diff --git a/.config/nextest.toml b/.config/nextest.toml
new file mode 100644
index 0000000000..2a4cd2cb93
--- /dev/null
+++ b/.config/nextest.toml
@@ -0,0 +1,3 @@
+# Minimum cargo-nextest for this repository: GHSA-vc25-qg58-w57c is fixed in 0.9.150 and CI
+# installs exactly that version, so an older nextest refuses to run (exit 92 REQUIRED_VERSION_NOT_MET).
+nextest-version = "0.9.150"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac276f13c9..94a4c545fe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - name: Windows font notice regressions
+        shell: pwsh
+        run: ./packaging/windows/test-font-notices.ps1
       - name: Git dependencies come from storytold
         run: |
           set -euo pipefail
@@ -73,13 +76,13 @@ jobs:
       # the org's 5 macOS slots are kept for release builds, and release.yml builds macOS.
       os: ${{ (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'full-ci')) && '["ubuntu-24.04","windows-latest"]' || '["ubuntu-24.04"]' }}
       # Same craft-fonts commit as release.yml and freebsd.yml.
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       # egui/winit/rfd, and the independent oracles (crates/oracle).
       packages: >-
         libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev
         libgtk-3-dev qpdf poppler-utils
       # cargo-deny for the deny step of `cargo xtask ci`, which requires it under CI.
-      tools: cargo-nextest@0.9.149,cargo-deny@0.20.2
+      tools: cargo-nextest@0.9.150,cargo-deny@0.20.2
       # A missing oracle fails the job instead of printing a skip notice that reads as a pass.
       linux-env: PDFCRAFT_ORACLES_REQUIRED=1
       windows-env: PDFCRAFT_REQUIRE_WINRES=1
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index fba20b1cc7..268da70ca1 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -26,4 +26,4 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c6ee0e1c31..a5c2ba7f7f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
     with:
       app-name: pdfcraft
       app-title: PdfCraft
-      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 7ca1124ce2..23ebcbbe82 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,37 +4,38 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with the SHA-256 of every asset but the translation catalogs, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (288)
+## In this repository (289)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
-| `crates/ui-egui/src/i18n/el.tsv` | Greek interface translation catalog | Camthalion77 and contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft English UI labels; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/zh-hans.tsv` | Simplified Chinese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/zh-hant.tsv` | Traditional Chinese (Taiwan) interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/cs.tsv` | Czech interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check and standard-identification wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/pt-br.tsv` | Brazilian Portuguese interface translation catalog | André Cardoso (andrecards), PdfCraft contributors | MIT OR Apache-2.0 | Clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources: the ~1,826-entry gist posted in issue #288 (https://gist.github.com/andrecards/ac388c25fba17312ce83207f8b7b467e), completed and reviewed by PdfCraft contributors; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table limit messages are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/es.tsv` | Spanish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; the 2026-10-20 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/fr.tsv` | French interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/de.tsv` | German interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/lo.tsv` | Lao interface translation catalog | @bounkirdni-2025 | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Lao UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/te.tsv` | Telugu interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/it.tsv` | Italian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/pl.tsv` | Polish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/ru.tsv` | Russian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/hu.tsv` | Hungarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/bg.tsv` | Bulgarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/kk.tsv` | Kazakh interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of the English UI labels into Kazakh, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Kazakh UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/ja.tsv` | Japanese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/uk.tsv` | Ukrainian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/ar.tsv` | Arabic interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/ckb.tsv` | Central Kurdish (Sorani) interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Central Kurdish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/tr.tsv` | Turkish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/lt.tsv` | Lithuanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; original catalog reviewed by a native Lithuanian-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/hi.tsv` | Hindi interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Hindi UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/id.tsv` | Indonesian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Indonesian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/ko.tsv` | Korean interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Korean UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/ro.tsv` | Romanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; AI-assisted and not yet reviewed line by line by a native Romanian speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Romanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/fi.tsv` | Finnish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: AI-assisted (Claude Code) clean-room translations of PdfCraft's English UI labels and user-facing messages; not yet proofread by a native Finnish speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 calculation-order, text-format, print, thumbnail, layer, comment-reshape and signature labels (previously English placeholders) are contributor-original AI-assisted translations from English, not separately native-reviewed | Finnish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/el.tsv` | Greek interface translation catalog | Camthalion77 and contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft English UI labels; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Greek UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/zh-hans.tsv` | Simplified Chinese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/zh-hant.tsv` | Traditional Chinese (Taiwan) interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/cs.tsv` | Czech interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check and standard-identification wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Czech UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/pt-br.tsv` | Brazilian Portuguese interface translation catalog | André Cardoso (andrecards), PdfCraft contributors | MIT OR Apache-2.0 | Clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources: the ~1,826-entry gist posted in issue #288 (https://gist.github.com/andrecards/ac388c25fba17312ce83207f8b7b467e), completed and reviewed by PdfCraft contributors; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table limit messages are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/es.tsv` | Spanish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; the 2026-10-20 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Spanish UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/fr.tsv` | French interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | French UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/de.tsv` | German interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | German UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/lo.tsv` | Lao interface translation catalog | @bounkirdni-2025 | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Lao UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/te.tsv` | Telugu interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Telugu UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/it.tsv` | Italian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Italian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/pl.tsv` | Polish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Polish UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/ru.tsv` | Russian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Russian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/hu.tsv` | Hungarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Hungarian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/bg.tsv` | Bulgarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/kk.tsv` | Kazakh interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of the English UI labels into Kazakh, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Kazakh UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/ja.tsv` | Japanese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Japanese UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/uk.tsv` | Ukrainian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/ar.tsv` | Arabic interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Arabic UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/ckb.tsv` | Central Kurdish (Sorani) interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Central Kurdish UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/fa.tsv` | Persian (Farsi) interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-25 initial catalog covering the current 2,776-entry key union, AI-assisted translations from English, not separately native-reviewed | Persian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/tr.tsv` | Turkish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Turkish UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/lt.tsv` | Lithuanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; original catalog reviewed by a native Lithuanian-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/hi.tsv` | Hindi interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Hindi UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/id.tsv` | Indonesian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Indonesian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/ko.tsv` | Korean interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Korean UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/ro.tsv` | Romanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; AI-assisted and not yet reviewed line by line by a native Romanian speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Romanian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/fi.tsv` | Finnish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: AI-assisted (Claude Code) clean-room translations of PdfCraft's English UI labels and user-facing messages; not yet proofread by a native Finnish speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 calculation-order, text-format, print, thumbnail, layer, comment-reshape and signature labels (previously English placeholders) are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Finnish UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
@@ -285,26 +286,27 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `packaging/macos/dmg/background.tiff` | PdfCraft macOS DMG window background (rendered) | @XusBadia | MIT OR Apache-2.0 | Rendered from packaging/macos/dmg/background.svg by packaging/macos/dmg/generate.py | 1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packaging/macos/package.sh; includes the app icon and the free LittleCMS built-in sRGB profile |
 | `crates/sign/tests/data/x509-rsa-sha1.pdf` | One-page PDF with a legacy adbe.x509.rsa_sha1 signature by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl dgst -sha1 -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/it/pdf.rs): the legacy adbe.x509.rsa_sha1 format |
 | `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `crates/ui-egui/src/i18n/vi.tsv` | Vietnamese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels; PhotoCraft and VectorCraft Vietnamese catalogs used only as translation memory when English source and semantic context matched; original catalog reviewed by a native Vietnamese-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/sl.tsv` | Slovene interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/vi.tsv` | Vietnamese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels; PhotoCraft and VectorCraft Vietnamese catalogs used only as translation memory when English source and semantic context matched; original catalog reviewed by a native Vietnamese-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/sl.tsv` | Slovene interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Slovene UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `vendor/vello_common/assets/probe.png` | vello_common probe reference image (rendered from probe.rgba) | Linebender vello contributors | MIT OR Apache-2.0 | vello_common 0.0.8 (crates.io), vendored in vendor/vello_common; regenerated by its vello_sparse_tests regenerate_probe_reference binary | Reference picture of the vendored vello_common probe module, for people only; the build reads probe.rgba, not this file |
-| `crates/ui-egui/src/i18n/nb.tsv` | Norwegian Bokmål interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/nb.tsv` | Norwegian Bokmål interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `assets/icons/superscript.svg` | Lucide icon "superscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/subscript.svg` | Lucide icon "subscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/pilcrow.svg` | Lucide icon "pilcrow" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/move-horizontal.svg` | Lucide icon "move-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `crates/ui-egui/src/i18n/sq.tsv` | Albanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-appearance labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Albanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/th.tsv` | Thai interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Thai UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
-| `crates/ui-egui/src/i18n/ca.tsv` | Catalan interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, written from their meaning; no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed | Catalan UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/sq.tsv` | Albanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-appearance labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Albanian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/th.tsv` | Thai interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Thai UI strings, compiled in by crates/ui-egui/src/i18n.rs |
+| `crates/ui-egui/src/i18n/ca.tsv` | Catalan interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, written from their meaning; no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Catalan UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 
-## Compiled in through dependencies (5)
+## Compiled in through dependencies (6)
 
 | Crate | File | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|---|
-| `epaint_default_fonts` 0.36.2 | `fonts/Ubuntu-Light.ttf` | Ubuntu Light | Canonical Ltd. / Dalton Maag | Ubuntu-font-1.0 | https://design.ubuntu.com/font | egui fallback fonts (eframe feature default_fonts) |
-| `epaint_default_fonts` 0.36.2 | `fonts/Hack-Regular.ttf` | Hack Regular | Source Foundry Authors (derived from Bitstream Vera / DejaVu) | MIT AND Bitstream-Vera | https://github.com/source-foundry/Hack | egui fallback fonts (eframe feature default_fonts) |
-| `epaint_default_fonts` 0.36.2 | `fonts/NotoEmoji-Regular.ttf` | Noto Emoji (monochrome) | Google Inc. | OFL-1.1 | https://github.com/googlefonts/noto-emoji | egui fallback fonts (eframe feature default_fonts) |
-| `epaint_default_fonts` 0.36.2 | `fonts/emoji-icon-font.ttf` | emoji-icon-font | John Slegers | MIT | https://github.com/jslegers/emoji-icon-font | egui fallback fonts (eframe feature default_fonts) |
+| `epaint_default_fonts` 0.37.0 | `fonts/Ubuntu-Light.ttf` | Ubuntu Light | Canonical Ltd. / Dalton Maag | Ubuntu-font-1.0 | https://design.ubuntu.com/font | egui fallback fonts (eframe feature default_fonts) |
+| `epaint_default_fonts` 0.37.0 | `fonts/Hack-Regular.ttf` | Hack Regular | Source Foundry Authors (derived from Bitstream Vera / DejaVu) | MIT AND Bitstream-Vera | https://github.com/source-foundry/Hack | egui fallback fonts (eframe feature default_fonts) |
+| `epaint_default_fonts` 0.37.0 | `fonts/NotoEmoji-Regular.ttf` | Noto Emoji (monochrome) | Google Inc. | OFL-1.1 | https://github.com/googlefonts/noto-emoji | egui monochrome fallback font (egui feature monochrome_emoji_fonts) |
+| `epaint_default_fonts` 0.37.0 | `fonts/emoji-icon-font.ttf` | emoji-icon-font | John Slegers | MIT | https://github.com/jslegers/emoji-icon-font | egui monochrome fallback font (egui feature monochrome_emoji_fonts) |
+| `epaint_default_fonts` 0.37.0 | `fonts/egui-icons.ttf` | egui icons (monochrome emoji-icon-font subset) | John Slegers | MIT | https://github.com/jslegers/emoji-icon-font | Small special-icon subset embedded by egui default_fonts; retained in FontDefinitions::default(). Provenance: https://github.com/storytold/egui/blob/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts/egui-icons.txt; complete MIT copyright and permission text in NOTICE. |
 | `hayro-interpret` 0.7.0 | `src/font/generated/metrics.rs` | Standard-14 font metrics and encodings (as Rust tables) (non-visual data, AGENTS.md §1.1) | Adobe (Core 14 AFM metrics, PDF specification encodings); tables by The Hayro Authors | MIT OR Apache-2.0 | ISO 32000-2 Annex D; Adobe Core14 AFM files (via vendored hayro-interpret) | Glyph widths and encodings for non-embedded standard fonts. Non-visual data, allowed by AGENTS.md §1.1 |
 
 ## Downloaded at build time (22)
@@ -333,8 +335,8 @@ Fonts are fetched by `cargo xtask demo-pdf` into `target/demo-fonts/`, OCR model
 | `NotoColorEmoji-Regular.ttf` | Noto Color Emoji | Google Inc. | OFL-1.1 | https://github.com/google/fonts/tree/9710da1eacb3be272583c3224dcb70f9da6eadbb/ofl/notocoloremoji | Showcase PDF (cargo xtask demo-pdf) |
 | `Inter[opsz,wght].ttf` | Inter (variable) | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/google/fonts/tree/9710da1eacb3be272583c3224dcb70f9da6eadbb/ofl/inter | Showcase PDF (cargo xtask demo-pdf) |
 | `Inter-Italic[opsz,wght].ttf` | Inter Italic (variable) | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/google/fonts/tree/9710da1eacb3be272583c3224dcb70f9da6eadbb/ofl/inter | Showcase PDF (cargo xtask demo-pdf) |
-| `text-detection.rten` | Ocrs text detection model | Robert Knight (ocrs-models; trained on HierText, CC-BY-SA-4.0) | CC-BY-SA-4.0 | https://github.com/robertknight/ocrs-models (the models ocrs downloads; model card: https://huggingface.co/robertknight/ocrs, cc-by-sa-4.0) | Scan & OCR: finds words on page images (cargo xtask models) |
-| `text-recognition.rten` | Ocrs text recognition model | Robert Knight (ocrs-models; trained on HierText, CC-BY-SA-4.0) | CC-BY-SA-4.0 | https://github.com/robertknight/ocrs-models (the models ocrs downloads; model card: https://huggingface.co/robertknight/ocrs, cc-by-sa-4.0) | Scan & OCR: reads the words it finds (cargo xtask models) |
+| `text-detection.onnx` | Ocrs text detection model | Robert Knight (ocrs-models; trained on HierText, CC-BY-SA-4.0) | CC-BY-SA-4.0 | https://github.com/robertknight/ocrs/blob/0c826441362a701c55560fefc17bf356b6d1037e/ocrs/examples/download-models.sh (author-published ONNX models; model card: https://huggingface.co/robertknight/ocrs/blob/df0edd170279ab971b53e094c627255a87e1a503/README.md, cc-by-sa-4.0) | Scan & OCR: finds words on page images (cargo xtask models) |
+| `text-recognition.onnx` | Ocrs text recognition model | Robert Knight (ocrs-models; trained on HierText, CC-BY-SA-4.0) | CC-BY-SA-4.0 | https://github.com/robertknight/ocrs/blob/0c826441362a701c55560fefc17bf356b6d1037e/ocrs/examples/download-models.sh (author-published ONNX models; model card: https://huggingface.co/robertknight/ocrs/blob/df0edd170279ab971b53e094c627255a87e1a503/README.md, cc-by-sa-4.0) | Scan & OCR: reads the words it finds (cargo xtask models) |
 
 ## Optional build inputs (1)
 
@@ -342,4 +344,4 @@ Not in this repository and never downloaded by it: compiled in only when the bui
 
 | Input | Option | Title | Author | Licence | Source | Attribution | Used for |
 |---|---|---|---|---|---|---|---|
-| `craft-fonts` | `CRAFT_FONTS_DIR` | Japanese fonts: BIZ UDPGothic (Regular, Bold), Shippori Mincho, BIZ UDMincho; Arabic font: Noto Sans Arabic | The BIZ UDGothic and BIZ UDMincho Project Authors (Morisawa Inc.), The Shippori Mincho Project Authors (FONTDASU), The Noto Project Authors (Noto Sans Arabic) | OFL-1.1 | https://github.com/storytold/craft-fonts (pinned by commit in .github/workflows/release.yml) | https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md | Japanese fallback in the interface (BIZ UDPGothic first) and Japanese glyphs in edited PDF text (Shippori Mincho); Arabic interface text, file names and document titles (Noto Sans Arabic); the web build embeds only BIZ UDPGothic Regular and Noto Sans Arabic. The checkout also holds Noto Sans CJK SC, which crates/fonts/build.rs leaves out for size |
+| `craft-fonts` | `CRAFT_FONTS_DIR` | Japanese fonts: BIZ UDPGothic (Regular, Bold), Shippori Mincho, BIZ UDMincho; native Simplified Chinese font: LXGW WenKai Lite; Arabic font: Noto Sans Arabic | The BIZ UDGothic and BIZ UDMincho Project Authors (Morisawa Inc.), The Shippori Mincho Project Authors (FONTDASU), LXGW and the original Klee Project Authors / Fontworks (LXGW WenKai Lite), The Noto Project Authors (Noto Sans Arabic) | OFL-1.1 | https://github.com/storytold/craft-fonts (pinned by commit in .github/workflows/release.yml and .github/workflows/ci.yml); LXGW WenKai Lite from https://github.com/lxgw/LxgwWenKai-Lite/releases/tag/v1.530 (commit b712c83d98acf977bacfb7fb010207802808bda9) | https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md | Japanese fallback in the interface (BIZ UDPGothic first) and Japanese glyphs in edited PDF text (Shippori Mincho); Simplified Chinese interface fallback on native builds only (LXGW WenKai Lite Regular, font SHA-256 f799a538a3355877e597a0ae04050e897932c9ae7689eb9227c2953c5dd549ea, OFL SHA-256 0333a85fe077b6849f8e417acc44e8bd879442ceb681e271acf93e2d57fd4e2e, read from fonts/simplified-chinese-manifest.txt and never embedded on wasm); Arabic interface text, file names and document titles (Noto Sans Arabic); the web build embeds BIZ UDPGothic Regular and the pinned small Arabic, Hebrew, Thai and Devanagari faces; the selected craft-fonts revision contains no Telugu face. Other non-Japanese CJK faces retain the general 4 MiB cap; the reviewed native-only LXGW fallback has a separate 16 MiB cap. Open-source OFL releases are permitted under current AGENTS.md §1.1 |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 9ca337e396..489247559d 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -2,11 +2,11 @@
 path = "crates/ui-egui/src/i18n/el.tsv"
 title = "Greek interface translation catalog"
 author = "Camthalion77 and contributors"
-source = "Contributor-original: clean-room translations of PdfCraft English UI labels; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft English UI labels; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 # ATTRIBUTION.toml: one entry per asset (AGENTS.md §1). The source of truth for provenance and licences.
 # ATTRIBUTION.md is generated from this file: `cargo xtask assets --write`. Checked by `cargo xtask assets` (part of `xtask ci`).
@@ -26,260 +26,270 @@ usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
 path = "crates/ui-egui/src/i18n/zh-hans.tsv"
 title = "Simplified Chinese interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
 title = "Traditional Chinese (Taiwan) interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
 title = "Czech interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check and standard-identification wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check and standard-identification wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
 title = "Brazilian Portuguese interface translation catalog"
 author = "André Cardoso (andrecards), PdfCraft contributors"
-source = "Clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources: the ~1,826-entry gist posted in issue #288 (https://gist.github.com/andrecards/ac388c25fba17312ce83207f8b7b467e), completed and reviewed by PdfCraft contributors; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table limit messages are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources: the ~1,826-entry gist posted in issue #288 (https://gist.github.com/andrecards/ac388c25fba17312ce83207f8b7b467e), completed and reviewed by PdfCraft contributors; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table limit messages are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
 title = "Spanish interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; the 2026-10-20 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; the 2026-10-20 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
 title = "French interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "French UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
 title = "German interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "German UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lo.tsv"
 title = "Lao interface translation catalog"
 author = "@bounkirdni-2025"
-source = "Contributor-original: clean-room translations of PdfCraft English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Lao UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Lao UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
 title = "Telugu interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
 title = "Italian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pl.tsv"
 title = "Polish interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
 title = "Russian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
 title = "Hungarian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
 title = "Bulgarian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/kk.tsv"
 title = "Kazakh interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of the English UI labels into Kazakh, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of the English UI labels into Kazakh, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Kazakh UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Kazakh UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
 title = "Japanese interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
 title = "Ukrainian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
 title = "Arabic interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ckb.tsv"
 title = "Central Kurdish (Sorani) interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Central Kurdish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Central Kurdish UI strings, compiled in by crates/ui-egui/src/i18n.rs"
+
+[[asset]]
+path = "crates/ui-egui/src/i18n/fa.tsv"
+title = "Persian (Farsi) interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-25 initial catalog covering the current 2,776-entry key union, AI-assisted translations from English, not separately native-reviewed"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "Persian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/tr.tsv"
 title = "Turkish interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Turkish UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lt.tsv"
 title = "Lithuanian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; original catalog reviewed by a native Lithuanian-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; original catalog reviewed by a native Lithuanian-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hi.tsv"
 title = "Hindi interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Hindi UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Hindi UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 [[asset]]
 path = "crates/ui-egui/src/i18n/id.tsv"
 title = "Indonesian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Indonesian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Indonesian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 [[asset]]
 path = "crates/ui-egui/src/i18n/ko.tsv"
 title = "Korean interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Korean UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Korean UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ro.tsv"
 title = "Romanian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; AI-assisted and not yet reviewed line by line by a native Romanian speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; AI-assisted and not yet reviewed line by line by a native Romanian speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Romanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Romanian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fi.tsv"
 title = "Finnish interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: AI-assisted (Claude Code) clean-room translations of PdfCraft's English UI labels and user-facing messages; not yet proofread by a native Finnish speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 calculation-order, text-format, print, thumbnail, layer, comment-reshape and signature labels (previously English placeholders) are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: AI-assisted (Claude Code) clean-room translations of PdfCraft's English UI labels and user-facing messages; not yet proofread by a native Finnish speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 calculation-order, text-format, print, thumbnail, layer, comment-reshape and signature labels (previously English placeholders) are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Finnish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Finnish UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
@@ -2429,7 +2439,7 @@ sha256 = "f225e0b044875b8fa6375b6b5ad935f0d99fcc1ad03ecf9f0baae2cedbfca4d2"
 
 [[bundled]]
 crate = "epaint_default_fonts"
-version = "0.36.2"
+version = "0.37.0"
 path = "fonts/Ubuntu-Light.ttf"
 title = "Ubuntu Light"
 author = "Canonical Ltd. / Dalton Maag"
@@ -2441,7 +2451,7 @@ sha256 = "80307b8da7649aa4ee4d484b232140e3ce1ec0ca093073d3c53c8f5a5ced7a70"
 
 [[bundled]]
 crate = "epaint_default_fonts"
-version = "0.36.2"
+version = "0.37.0"
 path = "fonts/Hack-Regular.ttf"
 title = "Hack Regular"
 author = "Source Foundry Authors (derived from Bitstream Vera / DejaVu)"
@@ -2453,28 +2463,40 @@ sha256 = "15f55cc0c85a2988d2b4b3a8cdb5d77fdfbaf319e1bb5309d725db9818fb7125"
 
 [[bundled]]
 crate = "epaint_default_fonts"
-version = "0.36.2"
+version = "0.37.0"
 path = "fonts/NotoEmoji-Regular.ttf"
 title = "Noto Emoji (monochrome)"
 author = "Google Inc."
 source = "https://github.com/googlefonts/noto-emoji"
 licence = "OFL-1.1"
 kind = "font"
-usage = "egui fallback fonts (eframe feature default_fonts)"
+usage = "egui monochrome fallback font (egui feature monochrome_emoji_fonts)"
 sha256 = "415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5"
 
 [[bundled]]
 crate = "epaint_default_fonts"
-version = "0.36.2"
+version = "0.37.0"
 path = "fonts/emoji-icon-font.ttf"
 title = "emoji-icon-font"
 author = "John Slegers"
 source = "https://github.com/jslegers/emoji-icon-font"
 licence = "MIT"
 kind = "font"
-usage = "egui fallback fonts (eframe feature default_fonts)"
+usage = "egui monochrome fallback font (egui feature monochrome_emoji_fonts)"
 sha256 = "f426bec371f484646d002717e2c555a95cd5145e635d83a48bbef83f3abf18ca"
 
+[[bundled]]
+crate = "epaint_default_fonts"
+version = "0.37.0"
+path = "fonts/egui-icons.ttf"
+title = "egui icons (monochrome emoji-icon-font subset)"
+author = "John Slegers"
+source = "https://github.com/jslegers/emoji-icon-font"
+licence = "MIT"
+kind = "font"
+usage = "Small special-icon subset embedded by egui default_fonts; retained in FontDefinitions::default(). Provenance: https://github.com/storytold/egui/blob/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts/egui-icons.txt; complete MIT copyright and permission text in NOTICE."
+sha256 = "122806555c73df7cef55aa1d945289ae27fbc4dbbd31abbb4204ee0cda829cc8"
+
 [[asset]]
 path = "vendor/hayro-cmap/assets/cmaps.brotli"
 title = "Adobe CMap resources (predefined CJK CMaps)"
@@ -3334,41 +3356,41 @@ usage = "1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packa
 sha256 = "f46881724a6621f3686a612a79dbdce4f7dbe9e2025610e44c9a094341334c2c"
 
 [[fetched]]
-file = "text-detection.rten"
-url = "https://ocrs-models.s3-accelerate.amazonaws.com/text-detection.rten"
+file = "text-detection.onnx"
+url = "https://ocrs-models.s3-accelerate.amazonaws.com/text-detection.onnx"
 title = "Ocrs text detection model"
 author = "Robert Knight (ocrs-models; trained on HierText, CC-BY-SA-4.0)"
-source = "https://github.com/robertknight/ocrs-models (the models ocrs downloads; model card: https://huggingface.co/robertknight/ocrs, cc-by-sa-4.0)"
+source = "https://github.com/robertknight/ocrs/blob/0c826441362a701c55560fefc17bf356b6d1037e/ocrs/examples/download-models.sh (author-published ONNX models; model card: https://huggingface.co/robertknight/ocrs/blob/df0edd170279ab971b53e094c627255a87e1a503/README.md, cc-by-sa-4.0)"
 licence = "CC-BY-SA-4.0"
 licence_url = "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt"
 licence_sha256 = "28a9529c7d0bb4dc51f4bf5c116a3d16ef247a052f7591466768ddf563fd1cf5"
 kind = "model"
 usage = "Scan & OCR: finds words on page images (cargo xtask models)"
-sha256 = "f15cfb56bd02c4bf478a20343986504a1f01e1665c2b3a0ad66340f054b1b5ca"
+sha256 = "a917b23dbd9524b465df7e922641b3ff2981623df4ded5a0234004ef2fee7cfe"
 
 [[fetched]]
-file = "text-recognition.rten"
-url = "https://ocrs-models.s3-accelerate.amazonaws.com/text-recognition.rten"
+file = "text-recognition.onnx"
+url = "https://ocrs-models.s3-accelerate.amazonaws.com/text-recognition.onnx"
 title = "Ocrs text recognition model"
 author = "Robert Knight (ocrs-models; trained on HierText, CC-BY-SA-4.0)"
-source = "https://github.com/robertknight/ocrs-models (the models ocrs downloads; model card: https://huggingface.co/robertknight/ocrs, cc-by-sa-4.0)"
+source = "https://github.com/robertknight/ocrs/blob/0c826441362a701c55560fefc17bf356b6d1037e/ocrs/examples/download-models.sh (author-published ONNX models; model card: https://huggingface.co/robertknight/ocrs/blob/df0edd170279ab971b53e094c627255a87e1a503/README.md, cc-by-sa-4.0)"
 licence = "CC-BY-SA-4.0"
 licence_url = "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt"
 licence_sha256 = "28a9529c7d0bb4dc51f4bf5c116a3d16ef247a052f7591466768ddf563fd1cf5"
 kind = "model"
 usage = "Scan & OCR: reads the words it finds (cargo xtask models)"
-sha256 = "e484866d4cce403175bd8d00b128feb08ab42e208de30e42cd9889d8f1735a6e"
+sha256 = "86c145c2edb96c8caed5b1ebb8f44d706408922211451c309c625157dd6061c5"
 
 [[build_input]]
 name = "craft-fonts"
 option = "CRAFT_FONTS_DIR"
-title = "Japanese fonts: BIZ UDPGothic (Regular, Bold), Shippori Mincho, BIZ UDMincho; Arabic font: Noto Sans Arabic"
-author = "The BIZ UDGothic and BIZ UDMincho Project Authors (Morisawa Inc.), The Shippori Mincho Project Authors (FONTDASU), The Noto Project Authors (Noto Sans Arabic)"
-source = "https://github.com/storytold/craft-fonts (pinned by commit in .github/workflows/release.yml)"
+title = "Japanese fonts: BIZ UDPGothic (Regular, Bold), Shippori Mincho, BIZ UDMincho; native Simplified Chinese font: LXGW WenKai Lite; Arabic font: Noto Sans Arabic"
+author = "The BIZ UDGothic and BIZ UDMincho Project Authors (Morisawa Inc.), The Shippori Mincho Project Authors (FONTDASU), LXGW and the original Klee Project Authors / Fontworks (LXGW WenKai Lite), The Noto Project Authors (Noto Sans Arabic)"
+source = "https://github.com/storytold/craft-fonts (pinned by commit in .github/workflows/release.yml and .github/workflows/ci.yml); LXGW WenKai Lite from https://github.com/lxgw/LxgwWenKai-Lite/releases/tag/v1.530 (commit b712c83d98acf977bacfb7fb010207802808bda9)"
 licence = "OFL-1.1"
 attribution = "https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md"
 kind = "font"
-usage = "Japanese fallback in the interface (BIZ UDPGothic first) and Japanese glyphs in edited PDF text (Shippori Mincho); Arabic interface text, file names and document titles (Noto Sans Arabic); the web build embeds only BIZ UDPGothic Regular and Noto Sans Arabic. The checkout also holds Noto Sans CJK SC, which crates/fonts/build.rs leaves out for size"
+usage = "Japanese fallback in the interface (BIZ UDPGothic first) and Japanese glyphs in edited PDF text (Shippori Mincho); Simplified Chinese interface fallback on native builds only (LXGW WenKai Lite Regular, font SHA-256 f799a538a3355877e597a0ae04050e897932c9ae7689eb9227c2953c5dd549ea, OFL SHA-256 0333a85fe077b6849f8e417acc44e8bd879442ceb681e271acf93e2d57fd4e2e, read from fonts/simplified-chinese-manifest.txt and never embedded on wasm); Arabic interface text, file names and document titles (Noto Sans Arabic); the web build embeds BIZ UDPGothic Regular and the pinned small Arabic, Hebrew, Thai and Devanagari faces; the selected craft-fonts revision contains no Telugu face. Other non-Japanese CJK faces retain the general 4 MiB cap; the reviewed native-only LXGW fallback has a separate 16 MiB cap. Open-source OFL releases are permitted under current AGENTS.md §1.1"
 
 [[asset]]
 path = "crates/sign/tests/data/x509-rsa-sha1.pdf"
@@ -3396,21 +3418,21 @@ sha256 = "d1a443233345724859de8e4fb48968ba91e885e12ddbd710701548bd91b39428"
 path = "crates/ui-egui/src/i18n/vi.tsv"
 title = "Vietnamese interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels; PhotoCraft and VectorCraft Vietnamese catalogs used only as translation memory when English source and semantic context matched; original catalog reviewed by a native Vietnamese-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels; PhotoCraft and VectorCraft Vietnamese catalogs used only as translation memory when English source and semantic context matched; original catalog reviewed by a native Vietnamese-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/sl.tsv"
 title = "Slovene interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Slovene UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 
@@ -3428,11 +3450,11 @@ sha256 = "78c59a0cfd2c829909d77006f94e34dac1ae5d1f90e7f10f72e84de541fef697"
 path = "crates/ui-egui/src/i18n/nb.tsv"
 title = "Norwegian Bokmål interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "assets/icons/superscript.svg"
@@ -3482,28 +3504,28 @@ sha256 = "864ab2f19254e6ac7240bc6a98323197332e8f714d4d3f94831f41309e5ef2f7"
 path = "crates/ui-egui/src/i18n/sq.tsv"
 title = "Albanian interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-appearance labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-appearance labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Albanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Albanian UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/th.tsv"
 title = "Thai interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Thai UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Thai UI strings, compiled in by crates/ui-egui/src/i18n.rs"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ca.tsv"
 title = "Catalan interface translation catalog"
 author = "PdfCraft contributors"
-source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, written from their meaning; no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, written from their meaning; no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed"
 licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
-usage = "Catalan UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+usage = "Catalan UI strings, compiled in by crates/ui-egui/src/i18n.rs"
diff --git a/CLAUDE.md b/CLAUDE.md
index 085e8356f6..f51a96d56e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -21,6 +21,7 @@ PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Ado
   - See `plan/README.md` §Clean-room and `plan/adr/0001`.
 - **Privacy.** When observing Acrobat, use synthetic fixtures only. Never capture the Home view, recent files or account info. Capture by window id (`plan/acrobat/tools/`). Never commit Acrobat outputs, corpus files or personal data.
 - **Layering.** Nothing below L7 depends on egui/winit/eframe/rfd (`plan/architecture.md` §3). `cos`/`filters`/`crypt`/`arlington` stay standalone.
+- **Page input.** Page modules read `PagePointer` (`crates/ui-egui/src/page_pointer.rs`), never egui's raw pointer state (`hover_pos`, `interact_pos`, `latest_pos`, `press_origin`, button reads); `page_pointer::tests::page_modules_read_the_pointer_only_through_page_pointer` enforces it.
 - **Fidelity.** The PDF object graph is the model. Preserve unknown data. Saves are incremental unless a full rewrite is required. Never silently drop or repair data without recording it.
 - **Never panic.** Every PDF, script, MCP call, settings file and keystroke is untrusted input, and none of it may crash the app or lose the user's work. This outranks feature work. Return `Result` (the crate's error enum) and propagate with `?`, or fall back leniently and record it. In non-test code:
   - No `unwrap`/`expect`/`panic!`/`unreachable!`/`todo!` unless it is provably infallible, with a comment saying why.
diff --git a/Cargo.lock b/Cargo.lock
index 8b49c9521c..b201da8413 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "accesskit"
-version = "0.24.1"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3b7f7f85a7e5f68090000ed7622545829afd484d210358702ae4cb97dd0c320"
+checksum = "ad442f58ee04714aaa0ba0a2768c1ea1935b29507bb22ddece8cbbc76db02932"
 dependencies = [
  "enumn",
  "serde",
@@ -15,57 +15,51 @@ dependencies = [
 
 [[package]]
 name = "accesskit_atspi_common"
-version = "0.18.1"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e8c61bee90b42a772d39d06a740207dc71a4e780004ace1db8d99fb1baaa954"
+checksum = "52c182f9c282ac9c5638d876d551d15e5f7d397ec263349a0c6a2b61595dd5e4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.36.0",
+ "accesskit_consumer",
  "atspi-common",
- "phf 0.13.1",
+ "phf 0.14.0",
  "serde",
  "zvariant",
 ]
 
 [[package]]
 name = "accesskit_consumer"
-version = "0.35.0"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53cf47daed85312e763fbf85ceca136e0d7abc68e0a7e12abe11f48172bc3b10"
+checksum = "8a45e2bb300bea6d5f33a82c3e051c3ddc6f41c209750f68a0acbe991a284344"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
-name = "accesskit_consumer"
-version = "0.36.0"
+name = "accesskit_ios"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25e0d7e25d06f4dc21d1774d67146e9e80d6789216cbd4d1e88185b0095dba60"
+checksum = "28e539d64b27fd4c14de8f78ada8f7c944c092f52f7e49fb63316507a57f6937"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "accesskit_consumer"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d10a236f96f87d70732e44520046785431ef01d5bcd6b041317bfadd2f88245"
-dependencies = [
- "accesskit",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit 0.2.2",
 ]
 
 [[package]]
 name = "accesskit_macos"
-version = "0.26.3"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce02dc63b43f0c9296af9ac946312a2dc8814427d7a64d2d600971dac55b6076"
+checksum = "5701624bf6a11efb6d4c8e922bf44126ed96250e5faa9a7a0468c979635839a4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.38.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "objc2 0.5.2",
  "objc2-app-kit 0.2.2",
  "objc2-foundation 0.2.2",
@@ -73,9 +67,9 @@ dependencies = [
 
 [[package]]
 name = "accesskit_unix"
-version = "0.21.1"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b016ca8db0ea0ea2ceff29a9d6240391492d960716aa471967c00e8cc8cb197c"
+checksum = "202f24df034a7476d07b7f74284de84f6d62aabd858dbe7ee9cad3b7ad6f8f9d"
 dependencies = [
  "accesskit",
  "accesskit_atspi_common",
@@ -91,13 +85,13 @@ dependencies = [
 
 [[package]]
 name = "accesskit_windows"
-version = "0.32.1"
+version = "0.35.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eff7009f1a532e917d66970a1e80c965140c6cfbbabbdde3d64e5431e6c78e21"
+checksum = "ce63f35d6bdcf59f26b76b3379063f738e6412cef46999cc772d46aa3de35adb"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "static_assertions",
  "windows",
  "windows-core",
@@ -105,11 +99,12 @@ dependencies = [
 
 [[package]]
 name = "accesskit_winit"
-version = "0.32.2"
+version = "0.34.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fe9a94394896352cc4660ca2288bd4ef883d83238853c038b44070c8f134313"
+checksum = "ee96dd150375c05912d8a473f98c2fb155fb3234fac88292d396548a2460fa77"
 dependencies = [
  "accesskit",
+ "accesskit_ios",
  "accesskit_macos",
  "accesskit_unix",
  "accesskit_windows",
@@ -220,21 +215,22 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arboard"
-version = "3.6.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+checksum = "aeb9553e62312c8756a5979254fc6d7da8bbeb5986a1e17037fab932f7037917"
 dependencies = [
  "clipboard-win",
  "image",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
+ "wl-clipboard-rs",
  "x11rb",
 ]
 
@@ -447,9 +443,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.18.1"
+version = "1.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
+checksum = "faac5829c2b74c28f830747e7818ccfb684261b5f48a1118b1e2a13d36dfab13"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -458,9 +454,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.45.0"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
+checksum = "f1622d8446a2d4b2ce0c7eefc73dd43a99779028d5ee5c2dd8073a658ba8a2bc"
 dependencies = [
  "cc",
  "cmake",
@@ -493,15 +489,6 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
-[[package]]
-name = "bit-set"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
-dependencies = [
- "bit-vec 0.8.0",
-]
-
 [[package]]
 name = "bit-set"
 version = "0.10.0"
@@ -512,10 +499,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "bit-vec"
-version = "0.8.0"
+name = "bit-set"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+checksum = "56d87354e4229f54a44f7bf2435906a4656dba36026ab6eaca629a2c436a691c"
+dependencies = [
+ "bit-vec 0.10.1",
+]
 
 [[package]]
 name = "bit-vec"
@@ -523,6 +513,16 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
 
+[[package]]
+name = "bit-vec"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5727b15fa97d4f4fee0a3b7c3d550ed0269f54329207b86388de918604e31269"
+dependencies = [
+ "borsh",
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -580,7 +580,7 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -649,7 +649,7 @@ dependencies = [
  "oneshot",
  "pastey",
  "portable-atomic",
- "rand 0.10.3",
+ "rand",
  "regress",
  "rustc-hash 2.1.3",
  "ryu-js",
@@ -740,6 +740,30 @@ dependencies = [
  "static_assertions",
 ]
 
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "borsh-derive",
+ "bytes",
+ "cfg_aliases",
+]
+
+[[package]]
+name = "borsh-derive"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56"
+dependencies = [
+ "once_cell",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "bp256"
 version = "0.14.0"
@@ -999,6 +1023,15 @@ dependencies = [
  "x509-cert",
 ]
 
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "codespan-reporting"
 version = "0.13.1"
@@ -1145,15 +1178,67 @@ dependencies = [
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+
+[[package]]
+name = "craft-fonts-build"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+
+[[package]]
+name = "craft-i18n"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+dependencies = [
+ "fixed_decimal",
+ "icu_decimal",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_normalizer",
+ "icu_plurals",
+ "icu_properties",
+ "icu_provider",
+ "icu_provider_adapters",
+ "icu_provider_blob",
+ "log",
+ "objc2-foundation 0.3.2",
+ "sys-locale",
+ "unicode-bidi",
+ "windows-registry",
+ "writeable",
+]
+
+[[package]]
+name = "craft-keymap"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+dependencies = [
+ "egui",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "craft-menu"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+dependencies = [
+ "craft-keymap",
+ "craft-quit",
+ "egui",
+ "muda",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+]
 
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=666c358065261a2816b376fa3bb10538dbf53040#666c358065261a2816b376fa3bb10538dbf53040"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
- "miniz_oxide 0.8.9",
- "roxmltree",
+ "craft-winprint-gdi",
+ "miniz_oxide 0.9.1",
+ "roxmltree 0.21.2",
  "tempfile",
  "winprint",
  "winsafe",
@@ -1162,22 +1247,66 @@ dependencies = [
 [[package]]
 name = "craft-quit"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=f58bc1a3df490992d633393d0898af0588ce882c#f58bc1a3df490992d633393d0898af0588ce882c"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "dispatch2",
  "egui",
- "muda",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
 ]
 
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=5c874d51eeb3de70e735c8ce87a59a7dedd47675#5c874d51eeb3de70e735c8ce87a59a7dedd47675"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
+ "craft-fonts-build",
+ "craft-i18n",
  "egui",
+ "epaint",
+ "js-sys",
+ "log",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
  "serde",
+ "skrifa 0.44.0",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "craft-update"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+dependencies = [
+ "chrono",
+ "dunce",
+ "egui",
+ "flate2",
+ "getrandom 0.3.4",
+ "log",
+ "plist",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "tar",
+ "tempfile",
+ "ureq",
+ "verifysign",
+ "winreg",
+ "winsafe",
+ "zip",
+]
+
+[[package]]
+name = "craft-winprint-gdi"
+version = "0.1.0"
+source = "git+https://github.com/storytold/winprint.rs?rev=417ac3c4d14d3da5485a99c7d5ce8f05664ec312#417ac3c4d14d3da5485a99c7d5ce8f05664ec312"
+dependencies = [
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1439,7 +1568,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -1535,9 +1664,8 @@ dependencies = [
 
 [[package]]
 name = "ecolor"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0656a7530b9e2841ee7a5f983965bdd9840c32f4012f759cfd44b912cced6b34"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "emath",
@@ -1561,16 +1689,15 @@ checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
- "sha2 0.11.0",
+ "sha2 0.11.1",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "eframe"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55ad41fac6e3149abb4866e93df37dbd33baa95db525c3368c944584e95a5dc2"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1585,7 +1712,7 @@ dependencies = [
  "image",
  "js-sys",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "parking_lot",
@@ -1594,6 +1721,7 @@ dependencies = [
  "profiling",
  "raw-window-handle",
  "ron",
+ "send_wrapper",
  "serde",
  "static_assertions",
  "wasm-bindgen",
@@ -1606,9 +1734,8 @@ dependencies = [
 
 [[package]]
 name = "egui"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc938cc27cd911415e1e4d151bc56ff9df063d8db081374e87aeb805ea74b2ba"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit",
  "ahash",
@@ -1628,7 +1755,8 @@ dependencies = [
 
 [[package]]
 name = "egui-wgpu"
-version = "0.36.2"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1646,32 +1774,35 @@ dependencies = [
 
 [[package]]
 name = "egui-winit"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98466000559d66ba4db786a30448b01483946add4188e7f10f522a27b4fb89cc"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit_winit",
  "arboard",
+ "block2 0.6.2",
  "bytemuck",
  "egui",
+ "image",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "objc2-ui-kit 0.3.2",
+ "parking_lot",
  "profiling",
  "raw-window-handle",
  "serde",
  "smithay-clipboard",
  "web-time",
  "webbrowser",
+ "windows-sys 0.61.2",
  "winit",
 ]
 
 [[package]]
 name = "egui_extras"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05cbdc785020861553f230f23d330ba1fb72613b9d8e0e457f3bdc8ba6db6dcf"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "egui",
@@ -1684,9 +1815,8 @@ dependencies = [
 
 [[package]]
 name = "egui_glow"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "606ed4167daf341e5753d703285c4c1d562324b2c07aa8f405cd7d066fe58f3b"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "egui",
@@ -1698,9 +1828,8 @@ dependencies = [
 
 [[package]]
 name = "egui_kittest"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb3f3effb2726fee23449293e67acbf6cc6ce35525b1722bd5743bb348114d5"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "eframe",
  "egui",
@@ -1742,9 +1871,8 @@ dependencies = [
 
 [[package]]
 name = "emath"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c8d4141cf0f60fb2f7aefaf352d3ffa5171ef0ab09731c64391801e95e48f1"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "serde",
@@ -1772,22 +1900,22 @@ checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
 [[package]]
 name = "enum-map"
-version = "2.7.3"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6866f3bfdf8207509a033af1a75a7b08abda06bbaaeae6669323fd5a097df2e9"
+checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
 dependencies = [
  "enum-map-derive",
 ]
 
 [[package]]
 name = "enum-map-derive"
-version = "0.17.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f282cfdfe92516eb26c2af8589c274c7c17681f5ecc03c18255fe741c6aa64eb"
+checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1824,9 +1952,8 @@ dependencies = [
 
 [[package]]
 name = "epaint"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0ec0308dc23130fc1a7d4623a8534c2ed069c6dc84e258ee4f3de99615aa1a3"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1843,16 +1970,17 @@ dependencies = [
  "serde",
  "skrifa 0.44.0",
  "smallvec",
+ "unicode-bidi",
  "unicode-general-category",
+ "unicode-properties",
  "unicode-segmentation",
- "vello_cpu 0.1.0",
+ "vello_cpu 0.2.0",
 ]
 
 [[package]]
 name = "epaint_default_fonts"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773fa9c96dd0dbef887e39d0ed6177f141cce4d68e6041df77570aa3702dfa13"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 
 [[package]]
 name = "equator"
@@ -1887,7 +2015,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1990,6 +2118,17 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixed_decimal"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2214fb00f669ee96bee5bb29dfb1ddabe058b2bc426817efc79afa03c9bc55ae"
+dependencies = [
+ "displaydoc",
+ "smallvec",
+ "writeable",
+]
+
 [[package]]
 name = "fixedbitset"
 version = "0.5.7"
@@ -2057,7 +2196,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90642cf66dde7f205dc8b42dfe57b47d0f3a29f571b832742883ef512e23fe55"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
 ]
@@ -2068,6 +2207,12 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "foldhash"
 version = "0.2.0"
@@ -2099,7 +2244,7 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbc773e24e02d4ddd8395fd30dc147524273a83e54e0f312d986ea30de5f5646"
 dependencies = [
- "roxmltree",
+ "roxmltree 0.20.0",
 ]
 
 [[package]]
@@ -2318,7 +2463,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d99fc21d493812643aae86d53b7bbd02f376434a90317e8a790bc209fdd6605e"
 dependencies = [
  "bytemuck",
- "foldhash",
+ "foldhash 0.2.0",
  "hashbrown 0.17.1",
  "log",
  "peniko",
@@ -2330,18 +2475,18 @@ dependencies = [
 
 [[package]]
 name = "glifo"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed4a1bb24121291d27230c1b1b44e07d6a9b28cefdb32fe1581dfb84e14f940a"
+checksum = "282a26c1e23de04bdab3e34a21b6f877a479b96737792516b9b8b8f69b6661be"
 dependencies = [
  "bytemuck",
- "foldhash",
+ "foldhash 0.2.0",
  "hashbrown 0.17.1",
  "log",
  "peniko",
  "skrifa 0.44.0",
  "smallvec",
- "vello_common 0.1.0",
+ "vello_common 0.2.0",
 ]
 
 [[package]]
@@ -2370,7 +2515,7 @@ dependencies = [
  "glutin_glx_sys",
  "glutin_wgl_sys",
  "libloading",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -2505,6 +2650,15 @@ version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash 0.1.5",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -2513,7 +2667,7 @@ checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash",
+ "foldhash 0.2.0",
 ]
 
 [[package]]
@@ -2524,7 +2678,7 @@ checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash",
+ "foldhash 0.2.0",
 ]
 
 [[package]]
@@ -2784,6 +2938,23 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_decimal"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb8f655bba2d0c0459e43a5b0e6cd3cd388109898fb3d85d048165e8b0abd08"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_locale_core",
+ "icu_pattern",
+ "icu_plurals",
+ "icu_provider",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_locale_core"
 version = "2.3.0"
@@ -2792,11 +2963,32 @@ checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
+ "serde",
  "tinystr",
  "writeable",
  "zerovec",
 ]
 
+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
 [[package]]
 name = "icu_normalizer"
 version = "2.3.0"
@@ -2809,6 +3001,7 @@ dependencies = [
  "icu_provider",
  "smallvec",
  "utf16_iter",
+ "utf8_iter",
  "write16",
  "zerovec",
 ]
@@ -2819,6 +3012,32 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
+[[package]]
+name = "icu_pattern"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b3db611446bd92c246b03e4aa0bafa71ddb194af431ddbb42b9d70e4bfce1a0"
+dependencies = [
+ "displaydoc",
+ "either",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e475e6766ef87b1d3c1f97be6363995b0bfaeddbc789671615df598a97ff0593"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_provider",
+ "serde",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_properties"
 version = "2.3.0"
@@ -2848,6 +3067,9 @@ checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
+ "postcard",
+ "serde",
+ "stable_deref_trait",
  "writeable",
  "yoke",
  "zerofrom",
@@ -2855,6 +3077,30 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_provider_adapters"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df887bc4f55dbc773c7c45a0c7dfa75be886f7b7812830a71ab7271cc1801820"
+dependencies = [
+ "icu_locale_fallback",
+ "icu_provider",
+]
+
+[[package]]
+name = "icu_provider_blob"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5916b44fac319d3f58e4d8d805a627df19e27937b582cd99fcde3bb6b7ce1b0e"
+dependencies = [
+ "icu_provider",
+ "postcard",
+ "serde",
+ "writeable",
+ "zerotrie",
+ "zerovec",
+]
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -3065,12 +3311,12 @@ checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
 
 [[package]]
 name = "kittest"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ceaa75eb0036a32b6b9833962eb18137449e9817e2e586006471925b727fd5"
+checksum = "0bb81a721ba76aa095b7f45deb180504f786904e56ca4b8e141f66eb89a78b75"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
+ "accesskit_consumer",
 ]
 
 [[package]]
@@ -3153,6 +3399,9 @@ name = "litemap"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "litrs"
@@ -3193,10 +3442,10 @@ dependencies = [
  "log",
  "md-5",
  "nom",
- "rand 0.10.3",
+ "rand",
  "rangemap",
  "rayon",
- "sha2 0.11.0",
+ "sha2 0.11.1",
  "stringprep",
  "thiserror 2.0.21",
  "weezl 0.2.1",
@@ -3298,13 +3547,13 @@ dependencies = [
  "crossbeam-channel",
  "dpi",
  "keyboard-types",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
  "png 0.18.1",
  "thiserror 2.0.21",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3381,6 +3630,18 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -3491,9 +3752,9 @@ dependencies = [
 
 [[package]]
 name = "objc2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
 dependencies = [
  "objc2-encode",
 ]
@@ -3522,7 +3783,7 @@ checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -3572,7 +3833,7 @@ checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
  "bitflags 2.13.2",
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -3583,7 +3844,7 @@ checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
 dependencies = [
  "bitflags 2.13.2",
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-io-surface",
 ]
@@ -3639,7 +3900,7 @@ checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
 ]
 
@@ -3650,7 +3911,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
 ]
 
@@ -3686,7 +3947,7 @@ checksum = "a0125f776a10d00af4152d74616409f0d4a2053a6f57fa5b7d6aa2854ac04794"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-foundation 0.3.2",
 ]
 
@@ -3710,7 +3971,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -3755,7 +4016,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
 ]
@@ -3846,6 +4107,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "p256"
 version = "0.14.0"
@@ -3856,7 +4127,7 @@ dependencies = [
  "elliptic-curve",
  "primefield",
  "primeorder",
- "sha2 0.11.0",
+ "sha2 0.11.1",
 ]
 
 [[package]]
@@ -3870,7 +4141,7 @@ dependencies = [
  "fiat-crypto",
  "primefield",
  "primeorder",
- "sha2 0.11.0",
+ "sha2 0.11.1",
 ]
 
 [[package]]
@@ -3884,7 +4155,7 @@ dependencies = [
  "elliptic-curve",
  "primefield",
  "primeorder",
- "sha2 0.11.0",
+ "sha2 0.11.1",
 ]
 
 [[package]]
@@ -3934,10 +4205,10 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "chrono",
- "craft-quit",
+ "craft-update",
  "eframe",
  "egui",
  "fmv-macos-events",
@@ -3946,10 +4217,8 @@ dependencies = [
  "pdfcraft-ui-egui",
  "pollster 1.0.1",
  "raw-window-handle",
- "rustls-native-certs",
  "serde_json",
  "uds_windows",
- "ureq",
  "wayland-client",
  "wayland-protocols",
  "windows",
@@ -3960,7 +4229,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-a11y"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -3972,7 +4241,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-annot"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -3983,7 +4252,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-audit"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -3994,9 +4263,9 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-automation"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "flate2",
  "image",
  "pdfcraft-cos",
@@ -4010,15 +4279,15 @@ dependencies = [
  "png 0.18.1",
  "rustix 1.1.5",
  "serde_json",
- "sha2 0.11.0",
+ "sha2 0.11.1",
  "tempfile",
 ]
 
 [[package]]
 name = "pdfcraft-cli"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "pdfcraft-audit",
  "pdfcraft-automation",
  "pdfcraft-cos",
@@ -4034,11 +4303,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-compare"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "pdfcraft-content"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4046,7 +4315,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cos"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "chrono",
  "hayro-syntax",
@@ -4061,7 +4330,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-create"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "encoding_rs",
  "hayro-syntax",
@@ -4077,19 +4346,19 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-crypt"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "aes",
  "md-5",
  "proptest",
- "sha2 0.11.0",
+ "sha2 0.11.1",
  "stringprep",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "pdfcraft-edit"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "hayro-syntax",
  "kurbo 0.13.1",
@@ -4104,7 +4373,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-engine"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "chrono",
  "craft-docpath",
@@ -4145,14 +4414,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-export"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "flate2",
 ]
 
 [[package]]
 name = "pdfcraft-filters"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "flate2",
  "proptest",
@@ -4162,7 +4431,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-fonts"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "harfrust",
  "pdfcraft-cos",
@@ -4172,7 +4441,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-forms"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4185,11 +4454,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-geom"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "pdfcraft-js"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "boa_engine",
  "chrono",
@@ -4197,7 +4466,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-measure"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4210,24 +4479,25 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-model"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "pdfcraft-cos",
 ]
 
 [[package]]
 name = "pdfcraft-ocr"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "ocrs",
  "pdfcraft-fonts",
  "rten",
+ "tempfile",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "pdfcraft-optimize"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "image",
  "pdfcraft-annot",
@@ -4242,11 +4512,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-oracle"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "pdfcraft-organize"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4257,7 +4527,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-platform"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "async-channel",
  "futures-lite",
@@ -4267,18 +4537,18 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-preflight"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "flate2",
  "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-model",
- "roxmltree",
+ "roxmltree 0.20.0",
 ]
 
 [[package]]
 name = "pdfcraft-print"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "craft-print",
  "pdfcraft-content",
@@ -4290,7 +4560,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-redact"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4306,7 +4576,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-render"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "bytemuck",
  "flate2",
@@ -4325,11 +4595,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-sign"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "aes",
  "aws-lc-rs",
- "base64 0.22.1",
+ "base64 0.23.1",
  "bp256",
  "bp384",
  "cbc",
@@ -4354,26 +4624,29 @@ dependencies = [
  "rustls-cng",
  "security-framework",
  "sha1 0.11.0",
- "sha2 0.11.0",
+ "sha2 0.11.1",
  "sha3",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "pdfcraft-testkit"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "pdfcraft-ui-egui"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "arboard",
- "base64 0.22.1",
+ "base64 0.23.1",
  "block2 0.6.2",
  "bytemuck",
  "chrono",
+ "craft-keymap",
+ "craft-menu",
  "craft-quit",
  "craft-ui",
+ "craft-update",
  "eframe",
  "egui",
  "egui_extras",
@@ -4383,7 +4656,7 @@ dependencies = [
  "image",
  "js-sys",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "pdfcraft-cos",
@@ -4407,13 +4680,14 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
+ "web-time",
  "winsafe",
  "xattr",
 ]
 
 [[package]]
 name = "pdfcraft-web"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "eframe",
  "egui",
@@ -4425,27 +4699,27 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfa"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "image",
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "png 0.18.1",
- "roxmltree",
- "sha2 0.11.0",
+ "roxmltree 0.20.0",
+ "sha2 0.11.1",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "pdfcraft-xfdf"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-cos",
  "pdfcraft-forms",
  "pdfcraft-model",
- "roxmltree",
+ "roxmltree 0.20.0",
  "thiserror 2.0.21",
 ]
 
@@ -4496,6 +4770,17 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
+]
+
 [[package]]
 name = "phf"
 version = "0.13.1"
@@ -4504,7 +4789,6 @@ checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
  "phf_macros 0.13.1",
  "phf_shared 0.13.1",
- "serde",
 ]
 
 [[package]]
@@ -4515,6 +4799,7 @@ checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
 dependencies = [
  "phf_macros 0.14.0",
  "phf_shared 0.14.0",
+ "serde",
 ]
 
 [[package]]
@@ -4668,9 +4953,9 @@ checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
 [[package]]
 name = "plist"
-version = "1.10.2"
+version = "1.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65dca778f41c79ebbe8b2b2139fee86f01b766b67130d108c7c2b8ffbd949f77"
+checksum = "327a4cb2ad49dc48adfdc9da89e22c64d488b508c67a044d71ba729e4521a285"
 dependencies = [
  "base64 0.23.1",
  "indexmap",
@@ -4755,12 +5040,24 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "serde",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
+ "serde_core",
+ "writeable",
  "zerovec",
 ]
 
@@ -4770,15 +5067,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
-[[package]]
-name = "ppv-lite86"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
-
 [[package]]
 name = "presser"
 version = "0.3.1"
@@ -4862,16 +5150,17 @@ checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
 
 [[package]]
 name = "proptest"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0"
 dependencies = [
- "bit-set 0.8.0",
- "bit-vec 0.8.0",
+ "bit-set 0.11.1",
+ "bit-vec 0.10.1",
  "bitflags 2.13.2",
+ "chacha20",
+ "core_detect",
  "num-traits",
- "rand 0.9.5",
- "rand_chacha",
+ "rand",
  "rand_xorshift",
  "regex-syntax",
  "rusty-fork",
@@ -4945,7 +5234,7 @@ dependencies = [
  "bytes",
  "getrandom 0.4.3",
  "lru-slab",
- "rand 0.10.3",
+ "rand",
  "rand_pcg",
  "ring",
  "rustc-hash 2.1.3",
@@ -4969,7 +5258,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4993,16 +5282,6 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
-[[package]]
-name = "rand"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
-dependencies = [
- "rand_chacha",
- "rand_core 0.9.5",
-]
-
 [[package]]
 name = "rand"
 version = "0.10.3"
@@ -5014,31 +5293,12 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.5",
-]
-
 [[package]]
 name = "rand_core"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 
-[[package]]
-name = "rand_core"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
-dependencies = [
- "getrandom 0.3.4",
-]
-
 [[package]]
 name = "rand_core"
 version = "0.10.1"
@@ -5056,11 +5316,11 @@ dependencies = [
 
 [[package]]
 name = "rand_xorshift"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf"
 dependencies = [
- "rand_core 0.9.5",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -5087,7 +5347,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40d213455a5f1dc59214213c7330e074ddf8114c9a42411eb890c767357ce135"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
  "objc2-quartz-core 0.3.2",
@@ -5280,7 +5540,7 @@ dependencies = [
  "js-sys",
  "libc",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -5348,6 +5608,15 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
 
+[[package]]
+name = "roxmltree"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9da7f59328b09405b181fee1018925fad50f157afb43c0c0f5c522c256dd5907"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "rsa"
 version = "0.10.0-rc.18"
@@ -5377,6 +5646,7 @@ dependencies = [
  "rten-base",
  "rten-gemm",
  "rten-model-file",
+ "rten-onnx",
  "rten-parallel",
  "rten-shape-inference",
  "rten-simd",
@@ -5426,6 +5696,12 @@ dependencies = [
  "rten-base",
 ]
 
+[[package]]
+name = "rten-onnx"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96944374568990b8d1bbc5bae5957585866f9dd8256130460405730948bfd42e"
+
 [[package]]
 name = "rten-parallel"
 version = "0.26.0"
@@ -5506,7 +5782,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5519,7 +5795,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5551,9 +5827,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4"
 dependencies = [
  "openssl-probe",
  "rustls-pki-types",
@@ -5589,7 +5865,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5718,6 +5994,16 @@ name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
 
 [[package]]
 name = "serde"
@@ -5751,9 +6037,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -5850,9 +6136,9 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.1",
@@ -6008,7 +6294,7 @@ dependencies = [
  "const-oid 0.9.6",
  "der 0.7.10",
  "hex",
- "rand 0.10.3",
+ "rand",
  "reqwest",
  "rustls-pki-types",
  "rustls-webpki",
@@ -6244,7 +6530,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6409,7 +6695,10 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eab9a99a024a169fe8a903cf9d4a3b3601109bcc13bd9e3c6fff259138626c4"
 dependencies = [
+ "js-sys",
  "libc",
+ "wasm-bindgen",
+ "web-sys",
 ]
 
 [[package]]
@@ -6463,10 +6752,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.5",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6604,6 +6893,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
+ "serde_core",
  "zerovec",
 ]
 
@@ -6800,6 +7090,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
 [[package]]
 name = "try-lock"
 version = "0.2.5"
@@ -6815,6 +7116,12 @@ dependencies = [
  "rustc-hash 2.1.3",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -6835,7 +7142,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6903,24 +7210,26 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "ureq"
-version = "3.4.2"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc"
+checksum = "cde93ff05758a36a851a398a772b0b79a82fbe3c186a46f2696baaeaf84c966b"
 dependencies = [
  "base64 0.23.1",
+ "flate2",
  "log",
  "percent-encoding",
  "rustls",
  "rustls-pki-types",
+ "rustls-platform-verifier",
  "ureq-proto",
  "utf8-zero",
 ]
 
 [[package]]
 name = "ureq-proto"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be"
+checksum = "841583fc36089d7d59419568ae157f43a5a03a2e5a81ba87c77d1596ef46e922"
 dependencies = [
  "base64 0.23.1",
  "http",
@@ -6953,7 +7262,7 @@ dependencies = [
  "kurbo 0.11.3",
  "log",
  "pico-args",
- "roxmltree",
+ "roxmltree 0.20.0",
  "simplecss",
  "siphasher",
  "strict-num",
@@ -7025,9 +7334,9 @@ dependencies = [
 
 [[package]]
 name = "vello_common"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
+checksum = "bbb2141a2bca6e6d598e471fd4d1d7eed8e020aad6a28187edda07f091a325dd"
 dependencies = [
  "bytemuck",
  "fearless_simd",
@@ -7053,14 +7362,24 @@ dependencies = [
 
 [[package]]
 name = "vello_cpu"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac7349e1f55f6b801c7c277958df4ea53e7f20f21e8014910ad888b2ecda93ea"
+checksum = "ace506ca414548966fcf3c283be94eb1cad8254de488791ee698bf438b0890a9"
 dependencies = [
  "bytemuck",
- "glifo 0.2.0",
+ "glifo 0.3.0",
  "hashbrown 0.17.1",
- "vello_common 0.1.0",
+ "vello_common 0.2.0",
+]
+
+[[package]]
+name = "verifysign"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6acfcc42a8d44f340d001193d97ef56bf33210b51ad760ae8308c97d5241ca51"
+dependencies = [
+ "core-foundation 0.10.1",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7332,7 +7651,7 @@ dependencies = [
  "jni",
  "log",
  "ndk-context",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "url",
@@ -7488,7 +7807,7 @@ dependencies = [
  "naga",
  "naga-types",
  "ndk-sys",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -7549,7 +7868,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -7670,16 +7989,16 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows-sys"
-version = "0.60.2"
+version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -7697,31 +8016,14 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
@@ -7739,99 +8041,52 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"
+source = "git+https://github.com/storytold/winit.git?rev=a517b3846ee8457d84ee4975110bfda6797c44dc#a517b3846ee8457d84ee4975110bfda6797c44dc"
 dependencies = [
  "ahash",
  "android-activity",
@@ -7909,10 +8164,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "winresource"
-version = "0.1.31"
+name = "winreg"
+version = "0.55.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+checksum = "cb5a765337c50e9ec252c2069be9bf91c7df47afb103b642ba3a53bf8101be97"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "winresource"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
 dependencies = [
  "toml",
  "version_check",
@@ -7930,6 +8195,24 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
 [[package]]
 name = "wnaf"
 version = "0.14.1"
@@ -7953,6 +8236,9 @@ name = "writeable"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+dependencies = [
+ "either",
+]
 
 [[package]]
 name = "x11-dl"
@@ -8076,7 +8362,7 @@ dependencies = [
  "png 0.18.1",
  "serde",
  "serde_json",
- "sha2 0.11.0",
+ "sha2 0.11.1",
  "toml",
 ]
 
@@ -8277,8 +8563,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
+ "litemap",
+ "serde_core",
  "yoke",
  "zerofrom",
+ "zerovec",
 ]
 
 [[package]]
@@ -8287,6 +8576,7 @@ version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
+ "serde",
  "yoke",
  "zerofrom",
  "zerovec-derive",
@@ -8303,6 +8593,23 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "zip"
+version = "9.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2886b00003a72c4ccee3f42cfc34908d33b2508a74d827dc2a4244706475c704"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "getrandom 0.4.3",
+ "indexmap",
+ "memchr",
+ "nix",
+ "typed-path",
+ "windows-sys 0.61.2",
+ "zopfli",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"
@@ -8315,6 +8622,18 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
+[[package]]
+name = "zopfli"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaf7fc5d30c28483d93805c4a5e12b05bbb52407fa67c5f8bd552374cd01fb11"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zune-core"
 version = "0.5.3"
@@ -8370,3 +8689,18 @@ dependencies = [
  "syn 3.0.6",
  "winnow",
 ]
+
+[[patch.unused]]
+name = "egui_demo_lib"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_inspection"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_system_font_provider"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
diff --git a/Cargo.toml b/Cargo.toml
index e7acfd31f9..99f9fa251b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["vendor"]
 default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.13.0"
+version = "0.14.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -13,47 +13,51 @@ repository = "https://github.com/storytold/pdfcraft"
 
 [workspace.dependencies]
 # Shared frontend components; engines remain independent of egui.
-craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["serde"] }
 # Quit the macOS way (#1136): ⌘Q asks about unsaved changes, and closing quits through `terminate:`.
-craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "f58bc1a3df490992d633393d0898af0588ce882c" }
+craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+# One menu definition for the native macOS menu bar and the in-window bar elsewhere.
+craft-menu = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", default-features = false }
 # Shared system spooler; document composition remains in pdfcraft-print.
-craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "666c358065261a2816b376fa3bb10538dbf53040" }
+craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
 # Whether a path stored in a document may be opened (GoToR link targets).
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["egui"] }
 # internal
-pdfcraft-geom = { path = "crates/geom", version = "0.13.0" }
-pdfcraft-filters = { path = "crates/filters", version = "0.13.0" }
-pdfcraft-cos = { path = "crates/cos", version = "0.13.0" }
-pdfcraft-crypt = { path = "crates/crypt", version = "0.13.0" }
-pdfcraft-organize = { path = "crates/organize", version = "0.13.0" }
-pdfcraft-measure = { path = "crates/measure", version = "0.13.0" }
-pdfcraft-annot = { path = "crates/annot", version = "0.13.0" }
-pdfcraft-audit = { path = "crates/audit", version = "0.13.0" }
-pdfcraft-fonts = { path = "crates/fonts", version = "0.13.0" }
-pdfcraft-model = { path = "crates/model", version = "0.13.0" }
-pdfcraft-content = { path = "crates/content", version = "0.13.0" }
-pdfcraft-redact = { path = "crates/redact", version = "0.13.0" }
-pdfcraft-print = { path = "crates/print", version = "0.13.0" }
-pdfcraft-xfdf = { path = "crates/xfdf", version = "0.13.0" }
-pdfcraft-sign = { path = "crates/sign", version = "0.13.0" }
-pdfcraft-optimize = { path = "crates/optimize", version = "0.13.0" }
-pdfcraft-a11y = { path = "crates/a11y", version = "0.13.0" }
-pdfcraft-oracle = { path = "crates/oracle", version = "0.13.0" }
-pdfcraft-testkit = { path = "crates/testkit", version = "0.13.0" }
-pdfcraft-ocr = { path = "crates/ocr", version = "0.13.0" }
-pdfcraft-js = { path = "crates/js", version = "0.13.0" }
-pdfcraft-compare = { path = "crates/compare", version = "0.13.0" }
-pdfcraft-preflight = { path = "crates/preflight", version = "0.13.0" }
-pdfcraft-export = { path = "crates/export", version = "0.13.0" }
-pdfcraft-edit = { path = "crates/edit", version = "0.13.0" }
-pdfcraft-create = { path = "crates/create", version = "0.13.0" }
-pdfcraft-forms = { path = "crates/forms", version = "0.13.0" }
-pdfcraft-xfa = { path = "crates/xfa", version = "0.13.0" }
-pdfcraft-render = { path = "crates/render", version = "0.13.0" }
-pdfcraft-engine = { path = "crates/engine", version = "0.13.0" }
-pdfcraft-platform = { path = "crates/platform", version = "0.13.0" }
-pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.13.0" }
-pdfcraft-automation = { path = "crates/automation", version = "0.13.0", default-features = false }
+pdfcraft-geom = { path = "crates/geom", version = "0.14.0" }
+pdfcraft-filters = { path = "crates/filters", version = "0.14.0" }
+pdfcraft-cos = { path = "crates/cos", version = "0.14.0" }
+pdfcraft-crypt = { path = "crates/crypt", version = "0.14.0" }
+pdfcraft-organize = { path = "crates/organize", version = "0.14.0" }
+pdfcraft-measure = { path = "crates/measure", version = "0.14.0" }
+pdfcraft-annot = { path = "crates/annot", version = "0.14.0" }
+pdfcraft-audit = { path = "crates/audit", version = "0.14.0" }
+pdfcraft-fonts = { path = "crates/fonts", version = "0.14.0" }
+pdfcraft-model = { path = "crates/model", version = "0.14.0" }
+pdfcraft-content = { path = "crates/content", version = "0.14.0" }
+pdfcraft-redact = { path = "crates/redact", version = "0.14.0" }
+pdfcraft-print = { path = "crates/print", version = "0.14.0" }
+pdfcraft-xfdf = { path = "crates/xfdf", version = "0.14.0" }
+pdfcraft-sign = { path = "crates/sign", version = "0.14.0" }
+pdfcraft-optimize = { path = "crates/optimize", version = "0.14.0" }
+pdfcraft-a11y = { path = "crates/a11y", version = "0.14.0" }
+pdfcraft-oracle = { path = "crates/oracle", version = "0.14.0" }
+pdfcraft-testkit = { path = "crates/testkit", version = "0.14.0" }
+pdfcraft-ocr = { path = "crates/ocr", version = "0.14.0" }
+pdfcraft-js = { path = "crates/js", version = "0.14.0" }
+pdfcraft-compare = { path = "crates/compare", version = "0.14.0" }
+pdfcraft-preflight = { path = "crates/preflight", version = "0.14.0" }
+pdfcraft-export = { path = "crates/export", version = "0.14.0" }
+pdfcraft-edit = { path = "crates/edit", version = "0.14.0" }
+pdfcraft-create = { path = "crates/create", version = "0.14.0" }
+pdfcraft-forms = { path = "crates/forms", version = "0.14.0" }
+pdfcraft-xfa = { path = "crates/xfa", version = "0.14.0" }
+pdfcraft-render = { path = "crates/render", version = "0.14.0" }
+pdfcraft-engine = { path = "crates/engine", version = "0.14.0" }
+pdfcraft-platform = { path = "crates/platform", version = "0.14.0" }
+pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.14.0" }
+pdfcraft-automation = { path = "crates/automation", version = "0.14.0", default-features = false }
 
 # pdf
 hayro = "0.7.1"
@@ -75,11 +79,13 @@ chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 proptest = "1"
 
 # ui
-egui = "0.36"
-egui_extras = { version = "0.36", default-features = false, features = ["svg"] }
-eframe = { version = "0.36", default-features = false }
-egui_kittest = "0.36"
+egui = "0.37"
+egui_extras = { version = "0.37", default-features = false, features = ["svg"] }
+eframe = { version = "0.37", default-features = false }
+egui_kittest = "0.37"
 rfd = "0.17"
+# Monotonic time for logic-only work on native and web (`App::logic` runs without a UI pass).
+web-time = "1.1"
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
@@ -118,6 +124,24 @@ hayro-cmap = { path = "vendor/hayro-cmap" }
 hayro-postscript = { path = "vendor/hayro-postscript" }
 hayro-jbig2 = { path = "vendor/hayro-jbig2" }
 lopdf = { path = "vendor/lopdf" }
-winit = { path = "vendor/winit" }
-egui-wgpu = { path = "vendor/egui-wgpu" }
 vello_common = { path = "vendor/vello_common" }
+# The egui and winit crates below are pinned to immutable storytold git revisions (egui
+# 6d518fc799681571963842f95b55a6b68431b15a, winit a517b3846ee8457d84ee4975110bfda6797c44dc).
+# Only the retained `vendor/winit` and `vendor/egui-wgpu` copies are provenance for the app's
+# earlier patches and their source guards, not path patches; the other `vendor/` entries above
+# remain real path patches. See vendor/README.md and the migration plan.
+ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint_default_fonts = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-winit = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-wgpu = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_glow = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_extras = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_kittest = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_system_font_provider = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+eframe = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_demo_lib = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_inspection = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+winit = { git = "https://github.com/storytold/winit.git", rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" }
diff --git a/NOTICE b/NOTICE
index 8cacb0b585..63a8fe672c 100644
--- a/NOTICE
+++ b/NOTICE
@@ -58,3 +58,21 @@ dependencies change (plan/adr/0002, 0006).
 Vendored (vendor/, patched; see vendor/README.md):
 - hayro 0.7.1 — Apache-2.0 OR MIT, Copyright the hayro authors (licence files kept in vendor/hayro).
 - hayro-interpret 0.7.0 — Apache-2.0 OR MIT, Copyright the hayro authors (LICENSE-APACHE, LICENSE-MIT kept in vendor/hayro-interpret).
+
+Bundled egui font icons
+
+The pinned egui dependency includes egui-icons.ttf, a small subset of John Slegers'
+emoji-icon-font, through default_fonts. The parent emoji-icon-font.ttf face is
+included through monochrome_emoji_fonts. Their upstream project is
+https://github.com/jslegers/emoji-icon-font; both use the same exact copyright
+and permission notice below.
+
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/README.md b/README.md
index d39bec5aa9..f319ffeadb 100644
--- a/README.md
+++ b/README.md
@@ -332,15 +332,13 @@ pdfcraft-cli ui --control ~/.pdfcraft-control.json inspect focused=true
 pdfcraft-cli ui --control ~/.pdfcraft-control.json quit
 ```
 
-`ui.dock` arranges the `tools` and `inspector` panels; `canvas` is the protected document view.
-Each per-panel request requires a `panel` ID and an `operation`: `open`, `close`,
-`activate`, `float` with `rect: [x, y, width, height]`, or `move` with `target` and
-`zone: center|left|right|top|bottom`. For example,
-`{"operation":"float","panel":"tools","rect":[100,100,320,440]}` floats Tools.
-`ui.dock.reset` restores the default
-arrangement. The control channel accepts these methods directly; `ui.command` also accepts
-`{"id":"ui.dock","params":{...}}`. Saved preferences retain groups, active tabs, visibility
-and floating geometry. Invalid requests return an error without changing the document or layout.
+`ui.panel` opens, closes or sizes a side panel: `{"panel":"tools"|"side","open":true|false,"width":320}`.
+`tools` is the Tools panel and `side` the panel the rail opens (reopening it shows the one open last).
+`width` is clamped to the panel's limits (Tools 240–520, side panel 260–520 points). `ui.dock.reset`
+resets the side panels: Tools open on the left, default widths. The control channel accepts these
+methods directly; `ui.command` also accepts `{"id":"ui.panel","params":{...}}`. Saved preferences keep
+the Tools side, the open panels and their widths. Invalid requests return an error without changing
+the document or the panels.
 
 
 `resize` requests a native inner-window size in logical points (each dimension must be between 320 and 8192); the window manager may constrain it. `state` reports the observed `window.width`, `window.height` and `window.pixels_per_point`. `focus` accepts exactly one widget `id` or unique enabled, focusable `label`; subsequent `key` requests traverse or activate the actual widgets. `inspect` includes focusability and accepts a `focused` filter. `quit` takes no parameters: clean documents exit normally, while unsaved edits or typing open the existing Save/Don't save/Cancel prompt and return `quitting: false, needs_confirmation: true`. It never silently discards work. Window resizing and application quit are native-only.
@@ -595,13 +593,4 @@ Forks and modified versions must remove them.
   <sub>Made by the <a href="https://getartcraft.com/">ArtCraft</a> team and community.</sub>
 </p>
 
-Tools and Inspector panels can be dragged into tab groups, split beside the PDF, or floated within the app window. Read and full-screen modes keep their existing focused document view. Drag a panel header to a target edge or another header. Its context menu offers Float panel, Move to group, and Close panel. Existing panel toggles reopen panels at their saved location; Reset Panel Layout restores the app layout. Floating panels remain inside the current app window.
-
-Advanced `ui.dock` operations use the same validated transaction as pointer gestures:
-`moveFloating` updates `rect`, `resizeSplit` accepts a boolean child `path` and
-`size` (`{"Ratio":0.5}`, `{"FixedFirst":280}`, or `{"FixedSecond":280}`),
-`setStackOpen` takes `open`, and `resizeStack` takes a point `height` or null.
-A center `move` can include `before` (panel ID or null to append) for tab order.
-The equivalent `{"action": ...}` form accepts a serialized shared docking action;
-this is also the form emitted by the renderer. Protected-canvas and app-specific panel
-rules apply equally to both forms.
+The Tools panel sits on the left, or on the right with Preferences ▸ Tools panel side. The rail stays at the right edge and opens one side panel beside it. Drag a panel's inner edge to resize it; widths are remembered. F4 shows or hides the side panel and Shift+F4 the Tools panel (also in the View menu); View ▸ Reset side panels restores the default arrangement.
diff --git a/ROADMAP.md b/ROADMAP.md
index 72e123df4c..f5de8044e1 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,8 @@
 
 **Stage: alpha** · next: beta, ~25% (ready for real work 50% → 75%) and ~400–700 h away
 
-> **Last reviewed:** 2026-10-23 | **Last updated:** 2026-10-23 | **Change:** minor (M8, #3205 follow-up: labelled Italian international phone numbers with a slash match whole; estimates unchanged)
+> **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
+> **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
 > **Last reviewed:** 2026-10-23 | **Last updated:** 2026-10-23 | **Change:** minor (M10: Word table cells use the widths of their own grid columns; estimates unchanged)
@@ -165,10 +166,10 @@ Portuguese and Spanish vs the current union). Detail and script notes: [localiza
 | Language | Code | Strings | Status |
 |---|---|---|---|
 | English | `en` | 100% | full |
-| Simplified Chinese | `zh-hans` | 97.4% | partial (no Hans UI face in releases, #826) |
+| Simplified Chinese | `zh-hans` | 97.4% | partial (native LXGW WenKai Lite; no Hans face in the web build, #826) |
 | Spanish | `es` | 100% of current union | partial (dialogs / tooltips; no help) |
 | Hindi | `hi` | 0% | none |
-| Arabic | `ar` | 100% | partial (layout not mirrored) |
+| Arabic | `ar` | 100% | partial (logical catalog, explicit RTL labels, mirrored stock chrome; native/browser/IME workflows unqualified) |
 | French | `fr` | 99.3% | partial |
 | Portuguese (Brazil) | `pt-br` | 100% of current union | partial |
 | Indonesian | `id` | 0% | none |
@@ -188,7 +189,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 | Rank | Milestone | Estimate (h) |
 |---|---|---|
 | 0 | Convert and share: Create PDF from Office, Word export that keeps layout (#773) | 32–55 |
-| 1 | Backlog and platform: crash and wrong-result reports, Chinese UI face (#826) | 50–90 |
+| 1 | Backlog and platform: crash and wrong-result reports, Chinese web UI face (#826) | 50–90 |
 | 2 | Fidelity harness against Acrobat and the renderer decision (M2; owner decision on #841) | 110–190 |
 | 3 | Editing existing content (M7) | 100–180 |
 | 4 | OCR languages and Office export/import (M10) | 95–175 |
@@ -199,6 +200,11 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-27 (M10, OCR models):** Model staging downloads and verifies the ONNX pair after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, retains complete RTEN fallback and preserves directory precedence.
+- **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
+- **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
+- **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
+
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
 - **2026-10-23 (M7, #2636 partial):** A new `PasteContent` edit pastes an added text box or image copied in the same document or another, keeping its style, picture, turns, flips and crop, as one undo step; `content_copy` drives it headlessly. A paste lands beside earlier copies (18 pt steps) and stays on the page. A pasted image reuses its picture object in its own document and after the first paste into another; there a colour profile is dropped and CMYK colours stored losslessly are turned to RGB. The desktop keys and menus follow in separate PRs. Estimates unchanged.
@@ -223,6 +229,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-20 (M3, #3535):** Escape with a menu open closes the menu and keeps the text selection; the next Escape clears it, as before. One keypress used to do both. A synthetic UI regression checks it. Estimates unchanged.
 - **2026-10-16 (M3, close prompt keyboard):** The "Save changes?" prompt opens with Save chosen (Enter saves, as before) and the arrow keys and Tab / Shift+Tab move the choice to Cancel or Don't save, shown with a focus ring; Enter or Space press the chosen button and Escape still cancels. Before, Enter always saved whatever was Tab-focused. Estimates unchanged.
 - **2026-10-21 (M3, #3808):** Page thumbnails in the Inspector can be resized independently from the document and Organize, with a slider, buttons and `thumbnail-zoom` control option. Selection, page following and reload are covered by regressions. Estimates unchanged.
+- **2026-10-22 (M5, comment threads):** Replies join the comment their `/IRT` references, not every comment sharing its `/NM`; PyMuPDF names each page's first comment `fitz-A0`, so all replies used to land under page 1. The Comments header counts comments without their replies, with the number of replies in small text under it (in every catalogue), and a reply's thread line runs from the avatar above it to its own. A reply to a reply shows in its thread in the panel too (it was listed nowhere), an `/IRT` that leads to no comment (itself, a loop, a pop-up, an unlisted object) leaves its annotation a comment of its own instead of hiding it (a status or checkmark that leads nowhere is listed nowhere), and a Replace Text caret isn't counted as a reply. The comment tools refuse an `id` several comments share instead of acting on the first (page 1's), and take `page` + `index` for those; `comment_list` reads a status or checkmark from the annotation it was set on, as the panel does, and reports a reply's own on the reply. UI, engine and automation regressions cover it. Estimates unchanged.
 - **2026-10-22 (M2, #3107 / PR #3438):** Inline-image parsing falls back to the existing EI heuristic when missing declared samples, headers or terminators exceed the content-window budget, instead of waiting for an impossible allocation. Exact-length parsing for available samples and ordinary large streamed images is retained. Estimates unchanged.
 - **2026-10-21 (M14, Brazilian Portuguese):** Completed the `pt-br` catalog against the current 2,674-key union, including signature validation and accessibility messages; no build or compilation run. Localization remains partial because help and unpredictable engine/OS error details are not translated.
 - **2026-10-21 (M14, #3557):** Preferences: the OK button stays below the scrolling settings instead of being the last thing in them, so it is in reach in a short window.
@@ -316,6 +323,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-15 (M12, XFA, #2574):** A `pageArea` with no `<occur>` repeats without limit instead of taking a subform's default of one use, so a later page area with `occur max="1"` is no longer drawn (with a copy of its fields) over every body page. Synthetic regression test; the page area's `occur min` (a once-only page of its own) is still not laid out, recorded in `form.xfa-dynamic`. Estimates unchanged.
 - **2026-10-14 (M12, reading colours, #2059):** Pending page backgrounds use the document's reading colour immediately, preventing white flashes while scrolling to uncached pages. A headless canvas regression covers three pending pages in every preset and a custom background. Estimates unchanged.
 - **2026-10-15 (community, M6, #2608):** In Prepare a form the selected field moves with the arrow keys: a point per press, ten with Shift, as the object nudge and dragging it do. Each press is one undo step ("Change field properties"), and the keys no longer turn the page while a field is selected. Estimates unchanged.
+- **2026-10-15 (M3, closable community card):** The ArtCraft community card on Home has a close button that hides it for the rest of the run; it returns on the next launch, and its links stay in the top bar's Discord button and the Help menu. A UI regression covers closing and the fresh-launch default. Estimates unchanged.
 - **2026-10-13 (community, M3, #1569 review):** Pixel-only Wayland wheel, wheel-tilt and continuous input use standalone moved events, so Ctrl zoom does not remain latched after the modifier is released (#991); vendored winit patch (13), with a policy test. Estimates unchanged.
 - **2026-10-15 (M14, #2383 candidate):** Device-limit requests now clamp unsupported maxima and minimum alignments before enabling the adapter's full 2D texture extent. This addresses the reported V3D request of 16 shader variables on an adapter supporting 15. Synthetic regressions fail before the clamp and pass afterward, along with the existing HiDPI case and Windows GPU-required application tests. Raspberry Pi startup remains unverified; milestone and overall estimates are unchanged.
 - **2026-10-12 (M6):** XFDF field import and data-file extraction join all text nodes in a value, preserving text after XML comments and processing instructions. Synthetic regressions cover Unicode, CDATA, empty values and PDF save/reopen. Estimates unchanged.
@@ -670,10 +678,13 @@ Newest first: the date, what moved, and the new overall estimate.
 
 ## Revision history
 
+**2026-10-25 · minor:** M14 localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Estimates unchanged.
+
 **2026-10-15 · minor:** M14/#2383 candidate: GPU device requests clamp unsupported limits while retaining the adapter texture extent. Synthetic V3D/downlevel regressions and Windows GPU-required tests pass; Raspberry Pi hardware remains unverified. Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
 | 2026-10-23 | minor | M11: image downsampling measures physical resolution after page-local UserUnit scaling, including shared nested forms; synthetic measurement and optimization regressions. Estimates unchanged. |
 | 2026-10-23 | minor | M10: Word table cells use the grid columns they span, including cells after a merged cell; synthetic export regression and CLI reproduction. Estimates unchanged. |
diff --git a/apps/pdfcraft-cli/Cargo.toml b/apps/pdfcraft-cli/Cargo.toml
index 7b5f9a82f3..3d9d87a812 100644
--- a/apps/pdfcraft-cli/Cargo.toml
+++ b/apps/pdfcraft-cli/Cargo.toml
@@ -21,7 +21,7 @@ pdfcraft-cos = { workspace = true }
 pdfcraft-preflight = { workspace = true }
 pdfcraft-automation = { workspace = true }
 pdfcraft-platform = { workspace = true }
-base64 = "0.22"
+base64 = "0.23"
 
 [dev-dependencies]
 # Decodes `render` output in tests/it/owner_password.rs; already a dependency of the engine.
diff --git a/apps/pdfcraft-cli/src/check.rs b/apps/pdfcraft-cli/src/check.rs
new file mode 100644
index 0000000000..1821f85826
--- /dev/null
+++ b/apps/pdfcraft-cli/src/check.rs
@@ -0,0 +1,206 @@
+use super::commands::{parse_dpi, read};
+use super::options::{AUDIT_OPTIONS, CHECK_ONE_OPTIONS, CHECK_OPTIONS, flag, positional, validate_options};
+use super::*;
+
+/// Audit a document for faux redactions. Prints the findings as JSON; fails when any are
+/// found so scripts and CI can gate on it, and when the audit itself cannot run.
+pub(crate) fn audit(args: &[String]) -> Result<(), CliError> {
+    validate_options("audit", args, AUDIT_OPTIONS)?;
+    let path = *positional(args, AUDIT_OPTIONS).first().ok_or("audit: missing file")?;
+    let bytes = read(path)?;
+    let password = flag(args, "--password");
+    let doc = pdfcraft_cos::Document::open_with_password(bytes.clone(), password).map_err(|e| format!("{path}: {e}"))?;
+    let findings = pdfcraft_audit::audit_redactions(&doc).map_err(|e| format!("{path}: {e}"))?;
+    // Rectangles in points from the top-left of the displayed page, as `doc_audit_redactions`
+    // reports them; the page geometry is read only when there is something to place.
+    let info = if findings.is_empty() {
+        None
+    } else {
+        let render_password = pdfcraft_engine::render_password_for(bytes.clone(), password);
+        Some(inspect(bytes, render_password.as_deref()).map_err(|e| format!("{path}: {e}"))?)
+    };
+    let items: Vec<serde_json::Value> = findings
+        .into_iter()
+        .map(|f| {
+            let rect = f.rect.map(|v| v as f32);
+            serde_json::json!({
+                "page": f.page + 1,
+                "kind": f.kind.id(),
+                "rect": info.as_ref().map_or(rect, |i| pdfcraft_automation::view_rect(i, f.page, rect)),
+                "covered_text": f.covered_text,
+            })
+        })
+        .collect();
+    println!("{}", serde_json::json!({ "file": path, "findings": items, "count": items.len() }));
+    if items.is_empty() { Ok(()) } else { Err(format!("audit: {} faux redaction(s) found", items.len()).into()) }
+}
+
+/// Child-process body for `check`: prints one JSON line.
+pub(crate) fn check_one(args: &[String]) -> Result<(), CliError> {
+    validate_options("check-one", args, CHECK_ONE_OPTIONS)?;
+    let path = *positional(args, CHECK_ONE_OPTIONS).first().ok_or("check-one: missing file")?;
+    let dpi = parse_dpi(flag(args, "--dpi").unwrap_or("36"))?;
+    let start = Instant::now();
+    let bytes = read(path)?;
+    let (status, pages, failed, detail, warnings) = match inspect(bytes.clone(), None) {
+        Err(e) => (format!("open-error:{}", short(&e.to_string())), 0, 0, e.to_string(), 0),
+        Ok(info) => {
+            let mut r = PageRenderer::new(bytes, RenderConfig::default());
+            let mut failed = Vec::new();
+            for i in 0..info.pages.len().min(500) {
+                let p = r.render(RenderRequest { page: i, kind: RequestKind::Pixels, tile: None, scale: dpi / 72.0, tag: 0, preview: false });
+                if let Some(e) = r.render(RenderRequest { page: i, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, preview: false }).error {
+                    failed.push(format!("p{} text: {e}", i + 1));
+                }
+                if let Some(e) = p.error {
+                    failed.push(format!("p{}: {e}", i + 1));
+                }
+            }
+            let status = if failed.is_empty() { "ok".to_string() } else { "page-errors".to_string() };
+            (status, info.pages.len(), failed.len(), failed.join(" | "), info.warnings.len())
+        }
+    };
+    // `--edit` (fuzzing): also run our own object layer end to end, with no panic safety net,
+    // so a panic in cos shows up as a crash of this process.
+    if args.iter().any(|a| a == "--edit") {
+        edit_round_trip(&std::fs::read(path).map_err(|e| e.to_string())?);
+    }
+    let line = serde_json::json!({ "file": path, "status": status, "pages": pages, "failed_pages": failed, "warnings": warnings,
+        "ms": start.elapsed().as_millis() as u64, "detail": detail.chars().take(400).collect::<String>() });
+    stdout_line(format_args!("{line}"))?;
+    Ok(())
+}
+
+/// Open with cos, touch every object, edit the catalog, save incrementally and in full (both
+/// output styles), and reopen each result. Errors are fine; panics, hangs and aborts are bugs.
+fn edit_round_trip(bytes: &[u8]) {
+    use pdfcraft_cos::{Document, Object, SaveOptions, write_full, write_incremental};
+    let Ok(mut doc) = Document::open(Arc::new(bytes.to_vec())) else { return };
+    for num in doc.object_numbers().into_iter().take(20_000) {
+        if let Ok(o) = doc.try_get(num)
+            && let Object::Stream(s) = &*o
+        {
+            let _ = s.decoded();
+        }
+    }
+    if let Some(root) = doc.root() {
+        let _ = doc.update_dict(root, |d| d.set(b"PdfCraftFuzz".to_vec(), Object::Bool(true)));
+    }
+    let classic = SaveOptions { object_streams: false, ..SaveOptions::default() };
+    for out in [write_incremental(&doc, &SaveOptions::default()), write_full(&doc, &SaveOptions::default()), write_full(&doc, &classic)]
+        .into_iter()
+        .flatten()
+    {
+        if let Ok(again) = Document::open(Arc::new(out)) {
+            let _ = again.root().map(|r| again.get(r));
+        }
+    }
+}
+
+fn short(s: &str) -> String {
+    s.split(|c: char| !c.is_alphanumeric()).filter(|w| !w.is_empty()).take(4).collect::<Vec<_>>().join("-").to_lowercase()
+}
+
+fn collect(paths: &[&str]) -> Vec<PathBuf> {
+    let mut out = Vec::new();
+    let mut stack: Vec<PathBuf> = paths.iter().map(PathBuf::from).collect();
+    let mut visited = std::collections::HashSet::new();
+    while let Some(p) = stack.pop() {
+        if p.is_dir() {
+            // Directory aliases and symlink cycles must not scan the same tree repeatedly.
+            let identity = match p.canonicalize() {
+                Ok(identity) => identity,
+                Err(error) => {
+                    eprintln!("{}: could not resolve directory: {error}", p.display());
+                    continue;
+                }
+            };
+            if !visited.insert(identity) {
+                continue;
+            }
+            if let Ok(rd) = std::fs::read_dir(&p) {
+                stack.extend(rd.flatten().map(|e| e.path()));
+            }
+        } else if p.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("pdf")) {
+            out.push(p);
+        }
+    }
+    out.sort();
+    out
+}
+
+pub(crate) fn check(args: &[String]) -> Result<(), CliError> {
+    validate_options("check", args, CHECK_OPTIONS)?;
+    // Every option is checked before the inputs are scanned, so a bad value is one message,
+    // not one problem per file: a zero timeout used to make every file time out, and a bad
+    // dpi used to reach each child, which printed nothing and was reported as a crash.
+    let timeout_value = flag(args, "--timeout").unwrap_or("20");
+    let timeout = Duration::from_secs(
+        timeout_value
+            .parse::<u64>()
+            .ok()
+            .filter(|secs| *secs > 0)
+            .ok_or_else(|| format!("bad --timeout: expected a positive whole number of seconds, got {timeout_value:?}"))?,
+    );
+    let dpi = flag(args, "--dpi").unwrap_or("36").to_string();
+    parse_dpi(&dpi)?;
+    let files = collect(&positional(args, CHECK_OPTIONS));
+    if files.is_empty() {
+        return Err("check: no PDF files found".into());
+    }
+    let exe = std::env::current_exe().map_err(|e| e.to_string())?;
+    let mut results = Vec::new();
+    let mut counts: std::collections::BTreeMap<String, usize> = Default::default();
+    for (n, f) in files.iter().enumerate() {
+        let r = run_child(&exe, f, &dpi, timeout);
+        let status = r["status"].as_str().unwrap_or("?").to_string();
+        *counts.entry(status.split(':').next().unwrap_or("?").to_string()).or_default() += 1;
+        if status != "ok" {
+            eprintln!(
+                "[{}/{}] {status:<28} {}  {}",
+                n + 1,
+                files.len(),
+                f.display(),
+                r["detail"].as_str().unwrap_or("").chars().take(160).collect::<String>()
+            );
+        }
+        results.push(r);
+    }
+    eprintln!("\nchecked {} files: {:?}", files.len(), counts);
+    if let Some(out) = flag(args, "--json") {
+        std::fs::write(out, serde_json::to_string_pretty(&results).unwrap_or_default()).map_err(|e| e.to_string())?;
+    }
+    Ok(())
+}
+
+fn run_child(exe: &Path, file: &Path, dpi: &str, timeout: Duration) -> serde_json::Value {
+    let file_s = file.to_string_lossy().to_string();
+    let child = Command::new(exe).args(["check-one", &file_s, "--dpi", dpi]).stdout(Stdio::piped()).stderr(Stdio::null()).spawn();
+    let mut child = match child {
+        Ok(c) => c,
+        Err(e) => return serde_json::json!({ "file": file_s, "status": "harness-error", "detail": e.to_string() }),
+    };
+    let start = Instant::now();
+    loop {
+        match child.try_wait() {
+            Ok(Some(status)) => {
+                let mut out = String::new();
+                if let Some(mut so) = child.stdout.take() {
+                    use std::io::Read;
+                    let _ = so.read_to_string(&mut out);
+                }
+                return match serde_json::from_str::<serde_json::Value>(out.trim()) {
+                    Ok(v) => v,
+                    Err(_) => serde_json::json!({ "file": file_s, "status": "crash", "detail": format!("child exited with {status}") }),
+                };
+            }
+            Ok(None) if start.elapsed() > timeout => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return serde_json::json!({ "file": file_s, "status": "timeout", "detail": format!("exceeded {}s", timeout.as_secs()) });
+            }
+            Ok(None) => std::thread::sleep(Duration::from_millis(20)),
+            Err(e) => return serde_json::json!({ "file": file_s, "status": "harness-error", "detail": e.to_string() }),
+        }
+    }
+}
diff --git a/apps/pdfcraft-cli/src/commands.rs b/apps/pdfcraft-cli/src/commands.rs
new file mode 100644
index 0000000000..5efec8331c
--- /dev/null
+++ b/apps/pdfcraft-cli/src/commands.rs
@@ -0,0 +1,413 @@
+use super::options::{
+    COMBINE_OPTIONS, EXTRACT_OPTIONS, INFO_OPTIONS, RENDER_OPTIONS, SPLIT_OPTIONS, TEXT_OPTIONS, can_be_path_value, flag, needs_value, positional,
+    validate_options,
+};
+use super::*;
+
+pub(crate) fn read(path: &str) -> Result<Arc<Vec<u8>>, String> {
+    std::fs::read(path).map(Arc::new).map_err(|e| format!("{path}: {e}"))
+}
+
+pub(crate) fn info(args: &[String]) -> Result<(), CliError> {
+    validate_options("info", args, INFO_OPTIONS)?;
+    let path = *positional(args, INFO_OPTIONS).first().ok_or("info: missing file")?;
+    let bytes = read(path)?;
+    let password = flag(args, "--password");
+    // The renderer takes only the user password of R2–R4 files; `Session::open` takes either.
+    let render_password = pdfcraft_engine::render_password_for(bytes.clone(), password);
+    let mut info = inspect(bytes.clone(), render_password.as_deref()).map_err(|e| e.to_string())?;
+    let pdf_pages = info.pages.len();
+    let acroform_fields = info.fields.len();
+    // Dynamic XFA forms: say what laying the template out gives (what the app shows).
+    let xfa_layout = (info.xfa == Some(pdfcraft_render::Xfa::Dynamic))
+        .then(|| {
+            let mut s = pdfcraft_engine::Session::new();
+            let id = s.open("info.pdf", None, bytes.clone(), password).ok()?;
+            let d = s.get(id)?;
+            d.xfa.as_ref().map(|x| {
+                info = d.info.clone();
+                // The in-memory layout is an appended revision, not the file being inspected.
+                info.file_size = bytes.len();
+                serde_json::json!({ "pages": x.pages, "fields": x.fields, "warnings": x.warnings })
+            })
+        })
+        .flatten();
+    // What the document declares as a standard, read the way the Standards panel reads it, so
+    // `info` and the app agree. A file that declares nothing leaves these null and empty.
+    let declared =
+        pdfcraft_cos::Document::open_with_password(bytes.clone(), password).map(|doc| pdfcraft_preflight::declared(&doc)).unwrap_or_default();
+    let json = serde_json::json!({
+        "file": path,
+        "pdf_version": info.pdf_version,
+        "file_size": info.file_size,
+        "pages": info.pages.len(),
+        "pdf_pages": pdf_pages, "acroform_fields": acroform_fields,
+        "first_page_pt": info.pages.first().map(|p| [p.width, p.height]),
+        "title": info.title, "author": info.author, "producer": info.producer, "creator": info.creator,
+        "encrypted": info.encrypted, "tagged": info.tagged, "javascript": info.has_javascript,
+        "pdfa": declared.pdfa.as_ref().map(|(part, conformance)| format!("PDF/A-{part}{}", conformance.to_lowercase())),
+        "pdfua": declared.pdfua,
+        "output_intents": declared.output_intents,
+        "xfa": info.xfa.map(|x| match x { pdfcraft_render::Xfa::Static => "static", pdfcraft_render::Xfa::Dynamic => "dynamic" }),
+        "xfa_layout": xfa_layout,
+        "bookmarks": info.outline.len(), "annotations": info.annotations.len(), "fields": info.fields.len(),
+        "links": info.links.len(), "layers": info.layers.len(), "attachments": info.attachments.len(),
+        "transitions": info.transitions.len(),
+        "custom_properties": info.custom.len(),
+        "page_labels": info.pages.iter().take(8).map(|p| p.label.clone()).collect::<Vec<_>>(),
+        "warnings": info.warnings,
+    });
+    stdout_line(format_args!("{}", serde_json::to_string_pretty(&json).unwrap_or_default()))?;
+    Ok(())
+}
+
+pub(crate) fn text(args: &[String]) -> Result<(), CliError> {
+    validate_options("text", args, TEXT_OPTIONS)?;
+    let path = *positional(args, TEXT_OPTIONS).first().ok_or("text: missing file")?;
+    let mut selected_page = None;
+    // Validate every supplied value before reading, retaining the first valid selection.
+    let mut options = args.iter();
+    while let Some(option) = options.next() {
+        if option == "--page" {
+            let page = options
+                .next()
+                .and_then(|value| value.parse::<usize>().ok())
+                .filter(|page| *page > 0)
+                .ok_or("bad --page: expected a positive page number")?;
+            selected_page.get_or_insert(page - 1);
+        } else if option.starts_with("--") {
+            // Match positional(): an option's operand is not itself another option.
+            options.next();
+        }
+    }
+    let password = flag(args, "--password");
+    let mut bytes = read(path)?;
+    // The renderer takes only the user password of R2–R4 files; `Session::open` takes either.
+    // Worked out from the file as read: `bytes` may become the session's display copy below.
+    let render_password = pdfcraft_engine::render_password_for(bytes.clone(), password);
+    // Printing the text is copying it, so ask what `text_extract` asks (#1645): without the
+    // permissions password, a document that doesn't allow copying gives no text.
+    let mut session = pdfcraft_engine::Session::new();
+    if let Some(doc) = session.open(path, None, bytes.clone(), password).ok().and_then(|id| session.get(id)) {
+        // The engine's hint is about editing in the app; on the command line the way in is
+        // `--password`.
+        doc.check_copying()
+            .map_err(|_| "text: the document's permissions don't allow copying its text; pass the owner password with --password to extract it")?;
+        if doc.xfa.is_some() {
+            bytes = doc.display.clone();
+        }
+    }
+    let mut r = PageRenderer::new(bytes.clone(), RenderConfig { password: render_password.as_deref().map(Arc::from), ..Default::default() });
+    // A document the renderer could not open (wrong or missing password, unparseable file) has
+    // no pages, and "extract every page" of nothing would print nothing and exit 0 (#132). Ask
+    // `inspect` why instead, so a protected file fails the same way `info` does.
+    if r.page_count() == 0 {
+        let info = inspect(bytes.clone(), render_password.as_deref()).map_err(|e| format!("text: {e}"))?;
+        if !info.pages.is_empty() {
+            return Err("text: the document could not be parsed".into());
+        }
+    }
+    let pages: Vec<usize> = match selected_page {
+        Some(page) => vec![page],
+        None => (0..r.page_count()).collect(),
+    };
+    let mut failed: Vec<usize> = Vec::new();
+    for (n, p) in pages.iter().enumerate() {
+        let out = r.render(RenderRequest { page: *p, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, preview: false });
+        if let Some(e) = out.error {
+            let _ = writeln!(std::io::stderr().lock(), "page {}: {e}", p + 1);
+            failed.push(p + 1);
+            continue;
+        }
+        if n > 0 {
+            stdout_line(format_args!("\u{c}"))?;
+        }
+        stdout_line(format_args!("{}", out.text.map(|t| t.plain_text()).unwrap_or_default()))?;
+    }
+    if failed.is_empty() {
+        Ok(())
+    } else {
+        Err(format!("text: page(s) {} could not be read", failed.iter().map(usize::to_string).collect::<Vec<_>>().join(", ")).into())
+    }
+}
+
+/// The most pages one `A-B` range may name: a bound on what a typed range can allocate.
+const MAX_RANGE: usize = 1_000_000;
+
+/// 1-based pages ("1,3,5-8": single pages and inclusive ranges, in the order given) → 0-based
+/// indices (#1923).
+fn page_list(s: &str) -> Result<Vec<usize>, String> {
+    let number = |t: &str, item: &str| t.trim().parse::<usize>().ok().filter(|n| *n > 0).ok_or_else(|| format!("bad page number {item:?}"));
+    let mut out = Vec::new();
+    for item in s.split(',').map(str::trim) {
+        match item.split_once('-') {
+            Some((from, to)) => {
+                let (from, to) = (number(from, item)?, number(to, item)?);
+                if to < from {
+                    return Err(format!("bad page range {item:?}: it ends before it starts"));
+                }
+                if to - from >= MAX_RANGE {
+                    return Err(format!("bad page range {item:?}: more than {MAX_RANGE} pages"));
+                }
+                out.extend(from - 1..to);
+            }
+            None => out.push(number(item, item)? - 1),
+        }
+    }
+    Ok(out)
+}
+
+/// The options `edit` understands, for its "unknown option" message.
+const EDIT_OPTIONS: &str = "--out, --password, --full, --rotate, --delete, --move, --insert-blank, --title, --author";
+
+/// Apply page and metadata edits through the engine and save (incrementally unless `--full`).
+///
+/// Every argument is parsed before the file is opened: an option this command does not know
+/// (a typo like `--rotat`) is an error, not something to skip — skipping it would write an
+/// unchanged copy and exit 0, which looks like a successful edit (#133).
+pub(crate) fn edit(args: &[String]) -> Result<(), CliError> {
+    use pdfcraft_engine::{Edit, Session};
+    let mut path: Option<&str> = None;
+    let mut out: Option<&str> = None;
+    let mut password: Option<&str> = None;
+    let mut full = false;
+    let mut edits = Vec::new();
+    let mut i = 0;
+    while let Some(arg) = args.get(i).map(String::as_str) {
+        // Options that take no value, and the input file.
+        match arg {
+            "--full" => {
+                full = true;
+                i += 1;
+                continue;
+            }
+            a if a.starts_with("--") => {}
+            a => {
+                if path.is_some() {
+                    return Err(format!("edit: unexpected argument {a:?} (one input file, then options)").into());
+                }
+                path = Some(a);
+                i += 1;
+                continue;
+            }
+        }
+        // `edit` parses its own options (they run in order), so `--out` is checked here in the
+        // same way: it wrote a PDF to a file called `--full`.
+        let value = args.get(i + 1).map(String::as_str);
+        if !can_be_path_value(arg, value) {
+            return Err(needs_value("edit", arg, value).into());
+        }
+        let value = value.ok_or_else(|| format!("edit: {arg} needs a value"))?;
+        match arg {
+            "--out" => out = Some(value),
+            "--password" => password = Some(value),
+            "--rotate" => {
+                let (pages, deg) = value.split_once(':').ok_or("--rotate PAGES:DEGREES")?;
+                let degrees: i64 = deg.parse().map_err(|_| format!("bad --rotate degrees: expected a whole number of degrees, got {deg:?}"))?;
+                // The same rule `rotate_pages` enforces, checked here so a bad angle is named
+                // with its option before any file is opened.
+                if degrees % 90 != 0 {
+                    return Err(format!("bad --rotate degrees: expected a multiple of 90 (such as 90, -90 or 180), got {degrees}").into());
+                }
+                edits.push(Edit::RotatePages { pages: page_list(pages)?, degrees });
+            }
+            "--delete" => edits.push(Edit::DeletePages { pages: page_list(value)? }),
+            "--move" => {
+                let (pages, to) = value.split_once(':').ok_or("--move PAGES:TO")?;
+                let target: usize = to
+                    .parse()
+                    .ok()
+                    .filter(|target| *target > 0)
+                    .ok_or_else(|| format!("bad --move target: expected a page number of at least 1, got {to:?}"))?;
+                edits.push(Edit::MovePages { pages: page_list(pages)?, to: target - 1 });
+            }
+            "--insert-blank" => {
+                let position: usize = value
+                    .parse()
+                    .ok()
+                    .filter(|position| *position > 0)
+                    .ok_or_else(|| format!("bad --insert-blank position: expected a page position of at least 1, got {value:?}"))?;
+                edits.push(Edit::InsertBlankPage { at: position - 1, width: 612.0, height: 792.0 });
+            }
+            "--title" => edits.push(Edit::SetInfo { key: "Title".into(), value: value.into() }),
+            "--author" => edits.push(Edit::SetInfo { key: "Author".into(), value: value.into() }),
+            other => return Err(format!("edit: unknown option {other:?} (expected one of: {EDIT_OPTIONS})").into()),
+        }
+        i += 2;
+    }
+    let path = path.ok_or("edit: missing file")?;
+    let out = out.ok_or("edit: missing --out")?;
+    let mut session = Session::new();
+    let id = session.open(path, Some(path.to_string()), read(path)?, password).map_err(|e| e.to_string())?;
+    for e in edits {
+        // A destination past the end must fail like `page_move` / `page_insert_blank` do, not
+        // silently become an append (#1330). Checked per edit: earlier edits change the count.
+        let n = session.get(id).map_or(0, |d| d.info.pages.len());
+        let destination = match &e {
+            Edit::MovePages { to, .. } => Some(("--move target", *to)),
+            Edit::InsertBlankPage { at, .. } => Some(("--insert-blank", *at)),
+            _ => None,
+        };
+        if let Some((option, at)) = destination.filter(|(_, at)| *at > n) {
+            return Err(format!("{option} {} is past the end: it must be between 1 and {} (the document has {n} pages)", at + 1, n + 1).into());
+        }
+        // Pages count from the document as the earlier options left it, so a page past the end is
+        // reported with its own option and the current page count (#1550).
+        let listed = match &e {
+            Edit::RotatePages { pages, .. } => Some(("--rotate", pages)),
+            Edit::DeletePages { pages } => Some(("--delete", pages)),
+            Edit::MovePages { pages, .. } => Some(("--move", pages)),
+            _ => None,
+        };
+        if let Some((option, bad)) = listed.and_then(|(option, pages)| pages.iter().find(|p| **p >= n).map(|p| (option, *p))) {
+            return Err(format!("{option}: page {} does not exist; after the earlier options the document has {n} pages", bad + 1).into());
+        }
+        session.apply(id, e).map_err(|e| e.to_string())?;
+    }
+    let bytes = if full { session.save_full_bytes(id) } else { session.save_bytes(id) }.map_err(|e| e.to_string())?;
+    // As the app's Save: the file must reopen with its pages before it replaces anything (#1698).
+    session.check_save(id, &bytes).map_err(|e| e.to_string())?;
+    write_pdf(Path::new(out), &bytes)
+}
+
+/// Write a PDF a command produced, through a staging file beside the target (#2166): a write
+/// that fails, or `--out` naming the input, never leaves a truncated file where a good one was.
+fn write_pdf(out: &Path, bytes: &[u8]) -> Result<(), CliError> {
+    use pdfcraft_platform::staging::{StagingName, write_atomically};
+    write_atomically(out, bytes, StagingName::SuffixThenTag).map_err(|e| format!("{}: {e}", out.display()).into())
+}
+
+fn file_stem(path: &str) -> String {
+    Path::new(path).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string())
+}
+
+pub(crate) fn combine(args: &[String]) -> Result<(), CliError> {
+    validate_options("combine", args, COMBINE_OPTIONS)?;
+    let out = flag(args, "--out").ok_or("combine: missing --out")?;
+    let inputs = positional(args, COMBINE_OPTIONS);
+    if inputs.len() < 2 {
+        return Err("combine: give at least two input files".into());
+    }
+    let sources = inputs.iter().map(|p| Ok((file_stem(p), read(p)?))).collect::<Result<Vec<_>, String>>()?;
+    let bytes = pdfcraft_engine::Session::new().combine(&sources).map_err(|e| e.to_string())?;
+    write_pdf(Path::new(out), &bytes)
+}
+
+pub(crate) fn extract(args: &[String]) -> Result<(), CliError> {
+    validate_options("extract", args, EXTRACT_OPTIONS)?;
+    let path = *positional(args, EXTRACT_OPTIONS).first().ok_or("extract: missing file")?;
+    let out = flag(args, "--out").ok_or("extract: missing --out")?;
+    let pages = page_list(flag(args, "--pages").ok_or("extract: missing --pages")?)?;
+    let mut session = pdfcraft_engine::Session::new();
+    let id = session.open(path, None, read(path)?, flag(args, "--password")).map_err(|e| e.to_string())?;
+    let bytes = session.extract(id, &pages).map_err(|e| e.to_string())?;
+    write_pdf(Path::new(out), &bytes)
+}
+
+pub(crate) fn split(args: &[String]) -> Result<(), CliError> {
+    validate_options("split", args, SPLIT_OPTIONS)?;
+    use pdfcraft_engine::SplitBy;
+    let path = *positional(args, SPLIT_OPTIONS).first().ok_or("split: missing file")?;
+    let by = match (flag(args, "--every"), flag(args, "--before")) {
+        (Some(n), None) => {
+            // A count the splitter cannot hold is refused here, before the file is opened,
+            // rather than silently clamped to 1 further down.
+            let count = n
+                .parse::<usize>()
+                .ok()
+                .filter(|count| *count > 0)
+                .ok_or_else(|| format!("bad --every: expected a positive whole number of pages, got {n:?}"))?;
+            SplitBy::PageCount(count)
+        }
+        (None, Some(list)) => SplitBy::Before(page_list(list)?),
+        _ => return Err("split: give either --every N or --before PAGES".into()),
+    };
+    let dir = PathBuf::from(flag(args, "--out-dir").unwrap_or("."));
+    let mut session = pdfcraft_engine::Session::new();
+    let id = session.open(path, None, read(path)?, flag(args, "--password")).map_err(|e| e.to_string())?;
+    let stem = file_stem(path);
+    let parts = session.split(id, &by).map_err(|e| e.to_string())?;
+    // An output folder that does not exist yet is created (#249); one that can't be is reported
+    // as the folder's problem, not as the first part's.
+    std::fs::create_dir_all(&dir).map_err(|e| format!("split: --out-dir {}: {e}", dir.display()))?;
+    for (a, b, bytes) in parts {
+        let name = dir.join(if a == b { format!("{stem}-p{a}.pdf") } else { format!("{stem}-p{a}-{b}.pdf") });
+        write_pdf(&name, &bytes)?;
+        stdout_line(format_args!("{}", name.display()))?;
+    }
+    Ok(())
+}
+
+/// A `--dpi` the renderer can be asked for: a positive, finite number. `0`, a negative value
+/// or `NaN` parse as an `f32` but reach the renderer as a scale it refuses with its own
+/// internal message (and in `check`, passed on as text, they would turn every file into a
+/// child that printed nothing), so the CLI names the option and the value instead.
+pub(crate) fn parse_dpi(value: &str) -> Result<f32, String> {
+    value
+        .parse::<f32>()
+        .ok()
+        .filter(|dpi| dpi.is_finite() && *dpi > 0.0)
+        .ok_or_else(|| format!("bad --dpi: expected a positive number of dots per inch, got {value:?}"))
+}
+
+pub(crate) fn render(args: &[String]) -> Result<(), CliError> {
+    validate_options("render", args, RENDER_OPTIONS)?;
+    let path = *positional(args, RENDER_OPTIONS).first().ok_or("render: missing file")?;
+    let page: usize =
+        flag(args, "--page").unwrap_or("1").parse().ok().filter(|page| *page > 0).ok_or("bad --page: expected a positive page number")?;
+    let page_index = page - 1;
+    let dpi = parse_dpi(flag(args, "--dpi").unwrap_or("96"))?;
+    let out = flag(args, "--out").ok_or("render: missing --out (.png, .jpg, .tif or .pam)")?;
+    // The file is what its name says (#248): a `.png` used to get a netpbm PAM stream.
+    let format = match Path::new(out).extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase).as_deref() {
+        Some("png") => Some(ImageFormat::Png),
+        Some("jpg" | "jpeg") => Some(ImageFormat::Jpeg { quality: 90 }),
+        Some("tif" | "tiff") => Some(ImageFormat::Tiff),
+        Some("pam") => None,
+        _ => return Err(format!("render: --out {out}: use a .png, .jpg, .tif or .pam name").into()),
+    };
+    // The app renders a display copy that draws comments missing their /AP streams; the CLI
+    // must agree with it (and with independent viewers), while keeping the file it reads intact.
+    let bytes = read(path)?;
+    let password = flag(args, "--password");
+    // The renderer takes only the user password of R2–R4 files; `Session::open` and the display
+    // copy take either.
+    let render_password = pdfcraft_engine::render_password_for(bytes.clone(), password);
+    let display = if inspect(bytes.clone(), render_password.as_deref()).is_ok_and(|info| info.xfa == Some(pdfcraft_render::Xfa::Dynamic)) {
+        let mut session = pdfcraft_engine::Session::new();
+        let id = session.open(path, None, bytes, password).map_err(|e| e.to_string())?;
+        session.get(id).ok_or("render: the document could not be opened")?.display.clone()
+    } else {
+        pdfcraft_engine::display_bytes_for(bytes, password)
+    };
+    let mut r =
+        PageRenderer::new(display, RenderConfig { password: render_password.as_deref().map(Arc::from), reject_oversize: true, ..Default::default() });
+    let p = r.render(RenderRequest { page: page_index, kind: RequestKind::Pixels, tile: None, scale: dpi / 72.0, tag: 0, preview: false });
+    if let Some(e) = p.error {
+        return Err(e.into());
+    }
+    let bytes = match format {
+        // With `reject_oversize` the page is drawn at `--dpi` or not at all, so the file can say so.
+        Some(f) => pdfcraft_engine::export::encode_image(p.width, p.height, &p.rgba, f, f64::from(dpi))?,
+        None => {
+            // PAM (netpbm RGB_ALPHA): the raw premultiplied pixels, for tools that read it.
+            let mut pam = format!("P7\nWIDTH {}\nHEIGHT {}\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n", p.width, p.height).into_bytes();
+            pam.extend_from_slice(&p.rgba);
+            pam
+        }
+    };
+    std::fs::write(out, bytes).map_err(|e| format!("{out}: {e}"))?;
+    let _ = writeln!(std::io::stderr().lock(), "rendered page {page} at {dpi} dpi: {}×{} px in {} ms", p.width, p.height, p.millis);
+    for warning in &p.warnings {
+        match warning {
+            pdfcraft_render::RenderWarning::ContentTruncated => {
+                let _ = writeln!(std::io::stderr().lock(), "warning: page {page}: content past the page's safety budget was skipped");
+            }
+            pdfcraft_render::RenderWarning::ColourFallback => {
+                let _ =
+                    writeln!(std::io::stderr().lock(), "warning: page {page}: a colour that could not be computed was painted in a fallback colour");
+            }
+        }
+    }
+    Ok(())
+}
diff --git a/apps/pdfcraft-cli/src/main.rs b/apps/pdfcraft-cli/src/main.rs
index 9ac3b21589..0c7fa9ba22 100644
--- a/apps/pdfcraft-cli/src/main.rs
+++ b/apps/pdfcraft-cli/src/main.rs
@@ -53,6 +53,20 @@ macro_rules! mcp_usage {
     };
 }
 
+mod check;
+mod commands;
+mod options;
+mod run;
+mod ui;
+
+use check::{audit, check, check_one};
+use commands::{combine, edit, extract, info, render, split, text};
+use options::{OptionSpec, flag, validate_options};
+#[cfg(feature = "mcp")]
+use run::mcp;
+use run::{automation, print_output, run, tools};
+use ui::ui;
+
 /// The full usage, printed by `--help` (also after a command, e.g. `render --help`).
 const USAGE: &str = concat!(
     "\
@@ -181,1055 +195,3 @@ fn version() -> Result<(), CliError> {
     stdout_line(format_args!("Source:  {}", pdfcraft_engine::links::GITHUB))?;
     Ok(())
 }
-
-/// Audit a document for faux redactions. Prints the findings as JSON; fails when any are
-/// found so scripts and CI can gate on it, and when the audit itself cannot run.
-fn audit(args: &[String]) -> Result<(), CliError> {
-    validate_options("audit", args, AUDIT_OPTIONS)?;
-    let path = *positional(args, AUDIT_OPTIONS).first().ok_or("audit: missing file")?;
-    let bytes = read(path)?;
-    let password = flag(args, "--password");
-    let doc = pdfcraft_cos::Document::open_with_password(bytes.clone(), password).map_err(|e| format!("{path}: {e}"))?;
-    let findings = pdfcraft_audit::audit_redactions(&doc).map_err(|e| format!("{path}: {e}"))?;
-    // Rectangles in points from the top-left of the displayed page, as `doc_audit_redactions`
-    // reports them; the page geometry is read only when there is something to place.
-    let info = if findings.is_empty() {
-        None
-    } else {
-        let render_password = pdfcraft_engine::render_password_for(bytes.clone(), password);
-        Some(inspect(bytes, render_password.as_deref()).map_err(|e| format!("{path}: {e}"))?)
-    };
-    let items: Vec<serde_json::Value> = findings
-        .into_iter()
-        .map(|f| {
-            let rect = f.rect.map(|v| v as f32);
-            serde_json::json!({
-                "page": f.page + 1,
-                "kind": f.kind.id(),
-                "rect": info.as_ref().map_or(rect, |i| pdfcraft_automation::view_rect(i, f.page, rect)),
-                "covered_text": f.covered_text,
-            })
-        })
-        .collect();
-    println!("{}", serde_json::json!({ "file": path, "findings": items, "count": items.len() }));
-    if items.is_empty() { Ok(()) } else { Err(format!("audit: {} faux redaction(s) found", items.len()).into()) }
-}
-
-fn flag<'a>(args: &'a [String], name: &str) -> Option<&'a str> {
-    args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).map(String::as_str)
-}
-
-#[derive(Clone, Copy)]
-struct OptionSpec {
-    name: &'static str,
-    takes_value: bool,
-}
-
-/// The options whose value is a file or folder. Only these refuse a value that is another
-/// option: a file named `--password` is never what was meant, while a password can be anything
-/// (`--password --page` is a password of `--page`, which tests/text.rs pins), and so can a title.
-/// The way to name a file that does start with `-` is `./--name`, as `--root` already offered.
-const PATH_VALUE_OPTIONS: [&str; 6] = ["--out", "--out-dir", "--json", "--root", "--control", "--script"];
-
-/// Whether a token can be the value of a path option. Another option cannot: `--out --password`
-/// used to write the PDF to a file called `--password` and exit 0 (photocraft#6944).
-fn can_be_path_value(name: &str, value: Option<&str>) -> bool {
-    !PATH_VALUE_OPTIONS.contains(&name) || value.is_some_and(|v| !v.is_empty() && !v.starts_with("--"))
-}
-
-/// The complaint about a path option whose value is missing or is another option.
-fn needs_value(command: &str, name: &str, value: Option<&str>) -> String {
-    match value {
-        Some(v) if !v.is_empty() => {
-            format!("{command}: {name} needs a value and `{v}` is another option; write `./{v}` for a file of that name")
-        }
-        _ => format!("{command}: {name} needs a value"),
-    }
-}
-
-/// Refuse unknown options and malformed confinement flags before any file is read.
-fn validate_options(command: &str, args: &[String], specs: &[OptionSpec]) -> Result<(), CliError> {
-    if specs.iter().any(|spec| spec.name == "--root") {
-        // `flag` searches every token, including another option's value. Match that lookup so
-        // a malformed confinement flag cannot be hidden there and fall back to no root.
-        let mut root_seen = false;
-        for (i, _) in args.iter().enumerate().filter(|(_, arg)| arg.as_str() == "--root") {
-            if root_seen {
-                return Err(format!("{command}: --root may only be supplied once").into());
-            }
-            root_seen = true;
-            if args.get(i + 1).is_none_or(|value| value.is_empty() || value.starts_with("--")) {
-                return Err(format!("{command}: --root needs a directory value").into());
-            }
-        }
-    }
-    let mut i = 0;
-    while let Some(arg) = args.get(i) {
-        if let Some(name) = arg.strip_prefix("--") {
-            let Some(spec) = specs.iter().find(|spec| spec.name == arg) else {
-                return Err(format!("{command}: unknown option --{name}").into());
-            };
-            // A file's name is not another option, which also closes the gap the walk left for
-            // those: an unknown option in that value position was skipped along with it. Other
-            // values, missing or malformed, are left to the command, which reports them in its
-            // own terms (`text` and `extract` explain what a page value must be).
-            i += if spec.takes_value {
-                let value = args.get(i + 1).map(String::as_str);
-                if !can_be_path_value(spec.name, value) {
-                    return Err(needs_value(command, spec.name, value).into());
-                }
-                2
-            } else {
-                1
-            };
-        } else {
-            i += 1;
-        }
-    }
-    Ok(())
-}
-
-const INFO_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--password", takes_value: true }];
-const AUDIT_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--password", takes_value: true }];
-const TEXT_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--page", takes_value: true }, OptionSpec { name: "--password", takes_value: true }];
-const COMBINE_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--out", takes_value: true }];
-const EXTRACT_OPTIONS: &[OptionSpec] = &[
-    OptionSpec { name: "--out", takes_value: true },
-    OptionSpec { name: "--pages", takes_value: true },
-    OptionSpec { name: "--password", takes_value: true },
-];
-const SPLIT_OPTIONS: &[OptionSpec] = &[
-    OptionSpec { name: "--every", takes_value: true },
-    OptionSpec { name: "--before", takes_value: true },
-    OptionSpec { name: "--out-dir", takes_value: true },
-    OptionSpec { name: "--password", takes_value: true },
-];
-const RENDER_OPTIONS: &[OptionSpec] = &[
-    OptionSpec { name: "--page", takes_value: true },
-    OptionSpec { name: "--dpi", takes_value: true },
-    OptionSpec { name: "--out", takes_value: true },
-    OptionSpec { name: "--password", takes_value: true },
-];
-const CHECK_ONE_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--dpi", takes_value: true }, OptionSpec { name: "--edit", takes_value: false }];
-const CHECK_OPTIONS: &[OptionSpec] = &[
-    OptionSpec { name: "--timeout", takes_value: true },
-    OptionSpec { name: "--dpi", takes_value: true },
-    OptionSpec { name: "--json", takes_value: true },
-];
-const RUN_OPTIONS: &[OptionSpec] = &[
-    OptionSpec { name: "--root", takes_value: true },
-    OptionSpec { name: "--script", takes_value: true },
-    OptionSpec { name: "--out", takes_value: true },
-    OptionSpec { name: "--report", takes_value: false },
-];
-const UI_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--control", takes_value: true }, OptionSpec { name: "--out", takes_value: true }];
-
-#[cfg(feature = "mcp")]
-const MCP_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--root", takes_value: true }, OptionSpec { name: "--compact", takes_value: false }];
-
-/// The arguments that are not options or their values. Which tokens are values is the spec's
-/// answer: skipping the one after every option made `check-one --edit file.pdf` report "missing
-/// file", the file having been read as `--edit`'s value.
-fn positional<'a>(args: &'a [String], specs: &[OptionSpec]) -> Vec<&'a str> {
-    let mut out = Vec::new();
-    let mut i = 0;
-    while let Some(a) = args.get(i) {
-        match specs.iter().find(|spec| spec.name == a.as_str()) {
-            Some(spec) if spec.takes_value => i += 2,
-            // An option that takes no value, and an unknown one, which `validate_options` has
-            // already refused by the time this runs.
-            Some(_) => i += 1,
-            None if a.starts_with("--") => i += 1,
-            None => {
-                out.push(a.as_str());
-                i += 1;
-            }
-        }
-    }
-    out
-}
-
-fn read(path: &str) -> Result<Arc<Vec<u8>>, String> {
-    std::fs::read(path).map(Arc::new).map_err(|e| format!("{path}: {e}"))
-}
-
-fn info(args: &[String]) -> Result<(), CliError> {
-    validate_options("info", args, INFO_OPTIONS)?;
-    let path = *positional(args, INFO_OPTIONS).first().ok_or("info: missing file")?;
-    let bytes = read(path)?;
-    let password = flag(args, "--password");
-    // The renderer takes only the user password of R2–R4 files; `Session::open` takes either.
-    let render_password = pdfcraft_engine::render_password_for(bytes.clone(), password);
-    let mut info = inspect(bytes.clone(), render_password.as_deref()).map_err(|e| e.to_string())?;
-    let pdf_pages = info.pages.len();
-    let acroform_fields = info.fields.len();
-    // Dynamic XFA forms: say what laying the template out gives (what the app shows).
-    let xfa_layout = (info.xfa == Some(pdfcraft_render::Xfa::Dynamic))
-        .then(|| {
-            let mut s = pdfcraft_engine::Session::new();
-            let id = s.open("info.pdf", None, bytes.clone(), password).ok()?;
-            let d = s.get(id)?;
-            d.xfa.as_ref().map(|x| {
-                info = d.info.clone();
-                // The in-memory layout is an appended revision, not the file being inspected.
-                info.file_size = bytes.len();
-                serde_json::json!({ "pages": x.pages, "fields": x.fields, "warnings": x.warnings })
-            })
-        })
-        .flatten();
-    // What the document declares as a standard, read the way the Standards panel reads it, so
-    // `info` and the app agree. A file that declares nothing leaves these null and empty.
-    let declared =
-        pdfcraft_cos::Document::open_with_password(bytes.clone(), password).map(|doc| pdfcraft_preflight::declared(&doc)).unwrap_or_default();
-    let json = serde_json::json!({
-        "file": path,
-        "pdf_version": info.pdf_version,
-        "file_size": info.file_size,
-        "pages": info.pages.len(),
-        "pdf_pages": pdf_pages, "acroform_fields": acroform_fields,
-        "first_page_pt": info.pages.first().map(|p| [p.width, p.height]),
-        "title": info.title, "author": info.author, "producer": info.producer, "creator": info.creator,
-        "encrypted": info.encrypted, "tagged": info.tagged, "javascript": info.has_javascript,
-        "pdfa": declared.pdfa.as_ref().map(|(part, conformance)| format!("PDF/A-{part}{}", conformance.to_lowercase())),
-        "pdfua": declared.pdfua,
-        "output_intents": declared.output_intents,
-        "xfa": info.xfa.map(|x| match x { pdfcraft_render::Xfa::Static => "static", pdfcraft_render::Xfa::Dynamic => "dynamic" }),
-        "xfa_layout": xfa_layout,
-        "bookmarks": info.outline.len(), "annotations": info.annotations.len(), "fields": info.fields.len(),
-        "links": info.links.len(), "layers": info.layers.len(), "attachments": info.attachments.len(),
-        "transitions": info.transitions.len(),
-        "custom_properties": info.custom.len(),
-        "page_labels": info.pages.iter().take(8).map(|p| p.label.clone()).collect::<Vec<_>>(),
-        "warnings": info.warnings,
-    });
-    stdout_line(format_args!("{}", serde_json::to_string_pretty(&json).unwrap_or_default()))?;
-    Ok(())
-}
-
-fn text(args: &[String]) -> Result<(), CliError> {
-    validate_options("text", args, TEXT_OPTIONS)?;
-    let path = *positional(args, TEXT_OPTIONS).first().ok_or("text: missing file")?;
-    let mut selected_page = None;
-    // Validate every supplied value before reading, retaining the first valid selection.
-    let mut options = args.iter();
-    while let Some(option) = options.next() {
-        if option == "--page" {
-            let page = options
-                .next()
-                .and_then(|value| value.parse::<usize>().ok())
-                .filter(|page| *page > 0)
-                .ok_or("bad --page: expected a positive page number")?;
-            selected_page.get_or_insert(page - 1);
-        } else if option.starts_with("--") {
-            // Match positional(): an option's operand is not itself another option.
-            options.next();
-        }
-    }
-    let password = flag(args, "--password");
-    let mut bytes = read(path)?;
-    // The renderer takes only the user password of R2–R4 files; `Session::open` takes either.
-    // Worked out from the file as read: `bytes` may become the session's display copy below.
-    let render_password = pdfcraft_engine::render_password_for(bytes.clone(), password);
-    // Printing the text is copying it, so ask what `text_extract` asks (#1645): without the
-    // permissions password, a document that doesn't allow copying gives no text.
-    let mut session = pdfcraft_engine::Session::new();
-    if let Some(doc) = session.open(path, None, bytes.clone(), password).ok().and_then(|id| session.get(id)) {
-        // The engine's hint is about editing in the app; on the command line the way in is
-        // `--password`.
-        doc.check_copying()
-            .map_err(|_| "text: the document's permissions don't allow copying its text; pass the owner password with --password to extract it")?;
-        if doc.xfa.is_some() {
-            bytes = doc.display.clone();
-        }
-    }
-    let mut r = PageRenderer::new(bytes.clone(), RenderConfig { password: render_password.as_deref().map(Arc::from), ..Default::default() });
-    // A document the renderer could not open (wrong or missing password, unparseable file) has
-    // no pages, and "extract every page" of nothing would print nothing and exit 0 (#132). Ask
-    // `inspect` why instead, so a protected file fails the same way `info` does.
-    if r.page_count() == 0 {
-        let info = inspect(bytes.clone(), render_password.as_deref()).map_err(|e| format!("text: {e}"))?;
-        if !info.pages.is_empty() {
-            return Err("text: the document could not be parsed".into());
-        }
-    }
-    let pages: Vec<usize> = match selected_page {
-        Some(page) => vec![page],
-        None => (0..r.page_count()).collect(),
-    };
-    let mut failed: Vec<usize> = Vec::new();
-    for (n, p) in pages.iter().enumerate() {
-        let out = r.render(RenderRequest { page: *p, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, preview: false });
-        if let Some(e) = out.error {
-            let _ = writeln!(std::io::stderr().lock(), "page {}: {e}", p + 1);
-            failed.push(p + 1);
-            continue;
-        }
-        if n > 0 {
-            stdout_line(format_args!("\u{c}"))?;
-        }
-        stdout_line(format_args!("{}", out.text.map(|t| t.plain_text()).unwrap_or_default()))?;
-    }
-    if failed.is_empty() {
-        Ok(())
-    } else {
-        Err(format!("text: page(s) {} could not be read", failed.iter().map(usize::to_string).collect::<Vec<_>>().join(", ")).into())
-    }
-}
-
-/// The most pages one `A-B` range may name: a bound on what a typed range can allocate.
-const MAX_RANGE: usize = 1_000_000;
-
-/// 1-based pages ("1,3,5-8": single pages and inclusive ranges, in the order given) → 0-based
-/// indices (#1923).
-fn page_list(s: &str) -> Result<Vec<usize>, String> {
-    let number = |t: &str, item: &str| t.trim().parse::<usize>().ok().filter(|n| *n > 0).ok_or_else(|| format!("bad page number {item:?}"));
-    let mut out = Vec::new();
-    for item in s.split(',').map(str::trim) {
-        match item.split_once('-') {
-            Some((from, to)) => {
-                let (from, to) = (number(from, item)?, number(to, item)?);
-                if to < from {
-                    return Err(format!("bad page range {item:?}: it ends before it starts"));
-                }
-                if to - from >= MAX_RANGE {
-                    return Err(format!("bad page range {item:?}: more than {MAX_RANGE} pages"));
-                }
-                out.extend(from - 1..to);
-            }
-            None => out.push(number(item, item)? - 1),
-        }
-    }
-    Ok(out)
-}
-
-/// The options `edit` understands, for its "unknown option" message.
-const EDIT_OPTIONS: &str = "--out, --password, --full, --rotate, --delete, --move, --insert-blank, --title, --author";
-
-/// Apply page and metadata edits through the engine and save (incrementally unless `--full`).
-///
-/// Every argument is parsed before the file is opened: an option this command does not know
-/// (a typo like `--rotat`) is an error, not something to skip — skipping it would write an
-/// unchanged copy and exit 0, which looks like a successful edit (#133).
-fn edit(args: &[String]) -> Result<(), CliError> {
-    use pdfcraft_engine::{Edit, Session};
-    let mut path: Option<&str> = None;
-    let mut out: Option<&str> = None;
-    let mut password: Option<&str> = None;
-    let mut full = false;
-    let mut edits = Vec::new();
-    let mut i = 0;
-    while let Some(arg) = args.get(i).map(String::as_str) {
-        // Options that take no value, and the input file.
-        match arg {
-            "--full" => {
-                full = true;
-                i += 1;
-                continue;
-            }
-            a if a.starts_with("--") => {}
-            a => {
-                if path.is_some() {
-                    return Err(format!("edit: unexpected argument {a:?} (one input file, then options)").into());
-                }
-                path = Some(a);
-                i += 1;
-                continue;
-            }
-        }
-        // `edit` parses its own options (they run in order), so `--out` is checked here in the
-        // same way: it wrote a PDF to a file called `--full`.
-        let value = args.get(i + 1).map(String::as_str);
-        if !can_be_path_value(arg, value) {
-            return Err(needs_value("edit", arg, value).into());
-        }
-        let value = value.ok_or_else(|| format!("edit: {arg} needs a value"))?;
-        match arg {
-            "--out" => out = Some(value),
-            "--password" => password = Some(value),
-            "--rotate" => {
-                let (pages, deg) = value.split_once(':').ok_or("--rotate PAGES:DEGREES")?;
-                let degrees: i64 = deg.parse().map_err(|_| format!("bad --rotate degrees: expected a whole number of degrees, got {deg:?}"))?;
-                // The same rule `rotate_pages` enforces, checked here so a bad angle is named
-                // with its option before any file is opened.
-                if degrees % 90 != 0 {
-                    return Err(format!("bad --rotate degrees: expected a multiple of 90 (such as 90, -90 or 180), got {degrees}").into());
-                }
-                edits.push(Edit::RotatePages { pages: page_list(pages)?, degrees });
-            }
-            "--delete" => edits.push(Edit::DeletePages { pages: page_list(value)? }),
-            "--move" => {
-                let (pages, to) = value.split_once(':').ok_or("--move PAGES:TO")?;
-                let target: usize = to
-                    .parse()
-                    .ok()
-                    .filter(|target| *target > 0)
-                    .ok_or_else(|| format!("bad --move target: expected a page number of at least 1, got {to:?}"))?;
-                edits.push(Edit::MovePages { pages: page_list(pages)?, to: target - 1 });
-            }
-            "--insert-blank" => {
-                let position: usize = value
-                    .parse()
-                    .ok()
-                    .filter(|position| *position > 0)
-                    .ok_or_else(|| format!("bad --insert-blank position: expected a page position of at least 1, got {value:?}"))?;
-                edits.push(Edit::InsertBlankPage { at: position - 1, width: 612.0, height: 792.0 });
-            }
-            "--title" => edits.push(Edit::SetInfo { key: "Title".into(), value: value.into() }),
-            "--author" => edits.push(Edit::SetInfo { key: "Author".into(), value: value.into() }),
-            other => return Err(format!("edit: unknown option {other:?} (expected one of: {EDIT_OPTIONS})").into()),
-        }
-        i += 2;
-    }
-    let path = path.ok_or("edit: missing file")?;
-    let out = out.ok_or("edit: missing --out")?;
-    let mut session = Session::new();
-    let id = session.open(path, Some(path.to_string()), read(path)?, password).map_err(|e| e.to_string())?;
-    for e in edits {
-        // A destination past the end must fail like `page_move` / `page_insert_blank` do, not
-        // silently become an append (#1330). Checked per edit: earlier edits change the count.
-        let n = session.get(id).map_or(0, |d| d.info.pages.len());
-        let destination = match &e {
-            Edit::MovePages { to, .. } => Some(("--move target", *to)),
-            Edit::InsertBlankPage { at, .. } => Some(("--insert-blank", *at)),
-            _ => None,
-        };
-        if let Some((option, at)) = destination.filter(|(_, at)| *at > n) {
-            return Err(format!("{option} {} is past the end: it must be between 1 and {} (the document has {n} pages)", at + 1, n + 1).into());
-        }
-        // Pages count from the document as the earlier options left it, so a page past the end is
-        // reported with its own option and the current page count (#1550).
-        let listed = match &e {
-            Edit::RotatePages { pages, .. } => Some(("--rotate", pages)),
-            Edit::DeletePages { pages } => Some(("--delete", pages)),
-            Edit::MovePages { pages, .. } => Some(("--move", pages)),
-            _ => None,
-        };
-        if let Some((option, bad)) = listed.and_then(|(option, pages)| pages.iter().find(|p| **p >= n).map(|p| (option, *p))) {
-            return Err(format!("{option}: page {} does not exist; after the earlier options the document has {n} pages", bad + 1).into());
-        }
-        session.apply(id, e).map_err(|e| e.to_string())?;
-    }
-    let bytes = if full { session.save_full_bytes(id) } else { session.save_bytes(id) }.map_err(|e| e.to_string())?;
-    // As the app's Save: the file must reopen with its pages before it replaces anything (#1698).
-    session.check_save(id, &bytes).map_err(|e| e.to_string())?;
-    write_pdf(Path::new(out), &bytes)
-}
-
-/// Write a PDF a command produced, through a staging file beside the target (#2166): a write
-/// that fails, or `--out` naming the input, never leaves a truncated file where a good one was.
-fn write_pdf(out: &Path, bytes: &[u8]) -> Result<(), CliError> {
-    use pdfcraft_platform::staging::{StagingName, write_atomically};
-    write_atomically(out, bytes, StagingName::SuffixThenTag).map_err(|e| format!("{}: {e}", out.display()).into())
-}
-
-fn file_stem(path: &str) -> String {
-    Path::new(path).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string())
-}
-
-fn combine(args: &[String]) -> Result<(), CliError> {
-    validate_options("combine", args, COMBINE_OPTIONS)?;
-    let out = flag(args, "--out").ok_or("combine: missing --out")?;
-    let inputs = positional(args, COMBINE_OPTIONS);
-    if inputs.len() < 2 {
-        return Err("combine: give at least two input files".into());
-    }
-    let sources = inputs.iter().map(|p| Ok((file_stem(p), read(p)?))).collect::<Result<Vec<_>, String>>()?;
-    let bytes = pdfcraft_engine::Session::new().combine(&sources).map_err(|e| e.to_string())?;
-    write_pdf(Path::new(out), &bytes)
-}
-
-fn extract(args: &[String]) -> Result<(), CliError> {
-    validate_options("extract", args, EXTRACT_OPTIONS)?;
-    let path = *positional(args, EXTRACT_OPTIONS).first().ok_or("extract: missing file")?;
-    let out = flag(args, "--out").ok_or("extract: missing --out")?;
-    let pages = page_list(flag(args, "--pages").ok_or("extract: missing --pages")?)?;
-    let mut session = pdfcraft_engine::Session::new();
-    let id = session.open(path, None, read(path)?, flag(args, "--password")).map_err(|e| e.to_string())?;
-    let bytes = session.extract(id, &pages).map_err(|e| e.to_string())?;
-    write_pdf(Path::new(out), &bytes)
-}
-
-fn split(args: &[String]) -> Result<(), CliError> {
-    validate_options("split", args, SPLIT_OPTIONS)?;
-    use pdfcraft_engine::SplitBy;
-    let path = *positional(args, SPLIT_OPTIONS).first().ok_or("split: missing file")?;
-    let by = match (flag(args, "--every"), flag(args, "--before")) {
-        (Some(n), None) => {
-            // A count the splitter cannot hold is refused here, before the file is opened,
-            // rather than silently clamped to 1 further down.
-            let count = n
-                .parse::<usize>()
-                .ok()
-                .filter(|count| *count > 0)
-                .ok_or_else(|| format!("bad --every: expected a positive whole number of pages, got {n:?}"))?;
-            SplitBy::PageCount(count)
-        }
-        (None, Some(list)) => SplitBy::Before(page_list(list)?),
-        _ => return Err("split: give either --every N or --before PAGES".into()),
-    };
-    let dir = PathBuf::from(flag(args, "--out-dir").unwrap_or("."));
-    let mut session = pdfcraft_engine::Session::new();
-    let id = session.open(path, None, read(path)?, flag(args, "--password")).map_err(|e| e.to_string())?;
-    let stem = file_stem(path);
-    let parts = session.split(id, &by).map_err(|e| e.to_string())?;
-    // An output folder that does not exist yet is created (#249); one that can't be is reported
-    // as the folder's problem, not as the first part's.
-    std::fs::create_dir_all(&dir).map_err(|e| format!("split: --out-dir {}: {e}", dir.display()))?;
-    for (a, b, bytes) in parts {
-        let name = dir.join(if a == b { format!("{stem}-p{a}.pdf") } else { format!("{stem}-p{a}-{b}.pdf") });
-        write_pdf(&name, &bytes)?;
-        stdout_line(format_args!("{}", name.display()))?;
-    }
-    Ok(())
-}
-
-/// A `--dpi` the renderer can be asked for: a positive, finite number. `0`, a negative value
-/// or `NaN` parse as an `f32` but reach the renderer as a scale it refuses with its own
-/// internal message (and in `check`, passed on as text, they would turn every file into a
-/// child that printed nothing), so the CLI names the option and the value instead.
-fn parse_dpi(value: &str) -> Result<f32, String> {
-    value
-        .parse::<f32>()
-        .ok()
-        .filter(|dpi| dpi.is_finite() && *dpi > 0.0)
-        .ok_or_else(|| format!("bad --dpi: expected a positive number of dots per inch, got {value:?}"))
-}
-
-fn render(args: &[String]) -> Result<(), CliError> {
-    validate_options("render", args, RENDER_OPTIONS)?;
-    let path = *positional(args, RENDER_OPTIONS).first().ok_or("render: missing file")?;
-    let page: usize =
-        flag(args, "--page").unwrap_or("1").parse().ok().filter(|page| *page > 0).ok_or("bad --page: expected a positive page number")?;
-    let page_index = page - 1;
-    let dpi = parse_dpi(flag(args, "--dpi").unwrap_or("96"))?;
-    let out = flag(args, "--out").ok_or("render: missing --out (.png, .jpg, .tif or .pam)")?;
-    // The file is what its name says (#248): a `.png` used to get a netpbm PAM stream.
-    let format = match Path::new(out).extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase).as_deref() {
-        Some("png") => Some(ImageFormat::Png),
-        Some("jpg" | "jpeg") => Some(ImageFormat::Jpeg { quality: 90 }),
-        Some("tif" | "tiff") => Some(ImageFormat::Tiff),
-        Some("pam") => None,
-        _ => return Err(format!("render: --out {out}: use a .png, .jpg, .tif or .pam name").into()),
-    };
-    // The app renders a display copy that draws comments missing their /AP streams; the CLI
-    // must agree with it (and with independent viewers), while keeping the file it reads intact.
-    let bytes = read(path)?;
-    let password = flag(args, "--password");
-    // The renderer takes only the user password of R2–R4 files; `Session::open` and the display
-    // copy take either.
-    let render_password = pdfcraft_engine::render_password_for(bytes.clone(), password);
-    let display = if inspect(bytes.clone(), render_password.as_deref()).is_ok_and(|info| info.xfa == Some(pdfcraft_render::Xfa::Dynamic)) {
-        let mut session = pdfcraft_engine::Session::new();
-        let id = session.open(path, None, bytes, password).map_err(|e| e.to_string())?;
-        session.get(id).ok_or("render: the document could not be opened")?.display.clone()
-    } else {
-        pdfcraft_engine::display_bytes_for(bytes, password)
-    };
-    let mut r =
-        PageRenderer::new(display, RenderConfig { password: render_password.as_deref().map(Arc::from), reject_oversize: true, ..Default::default() });
-    let p = r.render(RenderRequest { page: page_index, kind: RequestKind::Pixels, tile: None, scale: dpi / 72.0, tag: 0, preview: false });
-    if let Some(e) = p.error {
-        return Err(e.into());
-    }
-    let bytes = match format {
-        // With `reject_oversize` the page is drawn at `--dpi` or not at all, so the file can say so.
-        Some(f) => pdfcraft_engine::export::encode_image(p.width, p.height, &p.rgba, f, f64::from(dpi))?,
-        None => {
-            // PAM (netpbm RGB_ALPHA): the raw premultiplied pixels, for tools that read it.
-            let mut pam = format!("P7\nWIDTH {}\nHEIGHT {}\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n", p.width, p.height).into_bytes();
-            pam.extend_from_slice(&p.rgba);
-            pam
-        }
-    };
-    std::fs::write(out, bytes).map_err(|e| format!("{out}: {e}"))?;
-    let _ = writeln!(std::io::stderr().lock(), "rendered page {page} at {dpi} dpi: {}×{} px in {} ms", p.width, p.height, p.millis);
-    for warning in &p.warnings {
-        match warning {
-            pdfcraft_render::RenderWarning::ContentTruncated => {
-                let _ = writeln!(std::io::stderr().lock(), "warning: page {page}: content past the page's safety budget was skipped");
-            }
-            pdfcraft_render::RenderWarning::ColourFallback => {
-                let _ =
-                    writeln!(std::io::stderr().lock(), "warning: page {page}: a colour that could not be computed was painted in a fallback colour");
-            }
-        }
-    }
-    Ok(())
-}
-
-/// Child-process body for `check`: prints one JSON line.
-fn check_one(args: &[String]) -> Result<(), CliError> {
-    validate_options("check-one", args, CHECK_ONE_OPTIONS)?;
-    let path = *positional(args, CHECK_ONE_OPTIONS).first().ok_or("check-one: missing file")?;
-    let dpi = parse_dpi(flag(args, "--dpi").unwrap_or("36"))?;
-    let start = Instant::now();
-    let bytes = read(path)?;
-    let (status, pages, failed, detail, warnings) = match inspect(bytes.clone(), None) {
-        Err(e) => (format!("open-error:{}", short(&e.to_string())), 0, 0, e.to_string(), 0),
-        Ok(info) => {
-            let mut r = PageRenderer::new(bytes, RenderConfig::default());
-            let mut failed = Vec::new();
-            for i in 0..info.pages.len().min(500) {
-                let p = r.render(RenderRequest { page: i, kind: RequestKind::Pixels, tile: None, scale: dpi / 72.0, tag: 0, preview: false });
-                if let Some(e) = r.render(RenderRequest { page: i, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, preview: false }).error {
-                    failed.push(format!("p{} text: {e}", i + 1));
-                }
-                if let Some(e) = p.error {
-                    failed.push(format!("p{}: {e}", i + 1));
-                }
-            }
-            let status = if failed.is_empty() { "ok".to_string() } else { "page-errors".to_string() };
-            (status, info.pages.len(), failed.len(), failed.join(" | "), info.warnings.len())
-        }
-    };
-    // `--edit` (fuzzing): also run our own object layer end to end, with no panic safety net,
-    // so a panic in cos shows up as a crash of this process.
-    if args.iter().any(|a| a == "--edit") {
-        edit_round_trip(&std::fs::read(path).map_err(|e| e.to_string())?);
-    }
-    let line = serde_json::json!({ "file": path, "status": status, "pages": pages, "failed_pages": failed, "warnings": warnings,
-        "ms": start.elapsed().as_millis() as u64, "detail": detail.chars().take(400).collect::<String>() });
-    stdout_line(format_args!("{line}"))?;
-    Ok(())
-}
-
-/// Open with cos, touch every object, edit the catalog, save incrementally and in full (both
-/// output styles), and reopen each result. Errors are fine; panics, hangs and aborts are bugs.
-fn edit_round_trip(bytes: &[u8]) {
-    use pdfcraft_cos::{Document, Object, SaveOptions, write_full, write_incremental};
-    let Ok(mut doc) = Document::open(Arc::new(bytes.to_vec())) else { return };
-    for num in doc.object_numbers().into_iter().take(20_000) {
-        if let Ok(o) = doc.try_get(num)
-            && let Object::Stream(s) = &*o
-        {
-            let _ = s.decoded();
-        }
-    }
-    if let Some(root) = doc.root() {
-        let _ = doc.update_dict(root, |d| d.set(b"PdfCraftFuzz".to_vec(), Object::Bool(true)));
-    }
-    let classic = SaveOptions { object_streams: false, ..SaveOptions::default() };
-    for out in [write_incremental(&doc, &SaveOptions::default()), write_full(&doc, &SaveOptions::default()), write_full(&doc, &classic)]
-        .into_iter()
-        .flatten()
-    {
-        if let Ok(again) = Document::open(Arc::new(out)) {
-            let _ = again.root().map(|r| again.get(r));
-        }
-    }
-}
-
-fn short(s: &str) -> String {
-    s.split(|c: char| !c.is_alphanumeric()).filter(|w| !w.is_empty()).take(4).collect::<Vec<_>>().join("-").to_lowercase()
-}
-
-fn collect(paths: &[&str]) -> Vec<PathBuf> {
-    let mut out = Vec::new();
-    let mut stack: Vec<PathBuf> = paths.iter().map(PathBuf::from).collect();
-    let mut visited = std::collections::HashSet::new();
-    while let Some(p) = stack.pop() {
-        if p.is_dir() {
-            // Directory aliases and symlink cycles must not scan the same tree repeatedly.
-            let identity = match p.canonicalize() {
-                Ok(identity) => identity,
-                Err(error) => {
-                    eprintln!("{}: could not resolve directory: {error}", p.display());
-                    continue;
-                }
-            };
-            if !visited.insert(identity) {
-                continue;
-            }
-            if let Ok(rd) = std::fs::read_dir(&p) {
-                stack.extend(rd.flatten().map(|e| e.path()));
-            }
-        } else if p.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("pdf")) {
-            out.push(p);
-        }
-    }
-    out.sort();
-    out
-}
-
-fn check(args: &[String]) -> Result<(), CliError> {
-    validate_options("check", args, CHECK_OPTIONS)?;
-    // Every option is checked before the inputs are scanned, so a bad value is one message,
-    // not one problem per file: a zero timeout used to make every file time out, and a bad
-    // dpi used to reach each child, which printed nothing and was reported as a crash.
-    let timeout_value = flag(args, "--timeout").unwrap_or("20");
-    let timeout = Duration::from_secs(
-        timeout_value
-            .parse::<u64>()
-            .ok()
-            .filter(|secs| *secs > 0)
-            .ok_or_else(|| format!("bad --timeout: expected a positive whole number of seconds, got {timeout_value:?}"))?,
-    );
-    let dpi = flag(args, "--dpi").unwrap_or("36").to_string();
-    parse_dpi(&dpi)?;
-    let files = collect(&positional(args, CHECK_OPTIONS));
-    if files.is_empty() {
-        return Err("check: no PDF files found".into());
-    }
-    let exe = std::env::current_exe().map_err(|e| e.to_string())?;
-    let mut results = Vec::new();
-    let mut counts: std::collections::BTreeMap<String, usize> = Default::default();
-    for (n, f) in files.iter().enumerate() {
-        let r = run_child(&exe, f, &dpi, timeout);
-        let status = r["status"].as_str().unwrap_or("?").to_string();
-        *counts.entry(status.split(':').next().unwrap_or("?").to_string()).or_default() += 1;
-        if status != "ok" {
-            eprintln!(
-                "[{}/{}] {status:<28} {}  {}",
-                n + 1,
-                files.len(),
-                f.display(),
-                r["detail"].as_str().unwrap_or("").chars().take(160).collect::<String>()
-            );
-        }
-        results.push(r);
-    }
-    eprintln!("\nchecked {} files: {:?}", files.len(), counts);
-    if let Some(out) = flag(args, "--json") {
-        std::fs::write(out, serde_json::to_string_pretty(&results).unwrap_or_default()).map_err(|e| e.to_string())?;
-    }
-    Ok(())
-}
-
-fn run_child(exe: &Path, file: &Path, dpi: &str, timeout: Duration) -> serde_json::Value {
-    let file_s = file.to_string_lossy().to_string();
-    let child = Command::new(exe).args(["check-one", &file_s, "--dpi", dpi]).stdout(Stdio::piped()).stderr(Stdio::null()).spawn();
-    let mut child = match child {
-        Ok(c) => c,
-        Err(e) => return serde_json::json!({ "file": file_s, "status": "harness-error", "detail": e.to_string() }),
-    };
-    let start = Instant::now();
-    loop {
-        match child.try_wait() {
-            Ok(Some(status)) => {
-                let mut out = String::new();
-                if let Some(mut so) = child.stdout.take() {
-                    use std::io::Read;
-                    let _ = so.read_to_string(&mut out);
-                }
-                return match serde_json::from_str::<serde_json::Value>(out.trim()) {
-                    Ok(v) => v,
-                    Err(_) => serde_json::json!({ "file": file_s, "status": "crash", "detail": format!("child exited with {status}") }),
-                };
-            }
-            Ok(None) if start.elapsed() > timeout => {
-                let _ = child.kill();
-                let _ = child.wait();
-                return serde_json::json!({ "file": file_s, "status": "timeout", "detail": format!("exceeded {}s", timeout.as_secs()) });
-            }
-            Ok(None) => std::thread::sleep(Duration::from_millis(20)),
-            Err(e) => return serde_json::json!({ "file": file_s, "status": "harness-error", "detail": e.to_string() }),
-        }
-    }
-}
-
-// ---- automation --------------------------------------------------------------------------------
-
-fn automation(args: &[String]) -> Result<pdfcraft_automation::Automation, String> {
-    let a = pdfcraft_automation::Automation::new();
-    match flag(args, "--root") {
-        Some(root) => a.with_root(root).map_err(|e| format!("--root {root}: {e}")),
-        None => Ok(a),
-    }
-}
-
-fn tools() -> Result<(), CliError> {
-    let list: Vec<serde_json::Value> = pdfcraft_automation::tools()
-        .iter()
-        .map(|t| serde_json::json!({ "name": t.name, "description": t.description, "read_only": t.read_only, "command": t.command, "input_schema": t.input_schema }))
-        .collect();
-    stdout_line(format_args!("{}", serde_json::to_string_pretty(&list).unwrap_or_default()))?;
-    Ok(())
-}
-
-/// Print a tool's result: JSON as JSON; images go to `--out` (or are summarised). The image is
-/// written like a tool's own output, so `--root` confines it too.
-fn print_output(auto: &pdfcraft_automation::Automation, content: Vec<pdfcraft_automation::Content>, out: Option<&str>) -> Result<(), CliError> {
-    for c in content {
-        match c {
-            pdfcraft_automation::Content::Json(v) => stdout_line(format_args!("{}", serde_json::to_string_pretty(&v).unwrap_or_default()))?,
-            pdfcraft_automation::Content::Png { data, width, height } => match out {
-                Some(path) => {
-                    let written = auto.write_output(path, &data).map_err(|e| e.to_string())?;
-                    stdout_line(format_args!("{}", serde_json::json!({ "image": written.to_string_lossy(), "width": width, "height": height })))?;
-                }
-                None => stdout_line(format_args!("{}", png_summary(&data, width, height)))?,
-            },
-        }
-    }
-    Ok(())
-}
-
-/// What a PNG result is reported as when it isn't written to a file.
-fn png_summary(data: &[u8], width: u32, height: u32) -> serde_json::Value {
-    serde_json::json!({ "image": "png", "width": width, "height": height, "bytes": data.len(), "hint": "pass --out file.png to save it" })
-}
-
-/// A tool's result as JSON values, for the `--report` of a script. Same content as
-/// [`print_output`], collected instead of printed.
-fn output_values(
-    auto: &pdfcraft_automation::Automation,
-    content: Vec<pdfcraft_automation::Content>,
-    out: Option<&str>,
-) -> Result<Vec<serde_json::Value>, String> {
-    let mut values = Vec::new();
-    for c in content {
-        values.push(match c {
-            pdfcraft_automation::Content::Json(v) => v,
-            pdfcraft_automation::Content::Png { data, width, height } => match out {
-                Some(path) => {
-                    let written = auto.write_output(path, &data).map_err(|e| e.to_string())?;
-                    serde_json::json!({ "image": written.to_string_lossy(), "width": width, "height": height })
-                }
-                None => png_summary(&data, width, height),
-            },
-        });
-    }
-    Ok(values)
-}
-
-/// Run a script and print one JSON document: per step its number, tool and `ok`/`error`/`skipped`
-/// with the result or the message. The first failing step ends the run, as without `--report`;
-/// the steps after it are listed as skipped and the exit status is the same.
-fn run_script_report(auto: &mut pdfcraft_automation::Automation, steps: &[serde_json::Value]) -> Result<(), CliError> {
-    let mut report = Vec::with_capacity(steps.len());
-    let mut failure: Option<String> = None;
-    for (i, step) in steps.iter().enumerate() {
-        let n = i + 1;
-        let tool = step["tool"].as_str();
-        if failure.is_some() {
-            report.push(serde_json::json!({ "step": n, "tool": tool, "status": "skipped" }));
-            continue;
-        }
-        let outcome = match tool {
-            None => Err(format!("step {n}: missing \"tool\"")),
-            Some(t) => auto
-                .call(t, &step["args"])
-                .map_err(|e| e.to_string())
-                .and_then(|content| output_values(auto, content, step["out"].as_str()))
-                .map_err(|e| format!("step {n} ({t}): {e}")),
-        };
-        match outcome {
-            Ok(result) => report.push(serde_json::json!({ "step": n, "tool": tool, "status": "ok", "result": result })),
-            Err(message) => {
-                report.push(serde_json::json!({ "step": n, "tool": tool, "status": "error", "error": message }));
-                failure = Some(message);
-            }
-        }
-    }
-    let document = serde_json::json!({ "ok": failure.is_none(), "steps": report });
-    stdout_line(format_args!("{}", serde_json::to_string_pretty(&document).unwrap_or_default()))?;
-    failure.map_or(Ok(()), |message| Err(CliError::Message(message)))
-}
-
-fn run(args: &[String]) -> Result<(), CliError> {
-    validate_options("run", args, RUN_OPTIONS)?;
-    let report = args.iter().any(|a| a == "--report");
-    if report && flag(args, "--script").is_none() {
-        return Err("run: --report needs --script".to_string().into());
-    }
-    let mut auto = automation(args)?;
-    if let Some(script) = flag(args, "--script") {
-        let text = std::fs::read_to_string(script).map_err(|e| format!("{script}: {e}"))?;
-        let steps: Vec<serde_json::Value> = serde_json::from_str(&text).map_err(|e| format!("{script}: {e}"))?;
-        if report {
-            return run_script_report(&mut auto, &steps);
-        }
-        for (i, step) in steps.iter().enumerate() {
-            let tool = step["tool"].as_str().ok_or(format!("step {}: missing \"tool\"", i + 1))?;
-            let content = auto.call(tool, &step["args"]).map_err(|e| format!("step {} ({tool}): {e}", i + 1))?;
-            print_output(&auto, content, step["out"].as_str()).map_err(|e| match e {
-                CliError::Message(message) => CliError::Message(format!("step {} ({tool}): {message}", i + 1)),
-                stdout => stdout,
-            })?;
-        }
-        return Ok(());
-    }
-    let tool = *positional(args, RUN_OPTIONS).first().ok_or("run: missing tool name (see `pdfcraft-cli tools`)")?;
-    let mut obj = serde_json::Map::new();
-    for kv in positional(args, RUN_OPTIONS).iter().skip(1) {
-        let (k, v) = kv.split_once('=').ok_or(format!("run: expected key=value, got {kv:?}"))?;
-        let value = serde_json::from_str(v).unwrap_or_else(|_| serde_json::Value::String(v.to_string()));
-        obj.insert(k.to_string(), value);
-    }
-    let content = auto.call(tool, &serde_json::Value::Object(obj)).map_err(|e| e.to_string())?;
-    print_output(&auto, content, flag(args, "--out"))
-}
-
-/// Take `--automation-read-root` / `--automation-write-root` (each `--flag DIR` or `--flag=DIR`,
-/// once) out of `args`, and open the roots, which must be existing folders. Returns the arguments
-/// that are left. A malformed root flag is an error, never a root silently left out.
-#[cfg(feature = "mcp")]
-fn automation_roots(command: &str, args: &[String]) -> Result<(Option<Arc<pdfcraft_automation::file_access::AutomationRoots>>, Vec<String>), String> {
-    let mut found = automation_args::AutomationArgs::new(None, None);
-    let mut left = Vec::new();
-    let mut it = args.iter().cloned();
-    while let Some(arg) = it.next() {
-        if !found.consume(&arg, &mut it).map_err(|e| format!("{command}: {e}"))? {
-            left.push(arg);
-        }
-    }
-    let roots = pdfcraft_automation::file_access::AutomationRoots::new(found.read_root.as_deref(), found.write_root.as_deref())
-        .map_err(|e| format!("{command}: {e}"))?;
-    Ok((roots, left))
-}
-
-#[cfg(feature = "mcp")]
-fn mcp(args: &[String]) -> Result<(), CliError> {
-    let (roots, args) = automation_roots("mcp", args)?;
-    let args = args.as_slice();
-    validate_options("mcp", args, MCP_OPTIONS)?;
-    let compact = args.iter().any(|a| a == "--compact");
-    let mut auto = automation(args)?;
-    if let Some(roots) = roots {
-        let show = |root: Option<&Path>| root.map_or_else(|| "none".to_string(), |r| r.display().to_string());
-        let _ = writeln!(
-            std::io::stderr().lock(),
-            "pdfcraft-cli: files confined: read root {}, write root {}",
-            show(roots.read_root()),
-            show(roots.write_root())
-        );
-        auto = auto.with_automation_roots(Some(roots));
-    }
-    let mut server = pdfcraft_automation::mcp::McpServer::new(auto).with_compact(compact);
-    let _ = writeln!(
-        std::io::stderr().lock(),
-        "pdfcraft-cli: MCP server on stdio (protocol {}{}); close stdin to stop",
-        pdfcraft_automation::mcp::PROTOCOL_VERSIONS[0],
-        if compact { ", compact tool list" } else { "" }
-    );
-    server.serve(std::io::stdin().lock(), std::io::stdout().lock()).map_err(|e| CliError::Message(e.to_string()))
-}
-
-// ---- UI control channel client -----------------------------------------------------------------
-
-/// One request to a running app's control channel (`pdfcraft --control FILE`).
-fn ui(args: &[String]) -> Result<(), CliError> {
-    validate_options("ui", args, UI_OPTIONS)?;
-    use std::io::{BufRead, BufReader, Write as _};
-    let file = flag(args, "--control").ok_or("ui: missing --control FILE (start the app with `pdfcraft --control FILE`)")?;
-    let info = read_control_file(file)?;
-    let port = info["port"].as_u64().ok_or(format!("{file}: no port"))?;
-    // Refused rather than truncated, which would quietly reach some other port.
-    let port = u16::try_from(port).map_err(|_| format!("{file}: {port} is not a port number"))?;
-    let token = info["token"].as_str().ok_or(format!("{file}: no token"))?;
-    let pos = positional(args, UI_OPTIONS);
-    let method = *pos.first().ok_or("ui: missing method (state, inspect, click, drag, type, key, command, commands, set, open, screenshot)")?;
-    let method = if method.starts_with("ui.") { method.to_string() } else { format!("ui.{method}") };
-    let mut params = serde_json::Map::new();
-    for kv in pos.iter().skip(1) {
-        let (k, v) = kv.split_once('=').ok_or(format!("ui: expected key=value, got {kv:?}"))?;
-        params.insert(k.to_string(), serde_json::from_str(v).unwrap_or_else(|_| serde_json::Value::String(v.to_string())));
-    }
-    let stream =
-        std::net::TcpStream::connect(("127.0.0.1", port)).map_err(|e| format!("can't reach the app on port {port}: {e} (is it still running?)"))?;
-    stream.set_read_timeout(Some(Duration::from_secs(40))).map_err(|e| e.to_string())?;
-    let mut write = stream.try_clone().map_err(|e| e.to_string())?;
-    let mut lines = BufReader::new(stream).lines();
-    let mut rpc = |id: u64, method: &str, params: serde_json::Value| -> Result<serde_json::Value, String> {
-        writeln!(write, "{}", serde_json::json!({ "jsonrpc": "2.0", "id": id, "method": method, "params": params })).map_err(|e| e.to_string())?;
-        let line = lines.next().ok_or("the app closed the connection")?.map_err(|e| e.to_string())?;
-        let reply: serde_json::Value = serde_json::from_str(&line).map_err(|e| e.to_string())?;
-        match reply.get("error") {
-            Some(e) => Err(e["message"].as_str().unwrap_or("error").to_string()),
-            None => Ok(reply["result"].clone()),
-        }
-    };
-    rpc(1, "auth", serde_json::json!({ "token": token }))?;
-    let mut result = rpc(2, &method, serde_json::Value::Object(params))?;
-    if let (Some(out), Some(data)) = (flag(args, "--out"), result.get("png_base64").and_then(|d| d.as_str())) {
-        use base64::Engine as _;
-        let png = base64::engine::general_purpose::STANDARD.decode(data).map_err(|e| e.to_string())?;
-        std::fs::write(out, png).map_err(|e| format!("{out}: {e}"))?;
-        result["png_base64"] = serde_json::json!(format!("written to {out}"));
-    }
-    stdout_line(format_args!("{}", serde_json::to_string_pretty(&result).unwrap_or_default()))?;
-    Ok(())
-}
-
-/// Most a control file may hold. The app writes under 100 bytes.
-const CONTROL_FILE_MAX: u64 = 64 * 1024;
-
-const CONTROL_FILE_ADVICE: &str =
-    "Start the app with a control file in a folder only you can write, such as `pdfcraft --control ~/.pdfcraft-control.json`";
-
-/// Read the file written by `pdfcraft --control FILE`.
-///
-/// It names the port that receives the token and every command, typed text included, so it must
-/// be the user's own. In a shared folder such as `/tmp`, another local user can create the file
-/// first; the app then can't write it, and the CLI would talk to the other user's listener.
-/// Refused: a symbolic link, anything but a regular file, and on Unix a file owned by someone
-/// else or open to other users (the app writes it with mode 600).
-fn read_control_file(file: &str) -> Result<serde_json::Value, String> {
-    use std::io::Read as _;
-    let at_path = std::fs::symlink_metadata(file).map_err(|e| format!("{file}: {e}"))?;
-    if at_path.file_type().is_symlink() {
-        return Err(format!("{file}: is a symbolic link, which could point at another user's file. {CONTROL_FILE_ADVICE}"));
-    }
-    if !at_path.is_file() {
-        return Err(format!("{file}: not a regular file. {CONTROL_FILE_ADVICE}"));
-    }
-    let f = std::fs::File::open(file).map_err(|e| format!("{file}: {e}"))?;
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::MetadataExt;
-        // Checked on the open file, so nothing swapped in after `symlink_metadata` gets through.
-        let opened = f.metadata().map_err(|e| format!("{file}: {e}"))?;
-        if (opened.dev(), opened.ino()) != (at_path.dev(), at_path.ino()) {
-            return Err(format!("{file}: was replaced while being opened. {CONTROL_FILE_ADVICE}"));
-        }
-        if let Some(problem) = control_file_problem(opened.uid(), opened.mode(), current_uid()) {
-            return Err(format!("{file}: {problem}. {CONTROL_FILE_ADVICE}"));
-        }
-    }
-    let mut text = String::new();
-    f.take(CONTROL_FILE_MAX.saturating_add(1)).read_to_string(&mut text).map_err(|e| format!("{file}: {e}"))?;
-    if u64::try_from(text.len()).unwrap_or(u64::MAX) > CONTROL_FILE_MAX {
-        return Err(format!("{file}: too large for a control file (over {} KiB)", CONTROL_FILE_MAX / 1024));
-    }
-    serde_json::from_str(&text).map_err(|e| format!("{file}: {e}"))
-}
-
-/// Why user `me` can't trust a control file with this owner and mode, if they can't.
-#[cfg(any(test, unix))]
-fn control_file_problem(owner: u32, mode: u32, me: u32) -> Option<String> {
-    if owner != me {
-        return Some(format!("owned by another user (uid {owner}; you are uid {me}), who may be the one listening for your commands"));
-    }
-    let permissions = mode & 0o7777;
-    (permissions & 0o077 != 0).then(|| format!("other users have access to it (mode {permissions:o}; the app writes it with mode 600)"))
-}
-
-/// The effective user id: the owner of the files this process creates, and so of a control file
-/// the app wrote for this user. std has no `geteuid` and this crate forbids `unsafe`; rustix's is
-/// safe and can't fail.
-#[cfg(unix)]
-fn current_uid() -> u32 {
-    rustix::process::geteuid().as_raw()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::control_file_problem;
-
-    #[test]
-    fn a_control_file_must_be_yours_and_private() {
-        // Regular file type bits (0o100000) don't matter, only the owner and the permission bits.
-        assert_eq!(control_file_problem(1000, 0o100600, 1000), None);
-        assert_eq!(control_file_problem(1000, 0o600, 1000), None);
-        assert_eq!(control_file_problem(1000, 0o400, 1000), None);
-        let other = control_file_problem(1001, 0o600, 1000).unwrap_or_default();
-        assert!(other.contains("owned by another user") && other.contains("1001"), "{other}");
-        // Root gets no exception: a file a user planted is still theirs.
-        assert!(control_file_problem(1000, 0o600, 0).is_some_and(|p| p.contains("owned by another user")));
-        for mode in [0o644, 0o640, 0o604, 0o660, 0o606, 0o620, 0o602, 0o610, 0o601, 0o100666] {
-            let open = control_file_problem(1000, mode, 1000).unwrap_or_default();
-            assert!(open.contains("other users"), "{mode:o}: {open}");
-        }
-        assert!(control_file_problem(1000, 0o100644, 1000).unwrap_or_default().contains("mode 644"));
-    }
-}
diff --git a/apps/pdfcraft-cli/src/options.rs b/apps/pdfcraft-cli/src/options.rs
new file mode 100644
index 0000000000..ab1a3db34b
--- /dev/null
+++ b/apps/pdfcraft-cli/src/options.rs
@@ -0,0 +1,148 @@
+use super::*;
+
+pub(crate) fn flag<'a>(args: &'a [String], name: &str) -> Option<&'a str> {
+    args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).map(String::as_str)
+}
+
+#[derive(Clone, Copy)]
+pub(crate) struct OptionSpec {
+    pub(crate) name: &'static str,
+    pub(crate) takes_value: bool,
+}
+
+/// The options whose value is a file or folder. Only these refuse a value that is another
+/// option: a file named `--password` is never what was meant, while a password can be anything
+/// (`--password --page` is a password of `--page`, which tests/text.rs pins), and so can a title.
+/// The way to name a file that does start with `-` is `./--name`, as `--root` already offered.
+const PATH_VALUE_OPTIONS: [&str; 6] = ["--out", "--out-dir", "--json", "--root", "--control", "--script"];
+
+/// Whether a token can be the value of a path option. Another option cannot: `--out --password`
+/// used to write the PDF to a file called `--password` and exit 0 (photocraft#6944).
+pub(crate) fn can_be_path_value(name: &str, value: Option<&str>) -> bool {
+    !PATH_VALUE_OPTIONS.contains(&name) || value.is_some_and(|v| !v.is_empty() && !v.starts_with("--"))
+}
+
+/// The complaint about a path option whose value is missing or is another option.
+pub(crate) fn needs_value(command: &str, name: &str, value: Option<&str>) -> String {
+    match value {
+        Some(v) if !v.is_empty() => {
+            format!("{command}: {name} needs a value and `{v}` is another option; write `./{v}` for a file of that name")
+        }
+        _ => format!("{command}: {name} needs a value"),
+    }
+}
+
+/// Refuse unknown options and malformed confinement flags before any file is read.
+pub(crate) fn validate_options(command: &str, args: &[String], specs: &[OptionSpec]) -> Result<(), CliError> {
+    if specs.iter().any(|spec| spec.name == "--root") {
+        // `flag` searches every token, including another option's value. Match that lookup so
+        // a malformed confinement flag cannot be hidden there and fall back to no root.
+        let mut root_seen = false;
+        for (i, _) in args.iter().enumerate().filter(|(_, arg)| arg.as_str() == "--root") {
+            if root_seen {
+                return Err(format!("{command}: --root may only be supplied once").into());
+            }
+            root_seen = true;
+            if args.get(i + 1).is_none_or(|value| value.is_empty() || value.starts_with("--")) {
+                return Err(format!("{command}: --root needs a directory value").into());
+            }
+        }
+    }
+    let mut i = 0;
+    while let Some(arg) = args.get(i) {
+        if let Some(name) = arg.strip_prefix("--") {
+            let Some(spec) = specs.iter().find(|spec| spec.name == arg) else {
+                return Err(format!("{command}: unknown option --{name}").into());
+            };
+            // A file's name is not another option, which also closes the gap the walk left for
+            // those: an unknown option in that value position was skipped along with it. Other
+            // values, missing or malformed, are left to the command, which reports them in its
+            // own terms (`text` and `extract` explain what a page value must be).
+            i += if spec.takes_value {
+                let value = args.get(i + 1).map(String::as_str);
+                if !can_be_path_value(spec.name, value) {
+                    return Err(needs_value(command, spec.name, value).into());
+                }
+                2
+            } else {
+                1
+            };
+        } else {
+            i += 1;
+        }
+    }
+    Ok(())
+}
+
+pub(crate) const INFO_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--password", takes_value: true }];
+
+pub(crate) const AUDIT_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--password", takes_value: true }];
+
+pub(crate) const TEXT_OPTIONS: &[OptionSpec] =
+    &[OptionSpec { name: "--page", takes_value: true }, OptionSpec { name: "--password", takes_value: true }];
+
+pub(crate) const COMBINE_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--out", takes_value: true }];
+
+pub(crate) const EXTRACT_OPTIONS: &[OptionSpec] = &[
+    OptionSpec { name: "--out", takes_value: true },
+    OptionSpec { name: "--pages", takes_value: true },
+    OptionSpec { name: "--password", takes_value: true },
+];
+
+pub(crate) const SPLIT_OPTIONS: &[OptionSpec] = &[
+    OptionSpec { name: "--every", takes_value: true },
+    OptionSpec { name: "--before", takes_value: true },
+    OptionSpec { name: "--out-dir", takes_value: true },
+    OptionSpec { name: "--password", takes_value: true },
+];
+
+pub(crate) const RENDER_OPTIONS: &[OptionSpec] = &[
+    OptionSpec { name: "--page", takes_value: true },
+    OptionSpec { name: "--dpi", takes_value: true },
+    OptionSpec { name: "--out", takes_value: true },
+    OptionSpec { name: "--password", takes_value: true },
+];
+
+pub(crate) const CHECK_ONE_OPTIONS: &[OptionSpec] =
+    &[OptionSpec { name: "--dpi", takes_value: true }, OptionSpec { name: "--edit", takes_value: false }];
+
+pub(crate) const CHECK_OPTIONS: &[OptionSpec] = &[
+    OptionSpec { name: "--timeout", takes_value: true },
+    OptionSpec { name: "--dpi", takes_value: true },
+    OptionSpec { name: "--json", takes_value: true },
+];
+
+pub(crate) const RUN_OPTIONS: &[OptionSpec] = &[
+    OptionSpec { name: "--root", takes_value: true },
+    OptionSpec { name: "--script", takes_value: true },
+    OptionSpec { name: "--out", takes_value: true },
+    OptionSpec { name: "--report", takes_value: false },
+];
+
+pub(crate) const UI_OPTIONS: &[OptionSpec] = &[OptionSpec { name: "--control", takes_value: true }, OptionSpec { name: "--out", takes_value: true }];
+
+#[cfg(feature = "mcp")]
+pub(crate) const MCP_OPTIONS: &[OptionSpec] =
+    &[OptionSpec { name: "--root", takes_value: true }, OptionSpec { name: "--compact", takes_value: false }];
+
+/// The arguments that are not options or their values. Which tokens are values is the spec's
+/// answer: skipping the one after every option made `check-one --edit file.pdf` report "missing
+/// file", the file having been read as `--edit`'s value.
+pub(crate) fn positional<'a>(args: &'a [String], specs: &[OptionSpec]) -> Vec<&'a str> {
+    let mut out = Vec::new();
+    let mut i = 0;
+    while let Some(a) = args.get(i) {
+        match specs.iter().find(|spec| spec.name == a.as_str()) {
+            Some(spec) if spec.takes_value => i += 2,
+            // An option that takes no value, and an unknown one, which `validate_options` has
+            // already refused by the time this runs.
+            Some(_) => i += 1,
+            None if a.starts_with("--") => i += 1,
+            None => {
+                out.push(a.as_str());
+                i += 1;
+            }
+        }
+    }
+    out
+}
diff --git a/apps/pdfcraft-cli/src/run.rs b/apps/pdfcraft-cli/src/run.rs
new file mode 100644
index 0000000000..19eed21876
--- /dev/null
+++ b/apps/pdfcraft-cli/src/run.rs
@@ -0,0 +1,186 @@
+#[cfg(feature = "mcp")]
+use super::options::MCP_OPTIONS;
+use super::options::{RUN_OPTIONS, flag, positional, validate_options};
+use super::*;
+
+// ---- automation --------------------------------------------------------------------------------
+
+pub(crate) fn automation(args: &[String]) -> Result<pdfcraft_automation::Automation, String> {
+    let a = pdfcraft_automation::Automation::new();
+    match flag(args, "--root") {
+        Some(root) => a.with_root(root).map_err(|e| format!("--root {root}: {e}")),
+        None => Ok(a),
+    }
+}
+
+pub(crate) fn tools() -> Result<(), CliError> {
+    let list: Vec<serde_json::Value> = pdfcraft_automation::tools()
+        .iter()
+        .map(|t| serde_json::json!({ "name": t.name, "description": t.description, "read_only": t.read_only, "command": t.command, "input_schema": t.input_schema }))
+        .collect();
+    stdout_line(format_args!("{}", serde_json::to_string_pretty(&list).unwrap_or_default()))?;
+    Ok(())
+}
+
+/// Print a tool's result: JSON as JSON; images go to `--out` (or are summarised). The image is
+/// written like a tool's own output, so `--root` confines it too.
+pub(crate) fn print_output(
+    auto: &pdfcraft_automation::Automation,
+    content: Vec<pdfcraft_automation::Content>,
+    out: Option<&str>,
+) -> Result<(), CliError> {
+    for c in content {
+        match c {
+            pdfcraft_automation::Content::Json(v) => stdout_line(format_args!("{}", serde_json::to_string_pretty(&v).unwrap_or_default()))?,
+            pdfcraft_automation::Content::Png { data, width, height } => match out {
+                Some(path) => {
+                    let written = auto.write_output(path, &data).map_err(|e| e.to_string())?;
+                    stdout_line(format_args!("{}", serde_json::json!({ "image": written.to_string_lossy(), "width": width, "height": height })))?;
+                }
+                None => stdout_line(format_args!("{}", png_summary(&data, width, height)))?,
+            },
+        }
+    }
+    Ok(())
+}
+
+/// What a PNG result is reported as when it isn't written to a file.
+fn png_summary(data: &[u8], width: u32, height: u32) -> serde_json::Value {
+    serde_json::json!({ "image": "png", "width": width, "height": height, "bytes": data.len(), "hint": "pass --out file.png to save it" })
+}
+
+/// A tool's result as JSON values, for the `--report` of a script. Same content as
+/// [`print_output`], collected instead of printed.
+fn output_values(
+    auto: &pdfcraft_automation::Automation,
+    content: Vec<pdfcraft_automation::Content>,
+    out: Option<&str>,
+) -> Result<Vec<serde_json::Value>, String> {
+    let mut values = Vec::new();
+    for c in content {
+        values.push(match c {
+            pdfcraft_automation::Content::Json(v) => v,
+            pdfcraft_automation::Content::Png { data, width, height } => match out {
+                Some(path) => {
+                    let written = auto.write_output(path, &data).map_err(|e| e.to_string())?;
+                    serde_json::json!({ "image": written.to_string_lossy(), "width": width, "height": height })
+                }
+                None => png_summary(&data, width, height),
+            },
+        });
+    }
+    Ok(values)
+}
+
+/// Run a script and print one JSON document: per step its number, tool and `ok`/`error`/`skipped`
+/// with the result or the message. The first failing step ends the run, as without `--report`;
+/// the steps after it are listed as skipped and the exit status is the same.
+fn run_script_report(auto: &mut pdfcraft_automation::Automation, steps: &[serde_json::Value]) -> Result<(), CliError> {
+    let mut report = Vec::with_capacity(steps.len());
+    let mut failure: Option<String> = None;
+    for (i, step) in steps.iter().enumerate() {
+        let n = i + 1;
+        let tool = step["tool"].as_str();
+        if failure.is_some() {
+            report.push(serde_json::json!({ "step": n, "tool": tool, "status": "skipped" }));
+            continue;
+        }
+        let outcome = match tool {
+            None => Err(format!("step {n}: missing \"tool\"")),
+            Some(t) => auto
+                .call(t, &step["args"])
+                .map_err(|e| e.to_string())
+                .and_then(|content| output_values(auto, content, step["out"].as_str()))
+                .map_err(|e| format!("step {n} ({t}): {e}")),
+        };
+        match outcome {
+            Ok(result) => report.push(serde_json::json!({ "step": n, "tool": tool, "status": "ok", "result": result })),
+            Err(message) => {
+                report.push(serde_json::json!({ "step": n, "tool": tool, "status": "error", "error": message }));
+                failure = Some(message);
+            }
+        }
+    }
+    let document = serde_json::json!({ "ok": failure.is_none(), "steps": report });
+    stdout_line(format_args!("{}", serde_json::to_string_pretty(&document).unwrap_or_default()))?;
+    failure.map_or(Ok(()), |message| Err(CliError::Message(message)))
+}
+
+pub(crate) fn run(args: &[String]) -> Result<(), CliError> {
+    validate_options("run", args, RUN_OPTIONS)?;
+    let report = args.iter().any(|a| a == "--report");
+    if report && flag(args, "--script").is_none() {
+        return Err("run: --report needs --script".to_string().into());
+    }
+    let mut auto = automation(args)?;
+    if let Some(script) = flag(args, "--script") {
+        let text = std::fs::read_to_string(script).map_err(|e| format!("{script}: {e}"))?;
+        let steps: Vec<serde_json::Value> = serde_json::from_str(&text).map_err(|e| format!("{script}: {e}"))?;
+        if report {
+            return run_script_report(&mut auto, &steps);
+        }
+        for (i, step) in steps.iter().enumerate() {
+            let tool = step["tool"].as_str().ok_or(format!("step {}: missing \"tool\"", i + 1))?;
+            let content = auto.call(tool, &step["args"]).map_err(|e| format!("step {} ({tool}): {e}", i + 1))?;
+            print_output(&auto, content, step["out"].as_str()).map_err(|e| match e {
+                CliError::Message(message) => CliError::Message(format!("step {} ({tool}): {message}", i + 1)),
+                stdout => stdout,
+            })?;
+        }
+        return Ok(());
+    }
+    let tool = *positional(args, RUN_OPTIONS).first().ok_or("run: missing tool name (see `pdfcraft-cli tools`)")?;
+    let mut obj = serde_json::Map::new();
+    for kv in positional(args, RUN_OPTIONS).iter().skip(1) {
+        let (k, v) = kv.split_once('=').ok_or(format!("run: expected key=value, got {kv:?}"))?;
+        let value = serde_json::from_str(v).unwrap_or_else(|_| serde_json::Value::String(v.to_string()));
+        obj.insert(k.to_string(), value);
+    }
+    let content = auto.call(tool, &serde_json::Value::Object(obj)).map_err(|e| e.to_string())?;
+    print_output(&auto, content, flag(args, "--out"))
+}
+
+/// Take `--automation-read-root` / `--automation-write-root` (each `--flag DIR` or `--flag=DIR`,
+/// once) out of `args`, and open the roots, which must be existing folders. Returns the arguments
+/// that are left. A malformed root flag is an error, never a root silently left out.
+#[cfg(feature = "mcp")]
+fn automation_roots(command: &str, args: &[String]) -> Result<(Option<Arc<pdfcraft_automation::file_access::AutomationRoots>>, Vec<String>), String> {
+    let mut found = automation_args::AutomationArgs::new(None, None);
+    let mut left = Vec::new();
+    let mut it = args.iter().cloned();
+    while let Some(arg) = it.next() {
+        if !found.consume(&arg, &mut it).map_err(|e| format!("{command}: {e}"))? {
+            left.push(arg);
+        }
+    }
+    let roots = pdfcraft_automation::file_access::AutomationRoots::new(found.read_root.as_deref(), found.write_root.as_deref())
+        .map_err(|e| format!("{command}: {e}"))?;
+    Ok((roots, left))
+}
+
+#[cfg(feature = "mcp")]
+pub(crate) fn mcp(args: &[String]) -> Result<(), CliError> {
+    let (roots, args) = automation_roots("mcp", args)?;
+    let args = args.as_slice();
+    validate_options("mcp", args, MCP_OPTIONS)?;
+    let compact = args.iter().any(|a| a == "--compact");
+    let mut auto = automation(args)?;
+    if let Some(roots) = roots {
+        let show = |root: Option<&Path>| root.map_or_else(|| "none".to_string(), |r| r.display().to_string());
+        let _ = writeln!(
+            std::io::stderr().lock(),
+            "pdfcraft-cli: files confined: read root {}, write root {}",
+            show(roots.read_root()),
+            show(roots.write_root())
+        );
+        auto = auto.with_automation_roots(Some(roots));
+    }
+    let mut server = pdfcraft_automation::mcp::McpServer::new(auto).with_compact(compact);
+    let _ = writeln!(
+        std::io::stderr().lock(),
+        "pdfcraft-cli: MCP server on stdio (protocol {}{}); close stdin to stop",
+        pdfcraft_automation::mcp::PROTOCOL_VERSIONS[0],
+        if compact { ", compact tool list" } else { "" }
+    );
+    server.serve(std::io::stdin().lock(), std::io::stdout().lock()).map_err(|e| CliError::Message(e.to_string()))
+}
diff --git a/apps/pdfcraft-cli/src/ui.rs b/apps/pdfcraft-cli/src/ui.rs
new file mode 100644
index 0000000000..9d12233528
--- /dev/null
+++ b/apps/pdfcraft-cli/src/ui.rs
@@ -0,0 +1,131 @@
+use super::options::{UI_OPTIONS, flag, positional, validate_options};
+use super::*;
+
+// ---- UI control channel client -----------------------------------------------------------------
+
+/// One request to a running app's control channel (`pdfcraft --control FILE`).
+pub(crate) fn ui(args: &[String]) -> Result<(), CliError> {
+    validate_options("ui", args, UI_OPTIONS)?;
+    use std::io::{BufRead, BufReader, Write as _};
+    let file = flag(args, "--control").ok_or("ui: missing --control FILE (start the app with `pdfcraft --control FILE`)")?;
+    let info = read_control_file(file)?;
+    let port = info["port"].as_u64().ok_or(format!("{file}: no port"))?;
+    // Refused rather than truncated, which would quietly reach some other port.
+    let port = u16::try_from(port).map_err(|_| format!("{file}: {port} is not a port number"))?;
+    let token = info["token"].as_str().ok_or(format!("{file}: no token"))?;
+    let pos = positional(args, UI_OPTIONS);
+    let method = *pos.first().ok_or("ui: missing method (state, inspect, click, drag, type, key, command, commands, set, open, screenshot)")?;
+    let method = if method.starts_with("ui.") { method.to_string() } else { format!("ui.{method}") };
+    let mut params = serde_json::Map::new();
+    for kv in pos.iter().skip(1) {
+        let (k, v) = kv.split_once('=').ok_or(format!("ui: expected key=value, got {kv:?}"))?;
+        params.insert(k.to_string(), serde_json::from_str(v).unwrap_or_else(|_| serde_json::Value::String(v.to_string())));
+    }
+    let stream =
+        std::net::TcpStream::connect(("127.0.0.1", port)).map_err(|e| format!("can't reach the app on port {port}: {e} (is it still running?)"))?;
+    stream.set_read_timeout(Some(Duration::from_secs(40))).map_err(|e| e.to_string())?;
+    let mut write = stream.try_clone().map_err(|e| e.to_string())?;
+    let mut lines = BufReader::new(stream).lines();
+    let mut rpc = |id: u64, method: &str, params: serde_json::Value| -> Result<serde_json::Value, String> {
+        writeln!(write, "{}", serde_json::json!({ "jsonrpc": "2.0", "id": id, "method": method, "params": params })).map_err(|e| e.to_string())?;
+        let line = lines.next().ok_or("the app closed the connection")?.map_err(|e| e.to_string())?;
+        let reply: serde_json::Value = serde_json::from_str(&line).map_err(|e| e.to_string())?;
+        match reply.get("error") {
+            Some(e) => Err(e["message"].as_str().unwrap_or("error").to_string()),
+            None => Ok(reply["result"].clone()),
+        }
+    };
+    rpc(1, "auth", serde_json::json!({ "token": token }))?;
+    let mut result = rpc(2, &method, serde_json::Value::Object(params))?;
+    if let (Some(out), Some(data)) = (flag(args, "--out"), result.get("png_base64").and_then(|d| d.as_str())) {
+        use base64::Engine as _;
+        let png = base64::engine::general_purpose::STANDARD.decode(data).map_err(|e| e.to_string())?;
+        std::fs::write(out, png).map_err(|e| format!("{out}: {e}"))?;
+        result["png_base64"] = serde_json::json!(format!("written to {out}"));
+    }
+    stdout_line(format_args!("{}", serde_json::to_string_pretty(&result).unwrap_or_default()))?;
+    Ok(())
+}
+
+/// Most a control file may hold. The app writes under 100 bytes.
+const CONTROL_FILE_MAX: u64 = 64 * 1024;
+
+const CONTROL_FILE_ADVICE: &str =
+    "Start the app with a control file in a folder only you can write, such as `pdfcraft --control ~/.pdfcraft-control.json`";
+
+/// Read the file written by `pdfcraft --control FILE`.
+///
+/// It names the port that receives the token and every command, typed text included, so it must
+/// be the user's own. In a shared folder such as `/tmp`, another local user can create the file
+/// first; the app then can't write it, and the CLI would talk to the other user's listener.
+/// Refused: a symbolic link, anything but a regular file, and on Unix a file owned by someone
+/// else or open to other users (the app writes it with mode 600).
+fn read_control_file(file: &str) -> Result<serde_json::Value, String> {
+    use std::io::Read as _;
+    let at_path = std::fs::symlink_metadata(file).map_err(|e| format!("{file}: {e}"))?;
+    if at_path.file_type().is_symlink() {
+        return Err(format!("{file}: is a symbolic link, which could point at another user's file. {CONTROL_FILE_ADVICE}"));
+    }
+    if !at_path.is_file() {
+        return Err(format!("{file}: not a regular file. {CONTROL_FILE_ADVICE}"));
+    }
+    let f = std::fs::File::open(file).map_err(|e| format!("{file}: {e}"))?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        // Checked on the open file, so nothing swapped in after `symlink_metadata` gets through.
+        let opened = f.metadata().map_err(|e| format!("{file}: {e}"))?;
+        if (opened.dev(), opened.ino()) != (at_path.dev(), at_path.ino()) {
+            return Err(format!("{file}: was replaced while being opened. {CONTROL_FILE_ADVICE}"));
+        }
+        if let Some(problem) = control_file_problem(opened.uid(), opened.mode(), current_uid()) {
+            return Err(format!("{file}: {problem}. {CONTROL_FILE_ADVICE}"));
+        }
+    }
+    let mut text = String::new();
+    f.take(CONTROL_FILE_MAX.saturating_add(1)).read_to_string(&mut text).map_err(|e| format!("{file}: {e}"))?;
+    if u64::try_from(text.len()).unwrap_or(u64::MAX) > CONTROL_FILE_MAX {
+        return Err(format!("{file}: too large for a control file (over {} KiB)", CONTROL_FILE_MAX / 1024));
+    }
+    serde_json::from_str(&text).map_err(|e| format!("{file}: {e}"))
+}
+
+/// Why user `me` can't trust a control file with this owner and mode, if they can't.
+#[cfg(any(test, unix))]
+fn control_file_problem(owner: u32, mode: u32, me: u32) -> Option<String> {
+    if owner != me {
+        return Some(format!("owned by another user (uid {owner}; you are uid {me}), who may be the one listening for your commands"));
+    }
+    let permissions = mode & 0o7777;
+    (permissions & 0o077 != 0).then(|| format!("other users have access to it (mode {permissions:o}; the app writes it with mode 600)"))
+}
+
+/// The effective user id: the owner of the files this process creates, and so of a control file
+/// the app wrote for this user. std has no `geteuid` and this crate forbids `unsafe`; rustix's is
+/// safe and can't fail.
+#[cfg(unix)]
+fn current_uid() -> u32 {
+    rustix::process::geteuid().as_raw()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::control_file_problem;
+
+    #[test]
+    fn a_control_file_must_be_yours_and_private() {
+        // Regular file type bits (0o100000) don't matter, only the owner and the permission bits.
+        assert_eq!(control_file_problem(1000, 0o100600, 1000), None);
+        assert_eq!(control_file_problem(1000, 0o600, 1000), None);
+        assert_eq!(control_file_problem(1000, 0o400, 1000), None);
+        let other = control_file_problem(1001, 0o600, 1000).unwrap_or_default();
+        assert!(other.contains("owned by another user") && other.contains("1001"), "{other}");
+        // Root gets no exception: a file a user planted is still theirs.
+        assert!(control_file_problem(1000, 0o600, 0).is_some_and(|p| p.contains("owned by another user")));
+        for mode in [0o644, 0o640, 0o604, 0o660, 0o606, 0o620, 0o602, 0o610, 0o601, 0o100666] {
+            let open = control_file_problem(1000, mode, 1000).unwrap_or_default();
+            assert!(open.contains("other users"), "{mode:o}: {open}");
+        }
+        assert!(control_file_problem(1000, 0o100644, 1000).unwrap_or_default().contains("mode 644"));
+    }
+}
diff --git a/apps/pdfcraft-web/Cargo.toml b/apps/pdfcraft-web/Cargo.toml
index a64d729dcd..ad8243d594 100644
--- a/apps/pdfcraft-web/Cargo.toml
+++ b/apps/pdfcraft-web/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 pdfcraft-ui-egui = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "glow", "persistence", "accesskit"] }
-egui = { workspace = true }
+egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 wasm-bindgen-futures = "0.4"
diff --git a/apps/pdfcraft/Cargo.toml b/apps/pdfcraft/Cargo.toml
index 6943ad6e44..966af354d1 100644
--- a/apps/pdfcraft/Cargo.toml
+++ b/apps/pdfcraft/Cargo.toml
@@ -11,15 +11,13 @@ workspace = true
 [dependencies]
 # Help ▸ Check for updates (issue #28): one HTTPS request to GitHub, over rustls with the OS's
 # trusted roots. No bundled root list (webpki-roots and webpki-root-certs are CDLA-licensed).
-ureq = { version = "3.4", default-features = false, features = ["rustls-no-provider", "_ring"] }
-rustls-native-certs = "0.8"
 pdfcraft-ui-egui = { workspace = true }
 # `build_info`: the version and compile-time build label for `--version` and the log.
 pdfcraft-engine = { workspace = true }
 # wgpu draws; OpenGL (glow) is the fallback when wgpu can't start on an old or unusual GPU or
 # driver (#461, #435, #392), and can be chosen with PDFCRAFT_RENDERER=gl.
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "glow", "accesskit", "wayland", "x11", "persistence", "links"] }
-egui = { workspace = true }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "glow", "accesskit", "wayland", "x11", "persistence", "links", "clipboard"] }
+egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
 serde_json = { workspace = true }
 # Records from every crate go to standard error and the log file (src/logging.rs).
 log = { workspace = true }
@@ -31,9 +29,6 @@ chrono = { workspace = true }
 # crate registers the handler (Objective-C interop needs unsafe, which our workspace forbids)
 # behind a safe API. Same version as PhotoCraft. Pinned exactly: review the diff before bumping.
 fmv-macos-events = "=0.1.0"
-# ⌘Q asks about unsaved changes like the close button (#1136): an app menu whose Quit asks the
-# window to close instead of winit's, which ends the process without asking.
-craft-quit = { workspace = true, features = ["menu"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 # Asks the Wayland compositor which GPU it draws with (linux-dmabuf feedback), so the window is
@@ -71,3 +66,6 @@ uds_windows = "=1.2.1"
 [build-dependencies]
 # Icon + VERSIONINFO for pdfcraft.exe; build.rs only uses it when targeting Windows.
 winresource = "0.1"
+
+[target.'cfg(windows)'.dependencies]
+craft-update = { workspace = true }
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 96725cd8d5..f8e4e5b0d2 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -41,7 +41,6 @@ mod reopen;
 mod settings;
 mod single_instance;
 mod text_scale;
-mod updates;
 #[cfg(test)]
 #[path = "windows_manifest.rs"]
 mod windows_manifest;
@@ -195,6 +194,11 @@ fn rejoin_split_paths(args: Vec<String>, exists: impl Fn(&str) -> bool) -> Vec<S
 }
 
 fn main() -> eframe::Result {
+    // Windows: the update helper is a copy of this program started with `--finish-update`.
+    #[cfg(windows)]
+    if let Some(result) = craft_update::self_update::finish(&craft_update::suite::PDFCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+        std::process::exit(i32::from(result.is_err()));
+    }
     // First, so the panic hook and every start-up warning are recorded (`logging`).
     let logger = logging::install();
     // Last-resort guard (AGENTS.md §4): commands, edits, opens and saves catch panics and report
@@ -357,6 +361,9 @@ fn native_options(integrated: bool, app_frame: bool, renderer: eframe::Renderer)
     let persistence_path = settings_dir().map(|d| d.join("app.ron"));
     // Set explicitly, so the renderer never depends on which one eframe defaults to.
     let mut native = eframe::NativeOptions { viewport, persistence_path, renderer, ..Default::default() };
+    // PdfCraft installs its own last-resort system face (`PDFCRAFT_SYSTEM_FONTS`); eframe's
+    // provider would read every installed face, including proprietary ones, into every UI pass.
+    native.system_font_fallback = false;
     if renderer == eframe::Renderer::Wgpu {
         configure_gpu(&mut native);
     }
@@ -416,16 +423,17 @@ fn app_creator<'a>(
         {
             app.motion.source = Some(motion::source());
         }
-        app.update_source = Some(std::sync::Arc::new(updates::latest_release));
+        app.set_startup_update_check(true);
         app.printer_source = Some(pdfcraft_ui_egui::system_printers());
         app.os_key_store_ids = cfg!(any(target_os = "macos", target_os = "windows"));
         #[cfg(target_os = "macos")]
         {
             app.os_events = Some(apple_events.connect(&cc.egui_ctx));
-            // winit's Quit (⌘Q) ends the process without asking about unsaved changes (#1136). This
-            // menu's Quit closes the window instead, so `guard_quit` asks, as for the close button.
-            if let Err(e) = craft_quit::install_app_menu(&cc.egui_ctx, "PdfCraft") {
-                log::warn!("couldn't install the app menu, so ⌘Q quits without asking to save: {e}");
+            // The native menu bar. Its Quit (⌘Q) closes the window rather than ending the process as
+            // winit's does (#1136), so `guard_quit` asks about unsaved changes, as for the close
+            // button.
+            if !app.install_native_menu(&cc.egui_ctx) {
+                log::warn!("couldn't install the macOS menu bar; the menus stay in the window");
             }
         }
         if let Some(server) = instance {
@@ -794,671 +802,4 @@ fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[D
 }
 
 #[cfg(test)]
-mod tests {
-    use pdfcraft_ui_egui::control::Endpoint;
-
-    fn endpoint() -> std::io::Result<Endpoint> {
-        Ok(Endpoint { port: 4321, token: "0123456789abcdef".into() })
-    }
-
-    /// Tests that open a real GPU device take this first, so only one of them is inside the
-    /// graphics libraries at a time. The test threads otherwise run them together, and on
-    /// FreeBSD's CI machine the test process then died with SIGSEGV, in about half the runs:
-    /// the first device was still being set up when the second test began its own. The UI
-    /// tests take turns the same way (`crates/ui-egui/tests/it/main.rs`). Hold it for the whole
-    /// test (declared before the instance, so it's released after the device is dropped).
-    static GPU: std::sync::Mutex<()> = std::sync::Mutex::new(());
-
-    fn gpu() -> std::sync::MutexGuard<'static, ()> {
-        // A test that panicked while holding it leaves nothing to clean up.
-        GPU.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
-    }
-
-    #[test]
-    fn a_control_channel_that_cant_be_published_stops_the_app() {
-        let dir = std::env::temp_dir().join(format!("pdfcraft-app-control-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        let path = |name: &str| dir.join(name).to_str().unwrap().to_owned();
-
-        // A folder in the way stands in for a file another user created first: the write fails.
-        std::fs::create_dir(dir.join("taken.json")).unwrap();
-        let err = super::open_control_channel(&path("taken.json"), endpoint()).unwrap_err();
-        assert!(err.contains("--control") && err.contains("taken.json") && err.contains("only you can write"), "{err}");
-        // No listener: nothing to publish.
-        let err = super::open_control_channel(&path("pc.json"), Err(std::io::Error::other("no loopback"))).unwrap_err();
-        assert!(err.contains("no loopback"), "{err}");
-        assert!(!dir.join("pc.json").exists());
-
-        super::open_control_channel(&path("pc.json"), endpoint()).unwrap();
-        let written: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(dir.join("pc.json")).unwrap()).unwrap();
-        assert_eq!((written["port"].as_u64(), written["token"].as_str()), (Some(4321), Some("0123456789abcdef")));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn path_from_arg_decodes_file_uris() {
-        assert_eq!(super::path_from_arg("file:///home/alice/report.pdf".to_string()), "/home/alice/report.pdf");
-        assert_eq!(super::path_from_arg("file:///home/alice/my%20report.pdf".to_string()), "/home/alice/my report.pdf");
-        assert_eq!(super::path_from_arg("file://localhost/tmp/a%C3%A9.pdf".to_string()), "/tmp/aé.pdf");
-        // Malformed or truncated escapes are kept as written; bytes that aren't UTF-8 keep the URI.
-        assert_eq!(super::path_from_arg("file:///tmp/100%.pdf".to_string()), "/tmp/100%.pdf");
-        assert_eq!(super::path_from_arg("file:///tmp/a%2".to_string()), "/tmp/a%2");
-        assert_eq!(super::path_from_arg("file:///tmp/%zz%".to_string()), "/tmp/%zz%");
-        assert_eq!(super::path_from_arg("file:///tmp/%FF.pdf".to_string()), "file:///tmp/%FF.pdf");
-    }
-
-    #[test]
-    fn unquoted_paths_with_spaces_are_rejoined() {
-        let have = ["P:\\Archive\\00042A26 Contract.PDF", "C:\\a b c.pdf", "C:\\a.pdf", "C:\\x y.pdf"];
-        let exists = |p: &str| have.contains(&p);
-        let args = |a: &[&str]| a.iter().map(|s| s.to_string()).collect::<Vec<_>>();
-        // The case an office program produced: one path, split at its space.
-        assert_eq!(
-            super::rejoin_split_paths(args(&["P:\\Archive\\00042A26", "Contract.PDF"]), exists),
-            args(&["P:\\Archive\\00042A26 Contract.PDF"])
-        );
-        // The longest run wins; files that exist on their own are left alone.
-        assert_eq!(super::rejoin_split_paths(args(&["C:\\a", "b", "c.pdf", "C:\\a.pdf"]), exists), args(&["C:\\a b c.pdf", "C:\\a.pdf"]));
-        assert_eq!(super::rejoin_split_paths(args(&["C:\\a.pdf", "C:\\x", "y.pdf"]), exists), args(&["C:\\a.pdf", "C:\\x y.pdf"]));
-        // Nothing to join: kept as given, so the missing file is still reported by name.
-        assert_eq!(super::rejoin_split_paths(args(&["missing.pdf", "other"]), exists), args(&["missing.pdf", "other"]));
-        assert!(super::rejoin_split_paths(Vec::new(), exists).is_empty());
-    }
-
-    #[test]
-    fn path_from_arg_leaves_plain_paths_and_other_schemes_alone() {
-        assert_eq!(super::path_from_arg("report.pdf".to_string()), "report.pdf");
-        assert_eq!(super::path_from_arg("/home/alice/report.pdf".to_string()), "/home/alice/report.pdf");
-        assert_eq!(super::path_from_arg("https://example.com/report.pdf".to_string()), "https://example.com/report.pdf");
-        assert_eq!(super::path_from_arg("file://server/share/a.pdf".to_string()), "file://server/share/a.pdf");
-        assert_eq!(super::path_from_arg("file://".to_string()), "file://");
-    }
-
-    #[test]
-    fn opengl_is_the_fallback_unless_a_renderer_was_chosen() {
-        use super::{RendererChoice, native_options, renderer_choice, retry_with_gl};
-        assert_eq!(renderer_choice(None), RendererChoice::Auto);
-        assert_eq!(renderer_choice(Some("")), RendererChoice::Auto);
-        assert_eq!(renderer_choice(Some("vulkan")), RendererChoice::Auto);
-        assert_eq!(renderer_choice(Some(" WGPU ")), RendererChoice::Wgpu);
-        for gl in ["gl", "OpenGL", "glow"] {
-            assert_eq!(renderer_choice(Some(gl)), RendererChoice::Gl);
-        }
-        // Retried with OpenGL only when wgpu failed to start by default, never after the app ran.
-        assert!(retry_with_gl(RendererChoice::Auto, false));
-        assert!(!retry_with_gl(RendererChoice::Auto, true));
-        assert!(!retry_with_gl(RendererChoice::Wgpu, false));
-        assert!(!retry_with_gl(RendererChoice::Gl, false));
-        // Each run states its renderer rather than relying on eframe's default.
-        assert_eq!(native_options(false, false, eframe::Renderer::Wgpu).renderer, eframe::Renderer::Wgpu);
-        assert_eq!(native_options(false, false, eframe::Renderer::Glow).renderer, eframe::Renderer::Glow);
-    }
-
-    #[test]
-    fn the_desktop_frame_is_turned_off_only_when_the_app_draws_one() {
-        use super::native_options;
-        assert_eq!(native_options(false, false, eframe::Renderer::Glow).viewport.decorations, None);
-        assert_eq!(native_options(false, true, eframe::Renderer::Glow).viewport.decorations, Some(false));
-    }
-
-    #[test]
-    fn a_software_renderer_is_shown_to_the_user() {
-        use eframe::wgpu::DeviceType;
-        // Issue #519: WARP or llvmpipe is announced in the app, not just in pdfcraft.log.
-        let mut app = super::PdfCraftApp::new();
-        super::notify_software_renderer(&mut app, DeviceType::Cpu);
-        let notice = app.toast.as_ref().map(|(m, _)| m.as_str()).unwrap_or_default();
-        assert!(notice.contains("without a graphics processor"), "{notice:?}");
-        for gpu in [DeviceType::IntegratedGpu, DeviceType::DiscreteGpu, DeviceType::VirtualGpu, DeviceType::Other] {
-            let mut app = super::PdfCraftApp::new();
-            super::notify_software_renderer(&mut app, gpu);
-            assert!(app.toast.is_none(), "{gpu:?}: {:?}", app.toast);
-        }
-    }
-
-    #[test]
-    fn gpu_setup_avoids_vulkan_and_stretched_resizes_on_windows_and_prefers_low_power() {
-        let mut native = eframe::NativeOptions::default();
-        super::configure_gpu(&mut native);
-        let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &native.wgpu_options.wgpu_setup else {
-            panic!("default setup creates its own instance")
-        };
-        if std::env::var_os("WGPU_POWER_PREF").is_none() {
-            assert_eq!(setup.power_preference, eframe::wgpu::PowerPreference::LowPower);
-        }
-        if std::env::var_os("WGPU_VALIDATION_INDIRECT_CALL").is_none() {
-            let flags = setup.instance_descriptor.flags;
-            assert!(!flags.contains(eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL), "Intel Metal can't compile its shader: {flags:?}");
-        }
-        if cfg!(target_os = "windows") && std::env::var_os("WGPU_BACKEND").is_none() {
-            let backends = setup.instance_descriptor.backends;
-            assert!(backends.contains(eframe::wgpu::Backends::DX12), "{backends:?}");
-            assert!(!backends.contains(eframe::wgpu::Backends::VULKAN), "issue #37: {backends:?}");
-        }
-        use eframe::wgpu::Dx12SwapchainKind::{DxgiFromHwnd, DxgiFromVisual};
-        assert_eq!(super::dx12_presentation(None), DxgiFromVisual);
-        assert_eq!(super::dx12_presentation(Some(DxgiFromHwnd)), DxgiFromHwnd, "WGPU_DX12_PRESENTATION_SYSTEM still decides");
-        assert_eq!(super::dx12_presentation(Some(DxgiFromVisual)), DxgiFromVisual);
-        let presentation = setup.instance_descriptor.backend_options.dx12.presentation_system;
-        if cfg!(target_os = "windows") {
-            // A composition visual unless WGPU_DX12_PRESENTATION_SYSTEM asks otherwise.
-            let asked = eframe::wgpu::Dx12SwapchainKind::from_env();
-            assert_eq!(presentation, asked.unwrap_or(DxgiFromVisual), "issue #2738: resizing stretches a window swap chain");
-        } else {
-            assert_eq!(presentation, eframe::wgpu::Dx12SwapchainKind::default().with_env(), "only Windows changes it");
-        }
-    }
-
-    #[test]
-    fn restored_hidpi_window_fits_the_adapters_surface_limit() {
-        // The Outlook launch crash: 3440 x 1369 saved points at 250% DPI requested this surface.
-        let (width, height) = (8600, 3423);
-        let required = eframe::wgpu::Limits::default();
-        assert!(width > required.max_texture_dimension_2d);
-        let supported = eframe::wgpu::Limits { max_texture_dimension_2d: 16384, ..required.clone() };
-        let enabled = super::surface_texture_limits(required, &supported);
-        assert!(width <= enabled.max_texture_dimension_2d);
-        assert!(height <= enabled.max_texture_dimension_2d);
-    }
-
-    #[test]
-    fn surface_limits_preserve_other_requirements_and_never_overrequest() {
-        for required in [eframe::wgpu::Limits::default(), eframe::wgpu::Limits::downlevel_webgl2_defaults()] {
-            for extent in [4096, 8192, 16384] {
-                let supported = eframe::wgpu::Limits {
-                    max_texture_dimension_2d: extent,
-                    max_bind_groups: 8,
-                    min_uniform_buffer_offset_alignment: 128,
-                    min_storage_buffer_offset_alignment: 128,
-                    ..required.clone()
-                };
-                let enabled = super::surface_texture_limits(required.clone(), &supported);
-                let mut expected = required.clone();
-                expected.max_texture_dimension_2d = extent;
-                assert_eq!(enabled, expected);
-                assert_eq!(enabled.max_texture_dimension_2d, supported.max_texture_dimension_2d);
-                assert!(enabled.check_limits(&supported));
-            }
-        }
-    }
-
-    #[test]
-    fn surface_limits_fit_v3d_shader_variable_limit() {
-        // Issue #2383: V3D supports 15 variables, below the default request of 16.
-        let required = eframe::wgpu::Limits::default();
-        let supported = eframe::wgpu::Limits { max_texture_dimension_2d: 7680, max_inter_stage_shader_variables: 15, ..required.clone() };
-        let enabled = super::surface_texture_limits(required.clone(), &supported);
-        assert!(enabled.check_limits(&supported), "unsupported device limits: {enabled:?}");
-        let expected = eframe::wgpu::Limits { max_texture_dimension_2d: 7680, max_inter_stage_shader_variables: 15, ..required };
-        assert_eq!(enabled, expected);
-    }
-
-    #[test]
-    fn surface_limits_fit_downlevel_maxima_and_minimum_alignments() {
-        let required = eframe::wgpu::Limits::downlevel_webgl2_defaults();
-        let supported = eframe::wgpu::Limits {
-            max_texture_dimension_2d: 2048,
-            max_bind_groups: 2,
-            max_vertex_attributes: 8,
-            min_uniform_buffer_offset_alignment: 512,
-            min_storage_buffer_offset_alignment: 512,
-            ..required.clone()
-        };
-        let enabled = super::surface_texture_limits(required, &supported);
-        assert!(enabled.check_limits(&supported), "unsupported device limits: {enabled:?}");
-        // Larger minimum alignments are weaker capabilities, unlike maximum limits.
-        assert_eq!(enabled, supported);
-    }
-
-    #[test]
-    fn a_window_larger_than_the_gpu_limit_gets_a_surface_within_it() {
-        use eframe::egui_wgpu::winit::surface_fit;
-        // Issue #577: 3440 x 1369 points restored at 250% asked an 8192-pixel device for this.
-        let (width, height, scale) = surface_fit(8600, 3423, 8192);
-        assert_eq!((width, height), (8192, 3260));
-        // Both sides shrink alike and egui draws at that factor: the whole window is drawn.
-        assert!((8600.0 * scale - 8192.0).abs() < 0.01, "{scale}");
-        assert!((3423.0 * scale - height as f32).abs() < 1.0, "{scale}");
-        // Within the limit nothing changes, up to and including the limit itself.
-        assert_eq!(surface_fit(8600, 3423, 16384), (8600, 3423, 1.0));
-        assert_eq!(surface_fit(8192, 8192, 8192), (8192, 8192, 1.0));
-        assert_eq!(surface_fit(0, 0, 8192), (0, 0, 1.0));
-        // One side over the limit: the window as it would be stretched across monitors.
-        assert_eq!(surface_fit(8193, 600, 8192).0, 8192);
-        assert_eq!(surface_fit(600, 8193, 8192).1, 8192);
-    }
-
-    #[test]
-    fn surface_fit_never_empties_or_overflows_a_surface() {
-        use eframe::egui_wgpu::winit::surface_fit;
-        for (w, h, max) in [
-            (1, u32::MAX, 8192),
-            (u32::MAX, 1, 2048),
-            (u32::MAX, u32::MAX, 16384),
-            (0, u32::MAX, 8192),
-            (u32::MAX, 0, 8192),
-            (5, 7, 0),
-            (40_000, 3, 1),
-        ] {
-            let (fw, fh, scale) = surface_fit(w, h, max);
-            assert!(fw <= max.max(1) && fh <= max.max(1), "{w} x {h} in {max}: {fw} x {fh}");
-            // A side that wasn't zero stays non-zero (`Surface::configure` rejects an empty one),
-            // and a zero side stays zero (egui-wgpu skips configuring it).
-            assert_eq!((fw == 0, fh == 0), (w == 0, h == 0), "{w} x {h} in {max}: {fw} x {fh}");
-            assert!(scale.is_finite() && scale > 0.0 && scale <= 1.0, "{w} x {h} in {max}: {scale}");
-        }
-        // The longer side lands exactly on the limit (rounding never leaves it a pixel short),
-        // and the shorter side keeps the window's proportions to within a pixel.
-        for max in [2048, 8192, 16384] {
-            for long in (max + 1..=max * 5).step_by(997).chain([max * 2, max * 4, u32::MAX]) {
-                for short in [1, 3, 600, max / 3, max - 1, max, long - 1, long] {
-                    let (fw, fh, scale) = surface_fit(long, short, max);
-                    assert_eq!(fw, max, "{long} x {short} in {max}");
-                    let expected = f64::from(short) * f64::from(max) / f64::from(long);
-                    assert!((f64::from(fh) - expected).abs() <= 1.0, "{long} x {short} in {max}: {fh}");
-                    assert_eq!(surface_fit(short, long, max), (fh, fw, scale), "transposed");
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn egui_wgpu_carries_the_surface_size_fit() {
-        // Issue #577: egui-wgpu 0.36.2 configures a window's surface at the window's size, and
-        // `Surface::configure` panics when that's beyond the device's `max_texture_dimension_2d`
-        // (emilk/egui#8361). vendor/egui-wgpu fits it within the limit. A dependency bump that
-        // resolves egui-wgpu from crates.io again, or a re-vendored copy without the patch, would
-        // bring the crash back: re-apply the patch, or drop the copy once an egui release has a
-        // fix (vendor/README.md).
-        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
-        let lock = std::fs::read_to_string(root.join("Cargo.lock")).unwrap();
-        let egui_wgpu = lock.split("[[package]]").find(|p| p.contains("\nname = \"egui-wgpu\"\n")).expect("egui-wgpu is in Cargo.lock");
-        assert!(!egui_wgpu.contains("\nsource = "), "egui-wgpu must resolve to vendor/egui-wgpu, not:{egui_wgpu}");
-        // `surface_fit` is tested above; these keep it in the paths that size a surface.
-        let painter = std::fs::read_to_string(root.join("vendor/egui-wgpu/src/winit.rs")).unwrap().replace("\r\n", "\n");
-        for patch in [
-            "let (width, height, render_scale) = surface_fit(window_width, window_height, max_side);",
-            "let (fit_width, fit_height, _) = surface_fit(width, height, self.max_surface_side());",
-            "pixels_per_point: pixels_per_point * surface_state.render_scale,",
-            "old_state.window_width,\n            old_state.window_height,",
-        ] {
-            assert!(painter.contains(patch), "vendor/egui-wgpu lost its surface size patch: {patch}");
-        }
-    }
-
-    #[test]
-    fn a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic() {
-        // Issue #519: on a 2015 Intel GPU, wgpu's GL backend couldn't configure the window's
-        // surface (`GpuWaitTimeout`), and wgpu's default error handler panicked before the app was
-        // created, so PdfCraft never got to retry with OpenGL. vendor/egui-wgpu configures a new
-        // window's surface inside `catch_errors`. A real device on PdfCraft's own GPU settings,
-        // and an error wgpu raises before anything reaches the driver: a texture one pixel wider
-        // than the device allows.
-        use eframe::wgpu;
-        let _gpu = gpu();
-        let native = super::native_options(false, false, eframe::Renderer::Wgpu);
-        let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &native.wgpu_options.wgpu_setup else {
-            panic!("default setup creates its own instance")
-        };
-        let instance = pollster::block_on(native.wgpu_options.wgpu_setup.new_instance());
-        let options = wgpu::RequestAdapterOptions { power_preference: setup.power_preference, ..Default::default() };
-        // CI runners have a software adapter (WARP, llvmpipe); a machine without any skips.
-        let Ok(adapter) = pollster::block_on(instance.request_adapter(&options)) else {
-            eprintln!("skipping: no GPU adapter on this machine");
-            return;
-        };
-        let Ok((device, _queue)) = pollster::block_on(adapter.request_device(&(setup.device_descriptor)(&adapter))) else {
-            eprintln!("skipping: the adapter gives no device");
-            return;
-        };
-        let texture = |width: u32| {
-            device.create_texture(&wgpu::TextureDescriptor {
-                label: Some("issue-519"),
-                size: wgpu::Extent3d { width, height: 1, depth_or_array_layers: 1 },
-                mip_level_count: 1,
-                sample_count: 1,
-                dimension: wgpu::TextureDimension::D2,
-                format: wgpu::TextureFormat::Rgba8Unorm,
-                usage: wgpu::TextureUsages::TEXTURE_BINDING,
-                view_formats: &[],
-            })
-        };
-        let too_wide = device.limits().max_texture_dimension_2d.saturating_add(1);
-        let caught = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(too_wide)));
-        assert!(matches!(caught, Err(wgpu::Error::Validation { .. })), "{caught:?}");
-        // The device stays usable, and nothing is left behind to catch later errors by mistake.
-        let fine = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(16)));
-        assert!(fine.is_ok(), "{fine:?}");
-        assert_eq!(pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || 7)).ok(), Some(7));
-        // Nested: the inner call keeps its own error, and the outer one still catches what follows.
-        let caught = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || {
-            let inner = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(too_wide)));
-            assert!(inner.is_err(), "inner: {inner:?}");
-            texture(too_wide)
-        }));
-        assert!(matches!(caught, Err(wgpu::Error::Validation { .. })), "outer: {caught:?}");
-    }
-
-    #[test]
-    fn egui_wgpu_returns_a_surface_it_cannot_configure_as_an_error() {
-        // Issue #519: `catch_errors` is tested above; this keeps it around the first configure of
-        // every new window's surface, and its error reaching eframe as `WgpuError` (eframe then
-        // returns `Error::Wgpu`, which `main` retries with OpenGL). Without it a failed configure
-        // panics before the app is created, and the OpenGL retry never runs.
-        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
-        let lock = std::fs::read_to_string(root.join("Cargo.lock")).unwrap();
-        let egui_wgpu = lock.split("[[package]]").find(|p| p.contains("\nname = \"egui-wgpu\"\n")).expect("egui-wgpu is in Cargo.lock");
-        assert!(!egui_wgpu.contains("\nsource = "), "egui-wgpu must resolve to vendor/egui-wgpu, not:{egui_wgpu}");
-        let painter = std::fs::read_to_string(root.join("vendor/egui-wgpu/src/winit.rs")).unwrap().replace("\r\n", "\n");
-        let add_surface = painter.split("async fn add_surface(").nth(1).and_then(|s| s.split("\n    fn ").next()).expect("add_surface");
-        for patch in [
-            "let installed = catch_errors(&device, || {\n            self.install_surface(surface, viewport_id, size.width, size.height, false);\n        })",
-            "return Err(crate::WgpuError::ConfigureSurface(error));",
-        ] {
-            assert!(add_surface.contains(patch), "vendor/egui-wgpu lost its surface configure patch: {patch}");
-        }
-    }
-
-    #[test]
-    fn pipeline_creation_error_is_returned_and_device_remains_usable() {
-        use eframe::{egui_wgpu, wgpu};
-        let _gpu = gpu();
-        let mut native = super::native_options(false, false, eframe::Renderer::Wgpu);
-        let egui_wgpu::WgpuSetup::CreateNew(setup) = &native.wgpu_options.wgpu_setup else { panic!("default setup creates its own instance") };
-        let instance = pollster::block_on(native.wgpu_options.wgpu_setup.new_instance());
-        let options = wgpu::RequestAdapterOptions { power_preference: setup.power_preference, ..Default::default() };
-        let Ok(adapter) = pollster::block_on(instance.request_adapter(&options)) else {
-            assert!(std::env::var_os("PDFCRAFT_TEST_REQUIRE_GPU").is_none(), "a GPU adapter is required for this run");
-            eprintln!("skipping pipeline regression: no GPU adapter");
-            return;
-        };
-        let (device, queue) = pollster::block_on(adapter.request_device(&(setup.device_descriptor)(&adapter)))
-            .expect("the selected adapter must provide a test device");
-        native.wgpu_options.wgpu_setup =
-            egui_wgpu::WgpuSetup::Existing(egui_wgpu::WgpuSetupExisting { instance: instance.clone(), adapter, device, queue });
-        // Three samples is invalid on every backend, so this reproduces a pipeline error
-        // without depending on a particular driver. The unpatched constructor panics.
-        for samples in [3, 1, 3, 1] {
-            let options = egui_wgpu::RendererOptions { msaa_samples: samples, ..Default::default() };
-            let result = pollster::block_on(egui_wgpu::RenderState::create(&native.wgpu_options, &instance, None, options));
-            if samples == 3 {
-                let error = result.err().expect("invalid pipeline must return an error");
-                assert!(error.to_string().contains("egui_pipeline"), "{error}");
-            } else {
-                assert!(result.is_ok(), "the device must remain usable: {:?}", result.err());
-            }
-        }
-    }
-
-    #[test]
-    fn winit_carries_the_windows_11_monitor_scale_fix() {
-        // Issue #324: winit 0.30.13 as released nudges a window dragged onto a monitor with another
-        // scale factor back onto the one it is leaving, so on Windows 11 it ends up on the wrong
-        // monitor, at the wrong size and scale. vendor/winit carries the fix from winit master. A
-        // dependency bump that resolves winit from crates.io again, or a re-vendored copy without
-        // the patch, would silently bring the bug back: re-apply the patch, or drop the copy once a
-        // winit 0.30 release has the fix (vendor/README.md).
-        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
-        let lock = std::fs::read_to_string(root.join("Cargo.lock")).unwrap();
-        let winit = lock.split("[[package]]").find(|p| p.contains("\nname = \"winit\"\n")).expect("winit is in Cargo.lock");
-        assert!(!winit.contains("\nsource = "), "winit must resolve to vendor/winit, not:{winit}");
-        let dpi_changed = std::fs::read_to_string(root.join("vendor/winit/src/platform_impl/windows/event_loop.rs")).unwrap();
-        let patch = "if !WIN10_BUILD_VERSION.is_some_and(|build| build < 22000) {\n                new_outer_rect = suggested_rect;";
-        assert!(dpi_changed.contains(patch), "vendor/winit lost its WM_DPICHANGED patch");
-    }
-
-    const NVIDIA: (u32, u32) = (0x10de, 0x2684);
-    const NVIDIA_3090: (u32, u32) = (0x10de, 0x2204);
-    const AMD_IGPU: (u32, u32) = (0x1002, 0x164e);
-
-    fn adapters() -> Vec<(u32, u32, eframe::wgpu::DeviceType)> {
-        use eframe::wgpu::DeviceType;
-        vec![(NVIDIA.0, NVIDIA.1, DeviceType::DiscreteGpu), (AMD_IGPU.0, AMD_IGPU.1, DeviceType::IntegratedGpu), (0, 0, DeviceType::Cpu)]
-    }
-
-    const INTEL_IGPU: (u32, u32) = (0x8086, 0xa780);
-
-    fn monitor(pci: (u32, u32)) -> super::DisplayGpu {
-        super::DisplayGpu { pci, primary: false }
-    }
-
-    fn panel(pci: (u32, u32)) -> super::DisplayGpu {
-        super::DisplayGpu { pci, primary: true }
-    }
-
-    #[test]
-    fn pick_adapter_prefers_the_gpu_driving_the_monitors() {
-        // A desktop whose monitors are all on the discrete GPU: the integrated one shows black.
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA)], None), Some(0));
-        // Issue #378: the same on Windows, where the Ryzen integrated GPU without a monitor crashed
-        // the display driver. Windows also says which display is the primary one.
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(NVIDIA)], None), Some(0));
-    }
-
-    #[test]
-    fn pick_adapter_prefers_the_gpu_driving_the_primary_display() {
-        // A Windows desktop with a monitor on each GPU: the window opens on the primary display.
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), panel(NVIDIA)], None), Some(0));
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], None), Some(1));
-    }
-
-    #[test]
-    fn pci_ids_come_from_windows_device_ids() {
-        assert_eq!(super::pci_ids("PCI\\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1"), Some(NVIDIA_3090));
-        assert_eq!(super::pci_ids("PCI\\VEN_1002&DEV_164E&SUBSYS_88771043&REV_C1"), Some(AMD_IGPU));
-        assert_eq!(super::pci_ids("pci\\ven_1002&dev_164e"), Some(AMD_IGPU));
-        // Remote Desktop and other non-PCI display devices, and malformed ids.
-        assert_eq!(super::pci_ids("ROOT\\BasicDisplay\\0000"), None);
-        assert_eq!(super::pci_ids("PCI\\VEN_10DE&SUBSYS_40421458"), None);
-        assert_eq!(super::pci_ids("PCI\\VEN_10DE&DEV_ZZZZ"), None);
-        assert_eq!(super::pci_ids("VEN_&DEV_"), None);
-        assert_eq!(super::pci_ids(""), None);
-    }
-
-    #[cfg(target_os = "windows")]
-    #[test]
-    fn windows_display_gpus_lists_pci_gpus_with_a_monitor() {
-        // Whatever this machine has: every entry is a PCI GPU, at most one drives the primary
-        // display, and no GPU is listed twice. (A headless CI runner may list none.)
-        let gpus = super::windows_display_gpus();
-        assert!(gpus.iter().filter(|g| g.primary).count() <= 1, "{gpus:?}");
-        for (i, g) in gpus.iter().enumerate() {
-            assert!(g.pci.0 != 0, "{gpus:?}");
-            assert!(!gpus[..i].iter().any(|h| h.pci == g.pci), "{gpus:?}");
-        }
-    }
-
-    #[test]
-    fn pick_adapter_keeps_the_integrated_gpu_on_hybrid_laptops() {
-        // Issue #8: the panel is on the integrated GPU, an external monitor on the discrete one.
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA), panel(AMD_IGPU)], None), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], None), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], None), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU)], None), Some(1));
-    }
-
-    #[test]
-    fn pick_adapter_prefers_the_discrete_gpu_on_desktops_with_a_monitor_on_each() {
-        // Issue #445: one monitor on the Intel iGPU, one on the NVIDIA card, no built-in panel.
-        use eframe::wgpu::DeviceType;
-        let desktop =
-            [(INTEL_IGPU.0, INTEL_IGPU.1, DeviceType::IntegratedGpu), (NVIDIA.0, NVIDIA.1, DeviceType::DiscreteGpu), (0, 0, DeviceType::Cpu)];
-        assert_eq!(super::pick_adapter(&desktop, &[monitor(INTEL_IGPU), monitor(NVIDIA)], None), Some(1));
-        assert_eq!(super::pick_adapter(&desktop, &[monitor(NVIDIA), monitor(INTEL_IGPU)], None), Some(1));
-        // A GPU driving no display still loses to one that does.
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), monitor(INTEL_IGPU)], None), Some(1));
-    }
-
-    #[test]
-    fn pick_adapter_prefers_the_gpu_the_compositor_draws_with() {
-        // A hybrid laptop whose Wayland compositor runs on the discrete GPU (Hyprland with
-        // `AQ_DRM_DEVICES` naming it first): the integrated GPU drives the built-in panel, yet the
-        // compositor shows nothing it draws, and reports no error either.
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], Some(NVIDIA)), Some(0));
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], Some(NVIDIA)), Some(0));
-        // The usual hybrid laptop, with the compositor on the integrated GPU: as before (#8).
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], Some(AMD_IGPU)), Some(1));
-        // No GPU drives a display as far as sysfs says (a container), but the compositor knows.
-        assert_eq!(super::pick_adapter(&adapters(), &[], Some(NVIDIA)), Some(0));
-        // A compositor GPU no adapter matches (a virtual one) leaves the displays in charge.
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], Some((0x1af4, 0x1050))), Some(1));
-    }
-
-    #[test]
-    fn pick_adapter_falls_back_to_low_power_without_a_match() {
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234))], None), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234)), monitor((0x8086, 0x5678))], None), Some(1));
-        assert_eq!(super::pick_adapter(&[], &[monitor(NVIDIA)], None), None);
-    }
-
-    #[test]
-    fn internal_panels_are_edp_lvds_and_dsi_connectors() {
-        for name in ["eDP-1", "LVDS-1", "DSI-1"] {
-            assert!(super::is_internal_panel(name), "{name}");
-        }
-        for name in ["DP-3", "HDMI-A-1", "DVI-D-1", "VGA-1", "Writeback-1", ""] {
-            assert!(!super::is_internal_panel(name), "{name}");
-        }
-    }
-
-    #[cfg(target_os = "linux")]
-    #[test]
-    fn linux_display_gpus_reads_connected_connectors() -> std::io::Result<()> {
-        let dir = std::env::temp_dir().join(format!("pdfcraft-drm-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        let card = |name: &str, (vendor, device): (u32, u32)| -> std::io::Result<()> {
-            std::fs::create_dir_all(dir.join(name).join("device"))?;
-            std::fs::write(dir.join(name).join("device/vendor"), format!("{vendor:#06x}\n"))?;
-            std::fs::write(dir.join(name).join("device/device"), format!("{device:#06x}\n"))
-        };
-        let connector = |name: &str, status: &str| -> std::io::Result<()> {
-            std::fs::create_dir_all(dir.join(name))?;
-            std::fs::write(dir.join(name).join("status"), format!("{status}\n"))
-        };
-        card("card1", NVIDIA)?;
-        card("card2", AMD_IGPU)?;
-        connector("card1-DP-3", "connected")?;
-        connector("card1-DP-4", "connected")?;
-        connector("card2-HDMI-A-1", "disconnected")?;
-        connector("card2-Writeback-1", "unknown")?;
-        let desktop = super::linux_display_gpus(&dir);
-        // Issue #445: a monitor on the integrated GPU too, still no built-in panel.
-        connector("card2-HDMI-A-1", "connected")?;
-        let mut both = super::linux_display_gpus(&dir);
-        // A hybrid laptop: the integrated GPU drives the built-in panel as well.
-        connector("card2-eDP-1", "connected")?;
-        let mut laptop = super::linux_display_gpus(&dir);
-        std::fs::remove_dir_all(&dir)?;
-        assert_eq!(desktop, vec![monitor(NVIDIA)]);
-        both.sort_by_key(|g| g.pci);
-        assert_eq!(both, vec![monitor(AMD_IGPU), monitor(NVIDIA)]);
-        laptop.sort_by_key(|g| g.pci);
-        assert_eq!(laptop, vec![panel(AMD_IGPU), monitor(NVIDIA)]);
-        assert!(super::linux_display_gpus(std::path::Path::new("/nonexistent/drm")).is_empty());
-        Ok(())
-    }
-
-    /// A fresh folder per call: tests run in parallel.
-    fn scratch() -> std::path::PathBuf {
-        static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
-        let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-        let d = std::env::temp_dir().join(format!("pdfcraft-control-file-{}-{n}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&d);
-        std::fs::create_dir_all(&d).unwrap();
-        d
-    }
-
-    /// The control file's port and token, and every name in its folder.
-    fn written(dir: &std::path::Path) -> (serde_json::Value, Vec<String>) {
-        let json = serde_json::from_str(&std::fs::read_to_string(dir.join("ctl.json")).unwrap()).unwrap();
-        let mut names: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
-        names.sort();
-        (json, names)
-    }
-
-    #[test]
-    fn the_control_file_replaces_a_hard_link_instead_of_writing_through_it() {
-        // The file used to be opened with create + truncate, so a link planted at the path had its
-        // target truncated and overwritten with the token.
-        let dir = scratch();
-        std::fs::write(dir.join("victim.txt"), "keep me").unwrap();
-        std::fs::hard_link(dir.join("victim.txt"), dir.join("ctl.json")).unwrap();
-        super::write_control_file(&dir.join("ctl.json").to_string_lossy(), 4242, "t0ken").unwrap();
-        assert_eq!(std::fs::read_to_string(dir.join("victim.txt")).unwrap(), "keep me");
-        let (json, names) = written(&dir);
-        assert_eq!((json["port"].as_u64(), json["token"].as_str()), (Some(4242), Some("t0ken")));
-        assert_eq!(names, ["ctl.json", "victim.txt"], "no temporary file left behind");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn the_control_file_replaces_a_symlink_instead_of_writing_through_it() {
-        let dir = scratch();
-        let (link, target) = (dir.join("ctl.json"), dir.join("victim.txt"));
-        std::fs::write(&target, "keep me").unwrap();
-        #[cfg(unix)]
-        let made = std::os::unix::fs::symlink(&target, &link);
-        #[cfg(windows)]
-        let made = std::os::windows::fs::symlink_file(&target, &link);
-        if let Err(e) = made {
-            // Windows needs Developer Mode (or admin) for symlinks.
-            eprintln!("skipped: can't create a symlink here: {e}");
-            let _ = std::fs::remove_dir_all(&dir);
-            return;
-        }
-        super::write_control_file(&link.to_string_lossy(), 4242, "t0ken").unwrap();
-        assert_eq!(std::fs::read_to_string(&target).unwrap(), "keep me");
-        assert!(!std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink());
-        assert_eq!(written(&dir).0["token"].as_str(), Some("t0ken"));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn the_control_file_replaces_the_one_a_previous_run_left() {
-        let dir = scratch();
-        std::fs::write(dir.join("ctl.json"), r#"{"port":1,"token":"old"}"#).unwrap();
-        super::write_control_file(&dir.join("ctl.json").to_string_lossy(), 4242, "t0ken").unwrap();
-        let (json, names) = written(&dir);
-        assert_eq!(json["token"].as_str(), Some("t0ken"));
-        assert_eq!(names, ["ctl.json"]);
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-            let mode = std::fs::metadata(dir.join("ctl.json")).unwrap().permissions().mode();
-            assert_eq!(mode & 0o077, 0, "only the owner can read the token: {mode:o}");
-        }
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// X11 startup notification and docks match a window to its launcher by `StartupWMClass`,
-    /// so it has to be the class the window carries: the app id, on Wayland and X11 alike.
-    #[test]
-    fn the_desktop_entry_names_the_window_class() {
-        let entry = include_str!("../../../packaging/linux/ai.storyteller.pdfcraft.desktop");
-        let class = entry.lines().find_map(|line| line.strip_prefix("StartupWMClass="));
-        assert_eq!(class, Some(super::APP_ID));
-    }
-
-    // Regression test for #246: `eprintln!` panics when standard error is a broken pipe (a GUI
-    // launch on Windows), and a panic inside the panic hook aborts the process. The start-up
-    // path and the hook must write to standard error without it.
-    #[test]
-    fn start_up_and_the_panic_hook_never_use_eprintln() {
-        let source = include_str!("main.rs");
-        // Everything before the top-level test module is product code.
-        let product = source.split("\n#[cfg(test)]\nmod tests {").next().unwrap_or(source);
-        assert!(product.len() < source.len(), "found the end of the product code");
-        let offenders: Vec<_> = product
-            .lines()
-            .enumerate()
-            .filter(|(_, line)| !line.trim_start().starts_with("//") && line.contains("eprintln!"))
-            .map(|(n, line)| format!("main.rs:{}: {}", n + 1, line.trim()))
-            .collect();
-        assert!(
-            offenders.is_empty(),
-            "`eprintln!` panics on a broken standard error pipe; use `log::warn!` or `write_fmt` on `stderr()` and ignore the error:\n{}",
-            offenders.join("\n")
-        );
-    }
-}
+mod tests;
diff --git a/apps/pdfcraft/src/tests.rs b/apps/pdfcraft/src/tests.rs
new file mode 100644
index 0000000000..c6e6f36518
--- /dev/null
+++ b/apps/pdfcraft/src/tests.rs
@@ -0,0 +1,686 @@
+/// The lockfile package block for `name`, or a panic naming the missing package.
+fn locked_package(root: &std::path::Path, name: &str) -> String {
+    let lock = std::fs::read_to_string(root.join("Cargo.lock")).expect("Cargo.lock");
+    lock.split("[[package]]")
+        .find(|p| p.contains(&format!("\nname = \"{name}\"\n")))
+        .map(str::to_owned)
+        .unwrap_or_else(|| panic!("{name} is not in Cargo.lock"))
+}
+
+/// Interim graph check for the window stack while the reviewed fork revision is not yet
+/// published. The old `vendor/winit` / `vendor/egui-wgpu` path patches were removed from the
+/// published manifest; local integration supplies the reviewed worktrees through an external
+/// Cargo config patch. A git source must name the public storytold fork; a path source is the
+/// local integration graph. Behaviour (surface fitting, error scopes, scroll phases) is tested
+/// directly elsewhere; the retained vendor copies keep provenance until the fork revision is
+/// pinned. No public revision is invented here.
+fn assert_window_stack_graph(root: &std::path::Path, name: &str, version: &str) -> String {
+    let package = locked_package(root, name);
+    assert!(package.contains(&format!("\nversion = \"{version}\"\n")), "{name} must resolve to {version}: {package}");
+    if let Some(source) = package.lines().find_map(|line| line.strip_prefix("source = ")) {
+        assert!(source.contains("github.com/storytold/"), "{name} must come from the reviewed storytold fork once published, not {source}");
+        assert!(
+            source.split(|c: char| !c.is_ascii_hexdigit()).any(|part| part.len() == 40),
+            "{name} must pin the fork's 40-character revision, not {source}"
+        );
+    }
+    // A path patch has no `source =` in Cargo.lock. The local integration config is the only
+    // allowed path source; a machine-local path must never be in the published manifest,
+    // which the root-manifest assertion below checks. A path entry carries no remote identity
+    // to verify, so this test does not claim the resolved code is the published fork.
+    let manifest = std::fs::read_to_string(root.join("Cargo.toml")).expect("root Cargo.toml");
+    assert!(!manifest.contains(&format!("{name} = {{ path = \"vendor/")), "vendor/{name} must not be a published path patch");
+    package
+}
+
+use pdfcraft_ui_egui::control::Endpoint;
+
+fn endpoint() -> std::io::Result<Endpoint> {
+    Ok(Endpoint { port: 4321, token: "0123456789abcdef".into() })
+}
+
+/// Tests that open a real GPU device take this first, so only one of them is inside the
+/// graphics libraries at a time. The test threads otherwise run them together, and on
+/// FreeBSD's CI machine the test process then died with SIGSEGV, in about half the runs:
+/// the first device was still being set up when the second test began its own. The UI
+/// tests take turns the same way (`crates/ui-egui/tests/it/main.rs`). Hold it for the whole
+/// test (declared before the instance, so it's released after the device is dropped).
+static GPU: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+fn gpu() -> std::sync::MutexGuard<'static, ()> {
+    // A test that panicked while holding it leaves nothing to clean up.
+    GPU.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
+}
+
+#[test]
+fn a_control_channel_that_cant_be_published_stops_the_app() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-app-control-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = |name: &str| dir.join(name).to_str().unwrap().to_owned();
+
+    // A folder in the way stands in for a file another user created first: the write fails.
+    std::fs::create_dir(dir.join("taken.json")).unwrap();
+    let err = super::open_control_channel(&path("taken.json"), endpoint()).unwrap_err();
+    assert!(err.contains("--control") && err.contains("taken.json") && err.contains("only you can write"), "{err}");
+    // No listener: nothing to publish.
+    let err = super::open_control_channel(&path("pc.json"), Err(std::io::Error::other("no loopback"))).unwrap_err();
+    assert!(err.contains("no loopback"), "{err}");
+    assert!(!dir.join("pc.json").exists());
+
+    super::open_control_channel(&path("pc.json"), endpoint()).unwrap();
+    let written: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(dir.join("pc.json")).unwrap()).unwrap();
+    assert_eq!((written["port"].as_u64(), written["token"].as_str()), (Some(4321), Some("0123456789abcdef")));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn path_from_arg_decodes_file_uris() {
+    assert_eq!(super::path_from_arg("file:///home/alice/report.pdf".to_string()), "/home/alice/report.pdf");
+    assert_eq!(super::path_from_arg("file:///home/alice/my%20report.pdf".to_string()), "/home/alice/my report.pdf");
+    assert_eq!(super::path_from_arg("file://localhost/tmp/a%C3%A9.pdf".to_string()), "/tmp/aé.pdf");
+    // Malformed or truncated escapes are kept as written; bytes that aren't UTF-8 keep the URI.
+    assert_eq!(super::path_from_arg("file:///tmp/100%.pdf".to_string()), "/tmp/100%.pdf");
+    assert_eq!(super::path_from_arg("file:///tmp/a%2".to_string()), "/tmp/a%2");
+    assert_eq!(super::path_from_arg("file:///tmp/%zz%".to_string()), "/tmp/%zz%");
+    assert_eq!(super::path_from_arg("file:///tmp/%FF.pdf".to_string()), "file:///tmp/%FF.pdf");
+}
+
+#[test]
+fn unquoted_paths_with_spaces_are_rejoined() {
+    let have = ["P:\\Archive\\00042A26 Contract.PDF", "C:\\a b c.pdf", "C:\\a.pdf", "C:\\x y.pdf"];
+    let exists = |p: &str| have.contains(&p);
+    let args = |a: &[&str]| a.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+    // The case an office program produced: one path, split at its space.
+    assert_eq!(super::rejoin_split_paths(args(&["P:\\Archive\\00042A26", "Contract.PDF"]), exists), args(&["P:\\Archive\\00042A26 Contract.PDF"]));
+    // The longest run wins; files that exist on their own are left alone.
+    assert_eq!(super::rejoin_split_paths(args(&["C:\\a", "b", "c.pdf", "C:\\a.pdf"]), exists), args(&["C:\\a b c.pdf", "C:\\a.pdf"]));
+    assert_eq!(super::rejoin_split_paths(args(&["C:\\a.pdf", "C:\\x", "y.pdf"]), exists), args(&["C:\\a.pdf", "C:\\x y.pdf"]));
+    // Nothing to join: kept as given, so the missing file is still reported by name.
+    assert_eq!(super::rejoin_split_paths(args(&["missing.pdf", "other"]), exists), args(&["missing.pdf", "other"]));
+    assert!(super::rejoin_split_paths(Vec::new(), exists).is_empty());
+}
+
+#[test]
+fn path_from_arg_leaves_plain_paths_and_other_schemes_alone() {
+    assert_eq!(super::path_from_arg("report.pdf".to_string()), "report.pdf");
+    assert_eq!(super::path_from_arg("/home/alice/report.pdf".to_string()), "/home/alice/report.pdf");
+    assert_eq!(super::path_from_arg("https://example.com/report.pdf".to_string()), "https://example.com/report.pdf");
+    assert_eq!(super::path_from_arg("file://server/share/a.pdf".to_string()), "file://server/share/a.pdf");
+    assert_eq!(super::path_from_arg("file://".to_string()), "file://");
+}
+
+#[test]
+fn opengl_is_the_fallback_unless_a_renderer_was_chosen() {
+    use super::{RendererChoice, native_options, renderer_choice, retry_with_gl};
+    assert_eq!(renderer_choice(None), RendererChoice::Auto);
+    assert_eq!(renderer_choice(Some("")), RendererChoice::Auto);
+    assert_eq!(renderer_choice(Some("vulkan")), RendererChoice::Auto);
+    assert_eq!(renderer_choice(Some(" WGPU ")), RendererChoice::Wgpu);
+    for gl in ["gl", "OpenGL", "glow"] {
+        assert_eq!(renderer_choice(Some(gl)), RendererChoice::Gl);
+    }
+    // Retried with OpenGL only when wgpu failed to start by default, never after the app ran.
+    assert!(retry_with_gl(RendererChoice::Auto, false));
+    assert!(!retry_with_gl(RendererChoice::Auto, true));
+    assert!(!retry_with_gl(RendererChoice::Wgpu, false));
+    assert!(!retry_with_gl(RendererChoice::Gl, false));
+    // Each run states its renderer rather than relying on eframe's default.
+    assert_eq!(native_options(false, false, eframe::Renderer::Wgpu).renderer, eframe::Renderer::Wgpu);
+    assert_eq!(native_options(false, false, eframe::Renderer::Glow).renderer, eframe::Renderer::Glow);
+}
+
+#[test]
+fn the_desktop_frame_is_turned_off_only_when_the_app_draws_one() {
+    use super::native_options;
+    assert_eq!(native_options(false, false, eframe::Renderer::Glow).viewport.decorations, None);
+    assert_eq!(native_options(false, true, eframe::Renderer::Glow).viewport.decorations, Some(false));
+}
+
+#[test]
+fn a_software_renderer_is_shown_to_the_user() {
+    use eframe::wgpu::DeviceType;
+    // Issue #519: WARP or llvmpipe is announced in the app, not just in pdfcraft.log.
+    let mut app = super::PdfCraftApp::new();
+    super::notify_software_renderer(&mut app, DeviceType::Cpu);
+    let notice = app.toast.as_ref().map(|(m, _)| m.as_str()).unwrap_or_default();
+    assert!(notice.contains("without a graphics processor"), "{notice:?}");
+    for gpu in [DeviceType::IntegratedGpu, DeviceType::DiscreteGpu, DeviceType::VirtualGpu, DeviceType::Other] {
+        let mut app = super::PdfCraftApp::new();
+        super::notify_software_renderer(&mut app, gpu);
+        assert!(app.toast.is_none(), "{gpu:?}: {:?}", app.toast);
+    }
+}
+
+#[test]
+fn gpu_setup_avoids_vulkan_and_stretched_resizes_on_windows_and_prefers_low_power() {
+    let mut native = eframe::NativeOptions::default();
+    super::configure_gpu(&mut native);
+    let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &native.wgpu_options.wgpu_setup else { panic!("default setup creates its own instance") };
+    if std::env::var_os("WGPU_POWER_PREF").is_none() {
+        assert_eq!(setup.power_preference, eframe::wgpu::PowerPreference::LowPower);
+    }
+    if std::env::var_os("WGPU_VALIDATION_INDIRECT_CALL").is_none() {
+        let flags = setup.instance_descriptor.flags;
+        assert!(!flags.contains(eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL), "Intel Metal can't compile its shader: {flags:?}");
+    }
+    if cfg!(target_os = "windows") && std::env::var_os("WGPU_BACKEND").is_none() {
+        let backends = setup.instance_descriptor.backends;
+        assert!(backends.contains(eframe::wgpu::Backends::DX12), "{backends:?}");
+        assert!(!backends.contains(eframe::wgpu::Backends::VULKAN), "issue #37: {backends:?}");
+    }
+    use eframe::wgpu::Dx12SwapchainKind::{DxgiFromHwnd, DxgiFromVisual};
+    assert_eq!(super::dx12_presentation(None), DxgiFromVisual);
+    assert_eq!(super::dx12_presentation(Some(DxgiFromHwnd)), DxgiFromHwnd, "WGPU_DX12_PRESENTATION_SYSTEM still decides");
+    assert_eq!(super::dx12_presentation(Some(DxgiFromVisual)), DxgiFromVisual);
+    let presentation = setup.instance_descriptor.backend_options.dx12.presentation_system;
+    if cfg!(target_os = "windows") {
+        // A composition visual unless WGPU_DX12_PRESENTATION_SYSTEM asks otherwise.
+        let asked = eframe::wgpu::Dx12SwapchainKind::from_env();
+        assert_eq!(presentation, asked.unwrap_or(DxgiFromVisual), "issue #2738: resizing stretches a window swap chain");
+    } else {
+        assert_eq!(presentation, eframe::wgpu::Dx12SwapchainKind::default().with_env(), "only Windows changes it");
+    }
+}
+
+#[test]
+fn restored_hidpi_window_fits_the_adapters_surface_limit() {
+    // The Outlook launch crash: 3440 x 1369 saved points at 250% DPI requested this surface.
+    let (width, height) = (8600, 3423);
+    let required = eframe::wgpu::Limits::default();
+    assert!(width > required.max_texture_dimension_2d);
+    let supported = eframe::wgpu::Limits { max_texture_dimension_2d: 16384, ..required.clone() };
+    let enabled = super::surface_texture_limits(required, &supported);
+    assert!(width <= enabled.max_texture_dimension_2d);
+    assert!(height <= enabled.max_texture_dimension_2d);
+}
+
+#[test]
+fn surface_limits_preserve_other_requirements_and_never_overrequest() {
+    for required in [eframe::wgpu::Limits::default(), eframe::wgpu::Limits::downlevel_webgl2_defaults()] {
+        for extent in [4096, 8192, 16384] {
+            let supported = eframe::wgpu::Limits {
+                max_texture_dimension_2d: extent,
+                max_bind_groups: 8,
+                min_uniform_buffer_offset_alignment: 128,
+                min_storage_buffer_offset_alignment: 128,
+                ..required.clone()
+            };
+            let enabled = super::surface_texture_limits(required.clone(), &supported);
+            let mut expected = required.clone();
+            expected.max_texture_dimension_2d = extent;
+            assert_eq!(enabled, expected);
+            assert_eq!(enabled.max_texture_dimension_2d, supported.max_texture_dimension_2d);
+            assert!(enabled.check_limits(&supported));
+        }
+    }
+}
+
+#[test]
+fn surface_limits_fit_v3d_shader_variable_limit() {
+    // Issue #2383: V3D supports 15 variables, below the default request of 16.
+    let required = eframe::wgpu::Limits::default();
+    let supported = eframe::wgpu::Limits { max_texture_dimension_2d: 7680, max_inter_stage_shader_variables: 15, ..required.clone() };
+    let enabled = super::surface_texture_limits(required.clone(), &supported);
+    assert!(enabled.check_limits(&supported), "unsupported device limits: {enabled:?}");
+    let expected = eframe::wgpu::Limits { max_texture_dimension_2d: 7680, max_inter_stage_shader_variables: 15, ..required };
+    assert_eq!(enabled, expected);
+}
+
+#[test]
+fn surface_limits_fit_downlevel_maxima_and_minimum_alignments() {
+    let required = eframe::wgpu::Limits::downlevel_webgl2_defaults();
+    let supported = eframe::wgpu::Limits {
+        max_texture_dimension_2d: 2048,
+        max_bind_groups: 2,
+        max_vertex_attributes: 8,
+        min_uniform_buffer_offset_alignment: 512,
+        min_storage_buffer_offset_alignment: 512,
+        ..required.clone()
+    };
+    let enabled = super::surface_texture_limits(required, &supported);
+    assert!(enabled.check_limits(&supported), "unsupported device limits: {enabled:?}");
+    // Larger minimum alignments are weaker capabilities, unlike maximum limits.
+    assert_eq!(enabled, supported);
+}
+
+#[test]
+fn a_window_larger_than_the_gpu_limit_gets_a_surface_within_it() {
+    use eframe::egui_wgpu::winit::surface_fit;
+    // Issue #577: 3440 x 1369 points restored at 250% asked an 8192-pixel device for this.
+    let (width, height, scale) = surface_fit(8600, 3423, 8192);
+    assert_eq!((width, height), (8192, 3260));
+    // Both sides shrink alike and egui draws at that factor: the whole window is drawn.
+    assert!((8600.0 * scale - 8192.0).abs() < 0.01, "{scale}");
+    assert!((3423.0 * scale - height as f32).abs() < 1.0, "{scale}");
+    // Within the limit nothing changes, up to and including the limit itself.
+    assert_eq!(surface_fit(8600, 3423, 16384), (8600, 3423, 1.0));
+    assert_eq!(surface_fit(8192, 8192, 8192), (8192, 8192, 1.0));
+    assert_eq!(surface_fit(0, 0, 8192), (0, 0, 1.0));
+    // One side over the limit: the window as it would be stretched across monitors.
+    assert_eq!(surface_fit(8193, 600, 8192).0, 8192);
+    assert_eq!(surface_fit(600, 8193, 8192).1, 8192);
+}
+
+#[test]
+fn surface_fit_never_empties_or_overflows_a_surface() {
+    use eframe::egui_wgpu::winit::surface_fit;
+    for (w, h, max) in
+        [(1, u32::MAX, 8192), (u32::MAX, 1, 2048), (u32::MAX, u32::MAX, 16384), (0, u32::MAX, 8192), (u32::MAX, 0, 8192), (5, 7, 0), (40_000, 3, 1)]
+    {
+        let (fw, fh, scale) = surface_fit(w, h, max);
+        assert!(fw <= max.max(1) && fh <= max.max(1), "{w} x {h} in {max}: {fw} x {fh}");
+        // A side that wasn't zero stays non-zero (`Surface::configure` rejects an empty one),
+        // and a zero side stays zero (egui-wgpu skips configuring it).
+        assert_eq!((fw == 0, fh == 0), (w == 0, h == 0), "{w} x {h} in {max}: {fw} x {fh}");
+        assert!(scale.is_finite() && scale > 0.0 && scale <= 1.0, "{w} x {h} in {max}: {scale}");
+    }
+    // The longer side lands exactly on the limit (rounding never leaves it a pixel short),
+    // and the shorter side keeps the window's proportions to within a pixel.
+    for max in [2048, 8192, 16384] {
+        for long in (max + 1..=max * 5).step_by(997).chain([max * 2, max * 4, u32::MAX]) {
+            for short in [1, 3, 600, max / 3, max - 1, max, long - 1, long] {
+                let (fw, fh, scale) = surface_fit(long, short, max);
+                assert_eq!(fw, max, "{long} x {short} in {max}");
+                let expected = f64::from(short) * f64::from(max) / f64::from(long);
+                assert!((f64::from(fh) - expected).abs() <= 1.0, "{long} x {short} in {max}: {fh}");
+                assert_eq!(surface_fit(short, long, max), (fh, fw, scale), "transposed");
+            }
+        }
+    }
+}
+
+/// Regression test: the lockfile resolves egui-wgpu 0.37.0 through an allowed source, the root manifest
+/// does not path-patch the vendor copy, and that copy stays as provenance for the surface-fit patch.
+#[test]
+fn vendor_provenance_egui_wgpu_surface_fit_identity() {
+    // Issue #577: egui-wgpu configured a window's surface at the window's size, and
+    // `Surface::configure` panics when that's beyond the device's `max_texture_dimension_2d`
+    // (emilk/egui#8361). The reviewed egui 0.37 worktree carries E2 (`surface_fit`); the
+    // behavioural test above exercises it. The old 0.36 vendor copy is retained for
+    // provenance only and is no longer a published path patch, so reading it would not prove
+    // what the app runs.
+    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    assert_window_stack_graph(&root, "egui-wgpu", "0.37.0");
+    assert!(root.join("vendor/egui-wgpu/src/winit.rs").exists(), "the vendor copy and its provenance stay until the fork revision is pinned");
+}
+
+#[test]
+fn a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic() {
+    // Issue #519: on a 2015 Intel GPU, wgpu's GL backend couldn't configure the window's
+    // surface (`GpuWaitTimeout`), and wgpu's default error handler panicked before the app was
+    // created, so PdfCraft never got to retry with OpenGL. vendor/egui-wgpu configures a new
+    // window's surface inside `catch_errors`. A real device on PdfCraft's own GPU settings,
+    // and an error wgpu raises before anything reaches the driver: a texture one pixel wider
+    // than the device allows.
+    use eframe::wgpu;
+    let _gpu = gpu();
+    let native = super::native_options(false, false, eframe::Renderer::Wgpu);
+    let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &native.wgpu_options.wgpu_setup else { panic!("default setup creates its own instance") };
+    let instance = pollster::block_on(native.wgpu_options.wgpu_setup.new_instance());
+    let options = wgpu::RequestAdapterOptions { power_preference: setup.power_preference, ..Default::default() };
+    // CI runners have a software adapter (WARP, llvmpipe); a machine without any skips.
+    let Ok(adapter) = pollster::block_on(instance.request_adapter(&options)) else {
+        eprintln!("skipping: no GPU adapter on this machine");
+        return;
+    };
+    let Ok((device, _queue)) = pollster::block_on(adapter.request_device(&(setup.device_descriptor)(&adapter))) else {
+        eprintln!("skipping: the adapter gives no device");
+        return;
+    };
+    let texture = |width: u32| {
+        device.create_texture(&wgpu::TextureDescriptor {
+            label: Some("issue-519"),
+            size: wgpu::Extent3d { width, height: 1, depth_or_array_layers: 1 },
+            mip_level_count: 1,
+            sample_count: 1,
+            dimension: wgpu::TextureDimension::D2,
+            format: wgpu::TextureFormat::Rgba8Unorm,
+            usage: wgpu::TextureUsages::TEXTURE_BINDING,
+            view_formats: &[],
+        })
+    };
+    let too_wide = device.limits().max_texture_dimension_2d.saturating_add(1);
+    let caught = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(too_wide)));
+    assert!(matches!(caught, Err(wgpu::Error::Validation { .. })), "{caught:?}");
+    // The device stays usable, and nothing is left behind to catch later errors by mistake.
+    let fine = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(16)));
+    assert!(fine.is_ok(), "{fine:?}");
+    assert_eq!(pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || 7)).ok(), Some(7));
+    // Nested: the inner call keeps its own error, and the outer one still catches what follows.
+    let caught = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || {
+        let inner = pollster::block_on(eframe::egui_wgpu::winit::catch_errors(&device, || texture(too_wide)));
+        assert!(inner.is_err(), "inner: {inner:?}");
+        texture(too_wide)
+    }));
+    assert!(matches!(caught, Err(wgpu::Error::Validation { .. })), "outer: {caught:?}");
+}
+
+/// Regression test: the lockfile resolves egui-wgpu 0.37.0 through an allowed source, the root manifest
+/// does not path-patch the vendor copy, and that copy stays as provenance for the catch-errors patch.
+#[test]
+fn vendor_provenance_egui_wgpu_catch_errors_identity() {
+    // Issue #519: E3 (`catch_errors`) is tested above against a real device. The reviewed 0.37
+    // worktree carries it around the first configure of every new window's surface, and its
+    // error reaches eframe as `WgpuError` (eframe then returns `Error::Wgpu`, which `main`
+    // retries with OpenGL). Without it a failed configure panics before the app is created.
+    // `catch_errors` is exercised against a real device in the test above and below; the
+    // graph check makes sure the app runs the reviewed 0.37 worktree (the retained vendor
+    // copy is not read as proof of behaviour).
+    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    assert_window_stack_graph(&root, "egui-wgpu", "0.37.0");
+    assert!(root.join("vendor/egui-wgpu/src/winit.rs").exists(), "the vendor copy and its provenance stay until the fork revision is pinned");
+}
+
+#[test]
+fn pipeline_creation_error_is_returned_and_device_remains_usable() {
+    use eframe::{egui_wgpu, wgpu};
+    let _gpu = gpu();
+    let mut native = super::native_options(false, false, eframe::Renderer::Wgpu);
+    let egui_wgpu::WgpuSetup::CreateNew(setup) = &native.wgpu_options.wgpu_setup else { panic!("default setup creates its own instance") };
+    let instance = pollster::block_on(native.wgpu_options.wgpu_setup.new_instance());
+    let options = wgpu::RequestAdapterOptions { power_preference: setup.power_preference, ..Default::default() };
+    let Ok(adapter) = pollster::block_on(instance.request_adapter(&options)) else {
+        assert!(std::env::var_os("PDFCRAFT_TEST_REQUIRE_GPU").is_none(), "a GPU adapter is required for this run");
+        eprintln!("skipping pipeline regression: no GPU adapter");
+        return;
+    };
+    let (device, queue) =
+        pollster::block_on(adapter.request_device(&(setup.device_descriptor)(&adapter))).expect("the selected adapter must provide a test device");
+    native.wgpu_options.wgpu_setup =
+        egui_wgpu::WgpuSetup::Existing(egui_wgpu::WgpuSetupExisting { instance: instance.clone(), adapter, device, queue });
+    // Three samples is invalid on every backend, so this reproduces a pipeline error
+    // without depending on a particular driver. The unpatched constructor panics.
+    for samples in [3, 1, 3, 1] {
+        let options = egui_wgpu::RendererOptions { msaa_samples: samples, ..Default::default() };
+        let result = pollster::block_on(egui_wgpu::RenderState::create(&native.wgpu_options, &instance, None, options));
+        if samples == 3 {
+            let error = result.err().expect("invalid pipeline must return an error");
+            assert!(error.to_string().contains("egui_pipeline"), "{error}");
+        } else {
+            assert!(result.is_ok(), "the device must remain usable: {:?}", result.err());
+        }
+    }
+}
+
+/// Regression test: winit resolves to 0.30.13 without a published vendor path patch, the retained copy
+/// still carries the W1 Windows 11 monitor-scale fix, and its upstream base is recorded.
+#[test]
+fn winit_carries_the_windows_11_monitor_scale_fix() {
+    // Issue #324: winit 0.30.13 as released nudges a window dragged onto a monitor with another
+    // scale factor back onto the one it is leaving, so on Windows 11 it ends up on the wrong
+    // monitor, at the wrong size and scale. vendor/winit carries the fix from winit master. A
+    // dependency bump that resolves winit from crates.io again, or a re-vendored copy without
+    // the patch, would silently bring the bug back: re-apply the patch, or drop the copy once a
+    // winit 0.30 release has the fix (vendor/README.md).
+    // W1 (and W2–W13) were audited against the reviewed winit worktree: the vendor rows in
+    // `vendor/README.md` match the fork's PATCHES.md entries W1–W13. The vendor source is no
+    // longer a published path patch, so this checks the actual graph, not the old copy.
+    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    assert_window_stack_graph(&root, "winit", "0.30.13");
+    let event_loop = std::fs::read_to_string(root.join("vendor/winit/src/platform_impl/windows/event_loop.rs")).unwrap();
+    // The audited W1 hunk itself, not merely the file's presence: Windows 11 applies the
+    // rect Windows suggests, while Windows 10 keeps the old adjustment.
+    for marker in [
+        "PdfCraft patch: from Windows 11 (build 22000) on, apply the rect Windows suggests",
+        "if !WIN10_BUILD_VERSION.is_some_and(|build| build < 22000) {",
+        "new_outer_rect = suggested_rect;",
+    ] {
+        assert!(event_loop.contains(marker), "vendor/winit lost the W1 monitor-scale patch: {marker}");
+    }
+    let provenance = std::fs::read_to_string(root.join("vendor/winit/.cargo_vcs_info.json")).unwrap();
+    assert!(provenance.contains("e9809ef54b18499bb4f2cac945719ecc2a61061b"), "vendor/winit keeps its upstream base provenance");
+}
+
+const NVIDIA: (u32, u32) = (0x10de, 0x2684);
+const NVIDIA_3090: (u32, u32) = (0x10de, 0x2204);
+const AMD_IGPU: (u32, u32) = (0x1002, 0x164e);
+
+fn adapters() -> Vec<(u32, u32, eframe::wgpu::DeviceType)> {
+    use eframe::wgpu::DeviceType;
+    vec![(NVIDIA.0, NVIDIA.1, DeviceType::DiscreteGpu), (AMD_IGPU.0, AMD_IGPU.1, DeviceType::IntegratedGpu), (0, 0, DeviceType::Cpu)]
+}
+
+const INTEL_IGPU: (u32, u32) = (0x8086, 0xa780);
+
+fn monitor(pci: (u32, u32)) -> super::DisplayGpu {
+    super::DisplayGpu { pci, primary: false }
+}
+
+fn panel(pci: (u32, u32)) -> super::DisplayGpu {
+    super::DisplayGpu { pci, primary: true }
+}
+
+#[test]
+fn pick_adapter_prefers_the_gpu_driving_the_monitors() {
+    // A desktop whose monitors are all on the discrete GPU: the integrated one shows black.
+    assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA)], None), Some(0));
+    // Issue #378: the same on Windows, where the Ryzen integrated GPU without a monitor crashed
+    // the display driver. Windows also says which display is the primary one.
+    assert_eq!(super::pick_adapter(&adapters(), &[panel(NVIDIA)], None), Some(0));
+}
+
+#[test]
+fn pick_adapter_prefers_the_gpu_driving_the_primary_display() {
+    // A Windows desktop with a monitor on each GPU: the window opens on the primary display.
+    assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), panel(NVIDIA)], None), Some(0));
+    assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], None), Some(1));
+}
+
+#[test]
+fn pci_ids_come_from_windows_device_ids() {
+    assert_eq!(super::pci_ids("PCI\\VEN_10DE&DEV_2204&SUBSYS_40421458&REV_A1"), Some(NVIDIA_3090));
+    assert_eq!(super::pci_ids("PCI\\VEN_1002&DEV_164E&SUBSYS_88771043&REV_C1"), Some(AMD_IGPU));
+    assert_eq!(super::pci_ids("pci\\ven_1002&dev_164e"), Some(AMD_IGPU));
+    // Remote Desktop and other non-PCI display devices, and malformed ids.
+    assert_eq!(super::pci_ids("ROOT\\BasicDisplay\\0000"), None);
+    assert_eq!(super::pci_ids("PCI\\VEN_10DE&SUBSYS_40421458"), None);
+    assert_eq!(super::pci_ids("PCI\\VEN_10DE&DEV_ZZZZ"), None);
+    assert_eq!(super::pci_ids("VEN_&DEV_"), None);
+    assert_eq!(super::pci_ids(""), None);
+}
+
+#[cfg(target_os = "windows")]
+#[test]
+fn windows_display_gpus_lists_pci_gpus_with_a_monitor() {
+    // Whatever this machine has: every entry is a PCI GPU, at most one drives the primary
+    // display, and no GPU is listed twice. (A headless CI runner may list none.)
+    let gpus = super::windows_display_gpus();
+    assert!(gpus.iter().filter(|g| g.primary).count() <= 1, "{gpus:?}");
+    for (i, g) in gpus.iter().enumerate() {
+        assert!(g.pci.0 != 0, "{gpus:?}");
+        assert!(!gpus[..i].iter().any(|h| h.pci == g.pci), "{gpus:?}");
+    }
+}
+
+#[test]
+fn pick_adapter_keeps_the_integrated_gpu_on_hybrid_laptops() {
+    // Issue #8: the panel is on the integrated GPU, an external monitor on the discrete one.
+    assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA), panel(AMD_IGPU)], None), Some(1));
+    assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], None), Some(1));
+    assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], None), Some(1));
+    assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU)], None), Some(1));
+}
+
+#[test]
+fn pick_adapter_prefers_the_discrete_gpu_on_desktops_with_a_monitor_on_each() {
+    // Issue #445: one monitor on the Intel iGPU, one on the NVIDIA card, no built-in panel.
+    use eframe::wgpu::DeviceType;
+    let desktop = [(INTEL_IGPU.0, INTEL_IGPU.1, DeviceType::IntegratedGpu), (NVIDIA.0, NVIDIA.1, DeviceType::DiscreteGpu), (0, 0, DeviceType::Cpu)];
+    assert_eq!(super::pick_adapter(&desktop, &[monitor(INTEL_IGPU), monitor(NVIDIA)], None), Some(1));
+    assert_eq!(super::pick_adapter(&desktop, &[monitor(NVIDIA), monitor(INTEL_IGPU)], None), Some(1));
+    // A GPU driving no display still loses to one that does.
+    assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), monitor(INTEL_IGPU)], None), Some(1));
+}
+
+#[test]
+fn pick_adapter_prefers_the_gpu_the_compositor_draws_with() {
+    // A hybrid laptop whose Wayland compositor runs on the discrete GPU (Hyprland with
+    // `AQ_DRM_DEVICES` naming it first): the integrated GPU drives the built-in panel, yet the
+    // compositor shows nothing it draws, and reports no error either.
+    assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], Some(NVIDIA)), Some(0));
+    assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], Some(NVIDIA)), Some(0));
+    // The usual hybrid laptop, with the compositor on the integrated GPU: as before (#8).
+    assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], Some(AMD_IGPU)), Some(1));
+    // No GPU drives a display as far as sysfs says (a container), but the compositor knows.
+    assert_eq!(super::pick_adapter(&adapters(), &[], Some(NVIDIA)), Some(0));
+    // A compositor GPU no adapter matches (a virtual one) leaves the displays in charge.
+    assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], Some((0x1af4, 0x1050))), Some(1));
+}
+
+#[test]
+fn pick_adapter_falls_back_to_low_power_without_a_match() {
+    assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234))], None), Some(1));
+    assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234)), monitor((0x8086, 0x5678))], None), Some(1));
+    assert_eq!(super::pick_adapter(&[], &[monitor(NVIDIA)], None), None);
+}
+
+#[test]
+fn internal_panels_are_edp_lvds_and_dsi_connectors() {
+    for name in ["eDP-1", "LVDS-1", "DSI-1"] {
+        assert!(super::is_internal_panel(name), "{name}");
+    }
+    for name in ["DP-3", "HDMI-A-1", "DVI-D-1", "VGA-1", "Writeback-1", ""] {
+        assert!(!super::is_internal_panel(name), "{name}");
+    }
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_display_gpus_reads_connected_connectors() -> std::io::Result<()> {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-drm-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let card = |name: &str, (vendor, device): (u32, u32)| -> std::io::Result<()> {
+        std::fs::create_dir_all(dir.join(name).join("device"))?;
+        std::fs::write(dir.join(name).join("device/vendor"), format!("{vendor:#06x}\n"))?;
+        std::fs::write(dir.join(name).join("device/device"), format!("{device:#06x}\n"))
+    };
+    let connector = |name: &str, status: &str| -> std::io::Result<()> {
+        std::fs::create_dir_all(dir.join(name))?;
+        std::fs::write(dir.join(name).join("status"), format!("{status}\n"))
+    };
+    card("card1", NVIDIA)?;
+    card("card2", AMD_IGPU)?;
+    connector("card1-DP-3", "connected")?;
+    connector("card1-DP-4", "connected")?;
+    connector("card2-HDMI-A-1", "disconnected")?;
+    connector("card2-Writeback-1", "unknown")?;
+    let desktop = super::linux_display_gpus(&dir);
+    // Issue #445: a monitor on the integrated GPU too, still no built-in panel.
+    connector("card2-HDMI-A-1", "connected")?;
+    let mut both = super::linux_display_gpus(&dir);
+    // A hybrid laptop: the integrated GPU drives the built-in panel as well.
+    connector("card2-eDP-1", "connected")?;
+    let mut laptop = super::linux_display_gpus(&dir);
+    std::fs::remove_dir_all(&dir)?;
+    assert_eq!(desktop, vec![monitor(NVIDIA)]);
+    both.sort_by_key(|g| g.pci);
+    assert_eq!(both, vec![monitor(AMD_IGPU), monitor(NVIDIA)]);
+    laptop.sort_by_key(|g| g.pci);
+    assert_eq!(laptop, vec![panel(AMD_IGPU), monitor(NVIDIA)]);
+    assert!(super::linux_display_gpus(std::path::Path::new("/nonexistent/drm")).is_empty());
+    Ok(())
+}
+
+/// A fresh folder per call: tests run in parallel.
+fn scratch() -> std::path::PathBuf {
+    static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+    let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let d = std::env::temp_dir().join(format!("pdfcraft-control-file-{}-{n}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+/// The control file's port and token, and every name in its folder.
+fn written(dir: &std::path::Path) -> (serde_json::Value, Vec<String>) {
+    let json = serde_json::from_str(&std::fs::read_to_string(dir.join("ctl.json")).unwrap()).unwrap();
+    let mut names: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    names.sort();
+    (json, names)
+}
+
+#[test]
+fn the_control_file_replaces_a_hard_link_instead_of_writing_through_it() {
+    // The file used to be opened with create + truncate, so a link planted at the path had its
+    // target truncated and overwritten with the token.
+    let dir = scratch();
+    std::fs::write(dir.join("victim.txt"), "keep me").unwrap();
+    std::fs::hard_link(dir.join("victim.txt"), dir.join("ctl.json")).unwrap();
+    super::write_control_file(&dir.join("ctl.json").to_string_lossy(), 4242, "t0ken").unwrap();
+    assert_eq!(std::fs::read_to_string(dir.join("victim.txt")).unwrap(), "keep me");
+    let (json, names) = written(&dir);
+    assert_eq!((json["port"].as_u64(), json["token"].as_str()), (Some(4242), Some("t0ken")));
+    assert_eq!(names, ["ctl.json", "victim.txt"], "no temporary file left behind");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn the_control_file_replaces_a_symlink_instead_of_writing_through_it() {
+    let dir = scratch();
+    let (link, target) = (dir.join("ctl.json"), dir.join("victim.txt"));
+    std::fs::write(&target, "keep me").unwrap();
+    #[cfg(unix)]
+    let made = std::os::unix::fs::symlink(&target, &link);
+    #[cfg(windows)]
+    let made = std::os::windows::fs::symlink_file(&target, &link);
+    if let Err(e) = made {
+        // Windows needs Developer Mode (or admin) for symlinks.
+        eprintln!("skipped: can't create a symlink here: {e}");
+        let _ = std::fs::remove_dir_all(&dir);
+        return;
+    }
+    super::write_control_file(&link.to_string_lossy(), 4242, "t0ken").unwrap();
+    assert_eq!(std::fs::read_to_string(&target).unwrap(), "keep me");
+    assert!(!std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink());
+    assert_eq!(written(&dir).0["token"].as_str(), Some("t0ken"));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn the_control_file_replaces_the_one_a_previous_run_left() {
+    let dir = scratch();
+    std::fs::write(dir.join("ctl.json"), r#"{"port":1,"token":"old"}"#).unwrap();
+    super::write_control_file(&dir.join("ctl.json").to_string_lossy(), 4242, "t0ken").unwrap();
+    let (json, names) = written(&dir);
+    assert_eq!(json["token"].as_str(), Some("t0ken"));
+    assert_eq!(names, ["ctl.json"]);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let mode = std::fs::metadata(dir.join("ctl.json")).unwrap().permissions().mode();
+        assert_eq!(mode & 0o077, 0, "only the owner can read the token: {mode:o}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// X11 startup notification and docks match a window to its launcher by `StartupWMClass`,
+/// so it has to be the class the window carries: the app id, on Wayland and X11 alike.
+#[test]
+fn the_desktop_entry_names_the_window_class() {
+    let entry = include_str!("../../../packaging/linux/ai.storyteller.pdfcraft.desktop");
+    let class = entry.lines().find_map(|line| line.strip_prefix("StartupWMClass="));
+    assert_eq!(class, Some(super::APP_ID));
+}
+
+// Regression test for #246: `eprintln!` panics when standard error is a broken pipe (a GUI
+// launch on Windows), and a panic inside the panic hook aborts the process. The start-up
+// path and the hook must write to standard error without it.
+#[test]
+fn start_up_and_the_panic_hook_never_use_eprintln() {
+    let source = include_str!("main.rs");
+    // Everything before the top-level test module is product code.
+    let product = source.split("\n#[cfg(test)]\nmod tests;").next().unwrap_or(source);
+    assert!(product.len() < source.len(), "found the end of the product code");
+    let offenders: Vec<_> = product
+        .lines()
+        .enumerate()
+        .filter(|(_, line)| !line.trim_start().starts_with("//") && line.contains("eprintln!"))
+        .map(|(n, line)| format!("main.rs:{}: {}", n + 1, line.trim()))
+        .collect();
+    assert!(
+        offenders.is_empty(),
+        "`eprintln!` panics on a broken standard error pipe; use `log::warn!` or `write_fmt` on `stderr()` and ignore the error:\n{}",
+        offenders.join("\n")
+    );
+}
diff --git a/apps/pdfcraft/src/updates.rs b/apps/pdfcraft/src/updates.rs
deleted file mode 100644
index 686c8cee84..0000000000
--- a/apps/pdfcraft/src/updates.rs
+++ /dev/null
@@ -1,127 +0,0 @@
-//! Asks GitHub for the latest PdfCraft release (Help ▸ Check for updates, issue #28).
-
-use std::time::Duration;
-
-use pdfcraft_ui_egui::updates::{RELEASES_PAGE, Release};
-
-const LATEST: &str = "https://api.github.com/repos/storytold/pdfcraft/releases/latest";
-
-/// The latest release. The answer is untrusted: its size is capped, and only a page under
-/// [`RELEASES_PAGE`] is ever offered for download (anything else falls back to that list).
-pub fn latest_release() -> Result<Release, String> {
-    let agent = ureq::Agent::config_builder()
-        .timeout_global(Some(Duration::from_secs(10)))
-        .tls_config(ureq::tls::TlsConfig::builder().root_certs(os_roots()?).build())
-        .build()
-        .new_agent();
-    let mut response = agent
-        .get(LATEST)
-        .header("Accept", "application/vnd.github+json")
-        .header("User-Agent", concat!("PdfCraft/", env!("CARGO_PKG_VERSION")))
-        // Read error statuses ourselves: a 403 from GitHub usually means its anonymous
-        // rate limit ran out, and the retry time rides along in a response header.
-        .config()
-        .http_status_as_error(false)
-        .build()
-        .call()
-        .map_err(|e| format!("couldn't reach GitHub ({e})"))?;
-    let status = response.status().as_u16();
-    if status == 403 {
-        let reset = response.headers().get("x-ratelimit-reset").and_then(|v| v.to_str().ok());
-        return Err(rate_limited(reset, now_unix()));
-    }
-    if !(200..300).contains(&status) {
-        return Err(format!("couldn't reach GitHub (http status: {status})"));
-    }
-    let body = response.body_mut().with_config().limit(1 << 20).read_to_string().map_err(|e| format!("unreadable answer ({e})"))?;
-    parse(&body)
-}
-
-/// The certificate authorities the operating system trusts.
-fn os_roots() -> Result<ureq::tls::RootCerts, String> {
-    let found = rustls_native_certs::load_native_certs();
-    let certs: Vec<ureq::tls::Certificate<'static>> = found.certs.iter().map(|c| ureq::tls::Certificate::from_der(c.as_ref()).to_owned()).collect();
-    if certs.is_empty() {
-        return Err("no trusted certificates found on this system".into());
-    }
-    Ok(ureq::tls::RootCerts::new_with_certs(&certs))
-}
-
-/// The current Unix time in seconds (0 when the clock gives nothing usable).
-fn now_unix() -> u64 {
-    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0)
-}
-
-/// What to tell the user when GitHub answers 403: its anonymous quota (60 checks an hour,
-/// shared by everyone behind the same address) ran out. `reset` is the `x-ratelimit-reset`
-/// header, the Unix time the quota refills; `now` is the current Unix time. Anything
-/// surprising (no header, not a number, already past) falls back to asking for patience.
-fn rate_limited(reset: Option<&str>, now: u64) -> String {
-    const FALLBACK: &str = "GitHub is limiting update checks for now (shared hourly quota); try again later";
-    let wait = reset.and_then(|r| r.trim().parse::<u64>().ok()).and_then(|reset| reset.checked_sub(now)).filter(|&wait| wait > 0);
-    match wait {
-        Some(wait) => {
-            let minutes = wait.div_ceil(60).max(1);
-            let plural = if minutes == 1 { "" } else { "s" };
-            format!("GitHub is limiting update checks for now (shared hourly quota); try again in about {minutes} minute{plural}")
-        }
-        None => FALLBACK.into(),
-    }
-}
-
-fn parse(body: &str) -> Result<Release, String> {
-    let v: serde_json::Value = serde_json::from_str(body).map_err(|e| format!("unreadable answer ({e})"))?;
-    let version = v["tag_name"].as_str().filter(|t| !t.is_empty() && t.len() <= 64).ok_or("no release found")?.to_string();
-    let url = v["html_url"]
-        .as_str()
-        .filter(|u| u.strip_prefix(RELEASES_PAGE).is_some_and(|rest| rest.starts_with('/') && !rest.contains(['?', '#', '\\'])))
-        .unwrap_or(RELEASES_PAGE)
-        .to_string();
-    Ok(Release { version, url })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn answers_are_read_and_only_our_release_pages_are_offered() {
-        let r = parse(r#"{"tag_name":"v0.2.0","html_url":"https://github.com/storytold/pdfcraft/releases/tag/v0.2.0"}"#).unwrap();
-        assert_eq!(r, Release { version: "v0.2.0".into(), url: "https://github.com/storytold/pdfcraft/releases/tag/v0.2.0".into() });
-        for elsewhere in ["https://example.com/pdfcraft.exe", "https://github.com/storytold/pdfcraft/releases.evil/x", "javascript:alert(1)"] {
-            let r = parse(&format!(r#"{{"tag_name":"v9.9.9","html_url":"{elsewhere}"}}"#)).unwrap();
-            assert_eq!(r.url, RELEASES_PAGE, "{elsewhere}");
-        }
-        assert!(parse(r#"{"message":"Not Found"}"#).is_err());
-        assert!(parse("<html>").is_err());
-    }
-
-    #[test]
-    fn rate_limit_messages_name_the_wait() {
-        let limited = "GitHub is limiting update checks for now (shared hourly quota); try again in about 20 minutes";
-        assert_eq!(rate_limited(Some("1800001200"), 1800000000), limited);
-        // Rounds up: 61 seconds out reads as 2 minutes.
-        assert_eq!(
-            rate_limited(Some("1800000061"), 1800000000),
-            "GitHub is limiting update checks for now (shared hourly quota); try again in about 2 minutes"
-        );
-        assert_eq!(
-            rate_limited(Some("1800000060"), 1800000000),
-            "GitHub is limiting update checks for now (shared hourly quota); try again in about 1 minute"
-        );
-        // No header, not a number, or already past: ask for patience instead of a time.
-        let later = "GitHub is limiting update checks for now (shared hourly quota); try again later";
-        for bad in [None, Some(""), Some("soon"), Some("1799999999"), Some("1800000000")] {
-            assert_eq!(rate_limited(bad, 1800000000), later);
-        }
-    }
-
-    /// Live: asks GitHub over TLS with the OS's roots (`cargo test -p pdfcraft -- --ignored`).
-    #[test]
-    #[ignore = "needs network access"]
-    fn github_answers_with_the_latest_release() {
-        let r = latest_release().unwrap();
-        assert!(pdfcraft_ui_egui::updates::is_newer(&r.version, "0.0.0"), "{r:?}");
-        assert!(r.url.starts_with(RELEASES_PAGE), "{r:?}");
-    }
-}
diff --git a/apps/pdfcraft/tests/it/main.rs b/apps/pdfcraft/tests/it/main.rs
index bc05099a51..b09ace5f40 100644
--- a/apps/pdfcraft/tests/it/main.rs
+++ b/apps/pdfcraft/tests/it/main.rs
@@ -7,6 +7,7 @@ mod event {
     pub use winit::event::TouchPhase;
 }
 
+mod vendor_graph;
 mod winit_macos_emoji_picker;
 mod winit_macos_ime_commit;
 mod winit_macos_ime_discard;
diff --git a/apps/pdfcraft/tests/it/vendor_graph.rs b/apps/pdfcraft/tests/it/vendor_graph.rs
new file mode 100644
index 0000000000..a6a4d4b292
--- /dev/null
+++ b/apps/pdfcraft/tests/it/vendor_graph.rs
@@ -0,0 +1,81 @@
+//! Dependency-graph verification for the egui 0.37 window stack.
+//!
+//! The twelve `winit_*` modules next to this one read the retained `vendor/winit` /
+//! `vendor/egui-wgpu` copies. They are provenance for W1–W13 and E2+E3, not proof of what the app
+//! runs: the root manifest pins both crates to immutable storytold git revisions, and the retained
+//! copies are not path patches. These tests check the resolved graph and the retained evidence
+//! instead of treating the copies as the runtime source. The winit fork's own W17 tests own patch
+//! behaviour.
+
+/// Return the workspace root above the PdfCraft app crate.
+fn root() -> std::path::PathBuf {
+    std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..")
+}
+
+/// Every `[[package]]` block in `Cargo.lock` whose `name` is exactly `name`.
+fn locked_packages(name: &str) -> Vec<String> {
+    let lock = std::fs::read_to_string(root().join("Cargo.lock")).expect("Cargo.lock");
+    let needle = format!("name = \"{name}\"");
+    lock.split("[[package]]").filter(|package| package.lines().any(|line| line.trim() == needle.as_str())).map(str::to_owned).collect()
+}
+
+/// The one resolved package called `name`. A duplicate name is a lockfile problem, not something
+/// to resolve by taking the first match.
+fn locked(name: &str) -> String {
+    let mut packages = locked_packages(name);
+    assert_eq!(packages.len(), 1, "Cargo.lock must contain exactly one `{name}` package, found {}", packages.len());
+    packages.remove(0)
+}
+
+/// The resolved package must be the exact canonical storytold git source at the reviewed
+/// 40-character revision, including the `Cargo.lock` URL and fragment. A path source (no `source`
+/// line) is refused: it would make the graph depend on a developer's checkout. A published path
+/// patch is refused as well.
+fn assert_resolved(name: &str, version: &str, url: &str, rev: &str) {
+    let package = locked(name);
+    let expected_version = format!("version = \"{version}\"");
+    assert!(package.lines().any(|line| line.trim() == expected_version.as_str()), "{name} must resolve to {version}: {package}");
+    let sources: Vec<&str> = package.lines().filter_map(|line| line.trim().strip_prefix("source = ")).collect();
+    assert_eq!(sources.len(), 1, "{name} must have exactly one `source` in Cargo.lock; a local path source is not accepted: {package}");
+    let expected_source = format!("\"git+{url}?rev={rev}#{rev}\"");
+    assert_eq!(sources[0], expected_source.as_str(), "{name} must resolve to the exact canonical git URL, revision and fragment, not {}", sources[0]);
+
+    let manifest = std::fs::read_to_string(root().join("Cargo.toml")).expect("root Cargo.toml");
+    assert!(!manifest.contains(&format!("{name} = {{ path = \"vendor/")), "vendor/{name} cannot stay a published path patch");
+}
+
+/// Regression test: the resolved window stack points at the reviewed forks and the retained vendor provenance
+/// files remain.
+#[test]
+fn vendor_provenance_window_stack_graph_is_resolved() {
+    assert_resolved("winit", "0.30.13", "https://github.com/storytold/winit.git", "a517b3846ee8457d84ee4975110bfda6797c44dc");
+    assert_resolved("egui-wgpu", "0.37.0", "https://github.com/storytold/egui.git", "6d518fc799681571963842f95b55a6b68431b15a");
+    // Retained provenance: the audited copies and their recorded W1–W13 / E2+E3 rows.
+    let readme = std::fs::read_to_string(root().join("vendor/README.md")).expect("vendor/README.md");
+    for marker in ["W1–W13", "surface_fit", "catch_errors", "e9809ef54b18499bb4f2cac945719ecc2a61061b"] {
+        assert!(readme.contains(marker), "vendor/README.md lost window-stack provenance: {marker}");
+    }
+    let vcs = std::fs::read_to_string(root().join("vendor/winit/.cargo_vcs_info.json")).expect("vendor/winit provenance");
+    assert!(vcs.contains("e9809ef54b18499bb4f2cac945719ecc2a61061b"), "vendor/winit keeps its upstream base");
+    for path in ["vendor/winit/src/platform_impl", "vendor/egui-wgpu/src/winit.rs"] {
+        assert!(root().join(path).exists(), "retain {path} as provenance for the pinned fork");
+    }
+}
+
+/// Renderer, security and PostScript vendors are unrelated to the UI port and must stay path patches.
+#[test]
+fn renderer_and_security_vendors_remain() {
+    let manifest = std::fs::read_to_string(root().join("Cargo.toml")).expect("root Cargo.toml");
+    for vendor in [
+        "vendor/hayro",
+        "vendor/hayro-interpret",
+        "vendor/hayro-syntax",
+        "vendor/hayro-cmap",
+        "vendor/hayro-jbig2",
+        "vendor/hayro-postscript",
+        "vendor/lopdf",
+        "vendor/vello_common",
+    ] {
+        assert!(manifest.contains(&format!("path = \"{vendor}\"")), "{vendor} must stay a path patch");
+    }
+}
diff --git a/apps/pdfcraft/tests/it/winit_macos_emoji_picker.rs b/apps/pdfcraft/tests/it/winit_macos_emoji_picker.rs
index 6cedf57e33..b95058ba94 100644
--- a/apps/pdfcraft/tests/it/winit_macos_emoji_picker.rs
+++ b/apps/pdfcraft/tests/it/winit_macos_emoji_picker.rs
@@ -1,7 +1,11 @@
-//! vendor/winit patch (8) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (8) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit commits text inserted outside a key press and leaves `selectedRange`
+/// unmarked.
 #[test]
-fn winit_commits_macos_text_inserted_outside_a_key_press() {
+fn vendor_provenance_winit_macos_text_inserted_outside_a_key_press() {
     // The macOS emoji picker inserts its text with `insertText` outside any key press and without
     // a composition. winit 0.30.13 reports `insertText` only as part of a key press or a
     // composition, so an emoji picked into a PdfCraft text field was dropped. vendor/winit commits
diff --git a/apps/pdfcraft/tests/it/winit_macos_ime_commit.rs b/apps/pdfcraft/tests/it/winit_macos_ime_commit.rs
index 8701fc20a1..877f9e2a22 100644
--- a/apps/pdfcraft/tests/it/winit_macos_ime_commit.rs
+++ b/apps/pdfcraft/tests/it/winit_macos_ime_commit.rs
@@ -1,7 +1,11 @@
-//! vendor/winit patch (6) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (6) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit commits a composition that ended without marked text and keeps the
+/// marked-text underline.
 #[test]
-fn winit_commits_macos_compositions_that_end_without_marked_text() {
+fn vendor_provenance_winit_macos_compositions_that_end_without_marked_text() {
     // winit 0.30.13 treats `insertText` as an IME commit only while marked text is left. Input
     // methods that end a composition with `unmarkText` first lost the committed text, and Apple
     // Korean, which clears its marked text before inserting the key typed after a syllable (`한`
diff --git a/apps/pdfcraft/tests/it/winit_macos_ime_discard.rs b/apps/pdfcraft/tests/it/winit_macos_ime_discard.rs
index 52e65622f6..89efbd3d81 100644
--- a/apps/pdfcraft/tests/it/winit_macos_ime_discard.rs
+++ b/apps/pdfcraft/tests/it/winit_macos_ime_discard.rs
@@ -1,7 +1,10 @@
-//! vendor/winit patch (7) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (7) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: disallowing IME in the vendored winit discards the macOS input method's marked text.
 #[test]
-fn winit_discards_the_macos_composition_when_ime_is_disallowed() {
+fn vendor_provenance_winit_discards_the_macos_composition_when_ime_is_disallowed() {
     // egui disallows IME when a text field loses focus. winit 0.30.13 then forgets the marked text
     // but doesn't tell the input method, which keeps the composition and continues it once IME is
     // allowed again: the abandoned syllable comes back in the next field. vendor/winit calls
diff --git a/apps/pdfcraft/tests/it/winit_macos_korean_first_key.rs b/apps/pdfcraft/tests/it/winit_macos_korean_first_key.rs
index 76bb32ccbd..f18dde0f2a 100644
--- a/apps/pdfcraft/tests/it/winit_macos_korean_first_key.rs
+++ b/apps/pdfcraft/tests/it/winit_macos_korean_first_key.rs
@@ -1,7 +1,10 @@
-//! vendor/winit patch (10) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (10) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit retries the first Apple Korean key once so it starts a composition.
 #[test]
-fn winit_retries_the_first_apple_korean_key_once() {
+fn vendor_provenance_winit_retries_the_first_apple_korean_key_once() {
     // On the first key in a freshly started app, Apple Korean can answer with `insertText` and the
     // raw compatibility jamo instead of starting a composition, so typing g k s in PdfCraft gave
     // ㅎㅏㄴ instead of 한. vendor/winit interprets that one key again before sending it to the
diff --git a/apps/pdfcraft/tests/it/winit_macos_korean_space.rs b/apps/pdfcraft/tests/it/winit_macos_korean_space.rs
index 30c9d4779c..f5f2aada2f 100644
--- a/apps/pdfcraft/tests/it/winit_macos_korean_space.rs
+++ b/apps/pdfcraft/tests/it/winit_macos_korean_space.rs
@@ -1,7 +1,10 @@
-//! vendor/winit patch (9) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (9) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit sends a key committed through macOS IME only once.
 #[test]
-fn winit_sends_a_key_committed_through_macos_ime_only_once() {
+fn vendor_provenance_winit_sends_a_key_committed_through_macos_ime_only_once() {
     // Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`,
     // `insertText(" ")` and `setMarkedText("")`. The last call resets winit 0.30.13's IME state, so
     // the key went to the app both as `Ime::Commit(" ")` and as `KeyboardInput` with text " ", and
diff --git a/apps/pdfcraft/tests/it/winit_macos_title_bar_drag.rs b/apps/pdfcraft/tests/it/winit_macos_title_bar_drag.rs
index 5422af59b5..5c8e892f25 100644
--- a/apps/pdfcraft/tests/it/winit_macos_title_bar_drag.rs
+++ b/apps/pdfcraft/tests/it/winit_macos_title_bar_drag.rs
@@ -1,7 +1,11 @@
-//! vendor/winit patch (12) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (12) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit lets title-bar drags reach the app while the empty tab strip still
+/// moves the window.
 #[test]
-fn winit_lets_macos_title_bar_drags_reach_the_app() {
+fn vendor_provenance_winit_lets_macos_title_bar_drags_reach_the_app() {
     // On macOS the tab strip is the title bar: a transparent title bar over a full-size content
     // view. NSView answers YES to `mouseDownCanMoveWindow` for a view that isn't opaque, so AppKit
     // moved the whole window for a drag that began on a document tab, and tabs could not be
diff --git a/apps/pdfcraft/tests/it/winit_wayland_scroll.rs b/apps/pdfcraft/tests/it/winit_wayland_scroll.rs
index 96686f7ecf..8087219b21 100644
--- a/apps/pdfcraft/tests/it/winit_wayland_scroll.rs
+++ b/apps/pdfcraft/tests/it/winit_wayland_scroll.rs
@@ -1,3 +1,5 @@
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
 #![cfg(target_os = "linux")]
 
 use egui::{Event, Modifiers, MouseWheelUnit, RawInput, TouchPhase, vec2};
@@ -16,6 +18,7 @@ fn egui_phase(phase: event::TouchPhase) -> TouchPhase {
     }
 }
 
+/// Run three wheel frames through egui and return each frame's zoom and smooth-scroll deltas.
 fn wheel_trace(source: AxisSource, discrete: bool) -> Vec<(f32, egui::Vec2)> {
     let ctx = egui::Context::default();
     let mut previous = event::TouchPhase::Ended;
@@ -27,7 +30,13 @@ fn wheel_trace(source: AxisSource, discrete: bool) -> Vec<(f32, egui::Vec2)> {
         let (unit, dy) = if discrete { (MouseWheelUnit::Line, 1.0) } else { (MouseWheelUnit::Point, 24.0) };
         let input = RawInput {
             time: Some(frame as f64 / 60.0),
-            events: vec![Event::MouseWheel { unit, delta: vec2(0.0, dy), phase: egui_phase(phase), modifiers }],
+            events: vec![Event::MouseWheel {
+                unit,
+                delta: vec2(0.0, dy),
+                phase: egui_phase(phase),
+                modifiers,
+                source: egui::MouseWheelSource::Unknown,
+            }],
             ..Default::default()
         };
         ctx.run_ui(input, |ui| seen.push(ui.input(|i| (i.zoom_delta(), i.smooth_scroll_delta)))).textures_delta.clear();
@@ -35,8 +44,10 @@ fn wheel_trace(source: AxisSource, discrete: bool) -> Vec<(f32, egui::Vec2)> {
     seen
 }
 
+/// Regression test: releasing Ctrl after a pixel-wheel zoom makes the next wheel event scroll instead of
+/// zooming.
 #[test]
-fn releasing_ctrl_after_pixel_wheel_zoom_returns_to_scrolling() {
+fn vendor_provenance_releasing_ctrl_after_pixel_wheel_zoom_returns_to_scrolling() {
     for source in [AxisSource::Wheel, AxisSource::WheelTilt, AxisSource::Continuous] {
         let seen = wheel_trace(source, false);
         assert!(seen[1].0 > 1.0, "Ctrl must zoom: {source:?}");
@@ -45,16 +56,18 @@ fn releasing_ctrl_after_pixel_wheel_zoom_returns_to_scrolling() {
     }
 }
 
+/// Regression test: discrete wheels follow the modifiers of the current event, just like pixel wheels.
 #[test]
-fn discrete_wheels_still_follow_current_modifiers() {
+fn vendor_provenance_discrete_wheels_still_follow_current_modifiers() {
     let seen = wheel_trace(AxisSource::Wheel, true);
     assert!(seen[1].0 > 1.0);
     assert_eq!(seen[2].0, 1.0);
     assert!(seen[2].1.y > 0.0);
 }
 
+/// Regression test: a finger gesture keeps its Ctrl zoom through momentum until the gesture ends.
 #[test]
-fn finger_gestures_keep_their_modifier_until_the_gesture_ends() {
+fn vendor_provenance_finger_gestures_keep_their_modifier_until_the_gesture_ends() {
     // A finger scroll's momentum may arrive after Ctrl is released.
     let seen = wheel_trace(AxisSource::Finger, false);
     assert!(seen[1].0 > 1.0);
@@ -64,8 +77,9 @@ fn finger_gestures_keep_their_modifier_until_the_gesture_ends() {
     assert_eq!(scroll::phase(event::TouchPhase::Ended, Some(AxisSource::Finger), false, false), event::TouchPhase::Started);
 }
 
+/// Regression test: wheel sources without a phase keep the existing start, move and end policy.
 #[test]
-fn unknown_sources_keep_the_existing_phase_policy() {
+fn vendor_provenance_unknown_sources_keep_the_existing_phase_policy() {
     assert_eq!(scroll::phase(event::TouchPhase::Ended, None, false, false), event::TouchPhase::Started);
     assert_eq!(scroll::phase(event::TouchPhase::Started, None, false, false), event::TouchPhase::Moved);
     assert_eq!(scroll::phase(event::TouchPhase::Ended, None, true, false), event::TouchPhase::Moved);
diff --git a/apps/pdfcraft/tests/it/winit_wayland_text_input.rs b/apps/pdfcraft/tests/it/winit_wayland_text_input.rs
index 691659e5a6..6469354cdc 100644
--- a/apps/pdfcraft/tests/it/winit_wayland_text_input.rs
+++ b/apps/pdfcraft/tests/it/winit_wayland_text_input.rs
@@ -1,7 +1,10 @@
-//! vendor/winit patch (2) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (2) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit keeps a Wayland seat's text input until the seat itself is removed.
 #[test]
-fn winit_keeps_the_wayland_text_input_until_the_seat_goes() {
+fn vendor_provenance_winit_keeps_the_wayland_text_input_until_the_seat_goes() {
     // winit 0.30.13 destroys a Wayland seat's text input whenever the seat loses any capability (a
     // touch screen or tablet unplugged, a remote-desktop session ending) and recreates it only when
     // a capability is added, so IME stops working in a running PdfCraft until it is restarted.
diff --git a/apps/pdfcraft/tests/it/winit_windows_hidden_maximized.rs b/apps/pdfcraft/tests/it/winit_windows_hidden_maximized.rs
index a1bdd11840..a8009591bf 100644
--- a/apps/pdfcraft/tests/it/winit_windows_hidden_maximized.rs
+++ b/apps/pdfcraft/tests/it/winit_windows_hidden_maximized.rs
@@ -1,7 +1,10 @@
-//! vendor/winit patch (4) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (4) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit maximizes a hidden Windows window only when it is shown.
 #[test]
-fn winit_maximizes_a_hidden_windows_window_only_when_it_is_shown() {
+fn vendor_provenance_winit_maximizes_a_hidden_windows_window_only_when_it_is_shown() {
     // eframe creates PdfCraft's window hidden, restores the saved maximized state and shows the
     // window once its first frame is drawn. winit 0.30.13 applies the maximized state with
     // `ShowWindow(SW_MAXIMIZE)`, which shows a hidden window, so a window closed maximized came back
diff --git a/apps/pdfcraft/tests/it/winit_windows_ime_cursor.rs b/apps/pdfcraft/tests/it/winit_windows_ime_cursor.rs
index aef55877d7..1df11d8a68 100644
--- a/apps/pdfcraft/tests/it/winit_windows_ime_cursor.rs
+++ b/apps/pdfcraft/tests/it/winit_windows_ime_cursor.rs
@@ -1,7 +1,10 @@
-//! vendor/winit patch (3) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (3) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit reads the Windows IME cursor only when the composition reports it.
 #[test]
-fn winit_reads_the_windows_ime_cursor_only_when_it_is_reported() {
+fn vendor_provenance_winit_reads_the_windows_ime_cursor_only_when_it_is_reported() {
     // winit 0.30.13 reads `GCS_CURSORPOS` for every composition without a target clause, whether
     // or not `WM_IME_COMPOSITION` says the IME set it. The Microsoft Korean IME never sets it, so
     // the composition's cursor read as 0, before the syllable being composed. vendor/winit puts it
diff --git a/apps/pdfcraft/tests/it/winit_x11_dpi.rs b/apps/pdfcraft/tests/it/winit_x11_dpi.rs
index fed0cf3e42..a9bde6a1ee 100644
--- a/apps/pdfcraft/tests/it/winit_x11_dpi.rs
+++ b/apps/pdfcraft/tests/it/winit_x11_dpi.rs
@@ -1,5 +1,9 @@
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+/// Regression test: the vendored winit keeps the X11 server-DPI fallback and the desktop file does not
+/// override scaling.
 #[test]
-fn winit_carries_the_x11_server_dpi_fallback() {
+fn vendor_provenance_winit_carries_the_x11_server_dpi_fallback() {
     // The behavior tests live beside the policy in winit (util::randr::tests).
     // This guards PdfCraft's vendored copy, which workspace tests do not test itself.
     let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
diff --git a/apps/pdfcraft/tests/it/winit_x11_ime_focus.rs b/apps/pdfcraft/tests/it/winit_x11_ime_focus.rs
index f244d1387a..61e5c8ebfa 100644
--- a/apps/pdfcraft/tests/it/winit_x11_ime_focus.rs
+++ b/apps/pdfcraft/tests/it/winit_x11_ime_focus.rs
@@ -1,7 +1,10 @@
-//! vendor/winit patch (5) (vendor/README.md).
+//! Provenance-only: reads the retained `vendor/` copy, not the resolved dependency, so it is
+//! not runtime coverage. `vendor_graph.rs` checks the resolved graph identity.
+//! Retained vendor provenance for winit patch (5) (vendor/README.md); `vendor_graph.rs` checks the resolved graph.
 
+/// Regression test: the vendored winit focuses the X11 input context it replaces.
 #[test]
-fn winit_focuses_the_x11_input_context_it_replaces() {
+fn vendor_provenance_winit_focuses_the_x11_input_context_it_replaces() {
     // egui allows IME when a text field gains focus and disallows it when the field loses focus.
     // On X11, winit 0.30.13 replaces the window's input context each time and leaves focusing the
     // new one to the next focus event, which never comes while PdfCraft's window keeps the focus:
diff --git a/assets/demo/showcase.html b/assets/demo/showcase.html
index b26f24565a..3b14ea3b47 100644
--- a/assets/demo/showcase.html
+++ b/assets/demo/showcase.html
@@ -14,27 +14,27 @@
   (highlight, sticky note, stamp, ...), so annotation geometry follows the layout.
 -->
 <style>
-@font-face { font-display: block; font-family: "PC Mono"; src: url("{{ASSETS}}/fonts/JetBrainsMono-Regular.ttf"); }
-@font-face { font-display: block; font-family: "PC Inter"; src: url("{{FONTS}}/Inter[opsz,wght].ttf"); font-weight: 100 900; }
-@font-face { font-display: block; font-family: "PC Inter"; src: url("{{FONTS}}/Inter-Italic[opsz,wght].ttf"); font-weight: 100 900; font-style: italic; }
-@font-face { font-display: block; font-family: "PC Garamond"; src: url("{{FONTS}}/EBGaramond[wght].ttf"); font-weight: 400 800; }
-@font-face { font-display: block; font-family: "PC Garamond"; src: url("{{FONTS}}/EBGaramond-Italic[wght].ttf"); font-weight: 400 800; font-style: italic; }
-@font-face { font-display: block; font-family: "PC Playfair"; src: url("{{FONTS}}/PlayfairDisplay[wght].ttf"); font-weight: 400 900; }
-@font-face { font-display: block; font-family: "PC Playfair"; src: url("{{FONTS}}/PlayfairDisplay-Italic[wght].ttf"); font-weight: 400 900; font-style: italic; }
-@font-face { font-display: block; font-family: "PC Vibes"; src: url("{{FONTS}}/GreatVibes-Regular.ttf"); }
-@font-face { font-display: block; font-family: "PC Math"; src: url("{{FONTS}}/STIXTwoMath-Regular.ttf"); }
-@font-face { font-display: block; font-family: "PC Amiri"; src: url("{{FONTS}}/Amiri-Regular.ttf"); }
-@font-face { font-display: block; font-family: "PC Hebrew"; src: url("{{FONTS}}/NotoSansHebrew[wdth,wght].ttf"); font-weight: 100 900; }
-@font-face { font-display: block; font-family: "PC Devanagari"; src: url("{{FONTS}}/NotoSansDevanagari[wdth,wght].ttf"); font-weight: 100 900; }
-@font-face { font-display: block; font-family: "PC Thai"; src: url("{{FONTS}}/NotoSansThai[wdth,wght].ttf"); font-weight: 100 900; }
-@font-face { font-display: block; font-family: "PC Armenian"; src: url("{{FONTS}}/NotoSansArmenian[wdth,wght].ttf"); font-weight: 100 900; }
-@font-face { font-display: block; font-family: "PC Georgian"; src: url("{{FONTS}}/NotoSansGeorgian[wdth,wght].ttf"); font-weight: 100 900; }
-@font-face { font-display: block; font-family: "PC Tamil"; src: url("{{FONTS}}/NotoSansTamil[wdth,wght].ttf"); font-weight: 100 900; }
-@font-face { font-display: block; font-family: "PC Charis"; src: url("{{FONTS}}/CharisSIL-Regular.ttf"); }
-@font-face { font-display: block; font-family: "PC XiaoWei"; src: url("{{FONTS}}/ZCOOLXiaoWei-Regular.ttf"); }
-@font-face { font-display: block; font-family: "PC Mincho"; src: url("{{FONTS}}/ShipporiMincho-Regular.ttf"); }
-@font-face { font-display: block; font-family: "PC Gowun"; src: url("{{FONTS}}/GowunBatang-Regular.ttf"); }
-@font-face { font-display: block; font-family: "PC Emoji"; src: url("{{FONTS}}/NotoColorEmoji-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC Mono"; src: url("{{ASSETS}}/fonts/JetBrainsMono-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC Inter"; src: url("{{FONTS}}/Inter[opsz,wght].ttf"); font-weight: 100 900; }
+@font-face { font-display: swap; font-family: "PC Inter"; src: url("{{FONTS}}/Inter-Italic[opsz,wght].ttf"); font-weight: 100 900; font-style: italic; }
+@font-face { font-display: swap; font-family: "PC Garamond"; src: url("{{FONTS}}/EBGaramond[wght].ttf"); font-weight: 400 800; }
+@font-face { font-display: swap; font-family: "PC Garamond"; src: url("{{FONTS}}/EBGaramond-Italic[wght].ttf"); font-weight: 400 800; font-style: italic; }
+@font-face { font-display: swap; font-family: "PC Playfair"; src: url("{{FONTS}}/PlayfairDisplay[wght].ttf"); font-weight: 400 900; }
+@font-face { font-display: swap; font-family: "PC Playfair"; src: url("{{FONTS}}/PlayfairDisplay-Italic[wght].ttf"); font-weight: 400 900; font-style: italic; }
+@font-face { font-display: swap; font-family: "PC Vibes"; src: url("{{FONTS}}/GreatVibes-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC Math"; src: url("{{FONTS}}/STIXTwoMath-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC Amiri"; src: url("{{FONTS}}/Amiri-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC Hebrew"; src: url("{{FONTS}}/NotoSansHebrew[wdth,wght].ttf"); font-weight: 100 900; }
+@font-face { font-display: swap; font-family: "PC Devanagari"; src: url("{{FONTS}}/NotoSansDevanagari[wdth,wght].ttf"); font-weight: 100 900; }
+@font-face { font-display: swap; font-family: "PC Thai"; src: url("{{FONTS}}/NotoSansThai[wdth,wght].ttf"); font-weight: 100 900; }
+@font-face { font-display: swap; font-family: "PC Armenian"; src: url("{{FONTS}}/NotoSansArmenian[wdth,wght].ttf"); font-weight: 100 900; }
+@font-face { font-display: swap; font-family: "PC Georgian"; src: url("{{FONTS}}/NotoSansGeorgian[wdth,wght].ttf"); font-weight: 100 900; }
+@font-face { font-display: swap; font-family: "PC Tamil"; src: url("{{FONTS}}/NotoSansTamil[wdth,wght].ttf"); font-weight: 100 900; }
+@font-face { font-display: swap; font-family: "PC Charis"; src: url("{{FONTS}}/CharisSIL-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC XiaoWei"; src: url("{{FONTS}}/ZCOOLXiaoWei-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC Mincho"; src: url("{{FONTS}}/ShipporiMincho-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC Gowun"; src: url("{{FONTS}}/GowunBatang-Regular.ttf"); }
+@font-face { font-display: swap; font-family: "PC Emoji"; src: url("{{FONTS}}/NotoColorEmoji-Regular.ttf"); }
 
 @page { size: Letter; margin: 0; }
 
diff --git a/clippy.toml b/clippy.toml
index 7f2fd53057..e908d13581 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -13,3 +13,7 @@ disallowed-methods = [
     { path = "egui::Ui::radio_value", reason = "use radio_value from crates/ui-egui/src/widgets.rs, which is outlined and filled" },
     { path = "egui::RadioButton::new", reason = "use radio from crates/ui-egui/src/widgets.rs, which is outlined and filled" },
 ]
+
+disallowed-types = [
+    { path = "egui::ComboBox", reason = "use craft_ui::ComboBox: egui's combo box menu can't grow back while open (egui#5225)" },
+]
diff --git a/contributors/people.toml b/contributors/people.toml
index 4f2b22775c..dd75a07314 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -176,3 +176,7 @@ real_name = "Nick Nyssen"
 
 [people.agent-reed]
 sync_github_name = true
+
+[people.dotCooCoo]
+real_name = "Robert Lee"
+sync_github_name = true
diff --git a/crates/a11y/src/alt.rs b/crates/a11y/src/alt.rs
index 87cfce5acb..720b8a6a1e 100644
--- a/crates/a11y/src/alt.rs
+++ b/crates/a11y/src/alt.rs
@@ -211,6 +211,25 @@ fn close(marks: &mut Vec<Mark>, matching: &mut usize, out: &mut HashMap<i64, [f6
     draw(marks, b);
 }
 
+/// The page-space box a `Do` operator paints: a form's transformed `/BBox`, or the unit square for an image.
+/// `None` when the operand is not a resolvable XObject or the form's box is malformed.
+fn xobject_bbox(doc: &Document, xobjects: &Dict, op: &pdfcraft_content::Op, top: &Matrix) -> Option<[f64; 4]> {
+    let r = op.name(0).and_then(|n| xobjects.get(n)).and_then(Object::as_ref)?;
+    Some(match &*doc.get(r) {
+        Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Form") => {
+            let bb: Vec<f64> =
+                s.dict.get(b"BBox").and_then(|b| b.as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default();
+            let m = Matrix::from_operands(s.dict.get(b"Matrix").and_then(|m| m.as_array()).map(Vec::as_slice).unwrap_or(&[]))
+                .unwrap_or(Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]));
+            match bb[..] {
+                [a, b, c, d] => m.then(top).bbox([a, b, c, d]),
+                _ => return None,
+            }
+        }
+        _ => top.bbox([0.0, 0.0, 1.0, 1.0]),
+    })
+}
+
 /// Where each of the marked content `ids` is drawn on a page (images, forms and paths), in one pass
 /// over the page. What a sequence draws counts for every sequence of `ids` around it too.
 pub(crate) fn content_bboxes(doc: &Document, page: &Dict, ids: &HashSet<i64>) -> HashMap<i64, [f64; 4]> {
@@ -274,20 +293,7 @@ pub(crate) fn content_bboxes(doc: &Document, page: &Dict, ids: &HashSet<i64>) ->
                 path.clear();
             }
             b"Do" if inside => {
-                let Some(r) = op.name(0).and_then(|n| xobjects.get(n)).and_then(Object::as_ref) else { continue };
-                let unit = match &*doc.get(r) {
-                    Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Form") => {
-                        let bb: Vec<f64> =
-                            s.dict.get(b"BBox").and_then(|b| b.as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default();
-                        let m = Matrix::from_operands(s.dict.get(b"Matrix").and_then(|m| m.as_array()).map(Vec::as_slice).unwrap_or(&[]))
-                            .unwrap_or(Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]));
-                        match bb[..] {
-                            [a, b, c, d] => m.then(&top).bbox([a, b, c, d]),
-                            _ => continue,
-                        }
-                    }
-                    _ => top.bbox([0.0, 0.0, 1.0, 1.0]),
-                };
+                let Some(unit) = xobject_bbox(doc, &xobjects, &op, &top) else { continue };
                 draw(&mut marks, unit);
             }
             b"BI" if inside => draw(&mut marks, top.bbox([0.0, 0.0, 1.0, 1.0])),
diff --git a/crates/a11y/src/autotag.rs b/crates/a11y/src/autotag.rs
index 4462025cf5..9b65f6972b 100644
--- a/crates/a11y/src/autotag.rs
+++ b/crates/a11y/src/autotag.rs
@@ -132,6 +132,38 @@ fn harmless_inside(op: &[u8]) -> bool {
     )
 }
 
+/// The `(BT, ET)` operator index pairs of each text object that shows text, or why the page cannot be tagged.
+fn text_spans(ops: &[Op], index: usize) -> Result<Vec<(usize, usize)>, AutoTagError> {
+    let mut start = None;
+    let mut has_text = false;
+    let mut spans = Vec::new();
+    for (at, op) in ops.iter().enumerate() {
+        match op.op.as_slice() {
+            b"BT" if start.is_none() => {
+                start = Some(at);
+                has_text = false;
+            }
+            b"ET" => {
+                let Some(first) = start.take() else { return Err(unsupported(index, "unmatched ET operator")) };
+                if has_text {
+                    spans.push((first, at));
+                    if spans.len() > MAX_TEXT_OBJECTS {
+                        return Err(unsupported(index, "too many text objects (maximum 4096)"));
+                    }
+                }
+            }
+            b"Tj" | b"TJ" | b"'" | b"\"" if start.is_some() => has_text = true,
+            name if start.is_some() && harmless_inside(name) => {}
+            name if start.is_none() && harmless_outside(name) => {}
+            _ => return Err(unsupported(index, format!("unsupported or painted operator {}", String::from_utf8_lossy(&op.op)))),
+        }
+    }
+    if start.is_some() {
+        return Err(unsupported(index, "unterminated BT text object"));
+    }
+    Ok(spans)
+}
+
 fn plan(doc: &Document) -> Result<Vec<Plan>, AutoTagError> {
     let root = doc.root().ok_or(AutoTagError::NoCatalog)?;
     let catalog = doc.get(root);
@@ -163,33 +195,7 @@ fn plan(doc: &Document) -> Result<Vec<Plan>, AutoTagError> {
         if parsed.skipped > 0 || parsed.ops.len() > MAX_OPERATORS {
             return Err(unsupported(index, "content has malformed or too many operators"));
         }
-        let mut start = None;
-        let mut has_text = false;
-        let mut spans = Vec::new();
-        for (at, op) in parsed.ops.iter().enumerate() {
-            match op.op.as_slice() {
-                b"BT" if start.is_none() => {
-                    start = Some(at);
-                    has_text = false;
-                }
-                b"ET" => {
-                    let Some(first) = start.take() else { return Err(unsupported(index, "unmatched ET operator")) };
-                    if has_text {
-                        spans.push((first, at));
-                        if spans.len() > MAX_TEXT_OBJECTS {
-                            return Err(unsupported(index, "too many text objects (maximum 4096)"));
-                        }
-                    }
-                }
-                b"Tj" | b"TJ" | b"'" | b"\"" if start.is_some() => has_text = true,
-                name if start.is_some() && harmless_inside(name) => {}
-                name if start.is_none() && harmless_outside(name) => {}
-                _ => return Err(unsupported(index, format!("unsupported or painted operator {}", String::from_utf8_lossy(&op.op)))),
-            }
-        }
-        if start.is_some() {
-            return Err(unsupported(index, "unterminated BT text object"));
-        }
+        let spans = text_spans(&parsed.ops, index)?;
         total = total.saturating_add(spans.len());
         out.push(Plan { page: page.obj, ops: parsed.ops, spans });
     }
diff --git a/crates/annot/README.md b/crates/annot/README.md
index 55df6d1a75..8108201835 100644
--- a/crates/annot/README.md
+++ b/crates/annot/README.md
@@ -9,10 +9,12 @@ Comments (annotations), ISO 32000-2 §12.5. Layer L3, depends on `pdfcraft-cos`,
   line and arrow (`Line` with `/LE`), freehand drawing (`Ink`) and text box (`FreeText`).
 - **Appearance streams** (`appearance::build`) generated from the annotation dictionary, so new
   and restyled comments look the same in every viewer. Highlights multiply (`/BM /Multiply`).
+  A line's leader lines (`/LL`, `/LLE`, `/LLO`) and caption (`/Cap`, `/CP`, `/CO`) are drawn as
+  ISO 32000-2 Table 178 places them, the caption in black Helvetica 10.
   Note icons are PdfCraft's own drawings. Text boxes use standard Helvetica (WinAnsi), with
   line breaking by approximate Helvetica proportions (no font program is bundled). Text it can't
-  draw (in a text box, callout, Fill & Sign text, measurement label or dynamic stamp's by-line;
-  `appearance::undrawable_text`) is kept as typed and drawn as `?`, and the comment is marked with
+  draw (in a text box, callout, Fill & Sign text, line caption, measurement label or dynamic
+  stamp's by-line; `appearance::undrawable_text`) is kept as typed and drawn as `?`, and the comment is marked with
   the first such character (`pdfcraft_fonts::UNDRAWN_MARK`) so the engine reports the edit and
   flattening refuses to make it permanent. Two refusals (`AnnotError::Undrawable`): a redaction
   mark's overlay text, which becomes page content when applied; and a restyle or resize of a
diff --git a/crates/annot/src/appearance.rs b/crates/annot/src/appearance.rs
index 436c49b35f..508d2bee45 100644
--- a/crates/annot/src/appearance.rs
+++ b/crates/annot/src/appearance.rs
@@ -16,6 +16,11 @@ pub use pdfcraft_fonts::{helvetica_width as text_width, wrap};
 
 use crate::{NOTE_SIZE, Rgb, n};
 
+mod symbols;
+
+pub(crate) use symbols::display_stamp;
+use symbols::{CAPTION_SIZE, attach_icon, ellipse, line_caption, line_layout, note_icon, stamp};
+
 /// Length of an arrowhead for a line of width `w`.
 pub fn arrow_size(w: f64) -> f64 {
     6.0 + 3.0 * w.max(0.0)
@@ -302,13 +307,14 @@ fn text_turn(d: &Dict) -> i64 {
 
 /// The first text [`build`] would draw in the standard fonts (Helvetica, WinAnsiEncoding) that
 /// they can't, which would come out as `?`: what it is (for the message) and the character. The
-/// text of a text box, callout or Fill & Sign text, a measurement's label, a dynamic stamp's
-/// "By …" line, and a redaction mark's overlay text (drawn when it is applied). `None` when all of
+/// text of a text box, callout or Fill & Sign text, a line's caption, a measurement's label, a
+/// dynamic stamp's "By …" line, and a redaction mark's overlay text (drawn when it is applied). `None` when all of
 /// it can be drawn.
 pub fn undrawable_text(d: &Dict) -> Option<(&'static str, char)> {
     let text = |key: &[u8]| d.get(key).and_then(Object::as_string).map(PdfString::to_text);
     let (what, text) = match d.name(b"Subtype")? {
         b"FreeText" => ("the comment's text", text(b"Contents")?),
+        b"Line" if !d.contains(b"PCMeasureValue") => ("the line's caption", line_caption(d)?),
         b"Line" | b"PolyLine" | b"Polygon" => ("the measurement label", text(b"PCMeasureValue")?),
         b"Stamp" if matches!(d.get(b"PCStamp"), Some(Object::Bool(true))) => ("the stamp's \"By\" line", text(b"PCByLine")?),
         // Drawn in Helvetica when the redaction is applied: refused when it is marked.
@@ -389,6 +395,8 @@ pub fn build(d: &Dict) -> Option<Stream> {
     let w = border_width(d);
     let mut res = Dict::new();
     let mut c = String::new();
+    // Content after `c` that isn't UTF-8 (WinAnsi text).
+    let mut tail: Vec<u8> = Vec::new();
     let markup = matches!(subtype.as_slice(), b"Highlight" | b"Underline" | b"StrikeOut" | b"Squiggly");
     if let Some(gs) = ext_gstate(opacity, subtype == b"Highlight") {
         res.set(b"ExtGState".to_vec(), Object::Dict(gs));
@@ -513,13 +521,29 @@ pub fn build(d: &Dict) -> Option<Stream> {
                 return None;
             }
             let fill = interior_color(d, Some(col)).unwrap_or(col);
+            let layout = line_layout(d, [(l[0], l[1]), (l[2], l[3])], w);
+            let [p, q] = layout.line;
             c.push_str(&format!("{}{}{} w 1 J 1 j\n{}", rg_stroke(col), rg(fill), n(w), dash(d)));
-            c.push_str(&format!("{} {} m {} {} l S\n[] 0 d\n", n(l[0]), n(l[1]), n(l[2]), n(l[3])));
-            for (end, (tip, from)) in ends.iter().zip([((l[0], l[1]), (l[2], l[3])), ((l[2], l[3]), (l[0], l[1]))]) {
+            for [s, e] in layout.leaders.iter().chain(&layout.strokes).chain(&layout.tick) {
+                c.push_str(&format!("{} {} m {} {} l S\n", n(s.0), n(s.1), n(e.0), n(e.1)));
+            }
+            c.push_str("[] 0 d\n");
+            for (end, (tip, from)) in ends.iter().zip([(p, q), (q, p)]) {
                 if !line_end(&mut c, end, tip, from, w) {
                     return None;
                 }
             }
+            if let Some((text, m)) = layout.caption {
+                // The caption is black, in the standard font the measurement label uses.
+                tail.extend(
+                    format!("q 0 g BT /Helv {} Tf {} {} {} {} {} {} Tm ", n(CAPTION_SIZE), n(m[0]), n(m[1]), n(m[2]), n(m[3]), n(m[4]), n(m[5]))
+                        .bytes(),
+                );
+                // WinAnsi bytes go into the stream as-is, not through UTF-8.
+                tail.extend(literal(&win_ansi(&text)));
+                tail.extend_from_slice(b" Tj ET Q\n");
+                res.set(b"Font".to_vec(), helvetica_resource());
+            }
         }
         b"Polygon" | b"PolyLine" => {
             let v = nums(d, b"Vertices").filter(|v| v.len() >= 4 && v.len() % 2 == 0 && v.iter().all(|x| x.is_finite()))?;
@@ -866,6 +890,7 @@ pub fn build(d: &Dict) -> Option<Stream> {
     // PdfCraft measurement captions are kept separate from the comment's free-form text.
     // A restyle regenerates the path and its value together.
     let mut out = c.into_bytes();
+    out.extend(tail);
     if let Some(value) = d.get(b"PCMeasureValue").and_then(Object::as_string) {
         let value = value.to_text();
         if value.chars().count() <= 256 && matches!(subtype.as_slice(), b"Line" | b"PolyLine" | b"Polygon") {
@@ -882,352 +907,3 @@ pub fn build(d: &Dict) -> Option<Stream> {
     }
     Some(form(rect, &out, res))
 }
-
-/// The label and colour of a standard rubber stamp name (ISO 32000-2 Table 184), for a stamp
-/// another program wrote without an appearance. Names are matched byte for byte, as PDF names
-/// are compared (§7.3.5). Eight are stamps of PdfCraft's palette; the other six take a label of
-/// their own and the palette's colour for their meaning.
-fn standard_stamp(name: &[u8]) -> Option<(&'static str, Rgb)> {
-    use crate::StampKind::*;
-    let palette = [Approved, NotApproved, NotForPublicRelease, Confidential, Final, ForComment, Draft, ForPublicRelease];
-    if let Some(kind) = palette.into_iter().find(|k| k.name().as_bytes() == name) {
-        return Some((kind.label(), kind.color()));
-    }
-    let (label, like) = match name {
-        b"Experimental" => ("EXPERIMENTAL", Draft),
-        b"AsIs" => ("AS IS", Draft),
-        b"Expired" => ("EXPIRED", NotApproved),
-        b"Sold" => ("SOLD", Approved),
-        b"Departmental" => ("DEPARTMENTAL", Draft),
-        b"TopSecret" => ("TOP SECRET", Confidential),
-        _ => return None,
-    };
-    Some((label, like.color()))
-}
-
-/// The neutral grey of a stamp whose name has no drawing.
-const PLACEHOLDER_GREY: Rgb = [0.45, 0.45, 0.45];
-
-/// The display appearance of a rubber stamp another program wrote without one: the stamp its
-/// `/Name` names (Draft when there is none, Table 184's default) in its `/C` colour or the
-/// stamp's own, or for any other name a thin grey frame with both diagonals, so the stamp stays
-/// visible and can be selected. The frame is grey whatever the `/C`: it stands in for a stamp
-/// that cannot be drawn, so it takes none of that stamp's colour. The name is never drawn as text.
-///
-/// For display only ([`crate::with_missing_appearances`]): [`build`] declines these stamps, so
-/// edits (restyling, flattening) never write this drawing into the file. `None` for any other
-/// annotation, one of PdfCraft's own stamps, a dictionary with an `/AP` (a stamp's own artwork is
-/// never replaced; the display copy passes the dictionary without an `/AP` that has no normal
-/// appearance), or a `/Rect` that isn't finite or is under a point wide or high.
-pub(crate) fn display_stamp(d: &Dict) -> Option<Stream> {
-    let own = matches!(d.get(b"PCStamp"), Some(Object::Bool(true))) || d.contains(b"PCPicture") || d.contains(b"PCOutline");
-    if d.name(b"Subtype") != Some(b"Stamp") || own || d.contains(b"AP") {
-        return None;
-    }
-    let rect = nums(d, b"Rect")?;
-    let [a, b, c, e] = rect.as_slice() else { return None };
-    let rect = [a.min(*c), b.min(*e), a.max(*c), b.max(*e)];
-    if !rect.iter().all(|v| v.is_finite()) || rect[2] - rect[0] < 1.0 || rect[3] - rect[1] < 1.0 {
-        return None;
-    }
-    let opacity = d.get(b"CA").and_then(|o| o.as_f64()).unwrap_or(1.0).clamp(0.0, 1.0);
-    // A malformed `/C` falls back to the stamp's own colour rather than hiding the stamp.
-    let stroke = color(d, b"C").flatten();
-    let mut res = Dict::new();
-    if let Some(gs) = ext_gstate(opacity, false) {
-        res.set(b"ExtGState".to_vec(), Object::Dict(gs));
-    }
-    // A stamp whose intent (`/IT`, PDF 2.0) is an image or a snapshot has no `/Name` to default.
-    let stamp_intent = d.name(b"IT").is_none_or(|it| it == b"Stamp");
-    let name = d.name(b"Name").or(stamp_intent.then_some(b"Draft".as_slice()));
-    if let Some((label, col)) = name.and_then(standard_stamp) {
-        return Some(stamp(label, false, rect, stroke.unwrap_or(col), None, opacity, res));
-    }
-    let [x0, y0, x1, y1] = rect;
-    let (a0, b0, a1, b1) = (x0 + 0.5, y0 + 0.5, x1 - 0.5, y1 - 0.5);
-    let mut c = String::new();
-    if opacity < 1.0 {
-        c.push_str("/GS0 gs\n");
-    }
-    c.push_str(&format!(
-        "{}1 w\n{} {} {} {} re\n{} {} m {} {} l\n{} {} m {} {} l\nS\n",
-        // Grey whatever the `/C`: the placeholder is not the stamp, so it takes none of its colour.
-        rg_stroke(PLACEHOLDER_GREY),
-        n(a0),
-        n(b0),
-        n(a1 - a0),
-        n(b1 - b0),
-        n(a0),
-        n(b0),
-        n(a1),
-        n(b1),
-        n(a0),
-        n(b1),
-        n(a1),
-        n(b0)
-    ));
-    Some(form(rect, c.as_bytes(), res))
-}
-
-/// A rubber stamp: a rounded frame (a pointed tag for sign-here stamps) with the label in bold
-/// capitals, and the dynamic stamps' "By … at …" line.
-fn stamp(label: &str, sign_here: bool, rect: [f64; 4], col: Rgb, by: Option<&str>, opacity: f64, mut res: Dict) -> Stream {
-    let [x0, y0, x1, y1] = rect;
-    let h = y1 - y0;
-    let mut c = String::new();
-    if opacity < 1.0 {
-        c.push_str("/GS0 gs\n");
-    }
-    let lw = (h * 0.07).clamp(1.0, 3.0);
-    let inset = lw / 2.0 + 0.5;
-    if sign_here {
-        // A tag pointing left, filled, with white text.
-        let tip = h * 0.45;
-        c.push_str(&format!(
-            "{}{}{} w 1 j\n{} {} m {} {} l {} {} l {} {} l {} {} l h B\n",
-            rg(col),
-            rg_stroke(col),
-            n(lw),
-            n(x0 + inset),
-            n(y0 + h / 2.0),
-            n(x0 + tip),
-            n(y1 - inset),
-            n(x1 - inset),
-            n(y1 - inset),
-            n(x1 - inset),
-            n(y0 + inset),
-            n(x0 + tip),
-            n(y0 + inset)
-        ));
-    } else {
-        // A rounded frame with a light tint.
-        let r = (h * 0.2).min(8.0);
-        let k = 0.552_284_75 * r;
-        let (a0, b0, a1, b1) = (x0 + inset, y0 + inset, x1 - inset, y1 - inset);
-        let tint = col.map(|v| 1.0 - (1.0 - v) * 0.12);
-        c.push_str(&format!(
-            "{}{}{} w\n{} {} m {} {} l {} {} {} {} {} {} c {} {} l {} {} {} {} {} {} c {} {} l {} {} {} {} {} {} c {} {} l {} {} {} {} {} {} c h B\n",
-            rg(tint),
-            rg_stroke(col),
-            n(lw),
-            n(a0 + r),
-            n(b0),
-            n(a1 - r),
-            n(b0),
-            n(a1 - r + k),
-            n(b0),
-            n(a1),
-            n(b0 + r - k),
-            n(a1),
-            n(b0 + r),
-            n(a1),
-            n(b1 - r),
-            n(a1),
-            n(b1 - r + k),
-            n(a1 - r + k),
-            n(b1),
-            n(a1 - r),
-            n(b1),
-            n(a0 + r),
-            n(b1),
-            n(a0 + r - k),
-            n(b1),
-            n(a0),
-            n(b1 - r + k),
-            n(a0),
-            n(b1 - r),
-            n(a0),
-            n(b0 + r),
-            n(a0),
-            n(b0 + r - k),
-            n(a0 + r - k),
-            n(b0),
-            n(a0 + r),
-            n(b0)
-        ));
-    }
-    let (title_h, by_h) = if by.is_some() { (h * 0.5, h * 0.22) } else { (h * 0.52, 0.0) };
-    let text_area = if sign_here { (x0 + h * 0.45, x1 - lw * 2.0) } else { (x0 + lw * 2.0, x1 - lw * 2.0) };
-    let mut size = title_h;
-    let tw = text_width(label, size) * 1.12;
-    if tw > text_area.1 - text_area.0 - 4.0 {
-        size *= (text_area.1 - text_area.0 - 4.0) / tw;
-    }
-    let tw = text_width(label, size) * 1.12;
-    let text_col = if sign_here { [1.0, 1.0, 1.0] } else { col };
-    let ty = if by.is_some() { y0 + h * 0.48 } else { y0 + (h - size * 0.72) / 2.0 };
-    let mut out = c.into_bytes();
-    out.extend(
-        format!("BT\n{}/HelvB {} Tf\n1 0 0 1 {} {} Tm ", rg(text_col), n(size), n(text_area.0 + (text_area.1 - text_area.0 - tw) / 2.0), n(ty))
-            .bytes(),
-    );
-    out.extend(literal(&win_ansi(label)));
-    out.extend_from_slice(b" Tj\n");
-    if let Some(b) = by {
-        let mut s = by_h;
-        let bw = text_width(b, s);
-        if bw > text_area.1 - text_area.0 - 4.0 {
-            s *= (text_area.1 - text_area.0 - 4.0) / bw;
-        }
-        let bw = text_width(b, s);
-        out.extend(
-            format!("/Helv {} Tf\n1 0 0 1 {} {} Tm ", n(s), n(text_area.0 + (text_area.1 - text_area.0 - bw) / 2.0), n(y0 + h * 0.18)).bytes(),
-        );
-        out.extend(literal(&win_ansi(b)));
-        out.extend_from_slice(b" Tj\n");
-    }
-    out.extend_from_slice(b"ET\n");
-    let font = |base: &str| {
-        let mut f = Dict::new();
-        f.set(b"Type".to_vec(), Object::name("Font"));
-        f.set(b"Subtype".to_vec(), Object::name("Type1"));
-        f.set(b"BaseFont".to_vec(), Object::name(base));
-        f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-        Object::Dict(f)
-    };
-    let mut fonts = Dict::new();
-    fonts.set(b"HelvB".to_vec(), font("Helvetica-Bold"));
-    fonts.set(b"Helv".to_vec(), font("Helvetica"));
-    res.set(b"Font".to_vec(), Object::Dict(fonts));
-    form(rect, &out, res)
-}
-
-/// An ellipse inscribed in a rectangle, as four Bézier arcs.
-fn ellipse(x0: f64, y0: f64, x1: f64, y1: f64) -> String {
-    let k = 0.552_284_75;
-    let (cx, cy, rx, ry) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0, (x1 - x0) / 2.0, (y1 - y0) / 2.0);
-    let (ox, oy) = (rx * k, ry * k);
-    let mut s = format!("{} {} m\n", n(cx + rx), n(cy));
-    for [a, b, c, d, e, f] in [
-        [cx + rx, cy + oy, cx + ox, cy + ry, cx, cy + ry],
-        [cx - ox, cy + ry, cx - rx, cy + oy, cx - rx, cy],
-        [cx - rx, cy - oy, cx - ox, cy - ry, cx, cy - ry],
-        [cx + ox, cy - ry, cx + rx, cy - oy, cx + rx, cy],
-    ] {
-        s.push_str(&format!("{} {} {} {} {} {} c\n", n(a), n(b), n(c), n(d), n(e), n(f)));
-    }
-    s.push_str("h\n");
-    s
-}
-
-/// PdfCraft's note icons, drawn in a 20 × 20 box: a speech bubble for `/Comment`, a page
-/// with a folded corner for everything else, both filled with the note colour.
-/// File attachment icons in a 20 × 20 box: PdfCraft's own drawings.
-fn attach_icon(name: &str, col: Rgb) -> String {
-    let mut s = format!("{}{}1.2 w 1 j 1 J\n", rg(col), rg_stroke(col));
-    match name {
-        "Paperclip" => s.push_str("8 4 m 8 15 l 8 18 13 18 13 15 c 13 6 l 13 3 10 3 10 6 c 10 14 l S\n"),
-        "Graph" => s.push_str("3 3 m 3 17 l 3 3 m 17 3 l S\n5 3 3 6 re 9 3 3 10 re 13 3 3 13 re f\n"),
-        "Tag" => s.push_str("3 10 m 8 15 l 17 15 l 17 5 l 8 5 l h S\n7.3 10 m 7.3 10.7 6.7 11.3 6 11.3 c 5.3 11.3 4.7 10.7 4.7 10 c 4.7 9.3 5.3 8.7 6 8.7 c 6.7 8.7 7.3 9.3 7.3 10 c f\n"),
-        _ => {
-            // Push pin: a round head on a short needle.
-            s.push_str("10 2 m 10 9 l S\n6 9 m 14 9 l 14 11 l 12 12 l 12 16 l 13.5 17 l 13.5 18.5 l 6.5 18.5 l 6.5 17 l 8 16 l 8 12 l 6 11 l h f\n");
-        }
-    }
-    s
-}
-
-/// A closed circle path (four Bézier quarters) centred on (`x`, `y`).
-fn circle_path(x: f64, y: f64, r: f64) -> String {
-    let k = r * 0.5523;
-    let p = |v: f64| n(v);
-    format!(
-        "{} {} m {} {} {} {} {} {} c {} {} {} {} {} {} c {} {} {} {} {} {} c {} {} {} {} {} {} c h\n",
-        p(x + r),
-        p(y),
-        p(x + r),
-        p(y + k),
-        p(x + k),
-        p(y + r),
-        p(x),
-        p(y + r),
-        p(x - k),
-        p(y + r),
-        p(x - r),
-        p(y + k),
-        p(x - r),
-        p(y),
-        p(x - r),
-        p(y - k),
-        p(x - k),
-        p(y - r),
-        p(x),
-        p(y - r),
-        p(x + k),
-        p(y - r),
-        p(x + r),
-        p(y - k),
-        p(x + r),
-        p(y)
-    )
-}
-
-/// A note's icon in a 20 × 20 box: filled in `col`, outlined in dark grey. Each name of
-/// [`crate::NoteIcon`] has its own shape, so the icon a note names is the one it shows (ISO
-/// 32000-2 §12.5.6.4, Table 175); a name PdfCraft doesn't know draws as `Note`.
-fn note_icon(name: &str, col: Rgb) -> String {
-    let mut s = format!("{}0.25 0.25 0.25 RG 0.8 w 1 j 1 J\n", rg(col));
-    match name {
-        "Comment" => {
-            s.push_str("3 18.5 m 17 18.5 l 18.5 18.5 18.5 17 18.5 17 c 18.5 8 l 18.5 6.5 17 6.5 17 6.5 c 9.5 6.5 l 5 2 l 5.5 6.5 l 3 6.5 l 1.5 6.5 1.5 8 1.5 8 c 1.5 17 l 1.5 18.5 3 18.5 3 18.5 c h B\n");
-            s.push_str("4.5 15 m 15.5 15 l 4.5 12.5 m 15.5 12.5 l 4.5 10 m 11.5 10 l S\n");
-        }
-        // A key lying flat: a round bow with a hole, a shaft and two bits.
-        "Key" => {
-            s.push_str(&circle_path(5.5, 10.0, 4.5));
-            s.push_str(&circle_path(5.0, 10.0, 1.5));
-            s.push_str(
-                "9.5 11.2 m 18.5 11.2 l 18.5 8.8 l 17 8.8 l 17 6 l 15 6 l 15 8.8 l 13.5 8.8 l 13.5 6.8 l 11.5 6.8 l 11.5 8.8 l 9.5 8.8 l h B*\n",
-            );
-        }
-        // A disc with a question mark.
-        "Help" => {
-            s.push_str(&circle_path(10.0, 10.0, 8.5));
-            s.push_str("B\n1.6 w 7 12.8 m 7 15.6 13 15.6 13 12.8 c 13 10.6 10 10.8 10 8.2 c S\n10 5 m 10 5.1 l S\n");
-        }
-        // An insertion caret.
-        "Insert" => s.push_str("1.5 3 m 10 18 l 18.5 3 l 14.5 3 l 10 11 l 5.5 3 l h B\n"),
-        // A caret over a bar: a new paragraph goes here.
-        "NewParagraph" => s.push_str("3.5 9 m 10 18.5 l 16.5 9 l h B\n3 2 14 4 re B\n"),
-        // A pilcrow: a filled bowl and two stems.
-        "Paragraph" => {
-            s.push_str("11 18.5 m 7 18.5 4 16.3 4 13.2 c 4 10.1 7 8 11 8 c h B\n");
-            s.push_str("11 18.5 m 16 18.5 l 16 1.5 l 14 1.5 l 14 16.5 l 13 16.5 l 13 1.5 l 11 1.5 l h B\n");
-        }
-        // A tick.
-        "Check" => s.push_str("1.5 10.5 m 4.5 13.5 l 8 9.5 l 16 18.5 l 18.5 15.5 l 8 3.5 l h B\n"),
-        // A ring.
-        "Circle" => {
-            s.push_str(&circle_path(10.0, 10.0, 8.5));
-            s.push_str(&circle_path(10.0, 10.0, 5.0));
-            s.push_str("B*\n");
-        }
-        // A thick X.
-        "Cross" => s.push_str("4 1.5 m 10 7.5 l 16 1.5 l 18.5 4 l 12.5 10 l 18.5 16 l 16 18.5 l 10 12.5 l 4 18.5 l 1.5 16 l 7.5 10 l 1.5 4 l h B\n"),
-        // A ring with sighting lines through it.
-        "CrossHairs" => {
-            s.push_str(&circle_path(10.0, 10.0, 7.0));
-            s.push_str(&circle_path(10.0, 10.0, 4.5));
-            s.push_str("B*\n1.2 w 10 0.5 m 10 19.5 l 0.5 10 m 19.5 10 l S\n");
-        }
-        // A five-pointed star.
-        "Star" => {
-            let points: Vec<String> = (0..10)
-                .map(|i| {
-                    let r = if i % 2 == 0 { 9.5 } else { 3.9 };
-                    let a = std::f64::consts::FRAC_PI_2 + f64::from(i) * std::f64::consts::PI / 5.0;
-                    format!("{} {}", n(10.0 + r * a.cos()), n(9.5 + r * a.sin()))
-                })
-                .collect();
-            s.push_str(&format!("{} m {} l h B\n", points[0], points[1..].join(" l ")));
-        }
-        // Block arrows.
-        "RightArrow" => s.push_str("1.5 7 m 11 7 l 11 2.5 l 18.5 10 l 11 17.5 l 11 13 l 1.5 13 l h B\n"),
-        "UpArrow" => s.push_str("7 1.5 m 7 11 l 2.5 11 l 10 18.5 l 17.5 11 l 13 11 l 13 1.5 l h B\n"),
-        _ => {
-            s.push_str("3 19 m 13 19 l 17 15 l 17 1 l 3 1 l h B\n13 19 m 13 15 l 17 15 l S\n");
-            s.push_str("5.5 12 m 14.5 12 l 5.5 9 m 14.5 9 l 5.5 6 m 11.5 6 l S\n");
-        }
-    }
-    s
-}
diff --git a/crates/annot/src/appearance/symbols.rs b/crates/annot/src/appearance/symbols.rs
new file mode 100644
index 0000000000..d49224cd9f
--- /dev/null
+++ b/crates/annot/src/appearance/symbols.rs
@@ -0,0 +1,534 @@
+use super::*;
+
+/// The label and colour of a standard rubber stamp name (ISO 32000-2 Table 184), for a stamp
+/// another program wrote without an appearance. Names are matched byte for byte, as PDF names
+/// are compared (§7.3.5). Eight are stamps of PdfCraft's palette; the other six take a label of
+/// their own and the palette's colour for their meaning.
+fn standard_stamp(name: &[u8]) -> Option<(&'static str, Rgb)> {
+    use crate::StampKind::*;
+    let palette = [Approved, NotApproved, NotForPublicRelease, Confidential, Final, ForComment, Draft, ForPublicRelease];
+    if let Some(kind) = palette.into_iter().find(|k| k.name().as_bytes() == name) {
+        return Some((kind.label(), kind.color()));
+    }
+    let (label, like) = match name {
+        b"Experimental" => ("EXPERIMENTAL", Draft),
+        b"AsIs" => ("AS IS", Draft),
+        b"Expired" => ("EXPIRED", NotApproved),
+        b"Sold" => ("SOLD", Approved),
+        b"Departmental" => ("DEPARTMENTAL", Draft),
+        b"TopSecret" => ("TOP SECRET", Confidential),
+        _ => return None,
+    };
+    Some((label, like.color()))
+}
+
+/// The neutral grey of a stamp whose name has no drawing.
+const PLACEHOLDER_GREY: Rgb = [0.45, 0.45, 0.45];
+
+/// The display appearance of a rubber stamp another program wrote without one: the stamp its
+/// `/Name` names (Draft when there is none, Table 184's default) in its `/C` colour or the
+/// stamp's own, or for any other name a thin grey frame with both diagonals, so the stamp stays
+/// visible and can be selected. The frame is grey whatever the `/C`: it stands in for a stamp
+/// that cannot be drawn, so it takes none of that stamp's colour. The name is never drawn as text.
+///
+/// For display only ([`crate::with_missing_appearances`]): [`build`] declines these stamps, so
+/// edits (restyling, flattening) never write this drawing into the file. `None` for any other
+/// annotation, one of PdfCraft's own stamps, a dictionary with an `/AP` (a stamp's own artwork is
+/// never replaced; the display copy passes the dictionary without an `/AP` that has no normal
+/// appearance), or a `/Rect` that isn't finite or is under a point wide or high.
+pub(crate) fn display_stamp(d: &Dict) -> Option<Stream> {
+    let own = matches!(d.get(b"PCStamp"), Some(Object::Bool(true))) || d.contains(b"PCPicture") || d.contains(b"PCOutline");
+    if d.name(b"Subtype") != Some(b"Stamp") || own || d.contains(b"AP") {
+        return None;
+    }
+    let rect = nums(d, b"Rect")?;
+    let [a, b, c, e] = rect.as_slice() else { return None };
+    let rect = [a.min(*c), b.min(*e), a.max(*c), b.max(*e)];
+    if !rect.iter().all(|v| v.is_finite()) || rect[2] - rect[0] < 1.0 || rect[3] - rect[1] < 1.0 {
+        return None;
+    }
+    let opacity = d.get(b"CA").and_then(|o| o.as_f64()).unwrap_or(1.0).clamp(0.0, 1.0);
+    // A malformed `/C` falls back to the stamp's own colour rather than hiding the stamp.
+    let stroke = color(d, b"C").flatten();
+    let mut res = Dict::new();
+    if let Some(gs) = ext_gstate(opacity, false) {
+        res.set(b"ExtGState".to_vec(), Object::Dict(gs));
+    }
+    // A stamp whose intent (`/IT`, PDF 2.0) is an image or a snapshot has no `/Name` to default.
+    let stamp_intent = d.name(b"IT").is_none_or(|it| it == b"Stamp");
+    let name = d.name(b"Name").or(stamp_intent.then_some(b"Draft".as_slice()));
+    if let Some((label, col)) = name.and_then(standard_stamp) {
+        return Some(stamp(label, false, rect, stroke.unwrap_or(col), None, opacity, res));
+    }
+    let [x0, y0, x1, y1] = rect;
+    let (a0, b0, a1, b1) = (x0 + 0.5, y0 + 0.5, x1 - 0.5, y1 - 0.5);
+    let mut c = String::new();
+    if opacity < 1.0 {
+        c.push_str("/GS0 gs\n");
+    }
+    c.push_str(&format!(
+        "{}1 w\n{} {} {} {} re\n{} {} m {} {} l\n{} {} m {} {} l\nS\n",
+        // Grey whatever the `/C`: the placeholder is not the stamp, so it takes none of its colour.
+        rg_stroke(PLACEHOLDER_GREY),
+        n(a0),
+        n(b0),
+        n(a1 - a0),
+        n(b1 - b0),
+        n(a0),
+        n(b0),
+        n(a1),
+        n(b1),
+        n(a0),
+        n(b1),
+        n(a1),
+        n(b0)
+    ));
+    Some(form(rect, c.as_bytes(), res))
+}
+
+/// Size of a line's caption, as of a measurement's label.
+pub(super) const CAPTION_SIZE: f64 = 10.0;
+
+/// Characters of a line's caption drawn at most, as for a measurement's label.
+const MAX_CAPTION_CHARS: usize = 256;
+
+/// Leader lengths and caption offsets (Table 178) are held within this many points (200 inches,
+/// the largest page side ISO 32000-2 Annex C allows), so an absurd value can't overflow.
+const MAX_LINE_EXTENT: f64 = 14_400.0;
+
+/// A Table 178 length or offset: finite and within [`MAX_LINE_EXTENT`], 0 when absent or not one.
+fn line_length(v: Option<f64>) -> f64 {
+    v.filter(|v| v.is_finite()).map_or(0.0, |v| v.clamp(-MAX_LINE_EXTENT, MAX_LINE_EXTENT))
+}
+
+/// The caption a Line with `/Cap true` shows (ISO 32000-2 Table 178): its `/Contents`, else the
+/// plain text of its `/RC`, on one line and cut to [`MAX_CAPTION_CHARS`]. `None` without a
+/// caption, and for PdfCraft's own measurements, whose label (`/PCMeasureValue`) is the caption.
+pub(super) fn line_caption(d: &Dict) -> Option<String> {
+    if !matches!(d.get(b"Cap"), Some(Object::Bool(true))) || d.contains(b"PCMeasureValue") {
+        return None;
+    }
+    let text = |key: &[u8]| d.get(key).and_then(Object::as_string).map(PdfString::to_text);
+    let raw = text(b"Contents").filter(|t| !t.trim().is_empty()).or_else(|| text(b"RC").map(|rc| rich_plain(&rc)))?;
+    let words: Vec<&str> = raw.split_whitespace().collect();
+    let caption: String = words.join(" ").chars().filter(|c| !c.is_control()).take(MAX_CAPTION_CHARS).collect();
+    (!caption.is_empty()).then_some(caption)
+}
+
+/// The text of rich text (§12.7.4.3, XHTML): its markup dropped, the five XML entities and
+/// numeric character references read, block ends read as spaces.
+fn rich_plain(rc: &str) -> String {
+    let mut out = String::new();
+    let mut tag: Option<String> = None;
+    // Rich text past this is not caption material; it bounds the work.
+    for ch in rc.chars().take(MAX_CAPTION_CHARS * 64) {
+        match (&mut tag, ch) {
+            (None, '<') => tag = Some(String::new()),
+            (Some(name), '>') => {
+                let name =
+                    name.trim_start_matches('/').split(|c: char| c.is_whitespace() || c == '/').next().unwrap_or_default().to_ascii_lowercase();
+                if matches!(name.as_str(), "p" | "br" | "div" | "li") {
+                    out.push(' ');
+                }
+                tag = None;
+            }
+            (Some(name), c) => {
+                if name.len() < 16 {
+                    name.push(c);
+                }
+            }
+            (None, c) => out.push(c),
+        }
+    }
+    let mut text = String::new();
+    let mut rest = out.as_str();
+    while let Some(at) = rest.find('&') {
+        text.push_str(rest.get(..at).unwrap_or_default());
+        let after = rest.get(at + 1..).unwrap_or_default();
+        let entity = after.find(';').filter(|&end| end <= 10).and_then(|end| Some((after.get(..end)?, end)));
+        let decoded = entity.and_then(|(name, end)| {
+            let c = match name {
+                "amp" => '&',
+                "lt" => '<',
+                "gt" => '>',
+                "quot" => '"',
+                "apos" => '\'',
+                _ => {
+                    let num = name.strip_prefix('#')?;
+                    let code = match num.strip_prefix(['x', 'X']) {
+                        Some(hex) => u32::from_str_radix(hex, 16).ok()?,
+                        None => num.parse().ok()?,
+                    };
+                    char::from_u32(code)?
+                }
+            };
+            Some((c, end))
+        });
+        match decoded {
+            Some((c, end)) => {
+                text.push(c);
+                rest = after.get(end + 1..).unwrap_or_default();
+            }
+            None => {
+                text.push('&');
+                rest = after;
+            }
+        }
+    }
+    text.push_str(rest);
+    text
+}
+
+/// Where a Line annotation's parts go (ISO 32000-2 §12.5.6.7, Table 178).
+#[derive(Debug, Default)]
+pub(super) struct LineLayout {
+    /// The line itself, start to end: `/L`, or `/L` moved out by its leader lines.
+    pub(super) line: [(f64, f64); 2],
+    /// Strokes along the line: the whole line, or the two pieces either side of an inline caption.
+    pub(super) strokes: Vec<[(f64, f64); 2]>,
+    /// The leader lines, from `/L` (past the `/LLO` gap) to the line and on by `/LLE`.
+    pub(super) leaders: Vec<[(f64, f64); 2]>,
+    /// A short stroke from the line to a caption `/CO` moved off it.
+    pub(super) tick: Option<[(f64, f64); 2]>,
+    /// The caption and its text matrix.
+    pub(super) caption: Option<(String, [f64; 6])>,
+}
+
+/// Lay out a Line annotation from `/L` = `[a b]`, line width `w`, and its leader and caption
+/// entries.
+///
+/// Leader lines: a positive `/LL` puts the line on the left of travel from `a` to `b` (above `/L`
+/// for a line drawn left to right), so the leader lines, followed from the line to `/L`, turn
+/// clockwise from the direction of travel; a negative one puts it on the right. The line sits
+/// `|LL| + LLO` from `/L`. `/LLE` and `/LLO` are non-negative: a negative one counts as 0.
+///
+/// Caption (`/Cap true`): centred on the line's midpoint and turned with it so it reads left to
+/// right (bottom to top for a vertical line). `/CP /Inline` (the default) centres it on the line,
+/// which is broken around it; `/Top` sets it on top of the unbroken line. `/CO [h v]` moves it `h`
+/// along the line and `v` across it (positive: up in reading direction); a caption moved off an
+/// inline line gets a tick from the line to it.
+///
+/// A zero-length or overflowing `/L` has no direction: it gets neither leader lines nor caption.
+/// Every point is finite; if anything derived from the entries is not, they are left out.
+pub(super) fn line_layout(d: &Dict, [a, b]: [(f64, f64); 2], w: f64) -> LineLayout {
+    let plain = LineLayout { line: [a, b], strokes: vec![[a, b]], ..LineLayout::default() };
+    let (dx, dy) = (b.0 - a.0, b.1 - a.1);
+    let len = dx.hypot(dy);
+    if !len.is_finite() || len <= 0.0 {
+        return plain;
+    }
+    let (ux, uy) = (dx / len, dy / len);
+    let mut out = LineLayout { line: [a, b], ..LineLayout::default() };
+    let ll = line_length(d.get(b"LL").and_then(Object::as_f64));
+    if ll != 0.0 {
+        // The unit normal from `/L` towards the line: left of travel for a positive /LL.
+        let s = ll.signum();
+        let (nx, ny) = (-uy * s, ux * s);
+        let llo = line_length(d.get(b"LLO").and_then(Object::as_f64)).max(0.0);
+        let lle = line_length(d.get(b"LLE").and_then(Object::as_f64)).max(0.0);
+        let at = |p: (f64, f64), k: f64| (p.0 + nx * k, p.1 + ny * k);
+        let off = ll.abs() + llo;
+        out.line = [at(a, off), at(b, off)];
+        out.leaders = vec![[at(a, llo), at(a, off + lle)], [at(b, llo), at(b, off + lle)]];
+    }
+    let [p, _] = out.line;
+    let along = |t: f64| (p.0 + ux * t, p.1 + uy * t);
+    let mut gap = None;
+    if let Some(text) = line_caption(d) {
+        let size = CAPTION_SIZE;
+        let width = text_width(&text, size);
+        // Reading direction, and "up" across it.
+        let (tx, ty) = if ux < 0.0 || (ux == 0.0 && uy < 0.0) { (-ux, -uy) } else { (ux, uy) };
+        let (vx, vy) = (-ty, tx);
+        let co = nums(d, b"CO").filter(|c| c.len() == 2).unwrap_or_default();
+        let h = line_length(co.first().copied());
+        let v = line_length(co.get(1).copied());
+        let top = d.name(b"CP") == Some(b"Top");
+        // The caption's centre, as a distance along the line from `p`.
+        let centre = len / 2.0 + h * (tx * ux + ty * uy);
+        let mid = along(centre);
+        // Baseline across the line: on top of it, or with the text centred on it.
+        let base = if top { w.max(0.0) / 2.0 + 2.0 + v } else { v - size * 0.35 };
+        let origin = (mid.0 - tx * width / 2.0 + vx * base, mid.1 - ty * width / 2.0 + vy * base);
+        out.caption = Some((text, [tx, ty, -ty, tx, origin.0, origin.1]));
+        if !top && v.abs() < size / 2.0 {
+            let half = width / 2.0 + 2.0;
+            gap = Some(((centre - half).clamp(0.0, len), (centre + half).clamp(0.0, len)));
+        } else if !top {
+            let reach = v - v.signum() * size * 0.4;
+            out.tick = Some([mid, (mid.0 + vx * reach, mid.1 + vy * reach)]);
+        }
+    }
+    out.strokes = match gap {
+        Some((g0, g1)) => [(0.0, g0), (g1, len)].into_iter().filter(|(s, e)| e > s).map(|(s, e)| [along(s), along(e)]).collect(),
+        None => vec![out.line],
+    };
+    let finite = |q: &(f64, f64)| q.0.is_finite() && q.1.is_finite();
+    let all_finite =
+        out.line.iter().chain(out.strokes.iter().flatten()).chain(out.leaders.iter().flatten()).chain(out.tick.iter().flatten()).all(finite)
+            && out.caption.as_ref().is_none_or(|(_, m)| m.iter().all(|x| x.is_finite()));
+    if all_finite { out } else { plain }
+}
+
+/// A rubber stamp: a rounded frame (a pointed tag for sign-here stamps) with the label in bold
+/// capitals, and the dynamic stamps' "By … at …" line.
+pub(super) fn stamp(label: &str, sign_here: bool, rect: [f64; 4], col: Rgb, by: Option<&str>, opacity: f64, mut res: Dict) -> Stream {
+    let [x0, y0, x1, y1] = rect;
+    let h = y1 - y0;
+    let mut c = String::new();
+    if opacity < 1.0 {
+        c.push_str("/GS0 gs\n");
+    }
+    let lw = (h * 0.07).clamp(1.0, 3.0);
+    let inset = lw / 2.0 + 0.5;
+    if sign_here {
+        // A tag pointing left, filled, with white text.
+        let tip = h * 0.45;
+        c.push_str(&format!(
+            "{}{}{} w 1 j\n{} {} m {} {} l {} {} l {} {} l {} {} l h B\n",
+            rg(col),
+            rg_stroke(col),
+            n(lw),
+            n(x0 + inset),
+            n(y0 + h / 2.0),
+            n(x0 + tip),
+            n(y1 - inset),
+            n(x1 - inset),
+            n(y1 - inset),
+            n(x1 - inset),
+            n(y0 + inset),
+            n(x0 + tip),
+            n(y0 + inset)
+        ));
+    } else {
+        // A rounded frame with a light tint.
+        let r = (h * 0.2).min(8.0);
+        let k = 0.552_284_75 * r;
+        let (a0, b0, a1, b1) = (x0 + inset, y0 + inset, x1 - inset, y1 - inset);
+        let tint = col.map(|v| 1.0 - (1.0 - v) * 0.12);
+        c.push_str(&format!(
+            "{}{}{} w\n{} {} m {} {} l {} {} {} {} {} {} c {} {} l {} {} {} {} {} {} c {} {} l {} {} {} {} {} {} c {} {} l {} {} {} {} {} {} c h B\n",
+            rg(tint),
+            rg_stroke(col),
+            n(lw),
+            n(a0 + r),
+            n(b0),
+            n(a1 - r),
+            n(b0),
+            n(a1 - r + k),
+            n(b0),
+            n(a1),
+            n(b0 + r - k),
+            n(a1),
+            n(b0 + r),
+            n(a1),
+            n(b1 - r),
+            n(a1),
+            n(b1 - r + k),
+            n(a1 - r + k),
+            n(b1),
+            n(a1 - r),
+            n(b1),
+            n(a0 + r),
+            n(b1),
+            n(a0 + r - k),
+            n(b1),
+            n(a0),
+            n(b1 - r + k),
+            n(a0),
+            n(b1 - r),
+            n(a0),
+            n(b0 + r),
+            n(a0),
+            n(b0 + r - k),
+            n(a0 + r - k),
+            n(b0),
+            n(a0 + r),
+            n(b0)
+        ));
+    }
+    let (title_h, by_h) = if by.is_some() { (h * 0.5, h * 0.22) } else { (h * 0.52, 0.0) };
+    let text_area = if sign_here { (x0 + h * 0.45, x1 - lw * 2.0) } else { (x0 + lw * 2.0, x1 - lw * 2.0) };
+    let mut size = title_h;
+    let tw = text_width(label, size) * 1.12;
+    if tw > text_area.1 - text_area.0 - 4.0 {
+        size *= (text_area.1 - text_area.0 - 4.0) / tw;
+    }
+    let tw = text_width(label, size) * 1.12;
+    let text_col = if sign_here { [1.0, 1.0, 1.0] } else { col };
+    let ty = if by.is_some() { y0 + h * 0.48 } else { y0 + (h - size * 0.72) / 2.0 };
+    let mut out = c.into_bytes();
+    out.extend(
+        format!("BT\n{}/HelvB {} Tf\n1 0 0 1 {} {} Tm ", rg(text_col), n(size), n(text_area.0 + (text_area.1 - text_area.0 - tw) / 2.0), n(ty))
+            .bytes(),
+    );
+    out.extend(literal(&win_ansi(label)));
+    out.extend_from_slice(b" Tj\n");
+    if let Some(b) = by {
+        let mut s = by_h;
+        let bw = text_width(b, s);
+        if bw > text_area.1 - text_area.0 - 4.0 {
+            s *= (text_area.1 - text_area.0 - 4.0) / bw;
+        }
+        let bw = text_width(b, s);
+        out.extend(
+            format!("/Helv {} Tf\n1 0 0 1 {} {} Tm ", n(s), n(text_area.0 + (text_area.1 - text_area.0 - bw) / 2.0), n(y0 + h * 0.18)).bytes(),
+        );
+        out.extend(literal(&win_ansi(b)));
+        out.extend_from_slice(b" Tj\n");
+    }
+    out.extend_from_slice(b"ET\n");
+    let font = |base: &str| {
+        let mut f = Dict::new();
+        f.set(b"Type".to_vec(), Object::name("Font"));
+        f.set(b"Subtype".to_vec(), Object::name("Type1"));
+        f.set(b"BaseFont".to_vec(), Object::name(base));
+        f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+        Object::Dict(f)
+    };
+    let mut fonts = Dict::new();
+    fonts.set(b"HelvB".to_vec(), font("Helvetica-Bold"));
+    fonts.set(b"Helv".to_vec(), font("Helvetica"));
+    res.set(b"Font".to_vec(), Object::Dict(fonts));
+    form(rect, &out, res)
+}
+
+/// An ellipse inscribed in a rectangle, as four Bézier arcs.
+pub(super) fn ellipse(x0: f64, y0: f64, x1: f64, y1: f64) -> String {
+    let k = 0.552_284_75;
+    let (cx, cy, rx, ry) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0, (x1 - x0) / 2.0, (y1 - y0) / 2.0);
+    let (ox, oy) = (rx * k, ry * k);
+    let mut s = format!("{} {} m\n", n(cx + rx), n(cy));
+    for [a, b, c, d, e, f] in [
+        [cx + rx, cy + oy, cx + ox, cy + ry, cx, cy + ry],
+        [cx - ox, cy + ry, cx - rx, cy + oy, cx - rx, cy],
+        [cx - rx, cy - oy, cx - ox, cy - ry, cx, cy - ry],
+        [cx + ox, cy - ry, cx + rx, cy - oy, cx + rx, cy],
+    ] {
+        s.push_str(&format!("{} {} {} {} {} {} c\n", n(a), n(b), n(c), n(d), n(e), n(f)));
+    }
+    s.push_str("h\n");
+    s
+}
+
+/// PdfCraft's note icons, drawn in a 20 × 20 box: a speech bubble for `/Comment`, a page
+/// with a folded corner for everything else, both filled with the note colour.
+/// File attachment icons in a 20 × 20 box: PdfCraft's own drawings.
+pub(super) fn attach_icon(name: &str, col: Rgb) -> String {
+    let mut s = format!("{}{}1.2 w 1 j 1 J\n", rg(col), rg_stroke(col));
+    match name {
+        "Paperclip" => s.push_str("8 4 m 8 15 l 8 18 13 18 13 15 c 13 6 l 13 3 10 3 10 6 c 10 14 l S\n"),
+        "Graph" => s.push_str("3 3 m 3 17 l 3 3 m 17 3 l S\n5 3 3 6 re 9 3 3 10 re 13 3 3 13 re f\n"),
+        "Tag" => s.push_str("3 10 m 8 15 l 17 15 l 17 5 l 8 5 l h S\n7.3 10 m 7.3 10.7 6.7 11.3 6 11.3 c 5.3 11.3 4.7 10.7 4.7 10 c 4.7 9.3 5.3 8.7 6 8.7 c 6.7 8.7 7.3 9.3 7.3 10 c f\n"),
+        _ => {
+            // Push pin: a round head on a short needle.
+            s.push_str("10 2 m 10 9 l S\n6 9 m 14 9 l 14 11 l 12 12 l 12 16 l 13.5 17 l 13.5 18.5 l 6.5 18.5 l 6.5 17 l 8 16 l 8 12 l 6 11 l h f\n");
+        }
+    }
+    s
+}
+
+/// A closed circle path (four Bézier quarters) centred on (`x`, `y`).
+fn circle_path(x: f64, y: f64, r: f64) -> String {
+    let k = r * 0.5523;
+    let p = |v: f64| n(v);
+    format!(
+        "{} {} m {} {} {} {} {} {} c {} {} {} {} {} {} c {} {} {} {} {} {} c {} {} {} {} {} {} c h\n",
+        p(x + r),
+        p(y),
+        p(x + r),
+        p(y + k),
+        p(x + k),
+        p(y + r),
+        p(x),
+        p(y + r),
+        p(x - k),
+        p(y + r),
+        p(x - r),
+        p(y + k),
+        p(x - r),
+        p(y),
+        p(x - r),
+        p(y - k),
+        p(x - k),
+        p(y - r),
+        p(x),
+        p(y - r),
+        p(x + k),
+        p(y - r),
+        p(x + r),
+        p(y - k),
+        p(x + r),
+        p(y)
+    )
+}
+
+/// A note's icon in a 20 × 20 box: filled in `col`, outlined in dark grey. Each name of
+/// [`crate::NoteIcon`] has its own shape, so the icon a note names is the one it shows (ISO
+/// 32000-2 §12.5.6.4, Table 175); a name PdfCraft doesn't know draws as `Note`.
+pub(super) fn note_icon(name: &str, col: Rgb) -> String {
+    let mut s = format!("{}0.25 0.25 0.25 RG 0.8 w 1 j 1 J\n", rg(col));
+    match name {
+        "Comment" => {
+            s.push_str("3 18.5 m 17 18.5 l 18.5 18.5 18.5 17 18.5 17 c 18.5 8 l 18.5 6.5 17 6.5 17 6.5 c 9.5 6.5 l 5 2 l 5.5 6.5 l 3 6.5 l 1.5 6.5 1.5 8 1.5 8 c 1.5 17 l 1.5 18.5 3 18.5 3 18.5 c h B\n");
+            s.push_str("4.5 15 m 15.5 15 l 4.5 12.5 m 15.5 12.5 l 4.5 10 m 11.5 10 l S\n");
+        }
+        // A key lying flat: a round bow with a hole, a shaft and two bits.
+        "Key" => {
+            s.push_str(&circle_path(5.5, 10.0, 4.5));
+            s.push_str(&circle_path(5.0, 10.0, 1.5));
+            s.push_str(
+                "9.5 11.2 m 18.5 11.2 l 18.5 8.8 l 17 8.8 l 17 6 l 15 6 l 15 8.8 l 13.5 8.8 l 13.5 6.8 l 11.5 6.8 l 11.5 8.8 l 9.5 8.8 l h B*\n",
+            );
+        }
+        // A disc with a question mark.
+        "Help" => {
+            s.push_str(&circle_path(10.0, 10.0, 8.5));
+            s.push_str("B\n1.6 w 7 12.8 m 7 15.6 13 15.6 13 12.8 c 13 10.6 10 10.8 10 8.2 c S\n10 5 m 10 5.1 l S\n");
+        }
+        // An insertion caret.
+        "Insert" => s.push_str("1.5 3 m 10 18 l 18.5 3 l 14.5 3 l 10 11 l 5.5 3 l h B\n"),
+        // A caret over a bar: a new paragraph goes here.
+        "NewParagraph" => s.push_str("3.5 9 m 10 18.5 l 16.5 9 l h B\n3 2 14 4 re B\n"),
+        // A pilcrow: a filled bowl and two stems.
+        "Paragraph" => {
+            s.push_str("11 18.5 m 7 18.5 4 16.3 4 13.2 c 4 10.1 7 8 11 8 c h B\n");
+            s.push_str("11 18.5 m 16 18.5 l 16 1.5 l 14 1.5 l 14 16.5 l 13 16.5 l 13 1.5 l 11 1.5 l h B\n");
+        }
+        // A tick.
+        "Check" => s.push_str("1.5 10.5 m 4.5 13.5 l 8 9.5 l 16 18.5 l 18.5 15.5 l 8 3.5 l h B\n"),
+        // A ring.
+        "Circle" => {
+            s.push_str(&circle_path(10.0, 10.0, 8.5));
+            s.push_str(&circle_path(10.0, 10.0, 5.0));
+            s.push_str("B*\n");
+        }
+        // A thick X.
+        "Cross" => s.push_str("4 1.5 m 10 7.5 l 16 1.5 l 18.5 4 l 12.5 10 l 18.5 16 l 16 18.5 l 10 12.5 l 4 18.5 l 1.5 16 l 7.5 10 l 1.5 4 l h B\n"),
+        // A ring with sighting lines through it.
+        "CrossHairs" => {
+            s.push_str(&circle_path(10.0, 10.0, 7.0));
+            s.push_str(&circle_path(10.0, 10.0, 4.5));
+            s.push_str("B*\n1.2 w 10 0.5 m 10 19.5 l 0.5 10 m 19.5 10 l S\n");
+        }
+        // A five-pointed star.
+        "Star" => {
+            let points: Vec<String> = (0..10)
+                .map(|i| {
+                    let r = if i % 2 == 0 { 9.5 } else { 3.9 };
+                    let a = std::f64::consts::FRAC_PI_2 + f64::from(i) * std::f64::consts::PI / 5.0;
+                    format!("{} {}", n(10.0 + r * a.cos()), n(9.5 + r * a.sin()))
+                })
+                .collect();
+            s.push_str(&format!("{} m {} l h B\n", points[0], points[1..].join(" l ")));
+        }
+        // Block arrows.
+        "RightArrow" => s.push_str("1.5 7 m 11 7 l 11 2.5 l 18.5 10 l 11 17.5 l 11 13 l 1.5 13 l h B\n"),
+        "UpArrow" => s.push_str("7 1.5 m 7 11 l 2.5 11 l 10 18.5 l 17.5 11 l 13 11 l 13 1.5 l h B\n"),
+        _ => {
+            s.push_str("3 19 m 13 19 l 17 15 l 17 1 l 3 1 l h B\n13 19 m 13 15 l 17 15 l S\n");
+            s.push_str("5.5 12 m 14.5 12 l 5.5 9 m 14.5 9 l 5.5 6 m 11.5 6 l S\n");
+        }
+    }
+    s
+}
diff --git a/crates/annot/src/create.rs b/crates/annot/src/create.rs
new file mode 100644
index 0000000000..bedd1c6f15
--- /dev/null
+++ b/crates/annot/src/create.rs
@@ -0,0 +1,471 @@
+use super::draw::draw_appearance;
+use super::lookup::{annot_dict, annot_ref, annots, fill_sign_shape, page_ref, set_annots};
+use super::modify::{n, rich_text};
+use super::types::{FLAG_NO_ROTATE, FLAG_NO_ZOOM, FLAG_PRINT, LineEnding, Markup, Meta, NOTE_SIZE, NewAnnotation, Rgb, Shape, StampGroup, Style};
+use super::*;
+
+pub(crate) fn num_array(v: &[f64]) -> Object {
+    Object::Array(v.iter().map(|x| Object::Real(*x)).collect())
+}
+
+pub(crate) fn rgb(c: Rgb) -> Object {
+    num_array(&c.map(|x| x.clamp(0.0, 1.0)))
+}
+
+pub(crate) fn finite(v: &[f64]) -> bool {
+    v.iter().all(|x| x.is_finite() && x.abs() < 1e7)
+}
+
+pub(crate) fn normalize(r: [f64; 4]) -> [f64; 4] {
+    [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]
+}
+
+pub(crate) fn bounds(points: impl Iterator<Item = [f64; 2]>) -> Option<[f64; 4]> {
+    points.fold(None, |acc, [x, y]| match acc {
+        None => Some([x, y, x, y]),
+        Some([a, b, c, d]) => Some([a.min(x), b.min(y), c.max(x), d.max(y)]),
+    })
+}
+
+pub(crate) fn grow(r: [f64; 4], by: f64) -> [f64; 4] {
+    [r[0] - by, r[1] - by, r[2] + by, r[3] + by]
+}
+
+pub(crate) fn ending_draws(ending: LineEnding) -> bool {
+    ending != LineEnding::None
+}
+
+pub(crate) fn ending_pair(start: LineEnding, end: LineEnding) -> Object {
+    Object::Array(vec![Object::name(start.name()), Object::name(end.name())])
+}
+
+/// Validate and compute `/Rect` for a new comment.
+pub(crate) fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotError> {
+    let bad = |what: &str| AnnotError::Invalid(format!("invalid {what}"));
+    let half = style.width.max(0.0) / 2.0;
+    let r = match shape {
+        Shape::Note { at, .. } | Shape::Attachment { at, .. } => {
+            if !finite(at) {
+                return Err(bad("position"));
+            }
+            [at[0], at[1] - NOTE_SIZE, at[0] + NOTE_SIZE, at[1]]
+        }
+        Shape::TextMarkup { quads, .. } | Shape::Redact { quads, .. } => {
+            if quads.is_empty() || !quads.iter().all(|q| finite(q)) {
+                return Err(bad("text area (no quadrilaterals)"));
+            }
+            bounds(quads.iter().flat_map(|q| q.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect::<Vec<_>>()))
+                .ok_or_else(|| bad("text area"))?
+        }
+        Shape::Rectangle { rect }
+        | Shape::Oval { rect }
+        | Shape::TextBox { rect, .. }
+        | Shape::Typewriter { rect, .. }
+        | Shape::Stamp { rect, .. }
+        | Shape::TypedSignature { rect, .. }
+        | Shape::Mark { rect, .. } => {
+            let r = normalize(*rect);
+            if !finite(rect) || r[2] - r[0] < 1.0 || r[3] - r[1] < 1.0 {
+                return Err(bad("rectangle (too small)"));
+            }
+            r
+        }
+        Shape::CustomStamp { rect, .. } => {
+            let r = normalize(*rect);
+            // Image signatures may be very thin; a positive PDF appearance box still works.
+            if !finite(rect) || r[2] <= r[0] || r[3] <= r[1] {
+                return Err(bad("rectangle (empty)"));
+            }
+            r
+        }
+        Shape::Line { from, to, start, end } => {
+            if !finite(from) || !finite(to) || (from[0] - to[0]).hypot(from[1] - to[1]) < 1.0 {
+                return Err(bad("line (too short)"));
+            }
+            let pad = half + if ending_draws(*start) || ending_draws(*end) { appearance::arrow_size(style.width) } else { 0.0 };
+            grow(bounds([*from, *to].into_iter()).unwrap_or_default(), pad + 1.0)
+        }
+        Shape::Ink { strokes } | Shape::Signature { strokes } => {
+            if strokes.iter().all(Vec::is_empty) || !strokes.iter().flatten().all(|p| finite(p)) {
+                return Err(bad("drawing (no points)"));
+            }
+            // Strokes of three or more points are drawn as curves, which stay within their
+            // points and control points.
+            let controls = strokes.iter().filter(|s| s.len() > 2).flat_map(|s| {
+                let pts: Vec<(f64, f64)> = s.iter().map(|p| (p[0], p[1])).collect();
+                appearance::smooth_segments(&pts).into_iter().flat_map(|[a, b, _]| [[a.0, a.1], [b.0, b.1]])
+            });
+            grow(bounds(strokes.iter().flatten().copied().chain(controls)).unwrap_or_default(), half + 1.0)
+        }
+        Shape::Polygon { vertices, cloud } => {
+            let b = bounds(vertices.iter().copied())
+                .filter(|b| vertices.len() >= 3 && vertices.iter().all(|p| finite(p)) && b[2] - b[0] >= 1.0 && b[3] - b[1] >= 1.0);
+            let b = b.ok_or_else(|| bad("polygon (it needs three points)"))?;
+            grow(b, half + 1.0 + if *cloud { 1.5 * appearance::cloud_radius(style.width) } else { 0.0 })
+        }
+        Shape::PolyLine { vertices, start, end } => {
+            let b = bounds(vertices.iter().copied())
+                .filter(|b| vertices.len() >= 2 && vertices.iter().all(|p| finite(p)) && (b[2] - b[0]).max(b[3] - b[1]) >= 1.0);
+            let extra = if ending_draws(*start) || ending_draws(*end) { appearance::arrow_size(style.width) } else { 0.0 };
+            grow(b.ok_or_else(|| bad("connected lines (they need two points)"))?, half + 1.0 + extra)
+        }
+        Shape::Callout { rect, knee, point, .. } => {
+            let r = normalize(*rect);
+            if !finite(rect) || !finite(knee) || !finite(point) || r[2] - r[0] < 1.0 || r[3] - r[1] < 1.0 {
+                return Err(bad("callout"));
+            }
+            let pad = half + appearance::arrow_size(style.width) + 1.0;
+            let lead = grow(bounds([*knee, *point].into_iter()).unwrap_or_default(), pad);
+            [r[0].min(lead[0]), r[1].min(lead[1]), r[2].max(lead[2]), r[3].max(lead[3])]
+        }
+        Shape::Caret { rect } => {
+            let r = normalize(*rect);
+            if !finite(rect) || r[2] - r[0] < 1.0 || r[3] - r[1] < 1.0 {
+                return Err(bad("caret"));
+            }
+            r
+        }
+    };
+    Ok(r)
+}
+
+pub(crate) fn base_dict(subtype: &str, rect: [f64; 4], page: ObjRef, contents: &str, author: &str, meta: &Meta) -> Dict {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("Annot"));
+    d.set(b"Subtype".to_vec(), Object::name(subtype));
+    d.set(b"Rect".to_vec(), num_array(&rect));
+    d.set(b"Contents".to_vec(), PdfString::text(contents));
+    if !author.is_empty() {
+        d.set(b"T".to_vec(), PdfString::text(author));
+    }
+    if let Some(date) = &meta.date {
+        d.set(b"M".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
+        d.set(b"CreationDate".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
+    }
+    if !meta.id.is_empty() {
+        d.set(b"NM".to_vec(), PdfString::text(&meta.id));
+    }
+    d.set(b"P".to_vec(), Object::Ref(page));
+    d.set(b"F".to_vec(), Object::Int(FLAG_PRINT));
+    d
+}
+
+/// Acrobat's `/Subj` for each tool (shown as the comment type in other viewers).
+fn subject(shape: &Shape) -> &'static str {
+    match shape {
+        Shape::Note { .. } => "Sticky Note",
+        Shape::TextMarkup { kind: Markup::Highlight, .. } => "Highlight",
+        Shape::TextMarkup { kind: Markup::Underline, .. } => "Underline",
+        Shape::TextMarkup { kind: Markup::StrikeOut, .. } => "Strikethrough",
+        Shape::TextMarkup { kind: Markup::Squiggly, .. } => "Squiggly",
+        Shape::Rectangle { .. } => "Rectangle",
+        Shape::Oval { .. } => "Oval",
+        Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Arrow",
+        Shape::Line { .. } => "Line",
+        Shape::Ink { .. } => "Pencil",
+        Shape::TextBox { .. } => "Text Box",
+        Shape::Typewriter { .. } => "Typewriter",
+        Shape::Mark { mark, .. } => mark.label(),
+        Shape::Signature { .. } => "Signature",
+        Shape::Redact { .. } => "Redact",
+        Shape::Stamp { stamp, .. } => match stamp.group() {
+            StampGroup::Dynamic => "Dynamic stamp",
+            StampGroup::SignHere => "Sign Here",
+            StampGroup::StandardBusiness => "Stamp",
+        },
+        Shape::CustomStamp { .. } => "Stamp",
+        Shape::TypedSignature { .. } => "Signature",
+        Shape::Polygon { cloud: true, .. } => "Cloud",
+        Shape::Polygon { .. } => "Polygon",
+        Shape::PolyLine { .. } => "Polygonal Line",
+        Shape::Callout { .. } => "Callout",
+        Shape::Caret { .. } => "Inserted Text",
+        Shape::Attachment { .. } => "File Attachment",
+    }
+}
+
+/// Where a callout's leader line meets its text box: the middle of the side facing `knee`.
+pub fn callout_attach(rect: [f64; 4], knee: [f64; 2]) -> [f64; 2] {
+    let [x0, y0, x1, y1] = normalize(rect);
+    let (cx, cy) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0);
+    if knee[0] < x0 {
+        [x0, cy]
+    } else if knee[0] > x1 {
+        [x1, cy]
+    } else if knee[1] > y1 {
+        [cx, y1]
+    } else {
+        [cx, y0]
+    }
+}
+
+/// Add a comment; returns its index in the page's `/Annots`.
+pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> Result<usize, AnnotError> {
+    let page = page_ref(doc, new.page)?;
+    let style = &new.style;
+    if !finite(&style.color) || !style.opacity.is_finite() || !style.width.is_finite() {
+        return Err(AnnotError::Invalid("invalid style".into()));
+    }
+    let rect = rect_for(&new.shape, style)?;
+    let mut d = base_dict(new.shape.subtype(), rect, page, &new.contents, &new.author, meta);
+    d.set(b"Subj".to_vec(), PdfString::text(subject(&new.shape)));
+    let opacity = style.opacity.clamp(0.0, 1.0);
+    if opacity < 1.0 {
+        d.set(b"CA".to_vec(), Object::Real(opacity));
+    }
+    let border = |d: &mut Dict| {
+        let mut bs = Dict::new();
+        bs.set(b"W".to_vec(), Object::Real(style.width.max(0.0)));
+        bs.set(b"S".to_vec(), Object::name("S"));
+        d.set(b"BS".to_vec(), Object::Dict(bs));
+    };
+    let mut popup = None;
+    match &new.shape {
+        Shape::Note { icon, .. } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"Name".to_vec(), Object::name(icon.name()));
+            d.set(b"F".to_vec(), Object::Int(FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
+            d.set(b"Open".to_vec(), Object::Bool(false));
+            popup = Some([rect[2] + 10.0, rect[3] - 120.0, rect[2] + 210.0, rect[3]]);
+        }
+        Shape::TextMarkup { quads, .. } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"QuadPoints".to_vec(), num_array(&quads.concat()));
+        }
+        Shape::Redact { quads, overlay, look } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"IC".to_vec(), rgb(style.fill.unwrap_or([0.0, 0.0, 0.0])));
+            d.set(b"QuadPoints".to_vec(), num_array(&quads.concat()));
+            if !overlay.is_empty() {
+                d.set(b"OverlayText".to_vec(), PdfString::text(overlay));
+                let [r, g, b] = look.color.map(|x| x.clamp(0.0, 1.0));
+                let size = if look.size > 0.0 { look.size.min(400.0) } else { 0.0 };
+                d.set(
+                    b"DA".to_vec(),
+                    PdfString::literal(format!("{} {} {} rg /{} {} Tf", n(r), n(g), n(b), look.font.resource(), n(size)).into_bytes()),
+                );
+                d.set(b"Q".to_vec(), Object::Int(look.align.min(2) as i64));
+                if look.repeat {
+                    d.set(b"Repeat".to_vec(), Object::Bool(true));
+                }
+            }
+        }
+        Shape::Rectangle { .. } | Shape::Oval { .. } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            if let Some(f) = style.fill {
+                d.set(b"IC".to_vec(), rgb(f));
+            }
+            border(&mut d);
+        }
+        Shape::Line { from, to, start, end } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"L".to_vec(), num_array(&[from[0], from[1], to[0], to[1]]));
+            if ending_draws(*start) || ending_draws(*end) {
+                d.set(b"LE".to_vec(), ending_pair(*start, *end));
+            }
+            border(&mut d);
+        }
+        Shape::Mark { mark, .. } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"Name".to_vec(), Object::name(mark.name()));
+            border(&mut d);
+            // Drawn upright for the page as displayed, as a stamp is (#2392).
+            let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
+            if matches!(turn, 90 | 180 | 270) {
+                d.set(b"PCStampRotate".to_vec(), Object::Int(turn));
+            }
+        }
+        Shape::Stamp { stamp, by, .. } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"Name".to_vec(), Object::name(stamp.name()));
+            // Marks the stamp as drawn by PdfCraft: other stamps with standard names keep
+            // their own artwork.
+            d.set(b"PCStamp".to_vec(), Object::Bool(true));
+            if let Some(b) = by {
+                d.set(b"PCByLine".to_vec(), PdfString::text(b));
+            }
+            // The label is drawn for the page as displayed. A later page rotation is a new edit.
+            let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
+            if matches!(turn, 90 | 180 | 270) {
+                d.set(b"PCStampRotate".to_vec(), Object::Int(turn));
+            }
+        }
+        Shape::TypedSignature { contours, .. } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"Name".to_vec(), Object::name("PCTypedSignature"));
+            let list = contours.iter().filter(|c| c.len() > 2).map(|c| num_array(&c.iter().flat_map(|p| [p[0], p[1]]).collect::<Vec<_>>())).collect();
+            d.set(b"PCOutline".to_vec(), Object::Array(list));
+        }
+        Shape::CustomStamp { name, picture, image, size, .. } => {
+            let clean: String = name.chars().filter(char::is_ascii_alphanumeric).collect();
+            d.set(b"Name".to_vec(), Object::name(&format!("PCCustom{clean}")));
+            d.set(b"PCPicture".to_vec(), Object::Ref(*picture));
+            d.set(b"PCPictureImage".to_vec(), Object::Bool(*image));
+            d.set(b"PCPictureSize".to_vec(), num_array(&[size.0, size.1]));
+            // An image signature's rectangle is in user space; on a turned page its appearance is
+            // turned back (see `appearance::build`), so it reads upright as displayed.
+            if *image && matches!(clean.as_str(), "Signature" | "Initials") {
+                let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
+                if turn != 0 {
+                    d.set(b"PCPictureRotate".to_vec(), Object::Int(turn));
+                }
+            }
+        }
+        Shape::Ink { strokes } | Shape::Signature { strokes } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            let list = strokes.iter().filter(|s| !s.is_empty()).map(|s| num_array(&s.concat())).collect();
+            d.set(b"InkList".to_vec(), Object::Array(list));
+            border(&mut d);
+        }
+        Shape::Polygon { vertices, cloud } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            if let Some(f) = style.fill {
+                d.set(b"IC".to_vec(), rgb(f));
+            }
+            d.set(b"Vertices".to_vec(), num_array(&vertices.concat()));
+            if *cloud {
+                d.set(b"IT".to_vec(), Object::name("PolygonCloud"));
+                let mut be = Dict::new();
+                be.set(b"S".to_vec(), Object::name("C"));
+                be.set(b"I".to_vec(), Object::Int(1));
+                d.set(b"BE".to_vec(), Object::Dict(be));
+            }
+            border(&mut d);
+        }
+        Shape::PolyLine { vertices, start, end } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"Vertices".to_vec(), num_array(&vertices.concat()));
+            if ending_draws(*start) || ending_draws(*end) {
+                d.set(b"LE".to_vec(), ending_pair(*start, *end));
+            }
+            border(&mut d);
+        }
+        Shape::Caret { .. } => {
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"Sy".to_vec(), Object::name("None"));
+        }
+        Shape::Attachment { icon, file, data, .. } => {
+            if file.trim().is_empty() {
+                return Err(AnnotError::Invalid("the attached file needs a name".into()));
+            }
+            d.set(b"C".to_vec(), rgb(style.color));
+            d.set(b"Name".to_vec(), Object::name(icon.name()));
+            d.set(b"F".to_vec(), Object::Int(FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
+            // The file: an embedded file stream inside a file specification (§7.11.4).
+            let mut params = Dict::new();
+            params.set(b"Size".to_vec(), Object::Int(data.len() as i64));
+            if let Some(date) = &meta.date {
+                params.set(b"ModDate".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
+            }
+            let mut ef = Dict::new();
+            ef.set(b"Type".to_vec(), Object::name("EmbeddedFile"));
+            ef.set(b"Params".to_vec(), Object::Dict(params));
+            let ef = doc.add(Object::Stream(pdfcraft_cos::Stream::flate(ef, data)));
+            let mut efd = Dict::new();
+            efd.set(b"F".to_vec(), Object::Ref(ef));
+            efd.set(b"UF".to_vec(), Object::Ref(ef));
+            let mut fs = Dict::new();
+            fs.set(b"Type".to_vec(), Object::name("Filespec"));
+            fs.set(b"F".to_vec(), PdfString::text(file.trim()));
+            fs.set(b"UF".to_vec(), PdfString::text(file.trim()));
+            fs.set(b"EF".to_vec(), Object::Dict(efd));
+            d.set(b"FS".to_vec(), Object::Ref(doc.add(Object::Dict(fs))));
+            if new.contents.is_empty() {
+                d.set(b"Contents".to_vec(), PdfString::text(file.trim()));
+            }
+        }
+        Shape::Callout { rect: tb, knee, point, ending, .. } => {
+            let tb = normalize(*tb);
+            let attach = callout_attach(tb, *knee);
+            d.set(b"IT".to_vec(), Object::name("FreeTextCallout"));
+            d.set(b"CL".to_vec(), num_array(&[point[0], point[1], knee[0], knee[1], attach[0], attach[1]]));
+            d.set(b"LE".to_vec(), Object::name(ending.name()));
+            // The text box inside /Rect (§12.5.6.6 /RD).
+            d.set(b"RD".to_vec(), num_array(&[tb[0] - rect[0], tb[1] - rect[1], rect[2] - tb[2], rect[3] - tb[3]]));
+        }
+        _ => {}
+    }
+    match &new.shape {
+        Shape::TextBox { font_size, .. } | Shape::Typewriter { font_size, .. } | Shape::Callout { font_size, .. } => {
+            if matches!(new.shape, Shape::Typewriter { .. }) {
+                d.set(b"IT".to_vec(), Object::name("FreeTextTypeWriter"));
+            }
+            let size = if font_size.is_finite() && *font_size > 0.0 { font_size.clamp(1.0, 400.0) } else { 12.0 };
+            let [r, g, b] = style.color.map(|x| x.clamp(0.0, 1.0));
+            d.set(b"DA".to_vec(), PdfString::literal(format!("{} {} {} rg /Helv {} Tf", n(r), n(g), n(b), n(size)).into_bytes()));
+            d.set(b"Q".to_vec(), Object::Int(0));
+            if let Some(f) = style.fill {
+                d.set(b"C".to_vec(), rgb(f));
+            }
+            border(&mut d);
+            rich_text(&mut d);
+            // The text is laid out for the page as displayed, like a stamp's label.
+            if !matches!(new.shape, Shape::Callout { .. }) {
+                let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
+                if matches!(turn, 90 | 180 | 270) {
+                    d.set(b"PCTextRotate".to_vec(), Object::Int(turn));
+                }
+            }
+        }
+        _ => {}
+    }
+    if fill_sign_shape(&new.shape) {
+        // Survives a later subject edit, so flatten-on-save still finds the mark.
+        d.set(b"PCFillSign".to_vec(), Object::Bool(true));
+    }
+    // A redaction's overlay text becomes page content when it is applied, where `?` would be there
+    // for good: refused before anything is added. A comment's own text is stored as typed and
+    // drawn with `?` for what the standard fonts can't draw (marked, see `draw_appearance`).
+    if d.name(b"Subtype") == Some(b"Redact")
+        && let Some((what, c)) = appearance::undrawable_text(&d)
+    {
+        return Err(AnnotError::Undrawable(pdfcraft_fonts::undrawable_message(what, c)));
+    }
+    let r = doc.add(Object::Dict(d.clone()));
+    draw_appearance(doc, r)?;
+    let mut list = annots(doc, page);
+    let index = list.len();
+    list.push(Object::Ref(r));
+    if let Some(pr) = popup {
+        let mut p = Dict::new();
+        p.set(b"Type".to_vec(), Object::name("Annot"));
+        p.set(b"Subtype".to_vec(), Object::name("Popup"));
+        p.set(b"Rect".to_vec(), num_array(&pr));
+        p.set(b"Parent".to_vec(), Object::Ref(r));
+        p.set(b"Open".to_vec(), Object::Bool(false));
+        p.set(b"F".to_vec(), Object::Int(FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
+        let pref = doc.add(Object::Dict(p));
+        doc.update_dict(r, |d| d.set(b"Popup".to_vec(), Object::Ref(pref)))?;
+        list.push(Object::Ref(pref));
+    }
+    set_annots(doc, page, list)?;
+    Ok(index)
+}
+
+/// Counterrotate a newly placed picture stamp's appearance into displayed-page axes.
+/// The picture may be an image or a PDF page. The normal appearance's transformed bounding
+/// box is fitted to `/Rect` by PDF viewers.
+pub fn orient_image_stamp(doc: &mut Document, page: usize, index: usize, rotation: i64) -> Result<(), AnnotError> {
+    let matrix = match rotation {
+        90 => [0.0, 1.0, -1.0, 0.0, 0.0, 0.0],
+        180 => [-1.0, 0.0, 0.0, -1.0, 0.0, 0.0],
+        270 => [0.0, -1.0, 1.0, 0.0, 0.0, 0.0],
+        _ => return Ok(()),
+    };
+    let (_, r) = annot_ref(doc, page, index)?;
+    let d = annot_dict(doc, r);
+    if d.name(b"Subtype") != Some(b"Stamp") || d.get(b"PCPicture").is_none() {
+        return Err(AnnotError::Invalid("only a picture stamp can be oriented".into()));
+    }
+    let normal = d
+        .get(b"AP")
+        .map(|ap| doc.resolve(ap))
+        .and_then(|ap| ap.as_dict().and_then(|ap| ap.reference(b"N")))
+        .ok_or_else(|| AnnotError::Invalid("the stamp has no normal appearance".into()))?;
+    let Object::Stream(mut stream) = doc.get(normal).as_ref().clone() else {
+        return Err(AnnotError::Invalid("the stamp's normal appearance is not a stream".into()));
+    };
+    stream.dict.set(b"Matrix".to_vec(), num_array(&matrix));
+    doc.set(normal, Object::Stream(stream));
+    Ok(())
+}
diff --git a/crates/annot/src/draw.rs b/crates/annot/src/draw.rs
new file mode 100644
index 0000000000..1898454415
--- /dev/null
+++ b/crates/annot/src/draw.rs
@@ -0,0 +1,198 @@
+use super::create::{finite, num_array};
+use super::lookup::{annot_dict, annots, page_refs};
+use super::modify::refuse_foreign_text;
+use super::types::NOTE_SIZE;
+use super::*;
+
+/// (Re)generate `/AP /N` for the annotation `r` from its dictionary, for an edit that keeps its
+/// text (a restyle, a new size or colour).
+///
+/// A comment whose text the standard fonts can't draw, with an appearance another program drew
+/// (with a font that has those characters), keeps that appearance: redrawing it would put `?` in
+/// their place, so the edit is refused (`AnnotError::Undrawable`). One PdfCraft drew with `?`
+/// (marked `pdfcraft_fonts::UNDRAWN_MARK`) is redrawn.
+pub fn set_appearance(doc: &mut Document, r: ObjRef) -> Result<(), AnnotError> {
+    refuse_foreign_text(doc, &annot_dict(doc, r))?;
+    draw_appearance(doc, r)
+}
+
+/// Put `before` back when redrawing fails, so a refused edit does not keep the new rectangle or style.
+pub(crate) fn redraw_or_restore(doc: &mut Document, r: ObjRef, before: Dict) -> Result<(), AnnotError> {
+    if let Err(e) = set_appearance(doc, r) {
+        doc.set(r, Object::Dict(before));
+        return Err(e);
+    }
+    Ok(())
+}
+
+/// Draw `r`'s normal appearance from its dictionary, whatever its text: characters the standard
+/// fonts can't draw come out as `?`, and the annotation is marked (`pdfcraft_fonts::UNDRAWN_MARK`,
+/// cleared when all of it can be drawn) so the edit is reported and flattening won't make that
+/// `?` permanent. For new text (a new comment, changed contents), as Acrobat keeps text its font
+/// can't show, and for display-only copies.
+pub(crate) fn draw_appearance(doc: &mut Document, r: ObjRef) -> Result<(), AnnotError> {
+    let d = annot_dict(doc, r);
+    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
+    let Some(stream) = build_appearance(doc, &d) else { return Err(AnnotError::Unsupported(subtype)) };
+    apply_appearance(doc, r, &d, stream)
+}
+
+/// Draw the appearance for an annotation dictionary: the expensive half of [`set_appearance`].
+/// Pure from the dictionary and the objects it points at, so [`AppearanceCache`] can reuse it.
+fn build_appearance(doc: &Document, d: &Dict) -> Option<Stream> {
+    let mut stream = appearance::build(d)?;
+    // Picture-stamp restyling must retain the placement's page-axis correction.
+    if d.get(b"PCPicture").is_some() {
+        let matrix = d.get(b"AP").and_then(|ap| {
+            let ap = doc.resolve(ap);
+            let normal = doc.resolve(ap.as_dict()?.get(b"N")?);
+            let Object::Stream(normal) = normal.as_ref() else { return None };
+            normal.dict.get(b"Matrix").cloned()
+        });
+        if let Some(matrix) = matrix {
+            stream.dict.set(b"Matrix".to_vec(), matrix);
+        }
+    }
+    Some(stream)
+}
+
+/// Store a built appearance on the annotation: the cheap half of [`set_appearance`].
+fn apply_appearance(doc: &mut Document, r: ObjRef, d: &Dict, stream: Stream) -> Result<(), AnnotError> {
+    // Characters the standard fonts can't draw came out as `?`: mark the annotation with the first.
+    let missing = appearance::undrawable_text(d).map(|(_, c)| c);
+    let ap = doc.add(Object::Stream(stream));
+    // A copy (a shared /AP is left alone) that keeps unknown entries; the old down and rollover
+    // appearances would show the previous look on press or hover, so they go with the old /N.
+    let mut apd = d.get(b"AP").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().cloned()).unwrap_or_default();
+    apd.remove(b"D");
+    apd.remove(b"R");
+    apd.set(b"N".to_vec(), Object::Ref(ap));
+    // A note icon has a fixed size (`NOTE_SIZE`); viewers draw it at the upper-left corner of `/Rect`.
+    // The appearance's box is mapped onto `/Rect`, so any other `/Rect` (a large one, or one with
+    // no width, as LaTeX `pdfcomment` writes) would stretch the icon or shrink it to nothing.
+    let icon_rect = matches!(d.name(b"Subtype"), Some(b"Text" | b"FileAttachment"))
+        .then(|| d.get(b"Rect")?.as_array()?.iter().map(|o| o.as_f64()).collect::<Option<Vec<f64>>>())
+        .flatten()
+        .filter(|q| q.len() == 4 && finite(q))
+        .map(|q| {
+            let (x, top) = (q[0].min(q[2]), q[1].max(q[3]));
+            [x, top - NOTE_SIZE, x + NOTE_SIZE, top]
+        });
+    doc.update_dict(r, |d| {
+        d.set(b"AP".to_vec(), Object::Dict(apd));
+        if let Some(rect) = icon_rect {
+            d.set(b"Rect".to_vec(), num_array(&rect));
+        }
+        d.remove(b"AS");
+        pdfcraft_fonts::set_undrawn_mark(d, missing);
+    })?;
+    Ok(())
+}
+
+/// Display appearances built for annotations without any, reused while the annotation
+/// dictionaries they were drawn from are unchanged.
+///
+/// A content edit (moving a paragraph, retyping text, …) leaves every annotation dictionary
+/// alone, but the display copy is rebuilt from the edited document on every refresh: without
+/// this cache each refresh redrew every appearance (27k on one CAD file, ~0.7 s per edit
+/// commit). Entries are keyed by annotation reference; object numbers are never reused within
+/// a document lineage, so an entry stays valid until an annotation edit runs. Callers clear
+/// the cache on any refresh that may change annotations (comments, structural and full
+/// refreshes) and keep it for content-only ones.
+#[derive(Clone, Debug, Default)]
+pub struct AppearanceCache {
+    entries: std::collections::HashMap<ObjRef, Stream>,
+    bytes: usize,
+    hits: u64,
+    builds: u64,
+}
+
+impl AppearanceCache {
+    /// Cached appearance data restarts past this instead of growing without bound.
+    const MAX_BYTES: usize = 64 << 20;
+
+    /// Forget every entry (an annotation edit may have changed the dictionaries).
+    pub fn clear(&mut self) {
+        *self = Self::default();
+    }
+
+    fn get(&mut self, r: ObjRef) -> Option<Stream> {
+        let stream = self.entries.get(&r)?.clone();
+        self.hits += 1;
+        Some(stream)
+    }
+
+    fn insert(&mut self, r: ObjRef, stream: &Stream) {
+        self.builds += 1;
+        if self.entries.len() >= 1_000_000 {
+            self.clear();
+        }
+        if self.bytes.saturating_add(stream.raw.len()) <= Self::MAX_BYTES {
+            self.bytes += stream.raw.len();
+            self.entries.insert(r, stream.clone());
+        }
+        // Else over budget: keep serving the entries already cached instead of growing.
+    }
+
+    /// Cache hits so far (reused appearances); for tests.
+    pub fn hits(&self) -> u64 {
+        self.hits
+    }
+
+    /// Appearances built so far; for tests.
+    pub fn builds(&self) -> u64 {
+        self.builds
+    }
+}
+
+/// A copy of `doc` in which every annotation without a normal appearance (`/AP /N`) has the one
+/// [`appearance::build`] draws from its dictionary, for displaying the document (`None` when no
+/// annotation needs one). Many files carry comments without appearances (FreeText, Ink, notes,
+/// stamps, …) that viewers draw from the dictionary. `doc` is not changed: saving writes the file
+/// as it was. Links, form fields and pop-ups keep their own handling.
+pub fn with_missing_appearances(doc: &Document) -> Option<Document> {
+    with_missing_appearances_cached(doc, &mut AppearanceCache::default())
+}
+
+/// A copy of `doc` with [`AppearanceCache`] reuse across refreshes: annotations whose
+/// dictionary is unchanged since the cached build keep their stored appearance instead of
+/// redrawing it. See [`AppearanceCache`] for when entries stay valid.
+pub fn with_missing_appearances_cached(doc: &Document, cache: &mut AppearanceCache) -> Option<Document> {
+    let mut copy: Option<Document> = None;
+    // An annotation listed more than once, on one page or several, is drawn once. `has_normal`
+    // reads `doc`, which never gets the appearance, so every repeat used to add another stream to
+    // the copy, and the display bytes grew with the number of listings.
+    let mut seen = std::collections::HashSet::new();
+    for page in page_refs(doc).ok()? {
+        for r in annots(doc, page).iter().filter_map(Object::as_ref) {
+            if !seen.insert(r) {
+                continue;
+            }
+            let d = annot_dict(doc, r);
+            if matches!(d.name(b"Subtype"), None | Some(b"Link" | b"Widget" | b"Popup")) {
+                continue;
+            }
+            let has_normal = d.get(b"AP").is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N")));
+            if has_normal {
+                continue;
+            }
+            if let Some(stream) = cache.get(r) {
+                // Fails only when `r` isn't a dictionary, which the cached build ruled out.
+                apply_appearance(copy.get_or_insert_with(|| doc.clone()), r, &d, stream).ok();
+                continue;
+            }
+            // Another program's stamp gets a drawing for display only (ISO 32000-2 Table 184). Its
+            // `/AP`, if any, has no `/N` to keep here.
+            let other_stamp = || {
+                let mut bare = d.clone();
+                bare.remove(b"AP");
+                appearance::display_stamp(&bare)
+            };
+            let Some(stream) = build_appearance(doc, &d).or_else(other_stamp) else { continue };
+            cache.insert(r, &stream);
+            // Fails only when `r` isn't a dictionary, which the build just ruled out.
+            apply_appearance(copy.get_or_insert_with(|| doc.clone()), r, &d, stream).ok();
+        }
+    }
+    copy
+}
diff --git a/crates/annot/src/info.rs b/crates/annot/src/info.rs
new file mode 100644
index 0000000000..bea14d9ee2
--- /dev/null
+++ b/crates/annot/src/info.rs
@@ -0,0 +1,276 @@
+use super::create::finite;
+use super::draw::set_appearance;
+use super::lookup::{annot_dict, annot_ref, annotation_flags, annots, drawn_upright, is_fill_sign, page_ref, page_refs};
+use super::modify::{fillable, touch, unlocked};
+use super::types::{FLAG_LOCKED, LineEnding, Meta, NoteIcon, Rgb};
+use super::*;
+
+// ── reading ─────────────────────────────────────────────────────────────────────────────────
+
+/// One comment as the viewer lists it (the same fields and rules as
+/// `pdfcraft_render::Annotation`), read straight from the object graph. The engine uses it to
+/// refresh the comment list after a comment edit without re-inspecting the whole document.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Summary {
+    pub page: usize,
+    pub index: usize,
+    pub subtype: String,
+    pub author: Option<String>,
+    pub contents: Option<String>,
+    /// `/M` as written (a PDF date string).
+    pub modified: Option<String>,
+    pub name: Option<String>,
+    pub in_reply_to: Option<String>,
+    /// The page and `/Annots` position `/IRT` points at, by reference (`/NM` need not be unique).
+    pub parent: Option<(usize, usize)>,
+    /// `/RT /Group`: grouped with the `/IRT` annotation (Replace Text's caret), not a reply to it.
+    pub grouped: bool,
+    pub rect: [f32; 4],
+    pub color: Option<[f32; 3]>,
+    pub state: Option<String>,
+    pub quads: Vec<[f32; 8]>,
+    pub locked: bool,
+    pub intent: Option<String>,
+    /// A Fill & Sign mark ([`is_fill_sign`]).
+    pub fill_sign: bool,
+    /// The NoRotate flag (`/F` bit 5), as `pdfcraft_render::Annotation::no_rotate`.
+    pub no_rotate: bool,
+    /// A line's two ends (`/L`), or the corners of connected lines, a polygon or a cloud
+    /// (`/Vertices`), in user space; empty for other comments.
+    pub points: Vec<[f32; 2]>,
+}
+
+pub(crate) fn text_value(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
+    let o = doc.resolve(d.get(key)?);
+    let s = match &*o {
+        Object::String(s) => s.to_text(),
+        Object::Name(n) => String::from_utf8_lossy(n).into_owned(),
+        _ => return None,
+    };
+    let s = s.trim_matches('\0').trim().to_string();
+    (!s.is_empty()).then_some(s)
+}
+
+/// Whether an annotation subtype is a comment. Links, form widgets, pop-ups and the non-markup
+/// multimedia and print-production annotations (ISO 32000-2 §12.5.6: Screen, Movie, RichMedia,
+/// 3D, PrinterMark, TrapNet, Watermark) are not.
+pub fn is_comment_subtype(subtype: &str) -> bool {
+    !matches!(subtype, "Link" | "Widget" | "Popup" | "Screen" | "Movie" | "RichMedia" | "3D" | "PrinterMark" | "TrapNet" | "Watermark")
+}
+
+/// Where a reference to a reference (`5 0 obj 6 0 R endobj`) ends, as `pdfcraft_render::inspect`
+/// follows it, within a few steps (a cycle stops there).
+fn final_ref(doc: &Document, mut r: ObjRef) -> ObjRef {
+    for _ in 0..8 {
+        match &*doc.get(r) {
+            Object::Ref(next) => r = *next,
+            _ => break,
+        }
+    }
+    r
+}
+
+/// Every comment (see [`is_comment_subtype`]), ordered by page and then top edge.
+pub fn summaries(doc: &Document) -> Vec<Summary> {
+    let mut out = Vec::new();
+    let Ok(pages) = page_refs(doc) else { return out };
+    let lists: Vec<Vec<Object>> = pages.iter().map(|p| annots(doc, *p)).collect();
+    // Where each annotation is first listed, so a reply's `/IRT` finds its parent by reference.
+    let mut slots: std::collections::HashMap<ObjRef, (usize, usize)> = std::collections::HashMap::new();
+    for (page, list) in lists.iter().enumerate() {
+        for (index, entry) in list.iter().enumerate() {
+            if let Some(r) = entry.as_ref() {
+                slots.entry(final_ref(doc, r)).or_insert((page, index));
+            }
+        }
+    }
+    for (page, list) in lists.iter().enumerate() {
+        for (index, entry) in list.iter().enumerate() {
+            let obj = entry.as_ref().map_or_else(|| doc.resolve(entry), |r| doc.get(final_ref(doc, r)));
+            let Some(d) = obj.as_dict() else { continue };
+            let Some(subtype) = d.name(b"Subtype").map(|s| String::from_utf8_lossy(s).into_owned()) else { continue };
+            if !is_comment_subtype(&subtype) {
+                continue;
+            }
+            let nums = |k: &[u8]| -> Vec<f32> {
+                d.get(k)
+                    .map(|o| doc.resolve(o))
+                    .and_then(|o| o.as_array().map(|a| a.iter().map(|x| doc.resolve(x).as_f64().unwrap_or(0.0) as f32).collect()))
+                    .unwrap_or_default()
+            };
+            let r = nums(b"Rect");
+            let rect = if r.len() == 4 { [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])] } else { [0.0; 4] };
+            let c = nums(b"C");
+            let mut color = (c.len() == 3).then(|| [c[0], c[1], c[2]]);
+            if subtype == "FreeText"
+                && let Some(da) = text_value(doc, d, b"DA")
+            {
+                let t: Vec<&str> = da.split_whitespace().collect();
+                if let Some(i) = t.iter().position(|x| *x == "rg")
+                    && i >= 3
+                {
+                    let f = |k: usize| t[k].parse::<f32>().unwrap_or(0.0);
+                    color = Some([f(i - 3), f(i - 2), f(i - 1)]);
+                }
+            }
+            let quads = nums(b"QuadPoints").as_chunks::<8>().0.to_vec();
+            // Keep in step with `pdfcraft_render::inspect`.
+            let points = match subtype.as_str() {
+                "Line" => Some(nums(b"L")).filter(|l| l.len() == 4).map(|l| l.as_chunks::<2>().0.to_vec()).unwrap_or_default(),
+                "PolyLine" | "Polygon" => nums(b"Vertices").as_chunks::<2>().0.to_vec(),
+                _ => Vec::new(),
+            };
+            let irt = d.get(b"IRT").map(|o| o.as_ref().map_or_else(|| doc.resolve(o), |r| doc.get(final_ref(doc, r))));
+            let in_reply_to = irt.and_then(|o| o.as_dict().cloned()).and_then(|p| text_value(doc, &p, b"NM"));
+            let parent = d.get(b"IRT").and_then(Object::as_ref).and_then(|r| slots.get(&final_ref(doc, r)).copied());
+            out.push(Summary {
+                page,
+                index,
+                subtype,
+                author: text_value(doc, d, b"T"),
+                // Acrobat ends lines with CR, which the interface would draw as nothing (keep in
+                // step with `pdfcraft_render::inspect`).
+                contents: text_value(doc, d, b"Contents").map(|s| s.replace("\r\n", "\n").replace('\r', "\n")),
+                modified: text_value(doc, d, b"M"),
+                name: text_value(doc, d, b"NM"),
+                in_reply_to,
+                parent,
+                grouped: d.name(b"RT") == Some(b"Group"),
+                rect,
+                color,
+                state: text_value(doc, d, b"State"),
+                quads,
+                locked: annotation_flags(doc, d) & FLAG_LOCKED != 0,
+                intent: d.get(b"IT").and_then(|o| doc.resolve(o).as_name().map(|n| String::from_utf8_lossy(n).into_owned())),
+                fill_sign: is_fill_sign(doc, d),
+                no_rotate: drawn_upright(doc, d),
+                points,
+            });
+        }
+    }
+    out.sort_by(|a, b| a.page.cmp(&b.page).then(b.rect[3].total_cmp(&a.rect[3])));
+    out
+}
+
+/// Change a comment's author (`/T`), subject (`/Subj`) and, for notes, icon (`/Name`, redrawn).
+/// `None` leaves a value as it is.
+pub fn set_info(
+    doc: &mut Document,
+    page: usize,
+    index: usize,
+    author: Option<&str>,
+    subject: Option<&str>,
+    icon: Option<NoteIcon>,
+    meta: &Meta,
+) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let is_note = annot_dict(doc, r).name(b"Subtype") == Some(b"Text");
+    if icon.is_some() && !is_note {
+        return Err(AnnotError::Invalid("only sticky notes have an icon".into()));
+    }
+    doc.update_dict(r, |d| {
+        if let Some(a) = author {
+            d.set(b"T".to_vec(), PdfString::text(a));
+        }
+        if let Some(s) = subject {
+            d.set(b"Subj".to_vec(), PdfString::text(s));
+        }
+        if let Some(i) = icon {
+            d.set(b"Name".to_vec(), Object::name(i.name()));
+        }
+        touch(d, meta);
+    })?;
+    if icon.is_some() {
+        set_appearance(doc, r)?;
+    }
+    Ok(())
+}
+
+/// What Comment properties shows for one comment.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Props {
+    pub subtype: String,
+    pub author: String,
+    pub subject: String,
+    pub color: Option<Rgb>,
+    pub opacity: f64,
+    /// Border / line width, for shapes, lines, drawings and text boxes.
+    pub width: Option<f64>,
+    /// Notes only.
+    pub icon: Option<NoteIcon>,
+    /// `/M`, as written.
+    pub modified: Option<String>,
+    /// The appearance can be redrawn (so colour, opacity and width can change).
+    pub restylable: bool,
+    /// The Locked flag.
+    pub locked: bool,
+    /// `/LE`: two names for a line or polyline (`None` when unset), one for a callout.
+    pub endings: Option<Vec<LineEnding>>,
+    /// Whether the comment has a fill control (see [`fillable`]).
+    pub fillable: bool,
+    /// The interior colour (`None`: no fill).
+    pub fill: Option<Rgb>,
+    /// Text boxes, typewriter text and callouts: the `/DA` font size in points.
+    pub font_size: Option<f64>,
+}
+
+/// The current properties of the comment at `(page, index)`.
+pub fn props(doc: &Document, page: usize, index: usize) -> Option<Props> {
+    let p = page_ref(doc, page).ok()?;
+    let entry = annots(doc, p).get(index).cloned()?;
+    let obj = doc.resolve(&entry);
+    let d = obj.as_dict()?;
+    let subtype = String::from_utf8_lossy(d.name(b"Subtype")?).into_owned();
+    let c: Vec<f64> = d.get(b"C").and_then(|o| o.as_array().map(|a| a.iter().filter_map(|x| x.as_f64()).collect())).unwrap_or_default();
+    let color = if subtype == "FreeText" { Some(appearance::parse_da(d).0) } else { (c.len() == 3).then(|| [c[0], c[1], c[2]]) };
+    let width = matches!(subtype.as_str(), "Square" | "Circle" | "Line" | "Ink" | "Polygon" | "PolyLine" | "FreeText").then(|| {
+        if subtype == "FreeText" {
+            if !d.contains(b"BS") && !d.contains(b"Border") { 0.0 } else { appearance::border_width(d) }
+        } else {
+            d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0)
+        }
+    });
+    Some(Props {
+        author: text_value(doc, d, b"T").unwrap_or_default(),
+        subject: text_value(doc, d, b"Subj").unwrap_or_default(),
+        color,
+        opacity: d.get(b"CA").and_then(|o| o.as_f64()).unwrap_or(1.0),
+        width,
+        icon: (subtype == "Text").then(|| d.name(b"Name").and_then(|n| NoteIcon::from_name(&String::from_utf8_lossy(n))).unwrap_or(NoteIcon::Note)),
+        modified: text_value(doc, d, b"M"),
+        restylable: appearance::build(d).is_some(),
+        locked: annotation_flags(doc, d) & FLAG_LOCKED != 0,
+        fillable: fillable(&subtype),
+        fill: fill_of(d),
+        font_size: (subtype == "FreeText").then(|| appearance::parse_da(d).1),
+        subtype,
+        endings: line_endings_of(d),
+    })
+}
+
+/// A shape’s `/IC` or FreeText `/C` as RGB. Grey and CMYK fills are converted.
+fn fill_of(d: &Dict) -> Option<Rgb> {
+    let key: &[u8] = if d.name(b"Subtype") == Some(b"FreeText") { b"C" } else { b"IC" };
+    let c: Vec<f64> = d.get(key)?.as_array()?.iter().filter_map(|x| x.as_f64()).collect();
+    let rgb = match c.as_slice() {
+        [g] => [*g; 3],
+        [r, g, b] => [*r, *g, *b],
+        [c, m, y, k] => [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)],
+        _ => return None,
+    };
+    finite(&rgb).then(|| rgb.map(|x| x.clamp(0.0, 1.0)))
+}
+
+/// `/LE` for a line, polyline or callout. Unknown names yield `None` so the control stays hidden.
+pub(crate) fn line_endings_of(d: &Dict) -> Option<Vec<LineEnding>> {
+    let parse = |name: &[u8]| std::str::from_utf8(name).ok().and_then(LineEnding::parse);
+    match d.name(b"Subtype")? {
+        b"Line" | b"PolyLine" => match d.get(b"LE") {
+            None => Some(vec![LineEnding::None, LineEnding::None]),
+            Some(o) => o.as_array().filter(|a| a.len() == 2)?.iter().map(|e| parse(e.as_name()?)).collect(),
+        },
+        b"FreeText" if d.contains(b"CL") => Some(vec![parse(d.name(b"LE").unwrap_or(b"None"))?]),
+        _ => None,
+    }
+}
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index c00f442856..1d85d0bd64 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -14,8 +14,36 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+use std::collections::{HashMap, HashSet};
+
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 
+mod create;
+mod draw;
+mod info;
+mod lookup;
+mod modify;
+mod types;
+
+#[cfg(test)]
+use create::num_array;
+pub use create::{add_annotation, callout_attach, orient_image_stamp};
+pub use draw::{AppearanceCache, set_appearance, with_missing_appearances, with_missing_appearances_cached};
+pub use info::{Props, Summary, is_comment_subtype, props, set_info, summaries};
+#[cfg(test)]
+use lookup::{ANNOTS_ENTRIES_COPIED, PageWalk, annot_dict, annot_ref};
+use lookup::{annots, page_ref};
+pub use lookup::{has_visible_fill_sign, is_fill_sign, isolate_annotation, page_refs, picture_rotation, set_annots, signature_image};
+pub(crate) use modify::n;
+pub use modify::{
+    add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, move_annotation, set_contents, set_fill, set_font_size,
+    set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
+};
+pub use types::{
+    AttachIcon, FillMark, LineEnding, Markup, Meta, NOTE_SIZE, NewAnnotation, NoteIcon, OverlayFont, OverlayLook, ReviewState, Rgb, Shape,
+    StampGroup, StampKind, Style, rect_quad,
+};
+
 pub mod appearance;
 pub mod links;
 
@@ -43,2596 +71,3 @@ pub enum AnnotError {
     #[error("{0}")]
     Cos(#[from] pdfcraft_cos::CosError),
 }
-
-pub type Rgb = [f64; 3];
-
-/// Text markup kinds (§12.5.6.10).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Markup {
-    Highlight,
-    Underline,
-    StrikeOut,
-    Squiggly,
-}
-
-impl Markup {
-    fn subtype(self) -> &'static str {
-        match self {
-            Markup::Highlight => "Highlight",
-            Markup::Underline => "Underline",
-            Markup::StrikeOut => "StrikeOut",
-            Markup::Squiggly => "Squiggly",
-        }
-    }
-}
-
-/// Text-annotation icon names (`/Name`). The first seven are the standard names ISO 32000-2
-/// §12.5.6.4, Table 175 asks every viewer to draw; the rest are further names in common use, which
-/// the same table allows ("Additional names may be supported as well").
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum NoteIcon {
-    #[default]
-    Comment,
-    Note,
-    Help,
-    Insert,
-    Key,
-    NewParagraph,
-    Paragraph,
-    Check,
-    Circle,
-    Cross,
-    CrossHairs,
-    Star,
-    RightArrow,
-    UpArrow,
-}
-
-impl NoteIcon {
-    pub fn name(self) -> &'static str {
-        match self {
-            NoteIcon::Comment => "Comment",
-            NoteIcon::Note => "Note",
-            NoteIcon::Help => "Help",
-            NoteIcon::Insert => "Insert",
-            NoteIcon::Key => "Key",
-            NoteIcon::NewParagraph => "NewParagraph",
-            NoteIcon::Paragraph => "Paragraph",
-            NoteIcon::Check => "Check",
-            NoteIcon::Circle => "Circle",
-            NoteIcon::Cross => "Cross",
-            NoteIcon::CrossHairs => "CrossHairs",
-            NoteIcon::Star => "Star",
-            NoteIcon::RightArrow => "RightArrow",
-            NoteIcon::UpArrow => "UpArrow",
-        }
-    }
-
-    /// Every icon, the standard names first.
-    pub const ALL: [NoteIcon; 14] = [
-        Self::Comment,
-        Self::Note,
-        Self::Help,
-        Self::Insert,
-        Self::Key,
-        Self::NewParagraph,
-        Self::Paragraph,
-        Self::Check,
-        Self::Circle,
-        Self::Cross,
-        Self::CrossHairs,
-        Self::Star,
-        Self::RightArrow,
-        Self::UpArrow,
-    ];
-
-    pub fn from_name(n: &str) -> Option<Self> {
-        Self::ALL.into_iter().find(|i| i.name() == n)
-    }
-}
-
-/// Fill & Sign marks (Acrobat's ✓, ✕, ●, ─).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum FillMark {
-    Check,
-    Cross,
-    Dot,
-    Line,
-}
-
-impl FillMark {
-    /// The `/Name` of the stamp PdfCraft draws for it.
-    pub fn name(self) -> &'static str {
-        match self {
-            FillMark::Check => "PCCheck",
-            FillMark::Cross => "PCCross",
-            FillMark::Dot => "PCDot",
-            FillMark::Line => "PCLine",
-        }
-    }
-
-    pub fn label(self) -> &'static str {
-        match self {
-            FillMark::Check => "Checkmark",
-            FillMark::Cross => "Cross",
-            FillMark::Dot => "Dot",
-            FillMark::Line => "Line",
-        }
-    }
-
-    /// The user-space box of the mark placed at `at` on a page turned by `rotation`: centred
-    /// there and sized in displayed axes, so a line runs across the page as displayed (#2392).
-    pub fn rect_at(self, at: [f64; 2], rotation: i64) -> [f64; 4] {
-        let (w, h) = if self == FillMark::Line { (36.0, 4.0) } else { (12.0, 12.0) };
-        let (w, h) = if matches!(rotation.rem_euclid(360), 90 | 270) { (h, w) } else { (w, h) };
-        [at[0] - w / 2.0, at[1] - h / 2.0, at[0] + w / 2.0, at[1] + h / 2.0]
-    }
-}
-
-/// The stamps of Acrobat's stamp palette (drawn in PdfCraft's own style).
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub enum StampKind {
-    // Standard business.
-    Approved,
-    Completed,
-    Confidential,
-    Draft,
-    Final,
-    ForComment,
-    ForPublicRelease,
-    InformationOnly,
-    NotApproved,
-    NotForPublicRelease,
-    PreliminaryResults,
-    Void,
-    // Sign here.
-    Accepted,
-    InitialHere,
-    Rejected,
-    SignHere,
-    Witness,
-    // Dynamic (with a "By … at …" line).
-    DynApproved,
-    DynConfidential,
-    DynReceived,
-    DynReviewed,
-    DynRevised,
-}
-
-/// The palette's sections.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum StampGroup {
-    Dynamic,
-    SignHere,
-    StandardBusiness,
-}
-
-impl StampKind {
-    pub const ALL: [StampKind; 22] = [
-        StampKind::DynApproved,
-        StampKind::DynConfidential,
-        StampKind::DynReceived,
-        StampKind::DynReviewed,
-        StampKind::DynRevised,
-        StampKind::Accepted,
-        StampKind::InitialHere,
-        StampKind::Rejected,
-        StampKind::SignHere,
-        StampKind::Witness,
-        StampKind::Approved,
-        StampKind::Completed,
-        StampKind::Confidential,
-        StampKind::Draft,
-        StampKind::Final,
-        StampKind::ForComment,
-        StampKind::ForPublicRelease,
-        StampKind::InformationOnly,
-        StampKind::NotApproved,
-        StampKind::NotForPublicRelease,
-        StampKind::PreliminaryResults,
-        StampKind::Void,
-    ];
-
-    pub fn group(self) -> StampGroup {
-        use StampKind::*;
-        match self {
-            DynApproved | DynConfidential | DynReceived | DynReviewed | DynRevised => StampGroup::Dynamic,
-            Accepted | InitialHere | Rejected | SignHere | Witness => StampGroup::SignHere,
-            _ => StampGroup::StandardBusiness,
-        }
-    }
-
-    /// The text on the stamp.
-    pub fn label(self) -> &'static str {
-        use StampKind::*;
-        match self {
-            Approved | DynApproved => "APPROVED",
-            Completed => "COMPLETED",
-            Confidential | DynConfidential => "CONFIDENTIAL",
-            Draft => "DRAFT",
-            Final => "FINAL",
-            ForComment => "FOR COMMENT",
-            ForPublicRelease => "FOR PUBLIC RELEASE",
-            InformationOnly => "INFORMATION ONLY",
-            NotApproved => "NOT APPROVED",
-            NotForPublicRelease => "NOT FOR PUBLIC RELEASE",
-            PreliminaryResults => "PRELIMINARY RESULTS",
-            Void => "VOID",
-            Accepted => "ACCEPTED",
-            InitialHere => "INITIAL HERE",
-            Rejected => "REJECTED",
-            SignHere => "SIGN HERE",
-            Witness => "WITNESS",
-            DynReceived => "RECEIVED",
-            DynReviewed => "REVIEWED",
-            DynRevised => "REVISED",
-        }
-    }
-
-    /// `/Name`: the standard stamp names of ISO 32000-2 Table 184 where one exists.
-    pub fn name(self) -> &'static str {
-        use StampKind::*;
-        match self {
-            Approved => "Approved",
-            Confidential => "Confidential",
-            Draft => "Draft",
-            Final => "Final",
-            ForComment => "ForComment",
-            ForPublicRelease => "ForPublicRelease",
-            NotApproved => "NotApproved",
-            NotForPublicRelease => "NotForPublicRelease",
-            Completed => "PCCompleted",
-            InformationOnly => "PCInformationOnly",
-            PreliminaryResults => "PCPreliminaryResults",
-            Void => "PCVoid",
-            Accepted => "PCAccepted",
-            InitialHere => "PCInitialHere",
-            Rejected => "PCRejected",
-            SignHere => "PCSignHere",
-            Witness => "PCWitness",
-            DynApproved => "PCDynApproved",
-            DynConfidential => "PCDynConfidential",
-            DynReceived => "PCDynReceived",
-            DynReviewed => "PCDynReviewed",
-            DynRevised => "PCDynRevised",
-        }
-    }
-
-    pub fn from_name(n: &[u8]) -> Option<Self> {
-        Self::ALL.into_iter().find(|k| k.name().as_bytes() == n)
-    }
-
-    /// The stamp's colour: green for approval, red for refusal and restriction, blue otherwise.
-    pub fn color(self) -> Rgb {
-        use StampKind::*;
-        match self {
-            Approved | Completed | Final | Accepted | DynApproved | DynReceived | DynReviewed => [0.13, 0.55, 0.13],
-            NotApproved | Rejected | Void | Confidential | NotForPublicRelease | DynConfidential => [0.80, 0.10, 0.10],
-            SignHere | InitialHere | Witness => [0.85, 0.35, 0.05],
-            _ => [0.10, 0.30, 0.70],
-        }
-    }
-
-    /// The stamp's size (points) for its label, as placed with a click.
-    pub fn size(self) -> (f64, f64) {
-        let w = appearance::text_width(self.label(), 16.0) * 1.12 + 24.0;
-        let h = if self.group() == StampGroup::Dynamic { 42.0 } else { 30.0 };
-        let w = if self.group() == StampGroup::SignHere { w + 14.0 } else { w };
-        (w.max(80.0), h)
-    }
-}
-
-/// A line ending (`/LE`): the ten styles in ISO 32000-2 Table 217.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum LineEnding {
-    None,
-    Square,
-    Circle,
-    Diamond,
-    OpenArrow,
-    ClosedArrow,
-    Butt,
-    ROpenArrow,
-    RClosedArrow,
-    Slash,
-}
-
-impl LineEnding {
-    pub const ALL: [Self; 10] = [
-        Self::None,
-        Self::Square,
-        Self::Circle,
-        Self::Diamond,
-        Self::OpenArrow,
-        Self::ClosedArrow,
-        Self::Butt,
-        Self::ROpenArrow,
-        Self::RClosedArrow,
-        Self::Slash,
-    ];
-
-    pub fn name(self) -> &'static str {
-        match self {
-            Self::None => "None",
-            Self::Square => "Square",
-            Self::Circle => "Circle",
-            Self::Diamond => "Diamond",
-            Self::OpenArrow => "OpenArrow",
-            Self::ClosedArrow => "ClosedArrow",
-            Self::Butt => "Butt",
-            Self::ROpenArrow => "ROpenArrow",
-            Self::RClosedArrow => "RClosedArrow",
-            Self::Slash => "Slash",
-        }
-    }
-
-    pub fn parse(name: &str) -> Option<Self> {
-        Self::ALL.into_iter().find(|ending| ending.name() == name)
-    }
-}
-
-/// Geometry of a new comment, in PDF user space of its page.
-#[derive(Clone, Debug, PartialEq)]
-pub enum Shape {
-    /// A sticky note whose icon's top-left corner is at `at`.
-    Note {
-        at: [f64; 2],
-        icon: NoteIcon,
-    },
-    /// Text markup over quadrilaterals: `[x1 y1 x2 y2 x3 y3 x4 y4]` = top-left, top-right,
-    /// bottom-left, bottom-right (the order Acrobat writes, §12.5.6.10).
-    TextMarkup {
-        kind: Markup,
-        quads: Vec<[f64; 8]>,
-    },
-    Rectangle {
-        rect: [f64; 4],
-    },
-    Oval {
-        rect: [f64; 4],
-    },
-    /// A line. An open arrow at `to` is `start: None`, `end: OpenArrow` (the Arrow tool).
-    Line {
-        from: [f64; 2],
-        to: [f64; 2],
-        start: LineEnding,
-        end: LineEnding,
-    },
-    /// Freehand strokes (Draw tool).
-    Ink {
-        strokes: Vec<Vec<[f64; 2]>>,
-    },
-    /// A text box (FreeText) showing the comment's contents.
-    TextBox {
-        rect: [f64; 4],
-        font_size: f64,
-    },
-    /// Fill & Sign text typed onto the page (FreeText, typewriter intent, no border).
-    Typewriter {
-        rect: [f64; 4],
-        font_size: f64,
-    },
-    /// A Fill & Sign mark in `rect`.
-    Mark {
-        rect: [f64; 4],
-        mark: FillMark,
-    },
-    /// A drawn signature (ink strokes).
-    Signature {
-        strokes: Vec<Vec<[f64; 2]>>,
-    },
-    /// A rubber stamp from the stamp palette; `by` is the dynamic stamps' second line.
-    Stamp {
-        rect: [f64; 4],
-        stamp: StampKind,
-        by: Option<String>,
-    },
-    /// A typed signature or initials: filled outlines (each contour as points normalised to
-    /// `rect`, 0–1, y up), drawn with the non-zero winding rule.
-    TypedSignature {
-        rect: [f64; 4],
-        contours: Vec<Vec<[f64; 2]>>,
-    },
-    /// A custom stamp: a picture already in the document (an image XObject, or a form XObject
-    /// whose `/Matrix` maps it to `size` points) filling `rect`, named `name`.
-    CustomStamp {
-        rect: [f64; 4],
-        name: String,
-        picture: ObjRef,
-        image: bool,
-        size: (f64, f64),
-    },
-    /// A redaction mark (§12.5.6.23) over quadrilaterals (text) or one rectangle as a quad
-    /// (areas, pages). `overlay` is the text shown on the box once applied, drawn with `look`.
-    Redact {
-        quads: Vec<[f64; 8]>,
-        overlay: String,
-        look: OverlayLook,
-    },
-    /// A closed polygon (Polygon tool); with `cloud`, Acrobat's Cloud tool: the same polygon
-    /// with a cloudy border (`/BE /S /C`, `/IT /PolygonCloud`).
-    Polygon {
-        vertices: Vec<[f64; 2]>,
-        cloud: bool,
-    },
-    /// Connected lines (Polygonal Line tool). `start` is the first vertex, `end` the last.
-    PolyLine {
-        vertices: Vec<[f64; 2]>,
-        start: LineEnding,
-        end: LineEnding,
-    },
-    /// A text callout: a text box at `rect` with a leader line from `point` (arrowhead) via
-    /// `knee` to the box (FreeText, `/IT /FreeTextCallout`, `/CL`).
-    Callout {
-        rect: [f64; 4],
-        knee: [f64; 2],
-        point: [f64; 2],
-        font_size: f64,
-        ending: LineEnding,
-    },
-    /// Insert text: a caret in `rect` (its point at the top centre).
-    Caret {
-        rect: [f64; 4],
-    },
-    /// Attach a file as a comment: an icon whose top-left corner is at `at`, holding `data`
-    /// (embedded) under the name `file`.
-    Attachment {
-        at: [f64; 2],
-        icon: AttachIcon,
-        file: String,
-        data: Vec<u8>,
-    },
-}
-
-/// The standard file attachment icons (§12.5.6.15).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub enum AttachIcon {
-    #[default]
-    PushPin,
-    Paperclip,
-    Graph,
-    Tag,
-}
-
-impl AttachIcon {
-    pub const ALL: [AttachIcon; 4] = [AttachIcon::PushPin, AttachIcon::Paperclip, AttachIcon::Graph, AttachIcon::Tag];
-    pub fn name(self) -> &'static str {
-        match self {
-            AttachIcon::PushPin => "PushPin",
-            AttachIcon::Paperclip => "Paperclip",
-            AttachIcon::Graph => "Graph",
-            AttachIcon::Tag => "Tag",
-        }
-    }
-    pub fn from_name(n: &str) -> Option<AttachIcon> {
-        Self::ALL.into_iter().find(|i| i.name().eq_ignore_ascii_case(n))
-    }
-}
-
-/// A rectangle `[x0 y0 x1 y1]` as a quad in Acrobat's order (top-left, top-right, bottom-left,
-/// bottom-right).
-pub fn rect_quad(r: [f64; 4]) -> [f64; 8] {
-    let [x0, y0, x1, y1] = normalize(r);
-    [x0, y1, x1, y1, x0, y0, x1, y0]
-}
-
-impl Shape {
-    pub fn subtype(&self) -> &'static str {
-        match self {
-            Shape::Note { .. } => "Text",
-            Shape::TextMarkup { kind, .. } => kind.subtype(),
-            Shape::Rectangle { .. } => "Square",
-            Shape::Oval { .. } => "Circle",
-            Shape::Line { .. } => "Line",
-            Shape::Ink { .. } | Shape::Signature { .. } => "Ink",
-            Shape::TextBox { .. } | Shape::Typewriter { .. } | Shape::Callout { .. } => "FreeText",
-            Shape::Mark { .. } | Shape::Stamp { .. } | Shape::CustomStamp { .. } | Shape::TypedSignature { .. } => "Stamp",
-            Shape::Redact { .. } => "Redact",
-            Shape::Polygon { .. } => "Polygon",
-            Shape::PolyLine { .. } => "PolyLine",
-            Shape::Caret { .. } => "Caret",
-            Shape::Attachment { .. } => "FileAttachment",
-        }
-    }
-}
-
-/// The standard fonts of redaction overlay text.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub enum OverlayFont {
-    #[default]
-    Helvetica,
-    Times,
-    Courier,
-}
-
-impl OverlayFont {
-    pub const ALL: [OverlayFont; 3] = [OverlayFont::Helvetica, OverlayFont::Times, OverlayFont::Courier];
-
-    pub fn name(self) -> &'static str {
-        match self {
-            OverlayFont::Helvetica => "Helvetica",
-            OverlayFont::Times => "Times Roman",
-            OverlayFont::Courier => "Courier",
-        }
-    }
-
-    /// The `/DA` font resource name (Acrobat's form font names).
-    pub fn resource(self) -> &'static str {
-        match self {
-            OverlayFont::Helvetica => "Helv",
-            OverlayFont::Times => "TiRo",
-            OverlayFont::Courier => "Cour",
-        }
-    }
-
-    pub fn from_resource(n: &str) -> OverlayFont {
-        match n {
-            "TiRo" | "Times-Roman" | "TimesRoman" => OverlayFont::Times,
-            "Cour" | "Courier" => OverlayFont::Courier,
-            _ => OverlayFont::Helvetica,
-        }
-    }
-}
-
-/// How redaction overlay text is drawn (Redaction Properties ▸ Appearance).
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct OverlayLook {
-    pub font: OverlayFont,
-    /// Points; 0 = auto-size to fit the area.
-    pub size: f64,
-    pub color: Rgb,
-    /// 0 left, 1 centre, 2 right.
-    pub align: u8,
-    /// Repeat the text to fill the area.
-    pub repeat: bool,
-}
-
-impl Default for OverlayLook {
-    fn default() -> Self {
-        Self { font: OverlayFont::Helvetica, size: 0.0, color: [1.0, 0.0, 0.0], align: 1, repeat: false }
-    }
-}
-
-/// How a comment looks.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Style {
-    /// Stroke colour (text colour for text boxes, icon colour for notes).
-    pub color: Rgb,
-    /// 0–1 (`/CA`).
-    pub opacity: f64,
-    /// Border / stroke width in points (0 = none).
-    pub width: f64,
-    /// Interior fill for rectangles and ovals (`/IC`), background for text boxes.
-    pub fill: Option<Rgb>,
-}
-
-impl Default for Style {
-    fn default() -> Self {
-        Self { color: [1.0, 0.82, 0.0], opacity: 1.0, width: 1.0, fill: None }
-    }
-}
-
-impl Style {
-    /// The default look of each commenting tool.
-    pub fn default_for(shape: &Shape) -> Self {
-        let (color, width) = match shape {
-            Shape::Note { .. } => ([1.0, 0.82, 0.0], 1.0),
-            Shape::TextMarkup { kind: Markup::Highlight, .. } => ([1.0, 0.94, 0.0], 1.0),
-            Shape::TextMarkup { kind: Markup::Underline, .. } => ([0.0, 0.47, 0.84], 1.0),
-            Shape::TextMarkup { kind: Markup::StrikeOut, .. } => ([0.89, 0.13, 0.13], 1.0),
-            Shape::TextMarkup { kind: Markup::Squiggly, .. } => ([0.18, 0.62, 0.36], 1.0),
-            Shape::Rectangle { .. } | Shape::Oval { .. } | Shape::Line { .. } | Shape::Polygon { .. } | Shape::PolyLine { .. } => {
-                ([0.89, 0.13, 0.13], 2.0)
-            }
-            Shape::Callout { .. } => ([0.0, 0.0, 0.0], 1.0),
-            Shape::Caret { .. } | Shape::Attachment { .. } => ([0.0, 0.47, 0.84], 1.0),
-            Shape::Ink { .. } => ([0.0, 0.4, 0.87], 2.0),
-            Shape::TextBox { .. } | Shape::Typewriter { .. } => ([0.0, 0.0, 0.0], 0.0),
-            Shape::Mark { .. } => ([0.0, 0.0, 0.0], 1.5),
-            Shape::Signature { .. } => ([0.0, 0.0, 0.0], 1.5),
-            Shape::Stamp { stamp, .. } => (stamp.color(), 2.0),
-            Shape::CustomStamp { .. } => ([0.0, 0.0, 0.0], 0.0),
-            Shape::TypedSignature { .. } => ([0.0, 0.0, 0.0], 0.0),
-            // Red outline while marked; a black box once applied.
-            Shape::Redact { .. } => return Self { color: [0.89, 0.13, 0.13], opacity: 1.0, width: 1.0, fill: Some([0.0, 0.0, 0.0]) },
-        };
-        Self { color, opacity: 1.0, width, fill: None }
-    }
-}
-
-/// A comment to add.
-#[derive(Clone, Debug, PartialEq)]
-pub struct NewAnnotation {
-    /// 0-based page index.
-    pub page: usize,
-    pub shape: Shape,
-    pub style: Style,
-    /// The comment text (`/Contents`); the text shown by a text box.
-    pub contents: String,
-    /// `/T` (shown as the comment's author).
-    pub author: String,
-}
-
-/// Values stamped onto what an edit creates or changes, supplied by the caller so edits stay
-/// deterministic: a PDF date (`D:…`) and a unique id for `/NM`.
-#[derive(Clone, Debug, PartialEq, Default)]
-pub struct Meta {
-    pub date: Option<String>,
-    pub id: String,
-}
-
-/// Review states a reply can set (§12.5.6.3, Table 172; Acrobat's "Set status").
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum ReviewState {
-    None,
-    Accepted,
-    Rejected,
-    Cancelled,
-    Completed,
-}
-
-impl ReviewState {
-    pub fn name(self) -> &'static str {
-        match self {
-            ReviewState::None => "None",
-            ReviewState::Accepted => "Accepted",
-            ReviewState::Rejected => "Rejected",
-            ReviewState::Cancelled => "Cancelled",
-            ReviewState::Completed => "Completed",
-        }
-    }
-
-    pub fn from_name(n: &str) -> Option<Self> {
-        [Self::None, Self::Accepted, Self::Rejected, Self::Cancelled, Self::Completed].into_iter().find(|s| s.name().eq_ignore_ascii_case(n))
-    }
-}
-
-// ── pages and /Annots ───────────────────────────────────────────────────────────────────────
-
-/// The page object of each leaf page, in order.
-pub fn page_refs(doc: &Document) -> Result<Vec<ObjRef>, AnnotError> {
-    let root = doc.root().ok_or(AnnotError::NoPageTree)?;
-    let pages = doc.get(root).as_dict().and_then(|d| d.reference(b"Pages")).ok_or(AnnotError::NoPageTree)?;
-    Ok(PageWalk::new(doc, pages).collect())
-}
-
-/// Depth-first walk over the leaf pages under `top`. It keeps one cursor per open `/Kids` array,
-/// never one entry per child, so a child listed many times or shared between nodes is skipped by
-/// the seen check without being queued first (`pdfcraft_model::pages` walks the same way).
-/// Cycles end at the seen check, a `/Kids` array object shared by several nodes is read once,
-/// and at most a million nodes and four million `/Kids` entries are read.
-struct PageWalk<'a> {
-    doc: &'a Document,
-    seen: std::collections::HashSet<ObjRef>,
-    pending: Vec<(std::sync::Arc<Object>, usize)>,
-    /// `/Kids` entries read so far.
-    examined: usize,
-}
-
-impl<'a> PageWalk<'a> {
-    fn new(doc: &'a Document, top: ObjRef) -> Self {
-        let top = std::sync::Arc::new(Object::Array(vec![Object::Ref(top)]));
-        Self { doc, seen: Default::default(), pending: vec![(top, 0)], examined: 0 }
-    }
-}
-
-impl Iterator for PageWalk<'_> {
-    type Item = ObjRef;
-
-    fn next(&mut self) -> Option<ObjRef> {
-        while let Some((kids, next)) = self.pending.last_mut() {
-            let Some(kid) = kids.as_array().and_then(|a| a.get(*next)) else {
-                self.pending.pop();
-                continue;
-            };
-            let node = kid.as_ref();
-            *next += 1;
-            self.examined += 1;
-            let Some(node) = node else { continue };
-            if self.seen.len() >= 1_000_000 || self.examined > 4_000_000 {
-                self.pending.clear();
-                return None;
-            }
-            if !self.seen.insert(node) {
-                continue;
-            }
-            let obj = self.doc.get(node);
-            let Some(d) = obj.as_dict() else { continue };
-            match d.get(b"Kids") {
-                // A `/Kids` array object shared by several nodes is read under the first: under
-                // the others it would only list nodes already seen.
-                Some(Object::Ref(array)) if d.name(b"Type") != Some(b"Page") => {
-                    if self.seen.insert(*array) {
-                        self.pending.push((self.doc.get(*array), 0));
-                    }
-                }
-                Some(kids) if d.name(b"Type") != Some(b"Page") => self.pending.push((self.doc.resolve(kids), 0)),
-                _ => return Some(node),
-            }
-        }
-        None
-    }
-}
-
-fn page_ref(doc: &Document, page: usize) -> Result<ObjRef, AnnotError> {
-    page_refs(doc)?.get(page).copied().ok_or(AnnotError::NoSuchPage(page))
-}
-
-/// The entries of a page's `/Annots` (references or inline dictionaries).
-fn annots(doc: &Document, page: ObjRef) -> Vec<Object> {
-    let obj = doc.get(page);
-    let Some(a) = obj.as_dict().and_then(|d| d.get(b"Annots")) else { return Vec::new() };
-    let list = doc.resolve(a).as_array().cloned().unwrap_or_default();
-    #[cfg(test)]
-    ANNOTS_ENTRIES_COPIED.with(|n| n.set(n.get() + list.len()));
-    list
-}
-
-#[cfg(test)]
-thread_local! {
-    /// Entries copied out of pages' `/Annots` arrays.
-    static ANNOTS_ENTRIES_COPIED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-/// Replace a page's `/Annots`, writing into the shared array object when it is indirect.
-fn set_annots(doc: &mut Document, page: ObjRef, list: Vec<Object>) -> Result<(), AnnotError> {
-    let existing = doc.get(page).as_dict().and_then(|d| d.reference(b"Annots"));
-    match existing {
-        Some(r) if doc.get(r).as_array().is_some() => doc.set(r, Object::Array(list)),
-        _ => doc.update_dict(page, |d| {
-            if list.is_empty() {
-                d.remove(b"Annots");
-            } else {
-                d.set(b"Annots".to_vec(), Object::Array(list));
-            }
-        })?,
-    }
-    Ok(())
-}
-
-/// The annotation at `(page, index)` as an indirect object (inline dictionaries are promoted).
-fn annot_ref(doc: &mut Document, page: usize, index: usize) -> Result<(ObjRef, ObjRef), AnnotError> {
-    let p = page_ref(doc, page)?;
-    let mut list = annots(doc, p);
-    let entry = list.get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    let r = match entry {
-        Object::Ref(r) if doc.get(r).as_dict().is_some() => r,
-        Object::Dict(d) => {
-            let r = doc.add(Object::Dict(d));
-            list[index] = Object::Ref(r);
-            set_annots(doc, p, list)?;
-            r
-        }
-        _ => return Err(AnnotError::NoSuchAnnotation { page, index }),
-    };
-    Ok((p, r))
-}
-
-fn annot_dict(doc: &Document, r: ObjRef) -> Dict {
-    doc.get(r).as_dict().cloned().unwrap_or_default()
-}
-
-/// A Fill & Sign item: typed text, a check/cross/dot/line, or a typed, drawn or image signature.
-///
-/// New items carry `/PCFillSign`. Older files are recognised from the dictionaries PdfCraft
-/// already writes (`/IT /FreeTextTypeWriter`, stamp `/Name`, drawn ink whose subject is
-/// "Signature").
-pub fn is_fill_sign(doc: &Document, d: &Dict) -> bool {
-    if matches!(d.get(b"PCFillSign").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true))) {
-        return true;
-    }
-    let subtype = d.name(b"Subtype").unwrap_or_default();
-    if subtype == b"FreeText" && d.name(b"IT") == Some(b"FreeTextTypeWriter") {
-        return true;
-    }
-    if subtype == b"Stamp" {
-        if matches!(d.name(b"Name"), Some(b"PCCheck" | b"PCCross" | b"PCDot" | b"PCLine" | b"PCTypedSignature")) {
-            return true;
-        }
-        if matches!(d.name(b"Name"), Some(b"PCCustomSignature" | b"PCCustomInitials"))
-            && matches!(d.get(b"PCPictureImage").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true)))
-        {
-            return true;
-        }
-    }
-    subtype == b"Ink" && text_value(doc, d, b"Subj").as_deref() == Some("Signature")
-}
-
-fn annotation_flags(doc: &Document, d: &Dict) -> i64 {
-    d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0)
-}
-
-/// Whether the renderer keeps the annotation upright on a turned page: the NoRotate flag, with
-/// `/F` read as the renderer reads it (a real truncated, a value that isn't a `u32` no flags).
-fn drawn_upright(doc: &Document, d: &Dict) -> bool {
-    let f = match d.get(b"F").map(|f| doc.resolve(f)).as_deref() {
-        Some(Object::Int(i)) => *i,
-        Some(Object::Real(r)) => *r as i64,
-        _ => 0,
-    };
-    u32::try_from(f).is_ok_and(|f| i64::from(f) & FLAG_NO_ROTATE != 0)
-}
-
-/// Whether any page has a Fill & Sign annotation that flatten would bake in (not hidden).
-pub fn has_visible_fill_sign(doc: &Document) -> bool {
-    let Ok(pages) = page_refs(doc) else { return false };
-    for page in pages {
-        for entry in annots(doc, page) {
-            let obj = doc.resolve(&entry);
-            let Some(d) = obj.as_dict() else { continue };
-            let flags = annotation_flags(doc, d);
-            if flags & (FLAG_HIDDEN | FLAG_NO_VIEW) != 0 {
-                continue;
-            }
-            if is_fill_sign(doc, d) {
-                return true;
-            }
-        }
-    }
-    false
-}
-
-fn fill_sign_shape(shape: &Shape) -> bool {
-    match shape {
-        Shape::Typewriter { .. } | Shape::Mark { .. } | Shape::Signature { .. } | Shape::TypedSignature { .. } => true,
-        Shape::CustomStamp { name, image: true, .. } => name == "Signature" || name == "Initials",
-        _ => false,
-    }
-}
-
-/// The embedded image of a Fill & Sign image signature or initials (0-based target).
-/// Other stamps have appearances that can't be represented by this image alone.
-pub fn signature_image(doc: &Document, page: usize, index: usize) -> Result<Option<ObjRef>, AnnotError> {
-    let p = page_ref(doc, page)?;
-    let list = annots(doc, p);
-    let entry = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    let obj = doc.resolve(entry);
-    let Some(d) = obj.as_dict() else { return Ok(None) };
-    Ok((d.name(b"Subtype") == Some(b"Stamp")
-        && matches!(d.name(b"Name"), Some(b"PCCustomSignature" | b"PCCustomInitials"))
-        && matches!(d.get(b"PCPictureImage"), Some(Object::Bool(true))))
-    .then(|| d.reference(b"PCPicture"))
-    .flatten())
-}
-
-/// The page `/Rotate` the picture of the image signature at `(page, index)` is drawn turned back
-/// by, so it reads upright on a page shown that way: 0 for one added to an unturned page, or by
-/// another app. The picture appears turned by the page's current rotation less this.
-pub fn picture_rotation(doc: &Document, page: usize, index: usize) -> Result<i64, AnnotError> {
-    let p = page_ref(doc, page)?;
-    let list = annots(doc, p);
-    let entry = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    Ok(doc.resolve(entry).as_dict().map_or(0, appearance::picture_turn))
-}
-
-/// Leave page `page` of (a copy of) a document showing only its annotation at `index`, without
-/// the page's content or other annotations, so a render draws that annotation alone: to lay it
-/// over the page while it is dragged. `false`, with `doc` unchanged, when the annotation has no
-/// normal appearance (`/AP /N`) for that render to draw.
-pub fn isolate_annotation(doc: &mut Document, page: usize, index: usize) -> Result<bool, AnnotError> {
-    let p = page_ref(doc, page)?;
-    let entry = annots(doc, p).get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    let has_normal = {
-        let obj = doc.resolve(&entry);
-        obj.as_dict().and_then(|d| d.get(b"AP")).is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N")))
-    };
-    if !has_normal {
-        return Ok(false);
-    }
-    set_annots(doc, p, vec![entry])?;
-    doc.update_dict(p, |d| {
-        d.remove(b"Contents");
-    })?;
-    Ok(true)
-}
-
-// ── building ────────────────────────────────────────────────────────────────────────────────
-
-/// Annotation flags (§12.5.3).
-const FLAG_PRINT: i64 = 4;
-const FLAG_NO_ZOOM: i64 = 8;
-const FLAG_NO_ROTATE: i64 = 16;
-const FLAG_HIDDEN: i64 = 2;
-const FLAG_NO_VIEW: i64 = 32;
-const FLAG_LOCKED: i64 = 128;
-
-/// Size of a note icon (points, unscaled by zoom).
-pub const NOTE_SIZE: f64 = 20.0;
-
-fn num_array(v: &[f64]) -> Object {
-    Object::Array(v.iter().map(|x| Object::Real(*x)).collect())
-}
-
-fn rgb(c: Rgb) -> Object {
-    num_array(&c.map(|x| x.clamp(0.0, 1.0)))
-}
-
-fn finite(v: &[f64]) -> bool {
-    v.iter().all(|x| x.is_finite() && x.abs() < 1e7)
-}
-
-fn normalize(r: [f64; 4]) -> [f64; 4] {
-    [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]
-}
-
-fn bounds(points: impl Iterator<Item = [f64; 2]>) -> Option<[f64; 4]> {
-    points.fold(None, |acc, [x, y]| match acc {
-        None => Some([x, y, x, y]),
-        Some([a, b, c, d]) => Some([a.min(x), b.min(y), c.max(x), d.max(y)]),
-    })
-}
-
-fn grow(r: [f64; 4], by: f64) -> [f64; 4] {
-    [r[0] - by, r[1] - by, r[2] + by, r[3] + by]
-}
-
-fn ending_draws(ending: LineEnding) -> bool {
-    ending != LineEnding::None
-}
-
-fn ending_pair(start: LineEnding, end: LineEnding) -> Object {
-    Object::Array(vec![Object::name(start.name()), Object::name(end.name())])
-}
-
-/// Validate and compute `/Rect` for a new comment.
-fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotError> {
-    let bad = |what: &str| AnnotError::Invalid(format!("invalid {what}"));
-    let half = style.width.max(0.0) / 2.0;
-    let r = match shape {
-        Shape::Note { at, .. } | Shape::Attachment { at, .. } => {
-            if !finite(at) {
-                return Err(bad("position"));
-            }
-            [at[0], at[1] - NOTE_SIZE, at[0] + NOTE_SIZE, at[1]]
-        }
-        Shape::TextMarkup { quads, .. } | Shape::Redact { quads, .. } => {
-            if quads.is_empty() || !quads.iter().all(|q| finite(q)) {
-                return Err(bad("text area (no quadrilaterals)"));
-            }
-            bounds(quads.iter().flat_map(|q| q.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect::<Vec<_>>()))
-                .ok_or_else(|| bad("text area"))?
-        }
-        Shape::Rectangle { rect }
-        | Shape::Oval { rect }
-        | Shape::TextBox { rect, .. }
-        | Shape::Typewriter { rect, .. }
-        | Shape::Stamp { rect, .. }
-        | Shape::TypedSignature { rect, .. }
-        | Shape::Mark { rect, .. } => {
-            let r = normalize(*rect);
-            if !finite(rect) || r[2] - r[0] < 1.0 || r[3] - r[1] < 1.0 {
-                return Err(bad("rectangle (too small)"));
-            }
-            r
-        }
-        Shape::CustomStamp { rect, .. } => {
-            let r = normalize(*rect);
-            // Image signatures may be very thin; a positive PDF appearance box still works.
-            if !finite(rect) || r[2] <= r[0] || r[3] <= r[1] {
-                return Err(bad("rectangle (empty)"));
-            }
-            r
-        }
-        Shape::Line { from, to, start, end } => {
-            if !finite(from) || !finite(to) || (from[0] - to[0]).hypot(from[1] - to[1]) < 1.0 {
-                return Err(bad("line (too short)"));
-            }
-            let pad = half + if ending_draws(*start) || ending_draws(*end) { appearance::arrow_size(style.width) } else { 0.0 };
-            grow(bounds([*from, *to].into_iter()).unwrap_or_default(), pad + 1.0)
-        }
-        Shape::Ink { strokes } | Shape::Signature { strokes } => {
-            if strokes.iter().all(Vec::is_empty) || !strokes.iter().flatten().all(|p| finite(p)) {
-                return Err(bad("drawing (no points)"));
-            }
-            // Strokes of three or more points are drawn as curves, which stay within their
-            // points and control points.
-            let controls = strokes.iter().filter(|s| s.len() > 2).flat_map(|s| {
-                let pts: Vec<(f64, f64)> = s.iter().map(|p| (p[0], p[1])).collect();
-                appearance::smooth_segments(&pts).into_iter().flat_map(|[a, b, _]| [[a.0, a.1], [b.0, b.1]])
-            });
-            grow(bounds(strokes.iter().flatten().copied().chain(controls)).unwrap_or_default(), half + 1.0)
-        }
-        Shape::Polygon { vertices, cloud } => {
-            let b = bounds(vertices.iter().copied())
-                .filter(|b| vertices.len() >= 3 && vertices.iter().all(|p| finite(p)) && b[2] - b[0] >= 1.0 && b[3] - b[1] >= 1.0);
-            let b = b.ok_or_else(|| bad("polygon (it needs three points)"))?;
-            grow(b, half + 1.0 + if *cloud { 1.5 * appearance::cloud_radius(style.width) } else { 0.0 })
-        }
-        Shape::PolyLine { vertices, start, end } => {
-            let b = bounds(vertices.iter().copied())
-                .filter(|b| vertices.len() >= 2 && vertices.iter().all(|p| finite(p)) && (b[2] - b[0]).max(b[3] - b[1]) >= 1.0);
-            let extra = if ending_draws(*start) || ending_draws(*end) { appearance::arrow_size(style.width) } else { 0.0 };
-            grow(b.ok_or_else(|| bad("connected lines (they need two points)"))?, half + 1.0 + extra)
-        }
-        Shape::Callout { rect, knee, point, .. } => {
-            let r = normalize(*rect);
-            if !finite(rect) || !finite(knee) || !finite(point) || r[2] - r[0] < 1.0 || r[3] - r[1] < 1.0 {
-                return Err(bad("callout"));
-            }
-            let pad = half + appearance::arrow_size(style.width) + 1.0;
-            let lead = grow(bounds([*knee, *point].into_iter()).unwrap_or_default(), pad);
-            [r[0].min(lead[0]), r[1].min(lead[1]), r[2].max(lead[2]), r[3].max(lead[3])]
-        }
-        Shape::Caret { rect } => {
-            let r = normalize(*rect);
-            if !finite(rect) || r[2] - r[0] < 1.0 || r[3] - r[1] < 1.0 {
-                return Err(bad("caret"));
-            }
-            r
-        }
-    };
-    Ok(r)
-}
-
-fn base_dict(subtype: &str, rect: [f64; 4], page: ObjRef, contents: &str, author: &str, meta: &Meta) -> Dict {
-    let mut d = Dict::new();
-    d.set(b"Type".to_vec(), Object::name("Annot"));
-    d.set(b"Subtype".to_vec(), Object::name(subtype));
-    d.set(b"Rect".to_vec(), num_array(&rect));
-    d.set(b"Contents".to_vec(), PdfString::text(contents));
-    if !author.is_empty() {
-        d.set(b"T".to_vec(), PdfString::text(author));
-    }
-    if let Some(date) = &meta.date {
-        d.set(b"M".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
-        d.set(b"CreationDate".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
-    }
-    if !meta.id.is_empty() {
-        d.set(b"NM".to_vec(), PdfString::text(&meta.id));
-    }
-    d.set(b"P".to_vec(), Object::Ref(page));
-    d.set(b"F".to_vec(), Object::Int(FLAG_PRINT));
-    d
-}
-
-/// Acrobat's `/Subj` for each tool (shown as the comment type in other viewers).
-fn subject(shape: &Shape) -> &'static str {
-    match shape {
-        Shape::Note { .. } => "Sticky Note",
-        Shape::TextMarkup { kind: Markup::Highlight, .. } => "Highlight",
-        Shape::TextMarkup { kind: Markup::Underline, .. } => "Underline",
-        Shape::TextMarkup { kind: Markup::StrikeOut, .. } => "Strikethrough",
-        Shape::TextMarkup { kind: Markup::Squiggly, .. } => "Squiggly",
-        Shape::Rectangle { .. } => "Rectangle",
-        Shape::Oval { .. } => "Oval",
-        Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Arrow",
-        Shape::Line { .. } => "Line",
-        Shape::Ink { .. } => "Pencil",
-        Shape::TextBox { .. } => "Text Box",
-        Shape::Typewriter { .. } => "Typewriter",
-        Shape::Mark { mark, .. } => mark.label(),
-        Shape::Signature { .. } => "Signature",
-        Shape::Redact { .. } => "Redact",
-        Shape::Stamp { stamp, .. } => match stamp.group() {
-            StampGroup::Dynamic => "Dynamic stamp",
-            StampGroup::SignHere => "Sign Here",
-            StampGroup::StandardBusiness => "Stamp",
-        },
-        Shape::CustomStamp { .. } => "Stamp",
-        Shape::TypedSignature { .. } => "Signature",
-        Shape::Polygon { cloud: true, .. } => "Cloud",
-        Shape::Polygon { .. } => "Polygon",
-        Shape::PolyLine { .. } => "Polygonal Line",
-        Shape::Callout { .. } => "Callout",
-        Shape::Caret { .. } => "Inserted Text",
-        Shape::Attachment { .. } => "File Attachment",
-    }
-}
-
-/// Where a callout's leader line meets its text box: the middle of the side facing `knee`.
-pub fn callout_attach(rect: [f64; 4], knee: [f64; 2]) -> [f64; 2] {
-    let [x0, y0, x1, y1] = normalize(rect);
-    let (cx, cy) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0);
-    if knee[0] < x0 {
-        [x0, cy]
-    } else if knee[0] > x1 {
-        [x1, cy]
-    } else if knee[1] > y1 {
-        [cx, y1]
-    } else {
-        [cx, y0]
-    }
-}
-
-/// Add a comment; returns its index in the page's `/Annots`.
-pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> Result<usize, AnnotError> {
-    let page = page_ref(doc, new.page)?;
-    let style = &new.style;
-    if !finite(&style.color) || !style.opacity.is_finite() || !style.width.is_finite() {
-        return Err(AnnotError::Invalid("invalid style".into()));
-    }
-    let rect = rect_for(&new.shape, style)?;
-    let mut d = base_dict(new.shape.subtype(), rect, page, &new.contents, &new.author, meta);
-    d.set(b"Subj".to_vec(), PdfString::text(subject(&new.shape)));
-    let opacity = style.opacity.clamp(0.0, 1.0);
-    if opacity < 1.0 {
-        d.set(b"CA".to_vec(), Object::Real(opacity));
-    }
-    let border = |d: &mut Dict| {
-        let mut bs = Dict::new();
-        bs.set(b"W".to_vec(), Object::Real(style.width.max(0.0)));
-        bs.set(b"S".to_vec(), Object::name("S"));
-        d.set(b"BS".to_vec(), Object::Dict(bs));
-    };
-    let mut popup = None;
-    match &new.shape {
-        Shape::Note { icon, .. } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"Name".to_vec(), Object::name(icon.name()));
-            d.set(b"F".to_vec(), Object::Int(FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
-            d.set(b"Open".to_vec(), Object::Bool(false));
-            popup = Some([rect[2] + 10.0, rect[3] - 120.0, rect[2] + 210.0, rect[3]]);
-        }
-        Shape::TextMarkup { quads, .. } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"QuadPoints".to_vec(), num_array(&quads.concat()));
-        }
-        Shape::Redact { quads, overlay, look } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"IC".to_vec(), rgb(style.fill.unwrap_or([0.0, 0.0, 0.0])));
-            d.set(b"QuadPoints".to_vec(), num_array(&quads.concat()));
-            if !overlay.is_empty() {
-                d.set(b"OverlayText".to_vec(), PdfString::text(overlay));
-                let [r, g, b] = look.color.map(|x| x.clamp(0.0, 1.0));
-                let size = if look.size > 0.0 { look.size.min(400.0) } else { 0.0 };
-                d.set(
-                    b"DA".to_vec(),
-                    PdfString::literal(format!("{} {} {} rg /{} {} Tf", n(r), n(g), n(b), look.font.resource(), n(size)).into_bytes()),
-                );
-                d.set(b"Q".to_vec(), Object::Int(look.align.min(2) as i64));
-                if look.repeat {
-                    d.set(b"Repeat".to_vec(), Object::Bool(true));
-                }
-            }
-        }
-        Shape::Rectangle { .. } | Shape::Oval { .. } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            if let Some(f) = style.fill {
-                d.set(b"IC".to_vec(), rgb(f));
-            }
-            border(&mut d);
-        }
-        Shape::Line { from, to, start, end } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"L".to_vec(), num_array(&[from[0], from[1], to[0], to[1]]));
-            if ending_draws(*start) || ending_draws(*end) {
-                d.set(b"LE".to_vec(), ending_pair(*start, *end));
-            }
-            border(&mut d);
-        }
-        Shape::Mark { mark, .. } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"Name".to_vec(), Object::name(mark.name()));
-            border(&mut d);
-            // Drawn upright for the page as displayed, as a stamp is (#2392).
-            let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
-            if matches!(turn, 90 | 180 | 270) {
-                d.set(b"PCStampRotate".to_vec(), Object::Int(turn));
-            }
-        }
-        Shape::Stamp { stamp, by, .. } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"Name".to_vec(), Object::name(stamp.name()));
-            // Marks the stamp as drawn by PdfCraft: other stamps with standard names keep
-            // their own artwork.
-            d.set(b"PCStamp".to_vec(), Object::Bool(true));
-            if let Some(b) = by {
-                d.set(b"PCByLine".to_vec(), PdfString::text(b));
-            }
-            // The label is drawn for the page as displayed. A later page rotation is a new edit.
-            let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
-            if matches!(turn, 90 | 180 | 270) {
-                d.set(b"PCStampRotate".to_vec(), Object::Int(turn));
-            }
-        }
-        Shape::TypedSignature { contours, .. } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"Name".to_vec(), Object::name("PCTypedSignature"));
-            let list = contours.iter().filter(|c| c.len() > 2).map(|c| num_array(&c.iter().flat_map(|p| [p[0], p[1]]).collect::<Vec<_>>())).collect();
-            d.set(b"PCOutline".to_vec(), Object::Array(list));
-        }
-        Shape::CustomStamp { name, picture, image, size, .. } => {
-            let clean: String = name.chars().filter(char::is_ascii_alphanumeric).collect();
-            d.set(b"Name".to_vec(), Object::name(&format!("PCCustom{clean}")));
-            d.set(b"PCPicture".to_vec(), Object::Ref(*picture));
-            d.set(b"PCPictureImage".to_vec(), Object::Bool(*image));
-            d.set(b"PCPictureSize".to_vec(), num_array(&[size.0, size.1]));
-            // An image signature's rectangle is in user space; on a turned page its appearance is
-            // turned back (see `appearance::build`), so it reads upright as displayed.
-            if *image && matches!(clean.as_str(), "Signature" | "Initials") {
-                let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
-                if turn != 0 {
-                    d.set(b"PCPictureRotate".to_vec(), Object::Int(turn));
-                }
-            }
-        }
-        Shape::Ink { strokes } | Shape::Signature { strokes } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            let list = strokes.iter().filter(|s| !s.is_empty()).map(|s| num_array(&s.concat())).collect();
-            d.set(b"InkList".to_vec(), Object::Array(list));
-            border(&mut d);
-        }
-        Shape::Polygon { vertices, cloud } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            if let Some(f) = style.fill {
-                d.set(b"IC".to_vec(), rgb(f));
-            }
-            d.set(b"Vertices".to_vec(), num_array(&vertices.concat()));
-            if *cloud {
-                d.set(b"IT".to_vec(), Object::name("PolygonCloud"));
-                let mut be = Dict::new();
-                be.set(b"S".to_vec(), Object::name("C"));
-                be.set(b"I".to_vec(), Object::Int(1));
-                d.set(b"BE".to_vec(), Object::Dict(be));
-            }
-            border(&mut d);
-        }
-        Shape::PolyLine { vertices, start, end } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"Vertices".to_vec(), num_array(&vertices.concat()));
-            if ending_draws(*start) || ending_draws(*end) {
-                d.set(b"LE".to_vec(), ending_pair(*start, *end));
-            }
-            border(&mut d);
-        }
-        Shape::Caret { .. } => {
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"Sy".to_vec(), Object::name("None"));
-        }
-        Shape::Attachment { icon, file, data, .. } => {
-            if file.trim().is_empty() {
-                return Err(AnnotError::Invalid("the attached file needs a name".into()));
-            }
-            d.set(b"C".to_vec(), rgb(style.color));
-            d.set(b"Name".to_vec(), Object::name(icon.name()));
-            d.set(b"F".to_vec(), Object::Int(FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
-            // The file: an embedded file stream inside a file specification (§7.11.4).
-            let mut params = Dict::new();
-            params.set(b"Size".to_vec(), Object::Int(data.len() as i64));
-            if let Some(date) = &meta.date {
-                params.set(b"ModDate".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
-            }
-            let mut ef = Dict::new();
-            ef.set(b"Type".to_vec(), Object::name("EmbeddedFile"));
-            ef.set(b"Params".to_vec(), Object::Dict(params));
-            let ef = doc.add(Object::Stream(pdfcraft_cos::Stream::flate(ef, data)));
-            let mut efd = Dict::new();
-            efd.set(b"F".to_vec(), Object::Ref(ef));
-            efd.set(b"UF".to_vec(), Object::Ref(ef));
-            let mut fs = Dict::new();
-            fs.set(b"Type".to_vec(), Object::name("Filespec"));
-            fs.set(b"F".to_vec(), PdfString::text(file.trim()));
-            fs.set(b"UF".to_vec(), PdfString::text(file.trim()));
-            fs.set(b"EF".to_vec(), Object::Dict(efd));
-            d.set(b"FS".to_vec(), Object::Ref(doc.add(Object::Dict(fs))));
-            if new.contents.is_empty() {
-                d.set(b"Contents".to_vec(), PdfString::text(file.trim()));
-            }
-        }
-        Shape::Callout { rect: tb, knee, point, ending, .. } => {
-            let tb = normalize(*tb);
-            let attach = callout_attach(tb, *knee);
-            d.set(b"IT".to_vec(), Object::name("FreeTextCallout"));
-            d.set(b"CL".to_vec(), num_array(&[point[0], point[1], knee[0], knee[1], attach[0], attach[1]]));
-            d.set(b"LE".to_vec(), Object::name(ending.name()));
-            // The text box inside /Rect (§12.5.6.6 /RD).
-            d.set(b"RD".to_vec(), num_array(&[tb[0] - rect[0], tb[1] - rect[1], rect[2] - tb[2], rect[3] - tb[3]]));
-        }
-        _ => {}
-    }
-    match &new.shape {
-        Shape::TextBox { font_size, .. } | Shape::Typewriter { font_size, .. } | Shape::Callout { font_size, .. } => {
-            if matches!(new.shape, Shape::Typewriter { .. }) {
-                d.set(b"IT".to_vec(), Object::name("FreeTextTypeWriter"));
-            }
-            let size = if font_size.is_finite() && *font_size > 0.0 { font_size.clamp(1.0, 400.0) } else { 12.0 };
-            let [r, g, b] = style.color.map(|x| x.clamp(0.0, 1.0));
-            d.set(b"DA".to_vec(), PdfString::literal(format!("{} {} {} rg /Helv {} Tf", n(r), n(g), n(b), n(size)).into_bytes()));
-            d.set(b"Q".to_vec(), Object::Int(0));
-            if let Some(f) = style.fill {
-                d.set(b"C".to_vec(), rgb(f));
-            }
-            border(&mut d);
-            rich_text(&mut d);
-            // The text is laid out for the page as displayed, like a stamp's label.
-            if !matches!(new.shape, Shape::Callout { .. }) {
-                let turn = pdfcraft_model::pages(doc).get(new.page).map_or(0, |p| p.rotation(doc));
-                if matches!(turn, 90 | 180 | 270) {
-                    d.set(b"PCTextRotate".to_vec(), Object::Int(turn));
-                }
-            }
-        }
-        _ => {}
-    }
-    if fill_sign_shape(&new.shape) {
-        // Survives a later subject edit, so flatten-on-save still finds the mark.
-        d.set(b"PCFillSign".to_vec(), Object::Bool(true));
-    }
-    // A redaction's overlay text becomes page content when it is applied, where `?` would be there
-    // for good: refused before anything is added. A comment's own text is stored as typed and
-    // drawn with `?` for what the standard fonts can't draw (marked, see `draw_appearance`).
-    if d.name(b"Subtype") == Some(b"Redact")
-        && let Some((what, c)) = appearance::undrawable_text(&d)
-    {
-        return Err(AnnotError::Undrawable(pdfcraft_fonts::undrawable_message(what, c)));
-    }
-    let r = doc.add(Object::Dict(d.clone()));
-    draw_appearance(doc, r)?;
-    let mut list = annots(doc, page);
-    let index = list.len();
-    list.push(Object::Ref(r));
-    if let Some(pr) = popup {
-        let mut p = Dict::new();
-        p.set(b"Type".to_vec(), Object::name("Annot"));
-        p.set(b"Subtype".to_vec(), Object::name("Popup"));
-        p.set(b"Rect".to_vec(), num_array(&pr));
-        p.set(b"Parent".to_vec(), Object::Ref(r));
-        p.set(b"Open".to_vec(), Object::Bool(false));
-        p.set(b"F".to_vec(), Object::Int(FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
-        let pref = doc.add(Object::Dict(p));
-        doc.update_dict(r, |d| d.set(b"Popup".to_vec(), Object::Ref(pref)))?;
-        list.push(Object::Ref(pref));
-    }
-    set_annots(doc, page, list)?;
-    Ok(index)
-}
-
-/// Counterrotate a newly placed picture stamp's appearance into displayed-page axes.
-/// The picture may be an image or a PDF page. The normal appearance's transformed bounding
-/// box is fitted to `/Rect` by PDF viewers.
-pub fn orient_image_stamp(doc: &mut Document, page: usize, index: usize, rotation: i64) -> Result<(), AnnotError> {
-    let matrix = match rotation {
-        90 => [0.0, 1.0, -1.0, 0.0, 0.0, 0.0],
-        180 => [-1.0, 0.0, 0.0, -1.0, 0.0, 0.0],
-        270 => [0.0, -1.0, 1.0, 0.0, 0.0, 0.0],
-        _ => return Ok(()),
-    };
-    let (_, r) = annot_ref(doc, page, index)?;
-    let d = annot_dict(doc, r);
-    if d.name(b"Subtype") != Some(b"Stamp") || d.get(b"PCPicture").is_none() {
-        return Err(AnnotError::Invalid("only a picture stamp can be oriented".into()));
-    }
-    let normal = d
-        .get(b"AP")
-        .map(|ap| doc.resolve(ap))
-        .and_then(|ap| ap.as_dict().and_then(|ap| ap.reference(b"N")))
-        .ok_or_else(|| AnnotError::Invalid("the stamp has no normal appearance".into()))?;
-    let Object::Stream(mut stream) = doc.get(normal).as_ref().clone() else {
-        return Err(AnnotError::Invalid("the stamp's normal appearance is not a stream".into()));
-    };
-    stream.dict.set(b"Matrix".to_vec(), num_array(&matrix));
-    doc.set(normal, Object::Stream(stream));
-    Ok(())
-}
-
-/// A comment another program drew, whose text the standard fonts can't draw. Redrawing it would
-/// replace those characters with `?`, so the edit is refused before the dictionary changes.
-fn refuse_foreign_text(doc: &Document, d: &Dict) -> Result<(), AnnotError> {
-    let drawn_elsewhere =
-        d.get(b"AP").is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N"))) && pdfcraft_fonts::undrawn_mark(d).is_none();
-    if drawn_elsewhere && let Some((what, c)) = appearance::undrawable_text(d) {
-        return Err(AnnotError::Undrawable(format!(
-            "PdfCraft can't redraw this comment: the standard fonts can't draw \"{}\" (U+{:04X}) in {what}, which would then show as ? (the comment was left as it is)",
-            c.escape_debug(),
-            u32::from(c)
-        )));
-    }
-    Ok(())
-}
-
-/// (Re)generate `/AP /N` for the annotation `r` from its dictionary, for an edit that keeps its
-/// text (a restyle, a new size or colour).
-///
-/// A comment whose text the standard fonts can't draw, with an appearance another program drew
-/// (with a font that has those characters), keeps that appearance: redrawing it would put `?` in
-/// their place, so the edit is refused (`AnnotError::Undrawable`). One PdfCraft drew with `?`
-/// (marked `pdfcraft_fonts::UNDRAWN_MARK`) is redrawn.
-pub fn set_appearance(doc: &mut Document, r: ObjRef) -> Result<(), AnnotError> {
-    refuse_foreign_text(doc, &annot_dict(doc, r))?;
-    draw_appearance(doc, r)
-}
-
-/// Put `before` back when redrawing fails, so a refused edit does not keep the new rectangle or style.
-fn redraw_or_restore(doc: &mut Document, r: ObjRef, before: Dict) -> Result<(), AnnotError> {
-    if let Err(e) = set_appearance(doc, r) {
-        doc.set(r, Object::Dict(before));
-        return Err(e);
-    }
-    Ok(())
-}
-
-/// Draw `r`'s normal appearance from its dictionary, whatever its text: characters the standard
-/// fonts can't draw come out as `?`, and the annotation is marked (`pdfcraft_fonts::UNDRAWN_MARK`,
-/// cleared when all of it can be drawn) so the edit is reported and flattening won't make that
-/// `?` permanent. For new text (a new comment, changed contents), as Acrobat keeps text its font
-/// can't show, and for display-only copies.
-fn draw_appearance(doc: &mut Document, r: ObjRef) -> Result<(), AnnotError> {
-    let d = annot_dict(doc, r);
-    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
-    let Some(stream) = build_appearance(doc, &d) else { return Err(AnnotError::Unsupported(subtype)) };
-    apply_appearance(doc, r, &d, stream)
-}
-
-/// Draw the appearance for an annotation dictionary: the expensive half of [`set_appearance`].
-/// Pure from the dictionary and the objects it points at, so [`AppearanceCache`] can reuse it.
-fn build_appearance(doc: &Document, d: &Dict) -> Option<Stream> {
-    let mut stream = appearance::build(d)?;
-    // Picture-stamp restyling must retain the placement's page-axis correction.
-    if d.get(b"PCPicture").is_some() {
-        let matrix = d.get(b"AP").and_then(|ap| {
-            let ap = doc.resolve(ap);
-            let normal = doc.resolve(ap.as_dict()?.get(b"N")?);
-            let Object::Stream(normal) = normal.as_ref() else { return None };
-            normal.dict.get(b"Matrix").cloned()
-        });
-        if let Some(matrix) = matrix {
-            stream.dict.set(b"Matrix".to_vec(), matrix);
-        }
-    }
-    Some(stream)
-}
-
-/// Store a built appearance on the annotation: the cheap half of [`set_appearance`].
-fn apply_appearance(doc: &mut Document, r: ObjRef, d: &Dict, stream: Stream) -> Result<(), AnnotError> {
-    // Characters the standard fonts can't draw came out as `?`: mark the annotation with the first.
-    let missing = appearance::undrawable_text(d).map(|(_, c)| c);
-    let ap = doc.add(Object::Stream(stream));
-    // A copy (a shared /AP is left alone) that keeps unknown entries; the old down and rollover
-    // appearances would show the previous look on press or hover, so they go with the old /N.
-    let mut apd = d.get(b"AP").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().cloned()).unwrap_or_default();
-    apd.remove(b"D");
-    apd.remove(b"R");
-    apd.set(b"N".to_vec(), Object::Ref(ap));
-    // A note icon has a fixed size (`NOTE_SIZE`); viewers draw it at the upper-left corner of `/Rect`.
-    // The appearance's box is mapped onto `/Rect`, so any other `/Rect` (a large one, or one with
-    // no width, as LaTeX `pdfcomment` writes) would stretch the icon or shrink it to nothing.
-    let icon_rect = matches!(d.name(b"Subtype"), Some(b"Text" | b"FileAttachment"))
-        .then(|| d.get(b"Rect")?.as_array()?.iter().map(|o| o.as_f64()).collect::<Option<Vec<f64>>>())
-        .flatten()
-        .filter(|q| q.len() == 4 && finite(q))
-        .map(|q| {
-            let (x, top) = (q[0].min(q[2]), q[1].max(q[3]));
-            [x, top - NOTE_SIZE, x + NOTE_SIZE, top]
-        });
-    doc.update_dict(r, |d| {
-        d.set(b"AP".to_vec(), Object::Dict(apd));
-        if let Some(rect) = icon_rect {
-            d.set(b"Rect".to_vec(), num_array(&rect));
-        }
-        d.remove(b"AS");
-        pdfcraft_fonts::set_undrawn_mark(d, missing);
-    })?;
-    Ok(())
-}
-
-/// Display appearances built for annotations without any, reused while the annotation
-/// dictionaries they were drawn from are unchanged.
-///
-/// A content edit (moving a paragraph, retyping text, …) leaves every annotation dictionary
-/// alone, but the display copy is rebuilt from the edited document on every refresh: without
-/// this cache each refresh redrew every appearance (27k on one CAD file, ~0.7 s per edit
-/// commit). Entries are keyed by annotation reference; object numbers are never reused within
-/// a document lineage, so an entry stays valid until an annotation edit runs. Callers clear
-/// the cache on any refresh that may change annotations (comments, structural and full
-/// refreshes) and keep it for content-only ones.
-#[derive(Clone, Debug, Default)]
-pub struct AppearanceCache {
-    entries: std::collections::HashMap<ObjRef, Stream>,
-    bytes: usize,
-    hits: u64,
-    builds: u64,
-}
-
-impl AppearanceCache {
-    /// Cached appearance data restarts past this instead of growing without bound.
-    const MAX_BYTES: usize = 64 << 20;
-
-    /// Forget every entry (an annotation edit may have changed the dictionaries).
-    pub fn clear(&mut self) {
-        *self = Self::default();
-    }
-
-    fn get(&mut self, r: ObjRef) -> Option<Stream> {
-        let stream = self.entries.get(&r)?.clone();
-        self.hits += 1;
-        Some(stream)
-    }
-
-    fn insert(&mut self, r: ObjRef, stream: &Stream) {
-        self.builds += 1;
-        if self.entries.len() >= 1_000_000 {
-            self.clear();
-        }
-        if self.bytes.saturating_add(stream.raw.len()) <= Self::MAX_BYTES {
-            self.bytes += stream.raw.len();
-            self.entries.insert(r, stream.clone());
-        }
-        // Else over budget: keep serving the entries already cached instead of growing.
-    }
-
-    /// Cache hits so far (reused appearances); for tests.
-    pub fn hits(&self) -> u64 {
-        self.hits
-    }
-
-    /// Appearances built so far; for tests.
-    pub fn builds(&self) -> u64 {
-        self.builds
-    }
-}
-
-/// A copy of `doc` in which every annotation without a normal appearance (`/AP /N`) has the one
-/// [`appearance::build`] draws from its dictionary, for displaying the document (`None` when no
-/// annotation needs one). Many files carry comments without appearances (FreeText, Ink, notes,
-/// stamps, …) that viewers draw from the dictionary. `doc` is not changed: saving writes the file
-/// as it was. Links, form fields and pop-ups keep their own handling.
-pub fn with_missing_appearances(doc: &Document) -> Option<Document> {
-    with_missing_appearances_cached(doc, &mut AppearanceCache::default())
-}
-
-/// A copy of `doc` with [`AppearanceCache`] reuse across refreshes: annotations whose
-/// dictionary is unchanged since the cached build keep their stored appearance instead of
-/// redrawing it. See [`AppearanceCache`] for when entries stay valid.
-pub fn with_missing_appearances_cached(doc: &Document, cache: &mut AppearanceCache) -> Option<Document> {
-    let mut copy: Option<Document> = None;
-    // An annotation listed more than once, on one page or several, is drawn once. `has_normal`
-    // reads `doc`, which never gets the appearance, so every repeat used to add another stream to
-    // the copy, and the display bytes grew with the number of listings.
-    let mut seen = std::collections::HashSet::new();
-    for page in page_refs(doc).ok()? {
-        for r in annots(doc, page).iter().filter_map(Object::as_ref) {
-            if !seen.insert(r) {
-                continue;
-            }
-            let d = annot_dict(doc, r);
-            if matches!(d.name(b"Subtype"), None | Some(b"Link" | b"Widget" | b"Popup")) {
-                continue;
-            }
-            let has_normal = d.get(b"AP").is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N")));
-            if has_normal {
-                continue;
-            }
-            if let Some(stream) = cache.get(r) {
-                // Fails only when `r` isn't a dictionary, which the cached build ruled out.
-                apply_appearance(copy.get_or_insert_with(|| doc.clone()), r, &d, stream).ok();
-                continue;
-            }
-            // Another program's stamp gets a drawing for display only (ISO 32000-2 Table 184). Its
-            // `/AP`, if any, has no `/N` to keep here.
-            let other_stamp = || {
-                let mut bare = d.clone();
-                bare.remove(b"AP");
-                appearance::display_stamp(&bare)
-            };
-            let Some(stream) = build_appearance(doc, &d).or_else(other_stamp) else { continue };
-            cache.insert(r, &stream);
-            // Fails only when `r` isn't a dictionary, which the build just ruled out.
-            apply_appearance(copy.get_or_insert_with(|| doc.clone()), r, &d, stream).ok();
-        }
-    }
-    copy
-}
-
-/// Format a number for content streams and DA strings.
-pub(crate) fn n(v: f64) -> String {
-    let s = format!("{:.3}", if v.abs() < 5e-4 { 0.0 } else { v });
-    let s = s.trim_end_matches('0').trim_end_matches('.');
-    if s == "-0" { "0".into() } else { s.into() }
-}
-
-// ── edits ───────────────────────────────────────────────────────────────────────────────────
-
-/// A text box's rich text (§12.7.4.3): `/DS` (default style) and `/RC` (XHTML) written from its
-/// plain `/Contents`, `/DA` and `/Q`, so viewers that edit rich text show the same thing.
-fn rich_text(d: &mut Dict) {
-    let text = d.get(b"Contents").and_then(|c| c.as_string()).map(PdfString::to_text).unwrap_or_default();
-    let (col, size) = appearance::parse_da(d);
-    let hex = format!(
-        "#{:02X}{:02X}{:02X}",
-        (col[0].clamp(0.0, 1.0) * 255.0).round() as u8,
-        (col[1].clamp(0.0, 1.0) * 255.0).round() as u8,
-        (col[2].clamp(0.0, 1.0) * 255.0).round() as u8
-    );
-    let align = match d.get(b"Q").and_then(Object::as_int) {
-        Some(1) => "center",
-        Some(2) => "right",
-        _ => "left",
-    };
-    let esc = |s: &str| s.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;");
-    let body: String = text.split('\n').map(|line| format!("<p dir=\"ltr\">{}</p>", esc(line.trim_end_matches('\r')))).collect();
-    let style = format!(
-        "font-size:{}pt;text-align:{align};color:{hex};font-weight:normal;font-style:normal;font-family:Helvetica;font-stretch:normal",
-        n(size)
-    );
-    let rc = format!(
-        "<?xml version=\"1.0\"?><body xmlns=\"http://www.w3.org/1999/xhtml\" xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\" xfa:spec=\"2.0.2\" style=\"{style}\">{body}</body>"
-    );
-    d.set(b"DS".to_vec(), PdfString::text(&format!("font: Helvetica {}pt; text-align:{align}; color:{hex}", n(size))));
-    d.set(b"RC".to_vec(), PdfString::text(&rc));
-}
-
-fn touch(d: &mut Dict, meta: &Meta) {
-    if let Some(date) = &meta.date {
-        d.set(b"M".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
-    }
-}
-
-/// Delete a comment together with its pop-up and its replies (and theirs), as Acrobat does.
-pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
-    let p = page_ref(doc, page)?;
-    let list = annots(doc, p);
-    let target = list.get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    if let Some(r) = target.as_ref() {
-        unlocked(doc, r)?;
-    }
-    let mut doomed: Vec<ObjRef> = target.as_ref().into_iter().collect();
-    // Replies (`/IRT`) and pop-ups (`/Parent`) of anything doomed, to a fixpoint.
-    loop {
-        let before = doomed.len();
-        for e in &list {
-            let Some(r) = e.as_ref() else { continue };
-            if doomed.contains(&r) {
-                continue;
-            }
-            let obj = doc.get(r);
-            let Some(d) = obj.as_dict() else { continue };
-            let points_at = |k: &[u8]| d.reference(k).is_some_and(|t| doomed.contains(&t));
-            if points_at(b"IRT") || points_at(b"Parent") {
-                doomed.push(r);
-            }
-        }
-        for r in doomed.clone() {
-            if let Some(pop) = doc.get(r).as_dict().and_then(|d| d.reference(b"Popup"))
-                && !doomed.contains(&pop)
-            {
-                doomed.push(pop);
-            }
-        }
-        if doomed.len() == before {
-            break;
-        }
-    }
-    let kept: Vec<Object> =
-        list.into_iter().enumerate().filter(|(i, e)| *i != index && !e.as_ref().is_some_and(|r| doomed.contains(&r))).map(|(_, e)| e).collect();
-    set_annots(doc, p, kept)
-}
-
-/// Change a comment's text. Text boxes are redrawn to show it, and their rectangle follows the
-/// new text: the wrap width and top edge stay, the height fits the wrapped lines.
-pub fn set_contents(doc: &mut Document, page: usize, index: usize, text: &str, meta: &Meta) -> Result<(), AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    let free_text = annot_dict(doc, r).name(b"Subtype") == Some(b"FreeText");
-    doc.update_dict(r, |d| {
-        d.set(b"Contents".to_vec(), PdfString::text(text));
-        // The rich-text version follows the new plain text (text boxes), or would contradict it.
-        if free_text {
-            rich_text(d);
-        } else {
-            d.remove(b"RC");
-        }
-        touch(d, meta);
-    })?;
-    if free_text {
-        // The box grows and shrinks with the text instead of clipping it. A locked box keeps its
-        // text editable (as in Acrobat), so the re-fit ignores the lock. New text is drawn even
-        // where the standard fonts can't draw some of it (marked and reported, see
-        // `draw_appearance`).
-        match fitted_box(doc, r, text) {
-            Some(rect) => apply_text_box(doc, r, rect, meta, true)?,
-            None => draw_appearance(doc, r)?,
-        }
-    }
-    Ok(())
-}
-
-/// The rectangle a FreeText annotation's text box needs for `text`: the current wrap width and
-/// top edge stay and the height fits the wrapped lines, as at creation. `None` keeps the old
-/// rectangle (the box can't be measured, so only the appearance is redrawn).
-fn fitted_box(doc: &Document, r: ObjRef, text: &str) -> Option<[f64; 4]> {
-    let d = annot_dict(doc, r);
-    let nums = |key: &[u8]| -> Option<Vec<f64>> { d.get(key)?.as_array()?.iter().map(|o| o.as_f64()).collect() };
-    let (_, size) = appearance::parse_da(&d);
-    let pad = 2.0 + border_width_of(&d);
-    let rect = nums(b"Rect").filter(|v| v.len() == 4 && v.iter().all(|x| x.is_finite()))?;
-    let rect = [rect[0], rect[1], rect[2], rect[3]];
-    // A callout re-fits its text box (`/Rect` inset by `/RD`); the leader line keeps its place.
-    let tb = if d.contains(b"CL") {
-        let rd = nums(b"RD").filter(|v| v.len() == 4 && v.iter().all(|x| *x >= 0.0))?;
-        [rect[0] + rd[0], rect[1] + rd[1], rect[2] - rd[2], rect[3] - rd[3]]
-    } else {
-        rect
-    };
-    let (x0, top) = (tb[0].min(tb[2]), tb[1].max(tb[3]));
-    let w = tb[2] - tb[0];
-    let w = if w.is_finite() && w >= 1.0 {
-        w
-    } else {
-        // No usable old width: fall back to the creation-time width (at most 300 pt).
-        let longest = text.lines().map(|l| appearance::text_width(l, size)).fold(0.0, f64::max);
-        (longest + 2.0 * pad + 4.0).clamp(40.0, 300.0)
-    };
-    let lines = appearance::wrap(text, size, (w - 2.0 * pad).max(1.0)).len().max(1) as f64;
-    Some([x0, top - lines * size * 1.2 - 2.0 * pad - 2.0, x0 + w, top])
-}
-
-/// Reply to a comment; returns the reply's index in the page's `/Annots`.
-///
-/// A reply is a text annotation with `/IRT` pointing at its parent (§12.5.6.2). It gets the
-/// parent's rectangle and an empty appearance, so it shows in comment lists but never paints a
-/// second icon on the page.
-pub fn add_reply(doc: &mut Document, page: usize, index: usize, text: &str, author: &str, meta: &Meta) -> Result<usize, AnnotError> {
-    reply(doc, page, index, text, author, meta, None)
-}
-
-/// Set a comment's review status (Acrobat: "Set status ▸ Accepted"…). Like Acrobat this adds a
-/// state reply (`/State`, `/StateModel /Review`) by `author`; the latest one wins.
-pub fn set_review_state(doc: &mut Document, page: usize, index: usize, state: ReviewState, author: &str, meta: &Meta) -> Result<usize, AnnotError> {
-    let text = format!("{} set by {}", state.name(), if author.is_empty() { "unknown" } else { author });
-    reply(doc, page, index, &text, author, meta, Some(state))
-}
-
-fn reply(
-    doc: &mut Document,
-    page: usize,
-    index: usize,
-    text: &str,
-    author: &str,
-    meta: &Meta,
-    state: Option<ReviewState>,
-) -> Result<usize, AnnotError> {
-    let (p, parent) = annot_ref(doc, page, index)?;
-    let pd = annot_dict(doc, parent);
-    if pd.name(b"Subtype") == Some(b"Popup") {
-        return Err(AnnotError::Invalid("pop-ups can't be replied to".into()));
-    }
-    let rect = pd.get(b"Rect").cloned().unwrap_or_else(|| num_array(&[0.0, 0.0, 0.0, 0.0]));
-    let mut d = base_dict("Text", [0.0; 4], p, text, author, meta);
-    d.set(b"Rect".to_vec(), rect);
-    d.set(b"IRT".to_vec(), Object::Ref(parent));
-    d.set(b"F".to_vec(), Object::Int(FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
-    d.set(b"Name".to_vec(), Object::name("Comment"));
-    if let Some(c) = pd.get(b"C") {
-        d.set(b"C".to_vec(), c.clone());
-    }
-    if let Some(s) = state {
-        d.set(b"State".to_vec(), PdfString::text(s.name()));
-        d.set(b"StateModel".to_vec(), PdfString::text("Review"));
-        d.set(b"Subj".to_vec(), PdfString::text("Status"));
-    }
-    // An empty form: nothing is drawn for the reply itself.
-    let mut fd = Dict::new();
-    fd.set(b"Type".to_vec(), Object::name("XObject"));
-    fd.set(b"Subtype".to_vec(), Object::name("Form"));
-    fd.set(b"BBox".to_vec(), num_array(&[0.0, 0.0, 0.0, 0.0]));
-    let ap = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(fd, Vec::new())));
-    let mut apd = Dict::new();
-    apd.set(b"N".to_vec(), Object::Ref(ap));
-    d.set(b"AP".to_vec(), Object::Dict(apd));
-    let r = doc.add(Object::Dict(d));
-    let mut list = annots(doc, p);
-    list.push(Object::Ref(r));
-    let i = list.len() - 1;
-    set_annots(doc, p, list)?;
-    Ok(i)
-}
-
-fn flags(doc: &Document, r: ObjRef) -> i64 {
-    doc.get(r).as_dict().map(|d| annotation_flags(doc, d)).unwrap_or(0)
-}
-
-/// Refuse to change a locked comment (Acrobat: Properties ▸ Locked).
-fn unlocked(doc: &Document, r: ObjRef) -> Result<(), AnnotError> {
-    if flags(doc, r) & FLAG_LOCKED != 0 { Err(AnnotError::Invalid("the comment is locked".into())) } else { Ok(()) }
-}
-
-/// Lock or unlock a comment (the Locked flag). A locked comment can't be moved, resized,
-/// restyled or deleted; its text and replies stay editable, as in Acrobat.
-pub fn set_locked(doc: &mut Document, page: usize, index: usize, locked: bool) -> Result<(), AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    let f = if locked { flags(doc, r) | FLAG_LOCKED } else { flags(doc, r) & !FLAG_LOCKED };
-    doc.update_dict(r, |d| d.set(b"F".to_vec(), Object::Int(f)))?;
-    Ok(())
-}
-
-/// Mark or unmark a comment with a checkmark. Like Acrobat this adds a hidden state reply with
-/// `/StateModel /Marked` by `author`; the latest one wins. It's private bookkeeping, not a status.
-pub fn set_marked(doc: &mut Document, page: usize, index: usize, marked: bool, author: &str, meta: &Meta) -> Result<usize, AnnotError> {
-    let (p, parent) = annot_ref(doc, page, index)?;
-    let pd = annot_dict(doc, parent);
-    if pd.name(b"Subtype") == Some(b"Popup") {
-        return Err(AnnotError::Invalid("pop-ups can't be marked".into()));
-    }
-    let state = if marked { "Marked" } else { "Unmarked" };
-    let text = format!("{state} set by {}", if author.is_empty() { "unknown" } else { author });
-    let mut d = base_dict("Text", [0.0; 4], p, &text, author, meta);
-    d.set(b"Rect".to_vec(), pd.get(b"Rect").cloned().unwrap_or_else(|| num_array(&[0.0; 4])));
-    d.set(b"IRT".to_vec(), Object::Ref(parent));
-    d.set(b"F".to_vec(), Object::Int(FLAG_HIDDEN | FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
-    d.set(b"State".to_vec(), PdfString::text(state));
-    d.set(b"StateModel".to_vec(), PdfString::text("Marked"));
-    let r = doc.add(Object::Dict(d));
-    let mut list = annots(doc, p);
-    list.push(Object::Ref(r));
-    let i = list.len() - 1;
-    set_annots(doc, p, list)?;
-    Ok(i)
-}
-
-/// Move a comment (and its pop-up) by `(dx, dy)` points. The appearance moves with `/Rect`.
-pub fn move_annotation(doc: &mut Document, page: usize, index: usize, dx: f64, dy: f64, meta: &Meta) -> Result<(), AnnotError> {
-    if !finite(&[dx, dy]) {
-        return Err(AnnotError::Invalid("invalid offset".into()));
-    }
-    let (_, r) = annot_ref(doc, page, index)?;
-    unlocked(doc, r)?;
-    let shift = |o: &Object, every: bool| -> Option<Object> {
-        let a = o.as_array()?;
-        Some(Object::Array(
-            a.iter()
-                .enumerate()
-                .map(|(i, v)| match v.as_f64() {
-                    Some(x) if every || i < 4 => Object::Real(x + if i % 2 == 0 { dx } else { dy }),
-                    _ => v.clone(),
-                })
-                .collect(),
-        ))
-    };
-    let popup = annot_dict(doc, r).reference(b"Popup");
-    doc.update_dict(r, |d| {
-        for (k, every) in [(&b"Rect"[..], false), (b"QuadPoints", true), (b"L", false), (b"CL", true), (b"Vertices", true)] {
-            if let Some(v) = d.get(k).and_then(|o| shift(o, every)) {
-                d.set(k.to_vec(), v);
-            }
-        }
-        if let Some(Object::Array(list)) = d.get(b"InkList").cloned() {
-            let moved = list.iter().map(|s| shift(s, true).unwrap_or_else(|| s.clone())).collect();
-            d.set(b"InkList".to_vec(), Object::Array(moved));
-        }
-        touch(d, meta);
-    })?;
-    if let Some(p) = popup
-        && doc.get(p).as_dict().is_some()
-    {
-        doc.update_dict(p, |d| {
-            if let Some(v) = d.get(b"Rect").and_then(|o| shift(o, false)) {
-                d.set(b"Rect".to_vec(), v);
-            }
-        })?;
-    }
-    Ok(())
-}
-
-/// Resize a rectangle, oval, text box, stamp or drawing to `rect`. Stamps keep their appearance,
-/// which PDF viewers scale from its bounding box into the new rectangle; drawings scale their
-/// strokes and get a new one.
-pub fn set_rect(doc: &mut Document, page: usize, index: usize, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    unlocked(doc, r)?;
-    let d = annot_dict(doc, r);
-    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
-    if subtype == "Stamp" {
-        let rect = normalize(rect);
-        if !finite(&rect) || rect[2] <= rect[0] || rect[3] <= rect[1] {
-            return Err(AnnotError::Invalid("invalid rectangle (too small)".into()));
-        }
-        doc.update_dict(r, |d| {
-            d.set(b"Rect".to_vec(), num_array(&rect));
-            touch(d, meta);
-        })?;
-        return Ok(());
-    }
-    if subtype == "Ink" {
-        return resize_ink(doc, r, normalize(rect), meta);
-    }
-    if !matches!(subtype.as_str(), "Square" | "Circle" | "FreeText") {
-        return Err(AnnotError::Invalid(format!("{subtype} comments can't be resized")));
-    }
-    apply_text_box(doc, r, rect, meta, false)
-}
-
-/// At most this many points reshape a comment (a drawn polygon has a handful).
-const MAX_POINTS: usize = 100_000;
-
-/// Reshape a line, connected lines, a polygon or a cloud: its points in user space (a line's two
-/// ends, the others' corners), as dragging the comment's handles sets them. `/Rect` follows the
-/// points with room for the line's width and endings, as when the comment was drawn, and the
-/// appearance is redrawn. A measurement keeps the points it measured.
-pub fn set_points(doc: &mut Document, page: usize, index: usize, points: &[[f64; 2]], meta: &Meta) -> Result<(), AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    unlocked(doc, r)?;
-    let d = annot_dict(doc, r);
-    if d.contains(b"Measure") {
-        return Err(AnnotError::Invalid("a measurement's points are where it measured".into()));
-    }
-    if points.len() > MAX_POINTS {
-        return Err(AnnotError::Invalid(format!("at most {MAX_POINTS} points")));
-    }
-    let style = Style { width: border_width_of(&d), ..Style::default() };
-    let ends = line_endings_of(&d).unwrap_or_default();
-    let (start, end) = (ends.first().copied().unwrap_or(LineEnding::None), ends.get(1).copied().unwrap_or(LineEnding::None));
-    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
-    let (shape, key): (Shape, &[u8]) = match (subtype.as_str(), points) {
-        ("Line", [from, to]) => (Shape::Line { from: *from, to: *to, start, end }, b"L"),
-        ("Line", _) => return Err(AnnotError::Invalid("a line has two ends".into())),
-        ("PolyLine", _) => (Shape::PolyLine { vertices: points.to_vec(), start, end }, b"Vertices"),
-        ("Polygon", _) => {
-            let cloud = d.get(b"BE").and_then(|b| b.as_dict()).is_some_and(|b| b.name(b"S") == Some(b"C"));
-            (Shape::Polygon { vertices: points.to_vec(), cloud }, b"Vertices")
-        }
-        (other, _) => return Err(AnnotError::Invalid(format!("{other} comments have no points to move"))),
-    };
-    // Checks the points too: finite, and far enough apart to draw.
-    let rect = rect_for(&shape, &style)?;
-    let before = d;
-    doc.update_dict(r, |d| {
-        d.set(key.to_vec(), num_array(&points.concat()));
-        d.set(b"Rect".to_vec(), num_array(&rect));
-        touch(d, meta);
-    })?;
-    redraw_or_restore(doc, r, before)
-}
-
-/// Scale a drawing's strokes into `rect`. The margin between the strokes and the old `/Rect` (half
-/// the line width and a little more) stays the same on each side, so the line isn't clipped.
-fn resize_ink(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
-    let d = annot_dict(doc, r);
-    let strokes: Vec<Vec<[f64; 2]>> = d
-        .get(b"InkList")
-        .map(|l| doc.resolve(l))
-        .and_then(|l| l.as_array().cloned())
-        .unwrap_or_default()
-        .iter()
-        .map(|s| {
-            let v: Vec<f64> = doc.resolve(s).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()).unwrap_or_default();
-            v.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect()
-        })
-        .collect();
-    let Some(inner) = bounds(strokes.iter().flatten().copied()) else {
-        return Err(AnnotError::Invalid("the drawing has no strokes".into()));
-    };
-    let old = d.get(b"Rect").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
-    let old: Vec<f64> = old.iter().filter_map(|v| doc.resolve(v).as_f64()).collect();
-    let old = match old[..] {
-        [a, b, c, e] => normalize([a, b, c, e]),
-        _ => inner,
-    };
-    let margin = [inner[0] - old[0], inner[1] - old[1], old[2] - inner[2], old[3] - inner[3]].map(|m| m.max(0.0));
-    let target = [rect[0] + margin[0], rect[1] + margin[1], rect[2] - margin[2], rect[3] - margin[3]];
-    if !finite(&rect) || target[2] < target[0] || target[3] < target[1] || rect[2] - rect[0] < 1.0 || rect[3] - rect[1] < 1.0 {
-        return Err(AnnotError::Invalid("invalid rectangle (too small)".into()));
-    }
-    // An axis with no extent (a straight stroke) is centred rather than scaled.
-    let axis = |v: f64, a0: f64, a1: f64, b0: f64, b1: f64| if a1 > a0 { b0 + (v - a0) / (a1 - a0) * (b1 - b0) } else { (b0 + b1) / 2.0 };
-    let scaled: Vec<Vec<[f64; 2]>> = strokes
-        .iter()
-        .map(|s| {
-            s.iter().map(|p| [axis(p[0], inner[0], inner[2], target[0], target[2]), axis(p[1], inner[1], inner[3], target[1], target[3])]).collect()
-        })
-        .collect();
-    let before = annot_dict(doc, r);
-    doc.update_dict(r, |d| {
-        d.set(b"InkList".to_vec(), Object::Array(scaled.iter().map(|s| num_array(&s.concat())).collect()));
-        d.set(b"Rect".to_vec(), num_array(&rect));
-        touch(d, meta);
-    })?;
-    redraw_or_restore(doc, r, before)
-}
-
-/// Store `rect` as a FreeText annotation's text box (or a square's/oval's rectangle): a callout's
-/// leader line re-attaches and `/Rect` grows to hold it, and the appearance is redrawn
-/// (`new_text`: for changed contents, see [`set_appearance`] and `draw_appearance`).
-fn apply_text_box(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta, new_text: bool) -> Result<(), AnnotError> {
-    let rect = normalize(rect);
-    if !finite(&rect) || rect[2] - rect[0] < 1.0 || rect[3] - rect[1] < 1.0 {
-        return Err(AnnotError::Invalid("invalid rectangle (too small)".into()));
-    }
-    let d = annot_dict(doc, r);
-    if !new_text {
-        refuse_foreign_text(doc, &d)?;
-    }
-    // A callout's rectangle is its text box: the leader line re-attaches and `/Rect` grows to hold it.
-    let callout = d.get(b"CL").and_then(|o| o.as_array()).map(|a| a.iter().filter_map(|x| x.as_f64()).collect::<Vec<f64>>()).filter(|l| l.len() == 6);
-    let (outer, cl) = match callout {
-        Some(mut l) => {
-            let attach = callout_attach(rect, [l[2], l[3]]);
-            (l[4], l[5]) = (attach[0], attach[1]);
-            let pad = border_width_of(&d) / 2.0 + appearance::arrow_size(border_width_of(&d)) + 1.0;
-            let lead = grow(bounds([[l[0], l[1]], [l[2], l[3]]].into_iter()).unwrap_or_default(), pad);
-            ([rect[0].min(lead[0]), rect[1].min(lead[1]), rect[2].max(lead[2]), rect[3].max(lead[3])], Some(l))
-        }
-        None => (rect, None),
-    };
-    doc.update_dict(r, |d| {
-        d.set(b"Rect".to_vec(), num_array(&outer));
-        match &cl {
-            Some(l) => {
-                d.set(b"CL".to_vec(), num_array(l));
-                d.set(b"RD".to_vec(), num_array(&[rect[0] - outer[0], rect[1] - outer[1], outer[2] - rect[2], outer[3] - rect[3]]));
-            }
-            None => {
-                d.remove(b"RD");
-            }
-        }
-        touch(d, meta);
-    })?;
-    let before = d;
-    if new_text {
-        if let Err(e) = draw_appearance(doc, r) {
-            doc.set(r, Object::Dict(before));
-            return Err(e);
-        }
-        Ok(())
-    } else {
-        redraw_or_restore(doc, r, before)
-    }
-}
-
-fn border_width_of(d: &Dict) -> f64 {
-    d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0).max(0.0)
-}
-
-/// Change a comment's colour, opacity, line width and/or line endings, and redraw it.
-#[allow(clippy::too_many_arguments)]
-pub fn set_style(
-    doc: &mut Document,
-    page: usize,
-    index: usize,
-    color: Option<Rgb>,
-    opacity: Option<f64>,
-    width: Option<f64>,
-    endings: Option<&[LineEnding]>,
-    meta: &Meta,
-) -> Result<(), AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    unlocked(doc, r)?;
-    let d = annot_dict(doc, r);
-    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
-    // Check before changing anything: a stale appearance would contradict the new style.
-    if appearance::build(&d).is_none() {
-        return Err(AnnotError::Unsupported(subtype.clone()));
-    }
-    if color.is_some_and(|c| !finite(&c)) || opacity.is_some_and(|o| !o.is_finite()) || width.is_some_and(|w| !w.is_finite()) {
-        return Err(AnnotError::Invalid("invalid style".into()));
-    }
-    if let Some(ends) = endings {
-        let callout = subtype == "FreeText" && d.contains(b"CL");
-        let pair = matches!(subtype.as_str(), "Line" | "PolyLine");
-        if (callout && ends.len() != 1) || (pair && ends.len() != 2) || (!callout && !pair) {
-            return Err(AnnotError::Invalid("this comment has no line endings to change".into()));
-        }
-    }
-    refuse_foreign_text(doc, &d)?;
-    let free_text = subtype == "FreeText";
-    let before = d;
-    doc.update_dict(r, |d| {
-        if let Some(c) = color {
-            if free_text {
-                let (_, size) = appearance::parse_da(d);
-                let [r, g, b] = c.map(|x| x.clamp(0.0, 1.0));
-                d.set(b"DA".to_vec(), PdfString::literal(format!("{} {} {} rg /Helv {} Tf", n(r), n(g), n(b), n(size)).into_bytes()));
-                rich_text(d);
-            } else {
-                d.set(b"C".to_vec(), rgb(c));
-            }
-        }
-        if let Some(o) = opacity {
-            let o = o.clamp(0.0, 1.0);
-            if o < 1.0 {
-                d.set(b"CA".to_vec(), Object::Real(o));
-            } else {
-                d.remove(b"CA");
-            }
-        }
-        if let Some(w) = width {
-            let mut bs = d.get(b"BS").and_then(|b| b.as_dict()).cloned().unwrap_or_default();
-            bs.set(b"W".to_vec(), Object::Real(w.max(0.0)));
-            d.set(b"BS".to_vec(), Object::Dict(bs));
-            d.remove(b"Border");
-        }
-        if let Some(ends) = endings {
-            if ends.len() == 1 {
-                if let Some(ending) = ends.first() {
-                    d.set(b"LE".to_vec(), Object::name(ending.name()));
-                }
-            } else if let (Some(start), Some(end)) = (ends.first(), ends.get(1)) {
-                d.set(b"LE".to_vec(), ending_pair(*start, *end));
-            }
-        }
-        ensure_ending_room(d);
-        touch(d, meta);
-    })?;
-    redraw_or_restore(doc, r, before)
-}
-
-/// Change the font size of a text box, typewriter text or callout (`/DA` keeps its colour; the
-/// rich-text strings follow) and redraw it. The box grows to hold the wrapped text at the new
-/// size and never shrinks, so a box the user drew large stays large. Sizes are 1 to 400 pt.
-pub fn set_font_size(doc: &mut Document, page: usize, index: usize, size: f64, meta: &Meta) -> Result<(), AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    unlocked(doc, r)?;
-    let d = annot_dict(doc, r);
-    if d.name(b"Subtype") != Some(b"FreeText") {
-        return Err(AnnotError::Invalid("only text boxes, typewriter text and callouts have a font size".into()));
-    }
-    if !size.is_finite() || !(1.0..=400.0).contains(&size) {
-        return Err(AnnotError::Invalid("font size must be 1\u{2013}400 pt".into()));
-    }
-    refuse_foreign_text(doc, &d)?;
-    let before = d;
-    doc.update_dict(r, |d| {
-        let (col, _) = appearance::parse_da(d);
-        d.set(b"DA".to_vec(), PdfString::literal(format!("{} {} {} rg /Helv {} Tf", n(col[0]), n(col[1]), n(col[2]), n(size)).into_bytes()));
-        rich_text(d);
-        touch(d, meta);
-    })?;
-    let text = text_value(doc, &annot_dict(doc, r), b"Contents").unwrap_or_default();
-    let result = match fitted_box(doc, r, &text) {
-        Some(fit) => {
-            let cur = annot_dict(doc, r);
-            let nums: Vec<f64> =
-                cur.get(b"Rect").and_then(|o| o.as_array()).map(|a| a.iter().filter_map(|x| x.as_f64()).collect()).unwrap_or_default();
-            // Keep the top and sides; only the bottom edge moves, and only downwards.
-            match four(&nums).map(normalize) {
-                Some(old) if !cur.contains(b"CL") => apply_text_box(doc, r, [fit[0], fit[1].min(old[1]), fit[2], fit[3]], meta, false),
-                _ => apply_text_box(doc, r, fit, meta, false),
-            }
-        }
-        None => redraw_or_restore(doc, r, before.clone()),
-    };
-    if result.is_err() {
-        doc.set(r, Object::Dict(before));
-    }
-    result
-}
-
-/// Whether a comment has a fill: `/IC` for shapes, `/C` for FreeText (§12.5.6).
-pub fn fillable(subtype: &str) -> bool {
-    matches!(subtype, "Square" | "Circle" | "Polygon" | "FreeText")
-}
-
-/// Fill a shape or FreeText comment with `fill`, or remove its fill (`None`), and
-/// redraw its appearance (Acrobat: Properties ▸ Fill Color).
-pub fn set_fill(doc: &mut Document, page: usize, index: usize, fill: Option<Rgb>, meta: &Meta) -> Result<(), AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    unlocked(doc, r)?;
-    let d = annot_dict(doc, r);
-    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
-    if !fillable(&subtype) {
-        return Err(AnnotError::Invalid("only rectangles, ovals, polygons and text boxes can be filled".into()));
-    }
-    // Check before changing anything: a stale appearance would contradict the new fill.
-    if appearance::build(&d).is_none() {
-        return Err(AnnotError::Unsupported(subtype));
-    }
-    if fill.is_some_and(|c| !finite(&c)) {
-        return Err(AnnotError::Invalid("invalid fill colour".into()));
-    }
-    refuse_foreign_text(doc, &d)?;
-    let before = d;
-    doc.update_dict(r, |d| {
-        let key: &[u8] = if subtype == "FreeText" { b"C" } else { b"IC" };
-        match fill {
-            Some(c) => d.set(key.to_vec(), rgb(c)),
-            None => {
-                d.remove(key);
-            }
-        }
-        touch(d, meta);
-    })?;
-    redraw_or_restore(doc, r, before)
-}
-
-/// Grow a line or polyline's rectangle so a non-`None` ending is not clipped. Idempotent.
-fn ensure_ending_room(d: &mut Dict) {
-    let subtype = d.name(b"Subtype").unwrap_or_default();
-    if !matches!(subtype, b"Line" | b"PolyLine") {
-        return;
-    }
-    if !line_endings_of(d).is_some_and(|ends| ends.iter().any(|e| ending_draws(*e))) {
-        return;
-    }
-    let key: &[u8] = if subtype == b"Line" { b"L" } else { b"Vertices" };
-    let Some(pts) = pair_points(d, key) else { return };
-    let Some(bounds) = bounds(pts.iter().copied()) else { return };
-    let w = border_width_of(d);
-    let need = grow(bounds, w / 2.0 + appearance::arrow_size(w) + 1.0);
-    let vals: Vec<f64> = d.get(b"Rect").and_then(|o| o.as_array()).map(|a| a.iter().filter_map(|x| x.as_f64()).collect()).unwrap_or_default();
-    let Some(rect) = four(&vals) else { return };
-    let union = [rect[0].min(need[0]), rect[1].min(need[1]), rect[2].max(need[2]), rect[3].max(need[3])];
-    if union != rect {
-        d.set(b"Rect".to_vec(), num_array(&union));
-    }
-}
-
-fn four(v: &[f64]) -> Option<[f64; 4]> {
-    Some([*v.first()?, *v.get(1)?, *v.get(2)?, *v.get(3)?])
-}
-
-fn pair_points(d: &Dict, key: &[u8]) -> Option<Vec<[f64; 2]>> {
-    let v: Vec<f64> = d.get(key)?.as_array()?.iter().filter_map(|o| o.as_f64()).collect();
-    if v.len() < 4 || !v.len().is_multiple_of(2) || v.iter().any(|x| !x.is_finite()) {
-        return None;
-    }
-    Some(v.as_chunks::<2>().0.to_vec())
-}
-
-// ── reading ─────────────────────────────────────────────────────────────────────────────────
-
-/// One comment as the viewer lists it (the same fields and rules as
-/// `pdfcraft_render::Annotation`), read straight from the object graph. The engine uses it to
-/// refresh the comment list after a comment edit without re-inspecting the whole document.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Summary {
-    pub page: usize,
-    pub index: usize,
-    pub subtype: String,
-    pub author: Option<String>,
-    pub contents: Option<String>,
-    /// `/M` as written (a PDF date string).
-    pub modified: Option<String>,
-    pub name: Option<String>,
-    pub in_reply_to: Option<String>,
-    pub rect: [f32; 4],
-    pub color: Option<[f32; 3]>,
-    pub state: Option<String>,
-    pub quads: Vec<[f32; 8]>,
-    pub locked: bool,
-    pub intent: Option<String>,
-    /// A Fill & Sign mark ([`is_fill_sign`]).
-    pub fill_sign: bool,
-    /// The NoRotate flag (`/F` bit 5), as `pdfcraft_render::Annotation::no_rotate`.
-    pub no_rotate: bool,
-    /// A line's two ends (`/L`), or the corners of connected lines, a polygon or a cloud
-    /// (`/Vertices`), in user space; empty for other comments.
-    pub points: Vec<[f32; 2]>,
-}
-
-fn text_value(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
-    let o = doc.resolve(d.get(key)?);
-    let s = match &*o {
-        Object::String(s) => s.to_text(),
-        Object::Name(n) => String::from_utf8_lossy(n).into_owned(),
-        _ => return None,
-    };
-    let s = s.trim_matches('\0').trim().to_string();
-    (!s.is_empty()).then_some(s)
-}
-
-/// Whether an annotation subtype is a comment. Links, form widgets, pop-ups and the non-markup
-/// multimedia and print-production annotations (ISO 32000-2 §12.5.6: Screen, Movie, RichMedia,
-/// 3D, PrinterMark, TrapNet, Watermark) are not.
-pub fn is_comment_subtype(subtype: &str) -> bool {
-    !matches!(subtype, "Link" | "Widget" | "Popup" | "Screen" | "Movie" | "RichMedia" | "3D" | "PrinterMark" | "TrapNet" | "Watermark")
-}
-
-/// Every comment (see [`is_comment_subtype`]), ordered by page and then top edge.
-pub fn summaries(doc: &Document) -> Vec<Summary> {
-    let mut out = Vec::new();
-    let Ok(pages) = page_refs(doc) else { return out };
-    for (page, p) in pages.iter().enumerate() {
-        for (index, entry) in annots(doc, *p).iter().enumerate() {
-            let obj = doc.resolve(entry);
-            let Some(d) = obj.as_dict() else { continue };
-            let Some(subtype) = d.name(b"Subtype").map(|s| String::from_utf8_lossy(s).into_owned()) else { continue };
-            if !is_comment_subtype(&subtype) {
-                continue;
-            }
-            let nums = |k: &[u8]| -> Vec<f32> {
-                d.get(k)
-                    .map(|o| doc.resolve(o))
-                    .and_then(|o| o.as_array().map(|a| a.iter().map(|x| doc.resolve(x).as_f64().unwrap_or(0.0) as f32).collect()))
-                    .unwrap_or_default()
-            };
-            let r = nums(b"Rect");
-            let rect = if r.len() == 4 { [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])] } else { [0.0; 4] };
-            let c = nums(b"C");
-            let mut color = (c.len() == 3).then(|| [c[0], c[1], c[2]]);
-            if subtype == "FreeText"
-                && let Some(da) = text_value(doc, d, b"DA")
-            {
-                let t: Vec<&str> = da.split_whitespace().collect();
-                if let Some(i) = t.iter().position(|x| *x == "rg")
-                    && i >= 3
-                {
-                    let f = |k: usize| t[k].parse::<f32>().unwrap_or(0.0);
-                    color = Some([f(i - 3), f(i - 2), f(i - 1)]);
-                }
-            }
-            let quads = nums(b"QuadPoints").as_chunks::<8>().0.to_vec();
-            // Keep in step with `pdfcraft_render::inspect`.
-            let points = match subtype.as_str() {
-                "Line" => Some(nums(b"L")).filter(|l| l.len() == 4).map(|l| l.as_chunks::<2>().0.to_vec()).unwrap_or_default(),
-                "PolyLine" | "Polygon" => nums(b"Vertices").as_chunks::<2>().0.to_vec(),
-                _ => Vec::new(),
-            };
-            let in_reply_to = d.get(b"IRT").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).and_then(|p| text_value(doc, &p, b"NM"));
-            out.push(Summary {
-                page,
-                index,
-                subtype,
-                author: text_value(doc, d, b"T"),
-                // Acrobat ends lines with CR, which the interface would draw as nothing (keep in
-                // step with `pdfcraft_render::inspect`).
-                contents: text_value(doc, d, b"Contents").map(|s| s.replace("\r\n", "\n").replace('\r', "\n")),
-                modified: text_value(doc, d, b"M"),
-                name: text_value(doc, d, b"NM"),
-                in_reply_to,
-                rect,
-                color,
-                state: text_value(doc, d, b"State"),
-                quads,
-                locked: annotation_flags(doc, d) & FLAG_LOCKED != 0,
-                intent: d.get(b"IT").and_then(|o| doc.resolve(o).as_name().map(|n| String::from_utf8_lossy(n).into_owned())),
-                fill_sign: is_fill_sign(doc, d),
-                no_rotate: drawn_upright(doc, d),
-                points,
-            });
-        }
-    }
-    out.sort_by(|a, b| a.page.cmp(&b.page).then(b.rect[3].total_cmp(&a.rect[3])));
-    out
-}
-
-/// Change a comment's author (`/T`), subject (`/Subj`) and, for notes, icon (`/Name`, redrawn).
-/// `None` leaves a value as it is.
-pub fn set_info(
-    doc: &mut Document,
-    page: usize,
-    index: usize,
-    author: Option<&str>,
-    subject: Option<&str>,
-    icon: Option<NoteIcon>,
-    meta: &Meta,
-) -> Result<(), AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    unlocked(doc, r)?;
-    let is_note = annot_dict(doc, r).name(b"Subtype") == Some(b"Text");
-    if icon.is_some() && !is_note {
-        return Err(AnnotError::Invalid("only sticky notes have an icon".into()));
-    }
-    doc.update_dict(r, |d| {
-        if let Some(a) = author {
-            d.set(b"T".to_vec(), PdfString::text(a));
-        }
-        if let Some(s) = subject {
-            d.set(b"Subj".to_vec(), PdfString::text(s));
-        }
-        if let Some(i) = icon {
-            d.set(b"Name".to_vec(), Object::name(i.name()));
-        }
-        touch(d, meta);
-    })?;
-    if icon.is_some() {
-        set_appearance(doc, r)?;
-    }
-    Ok(())
-}
-
-/// What Comment properties shows for one comment.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Props {
-    pub subtype: String,
-    pub author: String,
-    pub subject: String,
-    pub color: Option<Rgb>,
-    pub opacity: f64,
-    /// Border / line width, for shapes, lines, drawings and text boxes.
-    pub width: Option<f64>,
-    /// Notes only.
-    pub icon: Option<NoteIcon>,
-    /// `/M`, as written.
-    pub modified: Option<String>,
-    /// The appearance can be redrawn (so colour, opacity and width can change).
-    pub restylable: bool,
-    /// The Locked flag.
-    pub locked: bool,
-    /// `/LE`: two names for a line or polyline (`None` when unset), one for a callout.
-    pub endings: Option<Vec<LineEnding>>,
-    /// Whether the comment has a fill control (see [`fillable`]).
-    pub fillable: bool,
-    /// The interior colour (`None`: no fill).
-    pub fill: Option<Rgb>,
-    /// Text boxes, typewriter text and callouts: the `/DA` font size in points.
-    pub font_size: Option<f64>,
-}
-
-/// The current properties of the comment at `(page, index)`.
-pub fn props(doc: &Document, page: usize, index: usize) -> Option<Props> {
-    let p = page_ref(doc, page).ok()?;
-    let entry = annots(doc, p).get(index).cloned()?;
-    let obj = doc.resolve(&entry);
-    let d = obj.as_dict()?;
-    let subtype = String::from_utf8_lossy(d.name(b"Subtype")?).into_owned();
-    let c: Vec<f64> = d.get(b"C").and_then(|o| o.as_array().map(|a| a.iter().filter_map(|x| x.as_f64()).collect())).unwrap_or_default();
-    let color = if subtype == "FreeText" { Some(appearance::parse_da(d).0) } else { (c.len() == 3).then(|| [c[0], c[1], c[2]]) };
-    let width = matches!(subtype.as_str(), "Square" | "Circle" | "Line" | "Ink" | "Polygon" | "PolyLine" | "FreeText").then(|| {
-        if subtype == "FreeText" {
-            if !d.contains(b"BS") && !d.contains(b"Border") { 0.0 } else { appearance::border_width(d) }
-        } else {
-            d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0)
-        }
-    });
-    Some(Props {
-        author: text_value(doc, d, b"T").unwrap_or_default(),
-        subject: text_value(doc, d, b"Subj").unwrap_or_default(),
-        color,
-        opacity: d.get(b"CA").and_then(|o| o.as_f64()).unwrap_or(1.0),
-        width,
-        icon: (subtype == "Text").then(|| d.name(b"Name").and_then(|n| NoteIcon::from_name(&String::from_utf8_lossy(n))).unwrap_or(NoteIcon::Note)),
-        modified: text_value(doc, d, b"M"),
-        restylable: appearance::build(d).is_some(),
-        locked: annotation_flags(doc, d) & FLAG_LOCKED != 0,
-        fillable: fillable(&subtype),
-        fill: fill_of(d),
-        font_size: (subtype == "FreeText").then(|| appearance::parse_da(d).1),
-        subtype,
-        endings: line_endings_of(d),
-    })
-}
-
-/// A shape’s `/IC` or FreeText `/C` as RGB. Grey and CMYK fills are converted.
-fn fill_of(d: &Dict) -> Option<Rgb> {
-    let key: &[u8] = if d.name(b"Subtype") == Some(b"FreeText") { b"C" } else { b"IC" };
-    let c: Vec<f64> = d.get(key)?.as_array()?.iter().filter_map(|x| x.as_f64()).collect();
-    let rgb = match c.as_slice() {
-        [g] => [*g; 3],
-        [r, g, b] => [*r, *g, *b],
-        [c, m, y, k] => [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)],
-        _ => return None,
-    };
-    finite(&rgb).then(|| rgb.map(|x| x.clamp(0.0, 1.0)))
-}
-
-/// `/LE` for a line, polyline or callout. Unknown names yield `None` so the control stays hidden.
-fn line_endings_of(d: &Dict) -> Option<Vec<LineEnding>> {
-    let parse = |name: &[u8]| std::str::from_utf8(name).ok().and_then(LineEnding::parse);
-    match d.name(b"Subtype")? {
-        b"Line" | b"PolyLine" => match d.get(b"LE") {
-            None => Some(vec![LineEnding::None, LineEnding::None]),
-            Some(o) => o.as_array().filter(|a| a.len() == 2)?.iter().map(|e| parse(e.as_name()?)).collect(),
-        },
-        b"FreeText" if d.contains(b"CL") => Some(vec![parse(d.name(b"LE").unwrap_or(b"None"))?]),
-        _ => None,
-    }
-}
-
-/// Replace Text (Acrobat's proposal): strike out `quads` and add a caret at the end of the
-/// struck text holding `replacement`, grouped with the strikeout (`/IRT` + `/RT /Group`) so they
-/// move, list and delete as one. Returns the strikeout's index.
-///
-/// The two annotations need their own `/NM`: XFDF names a reply by the `/NM` of what it replies
-/// to, so one id for both writes `inreplyto` equal to the caret's own `name`, and a reader that
-/// resolves names (Acrobat, and our own importer) loses the pair. `caret_meta` is a second id
-/// from the caller, so the edit stays deterministic.
-#[allow(clippy::too_many_arguments)]
-pub fn add_text_replacement(
-    doc: &mut Document,
-    page: usize,
-    quads: &[[f64; 8]],
-    replacement: &str,
-    author: &str,
-    strike: &Style,
-    caret: &Style,
-    meta: &Meta,
-    caret_meta: &Meta,
-) -> Result<usize, AnnotError> {
-    let last = *quads.last().ok_or_else(|| AnnotError::Invalid("select the text to replace first".into()))?;
-    let s = add_annotation(
-        doc,
-        &NewAnnotation {
-            page,
-            shape: Shape::TextMarkup { kind: Markup::StrikeOut, quads: quads.to_vec() },
-            style: strike.clone(),
-            contents: String::new(),
-            author: author.into(),
-        },
-        meta,
-    )?;
-    let (_, sr) = annot_ref(doc, page, s)?;
-    doc.update_dict(sr, |d| d.set(b"IT".to_vec(), Object::name("StrikeOutTextEdit")))?;
-    // The caret sits on the baseline at the end of the last line, its point at the text.
-    let xs = [last[0], last[2], last[4], last[6]];
-    let ys = [last[1], last[3], last[5], last[7]];
-    let x = xs.iter().copied().fold(f64::MIN, f64::max);
-    let (y0, y1) = (ys.iter().copied().fold(f64::MAX, f64::min), ys.iter().copied().fold(f64::MIN, f64::max));
-    let h = ((y1 - y0) * 0.6).clamp(4.0, 24.0);
-    let rect = [x - h / 2.0, y0 - h * 0.6, x + h / 2.0, y0 + h * 0.4];
-    let c = add_annotation(
-        doc,
-        &NewAnnotation { page, shape: Shape::Caret { rect }, style: caret.clone(), contents: replacement.into(), author: author.into() },
-        caret_meta,
-    )?;
-    let (_, cr) = annot_ref(doc, page, c)?;
-    doc.update_dict(cr, |d| {
-        d.set(b"IRT".to_vec(), Object::Ref(sr));
-        d.set(b"RT".to_vec(), Object::name("Group"));
-        d.set(b"Subj".to_vec(), PdfString::text("Replace Text"));
-    })?;
-    Ok(s)
-}
-
-/// The Eraser (Draw tools): remove the parts of drawing `(page, index)` within `radius` points
-/// of `path`, splitting strokes where they are cut. A drawing with nothing left is deleted.
-/// Returns whether anything was erased.
-pub fn erase_ink(doc: &mut Document, page: usize, index: usize, path: &[[f64; 2]], radius: f64, meta: &Meta) -> Result<bool, AnnotError> {
-    let (_, r) = annot_ref(doc, page, index)?;
-    unlocked(doc, r)?;
-    let d = annot_dict(doc, r);
-    if d.name(b"Subtype") != Some(b"Ink") {
-        return Err(AnnotError::Invalid("only drawings can be erased".into()));
-    }
-    if path.is_empty() || !path.iter().all(|p| finite(p)) || !radius.is_finite() || radius <= 0.0 {
-        return Err(AnnotError::Invalid("invalid eraser path".into()));
-    }
-    let strokes: Vec<Vec<[f64; 2]>> = d
-        .get(b"InkList")
-        .map(|l| doc.resolve(l))
-        .and_then(|l| l.as_array().cloned())
-        .unwrap_or_default()
-        .iter()
-        .map(|s| {
-            let v: Vec<f64> = doc.resolve(s).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()).unwrap_or_default();
-            v.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect()
-        })
-        .collect();
-    // Distance from a point to the eraser's path (segments, or a single point).
-    let near = |p: [f64; 2]| -> bool {
-        if path.len() == 1 {
-            return (p[0] - path[0][0]).hypot(p[1] - path[0][1]) <= radius;
-        }
-        path.windows(2).any(|w| {
-            let (a, b) = (w[0], w[1]);
-            let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
-            let len2 = dx * dx + dy * dy;
-            let t = if len2 > 0.0 { (((p[0] - a[0]) * dx + (p[1] - a[1]) * dy) / len2).clamp(0.0, 1.0) } else { 0.0 };
-            (p[0] - (a[0] + t * dx)).hypot(p[1] - (a[1] + t * dy)) <= radius
-        })
-    };
-    let mut kept: Vec<Vec<[f64; 2]>> = Vec::new();
-    let mut erased = false;
-    for s in &strokes {
-        // Densify so long segments are cut where the eraser crosses them.
-        let mut pts: Vec<[f64; 2]> = Vec::new();
-        for w in s.windows(2) {
-            let n = ((w[1][0] - w[0][0]).hypot(w[1][1] - w[0][1]) / (radius / 2.0)).ceil().clamp(1.0, 2000.0) as usize;
-            for k in 0..n {
-                let t = k as f64 / n as f64;
-                pts.push([w[0][0] + (w[1][0] - w[0][0]) * t, w[0][1] + (w[1][1] - w[0][1]) * t]);
-            }
-        }
-        if let Some(last) = s.last() {
-            pts.push(*last);
-        }
-        let mut run: Vec<[f64; 2]> = Vec::new();
-        for p in pts {
-            if near(p) {
-                erased = true;
-                if run.len() >= 2 {
-                    kept.push(std::mem::take(&mut run));
-                }
-                run.clear();
-            } else {
-                run.push(p);
-            }
-        }
-        if run.len() >= 2 {
-            kept.push(run);
-        }
-    }
-    if !erased {
-        return Ok(false);
-    }
-    if kept.is_empty() {
-        delete_annotation(doc, page, index)?;
-        return Ok(true);
-    }
-    let width = d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0);
-    let rect = grow(bounds(kept.iter().flatten().copied()).unwrap_or_default(), width / 2.0 + 1.0);
-    doc.update_dict(r, |d| {
-        d.set(b"InkList".to_vec(), Object::Array(kept.iter().map(|s| num_array(&s.concat())).collect()));
-        d.set(b"Rect".to_vec(), num_array(&rect));
-        touch(d, meta);
-    })?;
-    set_appearance(doc, r)?;
-    Ok(true)
-}
diff --git a/crates/annot/src/links.rs b/crates/annot/src/links.rs
index 53c31d83a6..7cf4328c7c 100644
--- a/crates/annot/src/links.rs
+++ b/crates/annot/src/links.rs
@@ -320,7 +320,7 @@ pub fn delete(doc: &mut Document, page: usize, index: usize) -> Result<(), Annot
     let (p, _) = link_at(doc, page, index)?;
     let mut list = annots(doc, p);
     list.remove(index);
-    set_annots(doc, p, list)
+    Ok(set_annots(doc, p, list)?)
 }
 
 /// Remove every link on `pages` (all when `None`). Returns how many went.
diff --git a/crates/annot/src/lookup.rs b/crates/annot/src/lookup.rs
new file mode 100644
index 0000000000..00ce23c37f
--- /dev/null
+++ b/crates/annot/src/lookup.rs
@@ -0,0 +1,243 @@
+use super::info::text_value;
+use super::types::{FLAG_HIDDEN, FLAG_NO_ROTATE, FLAG_NO_VIEW, Shape};
+use super::*;
+
+// ── pages and /Annots ───────────────────────────────────────────────────────────────────────
+
+/// The page object of each leaf page, in order.
+pub fn page_refs(doc: &Document) -> Result<Vec<ObjRef>, AnnotError> {
+    let root = doc.root().ok_or(AnnotError::NoPageTree)?;
+    let pages = doc.get(root).as_dict().and_then(|d| d.reference(b"Pages")).ok_or(AnnotError::NoPageTree)?;
+    Ok(PageWalk::new(doc, pages).collect())
+}
+
+/// Depth-first walk over the leaf pages under `top`. It keeps one cursor per open `/Kids` array,
+/// never one entry per child, so a child listed many times or shared between nodes is skipped by
+/// the seen check without being queued first (`pdfcraft_model::pages` walks the same way).
+/// Cycles end at the seen check, a `/Kids` array object shared by several nodes is read once,
+/// and at most a million nodes and four million `/Kids` entries are read.
+pub(crate) struct PageWalk<'a> {
+    doc: &'a Document,
+    seen: std::collections::HashSet<ObjRef>,
+    pub(crate) pending: Vec<(std::sync::Arc<Object>, usize)>,
+    /// `/Kids` entries read so far.
+    pub(crate) examined: usize,
+}
+
+impl<'a> PageWalk<'a> {
+    pub(crate) fn new(doc: &'a Document, top: ObjRef) -> Self {
+        let top = std::sync::Arc::new(Object::Array(vec![Object::Ref(top)]));
+        Self { doc, seen: Default::default(), pending: vec![(top, 0)], examined: 0 }
+    }
+}
+
+impl Iterator for PageWalk<'_> {
+    type Item = ObjRef;
+
+    fn next(&mut self) -> Option<ObjRef> {
+        while let Some((kids, next)) = self.pending.last_mut() {
+            let Some(kid) = kids.as_array().and_then(|a| a.get(*next)) else {
+                self.pending.pop();
+                continue;
+            };
+            let node = kid.as_ref();
+            *next += 1;
+            self.examined += 1;
+            let Some(node) = node else { continue };
+            if self.seen.len() >= 1_000_000 || self.examined > 4_000_000 {
+                self.pending.clear();
+                return None;
+            }
+            if !self.seen.insert(node) {
+                continue;
+            }
+            let obj = self.doc.get(node);
+            let Some(d) = obj.as_dict() else { continue };
+            match d.get(b"Kids") {
+                // A `/Kids` array object shared by several nodes is read under the first: under
+                // the others it would only list nodes already seen.
+                Some(Object::Ref(array)) if d.name(b"Type") != Some(b"Page") => {
+                    if self.seen.insert(*array) {
+                        self.pending.push((self.doc.get(*array), 0));
+                    }
+                }
+                Some(kids) if d.name(b"Type") != Some(b"Page") => self.pending.push((self.doc.resolve(kids), 0)),
+                _ => return Some(node),
+            }
+        }
+        None
+    }
+}
+
+pub(crate) fn page_ref(doc: &Document, page: usize) -> Result<ObjRef, AnnotError> {
+    page_refs(doc)?.get(page).copied().ok_or(AnnotError::NoSuchPage(page))
+}
+
+/// The entries of a page's `/Annots` (references or inline dictionaries).
+pub(crate) fn annots(doc: &Document, page: ObjRef) -> Vec<Object> {
+    let obj = doc.get(page);
+    let Some(a) = obj.as_dict().and_then(|d| d.get(b"Annots")) else { return Vec::new() };
+    let list = doc.resolve(a).as_array().cloned().unwrap_or_default();
+    #[cfg(test)]
+    ANNOTS_ENTRIES_COPIED.with(|n| n.set(n.get() + list.len()));
+    list
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Entries copied out of pages' `/Annots` arrays.
+    pub(crate) static ANNOTS_ENTRIES_COPIED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// Replace a page's `/Annots`, writing into the shared array object when it is indirect. An empty
+/// list removes a direct `/Annots`.
+pub fn set_annots(doc: &mut Document, page: ObjRef, list: Vec<Object>) -> Result<(), pdfcraft_cos::CosError> {
+    let existing = doc.get(page).as_dict().and_then(|d| d.reference(b"Annots"));
+    match existing {
+        Some(r) if doc.get(r).as_array().is_some() => doc.set(r, Object::Array(list)),
+        _ => doc.update_dict(page, |d| {
+            if list.is_empty() {
+                d.remove(b"Annots");
+            } else {
+                d.set(b"Annots".to_vec(), Object::Array(list));
+            }
+        })?,
+    }
+    Ok(())
+}
+
+/// The annotation at `(page, index)` as an indirect object (inline dictionaries are promoted).
+pub(crate) fn annot_ref(doc: &mut Document, page: usize, index: usize) -> Result<(ObjRef, ObjRef), AnnotError> {
+    let p = page_ref(doc, page)?;
+    let mut list = annots(doc, p);
+    let entry = list.get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    let r = match entry {
+        Object::Ref(r) if doc.get(r).as_dict().is_some() => r,
+        Object::Dict(d) => {
+            let r = doc.add(Object::Dict(d));
+            list[index] = Object::Ref(r);
+            set_annots(doc, p, list)?;
+            r
+        }
+        _ => return Err(AnnotError::NoSuchAnnotation { page, index }),
+    };
+    Ok((p, r))
+}
+
+pub(crate) fn annot_dict(doc: &Document, r: ObjRef) -> Dict {
+    doc.get(r).as_dict().cloned().unwrap_or_default()
+}
+
+/// A Fill & Sign item: typed text, a check/cross/dot/line, or a typed, drawn or image signature.
+///
+/// New items carry `/PCFillSign`. Older files are recognised from the dictionaries PdfCraft
+/// already writes (`/IT /FreeTextTypeWriter`, stamp `/Name`, drawn ink whose subject is
+/// "Signature").
+pub fn is_fill_sign(doc: &Document, d: &Dict) -> bool {
+    if matches!(d.get(b"PCFillSign").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true))) {
+        return true;
+    }
+    let subtype = d.name(b"Subtype").unwrap_or_default();
+    if subtype == b"FreeText" && d.name(b"IT") == Some(b"FreeTextTypeWriter") {
+        return true;
+    }
+    if subtype == b"Stamp" {
+        if matches!(d.name(b"Name"), Some(b"PCCheck" | b"PCCross" | b"PCDot" | b"PCLine" | b"PCTypedSignature")) {
+            return true;
+        }
+        if matches!(d.name(b"Name"), Some(b"PCCustomSignature" | b"PCCustomInitials"))
+            && matches!(d.get(b"PCPictureImage").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true)))
+        {
+            return true;
+        }
+    }
+    subtype == b"Ink" && text_value(doc, d, b"Subj").as_deref() == Some("Signature")
+}
+
+pub(crate) fn annotation_flags(doc: &Document, d: &Dict) -> i64 {
+    d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0)
+}
+
+/// Whether the renderer keeps the annotation upright on a turned page: the NoRotate flag, with
+/// `/F` read as the renderer reads it (a real truncated, a value that isn't a `u32` no flags).
+pub(crate) fn drawn_upright(doc: &Document, d: &Dict) -> bool {
+    let f = match d.get(b"F").map(|f| doc.resolve(f)).as_deref() {
+        Some(Object::Int(i)) => *i,
+        Some(Object::Real(r)) => *r as i64,
+        _ => 0,
+    };
+    u32::try_from(f).is_ok_and(|f| i64::from(f) & FLAG_NO_ROTATE != 0)
+}
+
+/// Whether any page has a Fill & Sign annotation that flatten would bake in (not hidden).
+pub fn has_visible_fill_sign(doc: &Document) -> bool {
+    let Ok(pages) = page_refs(doc) else { return false };
+    for page in pages {
+        for entry in annots(doc, page) {
+            let obj = doc.resolve(&entry);
+            let Some(d) = obj.as_dict() else { continue };
+            let flags = annotation_flags(doc, d);
+            if flags & (FLAG_HIDDEN | FLAG_NO_VIEW) != 0 {
+                continue;
+            }
+            if is_fill_sign(doc, d) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+pub(crate) fn fill_sign_shape(shape: &Shape) -> bool {
+    match shape {
+        Shape::Typewriter { .. } | Shape::Mark { .. } | Shape::Signature { .. } | Shape::TypedSignature { .. } => true,
+        Shape::CustomStamp { name, image: true, .. } => name == "Signature" || name == "Initials",
+        _ => false,
+    }
+}
+
+/// The embedded image of a Fill & Sign image signature or initials (0-based target).
+/// Other stamps have appearances that can't be represented by this image alone.
+pub fn signature_image(doc: &Document, page: usize, index: usize) -> Result<Option<ObjRef>, AnnotError> {
+    let p = page_ref(doc, page)?;
+    let list = annots(doc, p);
+    let entry = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    let obj = doc.resolve(entry);
+    let Some(d) = obj.as_dict() else { return Ok(None) };
+    Ok((d.name(b"Subtype") == Some(b"Stamp")
+        && matches!(d.name(b"Name"), Some(b"PCCustomSignature" | b"PCCustomInitials"))
+        && matches!(d.get(b"PCPictureImage"), Some(Object::Bool(true))))
+    .then(|| d.reference(b"PCPicture"))
+    .flatten())
+}
+
+/// The page `/Rotate` the picture of the image signature at `(page, index)` is drawn turned back
+/// by, so it reads upright on a page shown that way: 0 for one added to an unturned page, or by
+/// another app. The picture appears turned by the page's current rotation less this.
+pub fn picture_rotation(doc: &Document, page: usize, index: usize) -> Result<i64, AnnotError> {
+    let p = page_ref(doc, page)?;
+    let list = annots(doc, p);
+    let entry = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    Ok(doc.resolve(entry).as_dict().map_or(0, appearance::picture_turn))
+}
+
+/// Leave page `page` of (a copy of) a document showing only its annotation at `index`, without
+/// the page's content or other annotations, so a render draws that annotation alone: to lay it
+/// over the page while it is dragged. `false`, with `doc` unchanged, when the annotation has no
+/// normal appearance (`/AP /N`) for that render to draw.
+pub fn isolate_annotation(doc: &mut Document, page: usize, index: usize) -> Result<bool, AnnotError> {
+    let p = page_ref(doc, page)?;
+    let entry = annots(doc, p).get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    let has_normal = {
+        let obj = doc.resolve(&entry);
+        obj.as_dict().and_then(|d| d.get(b"AP")).is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N")))
+    };
+    if !has_normal {
+        return Ok(false);
+    }
+    set_annots(doc, p, vec![entry])?;
+    doc.update_dict(p, |d| {
+        d.remove(b"Contents");
+    })?;
+    Ok(true)
+}
diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
new file mode 100644
index 0000000000..992b3d0c51
--- /dev/null
+++ b/crates/annot/src/modify.rs
@@ -0,0 +1,825 @@
+use super::create::{
+    add_annotation, base_dict, bounds, callout_attach, ending_draws, ending_pair, finite, grow, normalize, num_array, rect_for, rgb,
+};
+use super::draw::{draw_appearance, redraw_or_restore, set_appearance};
+use super::info::{line_endings_of, text_value};
+use super::lookup::{annot_dict, annot_ref, annotation_flags, annots, page_ref, set_annots};
+use super::types::{
+    FLAG_HIDDEN, FLAG_LOCKED, FLAG_NO_ROTATE, FLAG_NO_ZOOM, FLAG_PRINT, LineEnding, Markup, Meta, NewAnnotation, ReviewState, Rgb, Shape, Style,
+};
+use super::*;
+
+/// A comment another program drew, whose text the standard fonts can't draw. Redrawing it would
+/// replace those characters with `?`, so the edit is refused before the dictionary changes.
+pub(crate) fn refuse_foreign_text(doc: &Document, d: &Dict) -> Result<(), AnnotError> {
+    let drawn_elsewhere =
+        d.get(b"AP").is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N"))) && pdfcraft_fonts::undrawn_mark(d).is_none();
+    if drawn_elsewhere && let Some((what, c)) = appearance::undrawable_text(d) {
+        return Err(AnnotError::Undrawable(format!(
+            "PdfCraft can't redraw this comment: the standard fonts can't draw \"{}\" (U+{:04X}) in {what}, which would then show as ? (the comment was left as it is)",
+            c.escape_debug(),
+            u32::from(c)
+        )));
+    }
+    Ok(())
+}
+
+/// Format a number for content streams and DA strings.
+pub(crate) fn n(v: f64) -> String {
+    let s = format!("{:.3}", if v.abs() < 5e-4 { 0.0 } else { v });
+    let s = s.trim_end_matches('0').trim_end_matches('.');
+    if s == "-0" { "0".into() } else { s.into() }
+}
+
+// ── edits ───────────────────────────────────────────────────────────────────────────────────
+
+/// A text box's rich text (§12.7.4.3): `/DS` (default style) and `/RC` (XHTML) written from its
+/// plain `/Contents`, `/DA` and `/Q`, so viewers that edit rich text show the same thing.
+pub(crate) fn rich_text(d: &mut Dict) {
+    let text = d.get(b"Contents").and_then(|c| c.as_string()).map(PdfString::to_text).unwrap_or_default();
+    let (col, size) = appearance::parse_da(d);
+    let hex = format!(
+        "#{:02X}{:02X}{:02X}",
+        (col[0].clamp(0.0, 1.0) * 255.0).round() as u8,
+        (col[1].clamp(0.0, 1.0) * 255.0).round() as u8,
+        (col[2].clamp(0.0, 1.0) * 255.0).round() as u8
+    );
+    let align = match d.get(b"Q").and_then(Object::as_int) {
+        Some(1) => "center",
+        Some(2) => "right",
+        _ => "left",
+    };
+    let esc = |s: &str| s.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;");
+    let body: String = text.split('\n').map(|line| format!("<p dir=\"ltr\">{}</p>", esc(line.trim_end_matches('\r')))).collect();
+    let style = format!(
+        "font-size:{}pt;text-align:{align};color:{hex};font-weight:normal;font-style:normal;font-family:Helvetica;font-stretch:normal",
+        n(size)
+    );
+    let rc = format!(
+        "<?xml version=\"1.0\"?><body xmlns=\"http://www.w3.org/1999/xhtml\" xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\" xfa:spec=\"2.0.2\" style=\"{style}\">{body}</body>"
+    );
+    d.set(b"DS".to_vec(), PdfString::text(&format!("font: Helvetica {}pt; text-align:{align}; color:{hex}", n(size))));
+    d.set(b"RC".to_vec(), PdfString::text(&rc));
+}
+
+pub(crate) fn touch(d: &mut Dict, meta: &Meta) {
+    if let Some(date) = &meta.date {
+        d.set(b"M".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
+    }
+}
+
+/// Delete a comment together with its pop-up and its replies (and theirs), as Acrobat does.
+pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
+    let p = page_ref(doc, page)?;
+    let list = annots(doc, p);
+    let target = list.get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    if let Some(r) = target.as_ref() {
+        unlocked(doc, r)?;
+    }
+    // An inline comment has no reference to collect; the pop-up it names still goes.
+    let seed = target.as_ref().or_else(|| target.as_dict().and_then(|d| d.reference(b"Popup")));
+    let doomed = with_replies_and_popups(doc, &list, seed);
+    let kept: Vec<Object> = list.into_iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e).collect();
+    Ok(set_annots(doc, p, kept)?)
+}
+
+/// Whether the `/Annots` entry `entry` goes with `going` (from [`with_replies_and_popups`]): it is
+/// one of them, or it is written inline (a file can, though the standard asks for references) and
+/// replies to (`/IRT`) or pops up for (`/Parent`) one of them. An inline entry has no reference
+/// for the walk to collect, so it is matched here.
+pub fn goes_with(entry: &Object, going: &HashSet<ObjRef>) -> bool {
+    match entry.as_ref() {
+        Some(r) => going.contains(&r),
+        None => entry.as_dict().is_some_and(|d| [d.reference(b"IRT"), d.reference(b"Parent")].into_iter().flatten().any(|r| going.contains(&r))),
+    }
+}
+
+/// `doomed` and what goes with it, as Acrobat deletes a comment: the entries of `list` (one or
+/// more pages' `/Annots`) that reply to (`/IRT`) or pop up for (`/Parent`) anything going, their
+/// own replies, and the pop-ups going annotations name (`/Popup`). An inline reply has no
+/// reference to collect, but the pop-up it names is. Each annotation is visited once, so a long or
+/// cyclic chain costs no more than its length. Filter a list with [`goes_with`], which also
+/// matches inline entries.
+pub fn with_replies_and_popups(doc: &Document, list: &[Object], doomed: impl IntoIterator<Item = ObjRef>) -> HashSet<ObjRef> {
+    let mut hanging: HashMap<ObjRef, Vec<ObjRef>> = HashMap::new();
+    for e in list {
+        let obj = doc.resolve(e);
+        let Some(d) = obj.as_dict() else { continue };
+        // What goes with the annotation this entry hangs off: the entry, or for an inline one the
+        // pop-up it names.
+        let Some(goes) = e.as_ref().or_else(|| d.reference(b"Popup")) else { continue };
+        for on in [d.reference(b"IRT"), d.reference(b"Parent")].into_iter().flatten() {
+            hanging.entry(on).or_default().push(goes);
+        }
+    }
+    let mut going = HashSet::new();
+    let mut todo: Vec<ObjRef> = doomed.into_iter().collect();
+    while let Some(r) = todo.pop() {
+        if !going.insert(r) {
+            continue;
+        }
+        todo.extend(hanging.get(&r).into_iter().flatten());
+        todo.extend(doc.get(r).as_dict().and_then(|d| d.reference(b"Popup")));
+    }
+    going
+}
+
+/// Change a comment's text. Text boxes are redrawn to show it, and their rectangle follows the
+/// new text: the wrap width and top edge stay, the height fits the wrapped lines.
+pub fn set_contents(doc: &mut Document, page: usize, index: usize, text: &str, meta: &Meta) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    let free_text = annot_dict(doc, r).name(b"Subtype") == Some(b"FreeText");
+    doc.update_dict(r, |d| {
+        d.set(b"Contents".to_vec(), PdfString::text(text));
+        // The rich-text version follows the new plain text (text boxes), or would contradict it.
+        if free_text {
+            rich_text(d);
+        } else {
+            d.remove(b"RC");
+        }
+        touch(d, meta);
+    })?;
+    if free_text {
+        // The box grows and shrinks with the text instead of clipping it. A locked box keeps its
+        // text editable (as in Acrobat), so the re-fit ignores the lock. New text is drawn even
+        // where the standard fonts can't draw some of it (marked and reported, see
+        // `draw_appearance`).
+        match fitted_box(doc, r, text) {
+            Some(rect) => apply_text_box(doc, r, rect, meta, true)?,
+            None => draw_appearance(doc, r)?,
+        }
+    }
+    Ok(())
+}
+
+/// The rectangle a FreeText annotation's text box needs for `text`: the current wrap width and
+/// top edge stay and the height fits the wrapped lines, as at creation. `None` keeps the old
+/// rectangle (the box can't be measured, so only the appearance is redrawn).
+fn fitted_box(doc: &Document, r: ObjRef, text: &str) -> Option<[f64; 4]> {
+    let d = annot_dict(doc, r);
+    let nums = |key: &[u8]| -> Option<Vec<f64>> { d.get(key)?.as_array()?.iter().map(|o| o.as_f64()).collect() };
+    let (_, size) = appearance::parse_da(&d);
+    let pad = 2.0 + border_width_of(&d);
+    let rect = nums(b"Rect").filter(|v| v.len() == 4 && v.iter().all(|x| x.is_finite()))?;
+    let rect = [rect[0], rect[1], rect[2], rect[3]];
+    // A callout re-fits its text box (`/Rect` inset by `/RD`); the leader line keeps its place.
+    let tb = if d.contains(b"CL") {
+        let rd = nums(b"RD").filter(|v| v.len() == 4 && v.iter().all(|x| *x >= 0.0))?;
+        [rect[0] + rd[0], rect[1] + rd[1], rect[2] - rd[2], rect[3] - rd[3]]
+    } else {
+        rect
+    };
+    let (x0, top) = (tb[0].min(tb[2]), tb[1].max(tb[3]));
+    let w = tb[2] - tb[0];
+    let w = if w.is_finite() && w >= 1.0 {
+        w
+    } else {
+        // No usable old width: fall back to the creation-time width (at most 300 pt).
+        let longest = text.lines().map(|l| appearance::text_width(l, size)).fold(0.0, f64::max);
+        (longest + 2.0 * pad + 4.0).clamp(40.0, 300.0)
+    };
+    let lines = appearance::wrap(text, size, (w - 2.0 * pad).max(1.0)).len().max(1) as f64;
+    Some([x0, top - lines * size * 1.2 - 2.0 * pad - 2.0, x0 + w, top])
+}
+
+/// Reply to a comment; returns the reply's index in the page's `/Annots`.
+///
+/// A reply is a text annotation with `/IRT` pointing at its parent (§12.5.6.2). It gets the
+/// parent's rectangle and an empty appearance, so it shows in comment lists but never paints a
+/// second icon on the page.
+pub fn add_reply(doc: &mut Document, page: usize, index: usize, text: &str, author: &str, meta: &Meta) -> Result<usize, AnnotError> {
+    reply(doc, page, index, text, author, meta, None)
+}
+
+/// Set a comment's review status (Acrobat: "Set status ▸ Accepted"…). Like Acrobat this adds a
+/// state reply (`/State`, `/StateModel /Review`) by `author`; the latest one wins.
+pub fn set_review_state(doc: &mut Document, page: usize, index: usize, state: ReviewState, author: &str, meta: &Meta) -> Result<usize, AnnotError> {
+    let text = format!("{} set by {}", state.name(), if author.is_empty() { "unknown" } else { author });
+    reply(doc, page, index, &text, author, meta, Some(state))
+}
+
+fn reply(
+    doc: &mut Document,
+    page: usize,
+    index: usize,
+    text: &str,
+    author: &str,
+    meta: &Meta,
+    state: Option<ReviewState>,
+) -> Result<usize, AnnotError> {
+    let (p, parent) = annot_ref(doc, page, index)?;
+    let pd = annot_dict(doc, parent);
+    if pd.name(b"Subtype") == Some(b"Popup") {
+        return Err(AnnotError::Invalid("pop-ups can't be replied to".into()));
+    }
+    let rect = pd.get(b"Rect").cloned().unwrap_or_else(|| num_array(&[0.0, 0.0, 0.0, 0.0]));
+    let mut d = base_dict("Text", [0.0; 4], p, text, author, meta);
+    d.set(b"Rect".to_vec(), rect);
+    d.set(b"IRT".to_vec(), Object::Ref(parent));
+    d.set(b"F".to_vec(), Object::Int(FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
+    d.set(b"Name".to_vec(), Object::name("Comment"));
+    if let Some(c) = pd.get(b"C") {
+        d.set(b"C".to_vec(), c.clone());
+    }
+    if let Some(s) = state {
+        d.set(b"State".to_vec(), PdfString::text(s.name()));
+        d.set(b"StateModel".to_vec(), PdfString::text("Review"));
+        d.set(b"Subj".to_vec(), PdfString::text("Status"));
+    }
+    // An empty form: nothing is drawn for the reply itself.
+    let mut fd = Dict::new();
+    fd.set(b"Type".to_vec(), Object::name("XObject"));
+    fd.set(b"Subtype".to_vec(), Object::name("Form"));
+    fd.set(b"BBox".to_vec(), num_array(&[0.0, 0.0, 0.0, 0.0]));
+    let ap = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(fd, Vec::new())));
+    let mut apd = Dict::new();
+    apd.set(b"N".to_vec(), Object::Ref(ap));
+    d.set(b"AP".to_vec(), Object::Dict(apd));
+    let r = doc.add(Object::Dict(d));
+    let mut list = annots(doc, p);
+    list.push(Object::Ref(r));
+    let i = list.len() - 1;
+    set_annots(doc, p, list)?;
+    Ok(i)
+}
+
+fn flags(doc: &Document, r: ObjRef) -> i64 {
+    doc.get(r).as_dict().map(|d| annotation_flags(doc, d)).unwrap_or(0)
+}
+
+/// Refuse to change a locked comment (Acrobat: Properties ▸ Locked).
+pub(crate) fn unlocked(doc: &Document, r: ObjRef) -> Result<(), AnnotError> {
+    if flags(doc, r) & FLAG_LOCKED != 0 { Err(AnnotError::Invalid("the comment is locked".into())) } else { Ok(()) }
+}
+
+/// Lock or unlock a comment (the Locked flag). A locked comment can't be moved, resized,
+/// restyled or deleted; its text and replies stay editable, as in Acrobat.
+pub fn set_locked(doc: &mut Document, page: usize, index: usize, locked: bool) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    let f = if locked { flags(doc, r) | FLAG_LOCKED } else { flags(doc, r) & !FLAG_LOCKED };
+    doc.update_dict(r, |d| d.set(b"F".to_vec(), Object::Int(f)))?;
+    Ok(())
+}
+
+/// Mark or unmark a comment with a checkmark. Like Acrobat this adds a hidden state reply with
+/// `/StateModel /Marked` by `author`; the latest one wins. It's private bookkeeping, not a status.
+pub fn set_marked(doc: &mut Document, page: usize, index: usize, marked: bool, author: &str, meta: &Meta) -> Result<usize, AnnotError> {
+    let (p, parent) = annot_ref(doc, page, index)?;
+    let pd = annot_dict(doc, parent);
+    if pd.name(b"Subtype") == Some(b"Popup") {
+        return Err(AnnotError::Invalid("pop-ups can't be marked".into()));
+    }
+    let state = if marked { "Marked" } else { "Unmarked" };
+    let text = format!("{state} set by {}", if author.is_empty() { "unknown" } else { author });
+    let mut d = base_dict("Text", [0.0; 4], p, &text, author, meta);
+    d.set(b"Rect".to_vec(), pd.get(b"Rect").cloned().unwrap_or_else(|| num_array(&[0.0; 4])));
+    d.set(b"IRT".to_vec(), Object::Ref(parent));
+    d.set(b"F".to_vec(), Object::Int(FLAG_HIDDEN | FLAG_PRINT | FLAG_NO_ZOOM | FLAG_NO_ROTATE));
+    d.set(b"State".to_vec(), PdfString::text(state));
+    d.set(b"StateModel".to_vec(), PdfString::text("Marked"));
+    let r = doc.add(Object::Dict(d));
+    let mut list = annots(doc, p);
+    list.push(Object::Ref(r));
+    let i = list.len() - 1;
+    set_annots(doc, p, list)?;
+    Ok(i)
+}
+
+/// Move a comment (and its pop-up) by `(dx, dy)` points. The appearance moves with `/Rect`.
+pub fn move_annotation(doc: &mut Document, page: usize, index: usize, dx: f64, dy: f64, meta: &Meta) -> Result<(), AnnotError> {
+    if !finite(&[dx, dy]) {
+        return Err(AnnotError::Invalid("invalid offset".into()));
+    }
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let shift = |o: &Object, every: bool| -> Option<Object> {
+        let a = o.as_array()?;
+        Some(Object::Array(
+            a.iter()
+                .enumerate()
+                .map(|(i, v)| match v.as_f64() {
+                    Some(x) if every || i < 4 => Object::Real(x + if i % 2 == 0 { dx } else { dy }),
+                    _ => v.clone(),
+                })
+                .collect(),
+        ))
+    };
+    let popup = annot_dict(doc, r).reference(b"Popup");
+    doc.update_dict(r, |d| {
+        for (k, every) in [(&b"Rect"[..], false), (b"QuadPoints", true), (b"L", false), (b"CL", true), (b"Vertices", true)] {
+            if let Some(v) = d.get(k).and_then(|o| shift(o, every)) {
+                d.set(k.to_vec(), v);
+            }
+        }
+        if let Some(Object::Array(list)) = d.get(b"InkList").cloned() {
+            let moved = list.iter().map(|s| shift(s, true).unwrap_or_else(|| s.clone())).collect();
+            d.set(b"InkList".to_vec(), Object::Array(moved));
+        }
+        touch(d, meta);
+    })?;
+    if let Some(p) = popup
+        && doc.get(p).as_dict().is_some()
+    {
+        doc.update_dict(p, |d| {
+            if let Some(v) = d.get(b"Rect").and_then(|o| shift(o, false)) {
+                d.set(b"Rect".to_vec(), v);
+            }
+        })?;
+    }
+    Ok(())
+}
+
+/// Resize a rectangle, oval, text box, stamp or drawing to `rect`. Stamps keep their appearance,
+/// which PDF viewers scale from its bounding box into the new rectangle; drawings scale their
+/// strokes and get a new one.
+pub fn set_rect(doc: &mut Document, page: usize, index: usize, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let d = annot_dict(doc, r);
+    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
+    if subtype == "Stamp" {
+        let rect = normalize(rect);
+        if !finite(&rect) || rect[2] <= rect[0] || rect[3] <= rect[1] {
+            return Err(AnnotError::Invalid("invalid rectangle (too small)".into()));
+        }
+        doc.update_dict(r, |d| {
+            d.set(b"Rect".to_vec(), num_array(&rect));
+            touch(d, meta);
+        })?;
+        return Ok(());
+    }
+    if subtype == "Ink" {
+        return resize_ink(doc, r, normalize(rect), meta);
+    }
+    if !matches!(subtype.as_str(), "Square" | "Circle" | "FreeText") {
+        return Err(AnnotError::Invalid(format!("{subtype} comments can't be resized")));
+    }
+    apply_text_box(doc, r, rect, meta, false)
+}
+
+/// At most this many points reshape a comment (a drawn polygon has a handful).
+const MAX_POINTS: usize = 100_000;
+
+/// Reshape a line, connected lines, a polygon or a cloud: its points in user space (a line's two
+/// ends, the others' corners), as dragging the comment's handles sets them. `/Rect` follows the
+/// points with room for the line's width and endings, as when the comment was drawn, and the
+/// appearance is redrawn. A measurement keeps the points it measured.
+pub fn set_points(doc: &mut Document, page: usize, index: usize, points: &[[f64; 2]], meta: &Meta) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let d = annot_dict(doc, r);
+    if d.contains(b"Measure") {
+        return Err(AnnotError::Invalid("a measurement's points are where it measured".into()));
+    }
+    if points.len() > MAX_POINTS {
+        return Err(AnnotError::Invalid(format!("at most {MAX_POINTS} points")));
+    }
+    let style = Style { width: border_width_of(&d), ..Style::default() };
+    let ends = line_endings_of(&d).unwrap_or_default();
+    let (start, end) = (ends.first().copied().unwrap_or(LineEnding::None), ends.get(1).copied().unwrap_or(LineEnding::None));
+    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
+    let (shape, key): (Shape, &[u8]) = match (subtype.as_str(), points) {
+        ("Line", [from, to]) => (Shape::Line { from: *from, to: *to, start, end }, b"L"),
+        ("Line", _) => return Err(AnnotError::Invalid("a line has two ends".into())),
+        ("PolyLine", _) => (Shape::PolyLine { vertices: points.to_vec(), start, end }, b"Vertices"),
+        ("Polygon", _) => {
+            let cloud = d.get(b"BE").and_then(|b| b.as_dict()).is_some_and(|b| b.name(b"S") == Some(b"C"));
+            (Shape::Polygon { vertices: points.to_vec(), cloud }, b"Vertices")
+        }
+        (other, _) => return Err(AnnotError::Invalid(format!("{other} comments have no points to move"))),
+    };
+    // Checks the points too: finite, and far enough apart to draw.
+    let rect = rect_for(&shape, &style)?;
+    let before = d;
+    doc.update_dict(r, |d| {
+        d.set(key.to_vec(), num_array(&points.concat()));
+        d.set(b"Rect".to_vec(), num_array(&rect));
+        touch(d, meta);
+    })?;
+    redraw_or_restore(doc, r, before)
+}
+
+/// Scale a drawing's strokes into `rect`. The margin between the strokes and the old `/Rect` (half
+/// the line width and a little more) stays the same on each side, so the line isn't clipped.
+fn resize_ink(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
+    let d = annot_dict(doc, r);
+    let strokes: Vec<Vec<[f64; 2]>> = d
+        .get(b"InkList")
+        .map(|l| doc.resolve(l))
+        .and_then(|l| l.as_array().cloned())
+        .unwrap_or_default()
+        .iter()
+        .map(|s| {
+            let v: Vec<f64> = doc.resolve(s).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()).unwrap_or_default();
+            v.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect()
+        })
+        .collect();
+    let Some(inner) = bounds(strokes.iter().flatten().copied()) else {
+        return Err(AnnotError::Invalid("the drawing has no strokes".into()));
+    };
+    let old = d.get(b"Rect").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
+    let old: Vec<f64> = old.iter().filter_map(|v| doc.resolve(v).as_f64()).collect();
+    let old = match old[..] {
+        [a, b, c, e] => normalize([a, b, c, e]),
+        _ => inner,
+    };
+    let margin = [inner[0] - old[0], inner[1] - old[1], old[2] - inner[2], old[3] - inner[3]].map(|m| m.max(0.0));
+    let target = [rect[0] + margin[0], rect[1] + margin[1], rect[2] - margin[2], rect[3] - margin[3]];
+    if !finite(&rect) || target[2] < target[0] || target[3] < target[1] || rect[2] - rect[0] < 1.0 || rect[3] - rect[1] < 1.0 {
+        return Err(AnnotError::Invalid("invalid rectangle (too small)".into()));
+    }
+    // An axis with no extent (a straight stroke) is centred rather than scaled.
+    let axis = |v: f64, a0: f64, a1: f64, b0: f64, b1: f64| if a1 > a0 { b0 + (v - a0) / (a1 - a0) * (b1 - b0) } else { (b0 + b1) / 2.0 };
+    let scaled: Vec<Vec<[f64; 2]>> = strokes
+        .iter()
+        .map(|s| {
+            s.iter().map(|p| [axis(p[0], inner[0], inner[2], target[0], target[2]), axis(p[1], inner[1], inner[3], target[1], target[3])]).collect()
+        })
+        .collect();
+    let before = annot_dict(doc, r);
+    doc.update_dict(r, |d| {
+        d.set(b"InkList".to_vec(), Object::Array(scaled.iter().map(|s| num_array(&s.concat())).collect()));
+        d.set(b"Rect".to_vec(), num_array(&rect));
+        touch(d, meta);
+    })?;
+    redraw_or_restore(doc, r, before)
+}
+
+/// Store `rect` as a FreeText annotation's text box (or a square's/oval's rectangle): a callout's
+/// leader line re-attaches and `/Rect` grows to hold it, and the appearance is redrawn
+/// (`new_text`: for changed contents, see [`set_appearance`] and `draw_appearance`).
+fn apply_text_box(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta, new_text: bool) -> Result<(), AnnotError> {
+    let rect = normalize(rect);
+    if !finite(&rect) || rect[2] - rect[0] < 1.0 || rect[3] - rect[1] < 1.0 {
+        return Err(AnnotError::Invalid("invalid rectangle (too small)".into()));
+    }
+    let d = annot_dict(doc, r);
+    if !new_text {
+        refuse_foreign_text(doc, &d)?;
+    }
+    // A callout's rectangle is its text box: the leader line re-attaches and `/Rect` grows to hold it.
+    let callout = d.get(b"CL").and_then(|o| o.as_array()).map(|a| a.iter().filter_map(|x| x.as_f64()).collect::<Vec<f64>>()).filter(|l| l.len() == 6);
+    let (outer, cl) = match callout {
+        Some(mut l) => {
+            let attach = callout_attach(rect, [l[2], l[3]]);
+            (l[4], l[5]) = (attach[0], attach[1]);
+            let pad = border_width_of(&d) / 2.0 + appearance::arrow_size(border_width_of(&d)) + 1.0;
+            let lead = grow(bounds([[l[0], l[1]], [l[2], l[3]]].into_iter()).unwrap_or_default(), pad);
+            ([rect[0].min(lead[0]), rect[1].min(lead[1]), rect[2].max(lead[2]), rect[3].max(lead[3])], Some(l))
+        }
+        None => (rect, None),
+    };
+    doc.update_dict(r, |d| {
+        d.set(b"Rect".to_vec(), num_array(&outer));
+        match &cl {
+            Some(l) => {
+                d.set(b"CL".to_vec(), num_array(l));
+                d.set(b"RD".to_vec(), num_array(&[rect[0] - outer[0], rect[1] - outer[1], outer[2] - rect[2], outer[3] - rect[3]]));
+            }
+            None => {
+                d.remove(b"RD");
+            }
+        }
+        touch(d, meta);
+    })?;
+    let before = d;
+    if new_text {
+        if let Err(e) = draw_appearance(doc, r) {
+            doc.set(r, Object::Dict(before));
+            return Err(e);
+        }
+        Ok(())
+    } else {
+        redraw_or_restore(doc, r, before)
+    }
+}
+
+fn border_width_of(d: &Dict) -> f64 {
+    d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0).max(0.0)
+}
+
+/// Change a comment's colour, opacity, line width and/or line endings, and redraw it.
+#[allow(clippy::too_many_arguments)]
+pub fn set_style(
+    doc: &mut Document,
+    page: usize,
+    index: usize,
+    color: Option<Rgb>,
+    opacity: Option<f64>,
+    width: Option<f64>,
+    endings: Option<&[LineEnding]>,
+    meta: &Meta,
+) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let d = annot_dict(doc, r);
+    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
+    // Check before changing anything: a stale appearance would contradict the new style.
+    if appearance::build(&d).is_none() {
+        return Err(AnnotError::Unsupported(subtype.clone()));
+    }
+    if color.is_some_and(|c| !finite(&c)) || opacity.is_some_and(|o| !o.is_finite()) || width.is_some_and(|w| !w.is_finite()) {
+        return Err(AnnotError::Invalid("invalid style".into()));
+    }
+    if let Some(ends) = endings {
+        let callout = subtype == "FreeText" && d.contains(b"CL");
+        let pair = matches!(subtype.as_str(), "Line" | "PolyLine");
+        if (callout && ends.len() != 1) || (pair && ends.len() != 2) || (!callout && !pair) {
+            return Err(AnnotError::Invalid("this comment has no line endings to change".into()));
+        }
+    }
+    refuse_foreign_text(doc, &d)?;
+    let free_text = subtype == "FreeText";
+    let before = d;
+    doc.update_dict(r, |d| {
+        if let Some(c) = color {
+            if free_text {
+                let (_, size) = appearance::parse_da(d);
+                let [r, g, b] = c.map(|x| x.clamp(0.0, 1.0));
+                d.set(b"DA".to_vec(), PdfString::literal(format!("{} {} {} rg /Helv {} Tf", n(r), n(g), n(b), n(size)).into_bytes()));
+                rich_text(d);
+            } else {
+                d.set(b"C".to_vec(), rgb(c));
+            }
+        }
+        if let Some(o) = opacity {
+            let o = o.clamp(0.0, 1.0);
+            if o < 1.0 {
+                d.set(b"CA".to_vec(), Object::Real(o));
+            } else {
+                d.remove(b"CA");
+            }
+        }
+        if let Some(w) = width {
+            let mut bs = d.get(b"BS").and_then(|b| b.as_dict()).cloned().unwrap_or_default();
+            bs.set(b"W".to_vec(), Object::Real(w.max(0.0)));
+            d.set(b"BS".to_vec(), Object::Dict(bs));
+            d.remove(b"Border");
+        }
+        if let Some(ends) = endings {
+            if ends.len() == 1 {
+                if let Some(ending) = ends.first() {
+                    d.set(b"LE".to_vec(), Object::name(ending.name()));
+                }
+            } else if let (Some(start), Some(end)) = (ends.first(), ends.get(1)) {
+                d.set(b"LE".to_vec(), ending_pair(*start, *end));
+            }
+        }
+        ensure_ending_room(d);
+        touch(d, meta);
+    })?;
+    redraw_or_restore(doc, r, before)
+}
+
+/// Change the font size of a text box, typewriter text or callout (`/DA` keeps its colour; the
+/// rich-text strings follow) and redraw it. The box grows to hold the wrapped text at the new
+/// size and never shrinks, so a box the user drew large stays large. Sizes are 1 to 400 pt.
+pub fn set_font_size(doc: &mut Document, page: usize, index: usize, size: f64, meta: &Meta) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let d = annot_dict(doc, r);
+    if d.name(b"Subtype") != Some(b"FreeText") {
+        return Err(AnnotError::Invalid("only text boxes, typewriter text and callouts have a font size".into()));
+    }
+    if !size.is_finite() || !(1.0..=400.0).contains(&size) {
+        return Err(AnnotError::Invalid("font size must be 1\u{2013}400 pt".into()));
+    }
+    refuse_foreign_text(doc, &d)?;
+    let before = d;
+    doc.update_dict(r, |d| {
+        let (col, _) = appearance::parse_da(d);
+        d.set(b"DA".to_vec(), PdfString::literal(format!("{} {} {} rg /Helv {} Tf", n(col[0]), n(col[1]), n(col[2]), n(size)).into_bytes()));
+        rich_text(d);
+        touch(d, meta);
+    })?;
+    let text = text_value(doc, &annot_dict(doc, r), b"Contents").unwrap_or_default();
+    let result = match fitted_box(doc, r, &text) {
+        Some(fit) => {
+            let cur = annot_dict(doc, r);
+            let nums: Vec<f64> =
+                cur.get(b"Rect").and_then(|o| o.as_array()).map(|a| a.iter().filter_map(|x| x.as_f64()).collect()).unwrap_or_default();
+            // Keep the top and sides; only the bottom edge moves, and only downwards.
+            match four(&nums).map(normalize) {
+                Some(old) if !cur.contains(b"CL") => apply_text_box(doc, r, [fit[0], fit[1].min(old[1]), fit[2], fit[3]], meta, false),
+                _ => apply_text_box(doc, r, fit, meta, false),
+            }
+        }
+        None => redraw_or_restore(doc, r, before.clone()),
+    };
+    if result.is_err() {
+        doc.set(r, Object::Dict(before));
+    }
+    result
+}
+
+/// Whether a comment has a fill: `/IC` for shapes, `/C` for FreeText (§12.5.6).
+pub fn fillable(subtype: &str) -> bool {
+    matches!(subtype, "Square" | "Circle" | "Polygon" | "FreeText")
+}
+
+/// Fill a shape or FreeText comment with `fill`, or remove its fill (`None`), and
+/// redraw its appearance (Acrobat: Properties ▸ Fill Color).
+pub fn set_fill(doc: &mut Document, page: usize, index: usize, fill: Option<Rgb>, meta: &Meta) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let d = annot_dict(doc, r);
+    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
+    if !fillable(&subtype) {
+        return Err(AnnotError::Invalid("only rectangles, ovals, polygons and text boxes can be filled".into()));
+    }
+    // Check before changing anything: a stale appearance would contradict the new fill.
+    if appearance::build(&d).is_none() {
+        return Err(AnnotError::Unsupported(subtype));
+    }
+    if fill.is_some_and(|c| !finite(&c)) {
+        return Err(AnnotError::Invalid("invalid fill colour".into()));
+    }
+    refuse_foreign_text(doc, &d)?;
+    let before = d;
+    doc.update_dict(r, |d| {
+        let key: &[u8] = if subtype == "FreeText" { b"C" } else { b"IC" };
+        match fill {
+            Some(c) => d.set(key.to_vec(), rgb(c)),
+            None => {
+                d.remove(key);
+            }
+        }
+        touch(d, meta);
+    })?;
+    redraw_or_restore(doc, r, before)
+}
+
+/// Grow a line or polyline's rectangle so a non-`None` ending is not clipped. Idempotent.
+fn ensure_ending_room(d: &mut Dict) {
+    let subtype = d.name(b"Subtype").unwrap_or_default();
+    if !matches!(subtype, b"Line" | b"PolyLine") {
+        return;
+    }
+    if !line_endings_of(d).is_some_and(|ends| ends.iter().any(|e| ending_draws(*e))) {
+        return;
+    }
+    let key: &[u8] = if subtype == b"Line" { b"L" } else { b"Vertices" };
+    let Some(pts) = pair_points(d, key) else { return };
+    let Some(bounds) = bounds(pts.iter().copied()) else { return };
+    let w = border_width_of(d);
+    let need = grow(bounds, w / 2.0 + appearance::arrow_size(w) + 1.0);
+    let vals: Vec<f64> = d.get(b"Rect").and_then(|o| o.as_array()).map(|a| a.iter().filter_map(|x| x.as_f64()).collect()).unwrap_or_default();
+    let Some(rect) = four(&vals) else { return };
+    let union = [rect[0].min(need[0]), rect[1].min(need[1]), rect[2].max(need[2]), rect[3].max(need[3])];
+    if union != rect {
+        d.set(b"Rect".to_vec(), num_array(&union));
+    }
+}
+
+fn four(v: &[f64]) -> Option<[f64; 4]> {
+    Some([*v.first()?, *v.get(1)?, *v.get(2)?, *v.get(3)?])
+}
+
+fn pair_points(d: &Dict, key: &[u8]) -> Option<Vec<[f64; 2]>> {
+    let v: Vec<f64> = d.get(key)?.as_array()?.iter().filter_map(|o| o.as_f64()).collect();
+    if v.len() < 4 || !v.len().is_multiple_of(2) || v.iter().any(|x| !x.is_finite()) {
+        return None;
+    }
+    Some(v.as_chunks::<2>().0.to_vec())
+}
+
+/// Replace Text (Acrobat's proposal): strike out `quads` and add a caret at the end of the
+/// struck text holding `replacement`, grouped with the strikeout (`/IRT` + `/RT /Group`) so they
+/// move, list and delete as one. Returns the strikeout's index.
+///
+/// The two annotations need their own `/NM`: XFDF names a reply by the `/NM` of what it replies
+/// to, so one id for both writes `inreplyto` equal to the caret's own `name`, and a reader that
+/// resolves names (Acrobat, and our own importer) loses the pair. `caret_meta` is a second id
+/// from the caller, so the edit stays deterministic.
+#[allow(clippy::too_many_arguments)]
+pub fn add_text_replacement(
+    doc: &mut Document,
+    page: usize,
+    quads: &[[f64; 8]],
+    replacement: &str,
+    author: &str,
+    strike: &Style,
+    caret: &Style,
+    meta: &Meta,
+    caret_meta: &Meta,
+) -> Result<usize, AnnotError> {
+    let last = *quads.last().ok_or_else(|| AnnotError::Invalid("select the text to replace first".into()))?;
+    let s = add_annotation(
+        doc,
+        &NewAnnotation {
+            page,
+            shape: Shape::TextMarkup { kind: Markup::StrikeOut, quads: quads.to_vec() },
+            style: strike.clone(),
+            contents: String::new(),
+            author: author.into(),
+        },
+        meta,
+    )?;
+    let (_, sr) = annot_ref(doc, page, s)?;
+    doc.update_dict(sr, |d| d.set(b"IT".to_vec(), Object::name("StrikeOutTextEdit")))?;
+    // The caret sits on the baseline at the end of the last line, its point at the text.
+    let xs = [last[0], last[2], last[4], last[6]];
+    let ys = [last[1], last[3], last[5], last[7]];
+    let x = xs.iter().copied().fold(f64::MIN, f64::max);
+    let (y0, y1) = (ys.iter().copied().fold(f64::MAX, f64::min), ys.iter().copied().fold(f64::MIN, f64::max));
+    let h = ((y1 - y0) * 0.6).clamp(4.0, 24.0);
+    let rect = [x - h / 2.0, y0 - h * 0.6, x + h / 2.0, y0 + h * 0.4];
+    let c = add_annotation(
+        doc,
+        &NewAnnotation { page, shape: Shape::Caret { rect }, style: caret.clone(), contents: replacement.into(), author: author.into() },
+        caret_meta,
+    )?;
+    let (_, cr) = annot_ref(doc, page, c)?;
+    doc.update_dict(cr, |d| {
+        d.set(b"IRT".to_vec(), Object::Ref(sr));
+        d.set(b"RT".to_vec(), Object::name("Group"));
+        d.set(b"Subj".to_vec(), PdfString::text("Replace Text"));
+    })?;
+    Ok(s)
+}
+
+/// The Eraser (Draw tools): remove the parts of drawing `(page, index)` within `radius` points
+/// of `path`, splitting strokes where they are cut. A drawing with nothing left is deleted.
+/// Returns whether anything was erased.
+pub fn erase_ink(doc: &mut Document, page: usize, index: usize, path: &[[f64; 2]], radius: f64, meta: &Meta) -> Result<bool, AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let d = annot_dict(doc, r);
+    if d.name(b"Subtype") != Some(b"Ink") {
+        return Err(AnnotError::Invalid("only drawings can be erased".into()));
+    }
+    if path.is_empty() || !path.iter().all(|p| finite(p)) || !radius.is_finite() || radius <= 0.0 {
+        return Err(AnnotError::Invalid("invalid eraser path".into()));
+    }
+    let strokes: Vec<Vec<[f64; 2]>> = d
+        .get(b"InkList")
+        .map(|l| doc.resolve(l))
+        .and_then(|l| l.as_array().cloned())
+        .unwrap_or_default()
+        .iter()
+        .map(|s| {
+            let v: Vec<f64> = doc.resolve(s).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()).unwrap_or_default();
+            v.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect()
+        })
+        .collect();
+    // Distance from a point to the eraser's path (segments, or a single point).
+    let near = |p: [f64; 2]| -> bool {
+        if path.len() == 1 {
+            return (p[0] - path[0][0]).hypot(p[1] - path[0][1]) <= radius;
+        }
+        path.windows(2).any(|w| {
+            let (a, b) = (w[0], w[1]);
+            let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
+            let len2 = dx * dx + dy * dy;
+            let t = if len2 > 0.0 { (((p[0] - a[0]) * dx + (p[1] - a[1]) * dy) / len2).clamp(0.0, 1.0) } else { 0.0 };
+            (p[0] - (a[0] + t * dx)).hypot(p[1] - (a[1] + t * dy)) <= radius
+        })
+    };
+    let mut kept: Vec<Vec<[f64; 2]>> = Vec::new();
+    let mut erased = false;
+    for s in &strokes {
+        // Densify so long segments are cut where the eraser crosses them.
+        let mut pts: Vec<[f64; 2]> = Vec::new();
+        for w in s.windows(2) {
+            let n = ((w[1][0] - w[0][0]).hypot(w[1][1] - w[0][1]) / (radius / 2.0)).ceil().clamp(1.0, 2000.0) as usize;
+            for k in 0..n {
+                let t = k as f64 / n as f64;
+                pts.push([w[0][0] + (w[1][0] - w[0][0]) * t, w[0][1] + (w[1][1] - w[0][1]) * t]);
+            }
+        }
+        if let Some(last) = s.last() {
+            pts.push(*last);
+        }
+        let mut run: Vec<[f64; 2]> = Vec::new();
+        for p in pts {
+            if near(p) {
+                erased = true;
+                if run.len() >= 2 {
+                    kept.push(std::mem::take(&mut run));
+                }
+                run.clear();
+            } else {
+                run.push(p);
+            }
+        }
+        if run.len() >= 2 {
+            kept.push(run);
+        }
+    }
+    if !erased {
+        return Ok(false);
+    }
+    if kept.is_empty() {
+        delete_annotation(doc, page, index)?;
+        return Ok(true);
+    }
+    let width = d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0);
+    let rect = grow(bounds(kept.iter().flatten().copied()).unwrap_or_default(), width / 2.0 + 1.0);
+    doc.update_dict(r, |d| {
+        d.set(b"InkList".to_vec(), Object::Array(kept.iter().map(|s| num_array(&s.concat())).collect()));
+        d.set(b"Rect".to_vec(), num_array(&rect));
+        touch(d, meta);
+    })?;
+    set_appearance(doc, r)?;
+    Ok(true)
+}
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index c3602d8b57..b9e47e5fb9 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -229,6 +229,47 @@ fn delete_takes_popup_and_reply_chain() {
     assert_eq!(delete_annotation(&mut doc, 0, 9), Err(AnnotError::NoSuchAnnotation { page: 0, index: 9 }));
 }
 
+/// A reply or pop-up written inline in `/Annots` (a file can, though the standard asks for
+/// references) goes with the comment it points at, and so does a pop-up an inline reply or an
+/// inline comment names. An unrelated inline comment stays until it is deleted itself.
+#[test]
+fn delete_takes_inline_replies_and_popups() {
+    let mut doc = fixture();
+    let mut popup = |note: &str| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("Annot"));
+        d.set(b"Subtype".to_vec(), Object::name("Popup"));
+        d.set(b"Contents".to_vec(), PdfString::text(note));
+        doc.add(Object::Dict(d))
+    };
+    let (reply_popup, square_popup) = (popup("of the reply"), popup("of the square"));
+    let inline = |subtype: &str, links: &[(&[u8], ObjRef)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("Annot"));
+        d.set(b"Subtype".to_vec(), Object::name(subtype));
+        links.iter().for_each(|(key, r)| d.set(key.to_vec(), Object::Ref(*r)));
+        Object::Dict(d)
+    };
+    let stamp = ObjRef::new(6, 0);
+    let entries = vec![
+        Object::Ref(stamp),
+        inline("Text", &[(b"IRT", stamp), (b"Popup", reply_popup)]),
+        Object::Ref(reply_popup),
+        inline("Popup", &[(b"Parent", stamp)]),
+        inline("Square", &[(b"Popup", square_popup)]),
+        Object::Ref(square_popup),
+    ];
+    doc.set(ObjRef::new(5, 0), Object::Array(entries));
+    let subtypes = |doc: &Document| -> Vec<String> {
+        list(doc, 1).iter().map(|d| String::from_utf8_lossy(d.name(b"Subtype").unwrap()).into_owned() + ":" + &text(d, b"Contents")).collect()
+    };
+    delete_annotation(&mut doc, 1, 0).unwrap();
+    let mut doc = reopen(&doc);
+    assert_eq!(subtypes(&doc), ["Square:", "Popup:of the square"]);
+    delete_annotation(&mut doc, 1, 0).unwrap();
+    assert!(subtypes(&reopen(&doc)).is_empty(), "the inline comment's pop-up went with it");
+}
+
 #[test]
 fn deleting_the_last_comment_removes_annots() {
     let mut doc = fixture();
@@ -1867,3 +1908,230 @@ fn a_caret_with_a_paragraph_symbol_draws_the_pilcrow() {
     let d = doc.get(ObjRef::new(1, 0)).as_dict().cloned().unwrap();
     assert!(appearance::build(&d).is_some());
 }
+
+// ── Line annotations: leader lines and captions (ISO 32000-2 §12.5.6.7, Table 178) ──────────
+
+/// A red Line from `l` with a 1 pt border, a generous `/Rect`, and `extra` entries.
+fn table_178_line(l: [f64; 4], extra: &[(&str, Object)]) -> Dict {
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Line"));
+    d.set(b"Rect".to_vec(), Object::Array([0.0, 0.0, 600.0, 800.0].map(Object::Real).to_vec()));
+    d.set(b"C".to_vec(), Object::Array([1.0, 0.0, 0.0].map(Object::Real).to_vec()));
+    d.set(b"L".to_vec(), Object::Array(l.map(Object::Real).to_vec()));
+    for (k, v) in extra {
+        d.set(k.as_bytes().to_vec(), v.clone());
+    }
+    d
+}
+
+/// The built appearance's content.
+fn line_drawing(d: &Dict) -> String {
+    let s = crate::appearance::build(d).expect("the line is drawn");
+    String::from_utf8_lossy(&s.decoded().unwrap()).into_owned()
+}
+
+/// Every straight two-point stroke (`x0 y0 m x1 y1 l S`) in a drawing.
+fn segments(content: &str) -> Vec<[f64; 4]> {
+    content
+        .lines()
+        .filter_map(|line| {
+            let t: Vec<&str> = line.split_whitespace().collect();
+            if t.len() != 7 || t[2] != "m" || t[5] != "l" || t[6] != "S" {
+                return None;
+            }
+            let v: Vec<f64> = [t[0], t[1], t[3], t[4]].iter().map(|x| x.parse().unwrap()).collect();
+            Some([v[0], v[1], v[2], v[3]])
+        })
+        .collect()
+}
+
+/// The caption's text matrix (`a b c d e f Tm`), if any.
+fn caption_matrix(content: &str) -> Option<[f64; 6]> {
+    let at = content.find(" Tm")?;
+    let before: Vec<f64> = content[..at].split_whitespace().rev().take(6).map(|x| x.parse().unwrap()).collect();
+    Some([before[5], before[4], before[3], before[2], before[1], before[0]])
+}
+
+fn has(segs: &[[f64; 4]], want: [f64; 4]) -> bool {
+    segs.iter().any(|s| s.iter().zip(want).all(|(a, b)| (a - b).abs() < 0.01))
+}
+
+#[test]
+fn a_positive_leader_length_puts_the_line_above_a_left_to_right_line_and_a_negative_one_below() {
+    let up = segments(&line_drawing(&table_178_line([72.0, 620.0, 272.0, 620.0], &[("LL", Object::Real(20.0))])));
+    assert!(has(&up, [72.0, 640.0, 272.0, 640.0]), "the line is 20 above /L: {up:?}");
+    assert!(has(&up, [72.0, 620.0, 72.0, 640.0]) && has(&up, [272.0, 620.0, 272.0, 640.0]), "leader lines from /L up to it: {up:?}");
+    assert!(!has(&up, [72.0, 620.0, 272.0, 620.0]), "nothing along /L itself: {up:?}");
+
+    let down = segments(&line_drawing(&table_178_line([72.0, 540.0, 272.0, 540.0], &[("LL", Object::Real(-20.0)), ("LLE", Object::Real(10.0))])));
+    assert!(has(&down, [72.0, 520.0, 272.0, 520.0]), "the line is 20 below /L: {down:?}");
+    assert!(has(&down, [72.0, 540.0, 72.0, 510.0]) && has(&down, [272.0, 540.0, 272.0, 510.0]), "leaders run 10 past it: {down:?}");
+}
+
+#[test]
+fn a_leader_offset_leaves_a_gap_and_the_endings_sit_on_the_line_itself() {
+    let d = table_178_line(
+        [72.0, 460.0, 272.0, 460.0],
+        &[("LL", Object::Real(20.0)), ("LLO", Object::Real(10.0)), ("LE", Object::Array(vec![Object::name("OpenArrow"), Object::name("OpenArrow")]))],
+    );
+    let content = line_drawing(&d);
+    let segs = segments(&content);
+    assert!(has(&segs, [72.0, 490.0, 272.0, 490.0]), "the line sits |LL| + LLO above /L: {segs:?}");
+    assert!(has(&segs, [72.0, 470.0, 72.0, 490.0]) && has(&segs, [272.0, 470.0, 272.0, 490.0]), "leaders start LLO from /L: {segs:?}");
+    // The open arrows' tips (`tip l`) are at the ends of the line, not of /L.
+    assert!(content.contains(" 72 490 l ") && content.contains(" 272 490 l "), "arrows at the moved line: {content}");
+    assert!(!content.contains(" 72 460 l "), "no arrow on /L: {content}");
+}
+
+#[test]
+fn an_inline_caption_breaks_the_line_around_its_text() {
+    let d =
+        table_178_line([72.0, 380.0, 272.0, 380.0], &[("Cap", Object::Bool(true)), ("Contents", Object::String(PdfString::text("Inline 50 mm")))]);
+    let content = line_drawing(&d);
+    assert!(content.contains("(Inline 50 mm) Tj"), "the caption is drawn: {content}");
+    assert!(content.contains("/Helv 10 Tf"), "in Helvetica 10: {content}");
+    let m = caption_matrix(&content).expect("text matrix");
+    let width = crate::appearance::text_width("Inline 50 mm", 10.0);
+    assert!((m[4] - (172.0 - width / 2.0)).abs() < 0.01 && m[5] < 380.0 && m[5] > 380.0 - 10.0, "centred on the line: {m:?}");
+    let segs = segments(&content);
+    assert_eq!(segs.len(), 2, "two pieces: {segs:?}");
+    assert!(segs.iter().all(|s| s[2] <= 172.0 - width / 2.0 || s[0] >= 172.0 + width / 2.0), "no stroke under the text: {segs:?}");
+    assert!(has(&segs, [72.0, 380.0, 172.0 - width / 2.0 - 2.0, 380.0]), "the left piece starts at the line's start: {segs:?}");
+}
+
+#[test]
+fn a_top_caption_sits_above_the_unbroken_line() {
+    let d = table_178_line(
+        [72.0, 300.0, 272.0, 300.0],
+        &[("Cap", Object::Bool(true)), ("CP", Object::name("Top")), ("Contents", Object::String(PdfString::text("Top 50 mm")))],
+    );
+    let content = line_drawing(&d);
+    let m = caption_matrix(&content).expect("text matrix");
+    assert!(m[5] > 300.0 && m[5] < 305.0, "baseline just above the line: {m:?}");
+    assert_eq!(segments(&content), vec![[72.0, 300.0, 272.0, 300.0]], "the line is whole");
+}
+
+#[test]
+fn a_caption_offset_moves_it_along_and_off_the_line_with_a_tick() {
+    let co = |h: f64, v: f64| Object::Array(vec![Object::Real(h), Object::Real(v)]);
+    let text = ("Contents", Object::String(PdfString::text("Offset 15")));
+    let base = caption_matrix(&line_drawing(&table_178_line([330.0, 700.0, 530.0, 700.0], &[("Cap", Object::Bool(true)), text.clone()]))).unwrap();
+    let content = line_drawing(&table_178_line([330.0, 700.0, 530.0, 700.0], &[("Cap", Object::Bool(true)), ("CO", co(0.0, 15.0)), text.clone()]));
+    let up = caption_matrix(&content).unwrap();
+    assert!((up[5] - base[5] - 15.0).abs() < 0.01 && (up[4] - base[4]).abs() < 0.01, "15 up: {base:?} → {up:?}");
+    let segs = segments(&content);
+    assert!(has(&segs, [330.0, 700.0, 530.0, 700.0]), "a caption off the line leaves it whole: {segs:?}");
+    assert!(segs.iter().any(|s| s[0] == 430.0 && s[2] == 430.0 && s[1] == 700.0 && s[3] > 705.0), "a tick from the midpoint up: {segs:?}");
+    let along =
+        caption_matrix(&line_drawing(&table_178_line([330.0, 700.0, 530.0, 700.0], &[("Cap", Object::Bool(true)), ("CO", co(-30.0, 0.0)), text])))
+            .unwrap();
+    assert!((along[4] - base[4] + 30.0).abs() < 0.01 && (along[5] - base[5]).abs() < 0.01, "30 left: {base:?} → {along:?}");
+}
+
+#[test]
+fn without_cap_true_no_caption_is_drawn() {
+    for cap in [None, Some(Object::Bool(false)), Some(Object::Int(1))] {
+        let mut extra = vec![("Contents", Object::String(PdfString::text("Hidden caption")))];
+        if let Some(c) = cap.clone() {
+            extra.push(("Cap", c));
+        }
+        let d = table_178_line([330.0, 620.0, 530.0, 620.0], &extra);
+        let content = line_drawing(&d);
+        assert!(!content.contains("Tj"), "{cap:?}: {content}");
+        assert_eq!(segments(&content), vec![[330.0, 620.0, 530.0, 620.0]]);
+        assert!(crate::appearance::undrawable_text(&d).is_none());
+    }
+}
+
+#[test]
+fn a_diagonal_lines_leaders_are_perpendicular_and_its_caption_turns_with_it() {
+    let d = table_178_line(
+        [330.0, 460.0, 530.0, 560.0],
+        &[
+            ("LL", Object::Real(20.0)),
+            ("LLE", Object::Real(10.0)),
+            ("Cap", Object::Bool(true)),
+            ("Contents", Object::String(PdfString::text("Diagonal"))),
+        ],
+    );
+    let content = line_drawing(&d);
+    let segs = segments(&content);
+    let (ux, uy) = (200.0 / 100f64.hypot(200.0), 100.0 / 100f64.hypot(200.0));
+    let leaders: Vec<&[f64; 4]> = segs.iter().filter(|s| (s[2] - s[0]) * ux + (s[3] - s[1]) * uy < 1e-2).collect();
+    assert_eq!(leaders.len(), 2, "two leader lines across the line: {segs:?}");
+    for l in leaders {
+        let (dx, dy) = (l[2] - l[0], l[3] - l[1]);
+        assert!((dx.hypot(dy) - 30.0).abs() < 0.01, "|LL| + LLE long: {l:?}");
+        assert!(dx < 0.0 && dy > 0.0, "up and to the left (left of travel): {l:?}");
+    }
+    let m = caption_matrix(&content).expect("caption");
+    assert!((m[0] - ux).abs() < 1e-3 && (m[1] - uy).abs() < 1e-3, "the text runs along the line: {m:?}");
+    // Drawn right to left, it still reads left to right.
+    let back = caption_matrix(&line_drawing(&table_178_line(
+        [530.0, 560.0, 330.0, 460.0],
+        &[("Cap", Object::Bool(true)), ("Contents", Object::String(PdfString::text("x")))],
+    )))
+    .unwrap();
+    assert!(back[0] > 0.0, "{back:?}");
+}
+
+#[test]
+fn a_caption_from_rich_text_and_one_the_font_cant_draw() {
+    let rc = "<?xml version=\"1.0\"?><body xmlns=\"http://www.w3.org/1999/xhtml\"><p>Dim &amp; <b>5</b>0&#x20;mm &lt;x&gt;</p></body>";
+    let d = table_178_line([0.0, 0.0, 100.0, 0.0], &[("Cap", Object::Bool(true)), ("RC", Object::String(PdfString::text(rc)))]);
+    let s = crate::appearance::build(&d).unwrap().decoded().unwrap();
+    assert!(s.windows(17).any(|w| w == b"(Dim & 50 mm <x>)"), "{}", String::from_utf8_lossy(&s));
+    let cjk = table_178_line([0.0, 0.0, 100.0, 0.0], &[("Cap", Object::Bool(true)), ("Contents", Object::String(PdfString::text("長さ")))]);
+    assert_eq!(crate::appearance::undrawable_text(&cjk), Some(("the line's caption", '長')));
+    // A PdfCraft measurement's label is its caption: the comment text isn't drawn a second time.
+    let mut measured = cjk.clone();
+    measured.set(b"PCMeasureValue".to_vec(), Object::String(PdfString::text("5 mm")));
+    assert_eq!(crate::appearance::undrawable_text(&measured), None);
+    let content = line_drawing(&measured);
+    assert_eq!(content.matches(" Tj").count(), 1, "{content}");
+}
+
+#[test]
+fn degenerate_and_absurd_leader_and_caption_values_do_not_panic() {
+    let cap = ("Cap", Object::Bool(true));
+    let text = ("Contents", Object::String(PdfString::text(&"w".repeat(10_000))));
+    // A zero-length line has no direction: no leader lines, no caption, no NaN.
+    let point =
+        line_drawing(&table_178_line([50.0, 50.0, 50.0, 50.0], &[("LL", Object::Real(20.0)), ("LLE", Object::Real(5.0)), cap.clone(), text.clone()]));
+    assert!(!point.contains("NaN") && !point.contains("inf") && !point.contains("Tj"), "{point}");
+    assert_eq!(segments(&point).len(), 1);
+    for bad in [f64::NAN, f64::INFINITY, f64::NEG_INFINITY, 1e300, -1e300, f64::MAX] {
+        let d = table_178_line(
+            [0.0, 0.0, 100.0, 0.0],
+            &[
+                ("LL", Object::Real(bad)),
+                ("LLE", Object::Real(bad)),
+                ("LLO", Object::Real(bad)),
+                ("CO", Object::Array(vec![Object::Real(bad), Object::Real(bad)])),
+                cap.clone(),
+                text.clone(),
+            ],
+        );
+        let content = line_drawing(&d);
+        assert!(!content.contains("NaN") && !content.contains("inf"), "{bad}: {content}");
+        for s in segments(&content) {
+            assert!(s.iter().all(|x| x.abs() <= 50_000.0), "{bad}: {s:?}");
+        }
+    }
+    // Negative LLE and LLO count as 0.
+    let neg = segments(&line_drawing(&table_178_line(
+        [0.0, 0.0, 100.0, 0.0],
+        &[("LL", Object::Real(10.0)), ("LLE", Object::Real(-5.0)), ("LLO", Object::Real(-5.0))],
+    )));
+    assert!(has(&neg, [0.0, 0.0, 0.0, 10.0]) && has(&neg, [0.0, 10.0, 100.0, 10.0]), "{neg:?}");
+    // Huge endpoints whose midpoint would overflow fall back to the plain line.
+    let huge = line_drawing(&table_178_line([f64::MAX, f64::MAX, f64::MAX / 2.0, f64::MAX], &[("LL", Object::Real(20.0)), cap, text]));
+    assert!(!huge.contains("NaN") && !huge.contains("inf"), "{huge}");
+    // The caption is cut to 256 characters.
+    let long = line_drawing(&table_178_line(
+        [0.0, 0.0, 100.0, 0.0],
+        &[("Cap", Object::Bool(true)), ("Contents", Object::String(PdfString::text(&"w".repeat(10_000))))],
+    ));
+    assert!(long.contains(&format!("({}) Tj", "w".repeat(256))), "cut to 256");
+    assert!(!long.contains(&"w".repeat(257)));
+}
diff --git a/crates/annot/src/types.rs b/crates/annot/src/types.rs
new file mode 100644
index 0000000000..632e990fea
--- /dev/null
+++ b/crates/annot/src/types.rs
@@ -0,0 +1,663 @@
+use super::create::normalize;
+use super::*;
+
+pub type Rgb = [f64; 3];
+
+/// Text markup kinds (§12.5.6.10).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Markup {
+    Highlight,
+    Underline,
+    StrikeOut,
+    Squiggly,
+}
+
+impl Markup {
+    fn subtype(self) -> &'static str {
+        match self {
+            Markup::Highlight => "Highlight",
+            Markup::Underline => "Underline",
+            Markup::StrikeOut => "StrikeOut",
+            Markup::Squiggly => "Squiggly",
+        }
+    }
+}
+
+/// Text-annotation icon names (`/Name`). The first seven are the standard names ISO 32000-2
+/// §12.5.6.4, Table 175 asks every viewer to draw; the rest are further names in common use, which
+/// the same table allows ("Additional names may be supported as well").
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum NoteIcon {
+    #[default]
+    Comment,
+    Note,
+    Help,
+    Insert,
+    Key,
+    NewParagraph,
+    Paragraph,
+    Check,
+    Circle,
+    Cross,
+    CrossHairs,
+    Star,
+    RightArrow,
+    UpArrow,
+}
+
+impl NoteIcon {
+    pub fn name(self) -> &'static str {
+        match self {
+            NoteIcon::Comment => "Comment",
+            NoteIcon::Note => "Note",
+            NoteIcon::Help => "Help",
+            NoteIcon::Insert => "Insert",
+            NoteIcon::Key => "Key",
+            NoteIcon::NewParagraph => "NewParagraph",
+            NoteIcon::Paragraph => "Paragraph",
+            NoteIcon::Check => "Check",
+            NoteIcon::Circle => "Circle",
+            NoteIcon::Cross => "Cross",
+            NoteIcon::CrossHairs => "CrossHairs",
+            NoteIcon::Star => "Star",
+            NoteIcon::RightArrow => "RightArrow",
+            NoteIcon::UpArrow => "UpArrow",
+        }
+    }
+
+    /// Every icon, the standard names first.
+    pub const ALL: [NoteIcon; 14] = [
+        Self::Comment,
+        Self::Note,
+        Self::Help,
+        Self::Insert,
+        Self::Key,
+        Self::NewParagraph,
+        Self::Paragraph,
+        Self::Check,
+        Self::Circle,
+        Self::Cross,
+        Self::CrossHairs,
+        Self::Star,
+        Self::RightArrow,
+        Self::UpArrow,
+    ];
+
+    pub fn from_name(n: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|i| i.name() == n)
+    }
+}
+
+/// Fill & Sign marks (Acrobat's ✓, ✕, ●, ─).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FillMark {
+    Check,
+    Cross,
+    Dot,
+    Line,
+}
+
+impl FillMark {
+    /// The `/Name` of the stamp PdfCraft draws for it.
+    pub fn name(self) -> &'static str {
+        match self {
+            FillMark::Check => "PCCheck",
+            FillMark::Cross => "PCCross",
+            FillMark::Dot => "PCDot",
+            FillMark::Line => "PCLine",
+        }
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            FillMark::Check => "Checkmark",
+            FillMark::Cross => "Cross",
+            FillMark::Dot => "Dot",
+            FillMark::Line => "Line",
+        }
+    }
+
+    /// The user-space box of the mark placed at `at` on a page turned by `rotation`: centred
+    /// there and sized in displayed axes, so a line runs across the page as displayed (#2392).
+    pub fn rect_at(self, at: [f64; 2], rotation: i64) -> [f64; 4] {
+        let (w, h) = if self == FillMark::Line { (36.0, 4.0) } else { (12.0, 12.0) };
+        let (w, h) = if matches!(rotation.rem_euclid(360), 90 | 270) { (h, w) } else { (w, h) };
+        [at[0] - w / 2.0, at[1] - h / 2.0, at[0] + w / 2.0, at[1] + h / 2.0]
+    }
+}
+
+/// The stamps of Acrobat's stamp palette (drawn in PdfCraft's own style).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum StampKind {
+    // Standard business.
+    Approved,
+    Completed,
+    Confidential,
+    Draft,
+    Final,
+    ForComment,
+    ForPublicRelease,
+    InformationOnly,
+    NotApproved,
+    NotForPublicRelease,
+    PreliminaryResults,
+    Void,
+    // Sign here.
+    Accepted,
+    InitialHere,
+    Rejected,
+    SignHere,
+    Witness,
+    // Dynamic (with a "By … at …" line).
+    DynApproved,
+    DynConfidential,
+    DynReceived,
+    DynReviewed,
+    DynRevised,
+}
+
+/// The palette's sections.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum StampGroup {
+    Dynamic,
+    SignHere,
+    StandardBusiness,
+}
+
+impl StampKind {
+    pub const ALL: [StampKind; 22] = [
+        StampKind::DynApproved,
+        StampKind::DynConfidential,
+        StampKind::DynReceived,
+        StampKind::DynReviewed,
+        StampKind::DynRevised,
+        StampKind::Accepted,
+        StampKind::InitialHere,
+        StampKind::Rejected,
+        StampKind::SignHere,
+        StampKind::Witness,
+        StampKind::Approved,
+        StampKind::Completed,
+        StampKind::Confidential,
+        StampKind::Draft,
+        StampKind::Final,
+        StampKind::ForComment,
+        StampKind::ForPublicRelease,
+        StampKind::InformationOnly,
+        StampKind::NotApproved,
+        StampKind::NotForPublicRelease,
+        StampKind::PreliminaryResults,
+        StampKind::Void,
+    ];
+
+    pub fn group(self) -> StampGroup {
+        use StampKind::*;
+        match self {
+            DynApproved | DynConfidential | DynReceived | DynReviewed | DynRevised => StampGroup::Dynamic,
+            Accepted | InitialHere | Rejected | SignHere | Witness => StampGroup::SignHere,
+            _ => StampGroup::StandardBusiness,
+        }
+    }
+
+    /// The text on the stamp.
+    pub fn label(self) -> &'static str {
+        use StampKind::*;
+        match self {
+            Approved | DynApproved => "APPROVED",
+            Completed => "COMPLETED",
+            Confidential | DynConfidential => "CONFIDENTIAL",
+            Draft => "DRAFT",
+            Final => "FINAL",
+            ForComment => "FOR COMMENT",
+            ForPublicRelease => "FOR PUBLIC RELEASE",
+            InformationOnly => "INFORMATION ONLY",
+            NotApproved => "NOT APPROVED",
+            NotForPublicRelease => "NOT FOR PUBLIC RELEASE",
+            PreliminaryResults => "PRELIMINARY RESULTS",
+            Void => "VOID",
+            Accepted => "ACCEPTED",
+            InitialHere => "INITIAL HERE",
+            Rejected => "REJECTED",
+            SignHere => "SIGN HERE",
+            Witness => "WITNESS",
+            DynReceived => "RECEIVED",
+            DynReviewed => "REVIEWED",
+            DynRevised => "REVISED",
+        }
+    }
+
+    /// `/Name`: the standard stamp names of ISO 32000-2 Table 184 where one exists.
+    pub fn name(self) -> &'static str {
+        use StampKind::*;
+        match self {
+            Approved => "Approved",
+            Confidential => "Confidential",
+            Draft => "Draft",
+            Final => "Final",
+            ForComment => "ForComment",
+            ForPublicRelease => "ForPublicRelease",
+            NotApproved => "NotApproved",
+            NotForPublicRelease => "NotForPublicRelease",
+            Completed => "PCCompleted",
+            InformationOnly => "PCInformationOnly",
+            PreliminaryResults => "PCPreliminaryResults",
+            Void => "PCVoid",
+            Accepted => "PCAccepted",
+            InitialHere => "PCInitialHere",
+            Rejected => "PCRejected",
+            SignHere => "PCSignHere",
+            Witness => "PCWitness",
+            DynApproved => "PCDynApproved",
+            DynConfidential => "PCDynConfidential",
+            DynReceived => "PCDynReceived",
+            DynReviewed => "PCDynReviewed",
+            DynRevised => "PCDynRevised",
+        }
+    }
+
+    pub fn from_name(n: &[u8]) -> Option<Self> {
+        Self::ALL.into_iter().find(|k| k.name().as_bytes() == n)
+    }
+
+    /// The stamp's colour: green for approval, red for refusal and restriction, blue otherwise.
+    pub fn color(self) -> Rgb {
+        use StampKind::*;
+        match self {
+            Approved | Completed | Final | Accepted | DynApproved | DynReceived | DynReviewed => [0.13, 0.55, 0.13],
+            NotApproved | Rejected | Void | Confidential | NotForPublicRelease | DynConfidential => [0.80, 0.10, 0.10],
+            SignHere | InitialHere | Witness => [0.85, 0.35, 0.05],
+            _ => [0.10, 0.30, 0.70],
+        }
+    }
+
+    /// The stamp's size (points) for its label, as placed with a click.
+    pub fn size(self) -> (f64, f64) {
+        let w = appearance::text_width(self.label(), 16.0) * 1.12 + 24.0;
+        let h = if self.group() == StampGroup::Dynamic { 42.0 } else { 30.0 };
+        let w = if self.group() == StampGroup::SignHere { w + 14.0 } else { w };
+        (w.max(80.0), h)
+    }
+}
+
+/// A line ending (`/LE`): the ten styles in ISO 32000-2 Table 217.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LineEnding {
+    None,
+    Square,
+    Circle,
+    Diamond,
+    OpenArrow,
+    ClosedArrow,
+    Butt,
+    ROpenArrow,
+    RClosedArrow,
+    Slash,
+}
+
+impl LineEnding {
+    pub const ALL: [Self; 10] = [
+        Self::None,
+        Self::Square,
+        Self::Circle,
+        Self::Diamond,
+        Self::OpenArrow,
+        Self::ClosedArrow,
+        Self::Butt,
+        Self::ROpenArrow,
+        Self::RClosedArrow,
+        Self::Slash,
+    ];
+
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::None => "None",
+            Self::Square => "Square",
+            Self::Circle => "Circle",
+            Self::Diamond => "Diamond",
+            Self::OpenArrow => "OpenArrow",
+            Self::ClosedArrow => "ClosedArrow",
+            Self::Butt => "Butt",
+            Self::ROpenArrow => "ROpenArrow",
+            Self::RClosedArrow => "RClosedArrow",
+            Self::Slash => "Slash",
+        }
+    }
+
+    pub fn parse(name: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|ending| ending.name() == name)
+    }
+}
+
+/// Geometry of a new comment, in PDF user space of its page.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Shape {
+    /// A sticky note whose icon's top-left corner is at `at`.
+    Note {
+        at: [f64; 2],
+        icon: NoteIcon,
+    },
+    /// Text markup over quadrilaterals: `[x1 y1 x2 y2 x3 y3 x4 y4]` = top-left, top-right,
+    /// bottom-left, bottom-right (the order Acrobat writes, §12.5.6.10).
+    TextMarkup {
+        kind: Markup,
+        quads: Vec<[f64; 8]>,
+    },
+    Rectangle {
+        rect: [f64; 4],
+    },
+    Oval {
+        rect: [f64; 4],
+    },
+    /// A line. An open arrow at `to` is `start: None`, `end: OpenArrow` (the Arrow tool).
+    Line {
+        from: [f64; 2],
+        to: [f64; 2],
+        start: LineEnding,
+        end: LineEnding,
+    },
+    /// Freehand strokes (Draw tool).
+    Ink {
+        strokes: Vec<Vec<[f64; 2]>>,
+    },
+    /// A text box (FreeText) showing the comment's contents.
+    TextBox {
+        rect: [f64; 4],
+        font_size: f64,
+    },
+    /// Fill & Sign text typed onto the page (FreeText, typewriter intent, no border).
+    Typewriter {
+        rect: [f64; 4],
+        font_size: f64,
+    },
+    /// A Fill & Sign mark in `rect`.
+    Mark {
+        rect: [f64; 4],
+        mark: FillMark,
+    },
+    /// A drawn signature (ink strokes).
+    Signature {
+        strokes: Vec<Vec<[f64; 2]>>,
+    },
+    /// A rubber stamp from the stamp palette; `by` is the dynamic stamps' second line.
+    Stamp {
+        rect: [f64; 4],
+        stamp: StampKind,
+        by: Option<String>,
+    },
+    /// A typed signature or initials: filled outlines (each contour as points normalised to
+    /// `rect`, 0–1, y up), drawn with the non-zero winding rule.
+    TypedSignature {
+        rect: [f64; 4],
+        contours: Vec<Vec<[f64; 2]>>,
+    },
+    /// A custom stamp: a picture already in the document (an image XObject, or a form XObject
+    /// whose `/Matrix` maps it to `size` points) filling `rect`, named `name`.
+    CustomStamp {
+        rect: [f64; 4],
+        name: String,
+        picture: ObjRef,
+        image: bool,
+        size: (f64, f64),
+    },
+    /// A redaction mark (§12.5.6.23) over quadrilaterals (text) or one rectangle as a quad
+    /// (areas, pages). `overlay` is the text shown on the box once applied, drawn with `look`.
+    Redact {
+        quads: Vec<[f64; 8]>,
+        overlay: String,
+        look: OverlayLook,
+    },
+    /// A closed polygon (Polygon tool); with `cloud`, Acrobat's Cloud tool: the same polygon
+    /// with a cloudy border (`/BE /S /C`, `/IT /PolygonCloud`).
+    Polygon {
+        vertices: Vec<[f64; 2]>,
+        cloud: bool,
+    },
+    /// Connected lines (Polygonal Line tool). `start` is the first vertex, `end` the last.
+    PolyLine {
+        vertices: Vec<[f64; 2]>,
+        start: LineEnding,
+        end: LineEnding,
+    },
+    /// A text callout: a text box at `rect` with a leader line from `point` (arrowhead) via
+    /// `knee` to the box (FreeText, `/IT /FreeTextCallout`, `/CL`).
+    Callout {
+        rect: [f64; 4],
+        knee: [f64; 2],
+        point: [f64; 2],
+        font_size: f64,
+        ending: LineEnding,
+    },
+    /// Insert text: a caret in `rect` (its point at the top centre).
+    Caret {
+        rect: [f64; 4],
+    },
+    /// Attach a file as a comment: an icon whose top-left corner is at `at`, holding `data`
+    /// (embedded) under the name `file`.
+    Attachment {
+        at: [f64; 2],
+        icon: AttachIcon,
+        file: String,
+        data: Vec<u8>,
+    },
+}
+
+/// The standard file attachment icons (§12.5.6.15).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum AttachIcon {
+    #[default]
+    PushPin,
+    Paperclip,
+    Graph,
+    Tag,
+}
+
+impl AttachIcon {
+    pub const ALL: [AttachIcon; 4] = [AttachIcon::PushPin, AttachIcon::Paperclip, AttachIcon::Graph, AttachIcon::Tag];
+    pub fn name(self) -> &'static str {
+        match self {
+            AttachIcon::PushPin => "PushPin",
+            AttachIcon::Paperclip => "Paperclip",
+            AttachIcon::Graph => "Graph",
+            AttachIcon::Tag => "Tag",
+        }
+    }
+    pub fn from_name(n: &str) -> Option<AttachIcon> {
+        Self::ALL.into_iter().find(|i| i.name().eq_ignore_ascii_case(n))
+    }
+}
+
+/// A rectangle `[x0 y0 x1 y1]` as a quad in Acrobat's order (top-left, top-right, bottom-left,
+/// bottom-right).
+pub fn rect_quad(r: [f64; 4]) -> [f64; 8] {
+    let [x0, y0, x1, y1] = normalize(r);
+    [x0, y1, x1, y1, x0, y0, x1, y0]
+}
+
+impl Shape {
+    pub fn subtype(&self) -> &'static str {
+        match self {
+            Shape::Note { .. } => "Text",
+            Shape::TextMarkup { kind, .. } => kind.subtype(),
+            Shape::Rectangle { .. } => "Square",
+            Shape::Oval { .. } => "Circle",
+            Shape::Line { .. } => "Line",
+            Shape::Ink { .. } | Shape::Signature { .. } => "Ink",
+            Shape::TextBox { .. } | Shape::Typewriter { .. } | Shape::Callout { .. } => "FreeText",
+            Shape::Mark { .. } | Shape::Stamp { .. } | Shape::CustomStamp { .. } | Shape::TypedSignature { .. } => "Stamp",
+            Shape::Redact { .. } => "Redact",
+            Shape::Polygon { .. } => "Polygon",
+            Shape::PolyLine { .. } => "PolyLine",
+            Shape::Caret { .. } => "Caret",
+            Shape::Attachment { .. } => "FileAttachment",
+        }
+    }
+}
+
+/// The standard fonts of redaction overlay text.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum OverlayFont {
+    #[default]
+    Helvetica,
+    Times,
+    Courier,
+}
+
+impl OverlayFont {
+    pub const ALL: [OverlayFont; 3] = [OverlayFont::Helvetica, OverlayFont::Times, OverlayFont::Courier];
+
+    pub fn name(self) -> &'static str {
+        match self {
+            OverlayFont::Helvetica => "Helvetica",
+            OverlayFont::Times => "Times Roman",
+            OverlayFont::Courier => "Courier",
+        }
+    }
+
+    /// The `/DA` font resource name (Acrobat's form font names).
+    pub fn resource(self) -> &'static str {
+        match self {
+            OverlayFont::Helvetica => "Helv",
+            OverlayFont::Times => "TiRo",
+            OverlayFont::Courier => "Cour",
+        }
+    }
+
+    pub fn from_resource(n: &str) -> OverlayFont {
+        match n {
+            "TiRo" | "Times-Roman" | "TimesRoman" => OverlayFont::Times,
+            "Cour" | "Courier" => OverlayFont::Courier,
+            _ => OverlayFont::Helvetica,
+        }
+    }
+}
+
+/// How redaction overlay text is drawn (Redaction Properties ▸ Appearance).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct OverlayLook {
+    pub font: OverlayFont,
+    /// Points; 0 = auto-size to fit the area.
+    pub size: f64,
+    pub color: Rgb,
+    /// 0 left, 1 centre, 2 right.
+    pub align: u8,
+    /// Repeat the text to fill the area.
+    pub repeat: bool,
+}
+
+impl Default for OverlayLook {
+    fn default() -> Self {
+        Self { font: OverlayFont::Helvetica, size: 0.0, color: [1.0, 0.0, 0.0], align: 1, repeat: false }
+    }
+}
+
+/// How a comment looks.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Style {
+    /// Stroke colour (text colour for text boxes, icon colour for notes).
+    pub color: Rgb,
+    /// 0–1 (`/CA`).
+    pub opacity: f64,
+    /// Border / stroke width in points (0 = none).
+    pub width: f64,
+    /// Interior fill for rectangles and ovals (`/IC`), background for text boxes.
+    pub fill: Option<Rgb>,
+}
+
+impl Default for Style {
+    fn default() -> Self {
+        Self { color: [1.0, 0.82, 0.0], opacity: 1.0, width: 1.0, fill: None }
+    }
+}
+
+impl Style {
+    /// The default look of each commenting tool.
+    pub fn default_for(shape: &Shape) -> Self {
+        let (color, width) = match shape {
+            Shape::Note { .. } => ([1.0, 0.82, 0.0], 1.0),
+            Shape::TextMarkup { kind: Markup::Highlight, .. } => ([1.0, 0.94, 0.0], 1.0),
+            Shape::TextMarkup { kind: Markup::Underline, .. } => ([0.0, 0.47, 0.84], 1.0),
+            Shape::TextMarkup { kind: Markup::StrikeOut, .. } => ([0.89, 0.13, 0.13], 1.0),
+            Shape::TextMarkup { kind: Markup::Squiggly, .. } => ([0.18, 0.62, 0.36], 1.0),
+            Shape::Rectangle { .. } | Shape::Oval { .. } | Shape::Line { .. } | Shape::Polygon { .. } | Shape::PolyLine { .. } => {
+                ([0.89, 0.13, 0.13], 2.0)
+            }
+            Shape::Callout { .. } => ([0.0, 0.0, 0.0], 1.0),
+            Shape::Caret { .. } | Shape::Attachment { .. } => ([0.0, 0.47, 0.84], 1.0),
+            Shape::Ink { .. } => ([0.0, 0.4, 0.87], 2.0),
+            Shape::TextBox { .. } | Shape::Typewriter { .. } => ([0.0, 0.0, 0.0], 0.0),
+            Shape::Mark { .. } => ([0.0, 0.0, 0.0], 1.5),
+            Shape::Signature { .. } => ([0.0, 0.0, 0.0], 1.5),
+            Shape::Stamp { stamp, .. } => (stamp.color(), 2.0),
+            Shape::CustomStamp { .. } => ([0.0, 0.0, 0.0], 0.0),
+            Shape::TypedSignature { .. } => ([0.0, 0.0, 0.0], 0.0),
+            // Red outline while marked; a black box once applied.
+            Shape::Redact { .. } => return Self { color: [0.89, 0.13, 0.13], opacity: 1.0, width: 1.0, fill: Some([0.0, 0.0, 0.0]) },
+        };
+        Self { color, opacity: 1.0, width, fill: None }
+    }
+}
+
+/// A comment to add.
+#[derive(Clone, Debug, PartialEq)]
+pub struct NewAnnotation {
+    /// 0-based page index.
+    pub page: usize,
+    pub shape: Shape,
+    pub style: Style,
+    /// The comment text (`/Contents`); the text shown by a text box.
+    pub contents: String,
+    /// `/T` (shown as the comment's author).
+    pub author: String,
+}
+
+/// Values stamped onto what an edit creates or changes, supplied by the caller so edits stay
+/// deterministic: a PDF date (`D:…`) and a unique id for `/NM`.
+#[derive(Clone, Debug, PartialEq, Default)]
+pub struct Meta {
+    pub date: Option<String>,
+    pub id: String,
+}
+
+/// Review states a reply can set (§12.5.6.3, Table 172; Acrobat's "Set status").
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ReviewState {
+    None,
+    Accepted,
+    Rejected,
+    Cancelled,
+    Completed,
+}
+
+impl ReviewState {
+    pub fn name(self) -> &'static str {
+        match self {
+            ReviewState::None => "None",
+            ReviewState::Accepted => "Accepted",
+            ReviewState::Rejected => "Rejected",
+            ReviewState::Cancelled => "Cancelled",
+            ReviewState::Completed => "Completed",
+        }
+    }
+
+    pub fn from_name(n: &str) -> Option<Self> {
+        [Self::None, Self::Accepted, Self::Rejected, Self::Cancelled, Self::Completed].into_iter().find(|s| s.name().eq_ignore_ascii_case(n))
+    }
+}
+
+// ── building ────────────────────────────────────────────────────────────────────────────────
+
+/// Annotation flags (§12.5.3).
+pub(crate) const FLAG_PRINT: i64 = 4;
+
+pub(crate) const FLAG_NO_ZOOM: i64 = 8;
+
+pub(crate) const FLAG_NO_ROTATE: i64 = 16;
+
+pub(crate) const FLAG_HIDDEN: i64 = 2;
+
+pub(crate) const FLAG_NO_VIEW: i64 = 32;
+
+pub(crate) const FLAG_LOCKED: i64 = 128;
+
+/// Size of a note icon (points, unscaled by zoom).
+pub const NOTE_SIZE: f64 = 20.0;
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index bed579ab84..a6e43de1f0 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -17,7 +17,7 @@ pdfcraft-platform = { workspace = true }
 serde_json = { workspace = true }
 sha2 = "0.11"
 tempfile = "3.27"
-base64 = { version = "0.22", optional = true }
+base64 = { version = "0.23", optional = true }
 
 
 [features]
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 7eb8ca1191..cdaaa13e64 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -33,7 +33,7 @@ its undo/redo history.
 - For proportional image signature resizing, use the embedded image layer's width/height ratio rather than a previously stretched annotation rectangle. The GUI preserves this ratio at corners with the opposite corner anchored; edge midpoint handles change only their own axis. `comment_edit` accepts the resulting rectangle.
 - `doc_close` refuses to drop unsaved changes unless `discard_changes: true`. `doc_save` writes atomically, incrementally in place, and in full for a new path. Atomic output writes call `sync_all` on the staging file before replacing the destination. A write or sync error leaves the destination intact, removes staging and leaves the document dirty for retry. A filesystem that does not support syncing returns an error; there is no unsynced fallback. This flushes file contents, but does not guarantee persistence of the parent-directory rename across power loss.
 - With a root set, every read and write path must resolve inside it (symlinks and `..` included). Relative paths resolve inside the root, and `..` is resolved by name before the check. Every path outside the root gets the same refusal (`<path> is outside the allowed directory <root>`), whether or not it exists, so a confined agent can't probe the rest of the disk; on Windows another network share or device path (`\\host\share`, `\\?\UNC\…`, `\\.\…`) is refused without being contacted. "Not found" and other filesystem errors are reported only for paths inside the root. Tools that write several files into a folder name them after the document or input file, with separators, colons and control characters replaced by `_`, so a name can't lead them out of the folder. The root itself must be a folder.
-- `Automation::with_automation_roots` holds a read folder and a write folder (`pdfcraft-cli mcp --automation-read-root DIR --automation-write-root DIR`, see [docs/mcp.md](../../docs/mcp.md)). Reads must lie inside the read root and writes inside the write root, links followed. A root left out grants none of its access. Refusals read `automation path rejected: outside the read root <root>: <path>`. It applies on top of `with_root`.
+- `Automation::with_automation_roots` holds a read folder and a write folder (`pdfcraft-cli mcp --automation-read-root DIR --automation-write-root DIR`, see [docs/mcp.md](../../docs/mcp.md)). Reads must lie inside the read root and writes inside the write root, links followed. A root left out grants none of its access. Refusals read `automation path rejected: outside the read root <root>: <path>`. As with a root set, on Windows a path on another network share or device path is refused with that refusal without being contacted (#4003). It applies on top of `with_root`.
 
 ## Text search and cache limits
 
diff --git a/crates/automation/src/a11y.rs b/crates/automation/src/a11y.rs
index 20243dcdae..1f0c9cb8a5 100644
--- a/crates/automation/src/a11y.rs
+++ b/crates/automation/src/a11y.rs
@@ -8,6 +8,10 @@ use std::collections::BTreeSet;
 
 use crate::{Args, Automation, Result, ToolError, child, failed, unused, write_atomic};
 
+mod documents;
+mod form_tools;
+mod ocr;
+
 fn status_id(s: Status) -> &'static str {
     match s {
         Status::Passed => "passed",
@@ -574,511 +578,6 @@ impl Automation {
     }
 }
 
-impl Automation {
-    /// Recognition settings from the arguments: `dpi` (clamped to 72–600), `language` (refused
-    /// unless the models read it) and `skip_text_pages`, each left at its default when absent.
-    pub(crate) fn ocr_settings(&self, a: &Args) -> Result<pdfcraft_engine::ocr::OcrSettings> {
-        let mut settings = pdfcraft_engine::ocr::OcrSettings::default();
-        if let Some(d) = a.opt_num("dpi")? {
-            settings.dpi = d.clamp(72.0, 600.0) as f32;
-        }
-        if let Some(l) = a.opt_str("language")? {
-            if !pdfcraft_engine::ocr::LANGUAGES.iter().any(|x| x.0 == l) {
-                return Err(ToolError::InvalidArgs(format!("unsupported language {l:?}")));
-            }
-            settings.language = l.into();
-        }
-        if let Some(s) = a.opt_bool("skip_text_pages")? {
-            settings.skip_text_pages = s;
-        }
-        Ok(settings)
-    }
-
-    /// Recognizes text in each of `paths` and writes the result under the same file name in
-    /// `folder`, reporting per file its output, word count and skipped pages, or its error. A
-    /// path outside the root refuses the whole call before any work starts.
-    pub(crate) fn ocr_recognize_files(&mut self, a: &Args) -> Result<Value> {
-        let settings = self.ocr_settings(a)?;
-        let folder = self.resolve(a.str("folder")?, true)?;
-        // A path that leaves the root refuses the whole call before any work starts, like the
-        // other tools (the write check passes missing files, which stay per-file errors below).
-        let paths = a.strs("paths")?;
-        for p in &paths {
-            self.resolve_for(p, crate::file_access::Access::Read, true)?;
-        }
-        // Two inputs that would write the same output file overwrite each other while both report
-        // success, so the whole batch is refused here: before the folder is created, anything is
-        // read, or the OCR engines load.
-        let targets: Vec<std::path::PathBuf> = paths.iter().map(|p| child(&folder, &input_file_name(p))).collect();
-        let shared = shared_file_names(&targets);
-        if !shared.is_empty() {
-            return Err(ToolError::InvalidArgs(format!(
-                "more than one input would write to the same output file, so each would replace the one before it. Colliding file names: {}. Give each input a different file name, or run them in separate batches with different folders.",
-                shared.join(", ")
-            )));
-        }
-        std::fs::create_dir_all(&folder).map_err(|e| failed(e.to_string()))?;
-        let ocr = pdfcraft_engine::ocr::engine().map_err(failed)?;
-        let mut out = Vec::new();
-        for p in paths {
-            let name = input_file_name(p);
-            let result =
-                self.resolve(p, false).map_err(|e| e.to_string()).and_then(|src| crate::read_input_bytes(&src).map_err(|e| e.to_string())).and_then(
-                    |bytes| pdfcraft_engine::ocr::recognize_file(&name, std::sync::Arc::new(bytes), None, settings.clone(), &ocr, |_, _| true),
-                );
-            out.push(match result {
-                Ok(r) => {
-                    let target = child(&folder, &name);
-                    write_atomic(&target, &r.bytes)?;
-                    let skipped: Vec<usize> = r.pages.iter().filter(|p| p.skipped.is_some()).map(|p| p.page + 1).collect();
-                    json!({ "path": p, "output": target.to_string_lossy(), "words": r.words(), "skipped_pages": skipped })
-                }
-                Err(e) => json!({ "path": p, "error": e }),
-            });
-        }
-        Ok(json!({ "files": out }))
-    }
-
-    /// Recognizes text on the open document's `pages` (every page when absent) and adds it,
-    /// reporting the total word count and, per page, why it was skipped or what it found.
-    pub(crate) fn ocr_recognize(&mut self, a: &Args) -> Result<Value> {
-        let settings = self.ocr_settings(a)?;
-        let pages = if a.opt_ints("pages")?.is_some() { self.pages(a, "pages")? } else { Vec::new() };
-        let doc = self.doc(a)?;
-        // Recognizing needs only permission to change the document; the words it found are
-        // returned only when copying is allowed too.
-        let (id, copy) = (doc.id, doc.allows_copying());
-        let found = self.session.recognize_text(id, &pages, settings).map_err(failed)?;
-        let list: Vec<Value> = found
-            .iter()
-            .map(|p| match &p.skipped {
-                Some(why) => json!({ "page": p.page + 1, "skipped": why }),
-                None if copy => json!({ "page": p.page + 1, "words": p.words.len(), "already_on_page": p.already_on_page, "text": p.text() }),
-                None => json!({ "page": p.page + 1, "words": p.words.len(), "already_on_page": p.already_on_page }),
-            })
-            .collect();
-        Ok(json!({ "words": found.iter().map(|p| p.words.len()).sum::<usize>(), "pages": list }))
-    }
-
-    /// Whether text recognition's models are installed, the directories searched for them (in
-    /// order), and the languages it reads, each as a code and a name.
-    pub(crate) fn ocr_status(&self) -> Result<Value> {
-        use pdfcraft_engine::ocr;
-        let dirs: Vec<String> = ocr::Models::search_dirs().iter().map(|d| d.to_string_lossy().into_owned()).collect();
-        let langs: Vec<Value> = ocr::LANGUAGES.iter().map(|(c, n)| json!({ "code": c, "name": n })).collect();
-        Ok(json!({ "available": ocr::available(), "search_dirs": dirs, "languages": langs }))
-    }
-}
-
-/// The file name an input is written under: its own file name, or `document.pdf` when it has none.
-fn input_file_name(path: &str) -> String {
-    std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document.pdf".into())
-}
-
-/// The output file names that two or more of `targets` share, each spelling listed once, in input
-/// order. Names are compared without regard to case on Windows and macOS and exactly elsewhere; on
-/// Windows a trailing dot or space is not part of the name (`scan.pdf.` is `scan.pdf`). Unicode
-/// normalization forms (NFC and NFD spellings of one name) are not compared, so such inputs are
-/// not caught. The folder is the same for every target, so only the names are compared.
-fn shared_file_names(targets: &[std::path::PathBuf]) -> Vec<String> {
-    let mut groups: std::collections::BTreeMap<String, (usize, Vec<String>)> = std::collections::BTreeMap::new();
-    for target in targets {
-        let name = target.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-        let key = if cfg!(windows) {
-            name.trim_end_matches(['.', ' ']).to_lowercase()
-        } else if cfg!(target_os = "macos") {
-            // Case only; NFC and NFD spellings of one name stay distinct here (a known limit).
-            name.to_lowercase()
-        } else {
-            name.clone()
-        };
-        let (count, spellings) = groups.entry(key).or_insert_with(|| (0, Vec::new()));
-        *count += 1;
-        if !spellings.contains(&name) {
-            spellings.push(name);
-        }
-    }
-    groups.into_values().filter(|(count, _)| *count > 1).flat_map(|(_, spellings)| spellings).collect()
-}
-
-/// A script's request to the viewer as the JSON that running a script reports; a side panel
-/// goes by its fixed id.
-fn request_json(r: &pdfcraft_engine::js::Request) -> Value {
-    use pdfcraft_engine::js::Request as R;
-    match r {
-        R::Reset(n) => json!({ "reset": n }),
-        R::Print => json!({ "print": true }),
-        R::GoToPage(p) => json!({ "page": p + 1 }),
-        R::LaunchUrl(u) => json!({ "url": u }),
-        R::Submit(u) => json!({ "submit": u }),
-        R::Focus(f) => json!({ "focus": f }),
-        R::Beep => json!({ "beep": true }),
-        R::SaveAs => json!({ "save_as": true }),
-        R::ShowPanel(p) => json!({ "panel": p.id() }),
-    }
-}
-
-impl Automation {
-    pub(crate) fn js_run(&mut self, a: &Args) -> Result<Value> {
-        let id = self.doc(a)?.id;
-        let o = self.session.run_javascript(id, a.str("script")?, a.opt_str("field")?).map_err(failed)?;
-        let reqs: Vec<Value> = o.requests.iter().map(request_json).collect();
-        Ok(
-            json!({ "alerts": o.alerts, "console": o.console, "requests": reqs, "error": o.error, "document_errors": o.doc_errors, "result": o.result }),
-        )
-    }
-
-    pub(crate) fn js_document_scripts(&self, a: &Args) -> Result<Value> {
-        let list: Vec<Value> = self.doc(a)?.document_scripts().into_iter().map(|(n, s)| json!({ "name": n, "script": s })).collect();
-        Ok(json!({ "scripts": list }))
-    }
-
-    pub(crate) fn js_set_document_script(&mut self, a: &Args) -> Result<Value> {
-        let edit = pdfcraft_engine::Edit::SetDocumentScript { name: a.str("name")?.into(), script: a.opt_str("script")?.map(str::to_string) };
-        let id = self.doc(a)?.id;
-        self.session.apply(id, edit).map_err(failed)?;
-        self.js_document_scripts(a)
-    }
-
-    pub(crate) fn form_set_script(&mut self, a: &Args) -> Result<Value> {
-        let edit = pdfcraft_engine::Edit::SetFieldScript {
-            name: a.str("field")?.into(),
-            event: a.str("event")?.into(),
-            script: a.opt_str("script")?.map(str::to_string),
-        };
-        let id = self.doc(a)?.id;
-        self.session.apply(id, edit).map_err(failed)?;
-        let out = self.session.take_js_output(id);
-        Ok(json!({ "field": a.str("field")?, "event": a.str("event")?, "console": out.console, "errors": out.errors }))
-    }
-
-    pub(crate) fn form_merge_data(&mut self, a: &Args) -> Result<Value> {
-        let mut files = Vec::new();
-        for p in a.strs("paths")? {
-            let path = self.resolve(p, false)?;
-            files.push((p.to_string(), crate::read_input_bytes(&path).map_err(|e| failed(format!("{p}: {e}")))?));
-        }
-        let csv = pdfcraft_engine::merge_data_files(&files).map_err(failed)?;
-        let target = self.resolve(a.str("path")?, true)?;
-        write_atomic(&target, csv.as_bytes())?;
-        let columns = csv.lines().next().map_or(0, |h| h.split(',').count());
-        Ok(json!({ "path": target.to_string_lossy(), "rows": files.len(), "columns": columns }))
-    }
-
-    pub(crate) fn doc_export_office(&self, a: &Args) -> Result<Value> {
-        let path = self.resolve(a.str("path")?, true)?;
-        let ext = path.extension().map(|e| e.to_string_lossy().into_owned()).unwrap_or_default();
-        let format = pdfcraft_engine::compare::OfficeFormat::from_extension(&ext)
-            .ok_or_else(|| ToolError::InvalidArgs(format!("unsupported extension {ext:?} (docx, pptx, html or rtf)")))?;
-        let export = self.doc_to_copy(a)?.export_office_checked(format);
-        write_atomic(&path, &export.bytes)?;
-        // Text left out to keep a hostile page bounded is said, not silent (#3120).
-        let truncated: Vec<usize> = export.truncated_pages.iter().map(|p| p.saturating_add(1)).collect();
-        let mut out = json!({ "path": path.to_string_lossy(), "bytes": export.bytes.len(), "format": format.extension(),
-            "truncated": !truncated.is_empty(), "truncated_pages": truncated });
-        if !export.truncated_pages.is_empty() {
-            use pdfcraft_engine::compare::{MAX_FORM_DEPTH, MAX_FORM_VISITS};
-            out["warnings"] = json!([format!(
-                "forms nested more than {MAX_FORM_DEPTH} deep, or past the first {MAX_FORM_VISITS} forms of a page (forms the page draws itself count too), were left out on the pages in truncated_pages: their text and images are missing from the export, although the viewer may still show them"
-            )]);
-        }
-        Ok(out)
-    }
-
-    fn pdfa_level(&self, a: &Args) -> Result<pdfcraft_engine::pdfa::Level> {
-        let l = a.opt_str("level")?.unwrap_or("2b");
-        pdfcraft_engine::pdfa::Level::from_id(l).ok_or_else(|| ToolError::InvalidArgs(format!("unknown PDF/A level {l:?} (2b or 3b)")))
-    }
-
-    pub(crate) fn pdfa_verify(&self, a: &Args) -> Result<Value> {
-        let level = self.pdfa_level(a)?;
-        let doc = self.doc(a)?;
-        let issues: Vec<Value> = doc
-            .pdfa_verify(level)
-            .iter()
-            .map(|i| json!({ "clause": i.clause, "message": i.message, "page": i.page.map(|p| p + 1), "fixable": i.fixable }))
-            .collect();
-        let d = doc.standards();
-        Ok(json!({
-            "level": level.label(),
-            "compliant": issues.is_empty(),
-            "issues": issues,
-            "declared": { "pdfa": d.pdfa.map(|(p, c)| format!("PDF/A-{p}{}", c.to_lowercase())), "pdfua": d.pdfua, "output_intents": d.output_intents },
-        }))
-    }
-
-    pub(crate) fn print_readiness(&self, a: &Args) -> Result<Value> {
-        let report = self.doc(a)?.print_readiness();
-        let findings: Vec<Value> =
-            report.findings.iter().map(|f| json!({ "id": f.id, "severity": f.severity, "message": f.message, "page": f.page })).collect();
-        let pages: Vec<Value> = report
-            .pages
-            .iter()
-            .map(|p| {
-                json!({
-                    "page": p.page,
-                    "media_mm": p.media_mm,
-                    "crop_mm": p.crop_mm,
-                    "trim_mm": p.trim_mm,
-                    "bleed_mm": p.bleed_mm,
-                    "trim_set": p.trim_set,
-                    "bleed_set": p.bleed_set,
-                    "bleed_margin_mm": p.bleed_margin_mm,
-                })
-            })
-            .collect();
-        let images: Vec<Value> = report
-            .images
-            .iter()
-            .map(|image| {
-                json!({
-                    "page": image.page,
-                    "name": image.name,
-                    "ppi": image.ppi,
-                    "pixels": image.pixels,
-                    "size_mm": image.size_mm,
-                })
-            })
-            .collect();
-        let pdfa: Vec<Value> = report
-            .pdfa_issues
-            .iter()
-            .map(|issue| json!({ "clause": issue.clause, "message": issue.message, "page": issue.page.map(|p| p + 1) }))
-            .collect();
-        Ok(json!({
-            "text": report.text(),
-            "findings": findings,
-            "pages": pages,
-            "images": images,
-            "output_intents": report.output_intents,
-            "fonts_not_embedded": report.fonts_not_embedded,
-            "pdfa_issues": pdfa,
-            "resolution_unknown": report.resolution_unknown,
-        }))
-    }
-
-    pub(crate) fn pdfa_convert(&mut self, a: &Args) -> Result<Value> {
-        let level = self.pdfa_level(a)?;
-        let id = self.doc(a)?.id;
-        self.session.apply(id, pdfcraft_engine::Edit::ConvertPdfA { level }).map_err(failed)?;
-        self.pdfa_verify(a)
-    }
-
-    pub(crate) fn action_list(&self) -> Result<Value> {
-        use pdfcraft_engine::actions::{Step, builtin};
-        let step_json = |s: &Step| json!({ "step": s.id(), "arg": s.arg() });
-        let actions: Vec<Value> = builtin()
-            .iter()
-            .map(|a| json!({ "name": a.name, "description": a.description, "steps": a.steps.iter().map(step_json).collect::<Vec<_>>() }))
-            .collect();
-        let steps: Vec<Value> = Step::all().iter().map(|s| json!({ "step": s.id(), "label": s.label(), "takes_arg": s.arg().is_some() })).collect();
-        Ok(json!({ "actions": actions, "steps": steps }))
-    }
-
-    pub(crate) fn action_run(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::actions::{Action, Step, builtin, run_on};
-        let action = if let Some(name) = a.opt_str("action")? {
-            builtin()
-                .into_iter()
-                .find(|x| x.name.eq_ignore_ascii_case(name))
-                .ok_or_else(|| ToolError::InvalidArgs(format!("no built-in action {name:?}")))?
-        } else {
-            let items = a.get("steps").and_then(Value::as_array).ok_or_else(|| ToolError::InvalidArgs("give action or steps".into()))?;
-            let steps = items
-                .iter()
-                .map(|it| {
-                    let id = it["step"].as_str().unwrap_or("");
-                    Step::from_id(id, it["arg"].as_str().unwrap_or("")).ok_or_else(|| ToolError::InvalidArgs(format!("unknown step {id:?}")))
-                })
-                .collect::<Result<Vec<_>>>()?;
-            Action { name: "Custom".into(), description: String::new(), steps, builtin: false }
-        };
-        let folder = self.resolve(a.str("folder")?, true)?;
-        std::fs::create_dir_all(&folder).map_err(|e| failed(e.to_string()))?;
-        let mut out = Vec::new();
-        for p in a.strs("paths")? {
-            let name = std::path::Path::new(p).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document.pdf".into());
-            let result = self
-                .resolve(p, false)
-                .map_err(|e| e.to_string())
-                .and_then(|src| crate::read_input_bytes(&src).map_err(|e| e.to_string()))
-                .and_then(|bytes| run_on(&action, &name, std::sync::Arc::new(bytes), |_, _| {}));
-            out.push(match result {
-                Ok(r) => {
-                    let target = child(&folder, &name);
-                    let target = if target.exists() {
-                        let stem =
-                            std::path::Path::new(&name).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| "document".into());
-                        unused(&folder, &stem)
-                    } else {
-                        target
-                    };
-                    if target.exists() {
-                        return Err(failed(format!("{}: no unused output name available", target.display())));
-                    }
-                    write_atomic(&target, &r.bytes)?;
-                    json!({ "path": p, "output": target.to_string_lossy(), "log": r.log })
-                }
-                Err(e) => json!({ "path": p, "error": e }),
-            });
-        }
-        Ok(json!({ "action": action.name, "files": out }))
-    }
-
-    fn compare_ids(&self, a: &Args) -> Result<(pdfcraft_engine::DocId, pdfcraft_engine::DocId)> {
-        let new = self.doc(a)?.id;
-        let other = a.int("other")?;
-        let old = u64::try_from(other)
-            .ok()
-            .and_then(|o| self.session.get(pdfcraft_engine::DocId(o)))
-            .map(|d| d.id)
-            .ok_or_else(|| ToolError::InvalidArgs(format!("no open document {other}")))?;
-        Ok((old, new))
-    }
-
-    pub(crate) fn doc_compare(&self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::compare::Kind;
-        let (old, new) = self.compare_ids(a)?;
-        let c = self.session.compare(old, new).map_err(failed)?;
-        let limit = a.opt_int("limit")?.unwrap_or(500).max(1) as usize;
-        let r2 = |r: &[f64; 4]| r.map(|v| (v * 100.0).round() / 100.0);
-        let side =
-            |s: &pdfcraft_engine::compare::Side| json!({ "text": s.text, "page": s.page + 1, "rects": s.rects.iter().map(r2).collect::<Vec<_>>() });
-        let list: Vec<Value> = c
-            .changes
-            .iter()
-            .take(limit)
-            .map(|ch| json!({ "kind": ch.kind.label().to_lowercase(), "old": side(&ch.old), "new": side(&ch.new) }))
-            .collect();
-        let visual: Vec<Value> = if a.opt_bool("visual")?.unwrap_or(false) {
-            self.session.compare_visual(old, new, 72.0).map_err(failed)?.iter().map(|(p, r)| json!({ "page": p + 1, "rect": r2(r) })).collect()
-        } else {
-            Vec::new()
-        };
-        Ok(json!({
-            "visual": visual,
-            "identical": c.identical(),
-            "replaced": c.count(Kind::Replaced),
-            "inserted": c.count(Kind::Inserted),
-            "deleted": c.count(Kind::Deleted),
-            "old_words": c.old_words,
-            "new_words": c.new_words,
-            "changes": list,
-        }))
-    }
-
-    pub(crate) fn doc_compare_report(&self, a: &Args) -> Result<Value> {
-        let (old, new) = self.compare_ids(a)?;
-        let bytes = self.session.compare_report(old, new).map_err(failed)?;
-        let path = self.resolve(a.str("path")?, true)?;
-        write_atomic(&path, &bytes)?;
-        Ok(json!({ "path": path.to_string_lossy(), "bytes": bytes.len() }))
-    }
-
-    pub(crate) fn doc_compare_mark(&mut self, a: &Args) -> Result<Value> {
-        let (old, new) = self.compare_ids(a)?;
-        let n = self.session.mark_differences(old, new).map_err(failed)?;
-        Ok(json!({ "comments": n }))
-    }
-
-    pub(crate) fn form_detect_fields(&mut self, a: &Args) -> Result<Value> {
-        let pages = if a.opt_ints("pages")?.is_some() { self.pages(a, "pages")? } else { Vec::new() };
-        let id = self.doc(a)?.id;
-        let found = self.session.detect_fields(id, &pages);
-        let list: Vec<Value> = found
-            .iter()
-            .map(|(p, c)| {
-                let (kind, comb) = match c.kind {
-                    pdfcraft_engine::detect::Kind::Text => ("text", None),
-                    pdfcraft_engine::detect::Kind::CheckBox => ("checkbox", None),
-                    pdfcraft_engine::detect::Kind::Comb { cells } => ("text", Some(cells)),
-                };
-                let mut v = json!({ "page": p + 1, "kind": kind, "name": c.name, "rect": c.rect.map(|v| (v * 100.0).round() / 100.0) });
-                if let Some(cells) = comb {
-                    v["comb"] = json!(cells);
-                }
-                v
-            })
-            .collect();
-        if a.opt_bool("add")?.unwrap_or(true) && !found.is_empty() {
-            self.session.auto_detect_fields(id, &pages).map_err(failed)?;
-        }
-        Ok(json!({ "fields": list }))
-    }
-
-    pub(crate) fn form_actions(&self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::FieldAction as A;
-        let list: Vec<Value> = self
-            .doc(a)?
-            .field_actions(a.str("field")?)
-            .iter()
-            .map(|(t, act)| {
-                let mut v = match act {
-                    A::JavaScript(j) => json!({ "javascript": j }),
-                    A::Uri(u) => json!({ "url": u }),
-                    A::Reset(f) => json!({ "reset": f }),
-                    A::Named(n) => json!({ "menu": n }),
-                    A::GoTo(p) => json!({ "page": p + 1 }),
-                    A::ShowHide { fields, hide: true } => json!({ "hide": fields }),
-                    A::ShowHide { fields, hide: false } => json!({ "show": fields }),
-                    A::Submit(u) => json!({ "submit": u }),
-                    A::Other(s) => json!({ "other": s }),
-                };
-                v["trigger"] = json!(t.id());
-                v
-            })
-            .collect();
-        Ok(json!({ "field": a.str("field")?, "actions": list }))
-    }
-
-    pub(crate) fn form_set_actions(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::{FieldAction as A, FieldTrigger as T};
-        let items = a.get("actions").and_then(Value::as_array).ok_or_else(|| ToolError::InvalidArgs("actions must be an array".into()))?;
-        let bad = |m: String| ToolError::InvalidArgs(m);
-        let names = |v: &Value| -> Vec<String> {
-            v.as_array().map(|x| x.iter().filter_map(|s| s.as_str().map(str::to_string)).collect()).unwrap_or_default()
-        };
-        let mut acts = Vec::new();
-        for it in items {
-            let tid = it["trigger"].as_str().unwrap_or("");
-            let t = T::from_id(tid).ok_or_else(|| bad(format!("unknown trigger {tid:?}")))?;
-            let act = if let Some(j) = it["javascript"].as_str() {
-                A::JavaScript(j.into())
-            } else if let Some(u) = it["url"].as_str() {
-                A::Uri(u.into())
-            } else if it.get("reset").is_some() {
-                A::Reset(names(&it["reset"]))
-            } else if let Some(m) = it["menu"].as_str() {
-                A::Named(m.into())
-            } else if let Some(p) = it["page"].as_u64() {
-                A::GoTo((p.max(1) - 1) as usize)
-            } else if it.get("show").is_some() {
-                A::ShowHide { fields: names(&it["show"]), hide: false }
-            } else if it.get("hide").is_some() {
-                A::ShowHide { fields: names(&it["hide"]), hide: true }
-            } else if let Some(u) = it["submit"].as_str() {
-                A::Submit(u.into())
-            } else {
-                return Err(bad(format!("{tid}: give one action (javascript, url, reset, menu, page, show, hide or submit)")));
-            };
-            acts.push((t, act));
-        }
-        let name = a.str("field")?.to_string();
-        let edit =
-            pdfcraft_engine::Edit::SetFieldProps { name, props: Box::new(pdfcraft_engine::FieldProps { actions: Some(acts), ..Default::default() }) };
-        let id = self.doc(a)?.id;
-        self.session.apply(id, edit).map_err(failed)?;
-        self.form_actions(a)
-    }
-
-    pub(crate) fn js_enabled(&mut self, a: &Args) -> Result<Value> {
-        if let Some(on) = a.opt_bool("enabled")? {
-            self.session.set_javascript(on);
-        }
-        Ok(json!({ "enabled": self.session.javascript() }))
-    }
-}
-
 #[cfg(test)]
 mod review_html_tests {
     use super::*;
@@ -1098,21 +597,3 @@ mod review_html_tests {
         assert!(!html.contains("<script>"));
     }
 }
-
-#[cfg(test)]
-mod shared_output_name_tests {
-    use super::*;
-
-    #[test]
-    fn shared_output_names_follow_the_default_filesystem() {
-        let targets = |names: &[&str]| -> Vec<std::path::PathBuf> { names.iter().map(|n| std::path::Path::new("out").join(n)).collect() };
-        // A spelling that repeats is one shared name, listed once.
-        assert_eq!(shared_file_names(&targets(&["a.pdf", "b.pdf", "a.pdf"])), vec!["a.pdf".to_string()]);
-        assert!(shared_file_names(&targets(&["a.pdf", "b.pdf"])).is_empty());
-        // Case is ignored on Windows and macOS only; a trailing dot is ignored on Windows only.
-        let case = shared_file_names(&targets(&["scan.pdf", "Scan.PDF"]));
-        let dot = shared_file_names(&targets(&["scan.pdf", "scan.pdf."]));
-        assert_eq!(case.len(), if cfg!(any(windows, target_os = "macos")) { 2 } else { 0 }, "{case:?}");
-        assert_eq!(dot.len(), if cfg!(windows) { 2 } else { 0 }, "{dot:?}");
-    }
-}
diff --git a/crates/automation/src/a11y/documents.rs b/crates/automation/src/a11y/documents.rs
new file mode 100644
index 0000000000..f623ef714e
--- /dev/null
+++ b/crates/automation/src/a11y/documents.rs
@@ -0,0 +1,219 @@
+use super::*;
+
+impl Automation {
+    pub(crate) fn doc_export_office(&self, a: &Args) -> Result<Value> {
+        let path = self.resolve(a.str("path")?, true)?;
+        let ext = path.extension().map(|e| e.to_string_lossy().into_owned()).unwrap_or_default();
+        let format = pdfcraft_engine::compare::OfficeFormat::from_extension(&ext)
+            .ok_or_else(|| ToolError::InvalidArgs(format!("unsupported extension {ext:?} (docx, pptx, html or rtf)")))?;
+        let export = self.doc_to_copy(a)?.export_office_checked(format);
+        write_atomic(&path, &export.bytes)?;
+        // Text left out to keep a hostile page bounded is said, not silent (#3120).
+        let truncated: Vec<usize> = export.truncated_pages.iter().map(|p| p.saturating_add(1)).collect();
+        let mut out = json!({ "path": path.to_string_lossy(), "bytes": export.bytes.len(), "format": format.extension(),
+            "truncated": !truncated.is_empty(), "truncated_pages": truncated });
+        if !export.truncated_pages.is_empty() {
+            use pdfcraft_engine::compare::{MAX_FORM_DEPTH, MAX_FORM_VISITS};
+            out["warnings"] = json!([format!(
+                "forms nested more than {MAX_FORM_DEPTH} deep, or past the first {MAX_FORM_VISITS} forms of a page (forms the page draws itself count too), were left out on the pages in truncated_pages: their text and images are missing from the export, although the viewer may still show them"
+            )]);
+        }
+        Ok(out)
+    }
+
+    fn pdfa_level(&self, a: &Args) -> Result<pdfcraft_engine::pdfa::Level> {
+        let l = a.opt_str("level")?.unwrap_or("2b");
+        pdfcraft_engine::pdfa::Level::from_id(l).ok_or_else(|| ToolError::InvalidArgs(format!("unknown PDF/A level {l:?} (2b or 3b)")))
+    }
+
+    pub(crate) fn pdfa_verify(&self, a: &Args) -> Result<Value> {
+        let level = self.pdfa_level(a)?;
+        let doc = self.doc(a)?;
+        let issues: Vec<Value> = doc
+            .pdfa_verify(level)
+            .iter()
+            .map(|i| json!({ "clause": i.clause, "message": i.message, "page": i.page.map(|p| p + 1), "fixable": i.fixable }))
+            .collect();
+        let d = doc.standards();
+        Ok(json!({
+            "level": level.label(),
+            "compliant": issues.is_empty(),
+            "issues": issues,
+            "declared": { "pdfa": d.pdfa.map(|(p, c)| format!("PDF/A-{p}{}", c.to_lowercase())), "pdfua": d.pdfua, "output_intents": d.output_intents },
+        }))
+    }
+
+    pub(crate) fn print_readiness(&self, a: &Args) -> Result<Value> {
+        let report = self.doc(a)?.print_readiness();
+        let findings: Vec<Value> =
+            report.findings.iter().map(|f| json!({ "id": f.id, "severity": f.severity, "message": f.message, "page": f.page })).collect();
+        let pages: Vec<Value> = report
+            .pages
+            .iter()
+            .map(|p| {
+                json!({
+                    "page": p.page,
+                    "media_mm": p.media_mm,
+                    "crop_mm": p.crop_mm,
+                    "trim_mm": p.trim_mm,
+                    "bleed_mm": p.bleed_mm,
+                    "trim_set": p.trim_set,
+                    "bleed_set": p.bleed_set,
+                    "bleed_margin_mm": p.bleed_margin_mm,
+                })
+            })
+            .collect();
+        let images: Vec<Value> = report
+            .images
+            .iter()
+            .map(|image| {
+                json!({
+                    "page": image.page,
+                    "name": image.name,
+                    "ppi": image.ppi,
+                    "pixels": image.pixels,
+                    "size_mm": image.size_mm,
+                })
+            })
+            .collect();
+        let pdfa: Vec<Value> = report
+            .pdfa_issues
+            .iter()
+            .map(|issue| json!({ "clause": issue.clause, "message": issue.message, "page": issue.page.map(|p| p + 1) }))
+            .collect();
+        Ok(json!({
+            "text": report.text(),
+            "findings": findings,
+            "pages": pages,
+            "images": images,
+            "output_intents": report.output_intents,
+            "fonts_not_embedded": report.fonts_not_embedded,
+            "pdfa_issues": pdfa,
+            "resolution_unknown": report.resolution_unknown,
+        }))
+    }
+
+    pub(crate) fn pdfa_convert(&mut self, a: &Args) -> Result<Value> {
+        let level = self.pdfa_level(a)?;
+        let id = self.doc(a)?.id;
+        self.session.apply(id, pdfcraft_engine::Edit::ConvertPdfA { level }).map_err(failed)?;
+        self.pdfa_verify(a)
+    }
+
+    pub(crate) fn action_list(&self) -> Result<Value> {
+        use pdfcraft_engine::actions::{Step, builtin};
+        let step_json = |s: &Step| json!({ "step": s.id(), "arg": s.arg() });
+        let actions: Vec<Value> = builtin()
+            .iter()
+            .map(|a| json!({ "name": a.name, "description": a.description, "steps": a.steps.iter().map(step_json).collect::<Vec<_>>() }))
+            .collect();
+        let steps: Vec<Value> = Step::all().iter().map(|s| json!({ "step": s.id(), "label": s.label(), "takes_arg": s.arg().is_some() })).collect();
+        Ok(json!({ "actions": actions, "steps": steps }))
+    }
+
+    pub(crate) fn action_run(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::actions::{Action, Step, builtin, run_on};
+        let action = if let Some(name) = a.opt_str("action")? {
+            builtin()
+                .into_iter()
+                .find(|x| x.name.eq_ignore_ascii_case(name))
+                .ok_or_else(|| ToolError::InvalidArgs(format!("no built-in action {name:?}")))?
+        } else {
+            let items = a.get("steps").and_then(Value::as_array).ok_or_else(|| ToolError::InvalidArgs("give action or steps".into()))?;
+            let steps = items
+                .iter()
+                .map(|it| {
+                    let id = it["step"].as_str().unwrap_or("");
+                    Step::from_id(id, it["arg"].as_str().unwrap_or("")).ok_or_else(|| ToolError::InvalidArgs(format!("unknown step {id:?}")))
+                })
+                .collect::<Result<Vec<_>>>()?;
+            Action { name: "Custom".into(), description: String::new(), steps, builtin: false }
+        };
+        let folder = self.resolve(a.str("folder")?, true)?;
+        std::fs::create_dir_all(&folder).map_err(|e| failed(e.to_string()))?;
+        let mut out = Vec::new();
+        for p in a.strs("paths")? {
+            let name = std::path::Path::new(p).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document.pdf".into());
+            let result = self
+                .resolve(p, false)
+                .map_err(|e| e.to_string())
+                .and_then(|src| crate::read_input_bytes(&src).map_err(|e| e.to_string()))
+                .and_then(|bytes| run_on(&action, &name, std::sync::Arc::new(bytes), |_, _| {}));
+            out.push(match result {
+                Ok(r) => {
+                    let target = child(&folder, &name);
+                    let target = if target.exists() {
+                        let stem =
+                            std::path::Path::new(&name).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| "document".into());
+                        unused(&folder, &stem)
+                    } else {
+                        target
+                    };
+                    if target.exists() {
+                        return Err(failed(format!("{}: no unused output name available", target.display())));
+                    }
+                    write_atomic(&target, &r.bytes)?;
+                    json!({ "path": p, "output": target.to_string_lossy(), "log": r.log })
+                }
+                Err(e) => json!({ "path": p, "error": e }),
+            });
+        }
+        Ok(json!({ "action": action.name, "files": out }))
+    }
+
+    fn compare_ids(&self, a: &Args) -> Result<(pdfcraft_engine::DocId, pdfcraft_engine::DocId)> {
+        let new = self.doc(a)?.id;
+        let other = a.int("other")?;
+        let old = u64::try_from(other)
+            .ok()
+            .and_then(|o| self.session.get(pdfcraft_engine::DocId(o)))
+            .map(|d| d.id)
+            .ok_or_else(|| ToolError::InvalidArgs(format!("no open document {other}")))?;
+        Ok((old, new))
+    }
+
+    pub(crate) fn doc_compare(&self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::compare::Kind;
+        let (old, new) = self.compare_ids(a)?;
+        let c = self.session.compare(old, new).map_err(failed)?;
+        let limit = a.opt_int("limit")?.unwrap_or(500).max(1) as usize;
+        let r2 = |r: &[f64; 4]| r.map(|v| (v * 100.0).round() / 100.0);
+        let side =
+            |s: &pdfcraft_engine::compare::Side| json!({ "text": s.text, "page": s.page + 1, "rects": s.rects.iter().map(r2).collect::<Vec<_>>() });
+        let list: Vec<Value> = c
+            .changes
+            .iter()
+            .take(limit)
+            .map(|ch| json!({ "kind": ch.kind.label().to_lowercase(), "old": side(&ch.old), "new": side(&ch.new) }))
+            .collect();
+        let visual: Vec<Value> = if a.opt_bool("visual")?.unwrap_or(false) {
+            self.session.compare_visual(old, new, 72.0).map_err(failed)?.iter().map(|(p, r)| json!({ "page": p + 1, "rect": r2(r) })).collect()
+        } else {
+            Vec::new()
+        };
+        Ok(json!({
+            "visual": visual,
+            "identical": c.identical(),
+            "replaced": c.count(Kind::Replaced),
+            "inserted": c.count(Kind::Inserted),
+            "deleted": c.count(Kind::Deleted),
+            "old_words": c.old_words,
+            "new_words": c.new_words,
+            "changes": list,
+        }))
+    }
+
+    pub(crate) fn doc_compare_report(&self, a: &Args) -> Result<Value> {
+        let (old, new) = self.compare_ids(a)?;
+        let bytes = self.session.compare_report(old, new).map_err(failed)?;
+        let path = self.resolve(a.str("path")?, true)?;
+        write_atomic(&path, &bytes)?;
+        Ok(json!({ "path": path.to_string_lossy(), "bytes": bytes.len() }))
+    }
+
+    pub(crate) fn doc_compare_mark(&mut self, a: &Args) -> Result<Value> {
+        let (old, new) = self.compare_ids(a)?;
+        let n = self.session.mark_differences(old, new).map_err(failed)?;
+        Ok(json!({ "comments": n }))
+    }
+}
diff --git a/crates/automation/src/a11y/form_tools.rs b/crates/automation/src/a11y/form_tools.rs
new file mode 100644
index 0000000000..5fb14f136e
--- /dev/null
+++ b/crates/automation/src/a11y/form_tools.rs
@@ -0,0 +1,163 @@
+use super::*;
+
+/// A script's request to the viewer as the JSON that running a script reports; a side panel
+/// goes by its fixed id.
+fn request_json(r: &pdfcraft_engine::js::Request) -> Value {
+    use pdfcraft_engine::js::Request as R;
+    match r {
+        R::Reset(n) => json!({ "reset": n }),
+        R::Print => json!({ "print": true }),
+        R::GoToPage(p) => json!({ "page": p + 1 }),
+        R::LaunchUrl(u) => json!({ "url": u }),
+        R::Submit(u) => json!({ "submit": u }),
+        R::Focus(f) => json!({ "focus": f }),
+        R::Beep => json!({ "beep": true }),
+        R::SaveAs => json!({ "save_as": true }),
+        R::ShowPanel(p) => json!({ "panel": p.id() }),
+    }
+}
+
+impl Automation {
+    pub(crate) fn js_run(&mut self, a: &Args) -> Result<Value> {
+        let id = self.doc(a)?.id;
+        let o = self.session.run_javascript(id, a.str("script")?, a.opt_str("field")?).map_err(failed)?;
+        let reqs: Vec<Value> = o.requests.iter().map(request_json).collect();
+        Ok(
+            json!({ "alerts": o.alerts, "console": o.console, "requests": reqs, "error": o.error, "document_errors": o.doc_errors, "result": o.result }),
+        )
+    }
+
+    pub(crate) fn js_document_scripts(&self, a: &Args) -> Result<Value> {
+        let list: Vec<Value> = self.doc(a)?.document_scripts().into_iter().map(|(n, s)| json!({ "name": n, "script": s })).collect();
+        Ok(json!({ "scripts": list }))
+    }
+
+    pub(crate) fn js_set_document_script(&mut self, a: &Args) -> Result<Value> {
+        let edit = pdfcraft_engine::Edit::SetDocumentScript { name: a.str("name")?.into(), script: a.opt_str("script")?.map(str::to_string) };
+        let id = self.doc(a)?.id;
+        self.session.apply(id, edit).map_err(failed)?;
+        self.js_document_scripts(a)
+    }
+
+    pub(crate) fn form_set_script(&mut self, a: &Args) -> Result<Value> {
+        let edit = pdfcraft_engine::Edit::SetFieldScript {
+            name: a.str("field")?.into(),
+            event: a.str("event")?.into(),
+            script: a.opt_str("script")?.map(str::to_string),
+        };
+        let id = self.doc(a)?.id;
+        self.session.apply(id, edit).map_err(failed)?;
+        let out = self.session.take_js_output(id);
+        Ok(json!({ "field": a.str("field")?, "event": a.str("event")?, "console": out.console, "errors": out.errors }))
+    }
+
+    pub(crate) fn form_merge_data(&mut self, a: &Args) -> Result<Value> {
+        let mut files = Vec::new();
+        for p in a.strs("paths")? {
+            let path = self.resolve(p, false)?;
+            files.push((p.to_string(), crate::read_input_bytes(&path).map_err(|e| failed(format!("{p}: {e}")))?));
+        }
+        let csv = pdfcraft_engine::merge_data_files(&files).map_err(failed)?;
+        let target = self.resolve(a.str("path")?, true)?;
+        write_atomic(&target, csv.as_bytes())?;
+        let columns = csv.lines().next().map_or(0, |h| h.split(',').count());
+        Ok(json!({ "path": target.to_string_lossy(), "rows": files.len(), "columns": columns }))
+    }
+
+    pub(crate) fn form_detect_fields(&mut self, a: &Args) -> Result<Value> {
+        let pages = if a.opt_ints("pages")?.is_some() { self.pages(a, "pages")? } else { Vec::new() };
+        let id = self.doc(a)?.id;
+        let found = self.session.detect_fields(id, &pages);
+        let list: Vec<Value> = found
+            .iter()
+            .map(|(p, c)| {
+                let (kind, comb) = match c.kind {
+                    pdfcraft_engine::detect::Kind::Text => ("text", None),
+                    pdfcraft_engine::detect::Kind::CheckBox => ("checkbox", None),
+                    pdfcraft_engine::detect::Kind::Comb { cells } => ("text", Some(cells)),
+                };
+                let mut v = json!({ "page": p + 1, "kind": kind, "name": c.name, "rect": c.rect.map(|v| (v * 100.0).round() / 100.0) });
+                if let Some(cells) = comb {
+                    v["comb"] = json!(cells);
+                }
+                v
+            })
+            .collect();
+        if a.opt_bool("add")?.unwrap_or(true) && !found.is_empty() {
+            self.session.auto_detect_fields(id, &pages).map_err(failed)?;
+        }
+        Ok(json!({ "fields": list }))
+    }
+
+    pub(crate) fn form_actions(&self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::FieldAction as A;
+        let list: Vec<Value> = self
+            .doc(a)?
+            .field_actions(a.str("field")?)
+            .iter()
+            .map(|(t, act)| {
+                let mut v = match act {
+                    A::JavaScript(j) => json!({ "javascript": j }),
+                    A::Uri(u) => json!({ "url": u }),
+                    A::Reset(f) => json!({ "reset": f }),
+                    A::Named(n) => json!({ "menu": n }),
+                    A::GoTo(p) => json!({ "page": p + 1 }),
+                    A::ShowHide { fields, hide: true } => json!({ "hide": fields }),
+                    A::ShowHide { fields, hide: false } => json!({ "show": fields }),
+                    A::Submit(u) => json!({ "submit": u }),
+                    A::Other(s) => json!({ "other": s }),
+                };
+                v["trigger"] = json!(t.id());
+                v
+            })
+            .collect();
+        Ok(json!({ "field": a.str("field")?, "actions": list }))
+    }
+
+    pub(crate) fn form_set_actions(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::{FieldAction as A, FieldTrigger as T};
+        let items = a.get("actions").and_then(Value::as_array).ok_or_else(|| ToolError::InvalidArgs("actions must be an array".into()))?;
+        let bad = |m: String| ToolError::InvalidArgs(m);
+        let names = |v: &Value| -> Vec<String> {
+            v.as_array().map(|x| x.iter().filter_map(|s| s.as_str().map(str::to_string)).collect()).unwrap_or_default()
+        };
+        let mut acts = Vec::new();
+        for it in items {
+            let tid = it["trigger"].as_str().unwrap_or("");
+            let t = T::from_id(tid).ok_or_else(|| bad(format!("unknown trigger {tid:?}")))?;
+            let act = if let Some(j) = it["javascript"].as_str() {
+                A::JavaScript(j.into())
+            } else if let Some(u) = it["url"].as_str() {
+                A::Uri(u.into())
+            } else if it.get("reset").is_some() {
+                A::Reset(names(&it["reset"]))
+            } else if let Some(m) = it["menu"].as_str() {
+                A::Named(m.into())
+            } else if let Some(p) = it["page"].as_u64() {
+                A::GoTo((p.max(1) - 1) as usize)
+            } else if it.get("show").is_some() {
+                A::ShowHide { fields: names(&it["show"]), hide: false }
+            } else if it.get("hide").is_some() {
+                A::ShowHide { fields: names(&it["hide"]), hide: true }
+            } else if let Some(u) = it["submit"].as_str() {
+                A::Submit(u.into())
+            } else {
+                return Err(bad(format!("{tid}: give one action (javascript, url, reset, menu, page, show, hide or submit)")));
+            };
+            acts.push((t, act));
+        }
+        let name = a.str("field")?.to_string();
+        let edit =
+            pdfcraft_engine::Edit::SetFieldProps { name, props: Box::new(pdfcraft_engine::FieldProps { actions: Some(acts), ..Default::default() }) };
+        let id = self.doc(a)?.id;
+        self.session.apply(id, edit).map_err(failed)?;
+        self.form_actions(a)
+    }
+
+    pub(crate) fn js_enabled(&mut self, a: &Args) -> Result<Value> {
+        if let Some(on) = a.opt_bool("enabled")? {
+            self.session.set_javascript(on);
+        }
+        Ok(json!({ "enabled": self.session.javascript() }))
+    }
+}
diff --git a/crates/automation/src/a11y/ocr.rs b/crates/automation/src/a11y/ocr.rs
new file mode 100644
index 0000000000..afc671a8c7
--- /dev/null
+++ b/crates/automation/src/a11y/ocr.rs
@@ -0,0 +1,146 @@
+use super::*;
+
+impl Automation {
+    /// Recognition settings from the arguments: `dpi` (clamped to 72–600), `language` (refused
+    /// unless the models read it) and `skip_text_pages`, each left at its default when absent.
+    pub(crate) fn ocr_settings(&self, a: &Args) -> Result<pdfcraft_engine::ocr::OcrSettings> {
+        let mut settings = pdfcraft_engine::ocr::OcrSettings::default();
+        if let Some(d) = a.opt_num("dpi")? {
+            settings.dpi = d.clamp(72.0, 600.0) as f32;
+        }
+        if let Some(l) = a.opt_str("language")? {
+            if !pdfcraft_engine::ocr::LANGUAGES.iter().any(|x| x.0 == l) {
+                return Err(ToolError::InvalidArgs(format!("unsupported language {l:?}")));
+            }
+            settings.language = l.into();
+        }
+        if let Some(s) = a.opt_bool("skip_text_pages")? {
+            settings.skip_text_pages = s;
+        }
+        Ok(settings)
+    }
+
+    /// Recognizes text in each of `paths` and writes the result under the same file name in
+    /// `folder`, reporting per file its output, word count and skipped pages, or its error. A
+    /// path outside the root refuses the whole call before any work starts.
+    pub(crate) fn ocr_recognize_files(&mut self, a: &Args) -> Result<Value> {
+        let settings = self.ocr_settings(a)?;
+        let folder = self.resolve(a.str("folder")?, true)?;
+        // A path that leaves the root refuses the whole call before any work starts, like the
+        // other tools (the write check passes missing files, which stay per-file errors below).
+        let paths = a.strs("paths")?;
+        for p in &paths {
+            self.resolve_for(p, crate::file_access::Access::Read, true)?;
+        }
+        // Two inputs that would write the same output file overwrite each other while both report
+        // success, so the whole batch is refused here: before the folder is created, anything is
+        // read, or the OCR engines load.
+        let targets: Vec<std::path::PathBuf> = paths.iter().map(|p| child(&folder, &input_file_name(p))).collect();
+        let shared = shared_file_names(&targets);
+        if !shared.is_empty() {
+            return Err(ToolError::InvalidArgs(format!(
+                "more than one input would write to the same output file, so each would replace the one before it. Colliding file names: {}. Give each input a different file name, or run them in separate batches with different folders.",
+                shared.join(", ")
+            )));
+        }
+        std::fs::create_dir_all(&folder).map_err(|e| failed(e.to_string()))?;
+        let ocr = pdfcraft_engine::ocr::engine().map_err(failed)?;
+        let mut out = Vec::new();
+        for p in paths {
+            let name = input_file_name(p);
+            let result =
+                self.resolve(p, false).map_err(|e| e.to_string()).and_then(|src| crate::read_input_bytes(&src).map_err(|e| e.to_string())).and_then(
+                    |bytes| pdfcraft_engine::ocr::recognize_file(&name, std::sync::Arc::new(bytes), None, settings.clone(), &ocr, |_, _| true),
+                );
+            out.push(match result {
+                Ok(r) => {
+                    let target = child(&folder, &name);
+                    write_atomic(&target, &r.bytes)?;
+                    let skipped: Vec<usize> = r.pages.iter().filter(|p| p.skipped.is_some()).map(|p| p.page + 1).collect();
+                    json!({ "path": p, "output": target.to_string_lossy(), "words": r.words(), "skipped_pages": skipped })
+                }
+                Err(e) => json!({ "path": p, "error": e }),
+            });
+        }
+        Ok(json!({ "files": out }))
+    }
+
+    /// Recognizes text on the open document's `pages` (every page when absent) and adds it,
+    /// reporting the total word count and, per page, why it was skipped or what it found.
+    pub(crate) fn ocr_recognize(&mut self, a: &Args) -> Result<Value> {
+        let settings = self.ocr_settings(a)?;
+        let pages = if a.opt_ints("pages")?.is_some() { self.pages(a, "pages")? } else { Vec::new() };
+        let doc = self.doc(a)?;
+        // Recognizing needs only permission to change the document; the words it found are
+        // returned only when copying is allowed too.
+        let (id, copy) = (doc.id, doc.allows_copying());
+        let found = self.session.recognize_text(id, &pages, settings).map_err(failed)?;
+        let list: Vec<Value> = found
+            .iter()
+            .map(|p| match &p.skipped {
+                Some(why) => json!({ "page": p.page + 1, "skipped": why }),
+                None if copy => json!({ "page": p.page + 1, "words": p.words.len(), "already_on_page": p.already_on_page, "text": p.text() }),
+                None => json!({ "page": p.page + 1, "words": p.words.len(), "already_on_page": p.already_on_page }),
+            })
+            .collect();
+        Ok(json!({ "words": found.iter().map(|p| p.words.len()).sum::<usize>(), "pages": list }))
+    }
+
+    /// Whether text recognition's models are installed, the directories searched for them (in
+    /// order), and the languages it reads, each as a code and a name.
+    pub(crate) fn ocr_status(&self) -> Result<Value> {
+        use pdfcraft_engine::ocr;
+        let dirs: Vec<String> = ocr::Models::search_dirs().iter().map(|d| d.to_string_lossy().into_owned()).collect();
+        let langs: Vec<Value> = ocr::LANGUAGES.iter().map(|(c, n)| json!({ "code": c, "name": n })).collect();
+        Ok(json!({ "available": ocr::available(), "search_dirs": dirs, "languages": langs }))
+    }
+}
+
+/// The file name an input is written under: its own file name, or `document.pdf` when it has none.
+fn input_file_name(path: &str) -> String {
+    std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document.pdf".into())
+}
+
+/// The output file names that two or more of `targets` share, each spelling listed once, in input
+/// order. Names are compared without regard to case on Windows and macOS and exactly elsewhere; on
+/// Windows a trailing dot or space is not part of the name (`scan.pdf.` is `scan.pdf`). Unicode
+/// normalization forms (NFC and NFD spellings of one name) are not compared, so such inputs are
+/// not caught. The folder is the same for every target, so only the names are compared.
+fn shared_file_names(targets: &[std::path::PathBuf]) -> Vec<String> {
+    let mut groups: std::collections::BTreeMap<String, (usize, Vec<String>)> = std::collections::BTreeMap::new();
+    for target in targets {
+        let name = target.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+        let key = if cfg!(windows) {
+            name.trim_end_matches(['.', ' ']).to_lowercase()
+        } else if cfg!(target_os = "macos") {
+            // Case only; NFC and NFD spellings of one name stay distinct here (a known limit).
+            name.to_lowercase()
+        } else {
+            name.clone()
+        };
+        let (count, spellings) = groups.entry(key).or_insert_with(|| (0, Vec::new()));
+        *count += 1;
+        if !spellings.contains(&name) {
+            spellings.push(name);
+        }
+    }
+    groups.into_values().filter(|(count, _)| *count > 1).flat_map(|(_, spellings)| spellings).collect()
+}
+
+#[cfg(test)]
+mod shared_output_name_tests {
+    use super::*;
+
+    #[test]
+    fn shared_output_names_follow_the_default_filesystem() {
+        let targets = |names: &[&str]| -> Vec<std::path::PathBuf> { names.iter().map(|n| std::path::Path::new("out").join(n)).collect() };
+        // A spelling that repeats is one shared name, listed once.
+        assert_eq!(shared_file_names(&targets(&["a.pdf", "b.pdf", "a.pdf"])), vec!["a.pdf".to_string()]);
+        assert!(shared_file_names(&targets(&["a.pdf", "b.pdf"])).is_empty());
+        // Case is ignored on Windows and macOS only; a trailing dot is ignored on Windows only.
+        let case = shared_file_names(&targets(&["scan.pdf", "Scan.PDF"]));
+        let dot = shared_file_names(&targets(&["scan.pdf", "scan.pdf."]));
+        assert_eq!(case.len(), if cfg!(any(windows, target_os = "macos")) { 2 } else { 0 }, "{case:?}");
+        assert_eq!(dot.len(), if cfg!(windows) { 2 } else { 0 }, "{dot:?}");
+    }
+}
diff --git a/crates/automation/src/assemble.rs b/crates/automation/src/assemble.rs
new file mode 100644
index 0000000000..40ae65ea87
--- /dev/null
+++ b/crates/automation/src/assemble.rs
@@ -0,0 +1,424 @@
+use super::error::{Result, ToolError, failed};
+use super::json::{Args, one_based, summary};
+use super::paths::{child, read_input, read_input_bytes, unused, write_atomic};
+use super::*;
+
+impl Automation {
+    pub(crate) fn doc_create(&mut self, a: &Args) -> Result<Value> {
+        let (name, bytes) = match a.str("from")? {
+            "blank" => {
+                let n = a.opt_int("pages")?.unwrap_or(1).clamp(1, 10_000) as usize;
+                let (w, h) = (a.opt_num("width")?.unwrap_or(612.0), a.opt_num("height")?.unwrap_or(792.0));
+                ("Untitled.pdf".to_string(), self.session.create_blank(w, h, n).map_err(failed)?)
+            }
+            "images" => {
+                let resolution = a.opt_num("dpi")?.map_or(pdfcraft_engine::ImageResolution::Embedded, pdfcraft_engine::ImageResolution::Dpi);
+                let mut images = Vec::new();
+                for p in a.strs("paths")? {
+                    let path = self.resolve(p, false)?;
+                    let bytes = read_input(&path)?;
+                    images.push((path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(), bytes));
+                }
+                let name = if images.len() == 1 {
+                    format!("{}.pdf", images[0].0.rsplit_once('.').map_or(images[0].0.as_str(), |(s, _)| s))
+                } else {
+                    "Images.pdf".into()
+                };
+                (name, self.session.create_from_images_with_resolution(&images, resolution).map_err(failed)?)
+            }
+            "text" => {
+                let (title, text) = match (a.opt_str("text")?, a.opt_str("path")?) {
+                    (Some(t), _) => ("Text".to_string(), t.to_string()),
+                    (None, Some(p)) => {
+                        let path = self.resolve(p, false)?;
+                        let t = read_input(&path)?;
+                        (path.file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default(), pdfcraft_engine::decode_text(&t))
+                    }
+                    (None, None) => return Err(ToolError::InvalidArgs("text needs `text` or `path`".into())),
+                };
+                // The page font is Helvetica/WinAnsi: text it would turn into `?` is refused (with
+                // its line) by `pdfcraft_create::from_text`, as for every other caller.
+                let bytes = self.session.create_from_text(&title, &text).map_err(|e| match e {
+                    pdfcraft_engine::EditError::Create(pdfcraft_engine::CreateError::Invalid(m)) => ToolError::InvalidArgs(m),
+                    e => failed(e),
+                })?;
+                (format!("{title}.pdf"), bytes)
+            }
+            other => return Err(ToolError::InvalidArgs(format!("unknown source {other:?}"))),
+        };
+        let name = a.opt_str("name")?.map(str::to_owned).unwrap_or(name);
+        let id = self.session.open_new(name, bytes).map_err(failed)?;
+        Ok(summary(self.session.get(id).ok_or_else(|| failed("the document vanished"))?))
+    }
+
+    pub(crate) fn page_transition_set(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::{Transition, TransitionSpec};
+        let n = self.doc(a)?.info.pages.len();
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..n).collect(),
+        };
+        let transition = match a.opt_str("style")? {
+            None | Some("none") => None,
+            Some(style) => {
+                let mut t = Transition::new(style);
+                if let Some(d) = a.opt_num("duration")? {
+                    t.duration = d as f32;
+                }
+                if let Some(dm) = a.opt_str("dimension")? {
+                    t.horizontal = match dm {
+                        "horizontal" => true,
+                        "vertical" => false,
+                        other => return Err(ToolError::InvalidArgs(format!("dimension must be horizontal or vertical, not {other:?}"))),
+                    };
+                }
+                if let Some(m) = a.opt_str("motion")? {
+                    t.inward = match m {
+                        "inward" => true,
+                        "outward" => false,
+                        other => return Err(ToolError::InvalidArgs(format!("motion must be inward or outward, not {other:?}"))),
+                    };
+                }
+                match a.get("direction") {
+                    None => {}
+                    Some(Value::String(s)) if s == "none" => t.direction = None,
+                    Some(v) => {
+                        t.direction = Some(
+                            v.as_u64()
+                                .and_then(|d| u16::try_from(d).ok())
+                                .ok_or_else(|| ToolError::InvalidArgs("direction must be 0, 90, 180, 270, 315 or \"none\"".into()))?,
+                        );
+                    }
+                }
+                if let Some(s) = a.opt_num("scale")? {
+                    t.scale = s as f32;
+                }
+                if let Some(b) = a.opt_bool("opaque")? {
+                    t.opaque = b;
+                }
+                Some(t)
+            }
+        };
+        let display = a.opt_num("display")?.map(|s| s as f32);
+        self.apply(a, Edit::SetTransition { pages, spec: TransitionSpec { transition, display } })
+    }
+
+    pub(crate) fn page_set_box(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::{BoxSpec, PageBox};
+        let doc = self.doc(a)?;
+        let n = doc.info.pages.len();
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..n).collect(),
+        };
+        let which = match a.opt_str("box")? {
+            None => PageBox::Crop,
+            Some(b) => PageBox::from_name(b).ok_or_else(|| ToolError::InvalidArgs(format!("unknown box {b:?}")))?,
+        };
+        let nums = |key: &str| -> Result<Option<[f64; 4]>> {
+            a.get(key)
+                .map(|v| {
+                    let v: Vec<f64> = v.as_array().map(|x| x.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
+                    <[f64; 4]>::try_from(v).map_err(|_| ToolError::InvalidArgs(format!("{key} must be 4 numbers")))
+                })
+                .transpose()
+        };
+        let spec = match (nums("margins")?, nums("rect")?) {
+            (Some(_), Some(_)) => return Err(ToolError::InvalidArgs("pass margins or rect, not both".into())),
+            (Some(m), None) => BoxSpec::Margins(m),
+            (None, Some(r)) => {
+                // Top-left-origin points on the displayed page → user space (one page at a time).
+                if pages.len() != 1 {
+                    return Err(ToolError::InvalidArgs("rect applies to a single page; use margins for several".into()));
+                }
+                let p = &doc.info.pages[pages[0]];
+                let (u0, u1) = (p.view_to_user(r[0] as f32, r[1] as f32), p.view_to_user(r[2] as f32, r[3] as f32));
+                BoxSpec::Rect([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
+            }
+            (None, None) => BoxSpec::Remove,
+        };
+        let mut out = self.apply(a, Edit::SetPageBox { pages, which, spec })?;
+        out["page_sizes"] = json!(self.doc(a)?.info.pages.iter().map(|p| [p.width, p.height]).collect::<Vec<_>>());
+        Ok(out)
+    }
+
+    pub(crate) fn insert_blank(&mut self, a: &Args) -> Result<Value> {
+        let doc = self.doc(a)?;
+        let at = self.position(a, "at")?;
+        // Default to the size of the neighbouring page, as Acrobat does; Letter for empty files.
+        let near = doc.info.pages.get(at.saturating_sub(1)).or(doc.info.pages.first());
+        let (w, h) = near.map(|p| (f64::from(p.width), f64::from(p.height))).unwrap_or((612.0, 792.0));
+        let width = a.opt_num("width")?.unwrap_or(w);
+        let height = a.opt_num("height")?.unwrap_or(h);
+        if !(1.0..=14400.0).contains(&width) || !(1.0..=14400.0).contains(&height) {
+            return Err(ToolError::InvalidArgs("width and height must be between 1 and 14400 points".into()));
+        }
+        self.apply(a, Edit::InsertBlankPage { at, width, height })
+    }
+
+    pub(crate) fn insert_file(&mut self, a: &Args) -> Result<Value> {
+        let at = self.position(a, "at")?;
+        let path = self.resolve(a.str("path")?, false)?;
+        let bytes = read_input(&path)?;
+        let pages = a.opt_ints("pages")?.map(|p| one_based(&p)).transpose()?;
+        let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+        self.apply(a, Edit::InsertPagesFrom { name, bytes: Arc::new(bytes), pages, at, field_conflicts: pdfcraft_organize::FieldConflicts::Rename })
+    }
+
+    /// Write freshly created bytes to `out` and/or open them as a new document.
+    pub(crate) fn deliver(&mut self, a: &Args, name: &str, bytes: Arc<Vec<u8>>) -> Result<Value> {
+        let mut result = json!({ "bytes": bytes.len() });
+        let out = a.opt_str("out")?;
+        if let Some(out) = out {
+            let path = self.resolve(out, true)?;
+            write_atomic(&path, &bytes)?;
+            result["path"] = json!(path.to_string_lossy());
+        }
+        if a.opt_bool("open")?.unwrap_or(out.is_none()) {
+            let id = self.session.open_new(name, bytes).map_err(failed)?;
+            result["document"] = summary(self.session.get(id).ok_or_else(|| failed("the document vanished"))?);
+        }
+        Ok(result)
+    }
+
+    pub(crate) fn doc_create_multiple(&mut self, a: &Args) -> Result<Value> {
+        let paths = a.strs("paths")?;
+        if paths.is_empty() {
+            return Err(ToolError::InvalidArgs("paths must list at least one file".into()));
+        }
+        let separate = match a.opt_str("mode")? {
+            None | Some("combine") => false,
+            Some("separate") => true,
+            Some(m) => return Err(ToolError::InvalidArgs(format!("mode must be \"combine\" or \"separate\", not {m:?}"))),
+        };
+        if separate {
+            return self.create_separate(a, &paths);
+        }
+        let ranges: Vec<Option<String>> = match a.get("pages") {
+            None | Some(Value::Null) => vec![None; paths.len()],
+            Some(Value::Array(v)) if v.len() == paths.len() => v.iter().map(|x| x.as_str().map(str::to_owned)).collect(),
+            Some(_) => return Err(ToolError::InvalidArgs("pages must list a range (or null) for each path".into())),
+        };
+        // Each file is read, converted and copied in turn, so a long list holds one file at a time.
+        let sources = paths.into_iter().zip(ranges).map(|(p, range)| -> std::result::Result<pdfcraft_engine::CombineSource, ToolError> {
+            let path = self.resolve(p, false)?;
+            let bytes = read_input(&path)?;
+            let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+            let (_, pdf) = self.session.convert_to_pdf(&name, &Arc::new(bytes)).map_err(failed)?;
+            let title = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+            Ok((title, pdf, range))
+        });
+        let bytes = self.session.combine_each(sources)?.ok_or_else(|| ToolError::InvalidArgs("paths must list at least one file".into()))?;
+        self.deliver(a, "Combined", bytes)
+    }
+
+    /// One PDF per file, written into `out_dir`; a file that fails doesn't stop the others.
+    fn create_separate(&mut self, a: &Args, paths: &[&str]) -> Result<Value> {
+        let dir = self.resolve(a.str("out_dir").map_err(|_| ToolError::InvalidArgs("mode \"separate\" needs out_dir".into()))?, true)?;
+        std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
+        let mut out = Vec::new();
+        for &p in paths {
+            let converted = self.resolve(p, false).map_err(|e| e.to_string()).and_then(|src| {
+                let bytes = read_input_bytes(&src).map_err(|e| format!("{}: {e}", src.display()))?;
+                let name = src.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+                let stem = src.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document".into());
+                let (kind, pdf) = self.session.convert_to_pdf(&name, &Arc::new(bytes)).map_err(|e| e.to_string())?;
+                Ok((kind, stem, pdf))
+            });
+            out.push(match converted {
+                Ok((pdfcraft_engine::SourceKind::Pdf, ..)) => json!({ "path": p, "skipped": "already a PDF" }),
+                Ok((_, stem, pdf)) => {
+                    let target = unused(&dir, &stem);
+                    write_atomic(&target, &pdf)?;
+                    json!({ "path": p, "output": target.to_string_lossy(), "bytes": pdf.len() })
+                }
+                Err(e) => json!({ "path": p, "error": e }),
+            });
+        }
+        Ok(json!({ "files": out }))
+    }
+
+    pub(crate) fn page_extract(&mut self, a: &Args) -> Result<Value> {
+        let doc = self.doc(a)?;
+        let (id, name) = (doc.id, format!("{} (extract)", doc.name));
+        let stem = Path::new(&doc.name).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| "page".into());
+        let pages = self.pages(a, "pages")?;
+        let mut out = if a.opt_bool("separate")?.unwrap_or(false) {
+            // Each page as its own file.
+            let dir = self.resolve(a.str("out_dir").map_err(|_| ToolError::InvalidArgs("separate files need out_dir".into()))?, true)?;
+            std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
+            let mut files = Vec::new();
+            for &p in &pages {
+                let bytes = self.session.extract(id, &[p]).map_err(failed)?;
+                let path = child(&dir, &format!("{stem}-page{}.pdf", p + 1));
+                write_atomic(&path, &bytes)?;
+                files.push(path.to_string_lossy().into_owned());
+            }
+            json!({ "files": files })
+        } else {
+            let bytes = self.session.extract(id, &pages).map_err(failed)?;
+            self.deliver(a, &name, bytes)?
+        };
+        if a.opt_bool("delete")?.unwrap_or(false) {
+            let deleted = self.apply(a, Edit::DeletePages { pages })?;
+            out["original"] = deleted;
+        }
+        Ok(out)
+    }
+
+    pub(crate) fn doc_combine(&mut self, a: &Args) -> Result<Value> {
+        let paths = a.strs("paths")?;
+        if paths.len() < 2 {
+            return Err(ToolError::InvalidArgs("combine needs at least two files".into()));
+        }
+        let ranges: Vec<Option<String>> = match a.get("pages") {
+            None | Some(Value::Null) => vec![None; paths.len()],
+            Some(Value::Array(v)) if v.len() == paths.len() => v
+                .iter()
+                .enumerate()
+                .map(|(index, value)| match value {
+                    Value::Null => Ok(None),
+                    Value::String(range) => Ok(Some(range.clone())),
+                    _ => Err(ToolError::InvalidArgs(format!("pages[{index}] must be a range string or null"))),
+                })
+                .collect::<Result<_>>()?,
+            Some(_) => return Err(ToolError::InvalidArgs("pages must list a range (or null) for each path".into())),
+        };
+        let passwords: Vec<Option<String>> = match a.get("passwords") {
+            None | Some(Value::Null) => vec![None; paths.len()],
+            Some(Value::Array(v)) if v.len() == paths.len() && v.iter().all(|x| x.is_string() || x.is_null()) => {
+                v.iter().map(|x| x.as_str().map(str::to_owned)).collect()
+            }
+            Some(_) => return Err(ToolError::InvalidArgs("passwords must list a password (or null) for each path".into())),
+        };
+        // Entries sharing a group number are one file split into parts placed apart.
+        let groups: Option<Vec<Option<u64>>> = match a.get("groups") {
+            None | Some(Value::Null) => None,
+            Some(Value::Array(v)) if v.len() == paths.len() && v.iter().all(|x| x.is_u64() || x.is_null()) => {
+                Some(v.iter().map(Value::as_u64).collect())
+            }
+            Some(_) => return Err(ToolError::InvalidArgs("groups must list a number (or null) for each path".into())),
+        };
+        let field_conflicts = match a.opt_str("field_conflicts")? {
+            None | Some("rename") => pdfcraft_organize::FieldConflicts::Rename,
+            Some("merge") => pdfcraft_organize::FieldConflicts::Merge,
+            Some(other) => {
+                return Err(ToolError::InvalidArgs(format!("field_conflicts must be \"rename\" or \"merge\", not {other:?}")));
+            }
+        };
+        let mut sources: Vec<CombineSource> = Vec::new();
+        let mut firsts: Vec<(u64, PathBuf, usize)> = Vec::new();
+        for (i, (p, range)) in paths.into_iter().zip(ranges).enumerate() {
+            let path = self.resolve(p, false)?;
+            let group = groups.as_ref().and_then(|g| g.get(i).copied().flatten());
+            let first = group.and_then(|g| firsts.iter().find(|f| f.0 == g));
+            let bytes = match first {
+                Some((g, first_path, at)) => {
+                    if *first_path != path {
+                        return Err(ToolError::InvalidArgs(format!("groups[{i}]: group {g} is {}, not {}", first_path.display(), path.display())));
+                    }
+                    sources.get(*at).map(|s| s.1.clone()).ok_or_else(|| failed("group source missing"))?
+                }
+                None => {
+                    if let Some(g) = group {
+                        firsts.push((g, path.clone(), sources.len()));
+                    }
+                    let bytes = Arc::new(read_input(&path)?);
+                    // Images and text files are made into PDFs first (#569), as in the Combine files tab.
+                    let file_name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+                    self.session.as_pdf(&file_name, &bytes).map_err(failed)?
+                }
+            };
+            let name = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+            sources.push((name, bytes, range));
+        }
+        let passwords: Vec<Option<&str>> = passwords.iter().map(Option::as_deref).collect();
+        let combined = match groups {
+            None => self.session.combine_unlocked_reporting(&sources, &passwords, field_conflicts),
+            Some(groups) => {
+                // A path without a group is a file of its own: give it a key no group uses.
+                let mut next = groups.iter().flatten().max().map_or(Some(0), |m| m.checked_add(1));
+                let mut keys = Vec::with_capacity(groups.len());
+                for g in &groups {
+                    keys.push(match g {
+                        Some(g) => *g,
+                        None => {
+                            let own = next.ok_or_else(|| ToolError::InvalidArgs("group numbers are too large".into()))?;
+                            next = own.checked_add(1);
+                            own
+                        }
+                    });
+                }
+                self.session.combine_grouped_reporting(&sources, &keys, &passwords, field_conflicts)
+            }
+        }
+        .map_err(failed)?;
+        let mut result = self.deliver(a, "Combined", combined.bytes)?;
+        if !combined.renamed_fields.is_empty() {
+            result["renamed_fields"] = json!(combined.renamed_fields.iter().map(|(old, new)| json!([old, new])).collect::<Vec<_>>());
+        }
+        Ok(result)
+    }
+
+    pub(crate) fn doc_split(&mut self, a: &Args) -> Result<Value> {
+        let doc = self.doc(a)?;
+        let id = doc.id;
+        let stem = Path::new(&doc.name).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| "part".into());
+        let bookmarks = a.opt_bool("bookmarks")?.unwrap_or(false);
+        let max_mb = a.opt_num("max_mb")?;
+        let chosen = [a.get("every").is_some(), a.get("before").is_some(), bookmarks, max_mb.is_some()].iter().filter(|x| **x).count();
+        if chosen != 1 {
+            return Err(ToolError::InvalidArgs(
+                "pass exactly one of every (pages per file), before (page numbers), bookmarks: true, or max_mb".into(),
+            ));
+        }
+        let mut titles: Vec<(usize, String)> = Vec::new();
+        let parts = if let Some(mb) = max_mb {
+            if !mb.is_finite() || mb <= 0.0 {
+                return Err(ToolError::InvalidArgs("max_mb must be positive".into()));
+            }
+            self.session.split_by_size(id, (mb * 1_048_576.0) as usize).map_err(failed)?
+        } else {
+            let by = match (a.opt_int("every")?, a.opt_ints("before")?) {
+                (Some(n), None) if n > 0 => pdfcraft_organize::SplitBy::PageCount(n as usize),
+                (None, Some(b)) => pdfcraft_organize::SplitBy::Before(one_based(&b)?),
+                _ if bookmarks => {
+                    titles = self.session.bookmark_splits(id);
+                    if titles.is_empty() {
+                        return Err(failed("the document has no top-level bookmarks"));
+                    }
+                    pdfcraft_organize::SplitBy::Before(titles.iter().map(|t| t.0).collect())
+                }
+                _ => return Err(ToolError::InvalidArgs("every must be a positive page count".into())),
+            };
+            self.session.split(id, &by).map_err(failed)?
+        };
+        let dir = self.resolve(a.str("out_dir")?, true)?;
+        std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
+        let mut files = Vec::new();
+        let mut used = std::collections::HashSet::new();
+        for (i, (first, last, bytes)) in parts.iter().enumerate() {
+            let safe = |t: &str| t.chars().map(|c| if c.is_alphanumeric() || " -_.,()".contains(c) { c } else { '_' }).collect::<String>();
+            let mut base = match titles.iter().find(|t| t.0 + 1 == *first) {
+                Some((_, t)) => format!("{stem}-{}", safe(t)),
+                None => format!("{stem}-part{}", i + 1),
+            };
+            // A file name is at most 255 bytes: keep the base to 200, cut between characters, which leaves room for ".pdf" and a -N suffix.
+            if let Some((end, _)) = base.char_indices().find(|(at, c)| at + c.len_utf8() > 200) {
+                base.truncate(end);
+            }
+            let file = format!("{base}.pdf");
+            // Equal titles (or titles that sanitize alike) get -2, -3, ... so no part overwrites another; compared case-insensitively.
+            let mut unique = file;
+            let mut n = 1;
+            while !used.insert(unique.to_lowercase()) {
+                n += 1;
+                unique = format!("{base}-{n}.pdf");
+            }
+            let path = child(&dir, &unique);
+            write_atomic(&path, bytes)?;
+            files.push(json!({ "path": path.to_string_lossy(), "first_page": first, "last_page": last }));
+        }
+        Ok(json!({ "files": files }))
+    }
+}
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index a29354f0b1..0150001096 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -3,6 +3,8 @@
 //! Geometry follows the automation convention: points from the top-left of the displayed page,
 //! y down. It is converted to PDF user space (crop box, `/Rotate`) here.
 
+use std::collections::HashMap;
+
 use pdfcraft_engine::{Edit, LineEnding, Markup, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, StampGroup, StampKind, Style, SummarySort};
 use pdfcraft_render::{Annotation, PageInfo};
 use serde_json::{Value, json};
@@ -152,8 +154,13 @@ impl Automation {
     fn comment_target(&self, a: &Args) -> Result<(usize, usize)> {
         let all = self.comments(a)?;
         if let Some(id) = a.opt_str("id")? {
-            let c =
-                all.iter().find(|c| c.name.as_deref() == Some(id)).ok_or_else(|| failed(format!("no comment with id {id:?} (see comment_list)")))?;
+            // `/NM` need not be unique (PyMuPDF names the first comment on every page `fitz-A0`):
+            // the first match could be another page's comment, so a shared id is refused.
+            let mut named = all.iter().filter(|c| c.name.as_deref() == Some(id));
+            let c = named.next().ok_or_else(|| failed(format!("no comment with id {id:?} (see comment_list)")))?;
+            if named.next().is_some() {
+                return Err(failed(format!("several comments have the id {id:?}: pass page and index instead (see comment_list)")));
+            }
             return Ok((c.page, c.index));
         }
         let (Some(page), Some(index)) = (a.opt_int("page")?, a.opt_int("index")?) else {
@@ -193,33 +200,44 @@ impl Automation {
             }
             v
         };
+        // Every reply under the comment its thread starts from, at any depth, in document order:
+        // a reply to a reply keeps its `/IRT` on the direct parent, so following one level would
+        // drop it. Parents are found by reference, as `/NM` need not be unique. A status or
+        // checkmark belongs to the annotation its `/IRT` names (ISO 32000-2 §12.5.6.2), as in the
+        // Comments panel: one set on a reply is not the comment's.
+        let tops = pdfcraft_render::thread_tops(&all);
+        let mut threads: HashMap<(usize, usize), Vec<&Annotation>> = HashMap::new();
+        for r in &all {
+            let Some(&top) = tops.get(&(r.page, r.index)) else { continue };
+            let key = match r.parent {
+                Some(parent) if r.state.is_some() => parent,
+                _ => top,
+            };
+            threads.entry(key).or_default().push(r);
+        }
+        // An annotation's review status and checkmark: the latest of each set on it.
+        let states = |c: &Annotation, v: &mut Value| {
+            let set = threads.get(&(c.page, c.index)).map(Vec::as_slice).unwrap_or(&[]);
+            v["status"] = json!(set.iter().rev().filter(|r| !r.is_mark()).find_map(|r| r.state.clone()));
+            v["marked"] = json!(set.iter().rev().find(|r| r.is_mark()).is_some_and(|r| r.state.as_deref() == Some("Marked")));
+        };
         let roots: Vec<Value> = all
             .iter()
-            .filter(|c| c.in_reply_to.is_none() && only.is_none_or(|p| c.page == p))
+            .filter(|c| c.is_comment() && only.is_none_or(|p| c.page == p))
             .map(|c| {
                 let mut v = view(c);
-                // Every reply under this comment, at any depth, in document order. A reply to a
-                // reply keeps its `/IRT` on the direct parent, so following one level would drop it.
-                let descends_from = |r: &Annotation, root: &str| -> bool {
-                    let mut parent = r.in_reply_to.as_deref();
-                    for _ in 0..64 {
-                        let Some(nm) = parent else { return false };
-                        if nm == root {
-                            return true;
-                        }
-                        parent = all.iter().find(|x| x.name.as_deref() == Some(nm)).and_then(|x| x.in_reply_to.as_deref());
-                    }
-                    false
-                };
-                let thread: Vec<&Annotation> = match c.name.as_deref() {
-                    Some(nm) => all.iter().filter(|r| r.in_reply_to.is_some() && descends_from(r, nm)).collect(),
-                    None => Vec::new(),
-                };
-                let status = thread.iter().rev().filter(|r| !r.is_mark()).find_map(|r| r.state.clone());
-                v["status"] = json!(status);
-                v["marked"] = json!(thread.iter().rev().find(|r| r.is_mark()).is_some_and(|r| r.state.as_deref() == Some("Marked")));
+                states(c, &mut v);
                 v["locked"] = json!(c.locked);
-                v["replies"] = thread.iter().filter(|r| r.state.is_none()).map(|r| view(r)).collect();
+                let thread = threads.get(&(c.page, c.index)).map(Vec::as_slice).unwrap_or(&[]);
+                v["replies"] = thread
+                    .iter()
+                    .filter(|r| r.state.is_none())
+                    .map(|r| {
+                        let mut reply = view(r);
+                        states(r, &mut reply);
+                        reply
+                    })
+                    .collect();
                 v
             })
             .collect();
diff --git a/crates/automation/src/content.rs b/crates/automation/src/content.rs
index d0b0b69fd2..c860298d98 100644
--- a/crates/automation/src/content.rs
+++ b/crates/automation/src/content.rs
@@ -188,8 +188,10 @@ impl Automation {
                     i.flip_v = !i.flip_v;
                 }
                 if let Some(c) = rect_arg(a, "crop")? {
-                    if !c.iter().all(|v| (0.0..0.5).contains(v)) {
-                        return Err(bad("crop takes fractions from 0 to under 0.5 (left, bottom, right, top)"));
+                    if !pdfcraft_engine::AddedImage::crop_valid(c) {
+                        return Err(bad(
+                            "crop takes fractions from 0 to under 1 (left, bottom, right, top); left and right together, and bottom and top together, trim at most 0.95",
+                        ));
                     }
                     i.crop = c;
                 }
diff --git a/crates/automation/src/dispatch.rs b/crates/automation/src/dispatch.rs
new file mode 100644
index 0000000000..26e1f95365
--- /dev/null
+++ b/crates/automation/src/dispatch.rs
@@ -0,0 +1,784 @@
+use super::error::{Result, ToolError, failed};
+use super::json::{Args, document_attachment_keys, info, one_based, parse_style_ranges, security, summary};
+use super::paths::{read_input, write_atomic};
+use super::*;
+
+/// One piece of a tool's result.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Content {
+    /// Structured data (MCP: a text block with the JSON plus `structuredContent`).
+    Json(Value),
+    /// A PNG image.
+    Png { data: Vec<u8>, width: u32, height: u32 },
+}
+
+impl Automation {
+    /// Run the tool `name` with JSON `args` (an object; `null` means no arguments).
+    pub fn call(&mut self, name: &str, args: &Value) -> Result<Vec<Content>> {
+        let empty = json!({});
+        let args = if args.is_null() { &empty } else { args };
+        if !args.is_object() {
+            return Err(ToolError::InvalidArgs("arguments must be a JSON object".into()));
+        }
+        let def = tools::find(name).ok_or_else(|| ToolError::UnknownTool(name.into()))?;
+        tools::check_args(def, args)?;
+        let a = Args(args);
+        let out = match name {
+            "doc_open" => self.doc_open(&a)?,
+            "doc_batch" => self.doc_batch(&a)?,
+            "doc_list" => json!({ "documents": self.session.docs().iter().map(summary).collect::<Vec<_>>() }),
+            "doc_info" => {
+                let id = self.doc(&a)?.id;
+                self.session.refresh_fonts(id);
+                info(self.doc(&a)?)
+            }
+            "doc_close" => self.doc_close(&a)?,
+            "doc_save" => self.doc_save(&a)?,
+            "doc_set_info" => {
+                let edit = Edit::SetInfo { key: a.str("key")?.into(), value: a.str("value")?.into() };
+                self.apply(&a, edit)?
+            }
+            "page_render" => return self.page_render(&a).map(|c| vec![c]),
+            "comment_image_preview" => return self.comment_image_preview(&a),
+            "text_extract" => self.text_extract(&a)?,
+            "text_word_count" => self.text_word_count(&a)?,
+            "text_find" => self.text_find(&a)?,
+            "page_rotate" => {
+                let degrees = a.int("degrees")?;
+                if degrees % 90 != 0 {
+                    return Err(ToolError::InvalidArgs("degrees must be a multiple of 90".into()));
+                }
+                let doc = self.doc(&a)?;
+                let base = match a.opt_ints("pages")? {
+                    Some(_) => self.pages(&a, "pages")?,
+                    None => (0..doc.info.pages.len()).collect(),
+                };
+                let parity = match a.opt_str("subset")?.unwrap_or("all") {
+                    "all" => pdfcraft_engine::PageParity::Both,
+                    "even" => pdfcraft_engine::PageParity::Even,
+                    "odd" => pdfcraft_engine::PageParity::Odd,
+                    s => return Err(ToolError::InvalidArgs(format!("unknown subset {s:?} (all, even, odd)"))),
+                };
+                let orientation = match a.opt_str("orientation")?.unwrap_or("all") {
+                    "all" => pdfcraft_engine::PageOrientation::Both,
+                    "landscape" => pdfcraft_engine::PageOrientation::Landscape,
+                    "portrait" => pdfcraft_engine::PageOrientation::Portrait,
+                    o => return Err(ToolError::InvalidArgs(format!("unknown orientation {o:?} (all, landscape, portrait)"))),
+                };
+                let pages = pdfcraft_engine::filter_pages(&self.doc(&a)?.info, &base, parity, orientation);
+                if pages.is_empty() {
+                    return Err(failed("no pages match the filters"));
+                }
+                let n = pages.len();
+                let mut out = self.apply(&a, Edit::RotatePages { pages, degrees })?;
+                out["rotated"] = json!(n);
+                out
+            }
+            "page_enhance_camera" => {
+                let page = self.page(&a)?;
+                let given = a.nums::<8>("corners")?;
+                let doc = self.doc(&a)?;
+                let (id, info) = (doc.id, doc.info.pages.get(page).cloned().ok_or_else(|| failed("no such page"))?);
+                let corners = match given {
+                    Some(c) => [0, 1, 2, 3].map(|i| {
+                        let [x, y] = info.view_to_user(c[2 * i] as f32, c[2 * i + 1] as f32);
+                        [x as f64, y as f64]
+                    }),
+                    None => self.session.detect_camera_corners(id, page).ok_or_else(|| {
+                        failed("the document's edges could not be found on this page: pass `corners` [x1, y1, x2, y2, x3, y3, x4, y4]")
+                    })?,
+                };
+                let level = match a.opt_int("level")? {
+                    None => 0,
+                    Some(l @ 0..=100) => l as u8,
+                    Some(l) => return Err(ToolError::InvalidArgs(format!("level must be between 0 and 100, not {l}"))),
+                };
+                let look = match a.opt_str("mode")? {
+                    None => pdfcraft_engine::camera_clean::Look::Colour,
+                    Some(m) => pdfcraft_engine::camera_clean::Look::from_name(m)
+                        .ok_or_else(|| ToolError::InvalidArgs(format!("unknown mode {m:?} (original, colour, greyscale, bw)")))?,
+                };
+                self.session.enhance_camera_page_at(id, page, corners, look, level).map_err(failed)?;
+                let r = |v: f32| (v * 100.0).round() / 100.0;
+                let used: Vec<f32> = corners.iter().flat_map(|&[x, y]| info.user_to_view(x as f32, y as f32)).map(r).collect();
+                let mut out = summary(self.doc(&a)?);
+                out["corners"] = json!(used);
+                out["detected"] = json!(given.is_none());
+                out
+            }
+            "page_delete" => {
+                let pages = self.pages(&a, "pages")?;
+                self.apply(&a, Edit::DeletePages { pages })?
+            }
+            "page_move" => {
+                let pages = self.pages(&a, "pages")?;
+                let to = self.position(&a, "to")?;
+                self.apply(&a, Edit::MovePages { pages, to })?
+            }
+            "page_reverse" => {
+                let pages = match a.opt_ints("pages")? {
+                    Some(_) => self.pages(&a, "pages")?,
+                    None => (0..self.doc(&a)?.info.pages.len()).collect(),
+                };
+                self.apply(&a, Edit::ReversePages { pages })?
+            }
+            "page_insert_blank" => self.insert_blank(&a)?,
+            "page_insert_file" => self.insert_file(&a)?,
+            "page_extract" => self.page_extract(&a)?,
+            "doc_combine" => self.doc_combine(&a)?,
+            "doc_create_multiple" => self.doc_create_multiple(&a)?,
+            "doc_split" => self.doc_split(&a)?,
+            "edit_undo" => {
+                let id = self.doc(&a)?.id;
+                let label = self.session.undo(id).map_err(failed)?.to_string();
+                json!({ "undone": label, "document": summary(self.doc(&a)?) })
+            }
+            "edit_redo" => {
+                let id = self.doc(&a)?.id;
+                let label = self.session.redo(id).map_err(failed)?.to_string();
+                json!({ "redone": label, "document": summary(self.doc(&a)?) })
+            }
+            "command_list" => self.command_list(&a)?,
+            "command_run" => return self.command_run(&a),
+            "command_batch" => self.command_batch(&a)?,
+            "doc_inspect" => self.doc_inspect(&a)?,
+            "render_preview" => return self.render_preview(&a).map(|c| vec![c]),
+            "page_number" => {
+                use pdfcraft_organize::LabelStyle as L;
+                let n = self.doc(&a)?.info.pages.len();
+                let (from, to) = (a.int("from")?, a.int("to")?);
+                if from < 1 || to < from || to as usize > n {
+                    return Err(ToolError::InvalidArgs(format!("from and to must satisfy 1 ≤ from ≤ to ≤ {n}")));
+                }
+                let style = match a.opt_str("style")?.unwrap_or("decimal") {
+                    "decimal" => L::Decimal,
+                    "upper-roman" => L::UpperRoman,
+                    "lower-roman" => L::LowerRoman,
+                    "upper-alpha" => L::UpperAlpha,
+                    "lower-alpha" => L::LowerAlpha,
+                    "none" => L::None,
+                    other => return Err(ToolError::InvalidArgs(format!("unknown style {other:?}"))),
+                };
+                let prefix = a.opt_str("prefix")?.unwrap_or_default().to_string();
+                let first = a.opt_int("start")?.unwrap_or(1).clamp(1, u32::MAX as i64) as u32;
+                let mut out = self.apply(&a, Edit::NumberPages { from: from as usize - 1, to: to as usize - 1, style, prefix, first })?;
+                out["labels"] = json!(self.doc(&a)?.info.pages.iter().map(|p| p.label.clone()).collect::<Vec<_>>());
+                out
+            }
+            "bookmark_list" => self.bookmark_listing(&a)?,
+            "bookmark_add" => {
+                let page = self.page(&a)?;
+                let parent = a.opt_path("parent")?.unwrap_or_default();
+                let index = a.opt_int("position")?.map_or(usize::MAX, |p| (p.max(1) - 1) as usize);
+                let title = a.str("title")?.to_string();
+                let (left, top) = (a.bookmark_coordinate("left")?, a.bookmark_coordinate("top")?);
+                let [left, top] = match self.doc(&a)?.info.pages.get(page) {
+                    Some(p) => p.xyz_for_view(left, top),
+                    None => [None, None],
+                };
+                let (left, top) = (left.map(f64::from), top.map(f64::from));
+                self.apply(&a, Edit::AddBookmark { parent, index, title, page, left, top })?
+            }
+            "bookmark_rename" => {
+                let (path, title) = (a.path("path")?, a.str("title")?.to_string());
+                self.apply(&a, Edit::RenameBookmark { path, title })?
+            }
+            "bookmark_delete" => {
+                let path = a.path("path")?;
+                self.apply(&a, Edit::DeleteBookmark { path })?
+            }
+            "bookmark_move" => {
+                let from = a.path("path")?;
+                let to_parent = a.opt_path("parent")?.unwrap_or_default();
+                let index = a.opt_int("position")?.map_or(usize::MAX, |p| (p.max(1) - 1) as usize);
+                self.apply(&a, Edit::MoveBookmark { from, to_parent, index })?
+            }
+            "bookmark_set_page" => {
+                let (path, page) = (a.path("path")?, self.page(&a)?);
+                self.apply(&a, Edit::SetBookmarkPage { path, page })?
+            }
+            "bookmark_set_style" => {
+                let path = a.path("path")?;
+                // Left out keeps the colour; [0, 0, 0] is the default black.
+                let color = match a.get("color") {
+                    None => None,
+                    Some(v) => {
+                        let rgb: Option<Vec<f64>> = v.as_array().and_then(|c| c.iter().map(Value::as_f64).collect());
+                        match rgb.as_deref() {
+                            Some(&[r, g, b]) if [r, g, b].iter().all(|c| (0.0..=1.0).contains(c)) => Some([r, g, b]),
+                            _ => return Err(ToolError::InvalidArgs("color must be [r, g, b], each from 0 to 1".into())),
+                        }
+                    }
+                };
+                let (bold, italic) = (a.opt_bool("bold")?, a.opt_bool("italic")?);
+                if color.is_none() && bold.is_none() && italic.is_none() {
+                    return Err(ToolError::InvalidArgs("give color, bold or italic".into()));
+                }
+                let mut edits = Vec::new();
+                if let Some(color) = color {
+                    edits.push(Edit::SetBookmarkColor { path: path.clone(), color: Some(color) });
+                }
+                if bold.is_some() || italic.is_some() {
+                    edits.push(Edit::SetBookmarkStyle { path, bold, italic });
+                }
+                // A colour and a style given together are one step to undo, applied all or nothing.
+                match edits.len() {
+                    1 => self.apply(&a, edits.remove(0))?,
+                    _ => self.apply(&a, Edit::Batch { label: "Style".into(), edits })?,
+                }
+            }
+            "bookmark_from_structure" => {
+                let mut out = self.apply(&a, Edit::BookmarksFromStructure)?;
+                let listing = self.bookmark_listing(&a)?;
+                out["bookmarks"] = listing["bookmarks"].clone();
+                out["next"] = listing["next"].clone();
+                out
+            }
+            "doc_protect" => self.doc_protect(&a)?,
+            "page_replace" => {
+                let pages = self.pages(&a, "pages")?;
+                let path = self.resolve(a.str("path")?, false)?;
+                let bytes = Arc::new(read_input(&path)?);
+                let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+                let src_pages = match a.opt_ints("from_pages")? {
+                    Some(p) => one_based(&p)?,
+                    None => (0..pages.len()).collect(),
+                };
+                self.apply(&a, Edit::ReplacePages { pages, name, bytes, src_pages })?
+            }
+            "page_duplicate" => {
+                let pages = self.pages(&a, "pages")?;
+                let at = self.opt_position(&a, "at")?;
+                self.apply(&a, Edit::DuplicatePages { pages, at })?
+            }
+            "page_set_box" => self.page_set_box(&a)?,
+            "page_transition_set" => self.page_transition_set(&a)?,
+            "doc_create" => self.doc_create(&a)?,
+            "xfa_to_static" => self.apply(&a, Edit::XfaToStatic)?,
+            "doc_flatten" => {
+                let (comments, fields) = (a.opt_bool("comments")?.unwrap_or(true), a.opt_bool("fields")?.unwrap_or(true));
+                if !comments && !fields {
+                    return Err(ToolError::InvalidArgs("nothing to flatten".into()));
+                }
+                self.apply(&a, Edit::Flatten { comments, fields })?
+            }
+            "doc_reduce" => {
+                let id = self.doc(&a)?.id;
+                let before = self.doc(&a)?.bytes.len();
+                let path = self.resolve(a.str("path")?, true)?;
+                let (bytes, merged) = self.session.reduced_bytes(id).map_err(failed)?;
+                // As in the app, a copy that isn't smaller is not written (#490).
+                let written = bytes.len() < before;
+                if written {
+                    write_atomic(&path, &bytes)?;
+                }
+                json!({ "path": path.to_string_lossy(), "written": written, "bytes_before": before, "bytes_after": bytes.len(), "merged_objects": merged })
+            }
+            "doc_optimize" => self.doc_optimize(&a)?,
+            "doc_initial_view" => self.doc_initial_view(&a)?,
+            "doc_revisions" => self.doc_revisions(&a)?,
+            "text_lines" => {
+                let page = self.page(&a)?;
+                let doc = self.doc_to_copy(&a)?;
+                let info = &doc.info.pages[page];
+                let r = |x: f32| (x as f64 * 100.0).round() / 100.0;
+                let lines: Vec<Value> = doc
+                    .text_lines(page)
+                    .iter()
+                    .enumerate()
+                    .map(|(i, l)| {
+                        let (u, v) = (info.user_to_view(l.rect[0] as f32, l.rect[1] as f32), info.user_to_view(l.rect[2] as f32, l.rect[3] as f32));
+                        json!({
+                            "line": i + 1,
+                            "text": l.text,
+                            "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))],
+                            "font": l.base_font,
+                            "size": (l.size * 100.0).round() / 100.0,
+                        })
+                    })
+                    .collect();
+                json!({ "page": page + 1, "count": lines.len(), "lines": lines })
+            }
+            "image_hit" => {
+                let page = self.page(&a)?;
+                let point = a
+                    .get("point")
+                    .and_then(Value::as_array)
+                    .filter(|p| p.len() == 2)
+                    .and_then(|p| Some([p.first()?.as_f64()?, p.get(1)?.as_f64()?]))
+                    .filter(|p| p.iter().all(|v| v.is_finite() && v.abs() <= 1e9))
+                    .ok_or_else(|| ToolError::InvalidArgs("point must contain two finite coordinates".into()))?;
+                let doc = self.doc(&a)?;
+                let p = &doc.info.pages[page];
+                let user = p.view_to_user(point[0] as f32, point[1] as f32).map(f64::from);
+                let images: Vec<_> = doc.page_images(page).iter().enumerate().filter(|(_, im)| im.contains(user)).map(|(i, _)| i + 1).collect();
+                json!({"page":page+1,"images":images})
+            }
+            "page_images" => {
+                let page = self.page(&a)?;
+                let doc = self.doc(&a)?;
+                let info = &doc.info.pages[page];
+                let r = |x: f32| (x as f64 * 100.0).round() / 100.0;
+                let list: Vec<Value> = doc
+                    .page_images(page)
+                    .iter()
+                    .enumerate()
+                    .map(|(i, im)| {
+                        let (u, v) = (info.user_to_view(im.rect[0] as f32, im.rect[1] as f32), info.user_to_view(im.rect[2] as f32, im.rect[3] as f32));
+                        let visible = im.visible_rect.map(|rect| {
+                            let (u, v) = (info.user_to_view(rect[0] as f32, rect[1] as f32), info.user_to_view(rect[2] as f32, rect[3] as f32));
+                            [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))]
+                        });
+                        json!({ "visible_rect": visible, "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
+                    })
+                    .collect();
+                json!({ "page": page + 1, "count": list.len(), "images": list })
+            }
+            "image_edit" | "image_save" => {
+                let page = self.page(&a)?;
+                let n = self.doc(&a)?.page_images(page).len();
+                let k = a.int("image")?;
+                if k < 1 || k as usize > n {
+                    return Err(ToolError::InvalidArgs(format!("image {k} is out of range: page {} has {n} images", page + 1)));
+                }
+                let index = k as usize - 1;
+                if name == "image_save" {
+                    let (ext, bytes) = self.doc(&a)?.page_image_file(page, index).map_err(failed)?;
+                    let mut path = self.resolve(a.str("path")?, true)?;
+                    if path.is_dir() {
+                        // Adding the extension to a folder's name would write beside it: "." is the
+                        // root, so that would land outside it.
+                        return Err(failed(format!("{}: is a folder, not a file", path.display())));
+                    }
+                    if path.extension().is_none() {
+                        path.set_extension(ext);
+                    }
+                    write_atomic(&path, &bytes)?;
+                    json!({ "path": path.to_string_lossy(), "format": ext, "bytes": bytes.len() })
+                } else {
+                    use pdfcraft_engine::ImageEdit;
+                    let change = match a.str("action")? {
+                        "move" => {
+                            let r: Vec<f64> =
+                                a.get("rect").and_then(Value::as_array).map(|x| x.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
+                            let r = <[f64; 4]>::try_from(r).map_err(|_| ToolError::InvalidArgs("move needs rect: 4 numbers".into()))?;
+                            // Top-left-origin points → user space.
+                            let info = &self.doc(&a)?.info.pages[page];
+                            let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
+                            ImageEdit::Move([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
+                        }
+                        "rotate_by" => ImageEdit::RotateBy(
+                            a.get("degrees")
+                                .and_then(Value::as_f64)
+                                .ok_or_else(|| ToolError::InvalidArgs("rotate_by needs degrees: a number (clockwise)".into()))?,
+                        ),
+                        "rotate" => ImageEdit::Rotate(a.opt_int("quarters")?.unwrap_or(1) as i32),
+                        "crop" => {
+                            let r: Vec<f64> =
+                                a.get("rect").and_then(Value::as_array).map(|x| x.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
+                            let r =
+                                <[f64; 4]>::try_from(r).map_err(|_| ToolError::InvalidArgs("crop needs rect: 4 numbers, the part to keep".into()))?;
+                            let info = &self.doc(&a)?.info.pages[page];
+                            let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
+                            ImageEdit::Crop([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
+                        }
+                        "flip_horizontal" => ImageEdit::Flip { horizontal: true },
+                        "flip_vertical" => ImageEdit::Flip { horizontal: false },
+                        "delete" => ImageEdit::Delete,
+                        "replace" => {
+                            let path = self.resolve(a.str("path")?, false)?;
+                            let bytes = read_input(&path)?;
+                            ImageEdit::Replace {
+                                name: path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(),
+                                bytes: Arc::new(bytes),
+                            }
+                        }
+                        other => return Err(ToolError::InvalidArgs(format!("unknown action {other:?}"))),
+                    };
+                    self.apply(&a, Edit::EditPageImage { page, index, change })?
+                }
+            }
+            "text_paragraphs" => {
+                let page = self.page(&a)?;
+                let doc = self.doc_to_copy(&a)?;
+                let info = &doc.info.pages[page];
+                let r = |x: f32| (x as f64 * 100.0).round() / 100.0;
+                let current = doc.text_blocks(page);
+                let id = doc.id;
+                let blocks: Vec<Value> = current
+                    .iter()
+                    .enumerate()
+                    .map(|(i, b)| {
+                        let (u, v) = (info.user_to_view(b.rect[0] as f32, b.rect[1] as f32), info.user_to_view(b.rect[2] as f32, b.rect[3] as f32));
+                        json!({
+                            "paragraph": i + 1,
+                            "text": b.text,
+                            "editor_text": b.editor_text,
+                            "rows": b.rows.iter().map(|row| row.iter().map(|i| i + 1).collect::<Vec<_>>()).collect::<Vec<_>>(),
+                            "lines": b.lines.iter().map(|l| l + 1).collect::<Vec<_>>(),
+                            "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))],
+                            "font": b.base_font,
+                            "size": (b.size * 100.0).round() / 100.0,
+                        })
+                    })
+                    .collect();
+                self.record_listing(id, page, &current);
+                json!({ "page": page + 1, "count": blocks.len(), "paragraphs": blocks })
+            }
+            "text_font_files" => {
+                let roots = if let Some(paths) = a.get("directories") {
+                    let paths = paths
+                        .as_array()
+                        .filter(|p| p.len() <= 16)
+                        .ok_or_else(|| ToolError::InvalidArgs("directories must be at most 16 paths".into()))?;
+                    paths
+                        .iter()
+                        .map(|p| self.resolve(p.as_str().ok_or_else(|| ToolError::InvalidArgs("directory must be a path".into()))?, false))
+                        .collect::<Result<Vec<_>>>()?
+                } else if let Some(roots) = &self.roots {
+                    // The installed fonts are outside the roots: look in the read root instead.
+                    let read = roots
+                        .read_root()
+                        .ok_or_else(|| failed("automation filesystem access is not granted: read authority is absent: installed fonts"))?;
+                    vec![self.resolve(&read.to_string_lossy(), false)?]
+                } else if let Some(root) = &self.root {
+                    vec![root.clone()]
+                } else {
+                    pdfcraft_engine::text_fonts::installed_directories()
+                };
+                json!({"fonts": pdfcraft_engine::text_fonts::discover(&roots).into_iter().map(|f| json!({"path":f.path,"family":f.family,"font":f.face})).collect::<Vec<_>>()})
+            }
+            "text_font_import" => {
+                let page = self.page(&a)?;
+                let path = self.resolve(a.str("path")?, false)?;
+                let file = std::fs::File::open(&path).map_err(failed)?;
+                use std::io::Read;
+                let mut bytes = Vec::new();
+                file.take((16 << 20) + 1).read_to_end(&mut bytes).map_err(failed)?;
+                if bytes.len() > 16 << 20 {
+                    return Err(ToolError::InvalidArgs("font input exceeds 16 MiB".into()));
+                }
+                let before: Vec<_> = self.doc(&a)?.text_editor_fonts(page).into_iter().map(|f| f.resource).collect();
+                let mut out = self.apply(&a, Edit::RegisterTextFont { page, bytes: Arc::new(bytes) })?;
+                let added = self
+                    .doc(&a)?
+                    .text_editor_fonts(page)
+                    .into_iter()
+                    .find(|f| !before.contains(&f.resource) && !f.resource.starts_with("PCApproved"));
+                if let Some(f) = added {
+                    out["resource"] = json!(f.resource);
+                    out["font"] = json!(f.face);
+                }
+                out
+            }
+            "text_fonts" => {
+                let page = self.page(&a)?;
+                json!({"fonts": self.doc(&a)?.text_editor_fonts(page).into_iter().map(|f| json!({"resource":f.resource,"font":f.face,"full_face":f.resource.starts_with("PCFull"),"preview_only":f.resource.starts_with("PCApproved")})).collect::<Vec<_>>()})
+            }
+            "text_edit_layout" => {
+                let page = self.page(&a)?;
+                let doc = self.doc(&a)?;
+                let k = a.int("paragraph")?;
+                let blocks = doc.text_blocks(page);
+                let index = self.paragraph_index(doc.id, page, k, &blocks)?;
+                let source = blocks.get(index).ok_or_else(|| ToolError::InvalidArgs("paragraph is out of range".into()))?;
+                let text = a.opt_str("text")?.unwrap_or(&source.editor_text);
+                let style = pdfcraft_engine::BlockStyle {
+                    size: a.opt_num("size")?,
+                    width: a.opt_num("width")?,
+                    resource: a.opt_str("font_resource")?.map(str::to_owned),
+                    ranges: parse_style_ranges(a.get("ranges"))?,
+                    ..Default::default()
+                };
+                let layout = doc.text_edit_layout(page, index, text, &style).map_err(failed)?;
+                let info = &doc.info.pages[page];
+                let view_rect = |r: [f64; 4]| {
+                    let a = info.user_to_view(r[0] as f32, r[1] as f32);
+                    let b = info.user_to_view(r[2] as f32, r[3] as f32);
+                    [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
+                };
+                let fonts: Vec<_> = doc.text_editor_fonts(page).into_iter().map(|f| json!({"resource": f.resource, "face": f.face})).collect();
+                json!({ "page": page + 1, "paragraph": k, "source_rect": view_rect(layout.source_rect),
+                    "draft_rect": layout.draft_rect.map(view_rect), "overflow": layout.overflow, "embedded_fonts": fonts })
+            }
+            "text_edit" if a.get("paragraph").is_some() => {
+                let page = self.page(&a)?;
+                let k = a.int("paragraph")?;
+                let (id, blocks) = {
+                    let doc = self.doc(&a)?;
+                    (doc.id, doc.text_blocks(page))
+                };
+                let index = self.paragraph_index(id, page, k, &blocks)?;
+                let block = blocks.get(index).cloned().ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range")))?;
+                let text = a.opt_str("text")?.map(str::to_owned).unwrap_or(block.text);
+                let mut style = pdfcraft_engine::BlockStyle {
+                    ranges: parse_style_ranges(a.get("ranges"))?,
+                    resource: a.opt_str("font_resource")?.map(str::to_owned),
+                    bold: a.opt_bool("bold")?,
+                    size: a.opt_num("size")?,
+                    underline: a.opt_bool("underline")?,
+                    line_spacing: a.opt_num("line_spacing")?,
+                    char_spacing: a.opt_num("char_spacing")?,
+                    scale: a.opt_num("scale")?,
+                    width: a.opt_num("width")?,
+                    ..Default::default()
+                };
+                let (dx, dy) = (a.opt_num("dx")?, a.opt_num("dy")?);
+                if dx.is_some() || dy.is_some() {
+                    style.offset = Some([dx.unwrap_or(0.0), dy.unwrap_or(0.0)]);
+                }
+                if let Some(f) = a.opt_str("font")? {
+                    let family = match f {
+                        "helvetica" => pdfcraft_engine::FontFamily::Helvetica,
+                        "times" => pdfcraft_engine::FontFamily::Times,
+                        "courier" => pdfcraft_engine::FontFamily::Courier,
+                        other => return Err(ToolError::InvalidArgs(format!("unknown font {other:?} (helvetica, times, courier)"))),
+                    };
+                    style.family = Some((family, a.opt_bool("bold")?.unwrap_or(false), a.opt_bool("italic")?.unwrap_or(false)));
+                }
+                if let Some(c) = a.opt_str("color")? {
+                    style.color = Some(comments::parse_color(c)?);
+                }
+                if let Some(al) = a.opt_str("align")? {
+                    style.align = Some(match al {
+                        "left" => pdfcraft_engine::TextAlign::Left,
+                        "center" => pdfcraft_engine::TextAlign::Center,
+                        "right" => pdfcraft_engine::TextAlign::Right,
+                        "justify" => pdfcraft_engine::TextAlign::Justify,
+                        other => return Err(ToolError::InvalidArgs(format!("unknown align {other:?}"))),
+                    });
+                }
+                // Where the paragraph is drawn after the edit: moved by dx, dy (up is +dy).
+                let [dx, dy] = style.offset.unwrap_or([0.0, 0.0]);
+                let moved = [block.rect[0] + dx, block.rect[1] + dy, block.rect[2] + dx, block.rect[3] + dy];
+                let wanted: String = text.split_whitespace().collect();
+                let mut out = self.apply(&a, Edit::EditTextBlock { page, block: index, text, style })?;
+                let doc = self.doc(&a)?;
+                let after = doc.text_blocks(page);
+                // Without `text` the paragraph keeps the document's own words: not echoed when
+                // the document doesn't allow copying them.
+                let copy = doc.allows_copying();
+                // Only a paragraph that now shows exactly the requested text is the edited one. A
+                // neighbour that overlaps the old box (overlaid text, a text layer) must not take
+                // its number, and neither must a paragraph the edit merged it into: rewriting that
+                // one by this number would drop the neighbour's text.
+                let edited = block_overlapping(&after, moved)
+                    .filter(|&i| !wanted.is_empty() && after.get(i).is_some_and(|b| b.text.split_whitespace().collect::<String>() == wanted));
+                if let Some(b) = edited.and_then(|i| after.get(i)) {
+                    out["paragraph"] = json!({ "lines": b.lines.len(), "font": b.base_font });
+                    if copy {
+                        out["paragraph"]["text"] = json!(b.text);
+                    }
+                }
+                let stale = self.follow_edit(id, page, k, edited.and_then(|i| after.get(i)), &after);
+                if !stale.is_empty() {
+                    out["stale_paragraphs"] = json!(stale);
+                }
+                out
+            }
+            "text_edit" => {
+                let page = self.page(&a)?;
+                let n = self.doc(&a)?.text_lines(page).len();
+                let line = a.int("line")?;
+                if line < 1 || line as usize > n {
+                    return Err(ToolError::InvalidArgs(format!("line {line} is out of range: page {} has {n} lines", page + 1)));
+                }
+                let text = a.str("text")?.to_owned();
+                let mut out = self.apply(&a, Edit::EditTextLine { page, line: line as usize - 1, text })?;
+                let after = self.doc(&a)?.text_lines(page);
+                if let Some(l) = after.get(line as usize - 1) {
+                    out["line"] = json!({ "text": l.text, "font": l.base_font });
+                }
+                out
+            }
+            "doc_audit_space" => {
+                let rows: Vec<Value> = self
+                    .doc(&a)?
+                    .audit_space()
+                    .iter()
+                    .map(|u| json!({ "category": u.category.label(), "bytes": u.bytes, "percent": (u.percent * 100.0).round() / 100.0 }))
+                    .collect();
+                json!({ "categories": rows })
+            }
+            "doc_open_revision" => {
+                let id = self.doc(&a)?.id;
+                let n = usize::try_from(a.opt_int("revision")?.ok_or_else(|| ToolError::InvalidArgs("revision is required".into()))?).unwrap_or(0);
+                let new = self.session.open_revision(id, n).map_err(failed)?;
+                summary(self.session.get(new).ok_or_else(|| failed("the document vanished"))?)
+            }
+            "doc_export_images" | "doc_export_text" | "doc_export_all_images" => self.export(name, &a)?,
+            "doc_header_footer" | "doc_watermark" | "doc_background" | "doc_remove_marks" => self.marks(name, &a)?,
+            "doc_unprotect" => {
+                let mut out = self.apply(&a, Edit::RemoveProtection)?;
+                out["security"] = security(self.doc(&a)?);
+                out
+            }
+            "form_fields" => self.form_fields(&a)?,
+            "form_fill" => self.form_fill(&a)?,
+            "form_set_image" => {
+                let path = self.resolve(a.str("path")?, false)?;
+                let bytes = read_input(&path)?;
+                self.apply(&a, Edit::SetFieldImage { name: a.str("field")?.to_owned(), image: Arc::new(bytes) })?
+            }
+            "form_reset" => self.form_reset(&a)?,
+            "form_add_field" => self.form_add_field(&a)?,
+            "form_add_field_table" => self.form_add_field_table(&a)?,
+            "form_set_props" => self.form_set_props(&a)?,
+            "form_delete_field" => self.form_delete_field(&a)?,
+            "form_tab_order" => self.form_tab_order(&a)?,
+            "form_calculation_order" => self.form_calculation_order(&a)?,
+            "doc_export_data" => self.doc_export_data(&a)?,
+            "doc_import_data" => self.doc_import_data(&a)?,
+            "redact_mark" => self.redact_mark(&a)?,
+            "redact_apply" => self.redact_apply(&a)?,
+            "redact_clear" => self.redact_clear(&a)?,
+            "doc_hidden_info" => self.doc_hidden_info(&a)?,
+            "printers" => self.printers()?,
+            "printer_options" => self.printer_options(&a)?,
+            "link_list" => self.link_list(&a)?,
+            "link_open" => self.link_open(&a)?,
+            "link_add" => self.link_add(&a)?,
+            "link_edit" => self.link_edit(&a)?,
+            "link_delete" => self.link_delete(&a)?,
+            "links_from_urls" => self.links_from_urls(&a)?,
+            "links_remove" => self.links_remove(&a)?,
+            "object_list" => self.object_list(&a)?,
+            "object_move" => self.object_move(&a)?,
+            "content_list" => self.content_list(&a)?,
+            "page_add_text" => self.page_add_text(&a)?,
+            "page_add_image" => self.page_add_image(&a)?,
+            "content_update" => self.content_update(&a)?,
+            "content_delete" => self.content_delete(&a)?,
+            "content_copy" => self.content_copy(&a)?,
+            "doc_print" => self.doc_print(&a)?,
+            "attachment_add" => {
+                let path = self.resolve(a.str("path")?, false)?;
+                let bytes = read_input(&path)?;
+                let name = match a.opt_str("name")? {
+                    Some(n) => n.to_string(),
+                    None => path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(),
+                };
+                let mime = pdfcraft_engine::mime_for_name(&name).map(str::to_string);
+                let description = a.opt_str("description")?.map(str::to_string);
+                // Only the document-level keys: an annotation attachment of the same name is not the new one.
+                let before = document_attachment_keys(self.doc(&a)?);
+                let out = self.apply(&a, Edit::AddAttachment { name, bytes, description, mime })?;
+                let key = document_attachment_keys(self.doc(&a)?).into_iter().find(|n| !before.contains(n)).unwrap_or_default();
+                json!({ "name": key, "document": out })
+            }
+            "attachment_delete" => {
+                let edit = Edit::DeleteAttachment { key: a.str("name")?.into() };
+                self.apply(&a, edit)?
+            }
+            "doc_remove_hidden" => self.doc_remove_hidden(&a)?,
+            "doc_audit_redactions" => self.doc_audit_redactions(&a)?,
+            "fill_sign_add" => self.fill_sign_add(&a)?,
+            "fill_sign_date_format" => self.fill_sign_date_format(&a)?,
+            "measure_distance" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Distance)?,
+            "measure_perimeter" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Perimeter)?,
+            "measure_area" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Area)?,
+            "measure_info" => self.measurement_info(&a)?,
+            "measure_list" => self.measurement_list(&a)?,
+            "measure_scale" => self.measurement_scale(&a)?,
+            "measure_snap" => self.measurement_snap(&a)?,
+            "measure_export" => self.measurement_export(&a)?,
+            "comment_list" => self.comment_list(&a)?,
+            "comment_add" => self.comment_add(&a)?,
+            "stamp_custom" => self.stamp_custom(&a)?,
+            "comment_reply" => self.comment_reply(&a)?,
+            "comment_set_status" => self.comment_set_status(&a)?,
+            "sign_list" => self.sign_list(&a)?,
+            "accessibility_check" => self.a11y_check(&a)?,
+            "accessibility_find_untagged" => self.a11y_find_untagged(&a)?,
+            "accessibility_autotag_preview" => self.accessibility_autotag_preview(&a)?,
+            "accessibility_autotag_apply" => self.accessibility_autotag_apply(&a)?,
+            "accessibility_autotag_form_fields" => self.accessibility_autotag_form_fields(&a)?,
+            "ocr_recognize" => self.ocr_recognize(&a)?,
+            "js_run" => self.js_run(&a)?,
+            "js_document_scripts" => self.js_document_scripts(&a)?,
+            "js_set_document_script" => self.js_set_document_script(&a)?,
+            "js_enabled" => self.js_enabled(&a)?,
+            "form_set_script" => self.form_set_script(&a)?,
+            "form_merge_data" => self.form_merge_data(&a)?,
+            "form_actions" => self.form_actions(&a)?,
+            "form_detect_fields" => self.form_detect_fields(&a)?,
+            "doc_compare" => self.doc_compare(&a)?,
+            "action_list" => self.action_list()?,
+            "pdfa_verify" => self.pdfa_verify(&a)?,
+            "print_readiness" => self.print_readiness(&a)?,
+            "doc_export_office" => self.doc_export_office(&a)?,
+            "pdfa_convert" => self.pdfa_convert(&a)?,
+            "standards_remove_id" => {
+                let standard = match a.str("standard")? {
+                    "pdfa" => pdfcraft_engine::Standard::PdfA,
+                    "pdfx" => pdfcraft_engine::Standard::PdfX,
+                    other => return Err(ToolError::InvalidArgs(format!("standard must be pdfa or pdfx, not {other}"))),
+                };
+                self.apply(&a, Edit::RemoveStandardId { standard })?
+            }
+            "action_run" => self.action_run(&a)?,
+            "doc_compare_report" => self.doc_compare_report(&a)?,
+            "doc_compare_mark" => self.doc_compare_mark(&a)?,
+            "form_set_actions" => self.form_set_actions(&a)?,
+            "ocr_status" => self.ocr_status()?,
+            "ocr_recognize_files" => self.ocr_recognize_files(&a)?,
+            "accessibility_report" => self.a11y_report(&a)?,
+            "accessibility_review_record" => self.a11y_review_record(&a)?,
+            "accessibility_review_save" => self.a11y_review_save(&a)?,
+            "accessibility_review_load" => self.a11y_review_load(&a)?,
+            "accessibility_review_html" => self.a11y_review_html(&a)?,
+            "accessibility_fix" => self.a11y_fix(&a)?,
+            "accessibility_figures" => self.accessibility_figures(&a)?,
+            "accessibility_set_alt" => self.accessibility_set_alt(&a)?,
+            "accessibility_tags" => self.accessibility_tags(&a)?,
+            "accessibility_tag_content" => self.accessibility_tag_content(&a)?,
+            "accessibility_set_tag_property" => self.accessibility_set_tag_property(&a)?,
+            "accessibility_mark_tag_artifact" => self.accessibility_mark_tag_artifact(&a)?,
+            "accessibility_move_tag" => self.accessibility_move_tag(&a)?,
+            "sign_id_create" => self.sign_id_create(&a)?,
+            "sign_document" => self.sign_document(&a)?,
+            "sign_keychain_ids" => {
+                #[cfg(target_os = "macos")]
+                let ids: Vec<Value> = pdfcraft_engine::sign::keychain::identities(None)
+                    .map_err(failed)?
+                    .iter()
+                    .map(|id| json!({ "id": pdfcraft_engine::sign::keychain::reference(&id.certificate), "certificate": signing::cert_json(&id.certificate) }))
+                    .collect();
+                #[cfg(not(target_os = "macos"))]
+                let ids: Vec<Value> = Vec::new();
+                json!({ "count": ids.len(), "ids": ids })
+            }
+            "sign_windows_ids" => {
+                #[cfg(target_os = "windows")]
+                let (ids, unusable): (Vec<Value>, Vec<Value>) = {
+                    let listing = pdfcraft_engine::sign::windows::list().map_err(failed)?;
+                    let ids = listing
+                        .ids
+                        .iter()
+                        .map(|id| json!({ "id": pdfcraft_engine::sign::windows::reference(&id.certificate), "certificate": signing::cert_json(&id.certificate) }))
+                        .collect();
+                    let unusable = listing
+                        .unusable
+                        .iter()
+                        .map(|u| json!({ "subject": u.subject, "sha256": u.fingerprint, "reason": u.reason, "no_private_key": u.no_private_key }))
+                        .collect();
+                    (ids, unusable)
+                };
+                #[cfg(not(target_os = "windows"))]
+                let (ids, unusable): (Vec<Value>, Vec<Value>) = (Vec::new(), Vec::new());
+                json!({ "count": ids.len(), "ids": ids, "unusable": unusable })
+            }
+            "sign_trust" => self.sign_trust(&a)?,
+            "comment_mark" => self.comment_mark(&a)?,
+            "comment_lock" => self.comment_lock(&a)?,
+            "comments_hide" => self.comments_hide(&a)?,
+            "layer_set" => self.layer_set(&a)?,
+            "view_reading_colors" => self.view_reading_colors(&a)?,
+            "comments_summarize" => self.comments_summarize(&a)?,
+            "comment_edit" => self.comment_edit(&a)?,
+            "comment_delete" => self.comment_delete(&a)?,
+            other => return Err(ToolError::UnknownTool(other.into())),
+        };
+        Ok(vec![Content::Json(out)])
+    }
+}
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
new file mode 100644
index 0000000000..dadc368b8d
--- /dev/null
+++ b/crates/automation/src/documents.rs
@@ -0,0 +1,621 @@
+use super::error::{Result, ToolError, failed};
+use super::json::{Args, nest_rows, security, summary};
+use super::paths::{child, read_input, write_atomic};
+use super::*;
+
+/// How far a watermark may be moved from the page centre, in points (a page is at most 14,400).
+const WATERMARK_MAX_OFFSET: f64 = 20_000.0;
+
+/// Bookmarks in one page of the bookmark list, by default and at most.
+const BOOKMARK_PAGE: usize = 100;
+
+const MAX_BOOKMARK_PAGE: usize = 1000;
+
+impl Automation {
+    // ---- documents ---------------------------------------------------------------------------
+
+    /// One page of a document's bookmarks: `offset` (from 0) and `limit` (1 to `MAX_BOOKMARK_PAGE`).
+    pub(crate) fn bookmark_listing(&self, a: &Args) -> Result<Value> {
+        let id = a.int("doc")?;
+        let id = DocId(u64::try_from(id).map_err(|_| ToolError::InvalidArgs("doc must be positive".into()))?);
+        let offset = a.opt_int("offset")?.unwrap_or(0);
+        let offset = usize::try_from(offset).map_err(|_| ToolError::InvalidArgs("offset must be 0 or more".into()))?;
+        let limit = a.opt_int("limit")?.unwrap_or(BOOKMARK_PAGE as i64);
+        let limit = usize::try_from(limit)
+            .ok()
+            .filter(|l| (1..=MAX_BOOKMARK_PAGE).contains(l))
+            .ok_or_else(|| ToolError::InvalidArgs(format!("limit must be from 1 to {MAX_BOOKMARK_PAGE}")))?;
+        let page = self
+            .session
+            .bookmark_page(id, offset, limit)
+            .ok_or_else(|| ToolError::Failed(format!("no open document with id {} (see doc_list)", id.0)))?;
+        let pages = &self.doc(a)?.info.pages;
+        Ok(json!({ "bookmarks": nest_rows(&page.rows, pages), "next": page.next, "truncated": page.truncated }))
+    }
+
+    pub(crate) fn doc(&self, a: &Args) -> Result<&Document> {
+        let id = a.int("doc")?;
+        let id = u64::try_from(id).map_err(|_| ToolError::InvalidArgs("doc must be positive".into()))?;
+        self.session.get(DocId(id)).ok_or_else(|| ToolError::Failed(format!("no open document with id {id} (see doc_list)")))
+    }
+
+    /// Most pages whose paragraph listing is remembered.
+    const MAX_LISTINGS: usize = 256;
+
+    /// Remember the paragraphs `text_paragraphs` just listed for `page`, so their numbers can be
+    /// resolved against that listing.
+    pub(crate) fn record_listing(&mut self, doc: DocId, page: usize, blocks: &[TextBlock]) {
+        if self.listed.len() >= Self::MAX_LISTINGS && !self.listed.contains_key(&(doc, page)) {
+            self.evicted.extend(self.listed.keys().map(|(d, _)| *d));
+            self.listed.clear();
+        }
+        self.listed.insert((doc, page), blocks.iter().map(BlockKey::of).collect());
+    }
+
+    /// The index in `blocks` (the page's paragraphs now) of paragraph number `k` (1-based).
+    ///
+    /// After `text_paragraphs` a number names the paragraph that listing showed, wherever it is
+    /// now. Without a listing it is a position in `blocks`. A paragraph an edit merged into a
+    /// neighbour (or changed) is refused: the number would otherwise rewrite another paragraph
+    /// and lose its text (#2516). So is any number on a page of a document whose listings were
+    /// dropped at the cap, until the page is listed again.
+    pub(crate) fn paragraph_index(&self, doc: DocId, page: usize, k: i64, blocks: &[TextBlock]) -> Result<usize> {
+        let keys = self.listed.get(&(doc, page));
+        if keys.is_none() && self.evicted.contains(&doc) {
+            return Err(ToolError::InvalidArgs(format!(
+                "page {} has no paragraph listing any more: too many pages were listed and the oldest listings were dropped. List the page again with text_paragraphs",
+                page + 1
+            )));
+        }
+        let n = keys.map_or(blocks.len(), Vec::len);
+        let i = usize::try_from(k)
+            .ok()
+            .and_then(|k| k.checked_sub(1))
+            .filter(|i| *i < n)
+            .ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range: page {} has {n} paragraphs", page + 1)))?;
+        let Some(keys) = keys else { return Ok(i) };
+        keys.get(i).and_then(|key| key.find(blocks, i)).ok_or_else(|| {
+            ToolError::InvalidArgs(format!(
+                "paragraph {k} of page {} is no longer a paragraph of its own: an edit changed it or how the page is grouped. List the page again with text_paragraphs",
+                page + 1
+            ))
+        })
+    }
+
+    /// Update the listing after paragraph `k` was edited into `edited`, one of the page's
+    /// paragraphs `after`. Returns the numbers of the listed paragraphs that are gone.
+    pub(crate) fn follow_edit(&mut self, doc: DocId, page: usize, k: i64, edited: Option<&TextBlock>, after: &[TextBlock]) -> Vec<usize> {
+        let Some(keys) = self.listed.get_mut(&(doc, page)) else { return Vec::new() };
+        if let (Some(edited), Some(key)) = (edited, usize::try_from(k).ok().and_then(|k| k.checked_sub(1)).and_then(|i| keys.get_mut(i))) {
+            *key = BlockKey::of(edited);
+        }
+        keys.iter().enumerate().filter(|(i, key)| key.find(after, *i).is_none()).map(|(i, _)| i + 1).collect()
+    }
+
+    /// The document, if its security allows copying text and images out of it (Table 22, bit 5).
+    pub(crate) fn doc_to_copy(&self, a: &Args) -> Result<&Document> {
+        let doc = self.doc(a)?;
+        doc.check_copying().map_err(failed)?;
+        Ok(doc)
+    }
+
+    pub(crate) fn doc_open(&mut self, a: &Args) -> Result<Value> {
+        let path = self.resolve(a.str("path")?, false)?;
+        let bytes = read_input(&path)?;
+        let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+        let id = self.session.open(name, Some(path.to_string_lossy().into_owned()), Arc::new(bytes), a.opt_str("password")?).map_err(failed)?;
+        let doc = self.session.get(id).ok_or_else(|| failed("the document vanished"))?;
+        Ok(summary(doc))
+    }
+
+    pub(crate) fn doc_close(&mut self, a: &Args) -> Result<Value> {
+        let doc = self.doc(a)?;
+        let id = doc.id;
+        let discard_changes = a.opt_bool("discard_changes")?.unwrap_or(false);
+        if doc.dirty && !discard_changes {
+            return Err(failed("the document has unsaved changes: save it with doc_save, or pass discard_changes: true"));
+        }
+        self.session.close(id);
+        self.renderers.remove(&id);
+        self.texts.remove(&id);
+        self.listed.retain(|(d, _), _| *d != id);
+        self.evicted.remove(&id);
+        Ok(json!({ "closed": id.0 }))
+    }
+
+    pub(crate) fn doc_save(&mut self, a: &Args) -> Result<Value> {
+        self.doc_save_with(a, write_atomic)
+    }
+
+    pub(crate) fn doc_save_with(&mut self, a: &Args, write: impl FnOnce(&Path, &[u8]) -> Result<()>) -> Result<Value> {
+        let doc = self.doc(a)?;
+        let id = doc.id;
+        let target = match a.opt_str("path")? {
+            Some(p) => self.resolve(p, true)?,
+            None => {
+                // Saving in place writes where the file was opened from, which the read root
+                // allows and the write root may not.
+                let own = doc.path.clone().ok_or_else(|| failed("the document has never been saved: pass a path"))?;
+                let own_path = PathBuf::from(&own);
+                self.check_roots(&own, &own_path, file_access::Access::Write)?;
+                own_path
+            }
+        };
+        let same_file = doc.path.as_deref().is_some_and(|p| Path::new(p) == target);
+        // Saving to a new file is a full rewrite unless asked otherwise, like Save As.
+        let full = a.opt_bool("full")?.unwrap_or(!same_file);
+        let flatten_fill_sign = a.opt_bool("flatten_fill_sign")?.unwrap_or(false);
+        if flatten_fill_sign {
+            self.apply(a, Edit::FlattenFillSign)?;
+        }
+        let bytes = if full { self.session.save_full_bytes(id) } else { self.session.save_bytes(id) }.map_err(failed)?;
+        // A save that adds or removes encryption, or must not keep the old revision (Sanitize,
+        // redaction), is rewritten in full even when an incremental save was asked for.
+        let incremental = !full && bytes.starts_with(&self.doc(a)?.saved_bytes());
+        self.publish_save(id, &target, bytes, incremental, write)
+    }
+
+    /// Validate the prepared bytes before publishing them or marking the document saved.
+    pub(crate) fn publish_save(
+        &mut self,
+        id: DocId,
+        target: &Path,
+        bytes: Arc<Vec<u8>>,
+        incremental: bool,
+        write: impl FnOnce(&Path, &[u8]) -> Result<()>,
+    ) -> Result<Value> {
+        self.session.check_save(id, &bytes).map_err(failed)?;
+        write(target, &bytes)?;
+        let path = target.to_string_lossy().into_owned();
+        self.session.mark_saved(id, bytes.clone(), Some(path.clone())).map_err(failed)?;
+        let doc = self.session.get(id).ok_or_else(|| failed("the saved document is no longer open"))?;
+        Ok(json!({ "path": path, "bytes": bytes.len(), "incremental": incremental, "document": summary(doc) }))
+    }
+
+    pub(crate) fn doc_revisions(&mut self, a: &Args) -> Result<Value> {
+        let doc = self.doc(a)?;
+        let ends = doc.revision_ends();
+        let sigs = doc.signatures.clone();
+        let list: Vec<Value> = ends
+            .iter()
+            .enumerate()
+            .map(|(i, end)| {
+                let start = if i == 0 { 0 } else { ends[i - 1] };
+                // A signature signs the revision its byte range ends in.
+                let signed: Vec<&str> =
+                    sigs.iter().filter(|s| s.signed && s.signed_len > start && s.signed_len <= *end).map(|s| s.field.as_str()).collect();
+                json!({ "revision": i + 1, "end": end, "bytes": end - start, "signed_by": signed })
+            })
+            .collect();
+        Ok(json!({ "revisions": list, "unsaved_changes": doc.dirty }))
+    }
+
+    pub(crate) fn doc_initial_view(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::{InitialLayout as L, Magnification as M, Navigation as N};
+        let bad = |m: String| ToolError::InvalidArgs(m);
+        let mut v = self.doc(a)?.initial_view();
+        let before = v.clone();
+        if let Some(n) = a.opt_str("navigation")? {
+            v.navigation = match n {
+                "page" => N::PageOnly,
+                "bookmarks" => N::Bookmarks,
+                "pages" => N::Pages,
+                "attachments" => N::Attachments,
+                "layers" => N::Layers,
+                o => return Err(bad(format!("unknown navigation {o:?}"))),
+            };
+        }
+        if let Some(l) = a.opt_str("layout")? {
+            v.layout = match l {
+                "default" => L::Default,
+                "single" => L::SinglePage,
+                "continuous" => L::SinglePageContinuous,
+                "two_up" => L::TwoUp,
+                "two_up_continuous" => L::TwoUpContinuous,
+                "two_up_cover" => L::TwoUpCoverPage,
+                "two_up_continuous_cover" => L::TwoUpContinuousCoverPage,
+                o => return Err(bad(format!("unknown layout {o:?}"))),
+            };
+        }
+        match a.get("magnification") {
+            None => {}
+            Some(Value::Number(p)) => v.magnification = M::Percent(p.as_f64().unwrap_or(100.0).clamp(1.0, 6400.0)),
+            Some(Value::String(m)) => {
+                v.magnification = match m.as_str() {
+                    "default" => M::Default,
+                    "actual" => M::ActualSize,
+                    "fit_page" => M::FitPage,
+                    "fit_width" => M::FitWidth,
+                    "fit_height" => M::FitHeight,
+                    "fit_visible" => M::FitVisible,
+                    o => return Err(bad(format!("unknown magnification {o:?}"))),
+                }
+            }
+            Some(_) => return Err(bad("magnification is a name or a percentage".into())),
+        }
+        if let Some(p) = a.opt_int("page")? {
+            v.page = (p.max(1) - 1) as usize;
+        }
+        for (k, f) in [
+            ("fit_window", &mut v.fit_window),
+            ("center_window", &mut v.center_window),
+            ("full_screen", &mut v.full_screen),
+            ("display_title", &mut v.display_title),
+            ("hide_menubar", &mut v.hide_menubar),
+            ("hide_toolbar", &mut v.hide_toolbar),
+            ("hide_window_ui", &mut v.hide_window_ui),
+        ] {
+            if let Some(b) = a.opt_bool(k)? {
+                *f = b;
+            }
+        }
+        if let Some(l) = a.opt_str("language")? {
+            v.language = (!l.trim().is_empty()).then(|| l.trim().to_string());
+        }
+        if let Some(b) = a.opt_str("binding")? {
+            v.right_to_left = match b {
+                "left" => false,
+                "right" => true,
+                o => return Err(bad(format!("binding is left or right, not {o:?}"))),
+            };
+        }
+        let mut out = if v != before { self.apply(a, Edit::SetInitialView(Box::new(v.clone())))? } else { json!({}) };
+        out["initial_view"] = json!({
+            "navigation": format!("{:?}", v.navigation),
+            "layout": format!("{:?}", v.layout),
+            "magnification": format!("{:?}", v.magnification),
+            "page": v.page + 1,
+            "fit_window": v.fit_window,
+            "center_window": v.center_window,
+            "full_screen": v.full_screen,
+            "display_title": v.display_title,
+            "hide_menubar": v.hide_menubar,
+            "hide_toolbar": v.hide_toolbar,
+            "hide_window_ui": v.hide_window_ui,
+            "language": v.language,
+            "binding": if v.right_to_left { "right" } else { "left" },
+        });
+        Ok(out)
+    }
+
+    pub(crate) fn doc_optimize(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, Preset};
+        let id = self.doc(a)?.id;
+        let before = self.doc(a)?.bytes.len();
+        let path = self.resolve(a.str("path")?, true)?;
+        let mut settings = match a.opt_str("preset")? {
+            None => Preset::Standard.settings(),
+            Some(p) => Preset::from_name(p).ok_or_else(|| ToolError::InvalidArgs(format!("unknown preset {p:?} (standard, mobile)")))?.settings(),
+        };
+        if let Some(c) = a.opt_str("compatibility")? {
+            settings.compatibility = Compatibility::from_name(c)
+                .ok_or_else(|| ToolError::InvalidArgs(format!("unknown compatibility {c:?} (retain, 1.4, 1.5, 1.6, 1.7, 2.0)")))?;
+        }
+        let images = |key: &str, base: ImageSettings| -> Result<ImageSettings> {
+            let Some(v) = a.get(key) else { return Ok(base) };
+            let mut s = base;
+            if let Some(d) = v.get("downsample").and_then(Value::as_bool) {
+                s.downsample = d;
+            }
+            if let Some(p) = v.get("ppi").and_then(Value::as_f64) {
+                s.target_ppi = p.clamp(9.0, 2400.0);
+            }
+            if let Some(p) = v.get("above_ppi").and_then(Value::as_f64) {
+                s.above_ppi = p.clamp(9.0, 2400.0);
+            }
+            s.above_ppi = s.above_ppi.max(s.target_ppi);
+            if let Some(c) = v.get("compression").and_then(Value::as_str) {
+                let q = v.get("quality").and_then(Value::as_u64).unwrap_or(60).clamp(1, 100) as u8;
+                s.compression = match c {
+                    "jpeg" => Compression::Jpeg(q),
+                    "zip" | "flate" => Compression::Flate,
+                    "retain" => Compression::Retain,
+                    other => return Err(ToolError::InvalidArgs(format!("unknown compression {other:?} (jpeg, zip, retain)"))),
+                };
+            }
+            Ok(s)
+        };
+        settings.color = images("color", settings.color)?;
+        settings.gray = images("gray", settings.gray)?;
+        for (key, flag) in [
+            ("merge_fragments", &mut settings.merge_fragments),
+            ("discard_thumbnails", &mut settings.discard_thumbnails),
+            ("discard_alternate_images", &mut settings.discard_alternate_images),
+            ("discard_tags", &mut settings.discard_tags),
+            ("discard_print_settings", &mut settings.discard_print_settings),
+            ("flate_unencoded", &mut settings.flate_unencoded),
+            ("object_streams", &mut settings.object_streams),
+            ("lzw_to_flate", &mut settings.lzw_to_flate),
+            ("remove_invalid_links", &mut settings.remove_invalid_links),
+            ("remove_unreferenced_dests", &mut settings.remove_unreferenced_dests),
+            ("discard_external_refs", &mut settings.discard_external_refs),
+        ] {
+            if let Some(b) = a.opt_bool(key)? {
+                *flag = b;
+            }
+        }
+        let discard: Vec<pdfcraft_engine::Hidden> = match a.get("discard") {
+            None => Vec::new(),
+            Some(v) => v
+                .as_array()
+                .ok_or_else(|| ToolError::InvalidArgs("discard must be an array".into()))?
+                .iter()
+                .map(|x| {
+                    x.as_str()
+                        .and_then(pdfcraft_engine::Hidden::from_id)
+                        .ok_or_else(|| ToolError::InvalidArgs(format!("unknown discard category {x}")))
+                })
+                .collect::<Result<_>>()?,
+        };
+        let (bytes, r) = self.session.optimized_bytes(id, &settings, &discard).map_err(failed)?;
+        write_atomic(&path, &bytes)?;
+        fn valid_version(v: &[u8]) -> Option<&str> {
+            if matches!(v, [b'1'..=b'9', b'.', b'0'..=b'9']) { std::str::from_utf8(v).ok() } else { None }
+        }
+        let catalog_version = (settings.compatibility == Compatibility::Retain)
+            .then(|| {
+                let pw = self.doc(a).ok().and_then(|d| d.password.as_deref());
+                let doc = pdfcraft_cos::Document::open_with_password(bytes.clone(), pw).ok()?;
+                let root = doc.root()?;
+                doc.get(root).as_dict()?.name(b"Version").and_then(valid_version).map(str::to_owned)
+            })
+            .flatten();
+        let header_version = bytes.strip_prefix(b"%PDF-").and_then(|b| b.get(..3)).and_then(valid_version);
+        // Viewers read the later of the two (object streams raise the header past a lower catalog
+        // entry). Both are "d.d", so text order is version order.
+        let pdf_version = catalog_version.as_deref().into_iter().chain(header_version).max();
+        let o = &r.optimize;
+        Ok(json!({
+            "path": path.to_string_lossy(),
+            "pdf_version": pdf_version,
+            "object_streams": settings.effective_object_streams(),
+            "bytes_before": before,
+            "bytes_after": bytes.len(),
+            "merged_images": o.merged_images,
+            "fragments_merged": o.fragments_merged,
+            "images": o.images,
+            "images_resampled": o.images_resampled,
+            "images_recompressed": o.images_recompressed,
+            "image_bytes_before": o.image_bytes_before,
+            "image_bytes_after": o.image_bytes_after,
+            "thumbnails": o.thumbnails,
+            "alternate_images": o.alternate_images,
+            "tags_removed": o.tags_removed,
+            "streams_compressed": o.streams_compressed,
+            "lzw_streams": o.lzw_streams,
+            "invalid_links": o.invalid_links,
+            "invalid_bookmarks": o.invalid_bookmarks,
+            "unreferenced_dests": o.unreferenced_dests,
+            "external_links": o.external_links,
+            "external_bookmarks": o.external_bookmarks,
+            "unused_xobjects": o.unused_xobjects,
+            "merged_objects": r.merged,
+            "discarded": r.discarded.iter().map(|(h, n)| json!({ "category": h.id(), "count": n })).collect::<Vec<_>>(),
+        }))
+    }
+
+    /// A watermark or background picture: `file` (an image or a PDF) and `file_page` (1-based).
+    fn mark_file(&self, a: &Args) -> Result<Option<pdfcraft_engine::MarkFile>> {
+        let Some(p) = a.opt_str("file")? else { return Ok(None) };
+        let path = self.resolve(p, false)?;
+        let bytes = read_input(&path)?;
+        let page = a.opt_int("file_page")?.unwrap_or(1).max(1) as usize - 1;
+        Ok(Some(pdfcraft_engine::MarkFile {
+            name: path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(),
+            bytes: Arc::new(bytes),
+            page,
+        }))
+    }
+
+    pub(crate) fn apply(&mut self, a: &Args, edit: Edit) -> Result<Value> {
+        let id = self.doc(a)?.id;
+        self.session.apply(id, edit).map_err(failed)?;
+        let doc = self.doc(a)?;
+        let mut out = summary(doc);
+        // Text the edit stored as typed but drew with `?` (its font can't draw it): said, not silent.
+        if !doc.edit_notices.is_empty() {
+            out["warnings"] = json!(doc.edit_notices.iter().map(ToString::to_string).collect::<Vec<_>>());
+        }
+        Ok(out)
+    }
+
+    pub(crate) fn marks(&mut self, tool: &str, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::{Background, HeaderFooter, MarkKind, Watermark};
+        let n = self.doc(a)?.info.pages.len();
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..n).collect(),
+        };
+        let color =
+            |key: &str, default: [f64; 3]| -> Result<[f64; 3]> { Ok(a.opt_str(key)?.map(comments::parse_color).transpose()?.unwrap_or(default)) };
+        let replace = a.opt_bool("replace")?.unwrap_or(false);
+        let edit = match tool {
+            "doc_header_footer" => {
+                let mut hf = HeaderFooter::default();
+                for (k, key) in ["header_left", "header_center", "header_right", "footer_left", "footer_center", "footer_right"].iter().enumerate() {
+                    hf.text[k] = a.opt_str(key)?.unwrap_or_default().to_string();
+                }
+                if let Some(s) = a.opt_num("font_size")? {
+                    hf.font_size = s;
+                }
+                hf.font = match a.opt_str("font")? {
+                    None | Some("Helvetica") => pdfcraft_engine::FontFamily::Helvetica,
+                    Some("Times") => pdfcraft_engine::FontFamily::Times,
+                    Some("Courier") => pdfcraft_engine::FontFamily::Courier,
+                    Some(other) => {
+                        return Err(ToolError::InvalidArgs(format!("font must be \"Helvetica\", \"Times\" or \"Courier\", not {other:?}")));
+                    }
+                };
+                hf.color = color("color", hf.color)?;
+                if let Some(m) = a.get("margins").and_then(Value::as_array) {
+                    let m: Vec<f64> = m.iter().filter_map(Value::as_f64).collect();
+                    hf.margins = <[f64; 4]>::try_from(m).map_err(|_| ToolError::InvalidArgs("margins must be 4 numbers".into()))?;
+                }
+                if let Some(s) = a.opt_int("start_number")? {
+                    hf.start_number = s.clamp(1, u32::MAX as i64) as u32;
+                }
+                hf.shrink = a.opt_bool("shrink")?.unwrap_or(false);
+                Edit::AddHeaderFooter { pages, settings: hf, replace }
+            }
+            "doc_watermark" => {
+                let d = Watermark::default();
+                let file = self.mark_file(a)?;
+                let text = match &file {
+                    Some(_) => a.opt_str("text")?.unwrap_or_default().to_string(),
+                    None => a.str("text")?.to_string(),
+                };
+                let wm = Watermark {
+                    text,
+                    source: None,
+                    scale: a.opt_num("scale")?.unwrap_or(d.scale).clamp(0.01, 1.0),
+                    font_size: a.opt_num("font_size")?.unwrap_or(0.0),
+                    color: color("color", d.color)?,
+                    opacity: a.opt_num("opacity")?.unwrap_or(d.opacity),
+                    rotation: a.opt_num("rotation")?.unwrap_or(d.rotation),
+                    behind: a.opt_bool("behind")?.unwrap_or(false),
+                    offset: [
+                        a.opt_num("offset_x")?.unwrap_or(0.0).clamp(-WATERMARK_MAX_OFFSET, WATERMARK_MAX_OFFSET),
+                        a.opt_num("offset_y")?.unwrap_or(0.0).clamp(-WATERMARK_MAX_OFFSET, WATERMARK_MAX_OFFSET),
+                    ],
+                };
+                Edit::AddWatermark { pages, settings: wm, replace, file }
+            }
+            "doc_background" => Edit::AddBackground {
+                pages,
+                settings: Background {
+                    color: color("color", [1.0; 3])?,
+                    opacity: a.opt_num("opacity")?.unwrap_or(1.0),
+                    scale: a.opt_num("scale")?.unwrap_or(1.0).clamp(0.01, 1.0),
+                    ..Background::default()
+                },
+                replace,
+                file: self.mark_file(a)?,
+            },
+            _ => {
+                let kind = match a.str("kind")? {
+                    "header_footer" => MarkKind::HeaderFooter,
+                    "watermark" => MarkKind::Watermark,
+                    "background" => MarkKind::Background,
+                    other => return Err(ToolError::InvalidArgs(format!("unknown kind {other:?}"))),
+                };
+                Edit::RemoveMarks { kind }
+            }
+        };
+        self.apply(a, edit)
+    }
+
+    pub(crate) fn export(&mut self, tool: &str, a: &Args) -> Result<Value> {
+        let doc = self.doc_to_copy(a)?;
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..doc.info.pages.len()).collect(),
+        };
+        let stem = doc.name.trim_end_matches(".pdf").trim_end_matches(".PDF").to_string();
+        let mut ex = pdfcraft_engine::export::Exporter::new(doc);
+        if tool == "doc_export_text" {
+            let path = self.resolve(a.str("path")?, true)?;
+            let text = ex.text_of(&pages).map_err(failed)?;
+            write_atomic(&path, text.as_bytes())?;
+            return Ok(json!({ "path": path.to_string_lossy(), "pages": pages.len(), "bytes": text.len() }));
+        }
+        let folder = self.resolve(a.str("folder")?, true)?;
+        std::fs::create_dir_all(&folder).map_err(|e| failed(format!("{}: {e}", folder.display())))?;
+        if tool == "doc_export_all_images" {
+            let min = u32::try_from(a.opt_int("min_size")?.unwrap_or(0).max(0)).unwrap_or(u32::MAX);
+            let out = pdfcraft_engine::export::extract_images(&doc.export_source(), &pages, min).map_err(failed)?;
+            let mut files = Vec::new();
+            for (k, img) in out.images.iter().enumerate() {
+                let path = child(&folder, &pdfcraft_engine::export::image_file_name(&stem, img, k + 1, doc.info.pages.len()));
+                write_atomic(&path, &img.data)?;
+                files.push(json!({ "path": path.to_string_lossy(), "page": img.page + 1, "width": img.width, "height": img.height }));
+            }
+            let skipped: Vec<Value> = out.skipped.iter().map(|(p, r, why)| json!({ "page": p + 1, "object": r.num, "reason": why })).collect();
+            return Ok(json!({ "count": files.len(), "files": files, "skipped": skipped }));
+        }
+        let dpi = a.opt_num("dpi")?.unwrap_or(150.0);
+        let quality = a.opt_int("quality")?.unwrap_or(85).clamp(1, 100) as u8;
+        let format = match a.opt_str("format")?.unwrap_or("png") {
+            "png" => pdfcraft_engine::export::ImageFormat::Png,
+            "jpeg" | "jpg" => pdfcraft_engine::export::ImageFormat::Jpeg { quality },
+            "tiff" | "tif" => pdfcraft_engine::export::ImageFormat::Tiff,
+            f => return Err(ToolError::InvalidArgs(format!("unknown format {f:?} (png, jpeg, tiff)"))),
+        };
+        let mut files = Vec::new();
+        let mut lowered = Vec::new();
+        // A write error stops the export as it is, not as a page error.
+        let mut write_error = None;
+        let exported = ex.images(&pages, dpi, format, |p, img| {
+            let path = child(&folder, &format!("{stem}_page_{}.{}", p + 1, format.extension()));
+            write_atomic(&path, &img).map_err(|e| {
+                let message = e.to_string();
+                write_error = Some(e);
+                message
+            })?;
+            files.push(path.to_string_lossy().into_owned());
+            Ok(())
+        });
+        if let Some(e) = write_error {
+            return Err(e);
+        }
+        exported.map_err(failed)?;
+        for &p in &pages {
+            // A page too large for the renderer at `dpi` is drawn at the most it allows.
+            let used = ex.dpi_used(p, dpi);
+            if used < dpi.clamp(18.0, 1200.0) - 0.5 {
+                lowered.push(json!({ "page": p + 1, "dpi": used.floor() }));
+            }
+        }
+        if lowered.is_empty() {
+            Ok(json!({ "count": files.len(), "files": files }))
+        } else {
+            Ok(json!({ "count": files.len(), "files": files, "lower_dpi": lowered }))
+        }
+    }
+
+    pub(crate) fn doc_protect(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::{Algorithm, Changes, Printing, Protection};
+        let d = Protection::default();
+        // Restrictions only exist behind a permissions password (ISO 32000-2 §7.6.4.4: /P is
+        // enforced against the owner password; without one everything stays allowed). Refuse a
+        // restriction that could not take effect instead of writing an unrestricted file (#134).
+        let restriction = ["printing", "changes", "copy", "accessibility"].into_iter().find(|k| a.get(k).is_some());
+        if let (None, Some(key)) = (a.opt_str("permissions_password")?, restriction) {
+            return Err(ToolError::InvalidArgs(format!(
+                "`{key}` needs `permissions_password`: with open_password alone the document is encrypted but nothing is restricted"
+            )));
+        }
+        let p = Protection {
+            open_password: a.opt_str("open_password")?.map(str::to_owned),
+            permissions_password: a.opt_str("permissions_password")?.map(str::to_owned),
+            printing: match a.opt_str("printing")? {
+                None => d.printing,
+                Some("none") => Printing::None,
+                Some("low") => Printing::Low,
+                Some("high") => Printing::High,
+                Some(o) => return Err(ToolError::InvalidArgs(format!("unknown printing {o:?}"))),
+            },
+            changes: match a.opt_str("changes")? {
+                None => d.changes,
+                Some("none") => Changes::None,
+                Some("pages") => Changes::Pages,
+                Some("fill-sign") => Changes::FillSign,
+                Some("comment-fill-sign") => Changes::CommentFillSign,
+                Some("any-except-extract") => Changes::AnyExceptExtract,
+                Some(o) => return Err(ToolError::InvalidArgs(format!("unknown changes {o:?}"))),
+            },
+            copy: a.opt_bool("copy")?.unwrap_or(d.copy),
+            accessibility: a.opt_bool("accessibility")?.unwrap_or(d.accessibility),
+            algorithm: match a.opt_str("compatibility")? {
+                None | Some("aes-256") => Algorithm::Aes256,
+                Some("aes-128") => Algorithm::Aes128,
+                Some("rc4-128") => Algorithm::Rc4_128,
+                Some("rc4-40") => Algorithm::Rc4_40,
+                Some(o) => return Err(ToolError::InvalidArgs(format!("unknown compatibility {o:?}"))),
+            },
+            encrypt_metadata: a.opt_bool("encrypt_metadata")?.unwrap_or(d.encrypt_metadata),
+        };
+        let mut out = self.apply(a, Edit::Protect(p))?;
+        out["security"] = security(self.doc(a)?);
+        Ok(out)
+    }
+}
diff --git a/crates/automation/src/error.rs b/crates/automation/src/error.rs
new file mode 100644
index 0000000000..18e58939ed
--- /dev/null
+++ b/crates/automation/src/error.rs
@@ -0,0 +1,33 @@
+/// Why a tool call failed.
+#[derive(Clone, Debug, PartialEq)]
+pub enum ToolError {
+    /// No tool has this name.
+    UnknownTool(String),
+    /// The arguments don't match the tool's schema.
+    InvalidArgs(String),
+    /// The tool ran and failed (the message is for the agent to read).
+    Failed(String),
+}
+
+impl std::fmt::Display for ToolError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ToolError::UnknownTool(t) => write!(f, "unknown tool {t:?}"),
+            ToolError::InvalidArgs(m) | ToolError::Failed(m) => f.write_str(m),
+        }
+    }
+}
+
+impl std::error::Error for ToolError {}
+
+pub(crate) type Result<T> = std::result::Result<T, ToolError>;
+
+pub(crate) fn failed(e: impl std::fmt::Display) -> ToolError {
+    ToolError::Failed(e.to_string())
+}
+
+impl From<pdfcraft_engine::EditError> for ToolError {
+    fn from(e: pdfcraft_engine::EditError) -> Self {
+        failed(e)
+    }
+}
diff --git a/crates/automation/src/file_access.rs b/crates/automation/src/file_access.rs
index 4820743e22..067a593888 100644
--- a/crates/automation/src/file_access.rs
+++ b/crates/automation/src/file_access.rs
@@ -9,6 +9,9 @@
 //!   links are followed: for a file that doesn't exist yet, the links of its nearest existing
 //!   folder, the rest of the path being plain names (`..` below a missing folder is refused, and so
 //!   is a link that leads nowhere).
+//! - A path on another network share or in a device namespace (`\\host\share`, `\\.\pipe\x`)
+//!   than the root's is refused by name, before anything is resolved: resolving it would contact
+//!   the host.
 //! - The result must lie inside the root, compared by whole components (`/work2` isn't inside
 //!   `/work`), without regard to case on Windows.
 //! - Read and write access are separate: a root given alone grants only its own kind of access.
@@ -97,7 +100,10 @@ impl AutomationRoots {
                 Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {shown}")),
             };
         };
-        if inside(&resolve(shown, target)?, folder) {
+        let absolute = absolute(shown, target)?;
+        // Another network share or a device is refused by name, as `--root` refuses it: even
+        // resolving the path would contact the host (#4003).
+        if !foreign_share(&absolute, folder) && inside(&resolve(shown, &absolute)?, folder) {
             return Ok(());
         }
         let root = root_shown.display();
@@ -123,9 +129,8 @@ fn plain(path: PathBuf) -> PathBuf {
     }
 }
 
-/// `path` made absolute with its links followed; for a path that doesn't exist (yet), its nearest
-/// existing folder's links followed and the rest appended.
-fn resolve(shown: &str, path: &Path) -> Result<PathBuf, String> {
+/// `path` made absolute against the working directory, by name: nothing on disk is read.
+fn absolute(shown: &str, path: &Path) -> Result<PathBuf, String> {
     if path.as_os_str().is_empty() {
         return Err("automation path rejected: path is empty".into());
     }
@@ -133,10 +138,15 @@ fn resolve(shown: &str, path: &Path) -> Result<PathBuf, String> {
     if cfg!(windows) && path.components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
         return Err(format!("automation path rejected: reserved device names are not allowed: {shown}"));
     }
-    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {shown}: {e}"))?;
+    std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {shown}: {e}"))
+}
+
+/// `absolute` with its links followed; for a path that doesn't exist (yet), its nearest existing
+/// folder's links followed and the rest appended.
+fn resolve(shown: &str, absolute: &Path) -> Result<PathBuf, String> {
     // The names below the nearest existing folder, last first.
     let mut missing: Vec<OsString> = vec![];
-    let mut at = absolute.as_path();
+    let mut at = absolute;
     loop {
         match std::fs::canonicalize(at) {
             Ok(mut found) => {
@@ -189,6 +199,24 @@ fn same_component(a: Component, b: Component) -> bool {
     }
 }
 
+/// Whether `path` names another network share or device namespace than `root` (Windows
+/// `\\host\share`, `\\?\UNC\…`, `\\.\…`, `\\?\…`). Those are refused by name: even checking
+/// that one exists would contact the host. Drive letters are left to the normal check.
+pub(crate) fn foreign_share(path: &Path, root: &Path) -> bool {
+    use std::path::Prefix;
+    fn share(p: &Path) -> Option<String> {
+        let Some(Component::Prefix(prefix)) = p.components().next() else { return None };
+        let (kind, a, b) = match prefix.kind() {
+            Prefix::Disk(_) | Prefix::VerbatimDisk(_) => return None,
+            Prefix::UNC(host, share) | Prefix::VerbatimUNC(host, share) => ("unc", host, share),
+            Prefix::DeviceNS(name) => ("device", name, std::ffi::OsStr::new("")),
+            Prefix::Verbatim(name) => ("verbatim", name, std::ffi::OsStr::new("")),
+        };
+        Some(format!("{kind}\\{}\\{}", a.to_string_lossy(), b.to_string_lossy()).to_lowercase())
+    }
+    share(path).is_some_and(|s| share(root).as_ref() != Some(&s))
+}
+
 /// A Windows device name (`CON`, `NUL`, `COM1`… also with an extension), which names no file.
 fn is_device_name(component: &str) -> bool {
     let stem = component.split('.').next().unwrap_or(component).trim_end_matches(' ').to_ascii_uppercase();
@@ -233,6 +261,27 @@ mod tests {
         let _ = std::fs::remove_dir_all(base);
     }
 
+    /// #4003: another share or a device namespace is refused by name, with the same words as any
+    /// other path outside the root, before anything is resolved (which would contact the host).
+    #[cfg(windows)]
+    #[test]
+    fn other_shares_and_devices_are_refused_before_they_are_resolved() {
+        let (base, roots) = folders("shares");
+        for p in [
+            r"\\.\pipe\pdfcraft-4003.pdf",
+            r"\\?\GLOBALROOT\Device\Null",
+            r"\\pdfcraft-no-such-host.invalid\share\a.pdf",
+            "//pdfcraft-no-such-host.invalid/share/a.pdf",
+            r"\\?\UNC\pdfcraft-no-such-host.invalid\share\a.pdf",
+        ] {
+            let e = roots.check(p, Access::Read).unwrap_err();
+            assert!(e.starts_with("automation path rejected: outside the read root"), "{p}: {e}");
+            let e = roots.check(p, Access::Write).unwrap_err();
+            assert!(e.starts_with("automation path rejected: outside the write root"), "{p}: {e}");
+        }
+        let _ = std::fs::remove_dir_all(base);
+    }
+
     #[test]
     fn a_sibling_with_the_same_prefix_is_outside() {
         let (base, roots) = folders("prefix");
@@ -347,22 +396,41 @@ mod tests {
         // discovered file again before `process` reads it or `publish` writes it.
         const RESOLVED_BY_CALLER: &[&str] =
             &["write_atomic", "write_atomic_with", "read_input", "read_input_bytes", "read_review_sidecar", "process", "linked", "walk", "publish"];
-        let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let mut dirs = vec![Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
+        let mut files = vec![];
+        while let Some(dir) = dirs.pop() {
+            for entry in std::fs::read_dir(&dir).unwrap() {
+                let path = entry.unwrap().path();
+                if path.is_dir() {
+                    if path.file_name().is_some_and(|n| !n.to_string_lossy().starts_with("tests")) {
+                        dirs.push(path);
+                    }
+                } else {
+                    files.push(path);
+                }
+            }
+        }
         let mut offenders = vec![];
-        for entry in std::fs::read_dir(&dir).unwrap() {
-            let path = entry.unwrap().path();
+        for path in files {
             if path.extension().is_none_or(|e| e != "rs")
                 || path.file_name().is_some_and(|n| n == "file_access.rs" || n.to_string_lossy().starts_with("tests"))
             {
                 continue;
             }
             let text = std::fs::read_to_string(&path).unwrap();
-            // Test modules (which build their own fixtures) come last in each file.
-            let code = text.split("\n#[cfg(test)]").next().unwrap_or("");
+            // Inline test modules (which build their own fixtures) come last in each file. A
+            // `#[cfg(test)]` on a `use` line or a `mod tests;` declaration doesn't start one.
+            let code = text
+                .match_indices("\n#[cfg(test)]\nmod ")
+                .find(|(at, m)| text[at + m.len()..].lines().next().is_some_and(|l| l.trim_end().ends_with('{')))
+                .map_or(text.as_str(), |(at, _)| &text[..at]);
             let lines: Vec<&str> = code.lines().collect();
             for (n, line) in lines.iter().enumerate() {
                 let trimmed = line.trim_start();
+                // A `use` line only names a helper; the call is checked where it is made.
                 if trimmed.starts_with("//")
+                    || trimmed.starts_with("use ")
+                    || (trimmed.starts_with("pub") && trimmed.contains(" use "))
                     || !(trimmed.contains("std::fs")
                         || trimmed.contains("File::open")
                         || trimmed.contains("File::create")
diff --git a/crates/automation/src/json.rs b/crates/automation/src/json.rs
new file mode 100644
index 0000000000..c8710aa509
--- /dev/null
+++ b/crates/automation/src/json.rs
@@ -0,0 +1,361 @@
+use super::error::{Result, ToolError};
+use super::*;
+
+/// How far from the page's corner a bookmark's position may be given, in points (a PDF page is at
+/// most 14 400 across).
+const MAX_BOOKMARK_POSITION: f64 = 1_000_000.0;
+
+// ---- JSON helpers ----------------------------------------------------------------------------
+
+pub(crate) fn parse_style_ranges(value: Option<&Value>) -> Result<Vec<pdfcraft_engine::RangeStyle>> {
+    let Some(value) = value else { return Ok(Vec::new()) };
+    let values = value.as_array().filter(|v| v.len() <= 1024).ok_or_else(|| Args::wrong("ranges", "an array of at most 1024 style objects"))?;
+    values
+        .iter()
+        .map(|v| {
+            let a = Args(v);
+            let bounds = a
+                .get("range")
+                .and_then(Value::as_array)
+                .filter(|v| v.len() == 2)
+                .ok_or_else(|| Args::wrong("range", "[start,end] UTF-8 byte offsets"))?;
+            let start = bounds
+                .first()
+                .and_then(Value::as_u64)
+                .and_then(|n| usize::try_from(n).ok())
+                .ok_or_else(|| Args::wrong("range", "nonnegative byte offsets"))?;
+            let end = bounds
+                .get(1)
+                .and_then(Value::as_u64)
+                .and_then(|n| usize::try_from(n).ok())
+                .ok_or_else(|| Args::wrong("range", "nonnegative byte offsets"))?;
+            let family = a
+                .opt_str("font")?
+                .map(|f| match f {
+                    "helvetica" => Ok(pdfcraft_engine::FontFamily::Helvetica),
+                    "times" => Ok(pdfcraft_engine::FontFamily::Times),
+                    "courier" => Ok(pdfcraft_engine::FontFamily::Courier),
+                    _ => Err(Args::wrong("font", "helvetica, times or courier")),
+                })
+                .transpose()?
+                .map(|f| -> Result<_> { Ok((f, a.opt_bool("bold")?.unwrap_or(false), a.opt_bool("italic")?.unwrap_or(false))) })
+                .transpose()?;
+            Ok(pdfcraft_engine::RangeStyle {
+                range: start..end,
+                family,
+                resource: a.opt_str("font_resource")?.map(str::to_owned),
+                size: a.opt_num("size")?,
+                color: a.opt_str("color")?.map(comments::parse_color).transpose()?,
+                underline: a.opt_bool("underline")?,
+                char_spacing: a.opt_num("char_spacing")?,
+                scale: a.opt_num("scale")?,
+            })
+        })
+        .collect()
+}
+
+/// Typed access to validated arguments.
+pub(crate) struct Args<'a>(pub(crate) &'a Value);
+
+impl Args<'_> {
+    pub(crate) fn get(&self, key: &str) -> Option<&Value> {
+        self.0.get(key).filter(|v| !v.is_null())
+    }
+    pub(crate) fn missing(key: &str) -> ToolError {
+        ToolError::InvalidArgs(format!("missing argument {key}"))
+    }
+    pub(crate) fn wrong(key: &str, what: &str) -> ToolError {
+        ToolError::InvalidArgs(format!("{key} must be {what}"))
+    }
+    pub(crate) fn str(&self, key: &str) -> Result<&str> {
+        self.opt_str(key)?.ok_or_else(|| Self::missing(key))
+    }
+    pub(crate) fn opt_str(&self, key: &str) -> Result<Option<&str>> {
+        self.get(key).map(|v| v.as_str().ok_or_else(|| Self::wrong(key, "a string"))).transpose()
+    }
+    pub(crate) fn int(&self, key: &str) -> Result<i64> {
+        self.opt_int(key)?.ok_or_else(|| Self::missing(key))
+    }
+    pub(crate) fn opt_int(&self, key: &str) -> Result<Option<i64>> {
+        self.get(key).map(|v| v.as_i64().ok_or_else(|| Self::wrong(key, "an integer"))).transpose()
+    }
+    pub(crate) fn opt_num(&self, key: &str) -> Result<Option<f64>> {
+        self.get(key).map(|v| v.as_f64().filter(|f| f.is_finite()).ok_or_else(|| Self::wrong(key, "a number"))).transpose()
+    }
+    pub(crate) fn opt_bool(&self, key: &str) -> Result<Option<bool>> {
+        self.get(key).map(|v| v.as_bool().ok_or_else(|| Self::wrong(key, "true or false"))).transpose()
+    }
+    pub(crate) fn ints(&self, key: &str) -> Result<Vec<i64>> {
+        self.opt_ints(key)?.ok_or_else(|| Self::missing(key))
+    }
+    pub(crate) fn opt_ints(&self, key: &str) -> Result<Option<Vec<i64>>> {
+        let Some(v) = self.get(key) else { return Ok(None) };
+        let arr = v.as_array().ok_or_else(|| Self::wrong(key, "an array of integers"))?;
+        arr.iter().map(|x| x.as_i64().ok_or_else(|| Self::wrong(key, "an array of integers"))).collect::<Result<Vec<_>>>().map(Some)
+    }
+    /// A 1-based bookmark path → 0-based indices.
+    pub(crate) fn path(&self, key: &str) -> Result<Vec<usize>> {
+        let p = self.opt_path(key)?.ok_or_else(|| Self::missing(key))?;
+        if p.is_empty() {
+            return Err(ToolError::InvalidArgs(format!("{key} must not be empty")));
+        }
+        Ok(p)
+    }
+    pub(crate) fn opt_path(&self, key: &str) -> Result<Option<Vec<usize>>> {
+        let Some(v) = self.opt_ints(key)? else { return Ok(None) };
+        v.iter().map(|i| if *i >= 1 { Ok(*i as usize - 1) } else { Err(Self::wrong(key, "1-based positions")) }).collect::<Result<Vec<_>>>().map(Some)
+    }
+    /// A bookmark's `left` or `top`: points on the displayed page, `None` when left out, an error
+    /// when it is not a number or lies absurdly far off the page.
+    pub(crate) fn bookmark_coordinate(&self, key: &str) -> Result<Option<f32>> {
+        match self.opt_num(key)? {
+            None => Ok(None),
+            Some(v) if v.is_finite() && v.abs() <= MAX_BOOKMARK_POSITION => Ok(Some(v as f32)),
+            Some(_) => Err(ToolError::InvalidArgs(format!("{key} must be between -{MAX_BOOKMARK_POSITION} and {MAX_BOOKMARK_POSITION} points"))),
+        }
+    }
+    pub(crate) fn strs(&self, key: &str) -> Result<Vec<&str>> {
+        let v = self.get(key).ok_or_else(|| Self::missing(key))?;
+        let arr = v.as_array().ok_or_else(|| Self::wrong(key, "an array of strings"))?;
+        arr.iter().map(|x| x.as_str().ok_or_else(|| Self::wrong(key, "an array of strings"))).collect()
+    }
+}
+
+/// The name-tree keys of a document's own attachments, leaving out the files attached to pages as comments.
+pub(crate) fn document_attachment_keys(doc: &Document) -> Vec<String> {
+    doc.info
+        .attachments
+        .iter()
+        .filter_map(|x| match &x.source {
+            pdfcraft_render::AttachmentSource::Document { key } => Some(key.clone()),
+            pdfcraft_render::AttachmentSource::Annotation { .. } => None,
+        })
+        .collect()
+}
+
+/// Bookmark rows in listing order as JSON: a row holds the rows that follow it on the page at the
+/// next level down in `children`, and paths and pages are 1-based.
+pub(crate) fn nest_rows(rows: &[pdfcraft_engine::BookmarkRow], pages: &[pdfcraft_render::PageInfo]) -> Vec<Value> {
+    // The open rows, outermost first, with their depth and the children gathered so far.
+    let mut open: Vec<(usize, Value, Vec<Value>)> = Vec::new();
+    let mut roots = Vec::new();
+    for row in rows {
+        let depth = row.path.len().saturating_sub(1);
+        while open.last().is_some_and(|(d, _, _)| *d >= depth) {
+            close_row(&mut open, &mut roots);
+        }
+        let path: Vec<usize> = row.path.iter().map(|p| p.saturating_add(1)).collect();
+        let mut fields = json!({ "path": path, "title": row.title, "page": row.page.map(|p| p.saturating_add(1)), "open": row.open });
+        // Only what differs from the defaults (black, regular), as the PDF itself stores it.
+        if let Some(color) = row.color {
+            fields["color"] = json!(color);
+        }
+        if row.bold {
+            fields["bold"] = json!(true);
+        }
+        if row.italic {
+            fields["italic"] = json!(true);
+        }
+        if let Some(destination) = row.page.and_then(|p| pages.get(p)).and_then(|p| destination(&row.view, p)) {
+            fields["destination"] = destination;
+        }
+        open.push((depth, fields, Vec::new()));
+    }
+    while !open.is_empty() {
+        close_row(&mut open, &mut roots);
+    }
+    roots
+}
+
+/// Where on its page a bookmark or link goes, in points from the top-left of the displayed page
+/// like every `rect`: the destination type (`XYZ`, `Fit`, `FitH`, `FitV`, `FitR`) and its
+/// position, `null` where the destination leaves it unspecified (`/XYZ null null null` keeps the
+/// reader's position and zoom). `None` for a destination without a type.
+pub(crate) fn destination(view: &pdfcraft_render::DestView, page: &pdfcraft_render::PageInfo) -> Option<Value> {
+    use pdfcraft_render::DestView;
+    let points = |left: Option<f32>, top: Option<f32>| {
+        let [x, y] = page.dest_fraction(left, top, 0);
+        let round = |v: f32| f64::from((v * 100.0).round() / 100.0);
+        (x.map(|x| round(x * page.width)), y.map(|y| round(y * page.height)))
+    };
+    Some(match view {
+        DestView::Top => return None,
+        DestView::Xyz { left, top, zoom } => {
+            let (x, y) = points(*left, *top);
+            json!({ "fit": "XYZ", "left": x, "top": y, "zoom": zoom.map(f64::from) })
+        }
+        DestView::Fit => json!({ "fit": "Fit" }),
+        DestView::FitH { top } => {
+            let (x, y) = points(None, *top);
+            json!({ "fit": "FitH", "left": x, "top": y })
+        }
+        DestView::FitV { left } => {
+            let (x, y) = points(*left, None);
+            json!({ "fit": "FitV", "left": x, "top": y })
+        }
+        DestView::FitR { rect } => json!({ "fit": "FitR", "rect": comments::rect_to_view(page, *rect) }),
+    })
+}
+
+/// Closes the innermost open row: it joins the row above it as a child, or the top level.
+fn close_row(open: &mut Vec<(usize, Value, Vec<Value>)>, roots: &mut Vec<Value>) {
+    if let Some((_, mut fields, children)) = open.pop() {
+        fields["children"] = Value::Array(children);
+        match open.last_mut() {
+            Some((_, _, siblings)) => siblings.push(fields),
+            None => roots.push(fields),
+        }
+    }
+}
+
+pub(crate) fn one_based(pages: &[i64]) -> Result<Vec<usize>> {
+    pages
+        .iter()
+        .map(|p| if *p >= 1 { Ok(*p as usize - 1) } else { Err(ToolError::InvalidArgs(format!("page numbers start at 1 (got {p})"))) })
+        .collect()
+}
+
+/// The document's security as the next save writes it (never includes passwords).
+pub(crate) fn security(d: &Document) -> Value {
+    match d.security_summary() {
+        None => json!({ "protected": false }),
+        Some(s) => {
+            let p = s.permissions;
+            json!({
+                "protected": true,
+                "method": s.method,
+                "pending": s.pending,
+                "printing": if !p.print() { "none" } else if p.print_high_quality() { "high" } else { "low" },
+                "modify": p.modify(), "assemble": p.assemble(), "copy": p.copy(), "annotate": p.annotate(),
+                "fill_forms": p.fill_forms(), "accessibility": p.extract_for_accessibility(),
+            })
+        }
+    }
+}
+
+/// What every tool that changes a document returns.
+pub(crate) fn summary(d: &Document) -> Value {
+    json!({
+        "doc": d.id.0,
+        "name": d.name,
+        "path": d.path,
+        "pages": d.info.pages.len(),
+        "dirty": d.dirty,
+        "editable": d.read_only_reason.is_none(),
+        "read_only_reason": d.read_only_reason,
+        "encrypted": d.info.encrypted,
+        "undo": d.can_undo(),
+        "redo": d.can_redo(),
+    })
+}
+
+pub(crate) fn info(d: &Document) -> Value {
+    let i = &d.info;
+    let page1 = |p: usize| p + 1;
+    let mut security = security(d);
+    if let Some(s) = d.security_summary() {
+        security["opened_as_owner"] = json!(s.owner);
+    }
+    json!({
+        "document": summary(d),
+        "pdf_version": i.pdf_version,
+        "file_size": i.file_size,
+        "title": i.title, "author": i.author, "subject": i.subject, "keywords": i.keywords,
+        // Custom document properties (Document Properties ▸ Custom): /Info entries beyond the
+        // ones the spec names, set and cleared with doc_set_info.
+        "custom": i.custom.iter().map(|(name, value)| json!({ "name": name, "value": value })).collect::<Vec<_>>(),
+        "creator": i.creator, "producer": i.producer,
+        "tagged": i.tagged,
+        "has_javascript": i.has_javascript,
+        // Where the document opens (/OpenAction, named destinations resolved): 1-based page and
+        // destination, null without one.
+        "open_destination": i.open_dest.as_ref().map(|(p, view)| json!({ "page": page1(*p), "destination": i.pages.get(*p).and_then(|pg| destination(view, pg)) })),
+        // XFA forms: "static" (the PDF's own fields work; the XFA data is ignored) or "dynamic"
+        // (laid out from the template by PdfCraft, see xfa_layout; placeholder pages when that failed).
+        "xfa": i.xfa.map(|x| match x { pdfcraft_render::Xfa::Static => "static", pdfcraft_render::Xfa::Dynamic => "dynamic" }),
+        "xfa_layout": d.xfa.as_ref().map(|x| json!({ "pages": x.pages, "fields": x.fields, "warnings": x.warnings })),
+        // A script of the form ran too long and was abandoned: its scripts no longer run in this
+        // document (calculations, buttons) until it is opened again.
+        "xfa_scripts_off": d.xfa_scripts_off(),
+        // What was rewritten from, or could not be written to, the XFA data.
+        "xfa_warnings": d.xfa_warnings,
+        "security": security,
+        "pages": i.pages.iter().enumerate().map(|(n, p)| json!({
+            "page": n + 1, "label": p.label, "width": p.width, "height": p.height, "rotation": p.rotation,
+        })).collect::<Vec<_>>(),
+        "outline": outline(&i.outline),
+        "outline_more": i.outline_more,
+        // Rectangles use the tools' convention (top-left of the displayed page, like
+        // comment_list and link_list), not raw PDF user space, so they can be fed back to
+        // geometry-taking tools (#129).
+        "annotations": i.annotations.iter().map(|a| json!({
+            "page": page1(a.page), "type": a.subtype, "author": a.author, "contents": a.contents,
+            "modified": a.modified, "name": a.name, "in_reply_to": a.in_reply_to,
+            "rect": view_rect(i, a.page, a.shown_rect(i.pages.get(a.page).map_or(0, |p| p.rotation))),
+        })).collect::<Vec<_>>(),
+        "fields": i.fields.iter().map(|f| json!({
+            "name": f.name, "kind": format!("{:?}", f.kind), "value": f.value, "page": f.page.map(page1),
+            "tooltip": f.tooltip, "has_actions": f.has_actions,
+        })).collect::<Vec<_>>(),
+        "links": i.links.iter().map(|l| json!({
+            "page": page1(l.page), "rect": view_rect(i, l.page, l.rect),
+            "target": match &l.target {
+                pdfcraft_render::LinkTarget::Page(p, _) => json!({ "page": page1(*p) }),
+                pdfcraft_render::LinkTarget::Uri(u) => json!({ "uri": u }),
+                pdfcraft_render::LinkTarget::SetLayers { changes, preserve_rb } => json!({
+                    "layers": changes.iter().map(|(op, ocg)| json!({
+                        "layer": i.layers.iter().find(|l| l.id == *ocg).map(|l| l.name.as_str()),
+                        "state": match op {
+                            pdfcraft_render::LayerOp::On => "on",
+                            pdfcraft_render::LayerOp::Off => "off",
+                            pdfcraft_render::LayerOp::Toggle => "toggle",
+                        },
+                    })).collect::<Vec<_>>(),
+                    "preserve_rb": preserve_rb,
+                }),
+                pdfcraft_render::LinkTarget::RemoteGoTo { launch, file, destination, new_window } => json!({
+                    "action": if *launch { "Launch" } else { "GoToR" },
+                    "remote_document": file,
+                    "destination": match destination {
+                        pdfcraft_render::RemoteDestination::Default => json!({ "kind": "default" }),
+                        pdfcraft_render::RemoteDestination::Page { page, view } => json!({ "kind": "page", "page": page1(*page), "view": format!("{view:?}") }),
+                        pdfcraft_render::RemoteDestination::Named(name) => json!({ "kind": "named", "name": name }),
+                    },
+                    "new_window": new_window,
+                }),
+                pdfcraft_render::LinkTarget::Other(o) => json!({ "other": o }),
+            },
+        })).collect::<Vec<_>>(),
+        "layers": i.layers.iter().map(|l| json!({ "name": l.name, "visible": l.visible, "initial": l.initial })).collect::<Vec<_>>(),
+        // Full-screen presentation settings a page carries (ISO 32000-2 §12.4.4): only pages with
+        // a `/Trans` or `/Dur` appear; `style` is null for a display time alone.
+        "transitions": i.transitions.iter().map(|t| json!({
+            "page": page1(t.page), "style": t.style.map(pdfcraft_render::TransitionStyle::name), "duration": t.duration,
+            "horizontal": t.horizontal, "inward": t.inward, "direction": t.direction, "scale": t.scale, "opaque": t.opaque,
+            "display": t.display,
+        })).collect::<Vec<_>>(),
+        "attachments": i.attachments.iter().map(|a| json!({ "name": a.name, "description": a.description, "size": a.size })).collect::<Vec<_>>(),
+        // `substitute` names the face standing in for a program the document does not embed, and
+        // `substitution` says why. Both are null for an embedded font: nothing stands in. A null
+        // `substitute` with a non-null `substitution` means no face was available at all, so
+        // nothing is drawn for that font -- which is the answer to "why is my text missing?".
+        "fonts": i.fonts.iter().map(|f| json!({
+            "name": f.name, "kind": f.kind, "embedded": f.embedded, "subset": f.subset, "encoding": f.encoding,
+            "substitute": f.substitute, "substitution": f.substitution,
+        })).collect::<Vec<_>>(),
+        "warnings": i.warnings,
+        "repairs": d.repair_log(),
+    })
+}
+
+/// A user-space rectangle on 0-based `page` in displayed-page coordinates (points from the
+/// top-left of the page as displayed, y down, after `/Rotate`), the way every tool reports
+/// rectangles; unchanged when the page is unknown (a malformed annotation that points at no page).
+/// Public so `pdfcraft-cli` reports the same rectangles as the tools.
+pub fn view_rect(i: &pdfcraft_render::DocInfo, page: usize, rect: [f32; 4]) -> [f32; 4] {
+    i.pages.get(page).map_or(rect, |p| comments::rect_to_view(p, rect))
+}
+
+fn outline(items: &[pdfcraft_render::OutlineItem]) -> Value {
+    Value::Array(items.iter().map(|o| json!({ "title": o.title, "page": o.page.map(|p| p + 1), "children": outline(&o.children) })).collect())
+}
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index af4c490bd6..e1ae0141c4 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -45,72 +45,32 @@ use serde_json::{Value, json};
 pub use pdfcraft_render::Pixels;
 pub use tools::{ToolDef, tools};
 
-/// One piece of a tool's result.
-#[derive(Clone, Debug, PartialEq)]
-pub enum Content {
-    /// Structured data (MCP: a text block with the JSON plus `structuredContent`).
-    Json(Value),
-    /// A PNG image.
-    Png { data: Vec<u8>, width: u32, height: u32 },
-}
-
-/// Why a tool call failed.
-#[derive(Clone, Debug, PartialEq)]
-pub enum ToolError {
-    /// No tool has this name.
-    UnknownTool(String),
-    /// The arguments don't match the tool's schema.
-    InvalidArgs(String),
-    /// The tool ran and failed (the message is for the agent to read).
-    Failed(String),
-}
-
-impl std::fmt::Display for ToolError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            ToolError::UnknownTool(t) => write!(f, "unknown tool {t:?}"),
-            ToolError::InvalidArgs(m) | ToolError::Failed(m) => f.write_str(m),
-        }
-    }
-}
-
-impl std::error::Error for ToolError {}
-
-type Result<T> = std::result::Result<T, ToolError>;
-
-fn failed(e: impl std::fmt::Display) -> ToolError {
-    ToolError::Failed(e.to_string())
-}
-
-impl From<pdfcraft_engine::EditError> for ToolError {
-    fn from(e: pdfcraft_engine::EditError) -> Self {
-        failed(e)
-    }
-}
-
-/// Default and maximum resolution for `page_render`.
-const DEFAULT_DPI: f64 = 96.0;
-const MAX_DPI: f64 = 600.0;
-/// How far a watermark may be moved from the page centre, in points (a page is at most 14,400).
-const WATERMARK_MAX_OFFSET: f64 = 20_000.0;
-
-/// Bookmarks in one page of the bookmark list, by default and at most.
-const BOOKMARK_PAGE: usize = 100;
-const MAX_BOOKMARK_PAGE: usize = 1000;
-/// How far from the page's corner a bookmark's position may be given, in points (a PDF page is at
-/// most 14 400 across).
-const MAX_BOOKMARK_POSITION: f64 = 1_000_000.0;
-
-/// `text_find` extracts this many pages first, doubling each batch up to [`FIND_MAX_BATCH`], so a
-/// match near the start returns without touching the rest of a long document (#971).
-const FIND_FIRST_BATCH: usize = 8;
-const FIND_MAX_BATCH: usize = 128;
-
+use file_access::foreign_share;
 use text_cache::TextCache;
 
-type PageTexts = Vec<(usize, std::result::Result<Arc<PageText>, String>)>;
-const FIND_MAX_WARNINGS: usize = 100;
-const FIND_MAX_WARNING_BYTES: usize = 1024;
+mod assemble;
+mod dispatch;
+mod documents;
+mod error;
+mod json;
+mod pages;
+mod paths;
+
+pub use dispatch::Content;
+pub use error::ToolError;
+use error::{Result, failed};
+pub(crate) use json::destination;
+pub use json::view_rect;
+use json::{Args, info, summary};
+use pages::{DEFAULT_DPI, MAX_DPI, encode_png};
+#[cfg(test)]
+use pages::{FIND_FIRST_BATCH, FIND_MAX_WARNING_BYTES, FIND_MAX_WARNINGS, extract_parallel};
+#[cfg(test)]
+pub(crate) use paths::MAX_INPUT;
+use paths::{child, lexical, unused, write_atomic};
+pub(crate) use paths::{read_input, read_input_bytes};
+#[cfg(test)]
+use paths::{write_atomic_synced, write_atomic_with};
 
 /// A headless PdfCraft session driven by tool calls.
 pub struct Automation {
@@ -173,6 +133,12 @@ impl Automation {
         self
     }
 
+    /// Multiply the time XFA form scripts may take (tests). See [`Session::with_xfa_time_scale`].
+    pub fn with_xfa_time_scale(mut self, factor: u32) -> Self {
+        self.session = std::mem::take(&mut self.session).with_xfa_time_scale(factor);
+        self
+    }
+
     /// The clock and time zone of a host without its own. See [`Session::with_wall_clock`].
     pub fn with_wall_clock(mut self, clock: fn() -> i64, utc_offset: fn() -> i64) -> Self {
         self.session = std::mem::take(&mut self.session).with_wall_clock(clock, utc_offset);
@@ -198,3225 +164,7 @@ impl Automation {
         }
         Ok(target)
     }
-
-    /// Run the tool `name` with JSON `args` (an object; `null` means no arguments).
-    pub fn call(&mut self, name: &str, args: &Value) -> Result<Vec<Content>> {
-        let empty = json!({});
-        let args = if args.is_null() { &empty } else { args };
-        if !args.is_object() {
-            return Err(ToolError::InvalidArgs("arguments must be a JSON object".into()));
-        }
-        let def = tools::find(name).ok_or_else(|| ToolError::UnknownTool(name.into()))?;
-        tools::check_args(def, args)?;
-        let a = Args(args);
-        let out = match name {
-            "doc_open" => self.doc_open(&a)?,
-            "doc_batch" => self.doc_batch(&a)?,
-            "doc_list" => json!({ "documents": self.session.docs().iter().map(summary).collect::<Vec<_>>() }),
-            "doc_info" => {
-                let id = self.doc(&a)?.id;
-                self.session.refresh_fonts(id);
-                info(self.doc(&a)?)
-            }
-            "doc_close" => self.doc_close(&a)?,
-            "doc_save" => self.doc_save(&a)?,
-            "doc_set_info" => {
-                let edit = Edit::SetInfo { key: a.str("key")?.into(), value: a.str("value")?.into() };
-                self.apply(&a, edit)?
-            }
-            "page_render" => return self.page_render(&a).map(|c| vec![c]),
-            "comment_image_preview" => return self.comment_image_preview(&a),
-            "text_extract" => self.text_extract(&a)?,
-            "text_word_count" => self.text_word_count(&a)?,
-            "text_find" => self.text_find(&a)?,
-            "page_rotate" => {
-                let degrees = a.int("degrees")?;
-                if degrees % 90 != 0 {
-                    return Err(ToolError::InvalidArgs("degrees must be a multiple of 90".into()));
-                }
-                let doc = self.doc(&a)?;
-                let base = match a.opt_ints("pages")? {
-                    Some(_) => self.pages(&a, "pages")?,
-                    None => (0..doc.info.pages.len()).collect(),
-                };
-                let parity = match a.opt_str("subset")?.unwrap_or("all") {
-                    "all" => pdfcraft_engine::PageParity::Both,
-                    "even" => pdfcraft_engine::PageParity::Even,
-                    "odd" => pdfcraft_engine::PageParity::Odd,
-                    s => return Err(ToolError::InvalidArgs(format!("unknown subset {s:?} (all, even, odd)"))),
-                };
-                let orientation = match a.opt_str("orientation")?.unwrap_or("all") {
-                    "all" => pdfcraft_engine::PageOrientation::Both,
-                    "landscape" => pdfcraft_engine::PageOrientation::Landscape,
-                    "portrait" => pdfcraft_engine::PageOrientation::Portrait,
-                    o => return Err(ToolError::InvalidArgs(format!("unknown orientation {o:?} (all, landscape, portrait)"))),
-                };
-                let pages = pdfcraft_engine::filter_pages(&self.doc(&a)?.info, &base, parity, orientation);
-                if pages.is_empty() {
-                    return Err(failed("no pages match the filters"));
-                }
-                let n = pages.len();
-                let mut out = self.apply(&a, Edit::RotatePages { pages, degrees })?;
-                out["rotated"] = json!(n);
-                out
-            }
-            "page_enhance_camera" => {
-                let page = self.page(&a)?;
-                let given = a.nums::<8>("corners")?;
-                let doc = self.doc(&a)?;
-                let (id, info) = (doc.id, doc.info.pages.get(page).cloned().ok_or_else(|| failed("no such page"))?);
-                let corners = match given {
-                    Some(c) => [0, 1, 2, 3].map(|i| {
-                        let [x, y] = info.view_to_user(c[2 * i] as f32, c[2 * i + 1] as f32);
-                        [x as f64, y as f64]
-                    }),
-                    None => self.session.detect_camera_corners(id, page).ok_or_else(|| {
-                        failed("the document's edges could not be found on this page: pass `corners` [x1, y1, x2, y2, x3, y3, x4, y4]")
-                    })?,
-                };
-                let level = match a.opt_int("level")? {
-                    None => 0,
-                    Some(l @ 0..=100) => l as u8,
-                    Some(l) => return Err(ToolError::InvalidArgs(format!("level must be between 0 and 100, not {l}"))),
-                };
-                let look = match a.opt_str("mode")? {
-                    None => pdfcraft_engine::camera_clean::Look::Colour,
-                    Some(m) => pdfcraft_engine::camera_clean::Look::from_name(m)
-                        .ok_or_else(|| ToolError::InvalidArgs(format!("unknown mode {m:?} (original, colour, greyscale, bw)")))?,
-                };
-                self.session.enhance_camera_page_at(id, page, corners, look, level).map_err(failed)?;
-                let r = |v: f32| (v * 100.0).round() / 100.0;
-                let used: Vec<f32> = corners.iter().flat_map(|&[x, y]| info.user_to_view(x as f32, y as f32)).map(r).collect();
-                let mut out = summary(self.doc(&a)?);
-                out["corners"] = json!(used);
-                out["detected"] = json!(given.is_none());
-                out
-            }
-            "page_delete" => {
-                let pages = self.pages(&a, "pages")?;
-                self.apply(&a, Edit::DeletePages { pages })?
-            }
-            "page_move" => {
-                let pages = self.pages(&a, "pages")?;
-                let to = self.position(&a, "to")?;
-                self.apply(&a, Edit::MovePages { pages, to })?
-            }
-            "page_reverse" => {
-                let pages = match a.opt_ints("pages")? {
-                    Some(_) => self.pages(&a, "pages")?,
-                    None => (0..self.doc(&a)?.info.pages.len()).collect(),
-                };
-                self.apply(&a, Edit::ReversePages { pages })?
-            }
-            "page_insert_blank" => self.insert_blank(&a)?,
-            "page_insert_file" => self.insert_file(&a)?,
-            "page_extract" => self.page_extract(&a)?,
-            "doc_combine" => self.doc_combine(&a)?,
-            "doc_create_multiple" => self.doc_create_multiple(&a)?,
-            "doc_split" => self.doc_split(&a)?,
-            "edit_undo" => {
-                let id = self.doc(&a)?.id;
-                let label = self.session.undo(id).map_err(failed)?.to_string();
-                json!({ "undone": label, "document": summary(self.doc(&a)?) })
-            }
-            "edit_redo" => {
-                let id = self.doc(&a)?.id;
-                let label = self.session.redo(id).map_err(failed)?.to_string();
-                json!({ "redone": label, "document": summary(self.doc(&a)?) })
-            }
-            "command_list" => self.command_list(&a)?,
-            "command_run" => return self.command_run(&a),
-            "command_batch" => self.command_batch(&a)?,
-            "doc_inspect" => self.doc_inspect(&a)?,
-            "render_preview" => return self.render_preview(&a).map(|c| vec![c]),
-            "page_number" => {
-                use pdfcraft_organize::LabelStyle as L;
-                let n = self.doc(&a)?.info.pages.len();
-                let (from, to) = (a.int("from")?, a.int("to")?);
-                if from < 1 || to < from || to as usize > n {
-                    return Err(ToolError::InvalidArgs(format!("from and to must satisfy 1 ≤ from ≤ to ≤ {n}")));
-                }
-                let style = match a.opt_str("style")?.unwrap_or("decimal") {
-                    "decimal" => L::Decimal,
-                    "upper-roman" => L::UpperRoman,
-                    "lower-roman" => L::LowerRoman,
-                    "upper-alpha" => L::UpperAlpha,
-                    "lower-alpha" => L::LowerAlpha,
-                    "none" => L::None,
-                    other => return Err(ToolError::InvalidArgs(format!("unknown style {other:?}"))),
-                };
-                let prefix = a.opt_str("prefix")?.unwrap_or_default().to_string();
-                let first = a.opt_int("start")?.unwrap_or(1).clamp(1, u32::MAX as i64) as u32;
-                let mut out = self.apply(&a, Edit::NumberPages { from: from as usize - 1, to: to as usize - 1, style, prefix, first })?;
-                out["labels"] = json!(self.doc(&a)?.info.pages.iter().map(|p| p.label.clone()).collect::<Vec<_>>());
-                out
-            }
-            "bookmark_list" => self.bookmark_listing(&a)?,
-            "bookmark_add" => {
-                let page = self.page(&a)?;
-                let parent = a.opt_path("parent")?.unwrap_or_default();
-                let index = a.opt_int("position")?.map_or(usize::MAX, |p| (p.max(1) - 1) as usize);
-                let title = a.str("title")?.to_string();
-                let (left, top) = (a.bookmark_coordinate("left")?, a.bookmark_coordinate("top")?);
-                let [left, top] = match self.doc(&a)?.info.pages.get(page) {
-                    Some(p) => p.xyz_for_view(left, top),
-                    None => [None, None],
-                };
-                let (left, top) = (left.map(f64::from), top.map(f64::from));
-                self.apply(&a, Edit::AddBookmark { parent, index, title, page, left, top })?
-            }
-            "bookmark_rename" => {
-                let (path, title) = (a.path("path")?, a.str("title")?.to_string());
-                self.apply(&a, Edit::RenameBookmark { path, title })?
-            }
-            "bookmark_delete" => {
-                let path = a.path("path")?;
-                self.apply(&a, Edit::DeleteBookmark { path })?
-            }
-            "bookmark_move" => {
-                let from = a.path("path")?;
-                let to_parent = a.opt_path("parent")?.unwrap_or_default();
-                let index = a.opt_int("position")?.map_or(usize::MAX, |p| (p.max(1) - 1) as usize);
-                self.apply(&a, Edit::MoveBookmark { from, to_parent, index })?
-            }
-            "bookmark_set_page" => {
-                let (path, page) = (a.path("path")?, self.page(&a)?);
-                self.apply(&a, Edit::SetBookmarkPage { path, page })?
-            }
-            "bookmark_set_style" => {
-                let path = a.path("path")?;
-                // Left out keeps the colour; [0, 0, 0] is the default black.
-                let color = match a.get("color") {
-                    None => None,
-                    Some(v) => {
-                        let rgb: Option<Vec<f64>> = v.as_array().and_then(|c| c.iter().map(Value::as_f64).collect());
-                        match rgb.as_deref() {
-                            Some(&[r, g, b]) if [r, g, b].iter().all(|c| (0.0..=1.0).contains(c)) => Some([r, g, b]),
-                            _ => return Err(ToolError::InvalidArgs("color must be [r, g, b], each from 0 to 1".into())),
-                        }
-                    }
-                };
-                let (bold, italic) = (a.opt_bool("bold")?, a.opt_bool("italic")?);
-                if color.is_none() && bold.is_none() && italic.is_none() {
-                    return Err(ToolError::InvalidArgs("give color, bold or italic".into()));
-                }
-                let mut edits = Vec::new();
-                if let Some(color) = color {
-                    edits.push(Edit::SetBookmarkColor { path: path.clone(), color: Some(color) });
-                }
-                if bold.is_some() || italic.is_some() {
-                    edits.push(Edit::SetBookmarkStyle { path, bold, italic });
-                }
-                // A colour and a style given together are one step to undo, applied all or nothing.
-                match edits.len() {
-                    1 => self.apply(&a, edits.remove(0))?,
-                    _ => self.apply(&a, Edit::Batch { label: "Style".into(), edits })?,
-                }
-            }
-            "bookmark_from_structure" => {
-                let mut out = self.apply(&a, Edit::BookmarksFromStructure)?;
-                let listing = self.bookmark_listing(&a)?;
-                out["bookmarks"] = listing["bookmarks"].clone();
-                out["next"] = listing["next"].clone();
-                out
-            }
-            "doc_protect" => self.doc_protect(&a)?,
-            "page_replace" => {
-                let pages = self.pages(&a, "pages")?;
-                let path = self.resolve(a.str("path")?, false)?;
-                let bytes = Arc::new(read_input(&path)?);
-                let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-                let src_pages = match a.opt_ints("from_pages")? {
-                    Some(p) => one_based(&p)?,
-                    None => (0..pages.len()).collect(),
-                };
-                self.apply(&a, Edit::ReplacePages { pages, name, bytes, src_pages })?
-            }
-            "page_duplicate" => {
-                let pages = self.pages(&a, "pages")?;
-                let at = self.opt_position(&a, "at")?;
-                self.apply(&a, Edit::DuplicatePages { pages, at })?
-            }
-            "page_set_box" => self.page_set_box(&a)?,
-            "page_transition_set" => self.page_transition_set(&a)?,
-            "doc_create" => self.doc_create(&a)?,
-            "xfa_to_static" => self.apply(&a, Edit::XfaToStatic)?,
-            "doc_flatten" => {
-                let (comments, fields) = (a.opt_bool("comments")?.unwrap_or(true), a.opt_bool("fields")?.unwrap_or(true));
-                if !comments && !fields {
-                    return Err(ToolError::InvalidArgs("nothing to flatten".into()));
-                }
-                self.apply(&a, Edit::Flatten { comments, fields })?
-            }
-            "doc_reduce" => {
-                let id = self.doc(&a)?.id;
-                let before = self.doc(&a)?.bytes.len();
-                let path = self.resolve(a.str("path")?, true)?;
-                let (bytes, merged) = self.session.reduced_bytes(id).map_err(failed)?;
-                // As in the app, a copy that isn't smaller is not written (#490).
-                let written = bytes.len() < before;
-                if written {
-                    write_atomic(&path, &bytes)?;
-                }
-                json!({ "path": path.to_string_lossy(), "written": written, "bytes_before": before, "bytes_after": bytes.len(), "merged_objects": merged })
-            }
-            "doc_optimize" => self.doc_optimize(&a)?,
-            "doc_initial_view" => self.doc_initial_view(&a)?,
-            "doc_revisions" => self.doc_revisions(&a)?,
-            "text_lines" => {
-                let page = self.page(&a)?;
-                let doc = self.doc_to_copy(&a)?;
-                let info = &doc.info.pages[page];
-                let r = |x: f32| (x as f64 * 100.0).round() / 100.0;
-                let lines: Vec<Value> = doc
-                    .text_lines(page)
-                    .iter()
-                    .enumerate()
-                    .map(|(i, l)| {
-                        let (u, v) = (info.user_to_view(l.rect[0] as f32, l.rect[1] as f32), info.user_to_view(l.rect[2] as f32, l.rect[3] as f32));
-                        json!({
-                            "line": i + 1,
-                            "text": l.text,
-                            "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))],
-                            "font": l.base_font,
-                            "size": (l.size * 100.0).round() / 100.0,
-                        })
-                    })
-                    .collect();
-                json!({ "page": page + 1, "count": lines.len(), "lines": lines })
-            }
-            "image_hit" => {
-                let page = self.page(&a)?;
-                let point = a
-                    .get("point")
-                    .and_then(Value::as_array)
-                    .filter(|p| p.len() == 2)
-                    .and_then(|p| Some([p.first()?.as_f64()?, p.get(1)?.as_f64()?]))
-                    .filter(|p| p.iter().all(|v| v.is_finite() && v.abs() <= 1e9))
-                    .ok_or_else(|| ToolError::InvalidArgs("point must contain two finite coordinates".into()))?;
-                let doc = self.doc(&a)?;
-                let p = &doc.info.pages[page];
-                let user = p.view_to_user(point[0] as f32, point[1] as f32).map(f64::from);
-                let images: Vec<_> = doc.page_images(page).iter().enumerate().filter(|(_, im)| im.contains(user)).map(|(i, _)| i + 1).collect();
-                json!({"page":page+1,"images":images})
-            }
-            "page_images" => {
-                let page = self.page(&a)?;
-                let doc = self.doc(&a)?;
-                let info = &doc.info.pages[page];
-                let r = |x: f32| (x as f64 * 100.0).round() / 100.0;
-                let list: Vec<Value> = doc
-                    .page_images(page)
-                    .iter()
-                    .enumerate()
-                    .map(|(i, im)| {
-                        let (u, v) = (info.user_to_view(im.rect[0] as f32, im.rect[1] as f32), info.user_to_view(im.rect[2] as f32, im.rect[3] as f32));
-                        let visible = im.visible_rect.map(|rect| {
-                            let (u, v) = (info.user_to_view(rect[0] as f32, rect[1] as f32), info.user_to_view(rect[2] as f32, rect[3] as f32));
-                            [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))]
-                        });
-                        json!({ "visible_rect": visible, "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
-                    })
-                    .collect();
-                json!({ "page": page + 1, "count": list.len(), "images": list })
-            }
-            "image_edit" | "image_save" => {
-                let page = self.page(&a)?;
-                let n = self.doc(&a)?.page_images(page).len();
-                let k = a.int("image")?;
-                if k < 1 || k as usize > n {
-                    return Err(ToolError::InvalidArgs(format!("image {k} is out of range: page {} has {n} images", page + 1)));
-                }
-                let index = k as usize - 1;
-                if name == "image_save" {
-                    let (ext, bytes) = self.doc(&a)?.page_image_file(page, index).map_err(failed)?;
-                    let mut path = self.resolve(a.str("path")?, true)?;
-                    if path.is_dir() {
-                        // Adding the extension to a folder's name would write beside it: "." is the
-                        // root, so that would land outside it.
-                        return Err(failed(format!("{}: is a folder, not a file", path.display())));
-                    }
-                    if path.extension().is_none() {
-                        path.set_extension(ext);
-                    }
-                    write_atomic(&path, &bytes)?;
-                    json!({ "path": path.to_string_lossy(), "format": ext, "bytes": bytes.len() })
-                } else {
-                    use pdfcraft_engine::ImageEdit;
-                    let change = match a.str("action")? {
-                        "move" => {
-                            let r: Vec<f64> =
-                                a.get("rect").and_then(Value::as_array).map(|x| x.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
-                            let r = <[f64; 4]>::try_from(r).map_err(|_| ToolError::InvalidArgs("move needs rect: 4 numbers".into()))?;
-                            // Top-left-origin points → user space.
-                            let info = &self.doc(&a)?.info.pages[page];
-                            let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
-                            ImageEdit::Move([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
-                        }
-                        "rotate_by" => ImageEdit::RotateBy(
-                            a.get("degrees")
-                                .and_then(Value::as_f64)
-                                .ok_or_else(|| ToolError::InvalidArgs("rotate_by needs degrees: a number (clockwise)".into()))?,
-                        ),
-                        "rotate" => ImageEdit::Rotate(a.opt_int("quarters")?.unwrap_or(1) as i32),
-                        "crop" => {
-                            let r: Vec<f64> =
-                                a.get("rect").and_then(Value::as_array).map(|x| x.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
-                            let r =
-                                <[f64; 4]>::try_from(r).map_err(|_| ToolError::InvalidArgs("crop needs rect: 4 numbers, the part to keep".into()))?;
-                            let info = &self.doc(&a)?.info.pages[page];
-                            let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
-                            ImageEdit::Crop([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
-                        }
-                        "flip_horizontal" => ImageEdit::Flip { horizontal: true },
-                        "flip_vertical" => ImageEdit::Flip { horizontal: false },
-                        "delete" => ImageEdit::Delete,
-                        "replace" => {
-                            let path = self.resolve(a.str("path")?, false)?;
-                            let bytes = read_input(&path)?;
-                            ImageEdit::Replace {
-                                name: path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(),
-                                bytes: Arc::new(bytes),
-                            }
-                        }
-                        other => return Err(ToolError::InvalidArgs(format!("unknown action {other:?}"))),
-                    };
-                    self.apply(&a, Edit::EditPageImage { page, index, change })?
-                }
-            }
-            "text_paragraphs" => {
-                let page = self.page(&a)?;
-                let doc = self.doc_to_copy(&a)?;
-                let info = &doc.info.pages[page];
-                let r = |x: f32| (x as f64 * 100.0).round() / 100.0;
-                let current = doc.text_blocks(page);
-                let id = doc.id;
-                let blocks: Vec<Value> = current
-                    .iter()
-                    .enumerate()
-                    .map(|(i, b)| {
-                        let (u, v) = (info.user_to_view(b.rect[0] as f32, b.rect[1] as f32), info.user_to_view(b.rect[2] as f32, b.rect[3] as f32));
-                        json!({
-                            "paragraph": i + 1,
-                            "text": b.text,
-                            "editor_text": b.editor_text,
-                            "rows": b.rows.iter().map(|row| row.iter().map(|i| i + 1).collect::<Vec<_>>()).collect::<Vec<_>>(),
-                            "lines": b.lines.iter().map(|l| l + 1).collect::<Vec<_>>(),
-                            "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))],
-                            "font": b.base_font,
-                            "size": (b.size * 100.0).round() / 100.0,
-                        })
-                    })
-                    .collect();
-                self.record_listing(id, page, &current);
-                json!({ "page": page + 1, "count": blocks.len(), "paragraphs": blocks })
-            }
-            "text_font_files" => {
-                let roots = if let Some(paths) = a.get("directories") {
-                    let paths = paths
-                        .as_array()
-                        .filter(|p| p.len() <= 16)
-                        .ok_or_else(|| ToolError::InvalidArgs("directories must be at most 16 paths".into()))?;
-                    paths
-                        .iter()
-                        .map(|p| self.resolve(p.as_str().ok_or_else(|| ToolError::InvalidArgs("directory must be a path".into()))?, false))
-                        .collect::<Result<Vec<_>>>()?
-                } else if let Some(roots) = &self.roots {
-                    // The installed fonts are outside the roots: look in the read root instead.
-                    let read = roots
-                        .read_root()
-                        .ok_or_else(|| failed("automation filesystem access is not granted: read authority is absent: installed fonts"))?;
-                    vec![self.resolve(&read.to_string_lossy(), false)?]
-                } else if let Some(root) = &self.root {
-                    vec![root.clone()]
-                } else {
-                    pdfcraft_engine::text_fonts::installed_directories()
-                };
-                json!({"fonts": pdfcraft_engine::text_fonts::discover(&roots).into_iter().map(|f| json!({"path":f.path,"family":f.family,"font":f.face})).collect::<Vec<_>>()})
-            }
-            "text_font_import" => {
-                let page = self.page(&a)?;
-                let path = self.resolve(a.str("path")?, false)?;
-                let file = std::fs::File::open(&path).map_err(failed)?;
-                use std::io::Read;
-                let mut bytes = Vec::new();
-                file.take((16 << 20) + 1).read_to_end(&mut bytes).map_err(failed)?;
-                if bytes.len() > 16 << 20 {
-                    return Err(ToolError::InvalidArgs("font input exceeds 16 MiB".into()));
-                }
-                let before: Vec<_> = self.doc(&a)?.text_editor_fonts(page).into_iter().map(|f| f.resource).collect();
-                let mut out = self.apply(&a, Edit::RegisterTextFont { page, bytes: Arc::new(bytes) })?;
-                let added = self
-                    .doc(&a)?
-                    .text_editor_fonts(page)
-                    .into_iter()
-                    .find(|f| !before.contains(&f.resource) && !f.resource.starts_with("PCApproved"));
-                if let Some(f) = added {
-                    out["resource"] = json!(f.resource);
-                    out["font"] = json!(f.face);
-                }
-                out
-            }
-            "text_fonts" => {
-                let page = self.page(&a)?;
-                json!({"fonts": self.doc(&a)?.text_editor_fonts(page).into_iter().map(|f| json!({"resource":f.resource,"font":f.face,"full_face":f.resource.starts_with("PCFull"),"preview_only":f.resource.starts_with("PCApproved")})).collect::<Vec<_>>()})
-            }
-            "text_edit_layout" => {
-                let page = self.page(&a)?;
-                let doc = self.doc(&a)?;
-                let k = a.int("paragraph")?;
-                let blocks = doc.text_blocks(page);
-                let index = self.paragraph_index(doc.id, page, k, &blocks)?;
-                let source = blocks.get(index).ok_or_else(|| ToolError::InvalidArgs("paragraph is out of range".into()))?;
-                let text = a.opt_str("text")?.unwrap_or(&source.editor_text);
-                let style = pdfcraft_engine::BlockStyle {
-                    size: a.opt_num("size")?,
-                    width: a.opt_num("width")?,
-                    resource: a.opt_str("font_resource")?.map(str::to_owned),
-                    ranges: parse_style_ranges(a.get("ranges"))?,
-                    ..Default::default()
-                };
-                let layout = doc.text_edit_layout(page, index, text, &style).map_err(failed)?;
-                let info = &doc.info.pages[page];
-                let view_rect = |r: [f64; 4]| {
-                    let a = info.user_to_view(r[0] as f32, r[1] as f32);
-                    let b = info.user_to_view(r[2] as f32, r[3] as f32);
-                    [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
-                };
-                let fonts: Vec<_> = doc.text_editor_fonts(page).into_iter().map(|f| json!({"resource": f.resource, "face": f.face})).collect();
-                json!({ "page": page + 1, "paragraph": k, "source_rect": view_rect(layout.source_rect),
-                    "draft_rect": layout.draft_rect.map(view_rect), "overflow": layout.overflow, "embedded_fonts": fonts })
-            }
-            "text_edit" if a.get("paragraph").is_some() => {
-                let page = self.page(&a)?;
-                let k = a.int("paragraph")?;
-                let (id, blocks) = {
-                    let doc = self.doc(&a)?;
-                    (doc.id, doc.text_blocks(page))
-                };
-                let index = self.paragraph_index(id, page, k, &blocks)?;
-                let block = blocks.get(index).cloned().ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range")))?;
-                let text = a.opt_str("text")?.map(str::to_owned).unwrap_or(block.text);
-                let mut style = pdfcraft_engine::BlockStyle {
-                    ranges: parse_style_ranges(a.get("ranges"))?,
-                    resource: a.opt_str("font_resource")?.map(str::to_owned),
-                    bold: a.opt_bool("bold")?,
-                    size: a.opt_num("size")?,
-                    underline: a.opt_bool("underline")?,
-                    line_spacing: a.opt_num("line_spacing")?,
-                    char_spacing: a.opt_num("char_spacing")?,
-                    scale: a.opt_num("scale")?,
-                    width: a.opt_num("width")?,
-                    ..Default::default()
-                };
-                let (dx, dy) = (a.opt_num("dx")?, a.opt_num("dy")?);
-                if dx.is_some() || dy.is_some() {
-                    style.offset = Some([dx.unwrap_or(0.0), dy.unwrap_or(0.0)]);
-                }
-                if let Some(f) = a.opt_str("font")? {
-                    let family = match f {
-                        "helvetica" => pdfcraft_engine::FontFamily::Helvetica,
-                        "times" => pdfcraft_engine::FontFamily::Times,
-                        "courier" => pdfcraft_engine::FontFamily::Courier,
-                        other => return Err(ToolError::InvalidArgs(format!("unknown font {other:?} (helvetica, times, courier)"))),
-                    };
-                    style.family = Some((family, a.opt_bool("bold")?.unwrap_or(false), a.opt_bool("italic")?.unwrap_or(false)));
-                }
-                if let Some(c) = a.opt_str("color")? {
-                    style.color = Some(comments::parse_color(c)?);
-                }
-                if let Some(al) = a.opt_str("align")? {
-                    style.align = Some(match al {
-                        "left" => pdfcraft_engine::TextAlign::Left,
-                        "center" => pdfcraft_engine::TextAlign::Center,
-                        "right" => pdfcraft_engine::TextAlign::Right,
-                        "justify" => pdfcraft_engine::TextAlign::Justify,
-                        other => return Err(ToolError::InvalidArgs(format!("unknown align {other:?}"))),
-                    });
-                }
-                // Where the paragraph is drawn after the edit: moved by dx, dy (up is +dy).
-                let [dx, dy] = style.offset.unwrap_or([0.0, 0.0]);
-                let moved = [block.rect[0] + dx, block.rect[1] + dy, block.rect[2] + dx, block.rect[3] + dy];
-                let wanted: String = text.split_whitespace().collect();
-                let mut out = self.apply(&a, Edit::EditTextBlock { page, block: index, text, style })?;
-                let doc = self.doc(&a)?;
-                let after = doc.text_blocks(page);
-                // Without `text` the paragraph keeps the document's own words: not echoed when
-                // the document doesn't allow copying them.
-                let copy = doc.allows_copying();
-                // Only a paragraph that now shows exactly the requested text is the edited one. A
-                // neighbour that overlaps the old box (overlaid text, a text layer) must not take
-                // its number, and neither must a paragraph the edit merged it into: rewriting that
-                // one by this number would drop the neighbour's text.
-                let edited = block_overlapping(&after, moved)
-                    .filter(|&i| !wanted.is_empty() && after.get(i).is_some_and(|b| b.text.split_whitespace().collect::<String>() == wanted));
-                if let Some(b) = edited.and_then(|i| after.get(i)) {
-                    out["paragraph"] = json!({ "lines": b.lines.len(), "font": b.base_font });
-                    if copy {
-                        out["paragraph"]["text"] = json!(b.text);
-                    }
-                }
-                let stale = self.follow_edit(id, page, k, edited.and_then(|i| after.get(i)), &after);
-                if !stale.is_empty() {
-                    out["stale_paragraphs"] = json!(stale);
-                }
-                out
-            }
-            "text_edit" => {
-                let page = self.page(&a)?;
-                let n = self.doc(&a)?.text_lines(page).len();
-                let line = a.int("line")?;
-                if line < 1 || line as usize > n {
-                    return Err(ToolError::InvalidArgs(format!("line {line} is out of range: page {} has {n} lines", page + 1)));
-                }
-                let text = a.str("text")?.to_owned();
-                let mut out = self.apply(&a, Edit::EditTextLine { page, line: line as usize - 1, text })?;
-                let after = self.doc(&a)?.text_lines(page);
-                if let Some(l) = after.get(line as usize - 1) {
-                    out["line"] = json!({ "text": l.text, "font": l.base_font });
-                }
-                out
-            }
-            "doc_audit_space" => {
-                let rows: Vec<Value> = self
-                    .doc(&a)?
-                    .audit_space()
-                    .iter()
-                    .map(|u| json!({ "category": u.category.label(), "bytes": u.bytes, "percent": (u.percent * 100.0).round() / 100.0 }))
-                    .collect();
-                json!({ "categories": rows })
-            }
-            "doc_open_revision" => {
-                let id = self.doc(&a)?.id;
-                let n = usize::try_from(a.opt_int("revision")?.ok_or_else(|| ToolError::InvalidArgs("revision is required".into()))?).unwrap_or(0);
-                let new = self.session.open_revision(id, n).map_err(failed)?;
-                summary(self.session.get(new).ok_or_else(|| failed("the document vanished"))?)
-            }
-            "doc_export_images" | "doc_export_text" | "doc_export_all_images" => self.export(name, &a)?,
-            "doc_header_footer" | "doc_watermark" | "doc_background" | "doc_remove_marks" => self.marks(name, &a)?,
-            "doc_unprotect" => {
-                let mut out = self.apply(&a, Edit::RemoveProtection)?;
-                out["security"] = security(self.doc(&a)?);
-                out
-            }
-            "form_fields" => self.form_fields(&a)?,
-            "form_fill" => self.form_fill(&a)?,
-            "form_set_image" => {
-                let path = self.resolve(a.str("path")?, false)?;
-                let bytes = read_input(&path)?;
-                self.apply(&a, Edit::SetFieldImage { name: a.str("field")?.to_owned(), image: Arc::new(bytes) })?
-            }
-            "form_reset" => self.form_reset(&a)?,
-            "form_add_field" => self.form_add_field(&a)?,
-            "form_add_field_table" => self.form_add_field_table(&a)?,
-            "form_set_props" => self.form_set_props(&a)?,
-            "form_delete_field" => self.form_delete_field(&a)?,
-            "form_tab_order" => self.form_tab_order(&a)?,
-            "form_calculation_order" => self.form_calculation_order(&a)?,
-            "doc_export_data" => self.doc_export_data(&a)?,
-            "doc_import_data" => self.doc_import_data(&a)?,
-            "redact_mark" => self.redact_mark(&a)?,
-            "redact_apply" => self.redact_apply(&a)?,
-            "redact_clear" => self.redact_clear(&a)?,
-            "doc_hidden_info" => self.doc_hidden_info(&a)?,
-            "printers" => self.printers()?,
-            "printer_options" => self.printer_options(&a)?,
-            "link_list" => self.link_list(&a)?,
-            "link_open" => self.link_open(&a)?,
-            "link_add" => self.link_add(&a)?,
-            "link_edit" => self.link_edit(&a)?,
-            "link_delete" => self.link_delete(&a)?,
-            "links_from_urls" => self.links_from_urls(&a)?,
-            "links_remove" => self.links_remove(&a)?,
-            "object_list" => self.object_list(&a)?,
-            "object_move" => self.object_move(&a)?,
-            "content_list" => self.content_list(&a)?,
-            "page_add_text" => self.page_add_text(&a)?,
-            "page_add_image" => self.page_add_image(&a)?,
-            "content_update" => self.content_update(&a)?,
-            "content_delete" => self.content_delete(&a)?,
-            "content_copy" => self.content_copy(&a)?,
-            "doc_print" => self.doc_print(&a)?,
-            "attachment_add" => {
-                let path = self.resolve(a.str("path")?, false)?;
-                let bytes = read_input(&path)?;
-                let name = match a.opt_str("name")? {
-                    Some(n) => n.to_string(),
-                    None => path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(),
-                };
-                let mime = pdfcraft_engine::mime_for_name(&name).map(str::to_string);
-                let description = a.opt_str("description")?.map(str::to_string);
-                // Only the document-level keys: an annotation attachment of the same name is not the new one.
-                let before = document_attachment_keys(self.doc(&a)?);
-                let out = self.apply(&a, Edit::AddAttachment { name, bytes, description, mime })?;
-                let key = document_attachment_keys(self.doc(&a)?).into_iter().find(|n| !before.contains(n)).unwrap_or_default();
-                json!({ "name": key, "document": out })
-            }
-            "attachment_delete" => {
-                let edit = Edit::DeleteAttachment { key: a.str("name")?.into() };
-                self.apply(&a, edit)?
-            }
-            "doc_remove_hidden" => self.doc_remove_hidden(&a)?,
-            "doc_audit_redactions" => self.doc_audit_redactions(&a)?,
-            "fill_sign_add" => self.fill_sign_add(&a)?,
-            "fill_sign_date_format" => self.fill_sign_date_format(&a)?,
-            "measure_distance" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Distance)?,
-            "measure_perimeter" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Perimeter)?,
-            "measure_area" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Area)?,
-            "measure_info" => self.measurement_info(&a)?,
-            "measure_list" => self.measurement_list(&a)?,
-            "measure_scale" => self.measurement_scale(&a)?,
-            "measure_snap" => self.measurement_snap(&a)?,
-            "measure_export" => self.measurement_export(&a)?,
-            "comment_list" => self.comment_list(&a)?,
-            "comment_add" => self.comment_add(&a)?,
-            "stamp_custom" => self.stamp_custom(&a)?,
-            "comment_reply" => self.comment_reply(&a)?,
-            "comment_set_status" => self.comment_set_status(&a)?,
-            "sign_list" => self.sign_list(&a)?,
-            "accessibility_check" => self.a11y_check(&a)?,
-            "accessibility_find_untagged" => self.a11y_find_untagged(&a)?,
-            "accessibility_autotag_preview" => self.accessibility_autotag_preview(&a)?,
-            "accessibility_autotag_apply" => self.accessibility_autotag_apply(&a)?,
-            "accessibility_autotag_form_fields" => self.accessibility_autotag_form_fields(&a)?,
-            "ocr_recognize" => self.ocr_recognize(&a)?,
-            "js_run" => self.js_run(&a)?,
-            "js_document_scripts" => self.js_document_scripts(&a)?,
-            "js_set_document_script" => self.js_set_document_script(&a)?,
-            "js_enabled" => self.js_enabled(&a)?,
-            "form_set_script" => self.form_set_script(&a)?,
-            "form_merge_data" => self.form_merge_data(&a)?,
-            "form_actions" => self.form_actions(&a)?,
-            "form_detect_fields" => self.form_detect_fields(&a)?,
-            "doc_compare" => self.doc_compare(&a)?,
-            "action_list" => self.action_list()?,
-            "pdfa_verify" => self.pdfa_verify(&a)?,
-            "print_readiness" => self.print_readiness(&a)?,
-            "doc_export_office" => self.doc_export_office(&a)?,
-            "pdfa_convert" => self.pdfa_convert(&a)?,
-            "standards_remove_id" => {
-                let standard = match a.str("standard")? {
-                    "pdfa" => pdfcraft_engine::Standard::PdfA,
-                    "pdfx" => pdfcraft_engine::Standard::PdfX,
-                    other => return Err(ToolError::InvalidArgs(format!("standard must be pdfa or pdfx, not {other}"))),
-                };
-                self.apply(&a, Edit::RemoveStandardId { standard })?
-            }
-            "action_run" => self.action_run(&a)?,
-            "doc_compare_report" => self.doc_compare_report(&a)?,
-            "doc_compare_mark" => self.doc_compare_mark(&a)?,
-            "form_set_actions" => self.form_set_actions(&a)?,
-            "ocr_status" => self.ocr_status()?,
-            "ocr_recognize_files" => self.ocr_recognize_files(&a)?,
-            "accessibility_report" => self.a11y_report(&a)?,
-            "accessibility_review_record" => self.a11y_review_record(&a)?,
-            "accessibility_review_save" => self.a11y_review_save(&a)?,
-            "accessibility_review_load" => self.a11y_review_load(&a)?,
-            "accessibility_review_html" => self.a11y_review_html(&a)?,
-            "accessibility_fix" => self.a11y_fix(&a)?,
-            "accessibility_figures" => self.accessibility_figures(&a)?,
-            "accessibility_set_alt" => self.accessibility_set_alt(&a)?,
-            "accessibility_tags" => self.accessibility_tags(&a)?,
-            "accessibility_tag_content" => self.accessibility_tag_content(&a)?,
-            "accessibility_set_tag_property" => self.accessibility_set_tag_property(&a)?,
-            "accessibility_mark_tag_artifact" => self.accessibility_mark_tag_artifact(&a)?,
-            "accessibility_move_tag" => self.accessibility_move_tag(&a)?,
-            "sign_id_create" => self.sign_id_create(&a)?,
-            "sign_document" => self.sign_document(&a)?,
-            "sign_keychain_ids" => {
-                #[cfg(target_os = "macos")]
-                let ids: Vec<Value> = pdfcraft_engine::sign::keychain::identities(None)
-                    .map_err(failed)?
-                    .iter()
-                    .map(|id| json!({ "id": pdfcraft_engine::sign::keychain::reference(&id.certificate), "certificate": signing::cert_json(&id.certificate) }))
-                    .collect();
-                #[cfg(not(target_os = "macos"))]
-                let ids: Vec<Value> = Vec::new();
-                json!({ "count": ids.len(), "ids": ids })
-            }
-            "sign_windows_ids" => {
-                #[cfg(target_os = "windows")]
-                let (ids, unusable): (Vec<Value>, Vec<Value>) = {
-                    let listing = pdfcraft_engine::sign::windows::list().map_err(failed)?;
-                    let ids = listing
-                        .ids
-                        .iter()
-                        .map(|id| json!({ "id": pdfcraft_engine::sign::windows::reference(&id.certificate), "certificate": signing::cert_json(&id.certificate) }))
-                        .collect();
-                    let unusable = listing
-                        .unusable
-                        .iter()
-                        .map(|u| json!({ "subject": u.subject, "sha256": u.fingerprint, "reason": u.reason, "no_private_key": u.no_private_key }))
-                        .collect();
-                    (ids, unusable)
-                };
-                #[cfg(not(target_os = "windows"))]
-                let (ids, unusable): (Vec<Value>, Vec<Value>) = (Vec::new(), Vec::new());
-                json!({ "count": ids.len(), "ids": ids, "unusable": unusable })
-            }
-            "sign_trust" => self.sign_trust(&a)?,
-            "comment_mark" => self.comment_mark(&a)?,
-            "comment_lock" => self.comment_lock(&a)?,
-            "comments_hide" => self.comments_hide(&a)?,
-            "layer_set" => self.layer_set(&a)?,
-            "view_reading_colors" => self.view_reading_colors(&a)?,
-            "comments_summarize" => self.comments_summarize(&a)?,
-            "comment_edit" => self.comment_edit(&a)?,
-            "comment_delete" => self.comment_delete(&a)?,
-            other => return Err(ToolError::UnknownTool(other.into())),
-        };
-        Ok(vec![Content::Json(out)])
-    }
-
-    // ---- documents ---------------------------------------------------------------------------
-
-    /// One page of a document's bookmarks: `offset` (from 0) and `limit` (1 to `MAX_BOOKMARK_PAGE`).
-    fn bookmark_listing(&self, a: &Args) -> Result<Value> {
-        let id = a.int("doc")?;
-        let id = DocId(u64::try_from(id).map_err(|_| ToolError::InvalidArgs("doc must be positive".into()))?);
-        let offset = a.opt_int("offset")?.unwrap_or(0);
-        let offset = usize::try_from(offset).map_err(|_| ToolError::InvalidArgs("offset must be 0 or more".into()))?;
-        let limit = a.opt_int("limit")?.unwrap_or(BOOKMARK_PAGE as i64);
-        let limit = usize::try_from(limit)
-            .ok()
-            .filter(|l| (1..=MAX_BOOKMARK_PAGE).contains(l))
-            .ok_or_else(|| ToolError::InvalidArgs(format!("limit must be from 1 to {MAX_BOOKMARK_PAGE}")))?;
-        let page = self
-            .session
-            .bookmark_page(id, offset, limit)
-            .ok_or_else(|| ToolError::Failed(format!("no open document with id {} (see doc_list)", id.0)))?;
-        let pages = &self.doc(a)?.info.pages;
-        Ok(json!({ "bookmarks": nest_rows(&page.rows, pages), "next": page.next, "truncated": page.truncated }))
-    }
-
-    fn doc(&self, a: &Args) -> Result<&Document> {
-        let id = a.int("doc")?;
-        let id = u64::try_from(id).map_err(|_| ToolError::InvalidArgs("doc must be positive".into()))?;
-        self.session.get(DocId(id)).ok_or_else(|| ToolError::Failed(format!("no open document with id {id} (see doc_list)")))
-    }
-
-    /// Most pages whose paragraph listing is remembered.
-    const MAX_LISTINGS: usize = 256;
-
-    /// Remember the paragraphs `text_paragraphs` just listed for `page`, so their numbers can be
-    /// resolved against that listing.
-    fn record_listing(&mut self, doc: DocId, page: usize, blocks: &[TextBlock]) {
-        if self.listed.len() >= Self::MAX_LISTINGS && !self.listed.contains_key(&(doc, page)) {
-            self.evicted.extend(self.listed.keys().map(|(d, _)| *d));
-            self.listed.clear();
-        }
-        self.listed.insert((doc, page), blocks.iter().map(BlockKey::of).collect());
-    }
-
-    /// The index in `blocks` (the page's paragraphs now) of paragraph number `k` (1-based).
-    ///
-    /// After `text_paragraphs` a number names the paragraph that listing showed, wherever it is
-    /// now. Without a listing it is a position in `blocks`. A paragraph an edit merged into a
-    /// neighbour (or changed) is refused: the number would otherwise rewrite another paragraph
-    /// and lose its text (#2516). So is any number on a page of a document whose listings were
-    /// dropped at the cap, until the page is listed again.
-    fn paragraph_index(&self, doc: DocId, page: usize, k: i64, blocks: &[TextBlock]) -> Result<usize> {
-        let keys = self.listed.get(&(doc, page));
-        if keys.is_none() && self.evicted.contains(&doc) {
-            return Err(ToolError::InvalidArgs(format!(
-                "page {} has no paragraph listing any more: too many pages were listed and the oldest listings were dropped. List the page again with text_paragraphs",
-                page + 1
-            )));
-        }
-        let n = keys.map_or(blocks.len(), Vec::len);
-        let i = usize::try_from(k)
-            .ok()
-            .and_then(|k| k.checked_sub(1))
-            .filter(|i| *i < n)
-            .ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range: page {} has {n} paragraphs", page + 1)))?;
-        let Some(keys) = keys else { return Ok(i) };
-        keys.get(i).and_then(|key| key.find(blocks, i)).ok_or_else(|| {
-            ToolError::InvalidArgs(format!(
-                "paragraph {k} of page {} is no longer a paragraph of its own: an edit changed it or how the page is grouped. List the page again with text_paragraphs",
-                page + 1
-            ))
-        })
-    }
-
-    /// Update the listing after paragraph `k` was edited into `edited`, one of the page's
-    /// paragraphs `after`. Returns the numbers of the listed paragraphs that are gone.
-    fn follow_edit(&mut self, doc: DocId, page: usize, k: i64, edited: Option<&TextBlock>, after: &[TextBlock]) -> Vec<usize> {
-        let Some(keys) = self.listed.get_mut(&(doc, page)) else { return Vec::new() };
-        if let (Some(edited), Some(key)) = (edited, usize::try_from(k).ok().and_then(|k| k.checked_sub(1)).and_then(|i| keys.get_mut(i))) {
-            *key = BlockKey::of(edited);
-        }
-        keys.iter().enumerate().filter(|(i, key)| key.find(after, *i).is_none()).map(|(i, _)| i + 1).collect()
-    }
-
-    /// The document, if its security allows copying text and images out of it (Table 22, bit 5).
-    fn doc_to_copy(&self, a: &Args) -> Result<&Document> {
-        let doc = self.doc(a)?;
-        doc.check_copying().map_err(failed)?;
-        Ok(doc)
-    }
-
-    fn doc_open(&mut self, a: &Args) -> Result<Value> {
-        let path = self.resolve(a.str("path")?, false)?;
-        let bytes = read_input(&path)?;
-        let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-        let id = self.session.open(name, Some(path.to_string_lossy().into_owned()), Arc::new(bytes), a.opt_str("password")?).map_err(failed)?;
-        let doc = self.session.get(id).ok_or_else(|| failed("the document vanished"))?;
-        Ok(summary(doc))
-    }
-
-    fn doc_close(&mut self, a: &Args) -> Result<Value> {
-        let doc = self.doc(a)?;
-        let id = doc.id;
-        let discard_changes = a.opt_bool("discard_changes")?.unwrap_or(false);
-        if doc.dirty && !discard_changes {
-            return Err(failed("the document has unsaved changes: save it with doc_save, or pass discard_changes: true"));
-        }
-        self.session.close(id);
-        self.renderers.remove(&id);
-        self.texts.remove(&id);
-        self.listed.retain(|(d, _), _| *d != id);
-        self.evicted.remove(&id);
-        Ok(json!({ "closed": id.0 }))
-    }
-
-    fn doc_save(&mut self, a: &Args) -> Result<Value> {
-        self.doc_save_with(a, write_atomic)
-    }
-
-    fn doc_save_with(&mut self, a: &Args, write: impl FnOnce(&Path, &[u8]) -> Result<()>) -> Result<Value> {
-        let doc = self.doc(a)?;
-        let id = doc.id;
-        let target = match a.opt_str("path")? {
-            Some(p) => self.resolve(p, true)?,
-            None => {
-                // Saving in place writes where the file was opened from, which the read root
-                // allows and the write root may not.
-                let own = doc.path.clone().ok_or_else(|| failed("the document has never been saved: pass a path"))?;
-                let own_path = PathBuf::from(&own);
-                self.check_roots(&own, &own_path, file_access::Access::Write)?;
-                own_path
-            }
-        };
-        let same_file = doc.path.as_deref().is_some_and(|p| Path::new(p) == target);
-        // Saving to a new file is a full rewrite unless asked otherwise, like Save As.
-        let full = a.opt_bool("full")?.unwrap_or(!same_file);
-        let flatten_fill_sign = a.opt_bool("flatten_fill_sign")?.unwrap_or(false);
-        if flatten_fill_sign {
-            self.apply(a, Edit::FlattenFillSign)?;
-        }
-        let bytes = if full { self.session.save_full_bytes(id) } else { self.session.save_bytes(id) }.map_err(failed)?;
-        // A save that adds or removes encryption, or must not keep the old revision (Sanitize,
-        // redaction), is rewritten in full even when an incremental save was asked for.
-        let incremental = !full && bytes.starts_with(&self.doc(a)?.saved_bytes());
-        self.publish_save(id, &target, bytes, incremental, write)
-    }
-
-    /// Validate the prepared bytes before publishing them or marking the document saved.
-    fn publish_save(
-        &mut self,
-        id: DocId,
-        target: &Path,
-        bytes: Arc<Vec<u8>>,
-        incremental: bool,
-        write: impl FnOnce(&Path, &[u8]) -> Result<()>,
-    ) -> Result<Value> {
-        self.session.check_save(id, &bytes).map_err(failed)?;
-        write(target, &bytes)?;
-        let path = target.to_string_lossy().into_owned();
-        self.session.mark_saved(id, bytes.clone(), Some(path.clone())).map_err(failed)?;
-        let doc = self.session.get(id).ok_or_else(|| failed("the saved document is no longer open"))?;
-        Ok(json!({ "path": path, "bytes": bytes.len(), "incremental": incremental, "document": summary(doc) }))
-    }
-
-    fn doc_revisions(&mut self, a: &Args) -> Result<Value> {
-        let doc = self.doc(a)?;
-        let ends = doc.revision_ends();
-        let sigs = doc.signatures.clone();
-        let list: Vec<Value> = ends
-            .iter()
-            .enumerate()
-            .map(|(i, end)| {
-                let start = if i == 0 { 0 } else { ends[i - 1] };
-                // A signature signs the revision its byte range ends in.
-                let signed: Vec<&str> =
-                    sigs.iter().filter(|s| s.signed && s.signed_len > start && s.signed_len <= *end).map(|s| s.field.as_str()).collect();
-                json!({ "revision": i + 1, "end": end, "bytes": end - start, "signed_by": signed })
-            })
-            .collect();
-        Ok(json!({ "revisions": list, "unsaved_changes": doc.dirty }))
-    }
-
-    fn doc_initial_view(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::{InitialLayout as L, Magnification as M, Navigation as N};
-        let bad = |m: String| ToolError::InvalidArgs(m);
-        let mut v = self.doc(a)?.initial_view();
-        let before = v.clone();
-        if let Some(n) = a.opt_str("navigation")? {
-            v.navigation = match n {
-                "page" => N::PageOnly,
-                "bookmarks" => N::Bookmarks,
-                "pages" => N::Pages,
-                "attachments" => N::Attachments,
-                "layers" => N::Layers,
-                o => return Err(bad(format!("unknown navigation {o:?}"))),
-            };
-        }
-        if let Some(l) = a.opt_str("layout")? {
-            v.layout = match l {
-                "default" => L::Default,
-                "single" => L::SinglePage,
-                "continuous" => L::SinglePageContinuous,
-                "two_up" => L::TwoUp,
-                "two_up_continuous" => L::TwoUpContinuous,
-                "two_up_cover" => L::TwoUpCoverPage,
-                "two_up_continuous_cover" => L::TwoUpContinuousCoverPage,
-                o => return Err(bad(format!("unknown layout {o:?}"))),
-            };
-        }
-        match a.get("magnification") {
-            None => {}
-            Some(Value::Number(p)) => v.magnification = M::Percent(p.as_f64().unwrap_or(100.0).clamp(1.0, 6400.0)),
-            Some(Value::String(m)) => {
-                v.magnification = match m.as_str() {
-                    "default" => M::Default,
-                    "actual" => M::ActualSize,
-                    "fit_page" => M::FitPage,
-                    "fit_width" => M::FitWidth,
-                    "fit_height" => M::FitHeight,
-                    "fit_visible" => M::FitVisible,
-                    o => return Err(bad(format!("unknown magnification {o:?}"))),
-                }
-            }
-            Some(_) => return Err(bad("magnification is a name or a percentage".into())),
-        }
-        if let Some(p) = a.opt_int("page")? {
-            v.page = (p.max(1) - 1) as usize;
-        }
-        for (k, f) in [
-            ("fit_window", &mut v.fit_window),
-            ("center_window", &mut v.center_window),
-            ("full_screen", &mut v.full_screen),
-            ("display_title", &mut v.display_title),
-            ("hide_menubar", &mut v.hide_menubar),
-            ("hide_toolbar", &mut v.hide_toolbar),
-            ("hide_window_ui", &mut v.hide_window_ui),
-        ] {
-            if let Some(b) = a.opt_bool(k)? {
-                *f = b;
-            }
-        }
-        if let Some(l) = a.opt_str("language")? {
-            v.language = (!l.trim().is_empty()).then(|| l.trim().to_string());
-        }
-        if let Some(b) = a.opt_str("binding")? {
-            v.right_to_left = match b {
-                "left" => false,
-                "right" => true,
-                o => return Err(bad(format!("binding is left or right, not {o:?}"))),
-            };
-        }
-        let mut out = if v != before { self.apply(a, Edit::SetInitialView(Box::new(v.clone())))? } else { json!({}) };
-        out["initial_view"] = json!({
-            "navigation": format!("{:?}", v.navigation),
-            "layout": format!("{:?}", v.layout),
-            "magnification": format!("{:?}", v.magnification),
-            "page": v.page + 1,
-            "fit_window": v.fit_window,
-            "center_window": v.center_window,
-            "full_screen": v.full_screen,
-            "display_title": v.display_title,
-            "hide_menubar": v.hide_menubar,
-            "hide_toolbar": v.hide_toolbar,
-            "hide_window_ui": v.hide_window_ui,
-            "language": v.language,
-            "binding": if v.right_to_left { "right" } else { "left" },
-        });
-        Ok(out)
-    }
-
-    fn doc_optimize(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, Preset};
-        let id = self.doc(a)?.id;
-        let before = self.doc(a)?.bytes.len();
-        let path = self.resolve(a.str("path")?, true)?;
-        let mut settings = match a.opt_str("preset")? {
-            None => Preset::Standard.settings(),
-            Some(p) => Preset::from_name(p).ok_or_else(|| ToolError::InvalidArgs(format!("unknown preset {p:?} (standard, mobile)")))?.settings(),
-        };
-        if let Some(c) = a.opt_str("compatibility")? {
-            settings.compatibility = Compatibility::from_name(c)
-                .ok_or_else(|| ToolError::InvalidArgs(format!("unknown compatibility {c:?} (retain, 1.4, 1.5, 1.6, 1.7, 2.0)")))?;
-        }
-        let images = |key: &str, base: ImageSettings| -> Result<ImageSettings> {
-            let Some(v) = a.get(key) else { return Ok(base) };
-            let mut s = base;
-            if let Some(d) = v.get("downsample").and_then(Value::as_bool) {
-                s.downsample = d;
-            }
-            if let Some(p) = v.get("ppi").and_then(Value::as_f64) {
-                s.target_ppi = p.clamp(9.0, 2400.0);
-            }
-            if let Some(p) = v.get("above_ppi").and_then(Value::as_f64) {
-                s.above_ppi = p.clamp(9.0, 2400.0);
-            }
-            s.above_ppi = s.above_ppi.max(s.target_ppi);
-            if let Some(c) = v.get("compression").and_then(Value::as_str) {
-                let q = v.get("quality").and_then(Value::as_u64).unwrap_or(60).clamp(1, 100) as u8;
-                s.compression = match c {
-                    "jpeg" => Compression::Jpeg(q),
-                    "zip" | "flate" => Compression::Flate,
-                    "retain" => Compression::Retain,
-                    other => return Err(ToolError::InvalidArgs(format!("unknown compression {other:?} (jpeg, zip, retain)"))),
-                };
-            }
-            Ok(s)
-        };
-        settings.color = images("color", settings.color)?;
-        settings.gray = images("gray", settings.gray)?;
-        for (key, flag) in [
-            ("merge_fragments", &mut settings.merge_fragments),
-            ("discard_thumbnails", &mut settings.discard_thumbnails),
-            ("discard_alternate_images", &mut settings.discard_alternate_images),
-            ("discard_tags", &mut settings.discard_tags),
-            ("discard_print_settings", &mut settings.discard_print_settings),
-            ("flate_unencoded", &mut settings.flate_unencoded),
-            ("object_streams", &mut settings.object_streams),
-            ("lzw_to_flate", &mut settings.lzw_to_flate),
-            ("remove_invalid_links", &mut settings.remove_invalid_links),
-            ("remove_unreferenced_dests", &mut settings.remove_unreferenced_dests),
-            ("discard_external_refs", &mut settings.discard_external_refs),
-        ] {
-            if let Some(b) = a.opt_bool(key)? {
-                *flag = b;
-            }
-        }
-        let discard: Vec<pdfcraft_engine::Hidden> = match a.get("discard") {
-            None => Vec::new(),
-            Some(v) => v
-                .as_array()
-                .ok_or_else(|| ToolError::InvalidArgs("discard must be an array".into()))?
-                .iter()
-                .map(|x| {
-                    x.as_str()
-                        .and_then(pdfcraft_engine::Hidden::from_id)
-                        .ok_or_else(|| ToolError::InvalidArgs(format!("unknown discard category {x}")))
-                })
-                .collect::<Result<_>>()?,
-        };
-        let (bytes, r) = self.session.optimized_bytes(id, &settings, &discard).map_err(failed)?;
-        write_atomic(&path, &bytes)?;
-        fn valid_version(v: &[u8]) -> Option<&str> {
-            if matches!(v, [b'1'..=b'9', b'.', b'0'..=b'9']) { std::str::from_utf8(v).ok() } else { None }
-        }
-        let catalog_version = (settings.compatibility == Compatibility::Retain)
-            .then(|| {
-                let pw = self.doc(a).ok().and_then(|d| d.password.as_deref());
-                let doc = pdfcraft_cos::Document::open_with_password(bytes.clone(), pw).ok()?;
-                let root = doc.root()?;
-                doc.get(root).as_dict()?.name(b"Version").and_then(valid_version).map(str::to_owned)
-            })
-            .flatten();
-        let header_version = bytes.strip_prefix(b"%PDF-").and_then(|b| b.get(..3)).and_then(valid_version);
-        // Viewers read the later of the two (object streams raise the header past a lower catalog
-        // entry). Both are "d.d", so text order is version order.
-        let pdf_version = catalog_version.as_deref().into_iter().chain(header_version).max();
-        let o = &r.optimize;
-        Ok(json!({
-            "path": path.to_string_lossy(),
-            "pdf_version": pdf_version,
-            "object_streams": settings.effective_object_streams(),
-            "bytes_before": before,
-            "bytes_after": bytes.len(),
-            "merged_images": o.merged_images,
-            "fragments_merged": o.fragments_merged,
-            "images": o.images,
-            "images_resampled": o.images_resampled,
-            "images_recompressed": o.images_recompressed,
-            "image_bytes_before": o.image_bytes_before,
-            "image_bytes_after": o.image_bytes_after,
-            "thumbnails": o.thumbnails,
-            "alternate_images": o.alternate_images,
-            "tags_removed": o.tags_removed,
-            "streams_compressed": o.streams_compressed,
-            "lzw_streams": o.lzw_streams,
-            "invalid_links": o.invalid_links,
-            "invalid_bookmarks": o.invalid_bookmarks,
-            "unreferenced_dests": o.unreferenced_dests,
-            "external_links": o.external_links,
-            "external_bookmarks": o.external_bookmarks,
-            "unused_xobjects": o.unused_xobjects,
-            "merged_objects": r.merged,
-            "discarded": r.discarded.iter().map(|(h, n)| json!({ "category": h.id(), "count": n })).collect::<Vec<_>>(),
-        }))
-    }
-
-    /// A watermark or background picture: `file` (an image or a PDF) and `file_page` (1-based).
-    fn mark_file(&self, a: &Args) -> Result<Option<pdfcraft_engine::MarkFile>> {
-        let Some(p) = a.opt_str("file")? else { return Ok(None) };
-        let path = self.resolve(p, false)?;
-        let bytes = read_input(&path)?;
-        let page = a.opt_int("file_page")?.unwrap_or(1).max(1) as usize - 1;
-        Ok(Some(pdfcraft_engine::MarkFile {
-            name: path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(),
-            bytes: Arc::new(bytes),
-            page,
-        }))
-    }
-
-    fn apply(&mut self, a: &Args, edit: Edit) -> Result<Value> {
-        let id = self.doc(a)?.id;
-        self.session.apply(id, edit).map_err(failed)?;
-        let doc = self.doc(a)?;
-        let mut out = summary(doc);
-        // Text the edit stored as typed but drew with `?` (its font can't draw it): said, not silent.
-        if !doc.edit_notices.is_empty() {
-            out["warnings"] = json!(doc.edit_notices.iter().map(ToString::to_string).collect::<Vec<_>>());
-        }
-        Ok(out)
-    }
-
-    fn marks(&mut self, tool: &str, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::{Background, HeaderFooter, MarkKind, Watermark};
-        let n = self.doc(a)?.info.pages.len();
-        let pages = match a.opt_ints("pages")? {
-            Some(_) => self.pages(a, "pages")?,
-            None => (0..n).collect(),
-        };
-        let color =
-            |key: &str, default: [f64; 3]| -> Result<[f64; 3]> { Ok(a.opt_str(key)?.map(comments::parse_color).transpose()?.unwrap_or(default)) };
-        let replace = a.opt_bool("replace")?.unwrap_or(false);
-        let edit = match tool {
-            "doc_header_footer" => {
-                let mut hf = HeaderFooter::default();
-                for (k, key) in ["header_left", "header_center", "header_right", "footer_left", "footer_center", "footer_right"].iter().enumerate() {
-                    hf.text[k] = a.opt_str(key)?.unwrap_or_default().to_string();
-                }
-                if let Some(s) = a.opt_num("font_size")? {
-                    hf.font_size = s;
-                }
-                hf.font = match a.opt_str("font")? {
-                    None | Some("Helvetica") => pdfcraft_engine::FontFamily::Helvetica,
-                    Some("Times") => pdfcraft_engine::FontFamily::Times,
-                    Some("Courier") => pdfcraft_engine::FontFamily::Courier,
-                    Some(other) => {
-                        return Err(ToolError::InvalidArgs(format!("font must be \"Helvetica\", \"Times\" or \"Courier\", not {other:?}")));
-                    }
-                };
-                hf.color = color("color", hf.color)?;
-                if let Some(m) = a.get("margins").and_then(Value::as_array) {
-                    let m: Vec<f64> = m.iter().filter_map(Value::as_f64).collect();
-                    hf.margins = <[f64; 4]>::try_from(m).map_err(|_| ToolError::InvalidArgs("margins must be 4 numbers".into()))?;
-                }
-                if let Some(s) = a.opt_int("start_number")? {
-                    hf.start_number = s.clamp(1, u32::MAX as i64) as u32;
-                }
-                hf.shrink = a.opt_bool("shrink")?.unwrap_or(false);
-                Edit::AddHeaderFooter { pages, settings: hf, replace }
-            }
-            "doc_watermark" => {
-                let d = Watermark::default();
-                let file = self.mark_file(a)?;
-                let text = match &file {
-                    Some(_) => a.opt_str("text")?.unwrap_or_default().to_string(),
-                    None => a.str("text")?.to_string(),
-                };
-                let wm = Watermark {
-                    text,
-                    source: None,
-                    scale: a.opt_num("scale")?.unwrap_or(d.scale).clamp(0.01, 1.0),
-                    font_size: a.opt_num("font_size")?.unwrap_or(0.0),
-                    color: color("color", d.color)?,
-                    opacity: a.opt_num("opacity")?.unwrap_or(d.opacity),
-                    rotation: a.opt_num("rotation")?.unwrap_or(d.rotation),
-                    behind: a.opt_bool("behind")?.unwrap_or(false),
-                    offset: [
-                        a.opt_num("offset_x")?.unwrap_or(0.0).clamp(-WATERMARK_MAX_OFFSET, WATERMARK_MAX_OFFSET),
-                        a.opt_num("offset_y")?.unwrap_or(0.0).clamp(-WATERMARK_MAX_OFFSET, WATERMARK_MAX_OFFSET),
-                    ],
-                };
-                Edit::AddWatermark { pages, settings: wm, replace, file }
-            }
-            "doc_background" => Edit::AddBackground {
-                pages,
-                settings: Background {
-                    color: color("color", [1.0; 3])?,
-                    opacity: a.opt_num("opacity")?.unwrap_or(1.0),
-                    scale: a.opt_num("scale")?.unwrap_or(1.0).clamp(0.01, 1.0),
-                    ..Background::default()
-                },
-                replace,
-                file: self.mark_file(a)?,
-            },
-            _ => {
-                let kind = match a.str("kind")? {
-                    "header_footer" => MarkKind::HeaderFooter,
-                    "watermark" => MarkKind::Watermark,
-                    "background" => MarkKind::Background,
-                    other => return Err(ToolError::InvalidArgs(format!("unknown kind {other:?}"))),
-                };
-                Edit::RemoveMarks { kind }
-            }
-        };
-        self.apply(a, edit)
-    }
-
-    fn export(&mut self, tool: &str, a: &Args) -> Result<Value> {
-        let doc = self.doc_to_copy(a)?;
-        let pages = match a.opt_ints("pages")? {
-            Some(_) => self.pages(a, "pages")?,
-            None => (0..doc.info.pages.len()).collect(),
-        };
-        let stem = doc.name.trim_end_matches(".pdf").trim_end_matches(".PDF").to_string();
-        let mut ex = pdfcraft_engine::export::Exporter::new(doc);
-        if tool == "doc_export_text" {
-            let path = self.resolve(a.str("path")?, true)?;
-            let text = ex.text_of(&pages).map_err(failed)?;
-            write_atomic(&path, text.as_bytes())?;
-            return Ok(json!({ "path": path.to_string_lossy(), "pages": pages.len(), "bytes": text.len() }));
-        }
-        let folder = self.resolve(a.str("folder")?, true)?;
-        std::fs::create_dir_all(&folder).map_err(|e| failed(format!("{}: {e}", folder.display())))?;
-        if tool == "doc_export_all_images" {
-            let min = u32::try_from(a.opt_int("min_size")?.unwrap_or(0).max(0)).unwrap_or(u32::MAX);
-            let out = pdfcraft_engine::export::extract_images(&doc.export_source(), &pages, min).map_err(failed)?;
-            let mut files = Vec::new();
-            for (k, img) in out.images.iter().enumerate() {
-                let path = child(&folder, &pdfcraft_engine::export::image_file_name(&stem, img, k + 1, doc.info.pages.len()));
-                write_atomic(&path, &img.data)?;
-                files.push(json!({ "path": path.to_string_lossy(), "page": img.page + 1, "width": img.width, "height": img.height }));
-            }
-            let skipped: Vec<Value> = out.skipped.iter().map(|(p, r, why)| json!({ "page": p + 1, "object": r.num, "reason": why })).collect();
-            return Ok(json!({ "count": files.len(), "files": files, "skipped": skipped }));
-        }
-        let dpi = a.opt_num("dpi")?.unwrap_or(150.0);
-        let quality = a.opt_int("quality")?.unwrap_or(85).clamp(1, 100) as u8;
-        let format = match a.opt_str("format")?.unwrap_or("png") {
-            "png" => pdfcraft_engine::export::ImageFormat::Png,
-            "jpeg" | "jpg" => pdfcraft_engine::export::ImageFormat::Jpeg { quality },
-            "tiff" | "tif" => pdfcraft_engine::export::ImageFormat::Tiff,
-            f => return Err(ToolError::InvalidArgs(format!("unknown format {f:?} (png, jpeg, tiff)"))),
-        };
-        let mut files = Vec::new();
-        let mut lowered = Vec::new();
-        for p in pages {
-            let img = ex.image(p, dpi, format).map_err(failed)?;
-            let path = child(&folder, &format!("{stem}_page_{}.{}", p + 1, format.extension()));
-            write_atomic(&path, &img)?;
-            files.push(path.to_string_lossy().into_owned());
-            // A page too large for the renderer at `dpi` is drawn at the most it allows.
-            let used = ex.dpi_used(p, dpi);
-            if used < dpi.clamp(18.0, 1200.0) - 0.5 {
-                lowered.push(json!({ "page": p + 1, "dpi": used.floor() }));
-            }
-        }
-        if lowered.is_empty() {
-            Ok(json!({ "count": files.len(), "files": files }))
-        } else {
-            Ok(json!({ "count": files.len(), "files": files, "lower_dpi": lowered }))
-        }
-    }
-
-    fn doc_create(&mut self, a: &Args) -> Result<Value> {
-        let (name, bytes) = match a.str("from")? {
-            "blank" => {
-                let n = a.opt_int("pages")?.unwrap_or(1).clamp(1, 10_000) as usize;
-                let (w, h) = (a.opt_num("width")?.unwrap_or(612.0), a.opt_num("height")?.unwrap_or(792.0));
-                ("Untitled.pdf".to_string(), self.session.create_blank(w, h, n).map_err(failed)?)
-            }
-            "images" => {
-                let resolution = a.opt_num("dpi")?.map_or(pdfcraft_engine::ImageResolution::Embedded, pdfcraft_engine::ImageResolution::Dpi);
-                let mut images = Vec::new();
-                for p in a.strs("paths")? {
-                    let path = self.resolve(p, false)?;
-                    let bytes = read_input(&path)?;
-                    images.push((path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default(), bytes));
-                }
-                let name = if images.len() == 1 {
-                    format!("{}.pdf", images[0].0.rsplit_once('.').map_or(images[0].0.as_str(), |(s, _)| s))
-                } else {
-                    "Images.pdf".into()
-                };
-                (name, self.session.create_from_images_with_resolution(&images, resolution).map_err(failed)?)
-            }
-            "text" => {
-                let (title, text) = match (a.opt_str("text")?, a.opt_str("path")?) {
-                    (Some(t), _) => ("Text".to_string(), t.to_string()),
-                    (None, Some(p)) => {
-                        let path = self.resolve(p, false)?;
-                        let t = read_input(&path)?;
-                        (path.file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default(), pdfcraft_engine::decode_text(&t))
-                    }
-                    (None, None) => return Err(ToolError::InvalidArgs("text needs `text` or `path`".into())),
-                };
-                // The page font is Helvetica/WinAnsi: text it would turn into `?` is refused (with
-                // its line) by `pdfcraft_create::from_text`, as for every other caller.
-                let bytes = self.session.create_from_text(&title, &text).map_err(|e| match e {
-                    pdfcraft_engine::EditError::Create(pdfcraft_engine::CreateError::Invalid(m)) => ToolError::InvalidArgs(m),
-                    e => failed(e),
-                })?;
-                (format!("{title}.pdf"), bytes)
-            }
-            other => return Err(ToolError::InvalidArgs(format!("unknown source {other:?}"))),
-        };
-        let name = a.opt_str("name")?.map(str::to_owned).unwrap_or(name);
-        let id = self.session.open_new(name, bytes).map_err(failed)?;
-        Ok(summary(self.session.get(id).ok_or_else(|| failed("the document vanished"))?))
-    }
-
-    fn page_transition_set(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::{Transition, TransitionSpec};
-        let n = self.doc(a)?.info.pages.len();
-        let pages = match a.opt_ints("pages")? {
-            Some(_) => self.pages(a, "pages")?,
-            None => (0..n).collect(),
-        };
-        let transition = match a.opt_str("style")? {
-            None | Some("none") => None,
-            Some(style) => {
-                let mut t = Transition::new(style);
-                if let Some(d) = a.opt_num("duration")? {
-                    t.duration = d as f32;
-                }
-                if let Some(dm) = a.opt_str("dimension")? {
-                    t.horizontal = match dm {
-                        "horizontal" => true,
-                        "vertical" => false,
-                        other => return Err(ToolError::InvalidArgs(format!("dimension must be horizontal or vertical, not {other:?}"))),
-                    };
-                }
-                if let Some(m) = a.opt_str("motion")? {
-                    t.inward = match m {
-                        "inward" => true,
-                        "outward" => false,
-                        other => return Err(ToolError::InvalidArgs(format!("motion must be inward or outward, not {other:?}"))),
-                    };
-                }
-                match a.get("direction") {
-                    None => {}
-                    Some(Value::String(s)) if s == "none" => t.direction = None,
-                    Some(v) => {
-                        t.direction = Some(
-                            v.as_u64()
-                                .and_then(|d| u16::try_from(d).ok())
-                                .ok_or_else(|| ToolError::InvalidArgs("direction must be 0, 90, 180, 270, 315 or \"none\"".into()))?,
-                        );
-                    }
-                }
-                if let Some(s) = a.opt_num("scale")? {
-                    t.scale = s as f32;
-                }
-                if let Some(b) = a.opt_bool("opaque")? {
-                    t.opaque = b;
-                }
-                Some(t)
-            }
-        };
-        let display = a.opt_num("display")?.map(|s| s as f32);
-        self.apply(a, Edit::SetTransition { pages, spec: TransitionSpec { transition, display } })
-    }
-
-    fn page_set_box(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::{BoxSpec, PageBox};
-        let doc = self.doc(a)?;
-        let n = doc.info.pages.len();
-        let pages = match a.opt_ints("pages")? {
-            Some(_) => self.pages(a, "pages")?,
-            None => (0..n).collect(),
-        };
-        let which = match a.opt_str("box")? {
-            None => PageBox::Crop,
-            Some(b) => PageBox::from_name(b).ok_or_else(|| ToolError::InvalidArgs(format!("unknown box {b:?}")))?,
-        };
-        let nums = |key: &str| -> Result<Option<[f64; 4]>> {
-            a.get(key)
-                .map(|v| {
-                    let v: Vec<f64> = v.as_array().map(|x| x.iter().filter_map(Value::as_f64).collect()).unwrap_or_default();
-                    <[f64; 4]>::try_from(v).map_err(|_| ToolError::InvalidArgs(format!("{key} must be 4 numbers")))
-                })
-                .transpose()
-        };
-        let spec = match (nums("margins")?, nums("rect")?) {
-            (Some(_), Some(_)) => return Err(ToolError::InvalidArgs("pass margins or rect, not both".into())),
-            (Some(m), None) => BoxSpec::Margins(m),
-            (None, Some(r)) => {
-                // Top-left-origin points on the displayed page → user space (one page at a time).
-                if pages.len() != 1 {
-                    return Err(ToolError::InvalidArgs("rect applies to a single page; use margins for several".into()));
-                }
-                let p = &doc.info.pages[pages[0]];
-                let (u0, u1) = (p.view_to_user(r[0] as f32, r[1] as f32), p.view_to_user(r[2] as f32, r[3] as f32));
-                BoxSpec::Rect([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
-            }
-            (None, None) => BoxSpec::Remove,
-        };
-        let mut out = self.apply(a, Edit::SetPageBox { pages, which, spec })?;
-        out["page_sizes"] = json!(self.doc(a)?.info.pages.iter().map(|p| [p.width, p.height]).collect::<Vec<_>>());
-        Ok(out)
-    }
-
-    fn doc_protect(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::{Algorithm, Changes, Printing, Protection};
-        let d = Protection::default();
-        // Restrictions only exist behind a permissions password (ISO 32000-2 §7.6.4.4: /P is
-        // enforced against the owner password; without one everything stays allowed). Refuse a
-        // restriction that could not take effect instead of writing an unrestricted file (#134).
-        let restriction = ["printing", "changes", "copy", "accessibility"].into_iter().find(|k| a.get(k).is_some());
-        if let (None, Some(key)) = (a.opt_str("permissions_password")?, restriction) {
-            return Err(ToolError::InvalidArgs(format!(
-                "`{key}` needs `permissions_password`: with open_password alone the document is encrypted but nothing is restricted"
-            )));
-        }
-        let p = Protection {
-            open_password: a.opt_str("open_password")?.map(str::to_owned),
-            permissions_password: a.opt_str("permissions_password")?.map(str::to_owned),
-            printing: match a.opt_str("printing")? {
-                None => d.printing,
-                Some("none") => Printing::None,
-                Some("low") => Printing::Low,
-                Some("high") => Printing::High,
-                Some(o) => return Err(ToolError::InvalidArgs(format!("unknown printing {o:?}"))),
-            },
-            changes: match a.opt_str("changes")? {
-                None => d.changes,
-                Some("none") => Changes::None,
-                Some("pages") => Changes::Pages,
-                Some("fill-sign") => Changes::FillSign,
-                Some("comment-fill-sign") => Changes::CommentFillSign,
-                Some("any-except-extract") => Changes::AnyExceptExtract,
-                Some(o) => return Err(ToolError::InvalidArgs(format!("unknown changes {o:?}"))),
-            },
-            copy: a.opt_bool("copy")?.unwrap_or(d.copy),
-            accessibility: a.opt_bool("accessibility")?.unwrap_or(d.accessibility),
-            algorithm: match a.opt_str("compatibility")? {
-                None | Some("aes-256") => Algorithm::Aes256,
-                Some("aes-128") => Algorithm::Aes128,
-                Some("rc4-128") => Algorithm::Rc4_128,
-                Some("rc4-40") => Algorithm::Rc4_40,
-                Some(o) => return Err(ToolError::InvalidArgs(format!("unknown compatibility {o:?}"))),
-            },
-            encrypt_metadata: a.opt_bool("encrypt_metadata")?.unwrap_or(d.encrypt_metadata),
-        };
-        let mut out = self.apply(a, Edit::Protect(p))?;
-        out["security"] = security(self.doc(a)?);
-        Ok(out)
-    }
-
-    fn insert_blank(&mut self, a: &Args) -> Result<Value> {
-        let doc = self.doc(a)?;
-        let at = self.position(a, "at")?;
-        // Default to the size of the neighbouring page, as Acrobat does; Letter for empty files.
-        let near = doc.info.pages.get(at.saturating_sub(1)).or(doc.info.pages.first());
-        let (w, h) = near.map(|p| (f64::from(p.width), f64::from(p.height))).unwrap_or((612.0, 792.0));
-        let width = a.opt_num("width")?.unwrap_or(w);
-        let height = a.opt_num("height")?.unwrap_or(h);
-        if !(1.0..=14400.0).contains(&width) || !(1.0..=14400.0).contains(&height) {
-            return Err(ToolError::InvalidArgs("width and height must be between 1 and 14400 points".into()));
-        }
-        self.apply(a, Edit::InsertBlankPage { at, width, height })
-    }
-
-    fn insert_file(&mut self, a: &Args) -> Result<Value> {
-        let at = self.position(a, "at")?;
-        let path = self.resolve(a.str("path")?, false)?;
-        let bytes = read_input(&path)?;
-        let pages = a.opt_ints("pages")?.map(|p| one_based(&p)).transpose()?;
-        let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-        self.apply(a, Edit::InsertPagesFrom { name, bytes: Arc::new(bytes), pages, at, field_conflicts: pdfcraft_organize::FieldConflicts::Rename })
-    }
-
-    /// Write freshly created bytes to `out` and/or open them as a new document.
-    fn deliver(&mut self, a: &Args, name: &str, bytes: Arc<Vec<u8>>) -> Result<Value> {
-        let mut result = json!({ "bytes": bytes.len() });
-        let out = a.opt_str("out")?;
-        if let Some(out) = out {
-            let path = self.resolve(out, true)?;
-            write_atomic(&path, &bytes)?;
-            result["path"] = json!(path.to_string_lossy());
-        }
-        if a.opt_bool("open")?.unwrap_or(out.is_none()) {
-            let id = self.session.open_new(name, bytes).map_err(failed)?;
-            result["document"] = summary(self.session.get(id).ok_or_else(|| failed("the document vanished"))?);
-        }
-        Ok(result)
-    }
-
-    fn doc_create_multiple(&mut self, a: &Args) -> Result<Value> {
-        let paths = a.strs("paths")?;
-        if paths.is_empty() {
-            return Err(ToolError::InvalidArgs("paths must list at least one file".into()));
-        }
-        let separate = match a.opt_str("mode")? {
-            None | Some("combine") => false,
-            Some("separate") => true,
-            Some(m) => return Err(ToolError::InvalidArgs(format!("mode must be \"combine\" or \"separate\", not {m:?}"))),
-        };
-        if separate {
-            return self.create_separate(a, &paths);
-        }
-        let ranges: Vec<Option<String>> = match a.get("pages") {
-            None | Some(Value::Null) => vec![None; paths.len()],
-            Some(Value::Array(v)) if v.len() == paths.len() => v.iter().map(|x| x.as_str().map(str::to_owned)).collect(),
-            Some(_) => return Err(ToolError::InvalidArgs("pages must list a range (or null) for each path".into())),
-        };
-        // Each file is read, converted and copied in turn, so a long list holds one file at a time.
-        let sources = paths.into_iter().zip(ranges).map(|(p, range)| -> std::result::Result<pdfcraft_engine::CombineSource, ToolError> {
-            let path = self.resolve(p, false)?;
-            let bytes = read_input(&path)?;
-            let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-            let (_, pdf) = self.session.convert_to_pdf(&name, &Arc::new(bytes)).map_err(failed)?;
-            let title = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-            Ok((title, pdf, range))
-        });
-        let bytes = self.session.combine_each(sources)?.ok_or_else(|| ToolError::InvalidArgs("paths must list at least one file".into()))?;
-        self.deliver(a, "Combined", bytes)
-    }
-
-    /// One PDF per file, written into `out_dir`; a file that fails doesn't stop the others.
-    fn create_separate(&mut self, a: &Args, paths: &[&str]) -> Result<Value> {
-        let dir = self.resolve(a.str("out_dir").map_err(|_| ToolError::InvalidArgs("mode \"separate\" needs out_dir".into()))?, true)?;
-        std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-        let mut out = Vec::new();
-        for &p in paths {
-            let converted = self.resolve(p, false).map_err(|e| e.to_string()).and_then(|src| {
-                let bytes = read_input_bytes(&src).map_err(|e| format!("{}: {e}", src.display()))?;
-                let name = src.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-                let stem = src.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document".into());
-                let (kind, pdf) = self.session.convert_to_pdf(&name, &Arc::new(bytes)).map_err(|e| e.to_string())?;
-                Ok((kind, stem, pdf))
-            });
-            out.push(match converted {
-                Ok((pdfcraft_engine::SourceKind::Pdf, ..)) => json!({ "path": p, "skipped": "already a PDF" }),
-                Ok((_, stem, pdf)) => {
-                    let target = unused(&dir, &stem);
-                    write_atomic(&target, &pdf)?;
-                    json!({ "path": p, "output": target.to_string_lossy(), "bytes": pdf.len() })
-                }
-                Err(e) => json!({ "path": p, "error": e }),
-            });
-        }
-        Ok(json!({ "files": out }))
-    }
-
-    fn page_extract(&mut self, a: &Args) -> Result<Value> {
-        let doc = self.doc(a)?;
-        let (id, name) = (doc.id, format!("{} (extract)", doc.name));
-        let stem = Path::new(&doc.name).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| "page".into());
-        let pages = self.pages(a, "pages")?;
-        let mut out = if a.opt_bool("separate")?.unwrap_or(false) {
-            // Each page as its own file.
-            let dir = self.resolve(a.str("out_dir").map_err(|_| ToolError::InvalidArgs("separate files need out_dir".into()))?, true)?;
-            std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-            let mut files = Vec::new();
-            for &p in &pages {
-                let bytes = self.session.extract(id, &[p]).map_err(failed)?;
-                let path = child(&dir, &format!("{stem}-page{}.pdf", p + 1));
-                write_atomic(&path, &bytes)?;
-                files.push(path.to_string_lossy().into_owned());
-            }
-            json!({ "files": files })
-        } else {
-            let bytes = self.session.extract(id, &pages).map_err(failed)?;
-            self.deliver(a, &name, bytes)?
-        };
-        if a.opt_bool("delete")?.unwrap_or(false) {
-            let deleted = self.apply(a, Edit::DeletePages { pages })?;
-            out["original"] = deleted;
-        }
-        Ok(out)
-    }
-
-    fn doc_combine(&mut self, a: &Args) -> Result<Value> {
-        let paths = a.strs("paths")?;
-        if paths.len() < 2 {
-            return Err(ToolError::InvalidArgs("combine needs at least two files".into()));
-        }
-        let ranges: Vec<Option<String>> = match a.get("pages") {
-            None | Some(Value::Null) => vec![None; paths.len()],
-            Some(Value::Array(v)) if v.len() == paths.len() => v
-                .iter()
-                .enumerate()
-                .map(|(index, value)| match value {
-                    Value::Null => Ok(None),
-                    Value::String(range) => Ok(Some(range.clone())),
-                    _ => Err(ToolError::InvalidArgs(format!("pages[{index}] must be a range string or null"))),
-                })
-                .collect::<Result<_>>()?,
-            Some(_) => return Err(ToolError::InvalidArgs("pages must list a range (or null) for each path".into())),
-        };
-        let passwords: Vec<Option<String>> = match a.get("passwords") {
-            None | Some(Value::Null) => vec![None; paths.len()],
-            Some(Value::Array(v)) if v.len() == paths.len() && v.iter().all(|x| x.is_string() || x.is_null()) => {
-                v.iter().map(|x| x.as_str().map(str::to_owned)).collect()
-            }
-            Some(_) => return Err(ToolError::InvalidArgs("passwords must list a password (or null) for each path".into())),
-        };
-        // Entries sharing a group number are one file split into parts placed apart.
-        let groups: Option<Vec<Option<u64>>> = match a.get("groups") {
-            None | Some(Value::Null) => None,
-            Some(Value::Array(v)) if v.len() == paths.len() && v.iter().all(|x| x.is_u64() || x.is_null()) => {
-                Some(v.iter().map(Value::as_u64).collect())
-            }
-            Some(_) => return Err(ToolError::InvalidArgs("groups must list a number (or null) for each path".into())),
-        };
-        let field_conflicts = match a.opt_str("field_conflicts")? {
-            None | Some("rename") => pdfcraft_organize::FieldConflicts::Rename,
-            Some("merge") => pdfcraft_organize::FieldConflicts::Merge,
-            Some(other) => {
-                return Err(ToolError::InvalidArgs(format!("field_conflicts must be \"rename\" or \"merge\", not {other:?}")));
-            }
-        };
-        let mut sources: Vec<CombineSource> = Vec::new();
-        let mut firsts: Vec<(u64, PathBuf, usize)> = Vec::new();
-        for (i, (p, range)) in paths.into_iter().zip(ranges).enumerate() {
-            let path = self.resolve(p, false)?;
-            let group = groups.as_ref().and_then(|g| g.get(i).copied().flatten());
-            let first = group.and_then(|g| firsts.iter().find(|f| f.0 == g));
-            let bytes = match first {
-                Some((g, first_path, at)) => {
-                    if *first_path != path {
-                        return Err(ToolError::InvalidArgs(format!("groups[{i}]: group {g} is {}, not {}", first_path.display(), path.display())));
-                    }
-                    sources.get(*at).map(|s| s.1.clone()).ok_or_else(|| failed("group source missing"))?
-                }
-                None => {
-                    if let Some(g) = group {
-                        firsts.push((g, path.clone(), sources.len()));
-                    }
-                    let bytes = Arc::new(read_input(&path)?);
-                    // Images and text files are made into PDFs first (#569), as in the Combine files tab.
-                    let file_name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-                    self.session.as_pdf(&file_name, &bytes).map_err(failed)?
-                }
-            };
-            let name = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-            sources.push((name, bytes, range));
-        }
-        let passwords: Vec<Option<&str>> = passwords.iter().map(Option::as_deref).collect();
-        let combined = match groups {
-            None => self.session.combine_unlocked_reporting(&sources, &passwords, field_conflicts),
-            Some(groups) => {
-                // A path without a group is a file of its own: give it a key no group uses.
-                let mut next = groups.iter().flatten().max().map_or(Some(0), |m| m.checked_add(1));
-                let mut keys = Vec::with_capacity(groups.len());
-                for g in &groups {
-                    keys.push(match g {
-                        Some(g) => *g,
-                        None => {
-                            let own = next.ok_or_else(|| ToolError::InvalidArgs("group numbers are too large".into()))?;
-                            next = own.checked_add(1);
-                            own
-                        }
-                    });
-                }
-                self.session.combine_grouped_reporting(&sources, &keys, &passwords, field_conflicts)
-            }
-        }
-        .map_err(failed)?;
-        let mut result = self.deliver(a, "Combined", combined.bytes)?;
-        if !combined.renamed_fields.is_empty() {
-            result["renamed_fields"] = json!(combined.renamed_fields.iter().map(|(old, new)| json!([old, new])).collect::<Vec<_>>());
-        }
-        Ok(result)
-    }
-
-    fn doc_split(&mut self, a: &Args) -> Result<Value> {
-        let doc = self.doc(a)?;
-        let id = doc.id;
-        let stem = Path::new(&doc.name).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| "part".into());
-        let bookmarks = a.opt_bool("bookmarks")?.unwrap_or(false);
-        let max_mb = a.opt_num("max_mb")?;
-        let chosen = [a.get("every").is_some(), a.get("before").is_some(), bookmarks, max_mb.is_some()].iter().filter(|x| **x).count();
-        if chosen != 1 {
-            return Err(ToolError::InvalidArgs(
-                "pass exactly one of every (pages per file), before (page numbers), bookmarks: true, or max_mb".into(),
-            ));
-        }
-        let mut titles: Vec<(usize, String)> = Vec::new();
-        let parts = if let Some(mb) = max_mb {
-            if !mb.is_finite() || mb <= 0.0 {
-                return Err(ToolError::InvalidArgs("max_mb must be positive".into()));
-            }
-            self.session.split_by_size(id, (mb * 1_048_576.0) as usize).map_err(failed)?
-        } else {
-            let by = match (a.opt_int("every")?, a.opt_ints("before")?) {
-                (Some(n), None) if n > 0 => pdfcraft_organize::SplitBy::PageCount(n as usize),
-                (None, Some(b)) => pdfcraft_organize::SplitBy::Before(one_based(&b)?),
-                _ if bookmarks => {
-                    titles = self.session.bookmark_splits(id);
-                    if titles.is_empty() {
-                        return Err(failed("the document has no top-level bookmarks"));
-                    }
-                    pdfcraft_organize::SplitBy::Before(titles.iter().map(|t| t.0).collect())
-                }
-                _ => return Err(ToolError::InvalidArgs("every must be a positive page count".into())),
-            };
-            self.session.split(id, &by).map_err(failed)?
-        };
-        let dir = self.resolve(a.str("out_dir")?, true)?;
-        std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-        let mut files = Vec::new();
-        let mut used = std::collections::HashSet::new();
-        for (i, (first, last, bytes)) in parts.iter().enumerate() {
-            let safe = |t: &str| t.chars().map(|c| if c.is_alphanumeric() || " -_.,()".contains(c) { c } else { '_' }).collect::<String>();
-            let mut base = match titles.iter().find(|t| t.0 + 1 == *first) {
-                Some((_, t)) => format!("{stem}-{}", safe(t)),
-                None => format!("{stem}-part{}", i + 1),
-            };
-            // A file name is at most 255 bytes: keep the base to 200, cut between characters, which leaves room for ".pdf" and a -N suffix.
-            if let Some((end, _)) = base.char_indices().find(|(at, c)| at + c.len_utf8() > 200) {
-                base.truncate(end);
-            }
-            let file = format!("{base}.pdf");
-            // Equal titles (or titles that sanitize alike) get -2, -3, ... so no part overwrites another; compared case-insensitively.
-            let mut unique = file;
-            let mut n = 1;
-            while !used.insert(unique.to_lowercase()) {
-                n += 1;
-                unique = format!("{base}-{n}.pdf");
-            }
-            let path = child(&dir, &unique);
-            write_atomic(&path, bytes)?;
-            files.push(json!({ "path": path.to_string_lossy(), "first_page": first, "last_page": last }));
-        }
-        Ok(json!({ "files": files }))
-    }
-
-    // ---- pages and text ----------------------------------------------------------------------
-
-    /// 1-based page list → validated 0-based indices.
-    fn pages(&self, a: &Args, key: &str) -> Result<Vec<usize>> {
-        let n = self.doc(a)?.info.pages.len();
-        let pages = one_based(&a.ints(key)?)?;
-        if pages.is_empty() {
-            return Err(ToolError::InvalidArgs(format!("{key} must list at least one page")));
-        }
-        if let Some(p) = pages.iter().find(|p| **p >= n) {
-            return Err(ToolError::InvalidArgs(format!("page {} is out of range: the document has {n} pages", p + 1)));
-        }
-        Ok(pages)
-    }
-
-    /// A 1-based insertion position (1 = before the first page, n+1 = after the last) → 0-based.
-    fn position(&self, a: &Args, key: &str) -> Result<usize> {
-        self.opt_position(a, key)?.ok_or_else(|| Args::missing(key))
-    }
-
-    /// `position`, but `None` when the key is absent.
-    fn opt_position(&self, a: &Args, key: &str) -> Result<Option<usize>> {
-        let Some(at) = a.opt_int(key)? else { return Ok(None) };
-        let n = self.doc(a)?.info.pages.len();
-        if at < 1 || at as usize > n + 1 {
-            return Err(ToolError::InvalidArgs(format!("{key} must be between 1 and {} (the document has {n} pages)", n + 1)));
-        }
-        Ok(Some(at as usize - 1))
-    }
-
-    fn renderer(&mut self, id: DocId) -> Result<&mut PageRenderer> {
-        let doc = self.session.get(id).ok_or_else(|| failed("no such document"))?;
-        // The document's own view settings: layer visibility, hidden comments, reading colours
-        // (tools that change one drop this cache so the next render reads it again).
-        let config =
-            self.session.render_config(id).unwrap_or_else(|| RenderConfig { password: doc.password.as_deref().map(Arc::from), ..Default::default() });
-        let fresh = || (doc.display.clone(), PageRenderer::new(doc.display.clone(), config.clone()));
-        let entry = self.renderers.entry(id).or_insert_with(fresh);
-        if !Arc::ptr_eq(&entry.0, &doc.display) {
-            *entry = fresh();
-        }
-        Ok(&mut entry.1)
-    }
-
-    fn page_render(&mut self, a: &Args) -> Result<Content> {
-        let id = self.doc(a)?.id;
-        let page = self.page(a)?;
-        let dpi = a.opt_num("dpi")?.unwrap_or(DEFAULT_DPI);
-        if !(1.0..=MAX_DPI).contains(&dpi) {
-            return Err(ToolError::InvalidArgs(format!("dpi must be between 1 and {MAX_DPI}")));
-        }
-        let scale = (dpi / 72.0) as f32;
-        let block = a.opt_int("hide_text_block")?;
-        let added = a.opt_int("hide_added_text")?;
-        if block.is_some() && added.is_some() {
-            return Err(ToolError::InvalidArgs("choose only one of hide_text_block and hide_added_text".into()));
-        }
-        let out = if let Some(block) = block {
-            if block < 1 {
-                return Err(ToolError::InvalidArgs("hide_text_block must be a positive paragraph index from text_paragraphs".into()));
-            }
-            // The number names the paragraph text_paragraphs listed, as it does for text_edit.
-            let doc = self.doc(a)?;
-            let index = self.paragraph_index(doc.id, page, block, &doc.text_blocks(page))?;
-            doc.text_edit_preview(page, index).map_err(failed)?.render_background(scale).map_err(failed)?
-        } else if let Some(added) = added {
-            let index = usize::try_from(added)
-                .ok()
-                .and_then(|n| n.checked_sub(1))
-                .ok_or_else(|| ToolError::InvalidArgs("hide_added_text must be a positive added text index from object_list".into()))?;
-            self.doc(a)?.added_text_preview(page, index).map_err(failed)?.render_background(scale).map_err(failed)?
-        } else {
-            self.renderer(id)?.render(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale, tag: 0, preview: false })
-        };
-        if let Some(e) = out.error {
-            return Err(failed(format!("page {} could not be rendered: {e}", page + 1)));
-        }
-        let data = encode_png(out.width, out.height, &out.rgba)?;
-        Ok(Content::Png { data, width: out.width, height: out.height })
-    }
-
-    /// A page as RGBA pixels, without encoding a PNG. `page` is 1-based and `scale` is pixels
-    /// per point (1.0 = 72 dpi). For an embedder that paints the result straight onto a canvas:
-    /// the `page_render` tool only returns PNG, and encoding one to decode it again is wasted
-    /// work on every scroll. It uses the same renderer, and the same per-document cache, as
-    /// `page_render`.
-    pub fn render_pixels(&mut self, doc: u64, page: usize, scale: f32) -> Result<(u32, u32, pdfcraft_render::Pixels)> {
-        if !(scale.is_finite() && scale > 0.0 && scale <= (MAX_DPI / 72.0) as f32) {
-            return Err(ToolError::InvalidArgs(format!("scale must be between 0 and {}", MAX_DPI / 72.0)));
-        }
-        let id = DocId(doc);
-        let n = self.session.get(id).ok_or_else(|| failed(format!("no open document with id {doc} (see doc_list)")))?.info.pages.len();
-        if page < 1 || page > n {
-            return Err(ToolError::InvalidArgs(format!("page {page} is out of range: the document has {n} pages")));
-        }
-        let out = self.renderer(id)?.render(RenderRequest { page: page - 1, kind: RequestKind::Pixels, tile: None, scale, tag: 0, preview: false });
-        if let Some(e) = out.error {
-            return Err(failed(format!("page {page} could not be rendered: {e}")));
-        }
-        Ok((out.width, out.height, out.rgba))
-    }
-
-    fn page(&self, a: &Args) -> Result<usize> {
-        let n = self.doc(a)?.info.pages.len();
-        let p = a.int("page")?;
-        if p < 1 || p as usize > n {
-            return Err(ToolError::InvalidArgs(format!("page {p} is out of range: the document has {n} pages")));
-        }
-        Ok(p as usize - 1)
-    }
-
-    /// The text of `pages` (0-based), from the cache or extracted in parallel.
-    fn page_texts(&mut self, id: DocId, pages: &[usize]) -> Result<Vec<Arc<PageText>>> {
-        self.page_text_results(id, pages, &mut extract_parallel)?
-            .into_iter()
-            .map(|(p, text)| text.map_err(|e| failed(format!("page {}: {e}", p + 1))))
-            .collect()
-    }
-
-    /// Keep per-page failures until the caller chooses strict or partial-result semantics.
-    fn page_text_results(
-        &mut self,
-        id: DocId,
-        pages: &[usize],
-        extract: &mut impl FnMut(&Arc<Vec<u8>>, Option<Arc<str>>, &[usize]) -> PageTexts,
-    ) -> Result<PageTexts> {
-        let doc = self.session.get(id).ok_or_else(|| failed("no such document"))?;
-        let (bytes, n) = (doc.bytes.clone(), doc.info.pages.len());
-        let password: Option<Arc<str>> = doc.password.as_deref().map(Arc::from);
-        self.texts.prepare(id, &bytes);
-        let mut results = HashMap::new();
-        let mut missing = Vec::new();
-        for &p in pages {
-            if p >= n {
-                results.insert(p, Err("page is out of range".to_owned()));
-            } else if let Some(text) = self.texts.get(id, p) {
-                results.insert(p, Ok(text));
-            } else {
-                missing.push(p);
-            }
-        }
-        missing.sort_unstable();
-        missing.dedup();
-        if !missing.is_empty() {
-            for (p, text) in extract(&bytes, password, &missing) {
-                if let Ok(text) = &text {
-                    self.texts.insert(id, p, &bytes, text.clone());
-                }
-                results.insert(p, text);
-            }
-        }
-        // The batch owns its Arcs: evicting a cache entry cannot lose a requested result. A
-        // worker that fails to return a page is an explicit failure, never an empty success.
-        Ok(pages.iter().map(|p| (*p, results.get(p).cloned().unwrap_or_else(|| Err("text extraction returned no result".into())))).collect())
-    }
-
-    fn text_word_count(&self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::word_count::{self, Counts, Options};
-        let doc = self.doc_to_copy(a)?;
-        let pages = match a.opt_ints("pages")? {
-            Some(_) => self.pages(a, "pages")?,
-            None => (0..doc.info.pages.len()).collect(),
-        };
-        let options = Options {
-            exclude_tables: a.opt_bool("exclude_tables")?.unwrap_or(false),
-            exclude_code: a.opt_bool("exclude_code")?.unwrap_or(false),
-            exclude_images: a.opt_bool("exclude_images")?.unwrap_or(false),
-        };
-        let report = word_count::count(doc.export_source(), &pages, options, |_| true).map_err(failed)?;
-        let counts = |c: Counts| json!({ "words": c.words, "characters": c.characters, "characters_without_spaces": c.characters_without_spaces });
-        Ok(json!({
-            "total": counts(report.total),
-            "pages": report.pages.into_iter().map(|(p, c)| json!({ "page": p + 1, "counts": counts(c) })).collect::<Vec<_>>(),
-            "pages_without_text": report.pages_without_text,
-            "unclassified_structure": report.unclassified_structure,
-        }))
-    }
-
-    fn text_extract(&mut self, a: &Args) -> Result<Value> {
-        let doc = self.doc_to_copy(a)?;
-        let id = doc.id;
-        let pages = match a.opt_ints("pages")? {
-            Some(_) => self.pages(a, "pages")?,
-            None => (0..doc.info.pages.len()).collect(),
-        };
-        // Column select (#740): only the text inside the rectangle, row by row.
-        let rect = a.nums::<4>("rect")?.map(|r| r.map(|v| v as f32));
-        let texts = self.page_texts(id, &pages)?;
-        let text = |t: &PageText| match rect {
-            Some(r) => t.column_text(&t.glyphs_in(r)),
-            None => t.plain_text(),
-        };
-        let out: Vec<Value> = pages.iter().zip(texts).map(|(p, t)| json!({ "page": p + 1, "text": text(&t) })).collect();
-        Ok(json!({ "pages": out }))
-    }
-
-    /// Matches in document order, extracting page text in growing batches and stopping as soon as
-    /// `limit` is reached, so a bounded search doesn't extract (and cache) the whole document
-    /// (#971). One match past the limit supplies `next`. Reached extraction failures are reported
-    /// as bounded warnings; `complete` requires both no continuation and no failed pages.
-    fn text_find(&mut self, a: &Args) -> Result<Value> {
-        self.text_find_with(a, &mut extract_parallel)
-    }
-
-    fn text_find_with(&mut self, a: &Args, extract: &mut impl FnMut(&Arc<Vec<u8>>, Option<Arc<str>>, &[usize]) -> PageTexts) -> Result<Value> {
-        let doc = self.doc(a)?;
-        let (id, n) = (doc.id, doc.info.pages.len());
-        let query = a.str("query")?;
-        let limit = usize::try_from(a.opt_int("limit")?.unwrap_or(500).max(1)).unwrap_or(usize::MAX);
-        let start = match a.opt_int("start_page")? {
-            None => 0,
-            Some(p) if p >= 1 && usize::try_from(p).is_ok_and(|p| p <= n) => usize::try_from(p - 1).unwrap_or(0),
-            Some(p) => return Err(ToolError::InvalidArgs(format!("start_page {p} is out of range: the document has {n} pages"))),
-        };
-        let skip = usize::try_from(a.opt_int("skip")?.unwrap_or(0).max(0)).unwrap_or(usize::MAX);
-        let mut matches = Vec::new();
-        let mut next = None;
-        let mut warnings = Vec::new();
-        let mut warning_count = 0usize;
-        let (mut first, mut batch) = (start, FIND_FIRST_BATCH);
-        'search: while first < n {
-            let end = first.saturating_add(batch).min(n);
-            let pages: Vec<usize> = (first..end).collect();
-            let texts = self.page_text_results(id, &pages, extract)?;
-            for (p, text) in texts {
-                let text = match text {
-                    Ok(text) => text,
-                    Err(mut error) => {
-                        warning_count += 1;
-                        if warnings.len() < FIND_MAX_WARNINGS {
-                            let end = error.floor_char_boundary(FIND_MAX_WARNING_BYTES.min(error.len()));
-                            let truncated = end < error.len();
-                            error.truncate(end);
-                            warnings.push(json!({ "page": p + 1, "error": error, "error_truncated": truncated }));
-                        }
-                        continue;
-                    }
-                };
-                let skip_here = if p == start { skip } else { 0 };
-                // One extra match proves that the caller needs a continuation. Include skipped
-                // matches on the starting page when bounding the temporary per-page result.
-                let needed = limit.saturating_sub(matches.len()).saturating_add(skip_here).saturating_add(1);
-                for (k, r) in text.find_opts_limited(query, false, false, needed).into_iter().enumerate().skip(skip_here) {
-                    if matches.len() == limit {
-                        next = Some(json!({ "start_page": p + 1, "skip": k }));
-                        break 'search;
-                    }
-                    matches.push(json!({ "page": p + 1, "text": text.text_of(r.clone()), "rects": text.line_rects(r) }));
-                }
-            }
-            first = end;
-            batch = batch.saturating_mul(2).min(FIND_MAX_BATCH);
-        }
-        let mut out = json!({ "query": query, "count": matches.len(), "complete": next.is_none() && warning_count == 0, "matches": matches,
-            "warnings_truncated": warning_count > warnings.len(), "warning_count": warning_count, "warnings": warnings });
-        if let (Some(next), Some(o)) = (next, out.as_object_mut()) {
-            o.insert("next".into(), next);
-        }
-        Ok(out)
-    }
-
-    fn command_list(&self, a: &Args) -> Result<Value> {
-        let active = match a.opt_int("doc")? {
-            Some(_) => Some(self.doc(a)?.id),
-            None => None,
-        };
-        let filter = a.opt_str("filter")?.unwrap_or("").to_lowercase();
-        let enabled_only = a.opt_bool("enabled_only")?.unwrap_or(false);
-        let list: Vec<Value> = commands::COMMANDS
-            .iter()
-            .map(|c| {
-                json!({
-                    "id": c.id,
-                    "label": commands::current_label(c, &self.session, active),
-                    "menu": c.menu,
-                    "shortcut": c.shortcut.map(|s| s.label(cfg!(target_os = "macos"))),
-                    "enabled": commands::is_enabled(c, &self.session, active),
-                    "tool": tools::tool_for_command(c.id),
-                    "params": tools::tool_for_command(c.id).and_then(tools::find).map(|t| &t.input_schema),
-                })
-            })
-            .collect();
-        let list: Vec<Value> = list
-            .into_iter()
-            .filter(|c| {
-                (!enabled_only || c.get("enabled").and_then(Value::as_bool) == Some(true))
-                    && (filter.is_empty()
-                        || ["id", "label", "menu"].iter().any(|k| c.get(k).is_some_and(|v| v.to_string().to_lowercase().contains(&filter))))
-            })
-            .collect();
-        Ok(json!({ "commands": list }))
-    }
-
-    // ---- paths -------------------------------------------------------------------------------
-
-    /// Resolve a user-supplied path, enforcing the root (if any). `for_write` allows a file that
-    /// does not exist yet (its nearest existing ancestor must be inside the root).
-    ///
-    /// Every path outside the root gets the same refusal, so a confined client can't learn what
-    /// exists out there (#136): `..` is resolved by name first, another network share or device
-    /// namespace is refused without touching it, and the deepest existing ancestor (links
-    /// followed) must be inside the root before anything about the rest is reported.
-    fn resolve(&self, path: &str, for_write: bool) -> Result<PathBuf> {
-        let access = if for_write { file_access::Access::Write } else { file_access::Access::Read };
-        self.resolve_for(path, access, for_write)
-    }
-
-    /// [`resolve`](Self::resolve) with the kind of access named, for the places where a file that
-    /// is only read may still be missing (a path checked up front, whose absence is reported per
-    /// file later). The automation roots, if any, get the last word.
-    fn resolve_for(&self, path: &str, access: file_access::Access, may_be_missing: bool) -> Result<PathBuf> {
-        let target = self.resolve_in_root(path, may_be_missing)?;
-        self.check_roots(path, &target, access)?;
-        Ok(target)
-    }
-
-    /// Hold `target`, which `path` named, to the automation read or write root. Always passes
-    /// without roots.
-    fn check_roots(&self, path: &str, target: &Path, access: file_access::Access) -> Result<()> {
-        match &self.roots {
-            Some(roots) => roots.check_path(path, target, access).map_err(failed),
-            None => Ok(()),
-        }
-    }
-
-    fn resolve_in_root(&self, path: &str, for_write: bool) -> Result<PathBuf> {
-        let p = Path::new(path);
-        let Some(root) = &self.root else { return Ok(p.to_path_buf()) };
-        let outside = || failed(format!("{path} is outside the allowed directory {}", root.display()));
-        let joined = lexical(&root.join(p)).ok_or_else(outside)?;
-        if foreign_share(&joined, root) {
-            return Err(outside());
-        }
-        let mut existing = joined.as_path();
-        let mut rest = Vec::new();
-        while !existing.exists() {
-            if existing.symlink_metadata().is_ok_and(|m| m.file_type().is_symlink()) {
-                return Err(outside()); // a broken link: going on would tell whether its target exists
-            }
-            match (existing.file_name(), existing.parent()) {
-                (Some(name), Some(parent)) => {
-                    rest.push(name);
-                    existing = parent;
-                }
-                _ => return Err(outside()), // not even a drive or share that exists
-            }
-        }
-        let mut real = existing.canonicalize().map_err(|_| outside())?;
-        if !real.starts_with(root) {
-            return Err(outside());
-        }
-        if !rest.is_empty() && !for_write {
-            // Missing, below a folder inside the root: say where it was looked for, so a path
-            // written for another working directory can be corrected (#1890), and otherwise
-            // why, as the system reports it. `joined` is under the root, so naming it reveals
-            // nothing outside.
-            real = joined.canonicalize().map_err(|e| {
-                let (looked, root) = (joined.display(), root.display());
-                match e.kind() {
-                    std::io::ErrorKind::NotFound => failed(format!("{path} not found (looked for {looked}, --root {root})")),
-                    _ => failed(format!("{path}: {e} (looked for {looked}, --root {root})")),
-                }
-            })?;
-            if !real.starts_with(root) {
-                return Err(outside()); // it appeared, as a link out, since the check above
-            }
-            return Ok(real);
-        }
-        real.extend(rest.iter().rev());
-        Ok(real)
-    }
-}
-
-/// `path` with `.` and `..` resolved by name, before the filesystem is consulted (Windows does
-/// the same, and so does joining onto a canonical root there). `None` if a `..` would climb
-/// above the start of the path.
-fn lexical(path: &Path) -> Option<PathBuf> {
-    use std::path::Component;
-    let mut parts: Vec<Component> = Vec::new();
-    for c in path.components() {
-        match c {
-            Component::CurDir => {}
-            Component::ParentDir => match parts.last() {
-                Some(Component::Normal(_)) => {
-                    parts.pop();
-                }
-                _ => return None,
-            },
-            other => parts.push(other),
-        }
-    }
-    Some(parts.iter().collect())
-}
-
-/// Whether `path` names another network share or device namespace than `root` (Windows
-/// `\\host\share`, `\\?\UNC\…`, `\\.\…`, `\\?\…`). Those are refused by name: even checking
-/// that one exists would contact the host. Drive letters are left to the normal check.
-fn foreign_share(path: &Path, root: &Path) -> bool {
-    use std::path::{Component, Prefix};
-    fn share(p: &Path) -> Option<String> {
-        let Some(Component::Prefix(prefix)) = p.components().next() else { return None };
-        let (kind, a, b) = match prefix.kind() {
-            Prefix::Disk(_) | Prefix::VerbatimDisk(_) => return None,
-            Prefix::UNC(host, share) | Prefix::VerbatimUNC(host, share) => ("unc", host, share),
-            Prefix::DeviceNS(name) => ("device", name, std::ffi::OsStr::new("")),
-            Prefix::Verbatim(name) => ("verbatim", name, std::ffi::OsStr::new("")),
-        };
-        Some(format!("{kind}\\{}\\{}", a.to_string_lossy(), b.to_string_lossy()).to_lowercase())
-    }
-    share(path).is_some_and(|s| share(root).as_ref() != Some(&s))
-}
-
-// ---- JSON helpers ----------------------------------------------------------------------------
-
-fn parse_style_ranges(value: Option<&Value>) -> Result<Vec<pdfcraft_engine::RangeStyle>> {
-    let Some(value) = value else { return Ok(Vec::new()) };
-    let values = value.as_array().filter(|v| v.len() <= 1024).ok_or_else(|| Args::wrong("ranges", "an array of at most 1024 style objects"))?;
-    values
-        .iter()
-        .map(|v| {
-            let a = Args(v);
-            let bounds = a
-                .get("range")
-                .and_then(Value::as_array)
-                .filter(|v| v.len() == 2)
-                .ok_or_else(|| Args::wrong("range", "[start,end] UTF-8 byte offsets"))?;
-            let start = bounds
-                .first()
-                .and_then(Value::as_u64)
-                .and_then(|n| usize::try_from(n).ok())
-                .ok_or_else(|| Args::wrong("range", "nonnegative byte offsets"))?;
-            let end = bounds
-                .get(1)
-                .and_then(Value::as_u64)
-                .and_then(|n| usize::try_from(n).ok())
-                .ok_or_else(|| Args::wrong("range", "nonnegative byte offsets"))?;
-            let family = a
-                .opt_str("font")?
-                .map(|f| match f {
-                    "helvetica" => Ok(pdfcraft_engine::FontFamily::Helvetica),
-                    "times" => Ok(pdfcraft_engine::FontFamily::Times),
-                    "courier" => Ok(pdfcraft_engine::FontFamily::Courier),
-                    _ => Err(Args::wrong("font", "helvetica, times or courier")),
-                })
-                .transpose()?
-                .map(|f| -> Result<_> { Ok((f, a.opt_bool("bold")?.unwrap_or(false), a.opt_bool("italic")?.unwrap_or(false))) })
-                .transpose()?;
-            Ok(pdfcraft_engine::RangeStyle {
-                range: start..end,
-                family,
-                resource: a.opt_str("font_resource")?.map(str::to_owned),
-                size: a.opt_num("size")?,
-                color: a.opt_str("color")?.map(comments::parse_color).transpose()?,
-                underline: a.opt_bool("underline")?,
-                char_spacing: a.opt_num("char_spacing")?,
-                scale: a.opt_num("scale")?,
-            })
-        })
-        .collect()
-}
-
-/// Typed access to validated arguments.
-struct Args<'a>(&'a Value);
-
-impl Args<'_> {
-    fn get(&self, key: &str) -> Option<&Value> {
-        self.0.get(key).filter(|v| !v.is_null())
-    }
-    fn missing(key: &str) -> ToolError {
-        ToolError::InvalidArgs(format!("missing argument {key}"))
-    }
-    fn wrong(key: &str, what: &str) -> ToolError {
-        ToolError::InvalidArgs(format!("{key} must be {what}"))
-    }
-    fn str(&self, key: &str) -> Result<&str> {
-        self.opt_str(key)?.ok_or_else(|| Self::missing(key))
-    }
-    fn opt_str(&self, key: &str) -> Result<Option<&str>> {
-        self.get(key).map(|v| v.as_str().ok_or_else(|| Self::wrong(key, "a string"))).transpose()
-    }
-    fn int(&self, key: &str) -> Result<i64> {
-        self.opt_int(key)?.ok_or_else(|| Self::missing(key))
-    }
-    fn opt_int(&self, key: &str) -> Result<Option<i64>> {
-        self.get(key).map(|v| v.as_i64().ok_or_else(|| Self::wrong(key, "an integer"))).transpose()
-    }
-    fn opt_num(&self, key: &str) -> Result<Option<f64>> {
-        self.get(key).map(|v| v.as_f64().filter(|f| f.is_finite()).ok_or_else(|| Self::wrong(key, "a number"))).transpose()
-    }
-    fn opt_bool(&self, key: &str) -> Result<Option<bool>> {
-        self.get(key).map(|v| v.as_bool().ok_or_else(|| Self::wrong(key, "true or false"))).transpose()
-    }
-    fn ints(&self, key: &str) -> Result<Vec<i64>> {
-        self.opt_ints(key)?.ok_or_else(|| Self::missing(key))
-    }
-    fn opt_ints(&self, key: &str) -> Result<Option<Vec<i64>>> {
-        let Some(v) = self.get(key) else { return Ok(None) };
-        let arr = v.as_array().ok_or_else(|| Self::wrong(key, "an array of integers"))?;
-        arr.iter().map(|x| x.as_i64().ok_or_else(|| Self::wrong(key, "an array of integers"))).collect::<Result<Vec<_>>>().map(Some)
-    }
-    /// A 1-based bookmark path → 0-based indices.
-    fn path(&self, key: &str) -> Result<Vec<usize>> {
-        let p = self.opt_path(key)?.ok_or_else(|| Self::missing(key))?;
-        if p.is_empty() {
-            return Err(ToolError::InvalidArgs(format!("{key} must not be empty")));
-        }
-        Ok(p)
-    }
-    fn opt_path(&self, key: &str) -> Result<Option<Vec<usize>>> {
-        let Some(v) = self.opt_ints(key)? else { return Ok(None) };
-        v.iter().map(|i| if *i >= 1 { Ok(*i as usize - 1) } else { Err(Self::wrong(key, "1-based positions")) }).collect::<Result<Vec<_>>>().map(Some)
-    }
-    /// A bookmark's `left` or `top`: points on the displayed page, `None` when left out, an error
-    /// when it is not a number or lies absurdly far off the page.
-    fn bookmark_coordinate(&self, key: &str) -> Result<Option<f32>> {
-        match self.opt_num(key)? {
-            None => Ok(None),
-            Some(v) if v.is_finite() && v.abs() <= MAX_BOOKMARK_POSITION => Ok(Some(v as f32)),
-            Some(_) => Err(ToolError::InvalidArgs(format!("{key} must be between -{MAX_BOOKMARK_POSITION} and {MAX_BOOKMARK_POSITION} points"))),
-        }
-    }
-    fn strs(&self, key: &str) -> Result<Vec<&str>> {
-        let v = self.get(key).ok_or_else(|| Self::missing(key))?;
-        let arr = v.as_array().ok_or_else(|| Self::wrong(key, "an array of strings"))?;
-        arr.iter().map(|x| x.as_str().ok_or_else(|| Self::wrong(key, "an array of strings"))).collect()
-    }
-}
-
-/// The name-tree keys of a document's own attachments, leaving out the files attached to pages as comments.
-fn document_attachment_keys(doc: &Document) -> Vec<String> {
-    doc.info
-        .attachments
-        .iter()
-        .filter_map(|x| match &x.source {
-            pdfcraft_render::AttachmentSource::Document { key } => Some(key.clone()),
-            pdfcraft_render::AttachmentSource::Annotation { .. } => None,
-        })
-        .collect()
-}
-
-/// Bookmark rows in listing order as JSON: a row holds the rows that follow it on the page at the
-/// next level down in `children`, and paths and pages are 1-based.
-fn nest_rows(rows: &[pdfcraft_engine::BookmarkRow], pages: &[pdfcraft_render::PageInfo]) -> Vec<Value> {
-    // The open rows, outermost first, with their depth and the children gathered so far.
-    let mut open: Vec<(usize, Value, Vec<Value>)> = Vec::new();
-    let mut roots = Vec::new();
-    for row in rows {
-        let depth = row.path.len().saturating_sub(1);
-        while open.last().is_some_and(|(d, _, _)| *d >= depth) {
-            close_row(&mut open, &mut roots);
-        }
-        let path: Vec<usize> = row.path.iter().map(|p| p.saturating_add(1)).collect();
-        let mut fields = json!({ "path": path, "title": row.title, "page": row.page.map(|p| p.saturating_add(1)), "open": row.open });
-        // Only what differs from the defaults (black, regular), as the PDF itself stores it.
-        if let Some(color) = row.color {
-            fields["color"] = json!(color);
-        }
-        if row.bold {
-            fields["bold"] = json!(true);
-        }
-        if row.italic {
-            fields["italic"] = json!(true);
-        }
-        if let Some(destination) = row.page.and_then(|p| pages.get(p)).and_then(|p| destination(&row.view, p)) {
-            fields["destination"] = destination;
-        }
-        open.push((depth, fields, Vec::new()));
-    }
-    while !open.is_empty() {
-        close_row(&mut open, &mut roots);
-    }
-    roots
-}
-
-/// Where on its page a bookmark or link goes, in points from the top-left of the displayed page
-/// like every `rect`: the destination type (`XYZ`, `Fit`, `FitH`, `FitV`, `FitR`) and its
-/// position, `null` where the destination leaves it unspecified (`/XYZ null null null` keeps the
-/// reader's position and zoom). `None` for a destination without a type.
-pub(crate) fn destination(view: &pdfcraft_render::DestView, page: &pdfcraft_render::PageInfo) -> Option<Value> {
-    use pdfcraft_render::DestView;
-    let points = |left: Option<f32>, top: Option<f32>| {
-        let [x, y] = page.dest_fraction(left, top, 0);
-        let round = |v: f32| f64::from((v * 100.0).round() / 100.0);
-        (x.map(|x| round(x * page.width)), y.map(|y| round(y * page.height)))
-    };
-    Some(match view {
-        DestView::Top => return None,
-        DestView::Xyz { left, top, zoom } => {
-            let (x, y) = points(*left, *top);
-            json!({ "fit": "XYZ", "left": x, "top": y, "zoom": zoom.map(f64::from) })
-        }
-        DestView::Fit => json!({ "fit": "Fit" }),
-        DestView::FitH { top } => {
-            let (x, y) = points(None, *top);
-            json!({ "fit": "FitH", "left": x, "top": y })
-        }
-        DestView::FitV { left } => {
-            let (x, y) = points(*left, None);
-            json!({ "fit": "FitV", "left": x, "top": y })
-        }
-        DestView::FitR { rect } => json!({ "fit": "FitR", "rect": comments::rect_to_view(page, *rect) }),
-    })
-}
-
-/// Closes the innermost open row: it joins the row above it as a child, or the top level.
-fn close_row(open: &mut Vec<(usize, Value, Vec<Value>)>, roots: &mut Vec<Value>) {
-    if let Some((_, mut fields, children)) = open.pop() {
-        fields["children"] = Value::Array(children);
-        match open.last_mut() {
-            Some((_, _, siblings)) => siblings.push(fields),
-            None => roots.push(fields),
-        }
-    }
-}
-
-fn one_based(pages: &[i64]) -> Result<Vec<usize>> {
-    pages
-        .iter()
-        .map(|p| if *p >= 1 { Ok(*p as usize - 1) } else { Err(ToolError::InvalidArgs(format!("page numbers start at 1 (got {p})"))) })
-        .collect()
-}
-
-/// The document's security as the next save writes it (never includes passwords).
-fn security(d: &Document) -> Value {
-    match d.security_summary() {
-        None => json!({ "protected": false }),
-        Some(s) => {
-            let p = s.permissions;
-            json!({
-                "protected": true,
-                "method": s.method,
-                "pending": s.pending,
-                "printing": if !p.print() { "none" } else if p.print_high_quality() { "high" } else { "low" },
-                "modify": p.modify(), "assemble": p.assemble(), "copy": p.copy(), "annotate": p.annotate(),
-                "fill_forms": p.fill_forms(), "accessibility": p.extract_for_accessibility(),
-            })
-        }
-    }
-}
-
-/// What every tool that changes a document returns.
-fn summary(d: &Document) -> Value {
-    json!({
-        "doc": d.id.0,
-        "name": d.name,
-        "path": d.path,
-        "pages": d.info.pages.len(),
-        "dirty": d.dirty,
-        "editable": d.read_only_reason.is_none(),
-        "read_only_reason": d.read_only_reason,
-        "encrypted": d.info.encrypted,
-        "undo": d.can_undo(),
-        "redo": d.can_redo(),
-    })
-}
-
-fn info(d: &Document) -> Value {
-    let i = &d.info;
-    let page1 = |p: usize| p + 1;
-    let mut security = security(d);
-    if let Some(s) = d.security_summary() {
-        security["opened_as_owner"] = json!(s.owner);
-    }
-    json!({
-        "document": summary(d),
-        "pdf_version": i.pdf_version,
-        "file_size": i.file_size,
-        "title": i.title, "author": i.author, "subject": i.subject, "keywords": i.keywords,
-        // Custom document properties (Document Properties ▸ Custom): /Info entries beyond the
-        // ones the spec names, set and cleared with doc_set_info.
-        "custom": i.custom.iter().map(|(name, value)| json!({ "name": name, "value": value })).collect::<Vec<_>>(),
-        "creator": i.creator, "producer": i.producer,
-        "tagged": i.tagged,
-        "has_javascript": i.has_javascript,
-        // XFA forms: "static" (the PDF's own fields work; the XFA data is ignored) or "dynamic"
-        // (laid out from the template by PdfCraft, see xfa_layout; placeholder pages when that failed).
-        "xfa": i.xfa.map(|x| match x { pdfcraft_render::Xfa::Static => "static", pdfcraft_render::Xfa::Dynamic => "dynamic" }),
-        "xfa_layout": d.xfa.as_ref().map(|x| json!({ "pages": x.pages, "fields": x.fields, "warnings": x.warnings })),
-        // A script of the form ran too long and was abandoned: its scripts no longer run in this
-        // document (calculations, buttons) until it is opened again.
-        "xfa_scripts_off": d.xfa_scripts_off(),
-        // What was rewritten from, or could not be written to, the XFA data.
-        "xfa_warnings": d.xfa_warnings,
-        "security": security,
-        "pages": i.pages.iter().enumerate().map(|(n, p)| json!({
-            "page": n + 1, "label": p.label, "width": p.width, "height": p.height, "rotation": p.rotation,
-        })).collect::<Vec<_>>(),
-        "outline": outline(&i.outline),
-        "outline_more": i.outline_more,
-        // Rectangles use the tools' convention (top-left of the displayed page, like
-        // comment_list and link_list), not raw PDF user space, so they can be fed back to
-        // geometry-taking tools (#129).
-        "annotations": i.annotations.iter().map(|a| json!({
-            "page": page1(a.page), "type": a.subtype, "author": a.author, "contents": a.contents,
-            "modified": a.modified, "name": a.name, "in_reply_to": a.in_reply_to,
-            "rect": view_rect(i, a.page, a.shown_rect(i.pages.get(a.page).map_or(0, |p| p.rotation))),
-        })).collect::<Vec<_>>(),
-        "fields": i.fields.iter().map(|f| json!({
-            "name": f.name, "kind": format!("{:?}", f.kind), "value": f.value, "page": f.page.map(page1),
-            "tooltip": f.tooltip, "has_actions": f.has_actions,
-        })).collect::<Vec<_>>(),
-        "links": i.links.iter().map(|l| json!({
-            "page": page1(l.page), "rect": view_rect(i, l.page, l.rect),
-            "target": match &l.target {
-                pdfcraft_render::LinkTarget::Page(p, _) => json!({ "page": page1(*p) }),
-                pdfcraft_render::LinkTarget::Uri(u) => json!({ "uri": u }),
-                pdfcraft_render::LinkTarget::SetLayers { changes, preserve_rb } => json!({
-                    "layers": changes.iter().map(|(op, ocg)| json!({
-                        "layer": i.layers.iter().find(|l| l.id == *ocg).map(|l| l.name.as_str()),
-                        "state": match op {
-                            pdfcraft_render::LayerOp::On => "on",
-                            pdfcraft_render::LayerOp::Off => "off",
-                            pdfcraft_render::LayerOp::Toggle => "toggle",
-                        },
-                    })).collect::<Vec<_>>(),
-                    "preserve_rb": preserve_rb,
-                }),
-                pdfcraft_render::LinkTarget::RemoteGoTo { launch, file, destination, new_window } => json!({
-                    "action": if *launch { "Launch" } else { "GoToR" },
-                    "remote_document": file,
-                    "destination": match destination {
-                        pdfcraft_render::RemoteDestination::Default => json!({ "kind": "default" }),
-                        pdfcraft_render::RemoteDestination::Page { page, view } => json!({ "kind": "page", "page": page1(*page), "view": format!("{view:?}") }),
-                        pdfcraft_render::RemoteDestination::Named(name) => json!({ "kind": "named", "name": name }),
-                    },
-                    "new_window": new_window,
-                }),
-                pdfcraft_render::LinkTarget::Other(o) => json!({ "other": o }),
-            },
-        })).collect::<Vec<_>>(),
-        "layers": i.layers.iter().map(|l| json!({ "name": l.name, "visible": l.visible, "initial": l.initial })).collect::<Vec<_>>(),
-        // Full-screen presentation settings a page carries (ISO 32000-2 §12.4.4): only pages with
-        // a `/Trans` or `/Dur` appear; `style` is null for a display time alone.
-        "transitions": i.transitions.iter().map(|t| json!({
-            "page": page1(t.page), "style": t.style.map(pdfcraft_render::TransitionStyle::name), "duration": t.duration,
-            "horizontal": t.horizontal, "inward": t.inward, "direction": t.direction, "scale": t.scale, "opaque": t.opaque,
-            "display": t.display,
-        })).collect::<Vec<_>>(),
-        "attachments": i.attachments.iter().map(|a| json!({ "name": a.name, "description": a.description, "size": a.size })).collect::<Vec<_>>(),
-        // `substitute` names the face standing in for a program the document does not embed, and
-        // `substitution` says why. Both are null for an embedded font: nothing stands in. A null
-        // `substitute` with a non-null `substitution` means no face was available at all, so
-        // nothing is drawn for that font -- which is the answer to "why is my text missing?".
-        "fonts": i.fonts.iter().map(|f| json!({
-            "name": f.name, "kind": f.kind, "embedded": f.embedded, "subset": f.subset, "encoding": f.encoding,
-            "substitute": f.substitute, "substitution": f.substitution,
-        })).collect::<Vec<_>>(),
-        "warnings": i.warnings,
-        "repairs": d.repair_log(),
-    })
-}
-
-/// A user-space rectangle on 0-based `page` in displayed-page coordinates (points from the
-/// top-left of the page as displayed, y down, after `/Rotate`), the way every tool reports
-/// rectangles; unchanged when the page is unknown (a malformed annotation that points at no page).
-/// Public so `pdfcraft-cli` reports the same rectangles as the tools.
-pub fn view_rect(i: &pdfcraft_render::DocInfo, page: usize, rect: [f32; 4]) -> [f32; 4] {
-    i.pages.get(page).map_or(rect, |p| comments::rect_to_view(p, rect))
-}
-
-fn outline(items: &[pdfcraft_render::OutlineItem]) -> Value {
-    Value::Array(items.iter().map(|o| json!({ "title": o.title, "page": o.page.map(|p| p + 1), "children": outline(&o.children) })).collect())
-}
-
-/// A rendered raster as PNG, through the engine's encoder (Export ▸ Image writes the same).
-fn encode_png(width: u32, height: u32, premultiplied: &[u8]) -> Result<Vec<u8>> {
-    pdfcraft_engine::export::encode_png(width, height, premultiplied).map_err(failed)
-}
-
-/// Extract the text of `pages` (0-based) with one renderer per worker thread.
-fn extract_parallel(bytes: &Arc<Vec<u8>>, password: Option<Arc<str>>, pages: &[usize]) -> PageTexts {
-    let extract = |r: &mut PageRenderer, p: usize| {
-        let out = r.render(RenderRequest { page: p, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, preview: false });
-        match out.error {
-            Some(e) => Err(e),
-            None => Ok(out.text.unwrap_or_default()),
-        }
-    };
-    let config = RenderConfig { password, ..Default::default() };
-    let workers = if cfg!(target_arch = "wasm32") { 1 } else { std::thread::available_parallelism().map_or(1, std::num::NonZeroUsize::get).min(8) };
-    // Small jobs aren't worth a second parse of the document.
-    if workers == 1 || pages.len() < 8 {
-        let mut r = PageRenderer::new(bytes.clone(), config);
-        return pages.iter().map(|p| (*p, extract(&mut r, *p))).collect();
-    }
-    let next = std::sync::atomic::AtomicUsize::new(0);
-    let mut out: PageTexts = std::thread::scope(|s| {
-        let handles: Vec<_> = (0..workers)
-            .map(|_| {
-                s.spawn(|| {
-                    let mut r = PageRenderer::new(bytes.clone(), config.clone());
-                    let mut done = Vec::new();
-                    loop {
-                        let i = next.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-                        let Some(p) = pages.get(i) else { break };
-                        done.push((*p, extract(&mut r, *p)));
-                    }
-                    done
-                })
-            })
-            .collect();
-        handles.into_iter().flat_map(|h| h.join().unwrap_or_default()).collect()
-    });
-    out.sort_by_key(|(p, _)| *p);
-    out
-}
-
-/// The file `name` inside `dir`, where `name` comes from a document or an argument: separators,
-/// colons (a Windows drive or stream) and control characters become `_`, and a name of only dots
-/// gets a leading `_`, so it is one plain file name and can't lead out of `dir`.
-fn child(dir: &Path, name: &str) -> PathBuf {
-    let mut safe: String = name.chars().map(|c| if matches!(c, '/' | '\\' | ':') || c.is_control() { '_' } else { c }).collect();
-    if safe.chars().all(|c| c == '.') {
-        safe.insert(0, '_');
-    }
-    dir.join(safe)
-}
-
-/// `<stem>.pdf` in `dir`, or `<stem> (2).pdf` and so on when that name is taken.
-fn unused(dir: &Path, stem: &str) -> PathBuf {
-    let first = child(dir, &format!("{stem}.pdf"));
-    if !first.exists() {
-        return first;
-    }
-    (2..10_000u32).map(|n| child(dir, &format!("{stem} ({n}).pdf"))).find(|p| !p.exists()).unwrap_or(first)
-}
-
-/// Largest input file a tool reads into memory (512 MiB, matching `doc_batch`).
-pub(crate) const MAX_INPUT: u64 = 512 * 1024 * 1024;
-
-/// Read a resolved input file of at most [`MAX_INPUT`] bytes without buffering past the cap.
-pub(crate) fn read_input_bytes(path: &Path) -> std::io::Result<Vec<u8>> {
-    use std::io::Read as _;
-    let file = std::fs::File::open(path)?;
-    if file.metadata().is_ok_and(|m| m.is_file() && m.len() > MAX_INPUT) {
-        return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "input exceeds 512 MiB"));
-    }
-    let mut bytes = Vec::new();
-    file.take(MAX_INPUT + 1).read_to_end(&mut bytes)?;
-    if bytes.len() as u64 > MAX_INPUT {
-        return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "input exceeds 512 MiB"));
-    }
-    Ok(bytes)
-}
-
-pub(crate) fn read_input(path: &Path) -> Result<Vec<u8>> {
-    read_input_bytes(path).map_err(|e| failed(format!("{}: {e}", path.display())))
-}
-
-/// Write and sync a temporary file in the same directory, then rename over the target.
-/// This flushes staged contents; it does not promise parent-directory durability after a
-/// power loss. Filesystems that refuse sync cause the save to fail before publication.
-fn write_atomic(path: &Path, bytes: &[u8]) -> Result<()> {
-    write_atomic_with(path, bytes, staging_suffixes())
-}
-
-/// [`write_atomic`], trying the staging names that `suffixes` give.
-fn write_atomic_with(path: &Path, bytes: &[u8], suffixes: impl IntoIterator<Item = u64>) -> Result<()> {
-    write_atomic_synced(path, bytes, suffixes, std::fs::File::sync_all)
-}
-
-fn write_atomic_synced(
-    path: &Path,
-    bytes: &[u8],
-    suffixes: impl IntoIterator<Item = u64>,
-    sync: impl FnOnce(&std::fs::File) -> std::io::Result<()>,
-) -> Result<()> {
-    // A folder can't be replaced, and staging beside it could land outside the root: "." names
-    // the root itself, whose parent isn't ours to write in.
-    if path.is_dir() {
-        return Err(failed(format!("{}: is a folder, not a file", path.display())));
-    }
-    let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or(Path::new("."));
-    path.file_name().ok_or_else(|| failed(format!("{}: not a file path", path.display())))?;
-    std::fs::create_dir_all(dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
-    // The writer itself is the platform crate's, shared with the desktop app and the CLI
-    // (#2166): the staging file is written, flushed (delayed writeback failures surface before
-    // the destination is replaced or a document marked clean), closed and renamed; a failure at
-    // any step removes it and leaves the destination as it was.
-    pdfcraft_platform::staging::write_atomically_with(path, bytes, StagingName::SuffixThenTag, suffixes, sync)
-        .map_err(|e| failed(format!("{}: {e}", path.display())))
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use pdfcraft_platform::staging::STAGING_ATTEMPTS;
-
-    /// `n` pages, page i showing "Page i".
-    fn numbered_pages(n: usize) -> Vec<u8> {
-        let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
-        let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 4 + 2 * i)).collect();
-        objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 200 300] >>", kids.join(" ")));
-        objs.push("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into());
-        for i in 0..n {
-            objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >> >>", 5 + 2 * i));
-            let body = format!("BT /F1 24 Tf 20 150 Td (Page {}) Tj ET", i + 1);
-            objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
-        }
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, o) in objs.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
-        }
-        let xref = out.len();
-        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
-        for o in offsets {
-            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
-        out
-    }
-
-    fn json(a: &mut Automation, tool: &str, args: Value) -> Value {
-        match a.call(tool, &args).map(|mut c| c.remove(0)) {
-            Ok(Content::Json(v)) => v,
-            other => panic!("{tool} {args}: {other:?}"),
-        }
-    }
-
-    fn search_document(a: &mut Automation, pages: usize) -> DocId {
-        a.session.open("synthetic.pdf", None, Arc::new(numbered_pages(pages)), None).unwrap()
-    }
-
-    #[test]
-    fn search_cache_stays_bounded_reextracts_and_follows_edits_and_close() {
-        let mut a = Automation::new();
-        a.texts = TextCache::new(16 * 1024);
-        let first = search_document(&mut a, 200);
-        let second = search_document(&mut a, 200);
-        for id in [first, second] {
-            let result = json(&mut a, "text_find", json!({ "doc": id.0, "query": "absent" }));
-            assert_eq!(result["complete"], true);
-            assert!(a.texts.bytes() <= 16 * 1024);
-            assert!(a.texts.len() < 200, "an exhaustive search must not retain every page");
-            let found = json(&mut a, "text_find", json!({ "doc": id.0, "query": "Page", "limit": 1000 }));
-            assert_eq!(found["count"], 200, "eviction inside a batch must not discard its matches");
-            eprintln!("200 pages searched: {} resident pages, {} estimated bytes (budget 16384)", a.texts.len(), a.texts.bytes());
-        }
-        assert!(a.texts.get(first, 0).is_none());
-        let text = a.page_texts(first, &[0]).unwrap().remove(0);
-        assert_eq!(text.plain_text(), "Page 1");
-        let again = a.page_texts(first, &[0]).unwrap().remove(0);
-        assert!(Arc::ptr_eq(&text, &again), "cache hits reuse glyph storage");
-        assert!(a.texts.bytes() <= 16 * 1024);
-        json(&mut a, "page_delete", json!({ "doc": first.0, "pages": [1] }));
-        let edited = a.page_texts(first, &[0]).unwrap().remove(0);
-        assert_eq!(edited.plain_text(), "Page 2");
-        assert!(!Arc::ptr_eq(&text, &edited));
-        json(&mut a, "doc_close", json!({ "doc": first.0, "discard_changes": true }));
-        json(&mut a, "doc_close", json!({ "doc": second.0 }));
-        assert_eq!((a.texts.bytes(), a.texts.len()), (0, 0));
-    }
-
-    #[test]
-    fn strict_text_collection_refuses_partial_results_but_keeps_successful_pages() {
-        let mut a = Automation::new();
-        let id = search_document(&mut a, 3);
-        let error = a.page_texts(id, &[0, 3, 1]).unwrap_err();
-        assert!(error.to_string().contains("page 4: page is out of range"));
-        assert!(a.texts.get(id, 0).is_some());
-        assert!(a.texts.get(id, 1).is_some(), "successful extraction after the failed entry is retained");
-        let results = a.page_text_results(id, &[2], &mut |_, _, _| vec![]).unwrap();
-        assert!(results[0].1.is_err(), "a missing worker result must not become an empty page");
-    }
-
-    #[test]
-    fn search_keeps_matches_around_failed_pages_and_continuations() {
-        let mut a = Automation::new();
-        let id = search_document(&mut a, 16);
-        let mut extract = |bytes: &Arc<Vec<u8>>, password, pages: &[usize]| {
-            extract_parallel(bytes, password, pages)
-                .into_iter()
-                .map(|(p, result)| (p, if [2, 6].contains(&p) { Err(format!("synthetic page {} failure", p + 1)) } else { result }))
-                .collect()
-        };
-        let all = a.text_find_with(&Args(&json!({ "doc": id.0, "query": "Page" })), &mut extract).unwrap();
-        assert_eq!(all["count"], 14);
-        assert_eq!(all["complete"], false);
-        assert_eq!(all["warning_count"], 2);
-        assert_eq!(all["warnings"][0]["page"], 3);
-        assert_eq!(all["warnings"][1]["page"], 7);
-        assert!(all.get("next").is_none());
-        assert_eq!(all["matches"][13]["page"], 16);
-        assert!(a.texts.get(id, 7).is_some(), "success after a failure in the same batch is cached");
-        let mut args = json!({ "doc": id.0, "query": "Page", "limit": 4 });
-        let mut matches = Vec::new();
-        let mut warned = Vec::new();
-        loop {
-            let part = a.text_find_with(&Args(&args), &mut extract).unwrap();
-            matches.extend(part["matches"].as_array().unwrap().iter().cloned());
-            warned.extend(part["warnings"].as_array().unwrap().iter().map(|w| w["page"].clone()));
-            if !part["warnings"].as_array().unwrap().is_empty() {
-                assert_eq!(part["complete"], false);
-            }
-            let Some(next) = part.get("next") else { break };
-            args["start_page"] = next["start_page"].clone();
-            args["skip"] = next["skip"].clone();
-        }
-        assert_eq!(matches, *all["matches"].as_array().unwrap(), "no readable match is lost or repeated");
-        assert_eq!(warned, vec![json!(3), json!(7)]);
-    }
-
-    #[test]
-    fn search_bounds_warning_volume_and_does_not_reach_distant_failures() {
-        let mut a = Automation::new();
-        let id = search_document(&mut a, 200);
-        let first = a
-            .text_find_with(&Args(&json!({ "doc": id.0, "query": "Page", "limit": 1 })), &mut |bytes, password, pages| {
-                assert!(pages.iter().all(|p| *p < FIND_FIRST_BATCH), "a bounded search must not reach the bad page at the end");
-                extract_parallel(bytes, password, pages)
-            })
-            .unwrap();
-        assert_eq!(first["count"], 1);
-        assert_eq!(first["warning_count"], 0);
-        assert_eq!(first["next"], json!({ "start_page": 2, "skip": 0 }));
-        a.texts.remove(&id);
-        let failures = a
-            .text_find_with(&Args(&json!({ "doc": id.0, "query": "Page" })), &mut |_, _, pages| {
-                pages.iter().map(|p| (*p, Err("界".repeat(2000)))).collect()
-            })
-            .unwrap();
-        assert_eq!(failures["count"], 0);
-        assert_eq!(failures["complete"], false);
-        assert!(failures.get("next").is_none());
-        assert_eq!(failures["warning_count"], 200);
-        assert_eq!(failures["warnings_truncated"], true);
-        let warnings = failures["warnings"].as_array().unwrap();
-        assert_eq!(warnings.len(), FIND_MAX_WARNINGS);
-        assert!(warnings.iter().all(|w| w["error"].as_str().unwrap().len() <= FIND_MAX_WARNING_BYTES && w["error_truncated"] == true));
-    }
-
-    #[test]
-    fn a_bounded_text_find_reads_only_the_pages_it_needs_and_says_it_stopped() {
-        let dir = std::env::temp_dir().join(format!("pdfcraft-automation-find-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        std::fs::write(dir.join("long.pdf"), numbered_pages(200)).unwrap();
-        let mut a = Automation::new().with_root(&dir).unwrap();
-        let doc = json(&mut a, "doc_open", json!({ "path": "long.pdf" }))["doc"].clone();
-        let extracted = |a: &Automation| a.texts.len();
-
-        // #971: the first match is on page 1 and the next on page 10, so the rest of the 200 pages
-        // aren't extracted or cached.
-        let first = json(&mut a, "text_find", json!({ "doc": doc, "query": "Page 1", "limit": 1 }));
-        assert_eq!(first["count"], 1);
-        assert_eq!(first["matches"][0]["page"], 1);
-        assert_eq!(first["complete"], false, "{first}");
-        assert_eq!(first["next"], json!({ "start_page": 10, "skip": 0 }));
-        assert!(extracted(&a) <= 3 * FIND_FIRST_BATCH, "{} pages extracted for one match", extracted(&a));
-
-        // Following `next` returns every match exactly once, in order, and then says it's complete.
-        // "1" appears twice on pages like 11 and 101, so continuing has to skip within a page.
-        let all = json(&mut a, "text_find", json!({ "doc": doc, "query": "1", "limit": 10_000 }));
-        assert_eq!(all["complete"], true);
-        assert!(all.get("next").is_none());
-        let mut pieced = Vec::new();
-        let mut args = json!({ "doc": doc, "query": "1", "limit": 3 });
-        loop {
-            let found = json(&mut a, "text_find", args.clone());
-            pieced.extend(found["matches"].as_array().unwrap().iter().map(|m| (m["page"].clone(), m["rects"].clone())));
-            if found["complete"] == true {
-                break;
-            }
-            args["start_page"] = found["next"]["start_page"].clone();
-            args["skip"] = found["next"]["skip"].clone();
-        }
-        let expected: Vec<_> = all["matches"].as_array().unwrap().iter().map(|m| (m["page"].clone(), m["rects"].clone())).collect();
-        assert_eq!(all["count"], expected.len());
-        assert_eq!(pieced, expected);
-
-        // A search that runs to the end below its limit is complete; a start page past the end is refused.
-        let few = json(&mut a, "text_find", json!({ "doc": doc, "query": "Page 200", "start_page": 150 }));
-        assert_eq!((few["count"].clone(), few["complete"].clone()), (json!(1), json!(true)));
-        assert!(a.call("text_find", &json!({ "doc": doc, "query": "x", "start_page": 201 })).is_err());
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn dot_dot_resolves_by_name_and_never_climbs_above_the_start() {
-        let base = std::env::temp_dir();
-        let l = |rel: &str| lexical(&base.join(rel));
-        assert_eq!(l("a/./b/../c"), Some(base.join("a").join("c")));
-        assert_eq!(l("missing/../../x"), lexical(&base.join("..").join("x")));
-        assert_eq!(l("a/.."), Some(lexical(&base).unwrap()));
-        let deep = "../".repeat(base.components().count() + 1);
-        assert_eq!(lexical(&base.join(&deep)), None);
-        assert_eq!(lexical(Path::new("..")), None);
-    }
-
-    #[test]
-    fn names_from_documents_become_one_plain_file_name() {
-        let dir = std::env::temp_dir().join("out");
-        for name in ["../../x.png", "/abs/x.png", r"..\..\x.png", "C:x.png", r"\\host\share\x.png", "a:stream", "..", ".", "", "tab\there", "ok.png"]
-        {
-            let p = child(&dir, name);
-            assert_eq!(p.parent(), Some(dir.as_path()), "{name:?} -> {}", p.display());
-            assert_eq!(p.components().count(), dir.components().count() + 1, "{name:?} -> {}", p.display());
-        }
-        assert_eq!(child(&dir, "ok.png"), dir.join("ok.png"));
-        assert_eq!(child(&dir, "../x.png"), dir.join(".._x.png"));
-    }
-
-    #[cfg(windows)]
-    #[test]
-    fn other_shares_and_device_paths_are_refused_by_name() {
-        let local = Path::new(r"\\?\C:\work\root");
-        for p in [
-            r"\\host\share\x.pdf",
-            "//host/share/x.pdf",
-            r"\/host/share/x.pdf",
-            r"\\?\UNC\host\share\x.pdf",
-            r"\\.\pipe\x",
-            r"\\.\C:\work\root\x.pdf",
-            r"\\?\GLOBALROOT\Device\x",
-        ] {
-            assert!(foreign_share(Path::new(p), local), "{p}");
-        }
-        for p in [r"C:\work\root\x.pdf", r"c:\elsewhere\x.pdf", r"\\?\C:\work\root\x.pdf", r"D:\x.pdf", r"C:x.pdf"] {
-            assert!(!foreign_share(Path::new(p), local), "{p}");
-        }
-        // A root on a share accepts that share, however it is spelled, and nothing else.
-        let shared = Path::new(r"\\?\UNC\Server\Docs\root");
-        assert!(!foreign_share(Path::new(r"\\server\docs\root\x.pdf"), shared));
-        assert!(!foreign_share(Path::new(r"\\?\UNC\SERVER\DOCS\x.pdf"), shared));
-        assert!(foreign_share(Path::new(r"\\server\other\x.pdf"), shared));
-        assert!(foreign_share(Path::new(r"\\attacker\docs\x.pdf"), shared));
-    }
-
-    /// A fresh, empty folder for one staging test.
-    fn staging_dir(test: &str) -> PathBuf {
-        let dir = std::env::temp_dir().join(format!("pdfcraft-staging-{}-{test}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        dir
-    }
-
-    fn staged(dir: &Path, suffix: u64) -> PathBuf {
-        dir.join(format!(".out.pdf.{suffix:016x}.pdfcraft-tmp"))
-    }
-
-    fn read(p: &Path) -> String {
-        std::fs::read_to_string(p).unwrap()
-    }
-
-    /// A symbolic link to a file, where the system allows one (Windows needs Developer Mode or an
-    /// administrator for it).
-    fn file_symlink(target: &Path, link: &Path) -> std::io::Result<()> {
-        #[cfg(unix)]
-        {
-            std::os::unix::fs::symlink(target, link)
-        }
-        #[cfg(windows)]
-        {
-            std::os::windows::fs::symlink_file(target, link)
-        }
-        #[cfg(not(any(unix, windows)))]
-        {
-            Err(std::io::Error::other(format!("no symbolic links here: {} {}", target.display(), link.display())))
-        }
-    }
-
-    #[test]
-    fn staging_never_writes_through_a_file_planted_at_its_name() {
-        let dir = staging_dir("planted");
-        // A file elsewhere that a planted link points at.
-        let outside = dir.join("outside.txt");
-        std::fs::write(&outside, "PRECIOUS").unwrap();
-        let target = dir.join("out.pdf");
-        // A hard link needs no privileges on any system, and writing to it writes to `outside`.
-        std::fs::hard_link(&outside, staged(&dir, 1)).unwrap();
-        std::fs::write(staged(&dir, 2), "PLANTED").unwrap();
-        write_atomic_with(&target, b"NEW", [1, 2, 3]).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert_eq!(read(&outside), "PRECIOUS");
-        assert_eq!(read(&staged(&dir, 1)), "PRECIOUS");
-        assert_eq!(read(&staged(&dir, 2)), "PLANTED");
-        assert!(!staged(&dir, 3).exists(), "the staging file was renamed into place");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn staging_never_writes_through_a_symbolic_link_planted_at_its_name() {
-        let dir = staging_dir("symlink");
-        let outside = dir.join("outside.txt");
-        std::fs::write(&outside, "PRECIOUS").unwrap();
-        let target = dir.join("out.pdf");
-        if let Err(e) = file_symlink(&outside, &staged(&dir, 1)) {
-            eprintln!("symbolic links not checked: {e}");
-            return;
-        }
-        write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert_eq!(read(&outside), "PRECIOUS");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn staging_never_creates_a_file_through_a_dangling_link_at_its_name() {
-        let dir = staging_dir("dangling");
-        let unborn = dir.join("created-through-a-link.txt");
-        let target = dir.join("out.pdf");
-        if let Err(e) = file_symlink(&unborn, &staged(&dir, 1)) {
-            eprintln!("symbolic links not checked: {e}");
-            return;
-        }
-        write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert!(!unborn.exists(), "nothing was created through the dangling link");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn staging_gives_up_rather_than_reuse_a_taken_name() {
-        let dir = staging_dir("taken");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, "OLD").unwrap();
-        for s in 1..=STAGING_ATTEMPTS as u64 {
-            std::fs::write(staged(&dir, s), "PLANTED").unwrap();
-        }
-        assert!(write_atomic_with(&target, b"NEW", 1..).is_err());
-        assert_eq!(read(&target), "OLD");
-        for s in 1..=STAGING_ATTEMPTS as u64 {
-            assert_eq!(read(&staged(&dir, s)), "PLANTED");
-        }
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn a_failed_staging_sync_keeps_the_destination_and_cleans_up() {
-        for exists in [false, true] {
-            let dir = staging_dir(if exists { "sync-existing" } else { "sync-new" });
-            let target = dir.join("out.pdf");
-            if exists {
-                std::fs::write(&target, "OLD").unwrap();
-            }
-            let result = write_atomic_synced(&target, b"NEW", [1], |_| {
-                assert_eq!(std::fs::read(staged(&dir, 1)).unwrap(), b"NEW", "sync follows writing");
-                if exists {
-                    assert_eq!(read(&target), "OLD", "sync precedes publication");
-                }
-                Err(std::io::Error::other("injected storage sync failure"))
-            });
-            assert!(result.is_err(), "sync failure must refuse publication");
-            assert!(result.unwrap_err().to_string().contains("injected storage sync failure"));
-            if exists {
-                assert_eq!(read(&target), "OLD");
-                assert_eq!(listing(&dir), ["out.pdf"]);
-            } else {
-                assert!(!target.exists());
-                assert!(listing(&dir).is_empty());
-            }
-            std::fs::remove_dir_all(dir).unwrap();
-        }
-    }
-
-    #[test]
-    fn invalid_save_bytes_never_reach_publication_or_mark_saved() {
-        let dir = staging_dir("invalid-save-bytes");
-        let target = dir.join("out.pdf");
-        let mut a = Automation::new().with_root(&dir).unwrap();
-        let id = search_document(&mut a, 2);
-        json(&mut a, "doc_save", json!({"doc": id.0, "path": "out.pdf"}));
-        let old = std::fs::read(&target).unwrap();
-        json(&mut a, "page_rotate", json!({"doc": id.0, "pages": [1], "degrees": 90}));
-        let before = summary(a.session.get(id).unwrap());
-        // Exercise both parse failure and a valid PDF that loses a page. This does not
-        // depend on a malformed input remaining unrepaired by future reader improvements.
-        for bytes in [b"not a PDF".to_vec(), numbered_pages(1)] {
-            let mut published = false;
-            let result = a.publish_save(id, &target, Arc::new(bytes), false, |_, _| {
-                published = true;
-                Ok(())
-            });
-            assert!(result.is_err(), "invalid output must be refused");
-            assert!(result.unwrap_err().to_string().contains("could not be reopened"));
-            assert!(!published, "validation must precede the writer");
-            assert_eq!(summary(a.session.get(id).unwrap()), before, "failed validation must preserve document state");
-            assert_eq!(std::fs::read(&target).unwrap(), old);
-            assert_eq!(listing(&dir), ["out.pdf"]);
-        }
-        json(&mut a, "doc_save", json!({"doc": id.0}));
-        assert!(!a.session.get(id).unwrap().dirty);
-        assert_ne!(std::fs::read(&target).unwrap(), old);
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    #[test]
-    fn a_failed_save_sync_keeps_the_document_dirty_and_can_be_retried() {
-        let dir = staging_dir("sync-dirty");
-        let target = dir.join("out.pdf");
-        let mut a = Automation::new().with_root(&dir).unwrap();
-        let id = search_document(&mut a, 2);
-        json(&mut a, "doc_save", json!({"doc": id.0, "path": "out.pdf"}));
-        let old = std::fs::read(&target).unwrap();
-        json(&mut a, "page_rotate", json!({"doc": id.0, "pages": [1], "degrees": 90}));
-        let args = json!({"doc": id.0});
-        let before = summary(a.doc(&Args(&args)).unwrap());
-        let result = a.doc_save_with(&Args(&args), |path, bytes| {
-            write_atomic_synced(path, bytes, [1], |_| Err(std::io::Error::other("injected storage sync failure")))
-        });
-        assert!(result.is_err());
-        let doc = a.doc(&Args(&args)).unwrap();
-        assert!(doc.dirty);
-        assert_eq!(summary(doc), before, "failed save must not reset history or saved state");
-        assert_eq!(std::fs::read(&target).unwrap(), old);
-        assert_eq!(listing(&dir), ["out.pdf"]);
-        json(&mut a, "doc_save", args.clone());
-        assert!(!a.doc(&Args(&args)).unwrap().dirty);
-        assert_ne!(std::fs::read(&target).unwrap(), old);
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    #[test]
-    fn successful_staging_sync_precedes_publication() {
-        let dir = staging_dir("sync-success");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, "OLD").unwrap();
-        let mut called = false;
-        write_atomic_synced(&target, b"NEW", [1], |file| {
-            called = true;
-            assert_eq!(read(&target), "OLD");
-            assert_eq!(std::fs::read(staged(&dir, 1)).unwrap(), b"NEW");
-            file.sync_all()
-        })
-        .unwrap();
-        assert!(called);
-        assert_eq!(read(&target), "NEW");
-        assert_eq!(listing(&dir), ["out.pdf"]);
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    /// The names in a folder: what a test can see was left behind.
-    fn listing(dir: &Path) -> Vec<String> {
-        let mut names: Vec<_> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
-        names.sort();
-        names
-    }
-
-    #[test]
-    fn staging_names_differ_between_saves_and_fit_long_names() {
-        let suffixes: std::collections::HashSet<u64> = staging_suffixes().take(64).collect();
-        assert_eq!(suffixes.len(), 64);
-        assert_ne!(staging_suffixes().next(), staging_suffixes().next(), "each save draws new names");
-        // 60 four-byte characters: a 244-byte name, within every system's limit. Its staging name
-        // must be too (on Linux the whole name in it would be 275 bytes).
-        let dir = staging_dir("long");
-        let name = format!("{}.pdf", "\u{1F600}".repeat(60));
-        write_atomic(&dir.join(&name), b"NEW").unwrap();
-        assert_eq!(read(&dir.join(&name)), "NEW");
-        assert_eq!(listing(&dir), [name], "no staging file is left behind");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn a_folder_at_the_staging_name_is_left_alone() {
-        let dir = staging_dir("folder");
-        std::fs::create_dir(staged(&dir, 1)).unwrap();
-        std::fs::write(staged(&dir, 1).join("inside.txt"), "PLANTED").unwrap();
-        let target = dir.join("out.pdf");
-        write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert_eq!(read(&staged(&dir, 1).join("inside.txt")), "PLANTED");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// Windows refuses to replace a read-only file, so the rename fails: the staging file must not
-    /// be left behind.
-    #[cfg(windows)]
-    #[test]
-    fn a_failed_rename_removes_the_staging_file() {
-        let dir = staging_dir("readonly");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, "OLD").unwrap();
-        let mut perms = std::fs::metadata(&target).unwrap().permissions();
-        perms.set_readonly(true);
-        std::fs::set_permissions(&target, perms.clone()).unwrap();
-        let e = write_atomic_with(&target, b"NEW", [7]).unwrap_err();
-        assert!(e.to_string().contains(&target.display().to_string()), "the rename failed, not the staging: {e}");
-        assert_eq!(read(&target), "OLD");
-        assert_eq!(listing(&dir), ["out.pdf"], "the staging file was removed");
-        #[allow(clippy::permissions_set_readonly_false)]
-        perms.set_readonly(false);
-        std::fs::set_permissions(&target, perms).unwrap();
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// A recovered document, or a new one, rotated and then undone still has never been saved:
-    /// `doc_close` refuses it unless told to discard it (#2346 review).
-    #[test]
-    fn closing_a_recovered_or_new_document_after_undo_is_refused() {
-        let mut a = Automation::new();
-        let recovered = a.session.open("Report.pdf", None, Arc::new(numbered_pages(2)), None).unwrap();
-        a.session.mark_recovered(recovered, Some("Report.pdf".into()));
-        let new = a.session.open_new("Combined.pdf", Arc::new(numbered_pages(2))).unwrap();
-        for id in [recovered, new] {
-            json(&mut a, "page_rotate", json!({"doc": id.0, "pages": [1], "degrees": 90}));
-            json(&mut a, "edit_undo", json!({"doc": id.0}));
-            let refused = a.call("doc_close", &json!({"doc": id.0}));
-            assert!(matches!(&refused, Err(e) if e.to_string().contains("unsaved changes")), "{id:?}: {refused:?}");
-            assert!(a.session.get(id).is_some(), "still open");
-            json(&mut a, "doc_close", json!({"doc": id.0, "discard_changes": true}));
-            assert!(a.session.get(id).is_none());
-        }
-    }
-
-    #[test]
-    fn tool_file_reads_refuse_inputs_exceeding_512_mib() {
-        let dir = staging_dir("capped-read");
-        let huge = dir.join("huge.bin");
-        let file = std::fs::File::create(&huge).unwrap();
-        file.set_len(MAX_INPUT + 1).unwrap();
-        drop(file);
-        let huge_str = huge.to_string_lossy().into_owned();
-
-        let mut a = Automation::new();
-        let id = a.session.open("a.pdf", None, Arc::new(numbered_pages(2)), None).unwrap().0;
-        for (tool, args) in [
-            ("doc_open", json!({ "path": huge_str })),
-            ("page_insert_file", json!({ "doc": id, "at": 1, "path": huge_str })),
-            ("page_replace", json!({ "doc": id, "pages": [1], "path": huge_str })),
-            ("page_add_image", json!({ "doc": id, "page": 1, "path": huge_str })),
-            ("doc_import_data", json!({ "doc": id, "path": huge_str })),
-            ("doc_create", json!({ "from": "text", "path": huge_str })),
-            ("doc_create", json!({ "from": "images", "paths": [huge_str] })),
-            ("doc_combine", json!({ "paths": [huge_str, huge_str] })),
-            ("form_merge_data", json!({ "paths": [huge_str], "path": dir.join("out.csv").to_string_lossy() })),
-            ("comment_add", json!({ "doc": id, "page": 1, "type": "attachment", "at": [72.0, 72.0], "path": huge_str })),
-            ("stamp_custom", json!({ "doc": id, "page": 1, "at": [72.0, 72.0], "path": huge_str })),
-            ("sign_trust", json!({ "paths": [huge_str] })),
-            ("attachment_add", json!({ "doc": id, "path": huge_str })),
-        ] {
-            let err = a.call(tool, &args).unwrap_err().to_string();
-            assert!(err.contains("input exceeds 512 MiB"), "{tool}: {err}");
-        }
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}
+mod tests;
diff --git a/crates/automation/src/pages.rs b/crates/automation/src/pages.rs
new file mode 100644
index 0000000000..d9ea9e5c4f
--- /dev/null
+++ b/crates/automation/src/pages.rs
@@ -0,0 +1,363 @@
+use super::dispatch::Content;
+use super::error::{Result, ToolError, failed};
+use super::json::{Args, one_based};
+use super::*;
+
+/// Default and maximum resolution for `page_render`.
+pub(crate) const DEFAULT_DPI: f64 = 96.0;
+
+pub(crate) const MAX_DPI: f64 = 600.0;
+
+/// `text_find` extracts this many pages first, doubling each batch up to [`FIND_MAX_BATCH`], so a
+/// match near the start returns without touching the rest of a long document (#971).
+pub(crate) const FIND_FIRST_BATCH: usize = 8;
+
+const FIND_MAX_BATCH: usize = 128;
+
+type PageTexts = Vec<(usize, std::result::Result<Arc<PageText>, String>)>;
+
+pub(crate) const FIND_MAX_WARNINGS: usize = 100;
+
+pub(crate) const FIND_MAX_WARNING_BYTES: usize = 1024;
+
+impl Automation {
+    // ---- pages and text ----------------------------------------------------------------------
+
+    /// 1-based page list → validated 0-based indices.
+    pub(crate) fn pages(&self, a: &Args, key: &str) -> Result<Vec<usize>> {
+        let n = self.doc(a)?.info.pages.len();
+        let pages = one_based(&a.ints(key)?)?;
+        if pages.is_empty() {
+            return Err(ToolError::InvalidArgs(format!("{key} must list at least one page")));
+        }
+        if let Some(p) = pages.iter().find(|p| **p >= n) {
+            return Err(ToolError::InvalidArgs(format!("page {} is out of range: the document has {n} pages", p + 1)));
+        }
+        Ok(pages)
+    }
+
+    /// A 1-based insertion position (1 = before the first page, n+1 = after the last) → 0-based.
+    pub(crate) fn position(&self, a: &Args, key: &str) -> Result<usize> {
+        self.opt_position(a, key)?.ok_or_else(|| Args::missing(key))
+    }
+
+    /// `position`, but `None` when the key is absent.
+    pub(crate) fn opt_position(&self, a: &Args, key: &str) -> Result<Option<usize>> {
+        let Some(at) = a.opt_int(key)? else { return Ok(None) };
+        let n = self.doc(a)?.info.pages.len();
+        if at < 1 || at as usize > n + 1 {
+            return Err(ToolError::InvalidArgs(format!("{key} must be between 1 and {} (the document has {n} pages)", n + 1)));
+        }
+        Ok(Some(at as usize - 1))
+    }
+
+    pub(crate) fn renderer(&mut self, id: DocId) -> Result<&mut PageRenderer> {
+        let doc = self.session.get(id).ok_or_else(|| failed("no such document"))?;
+        // The document's own view settings: layer visibility, hidden comments, reading colours
+        // (tools that change one drop this cache so the next render reads it again).
+        let config =
+            self.session.render_config(id).unwrap_or_else(|| RenderConfig { password: doc.password.as_deref().map(Arc::from), ..Default::default() });
+        let fresh = || (doc.display.clone(), PageRenderer::new(doc.display.clone(), config.clone()));
+        let entry = self.renderers.entry(id).or_insert_with(fresh);
+        if !Arc::ptr_eq(&entry.0, &doc.display) {
+            *entry = fresh();
+        }
+        Ok(&mut entry.1)
+    }
+
+    pub(crate) fn page_render(&mut self, a: &Args) -> Result<Content> {
+        let id = self.doc(a)?.id;
+        let page = self.page(a)?;
+        let dpi = a.opt_num("dpi")?.unwrap_or(DEFAULT_DPI);
+        if !(1.0..=MAX_DPI).contains(&dpi) {
+            return Err(ToolError::InvalidArgs(format!("dpi must be between 1 and {MAX_DPI}")));
+        }
+        let scale = (dpi / 72.0) as f32;
+        let block = a.opt_int("hide_text_block")?;
+        let added = a.opt_int("hide_added_text")?;
+        if block.is_some() && added.is_some() {
+            return Err(ToolError::InvalidArgs("choose only one of hide_text_block and hide_added_text".into()));
+        }
+        let out = if let Some(block) = block {
+            if block < 1 {
+                return Err(ToolError::InvalidArgs("hide_text_block must be a positive paragraph index from text_paragraphs".into()));
+            }
+            // The number names the paragraph text_paragraphs listed, as it does for text_edit.
+            let doc = self.doc(a)?;
+            let index = self.paragraph_index(doc.id, page, block, &doc.text_blocks(page))?;
+            doc.text_edit_preview(page, index).map_err(failed)?.render_background(scale).map_err(failed)?
+        } else if let Some(added) = added {
+            let index = usize::try_from(added)
+                .ok()
+                .and_then(|n| n.checked_sub(1))
+                .ok_or_else(|| ToolError::InvalidArgs("hide_added_text must be a positive added text index from object_list".into()))?;
+            self.doc(a)?.added_text_preview(page, index).map_err(failed)?.render_background(scale).map_err(failed)?
+        } else {
+            self.renderer(id)?.render(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale, tag: 0, preview: false })
+        };
+        if let Some(e) = out.error {
+            return Err(failed(format!("page {} could not be rendered: {e}", page + 1)));
+        }
+        let data = encode_png(out.width, out.height, &out.rgba)?;
+        Ok(Content::Png { data, width: out.width, height: out.height })
+    }
+
+    /// A page as RGBA pixels, without encoding a PNG. `page` is 1-based and `scale` is pixels
+    /// per point (1.0 = 72 dpi). For an embedder that paints the result straight onto a canvas:
+    /// the `page_render` tool only returns PNG, and encoding one to decode it again is wasted
+    /// work on every scroll. It uses the same renderer, and the same per-document cache, as
+    /// `page_render`.
+    pub fn render_pixels(&mut self, doc: u64, page: usize, scale: f32) -> Result<(u32, u32, pdfcraft_render::Pixels)> {
+        if !(scale.is_finite() && scale > 0.0 && scale <= (MAX_DPI / 72.0) as f32) {
+            return Err(ToolError::InvalidArgs(format!("scale must be between 0 and {}", MAX_DPI / 72.0)));
+        }
+        let id = DocId(doc);
+        let n = self.session.get(id).ok_or_else(|| failed(format!("no open document with id {doc} (see doc_list)")))?.info.pages.len();
+        if page < 1 || page > n {
+            return Err(ToolError::InvalidArgs(format!("page {page} is out of range: the document has {n} pages")));
+        }
+        let out = self.renderer(id)?.render(RenderRequest { page: page - 1, kind: RequestKind::Pixels, tile: None, scale, tag: 0, preview: false });
+        if let Some(e) = out.error {
+            return Err(failed(format!("page {page} could not be rendered: {e}")));
+        }
+        Ok((out.width, out.height, out.rgba))
+    }
+
+    pub(crate) fn page(&self, a: &Args) -> Result<usize> {
+        let n = self.doc(a)?.info.pages.len();
+        let p = a.int("page")?;
+        if p < 1 || p as usize > n {
+            return Err(ToolError::InvalidArgs(format!("page {p} is out of range: the document has {n} pages")));
+        }
+        Ok(p as usize - 1)
+    }
+
+    /// The text of `pages` (0-based), from the cache or extracted in parallel.
+    pub(crate) fn page_texts(&mut self, id: DocId, pages: &[usize]) -> Result<Vec<Arc<PageText>>> {
+        self.page_text_results(id, pages, &mut extract_parallel)?
+            .into_iter()
+            .map(|(p, text)| text.map_err(|e| failed(format!("page {}: {e}", p + 1))))
+            .collect()
+    }
+
+    /// Keep per-page failures until the caller chooses strict or partial-result semantics.
+    pub(crate) fn page_text_results(
+        &mut self,
+        id: DocId,
+        pages: &[usize],
+        extract: &mut impl FnMut(&Arc<Vec<u8>>, Option<Arc<str>>, &[usize]) -> PageTexts,
+    ) -> Result<PageTexts> {
+        let doc = self.session.get(id).ok_or_else(|| failed("no such document"))?;
+        let (bytes, n) = (doc.bytes.clone(), doc.info.pages.len());
+        let password: Option<Arc<str>> = doc.password.as_deref().map(Arc::from);
+        self.texts.prepare(id, &bytes);
+        let mut results = HashMap::new();
+        let mut missing = Vec::new();
+        for &p in pages {
+            if p >= n {
+                results.insert(p, Err("page is out of range".to_owned()));
+            } else if let Some(text) = self.texts.get(id, p) {
+                results.insert(p, Ok(text));
+            } else {
+                missing.push(p);
+            }
+        }
+        missing.sort_unstable();
+        missing.dedup();
+        if !missing.is_empty() {
+            for (p, text) in extract(&bytes, password, &missing) {
+                if let Ok(text) = &text {
+                    self.texts.insert(id, p, &bytes, text.clone());
+                }
+                results.insert(p, text);
+            }
+        }
+        // The batch owns its Arcs: evicting a cache entry cannot lose a requested result. A
+        // worker that fails to return a page is an explicit failure, never an empty success.
+        Ok(pages.iter().map(|p| (*p, results.get(p).cloned().unwrap_or_else(|| Err("text extraction returned no result".into())))).collect())
+    }
+
+    pub(crate) fn text_word_count(&self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::word_count::{self, Counts, Options};
+        let doc = self.doc_to_copy(a)?;
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..doc.info.pages.len()).collect(),
+        };
+        let options = Options {
+            exclude_tables: a.opt_bool("exclude_tables")?.unwrap_or(false),
+            exclude_code: a.opt_bool("exclude_code")?.unwrap_or(false),
+            exclude_images: a.opt_bool("exclude_images")?.unwrap_or(false),
+        };
+        let report = word_count::count(doc.export_source(), &pages, options, |_| true).map_err(failed)?;
+        let counts = |c: Counts| json!({ "words": c.words, "characters": c.characters, "characters_without_spaces": c.characters_without_spaces });
+        Ok(json!({
+            "total": counts(report.total),
+            "pages": report.pages.into_iter().map(|(p, c)| json!({ "page": p + 1, "counts": counts(c) })).collect::<Vec<_>>(),
+            "pages_without_text": report.pages_without_text,
+            "unclassified_structure": report.unclassified_structure,
+        }))
+    }
+
+    pub(crate) fn text_extract(&mut self, a: &Args) -> Result<Value> {
+        let doc = self.doc_to_copy(a)?;
+        let id = doc.id;
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..doc.info.pages.len()).collect(),
+        };
+        // Column select (#740): only the text inside the rectangle, row by row.
+        let rect = a.nums::<4>("rect")?.map(|r| r.map(|v| v as f32));
+        let texts = self.page_texts(id, &pages)?;
+        let text = |t: &PageText| match rect {
+            Some(r) => t.column_text(&t.glyphs_in(r)),
+            None => t.plain_text(),
+        };
+        let out: Vec<Value> = pages.iter().zip(texts).map(|(p, t)| json!({ "page": p + 1, "text": text(&t) })).collect();
+        Ok(json!({ "pages": out }))
+    }
+
+    /// Matches in document order, extracting page text in growing batches and stopping as soon as
+    /// `limit` is reached, so a bounded search doesn't extract (and cache) the whole document
+    /// (#971). One match past the limit supplies `next`. Reached extraction failures are reported
+    /// as bounded warnings; `complete` requires both no continuation and no failed pages.
+    pub(crate) fn text_find(&mut self, a: &Args) -> Result<Value> {
+        self.text_find_with(a, &mut extract_parallel)
+    }
+
+    pub(crate) fn text_find_with(
+        &mut self,
+        a: &Args,
+        extract: &mut impl FnMut(&Arc<Vec<u8>>, Option<Arc<str>>, &[usize]) -> PageTexts,
+    ) -> Result<Value> {
+        let doc = self.doc(a)?;
+        let (id, n) = (doc.id, doc.info.pages.len());
+        let query = a.str("query")?;
+        let limit = usize::try_from(a.opt_int("limit")?.unwrap_or(500).max(1)).unwrap_or(usize::MAX);
+        let start = match a.opt_int("start_page")? {
+            None => 0,
+            Some(p) if p >= 1 && usize::try_from(p).is_ok_and(|p| p <= n) => usize::try_from(p - 1).unwrap_or(0),
+            Some(p) => return Err(ToolError::InvalidArgs(format!("start_page {p} is out of range: the document has {n} pages"))),
+        };
+        let skip = usize::try_from(a.opt_int("skip")?.unwrap_or(0).max(0)).unwrap_or(usize::MAX);
+        let mut matches = Vec::new();
+        let mut next = None;
+        let mut warnings = Vec::new();
+        let mut warning_count = 0usize;
+        let (mut first, mut batch) = (start, FIND_FIRST_BATCH);
+        'search: while first < n {
+            let end = first.saturating_add(batch).min(n);
+            let pages: Vec<usize> = (first..end).collect();
+            let texts = self.page_text_results(id, &pages, extract)?;
+            for (p, text) in texts {
+                let text = match text {
+                    Ok(text) => text,
+                    Err(mut error) => {
+                        warning_count += 1;
+                        if warnings.len() < FIND_MAX_WARNINGS {
+                            let end = error.floor_char_boundary(FIND_MAX_WARNING_BYTES.min(error.len()));
+                            let truncated = end < error.len();
+                            error.truncate(end);
+                            warnings.push(json!({ "page": p + 1, "error": error, "error_truncated": truncated }));
+                        }
+                        continue;
+                    }
+                };
+                let skip_here = if p == start { skip } else { 0 };
+                // One extra match proves that the caller needs a continuation. Include skipped
+                // matches on the starting page when bounding the temporary per-page result.
+                let needed = limit.saturating_sub(matches.len()).saturating_add(skip_here).saturating_add(1);
+                for (k, r) in text.find_opts_limited(query, false, false, needed).into_iter().enumerate().skip(skip_here) {
+                    if matches.len() == limit {
+                        next = Some(json!({ "start_page": p + 1, "skip": k }));
+                        break 'search;
+                    }
+                    matches.push(json!({ "page": p + 1, "text": text.text_of(r.clone()), "rects": text.line_rects(r) }));
+                }
+            }
+            first = end;
+            batch = batch.saturating_mul(2).min(FIND_MAX_BATCH);
+        }
+        let mut out = json!({ "query": query, "count": matches.len(), "complete": next.is_none() && warning_count == 0, "matches": matches,
+            "warnings_truncated": warning_count > warnings.len(), "warning_count": warning_count, "warnings": warnings });
+        if let (Some(next), Some(o)) = (next, out.as_object_mut()) {
+            o.insert("next".into(), next);
+        }
+        Ok(out)
+    }
+
+    pub(crate) fn command_list(&self, a: &Args) -> Result<Value> {
+        let active = match a.opt_int("doc")? {
+            Some(_) => Some(self.doc(a)?.id),
+            None => None,
+        };
+        let filter = a.opt_str("filter")?.unwrap_or("").to_lowercase();
+        let enabled_only = a.opt_bool("enabled_only")?.unwrap_or(false);
+        let list: Vec<Value> = commands::COMMANDS
+            .iter()
+            .map(|c| {
+                json!({
+                    "id": c.id,
+                    "label": commands::current_label(c, &self.session, active),
+                    "menu": c.menu,
+                    "shortcut": c.shortcut.map(|s| s.label(cfg!(target_os = "macos"))),
+                    "enabled": commands::is_enabled(c, &self.session, active),
+                    "tool": tools::tool_for_command(c.id),
+                    "params": tools::tool_for_command(c.id).and_then(tools::find).map(|t| &t.input_schema),
+                })
+            })
+            .collect();
+        let list: Vec<Value> = list
+            .into_iter()
+            .filter(|c| {
+                (!enabled_only || c.get("enabled").and_then(Value::as_bool) == Some(true))
+                    && (filter.is_empty()
+                        || ["id", "label", "menu"].iter().any(|k| c.get(k).is_some_and(|v| v.to_string().to_lowercase().contains(&filter))))
+            })
+            .collect();
+        Ok(json!({ "commands": list }))
+    }
+}
+
+/// A rendered raster as PNG, through the engine's encoder (Export ▸ Image writes the same).
+pub(crate) fn encode_png(width: u32, height: u32, premultiplied: &[u8]) -> Result<Vec<u8>> {
+    pdfcraft_engine::export::encode_png(width, height, premultiplied).map_err(failed)
+}
+
+/// Extract the text of `pages` (0-based) with one renderer per worker thread.
+pub(crate) fn extract_parallel(bytes: &Arc<Vec<u8>>, password: Option<Arc<str>>, pages: &[usize]) -> PageTexts {
+    let extract = |r: &mut PageRenderer, p: usize| {
+        let out = r.render(RenderRequest { page: p, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, preview: false });
+        match out.error {
+            Some(e) => Err(e),
+            None => Ok(out.text.unwrap_or_default()),
+        }
+    };
+    let config = RenderConfig { password, ..Default::default() };
+    let workers = if cfg!(target_arch = "wasm32") { 1 } else { std::thread::available_parallelism().map_or(1, std::num::NonZeroUsize::get).min(8) };
+    // Small jobs aren't worth a second parse of the document.
+    if workers == 1 || pages.len() < 8 {
+        let mut r = PageRenderer::new(bytes.clone(), config);
+        return pages.iter().map(|p| (*p, extract(&mut r, *p))).collect();
+    }
+    let next = std::sync::atomic::AtomicUsize::new(0);
+    let mut out: PageTexts = std::thread::scope(|s| {
+        let handles: Vec<_> = (0..workers)
+            .map(|_| {
+                s.spawn(|| {
+                    let mut r = PageRenderer::new(bytes.clone(), config.clone());
+                    let mut done = Vec::new();
+                    loop {
+                        let i = next.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                        let Some(p) = pages.get(i) else { break };
+                        done.push((*p, extract(&mut r, *p)));
+                    }
+                    done
+                })
+            })
+            .collect();
+        handles.into_iter().flat_map(|h| h.join().unwrap_or_default()).collect()
+    });
+    out.sort_by_key(|(p, _)| *p);
+    out
+}
diff --git a/crates/automation/src/paths.rs b/crates/automation/src/paths.rs
new file mode 100644
index 0000000000..fb514df69f
--- /dev/null
+++ b/crates/automation/src/paths.rs
@@ -0,0 +1,180 @@
+use super::error::{Result, failed};
+use super::*;
+
+impl Automation {
+    // ---- paths -------------------------------------------------------------------------------
+
+    /// Resolve a user-supplied path, enforcing the root (if any). `for_write` allows a file that
+    /// does not exist yet (its nearest existing ancestor must be inside the root).
+    ///
+    /// Every path outside the root gets the same refusal, so a confined client can't learn what
+    /// exists out there (#136): `..` is resolved by name first, another network share or device
+    /// namespace is refused without touching it, and the deepest existing ancestor (links
+    /// followed) must be inside the root before anything about the rest is reported.
+    pub(crate) fn resolve(&self, path: &str, for_write: bool) -> Result<PathBuf> {
+        let access = if for_write { file_access::Access::Write } else { file_access::Access::Read };
+        self.resolve_for(path, access, for_write)
+    }
+
+    /// [`resolve`](Self::resolve) with the kind of access named, for the places where a file that
+    /// is only read may still be missing (a path checked up front, whose absence is reported per
+    /// file later). The automation roots, if any, get the last word.
+    pub(crate) fn resolve_for(&self, path: &str, access: file_access::Access, may_be_missing: bool) -> Result<PathBuf> {
+        let target = self.resolve_in_root(path, may_be_missing)?;
+        self.check_roots(path, &target, access)?;
+        Ok(target)
+    }
+
+    /// Hold `target`, which `path` named, to the automation read or write root. Always passes
+    /// without roots.
+    pub(crate) fn check_roots(&self, path: &str, target: &Path, access: file_access::Access) -> Result<()> {
+        match &self.roots {
+            Some(roots) => roots.check_path(path, target, access).map_err(failed),
+            None => Ok(()),
+        }
+    }
+
+    fn resolve_in_root(&self, path: &str, for_write: bool) -> Result<PathBuf> {
+        let p = Path::new(path);
+        let Some(root) = &self.root else { return Ok(p.to_path_buf()) };
+        let outside = || failed(format!("{path} is outside the allowed directory {}", root.display()));
+        let joined = lexical(&root.join(p)).ok_or_else(outside)?;
+        if foreign_share(&joined, root) {
+            return Err(outside());
+        }
+        let mut existing = joined.as_path();
+        let mut rest = Vec::new();
+        while !existing.exists() {
+            if existing.symlink_metadata().is_ok_and(|m| m.file_type().is_symlink()) {
+                return Err(outside()); // a broken link: going on would tell whether its target exists
+            }
+            match (existing.file_name(), existing.parent()) {
+                (Some(name), Some(parent)) => {
+                    rest.push(name);
+                    existing = parent;
+                }
+                _ => return Err(outside()), // not even a drive or share that exists
+            }
+        }
+        let mut real = existing.canonicalize().map_err(|_| outside())?;
+        if !real.starts_with(root) {
+            return Err(outside());
+        }
+        if !rest.is_empty() && !for_write {
+            // Missing, below a folder inside the root: say where it was looked for, so a path
+            // written for another working directory can be corrected (#1890), and otherwise
+            // why, as the system reports it. `joined` is under the root, so naming it reveals
+            // nothing outside.
+            real = joined.canonicalize().map_err(|e| {
+                let (looked, root) = (joined.display(), root.display());
+                match e.kind() {
+                    std::io::ErrorKind::NotFound => failed(format!("{path} not found (looked for {looked}, --root {root})")),
+                    _ => failed(format!("{path}: {e} (looked for {looked}, --root {root})")),
+                }
+            })?;
+            if !real.starts_with(root) {
+                return Err(outside()); // it appeared, as a link out, since the check above
+            }
+            return Ok(real);
+        }
+        real.extend(rest.iter().rev());
+        Ok(real)
+    }
+}
+
+/// `path` with `.` and `..` resolved by name, before the filesystem is consulted (Windows does
+/// the same, and so does joining onto a canonical root there). `None` if a `..` would climb
+/// above the start of the path.
+pub(crate) fn lexical(path: &Path) -> Option<PathBuf> {
+    use std::path::Component;
+    let mut parts: Vec<Component> = Vec::new();
+    for c in path.components() {
+        match c {
+            Component::CurDir => {}
+            Component::ParentDir => match parts.last() {
+                Some(Component::Normal(_)) => {
+                    parts.pop();
+                }
+                _ => return None,
+            },
+            other => parts.push(other),
+        }
+    }
+    Some(parts.iter().collect())
+}
+
+/// The file `name` inside `dir`, where `name` comes from a document or an argument: separators,
+/// colons (a Windows drive or stream) and control characters become `_`, and a name of only dots
+/// gets a leading `_`, so it is one plain file name and can't lead out of `dir`.
+pub(crate) fn child(dir: &Path, name: &str) -> PathBuf {
+    let mut safe: String = name.chars().map(|c| if matches!(c, '/' | '\\' | ':') || c.is_control() { '_' } else { c }).collect();
+    if safe.chars().all(|c| c == '.') {
+        safe.insert(0, '_');
+    }
+    dir.join(safe)
+}
+
+/// `<stem>.pdf` in `dir`, or `<stem> (2).pdf` and so on when that name is taken.
+pub(crate) fn unused(dir: &Path, stem: &str) -> PathBuf {
+    let first = child(dir, &format!("{stem}.pdf"));
+    if !first.exists() {
+        return first;
+    }
+    (2..10_000u32).map(|n| child(dir, &format!("{stem} ({n}).pdf"))).find(|p| !p.exists()).unwrap_or(first)
+}
+
+/// Largest input file a tool reads into memory (512 MiB, matching `doc_batch`).
+pub(crate) const MAX_INPUT: u64 = 512 * 1024 * 1024;
+
+/// Read a resolved input file of at most [`MAX_INPUT`] bytes without buffering past the cap.
+pub(crate) fn read_input_bytes(path: &Path) -> std::io::Result<Vec<u8>> {
+    use std::io::Read as _;
+    let file = std::fs::File::open(path)?;
+    if file.metadata().is_ok_and(|m| m.is_file() && m.len() > MAX_INPUT) {
+        return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "input exceeds 512 MiB"));
+    }
+    let mut bytes = Vec::new();
+    file.take(MAX_INPUT + 1).read_to_end(&mut bytes)?;
+    if bytes.len() as u64 > MAX_INPUT {
+        return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "input exceeds 512 MiB"));
+    }
+    Ok(bytes)
+}
+
+pub(crate) fn read_input(path: &Path) -> Result<Vec<u8>> {
+    read_input_bytes(path).map_err(|e| failed(format!("{}: {e}", path.display())))
+}
+
+/// Write and sync a temporary file in the same directory, then rename over the target.
+/// This flushes staged contents; it does not promise parent-directory durability after a
+/// power loss. Filesystems that refuse sync cause the save to fail before publication.
+pub(crate) fn write_atomic(path: &Path, bytes: &[u8]) -> Result<()> {
+    write_atomic_with(path, bytes, staging_suffixes())
+}
+
+/// [`write_atomic`], trying the staging names that `suffixes` give.
+pub(crate) fn write_atomic_with(path: &Path, bytes: &[u8], suffixes: impl IntoIterator<Item = u64>) -> Result<()> {
+    write_atomic_synced(path, bytes, suffixes, std::fs::File::sync_all)
+}
+
+pub(crate) fn write_atomic_synced(
+    path: &Path,
+    bytes: &[u8],
+    suffixes: impl IntoIterator<Item = u64>,
+    sync: impl FnOnce(&std::fs::File) -> std::io::Result<()>,
+) -> Result<()> {
+    // A folder can't be replaced, and staging beside it could land outside the root: "." names
+    // the root itself, whose parent isn't ours to write in.
+    if path.is_dir() {
+        return Err(failed(format!("{}: is a folder, not a file", path.display())));
+    }
+    let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).unwrap_or(Path::new("."));
+    path.file_name().ok_or_else(|| failed(format!("{}: not a file path", path.display())))?;
+    std::fs::create_dir_all(dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
+    // The writer itself is the platform crate's, shared with the desktop app and the CLI
+    // (#2166): the staging file is written, flushed (delayed writeback failures surface before
+    // the destination is replaced or a document marked clean), closed and renamed; a failure at
+    // any step removes it and leaves the destination as it was.
+    pdfcraft_platform::staging::write_atomically_with(path, bytes, StagingName::SuffixThenTag, suffixes, sync)
+        .map_err(|e| failed(format!("{}: {e}", path.display())))
+}
diff --git a/crates/automation/src/tests.rs b/crates/automation/src/tests.rs
new file mode 100644
index 0000000000..fd4efa79da
--- /dev/null
+++ b/crates/automation/src/tests.rs
@@ -0,0 +1,552 @@
+use super::*;
+use pdfcraft_platform::staging::STAGING_ATTEMPTS;
+
+/// `n` pages, page i showing "Page i".
+fn numbered_pages(n: usize) -> Vec<u8> {
+    let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 4 + 2 * i)).collect();
+    objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 200 300] >>", kids.join(" ")));
+    objs.push("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into());
+    for i in 0..n {
+        objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >> >>", 5 + 2 * i));
+        let body = format!("BT /F1 24 Tf 20 150 Td (Page {}) Tj ET", i + 1);
+        objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn json(a: &mut Automation, tool: &str, args: Value) -> Value {
+    match a.call(tool, &args).map(|mut c| c.remove(0)) {
+        Ok(Content::Json(v)) => v,
+        other => panic!("{tool} {args}: {other:?}"),
+    }
+}
+
+fn search_document(a: &mut Automation, pages: usize) -> DocId {
+    a.session.open("synthetic.pdf", None, Arc::new(numbered_pages(pages)), None).unwrap()
+}
+
+#[test]
+fn search_cache_stays_bounded_reextracts_and_follows_edits_and_close() {
+    let mut a = Automation::new();
+    a.texts = TextCache::new(16 * 1024);
+    let first = search_document(&mut a, 200);
+    let second = search_document(&mut a, 200);
+    for id in [first, second] {
+        let result = json(&mut a, "text_find", json!({ "doc": id.0, "query": "absent" }));
+        assert_eq!(result["complete"], true);
+        assert!(a.texts.bytes() <= 16 * 1024);
+        assert!(a.texts.len() < 200, "an exhaustive search must not retain every page");
+        let found = json(&mut a, "text_find", json!({ "doc": id.0, "query": "Page", "limit": 1000 }));
+        assert_eq!(found["count"], 200, "eviction inside a batch must not discard its matches");
+        eprintln!("200 pages searched: {} resident pages, {} estimated bytes (budget 16384)", a.texts.len(), a.texts.bytes());
+    }
+    assert!(a.texts.get(first, 0).is_none());
+    let text = a.page_texts(first, &[0]).unwrap().remove(0);
+    assert_eq!(text.plain_text(), "Page 1");
+    let again = a.page_texts(first, &[0]).unwrap().remove(0);
+    assert!(Arc::ptr_eq(&text, &again), "cache hits reuse glyph storage");
+    assert!(a.texts.bytes() <= 16 * 1024);
+    json(&mut a, "page_delete", json!({ "doc": first.0, "pages": [1] }));
+    let edited = a.page_texts(first, &[0]).unwrap().remove(0);
+    assert_eq!(edited.plain_text(), "Page 2");
+    assert!(!Arc::ptr_eq(&text, &edited));
+    json(&mut a, "doc_close", json!({ "doc": first.0, "discard_changes": true }));
+    json(&mut a, "doc_close", json!({ "doc": second.0 }));
+    assert_eq!((a.texts.bytes(), a.texts.len()), (0, 0));
+}
+
+#[test]
+fn strict_text_collection_refuses_partial_results_but_keeps_successful_pages() {
+    let mut a = Automation::new();
+    let id = search_document(&mut a, 3);
+    let error = a.page_texts(id, &[0, 3, 1]).unwrap_err();
+    assert!(error.to_string().contains("page 4: page is out of range"));
+    assert!(a.texts.get(id, 0).is_some());
+    assert!(a.texts.get(id, 1).is_some(), "successful extraction after the failed entry is retained");
+    let results = a.page_text_results(id, &[2], &mut |_, _, _| vec![]).unwrap();
+    assert!(results[0].1.is_err(), "a missing worker result must not become an empty page");
+}
+
+#[test]
+fn search_keeps_matches_around_failed_pages_and_continuations() {
+    let mut a = Automation::new();
+    let id = search_document(&mut a, 16);
+    let mut extract = |bytes: &Arc<Vec<u8>>, password, pages: &[usize]| {
+        extract_parallel(bytes, password, pages)
+            .into_iter()
+            .map(|(p, result)| (p, if [2, 6].contains(&p) { Err(format!("synthetic page {} failure", p + 1)) } else { result }))
+            .collect()
+    };
+    let all = a.text_find_with(&Args(&json!({ "doc": id.0, "query": "Page" })), &mut extract).unwrap();
+    assert_eq!(all["count"], 14);
+    assert_eq!(all["complete"], false);
+    assert_eq!(all["warning_count"], 2);
+    assert_eq!(all["warnings"][0]["page"], 3);
+    assert_eq!(all["warnings"][1]["page"], 7);
+    assert!(all.get("next").is_none());
+    assert_eq!(all["matches"][13]["page"], 16);
+    assert!(a.texts.get(id, 7).is_some(), "success after a failure in the same batch is cached");
+    let mut args = json!({ "doc": id.0, "query": "Page", "limit": 4 });
+    let mut matches = Vec::new();
+    let mut warned = Vec::new();
+    loop {
+        let part = a.text_find_with(&Args(&args), &mut extract).unwrap();
+        matches.extend(part["matches"].as_array().unwrap().iter().cloned());
+        warned.extend(part["warnings"].as_array().unwrap().iter().map(|w| w["page"].clone()));
+        if !part["warnings"].as_array().unwrap().is_empty() {
+            assert_eq!(part["complete"], false);
+        }
+        let Some(next) = part.get("next") else { break };
+        args["start_page"] = next["start_page"].clone();
+        args["skip"] = next["skip"].clone();
+    }
+    assert_eq!(matches, *all["matches"].as_array().unwrap(), "no readable match is lost or repeated");
+    assert_eq!(warned, vec![json!(3), json!(7)]);
+}
+
+#[test]
+fn search_bounds_warning_volume_and_does_not_reach_distant_failures() {
+    let mut a = Automation::new();
+    let id = search_document(&mut a, 200);
+    let first = a
+        .text_find_with(&Args(&json!({ "doc": id.0, "query": "Page", "limit": 1 })), &mut |bytes, password, pages| {
+            assert!(pages.iter().all(|p| *p < FIND_FIRST_BATCH), "a bounded search must not reach the bad page at the end");
+            extract_parallel(bytes, password, pages)
+        })
+        .unwrap();
+    assert_eq!(first["count"], 1);
+    assert_eq!(first["warning_count"], 0);
+    assert_eq!(first["next"], json!({ "start_page": 2, "skip": 0 }));
+    a.texts.remove(&id);
+    let failures = a
+        .text_find_with(&Args(&json!({ "doc": id.0, "query": "Page" })), &mut |_, _, pages| {
+            pages.iter().map(|p| (*p, Err("界".repeat(2000)))).collect()
+        })
+        .unwrap();
+    assert_eq!(failures["count"], 0);
+    assert_eq!(failures["complete"], false);
+    assert!(failures.get("next").is_none());
+    assert_eq!(failures["warning_count"], 200);
+    assert_eq!(failures["warnings_truncated"], true);
+    let warnings = failures["warnings"].as_array().unwrap();
+    assert_eq!(warnings.len(), FIND_MAX_WARNINGS);
+    assert!(warnings.iter().all(|w| w["error"].as_str().unwrap().len() <= FIND_MAX_WARNING_BYTES && w["error_truncated"] == true));
+}
+
+#[test]
+fn a_bounded_text_find_reads_only_the_pages_it_needs_and_says_it_stopped() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-automation-find-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("long.pdf"), numbered_pages(200)).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let doc = json(&mut a, "doc_open", json!({ "path": "long.pdf" }))["doc"].clone();
+    let extracted = |a: &Automation| a.texts.len();
+
+    // #971: the first match is on page 1 and the next on page 10, so the rest of the 200 pages
+    // aren't extracted or cached.
+    let first = json(&mut a, "text_find", json!({ "doc": doc, "query": "Page 1", "limit": 1 }));
+    assert_eq!(first["count"], 1);
+    assert_eq!(first["matches"][0]["page"], 1);
+    assert_eq!(first["complete"], false, "{first}");
+    assert_eq!(first["next"], json!({ "start_page": 10, "skip": 0 }));
+    assert!(extracted(&a) <= 3 * FIND_FIRST_BATCH, "{} pages extracted for one match", extracted(&a));
+
+    // Following `next` returns every match exactly once, in order, and then says it's complete.
+    // "1" appears twice on pages like 11 and 101, so continuing has to skip within a page.
+    let all = json(&mut a, "text_find", json!({ "doc": doc, "query": "1", "limit": 10_000 }));
+    assert_eq!(all["complete"], true);
+    assert!(all.get("next").is_none());
+    let mut pieced = Vec::new();
+    let mut args = json!({ "doc": doc, "query": "1", "limit": 3 });
+    loop {
+        let found = json(&mut a, "text_find", args.clone());
+        pieced.extend(found["matches"].as_array().unwrap().iter().map(|m| (m["page"].clone(), m["rects"].clone())));
+        if found["complete"] == true {
+            break;
+        }
+        args["start_page"] = found["next"]["start_page"].clone();
+        args["skip"] = found["next"]["skip"].clone();
+    }
+    let expected: Vec<_> = all["matches"].as_array().unwrap().iter().map(|m| (m["page"].clone(), m["rects"].clone())).collect();
+    assert_eq!(all["count"], expected.len());
+    assert_eq!(pieced, expected);
+
+    // A search that runs to the end below its limit is complete; a start page past the end is refused.
+    let few = json(&mut a, "text_find", json!({ "doc": doc, "query": "Page 200", "start_page": 150 }));
+    assert_eq!((few["count"].clone(), few["complete"].clone()), (json!(1), json!(true)));
+    assert!(a.call("text_find", &json!({ "doc": doc, "query": "x", "start_page": 201 })).is_err());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn dot_dot_resolves_by_name_and_never_climbs_above_the_start() {
+    let base = std::env::temp_dir();
+    let l = |rel: &str| lexical(&base.join(rel));
+    assert_eq!(l("a/./b/../c"), Some(base.join("a").join("c")));
+    assert_eq!(l("missing/../../x"), lexical(&base.join("..").join("x")));
+    assert_eq!(l("a/.."), Some(lexical(&base).unwrap()));
+    let deep = "../".repeat(base.components().count() + 1);
+    assert_eq!(lexical(&base.join(&deep)), None);
+    assert_eq!(lexical(Path::new("..")), None);
+}
+
+#[test]
+fn names_from_documents_become_one_plain_file_name() {
+    let dir = std::env::temp_dir().join("out");
+    for name in ["../../x.png", "/abs/x.png", r"..\..\x.png", "C:x.png", r"\\host\share\x.png", "a:stream", "..", ".", "", "tab\there", "ok.png"] {
+        let p = child(&dir, name);
+        assert_eq!(p.parent(), Some(dir.as_path()), "{name:?} -> {}", p.display());
+        assert_eq!(p.components().count(), dir.components().count() + 1, "{name:?} -> {}", p.display());
+    }
+    assert_eq!(child(&dir, "ok.png"), dir.join("ok.png"));
+    assert_eq!(child(&dir, "../x.png"), dir.join(".._x.png"));
+}
+
+#[cfg(windows)]
+#[test]
+fn other_shares_and_device_paths_are_refused_by_name() {
+    let local = Path::new(r"\\?\C:\work\root");
+    for p in [
+        r"\\host\share\x.pdf",
+        "//host/share/x.pdf",
+        r"\/host/share/x.pdf",
+        r"\\?\UNC\host\share\x.pdf",
+        r"\\.\pipe\x",
+        r"\\.\C:\work\root\x.pdf",
+        r"\\?\GLOBALROOT\Device\x",
+    ] {
+        assert!(foreign_share(Path::new(p), local), "{p}");
+    }
+    for p in [r"C:\work\root\x.pdf", r"c:\elsewhere\x.pdf", r"\\?\C:\work\root\x.pdf", r"D:\x.pdf", r"C:x.pdf"] {
+        assert!(!foreign_share(Path::new(p), local), "{p}");
+    }
+    // A root on a share accepts that share, however it is spelled, and nothing else.
+    let shared = Path::new(r"\\?\UNC\Server\Docs\root");
+    assert!(!foreign_share(Path::new(r"\\server\docs\root\x.pdf"), shared));
+    assert!(!foreign_share(Path::new(r"\\?\UNC\SERVER\DOCS\x.pdf"), shared));
+    assert!(foreign_share(Path::new(r"\\server\other\x.pdf"), shared));
+    assert!(foreign_share(Path::new(r"\\attacker\docs\x.pdf"), shared));
+}
+
+/// A fresh, empty folder for one staging test.
+fn staging_dir(test: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-staging-{}-{test}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+fn staged(dir: &Path, suffix: u64) -> PathBuf {
+    dir.join(format!(".out.pdf.{suffix:016x}.pdfcraft-tmp"))
+}
+
+fn read(p: &Path) -> String {
+    std::fs::read_to_string(p).unwrap()
+}
+
+/// A symbolic link to a file, where the system allows one (Windows needs Developer Mode or an
+/// administrator for it).
+fn file_symlink(target: &Path, link: &Path) -> std::io::Result<()> {
+    #[cfg(unix)]
+    {
+        std::os::unix::fs::symlink(target, link)
+    }
+    #[cfg(windows)]
+    {
+        std::os::windows::fs::symlink_file(target, link)
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        Err(std::io::Error::other(format!("no symbolic links here: {} {}", target.display(), link.display())))
+    }
+}
+
+#[test]
+fn staging_never_writes_through_a_file_planted_at_its_name() {
+    let dir = staging_dir("planted");
+    // A file elsewhere that a planted link points at.
+    let outside = dir.join("outside.txt");
+    std::fs::write(&outside, "PRECIOUS").unwrap();
+    let target = dir.join("out.pdf");
+    // A hard link needs no privileges on any system, and writing to it writes to `outside`.
+    std::fs::hard_link(&outside, staged(&dir, 1)).unwrap();
+    std::fs::write(staged(&dir, 2), "PLANTED").unwrap();
+    write_atomic_with(&target, b"NEW", [1, 2, 3]).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert_eq!(read(&outside), "PRECIOUS");
+    assert_eq!(read(&staged(&dir, 1)), "PRECIOUS");
+    assert_eq!(read(&staged(&dir, 2)), "PLANTED");
+    assert!(!staged(&dir, 3).exists(), "the staging file was renamed into place");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn staging_never_writes_through_a_symbolic_link_planted_at_its_name() {
+    let dir = staging_dir("symlink");
+    let outside = dir.join("outside.txt");
+    std::fs::write(&outside, "PRECIOUS").unwrap();
+    let target = dir.join("out.pdf");
+    if let Err(e) = file_symlink(&outside, &staged(&dir, 1)) {
+        eprintln!("symbolic links not checked: {e}");
+        return;
+    }
+    write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert_eq!(read(&outside), "PRECIOUS");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn staging_never_creates_a_file_through_a_dangling_link_at_its_name() {
+    let dir = staging_dir("dangling");
+    let unborn = dir.join("created-through-a-link.txt");
+    let target = dir.join("out.pdf");
+    if let Err(e) = file_symlink(&unborn, &staged(&dir, 1)) {
+        eprintln!("symbolic links not checked: {e}");
+        return;
+    }
+    write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert!(!unborn.exists(), "nothing was created through the dangling link");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn staging_gives_up_rather_than_reuse_a_taken_name() {
+    let dir = staging_dir("taken");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, "OLD").unwrap();
+    for s in 1..=STAGING_ATTEMPTS as u64 {
+        std::fs::write(staged(&dir, s), "PLANTED").unwrap();
+    }
+    assert!(write_atomic_with(&target, b"NEW", 1..).is_err());
+    assert_eq!(read(&target), "OLD");
+    for s in 1..=STAGING_ATTEMPTS as u64 {
+        assert_eq!(read(&staged(&dir, s)), "PLANTED");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_failed_staging_sync_keeps_the_destination_and_cleans_up() {
+    for exists in [false, true] {
+        let dir = staging_dir(if exists { "sync-existing" } else { "sync-new" });
+        let target = dir.join("out.pdf");
+        if exists {
+            std::fs::write(&target, "OLD").unwrap();
+        }
+        let result = write_atomic_synced(&target, b"NEW", [1], |_| {
+            assert_eq!(std::fs::read(staged(&dir, 1)).unwrap(), b"NEW", "sync follows writing");
+            if exists {
+                assert_eq!(read(&target), "OLD", "sync precedes publication");
+            }
+            Err(std::io::Error::other("injected storage sync failure"))
+        });
+        assert!(result.is_err(), "sync failure must refuse publication");
+        assert!(result.unwrap_err().to_string().contains("injected storage sync failure"));
+        if exists {
+            assert_eq!(read(&target), "OLD");
+            assert_eq!(listing(&dir), ["out.pdf"]);
+        } else {
+            assert!(!target.exists());
+            assert!(listing(&dir).is_empty());
+        }
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
+
+#[test]
+fn invalid_save_bytes_never_reach_publication_or_mark_saved() {
+    let dir = staging_dir("invalid-save-bytes");
+    let target = dir.join("out.pdf");
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let id = search_document(&mut a, 2);
+    json(&mut a, "doc_save", json!({"doc": id.0, "path": "out.pdf"}));
+    let old = std::fs::read(&target).unwrap();
+    json(&mut a, "page_rotate", json!({"doc": id.0, "pages": [1], "degrees": 90}));
+    let before = summary(a.session.get(id).unwrap());
+    // Exercise both parse failure and a valid PDF that loses a page. This does not
+    // depend on a malformed input remaining unrepaired by future reader improvements.
+    for bytes in [b"not a PDF".to_vec(), numbered_pages(1)] {
+        let mut published = false;
+        let result = a.publish_save(id, &target, Arc::new(bytes), false, |_, _| {
+            published = true;
+            Ok(())
+        });
+        assert!(result.is_err(), "invalid output must be refused");
+        assert!(result.unwrap_err().to_string().contains("could not be reopened"));
+        assert!(!published, "validation must precede the writer");
+        assert_eq!(summary(a.session.get(id).unwrap()), before, "failed validation must preserve document state");
+        assert_eq!(std::fs::read(&target).unwrap(), old);
+        assert_eq!(listing(&dir), ["out.pdf"]);
+    }
+    json(&mut a, "doc_save", json!({"doc": id.0}));
+    assert!(!a.session.get(id).unwrap().dirty);
+    assert_ne!(std::fs::read(&target).unwrap(), old);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn a_failed_save_sync_keeps_the_document_dirty_and_can_be_retried() {
+    let dir = staging_dir("sync-dirty");
+    let target = dir.join("out.pdf");
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let id = search_document(&mut a, 2);
+    json(&mut a, "doc_save", json!({"doc": id.0, "path": "out.pdf"}));
+    let old = std::fs::read(&target).unwrap();
+    json(&mut a, "page_rotate", json!({"doc": id.0, "pages": [1], "degrees": 90}));
+    let args = json!({"doc": id.0});
+    let before = summary(a.doc(&Args(&args)).unwrap());
+    let result = a.doc_save_with(&Args(&args), |path, bytes| {
+        write_atomic_synced(path, bytes, [1], |_| Err(std::io::Error::other("injected storage sync failure")))
+    });
+    assert!(result.is_err());
+    let doc = a.doc(&Args(&args)).unwrap();
+    assert!(doc.dirty);
+    assert_eq!(summary(doc), before, "failed save must not reset history or saved state");
+    assert_eq!(std::fs::read(&target).unwrap(), old);
+    assert_eq!(listing(&dir), ["out.pdf"]);
+    json(&mut a, "doc_save", args.clone());
+    assert!(!a.doc(&Args(&args)).unwrap().dirty);
+    assert_ne!(std::fs::read(&target).unwrap(), old);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn successful_staging_sync_precedes_publication() {
+    let dir = staging_dir("sync-success");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, "OLD").unwrap();
+    let mut called = false;
+    write_atomic_synced(&target, b"NEW", [1], |file| {
+        called = true;
+        assert_eq!(read(&target), "OLD");
+        assert_eq!(std::fs::read(staged(&dir, 1)).unwrap(), b"NEW");
+        file.sync_all()
+    })
+    .unwrap();
+    assert!(called);
+    assert_eq!(read(&target), "NEW");
+    assert_eq!(listing(&dir), ["out.pdf"]);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+/// The names in a folder: what a test can see was left behind.
+fn listing(dir: &Path) -> Vec<String> {
+    let mut names: Vec<_> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    names.sort();
+    names
+}
+
+#[test]
+fn staging_names_differ_between_saves_and_fit_long_names() {
+    let suffixes: std::collections::HashSet<u64> = staging_suffixes().take(64).collect();
+    assert_eq!(suffixes.len(), 64);
+    assert_ne!(staging_suffixes().next(), staging_suffixes().next(), "each save draws new names");
+    // 60 four-byte characters: a 244-byte name, within every system's limit. Its staging name
+    // must be too (on Linux the whole name in it would be 275 bytes).
+    let dir = staging_dir("long");
+    let name = format!("{}.pdf", "\u{1F600}".repeat(60));
+    write_atomic(&dir.join(&name), b"NEW").unwrap();
+    assert_eq!(read(&dir.join(&name)), "NEW");
+    assert_eq!(listing(&dir), [name], "no staging file is left behind");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_folder_at_the_staging_name_is_left_alone() {
+    let dir = staging_dir("folder");
+    std::fs::create_dir(staged(&dir, 1)).unwrap();
+    std::fs::write(staged(&dir, 1).join("inside.txt"), "PLANTED").unwrap();
+    let target = dir.join("out.pdf");
+    write_atomic_with(&target, b"NEW", [1, 2]).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert_eq!(read(&staged(&dir, 1).join("inside.txt")), "PLANTED");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Windows refuses to replace a read-only file, so the rename fails: the staging file must not
+/// be left behind.
+#[cfg(windows)]
+#[test]
+fn a_failed_rename_removes_the_staging_file() {
+    let dir = staging_dir("readonly");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, "OLD").unwrap();
+    let mut perms = std::fs::metadata(&target).unwrap().permissions();
+    perms.set_readonly(true);
+    std::fs::set_permissions(&target, perms.clone()).unwrap();
+    let e = write_atomic_with(&target, b"NEW", [7]).unwrap_err();
+    assert!(e.to_string().contains(&target.display().to_string()), "the rename failed, not the staging: {e}");
+    assert_eq!(read(&target), "OLD");
+    assert_eq!(listing(&dir), ["out.pdf"], "the staging file was removed");
+    #[allow(clippy::permissions_set_readonly_false)]
+    perms.set_readonly(false);
+    std::fs::set_permissions(&target, perms).unwrap();
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A recovered document, or a new one, rotated and then undone still has never been saved:
+/// `doc_close` refuses it unless told to discard it (#2346 review).
+#[test]
+fn closing_a_recovered_or_new_document_after_undo_is_refused() {
+    let mut a = Automation::new();
+    let recovered = a.session.open("Report.pdf", None, Arc::new(numbered_pages(2)), None).unwrap();
+    a.session.mark_recovered(recovered, Some("Report.pdf".into()));
+    let new = a.session.open_new("Combined.pdf", Arc::new(numbered_pages(2))).unwrap();
+    for id in [recovered, new] {
+        json(&mut a, "page_rotate", json!({"doc": id.0, "pages": [1], "degrees": 90}));
+        json(&mut a, "edit_undo", json!({"doc": id.0}));
+        let refused = a.call("doc_close", &json!({"doc": id.0}));
+        assert!(matches!(&refused, Err(e) if e.to_string().contains("unsaved changes")), "{id:?}: {refused:?}");
+        assert!(a.session.get(id).is_some(), "still open");
+        json(&mut a, "doc_close", json!({"doc": id.0, "discard_changes": true}));
+        assert!(a.session.get(id).is_none());
+    }
+}
+
+#[test]
+fn tool_file_reads_refuse_inputs_exceeding_512_mib() {
+    let dir = staging_dir("capped-read");
+    let huge = dir.join("huge.bin");
+    let file = std::fs::File::create(&huge).unwrap();
+    file.set_len(MAX_INPUT + 1).unwrap();
+    drop(file);
+    let huge_str = huge.to_string_lossy().into_owned();
+
+    let mut a = Automation::new();
+    let id = a.session.open("a.pdf", None, Arc::new(numbered_pages(2)), None).unwrap().0;
+    for (tool, args) in [
+        ("doc_open", json!({ "path": huge_str })),
+        ("page_insert_file", json!({ "doc": id, "at": 1, "path": huge_str })),
+        ("page_replace", json!({ "doc": id, "pages": [1], "path": huge_str })),
+        ("page_add_image", json!({ "doc": id, "page": 1, "path": huge_str })),
+        ("doc_import_data", json!({ "doc": id, "path": huge_str })),
+        ("doc_create", json!({ "from": "text", "path": huge_str })),
+        ("doc_create", json!({ "from": "images", "paths": [huge_str] })),
+        ("doc_combine", json!({ "paths": [huge_str, huge_str] })),
+        ("form_merge_data", json!({ "paths": [huge_str], "path": dir.join("out.csv").to_string_lossy() })),
+        ("comment_add", json!({ "doc": id, "page": 1, "type": "attachment", "at": [72.0, 72.0], "path": huge_str })),
+        ("stamp_custom", json!({ "doc": id, "page": 1, "at": [72.0, 72.0], "path": huge_str })),
+        ("sign_trust", json!({ "paths": [huge_str] })),
+        ("attachment_add", json!({ "doc": id, "path": huge_str })),
+    ] {
+        let err = a.call(tool, &args).unwrap_err().to_string();
+        assert!(err.contains("input exceeds 512 MiB"), "{tool}: {err}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index a3bc420ae1..68166b5c5b 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -60,7 +60,10 @@ fn color() -> Value {
 fn comment_ref(mut extra: Value) -> Value {
     if let Some(props) = extra.as_object_mut() {
         props.insert("doc".into(), doc());
-        props.insert("id".into(), json!({ "type": "string", "description": "The comment's id (from comment_list)." }));
+        props.insert(
+            "id".into(),
+            json!({ "type": "string", "description": "The comment's id (from comment_list). An id several comments share is refused: pass page and index." }),
+        );
         props.insert("page".into(), json!({ "type": "integer", "minimum": 1, "description": "With `index`, instead of `id`." }));
         props.insert(
             "index".into(),
@@ -139,7 +142,7 @@ pub fn tools() -> Vec<ToolDef> {
             .cmd("file.open")
             .with(schema(json!({ "path": { "type": "string" }, "password": { "type": "string", "description": "User or owner password for encrypted files." } }), &["path"])),
         t("doc_list", "List open documents", "List the open documents with their ids, page counts and unsaved state.").ro().with(schema(json!({}), &[])),
-        t("doc_info", "Inspect a document", "Metadata, page sizes and labels, bookmarks, annotations, form fields, links, layers, page transitions and display times, attachments, fonts, security and repair notes.")
+        t("doc_info", "Inspect a document", "Metadata, page sizes and labels, bookmarks, annotations, form fields, links, layers, page transitions and display times, the destination it opens at, attachments, fonts, security and repair notes.")
             .ro()
             .cmd("file.properties")
             .with(schema(json!({ "doc": doc() }), &["doc"])),
@@ -624,7 +627,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
                     "char_spacing": { "type": "number", "minimum": -500, "maximum": 500, "description": "Points after each character." },
                     "rotate": { "type": "integer" }, "flip_h": { "type": "boolean" }, "flip_v": { "type": "boolean" },
-                    "crop": { "type": "array", "items": { "type": "number", "minimum": 0, "maximum": 0.49 }, "minItems": 4, "maxItems": 4 },
+                    "crop": { "type": "array", "items": { "type": "number", "minimum": 0, "maximum": 0.95 }, "minItems": 4, "maxItems": 4, "description": "Fractions trimmed: left, bottom, right, top. Left and right together, and bottom and top together, trim at most 0.95." },
                     "image": { "type": "string", "description": "Replace the picture with this file." },
                 }),
                 &["doc", "page", "index"],
@@ -700,7 +703,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro().cmd("measure.snap").with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1},"at":point(),"tolerance":{"type":"number","minimum":0,"maximum":10000},"endpoints":{"type":"boolean"},"midpoints":{"type":"boolean"},"intersections":{"type":"boolean"},"paths":{"type":"boolean"}}), &["doc","page","at"])),
         t("measure_export", "Export measurements as CSV", "Atomically write saved measurement values, labels, authors and scale ratios as spreadsheet-safe CSV. Returns how many unsupported measurements were left out.")
             .cmd("measure.export").with(schema(json!({"doc":doc(),"out":path_arg()}), &["doc","out"])),
-        t("comment_list", "List comments", "Every comment (annotation other than links, form widgets and pop-ups) with its page, index, id, type, author, text, date, rectangle, colour, review status and replies.")
+        t("comment_list", "List comments", "Every comment (annotation other than links, form widgets and pop-ups) with its page, index, id, type, author, text, date, rectangle, colour, review status, checkmark and replies (each with its own status and checkmark).")
             .ro()
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1, "description": "Only this page." } }), &["doc"])),
         t(
@@ -953,7 +956,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "doc_header_footer",
             "Add header and footer",
-            "Add a header and/or footer to pages. Text boxes: header_left/center/right, footer_left/center/right. Tokens: <<1>> page number, <<n>> page count, <<1 of n>>, <<Page 1 of n>>, <<1/n>>, dates <<m/d/yyyy>> <<yyyy-mm-dd>> <<mmmm d, yyyy>> (and more), Bates <<Bates Number#6#1#PREFIX#SUFFIX>>. shrink: true scales the page content down evenly into the room the header and footer leave free, so they don't cover it. font: Helvetica (default), Times or Courier. replace: true swaps out existing ones (Update). Undoable.",
+            "Add a header and/or footer to pages. Text boxes: header_left/center/right, footer_left/center/right. Tokens: <<1>> page number, <<n>> page count, <<1 of n>>, <<Page 1 of n>>, <<1/n>>, dates <<m/d/yyyy>> <<yyyy-mm-dd>> <<mmmm d, yyyy>> <<dd.mm.yyyy>> (and more), Bates <<Bates Number#6#1#PREFIX#SUFFIX>>. shrink: true scales the page content down evenly into the room the header and footer leave free, so they don't cover it. font: Helvetica (default), Times or Courier. replace: true swaps out existing ones (Update). Undoable.",
         )
         .cmd("edit.header_footer")
         .with(schema(
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 5e41069f6d..a4eb48e501 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -213,6 +213,62 @@ fn doc_info_lists_page_transitions_and_display_times() {
     );
 }
 
+/// `doc_info` says where the document opens: the `/OpenAction` destination, a named one
+/// resolved (ISO 32000-2 §12.3.2.4), as a 1-based page and a destination in view coordinates.
+#[test]
+fn doc_info_reports_the_open_destination() {
+    let dir = workdir("open-destination");
+    let write = |name: &str, catalog: &str| {
+        let objects: Vec<String> = vec![
+            format!("<< /Type /Catalog /Pages 2 0 R {catalog} >>"),
+            "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 612 792] >>".into(),
+            "<< /Type /Page /Parent 2 0 R >>".into(),
+            "<< /Type /Page /Parent 2 0 R >>".into(),
+        ];
+        let mut bytes = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, object) in objects.iter().enumerate() {
+            offsets.push(bytes.len());
+            bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = bytes.len();
+        bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+        for o in offsets {
+            bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+        std::fs::write(dir.join(name), bytes).unwrap();
+    };
+    write("named.pdf", "/OpenAction << /S /GoTo /D /there >> /Dests << /there [4 0 R /XYZ 100 500 2] >>");
+    write("script.pdf", "/OpenAction << /S /JavaScript /JS (1) >>");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "named.pdf" }))["doc"].as_u64().unwrap();
+    let open = ok(&mut a, "doc_info", json!({ "doc": doc }))["open_destination"].clone();
+    assert_eq!(open["page"], 2, "{open}");
+    // y 500 is 292 points below the top of the 792-point page.
+    assert_eq!(
+        (open["destination"]["fit"].as_str(), open["destination"]["left"].as_f64(), open["destination"]["top"].as_f64()),
+        (Some("XYZ"), Some(100.0), Some(292.0)),
+        "{open}"
+    );
+    assert_eq!(open["destination"]["zoom"].as_f64(), Some(2.0));
+    // The initial view reads the named destination's page, and choosing page 1 replaces it (ISO
+    // 32000-2 §12.3.2.4): one undo step, kept by the save.
+    let page = |a: &mut Automation, doc: u64| ok(a, "doc_info", json!({ "doc": doc }))["open_destination"]["page"].clone();
+    assert_eq!(ok(&mut a, "doc_initial_view", json!({ "doc": doc }))["initial_view"]["page"], 2);
+    assert_eq!(ok(&mut a, "doc_initial_view", json!({ "doc": doc, "page": 1 }))["initial_view"]["page"], 1);
+    assert_eq!(page(&mut a, doc), 1);
+    ok(&mut a, "edit_undo", json!({ "doc": doc }));
+    assert_eq!(page(&mut a, doc), 2);
+    ok(&mut a, "edit_redo", json!({ "doc": doc }));
+    assert_eq!(page(&mut a, doc), 1);
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "named-page1.pdf" }));
+    let saved = ok(&mut a, "doc_open", json!({ "path": "named-page1.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(page(&mut a, saved), 1);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "script.pdf" }))["doc"].as_u64().unwrap();
+    assert!(ok(&mut a, "doc_info", json!({ "doc": doc }))["open_destination"].is_null());
+}
+
 /// Page transitions through the tools: set on chosen pages, written to the file as `/Trans` and
 /// `/Dur`, removed again, bad values refused, and one undo step. (Read through `pdfcraft_cos`,
 /// so this does not lean on `doc_info` listing them.)
@@ -2078,6 +2134,83 @@ fn nested_replies_stay_in_the_listing() {
     assert!(replies.contains(&"DIRECT_REPLY") && replies.contains(&"NESTED_REPLY"), "the nested reply is listed: {replies:?}");
 }
 
+/// Replies thread by their `/IRT` reference, not `/NM`: PyMuPDF names the first comment on every
+/// page `fitz-A0`. A shared id is refused rather than taken to mean page 1's comment.
+#[test]
+fn replies_thread_by_reference_when_ids_repeat_across_pages() {
+    let dir = workdir("repeated-ids");
+    // Contributor-original PDF, shaped like PyMuPDF output.
+    std::fs::write(
+        dir.join("fitz.pdf"),
+        b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [5 0 R] >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [6 0 R 7 0 R] >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (fitz-A0) /T (Alpha) /Contents (COVER) >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (fitz-A0) /T (Beta) /Contents (SECOND) >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 100 40 120] /NM (fitz-A1) /IRT 6 0 R /T (Gamma) /Contents (ANSWER) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+    )
+    .unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "fitz.pdf" }))["doc"].as_u64().unwrap();
+    let replies = |a: &mut Automation| -> Vec<(String, Vec<String>)> {
+        let list = ok(a, "comment_list", json!({ "doc": doc }));
+        list["comments"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|c| {
+                let mut texts: Vec<String> =
+                    c["replies"].as_array().unwrap().iter().filter_map(|r| r["contents"].as_str().map(String::from)).collect();
+                texts.sort();
+                (c["contents"].as_str().unwrap().to_string(), texts)
+            })
+            .collect()
+    };
+    assert_eq!(replies(&mut a), [("COVER".into(), vec![]), ("SECOND".into(), vec!["ANSWER".to_string()])]);
+    let refused = err(&mut a, "comment_reply", json!({ "doc": doc, "id": "fitz-A0", "text": "LATER" }));
+    assert!(refused.to_string().contains("several comments"), "{refused}");
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "page": 2, "index": 1, "text": "LATER" }));
+    assert_eq!(replies(&mut a), [("COVER".into(), vec![]), ("SECOND".into(), vec!["ANSWER".to_string(), "LATER".to_string()])]);
+}
+
+/// A status or checkmark belongs to the annotation its `/IRT` names: one set on a reply is not
+/// its comment's, as the Comments panel shows it, and is reported on the reply. One whose
+/// annotation can't be found is not a comment of its own.
+#[test]
+fn a_checkmark_on_a_reply_is_not_its_comments() {
+    let dir = workdir("reply-checkmark");
+    // Contributor-original PDF: a comment, a reply, a checkmark and a status on the reply, and a
+    // status whose annotation (object 9) doesn't exist.
+    std::fs::write(
+        dir.join("checked.pdf"),
+        b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [4 0 R 5 0 R 6 0 R 7 0 R 8 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Text /Rect [100 100 120 120] /T (Alpha) /Contents (COMMENT) >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [100 60 120 80] /IRT 4 0 R /T (Beta) /Contents (REPLY) >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [100 60 120 80] /IRT 5 0 R /T (Beta) /StateModel /Marked /State /Marked >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [100 60 120 80] /IRT 5 0 R /T (Beta) /StateModel /Review /State /Accepted >> endobj
+8 0 obj << /Type /Annot /Subtype /Text /Rect [200 20 220 40] /F 30 /IRT 9 0 R /T (Gamma) /StateModel /Review /State /Rejected >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+    )
+    .unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "checked.pdf" }))["doc"].as_u64().unwrap();
+    let list = ok(&mut a, "comment_list", json!({ "doc": doc }));
+    assert_eq!(list["count"], 1, "{list}");
+    let c = &list["comments"][0];
+    assert_eq!((&c["marked"], &c["status"]), (&json!(false), &Value::Null), "{c}");
+    assert_eq!(c["replies"].as_array().map(Vec::len), Some(1), "the reply, not its states: {c}");
+    let reply = &c["replies"][0];
+    assert_eq!((&reply["marked"], &reply["status"]), (&json!(true), &json!("Accepted")), "{reply}");
+}
+
 #[test]
 fn protecting_through_tools() {
     let dir = workdir("protect");
@@ -4351,6 +4484,12 @@ fn adding_content_through_tools() {
     assert!(text.contains("DRAFT") && !text.contains("CONFIDENTIAL"), "{text}");
     // Image tools: rotate, flip, crop, replace.
     ok(&mut a, "content_update", json!({ "doc": doc, "page": 1, "index": 2, "rotate": 90, "flip_h": true, "crop": [0.1, 0, 0.1, 0] }));
+    // One side may trim most of the picture; together an axis keeps at least 5 %.
+    ok(&mut a, "content_update", json!({ "doc": doc, "page": 1, "index": 2, "crop": [0.7, 0, 0, 0] }));
+    assert!(matches!(
+        a.call("content_update", &json!({ "doc": doc, "page": 1, "index": 2, "crop": [0.6, 0, 0.4, 0] })),
+        Err(ToolError::InvalidArgs(_))
+    ));
     ok(&mut a, "content_update", json!({ "doc": doc, "page": 1, "index": 2, "image": "logo.png" }));
     assert_eq!(ok(&mut a, "doc_info", json!({ "doc": doc }))["document"]["dirty"], true);
     assert!(matches!(a.call("content_update", &json!({ "doc": doc, "page": 1, "index": 2, "rotate": 45 })), Err(ToolError::InvalidArgs(_))));
@@ -5722,6 +5861,28 @@ fn signing_with_an_image_typed_or_drawn_graphic_through_tools() {
     assert!(inked(60, 110), "the strokes are drawn");
 }
 
+/// Signing a laid-out XFA form's signature box through the tools signs the field named by its
+/// SOM path, which is how another viewer, laying the form out again, finds the signature; the
+/// signed file reopens with the signature intact and on that field.
+#[test]
+fn a_dynamic_xfa_forms_signature_box_is_signed_under_its_som_path() {
+    let dir = workdir("xfa-sign");
+    std::fs::write(dir.join("form.pdf"), pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::fields_template(""))).unwrap();
+    let mut a = auto(&dir);
+    ok(&mut a, "sign_id_create", json!({ "name": "Ada Lovelace", "key": "p256", "password": "secret12", "path": "ada.p12" }));
+    let doc = ok(&mut a, "doc_open", json!({ "path": "form.pdf" }))["doc"].as_u64().unwrap();
+    let som = "form[0].page1[0].sign[0]";
+    let fields = ok(&mut a, "form_fields", json!({ "doc": doc }));
+    assert!(fields["fields"].as_array().unwrap().iter().any(|f| f["name"] == som), "{fields}");
+    ok(&mut a, "sign_document", json!({ "doc": doc, "id": "ada.p12", "password": "secret12", "field": som, "out": "signed.pdf" }));
+    let signed = ok(&mut a, "doc_open", json!({ "path": "signed.pdf" }))["doc"].as_u64().unwrap();
+    let list = ok(&mut a, "sign_list", json!({ "doc": signed }));
+    let s = list["signatures"].as_array().unwrap().iter().find(|s| s["signed"] == true).cloned().unwrap_or_else(|| panic!("{list}"));
+    assert_eq!(s["field"], som, "{s}");
+    assert_eq!(s["status"], "unknown", "intact, the signer not trusted: {s}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 #[test]
 fn digital_ids_signing_and_validation_through_tools() {
     let dir = workdir("signing");
@@ -6728,12 +6889,79 @@ BT /F1 11 Tf 20 20 Td (Total due: 150.00) Tj ET";
     assert!(rendered.iter().any(|c| matches!(c, Content::Png { .. })));
 }
 
+/// #4158: a word set in italic inside a sentence ("Before *Chevron* after.") reaches Word as an
+/// italic run of the sentence's paragraph, not as a paragraph of its own between two halves.
 #[test]
-fn hundreds_of_xfa_calculations_open_and_recalculate_within_their_budgets() {
+fn exporting_to_word_keeps_an_italic_word_inside_its_sentence() {
+    let dir = workdir("italic-run-word");
+    let content = "BT /F1 12 Tf 72 700 Td (Before ) Tj /F2 12 Tf (Chevron) Tj /F1 12 Tf ( after.) Tj ET \
+BT /F1 12 Tf 72 640 Td (A paragraph further down.) Tj ET";
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R /F2 6 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Times-Roman >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Times-Italic >>".into(),
+    ];
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    std::fs::write(dir.join("opinion.pdf"), pdf).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "opinion.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_export_office", json!({ "doc": doc, "path": "opinion.docx" }));
+    let zip = std::fs::read(dir.join("opinion.docx")).unwrap();
+    let mut at = 0;
+    let mut xml = String::new();
+    while zip[at..].starts_with(b"PK\x03\x04") {
+        let size = u32::from_le_bytes(zip[at + 18..at + 22].try_into().unwrap()) as usize;
+        let len = u16::from_le_bytes(zip[at + 26..at + 28].try_into().unwrap()) as usize;
+        let data = at + 30 + len;
+        if &zip[at + 30..data] == b"word/document.xml" {
+            std::io::Read::read_to_string(&mut flate2::read::DeflateDecoder::new(&zip[data..data + size]), &mut xml).unwrap();
+            break;
+        }
+        at = data + size;
+    }
+    // The paragraphs that hold text, each as its runs: (text, italic).
+    let paragraphs: Vec<Vec<(String, bool)>> = xml
+        .split("<w:p>")
+        .skip(1)
+        .map(|p| {
+            let p = p.split_once("</w:p>").map_or(p, |(inside, _)| inside);
+            p.split("<w:r>")
+                .skip(1)
+                .filter_map(|r| Some((r.split_once("<w:t xml:space=\"preserve\">")?.1.split_once("</w:t>")?.0.to_string(), r.contains("<w:i/>"))))
+                .collect::<Vec<_>>()
+        })
+        .filter(|runs| !runs.is_empty())
+        .collect();
+    let sentence = paragraphs.iter().find(|p| p.iter().any(|(t, _)| t.contains("Before"))).unwrap_or_else(|| panic!("{xml}"));
+    assert_eq!(sentence.len(), 3, "one paragraph, three runs: {xml}");
+    assert_eq!(sentence.iter().map(|(t, _)| t.as_str()).collect::<String>(), "Before Chevron after.", "{xml}");
+    assert_eq!(sentence.iter().map(|(_, i)| *i).collect::<Vec<_>>(), [false, true, false], "{xml}");
+    assert_eq!(paragraphs.len(), 2, "{xml}");
+}
+
+/// Hundreds of calculations run on opening and again after a change through the tools. The
+/// time limits are raised so that a busy machine does not stop them (the engine's tests check
+/// that the limits stop them).
+#[test]
+fn hundreds_of_xfa_calculations_open_and_recalculate_through_tools() {
     let dir = workdir("xfa-many");
     let (sections, rows) = (10, 20);
     std::fs::write(dir.join("many.pdf"), pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::many_calculations_template(sections, rows))).unwrap();
-    let mut a = auto(&dir);
+    let mut a = auto(&dir).with_xfa_time_scale(100);
     let started = std::time::Instant::now();
     let opened = ok(&mut a, "doc_open", json!({ "path": "many.pdf" }));
     let open_took = started.elapsed();
@@ -7156,7 +7384,8 @@ fn repeated_xfa_print_buttons_work_through_tools_and_after_reopen() {
     let dir = workdir("xfa-print-buttons");
     let template = pdfcraft_xfa::fixtures::repeated_print_button_template();
     std::fs::write(dir.join("print.pdf"), pdfcraft_xfa::fixtures::shell(&template)).unwrap();
-    let mut a = auto(&dir);
+    // Raised time limits: a busy machine does not stop the click scripts this checks.
+    let mut a = auto(&dir).with_xfa_time_scale(100);
     let doc = ok(&mut a, "doc_open", json!({ "path": "print.pdf" }))["doc"].as_u64().unwrap();
     let check = |a: &mut Automation, doc| {
         let fields = ok(a, "form_fields", json!({ "doc": doc }));
@@ -7181,7 +7410,8 @@ fn repeated_xfa_print_buttons_work_through_tools_and_after_reopen() {
 fn xfa_scripts_run_for_buttons_and_field_changes_through_tools() {
     let dir = workdir("xfa-scripts");
     std::fs::write(dir.join("scripted.pdf"), pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::scripted_template())).unwrap();
-    let mut a = auto(&dir);
+    // Raised time limits: a busy machine does not stop the scripts this checks.
+    let mut a = auto(&dir).with_xfa_time_scale(100);
     let doc = ok(&mut a, "doc_open", json!({ "path": "scripted.pdf" }))["doc"].as_u64().unwrap();
     let field = |a: &mut Automation, n: &str| {
         let f = ok(a, "form_fields", json!({ "doc": doc }));
@@ -8884,6 +9114,34 @@ fn bookmark_list_reports_colour_and_style() {
     assert_eq!(style(&ok(&mut b, "bookmark_list", json!({ "doc": re }))["bookmarks"]), style(&set), "saved");
 }
 
+/// An editable combo box (ISO 32000-2 Table 233, Edit) takes a value that isn't one of its
+/// options, and its page appearance shows it, before and after a save; one without Edit takes
+/// only its options.
+#[test]
+fn form_fill_takes_free_text_only_in_an_editable_combo_box() {
+    let dir = workdir("editable-combo");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let combo = |name: &str, top: f64, editable: bool| json!({ "doc": doc, "page": 1, "type": "combo", "rect": [20, top, 200, top + 22.0], "name": name, "options": ["Apple", "Banana"], "editable": editable });
+    ok(&mut a, "form_add_field", combo("fruit", 20.0, true));
+    ok(&mut a, "form_add_field", combo("veg", 60.0, false));
+    ok(&mut a, "form_fill", json!({ "doc": doc, "values": { "fruit": "Cherry" } }));
+    assert!(page_text(&mut a, doc)[0].contains("Cherry"), "the typed value is drawn");
+    let refused = err(&mut a, "form_fill", json!({ "doc": doc, "values": { "veg": "Cherry" } }));
+    assert!(matches!(&refused, ToolError::Failed(m) | ToolError::InvalidArgs(m) if m.contains("no option")), "{refused:?}");
+    // A choice from the list still works in both.
+    ok(&mut a, "form_fill", json!({ "doc": doc, "values": { "veg": "Banana" } }));
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "filled.pdf" }));
+    let saved = ok(&mut a, "doc_open", json!({ "path": "filled.pdf" }))["doc"].as_u64().unwrap();
+    let fields = ok(&mut a, "form_fields", json!({ "doc": saved }));
+    let value = |name: &str| fields["fields"].as_array().unwrap().iter().find(|f| f["name"] == name).map(|f| f["value"].clone());
+    assert_eq!(value("fruit"), Some(json!("Cherry")), "{fields}");
+    assert_eq!(value("veg"), Some(json!("Banana")), "{fields}");
+    let text = page_text(&mut a, saved);
+    assert!(text[0].contains("Cherry") && text[0].contains("Banana"), "{text:?}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// `page_render`'s pixels show a rubber stamp written without an appearance as the stamp its
 /// `/Name` names (ISO 32000-2 Table 184), and one with an unknown name as a grey placeholder.
 #[test]
diff --git a/crates/automation/tests/it/automation_roots.rs b/crates/automation/tests/it/automation_roots.rs
index 3e2d024cdb..a96870ca02 100644
--- a/crates/automation/tests/it/automation_roots.rs
+++ b/crates/automation/tests/it/automation_roots.rs
@@ -352,6 +352,19 @@ fn links_out_of_a_root_are_refused() {
     assert_eq!(names(&base.join("outside")), ["pic.png", "secret.pdf"]);
 }
 
+/// #4003: without `--root`, another network share or a device is refused by name through the
+/// tools too, with the same words as any other path outside a root.
+#[cfg(windows)]
+#[test]
+fn other_shares_and_devices_are_refused_by_name() {
+    let (mut server, base) = confined("shares", true, true);
+    ok(&mut server, "doc_open", json!({"path": s(&base.join("in/a.pdf"))}));
+    for p in [r"\\.\pipe\pdfcraft-4003.pdf", r"\\pdfcraft-no-such-host.invalid\share\a.pdf", "//pdfcraft-no-such-host.invalid/share/a.pdf"] {
+        refused(&mut server, "doc_open", json!({"path": p}), "outside the read root");
+        refused(&mut server, "doc_save", json!({"doc": 1, "path": p}), "outside the write root");
+    }
+}
+
 #[test]
 fn without_roots_nothing_is_confined() {
     let base = folders("none");
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index c7f2cb0156..0fac1591a9 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -12,395 +12,23 @@ use crate::CosError;
 use crate::object::{Dict, ObjRef, Object};
 use crate::parser::{EndstreamIndex, Lexer, is_whitespace, parse_indirect, parse_indirect_shared};
 
-thread_local! {
-    /// The objects being loaded on this thread, innermost last (see `Document::try_get`).
-    static LOADING: std::cell::RefCell<Vec<u32>> = const { std::cell::RefCell::new(Vec::new()) };
-    /// Indirect `/Length` values resolved during the current outermost load: a damaged file
-    /// retries a parse several ways, and each retry would resolve the same lengths again
-    /// (exponential in the chain of streams whose lengths point at further streams).
-    static LENGTHS: std::cell::RefCell<HashMap<u32, Option<i64>>> = std::cell::RefCell::new(HashMap::new());
-}
+mod objects;
+mod open;
+mod reader;
+mod state;
+mod xref;
 
-/// Marks an object as being loaded on this thread. Loading can re-enter (indirect stream
-/// `/Length`, object streams): an object already being loaded is a cycle, and the nesting is
-/// bounded as well.
-struct LoadGuard;
-
-impl LoadGuard {
-    const MAX: usize = 32;
-
-    fn enter(num: u32) -> Option<Self> {
-        LOADING.with(|l| {
-            let mut l = l.borrow_mut();
-            if l.len() >= Self::MAX || l.contains(&num) {
-                return None;
-            }
-            l.push(num);
-            Some(LoadGuard)
-        })
-    }
-}
-
-impl Drop for LoadGuard {
-    fn drop(&mut self) {
-        let outermost = LOADING.with(|l| {
-            let mut l = l.borrow_mut();
-            l.pop();
-            l.is_empty()
-        });
-        if outermost {
-            LENGTHS.with(|m| m.borrow_mut().clear());
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum XrefEntry {
-    Free { next_generation: u16 },
-    InFile { offset: u64, generation: u16 },
-    InStream { stream: u32, index: u32 },
-}
-
-#[derive(Clone, Copy, Debug)]
-struct XrefRange {
-    start: u32,
-    count: u32,
-    offset: usize,
-    stride: usize,
-}
-
-#[derive(Clone, Debug)]
-enum XrefSectionData {
-    Table,
-    Stream { bytes: Arc<Vec<u8>>, widths: [usize; 3] },
-}
-
-#[derive(Clone, Debug)]
-struct XrefSection {
-    data: XrefSectionData,
-    ranges: Vec<XrefRange>,
-    row_count: usize,
-    max_num: u32,
-    has_entries: bool,
-    /// A table subsection was read one number lower than it says ([`subsection_start`]).
-    renumbered: bool,
-}
-
-#[derive(Clone, Debug)]
-struct XrefRevisionSection {
-    primary: XrefSection,
-    hybrid: Option<XrefSection>,
-}
-
-#[derive(Clone, Debug)]
-enum XrefIndex {
-    Compact { revisions: Vec<XrefRevisionSection>, max_num: u32, has_entries: bool },
-    Materialized(Arc<BTreeMap<u32, XrefEntry>>),
-}
-
-const MAX_COMPACT_XREF_ROWS: usize = 2_000_000;
-const MAX_COMPACT_XREF_BYTES: usize = 64 * 1024 * 1024;
-
-impl XrefSection {
-    fn has_any_entry(&self) -> bool {
-        match &self.data {
-            XrefSectionData::Table => self.has_entries,
-            XrefSectionData::Stream { bytes, widths } => {
-                let row_width = widths.iter().sum::<usize>();
-                if row_width == 0 {
-                    return false;
-                }
-                for range in &self.ranges {
-                    let available = bytes.len().saturating_sub(range.offset) / row_width;
-                    for i in 0..available.min(range.count as usize) {
-                        let Some(offset) = i.checked_mul(row_width).and_then(|delta| range.offset.checked_add(delta)) else { continue };
-                        let Some(row) = bytes.get(offset..offset.saturating_add(row_width)) else { continue };
-                        let read_field = |from: usize, width: usize, default: u64| -> Option<u64> {
-                            if width == 0 {
-                                return Some(default);
-                            }
-                            let end = from.checked_add(width)?;
-                            Some(row.get(from..end)?.iter().fold(0u64, |acc, byte| acc.wrapping_shl(8) | u64::from(*byte)))
-                        };
-                        let Some(kind) = read_field(0, widths[0], 1) else { continue };
-                        if kind == 0 || kind == 2 {
-                            return true;
-                        }
-                        if kind == 1 && read_field(widths[0], widths[1], 0).is_some_and(|offset| offset != 0) {
-                            return true;
-                        }
-                    }
-                }
-                false
-            }
-        }
-    }
-
-    fn retained_bytes(&self) -> usize {
-        match &self.data {
-            XrefSectionData::Table => 0,
-            XrefSectionData::Stream { bytes, .. } => bytes.capacity(),
-        }
-    }
-
-    fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
-        let after = self.ranges.partition_point(|range| range.start <= num);
-        let range = self.ranges.get(after.checked_sub(1)?)?;
-        let end = u64::from(range.start).checked_add(u64::from(range.count))?;
-        if u64::from(num) >= end {
-            return None;
-        }
-        let row = usize::try_from(num.checked_sub(range.start)?).ok()?;
-        let offset = range.offset.checked_add(row.checked_mul(range.stride)?)?;
-        match &self.data {
-            XrefSectionData::Table => {
-                let mut lexer = Lexer::new(file, offset);
-                lexer.skip_ws();
-                let object_offset = lexer.token();
-                lexer.skip_ws();
-                let generation = lexer.token();
-                lexer.skip_ws();
-                let kind = lexer.token();
-                match kind {
-                    b"n" => {
-                        let object_offset = std::str::from_utf8(object_offset).ok()?.parse::<u64>().ok()?;
-                        if object_offset == 0 {
-                            return None;
-                        }
-                        let generation = std::str::from_utf8(generation).ok()?.parse::<u32>().unwrap_or(0).min(u16::MAX as u32) as u16;
-                        Some(XrefEntry::InFile { offset: object_offset, generation })
-                    }
-                    b"f" => {
-                        let generation = std::str::from_utf8(generation).ok()?.parse::<u32>().unwrap_or(0).min(u16::MAX as u32) as u16;
-                        Some(XrefEntry::Free { next_generation: generation })
-                    }
-                    _ => None,
-                }
-            }
-            XrefSectionData::Stream { bytes, widths } => {
-                let row_width = widths.iter().sum::<usize>();
-                let end = offset.checked_add(row_width)?;
-                let row = bytes.get(offset..end)?;
-                let field = |from: usize, width: usize, default: u64| -> Option<u64> {
-                    if width == 0 {
-                        return Some(default);
-                    }
-                    let end = from.checked_add(width)?;
-                    Some(row.get(from..end)?.iter().fold(0u64, |acc, byte| acc.wrapping_shl(8) | u64::from(*byte)))
-                };
-                let kind = field(0, widths[0], 1)?;
-                let a = field(widths[0], widths[1], 0)?;
-                let b = field(widths[0] + widths[1], widths[2], 0)?;
-                let entry = match kind {
-                    0 => XrefEntry::Free { next_generation: b.min(u16::MAX as u64) as u16 },
-                    1 => XrefEntry::InFile { offset: a, generation: b.min(u16::MAX as u64) as u16 },
-                    2 => XrefEntry::InStream { stream: a.min(u32::MAX as u64) as u32, index: b.min(u32::MAX as u64) as u32 },
-                    _ => return None,
-                };
-                (!matches!(entry, XrefEntry::InFile { offset: 0, .. })).then_some(entry)
-            }
-        }
-    }
-
-    fn extend_numbers(&self, numbers: &mut Vec<u32>) {
-        for range in &self.ranges {
-            let available = match &self.data {
-                XrefSectionData::Table => range.count as usize,
-                XrefSectionData::Stream { bytes, widths } => {
-                    let row_width = widths.iter().sum::<usize>();
-                    bytes.len().saturating_sub(range.offset).checked_div(row_width).unwrap_or(0)
-                }
-            };
-            for i in 0..available.min(range.count as usize) {
-                if let Ok(i) = u32::try_from(i)
-                    && let Some(num) = range.start.checked_add(i)
-                {
-                    numbers.push(num);
-                }
-            }
-        }
-    }
-}
-
-impl XrefRevisionSection {
-    fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
-        let primary = self.primary.lookup(num, file);
-        let hybrid = self.hybrid.as_ref().and_then(|section| section.lookup(num, file));
-        match primary {
-            None | Some(XrefEntry::Free { .. }) => hybrid.or(primary),
-            entry => entry,
-        }
-    }
-
-    fn extend_numbers(&self, numbers: &mut Vec<u32>) {
-        self.primary.extend_numbers(numbers);
-        if let Some(hybrid) = &self.hybrid {
-            hybrid.extend_numbers(numbers);
-        }
-    }
-}
-
-impl XrefIndex {
-    fn empty() -> Self {
-        Self::Materialized(Arc::new(BTreeMap::new()))
-    }
-
-    fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
-        match self {
-            Self::Compact { revisions, .. } => revisions.iter().find_map(|revision| revision.lookup(num, file)),
-            Self::Materialized(entries) => entries.get(&num).copied(),
-        }
-    }
-
-    fn is_empty(&self) -> bool {
-        match self {
-            Self::Compact { has_entries, .. } => !has_entries,
-            Self::Materialized(entries) => entries.is_empty(),
-        }
-    }
-
-    /// Drop an entry for object number 4294967295, which no incremental `/Size` can cover.
-    /// Only a materialized index can hold one: the compact reader requires `max_num < /Size`.
-    fn remove_exhausted(&mut self) -> bool {
-        match self {
-            Self::Compact { .. } => false,
-            Self::Materialized(entries) => Arc::make_mut(entries).remove(&u32::MAX).is_some(),
-        }
-    }
-
-    /// Every entry, newest section first, as the materialized reader keeps them.
-    fn to_map(&self, file: &[u8]) -> BTreeMap<u32, XrefEntry> {
-        match self {
-            Self::Materialized(entries) => entries.as_ref().clone(),
-            Self::Compact { revisions, .. } => {
-                let mut numbers = Vec::new();
-                for revision in revisions {
-                    revision.extend_numbers(&mut numbers);
-                }
-                numbers.into_iter().filter_map(|num| self.lookup(num, file).map(|entry| (num, entry))).collect()
-            }
-        }
-    }
-
-    fn max_num(&self) -> u32 {
-        match self {
-            Self::Compact { max_num, .. } => *max_num,
-            Self::Materialized(entries) => entries.keys().next_back().copied().unwrap_or(0),
-        }
-    }
-
-    fn object_numbers(&self, file: &[u8]) -> Vec<u32> {
-        match self {
-            Self::Materialized(entries) => {
-                entries.iter().filter_map(|(&num, entry)| (!matches!(entry, XrefEntry::Free { .. })).then_some(num)).collect()
-            }
-            Self::Compact { revisions, .. } => {
-                if let [revision] = revisions.as_slice()
-                    && revision.hybrid.is_none()
-                {
-                    let mut numbers = Vec::with_capacity(revision.primary.row_count);
-                    revision.primary.extend_numbers(&mut numbers);
-                    numbers.retain(|num| self.lookup(*num, file).is_some_and(|entry| !matches!(entry, XrefEntry::Free { .. })));
-                    return numbers;
-                }
-                let mut numbers = Vec::new();
-                for revision in revisions {
-                    revision.extend_numbers(&mut numbers);
-                }
-                numbers.sort_unstable();
-                numbers.dedup();
-                numbers.retain(|num| self.lookup(*num, file).is_some_and(|entry| !matches!(entry, XrefEntry::Free { .. })));
-                numbers
-            }
-        }
-    }
-}
-
-/// One cross-reference section of the file (one per save; the first is the original).
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Revision {
-    /// Offset of the xref section (`startxref` value).
-    pub xref_offset: u64,
-    /// `true` if the section is a cross-reference stream.
-    pub is_stream: bool,
-    /// `true` if `xref_offset` counts from the `%PDF-` header rather than from the start of the
-    /// file. The two differ only in a file with bytes before its header, and an update appended
-    /// to such a file must count the same way as the section it points back to.
-    pub header_relative: bool,
-}
-
-#[derive(Clone, Debug)]
-struct ObjStm {
-    /// One slot per member in stream order, since cross-reference entries name a member by its
-    /// position: (object number, byte offset within `data`), or `None` for a member whose number
-    /// or offset is unusable ([`objstm_member`]).
-    index: Vec<Option<(u32, usize)>>,
-    data: Arc<Vec<u8>>,
-}
-
-/// Where member `num` of an object stream starts: its `offset` past `/First` (`first`), when the
-/// number is an object number and the start lies inside the decoded `len` bytes. Checked on every
-/// target, so a 32-bit build neither truncates nor wraps a large `/First` or offset (#1815).
-fn objstm_member(num: i64, offset: i64, first: Option<usize>, len: usize) -> Option<(u32, usize)> {
-    let num = u32::try_from(num).ok()?;
-    let start = first?.checked_add(usize::try_from(offset).ok()?)?;
-    (start < len).then_some((num, start))
-}
-
-/// Where an overlay slot came from.
-#[derive(Clone, Debug, PartialEq)]
-enum Slot {
-    Set(u16, Arc<Object>),
-    Freed(u16),
-}
-
-/// An immutable input/decode context shared by document clones. Holding this identity
-/// retains neither the input bytes nor the parsed document. Weak ownership prevents an
-/// expired identity from matching a later allocation at the same address.
-#[derive(Clone, Debug)]
-pub struct SourceIdentity(Weak<()>);
-
-impl PartialEq for SourceIdentity {
-    fn eq(&self, other: &Self) -> bool {
-        self.0.ptr_eq(&other.0)
-    }
-}
-
-impl Eq for SourceIdentity {}
-
-/// What a document reads as: its source ([`SourceIdentity`]), its trailer and every object changed
-/// since it was opened. A clone, or a snapshot that undo restores, has the same state, and every
-/// change makes a different one. Changed objects are compared as allocations, which the state
-/// keeps alive, so a later object can't take an address one of them had.
-#[derive(Clone)]
-pub struct ReadState {
-    source: SourceIdentity,
-    trailer: Dict,
-    overlay: BTreeMap<u32, Slot>,
-}
-
-impl ReadState {
-    /// Whether `doc` reads as this state.
-    pub fn matches(&self, doc: &Document) -> bool {
-        self.source == doc.source_identity()
-            && self.trailer == doc.trailer
-            && self.overlay.len() == doc.overlay.len()
-            && self.overlay.iter().zip(&doc.overlay).all(|((a, x), (b, y))| {
-                a == b
-                    && match (x, y) {
-                        (Slot::Set(g, o), Slot::Set(h, p)) => g == h && Arc::ptr_eq(o, p),
-                        (Slot::Freed(g), Slot::Freed(h)) => g == h,
-                        _ => false,
-                    }
-            })
-    }
-}
-
-impl std::fmt::Debug for ReadState {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ReadState").field("changed_objects", &self.overlay.len()).finish_non_exhaustive()
-    }
-}
+#[cfg(test)]
+pub(crate) use reader::find;
+#[cfg(test)]
+use reader::rfind;
+pub(crate) use state::ObjectReader;
+use state::{ObjStm, Slot};
+pub use state::{ReadState, SourceIdentity};
+#[cfg(test)]
+use state::{SECTION_READS, objstm_member, owned_bytes};
+use xref::XrefIndex;
+pub use xref::{Revision, XrefEntry};
 
 #[derive(Clone)]
 pub struct Document {
@@ -439,3172 +67,11 @@ pub struct Document {
     out_encrypt_num: Option<u32>,
 }
 
-/// A temporary reader for whole-document work. Its caches never populate the editor or
-/// undo snapshots. Returned objects survive cache eviction; a stream read from the file is a
-/// view into the input bytes (it keeps the whole input alive while held, not a copy).
-pub(crate) struct ObjectReader {
-    pub(crate) document: Document,
-    decoded_count: usize,
-}
-
-impl ObjectReader {
-    const OBJECTS: usize = 128;
-    const STREAM_BYTES: usize = 8 * 1024 * 1024;
-
-    pub(crate) fn get(&mut self, reference: ObjRef) -> Arc<Object> {
-        self.try_get(reference).unwrap_or_else(|_| Arc::new(Object::Null))
-    }
-
-    pub(crate) fn try_get(&mut self, reference: ObjRef) -> Result<Arc<Object>, CosError> {
-        let object = self.document.try_get(reference.num);
-        // A missed eviction here only costs a re-parse, so never fail the read on a poisoned
-        // lock. The editing-cache evictors propagate instead; they guard user edits.
-        if let Ok(mut streams) = self.document.objstms.lock() {
-            // Only insertion changes this private cache between reads. Most neighboring
-            // objects reuse a decoded stream: do not sum the whole store for every object.
-            if streams.len() != self.decoded_count {
-                let bytes = streams.values().fold(0usize, |bytes, stream| {
-                    bytes
-                        .saturating_add(stream.data.capacity())
-                        .saturating_add(stream.index.capacity().saturating_mul(std::mem::size_of::<Option<(u32, usize)>>()))
-                });
-                if bytes > Self::STREAM_BYTES || streams.len() >= Self::OBJECTS {
-                    // Retain one oversized active stream so its next object does not require
-                    // decoding it again. That stream still obeys the document's decode cap.
-                    let current = match self.document.xref_entry(reference.num) {
-                        Some(XrefEntry::InStream { stream, .. }) => Some(stream),
-                        _ => None,
-                    };
-                    streams.retain(|num, _| Some(*num) == current);
-                }
-                self.decoded_count = streams.len();
-            }
-        }
-        // Parsed objects stay cached (an indirect /Length or a dictionary read again costs a
-        // lookup, not a parse) until the cache passes its object count or holds more than
-        // STREAM_BYTES of data of its own. Streams read from the file are views into the
-        // input bytes, which the document keeps anyway, so they don't count; decrypted
-        // streams and strings do. Checked after failed loads too: resolving a /Length may
-        // have cached large objects.
-        if let Ok(mut cache) = self.document.cache.lock() {
-            let data = &self.document.data;
-            if cache.len() >= Self::OBJECTS || cache.values().fold(0usize, |n, o| n.saturating_add(owned_bytes(o, data, 0))) > Self::STREAM_BYTES {
-                cache.clear();
-            }
-        }
-        object
-    }
-}
-
-#[cfg(test)]
-thread_local! {
-    /// Cross-reference sections read on this thread.
-    static SECTION_READS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-/// Nesting [`owned_bytes`] walks: past the parser's own nesting limit, so every parsed object
-/// is measured in full.
-const OWNED_BYTES_DEPTH: usize = 256;
-
-/// Bytes `object` holds of its own: string and stream data that is not a view into `data`
-/// (the input file). An object nested deeper than [`OWNED_BYTES_DEPTH`] cannot be measured
-/// and counts as too large to keep.
-fn owned_bytes(object: &Object, data: &Arc<Vec<u8>>, depth: usize) -> usize {
-    if depth > OWNED_BYTES_DEPTH {
-        return usize::MAX;
-    }
-    match object {
-        Object::String(s) => s.bytes.len(),
-        Object::Stream(s) => {
-            let own = if s.raw.shares(data) { 0 } else { s.raw.len() };
-            s.dict.iter().fold(own, |n, (_, v)| n.saturating_add(owned_bytes(v, data, depth + 1)))
-        }
-        Object::Array(a) => a.iter().fold(0usize, |n, v| n.saturating_add(owned_bytes(v, data, depth + 1))),
-        Object::Dict(d) => d.iter().fold(0usize, |n, (_, v)| n.saturating_add(owned_bytes(v, data, depth + 1))),
-        _ => 0,
-    }
-}
-
 impl std::fmt::Debug for Document {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.debug_struct("Document").field("bytes", &self.data.len()).field("xref", &self.entries).field("edits", &self.overlay.len()).finish()
     }
 }
 
-/// How an encrypted document is opened: with a password, or with the file key of a document
-/// that has the same encryption (an earlier revision of the same file).
-enum Credentials<'a> {
-    Password(Option<&'a str>),
-    Handler { handler: &'a Arc<pdfcraft_crypt::SecurityHandler>, id0: Vec<u8> },
-}
-
-impl Document {
-    /// A new document with an empty page tree (for split / extract / combine). It has no
-    /// original bytes, so saving always writes a full file.
-    pub fn new_empty() -> Self {
-        let mut doc = Document {
-            data: Arc::new(Vec::new()),
-            endstreams: Arc::default(),
-            source_identity: Arc::new(()),
-            entries: Arc::new(XrefIndex::empty()),
-            trailer: Dict::new(),
-            revisions: Arc::new(Vec::new()),
-            xref_oddities: Arc::default(),
-            located: Arc::default(),
-            repair_log: Arc::new(Vec::new()),
-            cache: Arc::default(),
-            objstms: Arc::default(),
-            stream_limit: crate::object::MAX_DECODED,
-            overlay: BTreeMap::new(),
-            next_num: 1,
-            header_offset: 0,
-            version: "1.7".into(),
-            security: None,
-            encrypt_num: None,
-            encryption_changed: false,
-            full_save: false,
-            out_security: None,
-            out_encrypt_num: None,
-        };
-        let mut pages = Dict::new();
-        pages.set(b"Type".to_vec(), Object::name("Pages"));
-        pages.set(b"Kids".to_vec(), Object::Array(Vec::new()));
-        pages.set(b"Count".to_vec(), Object::Int(0));
-        let pages = doc.add(pages);
-        let mut catalog = Dict::new();
-        catalog.set(b"Type".to_vec(), Object::name("Catalog"));
-        catalog.set(b"Pages".to_vec(), Object::Ref(pages));
-        let root = doc.add(catalog);
-        doc.trailer.set(b"Root".to_vec(), Object::Ref(root));
-        doc
-    }
-
-    /// Parse a document. Damaged cross-reference data is reconstructed; see `repair_log`.
-    /// Encrypted documents open only if their user password is empty; see `open_with_password`.
-    pub fn open(data: Arc<Vec<u8>>) -> Result<Self, CosError> {
-        Self::open_with_password(data, None)
-    }
-
-    /// Parse a document, authenticating encrypted ones with `password` (owner or user; `None`
-    /// tries the empty password). Fails with `NeedsPassword` / `WrongPassword` as appropriate.
-    pub fn open_with_password(data: Arc<Vec<u8>>, password: Option<&str>) -> Result<Self, CosError> {
-        Self::open_with_stream_limit(data, password, crate::object::MAX_DECODED)
-    }
-
-    /// Open with a tighter decompression bound for object and cross-reference streams.
-    /// Inspection can use this without changing the editing reader's default limit. Such a
-    /// document is read-only: objects in a larger object stream read as missing, so the
-    /// writers refuse to save it ([`CosError::ReadOnlyLimit`]).
-    pub fn open_with_stream_limit(data: Arc<Vec<u8>>, password: Option<&str>, stream_limit: usize) -> Result<Self, CosError> {
-        Self::open_as(data, Credentials::Password(password), stream_limit)
-    }
-
-    /// Open `data`, an earlier revision of this file (the bytes a signature covers) or another
-    /// save of it, with this document's credentials: an encrypted one must have the same
-    /// `/Encrypt` dictionary and `/ID` as this document, whose file key is then reused, so no
-    /// password is needed or kept; unencrypted data opens as [`open`](Self::open) does. Data
-    /// encrypted differently fails with `NeedsPassword`.
-    pub fn open_with_same_credentials(&self, data: Arc<Vec<u8>>) -> Result<Self, CosError> {
-        let credentials = match &self.security {
-            Some(handler) => Credentials::Handler { handler, id0: self.first_id() },
-            None => Credentials::Password(None),
-        };
-        Self::open_as(data, credentials, self.stream_limit)
-    }
-
-    fn open_as(data: Arc<Vec<u8>>, credentials: Credentials<'_>, stream_limit: usize) -> Result<Self, CosError> {
-        // Viewers accept files whose header is missing or damaged as long as the body looks
-        // like PDF; so do we (a note goes to the repair log).
-        let header = find(&data, b"%PDF-", 0, 1024);
-        let headerless = header.is_none();
-        if headerless && find(&data, b" obj", 0, 4096).is_none() {
-            return Err(CosError::NotPdf);
-        }
-        let header_offset = header.unwrap_or(0);
-        let version = match header {
-            Some(h) => String::from_utf8_lossy(&data[(h + 5).min(data.len())..(h + 8).min(data.len())]).trim().to_string(),
-            None => "1.4".to_string(),
-        };
-        let mut doc = Document {
-            data,
-            endstreams: Arc::default(),
-            source_identity: Arc::new(()),
-            entries: Arc::new(XrefIndex::empty()),
-            trailer: Dict::new(),
-            revisions: Arc::new(Vec::new()),
-            xref_oddities: Arc::default(),
-            located: Arc::default(),
-            repair_log: Arc::new(Vec::new()),
-            cache: Arc::default(),
-            objstms: Arc::default(),
-            stream_limit: stream_limit.min(crate::object::MAX_DECODED),
-            overlay: BTreeMap::new(),
-            next_num: 1,
-            header_offset,
-            version,
-            security: None,
-            encrypt_num: None,
-            encryption_changed: false,
-            full_save: false,
-            out_security: None,
-            out_encrypt_num: None,
-        };
-        let mut log = Vec::new();
-        if headerless {
-            log.push("the %PDF- header is missing; reading the file as PDF 1.4".into());
-        }
-        let parsed = doc.read_xref_chain(&mut log);
-        let mut authenticated = false;
-        let ok = match parsed {
-            Ok((entries, trailer, revisions, oddities)) => {
-                doc.entries = Arc::new(entries);
-                doc.trailer = trailer;
-                doc.revisions = Arc::new(revisions);
-                doc.xref_oddities = Arc::new(oddities);
-                doc.fill_xref_gaps(&mut log);
-                // Authenticate before checking the catalog: it may sit in an encrypted object
-                // stream, which reads as garbage until the key is known.
-                if let Some(enc) = doc.trailer.get(b"Encrypt").cloned() {
-                    doc.authenticate(&enc, &credentials)?;
-                    authenticated = true;
-                }
-                doc.root_is_catalog()
-            }
-            Err(e) => {
-                log.push(format!("cross-reference data unreadable ({e}); rebuilding from object headers"));
-                false
-            }
-        };
-        if !ok {
-            if !doc.entries.is_empty() {
-                log.push("cross-reference data does not lead to a valid catalog; rebuilding from object headers".into());
-            }
-            doc.reconstruct(&mut log)?;
-        }
-        doc.repair_log = Arc::new(log);
-        // Reconstruction may have found a different trailer: (re)authenticate against it.
-        if (!ok || !authenticated)
-            && let Some(enc) = doc.trailer.get(b"Encrypt").cloned()
-        {
-            doc.authenticate(&enc, &credentials)?;
-        }
-        if Arc::make_mut(&mut doc.entries).remove_exhausted() {
-            Arc::make_mut(&mut doc.repair_log).push("skipped exhausted xref object number 4294967295".into());
-        }
-        let max = doc.entries.max_num();
-        let size = u32::try_from(doc.trailer.int(b"Size").unwrap_or(0).max(0)).unwrap_or(u32::MAX);
-        if size == u32::MAX {
-            Arc::make_mut(&mut doc.repair_log).push("exhausted trailer /Size; new objects use unused object numbers".into());
-        }
-        doc.next_num = max.saturating_add(1).max(size).max(1);
-        Ok(doc)
-    }
-
-    fn authenticate(&mut self, enc: &Object, credentials: &Credentials<'_>) -> Result<(), CosError> {
-        // Authentication can change how the same input is decoded.
-        self.source_identity = Arc::new(());
-        let (num, dict) = match enc {
-            Object::Ref(r) => (Some(r.num), self.get(*r).as_dict().cloned()),
-            Object::Dict(d) => (None, Some(d.clone())),
-            _ => (None, None),
-        };
-        let Some(dict) = dict else {
-            // A dangling /Encrypt: viewers treat the file as unencrypted, and so do we.
-            let mut log = self.repair_log.as_ref().clone();
-            log.push("the trailer names an /Encrypt dictionary that does not exist; reading the file as unencrypted".into());
-            self.repair_log = Arc::new(log);
-            self.trailer.remove(b"Encrypt");
-            return Ok(());
-        };
-        let params = crate::security::encrypt_dict(self, &dict);
-        let id0 = self.first_id();
-        let handler = match credentials {
-            Credentials::Password(password) => Arc::new(pdfcraft_crypt::SecurityHandler::open(params, &id0, *password).map_err(|e| match e {
-                pdfcraft_crypt::CryptError::WrongPassword if password.is_none() => CosError::NeedsPassword,
-                pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
-                other => CosError::Security(other.to_string()),
-            })?),
-            // The same encryption as the document whose key this is: that key opens it.
-            Credentials::Handler { handler, id0: known } if *handler.dict() == params && *known == id0 => Arc::clone(handler),
-            Credentials::Handler { .. } => return Err(CosError::NeedsPassword),
-        };
-        self.security = Some(handler);
-        self.encrypt_num = num;
-        // Objects read while locating the catalog were read before decryption was possible.
-        self.cache = Arc::default();
-        self.objstms = Arc::default();
-        Ok(())
-    }
-
-    /// The first file identifier, part of the encryption key (empty when there is none).
-    fn first_id(&self) -> Vec<u8> {
-        match self.trailer.get(b"ID") {
-            Some(Object::Array(a)) => a.first().and_then(|s| s.as_string()).map(|s| s.bytes.clone()).unwrap_or_default(),
-            _ => Vec::new(),
-        }
-    }
-
-    /// Lift the restrictions of a document opened with its user password by entering the
-    /// owner (permissions) password (§7.6.4). Fails with `WrongPassword` for any other
-    /// password. Does nothing when the document is unencrypted or already opened as owner.
-    /// Both passwords unlock the same file key, so nothing read so far is decoded again.
-    pub fn unlock(&mut self, password: &str) -> Result<(), CosError> {
-        let Some(current) = self.security.as_deref() else { return Ok(()) };
-        if current.auth() == pdfcraft_crypt::Auth::Owner {
-            return Ok(());
-        }
-        let owner = current.authenticate_owner(&self.first_id(), password).map_err(|e| match e {
-            pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
-            other => CosError::Security(other.to_string()),
-        })?;
-        self.security = Some(Arc::new(owner));
-        Ok(())
-    }
-
-    /// The security handler, when the document is encrypted.
-    pub fn security(&self) -> Option<&pdfcraft_crypt::SecurityHandler> {
-        self.security.as_deref()
-    }
-
-    /// What the opening password allows (`None` for unencrypted documents: everything).
-    pub fn permissions(&self) -> Option<pdfcraft_crypt::Permissions> {
-        self.security().map(|s| s.permissions())
-    }
-
-    /// Make the next save a full rewrite: earlier revisions (which still hold what an edit
-    /// removed) must not stay in the file. Redaction requires this.
-    pub fn require_full_save(&mut self) {
-        self.full_save = true;
-    }
-
-    /// The next save must rewrite the whole file (see [`Document::require_full_save`]).
-    pub fn full_save_required(&self) -> bool {
-        self.full_save
-    }
-
-    /// Security was set or removed since the document was opened (the next save applies it).
-    pub fn encryption_changed(&self) -> bool {
-        self.encryption_changed
-    }
-
-    /// The handler used to write: the new one after `set_encryption` / `remove_encryption`,
-    /// otherwise the one the document was opened with.
-    pub(crate) fn output_security(&self) -> (Option<&pdfcraft_crypt::SecurityHandler>, Option<u32>) {
-        if self.encryption_changed { (self.out_security.as_deref(), self.out_encrypt_num) } else { (self.security.as_deref(), self.encrypt_num) }
-    }
-
-    /// The security the next save writes: protection applied with `set_encryption`, none after
-    /// `remove_encryption`, otherwise the security the document was opened with.
-    pub fn output_handler(&self) -> Option<&pdfcraft_crypt::SecurityHandler> {
-        self.output_security().0
-    }
-
-    /// Protect the document with a password (§7.6.4). Takes effect on the next save, which is
-    /// always a full rewrite. Returns the handler (authenticated as owner).
-    pub fn set_encryption(&mut self, params: &pdfcraft_crypt::NewEncryption) -> Result<(), CosError> {
-        // The file identifier is part of the key; make sure it exists and keep it.
-        let id0 = match self.trailer.get(b"ID") {
-            Some(Object::Array(a)) if a.len() == 2 => a[0].as_string().map(|s| s.bytes.clone()).unwrap_or_default(),
-            _ => {
-                let mut id = generated_id(&params.seed);
-                id.truncate(16);
-                let s = Object::String(crate::PdfString { bytes: id.clone(), hex: true });
-                self.trailer.set(b"ID".to_vec(), Object::Array(vec![s.clone(), s]));
-                id
-            }
-        };
-        let h = pdfcraft_crypt::create(params, &id0).map_err(|e| CosError::Security(e.to_string()))?;
-        let d = h.dict();
-        let s = |b: &[u8]| Object::String(crate::PdfString { bytes: b.to_vec(), hex: true });
-        let mut e = Dict::new();
-        e.set(b"Filter".to_vec(), Object::name("Standard"));
-        e.set(b"V".to_vec(), Object::Int(d.v));
-        e.set(b"R".to_vec(), Object::Int(d.r));
-        e.set(b"Length".to_vec(), Object::Int(d.length_bits));
-        e.set(b"O".to_vec(), s(&d.o));
-        e.set(b"U".to_vec(), s(&d.u));
-        e.set(b"P".to_vec(), Object::Int(i64::from(d.p)));
-        if d.v >= 4 {
-            let mut cf = Dict::new();
-            let mut std_cf = Dict::new();
-            std_cf.set(b"Type".to_vec(), Object::name("CryptFilter"));
-            let (cfm, len) = if d.v >= 5 { ("AESV3", 32) } else { ("AESV2", 16) };
-            std_cf.set(b"CFM".to_vec(), Object::name(cfm));
-            std_cf.set(b"Length".to_vec(), Object::Int(len));
-            std_cf.set(b"AuthEvent".to_vec(), Object::name("DocOpen"));
-            cf.set(b"StdCF".to_vec(), Object::Dict(std_cf));
-            e.set(b"CF".to_vec(), Object::Dict(cf));
-            e.set(b"StmF".to_vec(), Object::name("StdCF"));
-            e.set(b"StrF".to_vec(), Object::name("StdCF"));
-            if !d.encrypt_metadata {
-                e.set(b"EncryptMetadata".to_vec(), Object::Bool(false));
-            }
-        }
-        if d.v >= 5 {
-            e.set(b"OE".to_vec(), s(&d.oe));
-            e.set(b"UE".to_vec(), s(&d.ue));
-            e.set(b"Perms".to_vec(), s(&d.perms));
-        }
-        if let Some(Object::Ref(old)) = self.trailer.get(b"Encrypt").cloned() {
-            self.free(old);
-        }
-        let r = self.add(e);
-        self.trailer.set(b"Encrypt".to_vec(), Object::Ref(r));
-        // Objects are still read with the original handler; saves use the new one.
-        self.out_security = Some(Arc::new(h));
-        self.out_encrypt_num = Some(r.num);
-        self.encryption_changed = true;
-        Ok(())
-    }
-
-    /// Remove password protection (requires the document to be open — any authenticated
-    /// password; callers should require the owner password, §7.6.4). Applied by a full save.
-    pub fn remove_encryption(&mut self) {
-        if let Some(Object::Ref(r)) = self.trailer.get(b"Encrypt").cloned() {
-            self.free(r);
-        }
-        self.trailer.remove(b"Encrypt");
-        self.out_security = None;
-        self.out_encrypt_num = None;
-        self.encryption_changed = true;
-    }
-
-    /// Decrypt a freshly parsed indirect object if the document is encrypted.
-    fn decrypted(&self, id: ObjRef, o: Object) -> Object {
-        match &self.security {
-            Some(h) if Some(id.num) != self.encrypt_num => crate::security::transform(h, &o, id.num, id.generation, crate::security::Pass::Decrypt),
-            _ => o,
-        }
-    }
-
-    pub fn bytes(&self) -> &Arc<Vec<u8>> {
-        &self.data
-    }
-
-    /// Identity of the original bytes, xref and authenticated decode context. Edits and
-    /// clones preserve it; reopening (including after any save) produces a new identity.
-    pub fn source_identity(&self) -> SourceIdentity {
-        SourceIdentity(Arc::downgrade(&self.source_identity))
-    }
-
-    /// What the document reads as now (see [`ReadState`]): unlike [`Self::source_identity`], it
-    /// changes with every edit, so a value derived from the document can be cached against it.
-    pub fn read_state(&self) -> ReadState {
-        ReadState { source: self.source_identity(), trailer: self.trailer.clone(), overlay: self.overlay.clone() }
-    }
-
-    pub fn version(&self) -> &str {
-        &self.version
-    }
-
-    /// Set the PDF header version (`"1.4"`, `"1.7"`, `"2.0"`, …) written by a full save.
-    pub fn set_version(&mut self, version: impl Into<String>) {
-        self.version = version.into();
-    }
-
-    pub fn trailer(&self) -> &Dict {
-        &self.trailer
-    }
-
-    pub fn trailer_mut(&mut self) -> &mut Dict {
-        &mut self.trailer
-    }
-
-    pub fn revisions(&self) -> &[Revision] {
-        &self.revisions
-    }
-
-    /// Position of the `%PDF-` header in the file: 0 unless bytes come before it.
-    pub fn header_offset(&self) -> usize {
-        self.header_offset
-    }
-
-    /// There is no cross-reference chain to append to: the index was rebuilt from object
-    /// headers because the file's own was unusable (see [`Self::repair_log`]), or the document
-    /// was built from scratch ([`Self::new_empty`]). A save writes such a document in full, even
-    /// when nothing was edited: for a repaired file that is what puts the repair on disk.
-    pub fn reconstructed(&self) -> bool {
-        self.revisions.is_empty()
-    }
-
-    /// Where each revision of the file ends (oldest first): the byte after the `%%EOF` (and its
-    /// end-of-line) that closes its cross-reference section. `data[..end]` is that revision as it
-    /// was saved. A linearized file's first-page section belongs to the revision it precedes, so
-    /// ends only ever increase. Empty for a reconstructed file.
-    pub fn revision_ends(&self) -> Vec<usize> {
-        let d = &self.data[..];
-        let mut ends: Vec<usize> = Vec::with_capacity(self.revisions.len());
-        for r in self.revisions.iter() {
-            let from = (r.xref_offset as usize).saturating_add(self.header_offset).min(d.len());
-            let Some(at) = d[from..].windows(5).position(|w| w == b"%%EOF") else { continue };
-            let mut end = from + at + 5;
-            while end < d.len() && matches!(d[end], b'\r' | b'\n') && end - (from + at + 5) < 2 {
-                end += 1;
-            }
-            match ends.last_mut() {
-                Some(last) if end <= *last => {}
-                _ => ends.push(end),
-            }
-        }
-        ends
-    }
-
-    pub fn repair_log(&self) -> &[String] {
-        &self.repair_log
-    }
-
-    /// Add a line to [`Self::repair_log`]: a leniency applied while reading that the user should
-    /// know about (fidelity: never silent).
-    pub fn note_repair(&mut self, line: String) {
-        let mut log = self.repair_log.as_ref().clone();
-        log.push(line);
-        self.repair_log = Arc::new(log);
-    }
-
-    /// `true` when there are unsaved edits. Removing an `/Encrypt` dictionary written inline in
-    /// the trailer (as MuPDF writes it) changes no object, and is an edit all the same.
-    pub fn is_modified(&self) -> bool {
-        !self.overlay.is_empty() || self.encryption_changed
-    }
-
-    /// Object numbers changed since the document was opened (or last saved).
-    pub fn modified_objects(&self) -> Vec<u32> {
-        self.overlay.keys().copied().collect()
-    }
-
-    /// Where object `num` is stored in the file (ignoring unsaved edits).
-    pub fn xref_entry(&self, num: u32) -> Option<XrefEntry> {
-        self.entries.lookup(num, &self.data)
-    }
-
-    /// Cross-reference entries this reader did not take at face value, as (byte offset of the
-    /// section, object number): an in-use entry at offset 0, a second and different entry for
-    /// one object in the same section, a reserved cross-reference stream entry type, or a
-    /// hybrid /XRefStm entry that disagrees with the table. The reader sets such an entry aside
-    /// and keeps what it already had for the object. Another reader, the page renderer among
-    /// them, may follow it instead, so the two can then show different objects for one number.
-    /// Code that compares revisions (signature validation) must not call such an object
-    /// unchanged.
-    pub fn xref_oddities(&self) -> &[(u64, u32)] {
-        &self.xref_oddities
-    }
-
-    /// Whether the cross-reference entry of `num` locates that object itself: its `num G obj`
-    /// header at exactly the recorded offset, or the member with that number at the recorded
-    /// position of its object stream. When it does not, [`Self::get`] still finds the object by
-    /// searching, but another reader may resolve the number differently. Ignores unsaved edits.
-    pub fn xref_entry_is_exact(&self, num: u32) -> bool {
-        match self.xref_entry(num) {
-            None | Some(XrefEntry::Free { .. }) => true,
-            Some(XrefEntry::InFile { offset, .. }) => {
-                let at = |off: usize| matches!(parse_indirect_shared(&self.data, off, &|_| None, &self.endstreams), Ok((id, _)) if id.num == num);
-                // Offsets may count from a header that does not start the file.
-                usize::try_from(offset).is_ok_and(|off| at(off) || (self.header_offset != 0 && at(off.saturating_add(self.header_offset))))
-            }
-            Some(XrefEntry::InStream { stream, index }) => self
-                .objstm(stream)
-                .is_ok_and(|stm| usize::try_from(index).ok().and_then(|i| stm.index.get(i)).is_some_and(|m| m.is_some_and(|(n, _)| n == num))),
-        }
-    }
-
-    /// Object `num` has an unsaved edit.
-    pub fn is_edited(&self, num: u32) -> bool {
-        self.overlay.contains_key(&num)
-    }
-
-    pub fn root(&self) -> Option<ObjRef> {
-        self.trailer.reference(b"Root")
-    }
-
-    // ── object access ───────────────────────────────────────────────────────────────────────
-
-    /// Fetch an object by reference. Missing objects are `Null` (ISO 32000-2 §7.3.10).
-    pub fn get(&self, r: ObjRef) -> Arc<Object> {
-        self.try_get(r.num).unwrap_or_else(|_| Arc::new(Object::Null))
-    }
-
-    /// Follow a reference if `o` is one; otherwise return `o` itself.
-    pub fn resolve(&self, o: &Object) -> Arc<Object> {
-        match o {
-            Object::Ref(r) => self.get(*r),
-            other => Arc::new(other.clone()),
-        }
-    }
-
-    /// Resolve and return a dictionary (a stream's dictionary counts).
-    pub fn dict(&self, o: &Object) -> Option<Dict> {
-        self.resolve(o).as_dict().cloned()
-    }
-
-    pub fn try_get(&self, num: u32) -> Result<Arc<Object>, CosError> {
-        match self.overlay.get(&num) {
-            Some(Slot::Set(_, o)) => return Ok(o.clone()),
-            Some(Slot::Freed(_)) => return Ok(Arc::new(Object::Null)),
-            None => {}
-        }
-        if let Some(o) = self.cache.lock().map_err(|_| CosError::Poisoned)?.get(&num) {
-            return Ok(o.clone());
-        }
-        // Loading can re-enter (indirect stream `/Length`, object streams); damaged files make
-        // cycles such as `6 0 obj << /Length 6 0 R >>`. Bound the nesting on every path.
-        let _guard =
-            LoadGuard::enter(num).ok_or_else(|| CosError::Syntax { offset: 0, detail: format!("reference cycle while loading object {num}") })?;
-        let obj = self.load(num, 0)?;
-        let obj = Arc::new(obj);
-        // The editing cache is bounded like the scan reader's: re-parsing a file-backed view
-        // is cheap, and returned objects outlive eviction.
-        self.cache.lock().map_err(|_| CosError::Poisoned)?.insert(num, obj.clone());
-        self.evict_editor_cache_if_over_budget(num, &obj)?;
-        Ok(obj)
-    }
-
-    /// Bounds for the editing cache: roomier than the scan reader's (128 objects / 8 MB)
-    /// so interactive editing does not thrash, but still capped so touching a large
-    /// document cannot pin its whole object graph. Only owned (decrypted/copied) bytes
-    /// count; file-backed views re-parse for free.
-    ///
-    /// Worst case per document: input bytes + up to `EDITOR_CACHE_OBJECTS` ×
-    /// `EDITOR_LARGE_OBJECT` (1024 × 256 KB = 256 MB) of small objects between full
-    /// accounting passes + `EDITOR_OBJSTM_BYTES` (32 MB) + unsaved `overlay` edits.
-    /// The count cap always holds; byte accounting between passes is approximate.
-    /// Clones share these caches, so one clone's eviction drops another's hot set;
-    /// that only costs re-parsing, never correctness. Eviction keeps just the newcomer:
-    /// file-backed views re-parse cheaply and editor working sets stay far below 1024.
-    const EDITOR_CACHE_OBJECTS: usize = 1024;
-    const EDITOR_CACHE_BYTES: usize = 32 * 1024 * 1024;
-    /// Object streams decode to megabytes each, so fewer are kept than plain objects.
-    const EDITOR_OBJSTM_OBJECTS: usize = 256;
-    const EDITOR_OBJSTM_BYTES: usize = 32 * 1024 * 1024;
-    /// Newcomers above this force a full accounting pass even below the count cap:
-    /// `EDITOR_CACHE_BYTES / 128`, so 128 large newcomers always trigger a pass before the
-    /// byte budget can double.
-    const EDITOR_LARGE_OBJECT: usize = 256 * 1024;
-
-    fn evict_editor_cache_if_over_budget(&self, fresh_num: u32, fresh: &Object) -> Result<(), CosError> {
-        // Fast path: the full fold is O(cache) per insert, so skip it for a small newcomer
-        // below the count cap. `len` is copied out first; nothing here holds the lock.
-        let len = self.cache.lock().map_err(|_| CosError::Poisoned)?.len();
-        if len <= Self::EDITOR_CACHE_OBJECTS && owned_bytes(fresh, &self.data, 0) <= Self::EDITOR_LARGE_OBJECT {
-            return Ok(());
-        }
-        // Walk a snapshot off-lock; re-lock only to evict.
-        let live: Vec<(u32, Arc<Object>)> = self.cache.lock().map_err(|_| CosError::Poisoned)?.iter().map(|(n, o)| (*n, o.clone())).collect();
-        let data = &self.data;
-        let owned: usize = live.iter().fold(0usize, |n, (_, o)| n.saturating_add(owned_bytes(o, data, 0)));
-        if live.len() <= Self::EDITOR_CACHE_OBJECTS && owned <= Self::EDITOR_CACHE_BYTES {
-            return Ok(());
-        }
-        // Re-check under the final lock: another thread may have inserted or evicted since
-        // the snapshot. Keep its newcomers, and skip the eviction if back within budget.
-        let snapshot: std::collections::HashSet<u32> = live.into_iter().map(|(n, _)| n).collect();
-        let mut cache = self.cache.lock().map_err(|_| CosError::Poisoned)?;
-        if cache.len() <= Self::EDITOR_CACHE_OBJECTS {
-            let data = &self.data;
-            let owned: usize = cache.values().fold(0usize, |n, o| n.saturating_add(owned_bytes(o, data, 0)));
-            if owned <= Self::EDITOR_CACHE_BYTES {
-                return Ok(());
-            }
-        }
-        cache.retain(|n, _| *n == fresh_num || !snapshot.contains(n));
-        Ok(())
-    }
-
-    fn evict_editor_streams_if_over_budget(&self, current: u32) -> Result<(), CosError> {
-        // The caller inserts `current` first, so retaining it keeps a live entry.
-        let over = {
-            let streams = self.objstms.lock().map_err(|_| CosError::Poisoned)?;
-            let bytes = streams.values().fold(0usize, |bytes, stream| {
-                bytes
-                    .saturating_add(stream.data.capacity())
-                    .saturating_add(stream.index.capacity().saturating_mul(std::mem::size_of::<Option<(u32, usize)>>()))
-            });
-            bytes > Self::EDITOR_OBJSTM_BYTES || streams.len() > Self::EDITOR_OBJSTM_OBJECTS
-        };
-        if over {
-            self.objstms.lock().map_err(|_| CosError::Poisoned)?.retain(|n, _| *n == current);
-        }
-        Ok(())
-    }
-
-    /// Visit every current object without filling this document's editing cache.
-    ///
-    /// Full-document searches (for example, standalone timestamps) need to inspect objects
-    /// that may never be used again. Keep their parse caches private and release them in
-    /// batches. Returned objects own their data and remain valid after the next batch.
-    pub fn scan_objects(&self) -> impl Iterator<Item = (ObjRef, Arc<Object>)> + use<> {
-        let numbers = self.object_numbers();
-        let mut reader = self.object_reader();
-        numbers.into_iter().map(move |num| {
-            let reference = ObjRef::new(num, reader.document.generation(num));
-            (reference, reader.get(reference))
-        })
-    }
-
-    /// Like [`Self::scan_objects`], preserving read errors for callers that must distinguish
-    /// incomplete discovery from an actual null object. Caches remain private and bounded.
-    pub fn scan_objects_checked(&self) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
-        self.scan_objects_subset(self.object_numbers())
-    }
-
-    /// Inspect selected current objects with the same bounded cache as a whole-file scan.
-    /// Missing/freed numbers yield `Null`; malformed objects return their read error.
-    pub fn scan_objects_subset(&self, numbers: Vec<u32>) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
-        let mut reader = self.object_reader();
-        numbers.into_iter().map(move |num| {
-            let reference = ObjRef::new(num, reader.document.generation(num));
-            (reference, reader.try_get(reference))
-        })
-    }
-
-    /// Inspect selected objects in the immutable source, ignoring all unsaved edits. This
-    /// allows a consumer to check an edit's dependencies without retaining an old document.
-    pub fn scan_original_objects_subset(&self, numbers: Vec<u32>) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
-        let mut reader = self.object_reader();
-        reader.document.overlay.clear();
-        numbers.into_iter().map(move |num| {
-            let reference = ObjRef::new(num, reader.document.generation(num));
-            (reference, reader.try_get(reference))
-        })
-    }
-
-    /// Opened with a tighter stream limit than editing uses ([`Document::open_with_stream_limit`]).
-    pub(crate) fn stream_limited(&self) -> bool {
-        self.stream_limit < crate::object::MAX_DECODED
-    }
-
-    pub(crate) fn object_reader(&self) -> ObjectReader {
-        let mut document = self.clone();
-        document.cache = Arc::default();
-        document.objstms = Arc::default();
-        ObjectReader { document, decoded_count: 0 }
-    }
-
-    fn load(&self, num: u32, depth: u32) -> Result<Object, CosError> {
-        if depth > 16 {
-            return Err(CosError::Syntax { offset: 0, detail: "reference cycle while loading".into() });
-        }
-        match self.entries.lookup(num, &self.data) {
-            None | Some(XrefEntry::Free { .. }) => Ok(Object::Null),
-            Some(XrefEntry::InFile { offset, .. }) => {
-                let resolve = |r: ObjRef| {
-                    if let Some(known) = LENGTHS.with(|m| m.borrow().get(&r.num).copied()) {
-                        return known;
-                    }
-                    let length = self.try_get(r.num).ok().and_then(|o| o.as_int());
-                    LENGTHS.with(|m| m.borrow_mut().insert(r.num, length));
-                    length
-                };
-                let off = offset as usize;
-                let at = |off: usize| match parse_indirect_shared(&self.data, off, &resolve, &self.endstreams) {
-                    Ok((id, o)) if id.num == num => Some(self.decrypted(id, o)),
-                    _ => None,
-                };
-                // Offsets relative to a shifted header, or simply wrong: try both fixes.
-                at(off)
-                    .or_else(|| if self.header_offset == 0 { None } else { at(off.saturating_add(self.header_offset)) })
-                    .or_else(|| self.located.get(&num).and_then(|(o, _)| usize::try_from(*o).ok()).and_then(at))
-                    .or_else(|| self.scan_for(num).map(|(id, o)| self.decrypted(id, o)))
-                    .ok_or(CosError::MissingObject(num))
-            }
-            Some(XrefEntry::InStream { stream, index }) => {
-                let stm = self.objstm(stream)?;
-                // The member at the entry's position, else wherever the stream lists `num`.
-                let at = usize::try_from(index).ok().and_then(|i| stm.index.get(i)).copied().flatten().filter(|(n, _)| *n == num);
-                let (_, off) = at.or_else(|| stm.index.iter().flatten().find(|(n, _)| *n == num).copied()).ok_or(CosError::MissingObject(num))?;
-                Lexer::new(&stm.data, off).object()
-            }
-        }
-    }
-
-    fn objstm(&self, num: u32) -> Result<Arc<ObjStm>, CosError> {
-        if let Some(s) = self.objstms.lock().map_err(|_| CosError::Poisoned)?.get(&num) {
-            return Ok(s.clone());
-        }
-        // A file entry that cannot place the stream (one that says it is itself compressed
-        // inside another stream, as in #2367, or points nowhere) is tried by the stream's own
-        // header, as a plain object with a wrong offset is. An edited or freed stream, in the
-        // overlay or in a saved revision's table, is what that says it is: the file's copy
-        // must not come back.
-        let loaded = match self.try_get(num) {
-            Ok(o) if matches!(*o, Object::Stream(_)) => o,
-            _ if self.overlay.contains_key(&num) || matches!(self.xref_entry(num), Some(XrefEntry::Free { .. })) => {
-                return Err(CosError::MissingObject(num));
-            }
-            _ => Arc::new(self.scan_for(num).map(|(id, o)| self.decrypted(id, o)).ok_or(CosError::MissingObject(num))?),
-        };
-        let Object::Stream(s) = &*loaded else { return Err(CosError::MissingObject(num)) };
-        let n = s.dict.int(b"N").unwrap_or(0).clamp(0, 1_000_000) as usize;
-        let first = usize::try_from(s.dict.int(b"First").unwrap_or(0).max(0)).ok();
-        let data = s.decoded_within(self.stream_limit)?;
-        let mut lx = Lexer::new(&data, 0);
-        let mut index = Vec::with_capacity(n);
-        for _ in 0..n {
-            let (Some(Object::Int(onum)), Some(Object::Int(off))) = (lx.object().ok(), lx.object().ok()) else { break };
-            index.push(objstm_member(onum, off, first, data.len()));
-        }
-        let stm = Arc::new(ObjStm { index, data: Arc::new(data) });
-        // Same bound as the object cache: decoded object streams can be megabytes each.
-        // Insert first so the retained `num` is actually in the map.
-        self.objstms.lock().map_err(|_| CosError::Poisoned)?.insert(num, stm.clone());
-        self.evict_editor_streams_if_over_budget(num)?;
-        Ok(stm)
-    }
-
-    /// Last-resort lookup: scan the file for `num G obj`.
-    fn scan_for(&self, num: u32) -> Option<(ObjRef, Object)> {
-        let needle = format!("{num} ");
-        let data = &self.data;
-        let mut found = None;
-        let mut i = 0;
-        while let Some(p) = find(data, needle.as_bytes(), i, data.len()) {
-            i = p + 1;
-            if p > 0 && !is_whitespace(data[p - 1]) {
-                continue;
-            }
-            if let Ok((id, o)) = parse_indirect_shared(data, p, &|_| None, &self.endstreams)
-                && id.num == num
-            {
-                found = Some((id, o)); // keep the last (newest) definition
-            }
-        }
-        found
-    }
-
-    // ── editing ─────────────────────────────────────────────────────────────────────────────
-
-    /// Stream data still pointing into another document's file would keep that whole file
-    /// alive for as long as this edit exists: give it a buffer of its own (just its bytes).
-    fn adopt(&self, obj: Object) -> Object {
-        match obj {
-            Object::Stream(mut s) if s.raw.borrows_other_than(&self.data) => {
-                s.raw = s.raw.detached();
-                Object::Stream(s)
-            }
-            other => other,
-        }
-    }
-
-    /// Replace an object (keeping its generation).
-    pub fn set(&mut self, r: ObjRef, obj: impl Into<Object>) {
-        let obj = self.adopt(obj.into());
-        self.overlay.insert(r.num, Slot::Set(r.generation, Arc::new(obj)));
-        if r.num >= self.next_num {
-            self.next_num = r.num.saturating_add(1);
-        }
-    }
-
-    /// Add a new indirect object and return its reference.
-    pub fn add(&mut self, obj: impl Into<Object>) -> ObjRef {
-        let r = ObjRef::new(self.allocate_num(), 0);
-        let obj = self.adopt(obj.into());
-        self.overlay.insert(r.num, Slot::Set(0, Arc::new(obj)));
-        r
-    }
-
-    /// Find a never-used number, retaining the high-water mark for incremental /Size.
-    /// Exhausted hints fall back to gaps without replacing source or overlay objects.
-    fn allocate_num(&mut self) -> u32 {
-        let mut num = if self.next_num == u32::MAX { 1 } else { self.next_num.max(1) };
-        while self.entries.lookup(num, &self.data).is_some() || self.overlay.contains_key(&num) {
-            num = if num == u32::MAX - 1 { 1 } else { num + 1 };
-        }
-        self.next_num = self.next_num.max(num.saturating_add(1));
-        num
-    }
-
-    /// Delete an object (its number becomes free with the next generation).
-    pub fn free(&mut self, r: ObjRef) {
-        self.overlay.insert(r.num, Slot::Freed(r.generation.saturating_add(1)));
-    }
-
-    /// Record `current`'s object graph as unsaved edits of this document.
-    ///
-    /// Used when the working snapshot was restored from an earlier revision and the next
-    /// incremental save must still append to this file (the last saved revision). Objects
-    /// that already match are left untouched. Reads go through private readers so neither
-    /// document's editing cache is filled.
-    pub fn overlay_changes_from(&mut self, current: &Document) -> Result<(), CosError> {
-        let saved_nums = self.object_numbers();
-        let current_nums = current.object_numbers();
-        let mut freed = Vec::new();
-        let mut changed = Vec::new();
-        {
-            let mut saved_reader = self.object_reader();
-            let mut current_reader = current.object_reader();
-            for &num in &saved_nums {
-                if current_nums.binary_search(&num).is_err() {
-                    freed.push(num);
-                }
-            }
-            for &num in &current_nums {
-                let generation = current.generation(num);
-                let same = saved_nums.binary_search(&num).is_ok()
-                    && self.generation(num) == generation
-                    && saved_reader.try_get(ObjRef::new(num, 0))? == current_reader.try_get(ObjRef::new(num, 0))?;
-                if !same {
-                    changed.push(num);
-                }
-            }
-        }
-        for num in freed {
-            let generation = self.generation(num);
-            self.free(ObjRef::new(num, generation));
-        }
-        let mut current_reader = current.object_reader();
-        for num in changed {
-            let generation = current.generation(num);
-            let object = current_reader.try_get(ObjRef::new(num, 0))?;
-            self.set(ObjRef::new(num, generation), (*object).clone());
-        }
-        *self.trailer_mut() = current.trailer().clone();
-        Ok(())
-    }
-
-    /// Edit a dictionary (or stream dictionary) object in place.
-    pub fn update_dict(&mut self, r: ObjRef, f: impl FnOnce(&mut Dict)) -> Result<(), CosError> {
-        let mut obj = (*self.get(r)).clone();
-        let d = obj.as_dict_mut().ok_or(CosError::NotADictionary(r))?;
-        f(d);
-        self.set(r, obj);
-        Ok(())
-    }
-
-    /// Current generation of an object number.
-    pub fn generation(&self, num: u32) -> u16 {
-        match self.overlay.get(&num) {
-            Some(Slot::Set(g, _)) => *g,
-            Some(Slot::Freed(g)) => *g,
-            None => match self.entries.lookup(num, &self.data) {
-                Some(XrefEntry::InFile { generation, .. }) => generation,
-                Some(XrefEntry::Free { next_generation }) => next_generation,
-                _ => 0,
-            },
-        }
-    }
-
-    pub(crate) fn overlay_entries(&self) -> impl Iterator<Item = (u32, u16, Option<Arc<Object>>)> + '_ {
-        self.overlay.iter().map(|(n, s)| match s {
-            Slot::Set(g, o) => (*n, *g, Some(o.clone())),
-            Slot::Freed(g) => (*n, *g, None),
-        })
-    }
-
-    pub(crate) fn next_num(&self) -> u32 {
-        self.next_num
-    }
-
-    /// All object numbers known (file and overlay), excluding freed ones.
-    pub fn object_numbers(&self) -> Vec<u32> {
-        let source_numbers = self.entries.object_numbers(&self.data);
-        let mut numbers = Vec::with_capacity(source_numbers.len().max(self.overlay.len()));
-        let mut source = source_numbers.into_iter().peekable();
-        for (&num, slot) in &self.overlay {
-            while source.peek().is_some_and(|n| *n < num) {
-                if let Some(n) = source.next() {
-                    numbers.push(n);
-                }
-            }
-            if source.peek().is_some_and(|n| *n == num) {
-                source.next();
-            }
-            if matches!(slot, Slot::Set(..)) {
-                numbers.push(num);
-            }
-        }
-        numbers.extend(source);
-        numbers
-    }
-
-    /// Rebase this document on bytes written by the writer (after a save): edits become part of
-    /// the file and the overlay is cleared, so the next incremental save appends only new edits.
-    pub fn reopen_after_save(&self, bytes: Arc<Vec<u8>>) -> Result<Self, CosError> {
-        Document::open(bytes)
-    }
-
-    // ── cross-reference parsing ─────────────────────────────────────────────────────────────
-
-    fn root_is_catalog(&self) -> bool {
-        let Some(r) = self.root() else { return false };
-        matches!(self.try_get(r.num).as_deref(), Ok(Object::Dict(d)) if d.name(b"Type") == Some(b"Catalog") || d.contains(b"Pages"))
-    }
-
-    #[allow(clippy::type_complexity)]
-    fn read_xref_chain(&self, log: &mut Vec<String>) -> Result<(XrefIndex, Dict, Vec<Revision>, Vec<(u64, u32)>), CosError> {
-        let mut compact_log = Vec::new();
-        if let Ok(Some((index, trailer, revisions))) = self.read_compact_xref_chain(&mut compact_log) {
-            let size = trailer.int(b"Size").unwrap_or(0).max(0);
-            if size > 0 && size <= i64::from(u32::MAX) && u64::from(index.max_num()) < size as u64 {
-                log.extend(compact_log);
-                // The compact reader declines any section with set-aside entries, so there are none here.
-                return Ok((index, trailer, revisions, Vec::new()));
-            }
-        }
-        let (entries, trailer, revisions, oddities) = self.read_xref_chain_materialized(log)?;
-        Ok((XrefIndex::Materialized(Arc::new(entries)), trailer, revisions, oddities))
-    }
-
-    fn read_compact_xref_chain(&self, log: &mut Vec<String>) -> Result<Option<(XrefIndex, Dict, Vec<Revision>)>, CosError> {
-        let data = &self.data;
-        let tail_start = data.len().saturating_sub(4096);
-        let sx = rfind(data, b"startxref", tail_start).ok_or(CosError::Syntax { offset: data.len(), detail: "no startxref".into() })?;
-        let mut lx = Lexer::new(data, sx + 9);
-        let first = match lx.object() {
-            Ok(Object::Int(n)) if n >= 0 => n as u64,
-            _ => return Err(CosError::Syntax { offset: sx, detail: "bad startxref value".into() }),
-        };
-        let mut sections = Vec::new();
-        let mut retained_rows = 0usize;
-        let mut retained_bytes = 0usize;
-        let mut trailer: Option<Dict> = None;
-        let mut revisions = Vec::new();
-        let mut visited = HashSet::new();
-        let mut next = Some(first);
-        while let Some(off) = next.take() {
-            if !visited.insert(off) || visited.len() > 10_000 {
-                log.push(format!("cross-reference chain loops at offset {off}; stopped"));
-                break;
-            }
-            let ((primary, sect_trailer, is_stream), header_relative) = match self.read_compact_section(off as usize) {
-                Ok(Some(v)) => (v, false),
-                Ok(None) => return Ok(None),
-                Err(e) if self.header_offset > 0 => {
-                    log.push(format!("xref at {off} unreadable ({e}); retrying relative to the header"));
-                    match self.read_compact_section(off as usize + self.header_offset)? {
-                        Some(v) => (v, true),
-                        None => return Ok(None),
-                    }
-                }
-                // An unreadable older section loses every object only it locates: the
-                // materialized reader logs it and the file is rebuilt from object headers (#1656).
-                Err(e) => return Err(e),
-            };
-            revisions.push(Revision { xref_offset: off, is_stream, header_relative });
-            if primary.renumbered {
-                log.push(format!("xref subsection at {off} is numbered from 1 but begins with object 0's entry; read from 0"));
-            }
-            let Some(rows) = retained_rows.checked_add(primary.row_count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else { return Ok(None) };
-            let Some(bytes) = retained_bytes.checked_add(primary.retained_bytes()).filter(|bytes| *bytes <= MAX_COMPACT_XREF_BYTES) else {
-                return Ok(None);
-            };
-            retained_rows = rows;
-            retained_bytes = bytes;
-            let hybrid = if let Some(x) = sect_trailer.int(b"XRefStm").filter(|x| *x >= 0) {
-                match self.read_compact_section(x as usize) {
-                    Ok(Some((section, _, _))) => {
-                        let Some(rows) = retained_rows.checked_add(section.row_count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else {
-                            return Ok(None);
-                        };
-                        let Some(bytes) = retained_bytes.checked_add(section.retained_bytes()).filter(|bytes| *bytes <= MAX_COMPACT_XREF_BYTES)
-                        else {
-                            return Ok(None);
-                        };
-                        retained_rows = rows;
-                        retained_bytes = bytes;
-                        Some(section)
-                    }
-                    Ok(None) => return Ok(None),
-                    Err(e) => {
-                        log.push(format!("hybrid /XRefStm at {x} unreadable: {e}"));
-                        None
-                    }
-                }
-            } else {
-                None
-            };
-            if let Some(hybrid) = &hybrid {
-                // A hybrid entry that disagrees with the table is set aside by the materialized reader.
-                let mut numbers = Vec::new();
-                hybrid.extend_numbers(&mut numbers);
-                for num in numbers {
-                    let Some(entry) = hybrid.lookup(num, &self.data) else { continue };
-                    if primary.lookup(num, &self.data).is_some_and(|old| !matches!(old, XrefEntry::Free { .. }) && old != entry) {
-                        return Ok(None);
-                    }
-                }
-            }
-            sections.push(XrefRevisionSection { primary, hybrid });
-            next = prev_offset(data, &sect_trailer, off, |num| sections.iter().find_map(|s| s.lookup(num, data)), log);
-            if trailer.is_none() {
-                trailer = Some(sect_trailer);
-            }
-        }
-        revisions.reverse();
-        let mut trailer = trailer.ok_or(CosError::Syntax { offset: 0, detail: "no trailer".into() })?;
-        for k in [&b"Prev"[..], b"XRefStm", b"Type", b"W", b"Index", b"Filter", b"DecodeParms", b"Length"] {
-            trailer.remove(k);
-        }
-        let mut max_num = 0;
-        let mut has_entries = false;
-        for revision in &sections {
-            max_num = max_num.max(revision.primary.max_num);
-            has_entries |= revision.primary.has_entries;
-            if let Some(hybrid) = &revision.hybrid {
-                max_num = max_num.max(hybrid.max_num);
-                has_entries |= hybrid.has_entries;
-            }
-        }
-        Ok(Some((XrefIndex::Compact { revisions: sections, max_num, has_entries }, trailer, revisions)))
-    }
-
-    fn read_compact_section(&self, off: usize) -> Result<Option<(XrefSection, Dict, bool)>, CosError> {
-        let data = &self.data;
-        let mut lx = Lexer::new(data, off);
-        if lx.eat_keyword(b"xref") {
-            let mut ranges = Vec::new();
-            let mut layout_ok = true;
-            let mut max_num = 0;
-            let mut has_entries = false;
-            let mut previous_end = None;
-            let mut row_count = 0usize;
-            let mut renumbered = false;
-            loop {
-                lx.skip_ws();
-                if lx.eat_keyword(b"trailer") {
-                    let t = lx.object()?;
-                    let d = t.as_dict().cloned().ok_or(CosError::Syntax { offset: lx.pos, detail: "trailer is not a dictionary".into() })?;
-                    if !layout_ok {
-                        return Ok(None);
-                    }
-                    return Ok(Some((XrefSection { data: XrefSectionData::Table, ranges, row_count, max_num, has_entries, renumbered }, d, false)));
-                }
-                let (Ok(Object::Int(start)), Ok(Object::Int(count))) = (lx.object(), lx.object()) else {
-                    return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref subsection header".into() });
-                };
-                if !valid_xref_range(start, count) || count > 10_000_000 {
-                    return Err(CosError::Syntax { offset: lx.pos, detail: "invalid xref object range".into() });
-                }
-                let shifted = subsection_start(data, self.header_offset, lx.pos, start, count);
-                renumbered |= shifted != start;
-                let start = shifted;
-                let Some(next_rows) = usize::try_from(count).ok().and_then(|count| row_count.checked_add(count)) else { return Ok(None) };
-                if next_rows > MAX_COMPACT_XREF_ROWS {
-                    return Ok(None);
-                }
-                row_count = next_rows;
-                let mut range_offset = None;
-                let mut stride = None;
-                let mut previous_record = None;
-                for i in 0..count {
-                    lx.skip_ws();
-                    let record = lx.pos;
-                    if range_offset.is_none() {
-                        range_offset = Some(record);
-                    }
-                    if let Some(previous) = previous_record {
-                        let Some(delta) = record.checked_sub(previous) else {
-                            layout_ok = false;
-                            continue;
-                        };
-                        if stride.is_some_and(|known| known != delta) {
-                            layout_ok = false;
-                        }
-                        stride.get_or_insert(delta);
-                    }
-                    previous_record = Some(record);
-                    let o = lx.token();
-                    lx.skip_ws();
-                    let _generation = lx.token();
-                    lx.skip_ws();
-                    let kind = lx.token();
-                    let num = (start + i) as u32;
-                    let offset = std::str::from_utf8(o).ok().and_then(|s| s.parse::<u64>().ok());
-                    match (kind, offset) {
-                        (b"n", Some(offset)) if offset != 0 => {
-                            has_entries = true;
-                            max_num = max_num.max(num);
-                        }
-                        (b"n", Some(_)) => {
-                            // Set aside by the materialized reader, which records it.
-                            if num != 0 {
-                                return Ok(None);
-                            }
-                        }
-                        (b"f", _) => {
-                            has_entries = true;
-                            max_num = max_num.max(num);
-                        }
-                        _ => return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref entry".into() }),
-                    }
-                }
-                if count > 0 {
-                    let range_start = start as u32;
-                    let range_count = count as u32;
-                    let end = u64::from(range_start) + u64::from(range_count);
-                    if previous_end.is_some_and(|previous| u64::from(range_start) < previous) {
-                        layout_ok = false;
-                    }
-                    previous_end = Some(end);
-                    ranges.push(XrefRange {
-                        start: range_start,
-                        count: range_count,
-                        offset: range_offset.unwrap_or(lx.pos),
-                        stride: stride.unwrap_or(1),
-                    });
-                }
-            }
-        }
-        let (_, obj) = parse_indirect(data, off, &|_| None)?;
-        let Object::Stream(stream) = obj else { return Err(CosError::Syntax { offset: off, detail: "expected xref table or stream".into() }) };
-        if stream.dict.name(b"Type") != Some(b"XRef") {
-            return Err(CosError::Syntax { offset: off, detail: "stream at startxref is not /Type /XRef".into() });
-        }
-        let w: Vec<usize> = stream
-            .dict
-            .get(b"W")
-            .and_then(Object::as_array)
-            .map(|a| a.iter().map(|x| x.as_int().unwrap_or(0).clamp(0, 8) as usize).collect())
-            .unwrap_or_default();
-        if w.len() < 3 {
-            return Err(CosError::Syntax { offset: off, detail: "xref stream /W invalid".into() });
-        }
-        let widths = [w[0], w[1], w[2]];
-        let row = widths.iter().sum::<usize>();
-        if row == 0 {
-            return Err(CosError::Syntax { offset: off, detail: "xref stream row width 0".into() });
-        }
-        let size = stream.dict.int(b"Size").unwrap_or(0).max(0);
-        let index: Vec<i64> = match stream.dict.get(b"Index").and_then(Object::as_array) {
-            Some(a) => a.iter().filter_map(Object::as_int).collect(),
-            None => vec![0, size],
-        };
-        let mut requested_rows = 0usize;
-        let mut previous_end = None;
-        for pair in index.chunks(2) {
-            let [start, count] = pair else { break };
-            if !valid_xref_range(*start, *count) {
-                return Err(CosError::Syntax { offset: off, detail: "invalid xref object range".into() });
-            }
-            let Ok(count) = usize::try_from(*count) else { return Ok(None) };
-            let Some(next) = requested_rows.checked_add(count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else { return Ok(None) };
-            if count > 0 {
-                let end = (*start as u64).saturating_add(count as u64);
-                if previous_end.is_some_and(|previous| (*start as u64) < previous) {
-                    return Ok(None);
-                }
-                previous_end = Some(end);
-            }
-            requested_rows = next;
-        }
-        if requested_rows.checked_mul(row).is_none_or(|bytes| bytes > MAX_COMPACT_XREF_BYTES) {
-            return Ok(None);
-        }
-        let raw = stream.decoded_within(MAX_XREF_OBJECTS.saturating_mul(row).min(self.stream_limit).min(MAX_COMPACT_XREF_BYTES))?;
-        if raw.capacity() > MAX_COMPACT_XREF_BYTES {
-            return Ok(None);
-        }
-        let mut ranges = Vec::new();
-        let mut row_start = 0usize;
-        let available_rows = raw.len() / row;
-        for pair in index.chunks(2) {
-            let [start, count] = pair else { break };
-            let range_start = *start as u32;
-            let Ok(requested) = usize::try_from(*count) else { return Ok(None) };
-            let range_count = requested.min(available_rows.saturating_sub(row_start));
-            if range_count > 0 {
-                let Ok(range_count_u32) = u32::try_from(range_count) else { return Ok(None) };
-                let Some(byte_offset) = row_start.checked_mul(row) else { return Ok(None) };
-                ranges.push(XrefRange { start: range_start, count: range_count_u32, offset: byte_offset, stride: row });
-            }
-            let Some(next) = row_start.checked_add(range_count) else { return Ok(None) };
-            row_start = next;
-        }
-        // Rows the materialized reader sets aside (reserved types, offset 0) are left to it.
-        for range in &ranges {
-            for i in 0..range.count as usize {
-                let at = range.offset + i * row;
-                let Some(r) = raw.get(at..at + row) else { break };
-                let field = |from: usize, width: usize, default: u64| -> u64 {
-                    if width == 0 {
-                        return default;
-                    }
-                    r[from..from + width].iter().fold(0u64, |acc, byte| acc << 8 | u64::from(*byte))
-                };
-                let kind = field(0, widths[0], 1);
-                let offset = field(widths[0], widths[1], 0);
-                if kind > 2 || (kind == 1 && offset == 0 && range.start + i as u32 != 0) {
-                    return Ok(None);
-                }
-            }
-        }
-        let max_num = ranges.iter().filter_map(|range| range.start.checked_add(range.count.saturating_sub(1))).max().unwrap_or(0);
-        let row_count = row_start;
-        let section = XrefSection {
-            data: XrefSectionData::Stream { bytes: Arc::new(raw), widths },
-            ranges,
-            row_count,
-            max_num,
-            has_entries: false,
-            renumbered: false,
-        };
-        let has_entries = section.has_any_entry();
-        let section = XrefSection { has_entries, ..section };
-        Ok(Some((section, stream.dict.clone(), true)))
-    }
-
-    #[allow(clippy::type_complexity)]
-    fn read_xref_chain_materialized(
-        &self,
-        log: &mut Vec<String>,
-    ) -> Result<(BTreeMap<u32, XrefEntry>, Dict, Vec<Revision>, Vec<(u64, u32)>), CosError> {
-        let data = &self.data;
-        let tail_start = data.len().saturating_sub(4096);
-        let sx = rfind(data, b"startxref", tail_start).ok_or(CosError::Syntax { offset: data.len(), detail: "no startxref".into() })?;
-        let mut lx = Lexer::new(data, sx + 9);
-        let first = match lx.object() {
-            Ok(Object::Int(n)) if n >= 0 => n as u64,
-            _ => return Err(CosError::Syntax { offset: sx, detail: "bad startxref value".into() }),
-        };
-        let mut entries = BTreeMap::new();
-        let mut trailer: Option<Dict> = None;
-        let mut revisions = Vec::new();
-        let mut oddities = Vec::new();
-        let mut visited = HashSet::new();
-        // Hybrid streams already read, by offset: their entries, or `None` when unreadable. A newer
-        // section has merged every entry of one into `entries`, so an older section that names it
-        // again only has its own table compared with them, without decoding the stream again.
-        // At most MAX_XREF_OBJECTS entries are kept in all; a stream past that is read again.
-        let mut hybrids: HashMap<i64, Option<BTreeMap<u32, XrefEntry>>> = HashMap::new();
-        let (mut hybrid_rows, mut noted) = (0usize, HashSet::new());
-        let mut next = Some(first);
-        while let Some(off) = next.take() {
-            if !visited.insert(off) || visited.len() > 10_000 {
-                log.push(format!("cross-reference chain loops at offset {off}; stopped"));
-                break;
-            }
-            // This section's own entries; older sections only fill what newer ones left out.
-            let mut sect = BTreeMap::new();
-            // Object numbers whose entry in this section was set aside ([`Self::xref_oddities`]).
-            let mut odd = Vec::new();
-            let ((sect_trailer, is_stream), header_relative) = match self.read_section(off as usize, &mut sect, &mut odd, log) {
-                Ok(v) => (v, false),
-                Err(e) if self.header_offset > 0 => {
-                    log.push(format!("xref at {off} unreadable ({e}); retrying relative to the header"));
-                    sect.clear();
-                    odd.clear();
-                    (self.read_section(off as usize + self.header_offset, &mut sect, &mut odd, log)?, true)
-                }
-                Err(e) => {
-                    // An unreadable older section loses every object only it locates (the page
-                    // tree, often): rebuild from object headers, as readers do (#1656).
-                    if !revisions.is_empty() {
-                        log.push(format!("older cross-reference section at {off} is unreadable: {e}"));
-                    }
-                    return Err(e);
-                }
-            };
-            revisions.push(Revision { xref_offset: off, is_stream, header_relative });
-            // Hybrid files (§7.5.8.4): the /XRefStm entries supplement the table and replace the
-            // free entries it gives objects only a cross-reference stream can locate.
-            let hybrid = sect_trailer.int(b"XRefStm").filter(|x| *x >= 0);
-            if let Some((x, read)) = hybrid.and_then(|x| hybrids.get(&x).map(|read| (x, read))) {
-                if noted.insert(x) {
-                    log.push(format!("hybrid /XRefStm at {x} named again by the section at {off}; read once"));
-                }
-                if let Some(stm) = read {
-                    for (num, old) in &sect {
-                        // The table places the object somewhere other than the stream does.
-                        if !matches!(old, XrefEntry::Free { .. }) && stm.get(num).is_some_and(|e| e != old) {
-                            odd.push(*num);
-                        }
-                    }
-                }
-            } else if let Some(x) = hybrid {
-                let mut stm = BTreeMap::new();
-                let read = match self.read_section(x as usize, &mut stm, &mut odd, log) {
-                    Ok(_) => {
-                        for (&num, &e) in &stm {
-                            match sect.get(&num) {
-                                None | Some(XrefEntry::Free { .. }) => {
-                                    sect.insert(num, e);
-                                }
-                                // The table already places the object somewhere else.
-                                Some(old) if *old != e => odd.push(num),
-                                Some(_) => {}
-                            }
-                        }
-                        Some(stm)
-                    }
-                    Err(e) => {
-                        log.push(format!("hybrid /XRefStm at {x} unreadable: {e}"));
-                        None
-                    }
-                };
-                let rows = read.as_ref().map_or(0, BTreeMap::len);
-                if let Some(total) = hybrid_rows.checked_add(rows).filter(|total| *total <= MAX_XREF_OBJECTS) {
-                    hybrid_rows = total;
-                    hybrids.insert(x, read);
-                }
-            }
-            oddities.extend(odd.into_iter().map(|num| (off, num)));
-            for (num, e) in sect {
-                entries.entry(num).or_insert(e);
-            }
-            next = prev_offset(data, &sect_trailer, off, |num| entries.get(&num).copied(), log);
-            if trailer.is_none() {
-                trailer = Some(sect_trailer);
-            }
-        }
-        revisions.reverse();
-        let mut trailer = trailer.ok_or(CosError::Syntax { offset: 0, detail: "no trailer".into() })?;
-        for k in [&b"Prev"[..], b"XRefStm", b"Type", b"W", b"Index", b"Filter", b"DecodeParms", b"Length"] {
-            trailer.remove(k);
-        }
-        Ok((entries, trailer, revisions, oddities))
-    }
-
-    /// Read one section at `off`, adding entries not already known (newer sections win). `odd`
-    /// collects the object numbers whose entry here is set aside ([`Self::xref_oddities`]).
-    fn read_section(
-        &self,
-        off: usize,
-        entries: &mut BTreeMap<u32, XrefEntry>,
-        odd: &mut Vec<u32>,
-        log: &mut Vec<String>,
-    ) -> Result<(Dict, bool), CosError> {
-        #[cfg(test)]
-        SECTION_READS.with(|c| c.set(c.get() + 1));
-        let data = &self.data;
-        let mut lx = Lexer::new(data, off);
-        if lx.eat_keyword(b"xref") {
-            loop {
-                lx.skip_ws();
-                if lx.eat_keyword(b"trailer") {
-                    let t = lx.object()?;
-                    let d = t.as_dict().cloned().ok_or(CosError::Syntax { offset: lx.pos, detail: "trailer is not a dictionary".into() })?;
-                    return Ok((d, false));
-                }
-                let (Ok(Object::Int(start)), Ok(Object::Int(count))) = (lx.object(), lx.object()) else {
-                    return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref subsection header".into() });
-                };
-                if !valid_xref_range(start, count) || count > 10_000_000 {
-                    return Err(CosError::Syntax { offset: lx.pos, detail: "invalid xref object range".into() });
-                }
-                let shifted = subsection_start(data, self.header_offset, lx.pos, start, count);
-                if shifted != start {
-                    log.push(format!("xref subsection at {off} is numbered from 1 but begins with object 0's entry; read from 0"));
-                }
-                let start = shifted;
-                for i in 0..count {
-                    lx.skip_ws();
-                    let o = lx.token();
-                    lx.skip_ws();
-                    let g = lx.token();
-                    lx.skip_ws();
-                    let kind = lx.token();
-                    let num = (start + i) as u32;
-                    let offset = std::str::from_utf8(o).ok().and_then(|s| s.parse::<u64>().ok());
-                    let generation = std::str::from_utf8(g).ok().and_then(|s| s.parse::<u32>().ok()).unwrap_or(0).min(u16::MAX as u32) as u16;
-                    let entry = match (kind, offset) {
-                        (b"n", Some(offset)) => XrefEntry::InFile { offset, generation },
-                        (b"f", _) => XrefEntry::Free { next_generation: generation },
-                        _ => return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref entry".into() }),
-                    };
-                    // Offset 0 "in use" entries are a known producer bug: ignore them. (Object 0
-                    // is never a real object, so its entry cannot mislead anyone.)
-                    if matches!(entry, XrefEntry::InFile { offset: 0, .. }) {
-                        if num != 0 {
-                            odd.push(num);
-                        }
-                        continue;
-                    }
-                    if *entries.entry(num).or_insert(entry) != entry {
-                        odd.push(num);
-                    }
-                }
-            }
-        }
-        // Cross-reference stream.
-        let (_, obj) = parse_indirect(data, off, &|_| None)?;
-        let Object::Stream(s) = obj else { return Err(CosError::Syntax { offset: off, detail: "expected xref table or stream".into() }) };
-        if s.dict.name(b"Type") != Some(b"XRef") {
-            return Err(CosError::Syntax { offset: off, detail: "stream at startxref is not /Type /XRef".into() });
-        }
-        let w: Vec<usize> = s
-            .dict
-            .get(b"W")
-            .and_then(Object::as_array)
-            .map(|a| a.iter().map(|x| x.as_int().unwrap_or(0).clamp(0, 8) as usize).collect())
-            .unwrap_or_default();
-        if w.len() < 3 {
-            return Err(CosError::Syntax { offset: off, detail: "xref stream /W invalid".into() });
-        }
-        let size = s.dict.int(b"Size").unwrap_or(0).max(0);
-        let index: Vec<i64> = match s.dict.get(b"Index").and_then(Object::as_array) {
-            Some(a) => a.iter().filter_map(Object::as_int).collect(),
-            None => vec![0, size],
-        };
-        let row = w[0] + w[1] + w[2];
-        if row == 0 {
-            return Err(CosError::Syntax { offset: off, detail: "xref stream row width 0".into() });
-        }
-        // One row per object, and a document has at most 8,388,607 indirect objects (the classic
-        // implementation limit): decoding more than that (about 200 MB at the widest rows) is a
-        // decompression bomb, not cross-reference data. The section is then reconstructed.
-        let raw = s.decoded_within(MAX_XREF_OBJECTS.saturating_mul(row).min(self.stream_limit))?;
-        let field = |r: &[u8], from: usize, len: usize, default: u64| -> u64 {
-            if len == 0 {
-                return default;
-            }
-            r[from..from + len].iter().fold(0u64, |acc, b| acc << 8 | *b as u64)
-        };
-        let mut rows = raw.chunks_exact(row);
-        for pair in index.chunks(2) {
-            let [start, count] = pair else { break };
-            if !valid_xref_range(*start, *count) {
-                return Err(CosError::Syntax { offset: off, detail: "invalid xref object range".into() });
-            }
-            for i in 0..*count {
-                let Some(r) = rows.next() else { break };
-                let t = field(r, 0, w[0], 1);
-                let a = field(r, w[0], w[1], 0);
-                let b = field(r, w[0] + w[1], w[2], 0);
-                let num = (*start + i) as u32;
-                let entry = match t {
-                    0 => XrefEntry::Free { next_generation: b.min(u16::MAX as u64) as u16 },
-                    1 => XrefEntry::InFile { offset: a, generation: b.min(u16::MAX as u64) as u16 },
-                    2 => XrefEntry::InStream { stream: a.min(u32::MAX as u64) as u32, index: b.min(u32::MAX as u64) as u32 },
-                    // Reserved types are treated as null references (§7.5.8.3).
-                    _ => {
-                        odd.push(num);
-                        continue;
-                    }
-                };
-                if matches!(entry, XrefEntry::InFile { offset: 0, .. }) {
-                    if num != 0 {
-                        odd.push(num);
-                    }
-                    continue;
-                }
-                if *entries.entry(num).or_insert(entry) != entry {
-                    odd.push(num);
-                }
-            }
-        }
-        Ok((s.dict.clone(), true))
-    }
-
-    /// Cross-reference data that leaves out objects the file contains: a subsection numbered one
-    /// too low (object 0 in use, the last object without an entry), or an in-use entry at offset 0
-    /// that nothing else replaces. (A number no section lists is not evidence: it is a null
-    /// object, §7.3.10, and valid files have them below an oversized `/Size`.) Viewers rebuild
-    /// the table and show these objects; reading them as null would drop them from every copy.
-    /// When one of those shows, the file is scanned once for object headers, and wrong offsets
-    /// are looked up there (`load`). Only the numbers the damage leaves out take the last
-    /// header's location: one whose entry was set aside, or the last object of a subsection
-    /// numbered one too low. Any other unlisted number stays null, and existing
-    /// entries are never replaced: an object freed by an update stays freed.
-    fn fill_xref_gaps(&mut self, log: &mut Vec<String>) {
-        let entries = &self.entries;
-        let shifted = matches!(entries.lookup(0, &self.data), Some(XrefEntry::InFile { .. }));
-        let set_aside = self.xref_oddities.iter().any(|(_, num)| entries.lookup(*num, &self.data).is_none());
-        if !(shifted || set_aside) {
-            return;
-        }
-        let mut located = BTreeMap::new();
-        for (num, offset, generation, _) in object_headers(&self.data) {
-            located.insert(num, (offset, generation));
-        }
-        let mut filled = entries.to_map(&self.data);
-        // A subsection `0 N` whose rows are those of objects 1 to N leaves out object N, whatever
-        // newer sections say about its neighbours.
-        let past_shift: HashSet<u32> = if shifted {
-            self.revisions
-                .iter()
-                .filter(|r| !r.is_stream)
-                .filter_map(|r| usize::try_from(r.xref_offset).ok().map(|o| if r.header_relative { o.saturating_add(self.header_offset) } else { o }))
-                .filter_map(|at| shifted_subsection_end(&self.data, at))
-                .collect()
-        } else {
-            HashSet::new()
-        };
-        let odd: HashSet<u32> = self.xref_oddities.iter().map(|(_, n)| *n).collect();
-        let mut found = 0usize;
-        for (&num, &(offset, generation)) in &located {
-            let left_out = past_shift.contains(&num) || odd.contains(&num);
-            if num != 0 && !filled.contains_key(&num) && left_out {
-                filled.insert(num, XrefEntry::InFile { offset, generation });
-                found += 1;
-            }
-        }
-        if found > 0 {
-            log.push(format!("the cross-reference data leaves out {found} objects the file contains; located them by their object headers"));
-            self.entries = Arc::new(XrefIndex::Materialized(Arc::new(filled)));
-        }
-        self.located = Arc::new(located);
-    }
-
-    /// Rebuild the cross-reference index by scanning for `N G obj` headers (§7.5.4 recovery).
-    fn reconstruct(&mut self, log: &mut Vec<String>) -> Result<(), CosError> {
-        let data = self.data.clone();
-        let mut entries: BTreeMap<u32, XrefEntry> = BTreeMap::new();
-        let mut objstms = Vec::new();
-        // Offsets of objects that may be cross-reference streams: their dictionaries are the
-        // trailers of files that have no `trailer` keyword (§7.5.8).
-        let mut xref_streams = Vec::new();
-        for (num, offset, generation, body) in object_headers(&data) {
-            entries.insert(num, XrefEntry::InFile { offset, generation });
-            objstms.push(num);
-            if find(&data, b"/XRef", body, body.saturating_add(1024)).is_some()
-                && let Ok(at) = usize::try_from(offset)
-            {
-                xref_streams.push(at);
-            }
-        }
-        if entries.is_empty() {
-            return Err(CosError::Syntax { offset: 0, detail: "no objects found".into() });
-        }
-        self.entries = Arc::new(XrefIndex::Materialized(Arc::new(entries.clone())));
-        self.cache.lock().map_err(|_| CosError::Poisoned)?.clear();
-        // Objects inside object streams.
-        for num in objstms {
-            if let Ok(o) = self.try_get(num)
-                && let Object::Stream(s) = &*o
-                && s.dict.name(b"Type") == Some(b"ObjStm")
-                && let Ok(stm) = self.objstm(num)
-            {
-                for (idx, member) in stm.index.iter().enumerate() {
-                    if let Some((inner, _)) = member {
-                        entries.entry(*inner).or_insert(XrefEntry::InStream { stream: num, index: idx as u32 });
-                    }
-                }
-            }
-        }
-        let object_count = entries.len();
-        self.entries = Arc::new(XrefIndex::Materialized(Arc::new(entries)));
-        self.cache.lock().map_err(|_| CosError::Poisoned)?.clear();
-        // Trailer: the last `trailer` dictionary or cross-reference stream dictionary with a
-        // usable /Root (last in the file, whichever kind), else the catalog itself. One whose
-        // /Root is a catalog (as `root_is_catalog` judges it) beats one whose /Root is another
-        // dictionary, such as /Info, wherever it is; an FDF's /Root (no /Type, no /Pages) still
-        // counts when nothing better is there.
-        // A file whose only trailers are cross-reference streams (and whose `startxref` is gone
-        // or points nowhere) keeps its /Info, /ID and /Encrypt this way.
-        let rank = |at: usize, d: &Dict| {
-            let root = self.try_get(d.reference(b"Root")?.num).ok()?;
-            let Object::Dict(c) = &*root else { return None };
-            Some((c.name(b"Type") == Some(b"Catalog") || c.contains(b"Pages"), at))
-        };
-        let mut trailer: Option<((bool, usize), Dict)> = None;
-        let mut from = 0;
-        while let Some(p) = find(&data, b"trailer", from, data.len()) {
-            from = p + 7;
-            let mut lx = Lexer::new(&data, from);
-            if let Ok(Object::Dict(d)) = lx.object()
-                && let Some(r) = rank(p, &d)
-                && trailer.as_ref().is_none_or(|(best, _)| r > *best)
-            {
-                trailer = Some((r, d));
-            }
-        }
-        for at in xref_streams {
-            if trailer.as_ref().is_some_and(|((catalog, p), _)| *catalog && *p > at) {
-                continue;
-            }
-            if let Ok((_, Object::Stream(s))) = parse_indirect_shared(&data, at, &|_| None, &self.endstreams)
-                && s.dict.name(b"Type") == Some(b"XRef")
-                && let Some(r) = rank(at, &s.dict)
-                && trailer.as_ref().is_none_or(|(best, _)| r > *best)
-            {
-                trailer = Some((r, s.dict));
-            }
-        }
-        let trailer = match trailer {
-            Some((_, t)) => t,
-            None => {
-                let catalog = self
-                    .entries
-                    .object_numbers(&self.data)
-                    .into_iter()
-                    .find(|n| matches!(self.try_get(*n).as_deref(), Ok(Object::Dict(d)) if d.name(b"Type") == Some(b"Catalog")));
-                let Some(c) = catalog else { return Err(CosError::Syntax { offset: 0, detail: "no document catalog found".into() }) };
-                let mut t = Dict::new();
-                t.set(b"Root".to_vec(), Object::Ref(ObjRef::new(c, self.generation(c))));
-                t
-            }
-        };
-        let mut trailer = trailer;
-        // What a cross-reference stream's dictionary carries for itself goes, as the chain
-        // readers drop it: a save writes its own.
-        for k in [&b"Prev"[..], b"XRefStm", b"Type", b"W", b"Index", b"Filter", b"DecodeParms", b"Length"] {
-            trailer.remove(k);
-        }
-        self.trailer = trailer;
-        self.revisions = Arc::new(Vec::new());
-        log.push(format!("rebuilt cross-reference index from {object_count} object headers"));
-        Ok(())
-    }
-}
-
-/// For a classic table at `at` whose first subsection is `0 N` and opens with an in-use row
-/// (the rows of objects 1 to N), the number N its rows really end at.
-fn shifted_subsection_end(data: &[u8], at: usize) -> Option<u32> {
-    let mut lx = Lexer::new(data, at);
-    if !lx.eat_keyword(b"xref") {
-        return None;
-    }
-    let (Ok(Object::Int(0)), Ok(Object::Int(count))) = (lx.object(), lx.object()) else { return None };
-    lx.skip_ws();
-    let offset = std::str::from_utf8(lx.token()).ok().and_then(|s| s.parse::<u64>().ok());
-    lx.skip_ws();
-    lx.token();
-    lx.skip_ws();
-    match (offset, lx.token()) {
-        (Some(offset), b"n") if offset != 0 => u32::try_from(count).ok().filter(|n| *n > 0),
-        _ => None,
-    }
-}
-
-/// Every `N G obj` header in `data`, in file order, as (number, offset, generation, position
-/// after `obj`).
-fn object_headers(data: &[u8]) -> Vec<(u32, u64, u16, usize)> {
-    let mut headers = Vec::new();
-    let mut i = 0;
-    while i < data.len() {
-        // Object headers start at a line start (or after whitespace).
-        let at_start = i == 0 || is_whitespace(data[i - 1]) || data[i - 1] == b'>';
-        if at_start && data[i].is_ascii_digit() {
-            let mut lx = Lexer::new(data, i);
-            let n = lx.token();
-            lx.skip_ws();
-            let g = lx.token();
-            if !n.is_empty() && !g.is_empty() && n.iter().all(u8::is_ascii_digit) && g.iter().all(u8::is_ascii_digit) && lx.eat_keyword(b"obj") {
-                let num = std::str::from_utf8(n).ok().and_then(|s| s.parse::<u32>().ok());
-                let generation = std::str::from_utf8(g).ok().and_then(|s| s.parse::<u16>().ok()).unwrap_or(0);
-                if let Some(num) = num {
-                    headers.push((num, i as u64, generation, lx.pos));
-                }
-                i = lx.pos;
-                continue;
-            }
-        }
-        i += 1;
-    }
-    headers
-}
-
-/// The offset of the section before the one whose trailer this is (`/Prev`), if any. Some writers
-/// give it as a reference, `N 0 R`. When the sections read so far (`lookup`) place that object
-/// and it holds an offset (iText's `indirectPrev.pdf`), that is the offset; otherwise, as the
-/// tiff2pdf files in JHOVE's PDF-HUL-157 cases need, the sections before are at N. Either way the
-/// reference is noted. Any other value that is not an offset is noted and ends the chain.
-fn prev_offset(data: &[u8], trailer: &Dict, off: u64, lookup: impl Fn(u32) -> Option<XrefEntry>, log: &mut Vec<String>) -> Option<u64> {
-    match trailer.get(b"Prev") {
-        Some(Object::Int(p)) if *p >= 0 => Some(*p as u64),
-        Some(Object::Ref(r)) => {
-            let held = match lookup(r.num) {
-                Some(XrefEntry::InFile { offset, generation }) if generation == r.generation => {
-                    usize::try_from(offset).ok().and_then(|at| parse_indirect(data, at, &|_| None).ok()).and_then(|(at, value)| match value {
-                        Object::Int(p) if at == *r && p >= 0 => Some(p as u64),
-                        _ => None,
-                    })
-                }
-                _ => None,
-            };
-            match held {
-                Some(p) => {
-                    log.push(format!(
-                        "the trailer at {off} gives /Prev as the reference {} {} R; reading the offset {p} it holds",
-                        r.num, r.generation
-                    ));
-                    Some(p)
-                }
-                None => {
-                    log.push(format!(
-                        "the trailer at {off} gives /Prev as the reference {} {} R; reading it as offset {}",
-                        r.num, r.generation, r.num
-                    ));
-                    Some(u64::from(r.num))
-                }
-            }
-        }
-        Some(_) => {
-            log.push(format!("the trailer at {off} has a /Prev that is not an offset; the sections before it are unreachable"));
-            None
-        }
-        None => None,
-    }
-}
-
-pub(crate) fn find(hay: &[u8], needle: &[u8], from: usize, to: usize) -> Option<usize> {
-    let to = to.min(hay.len());
-    if from >= to || needle.is_empty() || to - from < needle.len() {
-        return None;
-    }
-    hay[from..to].windows(needle.len()).position(|w| w == needle).map(|p| p + from)
-}
-
-fn rfind(hay: &[u8], needle: &[u8], from: usize) -> Option<usize> {
-    if hay.len() < needle.len() {
-        return None;
-    }
-    (from..=hay.len() - needle.len()).rev().find(|&i| &hay[i..i + needle.len()] == needle)
-}
-
-/// A file identifier derived from entropy supplied by the caller.
-fn generated_id(seed: &[u8; 32]) -> Vec<u8> {
-    use std::hash::{Hash, Hasher};
-    let mut out = Vec::new();
-    for i in 0..2u8 {
-        let mut h = std::collections::hash_map::DefaultHasher::new();
-        (seed, i, b"pdfcraft id").hash(&mut h);
-        out.extend_from_slice(&h.finish().to_be_bytes());
-    }
-    out
-}
-
-/// The object number a classic xref subsection really starts at. A common producer bug heads the
-/// table `1 n` and then writes object 0's free entry (`0000000000 65535 f`) as its first row, so
-/// every row would be read one number too high and object 1 as free. Such a subsection is read
-/// from 0 when its second row, read that way, locates an object that is indeed numbered 1, at
-/// that offset or, as `load` reads offsets, relative to a header shifted by `header_offset`.
-/// `rows` is the position just after the subsection header.
-fn subsection_start(data: &[u8], header_offset: usize, rows: usize, start: i64, count: i64) -> i64 {
-    if start != 1 || count < 2 {
-        return start;
-    }
-    let mut lx = Lexer::new(data, rows);
-    let mut row = || {
-        lx.skip_ws();
-        let offset = std::str::from_utf8(lx.token()).ok().and_then(|s| s.parse::<u64>().ok());
-        lx.skip_ws();
-        let generation = std::str::from_utf8(lx.token()).ok().and_then(|s| s.parse::<u32>().ok());
-        lx.skip_ws();
-        (offset, generation, lx.token() == b"f")
-    };
-    let (Some(0), Some(65535), true) = row() else { return start };
-    let (Some(second), _, false) = row() else { return start };
-    let object_one = |at: usize| {
-        if at >= data.len() {
-            return false;
-        }
-        let mut obj = Lexer::new(data, at);
-        matches!((obj.object(), obj.object()), (Ok(Object::Int(1)), Ok(Object::Int(_)))) && obj.eat_keyword(b"obj")
-    };
-    let Ok(second) = usize::try_from(second) else { return start };
-    if object_one(second) || (header_offset != 0 && object_one(second.saturating_add(header_offset))) { 0 } else { start }
-}
-
-/// Object numbers must fit the representation used by references and the xref map.
-/// Validate the whole subsection before adding entries, so neither arithmetic overflow nor
-/// truncation can turn a damaged range into entries for unrelated objects.
-fn valid_xref_range(start: i64, count: i64) -> bool {
-    u32::try_from(start).is_ok() && count >= 0 && start.checked_add(count).is_some_and(|end| end <= i64::from(u32::MAX) + 1)
-}
-
-/// The most indirect objects a document can have (the classic implementation limit, ISO
-/// 32000-1 Annex C): it bounds how much data a cross-reference stream can hold.
-const MAX_XREF_OBJECTS: usize = 8_388_607;
-
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_read_state_matches_a_clone_and_no_changed_document() {
-        let mut doc = Document::new_empty();
-        let a = doc.add(Object::Int(1));
-        let state = doc.read_state();
-        let snapshot = doc.clone();
-        assert!(state.matches(&doc) && state.matches(&snapshot));
-        // The same value set again is still a change: another allocation.
-        doc.set(a, Object::Int(1));
-        assert!(!state.matches(&doc) && state.matches(&snapshot));
-        let edited = doc.read_state();
-        doc.free(a);
-        assert!(!edited.matches(&doc));
-        let mut trailer_changed = snapshot.clone();
-        trailer_changed.trailer_mut().set(b"Info".to_vec(), Object::Null);
-        assert!(!state.matches(&trailer_changed));
-        // Another document's state never matches, even with the same changes.
-        let mut other = Document::new_empty();
-        other.add(Object::Int(1));
-        assert!(!other.read_state().matches(&snapshot));
-    }
-
-    /// Build a classic-xref file from object bodies (object i+1 = bodies[i]).
-    pub(crate) fn build(bodies: &[&str], trailer: &str) -> Vec<u8> {
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, b) in bodies.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend_from_slice(format!("{} 0 obj\n{b}\nendobj\n", i + 1).as_bytes());
-        }
-        let xref = out.len();
-        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", bodies.len() + 1).as_bytes());
-        for o in offsets {
-            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        out.extend_from_slice(format!("trailer\n<< /Size {} {trailer} >>\nstartxref\n{xref}\n%%EOF\n", bodies.len() + 1).as_bytes());
-        out
-    }
-
-    fn assert_compact_matches_materialized(doc: &Document) {
-        assert!(matches!(doc.entries.as_ref(), XrefIndex::Compact { .. }), "valid xrefs should not retain a per-entry map");
-        let (entries, _, revisions, _) = doc.read_xref_chain_materialized(&mut Vec::new()).unwrap();
-        assert_eq!(revisions.as_slice(), doc.revisions());
-        let max = entries.keys().next_back().copied().unwrap_or(0);
-        assert_eq!(doc.entries.max_num(), max);
-        for num in 0..=max {
-            assert_eq!(doc.xref_entry(num), entries.get(&num).copied(), "object {num}");
-        }
-        let expected: Vec<_> = entries.iter().filter_map(|(&num, entry)| (!matches!(entry, XrefEntry::Free { .. })).then_some(num)).collect();
-        assert_eq!(doc.object_numbers(), expected);
-    }
-
-    #[test]
-    fn compact_xref_tables_streams_and_revisions_match_the_materialized_reader() {
-        let classic = Document::open(Arc::new(build(
-            &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Value 9 >>"],
-            "/Root 1 0 R",
-        )))
-        .unwrap();
-        assert_compact_matches_materialized(&classic);
-
-        let mut sparse = b"%PDF-1.7\n".to_vec();
-        let root_offset = sparse.len();
-        sparse.extend_from_slice(b"1 0 obj\n<< /Type /Catalog /Pages 5 0 R >>\nendobj\n");
-        let pages_offset = sparse.len();
-        sparse.extend_from_slice(b"5 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
-        let xref = sparse.len();
-        sparse.extend_from_slice(
-            format!(
-                "xref\n0 1\n0000000000 65535 f \n1 1\n{root_offset:010} 00000 n \n5 1\n{pages_offset:010} 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n"
-            )
-            .as_bytes(),
-        );
-        let sparse = Document::open(Arc::new(sparse)).unwrap();
-        assert_eq!(sparse.object_numbers(), vec![1, 5]);
-        assert_compact_matches_materialized(&sparse);
-
-        let mut sparse_stream = b"%PDF-1.7\n".to_vec();
-        let mut offsets = [0u32; 8];
-        offsets[1] = sparse_stream.len() as u32;
-        sparse_stream.extend_from_slice(b"1 0 obj\n<< /Type /Catalog /Pages 5 0 R >>\nendobj\n");
-        offsets[5] = sparse_stream.len() as u32;
-        sparse_stream.extend_from_slice(b"5 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
-        offsets[6] = sparse_stream.len() as u32;
-        sparse_stream.extend_from_slice(b"6 0 obj\n<< /Unused true >>\nendobj\n");
-        offsets[7] = sparse_stream.len() as u32;
-        let xref_row = |kind: u8, offset: u32, generation: u16| {
-            let mut row = Vec::with_capacity(7);
-            row.push(kind);
-            row.extend_from_slice(&offset.to_be_bytes());
-            row.extend_from_slice(&generation.to_be_bytes());
-            row
-        };
-        let mut rows = Vec::new();
-        rows.extend(xref_row(0, 0, u16::MAX));
-        rows.extend(xref_row(1, offsets[1], 0));
-        rows.extend(xref_row(1, offsets[5], 0));
-        rows.extend(xref_row(1, offsets[6], 0));
-        rows.extend(xref_row(1, offsets[7], 0));
-        sparse_stream.extend_from_slice(
-            format!("7 0 obj\n<< /Type /XRef /Size 8 /Root 1 0 R /W [1 4 2] /Index [0 2 5 3] /Length {} >>\nstream\n", rows.len()).as_bytes(),
-        );
-        sparse_stream.extend_from_slice(&rows);
-        sparse_stream.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{}\n%%EOF\n", offsets[7]).as_bytes());
-        let sparse_stream = Document::open(Arc::new(sparse_stream)).unwrap();
-        assert_eq!(sparse_stream.object_numbers(), vec![1, 5, 6, 7]);
-        assert_compact_matches_materialized(&sparse_stream);
-
-        let stream_bytes = crate::write_full(&classic, &crate::SaveOptions::default()).unwrap();
-        let stream = Document::open(Arc::new(stream_bytes)).unwrap();
-        assert!(stream.revisions().last().is_some_and(|revision| revision.is_stream));
-        assert_compact_matches_materialized(&stream);
-
-        let mut edited = classic.clone();
-        edited.update_dict(ObjRef::new(1, 0), |dict| dict.set(b"Lang".to_vec(), Object::String(crate::PdfString::literal("en")))).unwrap();
-        edited.free(ObjRef::new(3, 0));
-        let incremental = crate::write_incremental(&edited, &crate::SaveOptions::default()).unwrap();
-        let updated = Document::open(Arc::new(incremental)).unwrap();
-        assert_eq!(updated.revisions().len(), 2);
-        assert_compact_matches_materialized(&updated);
-    }
-
-    #[test]
-    fn malformed_size_uses_the_materialized_compatibility_path() {
-        let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Value 9 >>"], "/Root 1 0 R");
-        let marker = b"/Size 4";
-        let at = bytes.windows(marker.len()).position(|window| window == marker).unwrap();
-        bytes[at..at + marker.len()].copy_from_slice(b"/Size 2");
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert!(matches!(doc.entries.as_ref(), XrefIndex::Materialized(_)));
-        assert_eq!(doc.next_num, 4);
-        assert_eq!(doc.object_numbers(), vec![1, 2, 3]);
-    }
-
-    /// Entries the reader sets aside are remembered, so a caller comparing revisions can tell
-    /// that another reader may resolve the object differently.
-    #[test]
-    fn cross_reference_entries_that_are_set_aside_are_recorded() {
-        let base = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "(three)"], "/Root 1 0 R");
-        let plain = Document::open(Arc::new(base.clone())).unwrap();
-        assert!(plain.xref_oddities().is_empty());
-        assert!((1..=3).all(|n| plain.xref_entry_is_exact(n)));
-        let prev = String::from_utf8_lossy(&base).rfind("xref\n0 4").unwrap();
-        let third = plain.xref_entry(3).unwrap();
-
-        // A later section: object 3 "in use" at offset 0, object 2 listed twice with different
-        // offsets, and object 0 at offset 0 (the usual producer slip, which names no object).
-        let mut bytes = base.clone();
-        let section = bytes.len();
-        bytes.extend_from_slice(
-            format!("xref\n0 1\n0000000000 65535 n \n3 1\n0000000000 00000 n \n2 1\n0000000058 00000 n \n2 1\n0000000009 00000 n \ntrailer\n<< /Size 4 /Root 1 0 R /Prev {prev} >>\nstartxref\n{section}\n%%EOF\n").as_bytes(),
-        );
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert_eq!(doc.xref_oddities(), [(section as u64, 3), (section as u64, 2)]);
-        // What the reader resolves is what it resolved before: the first entry it kept.
-        assert_eq!(doc.xref_entry(3), Some(third));
-        assert_eq!(doc.xref_entry(2), Some(XrefEntry::InFile { offset: 58, generation: 0 }));
-    }
-
-    /// An entry that misses its object still resolves (by searching) but is not exact.
-    #[test]
-    fn an_entry_that_misses_its_object_is_found_by_searching_but_is_not_exact() {
-        let base = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "(three)"], "/Root 1 0 R");
-        let text = String::from_utf8_lossy(&base).into_owned();
-        let at = text.find("3 0 obj").unwrap();
-        let bytes = text.replacen(&format!("{at:010} 00000 n"), &format!("{:010} 00000 n", at + 2), 1).into_bytes();
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert_eq!(doc.get(ObjRef { num: 3, generation: 0 }).as_string().map(|s| s.bytes.clone()), Some(b"three".to_vec()));
-        assert!(!doc.xref_entry_is_exact(3));
-        assert!(doc.xref_entry_is_exact(1) && doc.xref_entry_is_exact(2));
-    }
-
-    /// A classic table with `/Size` rows and object 0's free entry first, its subsection numbered
-    /// `1 n` instead of `0 n` (#2676): every row is one number off.
-    fn misnumbered_table(start: u32) -> Vec<u8> {
-        let bodies = ["<< /Marker (first object) >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Type /Catalog /Pages 2 0 R >>"];
-        let mut out = b"%PDF-1.7
-"
-        .to_vec();
-        let mut offsets = Vec::new();
-        for (i, body) in bodies.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend_from_slice(
-                format!(
-                    "{} 0 obj
-{body}
-endobj
-",
-                    i + 1
-                )
-                .as_bytes(),
-            );
-        }
-        let xref = out.len();
-        out.extend_from_slice(format!("xref\n{start} 4\n0000000000 65535 f \n").as_bytes());
-        for o in offsets {
-            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        out.extend_from_slice(format!("trailer\n<< /Size 4 /Root 3 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
-        out
-    }
-
-    #[test]
-    fn a_table_numbered_from_1_that_begins_with_object_0_is_read_from_0() {
-        let doc = Document::open(Arc::new(misnumbered_table(1))).unwrap();
-        let first = doc.get(ObjRef::new(1, 0)).as_dict().cloned().expect("object 1 is not free");
-        assert!(first.contains(b"Marker"));
-        assert_eq!(doc.root(), Some(ObjRef::new(3, 0)));
-        assert!(doc.repair_log().iter().any(|l| l.contains("numbered from 1")), "{:?}", doc.repair_log());
-        // A correct table reads the same and logs nothing.
-        let fine = Document::open(Arc::new(misnumbered_table(0))).unwrap();
-        assert!(fine.get(ObjRef::new(1, 0)).as_dict().is_some_and(|d| d.contains(b"Marker")));
-        assert!(!fine.repair_log().iter().any(|l| l.contains("numbered from 1")));
-    }
-
-    #[test]
-    fn a_table_that_really_starts_at_1_keeps_its_numbers() {
-        // Object 1 deleted for good (generation 65535) in a subsection that does start at 1: its
-        // second row locates object 2, so nothing is shifted.
-        let mut bytes = b"%PDF-1.7\n".to_vec();
-        let pages = bytes.len();
-        bytes.extend_from_slice(b"2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
-        let catalog = bytes.len();
-        bytes.extend_from_slice(b"3 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n");
-        let xref = bytes.len();
-        bytes.extend_from_slice(
-            format!(
-                "xref\n0 1\n0000000000 65535 f \n1 3\n0000000000 65535 f \n{pages:010} 00000 n \n{catalog:010} 00000 n \ntrailer\n<< /Size 4 /Root 3 0 R >>\nstartxref\n{xref}\n%%EOF\n"
-            )
-            .as_bytes(),
-        );
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert!(doc.get(ObjRef::new(2, 0)).as_dict().is_some_and(|d| d.name(b"Type") == Some(b"Pages")));
-        assert!(doc.get(ObjRef::new(1, 0)).as_dict().is_none(), "object 1 stays free");
-        assert!(!doc.repair_log().iter().any(|l| l.contains("numbered from 1")));
-    }
-
-    /// A one-page scan: the page draws image 5 with content stream 4.
-    fn scanned_page() -> Vec<u8> {
-        build(
-            &[
-                "<< /Type /Catalog /Pages 2 0 R >>",
-                "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
-                "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 10 10] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >>",
-                "<< /Length 21 >>\nstream\n10 0 0 10 0 0 cm /Im0 Do\nendstream",
-                "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 1 >>\nstream\nA\nendstream",
-            ],
-            "/Root 1 0 R",
-        )
-    }
-
-    /// `bytes` with its cross-reference table replaced by `table` (the lines after `xref`).
-    fn with_table(bytes: &[u8], table: &[String], size: usize) -> Vec<u8> {
-        let text = String::from_utf8_lossy(bytes).into_owned();
-        let at = text.rfind("\nxref\n").unwrap() + 1;
-        let mut out = bytes[..at].to_vec();
-        out.extend_from_slice(format!("xref\n{}\ntrailer\n<< /Size {size} /Root 1 0 R >>\nstartxref\n{at}\n%%EOF\n", table.join("\n")).as_bytes());
-        out
-    }
-
-    /// The table's entry lines, object 0 first.
-    fn table_entries(bytes: &[u8]) -> Vec<String> {
-        let text = String::from_utf8_lossy(bytes).into_owned();
-        let at = text.rfind("\nxref\n").unwrap() + 1;
-        text[at..].lines().skip(2).take_while(|l| !l.starts_with("trailer")).map(str::to_string).collect()
-    }
-
-    /// The classic off-by-one: the subsection says it starts at 0 but lists objects 1 to 5, so
-    /// the last object has no entry. Viewers rebuild the table and show the page; a reader that
-    /// took the missing entry for a null object dropped the image when pages were copied (#1628).
-    #[test]
-    fn an_off_by_one_xref_subsection_still_finds_the_last_object() {
-        let base = scanned_page();
-        let entries = table_entries(&base);
-        let mut table = vec!["0 5".to_string()];
-        table.extend(entries[1..6].iter().cloned());
-        let doc = Document::open(Arc::new(with_table(&base, &table, 5))).unwrap();
-        let image = doc.get(ObjRef::new(5, 0));
-        assert_eq!(image.as_dict().and_then(|d| d.name(b"Subtype")), Some(&b"Image"[..]), "{image:?}");
-        assert!(matches!(&*image, Object::Stream(_)));
-        assert!(matches!(&*doc.get(ObjRef::new(4, 0)), Object::Stream(s) if &s.raw[..] == b"10 0 0 10 0 0 cm /Im0 Do"));
-        assert!(doc.repair_log().iter().any(|l| l.contains("object headers")), "{:?}", doc.repair_log());
-    }
-
-    /// An "in use" entry at offset 0 says nothing about where the object is: the object is
-    /// found by its header, and the repair is recorded.
-    #[test]
-    fn an_object_listed_at_offset_zero_is_found_by_its_header() {
-        let base = scanned_page();
-        for num in [4usize, 5] {
-            let mut table = vec!["0 6".to_string()];
-            table.extend(table_entries(&base));
-            table[num + 1] = "0000000000 00000 n ".into();
-            let doc = Document::open(Arc::new(with_table(&base, &table, 6))).unwrap();
-            assert!(matches!(&*doc.get(ObjRef::new(num as u32, 0)), Object::Stream(_)), "object {num}");
-            assert!(doc.repair_log().iter().any(|l| l.contains("object headers")), "object {num}: {:?}", doc.repair_log());
-        }
-    }
-
-    /// A valid table that simply does not list every number below `/Size` is not repaired: an
-    /// unlisted number is a null object (§7.3.10), even when an old body with that number is
-    /// still in the file.
-    #[test]
-    fn a_consistent_table_with_unlisted_numbers_is_taken_as_it_is() {
-        let base = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "(three)"], "/Root 1 0 R");
-        let at = String::from_utf8_lossy(&base).rfind("\nxref\n").unwrap() + 1;
-        let mut bytes = base[..at].to_vec();
-        bytes.extend_from_slice(b"4 0 obj\n(stale)\nendobj\n");
-        let mut table = vec!["0 4".to_string()];
-        table.extend(table_entries(&base));
-        let doc = Document::open(Arc::new(with_table(&[&bytes[..], &base[at..]].concat(), &table, 6))).unwrap();
-        assert!(doc.repair_log().is_empty(), "{:?}", doc.repair_log());
-        assert_eq!(*doc.get(ObjRef::new(4, 0)), Object::Null);
-        assert!(matches!(&*doc.get(ObjRef::new(3, 0)), Object::String(_)));
-    }
-
-    /// Filling the gaps of a damaged table never brings back an object that an incremental
-    /// update freed: its body is still in the file, but the newer section says it is gone.
-    #[test]
-    fn an_object_freed_by_an_update_stays_freed_when_the_table_is_repaired() {
-        let base = scanned_page();
-        // The original table lists the content stream at offset 0, so the gaps get filled.
-        let mut table = vec!["0 6".to_string()];
-        table.extend(table_entries(&base));
-        table[5] = "0000000000 00000 n ".into();
-        let mut bytes = with_table(&base, &table, 6);
-        let prev = String::from_utf8_lossy(&bytes).rfind("\nxref\n").unwrap() + 1;
-        let section = bytes.len();
-        bytes.extend_from_slice(
-            format!("xref\n5 1\n0000000000 00001 f \ntrailer\n<< /Size 6 /Root 1 0 R /Prev {prev} >>\nstartxref\n{section}\n%%EOF\n").as_bytes(),
-        );
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert!(matches!(&*doc.get(ObjRef::new(4, 0)), Object::Stream(_)), "the gap is filled");
-        assert_eq!(*doc.get(ObjRef::new(5, 0)), Object::Null, "the freed image stays freed");
-        assert_eq!(doc.xref_entry(5), Some(XrefEntry::Free { next_generation: 1 }));
-    }
-
-    /// Repairing a damaged table fills only the numbers the damage leaves out: an old body of a
-    /// number no section lists, under an oversized `/Size`, stays a null object.
-    #[test]
-    fn a_repaired_table_leaves_an_unlisted_number_null() {
-        let base = scanned_page();
-        let at = String::from_utf8_lossy(&base).rfind("\nxref\n").unwrap() + 1;
-        let entries = table_entries(&base);
-        let mut offset_zero = vec!["0 6".to_string()];
-        offset_zero.extend(entries.iter().cloned());
-        offset_zero[5] = "0000000000 00000 n ".into();
-        let mut off_by_one = vec!["0 5".to_string()];
-        off_by_one.extend(entries[1..6].iter().cloned());
-        for (name, table, found) in [("offset 0", offset_zero, 4), ("off by one", off_by_one, 5)] {
-            let bytes = [&base[..at], b"7 0 obj\n(stale)\nendobj\n", &base[at..]].concat();
-            let doc = Document::open(Arc::new(with_table(&bytes, &table, 9))).unwrap();
-            assert!(matches!(&*doc.get(ObjRef::new(found, 0)), Object::Stream(_)), "{name}: the gap is filled");
-            assert_eq!(*doc.get(ObjRef::new(7, 0)), Object::Null, "{name}: {:?}", doc.repair_log());
-            assert_eq!(doc.xref_entry(7), None, "{name}");
-        }
-    }
-
-    /// The last object of a subsection numbered one too low is filled from that subsection,
-    /// whatever later happens to the row before it: an incremental save that rewrites object 4,
-    /// or object 4's own row at offset 0.
-    #[test]
-    fn the_last_object_of_a_shifted_subsection_is_filled_whatever_its_neighbour_says() {
-        let base = scanned_page();
-        let entries = table_entries(&base);
-        let mut off_by_one = vec!["0 5".to_string()];
-        off_by_one.extend(entries[1..6].iter().cloned());
-        let shifted = with_table(&base, &off_by_one, 5);
-        let prev = String::from_utf8_lossy(&shifted).rfind("\nxref\n").unwrap() + 1;
-        let mut updated = shifted.clone();
-        let body = updated.len();
-        updated.extend_from_slice(b"4 0 obj\n<< /Length 21 >>\nstream\n10 0 0 10 0 0 cm /Im0 Do\nendstream\nendobj\n");
-        let section = updated.len();
-        updated.extend_from_slice(
-            format!("xref\n4 1\n{body:010} 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R /Prev {prev} >>\nstartxref\n{section}\n%%EOF\n").as_bytes(),
-        );
-        let mut neighbour_at_zero = off_by_one.clone();
-        neighbour_at_zero[5] = "0000000000 00000 n ".into();
-        for (name, bytes) in [("updated", updated), ("row 4 at offset 0", with_table(&base, &neighbour_at_zero, 5))] {
-            let doc = Document::open(Arc::new(bytes)).unwrap();
-            let image = doc.get(ObjRef::new(5, 0));
-            assert_eq!(image.as_dict().and_then(|d| d.name(b"Subtype")), Some(&b"Image"[..]), "{name}: {:?}", doc.repair_log());
-        }
-    }
-
-    /// The image the first page draws as `/Im1`, followed through the page tree.
-    fn first_page_image(doc: &Document) -> Arc<Object> {
-        let catalog = doc.get(doc.root().unwrap());
-        let pages = doc.resolve(catalog.as_dict().unwrap().get(b"Pages").unwrap());
-        let page = doc.resolve(&pages.as_dict().unwrap().get(b"Kids").unwrap().as_array().unwrap()[0]);
-        let resources = doc.resolve(page.as_dict().unwrap().get(b"Resources").unwrap());
-        let xobjects = doc.resolve(resources.as_dict().unwrap().get(b"XObject").unwrap());
-        doc.resolve(xobjects.as_dict().unwrap().get(b"Im1").unwrap())
-    }
-
-    /// The opposite off-by-one (#1628): the subsection says it starts at 1, but its first entry
-    /// is object 0's free-list head, so every entry lands one number too high and object 1, the
-    /// image, reads as free. The offset the table gives object 2 holds `1 0 obj`, so the
-    /// subsection is read from 0, and the image survives a full save.
-    #[test]
-    fn a_subsection_from_one_that_opens_with_the_free_list_head_is_read_from_zero() {
-        let base = build(
-            &[
-                "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length 12 >>\nstream\nABCDEFGHIJKL\nendstream",
-                "<< /Length 29 >>\nstream\nq 72 0 0 72 0 0 cm /Im1 Do Q\nendstream",
-                "<< /Type /Page /Parent 4 0 R /MediaBox [0 0 72 72] /Resources << /XObject << /Im1 1 0 R >> >> /Contents 2 0 R >>",
-                "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
-                "<< /Type /Catalog /Pages 4 0 R >>",
-                "<< /Subject (synthetic) >>",
-            ],
-            "/Root 5 0 R /Info 6 0 R",
-        );
-        // /Size 7 is one short of the shifted numbers; /Size 8 covers them all. Junk before the
-        // header moves every object past the offsets the table gives; it is not a comment, which
-        // the lexer would skip on its way to `1 0 obj` anyway.
-        for (size, junk) in [(7, ""), (8, ""), (7, "Content-Type: application/pdf\n\n")] {
-            let text = String::from_utf8_lossy(&base).replace("\nxref\n0 7\n", "\nxref\n1 7\n").replace("/Size 7 ", &format!("/Size {size} "));
-            let doc = Document::open(Arc::new(format!("{junk}{text}").into_bytes())).unwrap();
-            let image = first_page_image(&doc);
-            assert_eq!(image.as_dict().and_then(|d| d.name(b"Subtype")), Some(&b"Image"[..]), "/Size {size} {junk:?}: {image:?}");
-            assert_eq!(doc.xref_entry(0), Some(XrefEntry::Free { next_generation: 65535 }), "/Size {size} {junk:?}");
-            assert!(doc.repair_log().iter().any(|l| l.contains("from 0")), "/Size {size} {junk:?}: {:?}", doc.repair_log());
-            let saved = Document::open(Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap())).unwrap();
-            let image = first_page_image(&saved);
-            assert!(matches!(&*image, Object::Stream(s) if &s.raw[..] == b"ABCDEFGHIJKL"), "/Size {size} {junk:?}: {image:?}");
-        }
-    }
-
-    /// Object 1 really freed: the subsection from 1 opens with a free entry, but the next entry's
-    /// offset holds object 2, not object 1. The table is taken as it is, and the old body of
-    /// object 1 still in the file stays freed.
-    #[test]
-    fn a_subsection_from_one_whose_next_offset_holds_object_two_is_taken_as_it_is() {
-        let base = build(&["(freed)", "<< /Type /Catalog /Pages 3 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 2 0 R");
-        let entries = table_entries(&base);
-        let mut table = vec!["1 3".to_string(), "0000000000 65535 f ".to_string()];
-        table.extend(entries[2..].iter().cloned());
-        let text = String::from_utf8_lossy(&base).into_owned();
-        let at = text.rfind("\nxref\n").unwrap() + 1;
-        for junk in ["", "Content-Type: application/pdf\n\n"] {
-            let mut bytes = junk.as_bytes().to_vec();
-            bytes.extend_from_slice(&base[..at]);
-            bytes.extend_from_slice(format!("xref\n{}\ntrailer\n<< /Size 4 /Root 2 0 R >>\nstartxref\n{at}\n%%EOF\n", table.join("\n")).as_bytes());
-            let doc = Document::open(Arc::new(bytes)).unwrap();
-            assert_eq!(doc.xref_entry(1), Some(XrefEntry::Free { next_generation: 65535 }), "{junk:?}");
-            assert_eq!(*doc.get(ObjRef::new(1, 0)), Object::Null, "{junk:?}: the freed object stays freed");
-            assert!(matches!(&*doc.get(ObjRef::new(2, 0)), Object::Dict(d) if d.name(b"Type") == Some(&b"Catalog"[..])), "{junk:?}");
-            assert!(!doc.repair_log().iter().any(|l| l.contains("from 0")), "{junk:?}: {:?}", doc.repair_log());
-            assert!(!junk.is_empty() || doc.repair_log().is_empty(), "{:?}", doc.repair_log());
-        }
-    }
-
-    #[test]
-    fn opening_an_exhausted_classic_xref_repairs_and_allocates() {
-        // The extra in-use row need not be loaded to exhaust the next object number.
-        let bytes = b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\nxref\n0 3\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n4294967295 1\n0000000058 00000 n \ntrailer\n<< /Size 3 /Root 1 0 R >>\nstartxref\n110\n%%EOF\n";
-        assert_eq!(bytes.len(), 266);
-        let mut doc = Document::open(Arc::new(bytes.to_vec())).unwrap();
-        assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
-        assert!(doc.repair_log().iter().any(|line| line.contains("exhausted xref")));
-        assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
-    }
-
-    #[test]
-    fn opening_an_exhausted_xref_stream_repairs_and_allocates() {
-        let mut bytes =
-            b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n".to_vec();
-        let offset = bytes.len();
-        bytes.extend_from_slice(b"3 0 obj\n<< /Type /XRef /Size 4 /Root 1 0 R /W [1 4 2] /Index [0 3 4294967295 1] /Length 28 >>\nstream\n");
-        for (kind, position, generation) in [(0_u8, 0_u32, 65535_u16), (1, 9, 0), (1, 58, 0), (1, 58, 0)] {
-            bytes.push(kind);
-            bytes.extend_from_slice(&position.to_be_bytes());
-            bytes.extend_from_slice(&generation.to_be_bytes());
-        }
-        bytes.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{offset}\n%%EOF\n").as_bytes());
-        let mut doc = Document::open(Arc::new(bytes)).unwrap();
-        assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
-        assert!(doc.repair_log().iter().any(|line| line.contains("exhausted xref")));
-        assert_eq!(doc.add(Object::Null), ObjRef::new(4, 0));
-    }
-
-    #[test]
-    fn exhausted_size_and_high_edits_allocate_without_overwriting_objects() {
-        let ordinary = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
-        for size in ["4294967295", "4294967296", "9223372036854775807"] {
-            let bytes = String::from_utf8(ordinary.clone()).unwrap().replace("/Size 3", &format!("/Size {size}"));
-            let mut doc = Document::open(Arc::new(bytes.into_bytes())).unwrap();
-            assert!(doc.repair_log().iter().any(|line| line.contains("exhausted trailer")));
-            assert_eq!(doc.add(Object::Int(42)), ObjRef::new(3, 0));
-            doc.set(ObjRef::new(u32::MAX, 0), Object::Int(99));
-            doc.set(ObjRef::new(u32::MAX - 1, 0), Object::Int(98));
-            assert_eq!(doc.add(Object::Int(43)), ObjRef::new(4, 0));
-            assert_eq!(doc.get(ObjRef::new(3, 0)).as_int(), Some(42));
-            assert_eq!(doc.get(ObjRef::new(u32::MAX, 0)).as_int(), Some(99));
-            assert_eq!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().name(b"Type"), Some(b"Catalog".as_slice()));
-        }
-        let mut doc = Document::new_empty();
-        doc.set(ObjRef::new(u32::MAX - 2, 0), Object::Null);
-        assert_eq!(doc.add(Object::Null), ObjRef::new(u32::MAX - 1, 0));
-        assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
-        assert_eq!(doc.add(Object::Null), ObjRef::new(4, 0));
-    }
-
-    #[test]
-    fn exhausted_xref_controls_preserve_ordinary_ignored_and_repaired_entries() {
-        let ordinary = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
-        for (extra, repaired) in
-            [("", false), ("4294967295 1\n0000000000 00000 n \n", false), ("4294967295 2\n0000000058 00000 n \n0000000058 00000 n \n", true)]
-        {
-            let bytes = String::from_utf8(ordinary.clone()).unwrap().replacen("trailer\n", &format!("{extra}trailer\n"), 1);
-            let mut doc = Document::open(Arc::new(bytes.into_bytes())).unwrap();
-            assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
-            assert_eq!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().name(b"Type"), Some(b"Catalog".as_slice()));
-            assert_eq!(!doc.repair_log().is_empty(), repaired);
-            if repaired {
-                assert!(doc.repair_log().iter().any(|line| line.contains("xref") && line.contains("range")));
-            }
-            assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
-        }
-    }
-
-    #[test]
-    fn invalid_xref_object_ranges_are_reconstructed() {
-        // Original in-memory PDF: an intact catalog followed by a damaged xref section.
-        for stream in [false, true] {
-            for (start, count) in [(i64::MAX, 2), (-1, 2), (4_294_967_296, 1), (4_294_967_295, 2)] {
-                let mut bytes =
-                    b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n".to_vec();
-                let offset = bytes.len();
-                if stream {
-                    bytes.extend_from_slice(
-                        format!("3 0 obj\n<< /Type /XRef /Root 1 0 R /Size 4 /W [1 1 1] /Index [{start} {count}] /Length 6 >>\nstream\n").as_bytes(),
-                    );
-                    bytes.extend_from_slice(&[0, 0, 0, 0, 0, 0]);
-                    bytes.extend_from_slice(b"\nendstream\nendobj\n");
-                } else {
-                    bytes.extend_from_slice(
-                        format!("xref\n{start} {count}\n0000000000 65535 f \n0000000000 65535 f \ntrailer\n<< /Root 1 0 R /Size 3 >>\n").as_bytes(),
-                    );
-                }
-                bytes.extend_from_slice(format!("startxref\n{offset}\n%%EOF\n").as_bytes());
-                let doc = Document::open(Arc::new(bytes)).unwrap();
-                assert!(
-                    doc.repair_log().iter().any(|line| line.contains("xref") && line.contains("range")),
-                    "stream={stream}, start={start}, count={count}: {:?}",
-                    doc.repair_log()
-                );
-                assert_eq!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().name(b"Type"), Some(b"Catalog".as_slice()));
-            }
-        }
-    }
-
-    #[test]
-    fn objects_only_an_unreadable_older_section_locates_are_found_by_scanning() {
-        // The newest section lists the catalog only; its /Prev points past the end of the file,
-        // so the page tree is reachable only by scanning object headers, as readers do (#1656).
-        let mut bytes = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (num, body) in
-            [(1, "<< /Type /Catalog /Pages 2 0 R >>"), (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>"), (3, "<< /Type /Page /Parent 2 0 R >>")]
-        {
-            offsets.push(bytes.len());
-            bytes.extend_from_slice(format!("{num} 0 obj\n{body}\nendobj\n").as_bytes());
-        }
-        let xref = bytes.len();
-        bytes.extend_from_slice(
-            format!(
-                "xref\n0 2\n0000000000 65535 f \n{:010} 00000 n \ntrailer\n<< /Root 1 0 R /Size 4 /Prev 999999 >>\nstartxref\n{xref}\n%%EOF\n",
-                offsets[0]
-            )
-            .as_bytes(),
-        );
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert_eq!(doc.get(ObjRef::new(2, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(b"Pages".as_slice()));
-        assert_eq!(doc.get(ObjRef::new(3, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(b"Page".as_slice()));
-        assert!(doc.repair_log().iter().any(|l| l.contains("999999")), "{:?}", doc.repair_log());
-    }
-
-    #[test]
-    fn self_referential_length_does_not_overflow() {
-        let bytes = build(
-            &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Length 3 0 R >>\nstream\nabc\nendstream"],
-            "/Root 1 0 R",
-        );
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        // Either recovered via the endstream search or reported — but never a stack overflow.
-        let o = doc.get(ObjRef::new(3, 0));
-        if let Object::Stream(s) = o.as_ref() {
-            assert_eq!(&s.raw[..], b"abc");
-        }
-    }
-
-    #[test]
-    fn mutually_referential_lengths_do_not_overflow() {
-        let bytes = build(
-            &[
-                "<< /Type /Catalog /Pages 2 0 R >>",
-                "<< /Type /Pages /Kids [] /Count 0 >>",
-                "<< /Length 4 0 R >>\nstream\nabc\nendstream",
-                "<< /Length 3 0 R >>\nstream\nxyz\nendstream",
-            ],
-            "/Root 1 0 R",
-        );
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        let _ = doc.get(ObjRef::new(3, 0));
-        let _ = doc.get(ObjRef::new(4, 0));
-    }
-
-    #[test]
-    fn reads_classic_revision_and_edits_are_copy_on_write() {
-        let bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert_eq!(doc.revisions().len(), 1);
-        assert!(doc.repair_log().is_empty());
-        let mut edited = doc.clone();
-        edited.update_dict(ObjRef::new(1, 0), |d| d.set(b"Lang".to_vec(), Object::String(crate::PdfString::literal("en")))).unwrap();
-        assert!(edited.is_modified() && !doc.is_modified(), "clone is an independent snapshot");
-        assert!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().get(b"Lang").is_none());
-    }
-
-    #[test]
-    fn object_numbers_merge_source_and_overlay_in_order() {
-        let mut doc = Document::new_empty();
-        doc.overlay.clear();
-        doc.entries = Arc::new(XrefIndex::Materialized(Arc::new(BTreeMap::from([
-            (0, XrefEntry::Free { next_generation: 65535 }),
-            (2, XrefEntry::InFile { offset: 10, generation: 7 }),
-            (4, XrefEntry::Free { next_generation: 9 }),
-            (6, XrefEntry::InStream { stream: 80, index: 1 }),
-            (8, XrefEntry::InFile { offset: 20, generation: 5 }),
-            (10, XrefEntry::InFile { offset: 30, generation: 3 }),
-            (u32::MAX, XrefEntry::InFile { offset: 40, generation: 1 }),
-        ]))));
-        doc.set(ObjRef::new(1, 2), Object::Int(1)); // before the first live source slot
-        doc.set(ObjRef::new(2, 8), Object::Int(2)); // override, without duplication
-        doc.set(ObjRef::new(4, 9), Object::Int(4)); // reuse a source free slot
-        doc.free(ObjRef::new(6, 0)); // remove a compressed source object
-        doc.free(ObjRef::new(7, 2)); // free a number absent from the source
-        doc.free(ObjRef::new(10, 3));
-        doc.set(ObjRef::new(11, 4), Object::Int(11));
-        assert_eq!(doc.object_numbers(), vec![1, 2, 4, 8, 11, u32::MAX]);
-        assert_eq!(doc.generation(2), 8);
-        assert_eq!(doc.generation(4), 9);
-        assert_eq!(doc.generation(6), 1);
-        assert_eq!(doc.generation(8), 5);
-        assert_eq!(doc.generation(10), 4);
-        doc.overlay.clear();
-        assert_eq!(doc.object_numbers(), vec![2, 6, 8, 10, u32::MAX]);
-        doc.entries = Arc::new(XrefIndex::empty());
-        assert!(doc.object_numbers().is_empty());
-        doc.set(ObjRef::new(5, 7), Object::Int(5));
-        assert_eq!(doc.object_numbers(), vec![5]);
-    }
-
-    #[test]
-    fn full_object_scans_preserve_edits_without_retaining_the_scan() {
-        let mut bodies = vec!["<< /Type /Catalog /Pages 2 0 R >>".to_owned(), "<< /Type /Pages /Kids [] /Count 0 >>".to_owned()];
-        bodies.extend((0..400).map(|i| format!("<< /Value {i} >>")));
-        let refs: Vec<_> = bodies.iter().map(String::as_str).collect();
-        let mut doc = Document::open(Arc::new(build(&refs, "/Root 1 0 R"))).unwrap();
-        doc.set(ObjRef::new(3, 0), Object::Int(900));
-        doc.free(ObjRef::new(4, 0));
-        let added = doc.add(Object::Int(901));
-        let cached = doc.cache.lock().unwrap().len();
-        let held: Vec<_> = doc.scan_objects().collect();
-        assert_eq!(held.len(), 402);
-        assert_eq!(doc.cache.lock().unwrap().len(), cached, "scanning must not populate the editor cache");
-        assert!(doc.objstms.lock().unwrap().is_empty());
-        assert!(!held.iter().any(|(r, _)| r.num == 4));
-        assert_eq!(held.iter().find(|(r, _)| r.num == 3).unwrap().1.as_int(), Some(900));
-        assert_eq!(held.iter().find(|(r, _)| *r == added).unwrap().1.as_int(), Some(901));
-        assert_eq!(held.iter().find(|(r, _)| r.num == 400).unwrap().1.as_dict().unwrap().int(b"Value"), Some(397));
-        // Previously returned objects survive cache eviction and dropping the source.
-        drop(doc);
-        assert_eq!(held.iter().find(|(r, _)| r.num == 128).unwrap().1.as_dict().unwrap().int(b"Value"), Some(125));
-    }
-
-    #[test]
-    fn temporary_reader_keeps_file_views_and_evicts_data_of_its_own() {
-        // A stream read from the file is a view into the input: caching it costs no copy, so
-        // even a large one stays cached (its /Length object too) instead of being re-parsed.
-        let body = "x".repeat(ObjectReader::STREAM_BYTES + 1);
-        let stream = format!("<< /Length 4 0 R >>\nstream\n{body}\nendstream");
-        let length = body.len().to_string();
-        let bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", &stream, &length], "/Root 1 0 R");
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        let mut reader = doc.object_reader();
-        let read = reader.get(ObjRef::new(3, 0));
-        let Object::Stream(s) = &*read else { panic!("stream") };
-        assert!(s.raw.shares(&reader.document.data), "no copy of the file's bytes");
-        assert!(reader.document.cache.lock().unwrap().contains_key(&3), "a view costs nothing to keep");
-        // Data of its own (decrypted streams, strings) counts: past the budget the cache is
-        // cleared after the next read, including a failed one.
-        let owned = Object::Stream(crate::Stream::from_raw(Dict::new(), vec![b'y'; ObjectReader::STREAM_BYTES + 1]));
-        reader.document.cache.lock().unwrap().insert(3, Arc::new(owned));
-        assert_eq!(*reader.get(ObjRef::new(99, 0)), Object::Null);
-        assert!(reader.document.cache.lock().unwrap().is_empty(), "owned data over budget is evicted");
-    }
-
-    #[test]
-    fn temporary_reader_and_full_save_do_not_fill_snapshot_caches() {
-        let mut source = Document::new_empty();
-        let objects: Vec<_> = (0..260)
-            .map(|i| {
-                let mut value = vec![b'x'; 48 * 1024];
-                value[..4].copy_from_slice(&(i as u32).to_le_bytes());
-                Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
-            })
-            .collect();
-        source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
-        let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
-        let doc = Document::open(bytes).unwrap();
-        let root = doc.get(doc.root().unwrap());
-        let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap();
-        let snapshot = doc.clone();
-        let cached = doc.cache.lock().unwrap().len();
-        let streams = doc.objstms.lock().unwrap().len();
-        let mut reader = doc.object_reader();
-        let mut held = None;
-        for (i, reference) in references.iter().enumerate() {
-            let Object::Ref(reference) = reference else { panic!("indirect object") };
-            let object = reader.get(*reference);
-            assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
-            if i == 0 {
-                held = Some(object);
-            }
-            assert!(reader.document.cache.lock().unwrap().len() < ObjectReader::OBJECTS);
-            let decoded = reader.document.objstms.lock().unwrap();
-            assert!(decoded.len() < ObjectReader::OBJECTS);
-            let bytes: usize = decoded.values().map(|s| s.data.capacity() + s.index.capacity() * std::mem::size_of::<Option<(u32, usize)>>()).sum();
-            assert!(bytes <= ObjectReader::STREAM_BYTES || decoded.len() == 1, "only one oversized stream may remain");
-        }
-        drop(reader);
-        assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes(), "owned results survive evictions");
-        for object_streams in [false, true] {
-            let saved = crate::write_full(&doc, &crate::SaveOptions { object_streams, ..Default::default() }).unwrap();
-            assert!(Document::open(Arc::new(saved)).unwrap().repair_log().is_empty());
-            assert_eq!(doc.cache.lock().unwrap().len(), cached, "full saves must not fill the editor cache");
-            assert_eq!(doc.objstms.lock().unwrap().len(), streams);
-            assert!(Arc::ptr_eq(&doc.cache, &snapshot.cache), "do not detach or clear caller snapshots");
-        }
-    }
-
-    #[test]
-    fn streams_without_length_share_one_endstream_search() {
-        let n = 2_000;
-        let mut file = b"%PDF-1.7\n".to_vec();
-        for k in 1..=n {
-            file.extend_from_slice(format!("{k} 0 obj\n<< >>\nstream\nxx\n").as_bytes());
-        }
-        file.extend_from_slice(b"endstream\nendobj\n");
-        file.extend_from_slice(
-            format!(
-                "{0} 0 obj\n<< /Type /Catalog /Pages {1} 0 R >>\nendobj\n{1} 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n",
-                n + 1,
-                n + 2
-            )
-            .as_bytes(),
-        );
-        file.extend_from_slice(format!("trailer\n<< /Root {} 0 R /Size {} >>\n%%EOF\n", n + 1, n + 3).as_bytes());
-        let len = file.len();
-        crate::parser::ENDSTREAM_SCAN.with(|c| c.set(0));
-        let doc = Document::open(Arc::new(file)).unwrap();
-        for k in [1, n / 2, n] {
-            assert!(matches!(doc.try_get(k).as_deref(), Ok(Object::Stream(_))), "object {k}");
-        }
-        let scanned = crate::parser::ENDSTREAM_SCAN.with(|c| c.get());
-        assert!(scanned <= 4 * len, "{scanned} bytes searched in a {len}-byte file");
-    }
-
-    #[test]
-    fn editor_cache_counts_deeply_nested_strings() {
-        let mut nested = Object::String(crate::PdfString::literal(vec![b'x'; 1 << 20]));
-        for _ in 0..8 {
-            nested = Object::Array(vec![nested]);
-        }
-        let mut source = Document::new_empty();
-        let objects: Vec<_> = (0..48).map(|_| Object::Ref(source.add(nested.clone()))).collect();
-        source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
-        let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
-        let doc = Document::open(bytes).unwrap();
-        assert_eq!(owned_bytes(&nested, &doc.data, 0), 1 << 20);
-        let root = doc.get(doc.root().unwrap());
-        for reference in root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap() {
-            let Object::Ref(reference) = reference else { panic!("indirect object") };
-            drop(doc.get(*reference));
-            let cache = doc.cache.lock().unwrap();
-            let owned = cache.values().fold(0usize, |n, o| n.saturating_add(owned_bytes(o, &doc.data, 0)));
-            let strings = cache.values().filter(|o| o.as_array().is_some()).count();
-            assert!(strings << 20 <= Document::EDITOR_CACHE_BYTES + (1 << 20), "{strings} MiB strings cached, {owned} bytes counted");
-        }
-    }
-
-    #[test]
-    fn editor_cache_stays_bounded() {
-        let mut source = Document::new_empty();
-        let objects: Vec<_> = (0..(Document::EDITOR_CACHE_OBJECTS + 64))
-            .map(|i| {
-                let mut value = vec![b'x'; 1024];
-                value[..4].copy_from_slice(&(i as u32).to_le_bytes());
-                Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
-            })
-            .collect();
-        source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
-        let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
-        let doc = Document::open(bytes).unwrap();
-        let root = doc.get(doc.root().unwrap());
-        let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap().clone();
-        let mut held = None;
-        for (i, reference) in references.iter().enumerate() {
-            let Object::Ref(reference) = reference else { panic!("indirect object") };
-            let object = doc.get(*reference);
-            assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
-            if i == 0 {
-                held = Some(object);
-            }
-            assert!(doc.cache.lock().unwrap().len() <= Document::EDITOR_CACHE_OBJECTS, "editing must not pin the whole object graph");
-            // Eviction keeps the newcomer.
-            assert!(doc.cache.lock().unwrap().contains_key(&reference.num), "eviction must keep the newcomer");
-        }
-        // Returned objects survive eviction, through both handles of the shared cache.
-        assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
-        let snapshot = doc.clone();
-        let first = references[0].as_ref().unwrap();
-        assert_eq!(&snapshot.get(first).as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
-    }
-
-    #[test]
-    fn editor_cache_byte_bound_fires() {
-        // 40 × 1 MB strings: far below the count cap, above the 32 MB byte budget. Each
-        // newcomer exceeds EDITOR_LARGE_OBJECT, so every insert takes a full accounting pass.
-        let mut source = Document::new_empty();
-        let objects: Vec<_> = (0..40)
-            .map(|i| {
-                let mut value = vec![b'y'; 1024 * 1024];
-                value[..4].copy_from_slice(&(i as u32).to_le_bytes());
-                Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
-            })
-            .collect();
-        source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
-        let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
-        let doc = Document::open(bytes).unwrap();
-        let root = doc.get(doc.root().unwrap());
-        let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap().clone();
-        let mut held = None;
-        for (i, reference) in references.iter().enumerate() {
-            let Object::Ref(reference) = reference else { panic!("indirect object") };
-            let object = doc.get(*reference);
-            assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
-            if i == 0 {
-                held = Some(object);
-            }
-            // Eviction keeps the newcomer.
-            assert!(doc.cache.lock().unwrap().contains_key(&reference.num), "eviction must keep the newcomer");
-        }
-        assert!(doc.cache.lock().unwrap().len() < references.len(), "the byte budget must evict even below the count cap");
-        let last = references[references.len() - 1].as_ref().unwrap();
-        assert!(doc.cache.lock().unwrap().contains_key(&last.num), "eviction must keep the newcomer");
-        assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
-    }
-
-    #[test]
-    fn a_stream_limited_document_cannot_be_saved() {
-        let bytes = Arc::new(crate::write_full(&Document::new_empty(), &crate::SaveOptions::default()).unwrap());
-        let doc = Document::open_with_stream_limit(bytes.clone(), None, 1 << 20).unwrap();
-        for saved in [crate::write_full(&doc, &crate::SaveOptions::default()), crate::write_incremental(&doc, &crate::SaveOptions::default())] {
-            assert!(matches!(saved, Err(CosError::ReadOnlyLimit)), "{saved:?}");
-        }
-        let doc = Document::open(bytes).unwrap();
-        assert!(crate::write_full(&doc, &crate::SaveOptions::default()).is_ok());
-    }
-
-    #[test]
-    fn inspection_stream_limit_applies_before_loading_compressed_objects() {
-        let mut doc = Document::new_empty();
-        let large = doc.add(Object::String(crate::PdfString::literal(vec![b'x'; 4096])));
-        doc.update_dict(doc.root().unwrap(), |catalog| catalog.set(b"Extension".to_vec(), Object::Ref(large))).unwrap();
-        let bytes = Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap());
-        assert!(Document::open(bytes.clone()).is_ok());
-        assert!(Document::open_with_stream_limit(bytes, None, 512).is_err());
-    }
-
-    /// A /Prev chain that loops back on itself stops at the loop (and says so).
-    #[test]
-    fn looping_revision_chains_stop() {
-        let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
-        // An update whose /Prev points at itself.
-        let at = bytes.len();
-        bytes.extend_from_slice(
-            format!("xref\n0 1\n0000000000 65535 f \ntrailer << /Size 3 /Root 1 0 R /Prev {at} >>\nstartxref\n{at}\n%%EOF\n").as_bytes(),
-        );
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
-        assert!(doc.repair_log().iter().any(|l| l.contains("loops")), "{:?}", doc.repair_log());
-    }
-
-    /// A hybrid-reference file: the classic table leaves object 3 out; the `/XRefStm` stream
-    /// says it lives in object stream 4.
-    #[test]
-    fn hybrid_reference_files_read_the_xref_stream_too() {
-        let doc = Document::open(Arc::new(object_stream_file("3 0 ", "<< /Hidden (yes) >>", 0))).unwrap();
-        assert!(doc.repair_log().is_empty(), "{:?}", doc.repair_log());
-        assert_compact_matches_materialized(&doc);
-        assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
-    }
-
-    /// A hybrid-reference file whose classic table leaves object 3 out, and whose `/XRefStm`
-    /// stream puts it at position `member` of object stream 4, which holds `header` (the number
-    /// and offset pairs) and then `members`.
-    fn object_stream_file(header: &str, members: &str, member: u8) -> Vec<u8> {
-        let mut out = b"%PDF-1.5\n".to_vec();
-        let mut offs = [0usize; 6];
-        let mut obj = |out: &mut Vec<u8>, n: usize, body: &[u8]| {
-            offs[n] = out.len();
-            out.extend_from_slice(format!("{n} 0 obj\n").as_bytes());
-            out.extend_from_slice(body);
-            out.extend_from_slice(b"\nendobj\n");
-        };
-        obj(&mut out, 1, b"<< /Type /Catalog /Pages 2 0 R >>");
-        obj(&mut out, 2, b"<< /Type /Pages /Kids [] /Count 0 /Extra 3 0 R >>");
-        let count = header.split_whitespace().count() / 2;
-        let inner = format!("{header}{members}");
-        let mut stm = format!("<< /Type /ObjStm /N {count} /First {} /Length {} >>\nstream\n", header.len(), inner.len()).into_bytes();
-        stm.extend_from_slice(inner.as_bytes());
-        stm.extend_from_slice(b"\nendstream");
-        obj(&mut out, 4, &stm);
-        let data = [2u8, 0, 4, member];
-        let mut xs = format!("<< /Type /XRef /Size 6 /W [1 2 1] /Index [3 1] /Length {} >>\nstream\n", data.len()).into_bytes();
-        xs.extend_from_slice(&data);
-        xs.extend_from_slice(b"\nendstream");
-        obj(&mut out, 5, &xs);
-        let table = out.len();
-        out.extend_from_slice(b"xref\n0 6\n0000000000 65535 f \n");
-        for (n, off) in offs.iter().enumerate().skip(1) {
-            let line = if n == 3 { "0000000000 65535 f \n".to_string() } else { format!("{off:010} 00000 n \n") };
-            out.extend_from_slice(line.as_bytes());
-        }
-        out.extend_from_slice(format!("trailer << /Size 6 /Root 1 0 R /XRefStm {} >>\nstartxref\n{table}\n%%EOF\n", offs[5]).as_bytes());
-        out
-    }
-
-    /// Many revisions naming one hybrid /XRefStm read it once.
-    #[test]
-    fn a_hybrid_stream_named_by_many_revisions_is_read_once() {
-        let mut out = object_stream_file("3 0 ", "<< /Hidden (yes) >>", 0);
-        let stream = find(&out, b"5 0 obj", 0, out.len()).unwrap();
-        let mut prev = rfind(&out, b"\nxref\n", 0).unwrap() + 1;
-        let revisions = 200;
-        for _ in 0..revisions {
-            let at = out.len();
-            out.extend_from_slice(
-                format!("xref\ntrailer << /Size 6 /Root 1 0 R /XRefStm {stream} /Prev {prev} >>\nstartxref\n{at}\n%%EOF\n").as_bytes(),
-            );
-            prev = at;
-        }
-        let doc = Document::open(Arc::new(out)).unwrap();
-        SECTION_READS.with(|c| c.set(0));
-        let (entries, ..) = doc.read_xref_chain_materialized(&mut Vec::new()).unwrap();
-        let reads = SECTION_READS.with(|c| c.get());
-        assert!(reads <= revisions + 2, "{reads} sections read for {} revisions", revisions + 1);
-        assert!(matches!(entries.get(&3), Some(XrefEntry::InStream { stream: 4, .. })), "{:?}", entries.get(&3));
-        assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
-        assert_compact_matches_materialized(&doc);
-    }
-
-    /// An older section that names an /XRefStm a newer section already read still has its own
-    /// table compared with that stream, so an entry it sets aside is recorded for it.
-    #[test]
-    fn a_repeated_hybrid_stream_records_each_sections_conflicts() {
-        let mut out = object_stream_file("3 0 ", "<< /Hidden (yes) >>", 0);
-        let stream = find(&out, b"5 0 obj", 0, out.len()).unwrap();
-        let catalog = find(&out, b"1 0 obj", 0, out.len()).unwrap();
-        let base = rfind(&out, b"\nxref\n", 0).unwrap() + 1;
-        // This section's table places object 3 at the catalog; the stream puts it in object stream 4.
-        let older = out.len();
-        out.extend_from_slice(
-            format!(
-                "xref\n3 1\n{catalog:010} 00000 n \ntrailer << /Size 6 /Root 1 0 R /XRefStm {stream} /Prev {base} >>\nstartxref\n{older}\n%%EOF\n"
-            )
-            .as_bytes(),
-        );
-        let newer = out.len();
-        out.extend_from_slice(
-            format!("xref\ntrailer << /Size 6 /Root 1 0 R /XRefStm {stream} /Prev {older} >>\nstartxref\n{newer}\n%%EOF\n").as_bytes(),
-        );
-        let doc = Document::open(Arc::new(out)).unwrap();
-        assert_eq!(doc.xref_oddities(), [(older as u64, 3)]);
-        assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
-    }
-
-    fn text_of(doc: &Document, num: u32, key: &[u8]) -> Option<String> {
-        doc.get(ObjRef::new(num, 0)).as_dict().and_then(|d| d.get(key).and_then(|v| v.as_string().map(|s| s.to_text())))
-    }
-
-    /// An object stream member numbered 2^32 + 3 is not object 3 (#1815): the number used to be
-    /// cast to `u32`, which dropped the high bits.
-    #[test]
-    fn object_stream_numbers_beyond_u32_are_not_truncated() {
-        let control = Document::open(Arc::new(object_stream_file("3 0 ", "<< /Member (yes) >>", 0))).unwrap();
-        assert_eq!(text_of(&control, 3, b"Member").as_deref(), Some("yes"));
-        let doc = Document::open(Arc::new(object_stream_file("4294967299 0 ", "<< /Member (yes) >>", 0))).unwrap();
-        assert!(matches!(*doc.get(ObjRef::new(3, 0)), Object::Null), "{:?}", doc.get(ObjRef::new(3, 0)));
-        assert!(!doc.xref_entry_is_exact(3));
-    }
-
-    /// Member starts are checked rather than cast, so they cannot wrap on any target (#1815).
-    #[test]
-    fn object_stream_member_starts_are_checked() {
-        assert_eq!(objstm_member(3, 4, Some(10), 20), Some((3, 14)));
-        assert_eq!(objstm_member(3, 9, Some(10), 20), Some((3, 19)), "the last byte");
-        assert_eq!(objstm_member(3, 10, Some(10), 20), None, "at the end of the data");
-        assert_eq!(objstm_member(3, 1, Some(usize::MAX), 20), None, "/First plus the offset overflows");
-        assert_eq!(objstm_member(3, i64::MAX, Some(10), 20), None);
-        assert_eq!(objstm_member(3, -1, Some(10), 20), None);
-        assert_eq!(objstm_member(3, 0, None, 20), None, "/First does not fit in usize");
-        assert_eq!(objstm_member(i64::from(u32::MAX), 0, Some(0), 1), Some((u32::MAX, 0)));
-        assert_eq!(objstm_member(i64::from(u32::MAX) + 1, 0, Some(0), 1), None);
-        assert_eq!(objstm_member(-1, 0, Some(0), 1), None);
-    }
-
-    /// A member at a negative offset is unusable, not the stream's first member (#1815): the
-    /// offset used to be clamped to zero, which read the object at `/First`.
-    #[test]
-    fn object_stream_negative_offsets_are_refused() {
-        let doc = Document::open(Arc::new(object_stream_file("7 0 3 -1 ", "<< /First (yes) >>", 1))).unwrap();
-        assert!(matches!(*doc.get(ObjRef::new(3, 0)), Object::Null), "{:?}", doc.get(ObjRef::new(3, 0)));
-        let control = Document::open(Arc::new(object_stream_file("7 0 3 19 ", "<< /First (yes) >> << /Second (yes) >>", 1))).unwrap();
-        assert_eq!(text_of(&control, 3, b"Second").as_deref(), Some("yes"));
-    }
-
-    #[test]
-    fn revision_ends_split_incremental_updates() {
-        let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
-        let first = bytes.len();
-        let doc = Document::open(Arc::new(bytes.clone())).unwrap();
-        assert_eq!(doc.revision_ends(), vec![first]);
-        let mut edited = doc.clone();
-        edited.update_dict(ObjRef::new(1, 0), |d| d.set(b"Lang".to_vec(), Object::String(crate::PdfString::literal("en")))).unwrap();
-        bytes = crate::write_incremental(&edited, &crate::SaveOptions::default()).unwrap();
-        let doc = Document::open(Arc::new(bytes.clone())).unwrap();
-        let ends = doc.revision_ends();
-        assert_eq!(ends.len(), 2, "{ends:?}");
-        assert!(ends[0] >= first && ends[0] < bytes.len() && ends[1] == bytes.len(), "{ends:?} of {}", bytes.len());
-        // The first revision opens on its own, without the update.
-        let old = Document::open(Arc::new(bytes[..ends[0]].to_vec())).unwrap();
-        assert!(old.get(ObjRef::new(1, 0)).as_dict().unwrap().get(b"Lang").is_none());
-    }
-
-    /// qpdf's `xref-compressed-in-compressed.pdf` in miniature: object 3 is an object stream
-    /// holding object 4, and the cross-reference stream says object 3 itself lives in stream 99.
-    fn compressed_in_compressed_fixture() -> Document {
-        let mut out = b"%PDF-1.5\n".to_vec();
-        let at = |out: &mut Vec<u8>, num: u32, body: &str| {
-            let off = out.len();
-            out.extend_from_slice(format!("{num} 0 obj\n{body}\nendobj\n").as_bytes());
-            off as u16
-        };
-        let o1 = at(&mut out, 1, "<< /Type /Catalog /Pages 2 0 R /Outlines 4 0 R >>");
-        let o2 = at(&mut out, 2, "<< /Type /Pages /Kids [] /Count 0 >>");
-        let inner = "<< /Type /Outlines /Count 0 >>";
-        at(&mut out, 3, &format!("<< /Type /ObjStm /N 1 /First 4 /Length {} >>\nstream\n4 0 {inner}\nendstream", 4 + inner.len()));
-        // /W [1 2 1]: object 3 is said to live in stream 99 (which does not exist), 4 in stream 3.
-        let rows: Vec<[u8; 4]> = vec![
-            [0, 0, 0, 255],
-            [1, 0, o1 as u8, 0],
-            [1, 0, o2 as u8, 0],
-            [2, 0, 99, 0],
-            [2, 0, 3, 0],
-            [1, (out.len() >> 8) as u8, out.len() as u8, 0],
-        ];
-        let rows: Vec<u8> = rows.concat();
-        let xref = out.len();
-        out.extend_from_slice(
-            format!("5 0 obj\n<< /Type /XRef /W [1 2 1] /Index [0 6] /Size 6 /Root 1 0 R /Length {} >>\nstream\n", rows.len()).as_bytes(),
-        );
-        out.extend_from_slice(&rows);
-        out.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref}\n%%EOF\n").as_bytes());
-        Document::open(Arc::new(out)).unwrap()
-    }
-
-    /// An object stream whose own cross-reference entry says it is compressed inside another
-    /// stream (which the format forbids, and which does not exist here: qpdf's
-    /// `xref-compressed-in-compressed.pdf`, #2367) could not be loaded, so every object in it
-    /// read as null and a full save wrote `/Outlines null`. The stream is now found by its own
-    /// header, as a plain object with a wrong offset is.
-    #[test]
-    fn an_object_stream_marked_as_compressed_is_found_by_its_header() {
-        let doc = compressed_in_compressed_fixture();
-        assert_eq!(doc.revisions().len(), 1, "the chain itself reads: {:?}", doc.repair_log());
-        let outlines = doc.get(ObjRef::new(4, 0));
-        assert_eq!(outlines.as_dict().and_then(|d| d.name(b"Type")), Some(&b"Outlines"[..]), "{outlines:?}");
-        let saved = crate::write_full(&doc, &crate::SaveOptions::default()).unwrap();
-        let back = Document::open(Arc::new(saved)).unwrap();
-        let catalog = back.get(back.root().unwrap());
-        let outlines = back.resolve(catalog.as_dict().unwrap().get(b"Outlines").unwrap());
-        assert_eq!(outlines.as_dict().and_then(|d| d.name(b"Type")), Some(&b"Outlines"[..]), "the full save keeps it: {outlines:?}");
-    }
-
-    /// The header fallback is for file entries only: once the stream is freed (or replaced) in
-    /// the overlay, its objects must not come back from the file's copy of it.
-    #[test]
-    fn a_freed_object_stream_is_not_found_by_its_header() {
-        let doc = compressed_in_compressed_fixture();
-        assert!(doc.get(ObjRef::new(4, 0)).as_dict().is_some());
-        let mut edited = doc.clone();
-        edited.free(ObjRef::new(3, 0));
-        let fresh = edited.object_reader().document;
-        assert!(matches!(*fresh.get(ObjRef::new(4, 0)), Object::Null), "{:?}", fresh.get(ObjRef::new(4, 0)));
-        let mut replaced = doc.clone();
-        replaced.set(ObjRef::new(3, 0), Object::Int(0));
-        let fresh = replaced.object_reader().document;
-        assert!(matches!(*fresh.get(ObjRef::new(4, 0)), Object::Null), "{:?}", fresh.get(ObjRef::new(4, 0)));
-    }
-
-    /// The same once the free is saved: the revision's table says the stream is free, and
-    /// neither reading the file back nor rewriting it in full brings its objects back.
-    #[test]
-    fn a_container_freed_in_a_saved_revision_is_not_found_by_its_header() {
-        let mut edited = compressed_in_compressed_fixture();
-        edited.free(ObjRef::new(3, 0));
-        let incremental = crate::write_incremental(&edited, &crate::SaveOptions::default()).unwrap();
-        let reopened = Document::open(Arc::new(incremental)).unwrap();
-        assert_eq!(reopened.revisions().len(), 2);
-        assert!(matches!(reopened.xref_entry(3), Some(XrefEntry::Free { .. })));
-        assert!(matches!(*reopened.get(ObjRef::new(4, 0)), Object::Null), "{:?}", reopened.get(ObjRef::new(4, 0)));
-        for object_streams in [true, false] {
-            let opts = crate::SaveOptions { object_streams, ..Default::default() };
-            let full = crate::write_full(&reopened, &opts).unwrap();
-            let back = Document::open(Arc::new(full)).unwrap();
-            let catalog = back.get(back.root().unwrap());
-            let outlines = catalog.as_dict().unwrap().get(b"Outlines").map(|o| back.resolve(o));
-            assert!(outlines.as_ref().is_none_or(|o| matches!(**o, Object::Null)), "the full save keeps it out: {outlines:?}");
-        }
-    }
-
-    /// A trailer whose /Prev is written as the reference `N 0 R` (tiff2pdf did this; the files
-    /// are JHOVE's PDF-HUL-157 cases, #2366) used to end the cross-reference chain silently, so
-    /// every object of the earlier sections read as null: a four-page file showed one page, and
-    /// a full save wrote the three missing kids as null. The offset is read from the reference.
-    #[test]
-    fn a_prev_written_as_a_reference_still_reaches_the_earlier_sections() {
-        let base = build(
-            &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 >>", "<< /Type /Page /Parent 2 0 R >>"],
-            "/Root 1 0 R",
-        );
-        let prev = String::from_utf8_lossy(&base).rfind("xref\n0 4").unwrap();
-        let update = |prev_entry: &str| {
-            let mut bytes = base.clone();
-            let at = bytes.len();
-            bytes.extend_from_slice(b"4 0 obj\n<< /Title (Update) >>\nendobj\n");
-            let xref = bytes.len();
-            bytes.extend_from_slice(
-                format!(
-                    "xref\n4 1\n{at:010} 00000 n \ntrailer\n<< /Size 5 /Root 1 0 R /Info 4 0 R /Prev {prev_entry} >>\nstartxref\n{xref}\n%%EOF\n"
-                )
-                .as_bytes(),
-            );
-            Document::open(Arc::new(bytes)).unwrap()
-        };
-        let good = update(&prev.to_string());
-        let bad = update(&format!("{prev} 0 R"));
-        assert!(good.repair_log().is_empty(), "{:?}", good.repair_log());
-        assert_eq!(bad.revisions().len(), 2, "{:?}", bad.repair_log());
-        assert_eq!(bad.repair_log().len(), 1, "a note about the /Prev: {:?}", bad.repair_log());
-        assert_eq!(bad.xref_entry(3), good.xref_entry(3), "the page of the first section is reached");
-        assert_eq!(bad.get(ObjRef::new(3, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(&b"Page"[..]));
-        assert_eq!(
-            bad.get(ObjRef::new(4, 0)).as_dict().and_then(|d| d.get(b"Title").and_then(|t| t.as_string().map(|s| s.to_text()))),
-            Some("Update".into())
-        );
-    }
-
-    /// iText's `indirectPrev.pdf` in miniature: the update's trailer gives `/Prev 4 0 R`, and
-    /// object 4, listed in that update, holds the offset of the first section. Read as offset 4
-    /// (inside the header), the chain broke and the file was rebuilt without its revisions.
-    #[test]
-    fn a_prev_reference_to_an_object_holding_the_offset_reads_that_offset() {
-        let mut bytes = build(
-            &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 >>", "<< /Type /Page /Parent 2 0 R >>"],
-            "/Root 1 0 R",
-        );
-        let prev = String::from_utf8_lossy(&bytes).rfind("xref\n0 4").unwrap();
-        let mut at = Vec::new();
-        for (num, body) in
-            [(2, "<< /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 >>".to_string()), (4, prev.to_string()), (5, "<< /Type /Page /Parent 2 0 R >>".into())]
-        {
-            at.push(bytes.len());
-            bytes.extend_from_slice(format!("{num} 0 obj\n{body}\nendobj\n").as_bytes());
-        }
-        let xref = bytes.len();
-        bytes.extend_from_slice(
-            format!(
-                "xref\n2 1\n{:010} 00000 n \n4 2\n{:010} 00000 n \n{:010} 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R /Prev 4 0 R >>\nstartxref\n{xref}\n%%EOF\n",
-                at[0], at[1], at[2]
-            )
-            .as_bytes(),
-        );
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert_eq!(doc.revisions().len(), 2, "{:?}", doc.repair_log());
-        assert_eq!(doc.repair_log().len(), 1, "a note about the /Prev, and no rebuild: {:?}", doc.repair_log());
-        assert!(doc.repair_log()[0].contains(&format!("the offset {prev}")), "{:?}", doc.repair_log());
-        assert_eq!(doc.get(ObjRef::new(3, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(&b"Page"[..]));
-        assert_compact_matches_materialized(&doc);
-    }
-
-    /// A file whose only trailers are cross-reference stream dictionaries, with its `startxref`
-    /// out of reach (here a second file appended after it, cut off before its own
-    /// cross-reference data, as in #2365), is rebuilt from its object headers. The rebuild used
-    /// to look only for the `trailer` keyword, so /Info and /ID were lost, and a full save after
-    /// editing one Info field dropped every other.
-    #[test]
-    fn reconstruction_takes_the_trailer_from_a_cross_reference_stream() {
-        let table = build(
-            &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Title (Kept) /Creator (Me) >>"],
-            "/Root 1 0 R /Info 3 0 R",
-        );
-        let packed = crate::write_full(&Document::open(Arc::new(table)).unwrap(), &crate::SaveOptions::default()).unwrap();
-        let text = String::from_utf8_lossy(&packed);
-        assert!(text.contains("/XRef") && !text.contains("trailer"), "a cross-reference stream is the only trailer");
-        let mut bytes = packed.clone();
-        let appended = format!("%PDF-1.3\n90 0 obj\n<< /Length 5000 >>\nstream\n{}\nendstream\nendobj\n", "x".repeat(5000));
-        bytes.extend_from_slice(appended.as_bytes());
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert!(doc.revisions().is_empty(), "rebuilt: {:?}", doc.repair_log());
-        let info = doc.trailer().reference(b"Info").expect("the cross-reference stream's /Info");
-        let field = |d: &Document, key: &[u8]| d.get(info).as_dict().unwrap().get(key).unwrap().as_string().unwrap().bytes.clone();
-        assert_eq!(field(&doc, b"Title"), b"Kept");
-        assert!(doc.trailer().get(b"ID").is_some(), "and its /ID");
-        let mut edited = doc.clone();
-        edited.update_dict(info, |d| d.set(b"Subject".to_vec(), Object::String(crate::PdfString::literal("new")))).unwrap();
-        let saved = crate::write_full(&edited, &crate::SaveOptions::default()).unwrap();
-        let back = Document::open(Arc::new(saved)).unwrap();
-        assert!(back.repair_log().is_empty(), "{:?}", back.repair_log());
-        let info = back.trailer().reference(b"Info").expect("the full save keeps /Info");
-        let field = |key: &[u8]| back.get(info).as_dict().unwrap().get(key).unwrap().as_string().unwrap().bytes.clone();
-        assert_eq!((field(b"Title"), field(b"Creator"), field(b"Subject")), (b"Kept".to_vec(), b"Me".to_vec(), b"new".to_vec()));
-    }
-
-    /// A rebuild prefers a trailer whose /Root is the catalog (as `root_is_catalog` judges it): a
-    /// later cross-reference stream whose /Root points at the Info dictionary does not replace an
-    /// earlier good trailer, or a full save would write the Info dictionary as /Root.
-    #[test]
-    fn reconstruction_skips_a_trailer_whose_root_is_not_the_catalog() {
-        let mut bytes =
-            build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Title (Kept) >>"], "/Root 1 0 R /Info 3 0 R");
-        bytes.extend_from_slice(b"4 0 obj\n<< /Type /XRef /Size 5 /W [1 1 1] /Root 3 0 R /Length 3 >>\nstream\nabc\nendstream\nendobj\n");
-        let appended = format!("%PDF-1.3\n90 0 obj\n<< /Length 5000 >>\nstream\n{}\nendstream\nendobj\n", "x".repeat(5000));
-        bytes.extend_from_slice(appended.as_bytes());
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert!(doc.repair_log().iter().any(|l| l.contains("rebuilt")), "{:?}", doc.repair_log());
-        assert_eq!(doc.trailer().reference(b"Root").map(|r| r.num), Some(1), "the catalog, not the Info dictionary");
-        assert_eq!(doc.trailer().reference(b"Info").map(|r| r.num), Some(3));
-    }
-
-    #[test]
-    fn damaged_xref_is_reconstructed() {
-        let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
-        let n = bytes.len();
-        bytes[n - 12..n - 6].copy_from_slice(b"999999"); // point startxref into nowhere
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert!(doc.revisions().is_empty());
-        assert!(!doc.repair_log().is_empty());
-        assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
-    }
-
-    #[test]
-    fn a_decompression_bomb_in_an_xref_stream_is_refused_and_the_file_reconstructed() {
-        // 32 MiB of rows behind two FlateDecode filters (a few hundred bytes in the file) for
-        // /W [1 1 1]: at 3 bytes a row that is more than 8,388,607 objects' worth, so it is not
-        // decoded (in full: the limit applies while inflating) and the objects are found by
-        // reconstruction instead.
-        let bomb = pdfcraft_filters::encode_flate(&pdfcraft_filters::encode_flate(&vec![0u8; 32 << 20]));
-        let mut bytes = b"%PDF-1.7\n".to_vec();
-        let o1 = bytes.len();
-        bytes.extend_from_slice(b"1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n");
-        let o2 = bytes.len();
-        bytes.extend_from_slice(b"2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
-        let x = bytes.len();
-        bytes.extend_from_slice(
-            format!("3 0 obj\n<< /Type /XRef /Size 4 /W [1 1 1] /Root 1 0 R /Filter [/FlateDecode /FlateDecode] /Length {} >>\nstream\n", bomb.len())
-                .as_bytes(),
-        );
-        bytes.extend_from_slice(&bomb);
-        bytes.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{x}\n%%EOF\n").as_bytes());
-        assert!(o1 < o2 && o2 < x);
-        let doc = Document::open(Arc::new(bytes)).unwrap();
-        assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
-        assert!(doc.repair_log().iter().any(|l| l.contains("limit")), "{:?}", doc.repair_log());
-    }
-
-    #[test]
-    fn a_stream_whose_length_is_itself_and_never_ends_loads_quickly() {
-        // From the nightly fuzz job: `6 0 obj << /Length 6 0 R >> stream` with no `endstream`
-        // after it. Every parse attempt failed, and each attempt resolved the length by loading
-        // object 6 again, retrying the same ways down to the nesting limit: about 2^32 parses.
-        // Objects being loaded are now a seen-set, lengths are memoised, and the second parse
-        // only runs when the header is shifted.
-        let mut bytes = b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog >>\nendobj\n".to_vec();
-        bytes.extend_from_slice(b"6 0 obj\n<< /Length 6 0 R >>\nstream\nno end marker follows\n");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            if let Ok(doc) = Document::open(Arc::new(bytes)) {
-                let _ = doc.try_get(6);
-            }
-            let _ = tx.send(());
-        });
-        rx.recv_timeout(std::time::Duration::from_secs(20)).expect("loading must not retry exponentially");
-    }
-}
+mod tests;
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
new file mode 100644
index 0000000000..2ff729f1fb
--- /dev/null
+++ b/crates/cos/src/document/objects.rs
@@ -0,0 +1,572 @@
+use super::reader::find;
+use super::state::{LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadState, Slot, SourceIdentity, objstm_member, owned_bytes};
+use super::xref::{Revision, XrefEntry};
+use super::*;
+
+impl Document {
+    pub fn bytes(&self) -> &Arc<Vec<u8>> {
+        &self.data
+    }
+
+    /// Identity of the original bytes, xref and authenticated decode context. Edits and
+    /// clones preserve it; reopening (including after any save) produces a new identity.
+    pub fn source_identity(&self) -> SourceIdentity {
+        SourceIdentity(Arc::downgrade(&self.source_identity))
+    }
+
+    /// What the document reads as now (see [`ReadState`]): unlike [`Self::source_identity`], it
+    /// changes with every edit, so a value derived from the document can be cached against it.
+    pub fn read_state(&self) -> ReadState {
+        ReadState { source: self.source_identity(), trailer: self.trailer.clone(), overlay: self.overlay.clone() }
+    }
+
+    pub fn version(&self) -> &str {
+        &self.version
+    }
+
+    /// Set the PDF header version (`"1.4"`, `"1.7"`, `"2.0"`, …) written by a full save.
+    pub fn set_version(&mut self, version: impl Into<String>) {
+        self.version = version.into();
+    }
+
+    pub fn trailer(&self) -> &Dict {
+        &self.trailer
+    }
+
+    pub fn trailer_mut(&mut self) -> &mut Dict {
+        &mut self.trailer
+    }
+
+    pub fn revisions(&self) -> &[Revision] {
+        &self.revisions
+    }
+
+    /// Position of the `%PDF-` header in the file: 0 unless bytes come before it.
+    pub fn header_offset(&self) -> usize {
+        self.header_offset
+    }
+
+    /// There is no cross-reference chain to append to: the index was rebuilt from object
+    /// headers because the file's own was unusable (see [`Self::repair_log`]), or the document
+    /// was built from scratch ([`Self::new_empty`]). A save writes such a document in full, even
+    /// when nothing was edited: for a repaired file that is what puts the repair on disk.
+    pub fn reconstructed(&self) -> bool {
+        self.revisions.is_empty()
+    }
+
+    /// Where each revision of the file ends (oldest first): the byte after the `%%EOF` (and its
+    /// end-of-line) that closes its cross-reference section. `data[..end]` is that revision as it
+    /// was saved. A linearized file's first-page section belongs to the revision it precedes, so
+    /// ends only ever increase. Empty for a reconstructed file.
+    pub fn revision_ends(&self) -> Vec<usize> {
+        let d = &self.data[..];
+        let mut ends: Vec<usize> = Vec::with_capacity(self.revisions.len());
+        for r in self.revisions.iter() {
+            let from = (r.xref_offset as usize).saturating_add(self.header_offset).min(d.len());
+            let Some(at) = d[from..].windows(5).position(|w| w == b"%%EOF") else { continue };
+            let mut end = from + at + 5;
+            while end < d.len() && matches!(d[end], b'\r' | b'\n') && end - (from + at + 5) < 2 {
+                end += 1;
+            }
+            match ends.last_mut() {
+                Some(last) if end <= *last => {}
+                _ => ends.push(end),
+            }
+        }
+        ends
+    }
+
+    pub fn repair_log(&self) -> &[String] {
+        &self.repair_log
+    }
+
+    /// Add a line to [`Self::repair_log`]: a leniency applied while reading that the user should
+    /// know about (fidelity: never silent).
+    pub fn note_repair(&mut self, line: String) {
+        let mut log = self.repair_log.as_ref().clone();
+        log.push(line);
+        self.repair_log = Arc::new(log);
+    }
+
+    /// `true` when there are unsaved edits. Removing an `/Encrypt` dictionary written inline in
+    /// the trailer (as MuPDF writes it) changes no object, and is an edit all the same.
+    pub fn is_modified(&self) -> bool {
+        !self.overlay.is_empty() || self.encryption_changed
+    }
+
+    /// Object numbers changed since the document was opened (or last saved).
+    pub fn modified_objects(&self) -> Vec<u32> {
+        self.overlay.keys().copied().collect()
+    }
+
+    /// Where object `num` is stored in the file (ignoring unsaved edits).
+    pub fn xref_entry(&self, num: u32) -> Option<XrefEntry> {
+        self.entries.lookup(num, &self.data)
+    }
+
+    /// Cross-reference entries this reader did not take at face value, as (byte offset of the
+    /// section, object number): an in-use entry at offset 0, a second and different entry for
+    /// one object in the same section, a reserved cross-reference stream entry type, or a
+    /// hybrid /XRefStm entry that disagrees with the table. The reader sets such an entry aside
+    /// and keeps what it already had for the object. Another reader, the page renderer among
+    /// them, may follow it instead, so the two can then show different objects for one number.
+    /// Code that compares revisions (signature validation) must not call such an object
+    /// unchanged.
+    pub fn xref_oddities(&self) -> &[(u64, u32)] {
+        &self.xref_oddities
+    }
+
+    /// Whether the cross-reference entry of `num` locates that object itself: its `num G obj`
+    /// header at exactly the recorded offset, or the member with that number at the recorded
+    /// position of its object stream. When it does not, [`Self::get`] still finds the object by
+    /// searching, but another reader may resolve the number differently. Ignores unsaved edits.
+    pub fn xref_entry_is_exact(&self, num: u32) -> bool {
+        match self.xref_entry(num) {
+            None | Some(XrefEntry::Free { .. }) => true,
+            Some(XrefEntry::InFile { offset, .. }) => {
+                let at = |off: usize| matches!(parse_indirect_shared(&self.data, off, &|_| None, &self.endstreams), Ok((id, _)) if id.num == num);
+                // Offsets may count from a header that does not start the file.
+                usize::try_from(offset).is_ok_and(|off| at(off) || (self.header_offset != 0 && at(off.saturating_add(self.header_offset))))
+            }
+            Some(XrefEntry::InStream { stream, index }) => self
+                .objstm(stream)
+                .is_ok_and(|stm| usize::try_from(index).ok().and_then(|i| stm.index.get(i)).is_some_and(|m| m.is_some_and(|(n, _)| n == num))),
+        }
+    }
+
+    /// Object `num` has an unsaved edit.
+    pub fn is_edited(&self, num: u32) -> bool {
+        self.overlay.contains_key(&num)
+    }
+
+    pub fn root(&self) -> Option<ObjRef> {
+        self.trailer.reference(b"Root")
+    }
+
+    // ── object access ───────────────────────────────────────────────────────────────────────
+
+    /// Fetch an object by reference. Missing objects are `Null` (ISO 32000-2 §7.3.10).
+    pub fn get(&self, r: ObjRef) -> Arc<Object> {
+        self.try_get(r.num).unwrap_or_else(|_| Arc::new(Object::Null))
+    }
+
+    /// Follow a reference if `o` is one; otherwise return `o` itself.
+    pub fn resolve(&self, o: &Object) -> Arc<Object> {
+        match o {
+            Object::Ref(r) => self.get(*r),
+            other => Arc::new(other.clone()),
+        }
+    }
+
+    /// Resolve and return a dictionary (a stream's dictionary counts).
+    pub fn dict(&self, o: &Object) -> Option<Dict> {
+        self.resolve(o).as_dict().cloned()
+    }
+
+    pub fn try_get(&self, num: u32) -> Result<Arc<Object>, CosError> {
+        match self.overlay.get(&num) {
+            Some(Slot::Set(_, o)) => return Ok(o.clone()),
+            Some(Slot::Freed(_)) => return Ok(Arc::new(Object::Null)),
+            None => {}
+        }
+        if let Some(o) = self.cache.lock().map_err(|_| CosError::Poisoned)?.get(&num) {
+            return Ok(o.clone());
+        }
+        // Loading can re-enter (indirect stream `/Length`, object streams); damaged files make
+        // cycles such as `6 0 obj << /Length 6 0 R >>`. Bound the nesting on every path.
+        let _guard =
+            LoadGuard::enter(num).ok_or_else(|| CosError::Syntax { offset: 0, detail: format!("reference cycle while loading object {num}") })?;
+        let obj = self.load(num, 0)?;
+        let obj = Arc::new(obj);
+        // The editing cache is bounded like the scan reader's: re-parsing a file-backed view
+        // is cheap, and returned objects outlive eviction.
+        self.cache.lock().map_err(|_| CosError::Poisoned)?.insert(num, obj.clone());
+        self.evict_editor_cache_if_over_budget(num, &obj)?;
+        Ok(obj)
+    }
+
+    /// Bounds for the editing cache: roomier than the scan reader's (128 objects / 8 MB)
+    /// so interactive editing does not thrash, but still capped so touching a large
+    /// document cannot pin its whole object graph. Only owned (decrypted/copied) bytes
+    /// count; file-backed views re-parse for free.
+    ///
+    /// Worst case per document: input bytes + up to `EDITOR_CACHE_OBJECTS` ×
+    /// `EDITOR_LARGE_OBJECT` (1024 × 256 KB = 256 MB) of small objects between full
+    /// accounting passes + `EDITOR_OBJSTM_BYTES` (32 MB) + unsaved `overlay` edits.
+    /// The count cap always holds; byte accounting between passes is approximate.
+    /// Clones share these caches, so one clone's eviction drops another's hot set;
+    /// that only costs re-parsing, never correctness. Eviction keeps just the newcomer:
+    /// file-backed views re-parse cheaply and editor working sets stay far below 1024.
+    pub(super) const EDITOR_CACHE_OBJECTS: usize = 1024;
+
+    pub(super) const EDITOR_CACHE_BYTES: usize = 32 * 1024 * 1024;
+
+    /// Object streams decode to megabytes each, so fewer are kept than plain objects.
+    const EDITOR_OBJSTM_OBJECTS: usize = 256;
+
+    const EDITOR_OBJSTM_BYTES: usize = 32 * 1024 * 1024;
+
+    /// Newcomers above this force a full accounting pass even below the count cap:
+    /// `EDITOR_CACHE_BYTES / 128`, so 128 large newcomers always trigger a pass before the
+    /// byte budget can double.
+    const EDITOR_LARGE_OBJECT: usize = 256 * 1024;
+
+    fn evict_editor_cache_if_over_budget(&self, fresh_num: u32, fresh: &Object) -> Result<(), CosError> {
+        // Fast path: the full fold is O(cache) per insert, so skip it for a small newcomer
+        // below the count cap. `len` is copied out first; nothing here holds the lock.
+        let len = self.cache.lock().map_err(|_| CosError::Poisoned)?.len();
+        if len <= Self::EDITOR_CACHE_OBJECTS && owned_bytes(fresh, &self.data, 0) <= Self::EDITOR_LARGE_OBJECT {
+            return Ok(());
+        }
+        // Walk a snapshot off-lock; re-lock only to evict.
+        let live: Vec<(u32, Arc<Object>)> = self.cache.lock().map_err(|_| CosError::Poisoned)?.iter().map(|(n, o)| (*n, o.clone())).collect();
+        let data = &self.data;
+        let owned: usize = live.iter().fold(0usize, |n, (_, o)| n.saturating_add(owned_bytes(o, data, 0)));
+        if live.len() <= Self::EDITOR_CACHE_OBJECTS && owned <= Self::EDITOR_CACHE_BYTES {
+            return Ok(());
+        }
+        // Re-check under the final lock: another thread may have inserted or evicted since
+        // the snapshot. Keep its newcomers, and skip the eviction if back within budget.
+        let snapshot: std::collections::HashSet<u32> = live.into_iter().map(|(n, _)| n).collect();
+        let mut cache = self.cache.lock().map_err(|_| CosError::Poisoned)?;
+        if cache.len() <= Self::EDITOR_CACHE_OBJECTS {
+            let data = &self.data;
+            let owned: usize = cache.values().fold(0usize, |n, o| n.saturating_add(owned_bytes(o, data, 0)));
+            if owned <= Self::EDITOR_CACHE_BYTES {
+                return Ok(());
+            }
+        }
+        cache.retain(|n, _| *n == fresh_num || !snapshot.contains(n));
+        Ok(())
+    }
+
+    fn evict_editor_streams_if_over_budget(&self, current: u32) -> Result<(), CosError> {
+        // The caller inserts `current` first, so retaining it keeps a live entry.
+        let over = {
+            let streams = self.objstms.lock().map_err(|_| CosError::Poisoned)?;
+            let bytes = streams.values().fold(0usize, |bytes, stream| {
+                bytes
+                    .saturating_add(stream.data.capacity())
+                    .saturating_add(stream.index.capacity().saturating_mul(std::mem::size_of::<Option<(u32, usize)>>()))
+            });
+            bytes > Self::EDITOR_OBJSTM_BYTES || streams.len() > Self::EDITOR_OBJSTM_OBJECTS
+        };
+        if over {
+            self.objstms.lock().map_err(|_| CosError::Poisoned)?.retain(|n, _| *n == current);
+        }
+        Ok(())
+    }
+
+    /// Visit every current object without filling this document's editing cache.
+    ///
+    /// Full-document searches (for example, standalone timestamps) need to inspect objects
+    /// that may never be used again. Keep their parse caches private and release them in
+    /// batches. Returned objects own their data and remain valid after the next batch.
+    pub fn scan_objects(&self) -> impl Iterator<Item = (ObjRef, Arc<Object>)> + use<> {
+        let numbers = self.object_numbers();
+        let mut reader = self.object_reader();
+        numbers.into_iter().map(move |num| {
+            let reference = ObjRef::new(num, reader.document.generation(num));
+            (reference, reader.get(reference))
+        })
+    }
+
+    /// Like [`Self::scan_objects`], preserving read errors for callers that must distinguish
+    /// incomplete discovery from an actual null object. Caches remain private and bounded.
+    pub fn scan_objects_checked(&self) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
+        self.scan_objects_subset(self.object_numbers())
+    }
+
+    /// Inspect selected current objects with the same bounded cache as a whole-file scan.
+    /// Missing/freed numbers yield `Null`; malformed objects return their read error.
+    pub fn scan_objects_subset(&self, numbers: Vec<u32>) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
+        let mut reader = self.object_reader();
+        numbers.into_iter().map(move |num| {
+            let reference = ObjRef::new(num, reader.document.generation(num));
+            (reference, reader.try_get(reference))
+        })
+    }
+
+    /// Inspect selected objects in the immutable source, ignoring all unsaved edits. This
+    /// allows a consumer to check an edit's dependencies without retaining an old document.
+    pub fn scan_original_objects_subset(&self, numbers: Vec<u32>) -> impl Iterator<Item = (ObjRef, Result<Arc<Object>, CosError>)> + use<> {
+        let mut reader = self.object_reader();
+        reader.document.overlay.clear();
+        numbers.into_iter().map(move |num| {
+            let reference = ObjRef::new(num, reader.document.generation(num));
+            (reference, reader.try_get(reference))
+        })
+    }
+
+    /// Opened with a tighter stream limit than editing uses ([`Document::open_with_stream_limit`]).
+    pub(crate) fn stream_limited(&self) -> bool {
+        self.stream_limit < crate::object::MAX_DECODED
+    }
+
+    pub(crate) fn object_reader(&self) -> ObjectReader {
+        let mut document = self.clone();
+        document.cache = Arc::default();
+        document.objstms = Arc::default();
+        ObjectReader { document, decoded_count: 0 }
+    }
+
+    fn load(&self, num: u32, depth: u32) -> Result<Object, CosError> {
+        if depth > 16 {
+            return Err(CosError::Syntax { offset: 0, detail: "reference cycle while loading".into() });
+        }
+        match self.entries.lookup(num, &self.data) {
+            None | Some(XrefEntry::Free { .. }) => Ok(Object::Null),
+            Some(XrefEntry::InFile { offset, .. }) => {
+                let resolve = |r: ObjRef| {
+                    if let Some(known) = LENGTHS.with(|m| m.borrow().get(&r.num).copied()) {
+                        return known;
+                    }
+                    let length = self.try_get(r.num).ok().and_then(|o| o.as_int());
+                    LENGTHS.with(|m| m.borrow_mut().insert(r.num, length));
+                    length
+                };
+                let off = offset as usize;
+                let at = |off: usize| match parse_indirect_shared(&self.data, off, &resolve, &self.endstreams) {
+                    Ok((id, o)) if id.num == num => Some(self.decrypted(id, o)),
+                    _ => None,
+                };
+                // Offsets relative to a shifted header, or simply wrong: try both fixes.
+                at(off)
+                    .or_else(|| if self.header_offset == 0 { None } else { at(off.saturating_add(self.header_offset)) })
+                    .or_else(|| self.located.get(&num).and_then(|(o, _)| usize::try_from(*o).ok()).and_then(at))
+                    .or_else(|| self.scan_for(num).map(|(id, o)| self.decrypted(id, o)))
+                    .ok_or(CosError::MissingObject(num))
+            }
+            Some(XrefEntry::InStream { stream, index }) => {
+                let stm = self.objstm(stream)?;
+                // The member at the entry's position, else wherever the stream lists `num`.
+                let at = usize::try_from(index).ok().and_then(|i| stm.index.get(i)).copied().flatten().filter(|(n, _)| *n == num);
+                let (_, off) = at.or_else(|| stm.index.iter().flatten().find(|(n, _)| *n == num).copied()).ok_or(CosError::MissingObject(num))?;
+                Lexer::new(&stm.data, off).object()
+            }
+        }
+    }
+
+    pub(super) fn objstm(&self, num: u32) -> Result<Arc<ObjStm>, CosError> {
+        if let Some(s) = self.objstms.lock().map_err(|_| CosError::Poisoned)?.get(&num) {
+            return Ok(s.clone());
+        }
+        // A file entry that cannot place the stream (one that says it is itself compressed
+        // inside another stream, as in #2367, or points nowhere) is tried by the stream's own
+        // header, as a plain object with a wrong offset is. An edited or freed stream, in the
+        // overlay or in a saved revision's table, is what that says it is: the file's copy
+        // must not come back.
+        let loaded = match self.try_get(num) {
+            Ok(o) if matches!(*o, Object::Stream(_)) => o,
+            _ if self.overlay.contains_key(&num) || matches!(self.xref_entry(num), Some(XrefEntry::Free { .. })) => {
+                return Err(CosError::MissingObject(num));
+            }
+            _ => Arc::new(self.scan_for(num).map(|(id, o)| self.decrypted(id, o)).ok_or(CosError::MissingObject(num))?),
+        };
+        let Object::Stream(s) = &*loaded else { return Err(CosError::MissingObject(num)) };
+        let n = s.dict.int(b"N").unwrap_or(0).clamp(0, 1_000_000) as usize;
+        let first = usize::try_from(s.dict.int(b"First").unwrap_or(0).max(0)).ok();
+        let data = s.decoded_within(self.stream_limit)?;
+        let mut lx = Lexer::new(&data, 0);
+        let mut index = Vec::with_capacity(n);
+        for _ in 0..n {
+            let (Some(Object::Int(onum)), Some(Object::Int(off))) = (lx.object().ok(), lx.object().ok()) else { break };
+            index.push(objstm_member(onum, off, first, data.len()));
+        }
+        let stm = Arc::new(ObjStm { index, data: Arc::new(data) });
+        // Same bound as the object cache: decoded object streams can be megabytes each.
+        // Insert first so the retained `num` is actually in the map.
+        self.objstms.lock().map_err(|_| CosError::Poisoned)?.insert(num, stm.clone());
+        self.evict_editor_streams_if_over_budget(num)?;
+        Ok(stm)
+    }
+
+    /// Last-resort lookup: scan the file for `num G obj`.
+    fn scan_for(&self, num: u32) -> Option<(ObjRef, Object)> {
+        let needle = format!("{num} ");
+        let data = &self.data;
+        let mut found = None;
+        let mut i = 0;
+        while let Some(p) = find(data, needle.as_bytes(), i, data.len()) {
+            i = p + 1;
+            if p > 0 && !is_whitespace(data[p - 1]) {
+                continue;
+            }
+            if let Ok((id, o)) = parse_indirect_shared(data, p, &|_| None, &self.endstreams)
+                && id.num == num
+            {
+                found = Some((id, o)); // keep the last (newest) definition
+            }
+        }
+        found
+    }
+
+    // ── editing ─────────────────────────────────────────────────────────────────────────────
+
+    /// Stream data still pointing into another document's file would keep that whole file
+    /// alive for as long as this edit exists: give it a buffer of its own (just its bytes).
+    fn adopt(&self, obj: Object) -> Object {
+        match obj {
+            Object::Stream(mut s) if s.raw.borrows_other_than(&self.data) => {
+                s.raw = s.raw.detached();
+                Object::Stream(s)
+            }
+            other => other,
+        }
+    }
+
+    /// Replace an object (keeping its generation).
+    pub fn set(&mut self, r: ObjRef, obj: impl Into<Object>) {
+        let obj = self.adopt(obj.into());
+        self.overlay.insert(r.num, Slot::Set(r.generation, Arc::new(obj)));
+        if r.num >= self.next_num {
+            self.next_num = r.num.saturating_add(1);
+        }
+    }
+
+    /// Add a new indirect object and return its reference.
+    pub fn add(&mut self, obj: impl Into<Object>) -> ObjRef {
+        let r = ObjRef::new(self.allocate_num(), 0);
+        let obj = self.adopt(obj.into());
+        self.overlay.insert(r.num, Slot::Set(0, Arc::new(obj)));
+        r
+    }
+
+    /// Find a never-used number, retaining the high-water mark for incremental /Size.
+    /// Exhausted hints fall back to gaps without replacing source or overlay objects.
+    fn allocate_num(&mut self) -> u32 {
+        let mut num = if self.next_num == u32::MAX { 1 } else { self.next_num.max(1) };
+        while self.entries.lookup(num, &self.data).is_some() || self.overlay.contains_key(&num) {
+            num = if num == u32::MAX - 1 { 1 } else { num + 1 };
+        }
+        self.next_num = self.next_num.max(num.saturating_add(1));
+        num
+    }
+
+    /// Delete an object (its number becomes free with the next generation).
+    pub fn free(&mut self, r: ObjRef) {
+        self.overlay.insert(r.num, Slot::Freed(r.generation.saturating_add(1)));
+    }
+
+    /// Free what was added since the file was read and nothing refers to any more: the objects
+    /// [`SaveOptions::drop_unlinked`](crate::SaveOptions::drop_unlinked) leaves out of an
+    /// incremental save, freed as it writes them (the generation stays). For a writer about to
+    /// add an object that nothing refers to either, which that option would leave out too.
+    pub fn free_unlinked_additions(&mut self) {
+        for num in crate::writer::unlinked_additions(self) {
+            let generation = self.generation(num);
+            self.overlay.insert(num, Slot::Freed(generation));
+        }
+    }
+
+    /// Record `current`'s object graph as unsaved edits of this document.
+    ///
+    /// Used when the working snapshot was restored from an earlier revision and the next
+    /// incremental save must still append to this file (the last saved revision). Objects
+    /// that already match are left untouched. Reads go through private readers so neither
+    /// document's editing cache is filled.
+    pub fn overlay_changes_from(&mut self, current: &Document) -> Result<(), CosError> {
+        let saved_nums = self.object_numbers();
+        let current_nums = current.object_numbers();
+        let mut freed = Vec::new();
+        let mut changed = Vec::new();
+        {
+            let mut saved_reader = self.object_reader();
+            let mut current_reader = current.object_reader();
+            for &num in &saved_nums {
+                if current_nums.binary_search(&num).is_err() {
+                    freed.push(num);
+                }
+            }
+            for &num in &current_nums {
+                let generation = current.generation(num);
+                let same = saved_nums.binary_search(&num).is_ok()
+                    && self.generation(num) == generation
+                    && saved_reader.try_get(ObjRef::new(num, 0))? == current_reader.try_get(ObjRef::new(num, 0))?;
+                if !same {
+                    changed.push(num);
+                }
+            }
+        }
+        for num in freed {
+            let generation = self.generation(num);
+            self.free(ObjRef::new(num, generation));
+        }
+        let mut current_reader = current.object_reader();
+        for num in changed {
+            let generation = current.generation(num);
+            let object = current_reader.try_get(ObjRef::new(num, 0))?;
+            self.set(ObjRef::new(num, generation), (*object).clone());
+        }
+        *self.trailer_mut() = current.trailer().clone();
+        Ok(())
+    }
+
+    /// Edit a dictionary (or stream dictionary) object in place.
+    pub fn update_dict(&mut self, r: ObjRef, f: impl FnOnce(&mut Dict)) -> Result<(), CosError> {
+        let mut obj = (*self.get(r)).clone();
+        let d = obj.as_dict_mut().ok_or(CosError::NotADictionary(r))?;
+        f(d);
+        self.set(r, obj);
+        Ok(())
+    }
+
+    /// Current generation of an object number.
+    pub fn generation(&self, num: u32) -> u16 {
+        match self.overlay.get(&num) {
+            Some(Slot::Set(g, _)) => *g,
+            Some(Slot::Freed(g)) => *g,
+            None => match self.entries.lookup(num, &self.data) {
+                Some(XrefEntry::InFile { generation, .. }) => generation,
+                Some(XrefEntry::Free { next_generation }) => next_generation,
+                _ => 0,
+            },
+        }
+    }
+
+    pub(crate) fn overlay_entries(&self) -> impl Iterator<Item = (u32, u16, Option<Arc<Object>>)> + '_ {
+        self.overlay.iter().map(|(n, s)| match s {
+            Slot::Set(g, o) => (*n, *g, Some(o.clone())),
+            Slot::Freed(g) => (*n, *g, None),
+        })
+    }
+
+    pub(crate) fn next_num(&self) -> u32 {
+        self.next_num
+    }
+
+    /// All object numbers known (file and overlay), excluding freed ones.
+    pub fn object_numbers(&self) -> Vec<u32> {
+        let source_numbers = self.entries.object_numbers(&self.data);
+        let mut numbers = Vec::with_capacity(source_numbers.len().max(self.overlay.len()));
+        let mut source = source_numbers.into_iter().peekable();
+        for (&num, slot) in &self.overlay {
+            while source.peek().is_some_and(|n| *n < num) {
+                if let Some(n) = source.next() {
+                    numbers.push(n);
+                }
+            }
+            if source.peek().is_some_and(|n| *n == num) {
+                source.next();
+            }
+            if matches!(slot, Slot::Set(..)) {
+                numbers.push(num);
+            }
+        }
+        numbers.extend(source);
+        numbers
+    }
+
+    /// Rebase this document on bytes written by the writer (after a save): edits become part of
+    /// the file and the overlay is cleared, so the next incremental save appends only new edits.
+    pub fn reopen_after_save(&self, bytes: Arc<Vec<u8>>) -> Result<Self, CosError> {
+        Document::open(bytes)
+    }
+
+    // ── cross-reference parsing ─────────────────────────────────────────────────────────────
+
+    pub(super) fn root_is_catalog(&self) -> bool {
+        let Some(r) = self.root() else { return false };
+        matches!(self.try_get(r.num).as_deref(), Ok(Object::Dict(d)) if d.name(b"Type") == Some(b"Catalog") || d.contains(b"Pages"))
+    }
+}
diff --git a/crates/cos/src/document/open.rs b/crates/cos/src/document/open.rs
new file mode 100644
index 0000000000..c90d5c0906
--- /dev/null
+++ b/crates/cos/src/document/open.rs
@@ -0,0 +1,344 @@
+use super::reader::{find, generated_id};
+use super::state::Credentials;
+use super::xref::XrefIndex;
+use super::*;
+
+impl Document {
+    /// A new document with an empty page tree (for split / extract / combine). It has no
+    /// original bytes, so saving always writes a full file.
+    pub fn new_empty() -> Self {
+        let mut doc = Document {
+            data: Arc::new(Vec::new()),
+            endstreams: Arc::default(),
+            source_identity: Arc::new(()),
+            entries: Arc::new(XrefIndex::empty()),
+            trailer: Dict::new(),
+            revisions: Arc::new(Vec::new()),
+            xref_oddities: Arc::default(),
+            located: Arc::default(),
+            repair_log: Arc::new(Vec::new()),
+            cache: Arc::default(),
+            objstms: Arc::default(),
+            stream_limit: crate::object::MAX_DECODED,
+            overlay: BTreeMap::new(),
+            next_num: 1,
+            header_offset: 0,
+            version: "1.7".into(),
+            security: None,
+            encrypt_num: None,
+            encryption_changed: false,
+            full_save: false,
+            out_security: None,
+            out_encrypt_num: None,
+        };
+        let mut pages = Dict::new();
+        pages.set(b"Type".to_vec(), Object::name("Pages"));
+        pages.set(b"Kids".to_vec(), Object::Array(Vec::new()));
+        pages.set(b"Count".to_vec(), Object::Int(0));
+        let pages = doc.add(pages);
+        let mut catalog = Dict::new();
+        catalog.set(b"Type".to_vec(), Object::name("Catalog"));
+        catalog.set(b"Pages".to_vec(), Object::Ref(pages));
+        let root = doc.add(catalog);
+        doc.trailer.set(b"Root".to_vec(), Object::Ref(root));
+        doc
+    }
+
+    /// Parse a document. Damaged cross-reference data is reconstructed; see `repair_log`.
+    /// Encrypted documents open only if their user password is empty; see `open_with_password`.
+    pub fn open(data: Arc<Vec<u8>>) -> Result<Self, CosError> {
+        Self::open_with_password(data, None)
+    }
+
+    /// Parse a document, authenticating encrypted ones with `password` (owner or user; `None`
+    /// tries the empty password). Fails with `NeedsPassword` / `WrongPassword` as appropriate.
+    pub fn open_with_password(data: Arc<Vec<u8>>, password: Option<&str>) -> Result<Self, CosError> {
+        Self::open_with_stream_limit(data, password, crate::object::MAX_DECODED)
+    }
+
+    /// Open with a tighter decompression bound for object and cross-reference streams.
+    /// Inspection can use this without changing the editing reader's default limit. Such a
+    /// document is read-only: objects in a larger object stream read as missing, so the
+    /// writers refuse to save it ([`CosError::ReadOnlyLimit`]).
+    pub fn open_with_stream_limit(data: Arc<Vec<u8>>, password: Option<&str>, stream_limit: usize) -> Result<Self, CosError> {
+        Self::open_as(data, Credentials::Password(password), stream_limit)
+    }
+
+    /// Open `data`, an earlier revision of this file (the bytes a signature covers) or another
+    /// save of it, with this document's credentials: an encrypted one must have the same
+    /// `/Encrypt` dictionary and `/ID` as this document, whose file key is then reused, so no
+    /// password is needed or kept; unencrypted data opens as [`open`](Self::open) does. Data
+    /// encrypted differently fails with `NeedsPassword`.
+    pub fn open_with_same_credentials(&self, data: Arc<Vec<u8>>) -> Result<Self, CosError> {
+        let credentials = match &self.security {
+            Some(handler) => Credentials::Handler { handler, id0: self.first_id() },
+            None => Credentials::Password(None),
+        };
+        Self::open_as(data, credentials, self.stream_limit)
+    }
+
+    fn open_as(data: Arc<Vec<u8>>, credentials: Credentials<'_>, stream_limit: usize) -> Result<Self, CosError> {
+        // Viewers accept files whose header is missing or damaged as long as the body looks
+        // like PDF; so do we (a note goes to the repair log).
+        let header = find(&data, b"%PDF-", 0, 1024);
+        let headerless = header.is_none();
+        if headerless && find(&data, b" obj", 0, 4096).is_none() {
+            return Err(CosError::NotPdf);
+        }
+        let header_offset = header.unwrap_or(0);
+        let version = match header {
+            Some(h) => String::from_utf8_lossy(&data[(h + 5).min(data.len())..(h + 8).min(data.len())]).trim().to_string(),
+            None => "1.4".to_string(),
+        };
+        let mut doc = Document {
+            data,
+            endstreams: Arc::default(),
+            source_identity: Arc::new(()),
+            entries: Arc::new(XrefIndex::empty()),
+            trailer: Dict::new(),
+            revisions: Arc::new(Vec::new()),
+            xref_oddities: Arc::default(),
+            located: Arc::default(),
+            repair_log: Arc::new(Vec::new()),
+            cache: Arc::default(),
+            objstms: Arc::default(),
+            stream_limit: stream_limit.min(crate::object::MAX_DECODED),
+            overlay: BTreeMap::new(),
+            next_num: 1,
+            header_offset,
+            version,
+            security: None,
+            encrypt_num: None,
+            encryption_changed: false,
+            full_save: false,
+            out_security: None,
+            out_encrypt_num: None,
+        };
+        let mut log = Vec::new();
+        if headerless {
+            log.push("the %PDF- header is missing; reading the file as PDF 1.4".into());
+        }
+        let parsed = doc.read_xref_chain(&mut log);
+        let mut authenticated = false;
+        let ok = match parsed {
+            Ok((entries, trailer, revisions, oddities)) => {
+                doc.entries = Arc::new(entries);
+                doc.trailer = trailer;
+                doc.revisions = Arc::new(revisions);
+                doc.xref_oddities = Arc::new(oddities);
+                doc.fill_xref_gaps(&mut log);
+                // Authenticate before checking the catalog: it may sit in an encrypted object
+                // stream, which reads as garbage until the key is known.
+                if let Some(enc) = doc.trailer.get(b"Encrypt").cloned() {
+                    doc.authenticate(&enc, &credentials)?;
+                    authenticated = true;
+                }
+                doc.root_is_catalog()
+            }
+            Err(e) => {
+                log.push(format!("cross-reference data unreadable ({e}); rebuilding from object headers"));
+                false
+            }
+        };
+        if !ok {
+            if !doc.entries.is_empty() {
+                log.push("cross-reference data does not lead to a valid catalog; rebuilding from object headers".into());
+            }
+            doc.reconstruct(&mut log)?;
+        }
+        doc.repair_log = Arc::new(log);
+        // Reconstruction may have found a different trailer: (re)authenticate against it.
+        if (!ok || !authenticated)
+            && let Some(enc) = doc.trailer.get(b"Encrypt").cloned()
+        {
+            doc.authenticate(&enc, &credentials)?;
+        }
+        if Arc::make_mut(&mut doc.entries).remove_exhausted() {
+            Arc::make_mut(&mut doc.repair_log).push("skipped exhausted xref object number 4294967295".into());
+        }
+        let max = doc.entries.max_num();
+        let size = u32::try_from(doc.trailer.int(b"Size").unwrap_or(0).max(0)).unwrap_or(u32::MAX);
+        if size == u32::MAX {
+            Arc::make_mut(&mut doc.repair_log).push("exhausted trailer /Size; new objects use unused object numbers".into());
+        }
+        doc.next_num = max.saturating_add(1).max(size).max(1);
+        Ok(doc)
+    }
+
+    fn authenticate(&mut self, enc: &Object, credentials: &Credentials<'_>) -> Result<(), CosError> {
+        // Authentication can change how the same input is decoded.
+        self.source_identity = Arc::new(());
+        let (num, dict) = match enc {
+            Object::Ref(r) => (Some(r.num), self.get(*r).as_dict().cloned()),
+            Object::Dict(d) => (None, Some(d.clone())),
+            _ => (None, None),
+        };
+        let Some(dict) = dict else {
+            // A dangling /Encrypt: viewers treat the file as unencrypted, and so do we.
+            let mut log = self.repair_log.as_ref().clone();
+            log.push("the trailer names an /Encrypt dictionary that does not exist; reading the file as unencrypted".into());
+            self.repair_log = Arc::new(log);
+            self.trailer.remove(b"Encrypt");
+            return Ok(());
+        };
+        let params = crate::security::encrypt_dict(self, &dict);
+        let id0 = self.first_id();
+        let handler = match credentials {
+            Credentials::Password(password) => Arc::new(pdfcraft_crypt::SecurityHandler::open(params, &id0, *password).map_err(|e| match e {
+                pdfcraft_crypt::CryptError::WrongPassword if password.is_none() => CosError::NeedsPassword,
+                pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
+                other => CosError::Security(other.to_string()),
+            })?),
+            // The same encryption as the document whose key this is: that key opens it.
+            Credentials::Handler { handler, id0: known } if *handler.dict() == params && *known == id0 => Arc::clone(handler),
+            Credentials::Handler { .. } => return Err(CosError::NeedsPassword),
+        };
+        self.security = Some(handler);
+        self.encrypt_num = num;
+        // Objects read while locating the catalog were read before decryption was possible.
+        self.cache = Arc::default();
+        self.objstms = Arc::default();
+        Ok(())
+    }
+
+    /// The first file identifier, part of the encryption key (empty when there is none).
+    fn first_id(&self) -> Vec<u8> {
+        match self.trailer.get(b"ID") {
+            Some(Object::Array(a)) => a.first().and_then(|s| s.as_string()).map(|s| s.bytes.clone()).unwrap_or_default(),
+            _ => Vec::new(),
+        }
+    }
+
+    /// Lift the restrictions of a document opened with its user password by entering the
+    /// owner (permissions) password (§7.6.4). Fails with `WrongPassword` for any other
+    /// password. Does nothing when the document is unencrypted or already opened as owner.
+    /// Both passwords unlock the same file key, so nothing read so far is decoded again.
+    pub fn unlock(&mut self, password: &str) -> Result<(), CosError> {
+        let Some(current) = self.security.as_deref() else { return Ok(()) };
+        if current.auth() == pdfcraft_crypt::Auth::Owner {
+            return Ok(());
+        }
+        let owner = current.authenticate_owner(&self.first_id(), password).map_err(|e| match e {
+            pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
+            other => CosError::Security(other.to_string()),
+        })?;
+        self.security = Some(Arc::new(owner));
+        Ok(())
+    }
+
+    /// The security handler, when the document is encrypted.
+    pub fn security(&self) -> Option<&pdfcraft_crypt::SecurityHandler> {
+        self.security.as_deref()
+    }
+
+    /// What the opening password allows (`None` for unencrypted documents: everything).
+    pub fn permissions(&self) -> Option<pdfcraft_crypt::Permissions> {
+        self.security().map(|s| s.permissions())
+    }
+
+    /// Make the next save a full rewrite: earlier revisions (which still hold what an edit
+    /// removed) must not stay in the file. Redaction requires this.
+    pub fn require_full_save(&mut self) {
+        self.full_save = true;
+    }
+
+    /// The next save must rewrite the whole file (see [`Document::require_full_save`]).
+    pub fn full_save_required(&self) -> bool {
+        self.full_save
+    }
+
+    /// Security was set or removed since the document was opened (the next save applies it).
+    pub fn encryption_changed(&self) -> bool {
+        self.encryption_changed
+    }
+
+    /// The handler used to write: the new one after `set_encryption` / `remove_encryption`,
+    /// otherwise the one the document was opened with.
+    pub(crate) fn output_security(&self) -> (Option<&pdfcraft_crypt::SecurityHandler>, Option<u32>) {
+        if self.encryption_changed { (self.out_security.as_deref(), self.out_encrypt_num) } else { (self.security.as_deref(), self.encrypt_num) }
+    }
+
+    /// The security the next save writes: protection applied with `set_encryption`, none after
+    /// `remove_encryption`, otherwise the security the document was opened with.
+    pub fn output_handler(&self) -> Option<&pdfcraft_crypt::SecurityHandler> {
+        self.output_security().0
+    }
+
+    /// Protect the document with a password (§7.6.4). Takes effect on the next save, which is
+    /// always a full rewrite. Returns the handler (authenticated as owner).
+    pub fn set_encryption(&mut self, params: &pdfcraft_crypt::NewEncryption) -> Result<(), CosError> {
+        // The file identifier is part of the key; make sure it exists and keep it.
+        let id0 = match self.trailer.get(b"ID") {
+            Some(Object::Array(a)) if a.len() == 2 => a[0].as_string().map(|s| s.bytes.clone()).unwrap_or_default(),
+            _ => {
+                let mut id = generated_id(&params.seed);
+                id.truncate(16);
+                let s = Object::String(crate::PdfString { bytes: id.clone(), hex: true });
+                self.trailer.set(b"ID".to_vec(), Object::Array(vec![s.clone(), s]));
+                id
+            }
+        };
+        let h = pdfcraft_crypt::create(params, &id0).map_err(|e| CosError::Security(e.to_string()))?;
+        let d = h.dict();
+        let s = |b: &[u8]| Object::String(crate::PdfString { bytes: b.to_vec(), hex: true });
+        let mut e = Dict::new();
+        e.set(b"Filter".to_vec(), Object::name("Standard"));
+        e.set(b"V".to_vec(), Object::Int(d.v));
+        e.set(b"R".to_vec(), Object::Int(d.r));
+        e.set(b"Length".to_vec(), Object::Int(d.length_bits));
+        e.set(b"O".to_vec(), s(&d.o));
+        e.set(b"U".to_vec(), s(&d.u));
+        e.set(b"P".to_vec(), Object::Int(i64::from(d.p)));
+        if d.v >= 4 {
+            let mut cf = Dict::new();
+            let mut std_cf = Dict::new();
+            std_cf.set(b"Type".to_vec(), Object::name("CryptFilter"));
+            let (cfm, len) = if d.v >= 5 { ("AESV3", 32) } else { ("AESV2", 16) };
+            std_cf.set(b"CFM".to_vec(), Object::name(cfm));
+            std_cf.set(b"Length".to_vec(), Object::Int(len));
+            std_cf.set(b"AuthEvent".to_vec(), Object::name("DocOpen"));
+            cf.set(b"StdCF".to_vec(), Object::Dict(std_cf));
+            e.set(b"CF".to_vec(), Object::Dict(cf));
+            e.set(b"StmF".to_vec(), Object::name("StdCF"));
+            e.set(b"StrF".to_vec(), Object::name("StdCF"));
+            if !d.encrypt_metadata {
+                e.set(b"EncryptMetadata".to_vec(), Object::Bool(false));
+            }
+        }
+        if d.v >= 5 {
+            e.set(b"OE".to_vec(), s(&d.oe));
+            e.set(b"UE".to_vec(), s(&d.ue));
+            e.set(b"Perms".to_vec(), s(&d.perms));
+        }
+        if let Some(Object::Ref(old)) = self.trailer.get(b"Encrypt").cloned() {
+            self.free(old);
+        }
+        let r = self.add(e);
+        self.trailer.set(b"Encrypt".to_vec(), Object::Ref(r));
+        // Objects are still read with the original handler; saves use the new one.
+        self.out_security = Some(Arc::new(h));
+        self.out_encrypt_num = Some(r.num);
+        self.encryption_changed = true;
+        Ok(())
+    }
+
+    /// Remove password protection (requires the document to be open — any authenticated
+    /// password; callers should require the owner password, §7.6.4). Applied by a full save.
+    pub fn remove_encryption(&mut self) {
+        if let Some(Object::Ref(r)) = self.trailer.get(b"Encrypt").cloned() {
+            self.free(r);
+        }
+        self.trailer.remove(b"Encrypt");
+        self.out_security = None;
+        self.out_encrypt_num = None;
+        self.encryption_changed = true;
+    }
+
+    /// Decrypt a freshly parsed indirect object if the document is encrypted.
+    pub(super) fn decrypted(&self, id: ObjRef, o: Object) -> Object {
+        match &self.security {
+            Some(h) if Some(id.num) != self.encrypt_num => crate::security::transform(h, &o, id.num, id.generation, crate::security::Pass::Decrypt),
+            _ => o,
+        }
+    }
+}
diff --git a/crates/cos/src/document/reader.rs b/crates/cos/src/document/reader.rs
new file mode 100644
index 0000000000..ead09c36e5
--- /dev/null
+++ b/crates/cos/src/document/reader.rs
@@ -0,0 +1,874 @@
+#[cfg(test)]
+use super::state::SECTION_READS;
+use super::xref::{
+    MAX_COMPACT_XREF_BYTES, MAX_COMPACT_XREF_ROWS, Revision, XrefEntry, XrefIndex, XrefRange, XrefRevisionSection, XrefSection, XrefSectionData,
+};
+use super::*;
+
+impl Document {
+    #[allow(clippy::type_complexity)]
+    pub(super) fn read_xref_chain(&self, log: &mut Vec<String>) -> Result<(XrefIndex, Dict, Vec<Revision>, Vec<(u64, u32)>), CosError> {
+        let mut compact_log = Vec::new();
+        if let Ok(Some((index, trailer, revisions))) = self.read_compact_xref_chain(&mut compact_log) {
+            let size = trailer.int(b"Size").unwrap_or(0).max(0);
+            if size > 0 && size <= i64::from(u32::MAX) && u64::from(index.max_num()) < size as u64 {
+                log.extend(compact_log);
+                // The compact reader declines any section with set-aside entries, so there are none here.
+                return Ok((index, trailer, revisions, Vec::new()));
+            }
+        }
+        let (entries, trailer, revisions, oddities) = self.read_xref_chain_materialized(log)?;
+        Ok((XrefIndex::Materialized(Arc::new(entries)), trailer, revisions, oddities))
+    }
+
+    fn read_compact_xref_chain(&self, log: &mut Vec<String>) -> Result<Option<(XrefIndex, Dict, Vec<Revision>)>, CosError> {
+        let data = &self.data;
+        let tail_start = data.len().saturating_sub(4096);
+        let sx = rfind(data, b"startxref", tail_start).ok_or(CosError::Syntax { offset: data.len(), detail: "no startxref".into() })?;
+        let mut lx = Lexer::new(data, sx + 9);
+        let first = match lx.object() {
+            Ok(Object::Int(n)) if n >= 0 => n as u64,
+            _ => return Err(CosError::Syntax { offset: sx, detail: "bad startxref value".into() }),
+        };
+        let mut sections = Vec::new();
+        let mut retained_rows = 0usize;
+        let mut retained_bytes = 0usize;
+        let mut trailer: Option<Dict> = None;
+        let mut revisions = Vec::new();
+        let mut visited = HashSet::new();
+        let mut next = Some(first);
+        while let Some(off) = next.take() {
+            if !visited.insert(off) || visited.len() > 10_000 {
+                log.push(format!("cross-reference chain loops at offset {off}; stopped"));
+                break;
+            }
+            let ((primary, sect_trailer, is_stream), header_relative) = match self.read_compact_section(off as usize) {
+                Ok(Some(v)) => (v, false),
+                Ok(None) => return Ok(None),
+                Err(e) if self.header_offset > 0 => {
+                    log.push(format!("xref at {off} unreadable ({e}); retrying relative to the header"));
+                    match self.read_compact_section(off as usize + self.header_offset)? {
+                        Some(v) => (v, true),
+                        None => return Ok(None),
+                    }
+                }
+                // An unreadable older section loses every object only it locates: the
+                // materialized reader logs it and the file is rebuilt from object headers (#1656).
+                Err(e) => return Err(e),
+            };
+            revisions.push(Revision { xref_offset: off, is_stream, header_relative });
+            if primary.renumbered {
+                log.push(format!("xref subsection at {off} is numbered from 1 but begins with object 0's entry; read from 0"));
+            }
+            let Some(rows) = retained_rows.checked_add(primary.row_count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else { return Ok(None) };
+            let Some(bytes) = retained_bytes.checked_add(primary.retained_bytes()).filter(|bytes| *bytes <= MAX_COMPACT_XREF_BYTES) else {
+                return Ok(None);
+            };
+            retained_rows = rows;
+            retained_bytes = bytes;
+            let hybrid = if let Some(x) = sect_trailer.int(b"XRefStm").filter(|x| *x >= 0) {
+                match self.read_compact_section(x as usize) {
+                    Ok(Some((section, _, _))) => {
+                        let Some(rows) = retained_rows.checked_add(section.row_count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else {
+                            return Ok(None);
+                        };
+                        let Some(bytes) = retained_bytes.checked_add(section.retained_bytes()).filter(|bytes| *bytes <= MAX_COMPACT_XREF_BYTES)
+                        else {
+                            return Ok(None);
+                        };
+                        retained_rows = rows;
+                        retained_bytes = bytes;
+                        Some(section)
+                    }
+                    Ok(None) => return Ok(None),
+                    Err(e) => {
+                        log.push(format!("hybrid /XRefStm at {x} unreadable: {e}"));
+                        None
+                    }
+                }
+            } else {
+                None
+            };
+            if let Some(hybrid) = &hybrid {
+                // A hybrid entry that disagrees with the table is set aside by the materialized reader.
+                let mut numbers = Vec::new();
+                hybrid.extend_numbers(&mut numbers);
+                for num in numbers {
+                    let Some(entry) = hybrid.lookup(num, &self.data) else { continue };
+                    if primary.lookup(num, &self.data).is_some_and(|old| !matches!(old, XrefEntry::Free { .. }) && old != entry) {
+                        return Ok(None);
+                    }
+                }
+            }
+            sections.push(XrefRevisionSection { primary, hybrid });
+            next = prev_offset(data, &sect_trailer, off, |num| sections.iter().find_map(|s| s.lookup(num, data)), log);
+            if trailer.is_none() {
+                trailer = Some(sect_trailer);
+            }
+        }
+        revisions.reverse();
+        let mut trailer = trailer.ok_or(CosError::Syntax { offset: 0, detail: "no trailer".into() })?;
+        for k in [&b"Prev"[..], b"XRefStm", b"Type", b"W", b"Index", b"Filter", b"DecodeParms", b"Length"] {
+            trailer.remove(k);
+        }
+        let mut max_num = 0;
+        let mut has_entries = false;
+        for revision in &sections {
+            max_num = max_num.max(revision.primary.max_num);
+            has_entries |= revision.primary.has_entries;
+            if let Some(hybrid) = &revision.hybrid {
+                max_num = max_num.max(hybrid.max_num);
+                has_entries |= hybrid.has_entries;
+            }
+        }
+        Ok(Some((XrefIndex::Compact { revisions: sections, max_num, has_entries }, trailer, revisions)))
+    }
+
+    fn read_compact_section(&self, off: usize) -> Result<Option<(XrefSection, Dict, bool)>, CosError> {
+        let data = &self.data;
+        let mut lx = Lexer::new(data, off);
+        if lx.eat_keyword(b"xref") {
+            let mut ranges = Vec::new();
+            let mut layout_ok = true;
+            let mut max_num = 0;
+            let mut has_entries = false;
+            let mut previous_end = None;
+            let mut row_count = 0usize;
+            let mut renumbered = false;
+            loop {
+                lx.skip_ws();
+                if lx.eat_keyword(b"trailer") {
+                    let t = lx.object()?;
+                    let d = t.as_dict().cloned().ok_or(CosError::Syntax { offset: lx.pos, detail: "trailer is not a dictionary".into() })?;
+                    if !layout_ok {
+                        return Ok(None);
+                    }
+                    return Ok(Some((XrefSection { data: XrefSectionData::Table, ranges, row_count, max_num, has_entries, renumbered }, d, false)));
+                }
+                let (Ok(Object::Int(start)), Ok(Object::Int(count))) = (lx.object(), lx.object()) else {
+                    return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref subsection header".into() });
+                };
+                if !valid_xref_range(start, count) || count > 10_000_000 {
+                    return Err(CosError::Syntax { offset: lx.pos, detail: "invalid xref object range".into() });
+                }
+                let shifted = subsection_start(data, self.header_offset, lx.pos, start, count);
+                renumbered |= shifted != start;
+                let start = shifted;
+                let Some(next_rows) = usize::try_from(count).ok().and_then(|count| row_count.checked_add(count)) else { return Ok(None) };
+                if next_rows > MAX_COMPACT_XREF_ROWS {
+                    return Ok(None);
+                }
+                row_count = next_rows;
+                let mut range_offset = None;
+                let mut stride = None;
+                let mut previous_record = None;
+                for i in 0..count {
+                    lx.skip_ws();
+                    let record = lx.pos;
+                    if range_offset.is_none() {
+                        range_offset = Some(record);
+                    }
+                    if let Some(previous) = previous_record {
+                        let Some(delta) = record.checked_sub(previous) else {
+                            layout_ok = false;
+                            continue;
+                        };
+                        if stride.is_some_and(|known| known != delta) {
+                            layout_ok = false;
+                        }
+                        stride.get_or_insert(delta);
+                    }
+                    previous_record = Some(record);
+                    let o = lx.token();
+                    lx.skip_ws();
+                    let _generation = lx.token();
+                    lx.skip_ws();
+                    let kind = lx.token();
+                    let num = (start + i) as u32;
+                    let offset = std::str::from_utf8(o).ok().and_then(|s| s.parse::<u64>().ok());
+                    match (kind, offset) {
+                        (b"n", Some(offset)) if offset != 0 => {
+                            has_entries = true;
+                            max_num = max_num.max(num);
+                        }
+                        (b"n", Some(_)) => {
+                            // Set aside by the materialized reader, which records it.
+                            if num != 0 {
+                                return Ok(None);
+                            }
+                        }
+                        (b"f", _) => {
+                            has_entries = true;
+                            max_num = max_num.max(num);
+                        }
+                        _ => return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref entry".into() }),
+                    }
+                }
+                if count > 0 {
+                    let range_start = start as u32;
+                    let range_count = count as u32;
+                    let end = u64::from(range_start) + u64::from(range_count);
+                    if previous_end.is_some_and(|previous| u64::from(range_start) < previous) {
+                        layout_ok = false;
+                    }
+                    previous_end = Some(end);
+                    ranges.push(XrefRange {
+                        start: range_start,
+                        count: range_count,
+                        offset: range_offset.unwrap_or(lx.pos),
+                        stride: stride.unwrap_or(1),
+                    });
+                }
+            }
+        }
+        let (_, obj) = parse_indirect(data, off, &|_| None)?;
+        let Object::Stream(stream) = obj else { return Err(CosError::Syntax { offset: off, detail: "expected xref table or stream".into() }) };
+        if stream.dict.name(b"Type") != Some(b"XRef") {
+            return Err(CosError::Syntax { offset: off, detail: "stream at startxref is not /Type /XRef".into() });
+        }
+        let w: Vec<usize> = stream
+            .dict
+            .get(b"W")
+            .and_then(Object::as_array)
+            .map(|a| a.iter().map(|x| x.as_int().unwrap_or(0).clamp(0, 8) as usize).collect())
+            .unwrap_or_default();
+        if w.len() < 3 {
+            return Err(CosError::Syntax { offset: off, detail: "xref stream /W invalid".into() });
+        }
+        let widths = [w[0], w[1], w[2]];
+        let row = widths.iter().sum::<usize>();
+        if row == 0 {
+            return Err(CosError::Syntax { offset: off, detail: "xref stream row width 0".into() });
+        }
+        let size = stream.dict.int(b"Size").unwrap_or(0).max(0);
+        let index: Vec<i64> = match stream.dict.get(b"Index").and_then(Object::as_array) {
+            Some(a) => a.iter().filter_map(Object::as_int).collect(),
+            None => vec![0, size],
+        };
+        let mut requested_rows = 0usize;
+        let mut previous_end = None;
+        for pair in index.chunks(2) {
+            let [start, count] = pair else { break };
+            if !valid_xref_range(*start, *count) {
+                return Err(CosError::Syntax { offset: off, detail: "invalid xref object range".into() });
+            }
+            let Ok(count) = usize::try_from(*count) else { return Ok(None) };
+            let Some(next) = requested_rows.checked_add(count).filter(|rows| *rows <= MAX_COMPACT_XREF_ROWS) else { return Ok(None) };
+            if count > 0 {
+                let end = (*start as u64).saturating_add(count as u64);
+                if previous_end.is_some_and(|previous| (*start as u64) < previous) {
+                    return Ok(None);
+                }
+                previous_end = Some(end);
+            }
+            requested_rows = next;
+        }
+        if requested_rows.checked_mul(row).is_none_or(|bytes| bytes > MAX_COMPACT_XREF_BYTES) {
+            return Ok(None);
+        }
+        let raw = stream.decoded_within(MAX_XREF_OBJECTS.saturating_mul(row).min(self.stream_limit).min(MAX_COMPACT_XREF_BYTES))?;
+        if raw.capacity() > MAX_COMPACT_XREF_BYTES {
+            return Ok(None);
+        }
+        let mut ranges = Vec::new();
+        let mut row_start = 0usize;
+        let available_rows = raw.len() / row;
+        for pair in index.chunks(2) {
+            let [start, count] = pair else { break };
+            let range_start = *start as u32;
+            let Ok(requested) = usize::try_from(*count) else { return Ok(None) };
+            let range_count = requested.min(available_rows.saturating_sub(row_start));
+            if range_count > 0 {
+                let Ok(range_count_u32) = u32::try_from(range_count) else { return Ok(None) };
+                let Some(byte_offset) = row_start.checked_mul(row) else { return Ok(None) };
+                ranges.push(XrefRange { start: range_start, count: range_count_u32, offset: byte_offset, stride: row });
+            }
+            let Some(next) = row_start.checked_add(range_count) else { return Ok(None) };
+            row_start = next;
+        }
+        // Rows the materialized reader sets aside (reserved types, offset 0) are left to it.
+        for range in &ranges {
+            for i in 0..range.count as usize {
+                let at = range.offset + i * row;
+                let Some(r) = raw.get(at..at + row) else { break };
+                let field = |from: usize, width: usize, default: u64| -> u64 {
+                    if width == 0 {
+                        return default;
+                    }
+                    r[from..from + width].iter().fold(0u64, |acc, byte| acc << 8 | u64::from(*byte))
+                };
+                let kind = field(0, widths[0], 1);
+                let offset = field(widths[0], widths[1], 0);
+                if kind > 2 || (kind == 1 && offset == 0 && range.start + i as u32 != 0) {
+                    return Ok(None);
+                }
+            }
+        }
+        let max_num = ranges.iter().filter_map(|range| range.start.checked_add(range.count.saturating_sub(1))).max().unwrap_or(0);
+        let row_count = row_start;
+        let section = XrefSection {
+            data: XrefSectionData::Stream { bytes: Arc::new(raw), widths },
+            ranges,
+            row_count,
+            max_num,
+            has_entries: false,
+            renumbered: false,
+        };
+        let has_entries = section.has_any_entry();
+        let section = XrefSection { has_entries, ..section };
+        Ok(Some((section, stream.dict.clone(), true)))
+    }
+
+    #[allow(clippy::type_complexity)]
+    pub(super) fn read_xref_chain_materialized(
+        &self,
+        log: &mut Vec<String>,
+    ) -> Result<(BTreeMap<u32, XrefEntry>, Dict, Vec<Revision>, Vec<(u64, u32)>), CosError> {
+        let data = &self.data;
+        let tail_start = data.len().saturating_sub(4096);
+        let sx = rfind(data, b"startxref", tail_start).ok_or(CosError::Syntax { offset: data.len(), detail: "no startxref".into() })?;
+        let mut lx = Lexer::new(data, sx + 9);
+        let first = match lx.object() {
+            Ok(Object::Int(n)) if n >= 0 => n as u64,
+            _ => return Err(CosError::Syntax { offset: sx, detail: "bad startxref value".into() }),
+        };
+        let mut entries = BTreeMap::new();
+        let mut trailer: Option<Dict> = None;
+        let mut revisions = Vec::new();
+        let mut oddities = Vec::new();
+        let mut visited = HashSet::new();
+        // Hybrid streams already read, by offset: their entries, or `None` when unreadable. A newer
+        // section has merged every entry of one into `entries`, so an older section that names it
+        // again only has its own table compared with them, without decoding the stream again.
+        // At most MAX_XREF_OBJECTS entries are kept in all; a stream past that is read again.
+        let mut hybrids: HashMap<i64, Option<BTreeMap<u32, XrefEntry>>> = HashMap::new();
+        let (mut hybrid_rows, mut noted) = (0usize, HashSet::new());
+        let mut next = Some(first);
+        while let Some(off) = next.take() {
+            if !visited.insert(off) || visited.len() > 10_000 {
+                log.push(format!("cross-reference chain loops at offset {off}; stopped"));
+                break;
+            }
+            // This section's own entries; older sections only fill what newer ones left out.
+            let mut sect = BTreeMap::new();
+            // Object numbers whose entry in this section was set aside ([`Self::xref_oddities`]).
+            let mut odd = Vec::new();
+            let ((sect_trailer, is_stream), header_relative) = match self.read_section(off as usize, &mut sect, &mut odd, log) {
+                Ok(v) => (v, false),
+                Err(e) if self.header_offset > 0 => {
+                    log.push(format!("xref at {off} unreadable ({e}); retrying relative to the header"));
+                    sect.clear();
+                    odd.clear();
+                    (self.read_section(off as usize + self.header_offset, &mut sect, &mut odd, log)?, true)
+                }
+                Err(e) => {
+                    // An unreadable older section loses every object only it locates (the page
+                    // tree, often): rebuild from object headers, as readers do (#1656).
+                    if !revisions.is_empty() {
+                        log.push(format!("older cross-reference section at {off} is unreadable: {e}"));
+                    }
+                    return Err(e);
+                }
+            };
+            revisions.push(Revision { xref_offset: off, is_stream, header_relative });
+            // Hybrid files (§7.5.8.4): the /XRefStm entries supplement the table and replace the
+            // free entries it gives objects only a cross-reference stream can locate.
+            let hybrid = sect_trailer.int(b"XRefStm").filter(|x| *x >= 0);
+            if let Some((x, read)) = hybrid.and_then(|x| hybrids.get(&x).map(|read| (x, read))) {
+                if noted.insert(x) {
+                    log.push(format!("hybrid /XRefStm at {x} named again by the section at {off}; read once"));
+                }
+                if let Some(stm) = read {
+                    for (num, old) in &sect {
+                        // The table places the object somewhere other than the stream does.
+                        if !matches!(old, XrefEntry::Free { .. }) && stm.get(num).is_some_and(|e| e != old) {
+                            odd.push(*num);
+                        }
+                    }
+                }
+            } else if let Some(x) = hybrid {
+                let mut stm = BTreeMap::new();
+                let read = match self.read_section(x as usize, &mut stm, &mut odd, log) {
+                    Ok(_) => {
+                        for (&num, &e) in &stm {
+                            match sect.get(&num) {
+                                None | Some(XrefEntry::Free { .. }) => {
+                                    sect.insert(num, e);
+                                }
+                                // The table already places the object somewhere else.
+                                Some(old) if *old != e => odd.push(num),
+                                Some(_) => {}
+                            }
+                        }
+                        Some(stm)
+                    }
+                    Err(e) => {
+                        log.push(format!("hybrid /XRefStm at {x} unreadable: {e}"));
+                        None
+                    }
+                };
+                let rows = read.as_ref().map_or(0, BTreeMap::len);
+                if let Some(total) = hybrid_rows.checked_add(rows).filter(|total| *total <= MAX_XREF_OBJECTS) {
+                    hybrid_rows = total;
+                    hybrids.insert(x, read);
+                }
+            }
+            oddities.extend(odd.into_iter().map(|num| (off, num)));
+            for (num, e) in sect {
+                entries.entry(num).or_insert(e);
+            }
+            next = prev_offset(data, &sect_trailer, off, |num| entries.get(&num).copied(), log);
+            if trailer.is_none() {
+                trailer = Some(sect_trailer);
+            }
+        }
+        revisions.reverse();
+        let mut trailer = trailer.ok_or(CosError::Syntax { offset: 0, detail: "no trailer".into() })?;
+        for k in [&b"Prev"[..], b"XRefStm", b"Type", b"W", b"Index", b"Filter", b"DecodeParms", b"Length"] {
+            trailer.remove(k);
+        }
+        Ok((entries, trailer, revisions, oddities))
+    }
+
+    /// Read one section at `off`, adding entries not already known (newer sections win). `odd`
+    /// collects the object numbers whose entry here is set aside ([`Self::xref_oddities`]).
+    fn read_section(
+        &self,
+        off: usize,
+        entries: &mut BTreeMap<u32, XrefEntry>,
+        odd: &mut Vec<u32>,
+        log: &mut Vec<String>,
+    ) -> Result<(Dict, bool), CosError> {
+        #[cfg(test)]
+        SECTION_READS.with(|c| c.set(c.get() + 1));
+        let data = &self.data;
+        let mut lx = Lexer::new(data, off);
+        if lx.eat_keyword(b"xref") {
+            loop {
+                lx.skip_ws();
+                if lx.eat_keyword(b"trailer") {
+                    let t = lx.object()?;
+                    let d = t.as_dict().cloned().ok_or(CosError::Syntax { offset: lx.pos, detail: "trailer is not a dictionary".into() })?;
+                    return Ok((d, false));
+                }
+                let (Ok(Object::Int(start)), Ok(Object::Int(count))) = (lx.object(), lx.object()) else {
+                    return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref subsection header".into() });
+                };
+                if !valid_xref_range(start, count) || count > 10_000_000 {
+                    return Err(CosError::Syntax { offset: lx.pos, detail: "invalid xref object range".into() });
+                }
+                let shifted = subsection_start(data, self.header_offset, lx.pos, start, count);
+                if shifted != start {
+                    log.push(format!("xref subsection at {off} is numbered from 1 but begins with object 0's entry; read from 0"));
+                }
+                let start = shifted;
+                for i in 0..count {
+                    lx.skip_ws();
+                    let o = lx.token();
+                    lx.skip_ws();
+                    let g = lx.token();
+                    lx.skip_ws();
+                    let kind = lx.token();
+                    let num = (start + i) as u32;
+                    let offset = std::str::from_utf8(o).ok().and_then(|s| s.parse::<u64>().ok());
+                    let generation = std::str::from_utf8(g).ok().and_then(|s| s.parse::<u32>().ok()).unwrap_or(0).min(u16::MAX as u32) as u16;
+                    let entry = match (kind, offset) {
+                        (b"n", Some(offset)) => XrefEntry::InFile { offset, generation },
+                        (b"f", _) => XrefEntry::Free { next_generation: generation },
+                        _ => return Err(CosError::Syntax { offset: lx.pos, detail: "bad xref entry".into() }),
+                    };
+                    // Offset 0 "in use" entries are a known producer bug: ignore them. (Object 0
+                    // is never a real object, so its entry cannot mislead anyone.)
+                    if matches!(entry, XrefEntry::InFile { offset: 0, .. }) {
+                        if num != 0 {
+                            odd.push(num);
+                        }
+                        continue;
+                    }
+                    if *entries.entry(num).or_insert(entry) != entry {
+                        odd.push(num);
+                    }
+                }
+            }
+        }
+        // Cross-reference stream.
+        let (_, obj) = parse_indirect(data, off, &|_| None)?;
+        let Object::Stream(s) = obj else { return Err(CosError::Syntax { offset: off, detail: "expected xref table or stream".into() }) };
+        if s.dict.name(b"Type") != Some(b"XRef") {
+            return Err(CosError::Syntax { offset: off, detail: "stream at startxref is not /Type /XRef".into() });
+        }
+        let w: Vec<usize> = s
+            .dict
+            .get(b"W")
+            .and_then(Object::as_array)
+            .map(|a| a.iter().map(|x| x.as_int().unwrap_or(0).clamp(0, 8) as usize).collect())
+            .unwrap_or_default();
+        if w.len() < 3 {
+            return Err(CosError::Syntax { offset: off, detail: "xref stream /W invalid".into() });
+        }
+        let size = s.dict.int(b"Size").unwrap_or(0).max(0);
+        let index: Vec<i64> = match s.dict.get(b"Index").and_then(Object::as_array) {
+            Some(a) => a.iter().filter_map(Object::as_int).collect(),
+            None => vec![0, size],
+        };
+        let row = w[0] + w[1] + w[2];
+        if row == 0 {
+            return Err(CosError::Syntax { offset: off, detail: "xref stream row width 0".into() });
+        }
+        // One row per object, and a document has at most 8,388,607 indirect objects (the classic
+        // implementation limit): decoding more than that (about 200 MB at the widest rows) is a
+        // decompression bomb, not cross-reference data. The section is then reconstructed.
+        let raw = s.decoded_within(MAX_XREF_OBJECTS.saturating_mul(row).min(self.stream_limit))?;
+        let field = |r: &[u8], from: usize, len: usize, default: u64| -> u64 {
+            if len == 0 {
+                return default;
+            }
+            r[from..from + len].iter().fold(0u64, |acc, b| acc << 8 | *b as u64)
+        };
+        let mut rows = raw.chunks_exact(row);
+        for pair in index.chunks(2) {
+            let [start, count] = pair else { break };
+            if !valid_xref_range(*start, *count) {
+                return Err(CosError::Syntax { offset: off, detail: "invalid xref object range".into() });
+            }
+            for i in 0..*count {
+                let Some(r) = rows.next() else { break };
+                let t = field(r, 0, w[0], 1);
+                let a = field(r, w[0], w[1], 0);
+                let b = field(r, w[0] + w[1], w[2], 0);
+                let num = (*start + i) as u32;
+                let entry = match t {
+                    0 => XrefEntry::Free { next_generation: b.min(u16::MAX as u64) as u16 },
+                    1 => XrefEntry::InFile { offset: a, generation: b.min(u16::MAX as u64) as u16 },
+                    2 => XrefEntry::InStream { stream: a.min(u32::MAX as u64) as u32, index: b.min(u32::MAX as u64) as u32 },
+                    // Reserved types are treated as null references (§7.5.8.3).
+                    _ => {
+                        odd.push(num);
+                        continue;
+                    }
+                };
+                if matches!(entry, XrefEntry::InFile { offset: 0, .. }) {
+                    if num != 0 {
+                        odd.push(num);
+                    }
+                    continue;
+                }
+                if *entries.entry(num).or_insert(entry) != entry {
+                    odd.push(num);
+                }
+            }
+        }
+        Ok((s.dict.clone(), true))
+    }
+
+    /// Cross-reference data that leaves out objects the file contains: a subsection numbered one
+    /// too low (object 0 in use, the last object without an entry), or an in-use entry at offset 0
+    /// that nothing else replaces. (A number no section lists is not evidence: it is a null
+    /// object, §7.3.10, and valid files have them below an oversized `/Size`.) Viewers rebuild
+    /// the table and show these objects; reading them as null would drop them from every copy.
+    /// When one of those shows, the file is scanned once for object headers, and wrong offsets
+    /// are looked up there (`load`). Only the numbers the damage leaves out take the last
+    /// header's location: one whose entry was set aside, or the last object of a subsection
+    /// numbered one too low. Any other unlisted number stays null, and existing
+    /// entries are never replaced: an object freed by an update stays freed.
+    pub(super) fn fill_xref_gaps(&mut self, log: &mut Vec<String>) {
+        let entries = &self.entries;
+        let shifted = matches!(entries.lookup(0, &self.data), Some(XrefEntry::InFile { .. }));
+        let set_aside = self.xref_oddities.iter().any(|(_, num)| entries.lookup(*num, &self.data).is_none());
+        if !(shifted || set_aside) {
+            return;
+        }
+        let mut located = BTreeMap::new();
+        for (num, offset, generation, _) in object_headers(&self.data) {
+            located.insert(num, (offset, generation));
+        }
+        let mut filled = entries.to_map(&self.data);
+        // A subsection `0 N` whose rows are those of objects 1 to N leaves out object N, whatever
+        // newer sections say about its neighbours.
+        let past_shift: HashSet<u32> = if shifted {
+            self.revisions
+                .iter()
+                .filter(|r| !r.is_stream)
+                .filter_map(|r| usize::try_from(r.xref_offset).ok().map(|o| if r.header_relative { o.saturating_add(self.header_offset) } else { o }))
+                .filter_map(|at| shifted_subsection_end(&self.data, at))
+                .collect()
+        } else {
+            HashSet::new()
+        };
+        let odd: HashSet<u32> = self.xref_oddities.iter().map(|(_, n)| *n).collect();
+        let mut found = 0usize;
+        for (&num, &(offset, generation)) in &located {
+            let left_out = past_shift.contains(&num) || odd.contains(&num);
+            if num != 0 && !filled.contains_key(&num) && left_out {
+                filled.insert(num, XrefEntry::InFile { offset, generation });
+                found += 1;
+            }
+        }
+        if found > 0 {
+            log.push(format!("the cross-reference data leaves out {found} objects the file contains; located them by their object headers"));
+            self.entries = Arc::new(XrefIndex::Materialized(Arc::new(filled)));
+        }
+        self.located = Arc::new(located);
+    }
+
+    /// Rebuild the cross-reference index by scanning for `N G obj` headers (§7.5.4 recovery).
+    pub(super) fn reconstruct(&mut self, log: &mut Vec<String>) -> Result<(), CosError> {
+        let data = self.data.clone();
+        let mut entries: BTreeMap<u32, XrefEntry> = BTreeMap::new();
+        let mut objstms = Vec::new();
+        // Offsets of objects that may be cross-reference streams: their dictionaries are the
+        // trailers of files that have no `trailer` keyword (§7.5.8).
+        let mut xref_streams = Vec::new();
+        for (num, offset, generation, body) in object_headers(&data) {
+            entries.insert(num, XrefEntry::InFile { offset, generation });
+            objstms.push(num);
+            if find(&data, b"/XRef", body, body.saturating_add(1024)).is_some()
+                && let Ok(at) = usize::try_from(offset)
+            {
+                xref_streams.push(at);
+            }
+        }
+        if entries.is_empty() {
+            return Err(CosError::Syntax { offset: 0, detail: "no objects found".into() });
+        }
+        self.entries = Arc::new(XrefIndex::Materialized(Arc::new(entries.clone())));
+        self.cache.lock().map_err(|_| CosError::Poisoned)?.clear();
+        // Objects inside object streams.
+        for num in objstms {
+            if let Ok(o) = self.try_get(num)
+                && let Object::Stream(s) = &*o
+                && s.dict.name(b"Type") == Some(b"ObjStm")
+                && let Ok(stm) = self.objstm(num)
+            {
+                for (idx, member) in stm.index.iter().enumerate() {
+                    if let Some((inner, _)) = member {
+                        entries.entry(*inner).or_insert(XrefEntry::InStream { stream: num, index: idx as u32 });
+                    }
+                }
+            }
+        }
+        let object_count = entries.len();
+        self.entries = Arc::new(XrefIndex::Materialized(Arc::new(entries)));
+        self.cache.lock().map_err(|_| CosError::Poisoned)?.clear();
+        // Trailer: the last `trailer` dictionary or cross-reference stream dictionary with a
+        // usable /Root (last in the file, whichever kind), else the catalog itself. One whose
+        // /Root is a catalog (as `root_is_catalog` judges it) beats one whose /Root is another
+        // dictionary, such as /Info, wherever it is; an FDF's /Root (no /Type, no /Pages) still
+        // counts when nothing better is there.
+        // A file whose only trailers are cross-reference streams (and whose `startxref` is gone
+        // or points nowhere) keeps its /Info, /ID and /Encrypt this way.
+        let rank = |at: usize, d: &Dict| {
+            let root = self.try_get(d.reference(b"Root")?.num).ok()?;
+            let Object::Dict(c) = &*root else { return None };
+            Some((c.name(b"Type") == Some(b"Catalog") || c.contains(b"Pages"), at))
+        };
+        let mut trailer: Option<((bool, usize), Dict)> = None;
+        let mut from = 0;
+        while let Some(p) = find(&data, b"trailer", from, data.len()) {
+            from = p + 7;
+            let mut lx = Lexer::new(&data, from);
+            if let Ok(Object::Dict(d)) = lx.object()
+                && let Some(r) = rank(p, &d)
+                && trailer.as_ref().is_none_or(|(best, _)| r > *best)
+            {
+                trailer = Some((r, d));
+            }
+        }
+        for at in xref_streams {
+            if trailer.as_ref().is_some_and(|((catalog, p), _)| *catalog && *p > at) {
+                continue;
+            }
+            if let Ok((_, Object::Stream(s))) = parse_indirect_shared(&data, at, &|_| None, &self.endstreams)
+                && s.dict.name(b"Type") == Some(b"XRef")
+                && let Some(r) = rank(at, &s.dict)
+                && trailer.as_ref().is_none_or(|(best, _)| r > *best)
+            {
+                trailer = Some((r, s.dict));
+            }
+        }
+        let trailer = match trailer {
+            Some((_, t)) => t,
+            None => {
+                let catalog = self
+                    .entries
+                    .object_numbers(&self.data)
+                    .into_iter()
+                    .find(|n| matches!(self.try_get(*n).as_deref(), Ok(Object::Dict(d)) if d.name(b"Type") == Some(b"Catalog")));
+                let Some(c) = catalog else { return Err(CosError::Syntax { offset: 0, detail: "no document catalog found".into() }) };
+                let mut t = Dict::new();
+                t.set(b"Root".to_vec(), Object::Ref(ObjRef::new(c, self.generation(c))));
+                t
+            }
+        };
+        let mut trailer = trailer;
+        // What a cross-reference stream's dictionary carries for itself goes, as the chain
+        // readers drop it: a save writes its own.
+        for k in [&b"Prev"[..], b"XRefStm", b"Type", b"W", b"Index", b"Filter", b"DecodeParms", b"Length"] {
+            trailer.remove(k);
+        }
+        self.trailer = trailer;
+        self.revisions = Arc::new(Vec::new());
+        log.push(format!("rebuilt cross-reference index from {object_count} object headers"));
+        Ok(())
+    }
+}
+
+/// For a classic table at `at` whose first subsection is `0 N` and opens with an in-use row
+/// (the rows of objects 1 to N), the number N its rows really end at.
+fn shifted_subsection_end(data: &[u8], at: usize) -> Option<u32> {
+    let mut lx = Lexer::new(data, at);
+    if !lx.eat_keyword(b"xref") {
+        return None;
+    }
+    let (Ok(Object::Int(0)), Ok(Object::Int(count))) = (lx.object(), lx.object()) else { return None };
+    lx.skip_ws();
+    let offset = std::str::from_utf8(lx.token()).ok().and_then(|s| s.parse::<u64>().ok());
+    lx.skip_ws();
+    lx.token();
+    lx.skip_ws();
+    match (offset, lx.token()) {
+        (Some(offset), b"n") if offset != 0 => u32::try_from(count).ok().filter(|n| *n > 0),
+        _ => None,
+    }
+}
+
+/// Every `N G obj` header in `data`, in file order, as (number, offset, generation, position
+/// after `obj`).
+fn object_headers(data: &[u8]) -> Vec<(u32, u64, u16, usize)> {
+    let mut headers = Vec::new();
+    let mut i = 0;
+    while i < data.len() {
+        // Object headers start at a line start (or after whitespace).
+        let at_start = i == 0 || is_whitespace(data[i - 1]) || data[i - 1] == b'>';
+        if at_start && data[i].is_ascii_digit() {
+            let mut lx = Lexer::new(data, i);
+            let n = lx.token();
+            lx.skip_ws();
+            let g = lx.token();
+            if !n.is_empty() && !g.is_empty() && n.iter().all(u8::is_ascii_digit) && g.iter().all(u8::is_ascii_digit) && lx.eat_keyword(b"obj") {
+                let num = std::str::from_utf8(n).ok().and_then(|s| s.parse::<u32>().ok());
+                let generation = std::str::from_utf8(g).ok().and_then(|s| s.parse::<u16>().ok()).unwrap_or(0);
+                if let Some(num) = num {
+                    headers.push((num, i as u64, generation, lx.pos));
+                }
+                i = lx.pos;
+                continue;
+            }
+        }
+        i += 1;
+    }
+    headers
+}
+
+/// The offset of the section before the one whose trailer this is (`/Prev`), if any. Some writers
+/// give it as a reference, `N 0 R`. When the sections read so far (`lookup`) place that object
+/// and it holds an offset (iText's `indirectPrev.pdf`), that is the offset; otherwise, as the
+/// tiff2pdf files in JHOVE's PDF-HUL-157 cases need, the sections before are at N. Either way the
+/// reference is noted. Any other value that is not an offset is noted and ends the chain.
+fn prev_offset(data: &[u8], trailer: &Dict, off: u64, lookup: impl Fn(u32) -> Option<XrefEntry>, log: &mut Vec<String>) -> Option<u64> {
+    match trailer.get(b"Prev") {
+        Some(Object::Int(p)) if *p >= 0 => Some(*p as u64),
+        Some(Object::Ref(r)) => {
+            let held = match lookup(r.num) {
+                Some(XrefEntry::InFile { offset, generation }) if generation == r.generation => {
+                    usize::try_from(offset).ok().and_then(|at| parse_indirect(data, at, &|_| None).ok()).and_then(|(at, value)| match value {
+                        Object::Int(p) if at == *r && p >= 0 => Some(p as u64),
+                        _ => None,
+                    })
+                }
+                _ => None,
+            };
+            match held {
+                Some(p) => {
+                    log.push(format!(
+                        "the trailer at {off} gives /Prev as the reference {} {} R; reading the offset {p} it holds",
+                        r.num, r.generation
+                    ));
+                    Some(p)
+                }
+                None => {
+                    log.push(format!(
+                        "the trailer at {off} gives /Prev as the reference {} {} R; reading it as offset {}",
+                        r.num, r.generation, r.num
+                    ));
+                    Some(u64::from(r.num))
+                }
+            }
+        }
+        Some(_) => {
+            log.push(format!("the trailer at {off} has a /Prev that is not an offset; the sections before it are unreachable"));
+            None
+        }
+        None => None,
+    }
+}
+
+pub(crate) fn find(hay: &[u8], needle: &[u8], from: usize, to: usize) -> Option<usize> {
+    let to = to.min(hay.len());
+    if from >= to || needle.is_empty() || to - from < needle.len() {
+        return None;
+    }
+    hay[from..to].windows(needle.len()).position(|w| w == needle).map(|p| p + from)
+}
+
+pub(super) fn rfind(hay: &[u8], needle: &[u8], from: usize) -> Option<usize> {
+    if hay.len() < needle.len() {
+        return None;
+    }
+    (from..=hay.len() - needle.len()).rev().find(|&i| &hay[i..i + needle.len()] == needle)
+}
+
+/// A file identifier derived from entropy supplied by the caller.
+pub(super) fn generated_id(seed: &[u8; 32]) -> Vec<u8> {
+    use std::hash::{Hash, Hasher};
+    let mut out = Vec::new();
+    for i in 0..2u8 {
+        let mut h = std::collections::hash_map::DefaultHasher::new();
+        (seed, i, b"pdfcraft id").hash(&mut h);
+        out.extend_from_slice(&h.finish().to_be_bytes());
+    }
+    out
+}
+
+/// The object number a classic xref subsection really starts at. A common producer bug heads the
+/// table `1 n` and then writes object 0's free entry (`0000000000 65535 f`) as its first row, so
+/// every row would be read one number too high and object 1 as free. Such a subsection is read
+/// from 0 when its second row, read that way, locates an object that is indeed numbered 1, at
+/// that offset or, as `load` reads offsets, relative to a header shifted by `header_offset`.
+/// `rows` is the position just after the subsection header.
+fn subsection_start(data: &[u8], header_offset: usize, rows: usize, start: i64, count: i64) -> i64 {
+    if start != 1 || count < 2 {
+        return start;
+    }
+    let mut lx = Lexer::new(data, rows);
+    let mut row = || {
+        lx.skip_ws();
+        let offset = std::str::from_utf8(lx.token()).ok().and_then(|s| s.parse::<u64>().ok());
+        lx.skip_ws();
+        let generation = std::str::from_utf8(lx.token()).ok().and_then(|s| s.parse::<u32>().ok());
+        lx.skip_ws();
+        (offset, generation, lx.token() == b"f")
+    };
+    let (Some(0), Some(65535), true) = row() else { return start };
+    let (Some(second), _, false) = row() else { return start };
+    let object_one = |at: usize| {
+        if at >= data.len() {
+            return false;
+        }
+        let mut obj = Lexer::new(data, at);
+        matches!((obj.object(), obj.object()), (Ok(Object::Int(1)), Ok(Object::Int(_)))) && obj.eat_keyword(b"obj")
+    };
+    let Ok(second) = usize::try_from(second) else { return start };
+    if object_one(second) || (header_offset != 0 && object_one(second.saturating_add(header_offset))) { 0 } else { start }
+}
+
+/// Object numbers must fit the representation used by references and the xref map.
+/// Validate the whole subsection before adding entries, so neither arithmetic overflow nor
+/// truncation can turn a damaged range into entries for unrelated objects.
+fn valid_xref_range(start: i64, count: i64) -> bool {
+    u32::try_from(start).is_ok() && count >= 0 && start.checked_add(count).is_some_and(|end| end <= i64::from(u32::MAX) + 1)
+}
+
+/// The most indirect objects a document can have (the classic implementation limit, ISO
+/// 32000-1 Annex C): it bounds how much data a cross-reference stream can hold.
+const MAX_XREF_OBJECTS: usize = 8_388_607;
diff --git a/crates/cos/src/document/state.rs b/crates/cos/src/document/state.rs
new file mode 100644
index 0000000000..30f193e4e6
--- /dev/null
+++ b/crates/cos/src/document/state.rs
@@ -0,0 +1,210 @@
+use super::xref::XrefEntry;
+use super::*;
+
+thread_local! {
+    /// The objects being loaded on this thread, innermost last (see `Document::try_get`).
+    static LOADING: std::cell::RefCell<Vec<u32>> = const { std::cell::RefCell::new(Vec::new()) };
+    /// Indirect `/Length` values resolved during the current outermost load: a damaged file
+    /// retries a parse several ways, and each retry would resolve the same lengths again
+    /// (exponential in the chain of streams whose lengths point at further streams).
+    pub(super) static LENGTHS: std::cell::RefCell<HashMap<u32, Option<i64>>> = std::cell::RefCell::new(HashMap::new());
+}
+
+/// Marks an object as being loaded on this thread. Loading can re-enter (indirect stream
+/// `/Length`, object streams): an object already being loaded is a cycle, and the nesting is
+/// bounded as well.
+pub(super) struct LoadGuard;
+
+impl LoadGuard {
+    const MAX: usize = 32;
+
+    pub(super) fn enter(num: u32) -> Option<Self> {
+        LOADING.with(|l| {
+            let mut l = l.borrow_mut();
+            if l.len() >= Self::MAX || l.contains(&num) {
+                return None;
+            }
+            l.push(num);
+            Some(LoadGuard)
+        })
+    }
+}
+
+impl Drop for LoadGuard {
+    fn drop(&mut self) {
+        let outermost = LOADING.with(|l| {
+            let mut l = l.borrow_mut();
+            l.pop();
+            l.is_empty()
+        });
+        if outermost {
+            LENGTHS.with(|m| m.borrow_mut().clear());
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct ObjStm {
+    /// One slot per member in stream order, since cross-reference entries name a member by its
+    /// position: (object number, byte offset within `data`), or `None` for a member whose number
+    /// or offset is unusable ([`objstm_member`]).
+    pub(super) index: Vec<Option<(u32, usize)>>,
+    pub(super) data: Arc<Vec<u8>>,
+}
+
+/// Where member `num` of an object stream starts: its `offset` past `/First` (`first`), when the
+/// number is an object number and the start lies inside the decoded `len` bytes. Checked on every
+/// target, so a 32-bit build neither truncates nor wraps a large `/First` or offset (#1815).
+pub(super) fn objstm_member(num: i64, offset: i64, first: Option<usize>, len: usize) -> Option<(u32, usize)> {
+    let num = u32::try_from(num).ok()?;
+    let start = first?.checked_add(usize::try_from(offset).ok()?)?;
+    (start < len).then_some((num, start))
+}
+
+/// Where an overlay slot came from.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Slot {
+    Set(u16, Arc<Object>),
+    Freed(u16),
+}
+
+/// An immutable input/decode context shared by document clones. Holding this identity
+/// retains neither the input bytes nor the parsed document. Weak ownership prevents an
+/// expired identity from matching a later allocation at the same address.
+#[derive(Clone, Debug)]
+pub struct SourceIdentity(pub(super) Weak<()>);
+
+impl PartialEq for SourceIdentity {
+    fn eq(&self, other: &Self) -> bool {
+        self.0.ptr_eq(&other.0)
+    }
+}
+
+impl Eq for SourceIdentity {}
+
+/// What a document reads as: its source ([`SourceIdentity`]), its trailer and every object changed
+/// since it was opened. A clone, or a snapshot that undo restores, has the same state, and every
+/// change makes a different one. Changed objects are compared as allocations, which the state
+/// keeps alive, so a later object can't take an address one of them had.
+#[derive(Clone)]
+pub struct ReadState {
+    pub(super) source: SourceIdentity,
+    pub(super) trailer: Dict,
+    pub(super) overlay: BTreeMap<u32, Slot>,
+}
+
+impl ReadState {
+    /// Whether `doc` reads as this state.
+    pub fn matches(&self, doc: &Document) -> bool {
+        self.source == doc.source_identity()
+            && self.trailer == doc.trailer
+            && self.overlay.len() == doc.overlay.len()
+            && self.overlay.iter().zip(&doc.overlay).all(|((a, x), (b, y))| {
+                a == b
+                    && match (x, y) {
+                        (Slot::Set(g, o), Slot::Set(h, p)) => g == h && Arc::ptr_eq(o, p),
+                        (Slot::Freed(g), Slot::Freed(h)) => g == h,
+                        _ => false,
+                    }
+            })
+    }
+}
+
+impl std::fmt::Debug for ReadState {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ReadState").field("changed_objects", &self.overlay.len()).finish_non_exhaustive()
+    }
+}
+
+/// A temporary reader for whole-document work. Its caches never populate the editor or
+/// undo snapshots. Returned objects survive cache eviction; a stream read from the file is a
+/// view into the input bytes (it keeps the whole input alive while held, not a copy).
+pub(crate) struct ObjectReader {
+    pub(crate) document: Document,
+    pub(super) decoded_count: usize,
+}
+
+impl ObjectReader {
+    pub(super) const OBJECTS: usize = 128;
+    pub(super) const STREAM_BYTES: usize = 8 * 1024 * 1024;
+
+    pub(crate) fn get(&mut self, reference: ObjRef) -> Arc<Object> {
+        self.try_get(reference).unwrap_or_else(|_| Arc::new(Object::Null))
+    }
+
+    pub(crate) fn try_get(&mut self, reference: ObjRef) -> Result<Arc<Object>, CosError> {
+        let object = self.document.try_get(reference.num);
+        // A missed eviction here only costs a re-parse, so never fail the read on a poisoned
+        // lock. The editing-cache evictors propagate instead; they guard user edits.
+        if let Ok(mut streams) = self.document.objstms.lock() {
+            // Only insertion changes this private cache between reads. Most neighboring
+            // objects reuse a decoded stream: do not sum the whole store for every object.
+            if streams.len() != self.decoded_count {
+                let bytes = streams.values().fold(0usize, |bytes, stream| {
+                    bytes
+                        .saturating_add(stream.data.capacity())
+                        .saturating_add(stream.index.capacity().saturating_mul(std::mem::size_of::<Option<(u32, usize)>>()))
+                });
+                if bytes > Self::STREAM_BYTES || streams.len() >= Self::OBJECTS {
+                    // Retain one oversized active stream so its next object does not require
+                    // decoding it again. That stream still obeys the document's decode cap.
+                    let current = match self.document.xref_entry(reference.num) {
+                        Some(XrefEntry::InStream { stream, .. }) => Some(stream),
+                        _ => None,
+                    };
+                    streams.retain(|num, _| Some(*num) == current);
+                }
+                self.decoded_count = streams.len();
+            }
+        }
+        // Parsed objects stay cached (an indirect /Length or a dictionary read again costs a
+        // lookup, not a parse) until the cache passes its object count or holds more than
+        // STREAM_BYTES of data of its own. Streams read from the file are views into the
+        // input bytes, which the document keeps anyway, so they don't count; decrypted
+        // streams and strings do. Checked after failed loads too: resolving a /Length may
+        // have cached large objects.
+        if let Ok(mut cache) = self.document.cache.lock() {
+            let data = &self.document.data;
+            if cache.len() >= Self::OBJECTS || cache.values().fold(0usize, |n, o| n.saturating_add(owned_bytes(o, data, 0))) > Self::STREAM_BYTES {
+                cache.clear();
+            }
+        }
+        object
+    }
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Cross-reference sections read on this thread.
+    pub(super) static SECTION_READS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// Nesting [`owned_bytes`] walks: past the parser's own nesting limit, so every parsed object
+/// is measured in full.
+const OWNED_BYTES_DEPTH: usize = 256;
+
+/// Bytes `object` holds of its own: string and stream data that is not a view into `data`
+/// (the input file). An object nested deeper than [`OWNED_BYTES_DEPTH`] cannot be measured
+/// and counts as too large to keep.
+pub(super) fn owned_bytes(object: &Object, data: &Arc<Vec<u8>>, depth: usize) -> usize {
+    if depth > OWNED_BYTES_DEPTH {
+        return usize::MAX;
+    }
+    match object {
+        Object::String(s) => s.bytes.len(),
+        Object::Stream(s) => {
+            let own = if s.raw.shares(data) { 0 } else { s.raw.len() };
+            s.dict.iter().fold(own, |n, (_, v)| n.saturating_add(owned_bytes(v, data, depth + 1)))
+        }
+        Object::Array(a) => a.iter().fold(0usize, |n, v| n.saturating_add(owned_bytes(v, data, depth + 1))),
+        Object::Dict(d) => d.iter().fold(0usize, |n, (_, v)| n.saturating_add(owned_bytes(v, data, depth + 1))),
+        _ => 0,
+    }
+}
+
+/// How an encrypted document is opened: with a password, or with the file key of a document
+/// that has the same encryption (an earlier revision of the same file).
+pub(super) enum Credentials<'a> {
+    Password(Option<&'a str>),
+    Handler { handler: &'a Arc<pdfcraft_crypt::SecurityHandler>, id0: Vec<u8> },
+}
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
new file mode 100644
index 0000000000..bf22f23d76
--- /dev/null
+++ b/crates/cos/src/document/tests.rs
@@ -0,0 +1,1287 @@
+use super::*;
+
+#[test]
+fn a_read_state_matches_a_clone_and_no_changed_document() {
+    let mut doc = Document::new_empty();
+    let a = doc.add(Object::Int(1));
+    let state = doc.read_state();
+    let snapshot = doc.clone();
+    assert!(state.matches(&doc) && state.matches(&snapshot));
+    // The same value set again is still a change: another allocation.
+    doc.set(a, Object::Int(1));
+    assert!(!state.matches(&doc) && state.matches(&snapshot));
+    let edited = doc.read_state();
+    doc.free(a);
+    assert!(!edited.matches(&doc));
+    let mut trailer_changed = snapshot.clone();
+    trailer_changed.trailer_mut().set(b"Info".to_vec(), Object::Null);
+    assert!(!state.matches(&trailer_changed));
+    // Another document's state never matches, even with the same changes.
+    let mut other = Document::new_empty();
+    other.add(Object::Int(1));
+    assert!(!other.read_state().matches(&snapshot));
+}
+
+/// Build a classic-xref file from object bodies (object i+1 = bodies[i]).
+pub(crate) fn build(bodies: &[&str], trailer: &str) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, b) in bodies.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{b}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", bodies.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} {trailer} >>\nstartxref\n{xref}\n%%EOF\n", bodies.len() + 1).as_bytes());
+    out
+}
+
+fn assert_compact_matches_materialized(doc: &Document) {
+    assert!(matches!(doc.entries.as_ref(), XrefIndex::Compact { .. }), "valid xrefs should not retain a per-entry map");
+    let (entries, _, revisions, _) = doc.read_xref_chain_materialized(&mut Vec::new()).unwrap();
+    assert_eq!(revisions.as_slice(), doc.revisions());
+    let max = entries.keys().next_back().copied().unwrap_or(0);
+    assert_eq!(doc.entries.max_num(), max);
+    for num in 0..=max {
+        assert_eq!(doc.xref_entry(num), entries.get(&num).copied(), "object {num}");
+    }
+    let expected: Vec<_> = entries.iter().filter_map(|(&num, entry)| (!matches!(entry, XrefEntry::Free { .. })).then_some(num)).collect();
+    assert_eq!(doc.object_numbers(), expected);
+}
+
+#[test]
+fn compact_xref_tables_streams_and_revisions_match_the_materialized_reader() {
+    let classic = Document::open(Arc::new(build(
+        &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Value 9 >>"],
+        "/Root 1 0 R",
+    )))
+    .unwrap();
+    assert_compact_matches_materialized(&classic);
+
+    let mut sparse = b"%PDF-1.7\n".to_vec();
+    let root_offset = sparse.len();
+    sparse.extend_from_slice(b"1 0 obj\n<< /Type /Catalog /Pages 5 0 R >>\nendobj\n");
+    let pages_offset = sparse.len();
+    sparse.extend_from_slice(b"5 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
+    let xref = sparse.len();
+    sparse.extend_from_slice(
+        format!(
+            "xref\n0 1\n0000000000 65535 f \n1 1\n{root_offset:010} 00000 n \n5 1\n{pages_offset:010} 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n"
+        )
+        .as_bytes(),
+    );
+    let sparse = Document::open(Arc::new(sparse)).unwrap();
+    assert_eq!(sparse.object_numbers(), vec![1, 5]);
+    assert_compact_matches_materialized(&sparse);
+
+    let mut sparse_stream = b"%PDF-1.7\n".to_vec();
+    let mut offsets = [0u32; 8];
+    offsets[1] = sparse_stream.len() as u32;
+    sparse_stream.extend_from_slice(b"1 0 obj\n<< /Type /Catalog /Pages 5 0 R >>\nendobj\n");
+    offsets[5] = sparse_stream.len() as u32;
+    sparse_stream.extend_from_slice(b"5 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
+    offsets[6] = sparse_stream.len() as u32;
+    sparse_stream.extend_from_slice(b"6 0 obj\n<< /Unused true >>\nendobj\n");
+    offsets[7] = sparse_stream.len() as u32;
+    let xref_row = |kind: u8, offset: u32, generation: u16| {
+        let mut row = Vec::with_capacity(7);
+        row.push(kind);
+        row.extend_from_slice(&offset.to_be_bytes());
+        row.extend_from_slice(&generation.to_be_bytes());
+        row
+    };
+    let mut rows = Vec::new();
+    rows.extend(xref_row(0, 0, u16::MAX));
+    rows.extend(xref_row(1, offsets[1], 0));
+    rows.extend(xref_row(1, offsets[5], 0));
+    rows.extend(xref_row(1, offsets[6], 0));
+    rows.extend(xref_row(1, offsets[7], 0));
+    sparse_stream.extend_from_slice(
+        format!("7 0 obj\n<< /Type /XRef /Size 8 /Root 1 0 R /W [1 4 2] /Index [0 2 5 3] /Length {} >>\nstream\n", rows.len()).as_bytes(),
+    );
+    sparse_stream.extend_from_slice(&rows);
+    sparse_stream.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{}\n%%EOF\n", offsets[7]).as_bytes());
+    let sparse_stream = Document::open(Arc::new(sparse_stream)).unwrap();
+    assert_eq!(sparse_stream.object_numbers(), vec![1, 5, 6, 7]);
+    assert_compact_matches_materialized(&sparse_stream);
+
+    let stream_bytes = crate::write_full(&classic, &crate::SaveOptions::default()).unwrap();
+    let stream = Document::open(Arc::new(stream_bytes)).unwrap();
+    assert!(stream.revisions().last().is_some_and(|revision| revision.is_stream));
+    assert_compact_matches_materialized(&stream);
+
+    let mut edited = classic.clone();
+    edited.update_dict(ObjRef::new(1, 0), |dict| dict.set(b"Lang".to_vec(), Object::String(crate::PdfString::literal("en")))).unwrap();
+    edited.free(ObjRef::new(3, 0));
+    let incremental = crate::write_incremental(&edited, &crate::SaveOptions::default()).unwrap();
+    let updated = Document::open(Arc::new(incremental)).unwrap();
+    assert_eq!(updated.revisions().len(), 2);
+    assert_compact_matches_materialized(&updated);
+}
+
+#[test]
+fn malformed_size_uses_the_materialized_compatibility_path() {
+    let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Value 9 >>"], "/Root 1 0 R");
+    let marker = b"/Size 4";
+    let at = bytes.windows(marker.len()).position(|window| window == marker).unwrap();
+    bytes[at..at + marker.len()].copy_from_slice(b"/Size 2");
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert!(matches!(doc.entries.as_ref(), XrefIndex::Materialized(_)));
+    assert_eq!(doc.next_num, 4);
+    assert_eq!(doc.object_numbers(), vec![1, 2, 3]);
+}
+
+/// Entries the reader sets aside are remembered, so a caller comparing revisions can tell
+/// that another reader may resolve the object differently.
+#[test]
+fn cross_reference_entries_that_are_set_aside_are_recorded() {
+    let base = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "(three)"], "/Root 1 0 R");
+    let plain = Document::open(Arc::new(base.clone())).unwrap();
+    assert!(plain.xref_oddities().is_empty());
+    assert!((1..=3).all(|n| plain.xref_entry_is_exact(n)));
+    let prev = String::from_utf8_lossy(&base).rfind("xref\n0 4").unwrap();
+    let third = plain.xref_entry(3).unwrap();
+
+    // A later section: object 3 "in use" at offset 0, object 2 listed twice with different
+    // offsets, and object 0 at offset 0 (the usual producer slip, which names no object).
+    let mut bytes = base.clone();
+    let section = bytes.len();
+    bytes.extend_from_slice(
+        format!("xref\n0 1\n0000000000 65535 n \n3 1\n0000000000 00000 n \n2 1\n0000000058 00000 n \n2 1\n0000000009 00000 n \ntrailer\n<< /Size 4 /Root 1 0 R /Prev {prev} >>\nstartxref\n{section}\n%%EOF\n").as_bytes(),
+    );
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.xref_oddities(), [(section as u64, 3), (section as u64, 2)]);
+    // What the reader resolves is what it resolved before: the first entry it kept.
+    assert_eq!(doc.xref_entry(3), Some(third));
+    assert_eq!(doc.xref_entry(2), Some(XrefEntry::InFile { offset: 58, generation: 0 }));
+}
+
+/// An entry that misses its object still resolves (by searching) but is not exact.
+#[test]
+fn an_entry_that_misses_its_object_is_found_by_searching_but_is_not_exact() {
+    let base = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "(three)"], "/Root 1 0 R");
+    let text = String::from_utf8_lossy(&base).into_owned();
+    let at = text.find("3 0 obj").unwrap();
+    let bytes = text.replacen(&format!("{at:010} 00000 n"), &format!("{:010} 00000 n", at + 2), 1).into_bytes();
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.get(ObjRef { num: 3, generation: 0 }).as_string().map(|s| s.bytes.clone()), Some(b"three".to_vec()));
+    assert!(!doc.xref_entry_is_exact(3));
+    assert!(doc.xref_entry_is_exact(1) && doc.xref_entry_is_exact(2));
+}
+
+/// A classic table with `/Size` rows and object 0's free entry first, its subsection numbered
+/// `1 n` instead of `0 n` (#2676): every row is one number off.
+fn misnumbered_table(start: u32) -> Vec<u8> {
+    let bodies = ["<< /Marker (first object) >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Type /Catalog /Pages 2 0 R >>"];
+    let mut out = b"%PDF-1.7
+"
+    .to_vec();
+    let mut offsets = Vec::new();
+    for (i, body) in bodies.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(
+            format!(
+                "{} 0 obj
+{body}
+endobj
+",
+                i + 1
+            )
+            .as_bytes(),
+        );
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n{start} 4\n0000000000 65535 f \n").as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size 4 /Root 3 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    out
+}
+
+#[test]
+fn a_table_numbered_from_1_that_begins_with_object_0_is_read_from_0() {
+    let doc = Document::open(Arc::new(misnumbered_table(1))).unwrap();
+    let first = doc.get(ObjRef::new(1, 0)).as_dict().cloned().expect("object 1 is not free");
+    assert!(first.contains(b"Marker"));
+    assert_eq!(doc.root(), Some(ObjRef::new(3, 0)));
+    assert!(doc.repair_log().iter().any(|l| l.contains("numbered from 1")), "{:?}", doc.repair_log());
+    // A correct table reads the same and logs nothing.
+    let fine = Document::open(Arc::new(misnumbered_table(0))).unwrap();
+    assert!(fine.get(ObjRef::new(1, 0)).as_dict().is_some_and(|d| d.contains(b"Marker")));
+    assert!(!fine.repair_log().iter().any(|l| l.contains("numbered from 1")));
+}
+
+#[test]
+fn a_table_that_really_starts_at_1_keeps_its_numbers() {
+    // Object 1 deleted for good (generation 65535) in a subsection that does start at 1: its
+    // second row locates object 2, so nothing is shifted.
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let pages = bytes.len();
+    bytes.extend_from_slice(b"2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
+    let catalog = bytes.len();
+    bytes.extend_from_slice(b"3 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n");
+    let xref = bytes.len();
+    bytes.extend_from_slice(
+        format!(
+            "xref\n0 1\n0000000000 65535 f \n1 3\n0000000000 65535 f \n{pages:010} 00000 n \n{catalog:010} 00000 n \ntrailer\n<< /Size 4 /Root 3 0 R >>\nstartxref\n{xref}\n%%EOF\n"
+        )
+        .as_bytes(),
+    );
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert!(doc.get(ObjRef::new(2, 0)).as_dict().is_some_and(|d| d.name(b"Type") == Some(b"Pages")));
+    assert!(doc.get(ObjRef::new(1, 0)).as_dict().is_none(), "object 1 stays free");
+    assert!(!doc.repair_log().iter().any(|l| l.contains("numbered from 1")));
+}
+
+/// A one-page scan: the page draws image 5 with content stream 4.
+fn scanned_page() -> Vec<u8> {
+    build(
+        &[
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 10 10] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >>",
+            "<< /Length 21 >>\nstream\n10 0 0 10 0 0 cm /Im0 Do\nendstream",
+            "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 1 >>\nstream\nA\nendstream",
+        ],
+        "/Root 1 0 R",
+    )
+}
+
+/// `bytes` with its cross-reference table replaced by `table` (the lines after `xref`).
+fn with_table(bytes: &[u8], table: &[String], size: usize) -> Vec<u8> {
+    let text = String::from_utf8_lossy(bytes).into_owned();
+    let at = text.rfind("\nxref\n").unwrap() + 1;
+    let mut out = bytes[..at].to_vec();
+    out.extend_from_slice(format!("xref\n{}\ntrailer\n<< /Size {size} /Root 1 0 R >>\nstartxref\n{at}\n%%EOF\n", table.join("\n")).as_bytes());
+    out
+}
+
+/// The table's entry lines, object 0 first.
+fn table_entries(bytes: &[u8]) -> Vec<String> {
+    let text = String::from_utf8_lossy(bytes).into_owned();
+    let at = text.rfind("\nxref\n").unwrap() + 1;
+    text[at..].lines().skip(2).take_while(|l| !l.starts_with("trailer")).map(str::to_string).collect()
+}
+
+/// The classic off-by-one: the subsection says it starts at 0 but lists objects 1 to 5, so
+/// the last object has no entry. Viewers rebuild the table and show the page; a reader that
+/// took the missing entry for a null object dropped the image when pages were copied (#1628).
+#[test]
+fn an_off_by_one_xref_subsection_still_finds_the_last_object() {
+    let base = scanned_page();
+    let entries = table_entries(&base);
+    let mut table = vec!["0 5".to_string()];
+    table.extend(entries[1..6].iter().cloned());
+    let doc = Document::open(Arc::new(with_table(&base, &table, 5))).unwrap();
+    let image = doc.get(ObjRef::new(5, 0));
+    assert_eq!(image.as_dict().and_then(|d| d.name(b"Subtype")), Some(&b"Image"[..]), "{image:?}");
+    assert!(matches!(&*image, Object::Stream(_)));
+    assert!(matches!(&*doc.get(ObjRef::new(4, 0)), Object::Stream(s) if &s.raw[..] == b"10 0 0 10 0 0 cm /Im0 Do"));
+    assert!(doc.repair_log().iter().any(|l| l.contains("object headers")), "{:?}", doc.repair_log());
+}
+
+/// An "in use" entry at offset 0 says nothing about where the object is: the object is
+/// found by its header, and the repair is recorded.
+#[test]
+fn an_object_listed_at_offset_zero_is_found_by_its_header() {
+    let base = scanned_page();
+    for num in [4usize, 5] {
+        let mut table = vec!["0 6".to_string()];
+        table.extend(table_entries(&base));
+        table[num + 1] = "0000000000 00000 n ".into();
+        let doc = Document::open(Arc::new(with_table(&base, &table, 6))).unwrap();
+        assert!(matches!(&*doc.get(ObjRef::new(num as u32, 0)), Object::Stream(_)), "object {num}");
+        assert!(doc.repair_log().iter().any(|l| l.contains("object headers")), "object {num}: {:?}", doc.repair_log());
+    }
+}
+
+/// A valid table that simply does not list every number below `/Size` is not repaired: an
+/// unlisted number is a null object (§7.3.10), even when an old body with that number is
+/// still in the file.
+#[test]
+fn a_consistent_table_with_unlisted_numbers_is_taken_as_it_is() {
+    let base = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "(three)"], "/Root 1 0 R");
+    let at = String::from_utf8_lossy(&base).rfind("\nxref\n").unwrap() + 1;
+    let mut bytes = base[..at].to_vec();
+    bytes.extend_from_slice(b"4 0 obj\n(stale)\nendobj\n");
+    let mut table = vec!["0 4".to_string()];
+    table.extend(table_entries(&base));
+    let doc = Document::open(Arc::new(with_table(&[&bytes[..], &base[at..]].concat(), &table, 6))).unwrap();
+    assert!(doc.repair_log().is_empty(), "{:?}", doc.repair_log());
+    assert_eq!(*doc.get(ObjRef::new(4, 0)), Object::Null);
+    assert!(matches!(&*doc.get(ObjRef::new(3, 0)), Object::String(_)));
+}
+
+/// Filling the gaps of a damaged table never brings back an object that an incremental
+/// update freed: its body is still in the file, but the newer section says it is gone.
+#[test]
+fn an_object_freed_by_an_update_stays_freed_when_the_table_is_repaired() {
+    let base = scanned_page();
+    // The original table lists the content stream at offset 0, so the gaps get filled.
+    let mut table = vec!["0 6".to_string()];
+    table.extend(table_entries(&base));
+    table[5] = "0000000000 00000 n ".into();
+    let mut bytes = with_table(&base, &table, 6);
+    let prev = String::from_utf8_lossy(&bytes).rfind("\nxref\n").unwrap() + 1;
+    let section = bytes.len();
+    bytes.extend_from_slice(
+        format!("xref\n5 1\n0000000000 00001 f \ntrailer\n<< /Size 6 /Root 1 0 R /Prev {prev} >>\nstartxref\n{section}\n%%EOF\n").as_bytes(),
+    );
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert!(matches!(&*doc.get(ObjRef::new(4, 0)), Object::Stream(_)), "the gap is filled");
+    assert_eq!(*doc.get(ObjRef::new(5, 0)), Object::Null, "the freed image stays freed");
+    assert_eq!(doc.xref_entry(5), Some(XrefEntry::Free { next_generation: 1 }));
+}
+
+/// Repairing a damaged table fills only the numbers the damage leaves out: an old body of a
+/// number no section lists, under an oversized `/Size`, stays a null object.
+#[test]
+fn a_repaired_table_leaves_an_unlisted_number_null() {
+    let base = scanned_page();
+    let at = String::from_utf8_lossy(&base).rfind("\nxref\n").unwrap() + 1;
+    let entries = table_entries(&base);
+    let mut offset_zero = vec!["0 6".to_string()];
+    offset_zero.extend(entries.iter().cloned());
+    offset_zero[5] = "0000000000 00000 n ".into();
+    let mut off_by_one = vec!["0 5".to_string()];
+    off_by_one.extend(entries[1..6].iter().cloned());
+    for (name, table, found) in [("offset 0", offset_zero, 4), ("off by one", off_by_one, 5)] {
+        let bytes = [&base[..at], b"7 0 obj\n(stale)\nendobj\n", &base[at..]].concat();
+        let doc = Document::open(Arc::new(with_table(&bytes, &table, 9))).unwrap();
+        assert!(matches!(&*doc.get(ObjRef::new(found, 0)), Object::Stream(_)), "{name}: the gap is filled");
+        assert_eq!(*doc.get(ObjRef::new(7, 0)), Object::Null, "{name}: {:?}", doc.repair_log());
+        assert_eq!(doc.xref_entry(7), None, "{name}");
+    }
+}
+
+/// The last object of a subsection numbered one too low is filled from that subsection,
+/// whatever later happens to the row before it: an incremental save that rewrites object 4,
+/// or object 4's own row at offset 0.
+#[test]
+fn the_last_object_of_a_shifted_subsection_is_filled_whatever_its_neighbour_says() {
+    let base = scanned_page();
+    let entries = table_entries(&base);
+    let mut off_by_one = vec!["0 5".to_string()];
+    off_by_one.extend(entries[1..6].iter().cloned());
+    let shifted = with_table(&base, &off_by_one, 5);
+    let prev = String::from_utf8_lossy(&shifted).rfind("\nxref\n").unwrap() + 1;
+    let mut updated = shifted.clone();
+    let body = updated.len();
+    updated.extend_from_slice(b"4 0 obj\n<< /Length 21 >>\nstream\n10 0 0 10 0 0 cm /Im0 Do\nendstream\nendobj\n");
+    let section = updated.len();
+    updated.extend_from_slice(
+        format!("xref\n4 1\n{body:010} 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R /Prev {prev} >>\nstartxref\n{section}\n%%EOF\n").as_bytes(),
+    );
+    let mut neighbour_at_zero = off_by_one.clone();
+    neighbour_at_zero[5] = "0000000000 00000 n ".into();
+    for (name, bytes) in [("updated", updated), ("row 4 at offset 0", with_table(&base, &neighbour_at_zero, 5))] {
+        let doc = Document::open(Arc::new(bytes)).unwrap();
+        let image = doc.get(ObjRef::new(5, 0));
+        assert_eq!(image.as_dict().and_then(|d| d.name(b"Subtype")), Some(&b"Image"[..]), "{name}: {:?}", doc.repair_log());
+    }
+}
+
+/// The image the first page draws as `/Im1`, followed through the page tree.
+fn first_page_image(doc: &Document) -> Arc<Object> {
+    let catalog = doc.get(doc.root().unwrap());
+    let pages = doc.resolve(catalog.as_dict().unwrap().get(b"Pages").unwrap());
+    let page = doc.resolve(&pages.as_dict().unwrap().get(b"Kids").unwrap().as_array().unwrap()[0]);
+    let resources = doc.resolve(page.as_dict().unwrap().get(b"Resources").unwrap());
+    let xobjects = doc.resolve(resources.as_dict().unwrap().get(b"XObject").unwrap());
+    doc.resolve(xobjects.as_dict().unwrap().get(b"Im1").unwrap())
+}
+
+/// The opposite off-by-one (#1628): the subsection says it starts at 1, but its first entry
+/// is object 0's free-list head, so every entry lands one number too high and object 1, the
+/// image, reads as free. The offset the table gives object 2 holds `1 0 obj`, so the
+/// subsection is read from 0, and the image survives a full save.
+#[test]
+fn a_subsection_from_one_that_opens_with_the_free_list_head_is_read_from_zero() {
+    let base = build(
+        &[
+            "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length 12 >>\nstream\nABCDEFGHIJKL\nendstream",
+            "<< /Length 29 >>\nstream\nq 72 0 0 72 0 0 cm /Im1 Do Q\nendstream",
+            "<< /Type /Page /Parent 4 0 R /MediaBox [0 0 72 72] /Resources << /XObject << /Im1 1 0 R >> >> /Contents 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+            "<< /Type /Catalog /Pages 4 0 R >>",
+            "<< /Subject (synthetic) >>",
+        ],
+        "/Root 5 0 R /Info 6 0 R",
+    );
+    // /Size 7 is one short of the shifted numbers; /Size 8 covers them all. Junk before the
+    // header moves every object past the offsets the table gives; it is not a comment, which
+    // the lexer would skip on its way to `1 0 obj` anyway.
+    for (size, junk) in [(7, ""), (8, ""), (7, "Content-Type: application/pdf\n\n")] {
+        let text = String::from_utf8_lossy(&base).replace("\nxref\n0 7\n", "\nxref\n1 7\n").replace("/Size 7 ", &format!("/Size {size} "));
+        let doc = Document::open(Arc::new(format!("{junk}{text}").into_bytes())).unwrap();
+        let image = first_page_image(&doc);
+        assert_eq!(image.as_dict().and_then(|d| d.name(b"Subtype")), Some(&b"Image"[..]), "/Size {size} {junk:?}: {image:?}");
+        assert_eq!(doc.xref_entry(0), Some(XrefEntry::Free { next_generation: 65535 }), "/Size {size} {junk:?}");
+        assert!(doc.repair_log().iter().any(|l| l.contains("from 0")), "/Size {size} {junk:?}: {:?}", doc.repair_log());
+        let saved = Document::open(Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap())).unwrap();
+        let image = first_page_image(&saved);
+        assert!(matches!(&*image, Object::Stream(s) if &s.raw[..] == b"ABCDEFGHIJKL"), "/Size {size} {junk:?}: {image:?}");
+    }
+}
+
+/// Object 1 really freed: the subsection from 1 opens with a free entry, but the next entry's
+/// offset holds object 2, not object 1. The table is taken as it is, and the old body of
+/// object 1 still in the file stays freed.
+#[test]
+fn a_subsection_from_one_whose_next_offset_holds_object_two_is_taken_as_it_is() {
+    let base = build(&["(freed)", "<< /Type /Catalog /Pages 3 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 2 0 R");
+    let entries = table_entries(&base);
+    let mut table = vec!["1 3".to_string(), "0000000000 65535 f ".to_string()];
+    table.extend(entries[2..].iter().cloned());
+    let text = String::from_utf8_lossy(&base).into_owned();
+    let at = text.rfind("\nxref\n").unwrap() + 1;
+    for junk in ["", "Content-Type: application/pdf\n\n"] {
+        let mut bytes = junk.as_bytes().to_vec();
+        bytes.extend_from_slice(&base[..at]);
+        bytes.extend_from_slice(format!("xref\n{}\ntrailer\n<< /Size 4 /Root 2 0 R >>\nstartxref\n{at}\n%%EOF\n", table.join("\n")).as_bytes());
+        let doc = Document::open(Arc::new(bytes)).unwrap();
+        assert_eq!(doc.xref_entry(1), Some(XrefEntry::Free { next_generation: 65535 }), "{junk:?}");
+        assert_eq!(*doc.get(ObjRef::new(1, 0)), Object::Null, "{junk:?}: the freed object stays freed");
+        assert!(matches!(&*doc.get(ObjRef::new(2, 0)), Object::Dict(d) if d.name(b"Type") == Some(&b"Catalog"[..])), "{junk:?}");
+        assert!(!doc.repair_log().iter().any(|l| l.contains("from 0")), "{junk:?}: {:?}", doc.repair_log());
+        assert!(!junk.is_empty() || doc.repair_log().is_empty(), "{:?}", doc.repair_log());
+    }
+}
+
+#[test]
+fn opening_an_exhausted_classic_xref_repairs_and_allocates() {
+    // The extra in-use row need not be loaded to exhaust the next object number.
+    let bytes = b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\nxref\n0 3\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n4294967295 1\n0000000058 00000 n \ntrailer\n<< /Size 3 /Root 1 0 R >>\nstartxref\n110\n%%EOF\n";
+    assert_eq!(bytes.len(), 266);
+    let mut doc = Document::open(Arc::new(bytes.to_vec())).unwrap();
+    assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+    assert!(doc.repair_log().iter().any(|line| line.contains("exhausted xref")));
+    assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
+}
+
+#[test]
+fn opening_an_exhausted_xref_stream_repairs_and_allocates() {
+    let mut bytes = b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n".to_vec();
+    let offset = bytes.len();
+    bytes.extend_from_slice(b"3 0 obj\n<< /Type /XRef /Size 4 /Root 1 0 R /W [1 4 2] /Index [0 3 4294967295 1] /Length 28 >>\nstream\n");
+    for (kind, position, generation) in [(0_u8, 0_u32, 65535_u16), (1, 9, 0), (1, 58, 0), (1, 58, 0)] {
+        bytes.push(kind);
+        bytes.extend_from_slice(&position.to_be_bytes());
+        bytes.extend_from_slice(&generation.to_be_bytes());
+    }
+    bytes.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{offset}\n%%EOF\n").as_bytes());
+    let mut doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+    assert!(doc.repair_log().iter().any(|line| line.contains("exhausted xref")));
+    assert_eq!(doc.add(Object::Null), ObjRef::new(4, 0));
+}
+
+#[test]
+fn exhausted_size_and_high_edits_allocate_without_overwriting_objects() {
+    let ordinary = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
+    for size in ["4294967295", "4294967296", "9223372036854775807"] {
+        let bytes = String::from_utf8(ordinary.clone()).unwrap().replace("/Size 3", &format!("/Size {size}"));
+        let mut doc = Document::open(Arc::new(bytes.into_bytes())).unwrap();
+        assert!(doc.repair_log().iter().any(|line| line.contains("exhausted trailer")));
+        assert_eq!(doc.add(Object::Int(42)), ObjRef::new(3, 0));
+        doc.set(ObjRef::new(u32::MAX, 0), Object::Int(99));
+        doc.set(ObjRef::new(u32::MAX - 1, 0), Object::Int(98));
+        assert_eq!(doc.add(Object::Int(43)), ObjRef::new(4, 0));
+        assert_eq!(doc.get(ObjRef::new(3, 0)).as_int(), Some(42));
+        assert_eq!(doc.get(ObjRef::new(u32::MAX, 0)).as_int(), Some(99));
+        assert_eq!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().name(b"Type"), Some(b"Catalog".as_slice()));
+    }
+    let mut doc = Document::new_empty();
+    doc.set(ObjRef::new(u32::MAX - 2, 0), Object::Null);
+    assert_eq!(doc.add(Object::Null), ObjRef::new(u32::MAX - 1, 0));
+    assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
+    assert_eq!(doc.add(Object::Null), ObjRef::new(4, 0));
+}
+
+#[test]
+fn exhausted_xref_controls_preserve_ordinary_ignored_and_repaired_entries() {
+    let ordinary = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
+    for (extra, repaired) in
+        [("", false), ("4294967295 1\n0000000000 00000 n \n", false), ("4294967295 2\n0000000058 00000 n \n0000000058 00000 n \n", true)]
+    {
+        let bytes = String::from_utf8(ordinary.clone()).unwrap().replacen("trailer\n", &format!("{extra}trailer\n"), 1);
+        let mut doc = Document::open(Arc::new(bytes.into_bytes())).unwrap();
+        assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+        assert_eq!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().name(b"Type"), Some(b"Catalog".as_slice()));
+        assert_eq!(!doc.repair_log().is_empty(), repaired);
+        if repaired {
+            assert!(doc.repair_log().iter().any(|line| line.contains("xref") && line.contains("range")));
+        }
+        assert_eq!(doc.add(Object::Null), ObjRef::new(3, 0));
+    }
+}
+
+#[test]
+fn invalid_xref_object_ranges_are_reconstructed() {
+    // Original in-memory PDF: an intact catalog followed by a damaged xref section.
+    for stream in [false, true] {
+        for (start, count) in [(i64::MAX, 2), (-1, 2), (4_294_967_296, 1), (4_294_967_295, 2)] {
+            let mut bytes =
+                b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n".to_vec();
+            let offset = bytes.len();
+            if stream {
+                bytes.extend_from_slice(
+                    format!("3 0 obj\n<< /Type /XRef /Root 1 0 R /Size 4 /W [1 1 1] /Index [{start} {count}] /Length 6 >>\nstream\n").as_bytes(),
+                );
+                bytes.extend_from_slice(&[0, 0, 0, 0, 0, 0]);
+                bytes.extend_from_slice(b"\nendstream\nendobj\n");
+            } else {
+                bytes.extend_from_slice(
+                    format!("xref\n{start} {count}\n0000000000 65535 f \n0000000000 65535 f \ntrailer\n<< /Root 1 0 R /Size 3 >>\n").as_bytes(),
+                );
+            }
+            bytes.extend_from_slice(format!("startxref\n{offset}\n%%EOF\n").as_bytes());
+            let doc = Document::open(Arc::new(bytes)).unwrap();
+            assert!(
+                doc.repair_log().iter().any(|line| line.contains("xref") && line.contains("range")),
+                "stream={stream}, start={start}, count={count}: {:?}",
+                doc.repair_log()
+            );
+            assert_eq!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().name(b"Type"), Some(b"Catalog".as_slice()));
+        }
+    }
+}
+
+#[test]
+fn objects_only_an_unreadable_older_section_locates_are_found_by_scanning() {
+    // The newest section lists the catalog only; its /Prev points past the end of the file,
+    // so the page tree is reachable only by scanning object headers, as readers do (#1656).
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (num, body) in
+        [(1, "<< /Type /Catalog /Pages 2 0 R >>"), (2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>"), (3, "<< /Type /Page /Parent 2 0 R >>")]
+    {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{num} 0 obj\n{body}\nendobj\n").as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(
+        format!(
+            "xref\n0 2\n0000000000 65535 f \n{:010} 00000 n \ntrailer\n<< /Root 1 0 R /Size 4 /Prev 999999 >>\nstartxref\n{xref}\n%%EOF\n",
+            offsets[0]
+        )
+        .as_bytes(),
+    );
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.get(ObjRef::new(2, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(b"Pages".as_slice()));
+    assert_eq!(doc.get(ObjRef::new(3, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(b"Page".as_slice()));
+    assert!(doc.repair_log().iter().any(|l| l.contains("999999")), "{:?}", doc.repair_log());
+}
+
+#[test]
+fn self_referential_length_does_not_overflow() {
+    let bytes = build(
+        &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Length 3 0 R >>\nstream\nabc\nendstream"],
+        "/Root 1 0 R",
+    );
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    // Either recovered via the endstream search or reported — but never a stack overflow.
+    let o = doc.get(ObjRef::new(3, 0));
+    if let Object::Stream(s) = o.as_ref() {
+        assert_eq!(&s.raw[..], b"abc");
+    }
+}
+
+#[test]
+fn mutually_referential_lengths_do_not_overflow() {
+    let bytes = build(
+        &[
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [] /Count 0 >>",
+            "<< /Length 4 0 R >>\nstream\nabc\nendstream",
+            "<< /Length 3 0 R >>\nstream\nxyz\nendstream",
+        ],
+        "/Root 1 0 R",
+    );
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    let _ = doc.get(ObjRef::new(3, 0));
+    let _ = doc.get(ObjRef::new(4, 0));
+}
+
+#[test]
+fn reads_classic_revision_and_edits_are_copy_on_write() {
+    let bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.revisions().len(), 1);
+    assert!(doc.repair_log().is_empty());
+    let mut edited = doc.clone();
+    edited.update_dict(ObjRef::new(1, 0), |d| d.set(b"Lang".to_vec(), Object::String(crate::PdfString::literal("en")))).unwrap();
+    assert!(edited.is_modified() && !doc.is_modified(), "clone is an independent snapshot");
+    assert!(doc.get(ObjRef::new(1, 0)).as_dict().unwrap().get(b"Lang").is_none());
+}
+
+#[test]
+fn object_numbers_merge_source_and_overlay_in_order() {
+    let mut doc = Document::new_empty();
+    doc.overlay.clear();
+    doc.entries = Arc::new(XrefIndex::Materialized(Arc::new(BTreeMap::from([
+        (0, XrefEntry::Free { next_generation: 65535 }),
+        (2, XrefEntry::InFile { offset: 10, generation: 7 }),
+        (4, XrefEntry::Free { next_generation: 9 }),
+        (6, XrefEntry::InStream { stream: 80, index: 1 }),
+        (8, XrefEntry::InFile { offset: 20, generation: 5 }),
+        (10, XrefEntry::InFile { offset: 30, generation: 3 }),
+        (u32::MAX, XrefEntry::InFile { offset: 40, generation: 1 }),
+    ]))));
+    doc.set(ObjRef::new(1, 2), Object::Int(1)); // before the first live source slot
+    doc.set(ObjRef::new(2, 8), Object::Int(2)); // override, without duplication
+    doc.set(ObjRef::new(4, 9), Object::Int(4)); // reuse a source free slot
+    doc.free(ObjRef::new(6, 0)); // remove a compressed source object
+    doc.free(ObjRef::new(7, 2)); // free a number absent from the source
+    doc.free(ObjRef::new(10, 3));
+    doc.set(ObjRef::new(11, 4), Object::Int(11));
+    assert_eq!(doc.object_numbers(), vec![1, 2, 4, 8, 11, u32::MAX]);
+    assert_eq!(doc.generation(2), 8);
+    assert_eq!(doc.generation(4), 9);
+    assert_eq!(doc.generation(6), 1);
+    assert_eq!(doc.generation(8), 5);
+    assert_eq!(doc.generation(10), 4);
+    doc.overlay.clear();
+    assert_eq!(doc.object_numbers(), vec![2, 6, 8, 10, u32::MAX]);
+    doc.entries = Arc::new(XrefIndex::empty());
+    assert!(doc.object_numbers().is_empty());
+    doc.set(ObjRef::new(5, 7), Object::Int(5));
+    assert_eq!(doc.object_numbers(), vec![5]);
+}
+
+#[test]
+fn full_object_scans_preserve_edits_without_retaining_the_scan() {
+    let mut bodies = vec!["<< /Type /Catalog /Pages 2 0 R >>".to_owned(), "<< /Type /Pages /Kids [] /Count 0 >>".to_owned()];
+    bodies.extend((0..400).map(|i| format!("<< /Value {i} >>")));
+    let refs: Vec<_> = bodies.iter().map(String::as_str).collect();
+    let mut doc = Document::open(Arc::new(build(&refs, "/Root 1 0 R"))).unwrap();
+    doc.set(ObjRef::new(3, 0), Object::Int(900));
+    doc.free(ObjRef::new(4, 0));
+    let added = doc.add(Object::Int(901));
+    let cached = doc.cache.lock().unwrap().len();
+    let held: Vec<_> = doc.scan_objects().collect();
+    assert_eq!(held.len(), 402);
+    assert_eq!(doc.cache.lock().unwrap().len(), cached, "scanning must not populate the editor cache");
+    assert!(doc.objstms.lock().unwrap().is_empty());
+    assert!(!held.iter().any(|(r, _)| r.num == 4));
+    assert_eq!(held.iter().find(|(r, _)| r.num == 3).unwrap().1.as_int(), Some(900));
+    assert_eq!(held.iter().find(|(r, _)| *r == added).unwrap().1.as_int(), Some(901));
+    assert_eq!(held.iter().find(|(r, _)| r.num == 400).unwrap().1.as_dict().unwrap().int(b"Value"), Some(397));
+    // Previously returned objects survive cache eviction and dropping the source.
+    drop(doc);
+    assert_eq!(held.iter().find(|(r, _)| r.num == 128).unwrap().1.as_dict().unwrap().int(b"Value"), Some(125));
+}
+
+#[test]
+fn temporary_reader_keeps_file_views_and_evicts_data_of_its_own() {
+    // A stream read from the file is a view into the input: caching it costs no copy, so
+    // even a large one stays cached (its /Length object too) instead of being re-parsed.
+    let body = "x".repeat(ObjectReader::STREAM_BYTES + 1);
+    let stream = format!("<< /Length 4 0 R >>\nstream\n{body}\nendstream");
+    let length = body.len().to_string();
+    let bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", &stream, &length], "/Root 1 0 R");
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    let mut reader = doc.object_reader();
+    let read = reader.get(ObjRef::new(3, 0));
+    let Object::Stream(s) = &*read else { panic!("stream") };
+    assert!(s.raw.shares(&reader.document.data), "no copy of the file's bytes");
+    assert!(reader.document.cache.lock().unwrap().contains_key(&3), "a view costs nothing to keep");
+    // Data of its own (decrypted streams, strings) counts: past the budget the cache is
+    // cleared after the next read, including a failed one.
+    let owned = Object::Stream(crate::Stream::from_raw(Dict::new(), vec![b'y'; ObjectReader::STREAM_BYTES + 1]));
+    reader.document.cache.lock().unwrap().insert(3, Arc::new(owned));
+    assert_eq!(*reader.get(ObjRef::new(99, 0)), Object::Null);
+    assert!(reader.document.cache.lock().unwrap().is_empty(), "owned data over budget is evicted");
+}
+
+#[test]
+fn temporary_reader_and_full_save_do_not_fill_snapshot_caches() {
+    let mut source = Document::new_empty();
+    let objects: Vec<_> = (0..260)
+        .map(|i| {
+            let mut value = vec![b'x'; 48 * 1024];
+            value[..4].copy_from_slice(&(i as u32).to_le_bytes());
+            Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
+        })
+        .collect();
+    source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
+    let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
+    let doc = Document::open(bytes).unwrap();
+    let root = doc.get(doc.root().unwrap());
+    let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap();
+    let snapshot = doc.clone();
+    let cached = doc.cache.lock().unwrap().len();
+    let streams = doc.objstms.lock().unwrap().len();
+    let mut reader = doc.object_reader();
+    let mut held = None;
+    for (i, reference) in references.iter().enumerate() {
+        let Object::Ref(reference) = reference else { panic!("indirect object") };
+        let object = reader.get(*reference);
+        assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
+        if i == 0 {
+            held = Some(object);
+        }
+        assert!(reader.document.cache.lock().unwrap().len() < ObjectReader::OBJECTS);
+        let decoded = reader.document.objstms.lock().unwrap();
+        assert!(decoded.len() < ObjectReader::OBJECTS);
+        let bytes: usize = decoded.values().map(|s| s.data.capacity() + s.index.capacity() * std::mem::size_of::<Option<(u32, usize)>>()).sum();
+        assert!(bytes <= ObjectReader::STREAM_BYTES || decoded.len() == 1, "only one oversized stream may remain");
+    }
+    drop(reader);
+    assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes(), "owned results survive evictions");
+    for object_streams in [false, true] {
+        let saved = crate::write_full(&doc, &crate::SaveOptions { object_streams, ..Default::default() }).unwrap();
+        assert!(Document::open(Arc::new(saved)).unwrap().repair_log().is_empty());
+        assert_eq!(doc.cache.lock().unwrap().len(), cached, "full saves must not fill the editor cache");
+        assert_eq!(doc.objstms.lock().unwrap().len(), streams);
+        assert!(Arc::ptr_eq(&doc.cache, &snapshot.cache), "do not detach or clear caller snapshots");
+    }
+}
+
+#[test]
+fn streams_without_length_share_one_endstream_search() {
+    let n = 2_000;
+    let mut file = b"%PDF-1.7\n".to_vec();
+    for k in 1..=n {
+        file.extend_from_slice(format!("{k} 0 obj\n<< >>\nstream\nxx\n").as_bytes());
+    }
+    file.extend_from_slice(b"endstream\nendobj\n");
+    file.extend_from_slice(
+        format!("{0} 0 obj\n<< /Type /Catalog /Pages {1} 0 R >>\nendobj\n{1} 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n", n + 1, n + 2)
+            .as_bytes(),
+    );
+    file.extend_from_slice(format!("trailer\n<< /Root {} 0 R /Size {} >>\n%%EOF\n", n + 1, n + 3).as_bytes());
+    let len = file.len();
+    crate::parser::ENDSTREAM_SCAN.with(|c| c.set(0));
+    let doc = Document::open(Arc::new(file)).unwrap();
+    for k in [1, n / 2, n] {
+        assert!(matches!(doc.try_get(k).as_deref(), Ok(Object::Stream(_))), "object {k}");
+    }
+    let scanned = crate::parser::ENDSTREAM_SCAN.with(|c| c.get());
+    assert!(scanned <= 4 * len, "{scanned} bytes searched in a {len}-byte file");
+}
+
+#[test]
+fn editor_cache_counts_deeply_nested_strings() {
+    let mut nested = Object::String(crate::PdfString::literal(vec![b'x'; 1 << 20]));
+    for _ in 0..8 {
+        nested = Object::Array(vec![nested]);
+    }
+    let mut source = Document::new_empty();
+    let objects: Vec<_> = (0..48).map(|_| Object::Ref(source.add(nested.clone()))).collect();
+    source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
+    let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
+    let doc = Document::open(bytes).unwrap();
+    assert_eq!(owned_bytes(&nested, &doc.data, 0), 1 << 20);
+    let root = doc.get(doc.root().unwrap());
+    for reference in root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap() {
+        let Object::Ref(reference) = reference else { panic!("indirect object") };
+        drop(doc.get(*reference));
+        let cache = doc.cache.lock().unwrap();
+        let owned = cache.values().fold(0usize, |n, o| n.saturating_add(owned_bytes(o, &doc.data, 0)));
+        let strings = cache.values().filter(|o| o.as_array().is_some()).count();
+        assert!(strings << 20 <= Document::EDITOR_CACHE_BYTES + (1 << 20), "{strings} MiB strings cached, {owned} bytes counted");
+    }
+}
+
+#[test]
+fn editor_cache_stays_bounded() {
+    let mut source = Document::new_empty();
+    let objects: Vec<_> = (0..(Document::EDITOR_CACHE_OBJECTS + 64))
+        .map(|i| {
+            let mut value = vec![b'x'; 1024];
+            value[..4].copy_from_slice(&(i as u32).to_le_bytes());
+            Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
+        })
+        .collect();
+    source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
+    let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
+    let doc = Document::open(bytes).unwrap();
+    let root = doc.get(doc.root().unwrap());
+    let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap().clone();
+    let mut held = None;
+    for (i, reference) in references.iter().enumerate() {
+        let Object::Ref(reference) = reference else { panic!("indirect object") };
+        let object = doc.get(*reference);
+        assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
+        if i == 0 {
+            held = Some(object);
+        }
+        assert!(doc.cache.lock().unwrap().len() <= Document::EDITOR_CACHE_OBJECTS, "editing must not pin the whole object graph");
+        // Eviction keeps the newcomer.
+        assert!(doc.cache.lock().unwrap().contains_key(&reference.num), "eviction must keep the newcomer");
+    }
+    // Returned objects survive eviction, through both handles of the shared cache.
+    assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
+    let snapshot = doc.clone();
+    let first = references[0].as_ref().unwrap();
+    assert_eq!(&snapshot.get(first).as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
+}
+
+#[test]
+fn editor_cache_byte_bound_fires() {
+    // 40 × 1 MB strings: far below the count cap, above the 32 MB byte budget. Each
+    // newcomer exceeds EDITOR_LARGE_OBJECT, so every insert takes a full accounting pass.
+    let mut source = Document::new_empty();
+    let objects: Vec<_> = (0..40)
+        .map(|i| {
+            let mut value = vec![b'y'; 1024 * 1024];
+            value[..4].copy_from_slice(&(i as u32).to_le_bytes());
+            Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
+        })
+        .collect();
+    source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
+    let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
+    let doc = Document::open(bytes).unwrap();
+    let root = doc.get(doc.root().unwrap());
+    let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap().clone();
+    let mut held = None;
+    for (i, reference) in references.iter().enumerate() {
+        let Object::Ref(reference) = reference else { panic!("indirect object") };
+        let object = doc.get(*reference);
+        assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
+        if i == 0 {
+            held = Some(object);
+        }
+        // Eviction keeps the newcomer.
+        assert!(doc.cache.lock().unwrap().contains_key(&reference.num), "eviction must keep the newcomer");
+    }
+    assert!(doc.cache.lock().unwrap().len() < references.len(), "the byte budget must evict even below the count cap");
+    let last = references[references.len() - 1].as_ref().unwrap();
+    assert!(doc.cache.lock().unwrap().contains_key(&last.num), "eviction must keep the newcomer");
+    assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
+}
+
+#[test]
+fn a_stream_limited_document_cannot_be_saved() {
+    let bytes = Arc::new(crate::write_full(&Document::new_empty(), &crate::SaveOptions::default()).unwrap());
+    let doc = Document::open_with_stream_limit(bytes.clone(), None, 1 << 20).unwrap();
+    for saved in [crate::write_full(&doc, &crate::SaveOptions::default()), crate::write_incremental(&doc, &crate::SaveOptions::default())] {
+        assert!(matches!(saved, Err(CosError::ReadOnlyLimit)), "{saved:?}");
+    }
+    let doc = Document::open(bytes).unwrap();
+    assert!(crate::write_full(&doc, &crate::SaveOptions::default()).is_ok());
+}
+
+#[test]
+fn inspection_stream_limit_applies_before_loading_compressed_objects() {
+    let mut doc = Document::new_empty();
+    let large = doc.add(Object::String(crate::PdfString::literal(vec![b'x'; 4096])));
+    doc.update_dict(doc.root().unwrap(), |catalog| catalog.set(b"Extension".to_vec(), Object::Ref(large))).unwrap();
+    let bytes = Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap());
+    assert!(Document::open(bytes.clone()).is_ok());
+    assert!(Document::open_with_stream_limit(bytes, None, 512).is_err());
+}
+
+/// A /Prev chain that loops back on itself stops at the loop (and says so).
+#[test]
+fn looping_revision_chains_stop() {
+    let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
+    // An update whose /Prev points at itself.
+    let at = bytes.len();
+    bytes.extend_from_slice(
+        format!("xref\n0 1\n0000000000 65535 f \ntrailer << /Size 3 /Root 1 0 R /Prev {at} >>\nstartxref\n{at}\n%%EOF\n").as_bytes(),
+    );
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+    assert!(doc.repair_log().iter().any(|l| l.contains("loops")), "{:?}", doc.repair_log());
+}
+
+/// A hybrid-reference file: the classic table leaves object 3 out; the `/XRefStm` stream
+/// says it lives in object stream 4.
+#[test]
+fn hybrid_reference_files_read_the_xref_stream_too() {
+    let doc = Document::open(Arc::new(object_stream_file("3 0 ", "<< /Hidden (yes) >>", 0))).unwrap();
+    assert!(doc.repair_log().is_empty(), "{:?}", doc.repair_log());
+    assert_compact_matches_materialized(&doc);
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
+}
+
+/// A hybrid-reference file whose classic table leaves object 3 out, and whose `/XRefStm`
+/// stream puts it at position `member` of object stream 4, which holds `header` (the number
+/// and offset pairs) and then `members`.
+fn object_stream_file(header: &str, members: &str, member: u8) -> Vec<u8> {
+    let mut out = b"%PDF-1.5\n".to_vec();
+    let mut offs = [0usize; 6];
+    let mut obj = |out: &mut Vec<u8>, n: usize, body: &[u8]| {
+        offs[n] = out.len();
+        out.extend_from_slice(format!("{n} 0 obj\n").as_bytes());
+        out.extend_from_slice(body);
+        out.extend_from_slice(b"\nendobj\n");
+    };
+    obj(&mut out, 1, b"<< /Type /Catalog /Pages 2 0 R >>");
+    obj(&mut out, 2, b"<< /Type /Pages /Kids [] /Count 0 /Extra 3 0 R >>");
+    let count = header.split_whitespace().count() / 2;
+    let inner = format!("{header}{members}");
+    let mut stm = format!("<< /Type /ObjStm /N {count} /First {} /Length {} >>\nstream\n", header.len(), inner.len()).into_bytes();
+    stm.extend_from_slice(inner.as_bytes());
+    stm.extend_from_slice(b"\nendstream");
+    obj(&mut out, 4, &stm);
+    let data = [2u8, 0, 4, member];
+    let mut xs = format!("<< /Type /XRef /Size 6 /W [1 2 1] /Index [3 1] /Length {} >>\nstream\n", data.len()).into_bytes();
+    xs.extend_from_slice(&data);
+    xs.extend_from_slice(b"\nendstream");
+    obj(&mut out, 5, &xs);
+    let table = out.len();
+    out.extend_from_slice(b"xref\n0 6\n0000000000 65535 f \n");
+    for (n, off) in offs.iter().enumerate().skip(1) {
+        let line = if n == 3 { "0000000000 65535 f \n".to_string() } else { format!("{off:010} 00000 n \n") };
+        out.extend_from_slice(line.as_bytes());
+    }
+    out.extend_from_slice(format!("trailer << /Size 6 /Root 1 0 R /XRefStm {} >>\nstartxref\n{table}\n%%EOF\n", offs[5]).as_bytes());
+    out
+}
+
+/// Many revisions naming one hybrid /XRefStm read it once.
+#[test]
+fn a_hybrid_stream_named_by_many_revisions_is_read_once() {
+    let mut out = object_stream_file("3 0 ", "<< /Hidden (yes) >>", 0);
+    let stream = find(&out, b"5 0 obj", 0, out.len()).unwrap();
+    let mut prev = rfind(&out, b"\nxref\n", 0).unwrap() + 1;
+    let revisions = 200;
+    for _ in 0..revisions {
+        let at = out.len();
+        out.extend_from_slice(format!("xref\ntrailer << /Size 6 /Root 1 0 R /XRefStm {stream} /Prev {prev} >>\nstartxref\n{at}\n%%EOF\n").as_bytes());
+        prev = at;
+    }
+    let doc = Document::open(Arc::new(out)).unwrap();
+    SECTION_READS.with(|c| c.set(0));
+    let (entries, ..) = doc.read_xref_chain_materialized(&mut Vec::new()).unwrap();
+    let reads = SECTION_READS.with(|c| c.get());
+    assert!(reads <= revisions + 2, "{reads} sections read for {} revisions", revisions + 1);
+    assert!(matches!(entries.get(&3), Some(XrefEntry::InStream { stream: 4, .. })), "{:?}", entries.get(&3));
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
+    assert_compact_matches_materialized(&doc);
+}
+
+/// An older section that names an /XRefStm a newer section already read still has its own
+/// table compared with that stream, so an entry it sets aside is recorded for it.
+#[test]
+fn a_repeated_hybrid_stream_records_each_sections_conflicts() {
+    let mut out = object_stream_file("3 0 ", "<< /Hidden (yes) >>", 0);
+    let stream = find(&out, b"5 0 obj", 0, out.len()).unwrap();
+    let catalog = find(&out, b"1 0 obj", 0, out.len()).unwrap();
+    let base = rfind(&out, b"\nxref\n", 0).unwrap() + 1;
+    // This section's table places object 3 at the catalog; the stream puts it in object stream 4.
+    let older = out.len();
+    out.extend_from_slice(
+        format!("xref\n3 1\n{catalog:010} 00000 n \ntrailer << /Size 6 /Root 1 0 R /XRefStm {stream} /Prev {base} >>\nstartxref\n{older}\n%%EOF\n")
+            .as_bytes(),
+    );
+    let newer = out.len();
+    out.extend_from_slice(format!("xref\ntrailer << /Size 6 /Root 1 0 R /XRefStm {stream} /Prev {older} >>\nstartxref\n{newer}\n%%EOF\n").as_bytes());
+    let doc = Document::open(Arc::new(out)).unwrap();
+    assert_eq!(doc.xref_oddities(), [(older as u64, 3)]);
+    assert_eq!(text_of(&doc, 3, b"Hidden").as_deref(), Some("yes"));
+}
+
+fn text_of(doc: &Document, num: u32, key: &[u8]) -> Option<String> {
+    doc.get(ObjRef::new(num, 0)).as_dict().and_then(|d| d.get(key).and_then(|v| v.as_string().map(|s| s.to_text())))
+}
+
+/// An object stream member numbered 2^32 + 3 is not object 3 (#1815): the number used to be
+/// cast to `u32`, which dropped the high bits.
+#[test]
+fn object_stream_numbers_beyond_u32_are_not_truncated() {
+    let control = Document::open(Arc::new(object_stream_file("3 0 ", "<< /Member (yes) >>", 0))).unwrap();
+    assert_eq!(text_of(&control, 3, b"Member").as_deref(), Some("yes"));
+    let doc = Document::open(Arc::new(object_stream_file("4294967299 0 ", "<< /Member (yes) >>", 0))).unwrap();
+    assert!(matches!(*doc.get(ObjRef::new(3, 0)), Object::Null), "{:?}", doc.get(ObjRef::new(3, 0)));
+    assert!(!doc.xref_entry_is_exact(3));
+}
+
+/// Member starts are checked rather than cast, so they cannot wrap on any target (#1815).
+#[test]
+fn object_stream_member_starts_are_checked() {
+    assert_eq!(objstm_member(3, 4, Some(10), 20), Some((3, 14)));
+    assert_eq!(objstm_member(3, 9, Some(10), 20), Some((3, 19)), "the last byte");
+    assert_eq!(objstm_member(3, 10, Some(10), 20), None, "at the end of the data");
+    assert_eq!(objstm_member(3, 1, Some(usize::MAX), 20), None, "/First plus the offset overflows");
+    assert_eq!(objstm_member(3, i64::MAX, Some(10), 20), None);
+    assert_eq!(objstm_member(3, -1, Some(10), 20), None);
+    assert_eq!(objstm_member(3, 0, None, 20), None, "/First does not fit in usize");
+    assert_eq!(objstm_member(i64::from(u32::MAX), 0, Some(0), 1), Some((u32::MAX, 0)));
+    assert_eq!(objstm_member(i64::from(u32::MAX) + 1, 0, Some(0), 1), None);
+    assert_eq!(objstm_member(-1, 0, Some(0), 1), None);
+}
+
+/// A member at a negative offset is unusable, not the stream's first member (#1815): the
+/// offset used to be clamped to zero, which read the object at `/First`.
+#[test]
+fn object_stream_negative_offsets_are_refused() {
+    let doc = Document::open(Arc::new(object_stream_file("7 0 3 -1 ", "<< /First (yes) >>", 1))).unwrap();
+    assert!(matches!(*doc.get(ObjRef::new(3, 0)), Object::Null), "{:?}", doc.get(ObjRef::new(3, 0)));
+    let control = Document::open(Arc::new(object_stream_file("7 0 3 19 ", "<< /First (yes) >> << /Second (yes) >>", 1))).unwrap();
+    assert_eq!(text_of(&control, 3, b"Second").as_deref(), Some("yes"));
+}
+
+#[test]
+fn revision_ends_split_incremental_updates() {
+    let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
+    let first = bytes.len();
+    let doc = Document::open(Arc::new(bytes.clone())).unwrap();
+    assert_eq!(doc.revision_ends(), vec![first]);
+    let mut edited = doc.clone();
+    edited.update_dict(ObjRef::new(1, 0), |d| d.set(b"Lang".to_vec(), Object::String(crate::PdfString::literal("en")))).unwrap();
+    bytes = crate::write_incremental(&edited, &crate::SaveOptions::default()).unwrap();
+    let doc = Document::open(Arc::new(bytes.clone())).unwrap();
+    let ends = doc.revision_ends();
+    assert_eq!(ends.len(), 2, "{ends:?}");
+    assert!(ends[0] >= first && ends[0] < bytes.len() && ends[1] == bytes.len(), "{ends:?} of {}", bytes.len());
+    // The first revision opens on its own, without the update.
+    let old = Document::open(Arc::new(bytes[..ends[0]].to_vec())).unwrap();
+    assert!(old.get(ObjRef::new(1, 0)).as_dict().unwrap().get(b"Lang").is_none());
+}
+
+/// qpdf's `xref-compressed-in-compressed.pdf` in miniature: object 3 is an object stream
+/// holding object 4, and the cross-reference stream says object 3 itself lives in stream 99.
+fn compressed_in_compressed_fixture() -> Document {
+    let mut out = b"%PDF-1.5\n".to_vec();
+    let at = |out: &mut Vec<u8>, num: u32, body: &str| {
+        let off = out.len();
+        out.extend_from_slice(format!("{num} 0 obj\n{body}\nendobj\n").as_bytes());
+        off as u16
+    };
+    let o1 = at(&mut out, 1, "<< /Type /Catalog /Pages 2 0 R /Outlines 4 0 R >>");
+    let o2 = at(&mut out, 2, "<< /Type /Pages /Kids [] /Count 0 >>");
+    let inner = "<< /Type /Outlines /Count 0 >>";
+    at(&mut out, 3, &format!("<< /Type /ObjStm /N 1 /First 4 /Length {} >>\nstream\n4 0 {inner}\nendstream", 4 + inner.len()));
+    // /W [1 2 1]: object 3 is said to live in stream 99 (which does not exist), 4 in stream 3.
+    let rows: Vec<[u8; 4]> =
+        vec![[0, 0, 0, 255], [1, 0, o1 as u8, 0], [1, 0, o2 as u8, 0], [2, 0, 99, 0], [2, 0, 3, 0], [1, (out.len() >> 8) as u8, out.len() as u8, 0]];
+    let rows: Vec<u8> = rows.concat();
+    let xref = out.len();
+    out.extend_from_slice(
+        format!("5 0 obj\n<< /Type /XRef /W [1 2 1] /Index [0 6] /Size 6 /Root 1 0 R /Length {} >>\nstream\n", rows.len()).as_bytes(),
+    );
+    out.extend_from_slice(&rows);
+    out.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+/// An object stream whose own cross-reference entry says it is compressed inside another
+/// stream (which the format forbids, and which does not exist here: qpdf's
+/// `xref-compressed-in-compressed.pdf`, #2367) could not be loaded, so every object in it
+/// read as null and a full save wrote `/Outlines null`. The stream is now found by its own
+/// header, as a plain object with a wrong offset is.
+#[test]
+fn an_object_stream_marked_as_compressed_is_found_by_its_header() {
+    let doc = compressed_in_compressed_fixture();
+    assert_eq!(doc.revisions().len(), 1, "the chain itself reads: {:?}", doc.repair_log());
+    let outlines = doc.get(ObjRef::new(4, 0));
+    assert_eq!(outlines.as_dict().and_then(|d| d.name(b"Type")), Some(&b"Outlines"[..]), "{outlines:?}");
+    let saved = crate::write_full(&doc, &crate::SaveOptions::default()).unwrap();
+    let back = Document::open(Arc::new(saved)).unwrap();
+    let catalog = back.get(back.root().unwrap());
+    let outlines = back.resolve(catalog.as_dict().unwrap().get(b"Outlines").unwrap());
+    assert_eq!(outlines.as_dict().and_then(|d| d.name(b"Type")), Some(&b"Outlines"[..]), "the full save keeps it: {outlines:?}");
+}
+
+/// The header fallback is for file entries only: once the stream is freed (or replaced) in
+/// the overlay, its objects must not come back from the file's copy of it.
+#[test]
+fn a_freed_object_stream_is_not_found_by_its_header() {
+    let doc = compressed_in_compressed_fixture();
+    assert!(doc.get(ObjRef::new(4, 0)).as_dict().is_some());
+    let mut edited = doc.clone();
+    edited.free(ObjRef::new(3, 0));
+    let fresh = edited.object_reader().document;
+    assert!(matches!(*fresh.get(ObjRef::new(4, 0)), Object::Null), "{:?}", fresh.get(ObjRef::new(4, 0)));
+    let mut replaced = doc.clone();
+    replaced.set(ObjRef::new(3, 0), Object::Int(0));
+    let fresh = replaced.object_reader().document;
+    assert!(matches!(*fresh.get(ObjRef::new(4, 0)), Object::Null), "{:?}", fresh.get(ObjRef::new(4, 0)));
+}
+
+/// The same once the free is saved: the revision's table says the stream is free, and
+/// neither reading the file back nor rewriting it in full brings its objects back.
+#[test]
+fn a_container_freed_in_a_saved_revision_is_not_found_by_its_header() {
+    let mut edited = compressed_in_compressed_fixture();
+    edited.free(ObjRef::new(3, 0));
+    let incremental = crate::write_incremental(&edited, &crate::SaveOptions::default()).unwrap();
+    let reopened = Document::open(Arc::new(incremental)).unwrap();
+    assert_eq!(reopened.revisions().len(), 2);
+    assert!(matches!(reopened.xref_entry(3), Some(XrefEntry::Free { .. })));
+    assert!(matches!(*reopened.get(ObjRef::new(4, 0)), Object::Null), "{:?}", reopened.get(ObjRef::new(4, 0)));
+    for object_streams in [true, false] {
+        let opts = crate::SaveOptions { object_streams, ..Default::default() };
+        let full = crate::write_full(&reopened, &opts).unwrap();
+        let back = Document::open(Arc::new(full)).unwrap();
+        let catalog = back.get(back.root().unwrap());
+        let outlines = catalog.as_dict().unwrap().get(b"Outlines").map(|o| back.resolve(o));
+        assert!(outlines.as_ref().is_none_or(|o| matches!(**o, Object::Null)), "the full save keeps it out: {outlines:?}");
+    }
+}
+
+/// A trailer whose /Prev is written as the reference `N 0 R` (tiff2pdf did this; the files
+/// are JHOVE's PDF-HUL-157 cases, #2366) used to end the cross-reference chain silently, so
+/// every object of the earlier sections read as null: a four-page file showed one page, and
+/// a full save wrote the three missing kids as null. The offset is read from the reference.
+#[test]
+fn a_prev_written_as_a_reference_still_reaches_the_earlier_sections() {
+    let base =
+        build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 >>", "<< /Type /Page /Parent 2 0 R >>"], "/Root 1 0 R");
+    let prev = String::from_utf8_lossy(&base).rfind("xref\n0 4").unwrap();
+    let update = |prev_entry: &str| {
+        let mut bytes = base.clone();
+        let at = bytes.len();
+        bytes.extend_from_slice(b"4 0 obj\n<< /Title (Update) >>\nendobj\n");
+        let xref = bytes.len();
+        bytes.extend_from_slice(
+            format!("xref\n4 1\n{at:010} 00000 n \ntrailer\n<< /Size 5 /Root 1 0 R /Info 4 0 R /Prev {prev_entry} >>\nstartxref\n{xref}\n%%EOF\n")
+                .as_bytes(),
+        );
+        Document::open(Arc::new(bytes)).unwrap()
+    };
+    let good = update(&prev.to_string());
+    let bad = update(&format!("{prev} 0 R"));
+    assert!(good.repair_log().is_empty(), "{:?}", good.repair_log());
+    assert_eq!(bad.revisions().len(), 2, "{:?}", bad.repair_log());
+    assert_eq!(bad.repair_log().len(), 1, "a note about the /Prev: {:?}", bad.repair_log());
+    assert_eq!(bad.xref_entry(3), good.xref_entry(3), "the page of the first section is reached");
+    assert_eq!(bad.get(ObjRef::new(3, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(&b"Page"[..]));
+    assert_eq!(
+        bad.get(ObjRef::new(4, 0)).as_dict().and_then(|d| d.get(b"Title").and_then(|t| t.as_string().map(|s| s.to_text()))),
+        Some("Update".into())
+    );
+}
+
+/// iText's `indirectPrev.pdf` in miniature: the update's trailer gives `/Prev 4 0 R`, and
+/// object 4, listed in that update, holds the offset of the first section. Read as offset 4
+/// (inside the header), the chain broke and the file was rebuilt without its revisions.
+#[test]
+fn a_prev_reference_to_an_object_holding_the_offset_reads_that_offset() {
+    let mut bytes =
+        build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 >>", "<< /Type /Page /Parent 2 0 R >>"], "/Root 1 0 R");
+    let prev = String::from_utf8_lossy(&bytes).rfind("xref\n0 4").unwrap();
+    let mut at = Vec::new();
+    for (num, body) in
+        [(2, "<< /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 >>".to_string()), (4, prev.to_string()), (5, "<< /Type /Page /Parent 2 0 R >>".into())]
+    {
+        at.push(bytes.len());
+        bytes.extend_from_slice(format!("{num} 0 obj\n{body}\nendobj\n").as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(
+        format!(
+            "xref\n2 1\n{:010} 00000 n \n4 2\n{:010} 00000 n \n{:010} 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R /Prev 4 0 R >>\nstartxref\n{xref}\n%%EOF\n",
+            at[0], at[1], at[2]
+        )
+        .as_bytes(),
+    );
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.revisions().len(), 2, "{:?}", doc.repair_log());
+    assert_eq!(doc.repair_log().len(), 1, "a note about the /Prev, and no rebuild: {:?}", doc.repair_log());
+    assert!(doc.repair_log()[0].contains(&format!("the offset {prev}")), "{:?}", doc.repair_log());
+    assert_eq!(doc.get(ObjRef::new(3, 0)).as_dict().and_then(|d| d.name(b"Type")), Some(&b"Page"[..]));
+    assert_compact_matches_materialized(&doc);
+}
+
+/// A file whose only trailers are cross-reference stream dictionaries, with its `startxref`
+/// out of reach (here a second file appended after it, cut off before its own
+/// cross-reference data, as in #2365), is rebuilt from its object headers. The rebuild used
+/// to look only for the `trailer` keyword, so /Info and /ID were lost, and a full save after
+/// editing one Info field dropped every other.
+#[test]
+fn reconstruction_takes_the_trailer_from_a_cross_reference_stream() {
+    let table = build(
+        &["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Title (Kept) /Creator (Me) >>"],
+        "/Root 1 0 R /Info 3 0 R",
+    );
+    let packed = crate::write_full(&Document::open(Arc::new(table)).unwrap(), &crate::SaveOptions::default()).unwrap();
+    let text = String::from_utf8_lossy(&packed);
+    assert!(text.contains("/XRef") && !text.contains("trailer"), "a cross-reference stream is the only trailer");
+    let mut bytes = packed.clone();
+    let appended = format!("%PDF-1.3\n90 0 obj\n<< /Length 5000 >>\nstream\n{}\nendstream\nendobj\n", "x".repeat(5000));
+    bytes.extend_from_slice(appended.as_bytes());
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert!(doc.revisions().is_empty(), "rebuilt: {:?}", doc.repair_log());
+    let info = doc.trailer().reference(b"Info").expect("the cross-reference stream's /Info");
+    let field = |d: &Document, key: &[u8]| d.get(info).as_dict().unwrap().get(key).unwrap().as_string().unwrap().bytes.clone();
+    assert_eq!(field(&doc, b"Title"), b"Kept");
+    assert!(doc.trailer().get(b"ID").is_some(), "and its /ID");
+    let mut edited = doc.clone();
+    edited.update_dict(info, |d| d.set(b"Subject".to_vec(), Object::String(crate::PdfString::literal("new")))).unwrap();
+    let saved = crate::write_full(&edited, &crate::SaveOptions::default()).unwrap();
+    let back = Document::open(Arc::new(saved)).unwrap();
+    assert!(back.repair_log().is_empty(), "{:?}", back.repair_log());
+    let info = back.trailer().reference(b"Info").expect("the full save keeps /Info");
+    let field = |key: &[u8]| back.get(info).as_dict().unwrap().get(key).unwrap().as_string().unwrap().bytes.clone();
+    assert_eq!((field(b"Title"), field(b"Creator"), field(b"Subject")), (b"Kept".to_vec(), b"Me".to_vec(), b"new".to_vec()));
+}
+
+/// A rebuild prefers a trailer whose /Root is the catalog (as `root_is_catalog` judges it): a
+/// later cross-reference stream whose /Root points at the Info dictionary does not replace an
+/// earlier good trailer, or a full save would write the Info dictionary as /Root.
+#[test]
+fn reconstruction_skips_a_trailer_whose_root_is_not_the_catalog() {
+    let mut bytes =
+        build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>", "<< /Title (Kept) >>"], "/Root 1 0 R /Info 3 0 R");
+    bytes.extend_from_slice(b"4 0 obj\n<< /Type /XRef /Size 5 /W [1 1 1] /Root 3 0 R /Length 3 >>\nstream\nabc\nendstream\nendobj\n");
+    let appended = format!("%PDF-1.3\n90 0 obj\n<< /Length 5000 >>\nstream\n{}\nendstream\nendobj\n", "x".repeat(5000));
+    bytes.extend_from_slice(appended.as_bytes());
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert!(doc.repair_log().iter().any(|l| l.contains("rebuilt")), "{:?}", doc.repair_log());
+    assert_eq!(doc.trailer().reference(b"Root").map(|r| r.num), Some(1), "the catalog, not the Info dictionary");
+    assert_eq!(doc.trailer().reference(b"Info").map(|r| r.num), Some(3));
+}
+
+#[test]
+fn damaged_xref_is_reconstructed() {
+    let mut bytes = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [] /Count 0 >>"], "/Root 1 0 R");
+    let n = bytes.len();
+    bytes[n - 12..n - 6].copy_from_slice(b"999999"); // point startxref into nowhere
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert!(doc.revisions().is_empty());
+    assert!(!doc.repair_log().is_empty());
+    assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+}
+
+#[test]
+fn a_decompression_bomb_in_an_xref_stream_is_refused_and_the_file_reconstructed() {
+    // 32 MiB of rows behind two FlateDecode filters (a few hundred bytes in the file) for
+    // /W [1 1 1]: at 3 bytes a row that is more than 8,388,607 objects' worth, so it is not
+    // decoded (in full: the limit applies while inflating) and the objects are found by
+    // reconstruction instead.
+    let bomb = pdfcraft_filters::encode_flate(&pdfcraft_filters::encode_flate(&vec![0u8; 32 << 20]));
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let o1 = bytes.len();
+    bytes.extend_from_slice(b"1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n");
+    let o2 = bytes.len();
+    bytes.extend_from_slice(b"2 0 obj\n<< /Type /Pages /Kids [] /Count 0 >>\nendobj\n");
+    let x = bytes.len();
+    bytes.extend_from_slice(
+        format!("3 0 obj\n<< /Type /XRef /Size 4 /W [1 1 1] /Root 1 0 R /Filter [/FlateDecode /FlateDecode] /Length {} >>\nstream\n", bomb.len())
+            .as_bytes(),
+    );
+    bytes.extend_from_slice(&bomb);
+    bytes.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{x}\n%%EOF\n").as_bytes());
+    assert!(o1 < o2 && o2 < x);
+    let doc = Document::open(Arc::new(bytes)).unwrap();
+    assert_eq!(doc.root(), Some(ObjRef::new(1, 0)));
+    assert!(doc.repair_log().iter().any(|l| l.contains("limit")), "{:?}", doc.repair_log());
+}
+
+#[test]
+fn a_stream_whose_length_is_itself_and_never_ends_loads_quickly() {
+    // From the nightly fuzz job: `6 0 obj << /Length 6 0 R >> stream` with no `endstream`
+    // after it. Every parse attempt failed, and each attempt resolved the length by loading
+    // object 6 again, retrying the same ways down to the nesting limit: about 2^32 parses.
+    // Objects being loaded are now a seen-set, lengths are memoised, and the second parse
+    // only runs when the header is shifted.
+    let mut bytes = b"%PDF-1.7\n1 0 obj\n<< /Type /Catalog >>\nendobj\n".to_vec();
+    bytes.extend_from_slice(b"6 0 obj\n<< /Length 6 0 R >>\nstream\nno end marker follows\n");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        if let Ok(doc) = Document::open(Arc::new(bytes)) {
+            let _ = doc.try_get(6);
+        }
+        let _ = tx.send(());
+    });
+    rx.recv_timeout(std::time::Duration::from_secs(20)).expect("loading must not retry exponentially");
+}
diff --git a/crates/cos/src/document/xref.rs b/crates/cos/src/document/xref.rs
new file mode 100644
index 0000000000..96a782c1a9
--- /dev/null
+++ b/crates/cos/src/document/xref.rs
@@ -0,0 +1,277 @@
+use super::*;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum XrefEntry {
+    Free { next_generation: u16 },
+    InFile { offset: u64, generation: u16 },
+    InStream { stream: u32, index: u32 },
+}
+
+#[derive(Clone, Copy, Debug)]
+pub(super) struct XrefRange {
+    pub(super) start: u32,
+    pub(super) count: u32,
+    pub(super) offset: usize,
+    pub(super) stride: usize,
+}
+
+#[derive(Clone, Debug)]
+pub(super) enum XrefSectionData {
+    Table,
+    Stream { bytes: Arc<Vec<u8>>, widths: [usize; 3] },
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct XrefSection {
+    pub(super) data: XrefSectionData,
+    pub(super) ranges: Vec<XrefRange>,
+    pub(super) row_count: usize,
+    pub(super) max_num: u32,
+    pub(super) has_entries: bool,
+    /// A table subsection was read one number lower than it says ([`subsection_start`]).
+    pub(super) renumbered: bool,
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct XrefRevisionSection {
+    pub(super) primary: XrefSection,
+    pub(super) hybrid: Option<XrefSection>,
+}
+
+#[derive(Clone, Debug)]
+pub(super) enum XrefIndex {
+    Compact { revisions: Vec<XrefRevisionSection>, max_num: u32, has_entries: bool },
+    Materialized(Arc<BTreeMap<u32, XrefEntry>>),
+}
+
+pub(super) const MAX_COMPACT_XREF_ROWS: usize = 2_000_000;
+
+pub(super) const MAX_COMPACT_XREF_BYTES: usize = 64 * 1024 * 1024;
+
+impl XrefSection {
+    pub(super) fn has_any_entry(&self) -> bool {
+        match &self.data {
+            XrefSectionData::Table => self.has_entries,
+            XrefSectionData::Stream { bytes, widths } => {
+                let row_width = widths.iter().sum::<usize>();
+                if row_width == 0 {
+                    return false;
+                }
+                for range in &self.ranges {
+                    let available = bytes.len().saturating_sub(range.offset) / row_width;
+                    for i in 0..available.min(range.count as usize) {
+                        let Some(offset) = i.checked_mul(row_width).and_then(|delta| range.offset.checked_add(delta)) else { continue };
+                        let Some(row) = bytes.get(offset..offset.saturating_add(row_width)) else { continue };
+                        let read_field = |from: usize, width: usize, default: u64| -> Option<u64> {
+                            if width == 0 {
+                                return Some(default);
+                            }
+                            let end = from.checked_add(width)?;
+                            Some(row.get(from..end)?.iter().fold(0u64, |acc, byte| acc.wrapping_shl(8) | u64::from(*byte)))
+                        };
+                        let Some(kind) = read_field(0, widths[0], 1) else { continue };
+                        if kind == 0 || kind == 2 {
+                            return true;
+                        }
+                        if kind == 1 && read_field(widths[0], widths[1], 0).is_some_and(|offset| offset != 0) {
+                            return true;
+                        }
+                    }
+                }
+                false
+            }
+        }
+    }
+
+    pub(super) fn retained_bytes(&self) -> usize {
+        match &self.data {
+            XrefSectionData::Table => 0,
+            XrefSectionData::Stream { bytes, .. } => bytes.capacity(),
+        }
+    }
+
+    pub(super) fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
+        let after = self.ranges.partition_point(|range| range.start <= num);
+        let range = self.ranges.get(after.checked_sub(1)?)?;
+        let end = u64::from(range.start).checked_add(u64::from(range.count))?;
+        if u64::from(num) >= end {
+            return None;
+        }
+        let row = usize::try_from(num.checked_sub(range.start)?).ok()?;
+        let offset = range.offset.checked_add(row.checked_mul(range.stride)?)?;
+        match &self.data {
+            XrefSectionData::Table => {
+                let mut lexer = Lexer::new(file, offset);
+                lexer.skip_ws();
+                let object_offset = lexer.token();
+                lexer.skip_ws();
+                let generation = lexer.token();
+                lexer.skip_ws();
+                let kind = lexer.token();
+                match kind {
+                    b"n" => {
+                        let object_offset = std::str::from_utf8(object_offset).ok()?.parse::<u64>().ok()?;
+                        if object_offset == 0 {
+                            return None;
+                        }
+                        let generation = std::str::from_utf8(generation).ok()?.parse::<u32>().unwrap_or(0).min(u16::MAX as u32) as u16;
+                        Some(XrefEntry::InFile { offset: object_offset, generation })
+                    }
+                    b"f" => {
+                        let generation = std::str::from_utf8(generation).ok()?.parse::<u32>().unwrap_or(0).min(u16::MAX as u32) as u16;
+                        Some(XrefEntry::Free { next_generation: generation })
+                    }
+                    _ => None,
+                }
+            }
+            XrefSectionData::Stream { bytes, widths } => {
+                let row_width = widths.iter().sum::<usize>();
+                let end = offset.checked_add(row_width)?;
+                let row = bytes.get(offset..end)?;
+                let field = |from: usize, width: usize, default: u64| -> Option<u64> {
+                    if width == 0 {
+                        return Some(default);
+                    }
+                    let end = from.checked_add(width)?;
+                    Some(row.get(from..end)?.iter().fold(0u64, |acc, byte| acc.wrapping_shl(8) | u64::from(*byte)))
+                };
+                let kind = field(0, widths[0], 1)?;
+                let a = field(widths[0], widths[1], 0)?;
+                let b = field(widths[0] + widths[1], widths[2], 0)?;
+                let entry = match kind {
+                    0 => XrefEntry::Free { next_generation: b.min(u16::MAX as u64) as u16 },
+                    1 => XrefEntry::InFile { offset: a, generation: b.min(u16::MAX as u64) as u16 },
+                    2 => XrefEntry::InStream { stream: a.min(u32::MAX as u64) as u32, index: b.min(u32::MAX as u64) as u32 },
+                    _ => return None,
+                };
+                (!matches!(entry, XrefEntry::InFile { offset: 0, .. })).then_some(entry)
+            }
+        }
+    }
+
+    pub(super) fn extend_numbers(&self, numbers: &mut Vec<u32>) {
+        for range in &self.ranges {
+            let available = match &self.data {
+                XrefSectionData::Table => range.count as usize,
+                XrefSectionData::Stream { bytes, widths } => {
+                    let row_width = widths.iter().sum::<usize>();
+                    bytes.len().saturating_sub(range.offset).checked_div(row_width).unwrap_or(0)
+                }
+            };
+            for i in 0..available.min(range.count as usize) {
+                if let Ok(i) = u32::try_from(i)
+                    && let Some(num) = range.start.checked_add(i)
+                {
+                    numbers.push(num);
+                }
+            }
+        }
+    }
+}
+
+impl XrefRevisionSection {
+    pub(super) fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
+        let primary = self.primary.lookup(num, file);
+        let hybrid = self.hybrid.as_ref().and_then(|section| section.lookup(num, file));
+        match primary {
+            None | Some(XrefEntry::Free { .. }) => hybrid.or(primary),
+            entry => entry,
+        }
+    }
+
+    fn extend_numbers(&self, numbers: &mut Vec<u32>) {
+        self.primary.extend_numbers(numbers);
+        if let Some(hybrid) = &self.hybrid {
+            hybrid.extend_numbers(numbers);
+        }
+    }
+}
+
+impl XrefIndex {
+    pub(super) fn empty() -> Self {
+        Self::Materialized(Arc::new(BTreeMap::new()))
+    }
+
+    pub(super) fn lookup(&self, num: u32, file: &[u8]) -> Option<XrefEntry> {
+        match self {
+            Self::Compact { revisions, .. } => revisions.iter().find_map(|revision| revision.lookup(num, file)),
+            Self::Materialized(entries) => entries.get(&num).copied(),
+        }
+    }
+
+    pub(super) fn is_empty(&self) -> bool {
+        match self {
+            Self::Compact { has_entries, .. } => !has_entries,
+            Self::Materialized(entries) => entries.is_empty(),
+        }
+    }
+
+    /// Drop an entry for object number 4294967295, which no incremental `/Size` can cover.
+    /// Only a materialized index can hold one: the compact reader requires `max_num < /Size`.
+    pub(super) fn remove_exhausted(&mut self) -> bool {
+        match self {
+            Self::Compact { .. } => false,
+            Self::Materialized(entries) => Arc::make_mut(entries).remove(&u32::MAX).is_some(),
+        }
+    }
+
+    /// Every entry, newest section first, as the materialized reader keeps them.
+    pub(super) fn to_map(&self, file: &[u8]) -> BTreeMap<u32, XrefEntry> {
+        match self {
+            Self::Materialized(entries) => entries.as_ref().clone(),
+            Self::Compact { revisions, .. } => {
+                let mut numbers = Vec::new();
+                for revision in revisions {
+                    revision.extend_numbers(&mut numbers);
+                }
+                numbers.into_iter().filter_map(|num| self.lookup(num, file).map(|entry| (num, entry))).collect()
+            }
+        }
+    }
+
+    pub(super) fn max_num(&self) -> u32 {
+        match self {
+            Self::Compact { max_num, .. } => *max_num,
+            Self::Materialized(entries) => entries.keys().next_back().copied().unwrap_or(0),
+        }
+    }
+
+    pub(super) fn object_numbers(&self, file: &[u8]) -> Vec<u32> {
+        match self {
+            Self::Materialized(entries) => {
+                entries.iter().filter_map(|(&num, entry)| (!matches!(entry, XrefEntry::Free { .. })).then_some(num)).collect()
+            }
+            Self::Compact { revisions, .. } => {
+                if let [revision] = revisions.as_slice()
+                    && revision.hybrid.is_none()
+                {
+                    let mut numbers = Vec::with_capacity(revision.primary.row_count);
+                    revision.primary.extend_numbers(&mut numbers);
+                    numbers.retain(|num| self.lookup(*num, file).is_some_and(|entry| !matches!(entry, XrefEntry::Free { .. })));
+                    return numbers;
+                }
+                let mut numbers = Vec::new();
+                for revision in revisions {
+                    revision.extend_numbers(&mut numbers);
+                }
+                numbers.sort_unstable();
+                numbers.dedup();
+                numbers.retain(|num| self.lookup(*num, file).is_some_and(|entry| !matches!(entry, XrefEntry::Free { .. })));
+                numbers
+            }
+        }
+    }
+}
+
+/// One cross-reference section of the file (one per save; the first is the original).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Revision {
+    /// Offset of the xref section (`startxref` value).
+    pub xref_offset: u64,
+    /// `true` if the section is a cross-reference stream.
+    pub is_stream: bool,
+    /// `true` if `xref_offset` counts from the `%PDF-` header rather than from the start of the
+    /// file. The two differ only in a file with bytes before its header, and an update appended
+    /// to such a file must count the same way as the section it points back to.
+    pub header_relative: bool,
+}
diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index b151399fef..627f716495 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -2,17 +2,20 @@
 //!
 //! * `write_incremental` appends the edited objects, a cross-reference section in the same style
 //!   as the file's last one (table or stream) and a trailer with `/Prev`. The original bytes are
-//!   never modified, which keeps digital signatures over earlier revisions valid.
+//!   never modified, which keeps digital signatures over earlier revisions valid. With
+//!   `SaveOptions::drop_unlinked`, objects added since the file was read that nothing refers to
+//!   any more are left out (written as free).
 //! * `write_full` writes only objects reachable from the trailer, renumbered densely, with a
 //!   cross-reference table or stream — the "Save As" / garbage-collecting path. Unknown trailer
 //!   entries are copied, including objects reachable only from them.
 
 use std::borrow::Cow;
-use std::collections::{BTreeMap, HashMap, VecDeque};
+use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
 use std::io::Write;
+use std::sync::Arc;
 
 use crate::CosError;
-use crate::document::{Document, ObjectReader};
+use crate::document::{Document, ObjectReader, XrefEntry};
 use crate::object::{Dict, ObjRef, Object, PdfString, Stream};
 
 /// Serialize one object. Deterministic: same object → same bytes.
@@ -156,11 +159,18 @@ pub struct SaveOptions {
     /// Full saves: pack non-stream objects into compressed object streams with a cross-reference
     /// stream (PDF 1.5+, §7.5.7–7.5.8). Off writes a classic table that any reader accepts.
     pub object_streams: bool,
+    /// Incremental saves: leave out what was added since the file was read and nothing refers to
+    /// any more, such as a comment added and deleted again or a redaction mark added and cleared
+    /// (written as free). Off by default, because a writer may add an object only it finds again
+    /// by scanning, as a standalone document timestamp is; such a writer frees the leftovers
+    /// before adding it, with [`Document::free_unlinked_additions`]. Full saves always leave
+    /// these out.
+    pub drop_unlinked: bool,
 }
 
 impl Default for SaveOptions {
     fn default() -> Self {
-        Self { mod_date: None, id_seed: 0x5052_494E_5443_5241, object_streams: true }
+        Self { mod_date: None, id_seed: 0x5052_494E_5443_5241, object_streams: true, drop_unlinked: false }
     }
 }
 
@@ -209,8 +219,14 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>,
     let base = (original.len() + usize::from(newline)).saturating_sub(shift) as u64;
     let mut out = Vec::new();
     let mut offsets: BTreeMap<u32, (u64, u16, bool)> = BTreeMap::new(); // num → (offset, gen, in use)
+    let unlinked = if opts.drop_unlinked { unlinked_additions(&doc) } else { HashSet::new() };
     for (num, generation, obj) in doc.overlay_entries() {
         match obj {
+            // Written as free, so `/Size` still covers every number this document handed out. The
+            // generation stays: the number was never in use, and an undo can bring it back as is.
+            Some(_) if unlinked.contains(&num) => {
+                offsets.insert(num, (0, generation, false));
+            }
             Some(o) => {
                 offsets.insert(num, (base + out.len() as u64, generation, true));
                 write_indirect(num, generation, &prepared(&doc, num, num, generation, &o), &mut out);
@@ -387,7 +403,7 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
 /// Object `r` read again for writing. The traversal read it once and only kept its number, so
 /// a second read that fails, finds nothing or finds a different kind of object must fail the
 /// save rather than write `null` in its place.
-fn reread(reader: &mut ObjectReader, r: ObjRef, is_stream: bool) -> Result<std::sync::Arc<Object>, CosError> {
+fn reread(reader: &mut ObjectReader, r: ObjRef, is_stream: bool) -> Result<Arc<Object>, CosError> {
     let o = reader.try_get(r)?;
     if matches!(*o, Object::Null) || matches!(*o, Object::Stream(_)) != is_stream {
         return Err(CosError::Syntax { offset: 0, detail: format!("object {} read differently while saving; nothing was written", r.num) });
@@ -439,6 +455,37 @@ fn output_number(index: usize) -> Result<u32, CosError> {
     u32::try_from(index).ok().and_then(|n| n.checked_add(1)).ok_or_else(|| CosError::Syntax { offset: 0, detail: "too many objects to save".into() })
 }
 
+/// Objects added since the file was read (their numbers are not in use in it) that nothing an
+/// incremental update writes refers to: what one edit added and a later one unlinked, such as a
+/// deleted comment or a cleared redaction mark. The file never held them, so leaving them out
+/// loses nothing, while writing them would keep what the user removed. Only the update is walked:
+/// from the trailer and the file's changed objects through additions. An unchanged object of the
+/// file is not followed: a reference it holds to such a number already reads as null in the file
+/// (a damaged file's dangling reference), and it still does.
+pub(crate) fn unlinked_additions(doc: &Document) -> HashSet<u32> {
+    let added = |num: u32| matches!(doc.xref_entry(num), None | Some(XrefEntry::Free { .. }));
+    let mut pending: HashMap<u32, Arc<Object>> =
+        doc.overlay_entries().filter_map(|(num, _, o)| Some((num, o?))).filter(|(num, _)| added(*num)).collect();
+    if pending.is_empty() {
+        return HashSet::new();
+    }
+    let mut stack: Vec<ObjRef> = Vec::new();
+    doc.trailer().iter().for_each(|(_, v)| collect_refs(v, &mut |r| stack.push(r)));
+    for (num, _, o) in doc.overlay_entries() {
+        if let Some(o) = o
+            && !added(num)
+        {
+            collect_refs(&o, &mut |r| stack.push(r));
+        }
+    }
+    while let Some(r) = stack.pop() {
+        if let Some(o) = pending.remove(&r.num) {
+            collect_refs(&o, &mut |r| stack.push(r));
+        }
+    }
+    pending.into_keys().collect()
+}
+
 fn collect_refs(o: &Object, f: &mut impl FnMut(ObjRef)) {
     match o {
         Object::Ref(r) => f(*r),
diff --git a/crates/cos/tests/it/writer.rs b/crates/cos/tests/it/writer.rs
index ac04be2e94..1b98664255 100644
--- a/crates/cos/tests/it/writer.rs
+++ b/crates/cos/tests/it/writer.rs
@@ -228,6 +228,63 @@ fn incremental_save_keeps_a_trailer_only_edit() {
     assert_qpdf_clean(&saved);
 }
 
+/// What one edit added and a later one unlinked (a deleted comment, a cleared redaction mark) is
+/// not written: the file never held it, and writing it would keep what was removed. Additions the
+/// update still refers to, from the trailer or a changed object and through other additions, are.
+#[test]
+fn incremental_save_leaves_out_additions_nothing_refers_to() {
+    let mut doc = Document::open(Arc::new(classic_table())).unwrap();
+    let text = |s: &str| Object::String(pdfcraft_cos::PdfString::literal(s.as_bytes().to_vec()));
+    let dict = |entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        entries.iter().for_each(|(k, v)| d.set(k.as_bytes().to_vec(), v.clone()));
+        Object::Dict(d)
+    };
+    let page_obj = ObjRef::new(3, 0);
+    let leaf = doc.add(text("kept leaf"));
+    let kept = doc.add(dict(&[("Leaf", Object::Ref(leaf))]));
+    doc.update_dict(page_obj, |d| d.set(b"PieceInfo".to_vec(), Object::Ref(kept))).unwrap();
+    let by_trailer = doc.add(text("kept by the trailer"));
+    doc.trailer_mut().set(b"Custom".to_vec(), Object::Ref(by_trailer));
+    // Linked from the page and unlinked again, as clearing a mark does.
+    let dropped_leaf = doc.add(text("dropped leaf"));
+    let dropped = doc.add(dict(&[("Leaf", Object::Ref(dropped_leaf))]));
+    doc.update_dict(page_obj, |d| d.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(dropped)]))).unwrap();
+    doc.update_dict(page_obj, |d| {
+        d.remove(b"Annots");
+    })
+    .unwrap();
+    // Unlinked additions that refer to each other.
+    let first = doc.add(Object::Null);
+    let second = doc.add(dict(&[("Next", Object::Ref(first)), ("Note", text("dropped cycle"))]));
+    doc.set(first, dict(&[("Next", Object::Ref(second))]));
+
+    // Off by default: a writer may add what only it finds again, by scanning.
+    let kept_all = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    assert!(kept_all.windows(12).any(|w| w == b"dropped leaf"));
+    let saved = write_incremental(&doc, &SaveOptions { drop_unlinked: true, ..SaveOptions::default() }).unwrap();
+    let holds = |s: &str| saved.windows(s.len()).any(|w| w == s.as_bytes());
+    assert!(holds("kept leaf") && holds("kept by the trailer"));
+    assert!(!holds("dropped leaf") && !holds("dropped cycle"), "unlinked additions are written");
+    let back = Document::open(Arc::new(saved.clone())).unwrap();
+    assert!(back.repair_log().is_empty(), "{:?}", back.repair_log());
+    assert_eq!(back.get(leaf).as_string().map(|s| s.bytes.as_slice()), Some(b"kept leaf".as_slice()));
+    for gone in [dropped, dropped_leaf, first, second] {
+        assert_eq!(*back.get(gone), Object::Null);
+    }
+    assert!(!page(&back).contains(b"Annots"));
+    assert_qpdf_clean(&saved);
+
+    // Freed beforehand, they are written the same way without the option, and what is added
+    // after that, nothing referring to it either (a document timestamp), is kept.
+    let mut freed = doc.clone();
+    freed.free_unlinked_additions();
+    assert_eq!(write_incremental(&freed, &SaveOptions::default()).unwrap(), saved, "the same objects, freed the same way");
+    freed.add(text("added after"));
+    let stamped = write_incremental(&freed, &SaveOptions::default()).unwrap();
+    assert!(stamped.windows(11).any(|w| w == b"added after") && !stamped.windows(12).any(|w| w == b"dropped leaf"));
+}
+
 #[test]
 fn qpdf_accepts_object_stream_output() {
     let qpdf = pdfcraft_oracle::or_skip!(pdfcraft_oracle::qpdf());
diff --git a/crates/edit/src/added.rs b/crates/edit/src/added.rs
index 4157c57e40..40e540fb0c 100644
--- a/crates/edit/src/added.rs
+++ b/crates/edit/src/added.rs
@@ -18,167 +18,20 @@ use unicode_bidi::{Level, ParagraphBidiInfo};
 
 use crate::{EditError, MarkKind, check, contents, matrix_number, n, page_list, place_tagged};
 
-const TAG: &str = "Added";
+mod draw;
+mod layout;
+mod store;
+mod types;
 
-/// The most character spacing an added text takes either way, in points: as far as the font size goes.
-pub const CHAR_SPACING_LIMIT: f64 = 500.0;
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum Family {
-    #[default]
-    Helvetica,
-    Times,
-    Courier,
-}
-
-impl Family {
-    pub fn label(self) -> &'static str {
-        match self {
-            Family::Helvetica => "Helvetica",
-            Family::Times => "Times",
-            Family::Courier => "Courier",
-        }
-    }
-
-    /// The standard-14 font name for this family and style.
-    pub fn base_font(self, bold: bool, italic: bool) -> &'static str {
-        match (self, bold, italic) {
-            (Family::Helvetica, false, false) => "Helvetica",
-            (Family::Helvetica, true, false) => "Helvetica-Bold",
-            (Family::Helvetica, false, true) => "Helvetica-Oblique",
-            (Family::Helvetica, true, true) => "Helvetica-BoldOblique",
-            (Family::Times, false, false) => "Times-Roman",
-            (Family::Times, true, false) => "Times-Bold",
-            (Family::Times, false, true) => "Times-Italic",
-            (Family::Times, true, true) => "Times-BoldItalic",
-            (Family::Courier, false, false) => "Courier",
-            (Family::Courier, true, false) => "Courier-Bold",
-            (Family::Courier, false, true) => "Courier-Oblique",
-            (Family::Courier, true, true) => "Courier-BoldOblique",
-        }
-    }
-
-    fn from_base(base: &[u8]) -> (Family, bool, bool) {
-        let s = String::from_utf8_lossy(base);
-        let family = if s.starts_with("Times") {
-            Family::Times
-        } else if s.starts_with("Courier") {
-            Family::Courier
-        } else {
-            Family::Helvetica
-        };
-        (family, s.contains("Bold"), s.contains("Italic") || s.contains("Oblique"))
-    }
-
-    /// Advance width of `s` at `size` points, from the published standard-14 metrics.
-    ///
-    /// `italic` matters: the item is written out as the oblique/italic face (see [`Family::base_font`]),
-    /// whose published widths differ from the upright face (Times-Italic `A` is 611, Times-Roman 722).
-    pub fn width(self, s: &str, size: f64, bold: bool, italic: bool) -> f64 {
-        self.std14(bold, italic).text_width(s, size)
-    }
-
-    /// The standard-14 face this family means at the given style.
-    pub fn std14(self, bold: bool, italic: bool) -> Std14 {
-        match (self, bold, italic) {
-            (Family::Courier, false, false) => Std14::Courier,
-            (Family::Courier, true, false) => Std14::CourierBold,
-            (Family::Courier, false, true) => Std14::CourierOblique,
-            (Family::Courier, true, true) => Std14::CourierBoldOblique,
-            (Family::Times, false, false) => Std14::TimesRoman,
-            (Family::Times, true, false) => Std14::TimesBold,
-            (Family::Times, false, true) => Std14::TimesItalic,
-            (Family::Times, true, true) => Std14::TimesBoldItalic,
-            (Family::Helvetica, false, false) => Std14::Helvetica,
-            (Family::Helvetica, true, false) => Std14::HelveticaBold,
-            (Family::Helvetica, false, true) => Std14::HelveticaOblique,
-            (Family::Helvetica, true, true) => Std14::HelveticaBoldOblique,
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum Align {
-    #[default]
-    Left,
-    Center,
-    Right,
-    /// Lines (but the last) stretched to the box's width.
-    Justify,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct AddedText {
-    /// The text box in display space; its width wraps the text and its top is the first line's
-    /// top. The height follows the text.
-    pub rect: [f64; 4],
-    pub text: String,
-    pub family: Family,
-    pub bold: bool,
-    pub italic: bool,
-    pub size: f64,
-    pub color: [f64; 3],
-    pub align: Align,
-    /// Extra space after every character, in points: the PDF's character spacing (`Tc`).
-    pub char_spacing: f64,
-}
-
-impl Default for AddedText {
-    fn default() -> Self {
-        AddedText {
-            rect: [0.0; 4],
-            text: String::new(),
-            family: Family::Helvetica,
-            bold: false,
-            italic: false,
-            size: 12.0,
-            color: [0.0; 3],
-            align: Align::Left,
-            char_spacing: 0.0,
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct AddedImage {
-    /// Display space.
-    pub rect: [f64; 4],
-    /// The image XObject.
-    pub image: ObjRef,
-    /// Quarter turns counter-clockwise (0–3).
-    pub rotation: u8,
-    pub flip_h: bool,
-    pub flip_v: bool,
-    /// The fraction trimmed from each side of the image: left, bottom, right, top.
-    pub crop: [f64; 4],
-}
-
-impl AddedImage {
-    pub fn new(rect: [f64; 4], image: ObjRef) -> Self {
-        AddedImage { rect, image, rotation: 0, flip_h: false, flip_v: false, crop: [0.0; 4] }
-    }
-
-    /// The matrix from image space (the unit square) to display space: crop, flip, rotate,
-    /// then fill the box.
-    fn matrix(&self) -> pdfcraft_content::Matrix {
-        use pdfcraft_content::Matrix as M;
-        let [l, b, r, t] = self.crop.map(|v| v.clamp(0.0, 0.45));
-        let (cw, ch) = ((1.0 - l - r).max(0.05), (1.0 - b - t).max(0.05));
-        let mut m = M([1.0 / cw, 0.0, 0.0, 1.0 / ch, -l / cw, -b / ch]);
-        if self.flip_h {
-            m = m.then(&M([-1.0, 0.0, 0.0, 1.0, 1.0, 0.0]));
-        }
-        if self.flip_v {
-            m = m.then(&M([1.0, 0.0, 0.0, -1.0, 0.0, 1.0]));
-        }
-        for _ in 0..self.rotation % 4 {
-            // A quarter turn counter-clockwise within the unit square.
-            m = m.then(&M([0.0, 1.0, -1.0, 0.0, 1.0, 0.0]));
-        }
-        let [x0, y0, x1, y1] = norm(self.rect);
-        m.then(&M([x1 - x0, 0.0, 0.0, y1 - y0, x0, y0]))
-    }
-}
+#[cfg(test)]
+use draw::{GLYPHS_PER_FONT, LaidLine, draw_laid_shaped};
+#[cfg(test)]
+use layout::Piece;
+#[cfg(test)]
+pub(crate) use layout::WRAP_CALLS;
+pub use layout::{PASTE_STEP, first_undrawable, lines, paste_place, paste_rect, text_rect, text_width};
+pub use store::{add_content, delete_content, isolate_content, list_added, scan_markers, update_content};
+pub use types::{Added, AddedImage, AddedText, Align, CHAR_SPACING_LIMIT, Family, MarkerScan};
 
 #[derive(Clone, Debug, PartialEq)]
 pub enum Content {
@@ -214,1035 +67,5 @@ impl Content {
     }
 }
 
-/// An added item on a page.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Added {
-    pub page: usize,
-    /// The item's content stream.
-    pub obj: ObjRef,
-    pub content: Content,
-}
-
-/// PdfCraft-owned page content discovered in one page/content traversal.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct MarkerScan {
-    pub marks: Vec<MarkKind>,
-    pub added: Vec<Added>,
-}
-
-fn nums(doc: &Document, o: Option<&Object>) -> Vec<f64> {
-    o.map(|o| doc.resolve(o)).and_then(|a| a.as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default()
-}
-
-fn norm(r: [f64; 4]) -> [f64; 4] {
-    [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]
-}
-
-/// The advance of `s` in the item's standard font: its glyphs' widths and the character spacing
-/// after each of them, as `Tc` moves the pen (ISO 32000-2 §9.3.2).
-fn latin_width(t: &AddedText, s: &str) -> f64 {
-    t.family.width(s, t.size, t.bold, t.italic) + t.char_spacing * s.chars().count() as f64
-}
-
-/// The lines of a text item after wrapping to its box width.
-pub fn lines(t: &AddedText) -> Vec<String> {
-    wrapped(t).into_iter().map(|(line, _)| line).collect()
-}
-
-#[cfg(test)]
-thread_local! {
-    /// How often [`wrapped`] laid a text out on this thread, for the test that keeps it out of per-line loops.
-    pub(crate) static WRAP_CALLS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-/// [`lines`], each with whether its paragraph runs right to left (its first strong character
-/// does).
-fn wrapped(t: &AddedText) -> Vec<(String, bool)> {
-    #[cfg(test)]
-    WRAP_CALLS.with(|c| c.set(c.get().saturating_add(1)));
-    let width = (t.rect[2] - t.rect[0]).max(t.size);
-    let mut out = Vec::new();
-    for para in t.text.split('\n') {
-        // Arabic or Hebrew: laid out with the bidirectional algorithm and shaped.
-        let rtl_script = para.chars().any(|c| is_arabic(c) || is_hebrew(c));
-        let thai = para.chars().any(is_thai);
-        if thai
-            && !rtl_script
-            && let Ok(lines) = thai_lines(t, para, width)
-        {
-            out.extend(lines.into_iter().map(|line| (line, false)));
-            continue;
-        }
-        let rtl = rtl_script && unicode_bidi::get_base_direction(para) == unicode_bidi::Direction::Rtl;
-        // Arabic words are shaped one by one (joining stops at spaces), so a line's width is the
-        // sum of its words' and shaping stays linear in the paragraph's length. The space is the
-        // paragraph's; a space between Latin words is drawn in the item's font, a few hundredths
-        // of an em apart.
-        let measure = |s: &str| if rtl_script || thai { shaped_width(t, s, rtl) } else { latin_width(t, s) };
-        let space = measure(" ");
-        let (mut line, mut line_w) = (String::new(), 0.0);
-        for word in para.split(' ') {
-            let candidate = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
-            let candidate_w =
-                if rtl_script || thai { if line.is_empty() { measure(word) } else { line_w + space + measure(word) } } else { measure(&candidate) };
-            if !line.is_empty() && candidate_w > width {
-                out.push((std::mem::take(&mut line), rtl));
-                line = word.to_string();
-                line_w = measure(word);
-            } else {
-                line = candidate;
-                line_w = candidate_w;
-            }
-        }
-        out.push((line, rtl));
-    }
-    out
-}
-
-/// Thai wrapping at shaped cluster boundaries never detaches a tone/vowel mark from its base.
-/// This is glyph-safe wrapping, not dictionary-based Thai word segmentation.
-fn thai_lines(t: &AddedText, para: &str, width: f64) -> Result<Vec<String>, EditError> {
-    let (pieces, _) = shaped_layout(t, para, false)?;
-    let mut atoms = Vec::new();
-    for piece in pieces {
-        match piece {
-            Piece::Shaped(clusters) => atoms.extend(clusters.into_iter().map(|c| (c.text, c.advance * t.size + t.char_spacing))),
-            Piece::Latin(s) => atoms.extend(s.chars().map(|c| {
-                let text = c.to_string();
-                let w = latin_width(t, &text);
-                (text, w)
-            })),
-        }
-    }
-    let mut lines = Vec::new();
-    let (mut line, mut used) = (String::new(), 0.0);
-    for (text, advance) in atoms {
-        if !line.is_empty() && used + advance > width {
-            lines.push(std::mem::take(&mut line));
-            used = 0.0;
-        }
-        line.push_str(&text);
-        used += advance;
-    }
-    lines.push(line);
-    Ok(lines)
-}
-
-fn is_thai(c: char) -> bool {
-    matches!(u32::from(c), 0x0E00..=0x0E7F)
-}
-
-/// Arabic letters, marks, digits and punctuation: an item with any of them is shaped with the
-/// craft-fonts Arabic face.
-fn is_arabic(c: char) -> bool {
-    matches!(u32::from(c), 0x0600..=0x06FF | 0x0750..=0x077F | 0x0870..=0x08FF | 0xFB50..=0xFDFF | 0xFE70..=0xFEFC)
-}
-
-/// Hebrew letters, points, cantillation marks and punctuation (and the presentation forms): an
-/// item with any of them is drawn with the craft-fonts Hebrew face.
-fn is_hebrew(c: char) -> bool {
-    matches!(u32::from(c), 0x0591..=0x05F4 | 0xFB1D..=0xFB4F)
-}
-
-/// The first character of `t` that would be drawn as `?`: outside WinAnsiEncoding and not drawn
-/// with the craft-fonts Arabic (#125) or Hebrew (#128) face, or Arabic or Hebrew that the face can't
-/// draw (or that has no face to draw it). Page-content tools refuse such text; the Add-text editor
-/// keeps it open.
-pub fn first_undrawable(t: &AddedText) -> Option<char> {
-    if t.text.chars().any(is_thai) {
-        if let Some(c) = t.text.chars().find(|c| is_thai(*c) && !pdfcraft_fonts::thai_has(*c)) {
-            return Some(c);
-        }
-        let rest = AddedText { text: t.text.chars().filter(|c| !is_thai(*c)).collect(), ..t.clone() };
-        return first_undrawable(&rest);
-    }
-    // Arabic or Hebrew that nothing can draw: there's no face, or the face lacks it.
-    if let Some(c) =
-        t.text.chars().find(|c| (shaped_arabic(*c) && !pdfcraft_fonts::arabic_has(*c)) || (is_hebrew(*c) && !pdfcraft_fonts::hebrew_has(*c)))
-    {
-        return Some(c);
-    }
-    if !shaped_by_a_face(t) {
-        // Drawn line by line in the item's standard font (`\n` splits lines). Without the face
-        // that is also how `draw` redraws an existing item, so it's checked that way.
-        return t.text.split('\n').find_map(pdfcraft_fonts::first_non_win_ansi);
-    }
-    // What `shaped_layout` leaves to the standard font, exactly as `draw_shaped` splits it.
-    wrapped(t).into_iter().find_map(|(line, rtl)| {
-        let (pieces, _) = shaped_layout(t, &line, rtl).ok()?;
-        pieces.iter().find_map(|p| match p {
-            Piece::Latin(s) => pdfcraft_fonts::first_non_win_ansi(s),
-            Piece::Shaped(_) => None,
-        })
-    })
-}
-
-/// Whether `t` has Arabic or Hebrew that its craft-fonts face draws (so `draw` lays it out with
-/// [`draw_shaped`]).
-fn shaped_by_a_face(t: &AddedText) -> bool {
-    (pdfcraft_fonts::document_arabic_font().is_some() && t.text.chars().any(is_arabic))
-        || (pdfcraft_fonts::document_hebrew_font(false).is_some() && t.text.chars().any(is_hebrew))
-}
-
-/// An Arabic character the face shapes and draws (U+061C, a direction mark, is dropped).
-fn shaped_arabic(c: char) -> bool {
-    is_arabic(c) && !is_bidi_control(c)
-}
-
-/// Direction marks, embeddings, overrides and isolates: they steer the order and are not drawn.
-fn is_bidi_control(c: char) -> bool {
-    matches!(c, '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}')
-}
-
-fn mirrored(c: char) -> char {
-    match c {
-        '(' => ')',
-        ')' => '(',
-        '[' => ']',
-        ']' => '[',
-        '{' => '}',
-        '}' => '{',
-        '<' => '>',
-        '>' => '<',
-        '«' => '»',
-        '»' => '«',
-        other => other,
-    }
-}
-
-/// A piece of a line with shaped text, in drawing order.
-enum Piece {
-    /// Shown in the item's own standard font.
-    Latin(String),
-    Shaped(Vec<ShapedCluster>),
-}
-
-/// A line of a shaped-text item in drawing order (the Unicode bidirectional algorithm, UAX #9), and
-/// its width at the item's size. `rtl` is its paragraph's direction.
-fn shaped_layout(t: &AddedText, line: &str, rtl: bool) -> Result<(Vec<Piece>, f64), EditError> {
-    // unicode-bidi indexes the first level of a line, so an empty one would panic.
-    if line.is_empty() {
-        return Ok((Vec::new(), 0.0));
-    }
-    let base = if rtl { Level::rtl() } else { Level::ltr() };
-    let info = ParagraphBidiInfo::new(line, Some(base));
-    let (levels, runs) = info.visual_runs(0..line.len());
-    let mut pieces = Vec::new();
-    for run in runs {
-        let run_rtl = levels.get(run.start).is_some_and(Level::is_rtl);
-        // Runs lie on character boundaries; a missing slice is skipped, never a panic.
-        let Some(text) = line.get(run) else { continue };
-        // Arabic and Hebrew letters take their face; so do spaces and punctuation between them
-        // (Hebrew's when they follow Hebrew), which the shaper then mirrors. Latin text (and what
-        // the faces lack) keeps the item's font.
-        let mut segments: Vec<(Option<ShapedScript>, String)> = Vec::new();
-        for c in text.chars().filter(|c| !is_bidi_control(*c)) {
-            let after_hebrew = segments.last().is_some_and(|(kind, _)| *kind == Some(ShapedScript::Hebrew));
-            let script = if is_thai(c) {
-                Some(ShapedScript::Thai)
-            } else if is_hebrew(c) || (run_rtl && after_hebrew && !c.is_alphanumeric() && pdfcraft_fonts::hebrew_has(c)) {
-                Some(ShapedScript::Hebrew)
-            } else if is_arabic(c) || (run_rtl && !c.is_alphanumeric() && pdfcraft_fonts::arabic_has(c)) {
-                Some(ShapedScript::Arabic)
-            } else {
-                None
-            };
-            match segments.last_mut() {
-                Some((kind, s)) if *kind == script => s.push(c),
-                _ => segments.push((script, c.to_string())),
-            }
-        }
-        if run_rtl {
-            segments.reverse();
-        }
-        for (script, s) in segments {
-            pieces.push(if let Some(script) = script {
-                let shaped = match script {
-                    ShapedScript::Arabic => shape_arabic(&s, run_rtl).map_err(|e| arabic_error(e, &s))?,
-                    ShapedScript::Hebrew => shape_hebrew(&s, run_rtl).map_err(|e| hebrew_error(e, &s))?,
-                    ShapedScript::Thai => shape_thai(&s).map_err(|e| thai_error(e, &s))?,
-                };
-                Piece::Shaped(shaped)
-            } else if run_rtl {
-                Piece::Latin(s.chars().rev().map(mirrored).collect())
-            } else {
-                Piece::Latin(s)
-            });
-        }
-    }
-    let width = pieces
-        .iter()
-        .map(|p| match p {
-            Piece::Latin(s) => latin_width(t, s),
-            // Each cluster is shown on its own, so the spacing follows each once.
-            Piece::Shaped(clusters) => clusters.iter().map(|c| c.advance * t.size + t.char_spacing).sum::<f64>(),
-        })
-        .sum();
-    Ok((pieces, width))
-}
-
-/// The width of `s` in a shaped-text item; the item's font's estimate if it can't be shaped (drawing
-/// then reports why).
-fn shaped_width(t: &AddedText, s: &str, rtl: bool) -> f64 {
-    shaped_layout(t, s, rtl).map(|(_, w)| w).unwrap_or_else(|_| latin_width(t, s))
-}
-
-fn arabic_error(e: GlyphError, text: &str) -> EditError {
-    EditError::Invalid(match e {
-        GlyphError::NoFont => "Arabic text needs PdfCraft's Arabic font, which this build doesn't include \
-                               (to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout that has an Arab face)"
-            .into(),
-        GlyphError::Missing => format!("the Arabic font can't show \"{text}\""),
-        GlyphError::TooComplex => format!("the Arabic font's glyphs for \"{text}\" are too complex"),
-    })
-}
-
-fn hebrew_error(e: GlyphError, text: &str) -> EditError {
-    EditError::Invalid(match e {
-        GlyphError::NoFont => "Hebrew text needs PdfCraft's Hebrew font, which this build doesn't include \
-                               (to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout that has a Hebr face)"
-            .into(),
-        GlyphError::Missing => format!("the Hebrew font can't show \"{text}\""),
-        GlyphError::TooComplex => format!("the Hebrew font's glyphs for \"{text}\" are too complex"),
-    })
-}
-
-fn thai_error(e: GlyphError, text: &str) -> EditError {
-    EditError::Invalid(match e {
-        GlyphError::NoFont => {
-            "Thai text needs a Thai font in this build; rebuild with CRAFT_FONTS_DIR pointing to craft-fonts with a Thai face".into()
-        }
-        GlyphError::Missing => format!("the Thai font can't show \"{text}\""),
-        GlyphError::TooComplex => "the Thai glyphs are too complex; use a shorter text box".into(),
-    })
-}
-
-/// The box a text item occupies (height from its lines).
-pub fn text_rect(t: &AddedText) -> [f64; 4] {
-    let r = norm(t.rect);
-    let h = lines(t).len().max(1) as f64 * t.size * 1.2;
-    [r[0], r[3] - h, r[2], r[3]]
-}
-
-/// How far each paste onto a page already holding the copy is offset, down and to the right, so a
-/// copy doesn't hide what it was copied from (points).
-pub const PASTE_STEP: f64 = 18.0;
-
-/// Where a pasted item of box `rect` goes on a page of `size` (display space): with its top-left
-/// corner at `at`, else where it was, `steps` paste steps ([`PASTE_STEP`]) down and to the right.
-/// It is kept on the page; one larger than the page keeps its left and top edges on it. A page
-/// or point that isn't a number leaves the box where it was.
-pub fn paste_rect(rect: [f64; 4], size: [f64; 2], steps: u32, at: Option<[f64; 2]>) -> [f64; 4] {
-    let [x0, y0, x1, y1] = norm(rect);
-    let (w, h) = (x1 - x0, y1 - y0);
-    let (left, top) = match at {
-        Some([x, y]) => (x, y),
-        None => {
-            let d = PASTE_STEP * f64::from(steps);
-            (x0 + d, y1 - d)
-        }
-    };
-    if !size.iter().chain(&[left, top, w, h]).all(|v| v.is_finite()) {
-        return rect;
-    }
-    let left = left.min(size[0] - w).max(0.0);
-    let top = top.max(h).min(size[1]);
-    [left, top - h, left + w, top]
-}
-
-/// Most paste steps [`paste_place`] tries before giving up on finding a free place.
-const MAX_PASTE_STEPS: u32 = 64;
-
-/// Where Edit ▸ Paste puts `content` on a page of `size` already holding `items` (display space):
-/// where it was, or as many paste steps down and to the right as it takes not to land exactly on
-/// a copy of it (the original it was copied from, or an earlier paste).
-pub fn paste_place<'a>(items: impl IntoIterator<Item = &'a Content>, content: &Content, size: [f64; 2]) -> [f64; 4] {
-    let same = copy_key(content);
-    let copies: Vec<[f64; 4]> = items.into_iter().filter(|i| copy_key(i) == same).map(Content::rect).collect();
-    let taken = |rect: [f64; 4]| copies.iter().any(|c| c.iter().zip(rect).all(|(a, b)| (a - b).abs() < 0.5));
-    let mut rect = paste_rect(content.rect(), size, 0, None);
-    for steps in 1..=MAX_PASTE_STEPS {
-        if !taken(rect) {
-            break;
-        }
-        rect = paste_rect(content.rect(), size, steps, None);
-    }
-    rect
-}
-
-/// What makes two items copies of each other for [`paste_place`]: all but the box, and for an
-/// image all but the object holding its picture, which a paste into another document stores anew.
-fn copy_key(c: &Content) -> Content {
-    match c.with_rect([0.0; 4]) {
-        Content::Image(img) => Content::Image(AddedImage { image: ObjRef::new(0, 0), ..img }),
-        text => text,
-    }
-}
-
-/// The widest explicit line before wrapping, measured with the PDF writing fonts.
-pub fn text_width(t: &AddedText) -> f64 {
-    t.text.split('\n').map(|line| shaped_width(t, line, unicode_bidi::get_base_direction(line) == unicode_bidi::Direction::Rtl)).fold(0.0, f64::max)
-}
-
-fn font_name(base: &str) -> String {
-    format!("PCF{}", base.replace('-', ""))
-}
-
-/// Most glyphs in one Type 3 font: its codes are single bytes, 1–240. An item gets one such font
-/// per 240 distinct glyphs it needs.
-const GLYPHS_PER_FONT: usize = 240;
-
-/// A line of a shaped-text item after layout: its text, whether its paragraph runs right to left,
-/// its pieces in drawing order and its width at the item's size.
-type LaidLine = (String, bool, Vec<Piece>, f64);
-
-/// Draw a text item that has Arabic, Hebrew or Thai in it. Each line is laid out in display order; their glyphs
-/// come from Type 3 fonts drawn from the craft-fonts face's outlines (no font file is embedded),
-/// with a ToUnicode map for copy and search. Other text uses the item's standard font.
-fn draw_shaped(doc: &mut Document, t: &AddedText, taken: &Dict, fonts: &mut Dict, out: &mut Vec<u8>) -> Result<(), EditError> {
-    let laid = wrapped(t)
-        .into_iter()
-        .map(|(line, rtl)| shaped_layout(t, &line, rtl).map(|(pieces, w)| (line, rtl, pieces, w)))
-        .collect::<Result<Vec<_>, _>>()?;
-    draw_laid_shaped(doc, t, &laid, taken, fonts, out, shaped_glyph)
-}
-
-/// [`draw_shaped`] for lines that are already laid out. `outline` is the source of glyph outlines
-/// for a script's face (the craft-fonts faces, or a stand-in in tests).
-fn draw_laid_shaped(
-    doc: &mut Document,
-    t: &AddedText,
-    laid: &[LaidLine],
-    taken: &Dict,
-    fonts: &mut Dict,
-    out: &mut Vec<u8>,
-    outline: impl Fn(ShapedScript, u32) -> Result<GlyphOutline, GlyphError>,
-) -> Result<(), EditError> {
-    let r = text_rect(t);
-    let latin = font_name(t.family.base_font(t.bold, t.italic));
-    // Every distinct cluster (a letter with its dots and the text it stands for) is one glyph of
-    // one of the fonts, so copy and search get each character exactly once.
-    let mut keys: Vec<&ShapedCluster> = Vec::new();
-    let mut index: HashMap<ClusterKey, usize> = HashMap::new();
-    for c in laid.iter().flat_map(|(_, _, pieces, _)| pieces).flat_map(|p| match p {
-        Piece::Shaped(clusters) => clusters.as_slice(),
-        Piece::Latin(_) => &[],
-    }) {
-        index.entry(cluster_key(c)).or_insert_with(|| {
-            keys.push(c);
-            keys.len() - 1
-        });
-    }
-
-    // Every outline is read before anything is written, so a failure leaves the document as it was.
-    let mut outlines = HashMap::new();
-    for c in &keys {
-        for (id, _) in &c.glyphs {
-            if let std::collections::hash_map::Entry::Vacant(entry) = outlines.entry((c.script, *id)) {
-                entry.insert(outline(c.script, *id).map_err(|e| match c.script {
-                    ShapedScript::Arabic => arabic_error(e, &c.text),
-                    ShapedScript::Hebrew => hebrew_error(e, &c.text),
-                    ShapedScript::Thai => thai_error(e, &c.text),
-                })?);
-            }
-        }
-    }
-    // The names the page and this item already use: a new font never takes one of them.
-    let mut taken_names: HashSet<Vec<u8>> = taken.iter().chain(fonts.iter()).map(|(name, _)| name.clone()).collect();
-    let mut names = Vec::new();
-    for chunk in keys.chunks(GLYPHS_PER_FONT) {
-        let font = type3_shaped(doc, chunk, &outlines);
-        // A name no font on the page has, so items never replace each other's fonts (object
-        // numbers alone don't do: a full save renumbers objects but keeps resource names).
-        let mut name = format!("PCAr{}", font.num);
-        let mut suffix = 0usize;
-        while taken_names.contains(name.as_bytes()) {
-            suffix = suffix.saturating_add(1);
-            name = format!("PCAr{}_{suffix}", font.num);
-        }
-        taken_names.insert(name.clone().into_bytes());
-        fonts.set(name.clone().into_bytes(), Object::Ref(font));
-        names.push(name);
-    }
-    let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
-    out.extend(format!("BT {} {} {} rg\n", n(cr), n(cg), n(cb)).bytes());
-    if t.char_spacing != 0.0 {
-        out.extend(format!("{} Tc\n", n(t.char_spacing)).bytes());
-    }
-    for (i, (line, rtl, pieces, w)) in laid.iter().enumerate() {
-        // Shaped glyphs are painted in visual order. Keep the original line's typing order
-        // explicitly, including marks, ligatures, digits and mixed-script punctuation.
-        let logical: String = line.encode_utf16().map(|u| format!("{u:04X}")).collect();
-        out.extend(format!("/Span <</ActualText <FEFF{logical}>>> BDC\n").bytes());
-        let spaces = line.matches(' ').count();
-        // Justified: the spaces of every line but the last stretch to fill the box.
-        let tw = if t.align == Align::Justify && i + 1 < laid.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
-        let x = match t.align {
-            // A right-to-left paragraph's unstretched last line ends at the right edge.
-            Align::Justify if *rtl => r[2] - w - tw * spaces as f64,
-            Align::Left | Align::Justify => r[0],
-            Align::Center => r[0] + ((r[2] - r[0]) - w) / 2.0,
-            Align::Right => r[2] - w,
-        };
-        let y = r[3] - (i as f64 * 1.2 + 0.95) * t.size;
-        let mut pen = x;
-        let mut current: Option<&str> = None;
-        for piece in pieces {
-            match piece {
-                Piece::Latin(s) => {
-                    out.extend(format!("/{latin} {} Tf {} Tw 1 0 0 1 {} {} Tm ", n(t.size), n(tw), n(pen), n(y)).bytes());
-                    out.extend(literal(&win_ansi(s)));
-                    out.extend_from_slice(b" Tj\n");
-                    current = Some(latin.as_str());
-                    pen += latin_width(t, s) + tw * s.matches(' ').count() as f64;
-                }
-                Piece::Shaped(clusters) => {
-                    for c in clusters {
-                        let Some(&k) = index.get(&cluster_key(c)) else { continue };
-                        let Some(name) = names.get(k / GLYPHS_PER_FONT) else { continue };
-                        // Codes start at 1; k % 240 + 1 is at most 240.
-                        let code = u8::try_from(k % GLYPHS_PER_FONT + 1).unwrap_or(1);
-                        if current != Some(name.as_str()) {
-                            out.extend(format!("/{name} {} Tf ", n(t.size)).bytes());
-                            current = Some(name.as_str());
-                        }
-                        out.extend(format!("1 0 0 1 {} {} Tm ", n(pen), n(y)).bytes());
-                        out.extend(literal(&[code]));
-                        out.extend_from_slice(b" Tj\n");
-                        pen += c.advance * t.size + t.char_spacing + if c.text == " " { tw } else { 0.0 };
-                    }
-                }
-            }
-        }
-        out.extend_from_slice(b"EMC\n");
-    }
-    out.extend_from_slice(b"ET\n");
-    Ok(())
-}
-
-/// What makes two clusters the same Type 3 glyph: text, glyphs, offsets and advance (bit for bit;
-/// equal clusters come from the same font units).
-type ClusterKey<'a> = (ShapedScript, &'a str, Vec<(u32, u64, u64)>, u64);
-
-fn cluster_key(c: &ShapedCluster) -> ClusterKey<'_> {
-    (c.script, c.text.as_str(), c.glyphs.iter().map(|(id, [x, y])| (*id, x.to_bits(), y.to_bits())).collect(), c.advance.to_bits())
-}
-
-/// A Type 3 font with `clusters` as codes 1…, each drawn from its script face's glyph `outlines`.
-fn type3_shaped(doc: &mut Document, clusters: &[&ShapedCluster], outlines: &HashMap<(ShapedScript, u32), GlyphOutline>) -> ObjRef {
-    let mut charprocs = Dict::new();
-    let mut differences = vec![Object::Int(1)];
-    let mut widths = Vec::with_capacity(clusters.len());
-    let mut bbox = [0.0f64; 4];
-    let mut to_unicode = Vec::new();
-    for (i, c) in clusters.iter().enumerate() {
-        let code = i + 1;
-        // Glyph space is 1000 units per em.
-        let mut paths = Vec::new();
-        let mut ink: Option<[f64; 4]> = None;
-        for (id, [dx, dy]) in &c.glyphs {
-            let Some(g) = outlines.get(&(c.script, *id)) else { continue };
-            for contour in &g.contours {
-                for (j, p) in contour.iter().enumerate() {
-                    paths.extend(format!("{} {} {}\n", n((p[0] + dx) * 1000.0), n((p[1] + dy) * 1000.0), if j == 0 { "m" } else { "l" }).bytes());
-                }
-                paths.extend_from_slice(b"h\n");
-                let b = [g.bbox[0] + dx, g.bbox[1] + dy, g.bbox[2] + dx, g.bbox[3] + dy];
-                ink = Some(ink.map_or(b, |a| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]));
-            }
-        }
-        // Rounded outwards so no ink is clipped.
-        let [x0, y0, x1, y1] =
-            ink.map_or([0.0; 4], |b| [(b[0] * 1000.0).floor(), (b[1] * 1000.0).floor(), (b[2] * 1000.0).ceil(), (b[3] * 1000.0).ceil()]);
-        bbox = [bbox[0].min(x0), bbox[1].min(y0), bbox[2].max(x1), bbox[3].max(y1)];
-        let mut proc = format!("{} 0 {} {} {} {} d1\n", n(c.advance * 1000.0), n(x0), n(y0), n(x1), n(y1)).into_bytes();
-        if !paths.is_empty() {
-            proc.extend(paths);
-            proc.extend_from_slice(b"f\n");
-        }
-        let glyph = format!("g{code:02X}");
-        charprocs.set(glyph.clone().into_bytes(), Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), &proc)))));
-        differences.push(Object::name(&glyph));
-        widths.push(Object::Real((c.advance * 1000.0).round()));
-        if !c.text.is_empty() {
-            let hex: String = c.text.encode_utf16().map(|u| format!("{u:04X}")).collect();
-            to_unicode.push(format!("<{code:02X}> <{hex}>\n"));
-        }
-    }
-    let mut cmap = String::from(
-        "/CIDInit /ProcSet findresource begin\n12 dict begin\nbegincmap\n/CMapType 2 def\n1 begincodespacerange\n<01> <FF>\nendcodespacerange\n",
-    );
-    // A CMap block holds at most 100 entries.
-    for block in to_unicode.chunks(100) {
-        cmap.push_str(&format!("{} beginbfchar\n{}endbfchar\n", block.len(), block.concat()));
-    }
-    cmap.push_str("endcmap\nCMapName currentdict /CMap defineresource pop\nend\nend\n");
-    let cmap = doc.add(Object::Stream(Stream::flate(Dict::new(), cmap.as_bytes())));
-    // The face's family when every glyph comes from one script; without the face, the script's
-    // name (as Arabic items were always named).
-    let family = match clusters.first().map(|c| c.script).filter(|s| clusters.iter().all(|c| c.script == *s)) {
-        Some(script) => script.font().map_or(
-            match script {
-                ShapedScript::Arabic => "Arabic",
-                ShapedScript::Hebrew => "Hebrew",
-                ShapedScript::Thai => "Thai",
-            },
-            |f| f.family,
-        ),
-        None => "PdfCraft Shaped Text",
-    };
-    let mut descriptor = Dict::new();
-    descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
-    descriptor.set(b"FontName".to_vec(), Object::name(&family.replace(' ', "")));
-    descriptor.set(b"FontFamily".to_vec(), Object::String(PdfString::literal(family.as_bytes().to_vec())));
-    descriptor.set(b"Flags".to_vec(), Object::Int(4));
-    descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
-    let mut encoding = Dict::new();
-    encoding.set(b"Type".to_vec(), Object::name("Encoding"));
-    encoding.set(b"Differences".to_vec(), Object::Array(differences));
-    let mut font = Dict::new();
-    font.set(b"Type".to_vec(), Object::name("Font"));
-    font.set(b"Subtype".to_vec(), Object::name("Type3"));
-    font.set(b"FontDescriptor".to_vec(), Object::Ref(doc.add(Object::Dict(descriptor))));
-    font.set(b"FontBBox".to_vec(), Object::Array(bbox.iter().map(|v| Object::Real(*v)).collect()));
-    font.set(
-        b"FontMatrix".to_vec(),
-        Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
-    );
-    font.set(b"FirstChar".to_vec(), Object::Int(1));
-    font.set(b"LastChar".to_vec(), Object::Int(clusters.len() as i64));
-    font.set(b"Widths".to_vec(), Object::Array(widths));
-    font.set(b"Encoding".to_vec(), Object::Dict(encoding));
-    font.set(b"CharProcs".to_vec(), Object::Dict(charprocs));
-    font.set(b"ToUnicode".to_vec(), Object::Ref(cmap));
-    doc.add(Object::Dict(font))
-}
-
-/// Content and resources for an item; `view` maps display space to user space. `taken` holds the
-/// page's font names. `existing`: the item is being replaced, so a build without the Arabic or
-/// Hebrew face keeps drawing that text as `?`, as before it was supported, rather than refusing to
-/// move it.
-fn draw(doc: &mut Document, c: &Content, view: [f64; 6], taken: &Dict, existing: bool) -> Result<(Vec<u8>, Dict), EditError> {
-    let mut res = Dict::new();
-    let mut out = format!(
-        "q {} {} {} {} {} {} cm\n",
-        matrix_number(view[0]),
-        matrix_number(view[1]),
-        matrix_number(view[2]),
-        matrix_number(view[3]),
-        matrix_number(view[4]),
-        matrix_number(view[5])
-    )
-    .into_bytes();
-    match c {
-        Content::Text(t) => {
-            let base = t.family.base_font(t.bold, t.italic);
-            let name = font_name(base);
-            let mut font = Dict::new();
-            font.set(b"Type".to_vec(), Object::name("Font"));
-            font.set(b"Subtype".to_vec(), Object::name("Type1"));
-            font.set(b"BaseFont".to_vec(), Object::name(base));
-            if t.family != Family::Courier || !t.text.is_ascii() {
-                font.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-            }
-            let mut fonts = Dict::new();
-            fonts.set(name.clone().into_bytes(), Object::Dict(font));
-            let face_or_new = |has: fn(char) -> bool, face: bool| t.text.chars().any(has) && (face || !existing);
-            if t.text.chars().any(is_thai)
-                || face_or_new(is_arabic, pdfcraft_fonts::document_arabic_font().is_some())
-                || face_or_new(is_hebrew, pdfcraft_fonts::document_hebrew_font(false).is_some())
-            {
-                draw_shaped(doc, t, taken, &mut fonts, &mut out)?;
-                res.set(b"Font".to_vec(), Object::Dict(fonts));
-                out.extend_from_slice(b"Q\n");
-                return Ok((out, res));
-            }
-            res.set(b"Font".to_vec(), Object::Dict(fonts));
-            let r = text_rect(t);
-            let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
-            out.extend(format!("BT /{name} {} Tf {} {} {} rg\n", n(t.size), n(cr), n(cg), n(cb)).bytes());
-            if t.char_spacing != 0.0 {
-                out.extend(format!("{} Tc\n", n(t.char_spacing)).bytes());
-            }
-            let all = lines(t);
-            for (i, line) in all.iter().enumerate() {
-                let w = latin_width(t, line);
-                let x = match t.align {
-                    Align::Left | Align::Justify => r[0],
-                    Align::Center => r[0] + ((r[2] - r[0]) - w) / 2.0,
-                    Align::Right => r[2] - w,
-                };
-                // Baseline: 0.8 em below the line top.
-                let y = r[3] - (i as f64 * 1.2 + 0.95) * t.size;
-                // Justified: word spacing makes every line but the last fill the box.
-                let spaces = line.matches(' ').count();
-                let tw =
-                    if t.align == Align::Justify && i + 1 < all.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
-                out.extend(format!("1 0 0 1 {} {} Tm {} Tw ", n(x), n(y), n(tw)).bytes());
-                out.extend(literal(&win_ansi(line)));
-                out.extend_from_slice(b" Tj\n");
-            }
-            out.extend_from_slice(b"ET\n");
-        }
-        Content::Image(i) => {
-            if !matches!(&*doc.get(i.image), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image")) {
-                return Err(EditError::Invalid("not an image".into()));
-            }
-            let r = norm(i.rect);
-            let name = format!("PCImg{}", i.image.num);
-            let mut xo = Dict::new();
-            xo.set(name.clone().into_bytes(), Object::Ref(i.image));
-            res.set(b"XObject".to_vec(), Object::Dict(xo));
-            let [a, b, c, d, e, f] = i.matrix().0;
-            // Clip to the box: the cropped-away parts stay hidden.
-            out.extend(
-                format!(
-                    "{} {} {} {} re W n {} {} {} {} {} {} cm /{name} Do\n",
-                    n(r[0]),
-                    n(r[1]),
-                    n(r[2] - r[0]),
-                    n(r[3] - r[1]),
-                    n(a),
-                    n(b),
-                    n(c),
-                    n(d),
-                    n(e),
-                    n(f)
-                )
-                .bytes(),
-            );
-        }
-    }
-    out.extend_from_slice(b"Q\n");
-    Ok((out, res))
-}
-
-fn params(c: &Content) -> Dict {
-    let mut d = Dict::new();
-    let arr = |v: &[f64]| Object::Array(v.iter().map(|x| Object::Real(*x)).collect());
-    match c {
-        Content::Text(t) => {
-            d.set(b"Kind".to_vec(), Object::name("Text"));
-            d.set(b"Text".to_vec(), PdfString::text(&t.text));
-            d.set(b"Font".to_vec(), Object::name(t.family.base_font(t.bold, t.italic)));
-            d.set(b"Size".to_vec(), Object::Real(t.size));
-            d.set(b"Color".to_vec(), arr(&t.color));
-            d.set(
-                b"Align".to_vec(),
-                Object::Int(match t.align {
-                    Align::Left => 0,
-                    Align::Center => 1,
-                    Align::Right => 2,
-                    Align::Justify => 3,
-                }),
-            );
-            d.set(b"Rect".to_vec(), arr(&text_rect(t)));
-            if t.char_spacing != 0.0 {
-                d.set(b"CharSpacing".to_vec(), Object::Real(t.char_spacing));
-            }
-        }
-        Content::Image(i) => {
-            d.set(b"Kind".to_vec(), Object::name("Image"));
-            d.set(b"Image".to_vec(), Object::Ref(i.image));
-            d.set(b"Rect".to_vec(), arr(&norm(i.rect)));
-            if i.rotation % 4 != 0 {
-                d.set(b"Rotate".to_vec(), Object::Int(i64::from(i.rotation % 4) * 90));
-            }
-            if i.flip_h {
-                d.set(b"FlipH".to_vec(), Object::Bool(true));
-            }
-            if i.flip_v {
-                d.set(b"FlipV".to_vec(), Object::Bool(true));
-            }
-            if i.crop != [0.0; 4] {
-                d.set(b"Crop".to_vec(), arr(&i.crop));
-            }
-        }
-    }
-    d
-}
-
-fn parse(doc: &Document, d: &Dict) -> Option<Content> {
-    let r = nums(doc, d.get(b"Rect"));
-    let rect: [f64; 4] = r.try_into().ok()?;
-    match d.name(b"Kind")? {
-        b"Text" => {
-            let (family, bold, italic) = Family::from_base(d.name(b"Font").unwrap_or(b"Helvetica"));
-            let c = nums(doc, d.get(b"Color"));
-            Some(Content::Text(AddedText {
-                rect,
-                text: d.get(b"Text").and_then(|t| doc.resolve(t).as_string().map(|s| s.to_text())).unwrap_or_default(),
-                family,
-                bold,
-                italic,
-                size: d.get(b"Size").and_then(Object::as_f64).unwrap_or(12.0),
-                color: if c.len() == 3 { [c[0], c[1], c[2]] } else { [0.0; 3] },
-                align: match d.int(b"Align") {
-                    Some(1) => Align::Center,
-                    Some(2) => Align::Right,
-                    Some(3) => Align::Justify,
-                    _ => Align::Left,
-                },
-                // Items written before character spacing have none.
-                char_spacing: d.get(b"CharSpacing").and_then(Object::as_f64).filter(|v| v.is_finite()).unwrap_or(0.0),
-            }))
-        }
-        b"Image" => {
-            let crop = nums(doc, d.get(b"Crop"));
-            Some(Content::Image(AddedImage {
-                rect,
-                image: d.get(b"Image")?.as_ref()?,
-                rotation: (d.int(b"Rotate").unwrap_or(0).rem_euclid(360) / 90) as u8,
-                flip_h: matches!(d.get(b"FlipH"), Some(Object::Bool(true))),
-                flip_v: matches!(d.get(b"FlipV"), Some(Object::Bool(true))),
-                crop: crop.try_into().unwrap_or([0.0; 4]),
-            }))
-        }
-        _ => None,
-    }
-}
-
-fn with_resolved<T>(doc: &Document, object: &Object, f: impl FnOnce(&Object) -> T) -> T {
-    match object {
-        Object::Ref(reference) => {
-            let resolved = doc.get(*reference);
-            f(&resolved)
-        }
-        direct => f(direct),
-    }
-}
-
-fn for_each_content_entry(doc: &Document, page: &pdfcraft_model::Page, mut visit: impl FnMut(&Object)) {
-    let Some(contents) = page.dict.get(b"Contents") else { return };
-    with_resolved(doc, contents, |resolved| match resolved {
-        Object::Array(entries) => {
-            for entry in entries {
-                visit(entry);
-            }
-        }
-        _ => visit(contents),
-    });
-}
-
-/// Finds page marks and editable added content in one pass over the page content entries.
-pub fn scan_markers(doc: &Document) -> MarkerScan {
-    let mut scan = MarkerScan::default();
-    for (pi, page) in page_list(doc).iter().enumerate() {
-        for_each_content_entry(doc, page, |entry| {
-            with_resolved(doc, entry, |resolved| {
-                let Some(dict) = resolved.as_dict() else { return };
-                let tag = dict.name(b"PCMark");
-                let kind = if tag == Some(&b"HeaderFooter"[..]) {
-                    Some(MarkKind::HeaderFooter)
-                } else if tag == Some(&b"Watermark"[..]) {
-                    Some(MarkKind::Watermark)
-                } else if tag == Some(&b"Background"[..]) {
-                    Some(MarkKind::Background)
-                } else {
-                    None
-                };
-                if let Some(kind) = kind
-                    && !scan.marks.contains(&kind)
-                {
-                    scan.marks.push(kind);
-                }
-
-                let Some(obj) = Object::as_ref(entry) else { return };
-                if tag != Some(TAG.as_bytes()) {
-                    return;
-                }
-                let Some(params_object) = dict.get(b"PCAdded") else { return };
-                with_resolved(doc, params_object, |resolved_params| {
-                    let Some(params) = resolved_params.as_dict() else { return };
-                    if let Some(content) = parse(doc, params) {
-                        // Display points depend on the page's /UserUnit. An item records the one it was
-                        // written for; none means 1, as for items written before display space followed
-                        // /UserUnit.
-                        let written = params
-                            .get(b"UserUnit")
-                            .and_then(Object::as_f64)
-                            .filter(|u| u.is_finite() && *u >= 1.0)
-                            .map_or(1.0, |u| u.min(pdfcraft_model::MAX_USER_UNIT));
-                        scan.added.push(Added { page: pi, obj, content: content.scaled(page.user_unit(doc) / written) });
-                    }
-                });
-            });
-        });
-    }
-    scan
-}
-
-fn validate(c: &Content) -> Result<(), EditError> {
-    let r = c.rect();
-    if !r.iter().all(|v| v.is_finite()) {
-        return Err(EditError::Invalid("invalid position".into()));
-    }
-    match c {
-        Content::Text(t) => {
-            if t.text.trim().is_empty() {
-                return Err(EditError::Invalid("type some text first".into()));
-            }
-            if !(t.size.is_finite() && (1.0..=500.0).contains(&t.size)) {
-                return Err(EditError::Invalid("the font size must be between 1 and 500 points".into()));
-            }
-            if !(t.char_spacing.is_finite() && (-CHAR_SPACING_LIMIT..=CHAR_SPACING_LIMIT).contains(&t.char_spacing)) {
-                return Err(EditError::Invalid(format!(
-                    "the character spacing must be between -{CHAR_SPACING_LIMIT} and {CHAR_SPACING_LIMIT} points"
-                )));
-            }
-            if (r[2] - r[0]).abs() < 1.0 {
-                return Err(EditError::Invalid("the text box is too narrow".into()));
-            }
-            if t.text.chars().any(is_thai) && pdfcraft_fonts::document_thai_font().is_none() {
-                return Err(thai_error(GlyphError::NoFont, &t.text));
-            }
-            // Without the Arabic face, `draw` decides for the Arabic letters themselves (#403): a new
-            // item is refused with what's missing, and one that already holds Arabic stays movable.
-            // Everything else in it is drawn in the standard font, so it still has to fit.
-            let undrawable = if t.text.chars().any(shaped_arabic) && pdfcraft_fonts::document_arabic_font().is_none() {
-                t.text.split('\n').find_map(|line| {
-                    line.chars()
-                        .find(|c| !(shaped_arabic(*c) || is_thai(*c) && pdfcraft_fonts::thai_has(*c) || pdfcraft_fonts::win_ansi_encodable(*c)))
-                })
-            } else {
-                first_undrawable(t)
-            };
-            if let Some(c) = undrawable {
-                return Err(crate::undrawable(c));
-            }
-        }
-        Content::Image(_) => {
-            if (r[2] - r[0]).abs() < 1.0 || (r[3] - r[1]).abs() < 1.0 {
-                return Err(EditError::Invalid("the image is too small".into()));
-            }
-        }
-    }
-    Ok(())
-}
-
-/// Write an item's stream (new, or replacing `obj`) and make its resources available to the page.
-fn write(doc: &mut Document, page: usize, c: &Content, obj: Option<ObjRef>) -> Result<ObjRef, EditError> {
-    validate(c)?;
-    let all = page_list(doc);
-    check(&[page], all.len())?;
-    let p = &all[page];
-    let view = p.view_matrix(doc);
-    let user_unit = p.user_unit(doc);
-    // The page gets its own copy of its resources with the item's fonts and images added, and
-    // without the Arabic fonts of the version it replaces.
-    let mut pres = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    if let Some(r) = obj {
-        drop_fonts(doc, &mut pres, &own_fonts(doc, r));
-    }
-    let taken = pres.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
-    let (content, res) = draw(doc, c, view, &taken, obj.is_some())?;
-    if obj.is_none() {
-        crate::check_on_top(doc, p)?;
-    }
-    for (k, v) in res.iter() {
-        let mut sub = pres.get(k).map(|s| doc.resolve(s)).and_then(|s| s.as_dict().cloned()).unwrap_or_default();
-        for (n2, o) in v.as_dict().into_iter().flat_map(|d| d.iter()) {
-            sub.set(n2.clone(), o.clone());
-        }
-        pres.set(k.clone(), Object::Dict(sub));
-    }
-    doc.update_dict(p.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(pres)))?;
-    let mut sd = Dict::new();
-    sd.set(b"PCMark".to_vec(), Object::name(TAG));
-    let mut added = params(c);
-    if user_unit != 1.0 {
-        added.set(b"UserUnit".to_vec(), Object::Real(user_unit));
-    }
-    sd.set(b"PCAdded".to_vec(), Object::Dict(added));
-    let stream = Stream::flate(sd, &content);
-    match obj {
-        Some(r) => {
-            doc.set(r, Object::Stream(stream));
-            Ok(r)
-        }
-        None => {
-            // place_tagged appends a new stream; recover its reference.
-            let p = page_list(doc).swap_remove(page);
-            place_tagged(doc, &p, TAG, content.clone(), false)?;
-            let p = page_list(doc).swap_remove(page);
-            let r = contents(doc, &p)?.last().and_then(Object::as_ref).ok_or_else(|| EditError::Invalid("could not add the content".into()))?;
-            doc.set(r, Object::Stream(stream));
-            Ok(r)
-        }
-    }
-}
-
-/// Every added item, page by page, in drawing order.
-pub fn list_added(doc: &Document) -> Vec<Added> {
-    scan_markers(doc).added
-}
-
-/// Add an item to a page (0-based). Returns its index among the page's added items.
-pub fn add_content(doc: &mut Document, page: usize, c: &Content) -> Result<usize, EditError> {
-    write(doc, page, c, None)?;
-    Ok(list_added(doc).iter().filter(|a| a.page == page).count() - 1)
-}
-
-fn find(doc: &Document, page: usize, index: usize) -> Result<Added, EditError> {
-    list_added(doc)
-        .into_iter()
-        .filter(|a| a.page == page)
-        .nth(index)
-        .ok_or_else(|| EditError::Invalid(format!("page {} has no added item {}", page + 1, index + 1)))
-}
-
-/// Replace item `index` of `page` (moved, resized, retyped or reformatted).
-pub fn update_content(doc: &mut Document, page: usize, index: usize, c: &Content) -> Result<(), EditError> {
-    let a = find(doc, page, index)?;
-    if std::mem::discriminant(&a.content) != std::mem::discriminant(c) {
-        return Err(EditError::Invalid("an item can't change between text and image".into()));
-    }
-    write(doc, page, c, Some(a.obj))?;
-    Ok(())
-}
-
-/// Remove item `index` of `page`.
-pub fn delete_content(doc: &mut Document, page: usize, index: usize) -> Result<(), EditError> {
-    let a = find(doc, page, index)?;
-    let p = page_list(doc).swap_remove(page);
-    let list: Vec<Object> = contents(doc, &p)?.into_iter().filter(|o| o.as_ref() != Some(a.obj)).collect();
-    let fonts = own_fonts(doc, a.obj);
-    // Only the page's own resources carry an item's fonts (`write` gives the page a copy).
-    let res = match p.dict.get(b"Resources") {
-        Some(Object::Dict(d)) if !fonts.is_empty() => Some(d.clone()),
-        _ => None,
-    };
-    let res = res.map(|mut r| {
-        drop_fonts(doc, &mut r, &fonts);
-        r
-    });
-    doc.update_dict(p.obj, |d| {
-        d.set(b"Contents".to_vec(), Object::Array(list));
-        if let Some(r) = res {
-            d.set(b"Resources".to_vec(), Object::Dict(r));
-        }
-    })?;
-    Ok(())
-}
-
-/// The Type 3 fonts an Arabic item's stream shows text with. Each item has its own (`draw_shaped`
-/// names them so), so they go when the item is replaced or deleted.
-fn own_fonts(doc: &Document, obj: ObjRef) -> Vec<Vec<u8>> {
-    let Object::Stream(s) = &*doc.get(obj) else { return Vec::new() };
-    let Ok(data) = s.decoded() else { return Vec::new() };
-    data.split(u8::is_ascii_whitespace).filter_map(|w| w.strip_prefix(b"/")).filter(|w| w.starts_with(b"PCAr")).map(<[u8]>::to_vec).collect()
-}
-
-fn drop_fonts(doc: &Document, res: &mut Dict, names: &[Vec<u8>]) {
-    if names.is_empty() {
-        return;
-    }
-    let Some(mut fonts) = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()) else { return };
-    for name in names {
-        fonts.remove(name);
-    }
-    res.set(b"Font".to_vec(), Object::Dict(fonts));
-}
-
 #[cfg(test)]
 mod arabic_tests;
diff --git a/crates/edit/src/added/draw.rs b/crates/edit/src/added/draw.rs
new file mode 100644
index 0000000000..0fc7aa510d
--- /dev/null
+++ b/crates/edit/src/added/draw.rs
@@ -0,0 +1,383 @@
+use super::layout::{
+    Piece, arabic_error, hebrew_error, is_arabic, is_hebrew, is_thai, latin_width, lines, norm, shaped_layout, text_rect, thai_error, wrapped,
+};
+use super::types::{AddedText, Align, Family};
+use super::*;
+
+fn font_name(base: &str) -> String {
+    format!("PCF{}", base.replace('-', ""))
+}
+
+/// Most glyphs in one Type 3 font: its codes are single bytes, 1–240. An item gets one such font
+/// per 240 distinct glyphs it needs.
+pub(super) const GLYPHS_PER_FONT: usize = 240;
+
+/// A line of a shaped-text item after layout: its text, whether its paragraph runs right to left,
+/// its pieces in drawing order and its width at the item's size.
+pub(super) type LaidLine = (String, bool, Vec<Piece>, f64);
+
+/// Draw a text item that has Arabic, Hebrew or Thai in it. Each line is laid out in display order; their glyphs
+/// come from Type 3 fonts drawn from the craft-fonts face's outlines (no font file is embedded),
+/// with a ToUnicode map for copy and search. Other text uses the item's standard font.
+fn draw_shaped(doc: &mut Document, t: &AddedText, taken: &Dict, fonts: &mut Dict, out: &mut Vec<u8>) -> Result<(), EditError> {
+    let laid = wrapped(t)
+        .into_iter()
+        .map(|(line, rtl)| shaped_layout(t, &line, rtl).map(|(pieces, w)| (line, rtl, pieces, w)))
+        .collect::<Result<Vec<_>, _>>()?;
+    draw_laid_shaped(doc, t, &laid, taken, fonts, out, shaped_glyph)
+}
+
+/// [`draw_shaped`] for lines that are already laid out. `outline` is the source of glyph outlines
+/// for a script's face (the craft-fonts faces, or a stand-in in tests).
+pub(super) fn draw_laid_shaped(
+    doc: &mut Document,
+    t: &AddedText,
+    laid: &[LaidLine],
+    taken: &Dict,
+    fonts: &mut Dict,
+    out: &mut Vec<u8>,
+    outline: impl Fn(ShapedScript, u32) -> Result<GlyphOutline, GlyphError>,
+) -> Result<(), EditError> {
+    let r = text_rect(t);
+    let latin = font_name(t.family.base_font(t.bold, t.italic));
+    // Every distinct cluster (a letter with its dots and the text it stands for) is one glyph of
+    // one of the fonts, so copy and search get each character exactly once.
+    let mut keys: Vec<&ShapedCluster> = Vec::new();
+    let mut index: HashMap<ClusterKey, usize> = HashMap::new();
+    for c in laid.iter().flat_map(|(_, _, pieces, _)| pieces).flat_map(|p| match p {
+        Piece::Shaped(clusters) => clusters.as_slice(),
+        Piece::Latin(_) => &[],
+    }) {
+        index.entry(cluster_key(c)).or_insert_with(|| {
+            keys.push(c);
+            keys.len() - 1
+        });
+    }
+
+    // Every outline is read before anything is written, so a failure leaves the document as it was.
+    let mut outlines = HashMap::new();
+    for c in &keys {
+        for (id, _) in &c.glyphs {
+            if let std::collections::hash_map::Entry::Vacant(entry) = outlines.entry((c.script, *id)) {
+                entry.insert(outline(c.script, *id).map_err(|e| match c.script {
+                    ShapedScript::Arabic => arabic_error(e, &c.text),
+                    ShapedScript::Hebrew => hebrew_error(e, &c.text),
+                    ShapedScript::Thai => thai_error(e, &c.text),
+                })?);
+            }
+        }
+    }
+    // The names the page and this item already use: a new font never takes one of them.
+    let mut taken_names: HashSet<Vec<u8>> = taken.iter().chain(fonts.iter()).map(|(name, _)| name.clone()).collect();
+    let mut names = Vec::new();
+    for chunk in keys.chunks(GLYPHS_PER_FONT) {
+        let font = type3_shaped(doc, chunk, &outlines);
+        // A name no font on the page has, so items never replace each other's fonts (object
+        // numbers alone don't do: a full save renumbers objects but keeps resource names).
+        let mut name = format!("PCAr{}", font.num);
+        let mut suffix = 0usize;
+        while taken_names.contains(name.as_bytes()) {
+            suffix = suffix.saturating_add(1);
+            name = format!("PCAr{}_{suffix}", font.num);
+        }
+        taken_names.insert(name.clone().into_bytes());
+        fonts.set(name.clone().into_bytes(), Object::Ref(font));
+        names.push(name);
+    }
+    let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
+    out.extend(format!("BT {} {} {} rg\n", n(cr), n(cg), n(cb)).bytes());
+    if t.char_spacing != 0.0 {
+        out.extend(format!("{} Tc\n", n(t.char_spacing)).bytes());
+    }
+    for (i, (line, rtl, pieces, w)) in laid.iter().enumerate() {
+        // Shaped glyphs are painted in visual order. Keep the original line's typing order
+        // explicitly, including marks, ligatures, digits and mixed-script punctuation.
+        let logical: String = line.encode_utf16().map(|u| format!("{u:04X}")).collect();
+        out.extend(format!("/Span <</ActualText <FEFF{logical}>>> BDC\n").bytes());
+        let spaces = line.matches(' ').count();
+        // Justified: the spaces of every line but the last stretch to fill the box.
+        let tw = if t.align == Align::Justify && i + 1 < laid.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
+        let x = match t.align {
+            // A right-to-left paragraph's unstretched last line ends at the right edge.
+            Align::Justify if *rtl => r[2] - w - tw * spaces as f64,
+            Align::Left | Align::Justify => r[0],
+            Align::Center => r[0] + ((r[2] - r[0]) - w) / 2.0,
+            Align::Right => r[2] - w,
+        };
+        let y = r[3] - (i as f64 * 1.2 + 0.95) * t.size;
+        let mut pen = x;
+        let mut current: Option<&str> = None;
+        for piece in pieces {
+            match piece {
+                Piece::Latin(s) => {
+                    out.extend(format!("/{latin} {} Tf {} Tw 1 0 0 1 {} {} Tm ", n(t.size), n(tw), n(pen), n(y)).bytes());
+                    out.extend(literal(&win_ansi(s)));
+                    out.extend_from_slice(b" Tj\n");
+                    current = Some(latin.as_str());
+                    pen += latin_width(t, s) + tw * s.matches(' ').count() as f64;
+                }
+                Piece::Shaped(clusters) => {
+                    for c in clusters {
+                        let Some(&k) = index.get(&cluster_key(c)) else { continue };
+                        let Some(name) = names.get(k / GLYPHS_PER_FONT) else { continue };
+                        // Codes start at 1; k % 240 + 1 is at most 240.
+                        let code = u8::try_from(k % GLYPHS_PER_FONT + 1).unwrap_or(1);
+                        if current != Some(name.as_str()) {
+                            out.extend(format!("/{name} {} Tf ", n(t.size)).bytes());
+                            current = Some(name.as_str());
+                        }
+                        out.extend(format!("1 0 0 1 {} {} Tm ", n(pen), n(y)).bytes());
+                        out.extend(literal(&[code]));
+                        out.extend_from_slice(b" Tj\n");
+                        pen += c.advance * t.size + t.char_spacing + if c.text == " " { tw } else { 0.0 };
+                    }
+                }
+            }
+        }
+        out.extend_from_slice(b"EMC\n");
+    }
+    out.extend_from_slice(b"ET\n");
+    Ok(())
+}
+
+/// What makes two clusters the same Type 3 glyph: text, glyphs, offsets and advance (bit for bit;
+/// equal clusters come from the same font units).
+type ClusterKey<'a> = (ShapedScript, &'a str, Vec<(u32, u64, u64)>, u64);
+
+fn cluster_key(c: &ShapedCluster) -> ClusterKey<'_> {
+    (c.script, c.text.as_str(), c.glyphs.iter().map(|(id, [x, y])| (*id, x.to_bits(), y.to_bits())).collect(), c.advance.to_bits())
+}
+
+/// A Type 3 font with `clusters` as codes 1…, each drawn from its script face's glyph `outlines`.
+fn type3_shaped(doc: &mut Document, clusters: &[&ShapedCluster], outlines: &HashMap<(ShapedScript, u32), GlyphOutline>) -> ObjRef {
+    let mut charprocs = Dict::new();
+    let mut differences = vec![Object::Int(1)];
+    let mut widths = Vec::with_capacity(clusters.len());
+    let mut bbox = [0.0f64; 4];
+    let mut to_unicode = Vec::new();
+    for (i, c) in clusters.iter().enumerate() {
+        let code = i + 1;
+        // Glyph space is 1000 units per em.
+        let mut paths = Vec::new();
+        let mut ink: Option<[f64; 4]> = None;
+        for (id, [dx, dy]) in &c.glyphs {
+            let Some(g) = outlines.get(&(c.script, *id)) else { continue };
+            for contour in &g.contours {
+                for (j, p) in contour.iter().enumerate() {
+                    paths.extend(format!("{} {} {}\n", n((p[0] + dx) * 1000.0), n((p[1] + dy) * 1000.0), if j == 0 { "m" } else { "l" }).bytes());
+                }
+                paths.extend_from_slice(b"h\n");
+                let b = [g.bbox[0] + dx, g.bbox[1] + dy, g.bbox[2] + dx, g.bbox[3] + dy];
+                ink = Some(ink.map_or(b, |a| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]));
+            }
+        }
+        // Rounded outwards so no ink is clipped.
+        let [x0, y0, x1, y1] =
+            ink.map_or([0.0; 4], |b| [(b[0] * 1000.0).floor(), (b[1] * 1000.0).floor(), (b[2] * 1000.0).ceil(), (b[3] * 1000.0).ceil()]);
+        bbox = [bbox[0].min(x0), bbox[1].min(y0), bbox[2].max(x1), bbox[3].max(y1)];
+        let mut proc = format!("{} 0 {} {} {} {} d1\n", n(c.advance * 1000.0), n(x0), n(y0), n(x1), n(y1)).into_bytes();
+        if !paths.is_empty() {
+            proc.extend(paths);
+            proc.extend_from_slice(b"f\n");
+        }
+        let glyph = format!("g{code:02X}");
+        charprocs.set(glyph.clone().into_bytes(), Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), &proc)))));
+        differences.push(Object::name(&glyph));
+        widths.push(Object::Real((c.advance * 1000.0).round()));
+        if !c.text.is_empty() {
+            let hex: String = c.text.encode_utf16().map(|u| format!("{u:04X}")).collect();
+            to_unicode.push(format!("<{code:02X}> <{hex}>\n"));
+        }
+    }
+    let mut cmap = String::from(
+        "/CIDInit /ProcSet findresource begin\n12 dict begin\nbegincmap\n/CMapType 2 def\n1 begincodespacerange\n<01> <FF>\nendcodespacerange\n",
+    );
+    // A CMap block holds at most 100 entries.
+    for block in to_unicode.chunks(100) {
+        cmap.push_str(&format!("{} beginbfchar\n{}endbfchar\n", block.len(), block.concat()));
+    }
+    cmap.push_str("endcmap\nCMapName currentdict /CMap defineresource pop\nend\nend\n");
+    let cmap = doc.add(Object::Stream(Stream::flate(Dict::new(), cmap.as_bytes())));
+    // The face's family when every glyph comes from one script; without the face, the script's
+    // name (as Arabic items were always named).
+    let family = match clusters.first().map(|c| c.script).filter(|s| clusters.iter().all(|c| c.script == *s)) {
+        Some(script) => script.font().map_or(
+            match script {
+                ShapedScript::Arabic => "Arabic",
+                ShapedScript::Hebrew => "Hebrew",
+                ShapedScript::Thai => "Thai",
+            },
+            |f| f.family,
+        ),
+        None => "PdfCraft Shaped Text",
+    };
+    let mut descriptor = Dict::new();
+    descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
+    descriptor.set(b"FontName".to_vec(), Object::name(&family.replace(' ', "")));
+    descriptor.set(b"FontFamily".to_vec(), Object::String(PdfString::literal(family.as_bytes().to_vec())));
+    descriptor.set(b"Flags".to_vec(), Object::Int(4));
+    descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
+    let mut encoding = Dict::new();
+    encoding.set(b"Type".to_vec(), Object::name("Encoding"));
+    encoding.set(b"Differences".to_vec(), Object::Array(differences));
+    let mut font = Dict::new();
+    font.set(b"Type".to_vec(), Object::name("Font"));
+    font.set(b"Subtype".to_vec(), Object::name("Type3"));
+    font.set(b"FontDescriptor".to_vec(), Object::Ref(doc.add(Object::Dict(descriptor))));
+    font.set(b"FontBBox".to_vec(), Object::Array(bbox.iter().map(|v| Object::Real(*v)).collect()));
+    font.set(
+        b"FontMatrix".to_vec(),
+        Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
+    );
+    font.set(b"FirstChar".to_vec(), Object::Int(1));
+    font.set(b"LastChar".to_vec(), Object::Int(clusters.len() as i64));
+    font.set(b"Widths".to_vec(), Object::Array(widths));
+    font.set(b"Encoding".to_vec(), Object::Dict(encoding));
+    font.set(b"CharProcs".to_vec(), Object::Dict(charprocs));
+    font.set(b"ToUnicode".to_vec(), Object::Ref(cmap));
+    doc.add(Object::Dict(font))
+}
+
+/// Content and resources for an item; `view` maps display space to user space. `taken` holds the
+/// page's font names. `existing`: the item is being replaced, so a build without the Arabic or
+/// Hebrew face keeps drawing that text as `?`, as before it was supported, rather than refusing to
+/// move it.
+pub(super) fn draw(doc: &mut Document, c: &Content, view: [f64; 6], taken: &Dict, existing: bool) -> Result<(Vec<u8>, Dict), EditError> {
+    let mut res = Dict::new();
+    let mut out = format!(
+        "q {} {} {} {} {} {} cm\n",
+        matrix_number(view[0]),
+        matrix_number(view[1]),
+        matrix_number(view[2]),
+        matrix_number(view[3]),
+        matrix_number(view[4]),
+        matrix_number(view[5])
+    )
+    .into_bytes();
+    match c {
+        Content::Text(t) => {
+            let base = t.family.base_font(t.bold, t.italic);
+            let name = font_name(base);
+            let mut font = Dict::new();
+            font.set(b"Type".to_vec(), Object::name("Font"));
+            font.set(b"Subtype".to_vec(), Object::name("Type1"));
+            font.set(b"BaseFont".to_vec(), Object::name(base));
+            if t.family != Family::Courier || !t.text.is_ascii() {
+                font.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+            }
+            let mut fonts = Dict::new();
+            fonts.set(name.clone().into_bytes(), Object::Dict(font));
+            let face_or_new = |has: fn(char) -> bool, face: bool| t.text.chars().any(has) && (face || !existing);
+            if t.text.chars().any(is_thai)
+                || face_or_new(is_arabic, pdfcraft_fonts::document_arabic_font().is_some())
+                || face_or_new(is_hebrew, pdfcraft_fonts::document_hebrew_font(false).is_some())
+            {
+                draw_shaped(doc, t, taken, &mut fonts, &mut out)?;
+                res.set(b"Font".to_vec(), Object::Dict(fonts));
+                out.extend_from_slice(b"Q\n");
+                return Ok((out, res));
+            }
+            res.set(b"Font".to_vec(), Object::Dict(fonts));
+            let r = text_rect(t);
+            let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
+            out.extend(format!("BT /{name} {} Tf {} {} {} rg\n", n(t.size), n(cr), n(cg), n(cb)).bytes());
+            if t.char_spacing != 0.0 {
+                out.extend(format!("{} Tc\n", n(t.char_spacing)).bytes());
+            }
+            let all = lines(t);
+            for (i, line) in all.iter().enumerate() {
+                let w = latin_width(t, line);
+                let x = match t.align {
+                    Align::Left | Align::Justify => r[0],
+                    Align::Center => r[0] + ((r[2] - r[0]) - w) / 2.0,
+                    Align::Right => r[2] - w,
+                };
+                // Baseline: 0.8 em below the line top.
+                let y = r[3] - (i as f64 * 1.2 + 0.95) * t.size;
+                // Justified: word spacing makes every line but the last fill the box.
+                let spaces = line.matches(' ').count();
+                let tw =
+                    if t.align == Align::Justify && i + 1 < all.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
+                out.extend(format!("1 0 0 1 {} {} Tm {} Tw ", n(x), n(y), n(tw)).bytes());
+                out.extend(literal(&win_ansi(line)));
+                out.extend_from_slice(b" Tj\n");
+            }
+            out.extend_from_slice(b"ET\n");
+        }
+        Content::Image(i) => {
+            if !matches!(&*doc.get(i.image), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image")) {
+                return Err(EditError::Invalid("not an image".into()));
+            }
+            let r = norm(i.rect);
+            let name = format!("PCImg{}", i.image.num);
+            let mut xo = Dict::new();
+            xo.set(name.clone().into_bytes(), Object::Ref(i.image));
+            res.set(b"XObject".to_vec(), Object::Dict(xo));
+            let [a, b, c, d, e, f] = i.matrix().0;
+            // Clip to the box: the cropped-away parts stay hidden.
+            out.extend(
+                format!(
+                    "{} {} {} {} re W n {} {} {} {} {} {} cm /{name} Do\n",
+                    n(r[0]),
+                    n(r[1]),
+                    n(r[2] - r[0]),
+                    n(r[3] - r[1]),
+                    n(a),
+                    n(b),
+                    n(c),
+                    n(d),
+                    n(e),
+                    n(f)
+                )
+                .bytes(),
+            );
+        }
+    }
+    out.extend_from_slice(b"Q\n");
+    Ok((out, res))
+}
+
+pub(super) fn params(c: &Content) -> Dict {
+    let mut d = Dict::new();
+    let arr = |v: &[f64]| Object::Array(v.iter().map(|x| Object::Real(*x)).collect());
+    match c {
+        Content::Text(t) => {
+            d.set(b"Kind".to_vec(), Object::name("Text"));
+            d.set(b"Text".to_vec(), PdfString::text(&t.text));
+            d.set(b"Font".to_vec(), Object::name(t.family.base_font(t.bold, t.italic)));
+            d.set(b"Size".to_vec(), Object::Real(t.size));
+            d.set(b"Color".to_vec(), arr(&t.color));
+            d.set(
+                b"Align".to_vec(),
+                Object::Int(match t.align {
+                    Align::Left => 0,
+                    Align::Center => 1,
+                    Align::Right => 2,
+                    Align::Justify => 3,
+                }),
+            );
+            d.set(b"Rect".to_vec(), arr(&text_rect(t)));
+            if t.char_spacing != 0.0 {
+                d.set(b"CharSpacing".to_vec(), Object::Real(t.char_spacing));
+            }
+        }
+        Content::Image(i) => {
+            d.set(b"Kind".to_vec(), Object::name("Image"));
+            d.set(b"Image".to_vec(), Object::Ref(i.image));
+            d.set(b"Rect".to_vec(), arr(&norm(i.rect)));
+            if i.rotation % 4 != 0 {
+                d.set(b"Rotate".to_vec(), Object::Int(i64::from(i.rotation % 4) * 90));
+            }
+            if i.flip_h {
+                d.set(b"FlipH".to_vec(), Object::Bool(true));
+            }
+            if i.flip_v {
+                d.set(b"FlipV".to_vec(), Object::Bool(true));
+            }
+            if i.crop != [0.0; 4] {
+                d.set(b"Crop".to_vec(), arr(&i.crop));
+            }
+        }
+    }
+    d
+}
diff --git a/crates/edit/src/added/layout.rs b/crates/edit/src/added/layout.rs
new file mode 100644
index 0000000000..0e971b92c7
--- /dev/null
+++ b/crates/edit/src/added/layout.rs
@@ -0,0 +1,356 @@
+use super::types::{AddedImage, AddedText};
+use super::*;
+
+pub(super) fn nums(doc: &Document, o: Option<&Object>) -> Vec<f64> {
+    o.map(|o| doc.resolve(o)).and_then(|a| a.as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default()
+}
+
+pub(super) fn norm(r: [f64; 4]) -> [f64; 4] {
+    [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]
+}
+
+/// The advance of `s` in the item's standard font: its glyphs' widths and the character spacing
+/// after each of them, as `Tc` moves the pen (ISO 32000-2 §9.3.2).
+pub(super) fn latin_width(t: &AddedText, s: &str) -> f64 {
+    t.family.width(s, t.size, t.bold, t.italic) + t.char_spacing * s.chars().count() as f64
+}
+
+/// The lines of a text item after wrapping to its box width.
+pub fn lines(t: &AddedText) -> Vec<String> {
+    wrapped(t).into_iter().map(|(line, _)| line).collect()
+}
+
+#[cfg(test)]
+thread_local! {
+    /// How often [`wrapped`] laid a text out on this thread, for the test that keeps it out of per-line loops.
+    pub(crate) static WRAP_CALLS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// [`lines`], each with whether its paragraph runs right to left (its first strong character
+/// does).
+pub(super) fn wrapped(t: &AddedText) -> Vec<(String, bool)> {
+    #[cfg(test)]
+    WRAP_CALLS.with(|c| c.set(c.get().saturating_add(1)));
+    let width = (t.rect[2] - t.rect[0]).max(t.size);
+    let mut out = Vec::new();
+    for para in t.text.split('\n') {
+        // Arabic or Hebrew: laid out with the bidirectional algorithm and shaped.
+        let rtl_script = para.chars().any(|c| is_arabic(c) || is_hebrew(c));
+        let thai = para.chars().any(is_thai);
+        if thai
+            && !rtl_script
+            && let Ok(lines) = thai_lines(t, para, width)
+        {
+            out.extend(lines.into_iter().map(|line| (line, false)));
+            continue;
+        }
+        let rtl = rtl_script && unicode_bidi::get_base_direction(para) == unicode_bidi::Direction::Rtl;
+        // Arabic words are shaped one by one (joining stops at spaces), so a line's width is the
+        // sum of its words' and shaping stays linear in the paragraph's length. The space is the
+        // paragraph's; a space between Latin words is drawn in the item's font, a few hundredths
+        // of an em apart.
+        let measure = |s: &str| if rtl_script || thai { shaped_width(t, s, rtl) } else { latin_width(t, s) };
+        let space = measure(" ");
+        let (mut line, mut line_w) = (String::new(), 0.0);
+        for word in para.split(' ') {
+            let candidate = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
+            let candidate_w =
+                if rtl_script || thai { if line.is_empty() { measure(word) } else { line_w + space + measure(word) } } else { measure(&candidate) };
+            if !line.is_empty() && candidate_w > width {
+                out.push((std::mem::take(&mut line), rtl));
+                line = word.to_string();
+                line_w = measure(word);
+            } else {
+                line = candidate;
+                line_w = candidate_w;
+            }
+        }
+        out.push((line, rtl));
+    }
+    out
+}
+
+/// Thai wrapping at shaped cluster boundaries never detaches a tone/vowel mark from its base.
+/// This is glyph-safe wrapping, not dictionary-based Thai word segmentation.
+fn thai_lines(t: &AddedText, para: &str, width: f64) -> Result<Vec<String>, EditError> {
+    let (pieces, _) = shaped_layout(t, para, false)?;
+    let mut atoms = Vec::new();
+    for piece in pieces {
+        match piece {
+            Piece::Shaped(clusters) => atoms.extend(clusters.into_iter().map(|c| (c.text, c.advance * t.size + t.char_spacing))),
+            Piece::Latin(s) => atoms.extend(s.chars().map(|c| {
+                let text = c.to_string();
+                let w = latin_width(t, &text);
+                (text, w)
+            })),
+        }
+    }
+    let mut lines = Vec::new();
+    let (mut line, mut used) = (String::new(), 0.0);
+    for (text, advance) in atoms {
+        if !line.is_empty() && used + advance > width {
+            lines.push(std::mem::take(&mut line));
+            used = 0.0;
+        }
+        line.push_str(&text);
+        used += advance;
+    }
+    lines.push(line);
+    Ok(lines)
+}
+
+pub(super) fn is_thai(c: char) -> bool {
+    matches!(u32::from(c), 0x0E00..=0x0E7F)
+}
+
+/// Arabic letters, marks, digits and punctuation: an item with any of them is shaped with the
+/// craft-fonts Arabic face.
+pub(super) fn is_arabic(c: char) -> bool {
+    matches!(u32::from(c), 0x0600..=0x06FF | 0x0750..=0x077F | 0x0870..=0x08FF | 0xFB50..=0xFDFF | 0xFE70..=0xFEFC)
+}
+
+/// Hebrew letters, points, cantillation marks and punctuation (and the presentation forms): an
+/// item with any of them is drawn with the craft-fonts Hebrew face.
+pub(super) fn is_hebrew(c: char) -> bool {
+    matches!(u32::from(c), 0x0591..=0x05F4 | 0xFB1D..=0xFB4F)
+}
+
+/// The first character of `t` that would be drawn as `?`: outside WinAnsiEncoding and not drawn
+/// with the craft-fonts Arabic (#125) or Hebrew (#128) face, or Arabic or Hebrew that the face can't
+/// draw (or that has no face to draw it). Page-content tools refuse such text; the Add-text editor
+/// keeps it open.
+pub fn first_undrawable(t: &AddedText) -> Option<char> {
+    if t.text.chars().any(is_thai) {
+        if let Some(c) = t.text.chars().find(|c| is_thai(*c) && !pdfcraft_fonts::thai_has(*c)) {
+            return Some(c);
+        }
+        let rest = AddedText { text: t.text.chars().filter(|c| !is_thai(*c)).collect(), ..t.clone() };
+        return first_undrawable(&rest);
+    }
+    // Arabic or Hebrew that nothing can draw: there's no face, or the face lacks it.
+    if let Some(c) =
+        t.text.chars().find(|c| (shaped_arabic(*c) && !pdfcraft_fonts::arabic_has(*c)) || (is_hebrew(*c) && !pdfcraft_fonts::hebrew_has(*c)))
+    {
+        return Some(c);
+    }
+    if !shaped_by_a_face(t) {
+        // Drawn line by line in the item's standard font (`\n` splits lines). Without the face
+        // that is also how `draw` redraws an existing item, so it's checked that way.
+        return t.text.split('\n').find_map(pdfcraft_fonts::first_non_win_ansi);
+    }
+    // What `shaped_layout` leaves to the standard font, exactly as `draw_shaped` splits it.
+    wrapped(t).into_iter().find_map(|(line, rtl)| {
+        let (pieces, _) = shaped_layout(t, &line, rtl).ok()?;
+        pieces.iter().find_map(|p| match p {
+            Piece::Latin(s) => pdfcraft_fonts::first_non_win_ansi(s),
+            Piece::Shaped(_) => None,
+        })
+    })
+}
+
+/// Whether `t` has Arabic or Hebrew that its craft-fonts face draws (so `draw` lays it out with
+/// [`draw_shaped`]).
+fn shaped_by_a_face(t: &AddedText) -> bool {
+    (pdfcraft_fonts::document_arabic_font().is_some() && t.text.chars().any(is_arabic))
+        || (pdfcraft_fonts::document_hebrew_font(false).is_some() && t.text.chars().any(is_hebrew))
+}
+
+/// An Arabic character the face shapes and draws (U+061C, a direction mark, is dropped).
+pub(super) fn shaped_arabic(c: char) -> bool {
+    is_arabic(c) && !is_bidi_control(c)
+}
+
+/// Direction marks, embeddings, overrides and isolates: they steer the order and are not drawn.
+fn is_bidi_control(c: char) -> bool {
+    matches!(c, '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}')
+}
+
+fn mirrored(c: char) -> char {
+    match c {
+        '(' => ')',
+        ')' => '(',
+        '[' => ']',
+        ']' => '[',
+        '{' => '}',
+        '}' => '{',
+        '<' => '>',
+        '>' => '<',
+        '«' => '»',
+        '»' => '«',
+        other => other,
+    }
+}
+
+/// A piece of a line with shaped text, in drawing order.
+pub(super) enum Piece {
+    /// Shown in the item's own standard font.
+    Latin(String),
+    Shaped(Vec<ShapedCluster>),
+}
+
+/// A line of a shaped-text item in drawing order (the Unicode bidirectional algorithm, UAX #9), and
+/// its width at the item's size. `rtl` is its paragraph's direction.
+pub(super) fn shaped_layout(t: &AddedText, line: &str, rtl: bool) -> Result<(Vec<Piece>, f64), EditError> {
+    // unicode-bidi indexes the first level of a line, so an empty one would panic.
+    if line.is_empty() {
+        return Ok((Vec::new(), 0.0));
+    }
+    let base = if rtl { Level::rtl() } else { Level::ltr() };
+    let info = ParagraphBidiInfo::new(line, Some(base));
+    let (levels, runs) = info.visual_runs(0..line.len());
+    let mut pieces = Vec::new();
+    for run in runs {
+        let run_rtl = levels.get(run.start).is_some_and(Level::is_rtl);
+        // Runs lie on character boundaries; a missing slice is skipped, never a panic.
+        let Some(text) = line.get(run) else { continue };
+        // Arabic and Hebrew letters take their face; so do spaces and punctuation between them
+        // (Hebrew's when they follow Hebrew), which the shaper then mirrors. Latin text (and what
+        // the faces lack) keeps the item's font.
+        let mut segments: Vec<(Option<ShapedScript>, String)> = Vec::new();
+        for c in text.chars().filter(|c| !is_bidi_control(*c)) {
+            let after_hebrew = segments.last().is_some_and(|(kind, _)| *kind == Some(ShapedScript::Hebrew));
+            let script = if is_thai(c) {
+                Some(ShapedScript::Thai)
+            } else if is_hebrew(c) || (run_rtl && after_hebrew && !c.is_alphanumeric() && pdfcraft_fonts::hebrew_has(c)) {
+                Some(ShapedScript::Hebrew)
+            } else if is_arabic(c) || (run_rtl && !c.is_alphanumeric() && pdfcraft_fonts::arabic_has(c)) {
+                Some(ShapedScript::Arabic)
+            } else {
+                None
+            };
+            match segments.last_mut() {
+                Some((kind, s)) if *kind == script => s.push(c),
+                _ => segments.push((script, c.to_string())),
+            }
+        }
+        if run_rtl {
+            segments.reverse();
+        }
+        for (script, s) in segments {
+            pieces.push(if let Some(script) = script {
+                let shaped = match script {
+                    ShapedScript::Arabic => shape_arabic(&s, run_rtl).map_err(|e| arabic_error(e, &s))?,
+                    ShapedScript::Hebrew => shape_hebrew(&s, run_rtl).map_err(|e| hebrew_error(e, &s))?,
+                    ShapedScript::Thai => shape_thai(&s).map_err(|e| thai_error(e, &s))?,
+                };
+                Piece::Shaped(shaped)
+            } else if run_rtl {
+                Piece::Latin(s.chars().rev().map(mirrored).collect())
+            } else {
+                Piece::Latin(s)
+            });
+        }
+    }
+    let width = pieces
+        .iter()
+        .map(|p| match p {
+            Piece::Latin(s) => latin_width(t, s),
+            // Each cluster is shown on its own, so the spacing follows each once.
+            Piece::Shaped(clusters) => clusters.iter().map(|c| c.advance * t.size + t.char_spacing).sum::<f64>(),
+        })
+        .sum();
+    Ok((pieces, width))
+}
+
+/// The width of `s` in a shaped-text item; the item's font's estimate if it can't be shaped (drawing
+/// then reports why).
+fn shaped_width(t: &AddedText, s: &str, rtl: bool) -> f64 {
+    shaped_layout(t, s, rtl).map(|(_, w)| w).unwrap_or_else(|_| latin_width(t, s))
+}
+
+pub(super) fn arabic_error(e: GlyphError, text: &str) -> EditError {
+    EditError::Invalid(match e {
+        GlyphError::NoFont => "Arabic text needs PdfCraft's Arabic font, which this build doesn't include \
+                               (to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout that has an Arab face)"
+            .into(),
+        GlyphError::Missing => format!("the Arabic font can't show \"{text}\""),
+        GlyphError::TooComplex => format!("the Arabic font's glyphs for \"{text}\" are too complex"),
+    })
+}
+
+pub(super) fn hebrew_error(e: GlyphError, text: &str) -> EditError {
+    EditError::Invalid(match e {
+        GlyphError::NoFont => "Hebrew text needs PdfCraft's Hebrew font, which this build doesn't include \
+                               (to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout that has a Hebr face)"
+            .into(),
+        GlyphError::Missing => format!("the Hebrew font can't show \"{text}\""),
+        GlyphError::TooComplex => format!("the Hebrew font's glyphs for \"{text}\" are too complex"),
+    })
+}
+
+pub(super) fn thai_error(e: GlyphError, text: &str) -> EditError {
+    EditError::Invalid(match e {
+        GlyphError::NoFont => {
+            "Thai text needs a Thai font in this build; rebuild with CRAFT_FONTS_DIR pointing to craft-fonts with a Thai face".into()
+        }
+        GlyphError::Missing => format!("the Thai font can't show \"{text}\""),
+        GlyphError::TooComplex => "the Thai glyphs are too complex; use a shorter text box".into(),
+    })
+}
+
+/// The box a text item occupies (height from its lines).
+pub fn text_rect(t: &AddedText) -> [f64; 4] {
+    let r = norm(t.rect);
+    let h = lines(t).len().max(1) as f64 * t.size * 1.2;
+    [r[0], r[3] - h, r[2], r[3]]
+}
+
+/// How far each paste onto a page already holding the copy is offset, down and to the right, so a
+/// copy doesn't hide what it was copied from (points).
+pub const PASTE_STEP: f64 = 18.0;
+
+/// Where a pasted item of box `rect` goes on a page of `size` (display space): with its top-left
+/// corner at `at`, else where it was, `steps` paste steps ([`PASTE_STEP`]) down and to the right.
+/// It is kept on the page; one larger than the page keeps its left and top edges on it. A page
+/// or point that isn't a number leaves the box where it was.
+pub fn paste_rect(rect: [f64; 4], size: [f64; 2], steps: u32, at: Option<[f64; 2]>) -> [f64; 4] {
+    let [x0, y0, x1, y1] = norm(rect);
+    let (w, h) = (x1 - x0, y1 - y0);
+    let (left, top) = match at {
+        Some([x, y]) => (x, y),
+        None => {
+            let d = PASTE_STEP * f64::from(steps);
+            (x0 + d, y1 - d)
+        }
+    };
+    if !size.iter().chain(&[left, top, w, h]).all(|v| v.is_finite()) {
+        return rect;
+    }
+    let left = left.min(size[0] - w).max(0.0);
+    let top = top.max(h).min(size[1]);
+    [left, top - h, left + w, top]
+}
+
+/// Most paste steps [`paste_place`] tries before giving up on finding a free place.
+const MAX_PASTE_STEPS: u32 = 64;
+
+/// Where Edit ▸ Paste puts `content` on a page of `size` already holding `items` (display space):
+/// where it was, or as many paste steps down and to the right as it takes not to land exactly on
+/// a copy of it (the original it was copied from, or an earlier paste).
+pub fn paste_place<'a>(items: impl IntoIterator<Item = &'a Content>, content: &Content, size: [f64; 2]) -> [f64; 4] {
+    let same = copy_key(content);
+    let copies: Vec<[f64; 4]> = items.into_iter().filter(|i| copy_key(i) == same).map(Content::rect).collect();
+    let taken = |rect: [f64; 4]| copies.iter().any(|c| c.iter().zip(rect).all(|(a, b)| (a - b).abs() < 0.5));
+    let mut rect = paste_rect(content.rect(), size, 0, None);
+    for steps in 1..=MAX_PASTE_STEPS {
+        if !taken(rect) {
+            break;
+        }
+        rect = paste_rect(content.rect(), size, steps, None);
+    }
+    rect
+}
+
+/// What makes two items copies of each other for [`paste_place`]: all but the box, and for an
+/// image all but the object holding its picture, which a paste into another document stores anew.
+fn copy_key(c: &Content) -> Content {
+    match c.with_rect([0.0; 4]) {
+        Content::Image(img) => Content::Image(AddedImage { image: ObjRef::new(0, 0), ..img }),
+        text => text,
+    }
+}
+
+/// The widest explicit line before wrapping, measured with the PDF writing fonts.
+pub fn text_width(t: &AddedText) -> f64 {
+    t.text.split('\n').map(|line| shaped_width(t, line, unicode_bidi::get_base_direction(line) == unicode_bidi::Direction::Rtl)).fold(0.0, f64::max)
+}
diff --git a/crates/edit/src/added/store.rs b/crates/edit/src/added/store.rs
new file mode 100644
index 0000000000..b89d429000
--- /dev/null
+++ b/crates/edit/src/added/store.rs
@@ -0,0 +1,301 @@
+use super::draw::{draw, params};
+use super::layout::{first_undrawable, is_thai, nums, shaped_arabic, thai_error};
+use super::types::{Added, AddedImage, AddedText, Align, CHAR_SPACING_LIMIT, Family, MarkerScan, TAG};
+use super::*;
+
+fn parse(doc: &Document, d: &Dict) -> Option<Content> {
+    let r = nums(doc, d.get(b"Rect"));
+    let rect: [f64; 4] = r.try_into().ok()?;
+    match d.name(b"Kind")? {
+        b"Text" => {
+            let (family, bold, italic) = Family::from_base(d.name(b"Font").unwrap_or(b"Helvetica"));
+            let c = nums(doc, d.get(b"Color"));
+            Some(Content::Text(AddedText {
+                rect,
+                text: d.get(b"Text").and_then(|t| doc.resolve(t).as_string().map(|s| s.to_text())).unwrap_or_default(),
+                family,
+                bold,
+                italic,
+                size: d.get(b"Size").and_then(Object::as_f64).unwrap_or(12.0),
+                color: if c.len() == 3 { [c[0], c[1], c[2]] } else { [0.0; 3] },
+                align: match d.int(b"Align") {
+                    Some(1) => Align::Center,
+                    Some(2) => Align::Right,
+                    Some(3) => Align::Justify,
+                    _ => Align::Left,
+                },
+                // Items written before character spacing have none.
+                char_spacing: d.get(b"CharSpacing").and_then(Object::as_f64).filter(|v| v.is_finite()).unwrap_or(0.0),
+            }))
+        }
+        b"Image" => {
+            let crop = nums(doc, d.get(b"Crop"));
+            Some(Content::Image(AddedImage {
+                rect,
+                image: d.get(b"Image")?.as_ref()?,
+                rotation: (d.int(b"Rotate").unwrap_or(0).rem_euclid(360) / 90) as u8,
+                flip_h: matches!(d.get(b"FlipH"), Some(Object::Bool(true))),
+                flip_v: matches!(d.get(b"FlipV"), Some(Object::Bool(true))),
+                crop: crop.try_into().unwrap_or([0.0; 4]),
+            }))
+        }
+        _ => None,
+    }
+}
+
+fn with_resolved<T>(doc: &Document, object: &Object, f: impl FnOnce(&Object) -> T) -> T {
+    match object {
+        Object::Ref(reference) => {
+            let resolved = doc.get(*reference);
+            f(&resolved)
+        }
+        direct => f(direct),
+    }
+}
+
+fn for_each_content_entry(doc: &Document, page: &pdfcraft_model::Page, mut visit: impl FnMut(&Object)) {
+    let Some(contents) = page.dict.get(b"Contents") else { return };
+    with_resolved(doc, contents, |resolved| match resolved {
+        Object::Array(entries) => {
+            for entry in entries {
+                visit(entry);
+            }
+        }
+        _ => visit(contents),
+    });
+}
+
+/// Finds page marks and editable added content in one pass over the page content entries.
+pub fn scan_markers(doc: &Document) -> MarkerScan {
+    let mut scan = MarkerScan::default();
+    for (pi, page) in page_list(doc).iter().enumerate() {
+        for_each_content_entry(doc, page, |entry| {
+            with_resolved(doc, entry, |resolved| {
+                let Some(dict) = resolved.as_dict() else { return };
+                let tag = dict.name(b"PCMark");
+                let kind = if tag == Some(&b"HeaderFooter"[..]) {
+                    Some(MarkKind::HeaderFooter)
+                } else if tag == Some(&b"Watermark"[..]) {
+                    Some(MarkKind::Watermark)
+                } else if tag == Some(&b"Background"[..]) {
+                    Some(MarkKind::Background)
+                } else {
+                    None
+                };
+                if let Some(kind) = kind
+                    && !scan.marks.contains(&kind)
+                {
+                    scan.marks.push(kind);
+                }
+
+                let Some(obj) = Object::as_ref(entry) else { return };
+                if tag != Some(TAG.as_bytes()) {
+                    return;
+                }
+                let Some(params_object) = dict.get(b"PCAdded") else { return };
+                with_resolved(doc, params_object, |resolved_params| {
+                    let Some(params) = resolved_params.as_dict() else { return };
+                    if let Some(content) = parse(doc, params) {
+                        // Display points depend on the page's /UserUnit. An item records the one it was
+                        // written for; none means 1, as for items written before display space followed
+                        // /UserUnit.
+                        let written = params
+                            .get(b"UserUnit")
+                            .and_then(Object::as_f64)
+                            .filter(|u| u.is_finite() && *u >= 1.0)
+                            .map_or(1.0, |u| u.min(pdfcraft_model::MAX_USER_UNIT));
+                        scan.added.push(Added { page: pi, obj, content: content.scaled(page.user_unit(doc) / written) });
+                    }
+                });
+            });
+        });
+    }
+    scan
+}
+
+fn validate(c: &Content) -> Result<(), EditError> {
+    let r = c.rect();
+    if !r.iter().all(|v| v.is_finite()) {
+        return Err(EditError::Invalid("invalid position".into()));
+    }
+    match c {
+        Content::Text(t) => {
+            if t.text.trim().is_empty() {
+                return Err(EditError::Invalid("type some text first".into()));
+            }
+            if !(t.size.is_finite() && (1.0..=500.0).contains(&t.size)) {
+                return Err(EditError::Invalid("the font size must be between 1 and 500 points".into()));
+            }
+            if !(t.char_spacing.is_finite() && (-CHAR_SPACING_LIMIT..=CHAR_SPACING_LIMIT).contains(&t.char_spacing)) {
+                return Err(EditError::Invalid(format!(
+                    "the character spacing must be between -{CHAR_SPACING_LIMIT} and {CHAR_SPACING_LIMIT} points"
+                )));
+            }
+            if (r[2] - r[0]).abs() < 1.0 {
+                return Err(EditError::Invalid("the text box is too narrow".into()));
+            }
+            if t.text.chars().any(is_thai) && pdfcraft_fonts::document_thai_font().is_none() {
+                return Err(thai_error(GlyphError::NoFont, &t.text));
+            }
+            // Without the Arabic face, `draw` decides for the Arabic letters themselves (#403): a new
+            // item is refused with what's missing, and one that already holds Arabic stays movable.
+            // Everything else in it is drawn in the standard font, so it still has to fit.
+            let undrawable = if t.text.chars().any(shaped_arabic) && pdfcraft_fonts::document_arabic_font().is_none() {
+                t.text.split('\n').find_map(|line| {
+                    line.chars()
+                        .find(|c| !(shaped_arabic(*c) || is_thai(*c) && pdfcraft_fonts::thai_has(*c) || pdfcraft_fonts::win_ansi_encodable(*c)))
+                })
+            } else {
+                first_undrawable(t)
+            };
+            if let Some(c) = undrawable {
+                return Err(crate::undrawable(c));
+            }
+        }
+        Content::Image(_) => {
+            if (r[2] - r[0]).abs() < 1.0 || (r[3] - r[1]).abs() < 1.0 {
+                return Err(EditError::Invalid("the image is too small".into()));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Write an item's stream (new, or replacing `obj`) and make its resources available to the page.
+fn write(doc: &mut Document, page: usize, c: &Content, obj: Option<ObjRef>) -> Result<ObjRef, EditError> {
+    validate(c)?;
+    let all = page_list(doc);
+    check(&[page], all.len())?;
+    let p = &all[page];
+    let view = p.view_matrix(doc);
+    let user_unit = p.user_unit(doc);
+    // The page gets its own copy of its resources with the item's fonts and images added, and
+    // without the Arabic fonts of the version it replaces.
+    let mut pres = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    if let Some(r) = obj {
+        drop_fonts(doc, &mut pres, &own_fonts(doc, r));
+    }
+    let taken = pres.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
+    let (content, res) = draw(doc, c, view, &taken, obj.is_some())?;
+    if obj.is_none() {
+        crate::check_on_top(doc, p)?;
+    }
+    for (k, v) in res.iter() {
+        let mut sub = pres.get(k).map(|s| doc.resolve(s)).and_then(|s| s.as_dict().cloned()).unwrap_or_default();
+        for (n2, o) in v.as_dict().into_iter().flat_map(|d| d.iter()) {
+            sub.set(n2.clone(), o.clone());
+        }
+        pres.set(k.clone(), Object::Dict(sub));
+    }
+    doc.update_dict(p.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(pres)))?;
+    let mut sd = Dict::new();
+    sd.set(b"PCMark".to_vec(), Object::name(TAG));
+    let mut added = params(c);
+    if user_unit != 1.0 {
+        added.set(b"UserUnit".to_vec(), Object::Real(user_unit));
+    }
+    sd.set(b"PCAdded".to_vec(), Object::Dict(added));
+    let stream = Stream::flate(sd, &content);
+    match obj {
+        Some(r) => {
+            doc.set(r, Object::Stream(stream));
+            Ok(r)
+        }
+        None => {
+            // place_tagged appends a new stream; recover its reference.
+            let p = page_list(doc).swap_remove(page);
+            place_tagged(doc, &p, TAG, content.clone(), false)?;
+            let p = page_list(doc).swap_remove(page);
+            let r = contents(doc, &p)?.last().and_then(Object::as_ref).ok_or_else(|| EditError::Invalid("could not add the content".into()))?;
+            doc.set(r, Object::Stream(stream));
+            Ok(r)
+        }
+    }
+}
+
+/// Every added item, page by page, in drawing order.
+pub fn list_added(doc: &Document) -> Vec<Added> {
+    scan_markers(doc).added
+}
+
+/// Add an item to a page (0-based). Returns its index among the page's added items.
+pub fn add_content(doc: &mut Document, page: usize, c: &Content) -> Result<usize, EditError> {
+    write(doc, page, c, None)?;
+    Ok(list_added(doc).iter().filter(|a| a.page == page).count() - 1)
+}
+
+fn find(doc: &Document, page: usize, index: usize) -> Result<Added, EditError> {
+    list_added(doc)
+        .into_iter()
+        .filter(|a| a.page == page)
+        .nth(index)
+        .ok_or_else(|| EditError::Invalid(format!("page {} has no added item {}", page + 1, index + 1)))
+}
+
+/// Replace item `index` of `page` (moved, resized, retyped or reformatted).
+pub fn update_content(doc: &mut Document, page: usize, index: usize, c: &Content) -> Result<(), EditError> {
+    let a = find(doc, page, index)?;
+    if std::mem::discriminant(&a.content) != std::mem::discriminant(c) {
+        return Err(EditError::Invalid("an item can't change between text and image".into()));
+    }
+    write(doc, page, c, Some(a.obj))?;
+    Ok(())
+}
+
+/// Remove item `index` of `page`.
+pub fn delete_content(doc: &mut Document, page: usize, index: usize) -> Result<(), EditError> {
+    let a = find(doc, page, index)?;
+    let p = page_list(doc).swap_remove(page);
+    let list: Vec<Object> = contents(doc, &p)?.into_iter().filter(|o| o.as_ref() != Some(a.obj)).collect();
+    let fonts = own_fonts(doc, a.obj);
+    // Only the page's own resources carry an item's fonts (`write` gives the page a copy).
+    let res = match p.dict.get(b"Resources") {
+        Some(Object::Dict(d)) if !fonts.is_empty() => Some(d.clone()),
+        _ => None,
+    };
+    let res = res.map(|mut r| {
+        drop_fonts(doc, &mut r, &fonts);
+        r
+    });
+    doc.update_dict(p.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Array(list));
+        if let Some(r) = res {
+            d.set(b"Resources".to_vec(), Object::Dict(r));
+        }
+    })?;
+    Ok(())
+}
+
+/// Leave only item `index` on `page`: its contents become the item's own stream and its
+/// annotations go, so a render of the page (on a transparent backdrop) is the item's pixels
+/// alone. For previews on a copy of the document; the page's resources stay as they are.
+pub fn isolate_content(doc: &mut Document, page: usize, index: usize) -> Result<(), EditError> {
+    let a = find(doc, page, index)?;
+    let p = page_list(doc).swap_remove(page);
+    // An item's stream starts from the page's initial graphics state: `place_tagged` closes
+    // everything drawn before it, so it draws the same on its own.
+    doc.update_dict(p.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Array(vec![Object::Ref(a.obj)]));
+        d.remove(b"Annots");
+    })?;
+    Ok(())
+}
+
+/// The Type 3 fonts an Arabic item's stream shows text with. Each item has its own (`draw_shaped`
+/// names them so), so they go when the item is replaced or deleted.
+fn own_fonts(doc: &Document, obj: ObjRef) -> Vec<Vec<u8>> {
+    let Object::Stream(s) = &*doc.get(obj) else { return Vec::new() };
+    let Ok(data) = s.decoded() else { return Vec::new() };
+    data.split(u8::is_ascii_whitespace).filter_map(|w| w.strip_prefix(b"/")).filter(|w| w.starts_with(b"PCAr")).map(<[u8]>::to_vec).collect()
+}
+
+fn drop_fonts(doc: &Document, res: &mut Dict, names: &[Vec<u8>]) {
+    if names.is_empty() {
+        return;
+    }
+    let Some(mut fonts) = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()) else { return };
+    for name in names {
+        fonts.remove(name);
+    }
+    res.set(b"Font".to_vec(), Object::Dict(fonts));
+}
diff --git a/crates/edit/src/added/types.rs b/crates/edit/src/added/types.rs
new file mode 100644
index 0000000000..0a9f92f92c
--- /dev/null
+++ b/crates/edit/src/added/types.rs
@@ -0,0 +1,212 @@
+use super::layout::norm;
+use super::*;
+
+pub(super) const TAG: &str = "Added";
+
+/// The most character spacing an added text takes either way, in points: as far as the font size goes.
+pub const CHAR_SPACING_LIMIT: f64 = 500.0;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum Family {
+    #[default]
+    Helvetica,
+    Times,
+    Courier,
+}
+
+impl Family {
+    pub fn label(self) -> &'static str {
+        match self {
+            Family::Helvetica => "Helvetica",
+            Family::Times => "Times",
+            Family::Courier => "Courier",
+        }
+    }
+
+    /// The standard-14 font name for this family and style.
+    pub fn base_font(self, bold: bool, italic: bool) -> &'static str {
+        match (self, bold, italic) {
+            (Family::Helvetica, false, false) => "Helvetica",
+            (Family::Helvetica, true, false) => "Helvetica-Bold",
+            (Family::Helvetica, false, true) => "Helvetica-Oblique",
+            (Family::Helvetica, true, true) => "Helvetica-BoldOblique",
+            (Family::Times, false, false) => "Times-Roman",
+            (Family::Times, true, false) => "Times-Bold",
+            (Family::Times, false, true) => "Times-Italic",
+            (Family::Times, true, true) => "Times-BoldItalic",
+            (Family::Courier, false, false) => "Courier",
+            (Family::Courier, true, false) => "Courier-Bold",
+            (Family::Courier, false, true) => "Courier-Oblique",
+            (Family::Courier, true, true) => "Courier-BoldOblique",
+        }
+    }
+
+    pub(super) fn from_base(base: &[u8]) -> (Family, bool, bool) {
+        let s = String::from_utf8_lossy(base);
+        let family = if s.starts_with("Times") {
+            Family::Times
+        } else if s.starts_with("Courier") {
+            Family::Courier
+        } else {
+            Family::Helvetica
+        };
+        (family, s.contains("Bold"), s.contains("Italic") || s.contains("Oblique"))
+    }
+
+    /// Advance width of `s` at `size` points, from the published standard-14 metrics.
+    ///
+    /// `italic` matters: the item is written out as the oblique/italic face (see [`Family::base_font`]),
+    /// whose published widths differ from the upright face (Times-Italic `A` is 611, Times-Roman 722).
+    pub fn width(self, s: &str, size: f64, bold: bool, italic: bool) -> f64 {
+        self.std14(bold, italic).text_width(s, size)
+    }
+
+    /// The standard-14 face this family means at the given style.
+    pub fn std14(self, bold: bool, italic: bool) -> Std14 {
+        match (self, bold, italic) {
+            (Family::Courier, false, false) => Std14::Courier,
+            (Family::Courier, true, false) => Std14::CourierBold,
+            (Family::Courier, false, true) => Std14::CourierOblique,
+            (Family::Courier, true, true) => Std14::CourierBoldOblique,
+            (Family::Times, false, false) => Std14::TimesRoman,
+            (Family::Times, true, false) => Std14::TimesBold,
+            (Family::Times, false, true) => Std14::TimesItalic,
+            (Family::Times, true, true) => Std14::TimesBoldItalic,
+            (Family::Helvetica, false, false) => Std14::Helvetica,
+            (Family::Helvetica, true, false) => Std14::HelveticaBold,
+            (Family::Helvetica, false, true) => Std14::HelveticaOblique,
+            (Family::Helvetica, true, true) => Std14::HelveticaBoldOblique,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum Align {
+    #[default]
+    Left,
+    Center,
+    Right,
+    /// Lines (but the last) stretched to the box's width.
+    Justify,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct AddedText {
+    /// The text box in display space; its width wraps the text and its top is the first line's
+    /// top. The height follows the text.
+    pub rect: [f64; 4],
+    pub text: String,
+    pub family: Family,
+    pub bold: bool,
+    pub italic: bool,
+    pub size: f64,
+    pub color: [f64; 3],
+    pub align: Align,
+    /// Extra space after every character, in points: the PDF's character spacing (`Tc`).
+    pub char_spacing: f64,
+}
+
+impl Default for AddedText {
+    fn default() -> Self {
+        AddedText {
+            rect: [0.0; 4],
+            text: String::new(),
+            family: Family::Helvetica,
+            bold: false,
+            italic: false,
+            size: 12.0,
+            color: [0.0; 3],
+            align: Align::Left,
+            char_spacing: 0.0,
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct AddedImage {
+    /// Display space.
+    pub rect: [f64; 4],
+    /// The image XObject.
+    pub image: ObjRef,
+    /// Quarter turns counter-clockwise (0–3).
+    pub rotation: u8,
+    pub flip_h: bool,
+    pub flip_v: bool,
+    /// The fraction trimmed from each side of the image: left, bottom, right, top (see
+    /// [`AddedImage::crop_valid`]).
+    pub crop: [f64; 4],
+}
+
+impl AddedImage {
+    pub fn new(rect: [f64; 4], image: ObjRef) -> Self {
+        AddedImage { rect, image, rotation: 0, flip_h: false, flip_v: false, crop: [0.0; 4] }
+    }
+
+    /// The least of the image's width and of its height that a crop keeps.
+    pub const MIN_CROP_KEEP: f64 = 0.05;
+
+    /// How far a sum of two sides may pass the most a crop trims: `0.05 + 0.9` is
+    /// `0.9500000000000001` in floating point and still keeps 5 %.
+    const CROP_ROUNDING: f64 = 1e-9;
+
+    /// Whether `crop` trims every side by a fraction from 0 to under 1 and keeps at least
+    /// [`AddedImage::MIN_CROP_KEEP`] across each axis: one side may trim 95 % when its opposite
+    /// trims nothing.
+    pub fn crop_valid(crop: [f64; 4]) -> bool {
+        let [l, b, r, t] = crop;
+        let most = 1.0 - Self::MIN_CROP_KEEP;
+        crop.iter().all(|v| v.is_finite() && (0.0..1.0).contains(v)) && l + r <= most + Self::CROP_ROUNDING && b + t <= most + Self::CROP_ROUNDING
+    }
+
+    /// `crop` brought into [`AddedImage::crop_valid`] range, for one read from a file: each side
+    /// in range, and an axis that trims too much keeps its two sides' proportion.
+    pub fn clamp_crop(crop: [f64; 4]) -> [f64; 4] {
+        let most = 1.0 - Self::MIN_CROP_KEEP;
+        let [l, b, r, t] = crop.map(|v| if v.is_finite() { v.max(0.0) } else { 0.0 });
+        // Scaled from the halves, whose sum can't overflow, so the pair keeps its proportion;
+        // a pair within the limit keeps each side within it too.
+        let fit = |a: f64, c: f64| {
+            let half = a / 2.0 + c / 2.0;
+            if half > (most + Self::CROP_ROUNDING) / 2.0 { (a / 2.0 / half * most, c / 2.0 / half * most) } else { (a, c) }
+        };
+        let ((l, r), (b, t)) = (fit(l, r), fit(b, t));
+        [l, b, r, t]
+    }
+
+    /// The matrix from image space (the unit square) to display space: crop, flip, rotate,
+    /// then fill the box.
+    pub(super) fn matrix(&self) -> pdfcraft_content::Matrix {
+        use pdfcraft_content::Matrix as M;
+        let [l, b, r, t] = Self::clamp_crop(self.crop);
+        let (cw, ch) = (1.0 - l - r, 1.0 - b - t);
+        let mut m = M([1.0 / cw, 0.0, 0.0, 1.0 / ch, -l / cw, -b / ch]);
+        if self.flip_h {
+            m = m.then(&M([-1.0, 0.0, 0.0, 1.0, 1.0, 0.0]));
+        }
+        if self.flip_v {
+            m = m.then(&M([1.0, 0.0, 0.0, -1.0, 0.0, 1.0]));
+        }
+        for _ in 0..self.rotation % 4 {
+            // A quarter turn counter-clockwise within the unit square.
+            m = m.then(&M([0.0, 1.0, -1.0, 0.0, 1.0, 0.0]));
+        }
+        let [x0, y0, x1, y1] = norm(self.rect);
+        m.then(&M([x1 - x0, 0.0, 0.0, y1 - y0, x0, y0]))
+    }
+}
+
+/// An added item on a page.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Added {
+    pub page: usize,
+    /// The item's content stream.
+    pub obj: ObjRef,
+    pub content: Content,
+}
+
+/// PdfCraft-owned page content discovered in one page/content traversal.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct MarkerScan {
+    pub marks: Vec<MarkKind>,
+    pub added: Vec<Added>,
+}
diff --git a/crates/edit/src/apply.rs b/crates/edit/src/apply.rs
new file mode 100644
index 0000000000..1461dc78ef
--- /dev/null
+++ b/crates/edit/src/apply.rs
@@ -0,0 +1,291 @@
+use super::marks::{
+    Background, Context, HeaderFooter, MarkKind, Watermark, add_picture_resource, bates_start, expand, matrix_number, n, picture, rgb, shrink_matrix,
+};
+use super::place::{
+    END, Isolation, add_page_resources, add_resources, begin, check, check_on_top, contents, free_font_name, isolation, page_fonts, page_list, place,
+    place_inside_wrapper, stream_tag, text_op, undrawable, wrapper_role,
+};
+use super::*;
+
+/// Add a header and footer to `pages` (0-based). With `replace`, existing headers and footers on
+/// those pages are removed first (Acrobat's Replace Existing).
+pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter, replace: bool, cx: &Context) -> Result<(), EditError> {
+    let all = page_list(doc);
+    check(pages, all.len())?;
+    if hf.text.iter().all(|t| t.trim().is_empty()) {
+        return Err(EditError::Invalid("type the header or footer text first".into()));
+    }
+    if let Some(c) = hf.first_undrawable() {
+        return Err(undrawable(c));
+    }
+    if !(hf.font_size.is_finite() && hf.font_size > 0.0 && hf.font_size <= 200.0 && hf.margins.iter().all(|m| m.is_finite() && *m >= 0.0)) {
+        return Err(EditError::Invalid("invalid font size or margins".into()));
+    }
+    // Page numbers count up from start_number, so the last selected page needs the most room.
+    // Refuse the whole run before drawing anything: headers applied to some pages and then a
+    // failed page number would leave the document half changed.
+    let last_number = u64::from(hf.start_number)
+        .checked_add(pages.len().saturating_sub(1) as u64)
+        .ok_or_else(|| EditError::Invalid("the header page numbers are too large".into()))?;
+    if last_number > u64::from(u32::MAX) {
+        return Err(EditError::Invalid(format!(
+            "the header start number {} leaves no room for {} pages (page numbers stop at {})",
+            hf.start_number,
+            pages.len(),
+            u32::MAX
+        )));
+    }
+    // The same goes for Bates numbers: the last selected page must still fit in a u64.
+    let bates0 = hf.text.iter().find_map(|t| bates_start(t)).unwrap_or(1);
+    if bates0.checked_add(pages.len().saturating_sub(1) as u64).is_none() {
+        return Err(EditError::Invalid(format!(
+            "the Bates start number {bates0} leaves no room for {} pages (Bates numbers stop at {})",
+            pages.len(),
+            u64::MAX
+        )));
+    }
+    // Shrinking needs room on every page: refuse before anything is drawn or replaced.
+    let shrinks = pages
+        .iter()
+        .map(|&i| hf.shrink.then(|| shrink_matrix(hf, all[i].display_size(doc), all[i].view_matrix(doc))).transpose())
+        .collect::<Result<Vec<_>, _>>()?;
+    for &i in pages {
+        check_on_top(doc, &all[i])?;
+    }
+    if replace {
+        remove_marks(doc, pages, MarkKind::HeaderFooter)?;
+    }
+    let all = page_list(doc);
+    let count = all.len();
+    for (k, &i) in pages.iter().enumerate() {
+        let page = &all[i];
+        let (w, h) = page.display_size(doc);
+        let number =
+            u32::try_from(u64::from(hf.start_number) + k as u64).map_err(|_| EditError::Invalid("the header page numbers are too large".into()))?;
+        let bates = bates0.checked_add(k as u64).ok_or_else(|| EditError::Invalid("the Bates numbers are too large".into()))?;
+        let size = hf.font_size;
+        let [top, bottom, left, right] = hf.margins;
+        // The page resource the face is added under: the usual name, unless the page already
+        // draws another font by it, which must not change under the header.
+        let preferred = match hf.font {
+            added::Family::Helvetica => "PCHelv",
+            added::Family::Times => "PCTimes",
+            added::Family::Courier => "PCCour",
+        };
+        let base = hf.font.base_font(false, false);
+        let resource = free_font_name(doc, &page_fonts(doc, page), preferred, base);
+        let mut body: Vec<u8> = format!("BT\n/{resource} {} Tf\n{}\n", n(size), rgb(hf.color)).into_bytes();
+        let mut underlines = String::new();
+        for (slot, template) in hf.text.iter().enumerate() {
+            if template.trim().is_empty() {
+                continue;
+            }
+            let lines: Vec<String> = expand(template, number, count, bates, cx).lines().map(str::to_owned).collect();
+            let header = slot < 3;
+            let line_h = size * 1.2;
+            for (li, line) in lines.iter().enumerate() {
+                // Centred and right-aligned text is placed by its width in the chosen face.
+                let tw = hf.font.width(line, size, false, false);
+                let x = match slot % 3 {
+                    0 => left,
+                    1 => (w - tw) / 2.0,
+                    _ => w - right - tw,
+                };
+                // Headers hang below the top margin; footers sit on the bottom margin.
+                let y = if header { h - top - size * 0.8 - li as f64 * line_h } else { bottom + (lines.len() - 1 - li) as f64 * line_h };
+                body.extend(text_op(x, y, line));
+                if hf.underline {
+                    underlines.push_str(&format!("{} {} {} {} re f\n", n(x), n(y - size * 0.15), n(tw), n((size * 0.06).max(0.4))));
+                }
+            }
+        }
+        body.extend_from_slice(b"ET\n");
+        if !underlines.is_empty() {
+            body.extend(format!("{}\n{underlines}", rgb(hf.color)).bytes());
+        }
+        let mut content = begin(MarkKind::HeaderFooter, "Header", page.view_matrix(doc)).into_bytes();
+        content.extend(body);
+        content.extend_from_slice(END.as_bytes());
+        // A name already there is that very font (see `free_font_name`): left as it is.
+        if !page_fonts(doc, page).contains(resource.as_bytes()) {
+            add_page_resources(doc, page, None, &[(resource.into_bytes(), base)])?;
+        }
+        let page = &page_list(doc)[i];
+        place(doc, page, MarkKind::HeaderFooter, content, false)?;
+        if let Some(Some(m)) = shrinks.get(k) {
+            let cm = format!("{} cm\n", m.map(matrix_number).join(" "));
+            let page = &page_list(doc)[i];
+            place_inside_wrapper(doc, page, MarkKind::HeaderFooter.tag(), cm.into_bytes())?;
+        }
+    }
+    Ok(())
+}
+
+/// Add a text watermark to `pages`.
+pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replace: bool) -> Result<(), EditError> {
+    let all = page_list(doc);
+    check(pages, all.len())?;
+    let text = wm.text.trim();
+    if text.is_empty() && wm.source.is_none() {
+        return Err(EditError::Invalid("type the watermark text first".into()));
+    }
+    if let Some(c) = wm.first_undrawable() {
+        return Err(undrawable(c));
+    }
+    if !(wm.opacity.is_finite()
+        && wm.rotation.is_finite()
+        && wm.font_size.is_finite()
+        && wm.font_size >= 0.0
+        && wm.offset.iter().all(|o| o.is_finite()))
+    {
+        return Err(EditError::Invalid("invalid watermark settings".into()));
+    }
+    if !wm.behind {
+        for &i in pages {
+            check_on_top(doc, &all[i])?;
+        }
+    }
+    if replace {
+        remove_marks(doc, pages, MarkKind::Watermark)?;
+    }
+    let opacity = wm.opacity.clamp(0.0, 1.0);
+    let lines: Vec<&str> = text.lines().collect();
+    for &i in pages {
+        let page = page_list(doc)[i].clone();
+        let (w, h) = page.display_size(doc);
+        if let Some(src) = &wm.source {
+            let mut content = begin(MarkKind::Watermark, "Watermark", page.view_matrix(doc));
+            content.push_str(&format!("/PCGS{} gs\n", (opacity * 100.0).round() as i64));
+            content.push_str(&picture(src, (w, h), wm.scale, wm.rotation, wm.offset));
+            content.push_str(END);
+            add_resources(doc, &page, Some(opacity), None)?;
+            add_picture_resource(doc, &page_list(doc)[i].clone(), src)?;
+            let page = &page_list(doc)[i];
+            place(doc, page, MarkKind::Watermark, content.into_bytes(), wm.behind)?;
+            continue;
+        }
+        let widest = lines.iter().map(|l| helvetica_width(l, 1.0)).fold(0.0, f64::max).max(0.01);
+        let size = if wm.font_size > 0.0 { wm.font_size } else { ((w * w + h * h).sqrt() * 0.5 / widest).clamp(6.0, 300.0) };
+        let (s, c) = wm.rotation.to_radians().sin_cos();
+        let (cx, cy) = (w / 2.0 + wm.offset[0], h / 2.0 + wm.offset[1]);
+        let mut content = begin(MarkKind::Watermark, "Watermark", page.view_matrix(doc)).into_bytes();
+        content.extend(
+            format!(
+                "/PCGS{} gs\n{} {} {} {} {} {} cm\nBT\n/PCHelv {} Tf\n{}\n",
+                (opacity * 100.0).round() as i64,
+                n(c),
+                n(s),
+                n(-s),
+                n(c),
+                n(cx),
+                n(cy),
+                n(size),
+                rgb(wm.color)
+            )
+            .bytes(),
+        );
+        let line_h = size * 1.15;
+        let total = line_h * (lines.len() as f64 - 1.0);
+        for (li, line) in lines.iter().enumerate() {
+            let tw = helvetica_width(line, size);
+            content.extend(text_op(-tw / 2.0, total / 2.0 - li as f64 * line_h - size * 0.35, line));
+        }
+        content.extend_from_slice(b"ET\n");
+        content.extend_from_slice(END.as_bytes());
+        add_resources(doc, &page, Some(opacity), None)?;
+        let page = &page_list(doc)[i];
+        place(doc, page, MarkKind::Watermark, content, wm.behind)?;
+    }
+    Ok(())
+}
+
+/// Add a solid-colour background behind the content of `pages`.
+pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, replace: bool) -> Result<(), EditError> {
+    let all = page_list(doc);
+    check(pages, all.len())?;
+    if replace {
+        remove_marks(doc, pages, MarkKind::Background)?;
+    }
+    let opacity = if bg.opacity.is_finite() { bg.opacity.clamp(0.0, 1.0) } else { 1.0 };
+    for &i in pages {
+        let page = page_list(doc)[i].clone();
+        let (w, h) = page.display_size(doc);
+        let mut content = begin(MarkKind::Background, "Background", page.view_matrix(doc));
+        match &bg.source {
+            Some(src) => {
+                content.push_str(&format!("/PCGS{} gs\n", (opacity * 100.0).round() as i64));
+                content.push_str(&picture(src, (w, h), bg.scale, 0.0, [0.0; 2]));
+            }
+            None => content.push_str(&format!("/PCGS{} gs\n{}\n0 0 {} {} re f\n", (opacity * 100.0).round() as i64, rgb(bg.color), n(w), n(h))),
+        }
+        content.push_str(END);
+        add_resources(doc, &page, Some(opacity), None)?;
+        if let Some(src) = &bg.source {
+            add_picture_resource(doc, &page_list(doc)[i].clone(), src)?;
+        }
+        let page = &page_list(doc)[i];
+        place(doc, page, MarkKind::Background, content.into_bytes(), true)?;
+    }
+    Ok(())
+}
+
+/// Remove marks of `kind` from `pages`; returns how many were removed. Wrappers left with
+/// nothing after them go too, restoring the original content list; a wrapper that content
+/// after it still relies on (another tool's appended stream) stays.
+pub fn remove_marks(doc: &mut Document, pages: &[usize], kind: MarkKind) -> Result<usize, EditError> {
+    let all = page_list(doc);
+    check(pages, all.len())?;
+    let mut removed = 0;
+    for &i in pages {
+        let page = &all[i];
+        let list = contents(doc, page)?;
+        let before = list.len();
+        let mut kept: Vec<Object> = list.into_iter().filter(|o| stream_tag(doc, o).as_deref() != Some(kind.tag())).collect();
+        removed += before - kept.len();
+        // Strip only wrapper pairs whose close ends the list (after stripping the pairs after
+        // it): nothing comes after them to need the state they restore. Pairs come from the
+        // operators; for content that can't be read that precisely, from the wrapper streams
+        // alone, so updating a mark there doesn't nest another wrapper each time.
+        if before != kept.len() {
+            let wrappers = match isolation(doc, &kept) {
+                Isolation::Clean { wrappers, .. } => wrappers,
+                Isolation::Unknown { .. } | Isolation::TooDeep => {
+                    let mut opens = Vec::new();
+                    let mut pairs = Vec::new();
+                    for (i, o) in kept.iter().enumerate() {
+                        match wrapper_role(doc, o) {
+                            Some(true) => opens.push(i),
+                            Some(false) => pairs.extend(opens.pop().map(|open| (open, i))),
+                            None => {}
+                        }
+                    }
+                    pairs
+                }
+            };
+            let pairs: std::collections::HashMap<usize, usize> = wrappers.into_iter().map(|(open, close)| (close, open)).collect();
+            let mut discarded = std::collections::HashSet::new();
+            let mut end = kept.len();
+            while let Some(close) = end.checked_sub(1) {
+                if discarded.contains(&close) {
+                    end = close;
+                } else if let Some(&open) = pairs.get(&close) {
+                    discarded.insert(open);
+                    discarded.insert(close);
+                    end = close;
+                } else {
+                    break;
+                }
+            }
+            kept = kept.into_iter().enumerate().filter(|(i, _)| !discarded.contains(i)).map(|(_, o)| o).collect();
+        }
+        if before != kept.len() {
+            doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(kept)))?;
+        }
+    }
+    Ok(removed)
+}
+
+/// Which kinds of marks the document has (for enabling Update/Remove).
+pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
+    added::scan_markers(doc).marks
+}
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index 6f14271be4..5180e76018 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -539,6 +539,11 @@ pub(crate) fn selectable_images(
 /// Find the saved graphics-state scope containing just this image and its crop. Applying
 /// the transform before that scope moves the actual clipping path as well as the pixels.
 /// A shared clip must never be moved along with unrelated artwork or text.
+///
+/// Under a clip set outside every scope that holds only this image (a report or table drawing
+/// each picture as `q re W n cm Do Q` inside a section's clip), no scope contains every active
+/// clip. The outermost scope holding only the image is used then: it contains all of the
+/// image's private clips, which move with it, while the outer clip is shared and stays.
 fn image_transform_scope(ops: &[Op], target: usize) -> Result<Option<(usize, usize, Matrix)>, EditError> {
     struct Scope {
         start: usize,
@@ -556,6 +561,7 @@ fn image_transform_scope(ops: &[Op], target: usize) -> Result<Option<(usize, usi
     let mut text = false;
     let mut at_image = None;
     let mut isolated = None;
+    let mut outermost = None;
     for (index, op) in ops.iter().enumerate() {
         match op.op.as_slice() {
             b"q" => {
@@ -566,9 +572,13 @@ fn image_transform_scope(ops: &[Op], target: usize) -> Result<Option<(usize, usi
             }
             b"Q" => {
                 if let Some(scope) = stack.pop() {
-                    if scope.selected && !scope.other_paint && !scope.inherited_clip && !scope.inherited_path {
-                        // Prefer the innermost scope that contains every active clipping path.
-                        isolated.get_or_insert((scope.start, index, scope.matrix));
+                    if scope.selected && !scope.other_paint && !scope.inherited_path {
+                        if !scope.inherited_clip {
+                            // Prefer the innermost scope that contains every active clipping path.
+                            isolated.get_or_insert((scope.start, index, scope.matrix));
+                        }
+                        // Scopes close inner first, so the last one recorded is the outermost.
+                        outermost = Some((scope.start, index, scope.matrix));
                     }
                     matrix = scope.matrix;
                     clipped = scope.inherited_clip;
@@ -611,7 +621,7 @@ fn image_transform_scope(ops: &[Op], target: usize) -> Result<Option<(usize, usi
     if !clipped {
         return Ok(Some((target, target, placement)));
     }
-    Ok(isolated)
+    Ok(isolated.or(outermost))
 }
 
 fn transform_image(
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 630f12550b..7c8556332b 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -31,994 +31,8 @@ pub enum EditError {
     Cos(#[from] pdfcraft_cos::CosError),
 }
 
-/// The kinds of page marks.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum MarkKind {
-    HeaderFooter,
-    Watermark,
-    Background,
-}
-
-impl MarkKind {
-    fn tag(self) -> &'static str {
-        match self {
-            MarkKind::HeaderFooter => "HeaderFooter",
-            MarkKind::Watermark => "Watermark",
-            MarkKind::Background => "Background",
-        }
-    }
-}
-
 pub type Rgb = [f64; 3];
 
-/// Header and footer settings (Acrobat's Add Header and Footer dialog).
-#[derive(Clone, Debug, PartialEq)]
-pub struct HeaderFooter {
-    /// Left, centre and right header text, then left, centre and right footer text. Tokens:
-    /// `<<1>>` page number, `<<n>>` page count, `<<1 of n>>`, `<<1/n>>`, `<<Page 1>>`,
-    /// `<<Page 1 of n>>`, dates `<<m/d/yyyy>>`, `<<mm/dd/yyyy>>`, `<<d/m/yyyy>>`, `<<yyyy-mm-dd>>`,
-    /// `<<yyyy/mm/dd>>`, `<<yyyy/m/d>>`, `<<m/d/yy>>`, `<<mmmm d, yyyy>>`, and Bates numbers `<<Bates Number#6#1#PRE#SUF>>`
-    /// (digits, start, prefix, suffix).
-    pub text: [String; 6],
-    /// The standard face the text is drawn in (#3754): Helvetica (the default), Times or Courier.
-    pub font: added::Family,
-    pub font_size: f64,
-    pub color: Rgb,
-    pub underline: bool,
-    /// Margins in points: top, bottom, left, right (the text's distance from the page edges).
-    pub margins: [f64; 4],
-    /// The number `<<1>>` shows on the first page of the range.
-    pub start_number: u32,
-    /// Shrink the page content so the header and footer don't cover it (Acrobat's Appearance
-    /// Options): the original content is scaled down evenly into the band the header and footer
-    /// leave free, centred across the page. Remove and Update take the scaling away again.
-    pub shrink: bool,
-}
-
-impl Default for HeaderFooter {
-    /// Acrobat's defaults: 8 pt black, margins 0.5 in top and bottom, 1 in left and right.
-    fn default() -> Self {
-        Self {
-            text: Default::default(),
-            font: added::Family::Helvetica,
-            font_size: 8.0,
-            color: [0.0; 3],
-            underline: false,
-            margins: [36.0, 36.0, 72.0, 72.0],
-            start_number: 1,
-            shrink: false,
-        }
-    }
-}
-
-impl HeaderFooter {
-    /// The first character [`add_header_footer`] would refuse, because the standard fonts can't
-    /// draw it (#125). Tokens only add ASCII (Bates prefixes and suffixes are part of the
-    /// template), so checking the templates, split as `expand`'s output is, covers every page
-    /// (and a `\r` that would be drawn is refused too). The dialog asks this too, so its preview
-    /// never offers text that applying refuses (#2013).
-    pub fn first_undrawable(&self) -> Option<char> {
-        self.text.iter().flat_map(|t| t.lines()).find_map(pdfcraft_fonts::first_non_win_ansi)
-    }
-
-    /// The room the header and the footer take at the top and the bottom of a page, in points:
-    /// the margin, the lines of the tallest box, and a clearance of half the font size. A side
-    /// without text takes none. This is the room [`HeaderFooter::shrink`] keeps free.
-    pub fn bands(&self) -> (f64, f64) {
-        let size = self.font_size;
-        let line_h = size * 1.2;
-        let lines = |boxes: &[String]| boxes.iter().filter(|t| !t.trim().is_empty()).map(|t| t.lines().count().max(1)).max();
-        let (header, footer) = self.text.split_at(3);
-        // Header lines hang below the top margin (a full line each); the footer's last line sits
-        // on the bottom margin, so only its capitals (0.8 of the size) rise above it.
-        let top = lines(header).map_or(0.0, |n| self.margins[0] + size + (n - 1) as f64 * line_h + size / 2.0);
-        let bottom = lines(footer).map_or(0.0, |n| self.margins[1] + size * 0.8 + (n - 1) as f64 * line_h + size / 2.0);
-        (top, bottom)
-    }
-}
-
-/// The `cm` that shrinks a page's original content (user space) into the band `hf` leaves free,
-/// for a page shown `size` (display space) with view matrix `view` (display to user space): an
-/// even scale, centred across, the content's bottom on the footer's band.
-fn shrink_matrix(hf: &HeaderFooter, size: (f64, f64), view: [f64; 6]) -> Result<[f64; 6], EditError> {
-    let (w, h) = size;
-    let (top, bottom) = hf.bands();
-    let free = h - top - bottom;
-    if !(free.is_finite() && free >= 1.0 && w.is_finite() && w > 0.0) {
-        return Err(EditError::Invalid("the header and footer margins leave no room for the page content to shrink into".into()));
-    }
-    let k = free / h;
-    let v = kurbo::Affine::new(view);
-    let det = v.determinant();
-    if !(det.is_finite() && det.abs() > 1e-12) {
-        return Err(EditError::Invalid("the page can't be shrunk: its view matrix is degenerate".into()));
-    }
-    let shrink = kurbo::Affine::new([k, 0.0, 0.0, k, (w - w * k) / 2.0, bottom]);
-    // User space to display space, shrink there, and back.
-    Ok((v * shrink * v.inverse()).as_coeffs())
-}
-
-/// A picture for a background or watermark (Acrobat: Source ▸ File): an XObject already in
-/// the document, an image (drawn into a unit square) or a form (a page of a PDF).
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct MarkSource {
-    pub xobject: pdfcraft_cos::ObjRef,
-    /// Its natural size in points.
-    pub size: (f64, f64),
-    /// An image XObject (unit square); otherwise a form whose `/Matrix` maps it to `size`.
-    pub image: bool,
-}
-
-/// A watermark: text, or a picture from a file (`source`; the text is then ignored).
-#[derive(Clone, Debug, PartialEq)]
-pub struct Watermark {
-    pub text: String,
-    pub source: Option<MarkSource>,
-    /// Pictures: size relative to the page (1.0 fits the page).
-    pub scale: f64,
-    /// 0 = fit: about half the page diagonal.
-    pub font_size: f64,
-    pub color: Rgb,
-    /// 0–1.
-    pub opacity: f64,
-    /// Degrees counter-clockwise (Acrobat's 45° runs from bottom-left to top-right).
-    pub rotation: f64,
-    /// Draw behind the page content instead of on top.
-    pub behind: bool,
-    /// Offset of the centre from the page centre, in points (right, up).
-    pub offset: [f64; 2],
-}
-
-impl Watermark {
-    /// The first character of a text watermark [`add_watermark`] would refuse, because the
-    /// standard fonts can't draw it (#125). A picture watermark draws no text.
-    pub fn first_undrawable(&self) -> Option<char> {
-        match self.source {
-            Some(_) => None,
-            None => self.text.trim().lines().find_map(pdfcraft_fonts::first_non_win_ansi),
-        }
-    }
-}
-
-impl Default for Watermark {
-    fn default() -> Self {
-        Self {
-            text: String::new(),
-            source: None,
-            scale: 0.5,
-            font_size: 0.0,
-            color: [0.6, 0.6, 0.6],
-            opacity: 0.5,
-            rotation: 45.0,
-            behind: false,
-            offset: [0.0; 2],
-        }
-    }
-}
-
-/// A background behind the page content: a solid colour, or a picture from a file.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Background {
-    pub color: Rgb,
-    pub opacity: f64,
-    pub source: Option<MarkSource>,
-    /// Pictures: size relative to the page (1.0 fits the page).
-    pub scale: f64,
-}
-
-impl Default for Background {
-    fn default() -> Self {
-        Self { color: [1.0, 1.0, 0.85], opacity: 1.0, source: None, scale: 1.0 }
-    }
-}
-
-/// Drawing a picture mark: fitted to the page at `scale`, centred (plus `offset`), turned by
-/// `rotation` degrees. Returns the content and the resource name it uses.
-fn picture(src: &MarkSource, page: (f64, f64), scale: f64, rotation: f64, offset: [f64; 2]) -> String {
-    let (w, h) = page;
-    let (sw, sh) = (src.size.0.max(0.01), src.size.1.max(0.01));
-    let k = (w / sw).min(h / sh) * if scale.is_finite() && scale > 0.0 { scale } else { 1.0 };
-    let (dw, dh) = (sw * k, sh * k);
-    let (s, c) = rotation.to_radians().sin_cos();
-    let (cx, cy) = (w / 2.0 + offset[0], h / 2.0 + offset[1]);
-    // Centre, rotate, then place the picture's box (unit square for images).
-    let place = if src.image {
-        format!("{} 0 0 {} {} {} cm", n(dw), n(dh), n(-dw / 2.0), n(-dh / 2.0))
-    } else {
-        format!("{} 0 0 {} {} {} cm", n(k), n(k), n(-dw / 2.0), n(-dh / 2.0))
-    };
-    format!("{} {} {} {} {} {} cm\n{place}\n/PCPic{} Do\n", n(c), n(s), n(-s), n(c), n(cx), n(cy), src.xobject.num)
-}
-
-/// Register a mark picture in the page's own resources (`/PCPic<num>`).
-fn add_picture_resource(doc: &mut Document, page: &pdfcraft_model::Page, src: &MarkSource) -> Result<(), EditError> {
-    let p = doc.get(page.obj).as_dict().cloned().unwrap_or_default();
-    let mut res = p.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    let mut xo = res.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
-    xo.set(format!("PCPic{}", src.xobject.num).into_bytes(), Object::Ref(src.xobject));
-    res.set(b"XObject".to_vec(), Object::Dict(xo));
-    doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(res)))?;
-    Ok(())
-}
-
-/// Values tokens need that come from outside the document.
-#[derive(Clone, Debug, PartialEq, Default)]
-pub struct Context {
-    /// Today's date: (year, month 1–12, day 1–31).
-    pub date: (i64, u32, u32),
-}
-
-// Model-derived transforms can contain tiny scale factors; retain their PDF decimal precision.
-fn matrix_number(value: f64) -> String {
-    let mut bytes = Vec::new();
-    pdfcraft_cos::serialize(&Object::Real(value), &mut bytes);
-    String::from_utf8_lossy(&bytes).into_owned()
-}
-
-fn n(v: f64) -> String {
-    let s = format!("{:.3}", if v.abs() < 5e-4 { 0.0 } else { v });
-    let s = s.trim_end_matches('0').trim_end_matches('.');
-    if s == "-0" { "0".into() } else { s.into() }
-}
-
-fn rgb(c: Rgb) -> String {
-    let c = c.map(|x| x.clamp(0.0, 1.0));
-    format!("{} {} {} rg", n(c[0]), n(c[1]), n(c[2]))
-}
-
-const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
-
-/// Expand `<<…>>` tokens for page `index` (0-based within the range) of `count`.
-pub fn expand(template: &str, page_number: u32, count: usize, bates: u64, cx: &Context) -> String {
-    let (y, m, d) = cx.date;
-    let mut out = String::new();
-    let mut rest = template;
-    while let Some(start) = rest.find("<<") {
-        out.push_str(&rest[..start]);
-        let after = &rest[start + 2..];
-        let Some(end) = after.find(">>") else {
-            out.push_str(&rest[start..]);
-            return out;
-        };
-        let token = &after[..end];
-        let p = page_number;
-        let value = match token {
-            "1" => p.to_string(),
-            "n" => count.to_string(),
-            "1 of n" => format!("{p} of {count}"),
-            "1/n" => format!("{p}/{count}"),
-            "Page 1" => format!("Page {p}"),
-            "Page 1 of n" => format!("Page {p} of {count}"),
-            "m/d" => format!("{m}/{d}"),
-            "m/d/yy" => format!("{m}/{d}/{:02}", y.rem_euclid(100)),
-            "m/d/yyyy" => format!("{m}/{d}/{y}"),
-            "mm/dd/yy" => format!("{m:02}/{d:02}/{:02}", y.rem_euclid(100)),
-            "mm/dd/yyyy" => format!("{m:02}/{d:02}/{y}"),
-            "d/m/yy" => format!("{d}/{m}/{:02}", y.rem_euclid(100)),
-            "d/m/yyyy" => format!("{d}/{m}/{y}"),
-            "dd/mm/yyyy" => format!("{d:02}/{m:02}/{y}"),
-            "yyyy-mm-dd" => format!("{y}-{m:02}-{d:02}"),
-            "yyyy/mm/dd" => format!("{y}/{m:02}/{d:02}"),
-            "yyyy/m/d" => format!("{y}/{m}/{d}"),
-            "mmmm d, yyyy" => format!("{} {d}, {y}", MONTHS[(m.clamp(1, 12) - 1) as usize]),
-            t if t.starts_with("Bates Number") => {
-                // Bates Number#digits#start#prefix#suffix (start is applied by the caller).
-                let parts: Vec<&str> = t.split('#').collect();
-                let digits = parts.get(1).and_then(|d| d.parse::<usize>().ok()).unwrap_or(6).clamp(1, 15);
-                format!("{}{:0digits$}{}", parts.get(3).unwrap_or(&""), bates, parts.get(4).unwrap_or(&""))
-            }
-            _ => format!("<<{token}>>"),
-        };
-        out.push_str(&value);
-        rest = &after[end + 2..];
-    }
-    out.push_str(rest);
-    out
-}
-
-/// The Bates start number in a template (`<<Bates Number#digits#start#…>>`), if any.
-fn bates_start(template: &str) -> Option<u64> {
-    let i = template.find("<<Bates Number")?;
-    let t = &template[i + 2..];
-    let t = &t[..t.find(">>")?];
-    t.split('#').nth(2).and_then(|s| s.parse().ok()).or(Some(1))
-}
-
-fn page_list(doc: &Document) -> Vec<pdfcraft_model::Page> {
-    pdfcraft_model::pages(doc)
-}
-
-fn check(pages: &[usize], count: usize) -> Result<(), EditError> {
-    match pages.iter().find(|p| **p >= count) {
-        Some(p) => Err(EditError::NoSuchPage(*p)),
-        None => Ok(()),
-    }
-}
-
-/// The page's `/Contents` as a list of stream references (inline content is promoted).
-fn contents(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<Vec<Object>, EditError> {
-    let obj = doc.get(page.obj);
-    let d = obj.as_dict().cloned().unwrap_or_default();
-    Ok(match d.get(b"Contents").cloned() {
-        None => Vec::new(),
-        Some(Object::Ref(r)) => match doc.get(r).as_array() {
-            Some(a) => a.clone(),
-            None => vec![Object::Ref(r)],
-        },
-        Some(Object::Array(a)) => a,
-        Some(other) => vec![Object::Ref(doc.add(other))],
-    })
-}
-
-/// Add the font (and an opacity state) to the page's own resources.
-fn add_resources(doc: &mut Document, page: &pdfcraft_model::Page, opacity: Option<f64>, content: Option<&[u8]>) -> Result<(), EditError> {
-    let mut faces: Vec<(Vec<u8>, &str)> = Vec::new();
-    for (name, base) in [(&b"PCHelv"[..], "Helvetica"), (b"PCTimes", "Times-Roman"), (b"PCCour", "Courier")] {
-        // Helvetica always (marks use it); the others only when the content names them.
-        if name != b"PCHelv" && !content.is_some_and(|c| c.windows(name.len() + 1).any(|w| w[0] == b'/' && &w[1..] == name)) {
-            continue;
-        }
-        faces.push((name.to_vec(), base));
-    }
-    add_page_resources(doc, page, opacity, &faces)
-}
-
-/// The fonts a page draws with: its own resources' or the ones it inherits.
-fn page_fonts(doc: &Document, page: &pdfcraft_model::Page) -> Dict {
-    let res = page.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default()
-}
-
-/// A name in `fonts` for the standard face `base` that can't take over a font the page already
-/// draws with: `preferred` when it is free or already names exactly the dictionary
-/// [`add_page_resources`] writes for that face, otherwise the first such `preferred_1`,
-/// `preferred_2`… (one of the first `fonts.len() + 1` always is). A font with anything more
-/// (`/ToUnicode`, `/Widths`…) is someone else's, even in the same face.
-fn free_font_name(doc: &Document, fonts: &Dict, preferred: &str, base: &str) -> String {
-    let usable = |name: &str| match fonts.get(name.as_bytes()) {
-        None => true,
-        Some(font) => doc.resolve(font).as_dict().is_some_and(|d| {
-            d.len() == 4
-                && d.name(b"Type") == Some(b"Font")
-                && d.name(b"Subtype") == Some(b"Type1")
-                && d.name(b"BaseFont") == Some(base.as_bytes())
-                && d.name(b"Encoding") == Some(b"WinAnsiEncoding")
-        }),
-    };
-    if usable(preferred) {
-        return preferred.to_string();
-    }
-    (1..=fonts.len().saturating_add(1)).map(|k| format!("{preferred}_{k}")).find(|name| usable(name)).unwrap_or_else(|| preferred.to_string())
-}
-
-/// Add the standard `faces` (resource name, base font) and an opacity state to the page's own
-/// resources.
-fn add_page_resources(doc: &mut Document, page: &pdfcraft_model::Page, opacity: Option<f64>, faces: &[(Vec<u8>, &str)]) -> Result<(), EditError> {
-    let mut res = page.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    let mut fonts = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
-    for (name, base) in faces {
-        let mut font = Dict::new();
-        font.set(b"Type".to_vec(), Object::name("Font"));
-        font.set(b"Subtype".to_vec(), Object::name("Type1"));
-        font.set(b"BaseFont".to_vec(), Object::name(base));
-        font.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-        fonts.set(name.clone(), Object::Dict(font));
-    }
-    res.set(b"Font".to_vec(), Object::Dict(fonts));
-    if let Some(o) = opacity {
-        let mut gs = res.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
-        let mut s = Dict::new();
-        s.set(b"Type".to_vec(), Object::name("ExtGState"));
-        s.set(b"CA".to_vec(), Object::Real(o));
-        s.set(b"ca".to_vec(), Object::Real(o));
-        let name = format!("PCGS{}", (o * 100.0).round() as i64);
-        gs.set(name.into_bytes(), Object::Dict(s));
-        res.set(b"ExtGState".to_vec(), Object::Dict(gs));
-    }
-    // The page gets its own (possibly copied) resources; shared dictionaries stay untouched.
-    doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(res)))?;
-    Ok(())
-}
-
-const WRAP_OPEN: &[u8] = b"q %PdfCraft\n";
-/// Starts with an end of line, so a comment left open at the end of the content before it
-/// can't swallow the `Q`. Older files have the close without it.
-const WRAP_CLOSE: &[u8] = b"\nQ %PdfCraft\n";
-const OLD_WRAP_CLOSE: &[u8] = b"Q %PdfCraft\n";
-
-/// Whether `bytes` are a wrapper's close: canonical `EMC` closures, then the existing
-/// graphics closures. Legacy closes without the leading newline remain valid on their own.
-fn is_wrap_close(bytes: &[u8]) -> bool {
-    let mut rest = bytes;
-    while let Some(shorter) = rest.strip_prefix(b"\nEMC".as_slice()) {
-        rest = shorter;
-    }
-    let legacy = rest.len() == bytes.len();
-    loop {
-        if rest == WRAP_CLOSE || (legacy && rest == OLD_WRAP_CLOSE) {
-            return true;
-        }
-        match rest.strip_prefix(b"\nQ".as_slice()) {
-            Some(shorter) => rest = shorter,
-            None => return false,
-        }
-    }
-}
-
-/// A `Wrap`-tagged stream's role from its exact bytes: `Some(true)` for an open, `Some(false)`
-/// for a close.
-fn wrapper_role(doc: &Document, o: &Object) -> Option<bool> {
-    if stream_tag(doc, o).as_deref() != Some("Wrap") {
-        return None;
-    }
-    let Object::Stream(stream) = &*doc.resolve(o) else { return None };
-    // Wrappers are a few bytes; one that decodes to more isn't PdfCraft's.
-    let bytes = stream.decoded_within(64 * 1024).ok()?;
-    if bytes == WRAP_OPEN { Some(true) } else { is_wrap_close(&bytes).then_some(false) }
-}
-
-#[cfg(test)]
-fn stream_bytes(doc: &Document, o: &Object) -> Option<Vec<u8>> {
-    match &*doc.resolve(o) {
-        Object::Stream(s) => s.decoded().ok(),
-        _ => None,
-    }
-}
-
-/// The `/PCMark` tag in a content stream's dictionary: a mark kind, or `Wrap` for the q/Q
-/// wrapper. Read from the dictionary, so finding marks never decompresses page content.
-fn stream_tag(doc: &Document, o: &Object) -> Option<String> {
-    let obj = doc.resolve(o);
-    obj.as_dict()?.name(b"PCMark").map(|n| String::from_utf8_lossy(n).into_owned())
-}
-
-fn tagged(tag: &str) -> Dict {
-    let mut d = Dict::new();
-    d.set(b"PCMark".to_vec(), Object::name(tag));
-    d
-}
-
-/// What placing a mark on top needs, from the page's actual operators (not the `/PCMark` tags,
-/// which another writer may keep, copy or forge).
-enum Isolation {
-    /// The content parses cleanly with balanced `q`/`Q` and closed text objects and paths.
-    /// `suffix`: the stream from which the content leaves graphics state set (or a comment open)
-    /// that a mark on top must not inherit, so it needs a wrapper from there to the end.
-    /// `wrappers`: PdfCraft wrapper pairs (open, close) as stream indexes.
-    /// `marked`: unfinished marked-content sequences to close before a new mark.
-    Clean { suffix: Option<usize>, wrappers: Vec<(usize, usize)>, marked: usize },
-    /// The content could not be read that precisely (it doesn't decode, is too large, or has
-    /// stray bytes, unbalanced `q`/`Q` or an unfinished text object or path). `unclosed` is
-    /// the count of `q` left open at the end, when known. `marked` counts known unfinished
-    /// marked-content sequences independently of graphics malformation, or zero when unknown.
-    Unknown { unclosed: usize, marked: usize },
-    /// Marked content nests past [`ISOLATION_MAX_DEPTH`]: how many sequences a mark on top would
-    /// have to close (some may be hidden optional content) is unknown.
-    TooDeep,
-}
-
-const ISOLATION_MAX_STREAMS: usize = 100_000;
-const ISOLATION_MAX_BYTES: usize = 128 * 1024 * 1024;
-const ISOLATION_MAX_OPS: usize = 1_000_000;
-const ISOLATION_MAX_DEPTH: usize = 10_000;
-
-fn isolation(doc: &Document, list: &[Object]) -> Isolation {
-    let unknown = Isolation::Unknown { unclosed: 0, marked: 0 };
-    if list.len() > ISOLATION_MAX_STREAMS {
-        return unknown;
-    }
-    let mut remaining = ISOLATION_MAX_BYTES;
-    let mut data = Vec::with_capacity(list.len());
-    for object in list {
-        let resolved = doc.resolve(object);
-        let Object::Stream(stream) = &*resolved else { return unknown };
-        let Ok(bytes) = stream.decoded_within(remaining) else { return unknown };
-        let Some(left) = remaining.checked_sub(bytes.len().saturating_add(1)) else { return unknown };
-        remaining = left;
-        data.push(bytes);
-    }
-    let pieces = pdfcraft_content::Pieces::join(&data);
-    let parsed = pieces.parse();
-    if parsed.skipped != 0 || parsed.ops.len() > ISOLATION_MAX_OPS {
-        return unknown;
-    }
-    let edges = pieces.comment_edges(&parsed);
-    let (mut text_open, mut path_open, mut dirty, mut malformed) = (false, false, false, false);
-    let mut stack: Vec<usize> = Vec::new();
-    let (mut marked, mut marked_known) = (0usize, true);
-    let mut split = 0;
-    let mut previous_last = None;
-    let mut wrappers = Vec::new();
-    for op in &parsed.ops {
-        let (first, last) = pieces.pieces_of(op);
-        // A wrapper can only go in before a whole stream, outside graphics and marked-content
-        // scopes, between operators, where no comment would swallow the wrapper's `q`.
-        if stack.is_empty()
-            && marked_known
-            && marked == 0
-            && !text_open
-            && !path_open
-            && !dirty
-            && previous_last.is_none_or(|previous| first > previous)
-            && !edges.get(first).is_some_and(|edge| edge.0)
-        {
-            split = first;
-        }
-        previous_last = Some(last);
-        // Match the reader's tolerant operands: BMC uses the last name, BDC the last
-        // name/object pair, and EMC ignores surplus operands. Invalid begins are ignored.
-        let begin_marked = match op.op.as_slice() {
-            b"BMC" => op.operands.last().is_some_and(|o| matches!(o, Object::Name(_))),
-            b"BDC" => op.operands.len().checked_sub(2).and_then(|i| op.operands.get(i)).is_some_and(|o| matches!(o, Object::Name(_))),
-            _ => false,
-        };
-        if marked_known {
-            if begin_marked {
-                if marked < ISOLATION_MAX_DEPTH {
-                    marked += 1;
-                } else {
-                    // Once the budget is exceeded, later EMCs cannot restore a known depth.
-                    marked_known = false;
-                    marked = 0;
-                }
-            } else if op.is("EMC") {
-                marked = marked.saturating_sub(1);
-            }
-        }
-        match op.op.as_slice() {
-            b"BT" if !text_open => text_open = true,
-            b"ET" if text_open => text_open = false,
-            b"BT" | b"ET" => malformed = true,
-            b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re" | b"W" | b"W*" => path_open = true,
-            b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => path_open = false,
-            _ => {}
-        }
-        match op.op.as_slice() {
-            b"q" if op.operands.is_empty() && stack.len() < ISOLATION_MAX_DEPTH => stack.push(first),
-            b"Q" if op.operands.is_empty() => match stack.pop() {
-                Some(open) => {
-                    // Only a standalone PdfCraft wrapper pair may later be removed again.
-                    let wrap = |i: usize| list.get(i).is_some_and(|o| stream_tag(doc, o).as_deref() == Some("Wrap"));
-                    if wrap(open)
-                        && wrap(first)
-                        && data.get(open).is_some_and(|d| d == WRAP_OPEN)
-                        && data.get(first).is_some_and(|d| is_wrap_close(d))
-                    {
-                        wrappers.push((open, first));
-                    }
-                }
-                None => malformed = true,
-            },
-            b"q" | b"Q" => malformed = true,
-            _ if stack.is_empty() => dirty = true,
-            _ => {}
-        }
-    }
-    if !marked_known {
-        return Isolation::TooDeep;
-    }
-    if malformed || text_open || path_open || !stack.is_empty() {
-        return Isolation::Unknown { unclosed: if malformed { 0 } else { stack.len() }, marked };
-    }
-    let comment_open = edges.last().is_some_and(|edge| edge.1);
-    Isolation::Clean { suffix: (dirty || comment_open || marked != 0).then_some(split), wrappers, marked }
-}
-
-/// Put a mark's content on a page: behind (with the behind-marks at the start) or on top
-/// (appended, after wrapping the original content in q/Q).
-fn place(doc: &mut Document, page: &pdfcraft_model::Page, kind: MarkKind, content: Vec<u8>, behind: bool) -> Result<(), EditError> {
-    place_tagged(doc, page, kind.tag(), content, behind).map(drop)
-}
-
-/// Put content on a page, tagged `tag` (see [`place`]). On top, whatever graphics state the
-/// content before leaves set (a `cm`, a clip, text state…) must not reach the mark, including
-/// content appended after an earlier PdfCraft wrapper by another tool (#3084): the stretch of
-/// content that leaves state set is wrapped in q/Q, once. Any known unfinished marked-content
-/// sequences are closed at the end too, so hidden optional content cannot hide the new mark; when
-/// their number is unknown, nothing is placed on top. Returns the new content stream.
-fn place_tagged(doc: &mut Document, page: &pdfcraft_model::Page, tag: &str, content: Vec<u8>, behind: bool) -> Result<ObjRef, EditError> {
-    let mut list = contents(doc, page)?;
-    // The behind-marks at the start: backgrounds in the order added, then watermarks.
-    let behind_kinds = [MarkKind::Background.tag(), MarkKind::Watermark.tag()];
-    let behind_marks = list.iter().take_while(|o| stream_tag(doc, o).is_some_and(|t| behind_kinds.contains(&t.as_str()))).count();
-    let wrap = if behind {
-        None
-    } else {
-        match isolation(doc, &list) {
-            Isolation::Clean { suffix, marked, .. } => suffix.map(|split| (split, 0, marked)),
-            // Content that can't be read precisely is wrapped whole, as before: after the
-            // behind-marks at the start. A `q` it leaves open is closed at its end, where
-            // closing it changes nothing already drawn.
-            Isolation::Unknown { unclosed, marked } => (behind_marks < list.len()).then_some((behind_marks, unclosed, marked)),
-            // Content left inside an optional-content sequence it cannot close could be hidden.
-            Isolation::TooDeep => return Err(too_deep_on_top()),
-        }
-    };
-    let mark_ref = doc.add(Object::Stream(Stream::flate(tagged(tag), &content)));
-    let mark = Object::Ref(mark_ref);
-    if behind {
-        // Right after the backgrounds already there, so a new background is painted over the
-        // older ones (#3591) and a watermark over all of them. Not after the watermarks: on a
-        // page with no content, one on top is at the start too and can't be told apart, so a
-        // newer watermark behind goes under the older ones.
-        let at = list.iter().take(behind_marks).rposition(|o| stream_tag(doc, o).as_deref() == Some(MarkKind::Background.tag())).map_or(0, |i| i + 1);
-        list.insert(at, mark);
-    } else {
-        if let Some((split, unclosed, marked)) = wrap {
-            let mut close_bytes = b"\nEMC".repeat(marked);
-            close_bytes.extend_from_slice(&b"\nQ".repeat(unclosed));
-            close_bytes.extend_from_slice(WRAP_CLOSE);
-            let open = Object::Ref(doc.add(Object::Stream(Stream::from_raw(tagged("Wrap"), WRAP_OPEN.to_vec()))));
-            let close = Object::Ref(doc.add(Object::Stream(Stream::from_raw(tagged("Wrap"), close_bytes))));
-            list.insert(split.min(list.len()), open);
-            list.push(close);
-        }
-        list.push(mark);
-    }
-    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
-    Ok(mark_ref)
-}
-
-fn too_deep_on_top() -> EditError {
-    EditError::Invalid("the page's marked content is nested too deeply to add anything on top of it".into())
-}
-
-/// The refusal [`place_tagged`] gives for a mark on top of `page`, checked before an edit changes
-/// anything (removing old marks, adding resources) so a refused edit leaves the document as it was.
-fn check_on_top(doc: &Document, page: &pdfcraft_model::Page) -> Result<(), EditError> {
-    let obj = doc.get(page.obj);
-    let list = match obj.as_dict().and_then(|d| d.get(b"Contents")) {
-        None => return Ok(()),
-        Some(Object::Ref(r)) => doc.get(*r).as_array().cloned().unwrap_or_else(|| vec![Object::Ref(*r)]),
-        Some(Object::Array(a)) => a.clone(),
-        Some(other) => vec![other.clone()],
-    };
-    match isolation(doc, &list) {
-        Isolation::TooDeep => Err(too_deep_on_top()),
-        _ => Ok(()),
-    }
-}
-
-/// Put content tagged `tag` first inside the q/Q wrapper, so it applies to the page's original
-/// content and nothing else (a header's shrink). A page without a wrapper has no original content
-/// on it and is left alone.
-fn place_inside_wrapper(doc: &mut Document, page: &pdfcraft_model::Page, tag: &str, content: Vec<u8>) -> Result<(), EditError> {
-    let mut list = contents(doc, page)?;
-    let Some(open) = list.iter().position(|o| stream_tag(doc, o).as_deref() == Some("Wrap")) else { return Ok(()) };
-    let stream = Object::Ref(doc.add(Object::Stream(Stream::flate(tagged(tag), &content))));
-    list.insert(open + 1, stream);
-    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
-    Ok(())
-}
-
-/// Draw `content` on top of a page (0-based) as permanent page content, with standard Helvetica
-/// available as `/PCHelv`. The stream is tagged `tag` (not a mark kind, so Remove never takes
-/// it away); the original content is wrapped in q/Q first. Used for applied redaction boxes.
-/// Returns the new content stream.
-pub fn stamp(doc: &mut Document, page: usize, tag: &str, content: Vec<u8>) -> Result<ObjRef, EditError> {
-    let all = page_list(doc);
-    check(&[page], all.len())?;
-    check_on_top(doc, &all[page])?;
-    add_resources(doc, &all[page], None, Some(&content))?;
-    let p = page_list(doc).swap_remove(page);
-    place_tagged(doc, &p, tag, content, false)
-}
-
-fn begin(kind: MarkKind, subtype: &str, matrix: [f64; 6]) -> String {
-    format!(
-        "q\n/Artifact <</Type /Pagination /Subtype /{subtype} /PCMark /{}>> BDC\n{} {} {} {} {} {} cm\n",
-        kind.tag(),
-        matrix_number(matrix[0]),
-        matrix_number(matrix[1]),
-        matrix_number(matrix[2]),
-        matrix_number(matrix[3]),
-        matrix_number(matrix[4]),
-        matrix_number(matrix[5])
-    )
-}
-
-const END: &str = "EMC\nQ\n";
-
-/// The refusal for page text with `c`, which nothing here can draw.
-pub(crate) fn undrawable(c: char) -> EditError {
-    EditError::Invalid(undrawable_message(c))
-}
-
-/// The wording of the refusal for text with `c`, which the standard fonts can't draw.
-pub fn undrawable_message(c: char) -> String {
-    format!("the standard fonts can't draw \"{c}\" (U+{:04X}); only Western European characters can be added as text for now", u32::from(c))
-}
-
-fn text_op(x: f64, y: f64, text: &str) -> Vec<u8> {
-    let mut v = format!("1 0 0 1 {} {} Tm ", n(x), n(y)).into_bytes();
-    v.extend(literal(&win_ansi(text)));
-    v.extend_from_slice(b" Tj\n");
-    v
-}
-
-/// Add a header and footer to `pages` (0-based). With `replace`, existing headers and footers on
-/// those pages are removed first (Acrobat's Replace Existing).
-pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter, replace: bool, cx: &Context) -> Result<(), EditError> {
-    let all = page_list(doc);
-    check(pages, all.len())?;
-    if hf.text.iter().all(|t| t.trim().is_empty()) {
-        return Err(EditError::Invalid("type the header or footer text first".into()));
-    }
-    if let Some(c) = hf.first_undrawable() {
-        return Err(undrawable(c));
-    }
-    if !(hf.font_size.is_finite() && hf.font_size > 0.0 && hf.font_size <= 200.0 && hf.margins.iter().all(|m| m.is_finite() && *m >= 0.0)) {
-        return Err(EditError::Invalid("invalid font size or margins".into()));
-    }
-    // Page numbers count up from start_number, so the last selected page needs the most room.
-    // Refuse the whole run before drawing anything: headers applied to some pages and then a
-    // failed page number would leave the document half changed.
-    let last_number = u64::from(hf.start_number)
-        .checked_add(pages.len().saturating_sub(1) as u64)
-        .ok_or_else(|| EditError::Invalid("the header page numbers are too large".into()))?;
-    if last_number > u64::from(u32::MAX) {
-        return Err(EditError::Invalid(format!(
-            "the header start number {} leaves no room for {} pages (page numbers stop at {})",
-            hf.start_number,
-            pages.len(),
-            u32::MAX
-        )));
-    }
-    // The same goes for Bates numbers: the last selected page must still fit in a u64.
-    let bates0 = hf.text.iter().find_map(|t| bates_start(t)).unwrap_or(1);
-    if bates0.checked_add(pages.len().saturating_sub(1) as u64).is_none() {
-        return Err(EditError::Invalid(format!(
-            "the Bates start number {bates0} leaves no room for {} pages (Bates numbers stop at {})",
-            pages.len(),
-            u64::MAX
-        )));
-    }
-    // Shrinking needs room on every page: refuse before anything is drawn or replaced.
-    let shrinks = pages
-        .iter()
-        .map(|&i| hf.shrink.then(|| shrink_matrix(hf, all[i].display_size(doc), all[i].view_matrix(doc))).transpose())
-        .collect::<Result<Vec<_>, _>>()?;
-    for &i in pages {
-        check_on_top(doc, &all[i])?;
-    }
-    if replace {
-        remove_marks(doc, pages, MarkKind::HeaderFooter)?;
-    }
-    let all = page_list(doc);
-    let count = all.len();
-    for (k, &i) in pages.iter().enumerate() {
-        let page = &all[i];
-        let (w, h) = page.display_size(doc);
-        let number =
-            u32::try_from(u64::from(hf.start_number) + k as u64).map_err(|_| EditError::Invalid("the header page numbers are too large".into()))?;
-        let bates = bates0.checked_add(k as u64).ok_or_else(|| EditError::Invalid("the Bates numbers are too large".into()))?;
-        let size = hf.font_size;
-        let [top, bottom, left, right] = hf.margins;
-        // The page resource the face is added under: the usual name, unless the page already
-        // draws another font by it, which must not change under the header.
-        let preferred = match hf.font {
-            added::Family::Helvetica => "PCHelv",
-            added::Family::Times => "PCTimes",
-            added::Family::Courier => "PCCour",
-        };
-        let base = hf.font.base_font(false, false);
-        let resource = free_font_name(doc, &page_fonts(doc, page), preferred, base);
-        let mut body: Vec<u8> = format!("BT\n/{resource} {} Tf\n{}\n", n(size), rgb(hf.color)).into_bytes();
-        let mut underlines = String::new();
-        for (slot, template) in hf.text.iter().enumerate() {
-            if template.trim().is_empty() {
-                continue;
-            }
-            let lines: Vec<String> = expand(template, number, count, bates, cx).lines().map(str::to_owned).collect();
-            let header = slot < 3;
-            let line_h = size * 1.2;
-            for (li, line) in lines.iter().enumerate() {
-                // Centred and right-aligned text is placed by its width in the chosen face.
-                let tw = hf.font.width(line, size, false, false);
-                let x = match slot % 3 {
-                    0 => left,
-                    1 => (w - tw) / 2.0,
-                    _ => w - right - tw,
-                };
-                // Headers hang below the top margin; footers sit on the bottom margin.
-                let y = if header { h - top - size * 0.8 - li as f64 * line_h } else { bottom + (lines.len() - 1 - li) as f64 * line_h };
-                body.extend(text_op(x, y, line));
-                if hf.underline {
-                    underlines.push_str(&format!("{} {} {} {} re f\n", n(x), n(y - size * 0.15), n(tw), n((size * 0.06).max(0.4))));
-                }
-            }
-        }
-        body.extend_from_slice(b"ET\n");
-        if !underlines.is_empty() {
-            body.extend(format!("{}\n{underlines}", rgb(hf.color)).bytes());
-        }
-        let mut content = begin(MarkKind::HeaderFooter, "Header", page.view_matrix(doc)).into_bytes();
-        content.extend(body);
-        content.extend_from_slice(END.as_bytes());
-        // A name already there is that very font (see `free_font_name`): left as it is.
-        if !page_fonts(doc, page).contains(resource.as_bytes()) {
-            add_page_resources(doc, page, None, &[(resource.into_bytes(), base)])?;
-        }
-        let page = &page_list(doc)[i];
-        place(doc, page, MarkKind::HeaderFooter, content, false)?;
-        if let Some(Some(m)) = shrinks.get(k) {
-            let cm = format!("{} cm\n", m.map(matrix_number).join(" "));
-            let page = &page_list(doc)[i];
-            place_inside_wrapper(doc, page, MarkKind::HeaderFooter.tag(), cm.into_bytes())?;
-        }
-    }
-    Ok(())
-}
-
-/// Add a text watermark to `pages`.
-pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replace: bool) -> Result<(), EditError> {
-    let all = page_list(doc);
-    check(pages, all.len())?;
-    let text = wm.text.trim();
-    if text.is_empty() && wm.source.is_none() {
-        return Err(EditError::Invalid("type the watermark text first".into()));
-    }
-    if let Some(c) = wm.first_undrawable() {
-        return Err(undrawable(c));
-    }
-    if !(wm.opacity.is_finite()
-        && wm.rotation.is_finite()
-        && wm.font_size.is_finite()
-        && wm.font_size >= 0.0
-        && wm.offset.iter().all(|o| o.is_finite()))
-    {
-        return Err(EditError::Invalid("invalid watermark settings".into()));
-    }
-    if !wm.behind {
-        for &i in pages {
-            check_on_top(doc, &all[i])?;
-        }
-    }
-    if replace {
-        remove_marks(doc, pages, MarkKind::Watermark)?;
-    }
-    let opacity = wm.opacity.clamp(0.0, 1.0);
-    let lines: Vec<&str> = text.lines().collect();
-    for &i in pages {
-        let page = page_list(doc)[i].clone();
-        let (w, h) = page.display_size(doc);
-        if let Some(src) = &wm.source {
-            let mut content = begin(MarkKind::Watermark, "Watermark", page.view_matrix(doc));
-            content.push_str(&format!("/PCGS{} gs\n", (opacity * 100.0).round() as i64));
-            content.push_str(&picture(src, (w, h), wm.scale, wm.rotation, wm.offset));
-            content.push_str(END);
-            add_resources(doc, &page, Some(opacity), None)?;
-            add_picture_resource(doc, &page_list(doc)[i].clone(), src)?;
-            let page = &page_list(doc)[i];
-            place(doc, page, MarkKind::Watermark, content.into_bytes(), wm.behind)?;
-            continue;
-        }
-        let widest = lines.iter().map(|l| helvetica_width(l, 1.0)).fold(0.0, f64::max).max(0.01);
-        let size = if wm.font_size > 0.0 { wm.font_size } else { ((w * w + h * h).sqrt() * 0.5 / widest).clamp(6.0, 300.0) };
-        let (s, c) = wm.rotation.to_radians().sin_cos();
-        let (cx, cy) = (w / 2.0 + wm.offset[0], h / 2.0 + wm.offset[1]);
-        let mut content = begin(MarkKind::Watermark, "Watermark", page.view_matrix(doc)).into_bytes();
-        content.extend(
-            format!(
-                "/PCGS{} gs\n{} {} {} {} {} {} cm\nBT\n/PCHelv {} Tf\n{}\n",
-                (opacity * 100.0).round() as i64,
-                n(c),
-                n(s),
-                n(-s),
-                n(c),
-                n(cx),
-                n(cy),
-                n(size),
-                rgb(wm.color)
-            )
-            .bytes(),
-        );
-        let line_h = size * 1.15;
-        let total = line_h * (lines.len() as f64 - 1.0);
-        for (li, line) in lines.iter().enumerate() {
-            let tw = helvetica_width(line, size);
-            content.extend(text_op(-tw / 2.0, total / 2.0 - li as f64 * line_h - size * 0.35, line));
-        }
-        content.extend_from_slice(b"ET\n");
-        content.extend_from_slice(END.as_bytes());
-        add_resources(doc, &page, Some(opacity), None)?;
-        let page = &page_list(doc)[i];
-        place(doc, page, MarkKind::Watermark, content, wm.behind)?;
-    }
-    Ok(())
-}
-
-/// Add a solid-colour background behind the content of `pages`.
-pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, replace: bool) -> Result<(), EditError> {
-    let all = page_list(doc);
-    check(pages, all.len())?;
-    if replace {
-        remove_marks(doc, pages, MarkKind::Background)?;
-    }
-    let opacity = if bg.opacity.is_finite() { bg.opacity.clamp(0.0, 1.0) } else { 1.0 };
-    for &i in pages {
-        let page = page_list(doc)[i].clone();
-        let (w, h) = page.display_size(doc);
-        let mut content = begin(MarkKind::Background, "Background", page.view_matrix(doc));
-        match &bg.source {
-            Some(src) => {
-                content.push_str(&format!("/PCGS{} gs\n", (opacity * 100.0).round() as i64));
-                content.push_str(&picture(src, (w, h), bg.scale, 0.0, [0.0; 2]));
-            }
-            None => content.push_str(&format!("/PCGS{} gs\n{}\n0 0 {} {} re f\n", (opacity * 100.0).round() as i64, rgb(bg.color), n(w), n(h))),
-        }
-        content.push_str(END);
-        add_resources(doc, &page, Some(opacity), None)?;
-        if let Some(src) = &bg.source {
-            add_picture_resource(doc, &page_list(doc)[i].clone(), src)?;
-        }
-        let page = &page_list(doc)[i];
-        place(doc, page, MarkKind::Background, content.into_bytes(), true)?;
-    }
-    Ok(())
-}
-
-/// Remove marks of `kind` from `pages`; returns how many were removed. Wrappers left with
-/// nothing after them go too, restoring the original content list; a wrapper that content
-/// after it still relies on (another tool's appended stream) stays.
-pub fn remove_marks(doc: &mut Document, pages: &[usize], kind: MarkKind) -> Result<usize, EditError> {
-    let all = page_list(doc);
-    check(pages, all.len())?;
-    let mut removed = 0;
-    for &i in pages {
-        let page = &all[i];
-        let list = contents(doc, page)?;
-        let before = list.len();
-        let mut kept: Vec<Object> = list.into_iter().filter(|o| stream_tag(doc, o).as_deref() != Some(kind.tag())).collect();
-        removed += before - kept.len();
-        // Strip only wrapper pairs whose close ends the list (after stripping the pairs after
-        // it): nothing comes after them to need the state they restore. Pairs come from the
-        // operators; for content that can't be read that precisely, from the wrapper streams
-        // alone, so updating a mark there doesn't nest another wrapper each time.
-        if before != kept.len() {
-            let wrappers = match isolation(doc, &kept) {
-                Isolation::Clean { wrappers, .. } => wrappers,
-                Isolation::Unknown { .. } | Isolation::TooDeep => {
-                    let mut opens = Vec::new();
-                    let mut pairs = Vec::new();
-                    for (i, o) in kept.iter().enumerate() {
-                        match wrapper_role(doc, o) {
-                            Some(true) => opens.push(i),
-                            Some(false) => pairs.extend(opens.pop().map(|open| (open, i))),
-                            None => {}
-                        }
-                    }
-                    pairs
-                }
-            };
-            let pairs: std::collections::HashMap<usize, usize> = wrappers.into_iter().map(|(open, close)| (close, open)).collect();
-            let mut discarded = std::collections::HashSet::new();
-            let mut end = kept.len();
-            while let Some(close) = end.checked_sub(1) {
-                if discarded.contains(&close) {
-                    end = close;
-                } else if let Some(&open) = pairs.get(&close) {
-                    discarded.insert(open);
-                    discarded.insert(close);
-                    end = close;
-                } else {
-                    break;
-                }
-            }
-            kept = kept.into_iter().enumerate().filter(|(i, _)| !discarded.contains(i)).map(|(_, o)| o).collect();
-        }
-        if before != kept.len() {
-            doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(kept)))?;
-        }
-    }
-    Ok(removed)
-}
-
-/// Which kinds of marks the document has (for enabling Update/Remove).
-pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
-    added::scan_markers(doc).marks
-}
-
 mod background;
 pub use background::page_background;
 pub mod objects;
@@ -1038,10 +52,25 @@ pub use text::{
 };
 pub mod added;
 pub use added::{
-    Added, AddedImage, AddedText, Align, Content, Family, MarkerScan, add_content, delete_content, first_undrawable, list_added, scan_markers,
-    update_content,
+    Added, AddedImage, AddedText, Align, Content, Family, MarkerScan, add_content, delete_content, first_undrawable, isolate_content, list_added,
+    scan_markers, update_content,
 };
 
+mod apply;
+mod marks;
+mod place;
+
+pub use apply::{add_background, add_header_footer, add_watermark, marks_present, remove_marks};
+#[cfg(test)]
+use marks::bates_start;
+pub use marks::{Background, Context, HeaderFooter, MarkKind, MarkSource, Watermark, expand};
+use marks::{matrix_number, n};
+pub(crate) use place::undrawable;
+#[cfg(test)]
+use place::{ISOLATION_MAX_DEPTH, OLD_WRAP_CLOSE, WRAP_CLOSE, WRAP_OPEN, is_wrap_close, page_fonts, stream_bytes, stream_tag, tagged, wrapper_role};
+use place::{check, check_on_top, contents, page_list, place_tagged};
+pub use place::{stamp, undrawable_message};
+
 #[cfg(test)]
 mod marked_isolation_tests;
 #[cfg(test)]
diff --git a/crates/edit/src/marks.rs b/crates/edit/src/marks.rs
new file mode 100644
index 0000000000..507e2afa8e
--- /dev/null
+++ b/crates/edit/src/marks.rs
@@ -0,0 +1,298 @@
+use super::*;
+
+/// The kinds of page marks.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum MarkKind {
+    HeaderFooter,
+    Watermark,
+    Background,
+}
+
+impl MarkKind {
+    pub(crate) fn tag(self) -> &'static str {
+        match self {
+            MarkKind::HeaderFooter => "HeaderFooter",
+            MarkKind::Watermark => "Watermark",
+            MarkKind::Background => "Background",
+        }
+    }
+}
+
+/// Header and footer settings (Acrobat's Add Header and Footer dialog).
+#[derive(Clone, Debug, PartialEq)]
+pub struct HeaderFooter {
+    /// Left, centre and right header text, then left, centre and right footer text. Tokens:
+    /// `<<1>>` page number, `<<n>>` page count, `<<1 of n>>`, `<<1/n>>`, `<<Page 1>>`,
+    /// `<<Page 1 of n>>`, dates `<<m/d/yyyy>>`, `<<mm/dd/yyyy>>`, `<<d/m/yyyy>>`, `<<yyyy-mm-dd>>`,
+    /// `<<yyyy/mm/dd>>`, `<<yyyy/m/d>>`, `<<m/d/yy>>`, `<<mmmm d, yyyy>>`, the dotted day-first
+    /// dates of German-speaking and much of Central and Eastern Europe `<<dd.mm.yyyy>>`,
+    /// `<<d.m.yyyy>>`, `<<dd.mm.yy>>`, `<<d.m.yy>>`, and Bates numbers `<<Bates Number#6#1#PRE#SUF>>`
+    /// (digits, start, prefix, suffix).
+    pub text: [String; 6],
+    /// The standard face the text is drawn in (#3754): Helvetica (the default), Times or Courier.
+    pub font: added::Family,
+    pub font_size: f64,
+    pub color: Rgb,
+    pub underline: bool,
+    /// Margins in points: top, bottom, left, right (the text's distance from the page edges).
+    pub margins: [f64; 4],
+    /// The number `<<1>>` shows on the first page of the range.
+    pub start_number: u32,
+    /// Shrink the page content so the header and footer don't cover it (Acrobat's Appearance
+    /// Options): the original content is scaled down evenly into the band the header and footer
+    /// leave free, centred across the page. Remove and Update take the scaling away again.
+    pub shrink: bool,
+}
+
+impl Default for HeaderFooter {
+    /// Acrobat's defaults: 8 pt black, margins 0.5 in top and bottom, 1 in left and right.
+    fn default() -> Self {
+        Self {
+            text: Default::default(),
+            font: added::Family::Helvetica,
+            font_size: 8.0,
+            color: [0.0; 3],
+            underline: false,
+            margins: [36.0, 36.0, 72.0, 72.0],
+            start_number: 1,
+            shrink: false,
+        }
+    }
+}
+
+impl HeaderFooter {
+    /// The first character [`add_header_footer`] would refuse, because the standard fonts can't
+    /// draw it (#125). Tokens only add ASCII (Bates prefixes and suffixes are part of the
+    /// template), so checking the templates, split as `expand`'s output is, covers every page
+    /// (and a `\r` that would be drawn is refused too). The dialog asks this too, so its preview
+    /// never offers text that applying refuses (#2013).
+    pub fn first_undrawable(&self) -> Option<char> {
+        self.text.iter().flat_map(|t| t.lines()).find_map(pdfcraft_fonts::first_non_win_ansi)
+    }
+
+    /// The room the header and the footer take at the top and the bottom of a page, in points:
+    /// the margin, the lines of the tallest box, and a clearance of half the font size. A side
+    /// without text takes none. This is the room [`HeaderFooter::shrink`] keeps free.
+    pub fn bands(&self) -> (f64, f64) {
+        let size = self.font_size;
+        let line_h = size * 1.2;
+        let lines = |boxes: &[String]| boxes.iter().filter(|t| !t.trim().is_empty()).map(|t| t.lines().count().max(1)).max();
+        let (header, footer) = self.text.split_at(3);
+        // Header lines hang below the top margin (a full line each); the footer's last line sits
+        // on the bottom margin, so only its capitals (0.8 of the size) rise above it.
+        let top = lines(header).map_or(0.0, |n| self.margins[0] + size + (n - 1) as f64 * line_h + size / 2.0);
+        let bottom = lines(footer).map_or(0.0, |n| self.margins[1] + size * 0.8 + (n - 1) as f64 * line_h + size / 2.0);
+        (top, bottom)
+    }
+}
+
+/// The `cm` that shrinks a page's original content (user space) into the band `hf` leaves free,
+/// for a page shown `size` (display space) with view matrix `view` (display to user space): an
+/// even scale, centred across, the content's bottom on the footer's band.
+pub(crate) fn shrink_matrix(hf: &HeaderFooter, size: (f64, f64), view: [f64; 6]) -> Result<[f64; 6], EditError> {
+    let (w, h) = size;
+    let (top, bottom) = hf.bands();
+    let free = h - top - bottom;
+    if !(free.is_finite() && free >= 1.0 && w.is_finite() && w > 0.0) {
+        return Err(EditError::Invalid("the header and footer margins leave no room for the page content to shrink into".into()));
+    }
+    let k = free / h;
+    let v = kurbo::Affine::new(view);
+    let det = v.determinant();
+    if !(det.is_finite() && det.abs() > 1e-12) {
+        return Err(EditError::Invalid("the page can't be shrunk: its view matrix is degenerate".into()));
+    }
+    let shrink = kurbo::Affine::new([k, 0.0, 0.0, k, (w - w * k) / 2.0, bottom]);
+    // User space to display space, shrink there, and back.
+    Ok((v * shrink * v.inverse()).as_coeffs())
+}
+
+/// A picture for a background or watermark (Acrobat: Source ▸ File): an XObject already in
+/// the document, an image (drawn into a unit square) or a form (a page of a PDF).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct MarkSource {
+    pub xobject: pdfcraft_cos::ObjRef,
+    /// Its natural size in points.
+    pub size: (f64, f64),
+    /// An image XObject (unit square); otherwise a form whose `/Matrix` maps it to `size`.
+    pub image: bool,
+}
+
+/// A watermark: text, or a picture from a file (`source`; the text is then ignored).
+#[derive(Clone, Debug, PartialEq)]
+pub struct Watermark {
+    pub text: String,
+    pub source: Option<MarkSource>,
+    /// Pictures: size relative to the page (1.0 fits the page).
+    pub scale: f64,
+    /// 0 = fit: about half the page diagonal.
+    pub font_size: f64,
+    pub color: Rgb,
+    /// 0–1.
+    pub opacity: f64,
+    /// Degrees counter-clockwise (Acrobat's 45° runs from bottom-left to top-right).
+    pub rotation: f64,
+    /// Draw behind the page content instead of on top.
+    pub behind: bool,
+    /// Offset of the centre from the page centre, in points (right, up).
+    pub offset: [f64; 2],
+}
+
+impl Watermark {
+    /// The first character of a text watermark [`add_watermark`] would refuse, because the
+    /// standard fonts can't draw it (#125). A picture watermark draws no text.
+    pub fn first_undrawable(&self) -> Option<char> {
+        match self.source {
+            Some(_) => None,
+            None => self.text.trim().lines().find_map(pdfcraft_fonts::first_non_win_ansi),
+        }
+    }
+}
+
+impl Default for Watermark {
+    fn default() -> Self {
+        Self {
+            text: String::new(),
+            source: None,
+            scale: 0.5,
+            font_size: 0.0,
+            color: [0.6, 0.6, 0.6],
+            opacity: 0.5,
+            rotation: 45.0,
+            behind: false,
+            offset: [0.0; 2],
+        }
+    }
+}
+
+/// A background behind the page content: a solid colour, or a picture from a file.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Background {
+    pub color: Rgb,
+    pub opacity: f64,
+    pub source: Option<MarkSource>,
+    /// Pictures: size relative to the page (1.0 fits the page).
+    pub scale: f64,
+}
+
+impl Default for Background {
+    fn default() -> Self {
+        Self { color: [1.0, 1.0, 0.85], opacity: 1.0, source: None, scale: 1.0 }
+    }
+}
+
+/// Drawing a picture mark: fitted to the page at `scale`, centred (plus `offset`), turned by
+/// `rotation` degrees. Returns the content and the resource name it uses.
+pub(crate) fn picture(src: &MarkSource, page: (f64, f64), scale: f64, rotation: f64, offset: [f64; 2]) -> String {
+    let (w, h) = page;
+    let (sw, sh) = (src.size.0.max(0.01), src.size.1.max(0.01));
+    let k = (w / sw).min(h / sh) * if scale.is_finite() && scale > 0.0 { scale } else { 1.0 };
+    let (dw, dh) = (sw * k, sh * k);
+    let (s, c) = rotation.to_radians().sin_cos();
+    let (cx, cy) = (w / 2.0 + offset[0], h / 2.0 + offset[1]);
+    // Centre, rotate, then place the picture's box (unit square for images).
+    let place = if src.image {
+        format!("{} 0 0 {} {} {} cm", n(dw), n(dh), n(-dw / 2.0), n(-dh / 2.0))
+    } else {
+        format!("{} 0 0 {} {} {} cm", n(k), n(k), n(-dw / 2.0), n(-dh / 2.0))
+    };
+    format!("{} {} {} {} {} {} cm\n{place}\n/PCPic{} Do\n", n(c), n(s), n(-s), n(c), n(cx), n(cy), src.xobject.num)
+}
+
+/// Register a mark picture in the page's own resources (`/PCPic<num>`).
+pub(crate) fn add_picture_resource(doc: &mut Document, page: &pdfcraft_model::Page, src: &MarkSource) -> Result<(), EditError> {
+    let p = doc.get(page.obj).as_dict().cloned().unwrap_or_default();
+    let mut res = p.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let mut xo = res.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+    xo.set(format!("PCPic{}", src.xobject.num).into_bytes(), Object::Ref(src.xobject));
+    res.set(b"XObject".to_vec(), Object::Dict(xo));
+    doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(res)))?;
+    Ok(())
+}
+
+/// Values tokens need that come from outside the document.
+#[derive(Clone, Debug, PartialEq, Default)]
+pub struct Context {
+    /// Today's date: (year, month 1–12, day 1–31).
+    pub date: (i64, u32, u32),
+}
+
+// Model-derived transforms can contain tiny scale factors; retain their PDF decimal precision.
+pub(crate) fn matrix_number(value: f64) -> String {
+    let mut bytes = Vec::new();
+    pdfcraft_cos::serialize(&Object::Real(value), &mut bytes);
+    String::from_utf8_lossy(&bytes).into_owned()
+}
+
+pub(crate) fn n(v: f64) -> String {
+    let s = format!("{:.3}", if v.abs() < 5e-4 { 0.0 } else { v });
+    let s = s.trim_end_matches('0').trim_end_matches('.');
+    if s == "-0" { "0".into() } else { s.into() }
+}
+
+pub(crate) fn rgb(c: Rgb) -> String {
+    let c = c.map(|x| x.clamp(0.0, 1.0));
+    format!("{} {} {} rg", n(c[0]), n(c[1]), n(c[2]))
+}
+
+const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+
+/// Expand `<<…>>` tokens for page `index` (0-based within the range) of `count`.
+pub fn expand(template: &str, page_number: u32, count: usize, bates: u64, cx: &Context) -> String {
+    let (y, m, d) = cx.date;
+    let mut out = String::new();
+    let mut rest = template;
+    while let Some(start) = rest.find("<<") {
+        out.push_str(&rest[..start]);
+        let after = &rest[start + 2..];
+        let Some(end) = after.find(">>") else {
+            out.push_str(&rest[start..]);
+            return out;
+        };
+        let token = &after[..end];
+        let p = page_number;
+        let value = match token {
+            "1" => p.to_string(),
+            "n" => count.to_string(),
+            "1 of n" => format!("{p} of {count}"),
+            "1/n" => format!("{p}/{count}"),
+            "Page 1" => format!("Page {p}"),
+            "Page 1 of n" => format!("Page {p} of {count}"),
+            "m/d" => format!("{m}/{d}"),
+            "m/d/yy" => format!("{m}/{d}/{:02}", y.rem_euclid(100)),
+            "m/d/yyyy" => format!("{m}/{d}/{y}"),
+            "mm/dd/yy" => format!("{m:02}/{d:02}/{:02}", y.rem_euclid(100)),
+            "mm/dd/yyyy" => format!("{m:02}/{d:02}/{y}"),
+            "d/m/yy" => format!("{d}/{m}/{:02}", y.rem_euclid(100)),
+            "d/m/yyyy" => format!("{d}/{m}/{y}"),
+            "dd/mm/yyyy" => format!("{d:02}/{m:02}/{y}"),
+            "d.m.yy" => format!("{d}.{m}.{:02}", y.rem_euclid(100)),
+            "d.m.yyyy" => format!("{d}.{m}.{y}"),
+            "dd.mm.yy" => format!("{d:02}.{m:02}.{:02}", y.rem_euclid(100)),
+            "dd.mm.yyyy" => format!("{d:02}.{m:02}.{y}"),
+            "yyyy-mm-dd" => format!("{y}-{m:02}-{d:02}"),
+            "yyyy/mm/dd" => format!("{y}/{m:02}/{d:02}"),
+            "yyyy/m/d" => format!("{y}/{m}/{d}"),
+            "mmmm d, yyyy" => format!("{} {d}, {y}", MONTHS[(m.clamp(1, 12) - 1) as usize]),
+            t if t.starts_with("Bates Number") => {
+                // Bates Number#digits#start#prefix#suffix (start is applied by the caller).
+                let parts: Vec<&str> = t.split('#').collect();
+                let digits = parts.get(1).and_then(|d| d.parse::<usize>().ok()).unwrap_or(6).clamp(1, 15);
+                format!("{}{:0digits$}{}", parts.get(3).unwrap_or(&""), bates, parts.get(4).unwrap_or(&""))
+            }
+            _ => format!("<<{token}>>"),
+        };
+        out.push_str(&value);
+        rest = &after[end + 2..];
+    }
+    out.push_str(rest);
+    out
+}
+
+/// The Bates start number in a template (`<<Bates Number#digits#start#…>>`), if any.
+pub(crate) fn bates_start(template: &str) -> Option<u64> {
+    let i = template.find("<<Bates Number")?;
+    let t = &template[i + 2..];
+    let t = &t[..t.find(">>")?];
+    t.split('#').nth(2).and_then(|s| s.parse().ok()).or(Some(1))
+}
diff --git a/crates/edit/src/place.rs b/crates/edit/src/place.rs
new file mode 100644
index 0000000000..b6d50a6462
--- /dev/null
+++ b/crates/edit/src/place.rs
@@ -0,0 +1,424 @@
+use super::marks::{MarkKind, matrix_number, n};
+use super::*;
+
+pub(crate) fn page_list(doc: &Document) -> Vec<pdfcraft_model::Page> {
+    pdfcraft_model::pages(doc)
+}
+
+pub(crate) fn check(pages: &[usize], count: usize) -> Result<(), EditError> {
+    match pages.iter().find(|p| **p >= count) {
+        Some(p) => Err(EditError::NoSuchPage(*p)),
+        None => Ok(()),
+    }
+}
+
+/// The page's `/Contents` as a list of stream references (inline content is promoted).
+pub(crate) fn contents(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<Vec<Object>, EditError> {
+    let obj = doc.get(page.obj);
+    let d = obj.as_dict().cloned().unwrap_or_default();
+    Ok(match d.get(b"Contents").cloned() {
+        None => Vec::new(),
+        Some(Object::Ref(r)) => match doc.get(r).as_array() {
+            Some(a) => a.clone(),
+            None => vec![Object::Ref(r)],
+        },
+        Some(Object::Array(a)) => a,
+        Some(other) => vec![Object::Ref(doc.add(other))],
+    })
+}
+
+/// Add the font (and an opacity state) to the page's own resources.
+pub(crate) fn add_resources(doc: &mut Document, page: &pdfcraft_model::Page, opacity: Option<f64>, content: Option<&[u8]>) -> Result<(), EditError> {
+    let mut faces: Vec<(Vec<u8>, &str)> = Vec::new();
+    for (name, base) in [(&b"PCHelv"[..], "Helvetica"), (b"PCTimes", "Times-Roman"), (b"PCCour", "Courier")] {
+        // Helvetica always (marks use it); the others only when the content names them.
+        if name != b"PCHelv" && !content.is_some_and(|c| c.windows(name.len() + 1).any(|w| w[0] == b'/' && &w[1..] == name)) {
+            continue;
+        }
+        faces.push((name.to_vec(), base));
+    }
+    add_page_resources(doc, page, opacity, &faces)
+}
+
+/// The fonts a page draws with: its own resources' or the ones it inherits.
+pub(crate) fn page_fonts(doc: &Document, page: &pdfcraft_model::Page) -> Dict {
+    let res = page.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default()
+}
+
+/// A name in `fonts` for the standard face `base` that can't take over a font the page already
+/// draws with: `preferred` when it is free or already names exactly the dictionary
+/// [`add_page_resources`] writes for that face, otherwise the first such `preferred_1`,
+/// `preferred_2`… (one of the first `fonts.len() + 1` always is). A font with anything more
+/// (`/ToUnicode`, `/Widths`…) is someone else's, even in the same face.
+pub(crate) fn free_font_name(doc: &Document, fonts: &Dict, preferred: &str, base: &str) -> String {
+    let usable = |name: &str| match fonts.get(name.as_bytes()) {
+        None => true,
+        Some(font) => doc.resolve(font).as_dict().is_some_and(|d| {
+            d.len() == 4
+                && d.name(b"Type") == Some(b"Font")
+                && d.name(b"Subtype") == Some(b"Type1")
+                && d.name(b"BaseFont") == Some(base.as_bytes())
+                && d.name(b"Encoding") == Some(b"WinAnsiEncoding")
+        }),
+    };
+    if usable(preferred) {
+        return preferred.to_string();
+    }
+    (1..=fonts.len().saturating_add(1)).map(|k| format!("{preferred}_{k}")).find(|name| usable(name)).unwrap_or_else(|| preferred.to_string())
+}
+
+/// Add the standard `faces` (resource name, base font) and an opacity state to the page's own
+/// resources.
+pub(crate) fn add_page_resources(
+    doc: &mut Document,
+    page: &pdfcraft_model::Page,
+    opacity: Option<f64>,
+    faces: &[(Vec<u8>, &str)],
+) -> Result<(), EditError> {
+    let mut res = page.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let mut fonts = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
+    for (name, base) in faces {
+        let mut font = Dict::new();
+        font.set(b"Type".to_vec(), Object::name("Font"));
+        font.set(b"Subtype".to_vec(), Object::name("Type1"));
+        font.set(b"BaseFont".to_vec(), Object::name(base));
+        font.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+        fonts.set(name.clone(), Object::Dict(font));
+    }
+    res.set(b"Font".to_vec(), Object::Dict(fonts));
+    if let Some(o) = opacity {
+        let mut gs = res.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
+        let mut s = Dict::new();
+        s.set(b"Type".to_vec(), Object::name("ExtGState"));
+        s.set(b"CA".to_vec(), Object::Real(o));
+        s.set(b"ca".to_vec(), Object::Real(o));
+        let name = format!("PCGS{}", (o * 100.0).round() as i64);
+        gs.set(name.into_bytes(), Object::Dict(s));
+        res.set(b"ExtGState".to_vec(), Object::Dict(gs));
+    }
+    // The page gets its own (possibly copied) resources; shared dictionaries stay untouched.
+    doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(res)))?;
+    Ok(())
+}
+
+pub(crate) const WRAP_OPEN: &[u8] = b"q %PdfCraft\n";
+
+/// Starts with an end of line, so a comment left open at the end of the content before it
+/// can't swallow the `Q`. Older files have the close without it.
+pub(crate) const WRAP_CLOSE: &[u8] = b"\nQ %PdfCraft\n";
+
+pub(crate) const OLD_WRAP_CLOSE: &[u8] = b"Q %PdfCraft\n";
+
+/// Whether `bytes` are a wrapper's close: canonical `EMC` closures, then the existing
+/// graphics closures. Legacy closes without the leading newline remain valid on their own.
+pub(crate) fn is_wrap_close(bytes: &[u8]) -> bool {
+    let mut rest = bytes;
+    while let Some(shorter) = rest.strip_prefix(b"\nEMC".as_slice()) {
+        rest = shorter;
+    }
+    let legacy = rest.len() == bytes.len();
+    loop {
+        if rest == WRAP_CLOSE || (legacy && rest == OLD_WRAP_CLOSE) {
+            return true;
+        }
+        match rest.strip_prefix(b"\nQ".as_slice()) {
+            Some(shorter) => rest = shorter,
+            None => return false,
+        }
+    }
+}
+
+/// A `Wrap`-tagged stream's role from its exact bytes: `Some(true)` for an open, `Some(false)`
+/// for a close.
+pub(crate) fn wrapper_role(doc: &Document, o: &Object) -> Option<bool> {
+    if stream_tag(doc, o).as_deref() != Some("Wrap") {
+        return None;
+    }
+    let Object::Stream(stream) = &*doc.resolve(o) else { return None };
+    // Wrappers are a few bytes; one that decodes to more isn't PdfCraft's.
+    let bytes = stream.decoded_within(64 * 1024).ok()?;
+    if bytes == WRAP_OPEN { Some(true) } else { is_wrap_close(&bytes).then_some(false) }
+}
+
+#[cfg(test)]
+pub(crate) fn stream_bytes(doc: &Document, o: &Object) -> Option<Vec<u8>> {
+    match &*doc.resolve(o) {
+        Object::Stream(s) => s.decoded().ok(),
+        _ => None,
+    }
+}
+
+/// The `/PCMark` tag in a content stream's dictionary: a mark kind, or `Wrap` for the q/Q
+/// wrapper. Read from the dictionary, so finding marks never decompresses page content.
+pub(crate) fn stream_tag(doc: &Document, o: &Object) -> Option<String> {
+    let obj = doc.resolve(o);
+    obj.as_dict()?.name(b"PCMark").map(|n| String::from_utf8_lossy(n).into_owned())
+}
+
+pub(crate) fn tagged(tag: &str) -> Dict {
+    let mut d = Dict::new();
+    d.set(b"PCMark".to_vec(), Object::name(tag));
+    d
+}
+
+/// What placing a mark on top needs, from the page's actual operators (not the `/PCMark` tags,
+/// which another writer may keep, copy or forge).
+pub(crate) enum Isolation {
+    /// The content parses cleanly with balanced `q`/`Q` and closed text objects and paths.
+    /// `suffix`: the stream from which the content leaves graphics state set (or a comment open)
+    /// that a mark on top must not inherit, so it needs a wrapper from there to the end.
+    /// `wrappers`: PdfCraft wrapper pairs (open, close) as stream indexes.
+    /// `marked`: unfinished marked-content sequences to close before a new mark.
+    Clean { suffix: Option<usize>, wrappers: Vec<(usize, usize)>, marked: usize },
+    /// The content could not be read that precisely (it doesn't decode, is too large, or has
+    /// stray bytes, unbalanced `q`/`Q` or an unfinished text object or path). `unclosed` is
+    /// the count of `q` left open at the end, when known. `marked` counts known unfinished
+    /// marked-content sequences independently of graphics malformation, or zero when unknown.
+    Unknown { unclosed: usize, marked: usize },
+    /// Marked content nests past [`ISOLATION_MAX_DEPTH`]: how many sequences a mark on top would
+    /// have to close (some may be hidden optional content) is unknown.
+    TooDeep,
+}
+
+const ISOLATION_MAX_STREAMS: usize = 100_000;
+
+const ISOLATION_MAX_BYTES: usize = 128 * 1024 * 1024;
+
+const ISOLATION_MAX_OPS: usize = 1_000_000;
+
+pub(crate) const ISOLATION_MAX_DEPTH: usize = 10_000;
+
+pub(crate) fn isolation(doc: &Document, list: &[Object]) -> Isolation {
+    let unknown = Isolation::Unknown { unclosed: 0, marked: 0 };
+    if list.len() > ISOLATION_MAX_STREAMS {
+        return unknown;
+    }
+    let mut remaining = ISOLATION_MAX_BYTES;
+    let mut data = Vec::with_capacity(list.len());
+    for object in list {
+        let resolved = doc.resolve(object);
+        let Object::Stream(stream) = &*resolved else { return unknown };
+        let Ok(bytes) = stream.decoded_within(remaining) else { return unknown };
+        let Some(left) = remaining.checked_sub(bytes.len().saturating_add(1)) else { return unknown };
+        remaining = left;
+        data.push(bytes);
+    }
+    let pieces = pdfcraft_content::Pieces::join(&data);
+    let parsed = pieces.parse();
+    if parsed.skipped != 0 || parsed.ops.len() > ISOLATION_MAX_OPS {
+        return unknown;
+    }
+    let edges = pieces.comment_edges(&parsed);
+    let (mut text_open, mut path_open, mut dirty, mut malformed) = (false, false, false, false);
+    let mut stack: Vec<usize> = Vec::new();
+    let (mut marked, mut marked_known) = (0usize, true);
+    let mut split = 0;
+    let mut previous_last = None;
+    let mut wrappers = Vec::new();
+    for op in &parsed.ops {
+        let (first, last) = pieces.pieces_of(op);
+        // A wrapper can only go in before a whole stream, outside graphics and marked-content
+        // scopes, between operators, where no comment would swallow the wrapper's `q`.
+        if stack.is_empty()
+            && marked_known
+            && marked == 0
+            && !text_open
+            && !path_open
+            && !dirty
+            && previous_last.is_none_or(|previous| first > previous)
+            && !edges.get(first).is_some_and(|edge| edge.0)
+        {
+            split = first;
+        }
+        previous_last = Some(last);
+        // Match the reader's tolerant operands: BMC uses the last name, BDC the last
+        // name/object pair, and EMC ignores surplus operands. Invalid begins are ignored.
+        let begin_marked = match op.op.as_slice() {
+            b"BMC" => op.operands.last().is_some_and(|o| matches!(o, Object::Name(_))),
+            b"BDC" => op.operands.len().checked_sub(2).and_then(|i| op.operands.get(i)).is_some_and(|o| matches!(o, Object::Name(_))),
+            _ => false,
+        };
+        if marked_known {
+            if begin_marked {
+                if marked < ISOLATION_MAX_DEPTH {
+                    marked += 1;
+                } else {
+                    // Once the budget is exceeded, later EMCs cannot restore a known depth.
+                    marked_known = false;
+                    marked = 0;
+                }
+            } else if op.is("EMC") {
+                marked = marked.saturating_sub(1);
+            }
+        }
+        match op.op.as_slice() {
+            b"BT" if !text_open => text_open = true,
+            b"ET" if text_open => text_open = false,
+            b"BT" | b"ET" => malformed = true,
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re" | b"W" | b"W*" => path_open = true,
+            b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => path_open = false,
+            _ => {}
+        }
+        match op.op.as_slice() {
+            b"q" if op.operands.is_empty() && stack.len() < ISOLATION_MAX_DEPTH => stack.push(first),
+            b"Q" if op.operands.is_empty() => match stack.pop() {
+                Some(open) => {
+                    // Only a standalone PdfCraft wrapper pair may later be removed again.
+                    let wrap = |i: usize| list.get(i).is_some_and(|o| stream_tag(doc, o).as_deref() == Some("Wrap"));
+                    if wrap(open)
+                        && wrap(first)
+                        && data.get(open).is_some_and(|d| d == WRAP_OPEN)
+                        && data.get(first).is_some_and(|d| is_wrap_close(d))
+                    {
+                        wrappers.push((open, first));
+                    }
+                }
+                None => malformed = true,
+            },
+            b"q" | b"Q" => malformed = true,
+            _ if stack.is_empty() => dirty = true,
+            _ => {}
+        }
+    }
+    if !marked_known {
+        return Isolation::TooDeep;
+    }
+    if malformed || text_open || path_open || !stack.is_empty() {
+        return Isolation::Unknown { unclosed: if malformed { 0 } else { stack.len() }, marked };
+    }
+    let comment_open = edges.last().is_some_and(|edge| edge.1);
+    Isolation::Clean { suffix: (dirty || comment_open || marked != 0).then_some(split), wrappers, marked }
+}
+
+/// Put a mark's content on a page: behind (with the behind-marks at the start) or on top
+/// (appended, after wrapping the original content in q/Q).
+pub(crate) fn place(doc: &mut Document, page: &pdfcraft_model::Page, kind: MarkKind, content: Vec<u8>, behind: bool) -> Result<(), EditError> {
+    place_tagged(doc, page, kind.tag(), content, behind).map(drop)
+}
+
+/// Put content on a page, tagged `tag` (see [`place`]). On top, whatever graphics state the
+/// content before leaves set (a `cm`, a clip, text state…) must not reach the mark, including
+/// content appended after an earlier PdfCraft wrapper by another tool (#3084): the stretch of
+/// content that leaves state set is wrapped in q/Q, once. Any known unfinished marked-content
+/// sequences are closed at the end too, so hidden optional content cannot hide the new mark; when
+/// their number is unknown, nothing is placed on top. Returns the new content stream.
+pub(crate) fn place_tagged(doc: &mut Document, page: &pdfcraft_model::Page, tag: &str, content: Vec<u8>, behind: bool) -> Result<ObjRef, EditError> {
+    let mut list = contents(doc, page)?;
+    // The behind-marks at the start: backgrounds in the order added, then watermarks.
+    let behind_kinds = [MarkKind::Background.tag(), MarkKind::Watermark.tag()];
+    let behind_marks = list.iter().take_while(|o| stream_tag(doc, o).is_some_and(|t| behind_kinds.contains(&t.as_str()))).count();
+    let wrap = if behind {
+        None
+    } else {
+        match isolation(doc, &list) {
+            Isolation::Clean { suffix, marked, .. } => suffix.map(|split| (split, 0, marked)),
+            // Content that can't be read precisely is wrapped whole, as before: after the
+            // behind-marks at the start. A `q` it leaves open is closed at its end, where
+            // closing it changes nothing already drawn.
+            Isolation::Unknown { unclosed, marked } => (behind_marks < list.len()).then_some((behind_marks, unclosed, marked)),
+            // Content left inside an optional-content sequence it cannot close could be hidden.
+            Isolation::TooDeep => return Err(too_deep_on_top()),
+        }
+    };
+    let mark_ref = doc.add(Object::Stream(Stream::flate(tagged(tag), &content)));
+    let mark = Object::Ref(mark_ref);
+    if behind {
+        // Right after the backgrounds already there, so a new background is painted over the
+        // older ones (#3591) and a watermark over all of them. Not after the watermarks: on a
+        // page with no content, one on top is at the start too and can't be told apart, so a
+        // newer watermark behind goes under the older ones.
+        let at = list.iter().take(behind_marks).rposition(|o| stream_tag(doc, o).as_deref() == Some(MarkKind::Background.tag())).map_or(0, |i| i + 1);
+        list.insert(at, mark);
+    } else {
+        if let Some((split, unclosed, marked)) = wrap {
+            let mut close_bytes = b"\nEMC".repeat(marked);
+            close_bytes.extend_from_slice(&b"\nQ".repeat(unclosed));
+            close_bytes.extend_from_slice(WRAP_CLOSE);
+            let open = Object::Ref(doc.add(Object::Stream(Stream::from_raw(tagged("Wrap"), WRAP_OPEN.to_vec()))));
+            let close = Object::Ref(doc.add(Object::Stream(Stream::from_raw(tagged("Wrap"), close_bytes))));
+            list.insert(split.min(list.len()), open);
+            list.push(close);
+        }
+        list.push(mark);
+    }
+    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    Ok(mark_ref)
+}
+
+fn too_deep_on_top() -> EditError {
+    EditError::Invalid("the page's marked content is nested too deeply to add anything on top of it".into())
+}
+
+/// The refusal [`place_tagged`] gives for a mark on top of `page`, checked before an edit changes
+/// anything (removing old marks, adding resources) so a refused edit leaves the document as it was.
+pub(crate) fn check_on_top(doc: &Document, page: &pdfcraft_model::Page) -> Result<(), EditError> {
+    let obj = doc.get(page.obj);
+    let list = match obj.as_dict().and_then(|d| d.get(b"Contents")) {
+        None => return Ok(()),
+        Some(Object::Ref(r)) => doc.get(*r).as_array().cloned().unwrap_or_else(|| vec![Object::Ref(*r)]),
+        Some(Object::Array(a)) => a.clone(),
+        Some(other) => vec![other.clone()],
+    };
+    match isolation(doc, &list) {
+        Isolation::TooDeep => Err(too_deep_on_top()),
+        _ => Ok(()),
+    }
+}
+
+/// Put content tagged `tag` first inside the q/Q wrapper, so it applies to the page's original
+/// content and nothing else (a header's shrink). A page without a wrapper has no original content
+/// on it and is left alone.
+pub(crate) fn place_inside_wrapper(doc: &mut Document, page: &pdfcraft_model::Page, tag: &str, content: Vec<u8>) -> Result<(), EditError> {
+    let mut list = contents(doc, page)?;
+    let Some(open) = list.iter().position(|o| stream_tag(doc, o).as_deref() == Some("Wrap")) else { return Ok(()) };
+    let stream = Object::Ref(doc.add(Object::Stream(Stream::flate(tagged(tag), &content))));
+    list.insert(open + 1, stream);
+    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    Ok(())
+}
+
+/// Draw `content` on top of a page (0-based) as permanent page content, with standard Helvetica
+/// available as `/PCHelv`. The stream is tagged `tag` (not a mark kind, so Remove never takes
+/// it away); the original content is wrapped in q/Q first. Used for applied redaction boxes.
+/// Returns the new content stream.
+pub fn stamp(doc: &mut Document, page: usize, tag: &str, content: Vec<u8>) -> Result<ObjRef, EditError> {
+    let all = page_list(doc);
+    check(&[page], all.len())?;
+    check_on_top(doc, &all[page])?;
+    add_resources(doc, &all[page], None, Some(&content))?;
+    let p = page_list(doc).swap_remove(page);
+    place_tagged(doc, &p, tag, content, false)
+}
+
+pub(crate) fn begin(kind: MarkKind, subtype: &str, matrix: [f64; 6]) -> String {
+    format!(
+        "q\n/Artifact <</Type /Pagination /Subtype /{subtype} /PCMark /{}>> BDC\n{} {} {} {} {} {} cm\n",
+        kind.tag(),
+        matrix_number(matrix[0]),
+        matrix_number(matrix[1]),
+        matrix_number(matrix[2]),
+        matrix_number(matrix[3]),
+        matrix_number(matrix[4]),
+        matrix_number(matrix[5])
+    )
+}
+
+pub(crate) const END: &str = "EMC\nQ\n";
+
+/// The refusal for page text with `c`, which nothing here can draw.
+pub(crate) fn undrawable(c: char) -> EditError {
+    EditError::Invalid(undrawable_message(c))
+}
+
+/// The wording of the refusal for text with `c`, which the standard fonts can't draw.
+pub fn undrawable_message(c: char) -> String {
+    format!("the standard fonts can't draw \"{c}\" (U+{:04X}); only Western European characters can be added as text for now", u32::from(c))
+}
+
+pub(crate) fn text_op(x: f64, y: f64, text: &str) -> Vec<u8> {
+    let mut v = format!("1 0 0 1 {} {} Tm ", n(x), n(y)).into_bytes();
+    v.extend(literal(&win_ansi(text)));
+    v.extend_from_slice(b" Tj\n");
+    v
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 3ad46e8643..0f8adc6514 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -75,6 +75,31 @@ fn an_image_turns_by_any_angle_about_its_centre_and_saves_the_matrix() {
     assert!(images::turn_by_degrees(r0, f64::NAN).is_none() && images::turn_by_degrees(r0, f64::INFINITY).is_none());
 }
 
+#[test]
+fn an_added_image_crop_keeps_some_of_each_axis() {
+    use crate::added::AddedImage;
+    assert!(AddedImage::crop_valid([0.7, 0.0, 0.0, 0.95]));
+    assert!(AddedImage::crop_valid([0.5, 0.45, 0.45, 0.5]));
+    // 0.05 + 0.9 rounds to just above 0.95: still the 5 % kept, accepted and left as it is.
+    assert!(AddedImage::crop_valid([0.05, 0.0, 0.9, 0.0]));
+    assert_eq!(AddedImage::clamp_crop([0.05, 0.0, 0.9, 0.0]), [0.05, 0.0, 0.9, 0.0]);
+    assert!(!AddedImage::crop_valid([0.06, 0.0, 0.9, 0.0]), "more than 95 % across");
+    assert!(!AddedImage::crop_valid([0.6, 0.0, 0.4, 0.0]), "nothing left across");
+    assert!(!AddedImage::crop_valid([-0.1, 0.0, 0.0, 0.0]));
+    assert!(!AddedImage::crop_valid([f64::NAN, 0.0, 0.0, 0.0]));
+    assert_eq!(AddedImage::clamp_crop([0.7, 0.0, 0.0, 0.0]), [0.7, 0.0, 0.0, 0.0], "a valid crop stays as it is");
+    // From a file: too much across keeps the two sides' proportion; nonsense trims nothing.
+    let [l, b, r, t] = AddedImage::clamp_crop([0.6, f64::INFINITY, 0.6, -1.0]);
+    assert!((l - 0.475).abs() < 1e-12 && (r - 0.475).abs() < 1e-12 && b == 0.0 && t == 0.0);
+    // Sides beyond the whole image keep their proportion too, and huge ones don't overflow.
+    let [l, _, r, _] = AddedImage::clamp_crop([1.5, 0.0, 0.5, 0.0]);
+    assert!((l - 0.7125).abs() < 1e-12 && (r - 0.2375).abs() < 1e-12, "{l} {r}");
+    let [l, _, r, _] = AddedImage::clamp_crop([f64::MAX, 0.0, f64::MAX, 0.0]);
+    assert!((l - 0.475).abs() < 1e-12 && (r - 0.475).abs() < 1e-12, "{l} {r}");
+    let [l, _, r, _] = AddedImage::clamp_crop([1.5, 0.0, 0.0, 0.0]);
+    assert!((l - 0.95).abs() < 1e-12 && r == 0.0, "one side alone is capped at the limit");
+}
+
 #[test]
 fn tokens_expand() {
     let c = cx();
@@ -82,6 +107,7 @@ fn tokens_expand() {
     assert_eq!(expand("<<1 of n>> · <<Page 1>> · <<1/n>>", 2, 5, 0, &c), "2 of 5 · Page 2 · 2/5");
     assert_eq!(expand("<<m/d/yyyy>> <<yyyy-mm-dd>> <<mmmm d, yyyy>>", 1, 1, 0, &c), "10/1/2026 2026-10-01 October 1, 2026");
     assert_eq!(expand("<<yyyy/mm/dd>> <<yyyy/m/d>>", 1, 1, 0, &c), "2026/10/01 2026/10/1");
+    assert_eq!(expand("<<dd.mm.yyyy>> <<d.m.yyyy>> <<dd.mm.yy>> <<d.m.yy>>", 1, 1, 0, &c), "01.10.2026 1.10.2026 01.10.26 1.10.26");
     assert_eq!(expand("<<Bates Number#6#100#ABC#-X>>", 1, 1, 104, &c), "ABC000104-X");
     assert_eq!(expand("keep <<unknown>> and <<unclosed", 1, 1, 0, &c), "keep <<unknown>> and <<unclosed");
     assert_eq!(bates_start("x <<Bates Number#6#100#A#B>>"), Some(100));
@@ -983,6 +1009,28 @@ fn added_text_and_images_are_page_content_that_stays_editable() {
     assert!(marks_present(&doc).is_empty());
 }
 
+/// #4464: a page left with one added item draws that item and nothing else.
+#[test]
+fn an_isolated_item_is_all_that_is_left_on_its_page() {
+    let mut doc = fixture();
+    let first = AddedText { rect: [72.0, 600.0, 300.0, 700.0], text: "First".into(), size: 14.0, ..AddedText::default() };
+    let second = AddedText { rect: [72.0, 400.0, 300.0, 500.0], text: "Second".into(), ..first.clone() };
+    add_content(&mut doc, 0, &Content::Text(first)).unwrap();
+    add_content(&mut doc, 0, &Content::Text(second)).unwrap();
+    let before = streams(&doc, 0).join("\n");
+    assert!(before.contains("(First) Tj") && before.contains("(Second) Tj"), "{before}");
+    assert!(isolate_content(&mut doc, 0, 2).is_err(), "no third item");
+    assert!(isolate_content(&mut doc, 9, 0).is_err(), "no such page");
+    let page = pdfcraft_model::pages(&doc).swap_remove(0);
+    doc.update_dict(page.obj, |d| d.set(b"Annots".to_vec(), Object::Array(Vec::new()))).unwrap();
+    isolate_content(&mut doc, 0, 1).unwrap();
+    let after = streams(&doc, 0).join("\n");
+    assert!(after.contains("(Second) Tj") && !after.contains("(First) Tj"), "{after}");
+    let page = pdfcraft_model::pages(&doc).swap_remove(0);
+    assert!(page.dict.get(b"Annots").is_none(), "no annotations are drawn over it");
+    assert_eq!(list_added(&doc).len(), 1);
+}
+
 /// Edit ▸ Paste (#2636): where a pasted item lands.
 #[test]
 fn a_paste_lands_where_the_copy_was_offset_per_paste_and_stays_on_the_page() {
@@ -4978,6 +5026,40 @@ fn cropped_image_resizing_moves_private_clips_and_keeps_shared_ones() {
     assert_eq!(text::text_lines(&doc, 0).unwrap().len(), 1);
 }
 
+/// Report generators draw each picture as `q re W n cm Do Q` inside a section's clip that the
+/// section's text shares. Resizing the picture scales its own clip with it (the enlarged picture
+/// used to show only through its old box) while the section's clip and text stay put.
+#[test]
+fn resizing_an_image_under_a_shared_clip_moves_its_own_clip() {
+    // The picture's own clip as wide as the picture, and wider (both seen in one report).
+    for clip_width in [61.2, 85.0] {
+        let mut doc = image_page_with(&format!(
+            "q 20 20 560 760 re W n q 162 79 {clip_width} 28.3 re W n 61.2 0 0 28.3 162 79 cm /Im0 Do Q BT /F1 12 Tf 30 50 Td (Section text) Tj ET Q"
+        ));
+        let before = images::page_images(&doc, 0).unwrap()[0].clone();
+        assert!(close(before.visible_rect.unwrap(), [162.0, 79.0, 223.2, 107.3]), "{:?}", before.visible_rect);
+        let caption = text::text_lines(&doc, 0).unwrap();
+        let target = [162.0, 79.0, 284.4, 135.6];
+        let transform = images::rect_to_rect(before.visible_rect.unwrap(), target);
+        images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(transform)).unwrap();
+        doc = reopen(&doc);
+        let after = images::page_images(&doc, 0).unwrap()[0].clone();
+        let near = |a: [f64; 4], b: [f64; 4]| a.iter().zip(b).all(|(x, y)| (x - y).abs() < 0.05);
+        assert!(near(after.visible_rect.unwrap(), target), "clip {clip_width}: the whole enlarged picture shows, {:?}", after.visible_rect);
+        assert_eq!(after.object, before.object, "pixels are never resampled or replaced");
+        assert_eq!(
+            text::text_lines(&doc, 0).unwrap().iter().map(|l| (&l.text, l.rect, l.baseline())).collect::<Vec<_>>(),
+            caption.iter().map(|l| (&l.text, l.rect, l.baseline())).collect::<Vec<_>>(),
+            "the section's text stays where it was"
+        );
+        // The section's clip is shared, so it still bounds the picture: past it, nothing shows.
+        let past = images::rect_to_rect(after.visible_rect.unwrap(), [500.0, 79.0, 700.0, 135.6]);
+        images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(past)).unwrap();
+        let clipped = images::page_images(&reopen(&doc), 0).unwrap()[0].visible_rect.unwrap();
+        assert!(clipped[2] <= 580.05, "the section's clip stays in force: {clipped:?}");
+    }
+}
+
 #[test]
 fn private_image_crop_with_intervening_state_resizes_across_streams() {
     let variants: Vec<Vec<&[u8]>> = vec![
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 55f2e7ad17..eb45209353 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -27,6 +27,40 @@ mod session;
 use regions::{group_blocks, is_centred, rewrite_styled_block};
 pub use session::TextSession;
 
+mod blocks;
+mod editor;
+mod fallback;
+mod interp;
+mod lines;
+mod rewrite;
+
+use blocks::paragraph_separator;
+#[cfg(test)]
+use blocks::wrap;
+pub use blocks::{
+    BlockKey, BlockStyle, RangeStyle, ReadingBlocks, TextBlock, block_overlapping, clear_block, reading_blocks, reading_blocks_checked,
+    replace_block, text_blocks,
+};
+use editor::layout_draft;
+pub use editor::{TextEditLayout, TextEditorFont, register_text_font, text_edit_layout, text_editor_fonts};
+#[cfg(test)]
+pub(crate) use fallback::SOURCE_SPACE_CALLS;
+use fallback::{
+    MAX_TYPE3_GLYPHS, Type3Glyph, fallback_face, needs_type3, no_fallback_font, no_glyph_for, same_base_font, same_font, source_encodes,
+    source_family, source_program, source_show, source_space, source_width, strip_subset_tag, type3_faces, type3_glyph, write_type3_glyphs,
+};
+#[cfg(test)]
+use fallback::{add_type3_font, is_type3_fallback};
+use interp::{Origin, Paint, union};
+use lines::page_dict;
+pub(crate) use lines::{FormBudget, content_streams, content_streams_within, form_call, rewritten_contents, splice};
+pub use lines::{MAX_FORM_DEPTH, MAX_FORM_VISITS, glyph_text_lines, text_lines};
+pub use rewrite::{LineEdit, replace_line, rewrite_block};
+use rewrite::{coincident_ops, rewrite_block_from};
+#[cfg(test)]
+pub(crate) use rewrite::{replace_line_with_limit, rewrite_block_with_limit};
+pub(crate) use rewrite::{reveal_ops, selectable_blocks, translate_blocks};
+
 /// One line of existing text.
 #[derive(Clone, Debug, PartialEq)]
 pub struct TextLine {
@@ -103,3426 +137,6 @@ impl TextLine {
     }
 }
 
-/// An embedded sfnt source face, read only for the inline editor. Bytes stay in memory and
-/// are never installed, copied into assets, or used as a font for another document.
-#[derive(Clone, Debug)]
-pub struct TextEditorFont {
-    pub resource: String,
-    pub face: String,
-    pub bytes: Vec<u8>,
-}
-
-pub fn text_editor_fonts(doc: &Document, page: usize) -> Result<Vec<TextEditorFont>, EditError> {
-    let p = page_dict(doc, page)?;
-    let resources = p.dict.get(b"Resources").and_then(|o| doc.dict(o)).unwrap_or_default();
-    let fonts = resources.get(b"Font").and_then(|o| doc.dict(o)).unwrap_or_default();
-    let mut budget = 32_usize << 20;
-    // Every program decoded counts, usable or not, so aliases of one program can't repeat the work.
-    let mut decode = DecodeBudget::new(2 * budget, 0);
-    let mut result = Vec::new();
-    for (name, font) in fonts.iter().take(128) {
-        let Some(font) = doc.dict(font) else { continue };
-        let Some(bytes) = pdfcraft_fonts::pdf::embedded_sfnt_within(doc, &font, &mut decode) else { continue };
-        if bytes.len() > budget {
-            continue;
-        }
-        budget -= bytes.len();
-        result.push(TextEditorFont {
-            resource: String::from_utf8_lossy(name).into_owned(),
-            face: Metrics::from_dict(doc, &font).base_font.rsplit('+').next().unwrap_or_default().to_owned(),
-            bytes,
-        });
-    }
-    // The approved full face follows all source subsets in the editor's font stack. It can
-    // display newly inserted glyphs before Apply without changing the source text's face.
-    let source_faces: Vec<_> = result.iter().map(|p| p.face.clone()).collect();
-    for face in source_faces {
-        for full in pdfcraft_fonts::embedding::matching_faces(&face) {
-            if full.bytes.len() > budget || result.iter().any(|p| p.resource == format!("PCApproved{}", full.name())) {
-                continue;
-            }
-            budget -= full.bytes.len();
-            result.push(TextEditorFont { resource: format!("PCApproved{}", full.name()), face: face.clone(), bytes: full.bytes.to_vec() });
-        }
-    }
-    Ok(result)
-}
-
-/// Load an explicit full face into this page's resources. Nothing on the page is replaced;
-/// the new resource can complete matching source subsets or be chosen in a text style.
-pub fn register_text_font(doc: &mut Document, page: usize, bytes: &[u8]) -> Result<String, EditError> {
-    pdfcraft_fonts::embedding::validate_document_input(bytes).map_err(EditError::Invalid)?;
-    let (_, postscript) = pdfcraft_fonts::embedding::names(bytes).map_err(EditError::Invalid)?;
-    let p = page_dict(doc, page)?;
-    let mut resources = p.dict.get(b"Resources").and_then(|o| doc.dict(o)).unwrap_or_default();
-    let mut fonts = resources.get(b"Font").and_then(|o| doc.dict(o)).unwrap_or_default();
-    let name = pdfcraft_fonts::embedding::embed(doc, &mut fonts, bytes, &postscript).map_err(EditError::Invalid)?;
-    resources.set(b"Font".to_vec(), Object::Dict(fonts));
-    doc.update_dict(p.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources)))?;
-    Ok(name)
-}
-
-/// Read-only draft bounds, measured with the same PDF rewrite used by Apply/Save.
-#[derive(Clone, Debug, PartialEq)]
-pub struct TextEditLayout {
-    pub source_rect: [f64; 4],
-    pub draft_rect: Option<[f64; 4]>,
-    pub overflow: bool,
-}
-
-pub fn text_edit_layout(doc: &Document, page: usize, block: usize, text: &str, style: &BlockStyle) -> Result<TextEditLayout, EditError> {
-    TextSession::open(doc, page, block)?.layout(text, style)
-}
-
-/// A draft of paragraph `source` (number `block` among the page's `lines`) laid out by the rewrite
-/// Apply runs, on a copy of `doc`.
-fn layout_draft(
-    doc: &Document,
-    page: usize,
-    lines: &[TextLine],
-    source: &TextBlock,
-    block: usize,
-    text: &str,
-    style: &BlockStyle,
-) -> Result<TextEditLayout, EditError> {
-    if text == source.editor_text && *style == BlockStyle::default() {
-        return Ok(TextEditLayout { source_rect: source.rect, draft_rect: Some(source.rect), overflow: false });
-    }
-    // Subtract the untouched runs by value, rather than by operator offsets: a rewrite may
-    // split BT/ET or add font resources. A multiset also handles coincident repeated text.
-    let key =
-        |line: &TextLine| (line.text.clone(), line.font.clone(), line.rect.map(f64::to_bits), line.size.to_bits(), line.color.map(f64::to_bits));
-    let mut untouched = std::collections::BTreeMap::new();
-    for (index, line) in lines.iter().enumerate() {
-        if !source.lines.contains(&index) {
-            *untouched.entry(key(line)).or_insert(0_usize) += 1;
-        }
-    }
-    let mut draft = doc.clone();
-    rewrite_block_from(&mut draft, page, lines.to_vec(), block, Some(text), style, MAX_TYPE3_GLYPHS)?;
-    let mut rect: Option<[f64; 4]> = None;
-    for line in text_lines(&draft, page)? {
-        if let Some(count) = untouched.get_mut(&key(&line))
-            && *count > 0
-        {
-            *count -= 1;
-            continue;
-        }
-        // Spaces typed after a row's last word are drawn but show nothing, so an upright row is
-        // measured to the end of its last word: they don't make a draft overflow (#4199).
-        let mut r = line.rect;
-        if line.upright() && !line.ink.is_empty() {
-            if crate::bidi::rtl_base(&line.text) {
-                r[0] = r[0].max(line.ink.iter().map(|i| i[0]).fold(f64::INFINITY, f64::min));
-            } else {
-                r[2] = r[2].min(line.ink.iter().map(|i| i[2]).fold(f64::NEG_INFINITY, f64::max));
-            }
-        }
-        rect = Some(rect.map_or(r, |a| [a[0].min(r[0]), a[1].min(r[1]), a[2].max(r[2]), a[3].max(r[3])]));
-    }
-    let overflow = rect
-        .is_some_and(|r| r[0] < source.rect[0] - 0.5 || r[1] < source.rect[1] - 0.5 || r[2] > source.rect[2] + 0.5 || r[3] > source.rect[3] + 0.5);
-    Ok(TextEditLayout { source_rect: source.rect, draft_rect: rect, overflow })
-}
-
-/// Text and graphics state captured for rewriting.
-#[derive(Clone, Debug, PartialEq)]
-struct TextState {
-    font: Option<(String, f64)>,
-    char_spacing: f64,
-    word_spacing: f64,
-    scale: f64,
-    leading: f64,
-    rise: f64,
-    fill: Vec<Op>,
-    /// The text rendering mode (`Tr`); 3 is invisible text, as in an OCR layer over a scan.
-    render_mode: i64,
-    /// The stroke colour operators, the line width and the ExtGStates selected (see [`Ts`]):
-    /// graphics state the text was painted with that [`TextState::ops`] doesn't restate.
-    stroke: Vec<Op>,
-    line_width: Option<f64>,
-    ext_gstate: Vec<Vec<u8>>,
-    /// The dash pattern and line cap in force (see [`Ts`]): compared, not restated.
-    dash: Dash,
-    line_cap: i64,
-}
-
-impl TextState {
-    fn of(ts: &Ts) -> Self {
-        TextState {
-            font: ts.font.as_ref().map(|(n, _)| (String::from_utf8_lossy(n).into_owned(), ts.size)),
-            char_spacing: ts.char_spacing,
-            word_spacing: ts.word_spacing,
-            scale: ts.scale,
-            leading: ts.leading,
-            rise: ts.rise,
-            fill: ts.fill.clone(),
-            render_mode: ts.render_mode,
-            stroke: ts.stroke.clone(),
-            line_width: ts.line_width,
-            ext_gstate: ts.ext_gstate.clone(),
-            dash: ts.dash.clone(),
-            line_cap: ts.line_cap,
-        }
-    }
-
-    /// Operators that change how text is painted from `current` (the state where they run) to
-    /// this one: the ExtGStates, stroke colour, line width and a visible rendering mode. A
-    /// rewritten paragraph is drawn before its text object, so whatever that object set before
-    /// its first show (`/GS1 gs`, `1 Tr 1 0 0 RG 2 w` inside `BT`, #3508/#3509) must be stated
-    /// again. Empty when nothing differs.
-    ///
-    /// Only fill, stroke and fill-then-stroke (`Tr` 0–2) are restated: invisible text is revealed
-    /// by [`reveal_ops`] and clipping text is refused, so neither is ever drawn this way.
-    ///
-    /// A `gs` has no inverse, so a selection `current` has and this state doesn't stays in force:
-    /// run these inside a `q`/`Q` that starts from `current`, one per state drawn.
-    fn paint_ops(&self, current: &TextState) -> Vec<Op> {
-        let n = pdfcraft_content::num;
-        let mut v = Vec::new();
-        // The selections both share stay in force; the ones after them are selected again in order.
-        let shared = self.ext_gstate.iter().zip(&current.ext_gstate).take_while(|(a, b)| a == b).count();
-        for name in self.ext_gstate.iter().skip(shared) {
-            v.push(Op::new("gs", vec![Object::Name(name.clone())]));
-        }
-        // A reselected ExtGState may set `/LW`, so the width (already the effective one) follows it.
-        let reselected = !v.is_empty();
-        if self.stroke != current.stroke {
-            if self.stroke.is_empty() {
-                // The initial stroke colour: black in DeviceGray.
-                v.push(Op::new("G", vec![n(0.0)]));
-            } else {
-                v.extend(self.stroke.iter().cloned());
-            }
-        }
-        let width = self.line_width.unwrap_or(1.0);
-        if reselected || width != current.line_width.unwrap_or(1.0) {
-            v.push(Op::new("w", vec![n(width)]));
-        }
-        if (0..=2).contains(&self.render_mode) && self.render_mode != current.render_mode {
-            v.push(Op::new("Tr", vec![Object::Int(self.render_mode)]));
-        }
-        v
-    }
-
-    /// Operators that set this state (inside a text object).
-    fn ops(&self) -> Vec<Op> {
-        let n = pdfcraft_content::num;
-        let mut v = Vec::new();
-        if let Some((f, size)) = &self.font {
-            v.push(Op::new("Tf", vec![Object::name(f), n(*size)]));
-        }
-        v.push(Op::new("Tc", vec![n(self.char_spacing)]));
-        v.push(Op::new("Tw", vec![n(self.word_spacing)]));
-        v.push(Op::new("Tz", vec![n(self.scale * 100.0)]));
-        v.push(Op::new("TL", vec![n(self.leading)]));
-        v.push(Op::new("Ts", vec![n(self.rise)]));
-        v.extend(self.fill.iter().cloned());
-        v
-    }
-}
-
-/// What a run is drawn in beyond its text state: the optional content groups of the `/OC`
-/// marked-content sequences around it, and the effective graphics state parameters (`gs`) in
-/// force. A rewrite writes a paragraph in its first run's place, so runs that differ here are
-/// never joined: one in a hidden layer or at another opacity would lose it.
-#[derive(Clone, Debug, Default, PartialEq)]
-struct Paint {
-    layers: Vec<Vec<u8>>,
-    gs: Gs,
-}
-
-/// The transparency parameters of the graphics state: what the `gs` operators have set, resolved,
-/// so a repeated `gs` or two names with the same settings leave it as it was.
-#[derive(Clone, Debug, PartialEq)]
-struct Gs {
-    /// `ca`, the fill opacity.
-    fill_alpha: f64,
-    /// `CA`, the stroke opacity.
-    stroke_alpha: f64,
-    /// `BM`, the blend mode (`Compatible` is `Normal`).
-    blend: Vec<u8>,
-    /// `SMask`, when it is not `None`: the reference of an indirect soft mask, else the dictionary.
-    soft_mask: Option<Object>,
-}
-
-impl Default for Gs {
-    fn default() -> Self {
-        Gs { fill_alpha: 1.0, stroke_alpha: 1.0, blend: b"Normal".to_vec(), soft_mask: None }
-    }
-}
-
-impl Gs {
-    /// Applies the parameters a graphics state parameter dictionary sets; the others stay.
-    fn apply(&mut self, doc: &Document, params: &Dict) {
-        let num = |key: &[u8]| params.get(key).and_then(|o| doc.resolve(o).as_f64()).filter(|v| v.is_finite());
-        if let Some(v) = num(b"ca") {
-            self.fill_alpha = v;
-        }
-        if let Some(v) = num(b"CA") {
-            self.stroke_alpha = v;
-        }
-        if let Some(bm) = params.get(b"BM").map(|o| doc.resolve(o)) {
-            let first = bm
-                .as_name()
-                .map(<[u8]>::to_vec)
-                .or_else(|| bm.as_array().and_then(|a| a.iter().find_map(|o| doc.resolve(o).as_name().map(<[u8]>::to_vec))));
-            if let Some(name) = first {
-                self.blend = if name == b"Compatible" { b"Normal".to_vec() } else { name };
-            }
-        }
-        if let Some(mask) = params.get(b"SMask") {
-            self.soft_mask = match (mask.as_ref(), &*doc.resolve(mask)) {
-                (_, Object::Name(_)) => None,
-                (Some(r), _) => Some(Object::Ref(r)),
-                (None, Object::Dict(d)) => Some(Object::Dict(d.clone())),
-                (None, _) => None,
-            };
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq)]
-struct Origin {
-    tm: [f64; 6],
-    /// The text line matrix there (where the next line's Td/T* starts from).
-    tlm: [f64; 6],
-    /// Text-space units → user space (the scale of the text rendering matrix's y axis).
-    k: f64,
-    /// The CTM there (current space → page space), for moving the paragraph in page space.
-    ctm: [f64; 6],
-    baseline: f64,
-    x: f64,
-    state: TextState,
-    bt_op: usize,
-    bt_state: TextState,
-}
-
-/// An editable text region: adjacent runs on visual rows, followed by aligned rows.
-/// A region may contain several source fonts, sizes, colours and weights.
-#[derive(Clone, Debug, PartialEq)]
-pub struct TextBlock {
-    /// The lines' text joined with spaces (lines that ended in a hyphen are joined directly).
-    pub text: String,
-    pub rect: [f64; 4],
-    pub base_font: String,
-    pub size: f64,
-    pub bold: bool,
-    pub italic: bool,
-    /// The text fill colour as RGB, used by the visual editor and preserved when no colour
-    /// override is requested.
-    pub color: [f64; 3],
-    /// Counterclockwise baseline angle in page user space, in degrees.
-    pub rotation: f64,
-    /// Indexes into [`text_lines`].
-    pub lines: Vec<usize>,
-    /// Visual rows; each contains indexes into [`text_lines`], including mixed-style runs.
-    pub rows: Vec<Vec<usize>>,
-    /// Text for the inline editor, with a newline only between visual rows.
-    pub editor_text: String,
-    /// Byte ranges in `editor_text` and their source line indexes.
-    pub spans: Vec<(std::ops::Range<usize>, usize)>,
-    /// Every line is invisible text (rendering mode 3): an OCR layer over a scanned image, whose
-    /// pixels show the words. A rewrite draws the new text visibly (see [`BlockStyle::cover`]).
-    pub invisible: bool,
-}
-
-impl TextBlock {
-    /// Preserve styles outside the changed ranges; inserted characters inherit the surrounding
-    /// source run. The texts are aligned word by word, so words left untouched between two edits
-    /// keep their own runs (#2198); past [`MAX_CHANGED_WORDS`] the draft counts as one change.
-    /// Byte ranges are always UTF-8 boundaries. Linear time, including large edits.
-    pub fn edited_spans(&self, draft: &str) -> Vec<(std::ops::Range<usize>, usize)> {
-        if self.editor_text.len() > 4_000_000 || draft.len() > 4_000_000 {
-            return vec![(0..draft.len(), self.lines.first().copied().unwrap_or(0))];
-        }
-        let old: Vec<_> = self.editor_text.chars().collect();
-        let new: Vec<_> = draft.char_indices().collect();
-        let chars: Vec<_> = new.iter().map(|(_, c)| *c).collect();
-        let mut original = Vec::with_capacity(old.len());
-        let mut span = 0;
-        for (byte, _) in self.editor_text.char_indices() {
-            while self.spans.get(span).is_some_and(|(r, _)| byte >= r.end) {
-                span += 1;
-            }
-            original.push(self.spans.get(span).or_else(|| self.spans.last()).map_or(0, |(_, i)| *i));
-        }
-        let mut sources = Vec::with_capacity(new.len());
-        let slices = |text: &[char]| words(text).into_iter().map(|w| text.get(w).unwrap_or_default().to_vec()).collect::<Vec<_>>();
-        let (old_words, new_words) = (slices(&old), slices(&chars));
-        match edit_script(&old_words, &new_words, MAX_CHANGED_WORDS) {
-            Some(script) => {
-                // `(o, n)`: where the current change starts in the old and new text; `(x, y)`: where it ends.
-                let ((mut o, mut n), (mut x, mut y)) = ((0, 0), (0, 0));
-                let (mut a, mut b) = (old_words.iter(), new_words.iter());
-                for step in script {
-                    match step {
-                        Step::Keep => {
-                            replaced(&original, o, old.get(o..x).unwrap_or_default(), chars.get(n..y).unwrap_or_default(), &mut sources);
-                            let len = a.next().map_or(0, Vec::len);
-                            b.next();
-                            sources.extend(original.get(x..x.saturating_add(len)).unwrap_or_default());
-                            (x, y) = (x.saturating_add(len), y.saturating_add(len));
-                            (o, n) = (x, y);
-                        }
-                        Step::Delete => x = x.saturating_add(a.next().map_or(0, Vec::len)),
-                        Step::Insert => y = y.saturating_add(b.next().map_or(0, Vec::len)),
-                    }
-                }
-                replaced(&original, o, old.get(o..x).unwrap_or_default(), chars.get(n..y).unwrap_or_default(), &mut sources);
-            }
-            None => replaced(&original, 0, &old, &chars, &mut sources),
-        }
-        let fallback = original.first().copied().unwrap_or(0);
-        let mut result: Vec<(std::ops::Range<usize>, usize)> = Vec::new();
-        for (i, (byte, ch)) in new.iter().enumerate() {
-            let source = sources.get(i).copied().unwrap_or(fallback);
-            let end = byte.saturating_add(ch.len_utf8());
-            if let Some((range, _)) = result.last_mut().filter(|(_, prev)| *prev == source) {
-                range.end = end;
-            } else {
-                result.push((*byte..end, source));
-            }
-        }
-        result
-    }
-}
-
-/// Changed words [`TextBlock::edited_spans`] aligns before it treats the draft as one change.
-/// Myers' diff costs O((N + M) · D), so bounding D keeps it linear.
-const MAX_CHANGED_WORDS: usize = 64;
-
-/// `text` split into words, each with the whitespace after it, as char ranges.
-fn words(text: &[char]) -> Vec<std::ops::Range<usize>> {
-    let mut out = Vec::new();
-    let mut start = 0;
-    for (i, pair) in text.windows(2).enumerate() {
-        if let [a, b] = pair
-            && a.is_whitespace()
-            && !b.is_whitespace()
-        {
-            out.push(start..i + 1);
-            start = i + 1;
-        }
-    }
-    if start < text.len() {
-        out.push(start..text.len());
-    }
-    out
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-enum Step {
-    Keep,
-    Delete,
-    Insert,
-}
-
-/// Myers' shortest edit script from `a` to `b`, or `None` when it takes more than `max` steps.
-fn edit_script<T: PartialEq>(a: &[T], b: &[T], max: usize) -> Option<Vec<Step>> {
-    let (n, m) = (a.len() as isize, b.len() as isize);
-    let max = max.min(a.len().saturating_add(b.len())) as isize;
-    // Furthest x reached on each diagonal k = x - y, stored at k + max + 1.
-    let at = |v: &[isize], k: isize| usize::try_from(k + max + 1).ok().and_then(|i| v.get(i).copied()).unwrap_or(0);
-    let mut v = vec![0isize; (2 * max + 3) as usize];
-    let mut trace = Vec::new();
-    for d in 0..=max {
-        trace.push(v.clone());
-        for k in (-d..=d).step_by(2) {
-            let down = k == -d || (k != d && at(&v, k - 1) < at(&v, k + 1));
-            let mut x = if down { at(&v, k + 1) } else { at(&v, k - 1) + 1 };
-            let mut y = x - k;
-            while x < n && y < m && a.get(x as usize) == b.get(y as usize) {
-                x += 1;
-                y += 1;
-            }
-            if let Some(slot) = usize::try_from(k + max + 1).ok().and_then(|i| v.get_mut(i)) {
-                *slot = x;
-            }
-            if x >= n && y >= m {
-                return Some(backtrack(&trace, n, m, max));
-            }
-        }
-    }
-    None
-}
-
-/// Walk Myers' saved frontiers back from the end to the edit script.
-fn backtrack(trace: &[Vec<isize>], n: isize, m: isize, max: isize) -> Vec<Step> {
-    let at = |v: &[isize], k: isize| usize::try_from(k + max + 1).ok().and_then(|i| v.get(i).copied()).unwrap_or(0);
-    let mut steps = Vec::new();
-    let (mut x, mut y) = (n, m);
-    for (d, v) in trace.iter().enumerate().rev() {
-        let (d, k) = (d as isize, x - y);
-        let prev_k = if k == -d || (k != d && at(v, k - 1) < at(v, k + 1)) { k + 1 } else { k - 1 };
-        let prev_x = at(v, prev_k);
-        let prev_y = prev_x - prev_k;
-        while x > prev_x && y > prev_y {
-            steps.push(Step::Keep);
-            x -= 1;
-            y -= 1;
-        }
-        if d > 0 {
-            steps.push(if x == prev_x { Step::Insert } else { Step::Delete });
-        }
-        (x, y) = (prev_x, prev_y);
-    }
-    steps.reverse();
-    steps
-}
-
-/// `old`, at char `at` of the source, became `new`: characters kept at either end keep their
-/// runs, and the rest inherit the run just before the change (or the first one it replaces).
-fn replaced(original: &[usize], at: usize, old: &[char], new: &[char], out: &mut Vec<usize>) {
-    let prefix = old.iter().zip(new).take_while(|(a, b)| a == b).count();
-    let suffix = old.iter().rev().zip(new.iter().rev()).take(old.len().min(new.len()).saturating_sub(prefix)).take_while(|(a, b)| a == b).count();
-    let start = at.saturating_add(prefix);
-    let inherited = start.checked_sub(1).and_then(|i| original.get(i)).or_else(|| original.get(start)).copied().unwrap_or(0);
-    for i in 0..new.len() {
-        let source = if i < prefix {
-            original.get(at.saturating_add(i)).copied()
-        } else if i >= new.len().saturating_sub(suffix) {
-            original.get(at.saturating_add(old.len()).saturating_sub(new.len() - i)).copied()
-        } else {
-            Some(inherited)
-        };
-        out.push(source.unwrap_or(inherited));
-    }
-}
-
-impl TextLine {
-    /// The baseline's height in user space.
-    pub fn origin_baseline(&self) -> f64 {
-        self.origin.baseline
-    }
-
-    /// Paint position of the line's first operator: `(content-stream index, operator index in
-    /// the page's joined stream)`. A line joins runs painted at different times, so anything
-    /// painted after this position may lie on top of part of it.
-    /// (Lines from `text_lines` never come from form XObjects, so `stream` is always a
-    /// page content-stream index and `ops` are indices into the joined operator list.)
-    pub fn first_paint_pos(&self) -> (usize, usize) {
-        (self.stream, self.ops.iter().min().copied().unwrap_or(0))
-    }
-
-    /// The runs of text the line joins, in content order: each run's text as its glyphs show it,
-    /// the boxes of its words (a part of `ink`), and whether joining put a space between it and
-    /// the run before (`text` has one there; runs closer together join with none, so one word
-    /// can span runs). None when the line's text was reordered for reading (right-to-left or
-    /// visual-order Indic text): then only the line's text as a whole says what it reads.
-    pub fn runs(&self) -> impl Iterator<Item = (&str, &[[f64; 4]], bool)> {
-        let mut start = 0;
-        self.runs.iter().map(move |(text, end, spaced)| {
-            let ink = self.ink.get(start..*end).unwrap_or_default();
-            start = *end;
-            (text.as_str(), ink, *spaced)
-        })
-    }
-
-    fn rotation(&self) -> f64 {
-        let m = Matrix(self.origin.tm).then(&Matrix(self.origin.ctm)).0;
-        m[1].atan2(m[0]).to_degrees()
-    }
-
-    /// The unit direction its baseline runs in, in user space.
-    fn direction(&self) -> (f64, f64) {
-        direction(&Matrix(self.origin.tm).then(&Matrix(self.origin.ctm)))
-    }
-
-    /// Whether it reads left to right along the page's x axis (most text; a page drawn
-    /// turned a quarter, as landscape pages often are, isn't).
-    pub(crate) fn upright(&self) -> bool {
-        let (x, y) = self.direction();
-        (x - 1.0).abs() < 1e-3 && y.abs() < 1e-3
-    }
-
-    /// Where it starts as `(along, across)` its baseline: user space turned to the text's direction.
-    fn frame_origin(&self) -> (f64, f64) {
-        to_frame(self.direction(), (self.origin.x, self.origin.baseline))
-    }
-
-    /// Its box in the same frame, `[along0, across0, along1, across1]` (for upright text, `rect`).
-    fn frame_rect(&self) -> [f64; 4] {
-        self.frame
-    }
-}
-
-/// The unit x axis of a text rendering matrix in user space (`(1, 0)` when it is degenerate).
-fn direction(m: &Matrix) -> (f64, f64) {
-    let (x, y) = (m.0[0], m.0[1]);
-    let length = x.hypot(y);
-    if length.is_finite() && length > 1e-9 { (x / length, y / length) } else { (1.0, 0.0) }
-}
-
-/// User-space point `p` as `(along, across)` a baseline running in unit direction `dir`. Upright
-/// text (`dir` = `(1, 0)`) keeps its coordinates, so lines and rows of turned text are found the
-/// same way (#1443).
-fn to_frame(dir: (f64, f64), p: (f64, f64)) -> (f64, f64) {
-    (p.0 * dir.0 + p.1 * dir.1, p.1 * dir.0 - p.0 * dir.1)
-}
-
-/// The box covering both `[x0, y0, x1, y1]` boxes.
-fn union(a: [f64; 4], b: [f64; 4]) -> [f64; 4] {
-    [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]
-}
-
-/// What replacing a line did.
-#[derive(Clone, Debug, PartialEq)]
-pub struct LineEdit {
-    /// `Some(font)` when the line's font couldn't show the new text and Helvetica was used.
-    pub substituted: Option<String>,
-}
-
-#[derive(Clone)]
-struct Ts {
-    ctm: Matrix,
-    /// The operators that set the current fill colour (`g`, `rg`, `k`, or `cs` + `sc`/`scn`).
-    fill: Vec<Op>,
-    font: Option<(Vec<u8>, Rc<Metrics>)>,
-    /// The Japanese or Hebrew fallback face the font subsets, when the font is one (see [`is_type3_fallback`]).
-    face: Option<String>,
-    size: f64,
-    char_spacing: f64,
-    word_spacing: f64,
-    scale: f64,
-    leading: f64,
-    rise: f64,
-    render_mode: i64,
-    /// The transparency parameters the `gs` operators have set so far (see [`Paint`]).
-    gs: Gs,
-    /// The font's vertical advance per unit of font size (`/DW2`'s w1, normally −1) when its
-    /// CMap writes vertically (`WMode 1`, §9.7.4.3): each glyph then moves the pen down, not right.
-    vertical: Option<f64>,
-    /// Why the font's writing mode couldn't be read (a broken or cyclic CMap). Its text is then
-    /// listed as horizontal, but the lines in it are refused for editing.
-    unreadable: Option<Rc<str>>,
-    /// The operators that set the current stroke colour (`G`, `RG`, `K`, or `CS` + `SC`/`SCN`).
-    stroke: Vec<Op>,
-    /// The line width a `w` or an ExtGState's `/LW` set (`None`: the initial 1.0).
-    line_width: Option<f64>,
-    /// The ExtGState resources selected with `gs`, oldest first (see [`select_gs`]).
-    ext_gstate: Vec<Vec<u8>>,
-    /// The dash pattern a `d` or an ExtGState's `/D` set (initially solid: `[] 0`).
-    dash: Dash,
-    /// The line cap a `J` or an ExtGState's `/LC` set (initially 0, butt).
-    line_cap: i64,
-}
-
-/// A dash pattern (ISO 32000-2 §8.4.3.6): the dash array and the phase.
-type Dash = (Vec<f64>, f64);
-
-/// The most dash array entries a pattern keeps; a longer one is ignored, as is a malformed one.
-const MAX_DASH: usize = 32;
-
-/// The dash pattern `array phase`, as `d` takes it and an ExtGState's `/D` holds it.
-fn dash_pattern(doc: &Document, array: Option<&Object>, phase: Option<&Object>) -> Option<Dash> {
-    let array = doc.resolve(array?);
-    let items = array.as_array().filter(|a| a.len() <= MAX_DASH)?;
-    let finite = |o: &Object| doc.resolve(o).as_f64().filter(|v| v.is_finite());
-    Some((items.iter().map(finite).collect::<Option<Vec<_>>>()?, finite(phase?)?))
-}
-
-/// A line cap style, as `J` takes it and an ExtGState's `/LC` holds it: 0, 1 or 2.
-fn line_cap(doc: &Document, cap: Option<&Object>) -> Option<i64> {
-    doc.resolve(cap?).as_int().filter(|c| (0..=2).contains(c))
-}
-
-/// The most `gs` selections a state remembers. Repeating a selection moves it to the end, so
-/// this bounds the distinct ExtGStates in force, not the operators a hostile stream repeats.
-const MAX_GS: usize = 32;
-
-/// Record `gs /name` in `list`. A `gs` sets every parameter its dictionary names to an absolute
-/// value, so a later selection of the same dictionary overrides the earlier one completely: the
-/// earlier entry goes, which keeps replaying the list equivalent to replaying the stream.
-fn select_gs(list: &mut Vec<Vec<u8>>, name: &[u8]) {
-    list.retain(|n| n != name);
-    if list.len() >= MAX_GS {
-        list.remove(0);
-    }
-    list.push(name.to_vec());
-}
-
-/// The page's content streams as listed, each with its decoded data (empty when it doesn't
-/// decode), within one page's [`DecodeBudget`]. An error when the content runs past it: reading
-/// or rewriting a page from part of its content would lose the rest.
-pub(crate) fn content_streams(doc: &Document, page: &Dict) -> Result<Vec<(Object, Vec<u8>)>, EditError> {
-    content_streams_within(doc, page, &mut DecodeBudget::page())
-}
-
-/// [`content_streams`], decoded against `budget`, which a walk of the page's forms then goes on
-/// spending.
-pub(crate) fn content_streams_within(doc: &Document, page: &Dict, budget: &mut DecodeBudget) -> Result<Vec<(Object, Vec<u8>)>, EditError> {
-    let list: Vec<Object> = match page.get(b"Contents") {
-        None => Vec::new(),
-        Some(c) => match &*doc.resolve(c) {
-            Object::Array(a) => a.clone(),
-            _ => vec![c.clone()],
-        },
-    };
-    let mut out = Vec::with_capacity(list.len());
-    for o in list {
-        let data = match &*doc.resolve(&o) {
-            Object::Stream(s) => match budget.decode(s) {
-                Ok(data) => data,
-                Err(e) if budget.remaining() == 0 => return Err(EditError::Invalid(format!("the page content is too large to read: {e}"))),
-                Err(_) => Vec::new(),
-            },
-            _ => Vec::new(),
-        };
-        out.push((o, data));
-    }
-    Ok(out)
-}
-
-/// Rewrite a page's content (its streams joined, see [`Pieces`]): `edit(i)` gives the operators
-/// to insert before operator `i` of `ops` (parsed from the joined pieces) and whether to keep it.
-/// Everything else is copied byte for byte. A page's streams are one stream in pieces, split
-/// between any two tokens (ISO 32000-2 §7.8.2), so an operator's operands can end one piece and
-/// its keyword start the next; removing or replacing it rewrites every piece it spans. Returns
-/// each piece's new bytes.
-pub(crate) fn splice(pieces: &Pieces, ops: &[Op], mut edit: impl FnMut(usize) -> (Vec<Op>, bool)) -> Vec<Vec<u8>> {
-    let data = pieces.data();
-    let mut edits = Vec::new();
-    for (i, op) in ops.iter().enumerate() {
-        let (insert, keep) = edit(i);
-        if insert.is_empty() && keep {
-            continue;
-        }
-        let mut bytes = Vec::new();
-        if !insert.is_empty() {
-            if op.span.start.checked_sub(1).and_then(|p| data.get(p)).is_some_and(|b| !b.is_ascii_whitespace()) {
-                bytes.push(b'\n');
-            }
-            bytes.extend_from_slice(&serialize_ops(&insert));
-        }
-        let end = if keep { op.span.start } else { op.span.end };
-        edits.push((op.span.start..end, bytes));
-    }
-    pieces.splice(edits)
-}
-
-/// The page's `/Contents` after a [`splice`]: pieces whose bytes changed become new streams
-/// (keeping their dictionaries), the others stay as they were.
-pub(crate) fn rewritten_contents(doc: &mut Document, streams: &[(Object, Vec<u8>)], new: Vec<Vec<u8>>) -> Object {
-    let mut contents: Vec<Object> = Vec::with_capacity(streams.len());
-    for ((obj, old), data) in streams.iter().zip(new) {
-        if *old == data {
-            contents.push(obj.clone());
-            continue;
-        }
-        let mut dict = match &*doc.resolve(obj) {
-            Object::Stream(s) => s.dict.clone(),
-            _ => Dict::new(),
-        };
-        dict.remove(b"Length");
-        contents.push(Object::Ref(doc.add(Object::Stream(Stream::flate(dict, &data)))));
-    }
-    match <[Object; 1]>::try_from(contents) {
-        Ok([one]) => one,
-        Err(many) => Object::Array(many),
-    }
-}
-
-fn page_dict(doc: &Document, page: usize) -> Result<pdfcraft_model::Page, EditError> {
-    pdfcraft_model::pages(doc).into_iter().nth(page).ok_or(EditError::NoSuchPage(page))
-}
-
-fn fill_color(fill: &[Op]) -> [f64; 3] {
-    let Some(op) = fill.iter().rev().find(|op| matches!(op.op.as_slice(), b"g" | b"rg" | b"k" | b"sc" | b"scn")) else {
-        return [0.0, 0.0, 0.0];
-    };
-    let space = match op.op.as_slice() {
-        b"sc" | b"scn" => match op.operands.len() {
-            1 => b"g".as_slice(),
-            3 => b"rg".as_slice(),
-            4 => b"k".as_slice(),
-            _ => return [0.0; 3],
-        },
-        other => other,
-    };
-    match space {
-        b"g" => {
-            let v = op.operands.first().and_then(Object::as_f64).unwrap_or(0.0).clamp(0.0, 1.0);
-            [v, v, v]
-        }
-        b"rg" => [
-            op.operands.first().and_then(Object::as_f64).unwrap_or(0.0).clamp(0.0, 1.0),
-            op.operands.get(1).and_then(Object::as_f64).unwrap_or(0.0).clamp(0.0, 1.0),
-            op.operands.get(2).and_then(Object::as_f64).unwrap_or(0.0).clamp(0.0, 1.0),
-        ],
-        b"k" => {
-            let c = op.operands.first().and_then(Object::as_f64).unwrap_or(0.0);
-            let m = op.operands.get(1).and_then(Object::as_f64).unwrap_or(0.0);
-            let y = op.operands.get(2).and_then(Object::as_f64).unwrap_or(0.0);
-            let k = op.operands.get(3).and_then(Object::as_f64).unwrap_or(0.0);
-            [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)]
-        }
-        _ => [0.0, 0.0, 0.0],
-    }
-}
-
-/// The text-showing operators of one stream with their text, font, box and baseline.
-struct Shown {
-    op: usize,
-    extra_ops: Vec<usize>,
-    /// Encoded glyphs, not bytes or Unicode characters (a ligature can represent several).
-    glyph_count: usize,
-    /// Advance in text space, including spacing and TJ adjustments.
-    advance: f64,
-    tracking: f64,
-    /// The text matrix where it starts (text space), and the state there and at its `BT`.
-    tm: Matrix,
-    tlm: Matrix,
-    state: Ts,
-    bt_op: usize,
-    bt_state: Ts,
-    text: String,
-    rect: [f64; 4],
-    /// Its box along and across its baseline (see [`TextLine::frame`]).
-    frame: [f64; 4],
-    /// The boxes of its words (see [`TextLine::ink`]).
-    ink: Vec<[f64; 4]>,
-    baseline: f64,
-    start_x: f64,
-    end_x: f64,
-    end_y: f64,
-    bt: usize,
-    font: Vec<u8>,
-    base_font: String,
-    face: Option<String>,
-    size: f64,
-    bold: bool,
-    italic: bool,
-    visual_order: bool,
-    decodable: bool,
-    scope: Option<usize>,
-    paint: Paint,
-    logical_order: bool,
-    actual_text: bool,
-}
-
-impl Shown {
-    /// The unit direction of its baseline, where it starts and ends along it, and the baseline's
-    /// offset across it (for upright text: the user-space x, x and y). A vertical run goes along
-    /// its column instead, the way the pen moves: for upright text down, with the column's x
-    /// across.
-    fn span(&self) -> ((f64, f64), f64, f64, f64) {
-        let m = self.tm.then(&self.state.ctm);
-        let dir = match self.state.vertical {
-            Some(w1) => direction(&Matrix([m.0[2] * w1.signum(), m.0[3] * w1.signum(), 0.0, 0.0, 0.0, 0.0])),
-            None => direction(&m),
-        };
-        let (start, across) = to_frame(dir, (self.start_x, self.baseline));
-        (dir, start, to_frame(dir, (self.end_x, self.end_y)).0, across)
-    }
-}
-
-/// Where the previous run of a line ended: its text object, baseline direction, offset across
-/// the baseline, end along it and size.
-#[derive(Clone, Copy)]
-struct Pen {
-    bt: usize,
-    dir: (f64, f64),
-    across: f64,
-    end: f64,
-    size: f64,
-    vertical: bool,
-}
-
-impl Pen {
-    fn after(s: &Shown) -> Self {
-        let (dir, _, end, across) = s.span();
-        Pen { bt: s.bt, dir, across, end, size: s.size.max(1.0), vertical: s.state.vertical.is_some() }
-    }
-
-    /// Whether `s` could continue the same line on geometry alone: on the same baseline, starting
-    /// at most a word gap (`reach` sizes) after it. Also the gap along the baseline.
-    fn continues(&self, s: &Shown, reach: f64) -> (bool, f64) {
-        let (dir, start, _, across) = s.span();
-        let gap = start - self.end;
-        let same_dir = (dir.0 - self.dir.0).abs() < 1e-3 && (dir.1 - self.dir.1).abs() < 1e-3;
-        // A column continues a column (along which the pen moves), a baseline a baseline.
-        let same_dir = same_dir && self.vertical == s.state.vertical.is_some();
-        (same_dir && (across - self.across).abs() < self.size * 0.3 && gap > -self.size && gap < self.size * reach, gap)
-    }
-}
-
-/// Use the lower third of letter gaps, not word gaps. A pair of isolated labels is not
-/// evidence of tracking; unadjusted neighbours inside a string contribute zero too.
-/// The tracking a run of glyphs was set with: the lower third of its gaps, when that is at
-/// most half an em (`limit`). A wider "tracking" is word or cell spacing between one-glyph
-/// words (`a b c`, a column of digits or Y/N ticks), which must keep its spaces.
-fn typical_tracking(gaps: &mut [f64], limit: f64) -> f64 {
-    if gaps.len() < 3 {
-        return 0.0;
-    }
-    let at = gaps.len() / 3;
-    gaps.select_nth_unstable_by(at, f64::total_cmp);
-    gaps.get(at).copied().filter(|n| n.is_finite() && *n <= limit).unwrap_or(0.0).max(0.0)
-}
-
-fn tj_tracking(pieces: &[Object], metrics: &Metrics, size: f64, scale: f64) -> f64 {
-    let mut gaps = Vec::new();
-    let mut previous = false;
-    let mut gap = 0.0;
-    for piece in pieces {
-        if let Object::String(s) = piece {
-            for (code, len) in metrics.codes(&s.bytes) {
-                let blank = metrics.is_space(code, len) || metrics.text_of(code).is_some_and(|t| !t.is_empty() && t.chars().all(char::is_whitespace));
-                if previous && !blank {
-                    gaps.push(gap);
-                }
-                previous = !blank;
-                gap = 0.0;
-            }
-        } else if let Some(n) = piece.as_f64() {
-            gap += -n / 1000.0 * size * scale;
-        }
-    }
-    typical_tracking(&mut gaps, size * scale.abs() * 0.5)
-}
-
-fn positioned_tracking(shown: &mut [Shown]) {
-    let mut start = 0;
-    while start < shown.len() {
-        let mut end = start.saturating_add(1);
-        while let (Some(prev), Some(next)) = (shown.get(end.saturating_sub(1)), shown.get(end)) {
-            if prev.glyph_count != 1
-                || next.glyph_count != 1
-                || prev.font != next.font
-                || prev.scope != next.scope
-                || (prev.size - next.size).abs() > 0.01
-                || prev.state.char_spacing != next.state.char_spacing
-                || prev.state.scale != next.state.scale
-                || !Pen::after(prev).continues(next, 1.5).0
-            {
-                break;
-            }
-            end = end.saturating_add(1);
-        }
-        if let Some(run) = shown.get_mut(start..end) {
-            let mut gaps: Vec<f64> = run
-                .windows(2)
-                .filter_map(|pair| {
-                    let [prev, next] = pair else { return None };
-                    (!prev.text.trim().is_empty() && !next.text.trim().is_empty()).then(|| Pen::after(prev).continues(next, 0.0).1)
-                })
-                .collect();
-            let limit = run.first().map_or(0.0, |s| s.size * s.state.scale.abs() * 0.5);
-            let tracking = typical_tracking(&mut gaps, limit);
-            for s in run.iter_mut().skip(1) {
-                s.tracking = tracking;
-            }
-        }
-        start = end;
-    }
-}
-
-/// The graphics state carried from one of a page's content streams to the next: the streams
-/// are one stream in pieces (§7.8.2), so a `cm` (AutoCAD scales the whole page in the first
-/// stream), an unbalanced `q`, the font and the colour still apply in the streams after it.
-struct Carry {
-    ts: Ts,
-    stack: Vec<Ts>,
-    marked: Vec<Option<usize>>,
-    /// For each open marked-content sequence, its optional content group when it is `/OC`.
-    layers: Vec<Option<Vec<u8>>>,
-    /// Bytes of glyph text the rest of the page may still produce (see [`MAX_PAGE_TEXT`]).
-    text_left: usize,
-}
-
-/// The most glyph text one page's extraction produces, in bytes. A ToUnicode destination is
-/// copied for every glyph showing its code, so a small page can otherwise expand into gigabytes;
-/// real pages hold far less (a whole novel is about 1 MB).
-const MAX_PAGE_TEXT: usize = 16 << 20;
-
-impl Carry {
-    fn new() -> Self {
-        let ts = Ts {
-            ctm: Matrix::IDENTITY,
-            fill: Vec::new(),
-            font: None,
-            face: None,
-            size: 0.0,
-            char_spacing: 0.0,
-            word_spacing: 0.0,
-            scale: 1.0,
-            leading: 0.0,
-            rise: 0.0,
-            render_mode: 0,
-            gs: Gs::default(),
-            vertical: None,
-            unreadable: None,
-            stroke: Vec::new(),
-            line_width: None,
-            ext_gstate: Vec::new(),
-            dash: (Vec::new(), 0.0),
-            line_cap: 0,
-        };
-        Carry { ts, stack: Vec::new(), marked: Vec::new(), layers: Vec::new(), text_left: MAX_PAGE_TEXT }
-    }
-}
-
-/// A font resource's metrics, fallback face and vertical advance (see [`Ts`]), read once per page.
-/// The advance is an error message when the font's writing mode can't be read.
-type CachedFont = (Rc<Metrics>, Option<String>, Result<Option<f64>, String>);
-
-/// A `Do` met while interpreting: its operator index, XObject name and the state there.
-type Invocation = (usize, Vec<u8>, Ts);
-
-fn interpret(
-    doc: &Document,
-    ops: &[Op],
-    resources: &Dict,
-    cache: &mut HashMap<Vec<u8>, CachedFont>,
-    carry: &mut Carry,
-    mut invoked: Option<&mut Vec<Invocation>>,
-    // `Some(properties)`: read `/ActualText`, looking named property lists up in `properties`.
-    logical_text: Option<&Dict>,
-) -> Result<Vec<Shown>, EditError> {
-    let fonts_res = resources.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
-    let states = resources.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
-    let mut out: Vec<Shown> = Vec::new();
-    let mut ts = carry.ts.clone();
-    let mut at_bt = (0usize, ts.clone());
-    let mut stack: Vec<Ts> = std::mem::take(&mut carry.stack);
-    let (mut tm, mut tlm) = (Matrix::IDENTITY, Matrix::IDENTITY);
-    let mut bt = 0usize;
-    let mut marked = std::mem::take(&mut carry.marked);
-    let mut layers = std::mem::take(&mut carry.layers);
-    let mut actual: Vec<Option<(usize, usize, String)>> = Vec::new();
-    for (i, op) in ops.iter().enumerate() {
-        match op.op.as_slice() {
-            // No depth cap: every `EMC` pops, so a capped push would pair it with the enclosing
-            // sequence (#3573). Both stacks stay bounded by the number of operators.
-            b"BMC" | b"BDC" => {
-                // Marked text paragraphs/headings are authoritative boundaries. Ignore
-                // artifacts and inner spans, which inherit their enclosing region.
-                let region = matches!(op.name(0), Some(b"P" | b"H" | b"H1" | b"H2" | b"H3" | b"H4" | b"H5" | b"H6" | b"LI" | b"TD" | b"TH"));
-                marked.push(if region { Some(i) } else { marked.last().copied().flatten() });
-                // A layer named in the resources is told apart by its name, an inline one by where it opens.
-                let layer = op.is("BDC") && op.name(0) == Some(b"OC".as_slice());
-                layers.push(layer.then(|| op.operands.get(1).and_then(Object::as_name).map_or_else(|| format!("@{i}").into_bytes(), <[u8]>::to_vec)));
-                // The property list is inline or named in the resources' /Properties (§14.6.2).
-                let list = logical_text.and_then(|properties| match op.operands.get(1) {
-                    Some(Object::Name(n)) => properties.get(n).and_then(|o| doc.dict(o)),
-                    other => other.and_then(Object::as_dict).cloned(),
-                });
-                let logical = list.as_ref().and_then(|d| d.get(b"ActualText")).and_then(|s| match s {
-                    Object::String(s) if s.bytes.len() <= 4_000_000 => Some(s.to_text()),
-                    _ => None,
-                });
-                actual.push(logical.map(|s| (out.len(), i, s)));
-            }
-            b"EMC" => {
-                marked.pop();
-                layers.pop();
-                if let Some(Some((start, open, logical))) = actual.pop() {
-                    let tail = out.split_off(start.min(out.len()));
-                    let mut items = tail.into_iter();
-                    if let Some(mut first) = items.next() {
-                        for shown in items {
-                            first.glyph_count = first.glyph_count.saturating_add(shown.glyph_count);
-                            first.extra_ops.push(shown.op);
-                            first.extra_ops.extend(shown.extra_ops);
-                            first.rect = [
-                                first.rect[0].min(shown.rect[0]),
-                                first.rect[1].min(shown.rect[1]),
-                                first.rect[2].max(shown.rect[2]),
-                                first.rect[3].max(shown.rect[3]),
-                            ];
-                            first.frame = union(first.frame, shown.frame);
-                            first.ink.extend(shown.ink);
-                        }
-                        first.extra_ops.extend([open, i]);
-                        // Only right-to-left ActualText is already in typing order and must stay
-                        // out of the line's bidi recovery. Word and Chrome wrap Latin ligatures
-                        // (`fi`, `fl`) in ActualText spans mid-word; those keep joining their line.
-                        first.logical_order = logical.chars().any(crate::bidi::is_rtl);
-                        first.actual_text = true;
-                        first.text = logical;
-                        first.start_x = first.rect[0];
-                        first.end_x = first.rect[2];
-                        first.end_y = first.baseline;
-                        first.advance = (first.end_x - first.start_x) / first.tm.then(&first.state.ctm).0[0].abs().max(1e-6);
-                        out.push(first);
-                    }
-                }
-            }
-            b"q" => stack.push(ts.clone()),
-            b"Q" => {
-                if let Some(s) = stack.pop() {
-                    ts = s;
-                }
-            }
-            b"cm" => {
-                if let Some(m) = op.nums::<6>() {
-                    ts.ctm = Matrix(m).then(&ts.ctm);
-                }
-            }
-            b"BT" => {
-                tm = Matrix::IDENTITY;
-                tlm = Matrix::IDENTITY;
-                bt += 1;
-                at_bt = (i, ts.clone());
-            }
-            b"g" | b"rg" | b"k" | b"cs" => ts.fill = vec![op.clone()],
-            b"sc" | b"scn" => {
-                ts.fill.retain(|o| o.is("cs"));
-                ts.fill.push(op.clone());
-            }
-            b"G" | b"RG" | b"K" | b"CS" => ts.stroke = vec![op.clone()],
-            b"SC" | b"SCN" => {
-                ts.stroke.retain(|o| o.is("CS"));
-                ts.stroke.push(op.clone());
-            }
-            b"w" => ts.line_width = op.num(0).filter(|w| w.is_finite()).or(ts.line_width),
-            b"d" => ts.dash = dash_pattern(doc, op.operands.first(), op.operands.get(1)).unwrap_or_else(|| ts.dash.clone()),
-            b"J" => ts.line_cap = line_cap(doc, op.operands.first()).unwrap_or(ts.line_cap),
-            b"Tf" => {
-                ts.size = op.num(1).unwrap_or(ts.size);
-                if let Some(name) = op.name(0) {
-                    let (m, face, vertical) = cache.entry(name.to_vec()).or_insert_with(|| {
-                        let dict = fonts_res.get(name).and_then(|f| doc.resolve(f).as_dict().cloned());
-                        let metrics = dict.as_ref().map_or_else(Metrics::fallback, |d| Metrics::from_dict(doc, d));
-                        let vertical = dict.as_ref().map_or(Ok(None), |d| vertical_advance(doc, d).map_err(|e| e.to_string()));
-                        let face = dict.filter(is_type3_fallback).map(|_| metrics.base_font.clone());
-                        (Rc::new(metrics), face, vertical)
-                    });
-                    ts.font = Some((name.to_vec(), m.clone()));
-                    ts.face = face.clone();
-                    // Which way the glyphs advance is unknown (§9.7.4.3): list the font's text as
-                    // horizontal and record why, so editing its lines is refused (not the page).
-                    match vertical {
-                        Ok(v) => (ts.vertical, ts.unreadable) = (*v, None),
-                        Err(e) => (ts.vertical, ts.unreadable) = (None, Some(Rc::from(e.as_str()))),
-                    }
-                }
-            }
-            b"Tc" => ts.char_spacing = op.num(0).unwrap_or(0.0),
-            b"Tw" => ts.word_spacing = op.num(0).unwrap_or(0.0),
-            b"Tz" => ts.scale = op.num(0).unwrap_or(100.0) / 100.0,
-            b"TL" => ts.leading = op.num(0).unwrap_or(0.0),
-            b"Ts" => ts.rise = op.num(0).unwrap_or(0.0),
-            b"Tr" => ts.render_mode = op.operands.first().and_then(Object::as_int).unwrap_or(-1),
-            b"gs" => {
-                if let Some(name) = op.name(0) {
-                    select_gs(&mut ts.ext_gstate, name);
-                }
-                let params = op.name(0).and_then(|name| states.get(name)).map(|p| doc.resolve(p));
-                if let Some(params) = params.as_deref().and_then(Object::as_dict) {
-                    ts.gs.apply(doc, params);
-                    // `/LW` sets the line width as `w` does (ISO 32000-2 §8.4.5).
-                    let lw = params.get(b"LW").and_then(|w| doc.resolve(w).as_f64()).filter(|w| w.is_finite());
-                    ts.line_width = lw.or(ts.line_width);
-                    let dash = params.get(b"D").map(|d| doc.resolve(d));
-                    let dash = dash.as_deref().and_then(Object::as_array);
-                    if let Some(d) = dash.and_then(|d| dash_pattern(doc, d.first(), d.get(1))) {
-                        ts.dash = d;
-                    }
-                    ts.line_cap = line_cap(doc, params.get(b"LC")).unwrap_or(ts.line_cap);
-                }
-            }
-            b"Do" => {
-                if let (Some(list), Some(name)) = (invoked.as_deref_mut(), op.name(0)) {
-                    list.push((i, name.to_vec(), ts.clone()));
-                }
-            }
-            b"Td" | b"TD" => {
-                if let Some([x, y]) = op.nums::<2>() {
-                    if op.is("TD") {
-                        ts.leading = -y;
-                    }
-                    tlm = Matrix([1.0, 0.0, 0.0, 1.0, x, y]).then(&tlm);
-                    tm = tlm;
-                }
-            }
-            b"Tm" => {
-                if let Some(m) = op.nums::<6>() {
-                    tlm = Matrix(m);
-                    tm = tlm;
-                }
-            }
-            b"T*" => {
-                tlm = Matrix([1.0, 0.0, 0.0, 1.0, 0.0, -ts.leading]).then(&tlm);
-                tm = tlm;
-            }
-            b"Tj" | b"TJ" | b"'" | b"\"" => {
-                if matches!(op.op.as_slice(), b"'" | b"\"") {
-                    if op.is("\"") {
-                        ts.word_spacing = op.num(0).unwrap_or(ts.word_spacing);
-                        ts.char_spacing = op.num(1).unwrap_or(ts.char_spacing);
-                    }
-                    tlm = Matrix([1.0, 0.0, 0.0, 1.0, 0.0, -ts.leading]).then(&tlm);
-                    tm = tlm;
-                }
-                let Some((name, m)) = ts.font.clone() else { continue };
-                // Pieces: strings, and TJ number adjustments.
-                let pieces: Vec<Object> = match op.op.as_slice() {
-                    // A surplus array (`[(A)] [(B)] TJ`) is malformed, but the operator still
-                    // takes the one immediately before it, as the renderer and every other
-                    // reader here do (#3569) -- not the first, which a reader counting operands
-                    // from the front of a surplus list would otherwise take.
-                    b"TJ" => op.operands.last().and_then(Object::as_array).cloned().unwrap_or_default(),
-                    _ => op.operands.last().cloned().into_iter().collect(),
-                };
-                // Tc is already included in the pen advance; TJ may encode tracking instead.
-                let tracking = if op.is("TJ") { tj_tracking(&pieces, &m, ts.size, ts.scale) } else { 0.0 };
-                let trm0 = tm.then(&ts.ctm);
-                let start = trm0.apply(0.0, ts.rise);
-                let mut text = String::new();
-                let mut decodable = true;
-                let mut x_text = 0.0;
-                // Vertical text (§9.4.4): the pen moves along y instead, and each glyph is centred
-                // on it horizontally; `half` is half the widest glyph.
-                let vertical = ts.vertical;
-                let (mut y_text, mut half) = (0.0, 0.0_f64);
-                // Where each word's glyphs start and end along the run (text space), and whether
-                // the next glyph continues the last word.
-                let mut words: Vec<(f64, f64)> = Vec::new();
-                let mut in_word = false;
-                let mut glyph_count = 0_usize;
-                for p in &pieces {
-                    match p {
-                        Object::String(s) => {
-                            for (code, len) in m.codes(&s.bytes) {
-                                glyph_count = glyph_count.saturating_add(1);
-                                let shown = m.text_of(code);
-                                let blank =
-                                    m.is_space(code, len) || shown.as_deref().is_some_and(|t| !t.is_empty() && t.chars().all(char::is_whitespace));
-                                match shown {
-                                    Some(t) => {
-                                        carry.text_left = carry
-                                            .text_left
-                                            .checked_sub(t.len())
-                                            .ok_or_else(|| EditError::Invalid("the page's text is too large to read".into()))?;
-                                        text.push_str(&t);
-                                    }
-                                    None => decodable = false,
-                                }
-                                let spacing = ts.char_spacing + if m.is_space(code, len) { ts.word_spacing } else { 0.0 };
-                                if let Some(w1) = vertical {
-                                    half = half.max((m.width(code) * ts.size * ts.scale).abs() / 2.0);
-                                    if !blank {
-                                        let ink_end = y_text + w1 * ts.size;
-                                        let (lo, hi) = (y_text.min(ink_end), y_text.max(ink_end));
-                                        match words.last_mut() {
-                                            Some(word) if in_word => *word = (word.0.min(lo), word.1.max(hi)),
-                                            _ => words.push((lo, hi)),
-                                        }
-                                    }
-                                    in_word = !blank;
-                                    y_text += w1 * ts.size + spacing;
-                                    continue;
-                                }
-                                if !blank {
-                                    let ink_end = x_text + m.width(code) * ts.size * ts.scale;
-                                    // A negative font size or `Tz` runs the glyphs backwards:
-                                    // the word is the union of its glyphs, whichever way they go.
-                                    let (lo, hi) = (x_text.min(ink_end), x_text.max(ink_end));
-                                    match words.last_mut() {
-                                        Some(word) if in_word => *word = (word.0.min(lo), word.1.max(hi)),
-                                        _ => words.push((lo, hi)),
-                                    }
-                                }
-                                in_word = !blank;
-                                let w = m.width(code) * ts.size + ts.char_spacing + if m.is_space(code, len) { ts.word_spacing } else { 0.0 };
-                                x_text += w * ts.scale;
-                            }
-                        }
-                        other => {
-                            if let Some(n) = other.as_f64() {
-                                if vertical.is_some() {
-                                    // Down by n/1000 em, not scaled by `Tz`.
-                                    let dy = -n / 1000.0 * ts.size;
-                                    if -dy > ts.size * 0.2 && !text.ends_with(' ') {
-                                        text.push(' ');
-                                    }
-                                    if dy.abs() > ts.size.abs() * 0.2 {
-                                        in_word = false;
-                                    }
-                                    y_text += dy;
-                                    continue;
-                                }
-                                let dx = -n / 1000.0 * ts.size * ts.scale;
-                                // A large gap inside TJ reads as a space.
-                                if dx - tracking > (ts.size * ts.scale).abs() * 0.2 && !text.ends_with(' ') {
-                                    text.push(' ');
-                                }
-                                // Tracking and kerning keep a word together; a larger jump
-                                // ends it (whatever the sign of the size or `Tz`).
-                                if dx - tracking > (ts.size * ts.scale).abs() * 0.2 || dx < -(ts.size * ts.scale).abs() * 0.2 {
-                                    in_word = false;
-                                }
-                                x_text += dx;
-                            }
-                        }
-                    }
-                }
-                tm = Matrix([1.0, 0.0, 0.0, 1.0, x_text, y_text]).then(&tm);
-                let end = tm.then(&ts.ctm).apply(0.0, ts.rise);
-                // The box from `a` to `b` along the run: from descent to ascent across it, or for
-                // vertical text, the widest glyph's width centred on the pen.
-                let span = |a: f64, b: f64| match vertical {
-                    Some(_) => {
-                        [trm0.apply(-half, ts.rise + a), trm0.apply(half, ts.rise + a), trm0.apply(-half, ts.rise + b), trm0.apply(half, ts.rise + b)]
-                    }
-                    None => [
-                        trm0.apply(a, ts.rise + m.descent * ts.size),
-                        trm0.apply(b, ts.rise + m.descent * ts.size),
-                        trm0.apply(a, ts.rise + m.ascent * ts.size),
-                        trm0.apply(b, ts.rise + m.ascent * ts.size),
-                    ],
-                };
-                let corners = span(0.0, if vertical.is_some() { y_text } else { x_text });
-                let rect = corners
-                    .iter()
-                    .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |b, p| [b[0].min(p.0), b[1].min(p.1), b[2].max(p.0), b[3].max(p.1)]);
-                // The same corners along and across the baseline: the run's own box, not its
-                // upright bounding box turned (which is wider by the box's height on a slant).
-                let dir = direction(&trm0);
-                let frame = corners
-                    .iter()
-                    .map(|&p| to_frame(dir, p))
-                    .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |b, p| [b[0].min(p.0), b[1].min(p.1), b[2].max(p.0), b[3].max(p.1)]);
-                let ink = words
-                    .iter()
-                    .map(|&(a, b)| {
-                        span(a, b)
-                            .iter()
-                            .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |r, p| [r[0].min(p.0), r[1].min(p.1), r[2].max(p.0), r[3].max(p.1)])
-                    })
-                    .collect();
-                let size_user = (trm0.0[2].powi(2) + trm0.0[3].powi(2)).sqrt() * ts.size;
-                // A numeric-only TJ adjusts the current text matrix but paints no glyphs.
-                // It must not create a phantom editable line or enlarge its neighbours' boxes.
-                if !pieces.iter().any(|p| matches!(p, Object::String(s) if !s.bytes.is_empty())) {
-                    continue;
-                }
-                out.push(Shown {
-                    op: i,
-                    extra_ops: Vec::new(),
-                    glyph_count,
-                    // Vertical text: the TJ adjustment that undoes the run is n = -1000 y / size; the
-                    // preview divides by size × `Tz`, so `Tz` is put back here.
-                    advance: if vertical.is_some() { y_text * ts.scale } else { x_text },
-                    tracking: 0.0,
-                    tm: Matrix([
-                        tm.0[0],
-                        tm.0[1],
-                        tm.0[2],
-                        tm.0[3],
-                        tm.0[4] - x_text * tm.0[0] - y_text * tm.0[2],
-                        tm.0[5] - x_text * tm.0[1] - y_text * tm.0[3],
-                    ]),
-                    state: ts.clone(),
-                    tlm,
-                    bt_op: at_bt.0,
-                    bt_state: at_bt.1.clone(),
-                    text,
-                    rect,
-                    frame,
-                    ink,
-                    baseline: start.1,
-                    start_x: start.0,
-                    end_x: end.0,
-                    end_y: end.1,
-                    bt,
-                    font: name,
-                    base_font: m.base_font.clone(),
-                    face: ts.face.clone(),
-                    size: if size_user > 0.0 { size_user } else { ts.size },
-                    bold: m.bold,
-                    italic: m.italic,
-                    visual_order: m.visual_order,
-                    decodable,
-                    scope: marked.last().copied().flatten(),
-                    paint: Paint { layers: layers.iter().flatten().cloned().collect(), gs: ts.gs.clone() },
-                    logical_order: false,
-                    actual_text: false,
-                });
-            }
-            _ => {}
-        }
-    }
-    carry.ts = ts;
-    carry.stack = stack;
-    carry.marked = marked;
-    carry.layers = layers;
-    positioned_tracking(&mut out);
-    Ok(out)
-}
-
-/// The lines of text on a page (0-based), in content order.
-pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditError> {
-    text_lines_in(doc, &page_dict(doc, page)?, true)
-}
-
-/// The lines `page`'s glyphs show, in content order, without `/ActualText` replacements: what the
-/// page draws, not what its marked-content metadata says the glyphs mean. For checks that must
-/// not trust that metadata (the redaction audit). Takes the page itself, so a caller going
-/// through every page doesn't walk the page tree again for each.
-pub fn glyph_text_lines(doc: &Document, page: &pdfcraft_model::Page) -> Result<Vec<TextLine>, EditError> {
-    text_lines_in(doc, page, false)
-}
-
-/// [`text_lines`] of `p`; with `actual_text`, `/ActualText` replaces the glyphs it spans.
-fn text_lines_in(doc: &Document, p: &pdfcraft_model::Page, actual_text: bool) -> Result<Vec<TextLine>, EditError> {
-    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    let mut cache = HashMap::new();
-    let mut lines: Vec<TextLine> = Vec::new();
-    let mut carry = Carry::new();
-    // The streams are one stream in pieces (§7.8.2), split between any two tokens: parse them
-    // joined, so an operator whose operands end one piece still has them.
-    let pieces = Pieces::join(&content_streams(doc, &p.dict)?.into_iter().map(|(_, d)| d).collect::<Vec<_>>());
-    let ops = pieces.parse().ops;
-    let properties = res.get(b"Properties").and_then(|o| doc.dict(o)).unwrap_or_default();
-    let shown = interpret(doc, &ops, &res, &mut cache, &mut carry, None, actual_text.then_some(&properties))?;
-    let mut last: Option<(usize, Pen)> = None; // the stream piece and where its last run ended
-    for mut s in shown {
-        // A single RTL glyph's ActualText (e.g. lam-alef) is an inline ligature, not a
-        // separate logical line. Put its letters into visual order before joining the
-        // surrounding glyphs; the completed line is recovered to typing order below.
-        // Multi-glyph and mixed-direction replacements keep their authoritative order.
-        if s.logical_order && s.glyph_count == 1 && s.text.chars().all(crate::bidi::is_rtl) {
-            s.text = crate::bidi::to_visual(&s.text);
-            s.logical_order = false;
-        }
-        // A line belongs to one stream piece. Within it, PDF producers often put every word
-        // in its own BT/ET: geometry and text state, not object boundaries, define a line.
-        let si = ops.get(s.op).map_or(0, |op| pieces.pieces_of(op).0);
-        let joins = last.is_some_and(|(piece, pen)| {
-            let bt = pen.bt;
-            let (near, gap) = pen.continues(&s, if bt == s.bt { 3.0 } else { 1.5 });
-            piece == si
-                && lines.last().is_some_and(|l| l.scope == s.scope && l.paint == s.paint && l.logical_order == s.logical_order)
-                && (bt == s.bt || lines.last().is_some_and(|l| compatible_word(l, &s)))
-                && (s.text.trim().is_empty() || lines.last().is_some_and(|l| same_font(l, &s.font, &s.base_font, s.face.as_deref())))
-                && (s.text.trim().is_empty()
-                    || lines.last().is_some_and(|l| {
-                        (s.size - l.size).abs() < 0.01
-                            && s.bold == l.bold
-                            && s.italic == l.italic
-                            && fill_color(&s.state.fill) == l.color
-                            && same_paint(l, &s.state)
-                    }))
-                && near
-                // An OCR layer is one text object over the whole scan: its words continue a line
-                // only across a word space, not across a table cell or a tab stop.
-                && (s.state.render_mode != 3 || gap < pen.size * 0.6)
-        });
-        if joins && let Some(l) = lines.last_mut() {
-            let gap = last.map_or(0.0, |(_, pen)| pen.continues(&s, 0.0).1);
-            let spaced = gap - s.tracking > l.size * s.state.scale.abs() * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ');
-            if spaced {
-                l.text.push(' ');
-            }
-            l.text.push_str(&s.text);
-            l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
-            l.frame = union(l.frame, s.frame);
-            l.ink.extend(s.ink.iter().copied());
-            l.runs.push((s.text.clone(), l.ink.len(), spaced));
-            l.ops.push(s.op);
-            l.ops.extend(s.extra_ops.iter().copied());
-            l.decodable &= s.decodable;
-            l.visual_order |= s.visual_order;
-            l.actual_text |= s.actual_text;
-            l.clips |= s.state.render_mode >= 4;
-            if l.unreadable_mode.is_none() {
-                l.unreadable_mode = s.state.unreadable.as_deref().map(str::to_owned);
-            }
-            // Spaces may use a separate subset font; they do not change the visible style.
-        } else {
-            lines.push(TextLine {
-                text: s.text.clone(),
-                rect: s.rect,
-                frame: s.frame,
-                ink: s.ink.clone(),
-                font: String::from_utf8_lossy(&s.font).into_owned(),
-                base_font: s.base_font.clone(),
-                size: s.size,
-                bold: s.bold,
-                italic: s.italic,
-                color: fill_color(&s.state.fill),
-                decodable: s.decodable,
-                visual_order: s.visual_order,
-                face: s.face.clone(),
-                stream: si,
-                scope: s.scope,
-                paint: s.paint.clone(),
-                logical_order: s.logical_order,
-                actual_text: s.actual_text,
-                clips: s.state.render_mode >= 4,
-                unreadable_mode: s.state.unreadable.as_deref().map(str::to_owned),
-                runs: vec![(s.text.clone(), s.ink.len(), false)],
-                ops: std::iter::once(s.op).chain(s.extra_ops.iter().copied()).collect(),
-                origin: Origin {
-                    tm: s.tm.0,
-                    tlm: s.tlm.0,
-                    k: (s.tm.then(&s.state.ctm).0[2].powi(2) + s.tm.then(&s.state.ctm).0[3].powi(2)).sqrt(),
-                    ctm: s.state.ctm.0,
-                    baseline: s.baseline,
-                    x: s.start_x,
-                    state: TextState::of(&s.state),
-                    bt_op: s.bt_op,
-                    bt_state: TextState::of(&s.bt_state),
-                },
-            });
-        }
-        last = Some((si, Pen::after(&s)));
-    }
-    // Content streams draw right-to-left lines in visual order; the editor works in typing order.
-    for l in lines.iter_mut().filter(|l| !l.logical_order) {
-        // A visual-order Indic font draws pre-base vowel signs before their consonant.
-        let shown = l.text.clone();
-        if l.visual_order && !l.actual_text {
-            l.text = crate::indic::to_logical(&l.text);
-        }
-        l.text = crate::bidi::to_logical(&l.text);
-        // The runs hold the text in drawing order, which no longer reads as the line does.
-        if l.text != shown {
-            l.runs.clear();
-        }
-    }
-    // Lines of only spaces aren't editable text.
-    lines.retain(|l| !l.text.trim().is_empty());
-    Ok(lines)
-}
-
-/// Joining independent text objects is safe only when they use the same text and graphics
-/// transforms and spacing. In particular, a nearby rotated label isn't part of this line.
-fn compatible_word(line: &TextLine, shown: &Shown) -> bool {
-    let within = |a: &[f64], b: &[f64], tolerance: f64| a.iter().zip(b).all(|(a, b)| (a - b).abs() < tolerance);
-    let same = |a: &[f64], b: &[f64]| within(a, b, 1e-6);
-    let (a, b) = (&line.origin.state, TextState::of(&shown.state));
-    // Spacing that differs by less than a thousandth of an em, the unit glyph widths are given in,
-    // can't be seen. Some producers still write it (`0.0001 Tc` on one word of a line).
-    let em = shown.state.size.abs() / 1000.0;
-    line.scope == shown.scope
-        && line.paint == shown.paint
-        && same(&line.origin.tm[..4], &shown.tm.0[..4])
-        && same(&line.origin.ctm, &shown.state.ctm.0)
-        && within(&[a.char_spacing, a.word_spacing], &[b.char_spacing, b.word_spacing], em.max(1e-6))
-        && same(&[a.scale, a.rise], &[b.scale, b.rise])
-        && a.fill.len() == b.fill.len()
-        && a.fill.iter().zip(&b.fill).all(|(a, b)| a.op == b.op && a.operands == b.operands)
-}
-
-/// The line `s` continues, or a new one: `last` is the previous run of the same stream
-/// (`bt`, baseline, end x, size).
-fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<Pen>, s: Shown, stream: usize) {
-    let joins = last.is_some_and(|pen| {
-        let bt = pen.bt;
-        lines.last().is_some_and(|l| l.scope == s.scope && l.paint == s.paint && l.logical_order == s.logical_order)
-            && (bt == s.bt || lines.last().is_some_and(|l| compatible_word(l, &s)))
-            && (s.text.trim().is_empty() || lines.last().is_some_and(|l| same_font(l, &s.font, &s.base_font, s.face.as_deref())))
-            && (s.text.trim().is_empty()
-                || lines.last().is_some_and(|l| {
-                    (s.size - l.size).abs() < 0.01
-                        && s.bold == l.bold
-                        && s.italic == l.italic
-                        && fill_color(&s.state.fill) == l.color
-                        && same_paint(l, &s.state)
-                }))
-            && pen.continues(&s, if bt == s.bt { 3.0 } else { 1.5 }).0
-    });
-    if joins && let Some(l) = lines.last_mut() {
-        let gap = last.map_or(0.0, |pen| pen.continues(&s, 0.0).1);
-        let spaced = gap - s.tracking > l.size * s.state.scale.abs() * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ');
-        if spaced {
-            l.text.push(' ');
-        }
-        l.text.push_str(&s.text);
-        l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
-        l.frame = union(l.frame, s.frame);
-        l.ink.extend(s.ink.iter().copied());
-        l.runs.push((s.text.clone(), l.ink.len(), spaced));
-        l.ops.push(s.op);
-        l.ops.extend(s.extra_ops.iter().copied());
-        l.decodable &= s.decodable;
-        l.visual_order |= s.visual_order;
-        l.actual_text |= s.actual_text;
-        l.clips |= s.state.render_mode >= 4;
-        if l.unreadable_mode.is_none() {
-            l.unreadable_mode = s.state.unreadable.as_deref().map(str::to_owned);
-        }
-    } else {
-        lines.push(TextLine {
-            text: s.text.clone(),
-            rect: s.rect,
-            frame: s.frame,
-            ink: s.ink.clone(),
-            font: String::from_utf8_lossy(&s.font).into_owned(),
-            base_font: s.base_font.clone(),
-            size: s.size,
-            bold: s.bold,
-            italic: s.italic,
-            color: fill_color(&s.state.fill),
-            decodable: s.decodable,
-            visual_order: s.visual_order,
-            face: s.face.clone(),
-            stream,
-            scope: s.scope,
-            paint: s.paint.clone(),
-            logical_order: s.logical_order,
-            actual_text: s.actual_text,
-            clips: s.state.render_mode >= 4,
-            unreadable_mode: s.state.unreadable.as_deref().map(str::to_owned),
-            runs: vec![(s.text.clone(), s.ink.len(), false)],
-            ops: std::iter::once(s.op).chain(s.extra_ops.iter().copied()).collect(),
-            origin: Origin {
-                tm: s.tm.0,
-                tlm: s.tlm.0,
-                k: (s.tm.then(&s.state.ctm).0[2].powi(2) + s.tm.then(&s.state.ctm).0[3].powi(2)).sqrt(),
-                ctm: s.state.ctm.0,
-                baseline: s.baseline,
-                x: s.start_x,
-                state: TextState::of(&s.state),
-                bt_op: s.bt_op,
-                bt_state: TextState::of(&s.bt_state),
-            },
-        });
-    }
-    *last = Some(Pen::after(&s));
-}
-
-/// How deep form XObjects nest before reading stops (they may also refer to themselves). The
-/// renderer stops at the same depth, so export reads the text the page shows (#3120).
-pub const MAX_FORM_DEPTH: usize = 50;
-
-/// The most form XObjects one page's walk enters, at any depth. The depth cap alone still lets
-/// a form that draws another form many times fan out exponentially (100 `Do`s on each of 50
-/// levels), which would hang export on a hostile PDF. The renderer paints as many forms nested
-/// in forms; this budget also counts the forms the page draws itself, so a page that draws one
-/// a million times stays bounded too. A label or table cell drawn as a form a few thousand
-/// times is read in full (#3120).
-pub const MAX_FORM_VISITS: usize = 50_000;
-
-/// One page's walk through the form XObjects it draws: how many it entered (the page's
-/// [`MAX_FORM_VISITS`]), the bytes the page's content and forms may still decode to, and whether
-/// a limit left a form unread.
-pub(crate) struct FormBudget {
-    visits: usize,
-    decode: DecodeBudget,
-    /// A form was left unread because it nests deeper than [`MAX_FORM_DEPTH`], comes past
-    /// [`MAX_FORM_VISITS`] or past the decode budget: what it draws is missing from the walk.
-    pub(crate) truncated: bool,
-}
-
-impl FormBudget {
-    /// The walk of a page's forms, spending what `decode` has left after the page's content.
-    pub(crate) fn new(decode: DecodeBudget) -> Self {
-        Self { visits: 0, decode, truncated: false }
-    }
-}
-
-/// A form XObject a page draws: its object, content, resources and its matrix composed with the
-/// CTM at the `Do`.
-pub(crate) struct FormCall {
-    pub(crate) obj: Option<pdfcraft_cos::ObjRef>,
-    pub(crate) data: Vec<u8>,
-    pub(crate) resources: Dict,
-    pub(crate) ctm: Matrix,
-}
-
-/// The form XObject `name` in `resources`, drawn with `ctm`. `None` for images, missing names
-/// and forms already being read (`path`), and for forms nested too deep or past the page's
-/// budget, which `budget` records as truncated; each form entered counts one visit.
-pub(crate) fn form_call(
-    doc: &Document,
-    resources: &Dict,
-    name: &[u8],
-    ctm: Matrix,
-    path: &[pdfcraft_cos::ObjRef],
-    budget: &mut FormBudget,
-) -> Option<FormCall> {
-    let limited = path.len() >= MAX_FORM_DEPTH || budget.visits >= MAX_FORM_VISITS || budget.decode.remaining() == 0;
-    // Once a limit has cut the page short, refusing the rest costs nothing more.
-    if limited && budget.truncated {
-        return None;
-    }
-    let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned())?;
-    let o = xobjects.get(name)?;
-    let obj = o.as_ref();
-    if obj.is_some_and(|r| path.contains(&r)) {
-        return None;
-    }
-    let Object::Stream(s) = &*doc.resolve(o) else { return None };
-    if s.dict.name(b"Subtype") != Some(b"Form") {
-        return None;
-    }
-    // Only a form left unread loses content; an image at the limit is still read by its caller.
-    if limited {
-        budget.truncated = true;
-        return None;
-    }
-    let m = s.dict.get(b"Matrix").map(|m| doc.resolve(m)).and_then(|m| {
-        let a = m.as_array()?;
-        let v: Vec<f64> = a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect();
-        <[f64; 6]>::try_from(v).ok().filter(|v| v.iter().all(|x| x.is_finite()))
-    });
-    // A form without its own resources uses the ones it was drawn with (PDF 1.1 files).
-    let own = s.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned());
-    let data = match budget.decode.decode(s) {
-        Ok(data) => data,
-        Err(_) if budget.decode.remaining() == 0 => {
-            budget.truncated = true;
-            return None;
-        }
-        Err(_) => Vec::new(),
-    };
-    budget.visits = budget.visits.saturating_add(1);
-    Some(FormCall { obj, data, resources: own.unwrap_or_else(|| resources.clone()), ctm: m.map_or(ctm, |m| Matrix(m).then(&ctm)) })
-}
-
-/// The lines a page shows as it reads, including text drawn by form XObjects (which
-/// [`text_lines`] leaves out because it can only rewrite the page's own streams). Lines from a
-/// form carry a stream number past the page's streams, one per form drawn. The flag is `true`
-/// when forms past [`MAX_FORM_DEPTH`] or [`MAX_FORM_VISITS`] were left unread.
-fn reading_lines(doc: &Document, page: usize) -> Result<(Vec<TextLine>, bool), EditError> {
-    struct Walk<'a> {
-        doc: &'a Document,
-        lines: Vec<TextLine>,
-        next_stream: usize,
-        path: Vec<pdfcraft_cos::ObjRef>,
-        budget: FormBudget,
-    }
-    /// `stream` gives the stream number of the operator at an index of `ops`.
-    fn walk(w: &mut Walk, ops: &[Op], resources: &Dict, carry: &mut Carry, stream: &dyn Fn(usize) -> usize) -> Result<(), EditError> {
-        let mut cache = HashMap::new();
-        let mut invoked = Vec::new();
-        let properties = resources.get(b"Properties").and_then(|o| w.doc.dict(o)).unwrap_or_default();
-        let shown = interpret(w.doc, ops, resources, &mut cache, carry, Some(&mut invoked), Some(&properties))?;
-        let mut last = None;
-        let mut last_stream = None;
-        let mut forms = invoked.into_iter().peekable();
-        for s in shown {
-            while let Some((_, name, ts)) = forms.next_if(|f| f.0 < s.op) {
-                enter(w, resources, &name, ts, &mut carry.text_left)?;
-                // Text after a form starts a new line.
-                last = None;
-            }
-            let si = stream(s.op);
-            // Text from another stream starts a new line, as when each stream was read alone.
-            if last_stream.replace(si).is_some_and(|prev| prev != si) {
-                last = None;
-            }
-            add_shown(&mut w.lines, &mut last, s, si);
-        }
-        for (_, name, ts) in forms {
-            enter(w, resources, &name, ts, &mut carry.text_left)?;
-        }
-        Ok(())
-    }
-    /// `text_left`: the page's text budget, shared with the forms the page draws.
-    fn enter(w: &mut Walk, resources: &Dict, name: &[u8], ts: Ts, text_left: &mut usize) -> Result<(), EditError> {
-        let Some(form) = form_call(w.doc, resources, name, ts.ctm, &w.path, &mut w.budget) else { return Ok(()) };
-        let ops = parse(&form.data).ops;
-        // The form starts with the graphics state at its `Do`, its own matrix applied.
-        let mut carry = Carry { ts: Ts { ctm: form.ctm, ..ts }, stack: Vec::new(), marked: Vec::new(), layers: Vec::new(), text_left: *text_left };
-        let stream = w.next_stream;
-        w.next_stream = w.next_stream.saturating_add(1);
-        if let Some(r) = form.obj {
-            w.path.push(r);
-        }
-        walk(w, &ops, &form.resources, &mut carry, &|_| stream)?;
-        *text_left = carry.text_left;
-        if form.obj.is_some() {
-            w.path.pop();
-        }
-        Ok(())
-    }
-    let p = page_dict(doc, page)?;
-    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    let mut decode = DecodeBudget::page();
-    let streams = content_streams_within(doc, &p.dict, &mut decode)?;
-    let mut w = Walk { doc, lines: Vec::new(), next_stream: streams.len(), path: Vec::new(), budget: FormBudget::new(decode) };
-    let mut carry = Carry::new();
-    // Read the page's streams as the one stream they are, in one pass, as rendering and editing
-    // do: a comment, an operator's operands or a marked-content sequence (its /ActualText too)
-    // can run on from one stream into the next. Text still counts as the stream its operator
-    // starts in, which keeps lines from different streams apart.
-    let pieces = Pieces::join(&streams.into_iter().map(|(_, data)| data).collect::<Vec<_>>());
-    let ops = pieces.parse().ops;
-    let stream_of = |i: usize| ops.get(i).map_or(0, |op| pieces.pieces_of(op).0);
-    walk(&mut w, &ops, &res, &mut carry, &stream_of)?;
-    let mut lines = w.lines;
-    // A visual-order Indic font draws pre-base vowel signs before their consonant.
-    for l in lines.iter_mut().filter(|l| l.visual_order && !l.actual_text) {
-        let shown = l.text.clone();
-        l.text = crate::indic::to_logical(&l.text);
-        if l.text != shown {
-            l.runs.clear();
-        }
-    }
-    lines.retain(|l| !l.text.trim().is_empty());
-    Ok((lines, w.budget.truncated))
-}
-
-/// Text → the runs that show it: each run's font resource name and the bytes shown in that font.
-type Encoder = Box<dyn Fn(&str) -> Option<Vec<(String, Vec<u8>)>>>;
-
-fn is_win_ansi_char(c: char) -> bool {
-    c == '\t' || pdfcraft_fonts::win_ansi_byte(c).is_some()
-}
-
-fn needs_type3(text: &str) -> bool {
-    text.chars().any(|c| !is_win_ansi_char(c))
-}
-
-/// The `/Name` of the Type 3 fonts generated for Japanese text.
-const JAPANESE_FONT_NAME: &str = "PCJapanese";
-/// The `/Name` of the Type 3 fonts generated for Hebrew text.
-const HEBREW_FONT_NAME: &str = "PCHebrew";
-/// The `/Name` of the Type 3 fonts generated from the bundled Latin (Inter) face.
-const LATIN_FONT_NAME: &str = "PCLatin";
-
-/// Whether `font` is one of those generated fonts (Latin, Japanese or Hebrew): a replacement longer
-/// than one of them is split across several, which read back as one line (see [`same_font`]).
-fn is_type3_fallback(font: &Dict) -> bool {
-    font.name(b"Subtype") == Some(b"Type3")
-        && font
-            .name(b"Name")
-            .is_some_and(|n| n == JAPANESE_FONT_NAME.as_bytes() || n == HEBREW_FONT_NAME.as_bytes() || n == LATIN_FONT_NAME.as_bytes())
-}
-
-/// The generated font's `/Name` and its resource prefix: the bundled Latin face, Hebrew, or the
-/// Japanese ones.
-fn fallback_names(face: &CraftFont, hebrew: bool) -> (&'static str, &'static str) {
-    if hebrew {
-        (HEBREW_FONT_NAME, "PCHe")
-    } else if face.family == "Inter" {
-        (LATIN_FONT_NAME, "PCLat")
-    } else {
-        (JAPANESE_FONT_NAME, "PCJp")
-    }
-}
-
-/// Drops the generated fallback fonts ([`is_type3_fallback`]) that nothing on `page` shows any more.
-/// Each rewrite generates its own, with the outlines of every character it draws, so without this
-/// an earlier rewrite's fonts stay in the page's resources and the file. Only a font dictionary the
-/// page owns is changed (a rewrite gives the page its own), and nothing is dropped unless every
-/// content stream that may name the page's fonts can be read: the page's own, and those of form
-/// XObjects and Type 3 glyphs that have no resources of their own and so use the page's.
-fn drop_unused_fallback_fonts(doc: &mut Document, page: usize) {
-    let Ok(p) = page_dict(doc, page) else { return };
-    let Some(Object::Dict(mut resources)) = p.dict.get(b"Resources").cloned() else { return };
-    let Some(mut fonts) = resources.get(b"Font").and_then(|f| doc.dict(f)) else { return };
-    let generated: Vec<Vec<u8>> =
-        fonts.iter().filter(|(_, f)| doc.dict(f).is_some_and(|d| is_type3_fallback(&d))).map(|(name, _)| name.clone()).collect();
-    if generated.is_empty() {
-        return;
-    }
-    let Some(shown) = fonts_shown(doc, &p.dict, &resources) else { return };
-    let unused: Vec<&Vec<u8>> = generated.iter().filter(|name| !shown.contains(*name)).collect();
-    if unused.is_empty() {
-        return;
-    }
-    for name in unused {
-        fonts.remove(name);
-    }
-    resources.set(b"Font".to_vec(), Object::Dict(fonts));
-    // Nothing is lost if this fails: the fonts just stay.
-    let _ = doc.update_dict(p.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources)));
-}
-
-/// The font resource names `Tf` selects in the page's content and in the content that uses the
-/// page's resources (see [`drop_unused_fallback_fonts`]), or `None` if any of it can't be read.
-fn fonts_shown(doc: &Document, page: &Dict, resources: &Dict) -> Option<std::collections::HashSet<Vec<u8>>> {
-    let mut streams: Vec<Object> = match page.get(b"Contents") {
-        None => Vec::new(),
-        Some(c) => match &*doc.resolve(c) {
-            Object::Array(a) => a.clone(),
-            _ => vec![c.clone()],
-        },
-    };
-    // Form XObjects without their own resources use the page's, however deeply they are nested
-    // (ISO 32000-1 §7.8.3), so every form the page can reach is visited.
-    let mut pending: Vec<Dict> = vec![resources.clone()];
-    let mut seen = std::collections::HashSet::new();
-    while let Some(res) = pending.pop() {
-        for (_, x) in res.get(b"XObject").and_then(|x| doc.dict(x)).unwrap_or_default().iter() {
-            let Some(r) = x.as_ref() else { continue };
-            if !seen.insert(r) {
-                continue;
-            }
-            if seen.len() > 4096 {
-                return None;
-            }
-            let Object::Stream(s) = &*doc.get(r) else { continue };
-            if s.dict.name(b"Subtype") != Some(b"Form") {
-                continue;
-            }
-            match s.dict.get(b"Resources").and_then(|r| doc.dict(r)) {
-                Some(own) => pending.push(own),
-                None => streams.push(x.clone()),
-            }
-        }
-    }
-    // And so do Type 3 glyph procedures without their own (the generated fonts' are outlines only).
-    for (_, f) in resources.get(b"Font").and_then(|f| doc.dict(f)).unwrap_or_default().iter() {
-        if let Some(font) = doc.dict(f).filter(|d| d.name(b"Subtype") == Some(b"Type3") && !d.contains(b"Resources") && !is_type3_fallback(d)) {
-            streams.extend(font.get(b"CharProcs").and_then(|c| doc.dict(c)).unwrap_or_default().iter().map(|(_, proc)| proc.clone()));
-        }
-    }
-    let mut shown = std::collections::HashSet::new();
-    for stream in streams {
-        let Object::Stream(s) = &*doc.resolve(&stream) else { return None };
-        // Strict: a stream only partly read might name a font in the part that wasn't.
-        let data = s.decoded_strict().ok()?;
-        for op in parse(&data).ops {
-            if op.is("Tf")
-                && let Some(name) = op.operands.first().and_then(|n| n.as_name())
-            {
-                shown.insert(name.to_vec());
-            }
-        }
-    }
-    Some(shown)
-}
-
-/// Whether a run shown in `font` (a resource name), with `/BaseFont` `base_font` and the Japanese
-/// or Hebrew fallback face it subsets, if any, continues `line`: the same font resource, another
-/// resource for the same font (a writer may split one font into several subsets, #3661), or
-/// another subset of the same face.
-fn same_font(line: &TextLine, font: &[u8], base_font: &str, face: Option<&str>) -> bool {
-    line.font.as_bytes() == font || same_base_font(&line.base_font, base_font) || (line.face.is_some() && line.face.as_deref() == face)
-}
-
-/// Whether a run painted with `ts` continues `line` as it is painted: a line is rewritten in the
-/// state of its first run, so a `Tr`, stroke colour or line width that changes partway starts
-/// another run (see [`TextState::paint_ops`]; the `gs` parameters are compared as [`Paint`]).
-/// The stroke colour, width, dash and cap only count for text that is stroked, so a rule drawn
-/// between two words doesn't split their line. They are compared as values, wherever they were
-/// set: two ExtGStates with the same settings under other names still continue a line.
-///
-/// Only the visible modes (`Tr` 0–2) that `paint_ops` restates are compared: a line that goes on
-/// as invisible or clipping text stays one line, which the clipping refusal reads whole (#3447).
-fn same_paint(line: &TextLine, ts: &Ts) -> bool {
-    let a = &line.origin.state;
-    let visible = |m: i64| (0..=2).contains(&m);
-    let same_mode = a.render_mode == ts.render_mode || !visible(a.render_mode) || !visible(ts.render_mode);
-    let stroked = matches!((a.render_mode, ts.render_mode), (1 | 2, 1 | 2));
-    let outline = a.stroke == ts.stroke && a.line_width == ts.line_width && a.dash == ts.dash && a.line_cap == ts.line_cap;
-    same_mode && (!stroked || outline)
-}
-
-/// Whether two `/BaseFont` names name the same font: a subset's six-letter tag and `+` prefix do
-/// not change the font (ISO 32000-2 §9.6.4), so `ABCDEF+Arial` and `GHIJKL+Arial` are one font.
-/// A name that is missing, or only a tag (`ABCDEF+`), names no font and matches nothing.
-fn same_base_font(a: &str, b: &str) -> bool {
-    let (a, b) = (strip_subset_tag(a), strip_subset_tag(b));
-    !a.is_empty() && a == b
-}
-
-/// `ABCDEF+Arial` → `Arial`. A name without a subset tag is returned unchanged.
-fn strip_subset_tag(name: &str) -> &str {
-    let bytes = name.as_bytes();
-    let is_tag = bytes.get(6) == Some(&b'+') && bytes.get(..6).is_some_and(|tag| tag.iter().all(u8::is_ascii_uppercase));
-    if is_tag { name.get(7..).unwrap_or(name) } else { name }
-}
-
-fn source_family(base_font: &str) -> crate::added::Family {
-    let name = base_font.to_ascii_lowercase();
-    if ["courier", "mono", "consolas", "menlo", "monaco", "lucida console"].iter().any(|s| name.contains(s)) {
-        crate::added::Family::Courier
-    } else if !name.contains("sans")
-        && ["times", "serif", "roman", "mincho", "cambria", "georgia", "palatino", "garamond"].iter().any(|s| name.contains(s))
-    {
-        crate::added::Family::Times
-    } else {
-        crate::added::Family::Helvetica
-    }
-}
-
-const MAX_TYPE3_GLYPHS: usize = 240;
-
-/// The generated fonts for one replacement: one per run of at most `max_glyphs` unique characters,
-/// in order of first appearance.
-#[derive(Clone)]
-struct Type3Fallback {
-    /// The family its glyphs come from ("Shippori Mincho").
-    family: &'static str,
-    /// The fonts' resource names in order; the first is `PCJp` (`PCLat` for the bundled Latin
-    /// face, `PCHe` for Hebrew text).
-    names: Vec<String>,
-    /// Every unique character with its advance (em), in order of first appearance.
-    widths: Vec<(char, f64)>,
-    /// Where each character is shown: the index of its font in `names`, and its code there.
-    codes: HashMap<char, (usize, u8)>,
-}
-
-/// One glyph of a generated font: its code there, its character, its glyph procedure and advance.
-struct Type3Glyph {
-    code: u8,
-    ch: char,
-    path: Vec<u8>,
-    width: f64,
-}
-
-fn pdf_num(v: f64) -> String {
-    if v.fract() == 0.0 { format!("{v:.0}") } else { format!("{v:.4}").trim_end_matches('0').trim_end_matches('.').to_string() }
-}
-
-fn type3_path(face: &CraftFont, ch: char) -> Result<(Vec<u8>, f64), EditError> {
-    let glyph = japanese_glyph_from(face, ch).map_err(|e| match e {
-        GlyphError::NoFont => no_japanese_font(),
-        GlyphError::Missing => EditError::Invalid(format!("the {} fallback font has no glyph for U+{:04X}", face.family, ch as u32)),
-        GlyphError::TooComplex => EditError::Invalid(format!("the {} fallback glyph U+{:04X} is too complex", face.family, ch as u32)),
-    })?;
-    let (dx, width) = proportional(ch, &glyph);
-    let scale = 1000.0;
-    // d1 is `wx wy llx lly urx ury` (ISO 32000-2 §9.6.4) with a box enclosing the glyph;
-    // Acrobat draws a bullet in place of a glyph whose d1 is malformed.
-    let b = if glyph.contours.is_empty() { [0.0; 4] } else { glyph.bbox };
-    let mut out = format!(
-        "{} 0 {} {} {} {} d1\n",
-        pdf_num(width * scale),
-        pdf_num(((b[0] + dx) * scale).floor()),
-        pdf_num((b[1] * scale).floor()),
-        pdf_num(((b[2] + dx) * scale).ceil()),
-        pdf_num((b[3] * scale).ceil())
-    )
-    .into_bytes();
-    for contour in glyph.contours {
-        let Some(first) = contour.first() else { continue };
-        out.extend_from_slice(format!("{} {} m\n", pdf_num((first[0] + dx) * scale), pdf_num(first[1] * scale)).as_bytes());
-        for p in contour.iter().skip(1) {
-            out.extend_from_slice(format!("{} {} l\n", pdf_num((p[0] + dx) * scale), pdf_num(p[1] * scale)).as_bytes());
-        }
-        out.extend_from_slice(b"h\n");
-    }
-    out.extend_from_slice(b"f\n");
-    Ok((out, width))
-}
-
-/// Side bearing (em) given to a respaced glyph on each side.
-const SIDE_BEARING: f64 = 0.05;
-
-/// Shift and advance for a fallback glyph. Japanese faces draw Cyrillic and Greek full-width
-/// (one em each, as in JIS X 0208) and have no proportional (`palt`) metrics for them, so a
-/// word set that way reads as letter-spaced. Those letters get their ink width plus a side
-/// bearing instead; everything else keeps the face's own advance.
-fn proportional(ch: char, glyph: &pdfcraft_fonts::GlyphOutline) -> (f64, f64) {
-    let respace = matches!(ch, '\u{0370}'..='\u{03FF}' | '\u{0400}'..='\u{052F}' | '\u{1F00}'..='\u{1FFF}');
-    let ink = glyph.bbox[2] - glyph.bbox[0];
-    if !respace || glyph.contours.is_empty() || !(ink > 0.0 && ink < glyph.width) {
-        return (0.0, glyph.width);
-    }
-    (SIDE_BEARING - glyph.bbox[0], ink + 2.0 * SIDE_BEARING)
-}
-
-fn unicode_hex(ch: char) -> String {
-    let mut units = [0u16; 2];
-    let encoded = ch.encode_utf16(&mut units);
-    encoded.iter().map(|u| format!("{u:04X}")).collect()
-}
-
-/// The same outline for a face that may simply lack the glyph: `None` then, so the caller can try
-/// the next face (and report the character once none of them has it).
-fn type3_glyph(face: &CraftFont, ch: char) -> Result<Option<(Vec<u8>, f64)>, EditError> {
-    match japanese_glyph_from(face, ch) {
-        Err(GlyphError::Missing) => Ok(None),
-        _ => type3_path(face, ch).map(Some),
-    }
-}
-
-/// No face this build has can draw `text`. Only Japanese text is about the Japanese face: other
-/// characters are missing from the paragraph's font, and choosing a font that has them works too.
-fn no_fallback_font(text: &str) -> EditError {
-    if text.chars().any(needs_japanese) {
-        return no_japanese_font();
-    }
-    let Some(ch) = text.chars().find(|c| !c.is_whitespace() && !is_win_ansi_char(*c)) else { return no_japanese_font() };
-    EditError::Invalid(format!(
-        "the paragraph's font has no glyph for {ch} (U+{:04X}) and this build has no fallback font for it; \
-         choose a font that has it (Load font… or Installed fonts…), or use an official release, which includes \
-         PdfCraft's fallback fonts (to build them in, set CRAFT_FONTS_DIR to a craft-fonts checkout)",
-        u32::from(ch)
-    ))
-}
-
-/// The character the craft-fonts Japanese faces are for: kana, CJK ideographs and their compatibility
-/// and full-width forms.
-fn needs_japanese(ch: char) -> bool {
-    matches!(u32::from(ch), 0x3000..=0x30FF | 0x3400..=0x4DBF | 0x4E00..=0x9FFF | 0xF900..=0xFAFF | 0xFF00..=0xFFEF)
-}
-
-/// The chosen face has no outline for `ch`, and neither has any other: say which character it is and
-/// what the writer can do about it. A CJK character without a Japanese face in the build is about
-/// that build input, which is the one answer that changes it.
-fn no_glyph_for(face: &CraftFont, ch: char) -> EditError {
-    if needs_japanese(ch) && pdfcraft_fonts::document_japanese_font().is_none() {
-        return no_japanese_font();
-    }
-    EditError::Invalid(format!(
-        "the {} fallback font has no glyph for {ch} (U+{:04X}), and no fallback face covers the text; \
-         choose a font that has it (Load font… or Installed fonts…), or use an official release, which includes \
-         PdfCraft's fallback fonts (to build them in, set CRAFT_FONTS_DIR to a craft-fonts checkout)",
-        face.family,
-        u32::from(ch)
-    ))
-}
-
-/// This build has no Japanese face to draw replacement text with.
-fn no_japanese_font() -> EditError {
-    EditError::Invalid(
-        "this text needs PdfCraft's Japanese fallback font, which this build doesn't include \
-         (official releases do; to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout)"
-            .into(),
-    )
-}
-
-/// The first of `faces` (best match first) that has a glyph for every one of `chars`, else the first.
-fn fallback_face<'a>(faces: &[&'a CraftFont], chars: &[char], has_glyph: impl Fn(&CraftFont, char) -> bool) -> Option<&'a CraftFont> {
-    faces.iter().copied().find(|face| chars.iter().all(|ch| has_glyph(face, *ch))).or_else(|| faces.first().copied())
-}
-
-/// This build has no Hebrew face to draw replacement text with.
-fn no_hebrew_font() -> EditError {
-    EditError::Invalid(
-        "this text needs PdfCraft's Hebrew fallback font (Noto Sans Hebrew), which this build doesn't include \
-         (to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout that has it)"
-            .into(),
-    )
-}
-
-/// The faces a Type 3 replacement may draw `text` with, best first. Text with Hebrew takes the
-/// Hebrew face first (its Latin and digits too, so a line keeps one look), then the Japanese faces
-/// and the bundled Latin one for anything it lacks; other text takes the Japanese faces, and the
-/// bundled Latin face behind them, which covers the Latin, Greek and Cyrillic letters they lack
-/// (#2593: the Japanese faces have no қ, ғ, ҳ, ә, ө, ү, ұ or һ).
-fn type3_faces(text: &str, family: crate::added::Family, bold: bool) -> Result<(Vec<&'static CraftFont>, bool), EditError> {
-    let japanese = pdfcraft_fonts::document_japanese_fonts_for_style(family == crate::added::Family::Times, bold);
-    let latin = pdfcraft_fonts::document_latin_fonts(bold);
-    if !text.chars().any(crate::bidi::is_hebrew) {
-        return Ok((japanese.into_iter().chain(latin).collect(), false));
-    }
-    // Points are drawn on their letter with the font's positioning, which a one-glyph-per-
-    // character Type 3 font can't do; refuse rather than print them beside the letter.
-    if text.chars().any(crate::bidi::is_hebrew_mark) {
-        return Err(EditError::Invalid("Hebrew points (niqqud) can't be written into a PDF yet; type the text without them".into()));
-    }
-    let hebrew = pdfcraft_fonts::document_hebrew_font(bold).ok_or_else(no_hebrew_font)?;
-    Ok((std::iter::once(hebrew).chain(japanese).chain(latin).collect(), true))
-}
-
-fn type3_font(
-    doc: &mut Document,
-    fonts_res: &mut Dict,
-    text: &str,
-    family: crate::added::Family,
-    bold: bool,
-    max_glyphs: usize,
-) -> Result<Type3Fallback, EditError> {
-    let (faces, hebrew) = type3_faces(text, family, bold)?;
-    // Each unique character once, in order of first appearance.
-    let mut chars = Vec::new();
-    let mut seen = std::collections::HashSet::new();
-    for ch in text.chars() {
-        if seen.insert(ch) {
-            chars.push(ch);
-        }
-    }
-    if chars.is_empty() {
-        return Err(EditError::Invalid("replacement text is empty".into()));
-    }
-    // The faces differ in coverage (e.g. of Cyrillic), so use the best face that has every
-    // character. When none has them all, the best face reports the character it lacks. Hebrew
-    // text keeps the Hebrew face and takes each character it lacks from the next face that has it.
-    let face = if hebrew { faces.first().copied() } else { fallback_face(&faces, &chars, |face, ch| japanese_glyph_from(face, ch).is_ok()) }
-        .ok_or_else(|| no_fallback_font(text))?;
-    let others: &[&CraftFont] = if hebrew { faces.get(1..).unwrap_or_default() } else { &[] };
-    // Every outline is read before the document is touched, so a character that fails leaves it
-    // as it was. Each font takes the next `per_font` characters; codes restart at 1 in each.
-    let per_font = max_glyphs.clamp(1, MAX_TYPE3_GLYPHS);
-    let mut glyphs = Vec::with_capacity(chars.len());
-    for (i, ch) in chars.into_iter().enumerate() {
-        // The chosen face first, then the faces after it (Hebrew text takes a character the Hebrew
-        // face lacks from the next face that has it); a character no face draws is reported once.
-        let mut drawn = type3_glyph(face, ch)?;
-        for f in others.iter().copied() {
-            if drawn.is_some() {
-                break;
-            }
-            drawn = type3_glyph(f, ch)?;
-        }
-        let Some((path, width)) = drawn else { return Err(no_glyph_for(face, ch)) };
-        let code = u8::try_from((i % per_font).saturating_add(1))
-            .map_err(|_| EditError::Invalid("replacement text has too many unique characters".into()))?;
-        glyphs.push(Type3Glyph { code, ch, path, width });
-    }
-    Ok(write_type3_glyphs(doc, fonts_res, face, hebrew, glyphs, per_font))
-}
-
-/// Write already validated outlines; callers can prepare every face before adding any objects.
-fn write_type3_glyphs(
-    doc: &mut Document,
-    fonts_res: &mut Dict,
-    face: &CraftFont,
-    hebrew: bool,
-    glyphs: Vec<Type3Glyph>,
-    per_font: usize,
-) -> Type3Fallback {
-    let per_font = per_font.clamp(1, MAX_TYPE3_GLYPHS);
-    let mut codes = HashMap::with_capacity(glyphs.len());
-    let mut widths = Vec::with_capacity(glyphs.len());
-    let mut names = Vec::new();
-    let mut glyphs = glyphs.into_iter();
-    loop {
-        let group: Vec<Type3Glyph> = glyphs.by_ref().take(per_font).collect();
-        if group.is_empty() {
-            break;
-        }
-        for glyph in &group {
-            codes.insert(glyph.ch, (names.len(), glyph.code));
-            widths.push((glyph.ch, glyph.width));
-        }
-        names.push(add_type3_font(doc, fonts_res, face, hebrew, group));
-    }
-    Type3Fallback { family: face.family, names, widths, codes }
-}
-
-/// Adds one generated font whose codes 1 to `glyphs.len()` show `glyphs`, and returns its resource
-/// name (`PCLat`, `PCJp`, then `PCJp1`, ...; `PCHe`, ... for Hebrew text). Nothing here can fail: the
-/// outlines were read already.
-fn add_type3_font(doc: &mut Document, fonts_res: &mut Dict, face: &CraftFont, hebrew: bool, glyphs: Vec<Type3Glyph>) -> String {
-    let last_char = glyphs.len();
-    let mut charprocs = Dict::new();
-    let mut widths = Vec::with_capacity(last_char);
-    let mut differences = vec![Object::Int(1)];
-    let mut cmap = String::from(
-        "/CIDInit /ProcSet findresource begin\n12 dict begin\nbegincmap\n/CMapType 2 def\n1 begincodespacerange\n<01> <FF>\nendcodespacerange\n",
-    );
-    cmap.push_str(&format!("{last_char} beginbfchar\n"));
-    for glyph in glyphs {
-        let glyph_name = format!("g{:02X}", glyph.code);
-        let mut pd = Dict::new();
-        pd.set(b"Length".to_vec(), glyph.path.len() as i64);
-        let proc_ref = doc.add(Object::Stream(Stream::from_raw(pd, glyph.path)));
-        charprocs.set(glyph_name.as_bytes().to_vec(), Object::Ref(proc_ref));
-        differences.push(Object::name(&glyph_name));
-        widths.push(Object::Real((glyph.width * 1000.0).round()));
-        cmap.push_str(&format!("<{:02X}> <{}>\n", glyph.code, unicode_hex(glyph.ch)));
-    }
-    cmap.push_str("endbfchar\nendcmap\nCMapName currentdict /CMap defineresource pop\nend\nend\n");
-    let mut cmap_dict = Dict::new();
-    cmap_dict.set(b"Length".to_vec(), cmap.len() as i64);
-    let cmap_ref = doc.add(Object::Stream(Stream::from_raw(cmap_dict, cmap.into_bytes())));
-    let mut encoding = Dict::new();
-    encoding.set(b"Type".to_vec(), Object::name("Encoding"));
-    encoding.set(b"Differences".to_vec(), Object::Array(differences));
-    let mut font = Dict::new();
-    font.set(b"Type".to_vec(), Object::name("Font"));
-    font.set(b"Subtype".to_vec(), Object::name("Type3"));
-    let (font_name, prefix) = fallback_names(face, hebrew);
-    font.set(b"Name".to_vec(), Object::name(font_name));
-    let mut descriptor = Dict::new();
-    descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
-    descriptor.set(b"FontName".to_vec(), Object::name(&format!("{}-{}", face.family, face.style).replace(' ', "")));
-    descriptor.set(b"FontFamily".to_vec(), Object::String(PdfString::literal(face.family.as_bytes().to_vec())));
-    descriptor.set(b"Flags".to_vec(), Object::Int(if face.family.contains("Mincho") { 6 } else { 4 }));
-    descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
-    // PDF 1.7 tables 5.9 and 5.19: a Type 3 descriptor is indirect; Ascent/Descent may be omitted.
-    font.set(b"FontDescriptor".to_vec(), Object::Ref(doc.add(Object::Dict(descriptor))));
-    font.set(b"FontBBox".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(-300), Object::Int(1000), Object::Int(1000)]));
-    font.set(
-        b"FontMatrix".to_vec(),
-        Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
-    );
-    font.set(b"FirstChar".to_vec(), Object::Int(1));
-    font.set(b"LastChar".to_vec(), Object::Int(last_char as i64));
-    font.set(b"Widths".to_vec(), Object::Array(widths));
-    font.set(b"Encoding".to_vec(), Object::Dict(encoding));
-    font.set(b"CharProcs".to_vec(), Object::Dict(charprocs));
-    font.set(b"ToUnicode".to_vec(), Object::Ref(cmap_ref));
-    let mut name = String::from(prefix);
-    let mut suffix = 0usize;
-    while fonts_res.contains(name.as_bytes()) {
-        suffix = suffix.saturating_add(1);
-        name = format!("{prefix}{suffix}");
-    }
-    fonts_res.set(name.as_bytes().to_vec(), Object::Dict(font));
-    name
-}
-
-/// The runs that show `text` in the fallback: consecutive characters in one font form one run, so
-/// a font is switched only where the text moves to another font. `None` if a character has no code.
-fn type3_encode(fallback: &Type3Fallback, text: &str) -> Option<Vec<(String, Vec<u8>)>> {
-    let mut runs: Vec<(usize, Vec<u8>)> = Vec::new();
-    for ch in text.chars() {
-        let (font, code) = *fallback.codes.get(&ch)?;
-        match runs.last_mut() {
-            Some((last, bytes)) if *last == font => bytes.push(code),
-            _ => runs.push((font, vec![code])),
-        }
-    }
-    runs.into_iter().map(|(font, bytes)| Some((fallback.names.get(font)?.clone(), bytes))).collect()
-}
-
-/// The source font's own TrueType/OpenType program, when the document embeds a complete one whose
-/// licence allows editable embedding. A subset (an `ABCDEF+` name) is left out: a character can keep
-/// its mapping there after the subsetter dropped its outline.
-fn source_program(doc: &Document, fonts: &Dict, name: &str) -> Option<Vec<u8>> {
-    let font = fonts.get(name.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned())?;
-    let base = Metrics::from_dict(doc, &font).base_font;
-    if base.split_once('+').is_some_and(|(tag, _)| tag.len() == 6 && tag.bytes().all(|b| b.is_ascii_uppercase())) {
-        return None;
-    }
-    let bytes = pdfcraft_fonts::pdf::embedded_sfnt(doc, &font)?;
-    pdfcraft_fonts::embedding::validate(&bytes).is_ok().then_some(bytes)
-}
-
-/// Whether `text` has characters `line`'s font can't encode that its own program can draw.
-fn source_program_completes(doc: &Document, fonts: &Dict, line: &TextLine, text: &str) -> bool {
-    let Some(metrics) = fonts.get(line.font.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|f| Metrics::from_dict(doc, &f)) else {
-        return false;
-    };
-    let missing: String = text.chars().filter(|c| !c.is_whitespace() && !source_encodes(&metrics, &c.to_string())).collect();
-    !missing.is_empty() && source_program(doc, fonts, &line.font).is_some_and(|bytes| pdfcraft_fonts::embedding::covers(&bytes, &missing))
-}
-
-/// A subset may contain all the letters but no space glyph: producers use another subset
-/// or a positioning operator for spaces. Do the same instead of substituting the whole font.
-fn source_encodes(metrics: &Metrics, text: &str) -> bool {
-    text.split(' ').all(|word| metrics.encode(word).is_some())
-}
-
-#[cfg(test)]
-thread_local! {
-    /// How often [`source_space`] ran on this thread, for the test that pins it out of per-character loops.
-    pub(crate) static SOURCE_SPACE_CALLS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-fn source_space(doc: &Document, fonts: &Dict, metrics: &Metrics) -> f64 {
-    #[cfg(test)]
-    SOURCE_SPACE_CALLS.with(|c| c.set(c.get().saturating_add(1)));
-    let width = |m: &Metrics| m.encode(" ").map(|b| m.codes(&b).iter().map(|(c, _)| m.width(*c)).sum::<f64>());
-    if let Some(w) = width(metrics) {
-        return w;
-    }
-    let family = metrics.base_font.rsplit('+').next().unwrap_or(&metrics.base_font);
-    for (_, font) in fonts.iter() {
-        if let Some(dict) = doc.resolve(font).as_dict() {
-            let m = Metrics::from_dict(doc, dict);
-            if m.base_font.rsplit('+').next() == Some(family)
-                && let Some(w) = width(&m)
-            {
-                return w;
-            }
-        }
-    }
-    0.33
-}
-
-fn source_width(metrics: &Metrics, text: &str, size: f64, space: f64, char_spacing: f64, word_spacing: f64) -> f64 {
-    if let Some(bytes) = metrics.encode(text) {
-        // PDF word spacing applies only to single-byte code 32, even for a Unicode space.
-        return metrics
-            .codes(&bytes)
-            .iter()
-            .map(|(c, len)| metrics.width(*c) * size + char_spacing + if metrics.is_space(*c, *len) { word_spacing } else { 0.0 })
-            .sum();
-    }
-    let words: f64 = text
-        .split(' ')
-        .filter_map(|w| metrics.encode(w))
-        .map(|b| metrics.codes(&b).iter().map(|(c, _)| metrics.width(*c) * size + char_spacing).sum::<f64>())
-        .sum();
-    words + text.matches(' ').count() as f64 * (space * size + char_spacing + word_spacing)
-}
-
-fn source_show(metrics: &Metrics, text: &str, size: f64, space: f64, char_spacing: f64, word_spacing: f64) -> Result<Vec<Op>, EditError> {
-    if let Some(bytes) = metrics.encode(text) {
-        return Ok(vec![Op::new("Tj", vec![Object::String(PdfString::literal(bytes))])]);
-    }
-    let adjustment = -1000.0 * (space + (char_spacing + word_spacing) / size);
-    if !adjustment.is_finite() {
-        return Err(EditError::Invalid("the source font's space advance is invalid".into()));
-    }
-    let mut out = Vec::new();
-    for (i, word) in text.split(' ').enumerate() {
-        if i > 0 {
-            out.push(Op::new("TJ", vec![Object::Array(vec![pdfcraft_content::num(adjustment)])]));
-        }
-        if !word.is_empty() {
-            let bytes = metrics.encode(word).ok_or_else(|| EditError::Invalid("the source font cannot show the replacement text".into()))?;
-            out.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
-        }
-    }
-    Ok(out)
-}
-
-/// Replace the text of line `line` (an index into [`text_lines`]) on `page` with `text`.
-pub fn replace_line(doc: &mut Document, page: usize, line: usize, text: &str) -> Result<LineEdit, EditError> {
-    let edit = replace_line_with_limit(doc, page, line, text, MAX_TYPE3_GLYPHS)?;
-    drop_unused_fallback_fonts(doc, page);
-    Ok(edit)
-}
-
-/// Refuses a rewrite that would remove text drawn as a clipping path (`4 Tr` to `7 Tr`). Such
-/// glyphs are not ink but a mask, and whatever is painted through them takes their shape.
-/// Removing the glyphs removes the mask, and the fill or image behind floods its own rectangle
-/// instead -- the artwork is destroyed, in a file that still opens without a warning (#3429).
-/// `clear_block` already refuses these for the same reason.
-///
-/// Every line the rewrite drops is checked, not only the one being replaced: a line's runs need
-/// not share a rendering mode (see [`TextLine::clips`]), and [`coincident_ops`] drops a whole
-/// overlapping line without regard to its mode -- so a mask could go with text that is ink.
-fn refuse_clipping_text(lines: &[TextLine], dropped: &std::collections::HashSet<usize>) -> Result<(), EditError> {
-    if lines.iter().any(|l| l.clips && l.ops.iter().any(|op| dropped.contains(op))) {
-        return Err(EditError::Invalid("text used as a clipping path cannot be edited: its glyphs mask the artwork behind them".into()));
-    }
-    Ok(())
-}
-
-/// [`replace_line`] with the most unique characters one generated font may hold (tests lower it).
-pub(crate) fn replace_line_with_limit(doc: &mut Document, page: usize, line: usize, text: &str, max_glyphs: usize) -> Result<LineEdit, EditError> {
-    let text = text.replace(['\n', '\r'], " ");
-    let lines = text_lines(doc, page)?;
-    let target = lines.get(line).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no line {}", page + 1, line + 1)))?;
-    target.ensure_editable()?;
-    // Copies of the line drawn on the same baseline go with it, so the replacement is all that
-    // shows. Which operators go is settled here, before any font is generated, so that a refusal
-    // leaves the document untouched.
-    let mut drops = coincident_ops(&lines, &[&target]);
-    drops.extend(target.ops.iter().copied());
-    refuse_clipping_text(&lines, &drops)?;
-    let p = page_dict(doc, page)?;
-    let mut res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    let mut fonts_res = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
-    let streams = content_streams(doc, &p.dict)?;
-    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
-    let ops = pieces.parse().ops;
-    let first = target.ops.first().copied().filter(|i| *i < ops.len()).ok_or_else(|| EditError::Invalid("the page's content changed".into()))?;
-    // The line's own font, when it can show every character.
-    let font = fonts_res.get(target.font.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|d| Metrics::from_dict(doc, &d));
-    let visual_indic = font.as_ref().is_some_and(|m| m.visual_order) || target.visual_order;
-    let indic_text = if visual_indic { crate::indic::to_visual(&text) } else { text.clone() };
-    // Typed in logical order; drawn left to right (right-to-left runs reversed).
-    let shown = crate::bidi::to_visual(&indic_text);
-    let reused = font.as_ref().filter(|m| source_encodes(m, &shown));
-    let mut substituted = None;
-    let mut replacement: Vec<Op> = Vec::new();
-    // ' and " also move to the next line; keep that.
-    match ops[first].op.as_slice() {
-        b"'" => replacement.push(Op::new("T*", vec![])),
-        b"\"" => {
-            replacement.push(Op::new("Tw", vec![ops[first].operands.first().cloned().unwrap_or(Object::Int(0))]));
-            replacement.push(Op::new("Tc", vec![ops[first].operands.get(1).cloned().unwrap_or(Object::Int(0))]));
-            replacement.push(Op::new("T*", vec![]));
-        }
-        _ => {}
-    }
-    match reused {
-        Some(metrics) => replacement.extend(source_show(
-            metrics,
-            &shown,
-            target.origin.state.font.as_ref().map_or(target.size, |(_, size)| *size),
-            source_space(doc, &fonts_res, metrics),
-            target.origin.state.char_spacing,
-            target.origin.state.word_spacing,
-        )?),
-        None => {
-            let fallback_shown = crate::bidi::to_visual(&text);
-            if needs_type3(&text) {
-                let fallback = type3_font(doc, &mut fonts_res, &text, source_family(&target.base_font), target.bold, max_glyphs)?;
-                let runs = type3_encode(&fallback, &fallback_shown)
-                    .ok_or_else(|| EditError::Invalid(format!("\"{text}\" can't be shown by the {} fallback", fallback.family)))?;
-                let size = font_size_before(&ops, first).unwrap_or(target.size);
-                for (name, bytes) in runs {
-                    replacement.push(Op::new("Tf", vec![Object::name(&name), pdfcraft_content::num(size)]));
-                    replacement.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
-                }
-                replacement.push(Op::new("Tf", vec![Object::name(&target.font), pdfcraft_content::num(size)]));
-                substituted = Some(format!("{} Type3", fallback.family));
-            } else {
-                let win = pdfcraft_fonts::win_ansi(&fallback_shown);
-                // WinAnsi turns what it can't show into '?'; refuse rather than print the wrong thing.
-                let back: String = win.iter().map(|b| char::from_u32(u32::from(*b)).unwrap_or('?')).collect();
-                if fallback_shown.chars().zip(back.chars()).any(|(a, b)| b == '?' && a != '?') {
-                    return Err(EditError::Invalid(format!("\"{text}\" has characters neither {} nor Helvetica can show", target.base_font)));
-                }
-                // The size in text space: the current Tf's size.
-                let size = font_size_before(&ops, first).unwrap_or(target.size);
-                let family = source_family(&target.base_font);
-                let base = family.base_font(target.bold, target.italic);
-                let substitute_name = format!("PCEd{}", base.replace('-', ""));
-                replacement.push(Op::new("Tf", vec![Object::name(&substitute_name), pdfcraft_content::num(size)]));
-                replacement.push(Op::new("Tj", vec![Object::String(PdfString::literal(win))]));
-                replacement.push(Op::new("Tf", vec![Object::name(&target.font), pdfcraft_content::num(size)]));
-                substituted = Some(base.to_string());
-                let mut f = Dict::new();
-                f.set(b"Type".to_vec(), Object::name("Font"));
-                f.set(b"Subtype".to_vec(), Object::name("Type1"));
-                f.set(b"BaseFont".to_vec(), Object::name(base));
-                f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-                fonts_res.set(substitute_name.into_bytes(), Object::Dict(f));
-            }
-        }
-    }
-    // Rebuild: the line's first operator becomes the replacement, its others go.
-    let new_data = splice(&pieces, &ops, |i| if i == first { (std::mem::take(&mut replacement), false) } else { (Vec::new(), !drops.contains(&i)) });
-    let contents = rewritten_contents(doc, &streams, new_data);
-    let page_ref = p.obj;
-    if substituted.is_some() {
-        res.set(b"Font".to_vec(), Object::Dict(fonts_res));
-    }
-    doc.update_dict(page_ref, |d| {
-        d.set(b"Contents".to_vec(), contents);
-        if substituted.is_some() {
-            d.set(b"Resources".to_vec(), Object::Dict(res));
-        }
-    })?;
-    Ok(LineEdit { substituted })
-}
-
-/// The size of the last `Tf` before operator `at`.
-fn font_size_before(ops: &[Op], at: usize) -> Option<f64> {
-    ops[..at].iter().rev().find(|o| o.is("Tf")).and_then(|o| o.num(1))
-}
-
-/// Operators of every line that is another drawing of one of `targets` (fake bold, an invisible
-/// text layer). A surviving copy would show the old text under the replacement.
-///
-/// A copy overlaps a target by more than half the smaller box and sits on the same baseline
-/// (within the tolerance that joins showing operators onto one line). A neighbouring line can
-/// share box area when the leading is tighter than the font's ascent plus descent; its baseline
-/// is farther away, so it stays.
-fn coincident_ops(lines: &[TextLine], targets: &[&TextLine]) -> std::collections::HashSet<usize> {
-    let area = |r: [f64; 4]| ((r[2] - r[0]) * (r[3] - r[1])).max(0.0);
-    let mut drop = std::collections::HashSet::new();
-    for line in lines {
-        let copy = targets.iter().any(|target| {
-            let same_text = line.text.trim() == target.text.trim() || (line.origin.state.render_mode == 3) != (target.origin.state.render_mode == 3);
-            same_text && overlaps_half(line.rect, target.rect, area) && on_same_baseline(line, target)
-        });
-        if copy {
-            drop.extend(line.ops.iter().copied());
-        }
-    }
-    drop
-}
-
-fn overlaps_half(a: [f64; 4], b: [f64; 4], area: impl Fn([f64; 4]) -> f64) -> bool {
-    let ix = (b[2].min(a[2]) - b[0].max(a[0])).max(0.0);
-    let iy = (b[3].min(a[3]) - b[1].max(a[1])).max(0.0);
-    let small = area(b).min(area(a));
-    small > 0.0 && ix * iy / small > 0.5
-}
-
-/// Perpendicular distance between baselines, in user space. Horizontal text compares height;
-/// turned text compares the distance across the writing direction.
-fn on_same_baseline(line: &TextLine, target: &TextLine) -> bool {
-    let (dir, target_dir) = (line.direction(), target.direction());
-    let same_dir = (dir.0 - target_dir.0).abs() < 1e-3 && (dir.1 - target_dir.1).abs() < 1e-3;
-    let same_size = line.size.min(target.size) >= line.size.max(target.size) * 0.8;
-    let angle = target.rotation().to_radians();
-    let (sin, cos) = if angle.is_finite() { angle.sin_cos() } else { (0.0, 1.0) };
-    let dx = line.origin.x - target.origin.x;
-    let dy = line.origin.baseline - target.origin.baseline;
-    let offset = dx.mul_add(-sin, dy * cos).abs();
-    let size = line.size.min(target.size).max(1.0);
-    same_dir && same_size && offset.is_finite() && offset < size * 0.3
-}
-
-/// How a listing of [`text_blocks`] records a paragraph so that it can be found again.
-///
-/// The index of a paragraph is its position in a list regrouped from geometry on every read, so
-/// an edit that merges or splits paragraphs makes the same index name another one (#2516). A key
-/// names the paragraph by what it says and where it is; a paragraph that no longer exists as
-/// such has no match, instead of a neighbour taking its place.
-#[derive(Clone, Debug, PartialEq)]
-pub struct BlockKey {
-    text: String,
-    rect: [f64; 4],
-}
-
-impl BlockKey {
-    /// Two boxes are the same box within this many points.
-    const TOLERANCE: f64 = 0.01;
-
-    pub fn of(block: &TextBlock) -> Self {
-        Self { text: block.text.clone(), rect: block.rect }
-    }
-
-    /// The paragraph's box when it was recorded (user space).
-    pub fn rect(&self) -> [f64; 4] {
-        self.rect
-    }
-
-    /// The paragraph in `blocks` with this text and box. `hint` is tried first, so two
-    /// paragraphs drawn on top of one another are told apart by their order.
-    pub fn find(&self, blocks: &[TextBlock], hint: usize) -> Option<usize> {
-        let matches = |b: &TextBlock| b.text == self.text && b.rect.iter().zip(&self.rect).all(|(a, b)| (a - b).abs() <= Self::TOLERANCE);
-        match blocks.get(hint) {
-            Some(b) if matches(b) => Some(hint),
-            _ => blocks.iter().position(matches),
-        }
-    }
-}
-
-/// The paragraph in `blocks` whose box overlaps `rect` the most, if any overlaps it at all. An
-/// edit rewrites a paragraph in place, so this is the paragraph it became.
-pub fn block_overlapping(blocks: &[TextBlock], rect: [f64; 4]) -> Option<usize> {
-    // `f64::min` and `max` skip a NaN, which would make a box that isn't a number overlap anything.
-    let area = |b: &TextBlock| {
-        if !rect.iter().chain(&b.rect).all(|v| v.is_finite()) {
-            return 0.0;
-        }
-        let w = b.rect[2].min(rect[2]) - b.rect[0].max(rect[0]);
-        let h = b.rect[3].min(rect[3]) - b.rect[1].max(rect[1]);
-        if w > 0.0 && h > 0.0 { w * h } else { 0.0 }
-    };
-    blocks.iter().enumerate().map(|(i, b)| (i, area(b))).filter(|(_, a)| *a > 0.0).max_by(|(_, a), (_, b)| a.total_cmp(b)).map(|(i, _)| i)
-}
-
-/// The paragraphs on a page (0-based).
-pub fn text_blocks(doc: &Document, page: usize) -> Result<Vec<TextBlock>, EditError> {
-    let lines = text_lines(doc, page)?;
-    Ok(group_blocks(&lines))
-}
-
-/// Remove a paragraph's glyphs for a temporary editor background. Numeric TJ adjustments
-/// preserve the text matrix, so unselected text positioned relative to it stays in place.
-/// Call this on a clone: it is a preview operation, not a document edit.
-pub fn clear_block(doc: &mut Document, page: usize, block: usize) -> Result<(), EditError> {
-    let lines = text_lines(doc, page)?;
-    let blocks = group_blocks(&lines);
-    let target = blocks.get(block).ok_or_else(|| EditError::Invalid("the paragraph no longer exists".into()))?;
-    let targets: Vec<&TextLine> = target.lines.iter().filter_map(|i| lines.get(*i)).collect();
-    targets.iter().try_for_each(|line| line.ensure_editable())?;
-    let mut drops = coincident_ops(&lines, &targets);
-    drops.extend(target.lines.iter().filter_map(|i| lines.get(*i)).flat_map(|l| l.ops.iter().copied()));
-    let p = page_dict(doc, page)?;
-    let res = p.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
-    let streams = content_streams(doc, &p.dict)?;
-    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
-    let ops = pieces.parse().ops;
-    let shown = interpret(doc, &ops, &res, &mut HashMap::new(), &mut Carry::new(), None, None)?;
-    let mut patches = HashMap::new();
-    for s in shown.into_iter().filter(|s| drops.contains(&s.op)) {
-        if s.state.render_mode >= 4 {
-            return Err(EditError::Invalid("text used as a clipping path cannot be previewed for editing".into()));
-        }
-        let denominator = s.state.size * s.state.scale;
-        let adjustment = if denominator != 0.0 { -1000.0 * s.advance / denominator } else { 0.0 };
-        if !adjustment.is_finite() || (denominator == 0.0 && s.advance != 0.0) {
-            return Err(EditError::Invalid("the paragraph's text advance cannot be previewed".into()));
-        }
-        let mut replacement = Vec::new();
-        if let Some(op) = ops.get(s.op) {
-            if op.is("\"") {
-                replacement.push(Op::new("Tw", vec![op.operands.first().cloned().unwrap_or(Object::Int(0))]));
-                replacement.push(Op::new("Tc", vec![op.operands.get(1).cloned().unwrap_or(Object::Int(0))]));
-            }
-            if op.is("'") || op.is("\"") {
-                replacement.push(Op::new("T*", vec![]));
-            }
-        }
-        replacement.push(Op::new("TJ", vec![Object::Array(vec![pdfcraft_content::num(adjustment)])]));
-        patches.insert(s.op, replacement);
-    }
-    let data = splice(&pieces, &ops, |i| patches.remove(&i).map_or((Vec::new(), true), |v| (v, false)));
-    let contents = rewritten_contents(doc, &streams, data);
-    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
-    Ok(())
-}
-
-/// The paragraphs on a page as a reader sees them, including text drawn by form XObjects
-/// (Export to Word, HTML and RTF). Read-only: indexes into this list are not
-/// [`text_blocks`] indexes, so they can't be passed to [`replace_block`] or [`rewrite_block`].
-/// [`reading_blocks_checked`] also says whether text was left out.
-pub fn reading_blocks(doc: &Document, page: usize) -> Result<Vec<TextBlock>, EditError> {
-    reading_blocks_checked(doc, page).map(|r| r.blocks)
-}
-
-/// A page's paragraphs as a reader sees them ([`reading_blocks_checked`]).
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct ReadingBlocks {
-    /// The paragraphs, as [`reading_blocks`] returns them.
-    pub blocks: Vec<TextBlock>,
-    /// The page draws forms nested deeper than [`MAX_FORM_DEPTH`], more of them than
-    /// [`MAX_FORM_VISITS`], or forms that run past what the page's content left of its decode
-    /// budget. Reading leaves those forms out to stay bounded on hostile files, so their text
-    /// is missing from `blocks`; [`crate::reading_images`] walks the same forms and misses
-    /// their images too.
-    pub truncated: bool,
-}
-
-/// [`reading_blocks`], saying whether the limits that bound reading left text out. A page
-/// whose `/Contents` alone runs past its decode budget is an [`EditError::Invalid`], not a
-/// truncated result.
-pub fn reading_blocks_checked(doc: &Document, page: usize) -> Result<ReadingBlocks, EditError> {
-    let (lines, truncated) = reading_lines(doc, page)?;
-    Ok(ReadingBlocks { blocks: regions::group_reading_blocks(&lines), truncated })
-}
-
-// An ideographic space carries intentional Japanese spacing, including paragraph indentation.
-// Keep other whitespace normalization unchanged.
-fn paragraph_separator(c: char) -> bool {
-    c.is_whitespace() && c != '\u{3000}'
-}
-
-/// Greedy word wrapping to `width` with `advance` giving a string's width. Each `\n` starts a
-/// new line. A row may also end inside a word of Chinese or Japanese text ([`crate::linebreak`]);
-/// those pieces join without a space. Every white-space character is written as one space, so
-/// a run of spaces typed between, before or after words stays (#4199); only the spaces where a
-/// row wraps are dropped.
-fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<String> {
-    let mut out = Vec::new();
-    for row in text.split('\n') {
-        let mut line = String::new();
-        let start = out.len();
-        // The separators read since the last word: each one boundary between `split` pieces.
-        let mut gap = 0usize;
-        for (k, word) in row.split(paragraph_separator).enumerate() {
-            if k > 0 {
-                gap = gap.saturating_add(1);
-            }
-            if word.is_empty() {
-                continue;
-            }
-            let spaces = " ".repeat(std::mem::take(&mut gap));
-            for (i, piece) in crate::linebreak::pieces(word).into_iter().enumerate() {
-                let candidate = if i == 0 { format!("{line}{spaces}{piece}") } else { format!("{line}{piece}") };
-                // A row holding only the spaces that indent it doesn't wrap before its first word.
-                if line.chars().any(|c| c != ' ') && advance(&candidate) > width {
-                    out.push(std::mem::take(&mut line));
-                    line = piece.to_string();
-                } else {
-                    line = candidate;
-                }
-            }
-        }
-        line.push_str(&" ".repeat(gap));
-        if !line.is_empty() || out.len() == start {
-            out.push(line);
-        }
-    }
-    out
-}
-
-/// Replace paragraph `block` (an index into [`text_blocks`]) with `text`, rewrapped to the
-/// paragraph's width with its line spacing. The paragraph keeps its first line's position, font
-/// (or Helvetica when the font can't show the text), size and colour.
-pub fn replace_block(doc: &mut Document, page: usize, block: usize, text: &str) -> Result<LineEdit, EditError> {
-    rewrite_block(doc, page, block, Some(text), &BlockStyle::default())
-}
-
-/// Formatting for a rewritten paragraph (`None` keeps the paragraph's own).
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct BlockStyle {
-    /// Disjoint UTF-8 ranges in the replacement, each preserving unspecified source style.
-    pub ranges: Vec<RangeStyle>,
-    /// Explicit page font resource (from register_text_font or the page font inventory).
-    pub resource: Option<String>,
-    /// A standard font family, bold, italic.
-    pub family: Option<(crate::added::Family, bool, bool)>,
-    /// Override weight without choosing a different family (`None` keeps the source weight).
-    pub bold: Option<bool>,
-    /// Font size in points (user space).
-    pub size: Option<f64>,
-    /// Fill colour (RGB 0–1).
-    pub color: Option<[f64; 3]>,
-    pub align: Option<crate::added::Align>,
-    /// Draw a line under each line of text.
-    pub underline: Option<bool>,
-    /// Line spacing as a multiple of the font size (1.2 is ordinary).
-    pub line_spacing: Option<f64>,
-    /// Character spacing (points) and horizontal scaling (percent).
-    pub char_spacing: Option<f64>,
-    pub scale: Option<f64>,
-    /// Move the paragraph by `[dx, dy]` in user space (dragging its box).
-    pub offset: Option<[f64; 2]>,
-    /// Rewrap to this width in user space (dragging the box's edge).
-    pub width: Option<f64>,
-    /// For an invisible paragraph ([`TextBlock::invisible`]): fill its old area with this colour
-    /// (RGB 0–1) before the new text, hiding the scanned word beneath it.
-    pub cover: Option<[f64; 3]>,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct RangeStyle {
-    pub range: std::ops::Range<usize>,
-    pub family: Option<(crate::added::Family, bool, bool)>,
-    pub resource: Option<String>,
-    pub size: Option<f64>,
-    pub color: Option<[f64; 3]>,
-    pub underline: Option<bool>,
-    pub char_spacing: Option<f64>,
-    pub scale: Option<f64>,
-}
-
-/// Rewrite paragraph `block` with new text (or its own) and formatting, rewrapped to its width.
-pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option<&str>, style: &BlockStyle) -> Result<LineEdit, EditError> {
-    let edit = rewrite_block_with_limit(doc, page, block, text, style, MAX_TYPE3_GLYPHS)?;
-    drop_unused_fallback_fonts(doc, page);
-    Ok(edit)
-}
-
-/// [`rewrite_block`] with the most unique characters one generated font may hold (tests lower it).
-pub(crate) fn rewrite_block_with_limit(
-    doc: &mut Document,
-    page: usize,
-    block: usize,
-    text: Option<&str>,
-    style: &BlockStyle,
-    max_glyphs: usize,
-) -> Result<LineEdit, EditError> {
-    TextSession::open(doc, page, block)?.commit_with_limit(doc, text, style, max_glyphs)
-}
-
-/// [`rewrite_block_with_limit`] with the page's [`text_lines`], read from `doc` as it is now.
-fn rewrite_block_from(
-    doc: &mut Document,
-    page: usize,
-    lines: Vec<TextLine>,
-    block: usize,
-    text: Option<&str>,
-    style: &BlockStyle,
-    max_glyphs: usize,
-) -> Result<LineEdit, EditError> {
-    let blocks = group_blocks(&lines);
-    let b = blocks.get(block).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no paragraph {}", page + 1, block + 1)))?;
-    let members: Vec<&TextLine> = b.lines.iter().map(|i| &lines[*i]).collect();
-    // One clipping run is enough: rewriting the paragraph would drop its mask with the rest.
-    let mut dropped = coincident_ops(&lines, &members);
-    dropped.extend(members.iter().flat_map(|l| l.ops.iter().copied()));
-    refuse_clipping_text(&lines, &dropped)?;
-    let first = members.first().copied().ok_or_else(|| EditError::Invalid("the paragraph has no source runs".into()))?;
-    members.iter().try_for_each(|line| line.ensure_editable())?;
-    let p = page_dict(doc, page)?;
-    let mut res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    let mut fonts_res = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
-    let registered_face = fonts_res.iter().any(|(name, _)| name.starts_with(b"PCFull"));
-    // Hebrew is written back in drawing order (and with the Hebrew fallback face) by the
-    // single-style path below; the styled region path does not reorder right-to-left runs.
-    let hebrew = text.unwrap_or(&b.text).chars().any(crate::bidi::is_hebrew);
-    if hebrew && (!style.ranges.is_empty() || style.resource.is_some()) {
-        return Err(EditError::Invalid(
-            "formatting part of right-to-left (Hebrew) text, or choosing a document font for it, isn't supported yet".into(),
-        ));
-    }
-    // Text turned on the page (a landscape page drawn a quarter turn round) is rewritten in its
-    // own text space below; the styled region path lays rows out along the page's x axis.
-    let upright = members.iter().all(|line| line.upright());
-    if !upright && (!style.ranges.is_empty() || style.resource.is_some()) {
-        return Err(EditError::Invalid("formatting part of turned text, or choosing a document font for it, isn't supported yet".into()));
-    }
-    let visual_indic = members.iter().any(|line| line.visual_order);
-    if upright
-        && !hebrew
-        && !visual_indic
-        && (!style.ranges.is_empty()
-            || style.resource.is_some()
-            || (text.is_some_and(|draft| {
-                // A row break, `\n` or a carriage return, takes the path that keeps untouched rows.
-                draft.contains(['\n', '\r'])
-                    || pdfcraft_fonts::source_shaping::required(draft)
-                    || !pdfcraft_fonts::embedding::matching_faces(&b.base_font).is_empty()
-            }) || registered_face
-                || text.is_some_and(|draft| source_program_completes(doc, &fonts_res, first, draft))
-                || b.rows.iter().any(|row| row.len() > 1)
-                || members.iter().any(|line| line.font != first.font || line.size != first.size || line.color != first.color))
-                && style.family.is_none()
-                && style.bold.is_none())
-    {
-        return rewrite_styled_block(doc, page, &b, &lines, text, style, max_glyphs);
-    }
-    let streams = content_streams(doc, &p.dict)?;
-    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
-    let ops = pieces.parse().ops;
-    // Explicit line breaks stay (#1443), and so does each typed U+0020 space: a run of them is
-    // not folded into one (#4199, #3797). `\r\n` and a lone `\r` are breaks too; other white
-    // space is written as one space.
-    let text: String = text
-        .unwrap_or(&b.text)
-        .replace("\r\n", "\n")
-        .chars()
-        .map(|c| match c {
-            '\r' => '\n',
-            c if c != '\n' && paragraph_separator(c) => ' ',
-            c => c,
-        })
-        .collect();
-    // The characters to show, for choosing fonts: the breaks are moves, not glyphs.
-    let flat = text.replace('\n', " ");
-    let o = &first.origin;
-    let last = members.last().copied().unwrap_or(first);
-    let emit = &last.origin;
-    let (font_name, old_size) = o.state.font.clone().ok_or_else(|| EditError::Invalid("the paragraph has no font".into()))?;
-    let k = o.k.max(1e-6);
-    // The size in text space: points ÷ the text-to-user scale.
-    let size = style.size.map_or(old_size, |pt| (pt / k).max(0.1));
-    // Spacing and scaling (text state), with the chosen values.
-    let mut ts_state = o.state.clone();
-    if let Some(c) = style.char_spacing {
-        ts_state.char_spacing = c / k;
-    }
-    if let Some(sc) = style.scale {
-        ts_state.scale = (sc / 100.0).clamp(0.1, 10.0);
-    }
-    let o_state = ts_state.clone();
-    let metrics = fonts_res.get(font_name.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|d| Metrics::from_dict(doc, &d));
-    let visual_indic = metrics.as_ref().is_some_and(|m| m.visual_order) || first.visual_order;
-    let indic_text = if visual_indic { crate::indic::to_visual(&flat) } else { flat.clone() };
-    let reuse = style.family.is_none() && style.bold.is_none() && metrics.as_ref().is_some_and(|m| source_encodes(m, &indic_text));
-    let space = metrics.as_ref().map_or(0.33, |m| source_space(doc, &fonts_res, m));
-    // The chosen style also determines the real Japanese fallback outlines and advances.
-    let (family, bold, italic) = style.family.unwrap_or((source_family(&b.base_font), b.bold, b.italic));
-    let bold = style.bold.unwrap_or(bold);
-    // The face is chosen after `bold` settles, so a bold request measures with the bold metrics.
-    let face = family.std14(bold, italic);
-    let std_width = move |s: &str, size: f64| -> f64 { face.text_width(s, size) };
-    let [dx, dy] = style.offset.unwrap_or([0.0, 0.0]);
-    if !(dx.is_finite() && dy.is_finite()) {
-        return Err(EditError::Invalid("the paragraph can't be moved that far".into()));
-    }
-    // Right-to-left text (more Hebrew or Arabic letters than Latin) is right-aligned unless an
-    // alignment is asked for, and a single right-to-left line keeps its right edge as it grows.
-    let rtl = crate::bidi::rtl_base(&flat);
-    let anchored_right = rtl && upright && style.width.is_none() && members.len() == 1;
-    // The paragraph's width along its lines: in user space unless it is turned.
-    let frame = if upright {
-        b.rect
-    } else {
-        members.iter().map(|l| l.frame_rect()).reduce(|a, f| [a[0].min(f[0]), a[1].min(f[1]), a[2].max(f[2]), a[3].max(f[3])]).unwrap_or(b.rect)
-    };
-    // A centred title is laid out in the box it already sits in, so it keeps its centre as it
-    // grows or wraps, rather than being grown to the right up to the page's margin (#2581).
-    // Turned text is left alone: its centre lives along its own baseline, not in page space.
-    let crop = p.crop(doc);
-    let centred = upright && !rtl && style.width.is_none() && style.align.is_none() && is_centred(&b, &lines, (crop[0] + crop[2]) / 2.0, first.size);
-    // A paragraph keeps its width (or takes the one asked for); a single line grows to the right
-    // (to the left when right-to-left), up to the page's margin.
-    let width = match style.width {
-        // Capped at the largest page PDF allows (14 400 pt), even for text set larger than that
-        // (`clamp` panics when its minimum is the larger, or NaN).
-        Some(w) if w.is_finite() => w.clamp((size * k).min(14_400.0), 14_400.0),
-        Some(_) => return Err(EditError::Invalid("the paragraph's width must be a number".into())),
-        // Turned text: the page's margins are along another axis. A single line grows (below).
-        None if !upright => (frame[2] - frame[0]).max(size * k),
-        None if anchored_right => (b.rect[2] - b.rect[0]).max(size * k).max(b.rect[2] + dx - (crop[0] + 36.0)),
-        // A centred line is not stretched to the margin: its own box is the frame it is centred in.
-        None if members.len() == 1 && !centred => (b.rect[2] - b.rect[0]).max(size * k).max(crop[2] - 36.0 - (b.rect[0] + dx)),
-        None => (b.rect[2] - b.rect[0]).max(size * k),
-    };
-    if !width.is_finite() {
-        return Err(EditError::Invalid("the paragraph's width must be a number".into()));
-    }
-    let align = if centred { Some(crate::added::Align::Center) } else { style.align.or(rtl.then_some(crate::added::Align::Right)) };
-    // Where a right-aligned line ends, from the paragraph's left edge (user space).
-    let right_edge = if anchored_right { (b.rect[2] - b.rect[0]).max(0.0) } else { width };
-    // The move and the width are checked here, before the fallback fonts are written: a refused
-    // paragraph leaves the document as it was. The move is in page space, so it is taken back through
-    // the CTM's linear part into the space the paragraph is drawn in.
-    let movement = if dx != 0.0 || dy != 0.0 {
-        let c = emit.ctm;
-        let back = Matrix([c[0], c[1], c[2], c[3], 0.0, 0.0])
-            .invert()
-            .ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it can't be moved in".into()))?;
-        Some(back.apply(dx, dy))
-    } else {
-        None
-    };
-    let tm = if o.ctm == emit.ctm {
-        o.tm
-    } else {
-        let emit_inv = Matrix(emit.ctm).invert().ok_or_else(|| EditError::Invalid("the paragraph has a singular transform".into()))?;
-        Matrix(o.tm).then(&Matrix(o.ctm)).then(&emit_inv).0
-    };
-    let type3 = if !reuse && needs_type3(&flat) { Some(type3_font(doc, &mut fonts_res, &flat, family, bold, max_glyphs)?) } else { None };
-    let advance = |s: &str| -> f64 {
-        let t = match (&metrics, reuse) {
-            (Some(m), true) => {
-                let visual_s = if m.visual_order { crate::indic::to_visual(s) } else { s.to_owned() };
-                source_width(m, &visual_s, size, space, o_state.char_spacing, o_state.word_spacing)
-            }
-            _ if let Some(fallback) = &type3 => {
-                // Each character's count in `s`, from one pass over `s`.
-                let mut counts: HashMap<char, usize> = HashMap::new();
-                for c in s.chars() {
-                    let count = counts.entry(c).or_insert(0);
-                    *count = count.saturating_add(1);
-                }
-                fallback.widths.iter().map(|(ch, width)| counts.get(ch).copied().unwrap_or(0) as f64 * width * size).sum::<f64>()
-                    + s.chars().count() as f64 * o_state.char_spacing
-            }
-            _ => std_width(s, size) + s.chars().count() as f64 * o_state.char_spacing,
-        };
-        t * o_state.scale * k
-    };
-    // A turned single line grows to fit, up to where its baseline reaches the page's margin.
-    let width = if !upright && style.width.is_none() && members.len() == 1 {
-        let crop = p.crop(doc);
-        let (x0, y0) = (first.origin.x + dx, first.origin.baseline + dy);
-        let (ux, uy) = first.direction();
-        let tx = if ux > 1e-6 {
-            (crop[2] - 36.0 - x0) / ux
-        } else if ux < -1e-6 {
-            (crop[0] + 36.0 - x0) / ux
-        } else {
-            f64::INFINITY
-        };
-        let ty = if uy > 1e-6 {
-            (crop[3] - 36.0 - y0) / uy
-        } else if uy < -1e-6 {
-            (crop[1] + 36.0 - y0) / uy
-        } else {
-            f64::INFINITY
-        };
-        let cap = width.max(tx.min(ty)).min(14_400.0);
-        text.split('\n').map(&advance).fold(width, f64::max).min(cap)
-    } else {
-        width
-    };
-    let right_edge = if anchored_right { right_edge } else { width };
-    let wrapped = wrap(&text, width + 0.5, advance);
-    let mut substituted = None;
-    let new_font = !reuse;
-    let (show_font, encode): (String, Encoder) = if let Some(m) = metrics.clone().filter(|_| reuse) {
-        let name = font_name.clone();
-        (font_name.clone(), Box::new(move |s: &str| m.encode(s).map(|bytes| vec![(name.clone(), bytes)])))
-    } else if let Some(fallback) = type3.clone() {
-        substituted = Some(format!("{} Type3", fallback.family));
-        let first = fallback.names.first().cloned().ok_or_else(no_japanese_font)?;
-        (first, Box::new(move |s: &str| type3_encode(&fallback, s)))
-    } else {
-        let win = pdfcraft_fonts::win_ansi(&flat);
-        let back: String = win.iter().map(|c| char::from_u32(u32::from(*c)).unwrap_or('?')).collect();
-        let base = family.base_font(bold, italic);
-        if flat.chars().zip(back.chars()).any(|(a, c)| c == '?' && a != '?') {
-            return Err(EditError::Invalid(format!("\"{flat}\" has characters neither {} nor {base} can show", b.base_font)));
-        }
-        let mut f = Dict::new();
-        f.set(b"Type".to_vec(), Object::name("Font"));
-        f.set(b"Subtype".to_vec(), Object::name("Type1"));
-        f.set(b"BaseFont".to_vec(), Object::name(base));
-        f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-        // Named after its face, as the line and region rewrites name theirs: one name for every
-        // stand-in would repoint the paragraphs set in an earlier one at this face (#4280).
-        let name = format!("PCEd{}", base.replace('-', ""));
-        fonts_res.set(name.clone().into_bytes(), Object::Dict(f));
-        if style.family.is_none() {
-            substituted = Some(base.to_string());
-        }
-        let shown = name.clone();
-        (name, Box::new(move |s: &str| Some(vec![(shown.clone(), pdfcraft_fonts::win_ansi(s))])))
-    };
-    // Line spacing in text space: the paragraph's own (scaled with the size), or 1.2 × the size.
-    let lead = match style.line_spacing {
-        Some(m) => size * m.clamp(0.5, 5.0),
-        // From the first two rows (a row may hold several runs).
-        None if let Some((upper, lower)) = b
-            .rows
-            .first()
-            .zip(b.rows.get(1))
-            .and_then(|(upper, lower)| upper.first().zip(lower.first()))
-            .and_then(|(upper, lower)| lines.get(*upper).zip(lines.get(*lower))) =>
-        {
-            (upper.frame_origin().1 - lower.frame_origin().1) / k * size / old_size
-        }
-        None if o_state.leading > 0.0 => o_state.leading,
-        None => size * 1.2,
-    };
-    let n = pdfcraft_content::num;
-    // The paragraph's operators go, and so does another drawing on the same baseline (a fake-bold
-    // second copy, an invisible text layer): the new text is all that may show.
-    let drop = dropped;
-    // Text shown earlier in the same text object stays first: the paragraph then goes where its
-    // last row was, after any backgrounds between the rows, or between two halves of the text object.
-    let start = last.ops.first().copied().unwrap_or(emit.bt_op);
-    let split = ops
-        .get(emit.bt_op..start)
-        .unwrap_or_default()
-        .iter()
-        .enumerate()
-        .any(|(i, op)| matches!(op.op.as_slice(), b"Tj" | b"TJ" | b"'" | b"\"") && !drop.contains(&(emit.bt_op + i)));
-    // What the text after the paragraph expects, and what is in force where the paragraph is
-    // drawn: the state at its BT (or where it was split).
-    let after = if split { &emit.state } else { &emit.bt_state };
-    // In its own graphics state, so a new colour (or anything else) stops at the paragraph.
-    let mut block_ops = vec![Op::new("q", vec![])];
-    block_ops.extend(reveal_ops(&b, &lines, style, emit.ctm)?);
-    // Moved: a translation inside that state.
-    if let Some((ax, ay)) = movement {
-        block_ops.push(Op::new("cm", vec![n(1.0), n(0.0), n(0.0), n(1.0), n(ax), n(ay)]));
-    }
-    // Painted as the paragraph was, including what its text object set before the first show.
-    block_ops.extend(o_state.paint_ops(after));
-    block_ops.push(Op::new("BT", vec![]));
-    let mut state = o_state.clone();
-    state.word_spacing = 0.0;
-    // The font the next run is shown in: the one the BT sets, until a run of another fallback subset.
-    let mut shown_font = show_font.clone();
-    state.font = Some((show_font, size));
-    if let Some([r, g, bl]) = style.color {
-        state.fill = vec![Op::new("rg", vec![n(r), n(g), n(bl)])];
-    }
-    block_ops.extend(state.ops());
-    block_ops.push(Op::new("Tm", tm.iter().map(|v| n(*v)).collect()));
-    // Alignment: each line's offset from the left edge, in text space.
-    // `visible` is the width the line is aligned on (see the loop below).
-    let offset = |visible: f64| -> f64 {
-        let free = (width - visible).max(0.0) / k;
-        match align {
-            Some(crate::added::Align::Center) => free / 2.0,
-            // A right-to-left line anchored at its right edge may start left of the old box.
-            Some(crate::added::Align::Right) if anchored_right => (right_edge - visible) / k,
-            Some(crate::added::Align::Right) => free,
-            // A justified right-to-left paragraph ends its last line at the right edge.
-            Some(crate::added::Align::Justify) if rtl => free,
-            _ => 0.0,
-        }
-    };
-    // Justify: each line but the last fills the width. Word spacing reaches only single-byte code 32
-    // (ISO 32000-1 §9.3.3), so where a space is shown with another code (a composite font, a
-    // generated Type 3 font, a subset without a space) the extra space follows each space as a
-    // TJ adjustment instead, and code 32, which may then be a letter, gets none.
-    let justify = align == Some(crate::added::Align::Justify);
-    let word_spacing_reaches_spaces = match metrics.as_ref().filter(|_| reuse) {
-        Some(m) => m.encode(" ").is_some_and(|b| m.codes(&b).iter().all(|(c, len)| m.is_space(*c, *len))),
-        None => type3.is_none(),
-    };
-    let mut x = 0.0;
-    let mut tw_set = 0.0;
-    let mut underlines: Vec<(f64, f64, f64)> = Vec::new(); // (x0, x1, y) in text space
-    for (i, line) in wrapped.iter().enumerate() {
-        // A stretched (justified) line shows only its words, as before #4199: word spacing would
-        // reach the spaces before its first word and after its last, so they are left out, and
-        // the line fills the width from the left edge. Nothing to stretch over, or a paragraph
-        // drawn at `0 Tz`, isn't justified.
-        let body = line.trim_matches(' ');
-        let interior = body.matches(' ').count();
-        let tw = if justify && i + 1 < wrapped.len() && interior > 0 && o_state.scale.abs() > 1e-6 {
-            Some((width - advance(body)).max(0.0) / k / o_state.scale / interior as f64).filter(|tw| tw.is_finite())
-        } else {
-            None
-        }
-        .unwrap_or(0.0);
-        // Other lines show every space typed. A left-to-right one is aligned on its width up to
-        // its last word; a right-to-left one on its whole width, since the spaces typed after its
-        // last word are drawn on its left and the ones before its first on its right.
-        let (shown, visible) = if tw > 0.0 {
-            (body, advance(body))
-        } else if crate::bidi::rtl_base(line) {
-            (line.as_str(), advance(line))
-        } else {
-            (line.as_str(), advance(line.trim_end_matches(' ')))
-        };
-        let dx = if tw > 0.0 { 0.0 } else { offset(visible) };
-        if i > 0 || dx != 0.0 {
-            block_ops.push(Op::new("Td", vec![n(dx - x), n(if i > 0 { -lead } else { 0.0 })]));
-        }
-        x = dx;
-        let stretch = if word_spacing_reaches_spaces { 0.0 } else { tw };
-        let tw = tw - stretch;
-        if tw != tw_set {
-            block_ops.push(Op::new("Tw", vec![n(tw)]));
-            tw_set = tw;
-        }
-        // Each wrapped line in typing order; drawn left to right (right-to-left runs reversed).
-        let visual = crate::bidi::to_visual(shown);
-        // Stretched without word spacing: shown up to and including each space, then moved on.
-        let pieces = if stretch > 0.0 { visual.split_inclusive(' ').collect() } else { vec![visual.as_str()] };
-        for piece in pieces {
-            if let Some(metrics) = metrics.as_ref().filter(|_| reuse) {
-                let indic_piece = if metrics.visual_order { crate::indic::to_visual(piece) } else { piece.to_owned() };
-                block_ops.extend(source_show(metrics, &indic_piece, size, space, o_state.char_spacing, tw)?);
-            } else {
-                for (font, bytes) in encode(piece).ok_or_else(|| EditError::Invalid(format!("\"{line}\" can't be shown")))? {
-                    if font != shown_font {
-                        block_ops.push(Op::new("Tf", vec![Object::name(&font), n(size)]));
-                        shown_font = font;
-                    }
-                    block_ops.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
-                }
-            }
-            if stretch > 0.0 && piece.ends_with(' ') {
-                block_ops.push(Op::new("TJ", vec![Object::Array(vec![n(-1000.0 * stretch / size)])]));
-            }
-        }
-        let tw = tw + stretch;
-        // Underlined to the line's last word, over its stretched gaps.
-        let w = (visible + tw * interior as f64 * o_state.scale * k) / k;
-        underlines.push((dx, dx + w, -(i as f64) * lead - size * 0.12));
-    }
-    block_ops.push(Op::new("ET", vec![]));
-    if style.underline == Some(true) {
-        // In text space (the paragraph's text matrix), in its fill colour.
-        let colour: Vec<Op> = state
-            .fill
-            .iter()
-            .map(|f| match f.op.as_slice() {
-                b"g" => Op::new("G", f.operands.clone()),
-                b"rg" => Op::new("RG", f.operands.clone()),
-                b"k" => Op::new("K", f.operands.clone()),
-                b"cs" => Op::new("CS", f.operands.clone()),
-                b"sc" => Op::new("SC", f.operands.clone()),
-                _ => Op::new("SCN", f.operands.clone()),
-            })
-            .collect();
-        block_ops.push(Op::new("q", vec![]));
-        block_ops.push(Op::new("cm", tm.iter().map(|v| n(*v)).collect()));
-        block_ops.extend(colour);
-        block_ops.push(Op::new("w", vec![n(size * 0.06)]));
-        for (x0, x1, y) in underlines {
-            block_ops.push(Op::new("m", vec![n(x0), n(y)]));
-            block_ops.push(Op::new("l", vec![n(x1), n(y)]));
-        }
-        block_ops.push(Op::new("S", vec![]));
-        block_ops.push(Op::new("Q", vec![]));
-    }
-    block_ops.push(Op::new("Q", vec![]));
-    block_ops.extend(after.ops().into_iter().filter(|op| !op.is("Tf") || after.font.is_some()));
-    if split {
-        block_ops.insert(0, Op::new("ET", vec![]));
-        block_ops.push(Op::new("BT", vec![]));
-        block_ops.push(Op::new("Tm", emit.tlm.iter().map(|v| n(*v)).collect()));
-    }
-    let at = if split { start } else { emit.bt_op };
-    let new_data = splice(&pieces, &ops, |i| {
-        let insert = if i == at { std::mem::take(&mut block_ops) } else { Vec::new() };
-        (insert, !drop.contains(&i))
-    });
-    let contents = rewritten_contents(doc, &streams, new_data);
-    if new_font {
-        res.set(b"Font".to_vec(), Object::Dict(fonts_res));
-    }
-    let page_ref = p.obj;
-    doc.update_dict(page_ref, |d| {
-        d.set(b"Contents".to_vec(), contents);
-        if new_font {
-            d.set(b"Resources".to_vec(), Object::Dict(res));
-        }
-    })?;
-    Ok(LineEdit { substituted })
-}
-
-/// The cover (when [`BlockStyle::cover`] asks for one) and visible rendering that start a
-/// rewritten invisible paragraph, drawn in the space whose CTM is `ctm`. Nothing for visible text.
-/// The paragraph's `q`/`Q` restores the rendering mode for the invisible text after it.
-pub(crate) fn reveal_ops(block: &TextBlock, lines: &[TextLine], style: &BlockStyle, ctm: [f64; 6]) -> Result<Vec<Op>, EditError> {
-    if !block.invisible {
-        return Ok(Vec::new());
-    }
-    let n = pdfcraft_content::num;
-    let mut ops = Vec::new();
-    if let Some(colour) = style.cover {
-        if colour.iter().any(|c| !c.is_finite() || !(0.0..=1.0).contains(c)) {
-            return Err(EditError::Invalid("the cover colour must be RGB values from 0 to 1".into()));
-        }
-        let back = Matrix(ctm).invert().ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it can't be covered in".into()))?;
-        ops.push(Op::new("q", vec![]));
-        ops.push(Op::new("rg", colour.map(n).to_vec()));
-        for rect in block.lines.iter().filter_map(|i| lines.get(*i)).map(|l| l.rect) {
-            // Scanned ink reaches a little past the recognised box.
-            let pad = ((rect[3] - rect[1]).abs() * 0.1).clamp(0.5, 2.0);
-            let corners =
-                [[rect[0] - pad, rect[1] - pad], [rect[2] + pad, rect[1] - pad], [rect[2] + pad, rect[3] + pad], [rect[0] - pad, rect[3] + pad]];
-            for (i, [x, y]) in corners.into_iter().enumerate() {
-                let (x, y) = back.apply(x, y);
-                if !(x.is_finite() && y.is_finite()) {
-                    return Err(EditError::Invalid("the paragraph's area can't be covered".into()));
-                }
-                ops.push(Op::new(if i == 0 { "m" } else { "l" }, vec![n(x), n(y)]));
-            }
-            ops.push(Op::new("h", vec![]));
-        }
-        ops.push(Op::new("f", vec![]));
-        ops.push(Op::new("Q", vec![]));
-    }
-    ops.push(Op::new("Tr", vec![Object::Int(0)]));
-    Ok(ops)
-}
-
-/// Existing paragraph indexes, excluding streams owned by an added-content item.
-pub(crate) fn selectable_blocks(
-    doc: &Document,
-    page: usize,
-    excluded: &std::collections::BTreeSet<pdfcraft_cos::ObjRef>,
-) -> Result<Vec<(usize, TextBlock)>, EditError> {
-    let p = page_dict(doc, page)?;
-    let streams = content_streams(doc, &p.dict)?;
-    let lines = text_lines(doc, page)?;
-    Ok(group_blocks(&lines)
-        .into_iter()
-        .enumerate()
-        .filter(|(_, b)| {
-            !b.lines
-                .iter()
-                .filter_map(|i| lines.get(*i))
-                .any(|l| streams.get(l.stream).and_then(|(o, _)| o.as_ref()).is_some_and(|r| excluded.contains(&r)))
-        })
-        .collect())
-}
-
-/// The vertical advance per unit of font size of a font that writes vertically: `/DW2`'s w1
-/// (default −1000, §9.7.4.3), or `None` for horizontal text. Per-glyph `/W2` entries are not
-/// read. An encoding whose writing mode can't be read is an error, as in [`vertical_encoding`];
-/// listing text treats it as horizontal and records the error (see [`Ts::unreadable`]).
-fn vertical_advance(doc: &Document, font: &Dict) -> Result<Option<f64>, EditError> {
-    if !vertical_encoding(doc, font)? {
-        return Ok(None);
-    }
-    let descendant = font.get(b"DescendantFonts").and_then(|d| doc.resolve(d).as_array().and_then(|a| a.first().cloned()));
-    let w1 = descendant
-        .and_then(|d| doc.resolve(&d).as_dict().and_then(|d| d.get(b"DW2").cloned()))
-        .and_then(|a| doc.resolve(&a).as_array().and_then(|a| a.get(1).cloned()))
-        .and_then(|w| doc.resolve(&w).as_f64())
-        .filter(|w| w.is_finite())
-        .unwrap_or(-1000.0);
-    Ok(Some(w1 / 1000.0))
-}
-
-/// Detect vertical CMaps before moving horizontal text. A broken/cyclic embedded CMap is
-/// refused rather than guessing which direction TJ advances its text matrix.
-fn vertical_encoding(doc: &Document, font: &Dict) -> Result<bool, EditError> {
-    if font.name(b"Subtype") != Some(b"Type0") {
-        return Ok(false);
-    }
-    let mut next = font.get(b"Encoding").cloned();
-    let mut seen = std::collections::BTreeSet::new();
-    for _ in 0..8 {
-        let Some(o) = next.take() else { return Ok(false) };
-        if let Some(r) = o.as_ref()
-            && !seen.insert(r)
-        {
-            return Err(EditError::Invalid("the text encoding is cyclic".into()));
-        }
-        match &*doc.resolve(&o) {
-            Object::Name(n) => return Ok(n.ends_with(b"-V")),
-            Object::Stream(stream) => {
-                if let Some(mode) = stream.dict.get(b"WMode") {
-                    match mode.as_int() {
-                        Some(1) => return Ok(true),
-                        Some(0) => {}
-                        _ => return Err(EditError::Invalid("the text writing mode is invalid".into())),
-                    }
-                }
-                let bytes = stream
-                    .decoded_within(8 * 1024 * 1024)
-                    .map_err(|_| EditError::Invalid("the text encoding cannot be decoded within its size limit".into()))?;
-                let ops = parse(&bytes).ops;
-                if let Some(mode) = ops.iter().rev().find(|op| op.is("def") && op.name(0) == Some(b"WMode")) {
-                    return match mode.num(1) {
-                        Some(0.0) => Ok(false),
-                        Some(1.0) => Ok(true),
-                        _ => Err(EditError::Invalid("the text writing mode is invalid".into())),
-                    };
-                }
-                next = stream
-                    .dict
-                    .get(b"UseCMap")
-                    .cloned()
-                    .or_else(|| ops.iter().rev().find(|op| op.is("usecmap")).and_then(|op| op.operands.first().cloned()));
-            }
-            _ => return Err(EditError::Invalid("the text encoding is invalid".into())),
-        }
-    }
-    Err(EditError::Invalid("the text encoding is nested too deeply".into()))
-}
-
-/// Translate paragraphs together without re-encoding glyphs, changing fonts or reflowing.
-/// Numeric TJ offsets and text rise temporarily move each selected show operation, then
-/// restore both advances and rise. The PDF reader advances the original glyph bytes itself:
-/// no approximate font metrics are used to position following, unselected text (§9.4.4).
-pub(crate) fn translate_blocks(doc: &mut Document, page: usize, indexes: &[usize], offset: [f64; 2]) -> Result<(), EditError> {
-    if indexes.is_empty() {
-        return Ok(());
-    }
-    let p = page_dict(doc, page)?;
-    let streams = content_streams(doc, &p.dict)?;
-    let lines = text_lines(doc, page)?;
-    let blocks = group_blocks(&lines);
-    let mut selected = std::collections::BTreeSet::new();
-    for index in indexes {
-        let b = blocks.get(*index).ok_or_else(|| EditError::Invalid("a selected paragraph no longer exists".into()))?;
-        for line in &b.lines {
-            let l = lines.get(*line).ok_or_else(|| EditError::Invalid("a selected text line no longer exists".into()))?;
-            l.ensure_editable()?;
-            selected.extend(l.ops.iter().copied());
-        }
-    }
-    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    let fonts = res.get(b"Font").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
-    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
-    let ops = pieces.parse().ops;
-    let shown = interpret(doc, &ops, &res, &mut HashMap::new(), &mut Carry::new(), None, None)?;
-    let mut patches = HashMap::new();
-    // Keep full precision: a tiny rounded text-space change can be magnified by a CTM,
-    // and restoring rise/spacing must not alter following unselected text.
-    let n = Object::Real;
-    for s in shown.into_iter().filter(|s| selected.contains(&s.op)) {
-        if !(0..=3).contains(&s.state.render_mode) {
-            return Err(EditError::Invalid("text used as a clipping path cannot be moved in a group".into()));
-        }
-        let font = fonts
-            .get(&s.font)
-            .map(|f| doc.resolve(f))
-            .and_then(|f| f.as_dict().cloned())
-            .ok_or_else(|| EditError::Invalid("a selected paragraph has no font".into()))?;
-        if vertical_encoding(doc, &font)? {
-            return Err(EditError::Invalid("vertical text cannot be moved in a group".into()));
-        }
-        let inverse = s.tm.then(&s.state.ctm).invert().ok_or_else(|| EditError::Invalid("a selected paragraph has no area".into()))?;
-        let [a, b, c, d, _, _] = inverse.0;
-        let (dx, dy) = (a * offset[0] + c * offset[1], b * offset[0] + d * offset[1]);
-        let denominator = s.state.size * s.state.scale;
-        let shift = if dx == 0.0 {
-            0.0
-        } else if denominator.abs() > 1e-12 {
-            -1000.0 * dx / denominator
-        } else {
-            return Err(EditError::Invalid("a selected paragraph has no horizontal advance".into()));
-        };
-        let rise = s.state.rise + dy;
-        if ![shift, rise, dx, dy].iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
-            return Err(EditError::Invalid("the paragraph move is too large".into()));
-        }
-        let original = ops.get(s.op).ok_or_else(|| EditError::Invalid("a selected text operation is missing".into()))?;
-        let mut replacement = Vec::new();
-        let show = if original.is("'") || original.is("\"") {
-            if original.is("\"") {
-                let spacing = original
-                    .operands
-                    .get(..2)
-                    .filter(|a| a.iter().all(|o| o.as_f64().is_some()))
-                    .ok_or_else(|| EditError::Invalid("a text operation has invalid spacing".into()))?;
-                for (operator, operand) in ["Tw", "Tc"].into_iter().zip(spacing) {
-                    replacement.push(Op::new(operator, vec![operand.clone()]));
-                }
-            }
-            replacement.push(Op::new("T*", vec![]));
-            Op::new("Tj", vec![original.operands.last().cloned().ok_or_else(|| EditError::Invalid("a text operation has no string".into()))?])
-        } else {
-            original.clone()
-        };
-        if dy != 0.0 {
-            replacement.push(Op::new("Ts", vec![n(rise)]));
-        }
-        if shift != 0.0 {
-            replacement.push(Op::new("TJ", vec![Object::Array(vec![n(shift)])]));
-        }
-        replacement.push(show);
-        if shift != 0.0 {
-            replacement.push(Op::new("TJ", vec![Object::Array(vec![n(-shift)])]));
-        }
-        if dy != 0.0 {
-            replacement.push(Op::new("Ts", vec![n(s.state.rise)]));
-        }
-        patches.insert(s.op, replacement);
-    }
-    if patches.len() != selected.len() {
-        return Err(EditError::Invalid("a selected text operation cannot be moved".into()));
-    }
-    let data = splice(&pieces, &ops, |i| patches.remove(&i).map_or((Vec::new(), true), |v| (v, false)));
-    let contents = rewritten_contents(doc, &streams, data);
-    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
-    Ok(())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/edit/src/text/blocks.rs b/crates/edit/src/text/blocks.rs
new file mode 100644
index 0000000000..8d3d224da0
--- /dev/null
+++ b/crates/edit/src/text/blocks.rs
@@ -0,0 +1,424 @@
+use super::interp::{Carry, interpret};
+use super::lines::{content_streams, page_dict, reading_lines, rewritten_contents, splice, text_lines};
+use super::rewrite::{LineEdit, coincident_ops, rewrite_block};
+use super::*;
+
+/// An editable text region: adjacent runs on visual rows, followed by aligned rows.
+/// A region may contain several source fonts, sizes, colours and weights.
+#[derive(Clone, Debug, PartialEq)]
+pub struct TextBlock {
+    /// The lines' text joined with spaces (lines that ended in a hyphen are joined directly).
+    pub text: String,
+    pub rect: [f64; 4],
+    pub base_font: String,
+    pub size: f64,
+    pub bold: bool,
+    pub italic: bool,
+    /// The text fill colour as RGB, used by the visual editor and preserved when no colour
+    /// override is requested.
+    pub color: [f64; 3],
+    /// Counterclockwise baseline angle in page user space, in degrees.
+    pub rotation: f64,
+    /// Indexes into [`text_lines`].
+    pub lines: Vec<usize>,
+    /// Visual rows; each contains indexes into [`text_lines`], including mixed-style runs.
+    pub rows: Vec<Vec<usize>>,
+    /// Text for the inline editor, with a newline only between visual rows.
+    pub editor_text: String,
+    /// Byte ranges in `editor_text` and their source line indexes.
+    pub spans: Vec<(std::ops::Range<usize>, usize)>,
+    /// Every line is invisible text (rendering mode 3): an OCR layer over a scanned image, whose
+    /// pixels show the words. A rewrite draws the new text visibly (see [`BlockStyle::cover`]).
+    pub invisible: bool,
+}
+
+impl TextBlock {
+    /// Preserve styles outside the changed ranges; inserted characters inherit the surrounding
+    /// source run. The texts are aligned word by word, so words left untouched between two edits
+    /// keep their own runs (#2198); past [`MAX_CHANGED_WORDS`] the draft counts as one change.
+    /// Byte ranges are always UTF-8 boundaries. Linear time, including large edits.
+    pub fn edited_spans(&self, draft: &str) -> Vec<(std::ops::Range<usize>, usize)> {
+        if self.editor_text.len() > 4_000_000 || draft.len() > 4_000_000 {
+            return vec![(0..draft.len(), self.lines.first().copied().unwrap_or(0))];
+        }
+        let old: Vec<_> = self.editor_text.chars().collect();
+        let new: Vec<_> = draft.char_indices().collect();
+        let chars: Vec<_> = new.iter().map(|(_, c)| *c).collect();
+        let mut original = Vec::with_capacity(old.len());
+        let mut span = 0;
+        for (byte, _) in self.editor_text.char_indices() {
+            while self.spans.get(span).is_some_and(|(r, _)| byte >= r.end) {
+                span += 1;
+            }
+            original.push(self.spans.get(span).or_else(|| self.spans.last()).map_or(0, |(_, i)| *i));
+        }
+        let mut sources = Vec::with_capacity(new.len());
+        let slices = |text: &[char]| words(text).into_iter().map(|w| text.get(w).unwrap_or_default().to_vec()).collect::<Vec<_>>();
+        let (old_words, new_words) = (slices(&old), slices(&chars));
+        match edit_script(&old_words, &new_words, MAX_CHANGED_WORDS) {
+            Some(script) => {
+                // `(o, n)`: where the current change starts in the old and new text; `(x, y)`: where it ends.
+                let ((mut o, mut n), (mut x, mut y)) = ((0, 0), (0, 0));
+                let (mut a, mut b) = (old_words.iter(), new_words.iter());
+                for step in script {
+                    match step {
+                        Step::Keep => {
+                            replaced(&original, o, old.get(o..x).unwrap_or_default(), chars.get(n..y).unwrap_or_default(), &mut sources);
+                            let len = a.next().map_or(0, Vec::len);
+                            b.next();
+                            sources.extend(original.get(x..x.saturating_add(len)).unwrap_or_default());
+                            (x, y) = (x.saturating_add(len), y.saturating_add(len));
+                            (o, n) = (x, y);
+                        }
+                        Step::Delete => x = x.saturating_add(a.next().map_or(0, Vec::len)),
+                        Step::Insert => y = y.saturating_add(b.next().map_or(0, Vec::len)),
+                    }
+                }
+                replaced(&original, o, old.get(o..x).unwrap_or_default(), chars.get(n..y).unwrap_or_default(), &mut sources);
+            }
+            None => replaced(&original, 0, &old, &chars, &mut sources),
+        }
+        let fallback = original.first().copied().unwrap_or(0);
+        let mut result: Vec<(std::ops::Range<usize>, usize)> = Vec::new();
+        for (i, (byte, ch)) in new.iter().enumerate() {
+            let source = sources.get(i).copied().unwrap_or(fallback);
+            let end = byte.saturating_add(ch.len_utf8());
+            if let Some((range, _)) = result.last_mut().filter(|(_, prev)| *prev == source) {
+                range.end = end;
+            } else {
+                result.push((*byte..end, source));
+            }
+        }
+        result
+    }
+}
+
+/// Changed words [`TextBlock::edited_spans`] aligns before it treats the draft as one change.
+/// Myers' diff costs O((N + M) · D), so bounding D keeps it linear.
+const MAX_CHANGED_WORDS: usize = 64;
+
+/// `text` split into words, each with the whitespace after it, as char ranges.
+fn words(text: &[char]) -> Vec<std::ops::Range<usize>> {
+    let mut out = Vec::new();
+    let mut start = 0;
+    for (i, pair) in text.windows(2).enumerate() {
+        if let [a, b] = pair
+            && a.is_whitespace()
+            && !b.is_whitespace()
+        {
+            out.push(start..i + 1);
+            start = i + 1;
+        }
+    }
+    if start < text.len() {
+        out.push(start..text.len());
+    }
+    out
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Step {
+    Keep,
+    Delete,
+    Insert,
+}
+
+/// Myers' shortest edit script from `a` to `b`, or `None` when it takes more than `max` steps.
+fn edit_script<T: PartialEq>(a: &[T], b: &[T], max: usize) -> Option<Vec<Step>> {
+    let (n, m) = (a.len() as isize, b.len() as isize);
+    let max = max.min(a.len().saturating_add(b.len())) as isize;
+    // Furthest x reached on each diagonal k = x - y, stored at k + max + 1.
+    let at = |v: &[isize], k: isize| usize::try_from(k + max + 1).ok().and_then(|i| v.get(i).copied()).unwrap_or(0);
+    let mut v = vec![0isize; (2 * max + 3) as usize];
+    let mut trace = Vec::new();
+    for d in 0..=max {
+        trace.push(v.clone());
+        for k in (-d..=d).step_by(2) {
+            let down = k == -d || (k != d && at(&v, k - 1) < at(&v, k + 1));
+            let mut x = if down { at(&v, k + 1) } else { at(&v, k - 1) + 1 };
+            let mut y = x - k;
+            while x < n && y < m && a.get(x as usize) == b.get(y as usize) {
+                x += 1;
+                y += 1;
+            }
+            if let Some(slot) = usize::try_from(k + max + 1).ok().and_then(|i| v.get_mut(i)) {
+                *slot = x;
+            }
+            if x >= n && y >= m {
+                return Some(backtrack(&trace, n, m, max));
+            }
+        }
+    }
+    None
+}
+
+/// Walk Myers' saved frontiers back from the end to the edit script.
+fn backtrack(trace: &[Vec<isize>], n: isize, m: isize, max: isize) -> Vec<Step> {
+    let at = |v: &[isize], k: isize| usize::try_from(k + max + 1).ok().and_then(|i| v.get(i).copied()).unwrap_or(0);
+    let mut steps = Vec::new();
+    let (mut x, mut y) = (n, m);
+    for (d, v) in trace.iter().enumerate().rev() {
+        let (d, k) = (d as isize, x - y);
+        let prev_k = if k == -d || (k != d && at(v, k - 1) < at(v, k + 1)) { k + 1 } else { k - 1 };
+        let prev_x = at(v, prev_k);
+        let prev_y = prev_x - prev_k;
+        while x > prev_x && y > prev_y {
+            steps.push(Step::Keep);
+            x -= 1;
+            y -= 1;
+        }
+        if d > 0 {
+            steps.push(if x == prev_x { Step::Insert } else { Step::Delete });
+        }
+        (x, y) = (prev_x, prev_y);
+    }
+    steps.reverse();
+    steps
+}
+
+/// `old`, at char `at` of the source, became `new`: characters kept at either end keep their
+/// runs, and the rest inherit the run just before the change (or the first one it replaces).
+fn replaced(original: &[usize], at: usize, old: &[char], new: &[char], out: &mut Vec<usize>) {
+    let prefix = old.iter().zip(new).take_while(|(a, b)| a == b).count();
+    let suffix = old.iter().rev().zip(new.iter().rev()).take(old.len().min(new.len()).saturating_sub(prefix)).take_while(|(a, b)| a == b).count();
+    let start = at.saturating_add(prefix);
+    let inherited = start.checked_sub(1).and_then(|i| original.get(i)).or_else(|| original.get(start)).copied().unwrap_or(0);
+    for i in 0..new.len() {
+        let source = if i < prefix {
+            original.get(at.saturating_add(i)).copied()
+        } else if i >= new.len().saturating_sub(suffix) {
+            original.get(at.saturating_add(old.len()).saturating_sub(new.len() - i)).copied()
+        } else {
+            Some(inherited)
+        };
+        out.push(source.unwrap_or(inherited));
+    }
+}
+
+/// How a listing of [`text_blocks`] records a paragraph so that it can be found again.
+///
+/// The index of a paragraph is its position in a list regrouped from geometry on every read, so
+/// an edit that merges or splits paragraphs makes the same index name another one (#2516). A key
+/// names the paragraph by what it says and where it is; a paragraph that no longer exists as
+/// such has no match, instead of a neighbour taking its place.
+#[derive(Clone, Debug, PartialEq)]
+pub struct BlockKey {
+    text: String,
+    rect: [f64; 4],
+}
+
+impl BlockKey {
+    /// Two boxes are the same box within this many points.
+    const TOLERANCE: f64 = 0.01;
+
+    pub fn of(block: &TextBlock) -> Self {
+        Self { text: block.text.clone(), rect: block.rect }
+    }
+
+    /// The paragraph's box when it was recorded (user space).
+    pub fn rect(&self) -> [f64; 4] {
+        self.rect
+    }
+
+    /// The paragraph in `blocks` with this text and box. `hint` is tried first, so two
+    /// paragraphs drawn on top of one another are told apart by their order.
+    pub fn find(&self, blocks: &[TextBlock], hint: usize) -> Option<usize> {
+        let matches = |b: &TextBlock| b.text == self.text && b.rect.iter().zip(&self.rect).all(|(a, b)| (a - b).abs() <= Self::TOLERANCE);
+        match blocks.get(hint) {
+            Some(b) if matches(b) => Some(hint),
+            _ => blocks.iter().position(matches),
+        }
+    }
+}
+
+/// The paragraph in `blocks` whose box overlaps `rect` the most, if any overlaps it at all. An
+/// edit rewrites a paragraph in place, so this is the paragraph it became.
+pub fn block_overlapping(blocks: &[TextBlock], rect: [f64; 4]) -> Option<usize> {
+    // `f64::min` and `max` skip a NaN, which would make a box that isn't a number overlap anything.
+    let area = |b: &TextBlock| {
+        if !rect.iter().chain(&b.rect).all(|v| v.is_finite()) {
+            return 0.0;
+        }
+        let w = b.rect[2].min(rect[2]) - b.rect[0].max(rect[0]);
+        let h = b.rect[3].min(rect[3]) - b.rect[1].max(rect[1]);
+        if w > 0.0 && h > 0.0 { w * h } else { 0.0 }
+    };
+    blocks.iter().enumerate().map(|(i, b)| (i, area(b))).filter(|(_, a)| *a > 0.0).max_by(|(_, a), (_, b)| a.total_cmp(b)).map(|(i, _)| i)
+}
+
+/// The paragraphs on a page (0-based).
+pub fn text_blocks(doc: &Document, page: usize) -> Result<Vec<TextBlock>, EditError> {
+    let lines = text_lines(doc, page)?;
+    Ok(group_blocks(&lines))
+}
+
+/// Remove a paragraph's glyphs for a temporary editor background. Numeric TJ adjustments
+/// preserve the text matrix, so unselected text positioned relative to it stays in place.
+/// Call this on a clone: it is a preview operation, not a document edit.
+pub fn clear_block(doc: &mut Document, page: usize, block: usize) -> Result<(), EditError> {
+    let lines = text_lines(doc, page)?;
+    let blocks = group_blocks(&lines);
+    let target = blocks.get(block).ok_or_else(|| EditError::Invalid("the paragraph no longer exists".into()))?;
+    let targets: Vec<&TextLine> = target.lines.iter().filter_map(|i| lines.get(*i)).collect();
+    targets.iter().try_for_each(|line| line.ensure_editable())?;
+    let mut drops = coincident_ops(&lines, &targets);
+    drops.extend(target.lines.iter().filter_map(|i| lines.get(*i)).flat_map(|l| l.ops.iter().copied()));
+    let p = page_dict(doc, page)?;
+    let res = p.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
+    let streams = content_streams(doc, &p.dict)?;
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let shown = interpret(doc, &ops, &res, &mut HashMap::new(), &mut Carry::new(), None, None)?;
+    let mut patches = HashMap::new();
+    for s in shown.into_iter().filter(|s| drops.contains(&s.op)) {
+        if s.state.render_mode >= 4 {
+            return Err(EditError::Invalid("text used as a clipping path cannot be previewed for editing".into()));
+        }
+        let denominator = s.state.size * s.state.scale;
+        let adjustment = if denominator != 0.0 { -1000.0 * s.advance / denominator } else { 0.0 };
+        if !adjustment.is_finite() || (denominator == 0.0 && s.advance != 0.0) {
+            return Err(EditError::Invalid("the paragraph's text advance cannot be previewed".into()));
+        }
+        let mut replacement = Vec::new();
+        if let Some(op) = ops.get(s.op) {
+            if op.is("\"") {
+                replacement.push(Op::new("Tw", vec![op.operands.first().cloned().unwrap_or(Object::Int(0))]));
+                replacement.push(Op::new("Tc", vec![op.operands.get(1).cloned().unwrap_or(Object::Int(0))]));
+            }
+            if op.is("'") || op.is("\"") {
+                replacement.push(Op::new("T*", vec![]));
+            }
+        }
+        replacement.push(Op::new("TJ", vec![Object::Array(vec![pdfcraft_content::num(adjustment)])]));
+        patches.insert(s.op, replacement);
+    }
+    let data = splice(&pieces, &ops, |i| patches.remove(&i).map_or((Vec::new(), true), |v| (v, false)));
+    let contents = rewritten_contents(doc, &streams, data);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
+
+/// The paragraphs on a page as a reader sees them, including text drawn by form XObjects
+/// (Export to Word, HTML and RTF). Read-only: indexes into this list are not
+/// [`text_blocks`] indexes, so they can't be passed to [`replace_block`] or [`rewrite_block`].
+/// [`reading_blocks_checked`] also says whether text was left out.
+pub fn reading_blocks(doc: &Document, page: usize) -> Result<Vec<TextBlock>, EditError> {
+    reading_blocks_checked(doc, page).map(|r| r.blocks)
+}
+
+/// A page's paragraphs as a reader sees them ([`reading_blocks_checked`]).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct ReadingBlocks {
+    /// The paragraphs, as [`reading_blocks`] returns them.
+    pub blocks: Vec<TextBlock>,
+    /// The page draws forms nested deeper than [`MAX_FORM_DEPTH`], more of them than
+    /// [`MAX_FORM_VISITS`], or forms that run past what the page's content left of its decode
+    /// budget. Reading leaves those forms out to stay bounded on hostile files, so their text
+    /// is missing from `blocks`; [`crate::reading_images`] walks the same forms and misses
+    /// their images too.
+    pub truncated: bool,
+}
+
+/// [`reading_blocks`], saying whether the limits that bound reading left text out. A page
+/// whose `/Contents` alone runs past its decode budget is an [`EditError::Invalid`], not a
+/// truncated result.
+pub fn reading_blocks_checked(doc: &Document, page: usize) -> Result<ReadingBlocks, EditError> {
+    let (lines, truncated) = reading_lines(doc, page)?;
+    Ok(ReadingBlocks { blocks: regions::group_reading_blocks(&lines), truncated })
+}
+
+// An ideographic space carries intentional Japanese spacing, including paragraph indentation.
+// Keep other whitespace normalization unchanged.
+pub(crate) fn paragraph_separator(c: char) -> bool {
+    c.is_whitespace() && c != '\u{3000}'
+}
+
+/// Greedy word wrapping to `width` with `advance` giving a string's width. Each `\n` starts a
+/// new line. A row may also end inside a word of Chinese or Japanese text ([`crate::linebreak`]);
+/// those pieces join without a space. Every white-space character is written as one space, so
+/// a run of spaces typed between, before or after words stays (#4199); only the spaces where a
+/// row wraps are dropped.
+pub(super) fn wrap(text: &str, width: f64, advance: impl Fn(&str) -> f64) -> Vec<String> {
+    let mut out = Vec::new();
+    for row in text.split('\n') {
+        let mut line = String::new();
+        let start = out.len();
+        // The separators read since the last word: each one boundary between `split` pieces.
+        let mut gap = 0usize;
+        for (k, word) in row.split(paragraph_separator).enumerate() {
+            if k > 0 {
+                gap = gap.saturating_add(1);
+            }
+            if word.is_empty() {
+                continue;
+            }
+            let spaces = " ".repeat(std::mem::take(&mut gap));
+            for (i, piece) in crate::linebreak::pieces(word).into_iter().enumerate() {
+                let candidate = if i == 0 { format!("{line}{spaces}{piece}") } else { format!("{line}{piece}") };
+                // A row holding only the spaces that indent it doesn't wrap before its first word.
+                if line.chars().any(|c| c != ' ') && advance(&candidate) > width {
+                    out.push(std::mem::take(&mut line));
+                    line = piece.to_string();
+                } else {
+                    line = candidate;
+                }
+            }
+        }
+        line.push_str(&" ".repeat(gap));
+        if !line.is_empty() || out.len() == start {
+            out.push(line);
+        }
+    }
+    out
+}
+
+/// Replace paragraph `block` (an index into [`text_blocks`]) with `text`, rewrapped to the
+/// paragraph's width with its line spacing. The paragraph keeps its first line's position, font
+/// (or Helvetica when the font can't show the text), size and colour.
+pub fn replace_block(doc: &mut Document, page: usize, block: usize, text: &str) -> Result<LineEdit, EditError> {
+    rewrite_block(doc, page, block, Some(text), &BlockStyle::default())
+}
+
+/// Formatting for a rewritten paragraph (`None` keeps the paragraph's own).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct BlockStyle {
+    /// Disjoint UTF-8 ranges in the replacement, each preserving unspecified source style.
+    pub ranges: Vec<RangeStyle>,
+    /// Explicit page font resource (from register_text_font or the page font inventory).
+    pub resource: Option<String>,
+    /// A standard font family, bold, italic.
+    pub family: Option<(crate::added::Family, bool, bool)>,
+    /// Override weight without choosing a different family (`None` keeps the source weight).
+    pub bold: Option<bool>,
+    /// Font size in points (user space).
+    pub size: Option<f64>,
+    /// Fill colour (RGB 0–1).
+    pub color: Option<[f64; 3]>,
+    pub align: Option<crate::added::Align>,
+    /// Draw a line under each line of text.
+    pub underline: Option<bool>,
+    /// Line spacing as a multiple of the font size (1.2 is ordinary).
+    pub line_spacing: Option<f64>,
+    /// Character spacing (points) and horizontal scaling (percent).
+    pub char_spacing: Option<f64>,
+    pub scale: Option<f64>,
+    /// Move the paragraph by `[dx, dy]` in user space (dragging its box).
+    pub offset: Option<[f64; 2]>,
+    /// Rewrap to this width in user space (dragging the box's edge).
+    pub width: Option<f64>,
+    /// For an invisible paragraph ([`TextBlock::invisible`]): fill its old area with this colour
+    /// (RGB 0–1) before the new text, hiding the scanned word beneath it.
+    pub cover: Option<[f64; 3]>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct RangeStyle {
+    pub range: std::ops::Range<usize>,
+    pub family: Option<(crate::added::Family, bool, bool)>,
+    pub resource: Option<String>,
+    pub size: Option<f64>,
+    pub color: Option<[f64; 3]>,
+    pub underline: Option<bool>,
+    pub char_spacing: Option<f64>,
+    pub scale: Option<f64>,
+}
diff --git a/crates/edit/src/text/editor.rs b/crates/edit/src/text/editor.rs
new file mode 100644
index 0000000000..b2bd2b9f97
--- /dev/null
+++ b/crates/edit/src/text/editor.rs
@@ -0,0 +1,127 @@
+use super::blocks::{BlockStyle, TextBlock};
+use super::fallback::MAX_TYPE3_GLYPHS;
+use super::lines::{page_dict, text_lines};
+use super::rewrite::rewrite_block_from;
+use super::*;
+
+/// An embedded sfnt source face, read only for the inline editor. Bytes stay in memory and
+/// are never installed, copied into assets, or used as a font for another document.
+#[derive(Clone, Debug)]
+pub struct TextEditorFont {
+    pub resource: String,
+    pub face: String,
+    pub bytes: Vec<u8>,
+}
+
+pub fn text_editor_fonts(doc: &Document, page: usize) -> Result<Vec<TextEditorFont>, EditError> {
+    let p = page_dict(doc, page)?;
+    let resources = p.dict.get(b"Resources").and_then(|o| doc.dict(o)).unwrap_or_default();
+    let fonts = resources.get(b"Font").and_then(|o| doc.dict(o)).unwrap_or_default();
+    let mut budget = 32_usize << 20;
+    // Every program decoded counts, usable or not, so aliases of one program can't repeat the work.
+    let mut decode = DecodeBudget::new(2 * budget, 0);
+    let mut result = Vec::new();
+    for (name, font) in fonts.iter().take(128) {
+        let Some(font) = doc.dict(font) else { continue };
+        let Some(bytes) = pdfcraft_fonts::pdf::embedded_sfnt_within(doc, &font, &mut decode) else { continue };
+        if bytes.len() > budget {
+            continue;
+        }
+        budget -= bytes.len();
+        result.push(TextEditorFont {
+            resource: String::from_utf8_lossy(name).into_owned(),
+            face: Metrics::from_dict(doc, &font).base_font.rsplit('+').next().unwrap_or_default().to_owned(),
+            bytes,
+        });
+    }
+    // The approved full face follows all source subsets in the editor's font stack. It can
+    // display newly inserted glyphs before Apply without changing the source text's face.
+    let source_faces: Vec<_> = result.iter().map(|p| p.face.clone()).collect();
+    for face in source_faces {
+        for full in pdfcraft_fonts::embedding::matching_faces(&face) {
+            if full.bytes.len() > budget || result.iter().any(|p| p.resource == format!("PCApproved{}", full.name())) {
+                continue;
+            }
+            budget -= full.bytes.len();
+            result.push(TextEditorFont { resource: format!("PCApproved{}", full.name()), face: face.clone(), bytes: full.bytes.to_vec() });
+        }
+    }
+    Ok(result)
+}
+
+/// Load an explicit full face into this page's resources. Nothing on the page is replaced;
+/// the new resource can complete matching source subsets or be chosen in a text style.
+pub fn register_text_font(doc: &mut Document, page: usize, bytes: &[u8]) -> Result<String, EditError> {
+    pdfcraft_fonts::embedding::validate_document_input(bytes).map_err(EditError::Invalid)?;
+    let (_, postscript) = pdfcraft_fonts::embedding::names(bytes).map_err(EditError::Invalid)?;
+    let p = page_dict(doc, page)?;
+    let mut resources = p.dict.get(b"Resources").and_then(|o| doc.dict(o)).unwrap_or_default();
+    let mut fonts = resources.get(b"Font").and_then(|o| doc.dict(o)).unwrap_or_default();
+    let name = pdfcraft_fonts::embedding::embed(doc, &mut fonts, bytes, &postscript).map_err(EditError::Invalid)?;
+    resources.set(b"Font".to_vec(), Object::Dict(fonts));
+    doc.update_dict(p.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources)))?;
+    Ok(name)
+}
+
+/// Read-only draft bounds, measured with the same PDF rewrite used by Apply/Save.
+#[derive(Clone, Debug, PartialEq)]
+pub struct TextEditLayout {
+    pub source_rect: [f64; 4],
+    pub draft_rect: Option<[f64; 4]>,
+    pub overflow: bool,
+}
+
+pub fn text_edit_layout(doc: &Document, page: usize, block: usize, text: &str, style: &BlockStyle) -> Result<TextEditLayout, EditError> {
+    TextSession::open(doc, page, block)?.layout(text, style)
+}
+
+/// A draft of paragraph `source` (number `block` among the page's `lines`) laid out by the rewrite
+/// Apply runs, on a copy of `doc`.
+pub(crate) fn layout_draft(
+    doc: &Document,
+    page: usize,
+    lines: &[TextLine],
+    source: &TextBlock,
+    block: usize,
+    text: &str,
+    style: &BlockStyle,
+) -> Result<TextEditLayout, EditError> {
+    if text == source.editor_text && *style == BlockStyle::default() {
+        return Ok(TextEditLayout { source_rect: source.rect, draft_rect: Some(source.rect), overflow: false });
+    }
+    // Subtract the untouched runs by value, rather than by operator offsets: a rewrite may
+    // split BT/ET or add font resources. A multiset also handles coincident repeated text.
+    let key =
+        |line: &TextLine| (line.text.clone(), line.font.clone(), line.rect.map(f64::to_bits), line.size.to_bits(), line.color.map(f64::to_bits));
+    let mut untouched = std::collections::BTreeMap::new();
+    for (index, line) in lines.iter().enumerate() {
+        if !source.lines.contains(&index) {
+            *untouched.entry(key(line)).or_insert(0_usize) += 1;
+        }
+    }
+    let mut draft = doc.clone();
+    rewrite_block_from(&mut draft, page, lines.to_vec(), block, Some(text), style, MAX_TYPE3_GLYPHS)?;
+    let mut rect: Option<[f64; 4]> = None;
+    for line in text_lines(&draft, page)? {
+        if let Some(count) = untouched.get_mut(&key(&line))
+            && *count > 0
+        {
+            *count -= 1;
+            continue;
+        }
+        // Spaces typed after a row's last word are drawn but show nothing, so an upright row is
+        // measured to the end of its last word: they don't make a draft overflow (#4199).
+        let mut r = line.rect;
+        if line.upright() && !line.ink.is_empty() {
+            if crate::bidi::rtl_base(&line.text) {
+                r[0] = r[0].max(line.ink.iter().map(|i| i[0]).fold(f64::INFINITY, f64::min));
+            } else {
+                r[2] = r[2].min(line.ink.iter().map(|i| i[2]).fold(f64::NEG_INFINITY, f64::max));
+            }
+        }
+        rect = Some(rect.map_or(r, |a| [a[0].min(r[0]), a[1].min(r[1]), a[2].max(r[2]), a[3].max(r[3])]));
+    }
+    let overflow = rect
+        .is_some_and(|r| r[0] < source.rect[0] - 0.5 || r[1] < source.rect[1] - 0.5 || r[2] > source.rect[2] + 0.5 || r[3] > source.rect[3] + 0.5);
+    Ok(TextEditLayout { source_rect: source.rect, draft_rect: rect, overflow })
+}
diff --git a/crates/edit/src/text/fallback.rs b/crates/edit/src/text/fallback.rs
new file mode 100644
index 0000000000..0c19a6680a
--- /dev/null
+++ b/crates/edit/src/text/fallback.rs
@@ -0,0 +1,599 @@
+use super::interp::Ts;
+use super::lines::page_dict;
+use super::*;
+
+/// Text → the runs that show it: each run's font resource name and the bytes shown in that font.
+pub(super) type Encoder = Box<dyn Fn(&str) -> Option<Vec<(String, Vec<u8>)>>>;
+
+fn is_win_ansi_char(c: char) -> bool {
+    c == '\t' || pdfcraft_fonts::win_ansi_byte(c).is_some()
+}
+
+pub(crate) fn needs_type3(text: &str) -> bool {
+    text.chars().any(|c| !is_win_ansi_char(c))
+}
+
+/// The `/Name` of the Type 3 fonts generated for Japanese text.
+const JAPANESE_FONT_NAME: &str = "PCJapanese";
+
+/// The `/Name` of the Type 3 fonts generated for Hebrew text.
+const HEBREW_FONT_NAME: &str = "PCHebrew";
+
+/// The `/Name` of the Type 3 fonts generated from the bundled Latin (Inter) face.
+const LATIN_FONT_NAME: &str = "PCLatin";
+
+/// Whether `font` is one of those generated fonts (Latin, Japanese or Hebrew): a replacement longer
+/// than one of them is split across several, which read back as one line (see [`same_font`]).
+pub(super) fn is_type3_fallback(font: &Dict) -> bool {
+    font.name(b"Subtype") == Some(b"Type3")
+        && font
+            .name(b"Name")
+            .is_some_and(|n| n == JAPANESE_FONT_NAME.as_bytes() || n == HEBREW_FONT_NAME.as_bytes() || n == LATIN_FONT_NAME.as_bytes())
+}
+
+/// The generated font's `/Name` and its resource prefix: the bundled Latin face, Hebrew, or the
+/// Japanese ones.
+fn fallback_names(face: &CraftFont, hebrew: bool) -> (&'static str, &'static str) {
+    if hebrew {
+        (HEBREW_FONT_NAME, "PCHe")
+    } else if face.family == "Inter" {
+        (LATIN_FONT_NAME, "PCLat")
+    } else {
+        (JAPANESE_FONT_NAME, "PCJp")
+    }
+}
+
+/// Drops the generated fallback fonts ([`is_type3_fallback`]) that nothing on `page` shows any more.
+/// Each rewrite generates its own, with the outlines of every character it draws, so without this
+/// an earlier rewrite's fonts stay in the page's resources and the file. Only a font dictionary the
+/// page owns is changed (a rewrite gives the page its own), and nothing is dropped unless every
+/// content stream that may name the page's fonts can be read: the page's own, and those of form
+/// XObjects and Type 3 glyphs that have no resources of their own and so use the page's.
+pub(super) fn drop_unused_fallback_fonts(doc: &mut Document, page: usize) {
+    let Ok(p) = page_dict(doc, page) else { return };
+    let Some(Object::Dict(mut resources)) = p.dict.get(b"Resources").cloned() else { return };
+    let Some(mut fonts) = resources.get(b"Font").and_then(|f| doc.dict(f)) else { return };
+    let generated: Vec<Vec<u8>> =
+        fonts.iter().filter(|(_, f)| doc.dict(f).is_some_and(|d| is_type3_fallback(&d))).map(|(name, _)| name.clone()).collect();
+    if generated.is_empty() {
+        return;
+    }
+    let Some(shown) = fonts_shown(doc, &p.dict, &resources) else { return };
+    let unused: Vec<&Vec<u8>> = generated.iter().filter(|name| !shown.contains(*name)).collect();
+    if unused.is_empty() {
+        return;
+    }
+    for name in unused {
+        fonts.remove(name);
+    }
+    resources.set(b"Font".to_vec(), Object::Dict(fonts));
+    // Nothing is lost if this fails: the fonts just stay.
+    let _ = doc.update_dict(p.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources)));
+}
+
+/// The font resource names `Tf` selects in the page's content and in the content that uses the
+/// page's resources (see [`drop_unused_fallback_fonts`]), or `None` if any of it can't be read.
+fn fonts_shown(doc: &Document, page: &Dict, resources: &Dict) -> Option<std::collections::HashSet<Vec<u8>>> {
+    let mut streams: Vec<Object> = match page.get(b"Contents") {
+        None => Vec::new(),
+        Some(c) => match &*doc.resolve(c) {
+            Object::Array(a) => a.clone(),
+            _ => vec![c.clone()],
+        },
+    };
+    // Form XObjects without their own resources use the page's, however deeply they are nested
+    // (ISO 32000-1 §7.8.3), so every form the page can reach is visited.
+    let mut pending: Vec<Dict> = vec![resources.clone()];
+    let mut seen = std::collections::HashSet::new();
+    while let Some(res) = pending.pop() {
+        for (_, x) in res.get(b"XObject").and_then(|x| doc.dict(x)).unwrap_or_default().iter() {
+            let Some(r) = x.as_ref() else { continue };
+            if !seen.insert(r) {
+                continue;
+            }
+            if seen.len() > 4096 {
+                return None;
+            }
+            let Object::Stream(s) = &*doc.get(r) else { continue };
+            if s.dict.name(b"Subtype") != Some(b"Form") {
+                continue;
+            }
+            match s.dict.get(b"Resources").and_then(|r| doc.dict(r)) {
+                Some(own) => pending.push(own),
+                None => streams.push(x.clone()),
+            }
+        }
+    }
+    // And so do Type 3 glyph procedures without their own (the generated fonts' are outlines only).
+    for (_, f) in resources.get(b"Font").and_then(|f| doc.dict(f)).unwrap_or_default().iter() {
+        if let Some(font) = doc.dict(f).filter(|d| d.name(b"Subtype") == Some(b"Type3") && !d.contains(b"Resources") && !is_type3_fallback(d)) {
+            streams.extend(font.get(b"CharProcs").and_then(|c| doc.dict(c)).unwrap_or_default().iter().map(|(_, proc)| proc.clone()));
+        }
+    }
+    let mut shown = std::collections::HashSet::new();
+    for stream in streams {
+        let Object::Stream(s) = &*doc.resolve(&stream) else { return None };
+        // Strict: a stream only partly read might name a font in the part that wasn't.
+        let data = s.decoded_strict().ok()?;
+        for op in parse(&data).ops {
+            if op.is("Tf")
+                && let Some(name) = op.operands.first().and_then(|n| n.as_name())
+            {
+                shown.insert(name.to_vec());
+            }
+        }
+    }
+    Some(shown)
+}
+
+/// Whether a run shown in `font` (a resource name), with `/BaseFont` `base_font` and the Japanese
+/// or Hebrew fallback face it subsets, if any, continues `line`: the same font resource, another
+/// resource for the same font (a writer may split one font into several subsets, #3661), or
+/// another subset of the same face.
+pub(crate) fn same_font(line: &TextLine, font: &[u8], base_font: &str, face: Option<&str>) -> bool {
+    line.font.as_bytes() == font || same_base_font(&line.base_font, base_font) || (line.face.is_some() && line.face.as_deref() == face)
+}
+
+/// Whether a run painted with `ts` continues `line` as it is painted: a line is rewritten in the
+/// state of its first run, so a `Tr`, stroke colour or line width that changes partway starts
+/// another run (see [`TextState::paint_ops`]; the `gs` parameters are compared as [`Paint`]).
+/// The stroke colour, width, dash and cap only count for text that is stroked, so a rule drawn
+/// between two words doesn't split their line. They are compared as values, wherever they were
+/// set: two ExtGStates with the same settings under other names still continue a line.
+///
+/// Only the visible modes (`Tr` 0–2) that `paint_ops` restates are compared: a line that goes on
+/// as invisible or clipping text stays one line, which the clipping refusal reads whole (#3447).
+pub(super) fn same_paint(line: &TextLine, ts: &Ts) -> bool {
+    let a = &line.origin.state;
+    let visible = |m: i64| (0..=2).contains(&m);
+    let same_mode = a.render_mode == ts.render_mode || !visible(a.render_mode) || !visible(ts.render_mode);
+    let stroked = matches!((a.render_mode, ts.render_mode), (1 | 2, 1 | 2));
+    let outline = a.stroke == ts.stroke && a.line_width == ts.line_width && a.dash == ts.dash && a.line_cap == ts.line_cap;
+    same_mode && (!stroked || outline)
+}
+
+/// Whether two `/BaseFont` names name the same font: a subset's six-letter tag and `+` prefix do
+/// not change the font (ISO 32000-2 §9.6.4), so `ABCDEF+Arial` and `GHIJKL+Arial` are one font.
+/// A name that is missing, or only a tag (`ABCDEF+`), names no font and matches nothing.
+pub(crate) fn same_base_font(a: &str, b: &str) -> bool {
+    let (a, b) = (strip_subset_tag(a), strip_subset_tag(b));
+    !a.is_empty() && a == b
+}
+
+/// `ABCDEF+Arial` → `Arial`. A name without a subset tag is returned unchanged.
+pub(crate) fn strip_subset_tag(name: &str) -> &str {
+    let bytes = name.as_bytes();
+    let is_tag = bytes.get(6) == Some(&b'+') && bytes.get(..6).is_some_and(|tag| tag.iter().all(u8::is_ascii_uppercase));
+    if is_tag { name.get(7..).unwrap_or(name) } else { name }
+}
+
+pub(crate) fn source_family(base_font: &str) -> crate::added::Family {
+    let name = base_font.to_ascii_lowercase();
+    if ["courier", "mono", "consolas", "menlo", "monaco", "lucida console"].iter().any(|s| name.contains(s)) {
+        crate::added::Family::Courier
+    } else if !name.contains("sans")
+        && ["times", "serif", "roman", "mincho", "cambria", "georgia", "palatino", "garamond"].iter().any(|s| name.contains(s))
+    {
+        crate::added::Family::Times
+    } else {
+        crate::added::Family::Helvetica
+    }
+}
+
+pub(crate) const MAX_TYPE3_GLYPHS: usize = 240;
+
+/// The generated fonts for one replacement: one per run of at most `max_glyphs` unique characters,
+/// in order of first appearance.
+#[derive(Clone)]
+pub(crate) struct Type3Fallback {
+    /// The family its glyphs come from ("Shippori Mincho").
+    pub(crate) family: &'static str,
+    /// The fonts' resource names in order; the first is `PCJp` (`PCLat` for the bundled Latin
+    /// face, `PCHe` for Hebrew text).
+    pub(crate) names: Vec<String>,
+    /// Every unique character with its advance (em), in order of first appearance.
+    pub(super) widths: Vec<(char, f64)>,
+    /// Where each character is shown: the index of its font in `names`, and its code there.
+    pub(crate) codes: HashMap<char, (usize, u8)>,
+}
+
+/// One glyph of a generated font: its code there, its character, its glyph procedure and advance.
+pub(crate) struct Type3Glyph {
+    pub(crate) code: u8,
+    pub(crate) ch: char,
+    pub(crate) path: Vec<u8>,
+    pub(crate) width: f64,
+}
+
+fn pdf_num(v: f64) -> String {
+    if v.fract() == 0.0 { format!("{v:.0}") } else { format!("{v:.4}").trim_end_matches('0').trim_end_matches('.').to_string() }
+}
+
+fn type3_path(face: &CraftFont, ch: char) -> Result<(Vec<u8>, f64), EditError> {
+    let glyph = japanese_glyph_from(face, ch).map_err(|e| match e {
+        GlyphError::NoFont => no_japanese_font(),
+        GlyphError::Missing => EditError::Invalid(format!("the {} fallback font has no glyph for U+{:04X}", face.family, ch as u32)),
+        GlyphError::TooComplex => EditError::Invalid(format!("the {} fallback glyph U+{:04X} is too complex", face.family, ch as u32)),
+    })?;
+    let (dx, width) = proportional(ch, &glyph);
+    let scale = 1000.0;
+    // d1 is `wx wy llx lly urx ury` (ISO 32000-2 §9.6.4) with a box enclosing the glyph;
+    // Acrobat draws a bullet in place of a glyph whose d1 is malformed.
+    let b = if glyph.contours.is_empty() { [0.0; 4] } else { glyph.bbox };
+    let mut out = format!(
+        "{} 0 {} {} {} {} d1\n",
+        pdf_num(width * scale),
+        pdf_num(((b[0] + dx) * scale).floor()),
+        pdf_num((b[1] * scale).floor()),
+        pdf_num(((b[2] + dx) * scale).ceil()),
+        pdf_num((b[3] * scale).ceil())
+    )
+    .into_bytes();
+    for contour in glyph.contours {
+        let Some(first) = contour.first() else { continue };
+        out.extend_from_slice(format!("{} {} m\n", pdf_num((first[0] + dx) * scale), pdf_num(first[1] * scale)).as_bytes());
+        for p in contour.iter().skip(1) {
+            out.extend_from_slice(format!("{} {} l\n", pdf_num((p[0] + dx) * scale), pdf_num(p[1] * scale)).as_bytes());
+        }
+        out.extend_from_slice(b"h\n");
+    }
+    out.extend_from_slice(b"f\n");
+    Ok((out, width))
+}
+
+/// Side bearing (em) given to a respaced glyph on each side.
+const SIDE_BEARING: f64 = 0.05;
+
+/// Shift and advance for a fallback glyph. Japanese faces draw Cyrillic and Greek full-width
+/// (one em each, as in JIS X 0208) and have no proportional (`palt`) metrics for them, so a
+/// word set that way reads as letter-spaced. Those letters get their ink width plus a side
+/// bearing instead; everything else keeps the face's own advance.
+fn proportional(ch: char, glyph: &pdfcraft_fonts::GlyphOutline) -> (f64, f64) {
+    let respace = matches!(ch, '\u{0370}'..='\u{03FF}' | '\u{0400}'..='\u{052F}' | '\u{1F00}'..='\u{1FFF}');
+    let ink = glyph.bbox[2] - glyph.bbox[0];
+    if !respace || glyph.contours.is_empty() || !(ink > 0.0 && ink < glyph.width) {
+        return (0.0, glyph.width);
+    }
+    (SIDE_BEARING - glyph.bbox[0], ink + 2.0 * SIDE_BEARING)
+}
+
+fn unicode_hex(ch: char) -> String {
+    let mut units = [0u16; 2];
+    let encoded = ch.encode_utf16(&mut units);
+    encoded.iter().map(|u| format!("{u:04X}")).collect()
+}
+
+/// The same outline for a face that may simply lack the glyph: `None` then, so the caller can try
+/// the next face (and report the character once none of them has it).
+pub(crate) fn type3_glyph(face: &CraftFont, ch: char) -> Result<Option<(Vec<u8>, f64)>, EditError> {
+    match japanese_glyph_from(face, ch) {
+        Err(GlyphError::Missing) => Ok(None),
+        _ => type3_path(face, ch).map(Some),
+    }
+}
+
+/// No face this build has can draw `text`. Only Japanese text is about the Japanese face: other
+/// characters are missing from the paragraph's font, and choosing a font that has them works too.
+pub(crate) fn no_fallback_font(text: &str) -> EditError {
+    if text.chars().any(needs_japanese) {
+        return no_japanese_font();
+    }
+    let Some(ch) = text.chars().find(|c| !c.is_whitespace() && !is_win_ansi_char(*c)) else { return no_japanese_font() };
+    EditError::Invalid(format!(
+        "the paragraph's font has no glyph for {ch} (U+{:04X}) and this build has no fallback font for it; \
+         choose a font that has it (Load font… or Installed fonts…), or use an official release, which includes \
+         PdfCraft's fallback fonts (to build them in, set CRAFT_FONTS_DIR to a craft-fonts checkout)",
+        u32::from(ch)
+    ))
+}
+
+/// The character the craft-fonts Japanese faces are for: kana, CJK ideographs and their compatibility
+/// and full-width forms.
+fn needs_japanese(ch: char) -> bool {
+    matches!(u32::from(ch), 0x3000..=0x30FF | 0x3400..=0x4DBF | 0x4E00..=0x9FFF | 0xF900..=0xFAFF | 0xFF00..=0xFFEF)
+}
+
+/// The chosen face has no outline for `ch`, and neither has any other: say which character it is and
+/// what the writer can do about it. A CJK character without a Japanese face in the build is about
+/// that build input, which is the one answer that changes it.
+pub(crate) fn no_glyph_for(face: &CraftFont, ch: char) -> EditError {
+    if needs_japanese(ch) && pdfcraft_fonts::document_japanese_font().is_none() {
+        return no_japanese_font();
+    }
+    EditError::Invalid(format!(
+        "the {} fallback font has no glyph for {ch} (U+{:04X}), and no fallback face covers the text; \
+         choose a font that has it (Load font… or Installed fonts…), or use an official release, which includes \
+         PdfCraft's fallback fonts (to build them in, set CRAFT_FONTS_DIR to a craft-fonts checkout)",
+        face.family,
+        u32::from(ch)
+    ))
+}
+
+/// This build has no Japanese face to draw replacement text with.
+pub(super) fn no_japanese_font() -> EditError {
+    EditError::Invalid(
+        "this text needs PdfCraft's Japanese fallback font, which this build doesn't include \
+         (official releases do; to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout)"
+            .into(),
+    )
+}
+
+/// The first of `faces` (best match first) that has a glyph for every one of `chars`, else the first.
+pub(crate) fn fallback_face<'a>(faces: &[&'a CraftFont], chars: &[char], has_glyph: impl Fn(&CraftFont, char) -> bool) -> Option<&'a CraftFont> {
+    faces.iter().copied().find(|face| chars.iter().all(|ch| has_glyph(face, *ch))).or_else(|| faces.first().copied())
+}
+
+/// This build has no Hebrew face to draw replacement text with.
+fn no_hebrew_font() -> EditError {
+    EditError::Invalid(
+        "this text needs PdfCraft's Hebrew fallback font (Noto Sans Hebrew), which this build doesn't include \
+         (to build it in, set CRAFT_FONTS_DIR to a craft-fonts checkout that has it)"
+            .into(),
+    )
+}
+
+/// The faces a Type 3 replacement may draw `text` with, best first. Text with Hebrew takes the
+/// Hebrew face first (its Latin and digits too, so a line keeps one look), then the Japanese faces
+/// and the bundled Latin one for anything it lacks; other text takes the Japanese faces, and the
+/// bundled Latin face behind them, which covers the Latin, Greek and Cyrillic letters they lack
+/// (#2593: the Japanese faces have no қ, ғ, ҳ, ә, ө, ү, ұ or һ).
+pub(crate) fn type3_faces(text: &str, family: crate::added::Family, bold: bool) -> Result<(Vec<&'static CraftFont>, bool), EditError> {
+    let japanese = pdfcraft_fonts::document_japanese_fonts_for_style(family == crate::added::Family::Times, bold);
+    let latin = pdfcraft_fonts::document_latin_fonts(bold);
+    if !text.chars().any(crate::bidi::is_hebrew) {
+        return Ok((japanese.into_iter().chain(latin).collect(), false));
+    }
+    // Points are drawn on their letter with the font's positioning, which a one-glyph-per-
+    // character Type 3 font can't do; refuse rather than print them beside the letter.
+    if text.chars().any(crate::bidi::is_hebrew_mark) {
+        return Err(EditError::Invalid("Hebrew points (niqqud) can't be written into a PDF yet; type the text without them".into()));
+    }
+    let hebrew = pdfcraft_fonts::document_hebrew_font(bold).ok_or_else(no_hebrew_font)?;
+    Ok((std::iter::once(hebrew).chain(japanese).chain(latin).collect(), true))
+}
+
+pub(super) fn type3_font(
+    doc: &mut Document,
+    fonts_res: &mut Dict,
+    text: &str,
+    family: crate::added::Family,
+    bold: bool,
+    max_glyphs: usize,
+) -> Result<Type3Fallback, EditError> {
+    let (faces, hebrew) = type3_faces(text, family, bold)?;
+    // Each unique character once, in order of first appearance.
+    let mut chars = Vec::new();
+    let mut seen = std::collections::HashSet::new();
+    for ch in text.chars() {
+        if seen.insert(ch) {
+            chars.push(ch);
+        }
+    }
+    if chars.is_empty() {
+        return Err(EditError::Invalid("replacement text is empty".into()));
+    }
+    // The faces differ in coverage (e.g. of Cyrillic), so use the best face that has every
+    // character. When none has them all, the best face reports the character it lacks. Hebrew
+    // text keeps the Hebrew face and takes each character it lacks from the next face that has it.
+    let face = if hebrew { faces.first().copied() } else { fallback_face(&faces, &chars, |face, ch| japanese_glyph_from(face, ch).is_ok()) }
+        .ok_or_else(|| no_fallback_font(text))?;
+    let others: &[&CraftFont] = if hebrew { faces.get(1..).unwrap_or_default() } else { &[] };
+    // Every outline is read before the document is touched, so a character that fails leaves it
+    // as it was. Each font takes the next `per_font` characters; codes restart at 1 in each.
+    let per_font = max_glyphs.clamp(1, MAX_TYPE3_GLYPHS);
+    let mut glyphs = Vec::with_capacity(chars.len());
+    for (i, ch) in chars.into_iter().enumerate() {
+        // The chosen face first, then the faces after it (Hebrew text takes a character the Hebrew
+        // face lacks from the next face that has it); a character no face draws is reported once.
+        let mut drawn = type3_glyph(face, ch)?;
+        for f in others.iter().copied() {
+            if drawn.is_some() {
+                break;
+            }
+            drawn = type3_glyph(f, ch)?;
+        }
+        let Some((path, width)) = drawn else { return Err(no_glyph_for(face, ch)) };
+        let code = u8::try_from((i % per_font).saturating_add(1))
+            .map_err(|_| EditError::Invalid("replacement text has too many unique characters".into()))?;
+        glyphs.push(Type3Glyph { code, ch, path, width });
+    }
+    Ok(write_type3_glyphs(doc, fonts_res, face, hebrew, glyphs, per_font))
+}
+
+/// Write already validated outlines; callers can prepare every face before adding any objects.
+pub(crate) fn write_type3_glyphs(
+    doc: &mut Document,
+    fonts_res: &mut Dict,
+    face: &CraftFont,
+    hebrew: bool,
+    glyphs: Vec<Type3Glyph>,
+    per_font: usize,
+) -> Type3Fallback {
+    let per_font = per_font.clamp(1, MAX_TYPE3_GLYPHS);
+    let mut codes = HashMap::with_capacity(glyphs.len());
+    let mut widths = Vec::with_capacity(glyphs.len());
+    let mut names = Vec::new();
+    let mut glyphs = glyphs.into_iter();
+    loop {
+        let group: Vec<Type3Glyph> = glyphs.by_ref().take(per_font).collect();
+        if group.is_empty() {
+            break;
+        }
+        for glyph in &group {
+            codes.insert(glyph.ch, (names.len(), glyph.code));
+            widths.push((glyph.ch, glyph.width));
+        }
+        names.push(add_type3_font(doc, fonts_res, face, hebrew, group));
+    }
+    Type3Fallback { family: face.family, names, widths, codes }
+}
+
+/// Adds one generated font whose codes 1 to `glyphs.len()` show `glyphs`, and returns its resource
+/// name (`PCLat`, `PCJp`, then `PCJp1`, ...; `PCHe`, ... for Hebrew text). Nothing here can fail: the
+/// outlines were read already.
+pub(super) fn add_type3_font(doc: &mut Document, fonts_res: &mut Dict, face: &CraftFont, hebrew: bool, glyphs: Vec<Type3Glyph>) -> String {
+    let last_char = glyphs.len();
+    let mut charprocs = Dict::new();
+    let mut widths = Vec::with_capacity(last_char);
+    let mut differences = vec![Object::Int(1)];
+    let mut cmap = String::from(
+        "/CIDInit /ProcSet findresource begin\n12 dict begin\nbegincmap\n/CMapType 2 def\n1 begincodespacerange\n<01> <FF>\nendcodespacerange\n",
+    );
+    cmap.push_str(&format!("{last_char} beginbfchar\n"));
+    for glyph in glyphs {
+        let glyph_name = format!("g{:02X}", glyph.code);
+        let mut pd = Dict::new();
+        pd.set(b"Length".to_vec(), glyph.path.len() as i64);
+        let proc_ref = doc.add(Object::Stream(Stream::from_raw(pd, glyph.path)));
+        charprocs.set(glyph_name.as_bytes().to_vec(), Object::Ref(proc_ref));
+        differences.push(Object::name(&glyph_name));
+        widths.push(Object::Real((glyph.width * 1000.0).round()));
+        cmap.push_str(&format!("<{:02X}> <{}>\n", glyph.code, unicode_hex(glyph.ch)));
+    }
+    cmap.push_str("endbfchar\nendcmap\nCMapName currentdict /CMap defineresource pop\nend\nend\n");
+    let mut cmap_dict = Dict::new();
+    cmap_dict.set(b"Length".to_vec(), cmap.len() as i64);
+    let cmap_ref = doc.add(Object::Stream(Stream::from_raw(cmap_dict, cmap.into_bytes())));
+    let mut encoding = Dict::new();
+    encoding.set(b"Type".to_vec(), Object::name("Encoding"));
+    encoding.set(b"Differences".to_vec(), Object::Array(differences));
+    let mut font = Dict::new();
+    font.set(b"Type".to_vec(), Object::name("Font"));
+    font.set(b"Subtype".to_vec(), Object::name("Type3"));
+    let (font_name, prefix) = fallback_names(face, hebrew);
+    font.set(b"Name".to_vec(), Object::name(font_name));
+    let mut descriptor = Dict::new();
+    descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
+    descriptor.set(b"FontName".to_vec(), Object::name(&format!("{}-{}", face.family, face.style).replace(' ', "")));
+    descriptor.set(b"FontFamily".to_vec(), Object::String(PdfString::literal(face.family.as_bytes().to_vec())));
+    descriptor.set(b"Flags".to_vec(), Object::Int(if face.family.contains("Mincho") { 6 } else { 4 }));
+    descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
+    // PDF 1.7 tables 5.9 and 5.19: a Type 3 descriptor is indirect; Ascent/Descent may be omitted.
+    font.set(b"FontDescriptor".to_vec(), Object::Ref(doc.add(Object::Dict(descriptor))));
+    font.set(b"FontBBox".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(-300), Object::Int(1000), Object::Int(1000)]));
+    font.set(
+        b"FontMatrix".to_vec(),
+        Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
+    );
+    font.set(b"FirstChar".to_vec(), Object::Int(1));
+    font.set(b"LastChar".to_vec(), Object::Int(last_char as i64));
+    font.set(b"Widths".to_vec(), Object::Array(widths));
+    font.set(b"Encoding".to_vec(), Object::Dict(encoding));
+    font.set(b"CharProcs".to_vec(), Object::Dict(charprocs));
+    font.set(b"ToUnicode".to_vec(), Object::Ref(cmap_ref));
+    let mut name = String::from(prefix);
+    let mut suffix = 0usize;
+    while fonts_res.contains(name.as_bytes()) {
+        suffix = suffix.saturating_add(1);
+        name = format!("{prefix}{suffix}");
+    }
+    fonts_res.set(name.as_bytes().to_vec(), Object::Dict(font));
+    name
+}
+
+/// The runs that show `text` in the fallback: consecutive characters in one font form one run, so
+/// a font is switched only where the text moves to another font. `None` if a character has no code.
+pub(super) fn type3_encode(fallback: &Type3Fallback, text: &str) -> Option<Vec<(String, Vec<u8>)>> {
+    let mut runs: Vec<(usize, Vec<u8>)> = Vec::new();
+    for ch in text.chars() {
+        let (font, code) = *fallback.codes.get(&ch)?;
+        match runs.last_mut() {
+            Some((last, bytes)) if *last == font => bytes.push(code),
+            _ => runs.push((font, vec![code])),
+        }
+    }
+    runs.into_iter().map(|(font, bytes)| Some((fallback.names.get(font)?.clone(), bytes))).collect()
+}
+
+/// The source font's own TrueType/OpenType program, when the document embeds a complete one whose
+/// licence allows editable embedding. A subset (an `ABCDEF+` name) is left out: a character can keep
+/// its mapping there after the subsetter dropped its outline.
+pub(crate) fn source_program(doc: &Document, fonts: &Dict, name: &str) -> Option<Vec<u8>> {
+    let font = fonts.get(name.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned())?;
+    let base = Metrics::from_dict(doc, &font).base_font;
+    if base.split_once('+').is_some_and(|(tag, _)| tag.len() == 6 && tag.bytes().all(|b| b.is_ascii_uppercase())) {
+        return None;
+    }
+    let bytes = pdfcraft_fonts::pdf::embedded_sfnt(doc, &font)?;
+    pdfcraft_fonts::embedding::validate(&bytes).is_ok().then_some(bytes)
+}
+
+/// Whether `text` has characters `line`'s font can't encode that its own program can draw.
+pub(super) fn source_program_completes(doc: &Document, fonts: &Dict, line: &TextLine, text: &str) -> bool {
+    let Some(metrics) = fonts.get(line.font.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|f| Metrics::from_dict(doc, &f)) else {
+        return false;
+    };
+    let missing: String = text.chars().filter(|c| !c.is_whitespace() && !source_encodes(&metrics, &c.to_string())).collect();
+    !missing.is_empty() && source_program(doc, fonts, &line.font).is_some_and(|bytes| pdfcraft_fonts::embedding::covers(&bytes, &missing))
+}
+
+/// A subset may contain all the letters but no space glyph: producers use another subset
+/// or a positioning operator for spaces. Do the same instead of substituting the whole font.
+pub(crate) fn source_encodes(metrics: &Metrics, text: &str) -> bool {
+    text.split(' ').all(|word| metrics.encode(word).is_some())
+}
+
+#[cfg(test)]
+thread_local! {
+    /// How often [`source_space`] ran on this thread, for the test that pins it out of per-character loops.
+    pub(crate) static SOURCE_SPACE_CALLS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+pub(crate) fn source_space(doc: &Document, fonts: &Dict, metrics: &Metrics) -> f64 {
+    #[cfg(test)]
+    SOURCE_SPACE_CALLS.with(|c| c.set(c.get().saturating_add(1)));
+    let width = |m: &Metrics| m.encode(" ").map(|b| m.codes(&b).iter().map(|(c, _)| m.width(*c)).sum::<f64>());
+    if let Some(w) = width(metrics) {
+        return w;
+    }
+    let family = metrics.base_font.rsplit('+').next().unwrap_or(&metrics.base_font);
+    for (_, font) in fonts.iter() {
+        if let Some(dict) = doc.resolve(font).as_dict() {
+            let m = Metrics::from_dict(doc, dict);
+            if m.base_font.rsplit('+').next() == Some(family)
+                && let Some(w) = width(&m)
+            {
+                return w;
+            }
+        }
+    }
+    0.33
+}
+
+pub(crate) fn source_width(metrics: &Metrics, text: &str, size: f64, space: f64, char_spacing: f64, word_spacing: f64) -> f64 {
+    if let Some(bytes) = metrics.encode(text) {
+        // PDF word spacing applies only to single-byte code 32, even for a Unicode space.
+        return metrics
+            .codes(&bytes)
+            .iter()
+            .map(|(c, len)| metrics.width(*c) * size + char_spacing + if metrics.is_space(*c, *len) { word_spacing } else { 0.0 })
+            .sum();
+    }
+    let words: f64 = text
+        .split(' ')
+        .filter_map(|w| metrics.encode(w))
+        .map(|b| metrics.codes(&b).iter().map(|(c, _)| metrics.width(*c) * size + char_spacing).sum::<f64>())
+        .sum();
+    words + text.matches(' ').count() as f64 * (space * size + char_spacing + word_spacing)
+}
+
+pub(crate) fn source_show(metrics: &Metrics, text: &str, size: f64, space: f64, char_spacing: f64, word_spacing: f64) -> Result<Vec<Op>, EditError> {
+    if let Some(bytes) = metrics.encode(text) {
+        return Ok(vec![Op::new("Tj", vec![Object::String(PdfString::literal(bytes))])]);
+    }
+    let adjustment = -1000.0 * (space + (char_spacing + word_spacing) / size);
+    if !adjustment.is_finite() {
+        return Err(EditError::Invalid("the source font's space advance is invalid".into()));
+    }
+    let mut out = Vec::new();
+    for (i, word) in text.split(' ').enumerate() {
+        if i > 0 {
+            out.push(Op::new("TJ", vec![Object::Array(vec![pdfcraft_content::num(adjustment)])]));
+        }
+        if !word.is_empty() {
+            let bytes = metrics.encode(word).ok_or_else(|| EditError::Invalid("the source font cannot show the replacement text".into()))?;
+            out.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
+        }
+    }
+    Ok(out)
+}
diff --git a/crates/edit/src/text/interp.rs b/crates/edit/src/text/interp.rs
new file mode 100644
index 0000000000..ca0d63cef4
--- /dev/null
+++ b/crates/edit/src/text/interp.rs
@@ -0,0 +1,856 @@
+use super::fallback::is_type3_fallback;
+use super::rewrite::vertical_advance;
+use super::*;
+
+/// Text and graphics state captured for rewriting.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct TextState {
+    pub(crate) font: Option<(String, f64)>,
+    pub(crate) char_spacing: f64,
+    pub(crate) word_spacing: f64,
+    pub(crate) scale: f64,
+    pub(super) leading: f64,
+    pub(crate) rise: f64,
+    pub(crate) fill: Vec<Op>,
+    /// The text rendering mode (`Tr`); 3 is invisible text, as in an OCR layer over a scan.
+    pub(crate) render_mode: i64,
+    /// The stroke colour operators, the line width and the ExtGStates selected (see [`Ts`]):
+    /// graphics state the text was painted with that [`TextState::ops`] doesn't restate.
+    pub(super) stroke: Vec<Op>,
+    pub(super) line_width: Option<f64>,
+    ext_gstate: Vec<Vec<u8>>,
+    /// The dash pattern and line cap in force (see [`Ts`]): compared, not restated.
+    pub(super) dash: Dash,
+    pub(super) line_cap: i64,
+}
+
+impl TextState {
+    pub(super) fn of(ts: &Ts) -> Self {
+        TextState {
+            font: ts.font.as_ref().map(|(n, _)| (String::from_utf8_lossy(n).into_owned(), ts.size)),
+            char_spacing: ts.char_spacing,
+            word_spacing: ts.word_spacing,
+            scale: ts.scale,
+            leading: ts.leading,
+            rise: ts.rise,
+            fill: ts.fill.clone(),
+            render_mode: ts.render_mode,
+            stroke: ts.stroke.clone(),
+            line_width: ts.line_width,
+            ext_gstate: ts.ext_gstate.clone(),
+            dash: ts.dash.clone(),
+            line_cap: ts.line_cap,
+        }
+    }
+
+    /// Operators that change how text is painted from `current` (the state where they run) to
+    /// this one: the ExtGStates, stroke colour, line width and a visible rendering mode. A
+    /// rewritten paragraph is drawn before its text object, so whatever that object set before
+    /// its first show (`/GS1 gs`, `1 Tr 1 0 0 RG 2 w` inside `BT`, #3508/#3509) must be stated
+    /// again. Empty when nothing differs.
+    ///
+    /// Only fill, stroke and fill-then-stroke (`Tr` 0–2) are restated: invisible text is revealed
+    /// by [`reveal_ops`] and clipping text is refused, so neither is ever drawn this way.
+    ///
+    /// A `gs` has no inverse, so a selection `current` has and this state doesn't stays in force:
+    /// run these inside a `q`/`Q` that starts from `current`, one per state drawn.
+    pub(crate) fn paint_ops(&self, current: &TextState) -> Vec<Op> {
+        let n = pdfcraft_content::num;
+        let mut v = Vec::new();
+        // The selections both share stay in force; the ones after them are selected again in order.
+        let shared = self.ext_gstate.iter().zip(&current.ext_gstate).take_while(|(a, b)| a == b).count();
+        for name in self.ext_gstate.iter().skip(shared) {
+            v.push(Op::new("gs", vec![Object::Name(name.clone())]));
+        }
+        // A reselected ExtGState may set `/LW`, so the width (already the effective one) follows it.
+        let reselected = !v.is_empty();
+        if self.stroke != current.stroke {
+            if self.stroke.is_empty() {
+                // The initial stroke colour: black in DeviceGray.
+                v.push(Op::new("G", vec![n(0.0)]));
+            } else {
+                v.extend(self.stroke.iter().cloned());
+            }
+        }
+        let width = self.line_width.unwrap_or(1.0);
+        if reselected || width != current.line_width.unwrap_or(1.0) {
+            v.push(Op::new("w", vec![n(width)]));
+        }
+        if (0..=2).contains(&self.render_mode) && self.render_mode != current.render_mode {
+            v.push(Op::new("Tr", vec![Object::Int(self.render_mode)]));
+        }
+        v
+    }
+
+    /// Operators that set this state (inside a text object).
+    pub(crate) fn ops(&self) -> Vec<Op> {
+        let n = pdfcraft_content::num;
+        let mut v = Vec::new();
+        if let Some((f, size)) = &self.font {
+            v.push(Op::new("Tf", vec![Object::name(f), n(*size)]));
+        }
+        v.push(Op::new("Tc", vec![n(self.char_spacing)]));
+        v.push(Op::new("Tw", vec![n(self.word_spacing)]));
+        v.push(Op::new("Tz", vec![n(self.scale * 100.0)]));
+        v.push(Op::new("TL", vec![n(self.leading)]));
+        v.push(Op::new("Ts", vec![n(self.rise)]));
+        v.extend(self.fill.iter().cloned());
+        v
+    }
+}
+
+/// What a run is drawn in beyond its text state: the optional content groups of the `/OC`
+/// marked-content sequences around it, and the effective graphics state parameters (`gs`) in
+/// force. A rewrite writes a paragraph in its first run's place, so runs that differ here are
+/// never joined: one in a hidden layer or at another opacity would lose it.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(super) struct Paint {
+    layers: Vec<Vec<u8>>,
+    gs: Gs,
+}
+
+/// The transparency parameters of the graphics state: what the `gs` operators have set, resolved,
+/// so a repeated `gs` or two names with the same settings leave it as it was.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Gs {
+    /// `ca`, the fill opacity.
+    fill_alpha: f64,
+    /// `CA`, the stroke opacity.
+    stroke_alpha: f64,
+    /// `BM`, the blend mode (`Compatible` is `Normal`).
+    blend: Vec<u8>,
+    /// `SMask`, when it is not `None`: the reference of an indirect soft mask, else the dictionary.
+    soft_mask: Option<Object>,
+}
+
+impl Default for Gs {
+    fn default() -> Self {
+        Gs { fill_alpha: 1.0, stroke_alpha: 1.0, blend: b"Normal".to_vec(), soft_mask: None }
+    }
+}
+
+impl Gs {
+    /// Applies the parameters a graphics state parameter dictionary sets; the others stay.
+    fn apply(&mut self, doc: &Document, params: &Dict) {
+        let num = |key: &[u8]| params.get(key).and_then(|o| doc.resolve(o).as_f64()).filter(|v| v.is_finite());
+        if let Some(v) = num(b"ca") {
+            self.fill_alpha = v;
+        }
+        if let Some(v) = num(b"CA") {
+            self.stroke_alpha = v;
+        }
+        if let Some(bm) = params.get(b"BM").map(|o| doc.resolve(o)) {
+            let first = bm
+                .as_name()
+                .map(<[u8]>::to_vec)
+                .or_else(|| bm.as_array().and_then(|a| a.iter().find_map(|o| doc.resolve(o).as_name().map(<[u8]>::to_vec))));
+            if let Some(name) = first {
+                self.blend = if name == b"Compatible" { b"Normal".to_vec() } else { name };
+            }
+        }
+        if let Some(mask) = params.get(b"SMask") {
+            self.soft_mask = match (mask.as_ref(), &*doc.resolve(mask)) {
+                (_, Object::Name(_)) => None,
+                (Some(r), _) => Some(Object::Ref(r)),
+                (None, Object::Dict(d)) => Some(Object::Dict(d.clone())),
+                (None, _) => None,
+            };
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Origin {
+    pub(crate) tm: [f64; 6],
+    /// The text line matrix there (where the next line's Td/T* starts from).
+    pub(crate) tlm: [f64; 6],
+    /// Text-space units → user space (the scale of the text rendering matrix's y axis).
+    pub(crate) k: f64,
+    /// The CTM there (current space → page space), for moving the paragraph in page space.
+    pub(crate) ctm: [f64; 6],
+    pub(crate) baseline: f64,
+    pub(crate) x: f64,
+    pub(crate) state: TextState,
+    pub(crate) bt_op: usize,
+    pub(crate) bt_state: TextState,
+}
+
+/// The unit x axis of a text rendering matrix in user space (`(1, 0)` when it is degenerate).
+pub(super) fn direction(m: &Matrix) -> (f64, f64) {
+    let (x, y) = (m.0[0], m.0[1]);
+    let length = x.hypot(y);
+    if length.is_finite() && length > 1e-9 { (x / length, y / length) } else { (1.0, 0.0) }
+}
+
+/// User-space point `p` as `(along, across)` a baseline running in unit direction `dir`. Upright
+/// text (`dir` = `(1, 0)`) keeps its coordinates, so lines and rows of turned text are found the
+/// same way (#1443).
+pub(super) fn to_frame(dir: (f64, f64), p: (f64, f64)) -> (f64, f64) {
+    (p.0 * dir.0 + p.1 * dir.1, p.1 * dir.0 - p.0 * dir.1)
+}
+
+/// The box covering both `[x0, y0, x1, y1]` boxes.
+pub(crate) fn union(a: [f64; 4], b: [f64; 4]) -> [f64; 4] {
+    [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]
+}
+
+#[derive(Clone)]
+pub(super) struct Ts {
+    pub(super) ctm: Matrix,
+    /// The operators that set the current fill colour (`g`, `rg`, `k`, or `cs` + `sc`/`scn`).
+    pub(super) fill: Vec<Op>,
+    pub(super) font: Option<(Vec<u8>, Rc<Metrics>)>,
+    /// The Japanese or Hebrew fallback face the font subsets, when the font is one (see [`is_type3_fallback`]).
+    pub(super) face: Option<String>,
+    pub(super) size: f64,
+    pub(super) char_spacing: f64,
+    pub(super) word_spacing: f64,
+    pub(super) scale: f64,
+    pub(super) leading: f64,
+    pub(super) rise: f64,
+    pub(super) render_mode: i64,
+    /// The transparency parameters the `gs` operators have set so far (see [`Paint`]).
+    pub(super) gs: Gs,
+    /// The font's vertical advance per unit of font size (`/DW2`'s w1, normally −1) when its
+    /// CMap writes vertically (`WMode 1`, §9.7.4.3): each glyph then moves the pen down, not right.
+    pub(super) vertical: Option<f64>,
+    /// Why the font's writing mode couldn't be read (a broken or cyclic CMap). Its text is then
+    /// listed as horizontal, but the lines in it are refused for editing.
+    pub(super) unreadable: Option<Rc<str>>,
+    /// The operators that set the current stroke colour (`G`, `RG`, `K`, or `CS` + `SC`/`SCN`).
+    pub(super) stroke: Vec<Op>,
+    /// The line width a `w` or an ExtGState's `/LW` set (`None`: the initial 1.0).
+    pub(super) line_width: Option<f64>,
+    /// The ExtGState resources selected with `gs`, oldest first (see [`select_gs`]).
+    pub(super) ext_gstate: Vec<Vec<u8>>,
+    /// The dash pattern a `d` or an ExtGState's `/D` set (initially solid: `[] 0`).
+    pub(super) dash: Dash,
+    /// The line cap a `J` or an ExtGState's `/LC` set (initially 0, butt).
+    pub(super) line_cap: i64,
+}
+
+/// A dash pattern (ISO 32000-2 §8.4.3.6): the dash array and the phase.
+type Dash = (Vec<f64>, f64);
+
+/// The most dash array entries a pattern keeps; a longer one is ignored, as is a malformed one.
+const MAX_DASH: usize = 32;
+
+/// The dash pattern `array phase`, as `d` takes it and an ExtGState's `/D` holds it.
+fn dash_pattern(doc: &Document, array: Option<&Object>, phase: Option<&Object>) -> Option<Dash> {
+    let array = doc.resolve(array?);
+    let items = array.as_array().filter(|a| a.len() <= MAX_DASH)?;
+    let finite = |o: &Object| doc.resolve(o).as_f64().filter(|v| v.is_finite());
+    Some((items.iter().map(finite).collect::<Option<Vec<_>>>()?, finite(phase?)?))
+}
+
+/// A line cap style, as `J` takes it and an ExtGState's `/LC` holds it: 0, 1 or 2.
+fn line_cap(doc: &Document, cap: Option<&Object>) -> Option<i64> {
+    doc.resolve(cap?).as_int().filter(|c| (0..=2).contains(c))
+}
+
+/// The most `gs` selections a state remembers. Repeating a selection moves it to the end, so
+/// this bounds the distinct ExtGStates in force, not the operators a hostile stream repeats.
+const MAX_GS: usize = 32;
+
+/// Record `gs /name` in `list`. A `gs` sets every parameter its dictionary names to an absolute
+/// value, so a later selection of the same dictionary overrides the earlier one completely: the
+/// earlier entry goes, which keeps replaying the list equivalent to replaying the stream.
+fn select_gs(list: &mut Vec<Vec<u8>>, name: &[u8]) {
+    list.retain(|n| n != name);
+    if list.len() >= MAX_GS {
+        list.remove(0);
+    }
+    list.push(name.to_vec());
+}
+
+/// The text-showing operators of one stream with their text, font, box and baseline.
+pub(super) struct Shown {
+    pub(super) op: usize,
+    pub(super) extra_ops: Vec<usize>,
+    /// Encoded glyphs, not bytes or Unicode characters (a ligature can represent several).
+    pub(super) glyph_count: usize,
+    /// Advance in text space, including spacing and TJ adjustments.
+    pub(super) advance: f64,
+    pub(super) tracking: f64,
+    /// The text matrix where it starts (text space), and the state there and at its `BT`.
+    pub(super) tm: Matrix,
+    pub(super) tlm: Matrix,
+    pub(super) state: Ts,
+    pub(super) bt_op: usize,
+    pub(super) bt_state: Ts,
+    pub(super) text: String,
+    pub(super) rect: [f64; 4],
+    /// Its box along and across its baseline (see [`TextLine::frame`]).
+    pub(super) frame: [f64; 4],
+    /// The boxes of its words (see [`TextLine::ink`]).
+    pub(super) ink: Vec<[f64; 4]>,
+    pub(super) baseline: f64,
+    pub(super) start_x: f64,
+    end_x: f64,
+    end_y: f64,
+    pub(super) bt: usize,
+    pub(super) font: Vec<u8>,
+    pub(super) base_font: String,
+    pub(super) face: Option<String>,
+    pub(super) size: f64,
+    pub(super) bold: bool,
+    pub(super) italic: bool,
+    pub(super) visual_order: bool,
+    pub(super) decodable: bool,
+    pub(super) scope: Option<usize>,
+    pub(super) paint: Paint,
+    pub(super) logical_order: bool,
+    pub(super) actual_text: bool,
+}
+
+impl Shown {
+    /// The unit direction of its baseline, where it starts and ends along it, and the baseline's
+    /// offset across it (for upright text: the user-space x, x and y). A vertical run goes along
+    /// its column instead, the way the pen moves: for upright text down, with the column's x
+    /// across.
+    fn span(&self) -> ((f64, f64), f64, f64, f64) {
+        let m = self.tm.then(&self.state.ctm);
+        let dir = match self.state.vertical {
+            Some(w1) => direction(&Matrix([m.0[2] * w1.signum(), m.0[3] * w1.signum(), 0.0, 0.0, 0.0, 0.0])),
+            None => direction(&m),
+        };
+        let (start, across) = to_frame(dir, (self.start_x, self.baseline));
+        (dir, start, to_frame(dir, (self.end_x, self.end_y)).0, across)
+    }
+}
+
+/// Where the previous run of a line ended: its text object, baseline direction, offset across
+/// the baseline, end along it and size.
+#[derive(Clone, Copy)]
+pub(super) struct Pen {
+    pub(super) bt: usize,
+    dir: (f64, f64),
+    across: f64,
+    end: f64,
+    pub(super) size: f64,
+    vertical: bool,
+}
+
+impl Pen {
+    pub(super) fn after(s: &Shown) -> Self {
+        let (dir, _, end, across) = s.span();
+        Pen { bt: s.bt, dir, across, end, size: s.size.max(1.0), vertical: s.state.vertical.is_some() }
+    }
+
+    /// Whether `s` could continue the same line on geometry alone: on the same baseline, starting
+    /// at most a word gap (`reach` sizes) after it. Also the gap along the baseline.
+    pub(super) fn continues(&self, s: &Shown, reach: f64) -> (bool, f64) {
+        let (dir, start, _, across) = s.span();
+        let gap = start - self.end;
+        let same_dir = (dir.0 - self.dir.0).abs() < 1e-3 && (dir.1 - self.dir.1).abs() < 1e-3;
+        // A column continues a column (along which the pen moves), a baseline a baseline.
+        let same_dir = same_dir && self.vertical == s.state.vertical.is_some();
+        (same_dir && (across - self.across).abs() < self.size * 0.3 && gap > -self.size && gap < self.size * reach, gap)
+    }
+}
+
+/// Use the lower third of letter gaps, not word gaps. A pair of isolated labels is not
+/// evidence of tracking; unadjusted neighbours inside a string contribute zero too.
+/// The tracking a run of glyphs was set with: the lower third of its gaps, when that is at
+/// most half an em (`limit`). A wider "tracking" is word or cell spacing between one-glyph
+/// words (`a b c`, a column of digits or Y/N ticks), which must keep its spaces.
+fn typical_tracking(gaps: &mut [f64], limit: f64) -> f64 {
+    if gaps.len() < 3 {
+        return 0.0;
+    }
+    let at = gaps.len() / 3;
+    gaps.select_nth_unstable_by(at, f64::total_cmp);
+    gaps.get(at).copied().filter(|n| n.is_finite() && *n <= limit).unwrap_or(0.0).max(0.0)
+}
+
+fn tj_tracking(pieces: &[Object], metrics: &Metrics, size: f64, scale: f64) -> f64 {
+    let mut gaps = Vec::new();
+    let mut previous = false;
+    let mut gap = 0.0;
+    for piece in pieces {
+        if let Object::String(s) = piece {
+            for (code, len) in metrics.codes(&s.bytes) {
+                let blank = metrics.is_space(code, len) || metrics.text_of(code).is_some_and(|t| !t.is_empty() && t.chars().all(char::is_whitespace));
+                if previous && !blank {
+                    gaps.push(gap);
+                }
+                previous = !blank;
+                gap = 0.0;
+            }
+        } else if let Some(n) = piece.as_f64() {
+            gap += -n / 1000.0 * size * scale;
+        }
+    }
+    typical_tracking(&mut gaps, size * scale.abs() * 0.5)
+}
+
+fn positioned_tracking(shown: &mut [Shown]) {
+    let mut start = 0;
+    while start < shown.len() {
+        let mut end = start.saturating_add(1);
+        while let (Some(prev), Some(next)) = (shown.get(end.saturating_sub(1)), shown.get(end)) {
+            if prev.glyph_count != 1
+                || next.glyph_count != 1
+                || prev.font != next.font
+                || prev.scope != next.scope
+                || (prev.size - next.size).abs() > 0.01
+                || prev.state.char_spacing != next.state.char_spacing
+                || prev.state.scale != next.state.scale
+                || !Pen::after(prev).continues(next, 1.5).0
+            {
+                break;
+            }
+            end = end.saturating_add(1);
+        }
+        if let Some(run) = shown.get_mut(start..end) {
+            let mut gaps: Vec<f64> = run
+                .windows(2)
+                .filter_map(|pair| {
+                    let [prev, next] = pair else { return None };
+                    (!prev.text.trim().is_empty() && !next.text.trim().is_empty()).then(|| Pen::after(prev).continues(next, 0.0).1)
+                })
+                .collect();
+            let limit = run.first().map_or(0.0, |s| s.size * s.state.scale.abs() * 0.5);
+            let tracking = typical_tracking(&mut gaps, limit);
+            for s in run.iter_mut().skip(1) {
+                s.tracking = tracking;
+            }
+        }
+        start = end;
+    }
+}
+
+/// The graphics state carried from one of a page's content streams to the next: the streams
+/// are one stream in pieces (§7.8.2), so a `cm` (AutoCAD scales the whole page in the first
+/// stream), an unbalanced `q`, the font and the colour still apply in the streams after it.
+pub(super) struct Carry {
+    pub(super) ts: Ts,
+    pub(super) stack: Vec<Ts>,
+    pub(super) marked: Vec<Option<usize>>,
+    /// For each open marked-content sequence, its optional content group when it is `/OC`.
+    pub(super) layers: Vec<Option<Vec<u8>>>,
+    /// Bytes of glyph text the rest of the page may still produce (see [`MAX_PAGE_TEXT`]).
+    pub(super) text_left: usize,
+}
+
+/// The most glyph text one page's extraction produces, in bytes. A ToUnicode destination is
+/// copied for every glyph showing its code, so a small page can otherwise expand into gigabytes;
+/// real pages hold far less (a whole novel is about 1 MB).
+const MAX_PAGE_TEXT: usize = 16 << 20;
+
+impl Carry {
+    pub(super) fn new() -> Self {
+        let ts = Ts {
+            ctm: Matrix::IDENTITY,
+            fill: Vec::new(),
+            font: None,
+            face: None,
+            size: 0.0,
+            char_spacing: 0.0,
+            word_spacing: 0.0,
+            scale: 1.0,
+            leading: 0.0,
+            rise: 0.0,
+            render_mode: 0,
+            gs: Gs::default(),
+            vertical: None,
+            unreadable: None,
+            stroke: Vec::new(),
+            line_width: None,
+            ext_gstate: Vec::new(),
+            dash: (Vec::new(), 0.0),
+            line_cap: 0,
+        };
+        Carry { ts, stack: Vec::new(), marked: Vec::new(), layers: Vec::new(), text_left: MAX_PAGE_TEXT }
+    }
+}
+
+/// A font resource's metrics, fallback face and vertical advance (see [`Ts`]), read once per page.
+/// The advance is an error message when the font's writing mode can't be read.
+type CachedFont = (Rc<Metrics>, Option<String>, Result<Option<f64>, String>);
+
+/// A `Do` met while interpreting: its operator index, XObject name and the state there.
+type Invocation = (usize, Vec<u8>, Ts);
+
+pub(super) fn interpret(
+    doc: &Document,
+    ops: &[Op],
+    resources: &Dict,
+    cache: &mut HashMap<Vec<u8>, CachedFont>,
+    carry: &mut Carry,
+    mut invoked: Option<&mut Vec<Invocation>>,
+    // `Some(properties)`: read `/ActualText`, looking named property lists up in `properties`.
+    logical_text: Option<&Dict>,
+) -> Result<Vec<Shown>, EditError> {
+    let fonts_res = resources.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
+    let states = resources.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
+    let mut out: Vec<Shown> = Vec::new();
+    let mut ts = carry.ts.clone();
+    let mut at_bt = (0usize, ts.clone());
+    let mut stack: Vec<Ts> = std::mem::take(&mut carry.stack);
+    let (mut tm, mut tlm) = (Matrix::IDENTITY, Matrix::IDENTITY);
+    let mut bt = 0usize;
+    let mut marked = std::mem::take(&mut carry.marked);
+    let mut layers = std::mem::take(&mut carry.layers);
+    let mut actual: Vec<Option<(usize, usize, String)>> = Vec::new();
+    for (i, op) in ops.iter().enumerate() {
+        match op.op.as_slice() {
+            // No depth cap: every `EMC` pops, so a capped push would pair it with the enclosing
+            // sequence (#3573). Both stacks stay bounded by the number of operators.
+            b"BMC" | b"BDC" => {
+                // Marked text paragraphs/headings are authoritative boundaries. Ignore
+                // artifacts and inner spans, which inherit their enclosing region.
+                let region = matches!(op.name(0), Some(b"P" | b"H" | b"H1" | b"H2" | b"H3" | b"H4" | b"H5" | b"H6" | b"LI" | b"TD" | b"TH"));
+                marked.push(if region { Some(i) } else { marked.last().copied().flatten() });
+                // A layer named in the resources is told apart by its name, an inline one by where it opens.
+                let layer = op.is("BDC") && op.name(0) == Some(b"OC".as_slice());
+                layers.push(layer.then(|| op.operands.get(1).and_then(Object::as_name).map_or_else(|| format!("@{i}").into_bytes(), <[u8]>::to_vec)));
+                // The property list is inline or named in the resources' /Properties (§14.6.2).
+                let list = logical_text.and_then(|properties| match op.operands.get(1) {
+                    Some(Object::Name(n)) => properties.get(n).and_then(|o| doc.dict(o)),
+                    other => other.and_then(Object::as_dict).cloned(),
+                });
+                let logical = list.as_ref().and_then(|d| d.get(b"ActualText")).and_then(|s| match s {
+                    Object::String(s) if s.bytes.len() <= 4_000_000 => Some(s.to_text()),
+                    _ => None,
+                });
+                actual.push(logical.map(|s| (out.len(), i, s)));
+            }
+            b"EMC" => {
+                marked.pop();
+                layers.pop();
+                if let Some(Some((start, open, logical))) = actual.pop() {
+                    let tail = out.split_off(start.min(out.len()));
+                    let mut items = tail.into_iter();
+                    if let Some(mut first) = items.next() {
+                        for shown in items {
+                            first.glyph_count = first.glyph_count.saturating_add(shown.glyph_count);
+                            first.extra_ops.push(shown.op);
+                            first.extra_ops.extend(shown.extra_ops);
+                            first.rect = [
+                                first.rect[0].min(shown.rect[0]),
+                                first.rect[1].min(shown.rect[1]),
+                                first.rect[2].max(shown.rect[2]),
+                                first.rect[3].max(shown.rect[3]),
+                            ];
+                            first.frame = union(first.frame, shown.frame);
+                            first.ink.extend(shown.ink);
+                        }
+                        first.extra_ops.extend([open, i]);
+                        // Only right-to-left ActualText is already in typing order and must stay
+                        // out of the line's bidi recovery. Word and Chrome wrap Latin ligatures
+                        // (`fi`, `fl`) in ActualText spans mid-word; those keep joining their line.
+                        first.logical_order = logical.chars().any(crate::bidi::is_rtl);
+                        first.actual_text = true;
+                        first.text = logical;
+                        first.start_x = first.rect[0];
+                        first.end_x = first.rect[2];
+                        first.end_y = first.baseline;
+                        first.advance = (first.end_x - first.start_x) / first.tm.then(&first.state.ctm).0[0].abs().max(1e-6);
+                        out.push(first);
+                    }
+                }
+            }
+            b"q" => stack.push(ts.clone()),
+            b"Q" => {
+                if let Some(s) = stack.pop() {
+                    ts = s;
+                }
+            }
+            b"cm" => {
+                if let Some(m) = op.nums::<6>() {
+                    ts.ctm = Matrix(m).then(&ts.ctm);
+                }
+            }
+            b"BT" => {
+                tm = Matrix::IDENTITY;
+                tlm = Matrix::IDENTITY;
+                bt += 1;
+                at_bt = (i, ts.clone());
+            }
+            b"g" | b"rg" | b"k" | b"cs" => ts.fill = vec![op.clone()],
+            b"sc" | b"scn" => {
+                ts.fill.retain(|o| o.is("cs"));
+                ts.fill.push(op.clone());
+            }
+            b"G" | b"RG" | b"K" | b"CS" => ts.stroke = vec![op.clone()],
+            b"SC" | b"SCN" => {
+                ts.stroke.retain(|o| o.is("CS"));
+                ts.stroke.push(op.clone());
+            }
+            b"w" => ts.line_width = op.num(0).filter(|w| w.is_finite()).or(ts.line_width),
+            b"d" => ts.dash = dash_pattern(doc, op.operands.first(), op.operands.get(1)).unwrap_or_else(|| ts.dash.clone()),
+            b"J" => ts.line_cap = line_cap(doc, op.operands.first()).unwrap_or(ts.line_cap),
+            b"Tf" => {
+                ts.size = op.num(1).unwrap_or(ts.size);
+                if let Some(name) = op.name(0) {
+                    let (m, face, vertical) = cache.entry(name.to_vec()).or_insert_with(|| {
+                        let dict = fonts_res.get(name).and_then(|f| doc.resolve(f).as_dict().cloned());
+                        let metrics = dict.as_ref().map_or_else(Metrics::fallback, |d| Metrics::from_dict(doc, d));
+                        let vertical = dict.as_ref().map_or(Ok(None), |d| vertical_advance(doc, d).map_err(|e| e.to_string()));
+                        let face = dict.filter(is_type3_fallback).map(|_| metrics.base_font.clone());
+                        (Rc::new(metrics), face, vertical)
+                    });
+                    ts.font = Some((name.to_vec(), m.clone()));
+                    ts.face = face.clone();
+                    // Which way the glyphs advance is unknown (§9.7.4.3): list the font's text as
+                    // horizontal and record why, so editing its lines is refused (not the page).
+                    match vertical {
+                        Ok(v) => (ts.vertical, ts.unreadable) = (*v, None),
+                        Err(e) => (ts.vertical, ts.unreadable) = (None, Some(Rc::from(e.as_str()))),
+                    }
+                }
+            }
+            b"Tc" => ts.char_spacing = op.num(0).unwrap_or(0.0),
+            b"Tw" => ts.word_spacing = op.num(0).unwrap_or(0.0),
+            b"Tz" => ts.scale = op.num(0).unwrap_or(100.0) / 100.0,
+            b"TL" => ts.leading = op.num(0).unwrap_or(0.0),
+            b"Ts" => ts.rise = op.num(0).unwrap_or(0.0),
+            b"Tr" => ts.render_mode = op.operands.first().and_then(Object::as_int).unwrap_or(-1),
+            b"gs" => {
+                if let Some(name) = op.name(0) {
+                    select_gs(&mut ts.ext_gstate, name);
+                }
+                let params = op.name(0).and_then(|name| states.get(name)).map(|p| doc.resolve(p));
+                if let Some(params) = params.as_deref().and_then(Object::as_dict) {
+                    ts.gs.apply(doc, params);
+                    // `/LW` sets the line width as `w` does (ISO 32000-2 §8.4.5).
+                    let lw = params.get(b"LW").and_then(|w| doc.resolve(w).as_f64()).filter(|w| w.is_finite());
+                    ts.line_width = lw.or(ts.line_width);
+                    let dash = params.get(b"D").map(|d| doc.resolve(d));
+                    let dash = dash.as_deref().and_then(Object::as_array);
+                    if let Some(d) = dash.and_then(|d| dash_pattern(doc, d.first(), d.get(1))) {
+                        ts.dash = d;
+                    }
+                    ts.line_cap = line_cap(doc, params.get(b"LC")).unwrap_or(ts.line_cap);
+                }
+            }
+            b"Do" => {
+                if let (Some(list), Some(name)) = (invoked.as_deref_mut(), op.name(0)) {
+                    list.push((i, name.to_vec(), ts.clone()));
+                }
+            }
+            b"Td" | b"TD" => {
+                if let Some([x, y]) = op.nums::<2>() {
+                    if op.is("TD") {
+                        ts.leading = -y;
+                    }
+                    tlm = Matrix([1.0, 0.0, 0.0, 1.0, x, y]).then(&tlm);
+                    tm = tlm;
+                }
+            }
+            b"Tm" => {
+                if let Some(m) = op.nums::<6>() {
+                    tlm = Matrix(m);
+                    tm = tlm;
+                }
+            }
+            b"T*" => {
+                tlm = Matrix([1.0, 0.0, 0.0, 1.0, 0.0, -ts.leading]).then(&tlm);
+                tm = tlm;
+            }
+            b"Tj" | b"TJ" | b"'" | b"\"" => {
+                if matches!(op.op.as_slice(), b"'" | b"\"") {
+                    if op.is("\"") {
+                        ts.word_spacing = op.num(0).unwrap_or(ts.word_spacing);
+                        ts.char_spacing = op.num(1).unwrap_or(ts.char_spacing);
+                    }
+                    tlm = Matrix([1.0, 0.0, 0.0, 1.0, 0.0, -ts.leading]).then(&tlm);
+                    tm = tlm;
+                }
+                let Some((name, m)) = ts.font.clone() else { continue };
+                // Pieces: strings, and TJ number adjustments.
+                let pieces: Vec<Object> = match op.op.as_slice() {
+                    // A surplus array (`[(A)] [(B)] TJ`) is malformed, but the operator still
+                    // takes the one immediately before it, as the renderer and every other
+                    // reader here do (#3569) -- not the first, which a reader counting operands
+                    // from the front of a surplus list would otherwise take.
+                    b"TJ" => op.operands.last().and_then(Object::as_array).cloned().unwrap_or_default(),
+                    _ => op.operands.last().cloned().into_iter().collect(),
+                };
+                // Tc is already included in the pen advance; TJ may encode tracking instead.
+                let tracking = if op.is("TJ") { tj_tracking(&pieces, &m, ts.size, ts.scale) } else { 0.0 };
+                let trm0 = tm.then(&ts.ctm);
+                let start = trm0.apply(0.0, ts.rise);
+                let mut text = String::new();
+                let mut decodable = true;
+                let mut x_text = 0.0;
+                // Vertical text (§9.4.4): the pen moves along y instead, and each glyph is centred
+                // on it horizontally; `half` is half the widest glyph.
+                let vertical = ts.vertical;
+                let (mut y_text, mut half) = (0.0, 0.0_f64);
+                // Where each word's glyphs start and end along the run (text space), and whether
+                // the next glyph continues the last word.
+                let mut words: Vec<(f64, f64)> = Vec::new();
+                let mut in_word = false;
+                let mut glyph_count = 0_usize;
+                for p in &pieces {
+                    match p {
+                        Object::String(s) => {
+                            for (code, len) in m.codes(&s.bytes) {
+                                glyph_count = glyph_count.saturating_add(1);
+                                let shown = m.text_of(code);
+                                let blank =
+                                    m.is_space(code, len) || shown.as_deref().is_some_and(|t| !t.is_empty() && t.chars().all(char::is_whitespace));
+                                match shown {
+                                    Some(t) => {
+                                        carry.text_left = carry
+                                            .text_left
+                                            .checked_sub(t.len())
+                                            .ok_or_else(|| EditError::Invalid("the page's text is too large to read".into()))?;
+                                        text.push_str(&t);
+                                    }
+                                    None => decodable = false,
+                                }
+                                let spacing = ts.char_spacing + if m.is_space(code, len) { ts.word_spacing } else { 0.0 };
+                                if let Some(w1) = vertical {
+                                    half = half.max((m.width(code) * ts.size * ts.scale).abs() / 2.0);
+                                    if !blank {
+                                        let ink_end = y_text + w1 * ts.size;
+                                        let (lo, hi) = (y_text.min(ink_end), y_text.max(ink_end));
+                                        match words.last_mut() {
+                                            Some(word) if in_word => *word = (word.0.min(lo), word.1.max(hi)),
+                                            _ => words.push((lo, hi)),
+                                        }
+                                    }
+                                    in_word = !blank;
+                                    y_text += w1 * ts.size + spacing;
+                                    continue;
+                                }
+                                if !blank {
+                                    let ink_end = x_text + m.width(code) * ts.size * ts.scale;
+                                    // A negative font size or `Tz` runs the glyphs backwards:
+                                    // the word is the union of its glyphs, whichever way they go.
+                                    let (lo, hi) = (x_text.min(ink_end), x_text.max(ink_end));
+                                    match words.last_mut() {
+                                        Some(word) if in_word => *word = (word.0.min(lo), word.1.max(hi)),
+                                        _ => words.push((lo, hi)),
+                                    }
+                                }
+                                in_word = !blank;
+                                let w = m.width(code) * ts.size + ts.char_spacing + if m.is_space(code, len) { ts.word_spacing } else { 0.0 };
+                                x_text += w * ts.scale;
+                            }
+                        }
+                        other => {
+                            if let Some(n) = other.as_f64() {
+                                if vertical.is_some() {
+                                    // Down by n/1000 em, not scaled by `Tz`.
+                                    let dy = -n / 1000.0 * ts.size;
+                                    if -dy > ts.size * 0.2 && !text.ends_with(' ') {
+                                        text.push(' ');
+                                    }
+                                    if dy.abs() > ts.size.abs() * 0.2 {
+                                        in_word = false;
+                                    }
+                                    y_text += dy;
+                                    continue;
+                                }
+                                let dx = -n / 1000.0 * ts.size * ts.scale;
+                                // A large gap inside TJ reads as a space.
+                                if dx - tracking > (ts.size * ts.scale).abs() * 0.2 && !text.ends_with(' ') {
+                                    text.push(' ');
+                                }
+                                // Tracking and kerning keep a word together; a larger jump
+                                // ends it (whatever the sign of the size or `Tz`).
+                                if dx - tracking > (ts.size * ts.scale).abs() * 0.2 || dx < -(ts.size * ts.scale).abs() * 0.2 {
+                                    in_word = false;
+                                }
+                                x_text += dx;
+                            }
+                        }
+                    }
+                }
+                tm = Matrix([1.0, 0.0, 0.0, 1.0, x_text, y_text]).then(&tm);
+                let end = tm.then(&ts.ctm).apply(0.0, ts.rise);
+                // The box from `a` to `b` along the run: from descent to ascent across it, or for
+                // vertical text, the widest glyph's width centred on the pen.
+                let span = |a: f64, b: f64| match vertical {
+                    Some(_) => {
+                        [trm0.apply(-half, ts.rise + a), trm0.apply(half, ts.rise + a), trm0.apply(-half, ts.rise + b), trm0.apply(half, ts.rise + b)]
+                    }
+                    None => [
+                        trm0.apply(a, ts.rise + m.descent * ts.size),
+                        trm0.apply(b, ts.rise + m.descent * ts.size),
+                        trm0.apply(a, ts.rise + m.ascent * ts.size),
+                        trm0.apply(b, ts.rise + m.ascent * ts.size),
+                    ],
+                };
+                let corners = span(0.0, if vertical.is_some() { y_text } else { x_text });
+                let rect = corners
+                    .iter()
+                    .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |b, p| [b[0].min(p.0), b[1].min(p.1), b[2].max(p.0), b[3].max(p.1)]);
+                // The same corners along and across the baseline: the run's own box, not its
+                // upright bounding box turned (which is wider by the box's height on a slant).
+                let dir = direction(&trm0);
+                let frame = corners
+                    .iter()
+                    .map(|&p| to_frame(dir, p))
+                    .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |b, p| [b[0].min(p.0), b[1].min(p.1), b[2].max(p.0), b[3].max(p.1)]);
+                let ink = words
+                    .iter()
+                    .map(|&(a, b)| {
+                        span(a, b)
+                            .iter()
+                            .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |r, p| [r[0].min(p.0), r[1].min(p.1), r[2].max(p.0), r[3].max(p.1)])
+                    })
+                    .collect();
+                let size_user = (trm0.0[2].powi(2) + trm0.0[3].powi(2)).sqrt() * ts.size;
+                // A numeric-only TJ adjusts the current text matrix but paints no glyphs.
+                // It must not create a phantom editable line or enlarge its neighbours' boxes.
+                if !pieces.iter().any(|p| matches!(p, Object::String(s) if !s.bytes.is_empty())) {
+                    continue;
+                }
+                out.push(Shown {
+                    op: i,
+                    extra_ops: Vec::new(),
+                    glyph_count,
+                    // Vertical text: the TJ adjustment that undoes the run is n = -1000 y / size; the
+                    // preview divides by size × `Tz`, so `Tz` is put back here.
+                    advance: if vertical.is_some() { y_text * ts.scale } else { x_text },
+                    tracking: 0.0,
+                    tm: Matrix([
+                        tm.0[0],
+                        tm.0[1],
+                        tm.0[2],
+                        tm.0[3],
+                        tm.0[4] - x_text * tm.0[0] - y_text * tm.0[2],
+                        tm.0[5] - x_text * tm.0[1] - y_text * tm.0[3],
+                    ]),
+                    state: ts.clone(),
+                    tlm,
+                    bt_op: at_bt.0,
+                    bt_state: at_bt.1.clone(),
+                    text,
+                    rect,
+                    frame,
+                    ink,
+                    baseline: start.1,
+                    start_x: start.0,
+                    end_x: end.0,
+                    end_y: end.1,
+                    bt,
+                    font: name,
+                    base_font: m.base_font.clone(),
+                    face: ts.face.clone(),
+                    size: if size_user > 0.0 { size_user } else { ts.size },
+                    bold: m.bold,
+                    italic: m.italic,
+                    visual_order: m.visual_order,
+                    decodable,
+                    scope: marked.last().copied().flatten(),
+                    paint: Paint { layers: layers.iter().flatten().cloned().collect(), gs: ts.gs.clone() },
+                    logical_order: false,
+                    actual_text: false,
+                });
+            }
+            _ => {}
+        }
+    }
+    carry.ts = ts;
+    carry.stack = stack;
+    carry.marked = marked;
+    carry.layers = layers;
+    positioned_tracking(&mut out);
+    Ok(out)
+}
diff --git a/crates/edit/src/text/lines.rs b/crates/edit/src/text/lines.rs
new file mode 100644
index 0000000000..7543adeb39
--- /dev/null
+++ b/crates/edit/src/text/lines.rs
@@ -0,0 +1,585 @@
+use super::fallback::{same_font, same_paint};
+use super::interp::{Carry, Origin, Pen, Shown, TextState, Ts, direction, interpret, to_frame, union};
+use super::*;
+
+impl TextLine {
+    /// The baseline's height in user space.
+    pub fn origin_baseline(&self) -> f64 {
+        self.origin.baseline
+    }
+
+    /// Paint position of the line's first operator: `(content-stream index, operator index in
+    /// the page's joined stream)`. A line joins runs painted at different times, so anything
+    /// painted after this position may lie on top of part of it.
+    /// (Lines from `text_lines` never come from form XObjects, so `stream` is always a
+    /// page content-stream index and `ops` are indices into the joined operator list.)
+    pub fn first_paint_pos(&self) -> (usize, usize) {
+        (self.stream, self.ops.iter().min().copied().unwrap_or(0))
+    }
+
+    /// The runs of text the line joins, in content order: each run's text as its glyphs show it,
+    /// the boxes of its words (a part of `ink`), and whether joining put a space between it and
+    /// the run before (`text` has one there; runs closer together join with none, so one word
+    /// can span runs). None when the line's text was reordered for reading (right-to-left or
+    /// visual-order Indic text): then only the line's text as a whole says what it reads.
+    pub fn runs(&self) -> impl Iterator<Item = (&str, &[[f64; 4]], bool)> {
+        let mut start = 0;
+        self.runs.iter().map(move |(text, end, spaced)| {
+            let ink = self.ink.get(start..*end).unwrap_or_default();
+            start = *end;
+            (text.as_str(), ink, *spaced)
+        })
+    }
+
+    pub(crate) fn rotation(&self) -> f64 {
+        let m = Matrix(self.origin.tm).then(&Matrix(self.origin.ctm)).0;
+        m[1].atan2(m[0]).to_degrees()
+    }
+
+    /// The unit direction its baseline runs in, in user space.
+    pub(super) fn direction(&self) -> (f64, f64) {
+        direction(&Matrix(self.origin.tm).then(&Matrix(self.origin.ctm)))
+    }
+
+    /// Whether it reads left to right along the page's x axis (most text; a page drawn
+    /// turned a quarter, as landscape pages often are, isn't).
+    pub(crate) fn upright(&self) -> bool {
+        let (x, y) = self.direction();
+        (x - 1.0).abs() < 1e-3 && y.abs() < 1e-3
+    }
+
+    /// Where it starts as `(along, across)` its baseline: user space turned to the text's direction.
+    pub(crate) fn frame_origin(&self) -> (f64, f64) {
+        to_frame(self.direction(), (self.origin.x, self.origin.baseline))
+    }
+
+    /// Its box in the same frame, `[along0, across0, along1, across1]` (for upright text, `rect`).
+    pub(crate) fn frame_rect(&self) -> [f64; 4] {
+        self.frame
+    }
+}
+
+/// The page's content streams as listed, each with its decoded data (empty when it doesn't
+/// decode), within one page's [`DecodeBudget`]. An error when the content runs past it: reading
+/// or rewriting a page from part of its content would lose the rest.
+pub(crate) fn content_streams(doc: &Document, page: &Dict) -> Result<Vec<(Object, Vec<u8>)>, EditError> {
+    content_streams_within(doc, page, &mut DecodeBudget::page())
+}
+
+/// [`content_streams`], decoded against `budget`, which a walk of the page's forms then goes on
+/// spending.
+pub(crate) fn content_streams_within(doc: &Document, page: &Dict, budget: &mut DecodeBudget) -> Result<Vec<(Object, Vec<u8>)>, EditError> {
+    let list: Vec<Object> = match page.get(b"Contents") {
+        None => Vec::new(),
+        Some(c) => match &*doc.resolve(c) {
+            Object::Array(a) => a.clone(),
+            _ => vec![c.clone()],
+        },
+    };
+    let mut out = Vec::with_capacity(list.len());
+    for o in list {
+        let data = match &*doc.resolve(&o) {
+            Object::Stream(s) => match budget.decode(s) {
+                Ok(data) => data,
+                Err(e) if budget.remaining() == 0 => return Err(EditError::Invalid(format!("the page content is too large to read: {e}"))),
+                Err(_) => Vec::new(),
+            },
+            _ => Vec::new(),
+        };
+        out.push((o, data));
+    }
+    Ok(out)
+}
+
+/// Rewrite a page's content (its streams joined, see [`Pieces`]): `edit(i)` gives the operators
+/// to insert before operator `i` of `ops` (parsed from the joined pieces) and whether to keep it.
+/// Everything else is copied byte for byte. A page's streams are one stream in pieces, split
+/// between any two tokens (ISO 32000-2 §7.8.2), so an operator's operands can end one piece and
+/// its keyword start the next; removing or replacing it rewrites every piece it spans. Returns
+/// each piece's new bytes.
+pub(crate) fn splice(pieces: &Pieces, ops: &[Op], mut edit: impl FnMut(usize) -> (Vec<Op>, bool)) -> Vec<Vec<u8>> {
+    let data = pieces.data();
+    let mut edits = Vec::new();
+    for (i, op) in ops.iter().enumerate() {
+        let (insert, keep) = edit(i);
+        if insert.is_empty() && keep {
+            continue;
+        }
+        let mut bytes = Vec::new();
+        if !insert.is_empty() {
+            if op.span.start.checked_sub(1).and_then(|p| data.get(p)).is_some_and(|b| !b.is_ascii_whitespace()) {
+                bytes.push(b'\n');
+            }
+            bytes.extend_from_slice(&serialize_ops(&insert));
+        }
+        let end = if keep { op.span.start } else { op.span.end };
+        edits.push((op.span.start..end, bytes));
+    }
+    pieces.splice(edits)
+}
+
+/// The page's `/Contents` after a [`splice`]: pieces whose bytes changed become new streams
+/// (keeping their dictionaries), the others stay as they were.
+pub(crate) fn rewritten_contents(doc: &mut Document, streams: &[(Object, Vec<u8>)], new: Vec<Vec<u8>>) -> Object {
+    let mut contents: Vec<Object> = Vec::with_capacity(streams.len());
+    for ((obj, old), data) in streams.iter().zip(new) {
+        if *old == data {
+            contents.push(obj.clone());
+            continue;
+        }
+        let mut dict = match &*doc.resolve(obj) {
+            Object::Stream(s) => s.dict.clone(),
+            _ => Dict::new(),
+        };
+        dict.remove(b"Length");
+        contents.push(Object::Ref(doc.add(Object::Stream(Stream::flate(dict, &data)))));
+    }
+    match <[Object; 1]>::try_from(contents) {
+        Ok([one]) => one,
+        Err(many) => Object::Array(many),
+    }
+}
+
+pub(crate) fn page_dict(doc: &Document, page: usize) -> Result<pdfcraft_model::Page, EditError> {
+    pdfcraft_model::pages(doc).into_iter().nth(page).ok_or(EditError::NoSuchPage(page))
+}
+
+fn fill_color(fill: &[Op]) -> [f64; 3] {
+    let Some(op) = fill.iter().rev().find(|op| matches!(op.op.as_slice(), b"g" | b"rg" | b"k" | b"sc" | b"scn")) else {
+        return [0.0, 0.0, 0.0];
+    };
+    let space = match op.op.as_slice() {
+        b"sc" | b"scn" => match op.operands.len() {
+            1 => b"g".as_slice(),
+            3 => b"rg".as_slice(),
+            4 => b"k".as_slice(),
+            _ => return [0.0; 3],
+        },
+        other => other,
+    };
+    match space {
+        b"g" => {
+            let v = op.operands.first().and_then(Object::as_f64).unwrap_or(0.0).clamp(0.0, 1.0);
+            [v, v, v]
+        }
+        b"rg" => [
+            op.operands.first().and_then(Object::as_f64).unwrap_or(0.0).clamp(0.0, 1.0),
+            op.operands.get(1).and_then(Object::as_f64).unwrap_or(0.0).clamp(0.0, 1.0),
+            op.operands.get(2).and_then(Object::as_f64).unwrap_or(0.0).clamp(0.0, 1.0),
+        ],
+        b"k" => {
+            let c = op.operands.first().and_then(Object::as_f64).unwrap_or(0.0);
+            let m = op.operands.get(1).and_then(Object::as_f64).unwrap_or(0.0);
+            let y = op.operands.get(2).and_then(Object::as_f64).unwrap_or(0.0);
+            let k = op.operands.get(3).and_then(Object::as_f64).unwrap_or(0.0);
+            [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)]
+        }
+        _ => [0.0, 0.0, 0.0],
+    }
+}
+
+/// The lines of text on a page (0-based), in content order.
+pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditError> {
+    text_lines_in(doc, &page_dict(doc, page)?, true)
+}
+
+/// The lines `page`'s glyphs show, in content order, without `/ActualText` replacements: what the
+/// page draws, not what its marked-content metadata says the glyphs mean. For checks that must
+/// not trust that metadata (the redaction audit). Takes the page itself, so a caller going
+/// through every page doesn't walk the page tree again for each.
+pub fn glyph_text_lines(doc: &Document, page: &pdfcraft_model::Page) -> Result<Vec<TextLine>, EditError> {
+    text_lines_in(doc, page, false)
+}
+
+/// [`text_lines`] of `p`; with `actual_text`, `/ActualText` replaces the glyphs it spans.
+fn text_lines_in(doc: &Document, p: &pdfcraft_model::Page, actual_text: bool) -> Result<Vec<TextLine>, EditError> {
+    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let mut cache = HashMap::new();
+    let mut lines: Vec<TextLine> = Vec::new();
+    let mut carry = Carry::new();
+    // The streams are one stream in pieces (§7.8.2), split between any two tokens: parse them
+    // joined, so an operator whose operands end one piece still has them.
+    let pieces = Pieces::join(&content_streams(doc, &p.dict)?.into_iter().map(|(_, d)| d).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let properties = res.get(b"Properties").and_then(|o| doc.dict(o)).unwrap_or_default();
+    let shown = interpret(doc, &ops, &res, &mut cache, &mut carry, None, actual_text.then_some(&properties))?;
+    let mut last: Option<(usize, Pen)> = None; // the stream piece and where its last run ended
+    for mut s in shown {
+        // A single RTL glyph's ActualText (e.g. lam-alef) is an inline ligature, not a
+        // separate logical line. Put its letters into visual order before joining the
+        // surrounding glyphs; the completed line is recovered to typing order below.
+        // Multi-glyph and mixed-direction replacements keep their authoritative order.
+        if s.logical_order && s.glyph_count == 1 && s.text.chars().all(crate::bidi::is_rtl) {
+            s.text = crate::bidi::to_visual(&s.text);
+            s.logical_order = false;
+        }
+        // A line belongs to one stream piece. Within it, PDF producers often put every word
+        // in its own BT/ET: geometry and text state, not object boundaries, define a line.
+        let si = ops.get(s.op).map_or(0, |op| pieces.pieces_of(op).0);
+        let joins = last.is_some_and(|(piece, pen)| {
+            let bt = pen.bt;
+            let (near, gap) = pen.continues(&s, if bt == s.bt { 3.0 } else { 1.5 });
+            piece == si
+                && lines.last().is_some_and(|l| l.scope == s.scope && l.paint == s.paint && l.logical_order == s.logical_order)
+                && (bt == s.bt || lines.last().is_some_and(|l| compatible_word(l, &s)))
+                && (s.text.trim().is_empty() || lines.last().is_some_and(|l| same_font(l, &s.font, &s.base_font, s.face.as_deref())))
+                && (s.text.trim().is_empty()
+                    || lines.last().is_some_and(|l| {
+                        (s.size - l.size).abs() < 0.01
+                            && s.bold == l.bold
+                            && s.italic == l.italic
+                            && fill_color(&s.state.fill) == l.color
+                            && same_paint(l, &s.state)
+                    }))
+                && near
+                // An OCR layer is one text object over the whole scan: its words continue a line
+                // only across a word space, not across a table cell or a tab stop.
+                && (s.state.render_mode != 3 || gap < pen.size * 0.6)
+        });
+        if joins && let Some(l) = lines.last_mut() {
+            let gap = last.map_or(0.0, |(_, pen)| pen.continues(&s, 0.0).1);
+            let spaced = gap - s.tracking > l.size * s.state.scale.abs() * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ');
+            if spaced {
+                l.text.push(' ');
+            }
+            l.text.push_str(&s.text);
+            l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
+            l.frame = union(l.frame, s.frame);
+            l.ink.extend(s.ink.iter().copied());
+            l.runs.push((s.text.clone(), l.ink.len(), spaced));
+            l.ops.push(s.op);
+            l.ops.extend(s.extra_ops.iter().copied());
+            l.decodable &= s.decodable;
+            l.visual_order |= s.visual_order;
+            l.actual_text |= s.actual_text;
+            l.clips |= s.state.render_mode >= 4;
+            if l.unreadable_mode.is_none() {
+                l.unreadable_mode = s.state.unreadable.as_deref().map(str::to_owned);
+            }
+            // Spaces may use a separate subset font; they do not change the visible style.
+        } else {
+            lines.push(TextLine {
+                text: s.text.clone(),
+                rect: s.rect,
+                frame: s.frame,
+                ink: s.ink.clone(),
+                font: String::from_utf8_lossy(&s.font).into_owned(),
+                base_font: s.base_font.clone(),
+                size: s.size,
+                bold: s.bold,
+                italic: s.italic,
+                color: fill_color(&s.state.fill),
+                decodable: s.decodable,
+                visual_order: s.visual_order,
+                face: s.face.clone(),
+                stream: si,
+                scope: s.scope,
+                paint: s.paint.clone(),
+                logical_order: s.logical_order,
+                actual_text: s.actual_text,
+                clips: s.state.render_mode >= 4,
+                unreadable_mode: s.state.unreadable.as_deref().map(str::to_owned),
+                runs: vec![(s.text.clone(), s.ink.len(), false)],
+                ops: std::iter::once(s.op).chain(s.extra_ops.iter().copied()).collect(),
+                origin: Origin {
+                    tm: s.tm.0,
+                    tlm: s.tlm.0,
+                    k: (s.tm.then(&s.state.ctm).0[2].powi(2) + s.tm.then(&s.state.ctm).0[3].powi(2)).sqrt(),
+                    ctm: s.state.ctm.0,
+                    baseline: s.baseline,
+                    x: s.start_x,
+                    state: TextState::of(&s.state),
+                    bt_op: s.bt_op,
+                    bt_state: TextState::of(&s.bt_state),
+                },
+            });
+        }
+        last = Some((si, Pen::after(&s)));
+    }
+    // Content streams draw right-to-left lines in visual order; the editor works in typing order.
+    for l in lines.iter_mut().filter(|l| !l.logical_order) {
+        // A visual-order Indic font draws pre-base vowel signs before their consonant.
+        let shown = l.text.clone();
+        if l.visual_order && !l.actual_text {
+            l.text = crate::indic::to_logical(&l.text);
+        }
+        l.text = crate::bidi::to_logical(&l.text);
+        // The runs hold the text in drawing order, which no longer reads as the line does.
+        if l.text != shown {
+            l.runs.clear();
+        }
+    }
+    // Lines of only spaces aren't editable text.
+    lines.retain(|l| !l.text.trim().is_empty());
+    Ok(lines)
+}
+
+/// Joining independent text objects is safe only when they use the same text and graphics
+/// transforms and spacing. In particular, a nearby rotated label isn't part of this line.
+fn compatible_word(line: &TextLine, shown: &Shown) -> bool {
+    let within = |a: &[f64], b: &[f64], tolerance: f64| a.iter().zip(b).all(|(a, b)| (a - b).abs() < tolerance);
+    let same = |a: &[f64], b: &[f64]| within(a, b, 1e-6);
+    let (a, b) = (&line.origin.state, TextState::of(&shown.state));
+    // Spacing that differs by less than a thousandth of an em, the unit glyph widths are given in,
+    // can't be seen. Some producers still write it (`0.0001 Tc` on one word of a line).
+    let em = shown.state.size.abs() / 1000.0;
+    line.scope == shown.scope
+        && line.paint == shown.paint
+        && same(&line.origin.tm[..4], &shown.tm.0[..4])
+        && same(&line.origin.ctm, &shown.state.ctm.0)
+        && within(&[a.char_spacing, a.word_spacing], &[b.char_spacing, b.word_spacing], em.max(1e-6))
+        && same(&[a.scale, a.rise], &[b.scale, b.rise])
+        && a.fill.len() == b.fill.len()
+        && a.fill.iter().zip(&b.fill).all(|(a, b)| a.op == b.op && a.operands == b.operands)
+}
+
+/// The line `s` continues, or a new one: `last` is the previous run of the same stream
+/// (`bt`, baseline, end x, size).
+fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<Pen>, s: Shown, stream: usize) {
+    let joins = last.is_some_and(|pen| {
+        let bt = pen.bt;
+        lines.last().is_some_and(|l| l.scope == s.scope && l.paint == s.paint && l.logical_order == s.logical_order)
+            && (bt == s.bt || lines.last().is_some_and(|l| compatible_word(l, &s)))
+            && (s.text.trim().is_empty() || lines.last().is_some_and(|l| same_font(l, &s.font, &s.base_font, s.face.as_deref())))
+            && (s.text.trim().is_empty()
+                || lines.last().is_some_and(|l| {
+                    (s.size - l.size).abs() < 0.01
+                        && s.bold == l.bold
+                        && s.italic == l.italic
+                        && fill_color(&s.state.fill) == l.color
+                        && same_paint(l, &s.state)
+                }))
+            && pen.continues(&s, if bt == s.bt { 3.0 } else { 1.5 }).0
+    });
+    if joins && let Some(l) = lines.last_mut() {
+        let gap = last.map_or(0.0, |pen| pen.continues(&s, 0.0).1);
+        let spaced = gap - s.tracking > l.size * s.state.scale.abs() * 0.2 && !l.text.ends_with(' ') && !s.text.starts_with(' ');
+        if spaced {
+            l.text.push(' ');
+        }
+        l.text.push_str(&s.text);
+        l.rect = [l.rect[0].min(s.rect[0]), l.rect[1].min(s.rect[1]), l.rect[2].max(s.rect[2]), l.rect[3].max(s.rect[3])];
+        l.frame = union(l.frame, s.frame);
+        l.ink.extend(s.ink.iter().copied());
+        l.runs.push((s.text.clone(), l.ink.len(), spaced));
+        l.ops.push(s.op);
+        l.ops.extend(s.extra_ops.iter().copied());
+        l.decodable &= s.decodable;
+        l.visual_order |= s.visual_order;
+        l.actual_text |= s.actual_text;
+        l.clips |= s.state.render_mode >= 4;
+        if l.unreadable_mode.is_none() {
+            l.unreadable_mode = s.state.unreadable.as_deref().map(str::to_owned);
+        }
+    } else {
+        lines.push(TextLine {
+            text: s.text.clone(),
+            rect: s.rect,
+            frame: s.frame,
+            ink: s.ink.clone(),
+            font: String::from_utf8_lossy(&s.font).into_owned(),
+            base_font: s.base_font.clone(),
+            size: s.size,
+            bold: s.bold,
+            italic: s.italic,
+            color: fill_color(&s.state.fill),
+            decodable: s.decodable,
+            visual_order: s.visual_order,
+            face: s.face.clone(),
+            stream,
+            scope: s.scope,
+            paint: s.paint.clone(),
+            logical_order: s.logical_order,
+            actual_text: s.actual_text,
+            clips: s.state.render_mode >= 4,
+            unreadable_mode: s.state.unreadable.as_deref().map(str::to_owned),
+            runs: vec![(s.text.clone(), s.ink.len(), false)],
+            ops: std::iter::once(s.op).chain(s.extra_ops.iter().copied()).collect(),
+            origin: Origin {
+                tm: s.tm.0,
+                tlm: s.tlm.0,
+                k: (s.tm.then(&s.state.ctm).0[2].powi(2) + s.tm.then(&s.state.ctm).0[3].powi(2)).sqrt(),
+                ctm: s.state.ctm.0,
+                baseline: s.baseline,
+                x: s.start_x,
+                state: TextState::of(&s.state),
+                bt_op: s.bt_op,
+                bt_state: TextState::of(&s.bt_state),
+            },
+        });
+    }
+    *last = Some(Pen::after(&s));
+}
+
+/// How deep form XObjects nest before reading stops (they may also refer to themselves). The
+/// renderer stops at the same depth, so export reads the text the page shows (#3120).
+pub const MAX_FORM_DEPTH: usize = 50;
+
+/// The most form XObjects one page's walk enters, at any depth. The depth cap alone still lets
+/// a form that draws another form many times fan out exponentially (100 `Do`s on each of 50
+/// levels), which would hang export on a hostile PDF. The renderer paints as many forms nested
+/// in forms; this budget also counts the forms the page draws itself, so a page that draws one
+/// a million times stays bounded too. A label or table cell drawn as a form a few thousand
+/// times is read in full (#3120).
+pub const MAX_FORM_VISITS: usize = 50_000;
+
+/// One page's walk through the form XObjects it draws: how many it entered (the page's
+/// [`MAX_FORM_VISITS`]), the bytes the page's content and forms may still decode to, and whether
+/// a limit left a form unread.
+pub(crate) struct FormBudget {
+    visits: usize,
+    decode: DecodeBudget,
+    /// A form was left unread because it nests deeper than [`MAX_FORM_DEPTH`], comes past
+    /// [`MAX_FORM_VISITS`] or past the decode budget: what it draws is missing from the walk.
+    pub(crate) truncated: bool,
+}
+
+impl FormBudget {
+    /// The walk of a page's forms, spending what `decode` has left after the page's content.
+    pub(crate) fn new(decode: DecodeBudget) -> Self {
+        Self { visits: 0, decode, truncated: false }
+    }
+}
+
+/// A form XObject a page draws: its object, content, resources and its matrix composed with the
+/// CTM at the `Do`.
+pub(crate) struct FormCall {
+    pub(crate) obj: Option<pdfcraft_cos::ObjRef>,
+    pub(crate) data: Vec<u8>,
+    pub(crate) resources: Dict,
+    pub(crate) ctm: Matrix,
+}
+
+/// The form XObject `name` in `resources`, drawn with `ctm`. `None` for images, missing names
+/// and forms already being read (`path`), and for forms nested too deep or past the page's
+/// budget, which `budget` records as truncated; each form entered counts one visit.
+pub(crate) fn form_call(
+    doc: &Document,
+    resources: &Dict,
+    name: &[u8],
+    ctm: Matrix,
+    path: &[pdfcraft_cos::ObjRef],
+    budget: &mut FormBudget,
+) -> Option<FormCall> {
+    let limited = path.len() >= MAX_FORM_DEPTH || budget.visits >= MAX_FORM_VISITS || budget.decode.remaining() == 0;
+    // Once a limit has cut the page short, refusing the rest costs nothing more.
+    if limited && budget.truncated {
+        return None;
+    }
+    let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned())?;
+    let o = xobjects.get(name)?;
+    let obj = o.as_ref();
+    if obj.is_some_and(|r| path.contains(&r)) {
+        return None;
+    }
+    let Object::Stream(s) = &*doc.resolve(o) else { return None };
+    if s.dict.name(b"Subtype") != Some(b"Form") {
+        return None;
+    }
+    // Only a form left unread loses content; an image at the limit is still read by its caller.
+    if limited {
+        budget.truncated = true;
+        return None;
+    }
+    let m = s.dict.get(b"Matrix").map(|m| doc.resolve(m)).and_then(|m| {
+        let a = m.as_array()?;
+        let v: Vec<f64> = a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect();
+        <[f64; 6]>::try_from(v).ok().filter(|v| v.iter().all(|x| x.is_finite()))
+    });
+    // A form without its own resources uses the ones it was drawn with (PDF 1.1 files).
+    let own = s.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned());
+    let data = match budget.decode.decode(s) {
+        Ok(data) => data,
+        Err(_) if budget.decode.remaining() == 0 => {
+            budget.truncated = true;
+            return None;
+        }
+        Err(_) => Vec::new(),
+    };
+    budget.visits = budget.visits.saturating_add(1);
+    Some(FormCall { obj, data, resources: own.unwrap_or_else(|| resources.clone()), ctm: m.map_or(ctm, |m| Matrix(m).then(&ctm)) })
+}
+
+/// The lines a page shows as it reads, including text drawn by form XObjects (which
+/// [`text_lines`] leaves out because it can only rewrite the page's own streams). Lines from a
+/// form carry a stream number past the page's streams, one per form drawn. The flag is `true`
+/// when forms past [`MAX_FORM_DEPTH`] or [`MAX_FORM_VISITS`] were left unread.
+pub(super) fn reading_lines(doc: &Document, page: usize) -> Result<(Vec<TextLine>, bool), EditError> {
+    struct Walk<'a> {
+        doc: &'a Document,
+        lines: Vec<TextLine>,
+        next_stream: usize,
+        path: Vec<pdfcraft_cos::ObjRef>,
+        budget: FormBudget,
+    }
+    /// `stream` gives the stream number of the operator at an index of `ops`.
+    fn walk(w: &mut Walk, ops: &[Op], resources: &Dict, carry: &mut Carry, stream: &dyn Fn(usize) -> usize) -> Result<(), EditError> {
+        let mut cache = HashMap::new();
+        let mut invoked = Vec::new();
+        let properties = resources.get(b"Properties").and_then(|o| w.doc.dict(o)).unwrap_or_default();
+        let shown = interpret(w.doc, ops, resources, &mut cache, carry, Some(&mut invoked), Some(&properties))?;
+        let mut last = None;
+        let mut last_stream = None;
+        let mut forms = invoked.into_iter().peekable();
+        for s in shown {
+            while let Some((_, name, ts)) = forms.next_if(|f| f.0 < s.op) {
+                enter(w, resources, &name, ts, &mut carry.text_left)?;
+                // Text after a form starts a new line.
+                last = None;
+            }
+            let si = stream(s.op);
+            // Text from another stream starts a new line, as when each stream was read alone.
+            if last_stream.replace(si).is_some_and(|prev| prev != si) {
+                last = None;
+            }
+            add_shown(&mut w.lines, &mut last, s, si);
+        }
+        for (_, name, ts) in forms {
+            enter(w, resources, &name, ts, &mut carry.text_left)?;
+        }
+        Ok(())
+    }
+    /// `text_left`: the page's text budget, shared with the forms the page draws.
+    fn enter(w: &mut Walk, resources: &Dict, name: &[u8], ts: Ts, text_left: &mut usize) -> Result<(), EditError> {
+        let Some(form) = form_call(w.doc, resources, name, ts.ctm, &w.path, &mut w.budget) else { return Ok(()) };
+        let ops = parse(&form.data).ops;
+        // The form starts with the graphics state at its `Do`, its own matrix applied.
+        let mut carry = Carry { ts: Ts { ctm: form.ctm, ..ts }, stack: Vec::new(), marked: Vec::new(), layers: Vec::new(), text_left: *text_left };
+        let stream = w.next_stream;
+        w.next_stream = w.next_stream.saturating_add(1);
+        if let Some(r) = form.obj {
+            w.path.push(r);
+        }
+        walk(w, &ops, &form.resources, &mut carry, &|_| stream)?;
+        *text_left = carry.text_left;
+        if form.obj.is_some() {
+            w.path.pop();
+        }
+        Ok(())
+    }
+    let p = page_dict(doc, page)?;
+    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let mut decode = DecodeBudget::page();
+    let streams = content_streams_within(doc, &p.dict, &mut decode)?;
+    let mut w = Walk { doc, lines: Vec::new(), next_stream: streams.len(), path: Vec::new(), budget: FormBudget::new(decode) };
+    let mut carry = Carry::new();
+    // Read the page's streams as the one stream they are, in one pass, as rendering and editing
+    // do: a comment, an operator's operands or a marked-content sequence (its /ActualText too)
+    // can run on from one stream into the next. Text still counts as the stream its operator
+    // starts in, which keeps lines from different streams apart.
+    let pieces = Pieces::join(&streams.into_iter().map(|(_, data)| data).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let stream_of = |i: usize| ops.get(i).map_or(0, |op| pieces.pieces_of(op).0);
+    walk(&mut w, &ops, &res, &mut carry, &stream_of)?;
+    let mut lines = w.lines;
+    // A visual-order Indic font draws pre-base vowel signs before their consonant.
+    for l in lines.iter_mut().filter(|l| l.visual_order && !l.actual_text) {
+        let shown = l.text.clone();
+        l.text = crate::indic::to_logical(&l.text);
+        if l.text != shown {
+            l.runs.clear();
+        }
+    }
+    lines.retain(|l| !l.text.trim().is_empty());
+    Ok((lines, w.budget.truncated))
+}
diff --git a/crates/edit/src/text/rewrite.rs b/crates/edit/src/text/rewrite.rs
new file mode 100644
index 0000000000..dd58c72898
--- /dev/null
+++ b/crates/edit/src/text/rewrite.rs
@@ -0,0 +1,857 @@
+use super::blocks::{BlockStyle, TextBlock, paragraph_separator, wrap};
+use super::fallback::{
+    Encoder, MAX_TYPE3_GLYPHS, drop_unused_fallback_fonts, needs_type3, no_japanese_font, source_encodes, source_family, source_program_completes,
+    source_show, source_space, source_width, type3_encode, type3_font,
+};
+use super::interp::{Carry, interpret};
+use super::lines::{content_streams, page_dict, rewritten_contents, splice, text_lines};
+use super::*;
+
+/// What replacing a line did.
+#[derive(Clone, Debug, PartialEq)]
+pub struct LineEdit {
+    /// `Some(font)` when the line's font couldn't show the new text and Helvetica was used.
+    pub substituted: Option<String>,
+}
+
+/// Replace the text of line `line` (an index into [`text_lines`]) on `page` with `text`.
+pub fn replace_line(doc: &mut Document, page: usize, line: usize, text: &str) -> Result<LineEdit, EditError> {
+    let edit = replace_line_with_limit(doc, page, line, text, MAX_TYPE3_GLYPHS)?;
+    drop_unused_fallback_fonts(doc, page);
+    Ok(edit)
+}
+
+/// Refuses a rewrite that would remove text drawn as a clipping path (`4 Tr` to `7 Tr`). Such
+/// glyphs are not ink but a mask, and whatever is painted through them takes their shape.
+/// Removing the glyphs removes the mask, and the fill or image behind floods its own rectangle
+/// instead -- the artwork is destroyed, in a file that still opens without a warning (#3429).
+/// `clear_block` already refuses these for the same reason.
+///
+/// Every line the rewrite drops is checked, not only the one being replaced: a line's runs need
+/// not share a rendering mode (see [`TextLine::clips`]), and [`coincident_ops`] drops a whole
+/// overlapping line without regard to its mode -- so a mask could go with text that is ink.
+fn refuse_clipping_text(lines: &[TextLine], dropped: &std::collections::HashSet<usize>) -> Result<(), EditError> {
+    if lines.iter().any(|l| l.clips && l.ops.iter().any(|op| dropped.contains(op))) {
+        return Err(EditError::Invalid("text used as a clipping path cannot be edited: its glyphs mask the artwork behind them".into()));
+    }
+    Ok(())
+}
+
+/// [`replace_line`] with the most unique characters one generated font may hold (tests lower it).
+pub(crate) fn replace_line_with_limit(doc: &mut Document, page: usize, line: usize, text: &str, max_glyphs: usize) -> Result<LineEdit, EditError> {
+    let text = text.replace(['\n', '\r'], " ");
+    let lines = text_lines(doc, page)?;
+    let target = lines.get(line).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no line {}", page + 1, line + 1)))?;
+    target.ensure_editable()?;
+    // Copies of the line drawn on the same baseline go with it, so the replacement is all that
+    // shows. Which operators go is settled here, before any font is generated, so that a refusal
+    // leaves the document untouched.
+    let mut drops = coincident_ops(&lines, &[&target]);
+    drops.extend(target.ops.iter().copied());
+    refuse_clipping_text(&lines, &drops)?;
+    let p = page_dict(doc, page)?;
+    let mut res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let mut fonts_res = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
+    let streams = content_streams(doc, &p.dict)?;
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let first = target.ops.first().copied().filter(|i| *i < ops.len()).ok_or_else(|| EditError::Invalid("the page's content changed".into()))?;
+    // The line's own font, when it can show every character.
+    let font = fonts_res.get(target.font.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|d| Metrics::from_dict(doc, &d));
+    let visual_indic = font.as_ref().is_some_and(|m| m.visual_order) || target.visual_order;
+    let indic_text = if visual_indic { crate::indic::to_visual(&text) } else { text.clone() };
+    // Typed in logical order; drawn left to right (right-to-left runs reversed).
+    let shown = crate::bidi::to_visual(&indic_text);
+    let reused = font.as_ref().filter(|m| source_encodes(m, &shown));
+    let mut substituted = None;
+    let mut replacement: Vec<Op> = Vec::new();
+    // ' and " also move to the next line; keep that.
+    match ops[first].op.as_slice() {
+        b"'" => replacement.push(Op::new("T*", vec![])),
+        b"\"" => {
+            replacement.push(Op::new("Tw", vec![ops[first].operands.first().cloned().unwrap_or(Object::Int(0))]));
+            replacement.push(Op::new("Tc", vec![ops[first].operands.get(1).cloned().unwrap_or(Object::Int(0))]));
+            replacement.push(Op::new("T*", vec![]));
+        }
+        _ => {}
+    }
+    match reused {
+        Some(metrics) => replacement.extend(source_show(
+            metrics,
+            &shown,
+            target.origin.state.font.as_ref().map_or(target.size, |(_, size)| *size),
+            source_space(doc, &fonts_res, metrics),
+            target.origin.state.char_spacing,
+            target.origin.state.word_spacing,
+        )?),
+        None => {
+            let fallback_shown = crate::bidi::to_visual(&text);
+            if needs_type3(&text) {
+                let fallback = type3_font(doc, &mut fonts_res, &text, source_family(&target.base_font), target.bold, max_glyphs)?;
+                let runs = type3_encode(&fallback, &fallback_shown)
+                    .ok_or_else(|| EditError::Invalid(format!("\"{text}\" can't be shown by the {} fallback", fallback.family)))?;
+                let size = font_size_before(&ops, first).unwrap_or(target.size);
+                for (name, bytes) in runs {
+                    replacement.push(Op::new("Tf", vec![Object::name(&name), pdfcraft_content::num(size)]));
+                    replacement.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
+                }
+                replacement.push(Op::new("Tf", vec![Object::name(&target.font), pdfcraft_content::num(size)]));
+                substituted = Some(format!("{} Type3", fallback.family));
+            } else {
+                let win = pdfcraft_fonts::win_ansi(&fallback_shown);
+                // WinAnsi turns what it can't show into '?'; refuse rather than print the wrong thing.
+                let back: String = win.iter().map(|b| char::from_u32(u32::from(*b)).unwrap_or('?')).collect();
+                if fallback_shown.chars().zip(back.chars()).any(|(a, b)| b == '?' && a != '?') {
+                    return Err(EditError::Invalid(format!("\"{text}\" has characters neither {} nor Helvetica can show", target.base_font)));
+                }
+                // The size in text space: the current Tf's size.
+                let size = font_size_before(&ops, first).unwrap_or(target.size);
+                let family = source_family(&target.base_font);
+                let base = family.base_font(target.bold, target.italic);
+                let substitute_name = format!("PCEd{}", base.replace('-', ""));
+                replacement.push(Op::new("Tf", vec![Object::name(&substitute_name), pdfcraft_content::num(size)]));
+                replacement.push(Op::new("Tj", vec![Object::String(PdfString::literal(win))]));
+                replacement.push(Op::new("Tf", vec![Object::name(&target.font), pdfcraft_content::num(size)]));
+                substituted = Some(base.to_string());
+                let mut f = Dict::new();
+                f.set(b"Type".to_vec(), Object::name("Font"));
+                f.set(b"Subtype".to_vec(), Object::name("Type1"));
+                f.set(b"BaseFont".to_vec(), Object::name(base));
+                f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+                fonts_res.set(substitute_name.into_bytes(), Object::Dict(f));
+            }
+        }
+    }
+    // Rebuild: the line's first operator becomes the replacement, its others go.
+    let new_data = splice(&pieces, &ops, |i| if i == first { (std::mem::take(&mut replacement), false) } else { (Vec::new(), !drops.contains(&i)) });
+    let contents = rewritten_contents(doc, &streams, new_data);
+    let page_ref = p.obj;
+    if substituted.is_some() {
+        res.set(b"Font".to_vec(), Object::Dict(fonts_res));
+    }
+    doc.update_dict(page_ref, |d| {
+        d.set(b"Contents".to_vec(), contents);
+        if substituted.is_some() {
+            d.set(b"Resources".to_vec(), Object::Dict(res));
+        }
+    })?;
+    Ok(LineEdit { substituted })
+}
+
+/// The size of the last `Tf` before operator `at`.
+fn font_size_before(ops: &[Op], at: usize) -> Option<f64> {
+    ops[..at].iter().rev().find(|o| o.is("Tf")).and_then(|o| o.num(1))
+}
+
+/// Operators of every line that is another drawing of one of `targets` (fake bold, an invisible
+/// text layer). A surviving copy would show the old text under the replacement.
+///
+/// A copy overlaps a target by more than half the smaller box and sits on the same baseline
+/// (within the tolerance that joins showing operators onto one line). A neighbouring line can
+/// share box area when the leading is tighter than the font's ascent plus descent; its baseline
+/// is farther away, so it stays.
+pub(crate) fn coincident_ops(lines: &[TextLine], targets: &[&TextLine]) -> std::collections::HashSet<usize> {
+    let area = |r: [f64; 4]| ((r[2] - r[0]) * (r[3] - r[1])).max(0.0);
+    let mut drop = std::collections::HashSet::new();
+    for line in lines {
+        let copy = targets.iter().any(|target| {
+            let same_text = line.text.trim() == target.text.trim() || (line.origin.state.render_mode == 3) != (target.origin.state.render_mode == 3);
+            same_text && overlaps_half(line.rect, target.rect, area) && on_same_baseline(line, target)
+        });
+        if copy {
+            drop.extend(line.ops.iter().copied());
+        }
+    }
+    drop
+}
+
+fn overlaps_half(a: [f64; 4], b: [f64; 4], area: impl Fn([f64; 4]) -> f64) -> bool {
+    let ix = (b[2].min(a[2]) - b[0].max(a[0])).max(0.0);
+    let iy = (b[3].min(a[3]) - b[1].max(a[1])).max(0.0);
+    let small = area(b).min(area(a));
+    small > 0.0 && ix * iy / small > 0.5
+}
+
+/// Perpendicular distance between baselines, in user space. Horizontal text compares height;
+/// turned text compares the distance across the writing direction.
+fn on_same_baseline(line: &TextLine, target: &TextLine) -> bool {
+    let (dir, target_dir) = (line.direction(), target.direction());
+    let same_dir = (dir.0 - target_dir.0).abs() < 1e-3 && (dir.1 - target_dir.1).abs() < 1e-3;
+    let same_size = line.size.min(target.size) >= line.size.max(target.size) * 0.8;
+    let angle = target.rotation().to_radians();
+    let (sin, cos) = if angle.is_finite() { angle.sin_cos() } else { (0.0, 1.0) };
+    let dx = line.origin.x - target.origin.x;
+    let dy = line.origin.baseline - target.origin.baseline;
+    let offset = dx.mul_add(-sin, dy * cos).abs();
+    let size = line.size.min(target.size).max(1.0);
+    same_dir && same_size && offset.is_finite() && offset < size * 0.3
+}
+
+/// Rewrite paragraph `block` with new text (or its own) and formatting, rewrapped to its width.
+pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option<&str>, style: &BlockStyle) -> Result<LineEdit, EditError> {
+    let edit = rewrite_block_with_limit(doc, page, block, text, style, MAX_TYPE3_GLYPHS)?;
+    drop_unused_fallback_fonts(doc, page);
+    Ok(edit)
+}
+
+/// [`rewrite_block`] with the most unique characters one generated font may hold (tests lower it).
+pub(crate) fn rewrite_block_with_limit(
+    doc: &mut Document,
+    page: usize,
+    block: usize,
+    text: Option<&str>,
+    style: &BlockStyle,
+    max_glyphs: usize,
+) -> Result<LineEdit, EditError> {
+    TextSession::open(doc, page, block)?.commit_with_limit(doc, text, style, max_glyphs)
+}
+
+/// [`rewrite_block_with_limit`] with the page's [`text_lines`], read from `doc` as it is now.
+pub(crate) fn rewrite_block_from(
+    doc: &mut Document,
+    page: usize,
+    lines: Vec<TextLine>,
+    block: usize,
+    text: Option<&str>,
+    style: &BlockStyle,
+    max_glyphs: usize,
+) -> Result<LineEdit, EditError> {
+    let blocks = group_blocks(&lines);
+    let b = blocks.get(block).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no paragraph {}", page + 1, block + 1)))?;
+    let members: Vec<&TextLine> = b.lines.iter().map(|i| &lines[*i]).collect();
+    // One clipping run is enough: rewriting the paragraph would drop its mask with the rest.
+    let mut dropped = coincident_ops(&lines, &members);
+    dropped.extend(members.iter().flat_map(|l| l.ops.iter().copied()));
+    refuse_clipping_text(&lines, &dropped)?;
+    let first = members.first().copied().ok_or_else(|| EditError::Invalid("the paragraph has no source runs".into()))?;
+    members.iter().try_for_each(|line| line.ensure_editable())?;
+    let p = page_dict(doc, page)?;
+    let mut res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let mut fonts_res = res.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
+    let registered_face = fonts_res.iter().any(|(name, _)| name.starts_with(b"PCFull"));
+    // Hebrew is written back in drawing order (and with the Hebrew fallback face) by the
+    // single-style path below; the styled region path does not reorder right-to-left runs.
+    let hebrew = text.unwrap_or(&b.text).chars().any(crate::bidi::is_hebrew);
+    if hebrew && (!style.ranges.is_empty() || style.resource.is_some()) {
+        return Err(EditError::Invalid(
+            "formatting part of right-to-left (Hebrew) text, or choosing a document font for it, isn't supported yet".into(),
+        ));
+    }
+    // Text turned on the page (a landscape page drawn a quarter turn round) is rewritten in its
+    // own text space below; the styled region path lays rows out along the page's x axis.
+    let upright = members.iter().all(|line| line.upright());
+    if !upright && (!style.ranges.is_empty() || style.resource.is_some()) {
+        return Err(EditError::Invalid("formatting part of turned text, or choosing a document font for it, isn't supported yet".into()));
+    }
+    let visual_indic = members.iter().any(|line| line.visual_order);
+    if upright
+        && !hebrew
+        && !visual_indic
+        && (!style.ranges.is_empty()
+            || style.resource.is_some()
+            || (text.is_some_and(|draft| {
+                // A row break, `\n` or a carriage return, takes the path that keeps untouched rows.
+                draft.contains(['\n', '\r'])
+                    || pdfcraft_fonts::source_shaping::required(draft)
+                    || !pdfcraft_fonts::embedding::matching_faces(&b.base_font).is_empty()
+            }) || registered_face
+                || text.is_some_and(|draft| source_program_completes(doc, &fonts_res, first, draft))
+                || b.rows.iter().any(|row| row.len() > 1)
+                || members.iter().any(|line| line.font != first.font || line.size != first.size || line.color != first.color))
+                && style.family.is_none()
+                && style.bold.is_none())
+    {
+        return rewrite_styled_block(doc, page, &b, &lines, text, style, max_glyphs);
+    }
+    let streams = content_streams(doc, &p.dict)?;
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    // Explicit line breaks stay (#1443), and so does each typed U+0020 space: a run of them is
+    // not folded into one (#4199, #3797). `\r\n` and a lone `\r` are breaks too; other white
+    // space is written as one space.
+    let text: String = text
+        .unwrap_or(&b.text)
+        .replace("\r\n", "\n")
+        .chars()
+        .map(|c| match c {
+            '\r' => '\n',
+            c if c != '\n' && paragraph_separator(c) => ' ',
+            c => c,
+        })
+        .collect();
+    // The characters to show, for choosing fonts: the breaks are moves, not glyphs.
+    let flat = text.replace('\n', " ");
+    let o = &first.origin;
+    let last = members.last().copied().unwrap_or(first);
+    let emit = &last.origin;
+    let (font_name, old_size) = o.state.font.clone().ok_or_else(|| EditError::Invalid("the paragraph has no font".into()))?;
+    let k = o.k.max(1e-6);
+    // The size in text space: points ÷ the text-to-user scale.
+    let size = style.size.map_or(old_size, |pt| (pt / k).max(0.1));
+    // Spacing and scaling (text state), with the chosen values.
+    let mut ts_state = o.state.clone();
+    if let Some(c) = style.char_spacing {
+        ts_state.char_spacing = c / k;
+    }
+    if let Some(sc) = style.scale {
+        ts_state.scale = (sc / 100.0).clamp(0.1, 10.0);
+    }
+    let o_state = ts_state.clone();
+    let metrics = fonts_res.get(font_name.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned()).map(|d| Metrics::from_dict(doc, &d));
+    let visual_indic = metrics.as_ref().is_some_and(|m| m.visual_order) || first.visual_order;
+    let indic_text = if visual_indic { crate::indic::to_visual(&flat) } else { flat.clone() };
+    let reuse = style.family.is_none() && style.bold.is_none() && metrics.as_ref().is_some_and(|m| source_encodes(m, &indic_text));
+    let space = metrics.as_ref().map_or(0.33, |m| source_space(doc, &fonts_res, m));
+    // The chosen style also determines the real Japanese fallback outlines and advances.
+    let (family, bold, italic) = style.family.unwrap_or((source_family(&b.base_font), b.bold, b.italic));
+    let bold = style.bold.unwrap_or(bold);
+    // The face is chosen after `bold` settles, so a bold request measures with the bold metrics.
+    let face = family.std14(bold, italic);
+    let std_width = move |s: &str, size: f64| -> f64 { face.text_width(s, size) };
+    let [dx, dy] = style.offset.unwrap_or([0.0, 0.0]);
+    if !(dx.is_finite() && dy.is_finite()) {
+        return Err(EditError::Invalid("the paragraph can't be moved that far".into()));
+    }
+    // Right-to-left text (more Hebrew or Arabic letters than Latin) is right-aligned unless an
+    // alignment is asked for, and a single right-to-left line keeps its right edge as it grows.
+    let rtl = crate::bidi::rtl_base(&flat);
+    let anchored_right = rtl && upright && style.width.is_none() && members.len() == 1;
+    // The paragraph's width along its lines: in user space unless it is turned.
+    let frame = if upright {
+        b.rect
+    } else {
+        members.iter().map(|l| l.frame_rect()).reduce(|a, f| [a[0].min(f[0]), a[1].min(f[1]), a[2].max(f[2]), a[3].max(f[3])]).unwrap_or(b.rect)
+    };
+    // A centred title is laid out in the box it already sits in, so it keeps its centre as it
+    // grows or wraps, rather than being grown to the right up to the page's margin (#2581).
+    // Turned text is left alone: its centre lives along its own baseline, not in page space.
+    let crop = p.crop(doc);
+    let centred = upright && !rtl && style.width.is_none() && style.align.is_none() && is_centred(&b, &lines, (crop[0] + crop[2]) / 2.0, first.size);
+    // A paragraph keeps its width (or takes the one asked for); a single line grows to the right
+    // (to the left when right-to-left), up to the page's margin.
+    let width = match style.width {
+        // Capped at the largest page PDF allows (14 400 pt), even for text set larger than that
+        // (`clamp` panics when its minimum is the larger, or NaN).
+        Some(w) if w.is_finite() => w.clamp((size * k).min(14_400.0), 14_400.0),
+        Some(_) => return Err(EditError::Invalid("the paragraph's width must be a number".into())),
+        // Turned text: the page's margins are along another axis. A single line grows (below).
+        None if !upright => (frame[2] - frame[0]).max(size * k),
+        None if anchored_right => (b.rect[2] - b.rect[0]).max(size * k).max(b.rect[2] + dx - (crop[0] + 36.0)),
+        // A centred line is not stretched to the margin: its own box is the frame it is centred in.
+        None if members.len() == 1 && !centred => (b.rect[2] - b.rect[0]).max(size * k).max(crop[2] - 36.0 - (b.rect[0] + dx)),
+        None => (b.rect[2] - b.rect[0]).max(size * k),
+    };
+    if !width.is_finite() {
+        return Err(EditError::Invalid("the paragraph's width must be a number".into()));
+    }
+    let align = if centred { Some(crate::added::Align::Center) } else { style.align.or(rtl.then_some(crate::added::Align::Right)) };
+    // Where a right-aligned line ends, from the paragraph's left edge (user space).
+    let right_edge = if anchored_right { (b.rect[2] - b.rect[0]).max(0.0) } else { width };
+    // The move and the width are checked here, before the fallback fonts are written: a refused
+    // paragraph leaves the document as it was. The move is in page space, so it is taken back through
+    // the CTM's linear part into the space the paragraph is drawn in.
+    let movement = if dx != 0.0 || dy != 0.0 {
+        let c = emit.ctm;
+        let back = Matrix([c[0], c[1], c[2], c[3], 0.0, 0.0])
+            .invert()
+            .ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it can't be moved in".into()))?;
+        Some(back.apply(dx, dy))
+    } else {
+        None
+    };
+    let tm = if o.ctm == emit.ctm {
+        o.tm
+    } else {
+        let emit_inv = Matrix(emit.ctm).invert().ok_or_else(|| EditError::Invalid("the paragraph has a singular transform".into()))?;
+        Matrix(o.tm).then(&Matrix(o.ctm)).then(&emit_inv).0
+    };
+    let type3 = if !reuse && needs_type3(&flat) { Some(type3_font(doc, &mut fonts_res, &flat, family, bold, max_glyphs)?) } else { None };
+    let advance = |s: &str| -> f64 {
+        let t = match (&metrics, reuse) {
+            (Some(m), true) => {
+                let visual_s = if m.visual_order { crate::indic::to_visual(s) } else { s.to_owned() };
+                source_width(m, &visual_s, size, space, o_state.char_spacing, o_state.word_spacing)
+            }
+            _ if let Some(fallback) = &type3 => {
+                // Each character's count in `s`, from one pass over `s`.
+                let mut counts: HashMap<char, usize> = HashMap::new();
+                for c in s.chars() {
+                    let count = counts.entry(c).or_insert(0);
+                    *count = count.saturating_add(1);
+                }
+                fallback.widths.iter().map(|(ch, width)| counts.get(ch).copied().unwrap_or(0) as f64 * width * size).sum::<f64>()
+                    + s.chars().count() as f64 * o_state.char_spacing
+            }
+            _ => std_width(s, size) + s.chars().count() as f64 * o_state.char_spacing,
+        };
+        t * o_state.scale * k
+    };
+    // A turned single line grows to fit, up to where its baseline reaches the page's margin.
+    let width = if !upright && style.width.is_none() && members.len() == 1 {
+        let crop = p.crop(doc);
+        let (x0, y0) = (first.origin.x + dx, first.origin.baseline + dy);
+        let (ux, uy) = first.direction();
+        let tx = if ux > 1e-6 {
+            (crop[2] - 36.0 - x0) / ux
+        } else if ux < -1e-6 {
+            (crop[0] + 36.0 - x0) / ux
+        } else {
+            f64::INFINITY
+        };
+        let ty = if uy > 1e-6 {
+            (crop[3] - 36.0 - y0) / uy
+        } else if uy < -1e-6 {
+            (crop[1] + 36.0 - y0) / uy
+        } else {
+            f64::INFINITY
+        };
+        let cap = width.max(tx.min(ty)).min(14_400.0);
+        text.split('\n').map(&advance).fold(width, f64::max).min(cap)
+    } else {
+        width
+    };
+    let right_edge = if anchored_right { right_edge } else { width };
+    let wrapped = wrap(&text, width + 0.5, advance);
+    let mut substituted = None;
+    let new_font = !reuse;
+    let (show_font, encode): (String, Encoder) = if let Some(m) = metrics.clone().filter(|_| reuse) {
+        let name = font_name.clone();
+        (font_name.clone(), Box::new(move |s: &str| m.encode(s).map(|bytes| vec![(name.clone(), bytes)])))
+    } else if let Some(fallback) = type3.clone() {
+        substituted = Some(format!("{} Type3", fallback.family));
+        let first = fallback.names.first().cloned().ok_or_else(no_japanese_font)?;
+        (first, Box::new(move |s: &str| type3_encode(&fallback, s)))
+    } else {
+        let win = pdfcraft_fonts::win_ansi(&flat);
+        let back: String = win.iter().map(|c| char::from_u32(u32::from(*c)).unwrap_or('?')).collect();
+        let base = family.base_font(bold, italic);
+        if flat.chars().zip(back.chars()).any(|(a, c)| c == '?' && a != '?') {
+            return Err(EditError::Invalid(format!("\"{flat}\" has characters neither {} nor {base} can show", b.base_font)));
+        }
+        let mut f = Dict::new();
+        f.set(b"Type".to_vec(), Object::name("Font"));
+        f.set(b"Subtype".to_vec(), Object::name("Type1"));
+        f.set(b"BaseFont".to_vec(), Object::name(base));
+        f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+        // Named after its face, as the line and region rewrites name theirs: one name for every
+        // stand-in would repoint the paragraphs set in an earlier one at this face (#4280).
+        let name = format!("PCEd{}", base.replace('-', ""));
+        fonts_res.set(name.clone().into_bytes(), Object::Dict(f));
+        if style.family.is_none() {
+            substituted = Some(base.to_string());
+        }
+        let shown = name.clone();
+        (name, Box::new(move |s: &str| Some(vec![(shown.clone(), pdfcraft_fonts::win_ansi(s))])))
+    };
+    // Line spacing in text space: the paragraph's own (scaled with the size), or 1.2 × the size.
+    let lead = match style.line_spacing {
+        Some(m) => size * m.clamp(0.5, 5.0),
+        // From the first two rows (a row may hold several runs).
+        None if let Some((upper, lower)) = b
+            .rows
+            .first()
+            .zip(b.rows.get(1))
+            .and_then(|(upper, lower)| upper.first().zip(lower.first()))
+            .and_then(|(upper, lower)| lines.get(*upper).zip(lines.get(*lower))) =>
+        {
+            (upper.frame_origin().1 - lower.frame_origin().1) / k * size / old_size
+        }
+        None if o_state.leading > 0.0 => o_state.leading,
+        None => size * 1.2,
+    };
+    let n = pdfcraft_content::num;
+    // The paragraph's operators go, and so does another drawing on the same baseline (a fake-bold
+    // second copy, an invisible text layer): the new text is all that may show.
+    let drop = dropped;
+    // Text shown earlier in the same text object stays first: the paragraph then goes where its
+    // last row was, after any backgrounds between the rows, or between two halves of the text object.
+    let start = last.ops.first().copied().unwrap_or(emit.bt_op);
+    let split = ops
+        .get(emit.bt_op..start)
+        .unwrap_or_default()
+        .iter()
+        .enumerate()
+        .any(|(i, op)| matches!(op.op.as_slice(), b"Tj" | b"TJ" | b"'" | b"\"") && !drop.contains(&(emit.bt_op + i)));
+    // What the text after the paragraph expects, and what is in force where the paragraph is
+    // drawn: the state at its BT (or where it was split).
+    let after = if split { &emit.state } else { &emit.bt_state };
+    // In its own graphics state, so a new colour (or anything else) stops at the paragraph.
+    let mut block_ops = vec![Op::new("q", vec![])];
+    block_ops.extend(reveal_ops(&b, &lines, style, emit.ctm)?);
+    // Moved: a translation inside that state.
+    if let Some((ax, ay)) = movement {
+        block_ops.push(Op::new("cm", vec![n(1.0), n(0.0), n(0.0), n(1.0), n(ax), n(ay)]));
+    }
+    // Painted as the paragraph was, including what its text object set before the first show.
+    block_ops.extend(o_state.paint_ops(after));
+    block_ops.push(Op::new("BT", vec![]));
+    let mut state = o_state.clone();
+    state.word_spacing = 0.0;
+    // The font the next run is shown in: the one the BT sets, until a run of another fallback subset.
+    let mut shown_font = show_font.clone();
+    state.font = Some((show_font, size));
+    if let Some([r, g, bl]) = style.color {
+        state.fill = vec![Op::new("rg", vec![n(r), n(g), n(bl)])];
+    }
+    block_ops.extend(state.ops());
+    block_ops.push(Op::new("Tm", tm.iter().map(|v| n(*v)).collect()));
+    // Alignment: each line's offset from the left edge, in text space.
+    // `visible` is the width the line is aligned on (see the loop below).
+    let offset = |visible: f64| -> f64 {
+        let free = (width - visible).max(0.0) / k;
+        match align {
+            Some(crate::added::Align::Center) => free / 2.0,
+            // A right-to-left line anchored at its right edge may start left of the old box.
+            Some(crate::added::Align::Right) if anchored_right => (right_edge - visible) / k,
+            Some(crate::added::Align::Right) => free,
+            // A justified right-to-left paragraph ends its last line at the right edge.
+            Some(crate::added::Align::Justify) if rtl => free,
+            _ => 0.0,
+        }
+    };
+    // Justify: each line but the last fills the width. Word spacing reaches only single-byte code 32
+    // (ISO 32000-1 §9.3.3), so where a space is shown with another code (a composite font, a
+    // generated Type 3 font, a subset without a space) the extra space follows each space as a
+    // TJ adjustment instead, and code 32, which may then be a letter, gets none.
+    let justify = align == Some(crate::added::Align::Justify);
+    let word_spacing_reaches_spaces = match metrics.as_ref().filter(|_| reuse) {
+        Some(m) => m.encode(" ").is_some_and(|b| m.codes(&b).iter().all(|(c, len)| m.is_space(*c, *len))),
+        None => type3.is_none(),
+    };
+    let mut x = 0.0;
+    let mut tw_set = 0.0;
+    let mut underlines: Vec<(f64, f64, f64)> = Vec::new(); // (x0, x1, y) in text space
+    for (i, line) in wrapped.iter().enumerate() {
+        // A stretched (justified) line shows only its words, as before #4199: word spacing would
+        // reach the spaces before its first word and after its last, so they are left out, and
+        // the line fills the width from the left edge. Nothing to stretch over, or a paragraph
+        // drawn at `0 Tz`, isn't justified.
+        let body = line.trim_matches(' ');
+        let interior = body.matches(' ').count();
+        let tw = if justify && i + 1 < wrapped.len() && interior > 0 && o_state.scale.abs() > 1e-6 {
+            Some((width - advance(body)).max(0.0) / k / o_state.scale / interior as f64).filter(|tw| tw.is_finite())
+        } else {
+            None
+        }
+        .unwrap_or(0.0);
+        // Other lines show every space typed. A left-to-right one is aligned on its width up to
+        // its last word; a right-to-left one on its whole width, since the spaces typed after its
+        // last word are drawn on its left and the ones before its first on its right.
+        let (shown, visible) = if tw > 0.0 {
+            (body, advance(body))
+        } else if crate::bidi::rtl_base(line) {
+            (line.as_str(), advance(line))
+        } else {
+            (line.as_str(), advance(line.trim_end_matches(' ')))
+        };
+        let dx = if tw > 0.0 { 0.0 } else { offset(visible) };
+        if i > 0 || dx != 0.0 {
+            block_ops.push(Op::new("Td", vec![n(dx - x), n(if i > 0 { -lead } else { 0.0 })]));
+        }
+        x = dx;
+        let stretch = if word_spacing_reaches_spaces { 0.0 } else { tw };
+        let tw = tw - stretch;
+        if tw != tw_set {
+            block_ops.push(Op::new("Tw", vec![n(tw)]));
+            tw_set = tw;
+        }
+        // Each wrapped line in typing order; drawn left to right (right-to-left runs reversed).
+        let visual = crate::bidi::to_visual(shown);
+        // Stretched without word spacing: shown up to and including each space, then moved on.
+        let pieces = if stretch > 0.0 { visual.split_inclusive(' ').collect() } else { vec![visual.as_str()] };
+        for piece in pieces {
+            if let Some(metrics) = metrics.as_ref().filter(|_| reuse) {
+                let indic_piece = if metrics.visual_order { crate::indic::to_visual(piece) } else { piece.to_owned() };
+                block_ops.extend(source_show(metrics, &indic_piece, size, space, o_state.char_spacing, tw)?);
+            } else {
+                for (font, bytes) in encode(piece).ok_or_else(|| EditError::Invalid(format!("\"{line}\" can't be shown")))? {
+                    if font != shown_font {
+                        block_ops.push(Op::new("Tf", vec![Object::name(&font), n(size)]));
+                        shown_font = font;
+                    }
+                    block_ops.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
+                }
+            }
+            if stretch > 0.0 && piece.ends_with(' ') {
+                block_ops.push(Op::new("TJ", vec![Object::Array(vec![n(-1000.0 * stretch / size)])]));
+            }
+        }
+        let tw = tw + stretch;
+        // Underlined to the line's last word, over its stretched gaps.
+        let w = (visible + tw * interior as f64 * o_state.scale * k) / k;
+        underlines.push((dx, dx + w, -(i as f64) * lead - size * 0.12));
+    }
+    block_ops.push(Op::new("ET", vec![]));
+    if style.underline == Some(true) {
+        // In text space (the paragraph's text matrix), in its fill colour.
+        let colour: Vec<Op> = state
+            .fill
+            .iter()
+            .map(|f| match f.op.as_slice() {
+                b"g" => Op::new("G", f.operands.clone()),
+                b"rg" => Op::new("RG", f.operands.clone()),
+                b"k" => Op::new("K", f.operands.clone()),
+                b"cs" => Op::new("CS", f.operands.clone()),
+                b"sc" => Op::new("SC", f.operands.clone()),
+                _ => Op::new("SCN", f.operands.clone()),
+            })
+            .collect();
+        block_ops.push(Op::new("q", vec![]));
+        block_ops.push(Op::new("cm", tm.iter().map(|v| n(*v)).collect()));
+        block_ops.extend(colour);
+        block_ops.push(Op::new("w", vec![n(size * 0.06)]));
+        for (x0, x1, y) in underlines {
+            block_ops.push(Op::new("m", vec![n(x0), n(y)]));
+            block_ops.push(Op::new("l", vec![n(x1), n(y)]));
+        }
+        block_ops.push(Op::new("S", vec![]));
+        block_ops.push(Op::new("Q", vec![]));
+    }
+    block_ops.push(Op::new("Q", vec![]));
+    block_ops.extend(after.ops().into_iter().filter(|op| !op.is("Tf") || after.font.is_some()));
+    if split {
+        block_ops.insert(0, Op::new("ET", vec![]));
+        block_ops.push(Op::new("BT", vec![]));
+        block_ops.push(Op::new("Tm", emit.tlm.iter().map(|v| n(*v)).collect()));
+    }
+    let at = if split { start } else { emit.bt_op };
+    let new_data = splice(&pieces, &ops, |i| {
+        let insert = if i == at { std::mem::take(&mut block_ops) } else { Vec::new() };
+        (insert, !drop.contains(&i))
+    });
+    let contents = rewritten_contents(doc, &streams, new_data);
+    if new_font {
+        res.set(b"Font".to_vec(), Object::Dict(fonts_res));
+    }
+    let page_ref = p.obj;
+    doc.update_dict(page_ref, |d| {
+        d.set(b"Contents".to_vec(), contents);
+        if new_font {
+            d.set(b"Resources".to_vec(), Object::Dict(res));
+        }
+    })?;
+    Ok(LineEdit { substituted })
+}
+
+/// The cover (when [`BlockStyle::cover`] asks for one) and visible rendering that start a
+/// rewritten invisible paragraph, drawn in the space whose CTM is `ctm`. Nothing for visible text.
+/// The paragraph's `q`/`Q` restores the rendering mode for the invisible text after it.
+pub(crate) fn reveal_ops(block: &TextBlock, lines: &[TextLine], style: &BlockStyle, ctm: [f64; 6]) -> Result<Vec<Op>, EditError> {
+    if !block.invisible {
+        return Ok(Vec::new());
+    }
+    let n = pdfcraft_content::num;
+    let mut ops = Vec::new();
+    if let Some(colour) = style.cover {
+        if colour.iter().any(|c| !c.is_finite() || !(0.0..=1.0).contains(c)) {
+            return Err(EditError::Invalid("the cover colour must be RGB values from 0 to 1".into()));
+        }
+        let back = Matrix(ctm).invert().ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it can't be covered in".into()))?;
+        ops.push(Op::new("q", vec![]));
+        ops.push(Op::new("rg", colour.map(n).to_vec()));
+        for rect in block.lines.iter().filter_map(|i| lines.get(*i)).map(|l| l.rect) {
+            // Scanned ink reaches a little past the recognised box.
+            let pad = ((rect[3] - rect[1]).abs() * 0.1).clamp(0.5, 2.0);
+            let corners =
+                [[rect[0] - pad, rect[1] - pad], [rect[2] + pad, rect[1] - pad], [rect[2] + pad, rect[3] + pad], [rect[0] - pad, rect[3] + pad]];
+            for (i, [x, y]) in corners.into_iter().enumerate() {
+                let (x, y) = back.apply(x, y);
+                if !(x.is_finite() && y.is_finite()) {
+                    return Err(EditError::Invalid("the paragraph's area can't be covered".into()));
+                }
+                ops.push(Op::new(if i == 0 { "m" } else { "l" }, vec![n(x), n(y)]));
+            }
+            ops.push(Op::new("h", vec![]));
+        }
+        ops.push(Op::new("f", vec![]));
+        ops.push(Op::new("Q", vec![]));
+    }
+    ops.push(Op::new("Tr", vec![Object::Int(0)]));
+    Ok(ops)
+}
+
+/// Existing paragraph indexes, excluding streams owned by an added-content item.
+pub(crate) fn selectable_blocks(
+    doc: &Document,
+    page: usize,
+    excluded: &std::collections::BTreeSet<pdfcraft_cos::ObjRef>,
+) -> Result<Vec<(usize, TextBlock)>, EditError> {
+    let p = page_dict(doc, page)?;
+    let streams = content_streams(doc, &p.dict)?;
+    let lines = text_lines(doc, page)?;
+    Ok(group_blocks(&lines)
+        .into_iter()
+        .enumerate()
+        .filter(|(_, b)| {
+            !b.lines
+                .iter()
+                .filter_map(|i| lines.get(*i))
+                .any(|l| streams.get(l.stream).and_then(|(o, _)| o.as_ref()).is_some_and(|r| excluded.contains(&r)))
+        })
+        .collect())
+}
+
+/// The vertical advance per unit of font size of a font that writes vertically: `/DW2`'s w1
+/// (default −1000, §9.7.4.3), or `None` for horizontal text. Per-glyph `/W2` entries are not
+/// read. An encoding whose writing mode can't be read is an error, as in [`vertical_encoding`];
+/// listing text treats it as horizontal and records the error (see [`Ts::unreadable`]).
+pub(super) fn vertical_advance(doc: &Document, font: &Dict) -> Result<Option<f64>, EditError> {
+    if !vertical_encoding(doc, font)? {
+        return Ok(None);
+    }
+    let descendant = font.get(b"DescendantFonts").and_then(|d| doc.resolve(d).as_array().and_then(|a| a.first().cloned()));
+    let w1 = descendant
+        .and_then(|d| doc.resolve(&d).as_dict().and_then(|d| d.get(b"DW2").cloned()))
+        .and_then(|a| doc.resolve(&a).as_array().and_then(|a| a.get(1).cloned()))
+        .and_then(|w| doc.resolve(&w).as_f64())
+        .filter(|w| w.is_finite())
+        .unwrap_or(-1000.0);
+    Ok(Some(w1 / 1000.0))
+}
+
+/// Detect vertical CMaps before moving horizontal text. A broken/cyclic embedded CMap is
+/// refused rather than guessing which direction TJ advances its text matrix.
+fn vertical_encoding(doc: &Document, font: &Dict) -> Result<bool, EditError> {
+    if font.name(b"Subtype") != Some(b"Type0") {
+        return Ok(false);
+    }
+    let mut next = font.get(b"Encoding").cloned();
+    let mut seen = std::collections::BTreeSet::new();
+    for _ in 0..8 {
+        let Some(o) = next.take() else { return Ok(false) };
+        if let Some(r) = o.as_ref()
+            && !seen.insert(r)
+        {
+            return Err(EditError::Invalid("the text encoding is cyclic".into()));
+        }
+        match &*doc.resolve(&o) {
+            Object::Name(n) => return Ok(n.ends_with(b"-V")),
+            Object::Stream(stream) => {
+                if let Some(mode) = stream.dict.get(b"WMode") {
+                    match mode.as_int() {
+                        Some(1) => return Ok(true),
+                        Some(0) => {}
+                        _ => return Err(EditError::Invalid("the text writing mode is invalid".into())),
+                    }
+                }
+                let bytes = stream
+                    .decoded_within(8 * 1024 * 1024)
+                    .map_err(|_| EditError::Invalid("the text encoding cannot be decoded within its size limit".into()))?;
+                let ops = parse(&bytes).ops;
+                if let Some(mode) = ops.iter().rev().find(|op| op.is("def") && op.name(0) == Some(b"WMode")) {
+                    return match mode.num(1) {
+                        Some(0.0) => Ok(false),
+                        Some(1.0) => Ok(true),
+                        _ => Err(EditError::Invalid("the text writing mode is invalid".into())),
+                    };
+                }
+                next = stream
+                    .dict
+                    .get(b"UseCMap")
+                    .cloned()
+                    .or_else(|| ops.iter().rev().find(|op| op.is("usecmap")).and_then(|op| op.operands.first().cloned()));
+            }
+            _ => return Err(EditError::Invalid("the text encoding is invalid".into())),
+        }
+    }
+    Err(EditError::Invalid("the text encoding is nested too deeply".into()))
+}
+
+/// Translate paragraphs together without re-encoding glyphs, changing fonts or reflowing.
+/// Numeric TJ offsets and text rise temporarily move each selected show operation, then
+/// restore both advances and rise. The PDF reader advances the original glyph bytes itself:
+/// no approximate font metrics are used to position following, unselected text (§9.4.4).
+pub(crate) fn translate_blocks(doc: &mut Document, page: usize, indexes: &[usize], offset: [f64; 2]) -> Result<(), EditError> {
+    if indexes.is_empty() {
+        return Ok(());
+    }
+    let p = page_dict(doc, page)?;
+    let streams = content_streams(doc, &p.dict)?;
+    let lines = text_lines(doc, page)?;
+    let blocks = group_blocks(&lines);
+    let mut selected = std::collections::BTreeSet::new();
+    for index in indexes {
+        let b = blocks.get(*index).ok_or_else(|| EditError::Invalid("a selected paragraph no longer exists".into()))?;
+        for line in &b.lines {
+            let l = lines.get(*line).ok_or_else(|| EditError::Invalid("a selected text line no longer exists".into()))?;
+            l.ensure_editable()?;
+            selected.extend(l.ops.iter().copied());
+        }
+    }
+    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let fonts = res.get(b"Font").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let shown = interpret(doc, &ops, &res, &mut HashMap::new(), &mut Carry::new(), None, None)?;
+    let mut patches = HashMap::new();
+    // Keep full precision: a tiny rounded text-space change can be magnified by a CTM,
+    // and restoring rise/spacing must not alter following unselected text.
+    let n = Object::Real;
+    for s in shown.into_iter().filter(|s| selected.contains(&s.op)) {
+        if !(0..=3).contains(&s.state.render_mode) {
+            return Err(EditError::Invalid("text used as a clipping path cannot be moved in a group".into()));
+        }
+        let font = fonts
+            .get(&s.font)
+            .map(|f| doc.resolve(f))
+            .and_then(|f| f.as_dict().cloned())
+            .ok_or_else(|| EditError::Invalid("a selected paragraph has no font".into()))?;
+        if vertical_encoding(doc, &font)? {
+            return Err(EditError::Invalid("vertical text cannot be moved in a group".into()));
+        }
+        let inverse = s.tm.then(&s.state.ctm).invert().ok_or_else(|| EditError::Invalid("a selected paragraph has no area".into()))?;
+        let [a, b, c, d, _, _] = inverse.0;
+        let (dx, dy) = (a * offset[0] + c * offset[1], b * offset[0] + d * offset[1]);
+        let denominator = s.state.size * s.state.scale;
+        let shift = if dx == 0.0 {
+            0.0
+        } else if denominator.abs() > 1e-12 {
+            -1000.0 * dx / denominator
+        } else {
+            return Err(EditError::Invalid("a selected paragraph has no horizontal advance".into()));
+        };
+        let rise = s.state.rise + dy;
+        if ![shift, rise, dx, dy].iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+            return Err(EditError::Invalid("the paragraph move is too large".into()));
+        }
+        let original = ops.get(s.op).ok_or_else(|| EditError::Invalid("a selected text operation is missing".into()))?;
+        let mut replacement = Vec::new();
+        let show = if original.is("'") || original.is("\"") {
+            if original.is("\"") {
+                let spacing = original
+                    .operands
+                    .get(..2)
+                    .filter(|a| a.iter().all(|o| o.as_f64().is_some()))
+                    .ok_or_else(|| EditError::Invalid("a text operation has invalid spacing".into()))?;
+                for (operator, operand) in ["Tw", "Tc"].into_iter().zip(spacing) {
+                    replacement.push(Op::new(operator, vec![operand.clone()]));
+                }
+            }
+            replacement.push(Op::new("T*", vec![]));
+            Op::new("Tj", vec![original.operands.last().cloned().ok_or_else(|| EditError::Invalid("a text operation has no string".into()))?])
+        } else {
+            original.clone()
+        };
+        if dy != 0.0 {
+            replacement.push(Op::new("Ts", vec![n(rise)]));
+        }
+        if shift != 0.0 {
+            replacement.push(Op::new("TJ", vec![Object::Array(vec![n(shift)])]));
+        }
+        replacement.push(show);
+        if shift != 0.0 {
+            replacement.push(Op::new("TJ", vec![Object::Array(vec![n(-shift)])]));
+        }
+        if dy != 0.0 {
+            replacement.push(Op::new("Ts", vec![n(s.state.rise)]));
+        }
+        patches.insert(s.op, replacement);
+    }
+    if patches.len() != selected.len() {
+        return Err(EditError::Invalid("a selected text operation cannot be moved".into()));
+    }
+    let data = splice(&pieces, &ops, |i| patches.remove(&i).map_or((Vec::new(), true), |v| (v, false)));
+    let contents = rewritten_contents(doc, &streams, data);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
diff --git a/crates/edit/src/text_regions.rs b/crates/edit/src/text_regions.rs
index d4ebe4c443..7516cb793b 100644
--- a/crates/edit/src/text_regions.rs
+++ b/crates/edit/src/text_regions.rs
@@ -2,1105 +2,10 @@
 
 use super::*;
 
-// The draft is capped at 4 MiB; also bound the outline data prepared across all fallback faces.
-// A glyph budget worth 64 full batches (15,360 glyphs with the production batch size).
-// Lowering the internal batch size for tests lowers the budget by the same ratio.
-const MAX_STYLED_FALLBACK_BATCHES: usize = 64;
+#[path = "text_regions/grouping.rs"]
+mod grouping;
+#[path = "text_regions/styled.rs"]
+mod styled;
 
-struct FallbackGroup {
-    face: &'static CraftFont,
-    seen: std::collections::HashSet<char>,
-    glyphs: Vec<Type3Glyph>,
-    positions: Vec<usize>,
-}
-
-fn same_plane(a: &TextLine, b: &TextLine) -> bool {
-    let at = Matrix(a.origin.tm).then(&Matrix(a.origin.ctm));
-    let bt = Matrix(b.origin.tm).then(&Matrix(b.origin.ctm));
-    a.scope == b.scope
-        && a.paint == b.paint
-        && [0, 2].iter().all(|axis| {
-            let ax = at.0.get(*axis).copied().unwrap_or(0.0);
-            let ay = at.0.get(axis + 1).copied().unwrap_or(0.0);
-            let bx = bt.0.get(*axis).copied().unwrap_or(0.0);
-            let by = bt.0.get(axis + 1).copied().unwrap_or(0.0);
-            let al = ax.hypot(ay);
-            let bl = bx.hypot(by);
-            al > 0.0 && bl > 0.0 && (ax / al - bx / bl).abs() < 0.001 && (ay / al - by / bl).abs() < 0.001
-        })
-}
-
-fn row_rect(row: &[usize], lines: &[TextLine]) -> Option<[f64; 4]> {
-    row.iter().filter_map(|i| lines.get(*i)).map(|l| l.rect).reduce(union)
-}
-
-/// [`row_rect`] in its text's own frame ([`TextLine::frame_rect`]), so rows of turned text
-/// compare along and across their baselines.
-fn frame_row_rect(row: &[usize], lines: &[TextLine]) -> Option<[f64; 4]> {
-    row.iter().filter_map(|i| lines.get(*i)).map(TextLine::frame_rect).reduce(union)
-}
-
-/// The left edge the rest of the page's text sits on, ignoring the rows of `block`. A single row
-/// that does not share it is not merely an indented or full-width left-aligned line, so its own
-/// centre is the only remaining explanation for where it sits.
-fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
-    let mut edges: HashMap<i64, usize> = HashMap::new();
-    for (i, line) in lines.iter().enumerate() {
-        if block.lines.contains(&i) {
-            continue;
-        }
-        // Quarter-point buckets: equal edges found through different runs still agree.
-        *edges.entry((line.rect[0] * 4.0).round() as i64).or_insert(0) += 1;
-    }
-    let (best, _) = edges.into_iter().max_by_key(|(_, count)| *count)?;
-    Some(best as f64 / 4.0)
-}
-
-/// Whether a block reads as centred, and so must keep its centre when it grows or wraps.
-///
-/// Several ragged rows whose left edges disagree while their centres agree are centred. A one row
-/// block cannot say that: all of its left edges are the same, so the ragged test never fires and a
-/// centred title would be taken for left-aligned and grow to the right (#2581). Fall back to the
-/// page instead — a lone row sitting on the page's own centre, and not on the edge the rest of the
-/// text uses, is a centred title. A full-width left-aligned line still lines up with that edge, so
-/// it is not mistaken for one.
-pub(super) fn is_centred(block: &TextBlock, lines: &[TextLine], page_centre: f64, size: f64) -> bool {
-    let centre = (block.rect[0] + block.rect[2]) / 2.0;
-    let lefts: Vec<_> = block.rows.iter().filter_map(|r| row_rect(r, lines).map(|r| r[0])).collect();
-    if block.rows.len() > 1 {
-        let left_span = lefts.iter().copied().fold(f64::NEG_INFINITY, f64::max) - lefts.iter().copied().fold(f64::INFINITY, f64::min);
-        return left_span > size * 0.5
-            && block.rows.iter().all(|row| row_rect(row, lines).is_some_and(|r| ((r[0] + r[2]) / 2.0 - centre).abs() < size));
-    }
-    lefts
-        .first()
-        .is_some_and(|left| (centre - page_centre).abs() < size && neighbour_left(lines, block).is_none_or(|edge| (*left - edge).abs() > size * 0.5))
-}
-
-pub(super) fn group_blocks(lines: &[TextLine]) -> Vec<TextBlock> {
-    group_layout(lines, true)
-}
-
-/// Exporters currently represent a block with one style. Keep their style boundaries until
-/// they support rich runs, while edit selection may encompass the complete visual region.
-/// Dotted-leader entries stay on one row and use the title run's style.
-pub(super) fn group_reading_blocks(lines: &[TextLine]) -> Vec<TextBlock> {
-    let mut blocks = Vec::new();
-    let mut start = 0;
-    let mut offset = 0;
-    for row in lines.chunk_by(|a, b| same_plane(a, b) && (a.origin.baseline - b.origin.baseline).abs() < a.size.min(b.size) * 0.2) {
-        let mut text = String::new();
-        for (i, line) in row.iter().enumerate() {
-            if !text.ends_with(char::is_whitespace)
-                && !line.text.starts_with(char::is_whitespace)
-                && i.checked_sub(1).and_then(|i| row.get(i)).is_some_and(|prev| line.rect[0] - prev.rect[2] > line.size * 0.12)
-            {
-                text.push(' ');
-            }
-            text.push_str(&line.text);
-        }
-        if leader_entry(&text)
-            && let Some(first) = row.first()
-        {
-            // Tab leaders are a single reading row, even when the title, dots and page
-            // number are separate text objects far apart. Do not merge neighbouring entries.
-            blocks.extend(group_layout(lines.get(start..offset).unwrap_or_default(), false));
-            let mut line = first.clone();
-            line.text = text;
-            line.rect = row.iter().map(|line| line.rect).reduce(union).unwrap_or(first.rect);
-            blocks.extend(group_layout(std::slice::from_ref(&line), false));
-            start = offset + row.len();
-        }
-        offset += row.len();
-    }
-    blocks.extend(group_layout(lines.get(start..).unwrap_or_default(), false));
-    blocks
-}
-
-/// Dotted leaders end in a page number, with a title before the dots. A dot in an article
-/// number, or an ellipsis in ordinary prose, is not enough to make a contents entry.
-fn leader_entry(text: &str) -> bool {
-    let text = text.trim_end();
-    let prefix = text.trim_end_matches(|c: char| {
-        c.is_ascii_digit() || matches!(c, 'i' | 'v' | 'x' | 'l' | 'c' | 'd' | 'm' | 'I' | 'V' | 'X' | 'L' | 'C' | 'D' | 'M')
-    });
-    if prefix.len() == text.len() {
-        return false;
-    }
-    let title = prefix.trim_end_matches(|c: char| c.is_whitespace() || matches!(c, '.' | '…'));
-    let dots = prefix
-        .get(title.len()..)
-        .unwrap_or_default()
-        .chars()
-        .map(|c| match c {
-            '.' => 1,
-            '…' => 3,
-            _ => 0,
-        })
-        .sum::<usize>();
-    dots >= 3 && title.chars().any(char::is_alphabetic)
-}
-
-/// Text-space units → user space along the baseline. It is the vertical scale ([`Origin::k`])
-/// unless the text matrix stretches the glyphs, as an OCR layer fitting each word to the scan does.
-fn across(line: &TextLine) -> f64 {
-    let m = Matrix(line.origin.tm).then(&Matrix(line.origin.ctm)).0;
-    let h = m[0].hypot(m[1]);
-    if h.is_finite() && h > 1e-9 { h } else { line.origin.k }
-}
-
-/// Invisible text (rendering mode 3), as in an OCR layer over a scanned image.
-fn invisible(line: &TextLine) -> bool {
-    line.origin.state.render_mode == 3
-}
-
-fn same_style(a: &TextLine, b: &TextLine) -> bool {
-    same_font(a, b.font.as_bytes(), &b.base_font, b.face.as_deref())
-        // With no `/BaseFont` (or only a subset tag) there is no name to compare: the resource or
-        // fallback face `same_font` matched is the whole identity, so keep the lines together.
-        && (same_base_font(&a.base_font, &b.base_font)
-            || (strip_subset_tag(&a.base_font).is_empty() && strip_subset_tag(&b.base_font).is_empty()))
-        && a.bold == b.bold
-        && a.italic == b.italic
-        && a.color == b.color
-        && (a.rotation() - b.rotation()).abs() < 0.01
-        && (a.size - b.size).abs() < 0.01
-}
-
-/// Does a row open with a list marker? A bullet or a dash, or an ordered marker — digits (or a
-/// single letter) followed by `.` or `)` and then a space or the row's end, so prose such as
-/// `1.5` or `Dr. Smith` is left alone.
-fn opens_with_marker(text: &str) -> bool {
-    let Some(first) = text.chars().next() else { return false };
-    if matches!(first, '•' | '◦' | '▪' | '‣' | '⁃' | '*' | '-' | '–' | '—') {
-        return true;
-    }
-    if !first.is_ascii_digit() && !first.is_ascii_alphabetic() {
-        return false;
-    }
-    let digits = text.chars().take_while(char::is_ascii_digit).count();
-    let letters = text.chars().take_while(char::is_ascii_alphabetic).count();
-    // Both runs are ASCII characters, so their length in characters is their length in bytes:
-    // the slice below starts on a character boundary.
-    let rest = if digits > 0 {
-        &text[digits..]
-    } else if letters == 1 {
-        &text[1..]
-    } else {
-        return false;
-    };
-    let mut after = rest.chars();
-    matches!(after.next(), Some('.' | ')')) && after.next().is_none_or(char::is_whitespace)
-}
-
-/// A row that opens with a list marker opens its own item: joining it to the row above is what
-/// let an edit of one paragraph delete every item after it (#2564). The other error, splitting
-/// an ordinary paragraph, costs one more paragraph to click and never any text — so err this way.
-fn starts_list_item(row: &[usize], lines: &[TextLine]) -> bool {
-    row.iter().filter_map(|i| lines.get(*i)).map(|l| l.text.trim_start()).find(|t| !t.is_empty()).is_some_and(opens_with_marker)
-}
-
-fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
-    let mut rows: Vec<Vec<usize>> = Vec::new();
-    for (i, line) in lines.iter().enumerate() {
-        let joins = rows.last().and_then(|r| r.last()).and_then(|i| lines.get(*i)).is_some_and(|prev| {
-            let gap = line.frame_rect()[0] - prev.frame_rect()[2];
-            // OCR words (invisible text over a scan) join only across a word space: a wider gap
-            // is a table cell or a tab stop, which a rewrite would close up.
-            let scanned = !mixed || (invisible(prev) == invisible(line) && (!invisible(line) || gap < prev.size.max(line.size) * 0.6));
-            scanned
-                && (mixed || same_style(prev, line))
-                && same_plane(prev, line)
-                // A superscript or subscript run (a footnote marker, say) sits on the same visual
-                // row as the text around it, raised or lowered by `Ts` from the body baseline
-                // (#3252). That shift is typically up to half the body size, not the marker's own
-                // smaller size — but the wider tolerance only applies between a run and a
-                // distinctly smaller or larger one, with no horizontal overlap (`gap >= 0.0`):
-                // two equal-size runs can land within it too, at a baseline shift tight columns
-                // or compressed text (`Tz`) can produce between genuinely separate rows, and the
-                // original 20% tolerance is what keeps those apart.
-                && ((prev.frame_origin().1 - line.frame_origin().1).abs() < prev.size.min(line.size) * 0.2
-                    || (gap >= 0.0
-                        && prev.size.min(line.size) < prev.size.max(line.size) * 0.9
-                        && (prev.frame_origin().1 - line.frame_origin().1).abs() < prev.size.max(line.size) * 0.5))
-                && gap >= -prev.size.min(line.size) * 0.2
-                && gap < prev.size.max(line.size) * 1.5
-                // Separate same-style text objects that merely touch or overlap, with no space
-                // between them, are separate labels (for example a paragraph dragged against
-                // another, #594). Style runs and words separated by a space or gap still join.
-                && (prev.origin.bt_op == line.origin.bt_op
-                    || gap > prev.size.min(line.size) * 0.01
-                    || !same_style(prev, line)
-                    || prev.text.ends_with(char::is_whitespace)
-                    || line.text.starts_with(char::is_whitespace))
-        });
-        if joins && let Some(row) = rows.last_mut() {
-            row.push(i);
-        } else {
-            rows.push(vec![i]);
-        }
-    }
-    let mut blocks: Vec<TextBlock> = Vec::new();
-    for row in rows {
-        let Some(first) = row.first().and_then(|i| lines.get(*i)) else { continue };
-        let (Some(rect), Some(frame)) = (row_rect(&row, lines), frame_row_rect(&row, lines)) else { continue };
-        let joins = blocks.last().is_some_and(|block| {
-            // A bullet of its own opens a list item (#2564): such a row is a new paragraph, and
-            // letting it join is what made an edit of the row above delete this item and the ones
-            // after it.
-            if starts_list_item(&row, lines) {
-                return false;
-            }
-            let Some(prev_row) = block.rows.last() else { return false };
-            let Some(prev) = prev_row.first().and_then(|i| lines.get(*i)) else { return false };
-            let Some(pr) = frame_row_rect(prev_row, lines) else { return false };
-            let gap = prev.frame_origin().1 - first.frame_origin().1;
-            let tol = prev.size.max(first.size).max(1.0);
-            // The block opens with a list marker and this row sits further right: the item's text
-            // is at a hanging indent, so the row it wrapped onto continues it (#2564). A row at
-            // the block's own left edge is already covered by the match on `pr[0]`. Both boxes are
-            // in the frame, as the rest of this comparison is, so turned text matches too.
-            let hanging = frame[0] > pr[0]
-                && frame[0] - pr[0] <= tol * 3.0
-                && block.lines.first().and_then(|&i| lines.get(i)).is_some_and(|l| opens_with_marker(l.text.trim_start()));
-            let aligned = (pr[0] - frame[0]).abs() < tol
-                || ((pr[0] + pr[2] - frame[0] - frame[2]) / 2.0).abs() < tol
-                || (pr[2] - frame[2]).abs() < tol
-                || hanging;
-            // OCR lines stay apart: the scan fixes where each one is, so they never rewrap together.
-            (!mixed || !(invisible(prev) || invisible(first)))
-                && (mixed || same_style(prev, first))
-                && same_plane(prev, first)
-                // The rewrite sets every row in the first one's horizontal scale.
-                && (prev.origin.state.scale - first.origin.state.scale).abs() < 1e-6
-                && aligned
-                && first.size.min(prev.size) >= first.size.max(prev.size) * 0.4
-                && gap > first.size.min(prev.size) * 0.8
-                && gap < first.size.max(prev.size) * 2.5
-        });
-        if !joins {
-            blocks.push(TextBlock {
-                text: String::new(),
-                editor_text: String::new(),
-                spans: Vec::new(),
-                rect,
-                base_font: first.base_font.clone(),
-                size: first.size,
-                bold: first.bold,
-                italic: first.italic,
-                color: first.color,
-                rotation: first.rotation(),
-                lines: Vec::new(),
-                rows: Vec::new(),
-                invisible: true,
-            });
-        }
-        let Some(block) = blocks.last_mut() else { continue };
-        let mut row_text = String::new();
-        if !block.rows.is_empty() {
-            block.editor_text.push('\n');
-        }
-        for &index in &row {
-            let Some(line) = lines.get(index) else { continue };
-            // Some producers position separate words without encoding a space.
-            if let Some(prev) = block.lines.last().filter(|i| row.contains(i)).and_then(|i| lines.get(*i))
-                && !row_text.ends_with(char::is_whitespace)
-                && !line.text.starts_with(char::is_whitespace)
-                && line.frame_rect()[0] - prev.frame_rect()[2] > line.size * 0.12
-            {
-                row_text.push(' ');
-                block.editor_text.push(' ');
-            }
-            let start = block.editor_text.len();
-            block.editor_text.push_str(&line.text);
-            block.spans.push((start..block.editor_text.len(), index));
-            row_text.push_str(&line.text);
-            block.invisible &= line.origin.state.render_mode == 3;
-            block.lines.push(index);
-        }
-        if !block.text.is_empty() {
-            if block.text.ends_with('-') {
-                block.text.pop();
-            } else {
-                block.text.push(' ');
-            }
-        }
-        block.text.push_str(row_text.trim_matches(paragraph_separator));
-        block.rect = union(block.rect, rect);
-        block.rows.push(row);
-    }
-    blocks
-}
-
-/// Shape in the source or an explicitly registered matching full face. Never use interface fonts.
-fn shape_source(
-    doc: &Document,
-    fonts: &Dict,
-    name: &str,
-    text: &str,
-) -> Result<Option<(Vec<u8>, pdfcraft_fonts::source_shaping::ShapedRun, String)>, EditError> {
-    if !pdfcraft_fonts::source_shaping::required(text) {
-        return Ok(None);
-    }
-    let source =
-        fonts.get(name.as_bytes()).and_then(|f| doc.dict(f)).ok_or_else(|| EditError::Invalid("the shaped text has no font resource".into()))?;
-    let family = Metrics::from_dict(doc, &source).base_font;
-    let mut candidates = vec![source];
-    candidates.extend(
-        fonts
-            .iter()
-            .filter_map(|(_, f)| doc.dict(f))
-            .filter(|f| pdfcraft_fonts::embedding::face_key(&Metrics::from_dict(doc, f).base_font) == pdfcraft_fonts::embedding::face_key(&family)),
-    );
-    for font in candidates {
-        if let Some(bytes) = pdfcraft_fonts::pdf::embedded_sfnt(doc, &font)
-            && pdfcraft_fonts::embedding::covers(&bytes, text)
-            && let Ok(shaped) = pdfcraft_fonts::source_shaping::shape(&bytes, text)
-        {
-            return Ok(Some((bytes, shaped, family)));
-        }
-    }
-    Err(EditError::Invalid("complex text needs the complete source TrueType/OpenType face; load that font before editing".into()))
-}
-
-/// For each output row (a range of the draft's characters), whether it is exactly the source row
-/// at the same position: the same characters, none of them inserted or changed by the edit.
-fn untouched_rows(block: &TextBlock, draft: &str, rows: &[std::ops::Range<usize>]) -> Vec<bool> {
-    let old: Vec<char> = block.editor_text.chars().collect();
-    let new: Vec<char> = draft.chars().collect();
-    let prefix = old.iter().zip(&new).take_while(|(a, b)| a == b).count();
-    let suffix = old.iter().rev().zip(new.iter().rev()).take(old.len().min(new.len()).saturating_sub(prefix)).take_while(|(a, b)| a == b).count();
-    // The source character a draft character is, if the edit left it alone.
-    let origin = |i: usize| {
-        if i < prefix {
-            Some(i)
-        } else if i >= new.len().saturating_sub(suffix) {
-            (old.len() + i).checked_sub(new.len())
-        } else {
-            None
-        }
-    };
-    let mut source_rows = Vec::new();
-    let mut start = 0;
-    for (i, ch) in old.iter().enumerate() {
-        if *ch == '\n' {
-            source_rows.push(start..i);
-            start = i + 1;
-        }
-    }
-    source_rows.push(start..old.len());
-    // A line break inside a source run would pair editor rows with the wrong visual rows.
-    if source_rows.len() != block.rows.len() {
-        return vec![false; rows.len()];
-    }
-    rows.iter()
-        .enumerate()
-        .map(|(r, range)| {
-            source_rows.get(r).is_some_and(|source| {
-                !range.is_empty() && range.len() == source.len() && range.clone().zip(source.clone()).all(|(i, j)| origin(i) == Some(j))
-            })
-        })
-        .collect()
-}
-
-/// Rewrite visual rows while keeping the source style on each surviving character. Resource
-/// names may differ between Unicode subsets of the same face; encoding searches those subsets.
-pub(super) fn rewrite_styled_block(
-    doc: &mut Document,
-    page: usize,
-    block: &TextBlock,
-    lines: &[TextLine],
-    text: Option<&str>,
-    style: &BlockStyle,
-    max_glyphs: usize,
-) -> Result<LineEdit, EditError> {
-    let first = block.lines.first().and_then(|i| lines.get(*i)).ok_or_else(|| EditError::Invalid("the paragraph has no source runs".into()))?;
-    let draft = match text {
-        Some(t) if t != block.text => t,
-        _ => &block.editor_text,
-    };
-    if draft.len() > 4_000_000 {
-        return Err(EditError::Invalid("the replacement text is too large".into()));
-    }
-    if draft == block.editor_text && *style == BlockStyle::default() {
-        return Ok(LineEdit { substituted: None });
-    }
-    let mut ranges: Vec<_> = style.ranges.iter().collect();
-    ranges.sort_by_key(|r| r.range.start);
-    if ranges.len() > 1024
-        || ranges.iter().any(|r| {
-            r.range.start >= r.range.end
-                || draft.get(r.range.clone()).is_none()
-                || [r.size, r.char_spacing, r.scale].iter().flatten().any(|n| !n.is_finite())
-                || r.size.is_some_and(|n| n <= 0.0 || n > 14400.0)
-                || r.color.is_some_and(|c| c.iter().any(|n| !n.is_finite() || !(0.0..=1.0).contains(n)))
-        })
-        || ranges.windows(2).any(|r| r[0].range.end > r[1].range.start)
-    {
-        return Err(EditError::Invalid("text style ranges must be disjoint UTF-8 boundaries with finite formatting (at most 1024 ranges)".into()));
-    }
-    let source_count = lines.len();
-    let mut styled_lines = lines.to_vec();
-    let mut styled_spans = Vec::new();
-    let mut underlines = HashMap::new();
-    let mut overrides = HashMap::new();
-    for (span, source) in block.edited_spans(draft) {
-        let mut edges = vec![span.start, span.end];
-        for r in &ranges {
-            for edge in [r.range.start, r.range.end] {
-                if span.contains(&edge) {
-                    edges.push(edge);
-                }
-            }
-        }
-        edges.sort_unstable();
-        edges.dedup();
-        for bounds in edges.windows(2) {
-            let (Some(start), Some(end)) = (bounds.first().copied(), bounds.get(1).copied()) else { continue };
-            let mut index = source;
-            let selected = ranges.iter().find(|r| r.range.contains(&start)).copied();
-            if selected.is_some() || style.family.is_some() || style.bold.is_some() {
-                let default_range = RangeStyle {
-                    range: start..end,
-                    family: None,
-                    resource: None,
-                    size: None,
-                    color: None,
-                    underline: None,
-                    char_spacing: None,
-                    scale: None,
-                };
-                let r = selected.unwrap_or(&default_range);
-                let mut line = lines.get(source).unwrap_or(first).clone();
-                if let Some((family, bold, italic)) =
-                    r.family.or(style.family).or_else(|| style.bold.map(|b| (source_family(&line.base_font), b, line.italic)))
-                {
-                    let base = family.base_font(bold, italic);
-                    line.font = format!("PCRange{}", base.replace('-', ""));
-                    line.base_font = base.to_owned();
-                    line.bold = bold;
-                    line.italic = italic;
-                }
-                if let Some(resource) = &r.resource {
-                    line.font = resource.clone();
-                }
-                if let Some(size) = r.size {
-                    line.size = size;
-                }
-                if let Some(color) = r.color {
-                    line.color = color;
-                    line.origin.state.fill = vec![Op::new("rg", color.map(Object::Real).to_vec())];
-                }
-                if let Some(spacing) = r.char_spacing {
-                    line.origin.state.char_spacing = spacing / line.origin.k.max(1e-6);
-                }
-                if let Some(scale) = r.scale {
-                    line.origin.state.scale = (scale / 100.0).clamp(0.1, 10.0);
-                }
-                index = styled_lines.len();
-                styled_lines.push(line);
-                if let Some(r) = selected {
-                    overrides.insert(index, r);
-                }
-                if let Some(underline) = r.underline {
-                    underlines.insert(index, underline);
-                }
-            }
-            styled_spans.push((start..end, index));
-        }
-    }
-    let lines = styled_lines.as_slice();
-    let p = page_dict(doc, page)?;
-    let mut res = p.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
-    let mut fonts = res.get(b"Font").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
-    for line in lines.iter().filter(|line| line.font.starts_with("PCRange")) {
-        let mut f = Dict::new();
-        f.set(b"Type".to_vec(), Object::name("Font"));
-        f.set(b"Subtype".to_vec(), Object::name("Type1"));
-        f.set(b"BaseFont".to_vec(), Object::name(&line.base_font));
-        f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-        fonts.set(line.font.as_bytes().to_vec(), Object::Dict(f));
-    }
-    let mut metrics = std::collections::BTreeMap::new();
-    for (name, object) in fonts.iter().take(256) {
-        if let Some(font) = doc.resolve(object).as_dict() {
-            metrics.insert(String::from_utf8_lossy(name).into_owned(), Metrics::from_dict(doc, font));
-        }
-    }
-    for index in &block.lines {
-        if let Some(line) = lines.get(*index)
-            && !metrics.contains_key(&line.font)
-            && let Some(font) = fonts.get(line.font.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned())
-        {
-            metrics.insert(line.font.clone(), Metrics::from_dict(doc, &font));
-        }
-    }
-    if [style.size, style.line_spacing, style.char_spacing, style.scale, style.width].iter().flatten().any(|v| !v.is_finite())
-        || style.color.is_some_and(|c| c.iter().any(|v| !v.is_finite()))
-    {
-        return Err(EditError::Invalid("the paragraph's formatting must use finite numbers".into()));
-    }
-    let [dx, dy] = style.offset.unwrap_or([0.0, 0.0]);
-    if !dx.is_finite() || !dy.is_finite() || style.width.is_some_and(|w| !w.is_finite()) {
-        return Err(EditError::Invalid("the paragraph's position and width must be finite".into()));
-    }
-    // A visual row grows even when it contains several source/font runs. Multi-row
-    // paragraphs retain their container width; an explicit width always wins.
-    let natural = if block.invisible || block.rows.len() == 1 {
-        (p.crop(doc)[2] - 36.0 - (block.rect[0] + dx)).max(block.rect[2] - block.rect[0])
-    } else {
-        block.rect[2] - block.rect[0]
-    };
-    let width = style.width.unwrap_or(natural).clamp(1.0, 14_400.0);
-    // Each tuple is a character, its source style and an encodable resource name.
-    let mut chars = Vec::new();
-    let mut substituted = None;
-    let mut fallback_groups: Vec<FallbackGroup> = Vec::new();
-    let mut fallback_names: std::collections::BTreeMap<(String, bool, char), usize> = std::collections::BTreeMap::new();
-    let mut fallback_glyphs = 0_usize;
-    let per_font = max_glyphs.clamp(1, MAX_TYPE3_GLYPHS);
-    let fallback_budget = per_font.saturating_mul(MAX_STYLED_FALLBACK_BATCHES);
-    let mut full_faces: HashMap<String, String> = HashMap::new();
-    let mut programs: HashMap<String, Option<std::sync::Arc<Vec<u8>>>> = HashMap::new();
-    for (range, index) in styled_spans {
-        let source = lines.get(index).unwrap_or(first);
-        let start = range.start;
-        for (offset, ch) in draft.get(range).unwrap_or_default().char_indices() {
-            if ch == '\n' {
-                chars.push((ch, index, source.font.clone()));
-                continue;
-            }
-            // A carriage return breaks the row too. Before `\n` the pair is one break, so the
-            // CR stays a `\r` the rows skip. Either way it keeps its place among the draft's
-            // characters, which rows are counted in.
-            if ch == '\r' {
-                let crlf = start.checked_add(offset).and_then(|at| draft.get(at.saturating_add(1)..)).is_some_and(|rest| rest.starts_with('\n'));
-                chars.push((if crlf { '\r' } else { '\n' }, index, source.font.clone()));
-                continue;
-            }
-            let s = ch.to_string();
-            let name = if let Some(resource) = overrides.get(&index).and_then(|r| r.resource.as_ref()).or(style.resource.as_ref()) {
-                if !metrics.get(resource).is_some_and(|m| source_encodes(m, &s)) {
-                    return Err(EditError::Invalid(format!("the selected font resource {resource} cannot show U+{:04X}", u32::from(ch))));
-                }
-                resource.clone()
-            } else if metrics.get(&source.font).is_some_and(|m| source_encodes(m, &s)) {
-                source.font.clone()
-            } else if let Some((name, _)) = metrics.iter().find(|(_, m)| {
-                pdfcraft_fonts::embedding::face_key(&m.base_font) == pdfcraft_fonts::embedding::face_key(&source.base_font) && source_encodes(m, &s)
-            }) {
-                name.clone()
-            } else if let Some(face) =
-                pdfcraft_fonts::embedding::matching_faces(&source.base_font).into_iter().find(|f| pdfcraft_fonts::embedding::covers(f.bytes, &s))
-            {
-                let key = face.name();
-                if let Some(name) = full_faces.get(&key) {
-                    name.clone()
-                } else {
-                    let name = pdfcraft_fonts::embedding::embed(doc, &mut fonts, face.bytes, face.family).map_err(EditError::Invalid)?;
-                    let font = fonts
-                        .get(name.as_bytes())
-                        .and_then(|f| doc.dict(f))
-                        .ok_or_else(|| EditError::Invalid("the full source font could not be loaded".into()))?;
-                    metrics.insert(name.clone(), Metrics::from_dict(doc, &font));
-                    full_faces.insert(key, name.clone());
-                    name
-                }
-            } else if let Some(bytes) = programs
-                .entry(source.font.clone())
-                .or_insert_with(|| source_program(doc, &fonts, &source.font).map(std::sync::Arc::new))
-                .clone()
-                .filter(|bytes| pdfcraft_fonts::embedding::covers(bytes, &s))
-            {
-                // The document's own complete program of this font has the glyph: draw it with
-                // that face rather than another family's fallback.
-                let key = format!("source {}", source.font);
-                if let Some(name) = full_faces.get(&key) {
-                    name.clone()
-                } else {
-                    let family = pdfcraft_fonts::embedding::names(&bytes).map_or_else(|_| source.base_font.clone(), |(family, _)| family);
-                    let name = pdfcraft_fonts::embedding::embed(doc, &mut fonts, &bytes, &family).map_err(EditError::Invalid)?;
-                    let font = fonts
-                        .get(name.as_bytes())
-                        .and_then(|f| doc.dict(f))
-                        .ok_or_else(|| EditError::Invalid("the source font could not be loaded".into()))?;
-                    metrics.insert(name.clone(), Metrics::from_dict(doc, &font));
-                    full_faces.insert(key, name.clone());
-                    name
-                }
-            } else {
-                let family = source_family(&source.base_font);
-                if needs_type3(&s) {
-                    let key = (source.base_font.clone(), source.bold, ch);
-                    let group_index = if let Some(index) = fallback_names.get(&key) {
-                        *index
-                    } else {
-                        // Keep the old per-character face choice: a serif Japanese character
-                        // and a Cyrillic character may need different faces even in one style.
-                        // Hebrew uses the separate RTL path before reaching this writer.
-                        let (faces, _) = type3_faces(&s, family, source.bold)?;
-                        let face =
-                            fallback_face(&faces, &[ch], |face, ch| japanese_glyph_from(face, ch).is_ok()).ok_or_else(|| no_fallback_font(&s))?;
-                        let index = fallback_groups.iter().position(|group| std::ptr::eq(group.face, face)).unwrap_or_else(|| {
-                            let index = fallback_groups.len();
-                            fallback_groups.push(FallbackGroup { face, seen: Default::default(), glyphs: Vec::new(), positions: Vec::new() });
-                            index
-                        });
-                        fallback_names.insert(key, index);
-                        index
-                    };
-                    let group = fallback_groups.get_mut(group_index).ok_or_else(|| EditError::Invalid("the fallback face is missing".into()))?;
-                    if group.seen.insert(ch) {
-                        if fallback_glyphs >= fallback_budget {
-                            return Err(EditError::Invalid(format!(
-                                "the replacement needs more than {fallback_budget} fallback glyphs; edit a smaller paragraph or load a complete font"
-                            )));
-                        }
-                        let (path, width) = type3_glyph(group.face, ch)?.ok_or_else(|| no_glyph_for(group.face, ch))?;
-                        let code = u8::try_from((group.glyphs.len() % per_font).saturating_add(1))
-                            .map_err(|_| EditError::Invalid("replacement text has too many unique characters".into()))?;
-                        group.glyphs.push(Type3Glyph { code, ch, path, width });
-                        fallback_glyphs = fallback_glyphs.saturating_add(1);
-                    }
-                    group.positions.push(chars.len());
-                    // Filled from the prepared font/code map before measuring or drawing.
-                    String::new()
-                } else {
-                    let base = family.base_font(source.bold, source.italic);
-                    let name = format!("PCEd{}", base.replace('-', ""));
-                    let mut f = Dict::new();
-                    f.set(b"Type".to_vec(), Object::name("Font"));
-                    f.set(b"Subtype".to_vec(), Object::name("Type1"));
-                    f.set(b"BaseFont".to_vec(), Object::name(base));
-                    f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-                    metrics.entry(name.clone()).or_insert_with(|| Metrics::from_dict(doc, &f));
-                    fonts.set(name.clone().into_bytes(), Object::Dict(f));
-                    substituted = Some(base.to_string());
-                    name
-                }
-            };
-            chars.push((ch, index, name));
-        }
-    }
-    // All fallback outlines have now succeeded. Batch by actual face, preserving source
-    // style indices; the existing writer then coalesces adjacent equal-font/style characters.
-    for group in fallback_groups {
-        let fallback = write_type3_glyphs(doc, &mut fonts, group.face, false, group.glyphs, per_font);
-        for name in &fallback.names {
-            let font = fonts
-                .get(name.as_bytes())
-                .and_then(|f| doc.dict(f))
-                .ok_or_else(|| EditError::Invalid("the fallback font could not be loaded".into()))?;
-            metrics.insert(name.clone(), Metrics::from_dict(doc, &font));
-        }
-        for position in group.positions {
-            let item = chars.get_mut(position).ok_or_else(|| EditError::Invalid("the fallback character is missing".into()))?;
-            let (font, _) = fallback.codes.get(&item.0).ok_or_else(|| EditError::Invalid("the fallback glyph is missing".into()))?;
-            item.2 = fallback.names.get(*font).cloned().ok_or_else(|| EditError::Invalid("the fallback font is missing".into()))?;
-        }
-        substituted = Some(fallback.family.to_owned());
-    }
-    let size_of = |source: &TextLine, index: usize| {
-        overrides.get(&index).and_then(|r| r.size).or(style.size).unwrap_or(source.size).max(0.1) / source.origin.k.max(1e-6)
-    };
-    // A source run may carry TJ kerning/justification that is absent from its text state.
-    // Keep its measured advance when rebuilding the run instead of making it wrap on entry.
-    // Each font's space width, worked out once: when a font can't show a space, finding one
-    // reads every font on the page, and doing that for every character of a paragraph made each
-    // keystroke in a long paragraph take half a second (#2616).
-    // Only for the fonts the paragraph uses, when first asked: working out every page font's width
-    // up front would scan the page once per font for a short edit on a page of many fonts.
-    let spaces: std::cell::RefCell<HashMap<String, f64>> = std::cell::RefCell::new(HashMap::new());
-    let space_of = |name: &str, m: &Metrics| {
-        if let Some(w) = spaces.borrow().get(name) {
-            return *w;
-        }
-        let w = source_space(doc, &fonts, m);
-        spaces.borrow_mut().insert(name.to_owned(), w);
-        w
-    };
-    let mut calibration = HashMap::new();
-    for (index, source) in lines.iter().enumerate() {
-        if let Some(m) = metrics.get(&source.font) {
-            let nominal = source_width(
-                m,
-                &source.text,
-                source.origin.state.font.as_ref().map_or(1.0, |(_, s)| *s),
-                space_of(&source.font, m),
-                source.origin.state.char_spacing,
-                source.origin.state.word_spacing,
-            ) * source.origin.state.scale
-                * across(source);
-            let changed_face = style.resource.is_some() || overrides.get(&index).is_some_and(|r| r.family.is_some() || r.resource.is_some());
-            let factor = if nominal > 0.0 && !changed_face { ((source.rect[2] - source.rect[0]) / nominal).clamp(0.5, 2.0) } else { 1.0 };
-            calibration.insert(index, factor);
-        }
-    }
-    let advance = |item: &(char, usize, String)| -> f64 {
-        let source = lines.get(item.1).unwrap_or(first);
-        let Some(m) = metrics.get(&item.2) else { return 0.0 };
-        source_width(
-            m,
-            &item.0.to_string(),
-            size_of(source, item.1),
-            space_of(&item.2, m),
-            overrides
-                .get(&item.1)
-                .and_then(|r| r.char_spacing)
-                .or(style.char_spacing)
-                .map_or(source.origin.state.char_spacing, |c| c / source.origin.k.max(1e-6)),
-            source.origin.state.word_spacing,
-        ) * overrides.get(&item.1).and_then(|r| r.scale).or(style.scale).map_or(source.origin.state.scale, |s| (s / 100.0).clamp(0.1, 10.0))
-            * across(source)
-            * calibration.get(&item.1).copied().unwrap_or(1.0)
-    };
-    let measure = |items: &[(char, usize, String)]| -> Result<f64, EditError> {
-        let mut width = 0.0;
-        let mut at = 0;
-        while let Some(item) = items.get(at) {
-            let mut end = at + 1;
-            while items.get(end).is_some_and(|v| v.1 == item.1 && v.2 == item.2) {
-                end += 1;
-            }
-            let segment = items.get(at..end).unwrap_or_default();
-            let string: String = segment.iter().map(|v| v.0).collect();
-            if let Some((_, shaped, _)) = shape_source(doc, &fonts, &item.2, &string)? {
-                let source = lines.get(item.1).unwrap_or(first);
-                let scale =
-                    overrides.get(&item.1).and_then(|r| r.scale).or(style.scale).map_or(source.origin.state.scale, |s| (s / 100.0).clamp(0.1, 10.0));
-                let spacing = overrides
-                    .get(&item.1)
-                    .and_then(|r| r.char_spacing)
-                    .or(style.char_spacing)
-                    .map_or(source.origin.state.char_spacing, |s| s / source.origin.k.max(1e-6));
-                width += (shaped.advance * size_of(source, item.1)
-                    + spacing * string.chars().count() as f64
-                    + source.origin.state.word_spacing * string.matches(' ').count() as f64)
-                    * scale
-                    * source.origin.k;
-            } else {
-                width += segment.iter().map(&advance).sum::<f64>();
-            }
-            at = end;
-        }
-        Ok(width)
-    };
-    let mut rows: Vec<Vec<(char, usize, String)>> = Vec::new();
-    // Each row's characters, as indexes into the draft's characters (`chars` holds all of them).
-    let mut row_ranges = Vec::new();
-    let mut row_start = 0;
-    let mut row = Vec::new();
-    let mut row_width = 0.0;
-    // Wrap at word boundaries, retaining explicit source row breaks and whitespace.
-    let mut at = 0;
-    while at < chars.len() {
-        let Some(item) = chars.get(at) else { break };
-        // The CR of a CRLF: the `\n` after it breaks the row.
-        if item.0 == '\r' {
-            at += 1;
-            continue;
-        }
-        if item.0 == '\n' {
-            row_ranges.push(row_start..row_start + row.len());
-            rows.push(std::mem::take(&mut row));
-            row_width = 0.0;
-            at += 1;
-            row_start = at;
-            continue;
-        }
-        let mut end = at + 1;
-        if !item.0.is_whitespace() {
-            // A word ends at a space, or where Chinese or Japanese text may break between characters.
-            while let (Some(before), Some(c)) = (chars.get(end - 1), chars.get(end))
-                && !c.0.is_whitespace()
-                && !crate::linebreak::between(before.0, c.0)
-            {
-                end += 1;
-            }
-        }
-        let word = chars.get(at..end).unwrap_or_default();
-        let w = measure(word)?;
-        if !row.is_empty() && !item.0.is_whitespace() && row_width + w > width + 0.5 {
-            while row.last().is_some_and(|c: &(char, usize, String)| c.0.is_whitespace()) {
-                row.pop();
-            }
-            row_ranges.push(row_start..row_start + row.len());
-            rows.push(std::mem::take(&mut row));
-            row_width = 0.0;
-            row_start = at;
-        }
-        row.extend_from_slice(word);
-        row_width += w;
-        at = end;
-    }
-    if !row.is_empty() {
-        row_ranges.push(row_start..row_start + row.len());
-        rows.push(row);
-    }
-    let streams = content_streams(doc, &p.dict)?;
-    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
-    let ops = pieces.parse().ops;
-    // A row the edit doesn't reach keeps its source operators, so its kerning, TJ word gaps and
-    // glyph widths stay exactly as they were instead of being rebuilt from the text state.
-    let plain = BlockStyle { ranges: Vec::new(), ..style.clone() } == BlockStyle::default();
-    let mut kept = if plain {
-        untouched_rows(block, draft, &row_ranges).into_iter().zip(&rows).map(|(same, row)| same && row.iter().all(|c| c.1 < source_count)).collect()
-    } else {
-        vec![false; rows.len()]
-    };
-    let kept_lines: std::collections::HashSet<usize> =
-        kept.iter().enumerate().filter(|(_, k)| **k).filter_map(|(r, _)| block.rows.get(r)).flatten().copied().collect();
-    let rewritten: Vec<&TextLine> = block.lines.iter().filter(|i| !kept_lines.contains(i)).filter_map(|i| lines.get(*i)).collect();
-    // The rewrite goes where the last rewritten row was drawn, after any backgrounds painted
-    // between the rows. A dropped `'` or `"` also moved to the next line, which a kept row relies on.
-    let lead =
-        rewritten.last().copied().filter(|_| !rewritten.iter().flat_map(|l| &l.ops).any(|i| ops.get(*i).is_some_and(|op| op.is("'") || op.is("\""))));
-    let (members, lead) = match lead {
-        Some(lead) if !kept_lines.is_empty() => (rewritten, lead),
-        _ => {
-            kept.iter_mut().for_each(|k| *k = false);
-            let all: Vec<&TextLine> = block.lines.iter().filter_map(|i| lines.get(*i)).collect();
-            let last = all.last().copied().unwrap_or(first);
-            (all, last)
-        }
-    };
-    let o = &lead.origin;
-    let mut drop = coincident_ops(lines, &members);
-    drop.extend(members.iter().flat_map(|l| l.ops.iter().copied()));
-    let start = lead.ops.first().copied().unwrap_or(o.bt_op);
-    let split = ops
-        .get(o.bt_op..start)
-        .unwrap_or_default()
-        .iter()
-        .enumerate()
-        .any(|(i, op)| matches!(op.op.as_slice(), b"Tj" | b"TJ" | b"'" | b"\"") && !drop.contains(&(o.bt_op + i)));
-    // What is in force where the rewrite is drawn, and what the text after it expects.
-    let after = if split { &o.state } else { &o.bt_state };
-    for (row, _) in rows.iter().zip(&kept).filter(|(_, k)| !**k) {
-        let text: String = row.iter().map(|v| v.0).collect();
-        if pdfcraft_fonts::source_shaping::required(&text) && row.first().is_some_and(|first| row.iter().any(|v| v.1 != first.1 || v.2 != first.2)) {
-            return Err(EditError::Invalid(
-                "contextual/bidi text across font or style boundaries needs a uniform full-face row; mixed contextual runs are not yet supported"
-                    .into(),
-            ));
-        }
-    }
-    let measured: Vec<_> = rows.iter().map(|r| measure(r)).collect::<Result<_, _>>()?;
-    let mut shaped_runs = HashMap::new();
-    let mut segment_advances = HashMap::new();
-    for (row_index, row) in rows.iter().enumerate().filter(|(r, _)| !kept.get(*r).copied().unwrap_or(false)) {
-        let mut at = 0;
-        while let Some(item) = row.get(at) {
-            let mut end = at + 1;
-            while row.get(end).is_some_and(|v| v.1 == item.1 && v.2 == item.2) {
-                end += 1;
-            }
-            segment_advances.insert((row_index, at), row.get(at..end).unwrap_or_default().iter().map(&advance).sum::<f64>());
-            let string: String = row.get(at..end).unwrap_or_default().iter().map(|v| v.0).collect();
-            if let Some((bytes, shaped, family)) = shape_source(doc, &fonts, &item.2, &string)? {
-                shaped_runs.insert((row_index, at), (bytes, shaped, family));
-            }
-            at = end;
-        }
-    }
-    let mut glyph_resources = HashMap::new();
-    for (key, (bytes, shaped, family)) in &shaped_runs {
-        let mappings: Vec<_> = shaped.glyphs.iter().map(|g| (g.text.clone(), g.id)).collect();
-        let resource = pdfcraft_fonts::embedding::embed_mapping(doc, &mut fonts, bytes, family, &mappings).map_err(EditError::Invalid)?;
-        glyph_resources.insert(*key, resource);
-    }
-    let n = pdfcraft_content::num;
-    let mut block_ops = vec![Op::new("q", vec![])];
-    block_ops.extend(reveal_ops(block, lines, style, o.ctm)?);
-    let back = Matrix([o.ctm[0], o.ctm[1], o.ctm[2], o.ctm[3], 0.0, 0.0])
-        .invert()
-        .ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it cannot be edited in".into()))?;
-    let (tx, ty) = back.apply(dx, dy);
-    block_ops.push(Op::new("cm", vec![n(1.0), n(0.0), n(0.0), n(1.0), n(tx), n(ty)]));
-    let crop = p.crop(doc);
-    let centered = is_centred(block, lines, (crop[0] + crop[2]) / 2.0, first.size);
-    let source_leading = block
-        .rows
-        .windows(2)
-        .filter_map(|rows| {
-            let a = rows[0].first().and_then(|i| lines.get(*i))?;
-            let b = rows[1].first().and_then(|i| lines.get(*i))?;
-            Some((a.origin.baseline - b.origin.baseline).abs())
-        })
-        .rfind(|v| *v > 0.0)
-        .unwrap_or(first.size * 1.5);
-    let mut baseline = first.origin.baseline;
-    for (row_index, row) in rows.iter().enumerate() {
-        let anchor = block.rows.get(row_index).and_then(|r| r.first()).and_then(|i| lines.get(*i));
-        if style.line_spacing.is_none()
-            && style.size.is_none()
-            && let Some(anchor) = anchor
-        {
-            baseline = anchor.origin.baseline;
-        }
-        let anchor = anchor.unwrap_or(first);
-        if kept.get(row_index).copied().unwrap_or(false) {
-            // Kept rows only occur without spacing or size changes, so this is the step below.
-            baseline -= source_leading;
-            continue;
-        }
-        let w = measured.get(row_index).copied().unwrap_or(0.0);
-        let align = style.align.unwrap_or(if centered { crate::added::Align::Center } else { crate::added::Align::Left });
-        let original_rect = block.rows.get(row_index).and_then(|row| row_rect(row, lines)).unwrap_or(block.rect);
-        let left = if style.width.is_none() && style.align.is_none() { original_rect[0] } else { block.rect[0] };
-        let available = if style.width.is_none() && style.align.is_none() { original_rect[2] - original_rect[0] } else { width };
-        let mut x = left
-            + match align {
-                crate::added::Align::Center => (available - w) / 2.0,
-                crate::added::Align::Right => available - w,
-                _ => 0.0,
-            };
-        let mut pos = 0;
-        while pos < row.len() {
-            let Some(item) = row.get(pos) else { break };
-            let source = lines.get(item.1).unwrap_or(first);
-            let mut end = pos + 1;
-            while row.get(end).is_some_and(|other| other.1 == item.1 && other.2 == item.2) {
-                end += 1;
-            }
-            let segment = row.get(pos..end).unwrap_or_default();
-            let string: String = segment.iter().map(|c| c.0).collect();
-            let m = metrics.get(&item.2).ok_or_else(|| EditError::Invalid("the paragraph font is missing".into()))?;
-            let mut state = source.origin.state.clone();
-            state.font = Some((item.2.clone(), size_of(source, item.1)));
-            if let Some(c) = overrides.get(&item.1).and_then(|r| r.char_spacing).or(style.char_spacing) {
-                state.char_spacing = c / source.origin.k.max(1e-6);
-            }
-            if let Some(s) = overrides.get(&item.1).and_then(|r| r.scale).or(style.scale) {
-                state.scale = (s / 100.0).clamp(0.1, 10.0);
-            }
-            if !shaped_runs.contains_key(&(row_index, pos)) {
-                state.scale *= calibration.get(&item.1).copied().unwrap_or(1.0);
-            }
-            if let Some([r, g, b]) = overrides.get(&item.1).and_then(|r| r.color).or(style.color) {
-                state.fill = vec![Op::new("rg", vec![n(r), n(g), n(b)])];
-            }
-            let inverse = Matrix(o.ctm).invert().ok_or_else(|| EditError::Invalid("the paragraph has a singular transform".into()))?;
-            let mut tm = Matrix(source.origin.tm).then(&Matrix(source.origin.ctm)).then(&inverse).0;
-            let (ax, ay) = back.apply(x - source.origin.x, baseline - source.origin.baseline);
-            tm[4] += ax;
-            tm[5] += ay;
-            let mut segment_width = segment_advances.get(&(row_index, pos)).copied().unwrap_or(0.0);
-            // Each run in its own graphics state, restating what its source set inside its text
-            // object (`gs`, stroke, line width, `Tr`; #3508/#3509) from the state the rewrite is
-            // drawn in: a `gs` has no inverse, so one run's ExtGState would stay for the next.
-            block_ops.push(Op::new("q", vec![]));
-            block_ops.extend(state.paint_ops(after));
-            if let Some((_, shaped, _)) = shaped_runs.get(&(row_index, pos)) {
-                let resource = glyph_resources.get(&(row_index, pos)).ok_or_else(|| EditError::Invalid("shaped font is missing".into()))?;
-                let mut properties = Dict::new();
-                properties.set(b"ActualText".to_vec(), Object::String(PdfString::text(&string)));
-                block_ops.push(Op::new("BDC", vec![Object::name("Span"), Object::Dict(properties)]));
-                state.font = Some((resource.clone(), size_of(source, item.1)));
-                // One text object for the run: each glyph is placed where shaping put it by a TJ
-                // adjustment from where the glyph before it ends (its advance in the embedded
-                // font's widths), and raised by the text rise for a mark set above or below
-                // (ISO 32000-1 §9.4.3, §9.3.7). Font-program codes are separate from Unicode;
-                // ToUnicode and ActualText keep the logical text.
-                let size = size_of(source, item.1);
-                let per_unit = 1000.0 / size;
-                if !per_unit.is_finite() {
-                    return Err(EditError::Invalid("the shaped text has no size".into()));
-                }
-                let shown = fonts
-                    .get(resource.as_bytes())
-                    .and_then(|f| doc.resolve(f).as_dict().cloned())
-                    .map(|d| Metrics::from_dict(doc, &d))
-                    .ok_or_else(|| EditError::Invalid("shaped font is missing".into()))?;
-                // Spacing is part of each glyph's position, so the run itself has none.
-                let (char_spacing, word_spacing, rise) = (state.char_spacing, state.word_spacing, state.rise);
-                state.char_spacing = 0.0;
-                state.word_spacing = 0.0;
-                block_ops.push(Op::new("BT", vec![]));
-                block_ops.extend(state.ops());
-                block_ops.push(Op::new("Tm", tm.iter().map(|v| n(*v)).collect()));
-                // `pen`: where the next glyph would start, in thousandths of the font size.
-                let (mut pen, mut extra, mut raised) = (0.0, 0.0, rise);
-                let mut shown_glyphs: Vec<Object> = Vec::new();
-                for (i, glyph) in shaped.glyphs.iter().enumerate() {
-                    let target = (glyph.position[0] * size + extra) * per_unit;
-                    let glyph_rise = rise + glyph.position[1] * size;
-                    if (glyph_rise - raised).abs() > 1e-9 || shown_glyphs.len() >= 4096 {
-                        if !shown_glyphs.is_empty() {
-                            block_ops.push(Op::new("TJ", vec![Object::Array(std::mem::take(&mut shown_glyphs))]));
-                        }
-                        if (glyph_rise - raised).abs() > 1e-9 {
-                            block_ops.push(Op::new("Ts", vec![n(glyph_rise)]));
-                            raised = glyph_rise;
-                        }
-                    }
-                    if (target - pen).abs() > 1e-6 {
-                        shown_glyphs.push(n(pen - target));
-                    }
-                    let code = u16::try_from(i + 1).map_err(|_| EditError::Invalid("shaped glyph limit".into()))?;
-                    shown_glyphs.push(Object::String(PdfString::literal(code.to_be_bytes().to_vec())));
-                    pen = target + shown.width(u32::from(code)) * 1000.0;
-                    extra += char_spacing * glyph.text.chars().count() as f64 + word_spacing * glyph.text.matches(' ').count() as f64;
-                }
-                if !shown_glyphs.is_empty() {
-                    block_ops.push(Op::new("TJ", vec![Object::Array(shown_glyphs)]));
-                }
-                if (raised - rise).abs() > 1e-9 {
-                    block_ops.push(Op::new("Ts", vec![n(rise)]));
-                }
-                block_ops.push(Op::new("ET", vec![]));
-                (state.char_spacing, state.word_spacing) = (char_spacing, word_spacing);
-                block_ops.push(Op::new("EMC", vec![]));
-                segment_width = (shaped.advance * size + extra) * state.scale * source.origin.k;
-            } else {
-                block_ops.push(Op::new("BT", vec![]));
-                block_ops.extend(state.ops());
-                block_ops.push(Op::new("Tm", tm.iter().map(|v| n(*v)).collect()));
-                block_ops.extend(source_show(
-                    m,
-                    &string,
-                    size_of(source, item.1),
-                    spaces.borrow().get(&item.2).copied().unwrap_or_else(|| source_space(doc, &fonts, m)),
-                    state.char_spacing,
-                    state.word_spacing,
-                )?);
-                block_ops.push(Op::new("ET", vec![]));
-            }
-            if underlines.get(&item.1).copied().or(style.underline) == Some(true) {
-                let [r, g, b] = overrides.get(&item.1).and_then(|r| r.color).or(style.color).unwrap_or(source.color);
-                let underline_size = size_of(source, item.1) * source.origin.k;
-                let (x0, y0) = back.apply(x - o.ctm[4], baseline - o.ctm[5] - underline_size * 0.12);
-                let (x1, y1) = back.apply(x + segment_width - o.ctm[4], baseline - o.ctm[5] - underline_size * 0.12);
-                block_ops.push(Op::new("RG", vec![n(r), n(g), n(b)]));
-                block_ops.push(Op::new("w", vec![n(underline_size * 0.06 / o.ctm[2].hypot(o.ctm[3]).max(1e-6))]));
-                block_ops.push(Op::new("m", vec![n(x0), n(y0)]));
-                block_ops.push(Op::new("l", vec![n(x1), n(y1)]));
-                block_ops.push(Op::new("S", vec![]));
-            }
-            block_ops.push(Op::new("Q", vec![]));
-            x += segment_width;
-            pos = end;
-        }
-        baseline -= if style.line_spacing.is_none() && style.size.is_none() {
-            source_leading
-        } else {
-            style.line_spacing.unwrap_or(1.5).clamp(0.5, 5.0) * style.size.unwrap_or(anchor.size)
-        };
-    }
-    block_ops.push(Op::new("Q", vec![]));
-    block_ops.extend(after.ops());
-    if split {
-        block_ops.insert(0, Op::new("ET", vec![]));
-        block_ops.push(Op::new("BT", vec![]));
-        block_ops.push(Op::new("Tm", o.tlm.iter().map(|v| n(*v)).collect()));
-    }
-    let at = if split { start } else { o.bt_op };
-    let data = splice(&pieces, &ops, |i| (if i == at { std::mem::take(&mut block_ops) } else { Vec::new() }, !drop.contains(&i)));
-    let contents = rewritten_contents(doc, &streams, data);
-    res.set(b"Font".to_vec(), Object::Dict(fonts));
-    doc.update_dict(p.obj, |d| {
-        d.set(b"Contents".to_vec(), contents);
-        d.set(b"Resources".to_vec(), Object::Dict(res));
-    })?;
-    Ok(LineEdit { substituted })
-}
+pub(super) use grouping::{group_blocks, group_reading_blocks, is_centred};
+pub(super) use styled::rewrite_styled_block;
diff --git a/crates/edit/src/text_regions/grouping.rs b/crates/edit/src/text_regions/grouping.rs
new file mode 100644
index 0000000000..29004b8e33
--- /dev/null
+++ b/crates/edit/src/text_regions/grouping.rs
@@ -0,0 +1,319 @@
+use super::*;
+
+fn same_plane(a: &TextLine, b: &TextLine) -> bool {
+    let at = Matrix(a.origin.tm).then(&Matrix(a.origin.ctm));
+    let bt = Matrix(b.origin.tm).then(&Matrix(b.origin.ctm));
+    a.scope == b.scope
+        && a.paint == b.paint
+        && [0, 2].iter().all(|axis| {
+            let ax = at.0.get(*axis).copied().unwrap_or(0.0);
+            let ay = at.0.get(axis + 1).copied().unwrap_or(0.0);
+            let bx = bt.0.get(*axis).copied().unwrap_or(0.0);
+            let by = bt.0.get(axis + 1).copied().unwrap_or(0.0);
+            let al = ax.hypot(ay);
+            let bl = bx.hypot(by);
+            al > 0.0 && bl > 0.0 && (ax / al - bx / bl).abs() < 0.001 && (ay / al - by / bl).abs() < 0.001
+        })
+}
+
+pub(super) fn row_rect(row: &[usize], lines: &[TextLine]) -> Option<[f64; 4]> {
+    row.iter().filter_map(|i| lines.get(*i)).map(|l| l.rect).reduce(union)
+}
+
+/// [`row_rect`] in its text's own frame ([`TextLine::frame_rect`]), so rows of turned text
+/// compare along and across their baselines.
+fn frame_row_rect(row: &[usize], lines: &[TextLine]) -> Option<[f64; 4]> {
+    row.iter().filter_map(|i| lines.get(*i)).map(TextLine::frame_rect).reduce(union)
+}
+
+/// The left edge the rest of the page's text sits on, ignoring the rows of `block`. A single row
+/// that does not share it is not merely an indented or full-width left-aligned line, so its own
+/// centre is the only remaining explanation for where it sits.
+fn neighbour_left(lines: &[TextLine], block: &TextBlock) -> Option<f64> {
+    let mut edges: HashMap<i64, usize> = HashMap::new();
+    for (i, line) in lines.iter().enumerate() {
+        if block.lines.contains(&i) {
+            continue;
+        }
+        // Quarter-point buckets: equal edges found through different runs still agree.
+        *edges.entry((line.rect[0] * 4.0).round() as i64).or_insert(0) += 1;
+    }
+    let (best, _) = edges.into_iter().max_by_key(|(_, count)| *count)?;
+    Some(best as f64 / 4.0)
+}
+
+/// Whether a block reads as centred, and so must keep its centre when it grows or wraps.
+///
+/// Several ragged rows whose left edges disagree while their centres agree are centred. A one row
+/// block cannot say that: all of its left edges are the same, so the ragged test never fires and a
+/// centred title would be taken for left-aligned and grow to the right (#2581). Fall back to the
+/// page instead — a lone row sitting on the page's own centre, and not on the edge the rest of the
+/// text uses, is a centred title. A full-width left-aligned line still lines up with that edge, so
+/// it is not mistaken for one.
+pub(crate) fn is_centred(block: &TextBlock, lines: &[TextLine], page_centre: f64, size: f64) -> bool {
+    let centre = (block.rect[0] + block.rect[2]) / 2.0;
+    let lefts: Vec<_> = block.rows.iter().filter_map(|r| row_rect(r, lines).map(|r| r[0])).collect();
+    if block.rows.len() > 1 {
+        let left_span = lefts.iter().copied().fold(f64::NEG_INFINITY, f64::max) - lefts.iter().copied().fold(f64::INFINITY, f64::min);
+        return left_span > size * 0.5
+            && block.rows.iter().all(|row| row_rect(row, lines).is_some_and(|r| ((r[0] + r[2]) / 2.0 - centre).abs() < size));
+    }
+    lefts
+        .first()
+        .is_some_and(|left| (centre - page_centre).abs() < size && neighbour_left(lines, block).is_none_or(|edge| (*left - edge).abs() > size * 0.5))
+}
+
+pub(crate) fn group_blocks(lines: &[TextLine]) -> Vec<TextBlock> {
+    group_layout(lines, true)
+}
+
+/// Exporters currently represent a block with one style. Keep their style boundaries until
+/// they support rich runs, while edit selection may encompass the complete visual region.
+/// Dotted-leader entries stay on one row and use the title run's style.
+pub(crate) fn group_reading_blocks(lines: &[TextLine]) -> Vec<TextBlock> {
+    let mut blocks = Vec::new();
+    let mut start = 0;
+    let mut offset = 0;
+    for row in lines.chunk_by(|a, b| same_plane(a, b) && (a.origin.baseline - b.origin.baseline).abs() < a.size.min(b.size) * 0.2) {
+        let mut text = String::new();
+        for (i, line) in row.iter().enumerate() {
+            if !text.ends_with(char::is_whitespace)
+                && !line.text.starts_with(char::is_whitespace)
+                && i.checked_sub(1).and_then(|i| row.get(i)).is_some_and(|prev| line.rect[0] - prev.rect[2] > line.size * 0.12)
+            {
+                text.push(' ');
+            }
+            text.push_str(&line.text);
+        }
+        if leader_entry(&text)
+            && let Some(first) = row.first()
+        {
+            // Tab leaders are a single reading row, even when the title, dots and page
+            // number are separate text objects far apart. Do not merge neighbouring entries.
+            blocks.extend(group_layout(lines.get(start..offset).unwrap_or_default(), false));
+            let mut line = first.clone();
+            line.text = text;
+            line.rect = row.iter().map(|line| line.rect).reduce(union).unwrap_or(first.rect);
+            blocks.extend(group_layout(std::slice::from_ref(&line), false));
+            start = offset + row.len();
+        }
+        offset += row.len();
+    }
+    blocks.extend(group_layout(lines.get(start..).unwrap_or_default(), false));
+    blocks
+}
+
+/// Dotted leaders end in a page number, with a title before the dots. A dot in an article
+/// number, or an ellipsis in ordinary prose, is not enough to make a contents entry.
+fn leader_entry(text: &str) -> bool {
+    let text = text.trim_end();
+    let prefix = text.trim_end_matches(|c: char| {
+        c.is_ascii_digit() || matches!(c, 'i' | 'v' | 'x' | 'l' | 'c' | 'd' | 'm' | 'I' | 'V' | 'X' | 'L' | 'C' | 'D' | 'M')
+    });
+    if prefix.len() == text.len() {
+        return false;
+    }
+    let title = prefix.trim_end_matches(|c: char| c.is_whitespace() || matches!(c, '.' | '…'));
+    let dots = prefix
+        .get(title.len()..)
+        .unwrap_or_default()
+        .chars()
+        .map(|c| match c {
+            '.' => 1,
+            '…' => 3,
+            _ => 0,
+        })
+        .sum::<usize>();
+    dots >= 3 && title.chars().any(char::is_alphabetic)
+}
+
+/// Text-space units → user space along the baseline. It is the vertical scale ([`Origin::k`])
+/// unless the text matrix stretches the glyphs, as an OCR layer fitting each word to the scan does.
+pub(super) fn across(line: &TextLine) -> f64 {
+    let m = Matrix(line.origin.tm).then(&Matrix(line.origin.ctm)).0;
+    let h = m[0].hypot(m[1]);
+    if h.is_finite() && h > 1e-9 { h } else { line.origin.k }
+}
+
+/// Invisible text (rendering mode 3), as in an OCR layer over a scanned image.
+fn invisible(line: &TextLine) -> bool {
+    line.origin.state.render_mode == 3
+}
+
+fn same_style(a: &TextLine, b: &TextLine) -> bool {
+    same_font(a, b.font.as_bytes(), &b.base_font, b.face.as_deref())
+        // With no `/BaseFont` (or only a subset tag) there is no name to compare: the resource or
+        // fallback face `same_font` matched is the whole identity, so keep the lines together.
+        && (same_base_font(&a.base_font, &b.base_font)
+            || (strip_subset_tag(&a.base_font).is_empty() && strip_subset_tag(&b.base_font).is_empty()))
+        && a.bold == b.bold
+        && a.italic == b.italic
+        && a.color == b.color
+        && (a.rotation() - b.rotation()).abs() < 0.01
+        && (a.size - b.size).abs() < 0.01
+}
+
+/// Does a row open with a list marker? A bullet or a dash, or an ordered marker — digits (or a
+/// single letter) followed by `.` or `)` and then a space or the row's end, so prose such as
+/// `1.5` or `Dr. Smith` is left alone.
+fn opens_with_marker(text: &str) -> bool {
+    let Some(first) = text.chars().next() else { return false };
+    if matches!(first, '•' | '◦' | '▪' | '‣' | '⁃' | '*' | '-' | '–' | '—') {
+        return true;
+    }
+    if !first.is_ascii_digit() && !first.is_ascii_alphabetic() {
+        return false;
+    }
+    let digits = text.chars().take_while(char::is_ascii_digit).count();
+    let letters = text.chars().take_while(char::is_ascii_alphabetic).count();
+    // Both runs are ASCII characters, so their length in characters is their length in bytes:
+    // the slice below starts on a character boundary.
+    let rest = if digits > 0 {
+        &text[digits..]
+    } else if letters == 1 {
+        &text[1..]
+    } else {
+        return false;
+    };
+    let mut after = rest.chars();
+    matches!(after.next(), Some('.' | ')')) && after.next().is_none_or(char::is_whitespace)
+}
+
+/// A row that opens with a list marker opens its own item: joining it to the row above is what
+/// let an edit of one paragraph delete every item after it (#2564). The other error, splitting
+/// an ordinary paragraph, costs one more paragraph to click and never any text — so err this way.
+fn starts_list_item(row: &[usize], lines: &[TextLine]) -> bool {
+    row.iter().filter_map(|i| lines.get(*i)).map(|l| l.text.trim_start()).find(|t| !t.is_empty()).is_some_and(opens_with_marker)
+}
+
+fn group_layout(lines: &[TextLine], mixed: bool) -> Vec<TextBlock> {
+    let mut rows: Vec<Vec<usize>> = Vec::new();
+    for (i, line) in lines.iter().enumerate() {
+        let joins = rows.last().and_then(|r| r.last()).and_then(|i| lines.get(*i)).is_some_and(|prev| {
+            let gap = line.frame_rect()[0] - prev.frame_rect()[2];
+            // OCR words (invisible text over a scan) join only across a word space: a wider gap
+            // is a table cell or a tab stop, which a rewrite would close up.
+            let scanned = !mixed || (invisible(prev) == invisible(line) && (!invisible(line) || gap < prev.size.max(line.size) * 0.6));
+            scanned
+                && (mixed || same_style(prev, line))
+                && same_plane(prev, line)
+                // A superscript or subscript run (a footnote marker, say) sits on the same visual
+                // row as the text around it, raised or lowered by `Ts` from the body baseline
+                // (#3252). That shift is typically up to half the body size, not the marker's own
+                // smaller size — but the wider tolerance only applies between a run and a
+                // distinctly smaller or larger one, with no horizontal overlap (`gap >= 0.0`):
+                // two equal-size runs can land within it too, at a baseline shift tight columns
+                // or compressed text (`Tz`) can produce between genuinely separate rows, and the
+                // original 20% tolerance is what keeps those apart.
+                && ((prev.frame_origin().1 - line.frame_origin().1).abs() < prev.size.min(line.size) * 0.2
+                    || (gap >= 0.0
+                        && prev.size.min(line.size) < prev.size.max(line.size) * 0.9
+                        && (prev.frame_origin().1 - line.frame_origin().1).abs() < prev.size.max(line.size) * 0.5))
+                && gap >= -prev.size.min(line.size) * 0.2
+                && gap < prev.size.max(line.size) * 1.5
+                // Separate same-style text objects that merely touch or overlap, with no space
+                // between them, are separate labels (for example a paragraph dragged against
+                // another, #594). Style runs and words separated by a space or gap still join.
+                && (prev.origin.bt_op == line.origin.bt_op
+                    || gap > prev.size.min(line.size) * 0.01
+                    || !same_style(prev, line)
+                    || prev.text.ends_with(char::is_whitespace)
+                    || line.text.starts_with(char::is_whitespace))
+        });
+        if joins && let Some(row) = rows.last_mut() {
+            row.push(i);
+        } else {
+            rows.push(vec![i]);
+        }
+    }
+    let mut blocks: Vec<TextBlock> = Vec::new();
+    for row in rows {
+        let Some(first) = row.first().and_then(|i| lines.get(*i)) else { continue };
+        let (Some(rect), Some(frame)) = (row_rect(&row, lines), frame_row_rect(&row, lines)) else { continue };
+        let joins = blocks.last().is_some_and(|block| {
+            // A bullet of its own opens a list item (#2564): such a row is a new paragraph, and
+            // letting it join is what made an edit of the row above delete this item and the ones
+            // after it.
+            if starts_list_item(&row, lines) {
+                return false;
+            }
+            let Some(prev_row) = block.rows.last() else { return false };
+            let Some(prev) = prev_row.first().and_then(|i| lines.get(*i)) else { return false };
+            let Some(pr) = frame_row_rect(prev_row, lines) else { return false };
+            let gap = prev.frame_origin().1 - first.frame_origin().1;
+            let tol = prev.size.max(first.size).max(1.0);
+            // The block opens with a list marker and this row sits further right: the item's text
+            // is at a hanging indent, so the row it wrapped onto continues it (#2564). A row at
+            // the block's own left edge is already covered by the match on `pr[0]`. Both boxes are
+            // in the frame, as the rest of this comparison is, so turned text matches too.
+            let hanging = frame[0] > pr[0]
+                && frame[0] - pr[0] <= tol * 3.0
+                && block.lines.first().and_then(|&i| lines.get(i)).is_some_and(|l| opens_with_marker(l.text.trim_start()));
+            let aligned = (pr[0] - frame[0]).abs() < tol
+                || ((pr[0] + pr[2] - frame[0] - frame[2]) / 2.0).abs() < tol
+                || (pr[2] - frame[2]).abs() < tol
+                || hanging;
+            // OCR lines stay apart: the scan fixes where each one is, so they never rewrap together.
+            (!mixed || !(invisible(prev) || invisible(first)))
+                && (mixed || same_style(prev, first))
+                && same_plane(prev, first)
+                // The rewrite sets every row in the first one's horizontal scale.
+                && (prev.origin.state.scale - first.origin.state.scale).abs() < 1e-6
+                && aligned
+                && first.size.min(prev.size) >= first.size.max(prev.size) * 0.4
+                && gap > first.size.min(prev.size) * 0.8
+                && gap < first.size.max(prev.size) * 2.5
+        });
+        if !joins {
+            blocks.push(TextBlock {
+                text: String::new(),
+                editor_text: String::new(),
+                spans: Vec::new(),
+                rect,
+                base_font: first.base_font.clone(),
+                size: first.size,
+                bold: first.bold,
+                italic: first.italic,
+                color: first.color,
+                rotation: first.rotation(),
+                lines: Vec::new(),
+                rows: Vec::new(),
+                invisible: true,
+            });
+        }
+        let Some(block) = blocks.last_mut() else { continue };
+        let mut row_text = String::new();
+        if !block.rows.is_empty() {
+            block.editor_text.push('\n');
+        }
+        for &index in &row {
+            let Some(line) = lines.get(index) else { continue };
+            // Some producers position separate words without encoding a space.
+            if let Some(prev) = block.lines.last().filter(|i| row.contains(i)).and_then(|i| lines.get(*i))
+                && !row_text.ends_with(char::is_whitespace)
+                && !line.text.starts_with(char::is_whitespace)
+                && line.frame_rect()[0] - prev.frame_rect()[2] > line.size * 0.12
+            {
+                row_text.push(' ');
+                block.editor_text.push(' ');
+            }
+            let start = block.editor_text.len();
+            block.editor_text.push_str(&line.text);
+            block.spans.push((start..block.editor_text.len(), index));
+            row_text.push_str(&line.text);
+            block.invisible &= line.origin.state.render_mode == 3;
+            block.lines.push(index);
+        }
+        if !block.text.is_empty() {
+            if block.text.ends_with('-') {
+                block.text.pop();
+            } else {
+                block.text.push(' ');
+            }
+        }
+        block.text.push_str(row_text.trim_matches(paragraph_separator));
+        block.rect = union(block.rect, rect);
+        block.rows.push(row);
+    }
+    blocks
+}
diff --git a/crates/edit/src/text_regions/styled.rs b/crates/edit/src/text_regions/styled.rs
new file mode 100644
index 0000000000..09baf1ac7e
--- /dev/null
+++ b/crates/edit/src/text_regions/styled.rs
@@ -0,0 +1,787 @@
+use super::grouping::{across, is_centred, row_rect};
+use super::*;
+
+// The draft is capped at 4 MiB; also bound the outline data prepared across all fallback faces.
+// A glyph budget worth 64 full batches (15,360 glyphs with the production batch size).
+// Lowering the internal batch size for tests lowers the budget by the same ratio.
+const MAX_STYLED_FALLBACK_BATCHES: usize = 64;
+
+struct FallbackGroup {
+    face: &'static CraftFont,
+    seen: std::collections::HashSet<char>,
+    glyphs: Vec<Type3Glyph>,
+    positions: Vec<usize>,
+}
+
+/// Shape in the source or an explicitly registered matching full face. Never use interface fonts.
+fn shape_source(
+    doc: &Document,
+    fonts: &Dict,
+    name: &str,
+    text: &str,
+) -> Result<Option<(Vec<u8>, pdfcraft_fonts::source_shaping::ShapedRun, String)>, EditError> {
+    if !pdfcraft_fonts::source_shaping::required(text) {
+        return Ok(None);
+    }
+    let source =
+        fonts.get(name.as_bytes()).and_then(|f| doc.dict(f)).ok_or_else(|| EditError::Invalid("the shaped text has no font resource".into()))?;
+    let family = Metrics::from_dict(doc, &source).base_font;
+    let mut candidates = vec![source];
+    candidates.extend(
+        fonts
+            .iter()
+            .filter_map(|(_, f)| doc.dict(f))
+            .filter(|f| pdfcraft_fonts::embedding::face_key(&Metrics::from_dict(doc, f).base_font) == pdfcraft_fonts::embedding::face_key(&family)),
+    );
+    for font in candidates {
+        if let Some(bytes) = pdfcraft_fonts::pdf::embedded_sfnt(doc, &font)
+            && pdfcraft_fonts::embedding::covers(&bytes, text)
+            && let Ok(shaped) = pdfcraft_fonts::source_shaping::shape(&bytes, text)
+        {
+            return Ok(Some((bytes, shaped, family)));
+        }
+    }
+    Err(EditError::Invalid("complex text needs the complete source TrueType/OpenType face; load that font before editing".into()))
+}
+
+/// For each output row (a range of the draft's characters), whether it is exactly the source row
+/// at the same position: the same characters, none of them inserted or changed by the edit.
+fn untouched_rows(block: &TextBlock, draft: &str, rows: &[std::ops::Range<usize>]) -> Vec<bool> {
+    let old: Vec<char> = block.editor_text.chars().collect();
+    let new: Vec<char> = draft.chars().collect();
+    let prefix = old.iter().zip(&new).take_while(|(a, b)| a == b).count();
+    let suffix = old.iter().rev().zip(new.iter().rev()).take(old.len().min(new.len()).saturating_sub(prefix)).take_while(|(a, b)| a == b).count();
+    // The source character a draft character is, if the edit left it alone.
+    let origin = |i: usize| {
+        if i < prefix {
+            Some(i)
+        } else if i >= new.len().saturating_sub(suffix) {
+            (old.len() + i).checked_sub(new.len())
+        } else {
+            None
+        }
+    };
+    let mut source_rows = Vec::new();
+    let mut start = 0;
+    for (i, ch) in old.iter().enumerate() {
+        if *ch == '\n' {
+            source_rows.push(start..i);
+            start = i + 1;
+        }
+    }
+    source_rows.push(start..old.len());
+    // A line break inside a source run would pair editor rows with the wrong visual rows.
+    if source_rows.len() != block.rows.len() {
+        return vec![false; rows.len()];
+    }
+    rows.iter()
+        .enumerate()
+        .map(|(r, range)| {
+            source_rows.get(r).is_some_and(|source| {
+                !range.is_empty() && range.len() == source.len() && range.clone().zip(source.clone()).all(|(i, j)| origin(i) == Some(j))
+            })
+        })
+        .collect()
+}
+
+/// Rewrite visual rows while keeping the source style on each surviving character. Resource
+/// names may differ between Unicode subsets of the same face; encoding searches those subsets.
+pub(crate) fn rewrite_styled_block(
+    doc: &mut Document,
+    page: usize,
+    block: &TextBlock,
+    lines: &[TextLine],
+    text: Option<&str>,
+    style: &BlockStyle,
+    max_glyphs: usize,
+) -> Result<LineEdit, EditError> {
+    let first = block.lines.first().and_then(|i| lines.get(*i)).ok_or_else(|| EditError::Invalid("the paragraph has no source runs".into()))?;
+    let draft = match text {
+        Some(t) if t != block.text => t,
+        _ => &block.editor_text,
+    };
+    if draft.len() > 4_000_000 {
+        return Err(EditError::Invalid("the replacement text is too large".into()));
+    }
+    if draft == block.editor_text && *style == BlockStyle::default() {
+        return Ok(LineEdit { substituted: None });
+    }
+    let mut ranges: Vec<_> = style.ranges.iter().collect();
+    ranges.sort_by_key(|r| r.range.start);
+    if ranges.len() > 1024
+        || ranges.iter().any(|r| {
+            r.range.start >= r.range.end
+                || draft.get(r.range.clone()).is_none()
+                || [r.size, r.char_spacing, r.scale].iter().flatten().any(|n| !n.is_finite())
+                || r.size.is_some_and(|n| n <= 0.0 || n > 14400.0)
+                || r.color.is_some_and(|c| c.iter().any(|n| !n.is_finite() || !(0.0..=1.0).contains(n)))
+        })
+        || ranges.windows(2).any(|r| r[0].range.end > r[1].range.start)
+    {
+        return Err(EditError::Invalid("text style ranges must be disjoint UTF-8 boundaries with finite formatting (at most 1024 ranges)".into()));
+    }
+    let source_count = lines.len();
+    let mut styled_lines = lines.to_vec();
+    let mut styled_spans = Vec::new();
+    let mut underlines = HashMap::new();
+    let mut overrides = HashMap::new();
+    for (span, source) in block.edited_spans(draft) {
+        let mut edges = vec![span.start, span.end];
+        for r in &ranges {
+            for edge in [r.range.start, r.range.end] {
+                if span.contains(&edge) {
+                    edges.push(edge);
+                }
+            }
+        }
+        edges.sort_unstable();
+        edges.dedup();
+        for bounds in edges.windows(2) {
+            let (Some(start), Some(end)) = (bounds.first().copied(), bounds.get(1).copied()) else { continue };
+            let mut index = source;
+            let selected = ranges.iter().find(|r| r.range.contains(&start)).copied();
+            if selected.is_some() || style.family.is_some() || style.bold.is_some() {
+                let default_range = RangeStyle {
+                    range: start..end,
+                    family: None,
+                    resource: None,
+                    size: None,
+                    color: None,
+                    underline: None,
+                    char_spacing: None,
+                    scale: None,
+                };
+                let r = selected.unwrap_or(&default_range);
+                let mut line = lines.get(source).unwrap_or(first).clone();
+                if let Some((family, bold, italic)) =
+                    r.family.or(style.family).or_else(|| style.bold.map(|b| (source_family(&line.base_font), b, line.italic)))
+                {
+                    let base = family.base_font(bold, italic);
+                    line.font = format!("PCRange{}", base.replace('-', ""));
+                    line.base_font = base.to_owned();
+                    line.bold = bold;
+                    line.italic = italic;
+                }
+                if let Some(resource) = &r.resource {
+                    line.font = resource.clone();
+                }
+                if let Some(size) = r.size {
+                    line.size = size;
+                }
+                if let Some(color) = r.color {
+                    line.color = color;
+                    line.origin.state.fill = vec![Op::new("rg", color.map(Object::Real).to_vec())];
+                }
+                if let Some(spacing) = r.char_spacing {
+                    line.origin.state.char_spacing = spacing / line.origin.k.max(1e-6);
+                }
+                if let Some(scale) = r.scale {
+                    line.origin.state.scale = (scale / 100.0).clamp(0.1, 10.0);
+                }
+                index = styled_lines.len();
+                styled_lines.push(line);
+                if let Some(r) = selected {
+                    overrides.insert(index, r);
+                }
+                if let Some(underline) = r.underline {
+                    underlines.insert(index, underline);
+                }
+            }
+            styled_spans.push((start..end, index));
+        }
+    }
+    let lines = styled_lines.as_slice();
+    let p = page_dict(doc, page)?;
+    let mut res = p.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
+    let mut fonts = res.get(b"Font").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
+    for line in lines.iter().filter(|line| line.font.starts_with("PCRange")) {
+        let mut f = Dict::new();
+        f.set(b"Type".to_vec(), Object::name("Font"));
+        f.set(b"Subtype".to_vec(), Object::name("Type1"));
+        f.set(b"BaseFont".to_vec(), Object::name(&line.base_font));
+        f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+        fonts.set(line.font.as_bytes().to_vec(), Object::Dict(f));
+    }
+    let mut metrics = std::collections::BTreeMap::new();
+    for (name, object) in fonts.iter().take(256) {
+        if let Some(font) = doc.resolve(object).as_dict() {
+            metrics.insert(String::from_utf8_lossy(name).into_owned(), Metrics::from_dict(doc, font));
+        }
+    }
+    for index in &block.lines {
+        if let Some(line) = lines.get(*index)
+            && !metrics.contains_key(&line.font)
+            && let Some(font) = fonts.get(line.font.as_bytes()).and_then(|f| doc.resolve(f).as_dict().cloned())
+        {
+            metrics.insert(line.font.clone(), Metrics::from_dict(doc, &font));
+        }
+    }
+    if [style.size, style.line_spacing, style.char_spacing, style.scale, style.width].iter().flatten().any(|v| !v.is_finite())
+        || style.color.is_some_and(|c| c.iter().any(|v| !v.is_finite()))
+    {
+        return Err(EditError::Invalid("the paragraph's formatting must use finite numbers".into()));
+    }
+    let [dx, dy] = style.offset.unwrap_or([0.0, 0.0]);
+    if !dx.is_finite() || !dy.is_finite() || style.width.is_some_and(|w| !w.is_finite()) {
+        return Err(EditError::Invalid("the paragraph's position and width must be finite".into()));
+    }
+    // A visual row grows even when it contains several source/font runs. Multi-row
+    // paragraphs retain their container width; an explicit width always wins.
+    let natural = if block.invisible || block.rows.len() == 1 {
+        (p.crop(doc)[2] - 36.0 - (block.rect[0] + dx)).max(block.rect[2] - block.rect[0])
+    } else {
+        block.rect[2] - block.rect[0]
+    };
+    let width = style.width.unwrap_or(natural).clamp(1.0, 14_400.0);
+    // Each tuple is a character, its source style and an encodable resource name.
+    let mut chars = Vec::new();
+    let mut substituted = None;
+    let mut fallback_groups: Vec<FallbackGroup> = Vec::new();
+    let mut fallback_names: std::collections::BTreeMap<(String, bool, char), usize> = std::collections::BTreeMap::new();
+    let mut fallback_glyphs = 0_usize;
+    let per_font = max_glyphs.clamp(1, MAX_TYPE3_GLYPHS);
+    let fallback_budget = per_font.saturating_mul(MAX_STYLED_FALLBACK_BATCHES);
+    let mut full_faces: HashMap<String, String> = HashMap::new();
+    let mut programs: HashMap<String, Option<std::sync::Arc<Vec<u8>>>> = HashMap::new();
+    for (range, index) in styled_spans {
+        let source = lines.get(index).unwrap_or(first);
+        let start = range.start;
+        for (offset, ch) in draft.get(range).unwrap_or_default().char_indices() {
+            if ch == '\n' {
+                chars.push((ch, index, source.font.clone()));
+                continue;
+            }
+            // A carriage return breaks the row too. Before `\n` the pair is one break, so the
+            // CR stays a `\r` the rows skip. Either way it keeps its place among the draft's
+            // characters, which rows are counted in.
+            if ch == '\r' {
+                let crlf = start.checked_add(offset).and_then(|at| draft.get(at.saturating_add(1)..)).is_some_and(|rest| rest.starts_with('\n'));
+                chars.push((if crlf { '\r' } else { '\n' }, index, source.font.clone()));
+                continue;
+            }
+            let s = ch.to_string();
+            let name = if let Some(resource) = overrides.get(&index).and_then(|r| r.resource.as_ref()).or(style.resource.as_ref()) {
+                if !metrics.get(resource).is_some_and(|m| source_encodes(m, &s)) {
+                    return Err(EditError::Invalid(format!("the selected font resource {resource} cannot show U+{:04X}", u32::from(ch))));
+                }
+                resource.clone()
+            } else if metrics.get(&source.font).is_some_and(|m| source_encodes(m, &s)) {
+                source.font.clone()
+            } else if let Some((name, _)) = metrics.iter().find(|(_, m)| {
+                pdfcraft_fonts::embedding::face_key(&m.base_font) == pdfcraft_fonts::embedding::face_key(&source.base_font) && source_encodes(m, &s)
+            }) {
+                name.clone()
+            } else if let Some(face) =
+                pdfcraft_fonts::embedding::matching_faces(&source.base_font).into_iter().find(|f| pdfcraft_fonts::embedding::covers(f.bytes, &s))
+            {
+                let key = face.name();
+                if let Some(name) = full_faces.get(&key) {
+                    name.clone()
+                } else {
+                    let name = pdfcraft_fonts::embedding::embed(doc, &mut fonts, face.bytes, face.family).map_err(EditError::Invalid)?;
+                    let font = fonts
+                        .get(name.as_bytes())
+                        .and_then(|f| doc.dict(f))
+                        .ok_or_else(|| EditError::Invalid("the full source font could not be loaded".into()))?;
+                    metrics.insert(name.clone(), Metrics::from_dict(doc, &font));
+                    full_faces.insert(key, name.clone());
+                    name
+                }
+            } else if let Some(bytes) = programs
+                .entry(source.font.clone())
+                .or_insert_with(|| source_program(doc, &fonts, &source.font).map(std::sync::Arc::new))
+                .clone()
+                .filter(|bytes| pdfcraft_fonts::embedding::covers(bytes, &s))
+            {
+                // The document's own complete program of this font has the glyph: draw it with
+                // that face rather than another family's fallback.
+                let key = format!("source {}", source.font);
+                if let Some(name) = full_faces.get(&key) {
+                    name.clone()
+                } else {
+                    let family = pdfcraft_fonts::embedding::names(&bytes).map_or_else(|_| source.base_font.clone(), |(family, _)| family);
+                    let name = pdfcraft_fonts::embedding::embed(doc, &mut fonts, &bytes, &family).map_err(EditError::Invalid)?;
+                    let font = fonts
+                        .get(name.as_bytes())
+                        .and_then(|f| doc.dict(f))
+                        .ok_or_else(|| EditError::Invalid("the source font could not be loaded".into()))?;
+                    metrics.insert(name.clone(), Metrics::from_dict(doc, &font));
+                    full_faces.insert(key, name.clone());
+                    name
+                }
+            } else {
+                let family = source_family(&source.base_font);
+                if needs_type3(&s) {
+                    let key = (source.base_font.clone(), source.bold, ch);
+                    let group_index = if let Some(index) = fallback_names.get(&key) {
+                        *index
+                    } else {
+                        // Keep the old per-character face choice: a serif Japanese character
+                        // and a Cyrillic character may need different faces even in one style.
+                        // Hebrew uses the separate RTL path before reaching this writer.
+                        let (faces, _) = type3_faces(&s, family, source.bold)?;
+                        let face =
+                            fallback_face(&faces, &[ch], |face, ch| japanese_glyph_from(face, ch).is_ok()).ok_or_else(|| no_fallback_font(&s))?;
+                        let index = fallback_groups.iter().position(|group| std::ptr::eq(group.face, face)).unwrap_or_else(|| {
+                            let index = fallback_groups.len();
+                            fallback_groups.push(FallbackGroup { face, seen: Default::default(), glyphs: Vec::new(), positions: Vec::new() });
+                            index
+                        });
+                        fallback_names.insert(key, index);
+                        index
+                    };
+                    let group = fallback_groups.get_mut(group_index).ok_or_else(|| EditError::Invalid("the fallback face is missing".into()))?;
+                    if group.seen.insert(ch) {
+                        if fallback_glyphs >= fallback_budget {
+                            return Err(EditError::Invalid(format!(
+                                "the replacement needs more than {fallback_budget} fallback glyphs; edit a smaller paragraph or load a complete font"
+                            )));
+                        }
+                        let (path, width) = type3_glyph(group.face, ch)?.ok_or_else(|| no_glyph_for(group.face, ch))?;
+                        let code = u8::try_from((group.glyphs.len() % per_font).saturating_add(1))
+                            .map_err(|_| EditError::Invalid("replacement text has too many unique characters".into()))?;
+                        group.glyphs.push(Type3Glyph { code, ch, path, width });
+                        fallback_glyphs = fallback_glyphs.saturating_add(1);
+                    }
+                    group.positions.push(chars.len());
+                    // Filled from the prepared font/code map before measuring or drawing.
+                    String::new()
+                } else {
+                    let base = family.base_font(source.bold, source.italic);
+                    let name = format!("PCEd{}", base.replace('-', ""));
+                    let mut f = Dict::new();
+                    f.set(b"Type".to_vec(), Object::name("Font"));
+                    f.set(b"Subtype".to_vec(), Object::name("Type1"));
+                    f.set(b"BaseFont".to_vec(), Object::name(base));
+                    f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+                    metrics.entry(name.clone()).or_insert_with(|| Metrics::from_dict(doc, &f));
+                    fonts.set(name.clone().into_bytes(), Object::Dict(f));
+                    substituted = Some(base.to_string());
+                    name
+                }
+            };
+            chars.push((ch, index, name));
+        }
+    }
+    // All fallback outlines have now succeeded. Batch by actual face, preserving source
+    // style indices; the existing writer then coalesces adjacent equal-font/style characters.
+    for group in fallback_groups {
+        let fallback = write_type3_glyphs(doc, &mut fonts, group.face, false, group.glyphs, per_font);
+        for name in &fallback.names {
+            let font = fonts
+                .get(name.as_bytes())
+                .and_then(|f| doc.dict(f))
+                .ok_or_else(|| EditError::Invalid("the fallback font could not be loaded".into()))?;
+            metrics.insert(name.clone(), Metrics::from_dict(doc, &font));
+        }
+        for position in group.positions {
+            let item = chars.get_mut(position).ok_or_else(|| EditError::Invalid("the fallback character is missing".into()))?;
+            let (font, _) = fallback.codes.get(&item.0).ok_or_else(|| EditError::Invalid("the fallback glyph is missing".into()))?;
+            item.2 = fallback.names.get(*font).cloned().ok_or_else(|| EditError::Invalid("the fallback font is missing".into()))?;
+        }
+        substituted = Some(fallback.family.to_owned());
+    }
+    let size_of = |source: &TextLine, index: usize| {
+        overrides.get(&index).and_then(|r| r.size).or(style.size).unwrap_or(source.size).max(0.1) / source.origin.k.max(1e-6)
+    };
+    // A source run may carry TJ kerning/justification that is absent from its text state.
+    // Keep its measured advance when rebuilding the run instead of making it wrap on entry.
+    // Each font's space width, worked out once: when a font can't show a space, finding one
+    // reads every font on the page, and doing that for every character of a paragraph made each
+    // keystroke in a long paragraph take half a second (#2616).
+    // Only for the fonts the paragraph uses, when first asked: working out every page font's width
+    // up front would scan the page once per font for a short edit on a page of many fonts.
+    let spaces: std::cell::RefCell<HashMap<String, f64>> = std::cell::RefCell::new(HashMap::new());
+    let space_of = |name: &str, m: &Metrics| {
+        if let Some(w) = spaces.borrow().get(name) {
+            return *w;
+        }
+        let w = source_space(doc, &fonts, m);
+        spaces.borrow_mut().insert(name.to_owned(), w);
+        w
+    };
+    let mut calibration = HashMap::new();
+    for (index, source) in lines.iter().enumerate() {
+        if let Some(m) = metrics.get(&source.font) {
+            let nominal = source_width(
+                m,
+                &source.text,
+                source.origin.state.font.as_ref().map_or(1.0, |(_, s)| *s),
+                space_of(&source.font, m),
+                source.origin.state.char_spacing,
+                source.origin.state.word_spacing,
+            ) * source.origin.state.scale
+                * across(source);
+            let changed_face = style.resource.is_some() || overrides.get(&index).is_some_and(|r| r.family.is_some() || r.resource.is_some());
+            let factor = if nominal > 0.0 && !changed_face { ((source.rect[2] - source.rect[0]) / nominal).clamp(0.5, 2.0) } else { 1.0 };
+            calibration.insert(index, factor);
+        }
+    }
+    let advance = |item: &(char, usize, String)| -> f64 {
+        let source = lines.get(item.1).unwrap_or(first);
+        let Some(m) = metrics.get(&item.2) else { return 0.0 };
+        source_width(
+            m,
+            &item.0.to_string(),
+            size_of(source, item.1),
+            space_of(&item.2, m),
+            overrides
+                .get(&item.1)
+                .and_then(|r| r.char_spacing)
+                .or(style.char_spacing)
+                .map_or(source.origin.state.char_spacing, |c| c / source.origin.k.max(1e-6)),
+            source.origin.state.word_spacing,
+        ) * overrides.get(&item.1).and_then(|r| r.scale).or(style.scale).map_or(source.origin.state.scale, |s| (s / 100.0).clamp(0.1, 10.0))
+            * across(source)
+            * calibration.get(&item.1).copied().unwrap_or(1.0)
+    };
+    let measure = |items: &[(char, usize, String)]| -> Result<f64, EditError> {
+        let mut width = 0.0;
+        let mut at = 0;
+        while let Some(item) = items.get(at) {
+            let mut end = at + 1;
+            while items.get(end).is_some_and(|v| v.1 == item.1 && v.2 == item.2) {
+                end += 1;
+            }
+            let segment = items.get(at..end).unwrap_or_default();
+            let string: String = segment.iter().map(|v| v.0).collect();
+            if let Some((_, shaped, _)) = shape_source(doc, &fonts, &item.2, &string)? {
+                let source = lines.get(item.1).unwrap_or(first);
+                let scale =
+                    overrides.get(&item.1).and_then(|r| r.scale).or(style.scale).map_or(source.origin.state.scale, |s| (s / 100.0).clamp(0.1, 10.0));
+                let spacing = overrides
+                    .get(&item.1)
+                    .and_then(|r| r.char_spacing)
+                    .or(style.char_spacing)
+                    .map_or(source.origin.state.char_spacing, |s| s / source.origin.k.max(1e-6));
+                width += (shaped.advance * size_of(source, item.1)
+                    + spacing * string.chars().count() as f64
+                    + source.origin.state.word_spacing * string.matches(' ').count() as f64)
+                    * scale
+                    * source.origin.k;
+            } else {
+                width += segment.iter().map(&advance).sum::<f64>();
+            }
+            at = end;
+        }
+        Ok(width)
+    };
+    let mut rows: Vec<Vec<(char, usize, String)>> = Vec::new();
+    // Each row's characters, as indexes into the draft's characters (`chars` holds all of them).
+    let mut row_ranges = Vec::new();
+    let mut row_start = 0;
+    let mut row = Vec::new();
+    let mut row_width = 0.0;
+    // Wrap at word boundaries, retaining explicit source row breaks and whitespace.
+    let mut at = 0;
+    while at < chars.len() {
+        let Some(item) = chars.get(at) else { break };
+        // The CR of a CRLF: the `\n` after it breaks the row.
+        if item.0 == '\r' {
+            at += 1;
+            continue;
+        }
+        if item.0 == '\n' {
+            row_ranges.push(row_start..row_start + row.len());
+            rows.push(std::mem::take(&mut row));
+            row_width = 0.0;
+            at += 1;
+            row_start = at;
+            continue;
+        }
+        let mut end = at + 1;
+        if !item.0.is_whitespace() {
+            // A word ends at a space, or where Chinese or Japanese text may break between characters.
+            while let (Some(before), Some(c)) = (chars.get(end - 1), chars.get(end))
+                && !c.0.is_whitespace()
+                && !crate::linebreak::between(before.0, c.0)
+            {
+                end += 1;
+            }
+        }
+        let word = chars.get(at..end).unwrap_or_default();
+        let w = measure(word)?;
+        if !row.is_empty() && !item.0.is_whitespace() && row_width + w > width + 0.5 {
+            while row.last().is_some_and(|c: &(char, usize, String)| c.0.is_whitespace()) {
+                row.pop();
+            }
+            row_ranges.push(row_start..row_start + row.len());
+            rows.push(std::mem::take(&mut row));
+            row_width = 0.0;
+            row_start = at;
+        }
+        row.extend_from_slice(word);
+        row_width += w;
+        at = end;
+    }
+    if !row.is_empty() {
+        row_ranges.push(row_start..row_start + row.len());
+        rows.push(row);
+    }
+    let streams = content_streams(doc, &p.dict)?;
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    // A row the edit doesn't reach keeps its source operators, so its kerning, TJ word gaps and
+    // glyph widths stay exactly as they were instead of being rebuilt from the text state.
+    let plain = BlockStyle { ranges: Vec::new(), ..style.clone() } == BlockStyle::default();
+    let mut kept = if plain {
+        untouched_rows(block, draft, &row_ranges).into_iter().zip(&rows).map(|(same, row)| same && row.iter().all(|c| c.1 < source_count)).collect()
+    } else {
+        vec![false; rows.len()]
+    };
+    let kept_lines: std::collections::HashSet<usize> =
+        kept.iter().enumerate().filter(|(_, k)| **k).filter_map(|(r, _)| block.rows.get(r)).flatten().copied().collect();
+    let rewritten: Vec<&TextLine> = block.lines.iter().filter(|i| !kept_lines.contains(i)).filter_map(|i| lines.get(*i)).collect();
+    // The rewrite goes where the last rewritten row was drawn, after any backgrounds painted
+    // between the rows. A dropped `'` or `"` also moved to the next line, which a kept row relies on.
+    let lead =
+        rewritten.last().copied().filter(|_| !rewritten.iter().flat_map(|l| &l.ops).any(|i| ops.get(*i).is_some_and(|op| op.is("'") || op.is("\""))));
+    let (members, lead) = match lead {
+        Some(lead) if !kept_lines.is_empty() => (rewritten, lead),
+        _ => {
+            kept.iter_mut().for_each(|k| *k = false);
+            let all: Vec<&TextLine> = block.lines.iter().filter_map(|i| lines.get(*i)).collect();
+            let last = all.last().copied().unwrap_or(first);
+            (all, last)
+        }
+    };
+    let o = &lead.origin;
+    let mut drop = coincident_ops(lines, &members);
+    drop.extend(members.iter().flat_map(|l| l.ops.iter().copied()));
+    let start = lead.ops.first().copied().unwrap_or(o.bt_op);
+    let split = ops
+        .get(o.bt_op..start)
+        .unwrap_or_default()
+        .iter()
+        .enumerate()
+        .any(|(i, op)| matches!(op.op.as_slice(), b"Tj" | b"TJ" | b"'" | b"\"") && !drop.contains(&(o.bt_op + i)));
+    // What is in force where the rewrite is drawn, and what the text after it expects.
+    let after = if split { &o.state } else { &o.bt_state };
+    for (row, _) in rows.iter().zip(&kept).filter(|(_, k)| !**k) {
+        let text: String = row.iter().map(|v| v.0).collect();
+        if pdfcraft_fonts::source_shaping::required(&text) && row.first().is_some_and(|first| row.iter().any(|v| v.1 != first.1 || v.2 != first.2)) {
+            return Err(EditError::Invalid(
+                "contextual/bidi text across font or style boundaries needs a uniform full-face row; mixed contextual runs are not yet supported"
+                    .into(),
+            ));
+        }
+    }
+    let measured: Vec<_> = rows.iter().map(|r| measure(r)).collect::<Result<_, _>>()?;
+    let mut shaped_runs = HashMap::new();
+    let mut segment_advances = HashMap::new();
+    for (row_index, row) in rows.iter().enumerate().filter(|(r, _)| !kept.get(*r).copied().unwrap_or(false)) {
+        let mut at = 0;
+        while let Some(item) = row.get(at) {
+            let mut end = at + 1;
+            while row.get(end).is_some_and(|v| v.1 == item.1 && v.2 == item.2) {
+                end += 1;
+            }
+            segment_advances.insert((row_index, at), row.get(at..end).unwrap_or_default().iter().map(&advance).sum::<f64>());
+            let string: String = row.get(at..end).unwrap_or_default().iter().map(|v| v.0).collect();
+            if let Some((bytes, shaped, family)) = shape_source(doc, &fonts, &item.2, &string)? {
+                shaped_runs.insert((row_index, at), (bytes, shaped, family));
+            }
+            at = end;
+        }
+    }
+    let mut glyph_resources = HashMap::new();
+    for (key, (bytes, shaped, family)) in &shaped_runs {
+        let mappings: Vec<_> = shaped.glyphs.iter().map(|g| (g.text.clone(), g.id)).collect();
+        let resource = pdfcraft_fonts::embedding::embed_mapping(doc, &mut fonts, bytes, family, &mappings).map_err(EditError::Invalid)?;
+        glyph_resources.insert(*key, resource);
+    }
+    let n = pdfcraft_content::num;
+    let mut block_ops = vec![Op::new("q", vec![])];
+    block_ops.extend(reveal_ops(block, lines, style, o.ctm)?);
+    let back = Matrix([o.ctm[0], o.ctm[1], o.ctm[2], o.ctm[3], 0.0, 0.0])
+        .invert()
+        .ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it cannot be edited in".into()))?;
+    let (tx, ty) = back.apply(dx, dy);
+    block_ops.push(Op::new("cm", vec![n(1.0), n(0.0), n(0.0), n(1.0), n(tx), n(ty)]));
+    let crop = p.crop(doc);
+    let centered = is_centred(block, lines, (crop[0] + crop[2]) / 2.0, first.size);
+    let source_leading = block
+        .rows
+        .windows(2)
+        .filter_map(|rows| {
+            let a = rows[0].first().and_then(|i| lines.get(*i))?;
+            let b = rows[1].first().and_then(|i| lines.get(*i))?;
+            Some((a.origin.baseline - b.origin.baseline).abs())
+        })
+        .rfind(|v| *v > 0.0)
+        .unwrap_or(first.size * 1.5);
+    let mut baseline = first.origin.baseline;
+    for (row_index, row) in rows.iter().enumerate() {
+        let anchor = block.rows.get(row_index).and_then(|r| r.first()).and_then(|i| lines.get(*i));
+        if style.line_spacing.is_none()
+            && style.size.is_none()
+            && let Some(anchor) = anchor
+        {
+            baseline = anchor.origin.baseline;
+        }
+        let anchor = anchor.unwrap_or(first);
+        if kept.get(row_index).copied().unwrap_or(false) {
+            // Kept rows only occur without spacing or size changes, so this is the step below.
+            baseline -= source_leading;
+            continue;
+        }
+        let w = measured.get(row_index).copied().unwrap_or(0.0);
+        let align = style.align.unwrap_or(if centered { crate::added::Align::Center } else { crate::added::Align::Left });
+        let original_rect = block.rows.get(row_index).and_then(|row| row_rect(row, lines)).unwrap_or(block.rect);
+        let left = if style.width.is_none() && style.align.is_none() { original_rect[0] } else { block.rect[0] };
+        let available = if style.width.is_none() && style.align.is_none() { original_rect[2] - original_rect[0] } else { width };
+        let mut x = left
+            + match align {
+                crate::added::Align::Center => (available - w) / 2.0,
+                crate::added::Align::Right => available - w,
+                _ => 0.0,
+            };
+        let mut pos = 0;
+        while pos < row.len() {
+            let Some(item) = row.get(pos) else { break };
+            let source = lines.get(item.1).unwrap_or(first);
+            let mut end = pos + 1;
+            while row.get(end).is_some_and(|other| other.1 == item.1 && other.2 == item.2) {
+                end += 1;
+            }
+            let segment = row.get(pos..end).unwrap_or_default();
+            let string: String = segment.iter().map(|c| c.0).collect();
+            let m = metrics.get(&item.2).ok_or_else(|| EditError::Invalid("the paragraph font is missing".into()))?;
+            let mut state = source.origin.state.clone();
+            state.font = Some((item.2.clone(), size_of(source, item.1)));
+            if let Some(c) = overrides.get(&item.1).and_then(|r| r.char_spacing).or(style.char_spacing) {
+                state.char_spacing = c / source.origin.k.max(1e-6);
+            }
+            if let Some(s) = overrides.get(&item.1).and_then(|r| r.scale).or(style.scale) {
+                state.scale = (s / 100.0).clamp(0.1, 10.0);
+            }
+            if !shaped_runs.contains_key(&(row_index, pos)) {
+                state.scale *= calibration.get(&item.1).copied().unwrap_or(1.0);
+            }
+            if let Some([r, g, b]) = overrides.get(&item.1).and_then(|r| r.color).or(style.color) {
+                state.fill = vec![Op::new("rg", vec![n(r), n(g), n(b)])];
+            }
+            let inverse = Matrix(o.ctm).invert().ok_or_else(|| EditError::Invalid("the paragraph has a singular transform".into()))?;
+            let mut tm = Matrix(source.origin.tm).then(&Matrix(source.origin.ctm)).then(&inverse).0;
+            let (ax, ay) = back.apply(x - source.origin.x, baseline - source.origin.baseline);
+            tm[4] += ax;
+            tm[5] += ay;
+            let mut segment_width = segment_advances.get(&(row_index, pos)).copied().unwrap_or(0.0);
+            // Each run in its own graphics state, restating what its source set inside its text
+            // object (`gs`, stroke, line width, `Tr`; #3508/#3509) from the state the rewrite is
+            // drawn in: a `gs` has no inverse, so one run's ExtGState would stay for the next.
+            block_ops.push(Op::new("q", vec![]));
+            block_ops.extend(state.paint_ops(after));
+            if let Some((_, shaped, _)) = shaped_runs.get(&(row_index, pos)) {
+                let resource = glyph_resources.get(&(row_index, pos)).ok_or_else(|| EditError::Invalid("shaped font is missing".into()))?;
+                let mut properties = Dict::new();
+                properties.set(b"ActualText".to_vec(), Object::String(PdfString::text(&string)));
+                block_ops.push(Op::new("BDC", vec![Object::name("Span"), Object::Dict(properties)]));
+                state.font = Some((resource.clone(), size_of(source, item.1)));
+                // One text object for the run: each glyph is placed where shaping put it by a TJ
+                // adjustment from where the glyph before it ends (its advance in the embedded
+                // font's widths), and raised by the text rise for a mark set above or below
+                // (ISO 32000-1 §9.4.3, §9.3.7). Font-program codes are separate from Unicode;
+                // ToUnicode and ActualText keep the logical text.
+                let size = size_of(source, item.1);
+                let per_unit = 1000.0 / size;
+                if !per_unit.is_finite() {
+                    return Err(EditError::Invalid("the shaped text has no size".into()));
+                }
+                let shown = fonts
+                    .get(resource.as_bytes())
+                    .and_then(|f| doc.resolve(f).as_dict().cloned())
+                    .map(|d| Metrics::from_dict(doc, &d))
+                    .ok_or_else(|| EditError::Invalid("shaped font is missing".into()))?;
+                // Spacing is part of each glyph's position, so the run itself has none.
+                let (char_spacing, word_spacing, rise) = (state.char_spacing, state.word_spacing, state.rise);
+                state.char_spacing = 0.0;
+                state.word_spacing = 0.0;
+                block_ops.push(Op::new("BT", vec![]));
+                block_ops.extend(state.ops());
+                block_ops.push(Op::new("Tm", tm.iter().map(|v| n(*v)).collect()));
+                // `pen`: where the next glyph would start, in thousandths of the font size.
+                let (mut pen, mut extra, mut raised) = (0.0, 0.0, rise);
+                let mut shown_glyphs: Vec<Object> = Vec::new();
+                for (i, glyph) in shaped.glyphs.iter().enumerate() {
+                    let target = (glyph.position[0] * size + extra) * per_unit;
+                    let glyph_rise = rise + glyph.position[1] * size;
+                    if (glyph_rise - raised).abs() > 1e-9 || shown_glyphs.len() >= 4096 {
+                        if !shown_glyphs.is_empty() {
+                            block_ops.push(Op::new("TJ", vec![Object::Array(std::mem::take(&mut shown_glyphs))]));
+                        }
+                        if (glyph_rise - raised).abs() > 1e-9 {
+                            block_ops.push(Op::new("Ts", vec![n(glyph_rise)]));
+                            raised = glyph_rise;
+                        }
+                    }
+                    if (target - pen).abs() > 1e-6 {
+                        shown_glyphs.push(n(pen - target));
+                    }
+                    let code = u16::try_from(i + 1).map_err(|_| EditError::Invalid("shaped glyph limit".into()))?;
+                    shown_glyphs.push(Object::String(PdfString::literal(code.to_be_bytes().to_vec())));
+                    pen = target + shown.width(u32::from(code)) * 1000.0;
+                    extra += char_spacing * glyph.text.chars().count() as f64 + word_spacing * glyph.text.matches(' ').count() as f64;
+                }
+                if !shown_glyphs.is_empty() {
+                    block_ops.push(Op::new("TJ", vec![Object::Array(shown_glyphs)]));
+                }
+                if (raised - rise).abs() > 1e-9 {
+                    block_ops.push(Op::new("Ts", vec![n(rise)]));
+                }
+                block_ops.push(Op::new("ET", vec![]));
+                (state.char_spacing, state.word_spacing) = (char_spacing, word_spacing);
+                block_ops.push(Op::new("EMC", vec![]));
+                segment_width = (shaped.advance * size + extra) * state.scale * source.origin.k;
+            } else {
+                block_ops.push(Op::new("BT", vec![]));
+                block_ops.extend(state.ops());
+                block_ops.push(Op::new("Tm", tm.iter().map(|v| n(*v)).collect()));
+                block_ops.extend(source_show(
+                    m,
+                    &string,
+                    size_of(source, item.1),
+                    spaces.borrow().get(&item.2).copied().unwrap_or_else(|| source_space(doc, &fonts, m)),
+                    state.char_spacing,
+                    state.word_spacing,
+                )?);
+                block_ops.push(Op::new("ET", vec![]));
+            }
+            if underlines.get(&item.1).copied().or(style.underline) == Some(true) {
+                let [r, g, b] = overrides.get(&item.1).and_then(|r| r.color).or(style.color).unwrap_or(source.color);
+                let underline_size = size_of(source, item.1) * source.origin.k;
+                let (x0, y0) = back.apply(x - o.ctm[4], baseline - o.ctm[5] - underline_size * 0.12);
+                let (x1, y1) = back.apply(x + segment_width - o.ctm[4], baseline - o.ctm[5] - underline_size * 0.12);
+                block_ops.push(Op::new("RG", vec![n(r), n(g), n(b)]));
+                block_ops.push(Op::new("w", vec![n(underline_size * 0.06 / o.ctm[2].hypot(o.ctm[3]).max(1e-6))]));
+                block_ops.push(Op::new("m", vec![n(x0), n(y0)]));
+                block_ops.push(Op::new("l", vec![n(x1), n(y1)]));
+                block_ops.push(Op::new("S", vec![]));
+            }
+            block_ops.push(Op::new("Q", vec![]));
+            x += segment_width;
+            pos = end;
+        }
+        baseline -= if style.line_spacing.is_none() && style.size.is_none() {
+            source_leading
+        } else {
+            style.line_spacing.unwrap_or(1.5).clamp(0.5, 5.0) * style.size.unwrap_or(anchor.size)
+        };
+    }
+    block_ops.push(Op::new("Q", vec![]));
+    block_ops.extend(after.ops());
+    if split {
+        block_ops.insert(0, Op::new("ET", vec![]));
+        block_ops.push(Op::new("BT", vec![]));
+        block_ops.push(Op::new("Tm", o.tlm.iter().map(|v| n(*v)).collect()));
+    }
+    let at = if split { start } else { o.bt_op };
+    let data = splice(&pieces, &ops, |i| (if i == at { std::mem::take(&mut block_ops) } else { Vec::new() }, !drop.contains(&i)));
+    let contents = rewritten_contents(doc, &streams, data);
+    res.set(b"Font".to_vec(), Object::Dict(fonts));
+    doc.update_dict(p.obj, |d| {
+        d.set(b"Contents".to_vec(), contents);
+        d.set(b"Resources".to_vec(), Object::Dict(res));
+    })?;
+    Ok(LineEdit { substituted })
+}
diff --git a/crates/engine/examples/export_bench.rs b/crates/engine/examples/export_bench.rs
new file mode 100644
index 0000000000..41520d2ffa
--- /dev/null
+++ b/crates/engine/examples/export_bench.rs
@@ -0,0 +1,61 @@
+//! Times Export ▸ Image over every page of a PDF, for before and after comparisons.
+//!
+//! Usage: `export_bench FILE [DPI] [png|jpeg|tiff] [RUNS]` (defaults: 150 dpi, PNG, 7 runs). Each
+//! run exports every page through [`Exporter::images`] from a fresh exporter, as Export ▸ Image
+//! does, and prints its wall time; the summary gives the median and the minimum, the total size
+//! and an FNV-1a hash of every file in page order. Equal hashes mean equal output. Build with
+//! `--release`; timings are diagnostic, never a CI deadline.
+
+use std::error::Error;
+use std::sync::Arc;
+use std::time::Instant;
+
+use pdfcraft_engine::Session;
+use pdfcraft_engine::export::{Exporter, ImageFormat};
+
+const FNV_OFFSET: u64 = 0xcbf2_9ce4_8422_2325;
+const FNV_PRIME: u64 = 0x0000_0100_0000_01b3;
+
+fn main() -> Result<(), Box<dyn Error>> {
+    let mut args = std::env::args().skip(1);
+    let path = args.next().ok_or("usage: export_bench FILE [DPI] [png|jpeg|tiff] [RUNS]")?;
+    let dpi: f64 = args.next().map_or(Ok(150.0), |s| s.parse())?;
+    let format = match args.next().as_deref() {
+        None | Some("png") => ImageFormat::Png,
+        Some("jpeg" | "jpg") => ImageFormat::Jpeg { quality: 85 },
+        Some("tiff" | "tif") => ImageFormat::Tiff,
+        Some(other) => return Err(format!("unknown format {other:?}").into()),
+    };
+    let runs: usize = args.next().map_or(Ok(7), |s| s.parse())?;
+    let mut session = Session::new();
+    let id = session.open("bench.pdf", None, Arc::new(std::fs::read(&path)?), None)?;
+    let src = session.get(id).ok_or("the document did not open")?.export_source();
+    let pages: Vec<usize> = (0..src.pages).collect();
+    let mut times = Vec::new();
+    let mut summary = None;
+    for run in 0..runs {
+        let start = Instant::now();
+        let mut exporter = Exporter::from_source(src.clone());
+        let (mut hash, mut bytes) = (FNV_OFFSET, 0usize);
+        exporter.images(&pages, dpi, format, |_, file| {
+            bytes += file.len();
+            for b in file {
+                hash = (hash ^ u64::from(b)).wrapping_mul(FNV_PRIME);
+            }
+            Ok(())
+        })?;
+        let ms = start.elapsed().as_secs_f64() * 1000.0;
+        println!("run {}: {ms:.1} ms", run + 1);
+        times.push(ms);
+        summary = Some((bytes, hash));
+    }
+    times.sort_by(f64::total_cmp);
+    if let (Some(median), Some(min), Some((bytes, hash))) = (times.get(times.len() / 2), times.first(), summary) {
+        println!(
+            "{} pages, {} at {dpi} dpi: median {median:.1} ms, min {min:.1} ms ({runs} runs), {bytes} bytes, hash {hash:016x}",
+            pages.len(),
+            format.label()
+        );
+    }
+    Ok(())
+}
diff --git a/crates/engine/src/bookmarks.rs b/crates/engine/src/bookmarks.rs
new file mode 100644
index 0000000000..deaece22e4
--- /dev/null
+++ b/crates/engine/src/bookmarks.rs
@@ -0,0 +1,61 @@
+//! The bookmark list.
+
+/// A bookmark as the bookmark list shows it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct BookmarkRow {
+    /// Child indices from the top level, 0-based, as the edit functions take them.
+    pub path: Vec<usize>,
+    pub title: String,
+    /// Shown expanded (a positive `/Count`).
+    pub open: bool,
+    /// The 0-based page it goes to.
+    pub page: Option<usize>,
+    /// Where on that page it goes ([`pdfcraft_render::DestView::Top`] when it doesn't say).
+    pub view: pdfcraft_render::DestView,
+    /// The title's colour (`/C`), `None` for the default black, and its style (`/F`).
+    pub color: Option<[f32; 3]>,
+    pub italic: bool,
+    pub bold: bool,
+}
+
+/// One page of the bookmark list, in outline order.
+#[derive(Clone, Debug, PartialEq)]
+pub struct BookmarkPage {
+    pub rows: Vec<BookmarkRow>,
+    /// Where the next page starts, or `None` at the end.
+    pub next: Option<usize>,
+    /// Set only when the document's structure could not be read for editing: its listing then
+    /// comes from the viewer's copy of the outline, which is shorter than the file's.
+    pub truncated: bool,
+}
+
+/// The rows of a viewer outline, in outline order, with their paths.
+pub(crate) fn outline_rows(items: &[pdfcraft_render::OutlineItem]) -> Vec<BookmarkRow> {
+    let mut rows = Vec::new();
+    // One entry per open level: its items, and how many of them have been listed.
+    let mut levels: Vec<(&[pdfcraft_render::OutlineItem], usize)> = vec![(items, 0)];
+    while let Some(&(list, next)) = levels.last() {
+        let Some(item) = list.get(next) else {
+            levels.pop();
+            continue;
+        };
+        if let Some(top) = levels.last_mut() {
+            top.1 += 1;
+        }
+        let path: Vec<usize> = levels.iter().map(|(_, listed)| listed.saturating_sub(1)).collect();
+        rows.push(BookmarkRow {
+            path,
+            title: item.title.clone(),
+            open: item.open,
+            page: item.page,
+            view: item.view,
+            color: item.color,
+            italic: item.italic,
+            bold: item.bold,
+        });
+        if !item.children.is_empty() {
+            levels.push((&item.children, 0));
+        }
+    }
+    rows
+}
diff --git a/crates/engine/src/camera_edges.rs b/crates/engine/src/camera_edges.rs
index fd8dbd5f28..cee5c8f694 100644
--- a/crates/engine/src/camera_edges.rs
+++ b/crates/engine/src/camera_edges.rs
@@ -311,6 +311,35 @@ fn refine(q: [Point; 4], edges: &[Option<Edge>], w: usize, h: usize) -> Option<[
     order_quad(refined)
 }
 
+/// A candidate quad's score (its area times the square of its sides' mean support), or `None` when it
+/// strays off the image, is too small, or has a side without enough edge support.
+fn quad_score(q: &[Point; 4], edges: &[Option<Edge>], w: usize, h: usize) -> Option<f64> {
+    let (fw, fh) = (w as f64, h as f64);
+    let (mx, my) = (MARGIN * fw, MARGIN * fh);
+    if q.iter().any(|p| p[0] < -mx || p[1] < -my || p[0] > fw + mx || p[1] > fh + my) {
+        return None;
+    }
+    let area = (0..4)
+        .map(|k| {
+            let (p, n) = (q[k], q[(k + 1) % 4]);
+            p[0] * n[1] - n[0] * p[1]
+        })
+        .sum::<f64>()
+        .abs()
+        / 2.0;
+    if area < MIN_AREA * fw * fh {
+        return None;
+    }
+    let sides: Vec<f64> = (0..4).map(|k| support(q[k], q[(k + 1) % 4], edges, w, h)).collect();
+    if sides.iter().any(|&s| s < MIN_SUPPORT) {
+        return None;
+    }
+    // Large, and with every side on its edge: a slightly larger quad with a side
+    // off the sheet loses to the sheet itself.
+    let mean = sides.iter().sum::<f64>() / 4.0;
+    Some(area * mean * mean)
+}
+
 /// The convex quadrilateral of two near-horizontal and two near-vertical lines whose four sides
 /// all lie on edges, scored by its area times the square of its sides' mean support.
 fn best_quad(lines: &[Line], edges: &[Option<Edge>], w: usize, h: usize) -> Option<[Point; 4]> {
@@ -318,8 +347,6 @@ fn best_quad(lines: &[Line], edges: &[Option<Edge>], w: usize, h: usize) -> Opti
     let flat = |l: &&Line| (l.theta.to_degrees() - 90.0).abs() <= 45.0;
     let horizontal: Vec<&Line> = lines.iter().filter(flat).collect();
     let vertical: Vec<&Line> = lines.iter().filter(|l| !flat(l)).collect();
-    let (fw, fh) = (w as f64, h as f64);
-    let (mx, my) = (MARGIN * fw, MARGIN * fh);
     let mut best: Option<(f64, [Point; 4])> = None;
     for (i, &h1) in horizontal.iter().enumerate() {
         for &h2 in horizontal.iter().skip(i + 1) {
@@ -328,28 +355,7 @@ fn best_quad(lines: &[Line], edges: &[Option<Edge>], w: usize, h: usize) -> Opti
                     let corners = [intersect(*h1, *v1), intersect(*h1, *v2), intersect(*h2, *v2), intersect(*h2, *v1)];
                     let [Some(a), Some(b), Some(c), Some(d)] = corners else { continue };
                     let Some(q) = order_quad([a, b, c, d]) else { continue };
-                    if q.iter().any(|p| p[0] < -mx || p[1] < -my || p[0] > fw + mx || p[1] > fh + my) {
-                        continue;
-                    }
-                    let area = (0..4)
-                        .map(|k| {
-                            let (p, n) = (q[k], q[(k + 1) % 4]);
-                            p[0] * n[1] - n[0] * p[1]
-                        })
-                        .sum::<f64>()
-                        .abs()
-                        / 2.0;
-                    if area < MIN_AREA * fw * fh {
-                        continue;
-                    }
-                    let sides: Vec<f64> = (0..4).map(|k| support(q[k], q[(k + 1) % 4], edges, w, h)).collect();
-                    if sides.iter().any(|&s| s < MIN_SUPPORT) {
-                        continue;
-                    }
-                    // Large, and with every side on its edge: a slightly larger quad with a side
-                    // off the sheet loses to the sheet itself.
-                    let mean = sides.iter().sum::<f64>() / 4.0;
-                    let score = area * mean * mean;
+                    let Some(score) = quad_score(&q, edges, w, h) else { continue };
                     if best.is_none_or(|(b, _)| score > b) {
                         best = Some((score, q));
                     }
diff --git a/crates/engine/src/catalog.rs b/crates/engine/src/catalog.rs
index 0134d39af8..e479232bbb 100644
--- a/crates/engine/src/catalog.rs
+++ b/crates/engine/src/catalog.rs
@@ -550,6 +550,23 @@ pub fn group(id: &str) -> Option<&'static ToolGroup> {
     TOOL_GROUPS.iter().find(|g| g.id == id)
 }
 
+/// A heading of the expanded All tools view, as Acrobat files its tools under "Create & Edit",
+/// "Forms & Signatures" and so on. Every group belongs to exactly one category.
+#[derive(Clone, Copy, Debug)]
+pub struct ToolCategory {
+    pub label: &'static str,
+    /// [`ToolGroup::id`]s, in display order.
+    pub groups: &'static [&'static str],
+}
+
+pub static TOOL_CATEGORIES: &[ToolCategory] = &[
+    ToolCategory { label: "Create & Edit", groups: &["create", "edit", "export", "combine", "organize", "scan", "compress"] },
+    ToolCategory { label: "Review & Compare", groups: &["comment", "stamp", "compare", "measure"] },
+    ToolCategory { label: "Forms & Signatures", groups: &["fill_sign", "form", "certificate"] },
+    ToolCategory { label: "Protect & Standardize", groups: &["protect", "redact", "accessibility", "standards", "print_production"] },
+    ToolCategory { label: "Customize & Automate", groups: &["actions", "javascript", "search_index", "ai"] },
+];
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -564,6 +581,18 @@ mod tests {
         }
     }
 
+    #[test]
+    fn every_group_is_in_exactly_one_category() {
+        let mut seen = HashSet::new();
+        for c in TOOL_CATEGORIES {
+            for id in c.groups {
+                assert!(group(id).is_some(), "{} lists unknown group {id}", c.label);
+                assert!(seen.insert(*id), "{id} is in two categories");
+            }
+        }
+        assert_eq!(seen.len(), TOOL_GROUPS.len(), "a group is in no category");
+    }
+
     #[test]
     fn commands_are_namespaced() {
         for g in TOOL_GROUPS {
diff --git a/crates/engine/src/clock.rs b/crates/engine/src/clock.rs
new file mode 100644
index 0000000000..dc17ab56fb
--- /dev/null
+++ b/crates/engine/src/clock.rs
@@ -0,0 +1,13 @@
+/// Seconds to add to UTC for local time (0 where unknown).
+pub(crate) fn local_utc_offset() -> i64 {
+    #[cfg(not(target_arch = "wasm32"))]
+    return i64::from(chrono::Local::now().offset().local_minus_utc());
+    #[cfg(target_arch = "wasm32")]
+    return 0;
+}
+
+/// (year, month, day) from a PDF date `D:YYYYMMDD…`.
+pub(crate) fn parse_ymd(d: &str) -> Option<(i64, u32, u32)> {
+    let d = d.strip_prefix("D:").unwrap_or(d);
+    Some((d.get(0..4)?.parse().ok()?, d.get(4..6)?.parse().ok()?, d.get(6..8)?.parse().ok()?))
+}
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 4ebfecafc7..1f25c23c98 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -231,7 +231,23 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("view.previous_view", "Previous view", None, Some(Shortcut::cmd("[")), Document, "chevron-left"),
     c("view.next_view", "Next view", None, Some(Shortcut::cmd("]")), Document, "chevron-right"),
     c("view.focus_page_input", "Go to page…", VIEW, Some(Shortcut::cmd_shift("N")), Document, "text-cursor-input"),
-    c("ui.dock.reset", "Reset panel layout", VIEW, None, Nothing, "settings"),
+    c(
+        "view.side_panel",
+        "Show or hide the side panel",
+        VIEW,
+        Some(Shortcut { command: false, shift: false, mac_ctrl: false, key: "F4" }),
+        Nothing,
+        "panel-right",
+    ),
+    c(
+        "view.tools_pane",
+        "Show or hide the Tools panel",
+        VIEW,
+        Some(Shortcut { command: false, shift: true, mac_ctrl: false, key: "F4" }),
+        Nothing,
+        "panel-left",
+    ),
+    c("ui.dock.reset", "Reset side panels", VIEW, None, Nothing, "settings"),
     c("view.theme", "Switch light / dark theme", None, None, Nothing, "moon"),
     c("view.theme.system", "Use system setting", None, None, Nothing, "settings"),
     c("view.theme.light", "Light gray", None, None, Nothing, "sun"),
diff --git a/crates/engine/src/comments.rs b/crates/engine/src/comments.rs
new file mode 100644
index 0000000000..eee799ed2f
--- /dev/null
+++ b/crates/engine/src/comments.rs
@@ -0,0 +1,163 @@
+//! The comment list and its summary.
+
+/// The comment list, read from the object graph (as `inspect` lists comments).
+pub(crate) fn comment_list(doc: &pdfcraft_cos::Document) -> Vec<pdfcraft_render::Annotation> {
+    let mut list: Vec<pdfcraft_render::Annotation> = pdfcraft_annot::summaries(doc)
+        .into_iter()
+        .map(|s| pdfcraft_render::Annotation {
+            page: s.page,
+            subtype: s.subtype,
+            author: s.author,
+            contents: s.contents,
+            modified: s.modified.map(|m| pdfcraft_render::pretty_date(&m)),
+            name: s.name,
+            in_reply_to: s.in_reply_to,
+            parent: s.parent,
+            grouped: s.grouped,
+            rect: s.rect,
+            color: s.color,
+            index: s.index,
+            state: s.state,
+            quads: s.quads,
+            locked: s.locked,
+            intent: s.intent,
+            fill_sign: s.fill_sign,
+            no_rotate: s.no_rotate,
+            points: s.points,
+        })
+        .collect();
+    pdfcraft_render::link_replies(&mut list);
+    list
+}
+
+/// Order of Summarize Comments.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum SummarySort {
+    #[default]
+    Page,
+    Author,
+    Date,
+    Type,
+}
+
+impl SummarySort {
+    pub const ALL: [SummarySort; 4] = [SummarySort::Page, SummarySort::Author, SummarySort::Date, SummarySort::Type];
+    pub fn name(self) -> &'static str {
+        match self {
+            SummarySort::Page => "Page",
+            SummarySort::Author => "Author",
+            SummarySort::Date => "Date",
+            SummarySort::Type => "Type",
+        }
+    }
+    pub fn parse(s: &str) -> Option<SummarySort> {
+        Self::ALL.into_iter().find(|k| k.name().eq_ignore_ascii_case(s))
+    }
+}
+
+/// Acrobat's name for a comment type, as comment lists show it.
+pub fn comment_type_name(subtype: &str) -> &str {
+    match subtype {
+        "Text" => "Sticky Note",
+        "FreeText" => "Text Box",
+        "Highlight" => "Highlight",
+        "Underline" => "Underline",
+        "StrikeOut" => "Strikethrough",
+        "Squiggly" => "Squiggly",
+        "Square" => "Rectangle",
+        "Circle" => "Oval",
+        "Line" => "Line",
+        "Ink" => "Pencil",
+        "Polygon" => "Polygon",
+        "PolyLine" => "Polygonal Line",
+        "Stamp" => "Stamp",
+        "Caret" => "Inserted Text",
+        "FileAttachment" => "File Attachment",
+        "Sound" => "Sound",
+        "Redact" => "Redaction",
+        other => other,
+    }
+}
+
+/// [`comment_type_name`], telling callouts, clouds and typewriter text apart by `/IT`.
+pub fn comment_kind(a: &pdfcraft_render::Annotation) -> &str {
+    match a.intent.as_deref() {
+        Some("FreeTextCallout") => "Callout",
+        Some("PolygonCloud") => "Cloud",
+        Some("FreeTextTypeWriter") => "Typewriter",
+        _ => comment_type_name(&a.subtype),
+    }
+}
+
+/// The text of a comment summary: one block per comment (replies indented under it), with a
+/// "Page N" heading when sorted by page. Checkmarks and status replies are left out, as are
+/// pop-ups; the number is the comment's position on its page.
+pub fn comment_summary(name: &str, all: &[pdfcraft_render::Annotation], sort: SummarySort) -> String {
+    use std::fmt::Write;
+    let top: Vec<&pdfcraft_render::Annotation> = all.iter().filter(|a| a.is_comment()).collect();
+    // Each reply under the annotation its `/IRT` points at, in document order, gathered once.
+    type Children<'a> = std::collections::HashMap<(usize, usize), Vec<&'a pdfcraft_render::Annotation>>;
+    let mut children = Children::new();
+    for r in all.iter().filter(|r| r.state.is_none()) {
+        if let Some(parent) = r.parent {
+            children.entry(parent).or_default().push(r);
+        }
+    }
+    // Write a comment's replies, indenting each level. A reply to a reply keeps its `/IRT` on the
+    // direct parent, so following one level would leave the deeper replies out of the summary.
+    fn write_replies(out: &mut String, children: &Children<'_>, parent: &pdfcraft_render::Annotation, depth: usize) {
+        use std::fmt::Write;
+        if depth > 64 {
+            return;
+        }
+        for r in children.get(&(parent.page, parent.index)).into_iter().flatten() {
+            let indent = "    ".repeat(depth + 1);
+            let _ =
+                writeln!(out, "{indent}Author: {}  Subject: Reply  Date: {}", r.author.as_deref().unwrap_or(""), r.modified.as_deref().unwrap_or(""));
+            for line in r.contents.as_deref().unwrap_or("").lines() {
+                let _ = writeln!(out, "{indent}{line}");
+            }
+            write_replies(out, children, r, depth + 1);
+        }
+    }
+    let mut numbered: Vec<(usize, &pdfcraft_render::Annotation)> = Vec::new();
+    let mut last = usize::MAX;
+    let mut n = 0;
+    for a in &top {
+        if a.page != last {
+            last = a.page;
+            n = 0;
+        }
+        n += 1;
+        numbered.push((n, a));
+    }
+    match sort {
+        SummarySort::Page => {}
+        SummarySort::Author => numbered.sort_by(|x, y| x.1.author.cmp(&y.1.author)),
+        SummarySort::Date => numbered.sort_by(|x, y| x.1.modified.cmp(&y.1.modified)),
+        SummarySort::Type => numbered.sort_by(|x, y| comment_kind(x.1).cmp(comment_kind(y.1))),
+    }
+    let mut out = format!("Summary of Comments on {name}\n\n");
+    if numbered.is_empty() {
+        out.push_str("This document has no comments.\n");
+        return out;
+    }
+    let mut heading = usize::MAX;
+    for (n, a) in numbered {
+        if sort == SummarySort::Page && a.page != heading {
+            heading = a.page;
+            let _ = writeln!(out, "Page: {}", a.page + 1);
+        }
+        let _ = write!(out, "Number: {n}  Author: {}  Subject: {}", a.author.as_deref().unwrap_or(""), comment_kind(a));
+        if sort != SummarySort::Page {
+            let _ = write!(out, "  Page: {}", a.page + 1);
+        }
+        let _ = writeln!(out, "  Date: {}", a.modified.as_deref().unwrap_or(""));
+        if let Some(c) = a.contents.as_deref().filter(|c| !c.is_empty()) {
+            let _ = writeln!(out, "{c}");
+        }
+        write_replies(&mut out, &children, a, 0);
+        out.push('\n');
+    }
+    out
+}
diff --git a/crates/engine/src/compare.rs b/crates/engine/src/compare.rs
index 1326ccb5e8..044e40e2e2 100644
--- a/crates/engine/src/compare.rs
+++ b/crates/engine/src/compare.rs
@@ -220,7 +220,10 @@ impl crate::Document {
                     .filter(|b| !b.text.trim().is_empty())
                     .map(|b| {
                         let f = b.base_font.to_ascii_lowercase();
+                        // `text` is trimmed; the editor text keeps the source's own spaces.
+                        let space_around = [b.editor_text.starts_with(char::is_whitespace), b.editor_text.ends_with(char::is_whitespace)];
                         pdfcraft_export::Block {
+                            space_around,
                             text: b.text,
                             rect: visible_rect(b.rect),
                             size: b.size * unit,
diff --git a/crates/engine/src/dates.rs b/crates/engine/src/dates.rs
index 606ca53c65..c9382c1b02 100644
--- a/crates/engine/src/dates.rs
+++ b/crates/engine/src/dates.rs
@@ -63,7 +63,7 @@ const CKB_DAYS: [&str; 7] = ["یەکشەممە", "دووشەممە", "سێشەم
 
 /// The languages month and weekday names can be written in (Preferences ▸ Date format ▸ Language):
 /// the interface languages, in the same order and with the same names.
-pub static DATE_LANGUAGES: [DateLanguage; 34] = [
+pub static DATE_LANGUAGES: [DateLanguage; 35] = [
     DateLanguage {
         code: "en",
         name: "English",
@@ -267,6 +267,17 @@ pub static DATE_LANGUAGES: [DateLanguage; 34] = [
         days: CKB_DAYS,
         days_short: CKB_DAYS,
     },
+    // Persian (Farsi); Gregorian month and weekday names, right to left like Arabic and Kurdish.
+    // Persian does not change the month form after a day number, so `months_with_day` is `None`.
+    DateLanguage {
+        code: "fa",
+        name: "فارسی",
+        months: ["ژانویه", "فوریه", "مارس", "آوریل", "مه", "ژوئن", "ژوئیه", "اوت", "سپتامبر", "اکتبر", "نوامبر", "دسامبر"],
+        months_with_day: None,
+        months_short: ["ژانویه", "فوریه", "مارس", "آوریل", "مه", "ژوئن", "ژوئیه", "اوت", "سپتامبر", "اکتبر", "نوامبر", "دسامبر"],
+        days: ["یکشنبه", "دوشنبه", "سه‌شنبه", "چهارشنبه", "پنج‌شنبه", "جمعه", "شنبه"],
+        days_short: ["یک", "دو", "سه", "چه", "پن", "جم", "شن"],
+    },
     DateLanguage {
         code: "pl",
         name: "Polski",
diff --git a/crates/engine/src/doc_state.rs b/crates/engine/src/doc_state.rs
new file mode 100644
index 0000000000..d25cc65037
--- /dev/null
+++ b/crates/engine/src/doc_state.rs
@@ -0,0 +1,118 @@
+use super::*;
+
+/// A change to an existing page image.
+#[derive(Clone, Debug, PartialEq)]
+pub enum ImageEdit {
+    /// Move and resize it to this box (user space).
+    Move([f64; 4]),
+    /// Quarter turns clockwise about its centre.
+    Rotate(i32),
+    /// Any angle in degrees clockwise about its centre (the unit is degrees, not quarter turns).
+    RotateBy(f64),
+    Flip {
+        horizontal: bool,
+    },
+    /// Show only this box of it (user space), the pixels staying where they are.
+    Crop([f64; 4]),
+    /// Draw this image file (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000) in its place.
+    Replace {
+        name: String,
+        bytes: Arc<Vec<u8>>,
+    },
+    Delete,
+}
+
+/// Forms ▸ Merge data files into spreadsheet: the field values of each file (FDF, XFDF or a
+/// filled-in PDF form), as CSV with one row per file.
+pub fn merge_data_files(files: &[(String, Vec<u8>)]) -> Result<String, String> {
+    let rows =
+        files.iter().map(|(name, bytes)| pdfcraft_xfdf::data_values(bytes).map_err(|e| format!("{name}: {e}"))).collect::<Result<Vec<_>, _>>()?;
+    Ok(pdfcraft_xfdf::merge_csv(&rows))
+}
+
+/// One file produced by a split: (1-based first page, last page, PDF bytes).
+pub type SplitPart = (usize, usize, Arc<Vec<u8>>);
+
+/// Stable identifier of an open document within a session.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct DocId(pub u64);
+
+/// The highest resolution a document that allows only low-resolution printing (Table 22, bit 12
+/// clear) is printed at.
+pub(crate) const LOW_RESOLUTION_PRINT_DPI: f64 = 150.0;
+
+pub(crate) fn render_threads() -> usize {
+    std::thread::available_parallelism().map(std::num::NonZeroUsize::get).unwrap_or(4).clamp(2, 8) - 1
+}
+
+/// A document's working file captured for crash recovery.
+#[derive(Clone, Debug)]
+pub struct RecoverySnapshot {
+    pub doc: DocId,
+    pub name: String,
+    pub path: Option<String>,
+    pub bytes: Arc<Vec<u8>>,
+    /// The snapshot is encrypted (recovering it asks for the password again).
+    pub encrypted: bool,
+}
+
+/// The recovered user password of an R2–R4 file as text for the renderer, which tries a password
+/// as its UTF-8 bytes and then in PDFDocEncoding: UTF-8 bytes (as some writers store passwords
+/// PDFDocEncoding can't hold, such as "şifre") stay UTF-8, and other bytes are read as
+/// PDFDocEncoding, so either way the renderer gets back exactly these bytes.
+pub(crate) fn renderer_password(bytes: &[u8]) -> String {
+    match std::str::from_utf8(bytes) {
+        Ok(text) => text.to_owned(),
+        Err(_) => bytes.iter().map(|b| pdfcraft_cos::pdfdoc_char(*b)).collect(),
+    }
+}
+
+/// The document as it may be written to a file (#3926, #3944): a copy without the values of text
+/// fields with the Password flag (or XFA `<passwordEdit/>` fields in the datasets), or `cos`
+/// itself when it holds none. ISO 32000-2 §12.7.5.3, Table 231 (a note to the Password flag):
+/// "it is imperative that PDF processors never store the value of the text field in the PDF file
+/// if this flag is set". The open document keeps them in memory.
+pub(crate) fn writable(cos: &pdfcraft_cos::Document) -> Result<std::borrow::Cow<'_, pdfcraft_cos::Document>, EditError> {
+    let has_form_pw = pdfcraft_forms::has_password_values(cos);
+    let has_xfa_pw = pdfcraft_xfa::has_password_values(cos);
+    if !has_form_pw && !has_xfa_pw {
+        return Ok(std::borrow::Cow::Borrowed(cos));
+    }
+    let mut copy = cos.clone();
+    if has_form_pw {
+        pdfcraft_forms::clear_password_values(&mut copy).map_err(|e| EditError::Write(e.to_string()))?;
+    }
+    if has_xfa_pw {
+        pdfcraft_xfa::clear_password_values(&mut copy).map_err(|e| EditError::Write(e.to_string()))?;
+    }
+    Ok(std::borrow::Cow::Owned(copy))
+}
+
+/// The last-resort guard (AGENTS.md §4): run `f`, turning a panic that escapes it into an error
+/// message, so one bad file or edit can't take the app and its other documents down. It is a
+/// safety net for bugs, not a substitute for returning errors.
+pub fn guard<T>(f: impl FnOnce() -> T) -> Result<T, String> {
+    std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)).map_err(|p| {
+        p.downcast_ref::<&str>().map(|s| (*s).to_string()).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_else(|| "unknown error".into())
+    })
+}
+
+/// Validate the signature fields of `cos` (written as `bytes`).
+pub(crate) fn signatures_of(
+    cos: &pdfcraft_cos::Document,
+    bytes: &[u8],
+    trust: &TrustStore,
+    cache: &pdfcraft_sign::DigestCache,
+) -> Vec<SignatureInfo> {
+    pdfcraft_sign::pdf::list_cached(cos, bytes, trust, cache)
+}
+
+/// What Optimize PDF did.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct OptimizeReport {
+    pub optimize: optimize::Report,
+    /// Identical objects merged.
+    pub merged: usize,
+    /// Remove Hidden Information categories discarded, with counts.
+    pub discarded: Vec<(Hidden, usize)>,
+}
diff --git a/crates/engine/src/document.rs b/crates/engine/src/document.rs
new file mode 100644
index 0000000000..7023caa55e
--- /dev/null
+++ b/crates/engine/src/document.rs
@@ -0,0 +1,713 @@
+//! An open document: its working file, view data and edit state.
+
+use std::sync::{Arc, OnceLock};
+
+use pdfcraft_cos::{SaveOptions, write_incremental};
+use pdfcraft_render::{DocInfo, RenderConfig, RenderPool};
+
+use crate::history::Editor;
+use crate::{
+    CalculationOrder, CheckStyle, DocId, Edit, EditError, EditableObject, FormFieldKind, Hidden, InitialView, Label, MarkKind, SecuritySummary,
+    SignatureInfo, TabOrder, TrustStore, XfaLayout, a11y, form_appearance, guard, js, measure, optimize, renderer_password, unrestricted,
+};
+#[cfg(test)]
+use crate::{record_link_scan, record_marker_scan};
+
+pub struct Document {
+    pub id: DocId,
+    pub name: String,
+    pub path: Option<String>,
+    /// The working file: what Save writes.
+    pub bytes: Arc<Vec<u8>>,
+    /// What is displayed (the page view, `page_render`, page images): `bytes`, plus appearances
+    /// drawn for display only for comments that have none ([`display_bytes`]). Never saved.
+    pub display: Arc<Vec<u8>>,
+    pub info: DocInfo,
+    pub renderer: RenderPool,
+    /// The password the document was opened with (needed to read attachments, etc.).
+    pub password: Option<String>,
+    /// `true` when there are edits that have not been saved.
+    pub dirty: bool,
+    /// Bumped on every change to the working file (edit, undo, redo, save); autosave compares it.
+    pub(crate) generation: u64,
+    /// The generation last handed out by `autosave_snapshots`.
+    pub(crate) snapshot_generation: u64,
+    /// Why the document cannot be edited (e.g. encryption), if so.
+    pub read_only_reason: Option<String>,
+    /// Interactive form fields of the current state (empty without a form).
+    pub form: Arc<Vec<pdfcraft_forms::Field>>,
+    pub(crate) marker_scan: OnceLock<pdfcraft_edit::MarkerScan>,
+    pub(crate) links: OnceLock<Vec<pdfcraft_annot::links::LinkItem>>,
+    /// Signature fields, validated against the session's trust store (Signatures panel).
+    pub signatures: Arc<Vec<SignatureInfo>>,
+    pub(crate) trust: Arc<TrustStore>,
+    pub(crate) sig_cache: Arc<pdfcraft_sign::DigestCache>,
+    pub(crate) editor: Option<Editor>,
+    pub(crate) config: RenderConfig,
+    /// What field scripts printed or asked for (see [`Session::take_js_output`]).
+    pub(crate) js_output: js::JsOutput,
+    /// Dynamic XFA forms: what laying the template out produced (pages and fields are
+    /// PdfCraft's; Adobe's viewers draw the form from the XFA packets themselves).
+    pub xfa: Option<XfaLayout>,
+    /// The parsed template of a laid-out XFA form, for its scripts.
+    pub(crate) xfa_template: Option<Arc<pdfcraft_xfa::model::Template>>,
+    /// A script of the XFA form ran away, so its scripts are off (see [`Document::xfa_scripts_off`]).
+    pub(crate) xfa_scripts_off: bool,
+    /// A content-only refresh keeps `info` from before the edit; an edit may have added or
+    /// embedded fonts, so the font list is read again on demand ([`Session::refresh_fonts`]).
+    pub(crate) fonts_stale: bool,
+    /// XFA forms: what was approximated, rewritten or could not be written to the XFA data
+    /// (also in `info.warnings`, kept there when the document is re-read).
+    pub xfa_warnings: Vec<String>,
+    /// What the last successful [`Session::apply`](crate::Session::apply) wrote that its fonts can't draw: kept as typed,
+    /// drawn with `?` in its place (see [`TextNotice`]). The interface shows it; tools return it.
+    pub edit_notices: Vec<TextNotice>,
+}
+
+/// Text an edit stored as typed but drew with `?` in place of `ch`, because the font it is drawn
+/// with (a form field's, or the standard fonts for comments) can't draw that character. Acrobat
+/// keeps such text too, drawing it with fonts PdfCraft can't embed yet.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct TextNotice {
+    /// The form field's full name, or `None` for a comment.
+    pub field: Option<String>,
+    /// The page (0-based) of the comment or of the field's widget.
+    pub page: usize,
+    pub ch: char,
+    /// Other PDF viewers redraw it from the stored text (a form field, with `/NeedAppearances`
+    /// set); otherwise the `?` shows in every viewer.
+    pub redrawn_elsewhere: bool,
+}
+
+impl std::fmt::Display for TextNotice {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let ch = format!("\"{}\" (U+{:04X})", self.ch.escape_debug(), u32::from(self.ch));
+        let page = self.page + 1;
+        match (&self.field, self.redrawn_elsewhere) {
+            (Some(name), true) => write!(
+                f,
+                "form field {name:?} (page {page}) holds {ch}, which its font can't draw: the value is saved, PdfCraft shows ? in its place, and other PDF viewers redraw the field from the value"
+            ),
+            (Some(name), false) => write!(
+                f,
+                "form field {name:?} (page {page}) holds {ch}, which its font can't draw: the value is saved, but this PDF/A document can't ask other viewers to redraw it, so ? shows in its place everywhere"
+            ),
+            (None, _) => write!(
+                f,
+                "a comment on page {page} has {ch}, which the standard fonts can't draw: its text is saved, but its appearance shows ? in its place in every viewer"
+            ),
+        }
+    }
+}
+
+/// What `next` drew with `?` that `prev` didn't (a new or redrawn appearance carrying
+/// `pdfcraft_fonts::UNDRAWN_MARK`), one notice per field or comment, in page order.
+pub(crate) fn undrawn_notices(prev: &pdfcraft_cos::Document, next: &pdfcraft_cos::Document) -> Vec<TextNotice> {
+    let Ok(pages) = pdfcraft_annot::page_refs(next) else { return Vec::new() };
+    let redrawn_elsewhere = pdfcraft_forms::need_appearances(next);
+    let mut names: Option<std::collections::HashMap<pdfcraft_cos::ObjRef, String>> = None;
+    let mut out: Vec<TextNotice> = Vec::new();
+    for (page, p) in pages.iter().enumerate() {
+        let annots = next.get(*p).as_dict().and_then(|d| d.get(b"Annots").cloned()).map(|a| next.resolve(&a));
+        for r in annots.as_deref().and_then(pdfcraft_cos::Object::as_array).into_iter().flatten().filter_map(pdfcraft_cos::Object::as_ref) {
+            let now = next.get(r);
+            let Some(d) = now.as_dict() else { continue };
+            let Some(ch) = pdfcraft_fonts::undrawn_mark(d) else { continue };
+            // Only what this edit drew: a new annotation, or a new appearance.
+            let was = prev.get(r);
+            if was.as_dict().is_some_and(|w| w.get(b"AP") == d.get(b"AP") && pdfcraft_fonts::undrawn_mark(w) == Some(ch)) {
+                continue;
+            }
+            let field = (d.name(b"Subtype") == Some(b"Widget")).then(|| {
+                let names = names.get_or_insert_with(|| {
+                    pdfcraft_forms::fields(next)
+                        .into_iter()
+                        .flat_map(|f| f.widgets.iter().map(|w| (w.obj, f.name.clone())).collect::<Vec<_>>())
+                        .collect()
+                });
+                names.get(&r).cloned().unwrap_or_default()
+            });
+            if field.is_some() && out.iter().any(|n| n.field == field) {
+                continue;
+            }
+            out.push(TextNotice { redrawn_elsewhere: redrawn_elsewhere && field.is_some(), field, page, ch });
+        }
+    }
+    out
+}
+
+impl Document {
+    /// How the document opens (Document Properties ▸ Initial View).
+    /// Accessibility ▸ Check for accessibility: the full check (`None` if the document can't be
+    /// read for editing).
+    pub fn accessibility_check(&self, options: &a11y::Options) -> Option<a11y::Report> {
+        self.editor.as_ref().map(|e| a11y::check(&e.cos, options))
+    }
+
+    /// A script of this XFA form ran past its time limit and was abandoned, so the form's
+    /// scripts no longer run in this document (reopening it runs them again). The script's
+    /// error is in the JavaScript output; this is the state, for a viewer to show.
+    pub fn xfa_scripts_off(&self) -> bool {
+        self.xfa_scripts_off
+    }
+
+    /// PDF Optimizer ▸ Audit space usage.
+    pub fn audit_space(&self) -> Vec<optimize::SpaceUse> {
+        self.editor.as_ref().map(|e| optimize::audit_space(&e.cos, self.bytes.len() as u64)).unwrap_or_default()
+    }
+
+    /// Edit a PDF: the images `page` draws (0-based).
+    pub fn page_images(&self, page: usize) -> Vec<pdfcraft_edit::PageImage> {
+        self.editor.as_ref().and_then(|e| pdfcraft_edit::page_images(&e.cos, page).ok()).unwrap_or_default()
+    }
+
+    /// Mixed editable objects on one page. Source inventories are zero-based and added items
+    /// appear once. Rectangles are user-space points, independent of the viewer's zoom.
+    pub fn editable_objects(&self, page: usize) -> Result<Vec<EditableObject>, String> {
+        let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+        pdfcraft_edit::editable_objects(&editor.cos, page).map_err(|e| e.to_string())
+    }
+
+    /// Displayed top-left-origin motion to a user-space vector. Use the linear map only,
+    /// so even a large crop-box origin cannot erase a small drag by cancellation.
+    pub fn object_move_offset(&self, page: usize, delta: [f64; 2]) -> Result<[f64; 2], String> {
+        let p = self.info.pages.get(page).ok_or("the page no longer exists")?;
+        let [x0, y0, x1, y1] = p.crop.map(f64::from);
+        let (a, b) = (delta[0] / f64::from(p.width.max(1e-3)), delta[1] / f64::from(p.height.max(1e-3)));
+        let (u, v) = match p.rotation {
+            90 => (b, -a),
+            180 => (-a, -b),
+            270 => (-b, a),
+            _ => (a, b),
+        };
+        let offset = [u * (x1 - x0), -v * (y1 - y0)];
+        if !offset.iter().all(|v| v.is_finite()) {
+            return Err("the move must be finite and non-zero".into());
+        }
+        Ok(offset)
+    }
+
+    /// Save image as: image `index` on `page` as a file (extension, bytes).
+    pub fn page_image_file(&self, page: usize, index: usize) -> Result<(&'static str, Vec<u8>), String> {
+        self.check_copying().map_err(|e| e.to_string())?;
+        let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+        let img = self.page_images(page).into_iter().nth(index).ok_or_else(|| format!("page {} has no image {}", page + 1, index + 1))?;
+        if img.is_form {
+            return Err("grouped Form artwork is not a bitmap; Save Image As is only available for raster images".into());
+        }
+        pdfcraft_create::image_file(&editor.cos, img.object.ok_or("the image has no object")?)
+    }
+
+    /// Edit a PDF ▸ Edit text: the paragraphs on `page` (0-based).
+    pub fn text_blocks(&self, page: usize) -> Vec<pdfcraft_edit::TextBlock> {
+        self.editor.as_ref().and_then(|e| e.text_blocks(page).ok()).map(|b| b.as_ref().clone()).unwrap_or_default()
+    }
+
+    /// Saved measurement annotations, calculated from their geometry and PDF scales, plus
+    /// the ones that couldn't be read (unsupported formats are skipped, not fatal).
+    pub fn measurements(&self) -> Result<measure::Listing, String> {
+        let e = self.editor.as_ref().ok_or("the document can't be read")?;
+        Ok(measure::list(&e.cos))
+    }
+    pub fn measurement_scale(&self, page: usize, at: measure::Point) -> Result<measure::Scale, String> {
+        let e = self.editor.as_ref().ok_or("the document can't be read")?;
+        measure::scale_at(&e.cos, page, at).map_err(|e| e.to_string())
+    }
+    /// [`Self::measurement_scale`], measuring true size in `unit` (`per_point` of them in a
+    /// point) where the page sets no scale.
+    pub fn measurement_scale_or(&self, page: usize, at: measure::Point, per_point: f64, unit: &str) -> Result<measure::Scale, String> {
+        let e = self.editor.as_ref().ok_or("the document can't be read")?;
+        measure::scale_at_or(&e.cos, page, at, per_point, unit).map_err(|e| e.to_string())
+    }
+    pub fn measurement_to_user(&self, page: usize, point: measure::Point) -> Result<measure::Point, String> {
+        let e = self.editor.as_ref().ok_or("the document can't be read")?;
+        measure::view_to_user(&e.cos, page, point).map_err(|e| e.to_string())
+    }
+    pub fn measurement_to_view(&self, page: usize, point: measure::Point) -> Result<measure::Point, String> {
+        let e = self.editor.as_ref().ok_or("the document can't be read")?;
+        measure::user_to_view(&e.cos, page, point).map_err(|e| e.to_string())
+    }
+    pub fn measurement_paths(&self, page: usize) -> Result<measure::snap::Geometry, String> {
+        let e = self.editor.as_ref().ok_or("the document can't be read")?;
+        measure::snap::geometry(&e.cos, page).map_err(|e| e.to_string())
+    }
+
+    /// A counter that changes with every edit (for caches of derived data).
+    pub fn edit_generation(&self) -> u64 {
+        self.generation
+    }
+
+    /// Edit a PDF ▸ Edit text: the lines of existing text on `page` (0-based).
+    pub fn text_lines(&self, page: usize) -> Vec<pdfcraft_edit::TextLine> {
+        self.editor.as_ref().and_then(|e| pdfcraft_edit::text_lines(&e.cos, page).ok()).unwrap_or_default()
+    }
+
+    /// The form's calculation order: its calculated fields in the order they calculate, what each
+    /// formula reads, what is wrong with the order, and the order Fix order writes.
+    pub fn calculation_order(&self) -> CalculationOrder {
+        self.editor.as_ref().map(|e| pdfcraft_forms::calculation_order(&e.cos, &self.form)).unwrap_or_default()
+    }
+
+    /// Add alternate text: the figures, in document order.
+    pub fn figures(&self) -> Vec<a11y::Figure> {
+        self.editor.as_ref().map(|e| a11y::figures(&e.cos)).unwrap_or_default()
+    }
+
+    /// Reachable indirect structure tags, in document order.
+    pub fn tags(&self) -> Vec<a11y::TagInfo> {
+        self.editor.as_ref().map(|e| a11y::tags(&e.cos)).unwrap_or_default()
+    }
+
+    /// Marked-content items directly owned by one reachable indirect structure tag.
+    pub fn tag_content(&self, object: pdfcraft_cos::ObjRef) -> Result<Vec<a11y::TagContentItem>, a11y::TagError> {
+        self.editor.as_ref().map(|e| a11y::tag_content(&e.cos, object)).unwrap_or_else(|| Ok(Vec::new()))
+    }
+
+    /// The edit that fixes `rule`, for the rules with an automatic fix: the document language
+    /// (`value` is the language), the title (`value` replaces it; else the current title or the
+    /// file name) and the tab order.
+    pub fn accessibility_fix(&self, rule: a11y::Rule, value: Option<&str>) -> Result<Edit, String> {
+        let value = value.map(str::trim).filter(|v| !v.is_empty());
+        match rule {
+            a11y::Rule::PrimaryLanguage => {
+                let mut v = self.initial_view();
+                v.language = Some(value.ok_or("give the document language (for example en-US)")?.to_owned());
+                Ok(Edit::SetInitialView(Box::new(v)))
+            }
+            a11y::Rule::Title => {
+                let title = value
+                    .map(str::to_owned)
+                    .or_else(|| self.info_value("Title").filter(|t| !t.trim().is_empty()))
+                    .unwrap_or_else(|| self.name.trim_end_matches(".pdf").trim_end_matches(".PDF").to_owned());
+                let mut v = self.initial_view();
+                v.display_title = true;
+                Ok(Edit::Batch {
+                    label: "Set document title".into(),
+                    edits: vec![Edit::SetInfo { key: "Title".into(), value: title }, Edit::SetInitialView(Box::new(v))],
+                })
+            }
+            a11y::Rule::TabOrder => Ok(Edit::SetTabOrder { pages: (0..self.info.pages.len()).collect(), order: TabOrder::Structure }),
+            other => Err(format!("\"{}\" has no automatic fix", other.name())),
+        }
+    }
+
+    pub fn initial_view(&self) -> InitialView {
+        self.editor.as_ref().map(|e| pdfcraft_organize::initial_view(&e.cos)).unwrap_or_default()
+    }
+
+    /// Signed: at least one signature field holds a signature.
+    pub fn is_signed(&self) -> bool {
+        self.signatures.iter().any(|s| s.signed)
+    }
+
+    /// Whether comments are hidden (Comments ▸ Hide all comments).
+    pub fn comments_hidden(&self) -> bool {
+        self.config.hide_comments
+    }
+
+    pub fn can_undo(&self) -> Option<&str> {
+        self.undo_label().map(Label::as_str)
+    }
+
+    pub fn can_redo(&self) -> Option<&str> {
+        self.redo_label().map(Label::as_str)
+    }
+
+    /// What Undo would undo, in parts, for an interface that says it in another language.
+    pub fn undo_label(&self) -> Option<&Label> {
+        self.editor.as_ref().and_then(|e| e.undo.last()).map(|(l, ..)| l)
+    }
+
+    /// What Redo would redo, in parts.
+    pub fn redo_label(&self) -> Option<&Label> {
+        self.editor.as_ref().and_then(|e| e.redo.last()).map(|(l, ..)| l)
+    }
+
+    pub fn editable(&self) -> bool {
+        self.editor.is_some()
+    }
+
+    /// What the opening password allows; `None` when the document is not encrypted.
+    pub fn permissions(&self) -> Option<pdfcraft_cos::Permissions> {
+        self.editor.as_ref().and_then(|e| e.cos.permissions())
+    }
+
+    /// Printing is allowed (Table 22, bit 3).
+    pub fn allows_printing(&self) -> bool {
+        self.permissions().is_none_or(|p| p.print())
+    }
+
+    /// Copying or otherwise extracting text and images is allowed (Table 22, bit 5): copying
+    /// selected text, snapshots, Save Image As, exporting. Assistive technology may read the
+    /// content regardless (§7.6.4.2), so reading aloud and accessibility tools don't ask.
+    pub fn allows_copying(&self) -> bool {
+        self.permissions().is_none_or(|p| p.copy())
+    }
+
+    /// [`Self::allows_copying`], as the error to report when it isn't.
+    pub fn check_copying(&self) -> Result<(), EditError> {
+        if self.allows_copying() { Ok(()) } else { Err(EditError::NotPermitted("copying text and images")) }
+    }
+
+    /// Page changes (insert, delete, rotate, move, extract) are allowed.
+    pub fn allows_assembly(&self) -> bool {
+        self.editable() && self.permissions().is_none_or(|p| p.assemble())
+    }
+
+    /// Redaction marks waiting to be applied.
+    pub fn redaction_marks(&self) -> usize {
+        self.info.annotations.iter().filter(|a| a.subtype == "Redact").count()
+    }
+
+    /// Page marks present (headers and footers, watermarks, backgrounds), for Update/Remove.
+    pub fn marks(&self) -> &[MarkKind] {
+        &self
+            .marker_scan
+            .get_or_init(|| {
+                self.editor
+                    .as_ref()
+                    .map(|e| {
+                        #[cfg(test)]
+                        record_marker_scan();
+                        pdfcraft_edit::scan_markers(&e.cos)
+                    })
+                    .unwrap_or_default()
+            })
+            .marks
+    }
+
+    /// Text and images added with Edit a PDF ▸ Add content (still editable).
+    pub fn added(&self) -> &[pdfcraft_edit::Added] {
+        &self
+            .marker_scan
+            .get_or_init(|| {
+                self.editor
+                    .as_ref()
+                    .map(|e| {
+                        #[cfg(test)]
+                        record_marker_scan();
+                        pdfcraft_edit::scan_markers(&e.cos)
+                    })
+                    .unwrap_or_default()
+            })
+            .added
+    }
+
+    /// Link annotations, for Edit a PDF ▸ Link.
+    pub fn links(&self) -> &[pdfcraft_annot::links::LinkItem] {
+        self.links.get_or_init(|| {
+            self.editor
+                .as_ref()
+                .map(|e| {
+                    #[cfg(test)]
+                    record_link_scan();
+                    pdfcraft_annot::links::list(&e.cos)
+                })
+                .unwrap_or_default()
+        })
+    }
+
+    /// Changes to content and document information are allowed.
+    pub fn allows_modification(&self) -> bool {
+        self.editable() && self.permissions().is_none_or(|p| p.modify())
+    }
+
+    /// How widget `widget` of text field `name` lays its value out, for asking whether a typed
+    /// value fits it ([`form_appearance::TextBox::fits`]): a field that doesn't scroll takes no
+    /// more than fits. `None` without such a field or widget, or when the document can't be
+    /// edited.
+    pub fn field_text_box(&self, name: &str, widget: usize) -> Option<form_appearance::TextBox> {
+        let cos = &self.editor.as_ref()?.cos;
+        let f = self.form.iter().find(|f| f.name == name)?;
+        let w = f.widgets.get(widget)?;
+        Some(form_appearance::text_box(cos, f, w))
+    }
+
+    /// Filling in form fields is allowed (Table 22, bits 6 and 9).
+    pub fn allows_form_filling(&self) -> bool {
+        self.editable() && self.permissions().is_none_or(|p| p.fill_forms())
+    }
+
+    /// Adding and changing comments is allowed (Table 22, bit 6).
+    pub fn allows_annotation(&self) -> bool {
+        self.editable() && self.permissions().is_none_or(|p| p.annotate())
+    }
+
+    /// The document's security may be changed (Protect, Remove security): it is editable and,
+    /// if encrypted, was opened with the owner password.
+    pub fn allows_security_change(&self) -> bool {
+        self.editable() && self.permissions().is_none_or(|p| unrestricted(&p))
+    }
+
+    /// A password restricts the document and it wasn't opened with the owner password: entering
+    /// that password ([`Session::unlock`](crate::Session::unlock)) lifts the restrictions.
+    pub fn can_unlock(&self) -> bool {
+        self.editable() && self.permissions().is_some_and(|p| !unrestricted(&p))
+    }
+
+    /// A summary of the document's security for Document Properties ▸ Security, including
+    /// protection applied in this session (written by the next save).
+    pub fn security_summary(&self) -> Option<SecuritySummary> {
+        let editor = self.editor.as_ref()?;
+        let h = editor.cos.output_handler()?;
+        let d = h.dict();
+        let stream = d.crypt_filters.iter().find(|(name, _)| *name == d.stm_f).map(|(_, m)| *m);
+        let method = match (d.v, stream) {
+            (1..=3, _) if d.length_bits <= 40 => "RC4, 40-bit",
+            (1..=3, _) | (_, Some(pdfcraft_cos::CryptMethod::Rc4)) => "RC4, 128-bit",
+            (_, Some(pdfcraft_cos::CryptMethod::Aes128)) => "AES, 128-bit",
+            (_, Some(pdfcraft_cos::CryptMethod::Aes256)) => "AES, 256-bit",
+            _ => "Attachments only",
+        };
+        let pending = editor.cos.encryption_changed();
+        let permissions = if pending { pdfcraft_cos::Permissions { bits: h.permissions().bits, owner: false } } else { h.permissions() };
+        Some(SecuritySummary { method: method.into(), owner: h.auth() == pdfcraft_cos::Auth::Owner && !pending, permissions, pending })
+    }
+
+    /// Comment properties of the comment at `(page, index)` (Comment Properties dialog).
+    pub fn comment_props(&self, page: usize, index: usize) -> Option<pdfcraft_annot::Props> {
+        self.editor.as_ref().and_then(|e| pdfcraft_annot::props(&e.cos, page, index))
+    }
+
+    /// A form field's Appearance-tab look (borders, colours, font).
+    pub fn field_look(&self, name: &str) -> Option<pdfcraft_forms::Look> {
+        let e = self.editor.as_ref()?;
+        let f = self.form.iter().find(|f| f.name == name)?;
+        Some(pdfcraft_forms::look(&e.cos, f))
+    }
+
+    /// A check box's or radio button's mark (Field Properties ▸ Options), `None` for other fields.
+    pub fn field_check_style(&self, name: &str) -> Option<CheckStyle> {
+        let e = self.editor.as_ref()?;
+        let f = self.form.iter().find(|f| f.name == name)?;
+        matches!(f.kind, FormFieldKind::CheckBox | FormFieldKind::Radio).then(|| pdfcraft_forms::check_style(&e.cos, f))
+    }
+
+    /// Whether text field `name`'s value is cut off by its box at the field's font size (#4018):
+    /// the page (0-based) of the first widget that cuts it, and how.
+    pub fn field_overflow(&self, name: &str) -> Option<(Option<usize>, pdfcraft_forms::appearance::Overflow)> {
+        let e = self.editor.as_ref()?;
+        let f = self.form.iter().find(|f| f.name == name)?;
+        f.widgets.iter().find_map(|w| pdfcraft_forms::appearance::value_overflow(&e.cos, f, w).map(|o| (w.page, o)))
+    }
+
+    /// Remove Hidden Information: what each category would remove.
+    pub fn hidden_info(&self) -> Vec<(Hidden, usize)> {
+        self.editor.as_ref().map(|e| pdfcraft_redact::sanitize::scan(&e.cos)).unwrap_or_default()
+    }
+
+    /// Verification: faux redactions (opaque covers over extractable text) and redaction
+    /// marks that were never applied. Fails closed: any read error is returned, never an
+    /// empty list.
+    pub fn audit_redactions(&self) -> Result<Vec<pdfcraft_audit::AuditFinding>, String> {
+        let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+        pdfcraft_audit::audit_redactions(&editor.cos).map_err(|e| e.to_string())
+    }
+
+    /// Every page's media, crop, bleed, trim and art boxes (user space), for Set Page Boxes.
+    pub fn page_boxes(&self) -> Vec<[[f64; 4]; 5]> {
+        self.editor.as_ref().and_then(|e| pdfcraft_organize::page_boxes(&e.cos).ok()).unwrap_or_default()
+    }
+
+    /// Current value of a document-information entry (Title, Author, …).
+    pub fn info_value(&self, key: &str) -> Option<String> {
+        self.editor.as_ref().and_then(|e| pdfcraft_organize::info(&e.cos, key))
+    }
+
+    /// Whether the document information has an entry `key`, of any type, listed or not.
+    pub fn has_info(&self, key: &str) -> bool {
+        self.editor.as_ref().is_some_and(|e| pdfcraft_organize::has_info(&e.cos, key))
+    }
+
+    /// The custom document properties as they are now (name, text), Document Properties ▸ Custom.
+    pub fn custom_info(&self) -> Vec<(String, String)> {
+        self.editor.as_ref().map(|e| pdfcraft_organize::custom_info(&e.cos)).unwrap_or_default()
+    }
+
+    /// The name shown on the tab and window: the document title when the document asks for it
+    /// (Initial View ▸ Show: Document Title) and has a real one, else the file name.
+    pub fn display_name(&self) -> String {
+        self.editor
+            .as_ref()
+            .filter(|e| pdfcraft_organize::displays_doc_title(&e.cos))
+            .and_then(|e| pdfcraft_organize::info(&e.cos, "Title"))
+            .map(|t| t.trim().to_owned())
+            .filter(|t| !t.is_empty() && !is_placeholder_title(t))
+            .unwrap_or_else(|| self.name.clone())
+    }
+
+    /// Where each saved revision of the file ends (oldest first; `bytes[..end]` is that
+    /// revision). Unsaved edits aren't a revision yet.
+    pub fn revision_ends(&self) -> Vec<usize> {
+        self.editor.as_ref().map(|e| e.cos.revision_ends()).unwrap_or_default()
+    }
+
+    /// The file as last opened or saved, without unsaved edits: what an incremental save appends
+    /// to. This stays that file when undo has restored an older snapshot.
+    pub fn saved_bytes(&self) -> Arc<Vec<u8>> {
+        self.editor.as_ref().map_or_else(|| self.bytes.clone(), |e| e.saved.clone())
+    }
+
+    /// Notes about damage repaired while opening (Document Properties ▸ Advanced, notices).
+    pub fn repair_log(&self) -> Vec<String> {
+        self.editor.as_ref().map(|e| e.cos.repair_log().to_vec()).unwrap_or_default()
+    }
+}
+
+/// A title that names no document: what a web browser writes when it saves a blank page or a
+/// pop-up as PDF (`about:blank`), another browser-internal address, or a bare "Untitled". Such a
+/// title says less than the file name, so the file name is shown instead. An address is one
+/// word: "About: our company" is a real title.
+pub(crate) fn is_placeholder_title(title: &str) -> bool {
+    let t = title.trim().to_lowercase();
+    let address = !t.contains(char::is_whitespace) && ["about:", "blob:", "data:"].iter().any(|p| t.starts_with(p));
+    address || t == "untitled"
+}
+
+/// The working file plus appearances for comments that have none, and for form fields the file
+/// leaves to the viewer (#3470). Signature artwork is preserved; validation badges belong to the
+/// viewer and never enter these bytes, which image/text exports and Print as Image also consume.
+pub(crate) fn display_bytes(editor: Option<&mut Editor>, bytes: &Arc<Vec<u8>>) -> Arc<Vec<u8>> {
+    let Some(e) = editor else { return bytes.clone() };
+    let comments = pdfcraft_annot::with_missing_appearances_cached(&e.cos, &mut e.appearances);
+    let fields = pdfcraft_forms::with_field_appearances_cached(comments.as_ref().unwrap_or(&e.cos), &mut e.field_appearances);
+    let Some(display) = fields.or(comments) else {
+        return bytes.clone();
+    };
+    match write_incremental(&display, &SaveOptions::default()) {
+        Ok(written) => Arc::new(written),
+        Err(err) => {
+            e.cos.note_repair(format!("missing comment or field appearances could not be drawn ({err})"));
+            bytes.clone()
+        }
+    }
+}
+
+/// `comments` (the display copy with comment appearances, if it needed any; else the document
+/// itself) with its form fields drawn from their values where the file leaves that to the viewer.
+fn with_field_appearances(comments: Option<pdfcraft_cos::Document>, doc: &pdfcraft_cos::Document) -> Option<pdfcraft_cos::Document> {
+    pdfcraft_forms::with_field_appearances(comments.as_ref().unwrap_or(doc)).or(comments)
+}
+
+/// The reader shows the same pages in `a` and `b`: count, displayed size and rotation.
+pub(crate) fn same_pages(a: &[pdfcraft_render::PageInfo], b: &[pdfcraft_render::PageInfo]) -> bool {
+    a.len() == b.len()
+        && a.iter().zip(b).all(|(x, y)| (x.width - y.width).abs() < 0.01 && (x.height - y.height).abs() < 0.01 && x.rotation == y.rotation)
+}
+
+/// Each document-information field of `info` with its value in `cos` (`/Info`, else XMP), read
+/// the way the full inspection reads them: NULs and spaces trimmed, empty is none.
+pub(crate) fn info_fields<'a>(info: &'a mut DocInfo, cos: &pdfcraft_cos::Document) -> [(&'a mut Option<String>, Option<String>); 6] {
+    let read = |key| pdfcraft_organize::info(cos, key).map(|v| v.trim_matches('\0').trim().to_string()).filter(|v| !v.is_empty());
+    [
+        (&mut info.title, read("Title")),
+        (&mut info.author, read("Author")),
+        (&mut info.subject, read("Subject")),
+        (&mut info.keywords, read("Keywords")),
+        (&mut info.creator, read("Creator")),
+        (&mut info.producer, read("Producer")),
+    ]
+}
+
+/// The copy PDFCraft displays when opening `bytes`: with appearances drawn, in memory only, for
+/// comments that have none and form fields the file leaves to the viewer. Render paths outside the app, such as the CLI, use this so their page
+/// images agree with the app and independent viewers. It never changes the source document, and an
+/// unparseable file, a write failure or a parser panic falls back to the original bytes.
+pub fn display_bytes_for(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Arc<Vec<u8>> {
+    guard(|| {
+        pdfcraft_cos::Document::open_with_password(bytes.clone(), password)
+            .ok()
+            .and_then(|cos| with_field_appearances(pdfcraft_annot::with_missing_appearances(&cos), &cos))
+            .and_then(|display| write_incremental(&display, &SaveOptions::default()).ok())
+            .map(Arc::new)
+    })
+    .ok()
+    .flatten()
+    .unwrap_or(bytes)
+}
+
+/// The password to give the renderer (`inspect`, `PageRenderer`) for `bytes` opened with
+/// `password`. The renderer authenticates only the user password of R2–R4 files, so for their
+/// owner password this is the user password that owner authentication recovers; otherwise it is
+/// `password` itself. Render paths outside a [`Session`](crate::Session), such as the CLI, use this so the owner
+/// password works there as it does in `doc_open`. A file that doesn't open with `password` keeps
+/// it, so the renderer reports the same error it always did.
+pub fn render_password_for(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Option<String> {
+    let password = password?;
+    let recovered =
+        guard(|| pdfcraft_cos::Document::open_with_password(bytes, Some(password)).ok().and_then(|d| recovered_render_password(&d))).ok().flatten();
+    Some(recovered.unwrap_or_else(|| password.to_owned()))
+}
+
+/// The user password owner authentication recovered from an R2–R4 `cos`, as the renderer takes it.
+pub(crate) fn recovered_render_password(cos: &pdfcraft_cos::Document) -> Option<String> {
+    cos.security().and_then(|s| s.recovered_user_password()).map(|user| renderer_password(&user))
+}
+
+/// Fails when the renderer still draws text under an applied redaction mark.
+///
+/// Redaction decides what lies under a mark from the positions its own interpreter computes, and
+/// its verify pass reuses them. Where they differ from the renderer's (a standard font without
+/// /Widths, whose advances the interpreter approximates; a CMap
+/// that it reads differently), a mark drawn over the text as displayed lies over glyphs the
+/// interpreter believes are elsewhere: they stay in the file and nothing notices. The renderer is
+/// what the user saw when placing the marks, so it is asked. `after` is written as a save would
+/// write it, without the marks' own `overlays` (the box and its label are drawn on purpose), its
+/// text is extracted, and a glyph still mostly inside a mark fails the edit: the caller keeps
+/// the document as it was.
+pub(crate) fn shown_under_redactions(
+    after: &pdfcraft_cos::Document,
+    marks: &[pdfcraft_redact::Mark],
+    overlays: &[pdfcraft_cos::ObjRef],
+    pages: &[pdfcraft_render::PageInfo],
+    password: Option<&str>,
+) -> Result<(), EditError> {
+    use pdfcraft_cos::Object;
+    use pdfcraft_redact::RedactError;
+    let mut marked: Vec<usize> = marks.iter().map(|m| m.page).collect();
+    marked.sort_unstable();
+    marked.dedup();
+    if marked.is_empty() {
+        return Ok(());
+    }
+    let mut shown = after.clone();
+    let model = pdfcraft_model::pages(&shown);
+    for &pi in &marked {
+        let Some(page) = model.get(pi) else { continue };
+        let Some(Object::Array(list)) = page.dict.get(b"Contents").map(|c| (*shown.resolve(c)).clone()) else { continue };
+        let kept: Vec<Object> = list.into_iter().filter(|o| !o.as_ref().is_some_and(|r| overlays.contains(&r))).collect();
+        shown.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(kept))).map_err(|e| EditError::Write(e.to_string()))?;
+    }
+    let bytes = write_incremental(&shown, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?;
+    let config = RenderConfig { password: password.map(Arc::from), ..Default::default() };
+    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(bytes), config);
+    let mut residue = 0;
+    for &pi in &marked {
+        let request = pdfcraft_render::RenderRequest { page: pi, kind: pdfcraft_render::RequestKind::Text, scale: 1.0, ..Default::default() };
+        // A page that cannot be read back cannot be confirmed clean.
+        let (Some(info), Some(text)) = (pages.get(pi), renderer.render(request).text) else { return Err(RedactError::Unreadable(pi + 1).into()) };
+        let rects: Vec<[f64; 4]> = marks
+            .iter()
+            .filter(|m| m.page == pi)
+            .flat_map(|m| m.rects.iter())
+            .map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])])
+            .collect();
+        for glyph in text.glyphs.iter().filter(|g| !g.text.trim().is_empty()) {
+            let [x0, y0, x1, y1] = info.view_rect_to_user(glyph.rect).map(f64::from);
+            let area = (x1 - x0) * (y1 - y0);
+            if area.is_nan() || area <= 0.0 {
+                continue;
+            }
+            // Redaction itself takes any glyph a fifth under a mark; one that is half under it
+            // and still drawn was not where redaction thought it was.
+            let under = |r: &[f64; 4]| (x1.min(r[2]) - x0.max(r[0])).max(0.0) * (y1.min(r[3]) - y0.max(r[1])).max(0.0) >= 0.5 * area;
+            if rects.iter().any(under) {
+                residue += 1;
+            }
+        }
+    }
+    if residue > 0 {
+        return Err(RedactError::Residue(residue).into());
+    }
+    Ok(())
+}
diff --git a/crates/engine/src/edit.rs b/crates/engine/src/edit.rs
new file mode 100644
index 0000000000..c31984ca19
--- /dev/null
+++ b/crates/engine/src/edit.rs
@@ -0,0 +1,553 @@
+//! The edits a document takes: what each is called, whether its permissions allow it, and running it.
+
+use std::sync::Arc;
+
+use crate::{
+    AddedContent, AddedText, Background, BoxSpec, EditError, FieldProps, FieldValue, FillMark, HeaderFooter, Hidden, ImageEdit, InitialView, Label,
+    LineEnding, LinkAction, LinkStyle, MarkFile, MarkKind, Markup, NewAnnotation, NewField, NoteIcon, ObjectTarget, PageBox, Protection, ReviewState,
+    Rgb, Shape, Standard, Style, TabOrder, TransitionSpec, Watermark, a11y, copy_image, decode_data_file, embed_image, field_table, fit_picture,
+    image_content_type, is_xfa_data_file, js, mark_source, measure, open_source, strip_xfa, unrestricted, xfa, xfa_after_data_change,
+};
+
+mod labels;
+mod run;
+
+pub use labels::{BATCH_LABELS, EDIT_LABELS};
+pub(crate) use run::{EditCtx, check_permission, run_edit};
+
+/// Edits that can be applied to a document. Page indices are 0-based.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Edit {
+    RotatePages {
+        pages: Vec<usize>,
+        degrees: i64,
+    },
+    DeletePages {
+        pages: Vec<usize>,
+    },
+    MovePages {
+        pages: Vec<usize>,
+        to: usize,
+    },
+    /// `pages` reversed among the positions they occupy.
+    ReversePages {
+        pages: Vec<usize>,
+    },
+    InsertBlankPage {
+        at: usize,
+        width: f64,
+        height: f64,
+    },
+    /// Copies of `pages` inserted at `at` (an index in the page order as it is now), or after
+    /// the last of them when `at` is `None`.
+    DuplicatePages {
+        pages: Vec<usize>,
+        at: Option<usize>,
+    },
+    /// Replace Pages: the content of `pages` is replaced by `src_pages` of another PDF; the
+    /// pages' links, comments and bookmarks stay.
+    ReplacePages {
+        pages: Vec<usize>,
+        name: String,
+        bytes: Arc<Vec<u8>>,
+        src_pages: Vec<usize>,
+    },
+    /// Set Page Boxes / Crop: set (or reset) one box on `pages`.
+    SetPageBox {
+        pages: Vec<usize>,
+        which: PageBox,
+        spec: BoxSpec,
+    },
+    /// Set or remove the page transition and display time of pages (ISO 32000-2 §12.4.4),
+    /// Organize ▸ Page Transitions.
+    SetTransition {
+        pages: Vec<usize>,
+        spec: TransitionSpec,
+    },
+    SetInfo {
+        key: String,
+        value: String,
+    },
+    /// Insert pages from another PDF (all pages when `pages` is `None`) at position `at`.
+    InsertPagesFrom {
+        name: String,
+        bytes: Arc<Vec<u8>>,
+        pages: Option<Vec<usize>>,
+        at: usize,
+        /// How a form field whose name the document already uses is kept separate.
+        field_conflicts: pdfcraft_organize::FieldConflicts,
+    },
+    /// Add a bookmark to `page` as child `index` of the bookmark at `parent` (`[]` = top level).
+    /// It goes to the user-space point (`left`, `top`) of the page at the reader's zoom, and
+    /// either may be `None` to keep the reader's position that way (both `None` is the page top).
+    /// A coordinate that is not finite fails the edit.
+    AddBookmark {
+        parent: Vec<usize>,
+        index: usize,
+        title: String,
+        page: usize,
+        left: Option<f64>,
+        top: Option<f64>,
+    },
+    RenameBookmark {
+        path: Vec<usize>,
+        title: String,
+    },
+    /// Delete a bookmark and the bookmarks under it.
+    DeleteBookmark {
+        path: Vec<usize>,
+    },
+    /// Move a bookmark to child `index` of `to_parent` (indices after removing it).
+    MoveBookmark {
+        from: Vec<usize>,
+        to_parent: Vec<usize>,
+        index: usize,
+    },
+    /// Point a bookmark at another page.
+    SetBookmarkPage {
+        path: Vec<usize>,
+        page: usize,
+    },
+    /// Colour a bookmark's title (`/C`); `None` or black is the default black.
+    SetBookmarkColor {
+        path: Vec<usize>,
+        color: Option<[f64; 3]>,
+    },
+    /// Make a bookmark's title bold or italic or not (`/F`); `None` keeps that one.
+    SetBookmarkStyle {
+        path: Vec<usize>,
+        bold: Option<bool>,
+        italic: Option<bool>,
+    },
+    /// Bookmarks for the tagged headings (H, H1–H6), nested by level under a new first
+    /// "Untitled" bookmark (New Bookmarks from Structure).
+    BookmarksFromStructure,
+    /// Label pages `from..=to` (0-based) as Acrobat's "Number pages" does; later pages keep their labels.
+    NumberPages {
+        from: usize,
+        to: usize,
+        style: pdfcraft_organize::LabelStyle,
+        prefix: String,
+        first: u32,
+    },
+    /// Add a calibrated distance, perimeter or area annotation.
+    AddMeasurement(measure::NewMeasurement),
+    /// Store a drawing scale for a rectangular viewport (PDF user space).
+    SetMeasurementScale {
+        page: usize,
+        bbox: [f64; 4],
+        name: String,
+        scale: measure::Scale,
+    },
+    /// Add a comment (sticky note, highlight, shape, drawing, text box…).
+    AddAnnotation(NewAnnotation),
+    /// A custom stamp from a picture file (a PDF page or an image) on `page`. A zero-size
+    /// `rect` is a point: the stamp is centred there at its natural size (at most 200 pt).
+    /// Any other `rect` is a box: the picture is scaled to fit inside it, keeping its shape,
+    /// and centred in it (#4077).
+    AddCustomStamp {
+        page: usize,
+        rect: [f64; 4],
+        name: String,
+        file: MarkFile,
+        author: String,
+    },
+    /// Delete the comment at `index` in the page's `/Annots`, with its pop-up and replies.
+    DeleteAnnotation {
+        page: usize,
+        index: usize,
+    },
+    SetAnnotationContents {
+        page: usize,
+        index: usize,
+        text: String,
+    },
+    ReplyToAnnotation {
+        page: usize,
+        index: usize,
+        text: String,
+        author: String,
+    },
+    /// Acrobat's "Set status" (a state reply by `author`).
+    SetAnnotationStatus {
+        page: usize,
+        index: usize,
+        state: ReviewState,
+        author: String,
+    },
+    /// The Eraser: rub out the parts of drawing `(page, index)` near `path` (user space).
+    EraseInk {
+        page: usize,
+        index: usize,
+        path: Vec<[f64; 2]>,
+        radius: f64,
+    },
+    /// Replace Text: strike out `quads` and add a grouped caret holding `text`.
+    ReplaceText {
+        page: usize,
+        quads: Vec<[f64; 8]>,
+        text: String,
+        author: String,
+        strike: Style,
+        caret: Style,
+    },
+    /// Acrobat's "Mark with checkmark" (a hidden `/StateModel /Marked` reply by `author`).
+    MarkAnnotation {
+        page: usize,
+        index: usize,
+        marked: bool,
+        author: String,
+    },
+    /// Properties ▸ Locked.
+    LockAnnotation {
+        page: usize,
+        index: usize,
+        locked: bool,
+    },
+    MoveAnnotation {
+        page: usize,
+        index: usize,
+        dx: f64,
+        dy: f64,
+    },
+    /// Reshape a line, connected lines, a polygon or a cloud: its points in user space (a line's
+    /// two ends, the others' corners).
+    ReshapeAnnotation {
+        page: usize,
+        index: usize,
+        points: Vec<[f64; 2]>,
+    },
+    /// Resize a rectangle, oval or text box.
+    ResizeAnnotation {
+        page: usize,
+        index: usize,
+        rect: [f64; 4],
+    },
+    StyleAnnotation {
+        page: usize,
+        index: usize,
+        color: Option<Rgb>,
+        opacity: Option<f64>,
+        width: Option<f64>,
+        /// Line or polyline: two endings. Callout: one. `None` leaves `/LE` unchanged.
+        endings: Option<Vec<pdfcraft_annot::LineEnding>>,
+    },
+    /// Fill a rectangle, oval or polygon comment, or remove its fill (`None`).
+    FillAnnotation {
+        page: usize,
+        index: usize,
+        fill: Option<Rgb>,
+    },
+    /// Change the font size (pt) of a text box, typewriter text or callout.
+    FontSizeAnnotation {
+        page: usize,
+        index: usize,
+        size: f64,
+    },
+    /// Comment properties ▸ General / note icon.
+    SetAnnotationInfo {
+        page: usize,
+        index: usize,
+        author: Option<String>,
+        subject: Option<String>,
+        icon: Option<NoteIcon>,
+    },
+    /// Fill in a form field.
+    SetFieldValue {
+        name: String,
+        value: FieldValue,
+    },
+    /// Clear form: the named fields (all when `None`) back to their defaults.
+    ResetForm {
+        names: Option<Vec<String>>,
+    },
+    /// Prepare a form: add a field on a page (`rect` in PDF user space); `name` defaults to
+    /// Acrobat's next free name ("Text1", "Check Box2", …).
+    AddField {
+        page: usize,
+        rect: [f64; 4],
+        kind: NewField,
+        name: Option<String>,
+    },
+    /// Field Properties ▸ General / Options.
+    SetFieldProps {
+        name: String,
+        props: Box<FieldProps>,
+    },
+    /// An image field (or any button): show this image file (PNG, JPEG, TIFF, GIF, BMP).
+    SetFieldImage {
+        name: String,
+        image: Arc<Vec<u8>>,
+    },
+    /// Duplicate a field onto other pages (same field, shared value).
+    DuplicateField {
+        name: String,
+        pages: Vec<usize>,
+    },
+    DeleteField {
+        name: String,
+    },
+    /// Page properties ▸ Tab order, for pages (0-based).
+    SetTabOrder {
+        pages: Vec<usize>,
+        order: TabOrder,
+    },
+    /// Document Properties ▸ Initial View (and the language and binding).
+    SetInitialView(Box<InitialView>),
+    /// Edit ▸ Attach a file: a document-level attachment (`/Names /EmbeddedFiles`) under
+    /// `name`, made unique; `mime` is the embedded file's `/Subtype` when known.
+    AddAttachment {
+        name: String,
+        bytes: Vec<u8>,
+        description: Option<String>,
+        mime: Option<String>,
+    },
+    /// Remove the document-level attachment whose name-tree key is `key`.
+    DeleteAttachment {
+        key: String,
+    },
+    /// Build a tagged structure tree for an untagged, text-only document.
+    AutoTagText,
+    /// Add alternate text: set (or clear, with `None`) a figure's alternate text. `figure` is
+    /// the figure element's object number (from `Document::figures`).
+    SetAltText {
+        figure: u32,
+        alt: Option<String>,
+    },
+    /// Add `/Form` tags and object references for all widgets in an untagged AcroForm.
+    AutoTagFormFields,
+    /// Change one property on a reachable indirect structure tag.
+    SetTagProperty {
+        object: pdfcraft_cos::ObjRef,
+        property: a11y::TagProperty,
+        value: Option<String>,
+    },
+    /// Move a structure tag before or after a direct sibling in reading order.
+    MoveTag {
+        object: pdfcraft_cos::ObjRef,
+        anchor: pdfcraft_cos::ObjRef,
+        placement: a11y::TagPlacement,
+    },
+    /// Add alternate text ▸ Decorative figure: the figure's content becomes an artifact.
+    MarkDecorative {
+        figure: u32,
+    },
+    /// Tags panel ▸ Mark as artifact: retire a leaf tag and mark its content as an artifact.
+    MarkTagArtifact {
+        object: pdfcraft_cos::ObjRef,
+    },
+    /// Document JavaScripts: add, replace (`script`) or remove (`None`) the document-level
+    /// script `name`.
+    SetDocumentScript {
+        name: String,
+        script: Option<String>,
+    },
+    /// Field Properties ▸ a custom script: set or remove field `name`'s JavaScript for `event`
+    /// (keystroke, format, validate, calculate or mouse_up).
+    SetFieldScript {
+        name: String,
+        event: String,
+        script: Option<String>,
+    },
+    /// Standards ▸ Save as PDF/A: fix what can be fixed for `level` (metadata, output intent,
+    /// forbidden actions, annotation flags, …).
+    ConvertPdfA {
+        level: pdfcraft_preflight::Level,
+    },
+    /// Remove what identifies the document as meeting `standard` (PDF/A or PDF/X).
+    RemoveStandardId {
+        standard: Standard,
+    },
+    /// What a script (button or console) changed in form fields: values, read-only, required
+    /// and visibility.
+    ApplyScriptChanges {
+        changes: Vec<pdfcraft_forms::FieldChange>,
+    },
+    /// An XFA form's scripted event (a button's `click`, say) on the object at `som`: what the
+    /// script changes (values, rows, visibility) is applied and the form laid out again.
+    XfaEvent {
+        som: String,
+        activity: String,
+    },
+    /// Scan & OCR ▸ Recognize text: put recognised words on `page` as invisible text over the
+    /// image (from [`ocr::OcrJob::run`](crate::ocr::OcrJob::run)).
+    AddOcrText {
+        page: usize,
+        words: Vec<pdfcraft_ocr::PlacedWord>,
+    },
+    /// Edit a PDF ▸ Edit text: replace the text of line `line` (from `Document::text_lines`) on
+    /// `page`, in its own font when it can show it, else in Helvetica.
+    EditTextLine {
+        page: usize,
+        line: usize,
+        text: String,
+    },
+    /// Edit a PDF ▸ an existing image on `page` (index from `Document::page_images`).
+    EditPageImage {
+        page: usize,
+        index: usize,
+        change: ImageEdit,
+    },
+    /// Move mixed existing and added objects together. References resolve before any change;
+    /// offset is a user-space vector. No retyping, reflow or font substitution is involved.
+    MoveObjects {
+        page: usize,
+        objects: Vec<ObjectTarget>,
+        offset: [f64; 2],
+    },
+    /// Edit text in a paragraph box: replace paragraph `block` (from `Document::text_blocks`),
+    /// rewrapped to the box's width.
+    EditTextBlock {
+        page: usize,
+        block: usize,
+        text: String,
+        /// Formatting changes (font, size, colour, alignment); default keeps the paragraph's.
+        style: pdfcraft_edit::BlockStyle,
+    },
+    /// An explicit open-licensed full font program, completing subsets or selected by a user.
+    RegisterTextFont {
+        page: usize,
+        bytes: Arc<Vec<u8>>,
+    },
+    /// Order tabs manually: move a field one place earlier or later on its page.
+    MoveInTabOrder {
+        name: String,
+        earlier: bool,
+    },
+    /// Set the calculation order: these calculated fields first, in this order, then the others
+    /// in their current order (see [`Document::calculation_order`](crate::Document::calculation_order)). The form recalculates.
+    SetCalculationOrder {
+        names: Vec<String>,
+    },
+    /// Add a header and footer (with `replace`, existing ones on those pages go first).
+    AddHeaderFooter {
+        pages: Vec<usize>,
+        settings: HeaderFooter,
+        replace: bool,
+    },
+    /// `file`: a picture from a file (an image, or a page of a PDF) instead of text.
+    AddWatermark {
+        pages: Vec<usize>,
+        settings: Watermark,
+        replace: bool,
+        file: Option<MarkFile>,
+    },
+    /// `file`: a picture from a file instead of a colour.
+    AddBackground {
+        pages: Vec<usize>,
+        settings: Background,
+        replace: bool,
+        file: Option<MarkFile>,
+    },
+    /// Remove every mark of a kind from every page.
+    RemoveMarks {
+        kind: MarkKind,
+    },
+    /// Edit a PDF ▸ Add content ▸ Text (`text.rect` in display space).
+    AddText {
+        page: usize,
+        text: AddedText,
+    },
+    /// Edit a PDF ▸ Add content ▸ Image: an image file placed at `rect` (display space), or at
+    /// its natural size centred on the page (shrunk to fit).
+    AddImage {
+        page: usize,
+        rect: Option<[f64; 4]>,
+        name: String,
+        bytes: Arc<Vec<u8>>,
+    },
+    /// Move, resize, retype or reformat an added item (`index` among the page's added items).
+    UpdateContent {
+        page: usize,
+        index: usize,
+        content: AddedContent,
+    },
+    DeleteContent {
+        page: usize,
+        index: usize,
+    },
+    /// Replace an added image with another file (keeping its box and transforms).
+    ReplaceImage {
+        page: usize,
+        index: usize,
+        name: String,
+        bytes: Arc<Vec<u8>>,
+    },
+    /// Edit ▸ Paste: an added item copied in this document or another, as it was: text with its
+    /// style, an image in its box (display space) with its turns, flips and crop. An image's
+    /// picture is `file` (from [`Document::added_image_file`](crate::Document::added_image_file)): the copied image object is reused
+    /// while it is still that picture in this document, else one an added image here already draws
+    /// it from, else the file is embedded.
+    PasteContent {
+        page: usize,
+        content: AddedContent,
+        file: Option<(String, Arc<Vec<u8>>)>,
+    },
+    /// Apply redaction marks (all, or those on `pages`): remove what they cover for good.
+    ApplyRedactions {
+        pages: Option<Vec<usize>>,
+    },
+    /// Remove redaction marks without applying them.
+    ClearRedactions,
+    /// Edit a PDF ▸ Link: a new link over `rect` (user space).
+    AddLink {
+        page: usize,
+        rect: [f64; 4],
+        action: LinkAction,
+        style: LinkStyle,
+    },
+    /// Link Properties (`index` in the page's `/Annots`).
+    SetLink {
+        page: usize,
+        index: usize,
+        rect: Option<[f64; 4]>,
+        action: Option<LinkAction>,
+        style: Option<LinkStyle>,
+    },
+    DeleteLink {
+        page: usize,
+        index: usize,
+    },
+    /// Remove all links (on `pages`, or everywhere).
+    RemoveLinks {
+        pages: Option<Vec<usize>>,
+    },
+    /// Create links from URLs in the text: (page, line rects in user space, URI).
+    AddLinks {
+        links: Vec<(usize, Vec<[f64; 4]>, String)>,
+        style: LinkStyle,
+    },
+    /// Import comments and/or form data (XFDF, FDF, XML, CSV, tab-delimited text).
+    ImportData {
+        name: String,
+        bytes: Arc<Vec<u8>>,
+    },
+    /// Remove Hidden Information: the chosen categories.
+    RemoveHidden {
+        which: Vec<Hidden>,
+    },
+    /// Sanitize Document: every category, then a full rewrite on save.
+    Sanitize,
+    /// An XFA form made an ordinary (static) PDF form: the XFA packets, `/NeedsRendering` and
+    /// PdfCraft's private keys go, the pages as laid out and the fields with their values
+    /// stay, so every viewer shows the same form and none lays it out again. Its scripts no
+    /// longer run.
+    XfaToStatic,
+    /// Flatten comments and/or form fields on every page into page content.
+    Flatten {
+        comments: bool,
+        fields: bool,
+    },
+    /// Bake Fill & Sign text, marks and signatures into the page. Other comments and fields stay.
+    /// A no-op (no undo step) when the document has none.
+    FlattenFillSign,
+    /// Protect with passwords and permissions (written by the next save, which is a full rewrite).
+    Protect(Protection),
+    /// Remove password security (needs the owner password).
+    RemoveProtection,
+    /// Several edits applied as one undoable step (all or nothing).
+    Batch {
+        label: String,
+        edits: Vec<Edit>,
+    },
+}
diff --git a/crates/engine/src/edit/labels.rs b/crates/engine/src/edit/labels.rs
new file mode 100644
index 0000000000..5e25ae465b
--- /dev/null
+++ b/crates/engine/src/edit/labels.rs
@@ -0,0 +1,336 @@
+use super::*;
+
+/// Every wording [`Edit::label`] can produce, for an interface to translate. `Edit::Batch` is not
+/// here: its wording is only the hole, because a batch carries its name as text (see
+/// [`BATCH_LABELS`]).
+pub const EDIT_LABELS: &[&str] = &[
+    "Rotate page",
+    "Change tag properties",
+    "Rotate pages",
+    "Delete page",
+    "Delete pages",
+    "Move page",
+    "Move pages",
+    "Reverse pages",
+    "Insert blank page",
+    "Duplicate page",
+    "Duplicate pages",
+    "Replace page",
+    "Replace pages",
+    "Crop page",
+    "Crop pages",
+    "Set page boxes",
+    "Set page transitions",
+    "Change Title",
+    "Change Author",
+    "Change Subject",
+    "Change Keywords",
+    "Change {key}",
+    "Insert pages from {name}",
+    "Insert pages from {name} — 1 field renamed",
+    "Insert pages from {name} — fields renamed",
+    "Attach {name}",
+    "Delete attachment {key}",
+    "Add bookmark",
+    "Rename bookmark",
+    "Delete bookmark",
+    "Move bookmark",
+    "Set bookmark destination",
+    "Colour",
+    "Style",
+    "New bookmarks from structure",
+    "Number pages",
+    "Measure distance",
+    "Measure perimeter",
+    "Measure area",
+    "Set measurement scale",
+    "Add sticky note",
+    "Add highlight",
+    "Add underline",
+    "Add strikethrough",
+    "Add squiggly underline",
+    "Add rectangle",
+    "Add oval",
+    "Add arrow",
+    "Add line",
+    "Add drawing",
+    "Add text box",
+    "Add checkmark",
+    "Add cross",
+    "Add dot",
+    "Add signature",
+    "Add redaction mark",
+    "Add cloud",
+    "Add polygon",
+    "Add connected lines",
+    "Add callout",
+    "Add inserted text",
+    "Add file attachment",
+    "Add stamp",
+    "Delete comment",
+    "Edit comment",
+    "Reply",
+    "Set status None",
+    "Set status Accepted",
+    "Set status Rejected",
+    "Set status Cancelled",
+    "Set status Completed",
+    "Replace text",
+    "Erase",
+    "Mark with checkmark",
+    "Remove checkmark",
+    "Lock comment",
+    "Unlock comment",
+    "Move comment",
+    "Reshape comment",
+    "Resize comment",
+    "Change comment properties",
+    "Fill in {name}",
+    "Set the image of {name}",
+    "Clear form",
+    "Add field",
+    "Change field properties",
+    "Delete field",
+    "Duplicate field",
+    "Set tab order",
+    "Set calculation order",
+    "Change initial view",
+    "Set alternate text",
+    "Mark figure as decorative",
+    "Recognize text",
+    "Run JavaScript",
+    "Run form script",
+    "Save as {level}",
+    "Remove {standard} identification",
+    "Edit script of {name}",
+    "Delete document JavaScript",
+    "Edit document JavaScript",
+    "Edit text",
+    "Load document font",
+    "Move object",
+    "Move objects",
+    "Move image",
+    "Rotate image",
+    "Flip image",
+    "Replace image",
+    "Delete image",
+    "Add header & footer",
+    "Update header & footer",
+    "Add watermark",
+    "Update watermark",
+    "Add background",
+    "Update background",
+    "Remove header & footer",
+    "Remove watermark",
+    "Remove background",
+    "Add text",
+    "Add image",
+    "Edit content",
+    "Delete content",
+    "Paste",
+    "Apply redactions",
+    "Remove redaction marks",
+    "Remove hidden information",
+    "Import {name}",
+    "Add link",
+    "Change link properties",
+    "Delete link",
+    "Remove all links",
+    "Create link",
+    "Create links",
+    "Sanitize document",
+    "Flatten comments",
+    "Flatten form fields",
+    "Flatten",
+    "Flatten Fill & Sign",
+    "Protect with password",
+    "Remove security",
+];
+
+/// The names of the batches built below L7, which an interface shows in the same places as
+/// [`EDIT_LABELS`] and so translates the same way. A batch built in the interface itself arrives
+/// already worded in the interface's language.
+pub const BATCH_LABELS: &[&str] =
+    &["Set document title", "Mark differences", "Detect form fields", "Run JavaScript", "Recognize text", field_table::LABEL, "Style"];
+
+impl Edit {
+    /// Label for the Edit menu and history ("Undo Rotate pages").
+    pub fn label(&self) -> Label {
+        match self {
+            Edit::RotatePages { pages, .. } => plural("Rotate page", "Rotate pages", pages.len()),
+            Edit::DeletePages { pages } => plural("Delete page", "Delete pages", pages.len()),
+            Edit::MovePages { pages, .. } => plural("Move page", "Move pages", pages.len()),
+            Edit::ReversePages { .. } => Label::of("Reverse pages"),
+            Edit::InsertBlankPage { .. } => Label::of("Insert blank page"),
+            Edit::DuplicatePages { pages, .. } => plural("Duplicate page", "Duplicate pages", pages.len()),
+            Edit::ReplacePages { pages, .. } => plural("Replace page", "Replace pages", pages.len()),
+            Edit::SetPageBox { pages, which: PageBox::Crop, .. } => plural("Crop page", "Crop pages", pages.len()),
+            Edit::SetPageBox { .. } => Label::of("Set page boxes"),
+            Edit::SetTransition { .. } => Label::of("Set page transitions"),
+            // The four `/Info` keys PdfCraft itself offers get a wording of their own, so each can
+            // be said in another language; any other key is the document's and goes in as it stands.
+            Edit::SetInfo { key, .. } => match key.as_str() {
+                "Title" => Label::of("Change Title"),
+                "Author" => Label::of("Change Author"),
+                "Subject" => Label::of("Change Subject"),
+                "Keywords" => Label::of("Change Keywords"),
+                _ => Label::with("Change {key}", key.as_str()),
+            },
+            Edit::InsertPagesFrom { name, .. } => Label::with("Insert pages from {name}", name.as_str()),
+            Edit::AddBookmark { .. } => Label::of("Add bookmark"),
+            Edit::RenameBookmark { .. } => Label::of("Rename bookmark"),
+            Edit::DeleteBookmark { .. } => Label::of("Delete bookmark"),
+            Edit::MoveBookmark { .. } => Label::of("Move bookmark"),
+            Edit::SetBookmarkPage { .. } => Label::of("Set bookmark destination"),
+            // The bookmark Style and Colour menus' own names, already said in every language.
+            Edit::SetBookmarkColor { .. } => Label::of("Colour"),
+            Edit::SetBookmarkStyle { .. } => Label::of("Style"),
+            Edit::BookmarksFromStructure => Label::of("New bookmarks from structure"),
+            Edit::NumberPages { .. } => Label::of("Number pages"),
+            // What was measured is part of the wording too, for the same reason.
+            Edit::AddMeasurement(m) => Label::of(match m.kind {
+                pdfcraft_measure::Kind::Distance => "Measure distance",
+                pdfcraft_measure::Kind::Perimeter => "Measure perimeter",
+                pdfcraft_measure::Kind::Area => "Measure area",
+            }),
+            Edit::SetMeasurementScale { .. } => Label::of("Set measurement scale"),
+            Edit::AddAnnotation(a) => Label::of(add_annotation(&a.shape)),
+            Edit::AddCustomStamp { .. } => Label::of("Add stamp"),
+            Edit::DeleteAnnotation { .. } => Label::of("Delete comment"),
+            Edit::SetAnnotationContents { .. } => Label::of("Edit comment"),
+            Edit::ReplyToAnnotation { .. } => Label::of("Reply"),
+            // The state's name is part of the wording: a language may need to agree it with the rest.
+            Edit::SetAnnotationStatus { state, .. } => Label::of(match state {
+                ReviewState::None => "Set status None",
+                ReviewState::Accepted => "Set status Accepted",
+                ReviewState::Rejected => "Set status Rejected",
+                ReviewState::Cancelled => "Set status Cancelled",
+                ReviewState::Completed => "Set status Completed",
+            }),
+            Edit::ReplaceText { .. } => Label::of("Replace text"),
+            Edit::EraseInk { .. } => Label::of("Erase"),
+            Edit::MarkAnnotation { marked: true, .. } => Label::of("Mark with checkmark"),
+            Edit::MarkAnnotation { .. } => Label::of("Remove checkmark"),
+            Edit::LockAnnotation { locked: true, .. } => Label::of("Lock comment"),
+            Edit::LockAnnotation { .. } => Label::of("Unlock comment"),
+            Edit::MoveAnnotation { .. } => Label::of("Move comment"),
+            Edit::ReshapeAnnotation { .. } => Label::of("Reshape comment"),
+            Edit::ResizeAnnotation { .. } => Label::of("Resize comment"),
+            Edit::StyleAnnotation { .. } | Edit::FillAnnotation { .. } | Edit::FontSizeAnnotation { .. } | Edit::SetAnnotationInfo { .. } => {
+                Label::of("Change comment properties")
+            }
+            Edit::SetFieldValue { name, .. } => Label::with("Fill in {name}", name.as_str()),
+            Edit::SetFieldImage { name, .. } => Label::with("Set the image of {name}", name.as_str()),
+            Edit::ResetForm { .. } => Label::of("Clear form"),
+            Edit::AddField { .. } => Label::of("Add field"),
+            Edit::SetFieldProps { .. } => Label::of("Change field properties"),
+            Edit::DeleteField { .. } => Label::of("Delete field"),
+            Edit::DuplicateField { .. } => Label::of("Duplicate field"),
+            Edit::SetTabOrder { .. } | Edit::MoveInTabOrder { .. } => Label::of("Set tab order"),
+            Edit::SetCalculationOrder { .. } => Label::of("Set calculation order"),
+            Edit::SetInitialView(_) => Label::of("Change initial view"),
+            Edit::AddAttachment { name, .. } => Label::with("Attach {name}", name.as_str()),
+            Edit::DeleteAttachment { key } => Label::with("Delete attachment {key}", key.as_str()),
+            Edit::AutoTagText => Label::of("Automatically tag text"),
+            Edit::SetAltText { .. } => Label::of("Set alternate text"),
+            Edit::AutoTagFormFields => Label::of("Tag form fields"),
+            Edit::SetTagProperty { .. } => Label::of("Change tag properties"),
+            Edit::MoveTag { .. } => Label::of("Move object"),
+            Edit::MarkDecorative { .. } => Label::of("Mark figure as decorative"),
+            Edit::MarkTagArtifact { .. } => Label::of("Mark content as artifact"),
+            Edit::AddOcrText { .. } => Label::of("Recognize text"),
+            Edit::ApplyScriptChanges { .. } => Label::of("Run JavaScript"),
+            Edit::XfaEvent { .. } => Label::of("Run form script"),
+            // The level is the standard's own name ("PDF/A-2b"), so it goes in as it stands.
+            Edit::ConvertPdfA { level } => Label::with("Save as {level}", level.label()),
+            Edit::RemoveStandardId { standard } => Label::with("Remove {standard} identification", standard.label()),
+            Edit::SetFieldScript { name, .. } => Label::with("Edit script of {name}", name.as_str()),
+            Edit::SetDocumentScript { script: None, .. } => Label::of("Delete document JavaScript"),
+            Edit::SetDocumentScript { .. } => Label::of("Edit document JavaScript"),
+            Edit::EditTextLine { .. } | Edit::EditTextBlock { .. } => Label::of("Edit text"),
+            Edit::RegisterTextFont { .. } => Label::of("Load document font"),
+            Edit::MoveObjects { objects, .. } => plural("Move object", "Move objects", objects.len()),
+            Edit::EditPageImage { change, .. } => Label::of(match change {
+                ImageEdit::Move(_) => "Move image",
+                ImageEdit::Rotate(_) | ImageEdit::RotateBy(_) => "Rotate image",
+                ImageEdit::Crop(_) => "Crop image",
+                ImageEdit::Flip { .. } => "Flip image",
+                ImageEdit::Replace { .. } => "Replace image",
+                ImageEdit::Delete => "Delete image",
+            }),
+            Edit::AddHeaderFooter { replace: false, .. } => Label::of("Add header & footer"),
+            Edit::AddHeaderFooter { .. } => Label::of("Update header & footer"),
+            Edit::AddWatermark { replace: false, .. } => Label::of("Add watermark"),
+            Edit::AddWatermark { .. } => Label::of("Update watermark"),
+            Edit::AddBackground { replace: false, .. } => Label::of("Add background"),
+            Edit::AddBackground { .. } => Label::of("Update background"),
+            Edit::RemoveMarks { kind: MarkKind::HeaderFooter } => Label::of("Remove header & footer"),
+            Edit::RemoveMarks { kind: MarkKind::Watermark } => Label::of("Remove watermark"),
+            Edit::RemoveMarks { kind: MarkKind::Background } => Label::of("Remove background"),
+            Edit::AddText { .. } => Label::of("Add text"),
+            Edit::AddImage { .. } => Label::of("Add image"),
+            Edit::UpdateContent { .. } => Label::of("Edit content"),
+            Edit::DeleteContent { .. } => Label::of("Delete content"),
+            Edit::ReplaceImage { .. } => Label::of("Replace image"),
+            Edit::PasteContent { .. } => Label::of("Paste"),
+            Edit::ApplyRedactions { .. } => Label::of("Apply redactions"),
+            Edit::ClearRedactions => Label::of("Remove redaction marks"),
+            Edit::RemoveHidden { .. } => Label::of("Remove hidden information"),
+            Edit::ImportData { name, .. } => Label::with("Import {name}", name.as_str()),
+            Edit::AddLink { .. } => Label::of("Add link"),
+            Edit::SetLink { .. } => Label::of("Change link properties"),
+            Edit::DeleteLink { .. } => Label::of("Delete link"),
+            Edit::RemoveLinks { .. } => Label::of("Remove all links"),
+            Edit::AddLinks { links, .. } => plural("Create link", "Create links", links.len()),
+            Edit::Sanitize => Label::of("Sanitize document"),
+            Edit::XfaToStatic => Label::of("Convert to a static form"),
+            Edit::Flatten { comments: true, fields: false } => Label::of("Flatten comments"),
+            Edit::Flatten { comments: false, fields: true } => Label::of("Flatten form fields"),
+            Edit::Flatten { .. } => Label::of("Flatten"),
+            Edit::FlattenFillSign => Label::of("Flatten Fill & Sign"),
+            Edit::Protect(_) => Label::of("Protect with password"),
+            Edit::RemoveProtection => Label::of("Remove security"),
+            // A batch carries its own name, already worded by whoever built it.
+            // A batch carries its name as text, so the wording is only the hole (see `BATCH_LABELS`).
+            Edit::Batch { label, .. } => Label::with("{batch}", label.as_str()),
+        }
+    }
+}
+
+/// What the Edit menu calls a new comment ("Undo Add highlight"). A whole wording for each kind,
+/// so a language can give the noun the article and the gender its own grammar asks for.
+fn add_annotation(s: &Shape) -> &'static str {
+    match s {
+        Shape::Note { .. } => "Add sticky note",
+        Shape::TextMarkup { kind: Markup::Highlight, .. } => "Add highlight",
+        Shape::TextMarkup { kind: Markup::Underline, .. } => "Add underline",
+        Shape::TextMarkup { kind: Markup::StrikeOut, .. } => "Add strikethrough",
+        Shape::TextMarkup { kind: Markup::Squiggly, .. } => "Add squiggly underline",
+        Shape::Rectangle { .. } => "Add rectangle",
+        Shape::Oval { .. } => "Add oval",
+        Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Add arrow",
+        Shape::Line { .. } => "Add line",
+        Shape::Ink { .. } => "Add drawing",
+        Shape::TextBox { .. } => "Add text box",
+        Shape::Typewriter { .. } => "Add text",
+        Shape::Mark { mark: FillMark::Check, .. } => "Add checkmark",
+        Shape::Mark { mark: FillMark::Cross, .. } => "Add cross",
+        Shape::Mark { mark: FillMark::Dot, .. } => "Add dot",
+        Shape::Mark { mark: FillMark::Line, .. } => "Add line",
+        Shape::Signature { .. } | Shape::TypedSignature { .. } => "Add signature",
+        Shape::Redact { .. } => "Add redaction mark",
+        Shape::Stamp { .. } | Shape::CustomStamp { .. } => "Add stamp",
+        Shape::Polygon { cloud: true, .. } => "Add cloud",
+        Shape::Polygon { .. } => "Add polygon",
+        Shape::PolyLine { .. } => "Add connected lines",
+        Shape::Callout { .. } => "Add callout",
+        Shape::Caret { .. } => "Add inserted text",
+        Shape::Attachment { .. } => "Add file attachment",
+    }
+}
+
+/// The singular or the plural wording, by count. Both are written out: a language forms its plural
+/// its own way, and `one` and `many` may differ in more than an "s".
+fn plural(one: &'static str, many: &'static str, n: usize) -> Label {
+    Label::of(if n == 1 { one } else { many })
+}
diff --git a/crates/engine/src/edit/run.rs b/crates/engine/src/edit/run.rs
new file mode 100644
index 0000000000..7901a3b7d8
--- /dev/null
+++ b/crates/engine/src/edit/run.rs
@@ -0,0 +1,696 @@
+use super::*;
+
+/// Whether the opening password allows an edit (§7.6.4.2, Table 22).
+pub(crate) fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), EditError> {
+    match edit {
+        Edit::RotatePages { .. }
+        | Edit::DeletePages { .. }
+        | Edit::MovePages { .. }
+        | Edit::ReversePages { .. }
+        | Edit::InsertBlankPage { .. }
+        | Edit::DuplicatePages { .. }
+        | Edit::ReplacePages { .. }
+        | Edit::SetPageBox { .. }
+        | Edit::SetTransition { .. }
+        | Edit::InsertPagesFrom { .. }
+        // "Assemble the document: insert, rotate or delete pages and create bookmarks" (Table 22).
+        | Edit::AddBookmark { .. }
+        | Edit::RenameBookmark { .. }
+        | Edit::DeleteBookmark { .. }
+        | Edit::MoveBookmark { .. }
+        | Edit::SetBookmarkPage { .. }
+        | Edit::SetBookmarkColor { .. }
+        | Edit::SetBookmarkStyle { .. }
+        | Edit::BookmarksFromStructure
+        | Edit::NumberPages { .. } => {
+            if p.assemble() {
+                Ok(())
+            } else {
+                Err(EditError::NotPermitted("page changes"))
+            }
+        }
+        Edit::AddMeasurement(_)
+        | Edit::AddAnnotation(_)
+        | Edit::AddCustomStamp { .. }
+        | Edit::DeleteAnnotation { .. }
+        | Edit::SetAnnotationContents { .. }
+        | Edit::ReplyToAnnotation { .. }
+        | Edit::SetAnnotationStatus { .. }
+        | Edit::MarkAnnotation { .. }
+        | Edit::ReplaceText { .. }
+        | Edit::EraseInk { .. }
+        | Edit::LockAnnotation { .. }
+        | Edit::MoveAnnotation { .. }
+        | Edit::ReshapeAnnotation { .. }
+        | Edit::ResizeAnnotation { .. }
+        | Edit::StyleAnnotation { .. }
+        | Edit::FillAnnotation { .. }
+        | Edit::FontSizeAnnotation { .. }
+        | Edit::SetAnnotationInfo { .. }
+        | Edit::SetMeasurementScale { .. } => {
+            if p.annotate() {
+                Ok(())
+            } else {
+                Err(EditError::NotPermitted("comments"))
+            }
+        }
+        Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::ApplyScriptChanges { .. } | Edit::XfaEvent { .. } => {
+            if p.fill_forms() {
+                Ok(())
+            } else {
+                Err(EditError::NotPermitted("filling in form fields"))
+            }
+        }
+        Edit::Protect(_) | Edit::RemoveProtection => {
+            if unrestricted(p) {
+                Ok(())
+            } else {
+                Err(EditError::NotPermitted("changing security"))
+            }
+        }
+        // Converting to PDF/A takes the encryption off (PDF/A forbids it), so on an encrypted
+        // document it is a change of security (#3921).
+        Edit::ConvertPdfA { .. } => {
+            if unrestricted(p) {
+                Ok(())
+            } else {
+                Err(EditError::NotPermitted("removing the encryption, which PDF/A forbids"))
+            }
+        }
+        Edit::SetInfo { .. }
+        | Edit::AddHeaderFooter { .. }
+        | Edit::AddWatermark { .. }
+        | Edit::AddBackground { .. }
+        | Edit::RemoveMarks { .. }
+        | Edit::AddField { .. }
+        | Edit::ApplyRedactions { .. }
+        | Edit::AddText { .. }
+        | Edit::AddImage { .. }
+        | Edit::UpdateContent { .. }
+        | Edit::MoveObjects { .. }
+        | Edit::DeleteContent { .. }
+        | Edit::ReplaceImage { .. }
+        | Edit::PasteContent { .. }
+        | Edit::ClearRedactions
+        | Edit::RemoveHidden { .. }
+        | Edit::ImportData { .. }
+        | Edit::AddLink { .. }
+        | Edit::SetLink { .. }
+        | Edit::DeleteLink { .. }
+        | Edit::RemoveLinks { .. }
+        | Edit::AddLinks { .. }
+        | Edit::Sanitize
+        | Edit::XfaToStatic
+        | Edit::SetFieldProps { .. }
+        | Edit::DeleteField { .. }
+        | Edit::DuplicateField { .. }
+        | Edit::SetTabOrder { .. }
+        | Edit::MoveInTabOrder { .. }
+        | Edit::SetCalculationOrder { .. }
+        | Edit::SetInitialView(_)
+        | Edit::AddAttachment { .. }
+        | Edit::DeleteAttachment { .. }
+        | Edit::AutoTagText
+        | Edit::SetAltText { .. }
+        | Edit::AutoTagFormFields
+        | Edit::SetTagProperty { .. }
+        | Edit::MoveTag { .. }
+        | Edit::MarkDecorative { .. }
+        | Edit::MarkTagArtifact { .. }
+        | Edit::AddOcrText { .. }
+        | Edit::SetDocumentScript { .. }
+        | Edit::SetFieldScript { .. }
+        | Edit::RemoveStandardId { .. }
+        | Edit::EditTextLine { .. }
+        | Edit::EditTextBlock { .. }
+        | Edit::RegisterTextFont { .. }
+        | Edit::EditPageImage { .. }
+        | Edit::Flatten { .. }
+        | Edit::FlattenFillSign => {
+            if p.modify() {
+                Ok(())
+            } else {
+                Err(EditError::NotPermitted("changes to the document"))
+            }
+        }
+        Edit::Batch { edits, .. } => edits.iter().try_for_each(|e| check_permission(e, p)),
+    }
+}
+
+/// Dates and unique ids stamped onto what an edit creates.
+pub(crate) struct EditCtx {
+    /// Field scripts run (`None`: JavaScript is off) and what they produced.
+    pub(crate) js: Option<js::JsRunner>,
+    /// A laid-out XFA form's template (`None`: not an XFA form, or JavaScript is off) and what
+    /// its scripts produced.
+    pub(crate) xfa: Option<Arc<pdfcraft_xfa::model::Template>>,
+    pub(crate) xfa_out: js::JsOutput,
+    /// The datasets stream this edit wrote (later writes in the edit replace it in place).
+    pub(crate) xfa_datasets: Option<pdfcraft_cos::ObjRef>,
+    /// A form script ran too long and was abandoned: the document's scripts go off.
+    pub(crate) xfa_ran_away: bool,
+    /// What the XFA scripts' time limits are multiplied by ([`Session::with_xfa_time_scale`]).
+    pub(crate) xfa_time_scale: u32,
+    /// The edit took the XFA out of the form: what went with it, for the document's warnings.
+    pub(crate) xfa_removed: Vec<String>,
+    /// Pages in the document, for `xfa.layout.pageCount()`.
+    pub(crate) pages: usize,
+    pub(crate) date: Option<String>,
+    /// Today in local time, for date tokens.
+    pub(crate) today: (i64, u32, u32),
+    pub(crate) seed: u64,
+    pub(crate) count: u64,
+    /// Fields the edit renamed to keep imported names separate (old → new), for the repair
+    /// log and the undo label.
+    pub(crate) renamed_fields: Vec<(String, String)>,
+    /// The overlay streams the edit's applied redactions added, which alone the renderer's check
+    /// leaves out.
+    pub(crate) redaction_overlays: Vec<pdfcraft_cos::ObjRef>,
+}
+
+impl EditCtx {
+    pub(crate) fn new(now: Option<i64>, salt: u64) -> Self {
+        let mut seed = 0x9E37_79B9_7F4A_7C15u64 ^ salt;
+        if let Some(t) = now {
+            seed ^= (t as u64).rotate_left(17);
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        if now.is_some() {
+            // Real clock: mix in sub-second time so ids from two sessions don't collide.
+            seed ^= std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.subsec_nanos() as u64).unwrap_or(0) << 32;
+        }
+        Self {
+            js: None,
+            xfa: None,
+            xfa_out: Default::default(),
+            xfa_datasets: None,
+            xfa_ran_away: false,
+            xfa_time_scale: 1,
+            xfa_removed: Vec::new(),
+            pages: 0,
+            date: now.map(pdfcraft_cos::pdf_date),
+            today: (1970, 1, 1),
+            seed,
+            count: 0,
+            renamed_fields: Vec::new(),
+            redaction_overlays: Vec::new(),
+        }
+    }
+
+    /// 32 bytes of entropy for new encryption keys and salts. `RandomState` is seeded by the
+    /// operating system, so no extra dependency is needed.
+    fn entropy(&mut self) -> [u8; 32] {
+        use std::hash::{BuildHasher, Hasher};
+        let mut out = [0u8; 32];
+        for (i, chunk) in out.chunks_mut(8).enumerate() {
+            let mut h = std::collections::hash_map::RandomState::new().build_hasher();
+            h.write_u64(self.seed ^ i as u64);
+            h.write_u64(self.count);
+            self.count += 1;
+            chunk.copy_from_slice(&h.finish().to_le_bytes());
+        }
+        out
+    }
+
+    /// A fresh `/NM`: a random-looking UUID (version 4 layout) from a splitmix64 stream.
+    fn meta(&mut self) -> pdfcraft_annot::Meta {
+        let mut next = || {
+            self.count += 1;
+            let mut z = self.seed.wrapping_add(self.count.wrapping_mul(0x9E37_79B9_7F4A_7C15));
+            z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+            z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+            z ^ (z >> 31)
+        };
+        let (a, b) = (next(), next());
+        let id = format!(
+            "{:08x}-{:04x}-4{:03x}-{:04x}-{:012x}",
+            a >> 32,
+            (a >> 16) & 0xffff,
+            a & 0xfff,
+            0x8000 | (b >> 48) & 0x3fff,
+            b & 0xffff_ffff_ffff
+        );
+        pdfcraft_annot::Meta { date: self.date.clone(), id }
+    }
+}
+
+/// Perform an edit on a working copy (the caller discards it on error).
+pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) -> Result<(), EditError> {
+    match edit {
+        Edit::RotatePages { pages, degrees } => pdfcraft_organize::rotate_pages(doc, pages, *degrees)?,
+        Edit::DeletePages { pages } => pdfcraft_organize::delete_pages(doc, pages)?,
+        Edit::MovePages { pages, to } => pdfcraft_organize::move_pages(doc, pages, *to)?,
+        Edit::ReversePages { pages } => pdfcraft_organize::reverse_pages(doc, pages)?,
+        Edit::InsertBlankPage { at, width, height } => {
+            pdfcraft_organize::insert_blank_page(doc, *at, *width, *height)?;
+        }
+        Edit::SetInfo { key, value } => pdfcraft_organize::set_info(doc, key, value)?,
+        Edit::DuplicatePages { pages, at } => pdfcraft_organize::duplicate_pages(doc, pages, *at)?,
+        Edit::ReplacePages { pages, name, bytes, src_pages } => {
+            let src = open_source(name, bytes)?;
+            pdfcraft_organize::replace_pages(doc, pages, &src, src_pages)?;
+        }
+        Edit::SetPageBox { pages, which, spec } => pdfcraft_organize::set_page_box(doc, pages, *which, *spec)?,
+        Edit::SetTransition { pages, spec } => pdfcraft_organize::set_transition(doc, pages, spec)?,
+        Edit::InsertPagesFrom { name, bytes, pages, at, field_conflicts } => {
+            let src = open_source(name, bytes)?;
+            let pages = match pages {
+                Some(p) => p.clone(),
+                None => (0..pdfcraft_organize::page_count(&src)?).collect(),
+            };
+            // The file's bookmarks come along under one named after it, as in Combine Files.
+            let title = std::path::Path::new(name).file_stem().map_or_else(|| name.clone(), |s| s.to_string_lossy().into_owned());
+            let outcome = pdfcraft_organize::insert_file_pages(doc, &src, &title, &pages, *at, *field_conflicts)?;
+            cx.renamed_fields = outcome.renamed_fields;
+        }
+        Edit::AddBookmark { parent, index, title, page, left, top } => {
+            pdfcraft_organize::add_bookmark_at(doc, parent, *index, title, *page, *left, *top)?;
+        }
+        Edit::RenameBookmark { path, title } => pdfcraft_organize::rename_bookmark(doc, path, title)?,
+        Edit::DeleteBookmark { path } => pdfcraft_organize::delete_bookmark(doc, path)?,
+        Edit::MoveBookmark { from, to_parent, index } => {
+            pdfcraft_organize::move_bookmark(doc, from, to_parent, *index)?;
+        }
+        Edit::SetBookmarkPage { path, page } => pdfcraft_organize::set_bookmark_page(doc, path, *page)?,
+        Edit::SetBookmarkColor { path, color } => pdfcraft_organize::set_bookmark_color(doc, path, *color)?,
+        Edit::SetBookmarkStyle { path, bold, italic } => pdfcraft_organize::set_bookmark_style(doc, path, *bold, *italic)?,
+        Edit::BookmarksFromStructure => {
+            let entries: Vec<_> = pdfcraft_a11y::headings(doc)
+                .into_iter()
+                .map(|h| pdfcraft_organize::OutlineEntry { level: h.level, title: h.title, page: h.page, element: h.obj })
+                .collect();
+            pdfcraft_organize::add_bookmark_tree(doc, "Untitled", &entries)?;
+        }
+        Edit::NumberPages { from, to, style, prefix, first } => pdfcraft_organize::number_pages(doc, *from, *to, *style, prefix, *first)?,
+        Edit::AddMeasurement(m) => {
+            measure::add(doc, m, &cx.meta())?;
+        }
+        Edit::SetMeasurementScale { page, bbox, name, scale } => measure::set_scale(doc, *page, *bbox, name, scale)?,
+        Edit::AddAnnotation(a) => {
+            pdfcraft_annot::add_annotation(doc, a, &cx.meta())?;
+        }
+        Edit::AddCustomStamp { page, rect, name, file, author } => {
+            let src = mark_source(doc, file)?;
+            let (sw, sh) = (src.size.0.max(1.0), src.size.1.max(1.0));
+            let natural = rect[2] == rect[0] && rect[3] == rect[1];
+            let rotation = pdfcraft_organize::page_rotation(doc, *page)?;
+            // The picture as displayed: a quarter turn swaps its sides in user space.
+            let (dw, dh) = if matches!(rotation, 90 | 270) { (sh, sw) } else { (sw, sh) };
+            let rect = if natural {
+                let k = (200.0 / sw.max(sh)).min(1.0);
+                let (w, h) = (dw * k, dh * k);
+                [rect[0] - w / 2.0, rect[1] - h / 2.0, rect[0] + w / 2.0, rect[1] + h / 2.0]
+            } else {
+                fit_picture(*rect, dw, dh)
+            };
+            let shape = Shape::CustomStamp { rect, name: name.clone(), picture: src.xobject, image: src.image, size: (sw, sh) };
+            let style = pdfcraft_annot::Style::default_for(&shape);
+            let new = NewAnnotation { page: *page, shape, style, contents: name.clone(), author: author.clone() };
+            let index = pdfcraft_annot::add_annotation(doc, &new, &cx.meta())?;
+            pdfcraft_annot::orient_image_stamp(doc, *page, index, rotation)?;
+        }
+        Edit::DeleteAnnotation { page, index } => pdfcraft_annot::delete_annotation(doc, *page, *index)?,
+        Edit::SetAnnotationContents { page, index, text } => pdfcraft_annot::set_contents(doc, *page, *index, text, &cx.meta())?,
+        Edit::ReplyToAnnotation { page, index, text, author } => {
+            pdfcraft_annot::add_reply(doc, *page, *index, text, author, &cx.meta())?;
+        }
+        Edit::SetAnnotationStatus { page, index, state, author } => {
+            pdfcraft_annot::set_review_state(doc, *page, *index, *state, author, &cx.meta())?;
+        }
+        Edit::EraseInk { page, index, path, radius } => {
+            pdfcraft_annot::erase_ink(doc, *page, *index, path, *radius, &cx.meta())?;
+        }
+        Edit::AddAttachment { name, bytes, description, mime } => {
+            pdfcraft_organize::add_attachment(doc, name, bytes, description.as_deref(), mime.as_deref(), cx.date.as_deref())?;
+        }
+        Edit::DeleteAttachment { key } => pdfcraft_organize::delete_attachment(doc, key)?,
+        Edit::ReplaceText { page, quads, text, author, strike, caret } => {
+            // One `/NM` each: the caret replies to the strikeout, and XFDF names that reply by
+            // the strikeout's `/NM` (#2666).
+            let (strike_meta, caret_meta) = (cx.meta(), cx.meta());
+            pdfcraft_annot::add_text_replacement(doc, *page, quads, text, author, strike, caret, &strike_meta, &caret_meta)?;
+        }
+        Edit::MarkAnnotation { page, index, marked, author } => {
+            pdfcraft_annot::set_marked(doc, *page, *index, *marked, author, &cx.meta())?;
+        }
+        Edit::LockAnnotation { page, index, locked } => pdfcraft_annot::set_locked(doc, *page, *index, *locked)?,
+        Edit::MoveAnnotation { page, index, dx, dy } => pdfcraft_annot::move_annotation(doc, *page, *index, *dx, *dy, &cx.meta())?,
+        Edit::ReshapeAnnotation { page, index, points } => pdfcraft_annot::set_points(doc, *page, *index, points, &cx.meta())?,
+        Edit::ResizeAnnotation { page, index, rect } => pdfcraft_annot::set_rect(doc, *page, *index, *rect, &cx.meta())?,
+        Edit::StyleAnnotation { page, index, color, opacity, width, endings } => {
+            pdfcraft_annot::set_style(doc, *page, *index, *color, *opacity, *width, endings.as_deref(), &cx.meta())?;
+        }
+        Edit::FillAnnotation { page, index, fill } => pdfcraft_annot::set_fill(doc, *page, *index, *fill, &cx.meta())?,
+        Edit::FontSizeAnnotation { page, index, size } => pdfcraft_annot::set_font_size(doc, *page, *index, *size, &cx.meta())?,
+        Edit::SetAnnotationInfo { page, index, author, subject, icon } => {
+            pdfcraft_annot::set_info(doc, *page, *index, author.as_deref(), subject.as_deref(), *icon, &cx.meta())?;
+        }
+        Edit::SetFieldValue { name, value } => {
+            let mut set = |doc: &mut pdfcraft_cos::Document, value: &FieldValue| match cx.js.as_mut() {
+                Some(js) => pdfcraft_forms::set_value_with(doc, name, value, js),
+                None => pdfcraft_forms::set_value(doc, name, value),
+            };
+            match set(doc, value) {
+                Ok(()) => {}
+                // A date the field's format doesn't read may be typed by another of an XFA date
+                // field's patterns: it is kept in the first. Only a format refusal is tried
+                // again: it comes before any of the field's scripts run, so they run once.
+                Err(refused @ pdfcraft_forms::FormError::Format(_)) => match xfa::typed_date(doc, cx.xfa.as_deref(), name, value) {
+                    Some(typed) => set(doc, &typed)?,
+                    None => return Err(refused.into()),
+                },
+                Err(refused) => return Err(refused.into()),
+            }
+        }
+        Edit::ApplyScriptChanges { changes } => match cx.js.as_mut() {
+            Some(js) => pdfcraft_forms::apply_script_changes(doc, changes, js)?,
+            None => pdfcraft_forms::apply_script_changes(doc, changes, &mut pdfcraft_forms::NoScripts)?,
+        },
+        Edit::XfaEvent { som, activity } => {
+            let tpl = cx.xfa.clone().ok_or_else(|| EditError::Invalid("this is not a laid-out XFA form, or JavaScript is off".into()))?;
+            let mut run =
+                xfa::XfaRun { page_count: cx.pages, out: &mut cx.xfa_out, datasets: cx.xfa_datasets, ran_away: false, time_scale: cx.xfa_time_scale };
+            let ran = xfa::on_event(doc, &tpl, som, activity, &mut run);
+            cx.xfa_datasets = run.datasets;
+            cx.xfa_ran_away |= run.ran_away;
+            ran.map_err(EditError::Invalid)?;
+        }
+        Edit::SetFieldImage { name, image } => {
+            let (img, _) = embed_image(doc, name, image)?;
+            let px = match &*doc.get(img) {
+                pdfcraft_cos::Object::Stream(s) => (s.dict.int(b"Width").unwrap_or(1) as u32, s.dict.int(b"Height").unwrap_or(1) as u32),
+                _ => (1, 1),
+            };
+            // An XFA image field keeps the picture in the data too (as Designer saves it), and a
+            // laid-out form shows it from there: so only pictures the layout can show, and only
+            // for image fields (a laid-out one carries its SOM path; a static form's field name
+            // is its path).
+            let is_xfa = pdfcraft_xfa::read_packets(doc).ok().flatten().is_some();
+            let image_field = is_xfa
+                && pdfcraft_forms::fields(doc).iter().any(|f| f.name == *name && f.button == Some(pdfcraft_forms::af::ButtonAction::ImportIcon));
+            if image_field {
+                let Some(content_type) = image_content_type(image) else {
+                    return Err(EditError::Invalid(format!("{name}: an XFA form keeps a PNG, JPEG, GIF, BMP or TIFF picture; choose one of those")));
+                };
+                pdfcraft_forms::set_button_icon(doc, name, img, px)?;
+                let som = pdfcraft_xfa::fields_by_som(doc).into_iter().find(|(_, n)| n == name).map(|(s, _)| s).unwrap_or_else(|| name.clone());
+                let path = match cx.xfa.as_deref() {
+                    Some(tpl) => pdfcraft_xfa::data_path(tpl, &som),
+                    None => pdfcraft_xfa::som_to_path(&som),
+                };
+                let r =
+                    pdfcraft_xfa::write_data_image(doc, &path, content_type, image, cx.xfa_datasets).map_err(|e| EditError::Write(e.to_string()))?;
+                if !r.written && r.warnings.is_empty() {
+                    return Err(EditError::Write(format!("{name}: the picture could not be written into the form's data")));
+                }
+                cx.xfa_datasets = r.stream.or(cx.xfa_datasets);
+                cx.xfa_out.errors.extend(r.warnings);
+                xfa_after_data_change(doc, cx, false)?;
+            } else {
+                pdfcraft_forms::set_button_icon(doc, name, img, px)?;
+            }
+        }
+        Edit::ResetForm { names } => {
+            pdfcraft_forms::reset(doc, names.as_deref())?;
+        }
+        Edit::AddField { page, rect, kind, name } => {
+            pdfcraft_forms::add_field(doc, *page, *rect, kind, name.as_deref())?;
+        }
+        Edit::SetFieldProps { name, props } => {
+            pdfcraft_forms::set_props(doc, name, props)?;
+        }
+        Edit::DuplicateField { name, pages } => {
+            if pdfcraft_forms::duplicate_field(doc, name, pages)? == 0 {
+                return Err(EditError::Form(pdfcraft_forms::FormError::Invalid(format!("{name} is already on those pages"))));
+            }
+        }
+        Edit::DeleteField { name } => pdfcraft_forms::delete_field(doc, name)?,
+        Edit::SetTabOrder { pages, order } => pdfcraft_forms::set_tab_order(doc, pages, *order)?,
+        Edit::MoveInTabOrder { name, earlier } => pdfcraft_forms::move_in_tab_order(doc, name, *earlier)?,
+        // As after a script edit: the values the new order gives show at once.
+        Edit::SetCalculationOrder { names } => {
+            pdfcraft_forms::set_calculation_order(doc, names)?;
+            match cx.js.as_mut() {
+                Some(js) => pdfcraft_forms::recalculate_with(doc, js)?,
+                None => pdfcraft_forms::recalculate(doc)?,
+            };
+        }
+        Edit::SetInitialView(v) => pdfcraft_organize::set_initial_view(doc, v)?,
+        Edit::AutoTagText => {
+            a11y::autotag_text(doc).map_err(|e| EditError::Accessibility(e.to_string()))?;
+        }
+        Edit::SetAltText { figure, alt } => {
+            let r = pdfcraft_cos::ObjRef::new(*figure, doc.generation(*figure));
+            a11y::set_alt(doc, r, alt.as_deref()).map_err(|e| EditError::Accessibility(e.to_string()))?;
+        }
+        Edit::AutoTagFormFields => {
+            a11y::tag_form_fields(doc).map_err(EditError::Accessibility)?;
+        }
+        Edit::SetTagProperty { object, property, value } => {
+            a11y::set_tag_property(doc, *object, *property, value.as_deref()).map_err(|e| EditError::Accessibility(e.to_string()))?;
+        }
+        Edit::MoveTag { object, anchor, placement } => {
+            a11y::move_tag(doc, *object, *anchor, *placement).map_err(|e| EditError::Accessibility(e.to_string()))?;
+        }
+        Edit::EditTextLine { page, line, text } => {
+            pdfcraft_edit::replace_line(doc, *page, *line, text)?;
+        }
+        Edit::SetFieldScript { name, event, script } => {
+            pdfcraft_forms::set_field_script(doc, name, event, script.as_deref())?;
+            match cx.js.as_mut() {
+                Some(js) => pdfcraft_forms::recalculate_with(doc, js)?,
+                None => pdfcraft_forms::recalculate(doc)?,
+            };
+        }
+        Edit::ConvertPdfA { level } => {
+            pdfcraft_preflight::convert(doc, *level).map_err(|e| EditError::Invalid(e.to_string()))?;
+        }
+        Edit::RemoveStandardId { standard } => pdfcraft_organize::remove_standard_id(doc, *standard)?,
+        Edit::SetDocumentScript { name, script } => pdfcraft_forms::set_document_script(doc, name, script.as_deref())?,
+        Edit::AddOcrText { page, words } => {
+            pdfcraft_edit::stamp(doc, *page, "OCR", pdfcraft_ocr::text_layer(words))?;
+        }
+        Edit::EditPageImage { page, index, change } => {
+            let img = pdfcraft_edit::page_images(doc, *page)?
+                .into_iter()
+                .nth(*index)
+                .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1))))?;
+            let c = match change {
+                ImageEdit::Move(to) => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::rect_to_rect(img.rect, *to)),
+                ImageEdit::Rotate(q) => {
+                    pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.visible_rect.unwrap_or(img.rect), *q, false, false))
+                }
+                ImageEdit::RotateBy(degrees) => {
+                    let t = pdfcraft_edit::turn_by_degrees(img.visible_rect.unwrap_or(img.rect), *degrees)
+                        .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("the rotation angle must be a finite number".into())))?;
+                    pdfcraft_edit::ImageChange::Transform(t)
+                }
+                ImageEdit::Flip { horizontal } => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(
+                    img.visible_rect.unwrap_or(img.rect),
+                    0,
+                    *horizontal,
+                    !*horizontal,
+                )),
+                ImageEdit::Replace { name, bytes } => {
+                    if img.is_form {
+                        return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
+                            "grouped Form artwork cannot be replaced with a bitmap".into(),
+                        )));
+                    }
+                    pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
+                }
+                ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
+                ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
+            };
+            pdfcraft_edit::change_image(doc, *page, *index, &c)?;
+        }
+        Edit::MoveObjects { page, objects, offset } => pdfcraft_edit::move_objects(doc, *page, objects, *offset)?,
+        Edit::EditTextBlock { page, block, text, style } => {
+            pdfcraft_edit::rewrite_block(doc, *page, *block, Some(text), style)?;
+        }
+        Edit::RegisterTextFont { page, bytes } => {
+            pdfcraft_edit::text::register_text_font(doc, *page, bytes)?;
+        }
+        Edit::MarkDecorative { figure } => {
+            let r = pdfcraft_cos::ObjRef::new(*figure, doc.generation(*figure));
+            a11y::mark_decorative(doc, r).map_err(|e| EditError::Accessibility(e.to_string()))?;
+        }
+        Edit::MarkTagArtifact { object } => {
+            a11y::mark_tag_artifact(doc, *object).map_err(|e| EditError::Accessibility(e.to_string()))?;
+        }
+        Edit::AddHeaderFooter { pages, settings, replace } => {
+            let date = cx.today;
+            pdfcraft_edit::add_header_footer(doc, pages, settings, *replace, &pdfcraft_edit::Context { date })?;
+        }
+        Edit::AddWatermark { pages, settings, replace, file } => {
+            let mut s = settings.clone();
+            if let Some(f) = file {
+                s.source = Some(mark_source(doc, f)?);
+            }
+            pdfcraft_edit::add_watermark(doc, pages, &s, *replace)?
+        }
+        Edit::AddBackground { pages, settings, replace, file } => {
+            let mut s = settings.clone();
+            if let Some(f) = file {
+                s.source = Some(mark_source(doc, f)?);
+            }
+            pdfcraft_edit::add_background(doc, pages, &s, *replace)?
+        }
+        Edit::RemoveMarks { kind } => {
+            let n = pdfcraft_model::pages(doc).len();
+            if pdfcraft_edit::remove_marks(doc, &(0..n).collect::<Vec<_>>(), *kind)? == 0 {
+                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("there is nothing to remove".into())));
+            }
+        }
+        Edit::AddText { page, text } => {
+            pdfcraft_edit::add_content(doc, *page, &AddedContent::Text(text.clone()))?;
+        }
+        Edit::AddImage { page, rect, name, bytes } => {
+            let (image, natural) = embed_image(doc, name, bytes)?;
+            let rect = match rect {
+                Some(r) => *r,
+                None => {
+                    let p = pdfcraft_model::pages(doc).swap_remove(*page);
+                    let (pw, ph) = p.display_size(doc);
+                    let k = ((pw * 0.8) / natural.0).min((ph * 0.8) / natural.1).min(1.0);
+                    let (w, h) = (natural.0 * k, natural.1 * k);
+                    [(pw - w) / 2.0, (ph - h) / 2.0, (pw + w) / 2.0, (ph + h) / 2.0]
+                }
+            };
+            pdfcraft_edit::add_content(doc, *page, &AddedContent::Image(pdfcraft_edit::AddedImage::new(rect, image)))?;
+        }
+        Edit::UpdateContent { page, index, content } => pdfcraft_edit::update_content(doc, *page, *index, content)?,
+        Edit::DeleteContent { page, index } => pdfcraft_edit::delete_content(doc, *page, *index)?,
+        Edit::ReplaceImage { page, index, name, bytes } => {
+            let item = pdfcraft_edit::list_added(doc).into_iter().filter(|a| a.page == *page).nth(*index);
+            let Some(AddedContent::Image(old)) = item.map(|a| a.content) else {
+                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("that item is not an image".into())));
+            };
+            let (image, _) = embed_image(doc, name, bytes)?;
+            pdfcraft_edit::update_content(doc, *page, *index, &AddedContent::Image(pdfcraft_edit::AddedImage { image, ..old }))?;
+        }
+        Edit::PasteContent { page, content, file } => {
+            let content = match content {
+                AddedContent::Text(_) => content.clone(),
+                AddedContent::Image(img) => {
+                    let Some((name, bytes)) = file else {
+                        return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("a pasted image needs its picture".into())));
+                    };
+                    // The same picture in this document (copied here, pasted here before, or an
+                    // identical file): drawn again from the one image object rather than stored twice.
+                    let image = if copy_image::is_picture(doc, img.image, bytes) {
+                        img.image
+                    } else {
+                        match copy_image::added_picture(doc, bytes) {
+                            Some(image) => image,
+                            None => embed_image(doc, name, bytes)?.0,
+                        }
+                    };
+                    AddedContent::Image(pdfcraft_edit::AddedImage { image, ..img.clone() })
+                }
+            };
+            pdfcraft_edit::add_content(doc, *page, &content)?;
+        }
+        Edit::ApplyRedactions { pages } => {
+            cx.redaction_overlays = pdfcraft_redact::apply(doc, pages.as_deref())?.overlays;
+        }
+        Edit::ClearRedactions => {
+            pdfcraft_redact::clear_marks(doc, None)?;
+        }
+        Edit::AddLink { page, rect, action, style } => {
+            pdfcraft_annot::links::add(doc, *page, *rect, action, style)?;
+        }
+        Edit::SetLink { page, index, rect, action, style } => pdfcraft_annot::links::set(doc, *page, *index, *rect, action.as_ref(), style.as_ref())?,
+        Edit::DeleteLink { page, index } => pdfcraft_annot::links::delete(doc, *page, *index)?,
+        Edit::RemoveLinks { pages } => {
+            if pdfcraft_annot::links::remove_all(doc, pages.as_deref())? == 0 {
+                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("there are no links to remove".into())));
+            }
+        }
+        Edit::AddLinks { links, style } => {
+            if pdfcraft_annot::links::add_many(doc, links, style)? == 0 {
+                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("no web addresses were found".into())));
+            }
+        }
+        Edit::ImportData { bytes, .. } => {
+            // An XFA form takes XFA data files (XDP, datasets, or a data document) as its data;
+            // XFDF, FDF, Acrobat's XML and tables go the usual way.
+            let text = (pdfcraft_xfa::read_packets(doc).ok().flatten().is_some()).then(|| decode_data_file(bytes)).flatten();
+            match text {
+                Some(Ok(text)) if is_xfa_data_file(&text) => {
+                    let expect_root = cx.xfa.as_ref().and_then(|t| t.root.common.name.clone());
+                    let r = pdfcraft_xfa::import_data(doc, &text, expect_root.as_deref(), cx.xfa_datasets)
+                        .map_err(|e| EditError::Write(e.to_string()))?;
+                    cx.xfa_datasets = r.stream.or(cx.xfa_datasets);
+                    cx.xfa_out.errors.extend(r.warnings);
+                    cx.xfa_out.console.push(format!("Imported XFA data: {} node(s)", r.nodes));
+                    xfa_after_data_change(doc, cx, true)?;
+                }
+                Some(Err(why)) => return Err(EditError::Invalid(why)),
+                _ => {
+                    pdfcraft_xfdf::import(doc, bytes)?;
+                }
+            }
+        }
+        Edit::RemoveHidden { which } => {
+            pdfcraft_redact::sanitize::remove_hidden(doc, which)?;
+        }
+        Edit::Sanitize => {
+            pdfcraft_redact::sanitize::sanitize(doc)?;
+        }
+        Edit::Flatten { comments, fields } => {
+            // An XFA form's fields baked into the pages: the XFA goes too, or Adobe's viewers
+            // would lay the form out again from its template over the baked pages. A dynamic
+            // form that was never laid out keeps its XFA: without it only placeholders remain.
+            let shape = (*fields).then(|| pdfcraft_xfa::xfa_shape(doc)).flatten();
+            let n = pdfcraft_model::pages(doc).len();
+            pdfcraft_edit::flatten(doc, &(0..n).collect::<Vec<_>>(), *comments, *fields)?;
+            match shape {
+                Some(shape) if shape.strippable() => strip_xfa(doc, cx)?,
+                Some(_) => cx.xfa_removed.push("The XFA was kept: this dynamic form was not laid out, so its fields were not baked in".into()),
+                None => {}
+            }
+        }
+        Edit::XfaToStatic => {
+            let Some(shape) = pdfcraft_xfa::xfa_shape(doc) else {
+                return Err(EditError::Invalid("this document is not an XFA form".into()));
+            };
+            if !shape.strippable() {
+                return Err(EditError::Invalid("this dynamic XFA form was not laid out, so there is no static form to keep".into()));
+            }
+            strip_xfa(doc, cx)?;
+        }
+        Edit::FlattenFillSign => {
+            let n = pdfcraft_model::pages(doc).len();
+            pdfcraft_edit::flatten_fill_sign(doc, &(0..n).collect::<Vec<_>>())?;
+        }
+        Edit::Protect(p) => {
+            p.validate()?;
+            let seed = cx.entropy();
+            // Without a permissions password nothing is restricted, so the owner password is a
+            // random one nobody needs.
+            let random_owner: String = cx.entropy().iter().map(|b| format!("{b:02x}")).collect();
+            let params = pdfcraft_cos::NewEncryption {
+                algorithm: p.algorithm,
+                user_password: p.open_password.as_deref().unwrap_or(""),
+                owner_password: p.permissions_password.as_deref().unwrap_or(&random_owner),
+                permissions: p.permission_bits(),
+                encrypt_metadata: p.encrypt_metadata,
+                seed,
+            };
+            doc.set_encryption(&params).map_err(|e| EditError::Protection(e.to_string()))?;
+        }
+        Edit::RemoveProtection => {
+            if doc.output_handler().is_none() {
+                return Err(EditError::Protection("the document isn't protected".into()));
+            }
+            doc.remove_encryption();
+        }
+        Edit::Batch { edits, .. } => {
+            for e in edits {
+                run_edit(doc, e, cx)?;
+            }
+        }
+    }
+    Ok(())
+}
diff --git a/crates/engine/src/error.rs b/crates/engine/src/error.rs
new file mode 100644
index 0000000000..5ee915fcdf
--- /dev/null
+++ b/crates/engine/src/error.rs
@@ -0,0 +1,80 @@
+//! The errors editing and combining report.
+
+use crate::measure;
+
+/// Why a file can't be a source for Combine Files (or Insert / Replace pages).
+#[derive(Debug, Clone, PartialEq, thiserror::Error)]
+pub enum SourceProblem {
+    #[error("it is password-protected")]
+    Password,
+    #[error("the password is wrong")]
+    WrongPassword,
+    #[error("its security settings don't allow copying pages")]
+    NotPermitted,
+    #[error("{0}")]
+    Unreadable(String),
+}
+
+#[derive(Debug, thiserror::Error, PartialEq)]
+pub enum EditError {
+    #[error("no such document")]
+    NoDocument,
+    #[error("this document can't be edited: {0}")]
+    ReadOnly(String),
+    #[error("the document's security settings don't allow {0}; open it with the owner password to make this change")]
+    NotPermitted(&'static str),
+    #[error("{0}")]
+    Organize(#[from] pdfcraft_organize::OrganizeError),
+    #[error("{0}")]
+    Bookmark(#[from] pdfcraft_organize::OutlineError),
+    #[error("{0}")]
+    Comment(#[from] pdfcraft_annot::AnnotError),
+    #[error(transparent)]
+    Measure(#[from] measure::MeasureError),
+    #[error("{0}")]
+    Protection(String),
+    #[error("the password is incorrect")]
+    WrongPassword,
+    #[error("{0}")]
+    Form(#[from] pdfcraft_forms::FormError),
+    #[error(transparent)]
+    Redact(#[from] pdfcraft_redact::RedactError),
+    #[error("{0}")]
+    Print(String),
+    #[error("{0}")]
+    Accessibility(String),
+    #[error(transparent)]
+    Data(#[from] pdfcraft_xfdf::DataError),
+    #[error("{0}")]
+    Edit(#[from] pdfcraft_edit::EditError),
+    #[error("{0}")]
+    Create(#[from] pdfcraft_create::CreateError),
+    #[error("the edited document could not be written: {0}")]
+    Write(String),
+    #[error("the edited document could not be reopened: {0}")]
+    Reopen(String),
+    #[error("couldn't use {0}")]
+    Source(String),
+    #[error("nothing to undo")]
+    NothingToUndo,
+    #[error("nothing to redo")]
+    NothingToRedo,
+    #[error("{0}")]
+    Sign(String),
+    #[error("{0}")]
+    Optimize(String),
+    #[error("cancelled")]
+    Cancelled,
+    #[error("{0} isn't possible in a signed document: it would rewrite the file and invalidate the signatures")]
+    SignedRewrite(String),
+    #[error("this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)")]
+    Signed,
+    #[error("{0}")]
+    Invalid(String),
+}
+
+impl From<pdfcraft_sign::SignError> for EditError {
+    fn from(e: pdfcraft_sign::SignError) -> Self {
+        EditError::Sign(e.to_string())
+    }
+}
diff --git a/crates/engine/src/export.rs b/crates/engine/src/export.rs
index 01159df800..1330faf272 100644
--- a/crates/engine/src/export.rs
+++ b/crates/engine/src/export.rs
@@ -4,13 +4,52 @@
 //! text, from a
 //! document's working file (so unsaved edits and hidden layers are respected, as on screen).
 
+use std::collections::BTreeMap;
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::{Condvar, Mutex, PoisonError, mpsc};
+
 use pdfcraft_render::{PageRenderer, RenderRequest, RequestKind};
 
 use crate::Document;
 
+/// At most this many pages are drawn at once by [`Exporter::images`].
+const MAX_IMAGE_WORKERS: usize = 8;
+/// Bytes of rasters [`Exporter::images`] may hold at once: 1 GiB, about 16 Letter pages at 300 dpi.
+/// Each worker holds one page (the raster, its RGB copy and the encoded file), so large pages run
+/// on fewer workers; a page over the cap still exports, on one worker, as it did before.
+const IMAGE_MEMORY: f64 = 1024.0 * 1024.0 * 1024.0;
+
+/// Page `page` drawn at `dpi` and encoded as `format`, saying it was drawn at `used` dpi.
+fn draw_image(renderer: &mut PageRenderer, page: usize, dpi: f64, format: ImageFormat, used: f64) -> Result<Vec<u8>, String> {
+    let r = renderer.render(RenderRequest { page, scale: (dpi.clamp(18.0, 1200.0) / 72.0) as f32, ..Default::default() });
+    if let Some(e) = r.error {
+        return Err(format!("page {}: {e}", page + 1));
+    }
+    encode_image(r.width, r.height, &r.rgba, format, used)
+}
+
+/// Tells the workers of [`Exporter::images`] to stop when dropped.
+struct StopWorkers<'a> {
+    stop: &'a AtomicBool,
+    handed_over: &'a (Mutex<usize>, Condvar),
+}
+
+impl Drop for StopWorkers<'_> {
+    fn drop(&mut self) {
+        self.stop.store(true, Ordering::Relaxed);
+        // Taken under the lock, so a worker between its check and its wait still sees it.
+        drop(self.handed_over.0.lock().unwrap_or_else(PoisonError::into_inner));
+        self.handed_over.1.notify_all();
+    }
+}
+
 /// Renders and extracts pages of one document state.
 pub struct Exporter {
     renderer: PageRenderer,
+    /// What the renderer draws, for the extra renderers [`Exporter::images`] starts.
+    bytes: std::sync::Arc<Vec<u8>>,
+    config: pdfcraft_render::RenderConfig,
     pages: usize,
     /// Each page's displayed size in points, for [`Exporter::dpi_used`].
     sizes: Vec<(f32, f32)>,
@@ -65,7 +104,13 @@ impl Exporter {
     /// resolution they allow, as the interactive Export does; [`Exporter::dpi_used`] says at what.
     /// A source whose `config.reject_oversize` is set refuses such pages instead.
     pub fn from_source(src: ExportSource) -> Self {
-        Self { renderer: PageRenderer::new(src.bytes, src.config), pages: src.pages, sizes: src.sizes }
+        Self {
+            renderer: PageRenderer::new(src.bytes.clone(), src.config.clone()),
+            bytes: src.bytes,
+            config: src.config,
+            pages: src.pages,
+            sizes: src.sizes,
+        }
     }
 
     /// The resolution page `page` is actually exported at when asked for `dpi`: lower than asked
@@ -96,11 +141,146 @@ impl Exporter {
     /// Page `page` as an image file of `format`, which says the resolution it was drawn at.
     pub fn image(&mut self, page: usize, dpi: f64, format: ImageFormat) -> Result<Vec<u8>, String> {
         self.check(page)?;
-        let r = self.renderer.render(RenderRequest { page, scale: (dpi.clamp(18.0, 1200.0) / 72.0) as f32, ..Default::default() });
-        if let Some(e) = r.error {
-            return Err(format!("page {}: {e}", page + 1));
+        let used = self.dpi_used(page, dpi);
+        draw_image(&mut self.renderer, page, dpi, format, used)
+    }
+
+    /// Pages `pages` as image files of `format`, handed to `sink` in order with their page
+    /// number: the same files as [`Exporter::image`] for each page in turn. Encoding a page costs
+    /// several times what drawing it does, so several pages are drawn and encoded at once on
+    /// worker threads, each with its own renderer, while `sink` runs on the calling thread.
+    /// Workers draw at most one page each ahead of `sink`, and fewer run when the pages are
+    /// large, so memory stays bounded. Stops at the first page that fails or the first error `sink`
+    /// returns, and returns it; every page before it has been handed to `sink`.
+    pub fn images(
+        &mut self,
+        pages: &[usize],
+        dpi: f64,
+        format: ImageFormat,
+        sink: impl FnMut(usize, Vec<u8>) -> Result<(), String>,
+    ) -> Result<(), String> {
+        let workers = self.image_workers(pages, dpi);
+        self.images_on(workers, pages, dpi, format, sink)
+    }
+
+    /// [`Exporter::images`] with `workers` pages drawn at once (one: in turn, on this thread).
+    pub(crate) fn images_on(
+        &mut self,
+        workers: usize,
+        pages: &[usize],
+        dpi: f64,
+        format: ImageFormat,
+        mut sink: impl FnMut(usize, Vec<u8>) -> Result<(), String>,
+    ) -> Result<(), String> {
+        if workers <= 1 {
+            for &p in pages {
+                let img = self.image(p, dpi, format)?;
+                sink(p, img)?;
+            }
+            return Ok(());
         }
-        encode_image(r.width, r.height, &r.rgba, format, self.dpi_used(page, dpi))
+        let used: Vec<f64> = pages.iter().map(|p| self.dpi_used(*p, dpi)).collect();
+        let count = self.pages;
+        let (bytes, config) = (&self.bytes, &self.config);
+        let next = AtomicUsize::new(0);
+        let stop = AtomicBool::new(false);
+        // How many pages `sink` has taken; a worker waits while its page is `workers` past it.
+        let handed_over = (Mutex::new(0usize), Condvar::new());
+        let (tx, rx) = mpsc::channel::<(usize, Result<Vec<u8>, String>)>();
+        let mut first = Some(&mut self.renderer);
+        std::thread::scope(|s| {
+            let handles: Vec<_> = (0..workers)
+                .map(|_| {
+                    let tx = tx.clone();
+                    let (first, used, next, stop, handed_over) = (first.take(), &used, &next, &stop, &handed_over);
+                    s.spawn(move || {
+                        let mut own = None;
+                        let renderer = match first {
+                            Some(r) => r,
+                            None => own.insert(PageRenderer::new(bytes.clone(), config.clone())),
+                        };
+                        loop {
+                            let i = next.fetch_add(1, Ordering::Relaxed);
+                            let (Some(&page), Some(&used)) = (pages.get(i), used.get(i)) else { break };
+                            let mut taken = handed_over.0.lock().unwrap_or_else(PoisonError::into_inner);
+                            while i >= taken.saturating_add(workers) && !stop.load(Ordering::Relaxed) {
+                                taken = handed_over.1.wait(taken).unwrap_or_else(PoisonError::into_inner);
+                            }
+                            drop(taken);
+                            if stop.load(Ordering::Relaxed) {
+                                break;
+                            }
+                            let img = if page < count {
+                                catch_unwind(AssertUnwindSafe(|| draw_image(renderer, page, dpi, format, used)))
+                                    .unwrap_or_else(|_| Err(format!("page {}: the export crashed", page + 1)))
+                            } else {
+                                Err(format!("page {} does not exist", page + 1))
+                            };
+                            if tx.send((i, img)).is_err() {
+                                break;
+                            }
+                        }
+                    })
+                })
+                .collect();
+            drop(tx);
+            // Stops the workers however this ends, a panicking `sink` included: waiting ones
+            // would otherwise keep the scope from returning.
+            let stopper = StopWorkers { stop: &stop, handed_over: &handed_over };
+            let mut ready = BTreeMap::new();
+            let mut result = Ok(());
+            let mut taken = 0;
+            while let Some(&page) = pages.get(taken) {
+                let Some(img) = ready.remove(&taken) else {
+                    match rx.recv() {
+                        Ok((i, img)) => {
+                            ready.insert(i, img);
+                        }
+                        Err(_) => {
+                            result = Err(format!("page {}: the export stopped unexpectedly", page + 1));
+                            break;
+                        }
+                    }
+                    continue;
+                };
+                if let Err(e) = img.and_then(|img| sink(page, img)) {
+                    result = Err(e);
+                    break;
+                }
+                taken += 1;
+                *handed_over.0.lock().unwrap_or_else(PoisonError::into_inner) = taken;
+                handed_over.1.notify_all();
+            }
+            drop(stopper);
+            // Joined here, so a worker that panicked outside a page is not re-raised by the scope.
+            for h in handles {
+                let _ = h.join();
+            }
+            result
+        })
+    }
+
+    /// How many pages [`Exporter::images`] draws at once: one per core but one, up to
+    /// [`MAX_IMAGE_WORKERS`], as many as [`IMAGE_MEMORY`] holds of the largest page, and one
+    /// when there is nothing to share or no threads (wasm).
+    fn image_workers(&self, pages: &[usize], dpi: f64) -> usize {
+        if cfg!(target_arch = "wasm32") || pages.len() < 2 {
+            return 1;
+        }
+        // One core is left for the interface, which keeps drawing while an export runs.
+        let cores = std::thread::available_parallelism().map_or(1, std::num::NonZeroUsize::get).saturating_sub(1).min(MAX_IMAGE_WORKERS);
+        // The raster (RGBA), the RGB copy the encoders take, and room for the encoded file.
+        let largest = pages
+            .iter()
+            .filter_map(|p| {
+                let (w, h) = *self.sizes.get(*p)?;
+                let k = self.dpi_used(*p, dpi) / 72.0;
+                Some((f64::from(w) * k).ceil() * (f64::from(h) * k).ceil() * 8.0)
+            })
+            .fold(0.0, f64::max);
+        // A float-to-integer cast saturates (and NaN is 0).
+        let by_memory = if largest > 0.0 { (IMAGE_MEMORY / largest) as usize } else { cores };
+        cores.min(by_memory).min(pages.len()).max(1)
     }
 
     /// The reading-order text of a page.
diff --git a/crates/engine/src/fill_sign.rs b/crates/engine/src/fill_sign.rs
new file mode 100644
index 0000000000..1bd8c68d05
--- /dev/null
+++ b/crates/engine/src/fill_sign.rs
@@ -0,0 +1,47 @@
+//! Fill & Sign geometry: typed signatures, and boxes placed as a turned page displays them.
+
+use crate::{Shape, script_outline, signature_image};
+
+/// Fill & Sign: `text` in the script font as a typed signature, its left edge at `at` (user
+/// space, vertically centred) and `height` points tall. `None` for text with no outlines.
+///
+/// Left, centred and upright are as displayed on a page turned by `rotation` (its `/Rotate`):
+/// the box runs along the displayed axes, like an image signature's
+/// ([`SignatureImage::rect`](crate::SignatureImage::rect)), and the outlines are turned back so the name reads across.
+pub fn typed_signature_shape(at: [f64; 2], text: &str, height: f64, rotation: i64) -> Option<Shape> {
+    let o = script_outline(text);
+    let [left, bottom, right, top] = o.bounds();
+    let span = (top - bottom).max(0.1);
+    let width = right - left;
+    if o.contours.is_empty() || o.width <= 0.0 || !(width > 0.0 && height > 0.0) {
+        return None;
+    }
+    let k = height / span;
+    let rect = signature_image::upright_box(rotation, at, width * k, height)?;
+    // Displayed right and up as user-space unit vectors: a point at (nx, ny) of the displayed box
+    // is at this fraction of the user-space box. Exact for an unturned page.
+    let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(rotation, [0.0; 4]);
+    let to_user = |nx: f64, ny: f64| [a * nx + c * ny + (-a).max(0.0) + (-c).max(0.0), b * nx + d * ny + (-b).max(0.0) + (-d).max(0.0)];
+    let contours = o.contours.iter().map(|c| c.iter().map(|p| to_user((p[0] - left) / width, (p[1] - bottom) / span)).collect()).collect();
+    Some(Shape::TypedSignature { rect, contours })
+}
+
+/// `at` moved `right` and `up` points as displayed on a page turned by `rotation` (its `/Rotate`).
+pub fn displayed_offset(rotation: i64, at: [f64; 2], right: f64, up: f64) -> [f64; 2] {
+    let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(rotation, [0.0; 4]);
+    [at[0] + a * right + c * up, at[1] + b * right + d * up]
+}
+
+/// The user-space box `width` x `height` points as displayed on a page turned by `rotation`,
+/// with its displayed top-left corner at `at`: where typed text and text boxes go. `None` for a
+/// non-finite point.
+pub fn text_box_at(rotation: i64, at: [f64; 2], width: f64, height: f64) -> Option<[f64; 4]> {
+    signature_image::upright_box(rotation, displayed_offset(rotation, at, 0.0, -height / 2.0), width, height)
+}
+
+/// `text` in the script font as the graphic of a visible digital signature, as Fill & Sign types
+/// it. `None` for text with no outlines.
+pub fn typed_signature_graphic(text: &str) -> Option<pdfcraft_sign::Graphic> {
+    let o = script_outline(text);
+    o.contours.iter().any(|c| c.len() > 2).then_some(pdfcraft_sign::Graphic::Outlines(o.contours))
+}
diff --git a/crates/engine/src/history.rs b/crates/engine/src/history.rs
new file mode 100644
index 0000000000..fafa65b4c2
--- /dev/null
+++ b/crates/engine/src/history.rs
@@ -0,0 +1,233 @@
+//! Undo/redo: the editing state of a document, its snapshots and their labels.
+
+use std::sync::Arc;
+
+use crate::{AppearanceCache, Edit, EditError, Shape};
+
+/// Undo/redo depth. Snapshots share unchanged data, so this is memory-cheap.
+pub(crate) const MAX_UNDO: usize = 100;
+
+/// The passwords that go with one state of a document (protection can change them).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct Keys {
+    /// What the renderer and inspector open the working file with (the user password).
+    pub(crate) render: Option<String>,
+    /// What the editor re-opens a saved file with: the strongest password known (owner if any).
+    pub(crate) reopen: Option<String>,
+}
+
+/// What an edit can change, and so what the view data must be rebuilt from.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Scope {
+    /// Anything: re-inspect the whole document.
+    Full,
+    /// Document-information entries; page content and appearances are unchanged.
+    Metadata,
+    /// Only comments: re-read the comment list from the object graph.
+    Comments,
+    /// Only form field values (and their widget appearances).
+    Form,
+    /// Link annotations; the full inspection is refreshed, but page-content indexes stay valid.
+    Links,
+    /// Only page content streams, resources and added content/marks: the page tree,
+    /// annotations, form fields, links, outline and fonts are unchanged, so the full
+    /// re-inspection is skipped (seconds on very large files).
+    Content,
+}
+
+/// Edits during which field scripts run.
+pub(crate) fn uses_scripts(edit: &Edit) -> bool {
+    match edit {
+        Edit::SetFieldValue { .. } | Edit::ApplyScriptChanges { .. } | Edit::SetFieldScript { .. } | Edit::SetCalculationOrder { .. } => true,
+        Edit::Batch { edits, .. } => edits.iter().any(uses_scripts),
+        _ => false,
+    }
+}
+
+pub(crate) fn scope_of(edit: &Edit) -> Scope {
+    match edit {
+        Edit::SetInfo { .. } => Scope::Metadata,
+        // The Attachments list is read from the whole document.
+        Edit::AddAttachment { .. } | Edit::DeleteAttachment { .. } => Scope::Full,
+        // A file attachment also changes the Attachments list.
+        Edit::AddAnnotation(a) if matches!(a.shape, Shape::Attachment { .. }) => Scope::Full,
+        Edit::AddMeasurement(_)
+        | Edit::AddAnnotation(_)
+        | Edit::AddCustomStamp { .. }
+        | Edit::DeleteAnnotation { .. }
+        | Edit::SetAnnotationContents { .. }
+        | Edit::ReplyToAnnotation { .. }
+        | Edit::SetAnnotationStatus { .. }
+        | Edit::MarkAnnotation { .. }
+        | Edit::LockAnnotation { .. }
+        | Edit::ReplaceText { .. }
+        | Edit::EraseInk { .. }
+        | Edit::MoveAnnotation { .. }
+        | Edit::ReshapeAnnotation { .. }
+        | Edit::ResizeAnnotation { .. }
+        | Edit::StyleAnnotation { .. }
+        | Edit::FillAnnotation { .. }
+        | Edit::FontSizeAnnotation { .. }
+        | Edit::SetAnnotationInfo { .. } => Scope::Comments,
+        Edit::AddLink { .. } | Edit::SetLink { .. } | Edit::DeleteLink { .. } | Edit::RemoveLinks { .. } | Edit::AddLinks { .. } => Scope::Links,
+        Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::ApplyScriptChanges { .. } => Scope::Form,
+        // Page content, resources and added content/marks only: the page tree, annotations,
+        // fields, links and document metadata are untouched (see `refresh_content`).
+        Edit::MoveObjects { .. }
+        | Edit::EditTextLine { .. }
+        | Edit::EditTextBlock { .. }
+        | Edit::EditPageImage { .. }
+        | Edit::AddText { .. }
+        | Edit::AddImage { .. }
+        | Edit::UpdateContent { .. }
+        | Edit::DeleteContent { .. }
+        | Edit::ReplaceImage { .. }
+        | Edit::PasteContent { .. }
+        | Edit::AddHeaderFooter { .. }
+        | Edit::AddWatermark { .. }
+        | Edit::AddBackground { .. }
+        | Edit::RemoveMarks { .. } => Scope::Content,
+        Edit::Batch { edits, .. } => {
+            let mut scopes = edits.iter().map(scope_of);
+            let first = scopes.next().unwrap_or(Scope::Full);
+            if scopes.all(|s| s == first) { first } else { Scope::Full }
+        }
+        _ => Scope::Full,
+    }
+}
+
+/// One undo/redo step: its label, the document state, its passwords, and what it changed.
+pub(crate) type Snapshot = (Label, pdfcraft_cos::Document, Keys, Scope);
+
+/// Editing state of a document (absent when the document cannot be edited yet, e.g. encrypted).
+#[derive(Clone)]
+pub(crate) struct Editor {
+    pub(crate) cos: pdfcraft_cos::Document,
+    /// The file as last opened or saved. Incremental saves append to it, and Revert opens it.
+    /// Undo may restore a snapshot whose own base is an earlier revision; this does not follow it.
+    pub(crate) saved: Arc<Vec<u8>>,
+    /// Passwords that open [`Self::saved`].
+    pub(crate) saved_keys: Keys,
+    /// [`Self::saved`] was never written where the document belongs: a new document (combine,
+    /// extract, create) or one restored from recovery. It stays unsaved until a save, whatever
+    /// undo brings back, or closing it would lose the whole document without asking.
+    pub(crate) unsaved_file: bool,
+    pub(crate) undo: Vec<Snapshot>,
+    pub(crate) redo: Vec<Snapshot>,
+    pub(crate) keys: Keys,
+    /// Display appearances built for annotations without any, reused while no annotation edit
+    /// runs (content edits leave every annotation dictionary alone). Cleared on any refresh
+    /// that may change annotations; see [`AppearanceCache`].
+    pub(crate) appearances: AppearanceCache,
+    /// Display appearances drawn for form fields the file leaves to the viewer (#3470), reused
+    /// for each widget while the objects it was drawn from are unchanged; see
+    /// [`pdfcraft_forms::FieldAppearanceCache`].
+    pub(crate) field_appearances: pdfcraft_forms::FieldAppearanceCache,
+    /// The text blocks last computed for one page, reused while the document is unchanged.
+    pub(crate) text_blocks: TextBlocksCache,
+}
+
+/// One page's text blocks ([`pdfcraft_edit::text_blocks`]) and the document state they were read
+/// from. Opening a paragraph and applying its edit both need them, and grouping a long page is not
+/// cheap. The state ([`pdfcraft_cos::ReadState`]) changes with every edit and save and returns
+/// with undo, so a stale entry never matches, also after the document has been edited.
+#[derive(Default)]
+pub(crate) struct TextBlocksCache(std::sync::Mutex<Option<CachedTextBlocks>>);
+
+/// The document state, the page (0-based) and its text blocks.
+type CachedTextBlocks = (pdfcraft_cos::ReadState, usize, Arc<Vec<pdfcraft_edit::TextBlock>>);
+
+impl Clone for TextBlocksCache {
+    fn clone(&self) -> Self {
+        // A poisoned cache only loses the cached blocks.
+        Self(std::sync::Mutex::new(self.0.lock().ok().and_then(|c| c.clone())))
+    }
+}
+
+impl Editor {
+    /// The text blocks on `page` (0-based), from the cache when the document hasn't changed.
+    pub(crate) fn text_blocks(&self, page: usize) -> Result<Arc<Vec<pdfcraft_edit::TextBlock>>, EditError> {
+        if let Ok(cache) = self.text_blocks.0.lock()
+            && let Some((state, p, blocks)) = cache.as_ref()
+            && *p == page
+            && state.matches(&self.cos)
+        {
+            return Ok(blocks.clone());
+        }
+        let blocks = Arc::new(pdfcraft_edit::text_blocks(&self.cos, page)?);
+        if let Ok(mut cache) = self.text_blocks.0.lock() {
+            *cache = Some((self.cos.read_state(), page, blocks.clone()));
+        }
+        Ok(blocks)
+    }
+}
+
+/// What an edit is called in the Edit menu and in the history ("Undo Rotate pages"), in two parts:
+/// a whole English wording, and the one value the document itself supplies for the wording's hole
+/// (a file name, a field name). An interface in another language looks the wording up and says the
+/// label with [`said`](Self::said); [`as_str`](Self::as_str) is the English, said the same way, so
+/// the two cannot drift apart.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Label {
+    /// The wording, with one named hole (`{name}`) where `value` goes. Listed in [`EDIT_LABELS`](crate::EDIT_LABELS).
+    pub wording: &'static str,
+    /// What the document supplies, when the wording has a hole for it.
+    pub value: Option<String>,
+    text: String,
+}
+
+impl Label {
+    /// A wording with nothing to fill in.
+    pub fn of(wording: &'static str) -> Self {
+        Self { wording, value: None, text: wording.to_string() }
+    }
+
+    /// A wording whose hole the document fills in.
+    pub fn with(wording: &'static str, value: impl Into<String>) -> Self {
+        let mut label = Self { wording, value: Some(value.into()), text: String::new() };
+        label.text = label.said(wording);
+        label
+    }
+
+    /// The label read with this wording: the interface's translation of [`wording`](Self::wording),
+    /// or the English wording itself. What the document supplies goes in as it stands and is not
+    /// read again, so a name with braces in it stays whole.
+    pub fn said(&self, wording: &str) -> String {
+        let Some(value) = &self.value else { return wording.to_owned() };
+        // `{` and `}` are ASCII, so these are char boundaries.
+        match (wording.find('{'), wording.find('}')) {
+            (Some(open), Some(close)) if open < close => {
+                let mut said = String::with_capacity(wording.len() + value.len());
+                said.push_str(&wording[..open]);
+                said.push_str(value);
+                said.push_str(&wording[close + 1..]);
+                said
+            }
+            // A translation that lost its hole is said as it stands rather than losing the value.
+            _ => wording.to_owned(),
+        }
+    }
+
+    /// The label as English reads it.
+    pub fn as_str(&self) -> &str {
+        &self.text
+    }
+}
+
+impl std::fmt::Display for Label {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.text)
+    }
+}
+
+/// The passwords after `edit`, if it changes them.
+pub(crate) fn keys_after(edit: &Edit) -> Option<Keys> {
+    match edit {
+        Edit::Protect(p) => {
+            Some(Keys { render: p.open_password.clone(), reopen: p.permissions_password.clone().or_else(|| p.open_password.clone()) })
+        }
+        Edit::RemoveProtection => Some(Keys::default()),
+        Edit::Batch { edits, .. } => edits.iter().rev().find_map(keys_after),
+        _ => None,
+    }
+}
diff --git a/crates/engine/src/layers.rs b/crates/engine/src/layers.rs
new file mode 100644
index 0000000000..c2f4f63714
--- /dev/null
+++ b/crates/engine/src/layers.rs
@@ -0,0 +1,60 @@
+//! Layer (optional content) visibility: what the view shows and what printing writes.
+
+use std::sync::Arc;
+
+use pdfcraft_render::{Layer, LayerOp, RenderPool};
+
+use crate::{Document, render_threads};
+
+/// Write `layers`' visibility into the default optional-content configuration of `cos` (a copy
+/// made for printing): `/BaseState /ON`, `/ON` the visible layers, `/OFF` the hidden ones. Its
+/// other entries (`/Order`, `/RBGroups`, `/AS`…) are kept. A document without `/OCProperties`
+/// is left alone.
+pub(crate) fn set_default_layer_state(cos: &mut pdfcraft_cos::Document, layers: &[Layer]) {
+    use pdfcraft_cos::{Dict, ObjRef, Object};
+    let Some(root_ref) = cos.trailer().get(b"Root").and_then(Object::as_ref) else { return };
+    let Some(mut root) = cos.get(root_ref).as_dict().cloned() else { return };
+    let Some(properties) = root.get(b"OCProperties").cloned() else { return };
+    let Some(mut properties) = cos.resolve(&properties).as_dict().cloned() else { return };
+    let mut config = properties.get(b"D").and_then(|d| cos.resolve(d).as_dict().cloned()).unwrap_or_else(Dict::new);
+    let refs =
+        |visible: bool| Object::Array(layers.iter().filter(|l| l.visible == visible).map(|l| Object::Ref(ObjRef::new(l.id.0, l.id.1))).collect());
+    config.set(b"BaseState".to_vec(), Object::name("ON"));
+    config.set(b"ON".to_vec(), refs(true));
+    config.set(b"OFF".to_vec(), refs(false));
+    properties.set(b"D".to_vec(), Object::Dict(config));
+    root.set(b"OCProperties".to_vec(), Object::Dict(properties));
+    cos.set(root_ref, Object::Dict(root));
+}
+
+/// Render `doc` with the layer visibility in its `info.layers`.
+pub(crate) fn use_layer_choices(doc: &mut Document) {
+    let overrides: Vec<(i32, i32, bool)> = doc.info.layers.iter().map(|l| (l.id.0 as i32, l.id.1 as i32, l.visible)).collect();
+    doc.config.layers = Arc::new(overrides);
+    doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+}
+
+/// Apply a set-layer-visibility action to `layers`, one change at a time, so a toggle flips the
+/// state the changes before it left. Returns whether any layer ended up changed.
+pub(crate) fn apply_layer_state(layers: &mut [Layer], groups: &[Vec<(u32, u16)>], changes: &[(LayerOp, (u32, u16))], preserve_rb: bool) -> bool {
+    let before: Vec<bool> = layers.iter().map(|l| l.visible).collect();
+    let index: std::collections::HashMap<(u32, u16), usize> = layers.iter().enumerate().map(|(i, l)| (l.id, i)).collect();
+    for &(op, ocg) in changes {
+        let Some(layer) = index.get(&ocg).and_then(|&i| layers.get_mut(i)) else { continue };
+        let on = match op {
+            LayerOp::On => true,
+            LayerOp::Off => false,
+            LayerOp::Toggle => !layer.visible,
+        };
+        layer.visible = on;
+        // Turning a layer off leaves the rest of its groups alone.
+        if on && preserve_rb {
+            for other in groups.iter().filter(|g| g.contains(&ocg)).flatten().filter(|&&o| o != ocg) {
+                if let Some(l) = index.get(other).and_then(|&i| layers.get_mut(i)) {
+                    l.visible = false;
+                }
+            }
+        }
+    }
+    layers.iter().zip(before).any(|(l, was)| l.visible != was)
+}
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index ceaaa79523..889b839368 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -14,33 +14,55 @@
 
 pub mod actions;
 pub mod autotag;
+mod bookmarks;
 pub mod build_info;
 pub mod camera;
 pub mod camera_clean;
 pub mod camera_edges;
 pub mod catalog;
 pub mod commands;
+mod comments;
 pub mod compare;
 mod copy_image;
 pub mod dates;
+mod document;
+mod edit;
+mod error;
 pub mod export;
 pub mod field_table;
+mod fill_sign;
+mod history;
 pub mod js;
+mod layers;
 pub mod links;
 pub mod ocr;
+mod open;
 pub mod optimizer;
+mod page_filter;
+mod pictures;
 pub mod print_raster;
 pub mod printcheck;
+mod protection;
 mod scan_colours;
 mod scan_fields;
+mod session;
 pub mod signature_image;
 pub mod signature_scan;
+mod sources;
 mod stamp_preview;
+#[cfg(test)]
+mod test_hooks;
 pub mod text_fonts;
 mod text_preview;
 pub mod word_count;
 pub mod xfa;
+mod xfa_form;
 
+use std::sync::Arc;
+
+pub use links::{
+    MAX_REMOTE_DOCUMENT_BYTES, RemoteDocumentPathError, read_remote_document, remote_document_path_is_absolute, resolve_remote_document_path,
+};
 pub use signature_image::{ImageSignaturePreview, SignatureImage};
 pub use signature_scan::{PhotoRect, ScanError, SignaturePhoto, Turn};
 pub use stamp_preview::StampPreview;
@@ -48,9 +70,9 @@ pub use text_preview::TextEditPreview;
 
 pub use pdfcraft_organize::{BoxSpec, FieldConflicts, PageBox, SplitBy, Transition, TransitionSpec, mime_for_name, split_ranges};
 
-/// One file produced by a split: (1-based first page, last page, PDF bytes).
 pub use pdfcraft_organize::LabelStyle;
 pub use pdfcraft_organize::Standard;
+pub use pdfcraft_organize::check_custom_key;
 pub use pdfcraft_organize::view::{InitialView, Layout as InitialLayout, Magnification, Navigation};
 
 pub use pdfcraft_cos::Algorithm;
@@ -76,75 +98,8 @@ pub use pdfcraft_xfa::Report as XfaLayout;
 
 pub use pdfcraft_edit::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget};
 
-/// A change to an existing page image.
-#[derive(Clone, Debug, PartialEq)]
-pub enum ImageEdit {
-    /// Move and resize it to this box (user space).
-    Move([f64; 4]),
-    /// Quarter turns clockwise about its centre.
-    Rotate(i32),
-    /// Any angle in degrees clockwise about its centre (the unit is degrees, not quarter turns).
-    RotateBy(f64),
-    Flip {
-        horizontal: bool,
-    },
-    /// Show only this box of it (user space), the pixels staying where they are.
-    Crop([f64; 4]),
-    /// Draw this image file (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000) in its place.
-    Replace {
-        name: String,
-        bytes: Arc<Vec<u8>>,
-    },
-    Delete,
-}
 pub use pdfcraft_fonts::{MAX_SIGNATURE_CHARS, ScriptOutline, script_missing, script_outline, undrawable_message};
 
-/// Fill & Sign: `text` in the script font as a typed signature, its left edge at `at` (user
-/// space, vertically centred) and `height` points tall. `None` for text with no outlines.
-///
-/// Left, centred and upright are as displayed on a page turned by `rotation` (its `/Rotate`):
-/// the box runs along the displayed axes, like an image signature's
-/// ([`SignatureImage::rect`]), and the outlines are turned back so the name reads across.
-pub fn typed_signature_shape(at: [f64; 2], text: &str, height: f64, rotation: i64) -> Option<Shape> {
-    let o = script_outline(text);
-    let [left, bottom, right, top] = o.bounds();
-    let span = (top - bottom).max(0.1);
-    let width = right - left;
-    if o.contours.is_empty() || o.width <= 0.0 || !(width > 0.0 && height > 0.0) {
-        return None;
-    }
-    let k = height / span;
-    let rect = signature_image::upright_box(rotation, at, width * k, height)?;
-    // Displayed right and up as user-space unit vectors: a point at (nx, ny) of the displayed box
-    // is at this fraction of the user-space box. Exact for an unturned page.
-    let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(rotation, [0.0; 4]);
-    let to_user = |nx: f64, ny: f64| [a * nx + c * ny + (-a).max(0.0) + (-c).max(0.0), b * nx + d * ny + (-b).max(0.0) + (-d).max(0.0)];
-    let contours = o.contours.iter().map(|c| c.iter().map(|p| to_user((p[0] - left) / width, (p[1] - bottom) / span)).collect()).collect();
-    Some(Shape::TypedSignature { rect, contours })
-}
-/// `at` moved `right` and `up` points as displayed on a page turned by `rotation` (its `/Rotate`).
-pub fn displayed_offset(rotation: i64, at: [f64; 2], right: f64, up: f64) -> [f64; 2] {
-    let [a, b, c, d, ..] = pdfcraft_model::view_matrix_for(rotation, [0.0; 4]);
-    [at[0] + a * right + c * up, at[1] + b * right + d * up]
-}
-
-/// The user-space box `width` x `height` points as displayed on a page turned by `rotation`,
-/// with its displayed top-left corner at `at`: where typed text and text boxes go. `None` for a
-/// non-finite point.
-pub fn text_box_at(rotation: i64, at: [f64; 2], width: f64, height: f64) -> Option<[f64; 4]> {
-    signature_image::upright_box(rotation, displayed_offset(rotation, at, 0.0, -height / 2.0), width, height)
-}
-
-/// `text` in the script font as the graphic of a visible digital signature, as Fill & Sign types
-/// it. `None` for text with no outlines.
-pub fn typed_signature_graphic(text: &str) -> Option<pdfcraft_sign::Graphic> {
-    let o = script_outline(text);
-    o.contours.iter().any(|c| c.len() > 2).then_some(pdfcraft_sign::Graphic::Outlines(o.contours))
-}
-
-pub use links::{
-    MAX_REMOTE_DOCUMENT_BYTES, RemoteDocumentPathError, read_remote_document, remote_document_path_is_absolute, resolve_remote_document_path,
-};
 /// Comment geometry helpers (text-box line breaking) for frontends.
 pub use pdfcraft_annot::appearance as annot_text;
 pub use pdfcraft_annot::links::{Highlight as LinkHighlight, LinkAction, LinkItem, LinkStyle};
@@ -165,5440 +120,39 @@ pub use pdfcraft_sign as sign;
 pub use pdfcraft_sign::{SignOptions, SignatureInfo, Status as SignatureStatus, TrustStore};
 pub use pdfcraft_xfdf::Format as DataFormat;
 
-/// Forms ▸ Merge data files into spreadsheet: the field values of each file (FDF, XFDF or a
-/// filled-in PDF form), as CSV with one row per file.
-pub fn merge_data_files(files: &[(String, Vec<u8>)]) -> Result<String, String> {
-    let rows =
-        files.iter().map(|(name, bytes)| pdfcraft_xfdf::data_values(bytes).map_err(|e| format!("{name}: {e}"))).collect::<Result<Vec<_>, _>>()?;
-    Ok(pdfcraft_xfdf::merge_csv(&rows))
-}
-
-pub type SplitPart = (usize, usize, Arc<Vec<u8>>);
-
-use std::sync::{Arc, OnceLock};
-
+use bookmarks::outline_rows;
+pub use bookmarks::{BookmarkPage, BookmarkRow};
+use comments::comment_list;
+pub use comments::{SummarySort, comment_kind, comment_summary, comment_type_name};
+pub use document::{Document, TextNotice, display_bytes_for, render_password_for};
+use document::{display_bytes, info_fields, recovered_render_password, same_pages, shown_under_redactions, undrawn_notices};
+pub use edit::{BATCH_LABELS, EDIT_LABELS, Edit};
+pub use error::{EditError, SourceProblem};
+pub use fill_sign::{displayed_offset, text_box_at, typed_signature_graphic, typed_signature_shape};
+pub use history::Label;
+use layers::{apply_layer_state, set_default_layer_state, use_layer_choices};
+pub use open::{OpenContext, PreparedDocument};
+pub use page_filter::{PageOrientation, PageParity, filter_pages};
+pub use pictures::MarkFile;
+use pictures::{embed_image, fit_picture, mark_source};
+use protection::unrestricted;
+pub use protection::{Changes, Printing, Protection, SecuritySummary};
+pub use session::Session;
+pub use sources::{CombineSource, Combined, combine_source_check, source_page_count};
+use sources::{open_source, open_source_with};
 #[cfg(test)]
-thread_local! {
-    static SECONDARY_SCAN_COUNTS: std::cell::Cell<(usize, usize)> = const { std::cell::Cell::new((0, 0)) };
-    static REFRESH_PANICS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-#[cfg(test)]
-fn panic_on_refresh(count: usize) {
-    REFRESH_PANICS.with(|n| n.set(count));
-}
-
-#[cfg(test)]
-fn check_refresh_panic() {
-    REFRESH_PANICS.with(|n| {
-        let rem = n.get();
-        if rem > 0 {
-            n.set(rem - 1);
-            panic!("injected refresh panic");
-        }
-    });
-}
-
-#[cfg(test)]
-fn reset_secondary_scan_counts() {
-    SECONDARY_SCAN_COUNTS.with(|counts| counts.set((0, 0)));
-}
-
-#[cfg(test)]
-fn secondary_scan_counts() -> (usize, usize) {
-    SECONDARY_SCAN_COUNTS.with(std::cell::Cell::get)
-}
-
-#[cfg(test)]
-fn record_marker_scan() {
-    SECONDARY_SCAN_COUNTS.with(|counts| {
-        let (markers, links) = counts.get();
-        counts.set((markers + 1, links));
-    });
-}
-
-#[cfg(test)]
-fn record_link_scan() {
-    SECONDARY_SCAN_COUNTS.with(|counts| {
-        let (markers, links) = counts.get();
-        counts.set((markers, links + 1));
-    });
-}
-
-use pdfcraft_cos::{SaveOptions, write_full, write_incremental};
-use pdfcraft_render::{DocInfo, Layer, LayerOp, OpenError, ReadingColors, RenderConfig, RenderPool, inspect};
-
-/// Stable identifier of an open document within a session.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub struct DocId(pub u64);
-
-/// Undo/redo depth. Snapshots share unchanged data, so this is memory-cheap.
-const MAX_UNDO: usize = 100;
-
-/// The highest resolution a document that allows only low-resolution printing (Table 22, bit 12
-/// clear) is printed at.
-const LOW_RESOLUTION_PRINT_DPI: f64 = 150.0;
-
-/// The passwords that go with one state of a document (protection can change them).
-#[derive(Clone, Debug, Default, PartialEq)]
-struct Keys {
-    /// What the renderer and inspector open the working file with (the user password).
-    render: Option<String>,
-    /// What the editor re-opens a saved file with: the strongest password known (owner if any).
-    reopen: Option<String>,
-}
-
-/// What an edit can change, and so what the view data must be rebuilt from.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum Scope {
-    /// Anything: re-inspect the whole document.
-    Full,
-    /// Document-information entries; page content and appearances are unchanged.
-    Metadata,
-    /// Only comments: re-read the comment list from the object graph.
-    Comments,
-    /// Only form field values (and their widget appearances).
-    Form,
-    /// Link annotations; the full inspection is refreshed, but page-content indexes stay valid.
-    Links,
-    /// Only page content streams, resources and added content/marks: the page tree,
-    /// annotations, form fields, links, outline and fonts are unchanged, so the full
-    /// re-inspection is skipped (seconds on very large files).
-    Content,
-}
-
-/// Edits during which field scripts run.
-fn uses_scripts(edit: &Edit) -> bool {
-    match edit {
-        Edit::SetFieldValue { .. } | Edit::ApplyScriptChanges { .. } | Edit::SetFieldScript { .. } | Edit::SetCalculationOrder { .. } => true,
-        Edit::Batch { edits, .. } => edits.iter().any(uses_scripts),
-        _ => false,
-    }
-}
-
-fn scope_of(edit: &Edit) -> Scope {
-    match edit {
-        Edit::SetInfo { .. } => Scope::Metadata,
-        // The Attachments list is read from the whole document.
-        Edit::AddAttachment { .. } | Edit::DeleteAttachment { .. } => Scope::Full,
-        // A file attachment also changes the Attachments list.
-        Edit::AddAnnotation(a) if matches!(a.shape, Shape::Attachment { .. }) => Scope::Full,
-        Edit::AddMeasurement(_)
-        | Edit::AddAnnotation(_)
-        | Edit::AddCustomStamp { .. }
-        | Edit::DeleteAnnotation { .. }
-        | Edit::SetAnnotationContents { .. }
-        | Edit::ReplyToAnnotation { .. }
-        | Edit::SetAnnotationStatus { .. }
-        | Edit::MarkAnnotation { .. }
-        | Edit::LockAnnotation { .. }
-        | Edit::ReplaceText { .. }
-        | Edit::EraseInk { .. }
-        | Edit::MoveAnnotation { .. }
-        | Edit::ReshapeAnnotation { .. }
-        | Edit::ResizeAnnotation { .. }
-        | Edit::StyleAnnotation { .. }
-        | Edit::FillAnnotation { .. }
-        | Edit::FontSizeAnnotation { .. }
-        | Edit::SetAnnotationInfo { .. } => Scope::Comments,
-        Edit::AddLink { .. } | Edit::SetLink { .. } | Edit::DeleteLink { .. } | Edit::RemoveLinks { .. } | Edit::AddLinks { .. } => Scope::Links,
-        Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::ApplyScriptChanges { .. } => Scope::Form,
-        // Page content, resources and added content/marks only: the page tree, annotations,
-        // fields, links and document metadata are untouched (see `refresh_content`).
-        Edit::MoveObjects { .. }
-        | Edit::EditTextLine { .. }
-        | Edit::EditTextBlock { .. }
-        | Edit::EditPageImage { .. }
-        | Edit::AddText { .. }
-        | Edit::AddImage { .. }
-        | Edit::UpdateContent { .. }
-        | Edit::DeleteContent { .. }
-        | Edit::ReplaceImage { .. }
-        | Edit::PasteContent { .. }
-        | Edit::AddHeaderFooter { .. }
-        | Edit::AddWatermark { .. }
-        | Edit::AddBackground { .. }
-        | Edit::RemoveMarks { .. } => Scope::Content,
-        Edit::Batch { edits, .. } => {
-            let mut scopes = edits.iter().map(scope_of);
-            let first = scopes.next().unwrap_or(Scope::Full);
-            if scopes.all(|s| s == first) { first } else { Scope::Full }
-        }
-        _ => Scope::Full,
-    }
-}
-
-/// One undo/redo step: its label, the document state, its passwords, and what it changed.
-type Snapshot = (Label, pdfcraft_cos::Document, Keys, Scope);
-
-/// Editing state of a document (absent when the document cannot be edited yet, e.g. encrypted).
-#[derive(Clone)]
-struct Editor {
-    cos: pdfcraft_cos::Document,
-    /// The file as last opened or saved. Incremental saves append to it, and Revert opens it.
-    /// Undo may restore a snapshot whose own base is an earlier revision; this does not follow it.
-    saved: Arc<Vec<u8>>,
-    /// Passwords that open [`Self::saved`].
-    saved_keys: Keys,
-    /// [`Self::saved`] was never written where the document belongs: a new document (combine,
-    /// extract, create) or one restored from recovery. It stays unsaved until a save, whatever
-    /// undo brings back, or closing it would lose the whole document without asking.
-    unsaved_file: bool,
-    undo: Vec<Snapshot>,
-    redo: Vec<Snapshot>,
-    keys: Keys,
-    /// Display appearances built for annotations without any, reused while no annotation edit
-    /// runs (content edits leave every annotation dictionary alone). Cleared on any refresh
-    /// that may change annotations; see [`AppearanceCache`].
-    appearances: AppearanceCache,
-    /// Display appearances drawn for form fields the file leaves to the viewer (#3470), reused
-    /// for each widget while the objects it was drawn from are unchanged; see
-    /// [`pdfcraft_forms::FieldAppearanceCache`].
-    field_appearances: pdfcraft_forms::FieldAppearanceCache,
-    /// The text blocks last computed for one page, reused while the document is unchanged.
-    text_blocks: TextBlocksCache,
-}
-
-/// One page's text blocks ([`pdfcraft_edit::text_blocks`]) and the document state they were read
-/// from. Opening a paragraph and applying its edit both need them, and grouping a long page is not
-/// cheap. The state ([`pdfcraft_cos::ReadState`]) changes with every edit and save and returns
-/// with undo, so a stale entry never matches, also after the document has been edited.
-#[derive(Default)]
-struct TextBlocksCache(std::sync::Mutex<Option<CachedTextBlocks>>);
-
-/// The document state, the page (0-based) and its text blocks.
-type CachedTextBlocks = (pdfcraft_cos::ReadState, usize, Arc<Vec<pdfcraft_edit::TextBlock>>);
-
-impl Clone for TextBlocksCache {
-    fn clone(&self) -> Self {
-        // A poisoned cache only loses the cached blocks.
-        Self(std::sync::Mutex::new(self.0.lock().ok().and_then(|c| c.clone())))
-    }
-}
-
-impl Editor {
-    /// The text blocks on `page` (0-based), from the cache when the document hasn't changed.
-    fn text_blocks(&self, page: usize) -> Result<Arc<Vec<pdfcraft_edit::TextBlock>>, EditError> {
-        if let Ok(cache) = self.text_blocks.0.lock()
-            && let Some((state, p, blocks)) = cache.as_ref()
-            && *p == page
-            && state.matches(&self.cos)
-        {
-            return Ok(blocks.clone());
-        }
-        let blocks = Arc::new(pdfcraft_edit::text_blocks(&self.cos, page)?);
-        if let Ok(mut cache) = self.text_blocks.0.lock() {
-            *cache = Some((self.cos.read_state(), page, blocks.clone()));
-        }
-        Ok(blocks)
-    }
-}
-
-pub struct Document {
-    pub id: DocId,
-    pub name: String,
-    pub path: Option<String>,
-    /// The working file: what Save writes.
-    pub bytes: Arc<Vec<u8>>,
-    /// What is displayed (the page view, `page_render`, page images): `bytes`, plus appearances
-    /// drawn for display only for comments that have none ([`display_bytes`]). Never saved.
-    pub display: Arc<Vec<u8>>,
-    pub info: DocInfo,
-    pub renderer: RenderPool,
-    /// The password the document was opened with (needed to read attachments, etc.).
-    pub password: Option<String>,
-    /// `true` when there are edits that have not been saved.
-    pub dirty: bool,
-    /// Bumped on every change to the working file (edit, undo, redo, save); autosave compares it.
-    generation: u64,
-    /// The generation last handed out by `autosave_snapshots`.
-    snapshot_generation: u64,
-    /// Why the document cannot be edited (e.g. encryption), if so.
-    pub read_only_reason: Option<String>,
-    /// Interactive form fields of the current state (empty without a form).
-    pub form: Arc<Vec<pdfcraft_forms::Field>>,
-    marker_scan: OnceLock<pdfcraft_edit::MarkerScan>,
-    links: OnceLock<Vec<pdfcraft_annot::links::LinkItem>>,
-    /// Signature fields, validated against the session's trust store (Signatures panel).
-    pub signatures: Arc<Vec<SignatureInfo>>,
-    trust: Arc<TrustStore>,
-    sig_cache: Arc<pdfcraft_sign::DigestCache>,
-    editor: Option<Editor>,
-    config: RenderConfig,
-    /// What field scripts printed or asked for (see [`Session::take_js_output`]).
-    js_output: js::JsOutput,
-    /// Dynamic XFA forms: what laying the template out produced (pages and fields are
-    /// PdfCraft's; Adobe's viewers draw the form from the XFA packets themselves).
-    pub xfa: Option<XfaLayout>,
-    /// The parsed template of a laid-out XFA form, for its scripts.
-    xfa_template: Option<Arc<pdfcraft_xfa::model::Template>>,
-    /// A script of the XFA form ran away, so its scripts are off (see [`Document::xfa_scripts_off`]).
-    xfa_scripts_off: bool,
-    /// A content-only refresh keeps `info` from before the edit; an edit may have added or
-    /// embedded fonts, so the font list is read again on demand ([`Session::refresh_fonts`]).
-    fonts_stale: bool,
-    /// XFA forms: what was approximated, rewritten or could not be written to the XFA data
-    /// (also in `info.warnings`, kept there when the document is re-read).
-    pub xfa_warnings: Vec<String>,
-    /// What the last successful [`Session::apply`] wrote that its fonts can't draw: kept as typed,
-    /// drawn with `?` in its place (see [`TextNotice`]). The interface shows it; tools return it.
-    pub edit_notices: Vec<TextNotice>,
-}
-
-/// Text an edit stored as typed but drew with `?` in place of `ch`, because the font it is drawn
-/// with (a form field's, or the standard fonts for comments) can't draw that character. Acrobat
-/// keeps such text too, drawing it with fonts PdfCraft can't embed yet.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct TextNotice {
-    /// The form field's full name, or `None` for a comment.
-    pub field: Option<String>,
-    /// The page (0-based) of the comment or of the field's widget.
-    pub page: usize,
-    pub ch: char,
-    /// Other PDF viewers redraw it from the stored text (a form field, with `/NeedAppearances`
-    /// set); otherwise the `?` shows in every viewer.
-    pub redrawn_elsewhere: bool,
-}
-
-impl std::fmt::Display for TextNotice {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let ch = format!("\"{}\" (U+{:04X})", self.ch.escape_debug(), u32::from(self.ch));
-        let page = self.page + 1;
-        match (&self.field, self.redrawn_elsewhere) {
-            (Some(name), true) => write!(
-                f,
-                "form field {name:?} (page {page}) holds {ch}, which its font can't draw: the value is saved, PdfCraft shows ? in its place, and other PDF viewers redraw the field from the value"
-            ),
-            (Some(name), false) => write!(
-                f,
-                "form field {name:?} (page {page}) holds {ch}, which its font can't draw: the value is saved, but this PDF/A document can't ask other viewers to redraw it, so ? shows in its place everywhere"
-            ),
-            (None, _) => write!(
-                f,
-                "a comment on page {page} has {ch}, which the standard fonts can't draw: its text is saved, but its appearance shows ? in its place in every viewer"
-            ),
-        }
-    }
-}
-
-/// What `next` drew with `?` that `prev` didn't (a new or redrawn appearance carrying
-/// `pdfcraft_fonts::UNDRAWN_MARK`), one notice per field or comment, in page order.
-fn undrawn_notices(prev: &pdfcraft_cos::Document, next: &pdfcraft_cos::Document) -> Vec<TextNotice> {
-    let Ok(pages) = pdfcraft_annot::page_refs(next) else { return Vec::new() };
-    let redrawn_elsewhere = pdfcraft_forms::need_appearances(next);
-    let mut names: Option<std::collections::HashMap<pdfcraft_cos::ObjRef, String>> = None;
-    let mut out: Vec<TextNotice> = Vec::new();
-    for (page, p) in pages.iter().enumerate() {
-        let annots = next.get(*p).as_dict().and_then(|d| d.get(b"Annots").cloned()).map(|a| next.resolve(&a));
-        for r in annots.as_deref().and_then(pdfcraft_cos::Object::as_array).into_iter().flatten().filter_map(pdfcraft_cos::Object::as_ref) {
-            let now = next.get(r);
-            let Some(d) = now.as_dict() else { continue };
-            let Some(ch) = pdfcraft_fonts::undrawn_mark(d) else { continue };
-            // Only what this edit drew: a new annotation, or a new appearance.
-            let was = prev.get(r);
-            if was.as_dict().is_some_and(|w| w.get(b"AP") == d.get(b"AP") && pdfcraft_fonts::undrawn_mark(w) == Some(ch)) {
-                continue;
-            }
-            let field = (d.name(b"Subtype") == Some(b"Widget")).then(|| {
-                let names = names.get_or_insert_with(|| {
-                    pdfcraft_forms::fields(next)
-                        .into_iter()
-                        .flat_map(|f| f.widgets.iter().map(|w| (w.obj, f.name.clone())).collect::<Vec<_>>())
-                        .collect()
-                });
-                names.get(&r).cloned().unwrap_or_default()
-            });
-            if field.is_some() && out.iter().any(|n| n.field == field) {
-                continue;
-            }
-            out.push(TextNotice { redrawn_elsewhere: redrawn_elsewhere && field.is_some(), field, page, ch });
-        }
-    }
-    out
-}
-
-impl Document {
-    /// How the document opens (Document Properties ▸ Initial View).
-    /// Accessibility ▸ Check for accessibility: the full check (`None` if the document can't be
-    /// read for editing).
-    pub fn accessibility_check(&self, options: &a11y::Options) -> Option<a11y::Report> {
-        self.editor.as_ref().map(|e| a11y::check(&e.cos, options))
-    }
-
-    /// A script of this XFA form ran past its time limit and was abandoned, so the form's
-    /// scripts no longer run in this document (reopening it runs them again). The script's
-    /// error is in the JavaScript output; this is the state, for a viewer to show.
-    pub fn xfa_scripts_off(&self) -> bool {
-        self.xfa_scripts_off
-    }
-
-    /// PDF Optimizer ▸ Audit space usage.
-    pub fn audit_space(&self) -> Vec<optimize::SpaceUse> {
-        self.editor.as_ref().map(|e| optimize::audit_space(&e.cos, self.bytes.len() as u64)).unwrap_or_default()
-    }
-
-    /// Edit a PDF: the images `page` draws (0-based).
-    pub fn page_images(&self, page: usize) -> Vec<pdfcraft_edit::PageImage> {
-        self.editor.as_ref().and_then(|e| pdfcraft_edit::page_images(&e.cos, page).ok()).unwrap_or_default()
-    }
-
-    /// Mixed editable objects on one page. Source inventories are zero-based and added items
-    /// appear once. Rectangles are user-space points, independent of the viewer's zoom.
-    pub fn editable_objects(&self, page: usize) -> Result<Vec<EditableObject>, String> {
-        let editor = self.editor.as_ref().ok_or("the document can't be read")?;
-        pdfcraft_edit::editable_objects(&editor.cos, page).map_err(|e| e.to_string())
-    }
-
-    /// Displayed top-left-origin motion to a user-space vector. Use the linear map only,
-    /// so even a large crop-box origin cannot erase a small drag by cancellation.
-    pub fn object_move_offset(&self, page: usize, delta: [f64; 2]) -> Result<[f64; 2], String> {
-        let p = self.info.pages.get(page).ok_or("the page no longer exists")?;
-        let [x0, y0, x1, y1] = p.crop.map(f64::from);
-        let (a, b) = (delta[0] / f64::from(p.width.max(1e-3)), delta[1] / f64::from(p.height.max(1e-3)));
-        let (u, v) = match p.rotation {
-            90 => (b, -a),
-            180 => (-a, -b),
-            270 => (-b, a),
-            _ => (a, b),
-        };
-        let offset = [u * (x1 - x0), -v * (y1 - y0)];
-        if !offset.iter().all(|v| v.is_finite()) {
-            return Err("the move must be finite and non-zero".into());
-        }
-        Ok(offset)
-    }
-
-    /// Save image as: image `index` on `page` as a file (extension, bytes).
-    pub fn page_image_file(&self, page: usize, index: usize) -> Result<(&'static str, Vec<u8>), String> {
-        self.check_copying().map_err(|e| e.to_string())?;
-        let editor = self.editor.as_ref().ok_or("the document can't be read")?;
-        let img = self.page_images(page).into_iter().nth(index).ok_or_else(|| format!("page {} has no image {}", page + 1, index + 1))?;
-        if img.is_form {
-            return Err("grouped Form artwork is not a bitmap; Save Image As is only available for raster images".into());
-        }
-        pdfcraft_create::image_file(&editor.cos, img.object.ok_or("the image has no object")?)
-    }
-
-    /// Edit a PDF ▸ Edit text: the paragraphs on `page` (0-based).
-    pub fn text_blocks(&self, page: usize) -> Vec<pdfcraft_edit::TextBlock> {
-        self.editor.as_ref().and_then(|e| e.text_blocks(page).ok()).map(|b| b.as_ref().clone()).unwrap_or_default()
-    }
-
-    /// Saved measurement annotations, calculated from their geometry and PDF scales, plus
-    /// the ones that couldn't be read (unsupported formats are skipped, not fatal).
-    pub fn measurements(&self) -> Result<measure::Listing, String> {
-        let e = self.editor.as_ref().ok_or("the document can't be read")?;
-        Ok(measure::list(&e.cos))
-    }
-    pub fn measurement_scale(&self, page: usize, at: measure::Point) -> Result<measure::Scale, String> {
-        let e = self.editor.as_ref().ok_or("the document can't be read")?;
-        measure::scale_at(&e.cos, page, at).map_err(|e| e.to_string())
-    }
-    /// [`Self::measurement_scale`], measuring true size in `unit` (`per_point` of them in a
-    /// point) where the page sets no scale.
-    pub fn measurement_scale_or(&self, page: usize, at: measure::Point, per_point: f64, unit: &str) -> Result<measure::Scale, String> {
-        let e = self.editor.as_ref().ok_or("the document can't be read")?;
-        measure::scale_at_or(&e.cos, page, at, per_point, unit).map_err(|e| e.to_string())
-    }
-    pub fn measurement_to_user(&self, page: usize, point: measure::Point) -> Result<measure::Point, String> {
-        let e = self.editor.as_ref().ok_or("the document can't be read")?;
-        measure::view_to_user(&e.cos, page, point).map_err(|e| e.to_string())
-    }
-    pub fn measurement_to_view(&self, page: usize, point: measure::Point) -> Result<measure::Point, String> {
-        let e = self.editor.as_ref().ok_or("the document can't be read")?;
-        measure::user_to_view(&e.cos, page, point).map_err(|e| e.to_string())
-    }
-    pub fn measurement_paths(&self, page: usize) -> Result<measure::snap::Geometry, String> {
-        let e = self.editor.as_ref().ok_or("the document can't be read")?;
-        measure::snap::geometry(&e.cos, page).map_err(|e| e.to_string())
-    }
-
-    /// A counter that changes with every edit (for caches of derived data).
-    pub fn edit_generation(&self) -> u64 {
-        self.generation
-    }
-
-    /// Edit a PDF ▸ Edit text: the lines of existing text on `page` (0-based).
-    pub fn text_lines(&self, page: usize) -> Vec<pdfcraft_edit::TextLine> {
-        self.editor.as_ref().and_then(|e| pdfcraft_edit::text_lines(&e.cos, page).ok()).unwrap_or_default()
-    }
-
-    /// The form's calculation order: its calculated fields in the order they calculate, what each
-    /// formula reads, what is wrong with the order, and the order Fix order writes.
-    pub fn calculation_order(&self) -> CalculationOrder {
-        self.editor.as_ref().map(|e| pdfcraft_forms::calculation_order(&e.cos, &self.form)).unwrap_or_default()
-    }
-
-    /// Add alternate text: the figures, in document order.
-    pub fn figures(&self) -> Vec<a11y::Figure> {
-        self.editor.as_ref().map(|e| a11y::figures(&e.cos)).unwrap_or_default()
-    }
-
-    /// Reachable indirect structure tags, in document order.
-    pub fn tags(&self) -> Vec<a11y::TagInfo> {
-        self.editor.as_ref().map(|e| a11y::tags(&e.cos)).unwrap_or_default()
-    }
-
-    /// Marked-content items directly owned by one reachable indirect structure tag.
-    pub fn tag_content(&self, object: pdfcraft_cos::ObjRef) -> Result<Vec<a11y::TagContentItem>, a11y::TagError> {
-        self.editor.as_ref().map(|e| a11y::tag_content(&e.cos, object)).unwrap_or_else(|| Ok(Vec::new()))
-    }
-
-    /// The edit that fixes `rule`, for the rules with an automatic fix: the document language
-    /// (`value` is the language), the title (`value` replaces it; else the current title or the
-    /// file name) and the tab order.
-    pub fn accessibility_fix(&self, rule: a11y::Rule, value: Option<&str>) -> Result<Edit, String> {
-        let value = value.map(str::trim).filter(|v| !v.is_empty());
-        match rule {
-            a11y::Rule::PrimaryLanguage => {
-                let mut v = self.initial_view();
-                v.language = Some(value.ok_or("give the document language (for example en-US)")?.to_owned());
-                Ok(Edit::SetInitialView(Box::new(v)))
-            }
-            a11y::Rule::Title => {
-                let title = value
-                    .map(str::to_owned)
-                    .or_else(|| self.info_value("Title").filter(|t| !t.trim().is_empty()))
-                    .unwrap_or_else(|| self.name.trim_end_matches(".pdf").trim_end_matches(".PDF").to_owned());
-                let mut v = self.initial_view();
-                v.display_title = true;
-                Ok(Edit::Batch {
-                    label: "Set document title".into(),
-                    edits: vec![Edit::SetInfo { key: "Title".into(), value: title }, Edit::SetInitialView(Box::new(v))],
-                })
-            }
-            a11y::Rule::TabOrder => Ok(Edit::SetTabOrder { pages: (0..self.info.pages.len()).collect(), order: TabOrder::Structure }),
-            other => Err(format!("\"{}\" has no automatic fix", other.name())),
-        }
-    }
-
-    pub fn initial_view(&self) -> InitialView {
-        self.editor.as_ref().map(|e| pdfcraft_organize::initial_view(&e.cos)).unwrap_or_default()
-    }
-
-    /// Signed: at least one signature field holds a signature.
-    pub fn is_signed(&self) -> bool {
-        self.signatures.iter().any(|s| s.signed)
-    }
-
-    /// Whether comments are hidden (Comments ▸ Hide all comments).
-    pub fn comments_hidden(&self) -> bool {
-        self.config.hide_comments
-    }
-
-    pub fn can_undo(&self) -> Option<&str> {
-        self.undo_label().map(Label::as_str)
-    }
-
-    pub fn can_redo(&self) -> Option<&str> {
-        self.redo_label().map(Label::as_str)
-    }
-
-    /// What Undo would undo, in parts, for an interface that says it in another language.
-    pub fn undo_label(&self) -> Option<&Label> {
-        self.editor.as_ref().and_then(|e| e.undo.last()).map(|(l, ..)| l)
-    }
-
-    /// What Redo would redo, in parts.
-    pub fn redo_label(&self) -> Option<&Label> {
-        self.editor.as_ref().and_then(|e| e.redo.last()).map(|(l, ..)| l)
-    }
-
-    pub fn editable(&self) -> bool {
-        self.editor.is_some()
-    }
-
-    /// What the opening password allows; `None` when the document is not encrypted.
-    pub fn permissions(&self) -> Option<pdfcraft_cos::Permissions> {
-        self.editor.as_ref().and_then(|e| e.cos.permissions())
-    }
-
-    /// Printing is allowed (Table 22, bit 3).
-    pub fn allows_printing(&self) -> bool {
-        self.permissions().is_none_or(|p| p.print())
-    }
-
-    /// Copying or otherwise extracting text and images is allowed (Table 22, bit 5): copying
-    /// selected text, snapshots, Save Image As, exporting. Assistive technology may read the
-    /// content regardless (§7.6.4.2), so reading aloud and accessibility tools don't ask.
-    pub fn allows_copying(&self) -> bool {
-        self.permissions().is_none_or(|p| p.copy())
-    }
-
-    /// [`Self::allows_copying`], as the error to report when it isn't.
-    pub fn check_copying(&self) -> Result<(), EditError> {
-        if self.allows_copying() { Ok(()) } else { Err(EditError::NotPermitted("copying text and images")) }
-    }
-
-    /// Page changes (insert, delete, rotate, move, extract) are allowed.
-    pub fn allows_assembly(&self) -> bool {
-        self.editable() && self.permissions().is_none_or(|p| p.assemble())
-    }
-
-    /// Redaction marks waiting to be applied.
-    pub fn redaction_marks(&self) -> usize {
-        self.info.annotations.iter().filter(|a| a.subtype == "Redact").count()
-    }
-
-    /// Page marks present (headers and footers, watermarks, backgrounds), for Update/Remove.
-    pub fn marks(&self) -> &[MarkKind] {
-        &self
-            .marker_scan
-            .get_or_init(|| {
-                self.editor
-                    .as_ref()
-                    .map(|e| {
-                        #[cfg(test)]
-                        record_marker_scan();
-                        pdfcraft_edit::scan_markers(&e.cos)
-                    })
-                    .unwrap_or_default()
-            })
-            .marks
-    }
-
-    /// Text and images added with Edit a PDF ▸ Add content (still editable).
-    pub fn added(&self) -> &[pdfcraft_edit::Added] {
-        &self
-            .marker_scan
-            .get_or_init(|| {
-                self.editor
-                    .as_ref()
-                    .map(|e| {
-                        #[cfg(test)]
-                        record_marker_scan();
-                        pdfcraft_edit::scan_markers(&e.cos)
-                    })
-                    .unwrap_or_default()
-            })
-            .added
-    }
-
-    /// Link annotations, for Edit a PDF ▸ Link.
-    pub fn links(&self) -> &[pdfcraft_annot::links::LinkItem] {
-        self.links.get_or_init(|| {
-            self.editor
-                .as_ref()
-                .map(|e| {
-                    #[cfg(test)]
-                    record_link_scan();
-                    pdfcraft_annot::links::list(&e.cos)
-                })
-                .unwrap_or_default()
-        })
-    }
-
-    /// Changes to content and document information are allowed.
-    pub fn allows_modification(&self) -> bool {
-        self.editable() && self.permissions().is_none_or(|p| p.modify())
-    }
-
-    /// How widget `widget` of text field `name` lays its value out, for asking whether a typed
-    /// value fits it ([`form_appearance::TextBox::fits`]): a field that doesn't scroll takes no
-    /// more than fits. `None` without such a field or widget, or when the document can't be
-    /// edited.
-    pub fn field_text_box(&self, name: &str, widget: usize) -> Option<form_appearance::TextBox> {
-        let cos = &self.editor.as_ref()?.cos;
-        let f = self.form.iter().find(|f| f.name == name)?;
-        let w = f.widgets.get(widget)?;
-        Some(form_appearance::text_box(cos, f, w))
-    }
-
-    /// Filling in form fields is allowed (Table 22, bits 6 and 9).
-    pub fn allows_form_filling(&self) -> bool {
-        self.editable() && self.permissions().is_none_or(|p| p.fill_forms())
-    }
-
-    /// Adding and changing comments is allowed (Table 22, bit 6).
-    pub fn allows_annotation(&self) -> bool {
-        self.editable() && self.permissions().is_none_or(|p| p.annotate())
-    }
-
-    /// The document's security may be changed (Protect, Remove security): it is editable and,
-    /// if encrypted, was opened with the owner password.
-    pub fn allows_security_change(&self) -> bool {
-        self.editable() && self.permissions().is_none_or(|p| unrestricted(&p))
-    }
-
-    /// A password restricts the document and it wasn't opened with the owner password: entering
-    /// that password ([`Session::unlock`]) lifts the restrictions.
-    pub fn can_unlock(&self) -> bool {
-        self.editable() && self.permissions().is_some_and(|p| !unrestricted(&p))
-    }
-
-    /// A summary of the document's security for Document Properties ▸ Security, including
-    /// protection applied in this session (written by the next save).
-    pub fn security_summary(&self) -> Option<SecuritySummary> {
-        let editor = self.editor.as_ref()?;
-        let h = editor.cos.output_handler()?;
-        let d = h.dict();
-        let stream = d.crypt_filters.iter().find(|(name, _)| *name == d.stm_f).map(|(_, m)| *m);
-        let method = match (d.v, stream) {
-            (1..=3, _) if d.length_bits <= 40 => "RC4, 40-bit",
-            (1..=3, _) | (_, Some(pdfcraft_cos::CryptMethod::Rc4)) => "RC4, 128-bit",
-            (_, Some(pdfcraft_cos::CryptMethod::Aes128)) => "AES, 128-bit",
-            (_, Some(pdfcraft_cos::CryptMethod::Aes256)) => "AES, 256-bit",
-            _ => "Attachments only",
-        };
-        let pending = editor.cos.encryption_changed();
-        let permissions = if pending { pdfcraft_cos::Permissions { bits: h.permissions().bits, owner: false } } else { h.permissions() };
-        Some(SecuritySummary { method: method.into(), owner: h.auth() == pdfcraft_cos::Auth::Owner && !pending, permissions, pending })
-    }
-
-    /// Comment properties of the comment at `(page, index)` (Comment Properties dialog).
-    pub fn comment_props(&self, page: usize, index: usize) -> Option<pdfcraft_annot::Props> {
-        self.editor.as_ref().and_then(|e| pdfcraft_annot::props(&e.cos, page, index))
-    }
-
-    /// A form field's Appearance-tab look (borders, colours, font).
-    pub fn field_look(&self, name: &str) -> Option<pdfcraft_forms::Look> {
-        let e = self.editor.as_ref()?;
-        let f = self.form.iter().find(|f| f.name == name)?;
-        Some(pdfcraft_forms::look(&e.cos, f))
-    }
-
-    /// A check box's or radio button's mark (Field Properties ▸ Options), `None` for other fields.
-    pub fn field_check_style(&self, name: &str) -> Option<CheckStyle> {
-        let e = self.editor.as_ref()?;
-        let f = self.form.iter().find(|f| f.name == name)?;
-        matches!(f.kind, FormFieldKind::CheckBox | FormFieldKind::Radio).then(|| pdfcraft_forms::check_style(&e.cos, f))
-    }
-
-    /// Whether text field `name`'s value is cut off by its box at the field's font size (#4018):
-    /// the page (0-based) of the first widget that cuts it, and how.
-    pub fn field_overflow(&self, name: &str) -> Option<(Option<usize>, pdfcraft_forms::appearance::Overflow)> {
-        let e = self.editor.as_ref()?;
-        let f = self.form.iter().find(|f| f.name == name)?;
-        f.widgets.iter().find_map(|w| pdfcraft_forms::appearance::value_overflow(&e.cos, f, w).map(|o| (w.page, o)))
-    }
-
-    /// Remove Hidden Information: what each category would remove.
-    pub fn hidden_info(&self) -> Vec<(Hidden, usize)> {
-        self.editor.as_ref().map(|e| pdfcraft_redact::sanitize::scan(&e.cos)).unwrap_or_default()
-    }
-
-    /// Verification: faux redactions (opaque covers over extractable text) and redaction
-    /// marks that were never applied. Fails closed: any read error is returned, never an
-    /// empty list.
-    pub fn audit_redactions(&self) -> Result<Vec<pdfcraft_audit::AuditFinding>, String> {
-        let editor = self.editor.as_ref().ok_or("the document can't be read")?;
-        pdfcraft_audit::audit_redactions(&editor.cos).map_err(|e| e.to_string())
-    }
-
-    /// Every page's media, crop, bleed, trim and art boxes (user space), for Set Page Boxes.
-    pub fn page_boxes(&self) -> Vec<[[f64; 4]; 5]> {
-        self.editor.as_ref().and_then(|e| pdfcraft_organize::page_boxes(&e.cos).ok()).unwrap_or_default()
-    }
-
-    /// Current value of a document-information entry (Title, Author, …).
-    pub fn info_value(&self, key: &str) -> Option<String> {
-        self.editor.as_ref().and_then(|e| pdfcraft_organize::info(&e.cos, key))
-    }
-
-    /// The custom document properties as they are now (name, text), Document Properties ▸ Custom.
-    pub fn custom_info(&self) -> Vec<(String, String)> {
-        self.editor.as_ref().map(|e| pdfcraft_organize::custom_info(&e.cos)).unwrap_or_default()
-    }
-
-    /// The name shown on the tab and window: the document title when the document asks for it
-    /// (Initial View ▸ Show: Document Title) and has a real one, else the file name.
-    pub fn display_name(&self) -> String {
-        self.editor
-            .as_ref()
-            .filter(|e| pdfcraft_organize::displays_doc_title(&e.cos))
-            .and_then(|e| pdfcraft_organize::info(&e.cos, "Title"))
-            .map(|t| t.trim().to_owned())
-            .filter(|t| !t.is_empty() && !is_placeholder_title(t))
-            .unwrap_or_else(|| self.name.clone())
-    }
-
-    /// Where each saved revision of the file ends (oldest first; `bytes[..end]` is that
-    /// revision). Unsaved edits aren't a revision yet.
-    pub fn revision_ends(&self) -> Vec<usize> {
-        self.editor.as_ref().map(|e| e.cos.revision_ends()).unwrap_or_default()
-    }
-
-    /// The file as last opened or saved, without unsaved edits: what an incremental save appends
-    /// to. This stays that file when undo has restored an older snapshot.
-    pub fn saved_bytes(&self) -> Arc<Vec<u8>> {
-        self.editor.as_ref().map_or_else(|| self.bytes.clone(), |e| e.saved.clone())
-    }
-
-    /// Notes about damage repaired while opening (Document Properties ▸ Advanced, notices).
-    pub fn repair_log(&self) -> Vec<String> {
-        self.editor.as_ref().map(|e| e.cos.repair_log().to_vec()).unwrap_or_default()
-    }
-}
-
-/// A title that names no document: what a web browser writes when it saves a blank page or a
-/// pop-up as PDF (`about:blank`), another browser-internal address, or a bare "Untitled". Such a
-/// title says less than the file name, so the file name is shown instead. An address is one
-/// word: "About: our company" is a real title.
-fn is_placeholder_title(title: &str) -> bool {
-    let t = title.trim().to_lowercase();
-    let address = !t.contains(char::is_whitespace) && ["about:", "blob:", "data:"].iter().any(|p| t.starts_with(p));
-    address || t == "untitled"
-}
-
-/// The working file plus appearances for comments that have none, and for form fields the file
-/// leaves to the viewer (#3470). Signature artwork is preserved; validation badges belong to the
-/// viewer and never enter these bytes, which image/text exports and Print as Image also consume.
-fn display_bytes(editor: Option<&mut Editor>, bytes: &Arc<Vec<u8>>) -> Arc<Vec<u8>> {
-    let Some(e) = editor else { return bytes.clone() };
-    let comments = pdfcraft_annot::with_missing_appearances_cached(&e.cos, &mut e.appearances);
-    let fields = pdfcraft_forms::with_field_appearances_cached(comments.as_ref().unwrap_or(&e.cos), &mut e.field_appearances);
-    let Some(display) = fields.or(comments) else {
-        return bytes.clone();
-    };
-    match write_incremental(&display, &SaveOptions::default()) {
-        Ok(written) => Arc::new(written),
-        Err(err) => {
-            e.cos.note_repair(format!("missing comment or field appearances could not be drawn ({err})"));
-            bytes.clone()
-        }
-    }
-}
-
-/// `comments` (the display copy with comment appearances, if it needed any; else the document
-/// itself) with its form fields drawn from their values where the file leaves that to the viewer.
-fn with_field_appearances(comments: Option<pdfcraft_cos::Document>, doc: &pdfcraft_cos::Document) -> Option<pdfcraft_cos::Document> {
-    pdfcraft_forms::with_field_appearances(comments.as_ref().unwrap_or(doc)).or(comments)
-}
-
-/// The reader shows the same pages in `a` and `b`: count, displayed size and rotation.
-fn same_pages(a: &[pdfcraft_render::PageInfo], b: &[pdfcraft_render::PageInfo]) -> bool {
-    a.len() == b.len()
-        && a.iter().zip(b).all(|(x, y)| (x.width - y.width).abs() < 0.01 && (x.height - y.height).abs() < 0.01 && x.rotation == y.rotation)
-}
-
-/// Each document-information field of `info` with its value in `cos` (`/Info`, else XMP), read
-/// the way the full inspection reads them: NULs and spaces trimmed, empty is none.
-fn info_fields<'a>(info: &'a mut DocInfo, cos: &pdfcraft_cos::Document) -> [(&'a mut Option<String>, Option<String>); 6] {
-    let read = |key| pdfcraft_organize::info(cos, key).map(|v| v.trim_matches('\0').trim().to_string()).filter(|v| !v.is_empty());
-    [
-        (&mut info.title, read("Title")),
-        (&mut info.author, read("Author")),
-        (&mut info.subject, read("Subject")),
-        (&mut info.keywords, read("Keywords")),
-        (&mut info.creator, read("Creator")),
-        (&mut info.producer, read("Producer")),
-    ]
-}
-
-/// The copy PDFCraft displays when opening `bytes`: with appearances drawn, in memory only, for
-/// comments that have none and form fields the file leaves to the viewer. Render paths outside the app, such as the CLI, use this so their page
-/// images agree with the app and independent viewers. It never changes the source document, and an
-/// unparseable file, a write failure or a parser panic falls back to the original bytes.
-pub fn display_bytes_for(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Arc<Vec<u8>> {
-    guard(|| {
-        pdfcraft_cos::Document::open_with_password(bytes.clone(), password)
-            .ok()
-            .and_then(|cos| with_field_appearances(pdfcraft_annot::with_missing_appearances(&cos), &cos))
-            .and_then(|display| write_incremental(&display, &SaveOptions::default()).ok())
-            .map(Arc::new)
-    })
-    .ok()
-    .flatten()
-    .unwrap_or(bytes)
-}
-
-/// The password to give the renderer (`inspect`, `PageRenderer`) for `bytes` opened with
-/// `password`. The renderer authenticates only the user password of R2–R4 files, so for their
-/// owner password this is the user password that owner authentication recovers; otherwise it is
-/// `password` itself. Render paths outside a [`Session`], such as the CLI, use this so the owner
-/// password works there as it does in `doc_open`. A file that doesn't open with `password` keeps
-/// it, so the renderer reports the same error it always did.
-pub fn render_password_for(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Option<String> {
-    let password = password?;
-    let recovered =
-        guard(|| pdfcraft_cos::Document::open_with_password(bytes, Some(password)).ok().and_then(|d| recovered_render_password(&d))).ok().flatten();
-    Some(recovered.unwrap_or_else(|| password.to_owned()))
-}
-
-/// The user password owner authentication recovered from an R2–R4 `cos`, as the renderer takes it.
-fn recovered_render_password(cos: &pdfcraft_cos::Document) -> Option<String> {
-    cos.security().and_then(|s| s.recovered_user_password()).map(|user| renderer_password(&user))
-}
-
-/// Fails when the renderer still draws text under an applied redaction mark.
-///
-/// Redaction decides what lies under a mark from the positions its own interpreter computes, and
-/// its verify pass reuses them. Where they differ from the renderer's (a standard font without
-/// /Widths, whose advances the interpreter approximates; a CMap
-/// that it reads differently), a mark drawn over the text as displayed lies over glyphs the
-/// interpreter believes are elsewhere: they stay in the file and nothing notices. The renderer is
-/// what the user saw when placing the marks, so it is asked. `after` is written as a save would
-/// write it, without the marks' own `overlays` (the box and its label are drawn on purpose), its
-/// text is extracted, and a glyph still mostly inside a mark fails the edit: the caller keeps
-/// the document as it was.
-fn shown_under_redactions(
-    after: &pdfcraft_cos::Document,
-    marks: &[pdfcraft_redact::Mark],
-    overlays: &[pdfcraft_cos::ObjRef],
-    pages: &[pdfcraft_render::PageInfo],
-    password: Option<&str>,
-) -> Result<(), EditError> {
-    use pdfcraft_cos::Object;
-    use pdfcraft_redact::RedactError;
-    let mut marked: Vec<usize> = marks.iter().map(|m| m.page).collect();
-    marked.sort_unstable();
-    marked.dedup();
-    if marked.is_empty() {
-        return Ok(());
-    }
-    let mut shown = after.clone();
-    let model = pdfcraft_model::pages(&shown);
-    for &pi in &marked {
-        let Some(page) = model.get(pi) else { continue };
-        let Some(Object::Array(list)) = page.dict.get(b"Contents").map(|c| (*shown.resolve(c)).clone()) else { continue };
-        let kept: Vec<Object> = list.into_iter().filter(|o| !o.as_ref().is_some_and(|r| overlays.contains(&r))).collect();
-        shown.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(kept))).map_err(|e| EditError::Write(e.to_string()))?;
-    }
-    let bytes = write_incremental(&shown, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?;
-    let config = RenderConfig { password: password.map(Arc::from), ..Default::default() };
-    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(bytes), config);
-    let mut residue = 0;
-    for &pi in &marked {
-        let request = pdfcraft_render::RenderRequest { page: pi, kind: pdfcraft_render::RequestKind::Text, scale: 1.0, ..Default::default() };
-        // A page that cannot be read back cannot be confirmed clean.
-        let (Some(info), Some(text)) = (pages.get(pi), renderer.render(request).text) else { return Err(RedactError::Unreadable(pi + 1).into()) };
-        let rects: Vec<[f64; 4]> = marks
-            .iter()
-            .filter(|m| m.page == pi)
-            .flat_map(|m| m.rects.iter())
-            .map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])])
-            .collect();
-        for glyph in text.glyphs.iter().filter(|g| !g.text.trim().is_empty()) {
-            let [x0, y0, x1, y1] = info.view_rect_to_user(glyph.rect).map(f64::from);
-            let area = (x1 - x0) * (y1 - y0);
-            if area.is_nan() || area <= 0.0 {
-                continue;
-            }
-            // Redaction itself takes any glyph a fifth under a mark; one that is half under it
-            // and still drawn was not where redaction thought it was.
-            let under = |r: &[f64; 4]| (x1.min(r[2]) - x0.max(r[0])).max(0.0) * (y1.min(r[3]) - y0.max(r[1])).max(0.0) >= 0.5 * area;
-            if rects.iter().any(under) {
-                residue += 1;
-            }
-        }
-    }
-    if residue > 0 {
-        return Err(RedactError::Residue(residue).into());
-    }
-    Ok(())
-}
-
-fn render_threads() -> usize {
-    std::thread::available_parallelism().map(std::num::NonZeroUsize::get).unwrap_or(4).clamp(2, 8) - 1
-}
-
-/// Write `layers`' visibility into the default optional-content configuration of `cos` (a copy
-/// made for printing): `/BaseState /ON`, `/ON` the visible layers, `/OFF` the hidden ones. Its
-/// other entries (`/Order`, `/RBGroups`, `/AS`…) are kept. A document without `/OCProperties`
-/// is left alone.
-fn set_default_layer_state(cos: &mut pdfcraft_cos::Document, layers: &[Layer]) {
-    use pdfcraft_cos::{Dict, ObjRef, Object};
-    let Some(root_ref) = cos.trailer().get(b"Root").and_then(Object::as_ref) else { return };
-    let Some(mut root) = cos.get(root_ref).as_dict().cloned() else { return };
-    let Some(properties) = root.get(b"OCProperties").cloned() else { return };
-    let Some(mut properties) = cos.resolve(&properties).as_dict().cloned() else { return };
-    let mut config = properties.get(b"D").and_then(|d| cos.resolve(d).as_dict().cloned()).unwrap_or_else(Dict::new);
-    let refs =
-        |visible: bool| Object::Array(layers.iter().filter(|l| l.visible == visible).map(|l| Object::Ref(ObjRef::new(l.id.0, l.id.1))).collect());
-    config.set(b"BaseState".to_vec(), Object::name("ON"));
-    config.set(b"ON".to_vec(), refs(true));
-    config.set(b"OFF".to_vec(), refs(false));
-    properties.set(b"D".to_vec(), Object::Dict(config));
-    root.set(b"OCProperties".to_vec(), Object::Dict(properties));
-    cos.set(root_ref, Object::Dict(root));
-}
-
-/// Render `doc` with the layer visibility in its `info.layers`.
-fn use_layer_choices(doc: &mut Document) {
-    let overrides: Vec<(i32, i32, bool)> = doc.info.layers.iter().map(|l| (l.id.0 as i32, l.id.1 as i32, l.visible)).collect();
-    doc.config.layers = Arc::new(overrides);
-    doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-}
-
-/// Apply a set-layer-visibility action to `layers`, one change at a time, so a toggle flips the
-/// state the changes before it left. Returns whether any layer ended up changed.
-fn apply_layer_state(layers: &mut [Layer], groups: &[Vec<(u32, u16)>], changes: &[(LayerOp, (u32, u16))], preserve_rb: bool) -> bool {
-    let before: Vec<bool> = layers.iter().map(|l| l.visible).collect();
-    let index: std::collections::HashMap<(u32, u16), usize> = layers.iter().enumerate().map(|(i, l)| (l.id, i)).collect();
-    for &(op, ocg) in changes {
-        let Some(layer) = index.get(&ocg).and_then(|&i| layers.get_mut(i)) else { continue };
-        let on = match op {
-            LayerOp::On => true,
-            LayerOp::Off => false,
-            LayerOp::Toggle => !layer.visible,
-        };
-        layer.visible = on;
-        // Turning a layer off leaves the rest of its groups alone.
-        if on && preserve_rb {
-            for other in groups.iter().filter(|g| g.contains(&ocg)).flatten().filter(|&&o| o != ocg) {
-                if let Some(l) = index.get(other).and_then(|&i| layers.get_mut(i)) {
-                    l.visible = false;
-                }
-            }
-        }
-    }
-    layers.iter().zip(before).any(|(l, was)| l.visible != was)
-}
-
-/// A file to combine: its name (the bookmark title), bytes, and page range (`None`: all).
-pub type CombineSource = (String, Arc<Vec<u8>>, Option<String>);
-
-/// What a combine produced: the new PDF bytes, and the fields renamed to keep colliding names
-/// separate (old fully-qualified name → new one), in order across the sources.
-#[derive(Debug)]
-pub struct Combined {
-    pub bytes: Arc<Vec<u8>>,
-    pub renamed_fields: Vec<(String, String)>,
-}
-
-/// A bookmark as the bookmark list shows it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct BookmarkRow {
-    /// Child indices from the top level, 0-based, as the edit functions take them.
-    pub path: Vec<usize>,
-    pub title: String,
-    /// Shown expanded (a positive `/Count`).
-    pub open: bool,
-    /// The 0-based page it goes to.
-    pub page: Option<usize>,
-    /// Where on that page it goes ([`pdfcraft_render::DestView::Top`] when it doesn't say).
-    pub view: pdfcraft_render::DestView,
-    /// The title's colour (`/C`), `None` for the default black, and its style (`/F`).
-    pub color: Option<[f32; 3]>,
-    pub italic: bool,
-    pub bold: bool,
-}
-
-/// One page of the bookmark list, in outline order.
-#[derive(Clone, Debug, PartialEq)]
-pub struct BookmarkPage {
-    pub rows: Vec<BookmarkRow>,
-    /// Where the next page starts, or `None` at the end.
-    pub next: Option<usize>,
-    /// Set only when the document's structure could not be read for editing: its listing then
-    /// comes from the viewer's copy of the outline, which is shorter than the file's.
-    pub truncated: bool,
-}
-
-/// The rows of a viewer outline, in outline order, with their paths.
-fn outline_rows(items: &[pdfcraft_render::OutlineItem]) -> Vec<BookmarkRow> {
-    let mut rows = Vec::new();
-    // One entry per open level: its items, and how many of them have been listed.
-    let mut levels: Vec<(&[pdfcraft_render::OutlineItem], usize)> = vec![(items, 0)];
-    while let Some(&(list, next)) = levels.last() {
-        let Some(item) = list.get(next) else {
-            levels.pop();
-            continue;
-        };
-        if let Some(top) = levels.last_mut() {
-            top.1 += 1;
-        }
-        let path: Vec<usize> = levels.iter().map(|(_, listed)| listed.saturating_sub(1)).collect();
-        rows.push(BookmarkRow {
-            path,
-            title: item.title.clone(),
-            open: item.open,
-            page: item.page,
-            view: item.view,
-            color: item.color,
-            italic: item.italic,
-            bold: item.bold,
-        });
-        if !item.children.is_empty() {
-            levels.push((&item.children, 0));
-        }
-    }
-    rows
-}
-
-/// A document's working file captured for crash recovery.
-#[derive(Clone, Debug)]
-pub struct RecoverySnapshot {
-    pub doc: DocId,
-    pub name: String,
-    pub path: Option<String>,
-    pub bytes: Arc<Vec<u8>>,
-    /// The snapshot is encrypted (recovering it asks for the password again).
-    pub encrypted: bool,
-}
-
-/// Document Properties ▸ Security.
-#[derive(Clone, Debug, PartialEq)]
-pub struct SecuritySummary {
-    /// "AES, 256-bit" etc.
-    pub method: String,
-    /// Opened with the owner password (no restrictions apply).
-    pub owner: bool,
-    /// For pending protection: the restrictions as they will apply to others.
-    pub permissions: pdfcraft_cos::Permissions,
-    /// Set in this session; written by the next save.
-    pub pending: bool,
-}
-
-/// What printing a protected document allows (Acrobat: Printing allowed).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Printing {
-    None,
-    /// "Low Resolution (150 dpi)".
-    Low,
-    High,
-}
-
-/// What changes a protected document allows (Acrobat: Changes allowed).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Changes {
-    None,
-    /// "Inserting, deleting, and rotating pages".
-    Pages,
-    /// "Filling in form fields and signing existing signature fields".
-    FillSign,
-    /// "Commenting, filling in form fields, and signing existing signature fields".
-    CommentFillSign,
-    /// "Any except extracting pages".
-    AnyExceptExtract,
-}
-
-/// Password protection to apply (Protect Using Password and its Advanced options).
-#[derive(Clone, PartialEq)]
-pub struct Protection {
-    /// Required to open the document (the user password).
-    pub open_password: Option<String>,
-    /// Required to change security and lift the restrictions below (the owner password).
-    pub permissions_password: Option<String>,
-    pub printing: Printing,
-    pub changes: Changes,
-    /// "Enable copying of text, images, and other content".
-    pub copy: bool,
-    /// "Enable text access for screen reader devices".
-    pub accessibility: bool,
-    /// Compatibility level; AES-256 (Acrobat X and later) by default.
-    pub algorithm: pdfcraft_cos::Algorithm,
-    /// `false`: "Encrypt all document contents except metadata".
-    pub encrypt_metadata: bool,
-}
-
-impl std::fmt::Debug for Protection {
-    // Never print passwords (edits end up in logs and error messages).
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("Protection")
-            .field("open_password", &self.open_password.as_ref().map(|_| "…"))
-            .field("permissions_password", &self.permissions_password.as_ref().map(|_| "…"))
-            .field("printing", &self.printing)
-            .field("changes", &self.changes)
-            .field("copy", &self.copy)
-            .field("accessibility", &self.accessibility)
-            .field("algorithm", &self.algorithm)
-            .field("encrypt_metadata", &self.encrypt_metadata)
-            .finish()
-    }
-}
-
-impl Default for Protection {
-    /// Acrobat's defaults: AES-256, printing and accessibility allowed, no changes, no copying.
-    fn default() -> Self {
-        Self {
-            open_password: None,
-            permissions_password: None,
-            printing: Printing::High,
-            changes: Changes::None,
-            copy: false,
-            accessibility: true,
-            algorithm: pdfcraft_cos::Algorithm::Aes256,
-            encrypt_metadata: true,
-        }
-    }
-}
-
-impl Protection {
-    /// The `/P` permission bits (ISO 32000-2 Table 22), as Acrobat maps its choices.
-    pub fn permission_bits(&self) -> i32 {
-        let bit = |n: u32| 1i32 << (n - 1);
-        if self.permissions_password.is_none() {
-            return -1; // nothing restricted without a permissions password
-        }
-        let mut p = 0;
-        match self.printing {
-            Printing::None => {}
-            Printing::Low => p |= bit(3),
-            Printing::High => p |= bit(3) | bit(12),
-        }
-        p |= match self.changes {
-            Changes::None => 0,
-            Changes::Pages => bit(11),
-            Changes::FillSign => bit(9),
-            Changes::CommentFillSign => bit(6) | bit(9),
-            Changes::AnyExceptExtract => bit(4) | bit(6) | bit(9),
-        };
-        if self.copy {
-            p |= bit(5) | bit(10);
-        }
-        if self.accessibility {
-            p |= bit(10);
-        }
-        p
-    }
-
-    fn validate(&self) -> Result<(), EditError> {
-        let bad = |m: &str| Err(EditError::Protection(m.to_string()));
-        match (&self.open_password, &self.permissions_password) {
-            (None, None) => return bad("enter a password to open the document, a permissions password, or both"),
-            (Some(a), Some(b)) if a == b => return bad("the open password and the permissions password must be different"),
-            _ => {}
-        }
-        if [&self.open_password, &self.permissions_password].into_iter().flatten().any(String::is_empty) {
-            return bad("passwords can't be empty");
-        }
-        if self.algorithm != pdfcraft_cos::Algorithm::Aes256
-            && [&self.open_password, &self.permissions_password].into_iter().flatten().any(|p| p.chars().any(|c| !(' '..='~').contains(&c)))
-        {
-            return bad("this compatibility level supports only plain ASCII passwords; use AES-256 (Acrobat X and later)");
-        }
-        // Encryption keys on a password as `effective_password` gives it (AES-256: SASLprep,
-        // which drops soft hyphens and folds compatibility forms; older levels: the first 32
-        // bytes, padded). One that comes out as the empty password opens the file without asking,
-        // and an open password that comes out as the permissions password lifts the restrictions.
-        let effective = |p: &str| pdfcraft_cos::effective_password(self.algorithm, p);
-        let (open, permissions) = (self.open_password.as_deref().map(effective), self.permissions_password.as_deref().map(effective));
-        let empty = effective("");
-        if open.iter().chain(&permissions).any(|p| *p == empty) {
-            return bad("passwords can't be empty or made only of characters that passwords ignore, such as soft hyphens");
-        }
-        if open.is_some() && open == permissions {
-            return bad("the open password and the permissions password must be different (PDF readers treat these two as the same password)");
-        }
-        Ok(())
-    }
-}
-
-/// Edits that can be applied to a document. Page indices are 0-based.
-#[derive(Clone, Debug, PartialEq)]
-pub enum Edit {
-    RotatePages {
-        pages: Vec<usize>,
-        degrees: i64,
-    },
-    DeletePages {
-        pages: Vec<usize>,
-    },
-    MovePages {
-        pages: Vec<usize>,
-        to: usize,
-    },
-    /// `pages` reversed among the positions they occupy.
-    ReversePages {
-        pages: Vec<usize>,
-    },
-    InsertBlankPage {
-        at: usize,
-        width: f64,
-        height: f64,
-    },
-    /// Copies of `pages` inserted at `at` (an index in the page order as it is now), or after
-    /// the last of them when `at` is `None`.
-    DuplicatePages {
-        pages: Vec<usize>,
-        at: Option<usize>,
-    },
-    /// Replace Pages: the content of `pages` is replaced by `src_pages` of another PDF; the
-    /// pages' links, comments and bookmarks stay.
-    ReplacePages {
-        pages: Vec<usize>,
-        name: String,
-        bytes: Arc<Vec<u8>>,
-        src_pages: Vec<usize>,
-    },
-    /// Set Page Boxes / Crop: set (or reset) one box on `pages`.
-    SetPageBox {
-        pages: Vec<usize>,
-        which: PageBox,
-        spec: BoxSpec,
-    },
-    /// Set or remove the page transition and display time of pages (ISO 32000-2 §12.4.4),
-    /// Organize ▸ Page Transitions.
-    SetTransition {
-        pages: Vec<usize>,
-        spec: TransitionSpec,
-    },
-    SetInfo {
-        key: String,
-        value: String,
-    },
-    /// Insert pages from another PDF (all pages when `pages` is `None`) at position `at`.
-    InsertPagesFrom {
-        name: String,
-        bytes: Arc<Vec<u8>>,
-        pages: Option<Vec<usize>>,
-        at: usize,
-        /// How a form field whose name the document already uses is kept separate.
-        field_conflicts: pdfcraft_organize::FieldConflicts,
-    },
-    /// Add a bookmark to `page` as child `index` of the bookmark at `parent` (`[]` = top level).
-    /// It goes to the user-space point (`left`, `top`) of the page at the reader's zoom, and
-    /// either may be `None` to keep the reader's position that way (both `None` is the page top).
-    /// A coordinate that is not finite fails the edit.
-    AddBookmark {
-        parent: Vec<usize>,
-        index: usize,
-        title: String,
-        page: usize,
-        left: Option<f64>,
-        top: Option<f64>,
-    },
-    RenameBookmark {
-        path: Vec<usize>,
-        title: String,
-    },
-    /// Delete a bookmark and the bookmarks under it.
-    DeleteBookmark {
-        path: Vec<usize>,
-    },
-    /// Move a bookmark to child `index` of `to_parent` (indices after removing it).
-    MoveBookmark {
-        from: Vec<usize>,
-        to_parent: Vec<usize>,
-        index: usize,
-    },
-    /// Point a bookmark at another page.
-    SetBookmarkPage {
-        path: Vec<usize>,
-        page: usize,
-    },
-    /// Colour a bookmark's title (`/C`); `None` or black is the default black.
-    SetBookmarkColor {
-        path: Vec<usize>,
-        color: Option<[f64; 3]>,
-    },
-    /// Make a bookmark's title bold or italic or not (`/F`); `None` keeps that one.
-    SetBookmarkStyle {
-        path: Vec<usize>,
-        bold: Option<bool>,
-        italic: Option<bool>,
-    },
-    /// Bookmarks for the tagged headings (H, H1–H6), nested by level under a new first
-    /// "Untitled" bookmark (New Bookmarks from Structure).
-    BookmarksFromStructure,
-    /// Label pages `from..=to` (0-based) as Acrobat's "Number pages" does; later pages keep their labels.
-    NumberPages {
-        from: usize,
-        to: usize,
-        style: pdfcraft_organize::LabelStyle,
-        prefix: String,
-        first: u32,
-    },
-    /// Add a calibrated distance, perimeter or area annotation.
-    AddMeasurement(measure::NewMeasurement),
-    /// Store a drawing scale for a rectangular viewport (PDF user space).
-    SetMeasurementScale {
-        page: usize,
-        bbox: [f64; 4],
-        name: String,
-        scale: measure::Scale,
-    },
-    /// Add a comment (sticky note, highlight, shape, drawing, text box…).
-    AddAnnotation(NewAnnotation),
-    /// A custom stamp from a picture file (a PDF page or an image) on `page`. A zero-size
-    /// `rect` is a point: the stamp is centred there at its natural size (at most 200 pt).
-    /// Any other `rect` is a box: the picture is scaled to fit inside it, keeping its shape,
-    /// and centred in it (#4077).
-    AddCustomStamp {
-        page: usize,
-        rect: [f64; 4],
-        name: String,
-        file: MarkFile,
-        author: String,
-    },
-    /// Delete the comment at `index` in the page's `/Annots`, with its pop-up and replies.
-    DeleteAnnotation {
-        page: usize,
-        index: usize,
-    },
-    SetAnnotationContents {
-        page: usize,
-        index: usize,
-        text: String,
-    },
-    ReplyToAnnotation {
-        page: usize,
-        index: usize,
-        text: String,
-        author: String,
-    },
-    /// Acrobat's "Set status" (a state reply by `author`).
-    SetAnnotationStatus {
-        page: usize,
-        index: usize,
-        state: ReviewState,
-        author: String,
-    },
-    /// The Eraser: rub out the parts of drawing `(page, index)` near `path` (user space).
-    EraseInk {
-        page: usize,
-        index: usize,
-        path: Vec<[f64; 2]>,
-        radius: f64,
-    },
-    /// Replace Text: strike out `quads` and add a grouped caret holding `text`.
-    ReplaceText {
-        page: usize,
-        quads: Vec<[f64; 8]>,
-        text: String,
-        author: String,
-        strike: Style,
-        caret: Style,
-    },
-    /// Acrobat's "Mark with checkmark" (a hidden `/StateModel /Marked` reply by `author`).
-    MarkAnnotation {
-        page: usize,
-        index: usize,
-        marked: bool,
-        author: String,
-    },
-    /// Properties ▸ Locked.
-    LockAnnotation {
-        page: usize,
-        index: usize,
-        locked: bool,
-    },
-    MoveAnnotation {
-        page: usize,
-        index: usize,
-        dx: f64,
-        dy: f64,
-    },
-    /// Reshape a line, connected lines, a polygon or a cloud: its points in user space (a line's
-    /// two ends, the others' corners).
-    ReshapeAnnotation {
-        page: usize,
-        index: usize,
-        points: Vec<[f64; 2]>,
-    },
-    /// Resize a rectangle, oval or text box.
-    ResizeAnnotation {
-        page: usize,
-        index: usize,
-        rect: [f64; 4],
-    },
-    StyleAnnotation {
-        page: usize,
-        index: usize,
-        color: Option<Rgb>,
-        opacity: Option<f64>,
-        width: Option<f64>,
-        /// Line or polyline: two endings. Callout: one. `None` leaves `/LE` unchanged.
-        endings: Option<Vec<pdfcraft_annot::LineEnding>>,
-    },
-    /// Fill a rectangle, oval or polygon comment, or remove its fill (`None`).
-    FillAnnotation {
-        page: usize,
-        index: usize,
-        fill: Option<Rgb>,
-    },
-    /// Change the font size (pt) of a text box, typewriter text or callout.
-    FontSizeAnnotation {
-        page: usize,
-        index: usize,
-        size: f64,
-    },
-    /// Comment properties ▸ General / note icon.
-    SetAnnotationInfo {
-        page: usize,
-        index: usize,
-        author: Option<String>,
-        subject: Option<String>,
-        icon: Option<NoteIcon>,
-    },
-    /// Fill in a form field.
-    SetFieldValue {
-        name: String,
-        value: FieldValue,
-    },
-    /// Clear form: the named fields (all when `None`) back to their defaults.
-    ResetForm {
-        names: Option<Vec<String>>,
-    },
-    /// Prepare a form: add a field on a page (`rect` in PDF user space); `name` defaults to
-    /// Acrobat's next free name ("Text1", "Check Box2", …).
-    AddField {
-        page: usize,
-        rect: [f64; 4],
-        kind: NewField,
-        name: Option<String>,
-    },
-    /// Field Properties ▸ General / Options.
-    SetFieldProps {
-        name: String,
-        props: Box<FieldProps>,
-    },
-    /// An image field (or any button): show this image file (PNG, JPEG, TIFF, GIF, BMP).
-    SetFieldImage {
-        name: String,
-        image: Arc<Vec<u8>>,
-    },
-    /// Duplicate a field onto other pages (same field, shared value).
-    DuplicateField {
-        name: String,
-        pages: Vec<usize>,
-    },
-    DeleteField {
-        name: String,
-    },
-    /// Page properties ▸ Tab order, for pages (0-based).
-    SetTabOrder {
-        pages: Vec<usize>,
-        order: TabOrder,
-    },
-    /// Document Properties ▸ Initial View (and the language and binding).
-    SetInitialView(Box<InitialView>),
-    /// Edit ▸ Attach a file: a document-level attachment (`/Names /EmbeddedFiles`) under
-    /// `name`, made unique; `mime` is the embedded file's `/Subtype` when known.
-    AddAttachment {
-        name: String,
-        bytes: Vec<u8>,
-        description: Option<String>,
-        mime: Option<String>,
-    },
-    /// Remove the document-level attachment whose name-tree key is `key`.
-    DeleteAttachment {
-        key: String,
-    },
-    /// Build a tagged structure tree for an untagged, text-only document.
-    AutoTagText,
-    /// Add alternate text: set (or clear, with `None`) a figure's alternate text. `figure` is
-    /// the figure element's object number (from `Document::figures`).
-    SetAltText {
-        figure: u32,
-        alt: Option<String>,
-    },
-    /// Add `/Form` tags and object references for all widgets in an untagged AcroForm.
-    AutoTagFormFields,
-    /// Change one property on a reachable indirect structure tag.
-    SetTagProperty {
-        object: pdfcraft_cos::ObjRef,
-        property: a11y::TagProperty,
-        value: Option<String>,
-    },
-    /// Move a structure tag before or after a direct sibling in reading order.
-    MoveTag {
-        object: pdfcraft_cos::ObjRef,
-        anchor: pdfcraft_cos::ObjRef,
-        placement: a11y::TagPlacement,
-    },
-    /// Add alternate text ▸ Decorative figure: the figure's content becomes an artifact.
-    MarkDecorative {
-        figure: u32,
-    },
-    /// Tags panel ▸ Mark as artifact: retire a leaf tag and mark its content as an artifact.
-    MarkTagArtifact {
-        object: pdfcraft_cos::ObjRef,
-    },
-    /// Document JavaScripts: add, replace (`script`) or remove (`None`) the document-level
-    /// script `name`.
-    SetDocumentScript {
-        name: String,
-        script: Option<String>,
-    },
-    /// Field Properties ▸ a custom script: set or remove field `name`'s JavaScript for `event`
-    /// (keystroke, format, validate, calculate or mouse_up).
-    SetFieldScript {
-        name: String,
-        event: String,
-        script: Option<String>,
-    },
-    /// Standards ▸ Save as PDF/A: fix what can be fixed for `level` (metadata, output intent,
-    /// forbidden actions, annotation flags, …).
-    ConvertPdfA {
-        level: pdfcraft_preflight::Level,
-    },
-    /// Remove what identifies the document as meeting `standard` (PDF/A or PDF/X).
-    RemoveStandardId {
-        standard: Standard,
-    },
-    /// What a script (button or console) changed in form fields: values, read-only, required
-    /// and visibility.
-    ApplyScriptChanges {
-        changes: Vec<pdfcraft_forms::FieldChange>,
-    },
-    /// An XFA form's scripted event (a button's `click`, say) on the object at `som`: what the
-    /// script changes (values, rows, visibility) is applied and the form laid out again.
-    XfaEvent {
-        som: String,
-        activity: String,
-    },
-    /// Scan & OCR ▸ Recognize text: put recognised words on `page` as invisible text over the
-    /// image (from [`ocr::OcrJob::run`]).
-    AddOcrText {
-        page: usize,
-        words: Vec<pdfcraft_ocr::PlacedWord>,
-    },
-    /// Edit a PDF ▸ Edit text: replace the text of line `line` (from `Document::text_lines`) on
-    /// `page`, in its own font when it can show it, else in Helvetica.
-    EditTextLine {
-        page: usize,
-        line: usize,
-        text: String,
-    },
-    /// Edit a PDF ▸ an existing image on `page` (index from `Document::page_images`).
-    EditPageImage {
-        page: usize,
-        index: usize,
-        change: ImageEdit,
-    },
-    /// Move mixed existing and added objects together. References resolve before any change;
-    /// offset is a user-space vector. No retyping, reflow or font substitution is involved.
-    MoveObjects {
-        page: usize,
-        objects: Vec<ObjectTarget>,
-        offset: [f64; 2],
-    },
-    /// Edit text in a paragraph box: replace paragraph `block` (from `Document::text_blocks`),
-    /// rewrapped to the box's width.
-    EditTextBlock {
-        page: usize,
-        block: usize,
-        text: String,
-        /// Formatting changes (font, size, colour, alignment); default keeps the paragraph's.
-        style: pdfcraft_edit::BlockStyle,
-    },
-    /// An explicit open-licensed full font program, completing subsets or selected by a user.
-    RegisterTextFont {
-        page: usize,
-        bytes: Arc<Vec<u8>>,
-    },
-    /// Order tabs manually: move a field one place earlier or later on its page.
-    MoveInTabOrder {
-        name: String,
-        earlier: bool,
-    },
-    /// Set the calculation order: these calculated fields first, in this order, then the others
-    /// in their current order (see [`Document::calculation_order`]). The form recalculates.
-    SetCalculationOrder {
-        names: Vec<String>,
-    },
-    /// Add a header and footer (with `replace`, existing ones on those pages go first).
-    AddHeaderFooter {
-        pages: Vec<usize>,
-        settings: HeaderFooter,
-        replace: bool,
-    },
-    /// `file`: a picture from a file (an image, or a page of a PDF) instead of text.
-    AddWatermark {
-        pages: Vec<usize>,
-        settings: Watermark,
-        replace: bool,
-        file: Option<MarkFile>,
-    },
-    /// `file`: a picture from a file instead of a colour.
-    AddBackground {
-        pages: Vec<usize>,
-        settings: Background,
-        replace: bool,
-        file: Option<MarkFile>,
-    },
-    /// Remove every mark of a kind from every page.
-    RemoveMarks {
-        kind: MarkKind,
-    },
-    /// Edit a PDF ▸ Add content ▸ Text (`text.rect` in display space).
-    AddText {
-        page: usize,
-        text: AddedText,
-    },
-    /// Edit a PDF ▸ Add content ▸ Image: an image file placed at `rect` (display space), or at
-    /// its natural size centred on the page (shrunk to fit).
-    AddImage {
-        page: usize,
-        rect: Option<[f64; 4]>,
-        name: String,
-        bytes: Arc<Vec<u8>>,
-    },
-    /// Move, resize, retype or reformat an added item (`index` among the page's added items).
-    UpdateContent {
-        page: usize,
-        index: usize,
-        content: AddedContent,
-    },
-    DeleteContent {
-        page: usize,
-        index: usize,
-    },
-    /// Replace an added image with another file (keeping its box and transforms).
-    ReplaceImage {
-        page: usize,
-        index: usize,
-        name: String,
-        bytes: Arc<Vec<u8>>,
-    },
-    /// Edit ▸ Paste: an added item copied in this document or another, as it was: text with its
-    /// style, an image in its box (display space) with its turns, flips and crop. An image's
-    /// picture is `file` (from [`Document::added_image_file`]): the copied image object is reused
-    /// while it is still that picture in this document, else one an added image here already draws
-    /// it from, else the file is embedded.
-    PasteContent {
-        page: usize,
-        content: AddedContent,
-        file: Option<(String, Arc<Vec<u8>>)>,
-    },
-    /// Apply redaction marks (all, or those on `pages`): remove what they cover for good.
-    ApplyRedactions {
-        pages: Option<Vec<usize>>,
-    },
-    /// Remove redaction marks without applying them.
-    ClearRedactions,
-    /// Edit a PDF ▸ Link: a new link over `rect` (user space).
-    AddLink {
-        page: usize,
-        rect: [f64; 4],
-        action: LinkAction,
-        style: LinkStyle,
-    },
-    /// Link Properties (`index` in the page's `/Annots`).
-    SetLink {
-        page: usize,
-        index: usize,
-        rect: Option<[f64; 4]>,
-        action: Option<LinkAction>,
-        style: Option<LinkStyle>,
-    },
-    DeleteLink {
-        page: usize,
-        index: usize,
-    },
-    /// Remove all links (on `pages`, or everywhere).
-    RemoveLinks {
-        pages: Option<Vec<usize>>,
-    },
-    /// Create links from URLs in the text: (page, line rects in user space, URI).
-    AddLinks {
-        links: Vec<(usize, Vec<[f64; 4]>, String)>,
-        style: LinkStyle,
-    },
-    /// Import comments and/or form data (XFDF, FDF, XML, CSV, tab-delimited text).
-    ImportData {
-        name: String,
-        bytes: Arc<Vec<u8>>,
-    },
-    /// Remove Hidden Information: the chosen categories.
-    RemoveHidden {
-        which: Vec<Hidden>,
-    },
-    /// Sanitize Document: every category, then a full rewrite on save.
-    Sanitize,
-    /// An XFA form made an ordinary (static) PDF form: the XFA packets, `/NeedsRendering` and
-    /// PdfCraft's private keys go, the pages as laid out and the fields with their values
-    /// stay, so every viewer shows the same form and none lays it out again. Its scripts no
-    /// longer run.
-    XfaToStatic,
-    /// Flatten comments and/or form fields on every page into page content.
-    Flatten {
-        comments: bool,
-        fields: bool,
-    },
-    /// Bake Fill & Sign text, marks and signatures into the page. Other comments and fields stay.
-    /// A no-op (no undo step) when the document has none.
-    FlattenFillSign,
-    /// Protect with passwords and permissions (written by the next save, which is a full rewrite).
-    Protect(Protection),
-    /// Remove password security (needs the owner password).
-    RemoveProtection,
-    /// Several edits applied as one undoable step (all or nothing).
-    Batch {
-        label: String,
-        edits: Vec<Edit>,
-    },
-}
-
-/// What an edit is called in the Edit menu and in the history ("Undo Rotate pages"), in two parts:
-/// a whole English wording, and the one value the document itself supplies for the wording's hole
-/// (a file name, a field name). An interface in another language looks the wording up and says the
-/// label with [`said`](Self::said); [`as_str`](Self::as_str) is the English, said the same way, so
-/// the two cannot drift apart.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Label {
-    /// The wording, with one named hole (`{name}`) where `value` goes. Listed in [`EDIT_LABELS`].
-    pub wording: &'static str,
-    /// What the document supplies, when the wording has a hole for it.
-    pub value: Option<String>,
-    text: String,
-}
-
-impl Label {
-    /// A wording with nothing to fill in.
-    pub fn of(wording: &'static str) -> Self {
-        Self { wording, value: None, text: wording.to_string() }
-    }
-
-    /// A wording whose hole the document fills in.
-    pub fn with(wording: &'static str, value: impl Into<String>) -> Self {
-        let mut label = Self { wording, value: Some(value.into()), text: String::new() };
-        label.text = label.said(wording);
-        label
-    }
-
-    /// The label read with this wording: the interface's translation of [`wording`](Self::wording),
-    /// or the English wording itself. What the document supplies goes in as it stands and is not
-    /// read again, so a name with braces in it stays whole.
-    pub fn said(&self, wording: &str) -> String {
-        let Some(value) = &self.value else { return wording.to_owned() };
-        // `{` and `}` are ASCII, so these are char boundaries.
-        match (wording.find('{'), wording.find('}')) {
-            (Some(open), Some(close)) if open < close => {
-                let mut said = String::with_capacity(wording.len() + value.len());
-                said.push_str(&wording[..open]);
-                said.push_str(value);
-                said.push_str(&wording[close + 1..]);
-                said
-            }
-            // A translation that lost its hole is said as it stands rather than losing the value.
-            _ => wording.to_owned(),
-        }
-    }
-
-    /// The label as English reads it.
-    pub fn as_str(&self) -> &str {
-        &self.text
-    }
-}
-
-impl std::fmt::Display for Label {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str(&self.text)
-    }
-}
-
-/// Every wording [`Edit::label`] can produce, for an interface to translate. `Edit::Batch` is not
-/// here: its wording is only the hole, because a batch carries its name as text (see
-/// [`BATCH_LABELS`]).
-pub const EDIT_LABELS: &[&str] = &[
-    "Rotate page",
-    "Change tag properties",
-    "Rotate pages",
-    "Delete page",
-    "Delete pages",
-    "Move page",
-    "Move pages",
-    "Reverse pages",
-    "Insert blank page",
-    "Duplicate page",
-    "Duplicate pages",
-    "Replace page",
-    "Replace pages",
-    "Crop page",
-    "Crop pages",
-    "Set page boxes",
-    "Set page transitions",
-    "Change Title",
-    "Change Author",
-    "Change Subject",
-    "Change Keywords",
-    "Change {key}",
-    "Insert pages from {name}",
-    "Insert pages from {name} — 1 field renamed",
-    "Insert pages from {name} — fields renamed",
-    "Attach {name}",
-    "Delete attachment {key}",
-    "Add bookmark",
-    "Rename bookmark",
-    "Delete bookmark",
-    "Move bookmark",
-    "Set bookmark destination",
-    "Colour",
-    "Style",
-    "New bookmarks from structure",
-    "Number pages",
-    "Measure distance",
-    "Measure perimeter",
-    "Measure area",
-    "Set measurement scale",
-    "Add sticky note",
-    "Add highlight",
-    "Add underline",
-    "Add strikethrough",
-    "Add squiggly underline",
-    "Add rectangle",
-    "Add oval",
-    "Add arrow",
-    "Add line",
-    "Add drawing",
-    "Add text box",
-    "Add checkmark",
-    "Add cross",
-    "Add dot",
-    "Add signature",
-    "Add redaction mark",
-    "Add cloud",
-    "Add polygon",
-    "Add connected lines",
-    "Add callout",
-    "Add inserted text",
-    "Add file attachment",
-    "Add stamp",
-    "Delete comment",
-    "Edit comment",
-    "Reply",
-    "Set status None",
-    "Set status Accepted",
-    "Set status Rejected",
-    "Set status Cancelled",
-    "Set status Completed",
-    "Replace text",
-    "Erase",
-    "Mark with checkmark",
-    "Remove checkmark",
-    "Lock comment",
-    "Unlock comment",
-    "Move comment",
-    "Reshape comment",
-    "Resize comment",
-    "Change comment properties",
-    "Fill in {name}",
-    "Set the image of {name}",
-    "Clear form",
-    "Add field",
-    "Change field properties",
-    "Delete field",
-    "Duplicate field",
-    "Set tab order",
-    "Set calculation order",
-    "Change initial view",
-    "Set alternate text",
-    "Mark figure as decorative",
-    "Recognize text",
-    "Run JavaScript",
-    "Run form script",
-    "Save as {level}",
-    "Remove {standard} identification",
-    "Edit script of {name}",
-    "Delete document JavaScript",
-    "Edit document JavaScript",
-    "Edit text",
-    "Load document font",
-    "Move object",
-    "Move objects",
-    "Move image",
-    "Rotate image",
-    "Flip image",
-    "Replace image",
-    "Delete image",
-    "Add header & footer",
-    "Update header & footer",
-    "Add watermark",
-    "Update watermark",
-    "Add background",
-    "Update background",
-    "Remove header & footer",
-    "Remove watermark",
-    "Remove background",
-    "Add text",
-    "Add image",
-    "Edit content",
-    "Delete content",
-    "Paste",
-    "Apply redactions",
-    "Remove redaction marks",
-    "Remove hidden information",
-    "Import {name}",
-    "Add link",
-    "Change link properties",
-    "Delete link",
-    "Remove all links",
-    "Create link",
-    "Create links",
-    "Sanitize document",
-    "Flatten comments",
-    "Flatten form fields",
-    "Flatten",
-    "Flatten Fill & Sign",
-    "Protect with password",
-    "Remove security",
-];
-
-/// The names of the batches built below L7, which an interface shows in the same places as
-/// [`EDIT_LABELS`] and so translates the same way. A batch built in the interface itself arrives
-/// already worded in the interface's language.
-pub const BATCH_LABELS: &[&str] =
-    &["Set document title", "Mark differences", "Detect form fields", "Run JavaScript", "Recognize text", field_table::LABEL, "Style"];
-
-impl Edit {
-    /// Label for the Edit menu and history ("Undo Rotate pages").
-    pub fn label(&self) -> Label {
-        match self {
-            Edit::RotatePages { pages, .. } => plural("Rotate page", "Rotate pages", pages.len()),
-            Edit::DeletePages { pages } => plural("Delete page", "Delete pages", pages.len()),
-            Edit::MovePages { pages, .. } => plural("Move page", "Move pages", pages.len()),
-            Edit::ReversePages { .. } => Label::of("Reverse pages"),
-            Edit::InsertBlankPage { .. } => Label::of("Insert blank page"),
-            Edit::DuplicatePages { pages, .. } => plural("Duplicate page", "Duplicate pages", pages.len()),
-            Edit::ReplacePages { pages, .. } => plural("Replace page", "Replace pages", pages.len()),
-            Edit::SetPageBox { pages, which: PageBox::Crop, .. } => plural("Crop page", "Crop pages", pages.len()),
-            Edit::SetPageBox { .. } => Label::of("Set page boxes"),
-            Edit::SetTransition { .. } => Label::of("Set page transitions"),
-            // The four `/Info` keys PdfCraft itself offers get a wording of their own, so each can
-            // be said in another language; any other key is the document's and goes in as it stands.
-            Edit::SetInfo { key, .. } => match key.as_str() {
-                "Title" => Label::of("Change Title"),
-                "Author" => Label::of("Change Author"),
-                "Subject" => Label::of("Change Subject"),
-                "Keywords" => Label::of("Change Keywords"),
-                _ => Label::with("Change {key}", key.as_str()),
-            },
-            Edit::InsertPagesFrom { name, .. } => Label::with("Insert pages from {name}", name.as_str()),
-            Edit::AddBookmark { .. } => Label::of("Add bookmark"),
-            Edit::RenameBookmark { .. } => Label::of("Rename bookmark"),
-            Edit::DeleteBookmark { .. } => Label::of("Delete bookmark"),
-            Edit::MoveBookmark { .. } => Label::of("Move bookmark"),
-            Edit::SetBookmarkPage { .. } => Label::of("Set bookmark destination"),
-            // The bookmark Style and Colour menus' own names, already said in every language.
-            Edit::SetBookmarkColor { .. } => Label::of("Colour"),
-            Edit::SetBookmarkStyle { .. } => Label::of("Style"),
-            Edit::BookmarksFromStructure => Label::of("New bookmarks from structure"),
-            Edit::NumberPages { .. } => Label::of("Number pages"),
-            // What was measured is part of the wording too, for the same reason.
-            Edit::AddMeasurement(m) => Label::of(match m.kind {
-                pdfcraft_measure::Kind::Distance => "Measure distance",
-                pdfcraft_measure::Kind::Perimeter => "Measure perimeter",
-                pdfcraft_measure::Kind::Area => "Measure area",
-            }),
-            Edit::SetMeasurementScale { .. } => Label::of("Set measurement scale"),
-            Edit::AddAnnotation(a) => Label::of(add_annotation(&a.shape)),
-            Edit::AddCustomStamp { .. } => Label::of("Add stamp"),
-            Edit::DeleteAnnotation { .. } => Label::of("Delete comment"),
-            Edit::SetAnnotationContents { .. } => Label::of("Edit comment"),
-            Edit::ReplyToAnnotation { .. } => Label::of("Reply"),
-            // The state's name is part of the wording: a language may need to agree it with the rest.
-            Edit::SetAnnotationStatus { state, .. } => Label::of(match state {
-                ReviewState::None => "Set status None",
-                ReviewState::Accepted => "Set status Accepted",
-                ReviewState::Rejected => "Set status Rejected",
-                ReviewState::Cancelled => "Set status Cancelled",
-                ReviewState::Completed => "Set status Completed",
-            }),
-            Edit::ReplaceText { .. } => Label::of("Replace text"),
-            Edit::EraseInk { .. } => Label::of("Erase"),
-            Edit::MarkAnnotation { marked: true, .. } => Label::of("Mark with checkmark"),
-            Edit::MarkAnnotation { .. } => Label::of("Remove checkmark"),
-            Edit::LockAnnotation { locked: true, .. } => Label::of("Lock comment"),
-            Edit::LockAnnotation { .. } => Label::of("Unlock comment"),
-            Edit::MoveAnnotation { .. } => Label::of("Move comment"),
-            Edit::ReshapeAnnotation { .. } => Label::of("Reshape comment"),
-            Edit::ResizeAnnotation { .. } => Label::of("Resize comment"),
-            Edit::StyleAnnotation { .. } | Edit::FillAnnotation { .. } | Edit::FontSizeAnnotation { .. } | Edit::SetAnnotationInfo { .. } => {
-                Label::of("Change comment properties")
-            }
-            Edit::SetFieldValue { name, .. } => Label::with("Fill in {name}", name.as_str()),
-            Edit::SetFieldImage { name, .. } => Label::with("Set the image of {name}", name.as_str()),
-            Edit::ResetForm { .. } => Label::of("Clear form"),
-            Edit::AddField { .. } => Label::of("Add field"),
-            Edit::SetFieldProps { .. } => Label::of("Change field properties"),
-            Edit::DeleteField { .. } => Label::of("Delete field"),
-            Edit::DuplicateField { .. } => Label::of("Duplicate field"),
-            Edit::SetTabOrder { .. } | Edit::MoveInTabOrder { .. } => Label::of("Set tab order"),
-            Edit::SetCalculationOrder { .. } => Label::of("Set calculation order"),
-            Edit::SetInitialView(_) => Label::of("Change initial view"),
-            Edit::AddAttachment { name, .. } => Label::with("Attach {name}", name.as_str()),
-            Edit::DeleteAttachment { key } => Label::with("Delete attachment {key}", key.as_str()),
-            Edit::AutoTagText => Label::of("Automatically tag text"),
-            Edit::SetAltText { .. } => Label::of("Set alternate text"),
-            Edit::AutoTagFormFields => Label::of("Tag form fields"),
-            Edit::SetTagProperty { .. } => Label::of("Change tag properties"),
-            Edit::MoveTag { .. } => Label::of("Move object"),
-            Edit::MarkDecorative { .. } => Label::of("Mark figure as decorative"),
-            Edit::MarkTagArtifact { .. } => Label::of("Mark content as artifact"),
-            Edit::AddOcrText { .. } => Label::of("Recognize text"),
-            Edit::ApplyScriptChanges { .. } => Label::of("Run JavaScript"),
-            Edit::XfaEvent { .. } => Label::of("Run form script"),
-            // The level is the standard's own name ("PDF/A-2b"), so it goes in as it stands.
-            Edit::ConvertPdfA { level } => Label::with("Save as {level}", level.label()),
-            Edit::RemoveStandardId { standard } => Label::with("Remove {standard} identification", standard.label()),
-            Edit::SetFieldScript { name, .. } => Label::with("Edit script of {name}", name.as_str()),
-            Edit::SetDocumentScript { script: None, .. } => Label::of("Delete document JavaScript"),
-            Edit::SetDocumentScript { .. } => Label::of("Edit document JavaScript"),
-            Edit::EditTextLine { .. } | Edit::EditTextBlock { .. } => Label::of("Edit text"),
-            Edit::RegisterTextFont { .. } => Label::of("Load document font"),
-            Edit::MoveObjects { objects, .. } => plural("Move object", "Move objects", objects.len()),
-            Edit::EditPageImage { change, .. } => Label::of(match change {
-                ImageEdit::Move(_) => "Move image",
-                ImageEdit::Rotate(_) | ImageEdit::RotateBy(_) => "Rotate image",
-                ImageEdit::Crop(_) => "Crop image",
-                ImageEdit::Flip { .. } => "Flip image",
-                ImageEdit::Replace { .. } => "Replace image",
-                ImageEdit::Delete => "Delete image",
-            }),
-            Edit::AddHeaderFooter { replace: false, .. } => Label::of("Add header & footer"),
-            Edit::AddHeaderFooter { .. } => Label::of("Update header & footer"),
-            Edit::AddWatermark { replace: false, .. } => Label::of("Add watermark"),
-            Edit::AddWatermark { .. } => Label::of("Update watermark"),
-            Edit::AddBackground { replace: false, .. } => Label::of("Add background"),
-            Edit::AddBackground { .. } => Label::of("Update background"),
-            Edit::RemoveMarks { kind: MarkKind::HeaderFooter } => Label::of("Remove header & footer"),
-            Edit::RemoveMarks { kind: MarkKind::Watermark } => Label::of("Remove watermark"),
-            Edit::RemoveMarks { kind: MarkKind::Background } => Label::of("Remove background"),
-            Edit::AddText { .. } => Label::of("Add text"),
-            Edit::AddImage { .. } => Label::of("Add image"),
-            Edit::UpdateContent { .. } => Label::of("Edit content"),
-            Edit::DeleteContent { .. } => Label::of("Delete content"),
-            Edit::ReplaceImage { .. } => Label::of("Replace image"),
-            Edit::PasteContent { .. } => Label::of("Paste"),
-            Edit::ApplyRedactions { .. } => Label::of("Apply redactions"),
-            Edit::ClearRedactions => Label::of("Remove redaction marks"),
-            Edit::RemoveHidden { .. } => Label::of("Remove hidden information"),
-            Edit::ImportData { name, .. } => Label::with("Import {name}", name.as_str()),
-            Edit::AddLink { .. } => Label::of("Add link"),
-            Edit::SetLink { .. } => Label::of("Change link properties"),
-            Edit::DeleteLink { .. } => Label::of("Delete link"),
-            Edit::RemoveLinks { .. } => Label::of("Remove all links"),
-            Edit::AddLinks { links, .. } => plural("Create link", "Create links", links.len()),
-            Edit::Sanitize => Label::of("Sanitize document"),
-            Edit::XfaToStatic => Label::of("Convert to a static form"),
-            Edit::Flatten { comments: true, fields: false } => Label::of("Flatten comments"),
-            Edit::Flatten { comments: false, fields: true } => Label::of("Flatten form fields"),
-            Edit::Flatten { .. } => Label::of("Flatten"),
-            Edit::FlattenFillSign => Label::of("Flatten Fill & Sign"),
-            Edit::Protect(_) => Label::of("Protect with password"),
-            Edit::RemoveProtection => Label::of("Remove security"),
-            // A batch carries its own name, already worded by whoever built it.
-            // A batch carries its name as text, so the wording is only the hole (see `BATCH_LABELS`).
-            Edit::Batch { label, .. } => Label::with("{batch}", label.as_str()),
-        }
-    }
-}
-
-/// What the Edit menu calls a new comment ("Undo Add highlight"). A whole wording for each kind,
-/// so a language can give the noun the article and the gender its own grammar asks for.
-fn add_annotation(s: &Shape) -> &'static str {
-    match s {
-        Shape::Note { .. } => "Add sticky note",
-        Shape::TextMarkup { kind: Markup::Highlight, .. } => "Add highlight",
-        Shape::TextMarkup { kind: Markup::Underline, .. } => "Add underline",
-        Shape::TextMarkup { kind: Markup::StrikeOut, .. } => "Add strikethrough",
-        Shape::TextMarkup { kind: Markup::Squiggly, .. } => "Add squiggly underline",
-        Shape::Rectangle { .. } => "Add rectangle",
-        Shape::Oval { .. } => "Add oval",
-        Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Add arrow",
-        Shape::Line { .. } => "Add line",
-        Shape::Ink { .. } => "Add drawing",
-        Shape::TextBox { .. } => "Add text box",
-        Shape::Typewriter { .. } => "Add text",
-        Shape::Mark { mark: FillMark::Check, .. } => "Add checkmark",
-        Shape::Mark { mark: FillMark::Cross, .. } => "Add cross",
-        Shape::Mark { mark: FillMark::Dot, .. } => "Add dot",
-        Shape::Mark { mark: FillMark::Line, .. } => "Add line",
-        Shape::Signature { .. } | Shape::TypedSignature { .. } => "Add signature",
-        Shape::Redact { .. } => "Add redaction mark",
-        Shape::Stamp { .. } | Shape::CustomStamp { .. } => "Add stamp",
-        Shape::Polygon { cloud: true, .. } => "Add cloud",
-        Shape::Polygon { .. } => "Add polygon",
-        Shape::PolyLine { .. } => "Add connected lines",
-        Shape::Callout { .. } => "Add callout",
-        Shape::Caret { .. } => "Add inserted text",
-        Shape::Attachment { .. } => "Add file attachment",
-    }
-}
-
-/// Opened as owner, or nothing is restricted (no permissions password was set): security may
-/// be changed, as in Acrobat.
-fn unrestricted(p: &pdfcraft_cos::Permissions) -> bool {
-    const ALL: i32 = 0b1111_0011_1100; // bits 3–6 and 9–12
-    p.owner || p.bits & ALL == ALL
-}
-
-/// Whether the opening password allows an edit (§7.6.4.2, Table 22).
-fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), EditError> {
-    match edit {
-        Edit::RotatePages { .. }
-        | Edit::DeletePages { .. }
-        | Edit::MovePages { .. }
-        | Edit::ReversePages { .. }
-        | Edit::InsertBlankPage { .. }
-        | Edit::DuplicatePages { .. }
-        | Edit::ReplacePages { .. }
-        | Edit::SetPageBox { .. }
-        | Edit::SetTransition { .. }
-        | Edit::InsertPagesFrom { .. }
-        // "Assemble the document: insert, rotate or delete pages and create bookmarks" (Table 22).
-        | Edit::AddBookmark { .. }
-        | Edit::RenameBookmark { .. }
-        | Edit::DeleteBookmark { .. }
-        | Edit::MoveBookmark { .. }
-        | Edit::SetBookmarkPage { .. }
-        | Edit::SetBookmarkColor { .. }
-        | Edit::SetBookmarkStyle { .. }
-        | Edit::BookmarksFromStructure
-        | Edit::NumberPages { .. } => {
-            if p.assemble() {
-                Ok(())
-            } else {
-                Err(EditError::NotPermitted("page changes"))
-            }
-        }
-        Edit::AddMeasurement(_)
-        | Edit::AddAnnotation(_)
-        | Edit::AddCustomStamp { .. }
-        | Edit::DeleteAnnotation { .. }
-        | Edit::SetAnnotationContents { .. }
-        | Edit::ReplyToAnnotation { .. }
-        | Edit::SetAnnotationStatus { .. }
-        | Edit::MarkAnnotation { .. }
-        | Edit::ReplaceText { .. }
-        | Edit::EraseInk { .. }
-        | Edit::LockAnnotation { .. }
-        | Edit::MoveAnnotation { .. }
-        | Edit::ReshapeAnnotation { .. }
-        | Edit::ResizeAnnotation { .. }
-        | Edit::StyleAnnotation { .. }
-        | Edit::FillAnnotation { .. }
-        | Edit::FontSizeAnnotation { .. }
-        | Edit::SetAnnotationInfo { .. }
-        | Edit::SetMeasurementScale { .. } => {
-            if p.annotate() {
-                Ok(())
-            } else {
-                Err(EditError::NotPermitted("comments"))
-            }
-        }
-        Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::ApplyScriptChanges { .. } | Edit::XfaEvent { .. } => {
-            if p.fill_forms() {
-                Ok(())
-            } else {
-                Err(EditError::NotPermitted("filling in form fields"))
-            }
-        }
-        Edit::Protect(_) | Edit::RemoveProtection => {
-            if unrestricted(p) {
-                Ok(())
-            } else {
-                Err(EditError::NotPermitted("changing security"))
-            }
-        }
-        // Converting to PDF/A takes the encryption off (PDF/A forbids it), so on an encrypted
-        // document it is a change of security (#3921).
-        Edit::ConvertPdfA { .. } => {
-            if unrestricted(p) {
-                Ok(())
-            } else {
-                Err(EditError::NotPermitted("removing the encryption, which PDF/A forbids"))
-            }
-        }
-        Edit::SetInfo { .. }
-        | Edit::AddHeaderFooter { .. }
-        | Edit::AddWatermark { .. }
-        | Edit::AddBackground { .. }
-        | Edit::RemoveMarks { .. }
-        | Edit::AddField { .. }
-        | Edit::ApplyRedactions { .. }
-        | Edit::AddText { .. }
-        | Edit::AddImage { .. }
-        | Edit::UpdateContent { .. }
-        | Edit::MoveObjects { .. }
-        | Edit::DeleteContent { .. }
-        | Edit::ReplaceImage { .. }
-        | Edit::PasteContent { .. }
-        | Edit::ClearRedactions
-        | Edit::RemoveHidden { .. }
-        | Edit::ImportData { .. }
-        | Edit::AddLink { .. }
-        | Edit::SetLink { .. }
-        | Edit::DeleteLink { .. }
-        | Edit::RemoveLinks { .. }
-        | Edit::AddLinks { .. }
-        | Edit::Sanitize
-        | Edit::XfaToStatic
-        | Edit::SetFieldProps { .. }
-        | Edit::DeleteField { .. }
-        | Edit::DuplicateField { .. }
-        | Edit::SetTabOrder { .. }
-        | Edit::MoveInTabOrder { .. }
-        | Edit::SetCalculationOrder { .. }
-        | Edit::SetInitialView(_)
-        | Edit::AddAttachment { .. }
-        | Edit::DeleteAttachment { .. }
-        | Edit::AutoTagText
-        | Edit::SetAltText { .. }
-        | Edit::AutoTagFormFields
-        | Edit::SetTagProperty { .. }
-        | Edit::MoveTag { .. }
-        | Edit::MarkDecorative { .. }
-        | Edit::MarkTagArtifact { .. }
-        | Edit::AddOcrText { .. }
-        | Edit::SetDocumentScript { .. }
-        | Edit::SetFieldScript { .. }
-        | Edit::RemoveStandardId { .. }
-        | Edit::EditTextLine { .. }
-        | Edit::EditTextBlock { .. }
-        | Edit::RegisterTextFont { .. }
-        | Edit::EditPageImage { .. }
-        | Edit::Flatten { .. }
-        | Edit::FlattenFillSign => {
-            if p.modify() {
-                Ok(())
-            } else {
-                Err(EditError::NotPermitted("changes to the document"))
-            }
-        }
-        Edit::Batch { edits, .. } => edits.iter().try_for_each(|e| check_permission(e, p)),
-    }
-}
-
-/// Dates and unique ids stamped onto what an edit creates.
-struct EditCtx {
-    /// Field scripts run (`None`: JavaScript is off) and what they produced.
-    js: Option<js::JsRunner>,
-    /// A laid-out XFA form's template (`None`: not an XFA form, or JavaScript is off) and what
-    /// its scripts produced.
-    xfa: Option<Arc<pdfcraft_xfa::model::Template>>,
-    xfa_out: js::JsOutput,
-    /// The datasets stream this edit wrote (later writes in the edit replace it in place).
-    xfa_datasets: Option<pdfcraft_cos::ObjRef>,
-    /// A form script ran too long and was abandoned: the document's scripts go off.
-    xfa_ran_away: bool,
-    /// The edit took the XFA out of the form: what went with it, for the document's warnings.
-    xfa_removed: Vec<String>,
-    /// Pages in the document, for `xfa.layout.pageCount()`.
-    pages: usize,
-    date: Option<String>,
-    /// Today in local time, for date tokens.
-    today: (i64, u32, u32),
-    seed: u64,
-    count: u64,
-    /// Fields the edit renamed to keep imported names separate (old → new), for the repair
-    /// log and the undo label.
-    renamed_fields: Vec<(String, String)>,
-    /// The overlay streams the edit's applied redactions added, which alone the renderer's check
-    /// leaves out.
-    redaction_overlays: Vec<pdfcraft_cos::ObjRef>,
-}
-
-impl EditCtx {
-    fn new(now: Option<i64>, salt: u64) -> Self {
-        let mut seed = 0x9E37_79B9_7F4A_7C15u64 ^ salt;
-        if let Some(t) = now {
-            seed ^= (t as u64).rotate_left(17);
-        }
-        #[cfg(not(target_arch = "wasm32"))]
-        if now.is_some() {
-            // Real clock: mix in sub-second time so ids from two sessions don't collide.
-            seed ^= std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.subsec_nanos() as u64).unwrap_or(0) << 32;
-        }
-        Self {
-            js: None,
-            xfa: None,
-            xfa_out: Default::default(),
-            xfa_datasets: None,
-            xfa_ran_away: false,
-            xfa_removed: Vec::new(),
-            pages: 0,
-            date: now.map(pdfcraft_cos::pdf_date),
-            today: (1970, 1, 1),
-            seed,
-            count: 0,
-            renamed_fields: Vec::new(),
-            redaction_overlays: Vec::new(),
-        }
-    }
-
-    /// 32 bytes of entropy for new encryption keys and salts. `RandomState` is seeded by the
-    /// operating system, so no extra dependency is needed.
-    fn entropy(&mut self) -> [u8; 32] {
-        use std::hash::{BuildHasher, Hasher};
-        let mut out = [0u8; 32];
-        for (i, chunk) in out.chunks_mut(8).enumerate() {
-            let mut h = std::collections::hash_map::RandomState::new().build_hasher();
-            h.write_u64(self.seed ^ i as u64);
-            h.write_u64(self.count);
-            self.count += 1;
-            chunk.copy_from_slice(&h.finish().to_le_bytes());
-        }
-        out
-    }
-
-    /// A fresh `/NM`: a random-looking UUID (version 4 layout) from a splitmix64 stream.
-    fn meta(&mut self) -> pdfcraft_annot::Meta {
-        let mut next = || {
-            self.count += 1;
-            let mut z = self.seed.wrapping_add(self.count.wrapping_mul(0x9E37_79B9_7F4A_7C15));
-            z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
-            z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
-            z ^ (z >> 31)
-        };
-        let (a, b) = (next(), next());
-        let id = format!(
-            "{:08x}-{:04x}-4{:03x}-{:04x}-{:012x}",
-            a >> 32,
-            (a >> 16) & 0xffff,
-            a & 0xfff,
-            0x8000 | (b >> 48) & 0x3fff,
-            b & 0xffff_ffff_ffff
-        );
-        pdfcraft_annot::Meta { date: self.date.clone(), id }
-    }
-}
-
-/// Perform an edit on a working copy (the caller discards it on error).
-fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) -> Result<(), EditError> {
-    match edit {
-        Edit::RotatePages { pages, degrees } => pdfcraft_organize::rotate_pages(doc, pages, *degrees)?,
-        Edit::DeletePages { pages } => pdfcraft_organize::delete_pages(doc, pages)?,
-        Edit::MovePages { pages, to } => pdfcraft_organize::move_pages(doc, pages, *to)?,
-        Edit::ReversePages { pages } => pdfcraft_organize::reverse_pages(doc, pages)?,
-        Edit::InsertBlankPage { at, width, height } => {
-            pdfcraft_organize::insert_blank_page(doc, *at, *width, *height)?;
-        }
-        Edit::SetInfo { key, value } => pdfcraft_organize::set_info(doc, key, value)?,
-        Edit::DuplicatePages { pages, at } => pdfcraft_organize::duplicate_pages(doc, pages, *at)?,
-        Edit::ReplacePages { pages, name, bytes, src_pages } => {
-            let src = open_source(name, bytes)?;
-            pdfcraft_organize::replace_pages(doc, pages, &src, src_pages)?;
-        }
-        Edit::SetPageBox { pages, which, spec } => pdfcraft_organize::set_page_box(doc, pages, *which, *spec)?,
-        Edit::SetTransition { pages, spec } => pdfcraft_organize::set_transition(doc, pages, spec)?,
-        Edit::InsertPagesFrom { name, bytes, pages, at, field_conflicts } => {
-            let src = open_source(name, bytes)?;
-            let pages = match pages {
-                Some(p) => p.clone(),
-                None => (0..pdfcraft_organize::page_count(&src)?).collect(),
-            };
-            // The file's bookmarks come along under one named after it, as in Combine Files.
-            let title = std::path::Path::new(name).file_stem().map_or_else(|| name.clone(), |s| s.to_string_lossy().into_owned());
-            let outcome = pdfcraft_organize::insert_file_pages(doc, &src, &title, &pages, *at, *field_conflicts)?;
-            cx.renamed_fields = outcome.renamed_fields;
-        }
-        Edit::AddBookmark { parent, index, title, page, left, top } => {
-            pdfcraft_organize::add_bookmark_at(doc, parent, *index, title, *page, *left, *top)?;
-        }
-        Edit::RenameBookmark { path, title } => pdfcraft_organize::rename_bookmark(doc, path, title)?,
-        Edit::DeleteBookmark { path } => pdfcraft_organize::delete_bookmark(doc, path)?,
-        Edit::MoveBookmark { from, to_parent, index } => {
-            pdfcraft_organize::move_bookmark(doc, from, to_parent, *index)?;
-        }
-        Edit::SetBookmarkPage { path, page } => pdfcraft_organize::set_bookmark_page(doc, path, *page)?,
-        Edit::SetBookmarkColor { path, color } => pdfcraft_organize::set_bookmark_color(doc, path, *color)?,
-        Edit::SetBookmarkStyle { path, bold, italic } => pdfcraft_organize::set_bookmark_style(doc, path, *bold, *italic)?,
-        Edit::BookmarksFromStructure => {
-            let entries: Vec<_> = pdfcraft_a11y::headings(doc)
-                .into_iter()
-                .map(|h| pdfcraft_organize::OutlineEntry { level: h.level, title: h.title, page: h.page, element: h.obj })
-                .collect();
-            pdfcraft_organize::add_bookmark_tree(doc, "Untitled", &entries)?;
-        }
-        Edit::NumberPages { from, to, style, prefix, first } => pdfcraft_organize::number_pages(doc, *from, *to, *style, prefix, *first)?,
-        Edit::AddMeasurement(m) => {
-            measure::add(doc, m, &cx.meta())?;
-        }
-        Edit::SetMeasurementScale { page, bbox, name, scale } => measure::set_scale(doc, *page, *bbox, name, scale)?,
-        Edit::AddAnnotation(a) => {
-            pdfcraft_annot::add_annotation(doc, a, &cx.meta())?;
-        }
-        Edit::AddCustomStamp { page, rect, name, file, author } => {
-            let src = mark_source(doc, file)?;
-            let (sw, sh) = (src.size.0.max(1.0), src.size.1.max(1.0));
-            let natural = rect[2] == rect[0] && rect[3] == rect[1];
-            let rotation = pdfcraft_organize::page_rotation(doc, *page)?;
-            // The picture as displayed: a quarter turn swaps its sides in user space.
-            let (dw, dh) = if matches!(rotation, 90 | 270) { (sh, sw) } else { (sw, sh) };
-            let rect = if natural {
-                let k = (200.0 / sw.max(sh)).min(1.0);
-                let (w, h) = (dw * k, dh * k);
-                [rect[0] - w / 2.0, rect[1] - h / 2.0, rect[0] + w / 2.0, rect[1] + h / 2.0]
-            } else {
-                fit_picture(*rect, dw, dh)
-            };
-            let shape = Shape::CustomStamp { rect, name: name.clone(), picture: src.xobject, image: src.image, size: (sw, sh) };
-            let style = pdfcraft_annot::Style::default_for(&shape);
-            let new = NewAnnotation { page: *page, shape, style, contents: name.clone(), author: author.clone() };
-            let index = pdfcraft_annot::add_annotation(doc, &new, &cx.meta())?;
-            pdfcraft_annot::orient_image_stamp(doc, *page, index, rotation)?;
-        }
-        Edit::DeleteAnnotation { page, index } => pdfcraft_annot::delete_annotation(doc, *page, *index)?,
-        Edit::SetAnnotationContents { page, index, text } => pdfcraft_annot::set_contents(doc, *page, *index, text, &cx.meta())?,
-        Edit::ReplyToAnnotation { page, index, text, author } => {
-            pdfcraft_annot::add_reply(doc, *page, *index, text, author, &cx.meta())?;
-        }
-        Edit::SetAnnotationStatus { page, index, state, author } => {
-            pdfcraft_annot::set_review_state(doc, *page, *index, *state, author, &cx.meta())?;
-        }
-        Edit::EraseInk { page, index, path, radius } => {
-            pdfcraft_annot::erase_ink(doc, *page, *index, path, *radius, &cx.meta())?;
-        }
-        Edit::AddAttachment { name, bytes, description, mime } => {
-            pdfcraft_organize::add_attachment(doc, name, bytes, description.as_deref(), mime.as_deref(), cx.date.as_deref())?;
-        }
-        Edit::DeleteAttachment { key } => pdfcraft_organize::delete_attachment(doc, key)?,
-        Edit::ReplaceText { page, quads, text, author, strike, caret } => {
-            // One `/NM` each: the caret replies to the strikeout, and XFDF names that reply by
-            // the strikeout's `/NM` (#2666).
-            let (strike_meta, caret_meta) = (cx.meta(), cx.meta());
-            pdfcraft_annot::add_text_replacement(doc, *page, quads, text, author, strike, caret, &strike_meta, &caret_meta)?;
-        }
-        Edit::MarkAnnotation { page, index, marked, author } => {
-            pdfcraft_annot::set_marked(doc, *page, *index, *marked, author, &cx.meta())?;
-        }
-        Edit::LockAnnotation { page, index, locked } => pdfcraft_annot::set_locked(doc, *page, *index, *locked)?,
-        Edit::MoveAnnotation { page, index, dx, dy } => pdfcraft_annot::move_annotation(doc, *page, *index, *dx, *dy, &cx.meta())?,
-        Edit::ReshapeAnnotation { page, index, points } => pdfcraft_annot::set_points(doc, *page, *index, points, &cx.meta())?,
-        Edit::ResizeAnnotation { page, index, rect } => pdfcraft_annot::set_rect(doc, *page, *index, *rect, &cx.meta())?,
-        Edit::StyleAnnotation { page, index, color, opacity, width, endings } => {
-            pdfcraft_annot::set_style(doc, *page, *index, *color, *opacity, *width, endings.as_deref(), &cx.meta())?;
-        }
-        Edit::FillAnnotation { page, index, fill } => pdfcraft_annot::set_fill(doc, *page, *index, *fill, &cx.meta())?,
-        Edit::FontSizeAnnotation { page, index, size } => pdfcraft_annot::set_font_size(doc, *page, *index, *size, &cx.meta())?,
-        Edit::SetAnnotationInfo { page, index, author, subject, icon } => {
-            pdfcraft_annot::set_info(doc, *page, *index, author.as_deref(), subject.as_deref(), *icon, &cx.meta())?;
-        }
-        Edit::SetFieldValue { name, value } => {
-            let mut set = |doc: &mut pdfcraft_cos::Document, value: &FieldValue| match cx.js.as_mut() {
-                Some(js) => pdfcraft_forms::set_value_with(doc, name, value, js),
-                None => pdfcraft_forms::set_value(doc, name, value),
-            };
-            match set(doc, value) {
-                Ok(()) => {}
-                // A date the field's format doesn't read may be typed by another of an XFA date
-                // field's patterns: it is kept in the first. Only a format refusal is tried
-                // again: it comes before any of the field's scripts run, so they run once.
-                Err(refused @ pdfcraft_forms::FormError::Format(_)) => match xfa::typed_date(doc, cx.xfa.as_deref(), name, value) {
-                    Some(typed) => set(doc, &typed)?,
-                    None => return Err(refused.into()),
-                },
-                Err(refused) => return Err(refused.into()),
-            }
-        }
-        Edit::ApplyScriptChanges { changes } => match cx.js.as_mut() {
-            Some(js) => pdfcraft_forms::apply_script_changes(doc, changes, js)?,
-            None => pdfcraft_forms::apply_script_changes(doc, changes, &mut pdfcraft_forms::NoScripts)?,
-        },
-        Edit::XfaEvent { som, activity } => {
-            let tpl = cx.xfa.clone().ok_or_else(|| EditError::Invalid("this is not a laid-out XFA form, or JavaScript is off".into()))?;
-            let mut run = xfa::XfaRun { page_count: cx.pages, out: &mut cx.xfa_out, datasets: cx.xfa_datasets, ran_away: false };
-            let ran = xfa::on_event(doc, &tpl, som, activity, &mut run);
-            cx.xfa_datasets = run.datasets;
-            cx.xfa_ran_away |= run.ran_away;
-            ran.map_err(EditError::Invalid)?;
-        }
-        Edit::SetFieldImage { name, image } => {
-            let (img, _) = embed_image(doc, name, image)?;
-            let px = match &*doc.get(img) {
-                pdfcraft_cos::Object::Stream(s) => (s.dict.int(b"Width").unwrap_or(1) as u32, s.dict.int(b"Height").unwrap_or(1) as u32),
-                _ => (1, 1),
-            };
-            // An XFA image field keeps the picture in the data too (as Designer saves it), and a
-            // laid-out form shows it from there: so only pictures the layout can show, and only
-            // for image fields (a laid-out one carries its SOM path; a static form's field name
-            // is its path).
-            let is_xfa = pdfcraft_xfa::read_packets(doc).ok().flatten().is_some();
-            let image_field = is_xfa
-                && pdfcraft_forms::fields(doc).iter().any(|f| f.name == *name && f.button == Some(pdfcraft_forms::af::ButtonAction::ImportIcon));
-            if image_field {
-                let Some(content_type) = image_content_type(image) else {
-                    return Err(EditError::Invalid(format!("{name}: an XFA form keeps a PNG, JPEG, GIF, BMP or TIFF picture; choose one of those")));
-                };
-                pdfcraft_forms::set_button_icon(doc, name, img, px)?;
-                let som = pdfcraft_xfa::fields_by_som(doc).into_iter().find(|(_, n)| n == name).map(|(s, _)| s).unwrap_or_else(|| name.clone());
-                let path = match cx.xfa.as_deref() {
-                    Some(tpl) => pdfcraft_xfa::data_path(tpl, &som),
-                    None => pdfcraft_xfa::som_to_path(&som),
-                };
-                let r =
-                    pdfcraft_xfa::write_data_image(doc, &path, content_type, image, cx.xfa_datasets).map_err(|e| EditError::Write(e.to_string()))?;
-                if !r.written && r.warnings.is_empty() {
-                    return Err(EditError::Write(format!("{name}: the picture could not be written into the form's data")));
-                }
-                cx.xfa_datasets = r.stream.or(cx.xfa_datasets);
-                cx.xfa_out.errors.extend(r.warnings);
-                xfa_after_data_change(doc, cx, false)?;
-            } else {
-                pdfcraft_forms::set_button_icon(doc, name, img, px)?;
-            }
-        }
-        Edit::ResetForm { names } => {
-            pdfcraft_forms::reset(doc, names.as_deref())?;
-        }
-        Edit::AddField { page, rect, kind, name } => {
-            pdfcraft_forms::add_field(doc, *page, *rect, kind, name.as_deref())?;
-        }
-        Edit::SetFieldProps { name, props } => {
-            pdfcraft_forms::set_props(doc, name, props)?;
-        }
-        Edit::DuplicateField { name, pages } => {
-            if pdfcraft_forms::duplicate_field(doc, name, pages)? == 0 {
-                return Err(EditError::Form(pdfcraft_forms::FormError::Invalid(format!("{name} is already on those pages"))));
-            }
-        }
-        Edit::DeleteField { name } => pdfcraft_forms::delete_field(doc, name)?,
-        Edit::SetTabOrder { pages, order } => pdfcraft_forms::set_tab_order(doc, pages, *order)?,
-        Edit::MoveInTabOrder { name, earlier } => pdfcraft_forms::move_in_tab_order(doc, name, *earlier)?,
-        // As after a script edit: the values the new order gives show at once.
-        Edit::SetCalculationOrder { names } => {
-            pdfcraft_forms::set_calculation_order(doc, names)?;
-            match cx.js.as_mut() {
-                Some(js) => pdfcraft_forms::recalculate_with(doc, js)?,
-                None => pdfcraft_forms::recalculate(doc)?,
-            };
-        }
-        Edit::SetInitialView(v) => pdfcraft_organize::set_initial_view(doc, v)?,
-        Edit::AutoTagText => {
-            a11y::autotag_text(doc).map_err(|e| EditError::Accessibility(e.to_string()))?;
-        }
-        Edit::SetAltText { figure, alt } => {
-            let r = pdfcraft_cos::ObjRef::new(*figure, doc.generation(*figure));
-            a11y::set_alt(doc, r, alt.as_deref()).map_err(|e| EditError::Accessibility(e.to_string()))?;
-        }
-        Edit::AutoTagFormFields => {
-            a11y::tag_form_fields(doc).map_err(EditError::Accessibility)?;
-        }
-        Edit::SetTagProperty { object, property, value } => {
-            a11y::set_tag_property(doc, *object, *property, value.as_deref()).map_err(|e| EditError::Accessibility(e.to_string()))?;
-        }
-        Edit::MoveTag { object, anchor, placement } => {
-            a11y::move_tag(doc, *object, *anchor, *placement).map_err(|e| EditError::Accessibility(e.to_string()))?;
-        }
-        Edit::EditTextLine { page, line, text } => {
-            pdfcraft_edit::replace_line(doc, *page, *line, text)?;
-        }
-        Edit::SetFieldScript { name, event, script } => {
-            pdfcraft_forms::set_field_script(doc, name, event, script.as_deref())?;
-            match cx.js.as_mut() {
-                Some(js) => pdfcraft_forms::recalculate_with(doc, js)?,
-                None => pdfcraft_forms::recalculate(doc)?,
-            };
-        }
-        Edit::ConvertPdfA { level } => {
-            pdfcraft_preflight::convert(doc, *level).map_err(|e| EditError::Invalid(e.to_string()))?;
-        }
-        Edit::RemoveStandardId { standard } => pdfcraft_organize::remove_standard_id(doc, *standard)?,
-        Edit::SetDocumentScript { name, script } => pdfcraft_forms::set_document_script(doc, name, script.as_deref())?,
-        Edit::AddOcrText { page, words } => {
-            pdfcraft_edit::stamp(doc, *page, "OCR", pdfcraft_ocr::text_layer(words))?;
-        }
-        Edit::EditPageImage { page, index, change } => {
-            let img = pdfcraft_edit::page_images(doc, *page)?
-                .into_iter()
-                .nth(*index)
-                .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1))))?;
-            let c = match change {
-                ImageEdit::Move(to) => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::rect_to_rect(img.rect, *to)),
-                ImageEdit::Rotate(q) => {
-                    pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.visible_rect.unwrap_or(img.rect), *q, false, false))
-                }
-                ImageEdit::RotateBy(degrees) => {
-                    let t = pdfcraft_edit::turn_by_degrees(img.visible_rect.unwrap_or(img.rect), *degrees)
-                        .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("the rotation angle must be a finite number".into())))?;
-                    pdfcraft_edit::ImageChange::Transform(t)
-                }
-                ImageEdit::Flip { horizontal } => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(
-                    img.visible_rect.unwrap_or(img.rect),
-                    0,
-                    *horizontal,
-                    !*horizontal,
-                )),
-                ImageEdit::Replace { name, bytes } => {
-                    if img.is_form {
-                        return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
-                            "grouped Form artwork cannot be replaced with a bitmap".into(),
-                        )));
-                    }
-                    pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
-                }
-                ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
-                ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
-            };
-            pdfcraft_edit::change_image(doc, *page, *index, &c)?;
-        }
-        Edit::MoveObjects { page, objects, offset } => pdfcraft_edit::move_objects(doc, *page, objects, *offset)?,
-        Edit::EditTextBlock { page, block, text, style } => {
-            pdfcraft_edit::rewrite_block(doc, *page, *block, Some(text), style)?;
-        }
-        Edit::RegisterTextFont { page, bytes } => {
-            pdfcraft_edit::text::register_text_font(doc, *page, bytes)?;
-        }
-        Edit::MarkDecorative { figure } => {
-            let r = pdfcraft_cos::ObjRef::new(*figure, doc.generation(*figure));
-            a11y::mark_decorative(doc, r).map_err(|e| EditError::Accessibility(e.to_string()))?;
-        }
-        Edit::MarkTagArtifact { object } => {
-            a11y::mark_tag_artifact(doc, *object).map_err(|e| EditError::Accessibility(e.to_string()))?;
-        }
-        Edit::AddHeaderFooter { pages, settings, replace } => {
-            let date = cx.today;
-            pdfcraft_edit::add_header_footer(doc, pages, settings, *replace, &pdfcraft_edit::Context { date })?;
-        }
-        Edit::AddWatermark { pages, settings, replace, file } => {
-            let mut s = settings.clone();
-            if let Some(f) = file {
-                s.source = Some(mark_source(doc, f)?);
-            }
-            pdfcraft_edit::add_watermark(doc, pages, &s, *replace)?
-        }
-        Edit::AddBackground { pages, settings, replace, file } => {
-            let mut s = settings.clone();
-            if let Some(f) = file {
-                s.source = Some(mark_source(doc, f)?);
-            }
-            pdfcraft_edit::add_background(doc, pages, &s, *replace)?
-        }
-        Edit::RemoveMarks { kind } => {
-            let n = pdfcraft_model::pages(doc).len();
-            if pdfcraft_edit::remove_marks(doc, &(0..n).collect::<Vec<_>>(), *kind)? == 0 {
-                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("there is nothing to remove".into())));
-            }
-        }
-        Edit::AddText { page, text } => {
-            pdfcraft_edit::add_content(doc, *page, &AddedContent::Text(text.clone()))?;
-        }
-        Edit::AddImage { page, rect, name, bytes } => {
-            let (image, natural) = embed_image(doc, name, bytes)?;
-            let rect = match rect {
-                Some(r) => *r,
-                None => {
-                    let p = pdfcraft_model::pages(doc).swap_remove(*page);
-                    let (pw, ph) = p.display_size(doc);
-                    let k = ((pw * 0.8) / natural.0).min((ph * 0.8) / natural.1).min(1.0);
-                    let (w, h) = (natural.0 * k, natural.1 * k);
-                    [(pw - w) / 2.0, (ph - h) / 2.0, (pw + w) / 2.0, (ph + h) / 2.0]
-                }
-            };
-            pdfcraft_edit::add_content(doc, *page, &AddedContent::Image(pdfcraft_edit::AddedImage::new(rect, image)))?;
-        }
-        Edit::UpdateContent { page, index, content } => pdfcraft_edit::update_content(doc, *page, *index, content)?,
-        Edit::DeleteContent { page, index } => pdfcraft_edit::delete_content(doc, *page, *index)?,
-        Edit::ReplaceImage { page, index, name, bytes } => {
-            let item = pdfcraft_edit::list_added(doc).into_iter().filter(|a| a.page == *page).nth(*index);
-            let Some(AddedContent::Image(old)) = item.map(|a| a.content) else {
-                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("that item is not an image".into())));
-            };
-            let (image, _) = embed_image(doc, name, bytes)?;
-            pdfcraft_edit::update_content(doc, *page, *index, &AddedContent::Image(pdfcraft_edit::AddedImage { image, ..old }))?;
-        }
-        Edit::PasteContent { page, content, file } => {
-            let content = match content {
-                AddedContent::Text(_) => content.clone(),
-                AddedContent::Image(img) => {
-                    let Some((name, bytes)) = file else {
-                        return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("a pasted image needs its picture".into())));
-                    };
-                    // The same picture in this document (copied here, pasted here before, or an
-                    // identical file): drawn again from the one image object rather than stored twice.
-                    let image = if copy_image::is_picture(doc, img.image, bytes) {
-                        img.image
-                    } else {
-                        match copy_image::added_picture(doc, bytes) {
-                            Some(image) => image,
-                            None => embed_image(doc, name, bytes)?.0,
-                        }
-                    };
-                    AddedContent::Image(pdfcraft_edit::AddedImage { image, ..img.clone() })
-                }
-            };
-            pdfcraft_edit::add_content(doc, *page, &content)?;
-        }
-        Edit::ApplyRedactions { pages } => {
-            cx.redaction_overlays = pdfcraft_redact::apply(doc, pages.as_deref())?.overlays;
-        }
-        Edit::ClearRedactions => {
-            pdfcraft_redact::clear_marks(doc, None)?;
-        }
-        Edit::AddLink { page, rect, action, style } => {
-            pdfcraft_annot::links::add(doc, *page, *rect, action, style)?;
-        }
-        Edit::SetLink { page, index, rect, action, style } => pdfcraft_annot::links::set(doc, *page, *index, *rect, action.as_ref(), style.as_ref())?,
-        Edit::DeleteLink { page, index } => pdfcraft_annot::links::delete(doc, *page, *index)?,
-        Edit::RemoveLinks { pages } => {
-            if pdfcraft_annot::links::remove_all(doc, pages.as_deref())? == 0 {
-                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("there are no links to remove".into())));
-            }
-        }
-        Edit::AddLinks { links, style } => {
-            if pdfcraft_annot::links::add_many(doc, links, style)? == 0 {
-                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("no web addresses were found".into())));
-            }
-        }
-        Edit::ImportData { bytes, .. } => {
-            // An XFA form takes XFA data files (XDP, datasets, or a data document) as its data;
-            // XFDF, FDF, Acrobat's XML and tables go the usual way.
-            let text = (pdfcraft_xfa::read_packets(doc).ok().flatten().is_some()).then(|| decode_data_file(bytes)).flatten();
-            match text {
-                Some(Ok(text)) if is_xfa_data_file(&text) => {
-                    let expect_root = cx.xfa.as_ref().and_then(|t| t.root.common.name.clone());
-                    let r = pdfcraft_xfa::import_data(doc, &text, expect_root.as_deref(), cx.xfa_datasets)
-                        .map_err(|e| EditError::Write(e.to_string()))?;
-                    cx.xfa_datasets = r.stream.or(cx.xfa_datasets);
-                    cx.xfa_out.errors.extend(r.warnings);
-                    cx.xfa_out.console.push(format!("Imported XFA data: {} node(s)", r.nodes));
-                    xfa_after_data_change(doc, cx, true)?;
-                }
-                Some(Err(why)) => return Err(EditError::Invalid(why)),
-                _ => {
-                    pdfcraft_xfdf::import(doc, bytes)?;
-                }
-            }
-        }
-        Edit::RemoveHidden { which } => {
-            pdfcraft_redact::sanitize::remove_hidden(doc, which)?;
-        }
-        Edit::Sanitize => {
-            pdfcraft_redact::sanitize::sanitize(doc)?;
-        }
-        Edit::Flatten { comments, fields } => {
-            // An XFA form's fields baked into the pages: the XFA goes too, or Adobe's viewers
-            // would lay the form out again from its template over the baked pages. A dynamic
-            // form that was never laid out keeps its XFA: without it only placeholders remain.
-            let shape = (*fields).then(|| pdfcraft_xfa::xfa_shape(doc)).flatten();
-            let n = pdfcraft_model::pages(doc).len();
-            pdfcraft_edit::flatten(doc, &(0..n).collect::<Vec<_>>(), *comments, *fields)?;
-            match shape {
-                Some(shape) if shape.strippable() => strip_xfa(doc, cx)?,
-                Some(_) => cx.xfa_removed.push("The XFA was kept: this dynamic form was not laid out, so its fields were not baked in".into()),
-                None => {}
-            }
-        }
-        Edit::XfaToStatic => {
-            let Some(shape) = pdfcraft_xfa::xfa_shape(doc) else {
-                return Err(EditError::Invalid("this document is not an XFA form".into()));
-            };
-            if !shape.strippable() {
-                return Err(EditError::Invalid("this dynamic XFA form was not laid out, so there is no static form to keep".into()));
-            }
-            strip_xfa(doc, cx)?;
-        }
-        Edit::FlattenFillSign => {
-            let n = pdfcraft_model::pages(doc).len();
-            pdfcraft_edit::flatten_fill_sign(doc, &(0..n).collect::<Vec<_>>())?;
-        }
-        Edit::Protect(p) => {
-            p.validate()?;
-            let seed = cx.entropy();
-            // Without a permissions password nothing is restricted, so the owner password is a
-            // random one nobody needs.
-            let random_owner: String = cx.entropy().iter().map(|b| format!("{b:02x}")).collect();
-            let params = pdfcraft_cos::NewEncryption {
-                algorithm: p.algorithm,
-                user_password: p.open_password.as_deref().unwrap_or(""),
-                owner_password: p.permissions_password.as_deref().unwrap_or(&random_owner),
-                permissions: p.permission_bits(),
-                encrypt_metadata: p.encrypt_metadata,
-                seed,
-            };
-            doc.set_encryption(&params).map_err(|e| EditError::Protection(e.to_string()))?;
-        }
-        Edit::RemoveProtection => {
-            if doc.output_handler().is_none() {
-                return Err(EditError::Protection("the document isn't protected".into()));
-            }
-            doc.remove_encryption();
-        }
-        Edit::Batch { edits, .. } => {
-            for e in edits {
-                run_edit(doc, e, cx)?;
-            }
-        }
-    }
-    Ok(())
-}
-
-/// The comment list, read from the object graph (as `inspect` lists comments).
-fn comment_list(doc: &pdfcraft_cos::Document) -> Vec<pdfcraft_render::Annotation> {
-    pdfcraft_annot::summaries(doc)
-        .into_iter()
-        .map(|s| pdfcraft_render::Annotation {
-            page: s.page,
-            subtype: s.subtype,
-            author: s.author,
-            contents: s.contents,
-            modified: s.modified.map(|m| pdfcraft_render::pretty_date(&m)),
-            name: s.name,
-            in_reply_to: s.in_reply_to,
-            rect: s.rect,
-            color: s.color,
-            index: s.index,
-            state: s.state,
-            quads: s.quads,
-            locked: s.locked,
-            intent: s.intent,
-            fill_sign: s.fill_sign,
-            no_rotate: s.no_rotate,
-            points: s.points,
-        })
-        .collect()
-}
-
-/// Seconds to add to UTC for local time (0 where unknown).
-fn local_utc_offset() -> i64 {
-    #[cfg(not(target_arch = "wasm32"))]
-    return i64::from(chrono::Local::now().offset().local_minus_utc());
-    #[cfg(target_arch = "wasm32")]
-    return 0;
-}
-
-/// (year, month, day) from a PDF date `D:YYYYMMDD…`.
-fn parse_ymd(d: &str) -> Option<(i64, u32, u32)> {
-    let d = d.strip_prefix("D:").unwrap_or(d);
-    Some((d.get(0..4)?.parse().ok()?, d.get(4..6)?.parse().ok()?, d.get(6..8)?.parse().ok()?))
-}
-
-/// The passwords after `edit`, if it changes them.
-fn keys_after(edit: &Edit) -> Option<Keys> {
-    match edit {
-        Edit::Protect(p) => {
-            Some(Keys { render: p.open_password.clone(), reopen: p.permissions_password.clone().or_else(|| p.open_password.clone()) })
-        }
-        Edit::RemoveProtection => Some(Keys::default()),
-        Edit::Batch { edits, .. } => edits.iter().rev().find_map(keys_after),
-        _ => None,
-    }
-}
-
-/// The recovered user password of an R2–R4 file as text for the renderer, which tries a password
-/// as its UTF-8 bytes and then in PDFDocEncoding: UTF-8 bytes (as some writers store passwords
-/// PDFDocEncoding can't hold, such as "şifre") stay UTF-8, and other bytes are read as
-/// PDFDocEncoding, so either way the renderer gets back exactly these bytes.
-fn renderer_password(bytes: &[u8]) -> String {
-    match std::str::from_utf8(bytes) {
-        Ok(text) => text.to_owned(),
-        Err(_) => bytes.iter().map(|b| pdfcraft_cos::pdfdoc_char(*b)).collect(),
-    }
-}
-
-/// The document as it may be written to a file (#3926): a copy without the values of text fields
-/// with the Password flag, or `cos` itself when it holds none. ISO 32000-2 §12.7.5.3, Table 231
-/// (a note to the Password flag): "it is imperative that PDF processors never store the value of
-/// the text field in the PDF file if this flag is set". The open document keeps them in memory.
-fn writable(cos: &pdfcraft_cos::Document) -> Result<std::borrow::Cow<'_, pdfcraft_cos::Document>, EditError> {
-    if !pdfcraft_forms::has_password_values(cos) {
-        return Ok(std::borrow::Cow::Borrowed(cos));
-    }
-    let mut copy = cos.clone();
-    pdfcraft_forms::clear_password_values(&mut copy).map_err(|e| EditError::Write(e.to_string()))?;
-    Ok(std::borrow::Cow::Owned(copy))
-}
-
-/// The last-resort guard (AGENTS.md §4): run `f`, turning a panic that escapes it into an error
-/// message, so one bad file or edit can't take the app and its other documents down. It is a
-/// safety net for bugs, not a substitute for returning errors.
-pub fn guard<T>(f: impl FnOnce() -> T) -> Result<T, String> {
-    std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)).map_err(|p| {
-        p.downcast_ref::<&str>().map(|s| (*s).to_string()).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_else(|| "unknown error".into())
-    })
-}
-
-/// Parse another PDF to copy pages from.
-fn open_source(name: &str, bytes: &Arc<Vec<u8>>) -> Result<pdfcraft_cos::Document, EditError> {
-    open_source_with(name, bytes, None)
-}
-
-/// [`open_source`], authenticating with `password` (user or owner) for an encrypted file.
-fn open_source_with(name: &str, bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<pdfcraft_cos::Document, EditError> {
-    source_document(bytes, password).map_err(|p| EditError::Source(format!("{name}: {p}")))
-}
-
-/// Why a file can't be a source for Combine Files (or Insert / Replace pages).
-#[derive(Debug, Clone, PartialEq, thiserror::Error)]
-pub enum SourceProblem {
-    #[error("it is password-protected")]
-    Password,
-    #[error("the password is wrong")]
-    WrongPassword,
-    #[error("its security settings don't allow copying pages")]
-    NotPermitted,
-    #[error("{0}")]
-    Unreadable(String),
-}
-
-fn source_document(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<pdfcraft_cos::Document, SourceProblem> {
-    match std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password)) {
-        Ok(Ok(d)) if d.permissions().is_some_and(|p| !p.assemble()) => Err(SourceProblem::NotPermitted),
-        Ok(Ok(d)) => Ok(d),
-        Ok(Err(pdfcraft_cos::CosError::NeedsPassword)) => Err(SourceProblem::Password),
-        Ok(Err(pdfcraft_cos::CosError::WrongPassword)) => Err(SourceProblem::WrongPassword),
-        Ok(Err(e)) => Err(SourceProblem::Unreadable(e.to_string())),
-        Err(_) => Err(SourceProblem::Unreadable("the file could not be read".into())),
-    }
-}
-
-/// Whether `bytes` can be combined, opened with `password` (user or owner) if given, and if not
-/// why: what Combine would refuse it for, so the Combine files list can say so before Combine
-/// is pressed. The owner (permissions) password lifts the restriction on copying pages.
-pub fn combine_source_check(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<(), SourceProblem> {
-    source_document(bytes, password).map(|_| ())
-}
-
-/// The number of pages of `bytes`, opened with `password` (user or owner) if given, whatever
-/// its permissions allow; `None` when it can't be read.
-pub fn source_page_count(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Option<usize> {
-    let doc = std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password)).ok()?.ok()?;
-    pdfcraft_organize::page_count(&doc).ok()
-}
-
-/// The singular or the plural wording, by count. Both are written out: a language forms its plural
-/// its own way, and `one` and `many` may differ in more than an "s".
-fn plural(one: &'static str, many: &'static str, n: usize) -> Label {
-    Label::of(if n == 1 { one } else { many })
-}
-
-#[derive(Debug, thiserror::Error, PartialEq)]
-pub enum EditError {
-    #[error("no such document")]
-    NoDocument,
-    #[error("this document can't be edited: {0}")]
-    ReadOnly(String),
-    #[error("the document's security settings don't allow {0}; open it with the owner password to make this change")]
-    NotPermitted(&'static str),
-    #[error("{0}")]
-    Organize(#[from] pdfcraft_organize::OrganizeError),
-    #[error("{0}")]
-    Bookmark(#[from] pdfcraft_organize::OutlineError),
-    #[error("{0}")]
-    Comment(#[from] pdfcraft_annot::AnnotError),
-    #[error(transparent)]
-    Measure(#[from] measure::MeasureError),
-    #[error("{0}")]
-    Protection(String),
-    #[error("the password is incorrect")]
-    WrongPassword,
-    #[error("{0}")]
-    Form(#[from] pdfcraft_forms::FormError),
-    #[error(transparent)]
-    Redact(#[from] pdfcraft_redact::RedactError),
-    #[error("{0}")]
-    Print(String),
-    #[error("{0}")]
-    Accessibility(String),
-    #[error(transparent)]
-    Data(#[from] pdfcraft_xfdf::DataError),
-    #[error("{0}")]
-    Edit(#[from] pdfcraft_edit::EditError),
-    #[error("{0}")]
-    Create(#[from] pdfcraft_create::CreateError),
-    #[error("the edited document could not be written: {0}")]
-    Write(String),
-    #[error("the edited document could not be reopened: {0}")]
-    Reopen(String),
-    #[error("couldn't use {0}")]
-    Source(String),
-    #[error("nothing to undo")]
-    NothingToUndo,
-    #[error("nothing to redo")]
-    NothingToRedo,
-    #[error("{0}")]
-    Sign(String),
-    #[error("{0}")]
-    Optimize(String),
-    #[error("cancelled")]
-    Cancelled,
-    #[error("{0} isn't possible in a signed document: it would rewrite the file and invalidate the signatures")]
-    SignedRewrite(String),
-    #[error("this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)")]
-    Signed,
-    #[error("{0}")]
-    Invalid(String),
-}
-
-impl From<pdfcraft_sign::SignError> for EditError {
-    fn from(e: pdfcraft_sign::SignError) -> Self {
-        EditError::Sign(e.to_string())
-    }
-}
-
-#[derive(Default)]
-pub struct Session {
-    docs: Vec<Document>,
-    next_id: u64,
-    /// Seconds since the Unix epoch, injected so saves are deterministic in tests.
-    clock: Option<fn() -> i64>,
-    /// Seconds to add to UTC for local time, read from whoever knows the zone (a browser, say).
-    /// Separate from `clock` on purpose: `clock` alone is the test shortcut that takes the
-    /// injected time AS local time and zeroes the zone, so injecting only it leaves either the
-    /// local dates or the UTC ones wrong by the zone's offset.
-    utc_offset: Option<fn() -> i64>,
-    /// Certificates trusted for signing (Acrobat: Trusted Certificates).
-    trust: Arc<TrustStore>,
-    /// Preferences ▸ JavaScript ▸ Enable Acrobat JavaScript, inverted (on by default).
-    js_off: bool,
-    /// Preferences ▸ Date format, when not the default (see [`dates`]).
-    date_format: Option<String>,
-    /// Preferences ▸ Date format ▸ Language, when not following the interface language.
-    date_language: Option<String>,
-}
-
-/// Immutable session state needed while a document is prepared away from its owning thread.
-#[derive(Clone)]
-pub struct OpenContext {
-    now: Option<i64>,
-    js_off: bool,
-    trust: Arc<TrustStore>,
-}
-
-/// A fully prepared document that has not yet been registered in a session.
-pub struct PreparedDocument {
-    document: Document,
-}
-
-impl OpenContext {
-    /// Prepare a document without mutating the session that supplied this context.
-    pub fn prepare_open(
-        &self,
-        name: impl Into<String>,
-        path: Option<String>,
-        bytes: Arc<Vec<u8>>,
-        password: Option<&str>,
-    ) -> Result<PreparedDocument, OpenError> {
-        let name = name.into();
-        guard(|| Session::prepare_open_unguarded(self, name, path, bytes, password))
-            .unwrap_or_else(|m| Err(OpenError::Invalid(format!("reading it failed unexpectedly ({m})"))))
-    }
-}
-
-/// Lay a dynamic XFA form out (pages and fields) and give its widgets appearances.
-fn xfa_layout(doc: &mut pdfcraft_cos::Document) -> Result<XfaLayout, String> {
-    let mut report = pdfcraft_xfa::render_into(doc).map_err(|e| e.to_string())?;
-    xfa_redraw(doc)?;
-    // The form's own values: one its field's font can't draw is drawn with `?` and reported.
-    report.warnings.extend(undrawn_field_warnings(doc));
-    Ok(report)
-}
-
-/// Give the fields of a laid-out XFA form their appearances. A signed signature box keeps the
-/// picture its signer's application drew.
-pub(crate) fn xfa_redraw(doc: &mut pdfcraft_cos::Document) -> Result<(), String> {
-    for f in pdfcraft_forms::fields(doc) {
-        if f.kind == pdfcraft_forms::FieldKind::Signature && doc.get(f.obj).as_dict().is_some_and(|d| d.contains(b"V")) {
-            continue;
-        }
-        pdfcraft_forms::redraw_field(doc, &f.name).map_err(|e| format!("{}: {e}", f.name))?;
-    }
-    Ok(())
-}
-
-/// A warning for each field whose appearance PdfCraft drew with `?` for a character its font
-/// can't draw (laying out an XFA form's own values).
-fn undrawn_field_warnings(doc: &pdfcraft_cos::Document) -> Vec<String> {
-    pdfcraft_forms::undrawn_fields(doc)
-        .into_iter()
-        .map(|(name, c)| {
-            format!("form field {name:?} holds \"{}\" (U+{:04X}), which its font can't draw: it shows ? in its place", c.escape_debug(), u32::from(c))
-        })
-        .collect()
-}
-
-/// The form's fields as the XFA data layer wants them.
-fn xfa_field_data(doc: &pdfcraft_cos::Document) -> Vec<pdfcraft_xfa::FieldDatum> {
-    use pdfcraft_forms::FieldKind as K;
-    pdfcraft_forms::fields(doc)
-        .into_iter()
-        .map(|f| {
-            let data = match f.kind {
-                K::Text | K::Combo | K::List => pdfcraft_xfa::FieldData::Text(f.value.join("\n")),
-                K::CheckBox => pdfcraft_xfa::FieldData::Check(!f.value.is_empty()),
-                K::Radio => pdfcraft_xfa::FieldData::Radio(f.value.first().cloned()),
-                K::PushButton | K::Signature => pdfcraft_xfa::FieldData::None,
-            };
-            pdfcraft_xfa::FieldDatum { obj: f.obj, name: f.name, data }
-        })
-        .collect()
-}
-
-/// Keep the XFA datasets packet in step with the fields after an edit. Returns what could not
-/// be written.
-/// `datasets`: the stream this edit already wrote, replaced in place rather than added again
-/// (and set to the one written).
-/// `tpl`: the form's parsed template when the document has one cached (else it is parsed).
-fn xfa_sync_datasets(
-    doc: &mut pdfcraft_cos::Document,
-    tpl: Option<&pdfcraft_xfa::model::Template>,
-    datasets: &mut Option<pdfcraft_cos::ObjRef>,
-) -> Result<Vec<String>, String> {
-    let data = xfa_field_data(doc);
-    let r = pdfcraft_xfa::write_datasets_with(doc, tpl, &data, *datasets).map_err(|e| e.to_string())?;
-    if r.stream.is_some() {
-        *datasets = r.stream;
-    }
-    Ok(r.warnings)
-}
-
-/// What a document whose form script ran away is told.
-const XFA_SCRIPTS_OFF: &str =
-    "A script of this form ran too long and was abandoned; the form's scripts are off for this document (reopen it to run them again)";
-
-/// Most XFA warnings kept per document.
-const MAX_XFA_WARNINGS: usize = 50;
-
-/// Add `new` to `list` (no repeats, at most [`MAX_XFA_WARNINGS`]).
-fn note_warnings(list: &mut Vec<String>, new: &[String]) {
-    for w in new {
-        if !list.contains(w) && list.len() < MAX_XFA_WARNINGS {
-            list.push(w.clone());
-        }
-    }
-}
-
-/// A data file's text: UTF-8 or UTF-16 (by a byte order mark, or how `<` is written), or
-/// Latin-1 when its XML declaration says so. `None`: not text at all (FDF); `Err`: an
-/// encoding this can't read.
-fn decode_data_file(bytes: &[u8]) -> Option<Result<String, String>> {
-    if bytes.starts_with(b"%FDF") {
-        return None;
-    }
-    let declared = |text: &str| -> Option<String> {
-        let head = text.get(..text.len().min(256))?;
-        let decl = head.strip_prefix('\u{feff}').unwrap_or(head).trim_start().strip_prefix("<?xml")?;
-        let decl = decl.split_once("?>")?.0;
-        let enc = decl.split_once("encoding=")?.1;
-        let quote = enc.chars().next()?;
-        Some(enc.get(1..)?.split(quote).next()?.trim().to_ascii_lowercase())
-    };
-    if let Some((text, _)) = pdfcraft_xfa::packets::decode(bytes) {
-        match declared(&text).as_deref() {
-            None | Some("utf-8" | "utf8" | "utf-16" | "utf-16le" | "utf-16be" | "us-ascii" | "ascii") => return Some(Ok(text)),
-            Some("iso-8859-1" | "latin1" | "latin-1" | "windows-1252" | "cp1252") if !bytes.starts_with(&[0xEF, 0xBB, 0xBF]) => {
-                // Each byte is the character it names (the 0x80–0x9F block of Windows-1252
-                // differs, and is rare in form data).
-                return Some(Ok(bytes.iter().map(|b| char::from(*b)).collect()));
-            }
-            Some(other) => return Some(Err(format!("the data file's encoding {other:?} is not supported (UTF-8, UTF-16 and ISO-8859-1 are)"))),
-        }
-    }
-    // Not valid UTF-8/UTF-16: Latin-1 by declaration, else refused.
-    let latin1: String = bytes.iter().map(|b| char::from(*b)).collect();
-    match declared(&latin1).as_deref() {
-        Some("iso-8859-1" | "latin1" | "latin-1" | "windows-1252" | "cp1252") => Some(Ok(latin1)),
-        _ => Some(Err("the data file is not UTF-8, UTF-16 or ISO-8859-1 text".into())),
-    }
-}
-
-/// Take the XFA out of `doc` and note what went with it: the packets, data no field showed,
-/// buttons that did nothing but run scripts, and fields whose value differs from the form's
-/// data (data PdfCraft could not read into them, now lost).
-fn strip_xfa(doc: &mut pdfcraft_cos::Document, cx: &mut EditCtx) -> Result<(), EditError> {
-    let fields = pdfcraft_forms::fields(doc);
-    let data = xfa_field_data(doc);
-    let differ = pdfcraft_xfa::read_values(doc, &data)
-        .into_iter()
-        .filter(|(name, value)| {
-            let Some(f) = fields.iter().find(|f| f.name == *name) else { return false };
-            match value {
-                pdfcraft_xfa::FieldData::Text(t) => f.value.join("\n") != *t && !t.trim().is_empty(),
-                pdfcraft_xfa::FieldData::Check(on) => f.value.is_empty() == *on,
-                pdfcraft_xfa::FieldData::Radio(sel) => f.value.first() != sel.as_ref(),
-                pdfcraft_xfa::FieldData::None => false,
-            }
-        })
-        .count();
-    let r = pdfcraft_xfa::strip(doc).map_err(|e| EditError::Write(e.to_string()))?;
-    cx.xfa_removed.extend(r.notes());
-    if differ > 0 {
-        cx.xfa_removed.push(format!(
-            "{differ} field(s) held a value other than the form's XFA data (data PdfCraft could not read into them); the data's version is gone"
-        ));
-    }
-    Ok(())
-}
-
-/// Keep the document's XFA state in step with its file after an edit: a script may have laid
-/// the form out again (rows added, subforms shown), an edit may have taken the XFA out
-/// (flattened, or made static), or an undo put it back.
-fn sync_xfa_state(doc: &mut Document) {
-    let Some(cos) = doc.editor.as_ref().map(|e| &e.cos) else { return };
-    match pdfcraft_xfa::existing_layout(cos) {
-        Some(report) => {
-            if doc.xfa.is_none() {
-                // Back after an undo: the XFA's own warnings apply again, the strip's don't.
-                doc.xfa_warnings.retain(|w| !w.starts_with(XFA_REMOVED_PREFIX));
-                if doc.xfa_template.is_none() && !doc.xfa_scripts_off {
-                    doc.xfa_template = xfa::template(cos);
-                }
-            }
-            doc.xfa = Some(report);
-        }
-        None => {
-            doc.xfa = None;
-            doc.xfa_template = None;
-            // Only what the strip said stays (the XFA's own warnings no longer apply).
-            doc.xfa_warnings.retain(|w| w.starts_with(XFA_REMOVED_PREFIX));
-        }
-    }
-}
-
-/// How the warnings of a strip start, so they can be told from the XFA's own.
-const XFA_REMOVED_PREFIX: &str = "XFA removed: ";
-
-/// Is this an XFA data file (an XDP, a datasets document, a data element or a data document),
-/// rather than XFDF, Acrobat's `<fields>` XML or a table? By its root element.
-fn is_xfa_data_file(text: &str) -> bool {
-    let text = text.get(..text.len().min(65_536)).unwrap_or(text);
-    let mut rest = text.trim_start_matches('\u{feff}').trim_start();
-    // Past the XML declaration, comments and processing instructions.
-    let mut guard = 0;
-    while guard < 100 {
-        guard += 1;
-        if let Some(r) = rest.strip_prefix("<?") {
-            rest = r.split_once("?>").map_or("", |(_, r)| r).trim_start();
-        } else if let Some(r) = rest.strip_prefix("<!--") {
-            rest = r.split_once("-->").map_or("", |(_, r)| r).trim_start();
-        } else if let Some(r) = rest.strip_prefix("<!") {
-            rest = r.split_once('>').map_or("", |(_, r)| r).trim_start();
-        } else {
-            break;
-        }
-    }
-    let Some(tag) = rest.strip_prefix('<') else { return false };
-    let name = tag.split(|c: char| c.is_whitespace() || c == '>' || c == '/').next().unwrap_or("");
-    let local = name.rsplit(':').next().unwrap_or(name);
-    !local.is_empty() && !matches!(local, "xfdf" | "fields" | "html" | "body")
-}
-
-/// The content type a picture is saved under, from its bytes: the kinds a laid-out form shows.
-fn image_content_type(bytes: &[u8]) -> Option<&'static str> {
-    match pdfcraft_xfa::image::kind(bytes)? {
-        pdfcraft_xfa::image::Kind::Jpeg => Some("image/jpeg"),
-        pdfcraft_xfa::image::Kind::Png => Some("image/png"),
-        pdfcraft_xfa::image::Kind::Gif => Some("image/gif"),
-        pdfcraft_xfa::image::Kind::Bmp => Some("image/bmp"),
-        pdfcraft_xfa::image::Kind::Tiff => Some("image/tiff"),
-    }
-}
-
-/// After the XFA data changed outside the fields (an import, a picture): a laid-out form is
-/// laid out again from the data (then, when `calculate`, its calculations run), and the
-/// fields take the data's values.
-fn xfa_after_data_change(doc: &mut pdfcraft_cos::Document, cx: &mut EditCtx, calculate: bool) -> Result<(), EditError> {
-    if let Some(tpl) = cx.xfa.clone() {
-        let mut run = xfa::XfaRun { page_count: cx.pages, out: &mut cx.xfa_out, datasets: cx.xfa_datasets, ran_away: false };
-        let r = guard(|| xfa::on_data_replaced(doc, &tpl, calculate, &mut run))
-            .unwrap_or_else(|m| Err(format!("laying the form out again failed unexpectedly ({m})")));
-        cx.xfa_datasets = run.datasets;
-        cx.xfa_ran_away |= run.ran_away;
-        if let Err(e) = r {
-            cx.xfa_out.errors.push(e);
-        }
-    }
-    let taken = xfa_values_from_datasets(doc).map_err(EditError::Write)?;
-    if !taken.is_empty() {
-        cx.xfa_out.console.push(format!("{} field value(s) taken from the imported data", taken.len()));
-    }
-    // Not laid out again (a static form, or scripts off): fields the data no longer holds are
-    // emptied, so the data replaced is the data shown.
-    if cx.xfa.is_none() && calculate {
-        let data = xfa_field_data(doc);
-        let present: std::collections::HashSet<String> = pdfcraft_xfa::read_values(doc, &data).into_iter().map(|(n, _)| n).collect();
-        for f in pdfcraft_forms::fields(doc) {
-            if present.contains(&f.name) || f.value.is_empty() {
-                continue;
-            }
-            use pdfcraft_forms::FieldKind as K;
-            let empty = match f.kind {
-                K::Text => FieldValue::Text(String::new()),
-                K::CheckBox => FieldValue::Check(false),
-                K::Radio => FieldValue::Radio(None),
-                K::Combo | K::List => FieldValue::Choice(Vec::new()),
-                K::PushButton | K::Signature => continue,
-            };
-            if let Err(e) = pdfcraft_forms::set_value(doc, &f.name, &empty) {
-                cx.xfa_out.errors.push(format!("{}: not emptied by the import: {e}", f.name));
-            }
-        }
-    }
-    Ok(())
-}
-
-/// Give the fields the values the XFA datasets hold (a form filled in another viewer). Returns
-/// the names of the fields that changed.
-fn xfa_values_from_datasets(doc: &mut pdfcraft_cos::Document) -> Result<Vec<String>, String> {
-    let data = xfa_field_data(doc);
-    let fields = pdfcraft_forms::fields(doc);
-    let mut changed = Vec::new();
-    for (name, value) in pdfcraft_xfa::read_values(doc, &data) {
-        let Some(f) = fields.iter().find(|f| f.name == name) else { continue };
-        let new = match value {
-            pdfcraft_xfa::FieldData::Text(t) if matches!(f.kind, pdfcraft_forms::FieldKind::Combo | pdfcraft_forms::FieldKind::List) => {
-                // Saved values, one per line for a multi-select list; shown text stands for
-                // its saved value (an older viewer may have written it).
-                let saved = |v: &str| f.options.iter().find(|(e, s)| e == v || s == v).map_or(v.to_string(), |(e, _)| e.clone());
-                let picked: Vec<String> = if f.has(pdfcraft_forms::flags::MULTI_SELECT) {
-                    t.lines().map(str::trim).filter(|l| !l.is_empty()).map(saved).collect()
-                } else {
-                    vec![saved(t.trim())]
-                };
-                (f.value != picked).then_some(FieldValue::Choice(picked))
-            }
-            pdfcraft_xfa::FieldData::Text(t) => (f.value.join("\n") != t).then_some(FieldValue::Text(t)),
-            pdfcraft_xfa::FieldData::Check(on) => (f.value.is_empty() == on).then_some(FieldValue::Check(on)),
-            pdfcraft_xfa::FieldData::Radio(sel) => (f.value.first() != sel.as_ref()).then_some(FieldValue::Radio(sel)),
-            pdfcraft_xfa::FieldData::None => None,
-        };
-        if let Some(v) = new
-            && pdfcraft_forms::set_value(doc, &name, &v).is_ok()
-        {
-            changed.push(name);
-        }
-    }
-    Ok(changed)
-}
-
-/// Validate the signature fields of `cos` (written as `bytes`).
-fn signatures_of(cos: &pdfcraft_cos::Document, bytes: &[u8], trust: &TrustStore, cache: &pdfcraft_sign::DigestCache) -> Vec<SignatureInfo> {
-    pdfcraft_sign::pdf::list_cached(cos, bytes, trust, cache)
-}
-
-impl Session {
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    /// Use a fixed clock (tests) instead of the system time.
-    pub fn with_clock(mut self, clock: fn() -> i64) -> Self {
-        self.clock = Some(clock);
-        self
-    }
-
-    /// A real clock for a host that has neither a clock nor a time zone of its own (a
-    /// `wasm32-unknown-unknown` build: `now()` would be empty and `local_utc_offset()` is 0, so
-    /// Fill & Sign stamps 1 Jan 1970 and `/ModDate` is never written). `clock` is the UTC time in
-    /// seconds since the epoch; `utc_offset` is the local zone's seconds east of UTC, asked on every
-    /// use because the zone changes with the date (daylight saving). Unlike
-    /// [`Session::with_clock`], which is a test shortcut, nothing here is taken as local time.
-    pub fn with_wall_clock(mut self, clock: fn() -> i64, utc_offset: fn() -> i64) -> Self {
-        self.clock = Some(clock);
-        self.utc_offset = Some(utc_offset);
-        self
-    }
-
-    /// Seconds to add to UTC for the local time of this session: the injected zone, else 0 under
-    /// the test clock (which is already local), else the system's.
-    fn local_offset(&self) -> i64 {
-        match (self.utc_offset, self.clock) {
-            (Some(zone), _) => zone(),
-            (None, Some(_)) => 0,
-            (None, None) => local_utc_offset(),
-        }
-    }
-
-    /// Seconds since the Unix epoch from the session clock (0 when unknown).
-    pub fn now_secs(&self) -> i64 {
-        self.now().unwrap_or(0)
-    }
-
-    fn now(&self) -> Option<i64> {
-        if let Some(c) = self.clock {
-            return Some(c());
-        }
-        #[cfg(not(target_arch = "wasm32"))]
-        return std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).ok().map(|d| d.as_secs() as i64);
-        #[cfg(target_arch = "wasm32")]
-        return None;
-    }
-
-    /// Today's date in local time: (year, month, day). With an injected clock (tests) the clock
-    /// is taken as local time.
-    /// A dynamic stamp's second line: "By Ada at 2:14 pm, Oct 02, 2026" (local time).
-    pub fn stamp_by_line(&self, author: &str) -> String {
-        let offset = self.local_offset();
-        let d = self.now().map(|t| pdfcraft_cos::pdf_date(t + offset)).unwrap_or_default();
-        let num = |a: usize, b: usize| d.get(a..b).and_then(|s| s.parse::<u32>().ok()).unwrap_or(0);
-        let (y, mo, day, hh, mm) = (num(2, 6), num(6, 8), num(8, 10), num(10, 12), num(12, 14));
-        const MONTHS: [&str; 12] = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
-        let h12 = if hh % 12 == 0 { 12 } else { hh % 12 };
-        let who = if author.trim().is_empty() { String::new() } else { format!("By {} ", author.trim()) };
-        format!("{who}at {h12}:{mm:02} {}, {} {day:02}, {y}", if hh < 12 { "am" } else { "pm" }, MONTHS[(mo.clamp(1, 12) - 1) as usize])
-    }
-
-    pub fn today(&self) -> (i64, u32, u32) {
-        let offset = self.local_offset();
-        self.now().map(|t| pdfcraft_cos::pdf_date(t + offset)).as_deref().and_then(parse_ymd).unwrap_or((1970, 1, 1))
-    }
-
-    /// Open a document from bytes. Rendering starts lazily when pages are requested.
-    ///
-    /// `password` is tried as either the user or owner password when the file is encrypted.
-    /// Open saved revision `n` (1 = the oldest) of a document as a new, unsaved document named
-    /// "<name> (revision n)".
-    pub fn open_revision(&mut self, id: DocId, n: usize) -> Result<DocId, String> {
-        let doc = self.get(id).ok_or("no such document")?;
-        let ends = doc.revision_ends();
-        let end = *n.checked_sub(1).and_then(|i| ends.get(i)).ok_or_else(|| format!("the document has {} revision(s)", ends.len()))?;
-        let name = format!("{} (revision {n}).pdf", doc.name.trim_end_matches(".pdf"));
-        let (bytes, password) = (Arc::new(doc.bytes[..end.min(doc.bytes.len())].to_vec()), doc.password.clone());
-        self.open(name, None, bytes, password.as_deref()).map_err(|e| e.to_string())
-    }
-
-    /// Snapshot the session state that affects open-time scripts, dates and signature trust.
-    pub fn open_context(&self) -> OpenContext {
-        OpenContext { now: self.now(), js_off: self.js_off, trust: self.trust.clone() }
-    }
-
-    /// Prepare a document without adding it to this session.
-    pub fn prepare_open(
-        &self,
-        name: impl Into<String>,
-        path: Option<String>,
-        bytes: Arc<Vec<u8>>,
-        password: Option<&str>,
-    ) -> Result<PreparedDocument, OpenError> {
-        self.open_context().prepare_open(name, path, bytes, password)
-    }
-
-    /// Register a prepared document. This is the only open step that mutates the session.
-    pub fn commit_open(&mut self, prepared: PreparedDocument) -> DocId {
-        self.next_id += 1;
-        let id = DocId(self.next_id);
-        let mut document = prepared.document;
-        document.id = id;
-        self.docs.push(document);
-        id
-    }
-
-    /// Synchronous convenience API used by the CLI and automation.
-    pub fn open(&mut self, name: impl Into<String>, path: Option<String>, bytes: Arc<Vec<u8>>, password: Option<&str>) -> Result<DocId, OpenError> {
-        let prepared = self.prepare_open(name, path, bytes, password)?;
-        Ok(self.commit_open(prepared))
-    }
-
-    fn prepare_open_unguarded(
-        context: &OpenContext,
-        name: String,
-        path: Option<String>,
-        bytes: Arc<Vec<u8>>,
-        password: Option<&str>,
-    ) -> Result<PreparedDocument, OpenError> {
-        let cos = std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password));
-        // The renderer authenticates on its own. It cannot use the owner password of R2–R4
-        // files, so give it the user password that owner authentication recovers.
-        let (info, render_password) = match inspect(bytes.clone(), password) {
-            Ok(info) => (info, password.map(str::to_owned)),
-            Err(OpenError::WrongPassword) => {
-                let user = match &cos {
-                    Ok(Ok(d)) => recovered_render_password(d),
-                    _ => None,
-                };
-                let user = user.ok_or(OpenError::WrongPassword)?;
-                (inspect(bytes.clone(), Some(&user))?, Some(user))
-            }
-            Err(e) => return Err(e),
-        };
-        // A dynamic XFA form is a shell around an XML template; lay the template out into real
-        // pages and fields so the rest of the engine works on it. The original bytes stay: the
-        // laid-out form is one appended revision.
-        let opts = SaveOptions { mod_date: context.now.map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
-        // Write `work` as one more revision and reopen it: what the document then is.
-        let rebase = |work: &pdfcraft_cos::Document| -> Result<(Arc<Vec<u8>>, DocInfo, pdfcraft_cos::Document), String> {
-            let new_bytes = write_incremental(work, &opts).map(Arc::new).map_err(|e| e.to_string())?;
-            let new_info = inspect(new_bytes.clone(), render_password.as_deref()).map_err(|e| e.to_string())?;
-            let new_cos = pdfcraft_cos::Document::open_with_password(new_bytes.clone(), password).map_err(|e| e.to_string())?;
-            Ok((new_bytes, new_info, new_cos))
-        };
-        let (bytes, info, cos, xfa) = match (info.xfa, cos) {
-            (Some(pdfcraft_render::Xfa::Dynamic), Ok(Ok(cos))) if pdfcraft_xfa::existing_layout(&cos).is_none() => {
-                let mut work = cos.clone();
-                let laid_out = guard(|| xfa_layout(&mut work))
-                    .unwrap_or_else(|m| Err(format!("laying it out failed unexpectedly ({m})")))
-                    .and_then(|report| rebase(&work).map(|(b, i, c)| (b, i, c, report)));
-                match laid_out {
-                    Ok((b, i, c, report)) => (b, i, Ok(Ok(c)), Some(report)),
-                    Err(e) => {
-                        let mut info = info;
-                        info.warnings.push(format!("This dynamic XFA form could not be laid out: {e}"));
-                        (bytes, info, Ok(Ok(cos)), None)
-                    }
-                }
-            }
-            // A static XFA form, or a dynamic one laid out earlier: its datasets may hold values
-            // filled in by another viewer since; give the fields those values.
-            (Some(_), Ok(Ok(cos))) => {
-                let report = pdfcraft_xfa::existing_layout(&cos);
-                let mut work = cos.clone();
-                let synced =
-                    guard(|| xfa_values_from_datasets(&mut work)).unwrap_or_else(|m| Err(format!("reading its data failed unexpectedly ({m})")));
-                match synced {
-                    Ok(names) if names.is_empty() => (bytes, info, Ok(Ok(cos)), report),
-                    Ok(names) => match rebase(&work) {
-                        Ok((b, mut i, c)) => {
-                            // The fields were rewritten from the XFA data: say so, and which.
-                            let shown: Vec<&str> = names.iter().take(5).map(String::as_str).collect();
-                            let more = if names.len() > shown.len() { format!(" and {} more", names.len() - shown.len()) } else { String::new() };
-                            i.warnings.push(format!(
-                                "{} form field value{} were taken from this form's XFA data (filled in by another viewer): {}{more}",
-                                names.len(),
-                                if names.len() == 1 { "" } else { "s" },
-                                shown.join(", ")
-                            ));
-                            (b, i, Ok(Ok(c)), report)
-                        }
-                        Err(e) => {
-                            let mut info = info;
-                            info.warnings.push(format!("The values in this form's XFA data could not be applied: {e}"));
-                            (bytes, info, Ok(Ok(cos)), report)
-                        }
-                    },
-                    Err(e) => {
-                        let mut info = info;
-                        info.warnings.push(format!("The values in this form's XFA data could not be applied: {e}"));
-                        (bytes, info, Ok(Ok(cos)), report)
-                    }
-                }
-            }
-            (_, cos) => (bytes, info, cos, None),
-        };
-        // A laid-out XFA form: its initialize and calculate scripts run now, as on opening in
-        // Acrobat; what they change is one more revision, still nothing to save.
-        let mut script_output = js::JsOutput::default();
-        let mut ran_away = false;
-        let xfa_template = match (&xfa, &cos) {
-            (Some(_), Ok(Ok(c))) => xfa::template(c),
-            _ => None,
-        };
-        let (bytes, info, cos) = match (&xfa, cos) {
-            (Some(_), Ok(Ok(cos))) if !context.js_off => match xfa_template.clone() {
-                Some(tpl) => {
-                    let mut work = cos.clone();
-                    let pages = info.pages.len();
-                    let ran = guard(|| {
-                        let mut run = xfa::XfaRun { page_count: pages, out: &mut script_output, datasets: None, ran_away: false };
-                        let changes = xfa::on_open(&mut work, &tpl, &mut run);
-                        if run.ran_away {
-                            ran_away = true;
-                        }
-                        changes
-                    })
-                    .unwrap_or_else(|m| Err(format!("its scripts failed unexpectedly ({m})")));
-                    match ran {
-                        Ok(changes) if work.is_modified() => match rebase(&work) {
-                            Ok((b, mut i, c)) => {
-                                // The file as saved differs from what opening shows: say so.
-                                if !changes.is_empty() {
-                                    i.warnings.push(format!(
-                                        "This form's scripts changed it on opening ({}); saving keeps those changes",
-                                        changes.describe()
-                                    ));
-                                }
-                                (b, i, Ok(Ok(c)))
-                            }
-                            Err(e) => {
-                                script_output.errors.push(format!("The form's scripts could not be applied: {e}"));
-                                (bytes, info, Ok(Ok(cos)))
-                            }
-                        },
-                        Ok(_) => (bytes, info, Ok(Ok(cos))),
-                        Err(e) => {
-                            script_output.errors.push(format!("The form's scripts could not run: {e}"));
-                            (bytes, info, Ok(Ok(cos)))
-                        }
-                    }
-                }
-                None => (bytes, info, Ok(Ok(cos))),
-            },
-            (_, cos) => (bytes, info, cos),
-        };
-        // The catalog leads to no page, but the reader found pages by scanning: gather the page
-        // objects into a page tree as one more revision, or page edits address none of them
-        // (#1656). Kept only when the reader then shows the same pages, and never on a signed
-        // document, where writing the repair could rewrite the file under its signatures.
-        let (bytes, info, cos) = match cos {
-            Ok(Ok(cos)) if !info.pages.is_empty() && pdfcraft_organize::page_count(&cos).unwrap_or(0) == 0 => {
-                let mut work = cos.clone();
-                let signed = || pdfcraft_sign::pdf::list(&cos, &bytes, &context.trust).iter().any(|s| s.signed);
-                let rebuilt = match pdfcraft_organize::recover_page_tree(&mut work) {
-                    Ok(n) if n > 0 && !signed() => rebase(&work).ok().filter(|(_, i, _)| same_pages(&i.pages, &info.pages)),
-                    _ => None,
-                };
-                match rebuilt {
-                    Some((b, i, mut c)) => {
-                        for line in cos.repair_log() {
-                            c.note_repair(line.clone());
-                        }
-                        c.note_repair(format!("the page tree is missing; its {} pages were found by scanning the file", i.pages.len()));
-                        (b, i, Ok(Ok(c)))
-                    }
-                    None => (bytes, info, Ok(Ok(cos))),
-                }
-            }
-            cos => (bytes, info, cos),
-        };
-        // XFA notes survive the document being re-read after edits.
-        let xfa_warnings: Vec<String> = if info.xfa.is_some() { info.warnings.clone() } else { Vec::new() };
-        let mut document = Self::build_document(&context.trust, name, path, bytes, info, cos, render_password, password, xfa);
-        // A script that ran away on open turns the form's scripts off for this document.
-        document.xfa_template = if ran_away { None } else { xfa_template };
-        document.js_output.append(script_output);
-        if ran_away {
-            document.xfa_scripts_off = true;
-            document.js_output.errors.push(XFA_SCRIPTS_OFF.into());
-        }
-        note_warnings(&mut document.xfa_warnings, &xfa_warnings);
-        Ok(PreparedDocument { document })
-    }
-
-    /// The last step of opening: build the document record and register it.
-    #[allow(clippy::too_many_arguments)]
-    fn build_document(
-        trust: &Arc<TrustStore>,
-        name: String,
-        path: Option<String>,
-        bytes: Arc<Vec<u8>>,
-        mut info: DocInfo,
-        cos: Result<Result<pdfcraft_cos::Document, pdfcraft_cos::CosError>, Box<dyn std::any::Any + Send>>,
-        render_password: Option<String>,
-        password: Option<&str>,
-        xfa: Option<XfaLayout>,
-    ) -> Document {
-        let config = RenderConfig { password: render_password.as_deref().map(Arc::from), ..Default::default() };
-        let (mut editor, read_only_reason) = match cos {
-            Ok(Ok(cos)) => {
-                let keys = Keys { render: render_password.clone(), reopen: password.map(str::to_owned) };
-                let saved = cos.bytes().clone();
-                (
-                    Some(Editor {
-                        cos,
-                        saved,
-                        saved_keys: keys.clone(),
-                        unsaved_file: false,
-                        undo: Vec::new(),
-                        redo: Vec::new(),
-                        keys,
-                        appearances: AppearanceCache::default(),
-                        field_appearances: pdfcraft_forms::FieldAppearanceCache::default(),
-                        text_blocks: TextBlocksCache::default(),
-                    }),
-                    None,
-                )
-            }
-            Ok(Err(e)) => (None, Some(e.to_string())),
-            Err(_) => (None, Some("the document structure could not be read for editing".into())),
-        };
-        let sig_cache = Arc::new(pdfcraft_sign::DigestCache::default());
-        let signatures = editor.as_ref().map(|e| signatures_of(&e.cos, &bytes, trust, &sig_cache)).unwrap_or_default();
-        // The inspection reads only `/Info`; a file stating its title or author only in XMP still
-        // shows them (#2373).
-        if let Some(e) = &editor {
-            for (field, value) in info_fields(&mut info, &e.cos) {
-                if field.is_none() {
-                    *field = value;
-                }
-            }
-        }
-        let display = display_bytes(editor.as_mut(), &bytes);
-        let renderer = RenderPool::new(display.clone(), render_threads(), config.clone());
-        let (form, adopted) = editor
-            .as_ref()
-            .map(|e| {
-                let mut fields = pdfcraft_forms::fields_with_adopted(&e.cos);
-                xfa::mark_script_buttons(&e.cos, &mut fields.items);
-                (fields.items, fields.adopted_page_fields)
-            })
-            .unwrap_or_default();
-        // Fields the file lists only as page widgets are adopted leniently; the file says so.
-        if adopted > 0
-            && let Some(e) = &mut editor
-        {
-            let line = if adopted == 1 {
-                "the form's /Fields list omits 1 field; it was read from the page annotations".to_string()
-            } else {
-                format!("the form's /Fields list omits {adopted} fields; they were read from the page annotations")
-            };
-            e.cos.note_repair(line);
-        }
-        Document {
-            id: DocId(0),
-            name,
-            path,
-            bytes,
-            display,
-            info,
-            renderer,
-            password: render_password,
-            dirty: false,
-            generation: 0,
-            snapshot_generation: 0,
-            read_only_reason,
-            form: Arc::new(form),
-            marker_scan: OnceLock::new(),
-            links: OnceLock::new(),
-            signatures: Arc::new(signatures),
-            trust: trust.clone(),
-            sig_cache,
-            editor,
-            config,
-            js_output: Default::default(),
-            xfa,
-            xfa_template: None,
-            xfa_scripts_off: false,
-            fonts_stale: false,
-            xfa_warnings: Vec::new(),
-            edit_notices: Vec::new(),
-        }
-    }
-
-    fn doc_mut(&mut self, id: DocId) -> Result<&mut Document, EditError> {
-        self.docs.iter_mut().find(|d| d.id == id).ok_or(EditError::NoDocument)
-    }
-
-    /// Apply an edit. On success the previous state is undoable and the view data is refreshed.
-    pub fn apply(&mut self, id: DocId, edit: Edit) -> Result<(), EditError> {
-        let now = self.now();
-        let today = self.today();
-        let js_off = self.js_off;
-        let doc = self.doc_mut(id)?;
-        doc.edit_notices.clear();
-        let name = doc.name.clone();
-        let is_xfa = doc.info.xfa.is_some();
-        let mut scope = scope_of(&edit);
-        let mut cx = EditCtx::new(now, doc.generation ^ (id.0 << 48));
-        if !js_off {
-            cx.xfa = doc.xfa_template.clone();
-        }
-        cx.pages = doc.info.pages.len();
-        cx.today = today;
-        let reason = doc.read_only_reason.clone().unwrap_or_default();
-        let signed = doc.is_signed();
-        let editor = doc.editor.as_mut().ok_or(EditError::ReadOnly(reason))?;
-        if let Some(p) = editor.cos.permissions() {
-            check_permission(&edit, &p)?;
-        }
-        // Rewriting an OCR word (invisible text over a scan) also hides the scanned word: cover it
-        // in the paper's colour and draw the new text in the ink's.
-        let edit = match edit {
-            Edit::EditTextBlock { page, block, text, mut style } => {
-                // Only invisible text is sampled; the blocks are usually cached from opening it.
-                if style.cover.is_none()
-                    && let Some(info) = doc.info.pages.get(page)
-                    && let Some(b) = editor.text_blocks(page).ok().and_then(|b| b.get(block).filter(|b| b.invisible).cloned())
-                    && let Some((paper, ink)) = guard(|| scan_colours::sample(&editor.cos, info, page, &b)).ok().flatten()
-                {
-                    style.cover = Some(paper);
-                    style.color = style.color.or(Some(ink));
-                }
-                Edit::EditTextBlock { page, block, text, style }
-            }
-            other => other,
-        };
-        // Nothing to bake: leave undo history and the dirty flag alone.
-        if matches!(&edit, Edit::FlattenFillSign) && !pdfcraft_annot::has_visible_fill_sign(&editor.cos) {
-            return Ok(());
-        }
-        let mut next = editor.cos.clone();
-        if !js_off && uses_scripts(&edit) {
-            cx.js = Some(js::JsRunner::new(&next, &name));
-        }
-        cx.renamed_fields.clear();
-        cx.redaction_overlays.clear();
-        // `next` is a copy: if the edit fails or crashes, the document is unchanged.
-        guard(|| run_edit(&mut next, &edit, &mut cx))
-            .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label()))))?;
-        // Redaction removed what its own interpreter places under the marks. The marks were drawn
-        // over the page as the renderer shows it, so the renderer has the last word.
-        if let Edit::ApplyRedactions { pages } = &edit {
-            let marks: Vec<pdfcraft_redact::Mark> =
-                pdfcraft_redact::marks(&editor.cos).into_iter().filter(|m| pages.as_ref().is_none_or(|p| p.contains(&m.page))).collect();
-            guard(|| shown_under_redactions(&next, &marks, &cx.redaction_overlays, &doc.info.pages, doc.password.as_deref()))
-                .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label()))))?;
-        }
-        // Renamed fields are said, not slipped in: a repair-log note (with the caveat that
-        // scripts were left alone) and a count in the undo step's label.
-        let renamed_note = |renamed: &[(String, String)]| {
-            (!renamed.is_empty()).then(|| {
-                let shown: Vec<String> = renamed.iter().take(5).map(|(old, new)| format!("{old} → {new}")).collect();
-                let more = renamed.len().saturating_sub(shown.len());
-                let more = if more > 0 { format!(", and {more} more") } else { String::new() };
-                format!(
-                    "inserted pages renamed {} form field{} to keep their names separate ({}{more}); scripts that refer to the old names were not rewritten",
-                    renamed.len(),
-                    if renamed.len() == 1 { "" } else { "s" },
-                    shown.join(", ")
-                )
-            })
-        };
-        if let Some(note) = renamed_note(&cx.renamed_fields) {
-            next.note_repair(note);
-        }
-        // Only Insert from File renames fields; its label says so in a wording the interface
-        // translates (the count lives in the repair note).
-        let label = match (&edit, cx.renamed_fields.len()) {
-            (_, 0) => edit.label(),
-            (Edit::InsertPagesFrom { name, .. }, n) => Label::with(
-                if n == 1 { "Insert pages from {name} — 1 field renamed" } else { "Insert pages from {name} — fields renamed" },
-                name.as_str(),
-            ),
-            _ => edit.label(),
-        };
-        // An XFA form's scripts answer the change: exit and validate scripts of the field, then
-        // every calculation (and a reset recalculates). They read the data, so it is brought up
-        // to date first.
-        if let Some(tpl) = cx.xfa.clone() {
-            if is_xfa && matches!(scope_of(&edit), Scope::Form | Scope::Full | Scope::Content) {
-                let datasets = &mut cx.xfa_datasets;
-                let notes = guard(|| xfa_sync_datasets(&mut next, Some(&tpl), datasets))
-                    .unwrap_or_else(|m| Err(format!("writing the XFA data failed unexpectedly ({m})")))
-                    .map_err(EditError::Write)?;
-                cx.xfa_out.errors.extend(notes);
-            }
-            fn collect(e: &Edit, changed: &mut Vec<String>, reset: &mut bool) {
-                match e {
-                    Edit::SetFieldValue { name, .. } => changed.push(name.clone()),
-                    Edit::ResetForm { .. } => *reset = true,
-                    Edit::Batch { edits, .. } => edits.iter().for_each(|e| collect(e, changed, reset)),
-                    _ => {}
-                }
-            }
-            let mut changed: Vec<String> = Vec::new();
-            let mut reset = false;
-            collect(&edit, &mut changed, &mut reset);
-            if !changed.is_empty() || reset {
-                let mut run = xfa::XfaRun { page_count: cx.pages, out: &mut cx.xfa_out, datasets: cx.xfa_datasets, ran_away: false };
-                // Every changed field's scripts, then the calculations once (after a reset,
-                // only those).
-                let ran = guard(|| xfa::on_changes(&mut next, &tpl, &changed, &mut run))
-                    .unwrap_or_else(|m| Err(format!("the form's scripts failed unexpectedly ({m})")));
-                cx.xfa_datasets = run.datasets;
-                cx.xfa_ran_away |= run.ran_away;
-                if let Err(e) = ran {
-                    cx.xfa_out.errors.push(e);
-                }
-            }
-        }
-        // XFA forms keep their values in the datasets packet too, for Adobe's viewers.
-        let mut xfa_notes = Vec::new();
-        if is_xfa && matches!(scope_of(&edit), Scope::Form | Scope::Full | Scope::Content) {
-            let (tpl, datasets) = (cx.xfa.as_deref(), &mut cx.xfa_datasets);
-            xfa_notes = guard(|| xfa_sync_datasets(&mut next, tpl, datasets))
-                .unwrap_or_else(|m| Err(format!("writing the XFA data failed unexpectedly ({m})")))
-                .map_err(EditError::Write)?;
-            // Rebuilding from stale data would discard accepted widget values.
-            if xfa_notes.is_empty() {
-                let reflow = guard(|| xfa::relayout_changed_text(&mut next, tpl, &doc.form))
-                    .unwrap_or_else(|m| Err(format!("laying out the XFA text failed unexpectedly ({m})")))
-                    .map_err(EditError::Write)?;
-                if let Some(warnings) = reflow {
-                    xfa_notes.extend(warnings);
-                    // Layout replaces pages and widgets, even if the page count is unchanged.
-                    // Undo/redo must rebuild these too instead of refreshing only field values.
-                    scope = Scope::Full;
-                }
-            }
-        }
-        // Signed documents are only ever saved incrementally: an edit that needs a full rewrite
-        // (applying redactions, changing security, sanitizing) would invalidate the signatures.
-        // So does any edit to a file rebuilt from object headers: it has no chain to append to.
-        let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();
-        if signed && ((rewrites(&next) && !rewrites(&editor.cos)) || (next.is_modified() && next.revisions().is_empty())) {
-            return Err(EditError::SignedRewrite(edit.label().to_string()));
-        }
-        // What this edit drew with `?` (a value or comment text its font can't draw, stored as
-        // typed): reported, never silent (AGENTS.md §4).
-        let notices = if matches!(scope_of(&edit), Scope::Form | Scope::Comments | Scope::Full) {
-            guard(|| undrawn_notices(&editor.cos, &next)).unwrap_or_default()
-        } else {
-            Vec::new()
-        };
-        let previous = std::mem::replace(&mut editor.cos, next);
-        let keys = keys_after(&edit).unwrap_or_else(|| editor.keys.clone());
-        let previous_keys = std::mem::replace(&mut editor.keys, keys);
-        editor.undo.push((label, previous, previous_keys, scope));
-        if editor.undo.len() > MAX_UNDO {
-            editor.undo.remove(0);
-        }
-        editor.redo.clear();
-        Self::adopt_keys(doc);
-        let refreshed = guard(|| if scope == Scope::Content { Self::refresh_content(doc, Some(&edit)) } else { Self::refresh_scoped(doc, scope) })
-            .unwrap_or_else(|m| Err(EditError::Reopen(m)));
-        if let Err(e) = refreshed {
-            // Roll back: the edit produced something we cannot display.
-            if let Some(ed) = doc.editor.as_mut()
-                && let Some((_, prev, keys, _)) = ed.undo.pop()
-            {
-                ed.cos = prev;
-                ed.keys = keys;
-            }
-            Self::adopt_keys(doc);
-            if !matches!(guard(|| Self::refresh(doc)), Ok(Ok(()))) {
-                Self::show_released(doc);
-            }
-            return Err(e);
-        }
-        doc.dirty = true;
-        doc.generation += 1;
-        doc.edit_notices = notices;
-        if !cx.xfa_removed.is_empty() {
-            let removed: Vec<String> = cx.xfa_removed.iter().map(|n| format!("{XFA_REMOVED_PREFIX}{n}")).collect();
-            doc.xfa_warnings.retain(|w| w.starts_with(XFA_REMOVED_PREFIX));
-            note_warnings(&mut doc.xfa_warnings, &removed);
-            note_warnings(&mut doc.info.warnings, &removed);
-        }
-        note_warnings(&mut doc.xfa_warnings, &xfa_notes);
-        let notes = doc.xfa_warnings.clone();
-        note_warnings(&mut doc.info.warnings, &notes);
-        if let Some(js) = cx.js {
-            doc.js_output.append(js.output);
-        }
-        doc.js_output.append(cx.xfa_out);
-        if cx.xfa_ran_away {
-            doc.xfa_template = None;
-            doc.xfa_scripts_off = true;
-            doc.js_output.errors.push(XFA_SCRIPTS_OFF.into());
-        }
-        Ok(())
-    }
-
-    pub fn undo(&mut self, id: DocId) -> Result<Label, EditError> {
-        let doc = self.doc_mut(id)?;
-        let editor = doc.editor.as_mut().ok_or(EditError::NothingToUndo)?;
-        let (label, prev, keys, scope) = editor.undo.pop().ok_or(EditError::NothingToUndo)?;
-        let current = std::mem::replace(&mut editor.cos, prev);
-        let current_keys = std::mem::replace(&mut editor.keys, keys);
-        editor.redo.push((label.clone(), current, current_keys, scope));
-        Self::adopt_keys(doc);
-        let refreshed = guard(|| Self::refresh_scoped(doc, scope)).unwrap_or_else(|m| Err(EditError::Reopen(m)));
-        if let Err(e) = refreshed {
-            if let Some(ed) = doc.editor.as_mut()
-                && let Some((label, current, current_keys, scope)) = ed.redo.pop()
-            {
-                let prev = std::mem::replace(&mut ed.cos, current);
-                let keys = std::mem::replace(&mut ed.keys, current_keys);
-                ed.undo.push((label, prev, keys, scope));
-            }
-            Self::adopt_keys(doc);
-            if !matches!(guard(|| Self::refresh(doc)), Ok(Ok(()))) {
-                Self::show_released(doc);
-            }
-            return Err(e);
-        }
-        doc.edit_notices.clear();
-        Self::sync_dirty(doc);
-        doc.generation += 1;
-        Ok(label)
-    }
-
-    pub fn redo(&mut self, id: DocId) -> Result<Label, EditError> {
-        let doc = self.doc_mut(id)?;
-        let editor = doc.editor.as_mut().ok_or(EditError::NothingToRedo)?;
-        let (label, next, keys, scope) = editor.redo.pop().ok_or(EditError::NothingToRedo)?;
-        let current = std::mem::replace(&mut editor.cos, next);
-        let current_keys = std::mem::replace(&mut editor.keys, keys);
-        editor.undo.push((label.clone(), current, current_keys, scope));
-        Self::adopt_keys(doc);
-        let refreshed = guard(|| Self::refresh_scoped(doc, scope)).unwrap_or_else(|m| Err(EditError::Reopen(m)));
-        if let Err(e) = refreshed {
-            if let Some(ed) = doc.editor.as_mut()
-                && let Some((label, current, current_keys, scope)) = ed.undo.pop()
-            {
-                let next = std::mem::replace(&mut ed.cos, current);
-                let keys = std::mem::replace(&mut ed.keys, current_keys);
-                ed.redo.push((label, next, keys, scope));
-            }
-            Self::adopt_keys(doc);
-            if !matches!(guard(|| Self::refresh(doc)), Ok(Ok(()))) {
-                Self::show_released(doc);
-            }
-            return Err(e);
-        }
-        doc.edit_notices.clear();
-        Self::sync_dirty(doc);
-        doc.generation += 1;
-        Ok(label)
-    }
-
-    /// Unsaved when the working graph is not the last opened or saved file. Undo back to that
-    /// file is clean; undo past a later save is not, because the restored snapshot's own base
-    /// is an earlier revision.
-    fn sync_dirty(doc: &mut Document) {
-        doc.dirty = doc.editor.as_ref().is_some_and(|e| e.unsaved_file || e.cos.is_modified() || !Arc::ptr_eq(e.cos.bytes(), &e.saved));
-    }
-
-    /// Use the current state's password for viewing (protection edits change it).
-    fn adopt_keys(doc: &mut Document) {
-        if let Some(e) = doc.editor.as_ref() {
-            doc.password = e.keys.render.clone();
-            doc.config.password = e.keys.render.as_deref().map(Arc::from);
-        }
-    }
-
-    /// Rebuild the working bytes and the view data that `scope` may have changed. Metadata edits
-    /// keep the renderer; other scopes also replace it.
-    /// Comment and form edits skip the full re-inspection (seconds on very large files): the
-    /// comment list and field values are re-read from the object graph instead.
-    fn refresh_scoped(doc: &mut Document, scope: Scope) -> Result<(), EditError> {
-        if scope == Scope::Full || doc.info.encrypted != doc.editor.as_ref().is_some_and(|e| e.cos.output_handler().is_some()) {
-            return Self::refresh(doc);
-        }
-        if scope == Scope::Content {
-            return Self::refresh_content(doc, None);
-        }
-        if scope == Scope::Links {
-            return Self::refresh_links(doc);
-        }
-        // Metadata edits keep the renderer, which holds the working file anyway.
-        if scope != Scope::Metadata {
-            Self::release_working(doc);
-        }
-        let Some(editor) = doc.editor.as_mut() else { return Ok(()) };
-        // Comment edits, and form edits (a script may change annotation properties), may change
-        // annotation dictionaries, invalidating cached appearances.
-        if matches!(scope, Scope::Comments | Scope::Form) {
-            editor.appearances.clear();
-        }
-        let bytes = if editor.cos.is_modified() {
-            Arc::new(write_incremental(&editor.cos, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?)
-        } else {
-            editor.cos.bytes().clone()
-        };
-        if scope == Scope::Metadata {
-            for (field, value) in info_fields(&mut doc.info, &editor.cos) {
-                *field = value;
-            }
-            doc.info.custom = pdfcraft_organize::custom_info(&editor.cos);
-            doc.info.file_size = bytes.len();
-            #[cfg(test)]
-            check_refresh_panic();
-            if !doc.signatures.is_empty() {
-                let signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
-                doc.signatures = Arc::new(signatures);
-            }
-            doc.bytes = bytes;
-            return Ok(());
-        }
-        let mut form = pdfcraft_forms::fields(&editor.cos);
-        xfa::mark_script_buttons(&editor.cos, &mut form);
-        let form = Arc::new(form);
-        match scope {
-            Scope::Metadata => return Ok(()),
-            Scope::Comments => {
-                doc.info.annotations = comment_list(&editor.cos);
-                // Link indexes are positions in /Annots, so comment insertion/deletion can move them.
-                doc.links = OnceLock::new();
-            }
-            Scope::Form => {
-                // PERF: keystroke path, index once. A linear find per field is O(F^2);
-                // forms reach 10k fields.
-                let mut by_name = std::collections::HashMap::with_capacity(form.len());
-                for x in form.iter() {
-                    // First match wins (do not simplify to collect: it keeps the last).
-                    by_name.entry(x.name.as_str()).or_insert(x);
-                }
-                for f in &mut doc.info.fields {
-                    if let Some(ff) = by_name.get(f.name.as_str()) {
-                        f.value = match ff.kind {
-                            pdfcraft_forms::FieldKind::CheckBox | pdfcraft_forms::FieldKind::Radio => {
-                                Some(ff.value.first().cloned().unwrap_or_else(|| "Off".into()))
-                            }
-                            _ if ff.value.is_empty() => None,
-                            _ => Some(ff.value.join(", ")),
-                        };
-                    }
-                }
-            }
-            Scope::Links => return Self::refresh_links(doc),
-            // Handled above; kept as a full refresh so the match stays total.
-            Scope::Full => return Self::refresh(doc),
-            // Handled above (content-only refresh); the arm keeps the match total.
-            Scope::Content => return Self::refresh_content(doc, None),
-        }
-        doc.info.file_size = bytes.len();
-        doc.form = form;
-        let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache) };
-        doc.display = display_bytes(Some(editor), &bytes);
-        doc.signatures = Arc::new(signatures);
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-        doc.bytes = bytes;
-        Ok(())
-    }
-
-    /// Which derived lists a content-only edit can change: added content (`None`, from
-    /// undo/redo, re-reads both: always correct, rarely paid).
-    fn content_refresh_lists(edit: Option<&Edit>) -> (bool, bool) {
-        if let Some(Edit::Batch { edits, .. }) = edit {
-            // A batch of content edits (from a script, say) changes what its parts change.
-            return edits.iter().fold((false, false), |(added, marks), part| {
-                let (a, m) = Self::content_refresh_lists(Some(part));
-                (added || a, marks || m)
-            });
-        }
-        let touches_added = edit.is_none_or(|e| {
-            matches!(
-                e,
-                Edit::AddText { .. }
-                    | Edit::AddImage { .. }
-                    | Edit::UpdateContent { .. }
-                    | Edit::DeleteContent { .. }
-                    | Edit::ReplaceImage { .. }
-                    | Edit::PasteContent { .. }
-            ) || matches!(e, Edit::MoveObjects { objects, .. } if objects.iter().any(|o| o.kind == ObjectKind::Added))
-        });
-        let touches_marks = edit.is_none_or(|e| {
-            matches!(e, Edit::AddHeaderFooter { .. } | Edit::AddWatermark { .. } | Edit::AddBackground { .. } | Edit::RemoveMarks { .. })
-        });
-        (touches_added, touches_marks)
-    }
-
-    /// Rebuild working bytes, display bytes and renderer after a content-only edit: page
-    /// content streams, resources and added content/marks. The page tree, annotations, form
-    /// fields, links, outline and fonts are unchanged, so the full re-inspection (seconds on
-    /// very large files) is skipped. `edit` selects which derived lists are re-read (`None`,
-    /// from undo/redo, re-reads both: always correct, rarely paid). The cached display
-    /// appearances are kept: content edits leave every annotation dictionary alone.
-    fn refresh_content(doc: &mut Document, edit: Option<&Edit>) -> Result<(), EditError> {
-        Self::release_working(doc);
-        sync_xfa_state(doc);
-        let Some(editor) = doc.editor.as_mut() else { return Ok(()) };
-        let bytes = if editor.cos.is_modified() {
-            Arc::new(write_incremental(&editor.cos, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?)
-        } else {
-            editor.cos.bytes().clone()
-        };
-        // The edit must still leave a file the viewer can open; anything else rolls back above.
-        pdfcraft_render::check_pages(bytes.clone(), doc.password.as_deref(), doc.info.pages.len()).map_err(|e| EditError::Reopen(e.to_string()))?;
-        let (touches_added, touches_marks) = Self::content_refresh_lists(edit);
-        if touches_added || touches_marks {
-            doc.marker_scan = OnceLock::new();
-        }
-        doc.info.file_size = bytes.len();
-        let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache) };
-        doc.display = display_bytes(Some(editor), &bytes);
-        doc.signatures = Arc::new(signatures);
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-        doc.bytes = bytes;
-        doc.fonts_stale = true;
-        Ok(())
-    }
-
-    /// Let go of the working file before the next one is written (gap 13). The working file is
-    /// the original plus one appended revision, so on a 1 GiB file keeping the old one (in the
-    /// working bytes, the display bytes and the renderer) while writing the new one held three
-    /// copies at once; this keeps two. Until the refresh finishes, the working and display bytes
-    /// are the original's (already held by the editor, so free) and the renderer draws nothing.
-    /// A failed edit rolls back and refreshes again, which replaces all three; where a refresh
-    /// still fails, [`Self::show_released`] draws the original rather than nothing. Save writes
-    /// from the editor, never from these.
-    fn release_working(doc: &mut Document) {
-        let Some(original) = doc.editor.as_ref().map(|e| e.cos.bytes().clone()) else { return };
-        // Dropping the pool stops its workers; each lets go of the file when it exits.
-        doc.renderer = RenderPool::new_inline(Arc::new(Vec::new()), doc.config.clone());
-        doc.display = original.clone();
-        doc.bytes = original;
-        #[cfg(test)]
-        check_refresh_panic();
-    }
-
-    /// After a refresh failed: draw the display bytes it left (the original, once released),
-    /// so the page still shows a document.
-    fn show_released(doc: &mut Document) {
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-    }
-
-    /// Rebuild working bytes, inspection and renderer from the current edit state.
-    fn refresh(doc: &mut Document) -> Result<(), EditError> {
-        Self::refresh_with_indexes(doc, true, true)
-    }
-
-    /// Reinspect a link edit while preserving the page-content marker scan cache.
-    fn refresh_links(doc: &mut Document) -> Result<(), EditError> {
-        Self::refresh_with_indexes(doc, false, true)
-    }
-
-    fn refresh_with_indexes(doc: &mut Document, invalidate_markers: bool, invalidate_links: bool) -> Result<(), EditError> {
-        // A full refresh may follow structural or annotation changes: cached appearances
-        // may be stale, so they are rebuilt below.
-        if let Some(editor) = doc.editor.as_mut() {
-            editor.appearances.clear();
-        }
-        Self::release_working(doc);
-        sync_xfa_state(doc);
-        let Some(editor) = doc.editor.as_mut() else { return Ok(()) };
-        let bytes = if editor.cos.is_modified() {
-            Arc::new(write_incremental(&editor.cos, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?)
-        } else {
-            editor.cos.bytes().clone()
-        };
-        let info = inspect(bytes.clone(), doc.password.as_deref()).map_err(|e| EditError::Reopen(e.to_string()))?;
-        // Keep the user's layer choices where the layers still exist.
-        let mut info = info;
-        for l in &mut info.layers {
-            if let Some(old) = doc.info.layers.iter().find(|o| o.id == l.id) {
-                l.visible = old.visible;
-            }
-        }
-        note_warnings(&mut info.warnings, &doc.xfa_warnings);
-        // As in `build_document`: the inspection reads only `/Info`, so fields stated only in XMP
-        // are filled in again after every full refresh.
-        for (field, value) in info_fields(&mut info, &editor.cos) {
-            if field.is_none() {
-                *field = value;
-            }
-        }
-        doc.info = info;
-        doc.fonts_stale = false;
-        let mut form = pdfcraft_forms::fields(&editor.cos);
-        xfa::mark_script_buttons(&editor.cos, &mut form);
-        doc.form = Arc::new(form);
-        if invalidate_markers {
-            doc.marker_scan = OnceLock::new();
-        }
-        if invalidate_links {
-            doc.links = OnceLock::new();
-        }
-        let signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
-        doc.display = display_bytes(Some(editor), &bytes);
-        doc.signatures = Arc::new(signatures);
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-        doc.bytes = bytes;
-        Ok(())
-    }
-
-    /// The bytes to write for Save: an incremental update of the file as opened/last saved,
-    /// with `/ModDate` stamped. Call `mark_saved` after writing them successfully.
-    ///
-    /// A file whose cross-reference data had to be rebuilt is written in full even when nothing
-    /// was edited: its bytes as opened are the damaged file, and this save is how the repair the
-    /// user was told about reaches the disk (#1937). Not a signed one: a full rewrite would
-    /// break its signatures, so with no edits it keeps its bytes, damage and all.
-    pub fn save_bytes(&self, id: DocId) -> Result<Arc<Vec<u8>>, EditError> {
-        let doc = self.get(id).ok_or(EditError::NoDocument)?;
-        let Some(editor) = doc.editor.as_ref() else { return Ok(doc.bytes.clone()) };
-        let on_saved = Arc::ptr_eq(editor.cos.bytes(), &editor.saved);
-        if !editor.cos.is_modified() && on_saved && (!editor.cos.reconstructed() || doc.is_signed()) {
-            return Ok(editor.saved.clone());
-        }
-        let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
-        // A restored snapshot can be based on an earlier revision. Append to the last saved
-        // file so that revision stays in the chain. A full rewrite (redaction, new encryption,
-        // a reconstructed file) still writes the current graph on its own.
-        let rewrite = editor.cos.full_save_required() || editor.cos.encryption_changed() || editor.cos.revisions().is_empty();
-        let cos = writable(&editor.cos)?;
-        guard(|| {
-            if on_saved || rewrite {
-                write_incremental(&cos, &opts)
-            } else {
-                let mut base = pdfcraft_cos::Document::open_with_password(editor.saved.clone(), editor.saved_keys.reopen.as_deref())?;
-                base.overlay_changes_from(&cos)?;
-                write_incremental(&base, &opts)
-            }
-        })
-        .map_err(EditError::Write)?
-        .map(Arc::new)
-        .map_err(|e| EditError::Write(e.to_string()))
-    }
-
-    /// A compact, garbage-collected rewrite (Save As ▸ "Optimized" / Reduce File Size groundwork).
-    pub fn save_full_bytes(&self, id: DocId) -> Result<Arc<Vec<u8>>, EditError> {
-        let doc = self.get(id).ok_or(EditError::NoDocument)?;
-        if doc.is_signed() {
-            return Err(EditError::Signed);
-        }
-        let editor = doc.editor.as_ref().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
-        let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
-        let cos = writable(&editor.cos)?;
-        guard(|| write_full(&cos, &opts)).map_err(EditError::Write)?.map(Arc::new).map_err(|e| EditError::Write(e.to_string()))
-    }
-
-    /// Check that `bytes`, from [`Self::save_bytes`] or [`Self::save_full_bytes`], reopen as this
-    /// document before they are written (#1698): [`Self::mark_saved`] only finds out after the
-    /// file has been replaced. Same error as `mark_saved`.
-    pub fn check_save(&self, id: DocId, bytes: &Arc<Vec<u8>>) -> Result<(), EditError> {
-        let doc = self.get(id).ok_or(EditError::NoDocument)?;
-        let Some(editor) = doc.editor.as_ref() else { return Ok(()) };
-        pdfcraft_cos::Document::open_with_password(bytes.clone(), editor.keys.reopen.as_deref()).map_err(|e| EditError::Reopen(e.to_string()))?;
-        pdfcraft_render::check_pages(bytes.clone(), doc.password.as_deref(), doc.info.pages.len()).map_err(|e| EditError::Reopen(e.to_string()))
-    }
-
-    /// Record a successful save of `bytes` (to `path`, if any): rebase editing on the saved file
-    /// so the next save appends only newer edits. Undo history is kept.
-    pub fn mark_saved(&mut self, id: DocId, bytes: Arc<Vec<u8>>, path: Option<String>) -> Result<(), EditError> {
-        let doc = self.doc_mut(id)?;
-        if let Some(editor) = doc.editor.as_mut() {
-            // An encrypted file needs the password it is protected with now (the owner
-            // password when known, so saving never downgrades this session's rights).
-            let keys = editor.keys.clone();
-            // The saved file carries no Password-field values (#3943); the open document keeps them.
-            let typed = pdfcraft_forms::password_values(&editor.cos);
-            editor.cos =
-                pdfcraft_cos::Document::open_with_password(bytes.clone(), keys.reopen.as_deref()).map_err(|e| EditError::Reopen(e.to_string()))?;
-            pdfcraft_forms::restore_password_values(&mut editor.cos, &typed).map_err(|e| EditError::Reopen(e.to_string()))?;
-            editor.saved = bytes;
-            editor.saved_keys = keys;
-            editor.unsaved_file = false;
-        }
-        if let Some(p) = path {
-            doc.name = std::path::Path::new(&p).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| p.clone());
-            doc.path = Some(p);
-        }
-        doc.dirty = false;
-        doc.generation += 1;
-        Self::refresh(doc).inspect_err(|_| Self::show_released(doc))
-    }
-
-    /// Enter the permissions (owner) password of a document opened with its user password,
-    /// lifting its restrictions for this session (Acrobat asks for it before changing security).
-    /// Not an edit: nothing is marked unsaved and there is no undo step. Undo and redo states
-    /// are unlocked as well, and saving keeps the rights. Unencrypted documents and documents
-    /// opened by the owner need nothing.
-    pub fn unlock(&mut self, id: DocId, password: &str) -> Result<(), EditError> {
-        let doc = self.doc_mut(id)?;
-        let editor = doc.editor.as_mut().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
-        if editor.cos.permissions().is_none_or(|p| p.owner) {
-            return Ok(());
-        }
-        editor.cos.unlock(password).map_err(|e| match e {
-            pdfcraft_cos::CosError::WrongPassword => EditError::WrongPassword,
-            other => EditError::Protection(other.to_string()),
-        })?;
-        // Saving a state that keeps the security it was opened with reopens it with the same
-        // passwords, so it reopens as owner.
-        let reopen_as_owner = |cos: &pdfcraft_cos::Document, keys: &mut Keys| {
-            if !cos.encryption_changed() {
-                keys.reopen = Some(password.to_owned());
-            }
-        };
-        reopen_as_owner(&editor.cos, &mut editor.keys);
-        // Other states with the same restricted access are unlocked too; states opened with
-        // other passwords (protection changed and saved since) stay as they are.
-        for (_, cos, keys, _) in editor.undo.iter_mut().chain(editor.redo.iter_mut()) {
-            if cos.permissions().is_some_and(|p| !p.owner) && cos.unlock(password).is_ok() {
-                reopen_as_owner(cos, keys);
-            }
-        }
-        Ok(())
-    }
-
-    /// File ▸ Revert: back to the last saved version (or the file as opened). Undo history is
-    /// cleared, as in Acrobat.
-    pub fn revert(&mut self, id: DocId) -> Result<(), EditError> {
-        let doc = self.doc_mut(id)?;
-        let editor = doc.editor.as_mut().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
-        let base = editor.saved.clone();
-        // The saved file opens with the passwords it was saved with. The current snapshot may
-        // be an older revision (undo past that save), so its own base is not the saved file.
-        let mut candidates = vec![editor.saved_keys.clone(), editor.keys.clone()];
-        candidates.extend(editor.undo.iter().rev().map(|s| s.2.clone()));
-        candidates.push(Keys::default());
-        let (cos, keys) = candidates
-            .into_iter()
-            .find_map(|k| pdfcraft_cos::Document::open_with_password(base.clone(), k.reopen.as_deref()).ok().map(|c| (c, k)))
-            .ok_or_else(|| EditError::Reopen("the saved file can't be opened".into()))?;
-        editor.cos = cos;
-        editor.keys = keys;
-        editor.undo.clear();
-        editor.redo.clear();
-        Self::adopt_keys(doc);
-        Self::sync_dirty(doc);
-        doc.generation += 1;
-        Self::refresh(doc).inspect_err(|_| Self::show_released(doc))
-    }
-
-    /// The document's file changed on disk (a LaTeX or Typst build rewrote it, #431): open
-    /// `bytes`, the file as it is now, in its place. Everything opening does runs again (XFA
-    /// layout and scripts, signatures, repairs), but the document keeps its id, name and path,
-    /// so its tab and view stay with it. Undo history goes, as with Revert. The password it was
-    /// opened with is tried; on any failure the document is left as it was.
-    pub fn reload(&mut self, id: DocId, bytes: Arc<Vec<u8>>) -> Result<(), OpenError> {
-        let old = self.docs.iter().position(|d| d.id == id).ok_or_else(|| OpenError::Invalid("the document is not open".into()))?;
-        let doc = &self.docs[old];
-        let (name, path, generation) = (doc.name.clone(), doc.path.clone(), doc.generation);
-        let password = doc.editor.as_ref().and_then(|e| e.keys.reopen.clone()).or_else(|| doc.password.clone());
-        let new_id = self.open(name, path, bytes, password.as_deref())?;
-        let at = self.docs.iter().position(|d| d.id == new_id).ok_or_else(|| OpenError::Invalid("the new version was not kept".into()))?;
-        let mut doc = self.docs.remove(at);
-        doc.id = id;
-        // How the document is shown is the reader's, not the file's: reading colours and hidden
-        // comments stay as they were (#3443). `open` built the renderer with the defaults.
-        if let Some(old) = self.docs.get(old)
-            && (doc.config.reading_colors != old.config.reading_colors || doc.config.hide_comments != old.config.hide_comments)
-        {
-            doc.config.reading_colors = old.config.reading_colors;
-            doc.config.hide_comments = old.config.hide_comments;
-            doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-        }
-        // Caches keyed by the edit generation (edit lines, images, measurements) must see a new
-        // one; there is nothing new to autosave.
-        doc.generation = generation + 1;
-        doc.snapshot_generation = doc.generation;
-        // `open` pushed the new version last, so the old one is still at `old`.
-        *self.docs.get_mut(old).ok_or_else(|| OpenError::Invalid("the document is not open".into()))? = doc;
-        Ok(())
-    }
-
-    /// The page count of another PDF (Replace Pages, Insert Pages dialogs).
-    pub fn page_count_of(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<usize, EditError> {
-        Ok(pdfcraft_organize::page_count(&open_source(name, bytes)?)?)
-    }
-
-    /// A new blank document (Create ▸ Blank page).
-    pub fn create_blank(&self, width: f64, height: f64, pages: usize) -> Result<Arc<Vec<u8>>, EditError> {
-        self.write_new(&pdfcraft_create::blank(width, height, pages)?)
-    }
-
-    /// A new document with one page per image (PNG, JPEG).
-    pub fn create_from_images(&self, images: &[(String, Vec<u8>)]) -> Result<Arc<Vec<u8>>, EditError> {
-        self.write_new(&pdfcraft_create::from_images(images)?)
-    }
-
-    /// Create image pages at embedded resolution or a fixed dpi, without resampling.
-    pub fn create_from_images_with_resolution(&self, images: &[(String, Vec<u8>)], resolution: ImageResolution) -> Result<Arc<Vec<u8>>, EditError> {
-        self.write_new(&pdfcraft_create::from_images_with_resolution(images, resolution)?)
-    }
-
-    /// A new document from plain text (US Letter, 11 pt Helvetica). Text Helvetica can't draw is
-    /// refused, naming the line and the character (never set as `?`).
-    pub fn create_from_text(&self, title: &str, text: &str) -> Result<Arc<Vec<u8>>, EditError> {
-        self.write_new(&pdfcraft_create::from_text(title, text, pdfcraft_create::LETTER, 11.0)?)
-    }
-
-    /// [`Self::create_from_text`] for a report PdfCraft writes from documents (comment summaries,
-    /// compare reports), which can quote any language: characters Helvetica can't draw are written
-    /// as `[U+XXXX]`, and the report's first line says so, rather than the report being refused.
-    fn create_report(&self, title: &str, text: &str) -> Result<Arc<Vec<u8>>, EditError> {
-        let (doc, _escaped) = pdfcraft_create::from_text_escaped(title, text, pdfcraft_create::LETTER, 11.0)?;
-        self.write_new(&doc)
-    }
-
-    /// Convert a file Create understands (an image or plain text) to PDF bytes; a PDF is checked
-    /// (it must open and allow copying pages) and returned as it is.
-    pub fn convert_to_pdf(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<(SourceKind, Arc<Vec<u8>>), EditError> {
-        let Some(kind) = source_kind(name, bytes) else {
-            return Err(EditError::Source(format!("{name}: this file type can't be converted; use a PDF, an image or a .txt file")));
-        };
-        let title = name.rsplit_once('.').map_or(name, |(s, _)| s);
-        // Image decoders read untrusted bytes: a panic in one must not take the app down.
-        let created = guard(|| match kind {
-            SourceKind::Pdf => open_source(name, bytes).map(|_| bytes.clone()),
-            SourceKind::Image => self.create_from_images(&[(name.to_string(), bytes.to_vec())]),
-            SourceKind::Text => self.create_from_text(title, &decode_text(bytes)),
-        })
-        .map_err(|_| EditError::Source(format!("{name}: the file could not be read")))?;
-        Ok((kind, created?))
-    }
-
-    /// A file for Combine as PDF bytes: an image or text file is converted; a PDF is returned as
-    /// it is, unchecked (Combine reads it itself, with its password), as is a file named .pdf
-    /// without a `%PDF-` header, which the reader may still open.
-    pub fn as_pdf(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<Arc<Vec<u8>>, EditError> {
-        let pdf = match source_kind(name, bytes) {
-            Some(SourceKind::Pdf) => true,
-            Some(SourceKind::Image | SourceKind::Text) => false,
-            None => name.to_ascii_lowercase().ends_with(".pdf"),
-        };
-        if pdf { Ok(bytes.clone()) } else { self.convert_to_pdf(name, bytes).map(|(_, pdf)| pdf) }
-    }
-
-    /// Reduce File Size: Acrobat's defaults (images above 225 ppi to 150 ppi, JPEG medium
-    /// quality; thumbnails dropped), identical resources merged, unused objects dropped, objects
-    /// packed into compressed object streams. Returns the bytes and how many objects were
-    /// merged. The open document is not changed (Acrobat saves the reduced copy as a new file).
-    pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc<Vec<u8>>, usize), EditError> {
-        let (bytes, report) = self.optimized_bytes(id, &optimize::Settings::default(), &[])?;
-        Ok((bytes, report.merged))
-    }
-
-    /// Optimize PDF ▸ Advanced optimization: `settings` for images and objects, plus Remove
-    /// Hidden Information's `discard` categories (user data). A full rewrite: signed documents
-    /// are refused. The open document is not changed. This is [`Self::optimize_job`] run in
-    /// place, without progress.
-    pub fn optimized_bytes(&self, id: DocId, settings: &optimize::Settings, discard: &[Hidden]) -> Result<(Arc<Vec<u8>>, OptimizeReport), EditError> {
-        self.optimize_job(id, settings, discard)?.run(|_| true)
-    }
-
-    /// Export comments and/or form data: XFDF and FDF carry either or both; XML, CSV and text
-    /// are form data only.
-    pub fn export_data(&self, id: DocId, format: DataFormat, comments: bool, fields: bool) -> Result<Vec<u8>, EditError> {
-        let doc = self.get(id).ok_or(EditError::NoDocument)?;
-        let cos = match doc.editor.as_ref() {
-            Some(e) => e.cos.clone(),
-            None => {
-                pdfcraft_cos::Document::open_with_password(doc.bytes.clone(), doc.password.as_deref()).map_err(|e| EditError::Write(e.to_string()))?
-            }
-        };
-        // An XFA form's data is its datasets, as Acrobat exports it: XML or an XDP.
-        let xfa = doc.info.xfa.is_some();
-        if format == DataFormat::Xdp && !xfa {
-            return Err(EditError::Invalid("XDP holds XFA form data; this document is not an XFA form (use .xml, .csv or .txt)".into()));
-        }
-        guard(|| match format {
-            DataFormat::Xfdf => Ok(pdfcraft_xfdf::export_xfdf(&cos, comments, fields, &doc.name).into_bytes()),
-            DataFormat::Fdf => pdfcraft_xfdf::export_fdf(&cos, comments, fields, &doc.name).map_err(|e| e.to_string()),
-            DataFormat::Xml | DataFormat::Xdp if xfa => {
-                pdfcraft_xfa::export_data(&cos, format == DataFormat::Xdp, &doc.name).map(String::into_bytes).map_err(|e| e.to_string())
-            }
-            other => Ok(pdfcraft_xfdf::export_data(&cos, other).into_bytes()),
-        })
-        .map_err(EditError::Write)?
-        .map_err(EditError::Write)
-    }
-
-    /// The print-ready PDF for `settings` (sheets laid out for the paper; see `pdfcraft-print`).
-    pub fn print_pdf(&self, id: DocId, settings: &print::Settings) -> Result<Vec<u8>, EditError> {
-        let doc = self.get(id).ok_or(EditError::NoDocument)?;
-        if !doc.allows_printing() {
-            return Err(EditError::NotPermitted("printing"));
-        }
-        // Table 22, bit 12 clear: only a low-level representation may be printed, so the pages
-        // always go as pictures, at no more than the low resolution.
-        let low_res = doc.permissions().is_some_and(|p| !p.print_high_quality()).then(|| print::Raster {
-            dpi: settings.raster.map_or(LOW_RESOLUTION_PRINT_DPI, |r| r.dpi.min(LOW_RESOLUTION_PRINT_DPI)),
-            grayscale: settings.raster.is_some_and(|r| r.grayscale),
-        });
-        // Print as image: the pages used become pictures first, then the picture document is
-        // imposed in their place (its page k is the k-th distinct source page used).
-        if let Some(raster) = low_res.as_ref().or(settings.raster.as_ref()) {
-            let mut distinct: Vec<usize> = Vec::new();
-            for &p in &settings.pages {
-                if !distinct.contains(&p) {
-                    distinct.push(p);
-                }
-            }
-            let bytes = print_raster::rasterize(doc, &distinct, raster, settings.content).map_err(EditError::Print)?;
-            let pictures = pdfcraft_cos::Document::open(Arc::new(bytes)).map_err(|e| EditError::Print(e.to_string()))?;
-            let remapped = print::Settings {
-                pages: settings.pages.iter().map(|p| distinct.iter().position(|d| d == p).unwrap_or(0)).collect(),
-                content: print::Content::Document,
-                raster: None,
-                ..settings.clone()
-            };
-            return pdfcraft_print::impose(&pictures, &remapped).map_err(|e| EditError::Print(e.to_string()));
-        }
-        let mut cos = match doc.editor.as_ref() {
-            Some(e) => e.cos.clone(),
-            None => {
-                pdfcraft_cos::Document::open_with_password(doc.bytes.clone(), doc.password.as_deref()).map_err(|e| EditError::Write(e.to_string()))?
-            }
-        };
-        // #3046: the layers print as they are shown. Once the Layers panel (or a set-layer
-        // action) has changed one, the print copy's default configuration says which are on, so a
-        // hidden layer stays off on paper too; untouched, the document's own configuration prints.
-        if !doc.config.layers.is_empty() {
-            set_default_layer_state(&mut cos, &doc.info.layers);
-        }
-        pdfcraft_print::impose(&cos, settings).map_err(|e| EditError::Print(e.to_string()))
-    }
-
-    /// For each page, whether its text mostly runs bottom-to-top ([`pdfcraft_print::text_reads_up`]);
-    /// only `pages` are read, the others are `false`.
-    pub fn print_text_up(&self, id: DocId, pages: &[usize]) -> Vec<bool> {
-        let Some(doc) = self.get(id) else { return Vec::new() };
-        let cos = match doc.editor.as_ref() {
-            Some(e) => e.cos.clone(),
-            None => match pdfcraft_cos::Document::open_with_password(doc.bytes.clone(), doc.password.as_deref()) {
-                Ok(c) => c,
-                Err(_) => return Vec::new(),
-            },
-        };
-        (0..doc.info.pages.len()).map(|i| pages.contains(&i) && pdfcraft_print::text_reads_up(&cos, i)).collect()
-    }
-
-    /// Combine whole files, in order, into new PDF bytes (one bookmark per file).
-    pub fn combine(&self, sources: &[(String, Arc<Vec<u8>>)]) -> Result<Arc<Vec<u8>>, EditError> {
-        let docs = sources.iter().map(|(n, b)| open_source(n, b)).collect::<Result<Vec<_>, _>>()?;
-        let named: Vec<(&str, &pdfcraft_cos::Document)> = sources.iter().map(|(n, _)| n.as_str()).zip(docs.iter()).collect();
-        let out = pdfcraft_organize::combine(&named)?;
-        self.write_new(&out)
-    }
-
-    /// Combine Files with a page range per file ("1-3, 6"; `None` or empty for all pages).
-    pub fn combine_ranges(&self, sources: &[CombineSource]) -> Result<Arc<Vec<u8>>, EditError> {
-        self.combine_unlocked(sources, &[])
-    }
-
-    /// Combine sources one at a time, in order (Create ▸ Multiple files), to the same result as
-    /// [`Self::combine_ranges`]. Each item is a source's bookmark title, its PDF bytes (see
-    /// [`Self::convert_to_pdf`]) and its page range (`None` for all pages). Items are pulled one at a
-    /// time: a source is opened, its pages are copied into the result, and its bytes are released
-    /// before the next item is read. So the number of sources is not limited, and one source's
-    /// document is held at a time. An item's error stops the combine and is returned as it is.
-    /// `Ok(None)` when there are no sources.
-    pub fn combine_each<I, E>(&self, sources: I) -> Result<Option<Arc<Vec<u8>>>, E>
-    where
-        I: IntoIterator<Item = Result<CombineSource, E>>,
-        E: From<EditError>,
-    {
-        let mut combiner = pdfcraft_organize::Combiner::new();
-        let mut added = false;
-        for source in sources {
-            let (title, bytes, range) = source?;
-            let doc = open_source(&title, &bytes)?;
-            let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
-            let pages = match range {
-                Some(r) => {
-                    let n = pdfcraft_organize::page_count(&doc).map_err(EditError::from)?;
-                    let p = pdfcraft_print::select_pages(n, Some(r), &[], pdfcraft_print::Subset::All, false)
-                        .map_err(|e| EditError::Print(format!("{title}: {e}")))?;
-                    Some(p)
-                }
-                None => None,
-            };
-            combiner.add(&title, &doc, pages.as_deref()).map_err(EditError::from)?;
-            added = true;
-        }
-        if !added {
-            return Ok(None);
-        }
-        let out = combiner.finish().map_err(EditError::from)?;
-        Ok(Some(self.write_new(&out)?))
-    }
-
-    /// [`Self::combine_ranges`] with the password each encrypted source is opened with, by
-    /// position (missing or `None`: no password). The result is not encrypted.
-    pub fn combine_unlocked(&self, sources: &[CombineSource], passwords: &[Option<&str>]) -> Result<Arc<Vec<u8>>, EditError> {
-        Ok(self.combine_unlocked_reporting(sources, passwords, pdfcraft_organize::FieldConflicts::Rename)?.bytes)
-    }
-
-    /// The pre-flight over byte sources: what combining them, in order, would rename in each one
-    /// (whole files; page ranges are the combine's to apply). A source that cannot be opened
-    /// previews as nothing — its row already says why it cannot be combined.
-    pub fn combine_field_conflicts(&self, sources: &[CombineSource], passwords: &[Option<&str>]) -> Vec<Vec<(String, String)>> {
-        let docs: Vec<Option<pdfcraft_cos::Document>> =
-            sources.iter().enumerate().map(|(i, (n, b, _))| open_source_with(n, b, passwords.get(i).copied().flatten()).ok()).collect();
-        let refs: Vec<&pdfcraft_cos::Document> = docs.iter().filter_map(Option::as_ref).collect();
-        let mut opened = pdfcraft_organize::combine_field_conflicts(&refs).into_iter();
-        // One preview per source, in step with it: a file that cannot be opened has none.
-        docs.iter().map(|d| if d.is_some() { opened.next().unwrap_or_default() } else { Default::default() }).collect()
-    }
-
-    /// [`Self::combine_unlocked`] reporting what the conflict resolution renamed.
-    pub fn combine_unlocked_reporting(
-        &self,
-        sources: &[CombineSource],
-        passwords: &[Option<&str>],
-        field_conflicts: pdfcraft_organize::FieldConflicts,
-    ) -> Result<Combined, EditError> {
-        let docs = sources
-            .iter()
-            .enumerate()
-            .map(|(i, (n, b, _))| open_source_with(n, b, passwords.get(i).copied().flatten()))
-            .collect::<Result<Vec<_>, _>>()?;
-        let mut pages = Vec::with_capacity(docs.len());
-        for ((name, _, range), d) in sources.iter().zip(&docs) {
-            let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
-            pages.push(match range {
-                Some(r) => {
-                    let n = pdfcraft_organize::page_count(d)?;
-                    let p = pdfcraft_print::select_pages(n, Some(r), &[], pdfcraft_print::Subset::All, false)
-                        .map_err(|e| EditError::Print(format!("{name}: {e}")))?;
-                    Some(p)
-                }
-                None => None,
-            });
-        }
-        let named: Vec<(&str, &pdfcraft_cos::Document, Option<&[usize]>)> =
-            sources.iter().zip(docs.iter()).zip(&pages).map(|(((n, _, _), d), p)| (n.as_str(), d, p.as_deref())).collect();
-        let out = pdfcraft_organize::combine_selected_with(&named, field_conflicts)?;
-        let bytes = self.write_new(&out.doc)?;
-        Ok(Combined { bytes, renamed_fields: out.renamed_fields })
-    }
-
-    /// [`Self::combine_unlocked`] where sources with the same `groups` key (by position) are one
-    /// file split into several runs placed apart: each file is opened and copied once, so it keeps
-    /// one bookmark, its links between its own pages, its fields and its attachments whole (see
-    /// `pdfcraft_organize::combine_grouped`). A group's later sources use its first source's bytes
-    /// and password; a source without a key is a file of its own.
-    pub fn combine_grouped(&self, sources: &[CombineSource], groups: &[u64], passwords: &[Option<&str>]) -> Result<Arc<Vec<u8>>, EditError> {
-        Ok(self.combine_grouped_reporting(sources, groups, passwords, pdfcraft_organize::FieldConflicts::Rename)?.bytes)
-    }
-
-    /// [`Self::combine_grouped`] reporting what the conflict resolution renamed.
-    pub fn combine_grouped_reporting(
-        &self,
-        sources: &[CombineSource],
-        groups: &[u64],
-        passwords: &[Option<&str>],
-        field_conflicts: pdfcraft_organize::FieldConflicts,
-    ) -> Result<Combined, EditError> {
-        let (mut keys, mut docs, mut file): (Vec<Option<u64>>, Vec<pdfcraft_cos::Document>, Vec<usize>) = (Vec::new(), Vec::new(), Vec::new());
-        for (i, (name, bytes, _)) in sources.iter().enumerate() {
-            let key = groups.get(i).copied();
-            let known = key.and_then(|k| keys.iter().position(|g| *g == Some(k)));
-            let at = match known {
-                Some(at) => at,
-                None => {
-                    docs.push(open_source_with(name, bytes, passwords.get(i).copied().flatten())?);
-                    keys.push(key);
-                    docs.len() - 1
-                }
-            };
-            file.push(at);
-        }
-        let mut pages = Vec::with_capacity(sources.len());
-        for ((name, _, range), at) in sources.iter().zip(&file) {
-            let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
-            let Some(d) = docs.get(*at) else { return Err(EditError::Write(format!("{name}: not opened"))) };
-            pages.push(match range {
-                Some(r) => {
-                    let n = pdfcraft_organize::page_count(d)?;
-                    let p = pdfcraft_print::select_pages(n, Some(r), &[], pdfcraft_print::Subset::All, false)
-                        .map_err(|e| EditError::Print(format!("{name}: {e}")))?;
-                    Some(p)
-                }
-                None => None,
-            });
-        }
-        let mut runs: Vec<pdfcraft_organize::Run<'_>> = Vec::with_capacity(sources.len());
-        for (((name, _, _), at), p) in sources.iter().zip(&file).zip(&pages) {
-            let Some(d) = docs.get(*at) else { return Err(EditError::Write(format!("{name}: not opened"))) };
-            runs.push((*at, name.as_str(), d, p.as_deref()));
-        }
-        let out = pdfcraft_organize::combine_grouped_with(&runs, field_conflicts)?;
-        let bytes = self.write_new(&out.doc)?;
-        Ok(Combined { bytes, renamed_fields: out.renamed_fields })
-    }
-
-    /// New PDF bytes containing copies of `pages` of the document (Extract Pages).
-    pub fn extract(&self, id: DocId, pages: &[usize]) -> Result<Arc<Vec<u8>>, EditError> {
-        let src = self.cos(id)?;
-        if src.permissions().is_some_and(|p| !p.assemble()) {
-            return Err(EditError::NotPermitted("extracting pages"));
-        }
-        let out = pdfcraft_organize::extract_pages(src, pages)?;
-        self.write_new(&out)
-    }
-
-    /// Split the document into several new PDFs.
-    pub fn split(&self, id: DocId, by: &pdfcraft_organize::SplitBy) -> Result<Vec<SplitPart>, EditError> {
-        let src = self.cos(id)?;
-        if src.permissions().is_some_and(|p| !p.assemble()) {
-            return Err(EditError::NotPermitted("splitting the document"));
-        }
-        let n = pdfcraft_organize::page_count(src)?;
-        pdfcraft_organize::split_ranges(n, by)
-            .into_iter()
-            .map(|r| {
-                let doc = pdfcraft_organize::extract_pages(src, &r.clone().collect::<Vec<_>>())?;
-                Ok((r.start + 1, r.end, self.write_new(&doc)?))
-            })
-            .collect()
-    }
-
-    /// Split into parts of at most `max_bytes` each (Acrobat's "File size"): pages are taken in
-    /// order while their size (as single-page files, an over-estimate because shared fonts and
-    /// images count once per part) fits; a page larger than the limit is a part of its own.
-    pub fn split_by_size(&self, id: DocId, max_bytes: usize) -> Result<Vec<SplitPart>, EditError> {
-        let src = self.cos(id)?;
-        if src.permissions().is_some_and(|p| !p.assemble()) {
-            return Err(EditError::NotPermitted("splitting the document"));
-        }
-        let n = pdfcraft_organize::page_count(src)?;
-        let mut cuts = Vec::new();
-        let mut used = 0usize;
-        for p in 0..n {
-            let size = self.write_unchecked(&pdfcraft_organize::extract_pages(src, &[p])?)?.len();
-            if used > 0 && used + size > max_bytes {
-                cuts.push(p);
-                used = 0;
-            }
-            used += size;
-        }
-        self.split(id, &pdfcraft_organize::SplitBy::Before(cuts))
-    }
-
-    /// Web addresses in the text of every page (Create links from URLs): (page, one rectangle
-    /// per line in user space, URI). Text that already has a link over it is skipped.
-    pub fn find_urls(&self, id: DocId) -> Vec<(usize, Vec<[f64; 4]>, String)> {
-        let Some(doc) = self.get(id) else { return Vec::new() };
-        let config = RenderConfig { password: doc.password.as_deref().map(Arc::from), ..Default::default() };
-        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), config);
-        let mut out = Vec::new();
-        for page in 0..doc.info.pages.len() {
-            let res = r.render(pdfcraft_render::RenderRequest { page, kind: pdfcraft_render::RequestKind::Text, scale: 1.0, ..Default::default() });
-            let Some(text) = res.text else { continue };
-            let found: std::cell::RefCell<Vec<(std::ops::Range<usize>, String)>> = Default::default();
-            let hits = text.find_with(|chars| {
-                let urls = pdfcraft_annot::links::find_urls(chars);
-                let ranges = urls.iter().map(|u| u.0.clone()).collect();
-                *found.borrow_mut() = urls;
-                ranges
-            });
-            for (glyphs, (_, uri)) in hits.into_iter().zip(found.into_inner()) {
-                let rects: Vec<[f64; 4]> = text
-                    .line_rects(glyphs)
-                    .into_iter()
-                    .map(|v| {
-                        let q = doc.info.pages[page].view_rect_to_quad(v);
-                        let xs = [q[0], q[2], q[4], q[6]];
-                        let ys = [q[1], q[3], q[5], q[7]];
-                        [
-                            xs.iter().copied().fold(f64::MAX, f64::min),
-                            ys.iter().copied().fold(f64::MAX, f64::min),
-                            xs.iter().copied().fold(f64::MIN, f64::max),
-                            ys.iter().copied().fold(f64::MIN, f64::max),
-                        ]
-                    })
-                    .filter(|r| {
-                        !doc.links().iter().any(|l| l.page == page && l.rect[0] < r[2] && r[0] < l.rect[2] && l.rect[1] < r[3] && r[1] < l.rect[3])
-                    })
-                    .collect();
-                if !rects.is_empty() {
-                    out.push((page, rects, uri));
-                }
-            }
-        }
-        out
-    }
-
-    /// A page of the bookmark list in outline order: up to `limit` bookmarks from position `offset`.
-    /// The document's own structure is read for it, so every bookmark can be reached by paging.
-    pub fn bookmark_page(&self, id: DocId, offset: usize, limit: usize) -> Option<BookmarkPage> {
-        let doc = self.get(id)?;
-        if let Some(editor) = doc.editor.as_ref() {
-            let page = pdfcraft_organize::bookmark_page(&editor.cos, offset, limit);
-            let rows = page
-                .bookmarks
-                .into_iter()
-                .map(|b| {
-                    let view = b.view.map_or_else(Default::default, |(kind, numbers)| {
-                        let numbers: Vec<Option<f32>> = numbers.iter().map(|n| n.map(|n| n as f32)).collect();
-                        pdfcraft_render::DestView::from_operands(Some(&kind), &numbers)
-                    });
-                    BookmarkRow { path: b.path, title: b.title, open: b.open, page: b.page, view, color: b.color, italic: b.italic, bold: b.bold }
-                })
-                .collect();
-            return Some(BookmarkPage { rows, next: page.next, truncated: false });
-        }
-        let all = outline_rows(&doc.info.outline);
-        let end = offset.saturating_add(limit);
-        let rows = all.iter().skip(offset).take(limit).cloned().collect();
-        Some(BookmarkPage { rows, next: (end < all.len()).then_some(end), truncated: doc.info.outline_more })
-    }
-
-    /// Top-level bookmarks as split points: (first page of each part, its bookmark's title).
-    pub fn bookmark_splits(&self, id: DocId) -> Vec<(usize, String)> {
-        let Some(doc) = self.get(id) else { return Vec::new() };
-        let top: Vec<(Option<usize>, String)> = match doc.editor.as_ref() {
-            Some(editor) => pdfcraft_organize::top_level_bookmarks(&editor.cos).into_iter().map(|b| (b.page, b.title)).collect(),
-            None => doc.info.outline.iter().map(|o| (o.page, o.title.clone())).collect(),
-        };
-        let mut out: Vec<(usize, String)> = top.into_iter().filter_map(|(page, title)| Some((page?, title))).collect();
-        out.sort_by_key(|x| x.0);
-        out.dedup_by_key(|x| x.0);
-        out
-    }
-
-    /// Open freshly created bytes (combine / extract) as a new, unsaved document.
-    pub fn open_new(&mut self, name: impl Into<String>, bytes: Arc<Vec<u8>>) -> Result<DocId, OpenError> {
-        let id = self.open(name, None, bytes, None)?;
-        if let Some(d) = self.docs.iter_mut().find(|d| d.id == id) {
-            d.dirty = true;
-            if let Some(e) = d.editor.as_mut() {
-                e.unsaved_file = true;
-            }
-            // Unsaved work with no edit yet still needs its first recovery snapshot.
-            d.generation += 1;
-        }
-        Ok(id)
-    }
-
-    fn cos(&self, id: DocId) -> Result<&pdfcraft_cos::Document, EditError> {
-        let doc = self.get(id).ok_or(EditError::NoDocument)?;
-        doc.editor.as_ref().map(|e| &e.cos).ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))
-    }
-
-    /// A new file (Combine, Extract, Split, Create) as bytes, checked like a save before anyone
-    /// writes it (#1698, #2166): it reopens, and shows the pages it was built from.
-    fn write_new(&self, doc: &pdfcraft_cos::Document) -> Result<Arc<Vec<u8>>, EditError> {
-        let bytes = self.write_unchecked(doc)?;
-        let expected = pdfcraft_organize::page_count(doc)?;
-        pdfcraft_cos::Document::open(bytes.clone()).map_err(|e| EditError::Reopen(e.to_string()))?;
-        pdfcraft_render::check_pages(bytes.clone(), None, expected).map_err(|e| EditError::Reopen(e.to_string()))?;
-        Ok(bytes)
-    }
-
-    /// [`Self::write_new`] without the check, for bytes nobody writes: measuring a part's size.
-    /// Like a save, a new file never carries a typed Password-field value (#3926): Extract and
-    /// Split copy the fields of the pages they take.
-    fn write_unchecked(&self, doc: &pdfcraft_cos::Document) -> Result<Arc<Vec<u8>>, EditError> {
-        let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
-        let doc = writable(doc)?;
-        write_full(&doc, &opts).map(Arc::new).map_err(|e| EditError::Write(e.to_string()))
-    }
-
-    /// Whether a changed document still needs a recovery snapshot. This does not consume it.
-    pub fn has_pending_autosave(&self) -> bool {
-        self.docs.iter().any(|d| d.dirty && d.generation != d.snapshot_generation)
-    }
-
-    /// Documents with unsaved changes made since the last call: their current working file,
-    /// for crash recovery. Encrypted documents stay encrypted in the snapshot.
-    pub fn autosave_snapshots(&mut self) -> Vec<RecoverySnapshot> {
-        let mut out = Vec::new();
-        for d in &mut self.docs {
-            if d.dirty && d.generation != d.snapshot_generation {
-                // The working bytes hold typed Password-field values (#3926): a recovery file is
-                // written from a copy without them, and none is written if that copy fails.
-                let bytes = match d.editor.as_ref().filter(|e| pdfcraft_forms::has_password_values(&e.cos)) {
-                    Some(e) => match writable(&e.cos)
-                        .and_then(|c| write_incremental(&c, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string())))
-                    {
-                        Ok(b) => Arc::new(b),
-                        Err(_) => continue,
-                    },
-                    None => d.bytes.clone(),
-                };
-                d.snapshot_generation = d.generation;
-                out.push(RecoverySnapshot {
-                    doc: d.id,
-                    name: d.name.clone(),
-                    path: d.path.clone(),
-                    bytes,
-                    encrypted: d.info.encrypted || d.editor.as_ref().is_some_and(|e| e.cos.security().is_some()),
-                });
-            }
-        }
-        out
-    }
-
-    /// Mark a document opened from a recovery file: it has unsaved changes and belongs at
-    /// `path` (where Save writes), as when the session ended.
-    pub fn mark_recovered(&mut self, id: DocId, path: Option<String>) {
-        if let Some(d) = self.docs.iter_mut().find(|d| d.id == id) {
-            d.path = path;
-            d.dirty = true;
-            if let Some(e) = d.editor.as_mut() {
-                e.unsaved_file = true;
-            }
-            d.generation += 1;
-            d.snapshot_generation = d.generation; // its bytes are already in the recovery store
-        }
-    }
-
-    /// Show or hide a layer (optional content group) for viewing. Returns `true` if it changed;
-    /// callers must drop cached rasters and text for the document.
-    pub fn set_layer_visible(&mut self, id: DocId, layer: usize, visible: bool) -> bool {
-        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
-        let Some(l) = doc.info.layers.get_mut(layer) else { return false };
-        if l.visible == visible {
-            return false;
-        }
-        l.visible = visible;
-        use_layer_choices(doc);
-        true
-    }
-
-    /// Run a set-layer-visibility action (`SetOCGState`): apply `changes` in order, naming each
-    /// layer by its optional content group; groups that aren't layers are skipped. With
-    /// `preserve_rb`, a layer turned on turns off the other layers of its radio-button groups.
-    /// Returns `true` if any layer changed; callers must drop cached rasters and text for the
-    /// document, as for [`Self::set_layer_visible`].
-    pub fn set_layer_state(&mut self, id: DocId, changes: &[(LayerOp, (u32, u16))], preserve_rb: bool) -> bool {
-        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
-        if !apply_layer_state(&mut doc.info.layers, &doc.info.layer_groups, changes, preserve_rb) {
-            return false;
-        }
-        use_layer_choices(doc);
-        true
-    }
-
-    /// Show each layer as the file opens (Acrobat's Layers ▸ Reset to Initial Visibility). Returns
-    /// `true` if any layer changed; callers must drop cached rasters and text for the document,
-    /// as for [`Self::set_layer_visible`].
-    pub fn reset_layers(&mut self, id: DocId) -> bool {
-        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
-        let mut changed = false;
-        for l in &mut doc.info.layers {
-            changed |= l.visible != l.initial;
-            l.visible = l.initial;
-        }
-        if changed {
-            use_layer_choices(doc);
-        }
-        changed
-    }
-
-    /// Hide or show every comment on the page (Acrobat's Comments ▸ Hide all comments). Form
-    /// fields and links still draw. Returns whether anything changed.
-    pub fn set_hide_comments(&mut self, id: DocId, hide: bool) -> bool {
-        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
-        if doc.config.hide_comments == hide {
-            return false;
-        }
-        doc.config.hide_comments = hide;
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-        doc.generation += 1;
-        true
-    }
-
-    /// Set the document's reading colours (Acrobat's Replace Document Colors). Returns whether
-    /// anything changed; callers must drop cached rasters and text for the document.
-    pub fn set_reading_colors(&mut self, id: DocId, colors: ReadingColors) -> bool {
-        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
-        if doc.config.reading_colors == colors {
-            return false;
-        }
-        doc.config.reading_colors = colors;
-        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-        doc.generation += 1;
-        true
-    }
-
-    /// The document's reading-colours setting; `None` when no such document is open.
-    pub fn reading_colors(&self, id: DocId) -> Option<ReadingColors> {
-        Some(self.get(id)?.config.reading_colors)
-    }
-
-    /// How the document's pages are drawn for viewing: its password and view settings (layer
-    /// visibility, hidden comments, reading colours). `None` when no such document is open.
-    pub fn render_config(&self, id: DocId) -> Option<RenderConfig> {
-        Some(self.get(id)?.config.clone())
-    }
-
-    /// Acrobat's Summarize Comments ("Comments only" layout): a new PDF listing every comment
-    /// with its number, author, type, date, text and replies, grouped by page.
-    pub fn summarize_comments(&self, id: DocId, sort: SummarySort) -> Result<Arc<Vec<u8>>, EditError> {
-        let doc = self.get(id).ok_or(EditError::NoDocument)?;
-        let text = comment_summary(&doc.name, &doc.info.annotations, sort);
-        self.create_report(&format!("Summary of Comments on {}", doc.name), &text)
-    }
-
-    /// The certificates trusted for signing.
-    pub fn trusted_certificates(&self) -> &[pdfcraft_sign::Certificate] {
-        &self.trust.certs
-    }
-
-    /// Replace the trusted certificates, revalidate every open document's signatures,
-    /// and rebuild its display copy and renderer to match (working file untouched,
-    /// generation/dirty unchanged: trust alone is not an edit).
-    pub fn set_trusted_certificates(&mut self, certs: Vec<pdfcraft_sign::Certificate>) {
-        self.trust = Arc::new(TrustStore { certs });
-        for doc in &mut self.docs {
-            doc.trust = self.trust.clone();
-            let Some(editor) = doc.editor.as_mut() else { continue };
-            // Keep verdict refresh and renderer refresh together. Viewer caches are
-            // invalidated by the UI trust path; trust alone changes no document artwork.
-            let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &doc.bytes, &doc.trust, &doc.sig_cache) };
-            doc.display = display_bytes(Some(editor), &doc.bytes);
-            doc.signatures = Arc::new(signatures);
-            doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
-        }
-    }
-
-    /// The signing time as a PDF date in local time with its offset (`D:…+02'00'`).
-    pub fn signing_date(&self) -> String {
-        let offset = self.local_offset();
-        let local = pdfcraft_cos::pdf_date(self.now().unwrap_or(0) + offset);
-        let stamp = local.trim_end_matches('Z');
-        if offset == 0 {
-            return format!("{stamp}Z");
-        }
-        let (sign, m) = if offset < 0 { ('-', -offset / 60) } else { ('+', offset / 60) };
-        format!("{stamp}{sign}{:02}'{:02}'", m / 60, m % 60)
-    }
-
-    /// Sign the document's current state with `id` (Use a certificate ▸ Digitally sign). Returns
-    /// the signed file; the caller saves it and then calls [`Session::mark_signed`]. An empty
-    /// `opts.date` takes the session clock.
-    pub fn sign(&self, doc: DocId, id: &pdfcraft_sign::DigitalId, mut opts: SignOptions) -> Result<Arc<Vec<u8>>, EditError> {
-        let d = self.get(doc).ok_or(EditError::NoDocument)?;
-        // Encrypted documents are signed under their permissions (the signer checks them).
-        let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
-        if opts.date.is_empty() {
-            opts.date = self.signing_date();
-        }
-        // A typed Password-field value is not signed into the file (#3926), as it isn't saved.
-        let cos = writable(&editor.cos)?;
-        Ok(Arc::new(pdfcraft_sign::sign(&cos, id, &opts)?))
-    }
-
-    /// [`Session::sign`], embedding an RFC 3161 signature timestamp (PAdES B-T) produced by
-    /// `tsa`. The transport lives with the caller; the engine never opens a socket.
-    pub fn sign_with_timestamp(
-        &self,
-        doc: DocId,
-        id: &pdfcraft_sign::DigitalId,
-        mut opts: SignOptions,
-        tsa: &dyn pdfcraft_sign::TimestampAuthority,
-    ) -> Result<Arc<Vec<u8>>, EditError> {
-        let d = self.get(doc).ok_or(EditError::NoDocument)?;
-        let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
-        if opts.date.is_empty() {
-            opts.date = self.signing_date();
-        }
-        let cos = writable(&editor.cos)?;
-        let signed = Arc::new(pdfcraft_sign::sign_with_timestamp(&cos, id, &opts, tsa)?);
-        // Checked like a save before anyone writes it (#2166).
-        self.check_save(doc, &signed)?;
-        Ok(signed)
-    }
-
-    /// Append a standalone document timestamp (RFC 3161, `/ETSI.RFC3161`) covering the file's
-    /// current state. An empty `date` takes the session clock; the transport is the caller's.
-    pub fn timestamp_document(&self, doc: DocId, tsa: &dyn pdfcraft_sign::TimestampAuthority, date: String) -> Result<Arc<Vec<u8>>, EditError> {
-        let d = self.get(doc).ok_or(EditError::NoDocument)?;
-        let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
-        let date = if date.is_empty() { self.signing_date() } else { date };
-        let cos = writable(&editor.cos)?;
-        let stamped = Arc::new(pdfcraft_sign::timestamp_document(&cos, tsa, &date)?);
-        self.check_save(doc, &stamped)?;
-        Ok(stamped)
-    }
-
-    /// Embed revocation evidence into the catalog's `/DSS` with `/VRI` entries per signature
-    /// (PAdES B-LT): an incremental update that never rewrites signed bytes.
-    pub fn embed_ltv(&self, doc: DocId, evidence: &pdfcraft_sign::dss::Evidence) -> Result<Arc<Vec<u8>>, EditError> {
-        let d = self.get(doc).ok_or(EditError::NoDocument)?;
-        let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
-        let cos = writable(&editor.cos)?;
-        let embedded = Arc::new(pdfcraft_sign::dss::embed(&cos, evidence)?);
-        self.check_save(doc, &embedded)?;
-        Ok(embedded)
-    }
-
-    /// Record that the signed file `bytes` was saved (to `path`): like [`Session::mark_saved`],
-    /// and the edit history before signing is dropped (signing can't be undone).
-    pub fn mark_signed(&mut self, id: DocId, bytes: Arc<Vec<u8>>, path: Option<String>) -> Result<(), EditError> {
-        self.mark_saved(id, bytes, path)?;
-        let doc = self.doc_mut(id)?;
-        if let Some(e) = doc.editor.as_mut() {
-            e.undo.clear();
-            e.redo.clear();
-        }
-        Ok(())
-    }
-
-    pub fn close(&mut self, id: DocId) {
-        self.docs.retain(|d| d.id != id);
-    }
-
-    pub fn get(&self, id: DocId) -> Option<&Document> {
-        self.docs.iter().find(|d| d.id == id)
-    }
-
-    /// Read document `id`'s font list again if content edits since the last full inspection may
-    /// have changed it (Document Properties ▸ Fonts, `doc_info`). A no-op otherwise.
-    pub fn refresh_fonts(&mut self, id: DocId) {
-        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id && d.fonts_stale) else { return };
-        if let Ok(info) = pdfcraft_render::inspect(doc.bytes.clone(), doc.password.as_deref()) {
-            doc.info.fonts = info.fonts;
-        }
-        doc.fonts_stale = false;
-    }
-
-    pub fn docs(&self) -> &[Document] {
-        &self.docs
-    }
-}
-
-/// A picture for a watermark or background (Acrobat: Source ▸ File): an image, or `page`
-/// (0-based) of a PDF.
-#[derive(Clone, Debug, PartialEq)]
-pub struct MarkFile {
-    pub name: String,
-    pub bytes: Arc<Vec<u8>>,
-    pub page: usize,
-}
-
-/// Embed an image that is placed on a page, turned the way its EXIF Orientation says.
-fn embed_image(
-    doc: &mut pdfcraft_cos::Document,
-    name: &str,
-    bytes: &[u8],
-) -> Result<(pdfcraft_cos::ObjRef, (f64, f64)), pdfcraft_create::CreateError> {
-    pdfcraft_create::image_xobject(doc, name, bytes)
-}
-
-/// The largest box of `w`:`h` shape inside `rect`, centred in it: a stamp's picture keeps its
-/// shape in a box of any other shape. A box that is already that shape (to within rounding) is
-/// kept exactly, so callers that size it themselves get their box back. An empty or non-finite
-/// box, or a picture with no size, is returned as it is, for the annotation's own check to refuse.
-fn fit_picture(rect: [f64; 4], w: f64, h: f64) -> [f64; 4] {
-    if !rect.iter().all(|v| v.is_finite()) {
-        return rect;
-    }
-    let rect = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
-    let (bw, bh) = (rect[2] - rect[0], rect[3] - rect[1]);
-    let usable = |v: f64| v.is_finite() && v > 0.0;
-    if !(usable(bw) && usable(bh) && usable(w) && usable(h)) {
-        return rect;
-    }
-    let k = (bw / w).min(bh / h);
-    let (fw, fh) = (w * k, h * k);
-    if (fw - bw).abs() <= bw * 1e-9 && (fh - bh).abs() <= bh * 1e-9 {
-        return rect;
-    }
-    let (cx, cy) = (rect[0] + bw / 2.0, rect[1] + bh / 2.0);
-    [cx - fw / 2.0, cy - fh / 2.0, cx + fw / 2.0, cy + fh / 2.0]
-}
-
-/// Bring a mark's picture into `doc`: a PDF page as a form XObject, or an image.
-fn mark_source(doc: &mut pdfcraft_cos::Document, f: &MarkFile) -> Result<pdfcraft_edit::MarkSource, EditError> {
-    let head = &f.bytes[..f.bytes.len().min(1024)];
-    if head.windows(5).any(|w| w == b"%PDF-") {
-        let src = pdfcraft_cos::Document::open(f.bytes.clone()).map_err(|e| EditError::Source(format!("{}: {e}", f.name)))?;
-        let (xobject, size) = pdfcraft_organize::page_as_form(doc, &src, f.page)?;
-        Ok(pdfcraft_edit::MarkSource { xobject, size, image: false })
-    } else {
-        let (xobject, size) = embed_image(doc, &f.name, &f.bytes)?;
-        Ok(pdfcraft_edit::MarkSource { xobject, size, image: true })
-    }
-}
-
-/// What Optimize PDF did.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct OptimizeReport {
-    pub optimize: optimize::Report,
-    /// Identical objects merged.
-    pub merged: usize,
-    /// Remove Hidden Information categories discarded, with counts.
-    pub discarded: Vec<(Hidden, usize)>,
-}
-
-/// Order of Summarize Comments.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub enum SummarySort {
-    #[default]
-    Page,
-    Author,
-    Date,
-    Type,
-}
-
-impl SummarySort {
-    pub const ALL: [SummarySort; 4] = [SummarySort::Page, SummarySort::Author, SummarySort::Date, SummarySort::Type];
-    pub fn name(self) -> &'static str {
-        match self {
-            SummarySort::Page => "Page",
-            SummarySort::Author => "Author",
-            SummarySort::Date => "Date",
-            SummarySort::Type => "Type",
-        }
-    }
-    pub fn parse(s: &str) -> Option<SummarySort> {
-        Self::ALL.into_iter().find(|k| k.name().eq_ignore_ascii_case(s))
-    }
-}
-
-/// Acrobat's name for a comment type, as comment lists show it.
-pub fn comment_type_name(subtype: &str) -> &str {
-    match subtype {
-        "Text" => "Sticky Note",
-        "FreeText" => "Text Box",
-        "Highlight" => "Highlight",
-        "Underline" => "Underline",
-        "StrikeOut" => "Strikethrough",
-        "Squiggly" => "Squiggly",
-        "Square" => "Rectangle",
-        "Circle" => "Oval",
-        "Line" => "Line",
-        "Ink" => "Pencil",
-        "Polygon" => "Polygon",
-        "PolyLine" => "Polygonal Line",
-        "Stamp" => "Stamp",
-        "Caret" => "Inserted Text",
-        "FileAttachment" => "File Attachment",
-        "Sound" => "Sound",
-        "Redact" => "Redaction",
-        other => other,
-    }
-}
-
-/// [`comment_type_name`], telling callouts, clouds and typewriter text apart by `/IT`.
-pub fn comment_kind(a: &pdfcraft_render::Annotation) -> &str {
-    match a.intent.as_deref() {
-        Some("FreeTextCallout") => "Callout",
-        Some("PolygonCloud") => "Cloud",
-        Some("FreeTextTypeWriter") => "Typewriter",
-        _ => comment_type_name(&a.subtype),
-    }
-}
-
-/// The text of a comment summary: one block per comment (replies indented under it), with a
-/// "Page N" heading when sorted by page. Checkmarks and status replies are left out, as are
-/// pop-ups; the number is the comment's position on its page.
-pub fn comment_summary(name: &str, all: &[pdfcraft_render::Annotation], sort: SummarySort) -> String {
-    use std::fmt::Write;
-    let top: Vec<&pdfcraft_render::Annotation> = all.iter().filter(|a| a.in_reply_to.is_none() && a.state.is_none()).collect();
-    // Write a comment's replies, indenting each level. A reply to a reply keeps its `/IRT` on the
-    // direct parent, so following one level would leave the deeper replies out of the summary.
-    fn write_replies(out: &mut String, all: &[pdfcraft_render::Annotation], parent: &str, depth: usize) {
-        use std::fmt::Write;
-        if depth > 64 {
-            return;
-        }
-        for r in all.iter().filter(|r| r.state.is_none() && r.in_reply_to.as_deref() == Some(parent)) {
-            let indent = "    ".repeat(depth + 1);
-            let _ =
-                writeln!(out, "{indent}Author: {}  Subject: Reply  Date: {}", r.author.as_deref().unwrap_or(""), r.modified.as_deref().unwrap_or(""));
-            for line in r.contents.as_deref().unwrap_or("").lines() {
-                let _ = writeln!(out, "{indent}{line}");
-            }
-            if let Some(nm) = r.name.as_deref() {
-                write_replies(out, all, nm, depth + 1);
-            }
-        }
-    }
-    let mut numbered: Vec<(usize, &pdfcraft_render::Annotation)> = Vec::new();
-    let mut last = usize::MAX;
-    let mut n = 0;
-    for a in &top {
-        if a.page != last {
-            last = a.page;
-            n = 0;
-        }
-        n += 1;
-        numbered.push((n, a));
-    }
-    match sort {
-        SummarySort::Page => {}
-        SummarySort::Author => numbered.sort_by(|x, y| x.1.author.cmp(&y.1.author)),
-        SummarySort::Date => numbered.sort_by(|x, y| x.1.modified.cmp(&y.1.modified)),
-        SummarySort::Type => numbered.sort_by(|x, y| comment_kind(x.1).cmp(comment_kind(y.1))),
-    }
-    let mut out = format!("Summary of Comments on {name}\n\n");
-    if numbered.is_empty() {
-        out.push_str("This document has no comments.\n");
-        return out;
-    }
-    let mut heading = usize::MAX;
-    for (n, a) in numbered {
-        if sort == SummarySort::Page && a.page != heading {
-            heading = a.page;
-            let _ = writeln!(out, "Page: {}", a.page + 1);
-        }
-        let _ = write!(out, "Number: {n}  Author: {}  Subject: {}", a.author.as_deref().unwrap_or(""), comment_kind(a));
-        if sort != SummarySort::Page {
-            let _ = write!(out, "  Page: {}", a.page + 1);
-        }
-        let _ = writeln!(out, "  Date: {}", a.modified.as_deref().unwrap_or(""));
-        if let Some(c) = a.contents.as_deref().filter(|c| !c.is_empty()) {
-            let _ = writeln!(out, "{c}");
-        }
-        if let Some(nm) = a.name.as_deref() {
-            write_replies(&mut out, all, nm, 0);
-        }
-        out.push('\n');
-    }
-    out
-}
+use test_hooks::{check_refresh_panic, panic_on_refresh, record_link_scan, record_marker_scan, reset_secondary_scan_counts, secondary_scan_counts};
+use xfa_form::{
+    XFA_REMOVED_PREFIX, XFA_SCRIPTS_OFF, decode_data_file, image_content_type, is_xfa_data_file, note_warnings, strip_xfa, sync_xfa_state,
+    undrawn_field_warnings, xfa_after_data_change, xfa_layout, xfa_redraw, xfa_sync_datasets, xfa_values_from_datasets,
+};
+
+mod clock;
+mod doc_state;
+
+use clock::{local_utc_offset, parse_ymd};
+pub use doc_state::{DocId, ImageEdit, OptimizeReport, RecoverySnapshot, SplitPart, guard, merge_data_files};
+use doc_state::{LOW_RESOLUTION_PRINT_DPI, render_threads, renderer_password, signatures_of, writable};
 
 #[cfg(test)]
 mod tests;
-
-/// Page filters of Acrobat's Rotate Pages and page selection: even/odd page numbers and
-/// orientation (as displayed).
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum PageParity {
-    #[default]
-    Both,
-    Even,
-    Odd,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum PageOrientation {
-    #[default]
-    Both,
-    Landscape,
-    Portrait,
-}
-
-/// The pages of `pages` (0-based) that pass the filters.
-pub fn filter_pages(info: &pdfcraft_render::DocInfo, pages: &[usize], parity: PageParity, orientation: PageOrientation) -> Vec<usize> {
-    pages
-        .iter()
-        .copied()
-        .filter(|p| match parity {
-            PageParity::Both => true,
-            // Page numbers are 1-based: index 1 is page 2, an even page.
-            PageParity::Even => p % 2 == 1,
-            PageParity::Odd => p % 2 == 0,
-        })
-        .filter(|p| {
-            let Some(pg) = info.pages.get(*p) else { return false };
-            match orientation {
-                PageOrientation::Both => true,
-                PageOrientation::Landscape => pg.width > pg.height,
-                PageOrientation::Portrait => pg.width <= pg.height,
-            }
-        })
-        .collect()
-}
diff --git a/crates/engine/src/links.rs b/crates/engine/src/links.rs
index 9b1c49729f..e1d54d56ce 100644
--- a/crates/engine/src/links.rs
+++ b/crates/engine/src/links.rs
@@ -446,332 +446,4 @@ fn mixes_scripts(label: &str) -> bool {
 }
 
 #[cfg(test)]
-mod tests {
-    #[test]
-    fn remote_documents_must_be_regular_pdf_files() {
-        use super::{RemoteDocumentPathError as E, read_remote_document as read};
-        let dir = std::env::temp_dir().join(format!("pdfcraft-gotor-read-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(dir.join("folder.pdf")).unwrap();
-        std::fs::write(dir.join("doc.PDF"), b"%PDF-1.7\n").unwrap();
-        std::fs::write(dir.join("notes.txt"), b"text").unwrap();
-        assert_eq!(read(&dir.join("doc.PDF")).as_deref(), Ok(&b"%PDF-1.7\n"[..]));
-        assert_eq!(read(&dir.join("folder.pdf")), Err(E::NotAFile), "a directory is refused");
-        assert_eq!(read(&dir.join("notes.txt")), Err(E::NotPdf));
-        assert_eq!(read(&dir), Err(E::NotPdf));
-        #[cfg(unix)]
-        {
-            // Sparse: the size guard must reject this without allocating or reading a GiB.
-            let large = dir.join("large.pdf");
-            std::fs::File::create(&large).unwrap().set_len(super::MAX_REMOTE_DOCUMENT_BYTES + 1).unwrap();
-            assert_eq!(read(&large), Err(E::TooLarge));
-        }
-        assert!(matches!(read(&dir.join("missing.pdf")), Err(E::Read(_))));
-        #[cfg(unix)]
-        {
-            // A device (like /dev/zero, which never ends) and a FIFO (which blocks) are never opened.
-            std::os::unix::fs::symlink("/dev/zero", dir.join("zero.pdf")).unwrap();
-            assert_eq!(read(&dir.join("zero.pdf")), Err(E::NotAFile));
-            let fifo = dir.join("pipe.pdf");
-            if std::process::Command::new("mkfifo").arg(&fifo).status().is_ok_and(|s| s.success()) {
-                assert_eq!(read(&fifo), Err(E::NotAFile));
-            }
-        }
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn remote_document_absolute_classification_uses_the_original_platform_path() {
-        use super::remote_document_path_is_absolute as absolute;
-        for relative in ["target.pdf", "../appendix/target.pdf", "folder/target.pdf"] {
-            assert!(!absolute(relative), "{relative}");
-        }
-        #[cfg(unix)]
-        {
-            assert!(absolute("/manual/target.pdf"));
-            assert!(!absolute(r"C:\manual\target.pdf"));
-        }
-        #[cfg(windows)]
-        {
-            assert!(absolute(r"C:\manual\target.pdf"));
-            assert!(absolute("C:/manual/target.pdf"));
-            assert!(!absolute(r"C:target.pdf"), "drive-relative is not absolute");
-            assert!(!absolute(r"\manual\target.pdf"), "rooted without a drive is not absolute");
-        }
-    }
-
-    #[test]
-    fn remote_document_paths_are_local_and_source_relative() {
-        use super::{RemoteDocumentPathError as E, resolve_remote_document_path as resolve};
-        use std::path::Path;
-
-        let source = std::env::temp_dir().join("chapter").join("source.pdf");
-        let source = source.as_path();
-        let folder = source.parent().unwrap();
-        assert_eq!(resolve(Some(source), "target.pdf"), Ok(folder.join("target.pdf")));
-        assert_eq!(resolve(Some(source), "../target.pdf").as_deref(), Ok(folder.parent().unwrap().join("target.pdf").as_path()));
-        #[cfg(unix)]
-        assert_eq!(resolve(Some(source), "/manual/target.pdf").as_deref(), Ok(Path::new("/manual/target.pdf")));
-        assert_eq!(resolve(None, "target.pdf"), Err(E::MissingSourcePath));
-        assert_eq!(resolve(Some(Path::new("source.pdf")), "target.pdf"), Err(E::MissingSourcePath), "a relative source is not used");
-        #[cfg(unix)]
-        assert_eq!(resolve(Some(source), "C:\\x.pdf"), Err(E::NotLocal(craft_docpath::Refused::Invalid)), "a Windows path on Unix needs no source");
-        assert_eq!(resolve(Some(source), ""), Err(E::Empty));
-        assert_eq!(resolve(Some(source), "   "), Err(E::Empty));
-        for url in
-            ["file:///tmp/a.pdf", "file://h/s/a.pdf", "https://example.org/a.pdf", "smb://host/share/a.pdf", "ftp://host/a.pdf", "custom:target.pdf"]
-        {
-            assert!(matches!(resolve(Some(source), url), Err(E::NotLocal(_))), "{url}");
-        }
-        assert_eq!(resolve(Some(source), "folder/hidden\u{200B}.pdf"), Err(E::Hidden));
-        #[cfg(windows)]
-        assert_eq!(resolve(Some(source), "folder/a:b.pdf"), Err(E::NotLocal(craft_docpath::Refused::Invalid)));
-        assert_eq!(resolve(Some(source), &"a".repeat(super::MAX_REMOTE_DOCUMENT_PATH_BYTES + 1)), Err(E::TooLong));
-    }
-
-    #[test]
-    fn remote_document_paths_to_other_computers_and_devices_are_refused() {
-        use super::{RemoteDocumentPathError as E, resolve_remote_document_path as resolve};
-
-        let source = std::env::temp_dir().join("chapter").join("source.pdf");
-        let source = source.as_path();
-        // Refused before any filesystem access: none of these exist, and a stat of a network path
-        // would contact its host.
-        for not_local in [
-            "//server/share/a.pdf",
-            "\\\\server\\share\\a.pdf",
-            "\\\\h\\s\\a.pdf",
-            "\\\\?\\UNC\\h\\s\\a.pdf",
-            "\\??\\UNC\\h\\s\\a.pdf",
-            "/??/x",
-            "\\??\\C:\\a.pdf",
-            "\\\\.\\device\\a.pdf",
-            "/\\server/share/a.pdf",
-            "NUL.pdf",
-        ] {
-            assert!(matches!(resolve(Some(source), not_local), Err(E::NotLocal(_))), "{not_local:?}");
-        }
-        // Linux reads `//tmp/x` as `/tmp/x`, but on Windows it names a share.
-        #[cfg(unix)]
-        {
-            let doubled = format!("/{}", source.with_file_name("a.pdf").display());
-            assert!(matches!(resolve(Some(source), &doubled), Err(E::NotLocal(_))), "{doubled}");
-        }
-    }
-
-    #[test]
-    fn urls_follow_the_artcraft_scheme() {
-        assert_eq!(super::APP_PAGE, format!("{}/apps/{}", super::WEBSITE, super::APP));
-        assert_eq!(super::GITHUB, format!("https://github.com/storytold/{}", super::APP));
-        for l in super::LINKS {
-            assert!(l.url.starts_with("https://"), "{}", l.url);
-            assert!(crate::commands::command(l.command).is_some(), "{} is a registered command", l.command);
-        }
-    }
-
-    #[test]
-    fn documents_may_offer_web_and_email_addresses() {
-        use super::document_url;
-        for ok in [
-            "https://example.org",
-            "HTTPS://Example.org/a?b=c#d",
-            "http://example.org:8080/x",
-            "mailto:someone@example.org",
-            "https://[::1]:8443/",
-            // Plain spaces turn up in real documents' links and are visible in the dialog.
-            "mailto:orders@example.org?subject=Order form",
-            "https://example.org/My Report.pdf",
-        ] {
-            assert_eq!(document_url(ok).as_deref(), Ok(ok), "{ok}");
-        }
-        let multibyte = format!("https://example.org/{}", "é".repeat(super::MAX_DOCUMENT_URL - 20));
-        assert!(document_url(&multibyte).is_ok(), "the limit counts characters, not bytes");
-        assert_eq!(document_url("  https://example.org/ \n").as_deref(), Ok("https://example.org/"), "surrounding whitespace is trimmed");
-    }
-
-    #[test]
-    fn documents_may_not_offer_other_kinds_of_address() {
-        use super::{BlockedLink as B, MAX_DOCUMENT_URL, document_url};
-        let scheme = |s: &str| Err(B::Scheme(s.into()));
-        assert_eq!(document_url("file:///C:/Windows/System32/calc.exe"), scheme("file"));
-        assert_eq!(document_url("FILE://server/share/x.exe"), scheme("file"));
-        assert_eq!(document_url("javascript:alert(1)"), scheme("javascript"));
-        assert_eq!(document_url("data:text/html,<script>x</script>"), scheme("data"));
-        assert_eq!(document_url("ms-settings:privacy"), scheme("ms-settings"));
-        assert_eq!(document_url("smb://server/share"), scheme("smb"));
-        assert_eq!(document_url(""), Err(B::Empty));
-        assert_eq!(document_url("   "), Err(B::Empty));
-        for bad in [
-            "example.org",
-            "//example.org",
-            "1http://x",
-            "ht tp://x",
-            "https:",
-            "https://",
-            "https:///path",
-            "https://user@/x",
-            "mailto:",
-            "https://trusted.example /x",
-        ] {
-            assert_eq!(document_url(bad), Err(B::Malformed), "{bad}");
-        }
-        for hidden in [
-            "https://exa\u{202E}gro.elpmaxe",
-            "https://example.org\u{200B}.evil",
-            "https://a.org/\u{0007}",
-            "https://a.org/x\ty",
-            "https://a.org/x\ny",
-            "https://example.org/a\u{00A0}b",
-        ] {
-            assert_eq!(document_url(hidden), Err(B::Hidden), "{hidden:?}");
-        }
-        let long = format!("https://example.org/?q={}", "a".repeat(MAX_DOCUMENT_URL));
-        assert!(matches!(document_url(&long), Err(B::TooLong(_))));
-    }
-
-    #[test]
-    fn the_host_shown_is_the_one_the_address_goes_to() {
-        use super::host;
-        assert_eq!(host("https://example.org/path"), Some("example.org"));
-        assert_eq!(host("https://trusted.example@other.example/"), Some("other.example"));
-        assert_eq!(host("http://user:pw@other.example:8080?x"), Some("other.example"));
-        assert_eq!(host("https://[::1]:8443/"), Some("[::1]"));
-        // Browsers read `\` as `/`, so this goes to other.example, not trusted.example.
-        assert_eq!(host("https://other.example\\@trusted.example/"), Some("other.example"));
-        assert_eq!(host("https://other.example\\x@trusted.example/"), Some("other.example"));
-        assert_eq!(host("mailto:a@example.org"), None);
-        assert_eq!(host("https:///nohost"), None);
-    }
-
-    #[test]
-    fn addresses_the_url_parser_rejects_are_refused() {
-        use super::{BlockedLink as B, document_url};
-        // The webbrowser crate would open each of these as a local file path.
-        for bad in ["mailto://a^b/x", "mailto://a:99999/", "mailto://[x]/", "mailto://a\\b/", "mailto://a b/", "https://a^b/", "http://a<b/"] {
-            assert_eq!(document_url(bad), Err(B::Malformed), "{bad}");
-        }
-        for ok in ["mailto://example.org/x", "mailto:a@example.org?subject=a b"] {
-            assert_eq!(document_url(ok).as_deref(), Ok(ok), "{ok}");
-        }
-    }
-
-    #[test]
-    fn email_links_may_not_ask_for_a_local_file() {
-        use super::{BlockedLink as B, document_url};
-        for bad in [
-            // Evolution, KMail and Claws Mail attach the named file.
-            "mailto:a@example.org?attach=/home/me/.ssh/id_ed25519",
-            "mailto:a@example.org?subject=Hi&attachment=file:///etc/passwd",
-            // Claws Mail reads an `insert` file into the message body.
-            "mailto:a@example.org?insert=/home/me/notes.txt",
-            // Names are matched case-insensitively (Evolution, KMail) and after percent-decoding (KMail).
-            "mailto:a@example.org?ATTACH=x",
-            "mailto:a@example.org?Attachment=x",
-            "mailto:a@example.org?%61ttach=x",
-            "mailto:a@example.org?%2561ttach=x",
-            "mailto:a@example.org?%49NSERT=x",
-            "mailto:a@example.org?attach%3D/etc/passwd",
-            // An empty value, a repeated name, spaces or quotes before `=`.
-            "mailto:a@example.org?attach=",
-            "mailto:a@example.org?subject=a&attach=x&attach=y",
-            "mailto:a@example.org?subject=a& attach =x",
-            "mailto:a@example.org?subject=a&'attachment'='x'",
-            // No recipient, no `?` at all (xdg-email), a second `?`, and a `?` that only exists once decoded.
-            "mailto:?attach=x",
-            "mailto:a@example.org&attach=/etc/passwd",
-            "mailto:a@example.org?subject=a?attach=x",
-            "mailto:a@example.org%3Fattach=x",
-            // KMail reads the query from the first `?` even inside a fragment, and reads `&#38;` as `&`.
-            "mailto:a@example.org#?attach=x",
-            "mailto:a@example.org?subject=a#&attach=x",
-            "mailto:a@example.org?subject=a&#38;attach=x",
-            "mailto:a@example.org?subject=a;attach=x",
-            // An encoded `&`, and a comma (xdg-email copies the subject into a comma-separated list).
-            "mailto:a@example.org?subject=a%26attach=x",
-            "mailto:a@example.org?subject=a,attachment='/etc/passwd'",
-            // A `+`, an encoded tab or an encoded space between the name and `=`.
-            "mailto:a@example.org?attach+=x",
-            "mailto:a@example.org?attach%09=x",
-            "mailto:a@example.org?attach%20=x",
-        ] {
-            assert_eq!(document_url(bad), Err(B::MailFile), "{bad}");
-        }
-        // KMail decodes RFC 2047 encoded words across the whole address before reading it, so
-        // `=?utf-8?q?attach?=` could become `attach`. Such words never belong in a link.
-        for bad in [
-            "mailto:a@example.org?=?utf-8?q?attach?==/etc/passwd",
-            "mailto:a@example.org?subject==?UTF-8?B?YXR0YWNo?=",
-            "mailto:a@example.org?subject=%3D%3Futf-8%3Fq%3Fattach%3F%3D",
-            "mailto:a@example.org?subject==??q?attach?=",
-            "mailto:a@example.org?subject==?utf-8?base64?YXR0YWNo?=",
-            // Backslash escapes that `echo` in xdg-email decodes, raw and percent-encoded.
-            "mailto:a@example.org?\\0141ttach=x",
-            "mailto:x\\x61ttachment=y",
-            "mailto:a@example.org?%5C0141ttach=x",
-        ] {
-            assert_eq!(document_url(bad), Err(B::MailEncodedWord), "{bad}");
-        }
-        for ok in [
-            "mailto:orders@example.org?subject=Order form&body=Please attach the invoice",
-            "mailto:a@example.org?subject=Attachments%20to%20follow",
-            "mailto:a@example.org?body=Questions%3F%20Attach%20your%20CV",
-            "mailto:a@example.org?body=Hi%3B%20insert%20your%20name",
-            "mailto:a@example.org?cc=b@example.org&bcc=c@example.org&in-reply-to=%3Cid@example.org%3E",
-            "mailto:attach@example.org",
-            "mailto:a@example.org?attach",
-            "mailto:a@example.org?x-attach=1&reattach=2",
-            "mailto:a@example.org?body=Saved in C:\\Users\\me\\Documents",
-        ] {
-            assert_eq!(document_url(ok).as_deref(), Ok(ok), "{ok}");
-        }
-    }
-
-    #[test]
-    fn hosts_are_shown_as_the_browser_receives_them() {
-        use super::{BlockedLink as B, HostDisplay, display_host, document_url};
-        let plain = |a: &str| Some(HostDisplay { ascii: a.into(), international: false, mixed_scripts: false });
-        assert_eq!(display_host("https://example.org/path"), plain("example.org"));
-        assert_eq!(display_host("HTTPS://EXAMPLE.ORG/"), plain("example.org"), "lowercased, as the browser does");
-        assert_eq!(display_host("https://example.org./"), plain("example.org."));
-        assert_eq!(display_host("https://ex%61mple.org/"), plain("example.org"), "percent-decoded, as the browser does");
-        assert_eq!(display_host("https://ｅｘａｍｐｌｅ。org/"), plain("example.org"), "fullwidth letters and `。` are mapped");
-        assert_eq!(display_host("https://trusted.example@other.example/"), plain("other.example"));
-        assert_eq!(display_host("https://other.example\\@trusted.example/"), plain("other.example"));
-        assert_eq!(display_host("mailto:a@example.org"), None);
-        // Numeric hosts in the form the browser connects to, so a local address can't hide.
-        assert_eq!(display_host("https://[::1]:8443/"), plain("[::1]"));
-        assert_eq!(display_host("https://[0:0:0:0:0:0:0:1]/"), plain("[::1]"));
-        assert_eq!(display_host("http://3232235777/"), plain("192.168.1.1"));
-        assert_eq!(display_host("http://0x7f.1/"), plain("127.0.0.1"));
-        assert_eq!(display_host("http://0300.0250.01.01/"), plain("192.168.1.1"));
-
-        // International hosts are shown in punycode and marked.
-        let bucher = display_host("https://bücher.example/").unwrap();
-        assert_eq!(bucher, HostDisplay { ascii: "xn--bcher-kva.example".into(), international: true, mixed_scripts: false });
-        assert!(!display_host("https://ソニーstore.example/").unwrap().mixed_scripts, "Latin with Japanese is normal (UTS #39)");
-        assert!(!display_host("https://example.ελ/").unwrap().mixed_scripts, "scripts are compared within a label, not across labels");
-        // Cyrillic `а` (U+0430) in a Latin name: punycode, and flagged as mixed.
-        let lookalike = display_host("https://p\u{0430}ypal.com/").unwrap();
-        assert_eq!(lookalike, HostDisplay { ascii: "xn--pypal-4ve.com".into(), international: true, mixed_scripts: true });
-        // The same lookalike written in punycode in the document, and upper-case.
-        assert_eq!(display_host("https://XN--PYPAL-4VE.com/"), Some(lookalike));
-        // A whole-script lookalike (all Cyrillic) isn't mixed, but is still shown in punycode, marked.
-        let cyrillic = display_host("https://\u{0430}\u{0440}\u{0440}\u{04CF}\u{0435}.com/").unwrap();
-        assert!(cyrillic.ascii.starts_with("xn--") && cyrillic.international && !cyrillic.mixed_scripts, "{cyrillic:?}");
-
-        // A host the browser can't turn into an address is refused rather than shown.
-        for bad in [
-            "https://xn--a.example/",
-            "https://exa%FFmple.org/",
-            "https://\u{0300}a.example/",
-            "https://%E2%80%AEexample.org/",
-            "https://trusted.example%40other.example/",
-            "https://[evil.example]/",
-            "https://example.org:port/",
-            "https://example.org:99999/",
-        ] {
-            assert_eq!(display_host(bad), None, "{bad}");
-            assert_eq!(document_url(bad), Err(B::Malformed), "{bad}");
-        }
-    }
-}
+mod tests;
diff --git a/crates/engine/src/links/tests.rs b/crates/engine/src/links/tests.rs
new file mode 100644
index 0000000000..fbd272d03b
--- /dev/null
+++ b/crates/engine/src/links/tests.rs
@@ -0,0 +1,327 @@
+#[test]
+fn remote_documents_must_be_regular_pdf_files() {
+    use super::{RemoteDocumentPathError as E, read_remote_document as read};
+    let dir = std::env::temp_dir().join(format!("pdfcraft-gotor-read-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(dir.join("folder.pdf")).unwrap();
+    std::fs::write(dir.join("doc.PDF"), b"%PDF-1.7\n").unwrap();
+    std::fs::write(dir.join("notes.txt"), b"text").unwrap();
+    assert_eq!(read(&dir.join("doc.PDF")).as_deref(), Ok(&b"%PDF-1.7\n"[..]));
+    assert_eq!(read(&dir.join("folder.pdf")), Err(E::NotAFile), "a directory is refused");
+    assert_eq!(read(&dir.join("notes.txt")), Err(E::NotPdf));
+    assert_eq!(read(&dir), Err(E::NotPdf));
+    #[cfg(unix)]
+    {
+        // Sparse: the size guard must reject this without allocating or reading a GiB.
+        let large = dir.join("large.pdf");
+        std::fs::File::create(&large).unwrap().set_len(super::MAX_REMOTE_DOCUMENT_BYTES + 1).unwrap();
+        assert_eq!(read(&large), Err(E::TooLarge));
+    }
+    assert!(matches!(read(&dir.join("missing.pdf")), Err(E::Read(_))));
+    #[cfg(unix)]
+    {
+        // A device (like /dev/zero, which never ends) and a FIFO (which blocks) are never opened.
+        std::os::unix::fs::symlink("/dev/zero", dir.join("zero.pdf")).unwrap();
+        assert_eq!(read(&dir.join("zero.pdf")), Err(E::NotAFile));
+        let fifo = dir.join("pipe.pdf");
+        if std::process::Command::new("mkfifo").arg(&fifo).status().is_ok_and(|s| s.success()) {
+            assert_eq!(read(&fifo), Err(E::NotAFile));
+        }
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn remote_document_absolute_classification_uses_the_original_platform_path() {
+    use super::remote_document_path_is_absolute as absolute;
+    for relative in ["target.pdf", "../appendix/target.pdf", "folder/target.pdf"] {
+        assert!(!absolute(relative), "{relative}");
+    }
+    #[cfg(unix)]
+    {
+        assert!(absolute("/manual/target.pdf"));
+        assert!(!absolute(r"C:\manual\target.pdf"));
+    }
+    #[cfg(windows)]
+    {
+        assert!(absolute(r"C:\manual\target.pdf"));
+        assert!(absolute("C:/manual/target.pdf"));
+        assert!(!absolute(r"C:target.pdf"), "drive-relative is not absolute");
+        assert!(!absolute(r"\manual\target.pdf"), "rooted without a drive is not absolute");
+    }
+}
+
+#[test]
+fn remote_document_paths_are_local_and_source_relative() {
+    use super::{RemoteDocumentPathError as E, resolve_remote_document_path as resolve};
+    use std::path::Path;
+
+    let source = std::env::temp_dir().join("chapter").join("source.pdf");
+    let source = source.as_path();
+    let folder = source.parent().unwrap();
+    assert_eq!(resolve(Some(source), "target.pdf"), Ok(folder.join("target.pdf")));
+    assert_eq!(resolve(Some(source), "../target.pdf").as_deref(), Ok(folder.parent().unwrap().join("target.pdf").as_path()));
+    #[cfg(unix)]
+    assert_eq!(resolve(Some(source), "/manual/target.pdf").as_deref(), Ok(Path::new("/manual/target.pdf")));
+    assert_eq!(resolve(None, "target.pdf"), Err(E::MissingSourcePath));
+    assert_eq!(resolve(Some(Path::new("source.pdf")), "target.pdf"), Err(E::MissingSourcePath), "a relative source is not used");
+    #[cfg(unix)]
+    assert_eq!(resolve(Some(source), "C:\\x.pdf"), Err(E::NotLocal(craft_docpath::Refused::Invalid)), "a Windows path on Unix needs no source");
+    assert_eq!(resolve(Some(source), ""), Err(E::Empty));
+    assert_eq!(resolve(Some(source), "   "), Err(E::Empty));
+    for url in
+        ["file:///tmp/a.pdf", "file://h/s/a.pdf", "https://example.org/a.pdf", "smb://host/share/a.pdf", "ftp://host/a.pdf", "custom:target.pdf"]
+    {
+        assert!(matches!(resolve(Some(source), url), Err(E::NotLocal(_))), "{url}");
+    }
+    assert_eq!(resolve(Some(source), "folder/hidden\u{200B}.pdf"), Err(E::Hidden));
+    #[cfg(windows)]
+    assert_eq!(resolve(Some(source), "folder/a:b.pdf"), Err(E::NotLocal(craft_docpath::Refused::Invalid)));
+    assert_eq!(resolve(Some(source), &"a".repeat(super::MAX_REMOTE_DOCUMENT_PATH_BYTES + 1)), Err(E::TooLong));
+}
+
+#[test]
+fn remote_document_paths_to_other_computers_and_devices_are_refused() {
+    use super::{RemoteDocumentPathError as E, resolve_remote_document_path as resolve};
+
+    let source = std::env::temp_dir().join("chapter").join("source.pdf");
+    let source = source.as_path();
+    // Refused before any filesystem access: none of these exist, and a stat of a network path
+    // would contact its host.
+    for not_local in [
+        "//server/share/a.pdf",
+        "\\\\server\\share\\a.pdf",
+        "\\\\h\\s\\a.pdf",
+        "\\\\?\\UNC\\h\\s\\a.pdf",
+        "\\??\\UNC\\h\\s\\a.pdf",
+        "/??/x",
+        "\\??\\C:\\a.pdf",
+        "\\\\.\\device\\a.pdf",
+        "/\\server/share/a.pdf",
+        "NUL.pdf",
+    ] {
+        assert!(matches!(resolve(Some(source), not_local), Err(E::NotLocal(_))), "{not_local:?}");
+    }
+    // Linux reads `//tmp/x` as `/tmp/x`, but on Windows it names a share.
+    #[cfg(unix)]
+    {
+        let doubled = format!("/{}", source.with_file_name("a.pdf").display());
+        assert!(matches!(resolve(Some(source), &doubled), Err(E::NotLocal(_))), "{doubled}");
+    }
+}
+
+#[test]
+fn urls_follow_the_artcraft_scheme() {
+    assert_eq!(super::APP_PAGE, format!("{}/apps/{}", super::WEBSITE, super::APP));
+    assert_eq!(super::GITHUB, format!("https://github.com/storytold/{}", super::APP));
+    for l in super::LINKS {
+        assert!(l.url.starts_with("https://"), "{}", l.url);
+        assert!(crate::commands::command(l.command).is_some(), "{} is a registered command", l.command);
+    }
+}
+
+#[test]
+fn documents_may_offer_web_and_email_addresses() {
+    use super::document_url;
+    for ok in [
+        "https://example.org",
+        "HTTPS://Example.org/a?b=c#d",
+        "http://example.org:8080/x",
+        "mailto:someone@example.org",
+        "https://[::1]:8443/",
+        // Plain spaces turn up in real documents' links and are visible in the dialog.
+        "mailto:orders@example.org?subject=Order form",
+        "https://example.org/My Report.pdf",
+    ] {
+        assert_eq!(document_url(ok).as_deref(), Ok(ok), "{ok}");
+    }
+    let multibyte = format!("https://example.org/{}", "é".repeat(super::MAX_DOCUMENT_URL - 20));
+    assert!(document_url(&multibyte).is_ok(), "the limit counts characters, not bytes");
+    assert_eq!(document_url("  https://example.org/ \n").as_deref(), Ok("https://example.org/"), "surrounding whitespace is trimmed");
+}
+
+#[test]
+fn documents_may_not_offer_other_kinds_of_address() {
+    use super::{BlockedLink as B, MAX_DOCUMENT_URL, document_url};
+    let scheme = |s: &str| Err(B::Scheme(s.into()));
+    assert_eq!(document_url("file:///C:/Windows/System32/calc.exe"), scheme("file"));
+    assert_eq!(document_url("FILE://server/share/x.exe"), scheme("file"));
+    assert_eq!(document_url("javascript:alert(1)"), scheme("javascript"));
+    assert_eq!(document_url("data:text/html,<script>x</script>"), scheme("data"));
+    assert_eq!(document_url("ms-settings:privacy"), scheme("ms-settings"));
+    assert_eq!(document_url("smb://server/share"), scheme("smb"));
+    assert_eq!(document_url(""), Err(B::Empty));
+    assert_eq!(document_url("   "), Err(B::Empty));
+    for bad in [
+        "example.org",
+        "//example.org",
+        "1http://x",
+        "ht tp://x",
+        "https:",
+        "https://",
+        "https:///path",
+        "https://user@/x",
+        "mailto:",
+        "https://trusted.example /x",
+    ] {
+        assert_eq!(document_url(bad), Err(B::Malformed), "{bad}");
+    }
+    for hidden in [
+        "https://exa\u{202E}gro.elpmaxe",
+        "https://example.org\u{200B}.evil",
+        "https://a.org/\u{0007}",
+        "https://a.org/x\ty",
+        "https://a.org/x\ny",
+        "https://example.org/a\u{00A0}b",
+    ] {
+        assert_eq!(document_url(hidden), Err(B::Hidden), "{hidden:?}");
+    }
+    let long = format!("https://example.org/?q={}", "a".repeat(MAX_DOCUMENT_URL));
+    assert!(matches!(document_url(&long), Err(B::TooLong(_))));
+}
+
+#[test]
+fn the_host_shown_is_the_one_the_address_goes_to() {
+    use super::host;
+    assert_eq!(host("https://example.org/path"), Some("example.org"));
+    assert_eq!(host("https://trusted.example@other.example/"), Some("other.example"));
+    assert_eq!(host("http://user:pw@other.example:8080?x"), Some("other.example"));
+    assert_eq!(host("https://[::1]:8443/"), Some("[::1]"));
+    // Browsers read `\` as `/`, so this goes to other.example, not trusted.example.
+    assert_eq!(host("https://other.example\\@trusted.example/"), Some("other.example"));
+    assert_eq!(host("https://other.example\\x@trusted.example/"), Some("other.example"));
+    assert_eq!(host("mailto:a@example.org"), None);
+    assert_eq!(host("https:///nohost"), None);
+}
+
+#[test]
+fn addresses_the_url_parser_rejects_are_refused() {
+    use super::{BlockedLink as B, document_url};
+    // The webbrowser crate would open each of these as a local file path.
+    for bad in ["mailto://a^b/x", "mailto://a:99999/", "mailto://[x]/", "mailto://a\\b/", "mailto://a b/", "https://a^b/", "http://a<b/"] {
+        assert_eq!(document_url(bad), Err(B::Malformed), "{bad}");
+    }
+    for ok in ["mailto://example.org/x", "mailto:a@example.org?subject=a b"] {
+        assert_eq!(document_url(ok).as_deref(), Ok(ok), "{ok}");
+    }
+}
+
+#[test]
+fn email_links_may_not_ask_for_a_local_file() {
+    use super::{BlockedLink as B, document_url};
+    for bad in [
+        // Evolution, KMail and Claws Mail attach the named file.
+        "mailto:a@example.org?attach=/home/me/.ssh/id_ed25519",
+        "mailto:a@example.org?subject=Hi&attachment=file:///etc/passwd",
+        // Claws Mail reads an `insert` file into the message body.
+        "mailto:a@example.org?insert=/home/me/notes.txt",
+        // Names are matched case-insensitively (Evolution, KMail) and after percent-decoding (KMail).
+        "mailto:a@example.org?ATTACH=x",
+        "mailto:a@example.org?Attachment=x",
+        "mailto:a@example.org?%61ttach=x",
+        "mailto:a@example.org?%2561ttach=x",
+        "mailto:a@example.org?%49NSERT=x",
+        "mailto:a@example.org?attach%3D/etc/passwd",
+        // An empty value, a repeated name, spaces or quotes before `=`.
+        "mailto:a@example.org?attach=",
+        "mailto:a@example.org?subject=a&attach=x&attach=y",
+        "mailto:a@example.org?subject=a& attach =x",
+        "mailto:a@example.org?subject=a&'attachment'='x'",
+        // No recipient, no `?` at all (xdg-email), a second `?`, and a `?` that only exists once decoded.
+        "mailto:?attach=x",
+        "mailto:a@example.org&attach=/etc/passwd",
+        "mailto:a@example.org?subject=a?attach=x",
+        "mailto:a@example.org%3Fattach=x",
+        // KMail reads the query from the first `?` even inside a fragment, and reads `&#38;` as `&`.
+        "mailto:a@example.org#?attach=x",
+        "mailto:a@example.org?subject=a#&attach=x",
+        "mailto:a@example.org?subject=a&#38;attach=x",
+        "mailto:a@example.org?subject=a;attach=x",
+        // An encoded `&`, and a comma (xdg-email copies the subject into a comma-separated list).
+        "mailto:a@example.org?subject=a%26attach=x",
+        "mailto:a@example.org?subject=a,attachment='/etc/passwd'",
+        // A `+`, an encoded tab or an encoded space between the name and `=`.
+        "mailto:a@example.org?attach+=x",
+        "mailto:a@example.org?attach%09=x",
+        "mailto:a@example.org?attach%20=x",
+    ] {
+        assert_eq!(document_url(bad), Err(B::MailFile), "{bad}");
+    }
+    // KMail decodes RFC 2047 encoded words across the whole address before reading it, so
+    // `=?utf-8?q?attach?=` could become `attach`. Such words never belong in a link.
+    for bad in [
+        "mailto:a@example.org?=?utf-8?q?attach?==/etc/passwd",
+        "mailto:a@example.org?subject==?UTF-8?B?YXR0YWNo?=",
+        "mailto:a@example.org?subject=%3D%3Futf-8%3Fq%3Fattach%3F%3D",
+        "mailto:a@example.org?subject==??q?attach?=",
+        "mailto:a@example.org?subject==?utf-8?base64?YXR0YWNo?=",
+        // Backslash escapes that `echo` in xdg-email decodes, raw and percent-encoded.
+        "mailto:a@example.org?\\0141ttach=x",
+        "mailto:x\\x61ttachment=y",
+        "mailto:a@example.org?%5C0141ttach=x",
+    ] {
+        assert_eq!(document_url(bad), Err(B::MailEncodedWord), "{bad}");
+    }
+    for ok in [
+        "mailto:orders@example.org?subject=Order form&body=Please attach the invoice",
+        "mailto:a@example.org?subject=Attachments%20to%20follow",
+        "mailto:a@example.org?body=Questions%3F%20Attach%20your%20CV",
+        "mailto:a@example.org?body=Hi%3B%20insert%20your%20name",
+        "mailto:a@example.org?cc=b@example.org&bcc=c@example.org&in-reply-to=%3Cid@example.org%3E",
+        "mailto:attach@example.org",
+        "mailto:a@example.org?attach",
+        "mailto:a@example.org?x-attach=1&reattach=2",
+        "mailto:a@example.org?body=Saved in C:\\Users\\me\\Documents",
+    ] {
+        assert_eq!(document_url(ok).as_deref(), Ok(ok), "{ok}");
+    }
+}
+
+#[test]
+fn hosts_are_shown_as_the_browser_receives_them() {
+    use super::{BlockedLink as B, HostDisplay, display_host, document_url};
+    let plain = |a: &str| Some(HostDisplay { ascii: a.into(), international: false, mixed_scripts: false });
+    assert_eq!(display_host("https://example.org/path"), plain("example.org"));
+    assert_eq!(display_host("HTTPS://EXAMPLE.ORG/"), plain("example.org"), "lowercased, as the browser does");
+    assert_eq!(display_host("https://example.org./"), plain("example.org."));
+    assert_eq!(display_host("https://ex%61mple.org/"), plain("example.org"), "percent-decoded, as the browser does");
+    assert_eq!(display_host("https://ｅｘａｍｐｌｅ。org/"), plain("example.org"), "fullwidth letters and `。` are mapped");
+    assert_eq!(display_host("https://trusted.example@other.example/"), plain("other.example"));
+    assert_eq!(display_host("https://other.example\\@trusted.example/"), plain("other.example"));
+    assert_eq!(display_host("mailto:a@example.org"), None);
+    // Numeric hosts in the form the browser connects to, so a local address can't hide.
+    assert_eq!(display_host("https://[::1]:8443/"), plain("[::1]"));
+    assert_eq!(display_host("https://[0:0:0:0:0:0:0:1]/"), plain("[::1]"));
+    assert_eq!(display_host("http://3232235777/"), plain("192.168.1.1"));
+    assert_eq!(display_host("http://0x7f.1/"), plain("127.0.0.1"));
+    assert_eq!(display_host("http://0300.0250.01.01/"), plain("192.168.1.1"));
+
+    // International hosts are shown in punycode and marked.
+    let bucher = display_host("https://bücher.example/").unwrap();
+    assert_eq!(bucher, HostDisplay { ascii: "xn--bcher-kva.example".into(), international: true, mixed_scripts: false });
+    assert!(!display_host("https://ソニーstore.example/").unwrap().mixed_scripts, "Latin with Japanese is normal (UTS #39)");
+    assert!(!display_host("https://example.ελ/").unwrap().mixed_scripts, "scripts are compared within a label, not across labels");
+    // Cyrillic `а` (U+0430) in a Latin name: punycode, and flagged as mixed.
+    let lookalike = display_host("https://p\u{0430}ypal.com/").unwrap();
+    assert_eq!(lookalike, HostDisplay { ascii: "xn--pypal-4ve.com".into(), international: true, mixed_scripts: true });
+    // The same lookalike written in punycode in the document, and upper-case.
+    assert_eq!(display_host("https://XN--PYPAL-4VE.com/"), Some(lookalike));
+    // A whole-script lookalike (all Cyrillic) isn't mixed, but is still shown in punycode, marked.
+    let cyrillic = display_host("https://\u{0430}\u{0440}\u{0440}\u{04CF}\u{0435}.com/").unwrap();
+    assert!(cyrillic.ascii.starts_with("xn--") && cyrillic.international && !cyrillic.mixed_scripts, "{cyrillic:?}");
+
+    // A host the browser can't turn into an address is refused rather than shown.
+    for bad in [
+        "https://xn--a.example/",
+        "https://exa%FFmple.org/",
+        "https://\u{0300}a.example/",
+        "https://%E2%80%AEexample.org/",
+        "https://trusted.example%40other.example/",
+        "https://[evil.example]/",
+        "https://example.org:port/",
+        "https://example.org:99999/",
+    ] {
+        assert_eq!(display_host(bad), None, "{bad}");
+        assert_eq!(document_url(bad), Err(B::Malformed), "{bad}");
+    }
+}
diff --git a/crates/engine/src/open.rs b/crates/engine/src/open.rs
new file mode 100644
index 0000000000..d8950d1d6d
--- /dev/null
+++ b/crates/engine/src/open.rs
@@ -0,0 +1,355 @@
+//! Opening a document: preparing it away from the session, then registering it.
+
+use std::sync::{Arc, OnceLock};
+
+use pdfcraft_cos::{SaveOptions, write_incremental};
+use pdfcraft_render::{DocInfo, OpenError, RenderConfig, RenderPool, inspect};
+
+use crate::history::{Editor, Keys, TextBlocksCache};
+use crate::{
+    AppearanceCache, DocId, Document, Session, TrustStore, XFA_SCRIPTS_OFF, XfaLayout, display_bytes, guard, info_fields, js, note_warnings,
+    recovered_render_password, render_threads, same_pages, signatures_of, xfa, xfa_layout, xfa_values_from_datasets,
+};
+
+/// Immutable session state needed while a document is prepared away from its owning thread.
+#[derive(Clone)]
+pub struct OpenContext {
+    now: Option<i64>,
+    js_off: bool,
+    trust: Arc<TrustStore>,
+    xfa_time_scale: u32,
+}
+
+/// A fully prepared document that has not yet been registered in a session.
+pub struct PreparedDocument {
+    document: Document,
+}
+
+impl OpenContext {
+    /// Prepare a document without mutating the session that supplied this context.
+    pub fn prepare_open(
+        &self,
+        name: impl Into<String>,
+        path: Option<String>,
+        bytes: Arc<Vec<u8>>,
+        password: Option<&str>,
+    ) -> Result<PreparedDocument, OpenError> {
+        let name = name.into();
+        guard(|| Session::prepare_open_unguarded(self, name, path, bytes, password))
+            .unwrap_or_else(|m| Err(OpenError::Invalid(format!("reading it failed unexpectedly ({m})"))))
+    }
+}
+
+impl Session {
+    /// Snapshot the session state that affects open-time scripts, dates and signature trust.
+    pub fn open_context(&self) -> OpenContext {
+        OpenContext { now: self.now(), js_off: self.js_off, trust: self.trust.clone(), xfa_time_scale: self.xfa_time_scale.unwrap_or(1) }
+    }
+
+    /// Prepare a document without adding it to this session.
+    pub fn prepare_open(
+        &self,
+        name: impl Into<String>,
+        path: Option<String>,
+        bytes: Arc<Vec<u8>>,
+        password: Option<&str>,
+    ) -> Result<PreparedDocument, OpenError> {
+        self.open_context().prepare_open(name, path, bytes, password)
+    }
+
+    /// Register a prepared document. This is the only open step that mutates the session.
+    pub fn commit_open(&mut self, prepared: PreparedDocument) -> DocId {
+        self.next_id += 1;
+        let id = DocId(self.next_id);
+        let mut document = prepared.document;
+        document.id = id;
+        self.docs.push(document);
+        id
+    }
+
+    /// Synchronous convenience API used by the CLI and automation.
+    pub fn open(&mut self, name: impl Into<String>, path: Option<String>, bytes: Arc<Vec<u8>>, password: Option<&str>) -> Result<DocId, OpenError> {
+        let prepared = self.prepare_open(name, path, bytes, password)?;
+        Ok(self.commit_open(prepared))
+    }
+
+    fn prepare_open_unguarded(
+        context: &OpenContext,
+        name: String,
+        path: Option<String>,
+        bytes: Arc<Vec<u8>>,
+        password: Option<&str>,
+    ) -> Result<PreparedDocument, OpenError> {
+        let cos = std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password));
+        // The renderer authenticates on its own. It cannot use the owner password of R2–R4
+        // files, so give it the user password that owner authentication recovers.
+        let (info, render_password) = match inspect(bytes.clone(), password) {
+            Ok(info) => (info, password.map(str::to_owned)),
+            Err(OpenError::WrongPassword) => {
+                let user = match &cos {
+                    Ok(Ok(d)) => recovered_render_password(d),
+                    _ => None,
+                };
+                let user = user.ok_or(OpenError::WrongPassword)?;
+                (inspect(bytes.clone(), Some(&user))?, Some(user))
+            }
+            Err(e) => return Err(e),
+        };
+        // A dynamic XFA form is a shell around an XML template; lay the template out into real
+        // pages and fields so the rest of the engine works on it. The original bytes stay: the
+        // laid-out form is one appended revision.
+        let opts = SaveOptions { mod_date: context.now.map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
+        // Write `work` as one more revision and reopen it: what the document then is.
+        let rebase = |work: &pdfcraft_cos::Document| -> Result<(Arc<Vec<u8>>, DocInfo, pdfcraft_cos::Document), String> {
+            let new_bytes = write_incremental(work, &opts).map(Arc::new).map_err(|e| e.to_string())?;
+            let new_info = inspect(new_bytes.clone(), render_password.as_deref()).map_err(|e| e.to_string())?;
+            let new_cos = pdfcraft_cos::Document::open_with_password(new_bytes.clone(), password).map_err(|e| e.to_string())?;
+            Ok((new_bytes, new_info, new_cos))
+        };
+        let (bytes, info, cos, xfa) = match (info.xfa, cos) {
+            (Some(pdfcraft_render::Xfa::Dynamic), Ok(Ok(cos))) if pdfcraft_xfa::existing_layout(&cos).is_none() => {
+                let mut work = cos.clone();
+                let laid_out = guard(|| xfa_layout(&mut work))
+                    .unwrap_or_else(|m| Err(format!("laying it out failed unexpectedly ({m})")))
+                    .and_then(|report| rebase(&work).map(|(b, i, c)| (b, i, c, report)));
+                match laid_out {
+                    Ok((b, i, c, report)) => (b, i, Ok(Ok(c)), Some(report)),
+                    Err(e) => {
+                        let mut info = info;
+                        info.warnings.push(format!("This dynamic XFA form could not be laid out: {e}"));
+                        (bytes, info, Ok(Ok(cos)), None)
+                    }
+                }
+            }
+            // A static XFA form, or a dynamic one laid out earlier: its datasets may hold values
+            // filled in by another viewer since; give the fields those values.
+            (Some(_), Ok(Ok(cos))) => {
+                let report = pdfcraft_xfa::existing_layout(&cos);
+                let mut work = cos.clone();
+                let synced =
+                    guard(|| xfa_values_from_datasets(&mut work)).unwrap_or_else(|m| Err(format!("reading its data failed unexpectedly ({m})")));
+                match synced {
+                    Ok(names) if names.is_empty() => (bytes, info, Ok(Ok(cos)), report),
+                    Ok(names) => match rebase(&work) {
+                        Ok((b, mut i, c)) => {
+                            // The fields were rewritten from the XFA data: say so, and which.
+                            let shown: Vec<&str> = names.iter().take(5).map(String::as_str).collect();
+                            let more = if names.len() > shown.len() { format!(" and {} more", names.len() - shown.len()) } else { String::new() };
+                            i.warnings.push(format!(
+                                "{} form field value{} were taken from this form's XFA data (filled in by another viewer): {}{more}",
+                                names.len(),
+                                if names.len() == 1 { "" } else { "s" },
+                                shown.join(", ")
+                            ));
+                            (b, i, Ok(Ok(c)), report)
+                        }
+                        Err(e) => {
+                            let mut info = info;
+                            info.warnings.push(format!("The values in this form's XFA data could not be applied: {e}"));
+                            (bytes, info, Ok(Ok(cos)), report)
+                        }
+                    },
+                    Err(e) => {
+                        let mut info = info;
+                        info.warnings.push(format!("The values in this form's XFA data could not be applied: {e}"));
+                        (bytes, info, Ok(Ok(cos)), report)
+                    }
+                }
+            }
+            (_, cos) => (bytes, info, cos, None),
+        };
+        // A laid-out XFA form: its initialize and calculate scripts run now, as on opening in
+        // Acrobat; what they change is one more revision, still nothing to save.
+        let mut script_output = js::JsOutput::default();
+        let mut ran_away = false;
+        let xfa_template = match (&xfa, &cos) {
+            (Some(_), Ok(Ok(c))) => xfa::template(c),
+            _ => None,
+        };
+        let (bytes, info, cos) = match (&xfa, cos) {
+            (Some(_), Ok(Ok(cos))) if !context.js_off => match xfa_template.clone() {
+                Some(tpl) => {
+                    let mut work = cos.clone();
+                    let pages = info.pages.len();
+                    let ran = guard(|| {
+                        let mut run = xfa::XfaRun {
+                            page_count: pages,
+                            out: &mut script_output,
+                            datasets: None,
+                            ran_away: false,
+                            time_scale: context.xfa_time_scale,
+                        };
+                        let changes = xfa::on_open(&mut work, &tpl, &mut run);
+                        if run.ran_away {
+                            ran_away = true;
+                        }
+                        changes
+                    })
+                    .unwrap_or_else(|m| Err(format!("its scripts failed unexpectedly ({m})")));
+                    match ran {
+                        Ok(changes) if work.is_modified() => match rebase(&work) {
+                            Ok((b, mut i, c)) => {
+                                // The file as saved differs from what opening shows: say so.
+                                if !changes.is_empty() {
+                                    i.warnings.push(format!(
+                                        "This form's scripts changed it on opening ({}); saving keeps those changes",
+                                        changes.describe()
+                                    ));
+                                }
+                                (b, i, Ok(Ok(c)))
+                            }
+                            Err(e) => {
+                                script_output.errors.push(format!("The form's scripts could not be applied: {e}"));
+                                (bytes, info, Ok(Ok(cos)))
+                            }
+                        },
+                        Ok(_) => (bytes, info, Ok(Ok(cos))),
+                        Err(e) => {
+                            script_output.errors.push(format!("The form's scripts could not run: {e}"));
+                            (bytes, info, Ok(Ok(cos)))
+                        }
+                    }
+                }
+                None => (bytes, info, Ok(Ok(cos))),
+            },
+            (_, cos) => (bytes, info, cos),
+        };
+        // The catalog leads to no page, but the reader found pages by scanning: gather the page
+        // objects into a page tree as one more revision, or page edits address none of them
+        // (#1656). Kept only when the reader then shows the same pages, and never on a signed
+        // document, where writing the repair could rewrite the file under its signatures.
+        let (bytes, info, cos) = match cos {
+            Ok(Ok(cos)) if !info.pages.is_empty() && pdfcraft_organize::page_count(&cos).unwrap_or(0) == 0 => {
+                let mut work = cos.clone();
+                let signed = || pdfcraft_sign::pdf::list(&cos, &bytes, &context.trust).iter().any(|s| s.signed);
+                let rebuilt = match pdfcraft_organize::recover_page_tree(&mut work) {
+                    Ok(n) if n > 0 && !signed() => rebase(&work).ok().filter(|(_, i, _)| same_pages(&i.pages, &info.pages)),
+                    _ => None,
+                };
+                match rebuilt {
+                    Some((b, i, mut c)) => {
+                        for line in cos.repair_log() {
+                            c.note_repair(line.clone());
+                        }
+                        c.note_repair(format!("the page tree is missing; its {} pages were found by scanning the file", i.pages.len()));
+                        (b, i, Ok(Ok(c)))
+                    }
+                    None => (bytes, info, Ok(Ok(cos))),
+                }
+            }
+            cos => (bytes, info, cos),
+        };
+        // XFA notes survive the document being re-read after edits.
+        let xfa_warnings: Vec<String> = if info.xfa.is_some() { info.warnings.clone() } else { Vec::new() };
+        let mut document = Self::build_document(&context.trust, name, path, bytes, info, cos, render_password, password, xfa);
+        // A script that ran away on open turns the form's scripts off for this document.
+        document.xfa_template = if ran_away { None } else { xfa_template };
+        document.js_output.append(script_output);
+        if ran_away {
+            document.xfa_scripts_off = true;
+            document.js_output.errors.push(XFA_SCRIPTS_OFF.into());
+        }
+        note_warnings(&mut document.xfa_warnings, &xfa_warnings);
+        Ok(PreparedDocument { document })
+    }
+
+    /// The last step of opening: build the document record and register it.
+    #[allow(clippy::too_many_arguments)]
+    fn build_document(
+        trust: &Arc<TrustStore>,
+        name: String,
+        path: Option<String>,
+        bytes: Arc<Vec<u8>>,
+        mut info: DocInfo,
+        cos: Result<Result<pdfcraft_cos::Document, pdfcraft_cos::CosError>, Box<dyn std::any::Any + Send>>,
+        render_password: Option<String>,
+        password: Option<&str>,
+        xfa: Option<XfaLayout>,
+    ) -> Document {
+        let config = RenderConfig { password: render_password.as_deref().map(Arc::from), ..Default::default() };
+        let (mut editor, read_only_reason) = match cos {
+            Ok(Ok(cos)) => {
+                let keys = Keys { render: render_password.clone(), reopen: password.map(str::to_owned) };
+                let saved = cos.bytes().clone();
+                (
+                    Some(Editor {
+                        cos,
+                        saved,
+                        saved_keys: keys.clone(),
+                        unsaved_file: false,
+                        undo: Vec::new(),
+                        redo: Vec::new(),
+                        keys,
+                        appearances: AppearanceCache::default(),
+                        field_appearances: pdfcraft_forms::FieldAppearanceCache::default(),
+                        text_blocks: TextBlocksCache::default(),
+                    }),
+                    None,
+                )
+            }
+            Ok(Err(e)) => (None, Some(e.to_string())),
+            Err(_) => (None, Some("the document structure could not be read for editing".into())),
+        };
+        let sig_cache = Arc::new(pdfcraft_sign::DigestCache::default());
+        let signatures = editor.as_ref().map(|e| signatures_of(&e.cos, &bytes, trust, &sig_cache)).unwrap_or_default();
+        // The inspection reads only `/Info`; a file stating its title or author only in XMP still
+        // shows them (#2373).
+        if let Some(e) = &editor {
+            for (field, value) in info_fields(&mut info, &e.cos) {
+                if field.is_none() {
+                    *field = value;
+                }
+            }
+        }
+        let display = display_bytes(editor.as_mut(), &bytes);
+        let renderer = RenderPool::new(display.clone(), render_threads(), config.clone());
+        let (form, adopted) = editor
+            .as_ref()
+            .map(|e| {
+                let mut fields = pdfcraft_forms::fields_with_adopted(&e.cos);
+                xfa::mark_script_buttons(&e.cos, &mut fields.items);
+                (fields.items, fields.adopted_page_fields)
+            })
+            .unwrap_or_default();
+        // Fields the file lists only as page widgets are adopted leniently; the file says so.
+        if adopted > 0
+            && let Some(e) = &mut editor
+        {
+            let line = if adopted == 1 {
+                "the form's /Fields list omits 1 field; it was read from the page annotations".to_string()
+            } else {
+                format!("the form's /Fields list omits {adopted} fields; they were read from the page annotations")
+            };
+            e.cos.note_repair(line);
+        }
+        Document {
+            id: DocId(0),
+            name,
+            path,
+            bytes,
+            display,
+            info,
+            renderer,
+            password: render_password,
+            dirty: false,
+            generation: 0,
+            snapshot_generation: 0,
+            read_only_reason,
+            form: Arc::new(form),
+            marker_scan: OnceLock::new(),
+            links: OnceLock::new(),
+            signatures: Arc::new(signatures),
+            trust: trust.clone(),
+            sig_cache,
+            editor,
+            config,
+            js_output: Default::default(),
+            xfa,
+            xfa_template: None,
+            xfa_scripts_off: false,
+            fonts_stale: false,
+            xfa_warnings: Vec::new(),
+            edit_notices: Vec::new(),
+        }
+    }
+}
diff --git a/crates/engine/src/optimizer.rs b/crates/engine/src/optimizer.rs
index a3becf5147..42af737bab 100644
--- a/crates/engine/src/optimizer.rs
+++ b/crates/engine/src/optimizer.rs
@@ -87,8 +87,9 @@ impl OptimizeJob {
 
     fn work(self, progress: &mut dyn FnMut(OptimizeStage) -> bool) -> Result<Optimized, EditError> {
         let OptimizeJob { mut cos, settings, discard, opts } = self;
-        // Like every file written, without the values of Password-flag fields (#3926).
+        // Like every file written, without the values of Password-flag fields (#3926, #3944).
         pdfcraft_forms::clear_password_values(&mut cos).map_err(|e| EditError::Write(e.to_string()))?;
+        pdfcraft_xfa::clear_password_values(&mut cos).map_err(|e| EditError::Write(e.to_string()))?;
         let mut step = |stage| if progress(stage) { Ok(()) } else { Err(EditError::Cancelled) };
         step(OptimizeStage::Discarding)?;
         let discarded = if discard.is_empty() { Vec::new() } else { pdfcraft_redact::sanitize::remove_hidden(&mut cos, &discard)? };
diff --git a/crates/engine/src/page_filter.rs b/crates/engine/src/page_filter.rs
new file mode 100644
index 0000000000..aaedfbd65c
--- /dev/null
+++ b/crates/engine/src/page_filter.rs
@@ -0,0 +1,41 @@
+//! Page filters: even or odd page numbers, and orientation as displayed.
+
+/// Page filters of Acrobat's Rotate Pages and page selection: even/odd page numbers and
+/// orientation (as displayed).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum PageParity {
+    #[default]
+    Both,
+    Even,
+    Odd,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum PageOrientation {
+    #[default]
+    Both,
+    Landscape,
+    Portrait,
+}
+
+/// The pages of `pages` (0-based) that pass the filters.
+pub fn filter_pages(info: &pdfcraft_render::DocInfo, pages: &[usize], parity: PageParity, orientation: PageOrientation) -> Vec<usize> {
+    pages
+        .iter()
+        .copied()
+        .filter(|p| match parity {
+            PageParity::Both => true,
+            // Page numbers are 1-based: index 1 is page 2, an even page.
+            PageParity::Even => p % 2 == 1,
+            PageParity::Odd => p % 2 == 0,
+        })
+        .filter(|p| {
+            let Some(pg) = info.pages.get(*p) else { return false };
+            match orientation {
+                PageOrientation::Both => true,
+                PageOrientation::Landscape => pg.width > pg.height,
+                PageOrientation::Portrait => pg.width <= pg.height,
+            }
+        })
+        .collect()
+}
diff --git a/crates/engine/src/pictures.rs b/crates/engine/src/pictures.rs
new file mode 100644
index 0000000000..b29941720a
--- /dev/null
+++ b/crates/engine/src/pictures.rs
@@ -0,0 +1,59 @@
+//! Pictures placed on pages: added images, and the pictures of watermarks and backgrounds.
+
+use std::sync::Arc;
+
+use crate::EditError;
+
+/// A picture for a watermark or background (Acrobat: Source ▸ File): an image, or `page`
+/// (0-based) of a PDF.
+#[derive(Clone, Debug, PartialEq)]
+pub struct MarkFile {
+    pub name: String,
+    pub bytes: Arc<Vec<u8>>,
+    pub page: usize,
+}
+
+/// Embed an image that is placed on a page, turned the way its EXIF Orientation says.
+pub(crate) fn embed_image(
+    doc: &mut pdfcraft_cos::Document,
+    name: &str,
+    bytes: &[u8],
+) -> Result<(pdfcraft_cos::ObjRef, (f64, f64)), pdfcraft_create::CreateError> {
+    pdfcraft_create::image_xobject(doc, name, bytes)
+}
+
+/// The largest box of `w`:`h` shape inside `rect`, centred in it: a stamp's picture keeps its
+/// shape in a box of any other shape. A box that is already that shape (to within rounding) is
+/// kept exactly, so callers that size it themselves get their box back. An empty or non-finite
+/// box, or a picture with no size, is returned as it is, for the annotation's own check to refuse.
+pub(crate) fn fit_picture(rect: [f64; 4], w: f64, h: f64) -> [f64; 4] {
+    if !rect.iter().all(|v| v.is_finite()) {
+        return rect;
+    }
+    let rect = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
+    let (bw, bh) = (rect[2] - rect[0], rect[3] - rect[1]);
+    let usable = |v: f64| v.is_finite() && v > 0.0;
+    if !(usable(bw) && usable(bh) && usable(w) && usable(h)) {
+        return rect;
+    }
+    let k = (bw / w).min(bh / h);
+    let (fw, fh) = (w * k, h * k);
+    if (fw - bw).abs() <= bw * 1e-9 && (fh - bh).abs() <= bh * 1e-9 {
+        return rect;
+    }
+    let (cx, cy) = (rect[0] + bw / 2.0, rect[1] + bh / 2.0);
+    [cx - fw / 2.0, cy - fh / 2.0, cx + fw / 2.0, cy + fh / 2.0]
+}
+
+/// Bring a mark's picture into `doc`: a PDF page as a form XObject, or an image.
+pub(crate) fn mark_source(doc: &mut pdfcraft_cos::Document, f: &MarkFile) -> Result<pdfcraft_edit::MarkSource, EditError> {
+    let head = &f.bytes[..f.bytes.len().min(1024)];
+    if head.windows(5).any(|w| w == b"%PDF-") {
+        let src = pdfcraft_cos::Document::open(f.bytes.clone()).map_err(|e| EditError::Source(format!("{}: {e}", f.name)))?;
+        let (xobject, size) = pdfcraft_organize::page_as_form(doc, &src, f.page)?;
+        Ok(pdfcraft_edit::MarkSource { xobject, size, image: false })
+    } else {
+        let (xobject, size) = embed_image(doc, &f.name, &f.bytes)?;
+        Ok(pdfcraft_edit::MarkSource { xobject, size, image: true })
+    }
+}
diff --git a/crates/engine/src/protection.rs b/crates/engine/src/protection.rs
new file mode 100644
index 0000000000..e66f01538a
--- /dev/null
+++ b/crates/engine/src/protection.rs
@@ -0,0 +1,158 @@
+//! Password protection to apply, and the security a document has.
+
+use crate::EditError;
+
+/// Document Properties ▸ Security.
+#[derive(Clone, Debug, PartialEq)]
+pub struct SecuritySummary {
+    /// "AES, 256-bit" etc.
+    pub method: String,
+    /// Opened with the owner password (no restrictions apply).
+    pub owner: bool,
+    /// For pending protection: the restrictions as they will apply to others.
+    pub permissions: pdfcraft_cos::Permissions,
+    /// Set in this session; written by the next save.
+    pub pending: bool,
+}
+
+/// What printing a protected document allows (Acrobat: Printing allowed).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Printing {
+    None,
+    /// "Low Resolution (150 dpi)".
+    Low,
+    High,
+}
+
+/// What changes a protected document allows (Acrobat: Changes allowed).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Changes {
+    None,
+    /// "Inserting, deleting, and rotating pages".
+    Pages,
+    /// "Filling in form fields and signing existing signature fields".
+    FillSign,
+    /// "Commenting, filling in form fields, and signing existing signature fields".
+    CommentFillSign,
+    /// "Any except extracting pages".
+    AnyExceptExtract,
+}
+
+/// Password protection to apply (Protect Using Password and its Advanced options).
+#[derive(Clone, PartialEq)]
+pub struct Protection {
+    /// Required to open the document (the user password).
+    pub open_password: Option<String>,
+    /// Required to change security and lift the restrictions below (the owner password).
+    pub permissions_password: Option<String>,
+    pub printing: Printing,
+    pub changes: Changes,
+    /// "Enable copying of text, images, and other content".
+    pub copy: bool,
+    /// "Enable text access for screen reader devices".
+    pub accessibility: bool,
+    /// Compatibility level; AES-256 (Acrobat X and later) by default.
+    pub algorithm: pdfcraft_cos::Algorithm,
+    /// `false`: "Encrypt all document contents except metadata".
+    pub encrypt_metadata: bool,
+}
+
+impl std::fmt::Debug for Protection {
+    // Never print passwords (edits end up in logs and error messages).
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Protection")
+            .field("open_password", &self.open_password.as_ref().map(|_| "…"))
+            .field("permissions_password", &self.permissions_password.as_ref().map(|_| "…"))
+            .field("printing", &self.printing)
+            .field("changes", &self.changes)
+            .field("copy", &self.copy)
+            .field("accessibility", &self.accessibility)
+            .field("algorithm", &self.algorithm)
+            .field("encrypt_metadata", &self.encrypt_metadata)
+            .finish()
+    }
+}
+
+impl Default for Protection {
+    /// Acrobat's defaults: AES-256, printing and accessibility allowed, no changes, no copying.
+    fn default() -> Self {
+        Self {
+            open_password: None,
+            permissions_password: None,
+            printing: Printing::High,
+            changes: Changes::None,
+            copy: false,
+            accessibility: true,
+            algorithm: pdfcraft_cos::Algorithm::Aes256,
+            encrypt_metadata: true,
+        }
+    }
+}
+
+impl Protection {
+    /// The `/P` permission bits (ISO 32000-2 Table 22), as Acrobat maps its choices.
+    pub fn permission_bits(&self) -> i32 {
+        let bit = |n: u32| 1i32 << (n - 1);
+        if self.permissions_password.is_none() {
+            return -1; // nothing restricted without a permissions password
+        }
+        let mut p = 0;
+        match self.printing {
+            Printing::None => {}
+            Printing::Low => p |= bit(3),
+            Printing::High => p |= bit(3) | bit(12),
+        }
+        p |= match self.changes {
+            Changes::None => 0,
+            Changes::Pages => bit(11),
+            Changes::FillSign => bit(9),
+            Changes::CommentFillSign => bit(6) | bit(9),
+            Changes::AnyExceptExtract => bit(4) | bit(6) | bit(9),
+        };
+        if self.copy {
+            p |= bit(5) | bit(10);
+        }
+        if self.accessibility {
+            p |= bit(10);
+        }
+        p
+    }
+
+    pub(crate) fn validate(&self) -> Result<(), EditError> {
+        let bad = |m: &str| Err(EditError::Protection(m.to_string()));
+        match (&self.open_password, &self.permissions_password) {
+            (None, None) => return bad("enter a password to open the document, a permissions password, or both"),
+            (Some(a), Some(b)) if a == b => return bad("the open password and the permissions password must be different"),
+            _ => {}
+        }
+        if [&self.open_password, &self.permissions_password].into_iter().flatten().any(String::is_empty) {
+            return bad("passwords can't be empty");
+        }
+        if self.algorithm != pdfcraft_cos::Algorithm::Aes256
+            && [&self.open_password, &self.permissions_password].into_iter().flatten().any(|p| p.chars().any(|c| !(' '..='~').contains(&c)))
+        {
+            return bad("this compatibility level supports only plain ASCII passwords; use AES-256 (Acrobat X and later)");
+        }
+        // Encryption keys on a password as `effective_password` gives it (AES-256: SASLprep,
+        // which drops soft hyphens and folds compatibility forms; older levels: the first 32
+        // bytes, padded). One that comes out as the empty password opens the file without asking,
+        // and an open password that comes out as the permissions password lifts the restrictions.
+        let effective = |p: &str| pdfcraft_cos::effective_password(self.algorithm, p);
+        let (open, permissions) = (self.open_password.as_deref().map(effective), self.permissions_password.as_deref().map(effective));
+        let empty = effective("");
+        if open.iter().chain(&permissions).any(|p| *p == empty) {
+            return bad("passwords can't be empty or made only of characters that passwords ignore, such as soft hyphens");
+        }
+        if open.is_some() && open == permissions {
+            return bad("the open password and the permissions password must be different (PDF readers treat these two as the same password)");
+        }
+        Ok(())
+    }
+}
+
+/// Opened as owner, or nothing is restricted (no permissions password was set): security may
+/// be changed, as in Acrobat.
+pub(crate) fn unrestricted(p: &pdfcraft_cos::Permissions) -> bool {
+    const ALL: i32 = 0b1111_0011_1100; // bits 3–6 and 9–12
+    p.owner || p.bits & ALL == ALL
+}
diff --git a/crates/engine/src/session.rs b/crates/engine/src/session.rs
new file mode 100644
index 0000000000..1051903bae
--- /dev/null
+++ b/crates/engine/src/session.rs
@@ -0,0 +1,48 @@
+//! The session: the open documents and the operations on them.
+
+use std::sync::{Arc, OnceLock};
+
+use pdfcraft_cos::{SaveOptions, write_full, write_incremental};
+use pdfcraft_render::{LayerOp, OpenError, ReadingColors, RenderConfig, RenderPool, inspect};
+
+#[cfg(test)]
+use crate::check_refresh_panic;
+use crate::edit::{EditCtx, check_permission, run_edit};
+use crate::history::{Keys, MAX_UNDO, Scope, keys_after, scope_of, uses_scripts};
+use crate::{
+    BookmarkPage, BookmarkRow, CombineSource, Combined, DataFormat, DocId, Document, Edit, EditError, Hidden, ImageResolution,
+    LOW_RESOLUTION_PRINT_DPI, Label, ObjectKind, OptimizeReport, RecoverySnapshot, SignOptions, SourceKind, SplitPart, SummarySort, TrustStore,
+    XFA_REMOVED_PREFIX, XFA_SCRIPTS_OFF, apply_layer_state, comment_list, comment_summary, decode_text, display_bytes, guard, info_fields, js,
+    local_utc_offset, note_warnings, open_source, open_source_with, optimize, outline_rows, parse_ymd, print, print_raster, render_threads,
+    scan_colours, set_default_layer_state, shown_under_redactions, signatures_of, source_kind, sync_xfa_state, undrawn_notices, use_layer_choices,
+    writable, xfa, xfa_sync_datasets,
+};
+
+mod editing;
+mod files;
+mod save;
+mod view;
+
+#[derive(Default)]
+pub struct Session {
+    pub(crate) docs: Vec<Document>,
+    pub(crate) next_id: u64,
+    /// Seconds since the Unix epoch, injected so saves are deterministic in tests.
+    clock: Option<fn() -> i64>,
+    /// Seconds to add to UTC for local time, read from whoever knows the zone (a browser, say).
+    /// Separate from `clock` on purpose: `clock` alone is the test shortcut that takes the
+    /// injected time AS local time and zeroes the zone, so injecting only it leaves either the
+    /// local dates or the UTC ones wrong by the zone's offset.
+    utc_offset: Option<fn() -> i64>,
+    /// Certificates trusted for signing (Acrobat: Trusted Certificates).
+    pub(crate) trust: Arc<TrustStore>,
+    /// Preferences ▸ JavaScript ▸ Enable Acrobat JavaScript, inverted (on by default).
+    pub(crate) js_off: bool,
+    /// Preferences ▸ Date format, when not the default (see [`dates`]).
+    pub(crate) date_format: Option<String>,
+    /// Preferences ▸ Date format ▸ Language, when not following the interface language.
+    pub(crate) date_language: Option<String>,
+    /// What the XFA scripts' time limits are multiplied by (`None`: 1); see
+    /// [`Session::with_xfa_time_scale`].
+    pub(crate) xfa_time_scale: Option<u32>,
+}
diff --git a/crates/engine/src/session/editing.rs b/crates/engine/src/session/editing.rs
new file mode 100644
index 0000000000..9b1a8340a5
--- /dev/null
+++ b/crates/engine/src/session/editing.rs
@@ -0,0 +1,521 @@
+use super::*;
+
+impl Session {
+    /// Apply an edit. On success the previous state is undoable and the view data is refreshed.
+    pub fn apply(&mut self, id: DocId, edit: Edit) -> Result<(), EditError> {
+        let now = self.now();
+        let today = self.today();
+        let js_off = self.js_off;
+        let xfa_time_scale = self.xfa_time_scale.unwrap_or(1);
+        let doc = self.doc_mut(id)?;
+        doc.edit_notices.clear();
+        let name = doc.name.clone();
+        let is_xfa = doc.info.xfa.is_some();
+        let mut scope = scope_of(&edit);
+        let mut cx = EditCtx::new(now, doc.generation ^ (id.0 << 48));
+        if !js_off {
+            cx.xfa = doc.xfa_template.clone();
+        }
+        cx.xfa_time_scale = xfa_time_scale;
+        cx.pages = doc.info.pages.len();
+        cx.today = today;
+        let reason = doc.read_only_reason.clone().unwrap_or_default();
+        let signed = doc.is_signed();
+        let editor = doc.editor.as_mut().ok_or(EditError::ReadOnly(reason))?;
+        if let Some(p) = editor.cos.permissions() {
+            check_permission(&edit, &p)?;
+        }
+        // Rewriting an OCR word (invisible text over a scan) also hides the scanned word: cover it
+        // in the paper's colour and draw the new text in the ink's.
+        let edit = match edit {
+            Edit::EditTextBlock { page, block, text, mut style } => {
+                // Only invisible text is sampled; the blocks are usually cached from opening it.
+                if style.cover.is_none()
+                    && let Some(info) = doc.info.pages.get(page)
+                    && let Some(b) = editor.text_blocks(page).ok().and_then(|b| b.get(block).filter(|b| b.invisible).cloned())
+                    && let Some((paper, ink)) = guard(|| scan_colours::sample(&editor.cos, info, page, &b)).ok().flatten()
+                {
+                    style.cover = Some(paper);
+                    style.color = style.color.or(Some(ink));
+                }
+                Edit::EditTextBlock { page, block, text, style }
+            }
+            other => other,
+        };
+        // Nothing to bake: leave undo history and the dirty flag alone.
+        if matches!(&edit, Edit::FlattenFillSign) && !pdfcraft_annot::has_visible_fill_sign(&editor.cos) {
+            return Ok(());
+        }
+        let mut next = editor.cos.clone();
+        if !js_off && uses_scripts(&edit) {
+            cx.js = Some(js::JsRunner::new(&next, &name));
+        }
+        cx.renamed_fields.clear();
+        cx.redaction_overlays.clear();
+        // `next` is a copy: if the edit fails or crashes, the document is unchanged.
+        guard(|| run_edit(&mut next, &edit, &mut cx))
+            .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label()))))?;
+        // Redaction removed what its own interpreter places under the marks. The marks were drawn
+        // over the page as the renderer shows it, so the renderer has the last word.
+        if let Edit::ApplyRedactions { pages } = &edit {
+            let marks: Vec<pdfcraft_redact::Mark> =
+                pdfcraft_redact::marks(&editor.cos).into_iter().filter(|m| pages.as_ref().is_none_or(|p| p.contains(&m.page))).collect();
+            guard(|| shown_under_redactions(&next, &marks, &cx.redaction_overlays, &doc.info.pages, doc.password.as_deref()))
+                .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label()))))?;
+        }
+        // Renamed fields are said, not slipped in: a repair-log note (with the caveat that
+        // scripts were left alone) and a count in the undo step's label.
+        let renamed_note = |renamed: &[(String, String)]| {
+            (!renamed.is_empty()).then(|| {
+                let shown: Vec<String> = renamed.iter().take(5).map(|(old, new)| format!("{old} → {new}")).collect();
+                let more = renamed.len().saturating_sub(shown.len());
+                let more = if more > 0 { format!(", and {more} more") } else { String::new() };
+                format!(
+                    "inserted pages renamed {} form field{} to keep their names separate ({}{more}); scripts that refer to the old names were not rewritten",
+                    renamed.len(),
+                    if renamed.len() == 1 { "" } else { "s" },
+                    shown.join(", ")
+                )
+            })
+        };
+        if let Some(note) = renamed_note(&cx.renamed_fields) {
+            next.note_repair(note);
+        }
+        // Only Insert from File renames fields; its label says so in a wording the interface
+        // translates (the count lives in the repair note).
+        let label = match (&edit, cx.renamed_fields.len()) {
+            (_, 0) => edit.label(),
+            (Edit::InsertPagesFrom { name, .. }, n) => Label::with(
+                if n == 1 { "Insert pages from {name} — 1 field renamed" } else { "Insert pages from {name} — fields renamed" },
+                name.as_str(),
+            ),
+            _ => edit.label(),
+        };
+        // An XFA form's scripts answer the change: exit and validate scripts of the field, then
+        // every calculation (and a reset recalculates). They read the data, so it is brought up
+        // to date first.
+        if let Some(tpl) = cx.xfa.clone() {
+            if is_xfa && matches!(scope_of(&edit), Scope::Form | Scope::Full | Scope::Content) {
+                let datasets = &mut cx.xfa_datasets;
+                let notes = guard(|| xfa_sync_datasets(&mut next, Some(&tpl), datasets))
+                    .unwrap_or_else(|m| Err(format!("writing the XFA data failed unexpectedly ({m})")))
+                    .map_err(EditError::Write)?;
+                cx.xfa_out.errors.extend(notes);
+            }
+            fn collect(e: &Edit, changed: &mut Vec<String>, reset: &mut bool) {
+                match e {
+                    Edit::SetFieldValue { name, .. } => changed.push(name.clone()),
+                    Edit::ResetForm { .. } => *reset = true,
+                    Edit::Batch { edits, .. } => edits.iter().for_each(|e| collect(e, changed, reset)),
+                    _ => {}
+                }
+            }
+            let mut changed: Vec<String> = Vec::new();
+            let mut reset = false;
+            collect(&edit, &mut changed, &mut reset);
+            if !changed.is_empty() || reset {
+                let mut run = xfa::XfaRun {
+                    page_count: cx.pages,
+                    out: &mut cx.xfa_out,
+                    datasets: cx.xfa_datasets,
+                    ran_away: false,
+                    time_scale: cx.xfa_time_scale,
+                };
+                // Every changed field's scripts, then the calculations once (after a reset,
+                // only those).
+                let ran = guard(|| xfa::on_changes(&mut next, &tpl, &changed, &mut run))
+                    .unwrap_or_else(|m| Err(format!("the form's scripts failed unexpectedly ({m})")));
+                cx.xfa_datasets = run.datasets;
+                cx.xfa_ran_away |= run.ran_away;
+                if let Err(e) = ran {
+                    cx.xfa_out.errors.push(e);
+                }
+            }
+        }
+        // XFA forms keep their values in the datasets packet too, for Adobe's viewers.
+        let mut xfa_notes = Vec::new();
+        if is_xfa && matches!(scope_of(&edit), Scope::Form | Scope::Full | Scope::Content) {
+            let (tpl, datasets) = (cx.xfa.as_deref(), &mut cx.xfa_datasets);
+            xfa_notes = guard(|| xfa_sync_datasets(&mut next, tpl, datasets))
+                .unwrap_or_else(|m| Err(format!("writing the XFA data failed unexpectedly ({m})")))
+                .map_err(EditError::Write)?;
+            // Rebuilding from stale data would discard accepted widget values.
+            if xfa_notes.is_empty() {
+                let reflow = guard(|| xfa::relayout_changed_text(&mut next, tpl, &doc.form))
+                    .unwrap_or_else(|m| Err(format!("laying out the XFA text failed unexpectedly ({m})")))
+                    .map_err(EditError::Write)?;
+                if let Some(warnings) = reflow {
+                    xfa_notes.extend(warnings);
+                    // Layout replaces pages and widgets, even if the page count is unchanged.
+                    // Undo/redo must rebuild these too instead of refreshing only field values.
+                    scope = Scope::Full;
+                }
+            }
+        }
+        // Signed documents are only ever saved incrementally: an edit that needs a full rewrite
+        // (applying redactions, changing security, sanitizing) would invalidate the signatures.
+        // So does any edit to a file rebuilt from object headers: it has no chain to append to.
+        let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();
+        if signed && ((rewrites(&next) && !rewrites(&editor.cos)) || (next.is_modified() && next.revisions().is_empty())) {
+            return Err(EditError::SignedRewrite(edit.label().to_string()));
+        }
+        // What this edit drew with `?` (a value or comment text its font can't draw, stored as
+        // typed): reported, never silent (AGENTS.md §4).
+        let notices = if matches!(scope_of(&edit), Scope::Form | Scope::Comments | Scope::Full) {
+            guard(|| undrawn_notices(&editor.cos, &next)).unwrap_or_default()
+        } else {
+            Vec::new()
+        };
+        let previous = std::mem::replace(&mut editor.cos, next);
+        let keys = keys_after(&edit).unwrap_or_else(|| editor.keys.clone());
+        let previous_keys = std::mem::replace(&mut editor.keys, keys);
+        editor.undo.push((label, previous, previous_keys, scope));
+        if editor.undo.len() > MAX_UNDO {
+            editor.undo.remove(0);
+        }
+        editor.redo.clear();
+        Self::adopt_keys(doc);
+        let refreshed = guard(|| if scope == Scope::Content { Self::refresh_content(doc, Some(&edit)) } else { Self::refresh_scoped(doc, scope) })
+            .unwrap_or_else(|m| Err(EditError::Reopen(m)));
+        if let Err(e) = refreshed {
+            // Roll back: the edit produced something we cannot display.
+            if let Some(ed) = doc.editor.as_mut()
+                && let Some((_, prev, keys, _)) = ed.undo.pop()
+            {
+                ed.cos = prev;
+                ed.keys = keys;
+            }
+            Self::adopt_keys(doc);
+            if !matches!(guard(|| Self::refresh(doc)), Ok(Ok(()))) {
+                Self::show_released(doc);
+            }
+            return Err(e);
+        }
+        doc.dirty = true;
+        doc.generation += 1;
+        doc.edit_notices = notices;
+        if !cx.xfa_removed.is_empty() {
+            let removed: Vec<String> = cx.xfa_removed.iter().map(|n| format!("{XFA_REMOVED_PREFIX}{n}")).collect();
+            doc.xfa_warnings.retain(|w| w.starts_with(XFA_REMOVED_PREFIX));
+            note_warnings(&mut doc.xfa_warnings, &removed);
+            note_warnings(&mut doc.info.warnings, &removed);
+        }
+        note_warnings(&mut doc.xfa_warnings, &xfa_notes);
+        let notes = doc.xfa_warnings.clone();
+        note_warnings(&mut doc.info.warnings, &notes);
+        if let Some(js) = cx.js {
+            doc.js_output.append(js.output);
+        }
+        doc.js_output.append(cx.xfa_out);
+        if cx.xfa_ran_away {
+            doc.xfa_template = None;
+            doc.xfa_scripts_off = true;
+            doc.js_output.errors.push(XFA_SCRIPTS_OFF.into());
+        }
+        Ok(())
+    }
+
+    pub fn undo(&mut self, id: DocId) -> Result<Label, EditError> {
+        let doc = self.doc_mut(id)?;
+        let editor = doc.editor.as_mut().ok_or(EditError::NothingToUndo)?;
+        let (label, prev, keys, scope) = editor.undo.pop().ok_or(EditError::NothingToUndo)?;
+        let current = std::mem::replace(&mut editor.cos, prev);
+        let current_keys = std::mem::replace(&mut editor.keys, keys);
+        editor.redo.push((label.clone(), current, current_keys, scope));
+        Self::adopt_keys(doc);
+        let refreshed = guard(|| Self::refresh_scoped(doc, scope)).unwrap_or_else(|m| Err(EditError::Reopen(m)));
+        if let Err(e) = refreshed {
+            if let Some(ed) = doc.editor.as_mut()
+                && let Some((label, current, current_keys, scope)) = ed.redo.pop()
+            {
+                let prev = std::mem::replace(&mut ed.cos, current);
+                let keys = std::mem::replace(&mut ed.keys, current_keys);
+                ed.undo.push((label, prev, keys, scope));
+            }
+            Self::adopt_keys(doc);
+            if !matches!(guard(|| Self::refresh(doc)), Ok(Ok(()))) {
+                Self::show_released(doc);
+            }
+            return Err(e);
+        }
+        doc.edit_notices.clear();
+        Self::sync_dirty(doc);
+        doc.generation += 1;
+        Ok(label)
+    }
+
+    pub fn redo(&mut self, id: DocId) -> Result<Label, EditError> {
+        let doc = self.doc_mut(id)?;
+        let editor = doc.editor.as_mut().ok_or(EditError::NothingToRedo)?;
+        let (label, next, keys, scope) = editor.redo.pop().ok_or(EditError::NothingToRedo)?;
+        let current = std::mem::replace(&mut editor.cos, next);
+        let current_keys = std::mem::replace(&mut editor.keys, keys);
+        editor.undo.push((label.clone(), current, current_keys, scope));
+        Self::adopt_keys(doc);
+        let refreshed = guard(|| Self::refresh_scoped(doc, scope)).unwrap_or_else(|m| Err(EditError::Reopen(m)));
+        if let Err(e) = refreshed {
+            if let Some(ed) = doc.editor.as_mut()
+                && let Some((label, current, current_keys, scope)) = ed.undo.pop()
+            {
+                let next = std::mem::replace(&mut ed.cos, current);
+                let keys = std::mem::replace(&mut ed.keys, current_keys);
+                ed.redo.push((label, next, keys, scope));
+            }
+            Self::adopt_keys(doc);
+            if !matches!(guard(|| Self::refresh(doc)), Ok(Ok(()))) {
+                Self::show_released(doc);
+            }
+            return Err(e);
+        }
+        doc.edit_notices.clear();
+        Self::sync_dirty(doc);
+        doc.generation += 1;
+        Ok(label)
+    }
+
+    /// Unsaved when the working graph is not the last opened or saved file. Undo back to that
+    /// file is clean; undo past a later save is not, because the restored snapshot's own base
+    /// is an earlier revision.
+    pub(super) fn sync_dirty(doc: &mut Document) {
+        doc.dirty = doc.editor.as_ref().is_some_and(|e| e.unsaved_file || e.cos.is_modified() || !Arc::ptr_eq(e.cos.bytes(), &e.saved));
+    }
+
+    /// Use the current state's password for viewing (protection edits change it).
+    pub(super) fn adopt_keys(doc: &mut Document) {
+        if let Some(e) = doc.editor.as_ref() {
+            doc.password = e.keys.render.clone();
+            doc.config.password = e.keys.render.as_deref().map(Arc::from);
+        }
+    }
+
+    /// Rebuild the working bytes and the view data that `scope` may have changed. Metadata edits
+    /// keep the renderer; other scopes also replace it.
+    /// Comment and form edits skip the full re-inspection (seconds on very large files): the
+    /// comment list and field values are re-read from the object graph instead.
+    fn refresh_scoped(doc: &mut Document, scope: Scope) -> Result<(), EditError> {
+        if scope == Scope::Full || doc.info.encrypted != doc.editor.as_ref().is_some_and(|e| e.cos.output_handler().is_some()) {
+            return Self::refresh(doc);
+        }
+        if scope == Scope::Content {
+            return Self::refresh_content(doc, None);
+        }
+        if scope == Scope::Links {
+            return Self::refresh_links(doc);
+        }
+        // Metadata edits keep the renderer, which holds the working file anyway.
+        if scope != Scope::Metadata {
+            Self::release_working(doc);
+        }
+        let Some(editor) = doc.editor.as_mut() else { return Ok(()) };
+        // Comment edits, and form edits (a script may change annotation properties), may change
+        // annotation dictionaries, invalidating cached appearances.
+        if matches!(scope, Scope::Comments | Scope::Form) {
+            editor.appearances.clear();
+        }
+        let bytes = if editor.cos.is_modified() {
+            Arc::new(write_incremental(&editor.cos, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?)
+        } else {
+            editor.cos.bytes().clone()
+        };
+        if scope == Scope::Metadata {
+            for (field, value) in info_fields(&mut doc.info, &editor.cos) {
+                *field = value;
+            }
+            doc.info.custom = pdfcraft_organize::custom_info(&editor.cos);
+            doc.info.file_size = bytes.len();
+            #[cfg(test)]
+            check_refresh_panic();
+            if !doc.signatures.is_empty() {
+                let signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
+                doc.signatures = Arc::new(signatures);
+            }
+            doc.bytes = bytes;
+            return Ok(());
+        }
+        let mut form = pdfcraft_forms::fields(&editor.cos);
+        xfa::mark_script_buttons(&editor.cos, &mut form);
+        let form = Arc::new(form);
+        match scope {
+            Scope::Metadata => return Ok(()),
+            Scope::Comments => {
+                doc.info.annotations = comment_list(&editor.cos);
+                // Link indexes are positions in /Annots, so comment insertion/deletion can move them.
+                doc.links = OnceLock::new();
+            }
+            Scope::Form => {
+                // PERF: keystroke path, index once. A linear find per field is O(F^2);
+                // forms reach 10k fields.
+                let mut by_name = std::collections::HashMap::with_capacity(form.len());
+                for x in form.iter() {
+                    // First match wins (do not simplify to collect: it keeps the last).
+                    by_name.entry(x.name.as_str()).or_insert(x);
+                }
+                for f in &mut doc.info.fields {
+                    if let Some(ff) = by_name.get(f.name.as_str()) {
+                        f.value = match ff.kind {
+                            pdfcraft_forms::FieldKind::CheckBox | pdfcraft_forms::FieldKind::Radio => {
+                                Some(ff.value.first().cloned().unwrap_or_else(|| "Off".into()))
+                            }
+                            _ if ff.value.is_empty() => None,
+                            _ => Some(ff.value.join(", ")),
+                        };
+                    }
+                }
+            }
+            Scope::Links => return Self::refresh_links(doc),
+            // Handled above; kept as a full refresh so the match stays total.
+            Scope::Full => return Self::refresh(doc),
+            // Handled above (content-only refresh); the arm keeps the match total.
+            Scope::Content => return Self::refresh_content(doc, None),
+        }
+        doc.info.file_size = bytes.len();
+        doc.form = form;
+        let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache) };
+        doc.display = display_bytes(Some(editor), &bytes);
+        doc.signatures = Arc::new(signatures);
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.bytes = bytes;
+        Ok(())
+    }
+
+    /// Which derived lists a content-only edit can change: added content (`None`, from
+    /// undo/redo, re-reads both: always correct, rarely paid).
+    pub(crate) fn content_refresh_lists(edit: Option<&Edit>) -> (bool, bool) {
+        if let Some(Edit::Batch { edits, .. }) = edit {
+            // A batch of content edits (from a script, say) changes what its parts change.
+            return edits.iter().fold((false, false), |(added, marks), part| {
+                let (a, m) = Self::content_refresh_lists(Some(part));
+                (added || a, marks || m)
+            });
+        }
+        let touches_added = edit.is_none_or(|e| {
+            matches!(
+                e,
+                Edit::AddText { .. }
+                    | Edit::AddImage { .. }
+                    | Edit::UpdateContent { .. }
+                    | Edit::DeleteContent { .. }
+                    | Edit::ReplaceImage { .. }
+                    | Edit::PasteContent { .. }
+            ) || matches!(e, Edit::MoveObjects { objects, .. } if objects.iter().any(|o| o.kind == ObjectKind::Added))
+        });
+        let touches_marks = edit.is_none_or(|e| {
+            matches!(e, Edit::AddHeaderFooter { .. } | Edit::AddWatermark { .. } | Edit::AddBackground { .. } | Edit::RemoveMarks { .. })
+        });
+        (touches_added, touches_marks)
+    }
+
+    /// Rebuild working bytes, display bytes and renderer after a content-only edit: page
+    /// content streams, resources and added content/marks. The page tree, annotations, form
+    /// fields, links, outline and fonts are unchanged, so the full re-inspection (seconds on
+    /// very large files) is skipped. `edit` selects which derived lists are re-read (`None`,
+    /// from undo/redo, re-reads both: always correct, rarely paid). The cached display
+    /// appearances are kept: content edits leave every annotation dictionary alone.
+    fn refresh_content(doc: &mut Document, edit: Option<&Edit>) -> Result<(), EditError> {
+        Self::release_working(doc);
+        sync_xfa_state(doc);
+        let Some(editor) = doc.editor.as_mut() else { return Ok(()) };
+        let bytes = if editor.cos.is_modified() {
+            Arc::new(write_incremental(&editor.cos, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?)
+        } else {
+            editor.cos.bytes().clone()
+        };
+        // The edit must still leave a file the viewer can open; anything else rolls back above.
+        pdfcraft_render::check_pages(bytes.clone(), doc.password.as_deref(), doc.info.pages.len()).map_err(|e| EditError::Reopen(e.to_string()))?;
+        let (touches_added, touches_marks) = Self::content_refresh_lists(edit);
+        if touches_added || touches_marks {
+            doc.marker_scan = OnceLock::new();
+        }
+        doc.info.file_size = bytes.len();
+        let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache) };
+        doc.display = display_bytes(Some(editor), &bytes);
+        doc.signatures = Arc::new(signatures);
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.bytes = bytes;
+        doc.fonts_stale = true;
+        Ok(())
+    }
+
+    /// Let go of the working file before the next one is written (gap 13). The working file is
+    /// the original plus one appended revision, so on a 1 GiB file keeping the old one (in the
+    /// working bytes, the display bytes and the renderer) while writing the new one held three
+    /// copies at once; this keeps two. Until the refresh finishes, the working and display bytes
+    /// are the original's (already held by the editor, so free) and the renderer draws nothing.
+    /// A failed edit rolls back and refreshes again, which replaces all three; where a refresh
+    /// still fails, [`Self::show_released`] draws the original rather than nothing. Save writes
+    /// from the editor, never from these.
+    pub(crate) fn release_working(doc: &mut Document) {
+        let Some(original) = doc.editor.as_ref().map(|e| e.cos.bytes().clone()) else { return };
+        // Dropping the pool stops its workers; each lets go of the file when it exits.
+        doc.renderer = RenderPool::new_inline(Arc::new(Vec::new()), doc.config.clone());
+        doc.display = original.clone();
+        doc.bytes = original;
+        #[cfg(test)]
+        check_refresh_panic();
+    }
+
+    /// After a refresh failed: draw the display bytes it left (the original, once released),
+    /// so the page still shows a document.
+    pub(super) fn show_released(doc: &mut Document) {
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+    }
+
+    /// Rebuild working bytes, inspection and renderer from the current edit state.
+    pub(crate) fn refresh(doc: &mut Document) -> Result<(), EditError> {
+        Self::refresh_with_indexes(doc, true, true)
+    }
+
+    /// Reinspect a link edit while preserving the page-content marker scan cache.
+    fn refresh_links(doc: &mut Document) -> Result<(), EditError> {
+        Self::refresh_with_indexes(doc, false, true)
+    }
+
+    fn refresh_with_indexes(doc: &mut Document, invalidate_markers: bool, invalidate_links: bool) -> Result<(), EditError> {
+        // A full refresh may follow structural or annotation changes: cached appearances
+        // may be stale, so they are rebuilt below.
+        if let Some(editor) = doc.editor.as_mut() {
+            editor.appearances.clear();
+        }
+        Self::release_working(doc);
+        sync_xfa_state(doc);
+        let Some(editor) = doc.editor.as_mut() else { return Ok(()) };
+        let bytes = if editor.cos.is_modified() {
+            Arc::new(write_incremental(&editor.cos, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string()))?)
+        } else {
+            editor.cos.bytes().clone()
+        };
+        let info = inspect(bytes.clone(), doc.password.as_deref()).map_err(|e| EditError::Reopen(e.to_string()))?;
+        // Keep the user's layer choices where the layers still exist.
+        let mut info = info;
+        for l in &mut info.layers {
+            if let Some(old) = doc.info.layers.iter().find(|o| o.id == l.id) {
+                l.visible = old.visible;
+            }
+        }
+        note_warnings(&mut info.warnings, &doc.xfa_warnings);
+        // As in `build_document`: the inspection reads only `/Info`, so fields stated only in XMP
+        // are filled in again after every full refresh.
+        for (field, value) in info_fields(&mut info, &editor.cos) {
+            if field.is_none() {
+                *field = value;
+            }
+        }
+        doc.info = info;
+        doc.fonts_stale = false;
+        let mut form = pdfcraft_forms::fields(&editor.cos);
+        xfa::mark_script_buttons(&editor.cos, &mut form);
+        doc.form = Arc::new(form);
+        if invalidate_markers {
+            doc.marker_scan = OnceLock::new();
+        }
+        if invalidate_links {
+            doc.links = OnceLock::new();
+        }
+        let signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
+        doc.display = display_bytes(Some(editor), &bytes);
+        doc.signatures = Arc::new(signatures);
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.bytes = bytes;
+        Ok(())
+    }
+}
diff --git a/crates/engine/src/session/files.rs b/crates/engine/src/session/files.rs
new file mode 100644
index 0000000000..6d4e11d390
--- /dev/null
+++ b/crates/engine/src/session/files.rs
@@ -0,0 +1,397 @@
+use super::*;
+
+impl Session {
+    /// The page count of another PDF (Replace Pages, Insert Pages dialogs).
+    pub fn page_count_of(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<usize, EditError> {
+        Ok(pdfcraft_organize::page_count(&open_source(name, bytes)?)?)
+    }
+
+    /// A new blank document (Create ▸ Blank page).
+    pub fn create_blank(&self, width: f64, height: f64, pages: usize) -> Result<Arc<Vec<u8>>, EditError> {
+        self.write_new(&pdfcraft_create::blank(width, height, pages)?)
+    }
+
+    /// A new document with one page per image (PNG, JPEG).
+    pub fn create_from_images(&self, images: &[(String, Vec<u8>)]) -> Result<Arc<Vec<u8>>, EditError> {
+        self.write_new(&pdfcraft_create::from_images(images)?)
+    }
+
+    /// Create image pages at embedded resolution or a fixed dpi, without resampling.
+    pub fn create_from_images_with_resolution(&self, images: &[(String, Vec<u8>)], resolution: ImageResolution) -> Result<Arc<Vec<u8>>, EditError> {
+        self.write_new(&pdfcraft_create::from_images_with_resolution(images, resolution)?)
+    }
+
+    /// A new document from plain text (US Letter, 11 pt Helvetica). Text Helvetica can't draw is
+    /// refused, naming the line and the character (never set as `?`).
+    pub fn create_from_text(&self, title: &str, text: &str) -> Result<Arc<Vec<u8>>, EditError> {
+        self.write_new(&pdfcraft_create::from_text(title, text, pdfcraft_create::LETTER, 11.0)?)
+    }
+
+    /// [`Self::create_from_text`] for a report PdfCraft writes from documents (comment summaries,
+    /// compare reports), which can quote any language: characters Helvetica can't draw are written
+    /// as `[U+XXXX]`, and the report's first line says so, rather than the report being refused.
+    pub(crate) fn create_report(&self, title: &str, text: &str) -> Result<Arc<Vec<u8>>, EditError> {
+        let (doc, _escaped) = pdfcraft_create::from_text_escaped(title, text, pdfcraft_create::LETTER, 11.0)?;
+        self.write_new(&doc)
+    }
+
+    /// Convert a file Create understands (an image or plain text) to PDF bytes; a PDF is checked
+    /// (it must open and allow copying pages) and returned as it is.
+    pub fn convert_to_pdf(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<(SourceKind, Arc<Vec<u8>>), EditError> {
+        let Some(kind) = source_kind(name, bytes) else {
+            return Err(EditError::Source(format!("{name}: this file type can't be converted; use a PDF, an image or a .txt file")));
+        };
+        let title = name.rsplit_once('.').map_or(name, |(s, _)| s);
+        // Image decoders read untrusted bytes: a panic in one must not take the app down.
+        let created = guard(|| match kind {
+            SourceKind::Pdf => open_source(name, bytes).map(|_| bytes.clone()),
+            SourceKind::Image => self.create_from_images(&[(name.to_string(), bytes.to_vec())]),
+            SourceKind::Text => self.create_from_text(title, &decode_text(bytes)),
+        })
+        .map_err(|_| EditError::Source(format!("{name}: the file could not be read")))?;
+        Ok((kind, created?))
+    }
+
+    /// A file for Combine as PDF bytes: an image or text file is converted; a PDF is returned as
+    /// it is, unchecked (Combine reads it itself, with its password), as is a file named .pdf
+    /// without a `%PDF-` header, which the reader may still open.
+    pub fn as_pdf(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<Arc<Vec<u8>>, EditError> {
+        let pdf = match source_kind(name, bytes) {
+            Some(SourceKind::Pdf) => true,
+            Some(SourceKind::Image | SourceKind::Text) => false,
+            None => name.to_ascii_lowercase().ends_with(".pdf"),
+        };
+        if pdf { Ok(bytes.clone()) } else { self.convert_to_pdf(name, bytes).map(|(_, pdf)| pdf) }
+    }
+
+    /// Reduce File Size: Acrobat's defaults (images above 225 ppi to 150 ppi, JPEG medium
+    /// quality; thumbnails dropped), identical resources merged, unused objects dropped, objects
+    /// packed into compressed object streams. Returns the bytes and how many objects were
+    /// merged. The open document is not changed (Acrobat saves the reduced copy as a new file).
+    pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc<Vec<u8>>, usize), EditError> {
+        let (bytes, report) = self.optimized_bytes(id, &optimize::Settings::default(), &[])?;
+        Ok((bytes, report.merged))
+    }
+
+    /// Optimize PDF ▸ Advanced optimization: `settings` for images and objects, plus Remove
+    /// Hidden Information's `discard` categories (user data). A full rewrite: signed documents
+    /// are refused. The open document is not changed. This is [`Self::optimize_job`] run in
+    /// place, without progress.
+    pub fn optimized_bytes(&self, id: DocId, settings: &optimize::Settings, discard: &[Hidden]) -> Result<(Arc<Vec<u8>>, OptimizeReport), EditError> {
+        self.optimize_job(id, settings, discard)?.run(|_| true)
+    }
+
+    /// Export comments and/or form data: XFDF and FDF carry either or both; XML, CSV and text
+    /// are form data only.
+    pub fn export_data(&self, id: DocId, format: DataFormat, comments: bool, fields: bool) -> Result<Vec<u8>, EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        let cos = match doc.editor.as_ref() {
+            Some(e) => e.cos.clone(),
+            None => {
+                pdfcraft_cos::Document::open_with_password(doc.bytes.clone(), doc.password.as_deref()).map_err(|e| EditError::Write(e.to_string()))?
+            }
+        };
+        // An XFA form's data is its datasets, as Acrobat exports it: XML or an XDP.
+        let xfa = doc.info.xfa.is_some();
+        if format == DataFormat::Xdp && !xfa {
+            return Err(EditError::Invalid("XDP holds XFA form data; this document is not an XFA form (use .xml, .csv or .txt)".into()));
+        }
+        guard(|| match format {
+            DataFormat::Xfdf => Ok(pdfcraft_xfdf::export_xfdf(&cos, comments, fields, &doc.name).into_bytes()),
+            DataFormat::Fdf => pdfcraft_xfdf::export_fdf(&cos, comments, fields, &doc.name).map_err(|e| e.to_string()),
+            DataFormat::Xml | DataFormat::Xdp if xfa => {
+                pdfcraft_xfa::export_data(&cos, format == DataFormat::Xdp, &doc.name).map(String::into_bytes).map_err(|e| e.to_string())
+            }
+            other => Ok(pdfcraft_xfdf::export_data(&cos, other).into_bytes()),
+        })
+        .map_err(EditError::Write)?
+        .map_err(EditError::Write)
+    }
+
+    /// The print-ready PDF for `settings` (sheets laid out for the paper; see `pdfcraft-print`).
+    pub fn print_pdf(&self, id: DocId, settings: &print::Settings) -> Result<Vec<u8>, EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        if !doc.allows_printing() {
+            return Err(EditError::NotPermitted("printing"));
+        }
+        // Table 22, bit 12 clear: only a low-level representation may be printed, so the pages
+        // always go as pictures, at no more than the low resolution.
+        let low_res = doc.permissions().is_some_and(|p| !p.print_high_quality()).then(|| print::Raster {
+            dpi: settings.raster.map_or(LOW_RESOLUTION_PRINT_DPI, |r| r.dpi.min(LOW_RESOLUTION_PRINT_DPI)),
+            grayscale: settings.raster.is_some_and(|r| r.grayscale),
+        });
+        // Print as image: the pages used become pictures first, then the picture document is
+        // imposed in their place (its page k is the k-th distinct source page used).
+        if let Some(raster) = low_res.as_ref().or(settings.raster.as_ref()) {
+            let mut distinct: Vec<usize> = Vec::new();
+            for &p in &settings.pages {
+                if !distinct.contains(&p) {
+                    distinct.push(p);
+                }
+            }
+            let bytes = print_raster::rasterize(doc, &distinct, raster, settings.content).map_err(EditError::Print)?;
+            let pictures = pdfcraft_cos::Document::open(Arc::new(bytes)).map_err(|e| EditError::Print(e.to_string()))?;
+            let remapped = print::Settings {
+                pages: settings.pages.iter().map(|p| distinct.iter().position(|d| d == p).unwrap_or(0)).collect(),
+                content: print::Content::Document,
+                raster: None,
+                ..settings.clone()
+            };
+            return pdfcraft_print::impose(&pictures, &remapped).map_err(|e| EditError::Print(e.to_string()));
+        }
+        let mut cos = match doc.editor.as_ref() {
+            Some(e) => e.cos.clone(),
+            None => {
+                pdfcraft_cos::Document::open_with_password(doc.bytes.clone(), doc.password.as_deref()).map_err(|e| EditError::Write(e.to_string()))?
+            }
+        };
+        // #3046: the layers print as they are shown. Once the Layers panel (or a set-layer
+        // action) has changed one, the print copy's default configuration says which are on, so a
+        // hidden layer stays off on paper too; untouched, the document's own configuration prints.
+        if !doc.config.layers.is_empty() {
+            set_default_layer_state(&mut cos, &doc.info.layers);
+        }
+        pdfcraft_print::impose(&cos, settings).map_err(|e| EditError::Print(e.to_string()))
+    }
+
+    /// For each page, whether its text mostly runs bottom-to-top ([`pdfcraft_print::text_reads_up`]);
+    /// only `pages` are read, the others are `false`.
+    pub fn print_text_up(&self, id: DocId, pages: &[usize]) -> Vec<bool> {
+        let Some(doc) = self.get(id) else { return Vec::new() };
+        let cos = match doc.editor.as_ref() {
+            Some(e) => e.cos.clone(),
+            None => match pdfcraft_cos::Document::open_with_password(doc.bytes.clone(), doc.password.as_deref()) {
+                Ok(c) => c,
+                Err(_) => return Vec::new(),
+            },
+        };
+        (0..doc.info.pages.len()).map(|i| pages.contains(&i) && pdfcraft_print::text_reads_up(&cos, i)).collect()
+    }
+
+    /// Combine whole files, in order, into new PDF bytes (one bookmark per file).
+    pub fn combine(&self, sources: &[(String, Arc<Vec<u8>>)]) -> Result<Arc<Vec<u8>>, EditError> {
+        let docs = sources.iter().map(|(n, b)| open_source(n, b)).collect::<Result<Vec<_>, _>>()?;
+        let named: Vec<(&str, &pdfcraft_cos::Document)> = sources.iter().map(|(n, _)| n.as_str()).zip(docs.iter()).collect();
+        let out = pdfcraft_organize::combine(&named)?;
+        self.write_new(&out)
+    }
+
+    /// Combine Files with a page range per file ("1-3, 6"; `None` or empty for all pages).
+    pub fn combine_ranges(&self, sources: &[CombineSource]) -> Result<Arc<Vec<u8>>, EditError> {
+        self.combine_unlocked(sources, &[])
+    }
+
+    /// Combine sources one at a time, in order (Create ▸ Multiple files), to the same result as
+    /// [`Self::combine_ranges`]. Each item is a source's bookmark title, its PDF bytes (see
+    /// [`Self::convert_to_pdf`]) and its page range (`None` for all pages). Items are pulled one at a
+    /// time: a source is opened, its pages are copied into the result, and its bytes are released
+    /// before the next item is read. So the number of sources is not limited, and one source's
+    /// document is held at a time. An item's error stops the combine and is returned as it is.
+    /// `Ok(None)` when there are no sources.
+    pub fn combine_each<I, E>(&self, sources: I) -> Result<Option<Arc<Vec<u8>>>, E>
+    where
+        I: IntoIterator<Item = Result<CombineSource, E>>,
+        E: From<EditError>,
+    {
+        let mut combiner = pdfcraft_organize::Combiner::new();
+        let mut added = false;
+        for source in sources {
+            let (title, bytes, range) = source?;
+            let doc = open_source(&title, &bytes)?;
+            let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
+            let pages = match range {
+                Some(r) => {
+                    let n = pdfcraft_organize::page_count(&doc).map_err(EditError::from)?;
+                    let p = pdfcraft_print::select_pages(n, Some(r), &[], pdfcraft_print::Subset::All, false)
+                        .map_err(|e| EditError::Print(format!("{title}: {e}")))?;
+                    Some(p)
+                }
+                None => None,
+            };
+            combiner.add(&title, &doc, pages.as_deref()).map_err(EditError::from)?;
+            added = true;
+        }
+        if !added {
+            return Ok(None);
+        }
+        let out = combiner.finish().map_err(EditError::from)?;
+        Ok(Some(self.write_new(&out)?))
+    }
+
+    /// [`Self::combine_ranges`] with the password each encrypted source is opened with, by
+    /// position (missing or `None`: no password). The result is not encrypted.
+    pub fn combine_unlocked(&self, sources: &[CombineSource], passwords: &[Option<&str>]) -> Result<Arc<Vec<u8>>, EditError> {
+        Ok(self.combine_unlocked_reporting(sources, passwords, pdfcraft_organize::FieldConflicts::Rename)?.bytes)
+    }
+
+    /// The pre-flight over byte sources: what combining them, in order, would rename in each one
+    /// (whole files; page ranges are the combine's to apply). A source that cannot be opened
+    /// previews as nothing — its row already says why it cannot be combined.
+    pub fn combine_field_conflicts(&self, sources: &[CombineSource], passwords: &[Option<&str>]) -> Vec<Vec<(String, String)>> {
+        let docs: Vec<Option<pdfcraft_cos::Document>> =
+            sources.iter().enumerate().map(|(i, (n, b, _))| open_source_with(n, b, passwords.get(i).copied().flatten()).ok()).collect();
+        let refs: Vec<&pdfcraft_cos::Document> = docs.iter().filter_map(Option::as_ref).collect();
+        let mut opened = pdfcraft_organize::combine_field_conflicts(&refs).into_iter();
+        // One preview per source, in step with it: a file that cannot be opened has none.
+        docs.iter().map(|d| if d.is_some() { opened.next().unwrap_or_default() } else { Default::default() }).collect()
+    }
+
+    /// [`Self::combine_unlocked`] reporting what the conflict resolution renamed.
+    pub fn combine_unlocked_reporting(
+        &self,
+        sources: &[CombineSource],
+        passwords: &[Option<&str>],
+        field_conflicts: pdfcraft_organize::FieldConflicts,
+    ) -> Result<Combined, EditError> {
+        let docs = sources
+            .iter()
+            .enumerate()
+            .map(|(i, (n, b, _))| open_source_with(n, b, passwords.get(i).copied().flatten()))
+            .collect::<Result<Vec<_>, _>>()?;
+        let mut pages = Vec::with_capacity(docs.len());
+        for ((name, _, range), d) in sources.iter().zip(&docs) {
+            let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
+            pages.push(match range {
+                Some(r) => {
+                    let n = pdfcraft_organize::page_count(d)?;
+                    let p = pdfcraft_print::select_pages(n, Some(r), &[], pdfcraft_print::Subset::All, false)
+                        .map_err(|e| EditError::Print(format!("{name}: {e}")))?;
+                    Some(p)
+                }
+                None => None,
+            });
+        }
+        let named: Vec<(&str, &pdfcraft_cos::Document, Option<&[usize]>)> =
+            sources.iter().zip(docs.iter()).zip(&pages).map(|(((n, _, _), d), p)| (n.as_str(), d, p.as_deref())).collect();
+        let out = pdfcraft_organize::combine_selected_with(&named, field_conflicts)?;
+        let bytes = self.write_new(&out.doc)?;
+        Ok(Combined { bytes, renamed_fields: out.renamed_fields })
+    }
+
+    /// [`Self::combine_unlocked`] where sources with the same `groups` key (by position) are one
+    /// file split into several runs placed apart: each file is opened and copied once, so it keeps
+    /// one bookmark, its links between its own pages, its fields and its attachments whole (see
+    /// `pdfcraft_organize::combine_grouped`). A group's later sources use its first source's bytes
+    /// and password; a source without a key is a file of its own.
+    pub fn combine_grouped(&self, sources: &[CombineSource], groups: &[u64], passwords: &[Option<&str>]) -> Result<Arc<Vec<u8>>, EditError> {
+        Ok(self.combine_grouped_reporting(sources, groups, passwords, pdfcraft_organize::FieldConflicts::Rename)?.bytes)
+    }
+
+    /// [`Self::combine_grouped`] reporting what the conflict resolution renamed.
+    pub fn combine_grouped_reporting(
+        &self,
+        sources: &[CombineSource],
+        groups: &[u64],
+        passwords: &[Option<&str>],
+        field_conflicts: pdfcraft_organize::FieldConflicts,
+    ) -> Result<Combined, EditError> {
+        let (mut keys, mut docs, mut file): (Vec<Option<u64>>, Vec<pdfcraft_cos::Document>, Vec<usize>) = (Vec::new(), Vec::new(), Vec::new());
+        for (i, (name, bytes, _)) in sources.iter().enumerate() {
+            let key = groups.get(i).copied();
+            let known = key.and_then(|k| keys.iter().position(|g| *g == Some(k)));
+            let at = match known {
+                Some(at) => at,
+                None => {
+                    docs.push(open_source_with(name, bytes, passwords.get(i).copied().flatten())?);
+                    keys.push(key);
+                    docs.len() - 1
+                }
+            };
+            file.push(at);
+        }
+        let mut pages = Vec::with_capacity(sources.len());
+        for ((name, _, range), at) in sources.iter().zip(&file) {
+            let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
+            let Some(d) = docs.get(*at) else { return Err(EditError::Write(format!("{name}: not opened"))) };
+            pages.push(match range {
+                Some(r) => {
+                    let n = pdfcraft_organize::page_count(d)?;
+                    let p = pdfcraft_print::select_pages(n, Some(r), &[], pdfcraft_print::Subset::All, false)
+                        .map_err(|e| EditError::Print(format!("{name}: {e}")))?;
+                    Some(p)
+                }
+                None => None,
+            });
+        }
+        let mut runs: Vec<pdfcraft_organize::Run<'_>> = Vec::with_capacity(sources.len());
+        for (((name, _, _), at), p) in sources.iter().zip(&file).zip(&pages) {
+            let Some(d) = docs.get(*at) else { return Err(EditError::Write(format!("{name}: not opened"))) };
+            runs.push((*at, name.as_str(), d, p.as_deref()));
+        }
+        let out = pdfcraft_organize::combine_grouped_with(&runs, field_conflicts)?;
+        let bytes = self.write_new(&out.doc)?;
+        Ok(Combined { bytes, renamed_fields: out.renamed_fields })
+    }
+
+    /// New PDF bytes containing copies of `pages` of the document (Extract Pages).
+    pub fn extract(&self, id: DocId, pages: &[usize]) -> Result<Arc<Vec<u8>>, EditError> {
+        let src = self.cos(id)?;
+        if src.permissions().is_some_and(|p| !p.assemble()) {
+            return Err(EditError::NotPermitted("extracting pages"));
+        }
+        let out = pdfcraft_organize::extract_pages(src, pages)?;
+        self.write_new(&out)
+    }
+
+    /// Split the document into several new PDFs.
+    pub fn split(&self, id: DocId, by: &pdfcraft_organize::SplitBy) -> Result<Vec<SplitPart>, EditError> {
+        let src = self.cos(id)?;
+        if src.permissions().is_some_and(|p| !p.assemble()) {
+            return Err(EditError::NotPermitted("splitting the document"));
+        }
+        let n = pdfcraft_organize::page_count(src)?;
+        pdfcraft_organize::split_ranges(n, by)
+            .into_iter()
+            .map(|r| {
+                let doc = pdfcraft_organize::extract_pages(src, &r.clone().collect::<Vec<_>>())?;
+                Ok((r.start + 1, r.end, self.write_new(&doc)?))
+            })
+            .collect()
+    }
+
+    /// Split into parts of at most `max_bytes` each (Acrobat's "File size"): pages are taken in
+    /// order while their size (as single-page files, an over-estimate because shared fonts and
+    /// images count once per part) fits; a page larger than the limit is a part of its own.
+    pub fn split_by_size(&self, id: DocId, max_bytes: usize) -> Result<Vec<SplitPart>, EditError> {
+        let src = self.cos(id)?;
+        if src.permissions().is_some_and(|p| !p.assemble()) {
+            return Err(EditError::NotPermitted("splitting the document"));
+        }
+        let n = pdfcraft_organize::page_count(src)?;
+        let mut cuts = Vec::new();
+        let mut used = 0usize;
+        for p in 0..n {
+            let size = self.write_unchecked(&pdfcraft_organize::extract_pages(src, &[p])?)?.len();
+            if used > 0 && used + size > max_bytes {
+                cuts.push(p);
+                used = 0;
+            }
+            used += size;
+        }
+        self.split(id, &pdfcraft_organize::SplitBy::Before(cuts))
+    }
+
+    fn cos(&self, id: DocId) -> Result<&pdfcraft_cos::Document, EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        doc.editor.as_ref().map(|e| &e.cos).ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))
+    }
+
+    /// A new file (Combine, Extract, Split, Create) as bytes, checked like a save before anyone
+    /// writes it (#1698, #2166): it reopens, and shows the pages it was built from.
+    fn write_new(&self, doc: &pdfcraft_cos::Document) -> Result<Arc<Vec<u8>>, EditError> {
+        let bytes = self.write_unchecked(doc)?;
+        let expected = pdfcraft_organize::page_count(doc)?;
+        pdfcraft_cos::Document::open(bytes.clone()).map_err(|e| EditError::Reopen(e.to_string()))?;
+        pdfcraft_render::check_pages(bytes.clone(), None, expected).map_err(|e| EditError::Reopen(e.to_string()))?;
+        Ok(bytes)
+    }
+
+    /// [`Self::write_new`] without the check, for bytes nobody writes: measuring a part's size.
+    /// Like a save, a new file never carries a typed Password-field value (#3926): Extract and
+    /// Split copy the fields of the pages they take.
+    fn write_unchecked(&self, doc: &pdfcraft_cos::Document) -> Result<Arc<Vec<u8>>, EditError> {
+        let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
+        let doc = writable(doc)?;
+        write_full(&doc, &opts).map(Arc::new).map_err(|e| EditError::Write(e.to_string()))
+    }
+}
diff --git a/crates/engine/src/session/save.rs b/crates/engine/src/session/save.rs
new file mode 100644
index 0000000000..23994aee37
--- /dev/null
+++ b/crates/engine/src/session/save.rs
@@ -0,0 +1,335 @@
+use super::*;
+
+impl Session {
+    /// The bytes to write for Save: an incremental update of the file as opened/last saved,
+    /// with `/ModDate` stamped. Call `mark_saved` after writing them successfully.
+    ///
+    /// A file whose cross-reference data had to be rebuilt is written in full even when nothing
+    /// was edited: its bytes as opened are the damaged file, and this save is how the repair the
+    /// user was told about reaches the disk (#1937). Not a signed one: a full rewrite would
+    /// break its signatures, so with no edits it keeps its bytes, damage and all.
+    pub fn save_bytes(&self, id: DocId) -> Result<Arc<Vec<u8>>, EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        let Some(editor) = doc.editor.as_ref() else { return Ok(doc.bytes.clone()) };
+        let on_saved = Arc::ptr_eq(editor.cos.bytes(), &editor.saved);
+        if !editor.cos.is_modified() && on_saved && (!editor.cos.reconstructed() || doc.is_signed()) {
+            return Ok(editor.saved.clone());
+        }
+        // What the user removed again before saving (a cleared redaction mark) stays out of the file.
+        let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), drop_unlinked: true, ..SaveOptions::default() };
+        // A restored snapshot can be based on an earlier revision. Append to the last saved
+        // file so that revision stays in the chain. A full rewrite (redaction, new encryption,
+        // a reconstructed file) still writes the current graph on its own.
+        let rewrite = editor.cos.full_save_required() || editor.cos.encryption_changed() || editor.cos.revisions().is_empty();
+        let cos = writable(&editor.cos)?;
+        guard(|| {
+            if on_saved || rewrite {
+                write_incremental(&cos, &opts)
+            } else {
+                let mut base = pdfcraft_cos::Document::open_with_password(editor.saved.clone(), editor.saved_keys.reopen.as_deref())?;
+                base.overlay_changes_from(&cos)?;
+                write_incremental(&base, &opts)
+            }
+        })
+        .map_err(EditError::Write)?
+        .map(Arc::new)
+        .map_err(|e| EditError::Write(e.to_string()))
+    }
+
+    /// A compact, garbage-collected rewrite (Save As ▸ "Optimized" / Reduce File Size groundwork).
+    pub fn save_full_bytes(&self, id: DocId) -> Result<Arc<Vec<u8>>, EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        if doc.is_signed() {
+            return Err(EditError::Signed);
+        }
+        let editor = doc.editor.as_ref().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
+        let opts = SaveOptions { mod_date: self.now().map(pdfcraft_cos::pdf_date), ..SaveOptions::default() };
+        let cos = writable(&editor.cos)?;
+        guard(|| write_full(&cos, &opts)).map_err(EditError::Write)?.map(Arc::new).map_err(|e| EditError::Write(e.to_string()))
+    }
+
+    /// Check that `bytes`, from [`Self::save_bytes`] or [`Self::save_full_bytes`], reopen as this
+    /// document before they are written (#1698): [`Self::mark_saved`] only finds out after the
+    /// file has been replaced. Same error as `mark_saved`.
+    pub fn check_save(&self, id: DocId, bytes: &Arc<Vec<u8>>) -> Result<(), EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        let Some(editor) = doc.editor.as_ref() else { return Ok(()) };
+        pdfcraft_cos::Document::open_with_password(bytes.clone(), editor.keys.reopen.as_deref()).map_err(|e| EditError::Reopen(e.to_string()))?;
+        pdfcraft_render::check_pages(bytes.clone(), doc.password.as_deref(), doc.info.pages.len()).map_err(|e| EditError::Reopen(e.to_string()))
+    }
+
+    /// Record a successful save of `bytes` (to `path`, if any): rebase editing on the saved file
+    /// so the next save appends only newer edits. Undo history is kept.
+    pub fn mark_saved(&mut self, id: DocId, bytes: Arc<Vec<u8>>, path: Option<String>) -> Result<(), EditError> {
+        let doc = self.doc_mut(id)?;
+        if let Some(editor) = doc.editor.as_mut() {
+            // An encrypted file needs the password it is protected with now (the owner
+            // password when known, so saving never downgrades this session's rights).
+            let keys = editor.keys.clone();
+            // The saved file carries no Password-field values (#3943, #3944); the open document keeps them.
+            let typed = pdfcraft_forms::password_values(&editor.cos);
+            editor.cos =
+                pdfcraft_cos::Document::open_with_password(bytes.clone(), keys.reopen.as_deref()).map_err(|e| EditError::Reopen(e.to_string()))?;
+            pdfcraft_forms::restore_password_values(&mut editor.cos, &typed).map_err(|e| EditError::Reopen(e.to_string()))?;
+            if !typed.is_empty() && doc.info.xfa.is_some() {
+                let mut datasets = None;
+                let _ = xfa_sync_datasets(&mut editor.cos, doc.xfa_template.as_deref(), &mut datasets);
+            }
+            editor.saved = bytes;
+            editor.saved_keys = keys;
+            editor.unsaved_file = false;
+        }
+        if let Some(p) = path {
+            doc.name = std::path::Path::new(&p).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| p.clone());
+            doc.path = Some(p);
+        }
+        doc.dirty = false;
+        doc.generation += 1;
+        Self::refresh(doc).inspect_err(|_| Self::show_released(doc))
+    }
+
+    /// Enter the permissions (owner) password of a document opened with its user password,
+    /// lifting its restrictions for this session (Acrobat asks for it before changing security).
+    /// Not an edit: nothing is marked unsaved and there is no undo step. Undo and redo states
+    /// are unlocked as well, and saving keeps the rights. Unencrypted documents and documents
+    /// opened by the owner need nothing.
+    pub fn unlock(&mut self, id: DocId, password: &str) -> Result<(), EditError> {
+        let doc = self.doc_mut(id)?;
+        let editor = doc.editor.as_mut().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
+        if editor.cos.permissions().is_none_or(|p| p.owner) {
+            return Ok(());
+        }
+        editor.cos.unlock(password).map_err(|e| match e {
+            pdfcraft_cos::CosError::WrongPassword => EditError::WrongPassword,
+            other => EditError::Protection(other.to_string()),
+        })?;
+        // Saving a state that keeps the security it was opened with reopens it with the same
+        // passwords, so it reopens as owner.
+        let reopen_as_owner = |cos: &pdfcraft_cos::Document, keys: &mut Keys| {
+            if !cos.encryption_changed() {
+                keys.reopen = Some(password.to_owned());
+            }
+        };
+        reopen_as_owner(&editor.cos, &mut editor.keys);
+        // Other states with the same restricted access are unlocked too; states opened with
+        // other passwords (protection changed and saved since) stay as they are.
+        for (_, cos, keys, _) in editor.undo.iter_mut().chain(editor.redo.iter_mut()) {
+            if cos.permissions().is_some_and(|p| !p.owner) && cos.unlock(password).is_ok() {
+                reopen_as_owner(cos, keys);
+            }
+        }
+        Ok(())
+    }
+
+    /// File ▸ Revert: back to the last saved version (or the file as opened). Undo history is
+    /// cleared, as in Acrobat.
+    pub fn revert(&mut self, id: DocId) -> Result<(), EditError> {
+        let doc = self.doc_mut(id)?;
+        let editor = doc.editor.as_mut().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
+        let base = editor.saved.clone();
+        // The saved file opens with the passwords it was saved with. The current snapshot may
+        // be an older revision (undo past that save), so its own base is not the saved file.
+        let mut candidates = vec![editor.saved_keys.clone(), editor.keys.clone()];
+        candidates.extend(editor.undo.iter().rev().map(|s| s.2.clone()));
+        candidates.push(Keys::default());
+        let (cos, keys) = candidates
+            .into_iter()
+            .find_map(|k| pdfcraft_cos::Document::open_with_password(base.clone(), k.reopen.as_deref()).ok().map(|c| (c, k)))
+            .ok_or_else(|| EditError::Reopen("the saved file can't be opened".into()))?;
+        editor.cos = cos;
+        editor.keys = keys;
+        editor.undo.clear();
+        editor.redo.clear();
+        Self::adopt_keys(doc);
+        Self::sync_dirty(doc);
+        doc.generation += 1;
+        Self::refresh(doc).inspect_err(|_| Self::show_released(doc))
+    }
+
+    /// The document's file changed on disk (a LaTeX or Typst build rewrote it, #431): open
+    /// `bytes`, the file as it is now, in its place. Everything opening does runs again (XFA
+    /// layout and scripts, signatures, repairs), but the document keeps its id, name and path,
+    /// so its tab and view stay with it. Undo history goes, as with Revert. The password it was
+    /// opened with is tried; on any failure the document is left as it was.
+    pub fn reload(&mut self, id: DocId, bytes: Arc<Vec<u8>>) -> Result<(), OpenError> {
+        let old = self.docs.iter().position(|d| d.id == id).ok_or_else(|| OpenError::Invalid("the document is not open".into()))?;
+        let doc = &self.docs[old];
+        let (name, path, generation) = (doc.name.clone(), doc.path.clone(), doc.generation);
+        let password = doc.editor.as_ref().and_then(|e| e.keys.reopen.clone()).or_else(|| doc.password.clone());
+        let new_id = self.open(name, path, bytes, password.as_deref())?;
+        let at = self.docs.iter().position(|d| d.id == new_id).ok_or_else(|| OpenError::Invalid("the new version was not kept".into()))?;
+        let mut doc = self.docs.remove(at);
+        doc.id = id;
+        // How the document is shown is the reader's, not the file's: reading colours and hidden
+        // comments stay as they were (#3443). `open` built the renderer with the defaults.
+        if let Some(old) = self.docs.get(old)
+            && (doc.config.reading_colors != old.config.reading_colors || doc.config.hide_comments != old.config.hide_comments)
+        {
+            doc.config.reading_colors = old.config.reading_colors;
+            doc.config.hide_comments = old.config.hide_comments;
+            doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        }
+        // Caches keyed by the edit generation (edit lines, images, measurements) must see a new
+        // one; there is nothing new to autosave.
+        doc.generation = generation + 1;
+        doc.snapshot_generation = doc.generation;
+        // `open` pushed the new version last, so the old one is still at `old`.
+        *self.docs.get_mut(old).ok_or_else(|| OpenError::Invalid("the document is not open".into()))? = doc;
+        Ok(())
+    }
+
+    /// Whether a changed document still needs a recovery snapshot. This does not consume it.
+    pub fn has_pending_autosave(&self) -> bool {
+        self.docs.iter().any(|d| d.dirty && d.generation != d.snapshot_generation)
+    }
+
+    /// Documents with unsaved changes made since the last call: their current working file,
+    /// for crash recovery. Encrypted documents stay encrypted in the snapshot.
+    pub fn autosave_snapshots(&mut self) -> Vec<RecoverySnapshot> {
+        let mut out = Vec::new();
+        for d in &mut self.docs {
+            if d.dirty && d.generation != d.snapshot_generation {
+                // The working bytes hold typed Password-field values (#3926, #3944): a recovery file
+                // is written from a copy without them, and none is written if that copy fails.
+                let bytes =
+                    match d.editor.as_ref().filter(|e| pdfcraft_forms::has_password_values(&e.cos) || pdfcraft_xfa::has_password_values(&e.cos)) {
+                        Some(e) => match writable(&e.cos)
+                            .and_then(|c| write_incremental(&c, &SaveOptions::default()).map_err(|e| EditError::Write(e.to_string())))
+                        {
+                            Ok(b) => Arc::new(b),
+                            Err(_) => continue,
+                        },
+                        None => d.bytes.clone(),
+                    };
+                d.snapshot_generation = d.generation;
+                out.push(RecoverySnapshot {
+                    doc: d.id,
+                    name: d.name.clone(),
+                    path: d.path.clone(),
+                    bytes,
+                    encrypted: d.info.encrypted || d.editor.as_ref().is_some_and(|e| e.cos.security().is_some()),
+                });
+            }
+        }
+        out
+    }
+
+    /// Mark a document opened from a recovery file: it has unsaved changes and belongs at
+    /// `path` (where Save writes), as when the session ended.
+    pub fn mark_recovered(&mut self, id: DocId, path: Option<String>) {
+        if let Some(d) = self.docs.iter_mut().find(|d| d.id == id) {
+            d.path = path;
+            d.dirty = true;
+            if let Some(e) = d.editor.as_mut() {
+                e.unsaved_file = true;
+            }
+            d.generation += 1;
+            d.snapshot_generation = d.generation; // its bytes are already in the recovery store
+        }
+    }
+
+    /// The certificates trusted for signing.
+    pub fn trusted_certificates(&self) -> &[pdfcraft_sign::Certificate] {
+        &self.trust.certs
+    }
+
+    /// Replace the trusted certificates, revalidate every open document's signatures,
+    /// and rebuild its display copy and renderer to match (working file untouched,
+    /// generation/dirty unchanged: trust alone is not an edit).
+    pub fn set_trusted_certificates(&mut self, certs: Vec<pdfcraft_sign::Certificate>) {
+        self.trust = Arc::new(TrustStore { certs });
+        for doc in &mut self.docs {
+            doc.trust = self.trust.clone();
+            let Some(editor) = doc.editor.as_mut() else { continue };
+            // Keep verdict refresh and renderer refresh together. Viewer caches are
+            // invalidated by the UI trust path; trust alone changes no document artwork.
+            let signatures = if doc.signatures.is_empty() { Vec::new() } else { signatures_of(&editor.cos, &doc.bytes, &doc.trust, &doc.sig_cache) };
+            doc.display = display_bytes(Some(editor), &doc.bytes);
+            doc.signatures = Arc::new(signatures);
+            doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        }
+    }
+
+    /// The signing time as a PDF date in local time with its offset (`D:…+02'00'`).
+    pub fn signing_date(&self) -> String {
+        let offset = self.local_offset();
+        let local = pdfcraft_cos::pdf_date(self.now().unwrap_or(0) + offset);
+        let stamp = local.trim_end_matches('Z');
+        if offset == 0 {
+            return format!("{stamp}Z");
+        }
+        let (sign, m) = if offset < 0 { ('-', -offset / 60) } else { ('+', offset / 60) };
+        format!("{stamp}{sign}{:02}'{:02}'", m / 60, m % 60)
+    }
+
+    /// Sign the document's current state with `id` (Use a certificate ▸ Digitally sign). Returns
+    /// the signed file; the caller saves it and then calls [`Session::mark_signed`]. An empty
+    /// `opts.date` takes the session clock.
+    pub fn sign(&self, doc: DocId, id: &pdfcraft_sign::DigitalId, mut opts: SignOptions) -> Result<Arc<Vec<u8>>, EditError> {
+        let d = self.get(doc).ok_or(EditError::NoDocument)?;
+        // Encrypted documents are signed under their permissions (the signer checks them).
+        let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
+        if opts.date.is_empty() {
+            opts.date = self.signing_date();
+        }
+        // A typed Password-field value is not signed into the file (#3926), as it isn't saved.
+        let cos = writable(&editor.cos)?;
+        Ok(Arc::new(pdfcraft_sign::sign(&cos, id, &opts)?))
+    }
+
+    /// [`Session::sign`], embedding an RFC 3161 signature timestamp (PAdES B-T) produced by
+    /// `tsa`. The transport lives with the caller; the engine never opens a socket.
+    pub fn sign_with_timestamp(
+        &self,
+        doc: DocId,
+        id: &pdfcraft_sign::DigitalId,
+        mut opts: SignOptions,
+        tsa: &dyn pdfcraft_sign::TimestampAuthority,
+    ) -> Result<Arc<Vec<u8>>, EditError> {
+        let d = self.get(doc).ok_or(EditError::NoDocument)?;
+        let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
+        if opts.date.is_empty() {
+            opts.date = self.signing_date();
+        }
+        let cos = writable(&editor.cos)?;
+        let signed = Arc::new(pdfcraft_sign::sign_with_timestamp(&cos, id, &opts, tsa)?);
+        // Checked like a save before anyone writes it (#2166).
+        self.check_save(doc, &signed)?;
+        Ok(signed)
+    }
+
+    /// Append a standalone document timestamp (RFC 3161, `/ETSI.RFC3161`) covering the file's
+    /// current state. An empty `date` takes the session clock; the transport is the caller's.
+    pub fn timestamp_document(&self, doc: DocId, tsa: &dyn pdfcraft_sign::TimestampAuthority, date: String) -> Result<Arc<Vec<u8>>, EditError> {
+        let d = self.get(doc).ok_or(EditError::NoDocument)?;
+        let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
+        let date = if date.is_empty() { self.signing_date() } else { date };
+        let cos = writable(&editor.cos)?;
+        let stamped = Arc::new(pdfcraft_sign::timestamp_document(&cos, tsa, &date)?);
+        self.check_save(doc, &stamped)?;
+        Ok(stamped)
+    }
+
+    /// Embed revocation evidence into the catalog's `/DSS` with `/VRI` entries per signature
+    /// (PAdES B-LT): an incremental update that never rewrites signed bytes.
+    pub fn embed_ltv(&self, doc: DocId, evidence: &pdfcraft_sign::dss::Evidence) -> Result<Arc<Vec<u8>>, EditError> {
+        let d = self.get(doc).ok_or(EditError::NoDocument)?;
+        let editor = d.editor.as_ref().ok_or_else(|| EditError::ReadOnly(d.read_only_reason.clone().unwrap_or_default()))?;
+        let cos = writable(&editor.cos)?;
+        let embedded = Arc::new(pdfcraft_sign::dss::embed(&cos, evidence)?);
+        self.check_save(doc, &embedded)?;
+        Ok(embedded)
+    }
+
+    /// Record that the signed file `bytes` was saved (to `path`): like [`Session::mark_saved`],
+    /// and the edit history before signing is dropped (signing can't be undone).
+    pub fn mark_signed(&mut self, id: DocId, bytes: Arc<Vec<u8>>, path: Option<String>) -> Result<(), EditError> {
+        self.mark_saved(id, bytes, path)?;
+        let doc = self.doc_mut(id)?;
+        if let Some(e) = doc.editor.as_mut() {
+            e.undo.clear();
+            e.redo.clear();
+        }
+        Ok(())
+    }
+}
diff --git a/crates/engine/src/session/view.rs b/crates/engine/src/session/view.rs
new file mode 100644
index 0000000000..cef539189a
--- /dev/null
+++ b/crates/engine/src/session/view.rs
@@ -0,0 +1,304 @@
+use super::*;
+
+impl Session {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Use a fixed clock (tests) instead of the system time.
+    pub fn with_clock(mut self, clock: fn() -> i64) -> Self {
+        self.clock = Some(clock);
+        self
+    }
+
+    /// Multiply the time an XFA form's scripts may take by `factor` (tests): the 3 s the
+    /// scripts of an opening or a change share, the 5 s of a click's, the 10 s the script
+    /// engine has to start, and each script's own 1 s or 3 s. A test that checks what the
+    /// scripts do passes a large factor, so that a busy machine does not stop them. On native
+    /// builds, 0 stops every script before it starts; the wasm build has no wall clock, so
+    /// there the factor has no effect.
+    pub fn with_xfa_time_scale(mut self, factor: u32) -> Self {
+        self.xfa_time_scale = Some(factor);
+        self
+    }
+
+    /// A real clock for a host that has neither a clock nor a time zone of its own (a
+    /// `wasm32-unknown-unknown` build: `now()` would be empty and `local_utc_offset()` is 0, so
+    /// Fill & Sign stamps 1 Jan 1970 and `/ModDate` is never written). `clock` is the UTC time in
+    /// seconds since the epoch; `utc_offset` is the local zone's seconds east of UTC, asked on every
+    /// use because the zone changes with the date (daylight saving). Unlike
+    /// [`Session::with_clock`], which is a test shortcut, nothing here is taken as local time.
+    pub fn with_wall_clock(mut self, clock: fn() -> i64, utc_offset: fn() -> i64) -> Self {
+        self.clock = Some(clock);
+        self.utc_offset = Some(utc_offset);
+        self
+    }
+
+    /// Seconds to add to UTC for the local time of this session: the injected zone, else 0 under
+    /// the test clock (which is already local), else the system's.
+    pub(super) fn local_offset(&self) -> i64 {
+        match (self.utc_offset, self.clock) {
+            (Some(zone), _) => zone(),
+            (None, Some(_)) => 0,
+            (None, None) => local_utc_offset(),
+        }
+    }
+
+    /// Seconds since the Unix epoch from the session clock (0 when unknown).
+    pub fn now_secs(&self) -> i64 {
+        self.now().unwrap_or(0)
+    }
+
+    pub(crate) fn now(&self) -> Option<i64> {
+        if let Some(c) = self.clock {
+            return Some(c());
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        return std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).ok().map(|d| d.as_secs() as i64);
+        #[cfg(target_arch = "wasm32")]
+        return None;
+    }
+
+    /// Today's date in local time: (year, month, day). With an injected clock (tests) the clock
+    /// is taken as local time.
+    /// A dynamic stamp's second line: "By Ada at 2:14 pm, Oct 02, 2026" (local time).
+    pub fn stamp_by_line(&self, author: &str) -> String {
+        let offset = self.local_offset();
+        let d = self.now().map(|t| pdfcraft_cos::pdf_date(t + offset)).unwrap_or_default();
+        let num = |a: usize, b: usize| d.get(a..b).and_then(|s| s.parse::<u32>().ok()).unwrap_or(0);
+        let (y, mo, day, hh, mm) = (num(2, 6), num(6, 8), num(8, 10), num(10, 12), num(12, 14));
+        const MONTHS: [&str; 12] = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+        let h12 = if hh % 12 == 0 { 12 } else { hh % 12 };
+        let who = if author.trim().is_empty() { String::new() } else { format!("By {} ", author.trim()) };
+        format!("{who}at {h12}:{mm:02} {}, {} {day:02}, {y}", if hh < 12 { "am" } else { "pm" }, MONTHS[(mo.clamp(1, 12) - 1) as usize])
+    }
+
+    pub fn today(&self) -> (i64, u32, u32) {
+        let offset = self.local_offset();
+        self.now().map(|t| pdfcraft_cos::pdf_date(t + offset)).as_deref().and_then(parse_ymd).unwrap_or((1970, 1, 1))
+    }
+
+    /// Open a document from bytes. Rendering starts lazily when pages are requested.
+    ///
+    /// `password` is tried as either the user or owner password when the file is encrypted.
+    /// Open saved revision `n` (1 = the oldest) of a document as a new, unsaved document named
+    /// "<name> (revision n)".
+    pub fn open_revision(&mut self, id: DocId, n: usize) -> Result<DocId, String> {
+        let doc = self.get(id).ok_or("no such document")?;
+        let ends = doc.revision_ends();
+        let end = *n.checked_sub(1).and_then(|i| ends.get(i)).ok_or_else(|| format!("the document has {} revision(s)", ends.len()))?;
+        let name = format!("{} (revision {n}).pdf", doc.name.trim_end_matches(".pdf"));
+        let (bytes, password) = (Arc::new(doc.bytes[..end.min(doc.bytes.len())].to_vec()), doc.password.clone());
+        self.open(name, None, bytes, password.as_deref()).map_err(|e| e.to_string())
+    }
+
+    pub(crate) fn doc_mut(&mut self, id: DocId) -> Result<&mut Document, EditError> {
+        self.docs.iter_mut().find(|d| d.id == id).ok_or(EditError::NoDocument)
+    }
+
+    /// Web addresses in the text of every page (Create links from URLs): (page, one rectangle
+    /// per line in user space, URI). Text that already has a link over it is skipped.
+    pub fn find_urls(&self, id: DocId) -> Vec<(usize, Vec<[f64; 4]>, String)> {
+        let Some(doc) = self.get(id) else { return Vec::new() };
+        let config = RenderConfig { password: doc.password.as_deref().map(Arc::from), ..Default::default() };
+        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), config);
+        let mut out = Vec::new();
+        for page in 0..doc.info.pages.len() {
+            let res = r.render(pdfcraft_render::RenderRequest { page, kind: pdfcraft_render::RequestKind::Text, scale: 1.0, ..Default::default() });
+            let Some(text) = res.text else { continue };
+            let found: std::cell::RefCell<Vec<(std::ops::Range<usize>, String)>> = Default::default();
+            let hits = text.find_with(|chars| {
+                let urls = pdfcraft_annot::links::find_urls(chars);
+                let ranges = urls.iter().map(|u| u.0.clone()).collect();
+                *found.borrow_mut() = urls;
+                ranges
+            });
+            for (glyphs, (_, uri)) in hits.into_iter().zip(found.into_inner()) {
+                let rects: Vec<[f64; 4]> = text
+                    .line_rects(glyphs)
+                    .into_iter()
+                    .map(|v| {
+                        let q = doc.info.pages[page].view_rect_to_quad(v);
+                        let xs = [q[0], q[2], q[4], q[6]];
+                        let ys = [q[1], q[3], q[5], q[7]];
+                        [
+                            xs.iter().copied().fold(f64::MAX, f64::min),
+                            ys.iter().copied().fold(f64::MAX, f64::min),
+                            xs.iter().copied().fold(f64::MIN, f64::max),
+                            ys.iter().copied().fold(f64::MIN, f64::max),
+                        ]
+                    })
+                    .filter(|r| {
+                        !doc.links().iter().any(|l| l.page == page && l.rect[0] < r[2] && r[0] < l.rect[2] && l.rect[1] < r[3] && r[1] < l.rect[3])
+                    })
+                    .collect();
+                if !rects.is_empty() {
+                    out.push((page, rects, uri));
+                }
+            }
+        }
+        out
+    }
+
+    /// A page of the bookmark list in outline order: up to `limit` bookmarks from position `offset`.
+    /// The document's own structure is read for it, so every bookmark can be reached by paging.
+    pub fn bookmark_page(&self, id: DocId, offset: usize, limit: usize) -> Option<BookmarkPage> {
+        let doc = self.get(id)?;
+        if let Some(editor) = doc.editor.as_ref() {
+            let page = pdfcraft_organize::bookmark_page(&editor.cos, offset, limit);
+            let rows = page
+                .bookmarks
+                .into_iter()
+                .map(|b| {
+                    let view = b.view.map_or_else(Default::default, |(kind, numbers)| {
+                        let numbers: Vec<Option<f32>> = numbers.iter().map(|n| n.map(|n| n as f32)).collect();
+                        pdfcraft_render::DestView::from_operands(Some(&kind), &numbers)
+                    });
+                    BookmarkRow { path: b.path, title: b.title, open: b.open, page: b.page, view, color: b.color, italic: b.italic, bold: b.bold }
+                })
+                .collect();
+            return Some(BookmarkPage { rows, next: page.next, truncated: false });
+        }
+        let all = outline_rows(&doc.info.outline);
+        let end = offset.saturating_add(limit);
+        let rows = all.iter().skip(offset).take(limit).cloned().collect();
+        Some(BookmarkPage { rows, next: (end < all.len()).then_some(end), truncated: doc.info.outline_more })
+    }
+
+    /// Top-level bookmarks as split points: (first page of each part, its bookmark's title).
+    pub fn bookmark_splits(&self, id: DocId) -> Vec<(usize, String)> {
+        let Some(doc) = self.get(id) else { return Vec::new() };
+        let top: Vec<(Option<usize>, String)> = match doc.editor.as_ref() {
+            Some(editor) => pdfcraft_organize::top_level_bookmarks(&editor.cos).into_iter().map(|b| (b.page, b.title)).collect(),
+            None => doc.info.outline.iter().map(|o| (o.page, o.title.clone())).collect(),
+        };
+        let mut out: Vec<(usize, String)> = top.into_iter().filter_map(|(page, title)| Some((page?, title))).collect();
+        out.sort_by_key(|x| x.0);
+        out.dedup_by_key(|x| x.0);
+        out
+    }
+
+    /// Open freshly created bytes (combine / extract) as a new, unsaved document.
+    pub fn open_new(&mut self, name: impl Into<String>, bytes: Arc<Vec<u8>>) -> Result<DocId, OpenError> {
+        let id = self.open(name, None, bytes, None)?;
+        if let Some(d) = self.docs.iter_mut().find(|d| d.id == id) {
+            d.dirty = true;
+            if let Some(e) = d.editor.as_mut() {
+                e.unsaved_file = true;
+            }
+            // Unsaved work with no edit yet still needs its first recovery snapshot.
+            d.generation += 1;
+        }
+        Ok(id)
+    }
+
+    /// Show or hide a layer (optional content group) for viewing. Returns `true` if it changed;
+    /// callers must drop cached rasters and text for the document.
+    pub fn set_layer_visible(&mut self, id: DocId, layer: usize, visible: bool) -> bool {
+        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
+        let Some(l) = doc.info.layers.get_mut(layer) else { return false };
+        if l.visible == visible {
+            return false;
+        }
+        l.visible = visible;
+        use_layer_choices(doc);
+        true
+    }
+
+    /// Run a set-layer-visibility action (`SetOCGState`): apply `changes` in order, naming each
+    /// layer by its optional content group; groups that aren't layers are skipped. With
+    /// `preserve_rb`, a layer turned on turns off the other layers of its radio-button groups.
+    /// Returns `true` if any layer changed; callers must drop cached rasters and text for the
+    /// document, as for [`Self::set_layer_visible`].
+    pub fn set_layer_state(&mut self, id: DocId, changes: &[(LayerOp, (u32, u16))], preserve_rb: bool) -> bool {
+        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
+        if !apply_layer_state(&mut doc.info.layers, &doc.info.layer_groups, changes, preserve_rb) {
+            return false;
+        }
+        use_layer_choices(doc);
+        true
+    }
+
+    /// Show each layer as the file opens (Acrobat's Layers ▸ Reset to Initial Visibility). Returns
+    /// `true` if any layer changed; callers must drop cached rasters and text for the document,
+    /// as for [`Self::set_layer_visible`].
+    pub fn reset_layers(&mut self, id: DocId) -> bool {
+        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
+        let mut changed = false;
+        for l in &mut doc.info.layers {
+            changed |= l.visible != l.initial;
+            l.visible = l.initial;
+        }
+        if changed {
+            use_layer_choices(doc);
+        }
+        changed
+    }
+
+    /// Hide or show every comment on the page (Acrobat's Comments ▸ Hide all comments). Form
+    /// fields and links still draw. Returns whether anything changed.
+    pub fn set_hide_comments(&mut self, id: DocId, hide: bool) -> bool {
+        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
+        if doc.config.hide_comments == hide {
+            return false;
+        }
+        doc.config.hide_comments = hide;
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.generation += 1;
+        true
+    }
+
+    /// Set the document's reading colours (Acrobat's Replace Document Colors). Returns whether
+    /// anything changed; callers must drop cached rasters and text for the document.
+    pub fn set_reading_colors(&mut self, id: DocId, colors: ReadingColors) -> bool {
+        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return false };
+        if doc.config.reading_colors == colors {
+            return false;
+        }
+        doc.config.reading_colors = colors;
+        doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), doc.config.clone());
+        doc.generation += 1;
+        true
+    }
+
+    /// The document's reading-colours setting; `None` when no such document is open.
+    pub fn reading_colors(&self, id: DocId) -> Option<ReadingColors> {
+        Some(self.get(id)?.config.reading_colors)
+    }
+
+    /// How the document's pages are drawn for viewing: its password and view settings (layer
+    /// visibility, hidden comments, reading colours). `None` when no such document is open.
+    pub fn render_config(&self, id: DocId) -> Option<RenderConfig> {
+        Some(self.get(id)?.config.clone())
+    }
+
+    /// Acrobat's Summarize Comments ("Comments only" layout): a new PDF listing every comment
+    /// with its number, author, type, date, text and replies, grouped by page.
+    pub fn summarize_comments(&self, id: DocId, sort: SummarySort) -> Result<Arc<Vec<u8>>, EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        let text = comment_summary(&doc.name, &doc.info.annotations, sort);
+        self.create_report(&format!("Summary of Comments on {}", doc.name), &text)
+    }
+
+    pub fn close(&mut self, id: DocId) {
+        self.docs.retain(|d| d.id != id);
+    }
+
+    pub fn get(&self, id: DocId) -> Option<&Document> {
+        self.docs.iter().find(|d| d.id == id)
+    }
+
+    /// Read document `id`'s font list again if content edits since the last full inspection may
+    /// have changed it (Document Properties ▸ Fonts, `doc_info`). A no-op otherwise.
+    pub fn refresh_fonts(&mut self, id: DocId) {
+        let Some(doc) = self.docs.iter_mut().find(|d| d.id == id && d.fonts_stale) else { return };
+        if let Ok(info) = pdfcraft_render::inspect(doc.bytes.clone(), doc.password.as_deref()) {
+            doc.info.fonts = info.fonts;
+        }
+        doc.fonts_stale = false;
+    }
+
+    pub fn docs(&self) -> &[Document] {
+        &self.docs
+    }
+}
diff --git a/crates/engine/src/signature_scan.rs b/crates/engine/src/signature_scan.rs
index ba6ca269ab..4742754b01 100644
--- a/crates/engine/src/signature_scan.rs
+++ b/crates/engine/src/signature_scan.rs
@@ -602,303 +602,4 @@ fn render(area: &RgbImage, alpha: &[u8], bounds: Region) -> Result<Vec<u8>, Scan
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A gray "photo": `paper(x, y)` brightness with dark ink rectangles `[x, y, w, h]`.
-    fn photo(width: usize, height: usize, paper: impl Fn(usize, usize) -> u8, ink: &[[usize; 4]], ink_value: u8) -> Vec<u8> {
-        let mut out = vec![0; width * height];
-        for y in 0..height {
-            for x in 0..width {
-                let inside = ink.iter().any(|r| x >= r[0] && x < r[0] + r[2] && y >= r[1] && y < r[1] + r[3]);
-                out[y * width + x] = if inside { ink_value } else { paper(x, y) };
-            }
-        }
-        out
-    }
-
-    fn rgb(gray: &[u8], width: usize, height: usize) -> RgbImage {
-        RgbImage::from_fn(width as u32, height as u32, |x, y| {
-            let v = gray[y as usize * width + x as usize];
-            image::Rgb([v, v, v])
-        })
-    }
-
-    fn jpeg(image: &RgbImage) -> Vec<u8> {
-        let mut out = Cursor::new(Vec::new());
-        image.write_to(&mut out, ImageFormat::Jpeg).unwrap();
-        out.into_inner()
-    }
-
-    /// Photos keep the image signature limits (#1124): a 4 MiB file, at most 32 megapixels and
-    /// 8192 pixels per side decoded, and a working copy of at most 4 megapixels.
-    #[test]
-    fn photos_keep_the_image_signature_limits() {
-        let png = |image: &RgbImage| {
-            let mut out = Cursor::new(Vec::new());
-            image.write_to(&mut out, ImageFormat::Png).unwrap();
-            out.into_inner()
-        };
-        assert!(matches!(SignaturePhoto::from_bytes(&vec![0; MAX_PHOTO_BYTES + 1]), Err(ScanError::Size)));
-        assert!(SignaturePhoto::read(std::io::repeat(0)).is_err());
-        assert!(matches!(SignaturePhoto::from_bytes(&png(&RgbImage::new(8193, 1))), Err(ScanError::Size)));
-        assert!(matches!(SignaturePhoto::from_bytes(b"GIF89a\x02\0\x02\0"), Err(ScanError::Format)));
-        let [w, h] = SignaturePhoto::from_bytes(&png(&RgbImage::from_pixel(8000, 4000, image::Rgb([220, 220, 215])))).unwrap().size();
-        assert!(w <= WORKING_MAX_SIDE && u64::from(w) * u64::from(h) <= MAX_OUTPUT_PIXELS, "{w} x {h}");
-        assert!((f64::from(w) / f64::from(h) - 2.0).abs() < 0.01, "the aspect ratio is kept: {w} x {h}");
-    }
-
-    fn region(r: [usize; 4]) -> Region {
-        Region { x: r[0], y: r[1], width: r[2], height: r[3] }
-    }
-
-    fn opts() -> Options {
-        Options { sensitivity: DEFAULT_SENSITIVITY, despeckle: true, background_radius: None }
-    }
-
-    #[test]
-    fn box_blur_averages_and_keeps_a_constant_signal() {
-        let mut values = vec![0.0, 0.0, 9.0, 0.0, 0.0];
-        box_blur(&mut values, 5, 1, 1);
-        assert_eq!(values, vec![0.0, 3.0, 3.0, 3.0, 0.0]);
-        let mut flat = vec![7.0; 12];
-        box_blur(&mut flat, 4, 3, 2);
-        assert!(flat.iter().all(|v| (v - 7.0).abs() < 1e-4));
-    }
-
-    #[test]
-    fn square_filters_match_a_naive_window_with_repeated_edges() {
-        let (w, h) = (13, 7);
-        let src: Vec<u8> = (0..w * h).map(|i| ((i * 37 + 11) % 251) as u8).collect();
-        for radius in [1, 2, 5] {
-            for max in [true, false] {
-                let fast = square_filter(&src, w, h, radius, max);
-                for y in 0..h {
-                    for x in 0..w {
-                        let mut want = if max { 0 } else { 255 };
-                        for dy in -(radius as i64)..=radius as i64 {
-                            for dx in -(radius as i64)..=radius as i64 {
-                                let sx = (x as i64 + dx).clamp(0, w as i64 - 1) as usize;
-                                let sy = (y as i64 + dy).clamp(0, h as i64 - 1) as usize;
-                                let v = src[sy * w + sx];
-                                want = if max { want.max(v) } else { want.min(v) };
-                            }
-                        }
-                        assert_eq!(fast[y * w + x], want, "radius {radius} max {max} at {x},{y}");
-                    }
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn components_are_eight_connected() {
-        let mask = [true, false, false, false, false, true, false, true, false, false, false, false];
-        let (labels, count) = label_components(&mask, 4, 3);
-        assert_eq!(count, 2);
-        assert_eq!(labels[0], labels[5]);
-        assert_ne!(labels[7], labels[0]);
-        assert_eq!(labels[1], 0);
-    }
-
-    #[test]
-    fn sensitivity_lowers_the_threshold() {
-        assert!(threshold(0) > threshold(50));
-        assert!(threshold(50) > threshold(100));
-        assert_eq!(threshold(200), threshold(100));
-    }
-
-    #[test]
-    fn ink_survives_a_shadow_gradient_and_the_shadow_does_not() {
-        let (w, h) = (160, 80);
-        let stroke = [20, 30, 120, 6];
-        let gray = photo(w, h, |x, _| (235 - 115 * x / (w - 1)) as u8, &[stroke], 30);
-        let ink = extract_ink(&gray, w, h, opts());
-        assert_eq!(ink.alpha[10 * w + 150], 0);
-        assert_eq!(ink.alpha[33 * w + 30], 255);
-        assert_eq!(ink.alpha[33 * w + 130], 255);
-        assert_eq!(ink.bounds, Some(region(stroke)));
-    }
-
-    #[test]
-    fn a_sharp_shadow_edge_is_not_ink() {
-        let (w, h) = (200, 120);
-        let stroke = [30, 52, 140, 4];
-        let gray = photo(w, h, |_, y| if y < 60 { 230 } else { 120 }, &[stroke], 30);
-        let ink = extract_ink(&gray, w, h, opts());
-        for y in 58..63 {
-            assert_eq!(ink.alpha[y * w + 10], 0);
-            assert_eq!(ink.alpha[y * w + 190], 0);
-        }
-        assert_eq!(ink.bounds, Some(region(stroke)));
-    }
-
-    #[test]
-    fn a_table_at_the_edge_of_the_frame_is_not_ink() {
-        let (w, h) = (300, 120);
-        let stroke = [60, 60, 200, 4];
-        let gray = photo(w, h, |x, y| if x < 12 || y < 10 { 70 } else { 225 }, &[stroke], 30);
-        let ink = extract_ink(&gray, w, h, opts());
-        assert_eq!(ink.alpha[5 * w + 150], 0);
-        assert_eq!(ink.alpha[60 * w + 5], 0);
-        assert_eq!(ink.alpha[11 * w + 150], 0);
-        assert_eq!(ink.bounds, Some(region(stroke)));
-    }
-
-    #[test]
-    fn thick_strokes_stay_solid_when_the_window_is_sized_on_the_photo() {
-        let (w, h) = (600, 200);
-        let stroke = [50, 90, 500, 18];
-        let gray = photo(w, h, |_, _| 225, &[stroke], 30);
-        let middle = 99 * w + 300;
-        // Sized on the tight frame alone, the window is narrower than the stroke.
-        assert_eq!(extract_ink(&gray, w, h, opts()).alpha[middle], 0);
-        let ink = extract_ink(&gray, w, h, Options { background_radius: Some((4.0 * w as f32 * BACKGROUND_RADIUS_RATIO) as usize), ..opts() });
-        assert_eq!(ink.bounds, Some(region(stroke)));
-        assert!((90..108).all(|y| ink.alpha[y * w + 300] == 255));
-    }
-
-    #[test]
-    fn faint_stroke_ends_touching_ink_are_kept_and_isolated_ones_are_not() {
-        let (w, h) = (200, 60);
-        let mut gray = photo(w, h, |_, _| 220, &[[20, 28, 80, 4]], 40);
-        for y in 28..32 {
-            for x in (100..180).chain(10..15) {
-                gray[y * w + x] = 175;
-            }
-        }
-        let ink = extract_ink(&gray, w, h, opts());
-        assert!(ink.alpha[30 * w + 150] > 0);
-        assert_eq!(ink.alpha[30 * w + 12], 0);
-        assert_eq!(ink.bounds, Some(region([20, 28, 160, 4])));
-    }
-
-    #[test]
-    fn dust_is_removed_unless_despeckling_is_off() {
-        let (w, h) = (200, 100);
-        let gray = photo(w, h, |_, _| 230, &[[20, 40, 150, 5], [190, 5, 1, 1]], 20);
-        assert!(extract_ink(&gray, w, h, Options { despeckle: false, ..opts() }).alpha[5 * w + 190] > 0);
-        let ink = extract_ink(&gray, w, h, opts());
-        assert_eq!(ink.alpha[5 * w + 190], 0);
-        assert_eq!(ink.bounds, Some(region([20, 40, 150, 5])));
-    }
-
-    #[test]
-    fn faint_strokes_need_a_higher_sensitivity() {
-        let (w, h) = (120, 60);
-        let gray = photo(w, h, |_, _| 220, &[[10, 25, 100, 4]], 165);
-        assert!(extract_ink(&gray, w, h, Options { sensitivity: 0, ..opts() }).bounds.is_none());
-        assert!(extract_ink(&gray, w, h, Options { sensitivity: 100, ..opts() }).bounds.is_some());
-    }
-
-    #[test]
-    fn blank_paper_has_no_ink() {
-        let gray = photo(64, 64, |x, y| (200 + (x * 7 + y * 13) % 20) as u8, &[], 0);
-        assert!(extract_ink(&gray, 64, 64, opts()).bounds.is_none());
-        assert!(detect_region(&gray, 64, 64).is_none());
-    }
-
-    #[test]
-    fn detection_frames_all_words_and_ignores_dust_and_the_table_edge() {
-        let (w, h) = (400, 200);
-        let gray = photo(w, h, |_, y| if y >= 185 { 30 } else { 225 }, &[[40, 95, 90, 5], [230, 92, 30, 5], [300, 20, 1, 1]], 30);
-        let r = detect_region(&gray, w, h).unwrap();
-        assert!(r.x <= 40 && r.x + r.width >= 260, "{r:?}");
-        assert!(r.y > 20 && r.y + r.height < 185, "{r:?}");
-    }
-
-    #[test]
-    fn detection_frames_the_signature_not_the_sheet_on_a_dark_table() {
-        let (w, h) = (400, 300);
-        let sheet = |x: usize, y: usize| if (60..340).contains(&x) && (50..250).contains(&y) { 220 } else { 60 };
-        let gray = photo(w, h, sheet, &[[120, 150, 140, 4], [150, 135, 4, 20]], 30);
-        let r = detect_region(&gray, w, h).unwrap();
-        assert!(r.x > 80 && r.x + r.width < 320, "{r:?}");
-        assert!(r.y > 70 && r.y + r.height < 230, "{r:?}");
-    }
-
-    #[test]
-    fn rects_turn_with_the_photo_and_back() {
-        let rect = PhotoRect { x: 10, y: 20, width: 30, height: 40 };
-        let turned = rect.turned(Turn::Clockwise, 100, 80);
-        assert_eq!(turned, PhotoRect { x: 20, y: 10, width: 40, height: 30 });
-        assert_eq!(turned.turned(Turn::CounterClockwise, 80, 100), rect);
-        assert_eq!(PhotoRect { x: 500, y: 0, width: 0, height: 900 }.clamped(100, 50), PhotoRect { x: 99, y: 0, width: 1, height: 50 });
-        assert_eq!(PhotoRect { x: 0, y: 0, width: u32::MAX, height: 1 }.turned(Turn::CounterClockwise, 10, 10).y, 0);
-    }
-
-    #[test]
-    fn a_photo_is_scanned_into_a_trimmed_transparent_signature_in_its_ink_colour() {
-        let (w, h) = (600, 400);
-        let mut image = rgb(&photo(w, h, |x, _| (230 - 60 * x / w) as u8, &[], 0), w, h);
-        for (x, y, p) in image.enumerate_pixels_mut() {
-            if (150..450).contains(&x) && (200..206).contains(&y) || (200..206).contains(&x) && (170..206).contains(&y) {
-                *p = image::Rgb([30, 50, 140]);
-            }
-        }
-        let mut photo = SignaturePhoto::from_bytes(&jpeg(&image)).unwrap();
-        let rect = photo.auto_frame();
-        assert!(rect.x <= 150 && rect.x + rect.width >= 450 && rect.y <= 170 && rect.y + rect.height >= 206, "{rect:?}");
-        let signature = photo.scan(rect, DEFAULT_SENSITIVITY, SCAN_MAX_SIDE).unwrap();
-        let [sw, sh] = signature.size();
-        assert!((300..340).contains(&sw) && (36..60).contains(&sh), "{sw}x{sh}");
-        let pixels = signature.rgba().as_chunks::<4>().0;
-        assert_eq!(pixels[0][3], 0, "the margin is transparent");
-        let solid: Vec<_> = pixels.iter().filter(|p| p[3] == 255).collect();
-        assert!(!solid.is_empty());
-        assert!(solid.iter().all(|p| p[2] > p[0] + 40), "blue ink stays blue: {:?}", solid[0]);
-        let quick = photo.scan(rect, DEFAULT_SENSITIVITY, PREVIEW_MAX_SIDE).unwrap();
-        assert!(quick.size()[0] <= sw);
-    }
-
-    #[test]
-    fn a_sideways_signature_is_turned_upright() {
-        let (w, h) = (400, 600);
-        let gray = photo(w, h, |_, _| 225, &[[200, 120, 5, 300], [185, 300, 25, 4]], 30);
-        let mut photo = SignaturePhoto::from_bytes(&jpeg(&rgb(&gray, w, h))).unwrap();
-        let rect = photo.auto_frame();
-        assert_eq!(photo.size(), [600, 400]);
-        assert!(rect.width > rect.height * 2, "{rect:?}");
-    }
-
-    #[test]
-    fn an_empty_frame_reports_that_no_signature_was_found() {
-        let photo = SignaturePhoto::from_bytes(&jpeg(&RgbImage::from_pixel(200, 100, image::Rgb([220, 220, 220])))).unwrap();
-        let mut copy = photo.clone();
-        assert_eq!(copy.auto_frame(), PhotoRect { x: 28, y: 35, width: 142, height: 30 });
-        assert!(matches!(photo.scan(PhotoRect { x: 0, y: 0, width: 200, height: 100 }, 50, SCAN_MAX_SIDE), Err(ScanError::NoInk)));
-    }
-
-    #[test]
-    fn large_photos_are_downscaled_and_invalid_ones_rejected() {
-        let photo = SignaturePhoto::from_bytes(&jpeg(&RgbImage::from_pixel(5000, 100, image::Rgb([200, 200, 200])))).unwrap();
-        let [w, h] = photo.size();
-        assert!((4000..=WORKING_MAX_SIDE).contains(&w) && (81..=82).contains(&h), "{w} x {h}");
-        assert!(photo.thumbnail(512).width() <= 512);
-        assert!(matches!(SignaturePhoto::from_bytes(b"not a photo"), Err(ScanError::Format)));
-        assert!(matches!(SignaturePhoto::from_bytes(b"GIF89a\x02\0\x02\0"), Err(ScanError::Format)));
-        assert!(SignaturePhoto::from_bytes(b"\xff\xd8\xff\xe0truncated").is_err());
-        assert!(matches!(SignaturePhoto::from_bytes(&vec![0; MAX_PHOTO_BYTES + 1]), Err(ScanError::Size)));
-        assert!(SignaturePhoto::read(std::io::repeat(0)).is_err());
-        // A header claiming a huge image is rejected before decoding.
-        let mut png = Vec::new();
-        png.extend_from_slice(b"\x89PNG\r\n\x1a\n\0\0\0\x0dIHDR");
-        png.extend_from_slice(&20_000_u32.to_be_bytes());
-        png.extend_from_slice(&20_000_u32.to_be_bytes());
-        png.extend_from_slice(&[8, 2, 0, 0, 0, 0, 0, 0, 0]);
-        assert!(SignaturePhoto::from_bytes(&png).is_err());
-    }
-
-    #[test]
-    fn degenerate_buffers_do_not_panic() {
-        assert!(extract_ink(&[], 0, 0, opts()).bounds.is_none());
-        assert!(extract_ink(&[0; 3], 2, 2, opts()).bounds.is_none());
-        assert!(extract_ink(&[0], 1, 1, opts()).bounds.is_none());
-        assert!(detect_region(&[255; 4], 2, 2).is_none());
-        let mut empty: Vec<f32> = Vec::new();
-        box_blur(&mut empty, 0, 0, 3);
-        assert!(square_filter(&[], 0, 0, 2, true).is_empty());
-        let photo = SignaturePhoto::from_bytes(&jpeg(&RgbImage::from_pixel(3, 2, image::Rgb([10, 10, 10])))).unwrap();
-        let _ = photo.scan(PhotoRect { x: 9, y: 9, width: 0, height: 0 }, 255, 0);
-    }
-}
+mod tests;
diff --git a/crates/engine/src/signature_scan/tests.rs b/crates/engine/src/signature_scan/tests.rs
new file mode 100644
index 0000000000..c13200b1f1
--- /dev/null
+++ b/crates/engine/src/signature_scan/tests.rs
@@ -0,0 +1,298 @@
+use super::*;
+
+/// A gray "photo": `paper(x, y)` brightness with dark ink rectangles `[x, y, w, h]`.
+fn photo(width: usize, height: usize, paper: impl Fn(usize, usize) -> u8, ink: &[[usize; 4]], ink_value: u8) -> Vec<u8> {
+    let mut out = vec![0; width * height];
+    for y in 0..height {
+        for x in 0..width {
+            let inside = ink.iter().any(|r| x >= r[0] && x < r[0] + r[2] && y >= r[1] && y < r[1] + r[3]);
+            out[y * width + x] = if inside { ink_value } else { paper(x, y) };
+        }
+    }
+    out
+}
+
+fn rgb(gray: &[u8], width: usize, height: usize) -> RgbImage {
+    RgbImage::from_fn(width as u32, height as u32, |x, y| {
+        let v = gray[y as usize * width + x as usize];
+        image::Rgb([v, v, v])
+    })
+}
+
+fn jpeg(image: &RgbImage) -> Vec<u8> {
+    let mut out = Cursor::new(Vec::new());
+    image.write_to(&mut out, ImageFormat::Jpeg).unwrap();
+    out.into_inner()
+}
+
+/// Photos keep the image signature limits (#1124): a 4 MiB file, at most 32 megapixels and
+/// 8192 pixels per side decoded, and a working copy of at most 4 megapixels.
+#[test]
+fn photos_keep_the_image_signature_limits() {
+    let png = |image: &RgbImage| {
+        let mut out = Cursor::new(Vec::new());
+        image.write_to(&mut out, ImageFormat::Png).unwrap();
+        out.into_inner()
+    };
+    assert!(matches!(SignaturePhoto::from_bytes(&vec![0; MAX_PHOTO_BYTES + 1]), Err(ScanError::Size)));
+    assert!(SignaturePhoto::read(std::io::repeat(0)).is_err());
+    assert!(matches!(SignaturePhoto::from_bytes(&png(&RgbImage::new(8193, 1))), Err(ScanError::Size)));
+    assert!(matches!(SignaturePhoto::from_bytes(b"GIF89a\x02\0\x02\0"), Err(ScanError::Format)));
+    let [w, h] = SignaturePhoto::from_bytes(&png(&RgbImage::from_pixel(8000, 4000, image::Rgb([220, 220, 215])))).unwrap().size();
+    assert!(w <= WORKING_MAX_SIDE && u64::from(w) * u64::from(h) <= MAX_OUTPUT_PIXELS, "{w} x {h}");
+    assert!((f64::from(w) / f64::from(h) - 2.0).abs() < 0.01, "the aspect ratio is kept: {w} x {h}");
+}
+
+fn region(r: [usize; 4]) -> Region {
+    Region { x: r[0], y: r[1], width: r[2], height: r[3] }
+}
+
+fn opts() -> Options {
+    Options { sensitivity: DEFAULT_SENSITIVITY, despeckle: true, background_radius: None }
+}
+
+#[test]
+fn box_blur_averages_and_keeps_a_constant_signal() {
+    let mut values = vec![0.0, 0.0, 9.0, 0.0, 0.0];
+    box_blur(&mut values, 5, 1, 1);
+    assert_eq!(values, vec![0.0, 3.0, 3.0, 3.0, 0.0]);
+    let mut flat = vec![7.0; 12];
+    box_blur(&mut flat, 4, 3, 2);
+    assert!(flat.iter().all(|v| (v - 7.0).abs() < 1e-4));
+}
+
+#[test]
+fn square_filters_match_a_naive_window_with_repeated_edges() {
+    let (w, h) = (13, 7);
+    let src: Vec<u8> = (0..w * h).map(|i| ((i * 37 + 11) % 251) as u8).collect();
+    for radius in [1, 2, 5] {
+        for max in [true, false] {
+            let fast = square_filter(&src, w, h, radius, max);
+            for y in 0..h {
+                for x in 0..w {
+                    let mut want = if max { 0 } else { 255 };
+                    for dy in -(radius as i64)..=radius as i64 {
+                        for dx in -(radius as i64)..=radius as i64 {
+                            let sx = (x as i64 + dx).clamp(0, w as i64 - 1) as usize;
+                            let sy = (y as i64 + dy).clamp(0, h as i64 - 1) as usize;
+                            let v = src[sy * w + sx];
+                            want = if max { want.max(v) } else { want.min(v) };
+                        }
+                    }
+                    assert_eq!(fast[y * w + x], want, "radius {radius} max {max} at {x},{y}");
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn components_are_eight_connected() {
+    let mask = [true, false, false, false, false, true, false, true, false, false, false, false];
+    let (labels, count) = label_components(&mask, 4, 3);
+    assert_eq!(count, 2);
+    assert_eq!(labels[0], labels[5]);
+    assert_ne!(labels[7], labels[0]);
+    assert_eq!(labels[1], 0);
+}
+
+#[test]
+fn sensitivity_lowers_the_threshold() {
+    assert!(threshold(0) > threshold(50));
+    assert!(threshold(50) > threshold(100));
+    assert_eq!(threshold(200), threshold(100));
+}
+
+#[test]
+fn ink_survives_a_shadow_gradient_and_the_shadow_does_not() {
+    let (w, h) = (160, 80);
+    let stroke = [20, 30, 120, 6];
+    let gray = photo(w, h, |x, _| (235 - 115 * x / (w - 1)) as u8, &[stroke], 30);
+    let ink = extract_ink(&gray, w, h, opts());
+    assert_eq!(ink.alpha[10 * w + 150], 0);
+    assert_eq!(ink.alpha[33 * w + 30], 255);
+    assert_eq!(ink.alpha[33 * w + 130], 255);
+    assert_eq!(ink.bounds, Some(region(stroke)));
+}
+
+#[test]
+fn a_sharp_shadow_edge_is_not_ink() {
+    let (w, h) = (200, 120);
+    let stroke = [30, 52, 140, 4];
+    let gray = photo(w, h, |_, y| if y < 60 { 230 } else { 120 }, &[stroke], 30);
+    let ink = extract_ink(&gray, w, h, opts());
+    for y in 58..63 {
+        assert_eq!(ink.alpha[y * w + 10], 0);
+        assert_eq!(ink.alpha[y * w + 190], 0);
+    }
+    assert_eq!(ink.bounds, Some(region(stroke)));
+}
+
+#[test]
+fn a_table_at_the_edge_of_the_frame_is_not_ink() {
+    let (w, h) = (300, 120);
+    let stroke = [60, 60, 200, 4];
+    let gray = photo(w, h, |x, y| if x < 12 || y < 10 { 70 } else { 225 }, &[stroke], 30);
+    let ink = extract_ink(&gray, w, h, opts());
+    assert_eq!(ink.alpha[5 * w + 150], 0);
+    assert_eq!(ink.alpha[60 * w + 5], 0);
+    assert_eq!(ink.alpha[11 * w + 150], 0);
+    assert_eq!(ink.bounds, Some(region(stroke)));
+}
+
+#[test]
+fn thick_strokes_stay_solid_when_the_window_is_sized_on_the_photo() {
+    let (w, h) = (600, 200);
+    let stroke = [50, 90, 500, 18];
+    let gray = photo(w, h, |_, _| 225, &[stroke], 30);
+    let middle = 99 * w + 300;
+    // Sized on the tight frame alone, the window is narrower than the stroke.
+    assert_eq!(extract_ink(&gray, w, h, opts()).alpha[middle], 0);
+    let ink = extract_ink(&gray, w, h, Options { background_radius: Some((4.0 * w as f32 * BACKGROUND_RADIUS_RATIO) as usize), ..opts() });
+    assert_eq!(ink.bounds, Some(region(stroke)));
+    assert!((90..108).all(|y| ink.alpha[y * w + 300] == 255));
+}
+
+#[test]
+fn faint_stroke_ends_touching_ink_are_kept_and_isolated_ones_are_not() {
+    let (w, h) = (200, 60);
+    let mut gray = photo(w, h, |_, _| 220, &[[20, 28, 80, 4]], 40);
+    for y in 28..32 {
+        for x in (100..180).chain(10..15) {
+            gray[y * w + x] = 175;
+        }
+    }
+    let ink = extract_ink(&gray, w, h, opts());
+    assert!(ink.alpha[30 * w + 150] > 0);
+    assert_eq!(ink.alpha[30 * w + 12], 0);
+    assert_eq!(ink.bounds, Some(region([20, 28, 160, 4])));
+}
+
+#[test]
+fn dust_is_removed_unless_despeckling_is_off() {
+    let (w, h) = (200, 100);
+    let gray = photo(w, h, |_, _| 230, &[[20, 40, 150, 5], [190, 5, 1, 1]], 20);
+    assert!(extract_ink(&gray, w, h, Options { despeckle: false, ..opts() }).alpha[5 * w + 190] > 0);
+    let ink = extract_ink(&gray, w, h, opts());
+    assert_eq!(ink.alpha[5 * w + 190], 0);
+    assert_eq!(ink.bounds, Some(region([20, 40, 150, 5])));
+}
+
+#[test]
+fn faint_strokes_need_a_higher_sensitivity() {
+    let (w, h) = (120, 60);
+    let gray = photo(w, h, |_, _| 220, &[[10, 25, 100, 4]], 165);
+    assert!(extract_ink(&gray, w, h, Options { sensitivity: 0, ..opts() }).bounds.is_none());
+    assert!(extract_ink(&gray, w, h, Options { sensitivity: 100, ..opts() }).bounds.is_some());
+}
+
+#[test]
+fn blank_paper_has_no_ink() {
+    let gray = photo(64, 64, |x, y| (200 + (x * 7 + y * 13) % 20) as u8, &[], 0);
+    assert!(extract_ink(&gray, 64, 64, opts()).bounds.is_none());
+    assert!(detect_region(&gray, 64, 64).is_none());
+}
+
+#[test]
+fn detection_frames_all_words_and_ignores_dust_and_the_table_edge() {
+    let (w, h) = (400, 200);
+    let gray = photo(w, h, |_, y| if y >= 185 { 30 } else { 225 }, &[[40, 95, 90, 5], [230, 92, 30, 5], [300, 20, 1, 1]], 30);
+    let r = detect_region(&gray, w, h).unwrap();
+    assert!(r.x <= 40 && r.x + r.width >= 260, "{r:?}");
+    assert!(r.y > 20 && r.y + r.height < 185, "{r:?}");
+}
+
+#[test]
+fn detection_frames_the_signature_not_the_sheet_on_a_dark_table() {
+    let (w, h) = (400, 300);
+    let sheet = |x: usize, y: usize| if (60..340).contains(&x) && (50..250).contains(&y) { 220 } else { 60 };
+    let gray = photo(w, h, sheet, &[[120, 150, 140, 4], [150, 135, 4, 20]], 30);
+    let r = detect_region(&gray, w, h).unwrap();
+    assert!(r.x > 80 && r.x + r.width < 320, "{r:?}");
+    assert!(r.y > 70 && r.y + r.height < 230, "{r:?}");
+}
+
+#[test]
+fn rects_turn_with_the_photo_and_back() {
+    let rect = PhotoRect { x: 10, y: 20, width: 30, height: 40 };
+    let turned = rect.turned(Turn::Clockwise, 100, 80);
+    assert_eq!(turned, PhotoRect { x: 20, y: 10, width: 40, height: 30 });
+    assert_eq!(turned.turned(Turn::CounterClockwise, 80, 100), rect);
+    assert_eq!(PhotoRect { x: 500, y: 0, width: 0, height: 900 }.clamped(100, 50), PhotoRect { x: 99, y: 0, width: 1, height: 50 });
+    assert_eq!(PhotoRect { x: 0, y: 0, width: u32::MAX, height: 1 }.turned(Turn::CounterClockwise, 10, 10).y, 0);
+}
+
+#[test]
+fn a_photo_is_scanned_into_a_trimmed_transparent_signature_in_its_ink_colour() {
+    let (w, h) = (600, 400);
+    let mut image = rgb(&photo(w, h, |x, _| (230 - 60 * x / w) as u8, &[], 0), w, h);
+    for (x, y, p) in image.enumerate_pixels_mut() {
+        if (150..450).contains(&x) && (200..206).contains(&y) || (200..206).contains(&x) && (170..206).contains(&y) {
+            *p = image::Rgb([30, 50, 140]);
+        }
+    }
+    let mut photo = SignaturePhoto::from_bytes(&jpeg(&image)).unwrap();
+    let rect = photo.auto_frame();
+    assert!(rect.x <= 150 && rect.x + rect.width >= 450 && rect.y <= 170 && rect.y + rect.height >= 206, "{rect:?}");
+    let signature = photo.scan(rect, DEFAULT_SENSITIVITY, SCAN_MAX_SIDE).unwrap();
+    let [sw, sh] = signature.size();
+    assert!((300..340).contains(&sw) && (36..60).contains(&sh), "{sw}x{sh}");
+    let pixels = signature.rgba().as_chunks::<4>().0;
+    assert_eq!(pixels[0][3], 0, "the margin is transparent");
+    let solid: Vec<_> = pixels.iter().filter(|p| p[3] == 255).collect();
+    assert!(!solid.is_empty());
+    assert!(solid.iter().all(|p| p[2] > p[0] + 40), "blue ink stays blue: {:?}", solid[0]);
+    let quick = photo.scan(rect, DEFAULT_SENSITIVITY, PREVIEW_MAX_SIDE).unwrap();
+    assert!(quick.size()[0] <= sw);
+}
+
+#[test]
+fn a_sideways_signature_is_turned_upright() {
+    let (w, h) = (400, 600);
+    let gray = photo(w, h, |_, _| 225, &[[200, 120, 5, 300], [185, 300, 25, 4]], 30);
+    let mut photo = SignaturePhoto::from_bytes(&jpeg(&rgb(&gray, w, h))).unwrap();
+    let rect = photo.auto_frame();
+    assert_eq!(photo.size(), [600, 400]);
+    assert!(rect.width > rect.height * 2, "{rect:?}");
+}
+
+#[test]
+fn an_empty_frame_reports_that_no_signature_was_found() {
+    let photo = SignaturePhoto::from_bytes(&jpeg(&RgbImage::from_pixel(200, 100, image::Rgb([220, 220, 220])))).unwrap();
+    let mut copy = photo.clone();
+    assert_eq!(copy.auto_frame(), PhotoRect { x: 28, y: 35, width: 142, height: 30 });
+    assert!(matches!(photo.scan(PhotoRect { x: 0, y: 0, width: 200, height: 100 }, 50, SCAN_MAX_SIDE), Err(ScanError::NoInk)));
+}
+
+#[test]
+fn large_photos_are_downscaled_and_invalid_ones_rejected() {
+    let photo = SignaturePhoto::from_bytes(&jpeg(&RgbImage::from_pixel(5000, 100, image::Rgb([200, 200, 200])))).unwrap();
+    let [w, h] = photo.size();
+    assert!((4000..=WORKING_MAX_SIDE).contains(&w) && (81..=82).contains(&h), "{w} x {h}");
+    assert!(photo.thumbnail(512).width() <= 512);
+    assert!(matches!(SignaturePhoto::from_bytes(b"not a photo"), Err(ScanError::Format)));
+    assert!(matches!(SignaturePhoto::from_bytes(b"GIF89a\x02\0\x02\0"), Err(ScanError::Format)));
+    assert!(SignaturePhoto::from_bytes(b"\xff\xd8\xff\xe0truncated").is_err());
+    assert!(matches!(SignaturePhoto::from_bytes(&vec![0; MAX_PHOTO_BYTES + 1]), Err(ScanError::Size)));
+    assert!(SignaturePhoto::read(std::io::repeat(0)).is_err());
+    // A header claiming a huge image is rejected before decoding.
+    let mut png = Vec::new();
+    png.extend_from_slice(b"\x89PNG\r\n\x1a\n\0\0\0\x0dIHDR");
+    png.extend_from_slice(&20_000_u32.to_be_bytes());
+    png.extend_from_slice(&20_000_u32.to_be_bytes());
+    png.extend_from_slice(&[8, 2, 0, 0, 0, 0, 0, 0, 0]);
+    assert!(SignaturePhoto::from_bytes(&png).is_err());
+}
+
+#[test]
+fn degenerate_buffers_do_not_panic() {
+    assert!(extract_ink(&[], 0, 0, opts()).bounds.is_none());
+    assert!(extract_ink(&[0; 3], 2, 2, opts()).bounds.is_none());
+    assert!(extract_ink(&[0], 1, 1, opts()).bounds.is_none());
+    assert!(detect_region(&[255; 4], 2, 2).is_none());
+    let mut empty: Vec<f32> = Vec::new();
+    box_blur(&mut empty, 0, 0, 3);
+    assert!(square_filter(&[], 0, 0, 2, true).is_empty());
+    let photo = SignaturePhoto::from_bytes(&jpeg(&RgbImage::from_pixel(3, 2, image::Rgb([10, 10, 10])))).unwrap();
+    let _ = photo.scan(PhotoRect { x: 9, y: 9, width: 0, height: 0 }, 255, 0);
+}
diff --git a/crates/engine/src/sources.rs b/crates/engine/src/sources.rs
new file mode 100644
index 0000000000..3c8083162e
--- /dev/null
+++ b/crates/engine/src/sources.rs
@@ -0,0 +1,51 @@
+//! Other files to combine with or copy pages from: opening them, and why one can't be used.
+
+use std::sync::Arc;
+
+use crate::{EditError, SourceProblem};
+
+/// A file to combine: its name (the bookmark title), bytes, and page range (`None`: all).
+pub type CombineSource = (String, Arc<Vec<u8>>, Option<String>);
+
+/// What a combine produced: the new PDF bytes, and the fields renamed to keep colliding names
+/// separate (old fully-qualified name → new one), in order across the sources.
+#[derive(Debug)]
+pub struct Combined {
+    pub bytes: Arc<Vec<u8>>,
+    pub renamed_fields: Vec<(String, String)>,
+}
+
+/// Parse another PDF to copy pages from.
+pub(crate) fn open_source(name: &str, bytes: &Arc<Vec<u8>>) -> Result<pdfcraft_cos::Document, EditError> {
+    open_source_with(name, bytes, None)
+}
+
+/// [`open_source`], authenticating with `password` (user or owner) for an encrypted file.
+pub(crate) fn open_source_with(name: &str, bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<pdfcraft_cos::Document, EditError> {
+    source_document(bytes, password).map_err(|p| EditError::Source(format!("{name}: {p}")))
+}
+
+fn source_document(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<pdfcraft_cos::Document, SourceProblem> {
+    match std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password)) {
+        Ok(Ok(d)) if d.permissions().is_some_and(|p| !p.assemble()) => Err(SourceProblem::NotPermitted),
+        Ok(Ok(d)) => Ok(d),
+        Ok(Err(pdfcraft_cos::CosError::NeedsPassword)) => Err(SourceProblem::Password),
+        Ok(Err(pdfcraft_cos::CosError::WrongPassword)) => Err(SourceProblem::WrongPassword),
+        Ok(Err(e)) => Err(SourceProblem::Unreadable(e.to_string())),
+        Err(_) => Err(SourceProblem::Unreadable("the file could not be read".into())),
+    }
+}
+
+/// Whether `bytes` can be combined, opened with `password` (user or owner) if given, and if not
+/// why: what Combine would refuse it for, so the Combine files list can say so before Combine
+/// is pressed. The owner (permissions) password lifts the restriction on copying pages.
+pub fn combine_source_check(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<(), SourceProblem> {
+    source_document(bytes, password).map(|_| ())
+}
+
+/// The number of pages of `bytes`, opened with `password` (user or owner) if given, whatever
+/// its permissions allow; `None` when it can't be read.
+pub fn source_page_count(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Option<usize> {
+    let doc = std::panic::catch_unwind(|| pdfcraft_cos::Document::open_with_password(bytes.clone(), password)).ok()?.ok()?;
+    pdfcraft_organize::page_count(&doc).ok()
+}
diff --git a/crates/engine/src/test_hooks.rs b/crates/engine/src/test_hooks.rs
new file mode 100644
index 0000000000..d6e504599e
--- /dev/null
+++ b/crates/engine/src/test_hooks.rs
@@ -0,0 +1,42 @@
+//! Test-only hooks: injected refresh panics and counts of the secondary page scans.
+
+thread_local! {
+    static SECONDARY_SCAN_COUNTS: std::cell::Cell<(usize, usize)> = const { std::cell::Cell::new((0, 0)) };
+    static REFRESH_PANICS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+pub(crate) fn panic_on_refresh(count: usize) {
+    REFRESH_PANICS.with(|n| n.set(count));
+}
+
+pub(crate) fn check_refresh_panic() {
+    REFRESH_PANICS.with(|n| {
+        let rem = n.get();
+        if rem > 0 {
+            n.set(rem - 1);
+            panic!("injected refresh panic");
+        }
+    });
+}
+
+pub(crate) fn reset_secondary_scan_counts() {
+    SECONDARY_SCAN_COUNTS.with(|counts| counts.set((0, 0)));
+}
+
+pub(crate) fn secondary_scan_counts() -> (usize, usize) {
+    SECONDARY_SCAN_COUNTS.with(std::cell::Cell::get)
+}
+
+pub(crate) fn record_marker_scan() {
+    SECONDARY_SCAN_COUNTS.with(|counts| {
+        let (markers, links) = counts.get();
+        counts.set((markers + 1, links));
+    });
+}
+
+pub(crate) fn record_link_scan() {
+    SECONDARY_SCAN_COUNTS.with(|counts| {
+        let (markers, links) = counts.get();
+        counts.set((markers, links + 1));
+    });
+}
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index f5f438deca..e7e68a7588 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1,6 +1,9 @@
 use std::sync::Arc;
 
+use super::document::is_placeholder_title;
+use super::edit::check_permission;
 use super::*;
+use pdfcraft_render::{Layer, LayerOp, OpenError, ReadingColors};
 
 /// A minimal `n`-page document; page `i` shows "Page i+1".
 pub(crate) fn fixture(n: usize) -> Vec<u8> {
@@ -2284,6 +2287,82 @@ fn a_signed_file_carries_no_password_field_value() {
     assert!(!appears_in_pdf(&signed, "*******"), "nor the typed length");
 }
 
+/// #3944: a value typed into an XFA `<passwordEdit/>` field stays in the open document (both the
+/// widget and the live XFA datasets, even across multiple edits and across Save + `mark_saved`),
+/// but is written to no file — neither on the widget nor in the XFA datasets stream.
+#[test]
+fn xfa_password_field_values_are_not_saved_in_datasets_or_widgets() {
+    let xfa_pdf = pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::fields_template(""));
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("xfa.pdf", None, Arc::new(xfa_pdf), None).unwrap();
+    let pin_name = s.get(id).unwrap().form.iter().find(|f| f.name.contains("pin")).unwrap().name.clone();
+
+    // Edit the password twice so an earlier edit's datasets stream could not linger in the overlay.
+    s.apply(id, Edit::SetFieldValue { name: pin_name.clone(), value: FieldValue::Text("secret1".into()) }).unwrap();
+    s.apply(id, Edit::SetFieldValue { name: pin_name.clone(), value: FieldValue::Text("hunter2".into()) }).unwrap();
+
+    let field = s.get(id).unwrap().form.iter().find(|f| f.name == pin_name).cloned().unwrap();
+    assert!(field.has(pdfcraft_forms::flags::PASSWORD));
+    assert_eq!(field.value, vec!["hunter2".to_string()], "the open document keeps the value");
+    assert!(appears_in_pdf(&s.get(id).unwrap().bytes, "hunter2"), "the working bytes hold the live datasets");
+    assert!(!appears_in_pdf(&s.get(id).unwrap().bytes, "secret1"), "the first edit's datasets stream was replaced in place");
+
+    let saved = s.save_bytes(id).unwrap();
+    for leak in ["hunter2", "secret1", "*******"] {
+        assert!(!appears_in_pdf(&saved, leak), "Save leaked {leak}");
+        assert!(!appears_in_pdf(&s.save_full_bytes(id).unwrap(), leak), "save_full_bytes leaked {leak}");
+        assert!(!appears_in_pdf(&s.reduced_bytes(id).unwrap().0, leak), "reduced_bytes leaked {leak}");
+    }
+    let snaps = s.autosave_snapshots();
+    assert_eq!(snaps.len(), 1);
+    for leak in ["hunter2", "secret1", "*******"] {
+        assert!(!appears_in_pdf(&snaps[0].bytes, leak), "autosave snapshot leaked {leak}");
+    }
+
+    // Reopening the saved file in a new session leaves the password field empty (it does not
+    // repopulate from the XFA datasets on open).
+    let mut t = Session::new();
+    let reopened = t.open("saved.pdf", None, saved.clone(), None).unwrap();
+    assert!(
+        t.get(reopened).unwrap().form.iter().find(|f| f.name == pin_name).unwrap().value.iter().all(|v| v.is_empty()),
+        "reopened XFA form must have an empty password field"
+    );
+
+    // Recording the save keeps the typed password in the open document (and its live datasets),
+    // while a subsequent save still omits it.
+    s.mark_saved(id, saved, Some("saved.pdf".into())).unwrap();
+    assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == pin_name).unwrap().value, ["hunter2"]);
+    assert!(!s.get(id).unwrap().dirty);
+    for leak in ["hunter2", "secret1", "*******"] {
+        assert!(!appears_in_pdf(&s.save_bytes(id).unwrap(), leak), "save after mark_saved leaked {leak}");
+    }
+
+    // Undo past `mark_saved` and edit again: the datasets stream in the restored overlay is
+    // overwritten in place rather than left behind.
+    s.undo(id).unwrap();
+    s.apply(id, Edit::SetFieldValue { name: pin_name.clone(), value: FieldValue::Text("secret3".into()) }).unwrap();
+    let saved_after_undo = s.save_bytes(id).unwrap();
+    for leak in ["hunter2", "secret1", "secret3", "*******"] {
+        assert!(!appears_in_pdf(&saved_after_undo, leak), "save after undo leaked {leak}");
+    }
+
+    // A relayout (`rerender`) after typing a password frees the replaced generated widget and its
+    // masked appearance stream so neither remains in the overlay when saving.
+    let relayout_xml = pdfcraft_xfa::fixtures::fields_template("").replace(
+        r#"<subform name="page1" layout="tb">"#,
+        r#"<subform name="page1" layout="tb"><field name="grow" w="2in"><ui><textEdit multiLine="1"/></ui></field>"#,
+    );
+    let id2 = s.open("relayout.pdf", None, Arc::new(pdfcraft_xfa::fixtures::shell(&relayout_xml)), None).unwrap();
+    let pin2 = s.get(id2).unwrap().form.iter().find(|f| f.name.contains("pin")).unwrap().name.clone();
+    let grow2 = s.get(id2).unwrap().form.iter().find(|f| f.name.contains("grow")).unwrap().name.clone();
+    s.apply(id2, Edit::SetFieldValue { name: pin2, value: FieldValue::Text("s3cr3t!".into()) }).unwrap();
+    s.apply(id2, Edit::SetFieldValue { name: grow2, value: FieldValue::Text("line1\nline2\nline3\nline4\nline5".into()) }).unwrap();
+    let saved_relayout = s.save_bytes(id2).unwrap();
+    for leak in ["s3cr3t!", "*******"] {
+        assert!(!appears_in_pdf(&saved_relayout, leak), "save after relayout leaked {leak}");
+    }
+}
+
 /// A value its field's font can't draw is kept, and the edit that drew it reports it in
 /// `edit_notices` (the interface shows it, tools return it): not a later unrelated edit, not a
 /// failed one, and not a value that can be drawn. The form (an inline AcroForm here) asks other
@@ -2654,6 +2733,84 @@ fn redaction_marks_apply_for_good_and_undo() {
     assert!(matches!(s.apply(id, Edit::ApplyRedactions { pages: None }), Err(EditError::Redact(_))));
 }
 
+/// What [`mark_with_reply`] writes that must not reach a file once the mark is removed.
+const MARK_TRACES: [&str; 5] = ["/Redact", "MARKED OVERLAY", "Mark Author", "REPLY TO THE MARK", "Replier"];
+
+/// A redaction mark on page 1 (the first annotation there) and a reply to it.
+fn mark_with_reply(s: &mut Session, id: DocId) {
+    let shape = Shape::Redact {
+        quads: vec![pdfcraft_annot::rect_quad([80.0, 140.0, 100.0, 180.0])],
+        overlay: "MARKED OVERLAY".into(),
+        look: Default::default(),
+    };
+    let mark = Edit::AddAnnotation(NewAnnotation {
+        page: 0,
+        style: Style::default_for(&shape),
+        shape,
+        contents: String::new(),
+        author: "Mark Author".into(),
+    });
+    s.apply(id, mark).unwrap();
+    let reply = Edit::ReplyToAnnotation { page: 0, index: 0, text: "REPLY TO THE MARK".into(), author: "Replier".into() };
+    s.apply(id, reply).unwrap();
+}
+
+/// Marks removed before they are applied, all at once or one by one, are not saved, nor are
+/// replies to them: the file would otherwise record where they were, their overlay text and who
+/// made them, and the page is left as it was.
+#[test]
+fn removed_redaction_marks_are_not_saved() {
+    for clear in [true, false] {
+        let (mut s, id) = session_with(1);
+        mark_with_reply(&mut s, id);
+        let removal = if clear { Edit::ClearRedactions } else { Edit::DeleteAnnotation { page: 0, index: 0 } };
+        s.apply(id, removal).unwrap();
+        assert_eq!(s.get(id).unwrap().redaction_marks(), 0);
+        let saved = s.save_bytes(id).unwrap();
+        for trace in MARK_TRACES {
+            assert!(!saved.windows(trace.len()).any(|w| w == trace.as_bytes()), "clear: {clear}, {trace:?}");
+        }
+        let mut reopened = Session::new();
+        let back = reopened.open("saved.pdf", None, saved.clone(), None).unwrap();
+        assert_eq!(page_texts(&reopened, back), ["Page 1"]);
+        let page = pdfcraft_model::pages(&reopened.get(back).unwrap().editor.as_ref().unwrap().cos).swap_remove(0);
+        assert!(!page.dict.contains(b"Annots"), "clear: {clear}");
+
+        // Undo past that save brings the mark back, under the number the saved file left free.
+        s.mark_saved(id, saved, None).unwrap();
+        s.undo(id).unwrap();
+        let again = s.save_bytes(id).unwrap();
+        let mut reopened = Session::new();
+        let back = reopened.open("again.pdf", None, again.clone(), None).unwrap();
+        let d = reopened.get(back).unwrap();
+        assert!(d.info.warnings.is_empty() && d.editor.as_ref().unwrap().cos.repair_log().is_empty(), "{:?}", d.info.warnings);
+        assert_eq!(d.redaction_marks(), 1, "clear: {clear}");
+        let marks = pdfcraft_redact::marks(&d.editor.as_ref().unwrap().cos);
+        assert_eq!(marks.first().map(|m| m.overlay.as_str()), Some("MARKED OVERLAY"));
+    }
+}
+
+/// Removed marks are not in a signed file either, nor in one with revocation evidence embedded:
+/// no later save could take them out of those.
+#[test]
+fn removed_redaction_marks_are_not_signed() {
+    let p12 = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12")).unwrap();
+    let digital_id = sign::pkcs12::open(&p12, "test").unwrap();
+    // After the test certificate's start date (2026-10-02).
+    let mut s = Session::new().with_clock(|| 1_800_000_000);
+    let id = s.open("fixture.pdf", None, Arc::new(fixture(1)), None).unwrap();
+    mark_with_reply(&mut s, id);
+    s.apply(id, Edit::ClearRedactions).unwrap();
+    let signed = s.sign(id, &digital_id, SignOptions { rect: None, ..SignOptions::default() }).unwrap();
+    let evidence = sign::dss::Evidence { certs: vec![digital_id.certificate.raw.clone()], ocsps: Vec::new(), crls: Vec::new() };
+    let ltv = s.embed_ltv(id, &evidence).unwrap();
+    for (what, out) in [("signed", signed), ("LTV", ltv)] {
+        for trace in MARK_TRACES {
+            assert!(!out.windows(trace.len()).any(|w| w == trace.as_bytes()), "{what}: {trace:?}");
+        }
+    }
+}
+
 #[test]
 fn oversized_redaction_overlay_preserves_the_document_and_undo() {
     let (mut s, id) = session_with(1);
@@ -3253,6 +3410,70 @@ fn pages_export_as_png_jpeg_and_tiff() {
     assert_eq!((compression, predictor), (5, 1), "LZW, without a predictor");
 }
 
+/// Export ▸ Image draws several pages at once: each file is the one exporting that page alone
+/// writes, handed over in the order asked for, whatever the number of pages drawn at once.
+#[test]
+fn pages_exported_at_once_are_the_files_each_page_exports_alone_in_order() {
+    use crate::export::{Exporter, ImageFormat};
+    let (s, id) = session_with(12);
+    let pages = [3, 0, 11, 5, 5, 7, 1, 2, 10, 9, 8, 6, 4];
+    for format in [ImageFormat::Png, ImageFormat::Jpeg { quality: 85 }, ImageFormat::Tiff] {
+        let alone: Vec<(usize, Vec<u8>)> = pages.iter().map(|&p| (p, Exporter::new(s.get(id).unwrap()).image(p, 96.0, format).unwrap())).collect();
+        for workers in [1, 2, 4, 8] {
+            let mut got = Vec::new();
+            let mut ex = Exporter::new(s.get(id).unwrap());
+            ex.images_on(workers, &pages, 96.0, format, |p, img| {
+                got.push((p, img));
+                Ok(())
+            })
+            .unwrap();
+            assert!(got == alone, "{} with {workers} workers", format.label());
+        }
+        let mut got = Vec::new();
+        Exporter::new(s.get(id).unwrap())
+            .images(&pages, 96.0, format, |p, img| {
+                got.push((p, img));
+                Ok(())
+            })
+            .unwrap();
+        assert!(got == alone, "{}", format.label());
+    }
+}
+
+/// A page that can't be exported, or a file that can't be written, stops the export there with
+/// its error: every page before it is handed over, none after it.
+#[test]
+fn exporting_pages_at_once_stops_at_the_first_error() {
+    use crate::export::{Exporter, ImageFormat};
+    let (s, id) = session_with(6);
+    for workers in [1, 4] {
+        let mut ex = Exporter::new(s.get(id).unwrap());
+        let mut got = Vec::new();
+        let result = ex.images_on(workers, &[0, 1, 99, 2, 3], 72.0, ImageFormat::Png, |p, _| {
+            got.push(p);
+            Ok(())
+        });
+        assert_eq!(result, Err("page 100 does not exist".to_string()), "{workers} workers");
+        assert_eq!(got, [0, 1], "{workers} workers");
+
+        let mut got = Vec::new();
+        let result = ex.images_on(workers, &[0, 1, 2, 3, 4, 5], 72.0, ImageFormat::Png, |p, _| {
+            got.push(p);
+            if p == 2 { Err("disk full".to_string()) } else { Ok(()) }
+        });
+        assert_eq!(result, Err("disk full".to_string()), "{workers} workers");
+        assert_eq!(got, [0, 1, 2], "{workers} workers");
+        // The exporter is still usable afterwards.
+        assert!(ex.image(5, 72.0, ImageFormat::Png).is_ok());
+    }
+    // A panicking sink stops the workers rather than leaving them waiting for it.
+    let mut ex = Exporter::new(s.get(id).unwrap());
+    let panicked = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        ex.images_on(4, &[0, 1, 2, 3, 4, 5], 72.0, ImageFormat::Png, |p, _| if p == 1 { panic!("sink") } else { Ok(()) })
+    }));
+    assert!(panicked.is_err());
+}
+
 /// A TIFF's resolution unit (2 = inch) and its horizontal and vertical resolution.
 fn tiff_resolution(bytes: &[u8]) -> (u32, f64, f64) {
     use tiff::{decoder::ifd::Value, tags::Tag};
@@ -3496,8 +3717,12 @@ fn added_images_rotate_flip_and_crop_as_drawn() {
     assert!(blue(colour_at(&s, 70, 150)) && red(colour_at(&s, 130, 150)), "flipped");
     img.flip_h = false;
     img.crop = [0.0, 0.0, 0.5, 0.0];
-    s.apply(id, Edit::UpdateContent { page: 0, index: 0, content: AddedContent::Image(img) }).unwrap();
+    s.apply(id, Edit::UpdateContent { page: 0, index: 0, content: AddedContent::Image(img.clone()) }).unwrap();
     assert!(red(colour_at(&s, 130, 150)), "the right half cropped away: red fills the box");
+    // More than half from one side: only the blue right part is left.
+    img.crop = [0.7, 0.0, 0.0, 0.0];
+    s.apply(id, Edit::UpdateContent { page: 0, index: 0, content: AddedContent::Image(img) }).unwrap();
+    assert!(blue(colour_at(&s, 53, 150)) && blue(colour_at(&s, 130, 150)), "70 % trimmed from the left: blue fills the box to its left edge");
 }
 
 #[test]
@@ -3720,6 +3945,78 @@ fn comments_lock_take_checkmarks_hide_and_summarize() {
     assert_eq!(comment_summary("x", &[], SummarySort::Page), "Summary of Comments on x\n\nThis document has no comments.\n");
 }
 
+/// Replies thread by their `/IRT` reference, not `/NM`: PyMuPDF names the first comment on every
+/// page `fitz-A0`, which used to file every reply under page 1's comment. An `/IRT` to the
+/// annotation itself, or to a link (never listed as a comment), leaves it a comment of its own. Both readers (inspect on open, and the
+/// comment list the engine refreshes after an edit) must agree.
+#[test]
+fn replies_thread_by_reference_when_names_repeat_across_pages() {
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [5 0 R 8 0 R 9 0 R 10 0 R] >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [6 0 R 7 0 R] >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (fitz-A0) /T (Alpha) /Contents (COVER) >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (fitz-A0) /T (Beta) /Contents (SECOND) >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 100 40 120] /NM (fitz-A1) /IRT 6 0 R /T (Gamma) /Contents (ANSWER) >> endobj
+8 0 obj << /Type /Annot /Subtype /Text /Rect [20 100 40 120] /NM (fitz-A1) /IRT 8 0 R /T (Delta) /Contents (SELF) >> endobj
+9 0 obj << /Type /Annot /Subtype /Link /Rect [200 20 260 40] /Border [0 0 0] /Dest [3 0 R /Fit] >> endobj
+10 0 obj << /Type /Annot /Subtype /Text /Rect [20 60 40 80] /NM (fitz-A2) /IRT 9 0 R /T (Echo) /Contents (LINKED) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("fitz.pdf", None, Arc::new(pdf.to_vec()), None).expect("opens");
+    let check = |s: &Session, replies: usize| {
+        let all = &s.get(id).unwrap().info.annotations;
+        let answer = all.iter().find(|a| a.contents.as_deref() == Some("ANSWER")).unwrap();
+        assert_eq!(answer.parent, Some((1, 0)), "{answer:?}");
+        let looped = all.iter().find(|a| a.contents.as_deref() == Some("SELF")).unwrap();
+        assert!(!looped.is_reply(), "{looped:?}");
+        let linked = all.iter().find(|a| a.contents.as_deref() == Some("LINKED")).unwrap();
+        assert!(!linked.is_reply(), "{linked:?}");
+        let text = comment_summary("fitz.pdf", all, SummarySort::Page);
+        let (cover, second) = text.split_once("SECOND").unwrap();
+        assert!(!cover.contains("ANSWER"), "page 1's comment has no replies: {text}");
+        assert!(cover.contains("Number: 2  Author: Delta"), "the self-reply is a comment of its own: {text}");
+        assert!(cover.contains("Number: 3  Author: Echo"), "so is the reply to a link: {text}");
+        assert_eq!(second.matches("    Author:").count(), replies, "{text}");
+    };
+    check(&s, 1);
+    s.apply(id, Edit::ReplyToAnnotation { page: 1, index: 0, text: "LATER".into(), author: "Delta".into() }).unwrap();
+    check(&s, 2);
+}
+
+/// A comment listed through a reference chain (`/Annots [5 0 R]`, `5 0 obj 6 0 R`) keeps its
+/// replies after an edit, whether their `/IRT` names the comment or the chain, as on open.
+#[test]
+fn replies_thread_through_a_reference_chain_after_an_edit() {
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [5 0 R 7 0 R 8 0 R 9 0 R] >> endobj
+5 0 obj 6 0 R endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (one) /Contents (CHAINED) >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 120 40 130] /IRT 6 0 R /Contents (TO THE COMMENT) >> endobj
+8 0 obj << /Type /Annot /Subtype /Text /Rect [20 100 40 110] /IRT 5 0 R /Contents (THROUGH THE CHAIN) >> endobj
+9 0 obj << /Type /Annot /Subtype /Text /Rect [20 60 40 80] /NM (two) /Contents (PLAIN) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("chain.pdf", None, Arc::new(pdf.to_vec()), None).expect("opens");
+    let check = |s: &Session| {
+        let all = &s.get(id).unwrap().info.annotations;
+        let comment = all.iter().find(|a| a.contents.as_deref() == Some("CHAINED")).expect("listed");
+        assert_eq!((comment.page, comment.index, comment.is_reply()), (0, 0, false), "{all:?}");
+        for reply in ["TO THE COMMENT", "THROUGH THE CHAIN"] {
+            let a = all.iter().find(|a| a.contents.as_deref() == Some(reply)).expect("listed");
+            assert_eq!((a.parent, a.in_reply_to.as_deref()), (Some((0, 0)), Some("one")), "{reply}: {all:?}");
+        }
+    };
+    check(&s);
+    s.apply(id, Edit::ReplyToAnnotation { page: 0, index: 3, text: "LATER".into(), author: "Delta".into() }).unwrap();
+    check(&s);
+}
+
 /// #820: the generated summary includes replies to replies, indented one level deeper.
 #[test]
 fn comment_summary_includes_replies_to_replies() {
@@ -5354,6 +5651,74 @@ fn static_xfa_forms_take_their_values_from_the_datasets_and_write_them_back() {
     assert!(!d2.info.warnings.iter().any(|w| w.contains("taken from this form's XFA data")), "nothing was rewritten");
 }
 
+/// A static XFA form whose values are only in its datasets takes every one on opening, as
+/// filling the fields one at a time would leave it: values, appearances and the note; a
+/// read-only field keeps its own value.
+#[test]
+fn a_static_xfa_form_takes_many_data_values_as_one_by_one() {
+    let n = 60;
+    let original = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(n));
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("many.pdf", None, original.clone(), None).expect("opens");
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.info.xfa, Some(pdfcraft_render::Xfa::Static));
+    assert!(!doc.dirty && doc.bytes.starts_with(&original[..]), "the values are an appended revision");
+    // The read-only first field keeps its own (empty) value, and is not named.
+    let note = doc.info.warnings.iter().find(|w| w.contains("taken from this form's XFA data")).expect("a warning");
+    assert!(note.starts_with("59 form field values") && note.contains("form1[0].page1[0].f1[0]") && note.ends_with("and 54 more"), "{note}");
+    assert!(!note.contains("f0[0]"), "{note}");
+    // The same values filled one at a time.
+    let mut one_by_one = pdfcraft_cos::Document::open(original).unwrap();
+    for i in 0..n {
+        let r = pdfcraft_forms::set_value(&mut one_by_one, &format!("form1[0].page1[0].f{i}[0]"), &FieldValue::Text(format!("v{i}")));
+        assert_eq!(r.is_err(), i == 0, "field {i}: {r:?}");
+    }
+    let opened = &doc.editor.as_ref().unwrap().cos;
+    let shown = |d: &pdfcraft_cos::Document| -> Vec<(String, Vec<String>, String)> {
+        pdfcraft_forms::fields(d)
+            .into_iter()
+            .map(|f| {
+                let w = f.widgets.first().map(|w| w.obj).unwrap();
+                let ap = d.get(w).as_dict().and_then(|w| w.get(b"AP").cloned()).map(|a| d.resolve(&a));
+                let n = ap.and_then(|ap| ap.as_dict().and_then(|a| a.get(b"N").cloned())).map(|n| d.resolve(&n));
+                let look = match n.as_deref() {
+                    Some(pdfcraft_cos::Object::Stream(st)) => String::from_utf8_lossy(&st.decoded().unwrap()).into_owned(),
+                    _ => String::new(),
+                };
+                (f.name, f.value, look)
+            })
+            .collect()
+    };
+    let got = shown(opened);
+    assert_eq!(got.len(), n);
+    assert_eq!(got, shown(&one_by_one));
+    assert!(got[0].1.is_empty());
+    assert!(got.iter().enumerate().skip(1).all(|(i, (_, v, ap))| *v == [format!("v{i}")] && ap.contains(&format!("(v{i})"))));
+}
+
+/// Opening a static XFA form whose datasets fill thousands of fields took minutes: each value
+/// read the whole form again (twice), so the time grew with the square of the fields. Eight
+/// times the fields now takes at most about eight times as long (it took about fifty).
+#[test]
+fn opening_a_static_xfa_form_grows_linearly_with_its_data_values() {
+    let time = |n: usize| {
+        let bytes = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(n));
+        (0..3)
+            .map(|_| {
+                let mut s = Session::new();
+                let start = std::time::Instant::now();
+                s.open("many.pdf", None, bytes.clone(), None).expect("opens");
+                start.elapsed()
+            })
+            .min()
+            .unwrap_or_default()
+    };
+    let small = time(100);
+    let large = time(800);
+    let ratio = large.as_secs_f64() / small.as_secs_f64().max(1e-6);
+    assert!(ratio < 16.0, "100 fields: {small:?}, 800 fields: {large:?} ({ratio:.1}x)");
+}
+
 /// A date goes into the XFA data in the field's data picture (`<bind><picture>`), as other
 /// viewers write and read it, and comes back from there when the form is opened again. It used
 /// to be written as an ISO date whatever the picture said.
@@ -5437,6 +5802,8 @@ fn xfa_data_no_field_binds_to_survives_an_edit_and_save() {
     assert!(doc.xfa_warnings.iter().any(|w| w.contains("structured content")));
 }
 
+/// An XFA form's choice lists, signature and picture fields open as their kinds of field, take
+/// values that scripts read, and are saved into the datasets.
 #[test]
 fn xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save() {
     let data = "<form><page1><country>Japan</country><langs>English\nSpanish</langs></page1></form>";
@@ -5456,7 +5823,8 @@ fn xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save() {
     assert_eq!(langs.value, vec!["English".to_string(), "Spanish".to_string()]);
     assert!(field(&s, "other").has(pdfcraft_forms::flags::EDIT));
     assert!(field(&s, "pin").has(pdfcraft_forms::flags::PASSWORD));
-    assert_eq!(field(&s, "sign").kind, K::Signature);
+    // The signature field is named by its SOM path, as another viewer finds a signature.
+    assert_eq!(field(&s, "form[0].page1[0].sign[0]").kind, K::Signature);
     // Scripts read a choice list's saved value.
     assert_eq!(field(&s, "summary").value, vec!["Country: JP".to_string()], "{:?}", s.take_js_output(id));
     // Choosing another item recalculates; the list takes several values; a typed value is kept
@@ -5614,7 +5982,8 @@ fn xfa_data_import_on_a_static_form_replaces_every_value_and_pictures_reach_its_
 #[test]
 fn xfa_data_import_adds_and_removes_rows_of_a_dynamic_form() {
     let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::scripted_template()));
-    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    // Raised time limits: a busy machine does not stop the calculations this checks.
+    let mut s = Session::new().with_clock(|| 1_700_000_000).with_xfa_time_scale(100);
     let id = s.open("rows.pdf", None, bytes, None).expect("opens");
     let names = |s: &Session| s.get(id).unwrap().form.iter().map(|f| f.name.clone()).collect::<Vec<_>>();
     let value = |s: &Session, n: &str| s.get(id).unwrap().form.iter().find(|f| f.name == n).map(|f| f.value.clone()).unwrap_or_default();
@@ -5643,16 +6012,19 @@ fn xfa_data_import_adds_and_removes_rows_of_a_dynamic_form() {
     assert!(String::from_utf8_lossy(&out).contains("<item>only</item>"));
 }
 
-/// Hundreds of calculations, in JavaScript and FormCalc, run on opening in one engine within
-/// the opening's budget, and a change recalculates them within the event's.
+/// Hundreds of calculations, in JavaScript and FormCalc, run on opening in one engine, and a
+/// change recalculates them in one more. The time limits are raised so that a busy machine
+/// does not stop them; the next test checks that the limits stop them.
 #[test]
-fn hundreds_of_xfa_calculations_run_in_one_engine_within_the_open_budget() {
+fn hundreds_of_xfa_calculations_run_in_one_engine() {
     let (sections, rows) = (10, 20);
     let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::many_calculations_template(sections, rows)));
-    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let mut s = Session::new().with_clock(|| 1_700_000_000).with_xfa_time_scale(100);
+    let engines = pdfcraft_js::xfa_session::engines_started();
     let started = std::time::Instant::now();
     let id = s.open("many.pdf", None, bytes, None).expect("opens");
     let elapsed = started.elapsed();
+    assert_eq!(pdfcraft_js::xfa_session::engines_started() - engines, 1, "the scripts of the opening share one engine");
     let out = s.take_js_output(id);
     assert!(!out.errors.iter().any(|e| e.contains("were skipped") || e.contains("stopped")), "{:?}", out.errors);
     let form = &s.get(id).unwrap().form;
@@ -5665,9 +6037,10 @@ fn hundreds_of_xfa_calculations_run_in_one_engine_within_the_open_budget() {
     let expect = (rows * (rows + 1)).to_string();
     assert!(sums.iter().all(|f| f.value == vec![expect.clone()]), "{:?}", sums.iter().map(|f| f.value.clone()).collect::<Vec<_>>());
     eprintln!("{} calculate scripts on open in {elapsed:?}", sections * rows + sections);
-    // A change recalculates them all again, well within the event budget.
+    // A change recalculates them all again, in one more engine.
     let started = std::time::Instant::now();
     s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text("100".into()) }).unwrap();
+    assert_eq!(pdfcraft_js::xfa_session::engines_started() - engines, 2, "the scripts of the change share one engine");
     let out = s.take_js_output(id);
     assert!(!out.errors.iter().any(|e| e.contains("were skipped")), "{:?}", out.errors);
     assert_eq!(s.get(id).unwrap().form.iter().find(|f| f.name == "total").unwrap().value, vec!["200".to_string()]);
@@ -5675,6 +6048,28 @@ fn hundreds_of_xfa_calculations_run_in_one_engine_within_the_open_budget() {
     eprintln!("recalculated after a change in {:?}", started.elapsed());
 }
 
+/// The time the scripts of an opening share stops the calculations it has no time for, and
+/// says how many were skipped; a change's scripts are stopped the same way.
+#[test]
+fn the_xfa_open_budget_stops_the_calculations_it_has_no_time_for() {
+    let (sections, rows) = (10, 20);
+    let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::many_calculations_template(sections, rows)));
+    // A time scale of 0 leaves no time at all: every script is skipped before it starts.
+    let mut s = Session::new().with_clock(|| 1_700_000_000).with_xfa_time_scale(0);
+    let engines = pdfcraft_js::xfa_session::engines_started();
+    let id = s.open("many.pdf", None, bytes, None).expect("opens");
+    let skipped = sections * rows + sections;
+    let stopped = format!("The form's scripts were stopped: the scripts took more than 0 seconds; {skipped} more were skipped");
+    assert_eq!(s.take_js_output(id).errors, vec![stopped.clone()]);
+    let totals = |s: &Session| s.get(id).unwrap().form.iter().filter(|f| f.name.starts_with("total")).map(|f| f.value.clone()).collect::<Vec<_>>();
+    assert_eq!(totals(&s).len(), sections * rows);
+    assert!(totals(&s).iter().all(Vec::is_empty), "no total was calculated: {:?}", totals(&s));
+    s.apply(id, Edit::SetFieldValue { name: "qty".into(), value: FieldValue::Text("100".into()) }).unwrap();
+    assert!(s.take_js_output(id).errors.iter().any(|e| e.starts_with("The form's scripts were stopped: the scripts took more than 0 seconds")));
+    assert!(totals(&s).iter().all(Vec::is_empty), "no total was calculated: {:?}", totals(&s));
+    assert_eq!(pdfcraft_js::xfa_session::engines_started(), engines, "no script ran, so no engine started");
+}
+
 /// The scripts of one event share the form as the engine holds it: a failed script's
 /// half-done writes reach nobody, and a script reads the saved value a choice list was given
 /// by its shown text.
@@ -6413,6 +6808,42 @@ fn comments_without_appearances_are_drawn_but_not_saved() {
     }
 }
 
+/// ISO 32000-2 Table 178: with `/LL`, `/L` gives the ends of the leader lines, and the line itself
+/// is drawn `/LL` from it (above, for a positive `/LL` on a line drawn left to right). The page
+/// view shows the line there, with its leaders down to `/L`, and nothing along `/L` itself.
+#[test]
+fn a_line_without_an_appearance_is_drawn_at_its_leader_length() {
+    let objs: Vec<&[u8]> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
+        b"<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>",
+        b"<< /Type /Annot /Subtype /Line /Rect [0 0 200 300] /L [40 100 160 100] /LL 30 /C [1 0 0] /BS << /W 4 >> >>",
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        bytes.extend_from_slice(o);
+        bytes.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("line.pdf", None, Arc::new(bytes), None).expect("opens");
+    let p = shown(&s, id, 0);
+    let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    // y down: /L is row 200, the line itself row 170.
+    assert_eq!(px(100, 170), vec![255, 0, 0, 255], "the line, 30 above /L");
+    assert_eq!(px(40, 185), vec![255, 0, 0, 255], "the leader line at the start");
+    assert_eq!(px(160, 185), vec![255, 0, 0, 255], "the leader line at the end");
+    assert_eq!(px(100, 200), vec![255, 255, 255, 255], "nothing along /L");
+}
+
 /// A stamp's `/Rect` and the colour family expected inside it.
 type StampRect = ([f64; 4], char);
 
@@ -8288,3 +8719,70 @@ fn pdf_with_annots(annots: &[&[u8]]) -> Vec<u8> {
     bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
     bytes
 }
+
+/// ISO 32000-2 Table 224 (`/NeedAppearances`) and Table 192 (`/MK /CA`): a form that leaves its
+/// appearances to the viewer shows its check boxes and radio buttons drawn from `/MK`, over the
+/// filled squares the file carries: a checked box its check mark (ZapfDingbats `4`), an unchecked
+/// one its empty border, a radio button its dot (`l`), on screen and printed as an image. Without
+/// `/NeedAppearances` the file's own squares show. Saving writes the file as it was.
+#[test]
+fn need_appearances_buttons_are_displayed_from_their_captions() {
+    let pdf = |need: bool| {
+        let flag = if need { "/NeedAppearances true " } else { "" };
+        format!(
+            "%PDF-1.7\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 400 200] /Annots [6 0 R 7 0 R 8 0 R] >> endobj\n\
+             4 0 obj << /Fields [6 0 R 7 0 R 8 0 R] {flag}/DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> endobj\n\
+             5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj\n\
+             6 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /T (on) /V /Yes /AS /Yes /DA (/Helv 0 Tf 0 g) /MK << /BC [0 0 0] /CA (4) >> /Rect [20 100 60 140] /F 4 /P 3 0 R /AP << /N << /Yes 9 0 R /Off 9 0 R >> >> >> endobj\n\
+             7 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /T (off) /V /Off /AS /Off /DA (/Helv 0 Tf 0 g) /MK << /BC [0 0 0] /CA (4) >> /Rect [100 100 140 140] /F 4 /P 3 0 R /AP << /N << /Yes 9 0 R /Off 9 0 R >> >> >> endobj\n\
+             8 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /Ff 32768 /T (radio) /V /B /AS /B /DA (/Helv 0 Tf 0 g) /MK << /BC [0 0 0] /CA (l) >> /Rect [180 100 220 140] /F 4 /P 3 0 R /AP << /N << /B 9 0 R /Off 9 0 R >> >> >> endobj\n\
+             9 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Length 18 >> stream\n0 g 4 4 32 32 re f\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF"
+        )
+        .into_bytes()
+    };
+    let render = |bytes: Arc<Vec<u8>>| {
+        let mut r = pdfcraft_render::PageRenderer::new(bytes, pdfcraft_render::RenderConfig::default());
+        r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() })
+    };
+    // Dark pixels of the page (drawn at scale 1, 400 x 200) in the user-space box x0..x1, y0..y1.
+    let ink = |page: &pdfcraft_render::RenderedPage, (x0, y0, x1, y1): (u32, u32, u32, u32)| {
+        let (px, _) = page.rgba.as_chunks::<4>();
+        (200 - y1..200 - y0)
+            .flat_map(|y| (x0..x1).map(move |x| (x, y)))
+            .filter(|&(x, y)| px.get((y * page.width + x) as usize).is_some_and(|p| p[0] < 128 && p[1] < 128 && p[2] < 128))
+            .count()
+    };
+    // In a widget whose lower-left corner is (x, y): its whole inside, the top-left of its inside
+    // (where a check mark leaves the box empty), and the lower-left corner (outside a dot).
+    let inside = |x: u32, y: u32| (x + 6, y + 6, x + 34, y + 34);
+    let top_left = |x: u32, y: u32| (x + 6, y + 26, x + 14, y + 34);
+    let corner = |x: u32, y: u32| (x + 5, y + 5, x + 9, y + 9);
+    let mut s = Session::new();
+    let id = s.open("form.pdf", None, Arc::new(pdf(true)), None).unwrap();
+    let shown = render(s.get(id).unwrap().display.clone());
+    let raster = pdfcraft_print::Raster { dpi: 72.0, grayscale: false };
+    let pictures = crate::print_raster::rasterize(s.get(id).unwrap(), &[0], &raster, pdfcraft_print::Content::Document).unwrap();
+    let printed = render(Arc::new(pictures));
+    for (page, how) in [(&shown, "shown"), (&printed, "printed")] {
+        let (check, check_corner) = (ink(page, inside(20, 100)), ink(page, top_left(20, 100)));
+        assert!(check > 100 && check < 600, "{how}: a check mark, not the 28 x 28 square: {check}");
+        assert_eq!(check_corner, 0, "{how}: the check mark leaves the top left empty");
+        assert_eq!(ink(page, inside(100, 100)), 0, "{how}: the unchecked box is empty");
+        assert!(ink(page, (100, 100, 140, 102)) > 30, "{how}: and keeps its border");
+        let dot = ink(page, (188, 108, 212, 132));
+        assert!(dot > 300 && ink(page, corner(180, 100)) == 0, "{how}: the radio button's dot: {dot}");
+    }
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.windows(18).any(|w| w == b"0 g 4 4 32 32 re f"), "the file keeps its own appearances");
+
+    // Without /NeedAppearances the file's filled squares are shown.
+    let id = s.open("plain.pdf", None, Arc::new(pdf(false)), None).unwrap();
+    let shown = render(s.get(id).unwrap().display.clone());
+    for x in [20, 100, 180] {
+        assert!(ink(&shown, inside(x, 100)) > 700, "the file's square at {x}");
+    }
+}
diff --git a/crates/engine/src/text_preview.rs b/crates/engine/src/text_preview.rs
index d533faf7e0..290231cf73 100644
--- a/crates/engine/src/text_preview.rs
+++ b/crates/engine/src/text_preview.rs
@@ -89,4 +89,17 @@ impl Document {
             Ok(TextEditPreview { page, bytes, config: self.config.clone() })
         })?
     }
+
+    /// An added item alone, on a transparent page: what follows the pointer while it is dragged,
+    /// so the page under its first place doesn't come along. Read-only, like
+    /// [`Self::added_content_preview`].
+    pub fn added_content_alone(&self, page: usize, index: usize) -> Result<TextEditPreview, String> {
+        guard(|| {
+            let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+            let mut cos = editor.cos.clone();
+            pdfcraft_edit::isolate_content(&mut cos, page, index).map_err(|e| e.to_string())?;
+            let bytes = Arc::new(pdfcraft_cos::write_incremental(&cos, &pdfcraft_cos::SaveOptions::default()).map_err(|e| e.to_string())?);
+            Ok(TextEditPreview { page, bytes, config: RenderConfig { transparent: true, ..self.config.clone() } })
+        })?
+    }
 }
diff --git a/crates/engine/src/word_count.rs b/crates/engine/src/word_count.rs
index bd31c27e4c..feeb0a066f 100644
--- a/crates/engine/src/word_count.rs
+++ b/crates/engine/src/word_count.rs
@@ -110,6 +110,16 @@ fn standard_role(doc: &pdfcraft_cos::Document, map: &Dict, role: &[u8]) -> Vec<u
     role
 }
 
+/// Whether the page's resources hold a Form XObject, whose MCIDs are a separate namespace.
+fn page_has_form_xobject(doc: &pdfcraft_cos::Document, page: &pdfcraft_cos::Dict) -> bool {
+    let resources = page.get(b"Resources").map(|o| doc.resolve(o));
+    let objects = resources.as_ref().and_then(|o| o.as_dict()).and_then(|d| d.get(b"XObject")).map(|o| doc.resolve(o));
+    objects
+        .as_ref()
+        .and_then(|o| o.as_dict())
+        .is_some_and(|d| d.iter().any(|(_, value)| matches!(&*doc.resolve(value), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Form"))))
+}
+
 type Exclusions = HashMap<usize, HashSet<i32>>;
 
 /// Resolve page-local MCIDs through the structure hierarchy, including inherited roles and
@@ -179,11 +189,7 @@ fn exclusions(source: &ExportSource, options: Options) -> Result<(Exclusions, bo
         if !out.contains_key(&index) {
             continue;
         }
-        let resources = page.dict.get(b"Resources").map(|o| doc.resolve(o));
-        let objects = resources.as_ref().and_then(|o| o.as_dict()).and_then(|d| d.get(b"XObject")).map(|o| doc.resolve(o));
-        let has_form = objects.as_ref().and_then(|o| o.as_dict()).is_some_and(|d| {
-            d.iter().any(|(_, value)| matches!(&*doc.resolve(value), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Form")))
-        });
+        let has_form = page_has_form_xobject(&doc, &page.dict);
         if has_form {
             out.remove(&index);
             unclassified = true;
diff --git a/crates/engine/src/xfa.rs b/crates/engine/src/xfa.rs
index 2f98efdb04..dd011d47fc 100644
--- a/crates/engine/src/xfa.rs
+++ b/crates/engine/src/xfa.rs
@@ -128,6 +128,10 @@ pub(crate) struct XfaRun<'a> {
     pub datasets: Option<pdfcraft_cos::ObjRef>,
     /// A script ran past its time limit and was abandoned: the form's scripts should stay off.
     pub ran_away: bool,
+    /// What every time limit of the scripts is multiplied by (the event's budget, the engine's
+    /// start and each script's own): 1, unless the session was given another
+    /// ([`crate::Session::with_xfa_time_scale`]).
+    pub time_scale: u32,
 }
 
 /// The live form node `n`, with its descendants, as the script engine's snapshot of it.
@@ -277,6 +281,7 @@ impl<'a, 'b> Runner<'a, 'b> {
     fn new(doc: &'a mut pdfcraft_cos::Document, tpl: &'a Template, run: &'a mut XfaRun<'b>, budget_ms: u64) -> Self {
         let data = pdfcraft_xfa::data_of(doc);
         let ov = pdfcraft_xfa::overrides(doc);
+        let budget_ms = budget_ms.saturating_mul(u64::from(run.time_scale));
         Runner {
             doc,
             tpl,
@@ -311,7 +316,8 @@ impl<'a, 'b> Runner<'a, 'b> {
     /// The script engine for this event.
     fn session(&mut self) -> &mut XfaSession {
         let doc_info = XfaDoc { file_name: String::new(), page: 0, page_count: self.run.page_count };
-        self.session.get_or_insert_with(|| XfaSession::new(doc_info))
+        let scale = self.run.time_scale;
+        self.session.get_or_insert_with(|| XfaSession::new(doc_info).with_time_scale(scale))
     }
 
     /// Give the object at `som` the value `text` in the data and in the live form (refreshed
@@ -661,7 +667,7 @@ impl<'a, 'b> Runner<'a, 'b> {
             event,
             root,
             limits: limits_for(&ev.activity),
-            timeout: timeout_for(&ev.activity),
+            timeout: timeout_for(&ev.activity).saturating_mul(self.run.time_scale),
         };
         let o = self.session().run(script);
         if o.abandoned {
@@ -893,7 +899,7 @@ pub(crate) fn on_event(doc: &mut pdfcraft_cos::Document, tpl: &Template, som: &s
         r.run(&ev, "")?;
     }
     // The calculations that follow get a budget of their own.
-    r.clock = Clock::start(OPEN_BUDGET_MS);
+    r.clock = Clock::start(OPEN_BUDGET_MS.saturating_mul(u64::from(r.run.time_scale)));
     r.calculates()?;
     r.finish().map(|_| ())
 }
diff --git a/crates/engine/src/xfa_form.rs b/crates/engine/src/xfa_form.rs
new file mode 100644
index 0000000000..5ceaba1cd4
--- /dev/null
+++ b/crates/engine/src/xfa_form.rs
@@ -0,0 +1,297 @@
+//! A document's XFA form: laying it out, keeping its datasets and fields in step, and taking it out.
+
+use crate::edit::EditCtx;
+use crate::{Document, EditError, FieldValue, XfaLayout, guard, xfa};
+
+/// Lay a dynamic XFA form out (pages and fields) and give its widgets appearances.
+pub(crate) fn xfa_layout(doc: &mut pdfcraft_cos::Document) -> Result<XfaLayout, String> {
+    let mut report = pdfcraft_xfa::render_into(doc).map_err(|e| e.to_string())?;
+    xfa_redraw(doc)?;
+    // The form's own values: one its field's font can't draw is drawn with `?` and reported.
+    report.warnings.extend(undrawn_field_warnings(doc));
+    Ok(report)
+}
+
+/// Give the fields of a laid-out XFA form their appearances. A signed signature box keeps the
+/// picture its signer's application drew.
+pub(crate) fn xfa_redraw(doc: &mut pdfcraft_cos::Document) -> Result<(), String> {
+    for f in pdfcraft_forms::fields(doc) {
+        if f.kind == pdfcraft_forms::FieldKind::Signature && doc.get(f.obj).as_dict().is_some_and(|d| d.contains(b"V")) {
+            continue;
+        }
+        pdfcraft_forms::redraw_field(doc, &f.name).map_err(|e| format!("{}: {e}", f.name))?;
+    }
+    Ok(())
+}
+
+/// A warning for each field whose appearance PdfCraft drew with `?` for a character its font
+/// can't draw (laying out an XFA form's own values).
+pub(crate) fn undrawn_field_warnings(doc: &pdfcraft_cos::Document) -> Vec<String> {
+    pdfcraft_forms::undrawn_fields(doc)
+        .into_iter()
+        .map(|(name, c)| {
+            format!("form field {name:?} holds \"{}\" (U+{:04X}), which its font can't draw: it shows ? in its place", c.escape_debug(), u32::from(c))
+        })
+        .collect()
+}
+
+/// The form's fields as the XFA data layer wants them.
+fn xfa_field_data(doc: &pdfcraft_cos::Document) -> Vec<pdfcraft_xfa::FieldDatum> {
+    use pdfcraft_forms::FieldKind as K;
+    pdfcraft_forms::fields(doc)
+        .into_iter()
+        .map(|f| {
+            let data = match f.kind {
+                K::Text | K::Combo | K::List => pdfcraft_xfa::FieldData::Text(f.value.join("\n")),
+                K::CheckBox => pdfcraft_xfa::FieldData::Check(!f.value.is_empty()),
+                K::Radio => pdfcraft_xfa::FieldData::Radio(f.value.first().cloned()),
+                K::PushButton | K::Signature => pdfcraft_xfa::FieldData::None,
+            };
+            pdfcraft_xfa::FieldDatum { obj: f.obj, name: f.name, data }
+        })
+        .collect()
+}
+
+/// Keep the XFA datasets packet in step with the fields after an edit. Returns what could not
+/// be written.
+/// `datasets`: the stream this edit already wrote, replaced in place rather than added again
+/// (and set to the one written).
+/// `tpl`: the form's parsed template when the document has one cached (else it is parsed).
+pub(crate) fn xfa_sync_datasets(
+    doc: &mut pdfcraft_cos::Document,
+    tpl: Option<&pdfcraft_xfa::model::Template>,
+    datasets: &mut Option<pdfcraft_cos::ObjRef>,
+) -> Result<Vec<String>, String> {
+    let data = xfa_field_data(doc);
+    let r = pdfcraft_xfa::write_datasets_with(doc, tpl, &data, *datasets).map_err(|e| e.to_string())?;
+    if r.stream.is_some() {
+        *datasets = r.stream;
+    }
+    Ok(r.warnings)
+}
+
+/// What a document whose form script ran away is told.
+pub(crate) const XFA_SCRIPTS_OFF: &str =
+    "A script of this form ran too long and was abandoned; the form's scripts are off for this document (reopen it to run them again)";
+
+/// Most XFA warnings kept per document.
+const MAX_XFA_WARNINGS: usize = 50;
+
+/// Add `new` to `list` (no repeats, at most [`MAX_XFA_WARNINGS`]).
+pub(crate) fn note_warnings(list: &mut Vec<String>, new: &[String]) {
+    for w in new {
+        if !list.contains(w) && list.len() < MAX_XFA_WARNINGS {
+            list.push(w.clone());
+        }
+    }
+}
+
+/// A data file's text: UTF-8 or UTF-16 (by a byte order mark, or how `<` is written), or
+/// Latin-1 when its XML declaration says so. `None`: not text at all (FDF); `Err`: an
+/// encoding this can't read.
+pub(crate) fn decode_data_file(bytes: &[u8]) -> Option<Result<String, String>> {
+    if bytes.starts_with(b"%FDF") {
+        return None;
+    }
+    let declared = |text: &str| -> Option<String> {
+        let head = text.get(..text.len().min(256))?;
+        let decl = head.strip_prefix('\u{feff}').unwrap_or(head).trim_start().strip_prefix("<?xml")?;
+        let decl = decl.split_once("?>")?.0;
+        let enc = decl.split_once("encoding=")?.1;
+        let quote = enc.chars().next()?;
+        Some(enc.get(1..)?.split(quote).next()?.trim().to_ascii_lowercase())
+    };
+    if let Some((text, _)) = pdfcraft_xfa::packets::decode(bytes) {
+        match declared(&text).as_deref() {
+            None | Some("utf-8" | "utf8" | "utf-16" | "utf-16le" | "utf-16be" | "us-ascii" | "ascii") => return Some(Ok(text)),
+            Some("iso-8859-1" | "latin1" | "latin-1" | "windows-1252" | "cp1252") if !bytes.starts_with(&[0xEF, 0xBB, 0xBF]) => {
+                // Each byte is the character it names (the 0x80–0x9F block of Windows-1252
+                // differs, and is rare in form data).
+                return Some(Ok(bytes.iter().map(|b| char::from(*b)).collect()));
+            }
+            Some(other) => return Some(Err(format!("the data file's encoding {other:?} is not supported (UTF-8, UTF-16 and ISO-8859-1 are)"))),
+        }
+    }
+    // Not valid UTF-8/UTF-16: Latin-1 by declaration, else refused.
+    let latin1: String = bytes.iter().map(|b| char::from(*b)).collect();
+    match declared(&latin1).as_deref() {
+        Some("iso-8859-1" | "latin1" | "latin-1" | "windows-1252" | "cp1252") => Some(Ok(latin1)),
+        _ => Some(Err("the data file is not UTF-8, UTF-16 or ISO-8859-1 text".into())),
+    }
+}
+
+/// Take the XFA out of `doc` and note what went with it: the packets, data no field showed,
+/// buttons that did nothing but run scripts, and fields whose value differs from the form's
+/// data (data PdfCraft could not read into them, now lost).
+pub(crate) fn strip_xfa(doc: &mut pdfcraft_cos::Document, cx: &mut EditCtx) -> Result<(), EditError> {
+    let fields = pdfcraft_forms::fields(doc);
+    let data = xfa_field_data(doc);
+    let differ = pdfcraft_xfa::read_values(doc, &data)
+        .into_iter()
+        .filter(|(name, value)| {
+            let Some(f) = fields.iter().find(|f| f.name == *name) else { return false };
+            match value {
+                pdfcraft_xfa::FieldData::Text(t) => f.value.join("\n") != *t && !t.trim().is_empty(),
+                pdfcraft_xfa::FieldData::Check(on) => f.value.is_empty() == *on,
+                pdfcraft_xfa::FieldData::Radio(sel) => f.value.first() != sel.as_ref(),
+                pdfcraft_xfa::FieldData::None => false,
+            }
+        })
+        .count();
+    let r = pdfcraft_xfa::strip(doc).map_err(|e| EditError::Write(e.to_string()))?;
+    cx.xfa_removed.extend(r.notes());
+    if differ > 0 {
+        cx.xfa_removed.push(format!(
+            "{differ} field(s) held a value other than the form's XFA data (data PdfCraft could not read into them); the data's version is gone"
+        ));
+    }
+    Ok(())
+}
+
+/// Keep the document's XFA state in step with its file after an edit: a script may have laid
+/// the form out again (rows added, subforms shown), an edit may have taken the XFA out
+/// (flattened, or made static), or an undo put it back.
+pub(crate) fn sync_xfa_state(doc: &mut Document) {
+    let Some(cos) = doc.editor.as_ref().map(|e| &e.cos) else { return };
+    match pdfcraft_xfa::existing_layout(cos) {
+        Some(report) => {
+            if doc.xfa.is_none() {
+                // Back after an undo: the XFA's own warnings apply again, the strip's don't.
+                doc.xfa_warnings.retain(|w| !w.starts_with(XFA_REMOVED_PREFIX));
+                if doc.xfa_template.is_none() && !doc.xfa_scripts_off {
+                    doc.xfa_template = xfa::template(cos);
+                }
+            }
+            doc.xfa = Some(report);
+        }
+        None => {
+            doc.xfa = None;
+            doc.xfa_template = None;
+            // Only what the strip said stays (the XFA's own warnings no longer apply).
+            doc.xfa_warnings.retain(|w| w.starts_with(XFA_REMOVED_PREFIX));
+        }
+    }
+}
+
+/// How the warnings of a strip start, so they can be told from the XFA's own.
+pub(crate) const XFA_REMOVED_PREFIX: &str = "XFA removed: ";
+
+/// Is this an XFA data file (an XDP, a datasets document, a data element or a data document),
+/// rather than XFDF, Acrobat's `<fields>` XML or a table? By its root element.
+pub(crate) fn is_xfa_data_file(text: &str) -> bool {
+    let text = text.get(..text.len().min(65_536)).unwrap_or(text);
+    let mut rest = text.trim_start_matches('\u{feff}').trim_start();
+    // Past the XML declaration, comments and processing instructions.
+    let mut guard = 0;
+    while guard < 100 {
+        guard += 1;
+        if let Some(r) = rest.strip_prefix("<?") {
+            rest = r.split_once("?>").map_or("", |(_, r)| r).trim_start();
+        } else if let Some(r) = rest.strip_prefix("<!--") {
+            rest = r.split_once("-->").map_or("", |(_, r)| r).trim_start();
+        } else if let Some(r) = rest.strip_prefix("<!") {
+            rest = r.split_once('>').map_or("", |(_, r)| r).trim_start();
+        } else {
+            break;
+        }
+    }
+    let Some(tag) = rest.strip_prefix('<') else { return false };
+    let name = tag.split(|c: char| c.is_whitespace() || c == '>' || c == '/').next().unwrap_or("");
+    let local = name.rsplit(':').next().unwrap_or(name);
+    !local.is_empty() && !matches!(local, "xfdf" | "fields" | "html" | "body")
+}
+
+/// The content type a picture is saved under, from its bytes: the kinds a laid-out form shows.
+pub(crate) fn image_content_type(bytes: &[u8]) -> Option<&'static str> {
+    match pdfcraft_xfa::image::kind(bytes)? {
+        pdfcraft_xfa::image::Kind::Jpeg => Some("image/jpeg"),
+        pdfcraft_xfa::image::Kind::Png => Some("image/png"),
+        pdfcraft_xfa::image::Kind::Gif => Some("image/gif"),
+        pdfcraft_xfa::image::Kind::Bmp => Some("image/bmp"),
+        pdfcraft_xfa::image::Kind::Tiff => Some("image/tiff"),
+    }
+}
+
+/// After the XFA data changed outside the fields (an import, a picture): a laid-out form is
+/// laid out again from the data (then, when `calculate`, its calculations run), and the
+/// fields take the data's values.
+pub(crate) fn xfa_after_data_change(doc: &mut pdfcraft_cos::Document, cx: &mut EditCtx, calculate: bool) -> Result<(), EditError> {
+    if let Some(tpl) = cx.xfa.clone() {
+        let mut run =
+            xfa::XfaRun { page_count: cx.pages, out: &mut cx.xfa_out, datasets: cx.xfa_datasets, ran_away: false, time_scale: cx.xfa_time_scale };
+        let r = guard(|| xfa::on_data_replaced(doc, &tpl, calculate, &mut run))
+            .unwrap_or_else(|m| Err(format!("laying the form out again failed unexpectedly ({m})")));
+        cx.xfa_datasets = run.datasets;
+        cx.xfa_ran_away |= run.ran_away;
+        if let Err(e) = r {
+            cx.xfa_out.errors.push(e);
+        }
+    }
+    let taken = xfa_values_from_datasets(doc).map_err(EditError::Write)?;
+    if !taken.is_empty() {
+        cx.xfa_out.console.push(format!("{} field value(s) taken from the imported data", taken.len()));
+    }
+    // Not laid out again (a static form, or scripts off): fields the data no longer holds are
+    // emptied, so the data replaced is the data shown.
+    if cx.xfa.is_none() && calculate {
+        let data = xfa_field_data(doc);
+        let present: std::collections::HashSet<String> = pdfcraft_xfa::read_values(doc, &data).into_iter().map(|(n, _)| n).collect();
+        for f in pdfcraft_forms::fields(doc) {
+            if present.contains(&f.name) || f.value.is_empty() {
+                continue;
+            }
+            use pdfcraft_forms::FieldKind as K;
+            let empty = match f.kind {
+                K::Text => FieldValue::Text(String::new()),
+                K::CheckBox => FieldValue::Check(false),
+                K::Radio => FieldValue::Radio(None),
+                K::Combo | K::List => FieldValue::Choice(Vec::new()),
+                K::PushButton | K::Signature => continue,
+            };
+            if let Err(e) = pdfcraft_forms::set_value(doc, &f.name, &empty) {
+                cx.xfa_out.errors.push(format!("{}: not emptied by the import: {e}", f.name));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Give the fields the values the XFA datasets hold (a form filled in another viewer). Returns
+/// the names of the fields that changed.
+pub(crate) fn xfa_values_from_datasets(doc: &mut pdfcraft_cos::Document) -> Result<Vec<String>, String> {
+    let data = xfa_field_data(doc);
+    let fields = pdfcraft_forms::fields(doc);
+    // The first field of each name, as a lookup by name would find it.
+    let mut by_name = std::collections::HashMap::new();
+    for f in &fields {
+        by_name.entry(f.name.as_str()).or_insert(f);
+    }
+    let mut updates = Vec::new();
+    for (name, value) in pdfcraft_xfa::read_values(doc, &data) {
+        let Some(f) = by_name.get(name.as_str()) else { continue };
+        let new = match value {
+            pdfcraft_xfa::FieldData::Text(t) if matches!(f.kind, pdfcraft_forms::FieldKind::Combo | pdfcraft_forms::FieldKind::List) => {
+                // Saved values, one per line for a multi-select list; shown text stands for
+                // its saved value (an older viewer may have written it).
+                let saved = |v: &str| f.options.iter().find(|(e, s)| e == v || s == v).map_or(v.to_string(), |(e, _)| e.clone());
+                let picked: Vec<String> = if f.has(pdfcraft_forms::flags::MULTI_SELECT) {
+                    t.lines().map(str::trim).filter(|l| !l.is_empty()).map(saved).collect()
+                } else {
+                    vec![saved(t.trim())]
+                };
+                (f.value != picked).then_some(FieldValue::Choice(picked))
+            }
+            pdfcraft_xfa::FieldData::Text(t) => (f.value.join("\n") != t).then_some(FieldValue::Text(t)),
+            pdfcraft_xfa::FieldData::Check(on) => (f.value.is_empty() == on).then_some(FieldValue::Check(on)),
+            pdfcraft_xfa::FieldData::Radio(sel) => (f.value.first() != sel.as_ref()).then_some(FieldValue::Radio(sel)),
+            pdfcraft_xfa::FieldData::None => None,
+        };
+        if let Some(v) = new {
+            updates.push((name, v));
+        }
+    }
+    // All at once: one by one, each value would read the whole form again, which took minutes
+    // on a form with thousands of fields.
+    let Ok(results) = pdfcraft_forms::set_values(doc, &updates) else { return Ok(Vec::new()) };
+    Ok(updates.into_iter().zip(results).filter(|(_, r)| r.is_ok()).map(|((name, _), _)| name).collect())
+}
diff --git a/crates/export/src/as_docx.rs b/crates/export/src/as_docx.rs
new file mode 100644
index 0000000000..d8fb84f7d4
--- /dev/null
+++ b/crates/export/src/as_docx.rs
@@ -0,0 +1,364 @@
+use super::as_html::esc;
+use super::layout::{Image, Item, Page, Table, body_size, items};
+use super::*;
+
+/// A colour's 8-bit sRGB components (NaN and out-of-range values clamp; NaN reads as 0).
+pub(crate) fn rgb8(c: [f64; 3]) -> [u8; 3] {
+    // The value is clamped to 0..=255 before the cast, so it cannot truncate.
+    c.map(|v| if v.is_finite() { (v.clamp(0.0, 1.0) * 255.0).round() as u8 } else { 0 })
+}
+
+/// The colour as `RRGGBB`, or `None` for black (the default every format already uses).
+pub(crate) fn hex(c: [f64; 3]) -> Option<String> {
+    let [r, g, b] = rgb8(c);
+    (r | g | b != 0).then(|| format!("{r:02X}{g:02X}{b:02X}"))
+}
+
+/// A formatted text run (shared by paragraphs and table cells).
+fn run_xml(text: &str, size: f64, bold: bool, italic: bool, color: [f64; 3]) -> String {
+    let mut rpr = String::new();
+    if bold {
+        rpr.push_str("<w:b/>");
+    }
+    if italic {
+        rpr.push_str("<w:i/>");
+    }
+    if let Some(h) = hex(color) {
+        rpr.push_str(&format!("<w:color w:val=\"{h}\"/>"));
+    }
+    let half_points = if size.is_finite() { (size * 2.0).round().clamp(2.0, 3276.0) as i64 } else { 24 };
+    rpr.push_str(&format!("<w:sz w:val=\"{half_points}\"/>"));
+    format!("<w:r><w:rPr>{rpr}</w:rPr><w:t xml:space=\"preserve\">{}</w:t></w:r>", esc(text))
+}
+
+/// One Word table: explicit absent borders (alignment alone cannot prove PDF rules), a grid sized
+/// from the detected column edges, `gridSpan` for spanning cells, empty cells for holes.
+pub(crate) fn docx_table(t: &Table) -> String {
+    let mut edges = t.cols.clone();
+    edges.push(t.rect[2]);
+    let widths: Vec<i64> = edges.windows(2).map(|w| ((w[1] - w[0]).max(20.0) * 20.0).round().clamp(60.0, 31680.0) as i64).collect();
+    let mut s = String::from("<w:tbl><w:tblPr><w:tblW w:w=\"0\" w:type=\"auto\"/><w:tblBorders>");
+    for edge in ["top", "left", "bottom", "right", "insideH", "insideV"] {
+        s.push_str(&format!("<w:{edge} w:val=\"nil\"/>"));
+    }
+    s.push_str("</w:tblBorders></w:tblPr><w:tblGrid>");
+    for w in &widths {
+        s.push_str(&format!("<w:gridCol w:w=\"{w}\"/>"));
+    }
+    s.push_str("</w:tblGrid>");
+    for row in &t.rows {
+        s.push_str("<w:tr>");
+        let mut column = 0usize;
+        for c in row {
+            let span = if c.span > 1 { format!("<w:gridSpan w:val=\"{}\"/>", c.span) } else { String::new() };
+            let w: i64 = widths.iter().skip(column).take(c.span).sum();
+            s.push_str(&format!(
+                "<w:tc><w:tcPr><w:tcW w:w=\"{w}\" w:type=\"dxa\"/>{span}</w:tcPr><w:p>{}</w:p></w:tc>",
+                run_xml(&c.text, c.size, c.bold, c.italic, c.color)
+            ));
+            column = column.saturating_add(c.span);
+        }
+        // Pad the grid so every row covers all columns (Word rejects short rows).
+        for _ in column..t.cols.len() {
+            s.push_str("<w:tc><w:tcPr><w:tcW w:w=\"0\" w:type=\"auto\"/></w:tcPr><w:p/></w:tc>");
+        }
+        s.push_str("</w:tr>");
+    }
+    s.push_str("</w:tbl>");
+    s
+}
+
+/// Pages with rotated text, or text that actually overlaps an image or an oversized
+/// (watermark-like) text block, cannot be put in paragraph flow without changing their layout.
+/// Keep those pages as editable, absolutely positioned text boxes. Every other page, including
+/// one with a logo or a big title that sits clear of the text, flows as paragraphs and tables.
+fn positioned(page: &Page) -> bool {
+    if page.blocks.iter().any(|b| b.rotation.abs() > 0.1) {
+        return true;
+    }
+    let body = body_size(std::slice::from_ref(page)).max(1.0);
+    let overlays = page
+        .images
+        .iter()
+        .map(|im| (im.rect, None))
+        .chain(page.blocks.iter().enumerate().filter(|(_, b)| b.size >= 2.0 * body).map(|(i, b)| (b.rect, Some(i))));
+    // Bound the pairwise test on hostile pages (many overlays times many blocks): past the
+    // budget, keep the default flowing layout.
+    let mut budget: usize = 1_000_000;
+    for (r, own) in overlays {
+        for (i, b) in page.blocks.iter().enumerate() {
+            if budget == 0 {
+                return false;
+            }
+            budget -= 1;
+            if Some(i) != own && overlaps(r, b.rect) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+/// Whether two [x0, y0, x1, y1] boxes share more than a hairline (0.5 pt each way); boxes that
+/// only touch, or hostile non-finite coordinates, do not count.
+fn overlaps(a: [f64; 4], b: [f64; 4]) -> bool {
+    let w = a[2].min(b[2]) - a[0].max(b[0]);
+    let h = a[3].min(b[3]) - a[1].max(b[1]);
+    w.is_finite() && h.is_finite() && w > 0.5 && h > 0.5
+}
+
+/// Bound every value written into a shape's style, including hostile PDF coordinates.
+fn layout_number(n: f64) -> f64 {
+    if n.is_finite() { n.clamp(-1584.0, 1584.0) } else { 0.0 }
+}
+
+/// Most images a Word export embeds, and most image bytes (the zip writer has 32-bit sizes and
+/// a 16-bit entry count; a hostile PDF must not be able to overflow them).
+pub(crate) const MAX_MEDIA: usize = 1000;
+
+const MAX_MEDIA_BYTES: usize = 512 << 20;
+
+/// Whether `im` can still be embedded: it has data, and the package stays within its limits.
+fn room_for(media: &[(String, &Image)], im: &Image) -> bool {
+    !im.bytes.is_empty()
+        && media.len() < MAX_MEDIA
+        && media.iter().map(|(_, m)| m.bytes.len()).fold(im.bytes.len(), usize::saturating_add) <= MAX_MEDIA_BYTES
+}
+
+/// Points as EMU (12700 per point); non-finite values are 0.
+fn emu(pt: f64) -> i64 {
+    if pt.is_finite() { (pt * 12700.0).round() as i64 } else { 0 }
+}
+
+/// The `a:graphic` of one picture (DrawingML), rotated by `rotation` degrees when given.
+fn picture_xml(n: usize, name: &str, (cx, cy): (i64, i64), rotation: Option<f64>) -> String {
+    let rot = rotation.map_or(String::new(), |r| format!(" rot=\"{}\"", (r * 60000.0).round() as i64));
+    format!(
+        "<wp:docPr id=\"{n}\" name=\"Picture {n}\"/><wp:cNvGraphicFramePr/>\
+<a:graphic xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\"><a:graphicData uri=\"http://schemas.openxmlformats.org/drawingml/2006/picture\">\
+<pic:pic xmlns:pic=\"http://schemas.openxmlformats.org/drawingml/2006/picture\"><pic:nvPicPr><pic:cNvPr id=\"{n}\" name=\"{name}\"/><pic:cNvPicPr/></pic:nvPicPr>\
+<pic:blipFill><a:blip r:embed=\"rIdImg{n}\"/><a:stretch><a:fillRect/></a:stretch></pic:blipFill>\
+<pic:spPr><a:xfrm{rot}><a:off x=\"0\" y=\"0\"/><a:ext cx=\"{cx}\" cy=\"{cy}\"/></a:xfrm><a:prstGeom prst=\"rect\"><a:avLst/></a:prstGeom></pic:spPr></pic:pic>\
+</a:graphicData></a:graphic>"
+    )
+}
+
+fn positioned_page<'a>(page: &'a Page, media: &mut Vec<(String, &'a Image)>, shape_id: &mut usize) -> String {
+    // One 1 pt paragraph anchors the whole page. Shapes never reserve body space, so even a
+    // page-sized watermark cannot push the invoice footer onto another page.
+    let mut s = String::from("<w:p><w:pPr><w:spacing w:before=\"0\" w:after=\"0\" w:line=\"20\" w:lineRule=\"exact\"/></w:pPr>");
+    let body = body_size(std::slice::from_ref(page)).max(1.0);
+    for b in &page.blocks {
+        *shape_id = shape_id.saturating_add(1);
+        let rotation = layout_number(-b.rotation).rem_euclid(360.0);
+        let (sin, cos) = rotation.to_radians().sin_cos();
+        let (bw, bh) = (layout_number(b.rect[2] - b.rect[0]).max(1.0), layout_number(b.rect[3] - b.rect[1]).max(1.0));
+        let h = if b.rotation.abs() > 0.1 { layout_number(b.size).max(1.0) } else { bh };
+        // Recover the unrotated width from the axis-aligned box. Use the larger axis so
+        // quarter turns and 45-degree watermarks do not divide by (nearly) zero.
+        let w = if b.rotation.abs() <= 0.1 {
+            bw
+        } else if cos.abs() >= sin.abs() {
+            (bw - h * sin.abs()) / cos.abs()
+        } else {
+            (bh - h * cos.abs()) / sin.abs()
+        };
+        let w = layout_number(w).max(1.0);
+        let (x, y) = (layout_number(b.rect[0] + (bw - w) / 2.0), layout_number(page.height - b.rect[3] + (bh - h) / 2.0));
+        let z = if b.size >= 2.0 * body { -2 } else { 1 };
+        let style = format!(
+            "position:absolute;margin-left:{x:.3}pt;margin-top:{y:.3}pt;width:{w:.3}pt;height:{h:.3}pt;rotation:{rotation:.3};z-index:{z};mso-position-horizontal-relative:page;mso-position-vertical-relative:page"
+        );
+        s.push_str(&format!(
+            "<w:r><w:pict><v:rect id=\"Text{}\" style=\"{style}\" filled=\"f\" stroked=\"f\"><v:textbox inset=\"0,0,0,0\" style=\"mso-fit-shape-to-text:t\"><w:txbxContent><w:p><w:pPr><w:spacing w:before=\"0\" w:after=\"0\"/></w:pPr>{}</w:p></w:txbxContent></v:textbox><w10:wrap type=\"none\"/></v:rect></w:pict></w:r>",
+            shape_id, run_xml(&b.text, b.size, b.bold, b.italic, b.color)
+        ));
+    }
+    for im in &page.images {
+        if !room_for(media, im) {
+            continue;
+        }
+        *shape_id = shape_id.saturating_add(1);
+        let n = media.len().saturating_add(1);
+        let (w, h) = (layout_number(im.size[0]).max(1.0), layout_number(im.size[1]).max(1.0));
+        let (x, y) = (layout_number((im.rect[0] + im.rect[2] - w) / 2.0), layout_number(page.height - (im.rect[1] + im.rect[3] + h) / 2.0));
+        let rotation = layout_number(-im.rotation).rem_euclid(360.0);
+        let name = format!("image{n}.{}", im.ext);
+        let pic = picture_xml(n, &name, (emu(w), emu(h)), Some(rotation));
+        // A DrawingML anchor, the way Word itself stores a picture placed behind text: a VML
+        // rectangle with an image does not show the picture.
+        s.push_str(&format!(
+            "<w:r><w:drawing><wp:anchor distT=\"0\" distB=\"0\" distL=\"0\" distR=\"0\" simplePos=\"0\" relativeHeight=\"{}\" behindDoc=\"1\" locked=\"0\" layoutInCell=\"1\" allowOverlap=\"1\">\
+<wp:simplePos x=\"0\" y=\"0\"/><wp:positionH relativeFrom=\"page\"><wp:posOffset>{}</wp:posOffset></wp:positionH><wp:positionV relativeFrom=\"page\"><wp:posOffset>{}</wp:posOffset></wp:positionV>\
+<wp:extent cx=\"{}\" cy=\"{}\"/><wp:effectExtent l=\"0\" t=\"0\" r=\"0\" b=\"0\"/><wp:wrapNone/>",
+            n.saturating_add(1),
+            emu(x),
+            emu(y),
+            emu(w),
+            emu(h),
+        ));
+        s.push_str(&pic);
+        s.push_str("</wp:anchor></w:drawing></w:r>");
+        media.push((name, im));
+    }
+    s.push_str("</w:p>");
+    s
+}
+
+fn word_page_size(page: &Page) -> (i64, i64) {
+    let twips = |pt: f64| if pt.is_finite() { (pt * 20.0).round().clamp(144.0, 31680.0) as i64 } else { 12240 };
+    (twips(page.width), twips(page.height))
+}
+
+fn section(page: &Page) -> String {
+    let (pw, ph) = word_page_size(page);
+    let (mx, my) = ((pw / 8).min(1440), (ph / 8).min(1440));
+    format!(
+        "<w:sectPr><w:type w:val=\"nextPage\"/><w:pgSz w:w=\"{pw}\" w:h=\"{ph}\"/><w:pgMar w:top=\"{my}\" w:right=\"{mx}\" w:bottom=\"{my}\" w:left=\"{mx}\" w:header=\"{}\" w:footer=\"{}\" w:gutter=\"0\"/></w:sectPr>",
+        my / 2,
+        my / 2
+    )
+}
+
+/// The page colour of a Word document: Word has one background for the whole document, so it
+/// is written only when every page has the same, non-white background (#2992).
+fn word_background(pages: &[Page]) -> Option<String> {
+    let first = rgb8(pages.first()?.background?);
+    let same = pages.iter().all(|p| p.background.map(rgb8) == Some(first));
+    (same && first != [255, 255, 255]).then(|| format!("{:02X}{:02X}{:02X}", first[0], first[1], first[2]))
+}
+
+/// A Word document (.docx, Office Open XML). Ordinary pages flow as paragraphs and tables;
+/// pages with rotated text, or text that overlaps artwork, use floating shapes to retain their layout.
+pub fn docx(pages: &[Page], title: &str) -> Vec<u8> {
+    let mut body = String::new();
+    let mut media: Vec<(String, &Image)> = Vec::new();
+    // Word needs a paragraph between adjacent tables and after the last one in the body.
+    let mut after_table = false;
+    let mut shape_id = 0usize;
+    for (page_index, page) in pages.iter().enumerate() {
+        let (pw, _) = word_page_size(page);
+        let text_w = (pw - 2 * (pw / 8).min(1440)) as f64 / 20.0;
+        if positioned(page) {
+            body.push_str(&positioned_page(page, &mut media, &mut shape_id));
+            after_table = false;
+        } else {
+            for it in items(std::slice::from_ref(page)) {
+                match &it {
+                    Item::Para(runs, lvl) => {
+                        let style = match lvl {
+                            1 => "<w:pPr><w:pStyle w:val=\"Heading1\"/></w:pPr>",
+                            2 => "<w:pPr><w:pStyle w:val=\"Heading2\"/></w:pPr>",
+                            _ => "",
+                        };
+                        body.push_str("<w:p>");
+                        body.push_str(style);
+                        for r in runs {
+                            body.push_str(&run_xml(&r.text, r.block.size, r.block.bold, r.block.italic, r.block.color));
+                        }
+                        body.push_str("</w:p>");
+                    }
+                    Item::Table(t) => {
+                        if after_table {
+                            body.push_str("<w:p/>");
+                        }
+                        body.push_str(&docx_table(t));
+                    }
+                    Item::Img(im) => {
+                        if room_for(&media, im) {
+                            let n = media.len() + 1;
+                            let name = format!("image{n}.{}", im.ext);
+                            // Size on the page, at most the text width.
+                            let (w, h) = ((im.rect[2] - im.rect[0]).max(1.0), (im.rect[3] - im.rect[1]).max(1.0));
+                            let k = (text_w / w).min(1.0);
+                            let (cx, cy) = (emu(w * k), emu(h * k));
+                            body.push_str(&format!("<w:p><w:r><w:drawing><wp:inline><wp:extent cx=\"{cx}\" cy=\"{cy}\"/>"));
+                            body.push_str(&picture_xml(n, &name, (cx, cy), None));
+                            body.push_str("</wp:inline></w:drawing></w:r></w:p>");
+                            media.push((name, im));
+                        }
+                    }
+                    Item::PageBreak => body.push_str("<w:p><w:r><w:br w:type=\"page\"/></w:r></w:p>"),
+                }
+                after_table = matches!(it, Item::Table(_));
+            }
+        }
+        // Section breaks carry this source page's size and create exactly one next page.
+        // The last section must be a direct child of the body (OOXML 17.6.17).
+        if page_index + 1 < pages.len() {
+            body.push_str(&format!(
+                "<w:p><w:pPr><w:spacing w:before=\"0\" w:after=\"0\" w:line=\"20\" w:lineRule=\"exact\"/>{}</w:pPr></w:p>",
+                section(page)
+            ));
+        } else {
+            if after_table || page.blocks.is_empty() && page.images.is_empty() {
+                body.push_str("<w:p><w:pPr><w:spacing w:after=\"0\" w:line=\"20\" w:lineRule=\"exact\"/></w:pPr></w:p>");
+            }
+            body.push_str(&section(page));
+        }
+        after_table = false;
+    }
+    // Word shows a document background only when its settings say so (`settings.xml` below).
+    let page_colour = word_background(pages);
+    let background = page_colour.as_deref().map(|c| format!("<w:background w:color=\"{c}\"/>")).unwrap_or_default();
+    let doc = format!(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\
+<w:document xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\" xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" \
+xmlns:wp=\"http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing\" xmlns:v=\"urn:schemas-microsoft-com:vml\" xmlns:w10=\"urn:schemas-microsoft-com:office:word\">{background}<w:body>{body}\
+</w:body></w:document>"
+    );
+    let mut types = String::from(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">\
+<Default Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/><Default Extension=\"xml\" ContentType=\"application/xml\"/>\
+<Default Extension=\"png\" ContentType=\"image/png\"/><Default Extension=\"jpg\" ContentType=\"image/jpeg\"/>\
+<Override PartName=\"/word/document.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml\"/>\
+<Override PartName=\"/word/styles.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.wordprocessingml.styles+xml\"/>\
+<Override PartName=\"/docProps/core.xml\" ContentType=\"application/vnd.openxmlformats-package.core-properties+xml\"/>",
+    );
+    if page_colour.is_some() {
+        types.push_str(
+            "<Override PartName=\"/word/settings.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.wordprocessingml.settings+xml\"/>",
+        );
+    }
+    types.push_str("</Types>");
+    let rels = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\
+<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" Target=\"word/document.xml\"/>\
+<Relationship Id=\"rId2\" Type=\"http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties\" Target=\"docProps/core.xml\"/></Relationships>";
+    let mut doc_rels = String::from(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\
+<Relationship Id=\"rIdStyles\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles\" Target=\"styles.xml\"/>",
+    );
+    for (i, (name, _)) in media.iter().enumerate() {
+        doc_rels.push_str(&format!(
+            "<Relationship Id=\"rIdImg{}\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\" Target=\"media/{name}\"/>",
+            i + 1
+        ));
+    }
+    if page_colour.is_some() {
+        doc_rels.push_str("<Relationship Id=\"rIdSettings\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/settings\" Target=\"settings.xml\"/>");
+    }
+    doc_rels.push_str("</Relationships>");
+    let styles = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<w:styles xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\">\
+<w:style w:type=\"paragraph\" w:default=\"1\" w:styleId=\"Normal\"><w:name w:val=\"Normal\"/><w:pPr><w:spacing w:after=\"120\"/></w:pPr></w:style>\
+<w:style w:type=\"paragraph\" w:styleId=\"Heading1\"><w:name w:val=\"heading 1\"/><w:basedOn w:val=\"Normal\"/><w:next w:val=\"Normal\"/><w:pPr><w:keepNext/><w:spacing w:before=\"240\"/><w:outlineLvl w:val=\"0\"/></w:pPr><w:rPr><w:b/></w:rPr></w:style>\
+<w:style w:type=\"paragraph\" w:styleId=\"Heading2\"><w:name w:val=\"heading 2\"/><w:basedOn w:val=\"Normal\"/><w:next w:val=\"Normal\"/><w:pPr><w:keepNext/><w:spacing w:before=\"200\"/><w:outlineLvl w:val=\"1\"/></w:pPr><w:rPr><w:b/></w:rPr></w:style>\
+</w:styles>";
+    let core = format!(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<cp:coreProperties xmlns:cp=\"http://schemas.openxmlformats.org/package/2006/metadata/core-properties\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\"><dc:title>{}</dc:title></cp:coreProperties>",
+        esc(title)
+    );
+    let mut z = Zip::default();
+    z.add("[Content_Types].xml", types.as_bytes(), true);
+    z.add("_rels/.rels", rels.as_bytes(), true);
+    z.add("docProps/core.xml", core.as_bytes(), true);
+    z.add("word/document.xml", doc.as_bytes(), true);
+    z.add("word/styles.xml", styles.as_bytes(), true);
+    z.add("word/_rels/document.xml.rels", doc_rels.as_bytes(), true);
+    if page_colour.is_some() {
+        z.add("word/settings.xml", b"<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<w:settings xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\"><w:displayBackgroundShape/></w:settings>", true);
+    }
+    for (name, im) in &media {
+        z.add(&format!("word/media/{name}"), &im.bytes, false);
+    }
+    z.finish()
+}
diff --git a/crates/export/src/as_html.rs b/crates/export/src/as_html.rs
new file mode 100644
index 0000000000..7aeea595a8
--- /dev/null
+++ b/crates/export/src/as_html.rs
@@ -0,0 +1,103 @@
+use super::as_docx::{hex, rgb8};
+use super::layout::{Item, Page, items};
+
+/// Whether a character may appear in the output. XML 1.0 forbids the C0 controls other than tab,
+/// line feed and carriage return, and U+FFFE/U+FFFF. Text extracted from PDFs often holds them
+/// (fonts without a usable `/ToUnicode`), and Word refuses a whole document over one (#72).
+pub(crate) fn allowed(c: char) -> bool {
+    matches!(c, '\t' | '\n' | '\r') || !(c.is_ascii_control() || c == '\u{FFFE}' || c == '\u{FFFF}')
+}
+
+pub(crate) fn esc(s: &str) -> String {
+    let mut o = String::with_capacity(s.len());
+    for c in s.chars().filter(|c| allowed(*c)) {
+        match c {
+            '&' => o.push_str("&amp;"),
+            '<' => o.push_str("&lt;"),
+            '>' => o.push_str("&gt;"),
+            '"' => o.push_str("&quot;"),
+            c => o.push(c),
+        }
+    }
+    o
+}
+
+pub(crate) fn base64(data: &[u8]) -> String {
+    const A: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let mut s = String::with_capacity(data.len().div_ceil(3) * 4);
+    for c in data.chunks(3) {
+        let n = (c[0] as u32) << 16 | (*c.get(1).unwrap_or(&0) as u32) << 8 | *c.get(2).unwrap_or(&0) as u32;
+        s.push(A[(n >> 18) as usize & 63] as char);
+        s.push(A[(n >> 12) as usize & 63] as char);
+        s.push(if c.len() > 1 { A[(n >> 6) as usize & 63] as char } else { '=' });
+        s.push(if c.len() > 2 { A[n as usize & 63] as char } else { '=' });
+    }
+    s
+}
+
+/// One HTML file: headings and paragraphs, tables as real `<table>` elements, images inline, a
+/// rule between pages.
+pub fn html(pages: &[Page], title: &str) -> String {
+    let mut s = format!(
+        "<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<title>{}</title>\n<style>body{{max-width:46em;margin:2em auto;font-family:sans-serif;line-height:1.45}}\
+img{{max-width:100%}}hr{{border:0;border-top:1px solid #ccc;margin:2em 0}}\
+table{{border-collapse:collapse;margin:1em 0}}td,th{{border:1px solid #999;padding:2px 6px;vertical-align:top}}</style>\n</head>\n<body>\n",
+        esc(title)
+    );
+    for it in items(pages) {
+        match it {
+            Item::Para(runs, lvl) => {
+                let Some(first) = runs.first().map(|r| r.block) else { continue };
+                let mut t = String::new();
+                for r in &runs {
+                    let mut run = esc(&r.text);
+                    if r.block.italic {
+                        run = format!("<em>{run}</em>");
+                    }
+                    if r.block.bold && lvl == 0 {
+                        run = format!("<strong>{run}</strong>");
+                    }
+                    // The paragraph has its first run's colour; a run in another colour says so.
+                    let colour = rgb8(r.block.color);
+                    if colour != rgb8(first.color) {
+                        let [red, green, blue] = colour;
+                        run = format!("<span style=\"color:#{red:02X}{green:02X}{blue:02X}\">{run}</span>");
+                    }
+                    t.push_str(&run);
+                }
+                let style = hex(first.color).map_or(String::new(), |h| format!(" style=\"color:#{h}\""));
+                match lvl {
+                    0 => s.push_str(&format!("<p{style}>{t}</p>\n")),
+                    l => s.push_str(&format!("<h{l}{style}>{t}</h{l}>\n")),
+                }
+            }
+            Item::Table(t) => {
+                s.push_str("<table>\n");
+                for row in &t.rows {
+                    s.push_str("<tr>");
+                    for c in row {
+                        let mut body = esc(&c.text);
+                        if c.italic {
+                            body = format!("<em>{body}</em>");
+                        }
+                        if c.bold {
+                            body = format!("<strong>{body}</strong>");
+                        }
+                        let span = if c.span > 1 { format!(" colspan=\"{}\"", c.span) } else { String::new() };
+                        let style = hex(c.color).map_or(String::new(), |h| format!(" style=\"color:#{h}\""));
+                        s.push_str(&format!("<td{span}{style}>{body}</td>"));
+                    }
+                    s.push_str("</tr>\n");
+                }
+                s.push_str("</table>\n");
+            }
+            Item::Img(im) => {
+                let mime = if im.ext == "jpg" { "image/jpeg" } else { "image/png" };
+                s.push_str(&format!("<p><img alt=\"\" src=\"data:{mime};base64,{}\"></p>\n", base64(&im.bytes)));
+            }
+            Item::PageBreak => s.push_str("<hr>\n"),
+        }
+    }
+    s.push_str("</body>\n</html>\n");
+    s
+}
diff --git a/crates/export/src/as_rtf.rs b/crates/export/src/as_rtf.rs
new file mode 100644
index 0000000000..d7495df135
--- /dev/null
+++ b/crates/export/src/as_rtf.rs
@@ -0,0 +1,127 @@
+use super::as_docx::rgb8;
+use super::as_html::allowed;
+use super::layout::{Block, Item, Page, count_lookup_steps, items};
+use super::*;
+
+fn rtf_text(s: &str) -> String {
+    let mut o = String::new();
+    for c in s.chars().filter(|c| allowed(*c)) {
+        match c {
+            '\\' | '{' | '}' => {
+                o.push('\\');
+                o.push(c);
+            }
+            c if (c as u32) < 128 => o.push(c),
+            c => {
+                // \uN with a ? fallback; UTF-16 units as signed 16-bit numbers.
+                let mut buf = [0u16; 2];
+                for u in c.encode_utf16(&mut buf) {
+                    o.push_str(&format!("\\u{}?", *u as i16));
+                }
+            }
+        }
+    }
+    o
+}
+
+/// Rich Text Format: paragraphs with their sizes and bold/italic, real table rows, page breaks
+/// between pages (images are left out).
+pub fn rtf(pages: &[Page]) -> String {
+    let items = items(pages);
+    // The colour table: entry 0 is the default (auto) colour, then each non-black colour once.
+    let mut colors: Vec<[u8; 3]> = Vec::new();
+    let mut slot: HashMap<[u8; 3], usize> = HashMap::new();
+    let mut note = |c: [f64; 3]| {
+        let c = rgb8(c);
+        count_lookup_steps(1);
+        if c != [0, 0, 0] && !slot.contains_key(&c) {
+            slot.insert(c, colors.len());
+            colors.push(c);
+        }
+    };
+    for it in &items {
+        match it {
+            Item::Para(runs, _) => runs.iter().for_each(|r| note(r.block.color)),
+            Item::Table(t) => t.rows.iter().flatten().for_each(|c| note(c.color)),
+            Item::Img(_) | Item::PageBreak => {}
+        }
+    }
+    // `\cfN` for a colour (nothing for black, which keeps the default).
+    let cf = |c: [f64; 3]| {
+        let c = rgb8(c);
+        count_lookup_steps(1);
+        slot.get(&c).map_or(String::new(), |i| format!("\\cf{}", i + 1))
+    };
+    let mut s = String::from("{\\rtf1\\ansi\\deff0{\\fonttbl{\\f0 Helvetica;}}\n");
+    if !colors.is_empty() {
+        s.push_str("{\\colortbl;");
+        for [r, g, b] in &colors {
+            s.push_str(&format!("\\red{r}\\green{g}\\blue{b};"));
+        }
+        s.push_str("}\n");
+    }
+    for it in items {
+        match it {
+            Item::Para(runs, _) => {
+                // The first run's formatting is the paragraph's; each later run is a group that
+                // turns on or off what differs from it.
+                let fmt = |b: &Block, later: bool| {
+                    let mut fmt = format!("\\fs{}", (b.size * 2.0).round() as i64);
+                    if b.bold {
+                        fmt.push_str("\\b");
+                    } else if later {
+                        fmt.push_str("\\b0");
+                    }
+                    if b.italic {
+                        fmt.push_str("\\i");
+                    } else if later {
+                        fmt.push_str("\\i0");
+                    }
+                    let colour = cf(b.color);
+                    fmt.push_str(if colour.is_empty() && later { "\\cf0" } else { &colour });
+                    fmt
+                };
+                let mut runs = runs.iter();
+                let Some(first) = runs.next() else { continue };
+                s.push_str(&format!("{{\\pard{} {}", fmt(first.block, false), rtf_text(&first.text)));
+                for r in runs {
+                    s.push_str(&format!("{{{} {}}}", fmt(r.block, true), rtf_text(&r.text)));
+                }
+                s.push_str("\\par}\n");
+            }
+            Item::Table(t) => {
+                let mut edges = t.cols.clone();
+                edges.push(t.rect[2]);
+                let cellx: Vec<i64> = edges.iter().skip(1).map(|e| (e * 20.0).round() as i64).collect();
+                for row in &t.rows {
+                    s.push_str("\\trowd\\trgaph108");
+                    // The row's cell boundaries come first: each cell ends at the right edge of
+                    // the last grid column it spans.
+                    let mut column = 0;
+                    for c in row {
+                        column += c.span.max(1);
+                        if let Some(x) = cellx.get(column.min(cellx.len()).saturating_sub(1)) {
+                            s.push_str(&format!("\\cellx{x}"));
+                        }
+                    }
+                    for c in row {
+                        let mut fmt = format!("\\intbl\\fs{}", (c.size * 2.0).round() as i64);
+                        if c.bold {
+                            fmt.push_str("\\b");
+                        }
+                        if c.italic {
+                            fmt.push_str("\\i");
+                        }
+                        fmt.push_str(&cf(c.color));
+                        s.push_str(&format!("{{{fmt} {}}}\\cell", rtf_text(&c.text)));
+                    }
+                    s.push_str("\\row\n");
+                }
+            }
+            Item::Img(_) => {}
+            Item::PageBreak => s.push_str("\\page\n"),
+        }
+    }
+    s.push('}');
+    s
+}
diff --git a/crates/export/src/layout.rs b/crates/export/src/layout.rs
new file mode 100644
index 0000000000..8a06050898
--- /dev/null
+++ b/crates/export/src/layout.rs
@@ -0,0 +1,468 @@
+use super::*;
+
+/// A paragraph of a page.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Block {
+    pub text: String,
+    /// [x0, y0, x1, y1] on the displayed page in points (y up).
+    pub rect: [f64; 4],
+    /// Font size in points.
+    pub size: f64,
+    pub bold: bool,
+    pub italic: bool,
+    /// Text fill colour as sRGB components in 0..=1 (black when unknown).
+    pub color: [f64; 3],
+    /// Counterclockwise baseline angle in user space (degrees).
+    pub rotation: f64,
+    /// Whether the source had a word space just before (`[0]`) and just after (`[1]`) `text`,
+    /// which `text` leaves out. A block that continues this one on its line is a run of the same
+    /// paragraph, and these say whether a space separates them (#4158).
+    pub space_around: [bool; 2],
+}
+
+/// An image of a page.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Image {
+    /// "png" or "jpg".
+    pub ext: &'static str,
+    /// Shared: a picture drawn in many places is held once.
+    pub bytes: std::sync::Arc<[u8]>,
+    pub rect: [f64; 4],
+    /// Width and height before rotation, in points.
+    pub size: [f64; 2],
+    /// Counterclockwise rotation in user space (degrees).
+    pub rotation: f64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Page {
+    pub width: f64,
+    pub height: f64,
+    pub blocks: Vec<Block>,
+    pub images: Vec<Image>,
+    /// The colour the whole page is painted before its content (a page background), as sRGB
+    /// components in 0..=1; `None` for a page with no background of its own.
+    pub background: Option<[f64; 3]>,
+}
+
+/// One cell of a detected table. `span` is how many grid columns the cell covers (a header
+/// row that stretches over sub-columns).
+#[derive(Clone, Debug, PartialEq)]
+pub struct Cell {
+    pub text: String,
+    pub size: f64,
+    pub bold: bool,
+    pub italic: bool,
+    /// Text fill colour as sRGB components in 0..=1.
+    pub color: [f64; 3],
+    pub span: usize,
+}
+
+/// A table detected from the page's text layout: rows of cells, and the left edge of each
+/// grid column (user space, y up) so the writers can size the columns.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Table {
+    pub rect: [f64; 4],
+    pub cols: Vec<f64>,
+    pub rows: Vec<Vec<Cell>>,
+}
+
+/// What goes into the output, in order.
+pub(crate) enum Item<'a> {
+    /// A paragraph's runs (at least one) and its heading level.
+    Para(Vec<Run<'a>>, u8),
+    /// Owned: tables are detected per page inside [`items`], so they cannot borrow.
+    Table(Table),
+    Img(&'a Image),
+    PageBreak,
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Entries read to find a font size's or a colour's slot, for the tests that keep it constant.
+    pub(crate) static LOOKUP_STEPS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// Counts `n` entries read by a lookup (tests only).
+#[inline]
+pub(crate) fn count_lookup_steps(_n: usize) {
+    #[cfg(test)]
+    LOOKUP_STEPS.with(|c| c.set(c.get().saturating_add(_n)));
+}
+
+/// The body text size: the size most of the document's characters are set in.
+pub(crate) fn body_size(pages: &[Page]) -> f64 {
+    // Sizes in first-seen order (which breaks ties), and where each one is in it.
+    let mut by: Vec<(i64, usize)> = Vec::new();
+    let mut slot: HashMap<i64, usize> = HashMap::new();
+    for b in pages.iter().flat_map(|p| &p.blocks) {
+        let k = (b.size * 2.0).round() as i64;
+        count_lookup_steps(1);
+        let i = *slot.entry(k).or_insert_with(|| {
+            by.push((k, 0));
+            by.len() - 1
+        });
+        if let Some(e) = by.get_mut(i) {
+            e.1 = e.1.saturating_add(b.text.len());
+        }
+    }
+    by.into_iter().max_by_key(|e| e.1).map_or(11.0, |e| e.0 as f64 / 2.0)
+}
+
+/// Heading level for a block: 1 for ≥ 1.6× the body size, 2 for ≥ 1.25×, 0 for body text.
+fn level(b: &Block, body: f64) -> u8 {
+    let short = b.text.len() < 200;
+    if short && b.size >= body * 1.6 {
+        1
+    } else if short && (b.size >= body * 1.25 || (b.bold && b.size >= body && b.text.len() < 80 && !b.text.ends_with('.'))) {
+        2
+    } else {
+        0
+    }
+}
+
+/// How far two cell left edges may drift (points) and still be the same grid column.
+const COL_TOL: f64 = 4.0;
+
+/// More grid columns than this isn't a table. It is Word's limit: a .docx whose table has 64 or
+/// more columns doesn't open. It also bounds a table's size: every row is materialized to all
+/// its columns, so a hostile page laid out as a staircase of blocks would otherwise make
+/// (blocks / 2)² cells.
+pub(crate) const MAX_COLS: usize = 63;
+
+/// Two blocks in a row this close (as a fraction of their font size) are one line of running
+/// text that changed font or colour, such as a link inside a sentence, not two table cells.
+const INLINE_GAP: f64 = 0.5;
+
+/// How many blocks ending near a block's start are looked at to find the one it continues; a
+/// page laid out so that many end at the same place stays quick.
+const CONTINUATION_PROBE: usize = 64;
+
+/// Per block, whether it continues another on the same line: it starts where that one ends (up to
+/// [`INLINE_GAP`] later, or a point earlier for rounding), so it is the same line of text running
+/// on (a link inside a sentence, a superscript), not a cell of its own.
+fn continuations(blocks: &[Block]) -> Vec<bool> {
+    continued_from(blocks).into_iter().map(|from| from.is_some()).collect()
+}
+
+/// Per block, the block it continues on the same line (see [`continuations`]): of those it could
+/// continue, the one that ends nearest to where it starts.
+fn continued_from(blocks: &[Block]) -> Vec<Option<usize>> {
+    let mut by_end: Vec<(f64, usize)> = blocks.iter().enumerate().map(|(i, b)| (b.rect[2], i)).collect();
+    by_end.sort_by(|a, b| a.0.total_cmp(&b.0));
+    blocks
+        .iter()
+        .enumerate()
+        .map(|(bi, b)| {
+            let k = by_end.partition_point(|(end, _)| *end < b.rect[0] - INLINE_GAP * b.size);
+            by_end
+                .get(k..)
+                .unwrap_or_default()
+                .iter()
+                .take_while(|(end, _)| *end <= b.rect[0] + 1.0)
+                .take(CONTINUATION_PROBE)
+                .filter_map(|(_, ai)| blocks.get(*ai).filter(|_| *ai != bi).map(|a| (*ai, a)))
+                .filter(|(_, a)| a.rect[3].min(b.rect[3]) - a.rect[1].max(b.rect[1]) > 0.5 * (a.rect[3] - a.rect[1]).min(b.rect[3] - b.rect[1]))
+                .min_by(|(_, a), (_, c)| (a.rect[2] - b.rect[0]).abs().total_cmp(&(c.rect[2] - b.rect[0]).abs()))
+                .map(|(ai, _)| ai)
+        })
+        .collect()
+}
+
+/// A gap between two runs wider than this (as a fraction of the font size) is a word space the
+/// text left out. It is the gap the reading-block grouping uses for the same purpose.
+const WORD_GAP: f64 = 0.12;
+
+/// One run of a paragraph: a block, and the text it contributes (its own, plus the word space
+/// before the next run when the source had one there or the page shows a gap, but the text has
+/// none).
+pub(crate) struct Run<'a> {
+    pub(crate) block: &'a Block,
+    pub(crate) text: String,
+}
+
+/// A page's paragraphs, each a list of runs from left to right along its line. A block that
+/// continues another on the same line ([`continued_from`]: an italic case name, a link, a
+/// superscript) is a run in its own style inside that block's paragraph, not a paragraph of its
+/// own (#4158). Blocks marked in `skip` (table cells, a slide title) are left out and join
+/// nothing. Paragraphs come in the order of their first runs in `blocks`.
+pub(crate) fn paragraphs<'a>(blocks: &'a [Block], skip: &[bool]) -> Vec<Vec<Run<'a>>> {
+    let skipped = |i: usize| skip.get(i).copied().unwrap_or(false);
+    let from = continued_from(blocks);
+    // Left to right. A block joins only one that starts strictly further left (in `total_cmp`'s
+    // order, NaN included), so that one is visited first and has its paragraph already, and the
+    // links cannot form a cycle.
+    let mut order: Vec<(f64, usize)> = blocks.iter().enumerate().filter(|(i, _)| !skipped(*i)).map(|(i, b)| (b.rect[0], i)).collect();
+    order.sort_by(|a, b| a.0.total_cmp(&b.0).then(a.1.cmp(&b.1)));
+    // Each block's paragraph, named by its first block, and each paragraph's blocks in order.
+    let mut head: Vec<usize> = (0..blocks.len()).collect();
+    let mut members: Vec<Vec<usize>> = vec![Vec::new(); blocks.len()];
+    for &(x0, bi) in &order {
+        let Some(b) = blocks.get(bi) else { continue };
+        let joined = from
+            .get(bi)
+            .copied()
+            .flatten()
+            .filter(|ai| !skipped(*ai))
+            .filter(|ai| blocks.get(*ai).is_some_and(|a| a.rect[0].total_cmp(&x0).is_lt() && (a.rotation - b.rotation).abs() <= 0.1))
+            .and_then(|ai| head.get(ai).copied());
+        let h = joined.unwrap_or(bi);
+        if let Some(slot) = head.get_mut(bi) {
+            *slot = h;
+        }
+        if let Some(m) = members.get_mut(h) {
+            m.push(bi);
+        }
+    }
+    members
+        .into_iter()
+        .filter(|m| !m.is_empty())
+        .map(|m| {
+            let mut runs: Vec<Run<'a>> = Vec::with_capacity(m.len());
+            for b in m.into_iter().filter_map(|bi| blocks.get(bi)) {
+                if let Some(prev) = runs.last_mut()
+                    && !prev.text.ends_with(char::is_whitespace)
+                    && !b.text.starts_with(char::is_whitespace)
+                    && (prev.block.space_around[1] || b.space_around[0] || b.rect[0] - prev.block.rect[2] > b.size * WORD_GAP)
+                {
+                    prev.text.push(' ');
+                }
+                runs.push(Run { block: b, text: b.text.clone() });
+            }
+            runs
+        })
+        .collect()
+}
+
+/// A paragraph's heading level: the lowest of its runs', so body text that runs on after a bold
+/// lead-in on the same line keeps the paragraph body text. A marker set smaller than the first run
+/// (a footnote number, "st" in "1st") does not count, so a heading keeps its footnote marker.
+fn para_level(runs: &[Run], body: f64) -> u8 {
+    let Some(first) = runs.first() else { return 0 };
+    let marker = |r: &Run| r.block.size < first.block.size * 0.9 && r.block.text.trim().chars().count() <= 3;
+    runs.iter().filter(|r| !marker(r)).map(|r| level(r.block, body)).min().unwrap_or(0)
+}
+
+/// A cell is short: taller blocks are body text (or a multi-column layout), not table cells.
+fn is_cell_like(b: &Block) -> bool {
+    (b.rect[3] - b.rect[1]) <= b.size * 5.0 && !b.text.trim().is_empty()
+}
+
+/// Detect tables in a page's blocks from their text layout: columns are left edges shared by
+/// several short blocks, rows are blocks whose vertical spans overlap. Returns the tables and,
+/// per block, whether a table consumed it (so `items` can drop it from the paragraph flow).
+pub(crate) fn tables(blocks: &[Block]) -> (Vec<Table>, Vec<bool>) {
+    let mut consumed = vec![false; blocks.len()];
+    // Candidate columns: cluster the left edges of cell-like blocks.
+    let mut xs: Vec<(f64, usize)> = blocks.iter().enumerate().filter(|(_, b)| is_cell_like(b)).map(|(i, b)| (b.rect[0], i)).collect();
+    xs.sort_by(|a, b| a.0.total_cmp(&b.0));
+    let mut cols: Vec<(f64, Vec<usize>)> = Vec::new(); // (left edge, member block indices)
+    for (x, i) in xs {
+        match cols.last_mut() {
+            Some((e, m)) if (x - *e).abs() <= COL_TOL => {
+                *e = (*e * m.len() as f64 + x) / (m.len() + 1) as f64;
+                m.push(i);
+            }
+            _ => cols.push((x, vec![i])),
+        }
+    }
+    let cols: Vec<(f64, Vec<usize>)> = cols.into_iter().filter(|(_, m)| m.len() >= 2).collect();
+    if cols.len() < 2 {
+        return (Vec::new(), consumed);
+    }
+    // Each block's column (an index into `cols`), so lookups stay linear on pages with many blocks.
+    let mut col_of: Vec<Option<usize>> = vec![None; blocks.len()];
+    for (ci, (_, members)) in cols.iter().enumerate() {
+        for &i in members {
+            if let Some(c) = col_of.get_mut(i) {
+                *c = Some(ci);
+            }
+        }
+    }
+    // The column whose edge is within tolerance of `x` (edges are in ascending order).
+    let column_at = |x: f64| -> Option<usize> {
+        let k = cols.partition_point(|(e, _)| *e < x - COL_TOL);
+        cols.get(k).filter(|(e, _)| (*e - x).abs() <= COL_TOL).map(|_| k)
+    };
+    // Assign every cell-like block to its nearest column (within tolerance).
+    let mut rows: Vec<Vec<(usize, usize)>> = Vec::new(); // (column index, block index), top to bottom
+    let mut order: Vec<usize> = (0..blocks.len()).collect();
+    order.sort_by(|a, b| blocks[*b].rect[3].total_cmp(&blocks[*a].rect[3]).then(blocks[*a].rect[0].total_cmp(&blocks[*b].rect[0])));
+    for &bi in &order {
+        let b = &blocks[bi];
+        if !is_cell_like(b) {
+            continue;
+        }
+        let Some(ci) = column_at(b.rect[0]) else { continue };
+        let joins = rows
+            .last()
+            .and_then(|row| row.first())
+            .map(|(_, fi)| {
+                let rb = &blocks[*fi];
+                let overlap = rb.rect[3].min(b.rect[3]) - rb.rect[1].max(b.rect[1]);
+                overlap > 0.5 * (rb.rect[3] - rb.rect[1]).min(b.rect[3] - b.rect[1])
+            })
+            .unwrap_or(false);
+        if joins {
+            if let Some(row) = rows.last_mut() {
+                row.push((ci, bi));
+            }
+        } else {
+            rows.push(vec![(ci, bi)]);
+        }
+    }
+    // Runs of consecutive rows that have two or more distinct columns are tables.
+    let mut out = Vec::new();
+    let flush = |run: &mut Vec<Vec<(usize, usize)>>, out: &mut Vec<Table>, consumed: &mut Vec<bool>| {
+        if run.len() < 2 {
+            run.clear();
+            return;
+        }
+        let mut used: Vec<usize> = run.iter().flatten().map(|(_, i)| *i).collect();
+        used.sort_unstable();
+        used.dedup();
+        let mut edges: Vec<f64> = used.iter().filter_map(|&i| col_of.get(i).copied().flatten()).filter_map(|ci| cols.get(ci)).map(|c| c.0).collect();
+        edges.sort_by(f64::total_cmp);
+        edges.dedup_by(|a, b| (*a - *b).abs() <= COL_TOL);
+        let ncols = edges.len();
+        let ok = (ncols >= 3 || (ncols == 2 && run.len() >= 3)) && ncols <= MAX_COLS;
+        if !ok {
+            run.clear();
+            return;
+        }
+        let right = used.iter().map(|&i| blocks[i].rect[2]).fold(f64::MIN, f64::max) + COL_TOL;
+        let mut rows_out = Vec::new();
+        let mut slots: Vec<Option<(Cell, Vec<usize>)>> = vec![None; ncols];
+        for row in run.drain(..) {
+            for slot in slots.iter_mut() {
+                *slot = None;
+            }
+            for (_ci, bi) in row {
+                let b = &blocks[bi];
+                let Some(slot) = edges.iter().position(|e| (*e - b.rect[0]).abs() <= COL_TOL) else { continue };
+                let span = edges[slot + 1..].iter().filter(|e| **e > b.rect[0] + COL_TOL && **e < b.rect[2] - COL_TOL).count() + 1;
+                let cell = Cell { text: b.text.trim().to_string(), size: b.size, bold: b.bold, italic: b.italic, color: b.color, span };
+                match slots.get_mut(slot) {
+                    Some(Some((c, sources))) => {
+                        c.text.push(' ');
+                        c.text.push_str(&cell.text);
+                        sources.push(bi);
+                    }
+                    Some(empty @ None) => *empty = Some((cell, vec![bi])),
+                    None => continue,
+                }
+            }
+            let mut materialized = Vec::with_capacity(ncols);
+            let mut column = 0;
+            while column < ncols {
+                match slots.get_mut(column).and_then(Option::take) {
+                    Some((mut cell, sources)) => {
+                        // A spanning cell can skip later slots. Only consume source blocks
+                        // when their text is emitted, leaving covered text in paragraph flow.
+                        for bi in sources {
+                            if let Some(taken) = consumed.get_mut(bi) {
+                                *taken = true;
+                            }
+                        }
+                        cell.span = cell.span.min(ncols - column).max(1);
+                        column += cell.span;
+                        materialized.push(cell);
+                    }
+                    None => {
+                        column += 1;
+                        materialized.push(Cell { text: String::new(), size: 11.0, bold: false, italic: false, color: [0.0; 3], span: 1 });
+                    }
+                }
+            }
+            while materialized.last().is_some_and(|cell| cell.text.is_empty()) && materialized.iter().any(|cell| cell.span > 1) {
+                materialized.pop();
+            }
+            rows_out.push(materialized);
+        }
+        let rect = [
+            edges[0],
+            used.iter().map(|&i| blocks[i].rect[1]).fold(f64::MAX, f64::min),
+            right,
+            used.iter().map(|&i| blocks[i].rect[3]).fold(f64::MIN, f64::max),
+        ];
+        out.push(Table { rect, cols: edges, rows: rows_out });
+    };
+    // Runs of consecutive multi-column rows are tables. Rows on either side of a run that
+    // hold a single cell wide enough to span two columns (a header band, a totals row) join
+    // the table; other single-column rows (captions, following text) stay paragraphs.
+    let spans_run = |edges: &[f64], bi: usize| -> bool {
+        let b = &blocks[bi];
+        edges.iter().any(|e| (*e - b.rect[0]).abs() <= COL_TOL) && edges.iter().any(|e| *e > b.rect[0] + COL_TOL && *e < b.rect[2] - COL_TOL)
+    };
+    let run_edges = |run: &[Vec<(usize, usize)>]| -> Vec<f64> {
+        let mut es: Vec<f64> =
+            run.iter().flatten().filter_map(|(_, i)| col_of.get(*i).copied().flatten()).filter_map(|ci| cols.get(ci)).map(|c| c.0).collect();
+        es.sort_by(f64::total_cmp);
+        es.dedup_by(|a, b| (*a - *b).abs() <= COL_TOL);
+        es
+    };
+    let cont = continuations(blocks);
+    let qual: Vec<bool> = rows
+        .iter()
+        .map(|row| {
+            // A block that continues another adds no column of its own, and the cells of a table row
+            // sit side by side: blocks that overlap are a paragraph's lines, not cells (#2806).
+            let cells: Vec<(usize, usize)> = row.iter().copied().filter(|(_, bi)| !cont.get(*bi).copied().unwrap_or(false)).collect();
+            let mut spans: Vec<[f64; 2]> = cells.iter().filter_map(|(_, bi)| blocks.get(*bi)).map(|b| [b.rect[0], b.rect[2]]).collect();
+            spans.sort_by(|a, b| a[0].total_cmp(&b[0]));
+            let apart = spans.windows(2).all(|w| w[1][0] >= w[0][1] - COL_TOL);
+            let mut cs: Vec<usize> = cells.iter().map(|(c, _)| *c).collect();
+            cs.sort_unstable();
+            cs.dedup();
+            apart && cs.len() >= 2
+        })
+        .collect();
+    let mut i = 0;
+    while i < rows.len() {
+        if !qual[i] {
+            i += 1;
+            continue;
+        }
+        let start = i;
+        while i < rows.len() && qual[i] {
+            i += 1;
+        }
+        let end = i; // run = rows[start..end]
+        let mut pieces: Vec<Vec<(usize, usize)>> = Vec::new();
+        if start > 0 && rows[start - 1].len() == 1 && spans_run(&run_edges(&rows[start..end]), rows[start - 1][0].1) {
+            pieces.push(rows[start - 1].clone());
+        }
+        pieces.extend(rows[start..end].iter().cloned());
+        if end < rows.len() && rows[end].len() == 1 && spans_run(&run_edges(&rows[start..end]), rows[end][0].1) {
+            pieces.push(rows[end].clone());
+        }
+        flush(&mut pieces, &mut out, &mut consumed);
+    }
+    (out, consumed)
+}
+
+pub(crate) fn items(pages: &[Page]) -> Vec<Item<'_>> {
+    let body = body_size(pages);
+    let mut out = Vec::new();
+    for (i, p) in pages.iter().enumerate() {
+        if i > 0 {
+            out.push(Item::PageBreak);
+        }
+        let (tables, consumed) = tables(&p.blocks);
+        // Blocks and images by their top edge, top to bottom.
+        // A paragraph sits where its first run does: its other runs follow along the same line.
+        let mut parts: Vec<(f64, f64, Item)> = paragraphs(&p.blocks, &consumed)
+            .into_iter()
+            .filter_map(|runs| {
+                let first = runs.first()?.block;
+                let lvl = para_level(&runs, body);
+                Some((first.rect[3], first.rect[0], Item::Para(runs, lvl)))
+            })
+            .collect();
+        parts.extend(tables.into_iter().map(|t| (t.rect[3], t.rect[0], Item::Table(t))));
+        parts.extend(p.images.iter().map(|im| (im.rect[3], im.rect[0], Item::Img(im))));
+        parts.sort_by(|a, b| b.0.total_cmp(&a.0).then(a.1.total_cmp(&b.1)));
+        out.extend(parts.into_iter().map(|x| x.2));
+    }
+    out
+}
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index 1303254d66..cf32ea7930 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -2,7 +2,9 @@
 //!
 //! The engine reduces each page to [`Page`]: paragraphs (text, box, size, bold/italic) and
 //! images (encoded bytes and box), in reading order. The writers turn that into a flowing
-//! document: headings are the paragraphs set larger than the body text. Word keeps pages with
+//! document: headings are the paragraphs set larger than the body text, and a block that
+//! continues another on its line (an italic word, a link) is a run of that block's paragraph.
+//! Word keeps pages with
 //! rotated text, or text overlapped by artwork or watermark-sized text, as positioned, editable
 //! shapes to avoid reflowing overlays; other pages flow with images inline.
 
@@ -16,1529 +18,24 @@ mod zip;
 pub use pptx::pptx;
 pub use zip::Zip;
 
-/// A paragraph of a page.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Block {
-    pub text: String,
-    /// [x0, y0, x1, y1] on the displayed page in points (y up).
-    pub rect: [f64; 4],
-    /// Font size in points.
-    pub size: f64,
-    pub bold: bool,
-    pub italic: bool,
-    /// Text fill colour as sRGB components in 0..=1 (black when unknown).
-    pub color: [f64; 3],
-    /// Counterclockwise baseline angle in user space (degrees).
-    pub rotation: f64,
-}
+mod as_docx;
+mod as_html;
+mod as_rtf;
+mod layout;
 
-/// An image of a page.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Image {
-    /// "png" or "jpg".
-    pub ext: &'static str,
-    /// Shared: a picture drawn in many places is held once.
-    pub bytes: std::sync::Arc<[u8]>,
-    pub rect: [f64; 4],
-    /// Width and height before rotation, in points.
-    pub size: [f64; 2],
-    /// Counterclockwise rotation in user space (degrees).
-    pub rotation: f64,
-}
-
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Page {
-    pub width: f64,
-    pub height: f64,
-    pub blocks: Vec<Block>,
-    pub images: Vec<Image>,
-    /// The colour the whole page is painted before its content (a page background), as sRGB
-    /// components in 0..=1; `None` for a page with no background of its own.
-    pub background: Option<[f64; 3]>,
-}
-
-/// One cell of a detected table. `span` is how many grid columns the cell covers (a header
-/// row that stretches over sub-columns).
-#[derive(Clone, Debug, PartialEq)]
-pub struct Cell {
-    pub text: String,
-    pub size: f64,
-    pub bold: bool,
-    pub italic: bool,
-    /// Text fill colour as sRGB components in 0..=1.
-    pub color: [f64; 3],
-    pub span: usize,
-}
-
-/// A table detected from the page's text layout: rows of cells, and the left edge of each
-/// grid column (user space, y up) so the writers can size the columns.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Table {
-    pub rect: [f64; 4],
-    pub cols: Vec<f64>,
-    pub rows: Vec<Vec<Cell>>,
-}
-
-/// What goes into the output, in order.
-enum Item<'a> {
-    Para(&'a Block, u8),
-    /// Owned: tables are detected per page inside [`items`], so they cannot borrow.
-    Table(Table),
-    Img(&'a Image),
-    PageBreak,
-}
+pub use as_docx::docx;
+pub(crate) use as_docx::hex;
+#[cfg(test)]
+use as_docx::{MAX_MEDIA, docx_table};
+pub(crate) use as_html::esc;
+pub use as_html::html;
+#[cfg(test)]
+use as_html::{allowed, base64};
+pub use as_rtf::rtf;
+pub use layout::{Block, Cell, Image, Page, Table};
+#[cfg(test)]
+use layout::{LOOKUP_STEPS, MAX_COLS, body_size};
+pub(crate) use layout::{Run, paragraphs, tables};
 
 #[cfg(test)]
-thread_local! {
-    /// Entries read to find a font size's or a colour's slot, for the tests that keep it constant.
-    static LOOKUP_STEPS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-/// Counts `n` entries read by a lookup (tests only).
-#[inline]
-fn count_lookup_steps(_n: usize) {
-    #[cfg(test)]
-    LOOKUP_STEPS.with(|c| c.set(c.get().saturating_add(_n)));
-}
-
-/// The body text size: the size most of the document's characters are set in.
-fn body_size(pages: &[Page]) -> f64 {
-    // Sizes in first-seen order (which breaks ties), and where each one is in it.
-    let mut by: Vec<(i64, usize)> = Vec::new();
-    let mut slot: HashMap<i64, usize> = HashMap::new();
-    for b in pages.iter().flat_map(|p| &p.blocks) {
-        let k = (b.size * 2.0).round() as i64;
-        count_lookup_steps(1);
-        let i = *slot.entry(k).or_insert_with(|| {
-            by.push((k, 0));
-            by.len() - 1
-        });
-        if let Some(e) = by.get_mut(i) {
-            e.1 = e.1.saturating_add(b.text.len());
-        }
-    }
-    by.into_iter().max_by_key(|e| e.1).map_or(11.0, |e| e.0 as f64 / 2.0)
-}
-
-/// Heading level for a block: 1 for ≥ 1.6× the body size, 2 for ≥ 1.25×, 0 for body text.
-fn level(b: &Block, body: f64) -> u8 {
-    let short = b.text.len() < 200;
-    if short && b.size >= body * 1.6 {
-        1
-    } else if short && (b.size >= body * 1.25 || (b.bold && b.size >= body && b.text.len() < 80 && !b.text.ends_with('.'))) {
-        2
-    } else {
-        0
-    }
-}
-
-/// How far two cell left edges may drift (points) and still be the same grid column.
-const COL_TOL: f64 = 4.0;
-/// More grid columns than this isn't a table. It is Word's limit: a .docx whose table has 64 or
-/// more columns doesn't open. It also bounds a table's size: every row is materialized to all
-/// its columns, so a hostile page laid out as a staircase of blocks would otherwise make
-/// (blocks / 2)² cells.
-const MAX_COLS: usize = 63;
-/// Two blocks in a row this close (as a fraction of their font size) are one line of running
-/// text that changed font or colour, such as a link inside a sentence, not two table cells.
-const INLINE_GAP: f64 = 0.5;
-/// How many blocks ending near a block's start are looked at to find the one it continues; a
-/// page laid out so that many end at the same place stays quick.
-const CONTINUATION_PROBE: usize = 64;
-/// Per block, whether it continues another on the same line: it starts where that one ends (up to
-/// [`INLINE_GAP`] later, or a point earlier for rounding), so it is the same line of text running
-/// on (a link inside a sentence, a superscript), not a cell of its own.
-fn continuations(blocks: &[Block]) -> Vec<bool> {
-    let mut by_end: Vec<(f64, usize)> = blocks.iter().enumerate().map(|(i, b)| (b.rect[2], i)).collect();
-    by_end.sort_by(|a, b| a.0.total_cmp(&b.0));
-    blocks
-        .iter()
-        .enumerate()
-        .map(|(bi, b)| {
-            let k = by_end.partition_point(|(end, _)| *end < b.rect[0] - INLINE_GAP * b.size);
-            by_end
-                .get(k..)
-                .unwrap_or_default()
-                .iter()
-                .take_while(|(end, _)| *end <= b.rect[0] + 1.0)
-                .take(CONTINUATION_PROBE)
-                .filter_map(|(_, ai)| blocks.get(*ai).filter(|_| *ai != bi))
-                .any(|a| a.rect[3].min(b.rect[3]) - a.rect[1].max(b.rect[1]) > 0.5 * (a.rect[3] - a.rect[1]).min(b.rect[3] - b.rect[1]))
-        })
-        .collect()
-}
-/// A cell is short: taller blocks are body text (or a multi-column layout), not table cells.
-fn is_cell_like(b: &Block) -> bool {
-    (b.rect[3] - b.rect[1]) <= b.size * 5.0 && !b.text.trim().is_empty()
-}
-
-/// Detect tables in a page's blocks from their text layout: columns are left edges shared by
-/// several short blocks, rows are blocks whose vertical spans overlap. Returns the tables and,
-/// per block, whether a table consumed it (so `items` can drop it from the paragraph flow).
-pub(crate) fn tables(blocks: &[Block]) -> (Vec<Table>, Vec<bool>) {
-    let mut consumed = vec![false; blocks.len()];
-    // Candidate columns: cluster the left edges of cell-like blocks.
-    let mut xs: Vec<(f64, usize)> = blocks.iter().enumerate().filter(|(_, b)| is_cell_like(b)).map(|(i, b)| (b.rect[0], i)).collect();
-    xs.sort_by(|a, b| a.0.total_cmp(&b.0));
-    let mut cols: Vec<(f64, Vec<usize>)> = Vec::new(); // (left edge, member block indices)
-    for (x, i) in xs {
-        match cols.last_mut() {
-            Some((e, m)) if (x - *e).abs() <= COL_TOL => {
-                *e = (*e * m.len() as f64 + x) / (m.len() + 1) as f64;
-                m.push(i);
-            }
-            _ => cols.push((x, vec![i])),
-        }
-    }
-    let cols: Vec<(f64, Vec<usize>)> = cols.into_iter().filter(|(_, m)| m.len() >= 2).collect();
-    if cols.len() < 2 {
-        return (Vec::new(), consumed);
-    }
-    // Each block's column (an index into `cols`), so lookups stay linear on pages with many blocks.
-    let mut col_of: Vec<Option<usize>> = vec![None; blocks.len()];
-    for (ci, (_, members)) in cols.iter().enumerate() {
-        for &i in members {
-            if let Some(c) = col_of.get_mut(i) {
-                *c = Some(ci);
-            }
-        }
-    }
-    // The column whose edge is within tolerance of `x` (edges are in ascending order).
-    let column_at = |x: f64| -> Option<usize> {
-        let k = cols.partition_point(|(e, _)| *e < x - COL_TOL);
-        cols.get(k).filter(|(e, _)| (*e - x).abs() <= COL_TOL).map(|_| k)
-    };
-    // Assign every cell-like block to its nearest column (within tolerance).
-    let mut rows: Vec<Vec<(usize, usize)>> = Vec::new(); // (column index, block index), top to bottom
-    let mut order: Vec<usize> = (0..blocks.len()).collect();
-    order.sort_by(|a, b| blocks[*b].rect[3].total_cmp(&blocks[*a].rect[3]).then(blocks[*a].rect[0].total_cmp(&blocks[*b].rect[0])));
-    for &bi in &order {
-        let b = &blocks[bi];
-        if !is_cell_like(b) {
-            continue;
-        }
-        let Some(ci) = column_at(b.rect[0]) else { continue };
-        let joins = rows
-            .last()
-            .and_then(|row| row.first())
-            .map(|(_, fi)| {
-                let rb = &blocks[*fi];
-                let overlap = rb.rect[3].min(b.rect[3]) - rb.rect[1].max(b.rect[1]);
-                overlap > 0.5 * (rb.rect[3] - rb.rect[1]).min(b.rect[3] - b.rect[1])
-            })
-            .unwrap_or(false);
-        if joins {
-            if let Some(row) = rows.last_mut() {
-                row.push((ci, bi));
-            }
-        } else {
-            rows.push(vec![(ci, bi)]);
-        }
-    }
-    // Runs of consecutive rows that have two or more distinct columns are tables.
-    let mut out = Vec::new();
-    let flush = |run: &mut Vec<Vec<(usize, usize)>>, out: &mut Vec<Table>, consumed: &mut Vec<bool>| {
-        if run.len() < 2 {
-            run.clear();
-            return;
-        }
-        let mut used: Vec<usize> = run.iter().flatten().map(|(_, i)| *i).collect();
-        used.sort_unstable();
-        used.dedup();
-        let mut edges: Vec<f64> = used.iter().filter_map(|&i| col_of.get(i).copied().flatten()).filter_map(|ci| cols.get(ci)).map(|c| c.0).collect();
-        edges.sort_by(f64::total_cmp);
-        edges.dedup_by(|a, b| (*a - *b).abs() <= COL_TOL);
-        let ncols = edges.len();
-        let ok = (ncols >= 3 || (ncols == 2 && run.len() >= 3)) && ncols <= MAX_COLS;
-        if !ok {
-            run.clear();
-            return;
-        }
-        let right = used.iter().map(|&i| blocks[i].rect[2]).fold(f64::MIN, f64::max) + COL_TOL;
-        let mut rows_out = Vec::new();
-        let mut slots: Vec<Option<(Cell, Vec<usize>)>> = vec![None; ncols];
-        for row in run.drain(..) {
-            for slot in slots.iter_mut() {
-                *slot = None;
-            }
-            for (_ci, bi) in row {
-                let b = &blocks[bi];
-                let Some(slot) = edges.iter().position(|e| (*e - b.rect[0]).abs() <= COL_TOL) else { continue };
-                let span = edges[slot + 1..].iter().filter(|e| **e > b.rect[0] + COL_TOL && **e < b.rect[2] - COL_TOL).count() + 1;
-                let cell = Cell { text: b.text.trim().to_string(), size: b.size, bold: b.bold, italic: b.italic, color: b.color, span };
-                match slots.get_mut(slot) {
-                    Some(Some((c, sources))) => {
-                        c.text.push(' ');
-                        c.text.push_str(&cell.text);
-                        sources.push(bi);
-                    }
-                    Some(empty @ None) => *empty = Some((cell, vec![bi])),
-                    None => continue,
-                }
-            }
-            let mut materialized = Vec::with_capacity(ncols);
-            let mut column = 0;
-            while column < ncols {
-                match slots.get_mut(column).and_then(Option::take) {
-                    Some((mut cell, sources)) => {
-                        // A spanning cell can skip later slots. Only consume source blocks
-                        // when their text is emitted, leaving covered text in paragraph flow.
-                        for bi in sources {
-                            if let Some(taken) = consumed.get_mut(bi) {
-                                *taken = true;
-                            }
-                        }
-                        cell.span = cell.span.min(ncols - column).max(1);
-                        column += cell.span;
-                        materialized.push(cell);
-                    }
-                    None => {
-                        column += 1;
-                        materialized.push(Cell { text: String::new(), size: 11.0, bold: false, italic: false, color: [0.0; 3], span: 1 });
-                    }
-                }
-            }
-            while materialized.last().is_some_and(|cell| cell.text.is_empty()) && materialized.iter().any(|cell| cell.span > 1) {
-                materialized.pop();
-            }
-            rows_out.push(materialized);
-        }
-        let rect = [
-            edges[0],
-            used.iter().map(|&i| blocks[i].rect[1]).fold(f64::MAX, f64::min),
-            right,
-            used.iter().map(|&i| blocks[i].rect[3]).fold(f64::MIN, f64::max),
-        ];
-        out.push(Table { rect, cols: edges, rows: rows_out });
-    };
-    // Runs of consecutive multi-column rows are tables. Rows on either side of a run that
-    // hold a single cell wide enough to span two columns (a header band, a totals row) join
-    // the table; other single-column rows (captions, following text) stay paragraphs.
-    let spans_run = |edges: &[f64], bi: usize| -> bool {
-        let b = &blocks[bi];
-        edges.iter().any(|e| (*e - b.rect[0]).abs() <= COL_TOL) && edges.iter().any(|e| *e > b.rect[0] + COL_TOL && *e < b.rect[2] - COL_TOL)
-    };
-    let run_edges = |run: &[Vec<(usize, usize)>]| -> Vec<f64> {
-        let mut es: Vec<f64> =
-            run.iter().flatten().filter_map(|(_, i)| col_of.get(*i).copied().flatten()).filter_map(|ci| cols.get(ci)).map(|c| c.0).collect();
-        es.sort_by(f64::total_cmp);
-        es.dedup_by(|a, b| (*a - *b).abs() <= COL_TOL);
-        es
-    };
-    let cont = continuations(blocks);
-    let qual: Vec<bool> = rows
-        .iter()
-        .map(|row| {
-            // A block that continues another adds no column of its own, and the cells of a table row
-            // sit side by side: blocks that overlap are a paragraph's lines, not cells (#2806).
-            let cells: Vec<(usize, usize)> = row.iter().copied().filter(|(_, bi)| !cont.get(*bi).copied().unwrap_or(false)).collect();
-            let mut spans: Vec<[f64; 2]> = cells.iter().filter_map(|(_, bi)| blocks.get(*bi)).map(|b| [b.rect[0], b.rect[2]]).collect();
-            spans.sort_by(|a, b| a[0].total_cmp(&b[0]));
-            let apart = spans.windows(2).all(|w| w[1][0] >= w[0][1] - COL_TOL);
-            let mut cs: Vec<usize> = cells.iter().map(|(c, _)| *c).collect();
-            cs.sort_unstable();
-            cs.dedup();
-            apart && cs.len() >= 2
-        })
-        .collect();
-    let mut i = 0;
-    while i < rows.len() {
-        if !qual[i] {
-            i += 1;
-            continue;
-        }
-        let start = i;
-        while i < rows.len() && qual[i] {
-            i += 1;
-        }
-        let end = i; // run = rows[start..end]
-        let mut pieces: Vec<Vec<(usize, usize)>> = Vec::new();
-        if start > 0 && rows[start - 1].len() == 1 && spans_run(&run_edges(&rows[start..end]), rows[start - 1][0].1) {
-            pieces.push(rows[start - 1].clone());
-        }
-        pieces.extend(rows[start..end].iter().cloned());
-        if end < rows.len() && rows[end].len() == 1 && spans_run(&run_edges(&rows[start..end]), rows[end][0].1) {
-            pieces.push(rows[end].clone());
-        }
-        flush(&mut pieces, &mut out, &mut consumed);
-    }
-    (out, consumed)
-}
-
-fn items(pages: &[Page]) -> Vec<Item<'_>> {
-    let body = body_size(pages);
-    let mut out = Vec::new();
-    for (i, p) in pages.iter().enumerate() {
-        if i > 0 {
-            out.push(Item::PageBreak);
-        }
-        let (tables, consumed) = tables(&p.blocks);
-        // Blocks and images by their top edge, top to bottom.
-        let mut parts: Vec<(f64, f64, Item)> = p
-            .blocks
-            .iter()
-            .enumerate()
-            .filter(|(bi, _)| !consumed.get(*bi).copied().unwrap_or(false))
-            .map(|(_, b)| (b.rect[3], b.rect[0], Item::Para(b, level(b, body))))
-            .collect();
-        parts.extend(tables.into_iter().map(|t| (t.rect[3], t.rect[0], Item::Table(t))));
-        parts.extend(p.images.iter().map(|im| (im.rect[3], im.rect[0], Item::Img(im))));
-        parts.sort_by(|a, b| b.0.total_cmp(&a.0).then(a.1.total_cmp(&b.1)));
-        out.extend(parts.into_iter().map(|x| x.2));
-    }
-    out
-}
-
-/// Whether a character may appear in the output. XML 1.0 forbids the C0 controls other than tab,
-/// line feed and carriage return, and U+FFFE/U+FFFF. Text extracted from PDFs often holds them
-/// (fonts without a usable `/ToUnicode`), and Word refuses a whole document over one (#72).
-fn allowed(c: char) -> bool {
-    matches!(c, '\t' | '\n' | '\r') || !(c.is_ascii_control() || c == '\u{FFFE}' || c == '\u{FFFF}')
-}
-
-pub(crate) fn esc(s: &str) -> String {
-    let mut o = String::with_capacity(s.len());
-    for c in s.chars().filter(|c| allowed(*c)) {
-        match c {
-            '&' => o.push_str("&amp;"),
-            '<' => o.push_str("&lt;"),
-            '>' => o.push_str("&gt;"),
-            '"' => o.push_str("&quot;"),
-            c => o.push(c),
-        }
-    }
-    o
-}
-
-fn base64(data: &[u8]) -> String {
-    const A: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-    let mut s = String::with_capacity(data.len().div_ceil(3) * 4);
-    for c in data.chunks(3) {
-        let n = (c[0] as u32) << 16 | (*c.get(1).unwrap_or(&0) as u32) << 8 | *c.get(2).unwrap_or(&0) as u32;
-        s.push(A[(n >> 18) as usize & 63] as char);
-        s.push(A[(n >> 12) as usize & 63] as char);
-        s.push(if c.len() > 1 { A[(n >> 6) as usize & 63] as char } else { '=' });
-        s.push(if c.len() > 2 { A[n as usize & 63] as char } else { '=' });
-    }
-    s
-}
-
-/// One HTML file: headings and paragraphs, tables as real `<table>` elements, images inline, a
-/// rule between pages.
-pub fn html(pages: &[Page], title: &str) -> String {
-    let mut s = format!(
-        "<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<title>{}</title>\n<style>body{{max-width:46em;margin:2em auto;font-family:sans-serif;line-height:1.45}}\
-img{{max-width:100%}}hr{{border:0;border-top:1px solid #ccc;margin:2em 0}}\
-table{{border-collapse:collapse;margin:1em 0}}td,th{{border:1px solid #999;padding:2px 6px;vertical-align:top}}</style>\n</head>\n<body>\n",
-        esc(title)
-    );
-    for it in items(pages) {
-        match it {
-            Item::Para(b, lvl) => {
-                let mut t = esc(&b.text);
-                if b.italic {
-                    t = format!("<em>{t}</em>");
-                }
-                if b.bold && lvl == 0 {
-                    t = format!("<strong>{t}</strong>");
-                }
-                let style = hex(b.color).map_or(String::new(), |h| format!(" style=\"color:#{h}\""));
-                match lvl {
-                    0 => s.push_str(&format!("<p{style}>{t}</p>\n")),
-                    l => s.push_str(&format!("<h{l}{style}>{t}</h{l}>\n")),
-                }
-            }
-            Item::Table(t) => {
-                s.push_str("<table>\n");
-                for row in &t.rows {
-                    s.push_str("<tr>");
-                    for c in row {
-                        let mut body = esc(&c.text);
-                        if c.italic {
-                            body = format!("<em>{body}</em>");
-                        }
-                        if c.bold {
-                            body = format!("<strong>{body}</strong>");
-                        }
-                        let span = if c.span > 1 { format!(" colspan=\"{}\"", c.span) } else { String::new() };
-                        let style = hex(c.color).map_or(String::new(), |h| format!(" style=\"color:#{h}\""));
-                        s.push_str(&format!("<td{span}{style}>{body}</td>"));
-                    }
-                    s.push_str("</tr>\n");
-                }
-                s.push_str("</table>\n");
-            }
-            Item::Img(im) => {
-                let mime = if im.ext == "jpg" { "image/jpeg" } else { "image/png" };
-                s.push_str(&format!("<p><img alt=\"\" src=\"data:{mime};base64,{}\"></p>\n", base64(&im.bytes)));
-            }
-            Item::PageBreak => s.push_str("<hr>\n"),
-        }
-    }
-    s.push_str("</body>\n</html>\n");
-    s
-}
-
-/// A colour's 8-bit sRGB components (NaN and out-of-range values clamp; NaN reads as 0).
-pub(crate) fn rgb8(c: [f64; 3]) -> [u8; 3] {
-    // The value is clamped to 0..=255 before the cast, so it cannot truncate.
-    c.map(|v| if v.is_finite() { (v.clamp(0.0, 1.0) * 255.0).round() as u8 } else { 0 })
-}
-
-/// The colour as `RRGGBB`, or `None` for black (the default every format already uses).
-pub(crate) fn hex(c: [f64; 3]) -> Option<String> {
-    let [r, g, b] = rgb8(c);
-    (r | g | b != 0).then(|| format!("{r:02X}{g:02X}{b:02X}"))
-}
-
-/// A formatted text run (shared by paragraphs and table cells).
-fn run_xml(text: &str, size: f64, bold: bool, italic: bool, color: [f64; 3]) -> String {
-    let mut rpr = String::new();
-    if bold {
-        rpr.push_str("<w:b/>");
-    }
-    if italic {
-        rpr.push_str("<w:i/>");
-    }
-    if let Some(h) = hex(color) {
-        rpr.push_str(&format!("<w:color w:val=\"{h}\"/>"));
-    }
-    let half_points = if size.is_finite() { (size * 2.0).round().clamp(2.0, 3276.0) as i64 } else { 24 };
-    rpr.push_str(&format!("<w:sz w:val=\"{half_points}\"/>"));
-    format!("<w:r><w:rPr>{rpr}</w:rPr><w:t xml:space=\"preserve\">{}</w:t></w:r>", esc(text))
-}
-
-/// One Word table: explicit absent borders (alignment alone cannot prove PDF rules), a grid sized
-/// from the detected column edges, `gridSpan` for spanning cells, empty cells for holes.
-fn docx_table(t: &Table) -> String {
-    let mut edges = t.cols.clone();
-    edges.push(t.rect[2]);
-    let widths: Vec<i64> = edges.windows(2).map(|w| ((w[1] - w[0]).max(20.0) * 20.0).round().clamp(60.0, 31680.0) as i64).collect();
-    let mut s = String::from("<w:tbl><w:tblPr><w:tblW w:w=\"0\" w:type=\"auto\"/><w:tblBorders>");
-    for edge in ["top", "left", "bottom", "right", "insideH", "insideV"] {
-        s.push_str(&format!("<w:{edge} w:val=\"nil\"/>"));
-    }
-    s.push_str("</w:tblBorders></w:tblPr><w:tblGrid>");
-    for w in &widths {
-        s.push_str(&format!("<w:gridCol w:w=\"{w}\"/>"));
-    }
-    s.push_str("</w:tblGrid>");
-    for row in &t.rows {
-        s.push_str("<w:tr>");
-        let mut column = 0usize;
-        for c in row {
-            let span = if c.span > 1 { format!("<w:gridSpan w:val=\"{}\"/>", c.span) } else { String::new() };
-            let w: i64 = widths.iter().skip(column).take(c.span).sum();
-            s.push_str(&format!(
-                "<w:tc><w:tcPr><w:tcW w:w=\"{w}\" w:type=\"dxa\"/>{span}</w:tcPr><w:p>{}</w:p></w:tc>",
-                run_xml(&c.text, c.size, c.bold, c.italic, c.color)
-            ));
-            column = column.saturating_add(c.span);
-        }
-        // Pad the grid so every row covers all columns (Word rejects short rows).
-        for _ in column..t.cols.len() {
-            s.push_str("<w:tc><w:tcPr><w:tcW w:w=\"0\" w:type=\"auto\"/></w:tcPr><w:p/></w:tc>");
-        }
-        s.push_str("</w:tr>");
-    }
-    s.push_str("</w:tbl>");
-    s
-}
-
-/// Pages with rotated text, or text that actually overlaps an image or an oversized
-/// (watermark-like) text block, cannot be put in paragraph flow without changing their layout.
-/// Keep those pages as editable, absolutely positioned text boxes. Every other page, including
-/// one with a logo or a big title that sits clear of the text, flows as paragraphs and tables.
-fn positioned(page: &Page) -> bool {
-    if page.blocks.iter().any(|b| b.rotation.abs() > 0.1) {
-        return true;
-    }
-    let body = body_size(std::slice::from_ref(page)).max(1.0);
-    let overlays = page
-        .images
-        .iter()
-        .map(|im| (im.rect, None))
-        .chain(page.blocks.iter().enumerate().filter(|(_, b)| b.size >= 2.0 * body).map(|(i, b)| (b.rect, Some(i))));
-    // Bound the pairwise test on hostile pages (many overlays times many blocks): past the
-    // budget, keep the default flowing layout.
-    let mut budget: usize = 1_000_000;
-    for (r, own) in overlays {
-        for (i, b) in page.blocks.iter().enumerate() {
-            if budget == 0 {
-                return false;
-            }
-            budget -= 1;
-            if Some(i) != own && overlaps(r, b.rect) {
-                return true;
-            }
-        }
-    }
-    false
-}
-
-/// Whether two [x0, y0, x1, y1] boxes share more than a hairline (0.5 pt each way); boxes that
-/// only touch, or hostile non-finite coordinates, do not count.
-fn overlaps(a: [f64; 4], b: [f64; 4]) -> bool {
-    let w = a[2].min(b[2]) - a[0].max(b[0]);
-    let h = a[3].min(b[3]) - a[1].max(b[1]);
-    w.is_finite() && h.is_finite() && w > 0.5 && h > 0.5
-}
-
-/// Bound every value written into a shape's style, including hostile PDF coordinates.
-fn layout_number(n: f64) -> f64 {
-    if n.is_finite() { n.clamp(-1584.0, 1584.0) } else { 0.0 }
-}
-
-/// Most images a Word export embeds, and most image bytes (the zip writer has 32-bit sizes and
-/// a 16-bit entry count; a hostile PDF must not be able to overflow them).
-const MAX_MEDIA: usize = 1000;
-const MAX_MEDIA_BYTES: usize = 512 << 20;
-
-/// Whether `im` can still be embedded: it has data, and the package stays within its limits.
-fn room_for(media: &[(String, &Image)], im: &Image) -> bool {
-    !im.bytes.is_empty()
-        && media.len() < MAX_MEDIA
-        && media.iter().map(|(_, m)| m.bytes.len()).fold(im.bytes.len(), usize::saturating_add) <= MAX_MEDIA_BYTES
-}
-
-/// Points as EMU (12700 per point); non-finite values are 0.
-fn emu(pt: f64) -> i64 {
-    if pt.is_finite() { (pt * 12700.0).round() as i64 } else { 0 }
-}
-
-/// The `a:graphic` of one picture (DrawingML), rotated by `rotation` degrees when given.
-fn picture_xml(n: usize, name: &str, (cx, cy): (i64, i64), rotation: Option<f64>) -> String {
-    let rot = rotation.map_or(String::new(), |r| format!(" rot=\"{}\"", (r * 60000.0).round() as i64));
-    format!(
-        "<wp:docPr id=\"{n}\" name=\"Picture {n}\"/><wp:cNvGraphicFramePr/>\
-<a:graphic xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\"><a:graphicData uri=\"http://schemas.openxmlformats.org/drawingml/2006/picture\">\
-<pic:pic xmlns:pic=\"http://schemas.openxmlformats.org/drawingml/2006/picture\"><pic:nvPicPr><pic:cNvPr id=\"{n}\" name=\"{name}\"/><pic:cNvPicPr/></pic:nvPicPr>\
-<pic:blipFill><a:blip r:embed=\"rIdImg{n}\"/><a:stretch><a:fillRect/></a:stretch></pic:blipFill>\
-<pic:spPr><a:xfrm{rot}><a:off x=\"0\" y=\"0\"/><a:ext cx=\"{cx}\" cy=\"{cy}\"/></a:xfrm><a:prstGeom prst=\"rect\"><a:avLst/></a:prstGeom></pic:spPr></pic:pic>\
-</a:graphicData></a:graphic>"
-    )
-}
-
-fn positioned_page<'a>(page: &'a Page, media: &mut Vec<(String, &'a Image)>, shape_id: &mut usize) -> String {
-    // One 1 pt paragraph anchors the whole page. Shapes never reserve body space, so even a
-    // page-sized watermark cannot push the invoice footer onto another page.
-    let mut s = String::from("<w:p><w:pPr><w:spacing w:before=\"0\" w:after=\"0\" w:line=\"20\" w:lineRule=\"exact\"/></w:pPr>");
-    let body = body_size(std::slice::from_ref(page)).max(1.0);
-    for b in &page.blocks {
-        *shape_id = shape_id.saturating_add(1);
-        let rotation = layout_number(-b.rotation).rem_euclid(360.0);
-        let (sin, cos) = rotation.to_radians().sin_cos();
-        let (bw, bh) = (layout_number(b.rect[2] - b.rect[0]).max(1.0), layout_number(b.rect[3] - b.rect[1]).max(1.0));
-        let h = if b.rotation.abs() > 0.1 { layout_number(b.size).max(1.0) } else { bh };
-        // Recover the unrotated width from the axis-aligned box. Use the larger axis so
-        // quarter turns and 45-degree watermarks do not divide by (nearly) zero.
-        let w = if b.rotation.abs() <= 0.1 {
-            bw
-        } else if cos.abs() >= sin.abs() {
-            (bw - h * sin.abs()) / cos.abs()
-        } else {
-            (bh - h * cos.abs()) / sin.abs()
-        };
-        let w = layout_number(w).max(1.0);
-        let (x, y) = (layout_number(b.rect[0] + (bw - w) / 2.0), layout_number(page.height - b.rect[3] + (bh - h) / 2.0));
-        let z = if b.size >= 2.0 * body { -2 } else { 1 };
-        let style = format!(
-            "position:absolute;margin-left:{x:.3}pt;margin-top:{y:.3}pt;width:{w:.3}pt;height:{h:.3}pt;rotation:{rotation:.3};z-index:{z};mso-position-horizontal-relative:page;mso-position-vertical-relative:page"
-        );
-        s.push_str(&format!(
-            "<w:r><w:pict><v:rect id=\"Text{}\" style=\"{style}\" filled=\"f\" stroked=\"f\"><v:textbox inset=\"0,0,0,0\" style=\"mso-fit-shape-to-text:t\"><w:txbxContent><w:p><w:pPr><w:spacing w:before=\"0\" w:after=\"0\"/></w:pPr>{}</w:p></w:txbxContent></v:textbox><w10:wrap type=\"none\"/></v:rect></w:pict></w:r>",
-            shape_id, run_xml(&b.text, b.size, b.bold, b.italic, b.color)
-        ));
-    }
-    for im in &page.images {
-        if !room_for(media, im) {
-            continue;
-        }
-        *shape_id = shape_id.saturating_add(1);
-        let n = media.len().saturating_add(1);
-        let (w, h) = (layout_number(im.size[0]).max(1.0), layout_number(im.size[1]).max(1.0));
-        let (x, y) = (layout_number((im.rect[0] + im.rect[2] - w) / 2.0), layout_number(page.height - (im.rect[1] + im.rect[3] + h) / 2.0));
-        let rotation = layout_number(-im.rotation).rem_euclid(360.0);
-        let name = format!("image{n}.{}", im.ext);
-        let pic = picture_xml(n, &name, (emu(w), emu(h)), Some(rotation));
-        // A DrawingML anchor, the way Word itself stores a picture placed behind text: a VML
-        // rectangle with an image does not show the picture.
-        s.push_str(&format!(
-            "<w:r><w:drawing><wp:anchor distT=\"0\" distB=\"0\" distL=\"0\" distR=\"0\" simplePos=\"0\" relativeHeight=\"{}\" behindDoc=\"1\" locked=\"0\" layoutInCell=\"1\" allowOverlap=\"1\">\
-<wp:simplePos x=\"0\" y=\"0\"/><wp:positionH relativeFrom=\"page\"><wp:posOffset>{}</wp:posOffset></wp:positionH><wp:positionV relativeFrom=\"page\"><wp:posOffset>{}</wp:posOffset></wp:positionV>\
-<wp:extent cx=\"{}\" cy=\"{}\"/><wp:effectExtent l=\"0\" t=\"0\" r=\"0\" b=\"0\"/><wp:wrapNone/>",
-            n.saturating_add(1),
-            emu(x),
-            emu(y),
-            emu(w),
-            emu(h),
-        ));
-        s.push_str(&pic);
-        s.push_str("</wp:anchor></w:drawing></w:r>");
-        media.push((name, im));
-    }
-    s.push_str("</w:p>");
-    s
-}
-
-fn word_page_size(page: &Page) -> (i64, i64) {
-    let twips = |pt: f64| if pt.is_finite() { (pt * 20.0).round().clamp(144.0, 31680.0) as i64 } else { 12240 };
-    (twips(page.width), twips(page.height))
-}
-
-fn section(page: &Page) -> String {
-    let (pw, ph) = word_page_size(page);
-    let (mx, my) = ((pw / 8).min(1440), (ph / 8).min(1440));
-    format!(
-        "<w:sectPr><w:type w:val=\"nextPage\"/><w:pgSz w:w=\"{pw}\" w:h=\"{ph}\"/><w:pgMar w:top=\"{my}\" w:right=\"{mx}\" w:bottom=\"{my}\" w:left=\"{mx}\" w:header=\"{}\" w:footer=\"{}\" w:gutter=\"0\"/></w:sectPr>",
-        my / 2,
-        my / 2
-    )
-}
-
-/// The page colour of a Word document: Word has one background for the whole document, so it
-/// is written only when every page has the same, non-white background (#2992).
-fn word_background(pages: &[Page]) -> Option<String> {
-    let first = rgb8(pages.first()?.background?);
-    let same = pages.iter().all(|p| p.background.map(rgb8) == Some(first));
-    (same && first != [255, 255, 255]).then(|| format!("{:02X}{:02X}{:02X}", first[0], first[1], first[2]))
-}
-
-/// A Word document (.docx, Office Open XML). Ordinary pages flow as paragraphs and tables;
-/// pages with rotated text, or text that overlaps artwork, use floating shapes to retain their layout.
-pub fn docx(pages: &[Page], title: &str) -> Vec<u8> {
-    let mut body = String::new();
-    let mut media: Vec<(String, &Image)> = Vec::new();
-    // Word needs a paragraph between adjacent tables and after the last one in the body.
-    let mut after_table = false;
-    let run = |b: &Block| run_xml(&b.text, b.size, b.bold, b.italic, b.color);
-    let mut shape_id = 0usize;
-    for (page_index, page) in pages.iter().enumerate() {
-        let (pw, _) = word_page_size(page);
-        let text_w = (pw - 2 * (pw / 8).min(1440)) as f64 / 20.0;
-        if positioned(page) {
-            body.push_str(&positioned_page(page, &mut media, &mut shape_id));
-            after_table = false;
-        } else {
-            for it in items(std::slice::from_ref(page)) {
-                match &it {
-                    Item::Para(b, lvl) => {
-                        let style = match lvl {
-                            1 => "<w:pPr><w:pStyle w:val=\"Heading1\"/></w:pPr>",
-                            2 => "<w:pPr><w:pStyle w:val=\"Heading2\"/></w:pPr>",
-                            _ => "",
-                        };
-                        body.push_str(&format!("<w:p>{style}{}</w:p>", run(b)));
-                    }
-                    Item::Table(t) => {
-                        if after_table {
-                            body.push_str("<w:p/>");
-                        }
-                        body.push_str(&docx_table(t));
-                    }
-                    Item::Img(im) => {
-                        if room_for(&media, im) {
-                            let n = media.len() + 1;
-                            let name = format!("image{n}.{}", im.ext);
-                            // Size on the page, at most the text width.
-                            let (w, h) = ((im.rect[2] - im.rect[0]).max(1.0), (im.rect[3] - im.rect[1]).max(1.0));
-                            let k = (text_w / w).min(1.0);
-                            let (cx, cy) = (emu(w * k), emu(h * k));
-                            body.push_str(&format!("<w:p><w:r><w:drawing><wp:inline><wp:extent cx=\"{cx}\" cy=\"{cy}\"/>"));
-                            body.push_str(&picture_xml(n, &name, (cx, cy), None));
-                            body.push_str("</wp:inline></w:drawing></w:r></w:p>");
-                            media.push((name, im));
-                        }
-                    }
-                    Item::PageBreak => body.push_str("<w:p><w:r><w:br w:type=\"page\"/></w:r></w:p>"),
-                }
-                after_table = matches!(it, Item::Table(_));
-            }
-        }
-        // Section breaks carry this source page's size and create exactly one next page.
-        // The last section must be a direct child of the body (OOXML 17.6.17).
-        if page_index + 1 < pages.len() {
-            body.push_str(&format!(
-                "<w:p><w:pPr><w:spacing w:before=\"0\" w:after=\"0\" w:line=\"20\" w:lineRule=\"exact\"/>{}</w:pPr></w:p>",
-                section(page)
-            ));
-        } else {
-            if after_table || page.blocks.is_empty() && page.images.is_empty() {
-                body.push_str("<w:p><w:pPr><w:spacing w:after=\"0\" w:line=\"20\" w:lineRule=\"exact\"/></w:pPr></w:p>");
-            }
-            body.push_str(&section(page));
-        }
-        after_table = false;
-    }
-    // Word shows a document background only when its settings say so (`settings.xml` below).
-    let page_colour = word_background(pages);
-    let background = page_colour.as_deref().map(|c| format!("<w:background w:color=\"{c}\"/>")).unwrap_or_default();
-    let doc = format!(
-        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\
-<w:document xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\" xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" \
-xmlns:wp=\"http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing\" xmlns:v=\"urn:schemas-microsoft-com:vml\" xmlns:w10=\"urn:schemas-microsoft-com:office:word\">{background}<w:body>{body}\
-</w:body></w:document>"
-    );
-    let mut types = String::from(
-        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">\
-<Default Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/><Default Extension=\"xml\" ContentType=\"application/xml\"/>\
-<Default Extension=\"png\" ContentType=\"image/png\"/><Default Extension=\"jpg\" ContentType=\"image/jpeg\"/>\
-<Override PartName=\"/word/document.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml\"/>\
-<Override PartName=\"/word/styles.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.wordprocessingml.styles+xml\"/>\
-<Override PartName=\"/docProps/core.xml\" ContentType=\"application/vnd.openxmlformats-package.core-properties+xml\"/>",
-    );
-    if page_colour.is_some() {
-        types.push_str(
-            "<Override PartName=\"/word/settings.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.wordprocessingml.settings+xml\"/>",
-        );
-    }
-    types.push_str("</Types>");
-    let rels = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\
-<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" Target=\"word/document.xml\"/>\
-<Relationship Id=\"rId2\" Type=\"http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties\" Target=\"docProps/core.xml\"/></Relationships>";
-    let mut doc_rels = String::from(
-        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\
-<Relationship Id=\"rIdStyles\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles\" Target=\"styles.xml\"/>",
-    );
-    for (i, (name, _)) in media.iter().enumerate() {
-        doc_rels.push_str(&format!(
-            "<Relationship Id=\"rIdImg{}\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\" Target=\"media/{name}\"/>",
-            i + 1
-        ));
-    }
-    if page_colour.is_some() {
-        doc_rels.push_str("<Relationship Id=\"rIdSettings\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/settings\" Target=\"settings.xml\"/>");
-    }
-    doc_rels.push_str("</Relationships>");
-    let styles = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<w:styles xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\">\
-<w:style w:type=\"paragraph\" w:default=\"1\" w:styleId=\"Normal\"><w:name w:val=\"Normal\"/><w:pPr><w:spacing w:after=\"120\"/></w:pPr></w:style>\
-<w:style w:type=\"paragraph\" w:styleId=\"Heading1\"><w:name w:val=\"heading 1\"/><w:basedOn w:val=\"Normal\"/><w:next w:val=\"Normal\"/><w:pPr><w:keepNext/><w:spacing w:before=\"240\"/><w:outlineLvl w:val=\"0\"/></w:pPr><w:rPr><w:b/></w:rPr></w:style>\
-<w:style w:type=\"paragraph\" w:styleId=\"Heading2\"><w:name w:val=\"heading 2\"/><w:basedOn w:val=\"Normal\"/><w:next w:val=\"Normal\"/><w:pPr><w:keepNext/><w:spacing w:before=\"200\"/><w:outlineLvl w:val=\"1\"/></w:pPr><w:rPr><w:b/></w:rPr></w:style>\
-</w:styles>";
-    let core = format!(
-        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<cp:coreProperties xmlns:cp=\"http://schemas.openxmlformats.org/package/2006/metadata/core-properties\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\"><dc:title>{}</dc:title></cp:coreProperties>",
-        esc(title)
-    );
-    let mut z = Zip::default();
-    z.add("[Content_Types].xml", types.as_bytes(), true);
-    z.add("_rels/.rels", rels.as_bytes(), true);
-    z.add("docProps/core.xml", core.as_bytes(), true);
-    z.add("word/document.xml", doc.as_bytes(), true);
-    z.add("word/styles.xml", styles.as_bytes(), true);
-    z.add("word/_rels/document.xml.rels", doc_rels.as_bytes(), true);
-    if page_colour.is_some() {
-        z.add("word/settings.xml", b"<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<w:settings xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\"><w:displayBackgroundShape/></w:settings>", true);
-    }
-    for (name, im) in &media {
-        z.add(&format!("word/media/{name}"), &im.bytes, false);
-    }
-    z.finish()
-}
-
-fn rtf_text(s: &str) -> String {
-    let mut o = String::new();
-    for c in s.chars().filter(|c| allowed(*c)) {
-        match c {
-            '\\' | '{' | '}' => {
-                o.push('\\');
-                o.push(c);
-            }
-            c if (c as u32) < 128 => o.push(c),
-            c => {
-                // \uN with a ? fallback; UTF-16 units as signed 16-bit numbers.
-                let mut buf = [0u16; 2];
-                for u in c.encode_utf16(&mut buf) {
-                    o.push_str(&format!("\\u{}?", *u as i16));
-                }
-            }
-        }
-    }
-    o
-}
-
-/// Rich Text Format: paragraphs with their sizes and bold/italic, real table rows, page breaks
-/// between pages (images are left out).
-pub fn rtf(pages: &[Page]) -> String {
-    let items = items(pages);
-    // The colour table: entry 0 is the default (auto) colour, then each non-black colour once.
-    let mut colors: Vec<[u8; 3]> = Vec::new();
-    let mut slot: HashMap<[u8; 3], usize> = HashMap::new();
-    let mut note = |c: [f64; 3]| {
-        let c = rgb8(c);
-        count_lookup_steps(1);
-        if c != [0, 0, 0] && !slot.contains_key(&c) {
-            slot.insert(c, colors.len());
-            colors.push(c);
-        }
-    };
-    for it in &items {
-        match it {
-            Item::Para(b, _) => note(b.color),
-            Item::Table(t) => t.rows.iter().flatten().for_each(|c| note(c.color)),
-            Item::Img(_) | Item::PageBreak => {}
-        }
-    }
-    // `\cfN` for a colour (nothing for black, which keeps the default).
-    let cf = |c: [f64; 3]| {
-        let c = rgb8(c);
-        count_lookup_steps(1);
-        slot.get(&c).map_or(String::new(), |i| format!("\\cf{}", i + 1))
-    };
-    let mut s = String::from("{\\rtf1\\ansi\\deff0{\\fonttbl{\\f0 Helvetica;}}\n");
-    if !colors.is_empty() {
-        s.push_str("{\\colortbl;");
-        for [r, g, b] in &colors {
-            s.push_str(&format!("\\red{r}\\green{g}\\blue{b};"));
-        }
-        s.push_str("}\n");
-    }
-    for it in items {
-        match it {
-            Item::Para(b, _) => {
-                let mut fmt = format!("\\fs{}", (b.size * 2.0).round() as i64);
-                if b.bold {
-                    fmt.push_str("\\b");
-                }
-                if b.italic {
-                    fmt.push_str("\\i");
-                }
-                fmt.push_str(&cf(b.color));
-                s.push_str(&format!("{{\\pard{fmt} {}\\par}}\n", rtf_text(&b.text)));
-            }
-            Item::Table(t) => {
-                let mut edges = t.cols.clone();
-                edges.push(t.rect[2]);
-                let cellx: Vec<i64> = edges.iter().skip(1).map(|e| (e * 20.0).round() as i64).collect();
-                for row in &t.rows {
-                    s.push_str("\\trowd\\trgaph108");
-                    // The row's cell boundaries come first: each cell ends at the right edge of
-                    // the last grid column it spans.
-                    let mut column = 0;
-                    for c in row {
-                        column += c.span.max(1);
-                        if let Some(x) = cellx.get(column.min(cellx.len()).saturating_sub(1)) {
-                            s.push_str(&format!("\\cellx{x}"));
-                        }
-                    }
-                    for c in row {
-                        let mut fmt = format!("\\intbl\\fs{}", (c.size * 2.0).round() as i64);
-                        if c.bold {
-                            fmt.push_str("\\b");
-                        }
-                        if c.italic {
-                            fmt.push_str("\\i");
-                        }
-                        fmt.push_str(&cf(c.color));
-                        s.push_str(&format!("{{{fmt} {}}}\\cell", rtf_text(&c.text)));
-                    }
-                    s.push_str("\\row\n");
-                }
-            }
-            Item::Img(_) => {}
-            Item::PageBreak => s.push_str("\\page\n"),
-        }
-    }
-    s.push('}');
-    s
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A page of `n` one-word blocks, each in its own size and colour.
-    fn varied_page(n: usize) -> Page {
-        let blocks = (0..n)
-            .map(|i| Block {
-                text: "word".into(),
-                rect: [72.0, i as f64, 100.0, i as f64 + 1.0],
-                size: 4.0 + i as f64 * 0.5,
-                bold: false,
-                italic: false,
-                color: [(i % 256) as f64 / 255.0, (i / 256 % 256) as f64 / 255.0, 0.5],
-                rotation: 0.0,
-            })
-            .collect();
-        Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None }
-    }
-
-    fn lookup_steps(f: impl FnOnce()) -> usize {
-        LOOKUP_STEPS.with(|c| c.set(0));
-        f();
-        LOOKUP_STEPS.with(|c| c.get())
-    }
-
-    #[test]
-    fn many_distinct_sizes_are_counted_in_constant_steps_each() {
-        let pages = [varied_page(3000)];
-        let steps = lookup_steps(|| {
-            body_size(&pages);
-        });
-        assert!(steps <= 2 * 3000, "{steps} steps");
-    }
-
-    #[test]
-    fn many_distinct_colours_take_constant_steps_each() {
-        let pages = [varied_page(3000)];
-        let mut out = String::new();
-        let steps = lookup_steps(|| out = rtf(&pages));
-        assert!(steps <= 4 * 3000, "{steps} steps");
-        assert!(out.contains("\\cf3000 ") || out.contains("\\cf3000\\"), "the last colour has the last slot");
-    }
-
-    fn page() -> Page {
-        let b = |t: &str, y: f64, size: f64, bold: bool| Block {
-            text: t.into(),
-            rect: [72.0, y, 500.0, y + size],
-            size,
-            bold,
-            italic: false,
-            color: [0.0; 3],
-            rotation: 0.0,
-        };
-        Page {
-            width: 612.0,
-            height: 792.0,
-            blocks: vec![
-                b("Body text after the picture, which is long enough to be the main text size of the page.", 400.0, 11.0, false),
-                b("Annual Report", 700.0, 24.0, true),
-                b("Overview", 650.0, 14.0, true),
-                b("Some <body> text & more of it so that eleven points is the body size here.", 620.0, 11.0, false),
-            ],
-            images: vec![Image {
-                ext: "png",
-                bytes: b"\x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\0\x02\0\0\0\x03".as_slice().into(),
-                rect: [72.0, 450.0, 272.0, 600.0],
-                size: [200.0, 150.0],
-                rotation: 0.0,
-            }],
-            background: None,
-        }
-    }
-
-    #[test]
-    fn html_has_headings_paragraphs_and_images_in_order() {
-        let h = html(&[page(), page()], "Report");
-        let order: Vec<usize> = ["<h1>Annual Report</h1>", "<h2>Overview</h2>", "<p>Some &lt;body&gt; text &amp;", "<img", "<p>Body text after"]
-            .iter()
-            .map(|x| h.find(x).unwrap_or_else(|| panic!("{x} missing in {h}")))
-            .collect();
-        assert!(order.windows(2).all(|w| w[0] < w[1]), "{order:?}");
-        assert_eq!(h.matches("<hr>").count(), 1);
-        assert_eq!(base64(b"Man"), "TWFu");
-        assert_eq!(base64(b"Ma"), "TWE=");
-    }
-
-    #[test]
-    fn docx_is_a_word_package() {
-        let d = docx(&[page()], "Report");
-        assert!(d.starts_with(b"PK"));
-        let names: Vec<&str> =
-            ["[Content_Types].xml", "word/document.xml", "word/styles.xml", "word/_rels/document.xml.rels", "word/media/image1.png", "_rels/.rels"]
-                .to_vec();
-        for n in names {
-            assert!(d.windows(n.len()).any(|w| w == n.as_bytes()), "{n}");
-        }
-    }
-
-    #[test]
-    fn word_does_not_invent_borders_for_aligned_invoice_fields() {
-        let xml = part(&docx(&[table_page()], "Invoice"), "word/document.xml");
-        assert!(xml.contains("<w:tbl>"));
-        assert!(!xml.contains("w:val=\"single\""), "text alignment is not evidence of a border: {xml}");
-        assert!(xml.contains("<w:insideH w:val=\"nil\"/>"));
-    }
-
-    #[test]
-    fn word_table_cell_widths_follow_the_columns_they_span() {
-        let cell = |text: &str, span| Cell { text: text.into(), size: 11.0, bold: false, italic: false, color: [0.0; 3], span };
-        let table = Table {
-            rect: [0.0, 0.0, 300.0, 100.0],
-            cols: vec![0.0, 50.0, 150.0],
-            rows: vec![
-                vec![cell("First", 1), cell("Second", 1), cell("Third", 1)],
-                vec![cell("First", 1), cell("Last two", 2)],
-                vec![cell("First two", 2), cell("Third", 1)],
-                vec![cell("All", 3)],
-                vec![cell("First", 1)],
-            ],
-        };
-        let xml = docx_table(&table);
-        assert!(xml.contains("<w:gridCol w:w=\"1000\"/><w:gridCol w:w=\"2000\"/><w:gridCol w:w=\"3000\"/>"), "{xml}");
-        let widths: Vec<Vec<&str>> =
-            xml.split("<w:tr>").skip(1).map(|row| row.split("<w:tcW w:w=\"").skip(1).map(|cell| cell.split('"').next().unwrap()).collect()).collect();
-        assert_eq!(widths, vec![vec!["1000", "2000", "3000"], vec!["1000", "5000"], vec!["3000", "3000"], vec!["6000"], vec!["1000", "0", "0"]]);
-    }
-
-    #[test]
-    fn word_keeps_a_page_with_a_clear_image_and_big_title_in_flow() {
-        // page() has a picture between paragraphs and a 24 pt title over 11 pt body text, but
-        // nothing overlaps: it must stay flowing paragraphs with the image inline.
-        let xml = part(&docx(&[page()], "Report"), "word/document.xml");
-        assert!(!xml.contains("position:absolute"), "nothing overlaps, so nothing floats: {xml}");
-        assert!(xml.contains("<wp:inline>"), "the picture stays inline: {xml}");
-        assert!(xml.contains("<w:pStyle w:val=\"Heading1\"/>"), "the title stays a heading: {xml}");
-        let (title, body) = (xml.find(">Annual Report</w:t>"), xml.find(">Body text after the picture"));
-        assert!(title.is_some() && body.is_some() && title < body, "reading order kept: {xml}");
-        // The same page with the picture moved over the body text floats.
-        let mut over = page();
-        over.images[0].rect = [72.0, 380.0, 272.0, 530.0];
-        let xml = part(&docx(&[over], "Report"), "word/document.xml");
-        assert!(xml.contains("position:absolute"), "an image over text floats: {xml}");
-    }
-
-    #[test]
-    fn word_overlap_does_not_consume_invoice_body_space() {
-        let mut p = table_page();
-        p.blocks.push(Block {
-            text: "DRAFT".into(),
-            rect: [100.0, 200.0, 500.0, 700.0],
-            size: 100.0,
-            bold: false,
-            italic: false,
-            color: [0.8; 3],
-            rotation: 0.0,
-        });
-        p.images = page().images;
-        let xml = part(&docx(&[p], "Invoice"), "word/document.xml");
-        assert!(xml.contains("position:absolute"), "overlapping text must float: {xml}");
-        assert!(!xml.contains("<wp:inline>"), "images must not displace invoice text");
-        assert!(!xml.contains("<w:tbl>"), "the source text boxes must keep their positions");
-        assert_eq!(xml.matches(">DRAFT</w:t>").count(), 1);
-        assert_eq!(xml.matches("w:type=\"page\"").count(), 0);
-        assert!(xml.contains("margin-left:72.000pt;margin-top:160.000pt"), "Meter field keeps its source position: {xml}");
-        let watermark = xml.split(">DRAFT</w:t>").next().unwrap().rsplit("<v:rect ").next().unwrap();
-        assert!(watermark.contains("z-index:-2"), "watermark is behind foreground graphics");
-        // The picture is a DrawingML anchor behind the text (a VML rectangle shows no picture in Word).
-        assert!(!xml.contains("<v:imagedata"), "{xml}");
-        assert!(xml.contains("<wp:anchor ") && xml.contains("behindDoc=\"1\"") && xml.contains("<a:blip r:embed=\"rIdImg1\"/>"), "{xml}");
-    }
-
-    #[test]
-    fn word_rotated_pages_keep_separate_page_sizes_and_unique_shapes() {
-        let mut p = table_page();
-        p.blocks[0].rotation = 45.0;
-        let mut second = p.clone();
-        second.width = 400.0;
-        second.height = 500.0;
-        let xml = part(&docx(&[p, second], "Two invoices"), "word/document.xml");
-        assert!(xml.contains("rotation:315.000"), "PDF y-up becomes Word y-down");
-        assert_eq!(xml.matches("<w:sectPr>").count(), 2);
-        assert!(xml.contains("<w:pgSz w:w=\"8000\" w:h=\"10000\"/>"));
-        assert_eq!(xml.matches("id=\"Text1\"").count(), 1);
-        assert_eq!(xml.matches(">Meter</w:t>").count(), 2);
-    }
-
-    /// #2992: pages that share a background colour get it as the Word document's page colour
-    /// (with the setting that makes Word show it); differing or white backgrounds don't.
-    #[test]
-    fn docx_keeps_a_shared_page_background() {
-        let teal = Page { background: Some([0.0, 0.5, 0.5]), ..page() };
-        let zip = docx(&[teal.clone(), teal.clone()], "Teal");
-        let xml = part(&zip, "word/document.xml");
-        assert!(xml.contains("<w:background w:color=\"008080\"/><w:body>"), "{xml}");
-        assert!(part(&zip, "word/settings.xml").contains("<w:displayBackgroundShape/>"));
-        assert!(part(&zip, "[Content_Types].xml").contains("/word/settings.xml"));
-        assert!(part(&zip, "word/_rels/document.xml.rels").contains("Target=\"settings.xml\""));
-        let other = Page { background: Some([1.0, 0.0, 0.0]), ..page() };
-        for (pages, why) in [
-            (vec![teal.clone(), other], "different colours"),
-            (vec![teal.clone(), page()], "a page without one"),
-            (vec![Page { background: Some([1.0; 3]), ..page() }], "white"),
-            (vec![page()], "none"),
-        ] {
-            let zip = docx(&pages, "Plain");
-            assert!(!part(&zip, "word/document.xml").contains("<w:background"), "{why}");
-            assert!(!zip.windows(b"word/settings.xml".len()).any(|w| w == b"word/settings.xml"), "{why}");
-        }
-    }
-
-    /// One part of a package written by [`Zip`], inflated.
-    pub(crate) fn part(zip: &[u8], name: &str) -> String {
-        let at = |i: usize, n: usize| zip[i..i + n].iter().rev().fold(0usize, |v, b| v << 8 | *b as usize);
-        let mut i = 0;
-        while zip[i..].starts_with(b"PK\x03\x04") {
-            let (size, name_len) = (at(i + 18, 4), at(i + 26, 2));
-            let data = i + 30 + name_len;
-            if &zip[i + 30..data] == name.as_bytes() {
-                let mut s = String::new();
-                std::io::Read::read_to_string(&mut flate2::read::DeflateDecoder::new(&zip[data..data + size]), &mut s).unwrap();
-                return s;
-            }
-            i = data + size;
-        }
-        panic!("{name} missing")
-    }
-
-    #[test]
-    fn word_opens_text_with_control_characters_and_long_pages() {
-        // #72: text extracted without a usable /ToUnicode holds C0 controls, which XML forbids;
-        // Word then refused the whole file. A till receipt is also taller than Word's 22 in.
-        let mut p = page();
-        p.height = 2400.0;
-        p.blocks.push(Block {
-            text: "Total\u{0}\u{3}\u{c} 4.50\u{FFFF}\tGBP".into(),
-            rect: [72.0, 100.0, 300.0, 110.0],
-            size: f64::NAN,
-            bold: false,
-            italic: false,
-            color: [0.0; 3],
-            rotation: 0.0,
-        });
-        let xml = part(&docx(&[p.clone()], "Receipt\u{1}"), "word/document.xml");
-        assert!(xml.contains(">Total 4.50\tGBP</w:t>"), "{xml}");
-        assert!(!xml.chars().any(|c| !allowed(c)));
-        assert!(xml.contains("<w:pgSz w:w=\"12240\" w:h=\"31680\"/>"), "clamped to 22 in: {xml}");
-        assert!(xml.contains("<w:sz w:val=\"24\"/>"), "a non-finite size falls back to 12 pt");
-        assert!(rtf(&[p]).contains("Total 4.50\tGBP"));
-        // A narrow page keeps room for text: margins shrink.
-        let narrow = Page { width: 100.0, height: 200.0, ..page() };
-        let xml = part(&docx(&[narrow], "Narrow"), "word/document.xml");
-        assert!(xml.contains("<w:pgMar w:top=\"500\" w:right=\"250\" w:bottom=\"500\" w:left=\"250\""), "{xml}");
-    }
-
-    #[test]
-    fn text_colour_survives_every_format() {
-        // #526: a dark green heading (0.05 0.23 0.18 rg) came out black in Word.
-        let mut p = page();
-        p.blocks[1].color = [0.05, 0.23, 0.18];
-        p.blocks[3].color = [f64::NAN, 2.0, -1.0];
-        let xml = part(&docx(&[p.clone()], "Colour"), "word/document.xml");
-        assert!(xml.contains("<w:color w:val=\"0D3B2E\"/>"), "{xml}");
-        assert!(xml.contains("<w:color w:val=\"00FF00\"/>"), "out-of-range values clamp: {xml}");
-        // Black text keeps Word's default colour.
-        assert_eq!(xml.matches("<w:color ").count(), 2, "{xml}");
-        let h = html(&[p.clone()], "Colour");
-        assert!(h.contains("<h1 style=\"color:#0D3B2E\">Annual Report</h1>"), "{h}");
-        assert!(h.contains("<p style=\"color:#00FF00\">"), "{h}");
-        let r = rtf(&[p.clone()]);
-        assert!(r.contains("{\\colortbl;\\red13\\green59\\blue46;\\red0\\green255\\blue0;}"), "{r}");
-        assert!(r.contains("\\cf1 Annual Report"), "{r}");
-        let ppt = pptx(&[p], "Colour");
-        let pxml = part(&ppt, "ppt/slides/slide1.xml");
-        assert!(pxml.contains("<a:srgbClr val=\"0D3B2E\"/>"), "{pxml}");
-        assert!(pxml.contains("<a:srgbClr val=\"00FF00\"/>"), "out-of-range values clamp: {pxml}");
-        // A table cell keeps its colour too.
-        let mut t = table_page();
-        t.blocks[0].color = [1.0, 0.0, 0.0];
-        let xml = part(&docx(&[t.clone()], "Grid"), "word/document.xml");
-        assert!(xml.contains("<w:color w:val=\"FF0000\"/>"), "{xml}");
-        assert!(html(&[t], "Grid").contains("style=\"color:#FF0000\""));
-    }
-
-    #[test]
-    fn rtf_escapes_and_sizes() {
-        let mut p = page();
-        p.blocks.push(Block {
-            text: "Café {x}".into(),
-            rect: [72.0, 100.0, 200.0, 110.0],
-            size: 10.0,
-            bold: false,
-            italic: true,
-            color: [0.0; 3],
-            rotation: 0.0,
-        });
-        let r = rtf(&[p]);
-        assert!(r.starts_with("{\\rtf1") && r.ends_with('}'));
-        assert!(r.contains("\\fs48\\b Annual Report"));
-        assert!(r.contains("\\fs20\\i Caf\\u233? \\{x\\}"), "{r}");
-    }
-
-    /// A 3-column table with a spanning header row and a hole in the last row.
-    fn table_page() -> Page {
-        let cell = |t: &str, x: f64, y: f64, w: f64| Block {
-            text: t.into(),
-            rect: [x, y, x + w, y + 12.0],
-            size: 11.0,
-            bold: false,
-            italic: false,
-            color: [0.0; 3],
-            rotation: 0.0,
-        };
-        Page {
-            width: 612.0,
-            height: 792.0,
-            blocks: vec![
-                cell("Meter", 72.0, 620.0, 120.0),
-                cell("Unit", 232.0, 620.0, 80.0),
-                cell("Reading", 392.0, 620.0, 100.0),
-                cell("A1", 72.0, 590.0, 120.0),
-                cell("kWh", 232.0, 590.0, 80.0),
-                cell("37414.00", 392.0, 590.0, 100.0),
-                cell("A2", 72.0, 560.0, 120.0),
-                cell("kW", 232.0, 560.0, 80.0),
-                // A2's row is missing its third cell (an empty cell in the grid).
-                cell("Totals", 72.0, 530.0, 240.0),
-                Block {
-                    text: "Notes follow the table and are long enough to be the body text size of the page here.".into(),
-                    rect: [72.0, 460.0, 500.0, 471.0],
-                    size: 11.0,
-                    bold: false,
-                    italic: false,
-                    color: [0.0; 3],
-                    rotation: 0.0,
-                },
-            ],
-            images: Vec::new(),
-            background: None,
-        }
-    }
-
-    #[test]
-    fn grid_text_becomes_a_real_table_in_every_format() {
-        let p = table_page();
-        let h = html(std::slice::from_ref(&p), "Bill");
-        assert!(h.contains("<table>"), "{h}");
-        assert!(h.contains("<td colspan=\"2\">Totals</td>"), "spanning cell: {h}");
-        assert_eq!(h.matches("<tr>").count(), 4, "{h}");
-        assert!(h.contains("<td></td>"), "the hole is an empty cell: {h}");
-        assert!(h.contains("<p>Notes follow"), "the paragraph after the table stays: {h}");
-
-        let d = docx(std::slice::from_ref(&p), "Bill");
-        assert!(d.starts_with(b"PK"));
-        assert!(d.windows(b"word/document.xml".len()).any(|w| w == b"word/document.xml"));
-        let (tables, _) = tables(&p.blocks);
-        assert_eq!(tables.len(), 1);
-        let table_xml = docx_table(&tables[0]);
-        assert!(table_xml.contains("<w:tblGrid>"));
-        assert!(table_xml.contains("<w:gridSpan w:val=\"2\"/>"), "{table_xml}");
-        assert_eq!(table_xml.matches("<w:tr>").count(), 4);
-
-        let r = rtf(std::slice::from_ref(&p));
-        assert!(r.contains("\\trowd"), "{r}");
-        assert_eq!(r.matches("\\row").count(), 4);
-        // Boundaries precede the cells; "Totals" spans two columns, so it ends at the third edge.
-        assert!(r.contains("\\trowd\\trgaph108\\cellx4640\\cellx7840\\cellx9920{"), "{r}");
-        assert!(r.contains("\\trowd\\trgaph108\\cellx7840{\\intbl\\fs22 Totals}\\cell\\row"), "{r}");
-
-        let pt = pptx(std::slice::from_ref(&p), "Bill");
-        assert!(pt.starts_with(b"PK"));
-        assert!(pt.windows(b"ppt/slides/slide1.xml".len()).any(|w| w == b"ppt/slides/slide1.xml"));
-        let slide_xml = part(&pt, "ppt/slides/slide1.xml");
-        assert!(slide_xml.contains("<a:tbl>"));
-        assert!(slide_xml.contains("gridSpan=\"2\""));
-        assert_eq!(slide_xml.matches("<a:tr ").count(), 4);
-    }
-
-    #[test]
-    fn a_staircase_of_blocks_is_not_a_huge_table() {
-        // Row k holds blocks in columns k and k + 1: every column has two members and every row
-        // two columns, so without a cap this would be one table of (n / 2)² cells.
-        let n = 4000;
-        let blocks: Vec<Block> = (0..n)
-            .map(|i| {
-                let (row, col) = (i / 2, i / 2 + i % 2);
-                let (x, y) = (10.0 + col as f64 * 20.0, 10_000.0 - row as f64 * 14.0);
-                Block { text: "x".into(), rect: [x, y, x + 8.0, y + 12.0], size: 11.0, bold: false, italic: false, color: [0.0; 3], rotation: 0.0 }
-            })
-            .collect();
-        let started = std::time::Instant::now();
-        let (tables, _) = tables(&blocks);
-        assert!(tables.iter().all(|t| t.cols.len() <= MAX_COLS), "{} columns", tables.iter().map(|t| t.cols.len()).max().unwrap_or(0));
-        assert!(started.elapsed() < std::time::Duration::from_secs(5), "took {:?}", started.elapsed());
-    }
-
-    #[test]
-    fn word_opens_tables_up_to_its_column_limit() {
-        // Rows of short numbers on a regular grid, n columns wide.
-        let grid = |n: usize| Page {
-            width: 1500.0,
-            height: 792.0,
-            blocks: (0..3)
-                .flat_map(|row| {
-                    (0..n).map(move |col| {
-                        let (x, y) = (20.0 + col as f64 * 22.0, 700.0 - row as f64 * 14.0);
-                        Block {
-                            text: (col + 1).to_string(),
-                            rect: [x, y, x + 8.0, y + 8.0],
-                            size: 8.0,
-                            bold: false,
-                            italic: false,
-                            color: [0.0; 3],
-                            rotation: 0.0,
-                        }
-                    })
-                })
-                .collect(),
-            images: Vec::new(),
-            background: None,
-        };
-        let grid_cols = |p: &Page| part(&docx(std::slice::from_ref(p), "Grid"), "word/document.xml").matches("<w:gridCol ").count();
-        assert_eq!(grid_cols(&grid(63)), 63, "63 columns is still a table");
-        // Word refuses to open a document with a 64-column table, so that grid stays text.
-        assert_eq!(grid_cols(&grid(64)), 0);
-    }
-
-    fn block(t: &str, x0: f64, y0: f64, x1: f64, y1: f64) -> Block {
-        Block { text: t.into(), rect: [x0, y0, x1, y1], size: 12.0, bold: false, italic: false, color: [0.0; 3], rotation: 0.0 }
-    }
-
-    /// #2806: a sentence whose link is set in another colour or font runs on as separate blocks
-    /// on one line. They are not table columns, even when several such lines share left edges.
-    #[test]
-    fn a_link_inside_a_sentence_is_not_a_table_column() {
-        let blue = |t: &str, x0: f64, y0: f64, x1: f64, y1: f64| Block { color: [0.02, 0.388, 0.757], ..block(t, x0, y0, x1, y1) };
-        let p = Page {
-            width: 612.0,
-            height: 792.0,
-            blocks: vec![
-                block("6.3. 2. All content shown at", 121.7, 710.3, 272.0, 724.9),
-                blue("http", 273.5, 710.3, 294.1, 724.9),
-                blue("s", 294.1, 709.8, 298.8, 725.8),
-                blue("://women", 298.8, 710.3, 348.0, 724.9),
-                blue("g", 348.1, 709.8, 353.7, 725.8),
-                blue("randprix.fide.com", 353.7, 710.3, 443.2, 724.9),
-                block("shall be reviewed and approved by the Press Officer.", 164.3, 622.5, 533.1, 724.9),
-                block("6.3. 3. The Organiser shall warrant that", 121.7, 601.8, 345.1, 616.5),
-                blue("https://womengrandprix.fide.com", 350.2, 601.3, 519.9, 617.4),
-                block("is managed in a professional way and furthermore that it is capable of", 164.3, 557.9, 533.0, 616.5),
-                block("6. 3. 4. The Press Officer shall report to the FIDE Head of PR.", 121.7, 516.6, 530.3, 551.9),
-                block("conducted during a WGP tournament.", 164.3, 502.0, 352.5, 516.6),
-            ],
-            images: Vec::new(),
-            background: None,
-        };
-        let h = html(std::slice::from_ref(&p), "Regulations");
-        assert!(!h.contains("<table>"), "running text became a table: {h}");
-        for b in &p.blocks {
-            assert!(h.contains(&b.text), "{} was lost: {h}", b.text);
-        }
-    }
-
-    /// #2806: lines that each run on into a link starting at the same place are sentences, not a
-    /// two-column table, even three in a row.
-    #[test]
-    fn sentences_that_run_on_into_links_are_not_a_table() {
-        let blue = |t: &str, x0: f64, y0: f64, x1: f64, y1: f64| Block { color: [0.02, 0.388, 0.757], ..block(t, x0, y0, x1, y1) };
-        let mut blocks = Vec::new();
-        for (n, lead) in ["Rules are published at", "Pairings are posted at", "Results are listed at"].iter().enumerate() {
-            let y = 700.0 - 16.0 * n as f64;
-            blocks.push(block(lead, 72.0, y, 211.0, y + 12.0));
-            blocks.push(blue("https://example.org/event", 212.5, y, 360.0, y + 12.0));
-        }
-        let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
-        let h = html(std::slice::from_ref(&p), "Event");
-        assert!(!h.contains("<table>"), "sentences became a table: {h}");
-        assert_eq!(h.matches("https://example.org/event").count(), 3, "{h}");
-    }
-
-    /// A continuation can drift into a grid column covered by the preceding cell's span.
-    /// It must remain available as paragraph text if that slot never becomes an output cell.
-    #[test]
-    fn table_spans_do_not_consume_text_they_do_not_emit() {
-        let mut blocks = vec![
-            Block { size: 12.0, ..block("ABCDEFGHIJK", 72.1, 697.0, 151.3, 710.8) },
-            Block { size: 12.0, color: [0.0, 0.0, 1.0], ..block("LOST", 150.4, 697.0, 179.2, 710.8) },
-            Block { size: 12.0, ..block("R0", 250.0, 697.0, 264.4, 710.8) },
-        ];
-        for row in 1..=4 {
-            let y = 697.0 - f64::from(row) * 50.0;
-            for (text, left, right) in [(format!("L{row}"), 72.1, 86.5), (format!("M{row}"), 146.4, 160.8), (format!("R{row}"), 250.0, 264.4)] {
-                blocks.push(Block { size: 12.0, ..block(&text, left, y, right, y + 13.8) });
-            }
-        }
-        let p = Page { width: 612.0, height: 792.0, blocks, ..Page::default() };
-        let (tables, consumed) = tables(&p.blocks);
-        assert_eq!(tables.len(), 1);
-        assert_eq!(tables[0].rows[0][0].span, 2);
-        assert!(!consumed[1], "a covered slot did not emit its text");
-        assert!(consumed.iter().enumerate().all(|(index, used)| index == 1 || *used));
-        let outputs = [
-            html(std::slice::from_ref(&p), "Continuations"),
-            part(&docx(std::slice::from_ref(&p), "Continuations"), "word/document.xml"),
-            rtf(std::slice::from_ref(&p)),
-            part(&pptx(std::slice::from_ref(&p), "Continuations"), "ppt/slides/slide1.xml"),
-        ];
-        for output in outputs {
-            for b in &p.blocks {
-                assert_eq!(output.matches(&b.text).count(), 1, "{} must survive exactly once", b.text);
-            }
-        }
-    }
-
-    /// #2806: a superscript right after a number ("1" "st") continues its cell; the prize table
-    /// around it stays a table.
-    #[test]
-    fn a_superscript_beside_a_number_keeps_its_table() {
-        let mut blocks = vec![block("PLACE", 100.0, 700.0, 140.0, 712.0), block("PRIZE (euros)", 300.0, 700.0, 380.0, 712.0)];
-        for (n, (row, sup)) in [("1", "st"), ("2", "nd"), ("3", "rd"), ("4", "th")].iter().enumerate() {
-            let y = 680.0 - 20.0 * n as f64;
-            blocks.push(block(row, 100.0, y, 106.0, y + 12.0));
-            blocks.push(Block { size: 8.0, ..block(sup, 106.0, y + 5.0, 113.0, y + 13.0) });
-            blocks.push(block(&format!("{},000", 30 - 5 * n), 300.0, y, 340.0, y + 12.0));
-        }
-        let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
-        let h = html(std::slice::from_ref(&p), "Prizes");
-        assert!(h.contains("<table>"), "the prize table was lost: {h}");
-        assert!(h.contains("30,000") && h.contains("15,000"), "{h}");
-        let (tables, consumed) = tables(&p.blocks);
-        assert!(consumed.iter().all(|used| *used), "ordinary table continuations stay in their cells");
-        let cells: Vec<&str> = tables.iter().flat_map(|t| &t.rows).flatten().map(|c| c.text.as_str()).collect();
-        assert!(["st", "nd", "rd", "th"].iter().all(|suffix| cells.contains(suffix)));
-    }
-
-    #[test]
-    fn two_column_body_text_is_not_mistaken_for_a_table() {
-        let para = |t: &str, x: f64, y: f64| Block {
-            text: t.into(),
-            rect: [x, y, x + 200.0, y + 90.0], // nine lines tall: body text, not a cell
-            size: 11.0,
-            bold: false,
-            italic: false,
-            color: [0.0; 3],
-            rotation: 0.0,
-        };
-        let p = Page {
-            width: 612.0,
-            height: 792.0,
-            blocks: vec![
-                para("Left column text of the page, long enough to be a flowing paragraph.", 72.0, 500.0),
-                para("Right column text of the page, long enough to be a flowing paragraph.", 320.0, 500.0),
-                para("Second left block, still a tall flowing paragraph rather than a cell.", 72.0, 400.0),
-                para("Second right block, still a tall flowing paragraph rather than a cell.", 320.0, 400.0),
-            ],
-            images: Vec::new(),
-            background: None,
-        };
-        let h = html(&[p], "Paper");
-        assert!(!h.contains("<table>"), "tall two-column text must stay paragraphs: {h}");
-    }
-
-    /// #1936: every picture Word is told to draw (`r:embed`) names a relationship whose target is a
-    /// file in the package, with a content type; JPEG pictures too, inline or placed.
-    #[test]
-    fn word_pictures_resolve_to_media_in_the_package() {
-        let jpeg = Image { ext: "jpg", bytes: [0xFF, 0xD8, 0xFF, 0xD9].as_slice().into(), ..page().images[0].clone() };
-        for placed in [false, true] {
-            let mut p = page();
-            p.images = vec![jpeg.clone()];
-            if placed {
-                p.images[0].rect = [72.0, 640.0, 272.0, 790.0];
-                p.blocks[0].rect = [72.0, 700.0, 300.0, 760.0];
-            }
-            let zip = docx(&[p], "T");
-            let xml = part(&zip, "word/document.xml");
-            assert_eq!(xml.contains("<wp:anchor "), placed, "{xml}");
-            let rels = part(&zip, "word/_rels/document.xml.rels");
-            let embed = xml.split("r:embed=\"").nth(1).and_then(|r| r.split('"').next()).unwrap();
-            let rel = rels.split(&format!("Id=\"{embed}\"")).nth(1).unwrap();
-            assert!(rel.contains("relationships/image\""), "{rels}");
-            let target = rel.split("Target=\"").nth(1).and_then(|t| t.split('"').next()).unwrap();
-            assert_eq!(target, "media/image1.jpg");
-            assert!(zip.windows(21).any(|w| w == b"word/media/image1.jpg"));
-            assert!(part(&zip, "[Content_Types].xml").contains("Extension=\"jpg\" ContentType=\"image/jpeg\""));
-            assert!(xml.matches("<wp:docPr ").count() == 1 && !xml.contains("<v:imagedata"));
-        }
-    }
-
-    #[test]
-    fn word_export_bounds_the_number_of_pictures_and_skips_empty_ones() {
-        let mut p = page();
-        let one = p.images[0].clone();
-        p.images = vec![Image { bytes: [].as_slice().into(), ..one.clone() }];
-        p.images.extend(std::iter::repeat_n(one, MAX_MEDIA + 10));
-        let zip = docx(&[p], "T");
-        let rels = part(&zip, "word/_rels/document.xml.rels");
-        assert_eq!(rels.matches("relationships/image\"").count(), MAX_MEDIA);
-    }
-}
+mod tests;
diff --git a/crates/export/src/pptx.rs b/crates/export/src/pptx.rs
index 886a4bdbde..49765000d3 100644
--- a/crates/export/src/pptx.rs
+++ b/crates/export/src/pptx.rs
@@ -1,11 +1,12 @@
 //! PowerPoint presentation (.pptx, Office Open XML PresentationML): slides per page,
 //! largest text as slide title, remaining paragraphs as body text, images and tables between them.
 
-use crate::{Block, Image, Page, Table, Zip, esc, hex};
+use crate::{Image, Page, Run, Table, Zip, esc, hex};
 
 /// Items on a slide in reading order.
 enum SlideBodyItem<'a> {
-    Para(&'a Block),
+    /// A paragraph's runs (at least one).
+    Para(Vec<Run<'a>>),
     Table(Table),
     Img(&'a Image),
 }
@@ -136,11 +137,11 @@ pub fn pptx(pages: &[Page], title: &str) -> Vec<u8> {
             .map(|(i, _)| i);
 
         let mut items: Vec<(f64, f64, SlideBodyItem)> = Vec::new();
-        for (bi, b) in p.blocks.iter().enumerate() {
-            if Some(bi) == title_idx || consumed.get(bi).copied().unwrap_or(false) {
-                continue;
-            }
-            items.push((b.rect[3], b.rect[0], SlideBodyItem::Para(b)));
+        // The title is a shape of its own, so it joins no paragraph.
+        let skip: Vec<bool> = (0..p.blocks.len()).map(|bi| Some(bi) == title_idx || consumed.get(bi).copied().unwrap_or(false)).collect();
+        for runs in crate::paragraphs(&p.blocks, &skip) {
+            let Some(first) = runs.first().map(|r| r.block) else { continue };
+            items.push((first.rect[3], first.rect[0], SlideBodyItem::Para(runs)));
         }
         for t in tables {
             items.push((t.rect[3], t.rect[0], SlideBodyItem::Table(t)));
@@ -173,11 +174,16 @@ pub fn pptx(pages: &[Page], title: &str) -> Vec<u8> {
                 SlideBodyItem::Para(_) => {
                     let mut paras_xml = String::new();
                     let mut est_h_pt = 0.0;
-                    while let Some((_, _, SlideBodyItem::Para(b))) = items.get(i) {
-                        let run = run_drawingml(&b.text, b.size, b.bold, b.italic, b.color);
-                        paras_xml.push_str(&format!("<a:p>{run}</a:p>"));
-                        let lines = (b.text.len() as f64 / 60.0).ceil().max(1.0);
-                        est_h_pt += (b.size.max(10.0) * 1.3) * lines + 6.0;
+                    while let Some((_, _, SlideBodyItem::Para(runs))) = items.get(i) {
+                        paras_xml.push_str("<a:p>");
+                        for r in runs {
+                            paras_xml.push_str(&run_drawingml(&r.text, r.block.size, r.block.bold, r.block.italic, r.block.color));
+                        }
+                        paras_xml.push_str("</a:p>");
+                        let len = runs.iter().map(|r| r.text.len()).fold(0usize, usize::saturating_add);
+                        let size = runs.iter().map(|r| r.block.size).fold(10.0, f64::max);
+                        let lines = (len as f64 / 60.0).ceil().max(1.0);
+                        est_h_pt += (size * 1.3) * lines + 6.0;
                         i += 1;
                     }
                     let box_h = height_emu(est_h_pt);
@@ -352,390 +358,4 @@ xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\" type=\"blank\"
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::tests::part;
-
-    fn sample_page() -> Page {
-        Page {
-            width: 720.0,
-            height: 540.0,
-            blocks: vec![
-                Block {
-                    text: "Q3 Business Update".into(),
-                    rect: [72.0, 460.0, 500.0, 500.0],
-                    size: 28.0,
-                    bold: true,
-                    italic: false,
-                    color: [0.1, 0.2, 0.3],
-                    rotation: 0.0,
-                },
-                Block {
-                    text: "Revenue grew 25% year over year across all regions.".into(),
-                    rect: [72.0, 380.0, 500.0, 410.0],
-                    size: 14.0,
-                    bold: false,
-                    italic: false,
-                    color: [0.0; 3],
-                    rotation: 0.0,
-                },
-                Block {
-                    text: "Operational expenses remained flat.".into(),
-                    rect: [72.0, 340.0, 500.0, 370.0],
-                    size: 14.0,
-                    bold: false,
-                    italic: true,
-                    color: [0.0; 3],
-                    rotation: 0.0,
-                },
-            ],
-            images: vec![Image {
-                ext: "png",
-                bytes: b"\x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\0\x02\0\0\0\x03".as_slice().into(),
-                rect: [72.0, 150.0, 300.0, 300.0],
-                size: [228.0, 150.0],
-                rotation: 0.0,
-            }],
-            background: None,
-        }
-    }
-
-    #[test]
-    pub fn pptx_is_a_presentationml_package() {
-        let p = sample_page();
-        let bytes = pptx(&[p], "Executive Deck");
-        assert!(bytes.starts_with(b"PK"));
-        for part_name in [
-            "[Content_Types].xml",
-            "_rels/.rels",
-            "docProps/core.xml",
-            "ppt/presentation.xml",
-            "ppt/_rels/presentation.xml.rels",
-            "ppt/slideMasters/slideMaster1.xml",
-            "ppt/slideMasters/_rels/slideMaster1.xml.rels",
-            "ppt/slideLayouts/slideLayout1.xml",
-            "ppt/slideLayouts/_rels/slideLayout1.xml.rels",
-            "ppt/theme/theme1.xml",
-            "ppt/slides/slide1.xml",
-            "ppt/slides/_rels/slide1.xml.rels",
-            "ppt/media/image1.png",
-        ] {
-            assert!(bytes.windows(part_name.len()).any(|w| w == part_name.as_bytes()), "missing {part_name}");
-        }
-    }
-
-    #[test]
-    pub fn pptx_slide_has_title_body_and_images_in_order() {
-        let p = sample_page();
-        let bytes = pptx(&[p], "Deck");
-        let slide_xml = part(&bytes, "ppt/slides/slide1.xml");
-        assert!(slide_xml.contains("name=\"Title 2\""));
-        assert!(slide_xml.contains("txBox=\"1\""));
-        assert!(slide_xml.contains("Q3 Business Update"));
-        assert!(slide_xml.contains("name=\"TextBox 3\""));
-        assert!(slide_xml.contains("Revenue grew 25%"));
-        assert!(slide_xml.contains("<p:pic>"));
-        assert!(slide_xml.contains("<a:blip r:embed=\"rIdImg1\"/>"));
-        assert!(!slide_xml.contains("<p:ph"), "pure text boxes avoid placeholder inheritance repair warnings: {slide_xml}");
-
-        let rels_xml = part(&bytes, "ppt/slides/_rels/slide1.xml.rels");
-        assert!(rels_xml.contains("Target=\"../media/image1.png\""));
-        assert!(rels_xml.contains("Target=\"../slideLayouts/slideLayout1.xml\""));
-    }
-
-    #[test]
-    pub fn pptx_text_colour_and_formatting() {
-        let p = sample_page();
-        let bytes = pptx(&[p], "Deck");
-        let slide_xml = part(&bytes, "ppt/slides/slide1.xml");
-        assert!(slide_xml.contains("sz=\"2800\""));
-        assert!(slide_xml.contains("b=\"1\""));
-        assert!(slide_xml.contains("<a:srgbClr val=\"1A334D\"/>"));
-        assert!(slide_xml.contains("i=\"1\""));
-    }
-
-    /// Every entry of the package in order: (name, uncompressed bytes), read from the local
-    /// headers the way an unzipper walks them, so a broken structure fails here.
-    fn entries(zip: &[u8]) -> Vec<(String, Vec<u8>)> {
-        let at = |i: usize, n: usize| zip[i..i + n].iter().rev().fold(0usize, |v, b| v << 8 | *b as usize);
-        let mut out = Vec::new();
-        let mut i = 0;
-        while zip[i..].starts_with(b"PK\x03\x04") {
-            let (method, size, raw, name_len, extra) = (at(i + 8, 2), at(i + 18, 4), at(i + 22, 4), at(i + 26, 2), at(i + 28, 2));
-            let data = i + 30 + name_len + extra;
-            let name = String::from_utf8(zip[i + 30..i + 30 + name_len].to_vec()).expect("UTF-8 name");
-            let body = &zip[data..data + size];
-            let bytes = match method {
-                0 => body.to_vec(),
-                8 => {
-                    let mut v = Vec::new();
-                    std::io::Read::read_to_end(&mut flate2::read::DeflateDecoder::new(body), &mut v).expect("inflates");
-                    v
-                }
-                m => panic!("{name}: unexpected method {m}"),
-            };
-            assert_eq!(bytes.len(), raw, "{name}: uncompressed size");
-            out.push((name, bytes));
-            i = data + size;
-        }
-        assert!(zip[i..].starts_with(b"PK\x01\x02"), "the central directory follows the entries");
-        out
-    }
-
-    /// Checks that every start tag is closed by the matching end tag (text is escaped, so a
-    /// `<` always starts markup). Catches a typo such as `<a:lnR>…</a:lnL>`.
-    fn assert_tags_balance(name: &str, xml: &str) {
-        let mut stack: Vec<&str> = Vec::new();
-        for chunk in xml.split('<').skip(1) {
-            let tag = chunk.split('>').next().unwrap_or_default();
-            if tag.starts_with('?') {
-                continue;
-            }
-            if let Some(close) = tag.strip_prefix('/') {
-                assert_eq!(stack.pop(), Some(close.trim()), "{name}: </{close}> closes the wrong element");
-            } else if !tag.ends_with('/') {
-                stack.push(tag.split_whitespace().next().unwrap_or_default());
-            }
-        }
-        assert!(stack.is_empty(), "{name}: unclosed {stack:?}");
-    }
-
-    #[test]
-    fn pptx_package_parts_are_complete_and_consistent() {
-        let cell = |t: &str, x: f64, y: f64| Block {
-            text: t.into(),
-            rect: [x, y, x + 100.0, y + 14.0],
-            size: 12.0,
-            bold: false,
-            italic: false,
-            color: [0.0; 3],
-            rotation: 0.0,
-        };
-        let table_page = Page {
-            width: 612.0,
-            height: 792.0,
-            blocks: vec![
-                cell("Metric", 72.0, 400.0),
-                cell("Value", 200.0, 400.0),
-                cell("Growth", 72.0, 360.0),
-                cell("+9%", 200.0, 360.0),
-                cell("Target", 72.0, 320.0),
-                cell("100%", 200.0, 320.0),
-            ],
-            images: Vec::new(),
-            background: None,
-        };
-        let bytes = pptx(&[sample_page(), table_page], "Two");
-        let parts = entries(&bytes);
-        assert_eq!(parts.first().map(|p| p.0.as_str()), Some("[Content_Types].xml"), "content types come first");
-        let names: std::collections::HashSet<&str> = parts.iter().map(|p| p.0.as_str()).collect();
-        assert_eq!(names.len(), parts.len(), "no duplicate parts");
-        for required in [
-            "[Content_Types].xml",
-            "_rels/.rels",
-            "ppt/presentation.xml",
-            "ppt/_rels/presentation.xml.rels",
-            "ppt/slideMasters/slideMaster1.xml",
-            "ppt/slideMasters/_rels/slideMaster1.xml.rels",
-            "ppt/slideLayouts/slideLayout1.xml",
-            "ppt/slideLayouts/_rels/slideLayout1.xml.rels",
-            "ppt/theme/theme1.xml",
-            "ppt/slides/slide1.xml",
-            "ppt/slides/_rels/slide1.xml.rels",
-            "ppt/slides/slide2.xml",
-            "ppt/slides/_rels/slide2.xml.rels",
-            "ppt/media/image1.png",
-        ] {
-            assert!(names.contains(required), "missing {required}");
-        }
-        let text = |n: &str| String::from_utf8(parts.iter().find(|p| p.0 == n).map(|p| p.1.clone()).unwrap_or_default()).expect("UTF-8 XML");
-        for (name, body) in &parts {
-            if name.ends_with(".xml") || name.ends_with(".rels") {
-                assert!(body.starts_with(b"<?xml"), "{name} is XML");
-                assert_tags_balance(name, &text(name));
-            }
-        }
-        assert!(text("ppt/slides/slide2.xml").contains("<a:tbl>"), "the second slide carries the table");
-        // Text boxes, not placeholders: the blank layout defines none to inherit from.
-        for slide in ["ppt/slides/slide1.xml", "ppt/slides/slide2.xml"] {
-            assert!(!text(slide).contains("<p:ph"), "{slide} uses no placeholders");
-        }
-        // Every override names a part that exists, and every XML part has a content type.
-        let types = text("[Content_Types].xml");
-        for chunk in types.split("PartName=\"/").skip(1) {
-            let part = chunk.split('"').next().unwrap_or_default();
-            assert!(names.contains(part), "override for missing part {part}");
-        }
-        for slide in ["ppt/slides/slide1.xml", "ppt/slides/slide2.xml", "ppt/presentation.xml", "ppt/theme/theme1.xml"] {
-            assert!(types.contains(&format!("PartName=\"/{slide}\"")), "{slide} has a content type");
-        }
-        // Relationship targets resolve to parts in the package.
-        for (rels, base) in [
-            ("_rels/.rels", ""),
-            ("ppt/_rels/presentation.xml.rels", "ppt/"),
-            ("ppt/slides/_rels/slide1.xml.rels", "ppt/slides/"),
-            ("ppt/slides/_rels/slide2.xml.rels", "ppt/slides/"),
-            ("ppt/slideMasters/_rels/slideMaster1.xml.rels", "ppt/slideMasters/"),
-            ("ppt/slideLayouts/_rels/slideLayout1.xml.rels", "ppt/slideLayouts/"),
-        ] {
-            for chunk in text(rels).split("Target=\"").skip(1) {
-                let target = chunk.split('"').next().unwrap_or_default();
-                let mut path: Vec<&str> = base.split('/').filter(|s| !s.is_empty()).collect();
-                for seg in target.split('/') {
-                    if seg == ".." {
-                        path.pop();
-                    } else {
-                        path.push(seg);
-                    }
-                }
-                let resolved = path.join("/");
-                assert!(names.contains(resolved.as_str()), "{rels}: target {target} is missing");
-            }
-        }
-        // The theme's font scheme carries the schema-required latin, ea and cs faces.
-        let theme = text("ppt/theme/theme1.xml");
-        for font in ["majorFont", "minorFont"] {
-            let inner = theme.split(&format!("<a:{font}>")).nth(1).and_then(|r| r.split(&format!("</a:{font}>")).next()).unwrap_or_default();
-            assert!(inner.contains("<a:latin ") && inner.contains("<a:ea ") && inner.contains("<a:cs "), "{font}: {inner}");
-        }
-        assert!(text("ppt/presentation.xml").contains("r:id=\"rIdSld2\""));
-    }
-
-    #[test]
-    fn hostile_sizes_do_not_overflow_the_slide_position() {
-        let huge = |text: &str, size: f64, y: f64| Block {
-            text: text.into(),
-            rect: [72.0, y, 500.0, y + 10.0],
-            size,
-            bold: false,
-            italic: false,
-            color: [0.0; 3],
-            rotation: 0.0,
-        };
-        let mut blocks = vec![huge("Title", f64::MAX, 500.0)];
-        for k in 0..40 {
-            blocks.push(huge(&"word ".repeat(10_000), 1e300, 400.0 - k as f64));
-            blocks.push(huge("nan", f64::NAN, 300.0 - k as f64));
-            blocks.push(huge("inf", f64::INFINITY, 200.0 - k as f64));
-        }
-        let images = (0..40)
-            .map(|k| Image {
-                ext: "png",
-                bytes: [0; 4].as_slice().into(),
-                rect: [0.0, -1e300, 1e-300, 1e300 - k as f64],
-                size: [1.0, 1.0],
-                rotation: 0.0,
-            })
-            .collect();
-        let p = Page { width: f64::MAX, height: f64::NAN, blocks, images, background: None };
-        let bytes = pptx(&[p], "Hostile");
-        let slide = part(&bytes, "ppt/slides/slide1.xml");
-        assert!(slide.contains("Title") && slide.contains("<p:pic>"), "the slide is still written");
-        assert!(!slide.contains("y=\"-"), "positions never wrap negative");
-        assert!(!slide.contains("<p:ph"), "text boxes, not placeholders");
-    }
-
-    #[test]
-    pub fn pptx_empty_pages_produce_valid_slide() {
-        let bytes = pptx(&[], "Blank");
-        assert!(bytes.starts_with(b"PK"));
-        let pres_xml = part(&bytes, "ppt/presentation.xml");
-        assert!(pres_xml.contains("<p:sldId id=\"256\" r:id=\"rIdSld1\"/>"));
-        let slide_xml = part(&bytes, "ppt/slides/slide1.xml");
-        assert!(slide_xml.contains("<p:spTree>"));
-    }
-
-    #[test]
-    fn pptx_slide_dimensions_and_clamping() {
-        // Known dimensions: 720x540 pt (10x7.5 in) = 9144000x6858000 EMU
-        let p = Page { width: 720.0, height: 540.0, ..Page::default() };
-        let bytes = pptx(&[p], "Known Dimensions");
-        let pres_xml = part(&bytes, "ppt/presentation.xml");
-        assert!(pres_xml.contains("<p:sldSz cx=\"9144000\" cy=\"6858000\"/>"), "{pres_xml}");
-
-        // Tiny page (10x10 pt) clamps to PowerPoint minimum of 1 inch (914400 EMU)
-        let tiny = Page { width: 10.0, height: 10.0, ..Page::default() };
-        let tiny_bytes = pptx(&[tiny], "Tiny");
-        let tiny_pres = part(&tiny_bytes, "ppt/presentation.xml");
-        assert!(tiny_pres.contains("<p:sldSz cx=\"914400\" cy=\"914400\"/>"), "{tiny_pres}");
-
-        // Poster page (10000x10000 pt) clamps to PowerPoint maximum of 56 inches (51206400 EMU)
-        let poster = Page { width: 10_000.0, height: 10_000.0, ..Page::default() };
-        let poster_bytes = pptx(&[poster], "Poster");
-        let poster_pres = part(&poster_bytes, "ppt/presentation.xml");
-        assert!(poster_pres.contains("<p:sldSz cx=\"51206400\" cy=\"51206400\"/>"), "{poster_pres}");
-
-        // Non-finite dimensions fall back to default
-        let nan_page = Page { width: f64::NAN, height: -1.0, ..Page::default() };
-        let nan_bytes = pptx(&[nan_page], "NaN");
-        let nan_pres = part(&nan_bytes, "ppt/presentation.xml");
-        assert!(nan_pres.contains("<p:sldSz cx=\"9144000\" cy=\"6858000\"/>"), "{nan_pres}");
-    }
-
-    #[test]
-    fn pptx_table_cell_with_largest_font_stays_in_table_and_not_in_title() {
-        let cell = |t: &str, x: f64, y: f64, w: f64, sz: f64| Block {
-            text: t.into(),
-            rect: [x, y, x + w, y + 14.0],
-            size: sz,
-            bold: false,
-            italic: false,
-            color: [0.0; 3],
-            rotation: 0.0,
-        };
-        let p = Page {
-            width: 720.0,
-            height: 540.0,
-            blocks: vec![
-                // Heading outside the table (short width, does not span table columns)
-                Block {
-                    text: "Monthly Summary".into(),
-                    rect: [50.0, 480.0, 150.0, 500.0],
-                    size: 20.0,
-                    bold: true,
-                    italic: false,
-                    color: [0.0; 3],
-                    rotation: 0.0,
-                },
-                // Table where one cell has a very large number (e.g. 36 pt callout in the table)
-                cell("Metric", 72.0, 400.0, 100.0, 12.0),
-                cell("Value", 200.0, 400.0, 100.0, 12.0),
-                cell("Growth", 72.0, 360.0, 100.0, 12.0),
-                cell("+99%", 200.0, 360.0, 100.0, 36.0),
-                cell("Target", 72.0, 320.0, 100.0, 12.0),
-                cell("100%", 200.0, 320.0, 100.0, 12.0),
-            ],
-            images: Vec::new(),
-            background: None,
-        };
-        let bytes = pptx(&[p], "Table Check");
-        let slide_xml = part(&bytes, "ppt/slides/slide1.xml");
-        // Title should be the block outside the table ("Monthly Summary"), not the "+99%" cell
-        assert!(slide_xml.contains("Monthly Summary"));
-        assert!(slide_xml.contains("name=\"Title 2\""));
-        // The table must contain both the cell and explicit borders
-        assert!(slide_xml.contains("<a:tbl>"));
-        assert!(slide_xml.contains("+99%"));
-        assert!(slide_xml.contains("<a:tcPr><a:lnL w=\"12700\" cmpd=\"s\">"));
-    }
-
-    #[test]
-    fn pptx_opens_in_libreoffice() {
-        let p = sample_page();
-        let bytes = pptx(&[p], "LibreOffice Check");
-        let dir = std::env::temp_dir().join(format!("pdfcraft-pptx-lo-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        let _ = std::fs::create_dir_all(&dir);
-        let pptx_path = dir.join("test.pptx");
-        std::fs::write(&pptx_path, &bytes).unwrap();
-
-        for cmd in ["libreoffice", "soffice"] {
-            let status = std::process::Command::new(cmd).args(["--headless", "--convert-to", "pdf", "--outdir"]).arg(&dir).arg(&pptx_path).status();
-            if status.is_ok_and(|st| st.success()) {
-                assert!(dir.join("test.pdf").is_file(), "LibreOffice produced test.pdf");
-                break;
-            }
-        }
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}
+mod tests;
diff --git a/crates/export/src/pptx/tests.rs b/crates/export/src/pptx/tests.rs
new file mode 100644
index 0000000000..2e1c1bd046
--- /dev/null
+++ b/crates/export/src/pptx/tests.rs
@@ -0,0 +1,393 @@
+use super::*;
+use crate::Block;
+use crate::tests::part;
+
+fn sample_page() -> Page {
+    Page {
+        width: 720.0,
+        height: 540.0,
+        blocks: vec![
+            Block {
+                text: "Q3 Business Update".into(),
+                rect: [72.0, 460.0, 500.0, 500.0],
+                size: 28.0,
+                bold: true,
+                italic: false,
+                color: [0.1, 0.2, 0.3],
+                rotation: 0.0,
+                space_around: [false; 2],
+            },
+            Block {
+                text: "Revenue grew 25% year over year across all regions.".into(),
+                rect: [72.0, 380.0, 500.0, 410.0],
+                size: 14.0,
+                bold: false,
+                italic: false,
+                color: [0.0; 3],
+                rotation: 0.0,
+                space_around: [false; 2],
+            },
+            Block {
+                text: "Operational expenses remained flat.".into(),
+                rect: [72.0, 340.0, 500.0, 370.0],
+                size: 14.0,
+                bold: false,
+                italic: true,
+                color: [0.0; 3],
+                rotation: 0.0,
+                space_around: [false; 2],
+            },
+        ],
+        images: vec![Image {
+            ext: "png",
+            bytes: b"\x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\0\x02\0\0\0\x03".as_slice().into(),
+            rect: [72.0, 150.0, 300.0, 300.0],
+            size: [228.0, 150.0],
+            rotation: 0.0,
+        }],
+        background: None,
+    }
+}
+
+#[test]
+pub fn pptx_is_a_presentationml_package() {
+    let p = sample_page();
+    let bytes = pptx(&[p], "Executive Deck");
+    assert!(bytes.starts_with(b"PK"));
+    for part_name in [
+        "[Content_Types].xml",
+        "_rels/.rels",
+        "docProps/core.xml",
+        "ppt/presentation.xml",
+        "ppt/_rels/presentation.xml.rels",
+        "ppt/slideMasters/slideMaster1.xml",
+        "ppt/slideMasters/_rels/slideMaster1.xml.rels",
+        "ppt/slideLayouts/slideLayout1.xml",
+        "ppt/slideLayouts/_rels/slideLayout1.xml.rels",
+        "ppt/theme/theme1.xml",
+        "ppt/slides/slide1.xml",
+        "ppt/slides/_rels/slide1.xml.rels",
+        "ppt/media/image1.png",
+    ] {
+        assert!(bytes.windows(part_name.len()).any(|w| w == part_name.as_bytes()), "missing {part_name}");
+    }
+}
+
+#[test]
+pub fn pptx_slide_has_title_body_and_images_in_order() {
+    let p = sample_page();
+    let bytes = pptx(&[p], "Deck");
+    let slide_xml = part(&bytes, "ppt/slides/slide1.xml");
+    assert!(slide_xml.contains("name=\"Title 2\""));
+    assert!(slide_xml.contains("txBox=\"1\""));
+    assert!(slide_xml.contains("Q3 Business Update"));
+    assert!(slide_xml.contains("name=\"TextBox 3\""));
+    assert!(slide_xml.contains("Revenue grew 25%"));
+    assert!(slide_xml.contains("<p:pic>"));
+    assert!(slide_xml.contains("<a:blip r:embed=\"rIdImg1\"/>"));
+    assert!(!slide_xml.contains("<p:ph"), "pure text boxes avoid placeholder inheritance repair warnings: {slide_xml}");
+
+    let rels_xml = part(&bytes, "ppt/slides/_rels/slide1.xml.rels");
+    assert!(rels_xml.contains("Target=\"../media/image1.png\""));
+    assert!(rels_xml.contains("Target=\"../slideLayouts/slideLayout1.xml\""));
+}
+
+#[test]
+pub fn pptx_text_colour_and_formatting() {
+    let p = sample_page();
+    let bytes = pptx(&[p], "Deck");
+    let slide_xml = part(&bytes, "ppt/slides/slide1.xml");
+    assert!(slide_xml.contains("sz=\"2800\""));
+    assert!(slide_xml.contains("b=\"1\""));
+    assert!(slide_xml.contains("<a:srgbClr val=\"1A334D\"/>"));
+    assert!(slide_xml.contains("i=\"1\""));
+}
+
+/// Every entry of the package in order: (name, uncompressed bytes), read from the local
+/// headers the way an unzipper walks them, so a broken structure fails here.
+fn entries(zip: &[u8]) -> Vec<(String, Vec<u8>)> {
+    let at = |i: usize, n: usize| zip[i..i + n].iter().rev().fold(0usize, |v, b| v << 8 | *b as usize);
+    let mut out = Vec::new();
+    let mut i = 0;
+    while zip[i..].starts_with(b"PK\x03\x04") {
+        let (method, size, raw, name_len, extra) = (at(i + 8, 2), at(i + 18, 4), at(i + 22, 4), at(i + 26, 2), at(i + 28, 2));
+        let data = i + 30 + name_len + extra;
+        let name = String::from_utf8(zip[i + 30..i + 30 + name_len].to_vec()).expect("UTF-8 name");
+        let body = &zip[data..data + size];
+        let bytes = match method {
+            0 => body.to_vec(),
+            8 => {
+                let mut v = Vec::new();
+                std::io::Read::read_to_end(&mut flate2::read::DeflateDecoder::new(body), &mut v).expect("inflates");
+                v
+            }
+            m => panic!("{name}: unexpected method {m}"),
+        };
+        assert_eq!(bytes.len(), raw, "{name}: uncompressed size");
+        out.push((name, bytes));
+        i = data + size;
+    }
+    assert!(zip[i..].starts_with(b"PK\x01\x02"), "the central directory follows the entries");
+    out
+}
+
+/// Checks that every start tag is closed by the matching end tag (text is escaped, so a
+/// `<` always starts markup). Catches a typo such as `<a:lnR>…</a:lnL>`.
+fn assert_tags_balance(name: &str, xml: &str) {
+    let mut stack: Vec<&str> = Vec::new();
+    for chunk in xml.split('<').skip(1) {
+        let tag = chunk.split('>').next().unwrap_or_default();
+        if tag.starts_with('?') {
+            continue;
+        }
+        if let Some(close) = tag.strip_prefix('/') {
+            assert_eq!(stack.pop(), Some(close.trim()), "{name}: </{close}> closes the wrong element");
+        } else if !tag.ends_with('/') {
+            stack.push(tag.split_whitespace().next().unwrap_or_default());
+        }
+    }
+    assert!(stack.is_empty(), "{name}: unclosed {stack:?}");
+}
+
+#[test]
+fn pptx_package_parts_are_complete_and_consistent() {
+    let cell = |t: &str, x: f64, y: f64| Block {
+        text: t.into(),
+        rect: [x, y, x + 100.0, y + 14.0],
+        size: 12.0,
+        bold: false,
+        italic: false,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    };
+    let table_page = Page {
+        width: 612.0,
+        height: 792.0,
+        blocks: vec![
+            cell("Metric", 72.0, 400.0),
+            cell("Value", 200.0, 400.0),
+            cell("Growth", 72.0, 360.0),
+            cell("+9%", 200.0, 360.0),
+            cell("Target", 72.0, 320.0),
+            cell("100%", 200.0, 320.0),
+        ],
+        images: Vec::new(),
+        background: None,
+    };
+    let bytes = pptx(&[sample_page(), table_page], "Two");
+    let parts = entries(&bytes);
+    assert_eq!(parts.first().map(|p| p.0.as_str()), Some("[Content_Types].xml"), "content types come first");
+    let names: std::collections::HashSet<&str> = parts.iter().map(|p| p.0.as_str()).collect();
+    assert_eq!(names.len(), parts.len(), "no duplicate parts");
+    for required in [
+        "[Content_Types].xml",
+        "_rels/.rels",
+        "ppt/presentation.xml",
+        "ppt/_rels/presentation.xml.rels",
+        "ppt/slideMasters/slideMaster1.xml",
+        "ppt/slideMasters/_rels/slideMaster1.xml.rels",
+        "ppt/slideLayouts/slideLayout1.xml",
+        "ppt/slideLayouts/_rels/slideLayout1.xml.rels",
+        "ppt/theme/theme1.xml",
+        "ppt/slides/slide1.xml",
+        "ppt/slides/_rels/slide1.xml.rels",
+        "ppt/slides/slide2.xml",
+        "ppt/slides/_rels/slide2.xml.rels",
+        "ppt/media/image1.png",
+    ] {
+        assert!(names.contains(required), "missing {required}");
+    }
+    let text = |n: &str| String::from_utf8(parts.iter().find(|p| p.0 == n).map(|p| p.1.clone()).unwrap_or_default()).expect("UTF-8 XML");
+    for (name, body) in &parts {
+        if name.ends_with(".xml") || name.ends_with(".rels") {
+            assert!(body.starts_with(b"<?xml"), "{name} is XML");
+            assert_tags_balance(name, &text(name));
+        }
+    }
+    assert!(text("ppt/slides/slide2.xml").contains("<a:tbl>"), "the second slide carries the table");
+    // Text boxes, not placeholders: the blank layout defines none to inherit from.
+    for slide in ["ppt/slides/slide1.xml", "ppt/slides/slide2.xml"] {
+        assert!(!text(slide).contains("<p:ph"), "{slide} uses no placeholders");
+    }
+    // Every override names a part that exists, and every XML part has a content type.
+    let types = text("[Content_Types].xml");
+    for chunk in types.split("PartName=\"/").skip(1) {
+        let part = chunk.split('"').next().unwrap_or_default();
+        assert!(names.contains(part), "override for missing part {part}");
+    }
+    for slide in ["ppt/slides/slide1.xml", "ppt/slides/slide2.xml", "ppt/presentation.xml", "ppt/theme/theme1.xml"] {
+        assert!(types.contains(&format!("PartName=\"/{slide}\"")), "{slide} has a content type");
+    }
+    // Relationship targets resolve to parts in the package.
+    for (rels, base) in [
+        ("_rels/.rels", ""),
+        ("ppt/_rels/presentation.xml.rels", "ppt/"),
+        ("ppt/slides/_rels/slide1.xml.rels", "ppt/slides/"),
+        ("ppt/slides/_rels/slide2.xml.rels", "ppt/slides/"),
+        ("ppt/slideMasters/_rels/slideMaster1.xml.rels", "ppt/slideMasters/"),
+        ("ppt/slideLayouts/_rels/slideLayout1.xml.rels", "ppt/slideLayouts/"),
+    ] {
+        for chunk in text(rels).split("Target=\"").skip(1) {
+            let target = chunk.split('"').next().unwrap_or_default();
+            let mut path: Vec<&str> = base.split('/').filter(|s| !s.is_empty()).collect();
+            for seg in target.split('/') {
+                if seg == ".." {
+                    path.pop();
+                } else {
+                    path.push(seg);
+                }
+            }
+            let resolved = path.join("/");
+            assert!(names.contains(resolved.as_str()), "{rels}: target {target} is missing");
+        }
+    }
+    // The theme's font scheme carries the schema-required latin, ea and cs faces.
+    let theme = text("ppt/theme/theme1.xml");
+    for font in ["majorFont", "minorFont"] {
+        let inner = theme.split(&format!("<a:{font}>")).nth(1).and_then(|r| r.split(&format!("</a:{font}>")).next()).unwrap_or_default();
+        assert!(inner.contains("<a:latin ") && inner.contains("<a:ea ") && inner.contains("<a:cs "), "{font}: {inner}");
+    }
+    assert!(text("ppt/presentation.xml").contains("r:id=\"rIdSld2\""));
+}
+
+#[test]
+fn hostile_sizes_do_not_overflow_the_slide_position() {
+    let huge = |text: &str, size: f64, y: f64| Block {
+        text: text.into(),
+        rect: [72.0, y, 500.0, y + 10.0],
+        size,
+        bold: false,
+        italic: false,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    };
+    let mut blocks = vec![huge("Title", f64::MAX, 500.0)];
+    for k in 0..40 {
+        blocks.push(huge(&"word ".repeat(10_000), 1e300, 400.0 - k as f64));
+        blocks.push(huge("nan", f64::NAN, 300.0 - k as f64));
+        blocks.push(huge("inf", f64::INFINITY, 200.0 - k as f64));
+    }
+    let images = (0..40)
+        .map(|k| Image {
+            ext: "png",
+            bytes: [0; 4].as_slice().into(),
+            rect: [0.0, -1e300, 1e-300, 1e300 - k as f64],
+            size: [1.0, 1.0],
+            rotation: 0.0,
+        })
+        .collect();
+    let p = Page { width: f64::MAX, height: f64::NAN, blocks, images, background: None };
+    let bytes = pptx(&[p], "Hostile");
+    let slide = part(&bytes, "ppt/slides/slide1.xml");
+    assert!(slide.contains("Title") && slide.contains("<p:pic>"), "the slide is still written");
+    assert!(!slide.contains("y=\"-"), "positions never wrap negative");
+    assert!(!slide.contains("<p:ph"), "text boxes, not placeholders");
+}
+
+#[test]
+pub fn pptx_empty_pages_produce_valid_slide() {
+    let bytes = pptx(&[], "Blank");
+    assert!(bytes.starts_with(b"PK"));
+    let pres_xml = part(&bytes, "ppt/presentation.xml");
+    assert!(pres_xml.contains("<p:sldId id=\"256\" r:id=\"rIdSld1\"/>"));
+    let slide_xml = part(&bytes, "ppt/slides/slide1.xml");
+    assert!(slide_xml.contains("<p:spTree>"));
+}
+
+#[test]
+fn pptx_slide_dimensions_and_clamping() {
+    // Known dimensions: 720x540 pt (10x7.5 in) = 9144000x6858000 EMU
+    let p = Page { width: 720.0, height: 540.0, ..Page::default() };
+    let bytes = pptx(&[p], "Known Dimensions");
+    let pres_xml = part(&bytes, "ppt/presentation.xml");
+    assert!(pres_xml.contains("<p:sldSz cx=\"9144000\" cy=\"6858000\"/>"), "{pres_xml}");
+
+    // Tiny page (10x10 pt) clamps to PowerPoint minimum of 1 inch (914400 EMU)
+    let tiny = Page { width: 10.0, height: 10.0, ..Page::default() };
+    let tiny_bytes = pptx(&[tiny], "Tiny");
+    let tiny_pres = part(&tiny_bytes, "ppt/presentation.xml");
+    assert!(tiny_pres.contains("<p:sldSz cx=\"914400\" cy=\"914400\"/>"), "{tiny_pres}");
+
+    // Poster page (10000x10000 pt) clamps to PowerPoint maximum of 56 inches (51206400 EMU)
+    let poster = Page { width: 10_000.0, height: 10_000.0, ..Page::default() };
+    let poster_bytes = pptx(&[poster], "Poster");
+    let poster_pres = part(&poster_bytes, "ppt/presentation.xml");
+    assert!(poster_pres.contains("<p:sldSz cx=\"51206400\" cy=\"51206400\"/>"), "{poster_pres}");
+
+    // Non-finite dimensions fall back to default
+    let nan_page = Page { width: f64::NAN, height: -1.0, ..Page::default() };
+    let nan_bytes = pptx(&[nan_page], "NaN");
+    let nan_pres = part(&nan_bytes, "ppt/presentation.xml");
+    assert!(nan_pres.contains("<p:sldSz cx=\"9144000\" cy=\"6858000\"/>"), "{nan_pres}");
+}
+
+#[test]
+fn pptx_table_cell_with_largest_font_stays_in_table_and_not_in_title() {
+    let cell = |t: &str, x: f64, y: f64, w: f64, sz: f64| Block {
+        text: t.into(),
+        rect: [x, y, x + w, y + 14.0],
+        size: sz,
+        bold: false,
+        italic: false,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    };
+    let p = Page {
+        width: 720.0,
+        height: 540.0,
+        blocks: vec![
+            // Heading outside the table (short width, does not span table columns)
+            Block {
+                text: "Monthly Summary".into(),
+                rect: [50.0, 480.0, 150.0, 500.0],
+                size: 20.0,
+                bold: true,
+                italic: false,
+                color: [0.0; 3],
+                rotation: 0.0,
+                space_around: [false; 2],
+            },
+            // Table where one cell has a very large number (e.g. 36 pt callout in the table)
+            cell("Metric", 72.0, 400.0, 100.0, 12.0),
+            cell("Value", 200.0, 400.0, 100.0, 12.0),
+            cell("Growth", 72.0, 360.0, 100.0, 12.0),
+            cell("+99%", 200.0, 360.0, 100.0, 36.0),
+            cell("Target", 72.0, 320.0, 100.0, 12.0),
+            cell("100%", 200.0, 320.0, 100.0, 12.0),
+        ],
+        images: Vec::new(),
+        background: None,
+    };
+    let bytes = pptx(&[p], "Table Check");
+    let slide_xml = part(&bytes, "ppt/slides/slide1.xml");
+    // Title should be the block outside the table ("Monthly Summary"), not the "+99%" cell
+    assert!(slide_xml.contains("Monthly Summary"));
+    assert!(slide_xml.contains("name=\"Title 2\""));
+    // The table must contain both the cell and explicit borders
+    assert!(slide_xml.contains("<a:tbl>"));
+    assert!(slide_xml.contains("+99%"));
+    assert!(slide_xml.contains("<a:tcPr><a:lnL w=\"12700\" cmpd=\"s\">"));
+}
+
+#[test]
+fn pptx_opens_in_libreoffice() {
+    let p = sample_page();
+    let bytes = pptx(&[p], "LibreOffice Check");
+    let dir = std::env::temp_dir().join(format!("pdfcraft-pptx-lo-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let _ = std::fs::create_dir_all(&dir);
+    let pptx_path = dir.join("test.pptx");
+    std::fs::write(&pptx_path, &bytes).unwrap();
+
+    for cmd in ["libreoffice", "soffice"] {
+        let status = std::process::Command::new(cmd).args(["--headless", "--convert-to", "pdf", "--outdir"]).arg(&dir).arg(&pptx_path).status();
+        if status.is_ok_and(|st| st.success()) {
+            assert!(dir.join("test.pdf").is_file(), "LibreOffice produced test.pdf");
+            break;
+        }
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/export/src/tests.rs b/crates/export/src/tests.rs
new file mode 100644
index 0000000000..d735eb4c20
--- /dev/null
+++ b/crates/export/src/tests.rs
@@ -0,0 +1,771 @@
+use super::*;
+
+/// A page of `n` one-word blocks, each in its own size and colour.
+fn varied_page(n: usize) -> Page {
+    let blocks = (0..n)
+        .map(|i| Block {
+            text: "word".into(),
+            rect: [72.0, i as f64, 100.0, i as f64 + 1.0],
+            size: 4.0 + i as f64 * 0.5,
+            bold: false,
+            italic: false,
+            color: [(i % 256) as f64 / 255.0, (i / 256 % 256) as f64 / 255.0, 0.5],
+            rotation: 0.0,
+            space_around: [false; 2],
+        })
+        .collect();
+    Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None }
+}
+
+fn lookup_steps(f: impl FnOnce()) -> usize {
+    LOOKUP_STEPS.with(|c| c.set(0));
+    f();
+    LOOKUP_STEPS.with(|c| c.get())
+}
+
+#[test]
+fn many_distinct_sizes_are_counted_in_constant_steps_each() {
+    let pages = [varied_page(3000)];
+    let steps = lookup_steps(|| {
+        body_size(&pages);
+    });
+    assert!(steps <= 2 * 3000, "{steps} steps");
+}
+
+#[test]
+fn many_distinct_colours_take_constant_steps_each() {
+    let pages = [varied_page(3000)];
+    let mut out = String::new();
+    let steps = lookup_steps(|| out = rtf(&pages));
+    assert!(steps <= 4 * 3000, "{steps} steps");
+    assert!(out.contains("\\cf3000 ") || out.contains("\\cf3000\\"), "the last colour has the last slot");
+}
+
+fn page() -> Page {
+    let b = |t: &str, y: f64, size: f64, bold: bool| Block {
+        text: t.into(),
+        rect: [72.0, y, 500.0, y + size],
+        size,
+        bold,
+        italic: false,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    };
+    Page {
+        width: 612.0,
+        height: 792.0,
+        blocks: vec![
+            b("Body text after the picture, which is long enough to be the main text size of the page.", 400.0, 11.0, false),
+            b("Annual Report", 700.0, 24.0, true),
+            b("Overview", 650.0, 14.0, true),
+            b("Some <body> text & more of it so that eleven points is the body size here.", 620.0, 11.0, false),
+        ],
+        images: vec![Image {
+            ext: "png",
+            bytes: b"\x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\0\x02\0\0\0\x03".as_slice().into(),
+            rect: [72.0, 450.0, 272.0, 600.0],
+            size: [200.0, 150.0],
+            rotation: 0.0,
+        }],
+        background: None,
+    }
+}
+
+#[test]
+fn html_has_headings_paragraphs_and_images_in_order() {
+    let h = html(&[page(), page()], "Report");
+    let order: Vec<usize> = ["<h1>Annual Report</h1>", "<h2>Overview</h2>", "<p>Some &lt;body&gt; text &amp;", "<img", "<p>Body text after"]
+        .iter()
+        .map(|x| h.find(x).unwrap_or_else(|| panic!("{x} missing in {h}")))
+        .collect();
+    assert!(order.windows(2).all(|w| w[0] < w[1]), "{order:?}");
+    assert_eq!(h.matches("<hr>").count(), 1);
+    assert_eq!(base64(b"Man"), "TWFu");
+    assert_eq!(base64(b"Ma"), "TWE=");
+}
+
+#[test]
+fn docx_is_a_word_package() {
+    let d = docx(&[page()], "Report");
+    assert!(d.starts_with(b"PK"));
+    let names: Vec<&str> =
+        ["[Content_Types].xml", "word/document.xml", "word/styles.xml", "word/_rels/document.xml.rels", "word/media/image1.png", "_rels/.rels"]
+            .to_vec();
+    for n in names {
+        assert!(d.windows(n.len()).any(|w| w == n.as_bytes()), "{n}");
+    }
+}
+
+#[test]
+fn word_does_not_invent_borders_for_aligned_invoice_fields() {
+    let xml = part(&docx(&[table_page()], "Invoice"), "word/document.xml");
+    assert!(xml.contains("<w:tbl>"));
+    assert!(!xml.contains("w:val=\"single\""), "text alignment is not evidence of a border: {xml}");
+    assert!(xml.contains("<w:insideH w:val=\"nil\"/>"));
+}
+
+#[test]
+fn word_table_cell_widths_follow_the_columns_they_span() {
+    let cell = |text: &str, span| Cell { text: text.into(), size: 11.0, bold: false, italic: false, color: [0.0; 3], span };
+    let table = Table {
+        rect: [0.0, 0.0, 300.0, 100.0],
+        cols: vec![0.0, 50.0, 150.0],
+        rows: vec![
+            vec![cell("First", 1), cell("Second", 1), cell("Third", 1)],
+            vec![cell("First", 1), cell("Last two", 2)],
+            vec![cell("First two", 2), cell("Third", 1)],
+            vec![cell("All", 3)],
+            vec![cell("First", 1)],
+        ],
+    };
+    let xml = docx_table(&table);
+    assert!(xml.contains("<w:gridCol w:w=\"1000\"/><w:gridCol w:w=\"2000\"/><w:gridCol w:w=\"3000\"/>"), "{xml}");
+    let widths: Vec<Vec<&str>> =
+        xml.split("<w:tr>").skip(1).map(|row| row.split("<w:tcW w:w=\"").skip(1).map(|cell| cell.split('"').next().unwrap()).collect()).collect();
+    assert_eq!(widths, vec![vec!["1000", "2000", "3000"], vec!["1000", "5000"], vec!["3000", "3000"], vec!["6000"], vec!["1000", "0", "0"]]);
+}
+
+#[test]
+fn word_keeps_a_page_with_a_clear_image_and_big_title_in_flow() {
+    // page() has a picture between paragraphs and a 24 pt title over 11 pt body text, but
+    // nothing overlaps: it must stay flowing paragraphs with the image inline.
+    let xml = part(&docx(&[page()], "Report"), "word/document.xml");
+    assert!(!xml.contains("position:absolute"), "nothing overlaps, so nothing floats: {xml}");
+    assert!(xml.contains("<wp:inline>"), "the picture stays inline: {xml}");
+    assert!(xml.contains("<w:pStyle w:val=\"Heading1\"/>"), "the title stays a heading: {xml}");
+    let (title, body) = (xml.find(">Annual Report</w:t>"), xml.find(">Body text after the picture"));
+    assert!(title.is_some() && body.is_some() && title < body, "reading order kept: {xml}");
+    // The same page with the picture moved over the body text floats.
+    let mut over = page();
+    over.images[0].rect = [72.0, 380.0, 272.0, 530.0];
+    let xml = part(&docx(&[over], "Report"), "word/document.xml");
+    assert!(xml.contains("position:absolute"), "an image over text floats: {xml}");
+}
+
+#[test]
+fn word_overlap_does_not_consume_invoice_body_space() {
+    let mut p = table_page();
+    p.blocks.push(Block {
+        text: "DRAFT".into(),
+        rect: [100.0, 200.0, 500.0, 700.0],
+        size: 100.0,
+        bold: false,
+        italic: false,
+        color: [0.8; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    });
+    p.images = page().images;
+    let xml = part(&docx(&[p], "Invoice"), "word/document.xml");
+    assert!(xml.contains("position:absolute"), "overlapping text must float: {xml}");
+    assert!(!xml.contains("<wp:inline>"), "images must not displace invoice text");
+    assert!(!xml.contains("<w:tbl>"), "the source text boxes must keep their positions");
+    assert_eq!(xml.matches(">DRAFT</w:t>").count(), 1);
+    assert_eq!(xml.matches("w:type=\"page\"").count(), 0);
+    assert!(xml.contains("margin-left:72.000pt;margin-top:160.000pt"), "Meter field keeps its source position: {xml}");
+    let watermark = xml.split(">DRAFT</w:t>").next().unwrap().rsplit("<v:rect ").next().unwrap();
+    assert!(watermark.contains("z-index:-2"), "watermark is behind foreground graphics");
+    // The picture is a DrawingML anchor behind the text (a VML rectangle shows no picture in Word).
+    assert!(!xml.contains("<v:imagedata"), "{xml}");
+    assert!(xml.contains("<wp:anchor ") && xml.contains("behindDoc=\"1\"") && xml.contains("<a:blip r:embed=\"rIdImg1\"/>"), "{xml}");
+}
+
+#[test]
+fn word_rotated_pages_keep_separate_page_sizes_and_unique_shapes() {
+    let mut p = table_page();
+    p.blocks[0].rotation = 45.0;
+    let mut second = p.clone();
+    second.width = 400.0;
+    second.height = 500.0;
+    let xml = part(&docx(&[p, second], "Two invoices"), "word/document.xml");
+    assert!(xml.contains("rotation:315.000"), "PDF y-up becomes Word y-down");
+    assert_eq!(xml.matches("<w:sectPr>").count(), 2);
+    assert!(xml.contains("<w:pgSz w:w=\"8000\" w:h=\"10000\"/>"));
+    assert_eq!(xml.matches("id=\"Text1\"").count(), 1);
+    assert_eq!(xml.matches(">Meter</w:t>").count(), 2);
+}
+
+/// #2992: pages that share a background colour get it as the Word document's page colour
+/// (with the setting that makes Word show it); differing or white backgrounds don't.
+#[test]
+fn docx_keeps_a_shared_page_background() {
+    let teal = Page { background: Some([0.0, 0.5, 0.5]), ..page() };
+    let zip = docx(&[teal.clone(), teal.clone()], "Teal");
+    let xml = part(&zip, "word/document.xml");
+    assert!(xml.contains("<w:background w:color=\"008080\"/><w:body>"), "{xml}");
+    assert!(part(&zip, "word/settings.xml").contains("<w:displayBackgroundShape/>"));
+    assert!(part(&zip, "[Content_Types].xml").contains("/word/settings.xml"));
+    assert!(part(&zip, "word/_rels/document.xml.rels").contains("Target=\"settings.xml\""));
+    let other = Page { background: Some([1.0, 0.0, 0.0]), ..page() };
+    for (pages, why) in [
+        (vec![teal.clone(), other], "different colours"),
+        (vec![teal.clone(), page()], "a page without one"),
+        (vec![Page { background: Some([1.0; 3]), ..page() }], "white"),
+        (vec![page()], "none"),
+    ] {
+        let zip = docx(&pages, "Plain");
+        assert!(!part(&zip, "word/document.xml").contains("<w:background"), "{why}");
+        assert!(!zip.windows(b"word/settings.xml".len()).any(|w| w == b"word/settings.xml"), "{why}");
+    }
+}
+
+/// One part of a package written by [`Zip`], inflated.
+pub(crate) fn part(zip: &[u8], name: &str) -> String {
+    let at = |i: usize, n: usize| zip[i..i + n].iter().rev().fold(0usize, |v, b| v << 8 | *b as usize);
+    let mut i = 0;
+    while zip[i..].starts_with(b"PK\x03\x04") {
+        let (size, name_len) = (at(i + 18, 4), at(i + 26, 2));
+        let data = i + 30 + name_len;
+        if &zip[i + 30..data] == name.as_bytes() {
+            let mut s = String::new();
+            std::io::Read::read_to_string(&mut flate2::read::DeflateDecoder::new(&zip[data..data + size]), &mut s).unwrap();
+            return s;
+        }
+        i = data + size;
+    }
+    panic!("{name} missing")
+}
+
+#[test]
+fn word_opens_text_with_control_characters_and_long_pages() {
+    // #72: text extracted without a usable /ToUnicode holds C0 controls, which XML forbids;
+    // Word then refused the whole file. A till receipt is also taller than Word's 22 in.
+    let mut p = page();
+    p.height = 2400.0;
+    p.blocks.push(Block {
+        text: "Total\u{0}\u{3}\u{c} 4.50\u{FFFF}\tGBP".into(),
+        rect: [72.0, 100.0, 300.0, 110.0],
+        size: f64::NAN,
+        bold: false,
+        italic: false,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    });
+    let xml = part(&docx(&[p.clone()], "Receipt\u{1}"), "word/document.xml");
+    assert!(xml.contains(">Total 4.50\tGBP</w:t>"), "{xml}");
+    assert!(!xml.chars().any(|c| !allowed(c)));
+    assert!(xml.contains("<w:pgSz w:w=\"12240\" w:h=\"31680\"/>"), "clamped to 22 in: {xml}");
+    assert!(xml.contains("<w:sz w:val=\"24\"/>"), "a non-finite size falls back to 12 pt");
+    assert!(rtf(&[p]).contains("Total 4.50\tGBP"));
+    // A narrow page keeps room for text: margins shrink.
+    let narrow = Page { width: 100.0, height: 200.0, ..page() };
+    let xml = part(&docx(&[narrow], "Narrow"), "word/document.xml");
+    assert!(xml.contains("<w:pgMar w:top=\"500\" w:right=\"250\" w:bottom=\"500\" w:left=\"250\""), "{xml}");
+}
+
+#[test]
+fn text_colour_survives_every_format() {
+    // #526: a dark green heading (0.05 0.23 0.18 rg) came out black in Word.
+    let mut p = page();
+    p.blocks[1].color = [0.05, 0.23, 0.18];
+    p.blocks[3].color = [f64::NAN, 2.0, -1.0];
+    let xml = part(&docx(&[p.clone()], "Colour"), "word/document.xml");
+    assert!(xml.contains("<w:color w:val=\"0D3B2E\"/>"), "{xml}");
+    assert!(xml.contains("<w:color w:val=\"00FF00\"/>"), "out-of-range values clamp: {xml}");
+    // Black text keeps Word's default colour.
+    assert_eq!(xml.matches("<w:color ").count(), 2, "{xml}");
+    let h = html(&[p.clone()], "Colour");
+    assert!(h.contains("<h1 style=\"color:#0D3B2E\">Annual Report</h1>"), "{h}");
+    assert!(h.contains("<p style=\"color:#00FF00\">"), "{h}");
+    let r = rtf(&[p.clone()]);
+    assert!(r.contains("{\\colortbl;\\red13\\green59\\blue46;\\red0\\green255\\blue0;}"), "{r}");
+    assert!(r.contains("\\cf1 Annual Report"), "{r}");
+    let ppt = pptx(&[p], "Colour");
+    let pxml = part(&ppt, "ppt/slides/slide1.xml");
+    assert!(pxml.contains("<a:srgbClr val=\"0D3B2E\"/>"), "{pxml}");
+    assert!(pxml.contains("<a:srgbClr val=\"00FF00\"/>"), "out-of-range values clamp: {pxml}");
+    // A table cell keeps its colour too.
+    let mut t = table_page();
+    t.blocks[0].color = [1.0, 0.0, 0.0];
+    let xml = part(&docx(&[t.clone()], "Grid"), "word/document.xml");
+    assert!(xml.contains("<w:color w:val=\"FF0000\"/>"), "{xml}");
+    assert!(html(&[t], "Grid").contains("style=\"color:#FF0000\""));
+}
+
+#[test]
+fn rtf_escapes_and_sizes() {
+    let mut p = page();
+    p.blocks.push(Block {
+        text: "Café {x}".into(),
+        rect: [72.0, 100.0, 200.0, 110.0],
+        size: 10.0,
+        bold: false,
+        italic: true,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    });
+    let r = rtf(&[p]);
+    assert!(r.starts_with("{\\rtf1") && r.ends_with('}'));
+    assert!(r.contains("\\fs48\\b Annual Report"));
+    assert!(r.contains("\\fs20\\i Caf\\u233? \\{x\\}"), "{r}");
+}
+
+/// A 3-column table with a spanning header row and a hole in the last row.
+fn table_page() -> Page {
+    let cell = |t: &str, x: f64, y: f64, w: f64| Block {
+        text: t.into(),
+        rect: [x, y, x + w, y + 12.0],
+        size: 11.0,
+        bold: false,
+        italic: false,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    };
+    Page {
+        width: 612.0,
+        height: 792.0,
+        blocks: vec![
+            cell("Meter", 72.0, 620.0, 120.0),
+            cell("Unit", 232.0, 620.0, 80.0),
+            cell("Reading", 392.0, 620.0, 100.0),
+            cell("A1", 72.0, 590.0, 120.0),
+            cell("kWh", 232.0, 590.0, 80.0),
+            cell("37414.00", 392.0, 590.0, 100.0),
+            cell("A2", 72.0, 560.0, 120.0),
+            cell("kW", 232.0, 560.0, 80.0),
+            // A2's row is missing its third cell (an empty cell in the grid).
+            cell("Totals", 72.0, 530.0, 240.0),
+            Block {
+                text: "Notes follow the table and are long enough to be the body text size of the page here.".into(),
+                rect: [72.0, 460.0, 500.0, 471.0],
+                size: 11.0,
+                bold: false,
+                italic: false,
+                color: [0.0; 3],
+                rotation: 0.0,
+                space_around: [false; 2],
+            },
+        ],
+        images: Vec::new(),
+        background: None,
+    }
+}
+
+#[test]
+fn grid_text_becomes_a_real_table_in_every_format() {
+    let p = table_page();
+    let h = html(std::slice::from_ref(&p), "Bill");
+    assert!(h.contains("<table>"), "{h}");
+    assert!(h.contains("<td colspan=\"2\">Totals</td>"), "spanning cell: {h}");
+    assert_eq!(h.matches("<tr>").count(), 4, "{h}");
+    assert!(h.contains("<td></td>"), "the hole is an empty cell: {h}");
+    assert!(h.contains("<p>Notes follow"), "the paragraph after the table stays: {h}");
+
+    let d = docx(std::slice::from_ref(&p), "Bill");
+    assert!(d.starts_with(b"PK"));
+    assert!(d.windows(b"word/document.xml".len()).any(|w| w == b"word/document.xml"));
+    let (tables, _) = tables(&p.blocks);
+    assert_eq!(tables.len(), 1);
+    let table_xml = docx_table(&tables[0]);
+    assert!(table_xml.contains("<w:tblGrid>"));
+    assert!(table_xml.contains("<w:gridSpan w:val=\"2\"/>"), "{table_xml}");
+    assert_eq!(table_xml.matches("<w:tr>").count(), 4);
+
+    let r = rtf(std::slice::from_ref(&p));
+    assert!(r.contains("\\trowd"), "{r}");
+    assert_eq!(r.matches("\\row").count(), 4);
+    // Boundaries precede the cells; "Totals" spans two columns, so it ends at the third edge.
+    assert!(r.contains("\\trowd\\trgaph108\\cellx4640\\cellx7840\\cellx9920{"), "{r}");
+    assert!(r.contains("\\trowd\\trgaph108\\cellx7840{\\intbl\\fs22 Totals}\\cell\\row"), "{r}");
+
+    let pt = pptx(std::slice::from_ref(&p), "Bill");
+    assert!(pt.starts_with(b"PK"));
+    assert!(pt.windows(b"ppt/slides/slide1.xml".len()).any(|w| w == b"ppt/slides/slide1.xml"));
+    let slide_xml = part(&pt, "ppt/slides/slide1.xml");
+    assert!(slide_xml.contains("<a:tbl>"));
+    assert!(slide_xml.contains("gridSpan=\"2\""));
+    assert_eq!(slide_xml.matches("<a:tr ").count(), 4);
+}
+
+#[test]
+fn a_staircase_of_blocks_is_not_a_huge_table() {
+    // Row k holds blocks in columns k and k + 1: every column has two members and every row
+    // two columns, so without a cap this would be one table of (n / 2)² cells.
+    let n = 4000;
+    let blocks: Vec<Block> = (0..n)
+        .map(|i| {
+            let (row, col) = (i / 2, i / 2 + i % 2);
+            let (x, y) = (10.0 + col as f64 * 20.0, 10_000.0 - row as f64 * 14.0);
+            Block {
+                text: "x".into(),
+                rect: [x, y, x + 8.0, y + 12.0],
+                size: 11.0,
+                bold: false,
+                italic: false,
+                color: [0.0; 3],
+                rotation: 0.0,
+                space_around: [false; 2],
+            }
+        })
+        .collect();
+    let started = std::time::Instant::now();
+    let (tables, _) = tables(&blocks);
+    assert!(tables.iter().all(|t| t.cols.len() <= MAX_COLS), "{} columns", tables.iter().map(|t| t.cols.len()).max().unwrap_or(0));
+    assert!(started.elapsed() < std::time::Duration::from_secs(5), "took {:?}", started.elapsed());
+}
+
+#[test]
+fn word_opens_tables_up_to_its_column_limit() {
+    // Rows of short numbers on a regular grid, n columns wide.
+    let grid = |n: usize| Page {
+        width: 1500.0,
+        height: 792.0,
+        blocks: (0..3)
+            .flat_map(|row| {
+                (0..n).map(move |col| {
+                    let (x, y) = (20.0 + col as f64 * 22.0, 700.0 - row as f64 * 14.0);
+                    Block {
+                        text: (col + 1).to_string(),
+                        rect: [x, y, x + 8.0, y + 8.0],
+                        size: 8.0,
+                        bold: false,
+                        italic: false,
+                        color: [0.0; 3],
+                        rotation: 0.0,
+                        space_around: [false; 2],
+                    }
+                })
+            })
+            .collect(),
+        images: Vec::new(),
+        background: None,
+    };
+    let grid_cols = |p: &Page| part(&docx(std::slice::from_ref(p), "Grid"), "word/document.xml").matches("<w:gridCol ").count();
+    assert_eq!(grid_cols(&grid(63)), 63, "63 columns is still a table");
+    // Word refuses to open a document with a 64-column table, so that grid stays text.
+    assert_eq!(grid_cols(&grid(64)), 0);
+}
+
+fn block(t: &str, x0: f64, y0: f64, x1: f64, y1: f64) -> Block {
+    Block { text: t.into(), rect: [x0, y0, x1, y1], size: 12.0, bold: false, italic: false, color: [0.0; 3], rotation: 0.0, space_around: [false; 2] }
+}
+
+/// #2806: a sentence whose link is set in another colour or font runs on as separate blocks
+/// on one line. They are not table columns, even when several such lines share left edges.
+#[test]
+fn a_link_inside_a_sentence_is_not_a_table_column() {
+    let blue = |t: &str, x0: f64, y0: f64, x1: f64, y1: f64| Block { color: [0.02, 0.388, 0.757], ..block(t, x0, y0, x1, y1) };
+    let p = Page {
+        width: 612.0,
+        height: 792.0,
+        blocks: vec![
+            block("6.3. 2. All content shown at", 121.7, 710.3, 272.0, 724.9),
+            blue("http", 273.5, 710.3, 294.1, 724.9),
+            blue("s", 294.1, 709.8, 298.8, 725.8),
+            blue("://women", 298.8, 710.3, 348.0, 724.9),
+            blue("g", 348.1, 709.8, 353.7, 725.8),
+            blue("randprix.fide.com", 353.7, 710.3, 443.2, 724.9),
+            block("shall be reviewed and approved by the Press Officer.", 164.3, 622.5, 533.1, 724.9),
+            block("6.3. 3. The Organiser shall warrant that", 121.7, 601.8, 345.1, 616.5),
+            blue("https://womengrandprix.fide.com", 350.2, 601.3, 519.9, 617.4),
+            block("is managed in a professional way and furthermore that it is capable of", 164.3, 557.9, 533.0, 616.5),
+            block("6. 3. 4. The Press Officer shall report to the FIDE Head of PR.", 121.7, 516.6, 530.3, 551.9),
+            block("conducted during a WGP tournament.", 164.3, 502.0, 352.5, 516.6),
+        ],
+        images: Vec::new(),
+        background: None,
+    };
+    let h = html(std::slice::from_ref(&p), "Regulations");
+    assert!(!h.contains("<table>"), "running text became a table: {h}");
+    // The link is a run of its sentence, in its own colour (#4158).
+    assert!(h.contains("<p>6.3. 2. All content shown at <span style=\"color:#0563C1\">http</span>"), "{h}");
+    for b in &p.blocks {
+        assert!(h.contains(&b.text), "{} was lost: {h}", b.text);
+    }
+}
+
+/// #2806: lines that each run on into a link starting at the same place are sentences, not a
+/// two-column table, even three in a row.
+#[test]
+fn sentences_that_run_on_into_links_are_not_a_table() {
+    let blue = |t: &str, x0: f64, y0: f64, x1: f64, y1: f64| Block { color: [0.02, 0.388, 0.757], ..block(t, x0, y0, x1, y1) };
+    let mut blocks = Vec::new();
+    for (n, lead) in ["Rules are published at", "Pairings are posted at", "Results are listed at"].iter().enumerate() {
+        let y = 700.0 - 16.0 * n as f64;
+        blocks.push(block(lead, 72.0, y, 211.0, y + 12.0));
+        blocks.push(blue("https://example.org/event", 212.5, y, 360.0, y + 12.0));
+    }
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let h = html(std::slice::from_ref(&p), "Event");
+    assert!(!h.contains("<table>"), "sentences became a table: {h}");
+    assert_eq!(h.matches("https://example.org/event").count(), 3, "{h}");
+}
+
+/// A continuation can drift into a grid column covered by the preceding cell's span.
+/// It must remain available as paragraph text if that slot never becomes an output cell.
+#[test]
+fn table_spans_do_not_consume_text_they_do_not_emit() {
+    let mut blocks = vec![
+        Block { size: 12.0, ..block("ABCDEFGHIJK", 72.1, 697.0, 151.3, 710.8) },
+        Block { size: 12.0, color: [0.0, 0.0, 1.0], ..block("LOST", 150.4, 697.0, 179.2, 710.8) },
+        Block { size: 12.0, ..block("R0", 250.0, 697.0, 264.4, 710.8) },
+    ];
+    for row in 1..=4 {
+        let y = 697.0 - f64::from(row) * 50.0;
+        for (text, left, right) in [(format!("L{row}"), 72.1, 86.5), (format!("M{row}"), 146.4, 160.8), (format!("R{row}"), 250.0, 264.4)] {
+            blocks.push(Block { size: 12.0, ..block(&text, left, y, right, y + 13.8) });
+        }
+    }
+    let p = Page { width: 612.0, height: 792.0, blocks, ..Page::default() };
+    let (tables, consumed) = tables(&p.blocks);
+    assert_eq!(tables.len(), 1);
+    assert_eq!(tables[0].rows[0][0].span, 2);
+    assert!(!consumed[1], "a covered slot did not emit its text");
+    assert!(consumed.iter().enumerate().all(|(index, used)| index == 1 || *used));
+    let outputs = [
+        html(std::slice::from_ref(&p), "Continuations"),
+        part(&docx(std::slice::from_ref(&p), "Continuations"), "word/document.xml"),
+        rtf(std::slice::from_ref(&p)),
+        part(&pptx(std::slice::from_ref(&p), "Continuations"), "ppt/slides/slide1.xml"),
+    ];
+    for output in outputs {
+        for b in &p.blocks {
+            assert_eq!(output.matches(&b.text).count(), 1, "{} must survive exactly once", b.text);
+        }
+    }
+}
+
+/// #2806: a superscript right after a number ("1" "st") continues its cell; the prize table
+/// around it stays a table.
+#[test]
+fn a_superscript_beside_a_number_keeps_its_table() {
+    let mut blocks = vec![block("PLACE", 100.0, 700.0, 140.0, 712.0), block("PRIZE (euros)", 300.0, 700.0, 380.0, 712.0)];
+    for (n, (row, sup)) in [("1", "st"), ("2", "nd"), ("3", "rd"), ("4", "th")].iter().enumerate() {
+        let y = 680.0 - 20.0 * n as f64;
+        blocks.push(block(row, 100.0, y, 106.0, y + 12.0));
+        blocks.push(Block { size: 8.0, ..block(sup, 106.0, y + 5.0, 113.0, y + 13.0) });
+        blocks.push(block(&format!("{},000", 30 - 5 * n), 300.0, y, 340.0, y + 12.0));
+    }
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let h = html(std::slice::from_ref(&p), "Prizes");
+    assert!(h.contains("<table>"), "the prize table was lost: {h}");
+    assert!(h.contains("30,000") && h.contains("15,000"), "{h}");
+    let (tables, consumed) = tables(&p.blocks);
+    assert!(consumed.iter().all(|used| *used), "ordinary table continuations stay in their cells");
+    let cells: Vec<&str> = tables.iter().flat_map(|t| &t.rows).flatten().map(|c| c.text.as_str()).collect();
+    assert!(["st", "nd", "rd", "th"].iter().all(|suffix| cells.contains(suffix)));
+}
+
+#[test]
+fn two_column_body_text_is_not_mistaken_for_a_table() {
+    let para = |t: &str, x: f64, y: f64| Block {
+        text: t.into(),
+        rect: [x, y, x + 200.0, y + 90.0], // nine lines tall: body text, not a cell
+        size: 11.0,
+        bold: false,
+        italic: false,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    };
+    let p = Page {
+        width: 612.0,
+        height: 792.0,
+        blocks: vec![
+            para("Left column text of the page, long enough to be a flowing paragraph.", 72.0, 500.0),
+            para("Right column text of the page, long enough to be a flowing paragraph.", 320.0, 500.0),
+            para("Second left block, still a tall flowing paragraph rather than a cell.", 72.0, 400.0),
+            para("Second right block, still a tall flowing paragraph rather than a cell.", 320.0, 400.0),
+        ],
+        images: Vec::new(),
+        background: None,
+    };
+    let h = html(&[p], "Paper");
+    assert!(!h.contains("<table>"), "tall two-column text must stay paragraphs: {h}");
+}
+
+/// #1936: every picture Word is told to draw (`r:embed`) names a relationship whose target is a
+/// file in the package, with a content type; JPEG pictures too, inline or placed.
+#[test]
+fn word_pictures_resolve_to_media_in_the_package() {
+    let jpeg = Image { ext: "jpg", bytes: [0xFF, 0xD8, 0xFF, 0xD9].as_slice().into(), ..page().images[0].clone() };
+    for placed in [false, true] {
+        let mut p = page();
+        p.images = vec![jpeg.clone()];
+        if placed {
+            p.images[0].rect = [72.0, 640.0, 272.0, 790.0];
+            p.blocks[0].rect = [72.0, 700.0, 300.0, 760.0];
+        }
+        let zip = docx(&[p], "T");
+        let xml = part(&zip, "word/document.xml");
+        assert_eq!(xml.contains("<wp:anchor "), placed, "{xml}");
+        let rels = part(&zip, "word/_rels/document.xml.rels");
+        let embed = xml.split("r:embed=\"").nth(1).and_then(|r| r.split('"').next()).unwrap();
+        let rel = rels.split(&format!("Id=\"{embed}\"")).nth(1).unwrap();
+        assert!(rel.contains("relationships/image\""), "{rels}");
+        let target = rel.split("Target=\"").nth(1).and_then(|t| t.split('"').next()).unwrap();
+        assert_eq!(target, "media/image1.jpg");
+        assert!(zip.windows(21).any(|w| w == b"word/media/image1.jpg"));
+        assert!(part(&zip, "[Content_Types].xml").contains("Extension=\"jpg\" ContentType=\"image/jpeg\""));
+        assert!(xml.matches("<wp:docPr ").count() == 1 && !xml.contains("<v:imagedata"));
+    }
+}
+
+#[test]
+fn word_export_bounds_the_number_of_pictures_and_skips_empty_ones() {
+    let mut p = page();
+    let one = p.images[0].clone();
+    p.images = vec![Image { bytes: [].as_slice().into(), ..one.clone() }];
+    p.images.extend(std::iter::repeat_n(one, MAX_MEDIA + 10));
+    let zip = docx(&[p], "T");
+    let rels = part(&zip, "word/_rels/document.xml.rels");
+    assert_eq!(rels.matches("relationships/image\"").count(), MAX_MEDIA);
+}
+
+/// The flowing paragraphs of a Word document (table cells left out), each as its runs' text
+/// and whether the run is italic.
+fn word_paragraphs(xml: &str) -> Vec<Vec<(String, bool)>> {
+    let body = xml.split("<w:tbl>").map(|s| s.split_once("</w:tbl>").map_or(s, |(_, after)| after)).collect::<String>();
+    body.split("<w:p>")
+        .skip(1)
+        .map(|p| {
+            let p = p.split_once("</w:p>").map_or(p, |(inside, _)| inside);
+            p.split("<w:r>")
+                .skip(1)
+                .filter_map(|r| {
+                    let text = r.split_once("<w:t xml:space=\"preserve\">")?.1.split_once("</w:t>")?.0;
+                    Some((text.to_string(), r.contains("<w:i/>")))
+                })
+                .collect::<Vec<_>>()
+        })
+        .filter(|runs| !runs.is_empty())
+        .collect()
+}
+
+fn runs(r: &[(&str, bool)]) -> Vec<(String, bool)> {
+    r.iter().map(|(t, i)| (t.to_string(), *i)).collect()
+}
+
+/// "Before *Chevron* after." on one line: the roman text, the italic case name and the roman
+/// text after it, the way reading blocks split a sentence at its style changes (#4158). The
+/// italic face stands a little taller than the roman one around it.
+fn italic_sentence() -> Vec<Block> {
+    vec![
+        block("Before", 72.0, 700.0, 110.0, 712.0),
+        Block { italic: true, ..block("Chevron", 113.0, 700.0, 158.0, 712.6) },
+        block("after.", 161.0, 700.0, 190.0, 712.0),
+    ]
+}
+
+/// #4158: a run in another style inside a sentence stays in that sentence's paragraph, as a
+/// run in its own style, in every Office format.
+#[test]
+fn an_italic_word_stays_in_its_sentence() {
+    let mut blocks = italic_sentence();
+    blocks.push(block("The next line is a paragraph of its own.", 72.0, 684.0, 300.0, 696.0));
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let xml = part(&docx(std::slice::from_ref(&p), "Opinion"), "word/document.xml");
+    assert_eq!(
+        word_paragraphs(&xml),
+        vec![runs(&[("Before ", false), ("Chevron ", true), ("after.", false)]), runs(&[("The next line is a paragraph of its own.", false)])],
+        "{xml}"
+    );
+    let h = html(std::slice::from_ref(&p), "Opinion");
+    assert!(h.contains("<p>Before <em>Chevron </em>after.</p>"), "{h}");
+    let r = rtf(std::slice::from_ref(&p));
+    assert!(r.contains("{\\pard\\fs24 Before {\\fs24\\b0\\i\\cf0 Chevron }{\\fs24\\b0\\i0\\cf0 after.}\\par}"), "{r}");
+    // The longest line is the slide's title; the sentence is one paragraph of the body.
+    let pxml = part(&pptx(std::slice::from_ref(&p), "Opinion"), "ppt/slides/slide1.xml");
+    assert!(
+        pxml.contains("<a:p><a:r><a:rPr sz=\"1200\"></a:rPr><a:t>Before </a:t></a:r><a:r><a:rPr sz=\"1200\" i=\"1\"></a:rPr><a:t>Chevron </a:t></a:r><a:r><a:rPr sz=\"1200\"></a:rPr><a:t>after.</a:t></a:r></a:p>"),
+        "{pxml}"
+    );
+}
+
+/// #4158: the runs keep their order along the line whatever order the blocks come in, and the
+/// paragraph keeps its place on the page, though the italic run stands taller than the first.
+#[test]
+fn a_sentence_keeps_its_reading_order() {
+    let mut blocks = vec![block("Then the next line.", 72.0, 684.0, 200.0, 696.0)];
+    blocks.extend(italic_sentence().into_iter().rev());
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let xml = part(&docx(std::slice::from_ref(&p), "Opinion"), "word/document.xml");
+    assert_eq!(
+        word_paragraphs(&xml),
+        vec![runs(&[("Before ", false), ("Chevron ", true), ("after.", false)]), runs(&[("Then the next line.", false)])],
+        "{xml}"
+    );
+}
+
+/// The text of a block leaves out the spaces at its ends, and the box of a run often takes in
+/// its trailing space, so runs can touch. The source's own space still separates them; runs
+/// that touch with no space between them (a superscript) stay joined.
+#[test]
+fn runs_keep_the_spaces_the_source_had_between_them() {
+    let blocks = vec![
+        Block { space_around: [false, true], ..block("Before", 72.0, 700.0, 113.0, 712.0) },
+        Block { italic: true, ..block("Chevron", 113.0, 700.0, 158.0, 712.0) },
+        Block { space_around: [true, false], ..block("after.", 158.0, 700.0, 190.0, 712.0) },
+        block("E = mc", 72.0, 660.0, 110.0, 672.0),
+        Block { size: 8.0, ..block("2", 110.0, 665.0, 115.0, 673.0) },
+    ];
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let xml = part(&docx(std::slice::from_ref(&p), "Spaces"), "word/document.xml");
+    assert_eq!(
+        word_paragraphs(&xml),
+        vec![runs(&[("Before ", false), ("Chevron ", true), ("after.", false)]), runs(&[("E = mc", false), ("2", false)])],
+        "{xml}"
+    );
+}
+/// Text turned another way (a label up the margin) is not a run of the line it touches.
+#[test]
+fn turned_text_is_not_a_run_of_the_line_beside_it() {
+    let blocks = vec![block("Before", 72.0, 700.0, 110.0, 712.0), Block { rotation: 90.0, ..block("SIDE", 111.0, 690.0, 123.0, 720.0) }];
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let h = html(std::slice::from_ref(&p), "Turned");
+    assert!(h.contains("<p>Before</p>") && h.contains("<p>SIDE</p>"), "{h}");
+}
+/// A block that starts where the line above ends is the next line, not a run of it.
+#[test]
+fn a_block_on_the_next_line_starts_a_paragraph() {
+    let blocks = vec![
+        block("The first line ends here", 72.0, 700.0, 190.0, 712.0),
+        Block { italic: true, ..block("and the next starts there.", 190.5, 690.0, 320.0, 702.0) },
+    ];
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let xml = part(&docx(std::slice::from_ref(&p), "Lines"), "word/document.xml");
+    assert_eq!(word_paragraphs(&xml), vec![runs(&[("The first line ends here", false)]), runs(&[("and the next starts there.", true)])], "{xml}");
+}
+
+/// A superscript beside a table cell stays in the table: table detection consumes it before
+/// paragraphs are formed, and a sentence after the table still keeps its italic run.
+#[test]
+fn table_cells_are_not_runs_of_a_paragraph() {
+    let mut blocks = vec![block("PLACE", 100.0, 700.0, 140.0, 712.0), block("PRIZE (euros)", 300.0, 700.0, 380.0, 712.0)];
+    for (n, (row, sup)) in [("1", "st"), ("2", "nd"), ("3", "rd")].iter().enumerate() {
+        let y = 680.0 - 20.0 * n as f64;
+        blocks.push(block(row, 100.0, y, 106.0, y + 12.0));
+        blocks.push(Block { size: 8.0, ..block(sup, 106.0, y + 5.0, 113.0, y + 13.0) });
+        blocks.push(block(&format!("{},000", 30 - 5 * n), 300.0, y, 340.0, y + 12.0));
+    }
+    blocks.extend(italic_sentence().into_iter().map(|b| Block { rect: [b.rect[0], b.rect[1] - 200.0, b.rect[2], b.rect[3] - 200.0], ..b }));
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let xml = part(&docx(std::slice::from_ref(&p), "Prizes"), "word/document.xml");
+    assert_eq!(xml.matches("<w:tbl>").count(), 1, "{xml}");
+    for cell in ["st", "nd", "rd", "30,000"] {
+        assert_eq!(xml.matches(&format!("preserve\">{cell}</w:t>")).count(), 1, "{cell}: {xml}");
+    }
+    // The cells are all in the table: the only flowing paragraph is the sentence.
+    assert_eq!(word_paragraphs(&xml), vec![runs(&[("Before ", false), ("Chevron ", true), ("after.", false)])], "{xml}");
+}
+
+/// A bold lead-in followed by body text on its line is body text, not a heading; a heading
+/// with a smaller footnote marker after it stays a heading.
+#[test]
+fn a_paragraph_is_a_heading_only_when_its_text_is() {
+    let blocks = vec![
+        Block { size: 24.0, ..block("Annual Report", 72.0, 740.0, 250.0, 764.0) },
+        Block { size: 14.0, ..block("1", 251.0, 752.0, 258.0, 766.0) },
+        Block { bold: true, ..block("Summary", 72.0, 700.0, 125.0, 712.0) },
+        block("the year closed with more members than it opened with, and fewer debts.", 128.0, 700.0, 540.0, 712.0),
+    ];
+    let p = Page { width: 612.0, height: 792.0, blocks, images: Vec::new(), background: None };
+    let xml = part(&docx(std::slice::from_ref(&p), "Report"), "word/document.xml");
+    assert_eq!(xml.matches("<w:pStyle w:val=\"Heading1\"/>").count(), 1, "{xml}");
+    assert!(!xml.contains("Heading2"), "the lead-in made its paragraph a heading: {xml}");
+    assert_eq!(word_paragraphs(&xml).len(), 2, "{xml}");
+}
diff --git a/crates/fonts/build.rs b/crates/fonts/build.rs
index bc87a16634..980c195709 100644
--- a/crates/fonts/build.rs
+++ b/crates/fonts/build.rs
@@ -2,7 +2,9 @@
 //! The recipe is craft-fonts' `docs/integration.md`; unset, `CRAFT_FONTS` is empty. It only reads
 //! the local checkout (no network). On wasm32 it embeds only the UI faces (BIZ UDPGothic Regular
 //! and any `Arab`, `Telu`, `Hebr`, `Thai` or `Deva` face), to keep the web build within hosting
-//! limits (Cloudflare Pages: 25 MiB per file).
+//! limits (Cloudflare Pages: 25 MiB per file). Native builds also read the optional
+//! `fonts/simplified-chinese-manifest.txt` (LXGW WenKai Lite); it is never embedded on wasm.
+//! `CRAFT_FONTS_REQUIRED` makes both the checkout and that native manifest required.
 
 use std::fmt::Write as _;
 use std::path::PathBuf;
@@ -10,18 +12,21 @@ use std::path::PathBuf;
 #[path = "src/cjk_scripts.rs"]
 mod cjk_scripts;
 
+/// Build-script entry point: embed craft-fonts from `CRAFT_FONTS_DIR`, make a missing or invalid input fatal
+/// when `CRAFT_FONTS_REQUIRED` is set, and write `craft_fonts.rs` to `OUT_DIR`.
 fn main() {
     println!("cargo::rerun-if-env-changed=CRAFT_FONTS_DIR");
     println!("cargo::rerun-if-env-changed=CRAFT_FONTS_REQUIRED");
     let mut src = String::from("pub static CRAFT_FONTS: &[CraftFont] = &[\n");
+    let required = std::env::var_os("CRAFT_FONTS_REQUIRED").is_some();
     if let Some(dir) = std::env::var_os("CRAFT_FONTS_DIR").map(PathBuf::from) {
-        match craft_fonts(&dir) {
+        match craft_fonts(&dir, required) {
             Ok(entries) => src.push_str(&entries),
-            Err(e) if std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() => {
-                println!("cargo::error=CRAFT_FONTS_DIR={}: {e}", dir.display());
-            }
+            Err(e) if required => println!("cargo::error=CRAFT_FONTS_DIR={}: {e}", dir.display()),
             Err(e) => println!("cargo::warning=building without craft-fonts: CRAFT_FONTS_DIR={}: {e}", dir.display()),
         }
+    } else if required {
+        println!("cargo::error=CRAFT_FONTS_REQUIRED is set but CRAFT_FONTS_DIR is missing");
     }
     src.push_str("];\n");
     let out = PathBuf::from(std::env::var_os("OUT_DIR").unwrap_or_default()).join("craft_fonts.rs");
@@ -30,26 +35,66 @@ fn main() {
     }
 }
 
-/// One `CraftFont { .. }` initialiser per manifest line.
-fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
-    let manifest = dir.join("fonts/manifest.txt");
-    println!("cargo::rerun-if-changed={}", manifest.display());
-    let text = std::fs::read_to_string(&manifest).map_err(|e| format!("{}: {e}", manifest.display()))?;
+/// The main manifest, plus the native-only Simplified Chinese manifest. The latter is optional
+/// for ordinary builds and required when `CRAFT_FONTS_REQUIRED` is set, so a required build can
+/// never pass the Chinese UI tests only by skipping them.
+fn craft_fonts(dir: &std::path::Path, required: bool) -> Result<String, String> {
     let wasm = std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32");
+    let mut out = manifest(dir, &dir.join("fonts/manifest.txt"), wasm, false)?;
+    if !wasm {
+        let chinese = dir.join("fonts/simplified-chinese-manifest.txt");
+        println!("cargo::rerun-if-changed={}", chinese.display());
+        match chinese.try_exists() {
+            Ok(false) if required => {
+                return Err(format!("{}: CRAFT_FONTS_REQUIRED is set but the simplified-Chinese font manifest is missing", chinese.display()));
+            }
+            Ok(false) => {}
+            Ok(true) => match manifest(dir, &chinese, false, required) {
+                Ok(entries) => out.push_str(&entries),
+                // A broken optional addition must never discard the main Japanese/symbol/RTL faces.
+                Err(e) if required => return Err(e),
+                Err(e) => println!("cargo::warning=skipping optional Chinese fonts: {e}"),
+            },
+            Err(e) if required => return Err(format!("{}: {e}", chinese.display())),
+            Err(e) => println!("cargo::warning=skipping optional Chinese fonts: {}: {e}", chinese.display()),
+        }
+    }
+    Ok(out)
+}
+
+/// One `CraftFont { .. }` initialiser per manifest line.
+///
+/// `strict_cap` is set for the required native Simplified Chinese manifest: a face that does not
+/// fit its cap must fail the build rather than be silently left out, so a required build cannot
+/// pass without the Chinese face it promises.
+fn manifest(dir: &std::path::Path, manifest: &std::path::Path, wasm: bool, strict_cap: bool) -> Result<String, String> {
+    println!("cargo::rerun-if-changed={}", manifest.display());
+    let text = std::fs::read_to_string(manifest).map_err(|e| format!("{}: {e}", manifest.display()))?;
     let mut out = String::new();
+    // A required native Chinese manifest must add the Hans face itself, not merely some other
+    // CJK face that happens to fit: otherwise CRAFT_FONTS_REQUIRED would pass while the promised
+    // Simplified Chinese fallback is still absent.
+    let mut has_hans = false;
     for line in text.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')) {
         let f: Vec<&str> = line.split(" | ").map(str::trim).collect();
         let [family, style, file, scripts, ..] = f.as_slice() else {
             return Err(format!("malformed manifest line: {line}"));
         };
-        // Whole CJK faces aren't embedded for size; interface CJK comes from cut faces once the app
-        // moves to craft-fonts-build (storytold/craft-libs#213).
+        // Keep the upstream general CJK size cap. The separately pinned native Chinese UI
+        // face has its own bound; web builds retain the smaller general limit. A required
+        // Chinese face over its cap fails the build instead of being silently omitted.
         let cjk = scripts.split(',').any(cjk_scripts::is_cjk_script);
-        if cjk
-            && !cjk_scripts::WHOLE_CJK_FAMILIES.contains(family)
-            && std::fs::metadata(dir.join(file)).is_ok_and(|m| m.len() > cjk_scripts::MAX_OTHER_CJK_BYTES)
-        {
-            continue;
+        if cjk && let Ok(metadata) = std::fs::metadata(dir.join(file)) {
+            match cjk_scripts::cjk_size_decision(family, metadata.len(), wasm, strict_cap) {
+                cjk_scripts::CjkSizeDecision::Embed => {}
+                cjk_scripts::CjkSizeDecision::Skip => continue,
+                cjk_scripts::CjkSizeDecision::Reject => {
+                    let cap = cjk_scripts::cjk_cap_bytes(family, wasm);
+                    return Err(format!(
+                        "{file}: the {family} face is larger than the {cap}-byte native Chinese UI cap; CRAFT_FONTS_REQUIRED cannot embed it"
+                    ));
+                }
+            }
         }
         // Arabic interface faces are small, so the web build keeps them too.
         let arabic = scripts.split(',').any(|s| s.trim() == "Arab");
@@ -68,6 +113,7 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
         if wasm && !web_face {
             continue;
         }
+        has_hans |= cjk_scripts::has_script_tag(scripts, "Hans");
         let path = dir.join(file).canonicalize().map_err(|e| format!("{file}: {e}"))?;
         println!("cargo::rerun-if-changed={}", path.display());
         let scripts: Vec<String> = scripts.split(',').map(|s| format!("{:?}", s.trim())).collect();
@@ -78,5 +124,36 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
             path.display().to_string(),
         );
     }
+    if strict_cap && !has_hans {
+        return Err(format!(
+            "{}: CRAFT_FONTS_REQUIRED is set but the manifest emits no Hans face (a Simplified Chinese face is required)",
+            manifest.display()
+        ));
+    }
     Ok(out)
 }
+
+#[cfg(test)]
+mod manifest_tests {
+    use super::*;
+
+    /// Regression test: a required native-font manifest must declare at least one Hans face, while optional
+    /// input accepts another script and a missing asset still fails.
+    #[test]
+    fn required_native_manifest_rejects_non_hans_faces_after_parsing() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-required-hans-{}", std::process::id()));
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::write(root.join("face.ttf"), b"synthetic manifest fixture").unwrap();
+        let path = root.join("manifest.txt");
+        for scripts in ["Hant,Latn", "Hans-HK,Latn", "Latn"] {
+            std::fs::write(&path, format!("Fixture | Regular | face.ttf | {scripts}\n")).unwrap();
+            assert!(manifest(&root, &path, false, true).unwrap_err().contains("no Hans face"), "{scripts}");
+            assert!(manifest(&root, &path, false, false).unwrap().contains("CraftFont {"), "optional input stays usable");
+        }
+        std::fs::write(&path, "Fixture | Regular | face.ttf | Latn, Hans\n").unwrap();
+        assert!(manifest(&root, &path, false, true).unwrap().contains("CraftFont {"));
+        std::fs::remove_file(root.join("face.ttf")).unwrap();
+        assert!(manifest(&root, &path, false, true).is_err(), "a missing Hans asset cannot satisfy required input");
+        std::fs::remove_dir_all(root).unwrap();
+    }
+}
diff --git a/crates/fonts/src/cjk_scripts.rs b/crates/fonts/src/cjk_scripts.rs
index 16a863c683..1058c6e61b 100644
--- a/crates/fonts/src/cjk_scripts.rs
+++ b/crates/fonts/src/cjk_scripts.rs
@@ -8,6 +8,11 @@ pub const WHOLE_CJK_FAMILIES: [&str; 3] = ["Shippori Mincho", "BIZ UDPGothic", "
 /// Any other CJK face over this size is left out.
 pub const MAX_OTHER_CJK_BYTES: u64 = 4 << 20;
 
+/// Reviewed native-only UI fallback from the separate Chinese manifest.
+/// It is never included in the browser payload. Other CJK families keep the 4 MiB cap.
+pub const NATIVE_UI_CJK_FAMILIES: [&str; 1] = ["LXGW WenKai Lite"];
+pub const MAX_NATIVE_UI_CJK_BYTES: u64 = 16 << 20;
+
 /// ISO 15924 codes of the Han, Japanese and Korean scripts, Hangul on its own included.
 const CJK_SCRIPTS: [&str; 6] = ["Hani", "Hans", "Hant", "Jpan", "Kore", "Hang"];
 
@@ -17,3 +22,76 @@ pub fn is_cjk_script(tag: &str) -> bool {
     let code = tag.trim().split('-').next().unwrap_or_default();
     CJK_SCRIPTS.contains(&code)
 }
+
+/// Whether a manifest's comma-separated script list contains `script` exactly, ignoring spaces.
+/// The interface and document lookups use exact tags (`CraftFont::covers`), so a regional tag
+/// such as `Hans-HK` is not a `Hans` entry.
+pub fn has_script_tag(scripts: &str, script: &str) -> bool {
+    scripts.split(',').any(|tag| tag.trim() == script)
+}
+
+/// What `build.rs` does with one CJK face from a manifest.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CjkSizeDecision {
+    /// The face fits its cap (or is a Japanese family embedded whole).
+    Embed,
+    /// An optional face over its cap: leave it out and keep the rest.
+    Skip,
+    /// A required face over its cap: fail the build rather than silently omit it.
+    Reject,
+}
+
+/// The size cap that applies to `family` in this build.
+pub fn cjk_cap_bytes(family: &str, wasm: bool) -> u64 {
+    if !wasm && NATIVE_UI_CJK_FAMILIES.contains(&family) { MAX_NATIVE_UI_CJK_BYTES } else { MAX_OTHER_CJK_BYTES }
+}
+
+/// Decide whether a CJK face is embedded, skipped, or rejected.
+///
+/// The Japanese document/UI families are embedded whole. Every other CJK family uses its cap;
+/// `required` marks the native Simplified Chinese manifest of a `CRAFT_FONTS_REQUIRED` build,
+/// where an over-cap face must fail instead of quietly disappearing.
+pub fn cjk_size_decision(family: &str, bytes: u64, wasm: bool, required: bool) -> CjkSizeDecision {
+    if WHOLE_CJK_FAMILIES.contains(&family) {
+        return CjkSizeDecision::Embed;
+    }
+    if bytes <= cjk_cap_bytes(family, wasm) {
+        CjkSizeDecision::Embed
+    } else if required {
+        CjkSizeDecision::Reject
+    } else {
+        CjkSizeDecision::Skip
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Check that a required Chinese manifest needs an exact `Hans` script tag and does not accept
+    /// Traditional or region-suffixed tags.
+    #[test]
+    fn a_required_chinese_manifest_needs_an_exact_hans_entry() {
+        assert!(has_script_tag("Hans,Latn", "Hans"));
+        assert!(has_script_tag(" Latn , Hans ", "Hans"));
+        assert!(!has_script_tag("Hant,Latn", "Hans"), "Traditional Chinese is not the required Simplified face");
+        assert!(!has_script_tag("Hans-HK,Latn", "Hans"), "the UI looks for the exact Hans tag");
+        assert!(!has_script_tag("Hani,Jpan,Kore", "Hans"));
+    }
+
+    /// Check that a native Chinese face over its cap is rejected when required, skipped when optional, and
+    /// uses the web cap on the web.
+    #[test]
+    fn a_required_native_chinese_face_over_its_cap_is_rejected_not_skipped() {
+        let at_cap = MAX_NATIVE_UI_CJK_BYTES;
+        assert_eq!(cjk_size_decision("LXGW WenKai Lite", at_cap, false, true), CjkSizeDecision::Embed);
+        assert_eq!(cjk_size_decision("LXGW WenKai Lite", at_cap + 1, false, true), CjkSizeDecision::Reject);
+        assert_eq!(cjk_size_decision("LXGW WenKai Lite", at_cap + 1, false, false), CjkSizeDecision::Skip);
+        // The web build keeps the smaller general cap even for the native Chinese family.
+        assert_eq!(cjk_size_decision("LXGW WenKai Lite", MAX_OTHER_CJK_BYTES + 1, true, true), CjkSizeDecision::Reject);
+        // Japanese document/UI families are embedded whole.
+        assert_eq!(cjk_size_decision("BIZ UDPGothic", u64::MAX, false, true), CjkSizeDecision::Embed);
+        assert_eq!(cjk_cap_bytes("LXGW WenKai Lite", false), MAX_NATIVE_UI_CJK_BYTES);
+        assert_eq!(cjk_cap_bytes("LXGW WenKai Lite", true), MAX_OTHER_CJK_BYTES);
+    }
+}
diff --git a/crates/fonts/src/craft.rs b/crates/fonts/src/craft.rs
index e778a42ad7..dff96762aa 100644
--- a/crates/fonts/src/craft.rs
+++ b/crates/fonts/src/craft.rs
@@ -315,12 +315,13 @@ mod tests {
     }
 
     /// `build.rs` embeds the Japanese CJK faces whole and any other CJK face only up to
-    /// `MAX_OTHER_CJK_BYTES`, so a checkout with a large Chinese or Korean face (craft-fonts has the
+    /// `MAX_OTHER_CJK_BYTES` (the explicitly pinned native-only LXGW UI fallback has a separate
+    /// 16 MiB cap), so a checkout with a large Chinese or Korean face (craft-fonts has the
     /// 16.4 MB Noto Sans CJK SC) leaves it out. The four Japanese faces of the pinned craft-fonts
     /// are 24.1 MB.
     #[test]
     fn cjk_faces_follow_the_size_rule() {
-        use crate::cjk_scripts::{MAX_OTHER_CJK_BYTES, WHOLE_CJK_FAMILIES, is_cjk_script};
+        use crate::cjk_scripts::{MAX_NATIVE_UI_CJK_BYTES, MAX_OTHER_CJK_BYTES, NATIVE_UI_CJK_FAMILIES, WHOLE_CJK_FAMILIES, is_cjk_script};
         // A tag can carry a region after the code: craft-fonts tags Noto Sans HK UI `Hant-HK`.
         assert!(["Hant-HK", "Hans", "Jpan", "Hang"].iter().all(|s| is_cjk_script(s)));
         assert!(!["Latn", "Arab", "Hebr"].iter().any(|s| is_cjk_script(s)));
@@ -328,7 +329,10 @@ mod tests {
         let (whole, other): (Vec<_>, Vec<_>) = cjk.partition(|f| WHOLE_CJK_FAMILIES.contains(&f.family));
         for face in &other {
             let len = face.bytes.len();
-            assert!(u64::try_from(len).is_ok_and(|n| n <= MAX_OTHER_CJK_BYTES), "{} is embedded at {len} bytes", face.name());
+            let native_ui = NATIVE_UI_CJK_FAMILIES.contains(&face.family);
+            assert!(!cfg!(target_arch = "wasm32") || !native_ui, "native UI face in web payload");
+            let cap = if native_ui { MAX_NATIVE_UI_CJK_BYTES } else { MAX_OTHER_CJK_BYTES };
+            assert!(u64::try_from(len).is_ok_and(|n| n <= cap), "{} is embedded at {len} bytes", face.name());
         }
         let bytes: usize = whole.iter().map(|f| f.bytes.len()).sum();
         assert!(bytes < 25_000_000, "{bytes} bytes of Japanese faces");
diff --git a/crates/fonts/src/pdf.rs b/crates/fonts/src/pdf.rs
index 6e7ac7a8c2..240b1c4d55 100644
--- a/crates/fonts/src/pdf.rs
+++ b/crates/fonts/src/pdf.rs
@@ -1330,818 +1330,7 @@ fn identity_to_unicode() -> Vec<u8> {
 }
 
 #[cfg(test)]
-mod tests {
-    use pdfcraft_cos::{Dict, Document, Object, Stream};
-
-    use super::*;
-
-    /// Span records read while `f` runs.
-    fn span_reads(f: impl FnOnce()) -> usize {
-        SPAN_READS.with(|c| c.set(0));
-        f();
-        SPAN_READS.with(|c| c.get())
-    }
-
-    /// A composite font with `encoding` as its CMap, `w` as its widths and `to_unicode`.
-    fn composite(doc: &mut Document, encoding: &str, w: Vec<Object>, to_unicode: &str) -> Dict {
-        let mut desc = Dict::new();
-        desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
-        desc.set(b"W".to_vec(), Object::Array(w));
-        let enc = Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), encoding.as_bytes()))));
-        let tu = Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), to_unicode.as_bytes()))));
-        font(
-            doc,
-            vec![
-                ("Subtype", Object::name("Type0")),
-                ("Encoding", enc),
-                ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
-                ("ToUnicode", tu),
-            ],
-        )
-    }
-
-    /// Many `/W` ranges that leave a code out cost a glyph of it a binary search, not a scan of them all.
-    #[test]
-    fn widths_of_a_code_no_range_covers_take_few_steps() {
-        let mut doc = Document::new_empty();
-        let w: Vec<Object> = (1..=10_000i64).flat_map(|k| [Object::Int(2 * k), Object::Int(2 * k), Object::Int(500)]).collect();
-        let f = composite(&mut doc, "", w, "");
-        let m = Metrics::from_dict(&doc, &f);
-        assert_eq!(m.width(4), 0.5);
-        let reads = span_reads(|| {
-            for _ in 0..1000 {
-                assert_eq!(m.width(3), 1.0);
-            }
-        });
-        assert!(reads <= 1000 * 64, "{reads} span reads");
-    }
-
-    /// Where spans overlap, the first-declared one wins, as a scan in declaration order finds it.
-    #[test]
-    fn overlapping_spans_resolve_to_the_first_declared() {
-        let spans = Spans::new(vec![(0, 10, 'a'), (5, 20, 'b'), (3, 3, 'c'), (30, 25, 'd'), (u32::MAX, u32::MAX, 'e')]);
-        let found = |code| spans.find(code).map(|s| s.2);
-        let want = [(0, Some('a')), (3, Some('a')), (10, Some('a')), (11, Some('b')), (20, Some('b')), (21, None), (27, None), (u32::MAX, Some('e'))];
-        for (code, value) in want {
-            assert_eq!(found(code), value, "code {code}");
-        }
-    }
-
-    /// Checking the glyph of every explicit ToUnicode entry looks its code up once in the CID map.
-    #[test]
-    fn many_unicode_entries_look_up_their_cids_in_few_steps() {
-        let n = 2000;
-        let cidchars: String = (0..n).map(|k| format!("<{:04X}> {} ", 0x8000 + k, k + 1)).collect();
-        let encoding = format!("1 begincodespacerange <0000> <FFFF> endcodespacerange {n} begincidchar {cidchars} endcidchar");
-        let bfchars: String = (0..n).map(|k| format!("<{:04X}> <{:04X}> ", 0x1000 + k, 0x4E00 + k)).collect();
-        let to_unicode = format!("{n} beginbfchar {bfchars} endbfchar");
-        let mut doc = Document::new_empty();
-        let f = composite(&mut doc, &encoding, Vec::new(), &to_unicode);
-        let reads = span_reads(|| {
-            Metrics::from_dict(&doc, &f);
-        });
-        assert!(reads <= n * 64, "{reads} span reads");
-    }
-
-    /// Every glyph of a sequential range builds its text from the destination, so a long one is cut
-    /// to the CMap limit once, when it is read.
-    #[test]
-    fn unicode_destinations_are_cut_to_the_cmap_limit() {
-        let long = "0041".repeat(4096);
-        let cmap = format!("2 beginbfrange <0010> <0020> <{long}> <0030> <0030> [<{long}>] endbfrange 1 beginbfchar <0040> <{long}> endbfchar");
-        let mut u = Unicode::default();
-        parse_to_unicode(cmap.as_bytes(), &mut u);
-        for code in [0x10, 0x20, 0x30, 0x40] {
-            let text = u.text(code).unwrap_or_default();
-            assert!(!text.is_empty() && text.len() <= MAX_DESTINATION_UNITS * 3, "code {code:#x}: {} bytes", text.len());
-        }
-    }
-
-    /// A font whose ranges cover a few low codes keeps tables that size, not a fixed 64k-entry one.
-    #[test]
-    fn low_code_tables_end_with_the_last_covered_code() {
-        // One range over codes 0x20..=0x21, then nothing.
-        let cover = [(0x20u64, Some(0usize)), (0x22, None)];
-        let owner = super::owners_below_64k(&cover);
-        assert_eq!(owner.len(), 0x22);
-        assert_eq!((owner[0x1F], owner[0x20], owner[0x21]), (u32::MAX, 0, 0));
-        assert!(super::owners_below_64k(&[(0x2_0000, Some(0))]).is_empty(), "no code below 65 536");
-        let bits = super::bit_set_below_64k([3u32, 130, 0x2_0000].into_iter());
-        assert_eq!(bits.len(), 3);
-        assert_eq!((bits[0], bits[2]), (1 << 3, 1 << 2));
-        assert!(super::bit_set_below_64k([0x1_0000u32].into_iter()).is_empty());
-    }
-
-    fn font(doc: &mut Document, entries: Vec<(&str, Object)>) -> Dict {
-        let mut d = Dict::new();
-        d.set(b"Type".to_vec(), Object::name("Font"));
-        for (k, v) in entries {
-            d.set(k.as_bytes().to_vec(), v);
-        }
-        let _ = doc;
-        d
-    }
-
-    #[test]
-    fn embedded_editor_fonts_are_validated_without_installing_or_exporting() {
-        use pdfcraft_cos::Stream;
-        let mut doc = Document::new_empty();
-        let bytes = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
-        let program = doc.add(Object::Stream(Stream::flate(Dict::new(), bytes)));
-        let mut descriptor = Dict::new();
-        descriptor.set(b"FontFile2".to_vec(), Object::Ref(program));
-        let simple = font(&mut doc, vec![("FontDescriptor", Object::Dict(descriptor.clone()))]);
-        assert_eq!(embedded_sfnt(&doc, &simple).unwrap(), bytes);
-        let composite = font(&mut doc, vec![("DescendantFonts", Object::Array(vec![Object::Dict(simple.clone())]))]);
-        assert_eq!(embedded_sfnt(&doc, &composite).unwrap(), bytes);
-        let broken = doc.add(Object::Stream(Stream::flate(Dict::new(), b"broken font")));
-        descriptor.set(b"FontFile2".to_vec(), Object::Ref(broken));
-        let broken = font(&mut doc, vec![("FontDescriptor", Object::Dict(descriptor))]);
-        assert!(embedded_sfnt(&doc, &broken).is_none());
-        assert!(embedded_sfnt(&doc, &Dict::new()).is_none());
-    }
-
-    /// #2130: with no `/Widths`, an embedded program's advances win over a guess from the name
-    /// ("Mono" would mean Courier, 600 units for every glyph).
-    #[test]
-    fn a_font_without_widths_measures_with_its_embedded_program() {
-        use pdfcraft_cos::Stream;
-        use skrifa::MetadataProvider as _;
-        let mut doc = Document::new_empty();
-        let bytes = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
-        let face = skrifa::FontRef::new(bytes).unwrap();
-        let (size, location) = (skrifa::instance::Size::unscaled(), skrifa::instance::LocationRef::default());
-        let upem = f64::from(face.metrics(size, location).units_per_em);
-        let advance = |c: char| f64::from(face.glyph_metrics(size, location).advance_width(face.charmap().map(c).unwrap()).unwrap()) / upem;
-        let program = doc.add(Object::Stream(Stream::flate(Dict::new(), bytes)));
-        let mut descriptor = Dict::new();
-        descriptor.set(b"FontFile2".to_vec(), Object::Ref(program));
-        let f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("TrueType")),
-                ("BaseFont", Object::name("HouseMono")),
-                ("Encoding", Object::name("WinAnsiEncoding")),
-                ("FontDescriptor", Object::Dict(descriptor)),
-            ],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        for c in ['i', 'l', 'W', ' '] {
-            assert!((m.width(u32::from(c)) - advance(c)).abs() < 1e-9, "{c}: {} vs {}", m.width(u32::from(c)), advance(c));
-        }
-        assert!(m.width(u32::from('i')) < 0.4, "not Courier's 0.6");
-    }
-
-    #[test]
-    fn mac_subset_cmap_uses_pdf_unicode_without_changing_source_program() {
-        use skrifa::{MetadataProvider as _, raw::TableProvider as _};
-        let original = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
-        let face = skrifa::FontRef::new(original).unwrap();
-        let expected = face.charmap().map('Ω').unwrap();
-        let mut subset = original.to_vec();
-        let count = u16::from_be_bytes(subset[4..6].try_into().unwrap()) as usize;
-        let entry = (0..count).map(|i| 12 + i * 16).find(|i| &subset[*i..*i + 4] == b"cmap").unwrap();
-        let mut cmap = vec![0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 12];
-        cmap.extend_from_slice(&[0, 6, 0, 12, 0, 0, 0, 65, 0, 1]);
-        cmap.extend_from_slice(&u16::try_from(expected.to_u32()).unwrap().to_be_bytes());
-        let offset = subset.len() as u32;
-        subset[entry + 8..entry + 12].copy_from_slice(&offset.to_be_bytes());
-        subset[entry + 12..entry + 16].copy_from_slice(&(cmap.len() as u32).to_be_bytes());
-        subset.extend_from_slice(&cmap);
-        let face = skrifa::FontRef::new(&subset).unwrap();
-        assert!(!face.charmap().has_map(), "egui cannot directly use Mac format 6");
-        assert_eq!(face.cmap().unwrap().map_codepoint(65_u32), Some(expected));
-        let mut doc = Document::new_empty();
-        let program = doc.add(Object::Stream(Stream::flate(Dict::new(), &subset)));
-        let mut descriptor = Dict::new();
-        descriptor.set(b"FontFile2".to_vec(), Object::Ref(program));
-        let unicode = doc.add(Object::Stream(Stream::flate(Dict::new(), b"1 beginbfchar <41> <03A9> endbfchar")));
-        let source = font(&mut doc, vec![("FontDescriptor", Object::Dict(descriptor)), ("ToUnicode", Object::Ref(unicode))]);
-        let editor = embedded_sfnt(&doc, &source).unwrap();
-        let face = skrifa::FontRef::new(&editor).unwrap();
-        assert_eq!(face.charmap().map('Ω'), Some(expected), "Unicode selects the original glyph");
-        let Object::Stream(source) = doc.resolve(&Object::Ref(program)).as_ref().clone() else {
-            panic!("source stream");
-        };
-        assert_eq!(source.decoded().unwrap(), subset, "only an in-memory editor copy is adapted");
-        let mut broken = vec![0; 16];
-        assert!(append_editor_cmap(&mut broken, &std::collections::BTreeMap::from([(65, 1)])).is_none());
-    }
-
-    fn metrics_with_flags(flags: Option<Object>) -> Metrics {
-        let mut doc = Document::new_empty();
-        let mut descriptor = Dict::new();
-        if let Some(flags) = flags {
-            descriptor.set(b"Flags".to_vec(), flags);
-        }
-        let font = font(&mut doc, vec![("Subtype", Object::name("TrueType")), ("FontDescriptor", Object::Dict(descriptor))]);
-        Metrics::from_dict(&doc, &font)
-    }
-
-    #[test]
-    fn font_descriptor_flags_stay_within_the_u32_domain() {
-        let valid = metrics_with_flags(Some(Object::Int(64 | 262_144)));
-        assert!(valid.italic && valid.bold);
-
-        for flags in [Some(Object::Int(-1)), Some(Object::Int(4_294_967_296)), Some(Object::Bool(true)), None] {
-            let metrics = metrics_with_flags(flags);
-            assert!(!metrics.italic && !metrics.bold);
-        }
-    }
-
-    #[test]
-    fn type3_descriptor_names_the_font_without_changing_its_metrics() {
-        let mut doc = Document::new_empty();
-        let mut f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("Type3")),
-                (
-                    "FontMatrix",
-                    Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
-                ),
-                ("FontBBox", Object::Array(vec![Object::Int(0), Object::Int(-300), Object::Int(1000), Object::Int(1000)])),
-            ],
-        );
-        let before = Metrics::from_dict(&doc, &f);
-        let mut descriptor = Dict::new();
-        descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
-        descriptor.set(b"FontName".to_vec(), Object::name("ExampleMincho-Regular"));
-        descriptor.set(b"Flags".to_vec(), Object::Int(6));
-        descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
-        let reference = doc.add(Object::Dict(descriptor));
-        f.set(b"FontDescriptor".to_vec(), Object::Ref(reference));
-        let after = Metrics::from_dict(&doc, &f);
-        assert_eq!(after.base_font, "ExampleMincho-Regular");
-        assert_eq!((after.ascent, after.descent, after.scale), (before.ascent, before.descent, before.scale));
-        assert!(!after.bold && !after.italic && !after.subset);
-        f.set(b"BaseFont".to_vec(), Object::name("ExplicitName"));
-        assert_eq!(Metrics::from_dict(&doc, &f).base_font, "ExplicitName", "an explicit BaseFont takes precedence");
-    }
-
-    #[test]
-    fn simple_fonts_decode_and_encode_through_their_encoding() {
-        let mut doc = Document::new_empty();
-        let f = font(
-            &mut doc,
-            vec![("Subtype", Object::name("Type1")), ("BaseFont", Object::name("Helvetica")), ("Encoding", Object::name("WinAnsiEncoding"))],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        assert_eq!(m.decode(b"Caf\xe9 \x80 \x93x\x94"), "Café € “x”");
-        assert_eq!(m.encode("Café €").as_deref(), Some(&b"Caf\xe9 \x80"[..]));
-        assert_eq!(m.encode("Ω"), None, "not in WinAnsi");
-        // Differences rename codes by glyph name.
-        let mut enc = Dict::new();
-        enc.set(b"Differences".to_vec(), Object::Array(vec![Object::Int(65), Object::name("eacute"), Object::name("uni03A9")]));
-        let f = font(&mut doc, vec![("Subtype", Object::name("Type1")), ("BaseFont", Object::name("Custom")), ("Encoding", Object::Dict(enc))]);
-        let m = Metrics::from_dict(&doc, &f);
-        assert_eq!(m.decode(b"AB"), "éΩ");
-        assert_eq!(m.encode("Ω").as_deref(), Some(&b"B"[..]));
-    }
-
-    /// A standard-14 font with no `/Widths` is measured by the glyph each code draws, not by the
-    /// glyph WinAnsi gives that code (#2894); `/Widths`, when present, still go by code.
-    #[test]
-    fn standard_fonts_without_widths_measure_the_glyph_their_differences_name() {
-        let mut doc = Document::new_empty();
-        let mut enc = Dict::new();
-        enc.set(b"BaseEncoding".to_vec(), Object::name("WinAnsiEncoding"));
-        let diffs =
-            vec![Object::Int(65), Object::name("W"), Object::Int(87), Object::name("A"), Object::name("uni03A9"), Object::name("not.a.glyph")];
-        enc.set(b"Differences".to_vec(), Object::Array(diffs));
-        let f = font(
-            &mut doc,
-            vec![("Subtype", Object::name("Type1")), ("BaseFont", Object::name("Helvetica")), ("Encoding", Object::Dict(enc.clone()))],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        assert_eq!((m.width(65), m.width(87)), (0.944, 0.667), "A and W swap their widths");
-        // Omega has no WinAnsi code and the last name reads as nothing: both keep their code's width.
-        assert_eq!((m.width(88), m.width(89)), (0.667, 0.667));
-        let f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("Type1")),
-                ("BaseFont", Object::name("Helvetica")),
-                ("FirstChar", Object::Int(87)),
-                ("Widths", Object::Array(vec![Object::Int(500)])),
-                ("Encoding", Object::Dict(enc)),
-            ],
-        );
-        assert_eq!(Metrics::from_dict(&doc, &f).width(87), 0.5, "/Widths go by code");
-    }
-
-    #[test]
-    fn subset_fonts_only_encode_the_glyphs_they_have() {
-        let mut doc = Document::new_empty();
-        // Widths for a, b only (97, 98); c (99) is 0.
-        let widths = Object::Array(vec![Object::Int(500), Object::Int(520), Object::Int(0)]);
-        let f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("TrueType")),
-                ("BaseFont", Object::name("ABCDEF+Arial")),
-                ("FirstChar", Object::Int(97)),
-                ("Widths", widths),
-                ("Encoding", Object::name("WinAnsiEncoding")),
-            ],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        assert!(m.subset);
-        assert_eq!(m.encode("ab").as_deref(), Some(&b"ab"[..]));
-        assert_eq!(m.encode("abc"), None);
-    }
-
-    #[test]
-    fn cmap_streams_decode_within_a_size_cap() {
-        // A valid CMap padded past the cap (a small Flate stream of whitespace) is not decoded whole.
-        let to_unicode = b"1 begincodespacerange <0000> <FFFF> endcodespacerange 1 beginbfrange <0024> <0026> <0041> endbfrange";
-        let encoding = b"1 begincodespacerange <0000> <FFFF> endcodespacerange 1 begincidrange <0000> <FFFF> 0 endcidrange";
-        for padded in [false, true] {
-            let mut doc = Document::new_empty();
-            let mut stream = |cmap: &[u8]| {
-                let mut data = cmap.to_vec();
-                if padded {
-                    data.resize(MAX_CMAP_BYTES + 1, b' ');
-                }
-                Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), &data))))
-            };
-            let (tu, enc) = (stream(to_unicode), stream(encoding));
-            let mut desc = Dict::new();
-            desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
-            let f = font(
-                &mut doc,
-                vec![
-                    ("Subtype", Object::name("Type0")),
-                    ("Encoding", enc),
-                    ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
-                    ("ToUnicode", tu),
-                ],
-            );
-            let m = Metrics::from_dict(&doc, &f);
-            assert_eq!(m.decode(&[0, 0x24]) == "A", !padded, "ToUnicode, padded: {padded}");
-            assert_eq!(matches!(m.codes, Codes::Ranges(_)), !padded, "Encoding, padded: {padded}");
-        }
-    }
-
-    #[test]
-    fn composite_fonts_use_to_unicode() {
-        let mut doc = Document::new_empty();
-        let cmap = b"/CIDInit /ProcSet findresource begin 1 begincodespacerange <0000> <FFFF> endcodespacerange \
-            2 beginbfchar <0003> <0020> <0010> <00E9> endbfchar 1 beginbfrange <0024> <0026> <0041> endbfrange \
-            1 beginbfrange <0030> <0031> [<0048> <0069>] endbfrange end";
-        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
-        let mut desc = Dict::new();
-        desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
-        desc.set(
-            b"W".to_vec(),
-            Object::Array(vec![
-                Object::Int(3),
-                Object::Array(vec![Object::Int(250)]),
-                Object::Int(16),
-                Object::Int(16),
-                Object::Int(500),
-                Object::Int(36),
-                Object::Int(49),
-                Object::Int(600),
-            ]),
-        );
-        let f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("Type0")),
-                ("BaseFont", Object::name("QWERTY+Noto")),
-                ("Encoding", Object::name("Identity-H")),
-                ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
-                ("ToUnicode", Object::Ref(tu)),
-            ],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        assert_eq!(m.decode(&[0, 0x24, 0, 0x25, 0, 3, 0, 0x30, 0, 0x31, 0, 0x10]), "AB Hié");
-        assert_eq!(m.encode("Hi A").as_deref(), Some(&[0, 0x30, 0, 0x31, 0, 3, 0, 0x24][..]));
-        assert_eq!(m.encode("Z"), None);
-    }
-
-    /// Word's Type 0 subsets map CID 0 as well as the real space glyph to U+0020 and give CID 0 a
-    /// width; CID 0 is `.notdef`, so a typed space takes the real one (#3223).
-    #[test]
-    fn composite_fonts_never_encode_with_cid_0() {
-        let mut doc = Document::new_empty();
-        let cmap = b"/CIDInit /ProcSet findresource begin 1 begincodespacerange <0000> <FFFF> endcodespacerange \
-            1 beginbfrange <0000> <0002> [<0020> <004D> <00E1>] endbfrange \
-            1 beginbfrange <0005> <0007> [<0065> <0072> <0020>] endbfrange end";
-        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
-        let mut desc = Dict::new();
-        desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
-        let widths = [889, 444, 389, 278, 444, 333, 250].map(Object::Int).to_vec();
-        desc.set(b"W".to_vec(), Object::Array(vec![Object::Int(0), Object::Array(vec![Object::Int(778)]), Object::Int(1), Object::Array(widths)]));
-        let f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("Type0")),
-                ("BaseFont", Object::name("BCDEEE+TimesNewRomanPSMT")),
-                ("Encoding", Object::name("Identity-H")),
-                ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
-                ("ToUnicode", Object::Ref(tu)),
-            ],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        assert_eq!(m.encode("Me er").as_deref(), Some(&[0, 1, 0, 5, 0, 7, 0, 5, 0, 6][..]));
-        assert_eq!(m.decode(&[0, 1, 0, 7, 0, 2]), "M á");
-    }
-
-    /// WSCAD writes `/ToUnicode /Identity-H` (a name, not a CMap stream) on composite fonts whose
-    /// codes are UTF-16 code units: the codes read as the same Unicode, as in Acrobat. Controls
-    /// and lone surrogates map to nothing, and a simple font's name is not a ToUnicode map.
-    #[test]
-    fn identity_to_unicode_names_read_codes_as_unicode() {
-        let doc = Document::new_empty();
-        for name in ["Identity-H", "Identity-V"] {
-            let f = font(
-                &mut Document::new_empty(),
-                vec![
-                    ("Subtype", Object::name("Type0")),
-                    ("BaseFont", Object::name("RobotoMono-Regular")),
-                    ("Encoding", Object::name("Identity-H")),
-                    ("DescendantFonts", Object::Array(vec![Object::Dict(Dict::new())])),
-                    ("ToUnicode", Object::name(name)),
-                ],
-            );
-            let m = Metrics::from_dict(&doc, &f);
-            assert_eq!(m.decode(&[0, b'Z', 0, 0xFC, 0, b'r', 0x20, 0xAC, 0x4E, 0x2D]), "Zür€中", "{name}");
-            assert_eq!(m.text_of(0x0001), None);
-            assert_eq!(m.text_of(0x007F), None, "DEL is a control");
-            assert_eq!(m.text_of(0x0085), None, "a C1 control");
-            assert_eq!(m.text_of(0x00A0).as_deref(), Some("\u{A0}"), "the range resumes after C1");
-            assert_eq!(m.text_of(0x007E).as_deref(), Some("~"));
-            assert_eq!(m.text_of(0xD800), None);
-            assert_eq!(m.text_of(0xFFFD).as_deref(), Some("\u{FFFD}"));
-        }
-        let simple = font(
-            &mut Document::new_empty(),
-            vec![("Subtype", Object::name("TrueType")), ("BaseFont", Object::name("Arial")), ("ToUnicode", Object::name("Identity-H"))],
-        );
-        let m = Metrics::from_dict(&doc, &simple);
-        assert_eq!(m.text_of(0x41).as_deref(), Some("A"), "the encoding still applies");
-    }
-
-    /// Chrome's subsets leave the glyphs of `/DW` width out of `/W` (#1443): "s" (CID 0x56) is
-    /// still in the font, but nothing is when the font gives no default width to point at.
-    #[test]
-    fn composite_subset_glyphs_of_the_default_width_are_present() {
-        let metrics = |dw: bool| {
-            let mut doc = Document::new_empty();
-            let cmap = b"/CIDInit /ProcSet findresource begin 1 begincodespacerange <0000> <FFFF> endcodespacerange \
-                1 beginbfrange <0055> <0057> <0072> endbfrange end";
-            let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
-            let mut desc = Dict::new();
-            desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
-            if dw {
-                desc.set(b"DW".to_vec(), Object::Int(500));
-            }
-            desc.set(
-                b"W".to_vec(),
-                Object::Array(vec![
-                    Object::Int(0x55),
-                    Object::Array(vec![Object::Int(333)]),
-                    Object::Int(0x57),
-                    Object::Array(vec![Object::Int(277)]),
-                ]),
-            );
-            let f = font(
-                &mut doc,
-                vec![
-                    ("Subtype", Object::name("Type0")),
-                    ("BaseFont", Object::name("AAAAAA+LiberationSans")),
-                    ("Encoding", Object::name("Identity-H")),
-                    ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
-                    ("ToUnicode", Object::Ref(tu)),
-                ],
-            );
-            Metrics::from_dict(&doc, &f)
-        };
-        let chrome = metrics(true);
-        assert_eq!(chrome.encode("rst").as_deref(), Some(&[0, 0x55, 0, 0x56, 0, 0x57][..]));
-        assert_eq!(chrome.width(0x56), 0.5);
-        assert_eq!(chrome.encode("x"), None, "a character the ToUnicode map doesn't give");
-        assert_eq!(metrics(false).encode("s"), None);
-    }
-
-    /// A `/W` run that starts at the last CID stops there instead of overflowing onto CID 0.
-    #[test]
-    fn composite_width_run_past_the_last_cid_is_dropped() {
-        let widths = |first: i64| {
-            let mut doc = Document::new_empty();
-            let mut desc = Dict::new();
-            desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
-            desc.set(b"DW".to_vec(), Object::Int(1000));
-            desc.set(b"W".to_vec(), Object::Array(vec![Object::Int(first), Object::Array(vec![Object::Int(100), Object::Int(200)])]));
-            let f = font(
-                &mut doc,
-                vec![
-                    ("Subtype", Object::name("Type0")),
-                    ("Encoding", Object::name("Identity-H")),
-                    ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
-                ],
-            );
-            Metrics::from_dict(&doc, &f)
-        };
-        let ordinary = widths(0);
-        assert_eq!((ordinary.width(0), ordinary.width(1)), (0.1, 0.2));
-        let last = widths(i64::from(u32::MAX));
-        assert_eq!((last.width(0), last.width(u32::MAX)), (1.0, 0.1));
-    }
-
-    #[test]
-    fn glyph_names() {
-        assert_eq!(glyph_unicode("quotedblleft"), Some('“'));
-        assert_eq!(glyph_unicode("uni20AC"), Some('€'));
-        assert_eq!(glyph_unicode("u1F600"), Some('😀'));
-        assert_eq!(glyph_unicode("nonsense"), None);
-    }
-
-    fn to_unicode(cmap: &[u8]) -> HashMap<u32, String> {
-        let mut u = Unicode::default();
-        parse_to_unicode(cmap, &mut u);
-        let codes: Vec<u32> = u.explicit.keys().copied().chain(u.ranges.iter().flat_map(|r| r.lo..=r.hi)).collect();
-        codes.into_iter().filter_map(|c| u.text(c).map(|t| (c, t.into_owned()))).collect()
-    }
-
-    #[test]
-    fn cmap_tokens_need_no_space_between_them() {
-        // Hex strings, brackets and operators may touch; comments and literal strings are skipped.
-        let cmap = b"/CIDSystemInfo << /Registry (Adobe (x) \\) beginbfchar) >> def % beginbfchar <0001> <0058>\n\
-            2 beginbfchar<0003><0020><0010><00 E9>endbfchar \
-            1 beginbfrange<0024><0026><0041>endbfrange 1 beginbfrange<0030><0031>[<0048><0069>]endbfrange";
-        let map = to_unicode(cmap);
-        let mut got: Vec<_> = map.iter().map(|(c, u)| (*c, u.as_str())).collect();
-        got.sort_unstable();
-        assert_eq!(got, [(3, " "), (0x10, "é"), (0x24, "A"), (0x25, "B"), (0x26, "C"), (0x30, "H"), (0x31, "i")]);
-        let (spaces, cids) = parse_cmap(b"1 begincodespacerange<00><FF>endcodespacerange 1 begincidrange<20><7E>1 endcidrange");
-        assert_eq!(spaces, [(1, vec![0], vec![0xff])]);
-        assert_eq!(cids, [(0x20, 0x7e, 1)]);
-    }
-
-    #[test]
-    fn malformed_cmaps_never_panic() {
-        // Non-ASCII bytes inside hex strings once split a UTF-8 character and panicked.
-        for cmap in [
-            "1 beginbfchar <0é0> <0041> <AéB> <0042> endbfchar".as_bytes(),
-            "1 beginbfrange <0é0> <00é> <0041> endbfrange".as_bytes(),
-            b"1 beginbfchar <0001> <004",
-            b"1 beginbfchar <123> <0041> <0002> <zz> <0003> endbfchar",
-            b"1 beginbfrange <FFFF> <0001> [<0041>] endbfrange",
-            b"1 beginbfrange <0001> <0002> [<0041> (",
-            b"1 beginbfrange <0001>",
-            b"\xff\xfe beginbfchar \x80<\xc3\xa9> <0041> endbfchar %",
-        ] {
-            to_unicode(cmap);
-            parse_cmap(cmap);
-        }
-        // Code counters at the top of the range stop instead of overflowing.
-        let map = to_unicode(b"1 beginbfrange <FFFFFFFE> <FFFFFFFF> [<0041> <0042> <0043>] endbfrange");
-        assert_eq!(map.len(), 2);
-        assert_eq!(map.get(&u32::MAX).map(String::as_str), Some("B"));
-        // A malformed array entry keeps its place, so the next one maps the next code.
-        let map = to_unicode(b"1 beginbfrange <0001> <0003> [<0041> <zz> <0043>] endbfrange");
-        assert_eq!((map.get(&2), map.get(&3).map(String::as_str)), (None, Some("C")));
-        let mut m = Metrics::fallback();
-        m.cid_map = Spans::new(parse_cmap(b"1 begincidrange <0000> <FFFF> 4294967295 endcidrange").1);
-        assert_eq!(m.cid(5), u32::MAX);
-        let mut doc = Document::new_empty();
-        let mut enc = Dict::new();
-        enc.set(b"Differences".to_vec(), Object::Array(vec![Object::Int(i64::MAX), Object::name("A"), Object::name("B")]));
-        let f = font(&mut doc, vec![("Subtype", Object::name("Type1")), ("Encoding", Object::Dict(enc))]);
-        assert_eq!(unicode_map(&doc, &f, false).text(u32::MAX).as_deref(), Some("B"));
-    }
-
-    #[test]
-    fn sequential_ranges_past_the_entry_cap_still_map() {
-        // 17 ranges of 65 536 codes: 1 114 112 codes from 0.4 KB of CMap, more than MAX_CMAP_ENTRIES
-        // (the first 16 ranges use up the whole cap). Each range maps its codes upward from 'A', so
-        // the last code of the last range, 0x100019, is 'A' + 0x19 = 'Z'.
-        let mut cmap = b"17 beginbfrange ".to_vec();
-        for k in 0..17u32 {
-            cmap.extend(format!("<{:08X}> <{:08X}> <0041> ", k << 16, (k << 16) | 0xffff).bytes());
-        }
-        cmap.extend(b"endbfrange");
-        let mut doc = Document::new_empty();
-        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap)));
-        let f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("Type0")),
-                ("BaseFont", Object::name("Wide")),
-                ("Encoding", Object::name("Identity-H")),
-                ("ToUnicode", Object::Ref(tu)),
-            ],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        assert_eq!(m.text_of(0x0010_0019).as_deref(), Some("Z"));
-    }
-
-    #[test]
-    fn a_cmap_adds_at_most_max_entries() {
-        // 200 ranges of 65 536 codes would be 13 million codes from 4 KB of stream: 200 records.
-        let mut cmap = b"200 beginbfrange ".to_vec();
-        for k in 0..200u32 {
-            cmap.extend(format!("<{:08X}> <{:08X}> <0041> ", k << 16, (k << 16) | 0xffff).bytes());
-        }
-        cmap.extend(b"endbfrange");
-        let mut u = Unicode::default();
-        parse_to_unicode(&cmap, &mut u);
-        assert_eq!((u.ranges.len(), u.explicit.len()), (200, 0));
-        // Explicit entries are what the budget counts: 250 of the 300 here are kept.
-        let mut many = b"300 beginbfchar ".to_vec();
-        for k in 0..300u32 {
-            many.extend(format!("<{k:04X}> <{:04X}> ", 0x4E00 + k).bytes());
-        }
-        many.extend(b"endbfchar");
-        let mut u = Unicode::default();
-        parse_to_unicode_within(&many, &mut u, 250);
-        assert_eq!((u.explicit.len(), u.text(249).is_some(), u.text(250).is_some()), (250, true, false));
-        let mut many = b"begincidrange ".to_vec();
-        for k in 0..MAX_CMAP_RANGES + 10 {
-            many.extend(format!("<{k:08X}> <{k:08X}> 1 ").bytes());
-        }
-        assert_eq!(parse_cmap(&many).1.len(), MAX_CMAP_RANGES);
-    }
-
-    #[test]
-    fn a_range_is_one_record_however_many_codes() {
-        let mut u = Unicode::default();
-        parse_to_unicode(b"1 beginbfrange <0000> <FFFF> <0041> endbfrange", &mut u);
-        assert_eq!((u.ranges.len(), u.explicit.len()), (1, 0));
-        assert_eq!(u.text(0xFFFF).as_deref(), Some("@"), "0x41 + 0xFFFF wraps to U+0040");
-    }
-
-    #[test]
-    fn sequential_ranges_count_against_the_budget() {
-        // Range k maps codes k and k + 1 and costs two, so a budget of 250 keeps ranges 0 to 124.
-        let mut cmap = Vec::new();
-        for k in 0..300u32 {
-            cmap.extend(format!("1 beginbfrange <{k:08X}> <{:08X}> <0041> endbfrange ", k + 1).bytes());
-        }
-        let mut u = Unicode::default();
-        parse_to_unicode_within(&cmap, &mut u, 250);
-        assert_eq!((u.ranges.len(), u.text(125).is_some(), u.text(126).is_none()), (125, true, true));
-    }
-
-    #[test]
-    fn explicit_and_range_mappings_override_the_encoding() {
-        let mut doc = Document::new_empty();
-        let cmap = b"1 beginbfchar <41> <0058> endbfchar 1 beginbfrange <42> <43> <0059> endbfrange";
-        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
-        let f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("Type1")),
-                ("BaseFont", Object::name("Custom")),
-                ("Encoding", Object::name("WinAnsiEncoding")),
-                ("ToUnicode", Object::Ref(tu)),
-            ],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        let shown: Vec<Option<String>> = (0x41..=0x44).map(|c| m.text_of(c).map(|t| t.into_owned())).collect();
-        assert_eq!(shown, [Some("X".to_string()), Some("Y".to_string()), Some("Z".to_string()), Some("D".to_string())]);
-    }
-
-    /// Deterministic input for the differential test below.
-    struct Gen(u64);
-
-    impl Gen {
-        fn below(&mut self, n: u32) -> u32 {
-            self.0 = self.0.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
-            ((self.0 >> 33) % u64::from(n)) as u32
-        }
-
-        /// A destination: a unit from a pool of edge cases, a surrogate pair, or a lone high surrogate.
-        fn units(&mut self) -> Vec<u16> {
-            const POOL: [u16; 12] = [0x41, 0x42, 0xE9, 0x0, 0xFFFD, 0xFFFE, 0xFFFF, 0x100, 0x3042, 0xD800, 0xDC00, 0xDFFF];
-            match self.below(6) {
-                0 => vec![0xD835, 0xDC00 + self.below(0x400) as u16],
-                1 => vec![0xD800, 0x41],
-                _ => vec![POOL[self.below(POOL.len() as u32) as usize]],
-            }
-        }
-    }
-
-    fn hex(units: &[u16]) -> String {
-        units.iter().map(|u| format!("{u:04X}")).collect()
-    }
-
-    #[test]
-    fn lookups_match_the_expanded_mappings() {
-        // Random ToUnicode CMaps; `expected` is what expanding their entries in order gives.
-        let mut g = Gen(0x2545_f491_4f6c_dd1d);
-        for _ in 0..300 {
-            let mut cmap = String::from("1 begincodespacerange <0000> <FFFF> endcodespacerange ");
-            let mut expected: HashMap<u32, String> = HashMap::new();
-            for _ in 0..1 + g.below(12) {
-                match g.below(3) {
-                    0 => {
-                        let (code, u) = (g.below(300), g.units());
-                        cmap += &format!("1 beginbfchar <{code:04X}> <{}> endbfchar ", hex(&u));
-                        expected.insert(code, String::from_utf16_lossy(&u));
-                    }
-                    1 => {
-                        let (lo, width, u) = (g.below(300), g.below(13), g.units());
-                        cmap += &format!("1 beginbfrange <{lo:04X}> <{:04X}> <{}> endbfrange ", lo + width, hex(&u));
-                        for k in 0..=width {
-                            let mut v = u.clone();
-                            if let Some(last) = v.last_mut() {
-                                *last = last.wrapping_add(k as u16);
-                            }
-                            expected.insert(lo + k, String::from_utf16_lossy(&v));
-                        }
-                    }
-                    _ => {
-                        let (lo, width) = (g.below(300), g.below(5));
-                        let dests: Vec<Vec<u16>> = (0..=width).map(|_| g.units()).collect();
-                        let list: Vec<String> = dests.iter().map(|d| format!("<{}>", hex(d))).collect();
-                        cmap += &format!("1 beginbfrange <{lo:04X}> <{:04X}> [{}] endbfrange ", lo + width, list.join(" "));
-                        for (k, d) in dests.iter().enumerate() {
-                            expected.insert(lo + k as u32, String::from_utf16_lossy(d));
-                        }
-                    }
-                }
-            }
-            let mut doc = Document::new_empty();
-            let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.clone().into_bytes())));
-            let f = font(
-                &mut doc,
-                vec![
-                    ("Subtype", Object::name("Type0")),
-                    ("BaseFont", Object::name("Gen")),
-                    ("Encoding", Object::name("Identity-H")),
-                    ("ToUnicode", Object::Ref(tu)),
-                ],
-            );
-            let m = Metrics::from_dict(&doc, &f);
-            for code in 0..=320u32 {
-                let got = m.text_of(code).map(|t| t.into_owned());
-                assert_eq!(got, expected.get(&code).cloned(), "code {code:#06x} in {cmap}");
-            }
-            let mut reverse: HashMap<char, u32> = HashMap::new();
-            // Code 0 is CID 0, `.notdef`, which no character is encoded with.
-            for (&code, text) in expected.iter().filter(|&(&code, _)| code != 0) {
-                if let Some(c) = only_char(text) {
-                    keep(&mut reverse, c, code);
-                }
-            }
-            let mut chars: Vec<char> = expected.values().flat_map(|t| t.chars()).chain(['A', '\u{FFFD}', '\u{0}', '\u{1D400}']).collect();
-            chars.sort_unstable();
-            chars.dedup();
-            for c in chars {
-                let want = reverse.get(&c).map(|code| code.to_be_bytes()[2..].to_vec());
-                assert_eq!(m.encode(&c.to_string()), want, "char {c:?} in {cmap}");
-            }
-        }
-    }
-
-    #[test]
-    fn fffd_lookups_skip_overridden_surrogates() {
-        // Each record maps every code to itself, so its surrogate offsets decode to U+FFFD. The last
-        // record overrides the surrogates with letters, so each lookup walks past them to U+FFFD itself.
-        let mut cmap = "1 beginbfrange <0000> <FFFF> <0000> endbfrange ".repeat(300);
-        cmap.push_str("1 beginbfrange <D800> <DFFF> <0041> endbfrange");
-        let mut doc = Document::new_empty();
-        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.into_bytes())));
-        let f = font(
-            &mut doc,
-            vec![
-                ("Subtype", Object::name("Type0")),
-                ("BaseFont", Object::name("Gen")),
-                ("Encoding", Object::name("Identity-H")),
-                ("ToUnicode", Object::Ref(tu)),
-            ],
-        );
-        let m = Metrics::from_dict(&doc, &f);
-        assert_eq!(m.encode("\u{FFFD}"), Some(vec![0xFF, 0xFD]));
-    }
-
-    #[test]
-    fn hostile_ranges_stay_bounded() {
-        // A range wider than 65 536 codes is ignored, a reversed one maps nothing, and a maximal
-        // one-code range maps just its own code.
-        let mut u = Unicode::default();
-        let cmap = b"1 beginbfrange <00000000> <FFFFFFFF> <0041> endbfrange \
-            1 beginbfrange <0005> <0001> <0041> endbfrange \
-            1 beginbfrange <FFFFFFFF> <FFFFFFFF> <FFFF> endbfrange";
-        parse_to_unicode(cmap, &mut u);
-        assert_eq!((u.ranges.len(), u.text(u32::MAX).as_deref()), (0, Some("\u{FFFF}")));
-    }
-
-    #[test]
-    fn low_codes_resolve_to_the_covering_range() {
-        let mut u = Unicode::default();
-        let cmap = b"1 beginbfrange <0005> <0007> <0041> endbfrange 1 beginbfrange <0064> <0065> <0042> endbfrange \
-            1 beginbfrange <0000FFFE> <00010001> <0043> endbfrange";
-        parse_to_unicode(cmap, &mut u);
-        let covered: Vec<u32> = (0..0x70).filter(|&c| u.covering(c).is_some()).collect();
-        assert_eq!(covered, [5, 6, 7, 100, 101]);
-        assert_eq!((u.covering(0xFFFF).is_some(), u.covering(0x1_0001).is_some(), u.covering(0x1_0002).is_none()), (true, true, true));
-    }
-}
+mod tests;
 
 #[cfg(test)]
 mod encoding_tests {
diff --git a/crates/fonts/src/pdf/tests.rs b/crates/fonts/src/pdf/tests.rs
new file mode 100644
index 0000000000..c2acef191c
--- /dev/null
+++ b/crates/fonts/src/pdf/tests.rs
@@ -0,0 +1,797 @@
+use pdfcraft_cos::{Dict, Document, Object, Stream};
+
+use super::*;
+
+/// Span records read while `f` runs.
+fn span_reads(f: impl FnOnce()) -> usize {
+    SPAN_READS.with(|c| c.set(0));
+    f();
+    SPAN_READS.with(|c| c.get())
+}
+
+/// A composite font with `encoding` as its CMap, `w` as its widths and `to_unicode`.
+fn composite(doc: &mut Document, encoding: &str, w: Vec<Object>, to_unicode: &str) -> Dict {
+    let mut desc = Dict::new();
+    desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
+    desc.set(b"W".to_vec(), Object::Array(w));
+    let enc = Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), encoding.as_bytes()))));
+    let tu = Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), to_unicode.as_bytes()))));
+    font(
+        doc,
+        vec![("Subtype", Object::name("Type0")), ("Encoding", enc), ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])), ("ToUnicode", tu)],
+    )
+}
+
+/// Many `/W` ranges that leave a code out cost a glyph of it a binary search, not a scan of them all.
+#[test]
+fn widths_of_a_code_no_range_covers_take_few_steps() {
+    let mut doc = Document::new_empty();
+    let w: Vec<Object> = (1..=10_000i64).flat_map(|k| [Object::Int(2 * k), Object::Int(2 * k), Object::Int(500)]).collect();
+    let f = composite(&mut doc, "", w, "");
+    let m = Metrics::from_dict(&doc, &f);
+    assert_eq!(m.width(4), 0.5);
+    let reads = span_reads(|| {
+        for _ in 0..1000 {
+            assert_eq!(m.width(3), 1.0);
+        }
+    });
+    assert!(reads <= 1000 * 64, "{reads} span reads");
+}
+
+/// Where spans overlap, the first-declared one wins, as a scan in declaration order finds it.
+#[test]
+fn overlapping_spans_resolve_to_the_first_declared() {
+    let spans = Spans::new(vec![(0, 10, 'a'), (5, 20, 'b'), (3, 3, 'c'), (30, 25, 'd'), (u32::MAX, u32::MAX, 'e')]);
+    let found = |code| spans.find(code).map(|s| s.2);
+    let want = [(0, Some('a')), (3, Some('a')), (10, Some('a')), (11, Some('b')), (20, Some('b')), (21, None), (27, None), (u32::MAX, Some('e'))];
+    for (code, value) in want {
+        assert_eq!(found(code), value, "code {code}");
+    }
+}
+
+/// Checking the glyph of every explicit ToUnicode entry looks its code up once in the CID map.
+#[test]
+fn many_unicode_entries_look_up_their_cids_in_few_steps() {
+    let n = 2000;
+    let cidchars: String = (0..n).map(|k| format!("<{:04X}> {} ", 0x8000 + k, k + 1)).collect();
+    let encoding = format!("1 begincodespacerange <0000> <FFFF> endcodespacerange {n} begincidchar {cidchars} endcidchar");
+    let bfchars: String = (0..n).map(|k| format!("<{:04X}> <{:04X}> ", 0x1000 + k, 0x4E00 + k)).collect();
+    let to_unicode = format!("{n} beginbfchar {bfchars} endbfchar");
+    let mut doc = Document::new_empty();
+    let f = composite(&mut doc, &encoding, Vec::new(), &to_unicode);
+    let reads = span_reads(|| {
+        Metrics::from_dict(&doc, &f);
+    });
+    assert!(reads <= n * 64, "{reads} span reads");
+}
+
+/// Every glyph of a sequential range builds its text from the destination, so a long one is cut
+/// to the CMap limit once, when it is read.
+#[test]
+fn unicode_destinations_are_cut_to_the_cmap_limit() {
+    let long = "0041".repeat(4096);
+    let cmap = format!("2 beginbfrange <0010> <0020> <{long}> <0030> <0030> [<{long}>] endbfrange 1 beginbfchar <0040> <{long}> endbfchar");
+    let mut u = Unicode::default();
+    parse_to_unicode(cmap.as_bytes(), &mut u);
+    for code in [0x10, 0x20, 0x30, 0x40] {
+        let text = u.text(code).unwrap_or_default();
+        assert!(!text.is_empty() && text.len() <= MAX_DESTINATION_UNITS * 3, "code {code:#x}: {} bytes", text.len());
+    }
+}
+
+/// A font whose ranges cover a few low codes keeps tables that size, not a fixed 64k-entry one.
+#[test]
+fn low_code_tables_end_with_the_last_covered_code() {
+    // One range over codes 0x20..=0x21, then nothing.
+    let cover = [(0x20u64, Some(0usize)), (0x22, None)];
+    let owner = super::owners_below_64k(&cover);
+    assert_eq!(owner.len(), 0x22);
+    assert_eq!((owner[0x1F], owner[0x20], owner[0x21]), (u32::MAX, 0, 0));
+    assert!(super::owners_below_64k(&[(0x2_0000, Some(0))]).is_empty(), "no code below 65 536");
+    let bits = super::bit_set_below_64k([3u32, 130, 0x2_0000].into_iter());
+    assert_eq!(bits.len(), 3);
+    assert_eq!((bits[0], bits[2]), (1 << 3, 1 << 2));
+    assert!(super::bit_set_below_64k([0x1_0000u32].into_iter()).is_empty());
+}
+
+fn font(doc: &mut Document, entries: Vec<(&str, Object)>) -> Dict {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("Font"));
+    for (k, v) in entries {
+        d.set(k.as_bytes().to_vec(), v);
+    }
+    let _ = doc;
+    d
+}
+
+#[test]
+fn embedded_editor_fonts_are_validated_without_installing_or_exporting() {
+    use pdfcraft_cos::Stream;
+    let mut doc = Document::new_empty();
+    let bytes = include_bytes!("../../../../assets/fonts/Inter-Regular.ttf");
+    let program = doc.add(Object::Stream(Stream::flate(Dict::new(), bytes)));
+    let mut descriptor = Dict::new();
+    descriptor.set(b"FontFile2".to_vec(), Object::Ref(program));
+    let simple = font(&mut doc, vec![("FontDescriptor", Object::Dict(descriptor.clone()))]);
+    assert_eq!(embedded_sfnt(&doc, &simple).unwrap(), bytes);
+    let composite = font(&mut doc, vec![("DescendantFonts", Object::Array(vec![Object::Dict(simple.clone())]))]);
+    assert_eq!(embedded_sfnt(&doc, &composite).unwrap(), bytes);
+    let broken = doc.add(Object::Stream(Stream::flate(Dict::new(), b"broken font")));
+    descriptor.set(b"FontFile2".to_vec(), Object::Ref(broken));
+    let broken = font(&mut doc, vec![("FontDescriptor", Object::Dict(descriptor))]);
+    assert!(embedded_sfnt(&doc, &broken).is_none());
+    assert!(embedded_sfnt(&doc, &Dict::new()).is_none());
+}
+
+/// #2130: with no `/Widths`, an embedded program's advances win over a guess from the name
+/// ("Mono" would mean Courier, 600 units for every glyph).
+#[test]
+fn a_font_without_widths_measures_with_its_embedded_program() {
+    use pdfcraft_cos::Stream;
+    use skrifa::MetadataProvider as _;
+    let mut doc = Document::new_empty();
+    let bytes = include_bytes!("../../../../assets/fonts/Inter-Regular.ttf");
+    let face = skrifa::FontRef::new(bytes).unwrap();
+    let (size, location) = (skrifa::instance::Size::unscaled(), skrifa::instance::LocationRef::default());
+    let upem = f64::from(face.metrics(size, location).units_per_em);
+    let advance = |c: char| f64::from(face.glyph_metrics(size, location).advance_width(face.charmap().map(c).unwrap()).unwrap()) / upem;
+    let program = doc.add(Object::Stream(Stream::flate(Dict::new(), bytes)));
+    let mut descriptor = Dict::new();
+    descriptor.set(b"FontFile2".to_vec(), Object::Ref(program));
+    let f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("TrueType")),
+            ("BaseFont", Object::name("HouseMono")),
+            ("Encoding", Object::name("WinAnsiEncoding")),
+            ("FontDescriptor", Object::Dict(descriptor)),
+        ],
+    );
+    let m = Metrics::from_dict(&doc, &f);
+    for c in ['i', 'l', 'W', ' '] {
+        assert!((m.width(u32::from(c)) - advance(c)).abs() < 1e-9, "{c}: {} vs {}", m.width(u32::from(c)), advance(c));
+    }
+    assert!(m.width(u32::from('i')) < 0.4, "not Courier's 0.6");
+}
+
+#[test]
+fn mac_subset_cmap_uses_pdf_unicode_without_changing_source_program() {
+    use skrifa::{MetadataProvider as _, raw::TableProvider as _};
+    let original = include_bytes!("../../../../assets/fonts/Inter-Regular.ttf");
+    let face = skrifa::FontRef::new(original).unwrap();
+    let expected = face.charmap().map('Ω').unwrap();
+    let mut subset = original.to_vec();
+    let count = u16::from_be_bytes(subset[4..6].try_into().unwrap()) as usize;
+    let entry = (0..count).map(|i| 12 + i * 16).find(|i| &subset[*i..*i + 4] == b"cmap").unwrap();
+    let mut cmap = vec![0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 12];
+    cmap.extend_from_slice(&[0, 6, 0, 12, 0, 0, 0, 65, 0, 1]);
+    cmap.extend_from_slice(&u16::try_from(expected.to_u32()).unwrap().to_be_bytes());
+    let offset = subset.len() as u32;
+    subset[entry + 8..entry + 12].copy_from_slice(&offset.to_be_bytes());
+    subset[entry + 12..entry + 16].copy_from_slice(&(cmap.len() as u32).to_be_bytes());
+    subset.extend_from_slice(&cmap);
+    let face = skrifa::FontRef::new(&subset).unwrap();
+    assert!(!face.charmap().has_map(), "egui cannot directly use Mac format 6");
+    assert_eq!(face.cmap().unwrap().map_codepoint(65_u32), Some(expected));
+    let mut doc = Document::new_empty();
+    let program = doc.add(Object::Stream(Stream::flate(Dict::new(), &subset)));
+    let mut descriptor = Dict::new();
+    descriptor.set(b"FontFile2".to_vec(), Object::Ref(program));
+    let unicode = doc.add(Object::Stream(Stream::flate(Dict::new(), b"1 beginbfchar <41> <03A9> endbfchar")));
+    let source = font(&mut doc, vec![("FontDescriptor", Object::Dict(descriptor)), ("ToUnicode", Object::Ref(unicode))]);
+    let editor = embedded_sfnt(&doc, &source).unwrap();
+    let face = skrifa::FontRef::new(&editor).unwrap();
+    assert_eq!(face.charmap().map('Ω'), Some(expected), "Unicode selects the original glyph");
+    let Object::Stream(source) = doc.resolve(&Object::Ref(program)).as_ref().clone() else {
+        panic!("source stream");
+    };
+    assert_eq!(source.decoded().unwrap(), subset, "only an in-memory editor copy is adapted");
+    let mut broken = vec![0; 16];
+    assert!(append_editor_cmap(&mut broken, &std::collections::BTreeMap::from([(65, 1)])).is_none());
+}
+
+fn metrics_with_flags(flags: Option<Object>) -> Metrics {
+    let mut doc = Document::new_empty();
+    let mut descriptor = Dict::new();
+    if let Some(flags) = flags {
+        descriptor.set(b"Flags".to_vec(), flags);
+    }
+    let font = font(&mut doc, vec![("Subtype", Object::name("TrueType")), ("FontDescriptor", Object::Dict(descriptor))]);
+    Metrics::from_dict(&doc, &font)
+}
+
+#[test]
+fn font_descriptor_flags_stay_within_the_u32_domain() {
+    let valid = metrics_with_flags(Some(Object::Int(64 | 262_144)));
+    assert!(valid.italic && valid.bold);
+
+    for flags in [Some(Object::Int(-1)), Some(Object::Int(4_294_967_296)), Some(Object::Bool(true)), None] {
+        let metrics = metrics_with_flags(flags);
+        assert!(!metrics.italic && !metrics.bold);
+    }
+}
+
+#[test]
+fn type3_descriptor_names_the_font_without_changing_its_metrics() {
+    let mut doc = Document::new_empty();
+    let mut f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("Type3")),
+            (
+                "FontMatrix",
+                Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
+            ),
+            ("FontBBox", Object::Array(vec![Object::Int(0), Object::Int(-300), Object::Int(1000), Object::Int(1000)])),
+        ],
+    );
+    let before = Metrics::from_dict(&doc, &f);
+    let mut descriptor = Dict::new();
+    descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
+    descriptor.set(b"FontName".to_vec(), Object::name("ExampleMincho-Regular"));
+    descriptor.set(b"Flags".to_vec(), Object::Int(6));
+    descriptor.set(b"ItalicAngle".to_vec(), Object::Int(0));
+    let reference = doc.add(Object::Dict(descriptor));
+    f.set(b"FontDescriptor".to_vec(), Object::Ref(reference));
+    let after = Metrics::from_dict(&doc, &f);
+    assert_eq!(after.base_font, "ExampleMincho-Regular");
+    assert_eq!((after.ascent, after.descent, after.scale), (before.ascent, before.descent, before.scale));
+    assert!(!after.bold && !after.italic && !after.subset);
+    f.set(b"BaseFont".to_vec(), Object::name("ExplicitName"));
+    assert_eq!(Metrics::from_dict(&doc, &f).base_font, "ExplicitName", "an explicit BaseFont takes precedence");
+}
+
+#[test]
+fn simple_fonts_decode_and_encode_through_their_encoding() {
+    let mut doc = Document::new_empty();
+    let f = font(
+        &mut doc,
+        vec![("Subtype", Object::name("Type1")), ("BaseFont", Object::name("Helvetica")), ("Encoding", Object::name("WinAnsiEncoding"))],
+    );
+    let m = Metrics::from_dict(&doc, &f);
+    assert_eq!(m.decode(b"Caf\xe9 \x80 \x93x\x94"), "Café € “x”");
+    assert_eq!(m.encode("Café €").as_deref(), Some(&b"Caf\xe9 \x80"[..]));
+    assert_eq!(m.encode("Ω"), None, "not in WinAnsi");
+    // Differences rename codes by glyph name.
+    let mut enc = Dict::new();
+    enc.set(b"Differences".to_vec(), Object::Array(vec![Object::Int(65), Object::name("eacute"), Object::name("uni03A9")]));
+    let f = font(&mut doc, vec![("Subtype", Object::name("Type1")), ("BaseFont", Object::name("Custom")), ("Encoding", Object::Dict(enc))]);
+    let m = Metrics::from_dict(&doc, &f);
+    assert_eq!(m.decode(b"AB"), "éΩ");
+    assert_eq!(m.encode("Ω").as_deref(), Some(&b"B"[..]));
+}
+
+/// A standard-14 font with no `/Widths` is measured by the glyph each code draws, not by the
+/// glyph WinAnsi gives that code (#2894); `/Widths`, when present, still go by code.
+#[test]
+fn standard_fonts_without_widths_measure_the_glyph_their_differences_name() {
+    let mut doc = Document::new_empty();
+    let mut enc = Dict::new();
+    enc.set(b"BaseEncoding".to_vec(), Object::name("WinAnsiEncoding"));
+    let diffs = vec![Object::Int(65), Object::name("W"), Object::Int(87), Object::name("A"), Object::name("uni03A9"), Object::name("not.a.glyph")];
+    enc.set(b"Differences".to_vec(), Object::Array(diffs));
+    let f =
+        font(&mut doc, vec![("Subtype", Object::name("Type1")), ("BaseFont", Object::name("Helvetica")), ("Encoding", Object::Dict(enc.clone()))]);
+    let m = Metrics::from_dict(&doc, &f);
+    assert_eq!((m.width(65), m.width(87)), (0.944, 0.667), "A and W swap their widths");
+    // Omega has no WinAnsi code and the last name reads as nothing: both keep their code's width.
+    assert_eq!((m.width(88), m.width(89)), (0.667, 0.667));
+    let f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("Type1")),
+            ("BaseFont", Object::name("Helvetica")),
+            ("FirstChar", Object::Int(87)),
+            ("Widths", Object::Array(vec![Object::Int(500)])),
+            ("Encoding", Object::Dict(enc)),
+        ],
+    );
+    assert_eq!(Metrics::from_dict(&doc, &f).width(87), 0.5, "/Widths go by code");
+}
+
+#[test]
+fn subset_fonts_only_encode_the_glyphs_they_have() {
+    let mut doc = Document::new_empty();
+    // Widths for a, b only (97, 98); c (99) is 0.
+    let widths = Object::Array(vec![Object::Int(500), Object::Int(520), Object::Int(0)]);
+    let f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("TrueType")),
+            ("BaseFont", Object::name("ABCDEF+Arial")),
+            ("FirstChar", Object::Int(97)),
+            ("Widths", widths),
+            ("Encoding", Object::name("WinAnsiEncoding")),
+        ],
+    );
+    let m = Metrics::from_dict(&doc, &f);
+    assert!(m.subset);
+    assert_eq!(m.encode("ab").as_deref(), Some(&b"ab"[..]));
+    assert_eq!(m.encode("abc"), None);
+}
+
+#[test]
+fn cmap_streams_decode_within_a_size_cap() {
+    // A valid CMap padded past the cap (a small Flate stream of whitespace) is not decoded whole.
+    let to_unicode = b"1 begincodespacerange <0000> <FFFF> endcodespacerange 1 beginbfrange <0024> <0026> <0041> endbfrange";
+    let encoding = b"1 begincodespacerange <0000> <FFFF> endcodespacerange 1 begincidrange <0000> <FFFF> 0 endcidrange";
+    for padded in [false, true] {
+        let mut doc = Document::new_empty();
+        let mut stream = |cmap: &[u8]| {
+            let mut data = cmap.to_vec();
+            if padded {
+                data.resize(MAX_CMAP_BYTES + 1, b' ');
+            }
+            Object::Ref(doc.add(Object::Stream(Stream::flate(Dict::new(), &data))))
+        };
+        let (tu, enc) = (stream(to_unicode), stream(encoding));
+        let mut desc = Dict::new();
+        desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
+        let f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("Type0")),
+                ("Encoding", enc),
+                ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
+                ("ToUnicode", tu),
+            ],
+        );
+        let m = Metrics::from_dict(&doc, &f);
+        assert_eq!(m.decode(&[0, 0x24]) == "A", !padded, "ToUnicode, padded: {padded}");
+        assert_eq!(matches!(m.codes, Codes::Ranges(_)), !padded, "Encoding, padded: {padded}");
+    }
+}
+
+#[test]
+fn composite_fonts_use_to_unicode() {
+    let mut doc = Document::new_empty();
+    let cmap = b"/CIDInit /ProcSet findresource begin 1 begincodespacerange <0000> <FFFF> endcodespacerange \
+            2 beginbfchar <0003> <0020> <0010> <00E9> endbfchar 1 beginbfrange <0024> <0026> <0041> endbfrange \
+            1 beginbfrange <0030> <0031> [<0048> <0069>] endbfrange end";
+    let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
+    let mut desc = Dict::new();
+    desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
+    desc.set(
+        b"W".to_vec(),
+        Object::Array(vec![
+            Object::Int(3),
+            Object::Array(vec![Object::Int(250)]),
+            Object::Int(16),
+            Object::Int(16),
+            Object::Int(500),
+            Object::Int(36),
+            Object::Int(49),
+            Object::Int(600),
+        ]),
+    );
+    let f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("Type0")),
+            ("BaseFont", Object::name("QWERTY+Noto")),
+            ("Encoding", Object::name("Identity-H")),
+            ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
+            ("ToUnicode", Object::Ref(tu)),
+        ],
+    );
+    let m = Metrics::from_dict(&doc, &f);
+    assert_eq!(m.decode(&[0, 0x24, 0, 0x25, 0, 3, 0, 0x30, 0, 0x31, 0, 0x10]), "AB Hié");
+    assert_eq!(m.encode("Hi A").as_deref(), Some(&[0, 0x30, 0, 0x31, 0, 3, 0, 0x24][..]));
+    assert_eq!(m.encode("Z"), None);
+}
+
+/// Word's Type 0 subsets map CID 0 as well as the real space glyph to U+0020 and give CID 0 a
+/// width; CID 0 is `.notdef`, so a typed space takes the real one (#3223).
+#[test]
+fn composite_fonts_never_encode_with_cid_0() {
+    let mut doc = Document::new_empty();
+    let cmap = b"/CIDInit /ProcSet findresource begin 1 begincodespacerange <0000> <FFFF> endcodespacerange \
+            1 beginbfrange <0000> <0002> [<0020> <004D> <00E1>] endbfrange \
+            1 beginbfrange <0005> <0007> [<0065> <0072> <0020>] endbfrange end";
+    let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
+    let mut desc = Dict::new();
+    desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
+    let widths = [889, 444, 389, 278, 444, 333, 250].map(Object::Int).to_vec();
+    desc.set(b"W".to_vec(), Object::Array(vec![Object::Int(0), Object::Array(vec![Object::Int(778)]), Object::Int(1), Object::Array(widths)]));
+    let f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("Type0")),
+            ("BaseFont", Object::name("BCDEEE+TimesNewRomanPSMT")),
+            ("Encoding", Object::name("Identity-H")),
+            ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
+            ("ToUnicode", Object::Ref(tu)),
+        ],
+    );
+    let m = Metrics::from_dict(&doc, &f);
+    assert_eq!(m.encode("Me er").as_deref(), Some(&[0, 1, 0, 5, 0, 7, 0, 5, 0, 6][..]));
+    assert_eq!(m.decode(&[0, 1, 0, 7, 0, 2]), "M á");
+}
+
+/// WSCAD writes `/ToUnicode /Identity-H` (a name, not a CMap stream) on composite fonts whose
+/// codes are UTF-16 code units: the codes read as the same Unicode, as in Acrobat. Controls
+/// and lone surrogates map to nothing, and a simple font's name is not a ToUnicode map.
+#[test]
+fn identity_to_unicode_names_read_codes_as_unicode() {
+    let doc = Document::new_empty();
+    for name in ["Identity-H", "Identity-V"] {
+        let f = font(
+            &mut Document::new_empty(),
+            vec![
+                ("Subtype", Object::name("Type0")),
+                ("BaseFont", Object::name("RobotoMono-Regular")),
+                ("Encoding", Object::name("Identity-H")),
+                ("DescendantFonts", Object::Array(vec![Object::Dict(Dict::new())])),
+                ("ToUnicode", Object::name(name)),
+            ],
+        );
+        let m = Metrics::from_dict(&doc, &f);
+        assert_eq!(m.decode(&[0, b'Z', 0, 0xFC, 0, b'r', 0x20, 0xAC, 0x4E, 0x2D]), "Zür€中", "{name}");
+        assert_eq!(m.text_of(0x0001), None);
+        assert_eq!(m.text_of(0x007F), None, "DEL is a control");
+        assert_eq!(m.text_of(0x0085), None, "a C1 control");
+        assert_eq!(m.text_of(0x00A0).as_deref(), Some("\u{A0}"), "the range resumes after C1");
+        assert_eq!(m.text_of(0x007E).as_deref(), Some("~"));
+        assert_eq!(m.text_of(0xD800), None);
+        assert_eq!(m.text_of(0xFFFD).as_deref(), Some("\u{FFFD}"));
+    }
+    let simple = font(
+        &mut Document::new_empty(),
+        vec![("Subtype", Object::name("TrueType")), ("BaseFont", Object::name("Arial")), ("ToUnicode", Object::name("Identity-H"))],
+    );
+    let m = Metrics::from_dict(&doc, &simple);
+    assert_eq!(m.text_of(0x41).as_deref(), Some("A"), "the encoding still applies");
+}
+
+/// Chrome's subsets leave the glyphs of `/DW` width out of `/W` (#1443): "s" (CID 0x56) is
+/// still in the font, but nothing is when the font gives no default width to point at.
+#[test]
+fn composite_subset_glyphs_of_the_default_width_are_present() {
+    let metrics = |dw: bool| {
+        let mut doc = Document::new_empty();
+        let cmap = b"/CIDInit /ProcSet findresource begin 1 begincodespacerange <0000> <FFFF> endcodespacerange \
+                1 beginbfrange <0055> <0057> <0072> endbfrange end";
+        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
+        let mut desc = Dict::new();
+        desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
+        if dw {
+            desc.set(b"DW".to_vec(), Object::Int(500));
+        }
+        desc.set(
+            b"W".to_vec(),
+            Object::Array(vec![Object::Int(0x55), Object::Array(vec![Object::Int(333)]), Object::Int(0x57), Object::Array(vec![Object::Int(277)])]),
+        );
+        let f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("Type0")),
+                ("BaseFont", Object::name("AAAAAA+LiberationSans")),
+                ("Encoding", Object::name("Identity-H")),
+                ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
+                ("ToUnicode", Object::Ref(tu)),
+            ],
+        );
+        Metrics::from_dict(&doc, &f)
+    };
+    let chrome = metrics(true);
+    assert_eq!(chrome.encode("rst").as_deref(), Some(&[0, 0x55, 0, 0x56, 0, 0x57][..]));
+    assert_eq!(chrome.width(0x56), 0.5);
+    assert_eq!(chrome.encode("x"), None, "a character the ToUnicode map doesn't give");
+    assert_eq!(metrics(false).encode("s"), None);
+}
+
+/// A `/W` run that starts at the last CID stops there instead of overflowing onto CID 0.
+#[test]
+fn composite_width_run_past_the_last_cid_is_dropped() {
+    let widths = |first: i64| {
+        let mut doc = Document::new_empty();
+        let mut desc = Dict::new();
+        desc.set(b"Subtype".to_vec(), Object::name("CIDFontType2"));
+        desc.set(b"DW".to_vec(), Object::Int(1000));
+        desc.set(b"W".to_vec(), Object::Array(vec![Object::Int(first), Object::Array(vec![Object::Int(100), Object::Int(200)])]));
+        let f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("Type0")),
+                ("Encoding", Object::name("Identity-H")),
+                ("DescendantFonts", Object::Array(vec![Object::Dict(desc)])),
+            ],
+        );
+        Metrics::from_dict(&doc, &f)
+    };
+    let ordinary = widths(0);
+    assert_eq!((ordinary.width(0), ordinary.width(1)), (0.1, 0.2));
+    let last = widths(i64::from(u32::MAX));
+    assert_eq!((last.width(0), last.width(u32::MAX)), (1.0, 0.1));
+}
+
+#[test]
+fn glyph_names() {
+    assert_eq!(glyph_unicode("quotedblleft"), Some('“'));
+    assert_eq!(glyph_unicode("uni20AC"), Some('€'));
+    assert_eq!(glyph_unicode("u1F600"), Some('😀'));
+    assert_eq!(glyph_unicode("nonsense"), None);
+}
+
+fn to_unicode(cmap: &[u8]) -> HashMap<u32, String> {
+    let mut u = Unicode::default();
+    parse_to_unicode(cmap, &mut u);
+    let codes: Vec<u32> = u.explicit.keys().copied().chain(u.ranges.iter().flat_map(|r| r.lo..=r.hi)).collect();
+    codes.into_iter().filter_map(|c| u.text(c).map(|t| (c, t.into_owned()))).collect()
+}
+
+#[test]
+fn cmap_tokens_need_no_space_between_them() {
+    // Hex strings, brackets and operators may touch; comments and literal strings are skipped.
+    let cmap = b"/CIDSystemInfo << /Registry (Adobe (x) \\) beginbfchar) >> def % beginbfchar <0001> <0058>\n\
+            2 beginbfchar<0003><0020><0010><00 E9>endbfchar \
+            1 beginbfrange<0024><0026><0041>endbfrange 1 beginbfrange<0030><0031>[<0048><0069>]endbfrange";
+    let map = to_unicode(cmap);
+    let mut got: Vec<_> = map.iter().map(|(c, u)| (*c, u.as_str())).collect();
+    got.sort_unstable();
+    assert_eq!(got, [(3, " "), (0x10, "é"), (0x24, "A"), (0x25, "B"), (0x26, "C"), (0x30, "H"), (0x31, "i")]);
+    let (spaces, cids) = parse_cmap(b"1 begincodespacerange<00><FF>endcodespacerange 1 begincidrange<20><7E>1 endcidrange");
+    assert_eq!(spaces, [(1, vec![0], vec![0xff])]);
+    assert_eq!(cids, [(0x20, 0x7e, 1)]);
+}
+
+#[test]
+fn malformed_cmaps_never_panic() {
+    // Non-ASCII bytes inside hex strings once split a UTF-8 character and panicked.
+    for cmap in [
+        "1 beginbfchar <0é0> <0041> <AéB> <0042> endbfchar".as_bytes(),
+        "1 beginbfrange <0é0> <00é> <0041> endbfrange".as_bytes(),
+        b"1 beginbfchar <0001> <004",
+        b"1 beginbfchar <123> <0041> <0002> <zz> <0003> endbfchar",
+        b"1 beginbfrange <FFFF> <0001> [<0041>] endbfrange",
+        b"1 beginbfrange <0001> <0002> [<0041> (",
+        b"1 beginbfrange <0001>",
+        b"\xff\xfe beginbfchar \x80<\xc3\xa9> <0041> endbfchar %",
+    ] {
+        to_unicode(cmap);
+        parse_cmap(cmap);
+    }
+    // Code counters at the top of the range stop instead of overflowing.
+    let map = to_unicode(b"1 beginbfrange <FFFFFFFE> <FFFFFFFF> [<0041> <0042> <0043>] endbfrange");
+    assert_eq!(map.len(), 2);
+    assert_eq!(map.get(&u32::MAX).map(String::as_str), Some("B"));
+    // A malformed array entry keeps its place, so the next one maps the next code.
+    let map = to_unicode(b"1 beginbfrange <0001> <0003> [<0041> <zz> <0043>] endbfrange");
+    assert_eq!((map.get(&2), map.get(&3).map(String::as_str)), (None, Some("C")));
+    let mut m = Metrics::fallback();
+    m.cid_map = Spans::new(parse_cmap(b"1 begincidrange <0000> <FFFF> 4294967295 endcidrange").1);
+    assert_eq!(m.cid(5), u32::MAX);
+    let mut doc = Document::new_empty();
+    let mut enc = Dict::new();
+    enc.set(b"Differences".to_vec(), Object::Array(vec![Object::Int(i64::MAX), Object::name("A"), Object::name("B")]));
+    let f = font(&mut doc, vec![("Subtype", Object::name("Type1")), ("Encoding", Object::Dict(enc))]);
+    assert_eq!(unicode_map(&doc, &f, false).text(u32::MAX).as_deref(), Some("B"));
+}
+
+#[test]
+fn sequential_ranges_past_the_entry_cap_still_map() {
+    // 17 ranges of 65 536 codes: 1 114 112 codes from 0.4 KB of CMap, more than MAX_CMAP_ENTRIES
+    // (the first 16 ranges use up the whole cap). Each range maps its codes upward from 'A', so
+    // the last code of the last range, 0x100019, is 'A' + 0x19 = 'Z'.
+    let mut cmap = b"17 beginbfrange ".to_vec();
+    for k in 0..17u32 {
+        cmap.extend(format!("<{:08X}> <{:08X}> <0041> ", k << 16, (k << 16) | 0xffff).bytes());
+    }
+    cmap.extend(b"endbfrange");
+    let mut doc = Document::new_empty();
+    let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap)));
+    let f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("Type0")),
+            ("BaseFont", Object::name("Wide")),
+            ("Encoding", Object::name("Identity-H")),
+            ("ToUnicode", Object::Ref(tu)),
+        ],
+    );
+    let m = Metrics::from_dict(&doc, &f);
+    assert_eq!(m.text_of(0x0010_0019).as_deref(), Some("Z"));
+}
+
+#[test]
+fn a_cmap_adds_at_most_max_entries() {
+    // 200 ranges of 65 536 codes would be 13 million codes from 4 KB of stream: 200 records.
+    let mut cmap = b"200 beginbfrange ".to_vec();
+    for k in 0..200u32 {
+        cmap.extend(format!("<{:08X}> <{:08X}> <0041> ", k << 16, (k << 16) | 0xffff).bytes());
+    }
+    cmap.extend(b"endbfrange");
+    let mut u = Unicode::default();
+    parse_to_unicode(&cmap, &mut u);
+    assert_eq!((u.ranges.len(), u.explicit.len()), (200, 0));
+    // Explicit entries are what the budget counts: 250 of the 300 here are kept.
+    let mut many = b"300 beginbfchar ".to_vec();
+    for k in 0..300u32 {
+        many.extend(format!("<{k:04X}> <{:04X}> ", 0x4E00 + k).bytes());
+    }
+    many.extend(b"endbfchar");
+    let mut u = Unicode::default();
+    parse_to_unicode_within(&many, &mut u, 250);
+    assert_eq!((u.explicit.len(), u.text(249).is_some(), u.text(250).is_some()), (250, true, false));
+    let mut many = b"begincidrange ".to_vec();
+    for k in 0..MAX_CMAP_RANGES + 10 {
+        many.extend(format!("<{k:08X}> <{k:08X}> 1 ").bytes());
+    }
+    assert_eq!(parse_cmap(&many).1.len(), MAX_CMAP_RANGES);
+}
+
+#[test]
+fn a_range_is_one_record_however_many_codes() {
+    let mut u = Unicode::default();
+    parse_to_unicode(b"1 beginbfrange <0000> <FFFF> <0041> endbfrange", &mut u);
+    assert_eq!((u.ranges.len(), u.explicit.len()), (1, 0));
+    assert_eq!(u.text(0xFFFF).as_deref(), Some("@"), "0x41 + 0xFFFF wraps to U+0040");
+}
+
+#[test]
+fn sequential_ranges_count_against_the_budget() {
+    // Range k maps codes k and k + 1 and costs two, so a budget of 250 keeps ranges 0 to 124.
+    let mut cmap = Vec::new();
+    for k in 0..300u32 {
+        cmap.extend(format!("1 beginbfrange <{k:08X}> <{:08X}> <0041> endbfrange ", k + 1).bytes());
+    }
+    let mut u = Unicode::default();
+    parse_to_unicode_within(&cmap, &mut u, 250);
+    assert_eq!((u.ranges.len(), u.text(125).is_some(), u.text(126).is_none()), (125, true, true));
+}
+
+#[test]
+fn explicit_and_range_mappings_override_the_encoding() {
+    let mut doc = Document::new_empty();
+    let cmap = b"1 beginbfchar <41> <0058> endbfchar 1 beginbfrange <42> <43> <0059> endbfrange";
+    let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
+    let f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("Type1")),
+            ("BaseFont", Object::name("Custom")),
+            ("Encoding", Object::name("WinAnsiEncoding")),
+            ("ToUnicode", Object::Ref(tu)),
+        ],
+    );
+    let m = Metrics::from_dict(&doc, &f);
+    let shown: Vec<Option<String>> = (0x41..=0x44).map(|c| m.text_of(c).map(|t| t.into_owned())).collect();
+    assert_eq!(shown, [Some("X".to_string()), Some("Y".to_string()), Some("Z".to_string()), Some("D".to_string())]);
+}
+
+/// Deterministic input for the differential test below.
+struct Gen(u64);
+
+impl Gen {
+    fn below(&mut self, n: u32) -> u32 {
+        self.0 = self.0.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
+        ((self.0 >> 33) % u64::from(n)) as u32
+    }
+
+    /// A destination: a unit from a pool of edge cases, a surrogate pair, or a lone high surrogate.
+    fn units(&mut self) -> Vec<u16> {
+        const POOL: [u16; 12] = [0x41, 0x42, 0xE9, 0x0, 0xFFFD, 0xFFFE, 0xFFFF, 0x100, 0x3042, 0xD800, 0xDC00, 0xDFFF];
+        match self.below(6) {
+            0 => vec![0xD835, 0xDC00 + self.below(0x400) as u16],
+            1 => vec![0xD800, 0x41],
+            _ => vec![POOL[self.below(POOL.len() as u32) as usize]],
+        }
+    }
+}
+
+fn hex(units: &[u16]) -> String {
+    units.iter().map(|u| format!("{u:04X}")).collect()
+}
+
+#[test]
+fn lookups_match_the_expanded_mappings() {
+    // Random ToUnicode CMaps; `expected` is what expanding their entries in order gives.
+    let mut g = Gen(0x2545_f491_4f6c_dd1d);
+    for _ in 0..300 {
+        let mut cmap = String::from("1 begincodespacerange <0000> <FFFF> endcodespacerange ");
+        let mut expected: HashMap<u32, String> = HashMap::new();
+        for _ in 0..1 + g.below(12) {
+            match g.below(3) {
+                0 => {
+                    let (code, u) = (g.below(300), g.units());
+                    cmap += &format!("1 beginbfchar <{code:04X}> <{}> endbfchar ", hex(&u));
+                    expected.insert(code, String::from_utf16_lossy(&u));
+                }
+                1 => {
+                    let (lo, width, u) = (g.below(300), g.below(13), g.units());
+                    cmap += &format!("1 beginbfrange <{lo:04X}> <{:04X}> <{}> endbfrange ", lo + width, hex(&u));
+                    for k in 0..=width {
+                        let mut v = u.clone();
+                        if let Some(last) = v.last_mut() {
+                            *last = last.wrapping_add(k as u16);
+                        }
+                        expected.insert(lo + k, String::from_utf16_lossy(&v));
+                    }
+                }
+                _ => {
+                    let (lo, width) = (g.below(300), g.below(5));
+                    let dests: Vec<Vec<u16>> = (0..=width).map(|_| g.units()).collect();
+                    let list: Vec<String> = dests.iter().map(|d| format!("<{}>", hex(d))).collect();
+                    cmap += &format!("1 beginbfrange <{lo:04X}> <{:04X}> [{}] endbfrange ", lo + width, list.join(" "));
+                    for (k, d) in dests.iter().enumerate() {
+                        expected.insert(lo + k as u32, String::from_utf16_lossy(d));
+                    }
+                }
+            }
+        }
+        let mut doc = Document::new_empty();
+        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.clone().into_bytes())));
+        let f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("Type0")),
+                ("BaseFont", Object::name("Gen")),
+                ("Encoding", Object::name("Identity-H")),
+                ("ToUnicode", Object::Ref(tu)),
+            ],
+        );
+        let m = Metrics::from_dict(&doc, &f);
+        for code in 0..=320u32 {
+            let got = m.text_of(code).map(|t| t.into_owned());
+            assert_eq!(got, expected.get(&code).cloned(), "code {code:#06x} in {cmap}");
+        }
+        let mut reverse: HashMap<char, u32> = HashMap::new();
+        // Code 0 is CID 0, `.notdef`, which no character is encoded with.
+        for (&code, text) in expected.iter().filter(|&(&code, _)| code != 0) {
+            if let Some(c) = only_char(text) {
+                keep(&mut reverse, c, code);
+            }
+        }
+        let mut chars: Vec<char> = expected.values().flat_map(|t| t.chars()).chain(['A', '\u{FFFD}', '\u{0}', '\u{1D400}']).collect();
+        chars.sort_unstable();
+        chars.dedup();
+        for c in chars {
+            let want = reverse.get(&c).map(|code| code.to_be_bytes()[2..].to_vec());
+            assert_eq!(m.encode(&c.to_string()), want, "char {c:?} in {cmap}");
+        }
+    }
+}
+
+#[test]
+fn fffd_lookups_skip_overridden_surrogates() {
+    // Each record maps every code to itself, so its surrogate offsets decode to U+FFFD. The last
+    // record overrides the surrogates with letters, so each lookup walks past them to U+FFFD itself.
+    let mut cmap = "1 beginbfrange <0000> <FFFF> <0000> endbfrange ".repeat(300);
+    cmap.push_str("1 beginbfrange <D800> <DFFF> <0041> endbfrange");
+    let mut doc = Document::new_empty();
+    let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.into_bytes())));
+    let f = font(
+        &mut doc,
+        vec![
+            ("Subtype", Object::name("Type0")),
+            ("BaseFont", Object::name("Gen")),
+            ("Encoding", Object::name("Identity-H")),
+            ("ToUnicode", Object::Ref(tu)),
+        ],
+    );
+    let m = Metrics::from_dict(&doc, &f);
+    assert_eq!(m.encode("\u{FFFD}"), Some(vec![0xFF, 0xFD]));
+}
+
+#[test]
+fn hostile_ranges_stay_bounded() {
+    // A range wider than 65 536 codes is ignored, a reversed one maps nothing, and a maximal
+    // one-code range maps just its own code.
+    let mut u = Unicode::default();
+    let cmap = b"1 beginbfrange <00000000> <FFFFFFFF> <0041> endbfrange \
+            1 beginbfrange <0005> <0001> <0041> endbfrange \
+            1 beginbfrange <FFFFFFFF> <FFFFFFFF> <FFFF> endbfrange";
+    parse_to_unicode(cmap, &mut u);
+    assert_eq!((u.ranges.len(), u.text(u32::MAX).as_deref()), (0, Some("\u{FFFF}")));
+}
+
+#[test]
+fn low_codes_resolve_to_the_covering_range() {
+    let mut u = Unicode::default();
+    let cmap = b"1 beginbfrange <0005> <0007> <0041> endbfrange 1 beginbfrange <0064> <0065> <0042> endbfrange \
+            1 beginbfrange <0000FFFE> <00010001> <0043> endbfrange";
+    parse_to_unicode(cmap, &mut u);
+    let covered: Vec<u32> = (0..0x70).filter(|&c| u.covering(c).is_some()).collect();
+    assert_eq!(covered, [5, 6, 7, 100, 101]);
+    assert_eq!((u.covering(0xFFFF).is_some(), u.covering(0x1_0001).is_some(), u.covering(0x1_0002).is_none()), (true, true, true));
+}
diff --git a/crates/fonts/tests/build_input.rs b/crates/fonts/tests/build_input.rs
new file mode 100644
index 0000000000..832cc2c16c
--- /dev/null
+++ b/crates/fonts/tests/build_input.rs
@@ -0,0 +1,4 @@
+//! Required manifest checks execute the same parser as the production build script.
+#[allow(dead_code)]
+#[path = "../build.rs"]
+mod build_script;
diff --git a/crates/forms/README.md b/crates/forms/README.md
index 4aec223ee9..93b65bd14e 100644
--- a/crates/forms/README.md
+++ b/crates/forms/README.md
@@ -14,6 +14,8 @@ set_value(&mut doc, "name", &FieldValue::Text("Ada".into()))?;
 set_value(&mut doc, "agree", &FieldValue::Check(true))?;
 set_value(&mut doc, "size", &FieldValue::Radio(Some("L".into())))?;
 set_value(&mut doc, "toppings", &FieldValue::Choice(vec!["Ham".into()]))?;
+// Many values: as set_value one by one, but reading the form once and recalculating once.
+let results: Vec<Result<(), FormError>> = set_values(&mut doc, &[("name".into(), FieldValue::Text("Ada".into()))])?;
 reset(&mut doc, None)?;                                      // Clear form (back to /DV)
 
 // Prepare a form
@@ -58,7 +60,9 @@ let cells: Vec<table::Cell> = grid.cells_for(names)?;      // "Table1_1", "Table
   drawing while the objects it was drawn from are the same (`FieldAppearanceCache`), so typing in
   one field redraws that field, not the form. Check boxes and radio buttons with no appearance for
   their state are drawn from `/MK` (border, background, and when on the `/MK /CA` ZapfDingbats
-  symbol in the `/DA` colour), and push buttons with none from `/MK`, `/BS` and their caption.
+  symbol in the `/DA` colour), and with `/NeedAppearances` so is every one that has an `/MK`,
+  over the appearance the file carries; push buttons with none are drawn from `/MK`, `/BS` and
+  their caption.
 - Check boxes and radio buttons switch `/V` and each widget's `/AS`. Widgets with no appearances
   get PdfCraft's own (a drawn check mark or dot; no symbol font needed).
 - Imported `/MaxLen 0` is treated as unlimited (also clearing an inherited limit), while the
diff --git a/crates/forms/src/actions.rs b/crates/forms/src/actions.rs
index f58bd10783..5eb57c6c1b 100644
--- a/crates/forms/src/actions.rs
+++ b/crates/forms/src/actions.rs
@@ -260,6 +260,47 @@ fn write(doc: &mut Document, a: &FieldAction, pages: &[pdfcraft_cos::ObjRef]) ->
     Ok(Some(Object::Ref(doc.add(Object::Dict(d)))))
 }
 
+/// Rewrite one trigger of a widget to `new` (`None` clears it), given the `old` value read from
+/// the widget. `aa` and `a_entry` are the widget's `/AA` dict and `/A` entry, updated in place.
+#[allow(clippy::too_many_arguments)]
+fn replace_trigger(
+    doc: &mut Document,
+    pages: &[pdfcraft_cos::ObjRef],
+    scripts: &mut pdfcraft_cos::DecodeBudget,
+    t: Trigger,
+    new: Option<&FieldAction>,
+    old: Option<Object>,
+    aa: &mut Dict,
+    a_entry: &mut Option<Object>,
+) -> Result<(), FormError> {
+    let old_action = old.as_ref().and_then(|o| read(doc, o, pages, scripts));
+    if new.is_some() && new == old_action.as_ref() {
+        return Ok(());
+    }
+    // The list shows a trigger's first action: replacing it keeps the ones chained after it.
+    let next = new.and(old).and_then(|o| doc.resolve(&o).as_dict().and_then(|d| d.get(b"Next").cloned()));
+    let obj = match new {
+        Some(a) => write(doc, a, pages)?,
+        None => None,
+    };
+    if let (Some(Object::Ref(r)), Some(next)) = (&obj, next) {
+        doc.update_dict(*r, |d| d.set(b"Next".to_vec(), next))?;
+    }
+    match t.key() {
+        None => {
+            *a_entry = obj;
+            aa.remove(b"U");
+        }
+        Some(k) => match obj {
+            Some(o) => aa.set(k.to_vec(), o),
+            None => {
+                aa.remove(k);
+            }
+        },
+    }
+    Ok(())
+}
+
 /// Replace field `name`'s actions (on every widget) with `actions`; triggers not listed lose
 /// theirs. `Other` actions, and actions that read the same as before, are left as they are (with
 /// their chain and the keys this module doesn't read); a replaced action keeps its chain.
@@ -281,31 +322,7 @@ pub fn set_field_actions(doc: &mut Document, name: &str, actions: &[(Trigger, Fi
                 None => wd.get(b"A").cloned().or_else(|| aa.get(b"U").cloned()),
                 Some(k) => aa.get(k).cloned(),
             };
-            let old_action = old.as_ref().and_then(|o| read(doc, o, &pages, &mut scripts));
-            if new.is_some() && new == old_action.as_ref() {
-                continue;
-            }
-            // The list shows a trigger's first action: replacing it keeps the ones chained after it.
-            let next = new.and(old).and_then(|o| doc.resolve(&o).as_dict().and_then(|d| d.get(b"Next").cloned()));
-            let obj = match new {
-                Some(a) => write(doc, a, &pages)?,
-                None => None,
-            };
-            if let (Some(Object::Ref(r)), Some(next)) = (&obj, next) {
-                doc.update_dict(*r, |d| d.set(b"Next".to_vec(), next))?;
-            }
-            match t.key() {
-                None => {
-                    a_entry = obj;
-                    aa.remove(b"U");
-                }
-                Some(k) => match obj {
-                    Some(o) => aa.set(k.to_vec(), o),
-                    None => {
-                        aa.remove(k);
-                    }
-                },
-            }
+            replace_trigger(doc, &pages, &mut scripts, t, new, old, &mut aa, &mut a_entry)?;
         }
         doc.update_dict(w.obj, |d| {
             match &a_entry {
diff --git a/crates/forms/src/af.rs b/crates/forms/src/af.rs
index 7b706e9ae9..ee4aa18e3c 100644
--- a/crates/forms/src/af.rs
+++ b/crates/forms/src/af.rs
@@ -13,6 +13,17 @@ use std::collections::VecDeque;
 use std::fmt::Write as _;
 use std::ops::Range;
 
+mod calc;
+mod format;
+mod script;
+
+#[cfg(test)]
+use calc::{Notation, eval_notation, notation_name, notation_tokens, unique};
+pub use calc::{calculate, calculation_reads, notation_js, rename_in_calculation};
+pub use format::{DATE_PRESETS, DateTime, TIME_PRESETS, format_date, format_value, js_number, keystroke, make_number, parse_date, validate};
+use script::{Arg, call};
+pub use script::{calculate_js, format_js, parse_calculate, parse_format, parse_validate, validate_js};
+
 /// The Format tab.
 #[derive(Clone, Debug, PartialEq, Default)]
 pub enum Format {
@@ -112,1696 +123,8 @@ impl Actions {
     }
 }
 
-// ── parsing scripts ─────────────────────────────────────────────────────────────────────────
-
-#[derive(Clone, Debug, PartialEq)]
-enum Arg {
-    Num(f64),
-    Str(String),
-    Bool(bool),
-    List(Vec<Arg>),
-}
-
-impl Arg {
-    fn num(&self) -> Option<f64> {
-        match self {
-            Arg::Num(n) => Some(*n),
-            Arg::Bool(b) => Some(f64::from(u8::from(*b))),
-            Arg::Str(s) => s.trim().parse().ok(),
-            Arg::List(_) => None,
-        }
-    }
-
-    fn string(&self) -> Option<String> {
-        match self {
-            Arg::Str(s) => Some(s.clone()),
-            Arg::Num(n) => Some(n.to_string()),
-            _ => None,
-        }
-    }
-
-    fn truthy(&self) -> bool {
-        match self {
-            Arg::Bool(b) => *b,
-            Arg::Num(n) => *n != 0.0,
-            Arg::Str(s) => !s.is_empty(),
-            Arg::List(l) => !l.is_empty(),
-        }
-    }
-}
-
-/// How deeply script arguments and field notation may nest; deeper input is rejected rather
-/// than recursed into (a hostile file could otherwise overflow the stack).
-const MAX_NESTING: usize = 64;
-
-fn hex4(bytes: &[u8]) -> Option<u16> {
-    if bytes.len() != 4 {
-        return None;
-    }
-    bytes.iter().try_fold(0u16, |value, byte| {
-        let digit = match byte {
-            b'0'..=b'9' => byte - b'0',
-            b'a'..=b'f' => byte - b'a' + 10,
-            b'A'..=b'F' => byte - b'A' + 10,
-            _ => return None,
-        };
-        value.checked_mul(16)?.checked_add(u16::from(digit))
-    })
-}
-
-struct Parser<'a> {
-    s: &'a [u8],
-    i: usize,
-    depth: usize,
-}
-
-impl Parser<'_> {
-    fn ws(&mut self) {
-        while self.i < self.s.len() && (self.s[self.i].is_ascii_whitespace()) {
-            self.i += 1;
-        }
-    }
-
-    fn string(&mut self) -> Option<String> {
-        let q = self.s[self.i];
-        self.i += 1;
-        let mut out = Vec::new();
-        while self.i < self.s.len() {
-            let c = self.s[self.i];
-            self.i += 1;
-            match c {
-                b'\\' if self.i < self.s.len() => {
-                    let e = self.s[self.i];
-                    self.i += 1;
-                    match e {
-                        b'n' => out.push(b'\n'),
-                        b'r' => out.push(b'\r'),
-                        b't' => out.push(b'\t'),
-                        b'b' => out.push(0x08),
-                        b'f' => out.push(0x0C),
-                        b'v' => out.push(0x0B),
-                        b'0' => out.push(0),
-                        b'x' => {
-                            let digits = self.s.get(self.i..self.i.checked_add(2)?)?;
-                            let code = hex4(&[b'0', b'0', digits[0], digits[1]])?;
-                            self.i += 2;
-                            let ch = char::from_u32(u32::from(code)).unwrap_or('\u{FFFD}');
-                            let mut encoded = [0u8; 4];
-                            out.extend_from_slice(ch.encode_utf8(&mut encoded).as_bytes());
-                        }
-                        b'u' => {
-                            let code = hex4(self.s.get(self.i..self.i.checked_add(4)?)?)?;
-                            self.i += 4;
-                            let code = if (0xD800..=0xDBFF).contains(&code) && self.s.get(self.i..self.i.checked_add(6)?)?.starts_with(b"\\u") {
-                                let low = hex4(self.s.get(self.i.checked_add(2)?..self.i.checked_add(6)?)?)?;
-                                if (0xDC00..=0xDFFF).contains(&low) {
-                                    self.i += 6;
-                                    0x10000 + ((u32::from(code) - 0xD800) << 10) + (u32::from(low) - 0xDC00)
-                                } else {
-                                    u32::from(code)
-                                }
-                            } else {
-                                u32::from(code)
-                            };
-                            let ch = char::from_u32(code).unwrap_or('\u{FFFD}');
-                            let mut encoded = [0u8; 4];
-                            out.extend_from_slice(ch.encode_utf8(&mut encoded).as_bytes());
-                        }
-                        other => out.push(other),
-                    }
-                }
-                c if c == q => return Some(String::from_utf8_lossy(&out).into_owned()),
-                c => out.push(c),
-            }
-        }
-        None
-    }
-
-    fn arg(&mut self) -> Option<Arg> {
-        self.ws();
-        let c = *self.s.get(self.i)?;
-        match c {
-            b'"' | b'\'' => self.string().map(Arg::Str),
-            b'[' => {
-                self.i += 1;
-                self.nested(b']').map(Arg::List)
-            }
-            _ if self.s[self.i..].starts_with(b"new Array") => {
-                self.i += b"new Array".len();
-                self.ws();
-                if self.s.get(self.i) != Some(&b'(') {
-                    return None;
-                }
-                self.i += 1;
-                self.nested(b')').map(Arg::List)
-            }
-            _ if self.s[self.i..].starts_with(b"true") => {
-                self.i += 4;
-                Some(Arg::Bool(true))
-            }
-            _ if self.s[self.i..].starts_with(b"false") => {
-                self.i += 5;
-                Some(Arg::Bool(false))
-            }
-            _ => {
-                let start = self.i;
-                while self.i < self.s.len() && (self.s[self.i].is_ascii_digit() || matches!(self.s[self.i], b'.' | b'-' | b'+' | b'e' | b'E')) {
-                    self.i += 1;
-                }
-                std::str::from_utf8(&self.s[start..self.i]).ok()?.parse().ok().map(Arg::Num)
-            }
-        }
-    }
-
-    /// A list inside another, at most [`MAX_NESTING`] deep.
-    fn nested(&mut self, close: u8) -> Option<Vec<Arg>> {
-        if self.depth >= MAX_NESTING {
-            return None;
-        }
-        self.depth += 1;
-        let out = self.list(close);
-        self.depth -= 1;
-        out
-    }
-
-    fn list(&mut self, close: u8) -> Option<Vec<Arg>> {
-        let mut out = Vec::new();
-        loop {
-            self.ws();
-            if self.s.get(self.i) == Some(&close) {
-                self.i += 1;
-                return Some(out);
-            }
-            out.push(self.arg()?);
-            self.ws();
-            match self.s.get(self.i) {
-                Some(b',') => self.i += 1,
-                Some(c) if *c == close => {
-                    self.i += 1;
-                    return Some(out);
-                }
-                _ => return None,
-            }
-        }
-    }
-}
-
-/// The first call to `name(` in `js` and its arguments.
-fn call(js: &str, name: &str) -> Option<Vec<Arg>> {
-    let at = js.find(&format!("{name}("))?;
-    // Not part of a longer identifier (AFDate_Format vs AFDate_FormatEx).
-    if js[..at].chars().last().is_some_and(|c| c.is_alphanumeric() || c == '_') {
-        return None;
-    }
-    let mut p = Parser { s: js.as_bytes(), i: at + name.len() + 1, depth: 0 };
-    p.list(b')')
-}
-
-/// Acrobat's AFDate_Format(n) / AFTime_Format(n) presets.
-pub const DATE_PRESETS: [&str; 14] = [
-    "m/d",
-    "m/d/yy",
-    "mm/dd/yy",
-    "mm/yy",
-    "d-mmm",
-    "d-mmm-yy",
-    "dd-mmm-yy",
-    "yy-mm-dd",
-    "mmm-yy",
-    "mmmm-yy",
-    "mmm d, yyyy",
-    "mmmm d, yyyy",
-    "m/d/yy h:MM tt",
-    "m/d/yy HH:MM",
-];
-pub const TIME_PRESETS: [&str; 4] = ["HH:MM", "h:MM tt", "HH:MM:ss", "h:MM:ss tt"];
-
-pub fn parse_format(js: &str) -> Option<Format> {
-    let a = |args: &[Arg], i: usize| args.get(i).and_then(Arg::num).unwrap_or(0.0).clamp(0.0, 255.0) as u8;
-    if let Some(args) = call(js, "AFNumber_Format") {
-        return Some(Format::Number {
-            decimals: a(&args, 0),
-            sep: a(&args, 1),
-            neg: a(&args, 2),
-            currency: args.get(4).and_then(Arg::string).unwrap_or_default(),
-            prepend: args.get(5).is_none_or(Arg::truthy),
-        });
-    }
-    if let Some(args) = call(js, "AFPercent_Format") {
-        return Some(Format::Percent { decimals: a(&args, 0), sep: a(&args, 1) });
-    }
-    if let Some(args) = call(js, "AFDate_FormatEx") {
-        return Some(Format::Date(args.first().and_then(Arg::string)?));
-    }
-    if let Some(args) = call(js, "AFDate_Format") {
-        return Some(Format::Date(DATE_PRESETS.get(a(&args, 0) as usize)?.to_string()));
-    }
-    if let Some(args) = call(js, "AFTime_FormatEx") {
-        return Some(Format::Time(args.first().and_then(Arg::string)?));
-    }
-    if let Some(args) = call(js, "AFTime_Format") {
-        return Some(Format::Time(TIME_PRESETS.get(a(&args, 0) as usize)?.to_string()));
-    }
-    if let Some(args) = call(js, "AFSpecial_Format") {
-        return Some(Format::Special(a(&args, 0).min(3)));
-    }
-    if let Some(args) = call(js, "AFSpecial_KeystrokeEx") {
-        return Some(Format::Mask(args.first().and_then(Arg::string)?));
-    }
-    None
-}
-
-pub fn parse_validate(js: &str) -> Option<Validate> {
-    let args = call(js, "AFRange_Validate")?;
-    let flag = |i: usize| args.get(i).is_some_and(Arg::truthy);
-    let num = |i: usize| args.get(i).and_then(Arg::num);
-    Some(Validate::Range { min: if flag(0) { num(1) } else { None }, max: if flag(2) { num(3) } else { None } })
-}
-
-pub fn parse_calculate(js: &str) -> Option<Calculate> {
-    // Simplified field notation: Acrobat keeps the expression in a comment. A script is read for
-    // its comments only when it spells the marker.
-    if js.contains("BVCALC")
-        && let Some(range) = notation_range(js, &js_tokens(js).1)
-    {
-        return Some(Calculate::Notation(js.get(range)?.trim().to_string()));
-    }
-    let args = call(js, "AFSimple_Calculate")?;
-    let op = match args.first().and_then(Arg::string)?.as_str() {
-        "SUM" => CalcOp::Sum,
-        "PRD" => CalcOp::Product,
-        "AVG" => CalcOp::Average,
-        "MIN" => CalcOp::Minimum,
-        "MAX" => CalcOp::Maximum,
-        _ => return None,
-    };
-    let fields = match args.get(1)? {
-        Arg::List(l) => l.iter().filter_map(Arg::string).collect(),
-        Arg::Str(s) => s.split(',').map(|x| x.trim().to_string()).filter(|x| !x.is_empty()).collect(),
-        _ => return None,
-    };
-    Some(Calculate::Simple { op, fields })
-}
-
-// ── writing scripts (what Acrobat's tabs generate) ─────────────────────────────────────────
-
-fn js_str(s: &str) -> String {
-    let mut o = String::from("\"");
-    for c in s.chars() {
-        match c {
-            '"' | '\\' => {
-                o.push('\\');
-                o.push(c);
-            }
-            '\n' => o.push_str("\\n"),
-            '\r' => o.push_str("\\r"),
-            '\t' => o.push_str("\\t"),
-            c if c.is_ascii() && !c.is_control() => o.push(c),
-            c => {
-                let mut units = [0u16; 2];
-                for unit in c.encode_utf16(&mut units) {
-                    o.push_str(&format!("\\u{unit:04X}"));
-                }
-            }
-        }
-    }
-    o.push('"');
-    o
-}
-
-/// The (format, keystroke) scripts for a format.
-pub fn format_js(f: &Format) -> Option<(String, String)> {
-    Some(match f {
-        Format::None => return None,
-        Format::Number { decimals, sep, neg, currency, prepend } => {
-            let args = format!("{decimals}, {sep}, {neg}, 0, {}, {prepend}", js_str(currency));
-            (format!("AFNumber_Format({args});"), format!("AFNumber_Keystroke({args});"))
-        }
-        Format::Percent { decimals, sep } => (format!("AFPercent_Format({decimals}, {sep});"), format!("AFPercent_Keystroke({decimals}, {sep});")),
-        Format::Date(f) => (format!("AFDate_FormatEx({});", js_str(f)), format!("AFDate_KeystrokeEx({});", js_str(f))),
-        Format::Time(f) => (format!("AFTime_FormatEx({});", js_str(f)), format!("AFTime_KeystrokeEx({});", js_str(f))),
-        Format::Special(n) => (format!("AFSpecial_Format({n});"), format!("AFSpecial_Keystroke({n});")),
-        Format::Mask(m) => (String::new(), format!("AFSpecial_KeystrokeEx({});", js_str(m))),
-    })
-}
-
-pub fn validate_js(v: &Validate) -> Option<String> {
-    match v {
-        Validate::None => None,
-        Validate::Range { min, max } => {
-            Some(format!("AFRange_Validate({}, {}, {}, {});", min.is_some(), min.unwrap_or(0.0), max.is_some(), max.unwrap_or(0.0)))
-        }
-    }
-}
-
-pub fn calculate_js(c: &Calculate) -> Option<String> {
-    match c {
-        Calculate::None => None,
-        Calculate::Simple { op, fields } => Some(format!(
-            "AFSimple_Calculate({}, new Array({}));",
-            js_str(op.code()),
-            fields.iter().map(|f| js_str(f)).collect::<Vec<_>>().join(", ")
-        )),
-        // Acrobat's own translation follows the comment, so a viewer that runs the script instead
-        // of reading the comment computes the same value (a placeholder here showed 0).
-        Calculate::Notation(expr) => Some(format!("/** BVCALC {expr} EVCALC **/ event.value = {};", notation_js(expr))),
-    }
-}
-
-// ── renaming fields in calculations ─────────────────────────────────────────────────────────
-
-/// A JavaScript token, as far as finding the field names a calculation reads needs.
-#[derive(Clone, Debug, PartialEq)]
-enum Js {
-    Ident,
-    /// A string literal, its escapes undone.
-    Str(String),
-    Punct(char),
-    /// A number, a regular expression or a template literal.
-    Other,
-}
-
-/// A [`Js`] token with its byte range in the script.
-type Token = (Range<usize>, Js);
-
-/// Words after which `/` starts a regular expression instead of dividing.
-const BEFORE_REGEX: [&str; 13] = ["return", "typeof", "case", "do", "else", "in", "of", "new", "delete", "void", "throw", "instanceof", "yield"];
-
-/// Words whose condition, in parentheses, comes before a statement, so a `/` after it starts a
-/// regular expression. The `while` that ends a `do` loop counts too: the loop ends at its `)`, so
-/// a `/` after it starts the next statement, and can't divide.
-const BEFORE_CONDITION: [&str; 4] = ["if", "while", "for", "with"];
-
-/// Whether a line ends at `s[j]`: JavaScript ends one at `\n`, `\r`, U+2028 and U+2029.
-fn line_ends_at(s: &[u8], j: usize) -> bool {
-    matches!(s.get(j..), Some([b'\n' | b'\r', ..] | [0xE2, 0x80, 0xA8 | 0xA9, ..]))
-}
-
-/// JavaScript's tokens with their byte ranges, and apart from them the text of each comment
-/// (inside its `//`, or its `/*` and `*/`): enough of the language to tell code from strings,
-/// comments and regular expressions. The tokens stop where a string, comment or template literal
-/// never ends; a comment that never ends runs to the end of the script.
-fn js_tokens(js: &str) -> (Vec<Token>, Vec<Range<usize>>) {
-    let s = js.as_bytes();
-    // Whether `s[j]` is part of a word. Bytes past ASCII are parts of identifiers, except
-    // U+2028 and U+2029, which end a line: a range never ends inside a character.
-    let word = |j: usize| s.get(j).is_some_and(|&b| b.is_ascii_alphanumeric() || b == b'_' || b == b'$' || !b.is_ascii()) && !line_ends_at(s, j);
-    let mut out: Vec<Token> = Vec::new();
-    let mut comments = Vec::new();
-    let mut i = 0;
-    // Where a regular expression that never ended stopped being read: every `/` before it
-    // divides, so a line of them is read once, not once for each.
-    let mut divides_until = 0;
-    // For each `(` still open, whether it opened the condition of `if`, `while`, `for` or
-    // `with`; and whether the last token is the `)` that closed one.
-    let mut conditions: Vec<bool> = Vec::new();
-    let mut after_condition = false;
-    'scan: while let Some(&c) = s.get(i) {
-        let start = i;
-        let token = match c {
-            _ if c.is_ascii_whitespace() => {
-                i += 1;
-                continue;
-            }
-            // U+2028 or U+2029 between tokens ends a line, and is skipped whole: read a byte at a
-            // time, the rest of it would be read from inside the character.
-            0xE2 if line_ends_at(s, i) => {
-                i += 3;
-                continue;
-            }
-            b'/' if s.get(i + 1) == Some(&b'/') => {
-                i = (i + 2..s.len()).find(|&j| line_ends_at(s, j)).unwrap_or(s.len());
-                comments.push(start + 2..i);
-                continue;
-            }
-            b'/' if s.get(i + 1) == Some(&b'*') => match js.get(i + 2..).and_then(|rest| rest.find("*/")) {
-                Some(n) => {
-                    comments.push(i + 2..i + 2 + n);
-                    i += n + 4;
-                    continue;
-                }
-                None => {
-                    comments.push(i + 2..s.len());
-                    break 'scan;
-                }
-            },
-            b'"' | b'\'' => {
-                let mut p = Parser { s, i, depth: 0 };
-                let Some(text) = p.string() else { break 'scan };
-                i = p.i;
-                Js::Str(text)
-            }
-            b'`' => {
-                let mut j = i + 1;
-                loop {
-                    match s.get(j) {
-                        None => break 'scan,
-                        Some(b'\\') => j += 2,
-                        Some(b'`') => break,
-                        Some(_) => j += 1,
-                    }
-                }
-                i = j + 1;
-                Js::Other
-            }
-            b'/' if i >= divides_until && regex_may_follow(js, &out, after_condition) => {
-                // A regular expression ends at a `/` outside a class; a line break first means it
-                // was a division after all.
-                let (mut j, mut class) = (i + 1, false);
-                let end = loop {
-                    match s.get(j) {
-                        None => break None,
-                        Some(_) if line_ends_at(s, j) => break None,
-                        Some(b'\\') => j += 2,
-                        Some(b'/') if !class => break Some(j),
-                        Some(b) => {
-                            class = match b {
-                                b'[' => true,
-                                b']' => false,
-                                _ => class,
-                            };
-                            j += 1;
-                        }
-                    }
-                };
-                match end {
-                    Some(e) => {
-                        i = e + 1;
-                        while word(i) {
-                            i += 1;
-                        }
-                        Js::Other
-                    }
-                    None => {
-                        divides_until = j;
-                        i += 1;
-                        Js::Punct('/')
-                    }
-                }
-            }
-            _ if c.is_ascii_digit() => {
-                while word(i) || s.get(i) == Some(&b'.') {
-                    i += 1;
-                }
-                Js::Other
-            }
-            _ if word(i) => {
-                while word(i) {
-                    i += 1;
-                }
-                Js::Ident
-            }
-            _ => {
-                i += 1;
-                Js::Punct(char::from(c))
-            }
-        };
-        after_condition = match token {
-            Js::Punct('(') => {
-                conditions.push(opens_condition(js, &out));
-                false
-            }
-            Js::Punct(')') => conditions.pop().unwrap_or(false),
-            _ => false,
-        };
-        out.push((start..i, token));
-    }
-    (out, comments)
-}
-
-/// Whether a `/` after `tokens` starts a regular expression: after an operator, an opening
-/// bracket, a keyword such as `return` or the condition of `if`, `while`, `for` or `with`, not
-/// after a value. `after_condition` says the last token is the `)` that ends such a condition.
-fn regex_may_follow(js: &str, tokens: &[Token], after_condition: bool) -> bool {
-    match tokens.last() {
-        None => true,
-        Some((range, Js::Ident)) => js.get(range.clone()).is_some_and(|w| BEFORE_REGEX.contains(&w)),
-        Some((_, Js::Punct(')'))) => after_condition,
-        Some((_, Js::Punct(c))) => !matches!(c, ']' | '}'),
-        Some((_, Js::Str(_) | Js::Other)) => false,
-    }
-}
-
-/// Whether a `(` after `tokens` opens the condition of `if`, `while`, `for` or `with`, and not
-/// the arguments of a method that has one of those names (`o.if(x)`).
-fn opens_condition(js: &str, tokens: &[Token]) -> bool {
-    let mut back = tokens.iter().rev();
-    let Some((range, Js::Ident)) = back.next() else { return false };
-    js.get(range.clone()).is_some_and(|w| BEFORE_CONDITION.contains(&w)) && !matches!(back.next(), Some((_, Js::Punct('.'))))
-}
-
-/// Where a Calculate script keeps its simplified field notation: between `BVCALC` and the
-/// `EVCALC` after it, in the first of `comments` that holds both, as Acrobat writes it
-/// (`/** BVCALC a + b EVCALC **/`). A string or code that spells the markers is not the notation.
-fn notation_range(js: &str, comments: &[Range<usize>]) -> Option<Range<usize>> {
-    comments.iter().find_map(|comment| {
-        let text = js.get(comment.clone())?;
-        let a = text.find("BVCALC")? + 6;
-        let b = a + text.get(a..)?.find("EVCALC")?;
-        Some(comment.start + a..comment.start + b)
-    })
-}
-
-/// A place where a Calculate script names a field.
-#[derive(Clone, Debug, PartialEq)]
-enum Site {
-    /// A string literal holding one name: `getField("a")`, or an item of an
-    /// `AFSimple_Calculate` list.
-    Literal(String),
-    /// An `AFSimple_Calculate` list written as one string of comma-separated names.
-    Commas(String),
-    /// A name in the simplified field notation of a `BVCALC` comment.
-    Notation(String),
-}
-
-impl Site {
-    fn names(&self) -> Vec<&str> {
-        match self {
-            Site::Literal(name) | Site::Notation(name) => vec![name.as_str()],
-            Site::Commas(list) => list.split(',').map(str::trim).filter(|n| !n.is_empty()).collect(),
-        }
-    }
-
-    /// The site written again with field `old` named `new`, or `None` when it doesn't name `old`.
-    fn renamed(&self, old: &str, new: &str) -> Option<String> {
-        match self {
-            Site::Literal(name) => (name == old).then(|| js_str(new)),
-            Site::Notation(name) => (name == old).then(|| notation_name(new)),
-            Site::Commas(list) => {
-                let parts: Vec<&str> = list.split(',').collect();
-                parts.iter().any(|p| p.trim() == old).then(|| {
-                    // The spaces around each name stay as they were.
-                    let parts: Vec<String> = parts.iter().map(|p| if p.trim() == old { p.replacen(old, new, 1) } else { (*p).to_owned() }).collect();
-                    js_str(&parts.join(","))
-                })
-            }
-        }
-    }
-}
-
-/// Where a Calculate script names fields, in order: the simplified field notation in its comment
-/// (see [`notation_range`]; [`parse_calculate`] reads it there too), the field list of
-/// `AFSimple_Calculate`, and every `getField` whose whole argument is one string literal.
-/// A name built at run time (`getField("row" + i)`) is not a site.
-fn calculation_sites(js: &str) -> Vec<(Range<usize>, Site)> {
-    let mut sites = Vec::new();
-    let (tokens, comments) = js_tokens(js);
-    if let Some(at) = notation_range(js, &comments)
-        && let Some(expr) = js.get(at.clone())
-    {
-        for (range, token) in notation_tokens(expr) {
-            if let Notation::Name(name) = token {
-                sites.push((at.start + range.start..at.start + range.end, Site::Notation(name)));
-            }
-        }
-    }
-    let ident = |k: usize, word: &str| tokens.get(k).is_some_and(|(range, t)| *t == Js::Ident && js.get(range.clone()) == Some(word));
-    let punct = |k: usize, c: char| tokens.get(k).is_some_and(|(_, t)| *t == Js::Punct(c));
-    let string = |k: usize| match tokens.get(k) {
-        Some((range, Js::Str(text))) => Some((range.clone(), text.clone())),
-        _ => None,
-    };
-    for k in 0..tokens.len() {
-        if ident(k, "getField")
-            && punct(k + 1, '(')
-            && punct(k + 3, ')')
-            && let Some((range, name)) = string(k + 2)
-        {
-            sites.push((range, Site::Literal(name)));
-        }
-        if !(ident(k, "AFSimple_Calculate") && punct(k + 1, '(') && string(k + 2).is_some() && punct(k + 3, ',')) {
-            continue;
-        }
-        if let Some((range, list)) = string(k + 4) {
-            sites.push((range, Site::Commas(list)));
-            continue;
-        }
-        // `new Array("a", "b")` or `["a", "b"]`: its items, up to the first that isn't a string.
-        // Nothing else is read, so no token is read for two calls.
-        let first = if punct(k + 4, '[') {
-            k + 5
-        } else if ident(k + 4, "new") && ident(k + 5, "Array") && punct(k + 6, '(') {
-            k + 7
-        } else {
-            continue;
-        };
-        for (range, token) in tokens.iter().skip(first) {
-            match token {
-                Js::Str(name) => sites.push((range.clone(), Site::Literal(name.clone()))),
-                Js::Punct(',') => {}
-                _ => break,
-            }
-        }
-    }
-    sites.sort_by_key(|(range, _)| range.start);
-    sites
-}
-
-/// A Calculate script with field `old` named `new` everywhere it reads it (see
-/// [`calculation_sites`]), the rest kept as written; `None` when it doesn't read `old`. Also
-/// `None` when the new name would read as more than a name there (one holding `EVCALC` would end
-/// the notation early), so a script is never left meaning something else.
-pub fn rename_in_calculation(js: &str, old: &str, new: &str) -> Option<String> {
-    let sites = calculation_sites(js);
-    let edits: Vec<(Range<usize>, String)> = sites.iter().filter_map(|(range, site)| Some((range.clone(), site.renamed(old, new)?))).collect();
-    if edits.is_empty() {
-        return None;
-    }
-    let out = splice(js, edits);
-    let expected: Vec<&str> = sites.iter().flat_map(|(_, site)| site.names()).map(|n| if n == old { new } else { n }).collect();
-    let written = calculation_sites(&out);
-    let got: Vec<&str> = written.iter().flat_map(|(_, site)| site.names()).collect();
-    (got == expected).then_some(out)
-}
-
-/// The fields a Calculate script reads by name (see [`calculation_sites`]), each once, in the
-/// order it first names them.
-pub fn calculation_reads(js: &str) -> Vec<String> {
-    let sites = calculation_sites(js);
-    unique(sites.iter().flat_map(|(_, site)| site.names()).map(str::to_owned))
-}
-
-impl Calculate {
-    /// The fields it reads, each once, in the order it first names them. A name also stands for
-    /// the fields under it (`row` for `row.0` and `row.1`), as [`calculate`] reads them.
-    pub fn reads(&self) -> Vec<String> {
-        match self {
-            Calculate::None => Vec::new(),
-            Calculate::Simple { fields, .. } => unique(fields.iter().cloned()),
-            Calculate::Notation(expr) => unique(notation_tokens(expr).into_iter().filter_map(|(_, token)| match token {
-                Notation::Name(name) => Some(name),
-                _ => None,
-            })),
-        }
-    }
-}
-
-/// `names` without repeats, in order.
-fn unique(names: impl IntoIterator<Item = String>) -> Vec<String> {
-    let mut seen = std::collections::HashSet::new();
-    names.into_iter().filter(|n| seen.insert(n.clone())).collect()
-}
-
-// ── running them ────────────────────────────────────────────────────────────────────────────
-
-/// AFMakeNumber: a number from typed text (currency symbols, group separators, spaces and a
-/// trailing % ignored; a comma decimal separator accepted).
-pub fn make_number(s: &str) -> Option<f64> {
-    let t: String = s.trim().chars().filter(|c| !c.is_whitespace() && !matches!(c, '$' | '€' | '£' | '¥' | '\'' | '%')).collect();
-    if t.is_empty() {
-        return None;
-    }
-    let neg = t.starts_with('(') && t.ends_with(')');
-    let t = t.trim_start_matches('(').trim_end_matches(')');
-    // "1.234,56" or "1234,56": comma is the decimal separator when it comes last.
-    let normalized = match (t.rfind(','), t.rfind('.')) {
-        (Some(c), Some(d)) if c > d => t.replace('.', "").replace(',', "."),
-        (Some(c), None) if t.len() - c - 1 != 3 => t.replace(',', "."),
-        _ => t.replace(',', ""),
-    };
-    let v: f64 = normalized.parse().ok()?;
-    v.is_finite().then_some(if neg { -v } else { v })
-}
-
-/// A number as JavaScript prints it (integers without a fraction).
-pub fn js_number(v: f64) -> String {
-    if v.fract() == 0.0 && v.abs() < 1e15 { format!("{}", v as i64) } else { format!("{v}") }
-}
-
-fn group(int: &str, sep: char) -> String {
-    let mut out = String::new();
-    for (i, c) in int.chars().enumerate() {
-        if i > 0 && (int.len() - i).is_multiple_of(3) {
-            out.push(sep);
-        }
-        out.push(c);
-    }
-    out
-}
-
-/// A number with `decimals` places in separator style `sep` (0 "1,234.56", 1 "1234.56",
-/// 2 "1.234,56", 3 "1234,56", 4 "1'234.56").
-fn number_text(v: f64, decimals: u8, sep: u8) -> String {
-    // Round half away from zero, as JavaScript's toFixed does for these values.
-    let p = 10f64.powi(i32::from(decimals));
-    let s = format!("{:.*}", decimals as usize, (v.abs() * p).round() / p);
-    let (int, frac) = s.split_once('.').map_or((s.as_str(), ""), |(a, b)| (a, b));
-    let (g, d) = match sep {
-        1 => (None, '.'),
-        2 => (Some('.'), ','),
-        3 => (None, ','),
-        4 => (Some('\''), '.'),
-        _ => (Some(','), '.'),
-    };
-    let mut out = match g {
-        Some(c) => group(int, c),
-        None => int.to_string(),
-    };
-    if !frac.is_empty() {
-        out.push(d);
-        out.push_str(frac);
-    }
-    out
-}
-
-const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
-const DAYS: [&str; 7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
-
-/// A date and time read from text.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct DateTime {
-    pub y: i32,
-    pub m: u32,
-    pub d: u32,
-    pub hh: u32,
-    pub mm: u32,
-    pub ss: u32,
-}
-
-fn days_in(y: i32, m: u32) -> u32 {
-    match m {
-        2 if (y % 4 == 0 && y % 100 != 0) || y % 400 == 0 => 29,
-        2 => 28,
-        4 | 6 | 9 | 11 => 30,
-        _ => 31,
-    }
-}
-
-fn weekday(y: i32, m: u32, d: u32) -> usize {
-    // Sakamoto's method, in i64 so no year or day can overflow it.
-    const T: [i64; 12] = [0, 3, 2, 5, 0, 3, 5, 1, 4, 6, 2, 4];
-    let y = i64::from(y) - i64::from(m < 3);
-    let t = T.get((m as usize).wrapping_sub(1)).copied().unwrap_or(0);
-    (y + y / 4 - y / 100 + y / 400 + t + i64::from(d)).rem_euclid(7) as usize
-}
-
-/// One field of a date format, in the order the format has them.
-struct Part {
-    /// `'y'`, `'m'`, `'d'`, `'H'`, `'M'` or `'s'`; a run of literal digits (the fixed year in
-    /// "dd.mm.26") is `'#'`.
-    kind: char,
-    /// The value of a `'#'` run; 0 for the others.
-    literal: u32,
-    /// The digits the field takes when typed run together with the next one: 4 for "yyyy", 2 for
-    /// "yy", "mm", "dd", "HH", "MM" and "ss". 0 when the width varies ("m", "d") or the field is
-    /// a name ("mmm").
-    width: usize,
-    /// The next field follows with nothing between them ("yyyymmdd"), so one run of typed digits
-    /// can hold both.
-    joined: bool,
-}
-
-/// The fields of a format (year, month, day, hours, minutes, seconds and literal digits), in
-/// order.
-fn order(fmt: &str) -> Vec<Part> {
-    let mut out: Vec<Part> = Vec::new();
-    // Weekday names (ddd, dddd) are shown, not typed: leave them out.
-    let mut cleaned = fmt.replace("dddd", " ");
-    cleaned = cleaned.replace("ddd", " ");
-    let mut prev = ' ';
-    // The letter of the last field's current run and its length so far.
-    let mut run: Option<(char, usize)> = None;
-    let fixed = |k: char, n: usize| match (k, n) {
-        ('y', 2 | 4) | ('m' | 'd' | 'H' | 'M' | 's', 2) => n,
-        _ => 0,
-    };
-    for c in cleaned.chars() {
-        let continues = run.is_some_and(|(r, _)| r == c);
-        if let Some((r, n)) = run
-            && !continues
-        {
-            // The run ended; it was the last field's width.
-            if let Some(last) = out.last_mut().filter(|p| p.kind != '#') {
-                last.width = fixed(if r == 'h' { 'H' } else { r }, n);
-            }
-            run = None;
-        }
-        if let Some(digit) = c.to_digit(10) {
-            match out.last_mut() {
-                Some(p) if p.kind == '#' && prev.is_ascii_digit() => p.literal = p.literal.saturating_mul(10).saturating_add(digit),
-                _ => out.push(Part { kind: '#', literal: digit, width: 0, joined: false }),
-            }
-            prev = c;
-            continue;
-        }
-        let k = match c {
-            'y' => 'y',
-            'm' => 'm',
-            'd' => 'd',
-            'H' | 'h' => 'H',
-            'M' => 'M',
-            's' => 's',
-            _ => {
-                prev = c;
-                continue;
-            }
-        };
-        if continues {
-            run = run.map(|(r, n)| (r, n.saturating_add(1)));
-        } else {
-            // A field starting right where the last one's letters stopped is joined to it.
-            let adjacent = matches!(prev, 'y' | 'm' | 'd' | 'H' | 'h' | 'M' | 's');
-            if out.last().map(|p| p.kind) != Some(k) {
-                if let Some(last) = out.last_mut().filter(|p| p.kind != '#') {
-                    last.joined = adjacent;
-                }
-                out.push(Part { kind: k, literal: 0, width: 0, joined: false });
-            }
-            run = Some((c, 1));
-        }
-        prev = c;
-    }
-    if let (Some((r, n)), Some(last)) = (run, out.last_mut().filter(|p| p.kind != '#')) {
-        last.width = fixed(if r == 'h' { 'H' } else { r }, n);
-    }
-    out
-}
-
-/// Parse typed text against a date/time format (AFDate_KeystrokeEx's leniency: any
-/// separators, month names, two-digit years). `None` when it isn't a valid date.
-pub fn parse_date(text: &str, fmt: &str) -> Option<DateTime> {
-    let t = text.trim();
-    if t.is_empty() {
-        return None;
-    }
-    let lower = t.to_lowercase();
-    // A bare trailing "p" ("5:30p") only counts when it follows a digit, not a word like "Sep".
-    let bare_p = lower.strip_suffix('p').is_some_and(|rest| rest.trim_end().ends_with(|c: char| c.is_ascii_digit()));
-    let pm = lower.contains("pm") || bare_p;
-    let bare_a = lower.strip_suffix('a').is_some_and(|rest| rest.trim_end().ends_with(|c: char| c.is_ascii_digit()));
-    let am = lower.contains("am") || bare_a;
-    // Tokens: runs of digits (kept as text, so a run can be split between fields typed without
-    // separators) and month names.
-    let mut nums: VecDeque<String> = VecDeque::new();
-    let mut month_name: Option<u32> = None;
-    let mut cur = String::new();
-    let flush = |cur: &mut String, nums: &mut VecDeque<String>, month: &mut Option<u32>| {
-        if cur.is_empty() {
-            return;
-        }
-        if cur.starts_with(|c: char| c.is_ascii_digit()) {
-            nums.push_back(std::mem::take(cur));
-        } else if cur.len() >= 3
-            && let Some(i) = MONTHS.iter().position(|m| m.to_lowercase().starts_with(&cur.to_lowercase()))
-        {
-            *month = Some(i as u32 + 1);
-        }
-        cur.clear();
-    };
-    for c in t.chars() {
-        // Digits and letters form separate tokens ("5Mar" is 5 and Mar).
-        let same_kind = cur.is_empty() || cur.chars().next().is_some_and(|x| x.is_ascii_digit()) == c.is_ascii_digit();
-        if c.is_alphanumeric() && same_kind {
-            cur.push(c);
-        } else {
-            flush(&mut cur, &mut nums, &mut month_name);
-            if c.is_alphanumeric() {
-                cur.push(c);
-            }
-        }
-    }
-    flush(&mut cur, &mut nums, &mut month_name);
-    let mut dt = DateTime { y: 0, m: 1, d: 1, hh: 0, mm: 0, ss: 0 };
-    // The next number for a field. A field joined to the next one in the format ("yyyymmdd")
-    // takes only its own width from a longer run of digits and leaves the rest for the next.
-    // A run typed on its own is split only when fewer runs were typed than the fields of its kind
-    // still to fill (`need`, this one included: date fields for a date field, time fields for a
-    // time field, since times may be left out), and only when its rest can fill the next field
-    // (`next_width`): with separators each run is one field's number, so "2026-10-18" keeps its
-    // four-digit year in a yymmdd or yymmddHHMM field, and "2026 10 018" is the 18th. What is left
-    // of a split run (`tail`: the front of `nums` is one) goes on being split along the fields
-    // written side by side, and must fill its last field exactly, so "202610018" leaves "018" for
-    // dd and is refused. `None` when there is no number left, it doesn't fit a u32, or such a
-    // rest has the wrong width.
-    let next_number = |nums: &mut VecDeque<String>, tail: &mut bool, part: &Part, need: usize, next_width: usize| -> Option<u32> {
-        let run = nums.pop_front()?;
-        let was_tail = std::mem::replace(tail, false);
-        let short = nums.len() < need.saturating_sub(1);
-        let digits = match (run.get(..part.width), run.get(part.width..)) {
-            (Some(head), Some(rest)) if part.joined && part.width > 0 && !rest.is_empty() && (was_tail || (short && rest.len() >= next_width)) => {
-                nums.push_front(rest.to_string());
-                *tail = true;
-                head
-            }
-            _ if was_tail && part.width > 0 && run.len() != part.width => return None,
-            _ => run.as_str(),
-        };
-        digits.parse::<u32>().ok()
-    };
-    let parts = order(fmt);
-    let takes_number = |p: &Part| matches!(p.kind, 'y' | 'd' | 'H' | 'M' | 's') || (p.kind == 'm' && month_name.is_none());
-    let is_time = |p: &Part| matches!(p.kind, 'H' | 'M' | 's');
-    // The fields of each kind still to fill: [date, time].
-    let mut wanted = [parts.iter().filter(|p| takes_number(p) && !is_time(p)).count(), parts.iter().filter(|p| is_time(p)).count()];
-    let mut tail = false;
-    let mut have_y = false;
-    for (i, part) in parts.iter().enumerate() {
-        let kind = usize::from(is_time(part));
-        let need = wanted.get(kind).copied().unwrap_or(0);
-        let next_width = parts.get(i + 1).map_or(0, |p| p.width);
-        if takes_number(part)
-            && let Some(left) = wanted.get_mut(kind)
-        {
-            *left = left.saturating_sub(1);
-        }
-        let take = |nums: &mut VecDeque<String>, tail: &mut bool| next_number(nums, tail, part, need, next_width);
-        match part.kind {
-            // Literal digits in the format may be typed or left out ("15.05.26" or "15.05"
-            // for "dd.mm.26"); a different number there is left over and rejected below.
-            '#' if nums.front().and_then(|n| n.parse::<u32>().ok()) == Some(part.literal) => {
-                nums.pop_front();
-                tail = false;
-            }
-            'm' => {
-                dt.m = match month_name {
-                    Some(m) => m,
-                    None => take(&mut nums, &mut tail)?,
-                }
-            }
-            'd' => dt.d = take(&mut nums, &mut tail)?,
-            'y' => {
-                let y = i32::try_from(take(&mut nums, &mut tail)?).ok()?;
-                dt.y = if y < 100 { if y < 50 { 2000 + y } else { 1900 + y } } else { y };
-                have_y = true;
-            }
-            // Times may be left out; a number that is there must be readable.
-            'H' => dt.hh = if nums.is_empty() { 0 } else { take(&mut nums, &mut tail)? },
-            'M' => dt.mm = if nums.is_empty() { 0 } else { take(&mut nums, &mut tail)? },
-            's' => dt.ss = if nums.is_empty() { 0 } else { take(&mut nums, &mut tail)? },
-            _ => {}
-        }
-    }
-    if !nums.is_empty() {
-        return None;
-    }
-    if !have_y {
-        dt.y = 2000;
-    }
-    if pm && dt.hh < 12 {
-        dt.hh += 12;
-    }
-    if am && dt.hh == 12 {
-        dt.hh = 0;
-    }
-    let has_date = fmt.contains(['y', 'm', 'd']);
-    if has_date && (!(1..=12).contains(&dt.m) || dt.d == 0 || dt.d > days_in(dt.y, dt.m)) {
-        return None;
-    }
-    if dt.hh > 23 || dt.mm > 59 || dt.ss > 59 {
-        return None;
-    }
-    Some(dt)
-}
-
-/// Format a date/time with Acrobat's date format letters.
-pub fn format_date(dt: DateTime, fmt: &str) -> String {
-    let chars: Vec<char> = fmt.chars().collect();
-    let mut out = String::new();
-    let mut i = 0;
-    while i < chars.len() {
-        let c = chars[i];
-        let mut n = 1;
-        while i + n < chars.len() && chars[i + n] == c {
-            n += 1;
-        }
-        let h12 = if dt.hh.is_multiple_of(12) { 12 } else { dt.hh % 12 };
-        match (c, n) {
-            ('y', 4..) => {
-                let _ = write!(out, "{:04}", dt.y);
-            }
-            ('y', _) => {
-                let _ = write!(out, "{:02}", dt.y.rem_euclid(100));
-            }
-            ('m', 3..) => match MONTHS.get((dt.m as usize).wrapping_sub(1)) {
-                Some(name) if n >= 4 => out.push_str(name),
-                Some(name) => out.push_str(name.get(..3).unwrap_or(name)),
-                None => {
-                    let _ = write!(out, "{}", dt.m);
-                }
-            },
-            ('m', 2) => {
-                let _ = write!(out, "{:02}", dt.m);
-            }
-            ('m', _) => {
-                let _ = write!(out, "{}", dt.m);
-            }
-            ('d', 3..) => {
-                let name = DAYS.get(weekday(dt.y, dt.m, dt.d)).copied().unwrap_or_default();
-                out.push_str(if n >= 4 { name } else { name.get(..3).unwrap_or(name) });
-            }
-            ('d', 2) => {
-                let _ = write!(out, "{:02}", dt.d);
-            }
-            ('d', _) => {
-                let _ = write!(out, "{}", dt.d);
-            }
-            ('H', 2) => {
-                let _ = write!(out, "{:02}", dt.hh);
-            }
-            ('H', _) => {
-                let _ = write!(out, "{}", dt.hh);
-            }
-            ('h', 2) => {
-                let _ = write!(out, "{h12:02}");
-            }
-            ('h', _) => {
-                let _ = write!(out, "{h12}");
-            }
-            ('M', 2) => {
-                let _ = write!(out, "{:02}", dt.mm);
-            }
-            ('M', _) => {
-                let _ = write!(out, "{}", dt.mm);
-            }
-            ('s', 2) => {
-                let _ = write!(out, "{:02}", dt.ss);
-            }
-            ('s', _) => {
-                let _ = write!(out, "{}", dt.ss);
-            }
-            ('t', 2) => out.push_str(if dt.hh < 12 { "am" } else { "pm" }),
-            ('t', _) => out.push(if dt.hh < 12 { 'a' } else { 'p' }),
-            (c, n) => out.extend(std::iter::repeat_n(c, n)),
-        }
-        i += n;
-    }
-    out
-}
-
-const SPECIAL_MASKS: [&str; 4] = ["99999", "99999-9999", "(999) 999-9999", "999-99-9999"];
-
-fn mask_fits(mask: &str, text: &str) -> bool {
-    let t: Vec<char> = text.chars().collect();
-    let m: Vec<char> = mask.chars().collect();
-    t.len() == m.len()
-        && m.iter().zip(&t).all(|(mc, tc)| match mc {
-            '9' => tc.is_ascii_digit(),
-            'A' => tc.is_alphabetic(),
-            'O' => tc.is_alphanumeric(),
-            'X' => true,
-            other => other == tc,
-        })
-}
-
-/// Fill a mask from the typed characters that fit its slots.
-fn apply_mask(mask: &str, text: &str) -> Option<String> {
-    let mut src = text.chars().filter(|c| c.is_alphanumeric());
-    let mut out = String::new();
-    for mc in mask.chars() {
-        match mc {
-            '9' | 'A' | 'O' | 'X' => {
-                let c = src.next()?;
-                let ok = match mc {
-                    '9' => c.is_ascii_digit(),
-                    'A' => c.is_alphabetic(),
-                    _ => true,
-                };
-                if !ok {
-                    return None;
-                }
-                out.push(c);
-            }
-            other => out.push(other),
-        }
-    }
-    src.next().is_none().then_some(out)
-}
-
-/// The text shown for a value (the Format event).
-pub fn format_value(f: &Format, value: &str) -> String {
-    if value.is_empty() {
-        return String::new();
-    }
-    match f {
-        Format::None => value.to_string(),
-        Format::Number { decimals, sep, neg, currency, prepend } => {
-            let Some(v) = make_number(value) else { return value.to_string() };
-            let body = number_text(v, *decimals, *sep);
-            let body = match (currency.is_empty(), *prepend) {
-                (true, _) => body,
-                (false, true) => format!("{currency}{body}"),
-                (false, false) => format!("{body}{currency}"),
-            };
-            match (v < 0.0, neg) {
-                (false, _) => body,
-                // Styles 2 and 3 use parentheses (3 is also red, which the appearance can't
-                // know here); 0 and 1 a minus sign.
-                (true, 2 | 3) => format!("({body})"),
-                (true, _) => format!("-{body}"),
-            }
-        }
-        Format::Percent { decimals, sep } => match make_number(value) {
-            Some(v) => format!(
-                "{}%",
-                if v < 0.0 { format!("-{}", number_text(v * 100.0, *decimals, *sep)) } else { number_text(v * 100.0, *decimals, *sep) }
-            ),
-            None => value.to_string(),
-        },
-        Format::Date(fmt) | Format::Time(fmt) => parse_date(value, fmt).map_or_else(|| value.to_string(), |dt| format_date(dt, fmt)),
-        Format::Special(n) => apply_mask(SPECIAL_MASKS[(*n).min(3) as usize], value).unwrap_or_else(|| value.to_string()),
-        Format::Mask(m) => apply_mask(m, value).unwrap_or_else(|| value.to_string()),
-    }
-}
-
-/// The Keystroke event on commit: does the value fit the format? Returns the value to store
-/// (numbers are normalised), or Acrobat's message.
-pub fn keystroke(f: &Format, field: &str, value: &str) -> Result<String, String> {
-    let bad = || format!("The value entered does not match the format of the field [ {field} ]");
-    // Blank input clears a formatted field; without a format, whitespace is text like any other.
-    if *f != Format::None && value.trim().is_empty() {
-        return Ok(String::new());
-    }
-    match f {
-        Format::None => Ok(value.to_string()),
-        Format::Number { .. } => make_number(value).map(js_number).ok_or_else(bad),
-        Format::Percent { .. } => {
-            // Typed "12.5%" or "12.5" both mean 0.125 once stored? Acrobat stores the number
-            // as typed and shows it ×100: keep the typed number.
-            make_number(value).map(js_number).ok_or_else(bad)
-        }
-        Format::Date(fmt) | Format::Time(fmt) => parse_date(value, fmt)
-            .map(|_| value.trim().to_string())
-            .ok_or_else(|| format!("Invalid date/time: please ensure that the date/time exists. Field [ {field} ] should match format {fmt}")),
-        Format::Special(n) => {
-            let m = SPECIAL_MASKS[(*n).min(3) as usize];
-            apply_mask(m, value).filter(|s| mask_fits(m, s)).map(|_| value.trim().to_string()).ok_or_else(bad)
-        }
-        Format::Mask(m) => apply_mask(m, value).map(|_| value.trim().to_string()).ok_or_else(bad),
-    }
-}
-
-/// The Validate event: `Err` with Acrobat's message when the value is out of range.
-pub fn validate(v: &Validate, value: &str) -> Result<(), String> {
-    let Validate::Range { min, max } = v else { return Ok(()) };
-    if value.trim().is_empty() {
-        return Ok(());
-    }
-    let Some(x) = make_number(value) else { return Ok(()) };
-    let fmt = |n: f64| js_number(n);
-    let ok = min.is_none_or(|m| x >= m) && max.is_none_or(|m| x <= m);
-    if ok {
-        return Ok(());
-    }
-    Err(match (min, max) {
-        (Some(a), Some(b)) => format!("Invalid value: must be greater than or equal to {} and less than or equal to {}.", fmt(*a), fmt(*b)),
-        (Some(a), None) => format!("Invalid value: must be greater than or equal to {}.", fmt(*a)),
-        (None, Some(b)) => format!("Invalid value: must be less than or equal to {}.", fmt(*b)),
-        (None, None) => String::new(),
-    })
-}
-
-/// A token of simplified field notation.
-#[derive(Clone, Debug, PartialEq)]
-enum Notation {
-    /// A number, as written.
-    Number,
-    /// `+ - * / ( )`.
-    Op(char),
-    /// A field name, its `\` escapes undone.
-    Name(String),
-}
-
-/// Simplified field notation's tokens, each with its byte range in `src`. Whitespace separates
-/// them, and `\` escapes a space or an operator inside a name, as Acrobat writes them.
-fn notation_tokens(src: &str) -> Vec<(Range<usize>, Notation)> {
-    let breaks = |c: char| c.is_whitespace() || "+-*/()".contains(c);
-    let mut out = Vec::new();
-    let mut cs = src.char_indices().peekable();
-    while let Some(&(start, c)) = cs.peek() {
-        let mut end = start + c.len_utf8();
-        if c.is_whitespace() {
-            cs.next();
-        } else if breaks(c) {
-            cs.next();
-            out.push((start..end, Notation::Op(c)));
-        } else if c.is_ascii_digit() || c == '.' {
-            while let Some((i, d)) = cs.next_if(|(_, d)| d.is_ascii_digit() || *d == '.') {
-                end = i + d.len_utf8();
-            }
-            out.push((start..end, Notation::Number));
-        } else {
-            let mut name = String::new();
-            while let Some((i, n)) = cs.next_if(|(_, n)| !breaks(*n)) {
-                end = i + n.len_utf8();
-                if n == '\\'
-                    && let Some((j, next)) = cs.next()
-                {
-                    end = j + next.len_utf8();
-                    name.push(next);
-                } else {
-                    name.push(n);
-                }
-            }
-            out.push((start..end, Notation::Name(name)));
-        }
-    }
-    out
-}
-
-/// A field name as simplified field notation writes it: `\` before a space, an operator or a
-/// `\`, and before a first character that would start a number.
-fn notation_name(name: &str) -> String {
-    let mut out = String::new();
-    for (i, c) in name.chars().enumerate() {
-        if c.is_whitespace() || "+-*/()\\".contains(c) || (i == 0 && (c.is_ascii_digit() || c == '.')) {
-            out.push('\\');
-        }
-        out.push(c);
-    }
-    out
-}
-
-/// `src` with each range replaced. The ranges come in order and don't overlap; one that does
-/// is left out rather than written over another.
-fn splice(src: &str, edits: impl IntoIterator<Item = (Range<usize>, String)>) -> String {
-    let mut out = String::with_capacity(src.len());
-    let mut done = 0;
-    for (range, with) in edits {
-        let Some(kept) = src.get(done..range.start).filter(|_| range.start <= range.end) else { continue };
-        out.push_str(kept);
-        out.push_str(&with);
-        done = range.end;
-    }
-    out.push_str(src.get(done..).unwrap_or_default());
-    out
-}
-
-/// Simplified field notation as the JavaScript Acrobat writes after its `BVCALC` comment:
-/// each field name becomes `AFMakeNumber(this.getField("name").value)`, the rest stays.
-pub fn notation_js(expr: &str) -> String {
-    let names = notation_tokens(expr).into_iter().filter_map(|(range, t)| match t {
-        Notation::Name(name) => Some((range, format!("AFMakeNumber(this.getField({}).value)", js_str(&name)))),
-        _ => None,
-    });
-    splice(expr, names)
-}
-
-/// Evaluate simplified field notation: + - * / and parentheses over numbers and field names.
-fn eval_notation(src: &str, value_of: &dyn Fn(&str) -> f64) -> Option<f64> {
-    #[derive(Debug, Clone, PartialEq)]
-    enum T {
-        N(f64),
-        Op(char),
-    }
-    let toks = notation_tokens(src)
-        .into_iter()
-        .map(|(range, t)| match t {
-            Notation::Number => src.get(range)?.parse().ok().map(T::N),
-            Notation::Op(c) => Some(T::Op(c)),
-            Notation::Name(name) => Some(T::N(value_of(&name))),
-        })
-        .collect::<Option<Vec<T>>>()?;
-    // Recursive descent, `d` levels deep (at most MAX_NESTING).
-    fn expr(t: &[T], i: &mut usize, d: usize) -> Option<f64> {
-        let mut v = term(t, i, d)?;
-        while let Some(T::Op(o @ ('+' | '-'))) = t.get(*i) {
-            *i += 1;
-            let r = term(t, i, d)?;
-            v = if *o == '+' { v + r } else { v - r };
-        }
-        Some(v)
-    }
-    fn term(t: &[T], i: &mut usize, d: usize) -> Option<f64> {
-        let mut v = factor(t, i, d)?;
-        while let Some(T::Op(o @ ('*' | '/'))) = t.get(*i) {
-            *i += 1;
-            let r = factor(t, i, d)?;
-            v = if *o == '*' { v * r } else { v / r };
-        }
-        Some(v)
-    }
-    fn factor(t: &[T], i: &mut usize, d: usize) -> Option<f64> {
-        if d > MAX_NESTING {
-            return None;
-        }
-        match t.get(*i)? {
-            T::N(n) => {
-                *i += 1;
-                Some(*n)
-            }
-            T::Op('-') => {
-                *i += 1;
-                factor(t, i, d + 1).map(|v| -v)
-            }
-            T::Op('(') => {
-                *i += 1;
-                let v = expr(t, i, d + 1)?;
-                (t.get(*i) == Some(&T::Op(')'))).then(|| *i += 1)?;
-                Some(v)
-            }
-            _ => None,
-        }
-    }
-    let mut i = 0;
-    let v = expr(&toks, &mut i, 0)?;
-    (i == toks.len() && v.is_finite()).then_some(v)
-}
-
-/// The Calculate event: the new value, given the current values of the other fields
-/// (`values(name)` returns every field named `name` or below it, for groups).
-pub fn calculate(c: &Calculate, values: &dyn Fn(&str) -> Vec<String>) -> Option<String> {
-    let num = |s: &String| make_number(s).unwrap_or(0.0);
-    match c {
-        Calculate::None => None,
-        Calculate::Simple { op, fields } => {
-            let xs: Vec<f64> = fields.iter().flat_map(|f| values(f)).map(|v| num(&v)).collect();
-            let v = match op {
-                CalcOp::Sum => xs.iter().sum(),
-                CalcOp::Product => xs.iter().product(),
-                CalcOp::Average => {
-                    if xs.is_empty() {
-                        0.0
-                    } else {
-                        xs.iter().sum::<f64>() / xs.len() as f64
-                    }
-                }
-                CalcOp::Minimum => xs.iter().copied().fold(f64::INFINITY, f64::min),
-                CalcOp::Maximum => xs.iter().copied().fold(f64::NEG_INFINITY, f64::max),
-            };
-            Some(if v.is_finite() { js_number(v) } else { "0".into() })
-        }
-        Calculate::Notation(expr) => {
-            let v = eval_notation(expr, &|name| values(name).first().map(num).unwrap_or(0.0))?;
-            Some(js_number(v))
-        }
-    }
-}
-
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn javascript_escapes_are_decoded() {
-        assert_eq!(
-            parse_format("AFNumber_Format(2, 0, 0, 0, \"\\x24\", true);"),
-            Some(Format::Number { decimals: 2, sep: 0, neg: 0, currency: "$".into(), prepend: true })
-        );
-        assert_eq!(parse_format("AFDate_FormatEx(\"\\b\\f\\v\\0\\q\");"), Some(Format::Date("\u{8}\u{c}\u{b}\0q".into())));
-    }
-
-    #[test]
-    fn scripts_are_recognised_and_written_back() {
-        assert_eq!(
-            parse_format("AFNumber_Format(2, 0, 0, 0, \"$\", true);"),
-            Some(Format::Number { decimals: 2, sep: 0, neg: 0, currency: "$".into(), prepend: true })
-        );
-        assert_eq!(parse_format("AFPercent_Format(1, 0);"), Some(Format::Percent { decimals: 1, sep: 0 }));
-        assert_eq!(parse_format("AFDate_FormatEx(\"dd-mmm-yyyy\");"), Some(Format::Date("dd-mmm-yyyy".into())));
-        assert_eq!(parse_format("AFDate_Format(2);"), Some(Format::Date("mm/dd/yy".into())));
-        assert_eq!(parse_format("AFTime_Format(1);"), Some(Format::Time("h:MM tt".into())));
-        assert_eq!(parse_format("AFSpecial_Format(2);"), Some(Format::Special(2)));
-        assert_eq!(parse_format("AFSpecial_KeystrokeEx(\"AA-9999\");"), Some(Format::Mask("AA-9999".into())));
-        assert_eq!(parse_format("app.alert('hi')"), None);
-        assert_eq!(parse_validate("AFRange_Validate(true, 0, true, 100);"), Some(Validate::Range { min: Some(0.0), max: Some(100.0) }));
-        assert_eq!(parse_validate("AFRange_Validate(false, 0, true, 10);"), Some(Validate::Range { min: None, max: Some(10.0) }));
-        assert_eq!(
-            parse_calculate("AFSimple_Calculate(\"SUM\", new Array (\"a\", \"b.c\"));"),
-            Some(Calculate::Simple { op: CalcOp::Sum, fields: vec!["a".into(), "b.c".into()] })
-        );
-        assert_eq!(parse_calculate("AFSimple_Calculate('AVG', ['x']);"), Some(Calculate::Simple { op: CalcOp::Average, fields: vec!["x".into()] }));
-        assert_eq!(
-            parse_calculate("/** BVCALC Price * Qty EVCALC **/ event.value = AFMakeNumber(getField(\"Price\").value) * …"),
-            Some(Calculate::Notation("Price * Qty".into()))
-        );
-        // Round trips through what the tabs write.
-        for f in [
-            Format::Number { decimals: 2, sep: 2, neg: 2, currency: "€".into(), prepend: false },
-            Format::Percent { decimals: 0, sep: 0 },
-            Format::Date("mmmm d, yyyy".into()),
-            Format::Special(3),
-        ] {
-            let (fj, _) = format_js(&f).unwrap();
-            assert_eq!(parse_format(&fj), Some(f));
-        }
-        let euro = format_js(&Format::Number { decimals: 2, sep: 2, neg: 0, currency: "€".into(), prepend: true }).unwrap().0;
-        assert!(euro.contains("\\u20AC"), "{euro}");
-        assert!(!euro.contains('€'), "{euro}");
-        let pound = format_js(&Format::Number { decimals: 2, sep: 0, neg: 0, currency: "£".into(), prepend: true }).unwrap().0;
-        assert!(pound.contains("\\u00A3"), "{pound}");
-        assert!(!pound.contains('£'), "{pound}");
-        let c = Calculate::Simple { op: CalcOp::Product, fields: vec!["q".into(), "p".into()] };
-        assert_eq!(parse_calculate(&calculate_js(&c).unwrap()), Some(c));
-        let c = Calculate::Notation("a + b".into());
-        assert_eq!(parse_calculate(&calculate_js(&c).unwrap()), Some(c));
-        // The JavaScript after the comment is Acrobat's translation, so viewers that run it
-        // instead of reading the comment compute the same value (not 0).
-        assert_eq!(
-            calculate_js(&Calculate::Notation("(Unit\\ Price * Qty) / 2".into())).unwrap(),
-            "/** BVCALC (Unit\\ Price * Qty) / 2 EVCALC **/ event.value = (AFMakeNumber(this.getField(\"Unit Price\").value) * AFMakeNumber(this.getField(\"Qty\").value)) / 2;"
-        );
-    }
-
-    #[test]
-    fn a_rename_rewrites_only_where_a_calculation_reads_the_field() {
-        let renamed = |js: &str| rename_in_calculation(js, "a", "qty");
-        // The field lists Acrobat and other tools write for AFSimple_Calculate.
-        assert_eq!(
-            renamed("AFSimple_Calculate(\"SUM\", new Array (\"a\", \"b\"));").as_deref(),
-            Some("AFSimple_Calculate(\"SUM\", new Array (\"qty\", \"b\"));")
-        );
-        assert_eq!(renamed("AFSimple_Calculate('AVG', ['b', 'a']);").as_deref(), Some("AFSimple_Calculate('AVG', ['b', \"qty\"]);"));
-        assert_eq!(renamed("AFSimple_Calculate(\"SUM\", \"a, b,a\");").as_deref(), Some("AFSimple_Calculate(\"SUM\", \"qty, b,qty\");"));
-        assert_eq!(renamed("AFSimple_Calculate(\"SUM\", new Array(\"ab\", \"b.a\"));"), None, "other names that contain it");
-        // Notation: the expression in the comment and Acrobat's translation after it.
-        let notation = |expr: &str| calculate_js(&Calculate::Notation(expr.into())).unwrap();
-        assert_eq!(rename_in_calculation(&notation("(a + ab) * a / 2"), "a", "Unit Price"), Some(notation("(Unit\\ Price + ab) * Unit\\ Price / 2")));
-        assert_eq!(rename_in_calculation(&notation("Unit\\ Price * 2"), "Unit Price", "price"), Some(notation("price * 2")));
-        // Scripts: a getField whose argument is one string literal. Comments, strings, template
-        // literals, regular expressions and names built at run time are left as written.
-        let script = "// getField(\"a\")\nvar s = \"getField('a')\", t = `getField(\"a\")`; /* getField(\"a\") */\n\
-                      if (/\"/.test(s)) event.value = this.getField('a').value / 2 * getField(\"a\" + 1).value + getField ( \"ab\" ).value;";
-        assert_eq!(renamed(script), Some(script.replacen("this.getField('a')", "this.getField(\"qty\")", 1)));
-        assert_eq!(renamed("event.value = getField(\"b\").value;"), None);
-        // A new name is escaped as the script needs it.
-        assert_eq!(
-            rename_in_calculation("event.value = getField(\"a\").value;", "a", "say \"é\"").as_deref(),
-            Some("event.value = getField(\"say \\\"\\u00E9\\\"\").value;")
-        );
-        // A name that would end the notation early is not written in.
-        assert_eq!(rename_in_calculation(&notation("a * 2"), "a", "qtyEVCALC"), None);
-        // Unfinished scripts end their tokens, not the program.
-        for js in ["getField(\"a", "/* getField(\"a\")", "`getField(\"a\")", "x = /[/", "getField('a\\u12"] {
-            assert_eq!(renamed(js), None, "{js}");
-        }
-    }
-
-    /// The notation is read only from a comment, where Acrobat writes it: a string or code that
-    /// spells the markers is left alone, by the Calculate tab and by a rename.
-    #[test]
-    fn notation_is_read_only_from_a_comment() {
-        let string = "var s = \"BVCALC a EVCALC\"; event.value = getField(\"b\").value;";
-        assert_eq!(parse_calculate(string), None);
-        assert_eq!(rename_in_calculation(string, "a", "qty"), None);
-        // A comment after such a string holds the notation.
-        let both = "var s = 'BVCALC x EVCALC'; /** BVCALC a + 1 EVCALC **/ event.value = 1;";
-        assert_eq!(parse_calculate(both), Some(Calculate::Notation("a + 1".into())));
-        assert_eq!(rename_in_calculation(both, "x", "y"), None);
-        assert_eq!(rename_in_calculation(both, "a", "qty"), Some(both.replace("a + 1", "qty + 1")));
-        // A line comment is a comment too, and an unfinished one still holds it.
-        assert_eq!(parse_calculate("// BVCALC a EVCALC\nevent.value = 1;"), Some(Calculate::Notation("a".into())));
-        assert_eq!(parse_calculate("/** BVCALC a EVCALC"), Some(Calculate::Notation("a".into())));
-    }
-
-    /// A line comment ends at any of JavaScript's line terminators, not only `\n`, so with `\r` line
-    /// endings the code after one is still code; and a `/` read as starting a regular expression
-    /// divides after all when the line ends first.
-    #[test]
-    fn a_line_comment_ends_at_any_line_terminator() {
-        for end in ["\n", "\r", "\r\n", "\u{2028}", "\u{2029}"] {
-            let string = format!("// header{end}var s = \"BVCALC a EVCALC\"; event.value = getField(\"b\").value;");
-            assert_eq!(parse_calculate(&string), None, "{end:?}");
-            assert_eq!(rename_in_calculation(&string, "a", "qty"), None, "{end:?}");
-            let script = format!("// note{end}getField(\"a\").value;");
-            assert_eq!(rename_in_calculation(&script, "a", "qty"), Some(script.replace("\"a\"", "\"qty\"")), "{end:?}");
-            let divides = format!("var n = i++ / 2;{end}event.value = getField(\"a\").value / 4;");
-            assert_eq!(rename_in_calculation(&divides, "a", "qty"), Some(divides.replace("\"a\"", "\"qty\"")), "{end:?}");
-        }
-    }
-
-    /// U+2028 and U+2029 end a word, a number or a regular expression's flags, though as bytes
-    /// past ASCII they could be part of one, so a `getField` right after one is still a call.
-    #[test]
-    fn a_token_ends_at_a_line_separator() {
-        for end in ["\u{2028}", "\u{2029}"] {
-            let scripts = ["x", "1", "/r/g"].map(|token| format!("var t = {token}{end}getField(\"a\").value;"));
-            let renamed = scripts.clone().map(|js| rename_in_calculation(&js, "a", "qty"));
-            assert_eq!(renamed, scripts.map(|js| Some(js.replace("\"a\"", "\"qty\""))), "{end:?}");
-        }
-    }
-
-    /// A `/` after the condition of `if`, `while`, `for` or `with` starts a regular expression,
-    /// as after an operator; after a call's parentheses it still divides.
-    #[test]
-    fn a_regex_after_a_condition_is_not_read_as_code() {
-        let renamed = |js: &str| rename_in_calculation(js, "a", "qty");
-        assert_eq!(renamed("if (flag) /getField(\"a\")/.test(x); event.value = 1;"), None);
-        // A quote inside it doesn't start a string that hides the rest of the script.
-        let quote = "while (i--) /\"/.test(s); event.value = getField(\"a\").value;";
-        assert_eq!(renamed(quote), Some(quote.replace("\"a\"", "\"qty\"")));
-        // The same after the `while` that ends a `do` loop.
-        let after_do = "do i++; while (i < n) /\"/.test(s); event.value = getField(\"a\").value;";
-        assert_eq!(renamed(after_do), Some(after_do.replace("\"a\"", "\"qty\"")));
-        // After a call, or a method that happens to be called `if`, the `/` divides.
-        let divides = "event.value = Math.abs(getField(\"b\").value) / 2 + getField(\"a\").value / 3 + o.if(x) / 4 + getField(\"a\").value / 5;";
-        assert_eq!(renamed(divides), Some(divides.replace("\"a\"", "\"qty\"")));
-    }
-
-    /// Scripts are read in one pass: a line of unfinished regular expressions, or calls nested in
-    /// one another's field lists, don't make a rename read the rest of the script again for each.
-    #[test]
-    fn hostile_scripts_are_read_in_one_pass() {
-        let regexes = format!("x = {} getField(\"a\")", "/[".repeat(500_000));
-        assert!(rename_in_calculation(&regexes, "a", "b").is_some_and(|js| js.ends_with("getField(\"b\")")));
-        let nested = format!("{}\"a\"", "AFSimple_Calculate(\"SUM\", new Array(".repeat(100_000));
-        assert_eq!(rename_in_calculation(&nested, "a", "b"), Some(format!("{}\"b\"", "AFSimple_Calculate(\"SUM\", new Array(".repeat(100_000))));
-    }
-
-    /// Notation is read through one lexer: field names with escapes, numbers and operators.
-    #[test]
-    fn notation_is_read_by_one_lexer() {
-        let tokens: Vec<Notation> = notation_tokens("(Unit\\ Price+1.5)*qty_2\\").into_iter().map(|(_, t)| t).collect();
-        assert_eq!(
-            tokens,
-            [
-                Notation::Op('('),
-                Notation::Name("Unit Price".into()),
-                Notation::Op('+'),
-                Notation::Number,
-                Notation::Op(')'),
-                Notation::Op('*'),
-                Notation::Name("qty_2\\".into())
-            ]
-        );
-        assert_eq!(notation_js("2 * a\\ b"), "2 * AFMakeNumber(this.getField(\"a b\").value)");
-        let values = |name: &str| if name == "Unit Price" { 4.0 } else { 0.5 };
-        assert_eq!(eval_notation("(Unit\\ Price + 1.5) * qty", &values), Some(2.75));
-        assert_eq!(eval_notation("1.2.3 + a", &values), None, "a number that isn't one");
-        assert_eq!(notation_name("2nd + (x)\\"), "\\2nd\\ \\+\\ \\(x\\)\\\\");
-    }
-
-    proptest::proptest! {
-        /// Any field name written in notation reads back as that one name.
-        #[test]
-        fn any_name_written_in_notation_reads_back(name in "\\PC{1,12}") {
-            let written = notation_name(&name);
-            proptest::prop_assert_eq!(notation_tokens(&written), vec![(0..written.len(), Notation::Name(name))]);
-        }
-
-        /// Renaming a field in a formula and back gives the formula as it was.
-        #[test]
-        fn a_rename_round_trips(old in "\\PC{1,8}", new in "\\PC{1,8}", others in proptest::collection::vec("\\PC{1,8}", 0..4), sum in proptest::bool::ANY) {
-            proptest::prop_assume!(old != new && !others.contains(&new) && ![&old, &new].into_iter().chain(&others).any(|n| n.contains("VCALC")));
-            let names: Vec<String> = std::iter::once(old.clone()).chain(others).collect();
-            let js = if sum {
-                calculate_js(&Calculate::Simple { op: CalcOp::Sum, fields: names }).unwrap()
-            } else {
-                calculate_js(&Calculate::Notation(names.iter().map(|n| notation_name(n)).collect::<Vec<_>>().join(" * "))).unwrap()
-            };
-            let renamed = rename_in_calculation(&js, &old, &new);
-            proptest::prop_assert!(renamed.is_some(), "{js}");
-            let back = renamed.as_deref().and_then(|r| rename_in_calculation(r, &new, &old));
-            proptest::prop_assert_eq!(back, Some(js));
-        }
-
-        /// What a formula reads is the same whether it is read from the tab's settings or from
-        /// the script they are written as.
-        #[test]
-        fn a_formula_reads_the_same_fields_as_its_script(names in proptest::collection::vec("\\PC{1,8}", 1..5), sum in proptest::bool::ANY) {
-            proptest::prop_assume!(!names.iter().any(|n| n.contains("VCALC")));
-            let c = if sum {
-                Calculate::Simple { op: CalcOp::Product, fields: names.clone() }
-            } else {
-                Calculate::Notation(names.iter().map(|n| notation_name(n)).collect::<Vec<_>>().join(" + "))
-            };
-            let js = calculate_js(&c).unwrap();
-            proptest::prop_assert_eq!(calculation_reads(&js), c.reads());
-            proptest::prop_assert_eq!(c.reads(), unique(names));
-        }
-    }
-
-    #[test]
-    fn a_calculation_reads_each_named_field_once() {
-        assert_eq!(Calculate::Simple { op: CalcOp::Sum, fields: vec!["a".into(), "b".into(), "a".into()] }.reads(), ["a", "b"]);
-        assert_eq!(Calculate::Notation("(Unit\\ Price + 2) * qty / qty".into()).reads(), ["Unit Price", "qty"]);
-        assert_eq!(Calculate::None.reads(), Vec::<String>::new());
-        let script = "var t = getField(\"sub\").value; // getField(\"x\")\nevent.value = t + getField(\"tax\").value + getField(\"row\" + 1).value;";
-        assert_eq!(calculation_reads(script), ["sub", "tax"], "names built at run time aren't known");
-        assert_eq!(calculation_reads("AFSimple_Calculate(\"SUM\", \"a, b\");"), ["a", "b"]);
-    }
-
-    #[test]
-    fn numbers_format_like_acrobat() {
-        let n = |d, s, ng, c: &str, p| Format::Number { decimals: d, sep: s, neg: ng, currency: c.into(), prepend: p };
-        assert_eq!(format_value(&n(2, 0, 0, "$", true), "1234.5"), "$1,234.50");
-        assert_eq!(format_value(&n(0, 1, 0, "", true), "1234567"), "1234567");
-        assert_eq!(format_value(&n(2, 2, 0, " €", false), "1234.5"), "1.234,50 €");
-        assert_eq!(format_value(&n(2, 0, 2, "", true), "-12"), "(12.00)");
-        assert_eq!(format_value(&n(1, 0, 0, "", true), "-0.25"), "-0.3");
-        assert_eq!(format_value(&Format::Percent { decimals: 1, sep: 0 }, "0.125"), "12.5%");
-        assert_eq!(make_number("$1,234.50"), Some(1234.5));
-        assert_eq!(make_number("1.234,5"), Some(1234.5));
-        assert_eq!(make_number("(7)"), Some(-7.0));
-        assert_eq!(make_number("abc"), None);
-        assert_eq!(keystroke(&n(2, 0, 0, "$", true), "Total", "$1,000"), Ok("1000".into()));
-        assert_eq!(
-            keystroke(&n(2, 0, 0, "$", true), "Total", "ten"),
-            Err("The value entered does not match the format of the field [ Total ]".into())
-        );
-        // Blank input clears a formatted field (#1323); without a format it is text like any other.
-        assert_eq!(keystroke(&n(2, 0, 0, "$", true), "Total", " \t"), Ok(String::new()));
-        assert_eq!(keystroke(&Format::None, "Name", " \t"), Ok(" \t".into()));
-    }
-
-    #[test]
-    fn dates_times_and_masks() {
-        let d = Format::Date("mm/dd/yyyy".into());
-        assert_eq!(format_value(&d, "1/2/24"), "01/02/2024");
-        assert_eq!(format_value(&Format::Date("mmmm d, yyyy".into()), "10/1/2026"), "October 1, 2026");
-        assert_eq!(format_value(&Format::Date("dddd, mmm d, yyyy".into()), "10/1/2026"), "Thursday, Oct 1, 2026");
-        assert_eq!(format_value(&Format::Date("dd-mmm-yy".into()), "5-Mar-21"), "05-Mar-21", "month names are read");
-        assert!(keystroke(&d, "Due", "2/30/2024").is_err(), "no 30 February");
-        assert!(keystroke(&d, "Due", "13/1/2024").is_err());
-        // Literal digits in the format (a leave form fixing the year as "dd.mm.26").
-        let fixed = Format::Date("dd.mm.26".into());
-        assert_eq!(keystroke(&fixed, "Von", "15.05.26"), Ok("15.05.26".into()));
-        assert_eq!(format_value(&fixed, "15.05.26"), "15.05.26");
-        assert_eq!(format_value(&fixed, "3.1"), "03.01.26", "the literal may be left out");
-        assert!(keystroke(&fixed, "Von", "15.05.27").is_err(), "a different number there is not the literal");
-        assert!(keystroke(&fixed, "Von", "32.05.26").is_err());
-        assert_eq!(format_value(&Format::Time("h:MM tt".into()), "14:05"), "2:05 pm");
-        assert_eq!(format_value(&Format::Time("HH:MM".into()), "2:05 pm"), "14:05");
-        assert_eq!(format_value(&Format::Special(2), "5551234567"), "(555) 123-4567");
-        assert_eq!(format_value(&Format::Special(3), "123-45-6789"), "123-45-6789");
-        assert!(keystroke(&Format::Special(0), "Zip", "1234").is_err());
-        assert_eq!(format_value(&Format::Mask("AA-9999".into()), "ab1234"), "ab-1234");
-        assert!(keystroke(&Format::Mask("AA-9999".into()), "Code", "a11234").is_err());
-    }
-
-    #[test]
-    fn validation_and_calculation() {
-        let r = Validate::Range { min: Some(0.0), max: Some(100.0) };
-        assert!(validate(&r, "50").is_ok() && validate(&r, "").is_ok());
-        assert_eq!(validate(&r, "120"), Err("Invalid value: must be greater than or equal to 0 and less than or equal to 100.".into()));
-        let vals = |name: &str| -> Vec<String> {
-            match name {
-                "a" => vec!["2".into()],
-                "b" => vec!["$3.50".into()],
-                "row" => vec!["1".into(), "2".into(), "3".into()],
-                "Unit Price" => vec!["4".into()],
-                _ => vec![],
-            }
-        };
-        let simple = |op, f: &[&str]| calculate(&Calculate::Simple { op, fields: f.iter().map(|s| s.to_string()).collect() }, &vals);
-        assert_eq!(simple(CalcOp::Sum, &["a", "b"]), Some("5.5".into()));
-        assert_eq!(simple(CalcOp::Product, &["a", "b"]), Some("7".into()));
-        assert_eq!(simple(CalcOp::Average, &["row"]), Some("2".into()), "groups count every child");
-        assert_eq!(simple(CalcOp::Maximum, &["a", "row"]), Some("3".into()));
-        assert_eq!(simple(CalcOp::Sum, &["missing"]), Some("0".into()));
-        assert_eq!(calculate(&Calculate::Notation("(a + b) * 2 - Unit\\ Price / 4".into()), &vals), Some("10".into()));
-        assert_eq!(calculate(&Calculate::Notation("a +".into()), &vals), None);
-    }
-}
+mod tests;
 
 // ── push buttons ────────────────────────────────────────────────────────────────────────────
 
@@ -2060,4 +383,12 @@ mod undelimited_tests {
         assert_eq!(parse_date("99999999999999999999", "yyyymmdd"), None);
         assert_eq!(parse_date("2026 99999999999", "yyyy"), None, "an unreadable number is left over, not ignored");
     }
+
+    #[test]
+    fn huge_finite_numbers_do_not_print_inf() {
+        let n = format_value(&Format::Number { decimals: 2, sep: 1, neg: 0, currency: String::new(), prepend: true }, "1e307");
+        assert!(n.len() > 300 && n.ends_with(".00") && !n.contains("inf"), "got {n}");
+        let p = format_value(&Format::Percent { decimals: 2, sep: 1 }, "1e306");
+        assert!(!p.contains("inf"), "got {p}");
+    }
 }
diff --git a/crates/forms/src/af/calc.rs b/crates/forms/src/af/calc.rs
new file mode 100644
index 0000000000..b3a1524a4f
--- /dev/null
+++ b/crates/forms/src/af/calc.rs
@@ -0,0 +1,514 @@
+use super::format::{js_number, make_number};
+use super::script::{MAX_NESTING, Parser, js_str};
+use super::*;
+
+// ── renaming fields in calculations ─────────────────────────────────────────────────────────
+
+/// A JavaScript token, as far as finding the field names a calculation reads needs.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Js {
+    Ident,
+    /// A string literal, its escapes undone.
+    Str(String),
+    Punct(char),
+    /// A number, a regular expression or a template literal.
+    Other,
+}
+
+/// A [`Js`] token with its byte range in the script.
+type Token = (Range<usize>, Js);
+
+/// Words after which `/` starts a regular expression instead of dividing.
+const BEFORE_REGEX: [&str; 13] = ["return", "typeof", "case", "do", "else", "in", "of", "new", "delete", "void", "throw", "instanceof", "yield"];
+
+/// Words whose condition, in parentheses, comes before a statement, so a `/` after it starts a
+/// regular expression. The `while` that ends a `do` loop counts too: the loop ends at its `)`, so
+/// a `/` after it starts the next statement, and can't divide.
+const BEFORE_CONDITION: [&str; 4] = ["if", "while", "for", "with"];
+
+/// Whether a line ends at `s[j]`: JavaScript ends one at `\n`, `\r`, U+2028 and U+2029.
+fn line_ends_at(s: &[u8], j: usize) -> bool {
+    matches!(s.get(j..), Some([b'\n' | b'\r', ..] | [0xE2, 0x80, 0xA8 | 0xA9, ..]))
+}
+
+/// JavaScript's tokens with their byte ranges, and apart from them the text of each comment
+/// (inside its `//`, or its `/*` and `*/`): enough of the language to tell code from strings,
+/// comments and regular expressions. The tokens stop where a string, comment or template literal
+/// never ends; a comment that never ends runs to the end of the script.
+pub(super) fn js_tokens(js: &str) -> (Vec<Token>, Vec<Range<usize>>) {
+    let s = js.as_bytes();
+    // Whether `s[j]` is part of a word. Bytes past ASCII are parts of identifiers, except
+    // U+2028 and U+2029, which end a line: a range never ends inside a character.
+    let word = |j: usize| s.get(j).is_some_and(|&b| b.is_ascii_alphanumeric() || b == b'_' || b == b'$' || !b.is_ascii()) && !line_ends_at(s, j);
+    let mut out: Vec<Token> = Vec::new();
+    let mut comments = Vec::new();
+    let mut i = 0;
+    // Where a regular expression that never ended stopped being read: every `/` before it
+    // divides, so a line of them is read once, not once for each.
+    let mut divides_until = 0;
+    // For each `(` still open, whether it opened the condition of `if`, `while`, `for` or
+    // `with`; and whether the last token is the `)` that closed one.
+    let mut conditions: Vec<bool> = Vec::new();
+    let mut after_condition = false;
+    'scan: while let Some(&c) = s.get(i) {
+        let start = i;
+        let token = match c {
+            _ if c.is_ascii_whitespace() => {
+                i += 1;
+                continue;
+            }
+            // U+2028 or U+2029 between tokens ends a line, and is skipped whole: read a byte at a
+            // time, the rest of it would be read from inside the character.
+            0xE2 if line_ends_at(s, i) => {
+                i += 3;
+                continue;
+            }
+            b'/' if s.get(i + 1) == Some(&b'/') => {
+                i = (i + 2..s.len()).find(|&j| line_ends_at(s, j)).unwrap_or(s.len());
+                comments.push(start + 2..i);
+                continue;
+            }
+            b'/' if s.get(i + 1) == Some(&b'*') => match js.get(i + 2..).and_then(|rest| rest.find("*/")) {
+                Some(n) => {
+                    comments.push(i + 2..i + 2 + n);
+                    i += n + 4;
+                    continue;
+                }
+                None => {
+                    comments.push(i + 2..s.len());
+                    break 'scan;
+                }
+            },
+            b'"' | b'\'' => {
+                let mut p = Parser { s, i, depth: 0 };
+                let Some(text) = p.string() else { break 'scan };
+                i = p.i;
+                Js::Str(text)
+            }
+            b'`' => {
+                let mut j = i + 1;
+                loop {
+                    match s.get(j) {
+                        None => break 'scan,
+                        Some(b'\\') => j += 2,
+                        Some(b'`') => break,
+                        Some(_) => j += 1,
+                    }
+                }
+                i = j + 1;
+                Js::Other
+            }
+            b'/' if i >= divides_until && regex_may_follow(js, &out, after_condition) => {
+                // A regular expression ends at a `/` outside a class; a line break first means it
+                // was a division after all.
+                let (mut j, mut class) = (i + 1, false);
+                let end = loop {
+                    match s.get(j) {
+                        None => break None,
+                        Some(_) if line_ends_at(s, j) => break None,
+                        Some(b'\\') => j += 2,
+                        Some(b'/') if !class => break Some(j),
+                        Some(b) => {
+                            class = match b {
+                                b'[' => true,
+                                b']' => false,
+                                _ => class,
+                            };
+                            j += 1;
+                        }
+                    }
+                };
+                match end {
+                    Some(e) => {
+                        i = e + 1;
+                        while word(i) {
+                            i += 1;
+                        }
+                        Js::Other
+                    }
+                    None => {
+                        divides_until = j;
+                        i += 1;
+                        Js::Punct('/')
+                    }
+                }
+            }
+            _ if c.is_ascii_digit() => {
+                while word(i) || s.get(i) == Some(&b'.') {
+                    i += 1;
+                }
+                Js::Other
+            }
+            _ if word(i) => {
+                while word(i) {
+                    i += 1;
+                }
+                Js::Ident
+            }
+            _ => {
+                i += 1;
+                Js::Punct(char::from(c))
+            }
+        };
+        after_condition = match token {
+            Js::Punct('(') => {
+                conditions.push(opens_condition(js, &out));
+                false
+            }
+            Js::Punct(')') => conditions.pop().unwrap_or(false),
+            _ => false,
+        };
+        out.push((start..i, token));
+    }
+    (out, comments)
+}
+
+/// Whether a `/` after `tokens` starts a regular expression: after an operator, an opening
+/// bracket, a keyword such as `return` or the condition of `if`, `while`, `for` or `with`, not
+/// after a value. `after_condition` says the last token is the `)` that ends such a condition.
+fn regex_may_follow(js: &str, tokens: &[Token], after_condition: bool) -> bool {
+    match tokens.last() {
+        None => true,
+        Some((range, Js::Ident)) => js.get(range.clone()).is_some_and(|w| BEFORE_REGEX.contains(&w)),
+        Some((_, Js::Punct(')'))) => after_condition,
+        Some((_, Js::Punct(c))) => !matches!(c, ']' | '}'),
+        Some((_, Js::Str(_) | Js::Other)) => false,
+    }
+}
+
+/// Whether a `(` after `tokens` opens the condition of `if`, `while`, `for` or `with`, and not
+/// the arguments of a method that has one of those names (`o.if(x)`).
+fn opens_condition(js: &str, tokens: &[Token]) -> bool {
+    let mut back = tokens.iter().rev();
+    let Some((range, Js::Ident)) = back.next() else { return false };
+    js.get(range.clone()).is_some_and(|w| BEFORE_CONDITION.contains(&w)) && !matches!(back.next(), Some((_, Js::Punct('.'))))
+}
+
+/// Where a Calculate script keeps its simplified field notation: between `BVCALC` and the
+/// `EVCALC` after it, in the first of `comments` that holds both, as Acrobat writes it
+/// (`/** BVCALC a + b EVCALC **/`). A string or code that spells the markers is not the notation.
+pub(super) fn notation_range(js: &str, comments: &[Range<usize>]) -> Option<Range<usize>> {
+    comments.iter().find_map(|comment| {
+        let text = js.get(comment.clone())?;
+        let a = text.find("BVCALC")? + 6;
+        let b = a + text.get(a..)?.find("EVCALC")?;
+        Some(comment.start + a..comment.start + b)
+    })
+}
+
+/// A place where a Calculate script names a field.
+#[derive(Clone, Debug, PartialEq)]
+enum Site {
+    /// A string literal holding one name: `getField("a")`, or an item of an
+    /// `AFSimple_Calculate` list.
+    Literal(String),
+    /// An `AFSimple_Calculate` list written as one string of comma-separated names.
+    Commas(String),
+    /// A name in the simplified field notation of a `BVCALC` comment.
+    Notation(String),
+}
+
+impl Site {
+    fn names(&self) -> Vec<&str> {
+        match self {
+            Site::Literal(name) | Site::Notation(name) => vec![name.as_str()],
+            Site::Commas(list) => list.split(',').map(str::trim).filter(|n| !n.is_empty()).collect(),
+        }
+    }
+
+    /// The site written again with field `old` named `new`, or `None` when it doesn't name `old`.
+    fn renamed(&self, old: &str, new: &str) -> Option<String> {
+        match self {
+            Site::Literal(name) => (name == old).then(|| js_str(new)),
+            Site::Notation(name) => (name == old).then(|| notation_name(new)),
+            Site::Commas(list) => {
+                let parts: Vec<&str> = list.split(',').collect();
+                parts.iter().any(|p| p.trim() == old).then(|| {
+                    // The spaces around each name stay as they were.
+                    let parts: Vec<String> = parts.iter().map(|p| if p.trim() == old { p.replacen(old, new, 1) } else { (*p).to_owned() }).collect();
+                    js_str(&parts.join(","))
+                })
+            }
+        }
+    }
+}
+
+/// Where a Calculate script names fields, in order: the simplified field notation in its comment
+/// (see [`notation_range`]; [`parse_calculate`] reads it there too), the field list of
+/// `AFSimple_Calculate`, and every `getField` whose whole argument is one string literal.
+/// A name built at run time (`getField("row" + i)`) is not a site.
+fn calculation_sites(js: &str) -> Vec<(Range<usize>, Site)> {
+    let mut sites = Vec::new();
+    let (tokens, comments) = js_tokens(js);
+    if let Some(at) = notation_range(js, &comments)
+        && let Some(expr) = js.get(at.clone())
+    {
+        for (range, token) in notation_tokens(expr) {
+            if let Notation::Name(name) = token {
+                sites.push((at.start + range.start..at.start + range.end, Site::Notation(name)));
+            }
+        }
+    }
+    let ident = |k: usize, word: &str| tokens.get(k).is_some_and(|(range, t)| *t == Js::Ident && js.get(range.clone()) == Some(word));
+    let punct = |k: usize, c: char| tokens.get(k).is_some_and(|(_, t)| *t == Js::Punct(c));
+    let string = |k: usize| match tokens.get(k) {
+        Some((range, Js::Str(text))) => Some((range.clone(), text.clone())),
+        _ => None,
+    };
+    for k in 0..tokens.len() {
+        if ident(k, "getField")
+            && punct(k + 1, '(')
+            && punct(k + 3, ')')
+            && let Some((range, name)) = string(k + 2)
+        {
+            sites.push((range, Site::Literal(name)));
+        }
+        if !(ident(k, "AFSimple_Calculate") && punct(k + 1, '(') && string(k + 2).is_some() && punct(k + 3, ',')) {
+            continue;
+        }
+        if let Some((range, list)) = string(k + 4) {
+            sites.push((range, Site::Commas(list)));
+            continue;
+        }
+        // `new Array("a", "b")` or `["a", "b"]`: its items, up to the first that isn't a string.
+        // Nothing else is read, so no token is read for two calls.
+        let first = if punct(k + 4, '[') {
+            k + 5
+        } else if ident(k + 4, "new") && ident(k + 5, "Array") && punct(k + 6, '(') {
+            k + 7
+        } else {
+            continue;
+        };
+        for (range, token) in tokens.iter().skip(first) {
+            match token {
+                Js::Str(name) => sites.push((range.clone(), Site::Literal(name.clone()))),
+                Js::Punct(',') => {}
+                _ => break,
+            }
+        }
+    }
+    sites.sort_by_key(|(range, _)| range.start);
+    sites
+}
+
+/// A Calculate script with field `old` named `new` everywhere it reads it (see
+/// [`calculation_sites`]), the rest kept as written; `None` when it doesn't read `old`. Also
+/// `None` when the new name would read as more than a name there (one holding `EVCALC` would end
+/// the notation early), so a script is never left meaning something else.
+pub fn rename_in_calculation(js: &str, old: &str, new: &str) -> Option<String> {
+    let sites = calculation_sites(js);
+    let edits: Vec<(Range<usize>, String)> = sites.iter().filter_map(|(range, site)| Some((range.clone(), site.renamed(old, new)?))).collect();
+    if edits.is_empty() {
+        return None;
+    }
+    let out = splice(js, edits);
+    let expected: Vec<&str> = sites.iter().flat_map(|(_, site)| site.names()).map(|n| if n == old { new } else { n }).collect();
+    let written = calculation_sites(&out);
+    let got: Vec<&str> = written.iter().flat_map(|(_, site)| site.names()).collect();
+    (got == expected).then_some(out)
+}
+
+/// The fields a Calculate script reads by name (see [`calculation_sites`]), each once, in the
+/// order it first names them.
+pub fn calculation_reads(js: &str) -> Vec<String> {
+    let sites = calculation_sites(js);
+    unique(sites.iter().flat_map(|(_, site)| site.names()).map(str::to_owned))
+}
+
+impl Calculate {
+    /// The fields it reads, each once, in the order it first names them. A name also stands for
+    /// the fields under it (`row` for `row.0` and `row.1`), as [`calculate`] reads them.
+    pub fn reads(&self) -> Vec<String> {
+        match self {
+            Calculate::None => Vec::new(),
+            Calculate::Simple { fields, .. } => unique(fields.iter().cloned()),
+            Calculate::Notation(expr) => unique(notation_tokens(expr).into_iter().filter_map(|(_, token)| match token {
+                Notation::Name(name) => Some(name),
+                _ => None,
+            })),
+        }
+    }
+}
+
+/// `names` without repeats, in order.
+pub(super) fn unique(names: impl IntoIterator<Item = String>) -> Vec<String> {
+    let mut seen = std::collections::HashSet::new();
+    names.into_iter().filter(|n| seen.insert(n.clone())).collect()
+}
+
+/// A token of simplified field notation.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Notation {
+    /// A number, as written.
+    Number,
+    /// `+ - * / ( )`.
+    Op(char),
+    /// A field name, its `\` escapes undone.
+    Name(String),
+}
+
+/// Simplified field notation's tokens, each with its byte range in `src`. Whitespace separates
+/// them, and `\` escapes a space or an operator inside a name, as Acrobat writes them.
+pub(super) fn notation_tokens(src: &str) -> Vec<(Range<usize>, Notation)> {
+    let breaks = |c: char| c.is_whitespace() || "+-*/()".contains(c);
+    let mut out = Vec::new();
+    let mut cs = src.char_indices().peekable();
+    while let Some(&(start, c)) = cs.peek() {
+        let mut end = start + c.len_utf8();
+        if c.is_whitespace() {
+            cs.next();
+        } else if breaks(c) {
+            cs.next();
+            out.push((start..end, Notation::Op(c)));
+        } else if c.is_ascii_digit() || c == '.' {
+            while let Some((i, d)) = cs.next_if(|(_, d)| d.is_ascii_digit() || *d == '.') {
+                end = i + d.len_utf8();
+            }
+            out.push((start..end, Notation::Number));
+        } else {
+            let mut name = String::new();
+            while let Some((i, n)) = cs.next_if(|(_, n)| !breaks(*n)) {
+                end = i + n.len_utf8();
+                if n == '\\'
+                    && let Some((j, next)) = cs.next()
+                {
+                    end = j + next.len_utf8();
+                    name.push(next);
+                } else {
+                    name.push(n);
+                }
+            }
+            out.push((start..end, Notation::Name(name)));
+        }
+    }
+    out
+}
+
+/// A field name as simplified field notation writes it: `\` before a space, an operator or a
+/// `\`, and before a first character that would start a number.
+pub(super) fn notation_name(name: &str) -> String {
+    let mut out = String::new();
+    for (i, c) in name.chars().enumerate() {
+        if c.is_whitespace() || "+-*/()\\".contains(c) || (i == 0 && (c.is_ascii_digit() || c == '.')) {
+            out.push('\\');
+        }
+        out.push(c);
+    }
+    out
+}
+
+/// `src` with each range replaced. The ranges come in order and don't overlap; one that does
+/// is left out rather than written over another.
+fn splice(src: &str, edits: impl IntoIterator<Item = (Range<usize>, String)>) -> String {
+    let mut out = String::with_capacity(src.len());
+    let mut done = 0;
+    for (range, with) in edits {
+        let Some(kept) = src.get(done..range.start).filter(|_| range.start <= range.end) else { continue };
+        out.push_str(kept);
+        out.push_str(&with);
+        done = range.end;
+    }
+    out.push_str(src.get(done..).unwrap_or_default());
+    out
+}
+
+/// Simplified field notation as the JavaScript Acrobat writes after its `BVCALC` comment:
+/// each field name becomes `AFMakeNumber(this.getField("name").value)`, the rest stays.
+pub fn notation_js(expr: &str) -> String {
+    let names = notation_tokens(expr).into_iter().filter_map(|(range, t)| match t {
+        Notation::Name(name) => Some((range, format!("AFMakeNumber(this.getField({}).value)", js_str(&name)))),
+        _ => None,
+    });
+    splice(expr, names)
+}
+
+/// Evaluate simplified field notation: + - * / and parentheses over numbers and field names.
+pub(super) fn eval_notation(src: &str, value_of: &dyn Fn(&str) -> f64) -> Option<f64> {
+    #[derive(Debug, Clone, PartialEq)]
+    enum T {
+        N(f64),
+        Op(char),
+    }
+    let toks = notation_tokens(src)
+        .into_iter()
+        .map(|(range, t)| match t {
+            Notation::Number => src.get(range)?.parse().ok().map(T::N),
+            Notation::Op(c) => Some(T::Op(c)),
+            Notation::Name(name) => Some(T::N(value_of(&name))),
+        })
+        .collect::<Option<Vec<T>>>()?;
+    // Recursive descent, `d` levels deep (at most MAX_NESTING).
+    fn expr(t: &[T], i: &mut usize, d: usize) -> Option<f64> {
+        let mut v = term(t, i, d)?;
+        while let Some(T::Op(o @ ('+' | '-'))) = t.get(*i) {
+            *i += 1;
+            let r = term(t, i, d)?;
+            v = if *o == '+' { v + r } else { v - r };
+        }
+        Some(v)
+    }
+    fn term(t: &[T], i: &mut usize, d: usize) -> Option<f64> {
+        let mut v = factor(t, i, d)?;
+        while let Some(T::Op(o @ ('*' | '/'))) = t.get(*i) {
+            *i += 1;
+            let r = factor(t, i, d)?;
+            v = if *o == '*' { v * r } else { v / r };
+        }
+        Some(v)
+    }
+    fn factor(t: &[T], i: &mut usize, d: usize) -> Option<f64> {
+        if d > MAX_NESTING {
+            return None;
+        }
+        match t.get(*i)? {
+            T::N(n) => {
+                *i += 1;
+                Some(*n)
+            }
+            T::Op('-') => {
+                *i += 1;
+                factor(t, i, d + 1).map(|v| -v)
+            }
+            T::Op('(') => {
+                *i += 1;
+                let v = expr(t, i, d + 1)?;
+                (t.get(*i) == Some(&T::Op(')'))).then(|| *i += 1)?;
+                Some(v)
+            }
+            _ => None,
+        }
+    }
+    let mut i = 0;
+    let v = expr(&toks, &mut i, 0)?;
+    (i == toks.len() && v.is_finite()).then_some(v)
+}
+
+/// The Calculate event: the new value, given the current values of the other fields
+/// (`values(name)` returns every field named `name` or below it, for groups).
+pub fn calculate(c: &Calculate, values: &dyn Fn(&str) -> Vec<String>) -> Option<String> {
+    let num = |s: &String| make_number(s).unwrap_or(0.0);
+    match c {
+        Calculate::None => None,
+        Calculate::Simple { op, fields } => {
+            let xs: Vec<f64> = fields.iter().flat_map(|f| values(f)).map(|v| num(&v)).collect();
+            let v = match op {
+                CalcOp::Sum => xs.iter().sum(),
+                CalcOp::Product => xs.iter().product(),
+                CalcOp::Average => {
+                    if xs.is_empty() {
+                        0.0
+                    } else {
+                        xs.iter().sum::<f64>() / xs.len() as f64
+                    }
+                }
+                CalcOp::Minimum => xs.iter().copied().fold(f64::INFINITY, f64::min),
+                CalcOp::Maximum => xs.iter().copied().fold(f64::NEG_INFINITY, f64::max),
+            };
+            Some(if v.is_finite() { js_number(v) } else { "0".into() })
+        }
+        Calculate::Notation(expr) => {
+            let v = eval_notation(expr, &|name| values(name).first().map(num).unwrap_or(0.0))?;
+            Some(js_number(v))
+        }
+    }
+}
diff --git a/crates/forms/src/af/format.rs b/crates/forms/src/af/format.rs
new file mode 100644
index 0000000000..df4720bec7
--- /dev/null
+++ b/crates/forms/src/af/format.rs
@@ -0,0 +1,533 @@
+use super::*;
+
+/// Acrobat's AFDate_Format(n) / AFTime_Format(n) presets.
+pub const DATE_PRESETS: [&str; 14] = [
+    "m/d",
+    "m/d/yy",
+    "mm/dd/yy",
+    "mm/yy",
+    "d-mmm",
+    "d-mmm-yy",
+    "dd-mmm-yy",
+    "yy-mm-dd",
+    "mmm-yy",
+    "mmmm-yy",
+    "mmm d, yyyy",
+    "mmmm d, yyyy",
+    "m/d/yy h:MM tt",
+    "m/d/yy HH:MM",
+];
+
+pub const TIME_PRESETS: [&str; 4] = ["HH:MM", "h:MM tt", "HH:MM:ss", "h:MM:ss tt"];
+
+// ── running them ────────────────────────────────────────────────────────────────────────────
+
+/// AFMakeNumber: a number from typed text (currency symbols, group separators, spaces and a
+/// trailing % ignored; a comma decimal separator accepted).
+pub fn make_number(s: &str) -> Option<f64> {
+    let t: String = s.trim().chars().filter(|c| !c.is_whitespace() && !matches!(c, '$' | '€' | '£' | '¥' | '\'' | '%')).collect();
+    if t.is_empty() {
+        return None;
+    }
+    let neg = t.starts_with('(') && t.ends_with(')');
+    let t = t.trim_start_matches('(').trim_end_matches(')');
+    // "1.234,56" or "1234,56": comma is the decimal separator when it comes last.
+    let normalized = match (t.rfind(','), t.rfind('.')) {
+        (Some(c), Some(d)) if c > d => t.replace('.', "").replace(',', "."),
+        (Some(c), None) if t.len() - c - 1 != 3 => t.replace(',', "."),
+        _ => t.replace(',', ""),
+    };
+    let v: f64 = normalized.parse().ok()?;
+    v.is_finite().then_some(if neg { -v } else { v })
+}
+
+/// A number as JavaScript prints it (integers without a fraction).
+pub fn js_number(v: f64) -> String {
+    if v.fract() == 0.0 && v.abs() < 1e15 { format!("{}", v as i64) } else { format!("{v}") }
+}
+
+fn group(int: &str, sep: char) -> String {
+    let mut out = String::new();
+    for (i, c) in int.chars().enumerate() {
+        if i > 0 && (int.len() - i).is_multiple_of(3) {
+            out.push(sep);
+        }
+        out.push(c);
+    }
+    out
+}
+
+/// A number with `decimals` places in separator style `sep` (0 "1,234.56", 1 "1234.56",
+/// 2 "1.234,56", 3 "1234,56", 4 "1'234.56").
+fn number_text(v: f64, decimals: u8, sep: u8) -> String {
+    // Round half away from zero, as JavaScript's toFixed does for these values.
+    let p = 10f64.powi(i32::from(decimals));
+    let scaled = v.abs() * p;
+    // Past 2^53 every value is already whole, and scaling could overflow to infinity.
+    let r = if scaled.is_finite() { scaled.round() / p } else { v.abs() };
+    let s = format!("{:.*}", decimals as usize, r);
+    let (int, frac) = s.split_once('.').map_or((s.as_str(), ""), |(a, b)| (a, b));
+    let (g, d) = match sep {
+        1 => (None, '.'),
+        2 => (Some('.'), ','),
+        3 => (None, ','),
+        4 => (Some('\''), '.'),
+        _ => (Some(','), '.'),
+    };
+    let mut out = match g {
+        Some(c) => group(int, c),
+        None => int.to_string(),
+    };
+    if !frac.is_empty() {
+        out.push(d);
+        out.push_str(frac);
+    }
+    out
+}
+
+const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+
+const DAYS: [&str; 7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+
+/// A date and time read from text.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct DateTime {
+    pub y: i32,
+    pub m: u32,
+    pub d: u32,
+    pub hh: u32,
+    pub mm: u32,
+    pub ss: u32,
+}
+
+fn days_in(y: i32, m: u32) -> u32 {
+    match m {
+        2 if (y % 4 == 0 && y % 100 != 0) || y % 400 == 0 => 29,
+        2 => 28,
+        4 | 6 | 9 | 11 => 30,
+        _ => 31,
+    }
+}
+
+fn weekday(y: i32, m: u32, d: u32) -> usize {
+    // Sakamoto's method, in i64 so no year or day can overflow it.
+    const T: [i64; 12] = [0, 3, 2, 5, 0, 3, 5, 1, 4, 6, 2, 4];
+    let y = i64::from(y) - i64::from(m < 3);
+    let t = T.get((m as usize).wrapping_sub(1)).copied().unwrap_or(0);
+    (y + y / 4 - y / 100 + y / 400 + t + i64::from(d)).rem_euclid(7) as usize
+}
+
+/// One field of a date format, in the order the format has them.
+struct Part {
+    /// `'y'`, `'m'`, `'d'`, `'H'`, `'M'` or `'s'`; a run of literal digits (the fixed year in
+    /// "dd.mm.26") is `'#'`.
+    kind: char,
+    /// The value of a `'#'` run; 0 for the others.
+    literal: u32,
+    /// The digits the field takes when typed run together with the next one: 4 for "yyyy", 2 for
+    /// "yy", "mm", "dd", "HH", "MM" and "ss". 0 when the width varies ("m", "d") or the field is
+    /// a name ("mmm").
+    width: usize,
+    /// The next field follows with nothing between them ("yyyymmdd"), so one run of typed digits
+    /// can hold both.
+    joined: bool,
+}
+
+/// The fields of a format (year, month, day, hours, minutes, seconds and literal digits), in
+/// order.
+fn order(fmt: &str) -> Vec<Part> {
+    let mut out: Vec<Part> = Vec::new();
+    // Weekday names (ddd, dddd) are shown, not typed: leave them out.
+    let mut cleaned = fmt.replace("dddd", " ");
+    cleaned = cleaned.replace("ddd", " ");
+    let mut prev = ' ';
+    // The letter of the last field's current run and its length so far.
+    let mut run: Option<(char, usize)> = None;
+    let fixed = |k: char, n: usize| match (k, n) {
+        ('y', 2 | 4) | ('m' | 'd' | 'H' | 'M' | 's', 2) => n,
+        _ => 0,
+    };
+    for c in cleaned.chars() {
+        let continues = run.is_some_and(|(r, _)| r == c);
+        if let Some((r, n)) = run
+            && !continues
+        {
+            // The run ended; it was the last field's width.
+            if let Some(last) = out.last_mut().filter(|p| p.kind != '#') {
+                last.width = fixed(if r == 'h' { 'H' } else { r }, n);
+            }
+            run = None;
+        }
+        if let Some(digit) = c.to_digit(10) {
+            match out.last_mut() {
+                Some(p) if p.kind == '#' && prev.is_ascii_digit() => p.literal = p.literal.saturating_mul(10).saturating_add(digit),
+                _ => out.push(Part { kind: '#', literal: digit, width: 0, joined: false }),
+            }
+            prev = c;
+            continue;
+        }
+        let k = match c {
+            'y' => 'y',
+            'm' => 'm',
+            'd' => 'd',
+            'H' | 'h' => 'H',
+            'M' => 'M',
+            's' => 's',
+            _ => {
+                prev = c;
+                continue;
+            }
+        };
+        if continues {
+            run = run.map(|(r, n)| (r, n.saturating_add(1)));
+        } else {
+            // A field starting right where the last one's letters stopped is joined to it.
+            let adjacent = matches!(prev, 'y' | 'm' | 'd' | 'H' | 'h' | 'M' | 's');
+            if out.last().map(|p| p.kind) != Some(k) {
+                if let Some(last) = out.last_mut().filter(|p| p.kind != '#') {
+                    last.joined = adjacent;
+                }
+                out.push(Part { kind: k, literal: 0, width: 0, joined: false });
+            }
+            run = Some((c, 1));
+        }
+        prev = c;
+    }
+    if let (Some((r, n)), Some(last)) = (run, out.last_mut().filter(|p| p.kind != '#')) {
+        last.width = fixed(if r == 'h' { 'H' } else { r }, n);
+    }
+    out
+}
+
+/// Parse typed text against a date/time format (AFDate_KeystrokeEx's leniency: any
+/// separators, month names, two-digit years). `None` when it isn't a valid date.
+pub fn parse_date(text: &str, fmt: &str) -> Option<DateTime> {
+    let t = text.trim();
+    if t.is_empty() {
+        return None;
+    }
+    let lower = t.to_lowercase();
+    // A bare trailing "p" ("5:30p") only counts when it follows a digit, not a word like "Sep".
+    let bare_p = lower.strip_suffix('p').is_some_and(|rest| rest.trim_end().ends_with(|c: char| c.is_ascii_digit()));
+    let pm = lower.contains("pm") || bare_p;
+    let bare_a = lower.strip_suffix('a').is_some_and(|rest| rest.trim_end().ends_with(|c: char| c.is_ascii_digit()));
+    let am = lower.contains("am") || bare_a;
+    // Tokens: runs of digits (kept as text, so a run can be split between fields typed without
+    // separators) and month names.
+    let mut nums: VecDeque<String> = VecDeque::new();
+    let mut month_name: Option<u32> = None;
+    let mut cur = String::new();
+    let flush = |cur: &mut String, nums: &mut VecDeque<String>, month: &mut Option<u32>| {
+        if cur.is_empty() {
+            return;
+        }
+        if cur.starts_with(|c: char| c.is_ascii_digit()) {
+            nums.push_back(std::mem::take(cur));
+        } else if cur.len() >= 3
+            && let Some(i) = MONTHS.iter().position(|m| m.to_lowercase().starts_with(&cur.to_lowercase()))
+        {
+            *month = Some(i as u32 + 1);
+        }
+        cur.clear();
+    };
+    for c in t.chars() {
+        // Digits and letters form separate tokens ("5Mar" is 5 and Mar).
+        let same_kind = cur.is_empty() || cur.chars().next().is_some_and(|x| x.is_ascii_digit()) == c.is_ascii_digit();
+        if c.is_alphanumeric() && same_kind {
+            cur.push(c);
+        } else {
+            flush(&mut cur, &mut nums, &mut month_name);
+            if c.is_alphanumeric() {
+                cur.push(c);
+            }
+        }
+    }
+    flush(&mut cur, &mut nums, &mut month_name);
+    let mut dt = DateTime { y: 0, m: 1, d: 1, hh: 0, mm: 0, ss: 0 };
+    // The next number for a field. A field joined to the next one in the format ("yyyymmdd")
+    // takes only its own width from a longer run of digits and leaves the rest for the next.
+    // A run typed on its own is split only when fewer runs were typed than the fields of its kind
+    // still to fill (`need`, this one included: date fields for a date field, time fields for a
+    // time field, since times may be left out), and only when its rest can fill the next field
+    // (`next_width`): with separators each run is one field's number, so "2026-10-18" keeps its
+    // four-digit year in a yymmdd or yymmddHHMM field, and "2026 10 018" is the 18th. What is left
+    // of a split run (`tail`: the front of `nums` is one) goes on being split along the fields
+    // written side by side, and must fill its last field exactly, so "202610018" leaves "018" for
+    // dd and is refused. `None` when there is no number left, it doesn't fit a u32, or such a
+    // rest has the wrong width.
+    let next_number = |nums: &mut VecDeque<String>, tail: &mut bool, part: &Part, need: usize, next_width: usize| -> Option<u32> {
+        let run = nums.pop_front()?;
+        let was_tail = std::mem::replace(tail, false);
+        let short = nums.len() < need.saturating_sub(1);
+        let digits = match (run.get(..part.width), run.get(part.width..)) {
+            (Some(head), Some(rest)) if part.joined && part.width > 0 && !rest.is_empty() && (was_tail || (short && rest.len() >= next_width)) => {
+                nums.push_front(rest.to_string());
+                *tail = true;
+                head
+            }
+            _ if was_tail && part.width > 0 && run.len() != part.width => return None,
+            _ => run.as_str(),
+        };
+        digits.parse::<u32>().ok()
+    };
+    let parts = order(fmt);
+    let takes_number = |p: &Part| matches!(p.kind, 'y' | 'd' | 'H' | 'M' | 's') || (p.kind == 'm' && month_name.is_none());
+    let is_time = |p: &Part| matches!(p.kind, 'H' | 'M' | 's');
+    // The fields of each kind still to fill: [date, time].
+    let mut wanted = [parts.iter().filter(|p| takes_number(p) && !is_time(p)).count(), parts.iter().filter(|p| is_time(p)).count()];
+    let mut tail = false;
+    let mut have_y = false;
+    for (i, part) in parts.iter().enumerate() {
+        let kind = usize::from(is_time(part));
+        let need = wanted.get(kind).copied().unwrap_or(0);
+        let next_width = parts.get(i + 1).map_or(0, |p| p.width);
+        if takes_number(part)
+            && let Some(left) = wanted.get_mut(kind)
+        {
+            *left = left.saturating_sub(1);
+        }
+        let take = |nums: &mut VecDeque<String>, tail: &mut bool| next_number(nums, tail, part, need, next_width);
+        match part.kind {
+            // Literal digits in the format may be typed or left out ("15.05.26" or "15.05"
+            // for "dd.mm.26"); a different number there is left over and rejected below.
+            '#' if nums.front().and_then(|n| n.parse::<u32>().ok()) == Some(part.literal) => {
+                nums.pop_front();
+                tail = false;
+            }
+            'm' => {
+                dt.m = match month_name {
+                    Some(m) => m,
+                    None => take(&mut nums, &mut tail)?,
+                }
+            }
+            'd' => dt.d = take(&mut nums, &mut tail)?,
+            'y' => {
+                let y = i32::try_from(take(&mut nums, &mut tail)?).ok()?;
+                dt.y = if y < 100 { if y < 50 { 2000 + y } else { 1900 + y } } else { y };
+                have_y = true;
+            }
+            // Times may be left out; a number that is there must be readable.
+            'H' => dt.hh = if nums.is_empty() { 0 } else { take(&mut nums, &mut tail)? },
+            'M' => dt.mm = if nums.is_empty() { 0 } else { take(&mut nums, &mut tail)? },
+            's' => dt.ss = if nums.is_empty() { 0 } else { take(&mut nums, &mut tail)? },
+            _ => {}
+        }
+    }
+    if !nums.is_empty() {
+        return None;
+    }
+    if !have_y {
+        dt.y = 2000;
+    }
+    if pm && dt.hh < 12 {
+        dt.hh += 12;
+    }
+    if am && dt.hh == 12 {
+        dt.hh = 0;
+    }
+    let has_date = fmt.contains(['y', 'm', 'd']);
+    if has_date && (!(1..=12).contains(&dt.m) || dt.d == 0 || dt.d > days_in(dt.y, dt.m)) {
+        return None;
+    }
+    if dt.hh > 23 || dt.mm > 59 || dt.ss > 59 {
+        return None;
+    }
+    Some(dt)
+}
+
+/// Format a date/time with Acrobat's date format letters.
+pub fn format_date(dt: DateTime, fmt: &str) -> String {
+    let chars: Vec<char> = fmt.chars().collect();
+    let mut out = String::new();
+    let mut i = 0;
+    while i < chars.len() {
+        let c = chars[i];
+        let mut n = 1;
+        while i + n < chars.len() && chars[i + n] == c {
+            n += 1;
+        }
+        let h12 = if dt.hh.is_multiple_of(12) { 12 } else { dt.hh % 12 };
+        match (c, n) {
+            ('y', 4..) => {
+                let _ = write!(out, "{:04}", dt.y);
+            }
+            ('y', _) => {
+                let _ = write!(out, "{:02}", dt.y.rem_euclid(100));
+            }
+            ('m', 3..) => match MONTHS.get((dt.m as usize).wrapping_sub(1)) {
+                Some(name) if n >= 4 => out.push_str(name),
+                Some(name) => out.push_str(name.get(..3).unwrap_or(name)),
+                None => {
+                    let _ = write!(out, "{}", dt.m);
+                }
+            },
+            ('m', 2) => {
+                let _ = write!(out, "{:02}", dt.m);
+            }
+            ('m', _) => {
+                let _ = write!(out, "{}", dt.m);
+            }
+            ('d', 3..) => {
+                let name = DAYS.get(weekday(dt.y, dt.m, dt.d)).copied().unwrap_or_default();
+                out.push_str(if n >= 4 { name } else { name.get(..3).unwrap_or(name) });
+            }
+            ('d', 2) => {
+                let _ = write!(out, "{:02}", dt.d);
+            }
+            ('d', _) => {
+                let _ = write!(out, "{}", dt.d);
+            }
+            ('H', 2) => {
+                let _ = write!(out, "{:02}", dt.hh);
+            }
+            ('H', _) => {
+                let _ = write!(out, "{}", dt.hh);
+            }
+            ('h', 2) => {
+                let _ = write!(out, "{h12:02}");
+            }
+            ('h', _) => {
+                let _ = write!(out, "{h12}");
+            }
+            ('M', 2) => {
+                let _ = write!(out, "{:02}", dt.mm);
+            }
+            ('M', _) => {
+                let _ = write!(out, "{}", dt.mm);
+            }
+            ('s', 2) => {
+                let _ = write!(out, "{:02}", dt.ss);
+            }
+            ('s', _) => {
+                let _ = write!(out, "{}", dt.ss);
+            }
+            ('t', 2) => out.push_str(if dt.hh < 12 { "am" } else { "pm" }),
+            ('t', _) => out.push(if dt.hh < 12 { 'a' } else { 'p' }),
+            (c, n) => out.extend(std::iter::repeat_n(c, n)),
+        }
+        i += n;
+    }
+    out
+}
+
+const SPECIAL_MASKS: [&str; 4] = ["99999", "99999-9999", "(999) 999-9999", "999-99-9999"];
+
+fn mask_fits(mask: &str, text: &str) -> bool {
+    let t: Vec<char> = text.chars().collect();
+    let m: Vec<char> = mask.chars().collect();
+    t.len() == m.len()
+        && m.iter().zip(&t).all(|(mc, tc)| match mc {
+            '9' => tc.is_ascii_digit(),
+            'A' => tc.is_alphabetic(),
+            'O' => tc.is_alphanumeric(),
+            'X' => true,
+            other => other == tc,
+        })
+}
+
+/// Fill a mask from the typed characters that fit its slots.
+fn apply_mask(mask: &str, text: &str) -> Option<String> {
+    let mut src = text.chars().filter(|c| c.is_alphanumeric());
+    let mut out = String::new();
+    for mc in mask.chars() {
+        match mc {
+            '9' | 'A' | 'O' | 'X' => {
+                let c = src.next()?;
+                let ok = match mc {
+                    '9' => c.is_ascii_digit(),
+                    'A' => c.is_alphabetic(),
+                    _ => true,
+                };
+                if !ok {
+                    return None;
+                }
+                out.push(c);
+            }
+            other => out.push(other),
+        }
+    }
+    src.next().is_none().then_some(out)
+}
+
+/// The text shown for a value (the Format event).
+pub fn format_value(f: &Format, value: &str) -> String {
+    if value.is_empty() {
+        return String::new();
+    }
+    match f {
+        Format::None => value.to_string(),
+        Format::Number { decimals, sep, neg, currency, prepend } => {
+            let Some(v) = make_number(value) else { return value.to_string() };
+            let body = number_text(v, *decimals, *sep);
+            let body = match (currency.is_empty(), *prepend) {
+                (true, _) => body,
+                (false, true) => format!("{currency}{body}"),
+                (false, false) => format!("{body}{currency}"),
+            };
+            match (v < 0.0, neg) {
+                (false, _) => body,
+                // Styles 2 and 3 use parentheses (3 is also red, which the appearance can't
+                // know here); 0 and 1 a minus sign.
+                (true, 2 | 3) => format!("({body})"),
+                (true, _) => format!("-{body}"),
+            }
+        }
+        Format::Percent { decimals, sep } => match make_number(value) {
+            Some(v) => format!(
+                "{}%",
+                if v < 0.0 { format!("-{}", number_text(v * 100.0, *decimals, *sep)) } else { number_text(v * 100.0, *decimals, *sep) }
+            ),
+            None => value.to_string(),
+        },
+        Format::Date(fmt) | Format::Time(fmt) => parse_date(value, fmt).map_or_else(|| value.to_string(), |dt| format_date(dt, fmt)),
+        Format::Special(n) => apply_mask(SPECIAL_MASKS[(*n).min(3) as usize], value).unwrap_or_else(|| value.to_string()),
+        Format::Mask(m) => apply_mask(m, value).unwrap_or_else(|| value.to_string()),
+    }
+}
+
+/// The Keystroke event on commit: does the value fit the format? Returns the value to store
+/// (numbers are normalised), or Acrobat's message.
+pub fn keystroke(f: &Format, field: &str, value: &str) -> Result<String, String> {
+    let bad = || format!("The value entered does not match the format of the field [ {field} ]");
+    // Blank input clears a formatted field; without a format, whitespace is text like any other.
+    if *f != Format::None && value.trim().is_empty() {
+        return Ok(String::new());
+    }
+    match f {
+        Format::None => Ok(value.to_string()),
+        Format::Number { .. } => make_number(value).map(js_number).ok_or_else(bad),
+        Format::Percent { .. } => {
+            // Typed "12.5%" or "12.5" both mean 0.125 once stored? Acrobat stores the number
+            // as typed and shows it ×100: keep the typed number.
+            make_number(value).map(js_number).ok_or_else(bad)
+        }
+        Format::Date(fmt) | Format::Time(fmt) => parse_date(value, fmt)
+            .map(|_| value.trim().to_string())
+            .ok_or_else(|| format!("Invalid date/time: please ensure that the date/time exists. Field [ {field} ] should match format {fmt}")),
+        Format::Special(n) => {
+            let m = SPECIAL_MASKS[(*n).min(3) as usize];
+            apply_mask(m, value).filter(|s| mask_fits(m, s)).map(|_| value.trim().to_string()).ok_or_else(bad)
+        }
+        Format::Mask(m) => apply_mask(m, value).map(|_| value.trim().to_string()).ok_or_else(bad),
+    }
+}
+
+/// The Validate event: `Err` with Acrobat's message when the value is out of range.
+pub fn validate(v: &Validate, value: &str) -> Result<(), String> {
+    let Validate::Range { min, max } = v else { return Ok(()) };
+    if value.trim().is_empty() {
+        return Ok(());
+    }
+    let Some(x) = make_number(value) else { return Ok(()) };
+    let fmt = |n: f64| js_number(n);
+    let ok = min.is_none_or(|m| x >= m) && max.is_none_or(|m| x <= m);
+    if ok {
+        return Ok(());
+    }
+    Err(match (min, max) {
+        (Some(a), Some(b)) => format!("Invalid value: must be greater than or equal to {} and less than or equal to {}.", fmt(*a), fmt(*b)),
+        (Some(a), None) => format!("Invalid value: must be greater than or equal to {}.", fmt(*a)),
+        (None, Some(b)) => format!("Invalid value: must be less than or equal to {}.", fmt(*b)),
+        (None, None) => String::new(),
+    })
+}
diff --git a/crates/forms/src/af/script.rs b/crates/forms/src/af/script.rs
new file mode 100644
index 0000000000..c807f2d7d7
--- /dev/null
+++ b/crates/forms/src/af/script.rs
@@ -0,0 +1,340 @@
+use super::calc::{js_tokens, notation_js, notation_range};
+use super::format::{DATE_PRESETS, TIME_PRESETS};
+use super::*;
+
+// ── parsing scripts ─────────────────────────────────────────────────────────────────────────
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Arg {
+    Num(f64),
+    Str(String),
+    Bool(bool),
+    List(Vec<Arg>),
+}
+
+impl Arg {
+    fn num(&self) -> Option<f64> {
+        match self {
+            Arg::Num(n) => Some(*n),
+            Arg::Bool(b) => Some(f64::from(u8::from(*b))),
+            Arg::Str(s) => s.trim().parse().ok(),
+            Arg::List(_) => None,
+        }
+    }
+
+    pub(super) fn string(&self) -> Option<String> {
+        match self {
+            Arg::Str(s) => Some(s.clone()),
+            Arg::Num(n) => Some(n.to_string()),
+            _ => None,
+        }
+    }
+
+    fn truthy(&self) -> bool {
+        match self {
+            Arg::Bool(b) => *b,
+            Arg::Num(n) => *n != 0.0,
+            Arg::Str(s) => !s.is_empty(),
+            Arg::List(l) => !l.is_empty(),
+        }
+    }
+}
+
+/// How deeply script arguments and field notation may nest; deeper input is rejected rather
+/// than recursed into (a hostile file could otherwise overflow the stack).
+pub(super) const MAX_NESTING: usize = 64;
+
+fn hex4(bytes: &[u8]) -> Option<u16> {
+    if bytes.len() != 4 {
+        return None;
+    }
+    bytes.iter().try_fold(0u16, |value, byte| {
+        let digit = match byte {
+            b'0'..=b'9' => byte - b'0',
+            b'a'..=b'f' => byte - b'a' + 10,
+            b'A'..=b'F' => byte - b'A' + 10,
+            _ => return None,
+        };
+        value.checked_mul(16)?.checked_add(u16::from(digit))
+    })
+}
+
+pub(super) struct Parser<'a> {
+    pub(super) s: &'a [u8],
+    pub(super) i: usize,
+    pub(super) depth: usize,
+}
+
+impl Parser<'_> {
+    fn ws(&mut self) {
+        while self.i < self.s.len() && (self.s[self.i].is_ascii_whitespace()) {
+            self.i += 1;
+        }
+    }
+
+    pub(super) fn string(&mut self) -> Option<String> {
+        let q = self.s[self.i];
+        self.i += 1;
+        let mut out = Vec::new();
+        while self.i < self.s.len() {
+            let c = self.s[self.i];
+            self.i += 1;
+            match c {
+                b'\\' if self.i < self.s.len() => {
+                    let e = self.s[self.i];
+                    self.i += 1;
+                    match e {
+                        b'n' => out.push(b'\n'),
+                        b'r' => out.push(b'\r'),
+                        b't' => out.push(b'\t'),
+                        b'b' => out.push(0x08),
+                        b'f' => out.push(0x0C),
+                        b'v' => out.push(0x0B),
+                        b'0' => out.push(0),
+                        b'x' => {
+                            let digits = self.s.get(self.i..self.i.checked_add(2)?)?;
+                            let code = hex4(&[b'0', b'0', digits[0], digits[1]])?;
+                            self.i += 2;
+                            let ch = char::from_u32(u32::from(code)).unwrap_or('\u{FFFD}');
+                            let mut encoded = [0u8; 4];
+                            out.extend_from_slice(ch.encode_utf8(&mut encoded).as_bytes());
+                        }
+                        b'u' => {
+                            let code = hex4(self.s.get(self.i..self.i.checked_add(4)?)?)?;
+                            self.i += 4;
+                            let code = if (0xD800..=0xDBFF).contains(&code) && self.s.get(self.i..self.i.checked_add(6)?)?.starts_with(b"\\u") {
+                                let low = hex4(self.s.get(self.i.checked_add(2)?..self.i.checked_add(6)?)?)?;
+                                if (0xDC00..=0xDFFF).contains(&low) {
+                                    self.i += 6;
+                                    0x10000 + ((u32::from(code) - 0xD800) << 10) + (u32::from(low) - 0xDC00)
+                                } else {
+                                    u32::from(code)
+                                }
+                            } else {
+                                u32::from(code)
+                            };
+                            let ch = char::from_u32(code).unwrap_or('\u{FFFD}');
+                            let mut encoded = [0u8; 4];
+                            out.extend_from_slice(ch.encode_utf8(&mut encoded).as_bytes());
+                        }
+                        other => out.push(other),
+                    }
+                }
+                c if c == q => return Some(String::from_utf8_lossy(&out).into_owned()),
+                c => out.push(c),
+            }
+        }
+        None
+    }
+
+    fn arg(&mut self) -> Option<Arg> {
+        self.ws();
+        let c = *self.s.get(self.i)?;
+        match c {
+            b'"' | b'\'' => self.string().map(Arg::Str),
+            b'[' => {
+                self.i += 1;
+                self.nested(b']').map(Arg::List)
+            }
+            _ if self.s[self.i..].starts_with(b"new Array") => {
+                self.i += b"new Array".len();
+                self.ws();
+                if self.s.get(self.i) != Some(&b'(') {
+                    return None;
+                }
+                self.i += 1;
+                self.nested(b')').map(Arg::List)
+            }
+            _ if self.s[self.i..].starts_with(b"true") => {
+                self.i += 4;
+                Some(Arg::Bool(true))
+            }
+            _ if self.s[self.i..].starts_with(b"false") => {
+                self.i += 5;
+                Some(Arg::Bool(false))
+            }
+            _ => {
+                let start = self.i;
+                while self.i < self.s.len() && (self.s[self.i].is_ascii_digit() || matches!(self.s[self.i], b'.' | b'-' | b'+' | b'e' | b'E')) {
+                    self.i += 1;
+                }
+                std::str::from_utf8(&self.s[start..self.i]).ok()?.parse().ok().map(Arg::Num)
+            }
+        }
+    }
+
+    /// A list inside another, at most [`MAX_NESTING`] deep.
+    fn nested(&mut self, close: u8) -> Option<Vec<Arg>> {
+        if self.depth >= MAX_NESTING {
+            return None;
+        }
+        self.depth += 1;
+        let out = self.list(close);
+        self.depth -= 1;
+        out
+    }
+
+    fn list(&mut self, close: u8) -> Option<Vec<Arg>> {
+        let mut out = Vec::new();
+        loop {
+            self.ws();
+            if self.s.get(self.i) == Some(&close) {
+                self.i += 1;
+                return Some(out);
+            }
+            out.push(self.arg()?);
+            self.ws();
+            match self.s.get(self.i) {
+                Some(b',') => self.i += 1,
+                Some(c) if *c == close => {
+                    self.i += 1;
+                    return Some(out);
+                }
+                _ => return None,
+            }
+        }
+    }
+}
+
+/// The first call to `name(` in `js` and its arguments.
+pub(super) fn call(js: &str, name: &str) -> Option<Vec<Arg>> {
+    let at = js.find(&format!("{name}("))?;
+    // Not part of a longer identifier (AFDate_Format vs AFDate_FormatEx).
+    if js[..at].chars().last().is_some_and(|c| c.is_alphanumeric() || c == '_') {
+        return None;
+    }
+    let mut p = Parser { s: js.as_bytes(), i: at + name.len() + 1, depth: 0 };
+    p.list(b')')
+}
+
+pub fn parse_format(js: &str) -> Option<Format> {
+    let a = |args: &[Arg], i: usize| args.get(i).and_then(Arg::num).unwrap_or(0.0).clamp(0.0, 255.0) as u8;
+    if let Some(args) = call(js, "AFNumber_Format") {
+        return Some(Format::Number {
+            decimals: a(&args, 0),
+            sep: a(&args, 1),
+            neg: a(&args, 2),
+            currency: args.get(4).and_then(Arg::string).unwrap_or_default(),
+            prepend: args.get(5).is_none_or(Arg::truthy),
+        });
+    }
+    if let Some(args) = call(js, "AFPercent_Format") {
+        return Some(Format::Percent { decimals: a(&args, 0), sep: a(&args, 1) });
+    }
+    if let Some(args) = call(js, "AFDate_FormatEx") {
+        return Some(Format::Date(args.first().and_then(Arg::string)?));
+    }
+    if let Some(args) = call(js, "AFDate_Format") {
+        return Some(Format::Date(DATE_PRESETS.get(a(&args, 0) as usize)?.to_string()));
+    }
+    if let Some(args) = call(js, "AFTime_FormatEx") {
+        return Some(Format::Time(args.first().and_then(Arg::string)?));
+    }
+    if let Some(args) = call(js, "AFTime_Format") {
+        return Some(Format::Time(TIME_PRESETS.get(a(&args, 0) as usize)?.to_string()));
+    }
+    if let Some(args) = call(js, "AFSpecial_Format") {
+        return Some(Format::Special(a(&args, 0).min(3)));
+    }
+    if let Some(args) = call(js, "AFSpecial_KeystrokeEx") {
+        return Some(Format::Mask(args.first().and_then(Arg::string)?));
+    }
+    None
+}
+
+pub fn parse_validate(js: &str) -> Option<Validate> {
+    let args = call(js, "AFRange_Validate")?;
+    let flag = |i: usize| args.get(i).is_some_and(Arg::truthy);
+    let num = |i: usize| args.get(i).and_then(Arg::num);
+    Some(Validate::Range { min: if flag(0) { num(1) } else { None }, max: if flag(2) { num(3) } else { None } })
+}
+
+pub fn parse_calculate(js: &str) -> Option<Calculate> {
+    // Simplified field notation: Acrobat keeps the expression in a comment. A script is read for
+    // its comments only when it spells the marker.
+    if js.contains("BVCALC")
+        && let Some(range) = notation_range(js, &js_tokens(js).1)
+    {
+        return Some(Calculate::Notation(js.get(range)?.trim().to_string()));
+    }
+    let args = call(js, "AFSimple_Calculate")?;
+    let op = match args.first().and_then(Arg::string)?.as_str() {
+        "SUM" => CalcOp::Sum,
+        "PRD" => CalcOp::Product,
+        "AVG" => CalcOp::Average,
+        "MIN" => CalcOp::Minimum,
+        "MAX" => CalcOp::Maximum,
+        _ => return None,
+    };
+    let fields = match args.get(1)? {
+        Arg::List(l) => l.iter().filter_map(Arg::string).collect(),
+        Arg::Str(s) => s.split(',').map(|x| x.trim().to_string()).filter(|x| !x.is_empty()).collect(),
+        _ => return None,
+    };
+    Some(Calculate::Simple { op, fields })
+}
+
+// ── writing scripts (what Acrobat's tabs generate) ─────────────────────────────────────────
+
+pub(super) fn js_str(s: &str) -> String {
+    let mut o = String::from("\"");
+    for c in s.chars() {
+        match c {
+            '"' | '\\' => {
+                o.push('\\');
+                o.push(c);
+            }
+            '\n' => o.push_str("\\n"),
+            '\r' => o.push_str("\\r"),
+            '\t' => o.push_str("\\t"),
+            c if c.is_ascii() && !c.is_control() => o.push(c),
+            c => {
+                let mut units = [0u16; 2];
+                for unit in c.encode_utf16(&mut units) {
+                    o.push_str(&format!("\\u{unit:04X}"));
+                }
+            }
+        }
+    }
+    o.push('"');
+    o
+}
+
+/// The (format, keystroke) scripts for a format.
+pub fn format_js(f: &Format) -> Option<(String, String)> {
+    Some(match f {
+        Format::None => return None,
+        Format::Number { decimals, sep, neg, currency, prepend } => {
+            let args = format!("{decimals}, {sep}, {neg}, 0, {}, {prepend}", js_str(currency));
+            (format!("AFNumber_Format({args});"), format!("AFNumber_Keystroke({args});"))
+        }
+        Format::Percent { decimals, sep } => (format!("AFPercent_Format({decimals}, {sep});"), format!("AFPercent_Keystroke({decimals}, {sep});")),
+        Format::Date(f) => (format!("AFDate_FormatEx({});", js_str(f)), format!("AFDate_KeystrokeEx({});", js_str(f))),
+        Format::Time(f) => (format!("AFTime_FormatEx({});", js_str(f)), format!("AFTime_KeystrokeEx({});", js_str(f))),
+        Format::Special(n) => (format!("AFSpecial_Format({n});"), format!("AFSpecial_Keystroke({n});")),
+        Format::Mask(m) => (String::new(), format!("AFSpecial_KeystrokeEx({});", js_str(m))),
+    })
+}
+
+pub fn validate_js(v: &Validate) -> Option<String> {
+    match v {
+        Validate::None => None,
+        Validate::Range { min, max } => {
+            Some(format!("AFRange_Validate({}, {}, {}, {});", min.is_some(), min.unwrap_or(0.0), max.is_some(), max.unwrap_or(0.0)))
+        }
+    }
+}
+
+pub fn calculate_js(c: &Calculate) -> Option<String> {
+    match c {
+        Calculate::None => None,
+        Calculate::Simple { op, fields } => Some(format!(
+            "AFSimple_Calculate({}, new Array({}));",
+            js_str(op.code()),
+            fields.iter().map(|f| js_str(f)).collect::<Vec<_>>().join(", ")
+        )),
+        // Acrobat's own translation follows the comment, so a viewer that runs the script instead
+        // of reading the comment computes the same value (a placeholder here showed 0).
+        Calculate::Notation(expr) => Some(format!("/** BVCALC {expr} EVCALC **/ event.value = {};", notation_js(expr))),
+    }
+}
diff --git a/crates/forms/src/af/tests.rs b/crates/forms/src/af/tests.rs
new file mode 100644
index 0000000000..ff25e06968
--- /dev/null
+++ b/crates/forms/src/af/tests.rs
@@ -0,0 +1,309 @@
+use super::*;
+
+#[test]
+fn javascript_escapes_are_decoded() {
+    assert_eq!(
+        parse_format("AFNumber_Format(2, 0, 0, 0, \"\\x24\", true);"),
+        Some(Format::Number { decimals: 2, sep: 0, neg: 0, currency: "$".into(), prepend: true })
+    );
+    assert_eq!(parse_format("AFDate_FormatEx(\"\\b\\f\\v\\0\\q\");"), Some(Format::Date("\u{8}\u{c}\u{b}\0q".into())));
+}
+
+#[test]
+fn scripts_are_recognised_and_written_back() {
+    assert_eq!(
+        parse_format("AFNumber_Format(2, 0, 0, 0, \"$\", true);"),
+        Some(Format::Number { decimals: 2, sep: 0, neg: 0, currency: "$".into(), prepend: true })
+    );
+    assert_eq!(parse_format("AFPercent_Format(1, 0);"), Some(Format::Percent { decimals: 1, sep: 0 }));
+    assert_eq!(parse_format("AFDate_FormatEx(\"dd-mmm-yyyy\");"), Some(Format::Date("dd-mmm-yyyy".into())));
+    assert_eq!(parse_format("AFDate_Format(2);"), Some(Format::Date("mm/dd/yy".into())));
+    assert_eq!(parse_format("AFTime_Format(1);"), Some(Format::Time("h:MM tt".into())));
+    assert_eq!(parse_format("AFSpecial_Format(2);"), Some(Format::Special(2)));
+    assert_eq!(parse_format("AFSpecial_KeystrokeEx(\"AA-9999\");"), Some(Format::Mask("AA-9999".into())));
+    assert_eq!(parse_format("app.alert('hi')"), None);
+    assert_eq!(parse_validate("AFRange_Validate(true, 0, true, 100);"), Some(Validate::Range { min: Some(0.0), max: Some(100.0) }));
+    assert_eq!(parse_validate("AFRange_Validate(false, 0, true, 10);"), Some(Validate::Range { min: None, max: Some(10.0) }));
+    assert_eq!(
+        parse_calculate("AFSimple_Calculate(\"SUM\", new Array (\"a\", \"b.c\"));"),
+        Some(Calculate::Simple { op: CalcOp::Sum, fields: vec!["a".into(), "b.c".into()] })
+    );
+    assert_eq!(parse_calculate("AFSimple_Calculate('AVG', ['x']);"), Some(Calculate::Simple { op: CalcOp::Average, fields: vec!["x".into()] }));
+    assert_eq!(
+        parse_calculate("/** BVCALC Price * Qty EVCALC **/ event.value = AFMakeNumber(getField(\"Price\").value) * …"),
+        Some(Calculate::Notation("Price * Qty".into()))
+    );
+    // Round trips through what the tabs write.
+    for f in [
+        Format::Number { decimals: 2, sep: 2, neg: 2, currency: "€".into(), prepend: false },
+        Format::Percent { decimals: 0, sep: 0 },
+        Format::Date("mmmm d, yyyy".into()),
+        Format::Special(3),
+    ] {
+        let (fj, _) = format_js(&f).unwrap();
+        assert_eq!(parse_format(&fj), Some(f));
+    }
+    let euro = format_js(&Format::Number { decimals: 2, sep: 2, neg: 0, currency: "€".into(), prepend: true }).unwrap().0;
+    assert!(euro.contains("\\u20AC"), "{euro}");
+    assert!(!euro.contains('€'), "{euro}");
+    let pound = format_js(&Format::Number { decimals: 2, sep: 0, neg: 0, currency: "£".into(), prepend: true }).unwrap().0;
+    assert!(pound.contains("\\u00A3"), "{pound}");
+    assert!(!pound.contains('£'), "{pound}");
+    let c = Calculate::Simple { op: CalcOp::Product, fields: vec!["q".into(), "p".into()] };
+    assert_eq!(parse_calculate(&calculate_js(&c).unwrap()), Some(c));
+    let c = Calculate::Notation("a + b".into());
+    assert_eq!(parse_calculate(&calculate_js(&c).unwrap()), Some(c));
+    // The JavaScript after the comment is Acrobat's translation, so viewers that run it
+    // instead of reading the comment compute the same value (not 0).
+    assert_eq!(
+        calculate_js(&Calculate::Notation("(Unit\\ Price * Qty) / 2".into())).unwrap(),
+        "/** BVCALC (Unit\\ Price * Qty) / 2 EVCALC **/ event.value = (AFMakeNumber(this.getField(\"Unit Price\").value) * AFMakeNumber(this.getField(\"Qty\").value)) / 2;"
+    );
+}
+
+#[test]
+fn a_rename_rewrites_only_where_a_calculation_reads_the_field() {
+    let renamed = |js: &str| rename_in_calculation(js, "a", "qty");
+    // The field lists Acrobat and other tools write for AFSimple_Calculate.
+    assert_eq!(
+        renamed("AFSimple_Calculate(\"SUM\", new Array (\"a\", \"b\"));").as_deref(),
+        Some("AFSimple_Calculate(\"SUM\", new Array (\"qty\", \"b\"));")
+    );
+    assert_eq!(renamed("AFSimple_Calculate('AVG', ['b', 'a']);").as_deref(), Some("AFSimple_Calculate('AVG', ['b', \"qty\"]);"));
+    assert_eq!(renamed("AFSimple_Calculate(\"SUM\", \"a, b,a\");").as_deref(), Some("AFSimple_Calculate(\"SUM\", \"qty, b,qty\");"));
+    assert_eq!(renamed("AFSimple_Calculate(\"SUM\", new Array(\"ab\", \"b.a\"));"), None, "other names that contain it");
+    // Notation: the expression in the comment and Acrobat's translation after it.
+    let notation = |expr: &str| calculate_js(&Calculate::Notation(expr.into())).unwrap();
+    assert_eq!(rename_in_calculation(&notation("(a + ab) * a / 2"), "a", "Unit Price"), Some(notation("(Unit\\ Price + ab) * Unit\\ Price / 2")));
+    assert_eq!(rename_in_calculation(&notation("Unit\\ Price * 2"), "Unit Price", "price"), Some(notation("price * 2")));
+    // Scripts: a getField whose argument is one string literal. Comments, strings, template
+    // literals, regular expressions and names built at run time are left as written.
+    let script = "// getField(\"a\")\nvar s = \"getField('a')\", t = `getField(\"a\")`; /* getField(\"a\") */\n\
+                      if (/\"/.test(s)) event.value = this.getField('a').value / 2 * getField(\"a\" + 1).value + getField ( \"ab\" ).value;";
+    assert_eq!(renamed(script), Some(script.replacen("this.getField('a')", "this.getField(\"qty\")", 1)));
+    assert_eq!(renamed("event.value = getField(\"b\").value;"), None);
+    // A new name is escaped as the script needs it.
+    assert_eq!(
+        rename_in_calculation("event.value = getField(\"a\").value;", "a", "say \"é\"").as_deref(),
+        Some("event.value = getField(\"say \\\"\\u00E9\\\"\").value;")
+    );
+    // A name that would end the notation early is not written in.
+    assert_eq!(rename_in_calculation(&notation("a * 2"), "a", "qtyEVCALC"), None);
+    // Unfinished scripts end their tokens, not the program.
+    for js in ["getField(\"a", "/* getField(\"a\")", "`getField(\"a\")", "x = /[/", "getField('a\\u12"] {
+        assert_eq!(renamed(js), None, "{js}");
+    }
+}
+
+/// The notation is read only from a comment, where Acrobat writes it: a string or code that
+/// spells the markers is left alone, by the Calculate tab and by a rename.
+#[test]
+fn notation_is_read_only_from_a_comment() {
+    let string = "var s = \"BVCALC a EVCALC\"; event.value = getField(\"b\").value;";
+    assert_eq!(parse_calculate(string), None);
+    assert_eq!(rename_in_calculation(string, "a", "qty"), None);
+    // A comment after such a string holds the notation.
+    let both = "var s = 'BVCALC x EVCALC'; /** BVCALC a + 1 EVCALC **/ event.value = 1;";
+    assert_eq!(parse_calculate(both), Some(Calculate::Notation("a + 1".into())));
+    assert_eq!(rename_in_calculation(both, "x", "y"), None);
+    assert_eq!(rename_in_calculation(both, "a", "qty"), Some(both.replace("a + 1", "qty + 1")));
+    // A line comment is a comment too, and an unfinished one still holds it.
+    assert_eq!(parse_calculate("// BVCALC a EVCALC\nevent.value = 1;"), Some(Calculate::Notation("a".into())));
+    assert_eq!(parse_calculate("/** BVCALC a EVCALC"), Some(Calculate::Notation("a".into())));
+}
+
+/// A line comment ends at any of JavaScript's line terminators, not only `\n`, so with `\r` line
+/// endings the code after one is still code; and a `/` read as starting a regular expression
+/// divides after all when the line ends first.
+#[test]
+fn a_line_comment_ends_at_any_line_terminator() {
+    for end in ["\n", "\r", "\r\n", "\u{2028}", "\u{2029}"] {
+        let string = format!("// header{end}var s = \"BVCALC a EVCALC\"; event.value = getField(\"b\").value;");
+        assert_eq!(parse_calculate(&string), None, "{end:?}");
+        assert_eq!(rename_in_calculation(&string, "a", "qty"), None, "{end:?}");
+        let script = format!("// note{end}getField(\"a\").value;");
+        assert_eq!(rename_in_calculation(&script, "a", "qty"), Some(script.replace("\"a\"", "\"qty\"")), "{end:?}");
+        let divides = format!("var n = i++ / 2;{end}event.value = getField(\"a\").value / 4;");
+        assert_eq!(rename_in_calculation(&divides, "a", "qty"), Some(divides.replace("\"a\"", "\"qty\"")), "{end:?}");
+    }
+}
+
+/// U+2028 and U+2029 end a word, a number or a regular expression's flags, though as bytes
+/// past ASCII they could be part of one, so a `getField` right after one is still a call.
+#[test]
+fn a_token_ends_at_a_line_separator() {
+    for end in ["\u{2028}", "\u{2029}"] {
+        let scripts = ["x", "1", "/r/g"].map(|token| format!("var t = {token}{end}getField(\"a\").value;"));
+        let renamed = scripts.clone().map(|js| rename_in_calculation(&js, "a", "qty"));
+        assert_eq!(renamed, scripts.map(|js| Some(js.replace("\"a\"", "\"qty\""))), "{end:?}");
+    }
+}
+
+/// A `/` after the condition of `if`, `while`, `for` or `with` starts a regular expression,
+/// as after an operator; after a call's parentheses it still divides.
+#[test]
+fn a_regex_after_a_condition_is_not_read_as_code() {
+    let renamed = |js: &str| rename_in_calculation(js, "a", "qty");
+    assert_eq!(renamed("if (flag) /getField(\"a\")/.test(x); event.value = 1;"), None);
+    // A quote inside it doesn't start a string that hides the rest of the script.
+    let quote = "while (i--) /\"/.test(s); event.value = getField(\"a\").value;";
+    assert_eq!(renamed(quote), Some(quote.replace("\"a\"", "\"qty\"")));
+    // The same after the `while` that ends a `do` loop.
+    let after_do = "do i++; while (i < n) /\"/.test(s); event.value = getField(\"a\").value;";
+    assert_eq!(renamed(after_do), Some(after_do.replace("\"a\"", "\"qty\"")));
+    // After a call, or a method that happens to be called `if`, the `/` divides.
+    let divides = "event.value = Math.abs(getField(\"b\").value) / 2 + getField(\"a\").value / 3 + o.if(x) / 4 + getField(\"a\").value / 5;";
+    assert_eq!(renamed(divides), Some(divides.replace("\"a\"", "\"qty\"")));
+}
+
+/// Scripts are read in one pass: a line of unfinished regular expressions, or calls nested in
+/// one another's field lists, don't make a rename read the rest of the script again for each.
+#[test]
+fn hostile_scripts_are_read_in_one_pass() {
+    let regexes = format!("x = {} getField(\"a\")", "/[".repeat(500_000));
+    assert!(rename_in_calculation(&regexes, "a", "b").is_some_and(|js| js.ends_with("getField(\"b\")")));
+    let nested = format!("{}\"a\"", "AFSimple_Calculate(\"SUM\", new Array(".repeat(100_000));
+    assert_eq!(rename_in_calculation(&nested, "a", "b"), Some(format!("{}\"b\"", "AFSimple_Calculate(\"SUM\", new Array(".repeat(100_000))));
+}
+
+/// Notation is read through one lexer: field names with escapes, numbers and operators.
+#[test]
+fn notation_is_read_by_one_lexer() {
+    let tokens: Vec<Notation> = notation_tokens("(Unit\\ Price+1.5)*qty_2\\").into_iter().map(|(_, t)| t).collect();
+    assert_eq!(
+        tokens,
+        [
+            Notation::Op('('),
+            Notation::Name("Unit Price".into()),
+            Notation::Op('+'),
+            Notation::Number,
+            Notation::Op(')'),
+            Notation::Op('*'),
+            Notation::Name("qty_2\\".into())
+        ]
+    );
+    assert_eq!(notation_js("2 * a\\ b"), "2 * AFMakeNumber(this.getField(\"a b\").value)");
+    let values = |name: &str| if name == "Unit Price" { 4.0 } else { 0.5 };
+    assert_eq!(eval_notation("(Unit\\ Price + 1.5) * qty", &values), Some(2.75));
+    assert_eq!(eval_notation("1.2.3 + a", &values), None, "a number that isn't one");
+    assert_eq!(notation_name("2nd + (x)\\"), "\\2nd\\ \\+\\ \\(x\\)\\\\");
+}
+
+proptest::proptest! {
+    /// Any field name written in notation reads back as that one name.
+    #[test]
+    fn any_name_written_in_notation_reads_back(name in "\\PC{1,12}") {
+        let written = notation_name(&name);
+        proptest::prop_assert_eq!(notation_tokens(&written), vec![(0..written.len(), Notation::Name(name))]);
+    }
+
+    /// Renaming a field in a formula and back gives the formula as it was.
+    #[test]
+    fn a_rename_round_trips(old in "\\PC{1,8}", new in "\\PC{1,8}", others in proptest::collection::vec("\\PC{1,8}", 0..4), sum in proptest::bool::ANY) {
+        proptest::prop_assume!(old != new && !others.contains(&new) && ![&old, &new].into_iter().chain(&others).any(|n| n.contains("VCALC")));
+        let names: Vec<String> = std::iter::once(old.clone()).chain(others).collect();
+        let js = if sum {
+            calculate_js(&Calculate::Simple { op: CalcOp::Sum, fields: names }).unwrap()
+        } else {
+            calculate_js(&Calculate::Notation(names.iter().map(|n| notation_name(n)).collect::<Vec<_>>().join(" * "))).unwrap()
+        };
+        let renamed = rename_in_calculation(&js, &old, &new);
+        proptest::prop_assert!(renamed.is_some(), "{js}");
+        let back = renamed.as_deref().and_then(|r| rename_in_calculation(r, &new, &old));
+        proptest::prop_assert_eq!(back, Some(js));
+    }
+
+    /// What a formula reads is the same whether it is read from the tab's settings or from
+    /// the script they are written as.
+    #[test]
+    fn a_formula_reads_the_same_fields_as_its_script(names in proptest::collection::vec("\\PC{1,8}", 1..5), sum in proptest::bool::ANY) {
+        proptest::prop_assume!(!names.iter().any(|n| n.contains("VCALC")));
+        let c = if sum {
+            Calculate::Simple { op: CalcOp::Product, fields: names.clone() }
+        } else {
+            Calculate::Notation(names.iter().map(|n| notation_name(n)).collect::<Vec<_>>().join(" + "))
+        };
+        let js = calculate_js(&c).unwrap();
+        proptest::prop_assert_eq!(calculation_reads(&js), c.reads());
+        proptest::prop_assert_eq!(c.reads(), unique(names));
+    }
+}
+
+#[test]
+fn a_calculation_reads_each_named_field_once() {
+    assert_eq!(Calculate::Simple { op: CalcOp::Sum, fields: vec!["a".into(), "b".into(), "a".into()] }.reads(), ["a", "b"]);
+    assert_eq!(Calculate::Notation("(Unit\\ Price + 2) * qty / qty".into()).reads(), ["Unit Price", "qty"]);
+    assert_eq!(Calculate::None.reads(), Vec::<String>::new());
+    let script = "var t = getField(\"sub\").value; // getField(\"x\")\nevent.value = t + getField(\"tax\").value + getField(\"row\" + 1).value;";
+    assert_eq!(calculation_reads(script), ["sub", "tax"], "names built at run time aren't known");
+    assert_eq!(calculation_reads("AFSimple_Calculate(\"SUM\", \"a, b\");"), ["a", "b"]);
+}
+
+#[test]
+fn numbers_format_like_acrobat() {
+    let n = |d, s, ng, c: &str, p| Format::Number { decimals: d, sep: s, neg: ng, currency: c.into(), prepend: p };
+    assert_eq!(format_value(&n(2, 0, 0, "$", true), "1234.5"), "$1,234.50");
+    assert_eq!(format_value(&n(0, 1, 0, "", true), "1234567"), "1234567");
+    assert_eq!(format_value(&n(2, 2, 0, " €", false), "1234.5"), "1.234,50 €");
+    assert_eq!(format_value(&n(2, 0, 2, "", true), "-12"), "(12.00)");
+    assert_eq!(format_value(&n(1, 0, 0, "", true), "-0.25"), "-0.3");
+    assert_eq!(format_value(&Format::Percent { decimals: 1, sep: 0 }, "0.125"), "12.5%");
+    assert_eq!(make_number("$1,234.50"), Some(1234.5));
+    assert_eq!(make_number("1.234,5"), Some(1234.5));
+    assert_eq!(make_number("(7)"), Some(-7.0));
+    assert_eq!(make_number("abc"), None);
+    assert_eq!(keystroke(&n(2, 0, 0, "$", true), "Total", "$1,000"), Ok("1000".into()));
+    assert_eq!(keystroke(&n(2, 0, 0, "$", true), "Total", "ten"), Err("The value entered does not match the format of the field [ Total ]".into()));
+    // Blank input clears a formatted field (#1323); without a format it is text like any other.
+    assert_eq!(keystroke(&n(2, 0, 0, "$", true), "Total", " \t"), Ok(String::new()));
+    assert_eq!(keystroke(&Format::None, "Name", " \t"), Ok(" \t".into()));
+}
+
+#[test]
+fn dates_times_and_masks() {
+    let d = Format::Date("mm/dd/yyyy".into());
+    assert_eq!(format_value(&d, "1/2/24"), "01/02/2024");
+    assert_eq!(format_value(&Format::Date("mmmm d, yyyy".into()), "10/1/2026"), "October 1, 2026");
+    assert_eq!(format_value(&Format::Date("dddd, mmm d, yyyy".into()), "10/1/2026"), "Thursday, Oct 1, 2026");
+    assert_eq!(format_value(&Format::Date("dd-mmm-yy".into()), "5-Mar-21"), "05-Mar-21", "month names are read");
+    assert!(keystroke(&d, "Due", "2/30/2024").is_err(), "no 30 February");
+    assert!(keystroke(&d, "Due", "13/1/2024").is_err());
+    // Literal digits in the format (a leave form fixing the year as "dd.mm.26").
+    let fixed = Format::Date("dd.mm.26".into());
+    assert_eq!(keystroke(&fixed, "Von", "15.05.26"), Ok("15.05.26".into()));
+    assert_eq!(format_value(&fixed, "15.05.26"), "15.05.26");
+    assert_eq!(format_value(&fixed, "3.1"), "03.01.26", "the literal may be left out");
+    assert!(keystroke(&fixed, "Von", "15.05.27").is_err(), "a different number there is not the literal");
+    assert!(keystroke(&fixed, "Von", "32.05.26").is_err());
+    assert_eq!(format_value(&Format::Time("h:MM tt".into()), "14:05"), "2:05 pm");
+    assert_eq!(format_value(&Format::Time("HH:MM".into()), "2:05 pm"), "14:05");
+    assert_eq!(format_value(&Format::Special(2), "5551234567"), "(555) 123-4567");
+    assert_eq!(format_value(&Format::Special(3), "123-45-6789"), "123-45-6789");
+    assert!(keystroke(&Format::Special(0), "Zip", "1234").is_err());
+    assert_eq!(format_value(&Format::Mask("AA-9999".into()), "ab1234"), "ab-1234");
+    assert!(keystroke(&Format::Mask("AA-9999".into()), "Code", "a11234").is_err());
+}
+
+#[test]
+fn validation_and_calculation() {
+    let r = Validate::Range { min: Some(0.0), max: Some(100.0) };
+    assert!(validate(&r, "50").is_ok() && validate(&r, "").is_ok());
+    assert_eq!(validate(&r, "120"), Err("Invalid value: must be greater than or equal to 0 and less than or equal to 100.".into()));
+    let vals = |name: &str| -> Vec<String> {
+        match name {
+            "a" => vec!["2".into()],
+            "b" => vec!["$3.50".into()],
+            "row" => vec!["1".into(), "2".into(), "3".into()],
+            "Unit Price" => vec!["4".into()],
+            _ => vec![],
+        }
+    };
+    let simple = |op, f: &[&str]| calculate(&Calculate::Simple { op, fields: f.iter().map(|s| s.to_string()).collect() }, &vals);
+    assert_eq!(simple(CalcOp::Sum, &["a", "b"]), Some("5.5".into()));
+    assert_eq!(simple(CalcOp::Product, &["a", "b"]), Some("7".into()));
+    assert_eq!(simple(CalcOp::Average, &["row"]), Some("2".into()), "groups count every child");
+    assert_eq!(simple(CalcOp::Maximum, &["a", "row"]), Some("3".into()));
+    assert_eq!(simple(CalcOp::Sum, &["missing"]), Some("0".into()));
+    assert_eq!(calculate(&Calculate::Notation("(a + b) * 2 - Unit\\ Price / 4".into()), &vals), Some("10".into()));
+    assert_eq!(calculate(&Calculate::Notation("a +".into()), &vals), None);
+}
diff --git a/crates/forms/src/appearance.rs b/crates/forms/src/appearance.rs
index da25c211c0..c1bb5630a6 100644
--- a/crates/forms/src/appearance.rs
+++ b/crates/forms/src/appearance.rs
@@ -480,7 +480,7 @@ fn frame(doc: &Document, wd: &Dict, w: f64, h: f64) -> (String, f64) {
 
 /// Whether `wd` is a check box or radio button PdfCraft laid out for a round XFA check button
 /// (`/PCXfaRound true`, written by the XFA layout).
-fn is_round(doc: &Document, wd: &Dict) -> bool {
+pub(crate) fn is_round(doc: &Document, wd: &Dict) -> bool {
     matches!(wd.get(b"PCXfaRound").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true)))
 }
 
@@ -1029,9 +1029,10 @@ fn check_mark(style: crate::author::CheckStyle, cx: f64, cy: f64, s: f64, color:
 }
 
 /// How a check box or radio button widget `w` of field `f` looks in state on (`on`) or Off when
-/// the file has no appearance for that state: its `/MK` background and border ([`frame`]), and
-/// when on, its caption `/MK /CA` (ISO 32000-2 Table 192: the normal caption, which check boxes
-/// and radio buttons may use too) as a ZapfDingbats character, as in the check box example of
+/// the file has no appearance for that state, or leaves its appearances to the viewer
+/// (`/NeedAppearances`): its `/MK` background and border ([`frame`]), and when on, its caption
+/// `/MK /CA` (ISO 32000-2 Table 192: the normal caption, which check boxes and radio buttons may
+/// use too) as a ZapfDingbats character, as in the check box example of
 /// 12.7.5.2.3: `4` (a check mark) by default, `l` (a dot) for a radio button. The character is
 /// drawn in the `/DA` colour, at the `/DA` size or, for an automatic size (`0 Tf`), filling most
 /// of the box. ZapfDingbats is one of the standard 14 fonts, so no font program is needed.
diff --git a/crates/forms/src/appearances.rs b/crates/forms/src/appearances.rs
new file mode 100644
index 0000000000..d035feb4ef
--- /dev/null
+++ b/crates/forms/src/appearances.rs
@@ -0,0 +1,237 @@
+use super::read::{acroform, fields};
+use super::values::merged_appearance;
+use super::*;
+
+/// Whether the form asks viewers to draw its fields' appearances themselves (`/NeedAppearances`).
+pub fn need_appearances(doc: &Document) -> bool {
+    acroform(doc).is_some_and(|af| matches!(af.get(b"NeedAppearances").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true))))
+}
+
+/// A copy of `doc` in which form fields are drawn the way the file leaves to the viewer, for
+/// displaying the document (`None` when no widget needs it). Text and choice fields are drawn from
+/// their values: every one when the form sets `/NeedAppearances` (ISO 32000-2 Table 224: the
+/// writer left the appearances to the viewer), and otherwise each widget without a normal
+/// appearance (`/AP /N`), as typing the value would draw it (#3470). Check boxes and radio buttons
+/// with no normal appearance for their state (`/AS`) are drawn from their `/MK` background, border
+/// and caption, and with `/NeedAppearances` every one that has an `/MK` is, over its own
+/// appearance; push buttons with none are drawn from their `/MK` and `/BS` (Table 192). `doc` is
+/// not changed: saving writes the file as it was.
+pub fn with_field_appearances(doc: &Document) -> Option<Document> {
+    with_field_appearances_cached(doc, &mut FieldAppearanceCache::default())
+}
+
+/// [`with_field_appearances`], reusing the appearances `cache` drew for widgets whose inputs are
+/// the same objects as then (see [`FieldAppearanceCache`]).
+pub fn with_field_appearances_cached(doc: &Document, cache: &mut FieldAppearanceCache) -> Option<Document> {
+    let all = need_appearances(doc);
+    let mut copy: Option<Document> = None;
+    for f in fields(doc) {
+        for w in &f.widgets {
+            let widget = doc.get(w.obj);
+            let normal = widget
+                .as_dict()
+                .and_then(|d| d.get(b"AP"))
+                .and_then(|ap| doc.resolve(ap).as_dict().and_then(|ap| ap.get(b"N").map(|n| doc.resolve(n))));
+            // A check box or radio button shows the appearance of its state (12.7.5.2.3): `/AS`,
+            // else the value when it names this widget's on state (any check box value when the
+            // widget names none), else Off. An Off state may go without one (it shows nothing);
+            // an on state needs one.
+            let state = match f.kind {
+                FieldKind::CheckBox | FieldKind::Radio => {
+                    let mine = |v: &&String| w.on_state.as_ref().map_or(f.kind == FieldKind::CheckBox, |on| on == *v);
+                    let value = f.value.first().filter(|v| !v.is_empty() && v.as_str() != "Off").filter(mine);
+                    Some(w.state.clone().or_else(|| value.cloned()).unwrap_or_else(|| "Off".into()))
+                }
+                _ => None,
+            };
+            // With /NeedAppearances a check box or radio button that describes its look in /MK is
+            // drawn from it (Table 192), its own appearance or not; one without /MK keeps its own.
+            let described = || widget.as_dict().and_then(|d| d.get(b"MK")).is_some_and(|mk| doc.resolve(mk).as_dict().is_some());
+            let missing = match f.kind {
+                FieldKind::Text | FieldKind::Combo | FieldKind::List => normal.is_none() || all,
+                FieldKind::PushButton => normal.is_none(),
+                FieldKind::CheckBox | FieldKind::Radio => match (normal.as_deref(), state.as_deref()) {
+                    _ if all && described() => true,
+                    (None, _) => true,
+                    (Some(Object::Dict(states)), Some(s)) => s != "Off" && !states.contains(&name_bytes(s)),
+                    _ => false,
+                },
+                FieldKind::Signature => false,
+            };
+            if !missing {
+                continue;
+            }
+            let inputs = appearance_inputs(doc, w);
+            let stream = match cache.get(w.obj, &inputs) {
+                Some(stream) => stream,
+                None => {
+                    let stream = match f.kind {
+                        FieldKind::CheckBox | FieldKind::Radio => appearance::button_state_shown(doc, &f, w, state.as_deref() != Some("Off")),
+                        FieldKind::PushButton => appearance::push_button_shown(doc, &f, w),
+                        _ => appearance::field_appearance_drawn(doc, &f, w, &f.value, true).0,
+                    };
+                    cache.insert(w.obj, inputs, &stream);
+                    stream
+                }
+            };
+            let target = copy.get_or_insert_with(|| doc.clone());
+            let ap = target.add(Object::Stream(stream));
+            let mut fresh = Dict::new();
+            match &state {
+                // The drawn look under its state's name, and that state as the widget's own.
+                Some(s) => {
+                    let mut states = Dict::new();
+                    states.set(name_bytes(s), Object::Ref(ap));
+                    fresh.set(b"N".to_vec(), Object::Dict(states));
+                }
+                None => fresh.set(b"N".to_vec(), Object::Ref(ap)),
+            }
+            let apd = merged_appearance(target, w.obj, &fresh);
+            // Fails only when the widget isn't a dictionary; that widget then keeps its own look.
+            target
+                .update_dict(w.obj, |d| {
+                    d.set(b"AP".to_vec(), Object::Dict(apd));
+                    if let Some(s) = &state {
+                        d.set(b"AS".to_vec(), Object::Name(name_bytes(s)));
+                    }
+                })
+                .ok();
+        }
+    }
+    copy
+}
+
+/// The objects a widget's drawn appearance is built from, as the document holds them: the widget
+/// and the fields above it (value, `/DA`, `/Q`, flags, options, `/MK`, formatting actions), the
+/// form dictionary (`/DA`) and the fonts of its `/DR`, each with the objects its entries refer to
+/// (an indirect `/MK` or `/V`). Not the page: a field's rotation is its own `/MK /R`.
+fn appearance_inputs(doc: &Document, w: &Widget) -> Vec<std::sync::Arc<Object>> {
+    // The objects a dictionary's entries refer to. The tree links and the drawn appearance itself
+    // are not inputs, and `/Kids` and `/Fields` can be long.
+    let referred = |d: &Dict, inputs: &mut Vec<std::sync::Arc<Object>>| {
+        for (k, v) in d.iter() {
+            if !matches!(&k[..], b"Kids" | b"Fields" | b"P" | b"Parent" | b"AP")
+                && let Some(r) = v.as_ref()
+            {
+                inputs.push(doc.get(r));
+            }
+        }
+    };
+    let mut inputs = Vec::new();
+    let mut seen = std::collections::HashSet::new();
+    let mut node = Some(w.obj);
+    // The /Parent chain; the seen-set and the cap end a cycle or an absurd depth.
+    while let Some(r) = node.filter(|r| seen.insert(*r) && seen.len() <= 64) {
+        let obj = doc.get(r);
+        if let Some(d) = obj.as_dict() {
+            node = d.reference(b"Parent");
+            referred(d, &mut inputs);
+        } else {
+            node = None;
+        }
+        inputs.push(obj);
+    }
+    let Some(root) = doc.root() else { return inputs };
+    let catalog = doc.get(root);
+    let form = match catalog.as_dict().and_then(|c| c.reference(b"AcroForm")) {
+        Some(r) => doc.get(r),
+        None => catalog,
+    };
+    if let Some(f) = form.as_dict() {
+        referred(f, &mut inputs);
+        // The fonts of /DR. An indirect /DR or /Font is listed through the entries that refer to
+        // it; a direct one is part of the object that holds it. `held` only finds them: a copy
+        // of a direct object is a new one each time, never an input.
+        let held = |o: &Object| o.as_ref().map_or_else(|| std::sync::Arc::new(o.clone()), |r| doc.get(r));
+        if let Some(dr) = f.get(b"DR").map(held)
+            && let Some(dr) = dr.as_dict()
+        {
+            referred(dr, &mut inputs);
+            if let Some(font) = dr.get(b"Font").map(held)
+                && let Some(fonts) = font.as_dict()
+            {
+                referred(fonts, &mut inputs);
+            }
+        }
+    }
+    inputs.push(form);
+    inputs
+}
+
+/// Field appearances drawn for the display copy ([`with_field_appearances_cached`]), so a refresh
+/// redraws only the widgets whose inputs changed: a form that leaves every appearance to the
+/// viewer otherwise redrew all of its fields on each keystroke in any one of them (#3470). An
+/// entry holds the input objects it was drawn from and is used only while each is still the same
+/// object (`Arc::ptr_eq`); the document replaces an object it edits, so a changed input is a
+/// miss, never a stale hit.
+#[derive(Clone, Debug, Default)]
+pub struct FieldAppearanceCache {
+    entries: std::collections::HashMap<ObjRef, (Vec<std::sync::Arc<Object>>, pdfcraft_cos::Stream)>,
+    bytes: usize,
+    hits: u64,
+    builds: u64,
+}
+
+impl FieldAppearanceCache {
+    /// Cached appearance data restarts past this instead of growing without bound.
+    const MAX_BYTES: usize = 64 << 20;
+
+    /// Forget every entry.
+    pub fn clear(&mut self) {
+        *self = Self::default();
+    }
+
+    fn get(&mut self, w: ObjRef, inputs: &[std::sync::Arc<Object>]) -> Option<pdfcraft_cos::Stream> {
+        let (from, stream) = self.entries.get(&w)?;
+        if from.len() != inputs.len() || !from.iter().zip(inputs).all(|(a, b)| std::sync::Arc::ptr_eq(a, b)) {
+            return None;
+        }
+        self.hits += 1;
+        Some(stream.clone())
+    }
+
+    fn insert(&mut self, w: ObjRef, inputs: Vec<std::sync::Arc<Object>>, stream: &pdfcraft_cos::Stream) {
+        self.builds += 1;
+        if self.bytes.saturating_add(stream.raw.len()) > Self::MAX_BYTES {
+            self.clear();
+        }
+        self.bytes = self.bytes.saturating_add(stream.raw.len());
+        if let Some((_, old)) = self.entries.insert(w, (inputs, stream.clone())) {
+            self.bytes = self.bytes.saturating_sub(old.raw.len());
+        }
+    }
+
+    /// Cache hits so far (reused appearances); for tests.
+    pub fn hits(&self) -> u64 {
+        self.hits
+    }
+
+    /// Appearances drawn so far; for tests.
+    pub fn builds(&self) -> u64 {
+        self.builds
+    }
+}
+
+/// Whether the document's XMP metadata declares PDF/A conformance (`pdfaid:part`).
+pub fn declares_pdfa(doc: &Document) -> bool {
+    let Some(root) = doc.root() else { return false };
+    let Some(m) = doc.get(root).as_dict().and_then(|c| c.get(b"Metadata").cloned()) else { return false };
+    let m = doc.resolve(&m);
+    match &*m {
+        Object::Stream(s) => s.decoded().is_ok_and(|b| b.windows(11).any(|w| w == b"pdfaid:part")),
+        _ => false,
+    }
+}
+
+/// Every field with a widget whose appearance PdfCraft drew with `?` for a character its font
+/// can't hold (`pdfcraft_fonts::UNDRAWN_MARK`): the field's name and that character, once per
+/// field.
+pub fn undrawn_fields(doc: &Document) -> Vec<(String, char)> {
+    fields(doc)
+        .into_iter()
+        .filter_map(|f| {
+            let c = f.widgets.iter().find_map(|w| doc.get(w.obj).as_dict().and_then(pdfcraft_fonts::undrawn_mark))?;
+            Some((f.name, c))
+        })
+        .collect()
+}
diff --git a/crates/forms/src/author.rs b/crates/forms/src/author.rs
index 873ef3d716..ce89fad806 100644
--- a/crates/forms/src/author.rs
+++ b/crates/forms/src/author.rs
@@ -10,6 +10,17 @@ use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 
 use crate::{Field, FieldKind, FormError, Widget, appearance, fields, flags, page_refs};
 
+mod edit;
+mod lifecycle;
+mod look;
+mod tree;
+
+pub use edit::set_props;
+pub use lifecycle::{add_field, delete_field, delete_field_object, duplicate_field};
+pub(crate) use look::button_appearance;
+pub use look::{BorderStyle, CheckStyle, FieldFont, Look, LookPatch, check_style, look, redraw_field, set_button_icon};
+pub(crate) use tree::{ensure_form, form_fonts_as_objects};
+
 /// The smallest width and height of a field's widget, in points: a smaller one is refused.
 pub const MIN_FIELD_SIDE: f64 = 4.0;
 
@@ -113,1598 +124,3 @@ fn invalid<T>(m: impl Into<String>) -> Result<T, FormError> {
 fn rgb(c: [f64; 3]) -> Object {
     Object::Array(c.iter().map(|v| Object::Real(*v)).collect())
 }
-
-/// The AcroForm dictionary's reference, creating the form (with `/Helv` in `/DR`) if needed.
-pub(crate) fn ensure_form(doc: &mut Document) -> Result<ObjRef, FormError> {
-    let root = doc.root().ok_or(FormError::NoForm)?;
-    let existing = doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").cloned());
-    let r = match existing {
-        Some(Object::Ref(r)) if doc.get(r).as_dict().is_some() => r,
-        other => {
-            let d = other.and_then(|o| o.as_dict().cloned()).unwrap_or_default();
-            let r = doc.add(Object::Dict(d));
-            doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Ref(r)))?;
-            r
-        }
-    };
-    let mut af = doc.get(r).as_dict().cloned().unwrap_or_default();
-    if !af.contains(b"Fields") {
-        af.set(b"Fields".to_vec(), Object::Array(Vec::new()));
-    }
-    if !af.contains(b"DA") {
-        af.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
-    }
-    let (dr, mut fonts) = form_fonts(doc, &af);
-    let mut added = inline_fonts_as_objects(doc, &mut fonts);
-    // Acrobat's resource names for the standard fonts its Appearance tab offers.
-    for (name, base) in [("Helv", "Helvetica"), ("TiRo", "Times-Roman"), ("Cour", "Courier")] {
-        if fonts.contains(name.as_bytes()) {
-            continue;
-        }
-        let mut f = Dict::new();
-        f.set(b"Type".to_vec(), Object::name("Font"));
-        f.set(b"Subtype".to_vec(), Object::name("Type1"));
-        f.set(b"BaseFont".to_vec(), Object::name(base));
-        f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-        let r = doc.add(Object::Dict(f));
-        fonts.set(name.as_bytes().to_vec(), Object::Ref(r));
-        added = true;
-    }
-    if added {
-        store_form_fonts(doc, &mut af, dr, fonts);
-    }
-    doc.set(r, Object::Dict(af));
-    Ok(r)
-}
-
-/// The form dictionary's `/DR` and its `/Font` dictionary, resolved (empty where missing).
-fn form_fonts(doc: &Document, af: &Dict) -> (Dict, Dict) {
-    let dr = af.get(b"DR").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
-    let fonts = dr.get(b"Font").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
-    (dr, fonts)
-}
-
-/// Each /DR font its own object: Acrobat, redrawing a text field after it is typed in, shows
-/// nothing when the font is a dictionary written inline in /DR (#3441). Fonts written inline
-/// (by an earlier save, or another writer) become objects saying the same; a font that is an
-/// object already, or an entry that isn't a dictionary, is left alone. Whether any changed.
-fn inline_fonts_as_objects(doc: &mut Document, fonts: &mut Dict) -> bool {
-    let inline: Vec<(Vec<u8>, Dict)> = fonts.iter().filter_map(|(k, v)| Some((k.clone(), v.as_dict()?.clone()))).collect();
-    let changed = !inline.is_empty();
-    for (name, font) in inline {
-        let r = doc.add(Object::Dict(font));
-        fonts.set(name, Object::Ref(r));
-    }
-    changed
-}
-
-/// Write `fonts` back as the `/DR /Font` of the form dictionary `af`. An indirect `/DR` or
-/// `/Font` stays the object it is.
-fn store_form_fonts(doc: &mut Document, af: &mut Dict, mut dr: Dict, fonts: Dict) {
-    match dr.get(b"Font").and_then(Object::as_ref) {
-        Some(fr) => doc.set(fr, Object::Dict(fonts)),
-        None => dr.set(b"Font".to_vec(), Object::Dict(fonts)),
-    }
-    match af.get(b"DR").and_then(Object::as_ref) {
-        Some(dr_ref) => doc.set(dr_ref, Object::Dict(dr)),
-        None => af.set(b"DR".to_vec(), Object::Dict(dr)),
-    }
-}
-
-/// Filling a field: the form's inline `/DR` fonts become objects (see
-/// [`inline_fonts_as_objects`]), so a form an earlier version of PdfCraft made works in Acrobat
-/// once it has been filled here too (#3441). Only the font storage changes; nothing is added.
-/// Not in a form a signature covers: there the file stays as the signer saw it, apart from the
-/// value itself.
-pub(crate) fn form_fonts_as_objects(doc: &mut Document, all: &[crate::Field]) -> Result<(), FormError> {
-    let signed = all.iter().any(|f| f.kind == crate::FieldKind::Signature && holds_value(doc, f.obj));
-    if signed {
-        return Ok(());
-    }
-    let Some(root) = doc.root() else { return Ok(()) };
-    let Some(entry) = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").cloned()) else { return Ok(()) };
-    match entry {
-        Object::Ref(r) => {
-            let Some(mut af) = doc.get(r).as_dict().cloned() else { return Ok(()) };
-            let (dr, mut fonts) = form_fonts(doc, &af);
-            if inline_fonts_as_objects(doc, &mut fonts) {
-                store_form_fonts(doc, &mut af, dr, fonts);
-                doc.set(r, Object::Dict(af));
-            }
-        }
-        // A form dictionary written directly in the catalog (the catalog's /AcroForm need not be
-        // an indirect reference) is written back there.
-        Object::Dict(mut af) => {
-            let (dr, mut fonts) = form_fonts(doc, &af);
-            if inline_fonts_as_objects(doc, &mut fonts) {
-                store_form_fonts(doc, &mut af, dr, fonts);
-                doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(af)))?;
-            }
-        }
-        _ => {}
-    }
-    Ok(())
-}
-
-/// Whether the field `r`, or the nearest ancestor that has one, holds a `/V` (the entry is
-/// inheritable, ISO 32000-2 §12.7.4). The `/Parent` chain is followed at most 64 deep, as deep
-/// as the field walk goes, so a cyclic chain ends.
-fn holds_value(doc: &Document, r: ObjRef) -> bool {
-    let mut at = r;
-    for _ in 0..=64 {
-        let obj = doc.get(at);
-        let Some(d) = obj.as_dict() else { return false };
-        if d.contains(b"V") {
-            return true;
-        }
-        match d.reference(b"Parent") {
-            Some(p) => at = p,
-            None => return false,
-        }
-    }
-    false
-}
-
-/// The Appearance tab: borders, colours and text.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct Look {
-    pub border: Option<[f64; 3]>,
-    pub fill: Option<[f64; 3]>,
-    /// Line thickness in points (Acrobat: thin 1, medium 2, thick 3).
-    pub width: f64,
-    pub style: BorderStyle,
-    pub text: [f64; 3],
-    pub font: FieldFont,
-}
-
-/// A partial Appearance-tab edit. Outer `None` keeps a property; `Some(None)` removes a
-/// border or fill colour. The patch is applied to each widget's own dictionaries.
-#[derive(Clone, Copy, Debug, Default, PartialEq)]
-pub struct LookPatch {
-    pub border: Option<Option<[f64; 3]>>,
-    pub fill: Option<Option<[f64; 3]>>,
-    pub width: Option<f64>,
-    pub style: Option<BorderStyle>,
-    pub text: Option<[f64; 3]>,
-    pub font: Option<FieldFont>,
-}
-
-impl LookPatch {
-    fn validate(&self) -> Result<(), FormError> {
-        for c in self.border.flatten().into_iter().chain(self.fill.flatten()).chain(self.text) {
-            if !c.iter().all(|v| v.is_finite() && (0.0..=1.0).contains(v)) {
-                return invalid("appearance colours must be finite RGB values between 0 and 1");
-            }
-        }
-        if self.width.is_some_and(|v| !v.is_finite() || !(0.0..=12.0).contains(&v)) {
-            return invalid("border width must be between 0 and 12 points");
-        }
-        Ok(())
-    }
-}
-
-/// Rewrite only the selected operators in place: the last `Tf` (font and size) and the last
-/// fill colour (`g`, `rg` or `k`), appending one when the string has none. Everything else (a
-/// custom font resource, colour space or other graphics state) is kept, and repeated edits don't
-/// grow the string.
-fn patch_da(da: &str, size: Option<f64>, patch: &LookPatch) -> String {
-    if patch.font.is_none() && size.is_none() && patch.text.is_none() {
-        return da.to_string();
-    }
-    let mut toks: Vec<String> = da.split_whitespace().map(str::to_string).collect();
-    let numeric = |s: &str| s.parse::<f64>().is_ok();
-    if patch.font.is_some() || size.is_some() {
-        let old = appearance::parse_da(da);
-        let font = patch.font.map_or_else(|| old.font.clone(), |f| f.resource().to_string());
-        // `parse_da` reads sizes up to 300 points; keep the same bound when writing.
-        let size = appearance::fmt(size.unwrap_or(old.size).clamp(0.0, 300.0));
-        let at = toks.iter().enumerate().rev().find(|(i, t)| t.as_str() == "Tf" && *i >= 2).map(|(i, _)| i);
-        match at {
-            Some(i) => {
-                if let Some(slot) = toks.get_mut(i - 2) {
-                    *slot = format!("/{font}");
-                }
-                if let Some(slot) = toks.get_mut(i - 1) {
-                    *slot = size;
-                }
-            }
-            None => toks.extend([format!("/{font}"), size, "Tf".into()]),
-        }
-    }
-    if let Some(c) = patch.text {
-        let rgb = [appearance::fmt(c[0]), appearance::fmt(c[1]), appearance::fmt(c[2]), "rg".into()];
-        let at = toks.iter().enumerate().rev().find_map(|(i, t)| {
-            let n = match t.as_str() {
-                "g" => 1,
-                "rg" => 3,
-                "k" => 4,
-                _ => return None,
-            };
-            let start = i.checked_sub(n)?;
-            toks.get(start..i).is_some_and(|ops| ops.iter().all(|o| numeric(o))).then_some((start, i))
-        });
-        match at {
-            Some((start, end)) => {
-                toks.splice(start..=end, rgb);
-            }
-            None => toks.extend(rgb),
-        }
-    }
-    toks.join(" ")
-}
-
-fn patch_widget_look(doc: &mut Document, w: &Widget, patch: &LookPatch) -> Result<(), FormError> {
-    let touches_mk = patch.border.is_some() || patch.fill.is_some();
-    let touches_bs = patch.width.is_some() || patch.style.is_some();
-    // A size- or font-only edit changes /DA, not the widget: leave it out of the save.
-    if !touches_mk && !touches_bs {
-        return Ok(());
-    }
-    let wd = doc.get(w.obj).as_dict().cloned().ok_or_else(|| FormError::Invalid("the widget is not a dictionary".into()))?;
-    if touches_mk {
-        let indirect = wd.get(b"MK").and_then(Object::as_ref);
-        let mut mk = wd.get(b"MK").map(|m| doc.resolve(m)).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
-        for (key, change) in [(b"BC".as_slice(), patch.border), (b"BG".as_slice(), patch.fill)] {
-            if let Some(change) = change {
-                match change {
-                    Some(c) => mk.set(key.to_vec(), rgb(c)),
-                    None => {
-                        mk.remove(key);
-                    }
-                }
-            }
-        }
-        // A shared indirect /MK is updated where it lives, not copied into each widget.
-        match indirect {
-            Some(r) => doc.set(r, Object::Dict(mk)),
-            None => doc.update_dict(w.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?,
-        }
-    }
-    if touches_bs {
-        let indirect = wd.get(b"BS").and_then(Object::as_ref);
-        let mut bs = wd.get(b"BS").map(|b| doc.resolve(b)).and_then(|b| b.as_dict().cloned()).unwrap_or_default();
-        if let Some(width) = patch.width {
-            bs.set(b"W".to_vec(), Object::Real(width));
-        }
-        if let Some(style) = patch.style {
-            bs.set(b"S".to_vec(), Object::name(style.code()));
-            if style == BorderStyle::Dashed && !bs.contains(b"D") {
-                bs.set(b"D".to_vec(), Object::Array(vec![Object::Int(3)]));
-            }
-        }
-        match indirect {
-            Some(r) => doc.set(r, Object::Dict(bs)),
-            None => doc.update_dict(w.obj, |d| d.set(b"BS".to_vec(), Object::Dict(bs)))?,
-        }
-    }
-    Ok(())
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum BorderStyle {
-    Solid,
-    Dashed,
-    Beveled,
-    Inset,
-    Underline,
-}
-
-impl BorderStyle {
-    pub const ALL: [BorderStyle; 5] = [BorderStyle::Solid, BorderStyle::Dashed, BorderStyle::Beveled, BorderStyle::Inset, BorderStyle::Underline];
-
-    fn code(self) -> &'static str {
-        match self {
-            BorderStyle::Solid => "S",
-            BorderStyle::Dashed => "D",
-            BorderStyle::Beveled => "B",
-            BorderStyle::Inset => "I",
-            BorderStyle::Underline => "U",
-        }
-    }
-
-    pub fn label(self) -> &'static str {
-        match self {
-            BorderStyle::Solid => "Solid",
-            BorderStyle::Dashed => "Dashed",
-            BorderStyle::Beveled => "Beveled",
-            BorderStyle::Inset => "Inset",
-            BorderStyle::Underline => "Underline",
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum FieldFont {
-    Helvetica,
-    Times,
-    Courier,
-}
-
-impl FieldFont {
-    pub const ALL: [FieldFont; 3] = [FieldFont::Helvetica, FieldFont::Times, FieldFont::Courier];
-
-    fn resource(self) -> &'static str {
-        match self {
-            FieldFont::Helvetica => "Helv",
-            FieldFont::Times => "TiRo",
-            FieldFont::Courier => "Cour",
-        }
-    }
-
-    pub fn label(self) -> &'static str {
-        match self {
-            FieldFont::Helvetica => "Helvetica",
-            FieldFont::Times => "Times Roman",
-            FieldFont::Courier => "Courier",
-        }
-    }
-}
-
-/// The mark a check box or radio button shows when on (Field Properties ▸ Options ▸ style).
-/// Stored as `/MK /CA`, the ZapfDingbats character Acrobat uses for it; PdfCraft draws the
-/// mark as paths, so no symbol font is needed.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum CheckStyle {
-    Check,
-    Circle,
-    Cross,
-    Diamond,
-    Square,
-    Star,
-}
-
-impl CheckStyle {
-    pub const ALL: [CheckStyle; 6] =
-        [CheckStyle::Check, CheckStyle::Circle, CheckStyle::Cross, CheckStyle::Diamond, CheckStyle::Square, CheckStyle::Star];
-
-    fn code(self) -> &'static str {
-        match self {
-            CheckStyle::Check => "4",
-            CheckStyle::Circle => "l",
-            CheckStyle::Cross => "8",
-            CheckStyle::Diamond => "u",
-            CheckStyle::Square => "n",
-            CheckStyle::Star => "H",
-        }
-    }
-
-    pub fn label(self) -> &'static str {
-        match self {
-            CheckStyle::Check => "Check",
-            CheckStyle::Circle => "Circle",
-            CheckStyle::Cross => "Cross",
-            CheckStyle::Diamond => "Diamond",
-            CheckStyle::Square => "Square",
-            CheckStyle::Star => "Star",
-        }
-    }
-
-    /// A widget's style: its `/MK /CA`, else a check for check boxes and a circle for radios.
-    pub(crate) fn of_widget(doc: &Document, wd: &Dict, kind: FieldKind) -> Self {
-        let mk = wd.get(b"MK").and_then(|m| doc.resolve(m).as_dict().cloned()).unwrap_or_default();
-        let ca = mk.get(b"CA").and_then(|c| doc.resolve(c).as_string().map(|s| s.to_text()));
-        CheckStyle::ALL.into_iter().find(|s| ca.as_deref() == Some(s.code())).unwrap_or(if kind == FieldKind::Radio {
-            CheckStyle::Circle
-        } else {
-            CheckStyle::Check
-        })
-    }
-}
-
-/// A check box's or radio button's style (from its first widget).
-pub fn check_style(doc: &Document, f: &Field) -> CheckStyle {
-    let wd = f.widgets.first().and_then(|w| doc.get(w.obj).as_dict().cloned()).unwrap_or_default();
-    CheckStyle::of_widget(doc, &wd, f.kind)
-}
-
-fn rgb_of(doc: &Document, o: Option<&Object>) -> Option<[f64; 3]> {
-    let v: Vec<f64> = doc.resolve(o?).as_array()?.iter().filter_map(Object::as_f64).collect();
-    match v.len() {
-        1 => Some([v[0]; 3]),
-        3 => Some([v[0], v[1], v[2]]),
-        4 => Some([(1.0 - v[0]) * (1.0 - v[3]), (1.0 - v[1]) * (1.0 - v[3]), (1.0 - v[2]) * (1.0 - v[3])]),
-        _ => None,
-    }
-}
-
-/// A field's current look (from its first widget and its default appearance).
-pub fn look(doc: &Document, f: &Field) -> Look {
-    let wd = f.widgets.first().and_then(|w| doc.get(w.obj).as_dict().cloned()).unwrap_or_default();
-    let mk = wd.get(b"MK").and_then(|m| doc.resolve(m).as_dict().cloned()).unwrap_or_default();
-    let bs = wd.get(b"BS").and_then(|b| doc.resolve(b).as_dict().cloned()).unwrap_or_default();
-    let da = wd.get(b"DA").and_then(|o| doc.resolve(o).as_string().map(|s| s.to_text())).unwrap_or_else(|| f.da.clone());
-    let parsed = appearance::parse_da(&da);
-    let nums: Vec<f64> = parsed.color.split_whitespace().filter_map(|t| t.parse().ok()).collect();
-    let text = match nums.len() {
-        1 => [nums[0]; 3],
-        3 => [nums[0], nums[1], nums[2]],
-        4 => [(1.0 - nums[0]) * (1.0 - nums[3]), (1.0 - nums[1]) * (1.0 - nums[3]), (1.0 - nums[2]) * (1.0 - nums[3])],
-        _ => [0.0; 3],
-    };
-    Look {
-        border: rgb_of(doc, mk.get(b"BC")),
-        fill: rgb_of(doc, mk.get(b"BG")),
-        width: bs.get(b"W").and_then(|w| doc.resolve(w).as_f64()).unwrap_or(1.0),
-        style: match bs.name(b"S") {
-            Some(b"D") => BorderStyle::Dashed,
-            Some(b"B") => BorderStyle::Beveled,
-            Some(b"I") => BorderStyle::Inset,
-            Some(b"U") => BorderStyle::Underline,
-            _ => BorderStyle::Solid,
-        },
-        text,
-        font: match parsed.font.as_str() {
-            "TiRo" | "Times-Roman" => FieldFont::Times,
-            "Cour" | "Courier" => FieldFont::Courier,
-            _ => FieldFont::Helvetica,
-        },
-    }
-}
-
-/// A `/DA` string with the given font, size and colour.
-fn da_string(font: FieldFont, size: f64, c: [f64; 3]) -> String {
-    let f = crate::appearance::fmt;
-    format!("/{} {} Tf {} {} {} rg", font.resource(), f(size.clamp(0.0, 100.0)), f(c[0]), f(c[1]), f(c[2]))
-}
-
-fn add_to_page(doc: &mut Document, page: ObjRef, widget: ObjRef) -> Result<(), FormError> {
-    let existing = doc.get(page).as_dict().and_then(|d| d.get(b"Annots").cloned());
-    match existing.as_ref().and_then(|o| o.as_ref()).filter(|r| doc.get(*r).as_array().is_some()) {
-        Some(r) => {
-            let mut a = doc.get(r).as_array().cloned().unwrap_or_default();
-            a.push(Object::Ref(widget));
-            doc.set(r, Object::Array(a));
-        }
-        None => {
-            let mut a = existing.and_then(|o| o.as_array().cloned()).unwrap_or_default();
-            a.push(Object::Ref(widget));
-            doc.update_dict(page, |d| d.set(b"Annots".to_vec(), Object::Array(a)))?;
-        }
-    }
-    Ok(())
-}
-
-fn add_to_fields(doc: &mut Document, af: ObjRef, field: ObjRef) -> Result<(), FormError> {
-    let mut d = doc.get(af).as_dict().cloned().unwrap_or_default();
-    let mut list = d.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
-    list.push(Object::Ref(field));
-    d.set(b"Fields".to_vec(), Object::Array(list));
-    doc.set(af, Object::Dict(d));
-    Ok(())
-}
-
-/// The most parts a dotted field name may have ("a.b.c" has three).
-const MAX_NAME_PARTS: usize = 32;
-
-/// The field attributes a field inherits from its parents (ISO 32000-2 §12.7.4.1).
-const INHERITED_KEYS: [&[u8]; 7] = [b"FT", b"Ff", b"V", b"DV", b"DA", b"Q", b"MaxLen"];
-
-/// The parts of a full field name: `a.b` is the field `b` under the parent field `a`, since a
-/// field's own (partial) name can't contain a period (ISO 32000-2 §12.7.4.2) (#2696).
-fn name_parts(name: &str) -> Result<Vec<&str>, FormError> {
-    let parts: Vec<&str> = name.split('.').take(MAX_NAME_PARTS.saturating_add(1)).collect();
-    if parts.len() > MAX_NAME_PARTS {
-        return invalid(format!("field names can have at most {MAX_NAME_PARTS} parts"));
-    }
-    if parts.iter().any(|p| p.trim().is_empty()) {
-        return invalid("field names can't be empty, or have an empty part between periods");
-    }
-    Ok(parts)
-}
-
-/// Why the full name `name` can't be used beside the field named `other`, if it can't: the
-/// same name, or one inside the other (a field that has a value can't also hold fields).
-fn clash(name: &str, other: &str) -> Option<String> {
-    if name == other {
-        return Some(format!("a field named {name:?} already exists"));
-    }
-    let inside = |a: &str, b: &str| a.strip_prefix(b).is_some_and(|rest| rest.starts_with('.'));
-    (inside(name, other) || inside(other, name)).then(|| format!("{name:?} can't be used beside the field {other:?}"))
-}
-
-/// The array `key` of `holder` (`/Fields` of the form, `/Kids` of a field).
-fn list_of(doc: &Document, holder: ObjRef, key: &[u8]) -> Vec<Object> {
-    let d = doc.get(holder).as_dict().cloned().unwrap_or_default();
-    d.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default()
-}
-
-/// Add `field` to `parent`'s `/Kids`, or to the form's `/Fields` at the top.
-fn link(doc: &mut Document, af: ObjRef, parent: Option<ObjRef>, field: ObjRef) -> Result<(), FormError> {
-    let Some(p) = parent else { return add_to_fields(doc, af, field) };
-    let mut kids = list_of(doc, p, b"Kids");
-    kids.push(Object::Ref(field));
-    doc.update_dict(p, |d| d.set(b"Kids".to_vec(), Object::Array(kids)))?;
-    Ok(())
-}
-
-/// The node named `name` (its own `/T`) directly under `parent`, or at the top of the form.
-fn child_named(doc: &Document, af: ObjRef, parent: Option<ObjRef>, name: &str) -> Option<ObjRef> {
-    let list = match parent {
-        Some(p) => list_of(doc, p, b"Kids"),
-        None => list_of(doc, af, b"Fields"),
-    };
-    list.iter()
-        .filter_map(|o| o.as_ref())
-        .find(|r| doc.get(*r).as_dict().and_then(|d| d.get(b"T").cloned()).and_then(|t| crate::text_of(&doc.resolve(&t))).as_deref() == Some(name))
-}
-
-/// The values a parent field passes to the fields under it that can't be turned off by giving
-/// the field a neutral one of its own, as `/Ff` and `/Q` can.
-const PASSED_VALUES: [&[u8]; 3] = [b"V", b"DV", b"MaxLen"];
-
-/// Whether `field` may go in the field tree under the full name `parts`, changing nothing. The
-/// field list holds only terminal fields, so a parent left empty by a move isn't in it: a node
-/// of the same name there is found here.
-/// `inherited` is what the field will hold as its own before it moves (see [`inherited`]).
-fn check_place(doc: &Document, af: ObjRef, field: ObjRef, parts: &[&str], inherited: &Dict) -> Result<(), FormError> {
-    let Some((own, parents)) = parts.split_last() else { return invalid("field names can't be empty") };
-    let mut owned = doc.get(field).as_dict().cloned().unwrap_or_default();
-    for (k, v) in inherited.iter() {
-        owned.set(k.to_vec(), v.clone());
-    }
-    let mut at: Option<ObjRef> = None;
-    let mut whole_path = true;
-    for part in parents {
-        let Some(r) = child_named(doc, af, at, part) else {
-            whole_path = false;
-            break;
-        };
-        // A value, reset value or length limit held by a parent would pass to this field.
-        let held = doc.get(r).as_dict().is_some_and(|d| PASSED_VALUES.iter().any(|k| d.contains(k) && !owned.contains(k)));
-        if held {
-            return invalid(format!("{part:?} holds a value for the fields under it, so {:?} can't be put there", parts.join(".")));
-        }
-        at = Some(r);
-    }
-    // A field being moved is still in the tree here, but under another full name (a move to its
-    // own name changes nothing and doesn't get here), so a node found is another.
-    if whole_path && child_named(doc, af, at, own).is_some() {
-        return invalid(format!("a field named {:?} already exists", parts.join(".")));
-    }
-    Ok(())
-}
-
-/// Put `field` in the field tree under the full name `parts`: its own `/T` is the last part,
-/// and the parts before it name parent fields, reused where the tree has them and made where
-/// not (Acrobat makes `a.b` a field `b` under a field `a`).
-fn attach(doc: &mut Document, af: ObjRef, field: ObjRef, parts: &[&str]) -> Result<(), FormError> {
-    let Some((own, parents)) = parts.split_last() else { return invalid("field names can't be empty") };
-    check_place(doc, af, field, parts, &Dict::new())?;
-    let mut parent: Option<ObjRef> = None;
-    let mut inherits = false;
-    for part in parents {
-        let next = match child_named(doc, af, parent, part) {
-            Some(r) => {
-                inherits |= doc.get(r).as_dict().is_some_and(|d| d.contains(b"Ff") || d.contains(b"Q"));
-                r
-            }
-            None => {
-                let mut d = Dict::new();
-                d.set(b"T".to_vec(), PdfString::text(part));
-                d.set(b"Kids".to_vec(), Object::Array(Vec::new()));
-                if let Some(p) = parent {
-                    d.set(b"Parent".to_vec(), Object::Ref(p));
-                }
-                let r = doc.add(Object::Dict(d));
-                link(doc, af, parent, r)?;
-                r
-            }
-        };
-        parent = Some(next);
-    }
-    doc.update_dict(field, |d| {
-        d.set(b"T".to_vec(), PdfString::text(own));
-        match parent {
-            Some(p) => d.set(b"Parent".to_vec(), Object::Ref(p)),
-            None => {
-                d.remove(b"Parent");
-            }
-        }
-        // An existing parent's flags and alignment would otherwise pass to this field.
-        if inherits {
-            for k in [&b"Ff"[..], b"Q"] {
-                if !d.contains(k) {
-                    d.set(k.to_vec(), Object::Int(0));
-                }
-            }
-        }
-    })?;
-    link(doc, af, parent, field)
-}
-
-/// What `field` inherits from its parents and doesn't hold itself, changing nothing.
-fn inherited(doc: &Document, field: ObjRef) -> Dict {
-    let own = doc.get(field).as_dict().cloned().unwrap_or_default();
-    let mut add = Dict::new();
-    let mut seen = std::collections::HashSet::new();
-    let mut parent = own.reference(b"Parent");
-    while let Some(p) = parent {
-        if seen.len() > 64 || !seen.insert(p) {
-            break;
-        }
-        let Some(d) = doc.get(p).as_dict().cloned() else { break };
-        for k in INHERITED_KEYS {
-            if let Some(v) = d.get(k).filter(|_| !own.contains(k) && !add.contains(k)) {
-                add.set(k.to_vec(), v.clone());
-            }
-        }
-        parent = d.reference(b"Parent");
-    }
-    add
-}
-
-/// Copy onto `field` what it inherits (`add`, from [`inherited`]), so it keeps it when it moves.
-fn own_inherited(doc: &mut Document, field: ObjRef, add: &Dict) -> Result<(), FormError> {
-    if add.iter().next().is_some() {
-        doc.update_dict(field, |d| {
-            for (k, v) in add.iter() {
-                d.set(k.to_vec(), v.clone());
-            }
-        })?;
-    }
-    Ok(())
-}
-
-/// Take `field` out of the field tree: from its parent's `/Kids`, or from `/Fields`.
-fn detach(doc: &mut Document, field: ObjRef) -> Result<(), FormError> {
-    let parent = doc.get(field).as_dict().and_then(|d| d.reference(b"Parent"));
-    let remove_from = |doc: &mut Document, holder: ObjRef, key: &[u8]| -> Result<(), FormError> {
-        let mut d = doc.get(holder).as_dict().cloned().unwrap_or_default();
-        let list = d.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
-        let kept: Vec<Object> = list.into_iter().filter(|o| o.as_ref() != Some(field)).collect();
-        d.set(key.to_vec(), Object::Array(kept));
-        doc.set(holder, Object::Dict(d));
-        Ok(())
-    };
-    match parent {
-        Some(p) => remove_from(doc, p, b"Kids")?,
-        None => {
-            let root = doc.root().ok_or(FormError::NoForm)?;
-            match doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").cloned()) {
-                Some(Object::Ref(af)) => remove_from(doc, af, b"Fields")?,
-                // A form dictionary held directly in the catalog.
-                Some(Object::Dict(mut af)) => {
-                    let list = af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
-                    let kept: Vec<Object> = list.into_iter().filter(|o| o.as_ref() != Some(field)).collect();
-                    af.set(b"Fields".to_vec(), Object::Array(kept));
-                    doc.update_dict(root, |d| d.set(b"AcroForm".to_vec(), Object::Dict(af)))?;
-                }
-                _ => {}
-            }
-        }
-    }
-    Ok(())
-}
-
-/// The first free "<base>N" name: not a field's, and not held by a node at the top of the field
-/// tree (`held`), such as a parent field left empty by a move, which isn't in `existing`.
-fn free_name(existing: &[Field], held: &[String], base: &str) -> String {
-    (1..=u64::MAX)
-        .map(|n| format!("{base}{n}"))
-        .find(|c| !held.contains(c) && !existing.iter().any(|f| f.name == *c || f.name.starts_with(&format!("{c}."))))
-        .unwrap_or_else(|| base.to_string())
-}
-
-/// The own names (`/T`) of the nodes in the form's `/Fields`, changing nothing.
-fn top_names(doc: &Document) -> Vec<String> {
-    let Some(root) = doc.root() else { return Vec::new() };
-    let Some(af) = doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").map(|o| doc.resolve(o))).and_then(|o| o.as_dict().cloned()) else {
-        return Vec::new();
-    };
-    let list = af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
-    list.iter().filter_map(|o| doc.resolve(o).as_dict().and_then(|d| d.get(b"T").cloned())).filter_map(|t| crate::text_of(&doc.resolve(&t))).collect()
-}
-
-fn widget_dict(page: ObjRef, rect: [f64; 4]) -> Dict {
-    let mut d = Dict::new();
-    d.set(b"Type".to_vec(), Object::name("Annot"));
-    d.set(b"Subtype".to_vec(), Object::name("Widget"));
-    d.set(b"Rect".to_vec(), Object::Array(rect.iter().map(|v| Object::Real(*v)).collect()));
-    d.set(b"P".to_vec(), Object::Ref(page));
-    d.set(b"F".to_vec(), Object::Int(4));
-    let mut mk = Dict::new();
-    mk.set(b"BC".to_vec(), rgb([0.55, 0.55, 0.55]));
-    mk.set(b"BG".to_vec(), rgb([1.0, 1.0, 1.0]));
-    d.set(b"MK".to_vec(), Object::Dict(mk));
-    let mut bs = Dict::new();
-    bs.set(b"W".to_vec(), Object::Int(1));
-    bs.set(b"S".to_vec(), Object::name("S"));
-    d.set(b"BS".to_vec(), Object::Dict(bs));
-    d
-}
-
-/// Add a field on `page` (0-based) in `rect` (user space). Returns its full name.
-pub fn add_field(doc: &mut Document, page: usize, rect: [f64; 4], kind: &NewField, name: Option<&str>) -> Result<String, FormError> {
-    let pages = page_refs(doc);
-    let page_ref = *pages.get(page).ok_or_else(|| FormError::Invalid(format!("page {} does not exist", page + 1)))?;
-    let rect = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
-    if !rect.iter().all(|v| v.is_finite()) || rect[2] - rect[0] < MIN_FIELD_SIDE || rect[3] - rect[1] < MIN_FIELD_SIDE {
-        return invalid("the field is too small");
-    }
-    let existing = fields(doc);
-    // A radio button names its group: a new group takes that name.
-    let name = match (name, kind) {
-        (None, NewField::Radio { group: Some(g), .. }) => Some(g.as_str()),
-        _ => name,
-    };
-    let name = match name.map(str::trim) {
-        Some(n) if !n.is_empty() => n.to_string(),
-        _ => free_name(&existing, &top_names(doc), kind.base_name()),
-    };
-    let parts = name_parts(&name)?;
-    let radio_group = match kind {
-        NewField::Radio { group, .. } => existing.iter().find(|f| f.kind == FieldKind::Radio && Some(&f.name) == group.as_ref()).cloned(),
-        _ => None,
-    };
-    if radio_group.is_none()
-        && let Some(why) = existing.iter().find_map(|f| clash(&name, &f.name))
-    {
-        return invalid(why);
-    }
-    let af = ensure_form(doc)?;
-    let mut w = widget_dict(page_ref, rect);
-    let field_name = match kind {
-        NewField::Radio { group: Some(g), .. } if radio_group.is_some() => g.clone(),
-        _ => name.clone(),
-    };
-    match kind {
-        NewField::Text { multiline } => {
-            w.set(b"FT".to_vec(), Object::name("Tx"));
-            // Auto size (0): a fixed 12 pt is clipped in a box shorter than that (#1888).
-            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
-            if *multiline {
-                w.set(b"Ff".to_vec(), Object::Int(flags::MULTILINE as i64));
-            }
-        }
-        NewField::Date => {
-            w.set(b"FT".to_vec(), Object::name("Tx"));
-            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
-            // Acrobat's format and keystroke actions for mm/dd/yyyy (run by its JavaScript engine).
-            let js = |s: &str| {
-                let mut a = Dict::new();
-                a.set(b"S".to_vec(), Object::name("JavaScript"));
-                a.set(b"JS".to_vec(), PdfString::literal(s.as_bytes().to_vec()));
-                Object::Dict(a)
-            };
-            let mut aa = Dict::new();
-            aa.set(b"F".to_vec(), js("AFDate_FormatEx(\"mm/dd/yyyy\");"));
-            aa.set(b"K".to_vec(), js("AFDate_KeystrokeEx(\"mm/dd/yyyy\");"));
-            w.set(b"AA".to_vec(), Object::Dict(aa));
-        }
-        NewField::CheckBox => {
-            w.set(b"FT".to_vec(), Object::name("Btn"));
-            w.set(b"V".to_vec(), Object::name("Off"));
-            w.set(b"AS".to_vec(), Object::name("Off"));
-            w.set(b"DA".to_vec(), PdfString::literal(b"/ZaDb 0 Tf 0 g".to_vec()));
-        }
-        NewField::Radio { export, .. } => {
-            w.set(b"AS".to_vec(), Object::name("Off"));
-            if export.trim().is_empty() || export == "Off" {
-                return invalid("a radio button needs an export value other than Off");
-            }
-        }
-        NewField::Combo { options, editable } | NewField::List { options, multi: editable } => {
-            w.set(b"FT".to_vec(), Object::name("Ch"));
-            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 12 Tf 0 g".to_vec()));
-            let combo = matches!(kind, NewField::Combo { .. });
-            let mut ff = 0;
-            if combo {
-                ff |= flags::COMBO;
-                if *editable {
-                    ff |= flags::EDIT;
-                }
-            } else if *editable {
-                ff |= flags::MULTI_SELECT;
-            }
-            w.set(b"Ff".to_vec(), Object::Int(ff as i64));
-            w.set(b"Opt".to_vec(), Object::Array(options.iter().map(|o| Object::String(PdfString::text(o))).collect()));
-        }
-        NewField::Button { caption } => {
-            w.set(b"FT".to_vec(), Object::name("Btn"));
-            w.set(b"Ff".to_vec(), Object::Int(flags::PUSH_BUTTON as i64));
-            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
-            let mut mk = w.get(b"MK").and_then(|m| m.as_dict()).cloned().unwrap_or_default();
-            mk.set(b"BG".to_vec(), rgb([0.86, 0.86, 0.86]));
-            mk.set(b"CA".to_vec(), PdfString::text(caption));
-            w.set(b"MK".to_vec(), Object::Dict(mk));
-        }
-        NewField::Image => {
-            w.set(b"FT".to_vec(), Object::name("Btn"));
-            w.set(b"Ff".to_vec(), Object::Int(flags::PUSH_BUTTON as i64));
-            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
-            let mut mk = w.get(b"MK").and_then(|m| m.as_dict()).cloned().unwrap_or_default();
-            // Icon only, no border or fill: the picture is the field.
-            mk.remove(b"BC");
-            mk.remove(b"BG");
-            mk.set(b"TP".to_vec(), Object::Int(1));
-            w.set(b"MK".to_vec(), Object::Dict(mk));
-            let mut a = Dict::new();
-            a.set(b"S".to_vec(), Object::name("JavaScript"));
-            a.set(b"JS".to_vec(), PdfString::literal(b"event.target.buttonImportIcon();".to_vec()));
-            w.set(b"A".to_vec(), Object::Dict(a));
-        }
-        NewField::Signature => {
-            w.set(b"FT".to_vec(), Object::name("Sig"));
-        }
-    }
-    let widget = doc.add(Object::Dict(w));
-    match kind {
-        NewField::Radio { export, .. } => {
-            let group = match &radio_group {
-                Some(g) => g.obj,
-                None => {
-                    let mut g = Dict::new();
-                    g.set(b"FT".to_vec(), Object::name("Btn"));
-                    g.set(b"Ff".to_vec(), Object::Int((flags::RADIO | flags::NO_TOGGLE_TO_OFF) as i64));
-                    g.set(b"V".to_vec(), Object::name("Off"));
-                    g.set(b"DA".to_vec(), PdfString::literal(b"/ZaDb 0 Tf 0 g".to_vec()));
-                    g.set(b"Kids".to_vec(), Object::Array(Vec::new()));
-                    let g = doc.add(Object::Dict(g));
-                    attach(doc, af, g, &parts)?;
-                    g
-                }
-            };
-            doc.update_dict(widget, |d| d.set(b"Parent".to_vec(), Object::Ref(group)))?;
-            doc.update_dict(group, |d| {
-                let mut kids = d.get(b"Kids").and_then(|k| k.as_array().cloned()).unwrap_or_default();
-                kids.push(Object::Ref(widget));
-                d.set(b"Kids".to_vec(), Object::Array(kids));
-            })?;
-            let w = Widget {
-                obj: widget,
-                page: Some(page),
-                rect,
-                on_state: Some(export.clone()),
-                state: Some("Off".into()),
-                tab: usize::MAX,
-                locked: false,
-                hidden: false,
-                read_only: false,
-                rotation: 0,
-                caption: None,
-                list: None,
-            };
-            let ap = appearance::check_box_states(doc, &w, FieldKind::Radio, export, "/ZaDb 0 Tf 0 g");
-            doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap)))?;
-        }
-        _ => attach(doc, af, widget, &parts)?,
-    }
-    add_to_page(doc, page_ref, widget)?;
-    redraw_field(doc, &field_name)?;
-    Ok(field_name)
-}
-
-/// Regenerate every widget appearance of a field from its current value and settings. A value or
-/// button caption its font can't hold is drawn with `?` for those characters, the widget is marked
-/// (`pdfcraft_fonts::UNDRAWN_MARK`) and other viewers are asked to redraw the form (see
-/// `ask_viewers_to_redraw`), as when a value is set.
-pub fn redraw_field(doc: &mut Document, name: &str) -> Result<(), FormError> {
-    redraw_widgets(doc, name, None)
-}
-
-/// `redraw_field` for the widget at index `only` alone (so a caption-only edit leaves the field's
-/// other widgets' appearances as they are), or for every widget when `only` is `None`. Fails with
-/// `FormError::NoSuchField` when no field is named `name`.
-fn redraw_widgets(doc: &mut Document, name: &str, only: Option<usize>) -> Result<(), FormError> {
-    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
-    let mut undrawn = false;
-    for (index, w) in f.widgets.iter().enumerate() {
-        if only.is_some_and(|only| only != index) {
-            continue;
-        }
-        let mut missing = None;
-        let ap = match f.kind {
-            FieldKind::Text | FieldKind::Combo | FieldKind::List => {
-                let (s, m) = appearance::field_appearance_drawn(doc, &f, w, &f.value, true);
-                missing = m;
-                let r = doc.add(Object::Stream(s));
-                let mut d = Dict::new();
-                d.set(b"N".to_vec(), Object::Ref(r));
-                d
-            }
-            FieldKind::CheckBox | FieldKind::Radio => {
-                let on = w.on_state.clone().unwrap_or_else(|| "Yes".into());
-                appearance::check_box_states(doc, w, f.kind, &on, &f.da)
-            }
-            FieldKind::PushButton => {
-                let (s, m) = button_appearance(doc, w, &f.da);
-                missing = m;
-                let r = doc.add(Object::Stream(s));
-                let mut d = Dict::new();
-                d.set(b"N".to_vec(), Object::Ref(r));
-                d
-            }
-            FieldKind::Signature => {
-                let s = empty_box(doc, w);
-                let r = doc.add(Object::Stream(s));
-                let mut d = Dict::new();
-                d.set(b"N".to_vec(), Object::Ref(r));
-                d
-            }
-        };
-        undrawn |= missing.is_some();
-        let existing = crate::merged_appearance(doc, w.obj, &ap);
-        doc.update_dict(w.obj, |d| {
-            d.set(b"AP".to_vec(), Object::Dict(existing));
-            pdfcraft_fonts::set_undrawn_mark(d, missing);
-        })?;
-    }
-    if undrawn {
-        crate::ask_viewers_to_redraw(doc)?;
-    }
-    Ok(())
-}
-
-fn frame_only(doc: &Document, w: &Widget) -> (String, crate::appearance::Placement) {
-    let (page_w, page_h) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
-    let wobj = doc.get(w.obj);
-    let wd = wobj.as_dict().cloned().unwrap_or_default();
-    let place = crate::appearance::placement(crate::appearance::mk_rotation(doc, &wd), page_w, page_h);
-    let (width, height) = (place.layout_w, place.layout_h);
-    let mk = wd.get(b"MK").and_then(|m| m.as_dict()).cloned().unwrap_or_default();
-    let col = |k: &[u8]| -> Option<String> {
-        let v: Vec<f64> = mk.get(k)?.as_array()?.iter().filter_map(|x| x.as_f64()).collect();
-        (v.len() == 3).then(|| format!("{} {} {}", crate::appearance::fmt(v[0]), crate::appearance::fmt(v[1]), crate::appearance::fmt(v[2])))
-    };
-    let mut c = String::new();
-    if let Some(bg) = col(b"BG") {
-        c.push_str(&format!("{bg} rg 0 0 {width:.3} {height:.3} re f\n"));
-    }
-    if let Some(bc) = col(b"BC") {
-        c.push_str(&format!("{bc} RG 1 w 0.5 0.5 {:.3} {:.3} re S\n", width - 1.0, height - 1.0));
-    }
-    (c, place)
-}
-
-fn form_stream(place: crate::appearance::Placement, content: Vec<u8>, resources: Dict) -> Stream {
-    let mut d = Dict::new();
-    d.set(b"Type".to_vec(), Object::name("XObject"));
-    d.set(b"Subtype".to_vec(), Object::name("Form"));
-    crate::appearance::set_form_box(&mut d, place);
-    d.set(b"Resources".to_vec(), Object::Dict(resources));
-    Stream::flate(d, &content)
-}
-
-/// A push button: background, border, its icon (`/MK /I`, scaled to fit and centred) and its
-/// centred caption (unless the layout is icon only, `/TP 1`). The caption uses the font, size and
-/// color its `/DA` asks for (the widget's, else `field_da`, the field's own or inherited one).
-/// Also returns the first caption character the font can't draw (drawn as `?`), for the caller to
-/// mark and report.
-pub(crate) fn button_appearance(doc: &Document, w: &Widget, field_da: &str) -> (Stream, Option<char>) {
-    let (mut c, place) = frame_only(doc, w);
-    let (width, height) = (place.layout_w, place.layout_h);
-    let wobj = doc.get(w.obj);
-    let mk = wobj.as_dict().and_then(|d| d.get(b"MK")).map(|m| doc.resolve(m)).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
-    let caption = mk.get(b"CA").map(|c| doc.resolve(c)).and_then(|c| c.as_string().map(|s| s.to_text())).unwrap_or_default();
-    let icon_only = mk.get(b"TP").and_then(|t| doc.resolve(t).as_int()) == Some(1);
-    let mut content = std::mem::take(&mut c).into_bytes();
-    let mut xobjects = Dict::new();
-    if let Some(icon) = mk.get(b"I").and_then(Object::as_ref)
-        && let Object::Stream(s) = &*doc.get(icon)
-    {
-        let bb: Vec<f64> = s.dict.get(b"BBox").and_then(|b| b.as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default();
-        if let [x0, y0, x1, y1] = bb[..]
-            && x1 > x0
-            && y1 > y0
-        {
-            // Proportional, as large as fits (Acrobat's default icon placement), centred.
-            let k = ((width - 2.0) / (x1 - x0)).min((height - 2.0) / (y1 - y0)).max(0.0);
-            let (dx, dy) = ((width - (x1 - x0) * k) / 2.0 - x0 * k, (height - (y1 - y0) * k) / 2.0 - y0 * k);
-            content.extend(format!("q {k:.6} 0 0 {k:.6} {dx:.3} {dy:.3} cm /Icon Do Q\n").bytes());
-            xobjects.set(b"Icon".to_vec(), Object::Ref(icon));
-        }
-    }
-    let mut missing = None;
-    let mut fonts = Dict::new();
-    if !icon_only && !caption.is_empty() {
-        let da = wobj.as_dict().and_then(|d| d.get(b"DA")).and_then(|o| doc.resolve(o).as_string().map(|s| s.to_text()));
-        let auto = ((height - 4.0) * 0.6).clamp(4.0, 14.0);
-        let (ops, name, font, m) = appearance::button_caption(doc, da.as_deref().unwrap_or(field_da), &caption, width, height, auto);
-        content.extend(ops);
-        fonts.set(name.into_bytes(), font);
-        missing = m;
-    }
-    let mut res = Dict::new();
-    res.set(b"Font".to_vec(), Object::Dict(fonts));
-    if !xobjects.is_empty() {
-        res.set(b"XObject".to_vec(), Object::Dict(xobjects));
-    }
-    (form_stream(place, content, res), missing)
-}
-
-/// Give a push button (an image field) the picture `image` (an image XObject of `px` pixels):
-/// it becomes the button's icon (`/MK /I`) and its appearance.
-pub fn set_button_icon(doc: &mut Document, name: &str, image: ObjRef, px: (u32, u32)) -> Result<(), FormError> {
-    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
-    if f.kind != FieldKind::PushButton {
-        return invalid(format!("{name} is not a button or image field"));
-    }
-    // The icon form draws the image in a box of its pixel size (keeping its aspect ratio).
-    let (w, h) = (px.0.max(1) as f64, px.1.max(1) as f64);
-    let mut xo = Dict::new();
-    xo.set(b"Im0".to_vec(), Object::Ref(image));
-    let mut res = Dict::new();
-    res.set(b"XObject".to_vec(), Object::Dict(xo));
-    let icon =
-        doc.add(Object::Stream(form_stream(crate::appearance::placement(0, w, h), format!("q {w} 0 0 {h} 0 0 cm /Im0 Do Q").into_bytes(), res)));
-    for wd in &f.widgets {
-        let mut mk =
-            doc.get(wd.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m))).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
-        mk.set(b"I".to_vec(), Object::Ref(icon));
-        if !mk.contains(b"TP") {
-            mk.set(b"TP".to_vec(), Object::Int(1));
-        }
-        doc.update_dict(wd.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
-    }
-    redraw_field(doc, name)
-}
-
-fn empty_box(doc: &Document, w: &Widget) -> Stream {
-    let (c, place) = frame_only(doc, w);
-    form_stream(place, c.into_bytes(), Dict::new())
-}
-
-/// Swap width and height, keeping the center. `None` when that is not a usable widget.
-fn swapped_around_center(r: [f64; 4]) -> Option<[f64; 4]> {
-    if !r.iter().all(|v| v.is_finite()) {
-        return None;
-    }
-    let (x0, y0, x1, y1) = (r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3]));
-    let (cx, cy) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0);
-    let (nw, nh) = (y1 - y0, x1 - x0);
-    let out = [cx - nw / 2.0, cy - nh / 2.0, cx + nw / 2.0, cy + nh / 2.0];
-    (out.iter().all(|v| v.is_finite()) && out[2] - out[0] >= MIN_FIELD_SIDE && out[3] - out[1] >= MIN_FIELD_SIDE).then_some(out)
-}
-
-/// Change a field's properties (General and Options tabs) and redraw it.
-pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<String, FormError> {
-    if props.font_size.is_some_and(|size| !size.is_finite() || size < 0.0) {
-        return invalid("font size must be a finite, non-negative number");
-    }
-    if let Some(patch) = &props.appearance {
-        if props.look.is_some() {
-            return invalid("give an appearance patch or a complete look, not both");
-        }
-        patch.validate()?;
-    }
-    let all = fields(doc);
-    let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?.clone();
-    // Refuse a wrong type/index before any other requested property is written.
-    if let Some((wi, _)) = &props.caption {
-        if f.kind != FieldKind::PushButton {
-            return invalid("only push buttons have a caption");
-        }
-        if f.widgets.get(*wi).is_none() {
-            return invalid(format!("{name} has no widget {}", wi.saturating_add(1)));
-        }
-    }
-    // Validated before anything is written, so a refused rotation leaves the document unchanged.
-    // `Some(Some(rect))`: the widget's axis changes and it gets the swapped rectangle.
-    let mut rotated_rect: Option<Option<[f64; 4]>> = None;
-    if let Some((wi, rot)) = props.rotation {
-        if !matches!(rot, 0 | 90 | 180 | 270) {
-            return invalid("rotation must be 0, 90, 180 or 270 degrees");
-        }
-        let Some(w) = f.widgets.get(wi) else {
-            return invalid(format!("{name} has no widget {}", wi.saturating_add(1)));
-        };
-        let axis_change = (w.rotation % 180 == 0) != (rot % 180 == 0);
-        rotated_rect = Some(None);
-        if axis_change && props.rect.is_none() {
-            let Some(rect) = swapped_around_center(w.rect) else { return invalid("the field is too small") };
-            rotated_rect = Some(Some(rect));
-        }
-    }
-    // A locked field only takes unlocking (Acrobat greys its properties out).
-    if f.locked() && props.locked != Some(false) && *props != (FieldProps { locked: props.locked, ..FieldProps::default() }) {
-        return invalid(format!("{name} is locked: unlock it first"));
-    }
-    if let Some(lock) = props.locked {
-        for w in &f.widgets {
-            let flags = doc.get(w.obj).as_dict().and_then(|d| d.get(b"F").and_then(|v| doc.resolve(v).as_int())).unwrap_or(0);
-            let v = if lock { flags | 128 } else { flags & !128 };
-            doc.update_dict(w.obj, |d| d.set(b"F".to_vec(), Object::Int(v)))?;
-        }
-        if *props == (FieldProps { locked: props.locked, ..FieldProps::default() }) {
-            return Ok(name.to_string());
-        }
-    }
-    if let Some(acts) = &props.actions {
-        crate::set_field_actions(doc, name, acts)?;
-    }
-    let mut new_name = name.to_string();
-    if let Some(n) = props.name.as_deref().map(str::trim).filter(|n| *n != f.name) {
-        // A full name under the same parents only renames the field's own part (the editor
-        // shows nested fields by their full name): it isn't moved, so it keeps its place and
-        // goes on inheriting from its parents.
-        let n = match (n.rsplit_once('.'), f.name.rsplit_once('.')) {
-            (Some((parents, own)), Some((current, _))) if parents == current => own,
-            _ => n,
-        };
-        if n.contains('.') {
-            // A full name: the field moves under the parent fields it names (#2696).
-            let parts = name_parts(n)?;
-            if let Some(why) = all.iter().filter(|x| x.obj != f.obj).find_map(|x| clash(n, &x.name)) {
-                return invalid(why);
-            }
-            let af = ensure_form(doc)?;
-            // Checked before anything changes, so a refused move leaves the field as it was.
-            let add = inherited(doc, f.obj);
-            check_place(doc, af, f.obj, &parts, &add)?;
-            // From here a failure (a write that `check_place` couldn't foresee) would leave the
-            // field half moved in `doc`. The engine runs every edit on a copy of the document and
-            // keeps it only when the edit succeeds (`Session::apply`), so the open document never
-            // sees that.
-            own_inherited(doc, f.obj, &add)?;
-            detach(doc, f.obj)?;
-            attach(doc, af, f.obj, &parts)?;
-            new_name = n.to_string();
-        } else {
-            if n.is_empty() {
-                return invalid("field names can't be empty");
-            }
-            // Rename the terminal part (the field's own /T). The parents' part stays, so the name
-            // that must be free is the full one: `MASTER.a` renamed to `b` takes `MASTER.b` (ISO
-            // 32000-2 §12.7.4.2). The field itself is no clash when it keeps its own name.
-            let prefix = f.name.rsplit_once('.').map(|(p, _)| format!("{p}.")).unwrap_or_default();
-            new_name = format!("{prefix}{n}");
-            if let Some(why) = all.iter().filter(|x| x.obj != f.obj).find_map(|x| clash(&new_name, &x.name)) {
-                return invalid(why);
-            }
-            // A node of that name beside it that isn't a terminal field, such as a parent
-            // field left empty by a move.
-            let af = ensure_form(doc)?;
-            let parent = doc.get(f.obj).as_dict().and_then(|d| d.reference(b"Parent"));
-            if child_named(doc, af, parent, n).is_some_and(|r| r != f.obj) {
-                return invalid(format!("a field named {new_name:?} already exists"));
-            }
-            doc.update_dict(f.obj, |d| d.set(b"T".to_vec(), PdfString::text(n)))?;
-        }
-        // Calculations read the field by its new name, unless another field keeps the old one.
-        if all.iter().filter(|x| x.name == f.name).count() == 1 {
-            rename_in_calculations(doc, &all, &f.name, &new_name)?;
-        }
-    }
-    // The new default appearance when the size or the look changes.
-    let size = props.font_size.unwrap_or_else(|| crate::appearance::parse_da(&f.da).size);
-    let new_da = match &props.look {
-        Some(l) => da_string(l.font, size, l.text),
-        None => patch_da(&f.da, props.font_size, &props.appearance.unwrap_or_default()),
-    };
-    if props.look.is_some() || props.appearance.is_some_and(|p| p.font.is_some()) {
-        ensure_form(doc)?;
-    }
-    let mut ff = f.flags;
-    let mut set_flag = |flag: u32, on: Option<bool>| {
-        if let Some(on) = on {
-            if on {
-                ff |= flag;
-            } else {
-                ff &= !flag;
-            }
-        }
-    };
-    set_flag(flags::READ_ONLY, props.read_only);
-    set_flag(flags::REQUIRED, props.required);
-    if f.kind == FieldKind::Text {
-        set_flag(flags::MULTILINE, props.multiline);
-    }
-    for (flag, on) in &props.flags {
-        set_flag(*flag, Some(*on));
-    }
-    // A comb spreads a fixed number of characters across the field: it needs a limit and
-    // excludes multi-line, password, file selection and scrolling (ISO 32000-2 Table 229).
-    if f.kind == FieldKind::Text && ff & flags::COMB != 0 {
-        let limit = match props.max_len {
-            Some(m) => m,
-            None => f.max_len,
-        };
-        if limit.is_none_or(|m| m == 0) {
-            return invalid("a comb of characters needs a character limit");
-        }
-        ff &= !(flags::MULTILINE | flags::PASSWORD | flags::FILE_SELECT);
-    }
-    if let Some(q) = props.quadding
-        && !(0..=2).contains(&q)
-    {
-        return invalid("alignment is 0 (left), 1 (centre) or 2 (right)");
-    }
-    if props.options.as_ref().is_some_and(Vec::is_empty) && matches!(f.kind, FieldKind::Combo | FieldKind::List) {
-        return invalid("a list needs at least one option");
-    }
-    if props.check_style.is_some() && !matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) {
-        return invalid("only check boxes and radio buttons have a check style");
-    }
-    doc.update_dict(f.obj, |d| {
-        d.set(b"Ff".to_vec(), Object::Int(ff as i64));
-        if let Some(t) = &props.tooltip {
-            if t.is_empty() {
-                d.remove(b"TU");
-            } else {
-                d.set(b"TU".to_vec(), PdfString::text(t));
-            }
-        }
-        if let Some(m) = props.max_len {
-            match m {
-                Some(m) => d.set(b"MaxLen".to_vec(), Object::Int(m as i64)),
-                None => {
-                    d.remove(b"MaxLen");
-                }
-            }
-        }
-        if let Some(opts) = &props.options {
-            d.set(b"Opt".to_vec(), Object::Array(opts.iter().map(|o| Object::String(PdfString::text(o))).collect()));
-        }
-        // "Sort items": the list itself is kept in order (export values stay with their items).
-        if ff & flags::SORT != 0 && matches!(f.kind, FieldKind::Combo | FieldKind::List) {
-            let mut items: Vec<(String, String)> = match &props.options {
-                Some(o) => o.iter().map(|x| (x.clone(), x.clone())).collect(),
-                None => f.options.clone(),
-            };
-            items.sort_by_key(|(_, display)| display.to_lowercase());
-            let opt = items
-                .iter()
-                .map(|(e, disp)| {
-                    if e == disp {
-                        Object::String(PdfString::text(disp))
-                    } else {
-                        Object::Array(vec![Object::String(PdfString::text(e)), Object::String(PdfString::text(disp))])
-                    }
-                })
-                .collect();
-            d.set(b"Opt".to_vec(), Object::Array(opt));
-        }
-        if let Some(q) = props.quadding {
-            d.set(b"Q".to_vec(), Object::Int(q));
-        }
-        match &props.default_value {
-            // Buttons name their default state; text and choices hold a string.
-            Some(Some(v)) if matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) => d.set(b"DV".to_vec(), Object::Name(crate::name_bytes(v))),
-            Some(Some(v)) => d.set(b"DV".to_vec(), PdfString::text(v)),
-            Some(None) => {
-                d.remove(b"DV");
-            }
-            None => {}
-        }
-        if props.font_size.is_some() || props.look.is_some() || props.appearance.is_some_and(|p| p.font.is_some() || p.text.is_some()) {
-            d.set(b"DA".to_vec(), PdfString::literal(new_da.clone().into_bytes()));
-        }
-    })?;
-    if props.appearance.is_some() || (props.font_size.is_some() && props.look.is_none()) {
-        let patch = &props.appearance.unwrap_or_default();
-        for w in &f.widgets {
-            patch_widget_look(doc, w, patch)?;
-            // A widget's own /DA overrides its field's /DA. Patch that override separately
-            // rather than replacing its font or colour with the first widget's defaults.
-            if w.obj != f.obj && (props.font_size.is_some() || patch.font.is_some() || patch.text.is_some()) {
-                let da = doc
-                    .get(w.obj)
-                    .as_dict()
-                    .and_then(|d| d.get(b"DA").cloned())
-                    .map(|v| doc.resolve(&v))
-                    .and_then(|v| v.as_string().map(|s| s.to_text()));
-                if let Some(da) = da {
-                    let da = patch_da(&da, props.font_size, patch);
-                    doc.update_dict(w.obj, |d| d.set(b"DA".to_vec(), PdfString::literal(da.into_bytes())))?;
-                }
-            }
-        }
-    }
-    if let Some(l) = &props.look {
-        let arr = |c: [f64; 3]| Object::Array(c.iter().map(|v| Object::Real(v.clamp(0.0, 1.0))).collect());
-        for w in &f.widgets {
-            // Resolved first: an indirect /MK keeps its mark, rotation and other entries.
-            let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
-            doc.update_dict(w.obj, |d| {
-                match l.border {
-                    Some(c) => mk.set(b"BC".to_vec(), arr(c)),
-                    None => {
-                        mk.remove(b"BC");
-                    }
-                }
-                match l.fill {
-                    Some(c) => mk.set(b"BG".to_vec(), arr(c)),
-                    None => {
-                        mk.remove(b"BG");
-                    }
-                }
-                d.set(b"MK".to_vec(), Object::Dict(mk));
-                let mut bs = Dict::new();
-                bs.set(b"W".to_vec(), Object::Real(l.width.clamp(0.0, 12.0)));
-                bs.set(b"S".to_vec(), Object::name(l.style.code()));
-                if l.style == BorderStyle::Dashed {
-                    bs.set(b"D".to_vec(), Object::Array(vec![Object::Int(3)]));
-                }
-                d.set(b"BS".to_vec(), Object::Dict(bs));
-            })?;
-        }
-    }
-    if let Some(style) = props.check_style {
-        for w in &f.widgets {
-            // Resolved first: an indirect /MK keeps its colours.
-            let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
-            mk.set(b"CA".to_vec(), PdfString::text(style.code()));
-            doc.update_dict(w.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
-        }
-    }
-    if let Some((wi, r)) = props.rect {
-        let w = f.widgets.get(wi).ok_or_else(|| FormError::Invalid(format!("{name} has no widget {}", wi + 1)))?;
-        let r = [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])];
-        if !r.iter().all(|v| v.is_finite()) || r[2] - r[0] < MIN_FIELD_SIDE || r[3] - r[1] < MIN_FIELD_SIDE {
-            return invalid("the field is too small");
-        }
-        doc.update_dict(w.obj, |d| d.set(b"Rect".to_vec(), Object::Array(r.iter().map(|v| Object::Real(*v)).collect())))?;
-    }
-    if props.format.is_some() || props.validate.is_some() || props.calculate.is_some() {
-        if !matches!(f.kind, FieldKind::Text | FieldKind::Combo) {
-            return invalid("only text fields and drop-down lists have format, validate and calculate scripts");
-        }
-        let mut aa = doc
-            .get(f.obj)
-            .as_dict()
-            .and_then(|d| d.get(b"AA").cloned())
-            .map(|a| doc.resolve(&a))
-            .and_then(|a| a.as_dict().cloned())
-            .unwrap_or_default();
-        let action = |js: &str| -> Object {
-            let mut a = Dict::new();
-            a.set(b"S".to_vec(), Object::name("JavaScript"));
-            a.set(b"JS".to_vec(), PdfString::literal(js.as_bytes().to_vec()));
-            Object::Dict(a)
-        };
-        if let Some(fm) = &props.format {
-            aa.remove(b"F");
-            aa.remove(b"K");
-            if let Some((fjs, kjs)) = crate::af::format_js(fm) {
-                if !fjs.is_empty() {
-                    aa.set(b"F".to_vec(), action(&fjs));
-                }
-                aa.set(b"K".to_vec(), action(&kjs));
-            }
-        }
-        if let Some(v) = &props.validate {
-            aa.remove(b"V");
-            if let Some(js) = crate::af::validate_js(v) {
-                aa.set(b"V".to_vec(), action(&js));
-            }
-        }
-        if let Some(c) = &props.calculate {
-            aa.remove(b"C");
-            if let Some(js) = crate::af::calculate_js(c) {
-                aa.set(b"C".to_vec(), action(&js));
-            }
-            crate::calc_order::keep_listed(doc, f.obj, *c != crate::af::Calculate::None)?;
-        }
-        doc.update_dict(f.obj, |d| {
-            if aa.is_empty() {
-                d.remove(b"AA");
-            } else {
-                d.set(b"AA".to_vec(), Object::Dict(aa));
-            }
-        })?;
-    }
-    // A complete look replaces widget /DA overrides. Partial changes were patched above
-    // against each override, including size-only changes that keep its font and colour.
-    if props.look.is_some() {
-        for w in &f.widgets {
-            if w.obj != f.obj {
-                doc.update_dict(w.obj, |d| {
-                    if d.contains(b"DA") {
-                        d.set(b"DA".to_vec(), PdfString::literal(new_da.clone().into_bytes()));
-                    }
-                })?;
-            }
-        }
-    }
-    if let (Some((wi, rot)), Some(swapped)) = (props.rotation, rotated_rect)
-        && let Some(w) = f.widgets.get(wi)
-    {
-        if let Some(rect) = swapped {
-            doc.update_dict(w.obj, |d| d.set(b"Rect".to_vec(), Object::Array(rect.iter().map(|v| Object::Real(*v)).collect())))?;
-        }
-        let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
-        if rot == 0 {
-            mk.remove(b"R");
-        } else {
-            mk.set(b"R".to_vec(), Object::Int(rot));
-        }
-        doc.update_dict(w.obj, |d| {
-            if mk.is_empty() {
-                d.remove(b"MK");
-            } else {
-                d.set(b"MK".to_vec(), Object::Dict(mk));
-            }
-        })?;
-    }
-    if let Some((wi, caption)) = &props.caption
-        && let Some(w) = f.widgets.get(*wi)
-    {
-        // Copy an indirect/shared MK before patching it; colours, icons, rotation and
-        // unknown entries belong to this widget, and other owners keep their old label.
-        let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
-        mk.set(b"CA".to_vec(), PdfString::text(caption));
-        doc.update_dict(w.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
-    }
-    // A label-only edit must not replace another widget's custom appearances.
-    let only = props.caption.as_ref().filter(|_| *props == (FieldProps { caption: props.caption.clone(), ..Default::default() })).map(|(wi, _)| *wi);
-    redraw_widgets(doc, &new_name, only)?;
-    if props.calculate.is_some() {
-        crate::recalculate(doc)?;
-    }
-    Ok(new_name)
-}
-
-/// Name field `old` `new` in each field's Calculate script that reads it
-/// ([`crate::af::rename_in_calculation`]).
-fn rename_in_calculations(doc: &mut Document, all: &[Field], old: &str, new: &str) -> Result<(), FormError> {
-    let aa_of =
-        |doc: &Document, r: ObjRef| doc.get(r).as_dict().and_then(|d| d.get(b"AA").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned());
-    for f in all {
-        // The script is the field's, or its only widget's when the field has none, as
-        // `actions_of` reads it.
-        let only_widget = || match f.widgets.as_slice() {
-            [w] => aa_of(doc, w.obj).map(|aa| (w.obj, aa)),
-            _ => None,
-        };
-        let Some((owner, mut aa)) = aa_of(doc, f.obj).map(|aa| (f.obj, aa)).or_else(only_widget) else { continue };
-        let Some(mut action) = aa.get(b"C").and_then(|a| doc.resolve(a).as_dict().cloned()) else { continue };
-        let js = match action.get(b"JS").map(|js| doc.resolve(js)).as_deref() {
-            Some(Object::String(s)) => s.to_text(),
-            // A stream that isn't UTF-8 reads with replacement characters, which must not be
-            // written back in place of what it holds.
-            Some(Object::Stream(s)) => match s.decoded().ok().and_then(|b| String::from_utf8(b).ok()) {
-                Some(js) => js,
-                None => continue,
-            },
-            _ => continue,
-        };
-        let Some(js) = crate::af::rename_in_calculation(&js, old, new) else { continue };
-        action.set(b"JS".to_vec(), PdfString::text(&js));
-        aa.set(b"C".to_vec(), Object::Dict(action));
-        doc.update_dict(owner, |d| d.set(b"AA".to_vec(), Object::Dict(aa)))?;
-    }
-    Ok(())
-}
-
-/// Delete a field: its widgets leave their pages and the field leaves the form.
-pub fn delete_field(doc: &mut Document, name: &str) -> Result<(), FormError> {
-    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
-    delete_found_field(doc, f)
-}
-
-/// [`delete_field`] for the field object `obj`, when separate fields share one name.
-pub fn delete_field_object(doc: &mut Document, obj: ObjRef) -> Result<(), FormError> {
-    let f = fields(doc).into_iter().find(|f| f.obj == obj).ok_or_else(|| FormError::NoSuchField(format!("{obj:?}")))?;
-    delete_found_field(doc, f)
-}
-
-fn delete_found_field(doc: &mut Document, f: Field) -> Result<(), FormError> {
-    let widgets: std::collections::HashSet<ObjRef> = f.widgets.iter().map(|w| w.obj).collect();
-    for p in page_refs(doc) {
-        let Some(a) = doc.get(p).as_dict().and_then(|d| d.get(b"Annots").cloned()) else { continue };
-        let list = doc.resolve(&a).as_array().cloned().unwrap_or_default();
-        let kept: Vec<Object> = list.iter().filter(|o| !o.as_ref().is_some_and(|r| widgets.contains(&r))).cloned().collect();
-        if kept.len() != list.len() {
-            match a.as_ref() {
-                Some(r) if doc.get(r).as_array().is_some() => doc.set(r, Object::Array(kept)),
-                _ => doc.update_dict(p, |d| d.set(b"Annots".to_vec(), Object::Array(kept)))?,
-            }
-        }
-    }
-    detach(doc, f.obj)?;
-    // Out of the calculation order too: a `/CO` entry would keep the field, its value and its
-    // widgets reachable for a full save.
-    drop_from_calculation_order(doc, |r| r == f.obj || widgets.contains(&r))
-}
-
-/// Remove the `/CO` entries `gone` matches, whether the form and the array are held directly or
-/// by reference.
-fn drop_from_calculation_order(doc: &mut Document, gone: impl Fn(ObjRef) -> bool) -> Result<(), FormError> {
-    let Some(root) = doc.root() else { return Ok(()) };
-    let Some(af_obj) = doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").cloned()) else { return Ok(()) };
-    let Some(mut af) = doc.resolve(&af_obj).as_dict().cloned() else { return Ok(()) };
-    let Some(co_obj) = af.get(b"CO").cloned() else { return Ok(()) };
-    let co = doc.resolve(&co_obj).as_array().cloned().unwrap_or_default();
-    let kept: Vec<Object> = co.iter().filter(|o| !o.as_ref().is_some_and(&gone)).cloned().collect();
-    if kept.len() == co.len() {
-        return Ok(());
-    }
-    match (co_obj.as_ref(), af_obj.as_ref()) {
-        (Some(r), _) if doc.get(r).as_array().is_some() => doc.set(r, Object::Array(kept)),
-        (_, Some(af_ref)) => doc.update_dict(af_ref, |d| d.set(b"CO".to_vec(), Object::Array(kept)))?,
-        (_, None) => {
-            af.set(b"CO".to_vec(), Object::Array(kept));
-            doc.update_dict(root, |d| d.set(b"AcroForm".to_vec(), Object::Dict(af)))?;
-        }
-    }
-    Ok(())
-}
-
-/// Widget-only keys: they stay with each widget when a merged field is split.
-const WIDGET_KEYS: [&[u8]; 12] = [b"Type", b"Subtype", b"Rect", b"P", b"AP", b"AS", b"MK", b"F", b"BS", b"Border", b"H", b"StructParent"];
-
-/// Duplicate a field onto other pages (Acrobat: right-click a field ▸ Duplicate): each page
-/// gets a widget at the same place, belonging to the same field, so they share one value.
-/// A field that is its own widget is first split into a field and a widget kid. Returns how
-/// many widgets were added (pages that already have one are skipped).
-pub fn duplicate_field(doc: &mut Document, name: &str, pages: &[usize]) -> Result<usize, FormError> {
-    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
-    let model = f.widgets.first().cloned().ok_or_else(|| FormError::Invalid(format!("{name} has no widget")))?;
-    let refs = page_refs(doc);
-    for p in pages {
-        if *p >= refs.len() {
-            return invalid(format!("page {} does not exist", p + 1));
-        }
-    }
-    let have: std::collections::HashSet<usize> = f.widgets.iter().filter_map(|w| w.page).collect();
-    let targets: Vec<usize> = pages.iter().copied().filter(|p| !have.contains(p)).collect();
-    if targets.is_empty() {
-        return Ok(0);
-    }
-    // A merged field/widget becomes a field with one widget kid.
-    let mut model_ref = model.obj;
-    if model.obj == f.obj {
-        let d = doc.get(f.obj).as_dict().cloned().unwrap_or_default();
-        let mut kid = Dict::new();
-        for k in WIDGET_KEYS {
-            if let Some(v) = d.get(k) {
-                kid.set(k.to_vec(), v.clone());
-            }
-        }
-        kid.set(b"Parent".to_vec(), Object::Ref(f.obj));
-        let kr = doc.add(Object::Dict(kid));
-        doc.update_dict(f.obj, |d| {
-            for k in WIDGET_KEYS {
-                d.remove(k);
-            }
-            d.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(kr)]));
-        })?;
-        // The page lists the widget now, not the field.
-        if let Some(p) = model.page {
-            let pr = refs[p];
-            let annots = doc.get(pr).as_dict().and_then(|d| d.get(b"Annots").cloned());
-            let swap =
-                |a: Vec<Object>| -> Vec<Object> { a.into_iter().map(|o| if o.as_ref() == Some(f.obj) { Object::Ref(kr) } else { o }).collect() };
-            match annots {
-                Some(Object::Ref(ar)) => {
-                    let a = doc.get(ar).as_array().cloned().unwrap_or_default();
-                    doc.set(ar, Object::Array(swap(a)));
-                }
-                Some(Object::Array(a)) => doc.update_dict(pr, |d| d.set(b"Annots".to_vec(), Object::Array(swap(a))))?,
-                _ => {}
-            }
-        }
-        model_ref = kr;
-    }
-    let template = doc.get(model_ref).as_dict().cloned().unwrap_or_default();
-    let mut added = Vec::new();
-    for p in &targets {
-        let pr = refs[*p];
-        let mut w = template.clone();
-        w.set(b"P".to_vec(), Object::Ref(pr));
-        w.set(b"Parent".to_vec(), Object::Ref(f.obj));
-        w.remove(b"StructParent");
-        let wr = doc.add(Object::Dict(w));
-        let annots = doc.get(pr).as_dict().and_then(|d| d.get(b"Annots").cloned());
-        match annots {
-            Some(Object::Ref(ar)) => {
-                let mut a = doc.get(ar).as_array().cloned().unwrap_or_default();
-                a.push(Object::Ref(wr));
-                doc.set(ar, Object::Array(a));
-            }
-            other => {
-                let mut a = other.and_then(|o| o.as_array().cloned()).unwrap_or_default();
-                a.push(Object::Ref(wr));
-                doc.update_dict(pr, |d| d.set(b"Annots".to_vec(), Object::Array(a)))?;
-            }
-        }
-        added.push(wr);
-    }
-    doc.update_dict(f.obj, |d| {
-        let mut kids = d.get(b"Kids").and_then(|k| k.as_array().cloned()).unwrap_or_default();
-        kids.extend(added.iter().map(|r| Object::Ref(*r)));
-        d.set(b"Kids".to_vec(), Object::Array(kids));
-    })?;
-    redraw_field(doc, name)?;
-    Ok(added.len())
-}
diff --git a/crates/forms/src/author/edit.rs b/crates/forms/src/author/edit.rs
new file mode 100644
index 0000000000..dc7d91d4fc
--- /dev/null
+++ b/crates/forms/src/author/edit.rs
@@ -0,0 +1,425 @@
+use super::look::{BorderStyle, da_string, patch_da, patch_widget_look, redraw_widgets};
+use super::tree::{attach, check_place, child_named, clash, detach, ensure_form, inherited, name_parts, own_inherited};
+use super::*;
+
+/// Swap width and height, keeping the center. `None` when that is not a usable widget.
+fn swapped_around_center(r: [f64; 4]) -> Option<[f64; 4]> {
+    if !r.iter().all(|v| v.is_finite()) {
+        return None;
+    }
+    let (x0, y0, x1, y1) = (r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3]));
+    let (cx, cy) = ((x0 + x1) / 2.0, (y0 + y1) / 2.0);
+    let (nw, nh) = (y1 - y0, x1 - x0);
+    let out = [cx - nw / 2.0, cy - nh / 2.0, cx + nw / 2.0, cy + nh / 2.0];
+    (out.iter().all(|v| v.is_finite()) && out[2] - out[0] >= MIN_FIELD_SIDE && out[3] - out[1] >= MIN_FIELD_SIDE).then_some(out)
+}
+
+/// Change a field's properties (General and Options tabs) and redraw it.
+pub fn set_props(doc: &mut Document, name: &str, props: &FieldProps) -> Result<String, FormError> {
+    if props.font_size.is_some_and(|size| !size.is_finite() || size < 0.0) {
+        return invalid("font size must be a finite, non-negative number");
+    }
+    if let Some(patch) = &props.appearance {
+        if props.look.is_some() {
+            return invalid("give an appearance patch or a complete look, not both");
+        }
+        patch.validate()?;
+    }
+    let all = fields(doc);
+    let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?.clone();
+    // Refuse a wrong type/index before any other requested property is written.
+    if let Some((wi, _)) = &props.caption {
+        if f.kind != FieldKind::PushButton {
+            return invalid("only push buttons have a caption");
+        }
+        if f.widgets.get(*wi).is_none() {
+            return invalid(format!("{name} has no widget {}", wi.saturating_add(1)));
+        }
+    }
+    // Validated before anything is written, so a refused rotation leaves the document unchanged.
+    // `Some(Some(rect))`: the widget's axis changes and it gets the swapped rectangle.
+    let mut rotated_rect: Option<Option<[f64; 4]>> = None;
+    if let Some((wi, rot)) = props.rotation {
+        if !matches!(rot, 0 | 90 | 180 | 270) {
+            return invalid("rotation must be 0, 90, 180 or 270 degrees");
+        }
+        let Some(w) = f.widgets.get(wi) else {
+            return invalid(format!("{name} has no widget {}", wi.saturating_add(1)));
+        };
+        let axis_change = (w.rotation % 180 == 0) != (rot % 180 == 0);
+        rotated_rect = Some(None);
+        if axis_change && props.rect.is_none() {
+            let Some(rect) = swapped_around_center(w.rect) else { return invalid("the field is too small") };
+            rotated_rect = Some(Some(rect));
+        }
+    }
+    // A locked field only takes unlocking (Acrobat greys its properties out).
+    if f.locked() && props.locked != Some(false) && *props != (FieldProps { locked: props.locked, ..FieldProps::default() }) {
+        return invalid(format!("{name} is locked: unlock it first"));
+    }
+    if let Some(lock) = props.locked {
+        for w in &f.widgets {
+            let flags = doc.get(w.obj).as_dict().and_then(|d| d.get(b"F").and_then(|v| doc.resolve(v).as_int())).unwrap_or(0);
+            let v = if lock { flags | 128 } else { flags & !128 };
+            doc.update_dict(w.obj, |d| d.set(b"F".to_vec(), Object::Int(v)))?;
+        }
+        if *props == (FieldProps { locked: props.locked, ..FieldProps::default() }) {
+            return Ok(name.to_string());
+        }
+    }
+    if let Some(acts) = &props.actions {
+        crate::set_field_actions(doc, name, acts)?;
+    }
+    let mut new_name = name.to_string();
+    if let Some(n) = props.name.as_deref().map(str::trim).filter(|n| *n != f.name) {
+        // A full name under the same parents only renames the field's own part (the editor
+        // shows nested fields by their full name): it isn't moved, so it keeps its place and
+        // goes on inheriting from its parents.
+        let n = match (n.rsplit_once('.'), f.name.rsplit_once('.')) {
+            (Some((parents, own)), Some((current, _))) if parents == current => own,
+            _ => n,
+        };
+        if n.contains('.') {
+            // A full name: the field moves under the parent fields it names (#2696).
+            let parts = name_parts(n)?;
+            if let Some(why) = all.iter().filter(|x| x.obj != f.obj).find_map(|x| clash(n, &x.name)) {
+                return invalid(why);
+            }
+            let af = ensure_form(doc)?;
+            // Checked before anything changes, so a refused move leaves the field as it was.
+            let add = inherited(doc, f.obj);
+            check_place(doc, af, f.obj, &parts, &add)?;
+            // From here a failure (a write that `check_place` couldn't foresee) would leave the
+            // field half moved in `doc`. The engine runs every edit on a copy of the document and
+            // keeps it only when the edit succeeds (`Session::apply`), so the open document never
+            // sees that.
+            own_inherited(doc, f.obj, &add)?;
+            detach(doc, f.obj)?;
+            attach(doc, af, f.obj, &parts)?;
+            new_name = n.to_string();
+        } else {
+            if n.is_empty() {
+                return invalid("field names can't be empty");
+            }
+            // Rename the terminal part (the field's own /T). The parents' part stays, so the name
+            // that must be free is the full one: `MASTER.a` renamed to `b` takes `MASTER.b` (ISO
+            // 32000-2 §12.7.4.2). The field itself is no clash when it keeps its own name.
+            let prefix = f.name.rsplit_once('.').map(|(p, _)| format!("{p}.")).unwrap_or_default();
+            new_name = format!("{prefix}{n}");
+            if let Some(why) = all.iter().filter(|x| x.obj != f.obj).find_map(|x| clash(&new_name, &x.name)) {
+                return invalid(why);
+            }
+            // A node of that name beside it that isn't a terminal field, such as a parent
+            // field left empty by a move.
+            let af = ensure_form(doc)?;
+            let parent = doc.get(f.obj).as_dict().and_then(|d| d.reference(b"Parent"));
+            if child_named(doc, af, parent, n).is_some_and(|r| r != f.obj) {
+                return invalid(format!("a field named {new_name:?} already exists"));
+            }
+            doc.update_dict(f.obj, |d| d.set(b"T".to_vec(), PdfString::text(n)))?;
+        }
+        // Calculations read the field by its new name, unless another field keeps the old one.
+        if all.iter().filter(|x| x.name == f.name).count() == 1 {
+            rename_in_calculations(doc, &all, &f.name, &new_name)?;
+        }
+    }
+    // The new default appearance when the size or the look changes.
+    let size = props.font_size.unwrap_or_else(|| crate::appearance::parse_da(&f.da).size);
+    let new_da = match &props.look {
+        Some(l) => da_string(l.font, size, l.text),
+        None => patch_da(&f.da, props.font_size, &props.appearance.unwrap_or_default()),
+    };
+    if props.look.is_some() || props.appearance.is_some_and(|p| p.font.is_some()) {
+        ensure_form(doc)?;
+    }
+    let mut ff = f.flags;
+    let mut set_flag = |flag: u32, on: Option<bool>| {
+        if let Some(on) = on {
+            if on {
+                ff |= flag;
+            } else {
+                ff &= !flag;
+            }
+        }
+    };
+    set_flag(flags::READ_ONLY, props.read_only);
+    set_flag(flags::REQUIRED, props.required);
+    if f.kind == FieldKind::Text {
+        set_flag(flags::MULTILINE, props.multiline);
+    }
+    for (flag, on) in &props.flags {
+        set_flag(*flag, Some(*on));
+    }
+    // A comb spreads a fixed number of characters across the field: it needs a limit and
+    // excludes multi-line, password, file selection and scrolling (ISO 32000-2 Table 229).
+    if f.kind == FieldKind::Text && ff & flags::COMB != 0 {
+        let limit = match props.max_len {
+            Some(m) => m,
+            None => f.max_len,
+        };
+        if limit.is_none_or(|m| m == 0) {
+            return invalid("a comb of characters needs a character limit");
+        }
+        ff &= !(flags::MULTILINE | flags::PASSWORD | flags::FILE_SELECT);
+    }
+    if let Some(q) = props.quadding
+        && !(0..=2).contains(&q)
+    {
+        return invalid("alignment is 0 (left), 1 (centre) or 2 (right)");
+    }
+    if props.options.as_ref().is_some_and(Vec::is_empty) && matches!(f.kind, FieldKind::Combo | FieldKind::List) {
+        return invalid("a list needs at least one option");
+    }
+    if props.check_style.is_some() && !matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) {
+        return invalid("only check boxes and radio buttons have a check style");
+    }
+    doc.update_dict(f.obj, |d| {
+        d.set(b"Ff".to_vec(), Object::Int(ff as i64));
+        if let Some(t) = &props.tooltip {
+            if t.is_empty() {
+                d.remove(b"TU");
+            } else {
+                d.set(b"TU".to_vec(), PdfString::text(t));
+            }
+        }
+        if let Some(m) = props.max_len {
+            match m {
+                Some(m) => d.set(b"MaxLen".to_vec(), Object::Int(m as i64)),
+                None => {
+                    d.remove(b"MaxLen");
+                }
+            }
+        }
+        if let Some(opts) = &props.options {
+            d.set(b"Opt".to_vec(), Object::Array(opts.iter().map(|o| Object::String(PdfString::text(o))).collect()));
+        }
+        // "Sort items": the list itself is kept in order (export values stay with their items).
+        if ff & flags::SORT != 0 && matches!(f.kind, FieldKind::Combo | FieldKind::List) {
+            let mut items: Vec<(String, String)> = match &props.options {
+                Some(o) => o.iter().map(|x| (x.clone(), x.clone())).collect(),
+                None => f.options.clone(),
+            };
+            items.sort_by_key(|(_, display)| display.to_lowercase());
+            let opt = items
+                .iter()
+                .map(|(e, disp)| {
+                    if e == disp {
+                        Object::String(PdfString::text(disp))
+                    } else {
+                        Object::Array(vec![Object::String(PdfString::text(e)), Object::String(PdfString::text(disp))])
+                    }
+                })
+                .collect();
+            d.set(b"Opt".to_vec(), Object::Array(opt));
+        }
+        if let Some(q) = props.quadding {
+            d.set(b"Q".to_vec(), Object::Int(q));
+        }
+        match &props.default_value {
+            // Buttons name their default state; text and choices hold a string.
+            Some(Some(v)) if matches!(f.kind, FieldKind::CheckBox | FieldKind::Radio) => d.set(b"DV".to_vec(), Object::Name(crate::name_bytes(v))),
+            Some(Some(v)) => d.set(b"DV".to_vec(), PdfString::text(v)),
+            Some(None) => {
+                d.remove(b"DV");
+            }
+            None => {}
+        }
+        if props.font_size.is_some() || props.look.is_some() || props.appearance.is_some_and(|p| p.font.is_some() || p.text.is_some()) {
+            d.set(b"DA".to_vec(), PdfString::literal(new_da.clone().into_bytes()));
+        }
+    })?;
+    if props.appearance.is_some() || (props.font_size.is_some() && props.look.is_none()) {
+        let patch = &props.appearance.unwrap_or_default();
+        for w in &f.widgets {
+            patch_widget_look(doc, w, patch)?;
+            // A widget's own /DA overrides its field's /DA. Patch that override separately
+            // rather than replacing its font or colour with the first widget's defaults.
+            if w.obj != f.obj && (props.font_size.is_some() || patch.font.is_some() || patch.text.is_some()) {
+                let da = doc
+                    .get(w.obj)
+                    .as_dict()
+                    .and_then(|d| d.get(b"DA").cloned())
+                    .map(|v| doc.resolve(&v))
+                    .and_then(|v| v.as_string().map(|s| s.to_text()));
+                if let Some(da) = da {
+                    let da = patch_da(&da, props.font_size, patch);
+                    doc.update_dict(w.obj, |d| d.set(b"DA".to_vec(), PdfString::literal(da.into_bytes())))?;
+                }
+            }
+        }
+    }
+    if let Some(l) = &props.look {
+        let arr = |c: [f64; 3]| Object::Array(c.iter().map(|v| Object::Real(v.clamp(0.0, 1.0))).collect());
+        for w in &f.widgets {
+            // Resolved first: an indirect /MK keeps its mark, rotation and other entries.
+            let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
+            doc.update_dict(w.obj, |d| {
+                match l.border {
+                    Some(c) => mk.set(b"BC".to_vec(), arr(c)),
+                    None => {
+                        mk.remove(b"BC");
+                    }
+                }
+                match l.fill {
+                    Some(c) => mk.set(b"BG".to_vec(), arr(c)),
+                    None => {
+                        mk.remove(b"BG");
+                    }
+                }
+                d.set(b"MK".to_vec(), Object::Dict(mk));
+                let mut bs = Dict::new();
+                bs.set(b"W".to_vec(), Object::Real(l.width.clamp(0.0, 12.0)));
+                bs.set(b"S".to_vec(), Object::name(l.style.code()));
+                if l.style == BorderStyle::Dashed {
+                    bs.set(b"D".to_vec(), Object::Array(vec![Object::Int(3)]));
+                }
+                d.set(b"BS".to_vec(), Object::Dict(bs));
+            })?;
+        }
+    }
+    if let Some(style) = props.check_style {
+        for w in &f.widgets {
+            // Resolved first: an indirect /MK keeps its colours.
+            let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
+            mk.set(b"CA".to_vec(), PdfString::text(style.code()));
+            doc.update_dict(w.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
+        }
+    }
+    if let Some((wi, r)) = props.rect {
+        let w = f.widgets.get(wi).ok_or_else(|| FormError::Invalid(format!("{name} has no widget {}", wi + 1)))?;
+        let r = [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])];
+        if !r.iter().all(|v| v.is_finite()) || r[2] - r[0] < MIN_FIELD_SIDE || r[3] - r[1] < MIN_FIELD_SIDE {
+            return invalid("the field is too small");
+        }
+        doc.update_dict(w.obj, |d| d.set(b"Rect".to_vec(), Object::Array(r.iter().map(|v| Object::Real(*v)).collect())))?;
+    }
+    if props.format.is_some() || props.validate.is_some() || props.calculate.is_some() {
+        if !matches!(f.kind, FieldKind::Text | FieldKind::Combo) {
+            return invalid("only text fields and drop-down lists have format, validate and calculate scripts");
+        }
+        let mut aa = doc
+            .get(f.obj)
+            .as_dict()
+            .and_then(|d| d.get(b"AA").cloned())
+            .map(|a| doc.resolve(&a))
+            .and_then(|a| a.as_dict().cloned())
+            .unwrap_or_default();
+        let action = |js: &str| -> Object {
+            let mut a = Dict::new();
+            a.set(b"S".to_vec(), Object::name("JavaScript"));
+            a.set(b"JS".to_vec(), PdfString::literal(js.as_bytes().to_vec()));
+            Object::Dict(a)
+        };
+        if let Some(fm) = &props.format {
+            aa.remove(b"F");
+            aa.remove(b"K");
+            if let Some((fjs, kjs)) = crate::af::format_js(fm) {
+                if !fjs.is_empty() {
+                    aa.set(b"F".to_vec(), action(&fjs));
+                }
+                aa.set(b"K".to_vec(), action(&kjs));
+            }
+        }
+        if let Some(v) = &props.validate {
+            aa.remove(b"V");
+            if let Some(js) = crate::af::validate_js(v) {
+                aa.set(b"V".to_vec(), action(&js));
+            }
+        }
+        if let Some(c) = &props.calculate {
+            aa.remove(b"C");
+            if let Some(js) = crate::af::calculate_js(c) {
+                aa.set(b"C".to_vec(), action(&js));
+            }
+            crate::calc_order::keep_listed(doc, f.obj, *c != crate::af::Calculate::None)?;
+        }
+        doc.update_dict(f.obj, |d| {
+            if aa.is_empty() {
+                d.remove(b"AA");
+            } else {
+                d.set(b"AA".to_vec(), Object::Dict(aa));
+            }
+        })?;
+    }
+    // A complete look replaces widget /DA overrides. Partial changes were patched above
+    // against each override, including size-only changes that keep its font and colour.
+    if props.look.is_some() {
+        for w in &f.widgets {
+            if w.obj != f.obj {
+                doc.update_dict(w.obj, |d| {
+                    if d.contains(b"DA") {
+                        d.set(b"DA".to_vec(), PdfString::literal(new_da.clone().into_bytes()));
+                    }
+                })?;
+            }
+        }
+    }
+    if let (Some((wi, rot)), Some(swapped)) = (props.rotation, rotated_rect)
+        && let Some(w) = f.widgets.get(wi)
+    {
+        if let Some(rect) = swapped {
+            doc.update_dict(w.obj, |d| d.set(b"Rect".to_vec(), Object::Array(rect.iter().map(|v| Object::Real(*v)).collect())))?;
+        }
+        let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
+        if rot == 0 {
+            mk.remove(b"R");
+        } else {
+            mk.set(b"R".to_vec(), Object::Int(rot));
+        }
+        doc.update_dict(w.obj, |d| {
+            if mk.is_empty() {
+                d.remove(b"MK");
+            } else {
+                d.set(b"MK".to_vec(), Object::Dict(mk));
+            }
+        })?;
+    }
+    if let Some((wi, caption)) = &props.caption
+        && let Some(w) = f.widgets.get(*wi)
+    {
+        // Copy an indirect/shared MK before patching it; colours, icons, rotation and
+        // unknown entries belong to this widget, and other owners keep their old label.
+        let mut mk = doc.get(w.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m).as_dict().cloned())).flatten().unwrap_or_default();
+        mk.set(b"CA".to_vec(), PdfString::text(caption));
+        doc.update_dict(w.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
+    }
+    // A label-only edit must not replace another widget's custom appearances.
+    let only = props.caption.as_ref().filter(|_| *props == (FieldProps { caption: props.caption.clone(), ..Default::default() })).map(|(wi, _)| *wi);
+    redraw_widgets(doc, &new_name, only)?;
+    if props.calculate.is_some() {
+        crate::recalculate(doc)?;
+    }
+    Ok(new_name)
+}
+
+/// Name field `old` `new` in each field's Calculate script that reads it
+/// ([`crate::af::rename_in_calculation`]).
+fn rename_in_calculations(doc: &mut Document, all: &[Field], old: &str, new: &str) -> Result<(), FormError> {
+    let aa_of =
+        |doc: &Document, r: ObjRef| doc.get(r).as_dict().and_then(|d| d.get(b"AA").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned());
+    for f in all {
+        // The script is the field's, or its only widget's when the field has none, as
+        // `actions_of` reads it.
+        let only_widget = || match f.widgets.as_slice() {
+            [w] => aa_of(doc, w.obj).map(|aa| (w.obj, aa)),
+            _ => None,
+        };
+        let Some((owner, mut aa)) = aa_of(doc, f.obj).map(|aa| (f.obj, aa)).or_else(only_widget) else { continue };
+        let Some(mut action) = aa.get(b"C").and_then(|a| doc.resolve(a).as_dict().cloned()) else { continue };
+        let js = match action.get(b"JS").map(|js| doc.resolve(js)).as_deref() {
+            Some(Object::String(s)) => s.to_text(),
+            // A stream that isn't UTF-8 reads with replacement characters, which must not be
+            // written back in place of what it holds.
+            Some(Object::Stream(s)) => match s.decoded().ok().and_then(|b| String::from_utf8(b).ok()) {
+                Some(js) => js,
+                None => continue,
+            },
+            _ => continue,
+        };
+        let Some(js) = crate::af::rename_in_calculation(&js, old, new) else { continue };
+        action.set(b"JS".to_vec(), PdfString::text(&js));
+        aa.set(b"C".to_vec(), Object::Dict(action));
+        doc.update_dict(owner, |d| d.set(b"AA".to_vec(), Object::Dict(aa)))?;
+    }
+    Ok(())
+}
diff --git a/crates/forms/src/author/lifecycle.rs b/crates/forms/src/author/lifecycle.rs
new file mode 100644
index 0000000000..745ab3b341
--- /dev/null
+++ b/crates/forms/src/author/lifecycle.rs
@@ -0,0 +1,326 @@
+use super::look::redraw_field;
+use super::tree::{add_to_page, attach, clash, detach, ensure_form, free_name, name_parts, top_names};
+use super::*;
+
+fn widget_dict(page: ObjRef, rect: [f64; 4]) -> Dict {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("Annot"));
+    d.set(b"Subtype".to_vec(), Object::name("Widget"));
+    d.set(b"Rect".to_vec(), Object::Array(rect.iter().map(|v| Object::Real(*v)).collect()));
+    d.set(b"P".to_vec(), Object::Ref(page));
+    d.set(b"F".to_vec(), Object::Int(4));
+    let mut mk = Dict::new();
+    mk.set(b"BC".to_vec(), rgb([0.55, 0.55, 0.55]));
+    mk.set(b"BG".to_vec(), rgb([1.0, 1.0, 1.0]));
+    d.set(b"MK".to_vec(), Object::Dict(mk));
+    let mut bs = Dict::new();
+    bs.set(b"W".to_vec(), Object::Int(1));
+    bs.set(b"S".to_vec(), Object::name("S"));
+    d.set(b"BS".to_vec(), Object::Dict(bs));
+    d
+}
+
+/// Add a field on `page` (0-based) in `rect` (user space). Returns its full name.
+pub fn add_field(doc: &mut Document, page: usize, rect: [f64; 4], kind: &NewField, name: Option<&str>) -> Result<String, FormError> {
+    let pages = page_refs(doc);
+    let page_ref = *pages.get(page).ok_or_else(|| FormError::Invalid(format!("page {} does not exist", page + 1)))?;
+    let rect = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
+    if !rect.iter().all(|v| v.is_finite()) || rect[2] - rect[0] < MIN_FIELD_SIDE || rect[3] - rect[1] < MIN_FIELD_SIDE {
+        return invalid("the field is too small");
+    }
+    let existing = fields(doc);
+    // A radio button names its group: a new group takes that name.
+    let name = match (name, kind) {
+        (None, NewField::Radio { group: Some(g), .. }) => Some(g.as_str()),
+        _ => name,
+    };
+    let name = match name.map(str::trim) {
+        Some(n) if !n.is_empty() => n.to_string(),
+        _ => free_name(&existing, &top_names(doc), kind.base_name()),
+    };
+    let parts = name_parts(&name)?;
+    let radio_group = match kind {
+        NewField::Radio { group, .. } => existing.iter().find(|f| f.kind == FieldKind::Radio && Some(&f.name) == group.as_ref()).cloned(),
+        _ => None,
+    };
+    if radio_group.is_none()
+        && let Some(why) = existing.iter().find_map(|f| clash(&name, &f.name))
+    {
+        return invalid(why);
+    }
+    let af = ensure_form(doc)?;
+    let mut w = widget_dict(page_ref, rect);
+    let field_name = match kind {
+        NewField::Radio { group: Some(g), .. } if radio_group.is_some() => g.clone(),
+        _ => name.clone(),
+    };
+    match kind {
+        NewField::Text { multiline } => {
+            w.set(b"FT".to_vec(), Object::name("Tx"));
+            // Auto size (0): a fixed 12 pt is clipped in a box shorter than that (#1888).
+            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
+            if *multiline {
+                w.set(b"Ff".to_vec(), Object::Int(flags::MULTILINE as i64));
+            }
+        }
+        NewField::Date => {
+            w.set(b"FT".to_vec(), Object::name("Tx"));
+            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
+            // Acrobat's format and keystroke actions for mm/dd/yyyy (run by its JavaScript engine).
+            let js = |s: &str| {
+                let mut a = Dict::new();
+                a.set(b"S".to_vec(), Object::name("JavaScript"));
+                a.set(b"JS".to_vec(), PdfString::literal(s.as_bytes().to_vec()));
+                Object::Dict(a)
+            };
+            let mut aa = Dict::new();
+            aa.set(b"F".to_vec(), js("AFDate_FormatEx(\"mm/dd/yyyy\");"));
+            aa.set(b"K".to_vec(), js("AFDate_KeystrokeEx(\"mm/dd/yyyy\");"));
+            w.set(b"AA".to_vec(), Object::Dict(aa));
+        }
+        NewField::CheckBox => {
+            w.set(b"FT".to_vec(), Object::name("Btn"));
+            w.set(b"V".to_vec(), Object::name("Off"));
+            w.set(b"AS".to_vec(), Object::name("Off"));
+            w.set(b"DA".to_vec(), PdfString::literal(b"/ZaDb 0 Tf 0 g".to_vec()));
+        }
+        NewField::Radio { export, .. } => {
+            w.set(b"AS".to_vec(), Object::name("Off"));
+            if export.trim().is_empty() || export == "Off" {
+                return invalid("a radio button needs an export value other than Off");
+            }
+        }
+        NewField::Combo { options, editable } | NewField::List { options, multi: editable } => {
+            w.set(b"FT".to_vec(), Object::name("Ch"));
+            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 12 Tf 0 g".to_vec()));
+            let combo = matches!(kind, NewField::Combo { .. });
+            let mut ff = 0;
+            if combo {
+                ff |= flags::COMBO;
+                if *editable {
+                    ff |= flags::EDIT;
+                }
+            } else if *editable {
+                ff |= flags::MULTI_SELECT;
+            }
+            w.set(b"Ff".to_vec(), Object::Int(ff as i64));
+            w.set(b"Opt".to_vec(), Object::Array(options.iter().map(|o| Object::String(PdfString::text(o))).collect()));
+        }
+        NewField::Button { caption } => {
+            w.set(b"FT".to_vec(), Object::name("Btn"));
+            w.set(b"Ff".to_vec(), Object::Int(flags::PUSH_BUTTON as i64));
+            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
+            let mut mk = w.get(b"MK").and_then(|m| m.as_dict()).cloned().unwrap_or_default();
+            mk.set(b"BG".to_vec(), rgb([0.86, 0.86, 0.86]));
+            mk.set(b"CA".to_vec(), PdfString::text(caption));
+            w.set(b"MK".to_vec(), Object::Dict(mk));
+        }
+        NewField::Image => {
+            w.set(b"FT".to_vec(), Object::name("Btn"));
+            w.set(b"Ff".to_vec(), Object::Int(flags::PUSH_BUTTON as i64));
+            w.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
+            let mut mk = w.get(b"MK").and_then(|m| m.as_dict()).cloned().unwrap_or_default();
+            // Icon only, no border or fill: the picture is the field.
+            mk.remove(b"BC");
+            mk.remove(b"BG");
+            mk.set(b"TP".to_vec(), Object::Int(1));
+            w.set(b"MK".to_vec(), Object::Dict(mk));
+            let mut a = Dict::new();
+            a.set(b"S".to_vec(), Object::name("JavaScript"));
+            a.set(b"JS".to_vec(), PdfString::literal(b"event.target.buttonImportIcon();".to_vec()));
+            w.set(b"A".to_vec(), Object::Dict(a));
+        }
+        NewField::Signature => {
+            w.set(b"FT".to_vec(), Object::name("Sig"));
+        }
+    }
+    let widget = doc.add(Object::Dict(w));
+    match kind {
+        NewField::Radio { export, .. } => {
+            let group = match &radio_group {
+                Some(g) => g.obj,
+                None => {
+                    let mut g = Dict::new();
+                    g.set(b"FT".to_vec(), Object::name("Btn"));
+                    g.set(b"Ff".to_vec(), Object::Int((flags::RADIO | flags::NO_TOGGLE_TO_OFF) as i64));
+                    g.set(b"V".to_vec(), Object::name("Off"));
+                    g.set(b"DA".to_vec(), PdfString::literal(b"/ZaDb 0 Tf 0 g".to_vec()));
+                    g.set(b"Kids".to_vec(), Object::Array(Vec::new()));
+                    let g = doc.add(Object::Dict(g));
+                    attach(doc, af, g, &parts)?;
+                    g
+                }
+            };
+            doc.update_dict(widget, |d| d.set(b"Parent".to_vec(), Object::Ref(group)))?;
+            doc.update_dict(group, |d| {
+                let mut kids = d.get(b"Kids").and_then(|k| k.as_array().cloned()).unwrap_or_default();
+                kids.push(Object::Ref(widget));
+                d.set(b"Kids".to_vec(), Object::Array(kids));
+            })?;
+            let w = Widget {
+                obj: widget,
+                page: Some(page),
+                rect,
+                on_state: Some(export.clone()),
+                state: Some("Off".into()),
+                tab: usize::MAX,
+                locked: false,
+                hidden: false,
+                read_only: false,
+                rotation: 0,
+                caption: None,
+                list: None,
+                round: true,
+            };
+            let ap = appearance::check_box_states(doc, &w, FieldKind::Radio, export, "/ZaDb 0 Tf 0 g");
+            doc.update_dict(widget, |d| d.set(b"AP".to_vec(), Object::Dict(ap)))?;
+        }
+        _ => attach(doc, af, widget, &parts)?,
+    }
+    add_to_page(doc, page_ref, widget)?;
+    redraw_field(doc, &field_name)?;
+    Ok(field_name)
+}
+
+/// Delete a field: its widgets leave their pages and the field leaves the form.
+pub fn delete_field(doc: &mut Document, name: &str) -> Result<(), FormError> {
+    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    delete_found_field(doc, f)
+}
+
+/// [`delete_field`] for the field object `obj`, when separate fields share one name.
+pub fn delete_field_object(doc: &mut Document, obj: ObjRef) -> Result<(), FormError> {
+    let f = fields(doc).into_iter().find(|f| f.obj == obj).ok_or_else(|| FormError::NoSuchField(format!("{obj:?}")))?;
+    delete_found_field(doc, f)
+}
+
+fn delete_found_field(doc: &mut Document, f: Field) -> Result<(), FormError> {
+    let widgets: std::collections::HashSet<ObjRef> = f.widgets.iter().map(|w| w.obj).collect();
+    for p in page_refs(doc) {
+        let Some(a) = doc.get(p).as_dict().and_then(|d| d.get(b"Annots").cloned()) else { continue };
+        let list = doc.resolve(&a).as_array().cloned().unwrap_or_default();
+        let kept: Vec<Object> = list.iter().filter(|o| !o.as_ref().is_some_and(|r| widgets.contains(&r))).cloned().collect();
+        if kept.len() != list.len() {
+            match a.as_ref() {
+                Some(r) if doc.get(r).as_array().is_some() => doc.set(r, Object::Array(kept)),
+                _ => doc.update_dict(p, |d| d.set(b"Annots".to_vec(), Object::Array(kept)))?,
+            }
+        }
+    }
+    detach(doc, f.obj)?;
+    // Out of the calculation order too: a `/CO` entry would keep the field, its value and its
+    // widgets reachable for a full save.
+    drop_from_calculation_order(doc, |r| r == f.obj || widgets.contains(&r))
+}
+
+/// Remove the `/CO` entries `gone` matches, whether the form and the array are held directly or
+/// by reference.
+fn drop_from_calculation_order(doc: &mut Document, gone: impl Fn(ObjRef) -> bool) -> Result<(), FormError> {
+    let Some(root) = doc.root() else { return Ok(()) };
+    let Some(af_obj) = doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").cloned()) else { return Ok(()) };
+    let Some(mut af) = doc.resolve(&af_obj).as_dict().cloned() else { return Ok(()) };
+    let Some(co_obj) = af.get(b"CO").cloned() else { return Ok(()) };
+    let co = doc.resolve(&co_obj).as_array().cloned().unwrap_or_default();
+    let kept: Vec<Object> = co.iter().filter(|o| !o.as_ref().is_some_and(&gone)).cloned().collect();
+    if kept.len() == co.len() {
+        return Ok(());
+    }
+    match (co_obj.as_ref(), af_obj.as_ref()) {
+        (Some(r), _) if doc.get(r).as_array().is_some() => doc.set(r, Object::Array(kept)),
+        (_, Some(af_ref)) => doc.update_dict(af_ref, |d| d.set(b"CO".to_vec(), Object::Array(kept)))?,
+        (_, None) => {
+            af.set(b"CO".to_vec(), Object::Array(kept));
+            doc.update_dict(root, |d| d.set(b"AcroForm".to_vec(), Object::Dict(af)))?;
+        }
+    }
+    Ok(())
+}
+
+/// Widget-only keys: they stay with each widget when a merged field is split.
+const WIDGET_KEYS: [&[u8]; 12] = [b"Type", b"Subtype", b"Rect", b"P", b"AP", b"AS", b"MK", b"F", b"BS", b"Border", b"H", b"StructParent"];
+
+/// Duplicate a field onto other pages (Acrobat: right-click a field ▸ Duplicate): each page
+/// gets a widget at the same place, belonging to the same field, so they share one value.
+/// A field that is its own widget is first split into a field and a widget kid. Returns how
+/// many widgets were added (pages that already have one are skipped).
+pub fn duplicate_field(doc: &mut Document, name: &str, pages: &[usize]) -> Result<usize, FormError> {
+    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    let model = f.widgets.first().cloned().ok_or_else(|| FormError::Invalid(format!("{name} has no widget")))?;
+    let refs = page_refs(doc);
+    for p in pages {
+        if *p >= refs.len() {
+            return invalid(format!("page {} does not exist", p + 1));
+        }
+    }
+    let have: std::collections::HashSet<usize> = f.widgets.iter().filter_map(|w| w.page).collect();
+    let targets: Vec<usize> = pages.iter().copied().filter(|p| !have.contains(p)).collect();
+    if targets.is_empty() {
+        return Ok(0);
+    }
+    // A merged field/widget becomes a field with one widget kid.
+    let mut model_ref = model.obj;
+    if model.obj == f.obj {
+        let d = doc.get(f.obj).as_dict().cloned().unwrap_or_default();
+        let mut kid = Dict::new();
+        for k in WIDGET_KEYS {
+            if let Some(v) = d.get(k) {
+                kid.set(k.to_vec(), v.clone());
+            }
+        }
+        kid.set(b"Parent".to_vec(), Object::Ref(f.obj));
+        let kr = doc.add(Object::Dict(kid));
+        doc.update_dict(f.obj, |d| {
+            for k in WIDGET_KEYS {
+                d.remove(k);
+            }
+            d.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(kr)]));
+        })?;
+        // The page lists the widget now, not the field.
+        if let Some(p) = model.page {
+            let pr = refs[p];
+            let annots = doc.get(pr).as_dict().and_then(|d| d.get(b"Annots").cloned());
+            let swap =
+                |a: Vec<Object>| -> Vec<Object> { a.into_iter().map(|o| if o.as_ref() == Some(f.obj) { Object::Ref(kr) } else { o }).collect() };
+            match annots {
+                Some(Object::Ref(ar)) => {
+                    let a = doc.get(ar).as_array().cloned().unwrap_or_default();
+                    doc.set(ar, Object::Array(swap(a)));
+                }
+                Some(Object::Array(a)) => doc.update_dict(pr, |d| d.set(b"Annots".to_vec(), Object::Array(swap(a))))?,
+                _ => {}
+            }
+        }
+        model_ref = kr;
+    }
+    let template = doc.get(model_ref).as_dict().cloned().unwrap_or_default();
+    let mut added = Vec::new();
+    for p in &targets {
+        let pr = refs[*p];
+        let mut w = template.clone();
+        w.set(b"P".to_vec(), Object::Ref(pr));
+        w.set(b"Parent".to_vec(), Object::Ref(f.obj));
+        w.remove(b"StructParent");
+        let wr = doc.add(Object::Dict(w));
+        let annots = doc.get(pr).as_dict().and_then(|d| d.get(b"Annots").cloned());
+        match annots {
+            Some(Object::Ref(ar)) => {
+                let mut a = doc.get(ar).as_array().cloned().unwrap_or_default();
+                a.push(Object::Ref(wr));
+                doc.set(ar, Object::Array(a));
+            }
+            other => {
+                let mut a = other.and_then(|o| o.as_array().cloned()).unwrap_or_default();
+                a.push(Object::Ref(wr));
+                doc.update_dict(pr, |d| d.set(b"Annots".to_vec(), Object::Array(a)))?;
+            }
+        }
+        added.push(wr);
+    }
+    doc.update_dict(f.obj, |d| {
+        let mut kids = d.get(b"Kids").and_then(|k| k.as_array().cloned()).unwrap_or_default();
+        kids.extend(added.iter().map(|r| Object::Ref(*r)));
+        d.set(b"Kids".to_vec(), Object::Array(kids));
+    })?;
+    redraw_field(doc, name)?;
+    Ok(added.len())
+}
diff --git a/crates/forms/src/author/look.rs b/crates/forms/src/author/look.rs
new file mode 100644
index 0000000000..6044bdc70b
--- /dev/null
+++ b/crates/forms/src/author/look.rs
@@ -0,0 +1,473 @@
+use super::*;
+
+/// The Appearance tab: borders, colours and text.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Look {
+    pub border: Option<[f64; 3]>,
+    pub fill: Option<[f64; 3]>,
+    /// Line thickness in points (Acrobat: thin 1, medium 2, thick 3).
+    pub width: f64,
+    pub style: BorderStyle,
+    pub text: [f64; 3],
+    pub font: FieldFont,
+}
+
+/// A partial Appearance-tab edit. Outer `None` keeps a property; `Some(None)` removes a
+/// border or fill colour. The patch is applied to each widget's own dictionaries.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub struct LookPatch {
+    pub border: Option<Option<[f64; 3]>>,
+    pub fill: Option<Option<[f64; 3]>>,
+    pub width: Option<f64>,
+    pub style: Option<BorderStyle>,
+    pub text: Option<[f64; 3]>,
+    pub font: Option<FieldFont>,
+}
+
+impl LookPatch {
+    pub(super) fn validate(&self) -> Result<(), FormError> {
+        for c in self.border.flatten().into_iter().chain(self.fill.flatten()).chain(self.text) {
+            if !c.iter().all(|v| v.is_finite() && (0.0..=1.0).contains(v)) {
+                return invalid("appearance colours must be finite RGB values between 0 and 1");
+            }
+        }
+        if self.width.is_some_and(|v| !v.is_finite() || !(0.0..=12.0).contains(&v)) {
+            return invalid("border width must be between 0 and 12 points");
+        }
+        Ok(())
+    }
+}
+
+/// Rewrite only the selected operators in place: the last `Tf` (font and size) and the last
+/// fill colour (`g`, `rg` or `k`), appending one when the string has none. Everything else (a
+/// custom font resource, colour space or other graphics state) is kept, and repeated edits don't
+/// grow the string.
+pub(super) fn patch_da(da: &str, size: Option<f64>, patch: &LookPatch) -> String {
+    if patch.font.is_none() && size.is_none() && patch.text.is_none() {
+        return da.to_string();
+    }
+    let mut toks: Vec<String> = da.split_whitespace().map(str::to_string).collect();
+    let numeric = |s: &str| s.parse::<f64>().is_ok();
+    if patch.font.is_some() || size.is_some() {
+        let old = appearance::parse_da(da);
+        let font = patch.font.map_or_else(|| old.font.clone(), |f| f.resource().to_string());
+        // `parse_da` reads sizes up to 300 points; keep the same bound when writing.
+        let size = appearance::fmt(size.unwrap_or(old.size).clamp(0.0, 300.0));
+        let at = toks.iter().enumerate().rev().find(|(i, t)| t.as_str() == "Tf" && *i >= 2).map(|(i, _)| i);
+        match at {
+            Some(i) => {
+                if let Some(slot) = toks.get_mut(i - 2) {
+                    *slot = format!("/{font}");
+                }
+                if let Some(slot) = toks.get_mut(i - 1) {
+                    *slot = size;
+                }
+            }
+            None => toks.extend([format!("/{font}"), size, "Tf".into()]),
+        }
+    }
+    if let Some(c) = patch.text {
+        let rgb = [appearance::fmt(c[0]), appearance::fmt(c[1]), appearance::fmt(c[2]), "rg".into()];
+        let at = toks.iter().enumerate().rev().find_map(|(i, t)| {
+            let n = match t.as_str() {
+                "g" => 1,
+                "rg" => 3,
+                "k" => 4,
+                _ => return None,
+            };
+            let start = i.checked_sub(n)?;
+            toks.get(start..i).is_some_and(|ops| ops.iter().all(|o| numeric(o))).then_some((start, i))
+        });
+        match at {
+            Some((start, end)) => {
+                toks.splice(start..=end, rgb);
+            }
+            None => toks.extend(rgb),
+        }
+    }
+    toks.join(" ")
+}
+
+pub(super) fn patch_widget_look(doc: &mut Document, w: &Widget, patch: &LookPatch) -> Result<(), FormError> {
+    let touches_mk = patch.border.is_some() || patch.fill.is_some();
+    let touches_bs = patch.width.is_some() || patch.style.is_some();
+    // A size- or font-only edit changes /DA, not the widget: leave it out of the save.
+    if !touches_mk && !touches_bs {
+        return Ok(());
+    }
+    let wd = doc.get(w.obj).as_dict().cloned().ok_or_else(|| FormError::Invalid("the widget is not a dictionary".into()))?;
+    if touches_mk {
+        let indirect = wd.get(b"MK").and_then(Object::as_ref);
+        let mut mk = wd.get(b"MK").map(|m| doc.resolve(m)).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
+        for (key, change) in [(b"BC".as_slice(), patch.border), (b"BG".as_slice(), patch.fill)] {
+            if let Some(change) = change {
+                match change {
+                    Some(c) => mk.set(key.to_vec(), rgb(c)),
+                    None => {
+                        mk.remove(key);
+                    }
+                }
+            }
+        }
+        // A shared indirect /MK is updated where it lives, not copied into each widget.
+        match indirect {
+            Some(r) => doc.set(r, Object::Dict(mk)),
+            None => doc.update_dict(w.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?,
+        }
+    }
+    if touches_bs {
+        let indirect = wd.get(b"BS").and_then(Object::as_ref);
+        let mut bs = wd.get(b"BS").map(|b| doc.resolve(b)).and_then(|b| b.as_dict().cloned()).unwrap_or_default();
+        if let Some(width) = patch.width {
+            bs.set(b"W".to_vec(), Object::Real(width));
+        }
+        if let Some(style) = patch.style {
+            bs.set(b"S".to_vec(), Object::name(style.code()));
+            if style == BorderStyle::Dashed && !bs.contains(b"D") {
+                bs.set(b"D".to_vec(), Object::Array(vec![Object::Int(3)]));
+            }
+        }
+        match indirect {
+            Some(r) => doc.set(r, Object::Dict(bs)),
+            None => doc.update_dict(w.obj, |d| d.set(b"BS".to_vec(), Object::Dict(bs)))?,
+        }
+    }
+    Ok(())
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum BorderStyle {
+    Solid,
+    Dashed,
+    Beveled,
+    Inset,
+    Underline,
+}
+
+impl BorderStyle {
+    pub const ALL: [BorderStyle; 5] = [BorderStyle::Solid, BorderStyle::Dashed, BorderStyle::Beveled, BorderStyle::Inset, BorderStyle::Underline];
+
+    pub(super) fn code(self) -> &'static str {
+        match self {
+            BorderStyle::Solid => "S",
+            BorderStyle::Dashed => "D",
+            BorderStyle::Beveled => "B",
+            BorderStyle::Inset => "I",
+            BorderStyle::Underline => "U",
+        }
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            BorderStyle::Solid => "Solid",
+            BorderStyle::Dashed => "Dashed",
+            BorderStyle::Beveled => "Beveled",
+            BorderStyle::Inset => "Inset",
+            BorderStyle::Underline => "Underline",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FieldFont {
+    Helvetica,
+    Times,
+    Courier,
+}
+
+impl FieldFont {
+    pub const ALL: [FieldFont; 3] = [FieldFont::Helvetica, FieldFont::Times, FieldFont::Courier];
+
+    fn resource(self) -> &'static str {
+        match self {
+            FieldFont::Helvetica => "Helv",
+            FieldFont::Times => "TiRo",
+            FieldFont::Courier => "Cour",
+        }
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            FieldFont::Helvetica => "Helvetica",
+            FieldFont::Times => "Times Roman",
+            FieldFont::Courier => "Courier",
+        }
+    }
+}
+
+/// The mark a check box or radio button shows when on (Field Properties ▸ Options ▸ style).
+/// Stored as `/MK /CA`, the ZapfDingbats character Acrobat uses for it; PdfCraft draws the
+/// mark as paths, so no symbol font is needed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CheckStyle {
+    Check,
+    Circle,
+    Cross,
+    Diamond,
+    Square,
+    Star,
+}
+
+impl CheckStyle {
+    pub const ALL: [CheckStyle; 6] =
+        [CheckStyle::Check, CheckStyle::Circle, CheckStyle::Cross, CheckStyle::Diamond, CheckStyle::Square, CheckStyle::Star];
+
+    pub(super) fn code(self) -> &'static str {
+        match self {
+            CheckStyle::Check => "4",
+            CheckStyle::Circle => "l",
+            CheckStyle::Cross => "8",
+            CheckStyle::Diamond => "u",
+            CheckStyle::Square => "n",
+            CheckStyle::Star => "H",
+        }
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            CheckStyle::Check => "Check",
+            CheckStyle::Circle => "Circle",
+            CheckStyle::Cross => "Cross",
+            CheckStyle::Diamond => "Diamond",
+            CheckStyle::Square => "Square",
+            CheckStyle::Star => "Star",
+        }
+    }
+
+    /// A widget's style: its `/MK /CA`, else a check for check boxes and a circle for radios.
+    pub(crate) fn of_widget(doc: &Document, wd: &Dict, kind: FieldKind) -> Self {
+        let mk = wd.get(b"MK").and_then(|m| doc.resolve(m).as_dict().cloned()).unwrap_or_default();
+        let ca = mk.get(b"CA").and_then(|c| doc.resolve(c).as_string().map(|s| s.to_text()));
+        CheckStyle::ALL.into_iter().find(|s| ca.as_deref() == Some(s.code())).unwrap_or(if kind == FieldKind::Radio {
+            CheckStyle::Circle
+        } else {
+            CheckStyle::Check
+        })
+    }
+}
+
+/// A check box's or radio button's style (from its first widget).
+pub fn check_style(doc: &Document, f: &Field) -> CheckStyle {
+    let wd = f.widgets.first().and_then(|w| doc.get(w.obj).as_dict().cloned()).unwrap_or_default();
+    CheckStyle::of_widget(doc, &wd, f.kind)
+}
+
+fn rgb_of(doc: &Document, o: Option<&Object>) -> Option<[f64; 3]> {
+    let v: Vec<f64> = doc.resolve(o?).as_array()?.iter().filter_map(Object::as_f64).collect();
+    match v.len() {
+        1 => Some([v[0]; 3]),
+        3 => Some([v[0], v[1], v[2]]),
+        4 => Some([(1.0 - v[0]) * (1.0 - v[3]), (1.0 - v[1]) * (1.0 - v[3]), (1.0 - v[2]) * (1.0 - v[3])]),
+        _ => None,
+    }
+}
+
+/// A field's current look (from its first widget and its default appearance).
+pub fn look(doc: &Document, f: &Field) -> Look {
+    let wd = f.widgets.first().and_then(|w| doc.get(w.obj).as_dict().cloned()).unwrap_or_default();
+    let mk = wd.get(b"MK").and_then(|m| doc.resolve(m).as_dict().cloned()).unwrap_or_default();
+    let bs = wd.get(b"BS").and_then(|b| doc.resolve(b).as_dict().cloned()).unwrap_or_default();
+    let da = wd.get(b"DA").and_then(|o| doc.resolve(o).as_string().map(|s| s.to_text())).unwrap_or_else(|| f.da.clone());
+    let parsed = appearance::parse_da(&da);
+    let nums: Vec<f64> = parsed.color.split_whitespace().filter_map(|t| t.parse().ok()).collect();
+    let text = match nums.len() {
+        1 => [nums[0]; 3],
+        3 => [nums[0], nums[1], nums[2]],
+        4 => [(1.0 - nums[0]) * (1.0 - nums[3]), (1.0 - nums[1]) * (1.0 - nums[3]), (1.0 - nums[2]) * (1.0 - nums[3])],
+        _ => [0.0; 3],
+    };
+    Look {
+        border: rgb_of(doc, mk.get(b"BC")),
+        fill: rgb_of(doc, mk.get(b"BG")),
+        width: bs.get(b"W").and_then(|w| doc.resolve(w).as_f64()).unwrap_or(1.0),
+        style: match bs.name(b"S") {
+            Some(b"D") => BorderStyle::Dashed,
+            Some(b"B") => BorderStyle::Beveled,
+            Some(b"I") => BorderStyle::Inset,
+            Some(b"U") => BorderStyle::Underline,
+            _ => BorderStyle::Solid,
+        },
+        text,
+        font: match parsed.font.as_str() {
+            "TiRo" | "Times-Roman" => FieldFont::Times,
+            "Cour" | "Courier" => FieldFont::Courier,
+            _ => FieldFont::Helvetica,
+        },
+    }
+}
+
+/// A `/DA` string with the given font, size and colour.
+pub(super) fn da_string(font: FieldFont, size: f64, c: [f64; 3]) -> String {
+    let f = crate::appearance::fmt;
+    format!("/{} {} Tf {} {} {} rg", font.resource(), f(size.clamp(0.0, 100.0)), f(c[0]), f(c[1]), f(c[2]))
+}
+
+/// Regenerate every widget appearance of a field from its current value and settings. A value or
+/// button caption its font can't hold is drawn with `?` for those characters, the widget is marked
+/// (`pdfcraft_fonts::UNDRAWN_MARK`) and other viewers are asked to redraw the form (see
+/// `ask_viewers_to_redraw`), as when a value is set.
+pub fn redraw_field(doc: &mut Document, name: &str) -> Result<(), FormError> {
+    redraw_widgets(doc, name, None)
+}
+
+/// `redraw_field` for the widget at index `only` alone (so a caption-only edit leaves the field's
+/// other widgets' appearances as they are), or for every widget when `only` is `None`. Fails with
+/// `FormError::NoSuchField` when no field is named `name`.
+pub(super) fn redraw_widgets(doc: &mut Document, name: &str, only: Option<usize>) -> Result<(), FormError> {
+    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    let mut undrawn = false;
+    for (index, w) in f.widgets.iter().enumerate() {
+        if only.is_some_and(|only| only != index) {
+            continue;
+        }
+        let mut missing = None;
+        let ap = match f.kind {
+            FieldKind::Text | FieldKind::Combo | FieldKind::List => {
+                let (s, m) = appearance::field_appearance_drawn(doc, &f, w, &f.value, true);
+                missing = m;
+                let r = doc.add(Object::Stream(s));
+                let mut d = Dict::new();
+                d.set(b"N".to_vec(), Object::Ref(r));
+                d
+            }
+            FieldKind::CheckBox | FieldKind::Radio => {
+                let on = w.on_state.clone().unwrap_or_else(|| "Yes".into());
+                appearance::check_box_states(doc, w, f.kind, &on, &f.da)
+            }
+            FieldKind::PushButton => {
+                let (s, m) = button_appearance(doc, w, &f.da);
+                missing = m;
+                let r = doc.add(Object::Stream(s));
+                let mut d = Dict::new();
+                d.set(b"N".to_vec(), Object::Ref(r));
+                d
+            }
+            FieldKind::Signature => {
+                let s = empty_box(doc, w);
+                let r = doc.add(Object::Stream(s));
+                let mut d = Dict::new();
+                d.set(b"N".to_vec(), Object::Ref(r));
+                d
+            }
+        };
+        undrawn |= missing.is_some();
+        let existing = crate::merged_appearance(doc, w.obj, &ap);
+        doc.update_dict(w.obj, |d| {
+            d.set(b"AP".to_vec(), Object::Dict(existing));
+            pdfcraft_fonts::set_undrawn_mark(d, missing);
+        })?;
+    }
+    if undrawn {
+        crate::ask_viewers_to_redraw(doc)?;
+    }
+    Ok(())
+}
+
+fn frame_only(doc: &Document, w: &Widget) -> (String, crate::appearance::Placement) {
+    let (page_w, page_h) = ((w.rect[2] - w.rect[0]).max(1.0), (w.rect[3] - w.rect[1]).max(1.0));
+    let wobj = doc.get(w.obj);
+    let wd = wobj.as_dict().cloned().unwrap_or_default();
+    let place = crate::appearance::placement(crate::appearance::mk_rotation(doc, &wd), page_w, page_h);
+    let (width, height) = (place.layout_w, place.layout_h);
+    let mk = wd.get(b"MK").and_then(|m| m.as_dict()).cloned().unwrap_or_default();
+    let col = |k: &[u8]| -> Option<String> {
+        let v: Vec<f64> = mk.get(k)?.as_array()?.iter().filter_map(|x| x.as_f64()).collect();
+        (v.len() == 3).then(|| format!("{} {} {}", crate::appearance::fmt(v[0]), crate::appearance::fmt(v[1]), crate::appearance::fmt(v[2])))
+    };
+    let mut c = String::new();
+    if let Some(bg) = col(b"BG") {
+        c.push_str(&format!("{bg} rg 0 0 {width:.3} {height:.3} re f\n"));
+    }
+    if let Some(bc) = col(b"BC") {
+        c.push_str(&format!("{bc} RG 1 w 0.5 0.5 {:.3} {:.3} re S\n", width - 1.0, height - 1.0));
+    }
+    (c, place)
+}
+
+fn form_stream(place: crate::appearance::Placement, content: Vec<u8>, resources: Dict) -> Stream {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Form"));
+    crate::appearance::set_form_box(&mut d, place);
+    d.set(b"Resources".to_vec(), Object::Dict(resources));
+    Stream::flate(d, &content)
+}
+
+/// A push button: background, border, its icon (`/MK /I`, scaled to fit and centred) and its
+/// centred caption (unless the layout is icon only, `/TP 1`). The caption uses the font, size and
+/// color its `/DA` asks for (the widget's, else `field_da`, the field's own or inherited one).
+/// Also returns the first caption character the font can't draw (drawn as `?`), for the caller to
+/// mark and report.
+pub(crate) fn button_appearance(doc: &Document, w: &Widget, field_da: &str) -> (Stream, Option<char>) {
+    let (mut c, place) = frame_only(doc, w);
+    let (width, height) = (place.layout_w, place.layout_h);
+    let wobj = doc.get(w.obj);
+    let mk = wobj.as_dict().and_then(|d| d.get(b"MK")).map(|m| doc.resolve(m)).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
+    let caption = mk.get(b"CA").map(|c| doc.resolve(c)).and_then(|c| c.as_string().map(|s| s.to_text())).unwrap_or_default();
+    let icon_only = mk.get(b"TP").and_then(|t| doc.resolve(t).as_int()) == Some(1);
+    let mut content = std::mem::take(&mut c).into_bytes();
+    let mut xobjects = Dict::new();
+    if let Some(icon) = mk.get(b"I").and_then(Object::as_ref)
+        && let Object::Stream(s) = &*doc.get(icon)
+    {
+        let bb: Vec<f64> = s.dict.get(b"BBox").and_then(|b| b.as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default();
+        if let [x0, y0, x1, y1] = bb[..]
+            && x1 > x0
+            && y1 > y0
+        {
+            // Proportional, as large as fits (Acrobat's default icon placement), centred.
+            let k = ((width - 2.0) / (x1 - x0)).min((height - 2.0) / (y1 - y0)).max(0.0);
+            let (dx, dy) = ((width - (x1 - x0) * k) / 2.0 - x0 * k, (height - (y1 - y0) * k) / 2.0 - y0 * k);
+            content.extend(format!("q {k:.6} 0 0 {k:.6} {dx:.3} {dy:.3} cm /Icon Do Q\n").bytes());
+            xobjects.set(b"Icon".to_vec(), Object::Ref(icon));
+        }
+    }
+    let mut missing = None;
+    let mut fonts = Dict::new();
+    if !icon_only && !caption.is_empty() {
+        let da = wobj.as_dict().and_then(|d| d.get(b"DA")).and_then(|o| doc.resolve(o).as_string().map(|s| s.to_text()));
+        let auto = ((height - 4.0) * 0.6).clamp(4.0, 14.0);
+        let (ops, name, font, m) = appearance::button_caption(doc, da.as_deref().unwrap_or(field_da), &caption, width, height, auto);
+        content.extend(ops);
+        fonts.set(name.into_bytes(), font);
+        missing = m;
+    }
+    let mut res = Dict::new();
+    res.set(b"Font".to_vec(), Object::Dict(fonts));
+    if !xobjects.is_empty() {
+        res.set(b"XObject".to_vec(), Object::Dict(xobjects));
+    }
+    (form_stream(place, content, res), missing)
+}
+
+/// Give a push button (an image field) the picture `image` (an image XObject of `px` pixels):
+/// it becomes the button's icon (`/MK /I`) and its appearance.
+pub fn set_button_icon(doc: &mut Document, name: &str, image: ObjRef, px: (u32, u32)) -> Result<(), FormError> {
+    let f = fields(doc).into_iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    if f.kind != FieldKind::PushButton {
+        return invalid(format!("{name} is not a button or image field"));
+    }
+    // The icon form draws the image in a box of its pixel size (keeping its aspect ratio).
+    let (w, h) = (px.0.max(1) as f64, px.1.max(1) as f64);
+    let mut xo = Dict::new();
+    xo.set(b"Im0".to_vec(), Object::Ref(image));
+    let mut res = Dict::new();
+    res.set(b"XObject".to_vec(), Object::Dict(xo));
+    let icon =
+        doc.add(Object::Stream(form_stream(crate::appearance::placement(0, w, h), format!("q {w} 0 0 {h} 0 0 cm /Im0 Do Q").into_bytes(), res)));
+    for wd in &f.widgets {
+        let mut mk =
+            doc.get(wd.obj).as_dict().and_then(|d| d.get(b"MK").map(|m| doc.resolve(m))).and_then(|m| m.as_dict().cloned()).unwrap_or_default();
+        mk.set(b"I".to_vec(), Object::Ref(icon));
+        if !mk.contains(b"TP") {
+            mk.set(b"TP".to_vec(), Object::Int(1));
+        }
+        doc.update_dict(wd.obj, |d| d.set(b"MK".to_vec(), Object::Dict(mk)))?;
+    }
+    redraw_field(doc, name)
+}
+
+fn empty_box(doc: &Document, w: &Widget) -> Stream {
+    let (c, place) = frame_only(doc, w);
+    form_stream(place, c.into_bytes(), Dict::new())
+}
diff --git a/crates/forms/src/author/tree.rs b/crates/forms/src/author/tree.rs
new file mode 100644
index 0000000000..4f7db4d8e1
--- /dev/null
+++ b/crates/forms/src/author/tree.rs
@@ -0,0 +1,380 @@
+use super::*;
+
+/// The AcroForm dictionary's reference, creating the form (with `/Helv` in `/DR`) if needed.
+pub(crate) fn ensure_form(doc: &mut Document) -> Result<ObjRef, FormError> {
+    let root = doc.root().ok_or(FormError::NoForm)?;
+    let existing = doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").cloned());
+    let r = match existing {
+        Some(Object::Ref(r)) if doc.get(r).as_dict().is_some() => r,
+        other => {
+            let d = other.and_then(|o| o.as_dict().cloned()).unwrap_or_default();
+            let r = doc.add(Object::Dict(d));
+            doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Ref(r)))?;
+            r
+        }
+    };
+    let mut af = doc.get(r).as_dict().cloned().unwrap_or_default();
+    if !af.contains(b"Fields") {
+        af.set(b"Fields".to_vec(), Object::Array(Vec::new()));
+    }
+    if !af.contains(b"DA") {
+        af.set(b"DA".to_vec(), PdfString::literal(b"/Helv 0 Tf 0 g".to_vec()));
+    }
+    let (dr, mut fonts) = form_fonts(doc, &af);
+    let mut added = inline_fonts_as_objects(doc, &mut fonts);
+    // Acrobat's resource names for the standard fonts its Appearance tab offers.
+    for (name, base) in [("Helv", "Helvetica"), ("TiRo", "Times-Roman"), ("Cour", "Courier")] {
+        if fonts.contains(name.as_bytes()) {
+            continue;
+        }
+        let mut f = Dict::new();
+        f.set(b"Type".to_vec(), Object::name("Font"));
+        f.set(b"Subtype".to_vec(), Object::name("Type1"));
+        f.set(b"BaseFont".to_vec(), Object::name(base));
+        f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+        let r = doc.add(Object::Dict(f));
+        fonts.set(name.as_bytes().to_vec(), Object::Ref(r));
+        added = true;
+    }
+    if added {
+        store_form_fonts(doc, &mut af, dr, fonts);
+    }
+    doc.set(r, Object::Dict(af));
+    Ok(r)
+}
+
+/// The form dictionary's `/DR` and its `/Font` dictionary, resolved (empty where missing).
+fn form_fonts(doc: &Document, af: &Dict) -> (Dict, Dict) {
+    let dr = af.get(b"DR").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
+    let fonts = dr.get(b"Font").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
+    (dr, fonts)
+}
+
+/// Each /DR font its own object: Acrobat, redrawing a text field after it is typed in, shows
+/// nothing when the font is a dictionary written inline in /DR (#3441). Fonts written inline
+/// (by an earlier save, or another writer) become objects saying the same; a font that is an
+/// object already, or an entry that isn't a dictionary, is left alone. Whether any changed.
+fn inline_fonts_as_objects(doc: &mut Document, fonts: &mut Dict) -> bool {
+    let inline: Vec<(Vec<u8>, Dict)> = fonts.iter().filter_map(|(k, v)| Some((k.clone(), v.as_dict()?.clone()))).collect();
+    let changed = !inline.is_empty();
+    for (name, font) in inline {
+        let r = doc.add(Object::Dict(font));
+        fonts.set(name, Object::Ref(r));
+    }
+    changed
+}
+
+/// Write `fonts` back as the `/DR /Font` of the form dictionary `af`. An indirect `/DR` or
+/// `/Font` stays the object it is.
+fn store_form_fonts(doc: &mut Document, af: &mut Dict, mut dr: Dict, fonts: Dict) {
+    match dr.get(b"Font").and_then(Object::as_ref) {
+        Some(fr) => doc.set(fr, Object::Dict(fonts)),
+        None => dr.set(b"Font".to_vec(), Object::Dict(fonts)),
+    }
+    match af.get(b"DR").and_then(Object::as_ref) {
+        Some(dr_ref) => doc.set(dr_ref, Object::Dict(dr)),
+        None => af.set(b"DR".to_vec(), Object::Dict(dr)),
+    }
+}
+
+/// Filling a field: the form's inline `/DR` fonts become objects (see
+/// [`inline_fonts_as_objects`]), so a form an earlier version of PdfCraft made works in Acrobat
+/// once it has been filled here too (#3441). Only the font storage changes; nothing is added.
+/// Not in a form a signature covers: there the file stays as the signer saw it, apart from the
+/// value itself.
+pub(crate) fn form_fonts_as_objects(doc: &mut Document, all: &[crate::Field]) -> Result<(), FormError> {
+    let signed = all.iter().any(|f| f.kind == crate::FieldKind::Signature && holds_value(doc, f.obj));
+    if signed {
+        return Ok(());
+    }
+    let Some(root) = doc.root() else { return Ok(()) };
+    let Some(entry) = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").cloned()) else { return Ok(()) };
+    match entry {
+        Object::Ref(r) => {
+            let Some(mut af) = doc.get(r).as_dict().cloned() else { return Ok(()) };
+            let (dr, mut fonts) = form_fonts(doc, &af);
+            if inline_fonts_as_objects(doc, &mut fonts) {
+                store_form_fonts(doc, &mut af, dr, fonts);
+                doc.set(r, Object::Dict(af));
+            }
+        }
+        // A form dictionary written directly in the catalog (the catalog's /AcroForm need not be
+        // an indirect reference) is written back there.
+        Object::Dict(mut af) => {
+            let (dr, mut fonts) = form_fonts(doc, &af);
+            if inline_fonts_as_objects(doc, &mut fonts) {
+                store_form_fonts(doc, &mut af, dr, fonts);
+                doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(af)))?;
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+/// Whether the field `r`, or the nearest ancestor that has one, holds a `/V` (the entry is
+/// inheritable, ISO 32000-2 §12.7.4). The `/Parent` chain is followed at most 64 deep, as deep
+/// as the field walk goes, so a cyclic chain ends.
+fn holds_value(doc: &Document, r: ObjRef) -> bool {
+    let mut at = r;
+    for _ in 0..=64 {
+        let obj = doc.get(at);
+        let Some(d) = obj.as_dict() else { return false };
+        if d.contains(b"V") {
+            return true;
+        }
+        match d.reference(b"Parent") {
+            Some(p) => at = p,
+            None => return false,
+        }
+    }
+    false
+}
+
+pub(super) fn add_to_page(doc: &mut Document, page: ObjRef, widget: ObjRef) -> Result<(), FormError> {
+    let existing = doc.get(page).as_dict().and_then(|d| d.get(b"Annots").cloned());
+    match existing.as_ref().and_then(|o| o.as_ref()).filter(|r| doc.get(*r).as_array().is_some()) {
+        Some(r) => {
+            let mut a = doc.get(r).as_array().cloned().unwrap_or_default();
+            a.push(Object::Ref(widget));
+            doc.set(r, Object::Array(a));
+        }
+        None => {
+            let mut a = existing.and_then(|o| o.as_array().cloned()).unwrap_or_default();
+            a.push(Object::Ref(widget));
+            doc.update_dict(page, |d| d.set(b"Annots".to_vec(), Object::Array(a)))?;
+        }
+    }
+    Ok(())
+}
+
+fn add_to_fields(doc: &mut Document, af: ObjRef, field: ObjRef) -> Result<(), FormError> {
+    let mut d = doc.get(af).as_dict().cloned().unwrap_or_default();
+    let mut list = d.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
+    list.push(Object::Ref(field));
+    d.set(b"Fields".to_vec(), Object::Array(list));
+    doc.set(af, Object::Dict(d));
+    Ok(())
+}
+
+/// The most parts a dotted field name may have ("a.b.c" has three).
+const MAX_NAME_PARTS: usize = 32;
+
+/// The field attributes a field inherits from its parents (ISO 32000-2 §12.7.4.1).
+const INHERITED_KEYS: [&[u8]; 7] = [b"FT", b"Ff", b"V", b"DV", b"DA", b"Q", b"MaxLen"];
+
+/// The parts of a full field name: `a.b` is the field `b` under the parent field `a`, since a
+/// field's own (partial) name can't contain a period (ISO 32000-2 §12.7.4.2) (#2696).
+pub(super) fn name_parts(name: &str) -> Result<Vec<&str>, FormError> {
+    let parts: Vec<&str> = name.split('.').take(MAX_NAME_PARTS.saturating_add(1)).collect();
+    if parts.len() > MAX_NAME_PARTS {
+        return invalid(format!("field names can have at most {MAX_NAME_PARTS} parts"));
+    }
+    if parts.iter().any(|p| p.trim().is_empty()) {
+        return invalid("field names can't be empty, or have an empty part between periods");
+    }
+    Ok(parts)
+}
+
+/// Why the full name `name` can't be used beside the field named `other`, if it can't: the
+/// same name, or one inside the other (a field that has a value can't also hold fields).
+pub(super) fn clash(name: &str, other: &str) -> Option<String> {
+    if name == other {
+        return Some(format!("a field named {name:?} already exists"));
+    }
+    let inside = |a: &str, b: &str| a.strip_prefix(b).is_some_and(|rest| rest.starts_with('.'));
+    (inside(name, other) || inside(other, name)).then(|| format!("{name:?} can't be used beside the field {other:?}"))
+}
+
+/// The array `key` of `holder` (`/Fields` of the form, `/Kids` of a field).
+fn list_of(doc: &Document, holder: ObjRef, key: &[u8]) -> Vec<Object> {
+    let d = doc.get(holder).as_dict().cloned().unwrap_or_default();
+    d.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default()
+}
+
+/// Add `field` to `parent`'s `/Kids`, or to the form's `/Fields` at the top.
+fn link(doc: &mut Document, af: ObjRef, parent: Option<ObjRef>, field: ObjRef) -> Result<(), FormError> {
+    let Some(p) = parent else { return add_to_fields(doc, af, field) };
+    let mut kids = list_of(doc, p, b"Kids");
+    kids.push(Object::Ref(field));
+    doc.update_dict(p, |d| d.set(b"Kids".to_vec(), Object::Array(kids)))?;
+    Ok(())
+}
+
+/// The node named `name` (its own `/T`) directly under `parent`, or at the top of the form.
+pub(super) fn child_named(doc: &Document, af: ObjRef, parent: Option<ObjRef>, name: &str) -> Option<ObjRef> {
+    let list = match parent {
+        Some(p) => list_of(doc, p, b"Kids"),
+        None => list_of(doc, af, b"Fields"),
+    };
+    list.iter()
+        .filter_map(|o| o.as_ref())
+        .find(|r| doc.get(*r).as_dict().and_then(|d| d.get(b"T").cloned()).and_then(|t| crate::text_of(&doc.resolve(&t))).as_deref() == Some(name))
+}
+
+/// The values a parent field passes to the fields under it that can't be turned off by giving
+/// the field a neutral one of its own, as `/Ff` and `/Q` can.
+const PASSED_VALUES: [&[u8]; 3] = [b"V", b"DV", b"MaxLen"];
+
+/// Whether `field` may go in the field tree under the full name `parts`, changing nothing. The
+/// field list holds only terminal fields, so a parent left empty by a move isn't in it: a node
+/// of the same name there is found here.
+/// `inherited` is what the field will hold as its own before it moves (see [`inherited`]).
+pub(super) fn check_place(doc: &Document, af: ObjRef, field: ObjRef, parts: &[&str], inherited: &Dict) -> Result<(), FormError> {
+    let Some((own, parents)) = parts.split_last() else { return invalid("field names can't be empty") };
+    let mut owned = doc.get(field).as_dict().cloned().unwrap_or_default();
+    for (k, v) in inherited.iter() {
+        owned.set(k.to_vec(), v.clone());
+    }
+    let mut at: Option<ObjRef> = None;
+    let mut whole_path = true;
+    for part in parents {
+        let Some(r) = child_named(doc, af, at, part) else {
+            whole_path = false;
+            break;
+        };
+        // A value, reset value or length limit held by a parent would pass to this field.
+        let held = doc.get(r).as_dict().is_some_and(|d| PASSED_VALUES.iter().any(|k| d.contains(k) && !owned.contains(k)));
+        if held {
+            return invalid(format!("{part:?} holds a value for the fields under it, so {:?} can't be put there", parts.join(".")));
+        }
+        at = Some(r);
+    }
+    // A field being moved is still in the tree here, but under another full name (a move to its
+    // own name changes nothing and doesn't get here), so a node found is another.
+    if whole_path && child_named(doc, af, at, own).is_some() {
+        return invalid(format!("a field named {:?} already exists", parts.join(".")));
+    }
+    Ok(())
+}
+
+/// Put `field` in the field tree under the full name `parts`: its own `/T` is the last part,
+/// and the parts before it name parent fields, reused where the tree has them and made where
+/// not (Acrobat makes `a.b` a field `b` under a field `a`).
+pub(super) fn attach(doc: &mut Document, af: ObjRef, field: ObjRef, parts: &[&str]) -> Result<(), FormError> {
+    let Some((own, parents)) = parts.split_last() else { return invalid("field names can't be empty") };
+    check_place(doc, af, field, parts, &Dict::new())?;
+    let mut parent: Option<ObjRef> = None;
+    let mut inherits = false;
+    for part in parents {
+        let next = match child_named(doc, af, parent, part) {
+            Some(r) => {
+                inherits |= doc.get(r).as_dict().is_some_and(|d| d.contains(b"Ff") || d.contains(b"Q"));
+                r
+            }
+            None => {
+                let mut d = Dict::new();
+                d.set(b"T".to_vec(), PdfString::text(part));
+                d.set(b"Kids".to_vec(), Object::Array(Vec::new()));
+                if let Some(p) = parent {
+                    d.set(b"Parent".to_vec(), Object::Ref(p));
+                }
+                let r = doc.add(Object::Dict(d));
+                link(doc, af, parent, r)?;
+                r
+            }
+        };
+        parent = Some(next);
+    }
+    doc.update_dict(field, |d| {
+        d.set(b"T".to_vec(), PdfString::text(own));
+        match parent {
+            Some(p) => d.set(b"Parent".to_vec(), Object::Ref(p)),
+            None => {
+                d.remove(b"Parent");
+            }
+        }
+        // An existing parent's flags and alignment would otherwise pass to this field.
+        if inherits {
+            for k in [&b"Ff"[..], b"Q"] {
+                if !d.contains(k) {
+                    d.set(k.to_vec(), Object::Int(0));
+                }
+            }
+        }
+    })?;
+    link(doc, af, parent, field)
+}
+
+/// What `field` inherits from its parents and doesn't hold itself, changing nothing.
+pub(super) fn inherited(doc: &Document, field: ObjRef) -> Dict {
+    let own = doc.get(field).as_dict().cloned().unwrap_or_default();
+    let mut add = Dict::new();
+    let mut seen = std::collections::HashSet::new();
+    let mut parent = own.reference(b"Parent");
+    while let Some(p) = parent {
+        if seen.len() > 64 || !seen.insert(p) {
+            break;
+        }
+        let Some(d) = doc.get(p).as_dict().cloned() else { break };
+        for k in INHERITED_KEYS {
+            if let Some(v) = d.get(k).filter(|_| !own.contains(k) && !add.contains(k)) {
+                add.set(k.to_vec(), v.clone());
+            }
+        }
+        parent = d.reference(b"Parent");
+    }
+    add
+}
+
+/// Copy onto `field` what it inherits (`add`, from [`inherited`]), so it keeps it when it moves.
+pub(super) fn own_inherited(doc: &mut Document, field: ObjRef, add: &Dict) -> Result<(), FormError> {
+    if add.iter().next().is_some() {
+        doc.update_dict(field, |d| {
+            for (k, v) in add.iter() {
+                d.set(k.to_vec(), v.clone());
+            }
+        })?;
+    }
+    Ok(())
+}
+
+/// Take `field` out of the field tree: from its parent's `/Kids`, or from `/Fields`.
+pub(super) fn detach(doc: &mut Document, field: ObjRef) -> Result<(), FormError> {
+    let parent = doc.get(field).as_dict().and_then(|d| d.reference(b"Parent"));
+    let remove_from = |doc: &mut Document, holder: ObjRef, key: &[u8]| -> Result<(), FormError> {
+        let mut d = doc.get(holder).as_dict().cloned().unwrap_or_default();
+        let list = d.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
+        let kept: Vec<Object> = list.into_iter().filter(|o| o.as_ref() != Some(field)).collect();
+        d.set(key.to_vec(), Object::Array(kept));
+        doc.set(holder, Object::Dict(d));
+        Ok(())
+    };
+    match parent {
+        Some(p) => remove_from(doc, p, b"Kids")?,
+        None => {
+            let root = doc.root().ok_or(FormError::NoForm)?;
+            match doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").cloned()) {
+                Some(Object::Ref(af)) => remove_from(doc, af, b"Fields")?,
+                // A form dictionary held directly in the catalog.
+                Some(Object::Dict(mut af)) => {
+                    let list = af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
+                    let kept: Vec<Object> = list.into_iter().filter(|o| o.as_ref() != Some(field)).collect();
+                    af.set(b"Fields".to_vec(), Object::Array(kept));
+                    doc.update_dict(root, |d| d.set(b"AcroForm".to_vec(), Object::Dict(af)))?;
+                }
+                _ => {}
+            }
+        }
+    }
+    Ok(())
+}
+
+/// The first free "<base>N" name: not a field's, and not held by a node at the top of the field
+/// tree (`held`), such as a parent field left empty by a move, which isn't in `existing`.
+pub(super) fn free_name(existing: &[Field], held: &[String], base: &str) -> String {
+    (1..=u64::MAX)
+        .map(|n| format!("{base}{n}"))
+        .find(|c| !held.contains(c) && !existing.iter().any(|f| f.name == *c || f.name.starts_with(&format!("{c}."))))
+        .unwrap_or_else(|| base.to_string())
+}
+
+/// The own names (`/T`) of the nodes in the form's `/Fields`, changing nothing.
+pub(super) fn top_names(doc: &Document) -> Vec<String> {
+    let Some(root) = doc.root() else { return Vec::new() };
+    let Some(af) = doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").map(|o| doc.resolve(o))).and_then(|o| o.as_dict().cloned()) else {
+        return Vec::new();
+    };
+    let list = af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
+    list.iter().filter_map(|o| doc.resolve(o).as_dict().and_then(|d| d.get(b"T").cloned())).filter_map(|t| crate::text_of(&doc.resolve(&t))).collect()
+}
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index 75c3dbee00..6d8cf9c99d 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -35,6 +35,27 @@ pub use scripting::{
     set_field_script,
 };
 
+mod appearances;
+mod read;
+mod tab_order;
+mod values;
+
+pub use appearances::{FieldAppearanceCache, declares_pdfa, need_appearances, undrawn_fields, with_field_appearances, with_field_appearances_cached};
+pub(crate) use read::page_refs;
+pub use read::{Fields, acroform, adopted_page_fields, fields, fields_with_adopted};
+#[cfg(test)]
+use read::{MAX_SCRIPT_BYTES, PageWalk, enumerate, form_reads};
+use read::{script, script_budget};
+pub use tab_order::{TabOrder, move_in_tab_order, set_tab_order};
+#[cfg(test)]
+use values::has_password_flag;
+use values::write_value;
+pub(crate) use values::{ask_viewers_to_redraw, merged_appearance};
+pub use values::{
+    calculations_changed, clear_password_values, has_password_values, password_values, recalculate, recalculate_with, reset, restore_password_values,
+    set_value, set_value_with, set_values,
+};
+
 #[cfg(test)]
 mod tests;
 
@@ -118,6 +139,9 @@ pub struct Widget {
     pub caption: Option<String>,
     /// List boxes: where the options are drawn, so a click can pick the one under the pointer.
     pub list: Option<appearance::ListRows>,
+    /// Drawn round: a radio button, or a check box laid out for a round XFA check button
+    /// (`/PCXfaRound true`).
+    pub round: bool,
 }
 
 /// A terminal form field.
@@ -264,1483 +288,6 @@ fn name_obj(text: &str) -> Object {
     Object::Name(name_bytes(text))
 }
 
-/// At most this many `/State` entries of a set-layer-visibility action are read.
-const MAX_LAYER_STATE: usize = 1024;
-
-/// A push button's mouse-up action (`/A`, or `/AA /U`, on the field or its widget).
-fn button_action(doc: &Document, d: &Dict, widgets: &[ObjRef], scripts: &mut DecodeBudget) -> Option<af::ButtonAction> {
-    // A button PdfCraft generated for an XFA image field (`/PCXfaImage true`, no PDF action):
-    // clicking it picks a picture, as `buttonImportIcon()` does.
-    if matches!(d.get(b"PCXfaImage").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true))) {
-        return Some(af::ButtonAction::ImportIcon);
-    }
-    let pick = |dict: &Dict| -> Option<Object> {
-        dict.get(b"A").cloned().or_else(|| dict.get(b"AA").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().and_then(|aa| aa.get(b"U").cloned())))
-    };
-    let action = pick(d).or_else(|| widgets.iter().find_map(|w| doc.get(*w).as_dict().and_then(pick)))?;
-    let a = doc.resolve(&action);
-    let a = a.as_dict()?;
-    let s = |k: &[u8]| a.get(k).and_then(|v| text_of(&doc.resolve(v)));
-    Some(match a.name(b"S")? {
-        b"ResetForm" => {
-            let fields = a
-                .get(b"Fields")
-                .map(|f| doc.resolve(f))
-                .and_then(|f| f.as_array().cloned())
-                .unwrap_or_default()
-                .iter()
-                .filter_map(|o| match o {
-                    Object::Ref(r) => doc.get(*r).as_dict().and_then(|fd| fd.get(b"T").and_then(|t| text_of(&doc.resolve(t)))),
-                    other => text_of(&doc.resolve(other)),
-                })
-                .collect();
-            let exclude = a.get(b"Flags").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0) & 1 != 0;
-            af::ButtonAction::Reset { fields, exclude }
-        }
-        b"Named" => af::ButtonAction::Named(String::from_utf8_lossy(a.name(b"N")?).into_owned()),
-        b"URI" => af::ButtonAction::Uri(s(b"URI")?),
-        b"SubmitForm" => af::ButtonAction::Submit(
-            a.get(b"F")
-                .map(|f| doc.resolve(f))
-                .and_then(|f| f.as_dict().and_then(|fd| fd.get(b"F").and_then(|x| text_of(&doc.resolve(x)))).or_else(|| text_of(&f)))
-                .unwrap_or_default(),
-        ),
-        b"GoTo" => {
-            let dest = doc.resolve(a.get(b"D")?);
-            let target = dest.as_array()?.first()?.as_ref()?;
-            af::ButtonAction::GoTo(page_refs(doc).iter().position(|p| *p == target)?)
-        }
-        b"Hide" => {
-            // /T: a field name, an annotation (or field) reference, or an array of them.
-            let target = |o: &Object| match o {
-                Object::Ref(r) => qualified_name(doc, *r).or_else(|| text_of(&doc.resolve(o))),
-                other => text_of(other),
-            };
-            let fields = match a.get(b"T") {
-                Some(t) => match &*doc.resolve(t) {
-                    Object::Array(items) => items.iter().filter_map(target).collect(),
-                    _ => target(t).into_iter().collect(),
-                },
-                None => Vec::new(),
-            };
-            let hide = !a.get(b"H").is_some_and(|h| matches!(&*doc.resolve(h), Object::Bool(false)));
-            af::ButtonAction::ShowHide { fields, hide }
-        }
-        b"SetOCGState" => {
-            // /State: ON, OFF or Toggle, each followed by the groups it applies to.
-            let mut changes = Vec::new();
-            if let Some(state) = a.get(b"State") {
-                let mut op = None;
-                for item in doc.resolve(state).as_array().into_iter().flatten().take(MAX_LAYER_STATE) {
-                    match item {
-                        Object::Name(n) => {
-                            op = match n.as_slice() {
-                                b"ON" => Some(af::LayerOp::On),
-                                b"OFF" => Some(af::LayerOp::Off),
-                                b"Toggle" => Some(af::LayerOp::Toggle),
-                                _ => None,
-                            }
-                        }
-                        Object::Ref(r) => changes.extend(op.map(|op| (op, (r.num, r.generation)))),
-                        _ => {}
-                    }
-                }
-            }
-            let preserve_rb = !a.get(b"PreserveRB").is_some_and(|p| matches!(&*doc.resolve(p), Object::Bool(false)));
-            af::ButtonAction::SetLayers { changes, preserve_rb }
-        }
-        b"JavaScript" => af::button_script(&script(doc, &action, scripts)?),
-        _ => return None,
-    })
-}
-
-/// The fully qualified name of the field that `r` (a field or one of its widgets) belongs to,
-/// from the partial names (`/T`) up its `/Parent` chain.
-fn qualified_name(doc: &Document, r: ObjRef) -> Option<String> {
-    let mut parts = Vec::new();
-    let mut seen = std::collections::HashSet::new();
-    let mut cur = Some(r);
-    while let Some(c) = cur {
-        if seen.len() > 64 || !seen.insert(c) {
-            break;
-        }
-        let obj = doc.get(c);
-        let d = obj.as_dict()?;
-        if let Some(t) = d.get(b"T").and_then(|o| text_of(&doc.resolve(o))) {
-            parts.push(t);
-        }
-        cur = d.get(b"Parent").and_then(|p| p.as_ref());
-    }
-    parts.reverse();
-    (!parts.is_empty()).then(|| parts.join("."))
-}
-
-/// JavaScript streams one reading of the form (its fields, or its document scripts) may decode
-/// in all, however many actions name the same stream.
-const MAX_SCRIPT_BYTES: usize = 64 << 20;
-
-/// A budget for the script streams of one reading of the form.
-fn script_budget() -> DecodeBudget {
-    DecodeBudget::new(MAX_SCRIPT_BYTES, 0)
-}
-
-/// The JavaScript of an action dictionary (`/JS` string or stream). A stream is decoded against
-/// `budget`, and is `None` once it is spent.
-fn script(doc: &Document, action: &Object, budget: &mut DecodeBudget) -> Option<String> {
-    let a = doc.resolve(action);
-    let js = a.as_dict()?.get(b"JS")?.clone();
-    match &*doc.resolve(&js) {
-        Object::String(s) => Some(s.to_text()),
-        Object::Stream(s) => budget.decode(s).ok().map(|b| String::from_utf8_lossy(&b).into_owned()),
-        _ => None,
-    }
-}
-
-/// A field's format/keystroke, validate and calculate scripts (field dictionary, or its only
-/// widget's when the field has none).
-fn actions_of(doc: &Document, d: &Dict, widgets: &[ObjRef], scripts: &mut DecodeBudget) -> af::Actions {
-    let aa = d.get(b"AA").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().cloned()).or_else(|| {
-        (widgets.len() == 1)
-            .then(|| doc.get(widgets[0]))
-            .and_then(|w| w.as_dict().and_then(|wd| wd.get(b"AA").map(|a| doc.resolve(a))))
-            .and_then(|a| a.as_dict().cloned())
-    });
-    let mut out = af::Actions::default();
-    let Some(aa) = aa else { return out };
-    let mut js = |k: &[u8]| aa.get(k).and_then(|a| script(doc, a, scripts));
-    if let Some(f) = js(b"F") {
-        match af::parse_format(&f) {
-            Some(fm) => out.format = fm,
-            None if !f.trim().is_empty() => {
-                out.unsupported.push("format");
-                out.scripts.format = Some(f);
-            }
-            None => {}
-        }
-    }
-    if let Some(k) = js(b"K")
-        && out.format == af::Format::None
-    {
-        // A mask has only a keystroke script.
-        match af::parse_format(&k) {
-            Some(fm @ af::Format::Mask(_)) => out.format = fm,
-            Some(_) => {}
-            None if !k.trim().is_empty() => {
-                out.unsupported.push("keystroke");
-                out.scripts.keystroke = Some(k);
-            }
-            None => {}
-        }
-    }
-    if let Some(v) = js(b"V") {
-        match af::parse_validate(&v) {
-            Some(vv) => out.validate = vv,
-            None if !v.trim().is_empty() => {
-                out.unsupported.push("validate");
-                out.scripts.validate = Some(v);
-            }
-            None => {}
-        }
-    }
-    if let Some(c) = js(b"C") {
-        match af::parse_calculate(&c) {
-            Some(cc) => out.calculate = cc,
-            None if !c.trim().is_empty() => {
-                out.unsupported.push("calculate");
-                out.scripts.calculate = Some(c);
-            }
-            None => {}
-        }
-    }
-    out
-}
-
-fn values_of(doc: &Document, o: Option<&Object>) -> Vec<String> {
-    let Some(o) = o else { return Vec::new() };
-    match &*doc.resolve(o) {
-        Object::Array(a) => a.iter().filter_map(|x| text_of(&doc.resolve(x))).collect(),
-        Object::Stream(s) => s.decoded().ok().map(|b| PdfString::literal(b).to_text()).into_iter().collect(),
-        other => text_of(other).filter(|s| s != "Off" && !s.is_empty()).into_iter().collect(),
-    }
-}
-
-fn nums(doc: &Document, o: Option<&Object>) -> Option<Vec<f64>> {
-    let o = doc.resolve(o?);
-    o.as_array()?.iter().map(|x| doc.resolve(x).as_f64()).collect()
-}
-
-/// Leaf page objects in order (a small walker; `organize` and `annot` have their own).
-pub(crate) fn page_refs(doc: &Document) -> Vec<ObjRef> {
-    let Some(root) = doc.root() else { return Vec::new() };
-    let Some(pages) = doc.get(root).as_dict().and_then(|d| d.reference(b"Pages")) else { return Vec::new() };
-    PageWalk::new(doc, pages).collect()
-}
-
-/// Depth-first walk over the leaf pages under `top`. It keeps one cursor per open `/Kids` array,
-/// never one entry per child, so a child listed many times or shared between nodes is skipped by
-/// the seen check without being queued first (`pdfcraft_model::pages` walks the same way).
-/// Cycles end at the seen check and at most a million nodes are visited.
-struct PageWalk<'a> {
-    doc: &'a Document,
-    seen: std::collections::HashSet<ObjRef>,
-    pending: Vec<(std::sync::Arc<Object>, usize)>,
-}
-
-impl<'a> PageWalk<'a> {
-    fn new(doc: &'a Document, top: ObjRef) -> Self {
-        let top = std::sync::Arc::new(Object::Array(vec![Object::Ref(top)]));
-        Self { doc, seen: Default::default(), pending: vec![(top, 0)] }
-    }
-}
-
-impl Iterator for PageWalk<'_> {
-    type Item = ObjRef;
-
-    fn next(&mut self) -> Option<ObjRef> {
-        while let Some((kids, next)) = self.pending.last_mut() {
-            let Some(kid) = kids.as_array().and_then(|a| a.get(*next)) else {
-                self.pending.pop();
-                continue;
-            };
-            let node = kid.as_ref();
-            *next += 1;
-            let Some(node) = node else { continue };
-            if self.seen.len() >= 1_000_000 {
-                self.pending.clear();
-                return None;
-            }
-            if !self.seen.insert(node) {
-                continue;
-            }
-            let obj = self.doc.get(node);
-            let Some(d) = obj.as_dict() else { continue };
-            match d.get(b"Kids").map(|k| self.doc.resolve(k)) {
-                Some(kids) if d.name(b"Type") != Some(b"Page") => self.pending.push((kids, 0)),
-                _ => return Some(node),
-            }
-        }
-        None
-    }
-}
-
-/// The AcroForm dictionary.
-pub fn acroform(doc: &Document) -> Option<Dict> {
-    let root = doc.root()?;
-    let cat = doc.get(root);
-    let af = cat.as_dict()?.get(b"AcroForm")?.clone();
-    doc.resolve(&af).as_dict().cloned()
-}
-
-#[derive(Clone, Default)]
-struct Inherited {
-    name: String,
-    ft: Option<Vec<u8>>,
-    ff: Option<u32>,
-    v: Option<Object>,
-    dv: Option<Object>,
-    da: Option<String>,
-    q: Option<i64>,
-    max_len: Option<usize>,
-}
-
-/// Every terminal field: the `/Fields` tree in order, then the fields reachable only through the
-/// page annotations (see [`adopt_page_fields`]).
-pub fn fields(doc: &Document) -> Vec<Field> {
-    fields_with_adopted(doc).items
-}
-
-/// How many of [`fields`] were reachable only through the page annotations: the form's `/Fields`
-/// list names none or only some of them, so the leniency that adopts them is worth recording.
-pub fn adopted_page_fields(doc: &Document) -> usize {
-    fields_with_adopted(doc).adopted_page_fields
-}
-
-/// The terminal fields and page-only fields adopted while reading a form.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Fields {
-    /// Terminal fields in tree order, followed by adopted page-only fields.
-    pub items: Vec<Field>,
-    /// How many fields were reachable only through page annotations.
-    pub adopted_page_fields: usize,
-}
-
-/// Read all terminal fields and the page-only adoption count in one enumeration.
-pub fn fields_with_adopted(doc: &Document) -> Fields {
-    let (items, adopted_page_fields) = enumerate(doc);
-    Fields { items, adopted_page_fields }
-}
-
-fn enumerate(doc: &Document) -> (Vec<Field>, usize) {
-    let af = acroform(doc);
-    let mut page_of = std::collections::HashMap::new();
-    let mut annot_index = std::collections::HashMap::new();
-    let pages = page_refs(doc);
-    for (i, p) in pages.iter().enumerate() {
-        if let Some(a) = doc.get(*p).as_dict().and_then(|d| d.get(b"Annots").cloned()) {
-            for (k, e) in doc.resolve(&a).as_array().into_iter().flatten().enumerate() {
-                if let Some(r) = e.as_ref() {
-                    page_of.entry(r).or_insert(i);
-                    annot_index.entry(r).or_insert(k);
-                }
-            }
-        }
-    }
-    let base = match &af {
-        Some(af) => Inherited {
-            da: af.get(b"DA").and_then(|o| text_of(&doc.resolve(o))),
-            q: af.get(b"Q").and_then(|o| doc.resolve(o).as_int()),
-            ..Default::default()
-        },
-        None => Inherited::default(),
-    };
-    let mut out = Vec::new();
-    let mut seen = Seen { fields: std::collections::HashSet::new(), widgets: std::collections::HashSet::new(), scripts: script_budget() };
-    if let Some(af) = &af {
-        for f in af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default() {
-            if let Some(r) = f.as_ref() {
-                walk(doc, r, &base, &page_of, &mut seen, &mut out, 0);
-            }
-        }
-    }
-    let listed = out.len();
-    adopt_page_fields(doc, &pages, &base, &page_of, &mut seen, &mut out);
-    let adopted = out.len() - listed;
-    rank_tabs(doc, &pages, &annot_index, &mut out);
-    (out, adopted)
-}
-
-/// Widget annotations no `/Fields` entry reaches are adopted as fields, as Acrobat and the
-/// browsers do: some writers list only some of the fields, or none at all. Each widget is adopted
-/// through its topmost unlisted `/Parent`, so a field split across several widgets stays one
-/// field. Tree-listed fields keep their order first; the rest follow in page-annotation order.
-fn adopt_page_fields(
-    doc: &Document,
-    pages: &[ObjRef],
-    base: &Inherited,
-    page_of: &std::collections::HashMap<ObjRef, usize>,
-    seen: &mut Seen,
-    out: &mut Vec<Field>,
-) {
-    for p in pages {
-        let Some(a) = doc.get(*p).as_dict().and_then(|d| d.get(b"Annots").cloned()) else { continue };
-        let annots = doc.resolve(&a);
-        let Some(annots) = annots.as_array() else { continue };
-        for e in annots {
-            let Some(r) = e.as_ref() else { continue };
-            if seen.fields.contains(&r) || seen.widgets.contains(&r) {
-                continue;
-            }
-            let obj = doc.get(r);
-            let Some(d) = obj.as_dict() else { continue };
-            if d.name(b"Subtype") != Some(b"Widget") {
-                continue;
-            }
-            if !d.contains(b"FT") && !d.contains(b"T") && !d.contains(b"Parent") {
-                continue;
-            }
-            if let Some(root) = unlisted_root(doc, r, &seen.fields) {
-                walk(doc, root, base, page_of, seen, out, 0);
-            }
-        }
-    }
-}
-
-/// The topmost field above `r` (itself without a `/Parent`), or `None` when `r` or an ancestor is
-/// already reachable from the `/Fields` tree, or a `/Parent` loop hides the top.
-fn unlisted_root(doc: &Document, r: ObjRef, seen: &std::collections::HashSet<ObjRef>) -> Option<ObjRef> {
-    let mut top = r;
-    let mut visited = std::collections::HashSet::from([r]);
-    loop {
-        let parent = doc.get(top).as_dict().and_then(|d| d.reference(b"Parent"));
-        let Some(p) = parent else {
-            return if seen.contains(&top) { None } else { Some(top) };
-        };
-        if !visited.insert(p) || visited.len() > 64 {
-            return None;
-        }
-        if seen.contains(&p) {
-            return None;
-        }
-        top = p;
-    }
-}
-
-/// A page's tab order (`/Tabs`).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum TabOrder {
-    /// Rows, top to bottom, left to right within a row (`/R`).
-    Row,
-    /// Columns, left to right, top to bottom within a column (`/C`).
-    Column,
-    /// The document structure (`/S`; annotation order when the file has none).
-    Structure,
-    /// Unspecified: annotation order.
-    Annotations,
-}
-
-impl TabOrder {
-    fn of(name: Option<&[u8]>) -> TabOrder {
-        match name {
-            Some(b"R") => TabOrder::Row,
-            Some(b"C") => TabOrder::Column,
-            Some(b"S") => TabOrder::Structure,
-            _ => TabOrder::Annotations,
-        }
-    }
-}
-
-/// A widget on a page for tab ordering: (page, field, widget, rect, annotation index).
-type TabItem = (usize, usize, usize, [f64; 4], usize);
-
-/// Every widget's place in the tab order.
-fn rank_tabs(doc: &Document, pages: &[ObjRef], annot_index: &std::collections::HashMap<ObjRef, usize>, out: &mut [Field]) {
-    let mut items: Vec<TabItem> = Vec::new();
-    for (fi, f) in out.iter().enumerate() {
-        for (wi, w) in f.widgets.iter().enumerate() {
-            if let Some(p) = w.page {
-                items.push((p, fi, wi, w.rect, annot_index.get(&w.obj).copied().unwrap_or(usize::MAX)));
-            }
-        }
-    }
-    let mut ordered: Vec<(usize, usize)> = Vec::with_capacity(items.len());
-    for (pi, p) in pages.iter().enumerate() {
-        let mut on: Vec<_> = items.iter().filter(|i| i.0 == pi).collect();
-        if on.is_empty() {
-            continue;
-        }
-        let tabs = TabOrder::of(doc.get(*p).as_dict().and_then(|d| d.name(b"Tabs")));
-        match tabs {
-            TabOrder::Row | TabOrder::Column => {
-                let row = tabs == TabOrder::Row;
-                // Primary axis: rows by top edge (down the page), columns by left edge.
-                on.sort_by(|a, b| if row { b.3[3].total_cmp(&a.3[3]) } else { a.3[0].total_cmp(&b.3[0]) });
-                let mut groups: Vec<Vec<&TabItem>> = Vec::new();
-                for it in on {
-                    let fits = groups.last().is_some_and(|g| {
-                        let first = g[0];
-                        if row {
-                            (first.3[3] - it.3[3]).abs() < ((first.3[3] - first.3[1]) / 2.0).max(2.0)
-                        } else {
-                            (it.3[0] - first.3[0]).abs() < ((first.3[2] - first.3[0]) / 2.0).max(2.0)
-                        }
-                    });
-                    if fits && let Some(g) = groups.last_mut() {
-                        g.push(it);
-                    } else {
-                        groups.push(vec![it]);
-                    }
-                }
-                for mut g in groups {
-                    g.sort_by(|a, b| if row { a.3[0].total_cmp(&b.3[0]) } else { b.3[3].total_cmp(&a.3[3]) });
-                    ordered.extend(g.iter().map(|i| (i.1, i.2)));
-                }
-            }
-            TabOrder::Structure | TabOrder::Annotations => {
-                on.sort_by_key(|i| i.4);
-                ordered.extend(on.iter().map(|i| (i.1, i.2)));
-            }
-        }
-    }
-    for f in out.iter_mut() {
-        for w in &mut f.widgets {
-            w.tab = usize::MAX;
-        }
-    }
-    for (rank, (fi, wi)) in ordered.into_iter().enumerate() {
-        out[fi].widgets[wi].tab = rank;
-    }
-}
-
-/// Set the tab order of pages (0-based).
-pub fn set_tab_order(doc: &mut Document, pages: &[usize], order: TabOrder) -> Result<(), FormError> {
-    let refs = page_refs(doc);
-    for &p in pages {
-        let r = *refs.get(p).ok_or_else(|| FormError::Invalid(format!("page {} does not exist", p + 1)))?;
-        doc.update_dict(r, |d| match order {
-            TabOrder::Row => d.set(b"Tabs".to_vec(), Object::name("R")),
-            TabOrder::Column => d.set(b"Tabs".to_vec(), Object::name("C")),
-            TabOrder::Structure => d.set(b"Tabs".to_vec(), Object::name("S")),
-            TabOrder::Annotations => {
-                d.remove(b"Tabs");
-            }
-        })?;
-    }
-    Ok(())
-}
-
-/// What one reading of the form's fields has used: the field and widget dictionaries read, and
-/// the script budget their actions share.
-struct Seen {
-    fields: std::collections::HashSet<ObjRef>,
-    /// A widget belongs to the first field that lists it, however often it is listed.
-    widgets: std::collections::HashSet<ObjRef>,
-    scripts: DecodeBudget,
-}
-
-/// Read the field at `r` and the fields under it into `out`, with what they inherit from
-/// `parent`: kids with a name are fields of their own, kids without are this field's widgets.
-fn walk(
-    doc: &Document,
-    r: ObjRef,
-    parent: &Inherited,
-    page_of: &std::collections::HashMap<ObjRef, usize>,
-    seen: &mut Seen,
-    out: &mut Vec<Field>,
-    depth: usize,
-) {
-    if depth > 64 || !seen.fields.insert(r) {
-        return;
-    }
-    let obj = doc.get(r);
-    let Some(d) = obj.as_dict() else { return };
-    let mut inh = parent.clone();
-    if let Some(t) = d.get(b"T").and_then(|o| text_of(&doc.resolve(o))) {
-        inh.name = if inh.name.is_empty() { t } else { format!("{}.{t}", inh.name) };
-    }
-    if let Some(ft) = d.name(b"FT") {
-        inh.ft = Some(ft.to_vec());
-    }
-    if let Some(ff) = field_flags(doc, d) {
-        inh.ff = Some(ff);
-    }
-    for (k, slot) in [(&b"V"[..], &mut inh.v), (b"DV", &mut inh.dv)] {
-        if let Some(v) = d.get(k) {
-            *slot = Some(v.clone());
-        }
-    }
-    if let Some(da) = d.get(b"DA").and_then(|o| text_of(&doc.resolve(o))) {
-        inh.da = Some(da);
-    }
-    if let Some(q) = d.get(b"Q").and_then(|o| doc.resolve(o).as_int()) {
-        inh.q = Some(q);
-    }
-    if let Some(m) = d.get(b"MaxLen").and_then(|o| doc.resolve(o).as_int()) {
-        // Compatibility: some writers emit zero for an unlimited text field. Keep /MaxLen
-        // untouched in the object graph, but expose only positive limits to both UI and API.
-        // An explicit zero also clears an inherited limit rather than inheriting it again.
-        inh.max_len = usize::try_from(m).ok().filter(|limit| *limit > 0);
-    }
-    let kids: Vec<ObjRef> =
-        d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default().iter().filter_map(|k| k.as_ref()).collect();
-    // Kids with /T are fields; kids without are this field's widgets.
-    let field_kids: Vec<ObjRef> = kids.iter().copied().filter(|k| doc.get(*k).as_dict().is_some_and(|kd| kd.contains(b"T"))).collect();
-    if !field_kids.is_empty() {
-        for k in field_kids {
-            walk(doc, k, &inh, page_of, seen, out, depth + 1);
-        }
-        return;
-    }
-    // A field of no kind this reads is skipped before it claims widgets or scripts, which a later
-    // field listing them then reads.
-    let ff = inh.ff.unwrap_or(0);
-    let kind = match inh.ft.as_deref() {
-        Some(b"Tx") => FieldKind::Text,
-        Some(b"Btn") if ff & flags::PUSH_BUTTON != 0 => FieldKind::PushButton,
-        Some(b"Btn") if ff & flags::RADIO != 0 => FieldKind::Radio,
-        Some(b"Btn") => FieldKind::CheckBox,
-        Some(b"Ch") if ff & flags::COMBO != 0 => FieldKind::Combo,
-        Some(b"Ch") => FieldKind::List,
-        Some(b"Sig") => FieldKind::Signature,
-        _ => return,
-    };
-    let widget_refs: Vec<ObjRef> = if d.contains(b"Rect") { vec![r] } else { kids };
-    let widget_refs: Vec<ObjRef> = widget_refs.into_iter().filter(|w| seen.widgets.insert(*w)).collect();
-    let actions = actions_of(doc, d, &widget_refs, &mut seen.scripts);
-    let button = (inh.ft.as_deref() == Some(b"Btn") && inh.ff.unwrap_or(0) & flags::PUSH_BUTTON != 0)
-        .then(|| button_action(doc, d, &widget_refs, &mut seen.scripts))
-        .flatten();
-    let widgets = widget_refs
-        .into_iter()
-        .filter_map(|w| {
-            let wo = doc.get(w);
-            let wd = wo.as_dict()?;
-            let rect = nums(doc, wd.get(b"Rect")).filter(|r| r.len() == 4).unwrap_or_else(|| vec![0.0; 4]);
-            let annot_flags = wd.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
-            let own_ff = if w == r { 0 } else { field_flags(doc, wd).unwrap_or(0) };
-            let on_state = wd
-                .get(b"AP")
-                .map(|ap| doc.resolve(ap))
-                .and_then(|ap| ap.as_dict().and_then(|a| a.get(b"N").cloned()))
-                .and_then(|n| doc.resolve(&n).as_dict().cloned())
-                .and_then(|n| n.iter().map(|(k, _)| name_text(k)).find(|k| k != "Off"));
-            Some(Widget {
-                obj: w,
-                page: page_of.get(&w).copied(),
-                rect: [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])],
-                on_state: on_state.filter(|_| matches!(kind, FieldKind::CheckBox | FieldKind::Radio)),
-                state: wd.name(b"AS").map(name_text),
-                tab: usize::MAX,
-                locked: annot_flags & 128 != 0,
-                hidden: annot_flags & (2 | 32) != 0,
-                read_only: (ff | own_ff) & flags::READ_ONLY != 0,
-                rotation: appearance::mk_rotation(doc, wd),
-                caption: (kind == FieldKind::PushButton)
-                    .then(|| {
-                        let mk = doc.resolve(wd.get(b"MK")?);
-                        let value = doc.resolve(mk.as_dict()?.get(b"CA")?);
-                        value.as_string().map(|s| s.to_text())
-                    })
-                    .flatten(),
-                list: (kind == FieldKind::List).then(|| appearance::list_rows_of(doc, inh.da.as_deref().unwrap_or("/Helv 0 Tf 0 g"), Some(d), wd)),
-            })
-        })
-        .collect();
-    let options = d
-        .get(b"Opt")
-        .map(|o| doc.resolve(o))
-        .and_then(|o| o.as_array().cloned())
-        .unwrap_or_default()
-        .iter()
-        .filter_map(|o| match &*doc.resolve(o) {
-            Object::Array(pair) if pair.len() >= 2 => Some((text_of(&doc.resolve(&pair[0]))?, text_of(&doc.resolve(&pair[1]))?)),
-            other => text_of(other).map(|t| (t.clone(), t)),
-        })
-        .collect();
-    out.push(Field {
-        name: inh.name.clone(),
-        obj: r,
-        kind,
-        value: values_of(doc, inh.v.as_ref()),
-        default: values_of(doc, inh.dv.as_ref()),
-        flags: ff,
-        max_len: inh.max_len,
-        options,
-        da: inh.da.clone().unwrap_or_else(|| "/Helv 0 Tf 0 g".into()),
-        quadding: inh.q.unwrap_or(0),
-        tooltip: d.get(b"TU").and_then(|o| text_of(&doc.resolve(o))),
-        widgets,
-        actions,
-        button,
-    });
-}
-
-fn field_flags(doc: &Document, dict: &Dict) -> Option<u32> {
-    dict.get(b"Ff").and_then(|value| doc.resolve(value).as_int()).and_then(|value| u32::try_from(value).ok())
-}
-
-// ── writing ─────────────────────────────────────────────────────────────────────────────────
-
-/// Fill the field `name`.
-pub fn set_value(doc: &mut Document, name: &str, value: &FieldValue) -> Result<(), FormError> {
-    set_value_with(doc, name, value, &mut NoScripts)
-}
-
-/// [`set_value`], running the fields' JavaScript through `scripts`.
-pub fn set_value_with(doc: &mut Document, name: &str, value: &FieldValue, scripts: &mut dyn Scripts) -> Result<(), FormError> {
-    let all = fields(doc);
-    if all.is_empty() {
-        return Err(FormError::NoForm);
-    }
-    let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
-    if f.read_only() {
-        return Err(FormError::ReadOnly(name.into()));
-    }
-    write_value(doc, f, value, scripts)?;
-    author::form_fonts_as_objects(doc, &all)?;
-    // Fields with the same fully qualified name are one field (§12.7.3.1). Writers that repeat a
-    // name as separate field dictionaries, instead of widgets under one parent, get the value
-    // the first one took after its scripts, without running them again.
-    let twins: Vec<&Field> = all.iter().filter(|t| t.name == name && t.obj != f.obj && t.kind == f.kind).collect();
-    if !twins.is_empty() {
-        let taken = fields(doc).into_iter().find(|x| x.obj == f.obj).map(|x| x.value).unwrap_or_default();
-        for t in twins {
-            share_value(doc, f.obj, t, &taken, scripts)?;
-        }
-    }
-    recalculate_with(doc, scripts)?;
-    Ok(())
-}
-
-/// Give `twin` the value `source` holds: its `/V` (and a choice's `/I`), drawn in the twin's own
-/// widgets.
-fn share_value(doc: &mut Document, source: ObjRef, twin: &Field, value: &[String], scripts: &mut dyn Scripts) -> Result<(), FormError> {
-    match twin.kind {
-        FieldKind::CheckBox => {
-            let state = twin.widgets.iter().find_map(|w| w.on_state.clone()).unwrap_or_else(|| "Yes".into());
-            set_states(doc, twin, (!value.is_empty()).then_some(state.as_str()))
-        }
-        FieldKind::Radio => {
-            let choice = value.first().filter(|c| twin.widgets.iter().any(|w| w.on_state.as_deref() == Some(c.as_str())));
-            set_states(doc, twin, choice.map(String::as_str))
-        }
-        FieldKind::Text | FieldKind::Combo | FieldKind::List => {
-            let src = doc.get(source).as_dict().cloned().unwrap_or_default();
-            doc.update_dict(twin.obj, |d| {
-                for key in [&b"V"[..], b"I"] {
-                    match src.get(key) {
-                        Some(v) => d.set(key.to_vec(), v.clone()),
-                        None => {
-                            d.remove(key);
-                        }
-                    }
-                }
-                d.remove(b"RV");
-            })?;
-            redraw(doc, twin, value, scripts)
-        }
-        FieldKind::PushButton | FieldKind::Signature => Ok(()),
-    }
-}
-
-/// Run every field's Calculate script in the form's calculation order (`/CO`, then the other
-/// calculated fields), as Acrobat does after any value changes. Returns how many changed.
-pub fn recalculate(doc: &mut Document) -> Result<usize, FormError> {
-    recalculate_with(doc, &mut NoScripts)
-}
-
-/// [`recalculate`], running custom Calculate (and Format) scripts through `scripts`.
-pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result<usize, FormError> {
-    let mut all = fields(doc);
-    if !all.iter().any(calc_order::is_calculated) {
-        return Ok(0);
-    }
-    // By object: two fields can share a name in a malformed form, and each calculates.
-    let order: Vec<ObjRef> = calc_order::run_order(doc, &all).0.into_iter().filter_map(|(i, _)| all.get(i)).map(|f| f.obj).collect();
-    let mut changed = 0;
-    for obj in order {
-        let Some(f) = all.iter().find(|f| f.obj == obj).cloned() else { continue };
-        let lookup = |n: &str| -> Vec<String> {
-            let prefix = format!("{n}.");
-            all.iter().filter(|x| x.name == n || x.name.starts_with(&prefix)).flat_map(|x| x.value.first().cloned()).collect()
-        };
-        let current = f.value.first().cloned().unwrap_or_default();
-        let v = if let Some(js) = &f.actions.scripts.calculate {
-            let r = scripts.run(FieldEvent::Calculate, js, &f, &current, &all);
-            scripting::apply_changes(doc, &r.changes, &f.name)?;
-            if !r.changes.is_empty() {
-                all = fields(doc);
-            }
-            if !r.rc {
-                continue;
-            }
-            r.value
-        } else {
-            let Some(v) = af::calculate(&f.actions.calculate, &lookup) else { continue };
-            v
-        };
-        if current != v && matches!(f.kind, FieldKind::Text | FieldKind::Combo) {
-            doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), PdfString::text(&v)))?;
-            redraw(doc, &f, std::slice::from_ref(&v), scripts)?;
-            if let Some(target) = all.iter_mut().find(|x| x.obj == obj) {
-                target.value = vec![v];
-            }
-            changed += 1;
-        }
-    }
-    Ok(changed)
-}
-
-/// The fields whose calculation differs between two readings of a form, matched by field object
-/// and named as in `after`: the formulas an edit rewrote, such as a rename's.
-pub fn calculations_changed(before: &[Field], after: &[Field]) -> Vec<String> {
-    let before: std::collections::HashMap<ObjRef, &af::Actions> = before.iter().map(|f| (f.obj, &f.actions)).collect();
-    after
-        .iter()
-        .filter(|f| before.get(&f.obj).is_some_and(|b| b.calculate != f.actions.calculate || b.scripts.calculate != f.actions.scripts.calculate))
-        .map(|f| f.name.clone())
-        .collect()
-}
-
 fn invalid<T>(m: impl Into<String>) -> Result<T, FormError> {
     Err(FormError::Invalid(m.into()))
 }
-
-fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut dyn Scripts) -> Result<(), FormError> {
-    match (f.kind, value) {
-        (FieldKind::Text, FieldValue::Text(t)) => {
-            if let Some(max) = f.max_len
-                && t.chars().count() > max
-            {
-                return invalid(format!("{:?} takes at most {max} characters", f.name));
-            }
-            // Keystroke (on commit) and Validate, as Acrobat runs them before accepting a value.
-            let t = &af::keystroke(&f.actions.format, &f.name, t).map_err(FormError::Format)?;
-            af::validate(&f.actions.validate, t).map_err(FormError::Invalid)?;
-            let t = &scripting::accept(doc, f, t, scripts)?;
-            doc.update_dict(f.obj, |d| {
-                if t.is_empty() {
-                    d.remove(b"V");
-                } else {
-                    d.set(b"V".to_vec(), PdfString::text(t));
-                }
-                d.remove(b"RV");
-            })?;
-            redraw(doc, f, std::slice::from_ref(t), scripts)
-        }
-        (FieldKind::CheckBox, v) => {
-            let state = f.widgets.iter().find_map(|w| w.on_state.clone()).unwrap_or_else(|| "Yes".into());
-            let on = match v {
-                FieldValue::Check(on) => *on,
-                // The on-state name or a yes/no word also work (agents, FDF-style data).
-                FieldValue::Text(t) | FieldValue::Radio(Some(t)) => {
-                    let t = t.trim();
-                    if t == state || f.state_for(t).is_some() || ["yes", "true", "on", "1", "x", "checked"].contains(&t.to_lowercase().as_str()) {
-                        true
-                    } else if t.is_empty() || ["no", "false", "off", "0", "unchecked"].contains(&t.to_lowercase().as_str()) {
-                        false
-                    } else {
-                        return invalid(format!("{:?} is a check box: use true or false", f.name));
-                    }
-                }
-                FieldValue::Radio(None) => false,
-                FieldValue::Choice(_) => return invalid(format!("{:?} is a check box: use true or false", f.name)),
-            };
-            set_states(doc, f, on.then_some(state.as_str()))
-        }
-        (FieldKind::Radio, v) => {
-            let choice = match v {
-                FieldValue::Radio(c) => c.clone(),
-                FieldValue::Text(t) if t.is_empty() => None,
-                FieldValue::Text(t) => Some(t.clone()),
-                FieldValue::Check(false) => None,
-                _ => return invalid(format!("{:?} is a radio group: choose one of its options", f.name)),
-            };
-            // An export value from /Opt selects its widget's on state.
-            let choice = choice.map(|c| f.state_for(&c).map(str::to_owned).unwrap_or(c));
-            if let Some(c) = &choice
-                && !f.widgets.iter().any(|w| w.on_state.as_deref() == Some(c.as_str()))
-            {
-                let opts: Vec<&str> = (0..f.widgets.len()).filter_map(|i| f.export_of(i)).collect();
-                return invalid(format!("{:?} has no option {c:?} (options: {})", f.name, opts.join(", ")));
-            }
-            if choice.is_none() && f.has(flags::NO_TOGGLE_TO_OFF) && !f.value.is_empty() {
-                return invalid(format!("{:?} must keep one option selected", f.name));
-            }
-            set_states(doc, f, choice.as_deref())
-        }
-        (FieldKind::Combo | FieldKind::List, FieldValue::Choice(_) | FieldValue::Text(_)) => {
-            let vals: Vec<String> = match value {
-                FieldValue::Choice(v) => v.clone(),
-                FieldValue::Text(t) if t.is_empty() => Vec::new(),
-                FieldValue::Text(t) => vec![t.clone()],
-                other => return invalid(format!("{:?} can't take {other:?}", f.name)),
-            };
-            if vals.len() > 1 && !(f.kind == FieldKind::List && f.has(flags::MULTI_SELECT)) {
-                return invalid(format!("{:?} takes a single value", f.name));
-            }
-            // Accept export values or display texts; free text only in editable combo boxes.
-            let mut exports = Vec::new();
-            for v in &vals {
-                match f.options.iter().find(|(e, d)| e == v || d == v) {
-                    Some((e, _)) => exports.push(e.clone()),
-                    None if f.kind == FieldKind::Combo && f.has(flags::EDIT) => exports.push(v.clone()),
-                    None if f.options.is_empty() => exports.push(v.clone()),
-                    None => {
-                        let opts: Vec<&str> = f.options.iter().map(|(_, d)| d.as_str()).collect();
-                        return invalid(format!("{:?} has no option {v:?} (options: {})", f.name, opts.join(", ")));
-                    }
-                }
-            }
-            let mut indices: Vec<Object> =
-                exports.iter().filter_map(|e| f.options.iter().position(|(x, _)| x == e)).map(|i| Object::Int(i as i64)).collect();
-            // /I lists option indices in ascending order; /V keeps the caller's value order.
-            // Every entry above is an integer, so this sorts by its numeric option index.
-            indices.sort_unstable_by_key(Object::as_int);
-            // A list box scrolls (`/TI`) so the picked options are among the rows it draws, as
-            // in other viewers: a pick below the last visible row would otherwise not show (#1524).
-            let top = match (f.kind, f.widgets.first()) {
-                (FieldKind::List, Some(w)) => w.list.map(|rows| {
-                    let height = if matches!(w.rotation, 90 | 270) { w.rect[2] - w.rect[0] } else { w.rect[3] - w.rect[1] };
-                    let picked: Vec<usize> = indices.iter().filter_map(|i| i.as_int()).filter_map(|i| usize::try_from(i).ok()).collect();
-                    (rows.top, appearance::ListRows::top_showing(rows.top, &picked, rows.visible(height), f.options.len()))
-                }),
-                _ => None,
-            };
-            doc.update_dict(f.obj, |d| {
-                match exports.as_slice() {
-                    [] => {
-                        d.remove(b"V");
-                    }
-                    [one] => d.set(b"V".to_vec(), PdfString::text(one)),
-                    many => d.set(b"V".to_vec(), Object::Array(many.iter().map(|e| Object::String(PdfString::text(e))).collect())),
-                }
-                if indices.is_empty() {
-                    d.remove(b"I");
-                } else {
-                    d.set(b"I".to_vec(), Object::Array(indices));
-                }
-                if let Some((old, new)) = top
-                    && old != new
-                {
-                    d.set(b"TI".to_vec(), Object::Int(i64::try_from(new).unwrap_or(0)));
-                }
-            })?;
-            // A widget with its own `/TI` (read before the field's) scrolls too.
-            if let Some((old, new)) = top
-                && old != new
-            {
-                for w in f.widgets.iter().filter(|w| w.obj != f.obj) {
-                    if doc.get(w.obj).as_dict().is_some_and(|d| d.contains(b"TI")) {
-                        doc.update_dict(w.obj, |d| d.set(b"TI".to_vec(), Object::Int(i64::try_from(new).unwrap_or(0))))?;
-                    }
-                }
-            }
-            redraw(doc, f, &exports, scripts)
-        }
-        (FieldKind::PushButton, _) => invalid(format!("{:?} is a button; it has no value", f.name)),
-        (FieldKind::Signature, _) => invalid(format!("{:?} is a signature field; sign it with Fill & Sign or a digital ID", f.name)),
-        (kind, v) => invalid(format!("{:?} is a {kind:?} field and can't take {v:?}", f.name)),
-    }
-}
-
-/// Check boxes and radio buttons: `/V` on the field, `/AS` on each widget.
-fn set_states(doc: &mut Document, f: &Field, on: Option<&str>) -> Result<(), FormError> {
-    let v = on.unwrap_or("Off");
-    doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), name_obj(v)))?;
-    for w in &f.widgets {
-        let state = match (on, w.on_state.as_deref()) {
-            (Some(c), Some(s)) if c == s => s,
-            _ => "Off",
-        };
-        // A widget without appearances for its states gets PdfCraft's own.
-        let has_ap = doc.get(w.obj).as_dict().and_then(|d| d.get(b"AP").cloned()).is_some();
-        if !has_ap {
-            let on_name = w.on_state.clone().unwrap_or_else(|| on.unwrap_or("Yes").to_string());
-            let ap = appearance::check_box_states(doc, w, f.kind, &on_name, &f.da);
-            doc.update_dict(w.obj, |d| d.set(b"AP".to_vec(), Object::Dict(ap)))?;
-        }
-        doc.update_dict(w.obj, |d| d.set(b"AS".to_vec(), name_obj(state)))?;
-    }
-    Ok(())
-}
-
-/// Copy an existing appearance dictionary before replacing its normal appearance.
-fn appearance_dict(doc: &Document, widget: ObjRef) -> Dict {
-    doc.get(widget).as_dict().and_then(|d| d.get(b"AP").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned()).unwrap_or_default()
-}
-
-/// `widget`'s appearance dictionary (a copy, so a shared one is left alone) with the freshly
-/// drawn entries of `fresh` (its `/N`). Other entries are kept, but the old down and rollover
-/// appearances (`/D`, `/R`) would show the old value, caption or colour on press or hover, so
-/// they go — except, for check boxes and radio buttons (whose `/N` is a dictionary of states),
-/// the states the new `/N` still draws under the same names.
-pub(crate) fn merged_appearance(doc: &Document, widget: ObjRef, fresh: &Dict) -> Dict {
-    let mut apd = appearance_dict(doc, widget);
-    // Only a dictionary of states counts (`as_dict` would also see a stream's own dictionary).
-    let states_of = |o: &Object| match &*doc.resolve(o) {
-        Object::Dict(d) => Some(d.clone()),
-        _ => None,
-    };
-    let states: Option<Vec<Vec<u8>>> = fresh.get(b"N").and_then(states_of).map(|d| d.iter().map(|(k, _)| k.clone()).collect());
-    for key in [&b"D"[..], &b"R"[..]] {
-        if fresh.contains(key) {
-            continue;
-        }
-        let kept = states.as_ref().and_then(|names| {
-            let old = apd.get(key).and_then(states_of)?;
-            let mut d = Dict::new();
-            for (k, v) in old.iter().filter(|(k, _)| names.contains(k)) {
-                d.set(k.clone(), v.clone());
-            }
-            (!d.is_empty()).then_some(d)
-        });
-        match kept {
-            Some(d) => apd.set(key.to_vec(), Object::Dict(d)),
-            None => {
-                apd.remove(key);
-            }
-        }
-    }
-    for (k, v) in fresh.iter() {
-        apd.set(k.clone(), v.clone());
-    }
-    apd
-}
-
-/// Regenerate the normal appearance of every widget of a text or choice field.
-fn redraw(doc: &mut Document, f: &Field, values: &[String], scripts: &mut dyn Scripts) -> Result<(), FormError> {
-    let shown = match values {
-        [one] if matches!(f.kind, FieldKind::Text | FieldKind::Combo) => scripting::formatted(doc, f, one, scripts),
-        _ => None,
-    };
-    let mut undrawn = false;
-    for w in &f.widgets {
-        let (stream, missing) = match &shown {
-            Some(s) => appearance::field_appearance_drawn(doc, f, w, std::slice::from_ref(s), false),
-            None => appearance::field_appearance_drawn(doc, f, w, values, true),
-        };
-        undrawn |= missing.is_some();
-        let ap = doc.add(Object::Stream(stream));
-        let mut fresh = Dict::new();
-        fresh.set(b"N".to_vec(), Object::Ref(ap));
-        let apd = merged_appearance(doc, w.obj, &fresh);
-        doc.update_dict(w.obj, |d| {
-            d.set(b"AP".to_vec(), Object::Dict(apd));
-            d.remove(b"AS");
-            pdfcraft_fonts::set_undrawn_mark(d, missing);
-        })?;
-    }
-    if undrawn {
-        ask_viewers_to_redraw(doc)?;
-    }
-    Ok(())
-}
-
-/// A value its widget's font can't show is stored as typed and drawn with `?` (as Acrobat keeps
-/// such a value): `/NeedAppearances` then asks other viewers to draw the fields from their values
-/// with fonts that have those characters (the interactive form dictionary, §12.7.3). Not in a
-/// document that declares PDF/A, which forbids it: there the widget's mark
-/// (`pdfcraft_fonts::UNDRAWN_MARK`) is all, and the edit's report says the `?` shows everywhere.
-pub(crate) fn ask_viewers_to_redraw(doc: &mut Document) -> Result<(), FormError> {
-    if declares_pdfa(doc) || need_appearances(doc) {
-        return Ok(());
-    }
-    let Some(root) = doc.root() else { return Ok(()) };
-    let entry = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").cloned());
-    match entry {
-        Some(Object::Ref(r)) => doc.update_dict(r, |d| d.set(b"NeedAppearances".to_vec(), Object::Bool(true)))?,
-        Some(Object::Dict(mut af)) => {
-            af.set(b"NeedAppearances".to_vec(), Object::Bool(true));
-            doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(af)))?;
-        }
-        _ => {}
-    }
-    Ok(())
-}
-
-/// Text fields with the Password flag (inherited or their own) whose value (`/V`, inherited or
-/// their own) is not empty and not their default value (`/DV`, which the form's author wrote and
-/// a save restores), or one of whose separate widgets carries a `/V`.
-fn password_fields(doc: &Document) -> Vec<Field> {
-    if !has_password_flag(doc) {
-        return Vec::new();
-    }
-    let on_widget = |f: &Field| f.widgets.iter().any(|w| w.obj != f.obj && doc.get(w.obj).as_dict().is_some_and(|d| d.get(b"V").is_some()));
-    let typed = |f: &Field| f.value.iter().any(|v| !v.is_empty()) && f.value.first() != f.default.first();
-    fields(doc).into_iter().filter(|f| f.kind == FieldKind::Text && f.has(flags::PASSWORD) && (typed(f) || on_widget(f))).collect()
-}
-
-/// Whether any field dictionary sets the Password flag (#3943 review). A field that inherits the
-/// flag has an ancestor that sets it, so that ancestor is found instead; a kid clearing the flag
-/// again only makes the answer cautious. It reads only `/Ff`, `/Kids` and `/Parent`, so a save
-/// or recovery snapshot of a form without such a field doesn't build every [`Field`]. Like
-/// [`fields`], it looks at the form's field tree and at the widgets on the pages, which may be
-/// missing from `/Fields`. Each dictionary is visited once and at most 32 levels deep.
-fn has_password_flag(doc: &Document) -> bool {
-    let sets_it = |r: ObjRef| doc.get(r).as_dict().and_then(|d| field_flags(doc, d)).is_some_and(|ff| ff & flags::PASSWORD != 0);
-    let top = acroform(doc).and_then(|af| af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned())).unwrap_or_default();
-    let mut stack: Vec<(Object, usize)> = top.into_iter().map(|o| (o, 0)).collect();
-    let mut seen = std::collections::HashSet::new();
-    while let Some((o, depth)) = stack.pop() {
-        let Object::Ref(r) = o else { continue };
-        if depth > 32 || !seen.insert(r) {
-            continue;
-        }
-        if sets_it(r) {
-            return true;
-        }
-        let kids = doc.get(r).as_dict().and_then(|d| d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned())).unwrap_or_default();
-        stack.extend(kids.into_iter().map(|k| (k, depth + 1)));
-    }
-    // Widgets on the pages, and the fields above them.
-    page_refs(doc).into_iter().any(|p| {
-        let annots =
-            doc.get(p).as_dict().and_then(|d| d.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned())).unwrap_or_default();
-        annots.iter().filter_map(Object::as_ref).filter(|r| !seen.contains(r)).any(|r| field_chain(doc, r).into_iter().any(sets_it))
-    })
-}
-
-/// Whether any text field with the Password flag holds a value in `doc`.
-pub fn has_password_values(doc: &Document) -> bool {
-    !password_fields(doc).is_empty()
-}
-
-/// The typed values of the text fields with the Password flag, as (name, text) pairs, for
-/// [`restore_password_values`] after the document was rebased on a file written without them.
-pub fn password_values(doc: &Document) -> Vec<(String, String)> {
-    password_fields(doc).into_iter().filter_map(|f| f.value.first().map(|v| (f.name.clone(), v.clone()))).collect()
-}
-
-/// Put values from [`password_values`] back into the open document, in memory only. A field
-/// that is gone or read-only keeps what it has.
-pub fn restore_password_values(doc: &mut Document, values: &[(String, String)]) -> Result<(), FormError> {
-    for (name, v) in values {
-        match set_value(doc, name, &FieldValue::Text(v.clone())) {
-            Ok(()) | Err(FormError::NoSuchField(_) | FormError::ReadOnly(_)) => {}
-            Err(e) => return Err(e),
-        }
-    }
-    Ok(())
-}
-
-/// `r` and its field ancestors (`/Parent`), nearest first, at most 32 deep and without repeats.
-fn field_chain(doc: &Document, r: ObjRef) -> Vec<ObjRef> {
-    let mut chain = vec![r];
-    let mut cur = r;
-    while chain.len() < 32 {
-        let Some(Object::Ref(parent)) = doc.get(cur).as_dict().and_then(|d| d.get(b"Parent").cloned()) else { break };
-        if chain.contains(&parent) {
-            break;
-        }
-        chain.push(parent);
-        cur = parent;
-    }
-    chain
-}
-
-/// Remove the values of the text fields with the Password flag, for a copy of the document about
-/// to be written to a file (#3926). ISO 32000-2 §12.7.5.3, Table 231, Password flag, note: "it is
-/// imperative that PDF processors never store the value of the text field in the PDF file if
-/// this flag is set". As Acrobat saves such a field (#3943 review, black-box test): a field with
-/// a default value (`/DV`, which the form's author wrote) gets it back as its value, one without
-/// is left empty, and its appearance is drawn again from that value, so the masking characters
-/// no longer show how long the typed password was. `/DV` and the field's scripts stay.
-///
-/// A value can sit on the field, on one of its widgets, or on an ancestor it inherits from
-/// (`/V` is inheritable). Each is removed; an ancestor's only when every field inheriting from it
-/// is such a password field. Where an ancestor's value is shared with other fields and stays, the
-/// password field gets an empty value of its own so it no longer inherits it. Returns how many
-/// fields were cleared.
-pub fn clear_password_values(doc: &mut Document) -> Result<usize, FormError> {
-    let targets = password_fields(doc);
-    if targets.is_empty() {
-        return Ok(0);
-    }
-    let is_password = |f: &Field| f.kind == FieldKind::Text && f.has(flags::PASSWORD);
-    // Each field's ancestors, found once: only values change below, never `/Parent` (#3943
-    // review: walking them again for every ancestor of every target was quadratic).
-    let chains: Vec<(bool, Vec<ObjRef>)> = fields(doc).iter().map(|g| (is_password(g), field_chain(doc, g.obj))).collect();
-    for f in &targets {
-        let chain = field_chain(doc, f.obj);
-        for w in &f.widgets {
-            if w.obj != f.obj {
-                doc.update_dict(w.obj, |d| {
-                    d.remove(b"V");
-                })?;
-            }
-        }
-        doc.update_dict(f.obj, |d| {
-            d.remove(b"V");
-        })?;
-        let mut shared_value_kept = false;
-        for a in chain.iter().skip(1) {
-            if doc.get(*a).as_dict().is_none_or(|d| d.get(b"V").is_none()) {
-                continue;
-            }
-            let exclusive = chains.iter().filter(|(_, chain)| chain.contains(a)).all(|(password, _)| *password);
-            if exclusive {
-                doc.update_dict(*a, |d| {
-                    d.remove(b"V");
-                })?;
-            } else {
-                shared_value_kept = true;
-            }
-        }
-        let restored: Vec<String> = f.default.first().cloned().into_iter().collect();
-        match restored.first() {
-            Some(dv) => doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), PdfString::text(dv)))?,
-            None if shared_value_kept => doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), PdfString::text("")))?,
-            None => {}
-        }
-        redraw(doc, f, &restored, &mut NoScripts)?;
-    }
-    Ok(targets.len())
-}
-
-/// Whether the form asks viewers to draw its fields' appearances themselves (`/NeedAppearances`).
-pub fn need_appearances(doc: &Document) -> bool {
-    acroform(doc).is_some_and(|af| matches!(af.get(b"NeedAppearances").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true))))
-}
-
-/// A copy of `doc` in which form fields are drawn the way the file leaves to the viewer, for
-/// displaying the document (`None` when no widget needs it). Text and choice fields are drawn from
-/// their values: every one when the form sets `/NeedAppearances` (ISO 32000-2 Table 224: the
-/// writer left the appearances to the viewer), and otherwise each widget without a normal
-/// appearance (`/AP /N`), as typing the value would draw it (#3470). Check boxes and radio buttons
-/// with no normal appearance for their state (`/AS`) are drawn from their `/MK` background, border
-/// and caption, and push buttons with none from their `/MK` and `/BS` (Table 192). `doc` is not
-/// changed: saving writes the file as it was.
-pub fn with_field_appearances(doc: &Document) -> Option<Document> {
-    with_field_appearances_cached(doc, &mut FieldAppearanceCache::default())
-}
-
-/// [`with_field_appearances`], reusing the appearances `cache` drew for widgets whose inputs are
-/// the same objects as then (see [`FieldAppearanceCache`]).
-pub fn with_field_appearances_cached(doc: &Document, cache: &mut FieldAppearanceCache) -> Option<Document> {
-    let all = need_appearances(doc);
-    let mut copy: Option<Document> = None;
-    for f in fields(doc) {
-        for w in &f.widgets {
-            let widget = doc.get(w.obj);
-            let normal = widget
-                .as_dict()
-                .and_then(|d| d.get(b"AP"))
-                .and_then(|ap| doc.resolve(ap).as_dict().and_then(|ap| ap.get(b"N").map(|n| doc.resolve(n))));
-            // A check box or radio button shows the appearance of its state (12.7.5.2.3): `/AS`,
-            // else a check box's value, else Off. An Off state may go without one (it shows
-            // nothing); an on state needs one.
-            let state = match f.kind {
-                FieldKind::CheckBox | FieldKind::Radio => {
-                    let value = f.value.first().filter(|v| f.kind == FieldKind::CheckBox && !v.is_empty() && v.as_str() != "Off");
-                    Some(w.state.clone().or_else(|| value.cloned()).unwrap_or_else(|| "Off".into()))
-                }
-                _ => None,
-            };
-            let missing = match f.kind {
-                FieldKind::Text | FieldKind::Combo | FieldKind::List => normal.is_none() || all,
-                FieldKind::PushButton => normal.is_none(),
-                FieldKind::CheckBox | FieldKind::Radio => match (normal.as_deref(), state.as_deref()) {
-                    (None, _) => true,
-                    (Some(Object::Dict(states)), Some(s)) => s != "Off" && !states.contains(&name_bytes(s)),
-                    _ => false,
-                },
-                FieldKind::Signature => false,
-            };
-            if !missing {
-                continue;
-            }
-            let inputs = appearance_inputs(doc, w);
-            let stream = match cache.get(w.obj, &inputs) {
-                Some(stream) => stream,
-                None => {
-                    let stream = match f.kind {
-                        FieldKind::CheckBox | FieldKind::Radio => appearance::button_state_shown(doc, &f, w, state.as_deref() != Some("Off")),
-                        FieldKind::PushButton => appearance::push_button_shown(doc, &f, w),
-                        _ => appearance::field_appearance_drawn(doc, &f, w, &f.value, true).0,
-                    };
-                    cache.insert(w.obj, inputs, &stream);
-                    stream
-                }
-            };
-            let target = copy.get_or_insert_with(|| doc.clone());
-            let ap = target.add(Object::Stream(stream));
-            let mut fresh = Dict::new();
-            match &state {
-                // The drawn look under its state's name, and that state as the widget's own.
-                Some(s) => {
-                    let mut states = Dict::new();
-                    states.set(name_bytes(s), Object::Ref(ap));
-                    fresh.set(b"N".to_vec(), Object::Dict(states));
-                }
-                None => fresh.set(b"N".to_vec(), Object::Ref(ap)),
-            }
-            let apd = merged_appearance(target, w.obj, &fresh);
-            // Fails only when the widget isn't a dictionary; that widget then keeps its own look.
-            target
-                .update_dict(w.obj, |d| {
-                    d.set(b"AP".to_vec(), Object::Dict(apd));
-                    if let Some(s) = &state {
-                        d.set(b"AS".to_vec(), Object::Name(name_bytes(s)));
-                    }
-                })
-                .ok();
-        }
-    }
-    copy
-}
-
-/// The objects a widget's drawn appearance is built from, as the document holds them: the widget
-/// and the fields above it (value, `/DA`, `/Q`, flags, options, `/MK`, formatting actions), the
-/// form dictionary (`/DA`) and the fonts of its `/DR`, each with the objects its entries refer to
-/// (an indirect `/MK` or `/V`). Not the page: a field's rotation is its own `/MK /R`.
-fn appearance_inputs(doc: &Document, w: &Widget) -> Vec<std::sync::Arc<Object>> {
-    // The objects a dictionary's entries refer to. The tree links and the drawn appearance itself
-    // are not inputs, and `/Kids` and `/Fields` can be long.
-    let referred = |d: &Dict, inputs: &mut Vec<std::sync::Arc<Object>>| {
-        for (k, v) in d.iter() {
-            if !matches!(&k[..], b"Kids" | b"Fields" | b"P" | b"Parent" | b"AP")
-                && let Some(r) = v.as_ref()
-            {
-                inputs.push(doc.get(r));
-            }
-        }
-    };
-    let mut inputs = Vec::new();
-    let mut seen = std::collections::HashSet::new();
-    let mut node = Some(w.obj);
-    // The /Parent chain; the seen-set and the cap end a cycle or an absurd depth.
-    while let Some(r) = node.filter(|r| seen.insert(*r) && seen.len() <= 64) {
-        let obj = doc.get(r);
-        if let Some(d) = obj.as_dict() {
-            node = d.reference(b"Parent");
-            referred(d, &mut inputs);
-        } else {
-            node = None;
-        }
-        inputs.push(obj);
-    }
-    let Some(root) = doc.root() else { return inputs };
-    let catalog = doc.get(root);
-    let form = match catalog.as_dict().and_then(|c| c.reference(b"AcroForm")) {
-        Some(r) => doc.get(r),
-        None => catalog,
-    };
-    if let Some(f) = form.as_dict() {
-        referred(f, &mut inputs);
-        // The fonts of /DR. An indirect /DR or /Font is listed through the entries that refer to
-        // it; a direct one is part of the object that holds it. `held` only finds them: a copy
-        // of a direct object is a new one each time, never an input.
-        let held = |o: &Object| o.as_ref().map_or_else(|| std::sync::Arc::new(o.clone()), |r| doc.get(r));
-        if let Some(dr) = f.get(b"DR").map(held)
-            && let Some(dr) = dr.as_dict()
-        {
-            referred(dr, &mut inputs);
-            if let Some(font) = dr.get(b"Font").map(held)
-                && let Some(fonts) = font.as_dict()
-            {
-                referred(fonts, &mut inputs);
-            }
-        }
-    }
-    inputs.push(form);
-    inputs
-}
-
-/// Field appearances drawn for the display copy ([`with_field_appearances_cached`]), so a refresh
-/// redraws only the widgets whose inputs changed: a form that leaves every appearance to the
-/// viewer otherwise redrew all of its fields on each keystroke in any one of them (#3470). An
-/// entry holds the input objects it was drawn from and is used only while each is still the same
-/// object (`Arc::ptr_eq`); the document replaces an object it edits, so a changed input is a
-/// miss, never a stale hit.
-#[derive(Clone, Debug, Default)]
-pub struct FieldAppearanceCache {
-    entries: std::collections::HashMap<ObjRef, (Vec<std::sync::Arc<Object>>, pdfcraft_cos::Stream)>,
-    bytes: usize,
-    hits: u64,
-    builds: u64,
-}
-
-impl FieldAppearanceCache {
-    /// Cached appearance data restarts past this instead of growing without bound.
-    const MAX_BYTES: usize = 64 << 20;
-
-    /// Forget every entry.
-    pub fn clear(&mut self) {
-        *self = Self::default();
-    }
-
-    fn get(&mut self, w: ObjRef, inputs: &[std::sync::Arc<Object>]) -> Option<pdfcraft_cos::Stream> {
-        let (from, stream) = self.entries.get(&w)?;
-        if from.len() != inputs.len() || !from.iter().zip(inputs).all(|(a, b)| std::sync::Arc::ptr_eq(a, b)) {
-            return None;
-        }
-        self.hits += 1;
-        Some(stream.clone())
-    }
-
-    fn insert(&mut self, w: ObjRef, inputs: Vec<std::sync::Arc<Object>>, stream: &pdfcraft_cos::Stream) {
-        self.builds += 1;
-        if self.bytes.saturating_add(stream.raw.len()) > Self::MAX_BYTES {
-            self.clear();
-        }
-        self.bytes = self.bytes.saturating_add(stream.raw.len());
-        if let Some((_, old)) = self.entries.insert(w, (inputs, stream.clone())) {
-            self.bytes = self.bytes.saturating_sub(old.raw.len());
-        }
-    }
-
-    /// Cache hits so far (reused appearances); for tests.
-    pub fn hits(&self) -> u64 {
-        self.hits
-    }
-
-    /// Appearances drawn so far; for tests.
-    pub fn builds(&self) -> u64 {
-        self.builds
-    }
-}
-
-/// Whether the document's XMP metadata declares PDF/A conformance (`pdfaid:part`).
-pub fn declares_pdfa(doc: &Document) -> bool {
-    let Some(root) = doc.root() else { return false };
-    let Some(m) = doc.get(root).as_dict().and_then(|c| c.get(b"Metadata").cloned()) else { return false };
-    let m = doc.resolve(&m);
-    match &*m {
-        Object::Stream(s) => s.decoded().is_ok_and(|b| b.windows(11).any(|w| w == b"pdfaid:part")),
-        _ => false,
-    }
-}
-
-/// Every field with a widget whose appearance PdfCraft drew with `?` for a character its font
-/// can't hold (`pdfcraft_fonts::UNDRAWN_MARK`): the field's name and that character, once per
-/// field.
-pub fn undrawn_fields(doc: &Document) -> Vec<(String, char)> {
-    fields(doc)
-        .into_iter()
-        .filter_map(|f| {
-            let c = f.widgets.iter().find_map(|w| doc.get(w.obj).as_dict().and_then(pdfcraft_fonts::undrawn_mark))?;
-            Some((f.name, c))
-        })
-        .collect()
-}
-
-/// Acrobat's Clear form: every field (or the named ones) back to its default value.
-pub fn reset(doc: &mut Document, names: Option<&[String]>) -> Result<usize, FormError> {
-    let all = fields(doc);
-    if all.is_empty() {
-        return Err(FormError::NoForm);
-    }
-    if let Some(n) = names
-        && let Some(missing) = n.iter().find(|n| !all.iter().any(|f| &f.name == *n))
-    {
-        return Err(FormError::NoSuchField(missing.clone()));
-    }
-    let mut changed = 0;
-    for f in all.iter().filter(|f| names.is_none_or(|n| n.contains(&f.name))) {
-        if f.value == f.default {
-            continue;
-        }
-        let v = match f.kind {
-            FieldKind::Text => FieldValue::Text(f.default.first().cloned().unwrap_or_default()),
-            FieldKind::CheckBox => FieldValue::Check(!f.default.is_empty()),
-            FieldKind::Radio => FieldValue::Radio(f.default.first().cloned()),
-            FieldKind::Combo | FieldKind::List => FieldValue::Choice(f.default.clone()),
-            FieldKind::PushButton | FieldKind::Signature => continue,
-        };
-        // A reset is not blocked by NoToggleToOff: go through the writer directly.
-        let mut tmp = f.clone();
-        tmp.flags &= !flags::NO_TOGGLE_TO_OFF;
-        write_value(doc, &tmp, &v, &mut NoScripts)?;
-        changed += 1;
-    }
-    recalculate(doc)?;
-    Ok(changed)
-}
-
-/// Order tabs manually (Acrobat: Fields ▸ Tab Order ▸ Order Tabs Manually, then drag a field):
-/// move field `name` one place earlier or later in its page's tab order. The page switches to
-/// annotation order (`/Tabs` removed) and its widgets are reordered in `/Annots`; other
-/// annotations keep their places.
-pub fn move_in_tab_order(doc: &mut Document, name: &str, earlier: bool) -> Result<(), FormError> {
-    let all = fields(doc);
-    let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
-    let page = f.widgets.iter().filter_map(|w| w.page).min().ok_or_else(|| FormError::Invalid(format!("{name} is not on a page")))?;
-    // The page's fields in their current tab order (a field counts once, at its first widget).
-    let mut order: Vec<(usize, &str)> =
-        all.iter().filter_map(|g| g.widgets.iter().filter(|w| w.page == Some(page)).map(|w| w.tab).min().map(|t| (t, g.name.as_str()))).collect();
-    order.sort();
-    let names: Vec<&str> = order.iter().map(|(_, n)| *n).collect();
-    let Some(i) = names.iter().position(|n| *n == name) else { return invalid(format!("{name} is not on a page")) };
-    let j = if earlier { i.checked_sub(1) } else { Some(i + 1).filter(|j| *j < names.len()) };
-    let Some(j) = j else { return Ok(()) };
-    let mut names = names.into_iter().map(str::to_string).collect::<Vec<_>>();
-    names.swap(i, j);
-    // The widgets of this page in the new order.
-    let mut widgets: Vec<ObjRef> = Vec::new();
-    for n in &names {
-        if let Some(g) = all.iter().find(|g| &g.name == n) {
-            widgets.extend(g.widgets.iter().filter(|w| w.page == Some(page)).map(|w| w.obj));
-        }
-    }
-    let pr = *page_refs(doc).get(page).ok_or_else(|| FormError::Invalid("no such page".into()))?;
-    let annots_obj =
-        doc.get(pr).as_dict().and_then(|d| d.get(b"Annots").cloned()).ok_or_else(|| FormError::Invalid("the page has no annotations".into()))?;
-    let list = doc.resolve(&annots_obj).as_array().cloned().unwrap_or_default();
-    let mut next = widgets.into_iter();
-    let set: std::collections::HashSet<ObjRef> = all.iter().flat_map(|g| g.widgets.iter().filter(|w| w.page == Some(page)).map(|w| w.obj)).collect();
-    let new_list: Vec<Object> = list
-        .iter()
-        .map(|o| match o.as_ref() {
-            Some(r) if set.contains(&r) => next.next().map(Object::Ref).unwrap_or_else(|| o.clone()),
-            _ => o.clone(),
-        })
-        .collect();
-    match annots_obj {
-        Object::Ref(ar) => doc.set(ar, Object::Array(new_list)),
-        _ => doc.update_dict(pr, |d| d.set(b"Annots".to_vec(), Object::Array(new_list)))?,
-    }
-    doc.update_dict(pr, |d| {
-        d.remove(b"Tabs");
-    })?;
-    Ok(())
-}
diff --git a/crates/forms/src/read.rs b/crates/forms/src/read.rs
new file mode 100644
index 0000000000..a962af91bd
--- /dev/null
+++ b/crates/forms/src/read.rs
@@ -0,0 +1,568 @@
+use super::tab_order::rank_tabs;
+use super::*;
+
+/// At most this many `/State` entries of a set-layer-visibility action are read.
+const MAX_LAYER_STATE: usize = 1024;
+
+/// A push button's mouse-up action (`/A`, or `/AA /U`, on the field or its widget).
+fn button_action(doc: &Document, d: &Dict, widgets: &[ObjRef], scripts: &mut DecodeBudget) -> Option<af::ButtonAction> {
+    // A button PdfCraft generated for an XFA image field (`/PCXfaImage true`, no PDF action):
+    // clicking it picks a picture, as `buttonImportIcon()` does.
+    if matches!(d.get(b"PCXfaImage").map(|o| doc.resolve(o)).as_deref(), Some(Object::Bool(true))) {
+        return Some(af::ButtonAction::ImportIcon);
+    }
+    let pick = |dict: &Dict| -> Option<Object> {
+        dict.get(b"A").cloned().or_else(|| dict.get(b"AA").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().and_then(|aa| aa.get(b"U").cloned())))
+    };
+    let action = pick(d).or_else(|| widgets.iter().find_map(|w| doc.get(*w).as_dict().and_then(pick)))?;
+    let a = doc.resolve(&action);
+    let a = a.as_dict()?;
+    let s = |k: &[u8]| a.get(k).and_then(|v| text_of(&doc.resolve(v)));
+    Some(match a.name(b"S")? {
+        b"ResetForm" => {
+            let fields = a
+                .get(b"Fields")
+                .map(|f| doc.resolve(f))
+                .and_then(|f| f.as_array().cloned())
+                .unwrap_or_default()
+                .iter()
+                .filter_map(|o| match o {
+                    Object::Ref(r) => doc.get(*r).as_dict().and_then(|fd| fd.get(b"T").and_then(|t| text_of(&doc.resolve(t)))),
+                    other => text_of(&doc.resolve(other)),
+                })
+                .collect();
+            let exclude = a.get(b"Flags").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0) & 1 != 0;
+            af::ButtonAction::Reset { fields, exclude }
+        }
+        b"Named" => af::ButtonAction::Named(String::from_utf8_lossy(a.name(b"N")?).into_owned()),
+        b"URI" => af::ButtonAction::Uri(s(b"URI")?),
+        b"SubmitForm" => af::ButtonAction::Submit(
+            a.get(b"F")
+                .map(|f| doc.resolve(f))
+                .and_then(|f| f.as_dict().and_then(|fd| fd.get(b"F").and_then(|x| text_of(&doc.resolve(x)))).or_else(|| text_of(&f)))
+                .unwrap_or_default(),
+        ),
+        b"GoTo" => {
+            let dest = doc.resolve(a.get(b"D")?);
+            let target = dest.as_array()?.first()?.as_ref()?;
+            af::ButtonAction::GoTo(page_refs(doc).iter().position(|p| *p == target)?)
+        }
+        b"Hide" => {
+            // /T: a field name, an annotation (or field) reference, or an array of them.
+            let target = |o: &Object| match o {
+                Object::Ref(r) => qualified_name(doc, *r).or_else(|| text_of(&doc.resolve(o))),
+                other => text_of(other),
+            };
+            let fields = match a.get(b"T") {
+                Some(t) => match &*doc.resolve(t) {
+                    Object::Array(items) => items.iter().filter_map(target).collect(),
+                    _ => target(t).into_iter().collect(),
+                },
+                None => Vec::new(),
+            };
+            let hide = !a.get(b"H").is_some_and(|h| matches!(&*doc.resolve(h), Object::Bool(false)));
+            af::ButtonAction::ShowHide { fields, hide }
+        }
+        b"SetOCGState" => {
+            // /State: ON, OFF or Toggle, each followed by the groups it applies to.
+            let mut changes = Vec::new();
+            if let Some(state) = a.get(b"State") {
+                let mut op = None;
+                for item in doc.resolve(state).as_array().into_iter().flatten().take(MAX_LAYER_STATE) {
+                    match item {
+                        Object::Name(n) => {
+                            op = match n.as_slice() {
+                                b"ON" => Some(af::LayerOp::On),
+                                b"OFF" => Some(af::LayerOp::Off),
+                                b"Toggle" => Some(af::LayerOp::Toggle),
+                                _ => None,
+                            }
+                        }
+                        Object::Ref(r) => changes.extend(op.map(|op| (op, (r.num, r.generation)))),
+                        _ => {}
+                    }
+                }
+            }
+            let preserve_rb = !a.get(b"PreserveRB").is_some_and(|p| matches!(&*doc.resolve(p), Object::Bool(false)));
+            af::ButtonAction::SetLayers { changes, preserve_rb }
+        }
+        b"JavaScript" => af::button_script(&script(doc, &action, scripts)?),
+        _ => return None,
+    })
+}
+
+/// The fully qualified name of the field that `r` (a field or one of its widgets) belongs to,
+/// from the partial names (`/T`) up its `/Parent` chain.
+fn qualified_name(doc: &Document, r: ObjRef) -> Option<String> {
+    let mut parts = Vec::new();
+    let mut seen = std::collections::HashSet::new();
+    let mut cur = Some(r);
+    while let Some(c) = cur {
+        if seen.len() > 64 || !seen.insert(c) {
+            break;
+        }
+        let obj = doc.get(c);
+        let d = obj.as_dict()?;
+        if let Some(t) = d.get(b"T").and_then(|o| text_of(&doc.resolve(o))) {
+            parts.push(t);
+        }
+        cur = d.get(b"Parent").and_then(|p| p.as_ref());
+    }
+    parts.reverse();
+    (!parts.is_empty()).then(|| parts.join("."))
+}
+
+/// JavaScript streams one reading of the form (its fields, or its document scripts) may decode
+/// in all, however many actions name the same stream.
+pub(crate) const MAX_SCRIPT_BYTES: usize = 64 << 20;
+
+/// A budget for the script streams of one reading of the form.
+pub(crate) fn script_budget() -> DecodeBudget {
+    DecodeBudget::new(MAX_SCRIPT_BYTES, 0)
+}
+
+/// The JavaScript of an action dictionary (`/JS` string or stream). A stream is decoded against
+/// `budget`, and is `None` once it is spent.
+pub(crate) fn script(doc: &Document, action: &Object, budget: &mut DecodeBudget) -> Option<String> {
+    let a = doc.resolve(action);
+    let js = a.as_dict()?.get(b"JS")?.clone();
+    match &*doc.resolve(&js) {
+        Object::String(s) => Some(s.to_text()),
+        Object::Stream(s) => budget.decode(s).ok().map(|b| String::from_utf8_lossy(&b).into_owned()),
+        _ => None,
+    }
+}
+
+/// A field's format/keystroke, validate and calculate scripts (field dictionary, or its only
+/// widget's when the field has none).
+fn actions_of(doc: &Document, d: &Dict, widgets: &[ObjRef], scripts: &mut DecodeBudget) -> af::Actions {
+    let aa = d.get(b"AA").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().cloned()).or_else(|| {
+        (widgets.len() == 1)
+            .then(|| doc.get(widgets[0]))
+            .and_then(|w| w.as_dict().and_then(|wd| wd.get(b"AA").map(|a| doc.resolve(a))))
+            .and_then(|a| a.as_dict().cloned())
+    });
+    let mut out = af::Actions::default();
+    let Some(aa) = aa else { return out };
+    let mut js = |k: &[u8]| aa.get(k).and_then(|a| script(doc, a, scripts));
+    if let Some(f) = js(b"F") {
+        match af::parse_format(&f) {
+            Some(fm) => out.format = fm,
+            None if !f.trim().is_empty() => {
+                out.unsupported.push("format");
+                out.scripts.format = Some(f);
+            }
+            None => {}
+        }
+    }
+    if let Some(k) = js(b"K")
+        && out.format == af::Format::None
+    {
+        // A mask has only a keystroke script.
+        match af::parse_format(&k) {
+            Some(fm @ af::Format::Mask(_)) => out.format = fm,
+            Some(_) => {}
+            None if !k.trim().is_empty() => {
+                out.unsupported.push("keystroke");
+                out.scripts.keystroke = Some(k);
+            }
+            None => {}
+        }
+    }
+    if let Some(v) = js(b"V") {
+        match af::parse_validate(&v) {
+            Some(vv) => out.validate = vv,
+            None if !v.trim().is_empty() => {
+                out.unsupported.push("validate");
+                out.scripts.validate = Some(v);
+            }
+            None => {}
+        }
+    }
+    if let Some(c) = js(b"C") {
+        match af::parse_calculate(&c) {
+            Some(cc) => out.calculate = cc,
+            None if !c.trim().is_empty() => {
+                out.unsupported.push("calculate");
+                out.scripts.calculate = Some(c);
+            }
+            None => {}
+        }
+    }
+    out
+}
+
+fn values_of(doc: &Document, o: Option<&Object>) -> Vec<String> {
+    let Some(o) = o else { return Vec::new() };
+    match &*doc.resolve(o) {
+        Object::Array(a) => a.iter().filter_map(|x| text_of(&doc.resolve(x))).collect(),
+        Object::Stream(s) => s.decoded().ok().map(|b| PdfString::literal(b).to_text()).into_iter().collect(),
+        other => text_of(other).filter(|s| s != "Off" && !s.is_empty()).into_iter().collect(),
+    }
+}
+
+fn nums(doc: &Document, o: Option<&Object>) -> Option<Vec<f64>> {
+    let o = doc.resolve(o?);
+    o.as_array()?.iter().map(|x| doc.resolve(x).as_f64()).collect()
+}
+
+/// Leaf page objects in order (a small walker; `organize` and `annot` have their own).
+pub(crate) fn page_refs(doc: &Document) -> Vec<ObjRef> {
+    let Some(root) = doc.root() else { return Vec::new() };
+    let Some(pages) = doc.get(root).as_dict().and_then(|d| d.reference(b"Pages")) else { return Vec::new() };
+    PageWalk::new(doc, pages).collect()
+}
+
+/// Depth-first walk over the leaf pages under `top`. It keeps one cursor per open `/Kids` array,
+/// never one entry per child, so a child listed many times or shared between nodes is skipped by
+/// the seen check without being queued first (`pdfcraft_model::pages` walks the same way).
+/// Cycles end at the seen check and at most a million nodes are visited.
+pub(crate) struct PageWalk<'a> {
+    doc: &'a Document,
+    seen: std::collections::HashSet<ObjRef>,
+    pub(crate) pending: Vec<(std::sync::Arc<Object>, usize)>,
+}
+
+impl<'a> PageWalk<'a> {
+    pub(crate) fn new(doc: &'a Document, top: ObjRef) -> Self {
+        let top = std::sync::Arc::new(Object::Array(vec![Object::Ref(top)]));
+        Self { doc, seen: Default::default(), pending: vec![(top, 0)] }
+    }
+}
+
+impl Iterator for PageWalk<'_> {
+    type Item = ObjRef;
+
+    fn next(&mut self) -> Option<ObjRef> {
+        while let Some((kids, next)) = self.pending.last_mut() {
+            let Some(kid) = kids.as_array().and_then(|a| a.get(*next)) else {
+                self.pending.pop();
+                continue;
+            };
+            let node = kid.as_ref();
+            *next += 1;
+            let Some(node) = node else { continue };
+            if self.seen.len() >= 1_000_000 {
+                self.pending.clear();
+                return None;
+            }
+            if !self.seen.insert(node) {
+                continue;
+            }
+            let obj = self.doc.get(node);
+            let Some(d) = obj.as_dict() else { continue };
+            match d.get(b"Kids").map(|k| self.doc.resolve(k)) {
+                Some(kids) if d.name(b"Type") != Some(b"Page") => self.pending.push((kids, 0)),
+                _ => return Some(node),
+            }
+        }
+        None
+    }
+}
+
+/// The AcroForm dictionary.
+pub fn acroform(doc: &Document) -> Option<Dict> {
+    let root = doc.root()?;
+    let cat = doc.get(root);
+    let af = cat.as_dict()?.get(b"AcroForm")?.clone();
+    doc.resolve(&af).as_dict().cloned()
+}
+
+#[derive(Clone, Default)]
+struct Inherited {
+    name: String,
+    ft: Option<Vec<u8>>,
+    ff: Option<u32>,
+    v: Option<Object>,
+    dv: Option<Object>,
+    da: Option<String>,
+    q: Option<i64>,
+    max_len: Option<usize>,
+}
+
+/// Every terminal field: the `/Fields` tree in order, then the fields reachable only through the
+/// page annotations (see [`adopt_page_fields`]).
+pub fn fields(doc: &Document) -> Vec<Field> {
+    fields_with_adopted(doc).items
+}
+
+/// How many of [`fields`] were reachable only through the page annotations: the form's `/Fields`
+/// list names none or only some of them, so the leniency that adopts them is worth recording.
+pub fn adopted_page_fields(doc: &Document) -> usize {
+    fields_with_adopted(doc).adopted_page_fields
+}
+
+/// The terminal fields and page-only fields adopted while reading a form.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Fields {
+    /// Terminal fields in tree order, followed by adopted page-only fields.
+    pub items: Vec<Field>,
+    /// How many fields were reachable only through page annotations.
+    pub adopted_page_fields: usize,
+}
+
+/// Read all terminal fields and the page-only adoption count in one enumeration.
+pub fn fields_with_adopted(doc: &Document) -> Fields {
+    let (items, adopted_page_fields) = enumerate(doc);
+    Fields { items, adopted_page_fields }
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Whole-form readings ([`enumerate`]) on this thread.
+    static FORM_READS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// How many times this thread has read the whole form.
+#[cfg(test)]
+pub(crate) fn form_reads() -> usize {
+    FORM_READS.with(std::cell::Cell::get)
+}
+
+pub(crate) fn enumerate(doc: &Document) -> (Vec<Field>, usize) {
+    #[cfg(test)]
+    FORM_READS.with(|n| n.set(n.get() + 1));
+    let af = acroform(doc);
+    let mut page_of = std::collections::HashMap::new();
+    let mut annot_index = std::collections::HashMap::new();
+    let pages = page_refs(doc);
+    for (i, p) in pages.iter().enumerate() {
+        if let Some(a) = doc.get(*p).as_dict().and_then(|d| d.get(b"Annots").cloned()) {
+            for (k, e) in doc.resolve(&a).as_array().into_iter().flatten().enumerate() {
+                if let Some(r) = e.as_ref() {
+                    page_of.entry(r).or_insert(i);
+                    annot_index.entry(r).or_insert(k);
+                }
+            }
+        }
+    }
+    let base = match &af {
+        Some(af) => Inherited {
+            da: af.get(b"DA").and_then(|o| text_of(&doc.resolve(o))),
+            q: af.get(b"Q").and_then(|o| doc.resolve(o).as_int()),
+            ..Default::default()
+        },
+        None => Inherited::default(),
+    };
+    let mut out = Vec::new();
+    let mut seen = Seen { fields: std::collections::HashSet::new(), widgets: std::collections::HashSet::new(), scripts: script_budget() };
+    if let Some(af) = &af {
+        for f in af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default() {
+            if let Some(r) = f.as_ref() {
+                walk(doc, r, &base, &page_of, &mut seen, &mut out, 0);
+            }
+        }
+    }
+    let listed = out.len();
+    adopt_page_fields(doc, &pages, &base, &page_of, &mut seen, &mut out);
+    let adopted = out.len() - listed;
+    rank_tabs(doc, &pages, &annot_index, &mut out);
+    (out, adopted)
+}
+
+/// Widget annotations no `/Fields` entry reaches are adopted as fields, as Acrobat and the
+/// browsers do: some writers list only some of the fields, or none at all. Each widget is adopted
+/// through its topmost unlisted `/Parent`, so a field split across several widgets stays one
+/// field. Tree-listed fields keep their order first; the rest follow in page-annotation order.
+fn adopt_page_fields(
+    doc: &Document,
+    pages: &[ObjRef],
+    base: &Inherited,
+    page_of: &std::collections::HashMap<ObjRef, usize>,
+    seen: &mut Seen,
+    out: &mut Vec<Field>,
+) {
+    for p in pages {
+        let Some(a) = doc.get(*p).as_dict().and_then(|d| d.get(b"Annots").cloned()) else { continue };
+        let annots = doc.resolve(&a);
+        let Some(annots) = annots.as_array() else { continue };
+        for e in annots {
+            let Some(r) = e.as_ref() else { continue };
+            if seen.fields.contains(&r) || seen.widgets.contains(&r) {
+                continue;
+            }
+            let obj = doc.get(r);
+            let Some(d) = obj.as_dict() else { continue };
+            if d.name(b"Subtype") != Some(b"Widget") {
+                continue;
+            }
+            if !d.contains(b"FT") && !d.contains(b"T") && !d.contains(b"Parent") {
+                continue;
+            }
+            if let Some(root) = unlisted_root(doc, r, &seen.fields) {
+                walk(doc, root, base, page_of, seen, out, 0);
+            }
+        }
+    }
+}
+
+/// The topmost field above `r` (itself without a `/Parent`), or `None` when `r` or an ancestor is
+/// already reachable from the `/Fields` tree, or a `/Parent` loop hides the top.
+fn unlisted_root(doc: &Document, r: ObjRef, seen: &std::collections::HashSet<ObjRef>) -> Option<ObjRef> {
+    let mut top = r;
+    let mut visited = std::collections::HashSet::from([r]);
+    loop {
+        let parent = doc.get(top).as_dict().and_then(|d| d.reference(b"Parent"));
+        let Some(p) = parent else {
+            return if seen.contains(&top) { None } else { Some(top) };
+        };
+        if !visited.insert(p) || visited.len() > 64 {
+            return None;
+        }
+        if seen.contains(&p) {
+            return None;
+        }
+        top = p;
+    }
+}
+
+/// What one reading of the form's fields has used: the field and widget dictionaries read, and
+/// the script budget their actions share.
+struct Seen {
+    fields: std::collections::HashSet<ObjRef>,
+    /// A widget belongs to the first field that lists it, however often it is listed.
+    widgets: std::collections::HashSet<ObjRef>,
+    scripts: DecodeBudget,
+}
+
+/// Read the field at `r` and the fields under it into `out`, with what they inherit from
+/// `parent`: kids with a name are fields of their own, kids without are this field's widgets.
+fn walk(
+    doc: &Document,
+    r: ObjRef,
+    parent: &Inherited,
+    page_of: &std::collections::HashMap<ObjRef, usize>,
+    seen: &mut Seen,
+    out: &mut Vec<Field>,
+    depth: usize,
+) {
+    if depth > 64 || !seen.fields.insert(r) {
+        return;
+    }
+    let obj = doc.get(r);
+    let Some(d) = obj.as_dict() else { return };
+    let mut inh = parent.clone();
+    if let Some(t) = d.get(b"T").and_then(|o| text_of(&doc.resolve(o))) {
+        inh.name = if inh.name.is_empty() { t } else { format!("{}.{t}", inh.name) };
+    }
+    if let Some(ft) = d.name(b"FT") {
+        inh.ft = Some(ft.to_vec());
+    }
+    if let Some(ff) = field_flags(doc, d) {
+        inh.ff = Some(ff);
+    }
+    for (k, slot) in [(&b"V"[..], &mut inh.v), (b"DV", &mut inh.dv)] {
+        if let Some(v) = d.get(k) {
+            *slot = Some(v.clone());
+        }
+    }
+    if let Some(da) = d.get(b"DA").and_then(|o| text_of(&doc.resolve(o))) {
+        inh.da = Some(da);
+    }
+    if let Some(q) = d.get(b"Q").and_then(|o| doc.resolve(o).as_int()) {
+        inh.q = Some(q);
+    }
+    if let Some(m) = d.get(b"MaxLen").and_then(|o| doc.resolve(o).as_int()) {
+        // Compatibility: some writers emit zero for an unlimited text field. Keep /MaxLen
+        // untouched in the object graph, but expose only positive limits to both UI and API.
+        // An explicit zero also clears an inherited limit rather than inheriting it again.
+        inh.max_len = usize::try_from(m).ok().filter(|limit| *limit > 0);
+    }
+    let kids: Vec<ObjRef> =
+        d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default().iter().filter_map(|k| k.as_ref()).collect();
+    // Kids with /T are fields; kids without are this field's widgets.
+    let field_kids: Vec<ObjRef> = kids.iter().copied().filter(|k| doc.get(*k).as_dict().is_some_and(|kd| kd.contains(b"T"))).collect();
+    if !field_kids.is_empty() {
+        for k in field_kids {
+            walk(doc, k, &inh, page_of, seen, out, depth + 1);
+        }
+        return;
+    }
+    // A field of no kind this reads is skipped before it claims widgets or scripts, which a later
+    // field listing them then reads.
+    let ff = inh.ff.unwrap_or(0);
+    let kind = match inh.ft.as_deref() {
+        Some(b"Tx") => FieldKind::Text,
+        Some(b"Btn") if ff & flags::PUSH_BUTTON != 0 => FieldKind::PushButton,
+        Some(b"Btn") if ff & flags::RADIO != 0 => FieldKind::Radio,
+        Some(b"Btn") => FieldKind::CheckBox,
+        Some(b"Ch") if ff & flags::COMBO != 0 => FieldKind::Combo,
+        Some(b"Ch") => FieldKind::List,
+        Some(b"Sig") => FieldKind::Signature,
+        _ => return,
+    };
+    let widget_refs: Vec<ObjRef> = if d.contains(b"Rect") { vec![r] } else { kids };
+    let widget_refs: Vec<ObjRef> = widget_refs.into_iter().filter(|w| seen.widgets.insert(*w)).collect();
+    let actions = actions_of(doc, d, &widget_refs, &mut seen.scripts);
+    let button = (inh.ft.as_deref() == Some(b"Btn") && inh.ff.unwrap_or(0) & flags::PUSH_BUTTON != 0)
+        .then(|| button_action(doc, d, &widget_refs, &mut seen.scripts))
+        .flatten();
+    let widgets = widget_refs
+        .into_iter()
+        .filter_map(|w| {
+            let wo = doc.get(w);
+            let wd = wo.as_dict()?;
+            let rect = nums(doc, wd.get(b"Rect")).filter(|r| r.len() == 4).unwrap_or_else(|| vec![0.0; 4]);
+            let annot_flags = wd.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
+            let own_ff = if w == r { 0 } else { field_flags(doc, wd).unwrap_or(0) };
+            let on_state = wd
+                .get(b"AP")
+                .map(|ap| doc.resolve(ap))
+                .and_then(|ap| ap.as_dict().and_then(|a| a.get(b"N").cloned()))
+                .and_then(|n| doc.resolve(&n).as_dict().cloned())
+                .and_then(|n| n.iter().map(|(k, _)| name_text(k)).find(|k| k != "Off"));
+            Some(Widget {
+                obj: w,
+                page: page_of.get(&w).copied(),
+                rect: [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])],
+                on_state: on_state.filter(|_| matches!(kind, FieldKind::CheckBox | FieldKind::Radio)),
+                state: wd.name(b"AS").map(name_text),
+                tab: usize::MAX,
+                locked: annot_flags & 128 != 0,
+                hidden: annot_flags & (2 | 32) != 0,
+                read_only: (ff | own_ff) & flags::READ_ONLY != 0,
+                rotation: appearance::mk_rotation(doc, wd),
+                caption: (kind == FieldKind::PushButton)
+                    .then(|| {
+                        let mk = doc.resolve(wd.get(b"MK")?);
+                        let value = doc.resolve(mk.as_dict()?.get(b"CA")?);
+                        value.as_string().map(|s| s.to_text())
+                    })
+                    .flatten(),
+                list: (kind == FieldKind::List).then(|| appearance::list_rows_of(doc, inh.da.as_deref().unwrap_or("/Helv 0 Tf 0 g"), Some(d), wd)),
+                round: kind == FieldKind::Radio || (kind == FieldKind::CheckBox && appearance::is_round(doc, wd)),
+            })
+        })
+        .collect();
+    let options = d
+        .get(b"Opt")
+        .map(|o| doc.resolve(o))
+        .and_then(|o| o.as_array().cloned())
+        .unwrap_or_default()
+        .iter()
+        .filter_map(|o| match &*doc.resolve(o) {
+            Object::Array(pair) if pair.len() >= 2 => Some((text_of(&doc.resolve(&pair[0]))?, text_of(&doc.resolve(&pair[1]))?)),
+            other => text_of(other).map(|t| (t.clone(), t)),
+        })
+        .collect();
+    out.push(Field {
+        name: inh.name.clone(),
+        obj: r,
+        kind,
+        value: values_of(doc, inh.v.as_ref()),
+        default: values_of(doc, inh.dv.as_ref()),
+        flags: ff,
+        max_len: inh.max_len,
+        options,
+        da: inh.da.clone().unwrap_or_else(|| "/Helv 0 Tf 0 g".into()),
+        quadding: inh.q.unwrap_or(0),
+        tooltip: d.get(b"TU").and_then(|o| text_of(&doc.resolve(o))),
+        widgets,
+        actions,
+        button,
+    });
+}
+
+pub(crate) fn field_flags(doc: &Document, dict: &Dict) -> Option<u32> {
+    dict.get(b"Ff").and_then(|value| doc.resolve(value).as_int()).and_then(|value| u32::try_from(value).ok())
+}
diff --git a/crates/forms/src/tab_order.rs b/crates/forms/src/tab_order.rs
new file mode 100644
index 0000000000..9c5c33b694
--- /dev/null
+++ b/crates/forms/src/tab_order.rs
@@ -0,0 +1,153 @@
+use super::read::{fields, page_refs};
+use super::*;
+
+/// A page's tab order (`/Tabs`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum TabOrder {
+    /// Rows, top to bottom, left to right within a row (`/R`).
+    Row,
+    /// Columns, left to right, top to bottom within a column (`/C`).
+    Column,
+    /// The document structure (`/S`; annotation order when the file has none).
+    Structure,
+    /// Unspecified: annotation order.
+    Annotations,
+}
+
+impl TabOrder {
+    fn of(name: Option<&[u8]>) -> TabOrder {
+        match name {
+            Some(b"R") => TabOrder::Row,
+            Some(b"C") => TabOrder::Column,
+            Some(b"S") => TabOrder::Structure,
+            _ => TabOrder::Annotations,
+        }
+    }
+}
+
+/// A widget on a page for tab ordering: (page, field, widget, rect, annotation index).
+type TabItem = (usize, usize, usize, [f64; 4], usize);
+
+/// Every widget's place in the tab order.
+pub(crate) fn rank_tabs(doc: &Document, pages: &[ObjRef], annot_index: &std::collections::HashMap<ObjRef, usize>, out: &mut [Field]) {
+    let mut items: Vec<TabItem> = Vec::new();
+    for (fi, f) in out.iter().enumerate() {
+        for (wi, w) in f.widgets.iter().enumerate() {
+            if let Some(p) = w.page {
+                items.push((p, fi, wi, w.rect, annot_index.get(&w.obj).copied().unwrap_or(usize::MAX)));
+            }
+        }
+    }
+    let mut ordered: Vec<(usize, usize)> = Vec::with_capacity(items.len());
+    for (pi, p) in pages.iter().enumerate() {
+        let mut on: Vec<_> = items.iter().filter(|i| i.0 == pi).collect();
+        if on.is_empty() {
+            continue;
+        }
+        let tabs = TabOrder::of(doc.get(*p).as_dict().and_then(|d| d.name(b"Tabs")));
+        match tabs {
+            TabOrder::Row | TabOrder::Column => {
+                let row = tabs == TabOrder::Row;
+                // Primary axis: rows by top edge (down the page), columns by left edge.
+                on.sort_by(|a, b| if row { b.3[3].total_cmp(&a.3[3]) } else { a.3[0].total_cmp(&b.3[0]) });
+                let mut groups: Vec<Vec<&TabItem>> = Vec::new();
+                for it in on {
+                    let fits = groups.last().is_some_and(|g| {
+                        let first = g[0];
+                        if row {
+                            (first.3[3] - it.3[3]).abs() < ((first.3[3] - first.3[1]) / 2.0).max(2.0)
+                        } else {
+                            (it.3[0] - first.3[0]).abs() < ((first.3[2] - first.3[0]) / 2.0).max(2.0)
+                        }
+                    });
+                    if fits && let Some(g) = groups.last_mut() {
+                        g.push(it);
+                    } else {
+                        groups.push(vec![it]);
+                    }
+                }
+                for mut g in groups {
+                    g.sort_by(|a, b| if row { a.3[0].total_cmp(&b.3[0]) } else { b.3[3].total_cmp(&a.3[3]) });
+                    ordered.extend(g.iter().map(|i| (i.1, i.2)));
+                }
+            }
+            TabOrder::Structure | TabOrder::Annotations => {
+                on.sort_by_key(|i| i.4);
+                ordered.extend(on.iter().map(|i| (i.1, i.2)));
+            }
+        }
+    }
+    for f in out.iter_mut() {
+        for w in &mut f.widgets {
+            w.tab = usize::MAX;
+        }
+    }
+    for (rank, (fi, wi)) in ordered.into_iter().enumerate() {
+        out[fi].widgets[wi].tab = rank;
+    }
+}
+
+/// Set the tab order of pages (0-based).
+pub fn set_tab_order(doc: &mut Document, pages: &[usize], order: TabOrder) -> Result<(), FormError> {
+    let refs = page_refs(doc);
+    for &p in pages {
+        let r = *refs.get(p).ok_or_else(|| FormError::Invalid(format!("page {} does not exist", p + 1)))?;
+        doc.update_dict(r, |d| match order {
+            TabOrder::Row => d.set(b"Tabs".to_vec(), Object::name("R")),
+            TabOrder::Column => d.set(b"Tabs".to_vec(), Object::name("C")),
+            TabOrder::Structure => d.set(b"Tabs".to_vec(), Object::name("S")),
+            TabOrder::Annotations => {
+                d.remove(b"Tabs");
+            }
+        })?;
+    }
+    Ok(())
+}
+
+/// Order tabs manually (Acrobat: Fields ▸ Tab Order ▸ Order Tabs Manually, then drag a field):
+/// move field `name` one place earlier or later in its page's tab order. The page switches to
+/// annotation order (`/Tabs` removed) and its widgets are reordered in `/Annots`; other
+/// annotations keep their places.
+pub fn move_in_tab_order(doc: &mut Document, name: &str, earlier: bool) -> Result<(), FormError> {
+    let all = fields(doc);
+    let f = all.iter().find(|f| f.name == name).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    let page = f.widgets.iter().filter_map(|w| w.page).min().ok_or_else(|| FormError::Invalid(format!("{name} is not on a page")))?;
+    // The page's fields in their current tab order (a field counts once, at its first widget).
+    let mut order: Vec<(usize, &str)> =
+        all.iter().filter_map(|g| g.widgets.iter().filter(|w| w.page == Some(page)).map(|w| w.tab).min().map(|t| (t, g.name.as_str()))).collect();
+    order.sort();
+    let names: Vec<&str> = order.iter().map(|(_, n)| *n).collect();
+    let Some(i) = names.iter().position(|n| *n == name) else { return invalid(format!("{name} is not on a page")) };
+    let j = if earlier { i.checked_sub(1) } else { Some(i + 1).filter(|j| *j < names.len()) };
+    let Some(j) = j else { return Ok(()) };
+    let mut names = names.into_iter().map(str::to_string).collect::<Vec<_>>();
+    names.swap(i, j);
+    // The widgets of this page in the new order.
+    let mut widgets: Vec<ObjRef> = Vec::new();
+    for n in &names {
+        if let Some(g) = all.iter().find(|g| &g.name == n) {
+            widgets.extend(g.widgets.iter().filter(|w| w.page == Some(page)).map(|w| w.obj));
+        }
+    }
+    let pr = *page_refs(doc).get(page).ok_or_else(|| FormError::Invalid("no such page".into()))?;
+    let annots_obj =
+        doc.get(pr).as_dict().and_then(|d| d.get(b"Annots").cloned()).ok_or_else(|| FormError::Invalid("the page has no annotations".into()))?;
+    let list = doc.resolve(&annots_obj).as_array().cloned().unwrap_or_default();
+    let mut next = widgets.into_iter();
+    let set: std::collections::HashSet<ObjRef> = all.iter().flat_map(|g| g.widgets.iter().filter(|w| w.page == Some(page)).map(|w| w.obj)).collect();
+    let new_list: Vec<Object> = list
+        .iter()
+        .map(|o| match o.as_ref() {
+            Some(r) if set.contains(&r) => next.next().map(Object::Ref).unwrap_or_else(|| o.clone()),
+            _ => o.clone(),
+        })
+        .collect();
+    match annots_obj {
+        Object::Ref(ar) => doc.set(ar, Object::Array(new_list)),
+        _ => doc.update_dict(pr, |d| d.set(b"Annots".to_vec(), Object::Array(new_list)))?,
+    }
+    doc.update_dict(pr, |d| {
+        d.remove(b"Tabs");
+    })?;
+    Ok(())
+}
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 54bc137abd..61dab131e0 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -4088,6 +4088,65 @@ fn a_password_field_missing_from_the_field_list_is_still_cleared() {
     }
 }
 
+/// A password field nested beyond depth 32 (e.g. depth 35) is recognized by `has_password_flag`
+/// and `has_password_values`, matching the field tree walk limit of 64.
+#[test]
+fn a_password_field_nested_beyond_depth_32_is_recognized() {
+    let target_depth = 35;
+    let leaf_obj_num = 5 + target_depth;
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Fields [5 0 R] /DA (/Helv 0 Tf 0 g) >>".into(),
+    ];
+    for d in 0..target_depth {
+        let obj_num = 5 + d;
+        let next_obj_num = obj_num + 1;
+        let parent_entry = if d == 0 { String::new() } else { format!(" /Parent {} 0 R", obj_num - 1) };
+        objs.push(format!("<< /T (node{d}) /Kids [{next_obj_num} 0 R]{parent_entry} >>"));
+    }
+    objs.push(format!(
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (pass) /Ff 8192 /V (secret35) /Parent {} 0 R /Rect [50 600 150 620] /P 3 0 R >>",
+        leaf_obj_num - 1
+    ));
+    let mut doc = document(&objs);
+    assert!(has_password_flag(&doc));
+    assert!(has_password_values(&doc));
+    assert_eq!(clear_password_values(&mut doc).unwrap(), 1);
+    assert!(!has_password_values(&doc));
+}
+
+/// A password field whose widget is reachable through a page's Annots and whose inherited Password
+/// flag is deeper than 32 levels is recognized by `has_password_flag`.
+#[test]
+fn a_page_widget_inheriting_password_flag_beyond_depth_32_is_recognized() {
+    let target_depth = 35;
+    let leaf_obj_num = 5 + target_depth;
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        format!("<< /Type /Page /Parent 2 0 R /Annots [{leaf_obj_num} 0 R] >>"),
+        "<< /Fields [5 0 R] /DA (/Helv 0 Tf 0 g) >>".into(),
+    ];
+    for d in 0..target_depth {
+        let obj_num = 5 + d;
+        let next_obj_num = obj_num + 1;
+        let parent_entry = if d == 0 { String::new() } else { format!(" /Parent {} 0 R", obj_num - 1) };
+        let ff_entry = if d == 0 { " /Ff 8192" } else { "" };
+        objs.push(format!("<< /T (node{d}){ff_entry} /Kids [{next_obj_num} 0 R]{parent_entry} >>"));
+    }
+    objs.push(format!(
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (pass) /V (secret_chain) /Parent {} 0 R /Rect [50 600 150 620] /P 3 0 R >>",
+        leaf_obj_num - 1
+    ));
+    let mut doc = document(&objs);
+    assert!(has_password_flag(&doc));
+    assert!(has_password_values(&doc));
+    assert_eq!(clear_password_values(&mut doc).unwrap(), 1);
+    assert!(!has_password_values(&doc));
+}
+
 /// #4018: a value that doesn't fit its box at the field's font size is reported (it is drawn cut
 /// at the box). An auto-sized field shrinks to fit, and a short or empty value fits.
 #[test]
@@ -4300,3 +4359,221 @@ fn comb_fields_show_their_cells() {
     let plain = saved_look(&doc, "d");
     assert!(!plain.contains(" m ") && plain.contains("(A) Tj"), "{plain}");
 }
+
+/// Check boxes and radio buttons with an `/MK` look and appearances of their own, in a form that
+/// sets `/NeedAppearances` (`need`) or not.
+fn mk_buttons(need: bool) -> Document {
+    let flag = if need { "/NeedAppearances true " } else { "" };
+    let widget = |n: &str, rest: &str| format!("<< /Type /Annot /Subtype /Widget /FT /Btn /T ({n}) /F 4 /P 3 0 R {rest} >>");
+    let states = |on: &str| format!("/AP << /N << /{on} 15 0 R /Off 16 0 R >> >>");
+    document(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R] >>".into(),
+        format!(
+            "<< /Fields [6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R] {flag}/DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >>"
+        ),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        widget("check", &format!("/V /Yes /AS /Yes /DA (/Helv 0 Tf 0 g) /MK << /BC [0 0 0] /CA (4) >> /Rect [50 700 74 724] {}", states("Yes"))), // 6
+        widget("cross", &format!("/V /Yes /AS /Yes /DA (/ZaDb 0 Tf 1 0 0 rg) /MK << /CA (8) >> /Rect [100 700 124 724] {}", states("Yes"))),
+        widget("diamond", &format!("/V /Yes /AS /Yes /MK << /CA (u) /BG [1 1 0] >> /Rect [150 700 174 724] {}", states("Yes"))),
+        widget("square", &format!("/V /Yes /AS /Yes /MK << /CA (n) >> /Rect [200 700 224 724] {}", states("Yes"))),
+        widget("star", &format!("/V /Yes /AS /Yes /MK << /CA (H) >> /Rect [250 700 274 724] {}", states("Yes"))), // 10
+        widget("off", &format!("/V /Off /AS /Off /MK << /BC [0 0 0] /CA (4) >> /Rect [300 700 324 724] {}", states("Yes"))),
+        widget("radio", &format!("/Ff 32768 /V /B /MK << /BC [0 0 1] /CA (l) >> /Rect [350 700 374 724] {}", states("B"))),
+        widget("plain", &format!("/V /Yes /AS /Yes /Rect [400 700 424 724] {}", states("Yes"))),
+        widget(
+            "odd",
+            &format!(
+                "/V /Yes /AS /Yes /DA (/ZaDb nan Tf 1 x rg) /MK << /CA 42 /BC [(no) /Name] /BG 7 >> /BS << /W -3 >> /Rect [450 700 474 724] {}",
+                states("Yes")
+            ),
+        ),
+        "<< /Length 24 >>\nstream\n0 g 4 4 16 16 re f\nendstream".into(), // 15: a filled square
+        "<< /Length 4 >>\nstream\nq\nQ\nendstream".into(),
+    ])
+}
+
+/// ISO 32000-2 Table 224 (`/NeedAppearances`) and Table 192 (`/MK /CA`): a form that leaves its
+/// appearances to the viewer shows each check box and radio button with an `/MK` drawn from it,
+/// over the appearance the file carries: the caption's ZapfDingbats symbol in the `/DA` colour
+/// when on, only the border when off. A widget with no `/MK` keeps its own; the file is untouched.
+#[test]
+fn need_appearances_draws_check_boxes_and_radio_buttons_from_their_captions() {
+    let doc = mk_buttons(true);
+    let copy = with_field_appearances(&doc).expect("buttons to draw");
+    let all = fields(&copy);
+    for (name, state, symbol, colour) in [
+        ("check", "Yes", "(4) Tj", "0 g"),
+        ("cross", "Yes", "(8) Tj", "1 0 0 rg"),
+        ("diamond", "Yes", "(u) Tj", "0 g"),
+        ("square", "Yes", "(n) Tj", "0 g"),
+        ("star", "Yes", "(H) Tj", "0 g"),
+        ("radio", "B", "(l) Tj", "0 g"),
+    ] {
+        let shown = state_ap(&copy, &field(&all, name).widgets[0], state);
+        assert!(shown.contains(symbol) && shown.contains(&format!("{colour}\n")), "{name}: {shown}");
+        assert!(!shown.contains("4 4 16 16 re f"), "{name} is not the file's filled square: {shown}");
+    }
+    let check = state_ap(&copy, &field(&all, "check").widgets[0], "Yes");
+    assert!(check.contains("0 0 0 RG\n1 w\n0.5 0.5 23 23 re S"), "the /BC border: {check}");
+    assert!(state_ap(&copy, &field(&all, "diamond").widgets[0], "Yes").contains("1 1 0 rg\n0 0 24 24 re f"), "the /BG background");
+    assert!(state_ap(&copy, &field(&all, "radio").widgets[0], "B").contains("0 0 1 RG"), "the radio's own border");
+    let off = state_ap(&copy, &field(&all, "off").widgets[0], "Off");
+    assert!(off.contains("re S") && !off.contains("Tj"), "off: only the border: {off}");
+    // Nonsense in /MK, /DA and /BS: the default check, no border, and no panic.
+    let odd = state_ap(&copy, &field(&all, "odd").widgets[0], "Yes");
+    assert!(odd.contains("(4) Tj") && !odd.contains("re S"), "{odd}");
+    let own = |d: &Document, name: &str| d.get(field(&fields(d), name).widgets[0].obj).as_dict().and_then(|w| w.get(b"AP").cloned());
+    assert_eq!(own(&copy, "plain"), own(&doc, "plain"), "a box without /MK keeps its own look");
+    assert_eq!(state_ap(&doc, &field(&fields(&doc), "check").widgets[0], "Yes").trim_end(), "0 g 4 4 16 16 re f", "the file is untouched");
+}
+
+/// Without `/NeedAppearances` the file's own check box and radio button appearances are shown
+/// as they are, `/MK` or not: no copy is needed.
+#[test]
+fn without_need_appearances_buttons_keep_their_own_appearances() {
+    assert!(with_field_appearances(&mk_buttons(false)).is_none());
+}
+
+/// A form for filling many values at once: two summed fields and their calculated total, a
+/// name two field dictionaries share, a check box, a radio group, a list and a read-only field.
+fn batch_form() -> Document {
+    let tx = |name: &str, y: u32, rest: &str| {
+        format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [50 {y} 250 {}] /P 3 0 R {rest} >>", y + 20)
+    };
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 12 0 R 13 0 R 14 0 R 17 0 R] >>".into(),
+        "<< /Fields [5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R 14 0 R 17 0 R] /CO [7 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 15 0 R >> >> >>"
+            .into(),
+        tx("a", 700, "/V (1)"),
+        tx("b", 660, ""),
+        tx("total", 620, r#"/AA << /C << /S /JavaScript /JS (AFSimple_Calculate\("SUM", new Array\("a", "b"\)\);) >> >>"#),
+        tx("dup", 580, ""),
+        tx("dup", 540, ""),
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Off /AS /Off /Rect [300 700 315 715] /P 3 0 R >>".into(),
+        "<< /FT /Btn /T (size) /Ff 49152 /Kids [12 0 R 13 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /Parent 11 0 R /AS /Off /Rect [300 650 315 665] /P 3 0 R /AP << /N << /S 16 0 R /Off 16 0 R >> >> >>"
+            .into(),
+        "<< /Type /Annot /Subtype /Widget /Parent 11 0 R /AS /Off /Rect [330 650 345 665] /P 3 0 R /AP << /N << /L 16 0 R /Off 16 0 R >> >> >>"
+            .into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /T (country) /Ff 131072 /Opt [[(ca) (Canada)] [(fr) (France)]] /Rect [300 600 450 620] /P 3 0 R >>"
+            .into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".into(),
+        "<< /Length 0 >>\nstream\n\nendstream".into(),
+        tx("locked", 500, "/Ff 1 /V (kept)"),
+    ];
+    document(&objs)
+}
+
+/// What a filled form shows: every field as read, and each widget's drawn appearance.
+fn filled(doc: &Document) -> (Vec<Field>, Vec<String>) {
+    let all = fields(doc);
+    let looks = all
+        .iter()
+        .flat_map(|f| &f.widgets)
+        .map(|w| {
+            let wd = doc.get(w.obj).as_dict().cloned().unwrap_or_default();
+            let n = wd.get(b"AP").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().and_then(|a| a.get(b"N").cloned()));
+            match n.map(|n| doc.resolve(&n)) {
+                Some(n) => match &*n {
+                    Object::Stream(s) => String::from_utf8_lossy(&s.decoded().unwrap_or_default()).into_owned(),
+                    other => format!("{other:?}").chars().filter(|c| !c.is_ascii_digit()).collect(),
+                },
+                None => String::new(),
+            }
+        })
+        .collect();
+    (all, looks)
+}
+
+/// Filling values in one batch leaves the form as filling them one by one does: the values,
+/// the twin of a shared name, the calculated total and every widget's appearance; a name given
+/// twice ends with its last value, and is checked against the value it took earlier in the batch;
+/// and each value fails as it would on its own.
+#[test]
+fn set_values_fills_as_set_value_does_one_by_one() {
+    let values: Vec<(String, FieldValue)> = vec![
+        ("a".into(), FieldValue::Text("2".into())),
+        ("b".into(), FieldValue::Text("3".into())),
+        ("dup".into(), FieldValue::Text("shared".into())),
+        ("agree".into(), FieldValue::Check(true)),
+        ("size".into(), FieldValue::Radio(Some("L".into()))),
+        ("country".into(), FieldValue::Choice(vec!["fr".into()])),
+        ("nowhere".into(), FieldValue::Text("x".into())),
+        ("locked".into(), FieldValue::Text("changed".into())),
+        ("size".into(), FieldValue::Radio(Some("XL".into()))),
+        ("dup".into(), FieldValue::Text("again".into())),
+        ("a".into(), FieldValue::Text("10".into())),
+        // Refused only because the batch already selected L: the group keeps one selected.
+        ("size".into(), FieldValue::Radio(None)),
+    ];
+    let mut one_by_one = batch_form();
+    let expected: Vec<Result<(), FormError>> = values.iter().map(|(n, v)| set_value(&mut one_by_one, n, v)).collect();
+    let mut batch = batch_form();
+    let results = set_values(&mut batch, &values).expect("recalculates");
+    assert_eq!(results, expected);
+    assert_eq!(
+        results.iter().filter(|r| r.is_err()).count(),
+        4,
+        "the unknown name, the read-only field, the unknown option and clearing the group fail: {results:?}"
+    );
+    let (all, looks) = filled(&batch);
+    assert_eq!((all.clone(), looks), filled(&one_by_one));
+    assert_eq!(field(&all, "total").value, ["13"], "recalculated once, after the last value");
+    assert!(all.iter().filter(|f| f.name == "dup").all(|f| f.value == ["again"]), "both dup fields take the last value");
+    // And as saved.
+    assert_eq!(filled(&reopen(&batch)), filled(&reopen(&one_by_one)));
+}
+
+/// A form without fields refuses each value, and an empty batch changes nothing.
+#[test]
+fn set_values_without_a_form_or_values() {
+    let mut doc = document(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+    ]);
+    let r = set_values(&mut doc, &[("a".into(), FieldValue::Text("1".into()))]).unwrap();
+    assert_eq!(r, vec![Err(FormError::NoForm)]);
+    let mut form = batch_form();
+    assert_eq!(set_values(&mut form, &[]).unwrap(), Vec::new());
+    assert!(!form.is_modified());
+    // Nothing filled, nothing recalculated: the total stays as the file has it.
+    let r = set_values(&mut form, &[("nowhere".into(), FieldValue::Text("1".into()))]).unwrap();
+    assert_eq!(r, vec![Err(FormError::NoSuchField("nowhere".into()))]);
+    assert!(field(&fields(&form), "total").value.is_empty() && !form.is_modified());
+}
+
+/// Filling many fields reads the form a fixed number of times, not once or twice per field
+/// (which took minutes to open a form with thousands of fields whose XFA data was filled in
+/// elsewhere).
+#[test]
+fn set_values_reads_the_form_once_not_per_value() {
+    let n: u32 = 60;
+    let mut objs: Vec<String> =
+        vec!["<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(), "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into()];
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", i + 5)).collect();
+    objs.push(format!("<< /Type /Page /Parent 2 0 R /Annots [{}] >>", kids.join(" ")));
+    objs.push(format!("<< /Fields [{}] /DA (/Helv 10 Tf 0 g) >>", kids.join(" ")));
+    for i in 0..n {
+        objs.push(format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (f{i}) /Rect [50 {y} 250 {top}] /P 3 0 R >>", y = 10 * i, top = 10 * i + 10));
+    }
+    let mut doc = document(&objs);
+    let values: Vec<(String, FieldValue)> = (0..n).map(|i| (format!("f{i}"), FieldValue::Text(format!("v{i}")))).collect();
+    let before = form_reads();
+    let results = set_values(&mut doc, &values).unwrap();
+    let reads = form_reads() - before;
+    assert!(results.iter().all(Result::is_ok));
+    // One reading to fill, one to recalculate.
+    assert!(reads <= 2, "{reads} readings of the form for {n} values");
+    assert!(fields(&doc).iter().all(|f| f.value == [format!("v{}", &f.name[1..])]));
+    // A name filled again is read again, once: f0 and f1 again cost one more reading.
+    let again: Vec<(String, FieldValue)> = ["f0", "f1", "f0", "f1"].iter().map(|n| (n.to_string(), FieldValue::Text("w".into()))).collect();
+    let before = form_reads();
+    assert!(set_values(&mut doc, &again).unwrap().iter().all(Result::is_ok));
+    let reads = form_reads() - before;
+    assert_eq!(reads, 3, "one to fill, one when f0 comes again, one to recalculate");
+}
diff --git a/crates/forms/src/values.rs b/crates/forms/src/values.rs
new file mode 100644
index 0000000000..9dd79f0a70
--- /dev/null
+++ b/crates/forms/src/values.rs
@@ -0,0 +1,638 @@
+use super::appearances::{declares_pdfa, need_appearances};
+use super::read::{acroform, field_flags, fields, page_refs};
+use super::*;
+
+// ── writing ─────────────────────────────────────────────────────────────────────────────────
+
+/// Fill the field `name`.
+pub fn set_value(doc: &mut Document, name: &str, value: &FieldValue) -> Result<(), FormError> {
+    set_value_with(doc, name, value, &mut NoScripts)
+}
+
+/// [`set_value`], running the fields' JavaScript through `scripts`.
+pub fn set_value_with(doc: &mut Document, name: &str, value: &FieldValue, scripts: &mut dyn Scripts) -> Result<(), FormError> {
+    let all = fields(doc);
+    if all.is_empty() {
+        return Err(FormError::NoForm);
+    }
+    let named: Vec<usize> = all.iter().enumerate().filter(|(_, f)| f.name == name).map(|(i, _)| i).collect();
+    fill(doc, &all, &named, name, value, scripts)?;
+    recalculate_with(doc, scripts)?;
+    Ok(())
+}
+
+/// Fill several fields, as [`set_value`] fills each in turn, but reading the form once and
+/// recalculating once, after the last value. Filling fields one by one reads the whole form twice
+/// per field, which takes minutes on a form with thousands of fields.
+///
+/// Returns each value's result, in order. The outer `Err` is the recalculation failing, after
+/// which, as with [`set_value`], no value counts as filled (though each was written).
+pub fn set_values(doc: &mut Document, values: &[(String, FieldValue)]) -> Result<Vec<Result<(), FormError>>, FormError> {
+    let mut scripts = NoScripts;
+    let mut form = NamedFields::read(doc);
+    // The field objects this batch wrote since the form was last read.
+    let mut written = std::collections::HashSet::new();
+    let mut results = Vec::with_capacity(values.len());
+    let mut filled = false;
+    for (name, value) in values {
+        if form.all.is_empty() {
+            results.push(Err(FormError::NoForm));
+            continue;
+        }
+        // A field written earlier in the batch (named twice, or a twin's name) is read again,
+        // so this write starts from what the earlier one left, as it would one by one.
+        if form.objs(name).any(|o| written.contains(&o)) {
+            form = NamedFields::read(doc);
+            written.clear();
+        }
+        let named = form.named(name);
+        let result = fill(doc, &form.all, named, name, value, &mut scripts);
+        written.extend(form.objs(name));
+        filled |= result.is_ok();
+        results.push(result);
+    }
+    if filled {
+        recalculate_with(doc, &mut scripts)?;
+    }
+    Ok(results)
+}
+
+/// The form's fields, with the positions of each fully qualified name in them (in field order).
+struct NamedFields {
+    all: Vec<Field>,
+    by_name: std::collections::HashMap<String, Vec<usize>>,
+}
+
+impl NamedFields {
+    fn read(doc: &Document) -> Self {
+        let all = fields(doc);
+        let mut by_name: std::collections::HashMap<String, Vec<usize>> = std::collections::HashMap::new();
+        for (i, f) in all.iter().enumerate() {
+            by_name.entry(f.name.clone()).or_default().push(i);
+        }
+        NamedFields { all, by_name }
+    }
+
+    fn named(&self, name: &str) -> &[usize] {
+        self.by_name.get(name).map_or(&[], Vec::as_slice)
+    }
+
+    /// The field objects named `name`.
+    fn objs<'a>(&'a self, name: &str) -> impl Iterator<Item = ObjRef> + 'a {
+        self.named(name).iter().filter_map(|&i| self.all.get(i)).map(|f| f.obj)
+    }
+}
+
+/// Write `value` into the field `name`, without recalculating: `named` are the positions in
+/// `all` (the form as read before this write) of the fields with that name, in field order.
+fn fill(doc: &mut Document, all: &[Field], named: &[usize], name: &str, value: &FieldValue, scripts: &mut dyn Scripts) -> Result<(), FormError> {
+    let f = named.first().and_then(|&i| all.get(i)).ok_or_else(|| FormError::NoSuchField(name.into()))?;
+    if f.read_only() {
+        return Err(FormError::ReadOnly(name.into()));
+    }
+    write_value(doc, f, value, scripts)?;
+    author::form_fonts_as_objects(doc, all)?;
+    // Fields with the same fully qualified name are one field (§12.7.3.1). Writers that repeat a
+    // name as separate field dictionaries, instead of widgets under one parent, get the value
+    // the first one took after its scripts, without running them again.
+    let twins: Vec<&Field> = named.iter().filter_map(|&i| all.get(i)).filter(|t| t.obj != f.obj && t.kind == f.kind).collect();
+    if !twins.is_empty() {
+        let taken = fields(doc).into_iter().find(|x| x.obj == f.obj).map(|x| x.value).unwrap_or_default();
+        for t in twins {
+            share_value(doc, f.obj, t, &taken, scripts)?;
+        }
+    }
+    Ok(())
+}
+
+/// Give `twin` the value `source` holds: its `/V` (and a choice's `/I`), drawn in the twin's own
+/// widgets.
+fn share_value(doc: &mut Document, source: ObjRef, twin: &Field, value: &[String], scripts: &mut dyn Scripts) -> Result<(), FormError> {
+    match twin.kind {
+        FieldKind::CheckBox => {
+            let state = twin.widgets.iter().find_map(|w| w.on_state.clone()).unwrap_or_else(|| "Yes".into());
+            set_states(doc, twin, (!value.is_empty()).then_some(state.as_str()))
+        }
+        FieldKind::Radio => {
+            let choice = value.first().filter(|c| twin.widgets.iter().any(|w| w.on_state.as_deref() == Some(c.as_str())));
+            set_states(doc, twin, choice.map(String::as_str))
+        }
+        FieldKind::Text | FieldKind::Combo | FieldKind::List => {
+            let src = doc.get(source).as_dict().cloned().unwrap_or_default();
+            doc.update_dict(twin.obj, |d| {
+                for key in [&b"V"[..], b"I"] {
+                    match src.get(key) {
+                        Some(v) => d.set(key.to_vec(), v.clone()),
+                        None => {
+                            d.remove(key);
+                        }
+                    }
+                }
+                d.remove(b"RV");
+            })?;
+            redraw(doc, twin, value, scripts)
+        }
+        FieldKind::PushButton | FieldKind::Signature => Ok(()),
+    }
+}
+
+/// Run every field's Calculate script in the form's calculation order (`/CO`, then the other
+/// calculated fields), as Acrobat does after any value changes. Returns how many changed.
+pub fn recalculate(doc: &mut Document) -> Result<usize, FormError> {
+    recalculate_with(doc, &mut NoScripts)
+}
+
+/// [`recalculate`], running custom Calculate (and Format) scripts through `scripts`.
+pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result<usize, FormError> {
+    let mut all = fields(doc);
+    if !all.iter().any(calc_order::is_calculated) {
+        return Ok(0);
+    }
+    // By object: two fields can share a name in a malformed form, and each calculates.
+    let order: Vec<ObjRef> = calc_order::run_order(doc, &all).0.into_iter().filter_map(|(i, _)| all.get(i)).map(|f| f.obj).collect();
+    let mut changed = 0;
+    for obj in order {
+        let Some(f) = all.iter().find(|f| f.obj == obj).cloned() else { continue };
+        let lookup = |n: &str| -> Vec<String> {
+            let prefix = format!("{n}.");
+            all.iter().filter(|x| x.name == n || x.name.starts_with(&prefix)).flat_map(|x| x.value.first().cloned()).collect()
+        };
+        let current = f.value.first().cloned().unwrap_or_default();
+        let v = if let Some(js) = &f.actions.scripts.calculate {
+            let r = scripts.run(FieldEvent::Calculate, js, &f, &current, &all);
+            scripting::apply_changes(doc, &r.changes, &f.name)?;
+            if !r.changes.is_empty() {
+                all = fields(doc);
+            }
+            if !r.rc {
+                continue;
+            }
+            r.value
+        } else {
+            let Some(v) = af::calculate(&f.actions.calculate, &lookup) else { continue };
+            v
+        };
+        if current != v && matches!(f.kind, FieldKind::Text | FieldKind::Combo) {
+            doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), PdfString::text(&v)))?;
+            redraw(doc, &f, std::slice::from_ref(&v), scripts)?;
+            if let Some(target) = all.iter_mut().find(|x| x.obj == obj) {
+                target.value = vec![v];
+            }
+            changed += 1;
+        }
+    }
+    Ok(changed)
+}
+
+/// The fields whose calculation differs between two readings of a form, matched by field object
+/// and named as in `after`: the formulas an edit rewrote, such as a rename's.
+pub fn calculations_changed(before: &[Field], after: &[Field]) -> Vec<String> {
+    let before: std::collections::HashMap<ObjRef, &af::Actions> = before.iter().map(|f| (f.obj, &f.actions)).collect();
+    after
+        .iter()
+        .filter(|f| before.get(&f.obj).is_some_and(|b| b.calculate != f.actions.calculate || b.scripts.calculate != f.actions.scripts.calculate))
+        .map(|f| f.name.clone())
+        .collect()
+}
+
+pub(crate) fn write_value(doc: &mut Document, f: &Field, value: &FieldValue, scripts: &mut dyn Scripts) -> Result<(), FormError> {
+    match (f.kind, value) {
+        (FieldKind::Text, FieldValue::Text(t)) => {
+            if let Some(max) = f.max_len
+                && t.chars().count() > max
+            {
+                return invalid(format!("{:?} takes at most {max} characters", f.name));
+            }
+            // Keystroke (on commit) and Validate, as Acrobat runs them before accepting a value.
+            let t = &af::keystroke(&f.actions.format, &f.name, t).map_err(FormError::Format)?;
+            af::validate(&f.actions.validate, t).map_err(FormError::Invalid)?;
+            let t = &scripting::accept(doc, f, t, scripts)?;
+            doc.update_dict(f.obj, |d| {
+                if t.is_empty() {
+                    d.remove(b"V");
+                } else {
+                    d.set(b"V".to_vec(), PdfString::text(t));
+                }
+                d.remove(b"RV");
+            })?;
+            redraw(doc, f, std::slice::from_ref(t), scripts)
+        }
+        (FieldKind::CheckBox, v) => {
+            let state = f.widgets.iter().find_map(|w| w.on_state.clone()).unwrap_or_else(|| "Yes".into());
+            let on = match v {
+                FieldValue::Check(on) => *on,
+                // The on-state name or a yes/no word also work (agents, FDF-style data).
+                FieldValue::Text(t) | FieldValue::Radio(Some(t)) => {
+                    let t = t.trim();
+                    if t == state || f.state_for(t).is_some() || ["yes", "true", "on", "1", "x", "checked"].contains(&t.to_lowercase().as_str()) {
+                        true
+                    } else if t.is_empty() || ["no", "false", "off", "0", "unchecked"].contains(&t.to_lowercase().as_str()) {
+                        false
+                    } else {
+                        return invalid(format!("{:?} is a check box: use true or false", f.name));
+                    }
+                }
+                FieldValue::Radio(None) => false,
+                FieldValue::Choice(_) => return invalid(format!("{:?} is a check box: use true or false", f.name)),
+            };
+            set_states(doc, f, on.then_some(state.as_str()))
+        }
+        (FieldKind::Radio, v) => {
+            let choice = match v {
+                FieldValue::Radio(c) => c.clone(),
+                FieldValue::Text(t) if t.is_empty() => None,
+                FieldValue::Text(t) => Some(t.clone()),
+                FieldValue::Check(false) => None,
+                _ => return invalid(format!("{:?} is a radio group: choose one of its options", f.name)),
+            };
+            // An export value from /Opt selects its widget's on state.
+            let choice = choice.map(|c| f.state_for(&c).map(str::to_owned).unwrap_or(c));
+            if let Some(c) = &choice
+                && !f.widgets.iter().any(|w| w.on_state.as_deref() == Some(c.as_str()))
+            {
+                let opts: Vec<&str> = (0..f.widgets.len()).filter_map(|i| f.export_of(i)).collect();
+                return invalid(format!("{:?} has no option {c:?} (options: {})", f.name, opts.join(", ")));
+            }
+            if choice.is_none() && f.has(flags::NO_TOGGLE_TO_OFF) && !f.value.is_empty() {
+                return invalid(format!("{:?} must keep one option selected", f.name));
+            }
+            set_states(doc, f, choice.as_deref())
+        }
+        (FieldKind::Combo | FieldKind::List, FieldValue::Choice(_) | FieldValue::Text(_)) => {
+            let vals: Vec<String> = match value {
+                FieldValue::Choice(v) => v.clone(),
+                FieldValue::Text(t) if t.is_empty() => Vec::new(),
+                FieldValue::Text(t) => vec![t.clone()],
+                other => return invalid(format!("{:?} can't take {other:?}", f.name)),
+            };
+            if vals.len() > 1 && !(f.kind == FieldKind::List && f.has(flags::MULTI_SELECT)) {
+                return invalid(format!("{:?} takes a single value", f.name));
+            }
+            // Accept export values or display texts; free text only in editable combo boxes.
+            let mut exports = Vec::new();
+            for v in &vals {
+                match f.options.iter().find(|(e, d)| e == v || d == v) {
+                    Some((e, _)) => exports.push(e.clone()),
+                    None if f.kind == FieldKind::Combo && f.has(flags::EDIT) => exports.push(v.clone()),
+                    None if f.options.is_empty() => exports.push(v.clone()),
+                    None => {
+                        let opts: Vec<&str> = f.options.iter().map(|(_, d)| d.as_str()).collect();
+                        return invalid(format!("{:?} has no option {v:?} (options: {})", f.name, opts.join(", ")));
+                    }
+                }
+            }
+            let mut indices: Vec<Object> =
+                exports.iter().filter_map(|e| f.options.iter().position(|(x, _)| x == e)).map(|i| Object::Int(i as i64)).collect();
+            // /I lists option indices in ascending order; /V keeps the caller's value order.
+            // Every entry above is an integer, so this sorts by its numeric option index.
+            indices.sort_unstable_by_key(Object::as_int);
+            // A list box scrolls (`/TI`) so the picked options are among the rows it draws, as
+            // in other viewers: a pick below the last visible row would otherwise not show (#1524).
+            let top = match (f.kind, f.widgets.first()) {
+                (FieldKind::List, Some(w)) => w.list.map(|rows| {
+                    let height = if matches!(w.rotation, 90 | 270) { w.rect[2] - w.rect[0] } else { w.rect[3] - w.rect[1] };
+                    let picked: Vec<usize> = indices.iter().filter_map(|i| i.as_int()).filter_map(|i| usize::try_from(i).ok()).collect();
+                    (rows.top, appearance::ListRows::top_showing(rows.top, &picked, rows.visible(height), f.options.len()))
+                }),
+                _ => None,
+            };
+            doc.update_dict(f.obj, |d| {
+                match exports.as_slice() {
+                    [] => {
+                        d.remove(b"V");
+                    }
+                    [one] => d.set(b"V".to_vec(), PdfString::text(one)),
+                    many => d.set(b"V".to_vec(), Object::Array(many.iter().map(|e| Object::String(PdfString::text(e))).collect())),
+                }
+                if indices.is_empty() {
+                    d.remove(b"I");
+                } else {
+                    d.set(b"I".to_vec(), Object::Array(indices));
+                }
+                if let Some((old, new)) = top
+                    && old != new
+                {
+                    d.set(b"TI".to_vec(), Object::Int(i64::try_from(new).unwrap_or(0)));
+                }
+            })?;
+            // A widget with its own `/TI` (read before the field's) scrolls too.
+            if let Some((old, new)) = top
+                && old != new
+            {
+                for w in f.widgets.iter().filter(|w| w.obj != f.obj) {
+                    if doc.get(w.obj).as_dict().is_some_and(|d| d.contains(b"TI")) {
+                        doc.update_dict(w.obj, |d| d.set(b"TI".to_vec(), Object::Int(i64::try_from(new).unwrap_or(0))))?;
+                    }
+                }
+            }
+            redraw(doc, f, &exports, scripts)
+        }
+        (FieldKind::PushButton, _) => invalid(format!("{:?} is a button; it has no value", f.name)),
+        (FieldKind::Signature, _) => invalid(format!("{:?} is a signature field; sign it with Fill & Sign or a digital ID", f.name)),
+        (kind, v) => invalid(format!("{:?} is a {kind:?} field and can't take {v:?}", f.name)),
+    }
+}
+
+/// Check boxes and radio buttons: `/V` on the field, `/AS` on each widget.
+fn set_states(doc: &mut Document, f: &Field, on: Option<&str>) -> Result<(), FormError> {
+    let v = on.unwrap_or("Off");
+    doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), name_obj(v)))?;
+    for w in &f.widgets {
+        let state = match (on, w.on_state.as_deref()) {
+            (Some(c), Some(s)) if c == s => s,
+            _ => "Off",
+        };
+        // A widget without appearances for its states gets PdfCraft's own.
+        let has_ap = doc.get(w.obj).as_dict().and_then(|d| d.get(b"AP").cloned()).is_some();
+        if !has_ap {
+            let on_name = w.on_state.clone().unwrap_or_else(|| on.unwrap_or("Yes").to_string());
+            let ap = appearance::check_box_states(doc, w, f.kind, &on_name, &f.da);
+            doc.update_dict(w.obj, |d| d.set(b"AP".to_vec(), Object::Dict(ap)))?;
+        }
+        doc.update_dict(w.obj, |d| d.set(b"AS".to_vec(), name_obj(state)))?;
+    }
+    Ok(())
+}
+
+/// Copy an existing appearance dictionary before replacing its normal appearance.
+fn appearance_dict(doc: &Document, widget: ObjRef) -> Dict {
+    doc.get(widget).as_dict().and_then(|d| d.get(b"AP").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned()).unwrap_or_default()
+}
+
+/// `widget`'s appearance dictionary (a copy, so a shared one is left alone) with the freshly
+/// drawn entries of `fresh` (its `/N`). Other entries are kept, but the old down and rollover
+/// appearances (`/D`, `/R`) would show the old value, caption or colour on press or hover, so
+/// they go — except, for check boxes and radio buttons (whose `/N` is a dictionary of states),
+/// the states the new `/N` still draws under the same names.
+pub(crate) fn merged_appearance(doc: &Document, widget: ObjRef, fresh: &Dict) -> Dict {
+    let mut apd = appearance_dict(doc, widget);
+    // Only a dictionary of states counts (`as_dict` would also see a stream's own dictionary).
+    let states_of = |o: &Object| match &*doc.resolve(o) {
+        Object::Dict(d) => Some(d.clone()),
+        _ => None,
+    };
+    let states: Option<Vec<Vec<u8>>> = fresh.get(b"N").and_then(states_of).map(|d| d.iter().map(|(k, _)| k.clone()).collect());
+    for key in [&b"D"[..], &b"R"[..]] {
+        if fresh.contains(key) {
+            continue;
+        }
+        let kept = states.as_ref().and_then(|names| {
+            let old = apd.get(key).and_then(states_of)?;
+            let mut d = Dict::new();
+            for (k, v) in old.iter().filter(|(k, _)| names.contains(k)) {
+                d.set(k.clone(), v.clone());
+            }
+            (!d.is_empty()).then_some(d)
+        });
+        match kept {
+            Some(d) => apd.set(key.to_vec(), Object::Dict(d)),
+            None => {
+                apd.remove(key);
+            }
+        }
+    }
+    for (k, v) in fresh.iter() {
+        apd.set(k.clone(), v.clone());
+    }
+    apd
+}
+
+/// Regenerate the normal appearance of every widget of a text or choice field.
+fn redraw(doc: &mut Document, f: &Field, values: &[String], scripts: &mut dyn Scripts) -> Result<(), FormError> {
+    let shown = match values {
+        [one] if matches!(f.kind, FieldKind::Text | FieldKind::Combo) => scripting::formatted(doc, f, one, scripts),
+        _ => None,
+    };
+    let in_place = f.kind == FieldKind::Text && f.has(flags::PASSWORD);
+    let mut undrawn = false;
+    for w in &f.widgets {
+        let (stream, missing) = match &shown {
+            Some(s) => appearance::field_appearance_drawn(doc, f, w, std::slice::from_ref(s), false),
+            None => appearance::field_appearance_drawn(doc, f, w, values, true),
+        };
+        undrawn |= missing.is_some();
+        let existing_ap = in_place
+            .then(|| {
+                doc.get(w.obj)
+                    .as_dict()
+                    .and_then(|d| d.get(b"AP").map(|a| doc.resolve(a)))
+                    .and_then(|a| a.as_dict().and_then(|a| a.get(b"N").cloned()))
+                    .and_then(|n| n.as_ref())
+                    .filter(|r| doc.is_edited(r.num) && matches!(&*doc.get(*r), Object::Stream(_)))
+            })
+            .flatten();
+        let ap = match existing_ap {
+            Some(r) => {
+                doc.set(r, Object::Stream(stream));
+                r
+            }
+            None => doc.add(Object::Stream(stream)),
+        };
+        let mut fresh = Dict::new();
+        fresh.set(b"N".to_vec(), Object::Ref(ap));
+        let apd = merged_appearance(doc, w.obj, &fresh);
+        doc.update_dict(w.obj, |d| {
+            d.set(b"AP".to_vec(), Object::Dict(apd));
+            d.remove(b"AS");
+            pdfcraft_fonts::set_undrawn_mark(d, missing);
+        })?;
+    }
+    if undrawn {
+        ask_viewers_to_redraw(doc)?;
+    }
+    Ok(())
+}
+
+/// A value its widget's font can't show is stored as typed and drawn with `?` (as Acrobat keeps
+/// such a value): `/NeedAppearances` then asks other viewers to draw the fields from their values
+/// with fonts that have those characters (the interactive form dictionary, §12.7.3). Not in a
+/// document that declares PDF/A, which forbids it: there the widget's mark
+/// (`pdfcraft_fonts::UNDRAWN_MARK`) is all, and the edit's report says the `?` shows everywhere.
+pub(crate) fn ask_viewers_to_redraw(doc: &mut Document) -> Result<(), FormError> {
+    if declares_pdfa(doc) || need_appearances(doc) {
+        return Ok(());
+    }
+    let Some(root) = doc.root() else { return Ok(()) };
+    let entry = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").cloned());
+    match entry {
+        Some(Object::Ref(r)) => doc.update_dict(r, |d| d.set(b"NeedAppearances".to_vec(), Object::Bool(true)))?,
+        Some(Object::Dict(mut af)) => {
+            af.set(b"NeedAppearances".to_vec(), Object::Bool(true));
+            doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(af)))?;
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+/// Text fields with the Password flag (inherited or their own) whose value (`/V`, inherited or
+/// their own) is not empty and not their default value (`/DV`, which the form's author wrote and
+/// a save restores), or one of whose separate widgets carries a `/V`.
+fn password_fields(doc: &Document) -> Vec<Field> {
+    if !has_password_flag(doc) {
+        return Vec::new();
+    }
+    let on_widget = |f: &Field| f.widgets.iter().any(|w| w.obj != f.obj && doc.get(w.obj).as_dict().is_some_and(|d| d.get(b"V").is_some()));
+    let typed = |f: &Field| f.value.iter().any(|v| !v.is_empty()) && f.value.first() != f.default.first();
+    fields(doc).into_iter().filter(|f| f.kind == FieldKind::Text && f.has(flags::PASSWORD) && (typed(f) || on_widget(f))).collect()
+}
+
+/// Whether any field dictionary sets the Password flag (#3943 review). A field that inherits the
+/// flag has an ancestor that sets it, so that ancestor is found instead; a kid clearing the flag
+/// again only makes the answer cautious. It reads only `/Ff`, `/Kids` and `/Parent`, so a save
+/// or recovery snapshot of a form without such a field doesn't build every [`Field`]. Like
+/// [`fields`], it looks at the form's field tree and at the widgets on the pages, which may be
+/// missing from `/Fields`. Each dictionary is visited once and at most 64 levels deep.
+pub(crate) fn has_password_flag(doc: &Document) -> bool {
+    let sets_it = |r: ObjRef| doc.get(r).as_dict().and_then(|d| field_flags(doc, d)).is_some_and(|ff| ff & flags::PASSWORD != 0);
+    let top = acroform(doc).and_then(|af| af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned())).unwrap_or_default();
+    let mut stack: Vec<(Object, usize)> = top.into_iter().map(|o| (o, 0)).collect();
+    let mut seen = std::collections::HashSet::new();
+    while let Some((o, depth)) = stack.pop() {
+        let Object::Ref(r) = o else { continue };
+        if depth > 64 || !seen.insert(r) {
+            continue;
+        }
+        if sets_it(r) {
+            return true;
+        }
+        let kids = doc.get(r).as_dict().and_then(|d| d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned())).unwrap_or_default();
+        stack.extend(kids.into_iter().map(|k| (k, depth + 1)));
+    }
+    // Widgets on the pages, and the fields above them.
+    page_refs(doc).into_iter().any(|p| {
+        let annots =
+            doc.get(p).as_dict().and_then(|d| d.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned())).unwrap_or_default();
+        annots.iter().filter_map(Object::as_ref).filter(|r| !seen.contains(r)).any(|r| field_chain(doc, r).into_iter().any(sets_it))
+    })
+}
+
+/// Whether any text field with the Password flag holds a value in `doc`.
+pub fn has_password_values(doc: &Document) -> bool {
+    !password_fields(doc).is_empty()
+}
+
+/// The typed values of the text fields with the Password flag, as (name, text) pairs, for
+/// [`restore_password_values`] after the document was rebased on a file written without them.
+pub fn password_values(doc: &Document) -> Vec<(String, String)> {
+    password_fields(doc).into_iter().filter_map(|f| f.value.first().map(|v| (f.name.clone(), v.clone()))).collect()
+}
+
+/// Put values from [`password_values`] back into the open document, in memory only. A field
+/// that is gone or read-only keeps what it has.
+pub fn restore_password_values(doc: &mut Document, values: &[(String, String)]) -> Result<(), FormError> {
+    for (name, v) in values {
+        match set_value(doc, name, &FieldValue::Text(v.clone())) {
+            Ok(()) | Err(FormError::NoSuchField(_) | FormError::ReadOnly(_)) => {}
+            Err(e) => return Err(e),
+        }
+    }
+    Ok(())
+}
+
+/// `r` and its field ancestors (`/Parent`), nearest first, at most 64 deep and without repeats.
+fn field_chain(doc: &Document, r: ObjRef) -> Vec<ObjRef> {
+    let mut chain = vec![r];
+    let mut cur = r;
+    while chain.len() < 64 {
+        let Some(Object::Ref(parent)) = doc.get(cur).as_dict().and_then(|d| d.get(b"Parent").cloned()) else { break };
+        if chain.contains(&parent) {
+            break;
+        }
+        chain.push(parent);
+        cur = parent;
+    }
+    chain
+}
+
+/// Remove the values of the text fields with the Password flag, for a copy of the document about
+/// to be written to a file (#3926). ISO 32000-2 §12.7.5.3, Table 231, Password flag, note: "it is
+/// imperative that PDF processors never store the value of the text field in the PDF file if
+/// this flag is set". As Acrobat saves such a field (#3943 review, black-box test): a field with
+/// a default value (`/DV`, which the form's author wrote) gets it back as its value, one without
+/// is left empty, and its appearance is drawn again from that value, so the masking characters
+/// no longer show how long the typed password was. `/DV` and the field's scripts stay.
+///
+/// A value can sit on the field, on one of its widgets, or on an ancestor it inherits from
+/// (`/V` is inheritable). Each is removed; an ancestor's only when every field inheriting from it
+/// is such a password field. Where an ancestor's value is shared with other fields and stays, the
+/// password field gets an empty value of its own so it no longer inherits it. Returns how many
+/// fields were cleared.
+pub fn clear_password_values(doc: &mut Document) -> Result<usize, FormError> {
+    let targets = password_fields(doc);
+    if targets.is_empty() {
+        return Ok(0);
+    }
+    let is_password = |f: &Field| f.kind == FieldKind::Text && f.has(flags::PASSWORD);
+    // Each field's ancestors, found once: only values change below, never `/Parent` (#3943
+    // review: walking them again for every ancestor of every target was quadratic).
+    let chains: Vec<(bool, Vec<ObjRef>)> = fields(doc).iter().map(|g| (is_password(g), field_chain(doc, g.obj))).collect();
+    for f in &targets {
+        let chain = field_chain(doc, f.obj);
+        for w in &f.widgets {
+            if w.obj != f.obj {
+                doc.update_dict(w.obj, |d| {
+                    d.remove(b"V");
+                })?;
+            }
+        }
+        doc.update_dict(f.obj, |d| {
+            d.remove(b"V");
+        })?;
+        let mut shared_value_kept = false;
+        for a in chain.iter().skip(1) {
+            if doc.get(*a).as_dict().is_none_or(|d| d.get(b"V").is_none()) {
+                continue;
+            }
+            let exclusive = chains.iter().filter(|(_, chain)| chain.contains(a)).all(|(password, _)| *password);
+            if exclusive {
+                doc.update_dict(*a, |d| {
+                    d.remove(b"V");
+                })?;
+            } else {
+                shared_value_kept = true;
+            }
+        }
+        let restored: Vec<String> = f.default.first().cloned().into_iter().collect();
+        match restored.first() {
+            Some(dv) => doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), PdfString::text(dv)))?,
+            None if shared_value_kept => doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), PdfString::text("")))?,
+            None => {}
+        }
+        redraw(doc, f, &restored, &mut NoScripts)?;
+    }
+    Ok(targets.len())
+}
+
+/// Acrobat's Clear form: every field (or the named ones) back to its default value.
+pub fn reset(doc: &mut Document, names: Option<&[String]>) -> Result<usize, FormError> {
+    let all = fields(doc);
+    if all.is_empty() {
+        return Err(FormError::NoForm);
+    }
+    if let Some(n) = names
+        && let Some(missing) = n.iter().find(|n| !all.iter().any(|f| &f.name == *n))
+    {
+        return Err(FormError::NoSuchField(missing.clone()));
+    }
+    let mut changed = 0;
+    for f in all.iter().filter(|f| names.is_none_or(|n| n.contains(&f.name))) {
+        if f.value == f.default {
+            continue;
+        }
+        let v = match f.kind {
+            FieldKind::Text => FieldValue::Text(f.default.first().cloned().unwrap_or_default()),
+            FieldKind::CheckBox => FieldValue::Check(!f.default.is_empty()),
+            FieldKind::Radio => FieldValue::Radio(f.default.first().cloned()),
+            FieldKind::Combo | FieldKind::List => FieldValue::Choice(f.default.clone()),
+            FieldKind::PushButton | FieldKind::Signature => continue,
+        };
+        // A reset is not blocked by NoToggleToOff: go through the writer directly.
+        let mut tmp = f.clone();
+        tmp.flags &= !flags::NO_TOGGLE_TO_OFF;
+        write_value(doc, &tmp, &v, &mut NoScripts)?;
+        changed += 1;
+    }
+    recalculate(doc)?;
+    Ok(changed)
+}
diff --git a/crates/js/src/document.rs b/crates/js/src/document.rs
new file mode 100644
index 0000000000..3d0fe194ee
--- /dev/null
+++ b/crates/js/src/document.rs
@@ -0,0 +1,224 @@
+use super::host::{arg, colour, error, function, host, read, s, set_value, strings, text, value_of, write};
+use super::model::{DISPLAY_HIDDEN, DISPLAY_VISIBLE, FieldType, Request};
+use super::*;
+
+macro_rules! getter {
+    ($ctx:expr, $name:expr, |$f:ident, $c:ident| $body:expr) => {{
+        fn get(_: &JsValue, _: &[JsValue], name: &JsString, $c: &mut Context) -> JsResult<JsValue> {
+            let $f = read($c, name)?;
+            Ok($body)
+        }
+        function($ctx, NativeFunction::from_copy_closure_with_captures(get, $name.clone()))
+    }};
+}
+
+pub(crate) fn field_object(ctx: &mut Context, name: &str) -> JsObject {
+    let n = JsString::from(name);
+    let value_get = getter!(ctx, n, |f, c| value_of(&f, c));
+    let value_set = {
+        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+            let vals = strings(&arg(args, 0), c)?;
+            write(c, name, |f| set_value(f, vals))?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let as_string = getter!(ctx, n, |f, _c| s(&match f.kind {
+        FieldType::CheckBox | FieldType::RadioButton => f.value.first().cloned().unwrap_or_else(|| "Off".into()),
+        _ => f.value.join(","),
+    }));
+    let default = getter!(ctx, n, |f, _c| s(&f.default.first().cloned().unwrap_or_default()));
+    let kind = getter!(ctx, n, |f, _c| s(f.kind.name()));
+    let fname = getter!(ctx, n, |f, _c| s(&f.name));
+    let readonly_get = getter!(ctx, n, |f, _c| JsValue::from(f.readonly));
+    let readonly_set = {
+        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+            let on = arg(args, 0).to_boolean();
+            write(c, name, |f| f.readonly = on)?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let required_get = getter!(ctx, n, |f, _c| JsValue::from(f.required));
+    let required_set = {
+        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+            let on = arg(args, 0).to_boolean();
+            write(c, name, |f| f.required = on)?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let display_get = getter!(ctx, n, |f, _c| JsValue::from(f.display));
+    let display_set = {
+        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+            let d = arg(args, 0).to_number(c)? as i32;
+            write(c, name, |f| f.display = d.clamp(0, 3))?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let hidden_get = getter!(ctx, n, |f, _c| JsValue::from(f.display == DISPLAY_HIDDEN));
+    let hidden_set = {
+        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+            let on = arg(args, 0).to_boolean();
+            write(c, name, |f| f.display = if on { DISPLAY_HIDDEN } else { DISPLAY_VISIBLE })?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let num_items = getter!(ctx, n, |f, _c| JsValue::from(f.options.len() as f64));
+    let char_limit = getter!(ctx, n, |f, _c| JsValue::from(f.char_limit.unwrap_or(0) as f64));
+    let export_values = getter!(ctx, n, |f, c| {
+        let vals: Vec<JsValue> = f.options.iter().map(|o| s(&o.0)).collect();
+        JsArray::from_iter(vals, c).into()
+    });
+    let indices = getter!(ctx, n, |f, c| {
+        let idx: Vec<JsValue> = f.options.iter().enumerate().filter(|(_, o)| f.value.contains(&o.0)).map(|(i, _)| JsValue::from(i as f64)).collect();
+        if idx.len() == 1 { idx[0].clone() } else { JsArray::from_iter(idx, c).into() }
+    });
+    let text_color_get = getter!(ctx, n, |f, c| colour(&f.text_color, c));
+    let text_color_set = {
+        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+            let v = strings(&arg(args, 0), c)?;
+            write(c, name, |f| f.text_color = Some(v))?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+    let fill_color_get = getter!(ctx, n, |f, c| colour(&f.fill_color, c));
+    let fill_color_set = {
+        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+            let v = strings(&arg(args, 0), c)?;
+            write(c, name, |f| f.fill_color = Some(v))?;
+            Ok(JsValue::undefined())
+        }
+        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
+    };
+
+    fn get_item_at(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        let f = read(c, name)?;
+        let i = arg(args, 0).to_number(c)?;
+        // bExportValue defaults to true.
+        let export = args.get(1).is_none_or(JsValue::to_boolean);
+        let i = if i < 0.0 { f.options.len().saturating_sub(1) } else { i as usize };
+        let o = f.options.get(i).ok_or_else(|| error(format!("{} has no item {i}", f.name)))?;
+        Ok(s(if export { &o.0 } else { &o.1 }))
+    }
+    fn is_box_checked(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        let f = read(c, name)?;
+        let i = arg(args, 0).to_number(c)? as usize;
+        let on = f.options.get(i).is_some_and(|o| f.value.first() == Some(&o.0));
+        Ok(JsValue::from(on))
+    }
+    fn check_this_box(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        let f = read(c, name)?;
+        let i = arg(args, 0).to_number(c)? as usize;
+        let on = args.get(1).is_none_or(JsValue::to_boolean);
+        let export = f.options.get(i).map(|o| o.0.clone()).ok_or_else(|| error(format!("{} has no widget {i}", f.name)))?;
+        write(c, name, |f| {
+            if on {
+                f.value = vec![export];
+            } else if f.value.first() == Some(&export) {
+                f.value.clear();
+            }
+        })?;
+        Ok(JsValue::undefined())
+    }
+    fn set_focus(_: &JsValue, _: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
+        host(c)?.borrow_mut().request(Request::Focus(name.to_std_string_escaped()));
+        Ok(JsValue::undefined())
+    }
+
+    let rw = Attribute::CONFIGURABLE | Attribute::ENUMERABLE;
+    let get_item_at = NativeFunction::from_copy_closure_with_captures(get_item_at, n.clone());
+    let is_box_checked = NativeFunction::from_copy_closure_with_captures(is_box_checked, n.clone());
+    let check_this_box = NativeFunction::from_copy_closure_with_captures(check_this_box, n.clone());
+    let set_focus = NativeFunction::from_copy_closure_with_captures(set_focus, n.clone());
+    ObjectInitializer::new(ctx)
+        .accessor(js_string!("value"), Some(value_get), Some(value_set), rw)
+        .accessor(js_string!("valueAsString"), Some(as_string), None, rw)
+        .accessor(js_string!("defaultValue"), Some(default), None, rw)
+        .accessor(js_string!("type"), Some(kind), None, rw)
+        .accessor(js_string!("name"), Some(fname), None, rw)
+        .accessor(js_string!("readonly"), Some(readonly_get), Some(readonly_set), rw)
+        .accessor(js_string!("required"), Some(required_get), Some(required_set), rw)
+        .accessor(js_string!("display"), Some(display_get), Some(display_set), rw)
+        .accessor(js_string!("hidden"), Some(hidden_get), Some(hidden_set), rw)
+        .accessor(js_string!("numItems"), Some(num_items), None, rw)
+        .accessor(js_string!("charLimit"), Some(char_limit), None, rw)
+        .accessor(js_string!("exportValues"), Some(export_values), None, rw)
+        .accessor(js_string!("currentValueIndices"), Some(indices), None, rw)
+        .accessor(js_string!("textColor"), Some(text_color_get), Some(text_color_set), rw)
+        .accessor(js_string!("fillColor"), Some(fill_color_get), Some(fill_color_set), rw)
+        .function(get_item_at, js_string!("getItemAt"), 2)
+        .function(is_box_checked, js_string!("isBoxChecked"), 1)
+        .function(check_this_box, js_string!("checkThisBox"), 2)
+        .function(set_focus, js_string!("setFocus"), 0)
+        .build()
+}
+
+// ── the document (global object) ────────────────────────────────────────────────────────────
+
+pub(crate) fn get_field(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let name = text(&arg(args, 0), ctx)?;
+    let exists = host(ctx)?.borrow().fields.iter().any(|f| f.name == name);
+    if exists {
+        return Ok(field_object(ctx, &name).into());
+    }
+    // A parent name (e.g. "total" for "total.0"): its first kid stands in, as for groups.
+    let prefix = format!("{name}.");
+    let kid = host(ctx)?.borrow().fields.iter().find(|f| f.name.starts_with(&prefix)).map(|f| f.name.clone());
+    Ok(kid.map_or(JsValue::null(), |k| field_object(ctx, &k).into()))
+}
+
+pub(crate) fn get_nth_field_name(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let i = arg(args, 0).to_number(ctx)?;
+    let name = host(ctx)?.borrow().fields.get(i.max(0.0) as usize).map(|f| f.name.clone());
+    Ok(name.map_or(JsValue::null(), |n| s(&n)))
+}
+
+pub(crate) fn reset_form(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let names = strings(&arg(args, 0), ctx)?;
+    host(ctx)?.borrow_mut().request(Request::Reset(names));
+    Ok(JsValue::undefined())
+}
+
+pub(crate) fn print(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    host(ctx)?.borrow_mut().request(Request::Print);
+    Ok(JsValue::undefined())
+}
+
+pub(crate) fn submit_form(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let a = arg(args, 0);
+    let url = match a.as_object() {
+        Some(o) if !o.is_array() => {
+            let u = o.get(js_string!("cURL"), ctx)?;
+            text(&u, ctx)?
+        }
+        _ => text(&a, ctx)?,
+    };
+    host(ctx)?.borrow_mut().request(Request::Submit(url));
+    Ok(JsValue::undefined())
+}
+
+pub(crate) fn noop(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::undefined())
+}
+
+pub(crate) fn num_fields(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(host(ctx)?.borrow().fields.len() as f64))
+}
+
+pub(crate) fn page_num_get(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(host(ctx)?.borrow().doc.page as f64))
+}
+
+pub(crate) fn page_num_set(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let n = arg(args, 0).to_number(ctx)?;
+    let mut h = host(ctx)?.borrow_mut();
+    let last = h.doc.num_pages.saturating_sub(1);
+    let p = (n.max(0.0) as usize).min(last);
+    h.doc.page = p;
+    h.request(Request::GoToPage(p));
+    Ok(JsValue::undefined())
+}
diff --git a/crates/js/src/format.rs b/crates/js/src/format.rs
new file mode 100644
index 0000000000..5f2eed1021
--- /dev/null
+++ b/crates/js/src/format.rs
@@ -0,0 +1,620 @@
+use super::host::{arg, error, s, text};
+use super::run::{MAX_PRINTF_OUTPUT_BYTES, MAX_PRINTF_WIDTH_PRECISION};
+use super::*;
+
+/// `util.printf(cFormat, …)`: `%[,n][+ 0#][width][.prec](d|f|s|x)`, where `,0` groups
+/// thousands with commas (the default), `,1` doesn't, `,2` uses `.` and `,`, `,3` uses `.`
+/// without grouping.
+pub(crate) fn printf(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let fmt = text(&arg(args, 0), ctx)?;
+    let mut out = String::new();
+    let check_output = |len: usize| -> JsResult<()> {
+        if len > MAX_PRINTF_OUTPUT_BYTES {
+            return Err(error(format!("util.printf output exceeds {MAX_PRINTF_OUTPUT_BYTES} bytes")));
+        }
+        Ok(())
+    };
+    let mut next = 1;
+    let mut chars = fmt.chars().peekable();
+    while let Some(c) = chars.next() {
+        if c != '%' {
+            check_output(out.len().saturating_add(c.len_utf8()))?;
+            out.push(c);
+            continue;
+        }
+        if chars.peek() == Some(&'%') {
+            chars.next();
+            check_output(out.len().saturating_add(1))?;
+            out.push('%');
+            continue;
+        }
+        let mut sep = 1u8;
+        if chars.peek() == Some(&',') {
+            chars.next();
+            sep = chars.next().and_then(|d| d.to_digit(10)).unwrap_or(0) as u8;
+        }
+        let (mut plus, mut space, mut zero) = (false, false, false);
+        while let Some(&f) = chars.peek() {
+            match f {
+                '+' => plus = true,
+                ' ' => space = true,
+                '0' => zero = true,
+                '#' => {}
+                _ => break,
+            }
+            chars.next();
+        }
+        let mut width = 0usize;
+        while let Some(d) = chars.peek().and_then(|d| d.to_digit(10)) {
+            width = width.saturating_mul(10).saturating_add(d as usize);
+            chars.next();
+        }
+        let mut prec = None;
+        if chars.peek() == Some(&'.') {
+            chars.next();
+            let mut p = 0usize;
+            while let Some(d) = chars.peek().and_then(|d| d.to_digit(10)) {
+                p = p.saturating_mul(10).saturating_add(d as usize);
+                chars.next();
+            }
+            prec = Some(p);
+        }
+        if width > MAX_PRINTF_WIDTH_PRECISION || prec.is_some_and(|p| p > MAX_PRINTF_WIDTH_PRECISION) {
+            return Err(error(format!("util.printf width or precision exceeds {MAX_PRINTF_WIDTH_PRECISION}")));
+        }
+        let conv = chars.next().unwrap_or('s');
+        let v = arg(args, next);
+        next += 1;
+        let body = match conv {
+            'd' | 'f' => {
+                let n = v.to_number(ctx)?;
+                let p = if conv == 'd' { 0 } else { prec.unwrap_or(6) };
+                let n = if conv == 'd' { n.trunc() } else { n };
+                let mut t = group(&format!("{:.*}", p, n.abs()), sep);
+                if n < 0.0 {
+                    t.insert(0, '-');
+                } else if plus {
+                    t.insert(0, '+');
+                } else if space {
+                    t.insert(0, ' ');
+                }
+                t
+            }
+            'x' => format!("{:X}", v.to_number(ctx)? as i64),
+            _ => {
+                let t = text(&v, ctx)?;
+                match prec {
+                    Some(p) => t.chars().take(p).collect(),
+                    None => t,
+                }
+            }
+        };
+        let pad = width.saturating_sub(body.chars().count());
+        check_output(out.len().saturating_add(pad).saturating_add(body.len()))?;
+        if zero && matches!(conv, 'd' | 'f') {
+            let (sign, digits) = if body.starts_with(['-', '+', ' ']) { body.split_at(1) } else { ("", body.as_str()) };
+            out.push_str(sign);
+            out.push_str(&"0".repeat(pad));
+            out.push_str(digits);
+        } else {
+            out.push_str(&" ".repeat(pad));
+            out.push_str(&body);
+        }
+    }
+    Ok(s(&out))
+}
+
+/// Group the integer part of a plain decimal number per `util.printf`'s `,n` flag.
+fn group(t: &str, sep: u8) -> String {
+    let (int, frac) = t.split_once('.').map_or((t, None), |(a, b)| (a, Some(b)));
+    let (thousands, point) = match sep {
+        0 => (Some(','), '.'),
+        2 => (Some('.'), ','),
+        3 => (None, ','),
+        _ => (None, '.'),
+    };
+    let mut g = String::new();
+    for (i, ch) in int.chars().enumerate() {
+        if let Some(th) = thousands
+            && i > 0
+            && (int.len() - i).is_multiple_of(3)
+        {
+            g.push(th);
+        }
+        g.push(ch);
+    }
+    if let Some(f) = frac {
+        g.push(point);
+        g.push_str(f);
+    }
+    g
+}
+
+const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+
+const DAYS: [&str; 7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+
+/// `util.printd(cFormat, oDate)`: yyyy yy mmmm mmm mm m dddd ddd dd d HH H hh h MM M ss s tt,
+/// and the numeric formats 0 (D:yyyymmddHHMMss), 1 (yyyy.mm.dd HH:MM:ss) and 2 (m/d/yy h:MM:ss tt).
+pub(crate) fn printd(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let f = arg(args, 0);
+    let fmt = if f.is_number() {
+        match f.to_number(ctx)? as i32 {
+            0 => "D:yyyymmddHHMMss".to_string(),
+            1 => "yyyy.mm.dd HH:MM:ss".to_string(),
+            _ => "m/d/yy h:MM:ss tt".to_string(),
+        }
+    } else {
+        text(&f, ctx)?
+    };
+    let d = arg(args, 1);
+    let Some(date) = d.as_object() else { return Err(error("util.printd needs a Date")) };
+    let mut part = |m: &str| -> JsResult<i64> {
+        let func = date.get(JsString::from(m), ctx)?;
+        let func = func.as_callable().ok_or_else(|| error("util.printd needs a Date"))?;
+        let v = func.call(&d, &[], ctx)?.to_number(ctx)?;
+        if v.is_nan() {
+            return Err(error("invalid date"));
+        }
+        Ok(v as i64)
+    };
+    let (y, mo, day, wd, h, mi, sec) =
+        (part("getFullYear")?, part("getMonth")?, part("getDate")?, part("getDay")?, part("getHours")?, part("getMinutes")?, part("getSeconds")?);
+    let mut out = String::new();
+    let b = fmt.as_bytes();
+    let mut i = 0;
+    while i < b.len() {
+        let c = b[i];
+        // Only date letters read as runs; a literal is copied one character at a time, so
+        // measuring its run would rescan a long literal stretch at every position.
+        let run = if b"ymdHhMst".contains(&c) { b[i..].iter().take_while(|x| **x == c).count() } else { 1 };
+        #[cfg(test)]
+        PRINTD_SCANNED.fetch_add(run as u64, std::sync::atomic::Ordering::Relaxed);
+        let push_num = |out: &mut String, v: i64, n: usize| {
+            if n >= 2 {
+                out.push_str(&format!("{v:02}"));
+            } else {
+                out.push_str(&v.to_string());
+            }
+        };
+        match c {
+            b'y' => {
+                if run >= 4 {
+                    out.push_str(&format!("{y:04}"));
+                } else {
+                    out.push_str(&format!("{:02}", y % 100));
+                }
+            }
+            b'm' => match run {
+                r if r >= 4 => out.push_str(MONTHS[mo as usize % 12]),
+                3 => out.push_str(&MONTHS[mo as usize % 12][..3]),
+                n => push_num(&mut out, mo + 1, n),
+            },
+            b'd' => match run {
+                r if r >= 4 => out.push_str(DAYS[wd as usize % 7]),
+                3 => out.push_str(&DAYS[wd as usize % 7][..3]),
+                n => push_num(&mut out, day, n),
+            },
+            b'H' => push_num(&mut out, h, run),
+            b'h' => push_num(&mut out, if h % 12 == 0 { 12 } else { h % 12 }, run),
+            b'M' => push_num(&mut out, mi, run),
+            b's' => push_num(&mut out, sec, run),
+            b't' => {
+                let ampm = if h < 12 { "am" } else { "pm" };
+                out.push_str(if run >= 2 { ampm } else { &ampm[..1] });
+            }
+            b'\\' if i + 1 < b.len() => {
+                // The escaped character may be multi-byte; copy it whole.
+                let ch = fmt[i + 1..].chars().next().unwrap_or(' ');
+                out.push(ch);
+                i += 1 + ch.len_utf8();
+                continue;
+            }
+            _ => {
+                // Copy the rest of a multi-byte character too.
+                let ch = fmt[i..].chars().next().unwrap_or(' ');
+                out.push(ch);
+                i += ch.len_utf8();
+                continue;
+            }
+        }
+        i += run;
+    }
+    Ok(s(&out))
+}
+
+/// A field of a `util.scand` format.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum DateUnit {
+    /// `yyyy`: four digits.
+    Year,
+    /// `yy`: two digits, read as 1950–2049.
+    ShortYear,
+    Month,
+    /// `mmm`, `mmmm`: a month's name or its three-letter abbreviation.
+    MonthName,
+    Day,
+    /// `ddd`, `dddd`: a weekday's name, read and not checked.
+    Weekday,
+    Hour,
+    /// `h`, `hh`: 0–12, with `tt` for the afternoon.
+    Hour12,
+    Minute,
+    Second,
+    /// `t`, `tt`: am or pm.
+    AmPm,
+}
+
+impl DateUnit {
+    /// A year, month or day: a format needs one of these for `util.scand` to read anything.
+    fn is_date(self) -> bool {
+        matches!(self, Self::Year | Self::ShortYear | Self::Month | Self::MonthName | Self::Day)
+    }
+
+    /// Read from a run of digits, not from letters.
+    fn is_numeric(self) -> bool {
+        !matches!(self, Self::MonthName | Self::Weekday | Self::AmPm)
+    }
+}
+
+/// A piece of a `util.scand` format.
+#[derive(Debug, PartialEq, Eq)]
+enum ScanPart {
+    /// A field, the digits it takes when typed together with the next one (`width`), and whether
+    /// the next one follows it with nothing between them in the format (`joined`).
+    Field { unit: DateUnit, width: usize, joined: bool },
+    /// Letters the format writes as they are, which the text must have there.
+    Word(String),
+}
+
+/// The fields and literal words of a `util.scand` format, in order. A numeric field is marked
+/// `joined` when another numeric field follows it directly; anything but letters and digits
+/// outside a field is left out.
+fn scan_parts(fmt: &str) -> Vec<ScanPart> {
+    let chars: Vec<char> = fmt.chars().collect();
+    let mut parts: Vec<ScanPart> = Vec::new();
+    // The last part is a field written right before this point, or letters still being collected.
+    let (mut after_field, mut in_word) = (false, false);
+    let mut i = 0;
+    while let Some(&c) = chars.get(i) {
+        // Counted for field letters only, so a long run of anything else is read once.
+        let run = if "ymdHhMst".contains(c) { chars.get(i..).unwrap_or_default().iter().take_while(|x| **x == c).count() } else { 1 };
+        let field = match (c, run) {
+            ('y', 4..) => Some((DateUnit::Year, 4)),
+            ('y', _) => Some((DateUnit::ShortYear, 2)),
+            ('m', 3..) => Some((DateUnit::MonthName, 0)),
+            ('m', n) => Some((DateUnit::Month, n)),
+            ('d', 3..) => Some((DateUnit::Weekday, 0)),
+            ('d', n) => Some((DateUnit::Day, n)),
+            ('H', n) => Some((DateUnit::Hour, n.min(2))),
+            ('h', n) => Some((DateUnit::Hour12, n.min(2))),
+            ('M', n) => Some((DateUnit::Minute, n.min(2))),
+            ('s', n) => Some((DateUnit::Second, n.min(2))),
+            ('t', _) => Some((DateUnit::AmPm, 0)),
+            _ => None,
+        };
+        if let Some((unit, width)) = field {
+            if after_field
+                && unit.is_numeric()
+                && let Some(ScanPart::Field { unit: last, joined, .. }) = parts.last_mut()
+                && last.is_numeric()
+            {
+                *joined = true;
+            }
+            parts.push(ScanPart::Field { unit, width, joined: false });
+            (after_field, in_word) = (true, false);
+            i += run;
+            continue;
+        }
+        // `\` writes the next character as it is.
+        let (literal, step) = if c == '\\' { (chars.get(i + 1).copied(), 2) } else { (Some(c), 1) };
+        i += step;
+        after_field = false;
+        match literal {
+            Some(l) if l.is_alphanumeric() => match parts.last_mut() {
+                Some(ScanPart::Word(w)) if in_word => w.push(l),
+                _ => {
+                    parts.push(ScanPart::Word(l.to_string()));
+                    in_word = true;
+                }
+            },
+            _ => in_word = false,
+        }
+    }
+    parts
+}
+
+/// A run of digits or of letters in the text `util.scand` reads.
+enum ScanToken<'a> {
+    Digits(&'a str),
+    Letters(&'a str),
+}
+
+/// The text's runs of digits and of letters, in order; anything else only separates them, and
+/// may not begin or end the text. `None` when it does.
+fn scan_tokens(text: &str) -> Option<Vec<ScanToken<'_>>> {
+    // Some(true) for a digit, Some(false) for a letter, None for a separator.
+    let kind = |c: char| (c.is_ascii_digit() || c.is_alphabetic()).then_some(c.is_ascii_digit());
+    kind(text.chars().next()?)?;
+    kind(text.chars().next_back()?)?;
+    let mut out = Vec::new();
+    let mut start: Option<(usize, bool)> = None;
+    for (at, c) in text.char_indices().chain(std::iter::once((text.len(), ' '))) {
+        let k = kind(c);
+        if let Some((from, digits)) = start
+            && k != Some(digits)
+        {
+            let piece = text.get(from..at)?;
+            out.push(if digits { ScanToken::Digits(piece) } else { ScanToken::Letters(piece) });
+            start = None;
+        }
+        if let Some(digits) = k
+            && start.is_none()
+        {
+            start = Some((at, digits));
+        }
+    }
+    Some(out)
+}
+
+/// What `util.scand` reads.
+#[derive(Debug, PartialEq, Eq)]
+enum Scanned {
+    /// The text is empty: today, at noon.
+    Today,
+    /// A date and time: year, month (1–12), day, hours, minutes, seconds.
+    At(i32, u32, u32, u32, u32, u32),
+}
+
+/// The fields `util.scand` has read so far.
+#[derive(Default)]
+struct ScanValues {
+    y: Option<i32>,
+    mo: Option<u32>,
+    d: Option<u32>,
+    h: Option<u32>,
+    mi: Option<u32>,
+    sec: Option<u32>,
+    pm: Option<bool>,
+    /// The hour was read from `h` or `hh`.
+    twelve: bool,
+}
+
+impl ScanValues {
+    /// Records `v` as the value of `unit`: a `yy` year as 1950–2049, and an `h` or `hh` hour
+    /// marked as 12-hour. Month names, weekdays and am/pm are not read here.
+    fn set(&mut self, unit: DateUnit, v: u32) {
+        match unit {
+            DateUnit::Year => self.y = i32::try_from(v).ok(),
+            DateUnit::ShortYear => self.y = i32::try_from(v).ok().map(|v| if v < 50 { 2000 + v } else { 1900 + v }),
+            DateUnit::Month => self.mo = Some(v),
+            DateUnit::Day => self.d = Some(v),
+            DateUnit::Hour => self.h = Some(v),
+            DateUnit::Hour12 => {
+                self.h = Some(v);
+                self.twelve = true;
+            }
+            DateUnit::Minute => self.mi = Some(v),
+            DateUnit::Second => self.sec = Some(v),
+            DateUnit::MonthName | DateUnit::Weekday | DateUnit::AmPm => {}
+        }
+    }
+}
+
+/// Reads `text` by a `util.scand` format, as another viewer was observed to (black-box):
+///
+/// - Fields may be separated by anything but digits and letters, whether or not the format
+///   separates them, but nothing may come before the first or after the last.
+/// - Digits typed together fill the format's fields written together with exactly as many
+///   digits as each has letters (`yyyymd`: 4, 1 and 1). A run of digits for one field alone may
+///   have one or two, except a four-digit year.
+/// - `yy` is 1950–2049; month names may be written in full or as three letters, in any case.
+/// - Impossible dates are refused, but a month or day of 0 is read as 1.
+/// - A format with no year, month or day reads nothing; an empty text is today, at noon.
+///
+/// Not observed: a year left out is `this_year`, and a month or day left out is 1.
+fn scan_date(fmt: &str, text: &str, this_year: i32) -> Option<Scanned> {
+    let parts = scan_parts(fmt);
+    if !parts.iter().any(|p| matches!(p, ScanPart::Field { unit, .. } if unit.is_date())) {
+        return None;
+    }
+    if text.is_empty() {
+        return Some(Scanned::Today);
+    }
+    let tokens = scan_tokens(text)?;
+    let mut v = ScanValues::default();
+    let (mut p, mut t) = (0, 0);
+    while let Some(part) = parts.get(p) {
+        let token = tokens.get(t)?;
+        t += 1;
+        match (part, token) {
+            (ScanPart::Word(w), ScanToken::Letters(l) | ScanToken::Digits(l)) => {
+                if w.to_lowercase() != l.to_lowercase() {
+                    return None;
+                }
+                p += 1;
+            }
+            (ScanPart::Field { unit: DateUnit::MonthName, .. }, ScanToken::Letters(l)) => {
+                v.mo = Some(named(&MONTHS, l)?.saturating_add(1));
+                p += 1;
+            }
+            (ScanPart::Field { unit: DateUnit::Weekday, .. }, ScanToken::Letters(l)) => {
+                named(&DAYS, l)?;
+                p += 1;
+            }
+            (ScanPart::Field { unit: DateUnit::AmPm, .. }, ScanToken::Letters(l)) => {
+                v.pm = Some(match l.to_lowercase().as_str() {
+                    "am" | "a" => false,
+                    "pm" | "p" => true,
+                    _ => return None,
+                });
+                p += 1;
+            }
+            (ScanPart::Field { unit, width, joined }, ScanToken::Digits(run)) if unit.is_numeric() => {
+                // The fields written together from here, no more than the run's digits can fill,
+                // and the fewest of them the run fills.
+                let mut group = vec![(*unit, *width)];
+                let (mut more, mut widths) = (*joined, *width);
+                while more
+                    && widths < run.len()
+                    && let Some(ScanPart::Field { unit, width, joined }) = parts.get(p + group.len())
+                {
+                    group.push((*unit, *width));
+                    widths = widths.saturating_add(*width);
+                    more = *joined;
+                }
+                let mut sum = 0;
+                let fills = group.iter().position(|(_, w)| {
+                    sum += w;
+                    sum == run.len()
+                });
+                if let Some(last) = fills {
+                    let mut at = 0;
+                    for (unit, w) in group.iter().take(last + 1) {
+                        v.set(*unit, run.get(at..at + w)?.parse().ok()?);
+                        at += w;
+                    }
+                    p += last + 1;
+                } else if *unit != DateUnit::Year && run.len() <= 2 {
+                    v.set(*unit, run.parse().ok()?);
+                    p += 1;
+                } else {
+                    return None;
+                }
+            }
+            _ => return None,
+        }
+    }
+    if t != tokens.len() {
+        return None;
+    }
+    let y = v.y.unwrap_or(this_year);
+    let mo = v.mo.unwrap_or(1).max(1);
+    let d = v.d.unwrap_or(1).max(1);
+    if mo > 12 || i64::from(d) > i64::from(formcalc::days_in(i64::from(y), mo)) {
+        return None;
+    }
+    let mut h = v.h.unwrap_or(0);
+    if v.twelve && h > 12 {
+        return None;
+    }
+    match v.pm {
+        Some(true) if h < 12 => h += 12,
+        Some(false) if h == 12 => h = 0,
+        _ => {}
+    }
+    let (mi, sec) = (v.mi.unwrap_or(0), v.sec.unwrap_or(0));
+    (h <= 23 && mi <= 59 && sec <= 59).then_some(Scanned::At(y, mo, d, h, mi, sec))
+}
+
+/// The index of the name `word` is, in full or as its first three letters, in any case.
+fn named(names: &[&str], word: &str) -> Option<u32> {
+    let word = word.to_lowercase();
+    let i = names.iter().position(|n| {
+        let n = n.to_lowercase();
+        word == n || n.get(..3) == Some(word.as_str())
+    })?;
+    u32::try_from(i).ok()
+}
+
+/// `util.scand(cFormat, cDate)`: the date `cDate` gives by a `util.printd` format, as a local
+/// `Date`, or `null` when it doesn't read as one (see [`scan_date`]). Only text is read.
+pub(crate) fn scand(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let Some(typed) = arg(args, 1).as_string().map(|t| t.to_std_string_escaped()) else {
+        return Ok(JsValue::null());
+    };
+    let fmt = text(&arg(args, 0), ctx)?;
+    let date = JsDate::new(ctx);
+    let this_year = date.get_full_year(ctx)?.to_number(ctx)?;
+    let this_year = if this_year.is_finite() { this_year as i32 } else { 2000 };
+    match scan_date(&fmt, &typed, this_year) {
+        None => return Ok(JsValue::null()),
+        Some(Scanned::Today) => {
+            date.set_hours(&[12.into(), 0.into(), 0.into(), 0.into()], ctx)?;
+        }
+        Some(Scanned::At(y, mo, d, h, mi, sec)) => {
+            // setFullYear, not the constructor, so years 0–99 stay as they are.
+            date.set_full_year(&[y.into(), (mo.saturating_sub(1)).into(), d.into()], ctx)?;
+            date.set_hours(&[h.into(), mi.into(), sec.into(), 0.into()], ctx)?;
+        }
+    }
+    Ok(date.into())
+}
+
+/// `util.printx(cFormat, cSource)`: `?` any character, `X` letter or digit, `A` letter, `9`
+/// digit, `*` the rest, `\` escape, `>` / `<` / `=` upper / lower / as is.
+pub(crate) fn printx(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let fmt: Vec<char> = text(&arg(args, 0), ctx)?.chars().collect();
+    let src: Vec<char> = text(&arg(args, 1), ctx)?.chars().collect();
+    let (mut out, mut j, mut case) = (String::new(), 0, 0);
+    let mut i = 0;
+    let push = |out: &mut String, c: char, case: i32| match case {
+        1 => out.extend(c.to_uppercase()),
+        -1 => out.extend(c.to_lowercase()),
+        _ => out.push(c),
+    };
+    while i < fmt.len() {
+        let f = fmt[i];
+        i += 1;
+        let take = |j: &mut usize, ok: &dyn Fn(char) -> bool| -> Option<char> {
+            while *j < src.len() {
+                let c = src[*j];
+                *j += 1;
+                if ok(c) {
+                    return Some(c);
+                }
+            }
+            None
+        };
+        match f {
+            '?' => {
+                if let Some(c) = take(&mut j, &|_| true) {
+                    push(&mut out, c, case)
+                }
+            }
+            'X' => {
+                if let Some(c) = take(&mut j, &|c| c.is_alphanumeric()) {
+                    push(&mut out, c, case)
+                }
+            }
+            'A' => {
+                if let Some(c) = take(&mut j, &|c| c.is_alphabetic()) {
+                    push(&mut out, c, case)
+                }
+            }
+            '9' => {
+                if let Some(c) = take(&mut j, &|c| c.is_ascii_digit()) {
+                    push(&mut out, c, case)
+                }
+            }
+            '*' => {
+                for c in src[j.min(src.len())..].iter().copied() {
+                    push(&mut out, c, case);
+                }
+                j = src.len();
+            }
+            '\\' if i < fmt.len() => {
+                out.push(fmt[i]);
+                i += 1;
+            }
+            '>' => case = 1,
+            '<' => case = -1,
+            '=' => case = 0,
+            c => out.push(c),
+        }
+    }
+    Ok(s(&out))
+}
+
+// ── stack safety ────────────────────────────────────────────────────────────────────────────
+//
+// boa's parser and compiler recurse once per nesting level and have no limit of their own: about
+// a hundred nested parentheses overflow a 2 MiB stack, which aborts the whole app. Scripts come
+// from documents, so `run` refuses nesting no real form needs and runs the engine on a thread
+// with a large stack (address space, committed only as it is used). Together these bound the
+// stack a script can use: brackets and prefix operators by the limits below, and every other
+// construct (a few KiB per level, several bytes of source each) by the length limit.
+
+/// Bytes `util.printd` has scanned for runs of a format character, for tests that bound its work.
+#[cfg(test)]
+pub(crate) static PRINTD_SCANNED: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
diff --git a/crates/js/src/formcalc.rs b/crates/js/src/formcalc.rs
index 7b0d0e88a7..5c80177021 100644
--- a/crates/js/src/formcalc.rs
+++ b/crates/js/src/formcalc.rs
@@ -18,6 +18,27 @@ use crate::xfa::{
     reset_names, resolve_som, run_within,
 };
 
+mod access;
+mod ast;
+mod builtins;
+mod dates;
+mod eval;
+mod lexer;
+mod parser;
+mod value;
+mod words;
+
+use ast::Stmt;
+pub(crate) use dates::days_in;
+#[cfg(test)]
+use dates::{civil_from_days, days_from_civil, format_date, parse_date};
+use parser::parse;
+use value::Val;
+#[cfg(test)]
+use value::{fixed, num_text, parse_num};
+#[cfg(test)]
+use words::word_num;
+
 /// Deepest nesting the parser follows.
 const MAX_PARSE_DEPTH: usize = 64;
 /// Most statements and expressions evaluated in one run (loops included).
@@ -47,722 +68,6 @@ fn is_limit(e: &str) -> bool {
 #[cfg(not(target_arch = "wasm32"))]
 const CLOCK_EVERY: u64 = 256;
 
-// ── lexer ───────────────────────────────────────────────────────────────────────────────────
-
-#[derive(Clone, Debug, PartialEq)]
-enum Tok {
-    Num(f64),
-    Str(String),
-    Ident(String),
-    Op(&'static str),
-    Newline,
-    Eof,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-struct Token {
-    tok: Tok,
-    line: usize,
-}
-
-const OPS: [&str; 20] = ["<=", ">=", "==", "<>", "..", "(", ")", "[", "]", ".", ",", "=", "<", ">", "+", "-", "*", "/", "&", "|"];
-
-fn lex(src: &str) -> Result<Vec<Token>, String> {
-    let chars: Vec<char> = src.chars().collect();
-    let mut out = Vec::new();
-    let mut i = 0;
-    let mut line = 1;
-    let mut depth = 0usize;
-    while i < chars.len() {
-        let c = chars[i];
-        match c {
-            '\n' => {
-                line += 1;
-                i += 1;
-                // Newlines inside brackets continue the expression.
-                if depth == 0 {
-                    out.push(Token { tok: Tok::Newline, line });
-                }
-            }
-            ' ' | '\t' | '\r' => i += 1,
-            ';' => {
-                while i < chars.len() && chars[i] != '\n' {
-                    i += 1;
-                }
-            }
-            '/' if chars.get(i + 1) == Some(&'/') => {
-                while i < chars.len() && chars[i] != '\n' {
-                    i += 1;
-                }
-            }
-            '"' => {
-                let mut s = String::new();
-                i += 1;
-                loop {
-                    match chars.get(i) {
-                        None => return Err(format!("line {line}: unterminated string")),
-                        Some('"') if chars.get(i + 1) == Some(&'"') => {
-                            s.push('"');
-                            i += 2;
-                        }
-                        Some('"') => {
-                            i += 1;
-                            break;
-                        }
-                        Some(&ch) => {
-                            if ch == '\n' {
-                                line += 1;
-                            }
-                            s.push(ch);
-                            i += 1;
-                        }
-                    }
-                    if s.len() > MAX_STRING {
-                        return Err(format!("line {line}: a string is too long"));
-                    }
-                }
-                out.push(Token { tok: Tok::Str(s), line });
-            }
-            c if c.is_ascii_digit() || (c == '.' && chars.get(i + 1).is_some_and(char::is_ascii_digit)) => {
-                let start = i;
-                while i < chars.len() && (chars[i].is_ascii_digit() || (chars[i] == '.' && chars.get(i + 1) != Some(&'.'))) {
-                    i += 1;
-                }
-                if i < chars.len() && (chars[i] == 'e' || chars[i] == 'E') {
-                    let mut j = i + 1;
-                    if j < chars.len() && (chars[j] == '+' || chars[j] == '-') {
-                        j += 1;
-                    }
-                    if j < chars.len() && chars[j].is_ascii_digit() {
-                        i = j;
-                        while i < chars.len() && chars[i].is_ascii_digit() {
-                            i += 1;
-                        }
-                    }
-                }
-                let text: String = chars[start..i].iter().collect();
-                let n: f64 = text.parse().map_err(|_| format!("line {line}: bad number {text}"))?;
-                out.push(Token { tok: Tok::Num(n), line });
-            }
-            '!' => {
-                out.push(Token { tok: Tok::Ident("!".into()), line });
-                i += 1;
-            }
-            c if c.is_alphabetic() || c == '_' || c == '$' => {
-                let start = i;
-                i += 1;
-                while i < chars.len() && (chars[i].is_alphanumeric() || chars[i] == '_' || chars[i] == '$') {
-                    i += 1;
-                }
-                let text: String = chars[start..i].iter().collect();
-                out.push(Token { tok: Tok::Ident(text), line });
-            }
-            _ => {
-                let rest: String = chars[i..chars.len().min(i + 2)].iter().collect();
-                let op = OPS.iter().find(|o| rest.starts_with(*o)).copied().ok_or_else(|| format!("line {line}: unexpected character {c:?}"))?;
-                match op {
-                    "(" | "[" => depth += 1,
-                    ")" | "]" => depth = depth.saturating_sub(1),
-                    _ => {}
-                }
-                out.push(Token { tok: Tok::Op(op), line });
-                i += op.len();
-            }
-        }
-    }
-    out.push(Token { tok: Tok::Newline, line });
-    out.push(Token { tok: Tok::Eof, line });
-    Ok(out)
-}
-
-// ── syntax ──────────────────────────────────────────────────────────────────────────────────
-
-#[derive(Clone, Debug, PartialEq)]
-enum Expr {
-    Num(f64),
-    Str(String),
-    Null,
-    Ident(String),
-    /// `base.name`
-    Member(Box<Expr>, String),
-    /// `base[n]`, `base[*]`, `base[-n]`
-    Index(Box<Expr>, Idx),
-    /// `base..name`
-    Descend(Box<Expr>, String),
-    Call(Box<Expr>, Vec<Expr>),
-    Neg(Box<Expr>),
-    Not(Box<Expr>),
-    Bin(&'static str, Box<Expr>, Box<Expr>),
-}
-
-#[derive(Clone, Debug, PartialEq)]
-enum Idx {
-    /// `[*]`: every instance.
-    All,
-    /// `[n]`: the n-th instance (from 0).
-    Abs(Box<Expr>),
-    /// `[-n]` / `[+n]`: n instances before or after the one the script runs in.
-    Rel(i64),
-}
-
-#[derive(Clone, Debug, PartialEq)]
-enum Stmt {
-    Var(String, Option<Expr>),
-    Assign(Expr, Expr),
-    Expr(Expr),
-    If(Vec<(Expr, Vec<Stmt>)>, Option<Vec<Stmt>>),
-    While(Expr, Vec<Stmt>),
-    For { var: String, from: Expr, to: Expr, up: bool, step: Option<Expr>, body: Vec<Stmt> },
-    Foreach { var: String, list: Vec<Expr>, body: Vec<Stmt> },
-    Func { name: String, f: Rc<Func> },
-    Return(Option<Expr>),
-    Break,
-    Continue,
-    Exit,
-    Throw(Expr),
-}
-
-struct Parser {
-    toks: Vec<Token>,
-    at: usize,
-    depth: usize,
-    /// Operators and accessors chained so far in the expression being parsed.
-    chain: usize,
-}
-
-fn kw(t: &Tok, word: &str) -> bool {
-    matches!(t, Tok::Ident(s) if s.eq_ignore_ascii_case(word))
-}
-
-impl Parser {
-    fn peek(&self) -> &Tok {
-        self.toks.get(self.at).map_or(&Tok::Eof, |t| &t.tok)
-    }
-
-    fn line(&self) -> usize {
-        self.toks.get(self.at).map_or(0, |t| t.line)
-    }
-
-    fn next(&mut self) -> Tok {
-        let t = self.peek().clone();
-        self.at += 1;
-        t
-    }
-
-    fn is_op(&self, op: &str) -> bool {
-        matches!(self.peek(), Tok::Op(o) if *o == op)
-    }
-
-    fn eat_op(&mut self, op: &str) -> bool {
-        if self.is_op(op) {
-            self.at += 1;
-            true
-        } else {
-            false
-        }
-    }
-
-    fn expect_op(&mut self, op: &str) -> Result<(), String> {
-        if self.eat_op(op) { Ok(()) } else { Err(format!("line {}: expected {op}", self.line())) }
-    }
-
-    fn eat_kw(&mut self, word: &str) -> bool {
-        if kw(self.peek(), word) {
-            self.at += 1;
-            true
-        } else {
-            false
-        }
-    }
-
-    fn expect_kw(&mut self, word: &str) -> Result<(), String> {
-        if self.eat_kw(word) { Ok(()) } else { Err(format!("line {}: expected {word}", self.line())) }
-    }
-
-    fn skip_newlines(&mut self) {
-        while matches!(self.peek(), Tok::Newline) {
-            self.at += 1;
-        }
-    }
-
-    fn enter(&mut self) -> Result<(), String> {
-        self.depth += 1;
-        if self.depth > MAX_PARSE_DEPTH {
-            return Err("the script is nested too deeply".into());
-        }
-        Ok(())
-    }
-
-    fn leave(&mut self) {
-        self.depth = self.depth.saturating_sub(1);
-    }
-
-    /// One more link in an operator or accessor chain.
-    fn link(&mut self) -> Result<(), String> {
-        self.chain += 1;
-        if self.chain > MAX_CHAIN {
-            return Err(format!("line {}: an expression is too long", self.line()));
-        }
-        Ok(())
-    }
-
-    /// Statements up to one of `enders` (not consumed).
-    fn block(&mut self, enders: &[&str]) -> Result<Vec<Stmt>, String> {
-        self.enter()?;
-        let mut out = Vec::new();
-        loop {
-            self.skip_newlines();
-            match self.peek() {
-                Tok::Eof => break,
-                Tok::Ident(w) if enders.iter().any(|e| w.eq_ignore_ascii_case(e)) => break,
-                _ => out.push(self.statement()?),
-            }
-        }
-        self.leave();
-        Ok(out)
-    }
-
-    fn statement(&mut self) -> Result<Stmt, String> {
-        let line = self.line();
-        match self.peek().clone() {
-            Tok::Ident(w) if w.eq_ignore_ascii_case("var") => {
-                self.at += 1;
-                let Tok::Ident(name) = self.next() else { return Err(format!("line {line}: expected a name after var")) };
-                let init = if self.eat_op("=") { Some(self.top_expr()?) } else { None };
-                Ok(Stmt::Var(name, init))
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("if") => {
-                self.at += 1;
-                let mut arms = Vec::new();
-                let cond = self.top_expr()?;
-                self.expect_kw("then")?;
-                let body = self.block(&["elseif", "else", "endif"])?;
-                arms.push((cond, body));
-                let mut otherwise = None;
-                loop {
-                    if self.eat_kw("elseif") {
-                        let c = self.top_expr()?;
-                        self.expect_kw("then")?;
-                        let b = self.block(&["elseif", "else", "endif"])?;
-                        arms.push((c, b));
-                    } else if self.eat_kw("else") {
-                        otherwise = Some(self.block(&["endif"])?);
-                    } else {
-                        self.expect_kw("endif")?;
-                        break;
-                    }
-                }
-                Ok(Stmt::If(arms, otherwise))
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("while") => {
-                self.at += 1;
-                let cond = self.top_expr()?;
-                self.expect_kw("do")?;
-                let body = self.block(&["endwhile"])?;
-                self.expect_kw("endwhile")?;
-                Ok(Stmt::While(cond, body))
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("for") => {
-                self.at += 1;
-                let Tok::Ident(var) = self.next() else { return Err(format!("line {line}: expected a variable after for")) };
-                self.expect_op("=")?;
-                let from = self.top_expr()?;
-                let up = if self.eat_kw("upto") {
-                    true
-                } else if self.eat_kw("downto") {
-                    false
-                } else {
-                    return Err(format!("line {line}: expected upto or downto"));
-                };
-                let to = self.top_expr()?;
-                let step = if self.eat_kw("step") { Some(self.top_expr()?) } else { None };
-                self.expect_kw("do")?;
-                let body = self.block(&["endfor"])?;
-                self.expect_kw("endfor")?;
-                Ok(Stmt::For { var, from, to, up, step, body })
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("foreach") => {
-                self.at += 1;
-                let Tok::Ident(var) = self.next() else { return Err(format!("line {line}: expected a variable after foreach")) };
-                self.expect_kw("in")?;
-                self.expect_op("(")?;
-                let mut list = Vec::new();
-                if !self.is_op(")") {
-                    loop {
-                        list.push(self.top_expr()?);
-                        if !self.eat_op(",") {
-                            break;
-                        }
-                    }
-                }
-                self.expect_op(")")?;
-                self.expect_kw("do")?;
-                let body = self.block(&["endfor"])?;
-                self.expect_kw("endfor")?;
-                Ok(Stmt::Foreach { var, list, body })
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("func") => {
-                self.at += 1;
-                let Tok::Ident(name) = self.next() else { return Err(format!("line {line}: expected a name after func")) };
-                self.expect_op("(")?;
-                let mut params = Vec::new();
-                if !self.is_op(")") {
-                    loop {
-                        let Tok::Ident(p) = self.next() else { return Err(format!("line {line}: expected a parameter name")) };
-                        params.push(p);
-                        if !self.eat_op(",") {
-                            break;
-                        }
-                    }
-                }
-                self.expect_op(")")?;
-                self.expect_kw("do")?;
-                let body = self.block(&["endfunc"])?;
-                self.expect_kw("endfunc")?;
-                Ok(Stmt::Func { name, f: Rc::new(Func { params, body }) })
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("return") => {
-                self.at += 1;
-                let v = if matches!(self.peek(), Tok::Newline | Tok::Eof) { None } else { Some(self.top_expr()?) };
-                Ok(Stmt::Return(v))
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("break") => {
-                self.at += 1;
-                Ok(Stmt::Break)
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("continue") => {
-                self.at += 1;
-                Ok(Stmt::Continue)
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("exit") => {
-                self.at += 1;
-                Ok(Stmt::Exit)
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("throw") => {
-                self.at += 1;
-                Ok(Stmt::Throw(self.top_expr()?))
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("do") => {
-                // `do … end`: a block as one statement.
-                self.at += 1;
-                let body = self.block(&["end"])?;
-                self.expect_kw("end")?;
-                Ok(Stmt::If(vec![(Expr::Num(1.0), body)], None))
-            }
-            _ => {
-                let e = self.top_expr()?;
-                if self.eat_op("=") {
-                    let v = self.top_expr()?;
-                    return Ok(Stmt::Assign(e, v));
-                }
-                Ok(Stmt::Expr(e))
-            }
-        }
-    }
-
-    /// An expression that starts a tree of its own (a condition, a bound, a statement's
-    /// expression): its operator chain is counted from zero, whatever came before it.
-    fn top_expr(&mut self) -> Result<Expr, String> {
-        self.chain = 0;
-        self.expr()
-    }
-
-    fn expr(&mut self) -> Result<Expr, String> {
-        self.enter()?;
-        let e = self.or_expr();
-        self.leave();
-        e
-    }
-
-    fn or_expr(&mut self) -> Result<Expr, String> {
-        let mut l = self.and_expr()?;
-        loop {
-            if self.eat_op("|") || self.eat_kw("or") {
-                self.link()?;
-                let r = self.and_expr()?;
-                l = Expr::Bin("|", Box::new(l), Box::new(r));
-            } else {
-                return Ok(l);
-            }
-        }
-    }
-
-    fn and_expr(&mut self) -> Result<Expr, String> {
-        let mut l = self.cmp_expr()?;
-        loop {
-            if self.eat_op("&") || self.eat_kw("and") {
-                self.link()?;
-                let r = self.cmp_expr()?;
-                l = Expr::Bin("&", Box::new(l), Box::new(r));
-            } else {
-                return Ok(l);
-            }
-        }
-    }
-
-    fn cmp_expr(&mut self) -> Result<Expr, String> {
-        let mut l = self.add_expr()?;
-        loop {
-            let op = match self.peek() {
-                Tok::Op("==") => "==",
-                Tok::Op("<>") => "<>",
-                Tok::Op("<=") => "<=",
-                Tok::Op(">=") => ">=",
-                Tok::Op("<") => "<",
-                Tok::Op(">") => ">",
-                Tok::Ident(w) if w.eq_ignore_ascii_case("eq") => "==",
-                Tok::Ident(w) if w.eq_ignore_ascii_case("ne") => "<>",
-                Tok::Ident(w) if w.eq_ignore_ascii_case("le") => "<=",
-                Tok::Ident(w) if w.eq_ignore_ascii_case("ge") => ">=",
-                Tok::Ident(w) if w.eq_ignore_ascii_case("lt") => "<",
-                Tok::Ident(w) if w.eq_ignore_ascii_case("gt") => ">",
-                _ => return Ok(l),
-            };
-            self.at += 1;
-            self.link()?;
-            let r = self.add_expr()?;
-            l = Expr::Bin(op, Box::new(l), Box::new(r));
-        }
-    }
-
-    fn add_expr(&mut self) -> Result<Expr, String> {
-        let mut l = self.mul_expr()?;
-        loop {
-            let op = match self.peek() {
-                Tok::Op("+") => "+",
-                Tok::Op("-") => "-",
-                _ => return Ok(l),
-            };
-            self.at += 1;
-            self.link()?;
-            let r = self.mul_expr()?;
-            l = Expr::Bin(op, Box::new(l), Box::new(r));
-        }
-    }
-
-    fn mul_expr(&mut self) -> Result<Expr, String> {
-        let mut l = self.unary()?;
-        loop {
-            let op = match self.peek() {
-                Tok::Op("*") => "*",
-                Tok::Op("/") => "/",
-                _ => return Ok(l),
-            };
-            self.at += 1;
-            self.link()?;
-            let r = self.unary()?;
-            l = Expr::Bin(op, Box::new(l), Box::new(r));
-        }
-    }
-
-    fn unary(&mut self) -> Result<Expr, String> {
-        self.enter()?;
-        let e = if self.eat_op("-") {
-            Ok(Expr::Neg(Box::new(self.unary()?)))
-        } else if self.eat_op("+") {
-            self.unary()
-        } else if self.eat_kw("not") || matches!(self.peek(), Tok::Ident(w) if w == "!") {
-            if matches!(self.peek(), Tok::Ident(w) if w == "!") {
-                self.at += 1;
-            }
-            Ok(Expr::Not(Box::new(self.unary()?)))
-        } else {
-            self.postfix()
-        };
-        self.leave();
-        e
-    }
-
-    fn postfix(&mut self) -> Result<Expr, String> {
-        let mut e = self.primary()?;
-        loop {
-            if matches!(self.peek(), Tok::Op("." | ".." | "[" | "(")) {
-                self.link()?;
-            }
-            if self.eat_op(".") {
-                let Tok::Ident(name) = self.next() else { return Err(format!("line {}: expected a name after .", self.line())) };
-                e = Expr::Member(Box::new(e), name);
-            } else if self.eat_op("..") {
-                let Tok::Ident(name) = self.next() else { return Err(format!("line {}: expected a name after ..", self.line())) };
-                e = Expr::Descend(Box::new(e), name);
-            } else if self.eat_op("[") {
-                let sign = match self.peek() {
-                    Tok::Op("-") => Some(-1),
-                    Tok::Op("+") => Some(1),
-                    _ => None,
-                };
-                let relative = sign.and_then(|sign| match (self.toks.get(self.at + 1).map(|t| &t.tok), self.toks.get(self.at + 2).map(|t| &t.tok)) {
-                    (Some(Tok::Num(n)), Some(Tok::Op("]"))) if n.is_finite() && *n >= 0.0 && *n < 1e6 => Some(sign * (*n as i64)),
-                    _ => None,
-                });
-                let idx = if let Some(k) = relative {
-                    self.at += 2;
-                    Idx::Rel(k)
-                } else if self.eat_op("*") {
-                    Idx::All
-                } else {
-                    Idx::Abs(Box::new(self.expr()?))
-                };
-                self.expect_op("]")?;
-                e = Expr::Index(Box::new(e), idx);
-            } else if self.eat_op("(") {
-                let mut args = Vec::new();
-                self.skip_newlines();
-                if !self.is_op(")") {
-                    loop {
-                        args.push(self.expr()?);
-                        self.skip_newlines();
-                        if !self.eat_op(",") {
-                            break;
-                        }
-                        self.skip_newlines();
-                    }
-                }
-                self.expect_op(")")?;
-                e = Expr::Call(Box::new(e), args);
-            } else {
-                return Ok(e);
-            }
-        }
-    }
-
-    fn primary(&mut self) -> Result<Expr, String> {
-        let line = self.line();
-        match self.next() {
-            Tok::Num(n) => Ok(Expr::Num(n)),
-            Tok::Str(s) => Ok(Expr::Str(s)),
-            Tok::Op("(") => {
-                self.skip_newlines();
-                let e = self.expr()?;
-                self.skip_newlines();
-                self.expect_op(")")?;
-                Ok(e)
-            }
-            Tok::Ident(w) if w.eq_ignore_ascii_case("null") => Ok(Expr::Null),
-            Tok::Ident(w) if w.eq_ignore_ascii_case("nan") => Ok(Expr::Num(f64::NAN)),
-            Tok::Ident(w) if w.eq_ignore_ascii_case("infinity") => Ok(Expr::Num(f64::INFINITY)),
-            Tok::Ident(w) if w.eq_ignore_ascii_case("true") => Ok(Expr::Num(1.0)),
-            Tok::Ident(w) if w.eq_ignore_ascii_case("false") => Ok(Expr::Num(0.0)),
-            Tok::Ident(w) => Ok(Expr::Ident(w)),
-            t => Err(format!("line {line}: unexpected {}", describe(&t))),
-        }
-    }
-}
-
-fn describe(t: &Tok) -> String {
-    match t {
-        Tok::Num(n) => format!("number {n}"),
-        Tok::Str(s) => format!("string {s:?}"),
-        Tok::Ident(s) => s.clone(),
-        Tok::Op(o) => format!("{o:?}"),
-        Tok::Newline => "end of line".into(),
-        Tok::Eof => "end of script".into(),
-    }
-}
-
-fn parse(src: &str) -> Result<Vec<Stmt>, String> {
-    let toks = lex(src)?;
-    let mut p = Parser { toks, at: 0, depth: 0, chain: 0 };
-    let body = p.block(&[])?;
-    match p.peek() {
-        Tok::Eof => Ok(body),
-        t => Err(format!("line {}: unexpected {}", p.line(), describe(t))),
-    }
-}
-
-// ── values ──────────────────────────────────────────────────────────────────────────────────
-
-#[derive(Clone, Debug, PartialEq)]
-enum Val {
-    Null,
-    Num(f64),
-    Str(String),
-    /// A form object, by index in the host.
-    Node(usize),
-    /// Several objects or values (`Row[*]`, `Row[*].Amount`).
-    List(Vec<Val>),
-    Host,
-    Layout,
-    Event,
-    /// `xfa` itself (`xfa.form`, `xfa.host`, …).
-    Xfa,
-    /// The instance manager of `name` under `parent`.
-    Im(usize, String),
-    /// A property object whose contents are not modelled (`$.border.fill…`): reads give
-    /// another sink, writes change nothing.
-    Sink,
-}
-
-/// A number as FormCalc prints it: integers without a fraction, otherwise up to 15 digits.
-fn num_text(n: f64) -> String {
-    if !n.is_finite() {
-        return if n.is_nan() {
-            "NaN".into()
-        } else if n > 0.0 {
-            "Infinity".into()
-        } else {
-            "-Infinity".into()
-        };
-    }
-    if n.fract() == 0.0 && n.abs() < 1e15 {
-        return format!("{}", n as i64);
-    }
-    let s = format!("{n:.12}");
-    let s = s.trim_end_matches('0').trim_end_matches('.');
-    if s.is_empty() || s == "-0" { "0".into() } else { s.to_string() }
-}
-
-/// `v` with `decimals` places, rounding exact halves away from zero (Rust's formatter rounds them to even).
-fn fixed(v: f64, decimals: usize) -> String {
-    let k = 10f64.powi(decimals.min(20) as i32);
-    let scaled = (v * k).round() / k;
-    // A small negative value rounds to -0.0, which would print as "-0".
-    let scaled = if scaled == 0.0 { 0.0 } else { scaled };
-    format!("{:.decimals$}", if scaled.is_finite() { scaled } else { v })
-}
-
-/// The number a string holds: its leading numeric part (`12abc` → 12), `None` for none.
-fn parse_num(s: &str) -> Option<f64> {
-    let t = s.trim();
-    if t.is_empty() {
-        return None;
-    }
-    let mut end = 0;
-    let b = t.as_bytes();
-    let mut seen_digit = false;
-    let mut seen_dot = false;
-    let mut seen_e = false;
-    let mut i = 0;
-    if i < b.len() && (b[i] == b'-' || b[i] == b'+') {
-        i += 1;
-    }
-    while i < b.len() {
-        let c = b[i];
-        if c.is_ascii_digit() {
-            seen_digit = true;
-            end = i + 1;
-        } else if c == b'.' && !seen_dot && !seen_e {
-            seen_dot = true;
-        } else if (c == b'e' || c == b'E') && seen_digit && !seen_e {
-            seen_e = true;
-            if i + 1 < b.len() && (b[i + 1] == b'-' || b[i + 1] == b'+') {
-                i += 1;
-            }
-        } else {
-            break;
-        }
-        i += 1;
-    }
-    if !seen_digit {
-        return None;
-    }
-    t.get(..end).and_then(|p| p.parse::<f64>().ok()).filter(|v| v.is_finite())
-}
-
-fn is_numeric_text(s: &str) -> bool {
-    s.trim().parse::<f64>().is_ok_and(f64::is_finite)
-}
-
 // ── the evaluator ───────────────────────────────────────────────────────────────────────────
 
 enum Flow {
@@ -799,1756 +104,6 @@ struct Interp<'h> {
 
 type R<T> = Result<T, String>;
 
-impl Interp<'_> {
-    fn step(&mut self) -> R<()> {
-        self.charge(1)
-    }
-
-    /// `n` units of work done (a step per statement or expression, more for work on long
-    /// strings and lists).
-    fn charge(&mut self, n: u64) -> R<()> {
-        let before = self.steps;
-        self.steps = self.steps.saturating_add(n);
-        if self.steps > MAX_STEPS {
-            return Err(RAN_TOO_LONG.into());
-        }
-        #[cfg(not(target_arch = "wasm32"))]
-        if self.steps / CLOCK_EVERY != before / CLOCK_EVERY
-            && let Some(d) = self.deadline
-            && std::time::Instant::now() > d
-        {
-            return Err(RAN_TOO_LONG.into());
-        }
-        #[cfg(target_arch = "wasm32")]
-        let _ = before;
-        Ok(())
-    }
-
-    /// `more` nodes into `out`, each once, never past [`MAX_LIST`].
-    fn gather(&mut self, out: &mut Vec<usize>, seen: &mut HashSet<usize>, more: impl IntoIterator<Item = usize>) -> R<()> {
-        for i in more {
-            if seen.insert(i) {
-                out.push(i);
-                if out.len() > MAX_LIST {
-                    return Err(LIST_TOO_LONG.into());
-                }
-            }
-        }
-        self.charge(1)
-    }
-
-    /// The nodes of `v`, each once.
-    fn nodes_list(&self, v: &Val) -> Vec<usize> {
-        let mut seen = HashSet::new();
-        self.nodes_of(v).into_iter().filter(|i| seen.insert(*i)).collect()
-    }
-
-    fn node(&self, i: usize) -> Option<&HNode> {
-        self.h.nodes.get(i).filter(|n| !n.gone)
-    }
-
-    // ── coercions
-
-    /// A node's value as a FormCalc value.
-    fn node_value(&self, i: usize) -> Val {
-        let Some(n) = self.node(i) else { return Val::Null };
-        if n.value.is_empty() {
-            return Val::Null;
-        }
-        if n.numeric
-            && let Some(v) = parse_num(&n.value)
-        {
-            return Val::Num(v);
-        }
-        Val::Str(n.value.clone())
-    }
-
-    /// What copying `v` (or the values it stands for) costs, in steps: one per 256 bytes, so
-    /// copying long strings over and over runs out of steps even where there is no clock
-    /// (wasm). A form object counts its value; a list its items too.
-    fn cost(&self, v: &Val) -> u64 {
-        let mut bytes = 0usize;
-        let mut todo = vec![v];
-        while let Some(v) = todo.pop() {
-            match v {
-                Val::Str(s) => bytes = bytes.saturating_add(s.len()),
-                Val::Node(i) => bytes = bytes.saturating_add(self.node(*i).map_or(0, |n| n.value.len())),
-                Val::List(items) => {
-                    bytes = bytes.saturating_add(items.len().saturating_mul(16));
-                    todo.extend(items.iter());
-                }
-                _ => {}
-            }
-        }
-        (bytes / 256) as u64
-    }
-
-    /// [`Self::deref`], charged for the copy.
-    fn take(&mut self, v: Val) -> R<Val> {
-        self.charge(self.cost(&v))?;
-        Ok(self.deref(v))
-    }
-
-    /// Objects become their values; lists of objects become lists of values.
-    fn deref(&self, v: Val) -> Val {
-        match v {
-            Val::Node(i) => self.node_value(i),
-            Val::List(items) => Val::List(items.into_iter().map(|x| self.deref(x)).collect()),
-            other => other,
-        }
-    }
-
-    fn to_num(&self, v: &Val) -> f64 {
-        match v {
-            Val::Null => 0.0,
-            Val::Num(n) => *n,
-            Val::Str(s) => parse_num(s).unwrap_or(0.0),
-            Val::Node(i) => self.to_num(&self.node_value(*i)),
-            Val::List(items) => items.first().map_or(0.0, |x| self.to_num(x)),
-            _ => 0.0,
-        }
-    }
-
-    fn to_str(&self, v: &Val) -> String {
-        match v {
-            Val::Null => String::new(),
-            Val::Num(n) => num_text(*n),
-            Val::Str(s) => s.clone(),
-            Val::Node(i) => self.to_str(&self.node_value(*i)),
-            Val::List(items) => items.first().map_or(String::new(), |x| self.to_str(x)),
-            Val::Host => "host".into(),
-            Val::Layout => "layout".into(),
-            Val::Event => "event".into(),
-            Val::Xfa => "xfa".into(),
-            Val::Im(..) => "instanceManager".into(),
-            Val::Sink => String::new(),
-        }
-    }
-
-    fn truthy(&self, v: &Val) -> bool {
-        match v {
-            Val::Null => false,
-            Val::Num(n) => *n != 0.0 && !n.is_nan(),
-            Val::Str(s) => parse_num(s).is_some_and(|n| n != 0.0),
-            Val::Node(i) => {
-                let d = self.node_value(*i);
-                self.truthy(&d)
-            }
-            Val::List(items) => !items.is_empty(),
-            _ => true,
-        }
-    }
-
-    fn is_null(&self, v: &Val) -> bool {
-        match v {
-            Val::Null => true,
-            Val::Node(i) => self.node(*i).is_none_or(|n| n.value.is_empty()),
-            Val::List(items) => items.is_empty(),
-            _ => false,
-        }
-    }
-
-    // ── scopes
-
-    fn lookup(&self, name: &str) -> Option<Val> {
-        self.scopes.iter().rev().find_map(|s| s.get(name).cloned())
-    }
-
-    fn set_var(&mut self, name: &str, v: Val) -> bool {
-        for s in self.scopes.iter_mut().rev() {
-            if let Some(slot) = s.get_mut(name) {
-                *slot = v;
-                return true;
-            }
-        }
-        false
-    }
-
-    fn declare(&mut self, name: &str, v: Val) {
-        if let Some(s) = self.scopes.last_mut() {
-            s.insert(name.to_string(), v);
-        }
-    }
-
-    // ── accessors
-
-    /// The objects an identifier names from the current node: `$`, the special objects, an
-    /// instance manager (`_name`), a variable, or a form object by name (children first, then
-    /// the containing subforms).
-    fn ident(&self, name: &str) -> R<Val> {
-        if let Some(v) = self.lookup(name) {
-            return Ok(v);
-        }
-        let lower = name.to_ascii_lowercase();
-        Ok(match lower.as_str() {
-            "$" | "this" => Val::Node(self.h.current),
-            "$host" => Val::Host,
-            "$layout" => Val::Layout,
-            "$event" => Val::Event,
-            "$form" | "$data" | "$dataset" | "$datasets" => Val::Node(0),
-            "$record" => Val::Node(if self.node(1).is_some() { 1 } else { 0 }),
-            "$template" | "$xfa" => Val::Xfa,
-            "xfa" => Val::Xfa,
-            _ => {
-                if let Some(child) = name.strip_prefix('_') {
-                    // The instance manager of `child`, looked for like a name.
-                    let found = resolve_som(self.h, self.h.current, child);
-                    let Some(&first) = found.first() else { return Err(format!("unknown instance manager _{child}")) };
-                    let parent = self.node(first).and_then(|n| n.parent).ok_or_else(|| format!("unknown instance manager _{child}"))?;
-                    return Ok(Val::Im(parent, child.to_string()));
-                }
-                let found = resolve_som(self.h, self.h.current, name);
-                match found.as_slice() {
-                    [] => return Err(format!("unknown name {name}")),
-                    [one] => Val::Node(*one),
-                    many => Val::List(many.iter().map(|i| Val::Node(*i)).collect()),
-                }
-            }
-        })
-    }
-
-    /// Every object a value stands for.
-    fn nodes_of(&self, v: &Val) -> Vec<usize> {
-        match v {
-            Val::Node(i) => vec![*i],
-            Val::List(items) => items.iter().flat_map(|x| self.nodes_of(x)).collect(),
-            _ => Vec::new(),
-        }
-    }
-
-    fn member(&mut self, base: Val, name: &str) -> R<Val> {
-        match base {
-            Val::Node(i) => self.node_member(i, name),
-            Val::List(items) => {
-                let mut out = Vec::new();
-                let mut seen = HashSet::new();
-                for it in items {
-                    match self.member(it, name)? {
-                        Val::List(more) => {
-                            for m in more {
-                                self.list_push(&mut out, &mut seen, m)?;
-                            }
-                        }
-                        Val::Null => {}
-                        v => self.list_push(&mut out, &mut seen, v)?,
-                    }
-                }
-                Ok(match out.len() {
-                    0 => Val::Null,
-                    1 => out.remove(0),
-                    _ => Val::List(out),
-                })
-            }
-            Val::Host => Ok(match name.to_ascii_lowercase().as_str() {
-                "numpages" => Val::Num(self.h.doc.page_count as f64),
-                "currentpage" => Val::Num(self.h.doc.page as f64),
-                "name" => Val::Str("Acrobat".into()),
-                "apptype" => Val::Str("Exchange-Pro".into()),
-                "version" => Val::Str("11".into()),
-                "variation" => Val::Str("Full".into()),
-                "language" => Val::Str("en".into()),
-                "platform" => Val::Str(crate::platform().into()),
-                "title" => Val::Str(self.h.doc.file_name.clone()),
-                "calculationsenabled" | "validationsenabled" => Val::Num(1.0),
-                _ => Val::Sink,
-            }),
-            Val::Layout => Ok(Val::Sink),
-            Val::Event => Ok(match name.to_ascii_lowercase().as_str() {
-                "name" => Val::Str(self.event.activity.clone()),
-                "newtext" | "fulltext" => Val::Str(self.event.new_text.clone()),
-                "prevtext" => Val::Str(self.event.prev_text.clone()),
-                "change" => Val::Str(String::new()),
-                "target" => Val::Node(self.h.current),
-                "selstart" | "selend" | "cancelaction" | "reenter" | "shift" | "modifier" | "keydown" | "commitkey" => Val::Num(0.0),
-                _ => Val::Sink,
-            }),
-            Val::Xfa => Ok(match name.to_ascii_lowercase().as_str() {
-                "form" | "datasets" | "data" => Val::Node(0),
-                "record" => Val::Node(if self.node(1).is_some() { 1 } else { 0 }),
-                "host" => Val::Host,
-                "layout" => Val::Layout,
-                "event" => Val::Event,
-                _ => Val::Sink,
-            }),
-            Val::Im(parent, child) => Ok(match name.to_ascii_lowercase().as_str() {
-                "count" => Val::Num(instances(self.h, parent, &child).len() as f64),
-                "min" => Val::Num(instances(self.h, parent, &child).first().and_then(|i| self.node(*i)).map_or(0.0, |n| n.occur_min as f64)),
-                "max" => Val::Num(
-                    instances(self.h, parent, &child).first().and_then(|i| self.node(*i)).and_then(|n| n.occur_max).map_or(-1.0, |m| m as f64),
-                ),
-                "classname" => Val::Str("instanceManager".into()),
-                _ => Val::Sink,
-            }),
-            Val::Sink => Ok(Val::Sink),
-            Val::Null => Err(format!("no object to take {name} from")),
-            Val::Num(_) | Val::Str(_) => Err(format!("{} has no property {name}", self.to_str(&base))),
-        }
-    }
-
-    /// `v` onto `out`: a node only once, never past [`MAX_LIST`].
-    fn list_push(&mut self, out: &mut Vec<Val>, seen: &mut HashSet<usize>, v: Val) -> R<()> {
-        if let Val::Node(i) = v
-            && !seen.insert(i)
-        {
-            return Ok(());
-        }
-        out.push(v);
-        if out.len() > MAX_LIST {
-            return Err(LIST_TOO_LONG.into());
-        }
-        self.charge(1)
-    }
-
-    /// Property `name` of form object `i` as FormCalc reads it: its value, attributes,
-    /// relatives and children by name.
-    fn node_member(&mut self, i: usize, name: &str) -> R<Val> {
-        let Some(n) = self.node(i) else { return Ok(Val::Null) };
-        Ok(match name {
-            "formattedValue" => match &n.formatted {
-                Some(f) => Val::Str(f.clone()),
-                None => self.node_value(i),
-            },
-            "rawValue" | "value" => self.node_value(i),
-            "name" => Val::Str(n.name.clone()),
-            "somExpression" => Val::Str(n.som.clone()),
-            "className" => Val::Str(n.kind.class_name().into()),
-            "index" | "instanceIndex" => Val::Num(n.index as f64),
-            "presence" => Val::Str(n.presence.clone()),
-            "access" => Val::Str(n.access.clone()),
-            "isNull" => Val::Num(if n.value.is_empty() { 1.0 } else { 0.0 }),
-            "mandatory" => Val::Str("disabled".into()),
-            "parent" => n.parent.map_or(Val::Null, Val::Node),
-            "nodes" => Val::List(n.children.iter().copied().filter(|c| self.node(*c).is_some()).map(Val::Node).collect()),
-            "all" => match n.parent {
-                Some(p) => Val::List(instances(self.h, p, &n.name).into_iter().map(Val::Node).collect()),
-                None => Val::Node(i),
-            },
-            "instanceManager" => match n.parent {
-                Some(p) => Val::Im(p, n.name.clone()),
-                None => Val::Null,
-            },
-            "border" | "ui" | "font" | "caption" | "fillColor" | "borderColor" | "fontColor" | "margin" | "para" | "assist" | "validate"
-            | "format" | "items" | "bind" | "keep" | "h" | "w" | "x" | "y" | "minH" | "maxH" | "minW" | "maxW" | "layout" | "model"
-            | "oneOfChild" | "locale" | "relevant" | "colSpan" | "dataNode" | "defaultValue" | "editValue" | "selectedIndex" | "event"
-            | "calculate" | "traversal" | "extras" | "desc" => Val::Sink,
-            other => {
-                if let Some(child) = other.strip_prefix('_') {
-                    return Ok(if child_named(self.h, i, child).is_some() { Val::Im(i, child.to_string()) } else { Val::Null });
-                }
-                let found = instances(self.h, i, other);
-                match found.as_slice() {
-                    [] => Val::Null,
-                    [one] => Val::Node(*one),
-                    many => Val::List(many.iter().map(|k| Val::Node(*k)).collect()),
-                }
-            }
-        })
-    }
-
-    /// `base[n]` / `base[*]`: all the instances the last step named, then one or all.
-    fn index(&mut self, base: &Expr, idx: &Idx) -> R<Val> {
-        let all = self.all_of(base)?;
-        match idx {
-            Idx::All => Ok(Val::List(all.into_iter().map(Val::Node).collect())),
-            Idx::Abs(e) => {
-                let v = self.eval(e)?;
-                let n = self.to_num(&v);
-                if !n.is_finite() || n < 0.0 {
-                    return Ok(Val::Null);
-                }
-                Ok(all.get(n as usize).map_or(Val::Null, |i| Val::Node(*i)))
-            }
-            Idx::Rel(k) => {
-                // From the instance the script runs in (`row[-1]` in a row is the row above),
-                // else from the first.
-                let here = all.iter().position(|&i| self.encloses(i, self.h.current)).unwrap_or(0);
-                let at = (here as i64).saturating_add(*k);
-                Ok(usize::try_from(at).ok().and_then(|at| all.get(at)).map_or(Val::Null, |i| Val::Node(*i)))
-            }
-        }
-    }
-
-    /// Whether `node` is `inner` or one of its containers.
-    fn encloses(&self, node: usize, inner: usize) -> bool {
-        let mut at = Some(inner);
-        let mut guard = 0;
-        while let Some(i) = at
-            && guard < MAX_PARSE_DEPTH
-        {
-            if i == node {
-                return true;
-            }
-            at = self.h.nodes.get(i).and_then(|n| n.parent);
-            guard += 1;
-        }
-        false
-    }
-
-    /// Every instance an accessor names (`Row` → all rows, not just the first), each once.
-    fn all_of(&mut self, e: &Expr) -> R<Vec<usize>> {
-        let mut out = Vec::new();
-        let mut seen = HashSet::new();
-        match e {
-            Expr::Ident(name) => {
-                if self.lookup(name).is_some() || name.starts_with('$') || name.eq_ignore_ascii_case("xfa") {
-                    let v = self.eval(e)?;
-                    return Ok(self.nodes_list(&v));
-                }
-                // The name resolves to its first instance; `row[*]` means every sibling of it.
-                for first in resolve_som(self.h, self.h.current, name) {
-                    match self.node(first).and_then(|n| n.parent.map(|p| (p, n.name.clone()))) {
-                        Some((p, n)) => self.gather(&mut out, &mut seen, instances(self.h, p, &n))?,
-                        None => self.gather(&mut out, &mut seen, [first])?,
-                    }
-                }
-            }
-            Expr::Member(base, name) => {
-                let b = self.eval(base)?;
-                for i in self.nodes_list(&b) {
-                    self.gather(&mut out, &mut seen, instances(self.h, i, name))?;
-                }
-                if out.is_empty() {
-                    let v = self.member(b, name)?;
-                    out = self.nodes_list(&v);
-                }
-            }
-            Expr::Descend(base, name) => {
-                let b = self.eval(base)?;
-                for i in self.nodes_list(&b) {
-                    self.gather(&mut out, &mut seen, descendants_named(self.h, i, name, 0))?;
-                }
-            }
-            other => {
-                let v = self.eval(other)?;
-                out = self.nodes_list(&v);
-            }
-        }
-        Ok(out)
-    }
-
-    // ── expressions
-
-    fn eval(&mut self, e: &Expr) -> R<Val> {
-        self.step()?;
-        self.depth += 1;
-        if self.depth > self.max_depth {
-            self.depth -= 1;
-            return Err(TOO_DEEP.into());
-        }
-        let r = self.eval_inner(e);
-        self.depth -= 1;
-        r
-    }
-
-    fn eval_inner(&mut self, e: &Expr) -> R<Val> {
-        Ok(match e {
-            Expr::Num(n) => Val::Num(*n),
-            Expr::Str(s) => {
-                self.charge((s.len() / 256) as u64)?;
-                Val::Str(s.clone())
-            }
-            Expr::Null => Val::Null,
-            Expr::Ident(name) => {
-                let v = self.ident(name)?;
-                self.charge(self.cost(&v))?;
-                v
-            }
-            Expr::Member(base, name) => {
-                let b = self.eval(base)?;
-                self.member(b, name)?
-            }
-            Expr::Index(base, idx) => self.index(base, idx)?,
-            Expr::Descend(base, name) => {
-                let b = self.eval(base)?;
-                let mut out = Vec::new();
-                let mut seen = HashSet::new();
-                for i in self.nodes_list(&b) {
-                    self.gather(&mut out, &mut seen, descendants_named(self.h, i, name, 0))?;
-                }
-                match out.as_slice() {
-                    [] => Val::Null,
-                    [one] => Val::Node(*one),
-                    many => Val::List(many.iter().map(|k| Val::Node(*k)).collect()),
-                }
-            }
-            Expr::Call(callee, args) => self.call(callee, args)?,
-            Expr::Neg(x) => {
-                let v = self.eval(x)?;
-                if self.is_null(&v) { Val::Null } else { Val::Num(-self.to_num(&v)) }
-            }
-            Expr::Not(x) => {
-                let v = self.eval(x)?;
-                Val::Num(if self.truthy(&v) { 0.0 } else { 1.0 })
-            }
-            Expr::Bin(..) => {
-                // The parser leans left (`a + b + c` is `(a + b) + c`), so a chain is walked
-                // from its leftmost operand and folded without recursing per operator.
-                let mut links = Vec::new();
-                let mut leftmost = e;
-                while let Expr::Bin(op, l, r) = leftmost {
-                    links.push((*op, r.as_ref()));
-                    leftmost = l;
-                }
-                let mut acc = self.eval(leftmost)?;
-                for (op, r) in links.into_iter().rev() {
-                    self.step()?;
-                    acc = match op {
-                        "&" => {
-                            if !self.truthy(&acc) {
-                                // Not evaluated: the result is settled.
-                                Val::Num(0.0)
-                            } else {
-                                let b = self.eval(r)?;
-                                Val::Num(if self.truthy(&b) { 1.0 } else { 0.0 })
-                            }
-                        }
-                        "|" => {
-                            if self.truthy(&acc) {
-                                Val::Num(1.0)
-                            } else {
-                                let b = self.eval(r)?;
-                                Val::Num(if self.truthy(&b) { 1.0 } else { 0.0 })
-                            }
-                        }
-                        _ => {
-                            let b = self.eval(r)?;
-                            // Comparing (and dereferencing) long strings is work too.
-                            self.charge(self.cost(&acc).saturating_add(self.cost(&b)))?;
-                            self.binary(op, acc, b)?
-                        }
-                    };
-                }
-                acc
-            }
-        })
-    }
-
-    fn binary(&self, op: &str, a: Val, b: Val) -> R<Val> {
-        let (a, b) = (self.deref(a), self.deref(b));
-        // Null with an arithmetic operator is null only when both sides are null.
-        match op {
-            "+" | "-" | "*" | "/" => {
-                if self.is_null(&a) && self.is_null(&b) {
-                    return Ok(Val::Null);
-                }
-                let (x, y) = (self.to_num(&a), self.to_num(&b));
-                let v = match op {
-                    "+" => x + y,
-                    "-" => x - y,
-                    "*" => x * y,
-                    _ => {
-                        if y == 0.0 {
-                            return Err("division by zero".into());
-                        }
-                        x / y
-                    }
-                };
-                Ok(Val::Num(v))
-            }
-            _ => {
-                let ord = match (&a, &b) {
-                    (Val::Null, Val::Null) => Some(std::cmp::Ordering::Equal),
-                    (Val::Null, _) | (_, Val::Null) => None,
-                    (Val::Str(s), Val::Str(t)) if !(is_numeric_text(s) && is_numeric_text(t)) => Some(s.cmp(t)),
-                    (Val::Str(s), Val::Num(_)) if !is_numeric_text(s) => Some(s.as_str().cmp(num_text(self.to_num(&b)).as_str())),
-                    (Val::Num(_), Val::Str(t)) if !is_numeric_text(t) => Some(num_text(self.to_num(&a)).as_str().cmp(t.as_str())),
-                    _ => self.to_num(&a).partial_cmp(&self.to_num(&b)),
-                };
-                let r = match (op, ord) {
-                    ("==", Some(o)) => o.is_eq(),
-                    ("<>", Some(o)) => !o.is_eq(),
-                    ("<>", None) => true,
-                    ("<", Some(o)) => o.is_lt(),
-                    ("<=", Some(o)) => o.is_le(),
-                    (">", Some(o)) => o.is_gt(),
-                    (">=", Some(o)) => o.is_ge(),
-                    _ => false,
-                };
-                Ok(Val::Num(if r { 1.0 } else { 0.0 }))
-            }
-        }
-    }
-
-    // ── calls
-
-    fn call(&mut self, callee: &Expr, args: &[Expr]) -> R<Val> {
-        match callee {
-            Expr::Ident(name) => {
-                if let Some(f) = self.funcs.get(&name.to_ascii_lowercase()).cloned() {
-                    let mut vals = Vec::new();
-                    for a in args {
-                        let v = self.eval(a)?;
-                        vals.push(self.take(v)?);
-                    }
-                    return self.call_user(&f, vals);
-                }
-                self.builtin(name, args)
-            }
-            Expr::Member(base, method) => {
-                let b = self.eval(base)?;
-                self.method(b, method, args)
-            }
-            _ => Err("not a function".into()),
-        }
-    }
-
-    fn call_user(&mut self, f: &Func, vals: Vec<Val>) -> R<Val> {
-        if self.scopes.len() > self.max_depth {
-            return Err(CALLS_TOO_DEEP.into());
-        }
-        let mut scope = HashMap::new();
-        for (i, p) in f.params.iter().enumerate() {
-            scope.insert(p.clone(), vals.get(i).cloned().unwrap_or(Val::Null));
-        }
-        self.scopes.push(scope);
-        let r = self.block(&f.body);
-        self.scopes.pop();
-        match r? {
-            (Flow::Return(v), _) => Ok(v),
-            (Flow::Exit, last) => {
-                self.exited = true;
-                Ok(last)
-            }
-            (_, last) => Ok(last),
-        }
-    }
-
-    fn arg(&mut self, args: &[Expr], i: usize) -> R<Val> {
-        match args.get(i) {
-            Some(e) => {
-                let v = self.eval(e)?;
-                self.take(v)
-            }
-            None => Ok(Val::Null),
-        }
-    }
-
-    fn arg_num(&mut self, args: &[Expr], i: usize) -> R<f64> {
-        let v = self.arg(args, i)?;
-        Ok(self.to_num(&v))
-    }
-
-    fn arg_str(&mut self, args: &[Expr], i: usize) -> R<String> {
-        let v = self.arg(args, i)?;
-        Ok(self.to_str(&v))
-    }
-
-    /// Every value the arguments hold, lists flattened, nulls left out.
-    fn arg_values(&mut self, args: &[Expr]) -> R<Vec<Val>> {
-        self.arg_values_keeping(args, false)
-    }
-
-    /// [`Self::arg_values`]; `objects` keeps form objects (fields, subforms) as themselves, so
-    /// `Count(row[*])` counts rows rather than filled-in values.
-    fn arg_values_keeping(&mut self, args: &[Expr], objects: bool) -> R<Vec<Val>> {
-        let mut out = Vec::new();
-        for a in args {
-            let v = self.eval(a)?;
-            let v = if objects { v } else { self.take(v)? };
-            match v {
-                Val::List(items) => out.extend(items.into_iter().filter(|x| !matches!(x, Val::Null))),
-                Val::Null => {}
-                other => out.push(other),
-            }
-            if out.len() > MAX_LIST {
-                return Err(LIST_TOO_LONG.into());
-            }
-        }
-        Ok(out)
-    }
-
-    fn method(&mut self, base: Val, method: &str, args: &[Expr]) -> R<Val> {
-        let m = method.to_ascii_lowercase();
-        match base {
-            Val::Host => match m.as_str() {
-                "messagebox" => {
-                    let t = self.arg_str(args, 0)?;
-                    self.h.push(XfaEffect::MessageBox(t));
-                    Ok(Val::Num(1.0))
-                }
-                "resetdata" => {
-                    let list = self.arg_str(args, 0)?;
-                    self.h.push(XfaEffect::ResetData(reset_names(&list)));
-                    Ok(Val::Null)
-                }
-                "print" => {
-                    self.h.push(XfaEffect::Print);
-                    Ok(Val::Null)
-                }
-                "beep" => {
-                    self.h.push(XfaEffect::Beep);
-                    Ok(Val::Null)
-                }
-                "gotourl" => {
-                    let u = self.arg_str(args, 0)?;
-                    self.h.push(XfaEffect::LaunchUrl(u));
-                    Ok(Val::Null)
-                }
-                "setfocus" => {
-                    let target = match args.first() {
-                        Some(e) => {
-                            let raw = self.eval(e)?;
-                            match self.nodes_of(&raw).first() {
-                                Some(i) => self.node(*i).map(|n| n.som.clone()).unwrap_or_default(),
-                                None => {
-                                    let s = self.to_str(&raw);
-                                    let found = resolve_som(self.h, self.h.current, &s);
-                                    found.first().and_then(|i| self.node(*i)).map(|n| n.som.clone()).unwrap_or(s)
-                                }
-                            }
-                        }
-                        None => String::new(),
-                    };
-                    self.h.push(XfaEffect::SetFocus(target));
-                    Ok(Val::Null)
-                }
-                _ => Ok(Val::Null),
-            },
-            Val::Layout => match m.as_str() {
-                "page" | "abspage" => Ok(Val::Num(self.h.doc.page as f64 + if m == "page" { 1.0 } else { 0.0 })),
-                "pagecount" | "abspagecount" => Ok(Val::Num(self.h.doc.page_count as f64)),
-                "relayout" | "relayoutpagearea" => {
-                    self.h.push(XfaEffect::Relayout);
-                    Ok(Val::Null)
-                }
-                _ => Ok(Val::Num(0.0)),
-            },
-            Val::Xfa => match m.as_str() {
-                "resolvenode" | "resolvenodes" => {
-                    let s = self.arg_str(args, 0)?;
-                    let found = resolve_som(self.h, self.h.current, &s);
-                    Ok(self.set_val(found, m == "resolvenodes"))
-                }
-                "recalculate" => {
-                    self.h.push(XfaEffect::Recalculate);
-                    Ok(Val::Null)
-                }
-                "remerge" => {
-                    self.h.push(XfaEffect::Relayout);
-                    Ok(Val::Null)
-                }
-                _ => Ok(Val::Null),
-            },
-            Val::Node(i) => match m.as_str() {
-                "resolvenode" | "resolvenodes" => {
-                    let s = self.arg_str(args, 0)?;
-                    let found = resolve_som(self.h, i, &s);
-                    Ok(self.set_val(found, m == "resolvenodes"))
-                }
-                "recalculate" => {
-                    self.h.push(XfaEffect::Recalculate);
-                    Ok(Val::Null)
-                }
-                "remerge" => {
-                    self.h.push(XfaEffect::Relayout);
-                    Ok(Val::Null)
-                }
-                _ => Ok(Val::Null),
-            },
-            Val::Im(parent, name) => match m.as_str() {
-                "addinstance" | "insertinstance" => Ok(self.h.add_instance(parent, &name).map_or(Val::Null, Val::Node)),
-                "removeinstance" => {
-                    let i = self.arg_num(args, 0)?;
-                    if i.is_finite() && i >= 0.0 {
-                        self.h.remove_instance(parent, &name, i as usize);
-                    }
-                    Ok(Val::Null)
-                }
-                "setinstances" => {
-                    let want = self.arg_num(args, 0)?;
-                    if want.is_finite() && want >= 0.0 {
-                        self.h.set_instances(parent, &name, want as usize);
-                    }
-                    Ok(Val::Null)
-                }
-                _ => Ok(Val::Null),
-            },
-            Val::Event | Val::Sink | Val::List(_) => Ok(Val::Null),
-            Val::Null => Err(format!("no object to call {method} on")),
-            Val::Num(_) | Val::Str(_) => Err(format!("{} has no method {method}", self.to_str(&base))),
-        }
-    }
-
-    fn set_val(&self, found: Vec<usize>, many: bool) -> Val {
-        if many {
-            return Val::List(found.into_iter().map(Val::Node).collect());
-        }
-        match found.as_slice() {
-            [] => Val::Null,
-            [one] => Val::Node(*one),
-            all => Val::List(all.iter().map(|i| Val::Node(*i)).collect()),
-        }
-    }
-
-    // ── assignment
-
-    fn assign(&mut self, target: &Expr, v: Val) -> R<()> {
-        let v = self.deref(v);
-        match target {
-            Expr::Ident(name) => {
-                if self.set_var(name, v.clone()) {
-                    return Ok(());
-                }
-                let t = self.ident(name)?;
-                self.assign_to(t, "rawValue", v)
-            }
-            Expr::Member(base, prop) => {
-                let b = self.eval(base)?;
-                self.assign_to(b, prop, v)
-            }
-            Expr::Index(..) | Expr::Descend(..) => {
-                let t = self.eval(target)?;
-                self.assign_to(t, "rawValue", v)
-            }
-            _ => Err("cannot assign to that".into()),
-        }
-    }
-
-    fn assign_to(&mut self, target: Val, prop: &str, v: Val) -> R<()> {
-        match target {
-            Val::Node(i) => {
-                let Some(n) = self.node(i) else { return Ok(()) };
-                let som = n.som.clone();
-                match prop {
-                    "rawValue" | "value" | "formattedValue" => {
-                        let text = self.to_str(&v);
-                        if !self.h.set_value(i, text) {
-                            return Err(format!("{} is not a field", if som.is_empty() { "the form" } else { som.as_str() }));
-                        }
-                    }
-                    "presence" => {
-                        let p = self.to_str(&v);
-                        if matches!(p.as_str(), "visible" | "invisible" | "hidden" | "inactive") {
-                            self.h.set_state(i, XfaEffect::SetPresence { som, presence: p });
-                        }
-                    }
-                    "access" => {
-                        let a = self.to_str(&v);
-                        if matches!(a.as_str(), "open" | "readOnly" | "protected" | "nonInteractive") {
-                            self.h.set_state(i, XfaEffect::SetAccess { som, access: a });
-                        }
-                    }
-                    other => {
-                        // `page1.qty = 7`: the child object named by the last step takes the value.
-                        if let Some(child) = other.strip_prefix('_') {
-                            if child_named(self.h, i, child).is_some() {
-                                return self.assign_to(Val::Im(i, child.to_string()), "count", v);
-                            }
-                            return Ok(());
-                        }
-                        let kids = instances(self.h, i, other);
-                        if kids.is_empty() {
-                            return Err(format!("{som} has no {other} to assign to"));
-                        }
-                        for k in kids {
-                            // Every destination copies the value: charge each copy.
-                            self.charge(self.cost(&v))?;
-                            self.assign_to(Val::Node(k), "rawValue", v.clone())?;
-                        }
-                    }
-                }
-                Ok(())
-            }
-            Val::List(items) => {
-                for it in items {
-                    self.charge(self.cost(&v))?;
-                    self.assign_to(it, prop, v.clone())?;
-                }
-                Ok(())
-            }
-            Val::Im(parent, name) if prop.eq_ignore_ascii_case("count") => {
-                let want = self.to_num(&v);
-                if want.is_finite() && want >= 0.0 {
-                    self.h.set_instances(parent, &name, want as usize);
-                }
-                Ok(())
-            }
-            _ => Ok(()),
-        }
-    }
-
-    // ── statements
-
-    /// Run a block; returns how it ended and the value of its last expression statement.
-    fn block(&mut self, body: &[Stmt]) -> R<(Flow, Val)> {
-        // Nesting of statements counts like nesting of expressions: both are stack.
-        self.depth += 1;
-        if self.depth > self.max_depth {
-            self.depth -= 1;
-            return Err(TOO_DEEP.into());
-        }
-        let r = self.block_inner(body);
-        self.depth -= 1;
-        r
-    }
-
-    fn block_inner(&mut self, body: &[Stmt]) -> R<(Flow, Val)> {
-        let mut last = Val::Null;
-        for s in body {
-            self.step()?;
-            match self.exec(s)? {
-                (Flow::Next, v) => {
-                    if let Some(v) = v {
-                        last = v;
-                    }
-                    if self.exited {
-                        return Ok((Flow::Exit, last));
-                    }
-                }
-                (flow, _) => return Ok((flow, last)),
-            }
-        }
-        Ok((Flow::Next, last))
-    }
-
-    fn exec(&mut self, s: &Stmt) -> R<(Flow, Option<Val>)> {
-        match s {
-            Stmt::Var(name, init) => {
-                let v = match init {
-                    Some(e) => {
-                        let v = self.eval(e)?;
-                        self.take(v)?
-                    }
-                    None => Val::Null,
-                };
-                self.declare(name, v.clone());
-                Ok((Flow::Next, Some(v)))
-            }
-            Stmt::Assign(target, e) => {
-                let v = self.eval(e)?;
-                let v = self.take(v)?;
-                self.assign(target, v.clone())?;
-                Ok((Flow::Next, Some(v)))
-            }
-            Stmt::Expr(e) => {
-                let v = self.eval(e)?;
-                let v = self.take(v)?;
-                Ok((Flow::Next, Some(v)))
-            }
-            Stmt::If(arms, otherwise) => {
-                for (cond, body) in arms {
-                    let c = self.eval(cond)?;
-                    if self.truthy(&c) {
-                        let (f, v) = self.block(body)?;
-                        return Ok((f, Some(v)));
-                    }
-                }
-                if let Some(body) = otherwise {
-                    let (f, v) = self.block(body)?;
-                    return Ok((f, Some(v)));
-                }
-                Ok((Flow::Next, None))
-            }
-            Stmt::While(cond, body) => {
-                loop {
-                    let c = self.eval(cond)?;
-                    if !self.truthy(&c) {
-                        break;
-                    }
-                    self.iterate()?;
-                    match self.block(body)? {
-                        (Flow::Break, _) => break,
-                        (Flow::Return(v), _) => return Ok((Flow::Return(v), None)),
-                        (Flow::Exit, _) => return Ok((Flow::Exit, None)),
-                        _ => {}
-                    }
-                }
-                Ok((Flow::Next, None))
-            }
-            Stmt::For { var, from, to, up, step, body } => {
-                let start = {
-                    let v = self.eval(from)?;
-                    self.to_num(&v)
-                };
-                let end = {
-                    let v = self.eval(to)?;
-                    self.to_num(&v)
-                };
-                let by = match step {
-                    Some(e) => {
-                        let v = self.eval(e)?;
-                        self.to_num(&v).abs()
-                    }
-                    None => 1.0,
-                };
-                if by.is_nan() || by <= 0.0 || !start.is_finite() || !end.is_finite() {
-                    return Err("bad for loop bounds".into());
-                }
-                self.declare(var, Val::Num(start));
-                let mut i = start;
-                while if *up { i <= end } else { i >= end } {
-                    self.iterate()?;
-                    self.set_var(var, Val::Num(i));
-                    match self.block(body)? {
-                        (Flow::Break, _) => break,
-                        (Flow::Return(v), _) => return Ok((Flow::Return(v), None)),
-                        (Flow::Exit, _) => return Ok((Flow::Exit, None)),
-                        _ => {}
-                    }
-                    i = if *up { i + by } else { i - by };
-                }
-                Ok((Flow::Next, None))
-            }
-            Stmt::Foreach { var, list, body } => {
-                let items = self.arg_values_keeping(list, true)?;
-                self.declare(var, Val::Null);
-                for it in items {
-                    self.iterate()?;
-                    self.set_var(var, it);
-                    match self.block(body)? {
-                        (Flow::Break, _) => break,
-                        (Flow::Return(v), _) => return Ok((Flow::Return(v), None)),
-                        (Flow::Exit, _) => return Ok((Flow::Exit, None)),
-                        _ => {}
-                    }
-                }
-                Ok((Flow::Next, None))
-            }
-            Stmt::Func { name, f } => {
-                self.funcs.insert(name.to_ascii_lowercase(), Rc::clone(f));
-                Ok((Flow::Next, None))
-            }
-            Stmt::Return(e) => {
-                let v = match e {
-                    Some(e) => {
-                        let v = self.eval(e)?;
-                        self.take(v)?
-                    }
-                    None => Val::Null,
-                };
-                Ok((Flow::Return(v), None))
-            }
-            Stmt::Break => Ok((Flow::Break, None)),
-            Stmt::Continue => Ok((Flow::Continue, None)),
-            Stmt::Exit => Ok((Flow::Exit, None)),
-            Stmt::Throw(e) => {
-                let v = self.eval(e)?;
-                self.charge(self.cost(&v))?;
-                // The thrown value becomes the error message the caller keeps: cut it as
-                // messages are.
-                Err(clip(self.to_str(&v)))
-            }
-        }
-    }
-
-    fn iterate(&mut self) -> R<()> {
-        if self.loops_left == 0 {
-            return Err(LOOPED_TOO_MUCH.into());
-        }
-        self.loops_left -= 1;
-        Ok(())
-    }
-}
-
-// ── built-in functions ──────────────────────────────────────────────────────────────────────
-
-/// `NaiveDate::num_days_from_ce` of 1900-01-01 minus one: a civil date's day count rebased so
-/// that 1900-01-01 is FormCalc day 1 (and 1970-01-01 is day 25_568).
-const FORMCALC_EPOCH_FROM_CE: i64 = 693_595;
-
-/// Days in one 400-year Gregorian cycle; the calendar repeats after it.
-const DAYS_PER_400_YEARS: i64 = 146_097;
-
-/// Days from 1900-01-01 (day 1, as FormCalc counts) to a civil date.
-///
-/// chrono's `NaiveDate` stops near ±262143, but FormCalc accepts day numbers up to `MAX_DAYS`
-/// (years past 270000). The calendar repeats every 400 years, so chrono converts the date
-/// within its cycle and whole cycles are added back; the result matches the proleptic Gregorian
-/// count for every year. Callers pass dates `parse_date`/`civil_from_days` already validated;
-/// anything else reads as 0.
-fn days_from_civil(y: i64, m: u32, d: u32) -> i64 {
-    use chrono::Datelike;
-    let (cycles, year) = (i128::from(y.div_euclid(400)), y.rem_euclid(400));
-    i32::try_from(year)
-        .ok()
-        .and_then(|year| chrono::NaiveDate::from_ymd_opt(year, m, d))
-        .and_then(|date| {
-            let days = i128::from(date.num_days_from_ce()) - i128::from(FORMCALC_EPOCH_FROM_CE) + cycles * i128::from(DAYS_PER_400_YEARS);
-            i64::try_from(days).ok()
-        })
-        .unwrap_or(0)
-}
-
-/// The civil date (year, month, day) at FormCalc day number `n` (day 1 is 1900-01-01), for any
-/// `n`: chrono converts the day within its 400-year cycle and the cycles are added back as years.
-fn civil_from_days(n: i64) -> (i64, u32, u32) {
-    use chrono::Datelike;
-    // Days since CE day 0 (0000-12-31), in i128 so no `n` overflows.
-    let from_ce = i128::from(n) + i128::from(FORMCALC_EPOCH_FROM_CE);
-    let (cycles, rest) = (from_ce.div_euclid(i128::from(DAYS_PER_400_YEARS)), from_ce.rem_euclid(i128::from(DAYS_PER_400_YEARS)));
-    // `rest` is 0..146_097, so CE day `rest` lies in years 0..=400 (day 0 is 0000-12-31).
-    let date = i32::try_from(rest).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
-    match date {
-        Some(date) => {
-            let y = i128::from(date.year()) + cycles * 400;
-            (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), date.month(), date.day())
-        }
-        // Unreachable: every `rest` in 0..146_097 is a valid CE day.
-        None => (1900, 1, 1),
-    }
-}
-
-/// Day numbers (and years) beyond this are refused rather than computed.
-const MAX_DAYS: f64 = 1e8;
-
-const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
-
-/// Parse `text` as a date by `picture` (`YYYY-MM-DD`, `MM/DD/YYYY`, `MMM D, YYYY`, …).
-fn parse_date(text: &str, picture: &str) -> Option<(i64, u32, u32)> {
-    let pic: Vec<char> = picture.chars().collect();
-    let txt: Vec<char> = text.trim().chars().collect();
-    let (mut y, mut m, mut d) = (None, None, None);
-    let (mut i, mut j) = (0, 0);
-    while i < pic.len() {
-        let c = pic[i].to_ascii_uppercase();
-        if c == 'Y' || c == 'M' || c == 'D' {
-            let mut run = 1;
-            while i + run < pic.len() && pic[i + run].to_ascii_uppercase() == c {
-                run += 1;
-            }
-            i += run;
-            if c == 'M' && run >= 3 {
-                // Month name.
-                let rest: String = txt.get(j..).unwrap_or(&[]).iter().collect();
-                let lower = rest.to_ascii_lowercase();
-                let found = MONTHS
-                    .iter()
-                    .position(|name| lower.starts_with(&name.to_ascii_lowercase()) || lower.starts_with(&name[..3].to_ascii_lowercase()));
-                let k = found?;
-                m = Some(k as u32 + 1);
-                let full = MONTHS[k].to_ascii_lowercase();
-                j += if lower.starts_with(&full) { full.chars().count() } else { 3 };
-                continue;
-            }
-            let width = if run == 1 { 2 } else { run };
-            let mut digits = String::new();
-            while j < txt.len() && txt[j].is_ascii_digit() && digits.len() < width {
-                digits.push(txt[j]);
-                j += 1;
-            }
-            if digits.is_empty() {
-                return None;
-            }
-            let v: i64 = digits.parse().ok()?;
-            match c {
-                'Y' => y = Some(if run <= 2 { if v < 50 { 2000 + v } else { 1900 + v } } else { v }),
-                'M' => m = Some(v as u32),
-                _ => d = Some(v as u32),
-            }
-        } else {
-            if txt.get(j) != Some(&pic[i]) {
-                return None;
-            }
-            i += 1;
-            j += 1;
-        }
-    }
-    let (y, m, d) = (y?, m.unwrap_or(1), d.unwrap_or(1));
-    ((-200_000..=200_000).contains(&y) && (1..=12).contains(&m) && (1..=days_in(y, m)).contains(&d)).then_some((y, m, d))
-}
-
-/// Number of days in month `m` (1-12) of year `y`, leap years included.
-pub(crate) fn days_in(y: i64, m: u32) -> u32 {
-    // The length of the month from chrono (the first of the next month, less the first of this
-    // one). An invalid month keeps the old 31-day default.
-    // Month lengths repeat every 400 years, so the year within its cycle is enough (and always
-    // in chrono's range, whatever `y` is).
-    let y = y.rem_euclid(400);
-    let first = |y: i64, m: u32| i32::try_from(y).ok().and_then(|y| chrono::NaiveDate::from_ymd_opt(y, m, 1));
-    let next = if m == 12 { first(y + 1, 1) } else { first(y, m + 1) };
-    match (first(y, m), next) {
-        (Some(a), Some(b)) => (b - a).num_days() as u32,
-        _ => 31,
-    }
-}
-
-const WEEKDAYS: [&str; 7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
-
-fn format_date(y: i64, m: u32, d: u32, picture: &str) -> String {
-    let pic: Vec<char> = picture.chars().collect();
-    let mut out = String::new();
-    let mut i = 0;
-    while i < pic.len() {
-        let c = pic[i].to_ascii_uppercase();
-        if c == 'Y' || c == 'M' || c == 'D' {
-            let mut run = 1;
-            while i + run < pic.len() && pic[i + run].to_ascii_uppercase() == c {
-                run += 1;
-            }
-            i += run;
-            match (c, run) {
-                ('Y', 1 | 2) => out.push_str(&format!("{:02}", y.rem_euclid(100))),
-                ('Y', _) => out.push_str(&format!("{y:04}")),
-                ('M', 1) => out.push_str(&m.to_string()),
-                ('M', 2) => out.push_str(&format!("{m:02}")),
-                ('M', 3) => out.push_str(MONTHS.get((m as usize).saturating_sub(1)).map_or("", |n| &n[..3])),
-                ('M', _) => out.push_str(MONTHS.get((m as usize).saturating_sub(1)).copied().unwrap_or("")),
-                ('D', 1) => out.push_str(&d.to_string()),
-                (_, _) => out.push_str(&format!("{d:02}")),
-            }
-        } else if pic[i] == 'E' {
-            let mut run = 1;
-            while i + run < pic.len() && pic[i + run] == 'E' {
-                run += 1;
-            }
-            i += run;
-            // Day 1 (1900-01-01) was a Monday, so the serial modulo 7 indexes from Sunday.
-            let weekday = days_from_civil(y, m, d).rem_euclid(7) as usize;
-            match run {
-                1 | 2 => out.push_str(&(weekday + 1).to_string()),
-                3 => out.push_str(WEEKDAYS.get(weekday).map_or("", |n| &n[..3])),
-                _ => out.push_str(WEEKDAYS.get(weekday).copied().unwrap_or("")),
-            }
-        } else {
-            out.push(pic[i]);
-            i += 1;
-        }
-    }
-    out
-}
-
-const ONES: [&str; 20] = [
-    "Zero",
-    "One",
-    "Two",
-    "Three",
-    "Four",
-    "Five",
-    "Six",
-    "Seven",
-    "Eight",
-    "Nine",
-    "Ten",
-    "Eleven",
-    "Twelve",
-    "Thirteen",
-    "Fourteen",
-    "Fifteen",
-    "Sixteen",
-    "Seventeen",
-    "Eighteen",
-    "Nineteen",
-];
-const TENS: [&str; 10] = ["", "", "Twenty", "Thirty", "Forty", "Fifty", "Sixty", "Seventy", "Eighty", "Ninety"];
-
-fn words_below_1000(n: u64) -> String {
-    let mut parts = Vec::new();
-    if n >= 100 {
-        parts.push(format!("{} Hundred", ONES[(n / 100) as usize]));
-    }
-    let r = n % 100;
-    if r >= 20 {
-        parts.push(if r.is_multiple_of(10) {
-            TENS[(r / 10) as usize].to_string()
-        } else {
-            format!("{}-{}", TENS[(r / 10) as usize], ONES[(r % 10) as usize])
-        });
-    } else if r > 0 || n == 0 {
-        parts.push(ONES[r as usize].to_string());
-    }
-    parts.join(" ")
-}
-
-/// `WordNum`: an integer in English words (up to the billions).
-fn word_num(n: f64, cents: bool) -> String {
-    if !n.is_finite() || !(0.0..1e12).contains(&n) {
-        return String::new();
-    }
-    let cents_total = (n * 100.0).round() as u64;
-    let whole = if cents { cents_total / 100 } else { n.trunc() as u64 };
-    if whole >= 1_000_000_000_000 {
-        // Rounding to cents carried past the supported range.
-        return String::new();
-    }
-    let mut parts = Vec::new();
-    let groups = [(1_000_000_000u64, "Billion"), (1_000_000, "Million"), (1_000, "Thousand")];
-    let mut rest = whole;
-    for (unit, name) in groups {
-        if rest >= unit {
-            parts.push(format!("{} {name}", words_below_1000(rest / unit)));
-            rest %= unit;
-        }
-    }
-    if rest > 0 || parts.is_empty() {
-        parts.push(words_below_1000(rest));
-    }
-    let mut out = parts.join(" ");
-    if cents {
-        let c = cents_total % 100;
-        let dollars = if whole == 1 { "Dollar" } else { "Dollars" };
-        let cent = if c == 1 { "Cent" } else { "Cents" };
-        out.push_str(&format!(" {dollars} And {c:02} {cent}"));
-    }
-    out
-}
-
-impl Interp<'_> {
-    /// A built-in function: its result is never a string past [`MAX_STRING`], and work on
-    /// long strings is charged to the step budget.
-    fn builtin(&mut self, name: &str, args: &[Expr]) -> R<Val> {
-        let v = self.builtin_inner(name, args)?;
-        if let Val::Str(s) = &v {
-            if s.len() > MAX_STRING {
-                return Err(STRING_TOO_LONG.into());
-            }
-            self.charge((s.len() / 256) as u64)?;
-        }
-        Ok(v)
-    }
-
-    fn builtin_inner(&mut self, name: &str, args: &[Expr]) -> R<Val> {
-        let lower = name.to_ascii_lowercase();
-        let n = |v: f64| Ok(Val::Num(v));
-        Ok(match lower.as_str() {
-            // ── arithmetic
-            "abs" => return n(self.arg_num(args, 0)?.abs()),
-            "ceil" => return n(self.arg_num(args, 0)?.ceil()),
-            "floor" => return n(self.arg_num(args, 0)?.floor()),
-            "mod" => {
-                let (a, b) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?);
-                if b == 0.0 {
-                    return Err("division by zero".into());
-                }
-                Val::Num(a - b * (a / b).trunc())
-            }
-            "round" => {
-                let a = self.arg_num(args, 0)?;
-                let places = if args.len() > 1 { self.arg_num(args, 1)?.clamp(0.0, 12.0) as i32 } else { 0 };
-                let k = 10f64.powi(places);
-                Val::Num((a * k).round() / k)
-            }
-            "count" => {
-                // Non-null values and objects: an empty field doesn't count, a subform does.
-                let vals = self.arg_values_keeping(args, true)?;
-                let counts = |v: &Val| match v {
-                    Val::Node(i) => self.node(*i).is_some_and(|n| !matches!(n.kind, XfaKind::Field | XfaKind::ExclGroup) || !n.value.is_empty()),
-                    other => !self.is_null(other),
-                };
-                Val::Num(vals.iter().filter(|v| counts(v)).count() as f64)
-            }
-            "sum" | "avg" | "max" | "min" => {
-                let vals = self.arg_values(args)?;
-                let nums: Vec<f64> = vals.iter().map(|v| self.to_num(v)).collect();
-                match lower.as_str() {
-                    "sum" => Val::Num(nums.iter().sum()),
-                    "avg" => {
-                        if nums.is_empty() {
-                            Val::Null
-                        } else {
-                            Val::Num(nums.iter().sum::<f64>() / nums.len() as f64)
-                        }
-                    }
-                    "max" => nums.iter().copied().fold(None, |m: Option<f64>, x| Some(m.map_or(x, |m| m.max(x)))).map_or(Val::Null, Val::Num),
-                    _ => nums.iter().copied().fold(None, |m: Option<f64>, x| Some(m.map_or(x, |m| m.min(x)))).map_or(Val::Null, Val::Num),
-                }
-            }
-            // ── logical
-            "choose" => {
-                let i = self.arg_num(args, 0)?;
-                if !i.is_finite() || i < 1.0 {
-                    return Ok(Val::Null);
-                }
-                self.arg(args, i as usize)?
-            }
-            "exists" => {
-                let Some(e) = args.first() else { return Ok(Val::Num(0.0)) };
-                // A name that resolves to nothing is the answer "no"; a limit the lookup ran
-                // into (time, steps, depth, size) still stops the script.
-                match self.all_of(e) {
-                    Ok(v) => Val::Num(if v.is_empty() { 0.0 } else { 1.0 }),
-                    Err(e) if is_limit(&e) => return Err(e),
-                    Err(_) => Val::Num(0.0),
-                }
-            }
-            "hasvalue" => {
-                let v = self.arg(args, 0)?;
-                Val::Num(if self.is_null(&v) || matches!(&v, Val::Str(s) if s.trim().is_empty()) { 0.0 } else { 1.0 })
-            }
-            "oneof" => {
-                let v = self.arg(args, 0)?;
-                let rest = self.arg_values(args.get(1..).unwrap_or_default())?;
-                let mut hit = false;
-                for x in &rest {
-                    // Each comparison copies and compares `v`: charged per item.
-                    self.charge(self.cost(&v).saturating_add(self.cost(x)).saturating_add(1))?;
-                    if self.binary("==", v.clone(), x.clone()).is_ok_and(|r| self.truthy(&r)) {
-                        hit = true;
-                        break;
-                    }
-                }
-                Val::Num(if hit { 1.0 } else { 0.0 })
-            }
-            "within" => {
-                let v = self.arg(args, 0)?;
-                let (lo, hi) = (self.arg(args, 1)?, self.arg(args, 2)?);
-                let ok = self.binary(">=", v.clone(), lo).is_ok_and(|r| self.truthy(&r)) && self.binary("<=", v, hi).is_ok_and(|r| self.truthy(&r));
-                Val::Num(if ok { 1.0 } else { 0.0 })
-            }
-            // ── strings
-            "at" => {
-                let (s, sub) = (self.arg_str(args, 0)?, self.arg_str(args, 1)?);
-                Val::Num(if sub.is_empty() { 0.0 } else { s.find(&sub).map_or(0.0, |b| s[..b].chars().count() as f64 + 1.0) })
-            }
-            "concat" => {
-                let mut out = String::new();
-                for i in 0..args.len() {
-                    out.push_str(&self.arg_str(args, i)?);
-                    if out.len() > MAX_STRING {
-                        return Err(STRING_TOO_LONG.into());
-                    }
-                }
-                Val::Str(out)
-            }
-            "left" => {
-                let (s, k) = (self.arg_str(args, 0)?, self.arg_num(args, 1)?.max(0.0) as usize);
-                Val::Str(s.chars().take(k).collect())
-            }
-            "right" => {
-                let (s, k) = (self.arg_str(args, 0)?, self.arg_num(args, 1)?.max(0.0) as usize);
-                let len = s.chars().count();
-                Val::Str(s.chars().skip(len.saturating_sub(k)).collect())
-            }
-            "len" => Val::Num(self.arg_str(args, 0)?.chars().count() as f64),
-            "lower" => Val::Str(self.arg_str(args, 0)?.to_lowercase()),
-            "upper" => Val::Str(self.arg_str(args, 0)?.to_uppercase()),
-            "ltrim" => Val::Str(self.arg_str(args, 0)?.trim_start().to_string()),
-            "rtrim" => Val::Str(self.arg_str(args, 0)?.trim_end().to_string()),
-            "space" => {
-                let k = self.arg_num(args, 0)?.clamp(0.0, MAX_STRING as f64) as usize;
-                Val::Str(" ".repeat(k))
-            }
-            "str" => {
-                let v = self.arg_num(args, 0)?;
-                let width = if args.len() > 1 { self.arg_num(args, 1)?.clamp(0.0, 1000.0) as usize } else { 10 };
-                let prec = if args.len() > 2 { self.arg_num(args, 2)?.clamp(0.0, 20.0) as usize } else { 0 };
-                let text = fixed(v, prec);
-                Val::Str(if text.len() > width { "*".repeat(width) } else { format!("{text:>width$}") })
-            }
-            "substr" => {
-                let s = self.arg_str(args, 0)?;
-                let start = self.arg_num(args, 1)?.max(1.0) as usize;
-                let len = self.arg_num(args, 2)?.max(0.0) as usize;
-                Val::Str(s.chars().skip(start - 1).take(len).collect())
-            }
-            "stuff" => {
-                let s = self.arg_str(args, 0)?;
-                let start = self.arg_num(args, 1)?.max(1.0) as usize;
-                let del = self.arg_num(args, 2)?.max(0.0) as usize;
-                let ins = if args.len() > 3 { self.arg_str(args, 3)? } else { String::new() };
-                let chars: Vec<char> = s.chars().collect();
-                let a = start.saturating_sub(1).min(chars.len());
-                let b = a.saturating_add(del).min(chars.len());
-                let out: String = chars[..a].iter().chain(ins.chars().collect::<Vec<_>>().iter()).chain(chars[b..].iter()).collect();
-                if out.len() > MAX_STRING {
-                    return Err(STRING_TOO_LONG.into());
-                }
-                Val::Str(out)
-            }
-            "replace" => {
-                let (s, old) = (self.arg_str(args, 0)?, self.arg_str(args, 1)?);
-                let new = if args.len() > 2 { self.arg_str(args, 2)? } else { String::new() };
-                if old.is_empty() {
-                    return Ok(Val::Str(s));
-                }
-                let grown = s.matches(old.as_str()).count().saturating_mul(new.len()).saturating_add(s.len());
-                if grown > MAX_STRING {
-                    return Err(STRING_TOO_LONG.into());
-                }
-                Val::Str(s.replace(&old, &new))
-            }
-            "wordnum" => {
-                let v = self.arg_num(args, 0)?;
-                let kind = if args.len() > 1 { self.arg_num(args, 1)? } else { 0.0 };
-                Val::Str(word_num(v, kind == 2.0))
-            }
-            "uuid" => Val::Str(format!("{:032x}", (self.steps as u128).wrapping_mul(0x9E37_79B9_7F4A_7C15_F39C_C060_5CED_C835))),
-            "encode" | "decode" => {
-                let s = self.arg_str(args, 0)?;
-                let kind = if args.len() > 1 { self.arg_str(args, 1)?.to_ascii_lowercase() } else { "url".into() };
-                Val::Str(match (lower.as_str(), kind.as_str()) {
-                    ("encode", "html" | "xml") => s.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;"),
-                    ("decode", "html" | "xml") => s.replace("&lt;", "<").replace("&gt;", ">").replace("&quot;", "\"").replace("&amp;", "&"),
-                    ("encode", _) => s
-                        .bytes()
-                        .map(|b| if b.is_ascii_alphanumeric() || b"-_.~".contains(&b) { (b as char).to_string() } else { format!("%{b:02X}") })
-                        .collect(),
-                    (_, _) => {
-                        let mut out = Vec::new();
-                        let b = s.as_bytes();
-                        let mut i = 0;
-                        while i < b.len() {
-                            if b[i] == b'%'
-                                && let Some(h) =
-                                    b.get(i + 1..i + 3).and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok())
-                            {
-                                out.push(h);
-                                i += 3;
-                            } else {
-                                out.push(b[i]);
-                                i += 1;
-                            }
-                        }
-                        String::from_utf8_lossy(&out).into_owned()
-                    }
-                })
-            }
-            "format" => {
-                // Number pictures: `9` digit, `z` optional digit, `,` separator, `.` point, `$`.
-                let pic = self.arg_str(args, 0)?;
-                let v = self.arg(args, 1)?;
-                if pic.to_ascii_uppercase().contains("YY") || pic.to_ascii_uppercase().contains("DD") {
-                    let text = self.to_str(&v);
-                    let days = parse_num(&text).filter(|d| is_numeric_text(&text) && d.abs() < MAX_DAYS).map(|d| d as i64);
-                    return Ok(match days {
-                        Some(d) => {
-                            let (y, m, dd) = civil_from_days(d);
-                            Val::Str(format_date(y, m, dd, &pic))
-                        }
-                        None => parse_date(&text, "YYYY-MM-DD").map_or(Val::Str(text), |(y, m, d)| Val::Str(format_date(y, m, d, &pic))),
-                    });
-                }
-                let num = self.to_num(&v);
-                let decimals = pic.split_once('.').map_or(0, |(_, f)| f.chars().filter(|c| matches!(c, '9' | 'z' | 'Z')).count()).min(20);
-                // `9` in the integer part forces a digit; `z` does not.
-                let min_int = pic.split('.').next().map_or(0, |i| i.chars().filter(|c| *c == '9').count()).min(20);
-                let width = min_int + if decimals > 0 { decimals + 1 } else { 0 };
-                let grouped = pic.contains(',');
-                let mut text = format!("{:0>width$}", fixed(num.abs(), decimals));
-                if grouped {
-                    let (int, frac) = text.split_once('.').map_or((text.as_str(), ""), |(a, b)| (a, b));
-                    let mut g = String::new();
-                    for (k, c) in int.chars().enumerate() {
-                        if k > 0 && (int.len() - k) % 3 == 0 {
-                            g.push(',');
-                        }
-                        g.push(c);
-                    }
-                    text = if frac.is_empty() { g } else { format!("{g}.{frac}") };
-                }
-                let nonzero = text.chars().any(|c| ('1'..='9').contains(&c));
-                if pic.contains('$') {
-                    text = format!("${text}");
-                }
-                if num < 0.0 && nonzero {
-                    text = format!("-{text}");
-                }
-                Val::Str(text)
-            }
-            "parse" => {
-                let pic = self.arg_str(args, 0)?;
-                let s = self.arg_str(args, 1)?;
-                if pic.to_ascii_uppercase().contains("YY") {
-                    // The canonical form of a date is ISO.
-                    return Ok(parse_date(&s, &pic).map_or(Val::Null, |(y, m, d)| Val::Str(format_date(y, m, d, "YYYY-MM-DD"))));
-                }
-                let cleaned: String = s.chars().filter(|c| c.is_ascii_digit() || *c == '.' || *c == '-').collect();
-                parse_num(&cleaned).map_or(Val::Null, Val::Num)
-            }
-            // ── dates and times (days since 1900-01-01 = 1; milliseconds since midnight)
-            "date" => {
-                #[cfg(not(target_arch = "wasm32"))]
-                {
-                    let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs() as i64).unwrap_or(0);
-                    Val::Num((secs.div_euclid(86_400) + 25_568) as f64)
-                }
-                #[cfg(target_arch = "wasm32")]
-                {
-                    Val::Num(25_568.0)
-                }
-            }
-            "time" => {
-                #[cfg(not(target_arch = "wasm32"))]
-                {
-                    let ms = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_millis() as i64).unwrap_or(0);
-                    Val::Num(ms.rem_euclid(86_400_000) as f64)
-                }
-                #[cfg(target_arch = "wasm32")]
-                {
-                    Val::Num(0.0)
-                }
-            }
-            "date2num" | "isodate2num" => {
-                let s = self.arg_str(args, 0)?;
-                let pic = if lower == "isodate2num" || args.len() < 2 { "YYYY-MM-DD".to_string() } else { self.arg_str(args, 1)? };
-                let parsed = parse_date(&s, &pic).or_else(|| parse_date(&s, "YYYYMMDD")).or_else(|| parse_date(&s, "YYYY-MM-DD"));
-                parsed.map_or(Val::Num(0.0), |(y, m, d)| Val::Num(days_from_civil(y, m, d) as f64))
-            }
-            "num2date" => {
-                let days = self.arg_num(args, 0)?;
-                let pic = if args.len() > 1 { self.arg_str(args, 1)? } else { "MMM D, YYYY".into() };
-                if !days.is_finite() || days.abs() >= MAX_DAYS {
-                    return Ok(Val::Null);
-                }
-                let (y, m, d) = civil_from_days(days as i64);
-                Val::Str(format_date(y, m, d, &pic))
-            }
-            "datefmt" | "localdatefmt" => {
-                let style = if args.is_empty() { 0.0 } else { self.arg_num(args, 0)? };
-                Val::Str(
-                    match style as i32 {
-                        1 => "M/D/YY",
-                        2 => "MMM D, YYYY",
-                        3 => "MMMM D, YYYY",
-                        4 => "EEEE, MMMM D, YYYY",
-                        _ => "MMM D, YYYY",
-                    }
-                    .into(),
-                )
-            }
-            "timefmt" | "localtimefmt" => Val::Str("HH:MM:SS".into()),
-            "num2time" | "num2gmtime" => {
-                let ms = self.arg_num(args, 0)?;
-                if !ms.is_finite() || ms < 0.0 {
-                    return Ok(Val::Null);
-                }
-                let s = (ms / 1000.0) as u64;
-                Val::Str(format!("{:02}:{:02}:{:02}", (s / 3600) % 24, (s / 60) % 60, s % 60))
-            }
-            "time2num" | "isotime2num" => {
-                let s = self.arg_str(args, 0)?;
-                // ISO 8601 allows a leading "T", a trailing "Z" and fractional seconds.
-                let t = s.trim();
-                let t = t.strip_prefix(['T', 't']).unwrap_or(t);
-                let t = t.strip_suffix(['Z', 'z']).unwrap_or(t);
-                let mut parts = t.split(':');
-                let mut whole = || parts.next().and_then(|p| p.trim().parse::<u64>().ok()).unwrap_or(0).min(1_000_000);
-                let (h, m) = (whole(), whole());
-                let sec =
-                    parts.next().and_then(|p| p.trim().parse::<f64>().ok()).filter(|v| v.is_finite() && *v >= 0.0).unwrap_or(0.0).min(1_000_000.0);
-                Val::Num(((h * 3600 + m * 60) * 1000) as f64 + (sec * 1000.0).round())
-            }
-            // ── financial
-            "fv" => {
-                let (p, r, k) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
-                Val::Num(if r == 0.0 { p * k } else { p * (((1.0 + r).powf(k) - 1.0) / r) })
-            }
-            "pv" => {
-                let (p, r, k) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
-                Val::Num(if r == 0.0 { p * k } else { p * ((1.0 - (1.0 + r).powf(-k)) / r) })
-            }
-            "pmt" => {
-                let (pv, r, k) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
-                if k <= 0.0 {
-                    return Err("Pmt needs a positive number of periods".into());
-                }
-                Val::Num(if r == 0.0 { pv / k } else { pv * r / (1.0 - (1.0 + r).powf(-k)) })
-            }
-            "term" => {
-                let (p, r, fv) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
-                if p <= 0.0 || r <= 0.0 || fv <= 0.0 {
-                    return Err("Term needs positive arguments".into());
-                }
-                Val::Num(((fv * r / p) + 1.0).ln() / (1.0 + r).ln())
-            }
-            "cterm" => {
-                let (r, fv, pv) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
-                if r <= 0.0 || fv <= 0.0 || pv <= 0.0 {
-                    return Err("CTerm needs positive arguments".into());
-                }
-                Val::Num((fv / pv).ln() / (1.0 + r).ln())
-            }
-            "rate" => {
-                let (fv, pv, k) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
-                if fv <= 0.0 || pv <= 0.0 || k <= 0.0 {
-                    return Err("Rate needs positive arguments".into());
-                }
-                Val::Num((fv / pv).powf(1.0 / k) - 1.0)
-            }
-            "npv" => {
-                let r = self.arg_num(args, 0)?;
-                let flows = self.arg_values(args.get(1..).unwrap_or_default())?;
-                Val::Num(flows.iter().enumerate().map(|(i, v)| self.to_num(v) / (1.0 + r).powi(i as i32 + 1)).sum())
-            }
-            "ipmt" | "ppmt" => {
-                let (pv, r, pmt, first, count) = (
-                    self.arg_num(args, 0)?,
-                    self.arg_num(args, 1)?,
-                    self.arg_num(args, 2)?,
-                    self.arg_num(args, 3)?.max(1.0),
-                    self.arg_num(args, 4)?.max(1.0),
-                );
-                let (mut balance, mut interest, mut principal) = (pv, 0.0, 0.0);
-                for period in 1..=((first + count - 1.0).min(10_000.0) as u32) {
-                    self.step()?;
-                    let i = balance * r;
-                    let p = (pmt - i).min(balance);
-                    if period >= first as u32 {
-                        interest += i;
-                        principal += p;
-                    }
-                    balance -= p;
-                    if balance <= 0.0 {
-                        break;
-                    }
-                }
-                Val::Num(if lower == "ipmt" { interest } else { principal })
-            }
-            "apr" => {
-                let (principal, payment, periods) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
-                if principal <= 0.0 || payment <= 0.0 || periods <= 0.0 {
-                    return Err("Apr needs positive arguments".into());
-                }
-                // Bisection on the monthly rate.
-                let (mut lo, mut hi) = (0.0f64, 1.0f64);
-                for _ in 0..200 {
-                    let mid = (lo + hi) / 2.0;
-                    let pmt = if mid == 0.0 { principal / periods } else { principal * mid / (1.0 - (1.0 + mid).powf(-periods)) };
-                    if pmt > payment {
-                        hi = mid;
-                    } else {
-                        lo = mid;
-                    }
-                }
-                Val::Num((lo + hi) / 2.0 * 12.0)
-            }
-            // ── units and references
-            "unittype" => {
-                let s = self.arg_str(args, 0)?;
-                let unit: String = s.trim().chars().skip_while(|c| c.is_ascii_digit() || *c == '.' || *c == '-' || *c == '+').collect();
-                Val::Str(
-                    match unit.trim().to_ascii_lowercase().as_str() {
-                        "in" | "inch" | "inches" => "in",
-                        "mm" | "millimeter" | "millimeters" => "mm",
-                        "cm" | "centimeter" | "centimeters" => "cm",
-                        "pt" | "point" | "points" => "pt",
-                        "pc" | "pica" => "pc",
-                        _ => "in",
-                    }
-                    .into(),
-                )
-            }
-            "unitvalue" => {
-                let s = self.arg_str(args, 0)?;
-                let to = if args.len() > 1 { self.arg_str(args, 1)? } else { String::new() };
-                let v = parse_num(&s).unwrap_or(0.0);
-                let unit: String = s.trim().chars().skip_while(|c| c.is_ascii_digit() || *c == '.' || *c == '-' || *c == '+').collect();
-                let per_in = |u: &str| match u.trim().to_ascii_lowercase().as_str() {
-                    "mm" | "millimeter" | "millimeters" => 25.4,
-                    "cm" | "centimeter" | "centimeters" => 2.54,
-                    "pt" | "point" | "points" => 72.0,
-                    "pc" | "pica" => 6.0,
-                    _ => 1.0,
-                };
-                let target = if to.trim().is_empty() { unit.clone() } else { to };
-                Val::Num(v / per_in(&unit) * per_in(&target))
-            }
-            "ref" => {
-                let Some(e) = args.first() else { return Ok(Val::Null) };
-                self.eval(e)?
-            }
-            "eval" => {
-                let src = self.arg_str(args, 0)?;
-                self.charge((src.len() / 16) as u64)?;
-                let body = parse(&src)?;
-                let (_, v) = self.block(&body)?;
-                v
-            }
-            "get" | "post" | "put" => return Err(format!("{name}: network access is not available to form scripts")),
-            _ => return Err(format!("unknown function {name}")),
-        })
-    }
-}
-
 // ── entry points ────────────────────────────────────────────────────────────────────────────
 
 /// Run a FormCalc `script` for `event` on the form `root`, as [`crate::xfa::run_xfa`] runs a
diff --git a/crates/js/src/formcalc/access.rs b/crates/js/src/formcalc/access.rs
new file mode 100644
index 0000000000..3911a5223f
--- /dev/null
+++ b/crates/js/src/formcalc/access.rs
@@ -0,0 +1,431 @@
+use super::ast::{Expr, Idx};
+use super::value::{Val, num_text, parse_num};
+use super::*;
+
+impl Interp<'_> {
+    pub(super) fn step(&mut self) -> R<()> {
+        self.charge(1)
+    }
+
+    /// `n` units of work done (a step per statement or expression, more for work on long
+    /// strings and lists).
+    pub(super) fn charge(&mut self, n: u64) -> R<()> {
+        let before = self.steps;
+        self.steps = self.steps.saturating_add(n);
+        if self.steps > MAX_STEPS {
+            return Err(RAN_TOO_LONG.into());
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.steps / CLOCK_EVERY != before / CLOCK_EVERY
+            && let Some(d) = self.deadline
+            && std::time::Instant::now() > d
+        {
+            return Err(RAN_TOO_LONG.into());
+        }
+        #[cfg(target_arch = "wasm32")]
+        let _ = before;
+        Ok(())
+    }
+
+    /// `more` nodes into `out`, each once, never past [`MAX_LIST`].
+    pub(super) fn gather(&mut self, out: &mut Vec<usize>, seen: &mut HashSet<usize>, more: impl IntoIterator<Item = usize>) -> R<()> {
+        for i in more {
+            if seen.insert(i) {
+                out.push(i);
+                if out.len() > MAX_LIST {
+                    return Err(LIST_TOO_LONG.into());
+                }
+            }
+        }
+        self.charge(1)
+    }
+
+    /// The nodes of `v`, each once.
+    pub(super) fn nodes_list(&self, v: &Val) -> Vec<usize> {
+        let mut seen = HashSet::new();
+        self.nodes_of(v).into_iter().filter(|i| seen.insert(*i)).collect()
+    }
+
+    pub(super) fn node(&self, i: usize) -> Option<&HNode> {
+        self.h.nodes.get(i).filter(|n| !n.gone)
+    }
+
+    // ── coercions
+
+    /// A node's value as a FormCalc value.
+    fn node_value(&self, i: usize) -> Val {
+        let Some(n) = self.node(i) else { return Val::Null };
+        if n.value.is_empty() {
+            return Val::Null;
+        }
+        if n.numeric
+            && let Some(v) = parse_num(&n.value)
+        {
+            return Val::Num(v);
+        }
+        Val::Str(n.value.clone())
+    }
+
+    /// What copying `v` (or the values it stands for) costs, in steps: one per 256 bytes, so
+    /// copying long strings over and over runs out of steps even where there is no clock
+    /// (wasm). A form object counts its value; a list its items too.
+    pub(super) fn cost(&self, v: &Val) -> u64 {
+        let mut bytes = 0usize;
+        let mut todo = vec![v];
+        while let Some(v) = todo.pop() {
+            match v {
+                Val::Str(s) => bytes = bytes.saturating_add(s.len()),
+                Val::Node(i) => bytes = bytes.saturating_add(self.node(*i).map_or(0, |n| n.value.len())),
+                Val::List(items) => {
+                    bytes = bytes.saturating_add(items.len().saturating_mul(16));
+                    todo.extend(items.iter());
+                }
+                _ => {}
+            }
+        }
+        (bytes / 256) as u64
+    }
+
+    /// [`Self::deref`], charged for the copy.
+    pub(super) fn take(&mut self, v: Val) -> R<Val> {
+        self.charge(self.cost(&v))?;
+        Ok(self.deref(v))
+    }
+
+    /// Objects become their values; lists of objects become lists of values.
+    pub(super) fn deref(&self, v: Val) -> Val {
+        match v {
+            Val::Node(i) => self.node_value(i),
+            Val::List(items) => Val::List(items.into_iter().map(|x| self.deref(x)).collect()),
+            other => other,
+        }
+    }
+
+    pub(super) fn to_num(&self, v: &Val) -> f64 {
+        match v {
+            Val::Null => 0.0,
+            Val::Num(n) => *n,
+            Val::Str(s) => parse_num(s).unwrap_or(0.0),
+            Val::Node(i) => self.to_num(&self.node_value(*i)),
+            Val::List(items) => items.first().map_or(0.0, |x| self.to_num(x)),
+            _ => 0.0,
+        }
+    }
+
+    pub(super) fn to_str(&self, v: &Val) -> String {
+        match v {
+            Val::Null => String::new(),
+            Val::Num(n) => num_text(*n),
+            Val::Str(s) => s.clone(),
+            Val::Node(i) => self.to_str(&self.node_value(*i)),
+            Val::List(items) => items.first().map_or(String::new(), |x| self.to_str(x)),
+            Val::Host => "host".into(),
+            Val::Layout => "layout".into(),
+            Val::Event => "event".into(),
+            Val::Xfa => "xfa".into(),
+            Val::Im(..) => "instanceManager".into(),
+            Val::Sink => String::new(),
+        }
+    }
+
+    pub(super) fn truthy(&self, v: &Val) -> bool {
+        match v {
+            Val::Null => false,
+            Val::Num(n) => *n != 0.0 && !n.is_nan(),
+            Val::Str(s) => parse_num(s).is_some_and(|n| n != 0.0),
+            Val::Node(i) => {
+                let d = self.node_value(*i);
+                self.truthy(&d)
+            }
+            Val::List(items) => !items.is_empty(),
+            _ => true,
+        }
+    }
+
+    pub(super) fn is_null(&self, v: &Val) -> bool {
+        match v {
+            Val::Null => true,
+            Val::Node(i) => self.node(*i).is_none_or(|n| n.value.is_empty()),
+            Val::List(items) => items.is_empty(),
+            _ => false,
+        }
+    }
+
+    // ── scopes
+
+    fn lookup(&self, name: &str) -> Option<Val> {
+        self.scopes.iter().rev().find_map(|s| s.get(name).cloned())
+    }
+
+    pub(super) fn set_var(&mut self, name: &str, v: Val) -> bool {
+        for s in self.scopes.iter_mut().rev() {
+            if let Some(slot) = s.get_mut(name) {
+                *slot = v;
+                return true;
+            }
+        }
+        false
+    }
+
+    pub(super) fn declare(&mut self, name: &str, v: Val) {
+        if let Some(s) = self.scopes.last_mut() {
+            s.insert(name.to_string(), v);
+        }
+    }
+
+    // ── accessors
+
+    /// The objects an identifier names from the current node: `$`, the special objects, an
+    /// instance manager (`_name`), a variable, or a form object by name (children first, then
+    /// the containing subforms).
+    pub(super) fn ident(&self, name: &str) -> R<Val> {
+        if let Some(v) = self.lookup(name) {
+            return Ok(v);
+        }
+        let lower = name.to_ascii_lowercase();
+        Ok(match lower.as_str() {
+            "$" | "this" => Val::Node(self.h.current),
+            "$host" => Val::Host,
+            "$layout" => Val::Layout,
+            "$event" => Val::Event,
+            "$form" | "$data" | "$dataset" | "$datasets" => Val::Node(0),
+            "$record" => Val::Node(if self.node(1).is_some() { 1 } else { 0 }),
+            "$template" | "$xfa" => Val::Xfa,
+            "xfa" => Val::Xfa,
+            _ => {
+                if let Some(child) = name.strip_prefix('_') {
+                    // The instance manager of `child`, looked for like a name.
+                    let found = resolve_som(self.h, self.h.current, child);
+                    let Some(&first) = found.first() else { return Err(format!("unknown instance manager _{child}")) };
+                    let parent = self.node(first).and_then(|n| n.parent).ok_or_else(|| format!("unknown instance manager _{child}"))?;
+                    return Ok(Val::Im(parent, child.to_string()));
+                }
+                let found = resolve_som(self.h, self.h.current, name);
+                match found.as_slice() {
+                    [] => return Err(format!("unknown name {name}")),
+                    [one] => Val::Node(*one),
+                    many => Val::List(many.iter().map(|i| Val::Node(*i)).collect()),
+                }
+            }
+        })
+    }
+
+    /// Every object a value stands for.
+    pub(super) fn nodes_of(&self, v: &Val) -> Vec<usize> {
+        match v {
+            Val::Node(i) => vec![*i],
+            Val::List(items) => items.iter().flat_map(|x| self.nodes_of(x)).collect(),
+            _ => Vec::new(),
+        }
+    }
+
+    pub(super) fn member(&mut self, base: Val, name: &str) -> R<Val> {
+        match base {
+            Val::Node(i) => self.node_member(i, name),
+            Val::List(items) => {
+                let mut out = Vec::new();
+                let mut seen = HashSet::new();
+                for it in items {
+                    match self.member(it, name)? {
+                        Val::List(more) => {
+                            for m in more {
+                                self.list_push(&mut out, &mut seen, m)?;
+                            }
+                        }
+                        Val::Null => {}
+                        v => self.list_push(&mut out, &mut seen, v)?,
+                    }
+                }
+                Ok(match out.len() {
+                    0 => Val::Null,
+                    1 => out.remove(0),
+                    _ => Val::List(out),
+                })
+            }
+            Val::Host => Ok(match name.to_ascii_lowercase().as_str() {
+                "numpages" => Val::Num(self.h.doc.page_count as f64),
+                "currentpage" => Val::Num(self.h.doc.page as f64),
+                "name" => Val::Str("Acrobat".into()),
+                "apptype" => Val::Str("Exchange-Pro".into()),
+                "version" => Val::Str("11".into()),
+                "variation" => Val::Str("Full".into()),
+                "language" => Val::Str("en".into()),
+                "platform" => Val::Str(crate::platform().into()),
+                "title" => Val::Str(self.h.doc.file_name.clone()),
+                "calculationsenabled" | "validationsenabled" => Val::Num(1.0),
+                _ => Val::Sink,
+            }),
+            Val::Layout => Ok(Val::Sink),
+            Val::Event => Ok(match name.to_ascii_lowercase().as_str() {
+                "name" => Val::Str(self.event.activity.clone()),
+                "newtext" | "fulltext" => Val::Str(self.event.new_text.clone()),
+                "prevtext" => Val::Str(self.event.prev_text.clone()),
+                "change" => Val::Str(String::new()),
+                "target" => Val::Node(self.h.current),
+                "selstart" | "selend" | "cancelaction" | "reenter" | "shift" | "modifier" | "keydown" | "commitkey" => Val::Num(0.0),
+                _ => Val::Sink,
+            }),
+            Val::Xfa => Ok(match name.to_ascii_lowercase().as_str() {
+                "form" | "datasets" | "data" => Val::Node(0),
+                "record" => Val::Node(if self.node(1).is_some() { 1 } else { 0 }),
+                "host" => Val::Host,
+                "layout" => Val::Layout,
+                "event" => Val::Event,
+                _ => Val::Sink,
+            }),
+            Val::Im(parent, child) => Ok(match name.to_ascii_lowercase().as_str() {
+                "count" => Val::Num(instances(self.h, parent, &child).len() as f64),
+                "min" => Val::Num(instances(self.h, parent, &child).first().and_then(|i| self.node(*i)).map_or(0.0, |n| n.occur_min as f64)),
+                "max" => Val::Num(
+                    instances(self.h, parent, &child).first().and_then(|i| self.node(*i)).and_then(|n| n.occur_max).map_or(-1.0, |m| m as f64),
+                ),
+                "classname" => Val::Str("instanceManager".into()),
+                _ => Val::Sink,
+            }),
+            Val::Sink => Ok(Val::Sink),
+            Val::Null => Err(format!("no object to take {name} from")),
+            Val::Num(_) | Val::Str(_) => Err(format!("{} has no property {name}", self.to_str(&base))),
+        }
+    }
+
+    /// `v` onto `out`: a node only once, never past [`MAX_LIST`].
+    fn list_push(&mut self, out: &mut Vec<Val>, seen: &mut HashSet<usize>, v: Val) -> R<()> {
+        if let Val::Node(i) = v
+            && !seen.insert(i)
+        {
+            return Ok(());
+        }
+        out.push(v);
+        if out.len() > MAX_LIST {
+            return Err(LIST_TOO_LONG.into());
+        }
+        self.charge(1)
+    }
+
+    /// Property `name` of form object `i` as FormCalc reads it: its value, attributes,
+    /// relatives and children by name.
+    fn node_member(&mut self, i: usize, name: &str) -> R<Val> {
+        let Some(n) = self.node(i) else { return Ok(Val::Null) };
+        Ok(match name {
+            "formattedValue" => match &n.formatted {
+                Some(f) => Val::Str(f.clone()),
+                None => self.node_value(i),
+            },
+            "rawValue" | "value" => self.node_value(i),
+            "name" => Val::Str(n.name.clone()),
+            "somExpression" => Val::Str(n.som.clone()),
+            "className" => Val::Str(n.kind.class_name().into()),
+            "index" | "instanceIndex" => Val::Num(n.index as f64),
+            "presence" => Val::Str(n.presence.clone()),
+            "access" => Val::Str(n.access.clone()),
+            "isNull" => Val::Num(if n.value.is_empty() { 1.0 } else { 0.0 }),
+            "mandatory" => Val::Str("disabled".into()),
+            "parent" => n.parent.map_or(Val::Null, Val::Node),
+            "nodes" => Val::List(n.children.iter().copied().filter(|c| self.node(*c).is_some()).map(Val::Node).collect()),
+            "all" => match n.parent {
+                Some(p) => Val::List(instances(self.h, p, &n.name).into_iter().map(Val::Node).collect()),
+                None => Val::Node(i),
+            },
+            "instanceManager" => match n.parent {
+                Some(p) => Val::Im(p, n.name.clone()),
+                None => Val::Null,
+            },
+            "border" | "ui" | "font" | "caption" | "fillColor" | "borderColor" | "fontColor" | "margin" | "para" | "assist" | "validate"
+            | "format" | "items" | "bind" | "keep" | "h" | "w" | "x" | "y" | "minH" | "maxH" | "minW" | "maxW" | "layout" | "model"
+            | "oneOfChild" | "locale" | "relevant" | "colSpan" | "dataNode" | "defaultValue" | "editValue" | "selectedIndex" | "event"
+            | "calculate" | "traversal" | "extras" | "desc" => Val::Sink,
+            other => {
+                if let Some(child) = other.strip_prefix('_') {
+                    return Ok(if child_named(self.h, i, child).is_some() { Val::Im(i, child.to_string()) } else { Val::Null });
+                }
+                let found = instances(self.h, i, other);
+                match found.as_slice() {
+                    [] => Val::Null,
+                    [one] => Val::Node(*one),
+                    many => Val::List(many.iter().map(|k| Val::Node(*k)).collect()),
+                }
+            }
+        })
+    }
+
+    /// `base[n]` / `base[*]`: all the instances the last step named, then one or all.
+    pub(super) fn index(&mut self, base: &Expr, idx: &Idx) -> R<Val> {
+        let all = self.all_of(base)?;
+        match idx {
+            Idx::All => Ok(Val::List(all.into_iter().map(Val::Node).collect())),
+            Idx::Abs(e) => {
+                let v = self.eval(e)?;
+                let n = self.to_num(&v);
+                if !n.is_finite() || n < 0.0 {
+                    return Ok(Val::Null);
+                }
+                Ok(all.get(n as usize).map_or(Val::Null, |i| Val::Node(*i)))
+            }
+            Idx::Rel(k) => {
+                // From the instance the script runs in (`row[-1]` in a row is the row above),
+                // else from the first.
+                let here = all.iter().position(|&i| self.encloses(i, self.h.current)).unwrap_or(0);
+                let at = (here as i64).saturating_add(*k);
+                Ok(usize::try_from(at).ok().and_then(|at| all.get(at)).map_or(Val::Null, |i| Val::Node(*i)))
+            }
+        }
+    }
+
+    /// Whether `node` is `inner` or one of its containers.
+    fn encloses(&self, node: usize, inner: usize) -> bool {
+        let mut at = Some(inner);
+        let mut guard = 0;
+        while let Some(i) = at
+            && guard < MAX_PARSE_DEPTH
+        {
+            if i == node {
+                return true;
+            }
+            at = self.h.nodes.get(i).and_then(|n| n.parent);
+            guard += 1;
+        }
+        false
+    }
+
+    /// Every instance an accessor names (`Row` → all rows, not just the first), each once.
+    pub(super) fn all_of(&mut self, e: &Expr) -> R<Vec<usize>> {
+        let mut out = Vec::new();
+        let mut seen = HashSet::new();
+        match e {
+            Expr::Ident(name) => {
+                if self.lookup(name).is_some() || name.starts_with('$') || name.eq_ignore_ascii_case("xfa") {
+                    let v = self.eval(e)?;
+                    return Ok(self.nodes_list(&v));
+                }
+                // The name resolves to its first instance; `row[*]` means every sibling of it.
+                for first in resolve_som(self.h, self.h.current, name) {
+                    match self.node(first).and_then(|n| n.parent.map(|p| (p, n.name.clone()))) {
+                        Some((p, n)) => self.gather(&mut out, &mut seen, instances(self.h, p, &n))?,
+                        None => self.gather(&mut out, &mut seen, [first])?,
+                    }
+                }
+            }
+            Expr::Member(base, name) => {
+                let b = self.eval(base)?;
+                for i in self.nodes_list(&b) {
+                    self.gather(&mut out, &mut seen, instances(self.h, i, name))?;
+                }
+                if out.is_empty() {
+                    let v = self.member(b, name)?;
+                    out = self.nodes_list(&v);
+                }
+            }
+            Expr::Descend(base, name) => {
+                let b = self.eval(base)?;
+                for i in self.nodes_list(&b) {
+                    self.gather(&mut out, &mut seen, descendants_named(self.h, i, name, 0))?;
+                }
+            }
+            other => {
+                let v = self.eval(other)?;
+                out = self.nodes_list(&v);
+            }
+        }
+        Ok(out)
+    }
+}
diff --git a/crates/js/src/formcalc/ast.rs b/crates/js/src/formcalc/ast.rs
new file mode 100644
index 0000000000..f9a88be798
--- /dev/null
+++ b/crates/js/src/formcalc/ast.rs
@@ -0,0 +1,48 @@
+use super::*;
+
+// ── syntax ──────────────────────────────────────────────────────────────────────────────────
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Expr {
+    Num(f64),
+    Str(String),
+    Null,
+    Ident(String),
+    /// `base.name`
+    Member(Box<Expr>, String),
+    /// `base[n]`, `base[*]`, `base[-n]`
+    Index(Box<Expr>, Idx),
+    /// `base..name`
+    Descend(Box<Expr>, String),
+    Call(Box<Expr>, Vec<Expr>),
+    Neg(Box<Expr>),
+    Not(Box<Expr>),
+    Bin(&'static str, Box<Expr>, Box<Expr>),
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Idx {
+    /// `[*]`: every instance.
+    All,
+    /// `[n]`: the n-th instance (from 0).
+    Abs(Box<Expr>),
+    /// `[-n]` / `[+n]`: n instances before or after the one the script runs in.
+    Rel(i64),
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Stmt {
+    Var(String, Option<Expr>),
+    Assign(Expr, Expr),
+    Expr(Expr),
+    If(Vec<(Expr, Vec<Stmt>)>, Option<Vec<Stmt>>),
+    While(Expr, Vec<Stmt>),
+    For { var: String, from: Expr, to: Expr, up: bool, step: Option<Expr>, body: Vec<Stmt> },
+    Foreach { var: String, list: Vec<Expr>, body: Vec<Stmt> },
+    Func { name: String, f: Rc<Func> },
+    Return(Option<Expr>),
+    Break,
+    Continue,
+    Exit,
+    Throw(Expr),
+}
diff --git a/crates/js/src/formcalc/builtins.rs b/crates/js/src/formcalc/builtins.rs
new file mode 100644
index 0000000000..1e7bb94245
--- /dev/null
+++ b/crates/js/src/formcalc/builtins.rs
@@ -0,0 +1,477 @@
+use super::ast::Expr;
+use super::dates::{MAX_DAYS, civil_from_days, days_from_civil, format_date, parse_date};
+use super::parser::parse;
+use super::value::{Val, fixed, is_numeric_text, parse_num};
+use super::words::word_num;
+use super::*;
+
+impl Interp<'_> {
+    /// A built-in function: its result is never a string past [`MAX_STRING`], and work on
+    /// long strings is charged to the step budget.
+    pub(super) fn builtin(&mut self, name: &str, args: &[Expr]) -> R<Val> {
+        let v = self.builtin_inner(name, args)?;
+        if let Val::Str(s) = &v {
+            if s.len() > MAX_STRING {
+                return Err(STRING_TOO_LONG.into());
+            }
+            self.charge((s.len() / 256) as u64)?;
+        }
+        Ok(v)
+    }
+
+    fn builtin_inner(&mut self, name: &str, args: &[Expr]) -> R<Val> {
+        let lower = name.to_ascii_lowercase();
+        let n = |v: f64| Ok(Val::Num(v));
+        Ok(match lower.as_str() {
+            // ── arithmetic
+            "abs" => return n(self.arg_num(args, 0)?.abs()),
+            "ceil" => return n(self.arg_num(args, 0)?.ceil()),
+            "floor" => return n(self.arg_num(args, 0)?.floor()),
+            "mod" => {
+                let (a, b) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?);
+                if b == 0.0 {
+                    return Err("division by zero".into());
+                }
+                Val::Num(a - b * (a / b).trunc())
+            }
+            "round" => {
+                let a = self.arg_num(args, 0)?;
+                let places = if args.len() > 1 { self.arg_num(args, 1)?.clamp(0.0, 12.0) as i32 } else { 0 };
+                let k = 10f64.powi(places);
+                let scaled = a * k;
+                if scaled.is_finite() { Val::Num(scaled.round() / k) } else { Val::Num(a) }
+            }
+            "count" => {
+                // Non-null values and objects: an empty field doesn't count, a subform does.
+                let vals = self.arg_values_keeping(args, true)?;
+                let counts = |v: &Val| match v {
+                    Val::Node(i) => self.node(*i).is_some_and(|n| !matches!(n.kind, XfaKind::Field | XfaKind::ExclGroup) || !n.value.is_empty()),
+                    other => !self.is_null(other),
+                };
+                Val::Num(vals.iter().filter(|v| counts(v)).count() as f64)
+            }
+            "sum" | "avg" | "max" | "min" => {
+                let vals = self.arg_values(args)?;
+                let nums: Vec<f64> = vals.iter().map(|v| self.to_num(v)).collect();
+                match lower.as_str() {
+                    "sum" => Val::Num(nums.iter().sum()),
+                    "avg" => {
+                        if nums.is_empty() {
+                            Val::Null
+                        } else {
+                            Val::Num(nums.iter().sum::<f64>() / nums.len() as f64)
+                        }
+                    }
+                    "max" => nums.iter().copied().fold(None, |m: Option<f64>, x| Some(m.map_or(x, |m| m.max(x)))).map_or(Val::Null, Val::Num),
+                    _ => nums.iter().copied().fold(None, |m: Option<f64>, x| Some(m.map_or(x, |m| m.min(x)))).map_or(Val::Null, Val::Num),
+                }
+            }
+            // ── logical
+            "choose" => {
+                let i = self.arg_num(args, 0)?;
+                if !i.is_finite() || i < 1.0 {
+                    return Ok(Val::Null);
+                }
+                self.arg(args, i as usize)?
+            }
+            "exists" => {
+                let Some(e) = args.first() else { return Ok(Val::Num(0.0)) };
+                // A name that resolves to nothing is the answer "no"; a limit the lookup ran
+                // into (time, steps, depth, size) still stops the script.
+                match self.all_of(e) {
+                    Ok(v) => Val::Num(if v.is_empty() { 0.0 } else { 1.0 }),
+                    Err(e) if is_limit(&e) => return Err(e),
+                    Err(_) => Val::Num(0.0),
+                }
+            }
+            "hasvalue" => {
+                let v = self.arg(args, 0)?;
+                Val::Num(if self.is_null(&v) || matches!(&v, Val::Str(s) if s.trim().is_empty()) { 0.0 } else { 1.0 })
+            }
+            "oneof" => {
+                let v = self.arg(args, 0)?;
+                let rest = self.arg_values(args.get(1..).unwrap_or_default())?;
+                let mut hit = false;
+                for x in &rest {
+                    // Each comparison copies and compares `v`: charged per item.
+                    self.charge(self.cost(&v).saturating_add(self.cost(x)).saturating_add(1))?;
+                    if self.binary("==", v.clone(), x.clone()).is_ok_and(|r| self.truthy(&r)) {
+                        hit = true;
+                        break;
+                    }
+                }
+                Val::Num(if hit { 1.0 } else { 0.0 })
+            }
+            "within" => {
+                let v = self.arg(args, 0)?;
+                let (lo, hi) = (self.arg(args, 1)?, self.arg(args, 2)?);
+                let ok = self.binary(">=", v.clone(), lo).is_ok_and(|r| self.truthy(&r)) && self.binary("<=", v, hi).is_ok_and(|r| self.truthy(&r));
+                Val::Num(if ok { 1.0 } else { 0.0 })
+            }
+            // ── strings
+            "at" => {
+                let (s, sub) = (self.arg_str(args, 0)?, self.arg_str(args, 1)?);
+                Val::Num(if sub.is_empty() { 0.0 } else { s.find(&sub).map_or(0.0, |b| s[..b].chars().count() as f64 + 1.0) })
+            }
+            "concat" => {
+                let mut out = String::new();
+                for i in 0..args.len() {
+                    out.push_str(&self.arg_str(args, i)?);
+                    if out.len() > MAX_STRING {
+                        return Err(STRING_TOO_LONG.into());
+                    }
+                }
+                Val::Str(out)
+            }
+            "left" => {
+                let (s, k) = (self.arg_str(args, 0)?, self.arg_num(args, 1)?.max(0.0) as usize);
+                Val::Str(s.chars().take(k).collect())
+            }
+            "right" => {
+                let (s, k) = (self.arg_str(args, 0)?, self.arg_num(args, 1)?.max(0.0) as usize);
+                let len = s.chars().count();
+                Val::Str(s.chars().skip(len.saturating_sub(k)).collect())
+            }
+            "len" => Val::Num(self.arg_str(args, 0)?.chars().count() as f64),
+            "lower" => Val::Str(self.arg_str(args, 0)?.to_lowercase()),
+            "upper" => Val::Str(self.arg_str(args, 0)?.to_uppercase()),
+            "ltrim" => Val::Str(self.arg_str(args, 0)?.trim_start().to_string()),
+            "rtrim" => Val::Str(self.arg_str(args, 0)?.trim_end().to_string()),
+            "space" => {
+                let k = self.arg_num(args, 0)?.clamp(0.0, MAX_STRING as f64) as usize;
+                Val::Str(" ".repeat(k))
+            }
+            "str" => {
+                let v = self.arg_num(args, 0)?;
+                let width = if args.len() > 1 { self.arg_num(args, 1)?.clamp(0.0, 1000.0) as usize } else { 10 };
+                let prec = if args.len() > 2 { self.arg_num(args, 2)?.clamp(0.0, 20.0) as usize } else { 0 };
+                let text = fixed(v, prec);
+                Val::Str(if text.len() > width { "*".repeat(width) } else { format!("{text:>width$}") })
+            }
+            "substr" => {
+                let s = self.arg_str(args, 0)?;
+                let start = self.arg_num(args, 1)?.max(1.0) as usize;
+                let len = self.arg_num(args, 2)?.max(0.0) as usize;
+                Val::Str(s.chars().skip(start - 1).take(len).collect())
+            }
+            "stuff" => {
+                let s = self.arg_str(args, 0)?;
+                let start = self.arg_num(args, 1)?.max(1.0) as usize;
+                let del = self.arg_num(args, 2)?.max(0.0) as usize;
+                let ins = if args.len() > 3 { self.arg_str(args, 3)? } else { String::new() };
+                let chars: Vec<char> = s.chars().collect();
+                let a = start.saturating_sub(1).min(chars.len());
+                let b = a.saturating_add(del).min(chars.len());
+                let out: String = chars[..a].iter().chain(ins.chars().collect::<Vec<_>>().iter()).chain(chars[b..].iter()).collect();
+                if out.len() > MAX_STRING {
+                    return Err(STRING_TOO_LONG.into());
+                }
+                Val::Str(out)
+            }
+            "replace" => {
+                let (s, old) = (self.arg_str(args, 0)?, self.arg_str(args, 1)?);
+                let new = if args.len() > 2 { self.arg_str(args, 2)? } else { String::new() };
+                if old.is_empty() {
+                    return Ok(Val::Str(s));
+                }
+                let grown = s.matches(old.as_str()).count().saturating_mul(new.len()).saturating_add(s.len());
+                if grown > MAX_STRING {
+                    return Err(STRING_TOO_LONG.into());
+                }
+                Val::Str(s.replace(&old, &new))
+            }
+            "wordnum" => {
+                let v = self.arg_num(args, 0)?;
+                let kind = if args.len() > 1 { self.arg_num(args, 1)? } else { 0.0 };
+                Val::Str(word_num(v, kind == 2.0))
+            }
+            "uuid" => Val::Str(format!("{:032x}", (self.steps as u128).wrapping_mul(0x9E37_79B9_7F4A_7C15_F39C_C060_5CED_C835))),
+            "encode" | "decode" => {
+                let s = self.arg_str(args, 0)?;
+                let kind = if args.len() > 1 { self.arg_str(args, 1)?.to_ascii_lowercase() } else { "url".into() };
+                Val::Str(match (lower.as_str(), kind.as_str()) {
+                    ("encode", "html" | "xml") => s.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;"),
+                    ("decode", "html" | "xml") => s.replace("&lt;", "<").replace("&gt;", ">").replace("&quot;", "\"").replace("&amp;", "&"),
+                    ("encode", _) => s
+                        .bytes()
+                        .map(|b| if b.is_ascii_alphanumeric() || b"-_.~".contains(&b) { (b as char).to_string() } else { format!("%{b:02X}") })
+                        .collect(),
+                    (_, _) => {
+                        let mut out = Vec::new();
+                        let b = s.as_bytes();
+                        let mut i = 0;
+                        while i < b.len() {
+                            if b[i] == b'%'
+                                && let Some(h) = b
+                                    .get(i + 1..i + 3)
+                                    .filter(|h| h.iter().all(u8::is_ascii_hexdigit))
+                                    .and_then(|h| std::str::from_utf8(h).ok())
+                                    .and_then(|h| u8::from_str_radix(h, 16).ok())
+                            {
+                                out.push(h);
+                                i += 3;
+                            } else {
+                                out.push(b[i]);
+                                i += 1;
+                            }
+                        }
+                        String::from_utf8_lossy(&out).into_owned()
+                    }
+                })
+            }
+            "format" => {
+                // Number pictures: `9` digit, `z` optional digit, `,` separator, `.` point, `$`.
+                let pic = self.arg_str(args, 0)?;
+                let v = self.arg(args, 1)?;
+                if pic.to_ascii_uppercase().contains("YY") || pic.to_ascii_uppercase().contains("DD") {
+                    let text = self.to_str(&v);
+                    let days = parse_num(&text).filter(|d| is_numeric_text(&text) && d.abs() < MAX_DAYS).map(|d| d as i64);
+                    return Ok(match days {
+                        Some(d) => {
+                            let (y, m, dd) = civil_from_days(d);
+                            Val::Str(format_date(y, m, dd, &pic))
+                        }
+                        None => parse_date(&text, "YYYY-MM-DD").map_or(Val::Str(text), |(y, m, d)| Val::Str(format_date(y, m, d, &pic))),
+                    });
+                }
+                let num = self.to_num(&v);
+                let decimals = pic.split_once('.').map_or(0, |(_, f)| f.chars().filter(|c| matches!(c, '9' | 'z' | 'Z')).count()).min(20);
+                // `9` in the integer part forces a digit; `z` does not.
+                let min_int = pic.split('.').next().map_or(0, |i| i.chars().filter(|c| *c == '9').count()).min(20);
+                let width = min_int + if decimals > 0 { decimals + 1 } else { 0 };
+                let grouped = pic.contains(',');
+                let mut text = format!("{:0>width$}", fixed(num.abs(), decimals));
+                if grouped {
+                    let (int, frac) = text.split_once('.').map_or((text.as_str(), ""), |(a, b)| (a, b));
+                    let mut g = String::new();
+                    for (k, c) in int.chars().enumerate() {
+                        if k > 0 && (int.len() - k) % 3 == 0 {
+                            g.push(',');
+                        }
+                        g.push(c);
+                    }
+                    text = if frac.is_empty() { g } else { format!("{g}.{frac}") };
+                }
+                let nonzero = text.chars().any(|c| ('1'..='9').contains(&c));
+                if pic.contains('$') {
+                    text = format!("${text}");
+                }
+                if num < 0.0 && nonzero {
+                    text = format!("-{text}");
+                }
+                Val::Str(text)
+            }
+            "parse" => {
+                let pic = self.arg_str(args, 0)?;
+                let s = self.arg_str(args, 1)?;
+                if pic.to_ascii_uppercase().contains("YY") {
+                    // The canonical form of a date is ISO.
+                    return Ok(parse_date(&s, &pic).map_or(Val::Null, |(y, m, d)| Val::Str(format_date(y, m, d, "YYYY-MM-DD"))));
+                }
+                let cleaned: String = s.chars().filter(|c| c.is_ascii_digit() || *c == '.' || *c == '-').collect();
+                parse_num(&cleaned).map_or(Val::Null, Val::Num)
+            }
+            // ── dates and times (days since 1900-01-01 = 1; milliseconds since midnight)
+            "date" => {
+                #[cfg(not(target_arch = "wasm32"))]
+                {
+                    let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs() as i64).unwrap_or(0);
+                    Val::Num((secs.div_euclid(86_400) + 25_568) as f64)
+                }
+                #[cfg(target_arch = "wasm32")]
+                {
+                    Val::Num(25_568.0)
+                }
+            }
+            "time" => {
+                #[cfg(not(target_arch = "wasm32"))]
+                {
+                    let ms = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_millis() as i64).unwrap_or(0);
+                    Val::Num(ms.rem_euclid(86_400_000) as f64)
+                }
+                #[cfg(target_arch = "wasm32")]
+                {
+                    Val::Num(0.0)
+                }
+            }
+            "date2num" | "isodate2num" => {
+                let s = self.arg_str(args, 0)?;
+                let pic = if lower == "isodate2num" || args.len() < 2 { "YYYY-MM-DD".to_string() } else { self.arg_str(args, 1)? };
+                let parsed = parse_date(&s, &pic).or_else(|| parse_date(&s, "YYYYMMDD")).or_else(|| parse_date(&s, "YYYY-MM-DD"));
+                parsed.map_or(Val::Num(0.0), |(y, m, d)| Val::Num(days_from_civil(y, m, d) as f64))
+            }
+            "num2date" => {
+                let days = self.arg_num(args, 0)?;
+                let pic = if args.len() > 1 { self.arg_str(args, 1)? } else { "MMM D, YYYY".into() };
+                if !days.is_finite() || days.abs() >= MAX_DAYS {
+                    return Ok(Val::Null);
+                }
+                let (y, m, d) = civil_from_days(days as i64);
+                Val::Str(format_date(y, m, d, &pic))
+            }
+            "datefmt" | "localdatefmt" => {
+                let style = if args.is_empty() { 0.0 } else { self.arg_num(args, 0)? };
+                Val::Str(
+                    match style as i32 {
+                        1 => "M/D/YY",
+                        2 => "MMM D, YYYY",
+                        3 => "MMMM D, YYYY",
+                        4 => "EEEE, MMMM D, YYYY",
+                        _ => "MMM D, YYYY",
+                    }
+                    .into(),
+                )
+            }
+            "timefmt" | "localtimefmt" => Val::Str("HH:MM:SS".into()),
+            "num2time" | "num2gmtime" => {
+                let ms = self.arg_num(args, 0)?;
+                if !ms.is_finite() || ms < 0.0 {
+                    return Ok(Val::Null);
+                }
+                let s = (ms / 1000.0) as u64;
+                Val::Str(format!("{:02}:{:02}:{:02}", (s / 3600) % 24, (s / 60) % 60, s % 60))
+            }
+            "time2num" | "isotime2num" => {
+                let s = self.arg_str(args, 0)?;
+                // ISO 8601 allows a leading "T", a trailing "Z" and fractional seconds.
+                let t = s.trim();
+                let t = t.strip_prefix(['T', 't']).unwrap_or(t);
+                let t = t.strip_suffix(['Z', 'z']).unwrap_or(t);
+                let mut parts = t.split(':');
+                let mut whole = || parts.next().and_then(|p| p.trim().parse::<u64>().ok()).unwrap_or(0).min(1_000_000);
+                let (h, m) = (whole(), whole());
+                let sec =
+                    parts.next().and_then(|p| p.trim().parse::<f64>().ok()).filter(|v| v.is_finite() && *v >= 0.0).unwrap_or(0.0).min(1_000_000.0);
+                Val::Num(((h * 3600 + m * 60) * 1000) as f64 + (sec * 1000.0).round())
+            }
+            // ── financial
+            "fv" => {
+                let (p, r, k) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
+                Val::Num(if r == 0.0 { p * k } else { p * (((1.0 + r).powf(k) - 1.0) / r) })
+            }
+            "pv" => {
+                let (p, r, k) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
+                Val::Num(if r == 0.0 { p * k } else { p * ((1.0 - (1.0 + r).powf(-k)) / r) })
+            }
+            "pmt" => {
+                let (pv, r, k) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
+                if k <= 0.0 {
+                    return Err("Pmt needs a positive number of periods".into());
+                }
+                Val::Num(if r == 0.0 { pv / k } else { pv * r / (1.0 - (1.0 + r).powf(-k)) })
+            }
+            "term" => {
+                let (p, r, fv) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
+                if p <= 0.0 || r <= 0.0 || fv <= 0.0 {
+                    return Err("Term needs positive arguments".into());
+                }
+                Val::Num(((fv * r / p) + 1.0).ln() / (1.0 + r).ln())
+            }
+            "cterm" => {
+                let (r, fv, pv) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
+                if r <= 0.0 || fv <= 0.0 || pv <= 0.0 {
+                    return Err("CTerm needs positive arguments".into());
+                }
+                Val::Num((fv / pv).ln() / (1.0 + r).ln())
+            }
+            "rate" => {
+                let (fv, pv, k) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
+                if fv <= 0.0 || pv <= 0.0 || k <= 0.0 {
+                    return Err("Rate needs positive arguments".into());
+                }
+                Val::Num((fv / pv).powf(1.0 / k) - 1.0)
+            }
+            "npv" => {
+                let r = self.arg_num(args, 0)?;
+                let flows = self.arg_values(args.get(1..).unwrap_or_default())?;
+                Val::Num(flows.iter().enumerate().map(|(i, v)| self.to_num(v) / (1.0 + r).powi(i as i32 + 1)).sum())
+            }
+            "ipmt" | "ppmt" => {
+                let (pv, r, pmt, first, count) = (
+                    self.arg_num(args, 0)?,
+                    self.arg_num(args, 1)?,
+                    self.arg_num(args, 2)?,
+                    self.arg_num(args, 3)?.max(1.0),
+                    self.arg_num(args, 4)?.max(1.0),
+                );
+                let (mut balance, mut interest, mut principal) = (pv, 0.0, 0.0);
+                for period in 1..=((first + count - 1.0).min(10_000.0) as u32) {
+                    self.step()?;
+                    let i = balance * r;
+                    let p = (pmt - i).min(balance);
+                    if period >= first as u32 {
+                        interest += i;
+                        principal += p;
+                    }
+                    balance -= p;
+                    if balance <= 0.0 {
+                        break;
+                    }
+                }
+                Val::Num(if lower == "ipmt" { interest } else { principal })
+            }
+            "apr" => {
+                let (principal, payment, periods) = (self.arg_num(args, 0)?, self.arg_num(args, 1)?, self.arg_num(args, 2)?);
+                if principal <= 0.0 || payment <= 0.0 || periods <= 0.0 {
+                    return Err("Apr needs positive arguments".into());
+                }
+                // Bisection on the monthly rate.
+                let (mut lo, mut hi) = (0.0f64, 1.0f64);
+                for _ in 0..200 {
+                    let mid = (lo + hi) / 2.0;
+                    let pmt = if mid == 0.0 { principal / periods } else { principal * mid / (1.0 - (1.0 + mid).powf(-periods)) };
+                    if pmt > payment {
+                        hi = mid;
+                    } else {
+                        lo = mid;
+                    }
+                }
+                Val::Num((lo + hi) / 2.0 * 12.0)
+            }
+            // ── units and references
+            "unittype" => {
+                let s = self.arg_str(args, 0)?;
+                let unit: String = s.trim().chars().skip_while(|c| c.is_ascii_digit() || *c == '.' || *c == '-' || *c == '+').collect();
+                Val::Str(
+                    match unit.trim().to_ascii_lowercase().as_str() {
+                        "in" | "inch" | "inches" => "in",
+                        "mm" | "millimeter" | "millimeters" => "mm",
+                        "cm" | "centimeter" | "centimeters" => "cm",
+                        "pt" | "point" | "points" => "pt",
+                        "pc" | "pica" => "pc",
+                        _ => "in",
+                    }
+                    .into(),
+                )
+            }
+            "unitvalue" => {
+                let s = self.arg_str(args, 0)?;
+                let to = if args.len() > 1 { self.arg_str(args, 1)? } else { String::new() };
+                let v = parse_num(&s).unwrap_or(0.0);
+                let unit: String = s.trim().chars().skip_while(|c| c.is_ascii_digit() || *c == '.' || *c == '-' || *c == '+').collect();
+                let per_in = |u: &str| match u.trim().to_ascii_lowercase().as_str() {
+                    "mm" | "millimeter" | "millimeters" => 25.4,
+                    "cm" | "centimeter" | "centimeters" => 2.54,
+                    "pt" | "point" | "points" => 72.0,
+                    "pc" | "pica" => 6.0,
+                    _ => 1.0,
+                };
+                let target = if to.trim().is_empty() { unit.clone() } else { to };
+                Val::Num(v / per_in(&unit) * per_in(&target))
+            }
+            "ref" => {
+                let Some(e) = args.first() else { return Ok(Val::Null) };
+                self.eval(e)?
+            }
+            "eval" => {
+                let src = self.arg_str(args, 0)?;
+                self.charge((src.len() / 16) as u64)?;
+                let body = parse(&src)?;
+                let (_, v) = self.block(&body)?;
+                v
+            }
+            "get" | "post" | "put" => return Err(format!("{name}: network access is not available to form scripts")),
+            _ => return Err(format!("unknown function {name}")),
+        })
+    }
+}
diff --git a/crates/js/src/formcalc/dates.rs b/crates/js/src/formcalc/dates.rs
new file mode 100644
index 0000000000..bfb6383cdd
--- /dev/null
+++ b/crates/js/src/formcalc/dates.rs
@@ -0,0 +1,166 @@
+// ── built-in functions ──────────────────────────────────────────────────────────────────────
+
+/// `NaiveDate::num_days_from_ce` of 1900-01-01 minus one: a civil date's day count rebased so
+/// that 1900-01-01 is FormCalc day 1 (and 1970-01-01 is day 25_568).
+const FORMCALC_EPOCH_FROM_CE: i64 = 693_595;
+
+/// Days in one 400-year Gregorian cycle; the calendar repeats after it.
+const DAYS_PER_400_YEARS: i64 = 146_097;
+
+/// Days from 1900-01-01 (day 1, as FormCalc counts) to a civil date.
+///
+/// chrono's `NaiveDate` stops near ±262143, but FormCalc accepts day numbers up to `MAX_DAYS`
+/// (years past 270000). The calendar repeats every 400 years, so chrono converts the date
+/// within its cycle and whole cycles are added back; the result matches the proleptic Gregorian
+/// count for every year. Callers pass dates `parse_date`/`civil_from_days` already validated;
+/// anything else reads as 0.
+pub(super) fn days_from_civil(y: i64, m: u32, d: u32) -> i64 {
+    use chrono::Datelike;
+    let (cycles, year) = (i128::from(y.div_euclid(400)), y.rem_euclid(400));
+    i32::try_from(year)
+        .ok()
+        .and_then(|year| chrono::NaiveDate::from_ymd_opt(year, m, d))
+        .and_then(|date| {
+            let days = i128::from(date.num_days_from_ce()) - i128::from(FORMCALC_EPOCH_FROM_CE) + cycles * i128::from(DAYS_PER_400_YEARS);
+            i64::try_from(days).ok()
+        })
+        .unwrap_or(0)
+}
+
+/// The civil date (year, month, day) at FormCalc day number `n` (day 1 is 1900-01-01), for any
+/// `n`: chrono converts the day within its 400-year cycle and the cycles are added back as years.
+pub(super) fn civil_from_days(n: i64) -> (i64, u32, u32) {
+    use chrono::Datelike;
+    // Days since CE day 0 (0000-12-31), in i128 so no `n` overflows.
+    let from_ce = i128::from(n) + i128::from(FORMCALC_EPOCH_FROM_CE);
+    let (cycles, rest) = (from_ce.div_euclid(i128::from(DAYS_PER_400_YEARS)), from_ce.rem_euclid(i128::from(DAYS_PER_400_YEARS)));
+    // `rest` is 0..146_097, so CE day `rest` lies in years 0..=400 (day 0 is 0000-12-31).
+    let date = i32::try_from(rest).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    match date {
+        Some(date) => {
+            let y = i128::from(date.year()) + cycles * 400;
+            (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), date.month(), date.day())
+        }
+        // Unreachable: every `rest` in 0..146_097 is a valid CE day.
+        None => (1900, 1, 1),
+    }
+}
+
+/// Day numbers (and years) beyond this are refused rather than computed.
+pub(super) const MAX_DAYS: f64 = 1e8;
+
+const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+
+/// Parse `text` as a date by `picture` (`YYYY-MM-DD`, `MM/DD/YYYY`, `MMM D, YYYY`, …).
+pub(super) fn parse_date(text: &str, picture: &str) -> Option<(i64, u32, u32)> {
+    let pic: Vec<char> = picture.chars().collect();
+    let txt: Vec<char> = text.trim().chars().collect();
+    let (mut y, mut m, mut d) = (None, None, None);
+    let (mut i, mut j) = (0, 0);
+    while i < pic.len() {
+        let c = pic[i].to_ascii_uppercase();
+        if c == 'Y' || c == 'M' || c == 'D' {
+            let mut run = 1;
+            while i + run < pic.len() && pic[i + run].to_ascii_uppercase() == c {
+                run += 1;
+            }
+            i += run;
+            if c == 'M' && run >= 3 {
+                // Month name.
+                let rest: String = txt.get(j..).unwrap_or(&[]).iter().collect();
+                let lower = rest.to_ascii_lowercase();
+                let found = MONTHS
+                    .iter()
+                    .position(|name| lower.starts_with(&name.to_ascii_lowercase()) || lower.starts_with(&name[..3].to_ascii_lowercase()));
+                let k = found?;
+                m = Some(k as u32 + 1);
+                let full = MONTHS[k].to_ascii_lowercase();
+                j += if lower.starts_with(&full) { full.chars().count() } else { 3 };
+                continue;
+            }
+            let width = if run == 1 { 2 } else { run };
+            let mut digits = String::new();
+            while j < txt.len() && txt[j].is_ascii_digit() && digits.len() < width {
+                digits.push(txt[j]);
+                j += 1;
+            }
+            if digits.is_empty() {
+                return None;
+            }
+            let v: i64 = digits.parse().ok()?;
+            match c {
+                'Y' => y = Some(if run <= 2 { if v < 50 { 2000 + v } else { 1900 + v } } else { v }),
+                'M' => m = Some(v as u32),
+                _ => d = Some(v as u32),
+            }
+        } else {
+            if txt.get(j) != Some(&pic[i]) {
+                return None;
+            }
+            i += 1;
+            j += 1;
+        }
+    }
+    let (y, m, d) = (y?, m.unwrap_or(1), d.unwrap_or(1));
+    ((-200_000..=200_000).contains(&y) && (1..=12).contains(&m) && (1..=days_in(y, m)).contains(&d)).then_some((y, m, d))
+}
+
+/// Number of days in month `m` (1-12) of year `y`, leap years included.
+pub(crate) fn days_in(y: i64, m: u32) -> u32 {
+    // The length of the month from chrono (the first of the next month, less the first of this
+    // one). An invalid month keeps the old 31-day default.
+    // Month lengths repeat every 400 years, so the year within its cycle is enough (and always
+    // in chrono's range, whatever `y` is).
+    let y = y.rem_euclid(400);
+    let first = |y: i64, m: u32| i32::try_from(y).ok().and_then(|y| chrono::NaiveDate::from_ymd_opt(y, m, 1));
+    let next = if m == 12 { first(y + 1, 1) } else { first(y, m + 1) };
+    match (first(y, m), next) {
+        (Some(a), Some(b)) => (b - a).num_days() as u32,
+        _ => 31,
+    }
+}
+
+const WEEKDAYS: [&str; 7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+
+pub(super) fn format_date(y: i64, m: u32, d: u32, picture: &str) -> String {
+    let pic: Vec<char> = picture.chars().collect();
+    let mut out = String::new();
+    let mut i = 0;
+    while i < pic.len() {
+        let c = pic[i].to_ascii_uppercase();
+        if c == 'Y' || c == 'M' || c == 'D' {
+            let mut run = 1;
+            while i + run < pic.len() && pic[i + run].to_ascii_uppercase() == c {
+                run += 1;
+            }
+            i += run;
+            match (c, run) {
+                ('Y', 1 | 2) => out.push_str(&format!("{:02}", y.rem_euclid(100))),
+                ('Y', _) => out.push_str(&format!("{y:04}")),
+                ('M', 1) => out.push_str(&m.to_string()),
+                ('M', 2) => out.push_str(&format!("{m:02}")),
+                ('M', 3) => out.push_str(MONTHS.get((m as usize).saturating_sub(1)).map_or("", |n| &n[..3])),
+                ('M', _) => out.push_str(MONTHS.get((m as usize).saturating_sub(1)).copied().unwrap_or("")),
+                ('D', 1) => out.push_str(&d.to_string()),
+                (_, _) => out.push_str(&format!("{d:02}")),
+            }
+        } else if pic[i] == 'E' {
+            let mut run = 1;
+            while i + run < pic.len() && pic[i + run] == 'E' {
+                run += 1;
+            }
+            i += run;
+            // Day 1 (1900-01-01) was a Monday, so the serial modulo 7 indexes from Sunday.
+            let weekday = days_from_civil(y, m, d).rem_euclid(7) as usize;
+            match run {
+                1 | 2 => out.push_str(&(weekday + 1).to_string()),
+                3 => out.push_str(WEEKDAYS.get(weekday).map_or("", |n| &n[..3])),
+                _ => out.push_str(WEEKDAYS.get(weekday).copied().unwrap_or("")),
+            }
+        } else {
+            out.push(pic[i]);
+            i += 1;
+        }
+    }
+    out
+}
diff --git a/crates/js/src/formcalc/eval.rs b/crates/js/src/formcalc/eval.rs
new file mode 100644
index 0000000000..23ce3ec0c1
--- /dev/null
+++ b/crates/js/src/formcalc/eval.rs
@@ -0,0 +1,618 @@
+use super::ast::{Expr, Stmt};
+use super::value::{Val, is_numeric_text, num_text};
+use super::*;
+
+impl Interp<'_> {
+    // ── expressions
+
+    pub(super) fn eval(&mut self, e: &Expr) -> R<Val> {
+        self.step()?;
+        self.depth += 1;
+        if self.depth > self.max_depth {
+            self.depth -= 1;
+            return Err(TOO_DEEP.into());
+        }
+        let r = self.eval_inner(e);
+        self.depth -= 1;
+        r
+    }
+
+    fn eval_inner(&mut self, e: &Expr) -> R<Val> {
+        Ok(match e {
+            Expr::Num(n) => Val::Num(*n),
+            Expr::Str(s) => {
+                self.charge((s.len() / 256) as u64)?;
+                Val::Str(s.clone())
+            }
+            Expr::Null => Val::Null,
+            Expr::Ident(name) => {
+                let v = self.ident(name)?;
+                self.charge(self.cost(&v))?;
+                v
+            }
+            Expr::Member(base, name) => {
+                let b = self.eval(base)?;
+                self.member(b, name)?
+            }
+            Expr::Index(base, idx) => self.index(base, idx)?,
+            Expr::Descend(base, name) => {
+                let b = self.eval(base)?;
+                let mut out = Vec::new();
+                let mut seen = HashSet::new();
+                for i in self.nodes_list(&b) {
+                    self.gather(&mut out, &mut seen, descendants_named(self.h, i, name, 0))?;
+                }
+                match out.as_slice() {
+                    [] => Val::Null,
+                    [one] => Val::Node(*one),
+                    many => Val::List(many.iter().map(|k| Val::Node(*k)).collect()),
+                }
+            }
+            Expr::Call(callee, args) => self.call(callee, args)?,
+            Expr::Neg(x) => {
+                let v = self.eval(x)?;
+                if self.is_null(&v) { Val::Null } else { Val::Num(-self.to_num(&v)) }
+            }
+            Expr::Not(x) => {
+                let v = self.eval(x)?;
+                Val::Num(if self.truthy(&v) { 0.0 } else { 1.0 })
+            }
+            Expr::Bin(..) => {
+                // The parser leans left (`a + b + c` is `(a + b) + c`), so a chain is walked
+                // from its leftmost operand and folded without recursing per operator.
+                let mut links = Vec::new();
+                let mut leftmost = e;
+                while let Expr::Bin(op, l, r) = leftmost {
+                    links.push((*op, r.as_ref()));
+                    leftmost = l;
+                }
+                let mut acc = self.eval(leftmost)?;
+                for (op, r) in links.into_iter().rev() {
+                    self.step()?;
+                    acc = match op {
+                        "&" => {
+                            if !self.truthy(&acc) {
+                                // Not evaluated: the result is settled.
+                                Val::Num(0.0)
+                            } else {
+                                let b = self.eval(r)?;
+                                Val::Num(if self.truthy(&b) { 1.0 } else { 0.0 })
+                            }
+                        }
+                        "|" => {
+                            if self.truthy(&acc) {
+                                Val::Num(1.0)
+                            } else {
+                                let b = self.eval(r)?;
+                                Val::Num(if self.truthy(&b) { 1.0 } else { 0.0 })
+                            }
+                        }
+                        _ => {
+                            let b = self.eval(r)?;
+                            // Comparing (and dereferencing) long strings is work too.
+                            self.charge(self.cost(&acc).saturating_add(self.cost(&b)))?;
+                            self.binary(op, acc, b)?
+                        }
+                    };
+                }
+                acc
+            }
+        })
+    }
+
+    pub(super) fn binary(&self, op: &str, a: Val, b: Val) -> R<Val> {
+        let (a, b) = (self.deref(a), self.deref(b));
+        // Null with an arithmetic operator is null only when both sides are null.
+        match op {
+            "+" | "-" | "*" | "/" => {
+                if self.is_null(&a) && self.is_null(&b) {
+                    return Ok(Val::Null);
+                }
+                let (x, y) = (self.to_num(&a), self.to_num(&b));
+                let v = match op {
+                    "+" => x + y,
+                    "-" => x - y,
+                    "*" => x * y,
+                    _ => {
+                        if y == 0.0 {
+                            return Err("division by zero".into());
+                        }
+                        x / y
+                    }
+                };
+                Ok(Val::Num(v))
+            }
+            _ => {
+                let ord = match (&a, &b) {
+                    (Val::Null, Val::Null) => Some(std::cmp::Ordering::Equal),
+                    (Val::Null, _) | (_, Val::Null) => None,
+                    (Val::Str(s), Val::Str(t)) if !(is_numeric_text(s) && is_numeric_text(t)) => Some(s.cmp(t)),
+                    (Val::Str(s), Val::Num(_)) if !is_numeric_text(s) => Some(s.as_str().cmp(num_text(self.to_num(&b)).as_str())),
+                    (Val::Num(_), Val::Str(t)) if !is_numeric_text(t) => Some(num_text(self.to_num(&a)).as_str().cmp(t.as_str())),
+                    _ => self.to_num(&a).partial_cmp(&self.to_num(&b)),
+                };
+                let r = match (op, ord) {
+                    ("==", Some(o)) => o.is_eq(),
+                    ("<>", Some(o)) => !o.is_eq(),
+                    ("<>", None) => true,
+                    ("<", Some(o)) => o.is_lt(),
+                    ("<=", Some(o)) => o.is_le(),
+                    (">", Some(o)) => o.is_gt(),
+                    (">=", Some(o)) => o.is_ge(),
+                    _ => false,
+                };
+                Ok(Val::Num(if r { 1.0 } else { 0.0 }))
+            }
+        }
+    }
+
+    // ── calls
+
+    fn call(&mut self, callee: &Expr, args: &[Expr]) -> R<Val> {
+        match callee {
+            Expr::Ident(name) => {
+                if let Some(f) = self.funcs.get(&name.to_ascii_lowercase()).cloned() {
+                    let mut vals = Vec::new();
+                    for a in args {
+                        let v = self.eval(a)?;
+                        vals.push(self.take(v)?);
+                    }
+                    return self.call_user(&f, vals);
+                }
+                self.builtin(name, args)
+            }
+            Expr::Member(base, method) => {
+                let b = self.eval(base)?;
+                self.method(b, method, args)
+            }
+            _ => Err("not a function".into()),
+        }
+    }
+
+    fn call_user(&mut self, f: &Func, vals: Vec<Val>) -> R<Val> {
+        if self.scopes.len() > self.max_depth {
+            return Err(CALLS_TOO_DEEP.into());
+        }
+        let mut scope = HashMap::new();
+        for (i, p) in f.params.iter().enumerate() {
+            scope.insert(p.clone(), vals.get(i).cloned().unwrap_or(Val::Null));
+        }
+        self.scopes.push(scope);
+        let r = self.block(&f.body);
+        self.scopes.pop();
+        match r? {
+            (Flow::Return(v), _) => Ok(v),
+            (Flow::Exit, last) => {
+                self.exited = true;
+                Ok(last)
+            }
+            (_, last) => Ok(last),
+        }
+    }
+
+    pub(super) fn arg(&mut self, args: &[Expr], i: usize) -> R<Val> {
+        match args.get(i) {
+            Some(e) => {
+                let v = self.eval(e)?;
+                self.take(v)
+            }
+            None => Ok(Val::Null),
+        }
+    }
+
+    pub(super) fn arg_num(&mut self, args: &[Expr], i: usize) -> R<f64> {
+        let v = self.arg(args, i)?;
+        Ok(self.to_num(&v))
+    }
+
+    pub(super) fn arg_str(&mut self, args: &[Expr], i: usize) -> R<String> {
+        let v = self.arg(args, i)?;
+        Ok(self.to_str(&v))
+    }
+
+    /// Every value the arguments hold, lists flattened, nulls left out.
+    pub(super) fn arg_values(&mut self, args: &[Expr]) -> R<Vec<Val>> {
+        self.arg_values_keeping(args, false)
+    }
+
+    /// [`Self::arg_values`]; `objects` keeps form objects (fields, subforms) as themselves, so
+    /// `Count(row[*])` counts rows rather than filled-in values.
+    pub(super) fn arg_values_keeping(&mut self, args: &[Expr], objects: bool) -> R<Vec<Val>> {
+        let mut out = Vec::new();
+        for a in args {
+            let v = self.eval(a)?;
+            let v = if objects { v } else { self.take(v)? };
+            match v {
+                Val::List(items) => out.extend(items.into_iter().filter(|x| !matches!(x, Val::Null))),
+                Val::Null => {}
+                other => out.push(other),
+            }
+            if out.len() > MAX_LIST {
+                return Err(LIST_TOO_LONG.into());
+            }
+        }
+        Ok(out)
+    }
+
+    fn method(&mut self, base: Val, method: &str, args: &[Expr]) -> R<Val> {
+        let m = method.to_ascii_lowercase();
+        match base {
+            Val::Host => match m.as_str() {
+                "messagebox" => {
+                    let t = self.arg_str(args, 0)?;
+                    self.h.push(XfaEffect::MessageBox(t));
+                    Ok(Val::Num(1.0))
+                }
+                "resetdata" => {
+                    let list = self.arg_str(args, 0)?;
+                    self.h.push(XfaEffect::ResetData(reset_names(&list)));
+                    Ok(Val::Null)
+                }
+                "print" => {
+                    self.h.push(XfaEffect::Print);
+                    Ok(Val::Null)
+                }
+                "beep" => {
+                    self.h.push(XfaEffect::Beep);
+                    Ok(Val::Null)
+                }
+                "gotourl" => {
+                    let u = self.arg_str(args, 0)?;
+                    self.h.push(XfaEffect::LaunchUrl(u));
+                    Ok(Val::Null)
+                }
+                "setfocus" => {
+                    let target = match args.first() {
+                        Some(e) => {
+                            let raw = self.eval(e)?;
+                            match self.nodes_of(&raw).first() {
+                                Some(i) => self.node(*i).map(|n| n.som.clone()).unwrap_or_default(),
+                                None => {
+                                    let s = self.to_str(&raw);
+                                    let found = resolve_som(self.h, self.h.current, &s);
+                                    found.first().and_then(|i| self.node(*i)).map(|n| n.som.clone()).unwrap_or(s)
+                                }
+                            }
+                        }
+                        None => String::new(),
+                    };
+                    self.h.push(XfaEffect::SetFocus(target));
+                    Ok(Val::Null)
+                }
+                _ => Ok(Val::Null),
+            },
+            Val::Layout => match m.as_str() {
+                "page" | "abspage" => Ok(Val::Num(self.h.doc.page as f64 + if m == "page" { 1.0 } else { 0.0 })),
+                "pagecount" | "abspagecount" => Ok(Val::Num(self.h.doc.page_count as f64)),
+                "relayout" | "relayoutpagearea" => {
+                    self.h.push(XfaEffect::Relayout);
+                    Ok(Val::Null)
+                }
+                _ => Ok(Val::Num(0.0)),
+            },
+            Val::Xfa => match m.as_str() {
+                "resolvenode" | "resolvenodes" => {
+                    let s = self.arg_str(args, 0)?;
+                    let found = resolve_som(self.h, self.h.current, &s);
+                    Ok(self.set_val(found, m == "resolvenodes"))
+                }
+                "recalculate" => {
+                    self.h.push(XfaEffect::Recalculate);
+                    Ok(Val::Null)
+                }
+                "remerge" => {
+                    self.h.push(XfaEffect::Relayout);
+                    Ok(Val::Null)
+                }
+                _ => Ok(Val::Null),
+            },
+            Val::Node(i) => match m.as_str() {
+                "resolvenode" | "resolvenodes" => {
+                    let s = self.arg_str(args, 0)?;
+                    let found = resolve_som(self.h, i, &s);
+                    Ok(self.set_val(found, m == "resolvenodes"))
+                }
+                "recalculate" => {
+                    self.h.push(XfaEffect::Recalculate);
+                    Ok(Val::Null)
+                }
+                "remerge" => {
+                    self.h.push(XfaEffect::Relayout);
+                    Ok(Val::Null)
+                }
+                _ => Ok(Val::Null),
+            },
+            Val::Im(parent, name) => match m.as_str() {
+                "addinstance" | "insertinstance" => Ok(self.h.add_instance(parent, &name).map_or(Val::Null, Val::Node)),
+                "removeinstance" => {
+                    let i = self.arg_num(args, 0)?;
+                    if i.is_finite() && i >= 0.0 {
+                        self.h.remove_instance(parent, &name, i as usize);
+                    }
+                    Ok(Val::Null)
+                }
+                "setinstances" => {
+                    let want = self.arg_num(args, 0)?;
+                    if want.is_finite() && want >= 0.0 {
+                        self.h.set_instances(parent, &name, want as usize);
+                    }
+                    Ok(Val::Null)
+                }
+                _ => Ok(Val::Null),
+            },
+            Val::Event | Val::Sink | Val::List(_) => Ok(Val::Null),
+            Val::Null => Err(format!("no object to call {method} on")),
+            Val::Num(_) | Val::Str(_) => Err(format!("{} has no method {method}", self.to_str(&base))),
+        }
+    }
+
+    fn set_val(&self, found: Vec<usize>, many: bool) -> Val {
+        if many {
+            return Val::List(found.into_iter().map(Val::Node).collect());
+        }
+        match found.as_slice() {
+            [] => Val::Null,
+            [one] => Val::Node(*one),
+            all => Val::List(all.iter().map(|i| Val::Node(*i)).collect()),
+        }
+    }
+
+    // ── assignment
+
+    fn assign(&mut self, target: &Expr, v: Val) -> R<()> {
+        let v = self.deref(v);
+        match target {
+            Expr::Ident(name) => {
+                if self.set_var(name, v.clone()) {
+                    return Ok(());
+                }
+                let t = self.ident(name)?;
+                self.assign_to(t, "rawValue", v)
+            }
+            Expr::Member(base, prop) => {
+                let b = self.eval(base)?;
+                self.assign_to(b, prop, v)
+            }
+            Expr::Index(..) | Expr::Descend(..) => {
+                let t = self.eval(target)?;
+                self.assign_to(t, "rawValue", v)
+            }
+            _ => Err("cannot assign to that".into()),
+        }
+    }
+
+    fn assign_to(&mut self, target: Val, prop: &str, v: Val) -> R<()> {
+        match target {
+            Val::Node(i) => {
+                let Some(n) = self.node(i) else { return Ok(()) };
+                let som = n.som.clone();
+                match prop {
+                    "rawValue" | "value" | "formattedValue" => {
+                        let text = self.to_str(&v);
+                        if !self.h.set_value(i, text) {
+                            return Err(format!("{} is not a field", if som.is_empty() { "the form" } else { som.as_str() }));
+                        }
+                    }
+                    "presence" => {
+                        let p = self.to_str(&v);
+                        if matches!(p.as_str(), "visible" | "invisible" | "hidden" | "inactive") {
+                            self.h.set_state(i, XfaEffect::SetPresence { som, presence: p });
+                        }
+                    }
+                    "access" => {
+                        let a = self.to_str(&v);
+                        if matches!(a.as_str(), "open" | "readOnly" | "protected" | "nonInteractive") {
+                            self.h.set_state(i, XfaEffect::SetAccess { som, access: a });
+                        }
+                    }
+                    other => {
+                        // `page1.qty = 7`: the child object named by the last step takes the value.
+                        if let Some(child) = other.strip_prefix('_') {
+                            if child_named(self.h, i, child).is_some() {
+                                return self.assign_to(Val::Im(i, child.to_string()), "count", v);
+                            }
+                            return Ok(());
+                        }
+                        let kids = instances(self.h, i, other);
+                        if kids.is_empty() {
+                            return Err(format!("{som} has no {other} to assign to"));
+                        }
+                        for k in kids {
+                            // Every destination copies the value: charge each copy.
+                            self.charge(self.cost(&v))?;
+                            self.assign_to(Val::Node(k), "rawValue", v.clone())?;
+                        }
+                    }
+                }
+                Ok(())
+            }
+            Val::List(items) => {
+                for it in items {
+                    self.charge(self.cost(&v))?;
+                    self.assign_to(it, prop, v.clone())?;
+                }
+                Ok(())
+            }
+            Val::Im(parent, name) if prop.eq_ignore_ascii_case("count") => {
+                let want = self.to_num(&v);
+                if want.is_finite() && want >= 0.0 {
+                    self.h.set_instances(parent, &name, want as usize);
+                }
+                Ok(())
+            }
+            _ => Ok(()),
+        }
+    }
+
+    // ── statements
+
+    /// Run a block; returns how it ended and the value of its last expression statement.
+    pub(super) fn block(&mut self, body: &[Stmt]) -> R<(Flow, Val)> {
+        // Nesting of statements counts like nesting of expressions: both are stack.
+        self.depth += 1;
+        if self.depth > self.max_depth {
+            self.depth -= 1;
+            return Err(TOO_DEEP.into());
+        }
+        let r = self.block_inner(body);
+        self.depth -= 1;
+        r
+    }
+
+    fn block_inner(&mut self, body: &[Stmt]) -> R<(Flow, Val)> {
+        let mut last = Val::Null;
+        for s in body {
+            self.step()?;
+            match self.exec(s)? {
+                (Flow::Next, v) => {
+                    if let Some(v) = v {
+                        last = v;
+                    }
+                    if self.exited {
+                        return Ok((Flow::Exit, last));
+                    }
+                }
+                (flow, _) => return Ok((flow, last)),
+            }
+        }
+        Ok((Flow::Next, last))
+    }
+
+    fn exec(&mut self, s: &Stmt) -> R<(Flow, Option<Val>)> {
+        match s {
+            Stmt::Var(name, init) => {
+                let v = match init {
+                    Some(e) => {
+                        let v = self.eval(e)?;
+                        self.take(v)?
+                    }
+                    None => Val::Null,
+                };
+                self.declare(name, v.clone());
+                Ok((Flow::Next, Some(v)))
+            }
+            Stmt::Assign(target, e) => {
+                let v = self.eval(e)?;
+                let v = self.take(v)?;
+                self.assign(target, v.clone())?;
+                Ok((Flow::Next, Some(v)))
+            }
+            Stmt::Expr(e) => {
+                let v = self.eval(e)?;
+                let v = self.take(v)?;
+                Ok((Flow::Next, Some(v)))
+            }
+            Stmt::If(arms, otherwise) => {
+                for (cond, body) in arms {
+                    let c = self.eval(cond)?;
+                    if self.truthy(&c) {
+                        let (f, v) = self.block(body)?;
+                        return Ok((f, Some(v)));
+                    }
+                }
+                if let Some(body) = otherwise {
+                    let (f, v) = self.block(body)?;
+                    return Ok((f, Some(v)));
+                }
+                Ok((Flow::Next, None))
+            }
+            Stmt::While(cond, body) => {
+                loop {
+                    let c = self.eval(cond)?;
+                    if !self.truthy(&c) {
+                        break;
+                    }
+                    self.iterate()?;
+                    match self.block(body)? {
+                        (Flow::Break, _) => break,
+                        (Flow::Return(v), _) => return Ok((Flow::Return(v), None)),
+                        (Flow::Exit, _) => return Ok((Flow::Exit, None)),
+                        _ => {}
+                    }
+                }
+                Ok((Flow::Next, None))
+            }
+            Stmt::For { var, from, to, up, step, body } => {
+                let start = {
+                    let v = self.eval(from)?;
+                    self.to_num(&v)
+                };
+                let end = {
+                    let v = self.eval(to)?;
+                    self.to_num(&v)
+                };
+                let by = match step {
+                    Some(e) => {
+                        let v = self.eval(e)?;
+                        self.to_num(&v).abs()
+                    }
+                    None => 1.0,
+                };
+                if by.is_nan() || by <= 0.0 || !start.is_finite() || !end.is_finite() {
+                    return Err("bad for loop bounds".into());
+                }
+                self.declare(var, Val::Num(start));
+                let mut i = start;
+                while if *up { i <= end } else { i >= end } {
+                    self.iterate()?;
+                    self.set_var(var, Val::Num(i));
+                    match self.block(body)? {
+                        (Flow::Break, _) => break,
+                        (Flow::Return(v), _) => return Ok((Flow::Return(v), None)),
+                        (Flow::Exit, _) => return Ok((Flow::Exit, None)),
+                        _ => {}
+                    }
+                    i = if *up { i + by } else { i - by };
+                }
+                Ok((Flow::Next, None))
+            }
+            Stmt::Foreach { var, list, body } => {
+                let items = self.arg_values_keeping(list, true)?;
+                self.declare(var, Val::Null);
+                for it in items {
+                    self.iterate()?;
+                    self.set_var(var, it);
+                    match self.block(body)? {
+                        (Flow::Break, _) => break,
+                        (Flow::Return(v), _) => return Ok((Flow::Return(v), None)),
+                        (Flow::Exit, _) => return Ok((Flow::Exit, None)),
+                        _ => {}
+                    }
+                }
+                Ok((Flow::Next, None))
+            }
+            Stmt::Func { name, f } => {
+                self.funcs.insert(name.to_ascii_lowercase(), Rc::clone(f));
+                Ok((Flow::Next, None))
+            }
+            Stmt::Return(e) => {
+                let v = match e {
+                    Some(e) => {
+                        let v = self.eval(e)?;
+                        self.take(v)?
+                    }
+                    None => Val::Null,
+                };
+                Ok((Flow::Return(v), None))
+            }
+            Stmt::Break => Ok((Flow::Break, None)),
+            Stmt::Continue => Ok((Flow::Continue, None)),
+            Stmt::Exit => Ok((Flow::Exit, None)),
+            Stmt::Throw(e) => {
+                let v = self.eval(e)?;
+                self.charge(self.cost(&v))?;
+                // The thrown value becomes the error message the caller keeps: cut it as
+                // messages are.
+                Err(clip(self.to_str(&v)))
+            }
+        }
+    }
+
+    fn iterate(&mut self) -> R<()> {
+        if self.loops_left == 0 {
+            return Err(LOOPED_TOO_MUCH.into());
+        }
+        self.loops_left -= 1;
+        Ok(())
+    }
+}
diff --git a/crates/js/src/formcalc/lexer.rs b/crates/js/src/formcalc/lexer.rs
new file mode 100644
index 0000000000..ba9ae4f16a
--- /dev/null
+++ b/crates/js/src/formcalc/lexer.rs
@@ -0,0 +1,129 @@
+use super::*;
+
+// ── lexer ───────────────────────────────────────────────────────────────────────────────────
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Tok {
+    Num(f64),
+    Str(String),
+    Ident(String),
+    Op(&'static str),
+    Newline,
+    Eof,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Token {
+    pub(super) tok: Tok,
+    pub(super) line: usize,
+}
+
+const OPS: [&str; 20] = ["<=", ">=", "==", "<>", "..", "(", ")", "[", "]", ".", ",", "=", "<", ">", "+", "-", "*", "/", "&", "|"];
+
+pub(super) fn lex(src: &str) -> Result<Vec<Token>, String> {
+    let chars: Vec<char> = src.chars().collect();
+    let mut out = Vec::new();
+    let mut i = 0;
+    let mut line = 1;
+    let mut depth = 0usize;
+    while i < chars.len() {
+        let c = chars[i];
+        match c {
+            '\n' => {
+                line += 1;
+                i += 1;
+                // Newlines inside brackets continue the expression.
+                if depth == 0 {
+                    out.push(Token { tok: Tok::Newline, line });
+                }
+            }
+            ' ' | '\t' | '\r' => i += 1,
+            ';' => {
+                while i < chars.len() && chars[i] != '\n' {
+                    i += 1;
+                }
+            }
+            '/' if chars.get(i + 1) == Some(&'/') => {
+                while i < chars.len() && chars[i] != '\n' {
+                    i += 1;
+                }
+            }
+            '"' => {
+                let mut s = String::new();
+                i += 1;
+                loop {
+                    match chars.get(i) {
+                        None => return Err(format!("line {line}: unterminated string")),
+                        Some('"') if chars.get(i + 1) == Some(&'"') => {
+                            s.push('"');
+                            i += 2;
+                        }
+                        Some('"') => {
+                            i += 1;
+                            break;
+                        }
+                        Some(&ch) => {
+                            if ch == '\n' {
+                                line += 1;
+                            }
+                            s.push(ch);
+                            i += 1;
+                        }
+                    }
+                    if s.len() > MAX_STRING {
+                        return Err(format!("line {line}: a string is too long"));
+                    }
+                }
+                out.push(Token { tok: Tok::Str(s), line });
+            }
+            c if c.is_ascii_digit() || (c == '.' && chars.get(i + 1).is_some_and(char::is_ascii_digit)) => {
+                let start = i;
+                while i < chars.len() && (chars[i].is_ascii_digit() || (chars[i] == '.' && chars.get(i + 1) != Some(&'.'))) {
+                    i += 1;
+                }
+                if i < chars.len() && (chars[i] == 'e' || chars[i] == 'E') {
+                    let mut j = i + 1;
+                    if j < chars.len() && (chars[j] == '+' || chars[j] == '-') {
+                        j += 1;
+                    }
+                    if j < chars.len() && chars[j].is_ascii_digit() {
+                        i = j;
+                        while i < chars.len() && chars[i].is_ascii_digit() {
+                            i += 1;
+                        }
+                    }
+                }
+                let text: String = chars[start..i].iter().collect();
+                let n: f64 = text.parse().map_err(|_| format!("line {line}: bad number {text}"))?;
+                out.push(Token { tok: Tok::Num(n), line });
+            }
+            '!' => {
+                out.push(Token { tok: Tok::Ident("!".into()), line });
+                i += 1;
+            }
+            c if c.is_alphabetic() || c == '_' || c == '$' => {
+                let start = i;
+                i += 1;
+                while i < chars.len() && (chars[i].is_alphanumeric() || chars[i] == '_' || chars[i] == '$') {
+                    i += 1;
+                }
+                let text: String = chars[start..i].iter().collect();
+                out.push(Token { tok: Tok::Ident(text), line });
+            }
+            _ => {
+                let rest: String = chars[i..chars.len().min(i + 2)].iter().collect();
+                let op = OPS.iter().find(|o| rest.starts_with(*o)).copied().ok_or_else(|| format!("line {line}: unexpected character {c:?}"))?;
+                match op {
+                    "(" | "[" => depth += 1,
+                    ")" | "]" => depth = depth.saturating_sub(1),
+                    _ => {}
+                }
+                out.push(Token { tok: Tok::Op(op), line });
+                i += op.len();
+            }
+        }
+    }
+    out.push(Token { tok: Tok::Newline, line });
+    out.push(Token { tok: Tok::Eof, line });
+    Ok(out)
+}
diff --git a/crates/js/src/formcalc/parser.rs b/crates/js/src/formcalc/parser.rs
new file mode 100644
index 0000000000..84cf121cde
--- /dev/null
+++ b/crates/js/src/formcalc/parser.rs
@@ -0,0 +1,451 @@
+use super::ast::{Expr, Idx, Stmt};
+use super::lexer::{Tok, Token, lex};
+use super::*;
+
+struct Parser {
+    toks: Vec<Token>,
+    at: usize,
+    depth: usize,
+    /// Operators and accessors chained so far in the expression being parsed.
+    chain: usize,
+}
+
+fn kw(t: &Tok, word: &str) -> bool {
+    matches!(t, Tok::Ident(s) if s.eq_ignore_ascii_case(word))
+}
+
+impl Parser {
+    fn peek(&self) -> &Tok {
+        self.toks.get(self.at).map_or(&Tok::Eof, |t| &t.tok)
+    }
+
+    fn line(&self) -> usize {
+        self.toks.get(self.at).map_or(0, |t| t.line)
+    }
+
+    fn next(&mut self) -> Tok {
+        let t = self.peek().clone();
+        self.at += 1;
+        t
+    }
+
+    fn is_op(&self, op: &str) -> bool {
+        matches!(self.peek(), Tok::Op(o) if *o == op)
+    }
+
+    fn eat_op(&mut self, op: &str) -> bool {
+        if self.is_op(op) {
+            self.at += 1;
+            true
+        } else {
+            false
+        }
+    }
+
+    fn expect_op(&mut self, op: &str) -> Result<(), String> {
+        if self.eat_op(op) { Ok(()) } else { Err(format!("line {}: expected {op}", self.line())) }
+    }
+
+    fn eat_kw(&mut self, word: &str) -> bool {
+        if kw(self.peek(), word) {
+            self.at += 1;
+            true
+        } else {
+            false
+        }
+    }
+
+    fn expect_kw(&mut self, word: &str) -> Result<(), String> {
+        if self.eat_kw(word) { Ok(()) } else { Err(format!("line {}: expected {word}", self.line())) }
+    }
+
+    fn skip_newlines(&mut self) {
+        while matches!(self.peek(), Tok::Newline) {
+            self.at += 1;
+        }
+    }
+
+    fn enter(&mut self) -> Result<(), String> {
+        self.depth += 1;
+        if self.depth > MAX_PARSE_DEPTH {
+            return Err("the script is nested too deeply".into());
+        }
+        Ok(())
+    }
+
+    fn leave(&mut self) {
+        self.depth = self.depth.saturating_sub(1);
+    }
+
+    /// One more link in an operator or accessor chain.
+    fn link(&mut self) -> Result<(), String> {
+        self.chain += 1;
+        if self.chain > MAX_CHAIN {
+            return Err(format!("line {}: an expression is too long", self.line()));
+        }
+        Ok(())
+    }
+
+    /// Statements up to one of `enders` (not consumed).
+    fn block(&mut self, enders: &[&str]) -> Result<Vec<Stmt>, String> {
+        self.enter()?;
+        let mut out = Vec::new();
+        loop {
+            self.skip_newlines();
+            match self.peek() {
+                Tok::Eof => break,
+                Tok::Ident(w) if enders.iter().any(|e| w.eq_ignore_ascii_case(e)) => break,
+                _ => out.push(self.statement()?),
+            }
+        }
+        self.leave();
+        Ok(out)
+    }
+
+    fn statement(&mut self) -> Result<Stmt, String> {
+        let line = self.line();
+        match self.peek().clone() {
+            Tok::Ident(w) if w.eq_ignore_ascii_case("var") => {
+                self.at += 1;
+                let Tok::Ident(name) = self.next() else { return Err(format!("line {line}: expected a name after var")) };
+                let init = if self.eat_op("=") { Some(self.top_expr()?) } else { None };
+                Ok(Stmt::Var(name, init))
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("if") => {
+                self.at += 1;
+                let mut arms = Vec::new();
+                let cond = self.top_expr()?;
+                self.expect_kw("then")?;
+                let body = self.block(&["elseif", "else", "endif"])?;
+                arms.push((cond, body));
+                let mut otherwise = None;
+                loop {
+                    if self.eat_kw("elseif") {
+                        let c = self.top_expr()?;
+                        self.expect_kw("then")?;
+                        let b = self.block(&["elseif", "else", "endif"])?;
+                        arms.push((c, b));
+                    } else if self.eat_kw("else") {
+                        otherwise = Some(self.block(&["endif"])?);
+                    } else {
+                        self.expect_kw("endif")?;
+                        break;
+                    }
+                }
+                Ok(Stmt::If(arms, otherwise))
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("while") => {
+                self.at += 1;
+                let cond = self.top_expr()?;
+                self.expect_kw("do")?;
+                let body = self.block(&["endwhile"])?;
+                self.expect_kw("endwhile")?;
+                Ok(Stmt::While(cond, body))
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("for") => {
+                self.at += 1;
+                let Tok::Ident(var) = self.next() else { return Err(format!("line {line}: expected a variable after for")) };
+                self.expect_op("=")?;
+                let from = self.top_expr()?;
+                let up = if self.eat_kw("upto") {
+                    true
+                } else if self.eat_kw("downto") {
+                    false
+                } else {
+                    return Err(format!("line {line}: expected upto or downto"));
+                };
+                let to = self.top_expr()?;
+                let step = if self.eat_kw("step") { Some(self.top_expr()?) } else { None };
+                self.expect_kw("do")?;
+                let body = self.block(&["endfor"])?;
+                self.expect_kw("endfor")?;
+                Ok(Stmt::For { var, from, to, up, step, body })
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("foreach") => {
+                self.at += 1;
+                let Tok::Ident(var) = self.next() else { return Err(format!("line {line}: expected a variable after foreach")) };
+                self.expect_kw("in")?;
+                self.expect_op("(")?;
+                let mut list = Vec::new();
+                if !self.is_op(")") {
+                    loop {
+                        list.push(self.top_expr()?);
+                        if !self.eat_op(",") {
+                            break;
+                        }
+                    }
+                }
+                self.expect_op(")")?;
+                self.expect_kw("do")?;
+                let body = self.block(&["endfor"])?;
+                self.expect_kw("endfor")?;
+                Ok(Stmt::Foreach { var, list, body })
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("func") => {
+                self.at += 1;
+                let Tok::Ident(name) = self.next() else { return Err(format!("line {line}: expected a name after func")) };
+                self.expect_op("(")?;
+                let mut params = Vec::new();
+                if !self.is_op(")") {
+                    loop {
+                        let Tok::Ident(p) = self.next() else { return Err(format!("line {line}: expected a parameter name")) };
+                        params.push(p);
+                        if !self.eat_op(",") {
+                            break;
+                        }
+                    }
+                }
+                self.expect_op(")")?;
+                self.expect_kw("do")?;
+                let body = self.block(&["endfunc"])?;
+                self.expect_kw("endfunc")?;
+                Ok(Stmt::Func { name, f: Rc::new(Func { params, body }) })
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("return") => {
+                self.at += 1;
+                let v = if matches!(self.peek(), Tok::Newline | Tok::Eof) { None } else { Some(self.top_expr()?) };
+                Ok(Stmt::Return(v))
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("break") => {
+                self.at += 1;
+                Ok(Stmt::Break)
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("continue") => {
+                self.at += 1;
+                Ok(Stmt::Continue)
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("exit") => {
+                self.at += 1;
+                Ok(Stmt::Exit)
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("throw") => {
+                self.at += 1;
+                Ok(Stmt::Throw(self.top_expr()?))
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("do") => {
+                // `do … end`: a block as one statement.
+                self.at += 1;
+                let body = self.block(&["end"])?;
+                self.expect_kw("end")?;
+                Ok(Stmt::If(vec![(Expr::Num(1.0), body)], None))
+            }
+            _ => {
+                let e = self.top_expr()?;
+                if self.eat_op("=") {
+                    let v = self.top_expr()?;
+                    return Ok(Stmt::Assign(e, v));
+                }
+                Ok(Stmt::Expr(e))
+            }
+        }
+    }
+
+    /// An expression that starts a tree of its own (a condition, a bound, a statement's
+    /// expression): its operator chain is counted from zero, whatever came before it.
+    fn top_expr(&mut self) -> Result<Expr, String> {
+        self.chain = 0;
+        self.expr()
+    }
+
+    fn expr(&mut self) -> Result<Expr, String> {
+        self.enter()?;
+        let e = self.or_expr();
+        self.leave();
+        e
+    }
+
+    fn or_expr(&mut self) -> Result<Expr, String> {
+        let mut l = self.and_expr()?;
+        loop {
+            if self.eat_op("|") || self.eat_kw("or") {
+                self.link()?;
+                let r = self.and_expr()?;
+                l = Expr::Bin("|", Box::new(l), Box::new(r));
+            } else {
+                return Ok(l);
+            }
+        }
+    }
+
+    fn and_expr(&mut self) -> Result<Expr, String> {
+        let mut l = self.cmp_expr()?;
+        loop {
+            if self.eat_op("&") || self.eat_kw("and") {
+                self.link()?;
+                let r = self.cmp_expr()?;
+                l = Expr::Bin("&", Box::new(l), Box::new(r));
+            } else {
+                return Ok(l);
+            }
+        }
+    }
+
+    fn cmp_expr(&mut self) -> Result<Expr, String> {
+        let mut l = self.add_expr()?;
+        loop {
+            let op = match self.peek() {
+                Tok::Op("==") => "==",
+                Tok::Op("<>") => "<>",
+                Tok::Op("<=") => "<=",
+                Tok::Op(">=") => ">=",
+                Tok::Op("<") => "<",
+                Tok::Op(">") => ">",
+                Tok::Ident(w) if w.eq_ignore_ascii_case("eq") => "==",
+                Tok::Ident(w) if w.eq_ignore_ascii_case("ne") => "<>",
+                Tok::Ident(w) if w.eq_ignore_ascii_case("le") => "<=",
+                Tok::Ident(w) if w.eq_ignore_ascii_case("ge") => ">=",
+                Tok::Ident(w) if w.eq_ignore_ascii_case("lt") => "<",
+                Tok::Ident(w) if w.eq_ignore_ascii_case("gt") => ">",
+                _ => return Ok(l),
+            };
+            self.at += 1;
+            self.link()?;
+            let r = self.add_expr()?;
+            l = Expr::Bin(op, Box::new(l), Box::new(r));
+        }
+    }
+
+    fn add_expr(&mut self) -> Result<Expr, String> {
+        let mut l = self.mul_expr()?;
+        loop {
+            let op = match self.peek() {
+                Tok::Op("+") => "+",
+                Tok::Op("-") => "-",
+                _ => return Ok(l),
+            };
+            self.at += 1;
+            self.link()?;
+            let r = self.mul_expr()?;
+            l = Expr::Bin(op, Box::new(l), Box::new(r));
+        }
+    }
+
+    fn mul_expr(&mut self) -> Result<Expr, String> {
+        let mut l = self.unary()?;
+        loop {
+            let op = match self.peek() {
+                Tok::Op("*") => "*",
+                Tok::Op("/") => "/",
+                _ => return Ok(l),
+            };
+            self.at += 1;
+            self.link()?;
+            let r = self.unary()?;
+            l = Expr::Bin(op, Box::new(l), Box::new(r));
+        }
+    }
+
+    fn unary(&mut self) -> Result<Expr, String> {
+        self.enter()?;
+        let e = if self.eat_op("-") {
+            Ok(Expr::Neg(Box::new(self.unary()?)))
+        } else if self.eat_op("+") {
+            self.unary()
+        } else if self.eat_kw("not") || matches!(self.peek(), Tok::Ident(w) if w == "!") {
+            if matches!(self.peek(), Tok::Ident(w) if w == "!") {
+                self.at += 1;
+            }
+            Ok(Expr::Not(Box::new(self.unary()?)))
+        } else {
+            self.postfix()
+        };
+        self.leave();
+        e
+    }
+
+    fn postfix(&mut self) -> Result<Expr, String> {
+        let mut e = self.primary()?;
+        loop {
+            if matches!(self.peek(), Tok::Op("." | ".." | "[" | "(")) {
+                self.link()?;
+            }
+            if self.eat_op(".") {
+                let Tok::Ident(name) = self.next() else { return Err(format!("line {}: expected a name after .", self.line())) };
+                e = Expr::Member(Box::new(e), name);
+            } else if self.eat_op("..") {
+                let Tok::Ident(name) = self.next() else { return Err(format!("line {}: expected a name after ..", self.line())) };
+                e = Expr::Descend(Box::new(e), name);
+            } else if self.eat_op("[") {
+                let sign = match self.peek() {
+                    Tok::Op("-") => Some(-1),
+                    Tok::Op("+") => Some(1),
+                    _ => None,
+                };
+                let relative = sign.and_then(|sign| match (self.toks.get(self.at + 1).map(|t| &t.tok), self.toks.get(self.at + 2).map(|t| &t.tok)) {
+                    (Some(Tok::Num(n)), Some(Tok::Op("]"))) if n.is_finite() && *n >= 0.0 && *n < 1e6 => Some(sign * (*n as i64)),
+                    _ => None,
+                });
+                let idx = if let Some(k) = relative {
+                    self.at += 2;
+                    Idx::Rel(k)
+                } else if self.eat_op("*") {
+                    Idx::All
+                } else {
+                    Idx::Abs(Box::new(self.expr()?))
+                };
+                self.expect_op("]")?;
+                e = Expr::Index(Box::new(e), idx);
+            } else if self.eat_op("(") {
+                let mut args = Vec::new();
+                self.skip_newlines();
+                if !self.is_op(")") {
+                    loop {
+                        args.push(self.expr()?);
+                        self.skip_newlines();
+                        if !self.eat_op(",") {
+                            break;
+                        }
+                        self.skip_newlines();
+                    }
+                }
+                self.expect_op(")")?;
+                e = Expr::Call(Box::new(e), args);
+            } else {
+                return Ok(e);
+            }
+        }
+    }
+
+    fn primary(&mut self) -> Result<Expr, String> {
+        let line = self.line();
+        match self.next() {
+            Tok::Num(n) => Ok(Expr::Num(n)),
+            Tok::Str(s) => Ok(Expr::Str(s)),
+            Tok::Op("(") => {
+                self.skip_newlines();
+                let e = self.expr()?;
+                self.skip_newlines();
+                self.expect_op(")")?;
+                Ok(e)
+            }
+            Tok::Ident(w) if w.eq_ignore_ascii_case("null") => Ok(Expr::Null),
+            Tok::Ident(w) if w.eq_ignore_ascii_case("nan") => Ok(Expr::Num(f64::NAN)),
+            Tok::Ident(w) if w.eq_ignore_ascii_case("infinity") => Ok(Expr::Num(f64::INFINITY)),
+            Tok::Ident(w) if w.eq_ignore_ascii_case("true") => Ok(Expr::Num(1.0)),
+            Tok::Ident(w) if w.eq_ignore_ascii_case("false") => Ok(Expr::Num(0.0)),
+            Tok::Ident(w) => Ok(Expr::Ident(w)),
+            t => Err(format!("line {line}: unexpected {}", describe(&t))),
+        }
+    }
+}
+
+fn describe(t: &Tok) -> String {
+    match t {
+        Tok::Num(n) => format!("number {n}"),
+        Tok::Str(s) => format!("string {s:?}"),
+        Tok::Ident(s) => s.clone(),
+        Tok::Op(o) => format!("{o:?}"),
+        Tok::Newline => "end of line".into(),
+        Tok::Eof => "end of script".into(),
+    }
+}
+
+pub(super) fn parse(src: &str) -> Result<Vec<Stmt>, String> {
+    let toks = lex(src)?;
+    let mut p = Parser { toks, at: 0, depth: 0, chain: 0 };
+    let body = p.block(&[])?;
+    match p.peek() {
+        Tok::Eof => Ok(body),
+        t => Err(format!("line {}: unexpected {}", p.line(), describe(t))),
+    }
+}
diff --git a/crates/js/src/formcalc/value.rs b/crates/js/src/formcalc/value.rs
new file mode 100644
index 0000000000..16705e67ec
--- /dev/null
+++ b/crates/js/src/formcalc/value.rs
@@ -0,0 +1,92 @@
+// ── values ──────────────────────────────────────────────────────────────────────────────────
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Val {
+    Null,
+    Num(f64),
+    Str(String),
+    /// A form object, by index in the host.
+    Node(usize),
+    /// Several objects or values (`Row[*]`, `Row[*].Amount`).
+    List(Vec<Val>),
+    Host,
+    Layout,
+    Event,
+    /// `xfa` itself (`xfa.form`, `xfa.host`, …).
+    Xfa,
+    /// The instance manager of `name` under `parent`.
+    Im(usize, String),
+    /// A property object whose contents are not modelled (`$.border.fill…`): reads give
+    /// another sink, writes change nothing.
+    Sink,
+}
+
+/// A number as FormCalc prints it: integers without a fraction, otherwise up to 15 digits.
+pub(super) fn num_text(n: f64) -> String {
+    if !n.is_finite() {
+        return if n.is_nan() {
+            "NaN".into()
+        } else if n > 0.0 {
+            "Infinity".into()
+        } else {
+            "-Infinity".into()
+        };
+    }
+    if n.fract() == 0.0 && n.abs() < 1e15 {
+        return format!("{}", n as i64);
+    }
+    let s = format!("{n:.12}");
+    let s = s.trim_end_matches('0').trim_end_matches('.');
+    if s.is_empty() || s == "-0" { "0".into() } else { s.to_string() }
+}
+
+/// `v` with `decimals` places, rounding exact halves away from zero (Rust's formatter rounds them to even).
+pub(super) fn fixed(v: f64, decimals: usize) -> String {
+    let k = 10f64.powi(decimals.min(20) as i32);
+    let scaled = (v * k).round() / k;
+    // A small negative value rounds to -0.0, which would print as "-0".
+    let scaled = if scaled == 0.0 { 0.0 } else { scaled };
+    format!("{:.decimals$}", if scaled.is_finite() { scaled } else { v })
+}
+
+/// The number a string holds: its leading numeric part (`12abc` → 12), `None` for none.
+pub(super) fn parse_num(s: &str) -> Option<f64> {
+    let t = s.trim();
+    if t.is_empty() {
+        return None;
+    }
+    let mut end = 0;
+    let b = t.as_bytes();
+    let mut seen_digit = false;
+    let mut seen_dot = false;
+    let mut seen_e = false;
+    let mut i = 0;
+    if i < b.len() && (b[i] == b'-' || b[i] == b'+') {
+        i += 1;
+    }
+    while i < b.len() {
+        let c = b[i];
+        if c.is_ascii_digit() {
+            seen_digit = true;
+            end = i + 1;
+        } else if c == b'.' && !seen_dot && !seen_e {
+            seen_dot = true;
+        } else if (c == b'e' || c == b'E') && seen_digit && !seen_e {
+            seen_e = true;
+            if i + 1 < b.len() && (b[i + 1] == b'-' || b[i + 1] == b'+') {
+                i += 1;
+            }
+        } else {
+            break;
+        }
+        i += 1;
+    }
+    if !seen_digit {
+        return None;
+    }
+    t.get(..end).and_then(|p| p.parse::<f64>().ok()).filter(|v| v.is_finite())
+}
+
+pub(super) fn is_numeric_text(s: &str) -> bool {
+    s.trim().parse::<f64>().is_ok_and(f64::is_finite)
+}
diff --git a/crates/js/src/formcalc/words.rs b/crates/js/src/formcalc/words.rs
new file mode 100644
index 0000000000..d0d119abb5
--- /dev/null
+++ b/crates/js/src/formcalc/words.rs
@@ -0,0 +1,75 @@
+const ONES: [&str; 20] = [
+    "Zero",
+    "One",
+    "Two",
+    "Three",
+    "Four",
+    "Five",
+    "Six",
+    "Seven",
+    "Eight",
+    "Nine",
+    "Ten",
+    "Eleven",
+    "Twelve",
+    "Thirteen",
+    "Fourteen",
+    "Fifteen",
+    "Sixteen",
+    "Seventeen",
+    "Eighteen",
+    "Nineteen",
+];
+
+const TENS: [&str; 10] = ["", "", "Twenty", "Thirty", "Forty", "Fifty", "Sixty", "Seventy", "Eighty", "Ninety"];
+
+fn words_below_1000(n: u64) -> String {
+    let mut parts = Vec::new();
+    if n >= 100 {
+        parts.push(format!("{} Hundred", ONES[(n / 100) as usize]));
+    }
+    let r = n % 100;
+    if r >= 20 {
+        parts.push(if r.is_multiple_of(10) {
+            TENS[(r / 10) as usize].to_string()
+        } else {
+            format!("{}-{}", TENS[(r / 10) as usize], ONES[(r % 10) as usize])
+        });
+    } else if r > 0 || n == 0 {
+        parts.push(ONES[r as usize].to_string());
+    }
+    parts.join(" ")
+}
+
+/// `WordNum`: an integer in English words (up to the billions).
+pub(super) fn word_num(n: f64, cents: bool) -> String {
+    if !n.is_finite() || !(0.0..1e12).contains(&n) {
+        return String::new();
+    }
+    let cents_total = (n * 100.0).round() as u64;
+    let whole = if cents { cents_total / 100 } else { n.trunc() as u64 };
+    if whole >= 1_000_000_000_000 {
+        // Rounding to cents carried past the supported range.
+        return String::new();
+    }
+    let mut parts = Vec::new();
+    let groups = [(1_000_000_000u64, "Billion"), (1_000_000, "Million"), (1_000, "Thousand")];
+    let mut rest = whole;
+    for (unit, name) in groups {
+        if rest >= unit {
+            parts.push(format!("{} {name}", words_below_1000(rest / unit)));
+            rest %= unit;
+        }
+    }
+    if rest > 0 || parts.is_empty() {
+        parts.push(words_below_1000(rest));
+    }
+    let mut out = parts.join(" ");
+    if cents {
+        let c = cents_total % 100;
+        let dollars = if whole == 1 { "Dollar" } else { "Dollars" };
+        let cent = if c == 1 { "Cent" } else { "Cents" };
+        out.push_str(&format!(" {dollars} And {c:02} {cent}"));
+    }
+    out
+}
diff --git a/crates/js/src/globals.rs b/crates/js/src/globals.rs
new file mode 100644
index 0000000000..dd487c2482
--- /dev/null
+++ b/crates/js/src/globals.rs
@@ -0,0 +1,239 @@
+use super::document::{field_object, get_field, get_nth_field_name, noop, num_fields, page_num_get, page_num_set, print, reset_form, submit_form};
+use super::format::{printd, printf, printx, scand};
+use super::host::{arg, function, host, s, text, text_line};
+use super::model::{DISPLAY_HIDDEN, DISPLAY_NO_PRINT, DISPLAY_NO_VIEW, DISPLAY_VISIBLE, Event, Panel, Request};
+use super::*;
+
+// ── app, util, console ──────────────────────────────────────────────────────────────────────
+
+/// A message argument: a string, or an object with `cMsg`, cut to a message's length.
+fn message(v: &JsValue, key: &str, ctx: &mut Context) -> JsResult<String> {
+    match v.as_object() {
+        Some(o) if !o.is_array() && !o.is_callable() => {
+            let m = o.get(JsString::from(key), ctx)?;
+            text_line(&m, ctx)
+        }
+        _ => text_line(v, ctx),
+    }
+}
+
+/// `app.alert(cMsg)`: records the message, given as a string or as an object with `cMsg`, and
+/// returns 1 (the OK button).
+fn alert(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let m = message(&arg(args, 0), "cMsg", ctx)?;
+    host(ctx)?.borrow_mut().alert(m);
+    // The OK button.
+    Ok(JsValue::from(1))
+}
+
+/// `app.beep()`: queues a request to beep.
+fn beep(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    host(ctx)?.borrow_mut().request(Request::Beep);
+    Ok(JsValue::undefined())
+}
+
+/// `app.launchURL(cURL)`: queues a request to open the URL, given as a string or as an object
+/// with `cURL`.
+fn launch_url(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let u = message(&arg(args, 0), "cURL", ctx)?;
+    host(ctx)?.borrow_mut().request(Request::LaunchUrl(u));
+    Ok(JsValue::undefined())
+}
+
+/// What `app.execMenuItem(name)` asks for, for the menu items forms use: the side panels, Print
+/// and Save As. Other items do nothing.
+pub(crate) fn menu_item(name: &str) -> Option<Request> {
+    Some(match name {
+        "ShowHideFileAttachment" => Request::ShowPanel(Panel::Attachments),
+        "ShowHideBookmarks" => Request::ShowPanel(Panel::Bookmarks),
+        "ShowHideThumbnails" => Request::ShowPanel(Panel::Pages),
+        "ShowHideSignatures" => Request::ShowPanel(Panel::Signatures),
+        "ShowHideOptCont" => Request::ShowPanel(Panel::Layers),
+        "Print" => Request::Print,
+        // Save opens Save As too, as it always has for XFA forms' buttons: a click on a form
+        // never overwrites the file unasked.
+        "SaveAs" | "Save" => Request::SaveAs,
+        _ => return None,
+    })
+}
+
+/// `app.execMenuItem(name)`: queues the request [`menu_item`] gives for the name (Save opens
+/// Save As too); an unknown name does nothing.
+fn exec_menu_item(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let item = text(&arg(args, 0), ctx)?;
+    if let Some(r) = menu_item(&item) {
+        host(ctx)?.borrow_mut().request(r);
+    }
+    Ok(JsValue::undefined())
+}
+
+/// `app.response(…)`: always `null`, the answer for a canceled dialog, since no one is there to
+/// type one.
+fn response(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    // No one to answer: as if the dialog was cancelled.
+    Ok(JsValue::null())
+}
+
+fn println(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let m = text_line(&arg(args, 0), ctx)?;
+    host(ctx)?.borrow_mut().print(m);
+    Ok(JsValue::undefined())
+}
+
+fn console_clear(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    host(ctx)?.borrow_mut().console.clear();
+    Ok(JsValue::undefined())
+}
+
+fn timer(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    // Timers never fire in the sandbox; scripts get an object they can pass to clear*.
+    Ok(ObjectInitializer::new(ctx).build().into())
+}
+
+/// The `color` object: each named color (`transparent`, `black`, `red`, `cyan`, `gray`, …) as
+/// an array of its color space (`T`, `G`, `RGB` or `CMYK`) followed by its components.
+fn color_object(ctx: &mut Context) -> JsObject {
+    let mut entries: Vec<(&str, Vec<JsValue>)> = vec![
+        ("transparent", vec![s("T")]),
+        ("black", vec![s("G"), 0.into()]),
+        ("white", vec![s("G"), 1.into()]),
+        ("red", vec![s("RGB"), 1.into(), 0.into(), 0.into()]),
+        ("green", vec![s("RGB"), 0.into(), 1.into(), 0.into()]),
+        ("blue", vec![s("RGB"), 0.into(), 0.into(), 1.into()]),
+        ("cyan", vec![s("CMYK"), 1.into(), 0.into(), 0.into(), 0.into()]),
+        ("magenta", vec![s("CMYK"), 0.into(), 1.into(), 0.into(), 0.into()]),
+        ("yellow", vec![s("CMYK"), 0.into(), 0.into(), 1.into(), 0.into()]),
+        ("dkGray", vec![s("G"), JsValue::from(0.25)]),
+        ("gray", vec![s("G"), JsValue::from(0.5)]),
+        ("ltGray", vec![s("G"), JsValue::from(0.75)]),
+    ];
+    let arrays: Vec<(&str, JsValue)> = entries.drain(..).map(|(k, v)| (k, JsArray::from_iter(v, ctx).into())).collect();
+    let mut o = ObjectInitializer::new(ctx);
+    for (k, v) in arrays {
+        o.property(JsString::from(k), v, Attribute::all());
+    }
+    o.build()
+}
+
+/// The XFA version scripts see as `xfa_version`.
+const XFA_VERSION: f64 = 3.5;
+
+/// Defines the form object model's globals: the document's functions (`getField`, `resetForm`,
+/// `print`, `submitForm` and others) and properties (`numFields`, `pageNum`, `numPages`,
+/// `documentFileName`, `info`, the XFA version), and the `app`, `util`, `console`, `display` and
+/// `color` objects.
+pub(crate) fn install(ctx: &mut Context) -> JsResult<()> {
+    let globals: [(&str, usize, NativeFunction); 9] = [
+        ("getField", 1, NativeFunction::from_fn_ptr(get_field)),
+        ("getNthFieldName", 1, NativeFunction::from_fn_ptr(get_nth_field_name)),
+        ("resetForm", 1, NativeFunction::from_fn_ptr(reset_form)),
+        ("print", 1, NativeFunction::from_fn_ptr(print)),
+        ("submitForm", 1, NativeFunction::from_fn_ptr(submit_form)),
+        ("mailDoc", 1, NativeFunction::from_fn_ptr(noop)),
+        ("calculateNow", 0, NativeFunction::from_fn_ptr(noop)),
+        ("syncAnnotScan", 0, NativeFunction::from_fn_ptr(noop)),
+        ("dirty", 0, NativeFunction::from_fn_ptr(noop)),
+    ];
+    for (name, len, f) in globals {
+        ctx.register_global_callable(JsString::from(name), len, f)?;
+    }
+    let global = ctx.global_object();
+    let rw = Attribute::CONFIGURABLE;
+    let nf = function(ctx, NativeFunction::from_fn_ptr(num_fields));
+    let pg = function(ctx, NativeFunction::from_fn_ptr(page_num_get));
+    let ps = function(ctx, NativeFunction::from_fn_ptr(page_num_set));
+    let (file, pages, info, xfa) = {
+        let h = host(ctx)?.borrow();
+        (h.doc.file_name.clone(), h.doc.num_pages, h.doc.info.clone(), h.doc.xfa)
+    };
+    let mut io = ObjectInitializer::new(ctx);
+    for (k, v) in &info {
+        io.property(JsString::from(k.as_str()), s(v), Attribute::all());
+    }
+    let info = io.build();
+    use boa_engine::property::PropertyDescriptor;
+    global.define_property_or_throw(js_string!("numFields"), PropertyDescriptor::builder().get(nf).configurable(true), ctx)?;
+    global.define_property_or_throw(js_string!("pageNum"), PropertyDescriptor::builder().get(pg).set(ps).configurable(true), ctx)?;
+    ctx.register_global_property(js_string!("numPages"), JsValue::from(pages as f64), rw)?;
+    ctx.register_global_property(js_string!("documentFileName"), s(&file), rw)?;
+    ctx.register_global_property(js_string!("info"), info, rw)?;
+    // XFA forms check both before they run: every document sees the XFA version, and only an
+    // XFA form sees `xfa_installed`.
+    ctx.register_global_property(js_string!("xfa_version"), JsValue::from(XFA_VERSION), rw)?;
+    if xfa {
+        ctx.register_global_property(js_string!("xfa_installed"), JsValue::from(true), rw)?;
+    }
+
+    let app = ObjectInitializer::new(ctx)
+        .function(NativeFunction::from_fn_ptr(alert), js_string!("alert"), 1)
+        .function(NativeFunction::from_fn_ptr(beep), js_string!("beep"), 0)
+        .function(NativeFunction::from_fn_ptr(response), js_string!("response"), 1)
+        .function(NativeFunction::from_fn_ptr(launch_url), js_string!("launchURL"), 2)
+        .function(NativeFunction::from_fn_ptr(exec_menu_item), js_string!("execMenuItem"), 1)
+        .function(NativeFunction::from_fn_ptr(timer), js_string!("setTimeOut"), 2)
+        .function(NativeFunction::from_fn_ptr(timer), js_string!("setInterval"), 2)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("clearTimeOut"), 1)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("clearInterval"), 1)
+        .property(js_string!("viewerType"), s("Exchange-Pro"), Attribute::READONLY)
+        .property(js_string!("viewerVariation"), s("Full"), Attribute::READONLY)
+        .property(js_string!("viewerVersion"), JsValue::from(24.0), Attribute::READONLY)
+        .property(js_string!("formsVersion"), JsValue::from(24.0), Attribute::READONLY)
+        .property(js_string!("platform"), s(platform()), Attribute::READONLY)
+        .property(js_string!("language"), s("ENU"), Attribute::READONLY)
+        .build();
+    ctx.register_global_property(js_string!("app"), app, rw)?;
+    let util = ObjectInitializer::new(ctx)
+        .function(NativeFunction::from_fn_ptr(printf), js_string!("printf"), 1)
+        .function(NativeFunction::from_fn_ptr(printd), js_string!("printd"), 2)
+        .function(NativeFunction::from_fn_ptr(printx), js_string!("printx"), 2)
+        .function(NativeFunction::from_fn_ptr(scand), js_string!("scand"), 2)
+        .build();
+    ctx.register_global_property(js_string!("util"), util, rw)?;
+    let console = ObjectInitializer::new(ctx)
+        .function(NativeFunction::from_fn_ptr(println), js_string!("println"), 1)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("show"), 0)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("hide"), 0)
+        .function(NativeFunction::from_fn_ptr(console_clear), js_string!("clear"), 0)
+        .build();
+    ctx.register_global_property(js_string!("console"), console, rw)?;
+    let display = ObjectInitializer::new(ctx)
+        .property(js_string!("visible"), DISPLAY_VISIBLE, Attribute::READONLY)
+        .property(js_string!("hidden"), DISPLAY_HIDDEN, Attribute::READONLY)
+        .property(js_string!("noPrint"), DISPLAY_NO_PRINT, Attribute::READONLY)
+        .property(js_string!("noView"), DISPLAY_NO_VIEW, Attribute::READONLY)
+        .build();
+    ctx.register_global_property(js_string!("display"), display, rw)?;
+    let color = color_object(ctx);
+    ctx.register_global_property(js_string!("color"), color, rw)?;
+    Ok(())
+}
+
+pub(crate) fn platform() -> &'static str {
+    if cfg!(target_os = "macos") {
+        "MAC"
+    } else if cfg!(target_os = "windows") {
+        "WIN"
+    } else {
+        "UNIX"
+    }
+}
+
+pub(crate) fn event_object(ctx: &mut Context, e: &Event) -> JsObject {
+    let target = e.target.as_ref().map_or(JsValue::null(), |t| field_object(ctx, t).into());
+    ObjectInitializer::new(ctx)
+        .property(js_string!("name"), s(&e.name), Attribute::all())
+        .property(js_string!("type"), s(&e.kind), Attribute::all())
+        .property(js_string!("value"), s(&e.value), Attribute::all())
+        .property(js_string!("change"), s(&e.change), Attribute::all())
+        .property(js_string!("changeEx"), s(&e.change), Attribute::all())
+        .property(js_string!("willCommit"), e.will_commit, Attribute::all())
+        .property(js_string!("rc"), true, Attribute::all())
+        .property(js_string!("target"), target, Attribute::all())
+        .property(js_string!("targetName"), s(e.target.as_deref().unwrap_or("")), Attribute::all())
+        .property(js_string!("selStart"), 0, Attribute::all())
+        .property(js_string!("selEnd"), 0, Attribute::all())
+        .property(js_string!("commitKey"), 0, Attribute::all())
+        .property(js_string!("modifier"), false, Attribute::all())
+        .property(js_string!("shift"), false, Attribute::all())
+        .build()
+}
diff --git a/crates/js/src/host.rs b/crates/js/src/host.rs
new file mode 100644
index 0000000000..131b8851c9
--- /dev/null
+++ b/crates/js/src/host.rs
@@ -0,0 +1,197 @@
+use super::model::{DocInfo, FieldState, FieldType, Request};
+use super::run::MAX_ARRAY_LENGTH;
+use super::*;
+
+pub(crate) struct Host {
+    pub(crate) fields: Arc<Vec<FieldState>>,
+    pub(crate) changed: BTreeSet<usize>,
+    pub(crate) alerts: Vec<String>,
+    pub(crate) console: Vec<String>,
+    pub(crate) requests: Vec<Request>,
+    pub(crate) doc: DocInfo,
+    /// Bytes of text kept in alerts, console lines and requests, against [`xfa::MAX_PAYLOAD`].
+    pub(crate) kept: usize,
+    /// Alerts, console lines and requests the limits left out.
+    pub(crate) dropped: usize,
+}
+
+impl Host {
+    /// Room for `bytes` more bytes of kept text: charged when there is, a drop counted when not.
+    fn room(&mut self, bytes: usize) -> bool {
+        match self.kept.checked_add(bytes).filter(|k| *k <= xfa::MAX_PAYLOAD) {
+            Some(k) => {
+                self.kept = k;
+                true
+            }
+            None => {
+                self.dropped = self.dropped.saturating_add(1);
+                false
+            }
+        }
+    }
+
+    pub(crate) fn alert(&mut self, m: String) {
+        if self.alerts.len() >= xfa::MAX_ALERTS {
+            self.dropped = self.dropped.saturating_add(1);
+        } else if self.room(m.len()) {
+            self.alerts.push(m);
+        }
+    }
+
+    pub(crate) fn print(&mut self, m: String) {
+        if self.console.len() >= xfa::MAX_CONSOLE {
+            self.dropped = self.dropped.saturating_add(1);
+        } else if self.room(m.len()) {
+            self.console.push(m);
+        }
+    }
+
+    /// Record `r`, its names and URLs cut to a message's length, up to [`xfa::MAX_EFFECTS`]
+    /// requests and the run's byte budget.
+    pub(crate) fn request(&mut self, r: Request) {
+        if self.requests.len() >= xfa::MAX_EFFECTS {
+            self.dropped = self.dropped.saturating_add(1);
+            return;
+        }
+        let r = match r {
+            Request::Reset(names) => Request::Reset(names.into_iter().map(xfa::clip).collect()),
+            Request::LaunchUrl(u) => Request::LaunchUrl(xfa::clip(u)),
+            Request::Submit(u) => Request::Submit(xfa::clip(u)),
+            Request::Focus(n) => Request::Focus(xfa::clip(n)),
+            other => other,
+        };
+        let bytes = match &r {
+            Request::Reset(names) => names.iter().fold(0usize, |n, s| n.saturating_add(s.len()).saturating_add(std::mem::size_of::<String>())),
+            Request::LaunchUrl(u) | Request::Submit(u) | Request::Focus(u) => u.len(),
+            _ => 0,
+        };
+        if self.room(bytes) {
+            self.requests.push(r);
+        }
+    }
+}
+
+pub(crate) type Shared = RefCell<Host>;
+
+/// The host state, installed before scripts run.
+pub(crate) fn host(ctx: &Context) -> JsResult<&Shared> {
+    ctx.get_data::<Shared>().ok_or_else(|| error("the script host is not set up"))
+}
+
+pub(crate) fn s(v: &str) -> JsValue {
+    JsValue::from(JsString::from(v))
+}
+
+pub(crate) fn text(v: &JsValue, ctx: &mut Context) -> JsResult<String> {
+    if v.is_undefined() || v.is_null() {
+        return Ok(String::new());
+    }
+    Ok(v.to_string(ctx)?.to_std_string_escaped())
+}
+
+/// [`text`] cut to a message's length ([`xfa::clip`]), without first copying all of a longer
+/// string.
+pub(crate) fn text_line(v: &JsValue, ctx: &mut Context) -> JsResult<String> {
+    if v.is_undefined() || v.is_null() {
+        return Ok(String::new());
+    }
+    let js = v.to_string(ctx)?;
+    // Two UTF-16 units per character at most: the clip still sees more than a line's worth.
+    let keep = xfa::MAX_LINE.saturating_add(1).saturating_mul(2);
+    let js = if js.len() > keep { js.get(..keep).unwrap_or_default() } else { js };
+    Ok(xfa::clip(js.to_std_string_escaped()))
+}
+
+pub(crate) fn arg(args: &[JsValue], i: usize) -> JsValue {
+    args.get(i).cloned().unwrap_or_default()
+}
+
+pub(crate) fn error(msg: impl Into<String>) -> JsError {
+    JsNativeError::typ().with_message(msg.into()).into()
+}
+
+/// A JavaScript number for a text value that reads as one, as Acrobat's `field.value` gives.
+pub(crate) fn as_number(t: &str) -> Option<f64> {
+    let t = t.trim();
+    if t.is_empty() || t.starts_with('+') || t.len() > 1 && t.starts_with('0') && !t.starts_with("0.") {
+        return None;
+    }
+    t.parse::<f64>().ok().filter(|v| v.is_finite())
+}
+
+pub(crate) fn function(ctx: &mut Context, f: NativeFunction) -> JsFunction {
+    FunctionObjectBuilder::new(ctx.realm(), f).build()
+}
+
+pub(crate) fn strings(v: &JsValue, ctx: &mut Context) -> JsResult<Vec<String>> {
+    if let Some(o) = v.as_object()
+        && o.is_array()
+    {
+        let a = JsArray::from_object(o.clone())?;
+        let n = a.length(ctx)?;
+        if n > MAX_ARRAY_LENGTH {
+            return Err(error(format!("array length exceeds {MAX_ARRAY_LENGTH}")));
+        }
+        let mut out = Vec::new();
+        for i in 0..n {
+            let x = a.get(i, ctx)?;
+            out.push(text(&x, ctx)?);
+        }
+        return Ok(out);
+    }
+    Ok(if v.is_undefined() || v.is_null() { Vec::new() } else { vec![text(v, ctx)?] })
+}
+
+pub(crate) fn colour(c: &Option<Vec<String>>, ctx: &mut Context) -> JsValue {
+    match c {
+        None => JsArray::from_iter([s("T")], ctx).into(),
+        Some(parts) => {
+            let vals: Vec<JsValue> =
+                parts.iter().enumerate().map(|(i, p)| if i == 0 { s(p) } else { JsValue::from(p.parse::<f64>().unwrap_or(0.0)) }).collect();
+            JsArray::from_iter(vals, ctx).into()
+        }
+    }
+}
+
+// ── field objects ───────────────────────────────────────────────────────────────────────────
+
+fn field_index(ctx: &Context, name: &JsString) -> JsResult<usize> {
+    let n = name.to_std_string_escaped();
+    host(ctx)?.borrow().fields.iter().position(|f| f.name == n).ok_or_else(|| error(format!("no field named {n}")))
+}
+
+pub(crate) fn read(ctx: &Context, name: &JsString) -> JsResult<FieldState> {
+    let i = field_index(ctx, name)?;
+    Ok(host(ctx)?.borrow().fields[i].clone())
+}
+
+pub(crate) fn write(ctx: &Context, name: &JsString, change: impl FnOnce(&mut FieldState)) -> JsResult<()> {
+    let i = field_index(ctx, name)?;
+    let mut h = host(ctx)?.borrow_mut();
+    let field = Arc::make_mut(&mut h.fields).get_mut(i).ok_or_else(|| error("the field is no longer available"))?;
+    change(field);
+    h.changed.insert(i);
+    Ok(())
+}
+
+pub(crate) fn value_of(f: &FieldState, ctx: &mut Context) -> JsValue {
+    match f.kind {
+        FieldType::CheckBox | FieldType::RadioButton => s(f.value.first().map_or("Off", String::as_str)),
+        FieldType::ListBox if f.value.len() > 1 => {
+            let vals: Vec<JsValue> = f.value.iter().map(|v| s(v)).collect();
+            JsArray::from_iter(vals, ctx).into()
+        }
+        _ => {
+            let v = f.single();
+            as_number(&v).map_or_else(|| s(&v), JsValue::from)
+        }
+    }
+}
+
+pub(crate) fn set_value(f: &mut FieldState, vals: Vec<String>) {
+    f.value = match f.kind {
+        FieldType::CheckBox | FieldType::RadioButton => vals.into_iter().filter(|v| v != "Off" && !v.is_empty()).take(1).collect(),
+        FieldType::ListBox => vals,
+        _ => vals.into_iter().take(1).collect(),
+    };
+}
diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index 4db899c1c1..896ad3466d 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -34,1712 +34,27 @@ use boa_engine::property::Attribute;
 use boa_engine::realm::Realm;
 use boa_engine::{Context, JsError, JsNativeError, JsObject, JsResult, JsString, JsValue, NativeFunction, Source, js_string};
 
-/// The kinds of field, as `field.type` names them.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum FieldType {
-    Text,
-    CheckBox,
-    RadioButton,
-    ComboBox,
-    ListBox,
-    Button,
-    Signature,
-}
+mod document;
+mod format;
+mod globals;
+mod host;
+mod model;
+mod run;
 
-impl FieldType {
-    pub fn name(self) -> &'static str {
-        match self {
-            FieldType::Text => "text",
-            FieldType::CheckBox => "checkbox",
-            FieldType::RadioButton => "radiobutton",
-            FieldType::ComboBox => "combobox",
-            FieldType::ListBox => "listbox",
-            FieldType::Button => "button",
-            FieldType::Signature => "signature",
-        }
-    }
-}
-
-/// `display.*`: visible, hidden, noPrint, noView.
-pub const DISPLAY_VISIBLE: i32 = 0;
-pub const DISPLAY_HIDDEN: i32 = 1;
-pub const DISPLAY_NO_PRINT: i32 = 2;
-pub const DISPLAY_NO_VIEW: i32 = 3;
-
-/// A field as scripts see it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct FieldState {
-    pub name: String,
-    pub kind: FieldType,
-    /// Text: the text. Check box / radio: the selected export value (empty when off). Choice:
-    /// the selected export values.
-    pub value: Vec<String>,
-    pub default: Vec<String>,
-    pub readonly: bool,
-    pub required: bool,
-    pub display: i32,
-    /// Choice options (export value, display text); check boxes and radios: their export
-    /// values, one per widget.
-    pub options: Vec<(String, String)>,
-    pub char_limit: Option<usize>,
-    /// `textColor` / `fillColor` as Acrobat colour arrays (`["RGB", r, g, b]` etc.), when set.
-    pub text_color: Option<Vec<String>>,
-    pub fill_color: Option<Vec<String>>,
-}
-
-impl FieldState {
-    pub fn new(name: impl Into<String>, kind: FieldType, value: Vec<String>) -> FieldState {
-        FieldState {
-            name: name.into(),
-            kind,
-            value,
-            default: Vec::new(),
-            readonly: false,
-            required: false,
-            display: DISPLAY_VISIBLE,
-            options: Vec::new(),
-            char_limit: None,
-            text_color: None,
-            fill_color: None,
-        }
-    }
-
-    fn single(&self) -> String {
-        self.value.first().cloned().unwrap_or_default()
-    }
-}
-
-/// The event a script runs for.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Event {
-    /// `Keystroke`, `Validate`, `Calculate`, `Format`, `Mouse Up`, `Open`, …
-    pub name: String,
-    /// `Field`, `Doc`, `Page`, …
-    pub kind: String,
-    /// The field the event is for.
-    pub target: Option<String>,
-    pub value: String,
-    pub change: String,
-    pub will_commit: bool,
-}
-
-impl Event {
-    /// A field event (`event.type` = "Field").
-    pub fn field(name: &str, target: &str, value: &str) -> Event {
-        Event { name: name.into(), kind: "Field".into(), target: Some(target.into()), value: value.into(), change: String::new(), will_commit: true }
-    }
-
-    /// A document event (`event.type` = "Doc"), e.g. Open or WillSave.
-    pub fn doc(name: &str) -> Event {
-        Event { name: name.into(), kind: "Doc".into(), target: None, value: String::new(), change: String::new(), will_commit: false }
-    }
-}
-
-/// About the document, for `this.numPages`, `this.info` and the like.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct DocInfo {
-    pub file_name: String,
-    pub num_pages: usize,
-    /// The current page, 0-based.
-    pub page: usize,
-    /// Document information (`this.info.title` etc.): lower-case key, value.
-    pub info: Vec<(String, String)>,
-    /// The document has an XFA form, so scripts see `xfa_installed`.
-    pub xfa: bool,
-}
-
-/// Something a script asked the viewer to do.
-#[derive(Clone, Debug, PartialEq)]
-pub enum Request {
-    /// `this.resetForm([names])` (empty: every field).
-    Reset(Vec<String>),
-    Print,
-    /// `this.pageNum = n` (0-based).
-    GoToPage(usize),
-    LaunchUrl(String),
-    /// `this.submitForm(url)`: never sent on PdfCraft's own.
-    Submit(String),
-    /// `field.setFocus()`.
-    Focus(String),
-    Beep,
-    /// `app.execMenuItem("SaveAs")` (XFA forms' Save buttons).
-    SaveAs,
-    /// `app.execMenuItem("ShowHide…")`: show the side panel, or hide it when it is showing.
-    ShowPanel(Panel),
-}
-
-/// A side panel a script can show or hide (`app.execMenuItem("ShowHideFileAttachment")`, …).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Panel {
-    /// The document's bookmarks (outline).
-    Bookmarks,
-    /// Page thumbnails.
-    Pages,
-    /// The files attached to the document.
-    Attachments,
-    /// The document's signatures and their validity.
-    Signatures,
-    /// The document's layers (optional content).
-    Layers,
-}
-
-impl Panel {
-    /// The panel's name in automation output, fixed whatever the variant is called.
-    pub fn id(self) -> &'static str {
-        match self {
-            Panel::Bookmarks => "bookmarks",
-            Panel::Pages => "pages",
-            Panel::Attachments => "attachments",
-            Panel::Signatures => "signatures",
-            Panel::Layers => "layers",
-        }
-    }
-}
-
-/// What running a script did.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Outcome {
-    /// `event.rc`: `false` rejects the keystroke or value.
-    pub rc: bool,
-    /// `event.value` after the script.
-    pub value: String,
-    pub change: String,
-    /// Fields whose value or properties the script changed, as they are now.
-    pub changed: Vec<FieldState>,
-    pub alerts: Vec<String>,
-    pub console: Vec<String>,
-    pub requests: Vec<Request>,
-    /// The script's error (syntax error, exception, or a limit reached), if it failed.
-    pub error: Option<String>,
-    /// Errors in the document-level scripts that ran first. Each is a script of its own: one
-    /// that throws stops where it failed, and the others and the script itself still run (#3940).
-    pub doc_errors: Vec<String>,
-    /// The script's completion value (what the console prints), unless undefined.
-    pub result: Option<String>,
-}
-
-/// Bounds that keep a script from hanging the viewer.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct Limits {
-    pub loop_iterations: u64,
-    pub recursion: usize,
-}
-
-impl Default for Limits {
-    fn default() -> Self {
-        Limits { loop_iterations: 1_000_000, recursion: 256 }
-    }
-}
-
-struct Host {
-    fields: Arc<Vec<FieldState>>,
-    changed: BTreeSet<usize>,
-    alerts: Vec<String>,
-    console: Vec<String>,
-    requests: Vec<Request>,
-    doc: DocInfo,
-    /// Bytes of text kept in alerts, console lines and requests, against [`xfa::MAX_PAYLOAD`].
-    kept: usize,
-    /// Alerts, console lines and requests the limits left out.
-    dropped: usize,
-}
-
-impl Host {
-    /// Room for `bytes` more bytes of kept text: charged when there is, a drop counted when not.
-    fn room(&mut self, bytes: usize) -> bool {
-        match self.kept.checked_add(bytes).filter(|k| *k <= xfa::MAX_PAYLOAD) {
-            Some(k) => {
-                self.kept = k;
-                true
-            }
-            None => {
-                self.dropped = self.dropped.saturating_add(1);
-                false
-            }
-        }
-    }
-
-    fn alert(&mut self, m: String) {
-        if self.alerts.len() >= xfa::MAX_ALERTS {
-            self.dropped = self.dropped.saturating_add(1);
-        } else if self.room(m.len()) {
-            self.alerts.push(m);
-        }
-    }
-
-    fn print(&mut self, m: String) {
-        if self.console.len() >= xfa::MAX_CONSOLE {
-            self.dropped = self.dropped.saturating_add(1);
-        } else if self.room(m.len()) {
-            self.console.push(m);
-        }
-    }
-
-    /// Record `r`, its names and URLs cut to a message's length, up to [`xfa::MAX_EFFECTS`]
-    /// requests and the run's byte budget.
-    fn request(&mut self, r: Request) {
-        if self.requests.len() >= xfa::MAX_EFFECTS {
-            self.dropped = self.dropped.saturating_add(1);
-            return;
-        }
-        let r = match r {
-            Request::Reset(names) => Request::Reset(names.into_iter().map(xfa::clip).collect()),
-            Request::LaunchUrl(u) => Request::LaunchUrl(xfa::clip(u)),
-            Request::Submit(u) => Request::Submit(xfa::clip(u)),
-            Request::Focus(n) => Request::Focus(xfa::clip(n)),
-            other => other,
-        };
-        let bytes = match &r {
-            Request::Reset(names) => names.iter().fold(0usize, |n, s| n.saturating_add(s.len()).saturating_add(std::mem::size_of::<String>())),
-            Request::LaunchUrl(u) | Request::Submit(u) | Request::Focus(u) => u.len(),
-            _ => 0,
-        };
-        if self.room(bytes) {
-            self.requests.push(r);
-        }
-    }
-}
-
-type Shared = RefCell<Host>;
-
-/// The host state, installed before scripts run.
-fn host(ctx: &Context) -> JsResult<&Shared> {
-    ctx.get_data::<Shared>().ok_or_else(|| error("the script host is not set up"))
-}
-
-fn s(v: &str) -> JsValue {
-    JsValue::from(JsString::from(v))
-}
-
-fn text(v: &JsValue, ctx: &mut Context) -> JsResult<String> {
-    if v.is_undefined() || v.is_null() {
-        return Ok(String::new());
-    }
-    Ok(v.to_string(ctx)?.to_std_string_escaped())
-}
-
-/// [`text`] cut to a message's length ([`xfa::clip`]), without first copying all of a longer
-/// string.
-fn text_line(v: &JsValue, ctx: &mut Context) -> JsResult<String> {
-    if v.is_undefined() || v.is_null() {
-        return Ok(String::new());
-    }
-    let js = v.to_string(ctx)?;
-    // Two UTF-16 units per character at most: the clip still sees more than a line's worth.
-    let keep = xfa::MAX_LINE.saturating_add(1).saturating_mul(2);
-    let js = if js.len() > keep { js.get(..keep).unwrap_or_default() } else { js };
-    Ok(xfa::clip(js.to_std_string_escaped()))
-}
-
-fn arg(args: &[JsValue], i: usize) -> JsValue {
-    args.get(i).cloned().unwrap_or_default()
-}
-
-fn error(msg: impl Into<String>) -> JsError {
-    JsNativeError::typ().with_message(msg.into()).into()
-}
-
-/// A JavaScript number for a text value that reads as one, as Acrobat's `field.value` gives.
-fn as_number(t: &str) -> Option<f64> {
-    let t = t.trim();
-    if t.is_empty() || t.starts_with('+') || t.len() > 1 && t.starts_with('0') && !t.starts_with("0.") {
-        return None;
-    }
-    t.parse::<f64>().ok().filter(|v| v.is_finite())
-}
-
-fn function(ctx: &mut Context, f: NativeFunction) -> JsFunction {
-    FunctionObjectBuilder::new(ctx.realm(), f).build()
-}
-
-fn strings(v: &JsValue, ctx: &mut Context) -> JsResult<Vec<String>> {
-    if let Some(o) = v.as_object()
-        && o.is_array()
-    {
-        let a = JsArray::from_object(o.clone())?;
-        let n = a.length(ctx)?;
-        if n > MAX_ARRAY_LENGTH {
-            return Err(error(format!("array length exceeds {MAX_ARRAY_LENGTH}")));
-        }
-        let mut out = Vec::new();
-        for i in 0..n {
-            let x = a.get(i, ctx)?;
-            out.push(text(&x, ctx)?);
-        }
-        return Ok(out);
-    }
-    Ok(if v.is_undefined() || v.is_null() { Vec::new() } else { vec![text(v, ctx)?] })
-}
-
-fn colour(c: &Option<Vec<String>>, ctx: &mut Context) -> JsValue {
-    match c {
-        None => JsArray::from_iter([s("T")], ctx).into(),
-        Some(parts) => {
-            let vals: Vec<JsValue> =
-                parts.iter().enumerate().map(|(i, p)| if i == 0 { s(p) } else { JsValue::from(p.parse::<f64>().unwrap_or(0.0)) }).collect();
-            JsArray::from_iter(vals, ctx).into()
-        }
-    }
-}
-
-// ── field objects ───────────────────────────────────────────────────────────────────────────
-
-fn field_index(ctx: &Context, name: &JsString) -> JsResult<usize> {
-    let n = name.to_std_string_escaped();
-    host(ctx)?.borrow().fields.iter().position(|f| f.name == n).ok_or_else(|| error(format!("no field named {n}")))
-}
-
-fn read(ctx: &Context, name: &JsString) -> JsResult<FieldState> {
-    let i = field_index(ctx, name)?;
-    Ok(host(ctx)?.borrow().fields[i].clone())
-}
-
-fn write(ctx: &Context, name: &JsString, change: impl FnOnce(&mut FieldState)) -> JsResult<()> {
-    let i = field_index(ctx, name)?;
-    let mut h = host(ctx)?.borrow_mut();
-    let field = Arc::make_mut(&mut h.fields).get_mut(i).ok_or_else(|| error("the field is no longer available"))?;
-    change(field);
-    h.changed.insert(i);
-    Ok(())
-}
-
-fn value_of(f: &FieldState, ctx: &mut Context) -> JsValue {
-    match f.kind {
-        FieldType::CheckBox | FieldType::RadioButton => s(f.value.first().map_or("Off", String::as_str)),
-        FieldType::ListBox if f.value.len() > 1 => {
-            let vals: Vec<JsValue> = f.value.iter().map(|v| s(v)).collect();
-            JsArray::from_iter(vals, ctx).into()
-        }
-        _ => {
-            let v = f.single();
-            as_number(&v).map_or_else(|| s(&v), JsValue::from)
-        }
-    }
-}
-
-fn set_value(f: &mut FieldState, vals: Vec<String>) {
-    f.value = match f.kind {
-        FieldType::CheckBox | FieldType::RadioButton => vals.into_iter().filter(|v| v != "Off" && !v.is_empty()).take(1).collect(),
-        FieldType::ListBox => vals,
-        _ => vals.into_iter().take(1).collect(),
-    };
-}
-
-macro_rules! getter {
-    ($ctx:expr, $name:expr, |$f:ident, $c:ident| $body:expr) => {{
-        fn get(_: &JsValue, _: &[JsValue], name: &JsString, $c: &mut Context) -> JsResult<JsValue> {
-            let $f = read($c, name)?;
-            Ok($body)
-        }
-        function($ctx, NativeFunction::from_copy_closure_with_captures(get, $name.clone()))
-    }};
-}
-
-fn field_object(ctx: &mut Context, name: &str) -> JsObject {
-    let n = JsString::from(name);
-    let value_get = getter!(ctx, n, |f, c| value_of(&f, c));
-    let value_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let vals = strings(&arg(args, 0), c)?;
-            write(c, name, |f| set_value(f, vals))?;
-            Ok(JsValue::undefined())
-        }
-        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
-    };
-    let as_string = getter!(ctx, n, |f, _c| s(&match f.kind {
-        FieldType::CheckBox | FieldType::RadioButton => f.value.first().cloned().unwrap_or_else(|| "Off".into()),
-        _ => f.value.join(","),
-    }));
-    let default = getter!(ctx, n, |f, _c| s(&f.default.first().cloned().unwrap_or_default()));
-    let kind = getter!(ctx, n, |f, _c| s(f.kind.name()));
-    let fname = getter!(ctx, n, |f, _c| s(&f.name));
-    let readonly_get = getter!(ctx, n, |f, _c| JsValue::from(f.readonly));
-    let readonly_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let on = arg(args, 0).to_boolean();
-            write(c, name, |f| f.readonly = on)?;
-            Ok(JsValue::undefined())
-        }
-        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
-    };
-    let required_get = getter!(ctx, n, |f, _c| JsValue::from(f.required));
-    let required_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let on = arg(args, 0).to_boolean();
-            write(c, name, |f| f.required = on)?;
-            Ok(JsValue::undefined())
-        }
-        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
-    };
-    let display_get = getter!(ctx, n, |f, _c| JsValue::from(f.display));
-    let display_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let d = arg(args, 0).to_number(c)? as i32;
-            write(c, name, |f| f.display = d.clamp(0, 3))?;
-            Ok(JsValue::undefined())
-        }
-        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
-    };
-    let hidden_get = getter!(ctx, n, |f, _c| JsValue::from(f.display == DISPLAY_HIDDEN));
-    let hidden_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let on = arg(args, 0).to_boolean();
-            write(c, name, |f| f.display = if on { DISPLAY_HIDDEN } else { DISPLAY_VISIBLE })?;
-            Ok(JsValue::undefined())
-        }
-        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
-    };
-    let num_items = getter!(ctx, n, |f, _c| JsValue::from(f.options.len() as f64));
-    let char_limit = getter!(ctx, n, |f, _c| JsValue::from(f.char_limit.unwrap_or(0) as f64));
-    let export_values = getter!(ctx, n, |f, c| {
-        let vals: Vec<JsValue> = f.options.iter().map(|o| s(&o.0)).collect();
-        JsArray::from_iter(vals, c).into()
-    });
-    let indices = getter!(ctx, n, |f, c| {
-        let idx: Vec<JsValue> = f.options.iter().enumerate().filter(|(_, o)| f.value.contains(&o.0)).map(|(i, _)| JsValue::from(i as f64)).collect();
-        if idx.len() == 1 { idx[0].clone() } else { JsArray::from_iter(idx, c).into() }
-    });
-    let text_color_get = getter!(ctx, n, |f, c| colour(&f.text_color, c));
-    let text_color_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let v = strings(&arg(args, 0), c)?;
-            write(c, name, |f| f.text_color = Some(v))?;
-            Ok(JsValue::undefined())
-        }
-        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
-    };
-    let fill_color_get = getter!(ctx, n, |f, c| colour(&f.fill_color, c));
-    let fill_color_set = {
-        fn set(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-            let v = strings(&arg(args, 0), c)?;
-            write(c, name, |f| f.fill_color = Some(v))?;
-            Ok(JsValue::undefined())
-        }
-        function(ctx, NativeFunction::from_copy_closure_with_captures(set, n.clone()))
-    };
-
-    fn get_item_at(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-        let f = read(c, name)?;
-        let i = arg(args, 0).to_number(c)?;
-        // bExportValue defaults to true.
-        let export = args.get(1).is_none_or(JsValue::to_boolean);
-        let i = if i < 0.0 { f.options.len().saturating_sub(1) } else { i as usize };
-        let o = f.options.get(i).ok_or_else(|| error(format!("{} has no item {i}", f.name)))?;
-        Ok(s(if export { &o.0 } else { &o.1 }))
-    }
-    fn is_box_checked(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-        let f = read(c, name)?;
-        let i = arg(args, 0).to_number(c)? as usize;
-        let on = f.options.get(i).is_some_and(|o| f.value.first() == Some(&o.0));
-        Ok(JsValue::from(on))
-    }
-    fn check_this_box(_: &JsValue, args: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-        let f = read(c, name)?;
-        let i = arg(args, 0).to_number(c)? as usize;
-        let on = args.get(1).is_none_or(JsValue::to_boolean);
-        let export = f.options.get(i).map(|o| o.0.clone()).ok_or_else(|| error(format!("{} has no widget {i}", f.name)))?;
-        write(c, name, |f| {
-            if on {
-                f.value = vec![export];
-            } else if f.value.first() == Some(&export) {
-                f.value.clear();
-            }
-        })?;
-        Ok(JsValue::undefined())
-    }
-    fn set_focus(_: &JsValue, _: &[JsValue], name: &JsString, c: &mut Context) -> JsResult<JsValue> {
-        host(c)?.borrow_mut().request(Request::Focus(name.to_std_string_escaped()));
-        Ok(JsValue::undefined())
-    }
-
-    let rw = Attribute::CONFIGURABLE | Attribute::ENUMERABLE;
-    let get_item_at = NativeFunction::from_copy_closure_with_captures(get_item_at, n.clone());
-    let is_box_checked = NativeFunction::from_copy_closure_with_captures(is_box_checked, n.clone());
-    let check_this_box = NativeFunction::from_copy_closure_with_captures(check_this_box, n.clone());
-    let set_focus = NativeFunction::from_copy_closure_with_captures(set_focus, n.clone());
-    ObjectInitializer::new(ctx)
-        .accessor(js_string!("value"), Some(value_get), Some(value_set), rw)
-        .accessor(js_string!("valueAsString"), Some(as_string), None, rw)
-        .accessor(js_string!("defaultValue"), Some(default), None, rw)
-        .accessor(js_string!("type"), Some(kind), None, rw)
-        .accessor(js_string!("name"), Some(fname), None, rw)
-        .accessor(js_string!("readonly"), Some(readonly_get), Some(readonly_set), rw)
-        .accessor(js_string!("required"), Some(required_get), Some(required_set), rw)
-        .accessor(js_string!("display"), Some(display_get), Some(display_set), rw)
-        .accessor(js_string!("hidden"), Some(hidden_get), Some(hidden_set), rw)
-        .accessor(js_string!("numItems"), Some(num_items), None, rw)
-        .accessor(js_string!("charLimit"), Some(char_limit), None, rw)
-        .accessor(js_string!("exportValues"), Some(export_values), None, rw)
-        .accessor(js_string!("currentValueIndices"), Some(indices), None, rw)
-        .accessor(js_string!("textColor"), Some(text_color_get), Some(text_color_set), rw)
-        .accessor(js_string!("fillColor"), Some(fill_color_get), Some(fill_color_set), rw)
-        .function(get_item_at, js_string!("getItemAt"), 2)
-        .function(is_box_checked, js_string!("isBoxChecked"), 1)
-        .function(check_this_box, js_string!("checkThisBox"), 2)
-        .function(set_focus, js_string!("setFocus"), 0)
-        .build()
-}
-
-// ── the document (global object) ────────────────────────────────────────────────────────────
-
-fn get_field(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let name = text(&arg(args, 0), ctx)?;
-    let exists = host(ctx)?.borrow().fields.iter().any(|f| f.name == name);
-    if exists {
-        return Ok(field_object(ctx, &name).into());
-    }
-    // A parent name (e.g. "total" for "total.0"): its first kid stands in, as for groups.
-    let prefix = format!("{name}.");
-    let kid = host(ctx)?.borrow().fields.iter().find(|f| f.name.starts_with(&prefix)).map(|f| f.name.clone());
-    Ok(kid.map_or(JsValue::null(), |k| field_object(ctx, &k).into()))
-}
-
-fn get_nth_field_name(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let i = arg(args, 0).to_number(ctx)?;
-    let name = host(ctx)?.borrow().fields.get(i.max(0.0) as usize).map(|f| f.name.clone());
-    Ok(name.map_or(JsValue::null(), |n| s(&n)))
-}
-
-fn reset_form(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let names = strings(&arg(args, 0), ctx)?;
-    host(ctx)?.borrow_mut().request(Request::Reset(names));
-    Ok(JsValue::undefined())
-}
-
-fn print(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    host(ctx)?.borrow_mut().request(Request::Print);
-    Ok(JsValue::undefined())
-}
-
-fn submit_form(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let a = arg(args, 0);
-    let url = match a.as_object() {
-        Some(o) if !o.is_array() => {
-            let u = o.get(js_string!("cURL"), ctx)?;
-            text(&u, ctx)?
-        }
-        _ => text(&a, ctx)?,
-    };
-    host(ctx)?.borrow_mut().request(Request::Submit(url));
-    Ok(JsValue::undefined())
-}
-
-fn noop(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::undefined())
-}
-
-fn num_fields(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(host(ctx)?.borrow().fields.len() as f64))
-}
-
-fn page_num_get(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(host(ctx)?.borrow().doc.page as f64))
-}
-
-fn page_num_set(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let n = arg(args, 0).to_number(ctx)?;
-    let mut h = host(ctx)?.borrow_mut();
-    let last = h.doc.num_pages.saturating_sub(1);
-    let p = (n.max(0.0) as usize).min(last);
-    h.doc.page = p;
-    h.request(Request::GoToPage(p));
-    Ok(JsValue::undefined())
-}
-
-// ── app, util, console ──────────────────────────────────────────────────────────────────────
-
-/// A message argument: a string, or an object with `cMsg`, cut to a message's length.
-fn message(v: &JsValue, key: &str, ctx: &mut Context) -> JsResult<String> {
-    match v.as_object() {
-        Some(o) if !o.is_array() && !o.is_callable() => {
-            let m = o.get(JsString::from(key), ctx)?;
-            text_line(&m, ctx)
-        }
-        _ => text_line(v, ctx),
-    }
-}
-
-/// `app.alert(cMsg)`: records the message, given as a string or as an object with `cMsg`, and
-/// returns 1 (the OK button).
-fn alert(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let m = message(&arg(args, 0), "cMsg", ctx)?;
-    host(ctx)?.borrow_mut().alert(m);
-    // The OK button.
-    Ok(JsValue::from(1))
-}
-
-/// `app.beep()`: queues a request to beep.
-fn beep(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    host(ctx)?.borrow_mut().request(Request::Beep);
-    Ok(JsValue::undefined())
-}
-
-/// `app.launchURL(cURL)`: queues a request to open the URL, given as a string or as an object
-/// with `cURL`.
-fn launch_url(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let u = message(&arg(args, 0), "cURL", ctx)?;
-    host(ctx)?.borrow_mut().request(Request::LaunchUrl(u));
-    Ok(JsValue::undefined())
-}
-
-/// What `app.execMenuItem(name)` asks for, for the menu items forms use: the side panels, Print
-/// and Save As. Other items do nothing.
-pub(crate) fn menu_item(name: &str) -> Option<Request> {
-    Some(match name {
-        "ShowHideFileAttachment" => Request::ShowPanel(Panel::Attachments),
-        "ShowHideBookmarks" => Request::ShowPanel(Panel::Bookmarks),
-        "ShowHideThumbnails" => Request::ShowPanel(Panel::Pages),
-        "ShowHideSignatures" => Request::ShowPanel(Panel::Signatures),
-        "ShowHideOptCont" => Request::ShowPanel(Panel::Layers),
-        "Print" => Request::Print,
-        // Save opens Save As too, as it always has for XFA forms' buttons: a click on a form
-        // never overwrites the file unasked.
-        "SaveAs" | "Save" => Request::SaveAs,
-        _ => return None,
-    })
-}
-
-/// `app.execMenuItem(name)`: queues the request [`menu_item`] gives for the name (Save opens
-/// Save As too); an unknown name does nothing.
-fn exec_menu_item(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let item = text(&arg(args, 0), ctx)?;
-    if let Some(r) = menu_item(&item) {
-        host(ctx)?.borrow_mut().request(r);
-    }
-    Ok(JsValue::undefined())
-}
-
-/// `app.response(…)`: always `null`, the answer for a canceled dialog, since no one is there to
-/// type one.
-fn response(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
-    // No one to answer: as if the dialog was cancelled.
-    Ok(JsValue::null())
-}
-
-fn println(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let m = text_line(&arg(args, 0), ctx)?;
-    host(ctx)?.borrow_mut().print(m);
-    Ok(JsValue::undefined())
-}
-
-fn console_clear(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    host(ctx)?.borrow_mut().console.clear();
-    Ok(JsValue::undefined())
-}
-
-fn timer(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    // Timers never fire in the sandbox; scripts get an object they can pass to clear*.
-    Ok(ObjectInitializer::new(ctx).build().into())
-}
-
-/// `util.printf(cFormat, …)`: `%[,n][+ 0#][width][.prec](d|f|s|x)`, where `,0` groups
-/// thousands with commas (the default), `,1` doesn't, `,2` uses `.` and `,`, `,3` uses `.`
-/// without grouping.
-fn printf(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let fmt = text(&arg(args, 0), ctx)?;
-    let mut out = String::new();
-    let check_output = |len: usize| -> JsResult<()> {
-        if len > MAX_PRINTF_OUTPUT_BYTES {
-            return Err(error(format!("util.printf output exceeds {MAX_PRINTF_OUTPUT_BYTES} bytes")));
-        }
-        Ok(())
-    };
-    let mut next = 1;
-    let mut chars = fmt.chars().peekable();
-    while let Some(c) = chars.next() {
-        if c != '%' {
-            check_output(out.len().saturating_add(c.len_utf8()))?;
-            out.push(c);
-            continue;
-        }
-        if chars.peek() == Some(&'%') {
-            chars.next();
-            check_output(out.len().saturating_add(1))?;
-            out.push('%');
-            continue;
-        }
-        let mut sep = 1u8;
-        if chars.peek() == Some(&',') {
-            chars.next();
-            sep = chars.next().and_then(|d| d.to_digit(10)).unwrap_or(0) as u8;
-        }
-        let (mut plus, mut space, mut zero) = (false, false, false);
-        while let Some(&f) = chars.peek() {
-            match f {
-                '+' => plus = true,
-                ' ' => space = true,
-                '0' => zero = true,
-                '#' => {}
-                _ => break,
-            }
-            chars.next();
-        }
-        let mut width = 0usize;
-        while let Some(d) = chars.peek().and_then(|d| d.to_digit(10)) {
-            width = width.saturating_mul(10).saturating_add(d as usize);
-            chars.next();
-        }
-        let mut prec = None;
-        if chars.peek() == Some(&'.') {
-            chars.next();
-            let mut p = 0usize;
-            while let Some(d) = chars.peek().and_then(|d| d.to_digit(10)) {
-                p = p.saturating_mul(10).saturating_add(d as usize);
-                chars.next();
-            }
-            prec = Some(p);
-        }
-        if width > MAX_PRINTF_WIDTH_PRECISION || prec.is_some_and(|p| p > MAX_PRINTF_WIDTH_PRECISION) {
-            return Err(error(format!("util.printf width or precision exceeds {MAX_PRINTF_WIDTH_PRECISION}")));
-        }
-        let conv = chars.next().unwrap_or('s');
-        let v = arg(args, next);
-        next += 1;
-        let body = match conv {
-            'd' | 'f' => {
-                let n = v.to_number(ctx)?;
-                let p = if conv == 'd' { 0 } else { prec.unwrap_or(6) };
-                let n = if conv == 'd' { n.trunc() } else { n };
-                let mut t = group(&format!("{:.*}", p, n.abs()), sep);
-                if n < 0.0 {
-                    t.insert(0, '-');
-                } else if plus {
-                    t.insert(0, '+');
-                } else if space {
-                    t.insert(0, ' ');
-                }
-                t
-            }
-            'x' => format!("{:X}", v.to_number(ctx)? as i64),
-            _ => {
-                let t = text(&v, ctx)?;
-                match prec {
-                    Some(p) => t.chars().take(p).collect(),
-                    None => t,
-                }
-            }
-        };
-        let pad = width.saturating_sub(body.chars().count());
-        check_output(out.len().saturating_add(pad).saturating_add(body.len()))?;
-        if zero && matches!(conv, 'd' | 'f') {
-            let (sign, digits) = if body.starts_with(['-', '+', ' ']) { body.split_at(1) } else { ("", body.as_str()) };
-            out.push_str(sign);
-            out.push_str(&"0".repeat(pad));
-            out.push_str(digits);
-        } else {
-            out.push_str(&" ".repeat(pad));
-            out.push_str(&body);
-        }
-    }
-    Ok(s(&out))
-}
-
-/// Group the integer part of a plain decimal number per `util.printf`'s `,n` flag.
-fn group(t: &str, sep: u8) -> String {
-    let (int, frac) = t.split_once('.').map_or((t, None), |(a, b)| (a, Some(b)));
-    let (thousands, point) = match sep {
-        0 => (Some(','), '.'),
-        2 => (Some('.'), ','),
-        3 => (None, ','),
-        _ => (None, '.'),
-    };
-    let mut g = String::new();
-    for (i, ch) in int.chars().enumerate() {
-        if let Some(th) = thousands
-            && i > 0
-            && (int.len() - i).is_multiple_of(3)
-        {
-            g.push(th);
-        }
-        g.push(ch);
-    }
-    if let Some(f) = frac {
-        g.push(point);
-        g.push_str(f);
-    }
-    g
-}
-
-const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
-const DAYS: [&str; 7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
-
-/// `util.printd(cFormat, oDate)`: yyyy yy mmmm mmm mm m dddd ddd dd d HH H hh h MM M ss s tt,
-/// and the numeric formats 0 (D:yyyymmddHHMMss), 1 (yyyy.mm.dd HH:MM:ss) and 2 (m/d/yy h:MM:ss tt).
-fn printd(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let f = arg(args, 0);
-    let fmt = if f.is_number() {
-        match f.to_number(ctx)? as i32 {
-            0 => "D:yyyymmddHHMMss".to_string(),
-            1 => "yyyy.mm.dd HH:MM:ss".to_string(),
-            _ => "m/d/yy h:MM:ss tt".to_string(),
-        }
-    } else {
-        text(&f, ctx)?
-    };
-    let d = arg(args, 1);
-    let Some(date) = d.as_object() else { return Err(error("util.printd needs a Date")) };
-    let mut part = |m: &str| -> JsResult<i64> {
-        let func = date.get(JsString::from(m), ctx)?;
-        let func = func.as_callable().ok_or_else(|| error("util.printd needs a Date"))?;
-        let v = func.call(&d, &[], ctx)?.to_number(ctx)?;
-        if v.is_nan() {
-            return Err(error("invalid date"));
-        }
-        Ok(v as i64)
-    };
-    let (y, mo, day, wd, h, mi, sec) =
-        (part("getFullYear")?, part("getMonth")?, part("getDate")?, part("getDay")?, part("getHours")?, part("getMinutes")?, part("getSeconds")?);
-    let mut out = String::new();
-    let b = fmt.as_bytes();
-    let mut i = 0;
-    while i < b.len() {
-        let c = b[i];
-        // Only date letters read as runs; a literal is copied one character at a time, so
-        // measuring its run would rescan a long literal stretch at every position.
-        let run = if b"ymdHhMst".contains(&c) { b[i..].iter().take_while(|x| **x == c).count() } else { 1 };
-        #[cfg(test)]
-        PRINTD_SCANNED.fetch_add(run as u64, std::sync::atomic::Ordering::Relaxed);
-        let push_num = |out: &mut String, v: i64, n: usize| {
-            if n >= 2 {
-                out.push_str(&format!("{v:02}"));
-            } else {
-                out.push_str(&v.to_string());
-            }
-        };
-        match c {
-            b'y' => {
-                if run >= 4 {
-                    out.push_str(&format!("{y:04}"));
-                } else {
-                    out.push_str(&format!("{:02}", y % 100));
-                }
-            }
-            b'm' => match run {
-                r if r >= 4 => out.push_str(MONTHS[mo as usize % 12]),
-                3 => out.push_str(&MONTHS[mo as usize % 12][..3]),
-                n => push_num(&mut out, mo + 1, n),
-            },
-            b'd' => match run {
-                r if r >= 4 => out.push_str(DAYS[wd as usize % 7]),
-                3 => out.push_str(&DAYS[wd as usize % 7][..3]),
-                n => push_num(&mut out, day, n),
-            },
-            b'H' => push_num(&mut out, h, run),
-            b'h' => push_num(&mut out, if h % 12 == 0 { 12 } else { h % 12 }, run),
-            b'M' => push_num(&mut out, mi, run),
-            b's' => push_num(&mut out, sec, run),
-            b't' => {
-                let ampm = if h < 12 { "am" } else { "pm" };
-                out.push_str(if run >= 2 { ampm } else { &ampm[..1] });
-            }
-            b'\\' if i + 1 < b.len() => {
-                // The escaped character may be multi-byte; copy it whole.
-                let ch = fmt[i + 1..].chars().next().unwrap_or(' ');
-                out.push(ch);
-                i += 1 + ch.len_utf8();
-                continue;
-            }
-            _ => {
-                // Copy the rest of a multi-byte character too.
-                let ch = fmt[i..].chars().next().unwrap_or(' ');
-                out.push(ch);
-                i += ch.len_utf8();
-                continue;
-            }
-        }
-        i += run;
-    }
-    Ok(s(&out))
-}
-
-/// A field of a `util.scand` format.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum DateUnit {
-    /// `yyyy`: four digits.
-    Year,
-    /// `yy`: two digits, read as 1950–2049.
-    ShortYear,
-    Month,
-    /// `mmm`, `mmmm`: a month's name or its three-letter abbreviation.
-    MonthName,
-    Day,
-    /// `ddd`, `dddd`: a weekday's name, read and not checked.
-    Weekday,
-    Hour,
-    /// `h`, `hh`: 0–12, with `tt` for the afternoon.
-    Hour12,
-    Minute,
-    Second,
-    /// `t`, `tt`: am or pm.
-    AmPm,
-}
-
-impl DateUnit {
-    /// A year, month or day: a format needs one of these for `util.scand` to read anything.
-    fn is_date(self) -> bool {
-        matches!(self, Self::Year | Self::ShortYear | Self::Month | Self::MonthName | Self::Day)
-    }
-
-    /// Read from a run of digits, not from letters.
-    fn is_numeric(self) -> bool {
-        !matches!(self, Self::MonthName | Self::Weekday | Self::AmPm)
-    }
-}
-
-/// A piece of a `util.scand` format.
-#[derive(Debug, PartialEq, Eq)]
-enum ScanPart {
-    /// A field, the digits it takes when typed together with the next one (`width`), and whether
-    /// the next one follows it with nothing between them in the format (`joined`).
-    Field { unit: DateUnit, width: usize, joined: bool },
-    /// Letters the format writes as they are, which the text must have there.
-    Word(String),
-}
-
-/// The fields and literal words of a `util.scand` format, in order. A numeric field is marked
-/// `joined` when another numeric field follows it directly; anything but letters and digits
-/// outside a field is left out.
-fn scan_parts(fmt: &str) -> Vec<ScanPart> {
-    let chars: Vec<char> = fmt.chars().collect();
-    let mut parts: Vec<ScanPart> = Vec::new();
-    // The last part is a field written right before this point, or letters still being collected.
-    let (mut after_field, mut in_word) = (false, false);
-    let mut i = 0;
-    while let Some(&c) = chars.get(i) {
-        // Counted for field letters only, so a long run of anything else is read once.
-        let run = if "ymdHhMst".contains(c) { chars.get(i..).unwrap_or_default().iter().take_while(|x| **x == c).count() } else { 1 };
-        let field = match (c, run) {
-            ('y', 4..) => Some((DateUnit::Year, 4)),
-            ('y', _) => Some((DateUnit::ShortYear, 2)),
-            ('m', 3..) => Some((DateUnit::MonthName, 0)),
-            ('m', n) => Some((DateUnit::Month, n)),
-            ('d', 3..) => Some((DateUnit::Weekday, 0)),
-            ('d', n) => Some((DateUnit::Day, n)),
-            ('H', n) => Some((DateUnit::Hour, n.min(2))),
-            ('h', n) => Some((DateUnit::Hour12, n.min(2))),
-            ('M', n) => Some((DateUnit::Minute, n.min(2))),
-            ('s', n) => Some((DateUnit::Second, n.min(2))),
-            ('t', _) => Some((DateUnit::AmPm, 0)),
-            _ => None,
-        };
-        if let Some((unit, width)) = field {
-            if after_field
-                && unit.is_numeric()
-                && let Some(ScanPart::Field { unit: last, joined, .. }) = parts.last_mut()
-                && last.is_numeric()
-            {
-                *joined = true;
-            }
-            parts.push(ScanPart::Field { unit, width, joined: false });
-            (after_field, in_word) = (true, false);
-            i += run;
-            continue;
-        }
-        // `\` writes the next character as it is.
-        let (literal, step) = if c == '\\' { (chars.get(i + 1).copied(), 2) } else { (Some(c), 1) };
-        i += step;
-        after_field = false;
-        match literal {
-            Some(l) if l.is_alphanumeric() => match parts.last_mut() {
-                Some(ScanPart::Word(w)) if in_word => w.push(l),
-                _ => {
-                    parts.push(ScanPart::Word(l.to_string()));
-                    in_word = true;
-                }
-            },
-            _ => in_word = false,
-        }
-    }
-    parts
-}
-
-/// A run of digits or of letters in the text `util.scand` reads.
-enum ScanToken<'a> {
-    Digits(&'a str),
-    Letters(&'a str),
-}
-
-/// The text's runs of digits and of letters, in order; anything else only separates them, and
-/// may not begin or end the text. `None` when it does.
-fn scan_tokens(text: &str) -> Option<Vec<ScanToken<'_>>> {
-    // Some(true) for a digit, Some(false) for a letter, None for a separator.
-    let kind = |c: char| (c.is_ascii_digit() || c.is_alphabetic()).then_some(c.is_ascii_digit());
-    kind(text.chars().next()?)?;
-    kind(text.chars().next_back()?)?;
-    let mut out = Vec::new();
-    let mut start: Option<(usize, bool)> = None;
-    for (at, c) in text.char_indices().chain(std::iter::once((text.len(), ' '))) {
-        let k = kind(c);
-        if let Some((from, digits)) = start
-            && k != Some(digits)
-        {
-            let piece = text.get(from..at)?;
-            out.push(if digits { ScanToken::Digits(piece) } else { ScanToken::Letters(piece) });
-            start = None;
-        }
-        if let Some(digits) = k
-            && start.is_none()
-        {
-            start = Some((at, digits));
-        }
-    }
-    Some(out)
-}
-
-/// What `util.scand` reads.
-#[derive(Debug, PartialEq, Eq)]
-enum Scanned {
-    /// The text is empty: today, at noon.
-    Today,
-    /// A date and time: year, month (1–12), day, hours, minutes, seconds.
-    At(i32, u32, u32, u32, u32, u32),
-}
-
-/// The fields `util.scand` has read so far.
-#[derive(Default)]
-struct ScanValues {
-    y: Option<i32>,
-    mo: Option<u32>,
-    d: Option<u32>,
-    h: Option<u32>,
-    mi: Option<u32>,
-    sec: Option<u32>,
-    pm: Option<bool>,
-    /// The hour was read from `h` or `hh`.
-    twelve: bool,
-}
-
-impl ScanValues {
-    /// Records `v` as the value of `unit`: a `yy` year as 1950–2049, and an `h` or `hh` hour
-    /// marked as 12-hour. Month names, weekdays and am/pm are not read here.
-    fn set(&mut self, unit: DateUnit, v: u32) {
-        match unit {
-            DateUnit::Year => self.y = i32::try_from(v).ok(),
-            DateUnit::ShortYear => self.y = i32::try_from(v).ok().map(|v| if v < 50 { 2000 + v } else { 1900 + v }),
-            DateUnit::Month => self.mo = Some(v),
-            DateUnit::Day => self.d = Some(v),
-            DateUnit::Hour => self.h = Some(v),
-            DateUnit::Hour12 => {
-                self.h = Some(v);
-                self.twelve = true;
-            }
-            DateUnit::Minute => self.mi = Some(v),
-            DateUnit::Second => self.sec = Some(v),
-            DateUnit::MonthName | DateUnit::Weekday | DateUnit::AmPm => {}
-        }
-    }
-}
-
-/// Reads `text` by a `util.scand` format, as another viewer was observed to (black-box):
-///
-/// - Fields may be separated by anything but digits and letters, whether or not the format
-///   separates them, but nothing may come before the first or after the last.
-/// - Digits typed together fill the format's fields written together with exactly as many
-///   digits as each has letters (`yyyymd`: 4, 1 and 1). A run of digits for one field alone may
-///   have one or two, except a four-digit year.
-/// - `yy` is 1950–2049; month names may be written in full or as three letters, in any case.
-/// - Impossible dates are refused, but a month or day of 0 is read as 1.
-/// - A format with no year, month or day reads nothing; an empty text is today, at noon.
-///
-/// Not observed: a year left out is `this_year`, and a month or day left out is 1.
-fn scan_date(fmt: &str, text: &str, this_year: i32) -> Option<Scanned> {
-    let parts = scan_parts(fmt);
-    if !parts.iter().any(|p| matches!(p, ScanPart::Field { unit, .. } if unit.is_date())) {
-        return None;
-    }
-    if text.is_empty() {
-        return Some(Scanned::Today);
-    }
-    let tokens = scan_tokens(text)?;
-    let mut v = ScanValues::default();
-    let (mut p, mut t) = (0, 0);
-    while let Some(part) = parts.get(p) {
-        let token = tokens.get(t)?;
-        t += 1;
-        match (part, token) {
-            (ScanPart::Word(w), ScanToken::Letters(l) | ScanToken::Digits(l)) => {
-                if w.to_lowercase() != l.to_lowercase() {
-                    return None;
-                }
-                p += 1;
-            }
-            (ScanPart::Field { unit: DateUnit::MonthName, .. }, ScanToken::Letters(l)) => {
-                v.mo = Some(named(&MONTHS, l)?.saturating_add(1));
-                p += 1;
-            }
-            (ScanPart::Field { unit: DateUnit::Weekday, .. }, ScanToken::Letters(l)) => {
-                named(&DAYS, l)?;
-                p += 1;
-            }
-            (ScanPart::Field { unit: DateUnit::AmPm, .. }, ScanToken::Letters(l)) => {
-                v.pm = Some(match l.to_lowercase().as_str() {
-                    "am" | "a" => false,
-                    "pm" | "p" => true,
-                    _ => return None,
-                });
-                p += 1;
-            }
-            (ScanPart::Field { unit, width, joined }, ScanToken::Digits(run)) if unit.is_numeric() => {
-                // The fields written together from here, no more than the run's digits can fill,
-                // and the fewest of them the run fills.
-                let mut group = vec![(*unit, *width)];
-                let (mut more, mut widths) = (*joined, *width);
-                while more
-                    && widths < run.len()
-                    && let Some(ScanPart::Field { unit, width, joined }) = parts.get(p + group.len())
-                {
-                    group.push((*unit, *width));
-                    widths = widths.saturating_add(*width);
-                    more = *joined;
-                }
-                let mut sum = 0;
-                let fills = group.iter().position(|(_, w)| {
-                    sum += w;
-                    sum == run.len()
-                });
-                if let Some(last) = fills {
-                    let mut at = 0;
-                    for (unit, w) in group.iter().take(last + 1) {
-                        v.set(*unit, run.get(at..at + w)?.parse().ok()?);
-                        at += w;
-                    }
-                    p += last + 1;
-                } else if *unit != DateUnit::Year && run.len() <= 2 {
-                    v.set(*unit, run.parse().ok()?);
-                    p += 1;
-                } else {
-                    return None;
-                }
-            }
-            _ => return None,
-        }
-    }
-    if t != tokens.len() {
-        return None;
-    }
-    let y = v.y.unwrap_or(this_year);
-    let mo = v.mo.unwrap_or(1).max(1);
-    let d = v.d.unwrap_or(1).max(1);
-    if mo > 12 || i64::from(d) > i64::from(formcalc::days_in(i64::from(y), mo)) {
-        return None;
-    }
-    let mut h = v.h.unwrap_or(0);
-    if v.twelve && h > 12 {
-        return None;
-    }
-    match v.pm {
-        Some(true) if h < 12 => h += 12,
-        Some(false) if h == 12 => h = 0,
-        _ => {}
-    }
-    let (mi, sec) = (v.mi.unwrap_or(0), v.sec.unwrap_or(0));
-    (h <= 23 && mi <= 59 && sec <= 59).then_some(Scanned::At(y, mo, d, h, mi, sec))
-}
-
-/// The index of the name `word` is, in full or as its first three letters, in any case.
-fn named(names: &[&str], word: &str) -> Option<u32> {
-    let word = word.to_lowercase();
-    let i = names.iter().position(|n| {
-        let n = n.to_lowercase();
-        word == n || n.get(..3) == Some(word.as_str())
-    })?;
-    u32::try_from(i).ok()
-}
-
-/// `util.scand(cFormat, cDate)`: the date `cDate` gives by a `util.printd` format, as a local
-/// `Date`, or `null` when it doesn't read as one (see [`scan_date`]). Only text is read.
-fn scand(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let Some(typed) = arg(args, 1).as_string().map(|t| t.to_std_string_escaped()) else {
-        return Ok(JsValue::null());
-    };
-    let fmt = text(&arg(args, 0), ctx)?;
-    let date = JsDate::new(ctx);
-    let this_year = date.get_full_year(ctx)?.to_number(ctx)?;
-    let this_year = if this_year.is_finite() { this_year as i32 } else { 2000 };
-    match scan_date(&fmt, &typed, this_year) {
-        None => return Ok(JsValue::null()),
-        Some(Scanned::Today) => {
-            date.set_hours(&[12.into(), 0.into(), 0.into(), 0.into()], ctx)?;
-        }
-        Some(Scanned::At(y, mo, d, h, mi, sec)) => {
-            // setFullYear, not the constructor, so years 0–99 stay as they are.
-            date.set_full_year(&[y.into(), (mo.saturating_sub(1)).into(), d.into()], ctx)?;
-            date.set_hours(&[h.into(), mi.into(), sec.into(), 0.into()], ctx)?;
-        }
-    }
-    Ok(date.into())
-}
-
-/// `util.printx(cFormat, cSource)`: `?` any character, `X` letter or digit, `A` letter, `9`
-/// digit, `*` the rest, `\` escape, `>` / `<` / `=` upper / lower / as is.
-fn printx(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let fmt: Vec<char> = text(&arg(args, 0), ctx)?.chars().collect();
-    let src: Vec<char> = text(&arg(args, 1), ctx)?.chars().collect();
-    let (mut out, mut j, mut case) = (String::new(), 0, 0);
-    let mut i = 0;
-    let push = |out: &mut String, c: char, case: i32| match case {
-        1 => out.extend(c.to_uppercase()),
-        -1 => out.extend(c.to_lowercase()),
-        _ => out.push(c),
-    };
-    while i < fmt.len() {
-        let f = fmt[i];
-        i += 1;
-        let take = |j: &mut usize, ok: &dyn Fn(char) -> bool| -> Option<char> {
-            while *j < src.len() {
-                let c = src[*j];
-                *j += 1;
-                if ok(c) {
-                    return Some(c);
-                }
-            }
-            None
-        };
-        match f {
-            '?' => {
-                if let Some(c) = take(&mut j, &|_| true) {
-                    push(&mut out, c, case)
-                }
-            }
-            'X' => {
-                if let Some(c) = take(&mut j, &|c| c.is_alphanumeric()) {
-                    push(&mut out, c, case)
-                }
-            }
-            'A' => {
-                if let Some(c) = take(&mut j, &|c| c.is_alphabetic()) {
-                    push(&mut out, c, case)
-                }
-            }
-            '9' => {
-                if let Some(c) = take(&mut j, &|c| c.is_ascii_digit()) {
-                    push(&mut out, c, case)
-                }
-            }
-            '*' => {
-                for c in src[j.min(src.len())..].iter().copied() {
-                    push(&mut out, c, case);
-                }
-                j = src.len();
-            }
-            '\\' if i < fmt.len() => {
-                out.push(fmt[i]);
-                i += 1;
-            }
-            '>' => case = 1,
-            '<' => case = -1,
-            '=' => case = 0,
-            c => out.push(c),
-        }
-    }
-    Ok(s(&out))
-}
-
-/// The `color` object: each named color (`transparent`, `black`, `red`, `cyan`, `gray`, …) as
-/// an array of its color space (`T`, `G`, `RGB` or `CMYK`) followed by its components.
-fn color_object(ctx: &mut Context) -> JsObject {
-    let mut entries: Vec<(&str, Vec<JsValue>)> = vec![
-        ("transparent", vec![s("T")]),
-        ("black", vec![s("G"), 0.into()]),
-        ("white", vec![s("G"), 1.into()]),
-        ("red", vec![s("RGB"), 1.into(), 0.into(), 0.into()]),
-        ("green", vec![s("RGB"), 0.into(), 1.into(), 0.into()]),
-        ("blue", vec![s("RGB"), 0.into(), 0.into(), 1.into()]),
-        ("cyan", vec![s("CMYK"), 1.into(), 0.into(), 0.into(), 0.into()]),
-        ("magenta", vec![s("CMYK"), 0.into(), 1.into(), 0.into(), 0.into()]),
-        ("yellow", vec![s("CMYK"), 0.into(), 0.into(), 1.into(), 0.into()]),
-        ("dkGray", vec![s("G"), JsValue::from(0.25)]),
-        ("gray", vec![s("G"), JsValue::from(0.5)]),
-        ("ltGray", vec![s("G"), JsValue::from(0.75)]),
-    ];
-    let arrays: Vec<(&str, JsValue)> = entries.drain(..).map(|(k, v)| (k, JsArray::from_iter(v, ctx).into())).collect();
-    let mut o = ObjectInitializer::new(ctx);
-    for (k, v) in arrays {
-        o.property(JsString::from(k), v, Attribute::all());
-    }
-    o.build()
-}
-
-/// The XFA version scripts see as `xfa_version`.
-const XFA_VERSION: f64 = 3.5;
-
-/// Defines the form object model's globals: the document's functions (`getField`, `resetForm`,
-/// `print`, `submitForm` and others) and properties (`numFields`, `pageNum`, `numPages`,
-/// `documentFileName`, `info`, the XFA version), and the `app`, `util`, `console`, `display` and
-/// `color` objects.
-fn install(ctx: &mut Context) -> JsResult<()> {
-    let globals: [(&str, usize, NativeFunction); 9] = [
-        ("getField", 1, NativeFunction::from_fn_ptr(get_field)),
-        ("getNthFieldName", 1, NativeFunction::from_fn_ptr(get_nth_field_name)),
-        ("resetForm", 1, NativeFunction::from_fn_ptr(reset_form)),
-        ("print", 1, NativeFunction::from_fn_ptr(print)),
-        ("submitForm", 1, NativeFunction::from_fn_ptr(submit_form)),
-        ("mailDoc", 1, NativeFunction::from_fn_ptr(noop)),
-        ("calculateNow", 0, NativeFunction::from_fn_ptr(noop)),
-        ("syncAnnotScan", 0, NativeFunction::from_fn_ptr(noop)),
-        ("dirty", 0, NativeFunction::from_fn_ptr(noop)),
-    ];
-    for (name, len, f) in globals {
-        ctx.register_global_callable(JsString::from(name), len, f)?;
-    }
-    let global = ctx.global_object();
-    let rw = Attribute::CONFIGURABLE;
-    let nf = function(ctx, NativeFunction::from_fn_ptr(num_fields));
-    let pg = function(ctx, NativeFunction::from_fn_ptr(page_num_get));
-    let ps = function(ctx, NativeFunction::from_fn_ptr(page_num_set));
-    let (file, pages, info, xfa) = {
-        let h = host(ctx)?.borrow();
-        (h.doc.file_name.clone(), h.doc.num_pages, h.doc.info.clone(), h.doc.xfa)
-    };
-    let mut io = ObjectInitializer::new(ctx);
-    for (k, v) in &info {
-        io.property(JsString::from(k.as_str()), s(v), Attribute::all());
-    }
-    let info = io.build();
-    use boa_engine::property::PropertyDescriptor;
-    global.define_property_or_throw(js_string!("numFields"), PropertyDescriptor::builder().get(nf).configurable(true), ctx)?;
-    global.define_property_or_throw(js_string!("pageNum"), PropertyDescriptor::builder().get(pg).set(ps).configurable(true), ctx)?;
-    ctx.register_global_property(js_string!("numPages"), JsValue::from(pages as f64), rw)?;
-    ctx.register_global_property(js_string!("documentFileName"), s(&file), rw)?;
-    ctx.register_global_property(js_string!("info"), info, rw)?;
-    // XFA forms check both before they run: every document sees the XFA version, and only an
-    // XFA form sees `xfa_installed`.
-    ctx.register_global_property(js_string!("xfa_version"), JsValue::from(XFA_VERSION), rw)?;
-    if xfa {
-        ctx.register_global_property(js_string!("xfa_installed"), JsValue::from(true), rw)?;
-    }
-
-    let app = ObjectInitializer::new(ctx)
-        .function(NativeFunction::from_fn_ptr(alert), js_string!("alert"), 1)
-        .function(NativeFunction::from_fn_ptr(beep), js_string!("beep"), 0)
-        .function(NativeFunction::from_fn_ptr(response), js_string!("response"), 1)
-        .function(NativeFunction::from_fn_ptr(launch_url), js_string!("launchURL"), 2)
-        .function(NativeFunction::from_fn_ptr(exec_menu_item), js_string!("execMenuItem"), 1)
-        .function(NativeFunction::from_fn_ptr(timer), js_string!("setTimeOut"), 2)
-        .function(NativeFunction::from_fn_ptr(timer), js_string!("setInterval"), 2)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("clearTimeOut"), 1)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("clearInterval"), 1)
-        .property(js_string!("viewerType"), s("Exchange-Pro"), Attribute::READONLY)
-        .property(js_string!("viewerVariation"), s("Full"), Attribute::READONLY)
-        .property(js_string!("viewerVersion"), JsValue::from(24.0), Attribute::READONLY)
-        .property(js_string!("formsVersion"), JsValue::from(24.0), Attribute::READONLY)
-        .property(js_string!("platform"), s(platform()), Attribute::READONLY)
-        .property(js_string!("language"), s("ENU"), Attribute::READONLY)
-        .build();
-    ctx.register_global_property(js_string!("app"), app, rw)?;
-    let util = ObjectInitializer::new(ctx)
-        .function(NativeFunction::from_fn_ptr(printf), js_string!("printf"), 1)
-        .function(NativeFunction::from_fn_ptr(printd), js_string!("printd"), 2)
-        .function(NativeFunction::from_fn_ptr(printx), js_string!("printx"), 2)
-        .function(NativeFunction::from_fn_ptr(scand), js_string!("scand"), 2)
-        .build();
-    ctx.register_global_property(js_string!("util"), util, rw)?;
-    let console = ObjectInitializer::new(ctx)
-        .function(NativeFunction::from_fn_ptr(println), js_string!("println"), 1)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("show"), 0)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("hide"), 0)
-        .function(NativeFunction::from_fn_ptr(console_clear), js_string!("clear"), 0)
-        .build();
-    ctx.register_global_property(js_string!("console"), console, rw)?;
-    let display = ObjectInitializer::new(ctx)
-        .property(js_string!("visible"), DISPLAY_VISIBLE, Attribute::READONLY)
-        .property(js_string!("hidden"), DISPLAY_HIDDEN, Attribute::READONLY)
-        .property(js_string!("noPrint"), DISPLAY_NO_PRINT, Attribute::READONLY)
-        .property(js_string!("noView"), DISPLAY_NO_VIEW, Attribute::READONLY)
-        .build();
-    ctx.register_global_property(js_string!("display"), display, rw)?;
-    let color = color_object(ctx);
-    ctx.register_global_property(js_string!("color"), color, rw)?;
-    Ok(())
-}
-
-fn platform() -> &'static str {
-    if cfg!(target_os = "macos") {
-        "MAC"
-    } else if cfg!(target_os = "windows") {
-        "WIN"
-    } else {
-        "UNIX"
-    }
-}
-
-fn event_object(ctx: &mut Context, e: &Event) -> JsObject {
-    let target = e.target.as_ref().map_or(JsValue::null(), |t| field_object(ctx, t).into());
-    ObjectInitializer::new(ctx)
-        .property(js_string!("name"), s(&e.name), Attribute::all())
-        .property(js_string!("type"), s(&e.kind), Attribute::all())
-        .property(js_string!("value"), s(&e.value), Attribute::all())
-        .property(js_string!("change"), s(&e.change), Attribute::all())
-        .property(js_string!("changeEx"), s(&e.change), Attribute::all())
-        .property(js_string!("willCommit"), e.will_commit, Attribute::all())
-        .property(js_string!("rc"), true, Attribute::all())
-        .property(js_string!("target"), target, Attribute::all())
-        .property(js_string!("targetName"), s(e.target.as_deref().unwrap_or("")), Attribute::all())
-        .property(js_string!("selStart"), 0, Attribute::all())
-        .property(js_string!("selEnd"), 0, Attribute::all())
-        .property(js_string!("commitKey"), 0, Attribute::all())
-        .property(js_string!("modifier"), false, Attribute::all())
-        .property(js_string!("shift"), false, Attribute::all())
-        .build()
-}
-
-// ── stack safety ────────────────────────────────────────────────────────────────────────────
-//
-// boa's parser and compiler recurse once per nesting level and have no limit of their own: about
-// a hundred nested parentheses overflow a 2 MiB stack, which aborts the whole app. Scripts come
-// from documents, so `run` refuses nesting no real form needs and runs the engine on a thread
-// with a large stack (address space, committed only as it is used). Together these bound the
-// stack a script can use: brackets and prefix operators by the limits below, and every other
-// construct (a few KiB per level, several bytes of source each) by the length limit.
-
-/// Bytes `util.printd` has scanned for runs of a format character, for tests that bound its work.
 #[cfg(test)]
-pub(crate) static PRINTD_SCANNED: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
-
-/// Longest script, in bytes.
-pub(crate) const MAX_SCRIPT_BYTES: usize = 256 * 1024;
-/// Largest width or precision accepted by `util.printf`.
-const MAX_PRINTF_WIDTH_PRECISION: usize = 4096;
-/// Longest `util.printf` output, in bytes.
-const MAX_PRINTF_OUTPUT_BYTES: usize = 1 << 20;
-/// Longest array read item by item (`resetForm`, a field's `value` or colours). A sparse array's
-/// length costs the script nothing but the host one string per item; real lists are tiny.
-const MAX_ARRAY_LENGTH: u64 = 1 << 20;
-/// Deepest nesting of `(`, `[` and `{`.
-const MAX_BRACKET_DEPTH: usize = 64;
-/// Longest run of prefix operators (`!`, `~`, `+`, `-`).
-const MAX_PREFIX_RUN: usize = 64;
-/// Most `?` (conditional expressions nest without brackets).
-const MAX_CONDITIONALS: usize = 4096;
-/// The script thread's stack.
+pub(crate) use format::PRINTD_SCANNED;
+use format::{printd, printf, printx, scand};
+pub(crate) use globals::menu_item;
+use globals::platform;
+use host::{arg, as_number, error, function, s, text};
+pub use model::{
+    DISPLAY_HIDDEN, DISPLAY_NO_PRINT, DISPLAY_NO_VIEW, DISPLAY_VISIBLE, DocInfo, Event, FieldState, FieldType, Limits, Outcome, Panel, Request,
+};
 #[cfg(not(target_arch = "wasm32"))]
-const SCRIPT_STACK: usize = 1 << 30;
-
-/// Why `source` is refused, if it is: too long, or nested deeper than any form needs. Strings
-/// and comments are skipped; brackets in regular expressions and templates count, which only
-/// errs on the safe side.
-fn refuse(source: &str) -> Option<String> {
-    if source.len() > MAX_SCRIPT_BYTES {
-        return Some(format!("the script is too long ({} KiB; the limit is {} KiB)", source.len() / 1024, MAX_SCRIPT_BYTES / 1024));
-    }
-    let too_deep = || Some("the script is nested too deeply to run safely".to_string());
-    let b = source.as_bytes();
-    let (mut depth, mut prefix, mut conditionals) = (0usize, 0usize, 0usize);
-    let mut i = 0;
-    while let Some(&c) = b.get(i) {
-        i += 1;
-        match c {
-            b'\'' | b'"' => {
-                // To the closing quote (or the end of the line, where an unclosed string ends).
-                while let Some(&d) = b.get(i) {
-                    i += 1;
-                    if d == b'\\' {
-                        i += 1;
-                    } else if d == c || d == b'\n' {
-                        break;
-                    }
-                }
-                prefix = 0;
-            }
-            b'/' if b.get(i) == Some(&b'/') => {
-                while b.get(i).is_some_and(|d| *d != b'\n') {
-                    i += 1;
-                }
-            }
-            b'/' if b.get(i) == Some(&b'*') => {
-                i += 1;
-                while i < b.len() && !b[i..].starts_with(b"*/") {
-                    i += 1;
-                }
-                i += 2;
-            }
-            b'(' | b'[' | b'{' => {
-                depth += 1;
-                if depth > MAX_BRACKET_DEPTH {
-                    return too_deep();
-                }
-                prefix = 0;
-            }
-            b')' | b']' | b'}' => {
-                depth = depth.saturating_sub(1);
-                prefix = 0;
-            }
-            b'!' | b'~' | b'+' | b'-' => {
-                prefix += 1;
-                if prefix > MAX_PREFIX_RUN {
-                    return too_deep();
-                }
-            }
-            b'?' => {
-                conditionals += 1;
-                if conditionals > MAX_CONDITIONALS {
-                    return too_deep();
-                }
-                prefix = 0;
-            }
-            c if c.is_ascii_whitespace() => {}
-            _ => prefix = 0,
-        }
-    }
-    None
-}
-
-/// Run `script` for `event`, after the document-level scripts (`doc_scripts`, which define the
-/// functions field scripts call), with the form's `fields`.
-pub fn run(script: &str, event: &Event, doc: &DocInfo, fields: &[FieldState], doc_scripts: &[String], limits: Limits) -> Outcome {
-    run_shared(script, event, doc, Arc::new(fields.to_vec()), doc_scripts, limits)
-}
-
-/// Like [`run`], sharing an immutable initial field snapshot. Scripts still get a fresh
-/// context; the first field write copies the snapshot, so neither the caller nor another
-/// script can observe uncommitted writes. Read-only calculations avoid copying the whole form.
-pub fn run_shared(script: &str, event: &Event, doc: &DocInfo, fields: Arc<Vec<FieldState>>, doc_scripts: &[String], limits: Limits) -> Outcome {
-    let failed = |why: String| Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), error: Some(why), ..Default::default() };
-    if let Some(why) = refuse(script) {
-        return failed(why);
-    }
-    // A document script too long or too deeply nested to run safely is skipped and reported,
-    // as one that throws is; the others and the script still run (#3940).
-    let mut skipped = Vec::new();
-    let kept: Vec<(usize, &str)> = doc_scripts
-        .iter()
-        .enumerate()
-        .filter_map(|(i, d)| match refuse(d) {
-            Some(why) => {
-                skipped.push((i, why));
-                None
-            }
-            None => Some((i, d.as_str())),
-        })
-        .collect();
-    let (kept, skipped) = (&kept, &skipped);
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        std::thread::scope(|scope| {
-            let spawned = std::thread::Builder::new()
-                .name("pdfcraft-js".into())
-                .stack_size(SCRIPT_STACK)
-                .spawn_scoped(scope, || run_here(script, event, doc, fields, kept, skipped, limits));
-            match spawned {
-                Ok(thread) => thread.join().unwrap_or_else(|_| failed("the script stopped with an internal error".into())),
-                Err(e) => failed(format!("the script engine could not start: {e}")),
-            }
-        })
-    }
-    #[cfg(target_arch = "wasm32")]
-    run_here(script, event, doc, fields, kept, skipped, limits)
-}
-
-/// Host hooks that refuse to compile code from strings (`eval`, `Function` and its generator
-/// and async kin). Such code is built at run time, so it never passed [`refuse`], and boa's
-/// recursive parser would overflow the stack on a deeply nested one.
-struct NoCodeFromStrings;
-
-impl HostHooks for NoCodeFromStrings {
-    fn ensure_can_compile_strings(&self, _: Realm, _: &[JsString], _: &JsString, _: bool, _: &mut Context) -> JsResult<()> {
-        Err(JsNativeError::typ().with_message("scripts can't compile code from strings (eval, Function)").into())
-    }
-}
-
-/// Host hooks that hold code compiled from strings to the checks a script passes ([`refuse`]),
-/// for runners that start the script itself through `eval`.
-pub(crate) struct CheckedCodeFromStrings;
-
-impl HostHooks for CheckedCodeFromStrings {
-    fn ensure_can_compile_strings(&self, _: Realm, parameters: &[JsString], body: &JsString, _: bool, _: &mut Context) -> JsResult<()> {
-        let units = parameters.iter().chain(std::iter::once(body)).fold(0usize, |n, s| n.saturating_add(s.len()));
-        if units > MAX_SCRIPT_BYTES {
-            return Err(JsNativeError::range().with_message("the code is too long to compile").into());
-        }
-        // As one text: brackets left open in one parameter carry into the next.
-        let mut source = parameters.iter().map(JsString::to_std_string_lossy).collect::<Vec<_>>().join(",");
-        source.push('\n');
-        source.push_str(&body.to_std_string_lossy());
-        match refuse(&source) {
-            Some(why) => Err(JsNativeError::range().with_message(why).into()),
-            None => Ok(()),
-        }
-    }
-}
-
-/// How [`Outcome::doc_errors`] names a failing document script: by its 1-based place.
-fn doc_error(index: usize, error: &dyn std::fmt::Display) -> String {
-    format!("document script {}: {error}", index.saturating_add(1))
-}
-
-/// `doc_scripts` are the document scripts to run with their places among all of them;
-/// `skipped` the ones refused before running, with the reason.
-fn run_here(
-    script: &str,
-    event: &Event,
-    doc: &DocInfo,
-    fields: Arc<Vec<FieldState>>,
-    doc_scripts: &[(usize, &str)],
-    skipped: &[(usize, String)],
-    limits: Limits,
-) -> Outcome {
-    let mut ctx = match Context::builder().host_hooks(std::rc::Rc::new(NoCodeFromStrings)).build() {
-        Ok(ctx) => ctx,
-        Err(e) => {
-            let error = Some(format!("the script engine could not start: {e}"));
-            return Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), error, ..Default::default() };
-        }
-    };
-    ctx.runtime_limits_mut().set_loop_iteration_limit(limits.loop_iterations);
-    ctx.runtime_limits_mut().set_recursion_limit(limits.recursion);
-    ctx.insert_data(RefCell::new(Host {
-        fields,
-        changed: BTreeSet::new(),
-        alerts: Vec::new(),
-        console: Vec::new(),
-        requests: Vec::new(),
-        doc: doc.clone(),
-        kept: 0,
-        dropped: 0,
-    }));
-    let mut out = Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), ..Default::default() };
-    let mut doc_errors: Vec<(usize, String)> = skipped.iter().map(|(i, why)| (*i, doc_error(*i, why))).collect();
-    let result = (|| -> JsResult<()> {
-        install(&mut ctx)?;
-        let ev = event_object(&mut ctx, event);
-        ctx.register_global_property(js_string!("event"), ev.clone(), Attribute::all())?;
-        // One document script that throws (calling a method PdfCraft lacks, say) must not keep
-        // every field script in the form from running: what it defined before the error, and
-        // the other scripts, stay available (#3940).
-        for &(i, d) in doc_scripts {
-            if let Err(e) = ctx.eval(Source::from_bytes(d)) {
-                doc_errors.push((i, doc_error(i, &e)));
-            }
-        }
-        let r = ctx.eval(Source::from_bytes(script))?;
-        if !r.is_undefined() {
-            out.result = Some(text(&r, &mut ctx)?);
-        }
-        let rc = ev.get(js_string!("rc"), &mut ctx)?;
-        out.rc = rc.to_boolean();
-        let v = ev.get(js_string!("value"), &mut ctx)?;
-        out.value = text(&v, &mut ctx)?;
-        let c = ev.get(js_string!("change"), &mut ctx)?;
-        out.change = text(&c, &mut ctx)?;
-        Ok(())
-    })();
-    if let Err(e) = result {
-        out.error = Some(e.to_string());
-    }
-    doc_errors.sort_by_key(|(i, _)| *i);
-    out.doc_errors = doc_errors.into_iter().map(|(_, e)| e).collect();
-    if let Some(h) = ctx.remove_data::<Shared>() {
-        let h = h.into_inner();
-        out.changed = h.changed.iter().map(|i| h.fields[*i].clone()).collect();
-        out.alerts = h.alerts;
-        out.console = h.console;
-        out.requests = h.requests;
-        if h.dropped > 0 {
-            out.console.push(format!("the script's messages, console lines and requests passed their limits; {} more were left out", h.dropped));
-        }
-    }
-    out
-}
+use run::SCRIPT_STACK;
+use run::refuse;
+pub(crate) use run::{CheckedCodeFromStrings, MAX_SCRIPT_BYTES};
+pub use run::{run, run_shared};
 
 pub mod formcalc;
 pub mod xfa;
diff --git a/crates/js/src/model.rs b/crates/js/src/model.rs
new file mode 100644
index 0000000000..80583d0de0
--- /dev/null
+++ b/crates/js/src/model.rs
@@ -0,0 +1,199 @@
+/// The kinds of field, as `field.type` names them.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FieldType {
+    Text,
+    CheckBox,
+    RadioButton,
+    ComboBox,
+    ListBox,
+    Button,
+    Signature,
+}
+
+impl FieldType {
+    pub fn name(self) -> &'static str {
+        match self {
+            FieldType::Text => "text",
+            FieldType::CheckBox => "checkbox",
+            FieldType::RadioButton => "radiobutton",
+            FieldType::ComboBox => "combobox",
+            FieldType::ListBox => "listbox",
+            FieldType::Button => "button",
+            FieldType::Signature => "signature",
+        }
+    }
+}
+
+/// `display.*`: visible, hidden, noPrint, noView.
+pub const DISPLAY_VISIBLE: i32 = 0;
+
+pub const DISPLAY_HIDDEN: i32 = 1;
+
+pub const DISPLAY_NO_PRINT: i32 = 2;
+
+pub const DISPLAY_NO_VIEW: i32 = 3;
+
+/// A field as scripts see it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FieldState {
+    pub name: String,
+    pub kind: FieldType,
+    /// Text: the text. Check box / radio: the selected export value (empty when off). Choice:
+    /// the selected export values.
+    pub value: Vec<String>,
+    pub default: Vec<String>,
+    pub readonly: bool,
+    pub required: bool,
+    pub display: i32,
+    /// Choice options (export value, display text); check boxes and radios: their export
+    /// values, one per widget.
+    pub options: Vec<(String, String)>,
+    pub char_limit: Option<usize>,
+    /// `textColor` / `fillColor` as Acrobat colour arrays (`["RGB", r, g, b]` etc.), when set.
+    pub text_color: Option<Vec<String>>,
+    pub fill_color: Option<Vec<String>>,
+}
+
+impl FieldState {
+    pub fn new(name: impl Into<String>, kind: FieldType, value: Vec<String>) -> FieldState {
+        FieldState {
+            name: name.into(),
+            kind,
+            value,
+            default: Vec::new(),
+            readonly: false,
+            required: false,
+            display: DISPLAY_VISIBLE,
+            options: Vec::new(),
+            char_limit: None,
+            text_color: None,
+            fill_color: None,
+        }
+    }
+
+    pub(crate) fn single(&self) -> String {
+        self.value.first().cloned().unwrap_or_default()
+    }
+}
+
+/// The event a script runs for.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Event {
+    /// `Keystroke`, `Validate`, `Calculate`, `Format`, `Mouse Up`, `Open`, …
+    pub name: String,
+    /// `Field`, `Doc`, `Page`, …
+    pub kind: String,
+    /// The field the event is for.
+    pub target: Option<String>,
+    pub value: String,
+    pub change: String,
+    pub will_commit: bool,
+}
+
+impl Event {
+    /// A field event (`event.type` = "Field").
+    pub fn field(name: &str, target: &str, value: &str) -> Event {
+        Event { name: name.into(), kind: "Field".into(), target: Some(target.into()), value: value.into(), change: String::new(), will_commit: true }
+    }
+
+    /// A document event (`event.type` = "Doc"), e.g. Open or WillSave.
+    pub fn doc(name: &str) -> Event {
+        Event { name: name.into(), kind: "Doc".into(), target: None, value: String::new(), change: String::new(), will_commit: false }
+    }
+}
+
+/// About the document, for `this.numPages`, `this.info` and the like.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct DocInfo {
+    pub file_name: String,
+    pub num_pages: usize,
+    /// The current page, 0-based.
+    pub page: usize,
+    /// Document information (`this.info.title` etc.): lower-case key, value.
+    pub info: Vec<(String, String)>,
+    /// The document has an XFA form, so scripts see `xfa_installed`.
+    pub xfa: bool,
+}
+
+/// Something a script asked the viewer to do.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Request {
+    /// `this.resetForm([names])` (empty: every field).
+    Reset(Vec<String>),
+    Print,
+    /// `this.pageNum = n` (0-based).
+    GoToPage(usize),
+    LaunchUrl(String),
+    /// `this.submitForm(url)`: never sent on PdfCraft's own.
+    Submit(String),
+    /// `field.setFocus()`.
+    Focus(String),
+    Beep,
+    /// `app.execMenuItem("SaveAs")` (XFA forms' Save buttons).
+    SaveAs,
+    /// `app.execMenuItem("ShowHide…")`: show the side panel, or hide it when it is showing.
+    ShowPanel(Panel),
+}
+
+/// A side panel a script can show or hide (`app.execMenuItem("ShowHideFileAttachment")`, …).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Panel {
+    /// The document's bookmarks (outline).
+    Bookmarks,
+    /// Page thumbnails.
+    Pages,
+    /// The files attached to the document.
+    Attachments,
+    /// The document's signatures and their validity.
+    Signatures,
+    /// The document's layers (optional content).
+    Layers,
+}
+
+impl Panel {
+    /// The panel's name in automation output, fixed whatever the variant is called.
+    pub fn id(self) -> &'static str {
+        match self {
+            Panel::Bookmarks => "bookmarks",
+            Panel::Pages => "pages",
+            Panel::Attachments => "attachments",
+            Panel::Signatures => "signatures",
+            Panel::Layers => "layers",
+        }
+    }
+}
+
+/// What running a script did.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Outcome {
+    /// `event.rc`: `false` rejects the keystroke or value.
+    pub rc: bool,
+    /// `event.value` after the script.
+    pub value: String,
+    pub change: String,
+    /// Fields whose value or properties the script changed, as they are now.
+    pub changed: Vec<FieldState>,
+    pub alerts: Vec<String>,
+    pub console: Vec<String>,
+    pub requests: Vec<Request>,
+    /// The script's error (syntax error, exception, or a limit reached), if it failed.
+    pub error: Option<String>,
+    /// Errors in the document-level scripts that ran first. Each is a script of its own: one
+    /// that throws stops where it failed, and the others and the script itself still run (#3940).
+    pub doc_errors: Vec<String>,
+    /// The script's completion value (what the console prints), unless undefined.
+    pub result: Option<String>,
+}
+
+/// Bounds that keep a script from hanging the viewer.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Limits {
+    pub loop_iterations: u64,
+    pub recursion: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Limits { loop_iterations: 1_000_000, recursion: 256 }
+    }
+}
diff --git a/crates/js/src/run.rs b/crates/js/src/run.rs
new file mode 100644
index 0000000000..17b5c252ff
--- /dev/null
+++ b/crates/js/src/run.rs
@@ -0,0 +1,256 @@
+use super::globals::{event_object, install};
+use super::host::{Host, Shared, text};
+use super::model::{DocInfo, Event, FieldState, Limits, Outcome};
+use super::*;
+
+/// Longest script, in bytes.
+pub(crate) const MAX_SCRIPT_BYTES: usize = 256 * 1024;
+
+/// Largest width or precision accepted by `util.printf`.
+pub(crate) const MAX_PRINTF_WIDTH_PRECISION: usize = 4096;
+
+/// Longest `util.printf` output, in bytes.
+pub(crate) const MAX_PRINTF_OUTPUT_BYTES: usize = 1 << 20;
+
+/// Longest array read item by item (`resetForm`, a field's `value` or colours). A sparse array's
+/// length costs the script nothing but the host one string per item; real lists are tiny.
+pub(crate) const MAX_ARRAY_LENGTH: u64 = 1 << 20;
+
+/// Deepest nesting of `(`, `[` and `{`.
+const MAX_BRACKET_DEPTH: usize = 64;
+
+/// Longest run of prefix operators (`!`, `~`, `+`, `-`).
+const MAX_PREFIX_RUN: usize = 64;
+
+/// Most `?` (conditional expressions nest without brackets).
+const MAX_CONDITIONALS: usize = 4096;
+
+/// The script thread's stack.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) const SCRIPT_STACK: usize = 1 << 30;
+
+/// Why `source` is refused, if it is: too long, or nested deeper than any form needs. Strings
+/// and comments are skipped; brackets in regular expressions and templates count, which only
+/// errs on the safe side.
+pub(crate) fn refuse(source: &str) -> Option<String> {
+    if source.len() > MAX_SCRIPT_BYTES {
+        return Some(format!("the script is too long ({} KiB; the limit is {} KiB)", source.len() / 1024, MAX_SCRIPT_BYTES / 1024));
+    }
+    let too_deep = || Some("the script is nested too deeply to run safely".to_string());
+    let b = source.as_bytes();
+    let (mut depth, mut prefix, mut conditionals) = (0usize, 0usize, 0usize);
+    let mut i = 0;
+    while let Some(&c) = b.get(i) {
+        i += 1;
+        match c {
+            b'\'' | b'"' => {
+                // To the closing quote (or the end of the line, where an unclosed string ends).
+                while let Some(&d) = b.get(i) {
+                    i += 1;
+                    if d == b'\\' {
+                        i += 1;
+                    } else if d == c || d == b'\n' {
+                        break;
+                    }
+                }
+                prefix = 0;
+            }
+            b'/' if b.get(i) == Some(&b'/') => {
+                while b.get(i).is_some_and(|d| *d != b'\n') {
+                    i += 1;
+                }
+            }
+            b'/' if b.get(i) == Some(&b'*') => {
+                i += 1;
+                while i < b.len() && !b[i..].starts_with(b"*/") {
+                    i += 1;
+                }
+                i += 2;
+            }
+            b'(' | b'[' | b'{' => {
+                depth += 1;
+                if depth > MAX_BRACKET_DEPTH {
+                    return too_deep();
+                }
+                prefix = 0;
+            }
+            b')' | b']' | b'}' => {
+                depth = depth.saturating_sub(1);
+                prefix = 0;
+            }
+            b'!' | b'~' | b'+' | b'-' => {
+                prefix += 1;
+                if prefix > MAX_PREFIX_RUN {
+                    return too_deep();
+                }
+            }
+            b'?' => {
+                conditionals += 1;
+                if conditionals > MAX_CONDITIONALS {
+                    return too_deep();
+                }
+                prefix = 0;
+            }
+            c if c.is_ascii_whitespace() => {}
+            _ => prefix = 0,
+        }
+    }
+    None
+}
+
+/// Run `script` for `event`, after the document-level scripts (`doc_scripts`, which define the
+/// functions field scripts call), with the form's `fields`.
+pub fn run(script: &str, event: &Event, doc: &DocInfo, fields: &[FieldState], doc_scripts: &[String], limits: Limits) -> Outcome {
+    run_shared(script, event, doc, Arc::new(fields.to_vec()), doc_scripts, limits)
+}
+
+/// Like [`run`], sharing an immutable initial field snapshot. Scripts still get a fresh
+/// context; the first field write copies the snapshot, so neither the caller nor another
+/// script can observe uncommitted writes. Read-only calculations avoid copying the whole form.
+pub fn run_shared(script: &str, event: &Event, doc: &DocInfo, fields: Arc<Vec<FieldState>>, doc_scripts: &[String], limits: Limits) -> Outcome {
+    let failed = |why: String| Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), error: Some(why), ..Default::default() };
+    if let Some(why) = refuse(script) {
+        return failed(why);
+    }
+    // A document script too long or too deeply nested to run safely is skipped and reported,
+    // as one that throws is; the others and the script still run (#3940).
+    let mut skipped = Vec::new();
+    let kept: Vec<(usize, &str)> = doc_scripts
+        .iter()
+        .enumerate()
+        .filter_map(|(i, d)| match refuse(d) {
+            Some(why) => {
+                skipped.push((i, why));
+                None
+            }
+            None => Some((i, d.as_str())),
+        })
+        .collect();
+    let (kept, skipped) = (&kept, &skipped);
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        std::thread::scope(|scope| {
+            let spawned = std::thread::Builder::new()
+                .name("pdfcraft-js".into())
+                .stack_size(SCRIPT_STACK)
+                .spawn_scoped(scope, || run_here(script, event, doc, fields, kept, skipped, limits));
+            match spawned {
+                Ok(thread) => thread.join().unwrap_or_else(|_| failed("the script stopped with an internal error".into())),
+                Err(e) => failed(format!("the script engine could not start: {e}")),
+            }
+        })
+    }
+    #[cfg(target_arch = "wasm32")]
+    run_here(script, event, doc, fields, kept, skipped, limits)
+}
+
+/// Host hooks that refuse to compile code from strings (`eval`, `Function` and its generator
+/// and async kin). Such code is built at run time, so it never passed [`refuse`], and boa's
+/// recursive parser would overflow the stack on a deeply nested one.
+struct NoCodeFromStrings;
+
+impl HostHooks for NoCodeFromStrings {
+    fn ensure_can_compile_strings(&self, _: Realm, _: &[JsString], _: &JsString, _: bool, _: &mut Context) -> JsResult<()> {
+        Err(JsNativeError::typ().with_message("scripts can't compile code from strings (eval, Function)").into())
+    }
+}
+
+/// Host hooks that hold code compiled from strings to the checks a script passes ([`refuse`]),
+/// for runners that start the script itself through `eval`.
+pub(crate) struct CheckedCodeFromStrings;
+
+impl HostHooks for CheckedCodeFromStrings {
+    fn ensure_can_compile_strings(&self, _: Realm, parameters: &[JsString], body: &JsString, _: bool, _: &mut Context) -> JsResult<()> {
+        let units = parameters.iter().chain(std::iter::once(body)).fold(0usize, |n, s| n.saturating_add(s.len()));
+        if units > MAX_SCRIPT_BYTES {
+            return Err(JsNativeError::range().with_message("the code is too long to compile").into());
+        }
+        // As one text: brackets left open in one parameter carry into the next.
+        let mut source = parameters.iter().map(JsString::to_std_string_lossy).collect::<Vec<_>>().join(",");
+        source.push('\n');
+        source.push_str(&body.to_std_string_lossy());
+        match refuse(&source) {
+            Some(why) => Err(JsNativeError::range().with_message(why).into()),
+            None => Ok(()),
+        }
+    }
+}
+
+/// How [`Outcome::doc_errors`] names a failing document script: by its 1-based place.
+fn doc_error(index: usize, error: &dyn std::fmt::Display) -> String {
+    format!("document script {}: {error}", index.saturating_add(1))
+}
+
+/// `doc_scripts` are the document scripts to run with their places among all of them;
+/// `skipped` the ones refused before running, with the reason.
+fn run_here(
+    script: &str,
+    event: &Event,
+    doc: &DocInfo,
+    fields: Arc<Vec<FieldState>>,
+    doc_scripts: &[(usize, &str)],
+    skipped: &[(usize, String)],
+    limits: Limits,
+) -> Outcome {
+    let mut ctx = match Context::builder().host_hooks(std::rc::Rc::new(NoCodeFromStrings)).build() {
+        Ok(ctx) => ctx,
+        Err(e) => {
+            let error = Some(format!("the script engine could not start: {e}"));
+            return Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), error, ..Default::default() };
+        }
+    };
+    ctx.runtime_limits_mut().set_loop_iteration_limit(limits.loop_iterations);
+    ctx.runtime_limits_mut().set_recursion_limit(limits.recursion);
+    ctx.insert_data(RefCell::new(Host {
+        fields,
+        changed: BTreeSet::new(),
+        alerts: Vec::new(),
+        console: Vec::new(),
+        requests: Vec::new(),
+        doc: doc.clone(),
+        kept: 0,
+        dropped: 0,
+    }));
+    let mut out = Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), ..Default::default() };
+    let mut doc_errors: Vec<(usize, String)> = skipped.iter().map(|(i, why)| (*i, doc_error(*i, why))).collect();
+    let result = (|| -> JsResult<()> {
+        install(&mut ctx)?;
+        let ev = event_object(&mut ctx, event);
+        ctx.register_global_property(js_string!("event"), ev.clone(), Attribute::all())?;
+        // One document script that throws (calling a method PdfCraft lacks, say) must not keep
+        // every field script in the form from running: what it defined before the error, and
+        // the other scripts, stay available (#3940).
+        for &(i, d) in doc_scripts {
+            if let Err(e) = ctx.eval(Source::from_bytes(d)) {
+                doc_errors.push((i, doc_error(i, &e)));
+            }
+        }
+        let r = ctx.eval(Source::from_bytes(script))?;
+        if !r.is_undefined() {
+            out.result = Some(text(&r, &mut ctx)?);
+        }
+        let rc = ev.get(js_string!("rc"), &mut ctx)?;
+        out.rc = rc.to_boolean();
+        let v = ev.get(js_string!("value"), &mut ctx)?;
+        out.value = text(&v, &mut ctx)?;
+        let c = ev.get(js_string!("change"), &mut ctx)?;
+        out.change = text(&c, &mut ctx)?;
+        Ok(())
+    })();
+    if let Err(e) = result {
+        out.error = Some(e.to_string());
+    }
+    doc_errors.sort_by_key(|(i, _)| *i);
+    out.doc_errors = doc_errors.into_iter().map(|(_, e)| e).collect();
+    if let Some(h) = ctx.remove_data::<Shared>() {
+        let h = h.into_inner();
+        out.changed = h.changed.iter().map(|i| h.fields[*i].clone()).collect();
+        out.alerts = h.alerts;
+        out.console = h.console;
+        out.requests = h.requests;
+        if h.dropped > 0 {
+            out.console.push(format!("the script's messages, console lines and requests passed their limits; {} more were left out", h.dropped));
+        }
+    }
+    out
+}
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index 3d3c4ab524..9e96dcd2e3 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -1009,9 +1009,17 @@ mod formcalc {
         assert_eq!(calc(r#"Format("9.99", 2.344)"#), "2.34");
     }
 
+    #[test]
+    fn round_keeps_huge_values_finite() {
+        assert_eq!(calc("Round(1e300, 12) == 1e300"), "1");
+        assert_eq!(calc("Round(1.2345, 2)"), "1.23");
+    }
+
     #[test]
     fn built_in_functions_cover_the_common_set() {
         assert_eq!(calc("Abs(-2.5)"), "2.5");
+        assert_eq!(calc(r#"Decode("a%2Fb", "url")"#), "a/b");
+        assert_eq!(calc(r#"Decode("a%+fb", "url")"#), "a%+fb");
         assert_eq!(calc("Ceil(2.1)"), "3");
         assert_eq!(calc("Floor(-2.1)"), "-3");
         assert_eq!(calc("Mod(7, 3)"), "1");
diff --git a/crates/js/src/xfa.rs b/crates/js/src/xfa.rs
index 42b1688ed5..cddf8f2eb2 100644
--- a/crates/js/src/xfa.rs
+++ b/crates/js/src/xfa.rs
@@ -17,1639 +17,20 @@ use boa_engine::{Context, JsObject, JsResult, JsString, JsValue, NativeFunction,
 
 use crate::{Limits, arg, as_number, error, function, platform, printd, printf, printx, refuse, s, scand, text};
 
-/// What kind of template object a node is.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum XfaKind {
-    /// `xfa.form` itself.
-    Form,
-    Subform,
-    Field,
-    ExclGroup,
-    Draw,
-    Area,
-}
-
-impl XfaKind {
-    pub(crate) fn class_name(self) -> &'static str {
-        match self {
-            XfaKind::Form => "form",
-            XfaKind::Subform => "subform",
-            XfaKind::Field => "field",
-            XfaKind::ExclGroup => "exclGroup",
-            XfaKind::Draw => "draw",
-            XfaKind::Area => "area",
-        }
-    }
-}
-
-/// One object of the form, as the caller snapshots it.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct XfaNode {
-    pub name: String,
-    /// The SOM expression naming this instance (`form[0].head[0].familyName[0]`).
-    pub som: String,
-    pub kind: Option<XfaKind>,
-    /// Fields: the raw value (ISO dates, on values for buttons); empty when null.
-    pub value: String,
-    /// Numeric fields give numbers to scripts.
-    pub numeric: bool,
-    /// `visible`, `invisible`, `hidden` or `inactive`.
-    pub presence: String,
-    /// `open`, `readOnly`, `protected` or `nonInteractive`.
-    pub access: String,
-    /// Subforms: may have several instances (`occur max` other than 1).
-    pub repeatable: bool,
-    pub occur_min: usize,
-    pub occur_max: Option<usize>,
-    /// This instance's index among its same-named siblings.
-    pub index: usize,
-    pub children: Vec<XfaNode>,
-    /// Fields: the value shown in the field's display picture, what `formattedValue` reads;
-    /// `None` when the picture doesn't change it (the raw value is read then).
-    pub formatted: Option<String>,
-}
-
-/// The event a script runs for.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct XfaEvent {
-    /// `click`, `calculate`, `validate`, `initialize`, `change`, `exit`, …
-    pub activity: String,
-    /// The SOM of `this`.
-    pub target: String,
-    pub new_text: String,
-    pub prev_text: String,
-}
-
-/// About the document.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct XfaDoc {
-    pub file_name: String,
-    /// The current page, 0-based.
-    pub page: usize,
-    pub page_count: usize,
-}
-
-/// Something a script changed or asked for.
-#[derive(Clone, Debug, PartialEq)]
-pub enum XfaEffect {
-    SetValue {
-        som: String,
-        value: String,
-    },
-    SetPresence {
-        som: String,
-        presence: String,
-    },
-    SetAccess {
-        som: String,
-        access: String,
-    },
-    /// A new instance of a repeating subform, named by its own SOM (`…row[3]`).
-    AddInstance {
-        som: String,
-    },
-    /// The instance at this SOM is removed.
-    RemoveInstance {
-        som: String,
-    },
-    MessageBox(String),
-    /// `xfa.host.resetData()`: the named fields, or every field when empty.
-    ResetData(Vec<String>),
-    /// `app.execMenuItem("ShowHide…")`: show or hide a side panel.
-    ShowPanel(crate::Panel),
-    Print,
-    SaveAs,
-    LaunchUrl(String),
-    SetFocus(String),
-    Beep,
-    /// `xfa.form.recalculate(true)`.
-    Recalculate,
-    /// `xfa.form.remerge()`, `xfa.layout.relayout()`.
-    Relayout,
-}
-
-/// What running a script did.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct XfaOutcome {
-    pub effects: Vec<XfaEffect>,
-    pub console: Vec<String>,
-    /// The script's error, if it failed.
-    pub error: Option<String>,
-    /// The script's completion value (a calculate script's result; a validate script's verdict).
-    pub result: Option<String>,
-    /// The completion value as a boolean, when it was one.
-    pub result_bool: Option<bool>,
-    /// Limits the script ran into (too many effects, message boxes or console lines): what
-    /// was left out, for the caller to report.
-    pub notes: Vec<String>,
-    /// The script ran past its time limit and was left running on its own thread (the engine
-    /// can't interrupt it): the caller should run no more of this form's scripts.
-    pub abandoned: bool,
-}
-
-/// Most nodes a snapshot may hold.
-const MAX_NODES: usize = 200_000;
-/// Most instances a script may add in one run.
-pub(crate) const MAX_ADDED: usize = 1_000;
-/// Deepest tree followed.
-const MAX_DEPTH: usize = 64;
-/// Most effects one run may produce (after values set again on the same object are merged).
-pub const MAX_EFFECTS: usize = 10_000;
-/// Most message boxes one run may show.
-pub const MAX_ALERTS: usize = 100;
-/// Most console lines one run may print.
-pub const MAX_CONSOLE: usize = 1_000;
-/// Longest message or console line kept, in characters.
-pub(crate) const MAX_LINE: usize = 4_096;
-/// Most bytes of text one run may hand back or write: messages, console lines, URLs, names
-/// and the values it sets. Past it, more are left out and noted.
-pub(crate) const MAX_PAYLOAD: usize = 32 << 20;
-
-/// Longest value a script may put in a field (characters); longer ones are cut and noted.
-const MAX_VALUE: usize = 65_536;
-
-/// `m` cut to [`MAX_LINE`] characters.
-pub(crate) fn clip(m: String) -> String {
-    match m.char_indices().nth(MAX_LINE) {
-        Some((at, _)) => format!("{}…", m.get(..at).unwrap_or_default()),
-        None => m,
-    }
-}
-
-/// `v` cut to [`MAX_VALUE`] characters, and whether it was cut.
-pub(crate) fn clip_value(v: String) -> (String, bool) {
-    match v.char_indices().nth(MAX_VALUE) {
-        Some((at, _)) => (v.get(..at).unwrap_or_default().to_string(), true),
-        None => (v, false),
-    }
-}
-
-/// The field names of a `resetData` list (comma-separated), each cut to [`MAX_LINE`] and
-/// named once, at most as many as a snapshot holds nodes.
-pub(crate) fn reset_names(list: &str) -> Vec<String> {
-    let mut seen = HashSet::new();
-    let mut out = Vec::new();
-    for name in list.split(',').map(str::trim).filter(|s| !s.is_empty()) {
-        if out.len() >= MAX_NODES {
-            break;
-        }
-        let name = clip(name.to_string());
-        if seen.insert(name.clone()) {
-            out.push(name);
-        }
-    }
-    out
-}
-
-/// The (property, SOM) an effect setting a property of an object is merged by, see
-/// [`XHost::set_at`].
-fn effect_key(e: &XfaEffect) -> Option<(u8, String)> {
-    match e {
-        XfaEffect::SetValue { som, .. } => Some((0, som.clone())),
-        XfaEffect::SetPresence { som, .. } => Some((1, som.clone())),
-        XfaEffect::SetAccess { som, .. } => Some((2, som.clone())),
-        _ => None,
-    }
-}
-
-/// Bytes of text `e` holds.
-fn payload(e: &XfaEffect) -> usize {
-    match e {
-        XfaEffect::SetValue { som, value: s } | XfaEffect::SetPresence { som, presence: s } | XfaEffect::SetAccess { som, access: s } => {
-            som.len().saturating_add(s.len())
-        }
-        XfaEffect::AddInstance { som } | XfaEffect::RemoveInstance { som } => som.len(),
-        XfaEffect::MessageBox(s) | XfaEffect::LaunchUrl(s) | XfaEffect::SetFocus(s) => s.len(),
-        XfaEffect::ResetData(names) => names.iter().fold(0usize, |n, s| n.saturating_add(s.len()).saturating_add(std::mem::size_of::<String>())),
-        XfaEffect::Print | XfaEffect::SaveAs | XfaEffect::Beep | XfaEffect::Recalculate | XfaEffect::Relayout | XfaEffect::ShowPanel(_) => 0,
-    }
-}
-
-/// A script's completion value (what a calculate script puts in its field) cut to
-/// [`MAX_VALUE`] characters, as values a script sets are, with a note when it was.
-pub(crate) fn clip_result(out: &mut XfaOutcome) {
-    if let Some(r) = out.result.take() {
-        let (r, cut) = clip_value(r);
-        if cut {
-            out.notes.push(format!("the script's result was longer than {MAX_VALUE} characters; it was cut"));
-        }
-        out.result = Some(r);
-    }
-}
-
-/// One node of the flattened form, shared by the JavaScript and FormCalc engines.
-pub(crate) struct HNode {
-    pub(crate) name: String,
-    pub(crate) som: String,
-    pub(crate) kind: XfaKind,
-    pub(crate) value: String,
-    pub(crate) numeric: bool,
-    pub(crate) presence: String,
-    pub(crate) access: String,
-    pub(crate) repeatable: bool,
-    pub(crate) occur_min: usize,
-    pub(crate) occur_max: Option<usize>,
-    pub(crate) index: usize,
-    pub(crate) parent: Option<usize>,
-    pub(crate) children: Vec<usize>,
-    /// Removed by `removeInstance`: skipped everywhere.
-    pub(crate) gone: bool,
-    /// See [`XfaNode::formatted`]; dropped when a script sets the value, which it no longer shows.
-    pub(crate) formatted: Option<String>,
-}
-
-/// The form as a script sees and changes it, with the effects it records.
-pub(crate) struct XHost {
-    pub(crate) nodes: Vec<HNode>,
-    pub(crate) effects: Vec<XfaEffect>,
-    pub(crate) console: Vec<String>,
-    pub(crate) doc: XfaDoc,
-    added: usize,
-    /// Index of `this`.
-    pub(crate) current: usize,
-    /// Where the effect setting a property of an object is in `effects`, by (property, SOM):
-    /// setting it again replaces that effect (the last value wins) unless something that
-    /// depends on order (rows added or removed, a reset) came after it.
-    set_at: HashMap<(u8, String), usize>,
-    /// Effects before this index are behind an order-dependent effect.
-    barrier: usize,
-    alerts: usize,
-    dropped_effects: usize,
-    clipped_values: usize,
-    dropped_alerts: usize,
-    dropped_console: usize,
-    /// Bytes of text kept in effects, console lines and values written, against [`MAX_PAYLOAD`].
-    kept: usize,
-    dropped_bytes: usize,
-}
-
-impl XHost {
-    /// The host for a script on `root` (the template's root subform), with `this` at the node
-    /// named by `target`. `xfa.form` is a synthetic root whose child is the root subform.
-    pub(crate) fn new(root: XfaNode, target: &str, doc: &XfaDoc) -> XHost {
-        let form = XfaNode { name: "form".into(), kind: Some(XfaKind::Form), children: vec![root], ..Default::default() };
-        let mut nodes = Vec::new();
-        flatten(&form, None, &mut nodes, 0);
-        let current = nodes.iter().position(|n| n.som == target && n.kind != XfaKind::Form).unwrap_or(1.min(nodes.len().saturating_sub(1)));
-        XHost {
-            nodes,
-            effects: Vec::new(),
-            console: Vec::new(),
-            doc: doc.clone(),
-            added: 0,
-            current,
-            set_at: HashMap::new(),
-            barrier: 0,
-            alerts: 0,
-            dropped_effects: 0,
-            clipped_values: 0,
-            dropped_alerts: 0,
-            dropped_console: 0,
-            kept: 0,
-            dropped_bytes: 0,
-        }
-    }
-
-    /// Room for `bytes` more bytes of kept text: charged when there is, a drop counted when not.
-    fn room(&mut self, bytes: usize) -> bool {
-        match self.kept.checked_add(bytes).filter(|k| *k <= MAX_PAYLOAD) {
-            Some(k) => {
-                self.kept = k;
-                true
-            }
-            None => {
-                self.dropped_bytes = self.dropped_bytes.saturating_add(1);
-                false
-            }
-        }
-    }
-
-    /// Record an effect: values, presence and access set again on the same object replace the
-    /// earlier one; past [`MAX_EFFECTS`] (or [`MAX_ALERTS`] message boxes, or [`MAX_PAYLOAD`]
-    /// bytes of text) effects are counted and dropped.
-    pub(crate) fn push(&mut self, e: XfaEffect) {
-        let e = self.clip_effect(e);
-        if self.room(payload(&e)) {
-            self.record(e);
-        }
-    }
-
-    /// Room for `e`, which holds `bytes` of text, charged now: a change to the snapshot is made
-    /// only when the effect that applies it will be kept, so a script never sees a change its
-    /// effects leave out. An effect that replaces an earlier one needs no new slot. A drop is
-    /// counted when there is no room.
-    fn reserve(&mut self, e: &XfaEffect, bytes: usize) -> bool {
-        let replaces = effect_key(e).and_then(|k| self.set_at.get(&k)).is_some_and(|&at| at >= self.barrier && at < self.effects.len());
-        if !replaces && self.effects.len() >= MAX_EFFECTS {
-            self.dropped_effects += 1;
-            return false;
-        }
-        self.room(bytes)
-    }
-
-    /// Set the presence or access of node `i` to what `e` (a [`XfaEffect::SetPresence`] or
-    /// [`XfaEffect::SetAccess`]) says, in the snapshot only when the effect is kept.
-    pub(crate) fn set_state(&mut self, i: usize, e: XfaEffect) {
-        if !self.reserve(&e, payload(&e)) {
-            return;
-        }
-        if let Some(n) = self.nodes.get_mut(i) {
-            match &e {
-                XfaEffect::SetPresence { presence, .. } => n.presence = presence.clone(),
-                XfaEffect::SetAccess { access, .. } => n.access = access.clone(),
-                _ => {}
-            }
-        }
-        self.record(e);
-    }
-
-    /// `e` with its text cut to the lengths an effect keeps.
-    fn clip_effect(&mut self, e: XfaEffect) -> XfaEffect {
-        match e {
-            XfaEffect::MessageBox(m) => XfaEffect::MessageBox(clip(m)),
-            XfaEffect::LaunchUrl(u) => XfaEffect::LaunchUrl(clip(u)),
-            XfaEffect::SetFocus(s) => XfaEffect::SetFocus(clip(s)),
-            XfaEffect::ResetData(names) => XfaEffect::ResetData(names.into_iter().map(clip).collect()),
-            XfaEffect::SetValue { som, value } => {
-                let (value, cut) = clip_value(value);
-                if cut {
-                    self.clipped_values += 1;
-                }
-                XfaEffect::SetValue { som, value }
-            }
-            other => other,
-        }
-    }
-
-    /// Keep `e`, whose bytes are already charged, against the count limits.
-    fn record(&mut self, e: XfaEffect) {
-        if let Some(key) = effect_key(&e) {
-            if let Some(&at) = self.set_at.get(&key)
-                && at >= self.barrier
-                && let Some(slot) = self.effects.get_mut(at)
-            {
-                *slot = e;
-                return;
-            }
-            if self.effects.len() >= MAX_EFFECTS {
-                self.dropped_effects += 1;
-                return;
-            }
-            self.set_at.insert(key, self.effects.len());
-            self.effects.push(e);
-            return;
-        }
-        if matches!(e, XfaEffect::MessageBox(_)) {
-            if self.alerts >= MAX_ALERTS {
-                self.dropped_alerts += 1;
-                return;
-            }
-            self.alerts += 1;
-        }
-        if self.effects.len() >= MAX_EFFECTS {
-            self.dropped_effects += 1;
-            return;
-        }
-        if matches!(e, XfaEffect::AddInstance { .. } | XfaEffect::RemoveInstance { .. } | XfaEffect::ResetData(_)) {
-            self.barrier = self.effects.len() + 1;
-        }
-        self.effects.push(e);
-    }
-
-    pub(crate) fn print(&mut self, line: String) {
-        if self.console.len() >= MAX_CONSOLE {
-            self.dropped_console += 1;
-        } else if self.room(line.len()) {
-            self.console.push(line);
-        }
-    }
-
-    /// What the limits left out.
-    pub(crate) fn notes(&self) -> Vec<String> {
-        let mut out = Vec::new();
-        if self.dropped_effects > 0 {
-            out.push(format!("the script made more than {MAX_EFFECTS} changes; {} more were left out", self.dropped_effects));
-        }
-        if self.dropped_alerts > 0 {
-            out.push(format!("the script showed more than {MAX_ALERTS} messages; {} more were left out", self.dropped_alerts));
-        }
-        if self.dropped_console > 0 {
-            out.push(format!("the script printed more than {MAX_CONSOLE} console lines; {} more were left out", self.dropped_console));
-        }
-        if self.dropped_bytes > 0 {
-            out.push(format!("the script's changes and output passed {} MiB of text; {} more were left out", MAX_PAYLOAD >> 20, self.dropped_bytes));
-        }
-        if self.clipped_values > 0 {
-            out.push(format!("the script set {} value(s) longer than {MAX_VALUE} characters; they were cut", self.clipped_values));
-        }
-        out
-    }
-
-    /// Give node `i` the value `text` when it is a field or exclusion group (nothing else
-    /// holds a value; writing one into a subform would put text where another viewer expects
-    /// a data group). Returns whether it was.
-    pub(crate) fn set_value(&mut self, i: usize, text: String) -> bool {
-        let Some(n) = self.nodes.get(i) else { return false };
-        if n.gone || !matches!(n.kind, XfaKind::Field | XfaKind::ExclGroup) {
-            return false;
-        }
-        let som = n.som.clone();
-        // Cut here, not only in the effect: later reads in the script see what is saved, and
-        // the snapshot stays bounded however often a long value is written.
-        let (text, cut) = clip_value(text);
-        if cut {
-            self.clipped_values += 1;
-        }
-        // The snapshot's copy and the effect's are charged together, before either is kept:
-        // past the byte budget or the effect cap the write is left out of both.
-        let effect = XfaEffect::SetValue { som, value: text.clone() };
-        if !self.reserve(&effect, text.len().saturating_add(payload(&effect))) {
-            return true;
-        }
-        if let Some(n) = self.nodes.get_mut(i) {
-            n.value = text;
-            n.formatted = None;
-        }
-        self.record(effect);
-        true
-    }
-}
-
-type Shared = RefCell<XHost>;
-
-/// The form host of the script running in `ctx`.
-fn host(ctx: &Context) -> JsResult<&Shared> {
-    ctx.get_data::<Shared>().ok_or_else(|| error("the XFA script host is not set up"))
-}
-
-/// The snapshot `n` and its descendants flattened into `out` under `parent` (to [`MAX_DEPTH`]
-/// and [`MAX_NODES`]): the index of `n`'s node, `None` past the limits.
-fn flatten(n: &XfaNode, parent: Option<usize>, out: &mut Vec<HNode>, depth: usize) -> Option<usize> {
-    if depth > MAX_DEPTH || out.len() >= MAX_NODES {
-        return None;
-    }
-    let idx = out.len();
-    out.push(HNode {
-        name: n.name.clone(),
-        som: n.som.clone(),
-        kind: n.kind.unwrap_or(XfaKind::Subform),
-        value: n.value.clone(),
-        numeric: n.numeric,
-        presence: if n.presence.is_empty() { "visible".into() } else { n.presence.clone() },
-        access: if n.access.is_empty() { "open".into() } else { n.access.clone() },
-        repeatable: n.repeatable,
-        occur_min: n.occur_min,
-        occur_max: n.occur_max,
-        index: n.index,
-        parent,
-        children: Vec::new(),
-        gone: false,
-        formatted: n.formatted.clone(),
-    });
-    let mut kids = Vec::new();
-    for c in &n.children {
-        if let Some(ci) = flatten(c, Some(idx), out, depth + 1) {
-            kids.push(ci);
-        }
-    }
-    if let Some(h) = out.get_mut(idx) {
-        h.children = kids;
-    }
-    Some(idx)
-}
-
-// ── node objects ────────────────────────────────────────────────────────────────────────────
-
-const IDX: &str = "__xfaNode";
-
-fn node_index(target: &JsValue, ctx: &mut Context) -> JsResult<usize> {
-    let o = target.as_object().ok_or_else(|| error("not an XFA node"))?;
-    let v = o.get(JsString::from(IDX), ctx)?;
-    let n = v.to_number(ctx)?;
-    if !n.is_finite() || n < 0.0 {
-        return Err(error("not an XFA node"));
-    }
-    Ok(n as usize)
-}
-
-/// A Proxy standing for node `idx`.
-fn node_object(ctx: &mut Context, idx: usize) -> JsResult<JsValue> {
-    let target = ObjectInitializer::new(ctx).property(JsString::from(IDX), JsValue::from(idx as f64), Attribute::READONLY).build();
-    let proxy = JsProxy::builder(target).get(node_get).set(node_set).has(node_has).build(ctx)?;
-    Ok(proxy.into())
-}
-
-/// An object that takes any property read or write without complaint (`this.border.fill…`,
-/// `this.fillColor = …`): what a script sets there changes nothing here.
-fn sink(ctx: &mut Context) -> JsResult<JsValue> {
-    let target = ObjectInitializer::new(ctx).build();
-    let proxy = JsProxy::builder(target).get(sink_get).set(sink_set).build(ctx)?;
-    Ok(proxy.into())
-}
-
-fn sink_get(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let key = arg(args, 1);
-    if key.as_symbol().is_some() {
-        return Ok(JsValue::undefined());
-    }
-    match text(&key, ctx)?.as_str() {
-        "value" | "toString" | "valueOf" => Ok(s("")),
-        _ => sink(ctx),
-    }
-}
-
-fn sink_set(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(true))
-}
-
-fn node_has(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(true))
-}
-
-fn value_js(h: &HNode) -> JsValue {
-    if h.value.is_empty() {
-        return JsValue::null();
-    }
-    if h.numeric
-        && let Some(n) = as_number(&h.value)
-    {
-        return JsValue::from(n);
-    }
-    s(&h.value)
-}
-
-/// `(idx, name)` of the child of `parent` named `name`, first instance.
-pub(crate) fn child_named(h: &XHost, parent: usize, name: &str) -> Option<usize> {
-    let p = h.nodes.get(parent)?;
-    p.children.iter().copied().find(|&c| h.nodes.get(c).is_some_and(|n| !n.gone && n.name == name))
-}
-
-/// Every live instance named `name` under `parent`, in order.
-pub(crate) fn instances(h: &XHost, parent: usize, name: &str) -> Vec<usize> {
-    h.nodes
-        .get(parent)
-        .map(|p| p.children.iter().copied().filter(|&c| h.nodes.get(c).is_some_and(|n| !n.gone && n.name == name)).collect())
-        .unwrap_or_default()
-}
-
-fn list_object(ctx: &mut Context, items: &[usize]) -> JsResult<JsValue> {
-    let vals: Vec<JsValue> = items.iter().map(|i| JsValue::from(*i as f64)).collect();
-    let arr = JsArray::from_iter(vals, ctx);
-    let arr_obj: JsObject = arr.into();
-    fn item(_: &JsValue, args: &[JsValue], arr: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
-        let i = arg(args, 0).to_number(ctx)?;
-        if !i.is_finite() || i < 0.0 {
-            return Ok(JsValue::null());
-        }
-        let v = JsArray::from_object(arr.clone())?.get(i as u64, ctx)?;
-        if v.is_undefined() {
-            return Ok(JsValue::null());
-        }
-        let idx = v.to_number(ctx)? as usize;
-        node_object(ctx, idx)
-    }
-    let item_fn = function(ctx, NativeFunction::from_copy_closure_with_captures(item, arr_obj));
-    Ok(ObjectInitializer::new(ctx)
-        .property(js_string!("length"), JsValue::from(items.len() as f64), Attribute::READONLY)
-        .property(js_string!("item"), item_fn, Attribute::all())
-        .build()
-        .into())
-}
-
-/// The instance manager of the subform named `name` under `parent`.
-fn instance_manager(ctx: &mut Context, parent: usize, name: &str) -> JsResult<JsValue> {
-    let (count, min, max) = {
-        let h = host(ctx)?.borrow();
-        let live = instances(&h, parent, name);
-        let first = live.first().and_then(|i| h.nodes.get(*i));
-        (live.len(), first.map_or(0, |n| n.occur_min), first.and_then(|n| n.occur_max))
-    };
-    let key = ObjectInitializer::new(ctx)
-        .property(js_string!("parent"), JsValue::from(parent as f64), Attribute::READONLY)
-        .property(js_string!("name"), s(name), Attribute::READONLY)
-        .build();
-    fn target_of(key: &JsObject, ctx: &mut Context) -> JsResult<(usize, String)> {
-        let p = key.get(js_string!("parent"), ctx)?.to_number(ctx)? as usize;
-        let n = text(&key.get(js_string!("name"), ctx)?, ctx)?;
-        Ok((p, n))
-    }
-    fn add_instance(_: &JsValue, _: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
-        let (p, n) = target_of(key, ctx)?;
-        match add_instance_of(ctx, p, &n)? {
-            Some(i) => node_object(ctx, i),
-            None => Ok(JsValue::null()),
-        }
-    }
-    fn insert_instance(this: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
-        add_instance(this, args, key, ctx)
-    }
-    fn remove_instance(_: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
-        let (p, n) = target_of(key, ctx)?;
-        let i = arg(args, 0).to_number(ctx)?;
-        if i.is_finite() && i >= 0.0 {
-            remove_instance_of(ctx, p, &n, i as usize)?;
-        }
-        Ok(JsValue::undefined())
-    }
-    fn set_instances(_: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
-        let (p, n) = target_of(key, ctx)?;
-        let want = arg(args, 0).to_number(ctx)?;
-        if !want.is_finite() || want < 0.0 {
-            return Ok(JsValue::undefined());
-        }
-        host(ctx)?.borrow_mut().set_instances(p, &n, want as usize);
-        Ok(JsValue::undefined())
-    }
-    fn move_instance(_: &JsValue, _: &[JsValue], _: &JsObject, _: &mut Context) -> JsResult<JsValue> {
-        Ok(JsValue::undefined())
-    }
-    fn count_get(_: &JsValue, _: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
-        let (p, n) = target_of(key, ctx)?;
-        let c = instances(&host(ctx)?.borrow(), p, &n).len();
-        Ok(JsValue::from(c as f64))
-    }
-    fn count_set(_: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
-        set_instances(&JsValue::undefined(), args, key, ctx)
-    }
-    let count_g = function(ctx, NativeFunction::from_copy_closure_with_captures(count_get, key.clone()));
-    let count_s = function(ctx, NativeFunction::from_copy_closure_with_captures(count_set, key.clone()));
-    let add = function(ctx, NativeFunction::from_copy_closure_with_captures(add_instance, key.clone()));
-    let insert = function(ctx, NativeFunction::from_copy_closure_with_captures(insert_instance, key.clone()));
-    let remove = function(ctx, NativeFunction::from_copy_closure_with_captures(remove_instance, key.clone()));
-    let set = function(ctx, NativeFunction::from_copy_closure_with_captures(set_instances, key.clone()));
-    let mv = function(ctx, NativeFunction::from_copy_closure_with_captures(move_instance, key));
-    let _ = count;
-    let o = ObjectInitializer::new(ctx)
-        .property(js_string!("min"), JsValue::from(min as f64), Attribute::READONLY)
-        .property(js_string!("max"), max.map_or(JsValue::from(-1.0), |m| JsValue::from(m as f64)), Attribute::READONLY)
-        .property(js_string!("addInstance"), add, Attribute::all())
-        .property(js_string!("insertInstance"), insert, Attribute::all())
-        .property(js_string!("removeInstance"), remove, Attribute::all())
-        .property(js_string!("setInstances"), set, Attribute::all())
-        .property(js_string!("moveInstance"), mv, Attribute::all())
-        .property(js_string!("className"), s("instanceManager"), Attribute::READONLY)
-        .build();
-    use boa_engine::property::PropertyDescriptor;
-    o.define_property_or_throw(js_string!("count"), PropertyDescriptor::builder().get(count_g).set(count_s).configurable(true), ctx)?;
-    Ok(o.into())
-}
-
-/// Re-derive the SOM of `idx` and everything under it from its parent and index.
-fn renumber(h: &mut XHost, idx: usize, depth: usize) {
-    if depth > MAX_DEPTH {
-        return;
-    }
-    let (parent_som, name, index, kids) = {
-        let Some(n) = h.nodes.get(idx) else { return };
-        let parent_som = n.parent.and_then(|p| h.nodes.get(p)).map(|p| p.som.clone()).unwrap_or_default();
-        (parent_som, n.name.clone(), n.index, n.children.clone())
-    };
-    let som = child_som(parent_som, &name, index);
-    if let Some(n) = h.nodes.get_mut(idx) {
-        n.som = som;
-    }
-    for k in kids {
-        renumber(h, k, depth + 1);
-    }
-}
-
-/// The SOM of instance `index` of the node `name` under a parent at `parent_som`.
-fn child_som(parent_som: String, name: &str, index: usize) -> String {
-    if name.starts_with('#') || name.is_empty() {
-        parent_som
-    } else if parent_som.is_empty() {
-        format!("{name}[{index}]")
-    } else {
-        format!("{parent_som}.{name}[{index}]")
-    }
-}
-
-/// A copy of `src`'s subtree (values cleared) under `parent`, returning the copy's index.
-fn clone_subtree(h: &mut XHost, src: usize, parent: Option<usize>, depth: usize) -> Option<usize> {
-    if depth > MAX_DEPTH || h.nodes.len() >= MAX_NODES {
-        return None;
-    }
-    let (template, kids) = {
-        let n = h.nodes.get(src)?;
-        (
-            HNode {
-                name: n.name.clone(),
-                som: String::new(),
-                kind: n.kind,
-                value: String::new(),
-                numeric: n.numeric,
-                presence: n.presence.clone(),
-                access: n.access.clone(),
-                repeatable: n.repeatable,
-                occur_min: n.occur_min,
-                occur_max: n.occur_max,
-                index: n.index,
-                parent,
-                children: Vec::new(),
-                gone: false,
-                // The copy holds no value, so nothing is shown in its picture either.
-                formatted: None,
-            },
-            n.children.clone(),
-        )
-    };
-    let idx = h.nodes.len();
-    h.nodes.push(template);
-    let mut copied = Vec::new();
-    for k in kids {
-        // Nested repeating subforms copy their first instance only.
-        let skip = h.nodes.get(k).is_some_and(|c| c.gone || c.repeatable && c.index > 0);
-        if skip {
-            continue;
-        }
-        if let Some(ci) = clone_subtree(h, k, Some(idx), depth + 1) {
-            copied.push(ci);
-        }
-    }
-    if let Some(n) = h.nodes.get_mut(idx) {
-        n.children = copied;
-    }
-    Some(idx)
-}
-
-fn add_instance_of(ctx: &mut Context, parent: usize, name: &str) -> JsResult<Option<usize>> {
-    let mut h = host(ctx)?.borrow_mut();
-    Ok(h.add_instance(parent, name))
-}
-
-fn remove_instance_of(ctx: &mut Context, parent: usize, name: &str, i: usize) -> JsResult<()> {
-    let mut h = host(ctx)?.borrow_mut();
-    h.remove_instance(parent, name, i);
-    Ok(())
-}
-
-impl XHost {
-    /// A new instance of the subform `name` under `parent`, after the last one; `None` when the
-    /// subform doesn't repeat, is at its maximum, or the run added its limit.
-    pub(crate) fn add_instance(&mut self, parent: usize, name: &str) -> Option<usize> {
-        let h = self;
-        let live = instances(h, parent, name);
-        let &first = live.first()?;
-        let (repeatable, max) = h.nodes.get(first).map(|n| (n.repeatable, n.occur_max)).unwrap_or((false, Some(1)));
-        if !repeatable || max.is_some_and(|m| live.len() >= m) || h.added >= MAX_ADDED || h.nodes.len() >= MAX_NODES {
-            return None;
-        }
-        // The copy's SOM, as `renumber` will give it, so its effect is reserved before the copy.
-        let name = h.nodes.get(first).map(|n| n.name.clone()).unwrap_or_default();
-        let parent_som = h.nodes.get(parent).map(|p| p.som.clone()).unwrap_or_default();
-        let som = child_som(parent_som, &name, live.len());
-        if !h.reserve(&XfaEffect::AddInstance { som: String::new() }, som.len()) {
-            return None;
-        }
-        let new = clone_subtree(h, first, Some(parent), 0)?;
-        let last = live.last().copied().unwrap_or(first);
-        if let Some(n) = h.nodes.get_mut(new) {
-            n.index = live.len();
-        }
-        // Keep instances together: right after the last one.
-        if let Some(p) = h.nodes.get_mut(parent) {
-            let pos = p.children.iter().position(|&c| c == last).map_or(p.children.len(), |i| i + 1);
-            p.children.insert(pos, new);
-        }
-        renumber(h, new, 0);
-        h.added += 1;
-        h.record(XfaEffect::AddInstance { som });
-        Some(new)
-    }
-
-    /// Add or remove instances of the subform `name` under `parent` until there are `want`.
-    /// Bounded: adding stops at the cap or the maximum, removing at the floor, and a step that
-    /// changes nothing ends the loop.
-    pub(crate) fn set_instances(&mut self, parent: usize, name: &str, want: usize) {
-        let want = want.min(MAX_ADDED);
-        for _ in 0..=MAX_ADDED {
-            let have = instances(self, parent, name).len();
-            if have < want {
-                if self.add_instance(parent, name).is_none() {
-                    break;
-                }
-            } else if have > want && have > 0 {
-                self.remove_instance(parent, name, have - 1);
-                if instances(self, parent, name).len() == have {
-                    break;
-                }
-            } else {
-                break;
-            }
-        }
-    }
-
-    /// Remove instance `i` of the subform `name` under `parent` (never below the minimum, or
-    /// below one).
-    pub(crate) fn remove_instance(&mut self, parent: usize, name: &str, i: usize) {
-        let h = self;
-        let live = instances(h, parent, name);
-        let Some(&gone) = live.get(i) else { return };
-        let min = h.nodes.get(gone).map_or(0, |n| n.occur_min).max(1);
-        if live.len() <= min {
-            return;
-        }
-        let som = h.nodes.get(gone).map(|n| n.som.clone()).unwrap_or_default();
-        if !h.reserve(&XfaEffect::RemoveInstance { som: String::new() }, som.len()) {
-            return;
-        }
-        if let Some(n) = h.nodes.get_mut(gone) {
-            n.gone = true;
-        }
-        // Later instances move down one.
-        for (k, &inst) in live.iter().enumerate().skip(i + 1) {
-            if let Some(n) = h.nodes.get_mut(inst) {
-                n.index = k - 1;
-            }
-            renumber(h, inst, 0);
-        }
-        h.record(XfaEffect::RemoveInstance { som });
-    }
-}
-
-/// Resolve a SOM expression from node `from`: `$`, `$form`, `$record`, `$host`, `xfa.form…`,
-/// `parent`, `..name` (descendant search), `name[n]`, `name[*]`, `_name`.
-pub(crate) fn resolve_som(h: &XHost, from: usize, expr: &str) -> Vec<usize> {
-    let expr = expr.trim();
-    if expr.is_empty() {
-        return vec![from];
-    }
-    let root = 0usize;
-    let mut cur: Vec<usize> = vec![from];
-    let mut rest = expr;
-    let starts =
-        [("$form", root), ("xfa.form", root), ("$record", root), ("xfa.datasets.data", root), ("xfa.record", root), ("$", from), ("this", from)];
-    for (prefix, at) in starts {
-        if let Some(r) = rest.strip_prefix(prefix)
-            && (r.is_empty() || r.starts_with('.') || r.starts_with('['))
-        {
-            cur = vec![at];
-            rest = r;
-            break;
-        }
-    }
-    let mut depth = 0;
-    while !rest.is_empty() && depth < MAX_DEPTH {
-        depth += 1;
-        let descend = rest.starts_with("..");
-        rest = rest.trim_start_matches('.');
-        let end = rest.find(['.', '[']).unwrap_or(rest.len());
-        let (name, after) = rest.split_at(end);
-        let name = name.trim();
-        let (index, after) = match after.strip_prefix('[') {
-            Some(a) => {
-                let close = a.find(']').unwrap_or(a.len());
-                let idx = a.get(..close).map(str::trim).unwrap_or("");
-                (Some(idx.to_string()), a.get(close + 1..).unwrap_or(""))
-            }
-            None => (None, after),
-        };
-        rest = after;
-        let mut next = Vec::new();
-        for &c in &cur {
-            match name {
-                "" => {}
-                "parent" => {
-                    if let Some(p) = h.nodes.get(c).and_then(|n| n.parent) {
-                        next.push(p);
-                    }
-                }
-                _ => {
-                    let mut found: Vec<usize> = if descend { descendants_named(h, c, name, 0) } else { instances(h, c, name) };
-                    // A relative name a node has no child for is looked for among its siblings
-                    // and in each enclosing container, nearest first (so a field's script can
-                    // say `resolveNode("otherField")`).
-                    if found.is_empty() && depth == 1 && !descend {
-                        let mut at = h.nodes.get(c).and_then(|n| n.parent);
-                        let mut guard = 0;
-                        while let Some(p) = at
-                            && guard < MAX_DEPTH
-                        {
-                            found = instances(h, p, name);
-                            if !found.is_empty() {
-                                break;
-                            }
-                            at = h.nodes.get(p).and_then(|n| n.parent);
-                            guard += 1;
-                        }
-                    }
-                    match index.as_deref() {
-                        Some("*") => next.extend(found),
-                        Some(i) => {
-                            if let Some(k) = i.parse::<usize>().ok().and_then(|i| found.get(i)) {
-                                next.push(*k);
-                            }
-                        }
-                        None => next.extend(found.first()),
-                    }
-                }
-            }
-        }
-        // Each node once: `row[*].parent.row[*]` would otherwise multiply the list by the
-        // number of rows at every step.
-        let mut seen = std::collections::HashSet::with_capacity(next.len());
-        next.retain(|i| seen.insert(*i));
-        cur = next;
-        if cur.is_empty() {
-            break;
-        }
-    }
-    cur
-}
-
-/// The live descendants of node `from` named `name` (`from..name` in a SOM path), in document
-/// order, to [`MAX_DEPTH`].
-pub(crate) fn descendants_named(h: &XHost, from: usize, name: &str, depth: usize) -> Vec<usize> {
-    let mut out = Vec::new();
-    if depth > MAX_DEPTH {
-        return out;
-    }
-    let Some(n) = h.nodes.get(from) else { return out };
-    for &c in &n.children {
-        if let Some(k) = h.nodes.get(c)
-            && !k.gone
-        {
-            if k.name == name {
-                out.push(c);
-            } else {
-                out.extend(descendants_named(h, c, name, depth + 1));
-            }
-        }
-    }
-    out
-}
-
-/// A property read on a form node's Proxy: its value (and `formattedValue` as its picture shows
-/// it), attributes, relatives, methods, instance managers and children by name.
-fn node_get(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let idx = node_index(&arg(args, 0), ctx)?;
-    let key = arg(args, 1);
-    if key.as_symbol().is_some() {
-        return Ok(JsValue::undefined());
-    }
-    let key = text(&key, ctx)?;
-    let snapshot = {
-        let h = host(ctx)?.borrow();
-        let Some(n) = h.nodes.get(idx) else { return Ok(JsValue::undefined()) };
-        (n.name.clone(), n.som.clone(), n.kind, n.value.clone(), n.presence.clone(), n.access.clone(), n.index, n.parent, n.children.clone())
-    };
-    let (name, som, kind, value, presence, access, index, parent, children) = snapshot;
-    Ok(match key.as_str() {
-        IDX => JsValue::from(idx as f64),
-        "rawValue" | "value" => host(ctx)?.borrow().nodes.get(idx).map_or(JsValue::null(), value_js),
-        "formattedValue" => s(&host(ctx)?.borrow().nodes.get(idx).and_then(|n| n.formatted.clone()).unwrap_or(value)),
-        "name" => s(&name),
-        "somExpression" => s(&som),
-        "className" => s(kind.class_name()),
-        "index" | "instanceIndex" => JsValue::from(index as f64),
-        "presence" => s(&presence),
-        "access" => s(&access),
-        "isNull" => JsValue::from(value.is_empty()),
-        "mandatory" => s("disabled"),
-        "parent" => match parent {
-            Some(p) => node_object(ctx, p)?,
-            None => JsValue::null(),
-        },
-        "nodes" => {
-            let live: Vec<usize> = {
-                let h = host(ctx)?.borrow();
-                children.iter().copied().filter(|&c| h.nodes.get(c).is_some_and(|n| !n.gone)).collect()
-            };
-            list_object(ctx, &live)?
-        }
-        "all" => {
-            let live = match parent {
-                Some(p) => instances(&host(ctx)?.borrow(), p, &name),
-                None => vec![idx],
-            };
-            list_object(ctx, &live)?
-        }
-        "instanceManager" => match parent {
-            Some(p) => instance_manager(ctx, p, &name)?,
-            None => JsValue::undefined(),
-        },
-        "resolveNode" => resolver(ctx, idx, false)?,
-        "resolveNodes" => resolver(ctx, idx, true)?,
-        "recalculate" => function(ctx, NativeFunction::from_fn_ptr(recalculate)).into(),
-        "remerge" => function(ctx, NativeFunction::from_fn_ptr(relayout)).into(),
-        "getAttribute"
-        | "setAttribute"
-        | "execEvent"
-        | "execInitialize"
-        | "execCalculate"
-        | "execValidate"
-        | "getElement"
-        | "setElement"
-        | "isPropertySpecified"
-        | "loadXML"
-        | "saveXML"
-        | "clone" => function(ctx, NativeFunction::from_fn_ptr(noop)).into(),
-        "toString" | "valueOf" | "toJSON" => function(ctx, NativeFunction::from_fn_ptr(node_to_string)).into(),
-        "length" => JsValue::undefined(),
-        "border" | "ui" | "font" | "caption" | "fillColor" | "borderColor" | "fontColor" | "margin" | "para" | "assist" | "validate" | "format"
-        | "items" | "bind" | "keep" | "h" | "w" | "x" | "y" | "minH" | "maxH" | "minW" | "maxW" | "layout" | "model" | "oneOfChild" | "locale"
-        | "relevant" | "colSpan" | "dataNode" | "defaultValue" | "editValue" | "selectedIndex" | "event" | "calculate" | "traversal" | "extras"
-        | "desc" => sink(ctx)?,
-        other => {
-            if let Some(child) = other.strip_prefix('_') {
-                let exists = child_named(&host(ctx)?.borrow(), idx, child).is_some();
-                return if exists { instance_manager(ctx, idx, child) } else { Ok(JsValue::undefined()) };
-            }
-            let found = child_named(&host(ctx)?.borrow(), idx, other);
-            match found {
-                Some(c) => node_object(ctx, c)?,
-                None => JsValue::undefined(),
-            }
-        }
-    })
-}
-
-fn node_set(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let idx = node_index(&arg(args, 0), ctx)?;
-    let key = arg(args, 1);
-    if key.as_symbol().is_some() {
-        return Ok(JsValue::from(true));
-    }
-    let key = text(&key, ctx)?;
-    let value = arg(args, 2);
-    let value = if value.is_null() || value.is_undefined() { String::new() } else { text(&value, ctx)? };
-    let mut h = host(ctx)?.borrow_mut();
-    let Some(n) = h.nodes.get(idx) else { return Ok(JsValue::from(true)) };
-    let som = n.som.clone();
-    match key.as_str() {
-        "rawValue" | "value" | "formattedValue" => {
-            // Not a field: the property doesn't exist, as in Acrobat, and nothing is recorded.
-            h.set_value(idx, value);
-        }
-        "presence" => {
-            let p = match value.as_str() {
-                "hidden" | "invisible" | "inactive" | "visible" => value.clone(),
-                _ => return Ok(JsValue::from(true)),
-            };
-            h.set_state(idx, XfaEffect::SetPresence { som, presence: p });
-        }
-        "access" => {
-            let a = match value.as_str() {
-                "open" | "readOnly" | "protected" | "nonInteractive" => value.clone(),
-                _ => return Ok(JsValue::from(true)),
-            };
-            h.set_state(idx, XfaEffect::SetAccess { som, access: a });
-        }
-        _ => {}
-    }
-    Ok(JsValue::from(true))
-}
-
-fn node_to_string(this: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let idx = node_index(this, ctx)?;
-    Ok(s(&host(ctx)?.borrow().nodes.get(idx).map(|n| n.value.clone()).unwrap_or_default()))
-}
-
-fn noop(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::undefined())
-}
-
-/// `resolveNode(som)` / `resolveNodes(som)` bound to node `from`.
-fn resolver(ctx: &mut Context, from: usize, many: bool) -> JsResult<JsValue> {
-    let key = ObjectInitializer::new(ctx)
-        .property(js_string!("from"), JsValue::from(from as f64), Attribute::READONLY)
-        .property(js_string!("many"), JsValue::from(many), Attribute::READONLY)
-        .build();
-    fn resolve(_: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
-        let from = key.get(js_string!("from"), ctx)?.to_number(ctx)? as usize;
-        let many = key.get(js_string!("many"), ctx)?.to_boolean();
-        let expr = text(&arg(args, 0), ctx)?;
-        let found = resolve_som(&host(ctx)?.borrow(), from, &expr);
-        if many {
-            return list_object(ctx, &found);
-        }
-        match found.first() {
-            Some(i) => node_object(ctx, *i),
-            None => Ok(JsValue::null()),
-        }
-    }
-    Ok(function(ctx, NativeFunction::from_copy_closure_with_captures(resolve, key)).into())
-}
-
-// ── xfa.host, xfa.layout, xfa.event, app, console ───────────────────────────────────────────
-
-/// Records effect `e` on the host, as [`XHost::push`] does.
-fn effect(ctx: &mut Context, e: XfaEffect) -> JsResult<()> {
-    host(ctx)?.borrow_mut().push(e);
-    Ok(())
-}
-
-/// `xfa.host.messageBox(message)`: records the message, cut to [`MAX_LINE`] characters, and
-/// returns 1.
-fn message_box(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let m = clip(text(&arg(args, 0), ctx)?);
-    effect(ctx, XfaEffect::MessageBox(m))?;
-    Ok(JsValue::from(1.0))
-}
-
-/// `xfa.host.resetData(names)`: asks to reset the comma-separated fields, or every field when
-/// the list is empty.
-fn reset_data(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let list = text(&arg(args, 0), ctx)?;
-    effect(ctx, XfaEffect::ResetData(reset_names(&list)))?;
-    Ok(JsValue::undefined())
-}
-
-/// `xfa.host.print(…)`: asks to print; its arguments are ignored.
-fn print(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    effect(ctx, XfaEffect::Print)?;
-    Ok(JsValue::undefined())
-}
-
-/// `xfa.host.beep()`: asks to beep.
-fn beep(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    effect(ctx, XfaEffect::Beep)?;
-    Ok(JsValue::undefined())
-}
-
-/// `xfa.host.gotoURL(url)`: asks to open the URL.
-fn goto_url(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let u = text(&arg(args, 0), ctx)?;
-    effect(ctx, XfaEffect::LaunchUrl(u))?;
-    Ok(JsValue::undefined())
-}
-
-/// `xfa.host.setFocus(target)`: asks to focus the node, given as a node object or as a SOM
-/// expression resolved from the current node; an expression that names no node is passed on
-/// as written.
-fn set_focus(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let target = arg(args, 0);
-    let som = match target.as_object() {
-        Some(_) if node_index(&target, ctx).is_ok() => {
-            let i = node_index(&target, ctx)?;
-            host(ctx)?.borrow().nodes.get(i).map(|n| n.som.clone()).unwrap_or_default()
-        }
-        _ => {
-            let expr = text(&target, ctx)?;
-            let h = host(ctx)?.borrow();
-            let found = resolve_som(&h, h.current, &expr);
-            found.first().and_then(|i| h.nodes.get(*i)).map(|n| n.som.clone()).unwrap_or(expr)
-        }
-    };
-    effect(ctx, XfaEffect::SetFocus(som))?;
-    Ok(JsValue::undefined())
-}
-
-/// `app.execMenuItem(name)`: the effect for the request the shared menu table gives the name
-/// (Save opens Save As too); an unknown name does nothing.
-fn exec_menu_item(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let item = text(&arg(args, 0), ctx)?;
-    match crate::menu_item(&item) {
-        Some(crate::Request::SaveAs) => effect(ctx, XfaEffect::SaveAs)?,
-        Some(crate::Request::Print) => effect(ctx, XfaEffect::Print)?,
-        Some(crate::Request::ShowPanel(p)) => effect(ctx, XfaEffect::ShowPanel(p))?,
-        _ => {}
-    }
-    Ok(JsValue::undefined())
-}
-
-fn recalculate(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    effect(ctx, XfaEffect::Recalculate)?;
-    Ok(JsValue::undefined())
-}
-
-fn relayout(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    effect(ctx, XfaEffect::Relayout)?;
-    Ok(JsValue::undefined())
-}
-
-fn console_println(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    let m = clip(text(&arg(args, 0), ctx)?);
-    host(ctx)?.borrow_mut().print(m);
-    Ok(JsValue::undefined())
-}
-
-fn response(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::null())
-}
-
-fn layout_page(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(host(ctx)?.borrow().doc.page as f64 + 1.0))
-}
-
-fn layout_page0(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(host(ctx)?.borrow().doc.page as f64))
-}
-
-fn layout_page_count(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(host(ctx)?.borrow().doc.page_count as f64))
-}
-
-fn zero(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
-    Ok(JsValue::from(0.0))
-}
-
-fn xfa_resolve(ctx: &mut Context, many: bool) -> JsResult<JsValue> {
-    let current = host(ctx)?.borrow().current;
-    resolver(ctx, current, many)
-}
-
-/// Defines the globals for one script on node `current`: `xfa` (`form`, `host`, `layout`, `event`,
-/// `resolveNode` and more), `event` as the same object as `xfa.event`, `app`, `console`, `util`,
-/// and the nodes in scope by name, with `_name` for each repeatable one's instance manager.
-fn install(ctx: &mut Context, event: &XfaEvent, doc: &XfaDoc, current: usize) -> JsResult<()> {
-    let rw = Attribute::CONFIGURABLE;
-    let form = node_object(ctx, 0)?;
-    let this_node = node_object(ctx, current)?;
-    let host_obj = ObjectInitializer::new(ctx)
-        .function(NativeFunction::from_fn_ptr(message_box), js_string!("messageBox"), 4)
-        .function(NativeFunction::from_fn_ptr(reset_data), js_string!("resetData"), 1)
-        .function(NativeFunction::from_fn_ptr(print), js_string!("print"), 8)
-        .function(NativeFunction::from_fn_ptr(beep), js_string!("beep"), 1)
-        .function(NativeFunction::from_fn_ptr(goto_url), js_string!("gotoURL"), 2)
-        .function(NativeFunction::from_fn_ptr(set_focus), js_string!("setFocus"), 1)
-        .function(NativeFunction::from_fn_ptr(response), js_string!("response"), 4)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("openList"), 1)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("exportData"), 2)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("importData"), 1)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("pageDown"), 0)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("pageUp"), 0)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("getFocus"), 0)
-        .property(js_string!("currentPage"), JsValue::from(doc.page as f64), rw)
-        .property(js_string!("numPages"), JsValue::from(doc.page_count as f64), rw)
-        .property(js_string!("name"), s("Acrobat"), Attribute::READONLY)
-        .property(js_string!("appType"), s("Exchange-Pro"), Attribute::READONLY)
-        .property(js_string!("version"), s("11"), Attribute::READONLY)
-        .property(js_string!("variation"), s("Full"), Attribute::READONLY)
-        .property(js_string!("language"), s("en"), Attribute::READONLY)
-        .property(js_string!("platform"), s(platform()), Attribute::READONLY)
-        .property(js_string!("calculationsEnabled"), JsValue::from(true), rw)
-        .property(js_string!("validationsEnabled"), JsValue::from(true), rw)
-        .property(js_string!("title"), s(&doc.file_name), rw)
-        .build();
-    let layout = ObjectInitializer::new(ctx)
-        .function(NativeFunction::from_fn_ptr(layout_page), js_string!("page"), 1)
-        .function(NativeFunction::from_fn_ptr(layout_page0), js_string!("absPage"), 1)
-        .function(NativeFunction::from_fn_ptr(layout_page_count), js_string!("pageCount"), 0)
-        .function(NativeFunction::from_fn_ptr(layout_page_count), js_string!("absPageCount"), 0)
-        .function(NativeFunction::from_fn_ptr(relayout), js_string!("relayout"), 0)
-        .function(NativeFunction::from_fn_ptr(relayout), js_string!("relayoutPageArea"), 0)
-        .function(NativeFunction::from_fn_ptr(zero), js_string!("h"), 2)
-        .function(NativeFunction::from_fn_ptr(zero), js_string!("w"), 2)
-        .function(NativeFunction::from_fn_ptr(zero), js_string!("x"), 2)
-        .function(NativeFunction::from_fn_ptr(zero), js_string!("y"), 2)
-        .function(NativeFunction::from_fn_ptr(zero), js_string!("pageSpan"), 1)
-        .property(js_string!("ready"), JsValue::from(true), Attribute::READONLY)
-        .build();
-    let ev = ObjectInitializer::new(ctx)
-        .property(js_string!("name"), s(&event.activity), Attribute::all())
-        .property(js_string!("newText"), s(&event.new_text), Attribute::all())
-        .property(js_string!("prevText"), s(&event.prev_text), Attribute::all())
-        .property(js_string!("fullText"), s(&event.new_text), Attribute::all())
-        .property(js_string!("change"), s(""), Attribute::all())
-        .property(js_string!("target"), this_node.clone(), Attribute::all())
-        .property(js_string!("selStart"), JsValue::from(0.0), Attribute::all())
-        .property(js_string!("selEnd"), JsValue::from(0.0), Attribute::all())
-        .property(js_string!("cancelAction"), JsValue::from(false), Attribute::all())
-        .property(js_string!("reenter"), JsValue::from(false), Attribute::all())
-        .property(js_string!("shift"), JsValue::from(false), Attribute::all())
-        .property(js_string!("modifier"), JsValue::from(false), Attribute::all())
-        .property(js_string!("keyDown"), JsValue::from(false), Attribute::all())
-        .property(js_string!("commitKey"), JsValue::from(0.0), Attribute::all())
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("emit"), 0)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("reset"), 0)
-        .build();
-    let datasets = ObjectInitializer::new(ctx).property(js_string!("data"), form.clone(), rw).build();
-    let template = sink(ctx)?;
-    let resolve_one = xfa_resolve(ctx, false)?;
-    let resolve_many = xfa_resolve(ctx, true)?;
-    let xfa = ObjectInitializer::new(ctx)
-        .property(js_string!("form"), form.clone(), rw)
-        .property(js_string!("host"), host_obj, rw)
-        .property(js_string!("layout"), layout, rw)
-        .property(js_string!("event"), ev.clone(), rw)
-        .property(js_string!("datasets"), datasets, rw)
-        .property(js_string!("record"), form.clone(), rw)
-        .property(js_string!("template"), template, rw)
-        .property(js_string!("resolveNode"), resolve_one, rw)
-        .property(js_string!("resolveNodes"), resolve_many, rw)
-        .function(NativeFunction::from_fn_ptr(recalculate), js_string!("recalculate"), 1)
-        .function(NativeFunction::from_fn_ptr(relayout), js_string!("remerge"), 0)
-        .build();
-    ctx.register_global_property(js_string!("xfa"), xfa, rw)?;
-    ctx.register_global_property(js_string!("event"), ev, rw)?;
-    ctx.register_global_property(js_string!("__xfa_this"), this_node, rw)?;
-    let app = ObjectInitializer::new(ctx)
-        .function(NativeFunction::from_fn_ptr(message_box), js_string!("alert"), 4)
-        .function(NativeFunction::from_fn_ptr(beep), js_string!("beep"), 1)
-        .function(NativeFunction::from_fn_ptr(response), js_string!("response"), 1)
-        .function(NativeFunction::from_fn_ptr(goto_url), js_string!("launchURL"), 2)
-        .function(NativeFunction::from_fn_ptr(exec_menu_item), js_string!("execMenuItem"), 1)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("setTimeOut"), 2)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("setInterval"), 2)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("clearTimeOut"), 1)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("clearInterval"), 1)
-        .property(js_string!("viewerType"), s("Exchange-Pro"), Attribute::READONLY)
-        .property(js_string!("viewerVariation"), s("Full"), Attribute::READONLY)
-        .property(js_string!("viewerVersion"), JsValue::from(24.0), Attribute::READONLY)
-        .property(js_string!("platform"), s(platform()), Attribute::READONLY)
-        .property(js_string!("language"), s("ENU"), Attribute::READONLY)
-        .build();
-    ctx.register_global_property(js_string!("app"), app, rw)?;
-    let console = ObjectInitializer::new(ctx)
-        .function(NativeFunction::from_fn_ptr(console_println), js_string!("println"), 1)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("show"), 0)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("hide"), 0)
-        .function(NativeFunction::from_fn_ptr(noop), js_string!("clear"), 0)
-        .build();
-    ctx.register_global_property(js_string!("console"), console, rw)?;
-    let util = ObjectInitializer::new(ctx)
-        .function(NativeFunction::from_fn_ptr(printf), js_string!("printf"), 1)
-        .function(NativeFunction::from_fn_ptr(printd), js_string!("printd"), 2)
-        .function(NativeFunction::from_fn_ptr(printx), js_string!("printx"), 2)
-        .function(NativeFunction::from_fn_ptr(scand), js_string!("scand"), 2)
-        .build();
-    ctx.register_global_property(js_string!("util"), util, rw)?;
-    // Unqualified names: the current node's children, its siblings, then each ancestor's
-    // children, the nearest first. Instance managers as `_name`.
-    let scopes: Vec<usize> = {
-        let h = host(ctx)?.borrow();
-        let mut out = vec![current];
-        let mut at = h.nodes.get(current).and_then(|n| n.parent);
-        let mut guard = 0;
-        while let Some(p) = at
-            && guard < MAX_DEPTH
-        {
-            out.push(p);
-            at = h.nodes.get(p).and_then(|n| n.parent);
-            guard += 1;
-        }
-        out
-    };
-    // Names that stay what JavaScript (or this host) means by them: a field called `Date`
-    // is reached as `this.parent.Date` or by resolveNode.
-    const RESERVED: &[&str] = &[
-        "xfa",
-        "event",
-        "app",
-        "console",
-        "util",
-        "this",
-        "__xfa_this",
-        "__xfa_src",
-        "eval",
-        "arguments",
-        "globalThis",
-        "window",
-        "undefined",
-        "NaN",
-        "Infinity",
-        "Object",
-        "Function",
-        "Array",
-        "Number",
-        "String",
-        "Boolean",
-        "Symbol",
-        "Date",
-        "RegExp",
-        "Error",
-        "TypeError",
-        "RangeError",
-        "SyntaxError",
-        "Math",
-        "JSON",
-        "Map",
-        "Set",
-        "WeakMap",
-        "WeakSet",
-        "Promise",
-        "Proxy",
-        "Reflect",
-        "parseInt",
-        "parseFloat",
-        "isNaN",
-        "isFinite",
-        "encodeURIComponent",
-        "decodeURIComponent",
-        "encodeURI",
-        "decodeURI",
-        "escape",
-        "unescape",
-        "BigInt",
-        "ArrayBuffer",
-        "DataView",
-        "Intl",
-    ];
-    let mut defined: Vec<String> = RESERVED.iter().map(ToString::to_string).collect();
-    for scope in scopes {
-        let kids: Vec<(usize, String, bool)> = {
-            let h = host(ctx)?.borrow();
-            h.nodes
-                .get(scope)
-                .map(|n| n.children.iter().filter_map(|&c| h.nodes.get(c).map(|k| (c, k.name.clone(), k.repeatable && !k.gone))).collect())
-                .unwrap_or_default()
-        };
-        for (c, name, repeatable) in kids {
-            if !is_identifier(&name) || defined.contains(&name) {
-                continue;
-            }
-            let obj = node_object(ctx, c)?;
-            ctx.register_global_property(JsString::from(name.as_str()), obj, rw)?;
-            if repeatable {
-                let im = instance_manager(ctx, scope, &name)?;
-                ctx.register_global_property(JsString::from(format!("_{name}").as_str()), im, rw)?;
-            }
-            defined.push(name);
-        }
-    }
-    Ok(())
-}
-
-fn is_identifier(name: &str) -> bool {
-    let mut chars = name.chars();
-    match chars.next() {
-        Some(c) if c.is_ascii_alphabetic() || c == '_' || c == '$' => {}
-        _ => return false,
-    }
-    chars.all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '$')
-        && !matches!(
-            name,
-            "var"
-                | "let"
-                | "const"
-                | "function"
-                | "return"
-                | "if"
-                | "else"
-                | "for"
-                | "while"
-                | "new"
-                | "null"
-                | "true"
-                | "false"
-                | "undefined"
-                | "typeof"
-        )
-}
-
-/// Run `script` for `event` on the form `root` (the root subform), from node `event.target`.
-pub fn run_xfa(script: &str, event: &XfaEvent, doc: &XfaDoc, root: &XfaNode, limits: Limits) -> XfaOutcome {
-    let failed = |why: String| XfaOutcome { error: Some(why), ..Default::default() };
-    if let Some(why) = refuse(script) {
-        return failed(why);
-    }
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        std::thread::scope(|scope| {
-            let spawned = std::thread::Builder::new()
-                .name("pdfcraft-xfa-js".into())
-                .stack_size(crate::SCRIPT_STACK)
-                .spawn_scoped(scope, || run_here(script, event, doc, root.clone(), limits, &|| {}));
-            match spawned {
-                Ok(thread) => thread.join().unwrap_or_else(|_| failed("the script stopped with an internal error".into())),
-                Err(e) => failed(format!("the script engine could not start: {e}")),
-            }
-        })
-    }
-    #[cfg(target_arch = "wasm32")]
-    run_here(script, event, doc, root.clone(), limits, &|| {})
-}
-
-/// [`run_xfa`] with a time limit: a script still running `timeout` after the engine is ready
-/// (loops inside nested function calls can run for hours within the engine's per-frame loop
-/// limit) is left on its thread, which ends when the engine's own limits stop it, and an
-/// outcome with `abandoned` set comes back at once. In the browser build there are no
-/// threads: the script runs to its limits.
-pub fn run_xfa_within(script: &str, event: &XfaEvent, doc: &XfaDoc, root: XfaNode, limits: Limits, timeout: std::time::Duration) -> XfaOutcome {
-    if let Some(why) = refuse(script) {
-        return XfaOutcome { error: Some(why), ..Default::default() };
-    }
-    let (script, event, doc) = (script.to_string(), event.clone(), doc.clone());
-    run_within("pdfcraft-xfa-js", timeout, move |started| run_here(&script, &event, &doc, root, limits, started))
-}
-
-/// Longest the script engine may take to be ready for a script (its thread and context, and
-/// for the first script in a process the engine's own set-up) before the script is abandoned.
-/// It doesn't count against the script's time: on a busy machine the start alone can take
-/// longer than the tightest limit, and abandoning a script turns the form's scripts off.
-pub(crate) const ENGINE_START_LIMIT: std::time::Duration = std::time::Duration::from_secs(10);
-
-/// Run `script` on its own thread (with the script stack) and wait at most `timeout` for its
-/// outcome, counted from when it calls `started` (once the engine is ready); past that the
-/// thread is abandoned and the outcome says so. On wasm there are no threads: the script runs
-/// here.
-pub(crate) fn run_within(name: &str, timeout: std::time::Duration, script: impl FnOnce(&dyn Fn()) -> XfaOutcome + Send + 'static) -> XfaOutcome {
-    run_within_limits(name, ENGINE_START_LIMIT, timeout, script)
-}
-
-/// [`run_within`] with the engine's start-up limit given.
-pub(crate) fn run_within_limits(
-    name: &str,
-    start_limit: std::time::Duration,
-    timeout: std::time::Duration,
-    script: impl FnOnce(&dyn Fn()) -> XfaOutcome + Send + 'static,
-) -> XfaOutcome {
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        use std::sync::mpsc::RecvTimeoutError;
-        use std::time::Instant;
-        enum Step {
-            Started,
-            Done(XfaOutcome),
-        }
-        let failed = |why: String| XfaOutcome { error: Some(why), ..Default::default() };
-        let abandoned = |why: String| XfaOutcome { error: Some(why), abandoned: true, ..Default::default() };
-        let (tx, rx) = std::sync::mpsc::channel();
-        let spawned = std::thread::Builder::new().name(name.into()).stack_size(crate::SCRIPT_STACK).spawn(move || {
-            // The receiver is gone when the caller stopped waiting: nothing to report then.
-            let started = tx.clone();
-            let outcome = script(&move || {
-                let _ = started.send(Step::Started);
-            });
-            let _ = tx.send(Step::Done(outcome));
-        });
-        if let Err(e) = spawned {
-            return failed(format!("the script engine could not start: {e}"));
-        }
-        // Wait for the engine within its start-up limit, then for the script within its own.
-        let (mut running, mut limit) = (false, start_limit);
-        let mut deadline = Instant::now().checked_add(limit);
-        loop {
-            let left = deadline.map_or(limit, |d| d.saturating_duration_since(Instant::now()));
-            match rx.recv_timeout(left) {
-                Ok(Step::Done(o)) => return o,
-                Ok(Step::Started) => {
-                    // A second call changes nothing: the script's time has already begun.
-                    if !running {
-                        (running, limit) = (true, timeout);
-                        deadline = Instant::now().checked_add(limit);
-                    }
-                }
-                Err(RecvTimeoutError::Timeout) if running => {
-                    return abandoned(format!("the script ran longer than {:.1} s and was abandoned", timeout.as_secs_f64()));
-                }
-                Err(RecvTimeoutError::Timeout) => {
-                    return abandoned(format!("the script engine took longer than {:.0} s to start", start_limit.as_secs_f64()));
-                }
-                Err(RecvTimeoutError::Disconnected) => return failed("the script stopped with an internal error".into()),
-            }
-        }
-    }
-    #[cfg(target_arch = "wasm32")]
-    {
-        let _ = (name, start_limit, timeout);
-        script(&|| {})
-    }
-}
-
-/// The first script in a process sets the engine up (its built-ins, parser and compiler come
-/// into use): a trivial script takes that on, so a form's script is never timed with it.
-pub(crate) fn warm_up() {
-    static WARM: std::sync::Once = std::sync::Once::new();
-    // `call_once_force`: a poisoned `Once` (a panic while warming up) only means warming up again.
-    WARM.call_once_force(|_| {
-        let mut ctx = Context::default();
-        let _ = ctx.eval(Source::from_bytes(b"(function () { return eval('0'); }).call({})"));
-    });
-}
-
-/// `started` is called once the engine is ready: a time limit on the script runs from then.
-pub(crate) fn run_here(script: &str, event: &XfaEvent, doc: &XfaDoc, root: XfaNode, limits: Limits, started: &dyn Fn()) -> XfaOutcome {
-    warm_up();
-    let mut ctx = match Context::builder().host_hooks(std::rc::Rc::new(crate::CheckedCodeFromStrings)).build() {
-        Ok(ctx) => ctx,
-        Err(e) => return XfaOutcome { error: Some(format!("the script engine could not start: {e}")), ..Default::default() },
-    };
-    ctx.runtime_limits_mut().set_loop_iteration_limit(limits.loop_iterations);
-    ctx.runtime_limits_mut().set_recursion_limit(limits.recursion);
-    let host_state = XHost::new(root, &event.target, doc);
-    let current = host_state.current;
-    ctx.insert_data(RefCell::new(host_state));
-    let mut out = XfaOutcome::default();
-    let result = (|| -> JsResult<()> {
-        install(&mut ctx, event, doc, current)?;
-        // Ready for the script: its time starts now, the set-up above not charged to it.
-        started();
-        ctx.register_global_property(js_string!("__xfa_src"), s(script), Attribute::CONFIGURABLE)?;
-        // Direct eval inside a function called on the node: `this` is the node and the
-        // completion value is the script's last expression (what a calculate script yields).
-        let r = ctx.eval(Source::from_bytes(b"(function () { return eval(__xfa_src); }).call(__xfa_this)"))?;
-        if !r.is_undefined() {
-            // Best effort: a value that can't be made text (a symbol, say) is no failure.
-            out.result = Some(text(&r, &mut ctx).unwrap_or_default());
-            if r.is_boolean() {
-                out.result_bool = Some(r.to_boolean());
-            } else if r.is_null() {
-                out.result = Some(String::new());
-            }
-        }
-        Ok(())
-    })();
-    if let Err(e) = result {
-        out.error = Some(e.to_string());
-    }
-    if let Some(h) = ctx.remove_data::<Shared>() {
-        let h = h.into_inner();
-        out.notes = h.notes();
-        out.effects = h.effects;
-        out.console = h.console;
-    }
-    clip_result(&mut out);
-    out
-}
+mod globals;
+mod host;
+mod instances;
+mod model;
+mod nodes;
+mod run;
+
+pub(crate) use host::{HNode, XHost};
+pub use model::{MAX_ALERTS, MAX_CONSOLE, MAX_EFFECTS, XfaDoc, XfaEffect, XfaEvent, XfaKind, XfaNode, XfaOutcome};
+pub(crate) use model::{MAX_LINE, MAX_PAYLOAD, clip, clip_result, reset_names};
+pub(crate) use nodes::{child_named, descendants_named, instances, resolve_som};
+#[cfg(test)]
+pub(crate) use run::run_within_limits;
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) use run::{ENGINE_START_LIMIT, warm_up};
+pub(crate) use run::{run_here, run_within};
+pub use run::{run_xfa, run_xfa_within};
diff --git a/crates/js/src/xfa/globals.rs b/crates/js/src/xfa/globals.rs
new file mode 100644
index 0000000000..2507941658
--- /dev/null
+++ b/crates/js/src/xfa/globals.rs
@@ -0,0 +1,362 @@
+use super::host::host;
+use super::instances::instance_manager;
+use super::model::{MAX_DEPTH, XfaDoc, XfaEffect, XfaEvent, clip, reset_names};
+use super::nodes::{node_index, node_object, noop, resolve_som, resolver, sink};
+use super::*;
+
+// ── xfa.host, xfa.layout, xfa.event, app, console ───────────────────────────────────────────
+
+/// Records effect `e` on the host, as [`XHost::push`] does.
+fn effect(ctx: &mut Context, e: XfaEffect) -> JsResult<()> {
+    host(ctx)?.borrow_mut().push(e);
+    Ok(())
+}
+
+/// `xfa.host.messageBox(message)`: records the message, cut to [`MAX_LINE`] characters, and
+/// returns 1.
+fn message_box(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let m = clip(text(&arg(args, 0), ctx)?);
+    effect(ctx, XfaEffect::MessageBox(m))?;
+    Ok(JsValue::from(1.0))
+}
+
+/// `xfa.host.resetData(names)`: asks to reset the comma-separated fields, or every field when
+/// the list is empty.
+fn reset_data(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let list = text(&arg(args, 0), ctx)?;
+    effect(ctx, XfaEffect::ResetData(reset_names(&list)))?;
+    Ok(JsValue::undefined())
+}
+
+/// `xfa.host.print(…)`: asks to print; its arguments are ignored.
+fn print(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    effect(ctx, XfaEffect::Print)?;
+    Ok(JsValue::undefined())
+}
+
+/// `xfa.host.beep()`: asks to beep.
+fn beep(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    effect(ctx, XfaEffect::Beep)?;
+    Ok(JsValue::undefined())
+}
+
+/// `xfa.host.gotoURL(url)`: asks to open the URL.
+fn goto_url(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let u = text(&arg(args, 0), ctx)?;
+    effect(ctx, XfaEffect::LaunchUrl(u))?;
+    Ok(JsValue::undefined())
+}
+
+/// `xfa.host.setFocus(target)`: asks to focus the node, given as a node object or as a SOM
+/// expression resolved from the current node; an expression that names no node is passed on
+/// as written.
+fn set_focus(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let target = arg(args, 0);
+    let som = match target.as_object() {
+        Some(_) if node_index(&target, ctx).is_ok() => {
+            let i = node_index(&target, ctx)?;
+            host(ctx)?.borrow().nodes.get(i).map(|n| n.som.clone()).unwrap_or_default()
+        }
+        _ => {
+            let expr = text(&target, ctx)?;
+            let h = host(ctx)?.borrow();
+            let found = resolve_som(&h, h.current, &expr);
+            found.first().and_then(|i| h.nodes.get(*i)).map(|n| n.som.clone()).unwrap_or(expr)
+        }
+    };
+    effect(ctx, XfaEffect::SetFocus(som))?;
+    Ok(JsValue::undefined())
+}
+
+/// `app.execMenuItem(name)`: the effect for the request the shared menu table gives the name
+/// (Save opens Save As too); an unknown name does nothing.
+fn exec_menu_item(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let item = text(&arg(args, 0), ctx)?;
+    match crate::menu_item(&item) {
+        Some(crate::Request::SaveAs) => effect(ctx, XfaEffect::SaveAs)?,
+        Some(crate::Request::Print) => effect(ctx, XfaEffect::Print)?,
+        Some(crate::Request::ShowPanel(p)) => effect(ctx, XfaEffect::ShowPanel(p))?,
+        _ => {}
+    }
+    Ok(JsValue::undefined())
+}
+
+pub(super) fn recalculate(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    effect(ctx, XfaEffect::Recalculate)?;
+    Ok(JsValue::undefined())
+}
+
+pub(super) fn relayout(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    effect(ctx, XfaEffect::Relayout)?;
+    Ok(JsValue::undefined())
+}
+
+fn console_println(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let m = clip(text(&arg(args, 0), ctx)?);
+    host(ctx)?.borrow_mut().print(m);
+    Ok(JsValue::undefined())
+}
+
+fn response(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::null())
+}
+
+fn layout_page(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(host(ctx)?.borrow().doc.page as f64 + 1.0))
+}
+
+fn layout_page0(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(host(ctx)?.borrow().doc.page as f64))
+}
+
+fn layout_page_count(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(host(ctx)?.borrow().doc.page_count as f64))
+}
+
+fn zero(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(0.0))
+}
+
+fn xfa_resolve(ctx: &mut Context, many: bool) -> JsResult<JsValue> {
+    let current = host(ctx)?.borrow().current;
+    resolver(ctx, current, many)
+}
+
+/// Defines the globals for one script on node `current`: `xfa` (`form`, `host`, `layout`, `event`,
+/// `resolveNode` and more), `event` as the same object as `xfa.event`, `app`, `console`, `util`,
+/// and the nodes in scope by name, with `_name` for each repeatable one's instance manager.
+pub(super) fn install(ctx: &mut Context, event: &XfaEvent, doc: &XfaDoc, current: usize) -> JsResult<()> {
+    let rw = Attribute::CONFIGURABLE;
+    let form = node_object(ctx, 0)?;
+    let this_node = node_object(ctx, current)?;
+    let host_obj = ObjectInitializer::new(ctx)
+        .function(NativeFunction::from_fn_ptr(message_box), js_string!("messageBox"), 4)
+        .function(NativeFunction::from_fn_ptr(reset_data), js_string!("resetData"), 1)
+        .function(NativeFunction::from_fn_ptr(print), js_string!("print"), 8)
+        .function(NativeFunction::from_fn_ptr(beep), js_string!("beep"), 1)
+        .function(NativeFunction::from_fn_ptr(goto_url), js_string!("gotoURL"), 2)
+        .function(NativeFunction::from_fn_ptr(set_focus), js_string!("setFocus"), 1)
+        .function(NativeFunction::from_fn_ptr(response), js_string!("response"), 4)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("openList"), 1)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("exportData"), 2)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("importData"), 1)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("pageDown"), 0)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("pageUp"), 0)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("getFocus"), 0)
+        .property(js_string!("currentPage"), JsValue::from(doc.page as f64), rw)
+        .property(js_string!("numPages"), JsValue::from(doc.page_count as f64), rw)
+        .property(js_string!("name"), s("Acrobat"), Attribute::READONLY)
+        .property(js_string!("appType"), s("Exchange-Pro"), Attribute::READONLY)
+        .property(js_string!("version"), s("11"), Attribute::READONLY)
+        .property(js_string!("variation"), s("Full"), Attribute::READONLY)
+        .property(js_string!("language"), s("en"), Attribute::READONLY)
+        .property(js_string!("platform"), s(platform()), Attribute::READONLY)
+        .property(js_string!("calculationsEnabled"), JsValue::from(true), rw)
+        .property(js_string!("validationsEnabled"), JsValue::from(true), rw)
+        .property(js_string!("title"), s(&doc.file_name), rw)
+        .build();
+    let layout = ObjectInitializer::new(ctx)
+        .function(NativeFunction::from_fn_ptr(layout_page), js_string!("page"), 1)
+        .function(NativeFunction::from_fn_ptr(layout_page0), js_string!("absPage"), 1)
+        .function(NativeFunction::from_fn_ptr(layout_page_count), js_string!("pageCount"), 0)
+        .function(NativeFunction::from_fn_ptr(layout_page_count), js_string!("absPageCount"), 0)
+        .function(NativeFunction::from_fn_ptr(relayout), js_string!("relayout"), 0)
+        .function(NativeFunction::from_fn_ptr(relayout), js_string!("relayoutPageArea"), 0)
+        .function(NativeFunction::from_fn_ptr(zero), js_string!("h"), 2)
+        .function(NativeFunction::from_fn_ptr(zero), js_string!("w"), 2)
+        .function(NativeFunction::from_fn_ptr(zero), js_string!("x"), 2)
+        .function(NativeFunction::from_fn_ptr(zero), js_string!("y"), 2)
+        .function(NativeFunction::from_fn_ptr(zero), js_string!("pageSpan"), 1)
+        .property(js_string!("ready"), JsValue::from(true), Attribute::READONLY)
+        .build();
+    let ev = ObjectInitializer::new(ctx)
+        .property(js_string!("name"), s(&event.activity), Attribute::all())
+        .property(js_string!("newText"), s(&event.new_text), Attribute::all())
+        .property(js_string!("prevText"), s(&event.prev_text), Attribute::all())
+        .property(js_string!("fullText"), s(&event.new_text), Attribute::all())
+        .property(js_string!("change"), s(""), Attribute::all())
+        .property(js_string!("target"), this_node.clone(), Attribute::all())
+        .property(js_string!("selStart"), JsValue::from(0.0), Attribute::all())
+        .property(js_string!("selEnd"), JsValue::from(0.0), Attribute::all())
+        .property(js_string!("cancelAction"), JsValue::from(false), Attribute::all())
+        .property(js_string!("reenter"), JsValue::from(false), Attribute::all())
+        .property(js_string!("shift"), JsValue::from(false), Attribute::all())
+        .property(js_string!("modifier"), JsValue::from(false), Attribute::all())
+        .property(js_string!("keyDown"), JsValue::from(false), Attribute::all())
+        .property(js_string!("commitKey"), JsValue::from(0.0), Attribute::all())
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("emit"), 0)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("reset"), 0)
+        .build();
+    let datasets = ObjectInitializer::new(ctx).property(js_string!("data"), form.clone(), rw).build();
+    let template = sink(ctx)?;
+    let resolve_one = xfa_resolve(ctx, false)?;
+    let resolve_many = xfa_resolve(ctx, true)?;
+    let xfa = ObjectInitializer::new(ctx)
+        .property(js_string!("form"), form.clone(), rw)
+        .property(js_string!("host"), host_obj, rw)
+        .property(js_string!("layout"), layout, rw)
+        .property(js_string!("event"), ev.clone(), rw)
+        .property(js_string!("datasets"), datasets, rw)
+        .property(js_string!("record"), form.clone(), rw)
+        .property(js_string!("template"), template, rw)
+        .property(js_string!("resolveNode"), resolve_one, rw)
+        .property(js_string!("resolveNodes"), resolve_many, rw)
+        .function(NativeFunction::from_fn_ptr(recalculate), js_string!("recalculate"), 1)
+        .function(NativeFunction::from_fn_ptr(relayout), js_string!("remerge"), 0)
+        .build();
+    ctx.register_global_property(js_string!("xfa"), xfa, rw)?;
+    ctx.register_global_property(js_string!("event"), ev, rw)?;
+    ctx.register_global_property(js_string!("__xfa_this"), this_node, rw)?;
+    let app = ObjectInitializer::new(ctx)
+        .function(NativeFunction::from_fn_ptr(message_box), js_string!("alert"), 4)
+        .function(NativeFunction::from_fn_ptr(beep), js_string!("beep"), 1)
+        .function(NativeFunction::from_fn_ptr(response), js_string!("response"), 1)
+        .function(NativeFunction::from_fn_ptr(goto_url), js_string!("launchURL"), 2)
+        .function(NativeFunction::from_fn_ptr(exec_menu_item), js_string!("execMenuItem"), 1)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("setTimeOut"), 2)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("setInterval"), 2)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("clearTimeOut"), 1)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("clearInterval"), 1)
+        .property(js_string!("viewerType"), s("Exchange-Pro"), Attribute::READONLY)
+        .property(js_string!("viewerVariation"), s("Full"), Attribute::READONLY)
+        .property(js_string!("viewerVersion"), JsValue::from(24.0), Attribute::READONLY)
+        .property(js_string!("platform"), s(platform()), Attribute::READONLY)
+        .property(js_string!("language"), s("ENU"), Attribute::READONLY)
+        .build();
+    ctx.register_global_property(js_string!("app"), app, rw)?;
+    let console = ObjectInitializer::new(ctx)
+        .function(NativeFunction::from_fn_ptr(console_println), js_string!("println"), 1)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("show"), 0)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("hide"), 0)
+        .function(NativeFunction::from_fn_ptr(noop), js_string!("clear"), 0)
+        .build();
+    ctx.register_global_property(js_string!("console"), console, rw)?;
+    let util = ObjectInitializer::new(ctx)
+        .function(NativeFunction::from_fn_ptr(printf), js_string!("printf"), 1)
+        .function(NativeFunction::from_fn_ptr(printd), js_string!("printd"), 2)
+        .function(NativeFunction::from_fn_ptr(printx), js_string!("printx"), 2)
+        .function(NativeFunction::from_fn_ptr(scand), js_string!("scand"), 2)
+        .build();
+    ctx.register_global_property(js_string!("util"), util, rw)?;
+    // Unqualified names: the current node's children, its siblings, then each ancestor's
+    // children, the nearest first. Instance managers as `_name`.
+    let scopes: Vec<usize> = {
+        let h = host(ctx)?.borrow();
+        let mut out = vec![current];
+        let mut at = h.nodes.get(current).and_then(|n| n.parent);
+        let mut guard = 0;
+        while let Some(p) = at
+            && guard < MAX_DEPTH
+        {
+            out.push(p);
+            at = h.nodes.get(p).and_then(|n| n.parent);
+            guard += 1;
+        }
+        out
+    };
+    // Names that stay what JavaScript (or this host) means by them: a field called `Date`
+    // is reached as `this.parent.Date` or by resolveNode.
+    const RESERVED: &[&str] = &[
+        "xfa",
+        "event",
+        "app",
+        "console",
+        "util",
+        "this",
+        "__xfa_this",
+        "__xfa_src",
+        "eval",
+        "arguments",
+        "globalThis",
+        "window",
+        "undefined",
+        "NaN",
+        "Infinity",
+        "Object",
+        "Function",
+        "Array",
+        "Number",
+        "String",
+        "Boolean",
+        "Symbol",
+        "Date",
+        "RegExp",
+        "Error",
+        "TypeError",
+        "RangeError",
+        "SyntaxError",
+        "Math",
+        "JSON",
+        "Map",
+        "Set",
+        "WeakMap",
+        "WeakSet",
+        "Promise",
+        "Proxy",
+        "Reflect",
+        "parseInt",
+        "parseFloat",
+        "isNaN",
+        "isFinite",
+        "encodeURIComponent",
+        "decodeURIComponent",
+        "encodeURI",
+        "decodeURI",
+        "escape",
+        "unescape",
+        "BigInt",
+        "ArrayBuffer",
+        "DataView",
+        "Intl",
+    ];
+    let mut defined: Vec<String> = RESERVED.iter().map(ToString::to_string).collect();
+    for scope in scopes {
+        let kids: Vec<(usize, String, bool)> = {
+            let h = host(ctx)?.borrow();
+            h.nodes
+                .get(scope)
+                .map(|n| n.children.iter().filter_map(|&c| h.nodes.get(c).map(|k| (c, k.name.clone(), k.repeatable && !k.gone))).collect())
+                .unwrap_or_default()
+        };
+        for (c, name, repeatable) in kids {
+            if !is_identifier(&name) || defined.contains(&name) {
+                continue;
+            }
+            let obj = node_object(ctx, c)?;
+            ctx.register_global_property(JsString::from(name.as_str()), obj, rw)?;
+            if repeatable {
+                let im = instance_manager(ctx, scope, &name)?;
+                ctx.register_global_property(JsString::from(format!("_{name}").as_str()), im, rw)?;
+            }
+            defined.push(name);
+        }
+    }
+    Ok(())
+}
+
+fn is_identifier(name: &str) -> bool {
+    let mut chars = name.chars();
+    match chars.next() {
+        Some(c) if c.is_ascii_alphabetic() || c == '_' || c == '$' => {}
+        _ => return false,
+    }
+    chars.all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '$')
+        && !matches!(
+            name,
+            "var"
+                | "let"
+                | "const"
+                | "function"
+                | "return"
+                | "if"
+                | "else"
+                | "for"
+                | "while"
+                | "new"
+                | "null"
+                | "true"
+                | "false"
+                | "undefined"
+                | "typeof"
+        )
+}
diff --git a/crates/js/src/xfa/host.rs b/crates/js/src/xfa/host.rs
new file mode 100644
index 0000000000..419d2141fc
--- /dev/null
+++ b/crates/js/src/xfa/host.rs
@@ -0,0 +1,286 @@
+use super::model::{
+    MAX_ALERTS, MAX_CONSOLE, MAX_DEPTH, MAX_EFFECTS, MAX_NODES, MAX_PAYLOAD, MAX_VALUE, XfaDoc, XfaEffect, XfaKind, XfaNode, clip, clip_value,
+    effect_key, payload,
+};
+use super::*;
+
+/// One node of the flattened form, shared by the JavaScript and FormCalc engines.
+pub(crate) struct HNode {
+    pub(crate) name: String,
+    pub(crate) som: String,
+    pub(crate) kind: XfaKind,
+    pub(crate) value: String,
+    pub(crate) numeric: bool,
+    pub(crate) presence: String,
+    pub(crate) access: String,
+    pub(crate) repeatable: bool,
+    pub(crate) occur_min: usize,
+    pub(crate) occur_max: Option<usize>,
+    pub(crate) index: usize,
+    pub(crate) parent: Option<usize>,
+    pub(crate) children: Vec<usize>,
+    /// Removed by `removeInstance`: skipped everywhere.
+    pub(crate) gone: bool,
+    /// See [`XfaNode::formatted`]; dropped when a script sets the value, which it no longer shows.
+    pub(crate) formatted: Option<String>,
+}
+
+/// The form as a script sees and changes it, with the effects it records.
+pub(crate) struct XHost {
+    pub(crate) nodes: Vec<HNode>,
+    pub(crate) effects: Vec<XfaEffect>,
+    pub(crate) console: Vec<String>,
+    pub(crate) doc: XfaDoc,
+    pub(super) added: usize,
+    /// Index of `this`.
+    pub(crate) current: usize,
+    /// Where the effect setting a property of an object is in `effects`, by (property, SOM):
+    /// setting it again replaces that effect (the last value wins) unless something that
+    /// depends on order (rows added or removed, a reset) came after it.
+    set_at: HashMap<(u8, String), usize>,
+    /// Effects before this index are behind an order-dependent effect.
+    barrier: usize,
+    alerts: usize,
+    dropped_effects: usize,
+    clipped_values: usize,
+    dropped_alerts: usize,
+    dropped_console: usize,
+    /// Bytes of text kept in effects, console lines and values written, against [`MAX_PAYLOAD`].
+    kept: usize,
+    dropped_bytes: usize,
+}
+
+impl XHost {
+    /// The host for a script on `root` (the template's root subform), with `this` at the node
+    /// named by `target`. `xfa.form` is a synthetic root whose child is the root subform.
+    pub(crate) fn new(root: XfaNode, target: &str, doc: &XfaDoc) -> XHost {
+        let form = XfaNode { name: "form".into(), kind: Some(XfaKind::Form), children: vec![root], ..Default::default() };
+        let mut nodes = Vec::new();
+        flatten(&form, None, &mut nodes, 0);
+        let current = nodes.iter().position(|n| n.som == target && n.kind != XfaKind::Form).unwrap_or(1.min(nodes.len().saturating_sub(1)));
+        XHost {
+            nodes,
+            effects: Vec::new(),
+            console: Vec::new(),
+            doc: doc.clone(),
+            added: 0,
+            current,
+            set_at: HashMap::new(),
+            barrier: 0,
+            alerts: 0,
+            dropped_effects: 0,
+            clipped_values: 0,
+            dropped_alerts: 0,
+            dropped_console: 0,
+            kept: 0,
+            dropped_bytes: 0,
+        }
+    }
+
+    /// Room for `bytes` more bytes of kept text: charged when there is, a drop counted when not.
+    fn room(&mut self, bytes: usize) -> bool {
+        match self.kept.checked_add(bytes).filter(|k| *k <= MAX_PAYLOAD) {
+            Some(k) => {
+                self.kept = k;
+                true
+            }
+            None => {
+                self.dropped_bytes = self.dropped_bytes.saturating_add(1);
+                false
+            }
+        }
+    }
+
+    /// Record an effect: values, presence and access set again on the same object replace the
+    /// earlier one; past [`MAX_EFFECTS`] (or [`MAX_ALERTS`] message boxes, or [`MAX_PAYLOAD`]
+    /// bytes of text) effects are counted and dropped.
+    pub(crate) fn push(&mut self, e: XfaEffect) {
+        let e = self.clip_effect(e);
+        if self.room(payload(&e)) {
+            self.record(e);
+        }
+    }
+
+    /// Room for `e`, which holds `bytes` of text, charged now: a change to the snapshot is made
+    /// only when the effect that applies it will be kept, so a script never sees a change its
+    /// effects leave out. An effect that replaces an earlier one needs no new slot. A drop is
+    /// counted when there is no room.
+    pub(super) fn reserve(&mut self, e: &XfaEffect, bytes: usize) -> bool {
+        let replaces = effect_key(e).and_then(|k| self.set_at.get(&k)).is_some_and(|&at| at >= self.barrier && at < self.effects.len());
+        if !replaces && self.effects.len() >= MAX_EFFECTS {
+            self.dropped_effects += 1;
+            return false;
+        }
+        self.room(bytes)
+    }
+
+    /// Set the presence or access of node `i` to what `e` (a [`XfaEffect::SetPresence`] or
+    /// [`XfaEffect::SetAccess`]) says, in the snapshot only when the effect is kept.
+    pub(crate) fn set_state(&mut self, i: usize, e: XfaEffect) {
+        if !self.reserve(&e, payload(&e)) {
+            return;
+        }
+        if let Some(n) = self.nodes.get_mut(i) {
+            match &e {
+                XfaEffect::SetPresence { presence, .. } => n.presence = presence.clone(),
+                XfaEffect::SetAccess { access, .. } => n.access = access.clone(),
+                _ => {}
+            }
+        }
+        self.record(e);
+    }
+
+    /// `e` with its text cut to the lengths an effect keeps.
+    fn clip_effect(&mut self, e: XfaEffect) -> XfaEffect {
+        match e {
+            XfaEffect::MessageBox(m) => XfaEffect::MessageBox(clip(m)),
+            XfaEffect::LaunchUrl(u) => XfaEffect::LaunchUrl(clip(u)),
+            XfaEffect::SetFocus(s) => XfaEffect::SetFocus(clip(s)),
+            XfaEffect::ResetData(names) => XfaEffect::ResetData(names.into_iter().map(clip).collect()),
+            XfaEffect::SetValue { som, value } => {
+                let (value, cut) = clip_value(value);
+                if cut {
+                    self.clipped_values += 1;
+                }
+                XfaEffect::SetValue { som, value }
+            }
+            other => other,
+        }
+    }
+
+    /// Keep `e`, whose bytes are already charged, against the count limits.
+    pub(super) fn record(&mut self, e: XfaEffect) {
+        if let Some(key) = effect_key(&e) {
+            if let Some(&at) = self.set_at.get(&key)
+                && at >= self.barrier
+                && let Some(slot) = self.effects.get_mut(at)
+            {
+                *slot = e;
+                return;
+            }
+            if self.effects.len() >= MAX_EFFECTS {
+                self.dropped_effects += 1;
+                return;
+            }
+            self.set_at.insert(key, self.effects.len());
+            self.effects.push(e);
+            return;
+        }
+        if matches!(e, XfaEffect::MessageBox(_)) {
+            if self.alerts >= MAX_ALERTS {
+                self.dropped_alerts += 1;
+                return;
+            }
+            self.alerts += 1;
+        }
+        if self.effects.len() >= MAX_EFFECTS {
+            self.dropped_effects += 1;
+            return;
+        }
+        if matches!(e, XfaEffect::AddInstance { .. } | XfaEffect::RemoveInstance { .. } | XfaEffect::ResetData(_)) {
+            self.barrier = self.effects.len() + 1;
+        }
+        self.effects.push(e);
+    }
+
+    pub(crate) fn print(&mut self, line: String) {
+        if self.console.len() >= MAX_CONSOLE {
+            self.dropped_console += 1;
+        } else if self.room(line.len()) {
+            self.console.push(line);
+        }
+    }
+
+    /// What the limits left out.
+    pub(crate) fn notes(&self) -> Vec<String> {
+        let mut out = Vec::new();
+        if self.dropped_effects > 0 {
+            out.push(format!("the script made more than {MAX_EFFECTS} changes; {} more were left out", self.dropped_effects));
+        }
+        if self.dropped_alerts > 0 {
+            out.push(format!("the script showed more than {MAX_ALERTS} messages; {} more were left out", self.dropped_alerts));
+        }
+        if self.dropped_console > 0 {
+            out.push(format!("the script printed more than {MAX_CONSOLE} console lines; {} more were left out", self.dropped_console));
+        }
+        if self.dropped_bytes > 0 {
+            out.push(format!("the script's changes and output passed {} MiB of text; {} more were left out", MAX_PAYLOAD >> 20, self.dropped_bytes));
+        }
+        if self.clipped_values > 0 {
+            out.push(format!("the script set {} value(s) longer than {MAX_VALUE} characters; they were cut", self.clipped_values));
+        }
+        out
+    }
+
+    /// Give node `i` the value `text` when it is a field or exclusion group (nothing else
+    /// holds a value; writing one into a subform would put text where another viewer expects
+    /// a data group). Returns whether it was.
+    pub(crate) fn set_value(&mut self, i: usize, text: String) -> bool {
+        let Some(n) = self.nodes.get(i) else { return false };
+        if n.gone || !matches!(n.kind, XfaKind::Field | XfaKind::ExclGroup) {
+            return false;
+        }
+        let som = n.som.clone();
+        // Cut here, not only in the effect: later reads in the script see what is saved, and
+        // the snapshot stays bounded however often a long value is written.
+        let (text, cut) = clip_value(text);
+        if cut {
+            self.clipped_values += 1;
+        }
+        // The snapshot's copy and the effect's are charged together, before either is kept:
+        // past the byte budget or the effect cap the write is left out of both.
+        let effect = XfaEffect::SetValue { som, value: text.clone() };
+        if !self.reserve(&effect, text.len().saturating_add(payload(&effect))) {
+            return true;
+        }
+        if let Some(n) = self.nodes.get_mut(i) {
+            n.value = text;
+            n.formatted = None;
+        }
+        self.record(effect);
+        true
+    }
+}
+
+pub(super) type Shared = RefCell<XHost>;
+
+/// The form host of the script running in `ctx`.
+pub(super) fn host(ctx: &Context) -> JsResult<&Shared> {
+    ctx.get_data::<Shared>().ok_or_else(|| error("the XFA script host is not set up"))
+}
+
+/// The snapshot `n` and its descendants flattened into `out` under `parent` (to [`MAX_DEPTH`]
+/// and [`MAX_NODES`]): the index of `n`'s node, `None` past the limits.
+fn flatten(n: &XfaNode, parent: Option<usize>, out: &mut Vec<HNode>, depth: usize) -> Option<usize> {
+    if depth > MAX_DEPTH || out.len() >= MAX_NODES {
+        return None;
+    }
+    let idx = out.len();
+    out.push(HNode {
+        name: n.name.clone(),
+        som: n.som.clone(),
+        kind: n.kind.unwrap_or(XfaKind::Subform),
+        value: n.value.clone(),
+        numeric: n.numeric,
+        presence: if n.presence.is_empty() { "visible".into() } else { n.presence.clone() },
+        access: if n.access.is_empty() { "open".into() } else { n.access.clone() },
+        repeatable: n.repeatable,
+        occur_min: n.occur_min,
+        occur_max: n.occur_max,
+        index: n.index,
+        parent,
+        children: Vec::new(),
+        gone: false,
+        formatted: n.formatted.clone(),
+    });
+    let mut kids = Vec::new();
+    for c in &n.children {
+        if let Some(ci) = flatten(c, Some(idx), out, depth + 1) {
+            kids.push(ci);
+        }
+    }
+    if let Some(h) = out.get_mut(idx) {
+        h.children = kids;
+    }
+    Some(idx)
+}
diff --git a/crates/js/src/xfa/instances.rs b/crates/js/src/xfa/instances.rs
new file mode 100644
index 0000000000..b03e6aef09
--- /dev/null
+++ b/crates/js/src/xfa/instances.rs
@@ -0,0 +1,279 @@
+use super::host::{HNode, XHost, host};
+use super::model::{MAX_ADDED, MAX_DEPTH, MAX_NODES, XfaEffect};
+use super::nodes::{instances, node_object};
+use super::*;
+
+pub(super) fn list_object(ctx: &mut Context, items: &[usize]) -> JsResult<JsValue> {
+    let vals: Vec<JsValue> = items.iter().map(|i| JsValue::from(*i as f64)).collect();
+    let arr = JsArray::from_iter(vals, ctx);
+    let arr_obj: JsObject = arr.into();
+    fn item(_: &JsValue, args: &[JsValue], arr: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
+        let i = arg(args, 0).to_number(ctx)?;
+        if !i.is_finite() || i < 0.0 {
+            return Ok(JsValue::null());
+        }
+        let v = JsArray::from_object(arr.clone())?.get(i as u64, ctx)?;
+        if v.is_undefined() {
+            return Ok(JsValue::null());
+        }
+        let idx = v.to_number(ctx)? as usize;
+        node_object(ctx, idx)
+    }
+    let item_fn = function(ctx, NativeFunction::from_copy_closure_with_captures(item, arr_obj));
+    Ok(ObjectInitializer::new(ctx)
+        .property(js_string!("length"), JsValue::from(items.len() as f64), Attribute::READONLY)
+        .property(js_string!("item"), item_fn, Attribute::all())
+        .build()
+        .into())
+}
+
+/// The instance manager of the subform named `name` under `parent`.
+pub(super) fn instance_manager(ctx: &mut Context, parent: usize, name: &str) -> JsResult<JsValue> {
+    let (count, min, max) = {
+        let h = host(ctx)?.borrow();
+        let live = instances(&h, parent, name);
+        let first = live.first().and_then(|i| h.nodes.get(*i));
+        (live.len(), first.map_or(0, |n| n.occur_min), first.and_then(|n| n.occur_max))
+    };
+    let key = ObjectInitializer::new(ctx)
+        .property(js_string!("parent"), JsValue::from(parent as f64), Attribute::READONLY)
+        .property(js_string!("name"), s(name), Attribute::READONLY)
+        .build();
+    fn target_of(key: &JsObject, ctx: &mut Context) -> JsResult<(usize, String)> {
+        let p = key.get(js_string!("parent"), ctx)?.to_number(ctx)? as usize;
+        let n = text(&key.get(js_string!("name"), ctx)?, ctx)?;
+        Ok((p, n))
+    }
+    fn add_instance(_: &JsValue, _: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
+        let (p, n) = target_of(key, ctx)?;
+        match add_instance_of(ctx, p, &n)? {
+            Some(i) => node_object(ctx, i),
+            None => Ok(JsValue::null()),
+        }
+    }
+    fn insert_instance(this: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
+        add_instance(this, args, key, ctx)
+    }
+    fn remove_instance(_: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
+        let (p, n) = target_of(key, ctx)?;
+        let i = arg(args, 0).to_number(ctx)?;
+        if i.is_finite() && i >= 0.0 {
+            remove_instance_of(ctx, p, &n, i as usize)?;
+        }
+        Ok(JsValue::undefined())
+    }
+    fn set_instances(_: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
+        let (p, n) = target_of(key, ctx)?;
+        let want = arg(args, 0).to_number(ctx)?;
+        if !want.is_finite() || want < 0.0 {
+            return Ok(JsValue::undefined());
+        }
+        host(ctx)?.borrow_mut().set_instances(p, &n, want as usize);
+        Ok(JsValue::undefined())
+    }
+    fn move_instance(_: &JsValue, _: &[JsValue], _: &JsObject, _: &mut Context) -> JsResult<JsValue> {
+        Ok(JsValue::undefined())
+    }
+    fn count_get(_: &JsValue, _: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
+        let (p, n) = target_of(key, ctx)?;
+        let c = instances(&host(ctx)?.borrow(), p, &n).len();
+        Ok(JsValue::from(c as f64))
+    }
+    fn count_set(_: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
+        set_instances(&JsValue::undefined(), args, key, ctx)
+    }
+    let count_g = function(ctx, NativeFunction::from_copy_closure_with_captures(count_get, key.clone()));
+    let count_s = function(ctx, NativeFunction::from_copy_closure_with_captures(count_set, key.clone()));
+    let add = function(ctx, NativeFunction::from_copy_closure_with_captures(add_instance, key.clone()));
+    let insert = function(ctx, NativeFunction::from_copy_closure_with_captures(insert_instance, key.clone()));
+    let remove = function(ctx, NativeFunction::from_copy_closure_with_captures(remove_instance, key.clone()));
+    let set = function(ctx, NativeFunction::from_copy_closure_with_captures(set_instances, key.clone()));
+    let mv = function(ctx, NativeFunction::from_copy_closure_with_captures(move_instance, key));
+    let _ = count;
+    let o = ObjectInitializer::new(ctx)
+        .property(js_string!("min"), JsValue::from(min as f64), Attribute::READONLY)
+        .property(js_string!("max"), max.map_or(JsValue::from(-1.0), |m| JsValue::from(m as f64)), Attribute::READONLY)
+        .property(js_string!("addInstance"), add, Attribute::all())
+        .property(js_string!("insertInstance"), insert, Attribute::all())
+        .property(js_string!("removeInstance"), remove, Attribute::all())
+        .property(js_string!("setInstances"), set, Attribute::all())
+        .property(js_string!("moveInstance"), mv, Attribute::all())
+        .property(js_string!("className"), s("instanceManager"), Attribute::READONLY)
+        .build();
+    use boa_engine::property::PropertyDescriptor;
+    o.define_property_or_throw(js_string!("count"), PropertyDescriptor::builder().get(count_g).set(count_s).configurable(true), ctx)?;
+    Ok(o.into())
+}
+
+/// Re-derive the SOM of `idx` and everything under it from its parent and index.
+fn renumber(h: &mut XHost, idx: usize, depth: usize) {
+    if depth > MAX_DEPTH {
+        return;
+    }
+    let (parent_som, name, index, kids) = {
+        let Some(n) = h.nodes.get(idx) else { return };
+        let parent_som = n.parent.and_then(|p| h.nodes.get(p)).map(|p| p.som.clone()).unwrap_or_default();
+        (parent_som, n.name.clone(), n.index, n.children.clone())
+    };
+    let som = child_som(parent_som, &name, index);
+    if let Some(n) = h.nodes.get_mut(idx) {
+        n.som = som;
+    }
+    for k in kids {
+        renumber(h, k, depth + 1);
+    }
+}
+
+/// The SOM of instance `index` of the node `name` under a parent at `parent_som`.
+fn child_som(parent_som: String, name: &str, index: usize) -> String {
+    if name.starts_with('#') || name.is_empty() {
+        parent_som
+    } else if parent_som.is_empty() {
+        format!("{name}[{index}]")
+    } else {
+        format!("{parent_som}.{name}[{index}]")
+    }
+}
+
+/// A copy of `src`'s subtree (values cleared) under `parent`, returning the copy's index.
+fn clone_subtree(h: &mut XHost, src: usize, parent: Option<usize>, depth: usize) -> Option<usize> {
+    if depth > MAX_DEPTH || h.nodes.len() >= MAX_NODES {
+        return None;
+    }
+    let (template, kids) = {
+        let n = h.nodes.get(src)?;
+        (
+            HNode {
+                name: n.name.clone(),
+                som: String::new(),
+                kind: n.kind,
+                value: String::new(),
+                numeric: n.numeric,
+                presence: n.presence.clone(),
+                access: n.access.clone(),
+                repeatable: n.repeatable,
+                occur_min: n.occur_min,
+                occur_max: n.occur_max,
+                index: n.index,
+                parent,
+                children: Vec::new(),
+                gone: false,
+                // The copy holds no value, so nothing is shown in its picture either.
+                formatted: None,
+            },
+            n.children.clone(),
+        )
+    };
+    let idx = h.nodes.len();
+    h.nodes.push(template);
+    let mut copied = Vec::new();
+    for k in kids {
+        // Nested repeating subforms copy their first instance only.
+        let skip = h.nodes.get(k).is_some_and(|c| c.gone || c.repeatable && c.index > 0);
+        if skip {
+            continue;
+        }
+        if let Some(ci) = clone_subtree(h, k, Some(idx), depth + 1) {
+            copied.push(ci);
+        }
+    }
+    if let Some(n) = h.nodes.get_mut(idx) {
+        n.children = copied;
+    }
+    Some(idx)
+}
+
+fn add_instance_of(ctx: &mut Context, parent: usize, name: &str) -> JsResult<Option<usize>> {
+    let mut h = host(ctx)?.borrow_mut();
+    Ok(h.add_instance(parent, name))
+}
+
+fn remove_instance_of(ctx: &mut Context, parent: usize, name: &str, i: usize) -> JsResult<()> {
+    let mut h = host(ctx)?.borrow_mut();
+    h.remove_instance(parent, name, i);
+    Ok(())
+}
+
+impl XHost {
+    /// A new instance of the subform `name` under `parent`, after the last one; `None` when the
+    /// subform doesn't repeat, is at its maximum, or the run added its limit.
+    pub(crate) fn add_instance(&mut self, parent: usize, name: &str) -> Option<usize> {
+        let h = self;
+        let live = instances(h, parent, name);
+        let &first = live.first()?;
+        let (repeatable, max) = h.nodes.get(first).map(|n| (n.repeatable, n.occur_max)).unwrap_or((false, Some(1)));
+        if !repeatable || max.is_some_and(|m| live.len() >= m) || h.added >= MAX_ADDED || h.nodes.len() >= MAX_NODES {
+            return None;
+        }
+        // The copy's SOM, as `renumber` will give it, so its effect is reserved before the copy.
+        let name = h.nodes.get(first).map(|n| n.name.clone()).unwrap_or_default();
+        let parent_som = h.nodes.get(parent).map(|p| p.som.clone()).unwrap_or_default();
+        let som = child_som(parent_som, &name, live.len());
+        if !h.reserve(&XfaEffect::AddInstance { som: String::new() }, som.len()) {
+            return None;
+        }
+        let new = clone_subtree(h, first, Some(parent), 0)?;
+        let last = live.last().copied().unwrap_or(first);
+        if let Some(n) = h.nodes.get_mut(new) {
+            n.index = live.len();
+        }
+        // Keep instances together: right after the last one.
+        if let Some(p) = h.nodes.get_mut(parent) {
+            let pos = p.children.iter().position(|&c| c == last).map_or(p.children.len(), |i| i + 1);
+            p.children.insert(pos, new);
+        }
+        renumber(h, new, 0);
+        h.added += 1;
+        h.record(XfaEffect::AddInstance { som });
+        Some(new)
+    }
+
+    /// Add or remove instances of the subform `name` under `parent` until there are `want`.
+    /// Bounded: adding stops at the cap or the maximum, removing at the floor, and a step that
+    /// changes nothing ends the loop.
+    pub(crate) fn set_instances(&mut self, parent: usize, name: &str, want: usize) {
+        let want = want.min(MAX_ADDED);
+        for _ in 0..=MAX_ADDED {
+            let have = instances(self, parent, name).len();
+            if have < want {
+                if self.add_instance(parent, name).is_none() {
+                    break;
+                }
+            } else if have > want && have > 0 {
+                self.remove_instance(parent, name, have - 1);
+                if instances(self, parent, name).len() == have {
+                    break;
+                }
+            } else {
+                break;
+            }
+        }
+    }
+
+    /// Remove instance `i` of the subform `name` under `parent` (never below the minimum, or
+    /// below one).
+    pub(crate) fn remove_instance(&mut self, parent: usize, name: &str, i: usize) {
+        let h = self;
+        let live = instances(h, parent, name);
+        let Some(&gone) = live.get(i) else { return };
+        let min = h.nodes.get(gone).map_or(0, |n| n.occur_min).max(1);
+        if live.len() <= min {
+            return;
+        }
+        let som = h.nodes.get(gone).map(|n| n.som.clone()).unwrap_or_default();
+        if !h.reserve(&XfaEffect::RemoveInstance { som: String::new() }, som.len()) {
+            return;
+        }
+        if let Some(n) = h.nodes.get_mut(gone) {
+            n.gone = true;
+        }
+        // Later instances move down one.
+        for (k, &inst) in live.iter().enumerate().skip(i + 1) {
+            if let Some(n) = h.nodes.get_mut(inst) {
+                n.index = k - 1;
+            }
+            renumber(h, inst, 0);
+        }
+        h.record(XfaEffect::RemoveInstance { som });
+    }
+}
diff --git a/crates/js/src/xfa/model.rs b/crates/js/src/xfa/model.rs
new file mode 100644
index 0000000000..b9c6cedaae
--- /dev/null
+++ b/crates/js/src/xfa/model.rs
@@ -0,0 +1,228 @@
+use super::*;
+
+/// What kind of template object a node is.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum XfaKind {
+    /// `xfa.form` itself.
+    Form,
+    Subform,
+    Field,
+    ExclGroup,
+    Draw,
+    Area,
+}
+
+impl XfaKind {
+    pub(crate) fn class_name(self) -> &'static str {
+        match self {
+            XfaKind::Form => "form",
+            XfaKind::Subform => "subform",
+            XfaKind::Field => "field",
+            XfaKind::ExclGroup => "exclGroup",
+            XfaKind::Draw => "draw",
+            XfaKind::Area => "area",
+        }
+    }
+}
+
+/// One object of the form, as the caller snapshots it.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct XfaNode {
+    pub name: String,
+    /// The SOM expression naming this instance (`form[0].head[0].familyName[0]`).
+    pub som: String,
+    pub kind: Option<XfaKind>,
+    /// Fields: the raw value (ISO dates, on values for buttons); empty when null.
+    pub value: String,
+    /// Numeric fields give numbers to scripts.
+    pub numeric: bool,
+    /// `visible`, `invisible`, `hidden` or `inactive`.
+    pub presence: String,
+    /// `open`, `readOnly`, `protected` or `nonInteractive`.
+    pub access: String,
+    /// Subforms: may have several instances (`occur max` other than 1).
+    pub repeatable: bool,
+    pub occur_min: usize,
+    pub occur_max: Option<usize>,
+    /// This instance's index among its same-named siblings.
+    pub index: usize,
+    pub children: Vec<XfaNode>,
+    /// Fields: the value shown in the field's display picture, what `formattedValue` reads;
+    /// `None` when the picture doesn't change it (the raw value is read then).
+    pub formatted: Option<String>,
+}
+
+/// The event a script runs for.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct XfaEvent {
+    /// `click`, `calculate`, `validate`, `initialize`, `change`, `exit`, …
+    pub activity: String,
+    /// The SOM of `this`.
+    pub target: String,
+    pub new_text: String,
+    pub prev_text: String,
+}
+
+/// About the document.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct XfaDoc {
+    pub file_name: String,
+    /// The current page, 0-based.
+    pub page: usize,
+    pub page_count: usize,
+}
+
+/// Something a script changed or asked for.
+#[derive(Clone, Debug, PartialEq)]
+pub enum XfaEffect {
+    SetValue {
+        som: String,
+        value: String,
+    },
+    SetPresence {
+        som: String,
+        presence: String,
+    },
+    SetAccess {
+        som: String,
+        access: String,
+    },
+    /// A new instance of a repeating subform, named by its own SOM (`…row[3]`).
+    AddInstance {
+        som: String,
+    },
+    /// The instance at this SOM is removed.
+    RemoveInstance {
+        som: String,
+    },
+    MessageBox(String),
+    /// `xfa.host.resetData()`: the named fields, or every field when empty.
+    ResetData(Vec<String>),
+    /// `app.execMenuItem("ShowHide…")`: show or hide a side panel.
+    ShowPanel(crate::Panel),
+    Print,
+    SaveAs,
+    LaunchUrl(String),
+    SetFocus(String),
+    Beep,
+    /// `xfa.form.recalculate(true)`.
+    Recalculate,
+    /// `xfa.form.remerge()`, `xfa.layout.relayout()`.
+    Relayout,
+}
+
+/// What running a script did.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct XfaOutcome {
+    pub effects: Vec<XfaEffect>,
+    pub console: Vec<String>,
+    /// The script's error, if it failed.
+    pub error: Option<String>,
+    /// The script's completion value (a calculate script's result; a validate script's verdict).
+    pub result: Option<String>,
+    /// The completion value as a boolean, when it was one.
+    pub result_bool: Option<bool>,
+    /// Limits the script ran into (too many effects, message boxes or console lines): what
+    /// was left out, for the caller to report.
+    pub notes: Vec<String>,
+    /// The script ran past its time limit and was left running on its own thread (the engine
+    /// can't interrupt it): the caller should run no more of this form's scripts.
+    pub abandoned: bool,
+}
+
+/// Most nodes a snapshot may hold.
+pub(super) const MAX_NODES: usize = 200_000;
+
+/// Most instances a script may add in one run.
+pub(crate) const MAX_ADDED: usize = 1_000;
+
+/// Deepest tree followed.
+pub(super) const MAX_DEPTH: usize = 64;
+
+/// Most effects one run may produce (after values set again on the same object are merged).
+pub const MAX_EFFECTS: usize = 10_000;
+
+/// Most message boxes one run may show.
+pub const MAX_ALERTS: usize = 100;
+
+/// Most console lines one run may print.
+pub const MAX_CONSOLE: usize = 1_000;
+
+/// Longest message or console line kept, in characters.
+pub(crate) const MAX_LINE: usize = 4_096;
+
+/// Most bytes of text one run may hand back or write: messages, console lines, URLs, names
+/// and the values it sets. Past it, more are left out and noted.
+pub(crate) const MAX_PAYLOAD: usize = 32 << 20;
+
+/// Longest value a script may put in a field (characters); longer ones are cut and noted.
+pub(super) const MAX_VALUE: usize = 65_536;
+
+/// `m` cut to [`MAX_LINE`] characters.
+pub(crate) fn clip(m: String) -> String {
+    match m.char_indices().nth(MAX_LINE) {
+        Some((at, _)) => format!("{}…", m.get(..at).unwrap_or_default()),
+        None => m,
+    }
+}
+
+/// `v` cut to [`MAX_VALUE`] characters, and whether it was cut.
+pub(crate) fn clip_value(v: String) -> (String, bool) {
+    match v.char_indices().nth(MAX_VALUE) {
+        Some((at, _)) => (v.get(..at).unwrap_or_default().to_string(), true),
+        None => (v, false),
+    }
+}
+
+/// The field names of a `resetData` list (comma-separated), each cut to [`MAX_LINE`] and
+/// named once, at most as many as a snapshot holds nodes.
+pub(crate) fn reset_names(list: &str) -> Vec<String> {
+    let mut seen = HashSet::new();
+    let mut out = Vec::new();
+    for name in list.split(',').map(str::trim).filter(|s| !s.is_empty()) {
+        if out.len() >= MAX_NODES {
+            break;
+        }
+        let name = clip(name.to_string());
+        if seen.insert(name.clone()) {
+            out.push(name);
+        }
+    }
+    out
+}
+
+/// The (property, SOM) an effect setting a property of an object is merged by, see
+/// [`XHost::set_at`].
+pub(super) fn effect_key(e: &XfaEffect) -> Option<(u8, String)> {
+    match e {
+        XfaEffect::SetValue { som, .. } => Some((0, som.clone())),
+        XfaEffect::SetPresence { som, .. } => Some((1, som.clone())),
+        XfaEffect::SetAccess { som, .. } => Some((2, som.clone())),
+        _ => None,
+    }
+}
+
+/// Bytes of text `e` holds.
+pub(super) fn payload(e: &XfaEffect) -> usize {
+    match e {
+        XfaEffect::SetValue { som, value: s } | XfaEffect::SetPresence { som, presence: s } | XfaEffect::SetAccess { som, access: s } => {
+            som.len().saturating_add(s.len())
+        }
+        XfaEffect::AddInstance { som } | XfaEffect::RemoveInstance { som } => som.len(),
+        XfaEffect::MessageBox(s) | XfaEffect::LaunchUrl(s) | XfaEffect::SetFocus(s) => s.len(),
+        XfaEffect::ResetData(names) => names.iter().fold(0usize, |n, s| n.saturating_add(s.len()).saturating_add(std::mem::size_of::<String>())),
+        XfaEffect::Print | XfaEffect::SaveAs | XfaEffect::Beep | XfaEffect::Recalculate | XfaEffect::Relayout | XfaEffect::ShowPanel(_) => 0,
+    }
+}
+
+/// A script's completion value (what a calculate script puts in its field) cut to
+/// [`MAX_VALUE`] characters, as values a script sets are, with a note when it was.
+pub(crate) fn clip_result(out: &mut XfaOutcome) {
+    if let Some(r) = out.result.take() {
+        let (r, cut) = clip_value(r);
+        if cut {
+            out.notes.push(format!("the script's result was longer than {MAX_VALUE} characters; it was cut"));
+        }
+        out.result = Some(r);
+    }
+}
diff --git a/crates/js/src/xfa/nodes.rs b/crates/js/src/xfa/nodes.rs
new file mode 100644
index 0000000000..b9483f25d1
--- /dev/null
+++ b/crates/js/src/xfa/nodes.rs
@@ -0,0 +1,343 @@
+use super::globals::{recalculate, relayout};
+use super::host::{HNode, XHost, host};
+use super::instances::{instance_manager, list_object};
+use super::model::{MAX_DEPTH, XfaEffect};
+use super::*;
+
+// ── node objects ────────────────────────────────────────────────────────────────────────────
+
+const IDX: &str = "__xfaNode";
+
+pub(super) fn node_index(target: &JsValue, ctx: &mut Context) -> JsResult<usize> {
+    let o = target.as_object().ok_or_else(|| error("not an XFA node"))?;
+    let v = o.get(JsString::from(IDX), ctx)?;
+    let n = v.to_number(ctx)?;
+    if !n.is_finite() || n < 0.0 {
+        return Err(error("not an XFA node"));
+    }
+    Ok(n as usize)
+}
+
+/// A Proxy standing for node `idx`.
+pub(super) fn node_object(ctx: &mut Context, idx: usize) -> JsResult<JsValue> {
+    let target = ObjectInitializer::new(ctx).property(JsString::from(IDX), JsValue::from(idx as f64), Attribute::READONLY).build();
+    let proxy = JsProxy::builder(target).get(node_get).set(node_set).has(node_has).build(ctx)?;
+    Ok(proxy.into())
+}
+
+/// An object that takes any property read or write without complaint (`this.border.fill…`,
+/// `this.fillColor = …`): what a script sets there changes nothing here.
+pub(super) fn sink(ctx: &mut Context) -> JsResult<JsValue> {
+    let target = ObjectInitializer::new(ctx).build();
+    let proxy = JsProxy::builder(target).get(sink_get).set(sink_set).build(ctx)?;
+    Ok(proxy.into())
+}
+
+fn sink_get(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let key = arg(args, 1);
+    if key.as_symbol().is_some() {
+        return Ok(JsValue::undefined());
+    }
+    match text(&key, ctx)?.as_str() {
+        "value" | "toString" | "valueOf" => Ok(s("")),
+        _ => sink(ctx),
+    }
+}
+
+fn sink_set(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(true))
+}
+
+fn node_has(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::from(true))
+}
+
+fn value_js(h: &HNode) -> JsValue {
+    if h.value.is_empty() {
+        return JsValue::null();
+    }
+    if h.numeric
+        && let Some(n) = as_number(&h.value)
+    {
+        return JsValue::from(n);
+    }
+    s(&h.value)
+}
+
+/// `(idx, name)` of the child of `parent` named `name`, first instance.
+pub(crate) fn child_named(h: &XHost, parent: usize, name: &str) -> Option<usize> {
+    let p = h.nodes.get(parent)?;
+    p.children.iter().copied().find(|&c| h.nodes.get(c).is_some_and(|n| !n.gone && n.name == name))
+}
+
+/// Every live instance named `name` under `parent`, in order.
+pub(crate) fn instances(h: &XHost, parent: usize, name: &str) -> Vec<usize> {
+    h.nodes
+        .get(parent)
+        .map(|p| p.children.iter().copied().filter(|&c| h.nodes.get(c).is_some_and(|n| !n.gone && n.name == name)).collect())
+        .unwrap_or_default()
+}
+
+/// Resolve a SOM expression from node `from`: `$`, `$form`, `$record`, `$host`, `xfa.form…`,
+/// `parent`, `..name` (descendant search), `name[n]`, `name[*]`, `_name`.
+pub(crate) fn resolve_som(h: &XHost, from: usize, expr: &str) -> Vec<usize> {
+    let expr = expr.trim();
+    if expr.is_empty() {
+        return vec![from];
+    }
+    let root = 0usize;
+    let mut cur: Vec<usize> = vec![from];
+    let mut rest = expr;
+    let starts =
+        [("$form", root), ("xfa.form", root), ("$record", root), ("xfa.datasets.data", root), ("xfa.record", root), ("$", from), ("this", from)];
+    for (prefix, at) in starts {
+        if let Some(r) = rest.strip_prefix(prefix)
+            && (r.is_empty() || r.starts_with('.') || r.starts_with('['))
+        {
+            cur = vec![at];
+            rest = r;
+            break;
+        }
+    }
+    let mut depth = 0;
+    while !rest.is_empty() && depth < MAX_DEPTH {
+        depth += 1;
+        let descend = rest.starts_with("..");
+        rest = rest.trim_start_matches('.');
+        let end = rest.find(['.', '[']).unwrap_or(rest.len());
+        let (name, after) = rest.split_at(end);
+        let name = name.trim();
+        let (index, after) = match after.strip_prefix('[') {
+            Some(a) => {
+                let close = a.find(']').unwrap_or(a.len());
+                let idx = a.get(..close).map(str::trim).unwrap_or("");
+                (Some(idx.to_string()), a.get(close + 1..).unwrap_or(""))
+            }
+            None => (None, after),
+        };
+        rest = after;
+        let mut next = Vec::new();
+        for &c in &cur {
+            match name {
+                "" => {}
+                "parent" => {
+                    if let Some(p) = h.nodes.get(c).and_then(|n| n.parent) {
+                        next.push(p);
+                    }
+                }
+                _ => {
+                    let mut found: Vec<usize> = if descend { descendants_named(h, c, name, 0) } else { instances(h, c, name) };
+                    // A relative name a node has no child for is looked for among its siblings
+                    // and in each enclosing container, nearest first (so a field's script can
+                    // say `resolveNode("otherField")`).
+                    if found.is_empty() && depth == 1 && !descend {
+                        let mut at = h.nodes.get(c).and_then(|n| n.parent);
+                        let mut guard = 0;
+                        while let Some(p) = at
+                            && guard < MAX_DEPTH
+                        {
+                            found = instances(h, p, name);
+                            if !found.is_empty() {
+                                break;
+                            }
+                            at = h.nodes.get(p).and_then(|n| n.parent);
+                            guard += 1;
+                        }
+                    }
+                    match index.as_deref() {
+                        Some("*") => next.extend(found),
+                        Some(i) => {
+                            if let Some(k) = i.parse::<usize>().ok().and_then(|i| found.get(i)) {
+                                next.push(*k);
+                            }
+                        }
+                        None => next.extend(found.first()),
+                    }
+                }
+            }
+        }
+        // Each node once: `row[*].parent.row[*]` would otherwise multiply the list by the
+        // number of rows at every step.
+        let mut seen = std::collections::HashSet::with_capacity(next.len());
+        next.retain(|i| seen.insert(*i));
+        cur = next;
+        if cur.is_empty() {
+            break;
+        }
+    }
+    cur
+}
+
+/// The live descendants of node `from` named `name` (`from..name` in a SOM path), in document
+/// order, to [`MAX_DEPTH`].
+pub(crate) fn descendants_named(h: &XHost, from: usize, name: &str, depth: usize) -> Vec<usize> {
+    let mut out = Vec::new();
+    if depth > MAX_DEPTH {
+        return out;
+    }
+    let Some(n) = h.nodes.get(from) else { return out };
+    for &c in &n.children {
+        if let Some(k) = h.nodes.get(c)
+            && !k.gone
+        {
+            if k.name == name {
+                out.push(c);
+            } else {
+                out.extend(descendants_named(h, c, name, depth + 1));
+            }
+        }
+    }
+    out
+}
+
+/// A property read on a form node's Proxy: its value (and `formattedValue` as its picture shows
+/// it), attributes, relatives, methods, instance managers and children by name.
+fn node_get(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let idx = node_index(&arg(args, 0), ctx)?;
+    let key = arg(args, 1);
+    if key.as_symbol().is_some() {
+        return Ok(JsValue::undefined());
+    }
+    let key = text(&key, ctx)?;
+    let snapshot = {
+        let h = host(ctx)?.borrow();
+        let Some(n) = h.nodes.get(idx) else { return Ok(JsValue::undefined()) };
+        (n.name.clone(), n.som.clone(), n.kind, n.value.clone(), n.presence.clone(), n.access.clone(), n.index, n.parent, n.children.clone())
+    };
+    let (name, som, kind, value, presence, access, index, parent, children) = snapshot;
+    Ok(match key.as_str() {
+        IDX => JsValue::from(idx as f64),
+        "rawValue" | "value" => host(ctx)?.borrow().nodes.get(idx).map_or(JsValue::null(), value_js),
+        "formattedValue" => s(&host(ctx)?.borrow().nodes.get(idx).and_then(|n| n.formatted.clone()).unwrap_or(value)),
+        "name" => s(&name),
+        "somExpression" => s(&som),
+        "className" => s(kind.class_name()),
+        "index" | "instanceIndex" => JsValue::from(index as f64),
+        "presence" => s(&presence),
+        "access" => s(&access),
+        "isNull" => JsValue::from(value.is_empty()),
+        "mandatory" => s("disabled"),
+        "parent" => match parent {
+            Some(p) => node_object(ctx, p)?,
+            None => JsValue::null(),
+        },
+        "nodes" => {
+            let live: Vec<usize> = {
+                let h = host(ctx)?.borrow();
+                children.iter().copied().filter(|&c| h.nodes.get(c).is_some_and(|n| !n.gone)).collect()
+            };
+            list_object(ctx, &live)?
+        }
+        "all" => {
+            let live = match parent {
+                Some(p) => instances(&host(ctx)?.borrow(), p, &name),
+                None => vec![idx],
+            };
+            list_object(ctx, &live)?
+        }
+        "instanceManager" => match parent {
+            Some(p) => instance_manager(ctx, p, &name)?,
+            None => JsValue::undefined(),
+        },
+        "resolveNode" => resolver(ctx, idx, false)?,
+        "resolveNodes" => resolver(ctx, idx, true)?,
+        "recalculate" => function(ctx, NativeFunction::from_fn_ptr(recalculate)).into(),
+        "remerge" => function(ctx, NativeFunction::from_fn_ptr(relayout)).into(),
+        "getAttribute"
+        | "setAttribute"
+        | "execEvent"
+        | "execInitialize"
+        | "execCalculate"
+        | "execValidate"
+        | "getElement"
+        | "setElement"
+        | "isPropertySpecified"
+        | "loadXML"
+        | "saveXML"
+        | "clone" => function(ctx, NativeFunction::from_fn_ptr(noop)).into(),
+        "toString" | "valueOf" | "toJSON" => function(ctx, NativeFunction::from_fn_ptr(node_to_string)).into(),
+        "length" => JsValue::undefined(),
+        "border" | "ui" | "font" | "caption" | "fillColor" | "borderColor" | "fontColor" | "margin" | "para" | "assist" | "validate" | "format"
+        | "items" | "bind" | "keep" | "h" | "w" | "x" | "y" | "minH" | "maxH" | "minW" | "maxW" | "layout" | "model" | "oneOfChild" | "locale"
+        | "relevant" | "colSpan" | "dataNode" | "defaultValue" | "editValue" | "selectedIndex" | "event" | "calculate" | "traversal" | "extras"
+        | "desc" => sink(ctx)?,
+        other => {
+            if let Some(child) = other.strip_prefix('_') {
+                let exists = child_named(&host(ctx)?.borrow(), idx, child).is_some();
+                return if exists { instance_manager(ctx, idx, child) } else { Ok(JsValue::undefined()) };
+            }
+            let found = child_named(&host(ctx)?.borrow(), idx, other);
+            match found {
+                Some(c) => node_object(ctx, c)?,
+                None => JsValue::undefined(),
+            }
+        }
+    })
+}
+
+fn node_set(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let idx = node_index(&arg(args, 0), ctx)?;
+    let key = arg(args, 1);
+    if key.as_symbol().is_some() {
+        return Ok(JsValue::from(true));
+    }
+    let key = text(&key, ctx)?;
+    let value = arg(args, 2);
+    let value = if value.is_null() || value.is_undefined() { String::new() } else { text(&value, ctx)? };
+    let mut h = host(ctx)?.borrow_mut();
+    let Some(n) = h.nodes.get(idx) else { return Ok(JsValue::from(true)) };
+    let som = n.som.clone();
+    match key.as_str() {
+        "rawValue" | "value" | "formattedValue" => {
+            // Not a field: the property doesn't exist, as in Acrobat, and nothing is recorded.
+            h.set_value(idx, value);
+        }
+        "presence" => {
+            let p = match value.as_str() {
+                "hidden" | "invisible" | "inactive" | "visible" => value.clone(),
+                _ => return Ok(JsValue::from(true)),
+            };
+            h.set_state(idx, XfaEffect::SetPresence { som, presence: p });
+        }
+        "access" => {
+            let a = match value.as_str() {
+                "open" | "readOnly" | "protected" | "nonInteractive" => value.clone(),
+                _ => return Ok(JsValue::from(true)),
+            };
+            h.set_state(idx, XfaEffect::SetAccess { som, access: a });
+        }
+        _ => {}
+    }
+    Ok(JsValue::from(true))
+}
+
+fn node_to_string(this: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
+    let idx = node_index(this, ctx)?;
+    Ok(s(&host(ctx)?.borrow().nodes.get(idx).map(|n| n.value.clone()).unwrap_or_default()))
+}
+
+pub(super) fn noop(_: &JsValue, _: &[JsValue], _: &mut Context) -> JsResult<JsValue> {
+    Ok(JsValue::undefined())
+}
+
+/// `resolveNode(som)` / `resolveNodes(som)` bound to node `from`.
+pub(super) fn resolver(ctx: &mut Context, from: usize, many: bool) -> JsResult<JsValue> {
+    let key = ObjectInitializer::new(ctx)
+        .property(js_string!("from"), JsValue::from(from as f64), Attribute::READONLY)
+        .property(js_string!("many"), JsValue::from(many), Attribute::READONLY)
+        .build();
+    fn resolve(_: &JsValue, args: &[JsValue], key: &JsObject, ctx: &mut Context) -> JsResult<JsValue> {
+        let from = key.get(js_string!("from"), ctx)?.to_number(ctx)? as usize;
+        let many = key.get(js_string!("many"), ctx)?.to_boolean();
+        let expr = text(&arg(args, 0), ctx)?;
+        let found = resolve_som(&host(ctx)?.borrow(), from, &expr);
+        if many {
+            return list_object(ctx, &found);
+        }
+        match found.first() {
+            Some(i) => node_object(ctx, *i),
+            None => Ok(JsValue::null()),
+        }
+    }
+    Ok(function(ctx, NativeFunction::from_copy_closure_with_captures(resolve, key)).into())
+}
diff --git a/crates/js/src/xfa/run.rs b/crates/js/src/xfa/run.rs
new file mode 100644
index 0000000000..2db77d7062
--- /dev/null
+++ b/crates/js/src/xfa/run.rs
@@ -0,0 +1,170 @@
+use super::globals::install;
+use super::host::{Shared, XHost};
+use super::model::{XfaDoc, XfaEvent, XfaNode, XfaOutcome, clip_result};
+use super::*;
+
+/// Run `script` for `event` on the form `root` (the root subform), from node `event.target`.
+pub fn run_xfa(script: &str, event: &XfaEvent, doc: &XfaDoc, root: &XfaNode, limits: Limits) -> XfaOutcome {
+    let failed = |why: String| XfaOutcome { error: Some(why), ..Default::default() };
+    if let Some(why) = refuse(script) {
+        return failed(why);
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        std::thread::scope(|scope| {
+            let spawned = std::thread::Builder::new()
+                .name("pdfcraft-xfa-js".into())
+                .stack_size(crate::SCRIPT_STACK)
+                .spawn_scoped(scope, || run_here(script, event, doc, root.clone(), limits, &|| {}));
+            match spawned {
+                Ok(thread) => thread.join().unwrap_or_else(|_| failed("the script stopped with an internal error".into())),
+                Err(e) => failed(format!("the script engine could not start: {e}")),
+            }
+        })
+    }
+    #[cfg(target_arch = "wasm32")]
+    run_here(script, event, doc, root.clone(), limits, &|| {})
+}
+
+/// [`run_xfa`] with a time limit: a script still running `timeout` after the engine is ready
+/// (loops inside nested function calls can run for hours within the engine's per-frame loop
+/// limit) is left on its thread, which ends when the engine's own limits stop it, and an
+/// outcome with `abandoned` set comes back at once. In the browser build there are no
+/// threads: the script runs to its limits.
+pub fn run_xfa_within(script: &str, event: &XfaEvent, doc: &XfaDoc, root: XfaNode, limits: Limits, timeout: std::time::Duration) -> XfaOutcome {
+    if let Some(why) = refuse(script) {
+        return XfaOutcome { error: Some(why), ..Default::default() };
+    }
+    let (script, event, doc) = (script.to_string(), event.clone(), doc.clone());
+    run_within("pdfcraft-xfa-js", timeout, move |started| run_here(&script, &event, &doc, root, limits, started))
+}
+
+/// Longest the script engine may take to be ready for a script (its thread and context, and
+/// for the first script in a process the engine's own set-up) before the script is abandoned.
+/// It doesn't count against the script's time: on a busy machine the start alone can take
+/// longer than the tightest limit, and abandoning a script turns the form's scripts off.
+pub(crate) const ENGINE_START_LIMIT: std::time::Duration = std::time::Duration::from_secs(10);
+
+/// Run `script` on its own thread (with the script stack) and wait at most `timeout` for its
+/// outcome, counted from when it calls `started` (once the engine is ready); past that the
+/// thread is abandoned and the outcome says so. On wasm there are no threads: the script runs
+/// here.
+pub(crate) fn run_within(name: &str, timeout: std::time::Duration, script: impl FnOnce(&dyn Fn()) -> XfaOutcome + Send + 'static) -> XfaOutcome {
+    run_within_limits(name, ENGINE_START_LIMIT, timeout, script)
+}
+
+/// [`run_within`] with the engine's start-up limit given.
+pub(crate) fn run_within_limits(
+    name: &str,
+    start_limit: std::time::Duration,
+    timeout: std::time::Duration,
+    script: impl FnOnce(&dyn Fn()) -> XfaOutcome + Send + 'static,
+) -> XfaOutcome {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        use std::sync::mpsc::RecvTimeoutError;
+        use std::time::Instant;
+        enum Step {
+            Started,
+            Done(XfaOutcome),
+        }
+        let failed = |why: String| XfaOutcome { error: Some(why), ..Default::default() };
+        let abandoned = |why: String| XfaOutcome { error: Some(why), abandoned: true, ..Default::default() };
+        let (tx, rx) = std::sync::mpsc::channel();
+        let spawned = std::thread::Builder::new().name(name.into()).stack_size(crate::SCRIPT_STACK).spawn(move || {
+            // The receiver is gone when the caller stopped waiting: nothing to report then.
+            let started = tx.clone();
+            let outcome = script(&move || {
+                let _ = started.send(Step::Started);
+            });
+            let _ = tx.send(Step::Done(outcome));
+        });
+        if let Err(e) = spawned {
+            return failed(format!("the script engine could not start: {e}"));
+        }
+        // Wait for the engine within its start-up limit, then for the script within its own.
+        let (mut running, mut limit) = (false, start_limit);
+        let mut deadline = Instant::now().checked_add(limit);
+        loop {
+            let left = deadline.map_or(limit, |d| d.saturating_duration_since(Instant::now()));
+            match rx.recv_timeout(left) {
+                Ok(Step::Done(o)) => return o,
+                Ok(Step::Started) => {
+                    // A second call changes nothing: the script's time has already begun.
+                    if !running {
+                        (running, limit) = (true, timeout);
+                        deadline = Instant::now().checked_add(limit);
+                    }
+                }
+                Err(RecvTimeoutError::Timeout) if running => {
+                    return abandoned(format!("the script ran longer than {:.1} s and was abandoned", timeout.as_secs_f64()));
+                }
+                Err(RecvTimeoutError::Timeout) => {
+                    return abandoned(format!("the script engine took longer than {:.0} s to start", start_limit.as_secs_f64()));
+                }
+                Err(RecvTimeoutError::Disconnected) => return failed("the script stopped with an internal error".into()),
+            }
+        }
+    }
+    #[cfg(target_arch = "wasm32")]
+    {
+        let _ = (name, start_limit, timeout);
+        script(&|| {})
+    }
+}
+
+/// The first script in a process sets the engine up (its built-ins, parser and compiler come
+/// into use): a trivial script takes that on, so a form's script is never timed with it.
+pub(crate) fn warm_up() {
+    static WARM: std::sync::Once = std::sync::Once::new();
+    // `call_once_force`: a poisoned `Once` (a panic while warming up) only means warming up again.
+    WARM.call_once_force(|_| {
+        let mut ctx = Context::default();
+        let _ = ctx.eval(Source::from_bytes(b"(function () { return eval('0'); }).call({})"));
+    });
+}
+
+/// `started` is called once the engine is ready: a time limit on the script runs from then.
+pub(crate) fn run_here(script: &str, event: &XfaEvent, doc: &XfaDoc, root: XfaNode, limits: Limits, started: &dyn Fn()) -> XfaOutcome {
+    warm_up();
+    let mut ctx = match Context::builder().host_hooks(std::rc::Rc::new(crate::CheckedCodeFromStrings)).build() {
+        Ok(ctx) => ctx,
+        Err(e) => return XfaOutcome { error: Some(format!("the script engine could not start: {e}")), ..Default::default() },
+    };
+    ctx.runtime_limits_mut().set_loop_iteration_limit(limits.loop_iterations);
+    ctx.runtime_limits_mut().set_recursion_limit(limits.recursion);
+    let host_state = XHost::new(root, &event.target, doc);
+    let current = host_state.current;
+    ctx.insert_data(RefCell::new(host_state));
+    let mut out = XfaOutcome::default();
+    let result = (|| -> JsResult<()> {
+        install(&mut ctx, event, doc, current)?;
+        // Ready for the script: its time starts now, the set-up above not charged to it.
+        started();
+        ctx.register_global_property(js_string!("__xfa_src"), s(script), Attribute::CONFIGURABLE)?;
+        // Direct eval inside a function called on the node: `this` is the node and the
+        // completion value is the script's last expression (what a calculate script yields).
+        let r = ctx.eval(Source::from_bytes(b"(function () { return eval(__xfa_src); }).call(__xfa_this)"))?;
+        if !r.is_undefined() {
+            // Best effort: a value that can't be made text (a symbol, say) is no failure.
+            out.result = Some(text(&r, &mut ctx).unwrap_or_default());
+            if r.is_boolean() {
+                out.result_bool = Some(r.to_boolean());
+            } else if r.is_null() {
+                out.result = Some(String::new());
+            }
+        }
+        Ok(())
+    })();
+    if let Err(e) = result {
+        out.error = Some(e.to_string());
+    }
+    if let Some(h) = ctx.remove_data::<Shared>() {
+        let h = h.into_inner();
+        out.notes = h.notes();
+        out.effects = h.effects;
+        out.console = h.console;
+    }
+    clip_result(&mut out);
+    out
+}
diff --git a/crates/js/src/xfa_session.rs b/crates/js/src/xfa_session.rs
index 91447454dd..28ce53994d 100644
--- a/crates/js/src/xfa_session.rs
+++ b/crates/js/src/xfa_session.rs
@@ -18,6 +18,18 @@ use crate::xfa::{XfaDoc, XfaEvent, XfaNode, XfaOutcome};
 #[cfg(test)]
 pub(crate) static START_DELAY_MS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
 
+std::thread_local! {
+    static ENGINES_STARTED: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
+
+/// How many script engine threads the sessions made on this thread have started, for
+/// diagnostics and tests: an event's scripts share one, so opening a form with hundreds of
+/// calculations starts one. Per thread, so a caller counting its own events is not disturbed
+/// by forms on other threads. Always 0 on wasm, where the scripts run on the caller's thread.
+pub fn engines_started() -> u64 {
+    ENGINES_STARTED.with(std::cell::Cell::get)
+}
+
 /// What one script run needs.
 #[derive(Clone, Debug)]
 pub struct Script {
@@ -58,7 +70,7 @@ fn run_script(s: Script, doc: &XfaDoc, started: &dyn Fn()) -> XfaOutcome {
 #[cfg(not(target_arch = "wasm32"))]
 mod native {
     use std::sync::mpsc::{Receiver, RecvTimeoutError, Sender, channel};
-    use std::time::Instant;
+    use std::time::{Duration, Instant};
 
     use super::{Script, run_script};
     use crate::xfa::{ENGINE_START_LIMIT, XfaDoc, XfaOutcome};
@@ -83,11 +95,20 @@ mod native {
         worker: Option<Worker>,
         /// A script ran past its limit: its thread is left to it and nothing more runs.
         dead: Option<String>,
+        /// How long the engine has to be ready for a script ([`ENGINE_START_LIMIT`] by default).
+        start_limit: Duration,
     }
 
     impl XfaSession {
         pub fn new(doc: XfaDoc) -> XfaSession {
-            XfaSession { doc, worker: None, dead: None }
+            XfaSession { doc, worker: None, dead: None, start_limit: ENGINE_START_LIMIT }
+        }
+
+        /// Multiply the time the engine has to be ready for a script by `factor` (a script's
+        /// own time is [`Script::timeout`]).
+        pub fn with_time_scale(mut self, factor: u32) -> XfaSession {
+            self.start_limit = ENGINE_START_LIMIT.saturating_mul(factor);
+            self
         }
 
         /// Why nothing more runs, once a script was abandoned.
@@ -115,11 +136,12 @@ mod native {
                     }
                 });
                 spawned.map_err(|e| format!("the script engine could not start: {e}"))?;
-                match from.recv_timeout(ENGINE_START_LIMIT) {
+                super::ENGINES_STARTED.with(|n| n.set(n.get().saturating_add(1)));
+                match from.recv_timeout(self.start_limit) {
                     Ok(Reply::Ready) => {}
                     Ok(_) => return Err("the script engine answered out of turn".into()),
                     Err(RecvTimeoutError::Timeout) => {
-                        return Err(format!("the script engine took longer than {:.0} s to start", ENGINE_START_LIMIT.as_secs_f64()));
+                        return Err(format!("the script engine took longer than {:.0} s to start", self.start_limit.as_secs_f64()));
                     }
                     Err(RecvTimeoutError::Disconnected) => return Err("the script engine stopped with an internal error".into()),
                 }
@@ -129,8 +151,9 @@ mod native {
         }
 
         /// Run one script, waiting at most its `timeout` from when the engine is ready for it
-        /// (the engine itself gets [`ENGINE_START_LIMIT`] to be ready); past that it is
-        /// abandoned on its thread and the session is dead.
+        /// (the engine itself gets [`ENGINE_START_LIMIT`] to be ready, unless
+        /// [`XfaSession::with_time_scale`] changed it); past that it is abandoned on its thread
+        /// and the session is dead.
         pub fn run(&mut self, script: Script) -> XfaOutcome {
             let abandoned = |why: String| XfaOutcome { error: Some(why), abandoned: true, ..Default::default() };
             let failed = |why: String| XfaOutcome { error: Some(why), ..Default::default() };
@@ -138,6 +161,7 @@ mod native {
                 return abandoned(why.clone());
             }
             let timeout = script.timeout;
+            let start_limit = self.start_limit;
             let worker = match self.worker() {
                 Ok(w) => w,
                 Err(why) => return failed(why),
@@ -148,7 +172,7 @@ mod native {
                 return failed("the script engine stopped with an internal error".into());
             }
             // The engine's start, then the script's own time.
-            let (mut running, mut limit) = (false, ENGINE_START_LIMIT);
+            let (mut running, mut limit) = (false, start_limit);
             let mut deadline = Instant::now().checked_add(limit);
             loop {
                 let left = deadline.map_or(limit, |d| d.saturating_duration_since(Instant::now()));
@@ -167,7 +191,7 @@ mod native {
                         let why = if running {
                             format!("the script ran longer than {:.1} s and was abandoned", timeout.as_secs_f64())
                         } else {
-                            format!("the script engine took longer than {:.0} s to start", ENGINE_START_LIMIT.as_secs_f64())
+                            format!("the script engine took longer than {:.0} s to start", start_limit.as_secs_f64())
                         };
                         self.dead = Some(why.clone());
                         // Dropping the sender ends the thread's loop once the script is done.
@@ -199,6 +223,11 @@ mod native {
             XfaSession { doc }
         }
 
+        /// No engine to start on wasm: nothing to scale.
+        pub fn with_time_scale(self, _factor: u32) -> XfaSession {
+            self
+        }
+
         pub fn dead(&self) -> Option<&str> {
             None
         }
diff --git a/crates/ocr/Cargo.toml b/crates/ocr/Cargo.toml
index 46bb3a1e0e..750e78b96d 100644
--- a/crates/ocr/Cargo.toml
+++ b/crates/ocr/Cargo.toml
@@ -13,5 +13,8 @@ workspace = true
 [dependencies]
 pdfcraft-fonts = { workspace = true }
 ocrs = { version = "0.13.1", default-features = false, features = ["rten"] }
-rten = { version = "0.26.0", default-features = false, features = ["rten_format"] }
+rten = { version = "0.26.0", default-features = false, features = ["onnx_format", "rten_format"] }
 thiserror.workspace = true
+
+[dev-dependencies]
+tempfile = "3.27"
diff --git a/crates/ocr/src/lib.rs b/crates/ocr/src/lib.rs
index affa4ab163..7f58270e1a 100644
--- a/crates/ocr/src/lib.rs
+++ b/crates/ocr/src/lib.rs
@@ -15,8 +15,8 @@ use std::path::{Path, PathBuf};
 pub use pdfcraft_fonts::helvetica_width;
 
 /// The model files, as named in ATTRIBUTION.toml.
-pub const DETECTION_MODEL: &str = "text-detection.rten";
-pub const RECOGNITION_MODEL: &str = "text-recognition.rten";
+pub const DETECTION_MODEL: &str = "text-detection.onnx";
+pub const RECOGNITION_MODEL: &str = "text-recognition.onnx";
 
 /// The recognition model's alphabet, as it was trained (ocrs-models' `DEFAULT_ALPHABET`): its
 /// output classes follow this order. The ocrs crate's own copy has an `E` where the training had
@@ -48,10 +48,13 @@ pub struct Models {
 }
 
 impl Models {
-    /// The models in `dir`, if both files are there.
+    /// A complete model pair in `dir`, preferring current ONNX files over legacy RTEN files.
+    /// An incomplete update never mixes formats or hides an intact legacy pair.
     pub fn in_dir(dir: &Path) -> Option<Models> {
-        let m = Models { detection: dir.join(DETECTION_MODEL), recognition: dir.join(RECOGNITION_MODEL) };
-        (m.detection.is_file() && m.recognition.is_file()).then_some(m)
+        [(DETECTION_MODEL, RECOGNITION_MODEL), ("text-detection.rten", "text-recognition.rten")].into_iter().find_map(|(detection, recognition)| {
+            let m = Models { detection: dir.join(detection), recognition: dir.join(recognition) };
+            (m.detection.is_file() && m.recognition.is_file()).then_some(m)
+        })
     }
 
     /// Look for the models: `$PDFCRAFT_MODELS`, then where the release packages install them
@@ -321,6 +324,63 @@ mod tests {
         assert_eq!(w.up, [-10.0, 0.0]);
     }
 
+    /// The current ONNX pair wins when an installation also retains both legacy models.
+    #[test]
+    fn model_discovery_prefers_the_complete_onnx_pair() {
+        let dir = tempfile::tempdir().unwrap();
+        for file in ["text-detection.onnx", "text-recognition.onnx"] {
+            std::fs::write(dir.path().join(file), b"model").unwrap();
+        }
+        let expected = Some(Models { detection: dir.path().join("text-detection.onnx"), recognition: dir.path().join("text-recognition.onnx") });
+        assert_eq!(Models::in_dir(dir.path()), expected, "a complete ONNX pair is sufficient");
+        for file in ["text-detection.rten", "text-recognition.rten"] {
+            std::fs::write(dir.path().join(file), b"model").unwrap();
+        }
+        assert_eq!(Models::in_dir(dir.path()), expected, "the complete ONNX pair takes precedence over legacy models");
+    }
+
+    /// An interrupted ONNX update still permits an intact legacy pair in the same directory.
+    #[test]
+    fn model_discovery_falls_back_to_legacy_when_the_onnx_pair_is_incomplete() {
+        for current in ["text-detection.onnx", "text-recognition.onnx"] {
+            let dir = tempfile::tempdir().unwrap();
+            for file in [current, "text-detection.rten", "text-recognition.rten"] {
+                std::fs::write(dir.path().join(file), b"model").unwrap();
+            }
+            assert_eq!(
+                Models::in_dir(dir.path()),
+                Some(Models { detection: dir.path().join("text-detection.rten"), recognition: dir.path().join("text-recognition.rten") }),
+                "{current} alone must not hide a complete legacy pair"
+            );
+        }
+    }
+
+    /// Detection and recognition must come from one complete format pair, never a mixed update.
+    #[test]
+    fn model_discovery_refuses_mixed_format_pairs() {
+        for pair in [["text-detection.onnx", "text-recognition.rten"], ["text-detection.rten", "text-recognition.onnx"]] {
+            let dir = tempfile::tempdir().unwrap();
+            for file in pair {
+                std::fs::write(dir.path().join(file), b"model").unwrap();
+            }
+            assert_eq!(Models::in_dir(dir.path()), None, "{pair:?} is not a complete model pair");
+        }
+    }
+
+    /// Existing source builds and PDFCRAFT_MODELS overrides retain their complete RTEN pair.
+    #[test]
+    fn model_discovery_keeps_legacy_only_installations() {
+        let dir = tempfile::tempdir().unwrap();
+        assert_eq!(Models::in_dir(dir.path()), None);
+        std::fs::write(dir.path().join("text-detection.rten"), b"model").unwrap();
+        assert_eq!(Models::in_dir(dir.path()), None, "one legacy model is incomplete");
+        std::fs::write(dir.path().join("text-recognition.rten"), b"model").unwrap();
+        assert_eq!(
+            Models::in_dir(dir.path()),
+            Some(Models { detection: dir.path().join("text-detection.rten"), recognition: dir.path().join("text-recognition.rten") })
+        );
+    }
+
     /// #103: every release package's layout puts the models where the installed app looks.
     /// Mirrors packaging/{windows/package.ps1,macos/package.sh,linux/package.sh,freebsd/package.sh}.
     #[test]
diff --git a/crates/optimize/src/links.rs b/crates/optimize/src/links.rs
index 082d56e7df..cbd64eb928 100644
--- a/crates/optimize/src/links.rs
+++ b/crates/optimize/src/links.rs
@@ -152,11 +152,12 @@ fn referenced_names(doc: &Document) -> HashSet<Vec<u8>> {
                 Object::Dict(d) => {
                     // Resolve first: /Dest and a GoTo's /D may be an indirect reference to the name
                     // string, and an unresolved ref has no name, so the destination it uses would
-                    // look unreferenced and be removed.
+                    // look unreferenced and be removed. A GoToR or GoToE /D names a destination in
+                    // another document, so it does not count as a use of this one's.
                     if let Some(n) = d.get(b"Dest").and_then(|x| dest_name(doc.resolve(x).as_ref())) {
                         out.insert(n);
                     }
-                    if matches!(d.name(b"S"), Some(b"GoTo" | b"GoToR" | b"GoToE"))
+                    if d.name(b"S") == Some(b"GoTo")
                         && let Some(n) = d.get(b"D").and_then(|x| dest_name(doc.resolve(x).as_ref()))
                     {
                         out.insert(n);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index d00773f088..f16b9bc3fe 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1700,6 +1700,50 @@ fn indirectly_referenced_destination_is_kept() {
     assert!(!left.contains(&b"unused".to_vec()));
 }
 
+#[test]
+fn a_destination_named_only_by_a_remote_or_embedded_go_to_is_removed() {
+    // The /D of a GoToR or GoToE action names a destination in another document. A local
+    // destination of the same name that nothing else uses is unreferenced.
+    let mut doc = Document::new_empty();
+    let p = page(&mut doc, &[], "BT ET");
+    let s = |t: &str| Object::String(pdfcraft_cos::PdfString::literal(t.as_bytes().to_vec()));
+    let link = |doc: &mut Document, action: Dict| {
+        let mut link = Dict::new();
+        link.set(b"Type".to_vec(), Object::name("Annot"));
+        link.set(b"Subtype".to_vec(), Object::name("Link"));
+        link.set(b"Rect".to_vec(), Object::Array(vec![0.into(), 0.into(), 10.into(), 10.into()]));
+        link.set(b"A".to_vec(), Object::Dict(action));
+        Object::Ref(doc.add(Object::Dict(link)))
+    };
+    let mut go_to = Dict::new();
+    go_to.set(b"S".to_vec(), Object::name("GoTo"));
+    go_to.set(b"D".to_vec(), s("local"));
+    let mut remote = Dict::new();
+    remote.set(b"S".to_vec(), Object::name("GoToR"));
+    remote.set(b"F".to_vec(), s("other.pdf"));
+    remote.set(b"D".to_vec(), s("remote"));
+    let mut target = Dict::new();
+    target.set(b"R".to_vec(), Object::name("C"));
+    target.set(b"N".to_vec(), s("attached.pdf"));
+    let mut embedded = Dict::new();
+    embedded.set(b"S".to_vec(), Object::name("GoToE"));
+    embedded.set(b"T".to_vec(), Object::Dict(target));
+    embedded.set(b"D".to_vec(), s("embedded"));
+    let links = vec![link(&mut doc, go_to), link(&mut doc, remote), link(&mut doc, embedded)];
+    doc.update_dict(p, |d| d.set(b"Annots".to_vec(), Object::Array(links))).unwrap();
+    let fit = Object::Array(vec![Object::Ref(p), Object::name("Fit")]);
+    let mut tree = Dict::new();
+    tree.set(b"Names".to_vec(), Object::Array(vec![s("embedded"), fit.clone(), s("local"), fit.clone(), s("remote"), fit]));
+    let tree = doc.add(Object::Dict(tree));
+    let mut names = Dict::new();
+    names.set(b"Dests".to_vec(), Object::Ref(tree));
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| c.set(b"Names".to_vec(), Object::Dict(names))).unwrap();
+    let report = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(report.unreferenced_dests, 2);
+    assert_eq!(named_dest_keys(&doc), vec![b"local".to_vec()]);
+}
+
 /// The keys in the catalog's /Names /Dests name tree (one level, as the optimizer writes it).
 fn named_dest_keys(doc: &Document) -> Vec<Vec<u8>> {
     let cat = doc.get(doc.root().unwrap()).as_dict().cloned().unwrap();
diff --git a/crates/organize/src/import.rs b/crates/organize/src/import.rs
index ef11f10007..bd1878c3bc 100644
--- a/crates/organize/src/import.rs
+++ b/crates/organize/src/import.rs
@@ -23,223 +23,21 @@ use pdfcraft_cos::{Dict, Document, ObjRef, Object};
 
 use crate::{INHERITABLE, OrganizeError, pages_root, rebuild, walk};
 
-/// Keys that must not be followed when copying: they point back up or across the source
-/// document, and following them would drag in unrelated objects.
-const SKIP_ON_PAGE: &[&[u8]] = &[b"Parent", b"B", b"StructParents", b"Thumb", b"PieceInfo"];
-const SKIP_ON_ANNOT: &[&[u8]] = &[b"StructParent", b"P"];
+mod carry;
+mod combine;
+mod copy;
+mod fields;
 
-/// How deep a copy follows references and nested arrays and dictionaries, counted together.
-/// Real documents stay well under this (a page's resources, fonts and descriptors, nested
-/// form XObjects and field trees are a few levels each); a chain of thousands of indirect
-/// objects, each shallow enough for the parser, would otherwise exhaust the stack (#1800).
-const MAX_COPY_DEPTH: usize = 256;
-
-/// Keys that stay on the widget when a combined field/widget is split (#1810): the annotation's
-/// appearance, placement and page. Field state (name, value, flags, default appearance) moves to
-/// the new parent field, where the widgets inherit it.
-const WIDGET_KEYS: &[&[u8]] = &[
-    b"Type",
-    b"Subtype",
-    b"Rect",
-    b"P",
-    b"AP",
-    b"AS",
-    b"MK",
-    b"BS",
-    b"Border",
-    b"C",
-    b"CA",
-    b"F",
-    b"H",
-    b"R",
-    b"NM",
-    b"M",
-    b"StructParent",
-    b"StructParents",
-    b"OC",
-    b"Tabs",
-    b"A",
-    b"Contents",
-    b"BM",
-    b"Lang",
-    b"AF",
-];
-
-struct Copier<'a> {
-    src: &'a Document,
-    /// Current recursion depth, bounded by [`MAX_COPY_DEPTH`].
-    depth: usize,
-    map: HashMap<ObjRef, ObjRef>,
-    /// Source page → destination page, for rewriting `/P` and destinations.
-    pages: HashMap<ObjRef, ObjRef>,
-    /// Destination objects that are annotation dictionaries (fixed up after copying).
-    annots: Vec<ObjRef>,
-    /// Top-level form fields reached through widgets.
-    fields: Vec<ObjRef>,
-    /// Optional content groups copied: (source, destination).
-    ocgs: Vec<(ObjRef, ObjRef)>,
-}
-
-impl<'a> Copier<'a> {
-    fn new(src: &'a Document, map: HashMap<ObjRef, ObjRef>, pages: HashMap<ObjRef, ObjRef>) -> Self {
-        Copier { src, depth: 0, map, pages, annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() }
-    }
-
-    /// Copy an indirect object (once), returning its destination reference.
-    fn copy_ref(&mut self, dst: &mut Document, r: ObjRef) -> Result<ObjRef, OrganizeError> {
-        if let Some(d) = self.map.get(&r) {
-            return Ok(*d);
-        }
-        // Reserve the number first so cycles (field ↔ widget) terminate.
-        let new = dst.add(Object::Null);
-        self.map.insert(r, new);
-        let obj = self.src.get(r);
-        if obj.as_dict().is_some_and(|d| d.name(b"Type") == Some(b"OCG")) {
-            self.ocgs.push((r, new));
-        }
-        let copied = self.copy_value(dst, &obj, Some(new))?;
-        dst.set(new, copied);
-        Ok(new)
-    }
-
-    /// One level deeper into the object graph, or the refusal when there are too many.
-    fn descend(&mut self) -> Result<(), OrganizeError> {
-        if self.depth >= MAX_COPY_DEPTH {
-            return Err(OrganizeError::Invalid(format!("the pages refer to objects nested more than {MAX_COPY_DEPTH} levels deep")));
-        }
-        self.depth += 1;
-        Ok(())
-    }
-
-    fn copy_value(&mut self, dst: &mut Document, o: &Object, this: Option<ObjRef>) -> Result<Object, OrganizeError> {
-        if !matches!(o, Object::Ref(_) | Object::Array(_) | Object::Dict(_) | Object::Stream(_)) {
-            return Ok(o.clone());
-        }
-        self.descend()?;
-        let copied = match o {
-            Object::Ref(r) => self.copy_ref(dst, *r).map(Object::Ref),
-            Object::Array(a) => a.iter().map(|x| self.copy_value(dst, x, None)).collect::<Result<Vec<_>, _>>().map(Object::Array),
-            Object::Dict(d) => self.copy_dict(dst, d, this).map(Object::Dict),
-            Object::Stream(s) => self.copy_dict(dst, &s.dict, None).map(|dict| {
-                let mut s = s.clone();
-                s.dict = dict;
-                Object::Stream(s)
-            }),
-            other => Ok(other.clone()),
-        };
-        self.depth = self.depth.saturating_sub(1);
-        copied
-    }
-
-    fn copy_dict(&mut self, dst: &mut Document, d: &Dict, this: Option<ObjRef>) -> Result<Dict, OrganizeError> {
-        let is_annot = d.name(b"Type") == Some(b"Annot") || (d.contains(b"Subtype") && d.contains(b"Rect") && !d.contains(b"Type"));
-        let is_field = d.contains(b"FT") || (d.contains(b"T") && d.contains(b"Kids"));
-        let mut out = Dict::new();
-        for (k, v) in d.iter() {
-            if is_annot && SKIP_ON_ANNOT.contains(&k.as_slice()) {
-                continue;
-            }
-            // Destinations are rewritten afterwards (they may target pages copied later).
-            if is_annot && (k.as_slice() == b"Dest" || k.as_slice() == b"A") {
-                out.set(k.clone(), v.clone());
-                continue;
-            }
-            out.set(k.clone(), self.copy_value(dst, v, None)?);
-        }
-        if let Some(this) = this {
-            if is_annot {
-                self.annots.push(this);
-            }
-            // A field (or widget) without a parent is a top-level field.
-            if is_field && !d.contains(b"Parent") {
-                self.fields.push(this);
-            }
-        }
-        Ok(out)
-    }
-
-    /// Map a source destination (explicit array or reference to one) to the destination
-    /// document; `None` if it targets a page that was not copied.
-    fn map_dest(&self, dest: &Object) -> Option<Object> {
-        self.map_dest_depth(dest, 0)
-    }
-
-    fn map_dest_depth(&self, dest: &Object, depth: u8) -> Option<Object> {
-        if depth > 4 {
-            return None;
-        }
-        match dest {
-            Object::Name(n) => self.map_dest_depth(&named_dest(self.src, n)?, depth + 1),
-            Object::String(s) => self.map_dest_depth(&named_dest(self.src, &s.bytes)?, depth + 1),
-            Object::Ref(_) => self.map_dest_depth(&self.src.resolve(dest), depth + 1),
-            Object::Dict(d) => self.map_dest_depth(d.get(b"D")?, depth + 1),
-            Object::Array(a) => {
-                let page = a.first()?.as_ref()?;
-                let new_page = *self.pages.get(&page)?;
-                let mut a = a.clone();
-                a[0] = Object::Ref(new_page);
-                Some(Object::Array(a))
-            }
-            _ => None,
-        }
-    }
-
-    /// Rewrite `/P`, `/Dest` and GoTo actions on copied annotations.
-    fn fix_annotations(&mut self, dst: &mut Document, annot_pages: &HashMap<ObjRef, ObjRef>) -> Result<(), OrganizeError> {
-        for &a in &std::mem::take(&mut self.annots) {
-            let src_dict = dst.get(a).as_dict().cloned();
-            let Some(d) = src_dict else { continue };
-            let mut d = d;
-            if let Some(p) = annot_pages.get(&a) {
-                d.set(b"P".to_vec(), Object::Ref(*p));
-            }
-            if let Some(dest) = d.get(b"Dest").cloned() {
-                let resolved = self.src.resolve(&dest);
-                match self.map_dest(&resolved) {
-                    Some(nd) => d.set(b"Dest".to_vec(), nd),
-                    None => {
-                        d.remove(b"Dest");
-                    }
-                }
-            }
-            if let Some(action) = d.get(b"A").cloned() {
-                let action = self.src.resolve(&action);
-                if let Some(ad) = action.as_dict() {
-                    if ad.name(b"S") == Some(b"GoTo") {
-                        let target = ad.get(b"D").map(|x| self.src.resolve(x));
-                        match target.and_then(|t| self.map_dest(&t)) {
-                            Some(nd) => {
-                                let mut na = Dict::new();
-                                na.set(b"S".to_vec(), Object::name("GoTo"));
-                                na.set(b"D".to_vec(), nd);
-                                d.set(b"A".to_vec(), Object::Dict(na));
-                            }
-                            None => {
-                                d.remove(b"A");
-                            }
-                        }
-                    } else {
-                        // Other actions (URI, Launch, JavaScript…) carry no page references. The
-                        // copier lends its map out and takes it back with the new copies in it,
-                        // so actions sharing an object share its one copy.
-                        let mut c = Copier::new(self.src, std::mem::take(&mut self.map), HashMap::new());
-                        let copied = c.copy_value(dst, &Object::Dict(ad.clone()), None);
-                        self.map = c.map;
-                        d.set(b"A".to_vec(), copied?);
-                    }
-                }
-            }
-            dst.set(a, Object::Dict(d));
-        }
-        Ok(())
-    }
-}
-
-/// Copy `o` from `src` into `dst`, reusing the copies listed in `map` (source → destination), so
-/// an object the copied pages already brought along (an ICC profile) is not stored twice.
-pub(crate) fn copy_object(dst: &mut Document, src: &Document, o: &Object, map: HashMap<ObjRef, ObjRef>) -> Result<Object, OrganizeError> {
-    Copier::new(src, map, HashMap::new()).copy_value(dst, o, None)
-}
+pub(crate) use carry::set_attachments;
+use carry::{Mark, source_outline, write_outline_level};
+pub use combine::{
+    CombineOutcome, Combiner, Run, SplitBy, combine, combine_grouped, combine_grouped_with, combine_selected, combine_selected_with, combine_with,
+    extract_pages, split, split_ranges,
+};
+pub(crate) use copy::copy_object;
+use copy::{Copier, SKIP_ON_PAGE};
+use fields::{add_kid, field_and_widget, register_fields, resolve_field_conflicts, split_own_field};
+pub use fields::{combine_field_conflicts, field_name_conflicts};
 
 /// How colliding fully-qualified field names are resolved when pages are imported.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
@@ -678,833 +476,6 @@ fn register_layers(dst: &mut Document, src: &Document, ocgs: &[(ObjRef, ObjRef)]
     Ok(())
 }
 
-/// Rename the top-level fields about to be registered in `dst` whose fully-qualified names
-/// (`parent.T.child`) are already taken, so each imported field stays its own field instead of
-/// blurring into the destination's field of the same name (fields of one fully-qualified name
-/// are one field). A colliding node's own `/T` becomes the first free `Name-1`, `Name-2`…
-/// variant, so everything below it keeps its place in the tree. Returns what was renamed
-/// (old fully-qualified name → new one), in order.
-fn resolve_field_conflicts(dst: &mut Document, fields: &[ObjRef]) -> Result<Vec<(String, String)>, OrganizeError> {
-    let mut taken = taken_field_names(dst)?;
-    let planned = plan_renames(dst, fields, &mut taken);
-    let mut renamed = Vec::new();
-    for (node, new_t, old, new) in planned {
-        dst.update_dict(node, |d| d.set(b"T".to_vec(), Object::String(pdfcraft_cos::PdfString::text(&new_t))))?;
-        renamed.push((old, new));
-    }
-    Ok(renamed)
-}
-
-/// What importing `src` into `dst` would rename, computed without changing either document:
-/// each fully-qualified name of `src`'s fields that `dst` already uses (or that an earlier
-/// field of `src` itself uses) is renamed to the first free variant, exactly as the import
-/// would. Unreadable structure previews as nothing: the import itself will say why it failed.
-pub fn field_name_conflicts(dst: &Document, src: &Document) -> Vec<(String, String)> {
-    let Ok(mut taken) = taken_field_names(dst) else { return Vec::new() };
-    let Ok(roots) = field_roots(src) else { return Vec::new() };
-    plan_renames(src, &roots, &mut taken).into_iter().map(|(_, _, old, new)| (old, new)).collect()
-}
-
-/// What combining `sources`, in order, would rename in each one: the whole list is simulated
-/// with the same first-free-variant rule the combine uses, so a later file's preview sees the
-/// earlier files' renames. Unreadable structure previews as nothing (the combine itself will
-/// say why it fails); non-colliding names still count as taken for the files after them.
-pub fn combine_field_conflicts(sources: &[&Document]) -> Vec<Vec<(String, String)>> {
-    let mut taken = std::collections::HashSet::new();
-    sources
-        .iter()
-        .map(|src| match field_roots(src) {
-            Ok(roots) => plan_renames(src, &roots, &mut taken).into_iter().map(|(_, _, old, new)| (old, new)).collect(),
-            Err(_) => Vec::new(),
-        })
-        .collect()
-}
-
-/// Walk field trees `roots` in `doc` and plan the renames that would keep every name separate
-/// from `taken`: each node's fully-qualified name joins `taken` (so a later field of the same
-/// import collides with an earlier one), and a node already taken is renamed to the first free
-/// variant of its own `/T`. Names are compared and renamed as decoded text, not as stored
-/// bytes, so one name written in two encodings (PDFDocEncoding, UTF-16BE) is one name.
-/// Read-only: returns (node, new `/T`, old name, new name). Cycle- and depth-safe.
-fn plan_renames(doc: &Document, roots: &[ObjRef], taken: &mut std::collections::HashSet<String>) -> Vec<(ObjRef, String, String, String)> {
-    let mut planned = Vec::new();
-    let mut walk = RenameWalk::default();
-    for &root in roots {
-        plan_renames_under(doc, root, "", taken, &mut walk, 0, &mut planned);
-    }
-    planned
-}
-
-/// What one [`plan_renames`] call remembers: the nodes it visited, and for each colliding name
-/// the suffix to try next.
-#[derive(Default)]
-struct RenameWalk {
-    seen: HashSet<ObjRef>,
-    next: HashMap<String, u32>,
-}
-
-/// One node of [`plan_renames`].
-fn plan_renames_under(
-    doc: &Document,
-    node: ObjRef,
-    prefix: &str,
-    taken: &mut std::collections::HashSet<String>,
-    walk: &mut RenameWalk,
-    depth: u8,
-    planned: &mut Vec<(ObjRef, String, String, String)>,
-) {
-    if depth > 32 || !walk.seen.insert(node) {
-        return;
-    }
-    let Some(d) = doc.get(node).as_dict().cloned() else { return };
-    let mut name = d.get(b"T").and_then(|t| doc.resolve(t).as_string().map(|s| s.to_text())).unwrap_or_default();
-    if !name.is_empty() {
-        let fqn = qualified(prefix, &name);
-        if taken.contains(&fqn) {
-            // `taken` only grows, so every suffix below the last one handed out for this name is
-            // still taken: resume there instead of at 1.
-            let mut n = walk.next.get(&fqn).copied().unwrap_or(1);
-            let mut variant;
-            while {
-                #[cfg(test)]
-                crate::work(1);
-                variant = format!("{name}-{n}");
-                taken.contains(&qualified(prefix, &variant))
-            } {
-                n = n.saturating_add(1);
-            }
-            walk.next.insert(fqn.clone(), n.saturating_add(1));
-            let new_fqn = qualified(prefix, &variant);
-            planned.push((node, variant.clone(), fqn, new_fqn.clone()));
-            taken.insert(new_fqn);
-            name = variant;
-        } else {
-            taken.insert(fqn);
-        }
-    }
-    let prefix = qualified_optional(prefix, &name);
-    let kids = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
-    for kid in kids.iter().filter_map(|k| k.as_ref()) {
-        plan_renames_under(doc, kid, &prefix, taken, walk, depth + 1, planned);
-    }
-}
-
-/// The field names in use in `dst`: every name in its form, and every name hanging only off a
-/// page's widgets — a field the form never lists still owns its name.
-fn taken_field_names(dst: &Document) -> Result<std::collections::HashSet<String>, OrganizeError> {
-    let mut taken = std::collections::HashSet::new();
-    let mut seen = std::collections::HashSet::new();
-    for root in field_roots(dst)? {
-        collect_names(dst, root, "", &mut seen, 0, &mut taken);
-    }
-    Ok(taken)
-}
-
-/// A document's field trees, wherever they are rooted: the `/AcroForm /Fields` entries, and
-/// the fields behind widgets on pages (climbed to their root, for forms that never registered
-/// them).
-fn field_roots(doc: &Document) -> Result<Vec<ObjRef>, OrganizeError> {
-    let mut roots: Vec<ObjRef> = doc
-        .root()
-        .and_then(|r| doc.get(r).as_dict().cloned())
-        .and_then(|c| c.get(b"AcroForm").map(|f| doc.resolve(f)))
-        .and_then(|f| f.as_dict().cloned())
-        .and_then(|f| f.get(b"Fields").map(|l| doc.resolve(l)))
-        .and_then(|l| l.as_array().cloned())
-        .unwrap_or_default()
-        .iter()
-        .filter_map(|f| f.as_ref())
-        .collect();
-    for (page, _) in walk(doc)? {
-        let Some(d) = doc.get(page).as_dict().cloned() else { continue };
-        let annots = d.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default();
-        for a in annots.iter() {
-            let Some(w) = doc.resolve(a).as_dict().cloned() else { continue };
-            if w.name(b"Subtype") != Some(b"Widget") {
-                continue;
-            }
-            // Walk up to the field the widget belongs to, however deep it sits; a widget that
-            // is its own field is its own root.
-            let Some(mut root) = a.as_ref() else { continue };
-            let mut up = 0;
-            while let Some(parent) = doc.get(root).as_dict().and_then(|p| p.reference(b"Parent")) {
-                if up >= 32 || root == parent {
-                    break;
-                }
-                root = parent;
-                up += 1;
-            }
-            roots.push(root);
-        }
-    }
-    Ok(roots)
-}
-
-/// Record the fully-qualified names of one field tree. Cycle- and depth-safe.
-fn collect_names(
-    dst: &Document,
-    node: ObjRef,
-    prefix: &str,
-    seen: &mut std::collections::HashSet<ObjRef>,
-    depth: u8,
-    out: &mut std::collections::HashSet<String>,
-) {
-    if depth > 32 || !seen.insert(node) {
-        return;
-    }
-    let Some(d) = dst.get(node).as_dict().cloned() else { return };
-    let name = d.get(b"T").and_then(|t| dst.resolve(t).as_string().map(|s| s.to_text())).unwrap_or_default();
-    let prefix = qualified_optional(prefix, &name);
-    if !name.is_empty() {
-        out.insert(prefix.clone());
-    }
-    let kids = d.get(b"Kids").map(|k| dst.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
-    for kid in kids.iter().filter_map(|k| k.as_ref()) {
-        collect_names(dst, kid, &prefix, seen, depth + 1, out);
-    }
-}
-
-/// `prefix.name`, or `name` at the top level.
-fn qualified(prefix: &str, name: &str) -> String {
-    if prefix.is_empty() { name.to_string() } else { format!("{prefix}.{name}") }
-}
-
-/// The prefix a node's children hang under: its own name, when it has one.
-fn qualified_optional(prefix: &str, name: &str) -> String {
-    if name.is_empty() { prefix.to_string() } else { qualified(prefix, name) }
-}
-
-/// Add `kid` to `field`'s `/Kids`, in the array object itself when `/Kids` is one, so the field
-/// keeps its other widgets.
-fn add_kid(dst: &mut Document, field: ObjRef, kid: ObjRef) -> Result<(), OrganizeError> {
-    match dst.get(field).as_dict().and_then(|f| f.get(b"Kids").cloned()) {
-        Some(Object::Ref(list)) => {
-            let mut kids = dst.get(list).as_array().cloned().unwrap_or_default();
-            kids.push(Object::Ref(kid));
-            dst.set(list, Object::Array(kids));
-        }
-        _ => dst.update_dict(field, |f| {
-            let mut kids = f.get(b"Kids").and_then(|k| k.as_array()).cloned().unwrap_or_default();
-            kids.push(Object::Ref(kid));
-            f.set(b"Kids".to_vec(), Object::Array(kids));
-        })?,
-    }
-    Ok(())
-}
-
-/// PdfCraft patch (#1810): split a widget that doubles as its own field into a parent field
-/// holding the field keys (name, value, flags…) and a widget child holding the annotation keys
-/// (rectangle, appearance, page). The parent takes the widget's place among the top-level fields;
-/// later copies of the page add widget children of it, so every page has its own widget and the
-/// field stays one.
-fn split_own_field(dst: &mut Document, fields: &mut [ObjRef], widget: ObjRef) {
-    let Some(d) = dst.get(widget).as_dict().cloned() else { return };
-    let (mut field, mut child) = field_and_widget(dst, &d);
-    let parent = dst.add(Object::Null);
-    field.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(widget)]));
-    child.set(b"Parent".to_vec(), Object::Ref(parent));
-    dst.set(parent, Object::Dict(field));
-    dst.set(widget, Object::Dict(child));
-    if let Some(entry) = fields.iter_mut().find(|f| **f == widget) {
-        *entry = parent;
-    }
-}
-
-/// A combined field/widget has two additional-action namespaces (ISO 32000-1 tables 194/196).
-/// Partition them as well as the ordinary entries, including when copying a later widget.
-fn field_and_widget(doc: &Document, d: &Dict) -> (Dict, Dict) {
-    let (mut field, mut child) = (Dict::new(), Dict::new());
-    for (k, v) in d.iter() {
-        if k.as_slice() == b"AA"
-            && let Some(actions) = doc.resolve(v).as_dict().cloned()
-        {
-            let (mut field_actions, mut widget_actions) = (Dict::new(), Dict::new());
-            for (trigger, action) in actions.iter() {
-                if [b"E".as_slice(), b"X", b"D", b"U", b"Fo", b"Bl", b"PO", b"PC", b"PV", b"PI"].contains(&trigger.as_slice()) {
-                    widget_actions.set(trigger.clone(), action.clone());
-                } else {
-                    field_actions.set(trigger.clone(), action.clone());
-                }
-            }
-            if field_actions.iter().next().is_some() {
-                field.set(k.clone(), Object::Dict(field_actions));
-            }
-            if widget_actions.iter().next().is_some() {
-                child.set(k.clone(), Object::Dict(widget_actions));
-            }
-        } else if WIDGET_KEYS.contains(&k.as_slice()) {
-            child.set(k.clone(), v.clone());
-        } else {
-            field.set(k.clone(), v.clone());
-        }
-    }
-    (field, child)
-}
-
-/// Add top-level fields to the destination's `/AcroForm /Fields` (creating the form if needed).
-fn register_fields(dst: &mut Document, fields: &[ObjRef]) -> Result<(), OrganizeError> {
-    if fields.is_empty() {
-        return Ok(());
-    }
-    let root = dst.root().ok_or(OrganizeError::NoPageTree)?;
-    let catalog = dst.get(root).as_dict().cloned().ok_or(OrganizeError::NoPageTree)?;
-    let (form_ref, mut form) = match catalog.get(b"AcroForm") {
-        Some(Object::Ref(r)) => (Some(*r), dst.get(*r).as_dict().cloned().unwrap_or_default()),
-        Some(Object::Dict(d)) => (None, d.clone()),
-        _ => (None, Dict::new()),
-    };
-    let mut list = form.get(b"Fields").map(|f| dst.resolve(f)).and_then(|f| f.as_array().cloned()).unwrap_or_default();
-    let mut listed: HashSet<ObjRef> = list.iter().filter_map(Object::as_ref).collect();
-    for f in fields {
-        #[cfg(test)]
-        crate::work(1);
-        if listed.insert(*f) {
-            list.push(Object::Ref(*f));
-        }
-    }
-    form.set(b"Fields".to_vec(), Object::Array(list));
-    match form_ref {
-        Some(r) => dst.set(r, Object::Dict(form)),
-        None => {
-            let r = dst.add(form);
-            dst.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Ref(r)))?;
-        }
-    }
-    Ok(())
-}
-
-/// A new document containing copies of `pages` from `src` (Extract Pages / Split).
-/// Document information (title, author…) is carried over, and so is the print standard the
-/// source declares (PDF/X: its output intents and identification, #263), and the bookmarks that
-/// go to the copied pages.
-pub fn extract_pages(src: &Document, pages: &[usize]) -> Result<Document, OrganizeError> {
-    let mut out = Document::new_empty();
-    // One source: nothing to deduplicate. Its fields keep their names (a source with two
-    // same-named field roots stays one field, as it was), so Extract and Split never rename.
-    let imported = import_pages_mapped(&mut out, src, pages, 0, FieldConflicts::Merge)?;
-    // The bookmarks of these pages come along, mapped to the copies (#4020).
-    let outline = kept_bookmarks(source_outline(src, imported.page_map));
-    if !outline.is_empty() {
-        let root = crate::outline::container(&mut out, &[])?;
-        if let Some((first, last, _)) = write_outline_level(&mut out, root, &outline)? {
-            out.update_dict(root, |d| {
-                d.set(b"First".to_vec(), Object::Ref(first));
-                d.set(b"Last".to_vec(), Object::Ref(last));
-            })?;
-            let top = crate::outline::children(&out, root);
-            crate::outline::relink_and_recount(&mut out, root, &top)?;
-        }
-    }
-    for key in crate::INFO_KEYS {
-        if let Some(v) = crate::info(src, key) {
-            crate::set_info(&mut out, key, &v)?;
-        }
-    }
-    // After the title: the XMP packet repeats it.
-    crate::pdfx::carry(&mut out, Some(src), &crate::pdfx::PrintStandard::of(src), imported.objects)?;
-    // The pages share their source's resource dictionary, so the part would otherwise carry every
-    // XObject the source lists — images and all (#204). Keep only what these pages draw.
-    crate::prune::prune_unused_xobjects(&mut out)?;
-    Ok(out)
-}
-
-/// How to split a document.
-#[derive(Clone, Debug, PartialEq)]
-pub enum SplitBy {
-    /// Every `n` pages.
-    PageCount(usize),
-    /// Before each of these 0-based page indices (e.g. `[3, 7]` → 0–2, 3–6, 7–end).
-    Before(Vec<usize>),
-}
-
-/// The page ranges (0-based, end-exclusive) a split produces.
-pub fn split_ranges(page_count: usize, by: &SplitBy) -> Vec<std::ops::Range<usize>> {
-    let mut cuts: Vec<usize> = match by {
-        SplitBy::PageCount(n) => (1..).map(|i| i * (*n).max(1)).take_while(|c| *c < page_count).collect(),
-        SplitBy::Before(v) => v.iter().copied().filter(|c| *c > 0 && *c < page_count).collect(),
-    };
-    cuts.sort_unstable();
-    cuts.dedup();
-    let mut ranges = Vec::new();
-    let mut start = 0;
-    for c in cuts.into_iter().chain(std::iter::once(page_count)) {
-        if c > start {
-            ranges.push(start..c);
-            start = c;
-        }
-    }
-    ranges
-}
-
-/// Split a document into several new documents.
-pub fn split(src: &Document, by: &SplitBy) -> Result<Vec<Document>, OrganizeError> {
-    let n = crate::page_count(src)?;
-    split_ranges(n, by).into_iter().map(|r| extract_pages(src, &r.collect::<Vec<_>>())).collect()
-}
-
-/// What combining produced, beyond the document: the fields renamed to keep colliding names
-/// separate (old fully-qualified name → new one), in order across all sources.
-pub struct CombineOutcome {
-    /// The combined document.
-    pub doc: Document,
-    /// Every field renamed while combining.
-    pub renamed_fields: Vec<(String, String)>,
-}
-
-/// Combine whole documents, in order, into a new document. Each source gets a top-level
-/// bookmark (its `title`) pointing to its first page, like Acrobat's Combine Files.
-/// The source's own bookmarks are nested (collapsed) under its entry, and its document-level
-/// attachments are carried over. When every source declares the same print standard (PDF/X
-/// with the same output intent), so does the result.
-pub fn combine(sources: &[(&str, &Document)]) -> Result<Document, OrganizeError> {
-    combine_with(sources, FieldConflicts::Rename).map(|o| o.doc)
-}
-
-/// [`combine`] reporting what the conflict resolution renamed.
-pub fn combine_with(sources: &[(&str, &Document)], conflicts: FieldConflicts) -> Result<CombineOutcome, OrganizeError> {
-    let all: Vec<(&str, &Document, Option<&[usize]>)> = sources.iter().map(|(t, d)| (*t, *d, None)).collect();
-    combine_selected_with(&all, conflicts)
-}
-
-/// Combine Files with chosen pages: each source contributes `pages` (0-based, in that order;
-/// `None` for all of them). Bookmarks that point at pages left out lose their destination.
-pub fn combine_selected(sources: &[(&str, &Document, Option<&[usize]>)]) -> Result<Document, OrganizeError> {
-    combine_selected_with(sources, FieldConflicts::Rename).map(|o| o.doc)
-}
-
-/// [`combine_selected`] reporting what the conflict resolution renamed.
-pub fn combine_selected_with(sources: &[(&str, &Document, Option<&[usize]>)], conflicts: FieldConflicts) -> Result<CombineOutcome, OrganizeError> {
-    let mut combiner = Combiner::with_field_conflicts(conflicts);
-    for (title, src, chosen) in sources {
-        combiner.add(title, src, *chosen)?;
-    }
-    combiner.finish_with_renames()
-}
-
-/// Combine Files one source at a time, with the same result as [`combine_selected`]. [`Combiner::add`]
-/// copies a source's pages into the result and keeps only what the rest of the combine needs: its
-/// bookmarks (read and mapped to the copied pages), its attachments (copied), and its document only
-/// when it declares output intents. So each source can be dropped as soon as it is added, and a long
-/// list holds one source at a time rather than all of them.
-pub struct Combiner {
-    out: Document,
-    marks: Vec<Mark>,
-    attachments: Vec<(Vec<u8>, Object)>,
-    /// The first source's print standard, and what its pages brought along.
-    standard: Option<Standard>,
-    /// Whether every source so far declares the first source's print standard.
-    agreed: bool,
-    /// How colliding field names are resolved as each source is added.
-    field_conflicts: FieldConflicts,
-    /// What adding sources renamed (old → new fully-qualified field name), in order.
-    renamed_fields: Vec<(String, String)>,
-}
-
-/// The first source's print standard (see [`Combiner`]).
-struct Standard {
-    declared: crate::pdfx::PrintStandard,
-    /// The source objects the copied pages brought along, and their copies.
-    objects: HashMap<ObjRef, ObjRef>,
-    /// The source itself, kept only for its output intents, which are copied from it.
-    source: Option<Document>,
-}
-
-impl Default for Combiner {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl Combiner {
-    /// A combine with no sources yet, renaming colliding field names as sources are added.
-    pub fn new() -> Self {
-        Self::with_field_conflicts(FieldConflicts::Rename)
-    }
-
-    /// [`Combiner::new`] resolving colliding field names as `conflicts` says.
-    pub fn with_field_conflicts(field_conflicts: FieldConflicts) -> Self {
-        Self {
-            out: Document::new_empty(),
-            marks: Vec::new(),
-            attachments: Vec::new(),
-            standard: None,
-            agreed: true,
-            field_conflicts,
-            renamed_fields: Vec::new(),
-        }
-    }
-
-    /// What adding sources has renamed so far (old → new fully-qualified field name).
-    pub fn renamed_fields(&self) -> &[(String, String)] {
-        &self.renamed_fields
-    }
-
-    /// Add `src`'s `pages` (0-based, in that order; `None` for all of them) after the pages added so far,
-    /// under a bookmark titled `title`. `src` need not outlive the call.
-    pub fn add(&mut self, title: &str, src: &Document, pages: Option<&[usize]>) -> Result<(), OrganizeError> {
-        let n = crate::page_count(src)?;
-        let pages: Vec<usize> = match pages {
-            Some(p) => {
-                if let Some(bad) = p.iter().find(|i| **i >= n) {
-                    return Err(OrganizeError::NoSuchPage(*bad));
-                }
-                p.to_vec()
-            }
-            None => (0..n).collect(),
-        };
-        let at = crate::page_count(&self.out)?;
-        let imported = import_pages_mapped(&mut self.out, src, &pages, at, self.field_conflicts)?;
-        self.renamed_fields.extend(imported.renamed_fields);
-        if let Some(first) = imported.pages.first() {
-            let outline = source_outline(src, imported.page_map);
-            self.marks.push(Mark { title: title.to_string(), page: *first, outline });
-        }
-        collect_attachments(&mut self.out, src, &mut self.attachments)?;
-        let declared = crate::pdfx::PrintStandard::of(src);
-        match self.standard.as_ref().map(|first| first.declared.same_as(&declared)) {
-            Some(same) => self.agreed &= same,
-            None => {
-                let source = declared.declares_output_intents().then(|| src.clone());
-                self.standard = Some(Standard { declared, objects: imported.objects, source });
-            }
-        }
-        Ok(())
-    }
-
-    /// The combined document: the pages as added, the print standard of the first source when every
-    /// source declares the same one, shared resources stored once, then the bookmarks and attachments.
-    pub fn finish(self) -> Result<Document, OrganizeError> {
-        self.finish_with_renames().map(|o| o.doc)
-    }
-
-    /// [`Combiner::finish`] reporting what the combine renamed.
-    pub fn finish_with_renames(self) -> Result<CombineOutcome, OrganizeError> {
-        let Combiner { mut out, marks, attachments, standard, agreed, renamed_fields, .. } = self;
-        if let Some(first) = standard.filter(|_| agreed) {
-            crate::pdfx::carry(&mut out, first.source.as_ref(), &first.declared, first.objects)?;
-        }
-        // Sources often share fonts, images and profiles (or are the same file): store them once.
-        let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
-        crate::dedupe::dedupe_resources(&mut out, &all, false);
-        add_outline(&mut out, &marks)?;
-        set_attachments(&mut out, attachments)?;
-        Ok(CombineOutcome { doc: out, renamed_fields })
-    }
-}
-
-/// One run of pages for [`combine_grouped`]: the file it comes from (`group`: runs with the same
-/// group are one file split around, and give the same document), its title, the document, and
-/// its pages (0-based, in that order; `None` for all of them).
-pub type Run<'a> = (usize, &'a str, &'a Document, Option<&'a [usize]>);
-
-/// Combine Files where a file's pages may be split into several runs with other files' pages
-/// between them. Each file (group) is copied once, all its pages together, then the pages are put
-/// in the runs' order: its links between its own pages, its form fields and its attachments stay
-/// whole, and it gets one top-level bookmark (the title of its first run) at its first page, its
-/// own bookmarks nested. Otherwise as [`combine_selected`] (print standard, shared resources).
-pub fn combine_grouped(runs: &[Run<'_>]) -> Result<Document, OrganizeError> {
-    combine_grouped_with(runs, FieldConflicts::Rename).map(|o| o.doc)
-}
-
-/// [`combine_grouped`] reporting what the conflict resolution renamed.
-pub fn combine_grouped_with(runs: &[Run<'_>], conflicts: FieldConflicts) -> Result<CombineOutcome, OrganizeError> {
-    // Each file's pages, in the order its runs list them, and each run's place in that list.
-    struct File<'a> {
-        title: &'a str,
-        src: &'a Document,
-        pages: Vec<usize>,
-    }
-    let mut files: Vec<(usize, File<'_>)> = Vec::new();
-    let mut slices: Vec<(usize, usize, usize)> = Vec::with_capacity(runs.len());
-    for (group, title, src, chosen) in runs {
-        let at = match files.iter().position(|(g, _)| g == group) {
-            Some(at) => at,
-            None => {
-                files.push((*group, File { title, src, pages: Vec::new() }));
-                files.len() - 1
-            }
-        };
-        let Some((_, file)) = files.get_mut(at) else { continue };
-        let n = crate::page_count(file.src)?;
-        let pages: Vec<usize> = match chosen {
-            Some(p) => {
-                if let Some(bad) = p.iter().find(|i| **i >= n) {
-                    return Err(OrganizeError::NoSuchPage(*bad));
-                }
-                p.to_vec()
-            }
-            None => (0..n).collect(),
-        };
-        slices.push((at, file.pages.len(), pages.len()));
-        file.pages.extend(pages);
-    }
-    let mut out = Document::new_empty();
-    let mut marks = Vec::new();
-    let mut attachments = Vec::new();
-    let mut copies: Vec<Vec<ObjRef>> = Vec::with_capacity(files.len());
-    let mut renamed_fields = Vec::new();
-    let mut standard: Option<(crate::pdfx::PrintStandard, &Document, HashMap<ObjRef, ObjRef>)> = None;
-    let mut agreed = true;
-    for (_, file) in &files {
-        let at = crate::page_count(&out)?;
-        let imported = import_pages_mapped(&mut out, file.src, &file.pages, at, conflicts)?;
-        copies.push(imported.pages.clone());
-        renamed_fields.extend(imported.renamed_fields);
-        if let Some(first) = imported.pages.first() {
-            marks.push(Mark { title: file.title.to_string(), page: *first, outline: source_outline(file.src, imported.page_map) });
-        }
-        collect_attachments(&mut out, file.src, &mut attachments)?;
-        let declared = crate::pdfx::PrintStandard::of(file.src);
-        match &standard {
-            None => standard = Some((declared, file.src, imported.objects)),
-            Some((first, _, _)) => agreed &= first.same_as(&declared),
-        }
-    }
-    // The pages in the runs' order. A file's first run comes before its others, and its pages
-    // were copied in run order, so its bookmark (its first copied page) is its first page shown.
-    let mut order: Vec<(ObjRef, Dict)> = Vec::new();
-    for (file, start, len) in slices {
-        let run = copies.get(file).and_then(|c| c.get(start..start.saturating_add(len))).unwrap_or_default();
-        order.extend(run.iter().map(|r| (*r, Dict::new())));
-    }
-    rebuild(&mut out, &order)?;
-    if let Some((declared, src, objects)) = standard.filter(|_| agreed) {
-        crate::pdfx::carry(&mut out, Some(src), &declared, objects)?;
-    }
-    let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
-    crate::dedupe::dedupe_resources(&mut out, &all, false);
-    add_outline(&mut out, &marks)?;
-    set_attachments(&mut out, attachments)?;
-    Ok(CombineOutcome { doc: out, renamed_fields })
-}
-
-/// Copy a source's document-level attachments (`/Names /EmbeddedFiles`) into `dst`.
-fn collect_attachments(dst: &mut Document, src: &Document, out: &mut Vec<(Vec<u8>, Object)>) -> Result<(), OrganizeError> {
-    let Some(tree) = src
-        .root()
-        .and_then(|r| src.get(r).as_dict().cloned())
-        .and_then(|c| c.get(b"Names").map(|n| src.resolve(n)))
-        .and_then(|n| n.as_dict().and_then(|d| d.get(b"EmbeddedFiles").cloned()))
-    else {
-        return Ok(());
-    };
-    let mut entries = Vec::new();
-    name_tree_entries(src, &tree, 0, &mut HashSet::new(), &mut entries);
-    let mut copier = Copier::new(src, HashMap::new(), HashMap::new());
-    for (k, v) in entries {
-        let v = copier.copy_value(dst, &v, None)?;
-        out.push((k, v));
-    }
-    Ok(())
-}
-
-/// Write attachments as a flat, sorted `/EmbeddedFiles` name tree; duplicate names get " (2)"…
-pub(crate) fn set_attachments(dst: &mut Document, mut entries: Vec<(Vec<u8>, Object)>) -> Result<(), OrganizeError> {
-    if entries.is_empty() {
-        return Ok(());
-    }
-    // Names are compared and numbered as text: a key written as UTF-16 (a name with an accent
-    // or Chinese letters) must not get ASCII bytes appended to it.
-    let mut seen = std::collections::HashSet::new();
-    for (k, _) in entries.iter_mut() {
-        let base = pdfcraft_cos::PdfString::literal(k.clone()).to_text();
-        let mut text = base.clone();
-        let mut n = 2;
-        while !seen.insert(text.clone()) {
-            text = format!("{base} ({n})");
-            n += 1;
-        }
-        if text != base {
-            *k = pdfcraft_cos::PdfString::text(&text).bytes;
-        }
-    }
-    entries.sort_by(|a, b| a.0.cmp(&b.0));
-    let mut names = Vec::new();
-    for (k, v) in entries {
-        names.push(Object::String(pdfcraft_cos::PdfString::literal(k)));
-        names.push(v);
-    }
-    let mut tree = Dict::new();
-    tree.set(b"Names".to_vec(), Object::Array(names));
-    let tree = dst.add(tree);
-    let root = dst.root().ok_or(OrganizeError::NoPageTree)?;
-    // `/Names` may be an indirect dictionary (Acrobat writes it so): update it where it is, so
-    // its other trees (/Dests, /JavaScript…) stay.
-    if let Some(Object::Ref(names)) = dst.get(root).as_dict().and_then(|c| c.get(b"Names").cloned())
-        && dst.get(names).as_dict().is_some()
-    {
-        dst.update_dict(names, |n| n.set(b"EmbeddedFiles".to_vec(), Object::Ref(tree)))?;
-        return Ok(());
-    }
-    dst.update_dict(root, |c| {
-        let mut n = match c.get(b"Names") {
-            Some(Object::Dict(d)) => d.clone(),
-            _ => Dict::new(),
-        };
-        n.set(b"EmbeddedFiles".to_vec(), Object::Ref(tree));
-        c.set(b"Names".to_vec(), Object::Dict(n));
-    })?;
-    Ok(())
-}
-
-/// A source's entry in the combined outline (see [`add_outline`]): its title, its first page in the
-/// result, and its own bookmarks, read from the source when it was added.
-struct Mark {
-    title: String,
-    page: ObjRef,
-    outline: Vec<OutlineNode>,
-}
-
-/// One of a source's bookmarks, read and ready to write: its title, colour and flags, its destination
-/// in the result (`None` when the page it points at was not copied), whether it is open, and its own
-/// bookmarks.
-struct OutlineNode {
-    title: Option<Object>,
-    colour: Option<Object>,
-    flags: Option<Object>,
-    dest: Option<Object>,
-    open: bool,
-    children: Vec<OutlineNode>,
-}
-
-/// The bookmarks of `src`, with destinations mapped through `pages` (source page to copied page). They
-/// are read while `src` is at hand, so the source itself need not be kept.
-fn source_outline(src: &Document, pages: HashMap<ObjRef, ObjRef>) -> Vec<OutlineNode> {
-    let first = src
-        .root()
-        .and_then(|r| src.get(r).as_dict().cloned())
-        .and_then(|c| c.get(b"Outlines").map(|o| src.resolve(o)))
-        .and_then(|o| o.as_dict().and_then(|d| d.reference(b"First")));
-    let mapper = Copier::new(src, HashMap::new(), pages);
-    let mut budget = 10_000usize;
-    outline_level(&mapper, first, 0, &mut budget)
-}
-
-/// `nodes` without the bookmarks whose page was not copied (no destination left), unless a bookmark
-/// under them stays. [`outline_level`] already bounds the depth.
-fn kept_bookmarks(nodes: Vec<OutlineNode>) -> Vec<OutlineNode> {
-    nodes
-        .into_iter()
-        .filter_map(|mut n| {
-            n.children = kept_bookmarks(n.children);
-            (n.dest.is_some() || !n.children.is_empty()).then_some(n)
-        })
-        .collect()
-}
-
-/// One level of bookmarks from `first` (its siblings), each with its children. Cycle- and size-safe:
-/// at most `budget` bookmarks are read in all, and nesting stops at 32 levels.
-fn outline_level(m: &Copier<'_>, first: Option<ObjRef>, depth: u8, budget: &mut usize) -> Vec<OutlineNode> {
-    if depth > 32 {
-        return Vec::new();
-    }
-    let mut seen = std::collections::HashSet::new();
-    let mut made = Vec::new();
-    let mut cur = first;
-    while let Some(r) = cur {
-        if !seen.insert(r) || *budget == 0 {
-            break;
-        }
-        *budget -= 1;
-        let Some(item) = m.src.get(r).as_dict().cloned() else { break };
-        cur = item.reference(b"Next");
-        let title = item.get(b"Title").map(|t| m.src.resolve(t).as_ref().clone());
-        let colour = item.get(b"C").map(|v| m.src.resolve(v).as_ref().clone());
-        let flags = item.get(b"F").map(|v| m.src.resolve(v).as_ref().clone());
-        let target = item.get(b"Dest").cloned().or_else(|| {
-            let a = m.src.resolve(item.get(b"A")?);
-            let a = a.as_dict()?;
-            (a.name(b"S") == Some(b"GoTo")).then(|| a.get(b"D").cloned()).flatten()
-        });
-        let dest = target.and_then(|t| m.map_dest(&t));
-        let open = item.int(b"Count").is_some_and(|c| c > 0);
-        let children = outline_level(m, item.reference(b"First"), depth + 1, budget);
-        made.push(OutlineNode { title, colour, flags, dest, open, children });
-    }
-    made
-}
-
-/// Write `nodes` as one level under `parent`: each bookmark is created, then its children, depth first
-/// and in order, so the object numbers come out as they always did. Returns the level's first and last
-/// item and how many items it has (`None` when it is empty).
-fn write_outline_level(dst: &mut Document, parent: ObjRef, nodes: &[OutlineNode]) -> Result<Option<(ObjRef, ObjRef, usize)>, OrganizeError> {
-    let mut made: Vec<ObjRef> = Vec::new();
-    for node in nodes {
-        let new = dst.add(Object::Null);
-        let mut d = Dict::new();
-        if let Some(t) = &node.title {
-            d.set(b"Title".to_vec(), t.clone());
-        }
-        if let Some(c) = &node.colour {
-            d.set(b"C".to_vec(), c.clone());
-        }
-        if let Some(f) = &node.flags {
-            d.set(b"F".to_vec(), f.clone());
-        }
-        if let Some(dest) = &node.dest {
-            d.set(b"Dest".to_vec(), dest.clone());
-        }
-        d.set(b"Parent".to_vec(), Object::Ref(parent));
-        if let Some(prev) = made.last() {
-            d.set(b"Prev".to_vec(), Object::Ref(*prev));
-            dst.update_dict(*prev, |p| p.set(b"Next".to_vec(), Object::Ref(new)))?;
-        }
-        if let Some((f, l, n)) = write_outline_level(dst, new, &node.children)? {
-            d.set(b"First".to_vec(), Object::Ref(f));
-            d.set(b"Last".to_vec(), Object::Ref(l));
-            // Keep the source's open/closed state.
-            d.set(b"Count".to_vec(), Object::Int(if node.open { n as i64 } else { -(n as i64) }));
-        }
-        dst.set(new, Object::Dict(d));
-        made.push(new);
-    }
-    Ok(match (made.first(), made.last()) {
-        (Some(first), Some(last)) => Some((*first, *last, made.len())),
-        _ => None,
-    })
-}
-
-/// Replace the outline with one bookmark per source (title → its first page), each holding a collapsed
-/// copy of that source's own bookmarks with destinations mapped to the copied pages.
-fn add_outline(doc: &mut Document, marks: &[Mark]) -> Result<(), OrganizeError> {
-    if marks.is_empty() {
-        return Ok(());
-    }
-    let outlines = doc.add(Object::Null);
-    let items: Vec<ObjRef> = marks.iter().map(|_| doc.add(Object::Null)).collect();
-    let (Some(&first_item), Some(&last_item)) = (items.first(), items.last()) else { return Ok(()) };
-    for (i, (mark, r)) in marks.iter().zip(&items).enumerate() {
-        let mut d = Dict::new();
-        d.set(b"Title".to_vec(), Object::String(pdfcraft_cos::PdfString::text(&mark.title)));
-        d.set(b"Parent".to_vec(), Object::Ref(outlines));
-        d.set(b"Dest".to_vec(), Object::Array(vec![Object::Ref(mark.page), Object::name("Fit")]));
-        if i > 0 {
-            d.set(b"Prev".to_vec(), Object::Ref(items[i - 1]));
-        }
-        if let Some(next) = items.get(i + 1) {
-            d.set(b"Next".to_vec(), Object::Ref(*next));
-        }
-        if let Some((f, l, n)) = write_outline_level(doc, *r, &mark.outline)? {
-            d.set(b"First".to_vec(), Object::Ref(f));
-            d.set(b"Last".to_vec(), Object::Ref(l));
-            d.set(b"Count".to_vec(), Object::Int(-(n as i64))); // collapsed
-        }
-        doc.set(*r, Object::Dict(d));
-    }
-    let mut o = Dict::new();
-    o.set(b"Type".to_vec(), Object::name("Outlines"));
-    o.set(b"First".to_vec(), Object::Ref(first_item));
-    o.set(b"Last".to_vec(), Object::Ref(last_item));
-    o.set(b"Count".to_vec(), Object::Int(items.len() as i64));
-    doc.set(outlines, Object::Dict(o));
-    let root = doc.root().ok_or(OrganizeError::NoPageTree)?;
-    doc.update_dict(root, |c| {
-        c.set(b"Outlines".to_vec(), Object::Ref(outlines));
-        c.set(b"PageMode".to_vec(), Object::name("UseOutlines"));
-    })?;
-    Ok(())
-}
-
 /// Page `page` of `src` as a form XObject in `dst` (its content and resources, no annotations),
 /// for backgrounds and watermarks taken from a PDF. The form's `/BBox` is the page's crop box
 /// and its `/Matrix` undoes the page rotation, so it draws upright as displayed. Returns the
diff --git a/crates/organize/src/import/carry.rs b/crates/organize/src/import/carry.rs
new file mode 100644
index 0000000000..21c21b9be3
--- /dev/null
+++ b/crates/organize/src/import/carry.rs
@@ -0,0 +1,233 @@
+use super::copy::Copier;
+use super::*;
+
+/// Copy a source's document-level attachments (`/Names /EmbeddedFiles`) into `dst`.
+pub(super) fn collect_attachments(dst: &mut Document, src: &Document, out: &mut Vec<(Vec<u8>, Object)>) -> Result<(), OrganizeError> {
+    let Some(tree) = src
+        .root()
+        .and_then(|r| src.get(r).as_dict().cloned())
+        .and_then(|c| c.get(b"Names").map(|n| src.resolve(n)))
+        .and_then(|n| n.as_dict().and_then(|d| d.get(b"EmbeddedFiles").cloned()))
+    else {
+        return Ok(());
+    };
+    let mut entries = Vec::new();
+    name_tree_entries(src, &tree, 0, &mut HashSet::new(), &mut entries);
+    let mut copier = Copier::new(src, HashMap::new(), HashMap::new());
+    for (k, v) in entries {
+        let v = copier.copy_value(dst, &v, None)?;
+        out.push((k, v));
+    }
+    Ok(())
+}
+
+/// Write attachments as a flat, sorted `/EmbeddedFiles` name tree; duplicate names get " (2)"…
+pub(crate) fn set_attachments(dst: &mut Document, mut entries: Vec<(Vec<u8>, Object)>) -> Result<(), OrganizeError> {
+    if entries.is_empty() {
+        return Ok(());
+    }
+    // Names are compared and numbered as text: a key written as UTF-16 (a name with an accent
+    // or Chinese letters) must not get ASCII bytes appended to it.
+    let mut seen = std::collections::HashSet::new();
+    for (k, _) in entries.iter_mut() {
+        let base = pdfcraft_cos::PdfString::literal(k.clone()).to_text();
+        let mut text = base.clone();
+        let mut n = 2;
+        while !seen.insert(text.clone()) {
+            text = format!("{base} ({n})");
+            n += 1;
+        }
+        if text != base {
+            *k = pdfcraft_cos::PdfString::text(&text).bytes;
+        }
+    }
+    entries.sort_by(|a, b| a.0.cmp(&b.0));
+    let mut names = Vec::new();
+    for (k, v) in entries {
+        names.push(Object::String(pdfcraft_cos::PdfString::literal(k)));
+        names.push(v);
+    }
+    let mut tree = Dict::new();
+    tree.set(b"Names".to_vec(), Object::Array(names));
+    let tree = dst.add(tree);
+    let root = dst.root().ok_or(OrganizeError::NoPageTree)?;
+    // `/Names` may be an indirect dictionary (Acrobat writes it so): update it where it is, so
+    // its other trees (/Dests, /JavaScript…) stay.
+    if let Some(Object::Ref(names)) = dst.get(root).as_dict().and_then(|c| c.get(b"Names").cloned())
+        && dst.get(names).as_dict().is_some()
+    {
+        dst.update_dict(names, |n| n.set(b"EmbeddedFiles".to_vec(), Object::Ref(tree)))?;
+        return Ok(());
+    }
+    dst.update_dict(root, |c| {
+        let mut n = match c.get(b"Names") {
+            Some(Object::Dict(d)) => d.clone(),
+            _ => Dict::new(),
+        };
+        n.set(b"EmbeddedFiles".to_vec(), Object::Ref(tree));
+        c.set(b"Names".to_vec(), Object::Dict(n));
+    })?;
+    Ok(())
+}
+
+/// A source's entry in the combined outline (see [`add_outline`]): its title, its first page in the
+/// result, and its own bookmarks, read from the source when it was added.
+pub(super) struct Mark {
+    pub(super) title: String,
+    pub(super) page: ObjRef,
+    pub(super) outline: Vec<OutlineNode>,
+}
+
+/// One of a source's bookmarks, read and ready to write: its title, colour and flags, its destination
+/// in the result (`None` when the page it points at was not copied), whether it is open, and its own
+/// bookmarks.
+pub(super) struct OutlineNode {
+    title: Option<Object>,
+    colour: Option<Object>,
+    flags: Option<Object>,
+    dest: Option<Object>,
+    open: bool,
+    children: Vec<OutlineNode>,
+}
+
+/// The bookmarks of `src`, with destinations mapped through `pages` (source page to copied page). They
+/// are read while `src` is at hand, so the source itself need not be kept.
+pub(super) fn source_outline(src: &Document, pages: HashMap<ObjRef, ObjRef>) -> Vec<OutlineNode> {
+    let first = src
+        .root()
+        .and_then(|r| src.get(r).as_dict().cloned())
+        .and_then(|c| c.get(b"Outlines").map(|o| src.resolve(o)))
+        .and_then(|o| o.as_dict().and_then(|d| d.reference(b"First")));
+    let mapper = Copier::new(src, HashMap::new(), pages);
+    let mut budget = 10_000usize;
+    outline_level(&mapper, first, 0, &mut budget)
+}
+
+/// `nodes` without the bookmarks whose page was not copied (no destination left), unless a bookmark
+/// under them stays. [`outline_level`] already bounds the depth.
+pub(super) fn kept_bookmarks(nodes: Vec<OutlineNode>) -> Vec<OutlineNode> {
+    nodes
+        .into_iter()
+        .filter_map(|mut n| {
+            n.children = kept_bookmarks(n.children);
+            (n.dest.is_some() || !n.children.is_empty()).then_some(n)
+        })
+        .collect()
+}
+
+/// One level of bookmarks from `first` (its siblings), each with its children. Cycle- and size-safe:
+/// at most `budget` bookmarks are read in all, and nesting stops at 32 levels.
+fn outline_level(m: &Copier<'_>, first: Option<ObjRef>, depth: u8, budget: &mut usize) -> Vec<OutlineNode> {
+    if depth > 32 {
+        return Vec::new();
+    }
+    let mut seen = std::collections::HashSet::new();
+    let mut made = Vec::new();
+    let mut cur = first;
+    while let Some(r) = cur {
+        if !seen.insert(r) || *budget == 0 {
+            break;
+        }
+        *budget -= 1;
+        let Some(item) = m.src.get(r).as_dict().cloned() else { break };
+        cur = item.reference(b"Next");
+        let title = item.get(b"Title").map(|t| m.src.resolve(t).as_ref().clone());
+        let colour = item.get(b"C").map(|v| m.src.resolve(v).as_ref().clone());
+        let flags = item.get(b"F").map(|v| m.src.resolve(v).as_ref().clone());
+        let target = item.get(b"Dest").cloned().or_else(|| {
+            let a = m.src.resolve(item.get(b"A")?);
+            let a = a.as_dict()?;
+            (a.name(b"S") == Some(b"GoTo")).then(|| a.get(b"D").cloned()).flatten()
+        });
+        let dest = target.and_then(|t| m.map_dest(&t));
+        let open = item.int(b"Count").is_some_and(|c| c > 0);
+        let children = outline_level(m, item.reference(b"First"), depth + 1, budget);
+        made.push(OutlineNode { title, colour, flags, dest, open, children });
+    }
+    made
+}
+
+/// Write `nodes` as one level under `parent`: each bookmark is created, then its children, depth first
+/// and in order, so the object numbers come out as they always did. Returns the level's first and last
+/// item and how many items it has (`None` when it is empty).
+pub(super) fn write_outline_level(
+    dst: &mut Document,
+    parent: ObjRef,
+    nodes: &[OutlineNode],
+) -> Result<Option<(ObjRef, ObjRef, usize)>, OrganizeError> {
+    let mut made: Vec<ObjRef> = Vec::new();
+    for node in nodes {
+        let new = dst.add(Object::Null);
+        let mut d = Dict::new();
+        if let Some(t) = &node.title {
+            d.set(b"Title".to_vec(), t.clone());
+        }
+        if let Some(c) = &node.colour {
+            d.set(b"C".to_vec(), c.clone());
+        }
+        if let Some(f) = &node.flags {
+            d.set(b"F".to_vec(), f.clone());
+        }
+        if let Some(dest) = &node.dest {
+            d.set(b"Dest".to_vec(), dest.clone());
+        }
+        d.set(b"Parent".to_vec(), Object::Ref(parent));
+        if let Some(prev) = made.last() {
+            d.set(b"Prev".to_vec(), Object::Ref(*prev));
+            dst.update_dict(*prev, |p| p.set(b"Next".to_vec(), Object::Ref(new)))?;
+        }
+        if let Some((f, l, n)) = write_outline_level(dst, new, &node.children)? {
+            d.set(b"First".to_vec(), Object::Ref(f));
+            d.set(b"Last".to_vec(), Object::Ref(l));
+            // Keep the source's open/closed state.
+            d.set(b"Count".to_vec(), Object::Int(if node.open { n as i64 } else { -(n as i64) }));
+        }
+        dst.set(new, Object::Dict(d));
+        made.push(new);
+    }
+    Ok(match (made.first(), made.last()) {
+        (Some(first), Some(last)) => Some((*first, *last, made.len())),
+        _ => None,
+    })
+}
+
+/// Replace the outline with one bookmark per source (title → its first page), each holding a collapsed
+/// copy of that source's own bookmarks with destinations mapped to the copied pages.
+pub(super) fn add_outline(doc: &mut Document, marks: &[Mark]) -> Result<(), OrganizeError> {
+    if marks.is_empty() {
+        return Ok(());
+    }
+    let outlines = doc.add(Object::Null);
+    let items: Vec<ObjRef> = marks.iter().map(|_| doc.add(Object::Null)).collect();
+    let (Some(&first_item), Some(&last_item)) = (items.first(), items.last()) else { return Ok(()) };
+    for (i, (mark, r)) in marks.iter().zip(&items).enumerate() {
+        let mut d = Dict::new();
+        d.set(b"Title".to_vec(), Object::String(pdfcraft_cos::PdfString::text(&mark.title)));
+        d.set(b"Parent".to_vec(), Object::Ref(outlines));
+        d.set(b"Dest".to_vec(), Object::Array(vec![Object::Ref(mark.page), Object::name("Fit")]));
+        if i > 0 {
+            d.set(b"Prev".to_vec(), Object::Ref(items[i - 1]));
+        }
+        if let Some(next) = items.get(i + 1) {
+            d.set(b"Next".to_vec(), Object::Ref(*next));
+        }
+        if let Some((f, l, n)) = write_outline_level(doc, *r, &mark.outline)? {
+            d.set(b"First".to_vec(), Object::Ref(f));
+            d.set(b"Last".to_vec(), Object::Ref(l));
+            d.set(b"Count".to_vec(), Object::Int(-(n as i64))); // collapsed
+        }
+        doc.set(*r, Object::Dict(d));
+    }
+    let mut o = Dict::new();
+    o.set(b"Type".to_vec(), Object::name("Outlines"));
+    o.set(b"First".to_vec(), Object::Ref(first_item));
+    o.set(b"Last".to_vec(), Object::Ref(last_item));
+    o.set(b"Count".to_vec(), Object::Int(items.len() as i64));
+    doc.set(outlines, Object::Dict(o));
+    let root = doc.root().ok_or(OrganizeError::NoPageTree)?;
+    doc.update_dict(root, |c| {
+        c.set(b"Outlines".to_vec(), Object::Ref(outlines));
+        c.set(b"PageMode".to_vec(), Object::name("UseOutlines"));
+    })?;
+    Ok(())
+}
diff --git a/crates/organize/src/import/combine.rs b/crates/organize/src/import/combine.rs
new file mode 100644
index 0000000000..09a1b0725a
--- /dev/null
+++ b/crates/organize/src/import/combine.rs
@@ -0,0 +1,307 @@
+use super::carry::{Mark, add_outline, collect_attachments, kept_bookmarks, set_attachments, source_outline, write_outline_level};
+use super::*;
+
+/// A new document containing copies of `pages` from `src` (Extract Pages / Split).
+/// Document information (title, author…) is carried over, and so is the print standard the
+/// source declares (PDF/X: its output intents and identification, #263), and the bookmarks that
+/// go to the copied pages.
+pub fn extract_pages(src: &Document, pages: &[usize]) -> Result<Document, OrganizeError> {
+    let mut out = Document::new_empty();
+    // One source: nothing to deduplicate. Its fields keep their names (a source with two
+    // same-named field roots stays one field, as it was), so Extract and Split never rename.
+    let imported = import_pages_mapped(&mut out, src, pages, 0, FieldConflicts::Merge)?;
+    // The bookmarks of these pages come along, mapped to the copies (#4020).
+    let outline = kept_bookmarks(source_outline(src, imported.page_map));
+    if !outline.is_empty() {
+        let root = crate::outline::container(&mut out, &[])?;
+        if let Some((first, last, _)) = write_outline_level(&mut out, root, &outline)? {
+            out.update_dict(root, |d| {
+                d.set(b"First".to_vec(), Object::Ref(first));
+                d.set(b"Last".to_vec(), Object::Ref(last));
+            })?;
+            let top = crate::outline::children(&out, root);
+            crate::outline::relink_and_recount(&mut out, root, &top)?;
+        }
+    }
+    for key in crate::INFO_KEYS {
+        if let Some(v) = crate::info(src, key) {
+            crate::set_info(&mut out, key, &v)?;
+        }
+    }
+    // After the title: the XMP packet repeats it.
+    crate::pdfx::carry(&mut out, Some(src), &crate::pdfx::PrintStandard::of(src), imported.objects)?;
+    // The pages share their source's resource dictionary, so the part would otherwise carry every
+    // XObject the source lists — images and all (#204). Keep only what these pages draw.
+    crate::prune::prune_unused_xobjects(&mut out)?;
+    Ok(out)
+}
+
+/// How to split a document.
+#[derive(Clone, Debug, PartialEq)]
+pub enum SplitBy {
+    /// Every `n` pages.
+    PageCount(usize),
+    /// Before each of these 0-based page indices (e.g. `[3, 7]` → 0–2, 3–6, 7–end).
+    Before(Vec<usize>),
+}
+
+/// The page ranges (0-based, end-exclusive) a split produces.
+pub fn split_ranges(page_count: usize, by: &SplitBy) -> Vec<std::ops::Range<usize>> {
+    let mut cuts: Vec<usize> = match by {
+        SplitBy::PageCount(n) => (1..).map(|i| i * (*n).max(1)).take_while(|c| *c < page_count).collect(),
+        SplitBy::Before(v) => v.iter().copied().filter(|c| *c > 0 && *c < page_count).collect(),
+    };
+    cuts.sort_unstable();
+    cuts.dedup();
+    let mut ranges = Vec::new();
+    let mut start = 0;
+    for c in cuts.into_iter().chain(std::iter::once(page_count)) {
+        if c > start {
+            ranges.push(start..c);
+            start = c;
+        }
+    }
+    ranges
+}
+
+/// Split a document into several new documents.
+pub fn split(src: &Document, by: &SplitBy) -> Result<Vec<Document>, OrganizeError> {
+    let n = crate::page_count(src)?;
+    split_ranges(n, by).into_iter().map(|r| extract_pages(src, &r.collect::<Vec<_>>())).collect()
+}
+
+/// What combining produced, beyond the document: the fields renamed to keep colliding names
+/// separate (old fully-qualified name → new one), in order across all sources.
+pub struct CombineOutcome {
+    /// The combined document.
+    pub doc: Document,
+    /// Every field renamed while combining.
+    pub renamed_fields: Vec<(String, String)>,
+}
+
+/// Combine whole documents, in order, into a new document. Each source gets a top-level
+/// bookmark (its `title`) pointing to its first page, like Acrobat's Combine Files.
+/// The source's own bookmarks are nested (collapsed) under its entry, and its document-level
+/// attachments are carried over. When every source declares the same print standard (PDF/X
+/// with the same output intent), so does the result.
+pub fn combine(sources: &[(&str, &Document)]) -> Result<Document, OrganizeError> {
+    combine_with(sources, FieldConflicts::Rename).map(|o| o.doc)
+}
+
+/// [`combine`] reporting what the conflict resolution renamed.
+pub fn combine_with(sources: &[(&str, &Document)], conflicts: FieldConflicts) -> Result<CombineOutcome, OrganizeError> {
+    let all: Vec<(&str, &Document, Option<&[usize]>)> = sources.iter().map(|(t, d)| (*t, *d, None)).collect();
+    combine_selected_with(&all, conflicts)
+}
+
+/// Combine Files with chosen pages: each source contributes `pages` (0-based, in that order;
+/// `None` for all of them). Bookmarks that point at pages left out lose their destination.
+pub fn combine_selected(sources: &[(&str, &Document, Option<&[usize]>)]) -> Result<Document, OrganizeError> {
+    combine_selected_with(sources, FieldConflicts::Rename).map(|o| o.doc)
+}
+
+/// [`combine_selected`] reporting what the conflict resolution renamed.
+pub fn combine_selected_with(sources: &[(&str, &Document, Option<&[usize]>)], conflicts: FieldConflicts) -> Result<CombineOutcome, OrganizeError> {
+    let mut combiner = Combiner::with_field_conflicts(conflicts);
+    for (title, src, chosen) in sources {
+        combiner.add(title, src, *chosen)?;
+    }
+    combiner.finish_with_renames()
+}
+
+/// Combine Files one source at a time, with the same result as [`combine_selected`]. [`Combiner::add`]
+/// copies a source's pages into the result and keeps only what the rest of the combine needs: its
+/// bookmarks (read and mapped to the copied pages), its attachments (copied), and its document only
+/// when it declares output intents. So each source can be dropped as soon as it is added, and a long
+/// list holds one source at a time rather than all of them.
+pub struct Combiner {
+    out: Document,
+    marks: Vec<Mark>,
+    attachments: Vec<(Vec<u8>, Object)>,
+    /// The first source's print standard, and what its pages brought along.
+    standard: Option<Standard>,
+    /// Whether every source so far declares the first source's print standard.
+    agreed: bool,
+    /// How colliding field names are resolved as each source is added.
+    field_conflicts: FieldConflicts,
+    /// What adding sources renamed (old → new fully-qualified field name), in order.
+    renamed_fields: Vec<(String, String)>,
+}
+
+/// The first source's print standard (see [`Combiner`]).
+struct Standard {
+    declared: crate::pdfx::PrintStandard,
+    /// The source objects the copied pages brought along, and their copies.
+    objects: HashMap<ObjRef, ObjRef>,
+    /// The source itself, kept only for its output intents, which are copied from it.
+    source: Option<Document>,
+}
+
+impl Default for Combiner {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Combiner {
+    /// A combine with no sources yet, renaming colliding field names as sources are added.
+    pub fn new() -> Self {
+        Self::with_field_conflicts(FieldConflicts::Rename)
+    }
+
+    /// [`Combiner::new`] resolving colliding field names as `conflicts` says.
+    pub fn with_field_conflicts(field_conflicts: FieldConflicts) -> Self {
+        Self {
+            out: Document::new_empty(),
+            marks: Vec::new(),
+            attachments: Vec::new(),
+            standard: None,
+            agreed: true,
+            field_conflicts,
+            renamed_fields: Vec::new(),
+        }
+    }
+
+    /// What adding sources has renamed so far (old → new fully-qualified field name).
+    pub fn renamed_fields(&self) -> &[(String, String)] {
+        &self.renamed_fields
+    }
+
+    /// Add `src`'s `pages` (0-based, in that order; `None` for all of them) after the pages added so far,
+    /// under a bookmark titled `title`. `src` need not outlive the call.
+    pub fn add(&mut self, title: &str, src: &Document, pages: Option<&[usize]>) -> Result<(), OrganizeError> {
+        let n = crate::page_count(src)?;
+        let pages: Vec<usize> = match pages {
+            Some(p) => {
+                if let Some(bad) = p.iter().find(|i| **i >= n) {
+                    return Err(OrganizeError::NoSuchPage(*bad));
+                }
+                p.to_vec()
+            }
+            None => (0..n).collect(),
+        };
+        let at = crate::page_count(&self.out)?;
+        let imported = import_pages_mapped(&mut self.out, src, &pages, at, self.field_conflicts)?;
+        self.renamed_fields.extend(imported.renamed_fields);
+        if let Some(first) = imported.pages.first() {
+            let outline = source_outline(src, imported.page_map);
+            self.marks.push(Mark { title: title.to_string(), page: *first, outline });
+        }
+        collect_attachments(&mut self.out, src, &mut self.attachments)?;
+        let declared = crate::pdfx::PrintStandard::of(src);
+        match self.standard.as_ref().map(|first| first.declared.same_as(&declared)) {
+            Some(same) => self.agreed &= same,
+            None => {
+                let source = declared.declares_output_intents().then(|| src.clone());
+                self.standard = Some(Standard { declared, objects: imported.objects, source });
+            }
+        }
+        Ok(())
+    }
+
+    /// The combined document: the pages as added, the print standard of the first source when every
+    /// source declares the same one, shared resources stored once, then the bookmarks and attachments.
+    pub fn finish(self) -> Result<Document, OrganizeError> {
+        self.finish_with_renames().map(|o| o.doc)
+    }
+
+    /// [`Combiner::finish`] reporting what the combine renamed.
+    pub fn finish_with_renames(self) -> Result<CombineOutcome, OrganizeError> {
+        let Combiner { mut out, marks, attachments, standard, agreed, renamed_fields, .. } = self;
+        if let Some(first) = standard.filter(|_| agreed) {
+            crate::pdfx::carry(&mut out, first.source.as_ref(), &first.declared, first.objects)?;
+        }
+        // Sources often share fonts, images and profiles (or are the same file): store them once.
+        let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
+        crate::dedupe::dedupe_resources(&mut out, &all, false);
+        add_outline(&mut out, &marks)?;
+        set_attachments(&mut out, attachments)?;
+        Ok(CombineOutcome { doc: out, renamed_fields })
+    }
+}
+
+/// One run of pages for [`combine_grouped`]: the file it comes from (`group`: runs with the same
+/// group are one file split around, and give the same document), its title, the document, and
+/// its pages (0-based, in that order; `None` for all of them).
+pub type Run<'a> = (usize, &'a str, &'a Document, Option<&'a [usize]>);
+
+/// Combine Files where a file's pages may be split into several runs with other files' pages
+/// between them. Each file (group) is copied once, all its pages together, then the pages are put
+/// in the runs' order: its links between its own pages, its form fields and its attachments stay
+/// whole, and it gets one top-level bookmark (the title of its first run) at its first page, its
+/// own bookmarks nested. Otherwise as [`combine_selected`] (print standard, shared resources).
+pub fn combine_grouped(runs: &[Run<'_>]) -> Result<Document, OrganizeError> {
+    combine_grouped_with(runs, FieldConflicts::Rename).map(|o| o.doc)
+}
+
+/// [`combine_grouped`] reporting what the conflict resolution renamed.
+pub fn combine_grouped_with(runs: &[Run<'_>], conflicts: FieldConflicts) -> Result<CombineOutcome, OrganizeError> {
+    // Each file's pages, in the order its runs list them, and each run's place in that list.
+    struct File<'a> {
+        title: &'a str,
+        src: &'a Document,
+        pages: Vec<usize>,
+    }
+    let mut files: Vec<(usize, File<'_>)> = Vec::new();
+    let mut slices: Vec<(usize, usize, usize)> = Vec::with_capacity(runs.len());
+    for (group, title, src, chosen) in runs {
+        let at = match files.iter().position(|(g, _)| g == group) {
+            Some(at) => at,
+            None => {
+                files.push((*group, File { title, src, pages: Vec::new() }));
+                files.len() - 1
+            }
+        };
+        let Some((_, file)) = files.get_mut(at) else { continue };
+        let n = crate::page_count(file.src)?;
+        let pages: Vec<usize> = match chosen {
+            Some(p) => {
+                if let Some(bad) = p.iter().find(|i| **i >= n) {
+                    return Err(OrganizeError::NoSuchPage(*bad));
+                }
+                p.to_vec()
+            }
+            None => (0..n).collect(),
+        };
+        slices.push((at, file.pages.len(), pages.len()));
+        file.pages.extend(pages);
+    }
+    let mut out = Document::new_empty();
+    let mut marks = Vec::new();
+    let mut attachments = Vec::new();
+    let mut copies: Vec<Vec<ObjRef>> = Vec::with_capacity(files.len());
+    let mut renamed_fields = Vec::new();
+    let mut standard: Option<(crate::pdfx::PrintStandard, &Document, HashMap<ObjRef, ObjRef>)> = None;
+    let mut agreed = true;
+    for (_, file) in &files {
+        let at = crate::page_count(&out)?;
+        let imported = import_pages_mapped(&mut out, file.src, &file.pages, at, conflicts)?;
+        copies.push(imported.pages.clone());
+        renamed_fields.extend(imported.renamed_fields);
+        if let Some(first) = imported.pages.first() {
+            marks.push(Mark { title: file.title.to_string(), page: *first, outline: source_outline(file.src, imported.page_map) });
+        }
+        collect_attachments(&mut out, file.src, &mut attachments)?;
+        let declared = crate::pdfx::PrintStandard::of(file.src);
+        match &standard {
+            None => standard = Some((declared, file.src, imported.objects)),
+            Some((first, _, _)) => agreed &= first.same_as(&declared),
+        }
+    }
+    // The pages in the runs' order. A file's first run comes before its others, and its pages
+    // were copied in run order, so its bookmark (its first copied page) is its first page shown.
+    let mut order: Vec<(ObjRef, Dict)> = Vec::new();
+    for (file, start, len) in slices {
+        let run = copies.get(file).and_then(|c| c.get(start..start.saturating_add(len))).unwrap_or_default();
+        order.extend(run.iter().map(|r| (*r, Dict::new())));
+    }
+    rebuild(&mut out, &order)?;
+    if let Some((declared, src, objects)) = standard.filter(|_| agreed) {
+        crate::pdfx::carry(&mut out, Some(src), &declared, objects)?;
+    }
+    let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
+    crate::dedupe::dedupe_resources(&mut out, &all, false);
+    add_outline(&mut out, &marks)?;
+    set_attachments(&mut out, attachments)?;
+    Ok(CombineOutcome { doc: out, renamed_fields })
+}
diff --git a/crates/organize/src/import/copy.rs b/crates/organize/src/import/copy.rs
new file mode 100644
index 0000000000..f78411806f
--- /dev/null
+++ b/crates/organize/src/import/copy.rs
@@ -0,0 +1,220 @@
+use super::*;
+
+/// Keys that must not be followed when copying: they point back up or across the source
+/// document, and following them would drag in unrelated objects.
+pub(super) const SKIP_ON_PAGE: &[&[u8]] = &[b"Parent", b"B", b"StructParents", b"Thumb", b"PieceInfo"];
+
+const SKIP_ON_ANNOT: &[&[u8]] = &[b"StructParent", b"P"];
+
+/// How deep a copy follows references and nested arrays and dictionaries, counted together.
+/// Real documents stay well under this (a page's resources, fonts and descriptors, nested
+/// form XObjects and field trees are a few levels each); a chain of thousands of indirect
+/// objects, each shallow enough for the parser, would otherwise exhaust the stack (#1800).
+const MAX_COPY_DEPTH: usize = 256;
+
+/// Keys that stay on the widget when a combined field/widget is split (#1810): the annotation's
+/// appearance, placement and page. Field state (name, value, flags, default appearance) moves to
+/// the new parent field, where the widgets inherit it.
+pub(super) const WIDGET_KEYS: &[&[u8]] = &[
+    b"Type",
+    b"Subtype",
+    b"Rect",
+    b"P",
+    b"AP",
+    b"AS",
+    b"MK",
+    b"BS",
+    b"Border",
+    b"C",
+    b"CA",
+    b"F",
+    b"H",
+    b"R",
+    b"NM",
+    b"M",
+    b"StructParent",
+    b"StructParents",
+    b"OC",
+    b"Tabs",
+    b"A",
+    b"Contents",
+    b"BM",
+    b"Lang",
+    b"AF",
+];
+
+pub(super) struct Copier<'a> {
+    pub(super) src: &'a Document,
+    /// Current recursion depth, bounded by [`MAX_COPY_DEPTH`].
+    depth: usize,
+    pub(super) map: HashMap<ObjRef, ObjRef>,
+    /// Source page → destination page, for rewriting `/P` and destinations.
+    pub(super) pages: HashMap<ObjRef, ObjRef>,
+    /// Destination objects that are annotation dictionaries (fixed up after copying).
+    pub(super) annots: Vec<ObjRef>,
+    /// Top-level form fields reached through widgets.
+    pub(super) fields: Vec<ObjRef>,
+    /// Optional content groups copied: (source, destination).
+    pub(super) ocgs: Vec<(ObjRef, ObjRef)>,
+}
+
+impl<'a> Copier<'a> {
+    pub(super) fn new(src: &'a Document, map: HashMap<ObjRef, ObjRef>, pages: HashMap<ObjRef, ObjRef>) -> Self {
+        Copier { src, depth: 0, map, pages, annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() }
+    }
+
+    /// Copy an indirect object (once), returning its destination reference.
+    pub(super) fn copy_ref(&mut self, dst: &mut Document, r: ObjRef) -> Result<ObjRef, OrganizeError> {
+        if let Some(d) = self.map.get(&r) {
+            return Ok(*d);
+        }
+        // Reserve the number first so cycles (field ↔ widget) terminate.
+        let new = dst.add(Object::Null);
+        self.map.insert(r, new);
+        let obj = self.src.get(r);
+        if obj.as_dict().is_some_and(|d| d.name(b"Type") == Some(b"OCG")) {
+            self.ocgs.push((r, new));
+        }
+        let copied = self.copy_value(dst, &obj, Some(new))?;
+        dst.set(new, copied);
+        Ok(new)
+    }
+
+    /// One level deeper into the object graph, or the refusal when there are too many.
+    fn descend(&mut self) -> Result<(), OrganizeError> {
+        if self.depth >= MAX_COPY_DEPTH {
+            return Err(OrganizeError::Invalid(format!("the pages refer to objects nested more than {MAX_COPY_DEPTH} levels deep")));
+        }
+        self.depth += 1;
+        Ok(())
+    }
+
+    pub(super) fn copy_value(&mut self, dst: &mut Document, o: &Object, this: Option<ObjRef>) -> Result<Object, OrganizeError> {
+        if !matches!(o, Object::Ref(_) | Object::Array(_) | Object::Dict(_) | Object::Stream(_)) {
+            return Ok(o.clone());
+        }
+        self.descend()?;
+        let copied = match o {
+            Object::Ref(r) => self.copy_ref(dst, *r).map(Object::Ref),
+            Object::Array(a) => a.iter().map(|x| self.copy_value(dst, x, None)).collect::<Result<Vec<_>, _>>().map(Object::Array),
+            Object::Dict(d) => self.copy_dict(dst, d, this).map(Object::Dict),
+            Object::Stream(s) => self.copy_dict(dst, &s.dict, None).map(|dict| {
+                let mut s = s.clone();
+                s.dict = dict;
+                Object::Stream(s)
+            }),
+            other => Ok(other.clone()),
+        };
+        self.depth = self.depth.saturating_sub(1);
+        copied
+    }
+
+    fn copy_dict(&mut self, dst: &mut Document, d: &Dict, this: Option<ObjRef>) -> Result<Dict, OrganizeError> {
+        let is_annot = d.name(b"Type") == Some(b"Annot") || (d.contains(b"Subtype") && d.contains(b"Rect") && !d.contains(b"Type"));
+        let is_field = d.contains(b"FT") || (d.contains(b"T") && d.contains(b"Kids"));
+        let mut out = Dict::new();
+        for (k, v) in d.iter() {
+            if is_annot && SKIP_ON_ANNOT.contains(&k.as_slice()) {
+                continue;
+            }
+            // Destinations are rewritten afterwards (they may target pages copied later).
+            if is_annot && (k.as_slice() == b"Dest" || k.as_slice() == b"A") {
+                out.set(k.clone(), v.clone());
+                continue;
+            }
+            out.set(k.clone(), self.copy_value(dst, v, None)?);
+        }
+        if let Some(this) = this {
+            if is_annot {
+                self.annots.push(this);
+            }
+            // A field (or widget) without a parent is a top-level field.
+            if is_field && !d.contains(b"Parent") {
+                self.fields.push(this);
+            }
+        }
+        Ok(out)
+    }
+
+    /// Map a source destination (explicit array or reference to one) to the destination
+    /// document; `None` if it targets a page that was not copied.
+    pub(super) fn map_dest(&self, dest: &Object) -> Option<Object> {
+        self.map_dest_depth(dest, 0)
+    }
+
+    fn map_dest_depth(&self, dest: &Object, depth: u8) -> Option<Object> {
+        if depth > 4 {
+            return None;
+        }
+        match dest {
+            Object::Name(n) => self.map_dest_depth(&named_dest(self.src, n)?, depth + 1),
+            Object::String(s) => self.map_dest_depth(&named_dest(self.src, &s.bytes)?, depth + 1),
+            Object::Ref(_) => self.map_dest_depth(&self.src.resolve(dest), depth + 1),
+            Object::Dict(d) => self.map_dest_depth(d.get(b"D")?, depth + 1),
+            Object::Array(a) => {
+                let page = a.first()?.as_ref()?;
+                let new_page = *self.pages.get(&page)?;
+                let mut a = a.clone();
+                a[0] = Object::Ref(new_page);
+                Some(Object::Array(a))
+            }
+            _ => None,
+        }
+    }
+
+    /// Rewrite `/P`, `/Dest` and GoTo actions on copied annotations.
+    pub(super) fn fix_annotations(&mut self, dst: &mut Document, annot_pages: &HashMap<ObjRef, ObjRef>) -> Result<(), OrganizeError> {
+        for &a in &std::mem::take(&mut self.annots) {
+            let src_dict = dst.get(a).as_dict().cloned();
+            let Some(d) = src_dict else { continue };
+            let mut d = d;
+            if let Some(p) = annot_pages.get(&a) {
+                d.set(b"P".to_vec(), Object::Ref(*p));
+            }
+            if let Some(dest) = d.get(b"Dest").cloned() {
+                let resolved = self.src.resolve(&dest);
+                match self.map_dest(&resolved) {
+                    Some(nd) => d.set(b"Dest".to_vec(), nd),
+                    None => {
+                        d.remove(b"Dest");
+                    }
+                }
+            }
+            if let Some(action) = d.get(b"A").cloned() {
+                let action = self.src.resolve(&action);
+                if let Some(ad) = action.as_dict() {
+                    if ad.name(b"S") == Some(b"GoTo") {
+                        let target = ad.get(b"D").map(|x| self.src.resolve(x));
+                        match target.and_then(|t| self.map_dest(&t)) {
+                            Some(nd) => {
+                                let mut na = Dict::new();
+                                na.set(b"S".to_vec(), Object::name("GoTo"));
+                                na.set(b"D".to_vec(), nd);
+                                d.set(b"A".to_vec(), Object::Dict(na));
+                            }
+                            None => {
+                                d.remove(b"A");
+                            }
+                        }
+                    } else {
+                        // Other actions (URI, Launch, JavaScript…) carry no page references. The
+                        // copier lends its map out and takes it back with the new copies in it,
+                        // so actions sharing an object share its one copy.
+                        let mut c = Copier::new(self.src, std::mem::take(&mut self.map), HashMap::new());
+                        let copied = c.copy_value(dst, &Object::Dict(ad.clone()), None);
+                        self.map = c.map;
+                        d.set(b"A".to_vec(), copied?);
+                    }
+                }
+            }
+            dst.set(a, Object::Dict(d));
+        }
+        Ok(())
+    }
+}
+
+/// Copy `o` from `src` into `dst`, reusing the copies listed in `map` (source → destination), so
+/// an object the copied pages already brought along (an ICC profile) is not stored twice.
+pub(crate) fn copy_object(dst: &mut Document, src: &Document, o: &Object, map: HashMap<ObjRef, ObjRef>) -> Result<Object, OrganizeError> {
+    Copier::new(src, map, HashMap::new()).copy_value(dst, o, None)
+}
diff --git a/crates/organize/src/import/fields.rs b/crates/organize/src/import/fields.rs
new file mode 100644
index 0000000000..98f69c69ec
--- /dev/null
+++ b/crates/organize/src/import/fields.rs
@@ -0,0 +1,297 @@
+use super::copy::WIDGET_KEYS;
+use super::*;
+
+/// Rename the top-level fields about to be registered in `dst` whose fully-qualified names
+/// (`parent.T.child`) are already taken, so each imported field stays its own field instead of
+/// blurring into the destination's field of the same name (fields of one fully-qualified name
+/// are one field). A colliding node's own `/T` becomes the first free `Name-1`, `Name-2`…
+/// variant, so everything below it keeps its place in the tree. Returns what was renamed
+/// (old fully-qualified name → new one), in order.
+pub(super) fn resolve_field_conflicts(dst: &mut Document, fields: &[ObjRef]) -> Result<Vec<(String, String)>, OrganizeError> {
+    let mut taken = taken_field_names(dst)?;
+    let planned = plan_renames(dst, fields, &mut taken);
+    let mut renamed = Vec::new();
+    for (node, new_t, old, new) in planned {
+        dst.update_dict(node, |d| d.set(b"T".to_vec(), Object::String(pdfcraft_cos::PdfString::text(&new_t))))?;
+        renamed.push((old, new));
+    }
+    Ok(renamed)
+}
+
+/// What importing `src` into `dst` would rename, computed without changing either document:
+/// each fully-qualified name of `src`'s fields that `dst` already uses (or that an earlier
+/// field of `src` itself uses) is renamed to the first free variant, exactly as the import
+/// would. Unreadable structure previews as nothing: the import itself will say why it failed.
+pub fn field_name_conflicts(dst: &Document, src: &Document) -> Vec<(String, String)> {
+    let Ok(mut taken) = taken_field_names(dst) else { return Vec::new() };
+    let Ok(roots) = field_roots(src) else { return Vec::new() };
+    plan_renames(src, &roots, &mut taken).into_iter().map(|(_, _, old, new)| (old, new)).collect()
+}
+
+/// What combining `sources`, in order, would rename in each one: the whole list is simulated
+/// with the same first-free-variant rule the combine uses, so a later file's preview sees the
+/// earlier files' renames. Unreadable structure previews as nothing (the combine itself will
+/// say why it fails); non-colliding names still count as taken for the files after them.
+pub fn combine_field_conflicts(sources: &[&Document]) -> Vec<Vec<(String, String)>> {
+    let mut taken = std::collections::HashSet::new();
+    sources
+        .iter()
+        .map(|src| match field_roots(src) {
+            Ok(roots) => plan_renames(src, &roots, &mut taken).into_iter().map(|(_, _, old, new)| (old, new)).collect(),
+            Err(_) => Vec::new(),
+        })
+        .collect()
+}
+
+/// Walk field trees `roots` in `doc` and plan the renames that would keep every name separate
+/// from `taken`: each node's fully-qualified name joins `taken` (so a later field of the same
+/// import collides with an earlier one), and a node already taken is renamed to the first free
+/// variant of its own `/T`. Names are compared and renamed as decoded text, not as stored
+/// bytes, so one name written in two encodings (PDFDocEncoding, UTF-16BE) is one name.
+/// Read-only: returns (node, new `/T`, old name, new name). Cycle- and depth-safe.
+fn plan_renames(doc: &Document, roots: &[ObjRef], taken: &mut std::collections::HashSet<String>) -> Vec<(ObjRef, String, String, String)> {
+    let mut planned = Vec::new();
+    let mut walk = RenameWalk::default();
+    for &root in roots {
+        plan_renames_under(doc, root, "", taken, &mut walk, 0, &mut planned);
+    }
+    planned
+}
+
+/// What one [`plan_renames`] call remembers: the nodes it visited, and for each colliding name
+/// the suffix to try next.
+#[derive(Default)]
+struct RenameWalk {
+    seen: HashSet<ObjRef>,
+    next: HashMap<String, u32>,
+}
+
+/// One node of [`plan_renames`].
+fn plan_renames_under(
+    doc: &Document,
+    node: ObjRef,
+    prefix: &str,
+    taken: &mut std::collections::HashSet<String>,
+    walk: &mut RenameWalk,
+    depth: u8,
+    planned: &mut Vec<(ObjRef, String, String, String)>,
+) {
+    if depth > 32 || !walk.seen.insert(node) {
+        return;
+    }
+    let Some(d) = doc.get(node).as_dict().cloned() else { return };
+    let mut name = d.get(b"T").and_then(|t| doc.resolve(t).as_string().map(|s| s.to_text())).unwrap_or_default();
+    if !name.is_empty() {
+        let fqn = qualified(prefix, &name);
+        if taken.contains(&fqn) {
+            // `taken` only grows, so every suffix below the last one handed out for this name is
+            // still taken: resume there instead of at 1.
+            let mut n = walk.next.get(&fqn).copied().unwrap_or(1);
+            let mut variant;
+            while {
+                #[cfg(test)]
+                crate::work(1);
+                variant = format!("{name}-{n}");
+                taken.contains(&qualified(prefix, &variant))
+            } {
+                n = n.saturating_add(1);
+            }
+            walk.next.insert(fqn.clone(), n.saturating_add(1));
+            let new_fqn = qualified(prefix, &variant);
+            planned.push((node, variant.clone(), fqn, new_fqn.clone()));
+            taken.insert(new_fqn);
+            name = variant;
+        } else {
+            taken.insert(fqn);
+        }
+    }
+    let prefix = qualified_optional(prefix, &name);
+    let kids = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+    for kid in kids.iter().filter_map(|k| k.as_ref()) {
+        plan_renames_under(doc, kid, &prefix, taken, walk, depth + 1, planned);
+    }
+}
+
+/// The field names in use in `dst`: every name in its form, and every name hanging only off a
+/// page's widgets — a field the form never lists still owns its name.
+fn taken_field_names(dst: &Document) -> Result<std::collections::HashSet<String>, OrganizeError> {
+    let mut taken = std::collections::HashSet::new();
+    let mut seen = std::collections::HashSet::new();
+    for root in field_roots(dst)? {
+        collect_names(dst, root, "", &mut seen, 0, &mut taken);
+    }
+    Ok(taken)
+}
+
+/// A document's field trees, wherever they are rooted: the `/AcroForm /Fields` entries, and
+/// the fields behind widgets on pages (climbed to their root, for forms that never registered
+/// them).
+fn field_roots(doc: &Document) -> Result<Vec<ObjRef>, OrganizeError> {
+    let mut roots: Vec<ObjRef> = doc
+        .root()
+        .and_then(|r| doc.get(r).as_dict().cloned())
+        .and_then(|c| c.get(b"AcroForm").map(|f| doc.resolve(f)))
+        .and_then(|f| f.as_dict().cloned())
+        .and_then(|f| f.get(b"Fields").map(|l| doc.resolve(l)))
+        .and_then(|l| l.as_array().cloned())
+        .unwrap_or_default()
+        .iter()
+        .filter_map(|f| f.as_ref())
+        .collect();
+    for (page, _) in walk(doc)? {
+        let Some(d) = doc.get(page).as_dict().cloned() else { continue };
+        let annots = d.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default();
+        for a in annots.iter() {
+            let Some(w) = doc.resolve(a).as_dict().cloned() else { continue };
+            if w.name(b"Subtype") != Some(b"Widget") {
+                continue;
+            }
+            // Walk up to the field the widget belongs to, however deep it sits; a widget that
+            // is its own field is its own root.
+            let Some(mut root) = a.as_ref() else { continue };
+            let mut up = 0;
+            while let Some(parent) = doc.get(root).as_dict().and_then(|p| p.reference(b"Parent")) {
+                if up >= 32 || root == parent {
+                    break;
+                }
+                root = parent;
+                up += 1;
+            }
+            roots.push(root);
+        }
+    }
+    Ok(roots)
+}
+
+/// Record the fully-qualified names of one field tree. Cycle- and depth-safe.
+fn collect_names(
+    dst: &Document,
+    node: ObjRef,
+    prefix: &str,
+    seen: &mut std::collections::HashSet<ObjRef>,
+    depth: u8,
+    out: &mut std::collections::HashSet<String>,
+) {
+    if depth > 32 || !seen.insert(node) {
+        return;
+    }
+    let Some(d) = dst.get(node).as_dict().cloned() else { return };
+    let name = d.get(b"T").and_then(|t| dst.resolve(t).as_string().map(|s| s.to_text())).unwrap_or_default();
+    let prefix = qualified_optional(prefix, &name);
+    if !name.is_empty() {
+        out.insert(prefix.clone());
+    }
+    let kids = d.get(b"Kids").map(|k| dst.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+    for kid in kids.iter().filter_map(|k| k.as_ref()) {
+        collect_names(dst, kid, &prefix, seen, depth + 1, out);
+    }
+}
+
+/// `prefix.name`, or `name` at the top level.
+fn qualified(prefix: &str, name: &str) -> String {
+    if prefix.is_empty() { name.to_string() } else { format!("{prefix}.{name}") }
+}
+
+/// The prefix a node's children hang under: its own name, when it has one.
+fn qualified_optional(prefix: &str, name: &str) -> String {
+    if name.is_empty() { prefix.to_string() } else { qualified(prefix, name) }
+}
+
+/// Add `kid` to `field`'s `/Kids`, in the array object itself when `/Kids` is one, so the field
+/// keeps its other widgets.
+pub(super) fn add_kid(dst: &mut Document, field: ObjRef, kid: ObjRef) -> Result<(), OrganizeError> {
+    match dst.get(field).as_dict().and_then(|f| f.get(b"Kids").cloned()) {
+        Some(Object::Ref(list)) => {
+            let mut kids = dst.get(list).as_array().cloned().unwrap_or_default();
+            kids.push(Object::Ref(kid));
+            dst.set(list, Object::Array(kids));
+        }
+        _ => dst.update_dict(field, |f| {
+            let mut kids = f.get(b"Kids").and_then(|k| k.as_array()).cloned().unwrap_or_default();
+            kids.push(Object::Ref(kid));
+            f.set(b"Kids".to_vec(), Object::Array(kids));
+        })?,
+    }
+    Ok(())
+}
+
+/// PdfCraft patch (#1810): split a widget that doubles as its own field into a parent field
+/// holding the field keys (name, value, flags…) and a widget child holding the annotation keys
+/// (rectangle, appearance, page). The parent takes the widget's place among the top-level fields;
+/// later copies of the page add widget children of it, so every page has its own widget and the
+/// field stays one.
+pub(super) fn split_own_field(dst: &mut Document, fields: &mut [ObjRef], widget: ObjRef) {
+    let Some(d) = dst.get(widget).as_dict().cloned() else { return };
+    let (mut field, mut child) = field_and_widget(dst, &d);
+    let parent = dst.add(Object::Null);
+    field.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(widget)]));
+    child.set(b"Parent".to_vec(), Object::Ref(parent));
+    dst.set(parent, Object::Dict(field));
+    dst.set(widget, Object::Dict(child));
+    if let Some(entry) = fields.iter_mut().find(|f| **f == widget) {
+        *entry = parent;
+    }
+}
+
+/// A combined field/widget has two additional-action namespaces (ISO 32000-1 tables 194/196).
+/// Partition them as well as the ordinary entries, including when copying a later widget.
+pub(super) fn field_and_widget(doc: &Document, d: &Dict) -> (Dict, Dict) {
+    let (mut field, mut child) = (Dict::new(), Dict::new());
+    for (k, v) in d.iter() {
+        if k.as_slice() == b"AA"
+            && let Some(actions) = doc.resolve(v).as_dict().cloned()
+        {
+            let (mut field_actions, mut widget_actions) = (Dict::new(), Dict::new());
+            for (trigger, action) in actions.iter() {
+                if [b"E".as_slice(), b"X", b"D", b"U", b"Fo", b"Bl", b"PO", b"PC", b"PV", b"PI"].contains(&trigger.as_slice()) {
+                    widget_actions.set(trigger.clone(), action.clone());
+                } else {
+                    field_actions.set(trigger.clone(), action.clone());
+                }
+            }
+            if field_actions.iter().next().is_some() {
+                field.set(k.clone(), Object::Dict(field_actions));
+            }
+            if widget_actions.iter().next().is_some() {
+                child.set(k.clone(), Object::Dict(widget_actions));
+            }
+        } else if WIDGET_KEYS.contains(&k.as_slice()) {
+            child.set(k.clone(), v.clone());
+        } else {
+            field.set(k.clone(), v.clone());
+        }
+    }
+    (field, child)
+}
+
+/// Add top-level fields to the destination's `/AcroForm /Fields` (creating the form if needed).
+pub(super) fn register_fields(dst: &mut Document, fields: &[ObjRef]) -> Result<(), OrganizeError> {
+    if fields.is_empty() {
+        return Ok(());
+    }
+    let root = dst.root().ok_or(OrganizeError::NoPageTree)?;
+    let catalog = dst.get(root).as_dict().cloned().ok_or(OrganizeError::NoPageTree)?;
+    let (form_ref, mut form) = match catalog.get(b"AcroForm") {
+        Some(Object::Ref(r)) => (Some(*r), dst.get(*r).as_dict().cloned().unwrap_or_default()),
+        Some(Object::Dict(d)) => (None, d.clone()),
+        _ => (None, Dict::new()),
+    };
+    let mut list = form.get(b"Fields").map(|f| dst.resolve(f)).and_then(|f| f.as_array().cloned()).unwrap_or_default();
+    let mut listed: HashSet<ObjRef> = list.iter().filter_map(Object::as_ref).collect();
+    for f in fields {
+        #[cfg(test)]
+        crate::work(1);
+        if listed.insert(*f) {
+            list.push(Object::Ref(*f));
+        }
+    }
+    form.set(b"Fields".to_vec(), Object::Array(list));
+    match form_ref {
+        Some(r) => dst.set(r, Object::Dict(form)),
+        None => {
+            let r = dst.add(form);
+            dst.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Ref(r)))?;
+        }
+    }
+    Ok(())
+}
diff --git a/crates/organize/src/lib.rs b/crates/organize/src/lib.rs
index 9f8cc5c457..e24056a9c3 100644
--- a/crates/organize/src/lib.rs
+++ b/crates/organize/src/lib.rs
@@ -672,6 +672,11 @@ pub fn info(doc: &Document, key: &str) -> Option<String> {
     in_info.filter(|v| !v.trim_matches('\0').trim().is_empty()).or_else(|| xmp::info_value(doc, key))
 }
 
+/// Whether the document information has an entry `key`, of any type.
+pub fn has_info(doc: &Document, key: &str) -> bool {
+    doc.trailer().get(b"Info").map(|o| doc.resolve(o)).is_some_and(|info| info.as_dict().is_some_and(|d| d.get(key.as_bytes()).is_some()))
+}
+
 /// Set (or clear, with an empty value) a document-information entry.
 ///
 /// Documents with XMP metadata also carry Title, Author, Subject, Keywords, Creator and Producer
@@ -699,12 +704,18 @@ fn set_info_entry(doc: &mut Document, key: &[u8], entry: Option<Object>) -> Resu
             })?;
         }
         _ => {
-            let Some(v) = entry else { return Ok(()) };
             let mut d = match doc.trailer().get(b"Info") {
                 Some(Object::Dict(d)) => d.clone(),
                 _ => Dict::new(),
             };
-            d.set(key.to_vec(), v);
+            match entry {
+                Some(v) => d.set(key.to_vec(), v),
+                None => {
+                    if d.remove(key).is_none() {
+                        return Ok(());
+                    }
+                }
+            }
             let r = doc.add(d);
             doc.trailer_mut().set(b"Info".to_vec(), Object::Ref(r));
         }
diff --git a/crates/organize/src/outline.rs b/crates/organize/src/outline.rs
index 4bcfe93ae3..2bb4122d2f 100644
--- a/crates/organize/src/outline.rs
+++ b/crates/organize/src/outline.rs
@@ -265,6 +265,15 @@ fn explicit_dest(doc: &Document, targets: &mut Targets, dest: &Object, depth: u8
     }
 }
 
+/// The explicit destination array `dest` stands for: itself, a dictionary whose `/D` is one, or a
+/// named destination (a name or string, ISO 32000-2 §12.3.2.4) looked up in the `/Names /Dests`
+/// tree, then the catalog `/Dests`. `None` when a name names nothing.
+pub(crate) fn resolve_dest(doc: &Document, dest: &Object) -> Option<Vec<Object>> {
+    // Names only: the page map is not needed to look one up.
+    let mut targets = Targets { pages: HashMap::new(), names: None };
+    explicit_dest(doc, &mut targets, dest, 0)
+}
+
 /// The page index an explicit destination array names.
 fn page_of_explicit(targets: &Targets, dest: &[Object]) -> Option<usize> {
     match dest.first()? {
@@ -553,10 +562,7 @@ pub fn add_bookmark_at(
     let at = index.min(kids.len());
     kids.insert(at, item);
     relink(doc, parent, &kids)?;
-    // Show the new bookmark: open its parent (the root is always open).
-    if !parent_path.is_empty() && doc.get(parent).as_dict().and_then(|d| d.int(b"Count")).is_none_or(|c| c <= 0) {
-        put(doc, parent, b"Count", Some(Object::Int(1)))?;
-    }
+    show_children(doc, parent, parent_path)?;
     recount(doc)?;
     let mut path = parent_path.to_vec();
     path.push(at);
@@ -699,11 +705,23 @@ pub fn move_bookmark(doc: &mut Document, from: &[usize], to_parent: &[usize], in
     let at = index.min(kids.len());
     kids.insert(at, r);
     relink(doc, parent, &kids)?;
+    if parent != old_parent {
+        show_children(doc, parent, &to_parent)?;
+    }
     recount(doc)?;
     to_parent.push(at);
     Ok(to_parent)
 }
 
+/// Open `parent` so a bookmark just added or moved into it shows (the root is always open).
+/// Only the sign of `/Count` matters here: [`recount`] sets its value.
+fn show_children(doc: &mut Document, parent: ObjRef, parent_path: &[usize]) -> Result<()> {
+    if !parent_path.is_empty() && doc.get(parent).as_dict().and_then(|d| d.int(b"Count")).is_none_or(|c| c <= 0) {
+        put(doc, parent, b"Count", Some(Object::Int(1)))?;
+    }
+    Ok(())
+}
+
 /// Expand or collapse a bookmark that has children.
 pub fn set_bookmark_open(doc: &mut Document, path: &[usize], open: bool) -> Result<()> {
     let (r, _) = resolve_path(doc, path)?;
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index 02cee53d49..1fd60d744a 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -528,6 +528,29 @@ fn custom_document_properties_are_listed_set_removed_and_their_names_checked() {
     assert!(custom_info(&doc).is_empty());
 }
 
+/// An `/Info` dictionary written directly in the trailer: a cleared entry is removed, and the
+/// other entries are kept.
+#[test]
+fn document_info_entries_are_cleared_from_an_info_dictionary_in_the_trailer() {
+    let b = build(
+        &[
+            "<< /Type /Catalog /Pages 2 0 R >>".into(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R >>".into(),
+            body("X"),
+        ],
+        "/Root 1 0 R /Info << /Title (Report) /Project (Apollo) /Revision (7) >>",
+    );
+    let mut doc = open(b);
+    set_info(&mut doc, "Missing", "").unwrap();
+    assert!(matches!(doc.trailer().get(b"Info"), Some(Object::Dict(_))), "clearing an absent entry changes nothing");
+    set_info(&mut doc, "Project", "").unwrap();
+    set_info(&mut doc, "Title", "").unwrap();
+    let doc = save_and_reopen(&doc);
+    assert_eq!(custom_info(&doc), [("Revision".to_string(), "7".to_string())]);
+    assert_eq!(info(&doc, "Title"), None);
+}
+
 /// Padding is not part of a custom value, in any mix of NULs and whitespace, a value that is only
 /// padding is not listed, and such entries don't count towards the 256 listed: a real property
 /// after 300 blank ones is still there.
@@ -1725,6 +1748,18 @@ fn bookmarks_add_rename_move_delete() {
     assert_eq!(crate::move_bookmark(&mut d, &[0], &[2], 9).unwrap(), vec![1, 1]);
     assert_eq!(titles(&crate::bookmarks(&d)), ["Intro", "Results[Table,Figure 1]"]);
     assert_eq!(crate::move_bookmark(&mut d, &[1], &[1, 0], 0), Err(crate::OutlineError::IntoItself));
+    // Into a bookmark with no children yet (Indent): it opens, so the moved one shows.
+    assert_eq!(crate::move_bookmark(&mut d, &[1, 1], &[0], 0).unwrap(), vec![0, 0]);
+    let intro = crate::bookmarks(&d)[0].obj;
+    assert_eq!(count_of(&d, intro), Some(1));
+    // Reordering inside a closed parent leaves it closed.
+    crate::add_bookmark(&mut d, &[0], 1, "Second", 0).unwrap();
+    crate::set_bookmark_open(&mut d, &[0], false).unwrap();
+    crate::move_bookmark(&mut d, &[0, 1], &[0], 0).unwrap();
+    assert_eq!(count_of(&d, intro), Some(-2));
+    crate::delete_bookmark(&mut d, &[0, 0]).unwrap();
+    crate::move_bookmark(&mut d, &[0, 0], &[1], 9).unwrap();
+    assert_eq!(titles(&crate::bookmarks(&d)), ["Intro", "Results[Table,Figure 1]"]);
     crate::delete_bookmark(&mut d, &[1, 0]).unwrap();
     assert_eq!(titles(&crate::bookmarks(&d)), ["Intro", "Results[Figure 1]"]);
 
@@ -2392,6 +2427,125 @@ fn initial_view_round_trips_and_keeps_scripts() {
     assert!(crate::set_initial_view(&mut doc, &crate::InitialView { page: 9, ..Default::default() }).is_err());
 }
 
+#[test]
+fn an_unchanged_opening_destination_keeps_its_position_and_name() {
+    use crate::view::{Magnification, Navigation};
+    let page2 = Object::Ref(pdfcraft_cos::ObjRef::new(5, 0));
+    let xyz = Object::Array(vec![page2.clone(), Object::name("XYZ"), Object::Int(100), Object::Int(500), Object::Int(2)]);
+    let mut named = pdfcraft_cos::Dict::new();
+    named.set(b"S".to_vec(), Object::name("GoTo"));
+    named.set(b"D".to_vec(), Object::name("there"));
+    let mut dests = pdfcraft_cos::Dict::new();
+    dests.set(b"there".to_vec(), Object::Array(vec![page2, Object::name("Fit")]));
+    let mut prefs = pdfcraft_cos::Dict::new();
+    prefs.set(b"NonFullScreenPageMode".to_vec(), Object::name("UseOutlines"));
+    for action in [xyz, Object::Dict(named)] {
+        let mut doc = open(fixture());
+        let root = doc.root().unwrap();
+        doc.update_dict(root, |c| {
+            c.set(b"OpenAction".to_vec(), action.clone());
+            c.set(b"Dests".to_vec(), Object::Dict(dests.clone()));
+            c.set(b"PageMode".to_vec(), Object::name("FullScreen"));
+            c.set(b"ViewerPreferences".to_vec(), Object::Dict(prefs.clone()));
+        })
+        .unwrap();
+        // Another option changes: the opening action is written back as it was, and so is the
+        // full-screen panel, which the dialog doesn't edit.
+        let v = crate::initial_view(&doc);
+        assert_eq!(v.non_full_screen, Navigation::Bookmarks);
+        crate::set_initial_view(&mut doc, &crate::InitialView { hide_toolbar: true, ..v.clone() }).unwrap();
+        let catalog = doc.get(root).as_dict().cloned().unwrap();
+        assert_eq!(catalog.get(b"OpenAction"), Some(&action));
+        let doc = save_and_reopen(&doc);
+        assert_eq!(crate::initial_view(&doc), crate::InitialView { hide_toolbar: true, ..v.clone() });
+        // A changed magnification writes a destination of its own.
+        let mut doc = doc;
+        crate::set_initial_view(&mut doc, &crate::InitialView { magnification: Magnification::FitWidth, ..v }).unwrap();
+        let catalog = doc.get(root).as_dict().cloned().unwrap();
+        assert_ne!(catalog.get(b"OpenAction"), Some(&action));
+        assert_eq!(crate::initial_view(&doc).magnification, Magnification::FitWidth);
+    }
+}
+
+/// A document whose `/OpenAction` is `action`, with the named destination `there` (page 3 at
+/// 200%) in the catalog `/Dests` and `here` (page 1, fit) in a `/Names /Dests` tree.
+fn doc_opening_at(action: Object) -> Document {
+    let page1 = Object::Ref(pdfcraft_cos::ObjRef::new(4, 0));
+    let page3 = Object::Ref(pdfcraft_cos::ObjRef::new(6, 0));
+    let mut dests = pdfcraft_cos::Dict::new();
+    dests.set(b"there".to_vec(), Object::Array(vec![page3, Object::name("XYZ"), Object::Null, Object::Null, Object::Int(2)]));
+    let mut tree = pdfcraft_cos::Dict::new();
+    tree.set(b"Names".to_vec(), Object::Array(vec![Object::String(PdfString::text("here")), Object::Array(vec![page1, Object::name("Fit")])]));
+    let mut names = pdfcraft_cos::Dict::new();
+    names.set(b"Dests".to_vec(), Object::Dict(tree));
+    let mut doc = open(fixture());
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| {
+        c.set(b"OpenAction".to_vec(), action);
+        c.set(b"Dests".to_vec(), Object::Dict(dests));
+        c.set(b"Names".to_vec(), Object::Dict(names));
+    })
+    .unwrap();
+    doc
+}
+
+fn open_action(doc: &Document) -> Option<Object> {
+    doc.get(doc.root().unwrap()).as_dict().and_then(|c| c.get(b"OpenAction").cloned())
+}
+
+/// ISO 32000-2 §12.3.2.4: a named destination stands for the explicit one it names. Choosing
+/// page 1 in Document Properties on a document that opens at a named destination elsewhere
+/// writes a destination to page 1; it used to read the name as page 1 and change nothing.
+#[test]
+fn choosing_page_one_replaces_a_named_opening_destination() {
+    use crate::view::Magnification;
+    let page1 = Object::Ref(pdfcraft_cos::ObjRef::new(4, 0));
+    let mut goto = pdfcraft_cos::Dict::new();
+    goto.set(b"S".to_vec(), Object::name("GoTo"));
+    goto.set(b"D".to_vec(), Object::name("there"));
+    for action in [Object::Dict(goto), Object::name("there"), Object::String(PdfString::text("there"))] {
+        let mut doc = doc_opening_at(action.clone());
+        // The dialog shows where the document really opens.
+        let v = crate::initial_view(&doc);
+        assert_eq!((v.page, v.magnification), (2, Magnification::Percent(200.0)), "{action:?}");
+        // Page 1 at the same magnification: an explicit destination to page 1.
+        crate::set_initial_view(&mut doc, &crate::InitialView { page: 0, ..v.clone() }).unwrap();
+        let written = Object::Array(vec![page1.clone(), Object::name("XYZ"), Object::Null, Object::Null, Object::Real(2.0)]);
+        assert_eq!(open_action(&doc), Some(written), "{action:?}");
+        let reopened = save_and_reopen(&doc);
+        assert_eq!(crate::initial_view(&reopened), crate::InitialView { page: 0, ..v.clone() }, "{action:?}");
+        // Page 1 at the default magnification: no opening action, so the first page opens.
+        let mut doc = doc_opening_at(action.clone());
+        crate::set_initial_view(&mut doc, &crate::InitialView { page: 0, magnification: Magnification::Default, ..v }).unwrap();
+        assert_eq!(open_action(&doc), None, "{action:?}");
+        assert_eq!(crate::initial_view(&save_and_reopen(&doc)).page, 0, "{action:?}");
+    }
+}
+
+/// A named opening destination that already goes to the chosen page and magnification is kept,
+/// and so is one that names nothing (it reads as page 1) until another page is chosen.
+#[test]
+fn a_named_opening_destination_is_kept_while_it_still_holds() {
+    use crate::view::Magnification;
+    let page2 = Object::Ref(pdfcraft_cos::ObjRef::new(5, 0));
+    for (action, magnification) in
+        [(Object::String(PdfString::text("here")), Magnification::FitPage), (Object::name("nowhere"), Magnification::Default)]
+    {
+        let mut doc = doc_opening_at(action.clone());
+        let v = crate::initial_view(&doc);
+        assert_eq!((v.page, v.magnification), (0, magnification), "{action:?}");
+        crate::set_initial_view(&mut doc, &crate::InitialView { hide_toolbar: true, ..v.clone() }).unwrap();
+        assert_eq!(open_action(&doc), Some(action.clone()), "{action:?}");
+        crate::set_initial_view(&mut doc, &crate::InitialView { page: 1, ..v.clone() }).unwrap();
+        let kind = if magnification == Magnification::FitPage { "Fit" } else { "XYZ" };
+        assert_eq!(
+            open_action(&doc).as_ref().and_then(Object::as_array).map(|a| (a.first().cloned(), a.get(1).cloned())),
+            Some((Some(page2.clone()), Some(Object::name(kind)))),
+            "{action:?}"
+        );
+    }
+}
+
 // ── Split / Extract keep only the resources the part draws (#204) ──────────────────────────────
 
 /// A content stream with no text operators (an image draw).
diff --git a/crates/organize/src/view.rs b/crates/organize/src/view.rs
index 0f115d3051..899293b980 100644
--- a/crates/organize/src/view.rs
+++ b/crates/organize/src/view.rs
@@ -63,6 +63,10 @@ pub struct InitialView {
     pub language: Option<String>,
     /// Right-edge binding (`/Direction /R2L`).
     pub right_to_left: bool,
+    /// The navigation panel on leaving full screen (`/ViewerPreferences /NonFullScreenPageMode`,
+    /// ISO 32000-2 Table 147), read only when `full_screen` is set. It is read, not written:
+    /// [`set_initial_view`] leaves the entry as it is.
+    pub non_full_screen: Navigation,
 }
 
 fn catalog(doc: &Document) -> Result<(pdfcraft_cos::ObjRef, Dict), OrganizeError> {
@@ -104,11 +108,22 @@ pub fn initial_view(doc: &Document) -> InitialView {
         v.hide_toolbar = flag(b"HideToolbar");
         v.hide_window_ui = flag(b"HideWindowUI");
         v.right_to_left = name(&vp, b"Direction").as_deref() == Some(b"R2L");
+        // Table 147: meaningful only with `/PageMode /FullScreen`, and only these four values.
+        if v.full_screen {
+            v.non_full_screen = match name(&vp, b"NonFullScreenPageMode").as_deref() {
+                Some(b"UseOutlines") => Navigation::Bookmarks,
+                Some(b"UseThumbs") => Navigation::Pages,
+                Some(b"UseOC") => Navigation::Layers,
+                _ => Navigation::PageOnly,
+            };
+        }
     }
-    // The opening destination: an explicit array, or a GoTo action's.
+    // The opening destination: an explicit array, a GoTo action's `/D`, or a named destination (a
+    // name or string, §12.3.2.4) as the explicit one it names, so that the page and magnification
+    // read here are where the document opens. A name that names nothing reads as page 1.
     let dest = c.get(b"OpenAction").map(|o| doc.resolve(o)).and_then(|o| match &*o {
-        Object::Array(a) => Some(a.clone()),
-        Object::Dict(d) if d.name(b"S") == Some(b"GoTo") => d.get(b"D").map(|x| doc.resolve(x)).and_then(|x| x.as_array().cloned()),
+        Object::Array(_) | Object::Name(_) | Object::String(_) => crate::outline::resolve_dest(doc, &o),
+        Object::Dict(d) if d.name(b"S") == Some(b"GoTo") => d.get(b"D").and_then(|x| crate::outline::resolve_dest(doc, x)),
         _ => None,
     });
     if let Some(d) = dest {
@@ -149,8 +164,13 @@ pub fn displays_doc_title(doc: &Document) -> bool {
 }
 
 /// Write the initial view. An opening action that isn't a plain destination (a script, say) is
-/// kept unless the page or magnification asks for a destination.
+/// kept unless the page or magnification asks for a destination, and an opening action whose page
+/// and magnification `v` leaves as [`initial_view`] reads them is kept as it is.
 pub fn set_initial_view(doc: &mut Document, v: &InitialView) -> Result<(), OrganizeError> {
+    let same_destination = {
+        let now = initial_view(doc);
+        now.page == v.page && now.magnification == v.magnification
+    };
     let (root, c) = catalog(doc)?;
     let pages = crate::walk(doc)?;
     if v.page >= pages.len() {
@@ -177,9 +197,12 @@ pub fn set_initial_view(doc: &mut Document, v: &InitialView) -> Result<(), Organ
     } else {
         vp.remove(b"Direction");
     }
+    // A destination, explicit or named (§12.3.2.4), or a GoTo action to one.
     let open_action_is_dest = match c.get(b"OpenAction").map(|o| doc.resolve(o)) {
         None => true,
-        Some(o) => matches!(&*o, Object::Array(_)) || o.as_dict().is_some_and(|d| d.name(b"S") == Some(b"GoTo")),
+        Some(o) => {
+            matches!(&*o, Object::Array(_) | Object::Name(_) | Object::String(_)) || o.as_dict().is_some_and(|d| d.name(b"S") == Some(b"GoTo"))
+        }
     };
     let dest = match v.magnification {
         Magnification::Default if v.page == 0 => None,
@@ -238,6 +261,9 @@ pub fn set_initial_view(doc: &mut Document, v: &InitialView) -> Result<(), Organ
             }
         }
         match (&dest, open_action_is_dest) {
+            // The opening page and magnification are as read: the action stays as written, with
+            // its position or named destination (§12.3.2.4) that the view model doesn't hold.
+            _ if same_destination => {}
             (Some(d), _) => c.set(b"OpenAction".to_vec(), Object::Array(d.clone())),
             (None, true) => {
                 c.remove(b"OpenAction");
@@ -294,4 +320,40 @@ mod tests {
             assert_eq!(flags(initial_view(&doc)), [false; 6]);
         }
     }
+
+    /// A catalog with `/PageMode page_mode` and `/ViewerPreferences << /NonFullScreenPageMode mode >>`.
+    fn with_modes(page_mode: &str, mode: Object) -> Document {
+        let mut doc = Document::new_empty();
+        let mode = doc.add(mode);
+        let mut preferences = Dict::new();
+        preferences.set(b"NonFullScreenPageMode".to_vec(), Object::Ref(mode));
+        let root = doc.root().unwrap();
+        doc.update_dict(root, |c| {
+            c.set(b"PageMode".to_vec(), Object::name(page_mode));
+            c.set(b"ViewerPreferences".to_vec(), Object::Dict(preferences));
+        })
+        .unwrap();
+        doc
+    }
+
+    #[test]
+    fn non_full_screen_page_mode_is_read_with_full_screen_only() {
+        for (mode, want) in [
+            ("UseOutlines", Navigation::Bookmarks),
+            ("UseThumbs", Navigation::Pages),
+            ("UseOC", Navigation::Layers),
+            ("UseNone", Navigation::PageOnly),
+            // Not a value Table 147 lists.
+            ("UseAttachments", Navigation::PageOnly),
+            ("FullScreen", Navigation::PageOnly),
+        ] {
+            let v = initial_view(&with_modes("FullScreen", Object::name(mode)));
+            assert!(v.full_screen);
+            assert_eq!(v.non_full_screen, want, "{mode}");
+            // Ignored unless the document opens in full screen.
+            let v = initial_view(&with_modes("UseThumbs", Object::name(mode)));
+            assert_eq!((v.navigation, v.non_full_screen), (Navigation::Pages, Navigation::PageOnly), "{mode}");
+        }
+        assert_eq!(initial_view(&with_modes("FullScreen", Object::Int(1))).non_full_screen, Navigation::PageOnly);
+    }
 }
diff --git a/crates/platform/README.md b/crates/platform/README.md
index ea7af7a079..fea358e508 100644
--- a/crates/platform/README.md
+++ b/crates/platform/README.md
@@ -8,4 +8,4 @@ Synthetic tests pin both name forms, the 128-byte cut, the attempt limit and ref
 
 On macOS, `write_atomically_with` copies the existing regular destination's accessible extended attributes to the open staging file after writing the data and before flushing and renaming. Finder tags, comments, binary values and empty attributes therefore survive both incremental and full saves (#2658). Save As retains attributes of an existing destination; a new destination does not inherit metadata from the source PDF. Missing files and filesystems without xattr support keep working. The metadata read does not follow the destination's symlink or block on a FIFO. macOS manages the new file's `com.apple.provenance`; it is not copied. Kernel-hidden compression attributes are not requested.
 
-Attribute copying is bounded: 64 KiB of names, 1024 attributes, 16 MiB per value and 64 MiB total. Each value must fill the initially queried size and retain that size in a second query after reading: a resource fork may return a partial prefix on growth rather than an error. A read/copy error or exceeded bound returns an error suggesting Save As; the original bytes and metadata stay intact and the staging file is removed. Flush errors retain the same guarantee. Tests cover exact metadata before flush and after repeated saves, empty/binary values, oversized resource forks, a simulated partial read of a growing fork and symlink isolation. Automation covers incremental/full saves, Save As and retaining an unsaved edit after metadata refusal. The staging writer also retains Unix permissions and, where supported, Windows/macOS creation dates; attribute copying runs before the creation date is restored. ACLs and hard-link identity are not preserved.
+Attribute copying is bounded: 64 KiB of names, 1024 attributes, 16 MiB per value and 64 MiB total. Each value must fill the initially queried size and retain that size in a second query after reading: a resource fork may return a partial prefix on growth rather than an error. A read/copy error or exceeded bound returns an error suggesting Save As; the original bytes and metadata stay intact and the staging file is removed. Flush errors retain the same guarantee. Tests cover exact metadata before flush and after repeated saves, empty/binary values, oversized resource forks, a simulated partial read of a growing fork and symlink isolation. Automation covers incremental/full saves, Save As and retaining an unsaved edit after metadata refusal. The staging writer also retains Unix permissions, the Windows hidden and system attributes (the staging file is created with them, so a hidden file is never published visible and a plain one never hidden, #4593) and, where supported, Windows/macOS creation dates; attribute copying runs before the creation date is restored. ACLs and hard-link identity are not preserved.
diff --git a/crates/platform/src/staging.rs b/crates/platform/src/staging.rs
index c0e8f990bc..4316051352 100644
--- a/crates/platform/src/staging.rs
+++ b/crates/platform/src/staging.rs
@@ -34,7 +34,8 @@ pub fn create_staging(
 /// [`create_staging`], giving the new file the mode and group of the file `keep` describes on
 /// Unix. It is created readable and writable by its owner only and then given them, so its mode
 /// is never more open than that of the file it will replace, not even while it is still empty (a
-/// handle opened then would keep reading what is written later). The owner is the saver's.
+/// handle opened then would keep reading what is written later). The owner is the saver's. On
+/// Windows it is created with that file's [`KEPT_ATTRIBUTES`].
 fn create_staging_as(
     dir: &Path,
     name: &str,
@@ -63,8 +64,15 @@ fn create_staging_as(
             use std::os::unix::fs::OpenOptionsExt as _;
             options.mode(0o600);
         }
+        // Given as the file is created, so a hidden target's staging file is never visible.
+        #[cfg(windows)]
+        if let Some(keep) = keep {
+            use std::os::windows::fs::{MetadataExt as _, OpenOptionsExt as _};
+            options.attributes(keep.file_attributes() & KEPT_ATTRIBUTES);
+        }
         match options.open(&tmp) {
             Ok(file) => {
+                #[cfg(unix)]
                 if let Some(keep) = keep {
                     // A volume that can't change modes (FAT, some network shares) leaves the file
                     // owner-only: stricter than the file it replaces, never looser.
@@ -78,9 +86,18 @@ fn create_staging_as(
             Err(e) => return Err(e),
         }
     }
+    #[cfg(not(any(unix, windows)))]
+    let _ = keep;
     Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "every temporary file name tried is taken"))
 }
 
+/// The Windows attributes a replaced file passes on to its staging file (#4593):
+/// `FILE_ATTRIBUTE_HIDDEN` and `FILE_ATTRIBUTE_SYSTEM`, the two that say who should see the
+/// file. A read-only file is refused before anything is staged, and the archive bit is the
+/// system's to set on a changed file; the other attributes describe how the volume stores it.
+#[cfg(windows)]
+const KEPT_ATTRIBUTES: u32 = 0x2 | 0x4;
+
 /// The permissions a staging file gets to replace the file `keep` describes. The mode's group bits
 /// are meant for that file's group, so the staging file joins it first. Where it can't (the saver
 /// isn't a member), group and others get nothing: someone the group bits shut out would
@@ -96,11 +113,6 @@ fn kept_permissions(file: &std::fs::File, keep: &std::fs::Metadata) -> std::fs::
     mode
 }
 
-#[cfg(not(unix))]
-fn kept_permissions(_: &std::fs::File, keep: &std::fs::Metadata) -> std::fs::Permissions {
-    keep.permissions()
-}
-
 /// Unpredictable staging-name suffixes, so a name can't be planted in advance. Each is the
 /// standard library's keyed hash of a counter (`RandomState::hash_one`, currently SipHash-1-3),
 /// keyed from the operating system's random source. That is all a staging name needs, but it is
@@ -119,7 +131,8 @@ pub fn staging_suffixes() -> impl Iterator<Item = u64> {
 /// a folder at the target is refused by the rename. Flushing is the staging file's own
 /// (`sync_all`); parent-directory durability after a power loss is not promised. On Unix a file
 /// that is replaced keeps its permissions and group, so a private file stays private; a new file gets the
-/// usual mode for a new file. On Windows and macOS a replaced file keeps its creation date, where
+/// usual mode for a new file. On Windows a replaced file stays hidden or system if it was, and
+/// plain if it was plain. On Windows and macOS a replaced file keeps its creation date, where
 /// the volume stores one.
 /// On macOS, accessible extended attributes of an existing regular destination are copied
 /// before flushing; a copy failure refuses the save rather than losing metadata (#2658).
@@ -146,10 +159,14 @@ pub fn write_atomically_with(
     }
     let dir = path.parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(Path::new("."));
     let name = path.file_name().and_then(std::ffi::OsStr::to_str).unwrap_or("save");
-    // A file that is replaced keeps its permissions (#1790) and group. Unix only: Windows is as before.
+    // A file that is replaced keeps its permissions (#1790) and group on Unix, and its hidden and
+    // system attributes on Windows (#4593). A save replaces a symbolic link, not the file it
+    // points to, so on Windows the attributes are the link's own.
     #[cfg(unix)]
     let keep = std::fs::metadata(path).ok();
-    #[cfg(not(unix))]
+    #[cfg(windows)]
+    let keep = std::fs::symlink_metadata(path).ok();
+    #[cfg(not(any(unix, windows)))]
     let keep = None;
     // A saved file is the same document: it keeps its creation date (#2658).
     #[cfg(any(windows, target_os = "macos"))]
@@ -275,390 +292,4 @@ fn sync_staged(f: &std::fs::File, sync_all: impl FnOnce(&std::fs::File) -> std::
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A fresh, empty folder for one test.
-    fn test_dir(test: &str) -> PathBuf {
-        let dir = std::env::temp_dir().join(format!("pdfcraft-platform-staging-{}-{test}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        dir
-    }
-
-    fn file_name(p: &Path) -> String {
-        p.file_name().unwrap().to_string_lossy().into_owned()
-    }
-
-    /// The callers' tests plant files at these exact names; if a name changed, those tests would
-    /// plant where nothing writes and pass without testing anything.
-    #[test]
-    fn each_form_keeps_its_exact_name() {
-        let dir = test_dir("forms");
-        let (tools, _) = create_staging(&dir, "out.pdf", StagingName::SuffixThenTag, [0xab]).unwrap();
-        assert_eq!(file_name(&tools), ".out.pdf.00000000000000ab.pdfcraft-tmp");
-        let (desktop, _) = create_staging(&dir, "out.pdf", StagingName::TagThenSuffix, [0xab]).unwrap();
-        assert_eq!(file_name(&desktop), ".out.pdf.pdfcraft-00000000000000ab.tmp");
-        assert_eq!(std::fs::read(&tools).unwrap(), b"", "a new, empty file");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn a_long_name_is_cut_to_128_bytes_between_characters() {
-        let dir = test_dir("long");
-        // One byte, then four-byte characters: the 128-byte limit falls inside the 32nd one.
-        let name = format!("a{}.pdf", "\u{1F600}".repeat(40));
-        let (tmp, _) = create_staging(&dir, &name, StagingName::SuffixThenTag, [1]).unwrap();
-        assert_eq!(file_name(&tmp), format!(".a{}.0000000000000001.pdfcraft-tmp", "\u{1F600}".repeat(31)));
-        // One-byte characters: exactly 128 of them are kept.
-        let (tmp, _) = create_staging(&dir, &"x".repeat(200), StagingName::SuffixThenTag, [2]).unwrap();
-        assert_eq!(file_name(&tmp), format!(".{}.0000000000000002.pdfcraft-tmp", "x".repeat(128)));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// #2658: a read-only file is refused before anything is staged, on Unix (where a rename would
-    /// replace it) as on Windows (where the rename fails).
-    #[test]
-    fn a_read_only_target_is_refused_and_kept() {
-        let dir = test_dir("readonly");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, "OLD").unwrap();
-        let mut perms = std::fs::metadata(&target).unwrap().permissions();
-        perms.set_readonly(true);
-        std::fs::set_permissions(&target, perms.clone()).unwrap();
-        let staged = std::cell::Cell::new(false);
-        let e = write_atomically_with(&target, b"NEW", StagingName::TagThenSuffix, [7], |_: &std::fs::File| {
-            staged.set(true);
-            Ok(())
-        })
-        .unwrap_err();
-        assert_eq!(e.kind(), std::io::ErrorKind::PermissionDenied, "{e}");
-        assert!(!staged.get(), "nothing was staged");
-        assert_eq!(std::fs::read(&target).unwrap(), b"OLD");
-        assert!(std::fs::metadata(&target).unwrap().permissions().readonly(), "still read-only");
-        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1, "no staging file is left");
-        #[allow(clippy::permissions_set_readonly_false)]
-        perms.set_readonly(false);
-        std::fs::set_permissions(&target, perms).unwrap();
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn running_out_of_suffixes_refuses_and_creates_nothing() {
-        let dir = test_dir("empty");
-        let e = create_staging(&dir, "out.pdf", StagingName::TagThenSuffix, []).unwrap_err();
-        assert_eq!(e.kind(), std::io::ErrorKind::AlreadyExists);
-        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 0);
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn only_the_first_sixteen_names_are_tried() {
-        let dir = test_dir("cap");
-        let name = |s: u64| dir.join(format!(".out.pdf.{s:016x}.pdfcraft-tmp"));
-        for s in 1..=STAGING_ATTEMPTS as u64 {
-            std::fs::write(name(s), "PLANTED").unwrap();
-        }
-        assert!(create_staging(&dir, "out.pdf", StagingName::SuffixThenTag, 1..).is_err());
-        assert!(!name(STAGING_ATTEMPTS as u64 + 1).exists(), "a 17th name was tried");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// `write_atomically`: the target holds the new bytes only once they are complete; a refused
-    /// flush leaves the old file and removes the staging file; a missing folder writes nothing.
-    #[test]
-    fn an_atomic_write_replaces_the_target_only_when_complete() {
-        let dir = test_dir("write");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, b"OLD").unwrap();
-        let names = |dir: &Path| {
-            let mut v: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| file_name(&e.unwrap().path())).collect();
-            v.sort();
-            v
-        };
-        // The staging file is written and flushed before the target changes.
-        let mut seen_old = false;
-        write_atomically_with(&target, b"NEW", StagingName::SuffixThenTag, [7], |f| {
-            seen_old = std::fs::read(&target).unwrap() == b"OLD" && f.metadata().unwrap().len() == 3;
-            Ok(())
-        })
-        .unwrap();
-        assert!(seen_old, "flushed before publication, with the target still the old file");
-        assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
-        assert_eq!(names(&dir), ["out.pdf"], "no staging file is left");
-        // A refused flush keeps the target and cleans up.
-        let e = write_atomically_with(&target, b"NEWER", StagingName::TagThenSuffix, [8], |_| Err(std::io::Error::other("refused"))).unwrap_err();
-        assert!(e.to_string().contains("refused"));
-        assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
-        assert_eq!(names(&dir), ["out.pdf"]);
-        // A folder that does not exist: nothing is written anywhere.
-        assert!(write_atomically(&dir.join("missing").join("out.pdf"), b"X", StagingName::SuffixThenTag).is_err());
-        assert_eq!(names(&dir), ["out.pdf"]);
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn atomic_saves_keep_finder_tags_and_binary_extended_attributes() {
-        use rustix::fs::{XattrFlags, fgetxattr, setxattr};
-        use std::os::macos::fs::FileTimesExt as _;
-        let dir = test_dir("xattrs");
-        let target = dir.join("out.pdf");
-        let attributes: &[(&str, &[u8])] = &[
-            ("com.apple.metadata:_kMDItemUserTags", b"<plist version=\"1.0\"><array><string>PdfCraft\n6</string></array></plist>"),
-            ("com.pdfcraft.test.binary", b"\0\xff\x80original\0"),
-            ("com.pdfcraft.test.empty", b""),
-        ];
-        std::fs::write(&target, b"OLD").unwrap();
-        for (name, value) in attributes {
-            setxattr(&target, *name, value, XattrFlags::empty()).unwrap();
-        }
-        let created = std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(1_577_934_245);
-        let original = std::fs::OpenOptions::new().write(true).open(&target).unwrap();
-        original.set_times(std::fs::FileTimes::new().set_created(created)).unwrap();
-        assert_eq!(original.metadata().unwrap().created().unwrap(), created);
-        drop(original);
-        // Both desktop and automation name forms, including a second save of the replacement.
-        for form in [StagingName::TagThenSuffix, StagingName::SuffixThenTag] {
-            write_atomically_with(&target, b"NEW", form, [7], |staged| {
-                assert_eq!(staged.metadata().unwrap().created().unwrap(), created, "creation date must survive attribute copying before flush");
-                for (name, value) in attributes {
-                    let mut bytes = [0u8; 256];
-                    let len = fgetxattr(staged, *name, &mut bytes[..]).unwrap();
-                    assert_eq!(&bytes[..len], *value, "metadata must be present before flush: {name}");
-                }
-                Ok(())
-            })
-            .unwrap();
-            let saved = std::fs::File::open(&target).unwrap();
-            assert_eq!(saved.metadata().unwrap().created().unwrap(), created);
-            for (name, value) in attributes {
-                let mut bytes = [0u8; 256];
-                let len = fgetxattr(&saved, *name, &mut bytes[..]).unwrap();
-                assert_eq!(&bytes[..len], *value);
-            }
-            assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
-            assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
-        }
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn a_failed_flush_keeps_the_original_extended_attributes() {
-        use rustix::fs::{XattrFlags, getxattr, setxattr};
-        let dir = test_dir("xattrs-flush");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, b"OLD").unwrap();
-        setxattr(&target, "com.pdfcraft.test", b"original", XattrFlags::empty()).unwrap();
-        let e = write_atomically_with(&target, b"NEW", StagingName::TagThenSuffix, [9], |_| Err(std::io::Error::other("flush refused"))).unwrap_err();
-        assert!(e.to_string().contains("flush refused"));
-        assert_eq!(std::fs::read(&target).unwrap(), b"OLD");
-        let mut value = [0u8; 64];
-        let len = getxattr(&target, "com.pdfcraft.test", &mut value[..]).unwrap();
-        assert_eq!(&value[..len], b"original");
-        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    /// Model an HFS-style partial read while using real macOS metadata and the atomic writer.
-    /// The shared read validator must reject growth before the staging file can be published.
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn a_growing_resource_fork_refuses_publication_and_keeps_original() {
-        use rustix::fs::{XattrFlags, fgetxattr, fsetxattr, getxattr, setxattr};
-        let dir = test_dir("xattrs-growing-fork");
-        let target = dir.join("out.pdf");
-        let name = "com.apple.ResourceFork";
-        for form in [StagingName::TagThenSuffix, StagingName::SuffixThenTag] {
-            std::fs::write(&target, b"ORIGINAL PDF").unwrap();
-            setxattr(&target, name, b"ABC", XattrFlags::empty()).unwrap();
-            let source = std::fs::File::open(&target).unwrap();
-            let result = write_atomically_with(&target, b"REPLACEMENT PDF", form, [23], |staged| {
-                let size = fgetxattr(&source, name, &mut [] as &mut [u8])?;
-                let value = read_xattr_value(size, |buffer| {
-                    if buffer.is_empty() {
-                        return Ok(fgetxattr(&source, name, buffer)?);
-                    }
-                    // HFS can return the prefix that fits instead of ERANGE. APFS need not
-                    // have that behaviour: model the kernel response, not a timing race.
-                    setxattr(&target, name, b"ABCD", XattrFlags::empty())?;
-                    buffer.get_mut(..3).unwrap().copy_from_slice(b"ABC");
-                    Ok(3)
-                })?;
-                fsetxattr(staged, name, &value, XattrFlags::empty())?;
-                Ok(())
-            });
-            let error = result.expect_err("a short prefix of the grown fork must not be published");
-            assert!(error.to_string().contains("changed size"), "{error}");
-            assert_eq!(std::fs::read(&target).unwrap(), b"ORIGINAL PDF");
-            let mut bytes = [0u8; 8];
-            let len = getxattr(&target, name, &mut bytes[..]).unwrap();
-            assert_eq!(&bytes[..len], b"ABCD", "the original's grown fork must remain intact");
-            assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1, "staging files are removed on refusal");
-        }
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    /// Stable empty/binary values are accepted; short reads, growth and failed rechecks are refused.
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn attribute_reads_require_a_complete_value_and_stable_size() {
-        for bytes in [&b""[..], &b"\0\xffB"[..]] {
-            let value = read_xattr_value(bytes.len(), |buffer| {
-                if !buffer.is_empty() {
-                    buffer.get_mut(..bytes.len()).unwrap().copy_from_slice(bytes);
-                }
-                Ok(bytes.len())
-            })
-            .unwrap();
-            assert_eq!(value, bytes);
-        }
-        for (before, read_len, after) in [(3, 2, 3), (3, 3, 4), (0, 1, 1), (3, 2, 2)] {
-            let result = read_xattr_value(before, |buffer| Ok(if buffer.is_empty() { after } else { read_len }));
-            assert!(result.unwrap_err().to_string().contains("changed size"));
-        }
-        let result = read_xattr_value(3, |buffer| {
-            if buffer.is_empty() { Err(std::io::Error::new(std::io::ErrorKind::PermissionDenied, "size recheck refused")) } else { Ok(3) }
-        });
-        assert_eq!(result.unwrap_err().kind(), std::io::ErrorKind::PermissionDenied);
-    }
-
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn oversized_extended_attributes_refuse_the_save_without_replacing_the_target() {
-        use rustix::fs::{XattrFlags, getxattr, setxattr};
-        let dir = test_dir("xattrs-limit");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, b"OLD").unwrap();
-        // A resource fork can exceed the ordinary attribute limit on macOS. No fixture file
-        // is committed; only the OS metadata of this temporary synthetic file holds the bytes.
-        let fork = vec![42u8; 16 * 1024 * 1024 + 1];
-        setxattr(&target, "com.apple.ResourceFork", &fork, XattrFlags::empty()).unwrap();
-        let mut flushed = false;
-        let e = write_atomically_with(&target, b"NEW", StagingName::TagThenSuffix, [10], |_| {
-            flushed = true;
-            Ok(())
-        })
-        .unwrap_err();
-        assert!(e.to_string().contains("extended attributes"), "{e}");
-        assert!(e.to_string().contains("Save As"), "{e}");
-        assert!(!flushed, "metadata failure must stop before flush and rename");
-        assert_eq!(std::fs::read(&target).unwrap(), b"OLD");
-        let size = getxattr(&target, "com.apple.ResourceFork", &mut [] as &mut [u8]).unwrap();
-        assert_eq!(size, fork.len());
-        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn replacing_a_symlink_does_not_copy_attributes_from_its_referent() {
-        use rustix::fs::{XattrFlags, getxattr, setxattr};
-        let dir = test_dir("xattrs-symlink");
-        let outside = test_dir("xattrs-outside").join("private.pdf");
-        std::fs::write(&outside, b"PRIVATE").unwrap();
-        setxattr(&outside, "com.pdfcraft.test", b"private metadata", XattrFlags::empty()).unwrap();
-        let target = dir.join("out.pdf");
-        std::os::unix::fs::symlink(&outside, &target).unwrap();
-        write_atomically(&target, b"NEW", StagingName::TagThenSuffix).unwrap();
-        assert_eq!(std::fs::read(&outside).unwrap(), b"PRIVATE");
-        assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
-        assert!(!target.symlink_metadata().unwrap().file_type().is_symlink());
-        let mut bytes = [0u8; 64];
-        assert_eq!(getxattr(&target, "com.pdfcraft.test", &mut bytes[..]).unwrap_err(), rustix::io::Errno::NOATTR);
-        let len = getxattr(&outside, "com.pdfcraft.test", &mut bytes[..]).unwrap();
-        assert_eq!(&bytes[..len], b"private metadata");
-        std::fs::remove_dir_all(dir).unwrap();
-        std::fs::remove_dir_all(outside.parent().unwrap()).unwrap();
-    }
-
-    /// #1790: a replaced file keeps its permissions, and its staging file already has them while
-    /// it is written; a new file gets the same mode as any other new file.
-    #[cfg(unix)]
-    #[test]
-    fn a_replaced_file_keeps_its_permissions() {
-        use std::os::unix::fs::PermissionsExt as _;
-        let dir = test_dir("modes");
-        let mode = |p: &Path| std::fs::metadata(p).unwrap().permissions().mode() & 0o777;
-        let target = dir.join("out.pdf");
-        for keep in [0o600, 0o640, 0o664] {
-            std::fs::write(&target, b"OLD").unwrap();
-            std::fs::set_permissions(&target, std::fs::Permissions::from_mode(keep)).unwrap();
-            let mut staged = 0;
-            write_atomically_with(&target, b"NEW", StagingName::SuffixThenTag, [keep as u64], |f| {
-                staged = f.metadata()?.permissions().mode() & 0o777;
-                Ok(())
-            })
-            .unwrap();
-            assert_eq!(staged, keep, "the staging file has the target's mode before it is flushed");
-            assert_eq!(mode(&target), keep, "the saved file keeps mode {keep:o}");
-            assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
-        }
-        let fresh = dir.join("new.pdf");
-        write_atomically(&fresh, b"NEW", StagingName::TagThenSuffix).unwrap();
-        let plain = dir.join("plain");
-        std::fs::write(&plain, b"").unwrap();
-        assert_eq!(mode(&fresh), mode(&plain), "a new file is not made private");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// A replaced file keeps its group as well as its mode, so group permissions never reach a
-    /// group that couldn't read the file before (the saver's own group, by default).
-    #[cfg(target_os = "linux")]
-    #[test]
-    fn a_replaced_file_keeps_its_group() {
-        use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
-        let dir = test_dir("group");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, b"OLD").unwrap();
-        let created = std::fs::metadata(&target).unwrap().gid();
-        let status = std::fs::read_to_string("/proc/self/status").unwrap();
-        let groups = status.lines().find_map(|l| l.strip_prefix("Groups:")).unwrap_or_default();
-        let Some(other) = groups.split_whitespace().filter_map(|g| g.parse::<u32>().ok()).find(|&g| g != created) else {
-            eprintln!("skipped: the test needs a second group");
-            return;
-        };
-        std::os::unix::fs::chown(&target, None, Some(other)).unwrap();
-        std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o640)).unwrap();
-        let mut staged = (0, 0);
-        write_atomically_with(&target, b"NEW", StagingName::SuffixThenTag, [7], |f| {
-            let m = f.metadata()?;
-            staged = (m.gid(), m.permissions().mode() & 0o777);
-            Ok(())
-        })
-        .unwrap();
-        assert_eq!(staged, (other, 0o640), "the staging file has the target's group before it is flushed");
-        let m = std::fs::metadata(&target).unwrap();
-        assert_eq!((m.gid(), m.permissions().mode() & 0o777), (other, 0o640));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// #2658: a save replaces the file, but the document is the same one: it keeps its creation
-    /// date where the system lets a program set it.
-    #[cfg(any(windows, target_os = "macos"))]
-    #[test]
-    fn a_replaced_file_keeps_its_creation_date() {
-        #[cfg(target_os = "macos")]
-        use std::os::macos::fs::FileTimesExt as _;
-        #[cfg(windows)]
-        use std::os::windows::fs::FileTimesExt as _;
-        let dir = test_dir("created");
-        let target = dir.join("doc.pdf");
-        std::fs::write(&target, b"OLD").unwrap();
-        // 2020-01-02 03:04:05 UTC.
-        let then = std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(1_577_934_245);
-        let file = std::fs::OpenOptions::new().write(true).open(&target).unwrap();
-        file.set_times(std::fs::FileTimes::new().set_created(then)).unwrap();
-        drop(file);
-        assert_eq!(std::fs::metadata(&target).unwrap().created().unwrap(), then, "the fixture's date is set");
-        write_atomically(&target, b"NEW", StagingName::SuffixThenTag).unwrap();
-        assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
-        assert_eq!(std::fs::metadata(&target).unwrap().created().unwrap(), then, "the saved file keeps its creation date");
-        // A new file gets a date of its own.
-        let fresh = dir.join("new.pdf");
-        write_atomically(&fresh, b"NEW", StagingName::SuffixThenTag).unwrap();
-        assert!(std::fs::metadata(&fresh).unwrap().created().unwrap() > then);
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}
+mod tests;
diff --git a/crates/platform/src/staging/tests.rs b/crates/platform/src/staging/tests.rs
new file mode 100644
index 0000000000..b5552a2c7b
--- /dev/null
+++ b/crates/platform/src/staging/tests.rs
@@ -0,0 +1,450 @@
+use super::*;
+
+/// A fresh, empty folder for one test.
+fn test_dir(test: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-platform-staging-{}-{test}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+fn file_name(p: &Path) -> String {
+    p.file_name().unwrap().to_string_lossy().into_owned()
+}
+
+/// The callers' tests plant files at these exact names; if a name changed, those tests would
+/// plant where nothing writes and pass without testing anything.
+#[test]
+fn each_form_keeps_its_exact_name() {
+    let dir = test_dir("forms");
+    let (tools, _) = create_staging(&dir, "out.pdf", StagingName::SuffixThenTag, [0xab]).unwrap();
+    assert_eq!(file_name(&tools), ".out.pdf.00000000000000ab.pdfcraft-tmp");
+    let (desktop, _) = create_staging(&dir, "out.pdf", StagingName::TagThenSuffix, [0xab]).unwrap();
+    assert_eq!(file_name(&desktop), ".out.pdf.pdfcraft-00000000000000ab.tmp");
+    assert_eq!(std::fs::read(&tools).unwrap(), b"", "a new, empty file");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_long_name_is_cut_to_128_bytes_between_characters() {
+    let dir = test_dir("long");
+    // One byte, then four-byte characters: the 128-byte limit falls inside the 32nd one.
+    let name = format!("a{}.pdf", "\u{1F600}".repeat(40));
+    let (tmp, _) = create_staging(&dir, &name, StagingName::SuffixThenTag, [1]).unwrap();
+    assert_eq!(file_name(&tmp), format!(".a{}.0000000000000001.pdfcraft-tmp", "\u{1F600}".repeat(31)));
+    // One-byte characters: exactly 128 of them are kept.
+    let (tmp, _) = create_staging(&dir, &"x".repeat(200), StagingName::SuffixThenTag, [2]).unwrap();
+    assert_eq!(file_name(&tmp), format!(".{}.0000000000000002.pdfcraft-tmp", "x".repeat(128)));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// #2658: a read-only file is refused before anything is staged, on Unix (where a rename would
+/// replace it) as on Windows (where the rename fails).
+#[test]
+fn a_read_only_target_is_refused_and_kept() {
+    let dir = test_dir("readonly");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, "OLD").unwrap();
+    let mut perms = std::fs::metadata(&target).unwrap().permissions();
+    perms.set_readonly(true);
+    std::fs::set_permissions(&target, perms.clone()).unwrap();
+    let staged = std::cell::Cell::new(false);
+    let e = write_atomically_with(&target, b"NEW", StagingName::TagThenSuffix, [7], |_: &std::fs::File| {
+        staged.set(true);
+        Ok(())
+    })
+    .unwrap_err();
+    assert_eq!(e.kind(), std::io::ErrorKind::PermissionDenied, "{e}");
+    assert!(!staged.get(), "nothing was staged");
+    assert_eq!(std::fs::read(&target).unwrap(), b"OLD");
+    assert!(std::fs::metadata(&target).unwrap().permissions().readonly(), "still read-only");
+    assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1, "no staging file is left");
+    #[allow(clippy::permissions_set_readonly_false)]
+    perms.set_readonly(false);
+    std::fs::set_permissions(&target, perms).unwrap();
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn running_out_of_suffixes_refuses_and_creates_nothing() {
+    let dir = test_dir("empty");
+    let e = create_staging(&dir, "out.pdf", StagingName::TagThenSuffix, []).unwrap_err();
+    assert_eq!(e.kind(), std::io::ErrorKind::AlreadyExists);
+    assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 0);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn only_the_first_sixteen_names_are_tried() {
+    let dir = test_dir("cap");
+    let name = |s: u64| dir.join(format!(".out.pdf.{s:016x}.pdfcraft-tmp"));
+    for s in 1..=STAGING_ATTEMPTS as u64 {
+        std::fs::write(name(s), "PLANTED").unwrap();
+    }
+    assert!(create_staging(&dir, "out.pdf", StagingName::SuffixThenTag, 1..).is_err());
+    assert!(!name(STAGING_ATTEMPTS as u64 + 1).exists(), "a 17th name was tried");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// `write_atomically`: the target holds the new bytes only once they are complete; a refused
+/// flush leaves the old file and removes the staging file; a missing folder writes nothing.
+#[test]
+fn an_atomic_write_replaces_the_target_only_when_complete() {
+    let dir = test_dir("write");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, b"OLD").unwrap();
+    let names = |dir: &Path| {
+        let mut v: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| file_name(&e.unwrap().path())).collect();
+        v.sort();
+        v
+    };
+    // The staging file is written and flushed before the target changes.
+    let mut seen_old = false;
+    write_atomically_with(&target, b"NEW", StagingName::SuffixThenTag, [7], |f| {
+        seen_old = std::fs::read(&target).unwrap() == b"OLD" && f.metadata().unwrap().len() == 3;
+        Ok(())
+    })
+    .unwrap();
+    assert!(seen_old, "flushed before publication, with the target still the old file");
+    assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+    assert_eq!(names(&dir), ["out.pdf"], "no staging file is left");
+    // A refused flush keeps the target and cleans up.
+    let e = write_atomically_with(&target, b"NEWER", StagingName::TagThenSuffix, [8], |_| Err(std::io::Error::other("refused"))).unwrap_err();
+    assert!(e.to_string().contains("refused"));
+    assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+    assert_eq!(names(&dir), ["out.pdf"]);
+    // A folder that does not exist: nothing is written anywhere.
+    assert!(write_atomically(&dir.join("missing").join("out.pdf"), b"X", StagingName::SuffixThenTag).is_err());
+    assert_eq!(names(&dir), ["out.pdf"]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn atomic_saves_keep_finder_tags_and_binary_extended_attributes() {
+    use rustix::fs::{XattrFlags, fgetxattr, setxattr};
+    use std::os::macos::fs::FileTimesExt as _;
+    let dir = test_dir("xattrs");
+    let target = dir.join("out.pdf");
+    let attributes: &[(&str, &[u8])] = &[
+        ("com.apple.metadata:_kMDItemUserTags", b"<plist version=\"1.0\"><array><string>PdfCraft\n6</string></array></plist>"),
+        ("com.pdfcraft.test.binary", b"\0\xff\x80original\0"),
+        ("com.pdfcraft.test.empty", b""),
+    ];
+    std::fs::write(&target, b"OLD").unwrap();
+    for (name, value) in attributes {
+        setxattr(&target, *name, value, XattrFlags::empty()).unwrap();
+    }
+    let created = std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(1_577_934_245);
+    let original = std::fs::OpenOptions::new().write(true).open(&target).unwrap();
+    original.set_times(std::fs::FileTimes::new().set_created(created)).unwrap();
+    assert_eq!(original.metadata().unwrap().created().unwrap(), created);
+    drop(original);
+    // Both desktop and automation name forms, including a second save of the replacement.
+    for form in [StagingName::TagThenSuffix, StagingName::SuffixThenTag] {
+        write_atomically_with(&target, b"NEW", form, [7], |staged| {
+            assert_eq!(staged.metadata().unwrap().created().unwrap(), created, "creation date must survive attribute copying before flush");
+            for (name, value) in attributes {
+                let mut bytes = [0u8; 256];
+                let len = fgetxattr(staged, *name, &mut bytes[..]).unwrap();
+                assert_eq!(&bytes[..len], *value, "metadata must be present before flush: {name}");
+            }
+            Ok(())
+        })
+        .unwrap();
+        let saved = std::fs::File::open(&target).unwrap();
+        assert_eq!(saved.metadata().unwrap().created().unwrap(), created);
+        for (name, value) in attributes {
+            let mut bytes = [0u8; 256];
+            let len = fgetxattr(&saved, *name, &mut bytes[..]).unwrap();
+            assert_eq!(&bytes[..len], *value);
+        }
+        assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
+    }
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn a_failed_flush_keeps_the_original_extended_attributes() {
+    use rustix::fs::{XattrFlags, getxattr, setxattr};
+    let dir = test_dir("xattrs-flush");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, b"OLD").unwrap();
+    setxattr(&target, "com.pdfcraft.test", b"original", XattrFlags::empty()).unwrap();
+    let e = write_atomically_with(&target, b"NEW", StagingName::TagThenSuffix, [9], |_| Err(std::io::Error::other("flush refused"))).unwrap_err();
+    assert!(e.to_string().contains("flush refused"));
+    assert_eq!(std::fs::read(&target).unwrap(), b"OLD");
+    let mut value = [0u8; 64];
+    let len = getxattr(&target, "com.pdfcraft.test", &mut value[..]).unwrap();
+    assert_eq!(&value[..len], b"original");
+    assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+/// Model an HFS-style partial read while using real macOS metadata and the atomic writer.
+/// The shared read validator must reject growth before the staging file can be published.
+#[cfg(target_os = "macos")]
+#[test]
+fn a_growing_resource_fork_refuses_publication_and_keeps_original() {
+    use rustix::fs::{XattrFlags, fgetxattr, fsetxattr, getxattr, setxattr};
+    let dir = test_dir("xattrs-growing-fork");
+    let target = dir.join("out.pdf");
+    let name = "com.apple.ResourceFork";
+    for form in [StagingName::TagThenSuffix, StagingName::SuffixThenTag] {
+        std::fs::write(&target, b"ORIGINAL PDF").unwrap();
+        setxattr(&target, name, b"ABC", XattrFlags::empty()).unwrap();
+        let source = std::fs::File::open(&target).unwrap();
+        let result = write_atomically_with(&target, b"REPLACEMENT PDF", form, [23], |staged| {
+            let size = fgetxattr(&source, name, &mut [] as &mut [u8])?;
+            let value = read_xattr_value(size, |buffer| {
+                if buffer.is_empty() {
+                    return Ok(fgetxattr(&source, name, buffer)?);
+                }
+                // HFS can return the prefix that fits instead of ERANGE. APFS need not
+                // have that behaviour: model the kernel response, not a timing race.
+                setxattr(&target, name, b"ABCD", XattrFlags::empty())?;
+                buffer.get_mut(..3).unwrap().copy_from_slice(b"ABC");
+                Ok(3)
+            })?;
+            fsetxattr(staged, name, &value, XattrFlags::empty())?;
+            Ok(())
+        });
+        let error = result.expect_err("a short prefix of the grown fork must not be published");
+        assert!(error.to_string().contains("changed size"), "{error}");
+        assert_eq!(std::fs::read(&target).unwrap(), b"ORIGINAL PDF");
+        let mut bytes = [0u8; 8];
+        let len = getxattr(&target, name, &mut bytes[..]).unwrap();
+        assert_eq!(&bytes[..len], b"ABCD", "the original's grown fork must remain intact");
+        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1, "staging files are removed on refusal");
+    }
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+/// Stable empty/binary values are accepted; short reads, growth and failed rechecks are refused.
+#[cfg(target_os = "macos")]
+#[test]
+fn attribute_reads_require_a_complete_value_and_stable_size() {
+    for bytes in [&b""[..], &b"\0\xffB"[..]] {
+        let value = read_xattr_value(bytes.len(), |buffer| {
+            if !buffer.is_empty() {
+                buffer.get_mut(..bytes.len()).unwrap().copy_from_slice(bytes);
+            }
+            Ok(bytes.len())
+        })
+        .unwrap();
+        assert_eq!(value, bytes);
+    }
+    for (before, read_len, after) in [(3, 2, 3), (3, 3, 4), (0, 1, 1), (3, 2, 2)] {
+        let result = read_xattr_value(before, |buffer| Ok(if buffer.is_empty() { after } else { read_len }));
+        assert!(result.unwrap_err().to_string().contains("changed size"));
+    }
+    let result = read_xattr_value(3, |buffer| {
+        if buffer.is_empty() { Err(std::io::Error::new(std::io::ErrorKind::PermissionDenied, "size recheck refused")) } else { Ok(3) }
+    });
+    assert_eq!(result.unwrap_err().kind(), std::io::ErrorKind::PermissionDenied);
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn oversized_extended_attributes_refuse_the_save_without_replacing_the_target() {
+    use rustix::fs::{XattrFlags, getxattr, setxattr};
+    let dir = test_dir("xattrs-limit");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, b"OLD").unwrap();
+    // A resource fork can exceed the ordinary attribute limit on macOS. No fixture file
+    // is committed; only the OS metadata of this temporary synthetic file holds the bytes.
+    let fork = vec![42u8; 16 * 1024 * 1024 + 1];
+    setxattr(&target, "com.apple.ResourceFork", &fork, XattrFlags::empty()).unwrap();
+    let mut flushed = false;
+    let e = write_atomically_with(&target, b"NEW", StagingName::TagThenSuffix, [10], |_| {
+        flushed = true;
+        Ok(())
+    })
+    .unwrap_err();
+    assert!(e.to_string().contains("extended attributes"), "{e}");
+    assert!(e.to_string().contains("Save As"), "{e}");
+    assert!(!flushed, "metadata failure must stop before flush and rename");
+    assert_eq!(std::fs::read(&target).unwrap(), b"OLD");
+    let size = getxattr(&target, "com.apple.ResourceFork", &mut [] as &mut [u8]).unwrap();
+    assert_eq!(size, fork.len());
+    assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn replacing_a_symlink_does_not_copy_attributes_from_its_referent() {
+    use rustix::fs::{XattrFlags, getxattr, setxattr};
+    let dir = test_dir("xattrs-symlink");
+    let outside = test_dir("xattrs-outside").join("private.pdf");
+    std::fs::write(&outside, b"PRIVATE").unwrap();
+    setxattr(&outside, "com.pdfcraft.test", b"private metadata", XattrFlags::empty()).unwrap();
+    let target = dir.join("out.pdf");
+    std::os::unix::fs::symlink(&outside, &target).unwrap();
+    write_atomically(&target, b"NEW", StagingName::TagThenSuffix).unwrap();
+    assert_eq!(std::fs::read(&outside).unwrap(), b"PRIVATE");
+    assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+    assert!(!target.symlink_metadata().unwrap().file_type().is_symlink());
+    let mut bytes = [0u8; 64];
+    assert_eq!(getxattr(&target, "com.pdfcraft.test", &mut bytes[..]).unwrap_err(), rustix::io::Errno::NOATTR);
+    let len = getxattr(&outside, "com.pdfcraft.test", &mut bytes[..]).unwrap();
+    assert_eq!(&bytes[..len], b"private metadata");
+    std::fs::remove_dir_all(dir).unwrap();
+    std::fs::remove_dir_all(outside.parent().unwrap()).unwrap();
+}
+
+/// #1790: a replaced file keeps its permissions, and its staging file already has them while
+/// it is written; a new file gets the same mode as any other new file.
+#[cfg(unix)]
+#[test]
+fn a_replaced_file_keeps_its_permissions() {
+    use std::os::unix::fs::PermissionsExt as _;
+    let dir = test_dir("modes");
+    let mode = |p: &Path| std::fs::metadata(p).unwrap().permissions().mode() & 0o777;
+    let target = dir.join("out.pdf");
+    for keep in [0o600, 0o640, 0o664] {
+        std::fs::write(&target, b"OLD").unwrap();
+        std::fs::set_permissions(&target, std::fs::Permissions::from_mode(keep)).unwrap();
+        let mut staged = 0;
+        write_atomically_with(&target, b"NEW", StagingName::SuffixThenTag, [keep as u64], |f| {
+            staged = f.metadata()?.permissions().mode() & 0o777;
+            Ok(())
+        })
+        .unwrap();
+        assert_eq!(staged, keep, "the staging file has the target's mode before it is flushed");
+        assert_eq!(mode(&target), keep, "the saved file keeps mode {keep:o}");
+        assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+    }
+    let fresh = dir.join("new.pdf");
+    write_atomically(&fresh, b"NEW", StagingName::TagThenSuffix).unwrap();
+    let plain = dir.join("plain");
+    std::fs::write(&plain, b"").unwrap();
+    assert_eq!(mode(&fresh), mode(&plain), "a new file is not made private");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A replaced file keeps its group as well as its mode, so group permissions never reach a
+/// group that couldn't read the file before (the saver's own group, by default).
+#[cfg(target_os = "linux")]
+#[test]
+fn a_replaced_file_keeps_its_group() {
+    use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+    let dir = test_dir("group");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, b"OLD").unwrap();
+    let created = std::fs::metadata(&target).unwrap().gid();
+    let status = std::fs::read_to_string("/proc/self/status").unwrap();
+    let groups = status.lines().find_map(|l| l.strip_prefix("Groups:")).unwrap_or_default();
+    let Some(other) = groups.split_whitespace().filter_map(|g| g.parse::<u32>().ok()).find(|&g| g != created) else {
+        eprintln!("skipped: the test needs a second group");
+        return;
+    };
+    std::os::unix::fs::chown(&target, None, Some(other)).unwrap();
+    std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o640)).unwrap();
+    let mut staged = (0, 0);
+    write_atomically_with(&target, b"NEW", StagingName::SuffixThenTag, [7], |f| {
+        let m = f.metadata()?;
+        staged = (m.gid(), m.permissions().mode() & 0o777);
+        Ok(())
+    })
+    .unwrap();
+    assert_eq!(staged, (other, 0o640), "the staging file has the target's group before it is flushed");
+    let m = std::fs::metadata(&target).unwrap();
+    assert_eq!((m.gid(), m.permissions().mode() & 0o777), (other, 0o640));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// #2658: a save replaces the file, but the document is the same one: it keeps its creation
+/// date where the system lets a program set it.
+#[cfg(any(windows, target_os = "macos"))]
+#[test]
+fn a_replaced_file_keeps_its_creation_date() {
+    #[cfg(target_os = "macos")]
+    use std::os::macos::fs::FileTimesExt as _;
+    #[cfg(windows)]
+    use std::os::windows::fs::FileTimesExt as _;
+    let dir = test_dir("created");
+    let target = dir.join("doc.pdf");
+    std::fs::write(&target, b"OLD").unwrap();
+    // 2020-01-02 03:04:05 UTC.
+    let then = std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(1_577_934_245);
+    let file = std::fs::OpenOptions::new().write(true).open(&target).unwrap();
+    file.set_times(std::fs::FileTimes::new().set_created(then)).unwrap();
+    drop(file);
+    assert_eq!(std::fs::metadata(&target).unwrap().created().unwrap(), then, "the fixture's date is set");
+    write_atomically(&target, b"NEW", StagingName::SuffixThenTag).unwrap();
+    assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+    assert_eq!(std::fs::metadata(&target).unwrap().created().unwrap(), then, "the saved file keeps its creation date");
+    // A new file gets a date of its own.
+    let fresh = dir.join("new.pdf");
+    write_atomically(&fresh, b"NEW", StagingName::SuffixThenTag).unwrap();
+    assert!(std::fs::metadata(&fresh).unwrap().created().unwrap() > then);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// #4593: a save replaces the file, so a hidden or system file stays hidden or system, and
+/// its staging file already is while it is written; a plain file stays plain, though the
+/// staging name starts with a dot; a new file gets no attribute from anywhere.
+#[cfg(windows)]
+#[test]
+fn a_replaced_file_keeps_its_hidden_and_system_attributes() {
+    use std::os::windows::fs::{MetadataExt as _, OpenOptionsExt as _};
+    const HIDDEN: u32 = 0x2;
+    const SYSTEM: u32 = 0x4;
+    let dir = test_dir("attributes");
+    let kept = |p: &Path| std::fs::metadata(p).unwrap().file_attributes() & (HIDDEN | SYSTEM);
+    for (i, keep) in [0, HIDDEN, SYSTEM, HIDDEN | SYSTEM].into_iter().enumerate() {
+        let target = dir.join(format!("doc{i}.pdf"));
+        let mut fixture = std::fs::OpenOptions::new().write(true).create_new(true).attributes(keep).open(&target).unwrap();
+        std::io::Write::write_all(&mut fixture, b"OLD").unwrap();
+        drop(fixture);
+        assert_eq!(kept(&target), keep, "the fixture has attributes {keep:#x}");
+        for form in [StagingName::TagThenSuffix, StagingName::SuffixThenTag] {
+            let mut staged = u32::MAX;
+            write_atomically_with(&target, b"NEW", form, [i as u64], |f| {
+                staged = f.metadata()?.file_attributes() & (HIDDEN | SYSTEM);
+                Ok(())
+            })
+            .unwrap();
+            assert_eq!(staged, keep, "the staging file has the target's attributes before it is flushed");
+            assert_eq!(kept(&target), keep, "the saved file keeps attributes {keep:#x}");
+            assert_eq!(std::fs::read(&target).unwrap(), b"NEW");
+        }
+    }
+    let fresh = dir.join("new.pdf");
+    write_atomically(&fresh, b"NEW", StagingName::TagThenSuffix).unwrap();
+    assert_eq!(kept(&fresh), 0, "a new file is neither hidden nor system");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A save replaces a symbolic link, not the file it points to, so the saved file takes the
+/// link's own attributes: a plain link to a hidden file saves as a plain file, and the file
+/// it pointed to is left as it was.
+#[cfg(windows)]
+#[test]
+fn a_replaced_link_keeps_its_own_attributes_not_its_targets() {
+    use std::os::windows::fs::{MetadataExt as _, OpenOptionsExt as _};
+    const HIDDEN: u32 = 0x2;
+    let dir = test_dir("link-attributes");
+    let referent = dir.join("referent.pdf");
+    let mut fixture = std::fs::OpenOptions::new().write(true).create_new(true).attributes(HIDDEN).open(&referent).unwrap();
+    std::io::Write::write_all(&mut fixture, b"OLD").unwrap();
+    drop(fixture);
+    let link = dir.join("link.pdf");
+    if let Err(e) = std::os::windows::fs::symlink_file(&referent, &link) {
+        eprintln!("skipped: creating a symbolic link needs Developer Mode or administrator rights ({e})");
+        let _ = std::fs::remove_dir_all(&dir);
+        return;
+    }
+    assert_eq!(std::fs::symlink_metadata(&link).unwrap().file_attributes() & HIDDEN, 0, "the link itself is visible");
+    write_atomically(&link, b"NEW", StagingName::TagThenSuffix).unwrap();
+    let saved = std::fs::symlink_metadata(&link).unwrap();
+    assert!(!saved.file_type().is_symlink(), "the save replaced the link");
+    assert_eq!(saved.file_attributes() & HIDDEN, 0, "the link was visible, so the saved file is");
+    assert_eq!(std::fs::read(&link).unwrap(), b"NEW");
+    assert_eq!(std::fs::read(&referent).unwrap(), b"OLD", "the file the link pointed to is untouched");
+    assert_ne!(std::fs::metadata(&referent).unwrap().file_attributes() & HIDDEN, 0, "and still hidden");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/print/src/error.rs b/crates/print/src/error.rs
new file mode 100644
index 0000000000..4b1fe95f21
--- /dev/null
+++ b/crates/print/src/error.rs
@@ -0,0 +1,84 @@
+/// What can go wrong when printing.
+///
+/// The three things a *person* can be wrong about — there is nothing to print, a page number past
+/// the end, a range that is not a page — each have their own variant with the numbers apart from
+/// the words, so an interface can say them in its own language with [`PrintError::said`]. The rest
+/// are faults rather than mistakes and carry their text as it is.
+#[derive(Debug, thiserror::Error, PartialEq)]
+pub enum PrintError {
+    #[error("there are no pages to print")]
+    NoPages,
+    /// A page number past the end of the document: the number asked for, and the page count.
+    #[error("page {0} is out of range (1–{1})")]
+    OutOfRange(usize, usize),
+    /// A range token that is neither a page number nor a page label.
+    #[error("{0:?} is not a page number or label")]
+    NotAPage(String),
+    #[error("{0}")]
+    Invalid(String),
+    #[error("{0}")]
+    Spool(String),
+    #[error(transparent)]
+    Cos(#[from] pdfcraft_cos::CosError),
+}
+
+/// How an interface says one of our wordings in its own language, holes and all: given the English
+/// in [`WORDINGS`], the same wording in that language. [`in_english`] keeps the English.
+pub type Words<'a> = &'a dyn Fn(&str) -> String;
+
+/// The [`Words`] that translate nothing: the wording as it is written here.
+pub fn in_english(wording: &str) -> String {
+    wording.to_owned()
+}
+
+/// What a person can get wrong about what to print, in English, with their holes still in them.
+///
+/// An interface that reports these in another language translates these three, which is the whole
+/// reason they are gathered here; `wordings_are_said` keeps them in step with the errors.
+pub const WORDINGS: &[&str] = &["there are no pages to print", "page {n} is out of range (1–{count})", "{page} is not a page number or label"];
+
+impl PrintError {
+    /// This error as one sentence, said in the language `words` translates into.
+    ///
+    /// The wording is translated and the numbers go in afterwards, in a single pass, so what the
+    /// person typed cannot be read as a hole. With [`in_english`] this is the error's own
+    /// `Display`, which is what the command line and scripts report.
+    pub fn said(&self, words: Words) -> String {
+        match self {
+            PrintError::NoPages => words("there are no pages to print"),
+            PrintError::OutOfRange(n, count) => {
+                say(&words("page {n} is out of range (1–{count})"), &[("{n}", n.to_string()), ("{count}", count.to_string())])
+            }
+            // The token goes in quoted, the way it is typed, as the error itself prints it.
+            PrintError::NotAPage(token) => say(&words("{page} is not a page number or label"), &[("{page}", format!("{token:?}"))]),
+            fault => fault.to_string(),
+        }
+    }
+}
+
+/// A wording with its holes filled.
+///
+/// A hole is a name in braces, such as `{n}`; what is not in `values` is left as it is written.
+/// Values go in during a single pass, so a value with braces in it is never read as a hole.
+fn say(wording: &str, values: &[(&str, String)]) -> String {
+    let mut out = String::with_capacity(wording.len() + 8);
+    let mut rest = wording;
+    while let Some(open) = rest.find('{') {
+        let (before, from_brace) = rest.split_at(open);
+        out.push_str(before);
+        // `find` counts from the brace and `}` is one byte, so this is a char boundary.
+        let Some(close) = from_brace.find('}') else {
+            // A brace with nothing closing it is just text.
+            out.push_str(from_brace);
+            return out;
+        };
+        let Some(hole) = from_brace.get(..=close) else { return out + from_brace };
+        match values.iter().find(|(name, _)| *name == hole) {
+            Some((_, value)) => out.push_str(value),
+            None => out.push_str(hole),
+        }
+        rest = from_brace.get(close + 1..).unwrap_or_default();
+    }
+    out.push_str(rest);
+    out
+}
diff --git a/crates/print/src/imposition.rs b/crates/print/src/imposition.rs
new file mode 100644
index 0000000000..1257bcf25e
--- /dev/null
+++ b/crates/print/src/imposition.rs
@@ -0,0 +1,348 @@
+use super::error::PrintError;
+use super::settings::{Content, Settings};
+use super::sheets::{Sheet, layout};
+use super::*;
+
+// Model-derived transforms and clipping bounds need their full PDF decimal precision.
+fn geometry_number(value: f64) -> String {
+    let mut bytes = Vec::new();
+    pdfcraft_cos::serialize(&Object::Real(value), &mut bytes);
+    String::from_utf8_lossy(&bytes).into_owned()
+}
+
+fn n(v: f64) -> String {
+    let s = format!("{v:.4}");
+    let s = s.trim_end_matches('0').trim_end_matches('.');
+    if s == "-0" { "0".into() } else { s.into() }
+}
+
+/// The page's content streams decoded against `budget` and joined; streams that don't decode
+/// are left out. `None` when the budget ran out, so part of the content is missing.
+pub(crate) fn decoded_contents(doc: &Document, page: &Dict, budget: &mut DecodeBudget) -> Option<Vec<u8>> {
+    let Some(contents) = page.get(b"Contents") else { return Some(Vec::new()) };
+    let mut out = Vec::new();
+    for data in budget.decode_contents(doc, contents) {
+        match data {
+            Ok(data) => {
+                out.extend_from_slice(&data);
+                out.push(b'\n');
+            }
+            Err(_) if budget.remaining() == 0 => return None,
+            Err(_) => {}
+        }
+    }
+    Some(out)
+}
+
+/// Reduce `doc`'s pages to what [`impose`] draws of them under `content`: the annotations that
+/// don't print are dropped, and with [`Content::FormFieldsOnly`] the page content too. For
+/// printing pages as pictures, where a renderer draws each page as it stands.
+pub fn keep_printed(doc: &mut Document, content: Content) {
+    for page in pdfcraft_model::pages(doc) {
+        let annots = page.dict.get(b"Annots").and_then(|a| doc.resolve(a).as_array().cloned()).unwrap_or_default();
+        let kept: Vec<Object> = annots.into_iter().filter(|a| doc.resolve(a).as_dict().is_some_and(|d| prints(doc, d, content))).collect();
+        // Fails only when the page object isn't a dictionary, and such a page draws nothing.
+        let _ = doc.update_dict(page.obj, |d| {
+            if content == Content::FormFieldsOnly {
+                d.remove(b"Contents");
+            }
+            if d.contains(b"Annots") {
+                d.set(b"Annots".to_vec(), Object::Array(kept));
+            }
+        });
+    }
+}
+
+/// The standard annotation types of ISO 32000-2 Table 171.
+const STANDARD_ANNOTATION_TYPES: [&[u8]; 28] = [
+    b"Text",
+    b"Link",
+    b"FreeText",
+    b"Line",
+    b"Square",
+    b"Circle",
+    b"Polygon",
+    b"PolyLine",
+    b"Highlight",
+    b"Underline",
+    b"Squiggly",
+    b"StrikeOut",
+    b"Caret",
+    b"Stamp",
+    b"Ink",
+    b"Popup",
+    b"FileAttachment",
+    b"Sound",
+    b"Movie",
+    b"Screen",
+    b"Widget",
+    b"PrinterMark",
+    b"TrapNet",
+    b"Watermark",
+    b"3D",
+    b"Redact",
+    b"Projection",
+    b"RichMedia",
+];
+
+/// Does annotation `d` print under `content`?
+pub(crate) fn prints(doc: &Document, d: &Dict, content: Content) -> bool {
+    const INVISIBLE: i64 = 1;
+    const HIDDEN: i64 = 2;
+    const PRINT: i64 = 4;
+    let flags = d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
+    if flags & PRINT == 0 || flags & HIDDEN != 0 {
+        return false;
+    }
+    // `/Subtype` may be an indirect reference (ISO 32000-2 §7.3.10), so resolve it first.
+    let subtype_obj = d.get(b"Subtype").map(|s| doc.resolve(s));
+    let subtype = subtype_obj.as_deref().and_then(Object::as_name).unwrap_or(b"");
+    match subtype {
+        b"Widget" => true,
+        b"Link" | b"Popup" => false,
+        b"Stamp" => content != Content::Document && content != Content::FormFieldsOnly,
+        // ISO 32000-2 Table 167: an Invisible annotation of a type that isn't standard (Table
+        // 171) is not printed even with its Print flag set.
+        _ if flags & INVISIBLE != 0 && !STANDARD_ANNOTATION_TYPES.contains(&subtype) => false,
+        _ => content == Content::DocumentAndMarkups,
+    }
+}
+
+/// The normal appearance stream to draw for an annotation (honouring `/AS`).
+pub(crate) fn appearance(doc: &Document, d: &Dict) -> Option<ObjRef> {
+    let ap = doc.resolve(d.get(b"AP")?);
+    let normal = ap.as_dict()?.get(b"N")?.clone();
+    match &*doc.resolve(&normal) {
+        Object::Stream(_) => normal.as_ref(),
+        Object::Dict(states) => {
+            let state = d.name(b"AS")?;
+            states.get(state)?.as_ref()
+        }
+        _ => None,
+    }
+}
+
+/// Algorithm 8.1: the matrix placing an appearance form (BBox × Matrix) onto the annotation rect.
+pub(crate) fn appearance_matrix(doc: &Document, form: &Dict, rect: [f64; 4]) -> Option<Matrix> {
+    let nums =
+        |k: &[u8]| -> Option<Vec<f64>> { Some(doc.resolve(form.get(k)?).as_array()?.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()) };
+    let bbox = nums(b"BBox").filter(|b| b.len() == 4)?;
+    let m = nums(b"Matrix").filter(|m| m.len() == 6).map(|m| Matrix([m[0], m[1], m[2], m[3], m[4], m[5]])).unwrap_or_default();
+    let b = m.bbox([bbox[0], bbox[1], bbox[2], bbox[3]]);
+    let (bw, bh) = (b[2] - b[0], b[3] - b[1]);
+    if bw <= 0.0 || bh <= 0.0 {
+        return None;
+    }
+    let a = Matrix([
+        (rect[2] - rect[0]) / bw,
+        0.0,
+        0.0,
+        (rect[3] - rect[1]) / bh,
+        rect[0] - b[0] * (rect[2] - rect[0]) / bw,
+        rect[1] - b[1] * (rect[3] - rect[1]) / bh,
+    ]);
+    // The Do that draws the form applies its /Matrix itself, so only the placement goes here.
+    Some(a)
+}
+
+/// A Form XObject holding page `index` as it prints (user space; BBox = crop box).
+/// `pages` are the document's pages, listed once by the caller: listing them for each page
+/// printed would make printing quadratic in the page count.
+pub(crate) fn page_form(
+    doc: &mut Document,
+    pages: &[pdfcraft_model::Page],
+    index: usize,
+    content: Content,
+    promoted: &mut std::collections::HashMap<ObjRef, ObjRef>,
+) -> Result<ObjRef, PrintError> {
+    let page = pages.get(index).ok_or_else(|| PrintError::Invalid(format!("there is no page {}", index.saturating_add(1))))?;
+    let crop = page.crop(doc);
+    let mut res = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
+    let mut body = if content == Content::FormFieldsOnly {
+        Vec::new()
+    } else {
+        decoded_contents(doc, &page.dict, &mut DecodeBudget::page())
+            .ok_or_else(|| PrintError::Invalid(format!("page {} has more content than can be printed", index + 1)))?
+    };
+    // Wrap the page content so a state it leaves behind can't affect the annotations.
+    if !body.is_empty() {
+        let mut wrapped = b"q\n".to_vec();
+        wrapped.extend_from_slice(&body);
+        wrapped.extend_from_slice(b"\nQ\n");
+        body = wrapped;
+    }
+    let annots = page.dict.get(b"Annots").and_then(|a| doc.resolve(a).as_array().cloned()).unwrap_or_default();
+    let mut xobjects = res.get(b"XObject").and_then(|x| doc.resolve(x).as_dict().cloned()).unwrap_or_default();
+    let mut k = 0usize;
+    for a in annots {
+        let Some(d) = doc.resolve(&a).as_dict().cloned() else { continue };
+        if !prints(doc, &d, content) {
+            continue;
+        }
+        let rect: Vec<f64> =
+            d.get(b"Rect").and_then(|r| doc.resolve(r).as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default();
+        if rect.len() != 4 {
+            continue;
+        }
+        let rect = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
+        let Some(ap) = appearance(doc, &d) else { continue };
+        let form = doc.get(ap).as_dict().cloned().unwrap_or_default();
+        let Some(m) = appearance_matrix(doc, &form, rect) else { continue };
+        let ap = if !form.contains(b"Subtype")
+            && let Object::Stream(stream) = &*doc.get(ap)
+        {
+            // Some existing annotation appearances omit Subtype, but Do dispatch needs a Form XObject.
+            // Keep the original intact: other document objects can share this appearance.
+            if let Some(&cached) = promoted.get(&ap) {
+                cached
+            } else {
+                let mut stream = stream.clone();
+                stream.dict.set(b"Subtype".to_vec(), Object::name("Form"));
+                let copy = doc.add(Object::Stream(stream));
+                promoted.insert(ap, copy);
+                copy
+            }
+        } else {
+            ap
+        };
+        // Keep the page's own XObjects, including names previous print operations generated.
+        // Check the growing map so each appearance also keeps the name just assigned to it.
+        let name = loop {
+            let name = format!("PCPrA{k}");
+            k = k.checked_add(1).ok_or_else(|| PrintError::Invalid("too many annotation appearance resources".into()))?;
+            if !xobjects.contains(name.as_bytes()) {
+                break name;
+            }
+        };
+        let [a0, b0, c0, d0, e0, f0] = m.0;
+        body.extend(format!("q {} {} {} {} {} {} cm /{name} Do Q\n", n(a0), n(b0), n(c0), n(d0), n(e0), n(f0)).bytes());
+        xobjects.set(name.into_bytes(), Object::Ref(ap));
+    }
+    if !xobjects.is_empty() {
+        res.set(b"XObject".to_vec(), Object::Dict(xobjects));
+    }
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Form"));
+    d.set(b"BBox".to_vec(), Object::Array(crop.iter().map(|v| Object::Real(*v)).collect()));
+    d.set(b"Resources".to_vec(), Object::Dict(res));
+    if let Some(g) = page.dict.get(b"Group") {
+        d.set(b"Group".to_vec(), g.clone());
+    }
+    Ok(doc.add(Object::Stream(Stream::flate(d, &body))))
+}
+
+#[cfg(test)]
+thread_local! {
+    /// Pages listed by [`source_pages`] on this thread.
+    pub(crate) static PAGES_LISTED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// The source document's pages, for printing.
+fn source_pages(doc: &Document) -> Vec<pdfcraft_model::Page> {
+    let pages = pdfcraft_model::pages(doc);
+    #[cfg(test)]
+    PAGES_LISTED.with(|c| c.set(c.get() + pages.len()));
+    pages
+}
+
+/// Build the print-ready PDF for `settings`. Encryption is not carried over (the file goes to a
+/// printer or is the user's own copy); callers must check the print permission first.
+pub fn impose(src: &Document, settings: &Settings) -> Result<Vec<u8>, PrintError> {
+    let pages = source_pages(src);
+    let sizes: Vec<(f64, f64)> = pages.iter().map(|p| p.display_size(src)).collect();
+    let sheets = layout(&sizes, settings)?;
+    let mut doc = src.clone();
+    // One form per source page used (a page may appear on several sheets: posters).
+    let mut forms: std::collections::HashMap<usize, ObjRef> = std::collections::HashMap::new();
+    let mut promoted = std::collections::HashMap::new();
+    let views: Vec<[f64; 6]> = pages.iter().map(|p| p.view_matrix(src)).collect();
+    let pages_root = doc.add(Object::Null);
+    let mut kids = Vec::new();
+    for sheet in &sheets {
+        let mut c = String::new();
+        let mut xo = Dict::new();
+        for (i, pl) in sheet.placed.iter().enumerate() {
+            let form = match forms.get(&pl.page) {
+                Some(f) => *f,
+                None => {
+                    let f = page_form(&mut doc, &pages, pl.page, settings.content, &mut promoted)?;
+                    forms.insert(pl.page, f);
+                    f
+                }
+            };
+            let name = format!("P{i}");
+            xo.set(name.clone().into_bytes(), Object::Ref(form));
+            // Display space → sheet, then clip to the visible part, then user → display.
+            let [a, b, cc, d, e, f] = pl.matrix.0;
+            let to_display = Matrix(views[pl.page]).invert().unwrap_or_default();
+            let [ua, ub, uc, ud, ue, uf] = to_display.0;
+            let [x0, y0, x1, y1] = pl.clip;
+            c.push_str(&format!(
+                "q {} {} {} {} {} {} cm {} {} {} {} re W n {} {} {} {} {} {} cm /{name} Do Q\n",
+                geometry_number(a),
+                geometry_number(b),
+                geometry_number(cc),
+                geometry_number(d),
+                geometry_number(e),
+                geometry_number(f),
+                geometry_number(x0),
+                geometry_number(y0),
+                geometry_number(x1 - x0),
+                geometry_number(y1 - y0),
+                geometry_number(ua),
+                geometry_number(ub),
+                geometry_number(uc),
+                geometry_number(ud),
+                geometry_number(ue),
+                geometry_number(uf)
+            ));
+        }
+        if !sheet.borders.is_empty() || !sheet.lines.is_empty() {
+            c.push_str("q 0 G 0.5 w\n");
+            for r in &sheet.borders {
+                c.push_str(&format!("{} {} {} {} re S\n", n(r[0]), n(r[1]), n(r[2] - r[0]), n(r[3] - r[1])));
+            }
+            for l in &sheet.lines {
+                c.push_str(&format!("{} {} m {} {} l S\n", n(l[0]), n(l[1]), n(l[2]), n(l[3])));
+            }
+            c.push_str("Q\n");
+        }
+        let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), c.as_bytes())));
+        let mut res = Dict::new();
+        res.set(b"XObject".to_vec(), Object::Dict(xo));
+        let mut p = Dict::new();
+        p.set(b"Type".to_vec(), Object::name("Page"));
+        p.set(b"Parent".to_vec(), Object::Ref(pages_root));
+        p.set(b"MediaBox".to_vec(), Object::Array([0.0, 0.0, sheet.size.0, sheet.size.1].iter().map(|v| Object::Real(*v)).collect()));
+        p.set(b"Resources".to_vec(), Object::Dict(res));
+        p.set(b"Contents".to_vec(), Object::Ref(contents));
+        kids.push(Object::Ref(doc.add(Object::Dict(p))));
+    }
+    let mut tree = Dict::new();
+    tree.set(b"Type".to_vec(), Object::name("Pages"));
+    tree.set(b"Count".to_vec(), Object::Int(kids.len() as i64));
+    tree.set(b"Kids".to_vec(), Object::Array(kids));
+    doc.set(pages_root, Object::Dict(tree));
+    let mut cat = Dict::new();
+    cat.set(b"Type".to_vec(), Object::name("Catalog"));
+    cat.set(b"Pages".to_vec(), Object::Ref(pages_root));
+    // Keep the layers' configuration, or a layer that is off in the document would print: the
+    // pages' marked content still refers to its groups, and without this nothing says they are off.
+    let layers = src.trailer().get(b"Root").and_then(|r| src.resolve(r).as_dict().and_then(|root| root.get(b"OCProperties").cloned()));
+    if let Some(layers) = layers {
+        cat.set(b"OCProperties".to_vec(), layers);
+    }
+    let root = doc.add(Object::Dict(cat));
+    doc.trailer_mut().set(b"Root".to_vec(), Object::Ref(root));
+    doc.trailer_mut().remove(b"Info");
+    if doc.trailer().contains(b"Encrypt") {
+        doc.remove_encryption();
+    }
+    Ok(write_full(&doc, &SaveOptions::default())?)
+}
+
+/// Which source pages land on each sheet (for previews and the sheet count).
+pub fn sheet_pages(sheets: &[Sheet]) -> Vec<Vec<usize>> {
+    sheets.iter().map(|s| s.placed.iter().map(|p| p.page).collect()).collect()
+}
diff --git a/crates/print/src/lib.rs b/crates/print/src/lib.rs
index b731aff00f..067112b2e7 100644
--- a/crates/print/src/lib.rs
+++ b/crates/print/src/lib.rs
@@ -27,1026 +27,19 @@ mod tests;
 
 pub use range::{Subset, select_listed, select_pages};
 
-/// What can go wrong when printing.
-///
-/// The three things a *person* can be wrong about — there is nothing to print, a page number past
-/// the end, a range that is not a page — each have their own variant with the numbers apart from
-/// the words, so an interface can say them in its own language with [`PrintError::said`]. The rest
-/// are faults rather than mistakes and carry their text as it is.
-#[derive(Debug, thiserror::Error, PartialEq)]
-pub enum PrintError {
-    #[error("there are no pages to print")]
-    NoPages,
-    /// A page number past the end of the document: the number asked for, and the page count.
-    #[error("page {0} is out of range (1–{1})")]
-    OutOfRange(usize, usize),
-    /// A range token that is neither a page number nor a page label.
-    #[error("{0:?} is not a page number or label")]
-    NotAPage(String),
-    #[error("{0}")]
-    Invalid(String),
-    #[error("{0}")]
-    Spool(String),
-    #[error(transparent)]
-    Cos(#[from] pdfcraft_cos::CosError),
-}
-
-/// How an interface says one of our wordings in its own language, holes and all: given the English
-/// in [`WORDINGS`], the same wording in that language. [`in_english`] keeps the English.
-pub type Words<'a> = &'a dyn Fn(&str) -> String;
-
-/// The [`Words`] that translate nothing: the wording as it is written here.
-pub fn in_english(wording: &str) -> String {
-    wording.to_owned()
-}
-
-/// What a person can get wrong about what to print, in English, with their holes still in them.
-///
-/// An interface that reports these in another language translates these three, which is the whole
-/// reason they are gathered here; `wordings_are_said` keeps them in step with the errors.
-pub const WORDINGS: &[&str] = &["there are no pages to print", "page {n} is out of range (1–{count})", "{page} is not a page number or label"];
-
-impl PrintError {
-    /// This error as one sentence, said in the language `words` translates into.
-    ///
-    /// The wording is translated and the numbers go in afterwards, in a single pass, so what the
-    /// person typed cannot be read as a hole. With [`in_english`] this is the error's own
-    /// `Display`, which is what the command line and scripts report.
-    pub fn said(&self, words: Words) -> String {
-        match self {
-            PrintError::NoPages => words("there are no pages to print"),
-            PrintError::OutOfRange(n, count) => {
-                say(&words("page {n} is out of range (1–{count})"), &[("{n}", n.to_string()), ("{count}", count.to_string())])
-            }
-            // The token goes in quoted, the way it is typed, as the error itself prints it.
-            PrintError::NotAPage(token) => say(&words("{page} is not a page number or label"), &[("{page}", format!("{token:?}"))]),
-            fault => fault.to_string(),
-        }
-    }
-}
-
-/// A wording with its holes filled.
-///
-/// A hole is a name in braces, such as `{n}`; what is not in `values` is left as it is written.
-/// Values go in during a single pass, so a value with braces in it is never read as a hole.
-fn say(wording: &str, values: &[(&str, String)]) -> String {
-    let mut out = String::with_capacity(wording.len() + 8);
-    let mut rest = wording;
-    while let Some(open) = rest.find('{') {
-        let (before, from_brace) = rest.split_at(open);
-        out.push_str(before);
-        // `find` counts from the brace and `}` is one byte, so this is a char boundary.
-        let Some(close) = from_brace.find('}') else {
-            // A brace with nothing closing it is just text.
-            out.push_str(from_brace);
-            return out;
-        };
-        let Some(hole) = from_brace.get(..=close) else { return out + from_brace };
-        match values.iter().find(|(name, _)| *name == hole) {
-            Some((_, value)) => out.push_str(value),
-            None => out.push_str(hole),
-        }
-        rest = from_brace.get(close + 1..).unwrap_or_default();
-    }
-    out.push_str(rest);
-    out
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum Orientation {
-    #[default]
-    Auto,
-    Portrait,
-    Landscape,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Default)]
-pub enum SizeMode {
-    #[default]
-    Fit,
-    Actual,
-    Shrink,
-    /// Percent.
-    Custom(f64),
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum PageOrder {
-    #[default]
-    Horizontal,
-    HorizontalReversed,
-    Vertical,
-    VerticalReversed,
-    /// Single-sided sheets: cut into cell piles, then stack them in row-major order.
-    CutStack,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum BookletSubset {
-    #[default]
-    BothSides,
-    FrontOnly,
-    BackOnly,
-}
-
-/// How a booklet goes through the printer (#2707): it decides two-sided printing itself, as
-/// Acrobat does (its Print dialog hides Two-sided while Booklet is chosen; Using Acrobat X Pro,
-/// Print dialog box options: "Acrobat automatically enables duplex printing, if available, for
-/// booklet printing"). Both sides flip on the short edge, the fold of a 2-up sheet turned
-/// sideways; front side only or back side only is one pass of a manual duplex and prints
-/// single-sided.
-pub fn booklet_duplex(subset: BookletSubset) -> spool::Duplex {
-    match subset {
-        BookletSubset::BothSides => spool::Duplex::ShortEdge,
-        BookletSubset::FrontOnly | BookletSubset::BackOnly => spool::Duplex::Off,
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum Binding {
-    #[default]
-    Left,
-    Right,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum Layout {
-    Size(SizeMode),
-    Multiple {
-        cols: usize,
-        rows: usize,
-        /// Source pages on each sheet, at most `cols × rows`: three per sheet uses a 2 × 2 grid
-        /// with one cell left blank.
-        per_sheet: usize,
-        order: PageOrder,
-        border: bool,
-        auto_rotate: bool,
-    },
-    Booklet {
-        subset: BookletSubset,
-        binding: Binding,
-    },
-    /// Tile scale (percent), overlap (points), cut marks.
-    Poster {
-        scale: f64,
-        overlap: f64,
-        cut_marks: bool,
-    },
-    /// Shipping label: each page cut to its [`Settings::crops`] box, turned so its text reads
-    /// upright on the sheet and fitted with [`LABEL_MARGIN`]; `flip` turns it a further 180°.
-    Label {
-        flip: bool,
-    },
-}
-
-impl Default for Layout {
-    fn default() -> Self {
-        Layout::Size(SizeMode::Fit)
-    }
-}
-
-impl Layout {
-    /// Acrobat's pages-per-sheet choices as a grid (columns × rows on a portrait sheet).
-    pub fn multiple(per_sheet: usize) -> Layout {
-        let (cols, rows) = match per_sheet {
-            2 => (1, 2),
-            4 => (2, 2),
-            6 => (2, 3),
-            9 => (3, 3),
-            16 => (4, 4),
-            n => {
-                let c = (n as f64).sqrt().ceil().max(1.0) as usize;
-                (c, n.div_ceil(c).max(1))
-            }
-        };
-        Layout::Multiple { cols, rows, per_sheet: per_sheet.max(1), order: PageOrder::Horizontal, border: false, auto_rotate: true }
-    }
-}
-
-/// Acrobat's Comments & Forms choices.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum Content {
-    /// Page content and form fields.
-    Document,
-    /// Page content, form fields and every printable comment.
-    #[default]
-    DocumentAndMarkups,
-    /// Page content, form fields and stamps.
-    DocumentAndStamps,
-    /// Form fields only.
-    FormFieldsOnly,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct Settings {
-    /// Source pages (0-based) in print order; see [`select_pages`].
-    pub pages: Vec<usize>,
-    /// Paper (width, height) in points, portrait.
-    pub paper: (f64, f64),
-    pub orientation: Orientation,
-    pub layout: Layout,
-    pub content: Content,
-    /// For [`Layout::Label`], per source page: the area to keep (display space) and whether its
-    /// text runs bottom-to-top (so a quarter turn clockwise makes it upright). `None` or a
-    /// missing entry keeps the whole page.
-    pub crops: Vec<Option<Crop>>,
-    /// Print as image (Acrobat's Advanced Print Setup): every page rendered to a picture at this
-    /// resolution before it is placed on the paper. The engine does the rendering; `impose` is
-    /// then given the image-only document.
-    pub raster: Option<Raster>,
-}
-
-/// How pages are rendered when printing as image.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct Raster {
-    /// Dots per inch, 72–600 (Acrobat offers 150, 300 and 600).
-    pub dpi: f64,
-    /// Render the pictures in grey, so the print-ready PDF itself is grayscale.
-    pub grayscale: bool,
-}
-
-impl Default for Raster {
-    fn default() -> Self {
-        Raster { dpi: 300.0, grayscale: false }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct Crop {
-    pub rect: [f64; 4],
-    pub text_up: bool,
-}
-
-impl Default for Settings {
-    fn default() -> Self {
-        Settings {
-            pages: Vec::new(),
-            paper: PAPERS[0].1,
-            orientation: Orientation::Auto,
-            layout: Layout::default(),
-            content: Content::default(),
-            raster: None,
-            crops: Vec::new(),
-        }
-    }
-}
-
-/// Common paper sizes (points, portrait).
-pub const PAPERS: [(&str, (f64, f64)); 21] = [
-    ("US Letter", (612.0, 792.0)),
-    ("US Legal", (612.0, 1008.0)),
-    ("Tabloid", (792.0, 1224.0)),
-    ("A3", (841.89, 1190.55)),
-    ("A4", (595.28, 841.89)),
-    ("A5", (419.53, 595.28)),
-    ("A6", (297.64, 419.53)),
-    ("ARCH A (9 x 12 in)", (648.0, 864.0)),
-    ("ARCH B (12 x 18 in)", (864.0, 1296.0)),
-    ("ARCH C (18 x 24 in)", (1296.0, 1728.0)),
-    ("ARCH D (24 x 36 in)", (1728.0, 2592.0)),
-    ("ARCH E1 (30 x 42 in)", (2160.0, 3024.0)),
-    ("ARCH E (36 x 48 in)", (2592.0, 3456.0)),
-    ("ANSI C (17 x 22 in)", (1224.0, 1584.0)),
-    ("ANSI D (22 x 34 in)", (1584.0, 2448.0)),
-    ("ANSI E (34 x 44 in)", (2448.0, 3168.0)),
-    ("A2", (1190.55, 1683.78)),
-    ("A1", (1683.78, 2383.94)),
-    ("A0", (2383.94, 3370.39)),
-    ("4 x 6 in label (101.6 x 152.4 mm)", (288.0, 432.0)),
-    ("US #10 Envelope (4.125 x 9.5 in)", (297.0, 684.0)),
-];
-
-/// `PAPERS` index of the 4 × 6 in shipping label.
-pub const LABEL_PAPER: usize = 19;
-
-/// The CUPS media name for `PAPERS[index]`, so the spooler feeds the sheet the PDF was laid out
-/// on rather than the queue's default; `None` only past the end of `PAPERS`. The common sizes
-/// use their PPD keywords (`w288h432` is the usual 4×6 label, `Env10` the US #10 envelope).
-/// The rest use PWG 5101.1 names (ARCH E1 is its `wide-format` size), spelled exactly as the
-/// spec and the IANA registry have them: a driverless printer may take only the names it
-/// advertises. They carry their dimensions, so CUPS feeds the PPD size of those dimensions
-/// whatever the driver calls it (`ARCHD`, `AnsiD`) (#3752).
-pub fn cups_media(index: usize) -> Option<&'static str> {
-    Some(match PAPERS.get(index)?.0 {
-        "US Letter" => "Letter",
-        "US Legal" => "Legal",
-        "Tabloid" => "Tabloid",
-        "A3" => "A3",
-        "A4" => "A4",
-        "A5" => "A5",
-        "A6" => "iso_a6_105x148mm",
-        "ARCH A (9 x 12 in)" => "na_arch-a_9x12in",
-        "ARCH B (12 x 18 in)" => "na_arch-b_12x18in",
-        "ARCH C (18 x 24 in)" => "na_arch-c_18x24in",
-        "ARCH D (24 x 36 in)" => "na_arch-d_24x36in",
-        "ARCH E1 (30 x 42 in)" => "na_wide-format_30x42in",
-        "ARCH E (36 x 48 in)" => "na_arch-e_36x48in",
-        "ANSI C (17 x 22 in)" => "na_c_17x22in",
-        "ANSI D (22 x 34 in)" => "na_d_22x34in",
-        "ANSI E (34 x 44 in)" => "na_e_34x44in",
-        "A2" => "iso_a2_420x594mm",
-        "A1" => "iso_a1_594x841mm",
-        "A0" => "iso_a0_841x1189mm",
-        "US #10 Envelope (4.125 x 9.5 in)" => "Env10",
-        _ if index == LABEL_PAPER => "w288h432",
-        // A size added to PAPERS without a name here: its tests fail, and meanwhile the queue's
-        // paper stands, as it did for every size before #1583.
-        _ => return None,
-    })
-}
-
-/// The job option that feeds `PAPERS[index]` (`media`, see [`cups_media`]), for the Print
-/// dialog's jobs and `doc_print`'s alike.
-pub fn media_option(index: usize) -> Option<(String, String)> {
-    cups_media(index).map(|m| ("media".to_string(), m.to_string()))
-}
-
-/// Whether most of page `index`'s text runs bottom-to-top as the page displays (a label laid
-/// sideways on a letter or A4 sheet), counting each text-showing operator once; form XObjects
-/// are followed a few levels deep.
-pub fn text_reads_up(doc: &Document, index: usize) -> bool {
-    let Some(page) = pdfcraft_model::pages(doc).into_iter().nth(index) else { return false };
-    let to_display = Matrix(page.view_matrix(doc)).invert().unwrap_or_default();
-    let res = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
-    let mut score = 0i64;
-    let mut budget = DecodeBudget::page();
-    // Content past the budget is left out: the answer is a guess from the text read so far.
-    let data = decoded_contents(doc, &page.dict, &mut budget).unwrap_or_default();
-    text_direction(doc, &data, &res, to_display, 0, &mut score, &mut budget);
-    score > 0
-}
-
-fn text_direction(doc: &Document, data: &[u8], res: &Dict, base: Matrix, depth: usize, score: &mut i64, budget: &mut DecodeBudget) {
-    let (mut ctm, mut tm, mut stack) = (base, Matrix::IDENTITY, Vec::new());
-    for op in pdfcraft_content::parse(data).ops {
-        match op.op.as_slice() {
-            // Bounded like the renderer's graphics-state stack: deeper saves are ignored.
-            b"q" if stack.len() < 256 => stack.push(ctm),
-            b"Q" => ctm = stack.pop().unwrap_or(base),
-            b"cm" => ctm = Matrix::from_operands(&op.operands).unwrap_or_default().then(&ctm),
-            b"BT" => tm = Matrix::IDENTITY,
-            b"Tm" => tm = Matrix::from_operands(&op.operands).unwrap_or_default(),
-            b"Tj" | b"TJ" | b"'" | b"\"" => {
-                let [a, b, ..] = tm.then(&ctm).0;
-                *score += i64::from(b > a.abs()) - i64::from(-b > a.abs());
-            }
-            b"Do" if depth < 4 => {
-                let Some(name) = op.name(0) else { continue };
-                let Some(xobj) = res.get(b"XObject").and_then(|x| doc.resolve(x).as_dict().and_then(|x| x.get(name).cloned())) else { continue };
-                let Object::Stream(form) = &*doc.resolve(&xobj) else { continue };
-                if form.dict.get(b"Subtype").and_then(|s| doc.resolve(s).as_name().map(<[u8]>::to_vec)).as_deref() != Some(b"Form".as_slice()) {
-                    continue;
-                }
-                let m = form.dict.get(b"Matrix").and_then(|m| doc.resolve(m).as_array().and_then(|a| Matrix::from_operands(a))).unwrap_or_default();
-                let inner = form.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_else(|| res.clone());
-                if !budget.enter_form() {
-                    continue;
-                }
-                if let Ok(body) = budget.decode(form) {
-                    text_direction(doc, &body, &inner, m.then(&ctm), depth + 1, score, budget);
-                }
-            }
-            _ => {}
-        }
-    }
-}
-
-/// Margin kept around a label: thermal heads miss the very edge, and many 4×6 drivers feed
-/// 100 × 150 mm (283 × 425 pt), a little short of the 288 × 432 pt sheet.
-pub const LABEL_MARGIN: f64 = 8.0;
-
-/// Place `crop` (display space) of `page` centred in `cell`, scaled by `s` and turned by
-/// `quarter` quarter turns counter-clockwise (0–3).
-fn place_crop(page: usize, crop: [f64; 4], cell: [f64; 4], s: f64, quarter: u8) -> Placement {
-    let (w, h) = (crop[2] - crop[0], crop[3] - crop[1]);
-    let (pw, ph) = if quarter % 2 == 1 { (h * s, w * s) } else { (w * s, h * s) };
-    let (x, y) = (cell[0] + (cell[2] - cell[0] - pw) / 2.0, cell[1] + (cell[3] - cell[1] - ph) / 2.0);
-    let [a, b, c, d, e, f] = match quarter % 4 {
-        0 => [s, 0.0, 0.0, s, x, y],
-        1 => [0.0, s, -s, 0.0, x + pw, y],
-        2 => [-s, 0.0, 0.0, -s, x + pw, y + ph],
-        _ => [0.0, -s, s, 0.0, x, y + ph],
-    };
-    // Move the crop's corner to the origin first.
-    Placement { page, matrix: Matrix([a, b, c, d, e - a * crop[0] - c * crop[1], f - b * crop[0] - d * crop[1]]), clip: crop }
-}
-
-/// Match a displayed PDF page to a standard sheet, independent of orientation.
-/// Half a point allows rounded metric PDF dimensions without confusing distinct sizes.
-pub fn matching_paper(size: (f64, f64)) -> Option<usize> {
-    if !size.0.is_finite() || !size.1.is_finite() {
-        return None;
-    }
-    let size = (size.0.min(size.1), size.0.max(size.1));
-    PAPERS.iter().position(|(_, p)| (p.0 - size.0).abs() <= 0.5 && (p.1 - size.1).abs() <= 0.5)
-}
-
-/// The unprintable margin assumed around the sheet for Fit, Multiple and Booklet.
-pub const MARGIN: f64 = 18.0;
-
-/// One page as placed on a sheet: the source page, the matrix from its *display space* to the
-/// sheet, and the visible part of it in display space (clipping).
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct Placement {
-    pub page: usize,
-    pub matrix: Matrix,
-    pub clip: [f64; 4],
-}
-
-/// One output sheet.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Sheet {
-    pub size: (f64, f64),
-    pub placed: Vec<Placement>,
-    /// Page borders (Multiple) and cut marks (Poster), in sheet space: rectangles and lines.
-    pub borders: Vec<[f64; 4]>,
-    pub lines: Vec<[f64; 4]>,
-}
-
-fn oriented(paper: (f64, f64), o: Orientation, landscape_wanted: bool) -> (f64, f64) {
-    let (w, h) = (paper.0.min(paper.1), paper.0.max(paper.1));
-    match o {
-        Orientation::Portrait => (w, h),
-        Orientation::Landscape => (h, w),
-        Orientation::Auto => {
-            if landscape_wanted {
-                (h, w)
-            } else {
-                (w, h)
-            }
-        }
-    }
-}
-
-/// Place a page of display size `(dw, dh)` inside `cell` (sheet space), scaled by `s`
-/// (centred), optionally rotated 90° (counter-clockwise).
-fn place_in(page: usize, (dw, dh): (f64, f64), cell: [f64; 4], s: f64, rotate: bool) -> Placement {
-    let (cw, ch) = (cell[2] - cell[0], cell[3] - cell[1]);
-    let (pw, ph) = if rotate { (dh * s, dw * s) } else { (dw * s, dh * s) };
-    let (x, y) = (cell[0] + (cw - pw) / 2.0, cell[1] + (ch - ph) / 2.0);
-    let matrix = if rotate { Matrix([0.0, s, -s, 0.0, x + pw, y]) } else { Matrix([s, 0.0, 0.0, s, x, y]) };
-    Placement { page, matrix, clip: [0.0, 0.0, dw, dh] }
-}
-
-fn fit_scale((dw, dh): (f64, f64), (cw, ch): (f64, f64)) -> f64 {
-    if dw <= 0.0 || dh <= 0.0 { 1.0 } else { (cw / dw).min(ch / dh) }
-}
-
-/// Lay out the sheets for `settings` given each source page's display size.
-pub fn layout(sizes: &[(f64, f64)], settings: &Settings) -> Result<Vec<Sheet>, PrintError> {
-    let pages: Vec<usize> = settings.pages.iter().copied().filter(|p| *p < sizes.len()).collect();
-    if pages.is_empty() {
-        return Err(PrintError::NoPages);
-    }
-    let paper = settings.paper;
-    if !(paper.0 >= 72.0 && paper.1 >= 72.0 && paper.0.is_finite() && paper.1.is_finite()) {
-        return Err(PrintError::Invalid("invalid paper size".into()));
-    }
-    let mut sheets = Vec::new();
-    match settings.layout {
-        Layout::Size(mode) => {
-            for &p in &pages {
-                let d = sizes[p];
-                let size = oriented(paper, settings.orientation, d.0 > d.1);
-                let fit = fit_scale(d, (size.0 - 2.0 * MARGIN, size.1 - 2.0 * MARGIN));
-                let s = match mode {
-                    SizeMode::Fit => fit,
-                    SizeMode::Actual => 1.0,
-                    SizeMode::Shrink => fit.min(1.0),
-                    SizeMode::Custom(pct) if pct.is_finite() && pct > 0.0 => pct / 100.0,
-                    SizeMode::Custom(_) => return Err(PrintError::Invalid("the scale must be more than 0%".into())),
-                };
-                sheets.push(Sheet { size, placed: vec![place_in(p, d, [0.0, 0.0, size.0, size.1], s, false)], ..Sheet::default() });
-            }
-        }
-        Layout::Label { flip } => {
-            let size = oriented(paper, settings.orientation, false);
-            let cell = [LABEL_MARGIN, LABEL_MARGIN, size.0 - LABEL_MARGIN, size.1 - LABEL_MARGIN];
-            for &p in &pages {
-                let d = sizes[p];
-                let crop = settings.crops.get(p).copied().flatten();
-                let rect = crop
-                    .map(|c| [c.rect[0].max(0.0), c.rect[1].max(0.0), c.rect[2].min(d.0), c.rect[3].min(d.1)])
-                    .filter(|r| r[2] - r[0] > 1.0 && r[3] - r[1] > 1.0)
-                    .unwrap_or([0.0, 0.0, d.0, d.1]);
-                let (w, h) = (rect[2] - rect[0], rect[3] - rect[1]);
-                let turn = (w > h) != (cell[2] - cell[0] > cell[3] - cell[1]);
-                let mut quarter = match (turn, crop.is_some_and(|c| c.text_up)) {
-                    (false, _) => 0,
-                    (true, true) => 3,
-                    (true, false) => 1,
-                };
-                if flip {
-                    quarter = (quarter + 2) % 4;
-                }
-                let s = if turn {
-                    fit_scale((h, w), (cell[2] - cell[0], cell[3] - cell[1]))
-                } else {
-                    fit_scale((w, h), (cell[2] - cell[0], cell[3] - cell[1]))
-                };
-                sheets.push(Sheet { size, placed: vec![place_crop(p, rect, cell, s, quarter)], ..Sheet::default() });
-            }
-        }
-        Layout::Multiple { cols, rows, per_sheet, order, border, auto_rotate } => {
-            let cells = cols.checked_mul(rows).filter(|&n| n > 0 && n <= 256);
-            let Some(cells) = cells else {
-                return Err(PrintError::Invalid("invalid number of pages per sheet".into()));
-            };
-            // The grid can have more cells than the pages asked for on each sheet; the rest stay blank.
-            let per_sheet = per_sheet.min(cells);
-            if per_sheet == 0 {
-                return Err(PrintError::Invalid("invalid number of pages per sheet".into()));
-            }
-            // A grid with more columns than rows wants a landscape sheet, and the reverse.
-            let first = pages.first().and_then(|&p| sizes.get(p)).copied().ok_or(PrintError::NoPages)?;
-            let page_landscape = first.0 > first.1;
-            let (gc, gr, sheet_landscape) = if cols == rows {
-                (cols, rows, page_landscape)
-            } else if settings.orientation == Orientation::Landscape || (settings.orientation == Orientation::Auto && cols < rows) {
-                // 2 per sheet (1 × 2 on portrait) prints side by side on landscape paper.
-                (rows, cols, true)
-            } else {
-                (cols, rows, false)
-            };
-            let size = oriented(paper, settings.orientation, sheet_landscape);
-            let gap = 6.0;
-            let (aw, ah) = (size.0 - 2.0 * MARGIN, size.1 - 2.0 * MARGIN);
-            let (cw, ch) = ((aw - gap * (gc - 1) as f64) / gc as f64, (ah - gap * (gr - 1) as f64) / gr as f64);
-            if cw <= 0.0 || ch <= 0.0 {
-                return Err(PrintError::Invalid("the page grid does not fit on the paper".into()));
-            }
-            let sheet_count = pages.len().div_ceil(per_sheet);
-            for sheet_index in 0..sheet_count {
-                let mut sheet = Sheet { size, ..Sheet::default() };
-                if order == PageOrder::CutStack {
-                    // Marks align across every sheet, including unoccupied cells. Cut in the
-                    // middle of each gutter; marks stay in the printable area, clear of cells.
-                    for col in 1..gc {
-                        let x = MARGIN + col as f64 * (cw + gap) - gap / 2.0;
-                        sheet.lines.extend([[x, MARGIN, x, MARGIN + 8.0], [x, size.1 - MARGIN - 8.0, x, size.1 - MARGIN]]);
-                    }
-                    for row in 1..gr {
-                        let y = size.1 - MARGIN - row as f64 * (ch + gap) + gap / 2.0;
-                        sheet.lines.extend([[MARGIN, y, MARGIN + 8.0, y], [size.0 - MARGIN - 8.0, y, size.0 - MARGIN, y]]);
-                    }
-                }
-                for k in 0..per_sheet {
-                    // A cell's pile gets consecutive pages. Missing pages leave blank cells,
-                    // rather than shifting later piles left on the final sheets.
-                    let index = if order == PageOrder::CutStack {
-                        k.checked_mul(sheet_count).and_then(|n| n.checked_add(sheet_index))
-                    } else {
-                        sheet_index.checked_mul(per_sheet).and_then(|n| n.checked_add(k))
-                    };
-                    let Some(p) = index.and_then(|i| pages.get(i)).copied() else { continue };
-
-                    let (col, row) = match order {
-                        PageOrder::Horizontal | PageOrder::CutStack => (k % gc, k / gc),
-                        PageOrder::HorizontalReversed => (gc - 1 - k % gc, k / gc),
-                        PageOrder::Vertical => (k / gr, k % gr),
-                        PageOrder::VerticalReversed => (gc - 1 - k / gr, k % gr),
-                    };
-                    let x0 = MARGIN + col as f64 * (cw + gap);
-                    let y1 = size.1 - MARGIN - row as f64 * (ch + gap);
-                    let cell = [x0, y1 - ch, x0 + cw, y1];
-                    let d = sizes.get(p).copied().ok_or_else(|| PrintError::Invalid("page size is missing".into()))?;
-                    if !(d.0.is_finite() && d.1.is_finite() && d.0 > 0.0 && d.1 > 0.0) {
-                        return Err(PrintError::Invalid("invalid page size".into()));
-                    }
-                    let rotate = auto_rotate && (d.0 > d.1) != (cw > ch) && (d.0 - d.1).abs() > 1.0;
-                    let s = fit_scale(if rotate { (d.1, d.0) } else { d }, (cw, ch));
-                    if !s.is_finite() || s <= 0.0 {
-                        return Err(PrintError::Invalid("page size cannot be scaled to the grid".into()));
-                    }
-                    let pl = place_in(p, d, cell, s, rotate);
-                    if border {
-                        let b = pl.matrix.bbox(pl.clip);
-                        sheet.borders.push(b);
-                    }
-                    sheet.placed.push(pl);
-                }
-                sheets.push(sheet);
-            }
-        }
-        Layout::Booklet { subset, binding } => {
-            // Pad to a multiple of 4 with blank pages (None).
-            let n4 = pages.len().div_ceil(4) * 4;
-            let at = |i: usize| pages.get(i).copied();
-            let size = oriented(paper, Orientation::Landscape, true);
-            let half = (size.0 - 2.0 * MARGIN) / 2.0;
-            let cells = [[MARGIN, MARGIN, MARGIN + half, size.1 - MARGIN], [MARGIN + half, MARGIN, size.0 - MARGIN, size.1 - MARGIN]];
-            for k in 0..n4 / 4 {
-                let front = (at(n4 - 1 - 2 * k), at(2 * k));
-                let back = (at(2 * k + 1), at(n4 - 2 - 2 * k));
-                let mut sides = Vec::new();
-                if subset != BookletSubset::BackOnly {
-                    sides.push(front);
-                }
-                if subset != BookletSubset::FrontOnly {
-                    sides.push(back);
-                }
-                for (l, r) in sides {
-                    let (l, r) = if binding == Binding::Right { (r, l) } else { (l, r) };
-                    let mut sheet = Sheet { size, ..Sheet::default() };
-                    for (p, cell) in [(l, cells[0]), (r, cells[1])] {
-                        if let Some(p) = p {
-                            let d = sizes[p];
-                            let s = fit_scale(d, (cell[2] - cell[0], cell[3] - cell[1]));
-                            sheet.placed.push(place_in(p, d, cell, s, false));
-                        }
-                    }
-                    sheets.push(sheet);
-                }
-            }
-        }
-        Layout::Poster { scale, overlap, cut_marks } => {
-            if !(scale.is_finite() && scale > 0.0 && overlap.is_finite() && overlap >= 0.0) {
-                return Err(PrintError::Invalid("invalid tile scale or overlap".into()));
-            }
-            let s = scale / 100.0;
-            for &p in &pages {
-                let d = sizes[p];
-                let size = oriented(paper, settings.orientation, d.0 > d.1);
-                // Each tile shows `step` of the scaled page plus `overlap` shared with the next.
-                let (tw, th) = (size.0 - 2.0 * MARGIN, size.1 - 2.0 * MARGIN);
-                if overlap * 2.0 >= tw.min(th) {
-                    return Err(PrintError::Invalid("the overlap is larger than the tile".into()));
-                }
-                let (sw, sh) = (d.0 * s, d.1 * s);
-                let (stepx, stepy) = (tw - overlap, th - overlap);
-                let nx = (((sw - overlap) / stepx).ceil() as usize).max(1);
-                let ny = (((sh - overlap) / stepy).ceil() as usize).max(1);
-                // The counts saturate at usize::MAX for a huge scale, so their product can overflow.
-                if nx.checked_mul(ny).is_none_or(|n| n > 1024) {
-                    return Err(PrintError::Invalid("the poster would need more than 1024 sheets".into()));
-                }
-                // Tiles from the top-left, row by row.
-                for ty in 0..ny {
-                    for tx in 0..nx {
-                        // The window into the scaled page (scaled display space, y up).
-                        let wx0 = tx as f64 * stepx;
-                        let wy1 = sh - ty as f64 * stepy;
-                        let matrix = Matrix([s, 0.0, 0.0, s, MARGIN - wx0, size.1 - MARGIN - wy1]);
-                        let clip = [wx0 / s, (wy1 - th) / s, (wx0 + tw) / s, wy1 / s];
-                        let mut sheet = Sheet { size, placed: vec![Placement { page: p, matrix, clip }], ..Sheet::default() };
-                        if cut_marks {
-                            let (x0, y0, x1, y1) = (MARGIN, MARGIN, size.0 - MARGIN, size.1 - MARGIN);
-                            for (x, y) in [(x0, y0), (x1, y0), (x0, y1), (x1, y1)] {
-                                let dx = if x == x0 { -1.0 } else { 1.0 };
-                                let dy = if y == y0 { -1.0 } else { 1.0 };
-                                sheet.lines.push([x + dx * 2.0, y, x + dx * (MARGIN - 2.0), y]);
-                                sheet.lines.push([x, y + dy * 2.0, x, y + dy * (MARGIN - 2.0)]);
-                            }
-                        }
-                        sheets.push(sheet);
-                    }
-                }
-            }
-        }
-    }
-    Ok(sheets)
-}
-
-// Model-derived transforms and clipping bounds need their full PDF decimal precision.
-fn geometry_number(value: f64) -> String {
-    let mut bytes = Vec::new();
-    pdfcraft_cos::serialize(&Object::Real(value), &mut bytes);
-    String::from_utf8_lossy(&bytes).into_owned()
-}
-
-fn n(v: f64) -> String {
-    let s = format!("{v:.4}");
-    let s = s.trim_end_matches('0').trim_end_matches('.');
-    if s == "-0" { "0".into() } else { s.into() }
-}
-
-/// The page's content streams decoded against `budget` and joined; streams that don't decode
-/// are left out. `None` when the budget ran out, so part of the content is missing.
-fn decoded_contents(doc: &Document, page: &Dict, budget: &mut DecodeBudget) -> Option<Vec<u8>> {
-    let Some(contents) = page.get(b"Contents") else { return Some(Vec::new()) };
-    let mut out = Vec::new();
-    for data in budget.decode_contents(doc, contents) {
-        match data {
-            Ok(data) => {
-                out.extend_from_slice(&data);
-                out.push(b'\n');
-            }
-            Err(_) if budget.remaining() == 0 => return None,
-            Err(_) => {}
-        }
-    }
-    Some(out)
-}
-
-/// Reduce `doc`'s pages to what [`impose`] draws of them under `content`: the annotations that
-/// don't print are dropped, and with [`Content::FormFieldsOnly`] the page content too. For
-/// printing pages as pictures, where a renderer draws each page as it stands.
-pub fn keep_printed(doc: &mut Document, content: Content) {
-    for page in pdfcraft_model::pages(doc) {
-        let annots = page.dict.get(b"Annots").and_then(|a| doc.resolve(a).as_array().cloned()).unwrap_or_default();
-        let kept: Vec<Object> = annots.into_iter().filter(|a| doc.resolve(a).as_dict().is_some_and(|d| prints(doc, d, content))).collect();
-        // Fails only when the page object isn't a dictionary, and such a page draws nothing.
-        let _ = doc.update_dict(page.obj, |d| {
-            if content == Content::FormFieldsOnly {
-                d.remove(b"Contents");
-            }
-            if d.contains(b"Annots") {
-                d.set(b"Annots".to_vec(), Object::Array(kept));
-            }
-        });
-    }
-}
-
-/// The standard annotation types of ISO 32000-2 Table 171.
-const STANDARD_ANNOTATION_TYPES: [&[u8]; 28] = [
-    b"Text",
-    b"Link",
-    b"FreeText",
-    b"Line",
-    b"Square",
-    b"Circle",
-    b"Polygon",
-    b"PolyLine",
-    b"Highlight",
-    b"Underline",
-    b"Squiggly",
-    b"StrikeOut",
-    b"Caret",
-    b"Stamp",
-    b"Ink",
-    b"Popup",
-    b"FileAttachment",
-    b"Sound",
-    b"Movie",
-    b"Screen",
-    b"Widget",
-    b"PrinterMark",
-    b"TrapNet",
-    b"Watermark",
-    b"3D",
-    b"Redact",
-    b"Projection",
-    b"RichMedia",
-];
-
-/// Does annotation `d` print under `content`?
-fn prints(doc: &Document, d: &Dict, content: Content) -> bool {
-    const INVISIBLE: i64 = 1;
-    const HIDDEN: i64 = 2;
-    const PRINT: i64 = 4;
-    let flags = d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
-    if flags & PRINT == 0 || flags & HIDDEN != 0 {
-        return false;
-    }
-    // `/Subtype` may be an indirect reference (ISO 32000-2 §7.3.10), so resolve it first.
-    let subtype_obj = d.get(b"Subtype").map(|s| doc.resolve(s));
-    let subtype = subtype_obj.as_deref().and_then(Object::as_name).unwrap_or(b"");
-    match subtype {
-        b"Widget" => true,
-        b"Link" | b"Popup" => false,
-        b"Stamp" => content != Content::Document && content != Content::FormFieldsOnly,
-        // ISO 32000-2 Table 167: an Invisible annotation of a type that isn't standard (Table
-        // 171) is not printed even with its Print flag set.
-        _ if flags & INVISIBLE != 0 && !STANDARD_ANNOTATION_TYPES.contains(&subtype) => false,
-        _ => content == Content::DocumentAndMarkups,
-    }
-}
-
-/// The normal appearance stream to draw for an annotation (honouring `/AS`).
-fn appearance(doc: &Document, d: &Dict) -> Option<ObjRef> {
-    let ap = doc.resolve(d.get(b"AP")?);
-    let normal = ap.as_dict()?.get(b"N")?.clone();
-    match &*doc.resolve(&normal) {
-        Object::Stream(_) => normal.as_ref(),
-        Object::Dict(states) => {
-            let state = d.name(b"AS")?;
-            states.get(state)?.as_ref()
-        }
-        _ => None,
-    }
-}
-
-/// Algorithm 8.1: the matrix placing an appearance form (BBox × Matrix) onto the annotation rect.
-fn appearance_matrix(doc: &Document, form: &Dict, rect: [f64; 4]) -> Option<Matrix> {
-    let nums =
-        |k: &[u8]| -> Option<Vec<f64>> { Some(doc.resolve(form.get(k)?).as_array()?.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()) };
-    let bbox = nums(b"BBox").filter(|b| b.len() == 4)?;
-    let m = nums(b"Matrix").filter(|m| m.len() == 6).map(|m| Matrix([m[0], m[1], m[2], m[3], m[4], m[5]])).unwrap_or_default();
-    let b = m.bbox([bbox[0], bbox[1], bbox[2], bbox[3]]);
-    let (bw, bh) = (b[2] - b[0], b[3] - b[1]);
-    if bw <= 0.0 || bh <= 0.0 {
-        return None;
-    }
-    let a = Matrix([
-        (rect[2] - rect[0]) / bw,
-        0.0,
-        0.0,
-        (rect[3] - rect[1]) / bh,
-        rect[0] - b[0] * (rect[2] - rect[0]) / bw,
-        rect[1] - b[1] * (rect[3] - rect[1]) / bh,
-    ]);
-    // The Do that draws the form applies its /Matrix itself, so only the placement goes here.
-    Some(a)
-}
-
-/// A Form XObject holding page `index` as it prints (user space; BBox = crop box).
-/// `pages` are the document's pages, listed once by the caller: listing them for each page
-/// printed would make printing quadratic in the page count.
-fn page_form(
-    doc: &mut Document,
-    pages: &[pdfcraft_model::Page],
-    index: usize,
-    content: Content,
-    promoted: &mut std::collections::HashMap<ObjRef, ObjRef>,
-) -> Result<ObjRef, PrintError> {
-    let page = pages.get(index).ok_or_else(|| PrintError::Invalid(format!("there is no page {}", index.saturating_add(1))))?;
-    let crop = page.crop(doc);
-    let mut res = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
-    let mut body = if content == Content::FormFieldsOnly {
-        Vec::new()
-    } else {
-        decoded_contents(doc, &page.dict, &mut DecodeBudget::page())
-            .ok_or_else(|| PrintError::Invalid(format!("page {} has more content than can be printed", index + 1)))?
-    };
-    // Wrap the page content so a state it leaves behind can't affect the annotations.
-    if !body.is_empty() {
-        let mut wrapped = b"q\n".to_vec();
-        wrapped.extend_from_slice(&body);
-        wrapped.extend_from_slice(b"\nQ\n");
-        body = wrapped;
-    }
-    let annots = page.dict.get(b"Annots").and_then(|a| doc.resolve(a).as_array().cloned()).unwrap_or_default();
-    let mut xobjects = res.get(b"XObject").and_then(|x| doc.resolve(x).as_dict().cloned()).unwrap_or_default();
-    let mut k = 0usize;
-    for a in annots {
-        let Some(d) = doc.resolve(&a).as_dict().cloned() else { continue };
-        if !prints(doc, &d, content) {
-            continue;
-        }
-        let rect: Vec<f64> =
-            d.get(b"Rect").and_then(|r| doc.resolve(r).as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default();
-        if rect.len() != 4 {
-            continue;
-        }
-        let rect = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
-        let Some(ap) = appearance(doc, &d) else { continue };
-        let form = doc.get(ap).as_dict().cloned().unwrap_or_default();
-        let Some(m) = appearance_matrix(doc, &form, rect) else { continue };
-        let ap = if !form.contains(b"Subtype")
-            && let Object::Stream(stream) = &*doc.get(ap)
-        {
-            // Some existing annotation appearances omit Subtype, but Do dispatch needs a Form XObject.
-            // Keep the original intact: other document objects can share this appearance.
-            if let Some(&cached) = promoted.get(&ap) {
-                cached
-            } else {
-                let mut stream = stream.clone();
-                stream.dict.set(b"Subtype".to_vec(), Object::name("Form"));
-                let copy = doc.add(Object::Stream(stream));
-                promoted.insert(ap, copy);
-                copy
-            }
-        } else {
-            ap
-        };
-        // Keep the page's own XObjects, including names previous print operations generated.
-        // Check the growing map so each appearance also keeps the name just assigned to it.
-        let name = loop {
-            let name = format!("PCPrA{k}");
-            k = k.checked_add(1).ok_or_else(|| PrintError::Invalid("too many annotation appearance resources".into()))?;
-            if !xobjects.contains(name.as_bytes()) {
-                break name;
-            }
-        };
-        let [a0, b0, c0, d0, e0, f0] = m.0;
-        body.extend(format!("q {} {} {} {} {} {} cm /{name} Do Q\n", n(a0), n(b0), n(c0), n(d0), n(e0), n(f0)).bytes());
-        xobjects.set(name.into_bytes(), Object::Ref(ap));
-    }
-    if !xobjects.is_empty() {
-        res.set(b"XObject".to_vec(), Object::Dict(xobjects));
-    }
-    let mut d = Dict::new();
-    d.set(b"Type".to_vec(), Object::name("XObject"));
-    d.set(b"Subtype".to_vec(), Object::name("Form"));
-    d.set(b"BBox".to_vec(), Object::Array(crop.iter().map(|v| Object::Real(*v)).collect()));
-    d.set(b"Resources".to_vec(), Object::Dict(res));
-    if let Some(g) = page.dict.get(b"Group") {
-        d.set(b"Group".to_vec(), g.clone());
-    }
-    Ok(doc.add(Object::Stream(Stream::flate(d, &body))))
-}
+mod error;
+mod imposition;
+mod settings;
+mod sheets;
 
+pub use error::{PrintError, WORDINGS, Words, in_english};
 #[cfg(test)]
-thread_local! {
-    /// Pages listed by [`source_pages`] on this thread.
-    static PAGES_LISTED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-/// The source document's pages, for printing.
-fn source_pages(doc: &Document) -> Vec<pdfcraft_model::Page> {
-    let pages = pdfcraft_model::pages(doc);
-    #[cfg(test)]
-    PAGES_LISTED.with(|c| c.set(c.get() + pages.len()));
-    pages
-}
-
-/// Build the print-ready PDF for `settings`. Encryption is not carried over (the file goes to a
-/// printer or is the user's own copy); callers must check the print permission first.
-pub fn impose(src: &Document, settings: &Settings) -> Result<Vec<u8>, PrintError> {
-    let pages = source_pages(src);
-    let sizes: Vec<(f64, f64)> = pages.iter().map(|p| p.display_size(src)).collect();
-    let sheets = layout(&sizes, settings)?;
-    let mut doc = src.clone();
-    // One form per source page used (a page may appear on several sheets: posters).
-    let mut forms: std::collections::HashMap<usize, ObjRef> = std::collections::HashMap::new();
-    let mut promoted = std::collections::HashMap::new();
-    let views: Vec<[f64; 6]> = pages.iter().map(|p| p.view_matrix(src)).collect();
-    let pages_root = doc.add(Object::Null);
-    let mut kids = Vec::new();
-    for sheet in &sheets {
-        let mut c = String::new();
-        let mut xo = Dict::new();
-        for (i, pl) in sheet.placed.iter().enumerate() {
-            let form = match forms.get(&pl.page) {
-                Some(f) => *f,
-                None => {
-                    let f = page_form(&mut doc, &pages, pl.page, settings.content, &mut promoted)?;
-                    forms.insert(pl.page, f);
-                    f
-                }
-            };
-            let name = format!("P{i}");
-            xo.set(name.clone().into_bytes(), Object::Ref(form));
-            // Display space → sheet, then clip to the visible part, then user → display.
-            let [a, b, cc, d, e, f] = pl.matrix.0;
-            let to_display = Matrix(views[pl.page]).invert().unwrap_or_default();
-            let [ua, ub, uc, ud, ue, uf] = to_display.0;
-            let [x0, y0, x1, y1] = pl.clip;
-            c.push_str(&format!(
-                "q {} {} {} {} {} {} cm {} {} {} {} re W n {} {} {} {} {} {} cm /{name} Do Q\n",
-                geometry_number(a),
-                geometry_number(b),
-                geometry_number(cc),
-                geometry_number(d),
-                geometry_number(e),
-                geometry_number(f),
-                geometry_number(x0),
-                geometry_number(y0),
-                geometry_number(x1 - x0),
-                geometry_number(y1 - y0),
-                geometry_number(ua),
-                geometry_number(ub),
-                geometry_number(uc),
-                geometry_number(ud),
-                geometry_number(ue),
-                geometry_number(uf)
-            ));
-        }
-        if !sheet.borders.is_empty() || !sheet.lines.is_empty() {
-            c.push_str("q 0 G 0.5 w\n");
-            for r in &sheet.borders {
-                c.push_str(&format!("{} {} {} {} re S\n", n(r[0]), n(r[1]), n(r[2] - r[0]), n(r[3] - r[1])));
-            }
-            for l in &sheet.lines {
-                c.push_str(&format!("{} {} m {} {} l S\n", n(l[0]), n(l[1]), n(l[2]), n(l[3])));
-            }
-            c.push_str("Q\n");
-        }
-        let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), c.as_bytes())));
-        let mut res = Dict::new();
-        res.set(b"XObject".to_vec(), Object::Dict(xo));
-        let mut p = Dict::new();
-        p.set(b"Type".to_vec(), Object::name("Page"));
-        p.set(b"Parent".to_vec(), Object::Ref(pages_root));
-        p.set(b"MediaBox".to_vec(), Object::Array([0.0, 0.0, sheet.size.0, sheet.size.1].iter().map(|v| Object::Real(*v)).collect()));
-        p.set(b"Resources".to_vec(), Object::Dict(res));
-        p.set(b"Contents".to_vec(), Object::Ref(contents));
-        kids.push(Object::Ref(doc.add(Object::Dict(p))));
-    }
-    let mut tree = Dict::new();
-    tree.set(b"Type".to_vec(), Object::name("Pages"));
-    tree.set(b"Count".to_vec(), Object::Int(kids.len() as i64));
-    tree.set(b"Kids".to_vec(), Object::Array(kids));
-    doc.set(pages_root, Object::Dict(tree));
-    let mut cat = Dict::new();
-    cat.set(b"Type".to_vec(), Object::name("Catalog"));
-    cat.set(b"Pages".to_vec(), Object::Ref(pages_root));
-    // Keep the layers' configuration, or a layer that is off in the document would print: the
-    // pages' marked content still refers to its groups, and without this nothing says they are off.
-    let layers = src.trailer().get(b"Root").and_then(|r| src.resolve(r).as_dict().and_then(|root| root.get(b"OCProperties").cloned()));
-    if let Some(layers) = layers {
-        cat.set(b"OCProperties".to_vec(), layers);
-    }
-    let root = doc.add(Object::Dict(cat));
-    doc.trailer_mut().set(b"Root".to_vec(), Object::Ref(root));
-    doc.trailer_mut().remove(b"Info");
-    if doc.trailer().contains(b"Encrypt") {
-        doc.remove_encryption();
-    }
-    Ok(write_full(&doc, &SaveOptions::default())?)
-}
-
-/// Which source pages land on each sheet (for previews and the sheet count).
-pub fn sheet_pages(sheets: &[Sheet]) -> Vec<Vec<usize>> {
-    sheets.iter().map(|s| s.placed.iter().map(|p| p.page).collect()).collect()
-}
+use imposition::{PAGES_LISTED, appearance, appearance_matrix, decoded_contents, page_form, prints};
+pub use imposition::{impose, keep_printed, sheet_pages};
+pub use settings::{
+    Binding, BookletSubset, Content, Crop, LABEL_PAPER, Layout, Orientation, PAPERS, PageOrder, Raster, Settings, SizeMode, booklet_duplex,
+    cups_media, media_option,
+};
+#[cfg(test)]
+use sheets::text_direction;
+pub use sheets::{LABEL_MARGIN, MARGIN, Placement, Sheet, layout, matching_paper, text_reads_up};
diff --git a/crates/print/src/settings.rs b/crates/print/src/settings.rs
new file mode 100644
index 0000000000..7c9554f25e
--- /dev/null
+++ b/crates/print/src/settings.rs
@@ -0,0 +1,250 @@
+use super::*;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum Orientation {
+    #[default]
+    Auto,
+    Portrait,
+    Landscape,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Default)]
+pub enum SizeMode {
+    #[default]
+    Fit,
+    Actual,
+    Shrink,
+    /// Percent.
+    Custom(f64),
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum PageOrder {
+    #[default]
+    Horizontal,
+    HorizontalReversed,
+    Vertical,
+    VerticalReversed,
+    /// Single-sided sheets: cut into cell piles, then stack them in row-major order.
+    CutStack,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum BookletSubset {
+    #[default]
+    BothSides,
+    FrontOnly,
+    BackOnly,
+}
+
+/// How a booklet goes through the printer (#2707): it decides two-sided printing itself, as
+/// Acrobat does (its Print dialog hides Two-sided while Booklet is chosen; Using Acrobat X Pro,
+/// Print dialog box options: "Acrobat automatically enables duplex printing, if available, for
+/// booklet printing"). Both sides flip on the short edge, the fold of a 2-up sheet turned
+/// sideways; front side only or back side only is one pass of a manual duplex and prints
+/// single-sided.
+pub fn booklet_duplex(subset: BookletSubset) -> spool::Duplex {
+    match subset {
+        BookletSubset::BothSides => spool::Duplex::ShortEdge,
+        BookletSubset::FrontOnly | BookletSubset::BackOnly => spool::Duplex::Off,
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum Binding {
+    #[default]
+    Left,
+    Right,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Layout {
+    Size(SizeMode),
+    Multiple {
+        cols: usize,
+        rows: usize,
+        /// Source pages on each sheet, at most `cols × rows`: three per sheet uses a 2 × 2 grid
+        /// with one cell left blank.
+        per_sheet: usize,
+        order: PageOrder,
+        border: bool,
+        auto_rotate: bool,
+    },
+    Booklet {
+        subset: BookletSubset,
+        binding: Binding,
+    },
+    /// Tile scale (percent), overlap (points), cut marks.
+    Poster {
+        scale: f64,
+        overlap: f64,
+        cut_marks: bool,
+    },
+    /// Shipping label: each page cut to its [`Settings::crops`] box, turned so its text reads
+    /// upright on the sheet and fitted with [`LABEL_MARGIN`]; `flip` turns it a further 180°.
+    Label {
+        flip: bool,
+    },
+}
+
+impl Default for Layout {
+    fn default() -> Self {
+        Layout::Size(SizeMode::Fit)
+    }
+}
+
+impl Layout {
+    /// Acrobat's pages-per-sheet choices as a grid (columns × rows on a portrait sheet).
+    pub fn multiple(per_sheet: usize) -> Layout {
+        let (cols, rows) = match per_sheet {
+            2 => (1, 2),
+            4 => (2, 2),
+            6 => (2, 3),
+            9 => (3, 3),
+            16 => (4, 4),
+            n => {
+                let c = (n as f64).sqrt().ceil().max(1.0) as usize;
+                (c, n.div_ceil(c).max(1))
+            }
+        };
+        Layout::Multiple { cols, rows, per_sheet: per_sheet.max(1), order: PageOrder::Horizontal, border: false, auto_rotate: true }
+    }
+}
+
+/// Acrobat's Comments & Forms choices.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum Content {
+    /// Page content and form fields.
+    Document,
+    /// Page content, form fields and every printable comment.
+    #[default]
+    DocumentAndMarkups,
+    /// Page content, form fields and stamps.
+    DocumentAndStamps,
+    /// Form fields only.
+    FormFieldsOnly,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Settings {
+    /// Source pages (0-based) in print order; see [`select_pages`].
+    pub pages: Vec<usize>,
+    /// Paper (width, height) in points, portrait.
+    pub paper: (f64, f64),
+    pub orientation: Orientation,
+    pub layout: Layout,
+    pub content: Content,
+    /// For [`Layout::Label`], per source page: the area to keep (display space) and whether its
+    /// text runs bottom-to-top (so a quarter turn clockwise makes it upright). `None` or a
+    /// missing entry keeps the whole page.
+    pub crops: Vec<Option<Crop>>,
+    /// Print as image (Acrobat's Advanced Print Setup): every page rendered to a picture at this
+    /// resolution before it is placed on the paper. The engine does the rendering; `impose` is
+    /// then given the image-only document.
+    pub raster: Option<Raster>,
+}
+
+/// How pages are rendered when printing as image.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Raster {
+    /// Dots per inch, 72–600 (Acrobat offers 150, 300 and 600).
+    pub dpi: f64,
+    /// Render the pictures in grey, so the print-ready PDF itself is grayscale.
+    pub grayscale: bool,
+}
+
+impl Default for Raster {
+    fn default() -> Self {
+        Raster { dpi: 300.0, grayscale: false }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Crop {
+    pub rect: [f64; 4],
+    pub text_up: bool,
+}
+
+impl Default for Settings {
+    fn default() -> Self {
+        Settings {
+            pages: Vec::new(),
+            paper: PAPERS[0].1,
+            orientation: Orientation::Auto,
+            layout: Layout::default(),
+            content: Content::default(),
+            raster: None,
+            crops: Vec::new(),
+        }
+    }
+}
+
+/// Common paper sizes (points, portrait).
+pub const PAPERS: [(&str, (f64, f64)); 21] = [
+    ("US Letter", (612.0, 792.0)),
+    ("US Legal", (612.0, 1008.0)),
+    ("Tabloid", (792.0, 1224.0)),
+    ("A3", (841.89, 1190.55)),
+    ("A4", (595.28, 841.89)),
+    ("A5", (419.53, 595.28)),
+    ("A6", (297.64, 419.53)),
+    ("ARCH A (9 x 12 in)", (648.0, 864.0)),
+    ("ARCH B (12 x 18 in)", (864.0, 1296.0)),
+    ("ARCH C (18 x 24 in)", (1296.0, 1728.0)),
+    ("ARCH D (24 x 36 in)", (1728.0, 2592.0)),
+    ("ARCH E1 (30 x 42 in)", (2160.0, 3024.0)),
+    ("ARCH E (36 x 48 in)", (2592.0, 3456.0)),
+    ("ANSI C (17 x 22 in)", (1224.0, 1584.0)),
+    ("ANSI D (22 x 34 in)", (1584.0, 2448.0)),
+    ("ANSI E (34 x 44 in)", (2448.0, 3168.0)),
+    ("A2", (1190.55, 1683.78)),
+    ("A1", (1683.78, 2383.94)),
+    ("A0", (2383.94, 3370.39)),
+    ("4 x 6 in label (101.6 x 152.4 mm)", (288.0, 432.0)),
+    ("US #10 Envelope (4.125 x 9.5 in)", (297.0, 684.0)),
+];
+
+/// `PAPERS` index of the 4 × 6 in shipping label.
+pub const LABEL_PAPER: usize = 19;
+
+/// The CUPS media name for `PAPERS[index]`, so the spooler feeds the sheet the PDF was laid out
+/// on rather than the queue's default; `None` only past the end of `PAPERS`. The common sizes
+/// use their PPD keywords (`w288h432` is the usual 4×6 label, `Env10` the US #10 envelope).
+/// The rest use PWG 5101.1 names (ARCH E1 is its `wide-format` size), spelled exactly as the
+/// spec and the IANA registry have them: a driverless printer may take only the names it
+/// advertises. They carry their dimensions, so CUPS feeds the PPD size of those dimensions
+/// whatever the driver calls it (`ARCHD`, `AnsiD`) (#3752).
+pub fn cups_media(index: usize) -> Option<&'static str> {
+    Some(match PAPERS.get(index)?.0 {
+        "US Letter" => "Letter",
+        "US Legal" => "Legal",
+        "Tabloid" => "Tabloid",
+        "A3" => "A3",
+        "A4" => "A4",
+        "A5" => "A5",
+        "A6" => "iso_a6_105x148mm",
+        "ARCH A (9 x 12 in)" => "na_arch-a_9x12in",
+        "ARCH B (12 x 18 in)" => "na_arch-b_12x18in",
+        "ARCH C (18 x 24 in)" => "na_arch-c_18x24in",
+        "ARCH D (24 x 36 in)" => "na_arch-d_24x36in",
+        "ARCH E1 (30 x 42 in)" => "na_wide-format_30x42in",
+        "ARCH E (36 x 48 in)" => "na_arch-e_36x48in",
+        "ANSI C (17 x 22 in)" => "na_c_17x22in",
+        "ANSI D (22 x 34 in)" => "na_d_22x34in",
+        "ANSI E (34 x 44 in)" => "na_e_34x44in",
+        "A2" => "iso_a2_420x594mm",
+        "A1" => "iso_a1_594x841mm",
+        "A0" => "iso_a0_841x1189mm",
+        "US #10 Envelope (4.125 x 9.5 in)" => "Env10",
+        _ if index == LABEL_PAPER => "w288h432",
+        // A size added to PAPERS without a name here: its tests fail, and meanwhile the queue's
+        // paper stands, as it did for every size before #1583.
+        _ => return None,
+    })
+}
+
+/// The job option that feeds `PAPERS[index]` (`media`, see [`cups_media`]), for the Print
+/// dialog's jobs and `doc_print`'s alike.
+pub fn media_option(index: usize) -> Option<(String, String)> {
+    cups_media(index).map(|m| ("media".to_string(), m.to_string()))
+}
diff --git a/crates/print/src/sheets.rs b/crates/print/src/sheets.rs
new file mode 100644
index 0000000000..ce80adc3eb
--- /dev/null
+++ b/crates/print/src/sheets.rs
@@ -0,0 +1,350 @@
+use super::error::PrintError;
+use super::imposition::decoded_contents;
+use super::settings::{Binding, BookletSubset, Layout, Orientation, PAPERS, PageOrder, Settings, SizeMode};
+use super::*;
+
+/// Whether most of page `index`'s text runs bottom-to-top as the page displays (a label laid
+/// sideways on a letter or A4 sheet), counting each text-showing operator once; form XObjects
+/// are followed a few levels deep.
+pub fn text_reads_up(doc: &Document, index: usize) -> bool {
+    let Some(page) = pdfcraft_model::pages(doc).into_iter().nth(index) else { return false };
+    let to_display = Matrix(page.view_matrix(doc)).invert().unwrap_or_default();
+    let res = page.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_default();
+    let mut score = 0i64;
+    let mut budget = DecodeBudget::page();
+    // Content past the budget is left out: the answer is a guess from the text read so far.
+    let data = decoded_contents(doc, &page.dict, &mut budget).unwrap_or_default();
+    text_direction(doc, &data, &res, to_display, 0, &mut score, &mut budget);
+    score > 0
+}
+
+pub(crate) fn text_direction(doc: &Document, data: &[u8], res: &Dict, base: Matrix, depth: usize, score: &mut i64, budget: &mut DecodeBudget) {
+    let (mut ctm, mut tm, mut stack) = (base, Matrix::IDENTITY, Vec::new());
+    for op in pdfcraft_content::parse(data).ops {
+        match op.op.as_slice() {
+            // Bounded like the renderer's graphics-state stack: deeper saves are ignored.
+            b"q" if stack.len() < 256 => stack.push(ctm),
+            b"Q" => ctm = stack.pop().unwrap_or(base),
+            b"cm" => ctm = Matrix::from_operands(&op.operands).unwrap_or_default().then(&ctm),
+            b"BT" => tm = Matrix::IDENTITY,
+            b"Tm" => tm = Matrix::from_operands(&op.operands).unwrap_or_default(),
+            b"Tj" | b"TJ" | b"'" | b"\"" => {
+                let [a, b, ..] = tm.then(&ctm).0;
+                *score += i64::from(b > a.abs()) - i64::from(-b > a.abs());
+            }
+            b"Do" if depth < 4 => {
+                let Some(name) = op.name(0) else { continue };
+                let Some(xobj) = res.get(b"XObject").and_then(|x| doc.resolve(x).as_dict().and_then(|x| x.get(name).cloned())) else { continue };
+                let Object::Stream(form) = &*doc.resolve(&xobj) else { continue };
+                if form.dict.get(b"Subtype").and_then(|s| doc.resolve(s).as_name().map(<[u8]>::to_vec)).as_deref() != Some(b"Form".as_slice()) {
+                    continue;
+                }
+                let m = form.dict.get(b"Matrix").and_then(|m| doc.resolve(m).as_array().and_then(|a| Matrix::from_operands(a))).unwrap_or_default();
+                let inner = form.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()).unwrap_or_else(|| res.clone());
+                if !budget.enter_form() {
+                    continue;
+                }
+                if let Ok(body) = budget.decode(form) {
+                    text_direction(doc, &body, &inner, m.then(&ctm), depth + 1, score, budget);
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Margin kept around a label: thermal heads miss the very edge, and many 4×6 drivers feed
+/// 100 × 150 mm (283 × 425 pt), a little short of the 288 × 432 pt sheet.
+pub const LABEL_MARGIN: f64 = 8.0;
+
+/// Place `crop` (display space) of `page` centred in `cell`, scaled by `s` and turned by
+/// `quarter` quarter turns counter-clockwise (0–3).
+fn place_crop(page: usize, crop: [f64; 4], cell: [f64; 4], s: f64, quarter: u8) -> Placement {
+    let (w, h) = (crop[2] - crop[0], crop[3] - crop[1]);
+    let (pw, ph) = if quarter % 2 == 1 { (h * s, w * s) } else { (w * s, h * s) };
+    let (x, y) = (cell[0] + (cell[2] - cell[0] - pw) / 2.0, cell[1] + (cell[3] - cell[1] - ph) / 2.0);
+    let [a, b, c, d, e, f] = match quarter % 4 {
+        0 => [s, 0.0, 0.0, s, x, y],
+        1 => [0.0, s, -s, 0.0, x + pw, y],
+        2 => [-s, 0.0, 0.0, -s, x + pw, y + ph],
+        _ => [0.0, -s, s, 0.0, x, y + ph],
+    };
+    // Move the crop's corner to the origin first.
+    Placement { page, matrix: Matrix([a, b, c, d, e - a * crop[0] - c * crop[1], f - b * crop[0] - d * crop[1]]), clip: crop }
+}
+
+/// Match a displayed PDF page to a standard sheet, independent of orientation.
+/// Half a point allows rounded metric PDF dimensions without confusing distinct sizes.
+pub fn matching_paper(size: (f64, f64)) -> Option<usize> {
+    if !size.0.is_finite() || !size.1.is_finite() {
+        return None;
+    }
+    let size = (size.0.min(size.1), size.0.max(size.1));
+    PAPERS.iter().position(|(_, p)| (p.0 - size.0).abs() <= 0.5 && (p.1 - size.1).abs() <= 0.5)
+}
+
+/// The unprintable margin assumed around the sheet for Fit, Multiple and Booklet.
+pub const MARGIN: f64 = 18.0;
+
+/// One page as placed on a sheet: the source page, the matrix from its *display space* to the
+/// sheet, and the visible part of it in display space (clipping).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Placement {
+    pub page: usize,
+    pub matrix: Matrix,
+    pub clip: [f64; 4],
+}
+
+/// One output sheet.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Sheet {
+    pub size: (f64, f64),
+    pub placed: Vec<Placement>,
+    /// Page borders (Multiple) and cut marks (Poster), in sheet space: rectangles and lines.
+    pub borders: Vec<[f64; 4]>,
+    pub lines: Vec<[f64; 4]>,
+}
+
+fn oriented(paper: (f64, f64), o: Orientation, landscape_wanted: bool) -> (f64, f64) {
+    let (w, h) = (paper.0.min(paper.1), paper.0.max(paper.1));
+    match o {
+        Orientation::Portrait => (w, h),
+        Orientation::Landscape => (h, w),
+        Orientation::Auto => {
+            if landscape_wanted {
+                (h, w)
+            } else {
+                (w, h)
+            }
+        }
+    }
+}
+
+/// Place a page of display size `(dw, dh)` inside `cell` (sheet space), scaled by `s`
+/// (centred), optionally rotated 90° (counter-clockwise).
+fn place_in(page: usize, (dw, dh): (f64, f64), cell: [f64; 4], s: f64, rotate: bool) -> Placement {
+    let (cw, ch) = (cell[2] - cell[0], cell[3] - cell[1]);
+    let (pw, ph) = if rotate { (dh * s, dw * s) } else { (dw * s, dh * s) };
+    let (x, y) = (cell[0] + (cw - pw) / 2.0, cell[1] + (ch - ph) / 2.0);
+    let matrix = if rotate { Matrix([0.0, s, -s, 0.0, x + pw, y]) } else { Matrix([s, 0.0, 0.0, s, x, y]) };
+    Placement { page, matrix, clip: [0.0, 0.0, dw, dh] }
+}
+
+fn fit_scale((dw, dh): (f64, f64), (cw, ch): (f64, f64)) -> f64 {
+    if dw <= 0.0 || dh <= 0.0 { 1.0 } else { (cw / dw).min(ch / dh) }
+}
+
+/// Lay out the sheets for `settings` given each source page's display size.
+pub fn layout(sizes: &[(f64, f64)], settings: &Settings) -> Result<Vec<Sheet>, PrintError> {
+    let pages: Vec<usize> = settings.pages.iter().copied().filter(|p| *p < sizes.len()).collect();
+    if pages.is_empty() {
+        return Err(PrintError::NoPages);
+    }
+    let paper = settings.paper;
+    if !(paper.0 >= 72.0 && paper.1 >= 72.0 && paper.0.is_finite() && paper.1.is_finite()) {
+        return Err(PrintError::Invalid("invalid paper size".into()));
+    }
+    let mut sheets = Vec::new();
+    match settings.layout {
+        Layout::Size(mode) => {
+            for &p in &pages {
+                let d = sizes[p];
+                let size = oriented(paper, settings.orientation, d.0 > d.1);
+                let fit = fit_scale(d, (size.0 - 2.0 * MARGIN, size.1 - 2.0 * MARGIN));
+                let s = match mode {
+                    SizeMode::Fit => fit,
+                    SizeMode::Actual => 1.0,
+                    SizeMode::Shrink => fit.min(1.0),
+                    SizeMode::Custom(pct) if pct.is_finite() && pct > 0.0 => pct / 100.0,
+                    SizeMode::Custom(_) => return Err(PrintError::Invalid("the scale must be more than 0%".into())),
+                };
+                sheets.push(Sheet { size, placed: vec![place_in(p, d, [0.0, 0.0, size.0, size.1], s, false)], ..Sheet::default() });
+            }
+        }
+        Layout::Label { flip } => {
+            let size = oriented(paper, settings.orientation, false);
+            let cell = [LABEL_MARGIN, LABEL_MARGIN, size.0 - LABEL_MARGIN, size.1 - LABEL_MARGIN];
+            for &p in &pages {
+                let d = sizes[p];
+                let crop = settings.crops.get(p).copied().flatten();
+                let rect = crop
+                    .map(|c| [c.rect[0].max(0.0), c.rect[1].max(0.0), c.rect[2].min(d.0), c.rect[3].min(d.1)])
+                    .filter(|r| r[2] - r[0] > 1.0 && r[3] - r[1] > 1.0)
+                    .unwrap_or([0.0, 0.0, d.0, d.1]);
+                let (w, h) = (rect[2] - rect[0], rect[3] - rect[1]);
+                let turn = (w > h) != (cell[2] - cell[0] > cell[3] - cell[1]);
+                let mut quarter = match (turn, crop.is_some_and(|c| c.text_up)) {
+                    (false, _) => 0,
+                    (true, true) => 3,
+                    (true, false) => 1,
+                };
+                if flip {
+                    quarter = (quarter + 2) % 4;
+                }
+                let s = if turn {
+                    fit_scale((h, w), (cell[2] - cell[0], cell[3] - cell[1]))
+                } else {
+                    fit_scale((w, h), (cell[2] - cell[0], cell[3] - cell[1]))
+                };
+                sheets.push(Sheet { size, placed: vec![place_crop(p, rect, cell, s, quarter)], ..Sheet::default() });
+            }
+        }
+        Layout::Multiple { cols, rows, per_sheet, order, border, auto_rotate } => {
+            let cells = cols.checked_mul(rows).filter(|&n| n > 0 && n <= 256);
+            let Some(cells) = cells else {
+                return Err(PrintError::Invalid("invalid number of pages per sheet".into()));
+            };
+            // The grid can have more cells than the pages asked for on each sheet; the rest stay blank.
+            let per_sheet = per_sheet.min(cells);
+            if per_sheet == 0 {
+                return Err(PrintError::Invalid("invalid number of pages per sheet".into()));
+            }
+            // A grid with more columns than rows wants a landscape sheet, and the reverse.
+            let first = pages.first().and_then(|&p| sizes.get(p)).copied().ok_or(PrintError::NoPages)?;
+            let page_landscape = first.0 > first.1;
+            let (gc, gr, sheet_landscape) = if cols == rows {
+                (cols, rows, page_landscape)
+            } else if settings.orientation == Orientation::Landscape || (settings.orientation == Orientation::Auto && cols < rows) {
+                // 2 per sheet (1 × 2 on portrait) prints side by side on landscape paper.
+                (rows, cols, true)
+            } else {
+                (cols, rows, false)
+            };
+            let size = oriented(paper, settings.orientation, sheet_landscape);
+            let gap = 6.0;
+            let (aw, ah) = (size.0 - 2.0 * MARGIN, size.1 - 2.0 * MARGIN);
+            let (cw, ch) = ((aw - gap * (gc - 1) as f64) / gc as f64, (ah - gap * (gr - 1) as f64) / gr as f64);
+            if cw <= 0.0 || ch <= 0.0 {
+                return Err(PrintError::Invalid("the page grid does not fit on the paper".into()));
+            }
+            let sheet_count = pages.len().div_ceil(per_sheet);
+            for sheet_index in 0..sheet_count {
+                let mut sheet = Sheet { size, ..Sheet::default() };
+                if order == PageOrder::CutStack {
+                    // Marks align across every sheet, including unoccupied cells. Cut in the
+                    // middle of each gutter; marks stay in the printable area, clear of cells.
+                    for col in 1..gc {
+                        let x = MARGIN + col as f64 * (cw + gap) - gap / 2.0;
+                        sheet.lines.extend([[x, MARGIN, x, MARGIN + 8.0], [x, size.1 - MARGIN - 8.0, x, size.1 - MARGIN]]);
+                    }
+                    for row in 1..gr {
+                        let y = size.1 - MARGIN - row as f64 * (ch + gap) + gap / 2.0;
+                        sheet.lines.extend([[MARGIN, y, MARGIN + 8.0, y], [size.0 - MARGIN - 8.0, y, size.0 - MARGIN, y]]);
+                    }
+                }
+                for k in 0..per_sheet {
+                    // A cell's pile gets consecutive pages. Missing pages leave blank cells,
+                    // rather than shifting later piles left on the final sheets.
+                    let index = if order == PageOrder::CutStack {
+                        k.checked_mul(sheet_count).and_then(|n| n.checked_add(sheet_index))
+                    } else {
+                        sheet_index.checked_mul(per_sheet).and_then(|n| n.checked_add(k))
+                    };
+                    let Some(p) = index.and_then(|i| pages.get(i)).copied() else { continue };
+
+                    let (col, row) = match order {
+                        PageOrder::Horizontal | PageOrder::CutStack => (k % gc, k / gc),
+                        PageOrder::HorizontalReversed => (gc - 1 - k % gc, k / gc),
+                        PageOrder::Vertical => (k / gr, k % gr),
+                        PageOrder::VerticalReversed => (gc - 1 - k / gr, k % gr),
+                    };
+                    let x0 = MARGIN + col as f64 * (cw + gap);
+                    let y1 = size.1 - MARGIN - row as f64 * (ch + gap);
+                    let cell = [x0, y1 - ch, x0 + cw, y1];
+                    let d = sizes.get(p).copied().ok_or_else(|| PrintError::Invalid("page size is missing".into()))?;
+                    if !(d.0.is_finite() && d.1.is_finite() && d.0 > 0.0 && d.1 > 0.0) {
+                        return Err(PrintError::Invalid("invalid page size".into()));
+                    }
+                    let rotate = auto_rotate && (d.0 > d.1) != (cw > ch) && (d.0 - d.1).abs() > 1.0;
+                    let s = fit_scale(if rotate { (d.1, d.0) } else { d }, (cw, ch));
+                    if !s.is_finite() || s <= 0.0 {
+                        return Err(PrintError::Invalid("page size cannot be scaled to the grid".into()));
+                    }
+                    let pl = place_in(p, d, cell, s, rotate);
+                    if border {
+                        let b = pl.matrix.bbox(pl.clip);
+                        sheet.borders.push(b);
+                    }
+                    sheet.placed.push(pl);
+                }
+                sheets.push(sheet);
+            }
+        }
+        Layout::Booklet { subset, binding } => {
+            // Pad to a multiple of 4 with blank pages (None).
+            let n4 = pages.len().div_ceil(4) * 4;
+            let at = |i: usize| pages.get(i).copied();
+            let size = oriented(paper, Orientation::Landscape, true);
+            let half = (size.0 - 2.0 * MARGIN) / 2.0;
+            let cells = [[MARGIN, MARGIN, MARGIN + half, size.1 - MARGIN], [MARGIN + half, MARGIN, size.0 - MARGIN, size.1 - MARGIN]];
+            for k in 0..n4 / 4 {
+                let front = (at(n4 - 1 - 2 * k), at(2 * k));
+                let back = (at(2 * k + 1), at(n4 - 2 - 2 * k));
+                let mut sides = Vec::new();
+                if subset != BookletSubset::BackOnly {
+                    sides.push(front);
+                }
+                if subset != BookletSubset::FrontOnly {
+                    sides.push(back);
+                }
+                for (l, r) in sides {
+                    let (l, r) = if binding == Binding::Right { (r, l) } else { (l, r) };
+                    let mut sheet = Sheet { size, ..Sheet::default() };
+                    for (p, cell) in [(l, cells[0]), (r, cells[1])] {
+                        if let Some(p) = p {
+                            let d = sizes[p];
+                            let s = fit_scale(d, (cell[2] - cell[0], cell[3] - cell[1]));
+                            sheet.placed.push(place_in(p, d, cell, s, false));
+                        }
+                    }
+                    sheets.push(sheet);
+                }
+            }
+        }
+        Layout::Poster { scale, overlap, cut_marks } => {
+            if !(scale.is_finite() && scale > 0.0 && overlap.is_finite() && overlap >= 0.0) {
+                return Err(PrintError::Invalid("invalid tile scale or overlap".into()));
+            }
+            let s = scale / 100.0;
+            for &p in &pages {
+                let d = sizes[p];
+                let size = oriented(paper, settings.orientation, d.0 > d.1);
+                // Each tile shows `step` of the scaled page plus `overlap` shared with the next.
+                let (tw, th) = (size.0 - 2.0 * MARGIN, size.1 - 2.0 * MARGIN);
+                if overlap * 2.0 >= tw.min(th) {
+                    return Err(PrintError::Invalid("the overlap is larger than the tile".into()));
+                }
+                let (sw, sh) = (d.0 * s, d.1 * s);
+                let (stepx, stepy) = (tw - overlap, th - overlap);
+                let nx = (((sw - overlap) / stepx).ceil() as usize).max(1);
+                let ny = (((sh - overlap) / stepy).ceil() as usize).max(1);
+                // The counts saturate at usize::MAX for a huge scale, so their product can overflow.
+                if nx.checked_mul(ny).is_none_or(|n| n > 1024) {
+                    return Err(PrintError::Invalid("the poster would need more than 1024 sheets".into()));
+                }
+                // Tiles from the top-left, row by row.
+                for ty in 0..ny {
+                    for tx in 0..nx {
+                        // The window into the scaled page (scaled display space, y up).
+                        let wx0 = tx as f64 * stepx;
+                        let wy1 = sh - ty as f64 * stepy;
+                        let matrix = Matrix([s, 0.0, 0.0, s, MARGIN - wx0, size.1 - MARGIN - wy1]);
+                        let clip = [wx0 / s, (wy1 - th) / s, (wx0 + tw) / s, wy1 / s];
+                        let mut sheet = Sheet { size, placed: vec![Placement { page: p, matrix, clip }], ..Sheet::default() };
+                        if cut_marks {
+                            let (x0, y0, x1, y1) = (MARGIN, MARGIN, size.0 - MARGIN, size.1 - MARGIN);
+                            for (x, y) in [(x0, y0), (x1, y0), (x0, y1), (x1, y1)] {
+                                let dx = if x == x0 { -1.0 } else { 1.0 };
+                                let dy = if y == y0 { -1.0 } else { 1.0 };
+                                sheet.lines.push([x + dx * 2.0, y, x + dx * (MARGIN - 2.0), y]);
+                                sheet.lines.push([x, y + dy * 2.0, x, y + dy * (MARGIN - 2.0)]);
+                            }
+                        }
+                        sheets.push(sheet);
+                    }
+                }
+            }
+        }
+    }
+    Ok(sheets)
+}
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index bc0454c999..e6432d8aec 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -283,8 +283,8 @@ fn spooler_arguments_and_printer_list() {
     assert_eq!(
         parse_lpstat(out),
         [
-            spool::Printer { name: "Office_Laser".into(), default: true, two_sided: None },
-            spool::Printer { name: "Label_Writer".into(), default: false, two_sided: None }
+            spool::Printer { name: "Office_Laser".into(), default: true, two_sided: None, description: String::new() },
+            spool::Printer { name: "Label_Writer".into(), default: false, two_sided: None, description: String::new() }
         ]
     );
     assert!(parse_lpstat("lpstat: No destinations added.\nno system default destination\n").is_empty());
@@ -327,18 +327,21 @@ fn driverless_printers_join_the_list_without_a_queue() {
     assert_eq!(
         spool::printers_parsed(queues, Some("Basement_Color\nOffice_Laser\n")),
         [
-            spool::Printer { name: "Office_Laser".into(), default: true, two_sided: None },
-            spool::Printer { name: "Basement_Color".into(), default: false, two_sided: None },
+            spool::Printer { name: "Office_Laser".into(), default: true, two_sided: None, description: String::new() },
+            spool::Printer { name: "Basement_Color".into(), default: false, two_sided: None, description: String::new() },
         ],
         "queues first, then the driverless destination; the queue listed twice is not doubled"
     );
     // An old spooler without `-e` (CUPS < 1.7) keeps its queues; only the driverless names are lost.
-    assert_eq!(spool::printers_parsed(queues, None), [spool::Printer { name: "Office_Laser".into(), default: true, two_sided: None }]);
+    assert_eq!(
+        spool::printers_parsed(queues, None),
+        [spool::Printer { name: "Office_Laser".into(), default: true, two_sided: None, description: String::new() }]
+    );
     // The default can itself be driverless (`lpoptions -d` names a destination no queue exists
     // for): it keeps its marker, so the dialog preselects the user's default, not the first queue.
     assert_eq!(
         spool::printers_parsed("system default destination: Basement_Color\n", Some("Basement_Color\n")),
-        [spool::Printer { name: "Basement_Color".into(), default: true, two_sided: None }],
+        [spool::Printer { name: "Basement_Color".into(), default: true, two_sided: None, description: String::new() }],
         "a default destination without a queue is still the default"
     );
     assert!(spool::parse_lpstat_e("\n \n").is_empty(), "no destinations is empty, not [\"\"]");
@@ -414,17 +417,17 @@ fn windows_printers_carry_one_default_and_keep_their_names() {
     // Windows marks the system default with a `*` no queue name may contain; names hold spaces,
     // parentheses and non-ASCII letters, and the lines end with CRLF.
     let printers = parse_windows_printers("*Microsoft Print to PDF\r\nHP LaserJet 400 (Copy 2)\r\nКопир Canon iR\r\n\r\n*XPS via USB\r\n");
-    assert_eq!(printers[0], Printer { name: "Microsoft Print to PDF".into(), default: true, two_sided: None });
-    assert_eq!(printers[1], Printer { name: "HP LaserJet 400 (Copy 2)".into(), default: false, two_sided: None });
-    assert_eq!(printers[2], Printer { name: "Копир Canon iR".into(), default: false, two_sided: None });
+    assert_eq!(printers[0], Printer { name: "Microsoft Print to PDF".into(), default: true, two_sided: None, description: String::new() });
+    assert_eq!(printers[1], Printer { name: "HP LaserJet 400 (Copy 2)".into(), default: false, two_sided: None, description: String::new() });
+    assert_eq!(printers[2], Printer { name: "Копир Canon iR".into(), default: false, two_sided: None, description: String::new() });
     // A spooler marking two defaults: the first still wins, so the dialog has one to preselect.
-    assert_eq!(printers[3], Printer { name: "XPS via USB".into(), default: false, two_sided: None });
+    assert_eq!(printers[3], Printer { name: "XPS via USB".into(), default: false, two_sided: None, description: String::new() });
     assert_eq!(parse_windows_printers("\r\n"), Vec::new());
     // After a tab, whether the driver reports two-sided printing; a tab inside a name stays.
     let sided = parse_windows_printers("*Office PCL\t2\r\nOffice PS\t1\r\nTab\tName\t2\r\n");
-    assert_eq!(sided[0], Printer { name: "Office PCL".into(), default: true, two_sided: Some(true) });
-    assert_eq!(sided[1], Printer { name: "Office PS".into(), default: false, two_sided: Some(false) });
-    assert_eq!(sided[2], Printer { name: "Tab\tName".into(), default: false, two_sided: Some(true) });
+    assert_eq!(sided[0], Printer { name: "Office PCL".into(), default: true, two_sided: Some(true), description: String::new() });
+    assert_eq!(sided[1], Printer { name: "Office PS".into(), default: false, two_sided: Some(false), description: String::new() });
+    assert_eq!(sided[2], Printer { name: "Tab\tName".into(), default: false, two_sided: Some(true), description: String::new() });
 }
 
 /// A PPD shaped like a Fiery's: installable options, multi-line PostScript in the choices, Latin-1
diff --git a/crates/redact/src/interp.rs b/crates/redact/src/interp.rs
index 3380fece14..71b4684bc7 100644
--- a/crates/redact/src/interp.rs
+++ b/crates/redact/src/interp.rs
@@ -26,6 +26,13 @@ use pdfcraft_cos::{CosError, DecodeBudget, Dict, Document, MAX_PAGE_FORMS, ObjRe
 use crate::{RedactError, Report, image, page_streams, tags};
 use pdfcraft_fonts::pdf::Metrics;
 
+mod layers;
+mod prune;
+
+use layers::strip_hidden_layers;
+use prune::{clip_out, extgstate_font, prune_form_resources};
+pub(crate) use prune::{prune, prune_properties, resource_ops, unlink_doomed};
+
 /// How deep this pass follows form XObjects. A form past it is removed rather than walked, which
 /// is the fail-safe choice for a redaction -- marked content inside a form we cannot read would
 /// otherwise survive -- but it also removes whatever else that form drew, marked or not. So the
@@ -151,217 +158,6 @@ impl<'a> Scope<'a> {
         self.hidden_text.is_some() || self.layers_enabled
     }
 
-    /// Is this optional-content reference (an OCG or OCMD) hidden?
-    fn layer_hidden(&mut self, doc: &Document, o: &Object) -> bool {
-        if !self.layers_enabled {
-            return false;
-        }
-        let reference = o.as_ref();
-        if let Some(r) = reference {
-            if let Some(hidden) = self.ocmd_cache.get(&r) {
-                return *hidden;
-            }
-            if self.hidden_layers.contains(&r) {
-                self.ocmd_cache.insert(r, true);
-                return true;
-            }
-        }
-        // Evaluate the policy against the same default configuration used to select hidden
-        // groups. A membership dictionary's default policy is AnyOn.
-        let d = doc.resolve(o);
-        let Some(d) = d.as_dict() else { return false };
-        if d.name(b"Type") != Some(b"OCMD") {
-            return false;
-        }
-        let groups: Vec<ObjRef> = match d.get(b"OCGs").map(|g| (*doc.resolve(g)).clone()) {
-            Some(Object::Array(a)) => a.iter().filter_map(Object::as_ref).collect(),
-            Some(_) => d.get(b"OCGs").and_then(Object::as_ref).into_iter().collect(),
-            None => Vec::new(),
-        };
-        let fail_closed = || groups.iter().any(|g| self.hidden_layers.contains(g));
-        let hidden = if let Some(expression) = d.get(b"VE") {
-            let visible = self.visibility_expression(doc, expression, 0, &mut HashSet::new(), &mut 4096);
-            match visible {
-                Some(visible) => !visible,
-                None => fail_closed() || self.expression_mentions_hidden(doc, expression, 0, &mut HashSet::new(), &mut 4096),
-            }
-        } else if groups.is_empty() {
-            false
-        } else {
-            let any_on = groups.iter().any(|g| !self.hidden_layers.contains(g));
-            let all_on = groups.iter().all(|g| !self.hidden_layers.contains(g));
-            let policy = d.get(b"P").map(|p| doc.resolve(p)).and_then(|p| p.as_name().map(|name| name.to_vec()));
-            match (d.get(b"P"), policy.as_deref()) {
-                (None, _) | (Some(_), Some(b"AnyOn")) => !any_on,
-                (Some(_), Some(b"AllOn")) => !all_on,
-                (Some(_), Some(b"AnyOff")) => all_on,
-                (Some(_), Some(b"AllOff")) => any_on,
-                // An invalid policy must not make a candidate hidden block survive sanitization.
-                _ => fail_closed(),
-            }
-        };
-        if !hidden {
-            self.retained_off_layers.extend(groups.iter().filter(|g| self.hidden_layers.contains(g)).copied());
-            if let Some(expression) = d.get(b"VE") {
-                let mut referenced = HashSet::new();
-                if Self::collect_hidden_expression_groups(doc, expression, &self.hidden_layers, 0, &mut HashSet::new(), &mut 4096, &mut referenced) {
-                    self.retained_off_layers.extend(referenced);
-                } else {
-                    // If an expression cannot be fully walked, preserve every off group so that
-                    // the content we kept does not change visibility after configuration cleanup.
-                    self.retained_off_layers.extend(self.hidden_layers.iter().copied());
-                }
-            }
-        }
-        if let Some(r) = reference {
-            self.ocmd_cache.insert(r, hidden);
-        }
-        hidden
-    }
-
-    fn xobject_layer_hidden(&mut self, doc: &Document, xobject: ObjRef, oc: &Object) -> bool {
-        if oc.as_ref().is_some() {
-            return self.layer_hidden(doc, oc);
-        }
-        if let Some(hidden) = self.xobject_oc_cache.get(&xobject) {
-            return *hidden;
-        }
-        let hidden = self.layer_hidden(doc, oc);
-        self.xobject_oc_cache.insert(xobject, hidden);
-        hidden
-    }
-
-    fn collect_hidden_expression_groups(
-        doc: &Document,
-        expression: &Object,
-        hidden_layers: &HashSet<ObjRef>,
-        depth: usize,
-        path: &mut HashSet<ObjRef>,
-        budget: &mut usize,
-        found: &mut HashSet<ObjRef>,
-    ) -> bool {
-        if depth > 64 || *budget == 0 {
-            return false;
-        }
-        *budget -= 1;
-        let reference = expression.as_ref();
-        if let Some(r) = reference
-            && !path.insert(r)
-        {
-            return false;
-        }
-        let resolved = doc.resolve(expression);
-        let complete = match &*resolved {
-            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => {
-                if let Some(r) = reference
-                    && hidden_layers.contains(&r)
-                {
-                    found.insert(r);
-                }
-                reference.is_some()
-            }
-            Object::Array(items) => {
-                let Some(Object::Name(operator)) = items.first() else { return false };
-                let operands = match operator.as_slice() {
-                    b"And" | b"Or" if (2..=4097).contains(&items.len()) => items.get(1..),
-                    b"Not" if items.len() == 2 => items.get(1..),
-                    _ => None,
-                };
-                operands.is_some_and(|operands| {
-                    operands.iter().all(|item| Self::collect_hidden_expression_groups(doc, item, hidden_layers, depth + 1, path, budget, found))
-                })
-            }
-            _ => false,
-        };
-        if let Some(r) = reference {
-            path.remove(&r);
-        }
-        complete
-    }
-
-    /// Evaluate an optional-content visibility expression (`/VE`) against the default config.
-    /// Malformed, cyclic, or excessive expressions return `None` so the caller can fail closed.
-    fn visibility_expression(
-        &self,
-        doc: &Document,
-        expression: &Object,
-        depth: usize,
-        path: &mut HashSet<ObjRef>,
-        budget: &mut usize,
-    ) -> Option<bool> {
-        if depth > 64 || *budget == 0 {
-            return None;
-        }
-        *budget -= 1;
-        let reference = expression.as_ref();
-        if let Some(r) = reference
-            && !path.insert(r)
-        {
-            return None;
-        }
-        let resolved = doc.resolve(expression);
-        let result = match &*resolved {
-            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => reference.map(|r| !self.hidden_layers.contains(&r)),
-            Object::Array(items) if (2..=4097).contains(&items.len()) => {
-                let operator = match items.first() {
-                    Some(Object::Name(n)) => n.as_slice(),
-                    _ => return None,
-                };
-                match operator {
-                    b"And" if items.len() >= 2 => {
-                        let mut visible = true;
-                        for item in items.iter().skip(1) {
-                            visible &= self.visibility_expression(doc, item, depth + 1, path, budget)?;
-                        }
-                        Some(visible)
-                    }
-                    b"Or" if items.len() >= 2 => {
-                        let mut visible = false;
-                        for item in items.iter().skip(1) {
-                            visible |= self.visibility_expression(doc, item, depth + 1, path, budget)?;
-                        }
-                        Some(visible)
-                    }
-                    b"Not" if items.len() == 2 => Some(!self.visibility_expression(doc, &items[1], depth + 1, path, budget)?),
-                    _ => None,
-                }
-            }
-            _ => None,
-        };
-        if let Some(r) = reference {
-            path.remove(&r);
-        }
-        result
-    }
-
-    /// Conservatively find hidden groups in an expression that could not be evaluated. Unknown
-    /// syntax, cycles, and exhausted budgets count as a possible hidden reference.
-    fn expression_mentions_hidden(&self, doc: &Document, expression: &Object, depth: usize, path: &mut HashSet<ObjRef>, budget: &mut usize) -> bool {
-        if depth > 64 || *budget == 0 {
-            return true;
-        }
-        *budget -= 1;
-        if let Some(r) = expression.as_ref() {
-            if self.hidden_layers.contains(&r) {
-                return true;
-            }
-            if !path.insert(r) {
-                return true;
-            }
-        }
-        let resolved = doc.resolve(expression);
-        let found = match &*resolved {
-            Object::Array(items) => items.iter().any(|item| self.expression_mentions_hidden(doc, item, depth + 1, path, budget)),
-            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => expression.as_ref().is_none_or(|r| self.hidden_layers.contains(&r)),
-            Object::Dict(_) => true,
-            _ => false,
-        };
-        if let Some(r) = expression.as_ref() {
-            path.remove(&r);
-        }
-        found
-    }
-
     fn hits(&self, b: [f64; 4]) -> bool {
         self.rects.iter().any(|r| overlaps(*r, b, 0.0))
     }
@@ -418,358 +214,6 @@ fn fresh_name(scope: &mut Scope<'_>, xobjects: &Dict) -> Vec<u8> {
     }
 }
 
-/// Drop every `replaced` resource name whose `Do` no longer appears in the rewritten `content`,
-/// so a full-rewrite save stops reaching the original image or form it named. A name that some
-/// surviving `Do` still draws (the same image shown again outside a mark) is kept.
-pub(crate) fn prune(xo: &mut Dict, replaced: &[Vec<u8>], content: &[Vec<u8>]) {
-    if replaced.is_empty() {
-        return;
-    }
-    let joined = Pieces::join(content);
-    let ops = joined.parse().ops;
-    let still_drawn = |n: &[u8]| ops.iter().any(|op| op.is("Do") && op.last_name() == Some(n));
-    for n in replaced {
-        if !still_drawn(n) {
-            xo.remove(n);
-        }
-    }
-}
-
-/// Whether `content` draws the XObject `name` of the resource dictionary `xo`: directly, or
-/// through a form that has no /Resources of its own (such a form draws through its caller's).
-/// `None` when that cannot be told (a form that will not decode, or nesting past the limit).
-fn content_draws(doc: &Document, content: &[Vec<u8>], xo: &Dict, name: &[u8], depth: usize, seen: &mut HashSet<ObjRef>) -> Option<bool> {
-    let joined = Pieces::join(content);
-    let ops = joined.parse().ops;
-    for op in ops.iter().filter(|op| op.is("Do")) {
-        let Some(n) = op.last_name() else { continue };
-        if n == name {
-            return Some(true);
-        }
-        let Some(r) = xo.get(n).and_then(Object::as_ref) else { continue };
-        let obj = doc.get(r);
-        let Object::Stream(s) = &*obj else { continue };
-        if s.dict.name(b"Subtype") != Some(b"Form") || s.dict.contains(b"Resources") || !seen.insert(r) {
-            continue;
-        }
-        if depth >= MAX_DEPTH {
-            return None;
-        }
-        let Ok(_data) = s.decoded() else { return None };
-        match content_draws(doc, content, xo, name, depth + 1, seen) {
-            Some(false) => {}
-            other => return other,
-        }
-    }
-    Some(false)
-}
-
-/// Unlink the XObjects a rewrite dropped or replaced (`doomed`) from every page-tree resource
-/// dictionary that still names them. The rewritten page has its own pruned /Resources, but the
-/// originals stay reachable, and so stay in a full-rewrite save, when:
-/// - the page inherited its /Resources from a /Pages node, which still lists them;
-/// - several pages share one resource dictionary, and another page still refers to it;
-/// - a form without /Resources drew them through the page's dictionary.
-///
-/// An entry goes unless a page that draws through that dictionary still draws the name (the same
-/// image shown on another page, or again outside a mark). A dictionary that loses an entry is
-/// replaced by a private copy on its node, so a dictionary object shared with other nodes is
-/// left as it is for them. Retired properties are likewise unlinked only when none of the
-/// holder's pages or inheriting forms names them. Fails closed when use cannot be determined.
-pub(crate) fn unlink_doomed(doc: &mut Document, doomed: &[ObjRef], retired_properties: &[Object]) -> Result<(), RedactError> {
-    if doomed.is_empty() && retired_properties.is_empty() {
-        return Ok(());
-    }
-    let doomed: HashSet<ObjRef> = doomed.iter().copied().collect();
-    let Some(top) = doc.root().and_then(|root| doc.get(root).as_dict().and_then(|d| d.reference(b"Pages"))) else { return Ok(()) };
-    // Every page-tree node with a /Resources of its own, and the pages that draw through it
-    // (the nearest such node above a page, or the page itself). Cycles are cut as in
-    // `pdfcraft_model::pages`.
-    let mut holders: Vec<(ObjRef, Vec<ObjRef>)> = Vec::new();
-    let mut seen = HashSet::new();
-    let mut stack: Vec<(ObjRef, Option<usize>)> = vec![(top, None)];
-    while let Some((node, mut holder)) = stack.pop() {
-        if !seen.insert(node) || seen.len() > 1_000_000 {
-            continue;
-        }
-        let obj = doc.get(node);
-        let Some(d) = obj.as_dict() else { continue };
-        if d.contains(b"Resources") {
-            holders.push((node, Vec::new()));
-            holder = Some(holders.len() - 1);
-        }
-        let is_pages = d.name(b"Type") == Some(b"Pages") || (d.contains(b"Kids") && d.name(b"Type") != Some(b"Page"));
-        if is_pages {
-            let kids = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
-            stack.extend(kids.iter().filter_map(Object::as_ref).map(|k| (k, holder)));
-        } else if let Some(h) = holder.and_then(|i| holders.get_mut(i)) {
-            h.1.push(node);
-        }
-    }
-    let index: HashMap<ObjRef, usize> = pdfcraft_model::pages(doc).iter().enumerate().map(|(i, p)| (p.obj, i)).collect();
-    let holder_nodes: Vec<ObjRef> = holders.iter().map(|(node, _)| *node).collect();
-    for (node, users) in holders {
-        let Some(mut res) = doc.get(node).as_dict().and_then(|d| d.get(b"Resources")).and_then(|r| doc.resolve(r).as_dict().cloned()) else {
-            continue;
-        };
-        let mut xo = res_dict(doc, &res, b"XObject");
-        let names: Vec<Vec<u8>> = xo.iter().filter(|(_, v)| v.as_ref().is_some_and(|r| doomed.contains(&r))).map(|(n, _)| n.to_vec()).collect();
-        let properties = res_dict(doc, &res, b"Properties");
-        let property_names: Vec<Vec<u8>> = properties.iter().filter(|(_, v)| retired_properties.contains(v)).map(|(n, _)| n.to_vec()).collect();
-        if names.is_empty() && property_names.is_empty() {
-            continue;
-        }
-        let mut contents = Vec::with_capacity(users.len());
-        for user in &users {
-            let page = doc.get(*user).as_dict().cloned().unwrap_or_default();
-            // A page whose content cannot be read may still draw the name: fail closed.
-            contents.push(page_streams(doc, &page, index.get(user).copied().unwrap_or(0))?.1);
-        }
-        let mut pruned = false;
-        for n in names {
-            let mut drawn = Some(false);
-            for content in &contents {
-                drawn = content_draws(doc, content, &xo, &n, 0, &mut HashSet::new());
-                if drawn != Some(false) {
-                    break;
-                }
-            }
-            match drawn {
-                Some(true) => {}
-                Some(false) => {
-                    xo.remove(&n);
-                    pruned = true;
-                }
-                None => return Err(RedactError::Residue(1)),
-            }
-        }
-        if pruned {
-            res.set(b"XObject".to_vec(), Object::Dict(xo));
-        }
-        pruned |= prune_retired_properties(doc, &mut res, &property_names, &contents)?;
-        if pruned {
-            doc.update_dict(node, |d| d.set(b"Resources".to_vec(), Object::Dict(res)))?;
-        }
-    }
-    // A surviving form can own the same old resource dictionary as a rewritten page. Its
-    // unused descriptions and doomed XObjects remain reachable too, even after every page
-    // holder is cleaned.
-    unlink_from_forms(doc, &holder_nodes, &doomed, retired_properties)?;
-    Ok(())
-}
-
-/// Retire only properties removed from a rewritten scope, preserving names still used by any
-/// content sharing this holder. Different pages' streams must never be concatenated together.
-fn prune_retired_properties(doc: &Document, res: &mut Dict, names: &[Vec<u8>], contents: &[Vec<Vec<u8>>]) -> Result<bool, CosError> {
-    if names.is_empty() {
-        return Ok(false);
-    }
-    let mut used = HashSet::new();
-    for content in contents {
-        for op in resource_ops(doc, res, content)? {
-            if matches!(op.op.as_slice(), b"BDC" | b"DP")
-                && let Some(name) = op.name(1)
-            {
-                used.insert(name.to_vec());
-            }
-        }
-    }
-    let mut properties = res_dict(doc, res, b"Properties");
-    let mut pruned = false;
-    for name in names {
-        if !used.contains(name) {
-            pruned |= properties.remove(name).is_some();
-        }
-    }
-    if pruned {
-        if properties.is_empty() {
-            res.remove(b"Properties");
-        } else {
-            res.set(b"Properties".to_vec(), Object::Dict(properties));
-        }
-    }
-    Ok(pruned)
-}
-
-/// Unlink retired properties and `doomed` XObjects from the resources of the forms reachable from
-/// the page-tree `holders`, each unless the form's own content (or a form inheriting its
-/// resources) still uses the name. Fails closed when that cannot be determined.
-fn unlink_from_forms(doc: &mut Document, holders: &[ObjRef], doomed: &HashSet<ObjRef>, retired: &[Object]) -> Result<(), CosError> {
-    if retired.is_empty() && doomed.is_empty() {
-        return Ok(());
-    }
-    let mut pending: Vec<Dict> = holders
-        .iter()
-        .filter_map(|r| doc.get(*r).as_dict().and_then(|d| d.get(b"Resources")).and_then(|r| doc.resolve(r).as_dict().cloned()))
-        .collect();
-    let mut seen = HashSet::new();
-    while let Some(resources) = pending.pop() {
-        for (_, value) in res_dict(doc, &resources, b"XObject").iter() {
-            let Some(reference) = value.as_ref() else { continue };
-            if !seen.insert(reference) {
-                continue;
-            }
-            if seen.len() > 1_000_000 {
-                return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect shared form resources".into() });
-            }
-            let object = doc.get(reference);
-            let Object::Stream(form) = &*object else { continue };
-            if form.dict.name(b"Subtype") != Some(b"Form") {
-                continue;
-            }
-            let Some(mut res) = form.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()) else { continue };
-            let names: Vec<Vec<u8>> =
-                res_dict(doc, &res, b"Properties").iter().filter(|(_, value)| retired.contains(value)).map(|(name, _)| name.to_vec()).collect();
-            let mut xo = res_dict(doc, &res, b"XObject");
-            let doomed_names: Vec<Vec<u8>> =
-                xo.iter().filter(|(_, v)| v.as_ref().is_some_and(|r| doomed.contains(&r))).map(|(n, _)| n.to_vec()).collect();
-            if names.is_empty() && doomed_names.is_empty() {
-                pending.push(res);
-                continue;
-            }
-            let data = form.decoded()?;
-            let mut pruned = prune_doomed_xobjects(doc, std::slice::from_ref(&data), &mut xo, &doomed_names)?;
-            if pruned {
-                res.set(b"XObject".to_vec(), Object::Dict(xo));
-            }
-            pruned |= prune_retired_properties(doc, &mut res, &names, &[vec![data]])?;
-            if pruned {
-                doc.update_dict(reference, |d| d.set(b"Resources".to_vec(), Object::Dict(res.clone())))?;
-            }
-            pending.push(res);
-        }
-    }
-    Ok(())
-}
-
-fn prune_doomed_xobjects(doc: &Document, content: &[Vec<u8>], xo: &mut Dict, doomed_names: &[Vec<u8>]) -> Result<bool, CosError> {
-    let mut pruned = false;
-    for name in doomed_names {
-        match content_draws(doc, content, xo, name, 0, &mut HashSet::new()) {
-            Some(true) => {}
-            Some(false) => pruned |= xo.remove(name).is_some(),
-            None => return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect shared form resources".into() }),
-        }
-    }
-    Ok(pruned)
-}
-
-/// The clip that hides everything inside each region: one even-odd clip per region (a big
-/// rectangle with the region cut out), in the current user space. Returns `None` when the CTM
-/// can't be inverted (nothing is painted then anyway).
-fn clip_out(rects: &[[f64; 4]], ctm: &Matrix, around: [f64; 4]) -> Option<Vec<Op>> {
-    let inv = ctm.invert()?;
-    let mut ops = Vec::new();
-    let big = [around[0] - 10.0, around[1] - 10.0, around[2] + 10.0, around[3] + 10.0];
-    for r in rects.iter().filter(|r| overlaps(**r, around, 0.0)) {
-        let outer = [(big[0], big[1]), (big[2], big[1]), (big[2], big[3]), (big[0], big[3])];
-        let inner = [(r[0], r[1]), (r[0], r[3]), (r[2], r[3]), (r[2], r[1])];
-        for poly in [outer, inner] {
-            for (k, (x, y)) in poly.iter().enumerate() {
-                let (u, v) = inv.apply(*x, *y);
-                ops.push(Op::new(if k == 0 { "m" } else { "l" }, vec![num(u), num(v)]));
-            }
-            ops.push(Op::new("h", vec![]));
-        }
-        ops.push(Op::new("W*", vec![]));
-        ops.push(Op::new("n", vec![]));
-    }
-    Some(ops)
-}
-
-fn resource_ops(doc: &Document, res: &Dict, content: &[Vec<u8>]) -> Result<Vec<Op>, CosError> {
-    let parsed = Pieces::join(content).parse();
-    if parsed.skipped > 0 || parsed.ops.len() > 2_000_000 {
-        return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect property resources".into() });
-    }
-    let mut ops = parsed.ops;
-    let xobjects = res_dict(doc, res, b"XObject");
-    let mut seen = HashSet::new();
-    let mut cursor = 0;
-    while cursor < ops.len() {
-        let op = &ops[cursor];
-        if op.is("Do")
-            && let Some(r) = op.last_name().and_then(|n| xobjects.get(n)).and_then(Object::as_ref)
-            && seen.insert(r)
-            && let Object::Stream(s) = &*doc.get(r)
-            && s.dict.name(b"Subtype") == Some(b"Form")
-            && s.dict.get(b"Resources").is_none_or(|r| doc.resolve(r).as_dict().is_none())
-        {
-            let parsed = pdfcraft_content::parse(&s.decoded()?);
-            if seen.len() > 2_000_000 || ops.len().saturating_add(parsed.ops.len()) > 2_000_000 || parsed.skipped > 0 {
-                return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect inherited form resources".into() });
-            }
-            ops.extend(parsed.ops);
-        }
-        cursor += 1;
-    }
-    Ok(ops)
-}
-
-pub(crate) fn prune_properties(doc: &Document, res: &mut Dict, content: &[Vec<u8>]) -> Result<Vec<Object>, CosError> {
-    let mut properties = res_dict(doc, res, b"Properties");
-    if properties.is_empty() {
-        return Ok(Vec::new());
-    }
-    let mut retired = Vec::new();
-    let ops = resource_ops(doc, res, content)?;
-    let names: Vec<Vec<u8>> = properties.iter().map(|(n, _)| n.to_vec()).collect();
-    for name in names {
-        if !ops.iter().any(|op| matches!(op.op.as_slice(), b"BDC" | b"DP") && op.name(1) == Some(&name))
-            && let Some(value) = properties.remove(&name)
-        {
-            retired.push(value);
-        }
-    }
-    if properties.is_empty() {
-        res.remove(b"Properties");
-    } else {
-        res.set(b"Properties".to_vec(), Object::Dict(properties));
-    }
-    Ok(retired)
-}
-
-fn prune_form_resources(doc: &Document, res: &mut Dict, content: &[Vec<u8>]) -> Result<(), CosError> {
-    let ops = resource_ops(doc, res, content)?;
-    let mut xo = res_dict(doc, res, b"XObject");
-    let names: Vec<Vec<u8>> = xo.iter().map(|(n, _)| n.to_vec()).collect();
-    for name in names {
-        if !ops.iter().any(|op| op.is("Do") && op.last_name() == Some(&name)) {
-            xo.remove(&name);
-        }
-    }
-    res.set(b"XObject".to_vec(), Object::Dict(xo));
-    Ok(())
-}
-
-/// The font, writing direction and size an ExtGState's `/Font [font size]` entry sets, as `Tf`
-/// would (ISO 32000-2 §8.4.5); `None` when `name` sets no font. The metrics are cached with the
-/// fonts `Tf` names, under a key no resource name can take (a name cannot hold a null byte).
-fn extgstate_font(
-    doc: &Document,
-    scope: &mut Scope<'_>,
-    ext_gstates: &Dict,
-    name: &[u8],
-    fallback: &Rc<Metrics>,
-) -> Option<(Rc<Metrics>, bool, f64)> {
-    let state = doc.resolve(ext_gstates.get(name)?).as_dict().cloned()?;
-    let entry = doc.resolve(state.get(b"Font")?).as_array().cloned()?;
-    let [font, size] = entry.as_slice() else { return None };
-    let size = doc.resolve(size).as_f64()?;
-    let font_dict = doc.resolve(font).as_dict().cloned();
-    let vertical = font_dict.as_ref().is_some_and(|d| is_vertical(doc, d));
-    let key = [b"\0".as_slice(), name].concat();
-    let metrics = match scope.fonts.get(&key) {
-        Some(m) => m.clone(),
-        None => {
-            let m = font_dict.as_ref().map(|d| Rc::new(Metrics::from_dict(doc, d))).unwrap_or_else(|| fallback.clone());
-            scope.fonts.insert(key, m.clone());
-            m
-        }
-    };
-    Some((metrics, vertical, size))
-}
-
 /// One glyph of a shown string.
 struct Glyph {
     bytes: std::ops::Range<usize>,
@@ -884,37 +328,14 @@ fn process_from(doc: &mut Document, scope: &mut Scope<'_>, streams: &[Vec<u8>],
                 }
                 let b = bbox.unwrap_or_default();
                 changed = true;
-                if scope.covered(b) {
-                    scope.report.paths_removed += 1;
-                    if clips {
-                        // Keep the clipping, drop the painting.
-                        ops.extend(body);
-                        ops.push(Op::new("n", vec![]));
-                    }
-                } else if clips {
-                    // A clip-and-paint path can't be wrapped in q/Q without losing its clip:
-                    // paint it clipped, then set its clip with a no-op path.
-                    scope.report.paths_clipped += 1;
-                    if let Some(c) = clip_out(scope.rects, &gs.ctm, b) {
-                        let plain: Vec<Op> = body.iter().filter(|p| !p.is("W") && !p.is("W*")).cloned().collect();
-                        ops.push(Op::new("q", vec![]));
-                        ops.extend(c);
-                        ops.extend(plain);
-                        ops.push(op);
-                        ops.push(Op::new("Q", vec![]));
-                    }
+                scope.report.paths_removed += 1;
+                if scope.covered(b) && clips {
+                    // Keep the clipping, drop the painting.
                     ops.extend(body);
                     ops.push(Op::new("n", vec![]));
-                } else {
-                    scope.report.paths_clipped += 1;
-                    if let Some(c) = clip_out(scope.rects, &gs.ctm, b) {
-                        ops.push(Op::new("q", vec![]));
-                        ops.extend(c);
-                        ops.extend(body);
-                        ops.push(op);
-                        ops.push(Op::new("Q", vec![]));
-                    }
                 }
+                // Partial vector redaction must not retain underlying drawing commands
+                // behind clipping (F-008). Refuse partial clip retention and remove the path.
                 continue;
             }
             if !path.is_empty() {
@@ -1382,6 +803,10 @@ fn xobject(
                     out.error = Some(error);
                     return None;
                 }
+                if let Err(error) = crate::type3::prune_type3_from_resources(doc, &mut cleaned_res, content) {
+                    out.error = Some(error);
+                    return None;
+                }
             }
             if cleaned_res != res {
                 dict.set(b"Resources".to_vec(), Object::Dict(cleaned_res));
@@ -1404,45 +829,3 @@ fn xobject(
         _ => None,
     }
 }
-
-/// Remove marked-content blocks of hidden layers (`/OC /name BDC … EMC`, nested blocks
-/// included). Returns the remaining operators and how many blocks went.
-fn strip_hidden_layers(doc: &Document, scope: &mut Scope<'_>, ops: Vec<Op>, props: &Dict) -> (Vec<Op>, usize) {
-    let mut out = Vec::with_capacity(ops.len());
-    // For each open marked-content block: does it hide its contents?
-    let mut stack: Vec<bool> = Vec::new();
-    let mut removed = 0;
-    for op in ops {
-        let hidden_now = stack.last().copied().unwrap_or(false);
-        match op.op.as_slice() {
-            b"BDC" | b"BMC" => {
-                let this = op.is("BDC")
-                    && op.name(0) == Some(b"OC")
-                    && match op.operands.get(1) {
-                        Some(Object::Name(n)) => props.get(n).is_some_and(|o| scope.layer_hidden(doc, o)),
-                        Some(o) => scope.layer_hidden(doc, o),
-                        None => false,
-                    };
-                if this && !hidden_now {
-                    removed += 1;
-                }
-                stack.push(hidden_now || this);
-                if !(hidden_now || this) {
-                    out.push(op);
-                }
-            }
-            b"EMC" => {
-                let was = stack.pop().unwrap_or(false);
-                if !was {
-                    out.push(op);
-                }
-            }
-            _ => {
-                if !hidden_now {
-                    out.push(op);
-                }
-            }
-        }
-    }
-    (out, removed)
-}
diff --git a/crates/redact/src/interp/layers.rs b/crates/redact/src/interp/layers.rs
new file mode 100644
index 0000000000..32d7afdf1e
--- /dev/null
+++ b/crates/redact/src/interp/layers.rs
@@ -0,0 +1,256 @@
+use super::*;
+
+impl<'a> Scope<'a> {
+    /// Is this optional-content reference (an OCG or OCMD) hidden?
+    fn layer_hidden(&mut self, doc: &Document, o: &Object) -> bool {
+        if !self.layers_enabled {
+            return false;
+        }
+        let reference = o.as_ref();
+        if let Some(r) = reference {
+            if let Some(hidden) = self.ocmd_cache.get(&r) {
+                return *hidden;
+            }
+            if self.hidden_layers.contains(&r) {
+                self.ocmd_cache.insert(r, true);
+                return true;
+            }
+        }
+        // Evaluate the policy against the same default configuration used to select hidden
+        // groups. A membership dictionary's default policy is AnyOn.
+        let d = doc.resolve(o);
+        let Some(d) = d.as_dict() else { return false };
+        if d.name(b"Type") != Some(b"OCMD") {
+            return false;
+        }
+        let groups: Vec<ObjRef> = match d.get(b"OCGs").map(|g| (*doc.resolve(g)).clone()) {
+            Some(Object::Array(a)) => a.iter().filter_map(Object::as_ref).collect(),
+            Some(_) => d.get(b"OCGs").and_then(Object::as_ref).into_iter().collect(),
+            None => Vec::new(),
+        };
+        let fail_closed = || groups.iter().any(|g| self.hidden_layers.contains(g));
+        let hidden = if let Some(expression) = d.get(b"VE") {
+            let visible = self.visibility_expression(doc, expression, 0, &mut HashSet::new(), &mut 4096);
+            match visible {
+                Some(visible) => !visible,
+                None => fail_closed() || self.expression_mentions_hidden(doc, expression, 0, &mut HashSet::new(), &mut 4096),
+            }
+        } else if groups.is_empty() {
+            false
+        } else {
+            let any_on = groups.iter().any(|g| !self.hidden_layers.contains(g));
+            let all_on = groups.iter().all(|g| !self.hidden_layers.contains(g));
+            let policy = d.get(b"P").map(|p| doc.resolve(p)).and_then(|p| p.as_name().map(|name| name.to_vec()));
+            match (d.get(b"P"), policy.as_deref()) {
+                (None, _) | (Some(_), Some(b"AnyOn")) => !any_on,
+                (Some(_), Some(b"AllOn")) => !all_on,
+                (Some(_), Some(b"AnyOff")) => all_on,
+                (Some(_), Some(b"AllOff")) => any_on,
+                // An invalid policy must not make a candidate hidden block survive sanitization.
+                _ => fail_closed(),
+            }
+        };
+        if !hidden {
+            self.retained_off_layers.extend(groups.iter().filter(|g| self.hidden_layers.contains(g)).copied());
+            if let Some(expression) = d.get(b"VE") {
+                let mut referenced = HashSet::new();
+                if Self::collect_hidden_expression_groups(doc, expression, &self.hidden_layers, 0, &mut HashSet::new(), &mut 4096, &mut referenced) {
+                    self.retained_off_layers.extend(referenced);
+                } else {
+                    // If an expression cannot be fully walked, preserve every off group so that
+                    // the content we kept does not change visibility after configuration cleanup.
+                    self.retained_off_layers.extend(self.hidden_layers.iter().copied());
+                }
+            }
+        }
+        if let Some(r) = reference {
+            self.ocmd_cache.insert(r, hidden);
+        }
+        hidden
+    }
+
+    pub(super) fn xobject_layer_hidden(&mut self, doc: &Document, xobject: ObjRef, oc: &Object) -> bool {
+        if oc.as_ref().is_some() {
+            return self.layer_hidden(doc, oc);
+        }
+        if let Some(hidden) = self.xobject_oc_cache.get(&xobject) {
+            return *hidden;
+        }
+        let hidden = self.layer_hidden(doc, oc);
+        self.xobject_oc_cache.insert(xobject, hidden);
+        hidden
+    }
+
+    fn collect_hidden_expression_groups(
+        doc: &Document,
+        expression: &Object,
+        hidden_layers: &HashSet<ObjRef>,
+        depth: usize,
+        path: &mut HashSet<ObjRef>,
+        budget: &mut usize,
+        found: &mut HashSet<ObjRef>,
+    ) -> bool {
+        if depth > 64 || *budget == 0 {
+            return false;
+        }
+        *budget -= 1;
+        let reference = expression.as_ref();
+        if let Some(r) = reference
+            && !path.insert(r)
+        {
+            return false;
+        }
+        let resolved = doc.resolve(expression);
+        let complete = match &*resolved {
+            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => {
+                if let Some(r) = reference
+                    && hidden_layers.contains(&r)
+                {
+                    found.insert(r);
+                }
+                reference.is_some()
+            }
+            Object::Array(items) => {
+                let Some(Object::Name(operator)) = items.first() else { return false };
+                let operands = match operator.as_slice() {
+                    b"And" | b"Or" if (2..=4097).contains(&items.len()) => items.get(1..),
+                    b"Not" if items.len() == 2 => items.get(1..),
+                    _ => None,
+                };
+                operands.is_some_and(|operands| {
+                    operands.iter().all(|item| Self::collect_hidden_expression_groups(doc, item, hidden_layers, depth + 1, path, budget, found))
+                })
+            }
+            _ => false,
+        };
+        if let Some(r) = reference {
+            path.remove(&r);
+        }
+        complete
+    }
+
+    /// Evaluate an optional-content visibility expression (`/VE`) against the default config.
+    /// Malformed, cyclic, or excessive expressions return `None` so the caller can fail closed.
+    fn visibility_expression(
+        &self,
+        doc: &Document,
+        expression: &Object,
+        depth: usize,
+        path: &mut HashSet<ObjRef>,
+        budget: &mut usize,
+    ) -> Option<bool> {
+        if depth > 64 || *budget == 0 {
+            return None;
+        }
+        *budget -= 1;
+        let reference = expression.as_ref();
+        if let Some(r) = reference
+            && !path.insert(r)
+        {
+            return None;
+        }
+        let resolved = doc.resolve(expression);
+        let result = match &*resolved {
+            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => reference.map(|r| !self.hidden_layers.contains(&r)),
+            Object::Array(items) if (2..=4097).contains(&items.len()) => {
+                let operator = match items.first() {
+                    Some(Object::Name(n)) => n.as_slice(),
+                    _ => return None,
+                };
+                match operator {
+                    b"And" if items.len() >= 2 => {
+                        let mut visible = true;
+                        for item in items.iter().skip(1) {
+                            visible &= self.visibility_expression(doc, item, depth + 1, path, budget)?;
+                        }
+                        Some(visible)
+                    }
+                    b"Or" if items.len() >= 2 => {
+                        let mut visible = false;
+                        for item in items.iter().skip(1) {
+                            visible |= self.visibility_expression(doc, item, depth + 1, path, budget)?;
+                        }
+                        Some(visible)
+                    }
+                    b"Not" if items.len() == 2 => Some(!self.visibility_expression(doc, &items[1], depth + 1, path, budget)?),
+                    _ => None,
+                }
+            }
+            _ => None,
+        };
+        if let Some(r) = reference {
+            path.remove(&r);
+        }
+        result
+    }
+
+    /// Conservatively find hidden groups in an expression that could not be evaluated. Unknown
+    /// syntax, cycles, and exhausted budgets count as a possible hidden reference.
+    fn expression_mentions_hidden(&self, doc: &Document, expression: &Object, depth: usize, path: &mut HashSet<ObjRef>, budget: &mut usize) -> bool {
+        if depth > 64 || *budget == 0 {
+            return true;
+        }
+        *budget -= 1;
+        if let Some(r) = expression.as_ref() {
+            if self.hidden_layers.contains(&r) {
+                return true;
+            }
+            if !path.insert(r) {
+                return true;
+            }
+        }
+        let resolved = doc.resolve(expression);
+        let found = match &*resolved {
+            Object::Array(items) => items.iter().any(|item| self.expression_mentions_hidden(doc, item, depth + 1, path, budget)),
+            Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => expression.as_ref().is_none_or(|r| self.hidden_layers.contains(&r)),
+            Object::Dict(_) => true,
+            _ => false,
+        };
+        if let Some(r) = expression.as_ref() {
+            path.remove(&r);
+        }
+        found
+    }
+}
+
+/// Remove marked-content blocks of hidden layers (`/OC /name BDC … EMC`, nested blocks
+/// included). Returns the remaining operators and how many blocks went.
+pub(super) fn strip_hidden_layers(doc: &Document, scope: &mut Scope<'_>, ops: Vec<Op>, props: &Dict) -> (Vec<Op>, usize) {
+    let mut out = Vec::with_capacity(ops.len());
+    // For each open marked-content block: does it hide its contents?
+    let mut stack: Vec<bool> = Vec::new();
+    let mut removed = 0;
+    for op in ops {
+        let hidden_now = stack.last().copied().unwrap_or(false);
+        match op.op.as_slice() {
+            b"BDC" | b"BMC" => {
+                let this = op.is("BDC")
+                    && op.name(0) == Some(b"OC")
+                    && match op.operands.get(1) {
+                        Some(Object::Name(n)) => props.get(n).is_some_and(|o| scope.layer_hidden(doc, o)),
+                        Some(o) => scope.layer_hidden(doc, o),
+                        None => false,
+                    };
+                if this && !hidden_now {
+                    removed += 1;
+                }
+                stack.push(hidden_now || this);
+                if !(hidden_now || this) {
+                    out.push(op);
+                }
+            }
+            b"EMC" => {
+                let was = stack.pop().unwrap_or(false);
+                if !was {
+                    out.push(op);
+                }
+            }
+            _ => {
+                if !hidden_now {
+                    out.push(op);
+                }
+            }
+        }
+    }
+    (out, removed)
+}
diff --git a/crates/redact/src/interp/prune.rs b/crates/redact/src/interp/prune.rs
new file mode 100644
index 0000000000..2708a87a42
--- /dev/null
+++ b/crates/redact/src/interp/prune.rs
@@ -0,0 +1,354 @@
+use super::*;
+
+/// Drop every `replaced` resource name whose `Do` no longer appears in the rewritten `content`,
+/// so a full-rewrite save stops reaching the original image or form it named. A name that some
+/// surviving `Do` still draws (the same image shown again outside a mark) is kept.
+pub(crate) fn prune(xo: &mut Dict, replaced: &[Vec<u8>], content: &[Vec<u8>]) {
+    if replaced.is_empty() {
+        return;
+    }
+    let joined = Pieces::join(content);
+    let ops = joined.parse().ops;
+    let still_drawn = |n: &[u8]| ops.iter().any(|op| op.is("Do") && op.last_name() == Some(n));
+    for n in replaced {
+        if !still_drawn(n) {
+            xo.remove(n);
+        }
+    }
+}
+
+/// Whether `content` draws the XObject `name` of the resource dictionary `xo`: directly, or
+/// through a form that has no /Resources of its own (such a form draws through its caller's).
+/// `None` when that cannot be told (a form that will not decode, or nesting past the limit).
+fn content_draws(doc: &Document, content: &[Vec<u8>], xo: &Dict, name: &[u8], depth: usize, seen: &mut HashSet<ObjRef>) -> Option<bool> {
+    let joined = Pieces::join(content);
+    let ops = joined.parse().ops;
+    for op in ops.iter().filter(|op| op.is("Do")) {
+        let Some(n) = op.last_name() else { continue };
+        if n == name {
+            return Some(true);
+        }
+        let Some(r) = xo.get(n).and_then(Object::as_ref) else { continue };
+        let obj = doc.get(r);
+        let Object::Stream(s) = &*obj else { continue };
+        if s.dict.name(b"Subtype") != Some(b"Form") || s.dict.contains(b"Resources") || !seen.insert(r) {
+            continue;
+        }
+        if depth >= MAX_DEPTH {
+            return None;
+        }
+        let Ok(data) = s.decoded() else { return None };
+        match content_draws(doc, std::slice::from_ref(&data), xo, name, depth + 1, seen) {
+            Some(false) => {}
+            other => return other,
+        }
+    }
+    Some(false)
+}
+
+/// Unlink the XObjects a rewrite dropped or replaced (`doomed`) from every page-tree resource
+/// dictionary that still names them. The rewritten page has its own pruned /Resources, but the
+/// originals stay reachable, and so stay in a full-rewrite save, when:
+/// - the page inherited its /Resources from a /Pages node, which still lists them;
+/// - several pages share one resource dictionary, and another page still refers to it;
+/// - a form without /Resources drew them through the page's dictionary.
+///
+/// An entry goes unless a page that draws through that dictionary still draws the name (the same
+/// image shown on another page, or again outside a mark). A dictionary that loses an entry is
+/// replaced by a private copy on its node, so a dictionary object shared with other nodes is
+/// left as it is for them. Retired properties are likewise unlinked only when none of the
+/// holder's pages or inheriting forms names them. Fails closed when use cannot be determined.
+pub(crate) fn unlink_doomed(doc: &mut Document, doomed: &[ObjRef], retired_properties: &[Object]) -> Result<(), RedactError> {
+    crate::type3::unlink_type3(doc)?;
+    if doomed.is_empty() && retired_properties.is_empty() {
+        return Ok(());
+    }
+    let doomed: HashSet<ObjRef> = doomed.iter().copied().collect();
+    let Some(top) = doc.root().and_then(|root| doc.get(root).as_dict().and_then(|d| d.reference(b"Pages"))) else { return Ok(()) };
+    // Every page-tree node with a /Resources of its own, and the pages that draw through it
+    // (the nearest such node above a page, or the page itself). Cycles are cut as in
+    // `pdfcraft_model::pages`.
+    let mut holders: Vec<(ObjRef, Vec<ObjRef>)> = Vec::new();
+    let mut seen = HashSet::new();
+    let mut stack: Vec<(ObjRef, Option<usize>)> = vec![(top, None)];
+    while let Some((node, mut holder)) = stack.pop() {
+        if !seen.insert(node) || seen.len() > 1_000_000 {
+            continue;
+        }
+        let obj = doc.get(node);
+        let Some(d) = obj.as_dict() else { continue };
+        if d.contains(b"Resources") {
+            holders.push((node, Vec::new()));
+            holder = Some(holders.len() - 1);
+        }
+        let is_pages = d.name(b"Type") == Some(b"Pages") || (d.contains(b"Kids") && d.name(b"Type") != Some(b"Page"));
+        if is_pages {
+            let kids = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+            stack.extend(kids.iter().filter_map(Object::as_ref).map(|k| (k, holder)));
+        } else if let Some(h) = holder.and_then(|i| holders.get_mut(i)) {
+            h.1.push(node);
+        }
+    }
+    let index: HashMap<ObjRef, usize> = pdfcraft_model::pages(doc).iter().enumerate().map(|(i, p)| (p.obj, i)).collect();
+    let holder_nodes: Vec<ObjRef> = holders.iter().map(|(node, _)| *node).collect();
+    for (node, users) in holders {
+        let Some(mut res) = doc.get(node).as_dict().and_then(|d| d.get(b"Resources")).and_then(|r| doc.resolve(r).as_dict().cloned()) else {
+            continue;
+        };
+        let mut xo = res_dict(doc, &res, b"XObject");
+        let names: Vec<Vec<u8>> = xo.iter().filter(|(_, v)| v.as_ref().is_some_and(|r| doomed.contains(&r))).map(|(n, _)| n.to_vec()).collect();
+        let properties = res_dict(doc, &res, b"Properties");
+        let property_names: Vec<Vec<u8>> = properties.iter().filter(|(_, v)| retired_properties.contains(v)).map(|(n, _)| n.to_vec()).collect();
+        if names.is_empty() && property_names.is_empty() {
+            continue;
+        }
+        let mut contents = Vec::with_capacity(users.len());
+        for user in &users {
+            let page = doc.get(*user).as_dict().cloned().unwrap_or_default();
+            // A page whose content cannot be read may still draw the name: fail closed.
+            contents.push(page_streams(doc, &page, index.get(user).copied().unwrap_or(0))?.1);
+        }
+        let mut pruned = false;
+        for n in names {
+            let mut drawn = Some(false);
+            for content in &contents {
+                drawn = content_draws(doc, content, &xo, &n, 0, &mut HashSet::new());
+                if drawn != Some(false) {
+                    break;
+                }
+            }
+            match drawn {
+                Some(true) => {}
+                Some(false) => {
+                    xo.remove(&n);
+                    pruned = true;
+                }
+                None => return Err(RedactError::Residue(1)),
+            }
+        }
+        if pruned {
+            res.set(b"XObject".to_vec(), Object::Dict(xo));
+        }
+        pruned |= prune_retired_properties(doc, &mut res, &property_names, &contents)?;
+        if pruned {
+            doc.update_dict(node, |d| d.set(b"Resources".to_vec(), Object::Dict(res)))?;
+        }
+    }
+    // A surviving form can own the same old resource dictionary as a rewritten page. Its
+    // unused descriptions and doomed XObjects remain reachable too, even after every page
+    // holder is cleaned.
+    unlink_from_forms(doc, &holder_nodes, &doomed, retired_properties)?;
+    Ok(())
+}
+
+/// Retire only properties removed from a rewritten scope, preserving names still used by any
+/// content sharing this holder. Different pages' streams must never be concatenated together.
+fn prune_retired_properties(doc: &Document, res: &mut Dict, names: &[Vec<u8>], contents: &[Vec<Vec<u8>>]) -> Result<bool, CosError> {
+    if names.is_empty() {
+        return Ok(false);
+    }
+    let mut used = HashSet::new();
+    for content in contents {
+        for op in resource_ops(doc, res, content)? {
+            if matches!(op.op.as_slice(), b"BDC" | b"DP")
+                && let Some(name) = op.name(1)
+            {
+                used.insert(name.to_vec());
+            }
+        }
+    }
+    let mut properties = res_dict(doc, res, b"Properties");
+    let mut pruned = false;
+    for name in names {
+        if !used.contains(name) {
+            pruned |= properties.remove(name).is_some();
+        }
+    }
+    if pruned {
+        if properties.is_empty() {
+            res.remove(b"Properties");
+        } else {
+            res.set(b"Properties".to_vec(), Object::Dict(properties));
+        }
+    }
+    Ok(pruned)
+}
+
+/// Unlink retired properties and `doomed` XObjects from the resources of the forms reachable from
+/// the page-tree `holders`, each unless the form's own content (or a form inheriting its
+/// resources) still uses the name. Fails closed when that cannot be determined.
+fn unlink_from_forms(doc: &mut Document, holders: &[ObjRef], doomed: &HashSet<ObjRef>, retired: &[Object]) -> Result<(), CosError> {
+    if retired.is_empty() && doomed.is_empty() {
+        return Ok(());
+    }
+    let mut pending: Vec<Dict> = holders
+        .iter()
+        .filter_map(|r| doc.get(*r).as_dict().and_then(|d| d.get(b"Resources")).and_then(|r| doc.resolve(r).as_dict().cloned()))
+        .collect();
+    let mut seen = HashSet::new();
+    while let Some(resources) = pending.pop() {
+        for (_, value) in res_dict(doc, &resources, b"XObject").iter() {
+            let Some(reference) = value.as_ref() else { continue };
+            if !seen.insert(reference) {
+                continue;
+            }
+            if seen.len() > 1_000_000 {
+                return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect shared form resources".into() });
+            }
+            let object = doc.get(reference);
+            let Object::Stream(form) = &*object else { continue };
+            if form.dict.name(b"Subtype") != Some(b"Form") {
+                continue;
+            }
+            let Some(mut res) = form.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()) else { continue };
+            let names: Vec<Vec<u8>> =
+                res_dict(doc, &res, b"Properties").iter().filter(|(_, value)| retired.contains(value)).map(|(name, _)| name.to_vec()).collect();
+            let mut xo = res_dict(doc, &res, b"XObject");
+            let doomed_names: Vec<Vec<u8>> =
+                xo.iter().filter(|(_, v)| v.as_ref().is_some_and(|r| doomed.contains(&r))).map(|(n, _)| n.to_vec()).collect();
+            if names.is_empty() && doomed_names.is_empty() {
+                pending.push(res);
+                continue;
+            }
+            let data = form.decoded()?;
+            let mut pruned = prune_doomed_xobjects(doc, std::slice::from_ref(&data), &mut xo, &doomed_names)?;
+            if pruned {
+                res.set(b"XObject".to_vec(), Object::Dict(xo));
+            }
+            pruned |= prune_retired_properties(doc, &mut res, &names, &[vec![data]])?;
+            if pruned {
+                doc.update_dict(reference, |d| d.set(b"Resources".to_vec(), Object::Dict(res.clone())))?;
+            }
+            pending.push(res);
+        }
+    }
+    Ok(())
+}
+
+fn prune_doomed_xobjects(doc: &Document, content: &[Vec<u8>], xo: &mut Dict, doomed_names: &[Vec<u8>]) -> Result<bool, CosError> {
+    let mut pruned = false;
+    for name in doomed_names {
+        match content_draws(doc, content, xo, name, 0, &mut HashSet::new()) {
+            Some(true) => {}
+            Some(false) => pruned |= xo.remove(name).is_some(),
+            None => return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect shared form resources".into() }),
+        }
+    }
+    Ok(pruned)
+}
+
+/// The clip that hides everything inside each region: one even-odd clip per region (a big
+/// rectangle with the region cut out), in the current user space. Returns `None` when the CTM
+/// can't be inverted (nothing is painted then anyway).
+pub(super) fn clip_out(rects: &[[f64; 4]], ctm: &Matrix, around: [f64; 4]) -> Option<Vec<Op>> {
+    let inv = ctm.invert()?;
+    let mut ops = Vec::new();
+    let big = [around[0] - 10.0, around[1] - 10.0, around[2] + 10.0, around[3] + 10.0];
+    for r in rects.iter().filter(|r| overlaps(**r, around, 0.0)) {
+        let outer = [(big[0], big[1]), (big[2], big[1]), (big[2], big[3]), (big[0], big[3])];
+        let inner = [(r[0], r[1]), (r[0], r[3]), (r[2], r[3]), (r[2], r[1])];
+        for poly in [outer, inner] {
+            for (k, (x, y)) in poly.iter().enumerate() {
+                let (u, v) = inv.apply(*x, *y);
+                ops.push(Op::new(if k == 0 { "m" } else { "l" }, vec![num(u), num(v)]));
+            }
+            ops.push(Op::new("h", vec![]));
+        }
+        ops.push(Op::new("W*", vec![]));
+        ops.push(Op::new("n", vec![]));
+    }
+    Some(ops)
+}
+
+pub(crate) fn resource_ops(doc: &Document, res: &Dict, content: &[Vec<u8>]) -> Result<Vec<Op>, CosError> {
+    let parsed = Pieces::join(content).parse();
+    if parsed.skipped > 0 || parsed.ops.len() > 2_000_000 {
+        return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect property resources".into() });
+    }
+    let mut ops = parsed.ops;
+    let xobjects = res_dict(doc, res, b"XObject");
+    let mut seen = HashSet::new();
+    let mut cursor = 0;
+    while cursor < ops.len() {
+        let op = &ops[cursor];
+        if op.is("Do")
+            && let Some(r) = op.last_name().and_then(|n| xobjects.get(n)).and_then(Object::as_ref)
+            && seen.insert(r)
+            && let Object::Stream(s) = &*doc.get(r)
+            && s.dict.name(b"Subtype") == Some(b"Form")
+            && s.dict.get(b"Resources").is_none_or(|r| doc.resolve(r).as_dict().is_none())
+        {
+            let parsed = pdfcraft_content::parse(&s.decoded()?);
+            if seen.len() > 2_000_000 || ops.len().saturating_add(parsed.ops.len()) > 2_000_000 || parsed.skipped > 0 {
+                return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect inherited form resources".into() });
+            }
+            ops.extend(parsed.ops);
+        }
+        cursor += 1;
+    }
+    Ok(ops)
+}
+
+pub(crate) fn prune_properties(doc: &Document, res: &mut Dict, content: &[Vec<u8>]) -> Result<Vec<Object>, CosError> {
+    let mut properties = res_dict(doc, res, b"Properties");
+    if properties.is_empty() {
+        return Ok(Vec::new());
+    }
+    let mut retired = Vec::new();
+    let ops = resource_ops(doc, res, content)?;
+    let names: Vec<Vec<u8>> = properties.iter().map(|(n, _)| n.to_vec()).collect();
+    for name in names {
+        if !ops.iter().any(|op| matches!(op.op.as_slice(), b"BDC" | b"DP") && op.name(1) == Some(&name))
+            && let Some(value) = properties.remove(&name)
+        {
+            retired.push(value);
+        }
+    }
+    if properties.is_empty() {
+        res.remove(b"Properties");
+    } else {
+        res.set(b"Properties".to_vec(), Object::Dict(properties));
+    }
+    Ok(retired)
+}
+
+pub(super) fn prune_form_resources(doc: &Document, res: &mut Dict, content: &[Vec<u8>]) -> Result<(), CosError> {
+    let ops = resource_ops(doc, res, content)?;
+    let mut xo = res_dict(doc, res, b"XObject");
+    let names: Vec<Vec<u8>> = xo.iter().map(|(n, _)| n.to_vec()).collect();
+    for name in names {
+        if !ops.iter().any(|op| op.is("Do") && op.last_name() == Some(&name)) {
+            xo.remove(&name);
+        }
+    }
+    res.set(b"XObject".to_vec(), Object::Dict(xo));
+    Ok(())
+}
+
+/// The font, writing direction and size an ExtGState's `/Font [font size]` entry sets, as `Tf`
+/// would (ISO 32000-2 §8.4.5); `None` when `name` sets no font. The metrics are cached with the
+/// fonts `Tf` names, under a key no resource name can take (a name cannot hold a null byte).
+pub(super) fn extgstate_font(
+    doc: &Document,
+    scope: &mut Scope<'_>,
+    ext_gstates: &Dict,
+    name: &[u8],
+    fallback: &Rc<Metrics>,
+) -> Option<(Rc<Metrics>, bool, f64)> {
+    let state = doc.resolve(ext_gstates.get(name)?).as_dict().cloned()?;
+    let entry = doc.resolve(state.get(b"Font")?).as_array().cloned()?;
+    let [font, size] = entry.as_slice() else { return None };
+    let size = doc.resolve(size).as_f64()?;
+    let font_dict = doc.resolve(font).as_dict().cloned();
+    let vertical = font_dict.as_ref().is_some_and(|d| is_vertical(doc, d));
+    let key = [b"\0".as_slice(), name].concat();
+    let metrics = match scope.fonts.get(&key) {
+        Some(m) => m.clone(),
+        None => {
+            let m = font_dict.as_ref().map(|d| Rc::new(Metrics::from_dict(doc, d))).unwrap_or_else(|| fallback.clone());
+            scope.fonts.insert(key, m.clone());
+            m
+        }
+    };
+    Some((metrics, vertical, size))
+}
diff --git a/crates/redact/src/lib.rs b/crates/redact/src/lib.rs
index 29f23d3c96..6f69151d89 100644
--- a/crates/redact/src/lib.rs
+++ b/crates/redact/src/lib.rs
@@ -27,6 +27,8 @@ pub mod sanitize;
 mod tags;
 #[cfg(test)]
 mod tests;
+pub(crate) mod type3;
+pub(crate) mod type3_tables;
 
 use interp::{Mode, Scope, process};
 
@@ -493,6 +495,7 @@ fn apply_to(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Redac
                 pi,
             )?;
             retired_properties.extend(interp::prune_properties(doc, &mut res, &cleaned_data)?);
+            type3::prune_type3_from_resources(doc, &mut res, &cleaned_data)?;
             doc.update_dict(page.obj, |d| {
                 d.set(b"Contents".to_vec(), Object::Array(new_list));
                 d.set(b"Resources".to_vec(), Object::Dict(res));
@@ -699,27 +702,24 @@ fn apply_to(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Redac
     Ok(report)
 }
 
-/// Remove redaction marks without applying them (`None` = all).
+/// Remove redaction marks without applying them (`None` = all), with their replies and pop-ups as
+/// deleting a comment does: a reply left behind would keep its mark in the file through `/IRT`.
+/// Returns how many marks went.
 pub fn clear_marks(doc: &mut Document, pages: Option<&[usize]>) -> Result<usize, RedactError> {
-    let all = marks(doc);
-    let doomed: Vec<ObjRef> = all.iter().filter(|m| pages.is_none_or(|p| p.contains(&m.page))).map(|m| m.obj).collect();
-    if doomed.is_empty() {
+    let targets: HashSet<ObjRef> = marks(doc).iter().filter(|m| pages.is_none_or(|p| p.contains(&m.page))).map(|m| m.obj).collect();
+    if targets.is_empty() {
         return Err(RedactError::NothingToApply);
     }
+    let listed: Vec<Object> = pdfcraft_model::pages(doc).iter().flat_map(|p| annots_of(doc, &p.dict)).collect();
+    let doomed = pdfcraft_annot::with_replies_and_popups(doc, &listed, targets.iter().copied());
     for p in pdfcraft_model::pages(doc) {
         let annots = annots_of(doc, &p.dict);
-        let kept: Vec<Object> = annots
-            .iter()
-            .filter(|a| {
-                let Some(r) = a.as_ref() else { return true };
-                let parent = doc.get(r).as_dict().and_then(|d| d.get(b"Parent")).and_then(Object::as_ref);
-                !doomed.contains(&r) && !parent.is_some_and(|p| doomed.contains(&p))
-            })
-            .cloned()
-            .collect();
+        let kept: Vec<Object> = annots.iter().filter(|a| !pdfcraft_annot::goes_with(a, &doomed)).cloned().collect();
+        // As deleting a comment does: a page whose marks were all it had loses `/Annots` again,
+        // and an indirect array stays the one object the page points to.
         if kept.len() != annots.len() {
-            doc.update_dict(p.obj, |d| d.set(b"Annots".to_vec(), Object::Array(kept)))?;
+            pdfcraft_annot::set_annots(doc, p.obj, kept)?;
         }
     }
-    Ok(doomed.len())
+    Ok(targets.len())
 }
diff --git a/crates/redact/src/sanitize.rs b/crates/redact/src/sanitize.rs
index 8625f99c25..98703dfbf2 100644
--- a/crates/redact/src/sanitize.rs
+++ b/crates/redact/src/sanitize.rs
@@ -424,6 +424,7 @@ fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Re
                 res.set(b"XObject".to_vec(), Object::Dict(xo));
             }
             retired_properties.extend(crate::interp::prune_properties(doc, &mut res, &page_content)?);
+            crate::type3::prune_type3_from_resources(doc, &mut res, &page_content)?;
             doc.update_dict(page.obj, |d| {
                 d.set(b"Contents".to_vec(), Object::Array(new_list));
                 d.set(b"Resources".to_vec(), Object::Dict(res));
@@ -443,7 +444,11 @@ fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Re
     }
     // What a page no longer draws must not stay reachable through an inherited or shared
     // /Resources either.
-    crate::interp::unlink_doomed(doc, &doomed, &retired_properties)?;
+    // Only a removal rewrites the document; a count on a clone has nothing to unlink, and a
+    // cleanup error there would be mistaken for "nothing to remove".
+    if write {
+        crate::interp::unlink_doomed(doc, &doomed, &retired_properties)?;
+    }
     Ok((total, retained_off_layers))
 }
 
@@ -474,7 +479,16 @@ pub fn scan(doc: &Document) -> Vec<(Hidden, usize)> {
                         + owned(Hidden::Attachments)
                 }
                 Hidden::Comments => annots.iter().filter(|a| is_comment(a.name(b"Subtype").unwrap_or(b""))).count(),
-                Hidden::FormFields => pdfcraft_forms::fields(doc).len(),
+                Hidden::FormFields => {
+                    let n = pdfcraft_forms::fields(doc).len();
+                    if n > 0 {
+                        n
+                    } else if cat.contains(b"AcroForm") {
+                        1
+                    } else {
+                        0
+                    }
+                }
                 Hidden::HiddenText => content_pass(&mut doc2, true, false, false).map(|(n, _)| n).unwrap_or(0),
                 Hidden::HiddenLayers => {
                     let off = hidden_layers(doc).len();
@@ -510,7 +524,8 @@ pub fn remove_hidden(doc: &mut Document, which: &[Hidden]) -> Result<Vec<(Hidden
     // Every annotation the pages list now: whatever is no longer listed at the end (flattened
     // widgets included) leaves the structure tree too.
     let listed_before = listed_annotations(doc);
-    let fields = which.contains(&Hidden::FormFields) && count(Hidden::FormFields) > 0;
+    let has_acroform = doc.get(root).as_dict().is_some_and(|d| d.contains(b"AcroForm"));
+    let fields = which.contains(&Hidden::FormFields) && (count(Hidden::FormFields) > 0 || has_acroform);
     if fields {
         // Fields without appearances get one first, so their values stay visible.
         for f in pdfcraft_forms::fields(doc) {
@@ -631,9 +646,12 @@ pub fn remove_hidden(doc: &mut Document, which: &[Hidden]) -> Result<Vec<(Hidden
                     cat.set(b"OCProperties".to_vec(), Object::Dict(oc));
                 }
             }
+            Hidden::FormFields => {
+                cat.remove(b"AcroForm");
+            }
             _ => {}
         }
-        let n = count(h);
+        let n = if h == Hidden::FormFields && fields { count(h).max(1) } else { count(h) };
         if n > 0 {
             done.push((h, n));
         }
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 9ffb07e6f8..c072d19db7 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -281,14 +281,40 @@ fn vectors_are_removed_or_clipped_and_inline_images_go() {
     let mut doc = one_page(src, "", vec![]);
     mark(&mut doc, 0, &[[5.0, 5.0, 35.0, 35.0], [45.0, 45.0, 65.0, 65.0]], "");
     let r = apply(&mut doc, None).unwrap();
-    assert_eq!((r.paths_removed, r.paths_clipped, r.images_removed), (1, 1, 1), "{r:?}");
+    assert_eq!((r.paths_removed, r.paths_clipped, r.images_removed), (2, 0, 1), "{r:?}");
     let c = content(&doc, 0);
     assert!(!c.contains("10 10 20 20 re"), "{c}");
-    assert!(c.contains("W*\nn\n0 0 300 300 re\nf\nQ"), "the page-size rect is clipped: {c}");
+    assert!(!c.contains("300 300 re"), "the intersecting rect is removed: {c}");
     assert!(!c.contains("BI"), "{c}");
     assert!(c.contains("150 150 m"), "the line elsewhere stays");
 }
 
+#[test]
+fn partially_covered_vector_paths_do_not_leak_drawing_commands() {
+    // A vector path with detailed drawing commands (e.g. outlined text or confidential geometry)
+    // that is only partially covered by a redaction mark must be completely removed, not retained
+    // behind a clipping path (F-008).
+    let src = b"0 g 100 100 m 150 150 l 200 100 l h f 10 10 m 20 20 l W b 300 300 m 350 350 l S";
+    let mut doc = one_page(src, "", vec![]);
+    // Redaction mark covers only part of the triangle (100..200, 100..150):
+    // mark is [120, 120, 160, 160], partially intersecting the triangle.
+    // Also partially intersect the clip-and-stroke path [10..20, 10..20] with [15, 15, 25, 25].
+    mark(&mut doc, 0, &[[120.0, 120.0, 160.0, 160.0], [15.0, 15.0, 25.0, 25.0]], "");
+    let r = apply(&mut doc, None).unwrap();
+    assert_eq!(r.paths_removed, 2, "both partially intersected paths removed");
+    assert_eq!(r.paths_clipped, 0, "no paths retained via clipping");
+
+    let c = content(&doc, 0);
+    // Neither the drawing operators nor the coordinates should leak in the content stream.
+    assert!(!c.contains("100 100 m"), "underlying geometry must not leak: {c}");
+    assert!(!c.contains("150 150 l"), "underlying geometry must not leak: {c}");
+    assert!(!c.contains("200 100 l"), "underlying geometry must not leak: {c}");
+    assert!(!c.contains("10 10 m"), "partial clip geometry must not leak: {c}");
+    assert!(!c.contains("20 20 l"), "partial clip geometry must not leak: {c}");
+    // Unrelated non-intersecting path remains untouched.
+    assert!(c.contains("300 300 m\n350 350 l\nS"), "unaffected vector path must be kept: {c}");
+}
+
 /// A chain of nested forms deeper than the pass can walk was removed from the page, taking
 /// whatever else it drew with it even when nothing in it was marked. The limit now reaches as
 /// deep as the renderer and Edit text read (50), so anything a reader can see can be walked;
@@ -1145,6 +1171,41 @@ fn nothing_to_apply_and_clearing_marks() {
     assert!(content(&doc, 0).contains("(AB) Tj"));
 }
 
+/// Clearing marks puts a page's annotation list back as it was: a page that had none has no
+/// `/Annots` again, replies to the marks included, and one listed through an indirect array keeps
+/// pointing at that array.
+#[test]
+fn clearing_marks_leaves_the_annotation_list_as_it_was() {
+    let mut doc = one_page(b"BT /F1 10 Tf 10 100 Td (AB) Tj ET", "", vec![]);
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    let before = doc.get(page);
+    mark(&mut doc, 0, &[[0.0, 0.0, 50.0, 50.0]], "");
+    pdfcraft_annot::add_reply(&mut doc, 0, 0, "a reply", "Tester", &Meta::default()).unwrap();
+    // And a reply written inline, as a file can.
+    let mut inline = Dict::new();
+    inline.set(b"Subtype".to_vec(), Object::name("Text"));
+    inline.set(b"IRT".to_vec(), Object::Ref(marks(&doc)[0].obj));
+    let mut listed = annots_of(&doc, doc.get(page).as_dict().unwrap());
+    listed.push(Object::Dict(inline));
+    doc.update_dict(page, |d| d.set(b"Annots".to_vec(), Object::Array(listed))).unwrap();
+    assert_eq!(clear_marks(&mut doc, None), Ok(1), "one mark");
+    assert_eq!(doc.get(page), before, "the page has no /Annots again: both replies went with their mark");
+
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Annots 4 0 R >>".to_vec(),
+        b"[5 0 R]".to_vec(),
+        b"<< /Type /Annot /Subtype /Link /Rect [0 0 10 10] >>".to_vec(),
+    ]);
+    let (page, list) = (ObjRef::new(3, 0), ObjRef::new(4, 0));
+    let before = (doc.get(page), doc.get(list));
+    mark(&mut doc, 0, &[[0.0, 0.0, 50.0, 50.0]], "");
+    assert_eq!(doc.get(list).as_array().map(|a| a.len()), Some(2), "the mark is listed in the shared array");
+    clear_marks(&mut doc, None).unwrap();
+    assert_eq!((doc.get(page), doc.get(list)), before, "the page points at its array, which lists the link alone");
+}
+
 #[test]
 fn unreadable_content_fails_closed() {
     let mut doc = one_page(b"", "", vec![]);
@@ -2230,6 +2291,74 @@ fn unselected_pages_keep_inherited_forms() {
     assert_eq!(under(&mut saved, 1, &[[0.0, 190.0, 300.0, 220.0]]), 6);
 }
 
+#[test]
+fn nested_resource_less_forms_keep_live_resources_after_redacting_another_page() {
+    for own_resources in [false, true] {
+        for still_drawn in [false, true] {
+            let original = b"BT /F1 10 Tf 10 200 Td (SECRET) Tj ET";
+            let mut extra = vec![
+                stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300]", original),
+                stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300]", if still_drawn { b"/Fm Do".as_slice() } else { b"q Q".as_slice() }),
+            ];
+            if own_resources {
+                extra.push(stream(
+                    "/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> /XObject << /Fm 7 0 R /Relay 8 0 R >> >>",
+                    b"/Relay Do",
+                ));
+            }
+            let resources =
+                if own_resources { "/XObject << /Fm 7 0 R /Relay 8 0 R /Wrapper 9 0 R >>" } else { "/XObject << /Fm 7 0 R /Relay 8 0 R >>" };
+            let mut doc = one_page(b"/Fm Do", resources, extra);
+            let mut page = doc.get(ObjRef::new(3, 0)).as_dict().unwrap().clone();
+            let inherited = page.remove(b"Resources").unwrap();
+            doc.set(ObjRef::new(3, 0), Object::Dict(page.clone()));
+            let second_content =
+                doc.add(Object::Stream(Stream::from_raw(Dict::new(), if own_resources { b"/Wrapper Do".to_vec() } else { b"/Relay Do".to_vec() })));
+            page.set(b"Contents".to_vec(), Object::Ref(second_content));
+            let second = doc.add(Object::Dict(page));
+            doc.update_dict(ObjRef::new(2, 0), |d| {
+                d.set(b"Resources".to_vec(), inherited);
+                d.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(3, 0)), Object::Ref(second)]));
+                d.set(b"Count".to_vec(), Object::Int(2));
+            })
+            .unwrap();
+
+            let region = [[0.0, 190.0, 300.0, 220.0]];
+            let surviving = if still_drawn { 6 } else { 0 };
+            assert_eq!(under(&mut doc, 0, &region), 6, "the marked occurrence is real text");
+            assert_eq!(under(&mut doc, 1, &region), surviving, "the relay's original nested content is visible");
+            mark(&mut doc, 0, &region, "");
+            let report = apply(&mut doc, Some(&[0])).unwrap();
+            assert_eq!((report.marks, report.glyphs), (1, 6));
+            assert_eq!(under(&mut doc, 0, &region), 0);
+            assert_eq!(under(&mut doc, 1, &region), surviving, "redacting another page must preserve live nested content");
+
+            // A full saved document must retain both the reachable resource and its content,
+            // without relying on an old incremental revision's otherwise-unreachable objects.
+            let mut saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+            assert_eq!(under(&mut saved, 0, &region), 0);
+            assert_eq!(under(&mut saved, 1, &region), surviving);
+            let page = pdfcraft_model::pages(&saved).swap_remove(1);
+            let res = saved.resolve(page.dict.get(b"Resources").unwrap());
+            let xo = saved.resolve(res.as_dict().unwrap().get(b"XObject").unwrap());
+            let mut holder = xo.as_dict().unwrap().clone();
+            if own_resources {
+                let wrapper = saved.resolve(holder.get(b"Wrapper").unwrap());
+                let Object::Stream(wrapper) = &*wrapper else { panic!("a real wrapper form") };
+                let res = saved.resolve(wrapper.dict.get(b"Resources").unwrap());
+                let xo = saved.resolve(res.as_dict().unwrap().get(b"XObject").unwrap());
+                holder = xo.as_dict().unwrap().clone();
+            }
+            assert_eq!(holder.contains(b"Fm"), still_drawn, "keep only resources a surviving nested form actually uses");
+            if still_drawn {
+                let form = saved.resolve(holder.get(b"Fm").unwrap());
+                let Object::Stream(form) = &*form else { panic!("the preserved original form") };
+                assert_eq!(form.decoded().unwrap(), original);
+            }
+        }
+    }
+}
+
 /// A page tree of `n` pages that all draw form /Fm and inherit a direct `/Resources` from the root.
 fn inheriting_pages(n: usize) -> (Document, Vec<ObjRef>) {
     let form = stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300]", b"BT /F1 10 Tf 10 200 Td (SECRET) Tj ET");
@@ -2673,6 +2802,27 @@ fn removing_form_fields_takes_hidden_widgets_and_their_values_out_of_the_file()
     assert!(annots_of(&doc, &pdfcraft_model::pages(&doc).swap_remove(0).dict).is_empty());
 }
 
+/// F-021: removing form fields on a document with an AcroForm dictionary (even one with no
+/// enumerable terminal fields) removes the AcroForm dictionary, processes widgets, and requires full save.
+#[test]
+fn removing_form_fields_removes_acroform_even_without_terminal_fields() {
+    use crate::sanitize::{Hidden, remove_hidden, scan};
+    let mut doc =
+        one_page(b"BT /F1 10 Tf 10 100 Td (Visible) Tj ET", "", vec![b"<< /Type /Annot /Subtype /Widget /Rect [10 200 150 220] >>".to_vec()]);
+    doc.update_dict(doc.root().unwrap(), |d| d.set(b"AcroForm".to_vec(), fields_dict(&[]))).unwrap();
+    doc.update_dict(ObjRef::new(3, 0), |d| d.set(b"Annots".to_vec(), ref_array(&[7]))).unwrap();
+    let counts = scan(&doc);
+    assert_eq!(counts.iter().find(|c| c.0 == Hidden::FormFields).map(|c| c.1), Some(1));
+    assert!(doc.get(doc.root().unwrap()).as_dict().is_some_and(|d| d.contains(b"AcroForm")));
+    assert!(!doc.full_save_required());
+
+    let done = remove_hidden(&mut doc, &[Hidden::FormFields]).unwrap();
+    assert_eq!(done, [(Hidden::FormFields, 1)]);
+    assert!(!doc.get(doc.root().unwrap()).as_dict().is_some_and(|d| d.contains(b"AcroForm")));
+    assert!(annots_of(&doc, &pdfcraft_model::pages(&doc).swap_remove(0).dict).is_empty());
+    assert!(doc.full_save_required());
+}
+
 /// Removing hidden text cleans the structure tree as redaction does: the elements describing the
 /// removed text lose their descriptions, and a reference into a rewritten Form points at the copy.
 #[test]
diff --git a/crates/redact/src/tests/surviving_references.rs b/crates/redact/src/tests/surviving_references.rs
index d3aa98af67..477f03f9a5 100644
--- a/crates/redact/src/tests/surviving_references.rs
+++ b/crates/redact/src/tests/surviving_references.rs
@@ -66,3 +66,235 @@ fn an_image_a_surviving_form_draws_is_kept() {
     assert_eq!(apply(&mut doc, None).unwrap().images_removed, 1);
     assert!(full_save_holds(&doc, b"IMAGESECRET"), "the image the form still draws outside the mark");
 }
+
+/// The surviving form draws the image through a nested form without /Resources of its own,
+/// which draws through the outer form's: the image is kept.
+#[test]
+fn an_image_a_surviving_forms_nested_form_draws_is_kept() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources 5 0 R >>".to_vec(),
+        stream("", b"q 100 0 0 100 0 0 cm /Im Do Q /Fm Do"),
+        b"<< /XObject << /Im 6 0 R /Fm 7 0 R /Inner 8 0 R >> >>".to_vec(),
+        stream("/Type /XObject /Subtype /Image /Width 11 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"IMAGESECRET"),
+        stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources 5 0 R", b"/Inner Do"),
+        stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300]", b"q 50 0 0 50 200 200 cm /Im Do Q"),
+    ]);
+    mark(&mut doc, 0, &[[0.0, 0.0, 120.0, 120.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().images_removed, 1);
+    assert!(full_save_holds(&doc, b"IMAGESECRET"), "the image the nested form still draws outside the mark");
+}
+
+/// Two pages share one resource dictionary, and the second draws the image only through a form
+/// without /Resources: redacting the image on the first page keeps it for the second.
+#[test]
+fn an_image_another_page_draws_through_a_form_without_resources_is_kept() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 5 0 R /Resources 7 0 R >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 6 0 R /Resources 7 0 R >>".to_vec(),
+        stream("", b"q 100 0 0 100 0 0 cm /Im Do Q"),
+        stream("", b"/Inner Do"),
+        b"<< /XObject << /Im 8 0 R /Inner 9 0 R >> >>".to_vec(),
+        stream("/Type /XObject /Subtype /Image /Width 11 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"IMAGESECRET"),
+        stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300]", b"q 50 0 0 50 200 200 cm /Im Do Q"),
+    ]);
+    mark(&mut doc, 0, &[[0.0, 0.0, 120.0, 120.0]], "");
+    assert_eq!(apply(&mut doc, None).unwrap().images_removed, 1);
+    assert!(full_save_holds(&doc, b"IMAGESECRET"), "the second page still draws the image through its form");
+}
+
+/// A Type 3 font whose displayed glyphs are redacted has its unused glyph programs unlinked from
+/// /CharProcs and exclusive graphical resources pruned, so they do not survive in a full save (F-011).
+#[test]
+fn redacted_type3_glyph_and_exclusive_resources_do_not_survive_full_save() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources 5 0 R >>".to_vec(),
+        // Text showing AB with Type 3 font /T3
+        stream("", b"BT /T3 10 Tf 10 100 Td (AB) Tj ET"),
+        b"<< /Font << /T3 6 0 R >> >>".to_vec(),
+        // Type 3 font with /CharProcs << /A 7 0 R /B 8 0 R >> and /Resources with images for both
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 -200 1000 800] /FontMatrix [0.001 0 0 0.001 0 0] /FirstChar 65 /LastChar 66 /Widths [500 500] /Encoding << /Differences [65 /A /B] >> /CharProcs << /A 7 0 R /B 8 0 R >> /Resources << /XObject << /ImA 9 0 R /ImB 10 0 R >> >> >>".to_vec(),
+        stream("", b"/ImA Do % SECRET_GLYPH_A_PAYLOAD"),
+        stream("", b"/ImB Do % SURVIVING_GLYPH_B_PAYLOAD"),
+        stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"CONFIDENTIAL_IMAGE_A"),
+        stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"PUBLIC_IMAGE_B"),
+    ]);
+
+    // Redaction mark covers only 'A' (x: 10..15, y: 95..110)
+    mark(&mut doc, 0, &[[9.0, 95.0, 14.9, 110.0]], "");
+
+    assert!(full_save_holds(&doc, b"SECRET_GLYPH_A_PAYLOAD"));
+    assert!(full_save_holds(&doc, b"CONFIDENTIAL_IMAGE_A"));
+    assert!(full_save_holds(&doc, b"SURVIVING_GLYPH_B_PAYLOAD"));
+    assert!(full_save_holds(&doc, b"PUBLIC_IMAGE_B"));
+
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!(report.glyphs, 1);
+
+    // After redaction, unreferenced glyph A and its exclusive image A must not survive full save
+    assert!(!full_save_holds(&doc, b"SECRET_GLYPH_A_PAYLOAD"), "redacted glyph A program survived");
+    assert!(!full_save_holds(&doc, b"CONFIDENTIAL_IMAGE_A"), "exclusive image for redacted glyph A survived");
+
+    // Surviving glyph B and its image B must survive
+    assert!(full_save_holds(&doc, b"SURVIVING_GLYPH_B_PAYLOAD"), "surviving glyph B was lost");
+    assert!(full_save_holds(&doc, b"PUBLIC_IMAGE_B"), "surviving glyph B image was lost");
+
+    // Reopen and inspect the Type 3 font dictionary
+    let bytes = write_full(&doc, &SaveOptions::default()).unwrap();
+    let saved = Document::open(Arc::new(bytes)).unwrap();
+    let page = pdfcraft_model::pages(&saved).swap_remove(0);
+    let res = saved.resolve(page.dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+    let fonts = saved.resolve(res.get(b"Font").unwrap()).as_dict().unwrap().clone();
+    let t3 = saved.resolve(fonts.get(b"T3").unwrap()).as_dict().unwrap().clone();
+    let procs = saved.resolve(t3.get(b"CharProcs").unwrap()).as_dict().unwrap().clone();
+    assert!(!procs.contains(b"A"), "CharProcs still contains unreferenced glyph A");
+    assert!(procs.contains(b"B"), "CharProcs lost surviving glyph B");
+
+    let t3_res = saved.resolve(t3.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+    let t3_xo = saved.resolve(t3_res.get(b"XObject").unwrap()).as_dict().unwrap().clone();
+    assert!(!t3_xo.contains(b"ImA"), "Type 3 font resources still contains exclusive image ImA");
+    assert!(t3_xo.contains(b"ImB"), "Type 3 font resources lost surviving image ImB");
+}
+
+/// When all glyphs of a Type 3 font are redacted, the entire font is removed from Resources (F-011).
+#[test]
+fn all_redacted_type3_glyphs_cause_font_removal_from_resources() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources 5 0 R >>".to_vec(),
+        stream("", b"BT /T3 10 Tf 10 100 Td (A) Tj ET"),
+        b"<< /Font << /T3 6 0 R >> >>".to_vec(),
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 -200 1000 800] /FontMatrix [0.001 0 0 0.001 0 0] /FirstChar 65 /LastChar 65 /Widths [500] /Encoding << /Differences [65 /A] >> /CharProcs << /A 7 0 R >> /Resources << /XObject << /ImA 8 0 R >> >> >>".to_vec(),
+        stream("", b"/ImA Do % SECRET_GLYPH_ONLY_PAYLOAD"),
+        stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", b"CONFIDENTIAL_IMAGE_ONLY"),
+    ]);
+
+    mark(&mut doc, 0, &[[9.0, 95.0, 16.0, 110.0]], "");
+
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!(report.glyphs, 1);
+
+    assert!(!full_save_holds(&doc, b"SECRET_GLYPH_ONLY_PAYLOAD"));
+    assert!(!full_save_holds(&doc, b"CONFIDENTIAL_IMAGE_ONLY"));
+
+    let bytes = write_full(&doc, &SaveOptions::default()).unwrap();
+    let saved = Document::open(Arc::new(bytes)).unwrap();
+    let page = pdfcraft_model::pages(&saved).swap_remove(0);
+    if let Some(res_val) = page.dict.get(b"Resources")
+        && let Some(res) = saved.resolve(res_val).as_dict()
+        && let Some(fonts_val) = res.get(b"Font")
+    {
+        let fonts = saved.resolve(fonts_val).as_dict().unwrap().clone();
+        assert!(!fonts.contains(b"T3"), "Font /T3 was not removed from Resources");
+    }
+}
+
+/// In shared Type 3 fonts across multiple pages, glyphs used on another page are preserved (F-011).
+#[test]
+fn shared_type3_font_preserves_glyphs_used_by_another_page() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >>".to_vec(),
+        // Page 1: draws 'A' (redacted)
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 5 0 R /Resources 7 0 R >>".to_vec(),
+        // Page 2: draws 'B' (survives)
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 6 0 R /Resources 7 0 R >>".to_vec(),
+        stream("", b"BT /T3 10 Tf 10 100 Td (A) Tj ET"),
+        stream("", b"BT /T3 10 Tf 10 100 Td (B) Tj ET"),
+        // Shared Resources 7 0 R
+        b"<< /Font << /T3 8 0 R >> >>".to_vec(),
+        // Shared Type 3 font 8 0 R
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 -200 1000 800] /FontMatrix [0.001 0 0 0.001 0 0] /FirstChar 65 /LastChar 66 /Widths [500 500] /Encoding << /Differences [65 /A /B] >> /CharProcs << /A 9 0 R /B 10 0 R >> >>".to_vec(),
+        stream("", b"% SECRET_PAGE1_GLYPH_A"),
+        stream("", b"% PUBLIC_PAGE2_GLYPH_B"),
+    ]);
+
+    // Redact only Page 1's 'A'
+    mark(&mut doc, 0, &[[9.0, 95.0, 16.0, 110.0]], "");
+
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!(report.glyphs, 1);
+
+    // Glyph A was removed from Page 1 and used nowhere else -> unlinked!
+    assert!(!full_save_holds(&doc, b"SECRET_PAGE1_GLYPH_A"));
+
+    // Glyph B is still used on Page 2 -> kept!
+    assert!(full_save_holds(&doc, b"PUBLIC_PAGE2_GLYPH_B"));
+
+    let bytes = write_full(&doc, &SaveOptions::default()).unwrap();
+    let saved = Document::open(Arc::new(bytes)).unwrap();
+    let pages = pdfcraft_model::pages(&saved);
+    let p2_res = saved.resolve(pages[1].dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+    let fonts = saved.resolve(p2_res.get(b"Font").unwrap()).as_dict().unwrap().clone();
+    let t3 = saved.resolve(fonts.get(b"T3").unwrap()).as_dict().unwrap().clone();
+    let procs = saved.resolve(t3.get(b"CharProcs").unwrap()).as_dict().unwrap().clone();
+    assert!(!procs.contains(b"A"));
+    assert!(procs.contains(b"B"));
+}
+
+/// Fails closed when Type 3 font cleanup cannot be safely established (F-011).
+#[test]
+fn unparseable_type3_font_encoding_fails_closed() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources 5 0 R >>".to_vec(),
+        stream("", b"BT /T3 10 Tf 10 100 Td (A) Tj ET"),
+        b"<< /Font << /T3 6 0 R >> >>".to_vec(),
+        // Unsupported encoding /UnknownCustomEncoding without Differences
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 -200 1000 800] /FontMatrix [0.001 0 0 0.001 0 0] /FirstChar 65 /LastChar 65 /Widths [500] /Encoding /UnknownCustomEncoding /CharProcs << /A 7 0 R >> >>".to_vec(),
+        stream("", b"% SECRET_PAYLOAD_UNPARSEABLE"),
+    ]);
+
+    mark(&mut doc, 0, &[[9.0, 95.0, 16.0, 110.0]], "");
+
+    let res = apply(&mut doc, None);
+    assert!(res.is_err(), "redaction must fail closed when Type 3 cleanup cannot be established: {res:?}");
+}
+
+/// A Type 3 font selected through an ExtGState /Font entry is a use of the font for pruning:
+/// its redacted glyph program does not survive a full save (F-011).
+#[test]
+fn type3_font_set_through_extgstate_has_its_redacted_glyph_removed() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources 5 0 R >>".to_vec(),
+        stream("", b"/GS1 gs BT 10 100 Td (A) Tj ET"),
+        b"<< /Font << /T3 6 0 R >> /ExtGState << /GS1 8 0 R >> >>".to_vec(),
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 -200 1000 800] /FontMatrix [0.001 0 0 0.001 0 0] /FirstChar 65 /LastChar 65 /Widths [500] /Encoding << /Differences [65 /A] >> /CharProcs << /A 7 0 R >> >>".to_vec(),
+        stream("", b"% SECRET_EXTGSTATE_GLYPH_PAYLOAD"),
+        b"<< /Type /ExtGState /Font [6 0 R 10] >>".to_vec(),
+    ]);
+    mark(&mut doc, 0, &[[9.0, 95.0, 16.0, 110.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!(report.glyphs, 1);
+    assert!(!full_save_holds(&doc, b"SECRET_EXTGSTATE_GLYPH_PAYLOAD"), "redacted glyph program survived");
+}
+
+/// A Type 3 font used only inside a Form XObject is found by the scan and its redacted glyph
+/// program does not survive a full save (F-011).
+#[test]
+fn type3_font_used_in_a_form_xobject_has_its_redacted_glyph_removed() {
+    let mut doc = pdf(vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources 5 0 R >>".to_vec(),
+        stream("", b"/Fm Do"),
+        b"<< /XObject << /Fm 8 0 R >> >>".to_vec(),
+        b"<< /Type /Font /Subtype /Type3 /FontBBox [0 -200 1000 800] /FontMatrix [0.001 0 0 0.001 0 0] /FirstChar 65 /LastChar 65 /Widths [500] /Encoding << /Differences [65 /A] >> /CharProcs << /A 7 0 R >> >>".to_vec(),
+        stream("", b"% SECRET_FORM_GLYPH_PAYLOAD"),
+        stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources 9 0 R", b"BT /T3 10 Tf 10 100 Td (A) Tj ET"),
+        b"<< /Font << /T3 6 0 R >> >>".to_vec(),
+    ]);
+    mark(&mut doc, 0, &[[9.0, 95.0, 16.0, 110.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!(report.glyphs, 1);
+    assert!(!full_save_holds(&doc, b"SECRET_FORM_GLYPH_PAYLOAD"), "redacted glyph program survived");
+}
diff --git a/crates/redact/src/type3.rs b/crates/redact/src/type3.rs
new file mode 100644
index 0000000000..f431dab902
--- /dev/null
+++ b/crates/redact/src/type3.rs
@@ -0,0 +1,692 @@
+//! Unlink unused Type 3 font glyph programs and prune exclusive graphical resources (F-011).
+
+use std::collections::{HashMap, HashSet};
+
+use pdfcraft_content::Pieces;
+use pdfcraft_cos::{CosError, Dict, Document, ObjRef, Object};
+
+use crate::{RedactError, page_streams};
+
+const MAX_DEPTH: usize = 64;
+const MAX_HOLDERS: usize = 1_000_000;
+
+fn res_dict(doc: &Document, res: &Dict, key: &[u8]) -> Dict {
+    res.get(key).and_then(|o| doc.resolve(o).as_dict().cloned()).unwrap_or_default()
+}
+
+/// Identifies a font in the document. Only fonts that are indirect objects are cleaned: a Type 3
+/// font held directly in a resource dictionary fails closed (see [`unlink_type3`]), because its
+/// glyph programs could not be told apart or rewritten reliably.
+#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
+pub(crate) enum FontKey {
+    Ref(ObjRef),
+}
+
+/// Build the mapping from character code (0..=255) to glyph name in a Type 3 font.
+/// Fails closed if the encoding cannot be safely resolved or parsed.
+pub(crate) fn type3_code_to_glyph(doc: &Document, font_dict: &Dict) -> Result<[Option<Vec<u8>>; 256], CosError> {
+    let Some(enc_obj) = font_dict.get(b"Encoding") else {
+        return Err(CosError::Syntax { offset: 0, detail: "redaction could not establish safe Type 3 font cleanup: missing Encoding".into() });
+    };
+    let resolved_enc = doc.resolve(enc_obj);
+
+    let mut differences = HashMap::new();
+    let base_name: Option<Vec<u8>>;
+
+    match &*resolved_enc {
+        Object::Dict(enc_dict) => {
+            if let Some(diffs) = enc_dict.get(b"Differences").and_then(|d| doc.resolve(d).as_array().cloned()) {
+                let mut cur_code = 0i64;
+                for item in &diffs {
+                    match &*doc.resolve(item) {
+                        Object::Int(n) => cur_code = *n,
+                        Object::Name(name) => {
+                            if let Ok(c) = u8::try_from(cur_code) {
+                                differences.insert(c, name.clone());
+                            }
+                            cur_code = cur_code.saturating_add(1);
+                        }
+                        _ => {}
+                    }
+                }
+            }
+            if let Some(base) = enc_dict.name(b"BaseEncoding") {
+                base_name = Some(base.to_vec());
+            } else {
+                // ISO 32000 §9.6.6.1: default base encoding for Type 3 fonts is StandardEncoding.
+                base_name = Some(b"StandardEncoding".to_vec());
+            }
+        }
+        Object::Name(name) => {
+            base_name = Some(name.clone());
+        }
+        _ => {
+            return Err(CosError::Syntax {
+                offset: 0,
+                detail: "redaction could not establish safe Type 3 font cleanup: invalid Encoding object".into(),
+            });
+        }
+    }
+
+    let base_table: Option<&'static [Option<&'static [u8]>; 256]> = match base_name.as_deref() {
+        Some(b"StandardEncoding") => Some(&crate::type3_tables::STANDARD),
+        Some(b"WinAnsiEncoding") => Some(&crate::type3_tables::WIN_ANSI),
+        Some(b"MacRomanEncoding") => Some(&crate::type3_tables::MAC_ROMAN),
+        Some(b"MacExpertEncoding") => Some(&crate::type3_tables::MAC_EXPERT),
+        Some(other) => {
+            return Err(CosError::Syntax {
+                offset: 0,
+                detail: format!(
+                    "redaction could not establish safe Type 3 font cleanup: unsupported BaseEncoding: {}",
+                    String::from_utf8_lossy(other)
+                ),
+            });
+        }
+        None => None,
+    };
+
+    let mut map: [Option<Vec<u8>>; 256] = std::array::from_fn(|_| None);
+    for (code, entry) in map.iter_mut().enumerate() {
+        let c = code as u8;
+        if let Some(diff_glyph) = differences.get(&c) {
+            *entry = Some(diff_glyph.clone());
+        } else if let Some(table) = base_table
+            && let Some(base_glyph) = table[code]
+        {
+            *entry = Some(base_glyph.to_vec());
+        }
+    }
+
+    Ok(map)
+}
+
+fn resolve_font_in_res(doc: &Document, res: &Dict, font_name: &[u8]) -> Option<(FontKey, Dict)> {
+    let fonts = res_dict(doc, res, b"Font");
+    let font_obj = fonts.get(font_name)?;
+    // A direct Type 3 font is refused during discovery, so none reaches the scan.
+    let font_ref = font_obj.as_ref()?;
+    let dict = doc.resolve(font_obj).as_dict()?.clone();
+    (dict.name(b"Subtype") == Some(b"Type3")).then_some((FontKey::Ref(font_ref), dict))
+}
+
+fn resolve_extgstate_font(doc: &Document, res: &Dict, gs_name: &[u8]) -> Option<(FontKey, Dict)> {
+    let extg = res_dict(doc, res, b"ExtGState");
+    let state = doc.resolve(extg.get(gs_name)?).as_dict().cloned()?;
+    let font_entry = state.get(b"Font").and_then(|f| doc.resolve(f).as_array().cloned())?;
+    let font_obj = font_entry.first()?;
+    let font_ref = font_obj.as_ref()?;
+    let dict = doc.resolve(font_obj).as_dict()?.clone();
+    (dict.name(b"Subtype") == Some(b"Type3")).then_some((FontKey::Ref(font_ref), dict))
+}
+
+#[derive(Default)]
+struct UsedInGlyphs {
+    xobjects: HashSet<Vec<u8>>,
+    colorspaces: HashSet<Vec<u8>>,
+    patterns: HashSet<Vec<u8>>,
+    shadings: HashSet<Vec<u8>>,
+    extgstates: HashSet<Vec<u8>>,
+    fonts: HashSet<Vec<u8>>,
+    properties: HashSet<Vec<u8>>,
+}
+
+fn collect_used_resources_in_stream(data: &[u8], used: &mut UsedInGlyphs) -> Result<(), CosError> {
+    let parsed = pdfcraft_content::parse(data);
+    if parsed.skipped > 0 {
+        return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect glyph stream syntax".into() });
+    }
+    for op in parsed.ops {
+        match op.op.as_slice() {
+            b"Do" => {
+                if let Some(n) = op.last_name() {
+                    used.xobjects.insert(n.to_vec());
+                }
+            }
+            b"cs" | b"CS" => {
+                if let Some(n) = op.name(0) {
+                    used.colorspaces.insert(n.to_vec());
+                }
+            }
+            b"scn" | b"SCN" => {
+                if let Some(n) = op.last_name() {
+                    used.patterns.insert(n.to_vec());
+                }
+            }
+            b"sh" => {
+                if let Some(n) = op.last_name() {
+                    used.shadings.insert(n.to_vec());
+                }
+            }
+            b"gs" => {
+                if let Some(n) = op.name(0) {
+                    used.extgstates.insert(n.to_vec());
+                }
+            }
+            b"Tf" => {
+                if let Some(n) = op.name(0) {
+                    used.fonts.insert(n.to_vec());
+                }
+            }
+            b"BDC" | b"DP" => {
+                if let Some(n) = op.name(1) {
+                    used.properties.insert(n.to_vec());
+                }
+            }
+            _ => {}
+        }
+    }
+    Ok(())
+}
+
+fn prune_type3_font_resources(doc: &Document, font_res: &mut Dict, used: &UsedInGlyphs) -> bool {
+    let mut changed = false;
+
+    macro_rules! prune_category {
+        ($cat:expr, $used_set:expr) => {
+            if let Some(sub_obj) = font_res.get($cat) {
+                let mut sub = doc.resolve(sub_obj).as_dict().cloned().unwrap_or_default();
+                let names: Vec<Vec<u8>> = sub.iter().map(|(n, _)| n.to_vec()).collect();
+                let mut cat_changed = false;
+                for n in names {
+                    if !$used_set.contains(&n) {
+                        sub.remove(&n);
+                        cat_changed = true;
+                    }
+                }
+                if cat_changed {
+                    changed = true;
+                    if sub.is_empty() {
+                        font_res.remove($cat);
+                    } else {
+                        font_res.set($cat.to_vec(), Object::Dict(sub));
+                    }
+                }
+            }
+        };
+    }
+
+    prune_category!(b"XObject", used.xobjects);
+    prune_category!(b"ColorSpace", used.colorspaces);
+    prune_category!(b"Pattern", used.patterns);
+    prune_category!(b"Shading", used.shadings);
+    prune_category!(b"ExtGState", used.extgstates);
+    prune_category!(b"Font", used.fonts);
+    prune_category!(b"Properties", used.properties);
+
+    changed
+}
+
+struct ScanContext<'a> {
+    doc: &'a Document,
+    font_maps: &'a HashMap<FontKey, [Option<Vec<u8>>; 256]>,
+    used_glyphs: &'a mut HashMap<FontKey, HashSet<Vec<u8>>>,
+    /// A form scanned with its inherited font and the resources it draws through: the same form
+    /// drawn in another context is scanned again.
+    seen_forms: &'a mut HashSet<(ObjRef, Option<FontKey>, ObjRef)>,
+}
+
+fn scan_content_stream(
+    ctx: &mut ScanContext<'_>,
+    content: &[Vec<u8>],
+    holder_ref: ObjRef,
+    res: &Dict,
+    initial_font: Option<FontKey>,
+    depth: usize,
+) -> Result<(), CosError> {
+    if depth > MAX_DEPTH {
+        return Err(CosError::Syntax { offset: 0, detail: "redaction exceeded max depth inspecting Type 3 font content".into() });
+    }
+    let joined = Pieces::join(content);
+    let parsed = joined.parse();
+    if parsed.skipped > 0 {
+        return Err(CosError::Syntax { offset: 0, detail: "redaction could not fully inspect content stream syntax".into() });
+    }
+
+    let mut stack: Vec<Option<FontKey>> = Vec::new();
+    let mut current_font = initial_font;
+
+    for op in parsed.ops {
+        match op.op.as_slice() {
+            b"q" => stack.push(current_font),
+            b"Q" => {
+                if let Some(saved) = stack.pop() {
+                    current_font = saved;
+                }
+            }
+            b"Do" => {
+                if let Some(name) = op.last_name() {
+                    scan_xobject(ctx, res, holder_ref, name, current_font, depth)?;
+                }
+            }
+            _ => apply_text_op(ctx, res, &op, &mut current_font),
+        }
+    }
+    Ok(())
+}
+
+/// Apply an operator that changes or uses the current font: `Tf`, `gs`, and the text-showing
+/// operators, which record the glyphs they draw.
+fn apply_text_op(ctx: &mut ScanContext<'_>, res: &Dict, op: &pdfcraft_content::Op, current_font: &mut Option<FontKey>) {
+    match op.op.as_slice() {
+        b"Tf" => {
+            if let Some(name) = op.name(0) {
+                *current_font = resolve_font_in_res(ctx.doc, res, name).map(|(k, _)| k);
+            }
+        }
+        b"gs" => {
+            if let Some(name) = op.name(0)
+                && let Some((k, _)) = resolve_extgstate_font(ctx.doc, res, name)
+            {
+                *current_font = Some(k);
+            }
+        }
+        b"Tj" | b"'" | b"\"" => {
+            if let Some(s) = op.operands.last().and_then(Object::as_string) {
+                mark_shown(ctx, *current_font, &s.bytes);
+            }
+        }
+        b"TJ" => {
+            if let Some(arr) = op.operands.last().and_then(Object::as_array) {
+                for item in arr {
+                    if let Some(s) = item.as_string() {
+                        mark_shown(ctx, *current_font, &s.bytes);
+                    }
+                }
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Record every glyph of `font` that the shown string `bytes` uses.
+fn mark_shown(ctx: &mut ScanContext<'_>, font: Option<FontKey>, bytes: &[u8]) {
+    let Some(fk) = font else { return };
+    let Some(map) = ctx.font_maps.get(&fk) else { return };
+    for b in bytes {
+        if let Some(g) = &map[*b as usize] {
+            ctx.used_glyphs.entry(fk).or_default().insert(g.clone());
+        }
+    }
+}
+
+/// Scan the Form XObject `name` drawn by a `Do` operator, once per (form, font, drawing holder).
+fn scan_xobject(
+    ctx: &mut ScanContext<'_>,
+    res: &Dict,
+    holder_ref: ObjRef,
+    name: &[u8],
+    current_font: Option<FontKey>,
+    depth: usize,
+) -> Result<(), CosError> {
+    let xo = res_dict(ctx.doc, res, b"XObject");
+    let Some(r) = xo.get(name).and_then(Object::as_ref) else { return Ok(()) };
+    let obj = ctx.doc.get(r);
+    let Object::Stream(s) = &*obj else { return Ok(()) };
+    if s.dict.name(b"Subtype") != Some(b"Form") {
+        return Ok(());
+    }
+    let form_own_res = s.dict.get(b"Resources").and_then(|ro| ctx.doc.resolve(ro).as_dict().cloned());
+    // A form with resources of its own draws through them; one without draws through its caller's.
+    let through = if form_own_res.is_some() { r } else { holder_ref };
+    if !ctx.seen_forms.insert((r, current_font, through)) {
+        return Ok(());
+    }
+    let data = s.decoded()?;
+    match form_own_res {
+        Some(form_res) => scan_content_stream(ctx, std::slice::from_ref(&data), r, &form_res, current_font, depth + 1),
+        None => scan_content_stream(ctx, std::slice::from_ref(&data), holder_ref, res, current_font, depth + 1),
+    }
+}
+
+/// The font object an ExtGState's `/Font` entry names (its first element), if any.
+fn gs_font_object(doc: &Document, state_obj: &Object) -> Option<Object> {
+    let state = doc.resolve(state_obj).as_dict()?.clone();
+    let font_entry = doc.resolve(state.get(b"Font")?).as_array()?.clone();
+    font_entry.into_iter().next()
+}
+
+/// Prune Type 3 fonts from a rewritten page or form's `/Resources` dictionary if the rewritten
+/// content no longer draws any text using that font name.
+pub(crate) fn prune_type3_from_resources(doc: &Document, res: &mut Dict, content: &[Vec<u8>]) -> Result<(), CosError> {
+    let mut fonts = res_dict(doc, res, b"Font");
+    if fonts.is_empty() {
+        return Ok(());
+    }
+
+    // The operators of forms that draw through these resources count too: dropping a font a child
+    // form still shows would leave its text without one.
+    let ops = crate::interp::resource_ops(doc, res, content)?;
+
+    let mut drawn_font_names = HashSet::new();
+    for op in &ops {
+        if op.is("Tf") {
+            if let Some(name) = op.name(0) {
+                drawn_font_names.insert(name.to_vec());
+            }
+        } else if op.is("gs")
+            && let Some(name) = op.name(0)
+        {
+            let extg = res_dict(doc, res, b"ExtGState");
+            if let Some(font_obj) = extg.get(name).and_then(|state_obj| gs_font_object(doc, state_obj)) {
+                drawn_font_names.extend(
+                    fonts
+                        .iter()
+                        .filter(|(_, fn_obj)| fn_obj.as_ref().is_some() && fn_obj.as_ref() == font_obj.as_ref())
+                        .map(|(fn_name, _)| fn_name.to_vec()),
+                );
+            }
+        }
+    }
+
+    let mut changed = false;
+    let font_names: Vec<Vec<u8>> = fonts.iter().map(|(n, _)| n.to_vec()).collect();
+    for name in font_names {
+        if let Some(font_obj) = fonts.get(&name) {
+            let resolved = doc.resolve(font_obj);
+            if let Some(d) = resolved.as_dict()
+                && d.name(b"Subtype") == Some(b"Type3")
+                && !drawn_font_names.contains(&name)
+            {
+                fonts.remove(&name);
+                changed = true;
+            }
+        }
+    }
+
+    if changed {
+        if fonts.is_empty() {
+            res.remove(b"Font");
+        } else {
+            res.set(b"Font".to_vec(), Object::Dict(fonts));
+        }
+    }
+
+    Ok(())
+}
+
+/// Unlink unused Type 3 glyph programs from `CharProcs`, prune their exclusive resources from the
+/// font's `/Resources`, and remove completely unused Type 3 fonts across all reachable resource
+/// holders in the document. Fails closed if safe cleanup cannot be established.
+pub(crate) fn unlink_type3(doc: &mut Document) -> Result<(), RedactError> {
+    let Some(top) = doc.root().and_then(|root| doc.get(root).as_dict().and_then(|d| d.reference(b"Pages"))) else {
+        return Ok(());
+    };
+
+    // Find all page-tree nodes with /Resources of their own, and the pages that draw through them.
+    let mut holders: Vec<(ObjRef, Vec<ObjRef>)> = Vec::new();
+    let mut seen = HashSet::new();
+    let mut stack: Vec<(ObjRef, Option<usize>)> = vec![(top, None)];
+    while let Some((node, mut holder)) = stack.pop() {
+        if !seen.insert(node) || seen.len() > MAX_HOLDERS {
+            continue;
+        }
+        let obj = doc.get(node);
+        let Some(d) = obj.as_dict() else { continue };
+        if d.contains(b"Resources") {
+            holders.push((node, Vec::new()));
+            holder = Some(holders.len() - 1);
+        }
+        let is_pages = d.name(b"Type") == Some(b"Pages") || (d.contains(b"Kids") && d.name(b"Type") != Some(b"Page"));
+        if is_pages {
+            let kids = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+            stack.extend(kids.iter().filter_map(Object::as_ref).map(|k| (k, holder)));
+        } else if let Some(h) = holder.and_then(|i| holders.get_mut(i)) {
+            h.1.push(node);
+        }
+    }
+
+    let form_holders = reachable_form_holders(doc, &holders)?;
+
+    // Discover all Type 3 fonts in holders and forms.
+    let mut type3_fonts: HashMap<FontKey, Dict> = HashMap::new();
+    for (node, _) in &holders {
+        if let Some(res) = doc.get(*node).as_dict().and_then(|d| d.get(b"Resources")).and_then(|r| doc.resolve(r).as_dict().cloned()) {
+            collect_type3_fonts(doc, &res, &mut type3_fonts)?;
+        }
+    }
+    for (_, form_res) in &form_holders {
+        collect_type3_fonts(doc, form_res, &mut type3_fonts)?;
+    }
+
+    if type3_fonts.is_empty() {
+        return Ok(());
+    }
+
+    // Build code-to-glyph mappings for each Type 3 font. Fails closed on error.
+    let mut font_maps: HashMap<FontKey, [Option<Vec<u8>>; 256]> = HashMap::new();
+    for (key, font_dict) in &type3_fonts {
+        let map = type3_code_to_glyph(doc, font_dict)?;
+        font_maps.insert(*key, map);
+    }
+
+    // Scan all page contents and reachable forms to discover surviving glyph usage.
+    let page_list = pdfcraft_model::pages(doc);
+    let mut used_glyphs: HashMap<FontKey, HashSet<Vec<u8>>> = HashMap::new();
+    let mut seen_drawn_forms = HashSet::new();
+
+    let mut ctx = ScanContext { doc, font_maps: &font_maps, used_glyphs: &mut used_glyphs, seen_forms: &mut seen_drawn_forms };
+
+    for (pi, p) in page_list.iter().enumerate() {
+        let (_, content) = page_streams(ctx.doc, &p.dict, pi)?;
+        let page_res = p
+            .dict
+            .get(b"Resources")
+            .and_then(|r| ctx.doc.resolve(r).as_dict().cloned())
+            .or_else(|| {
+                holders.iter().find(|(_, users)| users.contains(&p.obj)).and_then(|(h, _)| {
+                    ctx.doc.get(*h).as_dict().and_then(|d| d.get(b"Resources")).and_then(|ro| ctx.doc.resolve(ro).as_dict().cloned())
+                })
+            })
+            .unwrap_or_default();
+
+        scan_content_stream(&mut ctx, &content, p.obj, &page_res, None, 0)?;
+    }
+
+    // Also scan any surviving form that wasn't reached by page streams directly.
+    for (form_ref, form_res) in &form_holders {
+        if !ctx.seen_forms.iter().any(|(form, _, _)| form == form_ref) {
+            let Object::Stream(s) = &*ctx.doc.get(*form_ref) else { continue };
+            let data = s.decoded()?;
+            scan_content_stream(&mut ctx, std::slice::from_ref(&data), *form_ref, form_res, None, 0)?;
+        }
+    }
+
+    // For each Type 3 font: unlink unused glyphs from CharProcs and prune exclusive resources.
+    for (font_key, font_dict) in &type3_fonts {
+        let surviving = used_glyphs.get(font_key).cloned().unwrap_or_default();
+        clean_type3_font(doc, &holders, &form_holders, font_key, font_dict, &surviving)?;
+    }
+
+    Ok(())
+}
+
+/// Every reachable Form XObject with resources of its own, with those resources, found by
+/// walking the resources of the holders and of the forms they draw.
+fn reachable_form_holders(doc: &Document, holders: &[(ObjRef, Vec<ObjRef>)]) -> Result<Vec<(ObjRef, Dict)>, CosError> {
+    let mut form_holders: Vec<(ObjRef, Dict)> = Vec::new();
+    let mut pending_res: Vec<Dict> = holders
+        .iter()
+        .filter_map(|(r, _)| doc.get(*r).as_dict().and_then(|d| d.get(b"Resources")).and_then(|ro| doc.resolve(ro).as_dict().cloned()))
+        .collect();
+    let mut seen_forms = HashSet::new();
+    while let Some(res) = pending_res.pop() {
+        for (_, value) in res_dict(doc, &res, b"XObject").iter() {
+            let Some(reference) = value.as_ref() else { continue };
+            if !seen_forms.insert(reference) {
+                continue;
+            }
+            if seen_forms.len() > MAX_HOLDERS {
+                return Err(CosError::Syntax { offset: 0, detail: "redaction exceeded max depth inspecting form resources".into() });
+            }
+            let object = doc.get(reference);
+            let Object::Stream(form) = &*object else { continue };
+            if form.dict.name(b"Subtype") != Some(b"Form") {
+                continue;
+            }
+            if let Some(r) = form.dict.get(b"Resources").and_then(|ro| doc.resolve(ro).as_dict().cloned()) {
+                form_holders.push((reference, r.clone()));
+                pending_res.push(r);
+            }
+        }
+    }
+    Ok(form_holders)
+}
+
+/// Record every Type 3 font named by a resource dictionary's `/Font` and `/ExtGState` entries.
+/// A Type 3 font held directly in a resource dictionary can neither be named reliably nor have its
+/// glyph programs rewritten, so redaction fails closed rather than leaving its glyphs unchecked.
+fn collect_type3_fonts(doc: &Document, res: &Dict, t3_fonts: &mut HashMap<FontKey, Dict>) -> Result<(), CosError> {
+    let direct = || CosError::Syntax {
+        offset: 0,
+        detail: "redaction could not establish safe Type 3 font cleanup: a Type 3 font is not an indirect object".into(),
+    };
+    let mut consider = |font_obj: &Object| -> Result<(), CosError> {
+        if let Some(dict) = doc.resolve(font_obj).as_dict().cloned()
+            && dict.name(b"Subtype") == Some(b"Type3")
+        {
+            let font_ref = font_obj.as_ref().ok_or_else(direct)?;
+            t3_fonts.entry(FontKey::Ref(font_ref)).or_insert(dict);
+        }
+        Ok(())
+    };
+    for (_, font_obj) in res_dict(doc, res, b"Font").iter() {
+        consider(font_obj)?;
+    }
+    for (_, state_obj) in res_dict(doc, res, b"ExtGState").iter() {
+        if let Some(font_obj) = gs_font_object(doc, state_obj) {
+            consider(&font_obj)?;
+        }
+    }
+    Ok(())
+}
+
+/// Unlink the glyph programs of one Type 3 font that no longer draw, then either remove the font
+/// (when no glyph survives) or prune the resources only its surviving glyphs used.
+fn clean_type3_font(
+    doc: &mut Document,
+    holders: &[(ObjRef, Vec<ObjRef>)],
+    form_holders: &[(ObjRef, Dict)],
+    font_key: &FontKey,
+    font_dict: &Dict,
+    surviving: &HashSet<Vec<u8>>,
+) -> Result<(), RedactError> {
+    let Some(char_procs_val) = font_dict.get(b"CharProcs") else {
+        return Err(CosError::Syntax { offset: 0, detail: "redaction could not establish safe Type 3 font cleanup: missing CharProcs".into() }.into());
+    };
+    let mut char_procs = doc.resolve(char_procs_val).as_dict().cloned().ok_or_else(|| CosError::Syntax {
+        offset: 0,
+        detail: "redaction could not establish safe Type 3 font cleanup: CharProcs is not a dict".into(),
+    })?;
+
+    let mut procs_changed = false;
+    let glyph_names: Vec<Vec<u8>> = char_procs.iter().map(|(n, _)| n.to_vec()).collect();
+    for g in glyph_names {
+        if !surviving.contains(&g) {
+            char_procs.remove(&g);
+            procs_changed = true;
+        }
+    }
+
+    let FontKey::Ref(fr) = font_key;
+    if char_procs.is_empty() {
+        // The font has no surviving glyphs: clear its own glyph programs and resources, then
+        // remove font from /Font across all holders.
+        doc.update_dict(*fr, |d| {
+            d.remove(b"CharProcs");
+            d.remove(b"Resources");
+        })?;
+        return remove_font_from_holders(doc, holders, form_holders, font_key);
+    }
+
+    // A CharProcs object can be shared with another Type 3 font, so never rewrite it in place:
+    // give this font its own filtered dictionary instead.
+    if procs_changed {
+        doc.update_dict(*fr, |d| {
+            d.set(b"CharProcs".to_vec(), Object::Dict(char_procs.clone()));
+        })?;
+    }
+
+    // Clean exclusive resources from the Type 3 font's /Resources.
+    let Some(f_res_val) = font_dict.get(b"Resources") else { return Ok(()) };
+    let mut f_res = doc.resolve(f_res_val).as_dict().cloned().unwrap_or_default();
+
+    let mut used_in_glyphs = UsedInGlyphs::default();
+    for (_, proc_val) in char_procs.iter() {
+        let resolved = doc.resolve(proc_val);
+        let Object::Stream(s) = &*resolved else {
+            return Err(CosError::Syntax {
+                offset: 0,
+                detail: "redaction could not establish safe Type 3 font cleanup: CharProc is not a stream".into(),
+            }
+            .into());
+        };
+        let data = s.decoded()?;
+        collect_used_resources_in_stream(&data, &mut used_in_glyphs)?;
+    }
+
+    if prune_type3_font_resources(doc, &mut f_res, &used_in_glyphs) {
+        // The pruned dictionary goes into the font object: a font's /Resources object is
+        // often the page's own, and rewriting that would strip the page of its resources.
+        doc.update_dict(*fr, |d| {
+            if f_res.is_empty() {
+                d.remove(b"Resources");
+            } else {
+                d.set(b"Resources".to_vec(), Object::Dict(f_res.clone()));
+            }
+        })?;
+    }
+    Ok(())
+}
+
+fn remove_font_from_holders(
+    doc: &mut Document,
+    holders: &[(ObjRef, Vec<ObjRef>)],
+    form_holders: &[(ObjRef, Dict)],
+    target_key: &FontKey,
+) -> Result<(), RedactError> {
+    let clean_res = |doc: &Document, res: &mut Dict| -> bool {
+        let mut fonts = res_dict(doc, res, b"Font");
+        let mut changed = false;
+        let names: Vec<Vec<u8>> = fonts.iter().map(|(n, _)| n.to_vec()).collect();
+        for n in names {
+            if let Some(val) = fonts.get(&n)
+                && val.as_ref().map(FontKey::Ref) == Some(*target_key)
+            {
+                fonts.remove(&n);
+                changed = true;
+            }
+        }
+        if changed {
+            if fonts.is_empty() {
+                res.remove(b"Font");
+            } else {
+                res.set(b"Font".to_vec(), Object::Dict(fonts));
+            }
+        }
+        changed
+    };
+
+    for (node, _) in holders {
+        if let Some(mut res) = doc.get(*node).as_dict().and_then(|d| d.get(b"Resources")).and_then(|r| doc.resolve(r).as_dict().cloned())
+            && clean_res(doc, &mut res)
+        {
+            doc.update_dict(*node, |d| {
+                d.set(b"Resources".to_vec(), Object::Dict(res));
+            })?;
+        }
+    }
+
+    for (form_ref, _) in form_holders {
+        let obj = doc.get(*form_ref);
+        if let Object::Stream(s) = &*obj
+            && let Some(mut res) = s.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned())
+            && clean_res(doc, &mut res)
+        {
+            doc.update_dict(*form_ref, |d| {
+                d.set(b"Resources".to_vec(), Object::Dict(res));
+            })?;
+        }
+    }
+
+    Ok(())
+}
diff --git a/crates/redact/src/type3_tables.rs b/crates/redact/src/type3_tables.rs
new file mode 100644
index 0000000000..62128772de
--- /dev/null
+++ b/crates/redact/src/type3_tables.rs
@@ -0,0 +1,775 @@
+//! Predefined font encodings (ISO 32000 Annex D) mapping character codes to glyph names.
+
+//! Each encoding lists only the codes it maps; every other code is unmapped.
+
+type Entries = &'static [(u8, &'static [u8])];
+
+const fn build(entries: Entries) -> [Option<&'static [u8]>; 256] {
+    let mut out: [Option<&'static [u8]>; 256] = [None; 256];
+    let mut i = 0;
+    while i < entries.len() {
+        out[entries[i].0 as usize] = Some(entries[i].1);
+        i += 1;
+    }
+    out
+}
+
+const STANDARD_ENTRIES: Entries = &[
+    (32, b"space"),
+    (33, b"exclam"),
+    (34, b"quotedbl"),
+    (35, b"numbersign"),
+    (36, b"dollar"),
+    (37, b"percent"),
+    (38, b"ampersand"),
+    (39, b"quoteright"),
+    (40, b"parenleft"),
+    (41, b"parenright"),
+    (42, b"asterisk"),
+    (43, b"plus"),
+    (44, b"comma"),
+    (45, b"hyphen"),
+    (46, b"period"),
+    (47, b"slash"),
+    (48, b"zero"),
+    (49, b"one"),
+    (50, b"two"),
+    (51, b"three"),
+    (52, b"four"),
+    (53, b"five"),
+    (54, b"six"),
+    (55, b"seven"),
+    (56, b"eight"),
+    (57, b"nine"),
+    (58, b"colon"),
+    (59, b"semicolon"),
+    (60, b"less"),
+    (61, b"equal"),
+    (62, b"greater"),
+    (63, b"question"),
+    (64, b"at"),
+    (65, b"A"),
+    (66, b"B"),
+    (67, b"C"),
+    (68, b"D"),
+    (69, b"E"),
+    (70, b"F"),
+    (71, b"G"),
+    (72, b"H"),
+    (73, b"I"),
+    (74, b"J"),
+    (75, b"K"),
+    (76, b"L"),
+    (77, b"M"),
+    (78, b"N"),
+    (79, b"O"),
+    (80, b"P"),
+    (81, b"Q"),
+    (82, b"R"),
+    (83, b"S"),
+    (84, b"T"),
+    (85, b"U"),
+    (86, b"V"),
+    (87, b"W"),
+    (88, b"X"),
+    (89, b"Y"),
+    (90, b"Z"),
+    (91, b"bracketleft"),
+    (92, b"backslash"),
+    (93, b"bracketright"),
+    (94, b"asciicircum"),
+    (95, b"underscore"),
+    (96, b"quoteleft"),
+    (97, b"a"),
+    (98, b"b"),
+    (99, b"c"),
+    (100, b"d"),
+    (101, b"e"),
+    (102, b"f"),
+    (103, b"g"),
+    (104, b"h"),
+    (105, b"i"),
+    (106, b"j"),
+    (107, b"k"),
+    (108, b"l"),
+    (109, b"m"),
+    (110, b"n"),
+    (111, b"o"),
+    (112, b"p"),
+    (113, b"q"),
+    (114, b"r"),
+    (115, b"s"),
+    (116, b"t"),
+    (117, b"u"),
+    (118, b"v"),
+    (119, b"w"),
+    (120, b"x"),
+    (121, b"y"),
+    (122, b"z"),
+    (123, b"braceleft"),
+    (124, b"bar"),
+    (125, b"braceright"),
+    (126, b"asciitilde"),
+    (161, b"exclamdown"),
+    (162, b"cent"),
+    (163, b"sterling"),
+    (164, b"fraction"),
+    (165, b"yen"),
+    (166, b"florin"),
+    (167, b"section"),
+    (168, b"currency"),
+    (169, b"quotesingle"),
+    (170, b"quotedblleft"),
+    (171, b"guillemotleft"),
+    (172, b"guilsinglleft"),
+    (173, b"guilsinglright"),
+    (174, b"fi"),
+    (175, b"fl"),
+    (177, b"endash"),
+    (178, b"dagger"),
+    (179, b"daggerdbl"),
+    (180, b"periodcentered"),
+    (182, b"paragraph"),
+    (183, b"bullet"),
+    (184, b"quotesinglbase"),
+    (185, b"quotedblbase"),
+    (186, b"quotedblright"),
+    (187, b"guillemotright"),
+    (188, b"ellipsis"),
+    (189, b"perthousand"),
+    (191, b"questiondown"),
+    (193, b"grave"),
+    (194, b"acute"),
+    (195, b"circumflex"),
+    (196, b"tilde"),
+    (197, b"macron"),
+    (198, b"breve"),
+    (199, b"dotaccent"),
+    (200, b"dieresis"),
+    (202, b"ring"),
+    (203, b"cedilla"),
+    (205, b"hungarumlaut"),
+    (206, b"ogonek"),
+    (207, b"caron"),
+    (208, b"emdash"),
+    (225, b"AE"),
+    (227, b"ordfeminine"),
+    (232, b"Lslash"),
+    (233, b"Oslash"),
+    (234, b"OE"),
+    (235, b"ordmasculine"),
+    (241, b"ae"),
+    (245, b"dotlessi"),
+    (248, b"lslash"),
+    (249, b"oslash"),
+    (250, b"oe"),
+    (251, b"germandbls"),
+];
+
+pub(crate) static STANDARD: [Option<&[u8]>; 256] = build(STANDARD_ENTRIES);
+
+const WIN_ANSI_ENTRIES: Entries = &[
+    (32, b"space"),
+    (33, b"exclam"),
+    (34, b"quotedbl"),
+    (35, b"numbersign"),
+    (36, b"dollar"),
+    (37, b"percent"),
+    (38, b"ampersand"),
+    (39, b"quotesingle"),
+    (40, b"parenleft"),
+    (41, b"parenright"),
+    (42, b"asterisk"),
+    (43, b"plus"),
+    (44, b"comma"),
+    (45, b"hyphen"),
+    (46, b"period"),
+    (47, b"slash"),
+    (48, b"zero"),
+    (49, b"one"),
+    (50, b"two"),
+    (51, b"three"),
+    (52, b"four"),
+    (53, b"five"),
+    (54, b"six"),
+    (55, b"seven"),
+    (56, b"eight"),
+    (57, b"nine"),
+    (58, b"colon"),
+    (59, b"semicolon"),
+    (60, b"less"),
+    (61, b"equal"),
+    (62, b"greater"),
+    (63, b"question"),
+    (64, b"at"),
+    (65, b"A"),
+    (66, b"B"),
+    (67, b"C"),
+    (68, b"D"),
+    (69, b"E"),
+    (70, b"F"),
+    (71, b"G"),
+    (72, b"H"),
+    (73, b"I"),
+    (74, b"J"),
+    (75, b"K"),
+    (76, b"L"),
+    (77, b"M"),
+    (78, b"N"),
+    (79, b"O"),
+    (80, b"P"),
+    (81, b"Q"),
+    (82, b"R"),
+    (83, b"S"),
+    (84, b"T"),
+    (85, b"U"),
+    (86, b"V"),
+    (87, b"W"),
+    (88, b"X"),
+    (89, b"Y"),
+    (90, b"Z"),
+    (91, b"bracketleft"),
+    (92, b"backslash"),
+    (93, b"bracketright"),
+    (94, b"asciicircum"),
+    (95, b"underscore"),
+    (96, b"grave"),
+    (97, b"a"),
+    (98, b"b"),
+    (99, b"c"),
+    (100, b"d"),
+    (101, b"e"),
+    (102, b"f"),
+    (103, b"g"),
+    (104, b"h"),
+    (105, b"i"),
+    (106, b"j"),
+    (107, b"k"),
+    (108, b"l"),
+    (109, b"m"),
+    (110, b"n"),
+    (111, b"o"),
+    (112, b"p"),
+    (113, b"q"),
+    (114, b"r"),
+    (115, b"s"),
+    (116, b"t"),
+    (117, b"u"),
+    (118, b"v"),
+    (119, b"w"),
+    (120, b"x"),
+    (121, b"y"),
+    (122, b"z"),
+    (123, b"braceleft"),
+    (124, b"bar"),
+    (125, b"braceright"),
+    (126, b"asciitilde"),
+    (128, b"Euro"),
+    (130, b"quotesinglbase"),
+    (131, b"florin"),
+    (132, b"quotedblbase"),
+    (133, b"ellipsis"),
+    (134, b"dagger"),
+    (135, b"daggerdbl"),
+    (136, b"circumflex"),
+    (137, b"perthousand"),
+    (138, b"Scaron"),
+    (139, b"guilsinglleft"),
+    (140, b"OE"),
+    (142, b"Zcaron"),
+    (145, b"quoteleft"),
+    (146, b"quoteright"),
+    (147, b"quotedblleft"),
+    (148, b"quotedblright"),
+    (149, b"bullet"),
+    (150, b"endash"),
+    (151, b"emdash"),
+    (152, b"tilde"),
+    (153, b"trademark"),
+    (154, b"scaron"),
+    (155, b"guilsinglright"),
+    (156, b"oe"),
+    (158, b"zcaron"),
+    (159, b"Ydieresis"),
+    (160, b"space"),
+    (161, b"exclamdown"),
+    (162, b"cent"),
+    (163, b"sterling"),
+    (164, b"currency"),
+    (165, b"yen"),
+    (166, b"brokenbar"),
+    (167, b"section"),
+    (168, b"dieresis"),
+    (169, b"copyright"),
+    (170, b"ordfeminine"),
+    (171, b"guillemotleft"),
+    (172, b"logicalnot"),
+    (173, b"hyphen"),
+    (174, b"registered"),
+    (175, b"macron"),
+    (176, b"degree"),
+    (177, b"plusminus"),
+    (178, b"twosuperior"),
+    (179, b"threesuperior"),
+    (180, b"acute"),
+    (181, b"mu"),
+    (182, b"paragraph"),
+    (183, b"periodcentered"),
+    (184, b"cedilla"),
+    (185, b"onesuperior"),
+    (186, b"ordmasculine"),
+    (187, b"guillemotright"),
+    (188, b"onequarter"),
+    (189, b"onehalf"),
+    (190, b"threequarters"),
+    (191, b"questiondown"),
+    (192, b"Agrave"),
+    (193, b"Aacute"),
+    (194, b"Acircumflex"),
+    (195, b"Atilde"),
+    (196, b"Adieresis"),
+    (197, b"Aring"),
+    (198, b"AE"),
+    (199, b"Ccedilla"),
+    (200, b"Egrave"),
+    (201, b"Eacute"),
+    (202, b"Ecircumflex"),
+    (203, b"Edieresis"),
+    (204, b"Igrave"),
+    (205, b"Iacute"),
+    (206, b"Icircumflex"),
+    (207, b"Idieresis"),
+    (208, b"Eth"),
+    (209, b"Ntilde"),
+    (210, b"Ograve"),
+    (211, b"Oacute"),
+    (212, b"Ocircumflex"),
+    (213, b"Otilde"),
+    (214, b"Odieresis"),
+    (215, b"multiply"),
+    (216, b"Oslash"),
+    (217, b"Ugrave"),
+    (218, b"Uacute"),
+    (219, b"Ucircumflex"),
+    (220, b"Udieresis"),
+    (221, b"Yacute"),
+    (222, b"Thorn"),
+    (223, b"germandbls"),
+    (224, b"agrave"),
+    (225, b"aacute"),
+    (226, b"acircumflex"),
+    (227, b"atilde"),
+    (228, b"adieresis"),
+    (229, b"aring"),
+    (230, b"ae"),
+    (231, b"ccedilla"),
+    (232, b"egrave"),
+    (233, b"eacute"),
+    (234, b"ecircumflex"),
+    (235, b"edieresis"),
+    (236, b"igrave"),
+    (237, b"iacute"),
+    (238, b"icircumflex"),
+    (239, b"idieresis"),
+    (240, b"eth"),
+    (241, b"ntilde"),
+    (242, b"ograve"),
+    (243, b"oacute"),
+    (244, b"ocircumflex"),
+    (245, b"otilde"),
+    (246, b"odieresis"),
+    (247, b"divide"),
+    (248, b"oslash"),
+    (249, b"ugrave"),
+    (250, b"uacute"),
+    (251, b"ucircumflex"),
+    (252, b"udieresis"),
+    (253, b"yacute"),
+    (254, b"thorn"),
+    (255, b"ydieresis"),
+];
+
+pub(crate) static WIN_ANSI: [Option<&[u8]>; 256] = build(WIN_ANSI_ENTRIES);
+
+const MAC_ROMAN_ENTRIES: Entries = &[
+    (32, b"space"),
+    (33, b"exclam"),
+    (34, b"quotedbl"),
+    (35, b"numbersign"),
+    (36, b"dollar"),
+    (37, b"percent"),
+    (38, b"ampersand"),
+    (39, b"quotesingle"),
+    (40, b"parenleft"),
+    (41, b"parenright"),
+    (42, b"asterisk"),
+    (43, b"plus"),
+    (44, b"comma"),
+    (45, b"hyphen"),
+    (46, b"period"),
+    (47, b"slash"),
+    (48, b"zero"),
+    (49, b"one"),
+    (50, b"two"),
+    (51, b"three"),
+    (52, b"four"),
+    (53, b"five"),
+    (54, b"six"),
+    (55, b"seven"),
+    (56, b"eight"),
+    (57, b"nine"),
+    (58, b"colon"),
+    (59, b"semicolon"),
+    (60, b"less"),
+    (61, b"equal"),
+    (62, b"greater"),
+    (63, b"question"),
+    (64, b"at"),
+    (65, b"A"),
+    (66, b"B"),
+    (67, b"C"),
+    (68, b"D"),
+    (69, b"E"),
+    (70, b"F"),
+    (71, b"G"),
+    (72, b"H"),
+    (73, b"I"),
+    (74, b"J"),
+    (75, b"K"),
+    (76, b"L"),
+    (77, b"M"),
+    (78, b"N"),
+    (79, b"O"),
+    (80, b"P"),
+    (81, b"Q"),
+    (82, b"R"),
+    (83, b"S"),
+    (84, b"T"),
+    (85, b"U"),
+    (86, b"V"),
+    (87, b"W"),
+    (88, b"X"),
+    (89, b"Y"),
+    (90, b"Z"),
+    (91, b"bracketleft"),
+    (92, b"backslash"),
+    (93, b"bracketright"),
+    (94, b"asciicircum"),
+    (95, b"underscore"),
+    (96, b"grave"),
+    (97, b"a"),
+    (98, b"b"),
+    (99, b"c"),
+    (100, b"d"),
+    (101, b"e"),
+    (102, b"f"),
+    (103, b"g"),
+    (104, b"h"),
+    (105, b"i"),
+    (106, b"j"),
+    (107, b"k"),
+    (108, b"l"),
+    (109, b"m"),
+    (110, b"n"),
+    (111, b"o"),
+    (112, b"p"),
+    (113, b"q"),
+    (114, b"r"),
+    (115, b"s"),
+    (116, b"t"),
+    (117, b"u"),
+    (118, b"v"),
+    (119, b"w"),
+    (120, b"x"),
+    (121, b"y"),
+    (122, b"z"),
+    (123, b"braceleft"),
+    (124, b"bar"),
+    (125, b"braceright"),
+    (126, b"asciitilde"),
+    (128, b"Adieresis"),
+    (129, b"Aring"),
+    (130, b"Ccedilla"),
+    (131, b"Eacute"),
+    (132, b"Ntilde"),
+    (133, b"Odieresis"),
+    (134, b"Udieresis"),
+    (135, b"aacute"),
+    (136, b"agrave"),
+    (137, b"acircumflex"),
+    (138, b"adieresis"),
+    (139, b"atilde"),
+    (140, b"aring"),
+    (141, b"ccedilla"),
+    (142, b"eacute"),
+    (143, b"egrave"),
+    (144, b"ecircumflex"),
+    (145, b"edieresis"),
+    (146, b"iacute"),
+    (147, b"igrave"),
+    (148, b"icircumflex"),
+    (149, b"idieresis"),
+    (150, b"ntilde"),
+    (151, b"oacute"),
+    (152, b"ograve"),
+    (153, b"ocircumflex"),
+    (154, b"odieresis"),
+    (155, b"otilde"),
+    (156, b"uacute"),
+    (157, b"ugrave"),
+    (158, b"ucircumflex"),
+    (159, b"udieresis"),
+    (160, b"dagger"),
+    (161, b"degree"),
+    (162, b"cent"),
+    (163, b"sterling"),
+    (164, b"section"),
+    (165, b"bullet"),
+    (166, b"paragraph"),
+    (167, b"germandbls"),
+    (168, b"registered"),
+    (169, b"copyright"),
+    (170, b"trademark"),
+    (171, b"acute"),
+    (172, b"dieresis"),
+    (174, b"AE"),
+    (175, b"Oslash"),
+    (177, b"plusminus"),
+    (180, b"yen"),
+    (181, b"mu"),
+    (187, b"ordfeminine"),
+    (188, b"ordmasculine"),
+    (190, b"ae"),
+    (191, b"oslash"),
+    (192, b"questiondown"),
+    (193, b"exclamdown"),
+    (194, b"logicalnot"),
+    (196, b"florin"),
+    (199, b"guillemotleft"),
+    (200, b"guillemotright"),
+    (201, b"ellipsis"),
+    (202, b"space"),
+    (203, b"Agrave"),
+    (204, b"Atilde"),
+    (205, b"Otilde"),
+    (206, b"OE"),
+    (207, b"oe"),
+    (208, b"endash"),
+    (209, b"emdash"),
+    (210, b"quotedblleft"),
+    (211, b"quotedblright"),
+    (212, b"quoteleft"),
+    (213, b"quoteright"),
+    (214, b"divide"),
+    (216, b"ydieresis"),
+    (217, b"Ydieresis"),
+    (218, b"fraction"),
+    (219, b"currency"),
+    (220, b"guilsinglleft"),
+    (221, b"guilsinglright"),
+    (222, b"fi"),
+    (223, b"fl"),
+    (224, b"daggerdbl"),
+    (225, b"periodcentered"),
+    (226, b"quotesinglbase"),
+    (227, b"quotedblbase"),
+    (228, b"perthousand"),
+    (229, b"Acircumflex"),
+    (230, b"Ecircumflex"),
+    (231, b"Aacute"),
+    (232, b"Edieresis"),
+    (233, b"Egrave"),
+    (234, b"Iacute"),
+    (235, b"Icircumflex"),
+    (236, b"Idieresis"),
+    (237, b"Igrave"),
+    (238, b"Oacute"),
+    (239, b"Ocircumflex"),
+    (241, b"Ograve"),
+    (242, b"Uacute"),
+    (243, b"Ucircumflex"),
+    (244, b"Ugrave"),
+    (245, b"dotlessi"),
+    (246, b"circumflex"),
+    (247, b"tilde"),
+    (248, b"macron"),
+    (249, b"breve"),
+    (250, b"dotaccent"),
+    (251, b"ring"),
+    (252, b"cedilla"),
+    (253, b"hungarumlaut"),
+    (254, b"ogonek"),
+    (255, b"caron"),
+];
+
+pub(crate) static MAC_ROMAN: [Option<&[u8]>; 256] = build(MAC_ROMAN_ENTRIES);
+
+const MAC_EXPERT_ENTRIES: Entries = &[
+    (32, b"space"),
+    (33, b"exclamsmall"),
+    (34, b"Hungarumlautsmall"),
+    (35, b"centoldstyle"),
+    (36, b"dollaroldstyle"),
+    (37, b"dollarsuperior"),
+    (38, b"ampersandsmall"),
+    (39, b"Acutesmall"),
+    (40, b"parenleftsuperior"),
+    (41, b"parenrightsuperior"),
+    (42, b"twodotenleader"),
+    (43, b"onedotenleader"),
+    (44, b"comma"),
+    (45, b"hyphen"),
+    (46, b"period"),
+    (47, b"fraction"),
+    (48, b"zerooldstyle"),
+    (49, b"oneoldstyle"),
+    (50, b"twooldstyle"),
+    (51, b"threeoldstyle"),
+    (52, b"fouroldstyle"),
+    (53, b"fiveoldstyle"),
+    (54, b"sixoldstyle"),
+    (55, b"sevenoldstyle"),
+    (56, b"eightoldstyle"),
+    (57, b"nineoldstyle"),
+    (58, b"colon"),
+    (59, b"semicolon"),
+    (61, b"threequartersemdash"),
+    (63, b"questionsmall"),
+    (68, b"Ethsmall"),
+    (71, b"onequarter"),
+    (72, b"onehalf"),
+    (73, b"threequarters"),
+    (74, b"oneeighth"),
+    (75, b"threeeighths"),
+    (76, b"fiveeighths"),
+    (77, b"seveneighths"),
+    (78, b"onethird"),
+    (79, b"twothirds"),
+    (86, b"ff"),
+    (87, b"fi"),
+    (88, b"fl"),
+    (89, b"ffi"),
+    (90, b"ffl"),
+    (91, b"parenleftinferior"),
+    (93, b"parenrightinferior"),
+    (94, b"Circumflexsmall"),
+    (95, b"hypheninferior"),
+    (96, b"Gravesmall"),
+    (97, b"Asmall"),
+    (98, b"Bsmall"),
+    (99, b"Csmall"),
+    (100, b"Dsmall"),
+    (101, b"Esmall"),
+    (102, b"Fsmall"),
+    (103, b"Gsmall"),
+    (104, b"Hsmall"),
+    (105, b"Ismall"),
+    (106, b"Jsmall"),
+    (107, b"Ksmall"),
+    (108, b"Lsmall"),
+    (109, b"Msmall"),
+    (110, b"Nsmall"),
+    (111, b"Osmall"),
+    (112, b"Psmall"),
+    (113, b"Qsmall"),
+    (114, b"Rsmall"),
+    (115, b"Ssmall"),
+    (116, b"Tsmall"),
+    (117, b"Usmall"),
+    (118, b"Vsmall"),
+    (119, b"Wsmall"),
+    (120, b"Xsmall"),
+    (121, b"Ysmall"),
+    (122, b"Zsmall"),
+    (123, b"colonmonetary"),
+    (124, b"onefitted"),
+    (125, b"rupiah"),
+    (126, b"Tildesmall"),
+    (129, b"asuperior"),
+    (130, b"centsuperior"),
+    (135, b"Aacutesmall"),
+    (136, b"Agravesmall"),
+    (137, b"Acircumflexsmall"),
+    (138, b"Adieresissmall"),
+    (139, b"Atildesmall"),
+    (140, b"Aringsmall"),
+    (141, b"Ccedillasmall"),
+    (142, b"Eacutesmall"),
+    (143, b"Egravesmall"),
+    (144, b"Ecircumflexsmall"),
+    (145, b"Edieresissmall"),
+    (146, b"Iacutesmall"),
+    (147, b"Igravesmall"),
+    (148, b"Icircumflexsmall"),
+    (149, b"Idieresissmall"),
+    (150, b"Ntildesmall"),
+    (151, b"Oacutesmall"),
+    (152, b"Ogravesmall"),
+    (153, b"Ocircumflexsmall"),
+    (154, b"Odieresissmall"),
+    (155, b"Otildesmall"),
+    (156, b"Uacutesmall"),
+    (157, b"Ugravesmall"),
+    (158, b"Ucircumflexsmall"),
+    (159, b"Udieresissmall"),
+    (161, b"eightsuperior"),
+    (162, b"fourinferior"),
+    (163, b"threeinferior"),
+    (164, b"sixinferior"),
+    (165, b"eightinferior"),
+    (166, b"seveninferior"),
+    (167, b"Scaronsmall"),
+    (169, b"centinferior"),
+    (170, b"twoinferior"),
+    (172, b"Dieresissmall"),
+    (174, b"Caronsmall"),
+    (175, b"osuperior"),
+    (176, b"fiveinferior"),
+    (178, b"commainferior"),
+    (179, b"periodinferior"),
+    (180, b"Yacutesmall"),
+    (182, b"dollarinferior"),
+    (185, b"Thornsmall"),
+    (187, b"nineinferior"),
+    (188, b"zeroinferior"),
+    (189, b"Zcaronsmall"),
+    (190, b"AEsmall"),
+    (191, b"Oslashsmall"),
+    (192, b"questiondownsmall"),
+    (193, b"oneinferior"),
+    (194, b"Lslashsmall"),
+    (201, b"Cedillasmall"),
+    (207, b"OEsmall"),
+    (208, b"figuredash"),
+    (209, b"hyphensuperior"),
+    (214, b"exclamdownsmall"),
+    (216, b"Ydieresissmall"),
+    (218, b"onesuperior"),
+    (219, b"twosuperior"),
+    (220, b"threesuperior"),
+    (221, b"foursuperior"),
+    (222, b"fivesuperior"),
+    (223, b"sixsuperior"),
+    (224, b"sevensuperior"),
+    (225, b"ninesuperior"),
+    (226, b"zerosuperior"),
+    (228, b"esuperior"),
+    (229, b"rsuperior"),
+    (230, b"tsuperior"),
+    (233, b"isuperior"),
+    (234, b"ssuperior"),
+    (235, b"dsuperior"),
+    (241, b"lsuperior"),
+    (242, b"Ogoneksmall"),
+    (243, b"Brevesmall"),
+    (244, b"Macronsmall"),
+    (245, b"bsuperior"),
+    (246, b"nsuperior"),
+    (247, b"msuperior"),
+    (248, b"commasuperior"),
+    (249, b"periodsuperior"),
+    (250, b"Dotaccentsmall"),
+    (251, b"Ringsmall"),
+];
+
+pub(crate) static MAC_EXPERT: [Option<&[u8]>; 256] = build(MAC_EXPERT_ENTRIES);
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index 26969396a1..0cf287b3f1 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -6,6 +6,7 @@
 //! are empty and `warnings` says why.
 
 use std::cell::OnceCell;
+use std::collections::hash_map::Entry;
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::Arc;
 
@@ -22,60 +23,27 @@ use pdfcraft_cos::page_labels::{
 use crate::OpenError;
 use crate::structure::{LazyStructure, Structure};
 
-/// lopdf decodes object and cross-reference streams while it loads, with no limit unless one is
-/// set: a few hundred bytes of nested FlateDecode then inflate to gigabytes. Real object and
-/// xref streams are far below this.
-const LOAD_STREAM_LIMIT: usize = 256 << 20;
+mod annotations;
+mod core;
+mod model;
+mod navigation;
+mod resources;
 
-/// At most this many `/State` entries of a set-layer-visibility action are read.
-const MAX_LAYER_STATE: usize = 1024;
-
-/// Decoded bytes read from an XFA form's configuration packet (or a whole-XDP `/XFA` stream) to
-/// find `dynamicRender`. Designer's packets are a few kilobytes; a whole XDP can hold the template.
-const MAX_XFA_CONFIG_BYTES: usize = 16 << 20;
-
-/// File specifications retained from a remote-Go-To action are deliberately small.
-const MAX_REMOTE_FILE_SPEC_BYTES: usize = 4096;
-const MAX_REMOTE_DESTINATION_NAME_BYTES: usize = 1024;
-
-/// Text and geometry `DocInfo::annotations` keeps, as counted by [`retained`]. Past it the rest
-/// are not listed: real comments stay far below, many small ones sharing one long string do not.
-const MAX_ANNOTATION_BYTES: usize = 64 << 20;
-
-/// Web-address text the link listing, and name, description and embedded-file key text the
-/// attachment listing, keep together. Many links or attachments can share one long string, which
-/// each would otherwise copy. Past it, a link to a web address lists as a URI action without its
-/// address, an attachment under its generic name without a description, and an embedded file whose
-/// key does not fit is not listed.
-const MAX_LINK_ATTACHMENT_TEXT_BYTES: usize = 16 << 20;
-
-/// The bytes a listed annotation keeps.
-fn retained(a: &Annotation) -> usize {
-    let text = [&a.author, &a.contents, &a.modified, &a.name, &a.in_reply_to, &a.state, &a.intent];
-    text.into_iter()
-        .map(|t| t.as_ref().map_or(0, String::len))
-        .chain([
-            a.subtype.len(),
-            std::mem::size_of_val(a.quads.as_slice()),
-            std::mem::size_of_val(a.points.as_slice()),
-            std::mem::size_of::<Annotation>(),
-        ])
-        .fold(0, usize::saturating_add)
-}
-
-/// At most this many layers are read from all of `/RBGroups` together.
-const MAX_LAYER_GROUP_ENTRIES: usize = 4096;
-
-/// `DocInfo::outline` holds the first this many bookmarks in outline order. Opening a document
-/// reads only this window; the rest are listed by page through `pdfcraft_organize`.
-const OUTLINE_WINDOW: usize = 10_000;
-
-/// Deepest level `DocInfo::outline` nests (the top level is 0); deeper bookmarks are left out.
-const OUTLINE_DEPTH: usize = 32;
-
-fn load_options(password: Option<&str>) -> LoadOptions {
-    LoadOptions { password: password.map(str::to_owned), max_decompressed_size: Some(LOAD_STREAM_LIMIT), ..LoadOptions::default() }
-}
+#[cfg(test)]
+use annotations::{MAX_ANNOTATION_BYTES, MAX_LINK_ATTACHMENT_TEXT_BYTES, MAX_REMOTE_FILE_SPEC_BYTES, retained};
+use core::Inspector;
+pub use core::{check_pages, inspect, pretty_date};
+#[cfg(test)]
+use core::{inspect_structure, spend};
+pub use model::{
+    Annotation, Attachment, AttachmentSource, DestView, Field, FieldKind, FontInfo, Layer, LayerOp, Link, LinkTarget, OutlineItem, PageInfo,
+    PageTransition, RemoteDestination, TransitionStyle, Xfa, link_replies, thread_tops,
+};
+#[cfg(test)]
+use navigation::{OUTLINE_DEPTH, OUTLINE_WINDOW};
+pub use resources::attachment_data;
+#[cfg(test)]
+use resources::{xfa_config_dynamic_render, xfa_packet_text};
 
 #[derive(Clone, Debug, Default)]
 pub struct DocInfo {
@@ -110,4007 +78,12 @@ pub struct DocInfo {
     pub attachments: Vec<Attachment>,
     /// Pages with a presentation transition (`/Trans`) or display time (`/Dur`), in page order.
     pub transitions: Vec<PageTransition>,
+    /// Where the document opens (`/OpenAction`): the (0-based page, view) of its destination,
+    /// named destinations resolved. `None` without one, for an action that goes nowhere in this
+    /// document (a script, say), or for one that doesn't resolve to a page of it.
+    pub open_dest: Option<(usize, DestView)>,
     pub warnings: Vec<String>,
 }
 
-/// What kind of XFA form a document has (`/AcroForm /XFA`).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Xfa {
-    /// The pages and fields are ordinary PDF; the XFA packets describe the same form (and hold
-    /// its data, which Acrobat shows in preference to the fields).
-    Static,
-    /// The form is laid out from the XFA packets at open (`/NeedsRendering`, or no fields and a
-    /// configuration that doesn't forbid dynamic rendering): the PDF pages are only a placeholder.
-    Dynamic,
-}
-
-/// A page's presentation transition and display time (ISO 32000-2 §12.4.4): how the page comes
-/// into view in a full-screen presentation, and how long it stays before advancing. Only pages
-/// carrying `/Trans` or `/Dur` are listed. Values outside the spec's ranges fall back to the
-/// defaults rather than being refused.
-#[derive(Clone, Debug, PartialEq)]
-pub struct PageTransition {
-    pub page: usize,
-    /// `/Trans /S`; `None` when the page has only `/Dur`.
-    pub style: Option<TransitionStyle>,
-    /// `/D`: how long the transition takes, in seconds (default 1).
-    pub duration: f32,
-    /// `/Dm /H` (true) or `/V` (Split, Blinds).
-    pub horizontal: bool,
-    /// `/M /I` (true) or `/O` (Split, Box, Fly).
-    pub inward: bool,
-    /// `/Di`: 0, 90, 180, 270 or 315 degrees (Wipe, Glitter, Fly, Cover, Uncover, Push); `None`
-    /// for `/None` (Fly only).
-    pub direction: Option<u16>,
-    /// `/SS`: the Fly scale (default 1).
-    pub scale: f32,
-    /// `/B`: Fly with an opaque backdrop.
-    pub opaque: bool,
-    /// `/Dur`: seconds the page shows before the presentation advances; `None` waits for the
-    /// presenter.
-    pub display: Option<f32>,
-}
-
-/// The transition styles of ISO 32000-2 table 164 (`/Trans /S`).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum TransitionStyle {
-    Split,
-    Blinds,
-    Box,
-    Wipe,
-    Dissolve,
-    Glitter,
-    /// `/R`: the next page replaces the old one with no effect (the default).
-    Replace,
-    Fly,
-    Push,
-    Cover,
-    Uncover,
-    Fade,
-}
-
-impl TransitionStyle {
-    /// The style a `/S` name means; an unknown name is `Replace`, the spec's default.
-    pub fn from_name(name: &str) -> Self {
-        match name {
-            "Split" => Self::Split,
-            "Blinds" => Self::Blinds,
-            "Box" => Self::Box,
-            "Wipe" => Self::Wipe,
-            "Dissolve" => Self::Dissolve,
-            "Glitter" => Self::Glitter,
-            "Fly" => Self::Fly,
-            "Push" => Self::Push,
-            "Cover" => Self::Cover,
-            "Uncover" => Self::Uncover,
-            "Fade" => Self::Fade,
-            _ => Self::Replace,
-        }
-    }
-
-    /// The name as written in a PDF (`/S`).
-    pub fn name(self) -> &'static str {
-        match self {
-            Self::Split => "Split",
-            Self::Blinds => "Blinds",
-            Self::Box => "Box",
-            Self::Wipe => "Wipe",
-            Self::Dissolve => "Dissolve",
-            Self::Glitter => "Glitter",
-            Self::Replace => "R",
-            Self::Fly => "Fly",
-            Self::Push => "Push",
-            Self::Cover => "Cover",
-            Self::Uncover => "Uncover",
-            Self::Fade => "Fade",
-        }
-    }
-}
-
-#[derive(Clone, Debug)]
-pub struct PageInfo {
-    /// Displayed size in points, after `/Rotate` and `/UserUnit`.
-    pub width: f32,
-    pub height: f32,
-    /// Page label (`/PageLabels`), falling back to the 1-based page number.
-    pub label: String,
-    /// Effective crop box in user space [x0, y0, x1, y1] (the visible region).
-    pub crop: [f32; 4],
-    /// Clockwise page rotation in degrees (0, 90, 180, 270).
-    pub rotation: u16,
-}
-
-impl PageInfo {
-    /// A point in view space (points, y down, after `/Rotate`; what the text layer uses) →
-    /// PDF user space.
-    pub fn view_to_user(&self, x: f32, y: f32) -> [f32; 2] {
-        let [cx0, cy0, cx1, cy1] = self.crop;
-        let (a, b) = (x / self.width.max(1e-3), y / self.height.max(1e-3));
-        let (u, v) = match self.rotation {
-            90 => (b, 1.0 - a),
-            180 => (1.0 - a, 1.0 - b),
-            270 => (1.0 - b, a),
-            _ => (a, b),
-        };
-        [cx0 + u * (cx1 - cx0), cy1 - v * (cy1 - cy0)]
-    }
-
-    /// PDF user space → view space (the inverse of [`Self::view_to_user`]).
-    pub fn user_to_view(&self, x: f32, y: f32) -> [f32; 2] {
-        let [cx0, cy0, cx1, cy1] = self.crop;
-        let (u, v) = ((x - cx0) / (cx1 - cx0).max(1e-3), (cy1 - y) / (cy1 - cy0).max(1e-3));
-        let (a, b) = match self.rotation {
-            90 => (1.0 - v, u),
-            180 => (1.0 - u, 1.0 - v),
-            270 => (v, 1.0 - u),
-            _ => (u, v),
-        };
-        [a * self.width, b * self.height]
-    }
-
-    /// A point as displayed (points from the page's top-left, y down, before any view rotation)
-    /// → the `/XYZ` position `[left, top]` in user space that puts it at the window's top-left.
-    /// Only a coordinate that is given is pinned: a bookmark made at the top of the window
-    /// leaves the horizontal position alone. On a page turned a quarter, the displayed `y` decides
-    /// the user `left` and the displayed `x` the user `top` (the inverse of [`Self::dest_fraction`]).
-    /// A value that is not finite counts as not given.
-    pub fn xyz_for_view(&self, x: Option<f32>, y: Option<f32>) -> [Option<f32>; 2] {
-        let (x, y) = (x.filter(|v| v.is_finite()), y.filter(|v| v.is_finite()));
-        let [ux, uy] = self.view_to_user(x.unwrap_or(0.0), y.unwrap_or(0.0));
-        if self.rotation.is_multiple_of(180) { [x.map(|_| ux), y.map(|_| uy)] } else { [y.map(|_| ux), x.map(|_| uy)] }
-    }
-
-    /// A destination's user-space point (each coordinate possibly unspecified) → the same point
-    /// as a fraction of the displayed page `[x, y]` (0..1 from its top-left corner, y down),
-    /// after `/Rotate` and a further clockwise `view_rotation` (0, 90, 180 or 270). On a page
-    /// turned a quarter, the user `x` decides the displayed `y` and vice versa, so each output
-    /// is `None` when the input it comes from is (or is not finite). Points off the page are
-    /// clamped to its edge.
-    pub fn dest_fraction(&self, x: Option<f32>, y: Option<f32>, view_rotation: u16) -> [Option<f32>; 2] {
-        let [cx0, cy0, cx1, cy1] = self.crop;
-        let frac = |v: f32| if v.is_finite() { Some(v.clamp(0.0, 1.0)) } else { None };
-        // Unrotated fractions across (u, from the crop's left) and down (v, from its top).
-        let u = x.and_then(|x| frac((x - cx0) / (cx1 - cx0).max(1e-3)));
-        let v = y.and_then(|y| frac((cy1 - y) / (cy1 - cy0).max(1e-3)));
-        let flip = |f: Option<f32>| f.map(|f| 1.0 - f);
-        match (u32::from(self.rotation) + u32::from(view_rotation)) % 360 {
-            90 => [flip(v), u],
-            180 => [flip(u), flip(v)],
-            270 => [v, flip(u)],
-            _ => [u, v],
-        }
-    }
-
-    /// A view-space rectangle → the normalized user-space rectangle covering the same area of the
-    /// page (`[x0, y0, x1, y1]`, `x0 <= x1`, `y0 <= y1`). Under `/Rotate` the corners swap roles,
-    /// so a view rectangle's top-left is not in general the user rectangle's `[x0, y1]`.
-    pub fn view_rect_to_user(&self, r: [f32; 4]) -> [f32; 4] {
-        let (a, b) = (self.view_to_user(r[0], r[1]), self.view_to_user(r[2], r[3]));
-        [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
-    }
-
-    /// A view-space rectangle as a text-markup quad in user space: top-left, top-right,
-    /// bottom-left, bottom-right as read on screen.
-    pub fn view_rect_to_quad(&self, r: [f32; 4]) -> [f64; 8] {
-        let mut q = [0.0; 8];
-        for (i, (x, y)) in [(r[0], r[1]), (r[2], r[1]), (r[0], r[3]), (r[2], r[3])].into_iter().enumerate() {
-            let [ux, uy] = self.view_to_user(x, y);
-            q[2 * i] = ux as f64;
-            q[2 * i + 1] = uy as f64;
-        }
-        q
-    }
-}
-
-/// A clickable link annotation.
-#[derive(Clone, Debug)]
-pub struct Link {
-    pub page: usize,
-    /// Zero-based position in the page's raw `/Annots` array.
-    pub index: usize,
-    pub rect: [f32; 4],
-    pub target: LinkTarget,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub enum LinkTarget {
-    /// A destination in this document: the 0-based page and where on it the view goes.
-    Page(usize, DestView),
-    Uri(String),
-    /// A set-layer-visibility action (`SetOCGState`, ISO 32000-2 §12.6.4.13): each change in
-    /// order, naming the layer by its optional content group. With `preserve_rb`, a layer turned
-    /// on turns off the other layers of its radio-button groups.
-    SetLayers {
-        changes: Vec<(LayerOp, (u32, u16))>,
-        preserve_rb: bool,
-    },
-    /// A local-file remote Go-To action. The caller resolves `file` relative to the source path.
-    /// `launch` marks a Launch action that names a PDF file (see `launch_pdf`), opened the same
-    /// way: as a document in PdfCraft, never by the operating system.
-    RemoteGoTo {
-        launch: bool,
-        file: String,
-        destination: RemoteDestination,
-        new_window: Option<bool>,
-    },
-    Other(String),
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub enum RemoteDestination {
-    Default,
-    Page { page: usize, view: DestView },
-    Named(String),
-}
-
-/// What a set-layer-visibility action does to a layer.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum LayerOp {
-    On,
-    Off,
-    Toggle,
-}
-
-/// Where an explicit destination (ISO 32000-2 §12.3.2.2, Table 149) places its page in the
-/// window. Coordinates are PDF user space; `None` is a `null` (or unusable) operand, which keeps
-/// that part of the view as it is.
-#[derive(Clone, Copy, Debug, Default, PartialEq)]
-pub enum DestView {
-    /// The top of the page at the current zoom: a destination with no position, or one whose
-    /// type is missing or unknown.
-    #[default]
-    Top,
-    /// `/XYZ left top zoom`: the point (left, top) at the window's upper-left corner, at `zoom`
-    /// (1.0 = 100%; 0 or null keeps the current zoom).
-    Xyz { left: Option<f32>, top: Option<f32>, zoom: Option<f32> },
-    /// `/Fit`, and `/FitB` (fit the page's content box; read as the whole page).
-    Fit,
-    /// `/FitH top`, and `/FitBH`: fit the width, with `top` at the window's top edge.
-    FitH { top: Option<f32> },
-    /// `/FitV left`, and `/FitBV`: fit the height, with `left` at the window's left edge.
-    FitV { left: Option<f32> },
-    /// `/FitR left bottom right top`: fit the rectangle `[x0, y0, x1, y1]` (normalized).
-    FitR { rect: [f32; 4] },
-}
-
-impl DestView {
-    /// The view an explicit destination array asks for, from its elements after the page
-    /// (`/XYZ left top zoom`, `/FitH top`, …). Hostile input never fails: a missing or unknown
-    /// type, or a `/FitR` without four usable numbers, is [`DestView::Top`]; a non-numeric,
-    /// non-finite or missing operand is `None`; a zoom that is not positive is `None`.
-    pub fn from_operands(kind: Option<&[u8]>, operands: &[Option<f32>]) -> Self {
-        let n = |i: usize| operands.get(i).copied().flatten().filter(|v| v.is_finite());
-        match kind {
-            Some(b"XYZ") => Self::Xyz { left: n(0), top: n(1), zoom: n(2).filter(|z| *z > 0.0) },
-            Some(b"Fit" | b"FitB") => Self::Fit,
-            Some(b"FitH" | b"FitBH") => Self::FitH { top: n(0) },
-            Some(b"FitV" | b"FitBV") => Self::FitV { left: n(0) },
-            Some(b"FitR") => match (n(0), n(1), n(2), n(3)) {
-                (Some(x0), Some(y0), Some(x1), Some(y1)) => Self::FitR { rect: [x0.min(x1), y0.min(y1), x0.max(x1), y0.max(y1)] },
-                _ => Self::Top,
-            },
-            _ => Self::Top,
-        }
-    }
-}
-
-#[derive(Clone, Debug)]
-pub struct OutlineItem {
-    pub title: String,
-    pub page: Option<usize>,
-    /// Where on `page` the bookmark goes ([`DestView::Top`] for a bookmark without a page).
-    pub view: DestView,
-    pub children: Vec<OutlineItem>,
-    pub open: bool,
-    /// The title's colour (`/C`, DeviceRGB, ISO 32000-2 §12.3.3 Table 151), or `None` for the
-    /// default black or a value that isn't three numbers.
-    pub color: Option<[f32; 3]>,
-    /// The title's style (`/F`, Table 152): bit 1 italic, bit 2 bold.
-    pub italic: bool,
-    pub bold: bool,
-}
-
-#[derive(Clone, Debug)]
-pub struct Annotation {
-    pub page: usize,
-    pub subtype: String,
-    pub author: Option<String>,
-    pub contents: Option<String>,
-    pub modified: Option<String>,
-    /// `/NM` of this annotation, and of the one it replies to (`/IRT`), for threading.
-    pub name: Option<String>,
-    pub in_reply_to: Option<String>,
-    /// Rect in PDF user space: [x0, y0, x1, y1].
-    pub rect: [f32; 4],
-    pub color: Option<[f32; 3]>,
-    /// Position in the page's `/Annots` (how edits address the comment).
-    pub index: usize,
-    /// For a status reply (`/State`, Acrobat's "Set status"): the state it sets.
-    pub state: Option<String>,
-    /// Text markup quadrilaterals (`/QuadPoints`), 8 numbers each.
-    pub quads: Vec<[f32; 8]>,
-    /// The Locked flag (`/F` bit 8): the comment can't be moved, resized, restyled or deleted.
-    pub locked: bool,
-    /// `/IT`, the intent: `FreeTextCallout`, `PolygonCloud`, `FreeTextTypeWriter`…
-    pub intent: Option<String>,
-    /// A Fill & Sign mark: typed text, a check, cross, dot or line, or a typed, drawn or picture
-    /// signature or initials (the rules of `pdfcraft_annot::is_fill_sign`).
-    pub fill_sign: bool,
-    /// The NoRotate flag (`/F` bit 5), set on sticky notes and attachments: on a turned page the
-    /// appearance stays upright, turned about the upper-left corner of `rect`
-    /// ([`Self::shown_rect`]).
-    pub no_rotate: bool,
-    /// The points that shape a line (its two ends, `/L`) or connected lines, a polygon or a
-    /// cloud (their corners, `/Vertices`), in user space; empty for other comments.
-    pub points: Vec<[f32; 2]>,
-}
-
-impl Annotation {
-    /// A checkmark reply (`/StateModel /Marked`): "Marked" or "Unmarked" rather than a review status.
-    pub fn is_mark(&self) -> bool {
-        matches!(self.state.as_deref(), Some("Marked" | "Unmarked"))
-    }
-
-    /// Where the comment is drawn on a page turned by `rotation` (`PageInfo::rotation`), in user
-    /// space: `rect`, or for a NoRotate comment `rect` turned upright about its upper-left corner
-    /// (see [`Self::no_rotate`]). Hit-testing, selection and anything placed beside the comment
-    /// use this, so they match the drawing.
-    pub fn shown_rect(&self, rotation: u16) -> [f32; 4] {
-        self.shown(self.rect.map(f64::from), rotation).map(|v| v as f32)
-    }
-
-    /// [`Self::shown_rect`] for this comment with its `/Rect` at `rect` (one being moved or
-    /// resized).
-    pub fn shown(&self, rect: [f64; 4], rotation: u16) -> [f64; 4] {
-        if self.no_rotate { upright_rect(rect, rotation) } else { rect }
-    }
-
-    /// The `/Rect` that shows this comment in the user-space box `shown`: the inverse of
-    /// [`Self::shown`], for a box resized as drawn.
-    pub fn rect_for_shown(&self, shown: [f64; 4], rotation: u16) -> [f64; 4] {
-        if self.no_rotate { rect_from_upright(shown, rotation) } else { shown }
-    }
-}
-
-/// The user-space box a NoRotate annotation with `/Rect` `rect` is drawn in on a page turned
-/// clockwise by `rotation` (ISO 32000-2 §12.5.3): `rect` turned as far counterclockwise about its
-/// upper-left corner `(x0, y1)`, which stays where it is on the page. As displayed, the box's
-/// top-left is that corner, the rectangle's width runs across and its height down, as on an
-/// unturned page. `rect` itself for 0 or anything that isn't a quarter turn. The vendored
-/// renderer draws the appearance there (hayro-interpret patch 37).
-fn upright_rect(rect: [f64; 4], rotation: u16) -> [f64; 4] {
-    let [x0, y0, x1, y1] = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
-    let (w, h) = (x1 - x0, y1 - y0);
-    match rotation {
-        90 => [x0, y1, x0 + h, y1 + w],
-        180 => [x0 - w, y1, x0, y1 + h],
-        270 => [x0 - h, y1 - w, x0, y1],
-        _ => [x0, y0, x1, y1],
-    }
-}
-
-/// The `/Rect` whose [`upright_rect`] is `shown`: `shown` turned back about the corner that
-/// stays put.
-fn rect_from_upright(shown: [f64; 4], rotation: u16) -> [f64; 4] {
-    let [s0, s1, s2, s3] = [shown[0].min(shown[2]), shown[1].min(shown[3]), shown[0].max(shown[2]), shown[1].max(shown[3])];
-    let (sw, sh) = (s2 - s0, s3 - s1);
-    // The upper-left corner of `/Rect` and the rectangle's width and height.
-    let ((x0, y1), w, h) = match rotation {
-        90 => ((s0, s1), sh, sw),
-        180 => ((s2, s1), sw, sh),
-        270 => ((s2, s3), sh, sw),
-        _ => return [s0, s1, s2, s3],
-    };
-    [x0, y1 - h, x0 + w, y1]
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum FieldKind {
-    Text,
-    CheckBox,
-    Radio,
-    PushButton,
-    Combo,
-    List,
-    Signature,
-    Unknown,
-}
-
-#[derive(Clone, Debug)]
-pub struct Field {
-    pub name: String,
-    pub kind: FieldKind,
-    pub value: Option<String>,
-    pub page: Option<usize>,
-    pub tooltip: Option<String>,
-    pub has_actions: bool,
-    /// Rect of the first widget, in user space.
-    pub rect: Option<[f32; 4]>,
-}
-
-#[derive(Clone, Debug)]
-pub struct Layer {
-    /// Object number and generation of the optional content group.
-    pub id: (u32, u16),
-    pub name: String,
-    pub visible: bool,
-    /// Shown as the file opens: the default configuration (`/OCProperties /D`).
-    pub initial: bool,
-}
-
-#[derive(Clone, Debug)]
-pub struct Attachment {
-    pub name: String,
-    pub description: Option<String>,
-    pub size: Option<usize>,
-    pub source: AttachmentSource,
-}
-
-/// Where an attachment lives (so its bytes can be fetched on demand).
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum AttachmentSource {
-    /// Document-level: `/Names /EmbeddedFiles` entry with this key.
-    Document { key: String },
-    /// A FileAttachment annotation: page index and position in the page's `/Annots`.
-    Annotation { page: usize, index: usize },
-}
-
-/// A font used by the document (Document Properties ▸ Fonts).
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct FontInfo {
-    /// BaseFont without the subset tag.
-    pub name: String,
-    /// Type1, TrueType, Type0, Type3, MMType1, CIDFontType0/2 …
-    pub kind: String,
-    pub embedded: bool,
-    pub subset: bool,
-    pub encoding: Option<String>,
-    /// The face standing in for a program the document does not embed. `None` when the font is
-    /// embedded (nothing stands in) or when no face was available at all -- `substitution` then
-    /// says which of the two it is.
-    pub substitute: Option<String>,
-    /// Why a face was substituted, as a sentence for whoever has to act on it. `None` only when
-    /// the document's own glyphs are being shown.
-    pub substitution: Option<String>,
-}
-
-/// Check that `bytes` still open as the same document: the parser reads them and the page
-/// count matches. Content-only edits skip the full [`inspect`] (seconds on very large files)
-/// but must still catch an edit that produced something the viewer cannot display, so the
-/// caller can roll it back. Never panics: parser crashes are caught and reported.
-pub fn check_pages(bytes: Arc<Vec<u8>>, password: Option<&str>, expected: usize) -> Result<(), OpenError> {
-    let pdf = catch_unwind(AssertUnwindSafe(|| Pdf::new_with_password(bytes, password.unwrap_or(""))))
-        .map_err(|p| OpenError::Invalid(format!("the parser crashed: {}", crate::raster::panic_message(&p))))?
-        .map_err(|e| match e {
-            LoadPdfError::Decryption(DecryptionError::PasswordProtected) => {
-                if password.is_some() {
-                    OpenError::WrongPassword
-                } else {
-                    OpenError::NeedsPassword
-                }
-            }
-            LoadPdfError::Decryption(other) => OpenError::Unsupported(format!("encryption not supported: {other:?}")),
-            LoadPdfError::Invalid => OpenError::Invalid("no readable page tree or cross-reference data was found".into()),
-        })?;
-    let pages = catch_unwind(AssertUnwindSafe(|| pdf.pages().len()))
-        .map_err(|p| OpenError::Invalid(format!("the page tree could not be read: {}", crate::raster::panic_message(&p))))?;
-    if pages != expected {
-        return Err(OpenError::Invalid(format!("the edit changed the page count from {expected} to {pages}")));
-    }
-    Ok(())
-}
-
-/// Inspect a document. Fails only if the renderer itself cannot open the file (or needs a
-/// password). Never panics: parser crashes are caught and reported.
-pub fn inspect(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Result<DocInfo, OpenError> {
-    let pdf = catch_unwind(AssertUnwindSafe(|| Pdf::new_with_password(bytes.clone(), password.unwrap_or(""))))
-        .map_err(|p| OpenError::Invalid(format!("the parser crashed: {}", crate::raster::panic_message(&p))))?
-        .map_err(|e| match e {
-            LoadPdfError::Decryption(DecryptionError::PasswordProtected) => {
-                if password.is_some() {
-                    OpenError::WrongPassword
-                } else {
-                    OpenError::NeedsPassword
-                }
-            }
-            LoadPdfError::Decryption(other) => OpenError::Unsupported(format!("encryption not supported: {other:?}")),
-            LoadPdfError::Invalid => OpenError::Invalid("no readable page tree or cross-reference data was found".into()),
-        })?;
-    let mut info = DocInfo { file_size: bytes.len(), pdf_version: version_label(&format!("{:?}", pdf.version())), ..Default::default() };
-    let pages = catch_unwind(AssertUnwindSafe(|| {
-        let mut out = Vec::new();
-        for (i, page) in pdf.pages().iter().enumerate() {
-            let (w, h) = page.render_dimensions();
-            let c = page.intersected_crop_box();
-            let rotation = match page.rotation() {
-                hayro::hayro_syntax::page::Rotation::None => 0,
-                hayro::hayro_syntax::page::Rotation::Horizontal => 90,
-                hayro::hayro_syntax::page::Rotation::Flipped => 180,
-                hayro::hayro_syntax::page::Rotation::FlippedHorizontal => 270,
-            };
-            let crop = [c.x0 as f32, c.y0 as f32, c.x1 as f32, c.y1 as f32];
-            // Degenerate boxes still get a usable placeholder size so layout never divides by zero.
-            let (w, h) = if w.is_finite() && h.is_finite() && w >= 1.0 && h >= 1.0 { (w, h) } else { (612.0, 792.0) };
-            out.push(PageInfo { width: w, height: h, label: (i + 1).to_string(), crop, rotation });
-        }
-        out
-    }));
-    match pages {
-        Ok(p) => info.pages = p,
-        Err(p) => return Err(OpenError::Invalid(format!("the page tree could not be read: {}", crate::raster::panic_message(&p)))),
-    }
-    let options = load_options(password);
-    // Geometry no longer needs the renderer parser. Do not overlap its allocations with
-    // structural inspection, including the compatibility fallback for damaged files.
-    drop(pdf);
-    inspect_structure(&mut info, |tmp| {
-        // The lazy reader first; lopdf's repair/tolerance path when it can't expose the same
-        // page tree or an object a panel needs. No partial result is published.
-        let lazy = catch_unwind(AssertUnwindSafe(|| {
-            let doc = LazyStructure::new(bytes.clone(), password).ok()?;
-            let mut t = DocInfo { pages: tmp.pages.clone(), ..Default::default() };
-            let inspector = Inspector::new(&doc);
-            if inspector.page_index.len() != t.pages.len() {
-                return None;
-            }
-            inspector.fill(&mut t);
-            (!doc.failed()).then_some(t)
-        }))
-        .ok()
-        .flatten();
-        if let Some(t) = lazy {
-            *tmp = t;
-            return Ok(());
-        }
-        let doc = Document::load_mem_with_options(&bytes, options).map_err(|e| e.to_string())?;
-        Inspector::new(&doc).fill(tmp);
-        Ok(())
-    });
-    if info.pages.is_empty() {
-        return Err(OpenError::Invalid("the document has no pages".into()));
-    }
-    Ok(info)
-}
-
-// Commit auxiliary metadata only after inspection succeeds; renderer geometry is the fallback.
-fn inspect_structure(info: &mut DocInfo, fill: impl FnOnce(&mut DocInfo) -> Result<(), String>) {
-    let structure = catch_unwind(AssertUnwindSafe(|| {
-        let mut tmp = DocInfo { pages: info.pages.clone(), ..Default::default() };
-        fill(&mut tmp)?;
-        Ok::<_, String>(tmp)
-    }));
-    match structure {
-        Ok(Ok(mut filled)) => {
-            filled.file_size = info.file_size;
-            filled.pdf_version = std::mem::take(&mut info.pdf_version);
-            *info = filled;
-        }
-        Ok(Err(e)) => info.warnings.push(format!("Some document structure (bookmarks, comments, fields) could not be read: {e}")),
-        Err(p) => {
-            info.warnings.push(format!("Document structure inspection crashed and was skipped: {}", crate::raster::panic_message(&p)));
-        }
-    }
-}
-
-struct Inspector<'a> {
-    doc: &'a dyn Structure,
-    page_ids: Vec<ObjectId>,
-    page_index: HashMap<ObjectId, usize>,
-    /// Named destinations (`/Names /Dests` tree), keyed by raw string bytes, built once.
-    /// Looking each name up by walking the tree was O(links × names): minutes on manuals.
-    named: HashMap<Vec<u8>, &'a Object>,
-    /// The page of each annotation (the first page that lists it), built when a field's widget
-    /// has no `/P`. Searching every page's `/Annots` for each such field was O(fields ×
-    /// annotations): a second on a form of 8,000 fields.
-    annotation_pages: OnceCell<HashMap<ObjectId, usize>>,
-}
-
-impl<'a> Inspector<'a> {
-    fn new(doc: &'a dyn Structure) -> Self {
-        let page_ids = doc.page_ids();
-        let page_index = page_ids.iter().copied().enumerate().map(|(index, id)| (id, index)).collect();
-        let mut me = Self { doc, page_ids, page_index, named: HashMap::new(), annotation_pages: OnceCell::new() };
-        let mut named = HashMap::new();
-        if let Some(tree) =
-            doc.catalog().ok().and_then(|c| c.get(b"Names").ok()).and_then(|o| me.dict(o)).and_then(|n| n.get(b"Dests").ok()).and_then(|o| me.dict(o))
-        {
-            me.name_tree_raw(tree, &mut HashSet::new(), 0, &mut named);
-        }
-        me.named = named;
-        me
-    }
-
-    fn fill(&self, info: &mut DocInfo) {
-        // lopdf drops /Encrypt from the trailer once it has decrypted the file.
-        info.encrypted = self.doc.encrypted();
-        if let Some(d) = self.doc.trailer().get(b"Info").ok().and_then(|o| self.dict(o)) {
-            info.title = self.text(d, b"Title");
-            info.author = self.text(d, b"Author");
-            info.subject = self.text(d, b"Subject");
-            info.keywords = self.text(d, b"Keywords");
-            info.creator = self.text(d, b"Creator");
-            info.producer = self.text(d, b"Producer");
-            const STANDARD: [&[u8]; 9] =
-                [b"Title", b"Author", b"Subject", b"Keywords", b"Creator", b"Producer", b"CreationDate", b"ModDate", b"Trapped"];
-            // The same rule as the engine's list after an edit (`pdfcraft_organize::custom_info`,
-            // trimmed and without empty values): text strings only, so a name value is not a
-            // custom property, and the cap counts listed entries.
-            info.custom = d
-                .iter()
-                .filter(|(k, _)| !STANDARD.contains(&k.as_slice()))
-                .filter_map(|(k, v)| match self.resolve(v) {
-                    Object::String(bytes, _) => {
-                        let v = text_string(bytes).trim_matches(|c: char| c == '\0' || c.is_whitespace()).to_string();
-                        (!v.is_empty()).then(|| (String::from_utf8_lossy(k).into_owned(), v))
-                    }
-                    _ => None,
-                })
-                .take(256)
-                .collect();
-        }
-        let Ok(catalog) = self.doc.catalog() else { return };
-        info.tagged = catalog
-            .get(b"MarkInfo")
-            .ok()
-            .and_then(|o| self.dict(o))
-            .and_then(|m| m.get(b"Marked").ok())
-            // Any value may be written as an indirect reference, `/Marked 9 0 R` included, so the
-            // flag is resolved before it is read as a boolean (#3671).
-            .map(|o| self.resolve(o))
-            .and_then(|o| o.as_bool().ok())
-            .unwrap_or(false);
-        match self.page_labels(catalog, &mut info.pages) {
-            Ok(notes) => info.warnings.extend(notes.into_iter().map(|note| format!("Page labels: {note}."))),
-            Err(reason) => info.warnings.push(format!("Page labels were skipped: {reason}; using physical page numbers.")),
-        }
-        if let Some(first) = catalog.get(b"Outlines").ok().and_then(|o| self.dict(o)).and_then(|d| d.get(b"First").ok()) {
-            (info.outline, info.outline_more) = self.outline_window(first);
-        }
-        let mut text_budget = MAX_LINK_ATTACHMENT_TEXT_BYTES;
-        self.annotations(info, &mut text_budget);
-        self.transitions(info);
-        let mut field_seen = HashSet::new();
-        if let Some(form) = catalog.get(b"AcroForm").ok().and_then(|o| self.dict(o))
-            && let Ok(fields) = form.get(b"Fields").and_then(|o| self.resolve(o).as_array())
-        {
-            for f in fields {
-                self.field(f, None, &mut info.fields, &mut field_seen, 0);
-            }
-        }
-        // Widgets no `/Fields` entry reaches are fields too (Acrobat and the browsers fill them);
-        // each is adopted through its topmost unlisted `/Parent`, so a split field stays one.
-        for &pid in &self.page_ids {
-            let Ok(page_dict) = self.doc.get_dictionary(pid) else { continue };
-            let Ok(Object::Array(annots)) = page_dict.get(b"Annots").map(|o| self.resolve(o)) else { continue };
-            for a in annots {
-                let Some(d) = self.dict(a) else { continue };
-                if self.name(d, b"Subtype").as_deref() != Some("Widget")
-                    || (d.get(b"FT").is_err() && d.get(b"T").is_err() && d.get(b"Parent").is_err())
-                {
-                    continue;
-                }
-                if let Object::Reference(id) = a
-                    && let Some(root) = self.unlisted_field(*id, &field_seen)
-                {
-                    self.field(&Object::Reference(root), None, &mut info.fields, &mut field_seen, 0);
-                }
-            }
-        }
-        info.has_javascript |= info.fields.iter().any(|f| f.has_actions);
-        let needs_rendering = catalog.get(b"NeedsRendering").ok().and_then(|o| self.resolve(o).as_bool().ok()).unwrap_or(false);
-        if let Some(xfa) = catalog.get(b"AcroForm").ok().and_then(|o| self.dict(o)).and_then(|form| form.get(b"XFA").ok()) {
-            // A form with no fields is taken to be laid out from its template, unless its
-            // configuration says it is a static form (#3180): Designer writes
-            // `<dynamicRender>forbidden</dynamicRender>` for one, whose pages are the form.
-            let static_form = self.xfa_dynamic_render(xfa).as_deref() == Some("forbidden");
-            info.xfa = Some(if needs_rendering || (info.fields.is_empty() && !static_form) { Xfa::Dynamic } else { Xfa::Static });
-        }
-        self.layers(catalog, &mut info.layers);
-        info.layer_groups = self.layer_groups(catalog);
-        self.fonts(&mut info.fonts);
-        if let Some(names) = catalog.get(b"Names").ok().and_then(|o| self.dict(o)) {
-            if let Some(ef) = names.get(b"EmbeddedFiles").ok().and_then(|o| self.dict(o)) {
-                let mut seen = HashSet::new();
-                for (name, spec) in self.name_tree(ef, &mut seen, 0, &mut text_budget) {
-                    // The key is kept a second time when it is also the name.
-                    let fallback = |budget: &mut usize| spend(name.as_bytes(), budget, |_| name.clone());
-                    info.attachments.push(self.attachment(spec, AttachmentSource::Document { key: name.clone() }, &mut text_budget, fallback));
-                }
-            }
-            info.has_javascript |= names.get(b"JavaScript").is_ok();
-        }
-        if let Ok(action) = catalog.get(b"OpenAction")
-            && let Some(dict) = self.dict(action)
-            && dict.get(b"S").ok().and_then(|o| self.resolve(o).as_name().ok()) == Some(&b"JavaScript"[..])
-        {
-            info.has_javascript = true;
-        }
-    }
-
-    // ── object helpers ──────────────────────────────────────────────────────────────────────
-
-    /// `/Trans` and `/Dur` of every page (ISO 32000-2 §12.4.4), in page order. Lenient: a value
-    /// outside the spec's choices takes that entry's default, and a page with neither entry is
-    /// not listed. Bounded by the page count.
-    fn transitions(&self, info: &mut DocInfo) {
-        for (page, &pid) in self.page_ids.iter().enumerate() {
-            let Ok(d) = self.doc.get_dictionary(pid) else { continue };
-            let display = d.get(b"Dur").ok().and_then(|o| self.resolve(o).as_float().ok()).filter(|s| s.is_finite() && *s >= 0.0);
-            let trans = d.get(b"Trans").ok().and_then(|o| self.dict(o));
-            if trans.is_none() && display.is_none() {
-                continue;
-            }
-            let mut t = PageTransition {
-                page,
-                style: None,
-                duration: 1.0,
-                horizontal: true,
-                inward: true,
-                direction: Some(0),
-                scale: 1.0,
-                opaque: false,
-                display,
-            };
-            if let Some(tr) = trans {
-                t.style = Some(self.name(tr, b"S").map_or(TransitionStyle::Replace, |n| TransitionStyle::from_name(&n)));
-                let num = |key: &[u8]| tr.get(key).ok().and_then(|o| self.resolve(o).as_float().ok()).filter(|v| v.is_finite());
-                t.duration = num(b"D").filter(|d| *d >= 0.0).unwrap_or(1.0);
-                t.horizontal = self.name(tr, b"Dm").as_deref() != Some("V");
-                t.inward = self.name(tr, b"M").as_deref() != Some("O");
-                t.direction = match tr.get(b"Di").map(|o| self.resolve(o)) {
-                    Ok(Object::Name(n)) if n.as_slice() == b"None" => None,
-                    Ok(o) => match o.as_i64().ok() {
-                        Some(0) => Some(0),
-                        Some(90) => Some(90),
-                        Some(180) => Some(180),
-                        Some(270) => Some(270),
-                        Some(315) => Some(315),
-                        _ => Some(0),
-                    },
-                    Err(_) => Some(0),
-                };
-                t.scale = num(b"SS").filter(|s| *s > 0.0).unwrap_or(1.0);
-                t.opaque = matches!(tr.get(b"B").map(|o| self.resolve(o)), Ok(Object::Boolean(true)));
-            }
-            info.transitions.push(t);
-        }
-    }
-
-    /// The value of `dynamicRender` in an XFA form's configuration packet (`config`, under
-    /// `acrobat/acrobat7`): `required` for a dynamic form, `forbidden` for a static one. `/XFA` is
-    /// either one stream holding the whole XDP or an array of packet names and streams (ISO
-    /// 32000-1 §12.7.8). Lenient: `None` when the packet is missing, unreadable or over
-    /// `MAX_XFA_CONFIG_BYTES` decoded, or has no such element.
-    fn xfa_dynamic_render(&self, xfa: &'a Object) -> Option<String> {
-        let stream = match self.resolve(xfa) {
-            Object::Array(items) => {
-                let at = items.iter().position(|o| matches!(self.resolve(o), Object::String(name, _) if name.as_slice() == b"config"))?;
-                self.resolve(items.get(at.checked_add(1)?)?)
-            }
-            whole => whole,
-        };
-        let stream = stream.as_stream().ok()?;
-        let bytes = if stream.dict.get(b"Filter").is_ok() {
-            stream.decompressed_content_with_limit(MAX_XFA_CONFIG_BYTES).ok()?
-        } else {
-            stream.content.get(..stream.content.len().min(MAX_XFA_CONFIG_BYTES))?.to_vec()
-        };
-        xfa_config_dynamic_render(&xfa_packet_text(&bytes))
-    }
-
-    fn resolve(&self, o: &'a Object) -> &'a Object {
-        self.doc.dereference(o).map(|(_, o)| o).unwrap_or(o)
-    }
-
-    /// The object a reference ends at after following any chain of references; `None` for a
-    /// direct object or a broken reference.
-    fn resolved_id(&self, o: &Object) -> Option<ObjectId> {
-        self.doc.dereference(o).ok().and_then(|(id, _)| id)
-    }
-
-    fn dict(&self, o: &'a Object) -> Option<&'a Dictionary> {
-        match self.resolve(o) {
-            Object::Dictionary(d) => Some(d),
-            Object::Stream(s) => Some(&s.dict),
-            _ => None,
-        }
-    }
-
-    fn text(&self, d: &Dictionary, key: &[u8]) -> Option<String> {
-        let s = trimmed_text(self.resolve(d.get(key).ok()?))?;
-        (!s.is_empty()).then_some(s)
-    }
-
-    /// [`Self::text`], converted and spent from `budget` as [`spend`] does, so text that trims
-    /// short or to nothing still spends its raw length.
-    fn budgeted_text(&self, d: &Dictionary, key: &[u8], budget: &mut usize) -> Option<String> {
-        let o = self.resolve(d.get(key).ok()?);
-        let (Object::String(bytes, _) | Object::Name(bytes)) = o else { return None };
-        let text = spend(bytes, budget, |_| trimmed_text(o).unwrap_or_default())?;
-        (!text.is_empty()).then_some(text)
-    }
-
-    fn name(&self, d: &Dictionary, key: &[u8]) -> Option<String> {
-        self.resolve(d.get(key).ok()?).as_name().ok().map(|n| String::from_utf8_lossy(n).into_owned())
-    }
-
-    /// Whether an annotation is a Fill & Sign mark. Keep in step with
-    /// `pdfcraft_annot::is_fill_sign`, which the engine's comment list uses.
-    fn is_fill_sign(&self, d: &Dictionary, subtype: &str) -> bool {
-        let yes = |key: &[u8]| matches!(d.get(key).map(|o| self.resolve(o)), Ok(Object::Boolean(true)));
-        if yes(b"PCFillSign") {
-            return true;
-        }
-        match subtype {
-            "FreeText" => self.name(d, b"IT").as_deref() == Some("FreeTextTypeWriter"),
-            "Stamp" => match self.name(d, b"Name").as_deref() {
-                Some("PCCheck" | "PCCross" | "PCDot" | "PCLine" | "PCTypedSignature") => true,
-                Some("PCCustomSignature" | "PCCustomInitials") => yes(b"PCPictureImage"),
-                _ => false,
-            },
-            "Ink" => self.text(d, b"Subj").as_deref() == Some("Signature"),
-            _ => false,
-        }
-    }
-
-    fn page_of(&self, o: &Object) -> Option<usize> {
-        match o {
-            Object::Reference(id) => self.page_index.get(id).copied(),
-            // Some producers write page *numbers* in remote-style destinations.
-            Object::Integer(n) => usize::try_from(*n).ok(),
-            _ => None,
-        }
-    }
-
-    // ── destinations ────────────────────────────────────────────────────────────────────────
-
-    /// The page and view of a destination: an explicit array (`[page /XYZ left top zoom]`, …),
-    /// a dictionary with `/D`, or a named destination that resolves to one.
-    fn dest(&self, dest: &Object, depth: u32) -> Option<(usize, DestView)> {
-        if depth > 8 {
-            return None;
-        }
-        match self.resolve(dest) {
-            Object::Array(a) => {
-                let page = a.first().and_then(|p| self.page_of(p))?;
-                let kind = a.get(1).map(|k| self.resolve(k)).and_then(|k| k.as_name().ok());
-                let operands: Vec<Option<f32>> = a.iter().skip(2).take(4).map(|o| self.resolve(o).as_float().ok()).collect();
-                Some((page, DestView::from_operands(kind, &operands)))
-            }
-            Object::Dictionary(d) => d.get(b"D").ok().and_then(|d| self.dest(d, depth + 1)),
-            Object::String(key, _) | Object::Name(key) => self.named_dest(key).and_then(|d| self.dest(d, depth + 1)),
-            _ => None,
-        }
-    }
-
-    fn named_dest(&self, key: &[u8]) -> Option<&'a Object> {
-        let catalog = self.doc.catalog().ok()?;
-        if let Some(v) = self.named.get(key) {
-            return Some(v);
-        }
-        // PDF 1.1 style /Dests dictionary.
-        catalog.get(b"Dests").ok().and_then(|o| self.dict(o)).and_then(|d| d.get(key).ok())
-    }
-
-    /// A name tree's leaves keyed by their raw key bytes (first occurrence wins).
-    fn name_tree_raw(&self, node: &'a Dictionary, seen: &mut HashSet<*const Dictionary>, depth: u32, out: &mut HashMap<Vec<u8>, &'a Object>) {
-        if depth > 32 || !seen.insert(node as *const _) {
-            return;
-        }
-        if let Ok(Object::Array(pairs)) = node.get(b"Names").map(|o| self.resolve(o)) {
-            for pair in pairs.chunks(2) {
-                if let [k, v] = pair {
-                    let key = match self.resolve(k) {
-                        Object::String(s, _) => s.clone(),
-                        Object::Name(n) => n.clone(),
-                        _ => continue,
-                    };
-                    out.entry(key).or_insert(v);
-                }
-            }
-        }
-        if let Ok(Object::Array(kids)) = node.get(b"Kids").map(|o| self.resolve(o)) {
-            for k in kids {
-                if let Some(d) = self.dict(k) {
-                    self.name_tree_raw(d, seen, depth + 1, out);
-                }
-            }
-        }
-    }
-
-    /// The entries of an embedded-files name tree. Each string key is spent from `text_budget`
-    /// (see [`MAX_LINK_ATTACHMENT_TEXT_BYTES`]), and an entry whose key does not fit is left out.
-    fn name_tree(
-        &self,
-        node: &'a Dictionary,
-        seen: &mut HashSet<*const Dictionary>,
-        depth: u32,
-        text_budget: &mut usize,
-    ) -> Vec<(String, &'a Object)> {
-        let mut out = Vec::new();
-        if depth > 32 || !seen.insert(node as *const _) {
-            return out;
-        }
-        if let Ok(Object::Array(pairs)) = node.get(b"Names").map(|o| self.resolve(o)) {
-            for pair in pairs.chunks(2) {
-                if let [k, v] = pair {
-                    let key = match self.resolve(k) {
-                        Object::String(bytes, _) => match spend(bytes, text_budget, text_string) {
-                            Some(key) => key,
-                            None => continue,
-                        },
-                        _ => String::new(),
-                    };
-                    out.push((key, v));
-                }
-            }
-        }
-        if let Ok(Object::Array(kids)) = node.get(b"Kids").map(|o| self.resolve(o)) {
-            for k in kids {
-                if let Some(d) = self.dict(k) {
-                    out.extend(self.name_tree(d, seen, depth + 1, text_budget));
-                }
-            }
-        }
-        out
-    }
-
-    /// The first entry of an embedded-files name tree whose key is `key`, in the order
-    /// [`Self::name_tree`] lists them, with no key budget. It keeps no key, and converts a key
-    /// object or `/Names` array that several places reference only once (a second visit cannot
-    /// match, since the first would have returned).
-    fn name_tree_find(&self, node: &'a Dictionary, key: &str, seen: &mut NameTreeSeen, depth: u32) -> Option<&'a Object> {
-        if depth > 32 || !seen.nodes.insert(node as *const _) {
-            return None;
-        }
-        let names = node.get(b"Names").ok();
-        if let Some(names) = names
-            && self.resolved_id(names).is_none_or(|id| seen.objects.insert(id))
-            && let Object::Array(pairs) = self.resolve(names)
-        {
-            for pair in pairs.chunks(2) {
-                if let [k, v] = pair {
-                    if self.resolved_id(k).is_some_and(|id| !seen.objects.insert(id)) {
-                        continue;
-                    }
-                    let found = match self.resolve(k) {
-                        Object::String(bytes, _) => text_string(bytes) == key,
-                        _ => key.is_empty(),
-                    };
-                    if found {
-                        return Some(v);
-                    }
-                }
-            }
-        }
-        if let Ok(Object::Array(kids)) = node.get(b"Kids").map(|o| self.resolve(o)) {
-            for k in kids {
-                if let Some(d) = self.dict(k)
-                    && let Some(v) = self.name_tree_find(d, key, seen, depth + 1)
-                {
-                    return Some(v);
-                }
-            }
-        }
-        None
-    }
-
-    // ── outline ─────────────────────────────────────────────────────────────────────────────
-
-    /// The window `DocInfo::outline` keeps: the first `OUTLINE_WINDOW` bookmarks in outline order,
-    /// nested no deeper than `OUTLINE_DEPTH`, and whether any bookmark was left out. Iterative, and
-    /// each bookmark is read once, so the work and memory stay within the window.
-    fn outline_window(&self, first: &'a Object) -> (Vec<OutlineItem>, bool) {
-        let mut seen = HashSet::new();
-        // The listed bookmarks in outline order, with their depth.
-        let mut listed: Vec<(usize, OutlineItem)> = Vec::new();
-        // One entry per open level: its next sibling, or `None` once that run of siblings has ended.
-        let mut levels: Vec<Option<&'a Object>> = vec![Some(first)];
-        let mut more = false;
-        while let Some(depth) = levels.len().checked_sub(1) {
-            let Some(slot) = levels.get_mut(depth) else { break };
-            let Some(o) = slot.take() else {
-                levels.pop();
-                continue;
-            };
-            if let Object::Reference(id) = o
-                && !seen.insert(*id)
-            {
-                continue; // cycle: this run of siblings ends here
-            }
-            let Some(d) = self.dict(o) else { continue };
-            if listed.len() >= OUTLINE_WINDOW {
-                more = true;
-                break;
-            }
-            *slot = d.get(b"Next").ok();
-            let dest = d
-                .get(b"Dest")
-                .ok()
-                .and_then(|dest| self.dest(dest, 0))
-                .or_else(|| d.get(b"A").ok().and_then(|a| self.dict(a)).and_then(|a| a.get(b"D").ok()).and_then(|dest| self.dest(dest, 0)));
-            let (page, view) = dest.map_or((None, DestView::Top), |(p, v)| (Some(p), v));
-            match d.get(b"First").ok() {
-                Some(child) if depth < OUTLINE_DEPTH => levels.push(Some(child)),
-                Some(_) => more = true,
-                None => {}
-            }
-            let open = d.get(b"Count").ok().and_then(|c| c.as_i64().ok()).is_some_and(|c| c > 0);
-            let title = self.text(d, b"Title").unwrap_or_default();
-            let color = match d.get(b"C").map(|o| self.resolve(o)) {
-                Ok(Object::Array(c)) => outline_color(c.iter().map(|v| self.resolve(v).as_float().ok())),
-                _ => None,
-            };
-            let flags = d.get(b"F").ok().and_then(|f| self.resolve(f).as_i64().ok()).unwrap_or(0);
-            let (italic, bold) = (flags & 1 != 0, flags & 2 != 0);
-            listed.push((depth, OutlineItem { title, page, view, children: Vec::new(), open, color, italic, bold }));
-        }
-        (nest_outline(listed), more)
-    }
-
-    // ── page labels (ISO 32000-2 §12.4.2) ───────────────────────────────────────────────────
-
-    fn label_object(&self, object: &'a Object) -> Result<&'a Object, &'static str> {
-        self.doc.dereference(object).map(|(_, o)| o).map_err(|_| "a number tree reference is missing or cyclic")
-    }
-
-    fn label_dict(&self, object: &'a Object) -> Result<Option<&'a Dictionary>, &'static str> {
-        Ok(match self.label_object(object)? {
-            Object::Dictionary(d) => Some(d),
-            Object::Stream(s) => Some(&s.dict),
-            _ => None,
-        })
-    }
-
-    /// Apply `/PageLabels` to `pages`. `Err`: the tree is unusable and no label is applied.
-    /// `Ok(notes)`: labels applied, with what was repaired on the way (a duplicated start page,
-    /// a range whose labels are too long to show).
-    fn page_labels(&self, catalog: &Dictionary, pages: &mut [PageInfo]) -> Result<Vec<String>, &'static str> {
-        let mut notes = Vec::new();
-        let Ok(tree) = catalog.get(b"PageLabels") else { return Ok(notes) };
-        let Some(tree) = self.label_dict(tree)? else { return Ok(notes) };
-        let mut ranges: BTreeMap<usize, &Dictionary> = BTreeMap::new();
-        let mut stack = vec![(tree, 0usize)];
-        let mut seen = HashSet::new();
-        let mut left = MAX_LABEL_TREE_WORK;
-        while let Some((node, depth)) = stack.pop() {
-            label_work(&mut left, 1)?;
-            if depth > MAX_LABEL_TREE_DEPTH {
-                return Err("the number tree is too deep");
-            }
-            if !seen.insert(node as *const Dictionary) {
-                return Err("the number tree repeats a node or contains a cycle");
-            }
-            if let Ok(nums) = node.get(b"Nums")
-                && let Object::Array(nums) = self.label_object(nums)?
-            {
-                label_work(&mut left, nums.len().div_ceil(2))?;
-                for pair in nums.chunks(2) {
-                    if let [k, v] = pair
-                        && let (Ok(start), Some(d)) = (self.label_object(k)?.as_i64(), self.label_dict(v)?)
-                        && let Ok(start) = usize::try_from(start)
-                        && ranges.insert(start, d).is_some()
-                    {
-                        // The later range wins, as in readers that overwrite.
-                        notes.push(format!("a range starts on page {} twice; the later one is used", start.saturating_add(1)));
-                    }
-                }
-            }
-            if let Ok(kids) = node.get(b"Kids")
-                && let Object::Array(kids) = self.label_object(kids)?
-            {
-                label_work(&mut left, kids.len())?;
-                if kids.len() > MAX_LABEL_TREE_WORK.saturating_sub(stack.len()) {
-                    return Err("the number tree has too many pending nodes");
-                }
-                if !kids.is_empty() && depth == MAX_LABEL_TREE_DEPTH {
-                    return Err("the number tree is too deep");
-                }
-                for kid in kids {
-                    if let Some(d) = self.label_dict(kid)? {
-                        stack.push((d, depth + 1));
-                    }
-                }
-            }
-        }
-        // Decode each bounded prefix once, rather than once for every page in its range.
-        let mut specs = BTreeMap::new();
-        let mut prefix_total = 0usize;
-        for (start, d) in ranges {
-            let first = d.get(b"St").ok().and_then(|o| self.resolve(o).as_i64().ok()).unwrap_or(1).max(1) as u64;
-            let prefix = match d.get(b"P").ok().map(|o| self.resolve(o)) {
-                Some(Object::String(raw, _)) => {
-                    if raw.len() > MAX_PREFIX_BYTES {
-                        return Err("a raw prefix exceeds 2050 bytes");
-                    }
-                    // A label prefix is literal text, not trimmed document metadata.
-                    text_string(raw).trim_matches('\0').to_string()
-                }
-                Some(Object::Name(raw)) => {
-                    if raw.len() > MAX_PREFIX_BYTES {
-                        return Err("a raw prefix exceeds 2050 bytes");
-                    }
-                    // Retain the existing name compatibility and boundary-NUL handling.
-                    String::from_utf8_lossy(raw).trim_matches('\0').to_string()
-                }
-                _ => String::new(),
-            };
-            if prefix.len() > MAX_LABEL_BYTES {
-                return Err("a decoded prefix exceeds 1024 UTF-8 bytes");
-            }
-            // A prefix object shared by many ranges is decoded once per range: count every copy.
-            prefix_total = prefix_total.saturating_add(prefix.len());
-            if prefix_total > MAX_PREFIX_TOTAL_BYTES {
-                return Err("decoded prefixes exceed 4 MiB in total");
-            }
-            let style = d.get(b"S").ok().and_then(|o| self.resolve(o).as_name().ok());
-            specs.insert(start, (first, prefix, style));
-        }
-        let mut staged = Vec::new();
-        let mut total = 0usize;
-        for (i, _) in pages.iter().enumerate() {
-            let Some((&start, (first, prefix, style))) = specs.range(..=i).next_back() else { continue };
-            let n = if matches!(*style, Some(b"D" | b"R" | b"r" | b"A" | b"a")) {
-                let offset = u64::try_from(i - start).map_err(|_| "a page number is too large")?;
-                first.checked_add(offset).ok_or("a page number overflows")?
-            } else {
-                0 // /St is unused when the label consists only of its prefix.
-            };
-            let remaining = MAX_LABEL_BYTES - prefix.len();
-            let number = match *style {
-                Some(b"D") => Some(n.to_string()),
-                Some(b"R" | b"r") => roman(n, remaining),
-                Some(b"A" | b"a") => alpha(n, remaining),
-                _ => Some(String::new()),
-            }
-            .filter(|number| number.len() <= remaining);
-            // A label too long to show keeps that page's physical number; other ranges stay.
-            let Some(mut number) = number else {
-                let note = format!(
-                    "labels from page {} exceed {MAX_LABEL_BYTES} UTF-8 bytes; those pages show their physical page numbers",
-                    start.saturating_add(1)
-                );
-                if !notes.contains(&note) {
-                    notes.push(note);
-                }
-                continue;
-            };
-            if matches!(*style, Some(b"R" | b"A")) {
-                number.make_ascii_uppercase();
-            }
-            let mut label = prefix.clone();
-            label.push_str(&number);
-            if label.is_empty() {
-                continue; // Keep the existing physical number for an empty custom label.
-            }
-            total = total.checked_add(label.len()).ok_or("the total label size overflows")?;
-            if total > MAX_LABEL_TOTAL_BYTES {
-                return Err("custom labels exceed 4 MiB in total");
-            }
-            staged.push((i, label));
-        }
-        // A malformed later range must not leave a partially applied custom label sequence.
-        for (i, label) in staged {
-            if let Some(page) = pages.get_mut(i) {
-                page.label = label;
-            }
-        }
-        Ok(notes)
-    }
-
-    // ── annotations ─────────────────────────────────────────────────────────────────────────
-
-    /// `text_budget` is what is left of [`MAX_LINK_ATTACHMENT_TEXT_BYTES`].
-    fn annotations(&self, info: &mut DocInfo, text_budget: &mut usize) {
-        let mut pages: Vec<(ObjectId, usize)> = self.page_index.iter().map(|(&id, &page)| (id, page)).collect();
-        pages.sort_unstable_by_key(|&(_, page)| page);
-        // An annotation, or a whole `/Annots` array, that several entries or pages list is on the
-        // first of them (§12.5.2 allows one page per annotation). Both are told apart by the object
-        // a reference resolves to, since an indirect object may itself hold a reference.
-        let mut seen_arrays = HashSet::new();
-        let mut seen_annotations = HashSet::new();
-        let mut kept = 0usize;
-        // Once the comment budget is spent, comments are no longer built, but links and attachments
-        // are still listed.
-        let mut comments_full = false;
-        for (id, page) in pages {
-            let Ok(page_dict) = self.doc.get_dictionary(id) else { continue };
-            if let Ok(annots) = page_dict.get(b"Annots")
-                && let Some(r) = self.resolved_id(annots)
-                && !seen_arrays.insert(r)
-            {
-                continue;
-            }
-            let Ok(Object::Array(annots)) = page_dict.get(b"Annots").map(|o| self.resolve(o)) else { continue };
-            for (index, a) in annots.iter().enumerate() {
-                if let Some(r) = self.resolved_id(a)
-                    && !seen_annotations.insert(r)
-                {
-                    continue;
-                }
-                let Some(d) = self.dict(a) else { continue };
-                let Some(subtype) = self.name(d, b"Subtype") else { continue };
-                if subtype == "FileAttachment"
-                    && let Ok(fs) = d.get(b"FS")
-                {
-                    let fallback = |budget: &mut usize| self.budgeted_text(d, b"Contents", budget);
-                    info.attachments.push(self.attachment(fs, AttachmentSource::Annotation { page, index }, text_budget, fallback));
-                }
-                if subtype == "Link" {
-                    if let Some(link) = self.link(page, index, d, text_budget) {
-                        if matches!(&link.target, LinkTarget::Other(s) if s == "JavaScript") {
-                            info.has_javascript = true;
-                        }
-                        info.links.push(link);
-                    }
-                    continue;
-                }
-                // Not comments: form widgets, pop-ups and non-markup annotations such as the
-                // Screen annotation that drives a LaTeX `animate` player (keep in step with
-                // `pdfcraft_annot::is_comment_subtype`).
-                if matches!(subtype.as_str(), "Widget" | "Popup" | "Screen" | "Movie" | "RichMedia" | "3D" | "PrinterMark" | "TrapNet" | "Watermark")
-                {
-                    continue;
-                }
-                if comments_full {
-                    continue;
-                }
-                let rect = rect4(self.resolve(d.get(b"Rect").unwrap_or(&Object::Null)));
-                let mut color = match d.get(b"C").map(|o| self.resolve(o)) {
-                    Ok(Object::Array(c)) if c.len() == 3 => {
-                        let f = |i: usize| c[i].as_float().unwrap_or(0.0);
-                        Some([f(0), f(1), f(2)])
-                    }
-                    _ => None,
-                };
-                // A text box's /C is its background; its text colour is in /DA.
-                if subtype == "FreeText"
-                    && let Some(da) = self.text(d, b"DA")
-                {
-                    let t: Vec<&str> = da.split_whitespace().collect();
-                    if let Some(i) = t.iter().position(|x| *x == "rg")
-                        && i >= 3
-                    {
-                        let f = |k: usize| t[k].parse::<f32>().unwrap_or(0.0);
-                        color = Some([f(i - 3), f(i - 2), f(i - 1)]);
-                    }
-                }
-                let quads = match d.get(b"QuadPoints").map(|o| self.resolve(o)) {
-                    Ok(Object::Array(q)) => {
-                        let v: Vec<f32> = q.iter().map(|o| o.as_float().unwrap_or(0.0)).collect();
-                        v.as_chunks::<8>().0.to_vec()
-                    }
-                    _ => Vec::new(),
-                };
-                let in_reply_to = d.get(b"IRT").ok().and_then(|o| self.dict(o)).and_then(|p| self.text(p, b"NM"));
-                let fill_sign = self.is_fill_sign(d, &subtype);
-                // Keep in step with `pdfcraft_annot::summaries`.
-                let key: &[u8] = if subtype == "Line" { b"L" } else { b"Vertices" };
-                let points = match d.get(key).map(|o| self.resolve(o)) {
-                    Ok(Object::Array(v)) if matches!(subtype.as_str(), "Line" | "PolyLine" | "Polygon") => {
-                        let v: Vec<f32> = v.iter().map(|o| o.as_float().unwrap_or(0.0)).collect();
-                        let pts: Vec<[f32; 2]> = v.as_chunks::<2>().0.to_vec();
-                        if subtype == "Line" && pts.len() != 2 { Vec::new() } else { pts }
-                    }
-                    _ => Vec::new(),
-                };
-                let annotation = Annotation {
-                    page,
-                    subtype,
-                    author: self.text(d, b"T"),
-                    // Acrobat ends lines with CR, which the interface would draw as nothing (keep
-                    // in step with `pdfcraft_annot::summaries`).
-                    contents: self.text(d, b"Contents").map(|s| s.replace("\r\n", "\n").replace('\r', "\n")),
-                    modified: self.text(d, b"M").map(|m| pretty_date(&m)),
-                    name: self.text(d, b"NM"),
-                    in_reply_to,
-                    rect,
-                    color,
-                    index,
-                    state: self.text(d, b"State"),
-                    quads,
-                    locked: d.get(b"F").ok().and_then(|f| self.resolve(f).as_i64().ok()).unwrap_or(0) & 128 != 0,
-                    intent: self.name(d, b"IT"),
-                    fill_sign,
-                    no_rotate: d.get(b"F").is_ok_and(|f| draw_flags(self.resolve(f)) & 16 != 0),
-                    points,
-                };
-                kept = kept.saturating_add(retained(&annotation));
-                if kept > MAX_ANNOTATION_BYTES {
-                    comments_full = true;
-                    continue;
-                }
-                info.annotations.push(annotation);
-            }
-        }
-        info.annotations.sort_by(|a, b| a.page.cmp(&b.page).then(b.rect[3].total_cmp(&a.rect[3])));
-    }
-
-    fn link(&self, page: usize, index: usize, d: &Dictionary, text_budget: &mut usize) -> Option<Link> {
-        let rect = rect4(self.resolve(d.get(b"Rect").ok()?));
-        let target = if let Ok(dest) = d.get(b"Dest") {
-            let (page, view) = self.dest(dest, 0)?;
-            LinkTarget::Page(page, view)
-        } else {
-            let a = d.get(b"A").ok().and_then(|a| self.dict(a))?;
-            match self.name(a, b"S").as_deref() {
-                Some("GoTo") => {
-                    let (page, view) = self.dest(a.get(b"D").ok()?, 0)?;
-                    LinkTarget::Page(page, view)
-                }
-                Some("URI") => {
-                    let uri = a.get(b"URI").ok().and_then(|u| self.resolve(u).as_str().ok())?;
-                    match spend(uri, text_budget, |b| String::from_utf8_lossy(b).into_owned()) {
-                        Some(uri) => LinkTarget::Uri(uri),
-                        None => LinkTarget::Other("URI".into()),
-                    }
-                }
-                Some("SetOCGState") => self.layer_state(a),
-                Some("GoToR") => self.remote_go_to(a).unwrap_or_else(|| LinkTarget::Other("GoToR".into())),
-                Some("Launch") => self.launch_pdf(a).unwrap_or_else(|| LinkTarget::Other("Launch".into())),
-                Some(other) => LinkTarget::Other(other.to_string()),
-                None => return None,
-            }
-        };
-        Some(Link { page, index, rect, target })
-    }
-
-    fn remote_go_to(&self, action: &Dictionary) -> Option<LinkTarget> {
-        let file = self.action_file(action)?;
-        let destination = match action.get(b"D") {
-            Err(_) => RemoteDestination::Default,
-            Ok(o) => match self.resolve(o) {
-                Object::Array(items) => {
-                    let page = items.first().and_then(|o| self.resolve(o).as_i64().ok()).and_then(|n| usize::try_from(n).ok())?;
-                    let kind = items.get(1).map(|o| self.resolve(o)).and_then(|o| o.as_name().ok());
-                    let operands: [Option<f32>; 4] = std::array::from_fn(|i| items.get(i + 2).and_then(|o| self.resolve(o).as_float().ok()));
-                    RemoteDestination::Page { page, view: DestView::from_operands(kind, &operands) }
-                }
-                Object::Name(name) if name.len() <= MAX_REMOTE_DESTINATION_NAME_BYTES => {
-                    let name = String::from_utf8_lossy(name).into_owned();
-                    if name.is_empty() || name.len() > MAX_REMOTE_DESTINATION_NAME_BYTES {
-                        return None;
-                    }
-                    RemoteDestination::Named(name)
-                }
-                Object::String(bytes, _) if bytes.len() <= MAX_REMOTE_DESTINATION_NAME_BYTES => {
-                    let name = text_string(bytes);
-                    if name.is_empty() || name.len() > MAX_REMOTE_DESTINATION_NAME_BYTES {
-                        return None;
-                    }
-                    RemoteDestination::Named(name)
-                }
-                _ => return None,
-            },
-        };
-        Some(LinkTarget::RemoteGoTo { launch: false, file, destination, new_window: self.new_window(action) })
-    }
-
-    /// The non-empty local file an action's `/F` names (a string or a file specification), shared
-    /// by GoToR and Launch. A URL file system (`/FS /URL`) names no local file.
-    fn action_file(&self, action: &Dictionary) -> Option<String> {
-        if self.name(action, b"FS").as_deref() == Some("URL") {
-            return None;
-        }
-        let file = match self.resolve(action.get(b"F").ok()?) {
-            Object::String(bytes, _) => limited_pdf_string(bytes, MAX_REMOTE_FILE_SPEC_BYTES)?,
-            Object::Dictionary(spec) => {
-                if self.name(spec, b"FS").as_deref() == Some("URL") {
-                    return None;
-                }
-                spec.get(b"UF")
-                    .ok()
-                    .and_then(|o| self.pdf_text(o, MAX_REMOTE_FILE_SPEC_BYTES))
-                    .or_else(|| spec.get(b"F").ok().and_then(|o| self.pdf_text(o, MAX_REMOTE_FILE_SPEC_BYTES)))?
-            }
-            _ => return None,
-        };
-        (!file.is_empty()).then_some(file)
-    }
-
-    fn new_window(&self, action: &Dictionary) -> Option<bool> {
-        match action.get(b"NewWindow").map(|o| self.resolve(o)) {
-            Ok(Object::Boolean(value)) => Some(*value),
-            _ => None,
-        }
-    }
-
-    /// A Launch action (ISO 32000-2 §12.6.4.6, Table 207) whose `/F` names a `.pdf` file, read as
-    /// the remote Go-To to that file's first page that it amounts to (#4168). Launching anything
-    /// else, or with the deprecated `/Win` launch parameters (an application, an operation, its
-    /// arguments), is not followed: a document must not start programs. `\` separators, which
-    /// Windows writers put in such paths, are read as `/` (§7.11.2.1 separates components with
-    /// `/`) when the path has no `/` of its own. Launch has no `/D`, so one present (written
-    /// for GoToR, or junk) is ignored rather than checked as a destination.
-    fn launch_pdf(&self, action: &Dictionary) -> Option<LinkTarget> {
-        if action.has(b"Win") {
-            return None;
-        }
-        let file = self.action_file(action)?;
-        let new_window = self.new_window(action);
-        let file = if file.contains('/') { file } else { file.replace('\\', "/") };
-        let pdf = file.rsplit('/').next().is_some_and(|name| name.len() > 4 && name.to_ascii_lowercase().ends_with(".pdf"));
-        pdf.then_some(LinkTarget::RemoteGoTo { launch: true, file, destination: RemoteDestination::Default, new_window })
-    }
-
-    fn pdf_text(&self, o: &Object, max_bytes: usize) -> Option<String> {
-        match self.resolve(o) {
-            Object::String(bytes, _) => limited_pdf_string(bytes, max_bytes),
-            _ => None,
-        }
-    }
-
-    /// A set-OCG-state action: `/State` is `ON`, `OFF` or `Toggle`, each followed by the groups
-    /// it applies to; `/PreserveRB` is true unless it is `false`.
-    fn layer_state(&self, a: &Dictionary) -> LinkTarget {
-        let mut changes = Vec::new();
-        if let Ok(Object::Array(items)) = a.get(b"State").map(|o| self.resolve(o)) {
-            let mut op = None;
-            for item in items.iter().take(MAX_LAYER_STATE) {
-                match item {
-                    Object::Name(n) => {
-                        op = match n.as_slice() {
-                            b"ON" => Some(LayerOp::On),
-                            b"OFF" => Some(LayerOp::Off),
-                            b"Toggle" => Some(LayerOp::Toggle),
-                            _ => None,
-                        }
-                    }
-                    Object::Reference(id) => changes.extend(op.map(|op| (op, *id))),
-                    _ => {}
-                }
-            }
-        }
-        let preserve_rb = !matches!(a.get(b"PreserveRB").map(|o| self.resolve(o)), Ok(Object::Boolean(false)));
-        LinkTarget::SetLayers { changes, preserve_rb }
-    }
-
-    // ── form fields ─────────────────────────────────────────────────────────────────────────
-
-    fn field(
-        &self,
-        o: &'a Object,
-        parent: Option<(&str, Option<String>, Option<i64>)>,
-        out: &mut Vec<Field>,
-        seen: &mut HashSet<ObjectId>,
-        depth: u32,
-    ) {
-        if depth > 32 {
-            return;
-        }
-        if let Object::Reference(id) = o
-            && !seen.insert(*id)
-        {
-            return;
-        }
-        let Some(d) = self.dict(o) else { return };
-        let (parent_name, parent_ft, parent_ff) = parent.unwrap_or(("", None, None));
-        let partial = self.text(d, b"T");
-        let full = match (&partial, parent_name.is_empty()) {
-            (Some(t), true) => t.clone(),
-            (Some(t), false) => format!("{parent_name}.{t}"),
-            (None, _) => parent_name.to_string(),
-        };
-        let ft = self.name(d, b"FT").or(parent_ft);
-        let ff = d.get(b"Ff").ok().and_then(|x| x.as_i64().ok()).or(parent_ff);
-        // Non-terminal: has kids that are fields (they carry /T). Widgets-only kids are terminal.
-        let kids = match d.get(b"Kids").map(|k| self.resolve(k)) {
-            Ok(Object::Array(k)) => k.as_slice(),
-            _ => &[],
-        };
-        let field_kids: Vec<_> = kids.iter().filter(|k| self.dict(k).is_some_and(|kd| kd.get(b"T").is_ok())).collect();
-        if !field_kids.is_empty() {
-            for k in field_kids {
-                self.field(k, Some((&full, ft.clone(), ff)), out, seen, depth + 1);
-            }
-            return;
-        }
-        let flags = ff.unwrap_or(0);
-        let kind = match ft.as_deref() {
-            Some("Tx") => FieldKind::Text,
-            Some("Btn") if flags & (1 << 16) != 0 => FieldKind::PushButton,
-            Some("Btn") if flags & (1 << 15) != 0 => FieldKind::Radio,
-            Some("Btn") => FieldKind::CheckBox,
-            Some("Ch") if flags & (1 << 17) != 0 => FieldKind::Combo,
-            Some("Ch") => FieldKind::List,
-            Some("Sig") => FieldKind::Signature,
-            _ => FieldKind::Unknown,
-        };
-        let value = match d.get(b"V").map(|v| self.resolve(v)) {
-            Ok(Object::Name(n)) => Some(String::from_utf8_lossy(n).into_owned()),
-            Ok(Object::String(bytes, _)) => Some(text_string(bytes)),
-            Ok(Object::Array(a)) => Some(
-                a.iter()
-                    .filter_map(|x| match self.resolve(x) {
-                        Object::String(bytes, _) => Some(text_string(bytes)),
-                        _ => None,
-                    })
-                    .collect::<Vec<_>>()
-                    .join(", "),
-            ),
-            Ok(Object::Dictionary(_)) if kind == FieldKind::Signature => Some("signed".into()),
-            _ => None,
-        };
-        // The widget is either this dict (merged field/widget) or its first kid.
-        let widget = if d.get(b"Rect").is_ok() { Some(d) } else { kids.first().and_then(|k| self.dict(k)) };
-        let page = widget.and_then(|w| w.get(b"P").ok()).and_then(|p| self.page_of(p)).or_else(|| self.find_widget_page(o, kids));
-        let has_actions = d.get(b"AA").is_ok() || widget.is_some_and(|w| w.get(b"AA").is_ok() || w.get(b"A").is_ok());
-        let rect = widget.and_then(|w| w.get(b"Rect").ok()).map(|r| rect4(self.resolve(r)));
-        out.push(Field { name: full, kind, value, page, tooltip: self.text(d, b"TU"), has_actions, rect });
-    }
-
-    /// The first page whose `/Annots` lists the field or one of its kids.
-    fn find_widget_page(&self, field: &Object, kids: &[Object]) -> Option<usize> {
-        let pages = self.annotation_pages.get_or_init(|| self.annotation_pages());
-        std::iter::once(field).chain(kids).filter_map(|o| if let Object::Reference(id) = o { pages.get(id).copied() } else { None }).min()
-    }
-
-    /// Each annotation listed in a page's `/Annots`, with the first page that lists it.
-    fn annotation_pages(&self) -> HashMap<ObjectId, usize> {
-        let mut pages = HashMap::new();
-        for (idx, &pid) in self.page_ids.iter().enumerate() {
-            let Some(annots) = self.doc.get_dictionary(pid).ok().and_then(|d| d.get(b"Annots").ok()) else { continue };
-            let Ok(annots) = self.resolve(annots).as_array() else { continue };
-            for a in annots {
-                if let Object::Reference(id) = a {
-                    pages.entry(*id).or_insert(idx);
-                }
-            }
-        }
-        pages
-    }
-
-    /// The topmost field above widget `id` (itself without a `/Parent`), or `None` when it or an
-    /// ancestor is already reachable from the `/Fields` tree, or a `/Parent` loop hides the top.
-    fn unlisted_field(&self, id: ObjectId, seen: &HashSet<ObjectId>) -> Option<ObjectId> {
-        let mut top = id;
-        let mut visited = HashSet::from([id]);
-        loop {
-            let o = Object::Reference(top);
-            let d = self.dict(&o)?;
-            let parent = match d.get(b"Parent") {
-                Ok(Object::Reference(p)) => Some(*p),
-                _ => None,
-            };
-            let Some(p) = parent else {
-                return if seen.contains(&top) { None } else { Some(top) };
-            };
-            if !visited.insert(p) || visited.len() > 64 {
-                return None;
-            }
-            if seen.contains(&p) {
-                return None;
-            }
-            top = p;
-        }
-    }
-
-    // ── optional content ────────────────────────────────────────────────────────────────────
-
-    fn layers(&self, catalog: &Dictionary, out: &mut Vec<Layer>) {
-        let Some(props) = catalog.get(b"OCProperties").ok().and_then(|o| self.dict(o)) else { return };
-        let config = props.get(b"D").ok().and_then(|o| self.dict(o));
-        let off: HashSet<ObjectId> = config
-            .and_then(|c| c.get(b"OFF").ok())
-            .and_then(|o| self.resolve(o).as_array().ok())
-            .map(|a| a.iter().filter_map(|x| x.as_reference().ok()).collect())
-            .unwrap_or_default();
-        let base_off = config.and_then(|c| self.name(c, b"BaseState")).as_deref() == Some("OFF");
-        let on: HashSet<ObjectId> = config
-            .and_then(|c| c.get(b"ON").ok())
-            .and_then(|o| self.resolve(o).as_array().ok())
-            .map(|a| a.iter().filter_map(|x| x.as_reference().ok()).collect())
-            .unwrap_or_default();
-        let Ok(Object::Array(ocgs)) = props.get(b"OCGs").map(|o| self.resolve(o)) else { return };
-        for g in ocgs {
-            let Some(d) = self.dict(g) else { continue };
-            let id = g.as_reference().ok();
-            let visible = match id {
-                Some(id) if off.contains(&id) => false,
-                Some(id) if on.contains(&id) => true,
-                _ => !base_off,
-            };
-            let Some(id) = id else { continue };
-            out.push(Layer { id, name: self.text(d, b"Name").unwrap_or_else(|| "Layer".into()), visible, initial: visible });
-        }
-    }
-
-    /// The default configuration's radio-button groups (`/RBGroups`) of two or more layers.
-    fn layer_groups(&self, catalog: &Dictionary) -> Vec<Vec<ObjectId>> {
-        let groups = catalog
-            .get(b"OCProperties")
-            .ok()
-            .and_then(|o| self.dict(o))
-            .and_then(|p| p.get(b"D").ok())
-            .and_then(|o| self.dict(o))
-            .and_then(|c| c.get(b"RBGroups").ok())
-            .and_then(|o| self.resolve(o).as_array().ok());
-        let mut left = MAX_LAYER_GROUP_ENTRIES;
-        let mut out = Vec::new();
-        for g in groups.into_iter().flatten() {
-            let Ok(members) = self.resolve(g).as_array() else { continue };
-            let group: Vec<ObjectId> = members.iter().filter_map(|x| x.as_reference().ok()).take(left).collect();
-            left = left.saturating_sub(group.len());
-            if group.len() > 1 {
-                out.push(group);
-            }
-            if left == 0 {
-                break;
-            }
-        }
-        out
-    }
-
-    fn fonts(&self, out: &mut Vec<FontInfo>) {
-        let mut seen = HashSet::new();
-        for &pid in &self.page_ids {
-            let Ok(fonts) = self.doc.get_page_fonts(pid) else { continue };
-            for (_, f) in fonts {
-                let base = f
-                    .get(b"BaseFont")
-                    .ok()
-                    .and_then(|o| o.as_name().ok())
-                    .map(|n| String::from_utf8_lossy(n).into_owned())
-                    .unwrap_or_else(|| "(unnamed)".into());
-                let kind = self.name(f, b"Subtype").unwrap_or_default();
-                let encoding = match f.get(b"Encoding").map(|o| self.resolve(o)) {
-                    Ok(Object::Name(n)) => Some(String::from_utf8_lossy(n).into_owned()),
-                    Ok(Object::Dictionary(_)) => Some("Custom".into()),
-                    Ok(Object::Stream(_)) => Some("Embedded CMap".into()),
-                    _ => None,
-                };
-                // Embedded: FontFile/2/3 in the descriptor (for Type0, in the descendant font).
-                let descriptor_of = |d: &'a Dictionary| d.get(b"FontDescriptor").ok().and_then(|o| self.dict(o));
-                let descendant =
-                    f.get(b"DescendantFonts").ok().and_then(|o| self.resolve(o).as_array().ok()).and_then(|a| a.first()).and_then(|o| self.dict(o));
-                let desc = descriptor_of(f).or_else(|| descendant.and_then(descriptor_of));
-                let embedded =
-                    kind == "Type3" || desc.is_some_and(|d| d.get(b"FontFile").is_ok() || d.get(b"FontFile2").is_ok() || d.get(b"FontFile3").is_ok());
-                // What the substitution chain needs beyond the name: the descriptor flags, and for
-                // a composite font the script its descendant declares (ISO 32000-2 9.7.3).
-                let flags = desc
-                    .and_then(|d| d.get(b"Flags").ok())
-                    .and_then(|o| self.resolve(o).as_i64().ok())
-                    .and_then(|n| u32::try_from(n).ok())
-                    .unwrap_or(0);
-                let ordering =
-                    descendant.and_then(|d| d.get(b"CIDSystemInfo").ok()).and_then(|o| self.dict(o)).and_then(|c| self.text(c, b"Ordering"));
-                let subset = base.len() > 7 && base.as_bytes()[6] == b'+' && base[..6].bytes().all(|b| b.is_ascii_uppercase());
-                let name = if subset { base[7..].to_string() } else { base };
-                let chosen = pdfcraft_fonts::fallback::substitute(&pdfcraft_fonts::fallback::Request {
-                    base_font: &name,
-                    embedded,
-                    flags,
-                    ordering: ordering.as_deref(),
-                });
-                let info = FontInfo {
-                    name,
-                    kind,
-                    embedded,
-                    subset,
-                    encoding,
-                    substitute: chosen.face_name(),
-                    substitution: (!chosen.why.is_faithful()).then(|| chosen.why.note().to_owned()),
-                };
-                if seen.insert((info.name.clone(), info.kind.clone(), info.embedded)) {
-                    out.push(info);
-                }
-            }
-        }
-        out.sort_by(|a, b| a.name.cmp(&b.name));
-    }
-
-    /// The attachment's name is the file specification's, else `fallback`'s, else a generic one.
-    fn attachment(
-        &self,
-        spec: &Object,
-        source: AttachmentSource,
-        text_budget: &mut usize,
-        fallback: impl FnOnce(&mut usize) -> Option<String>,
-    ) -> Attachment {
-        let d = self.dict(spec);
-        let size =
-            d.and_then(|d| d.get(b"EF").ok()).and_then(|o| self.dict(o)).and_then(|ef| ef.get(b"F").ok().or_else(|| ef.get(b"UF").ok())).and_then(
-                |f| match self.resolve(f) {
-                    Object::Stream(s) => s
-                        .dict
-                        .get(b"Params")
-                        .ok()
-                        .and_then(|p| self.dict(p))
-                        .and_then(|p| p.get(b"Size").ok())
-                        .and_then(|s| s.as_i64().ok())
-                        .map(|s| s as usize)
-                        .or(Some(s.content.len())),
-                    _ => None,
-                },
-            );
-        let display = d
-            .and_then(|d| self.budgeted_text(d, b"UF", text_budget).or_else(|| self.budgeted_text(d, b"F", text_budget)))
-            .or_else(|| fallback(text_budget))
-            .unwrap_or_else(|| "attachment".into());
-        Attachment { name: display, description: d.and_then(|d| self.budgeted_text(d, b"Desc", text_budget)), size, source }
-    }
-}
-
-/// A text string's value, decoded by the same rules as the engine's object model
-/// ([`pdfcraft_cos::PdfString::to_text`]) so the panels and outline editing agree.
-fn text_string(bytes: &[u8]) -> String {
-    pdfcraft_cos::PdfString::literal(bytes).to_text()
-}
-
-/// What [`Inspector::name_tree_find`] has visited: node dictionaries, and the key and `/Names`
-/// array objects it reached by reference.
-#[derive(Default)]
-struct NameTreeSeen {
-    nodes: HashSet<*const Dictionary>,
-    objects: HashSet<ObjectId>,
-}
-
-/// A string or name value as text, without surrounding NULs and white space.
-fn trimmed_text(o: &Object) -> Option<String> {
-    let s = match o {
-        Object::String(bytes, _) => text_string(bytes),
-        Object::Name(n) => String::from_utf8_lossy(n).into_owned(),
-        _ => return None,
-    };
-    Some(s.trim_matches('\0').trim().to_string())
-}
-
-/// `convert(bytes)` when the result fits in `budget`, which it then spends by the longer of the raw
-/// and converted lengths. Bytes longer than the budget are not converted. A conversion that comes
-/// out too long spends the raw length, so a string many entries share is converted only until the
-/// budget runs out.
-fn spend(bytes: &[u8], budget: &mut usize, convert: impl FnOnce(&[u8]) -> String) -> Option<String> {
-    if bytes.len() > *budget {
-        return None;
-    }
-    let text = convert(bytes);
-    if text.len() > *budget {
-        *budget = budget.saturating_sub(bytes.len());
-        return None;
-    }
-    // The conversion's work follows the raw length, even when the text it keeps is shorter.
-    *budget = budget.saturating_sub(text.len().max(bytes.len()));
-    Some(text)
-}
-
-fn limited_pdf_string(bytes: &[u8], max_bytes: usize) -> Option<String> {
-    if bytes.len() > max_bytes {
-        return None;
-    }
-    let text = text_string(bytes);
-    (text.len() <= max_bytes).then_some(text)
-}
-
-/// A bookmark title's colour from its `/C` entries, each kept within 0–1 (ISO 32000-2 §12.3.3,
-/// Table 151: "An array of three numbers in the range 0.0 to 1.0, representing the components in
-/// the DeviceRGB colour space"). Black, the default, and anything that isn't three numbers give
-/// `None`.
-pub(crate) fn outline_color(values: impl Iterator<Item = Option<f32>>) -> Option<[f32; 3]> {
-    let v: Vec<Option<f32>> = values.take(4).collect();
-    let [Some(r), Some(g), Some(b)] = v.as_slice() else { return None };
-    // A number past the range, however large, is kept at its edge.
-    let rgb = [*r, *g, *b].map(|c| c.clamp(0.0, 1.0));
-    (rgb != [0.0; 3]).then_some(rgb)
-}
-
-/// Nests a pre-order list of `(depth, item)` into the outline tree.
-fn nest_outline(listed: Vec<(usize, OutlineItem)>) -> Vec<OutlineItem> {
-    let mut roots = Vec::new();
-    // The open ancestors, outermost first; each collects its children until it closes.
-    let mut open: Vec<(usize, OutlineItem)> = Vec::new();
-    for (depth, item) in listed {
-        while open.last().is_some_and(|(d, _)| *d >= depth) {
-            close_outline(&mut open, &mut roots);
-        }
-        open.push((depth, item));
-    }
-    while !open.is_empty() {
-        close_outline(&mut open, &mut roots);
-    }
-    roots
-}
-
-/// Closes the innermost open bookmark: it joins its parent's children, or the top level.
-fn close_outline(open: &mut Vec<(usize, OutlineItem)>, roots: &mut Vec<OutlineItem>) {
-    if let Some((_, item)) = open.pop() {
-        match open.last_mut() {
-            Some((_, parent)) => parent.children.push(item),
-            None => roots.push(item),
-        }
-    }
-}
-
-/// An annotation's `/F` as the renderer reads it: a real is truncated, and a value that isn't a
-/// `u32` counts as no flags.
-fn draw_flags(o: &Object) -> u32 {
-    let f = match o {
-        Object::Integer(i) => *i,
-        Object::Real(r) => *r as i64,
-        _ => 0,
-    };
-    u32::try_from(f).unwrap_or(0)
-}
-
-fn rect4(o: &Object) -> [f32; 4] {
-    match o {
-        Object::Array(a) if a.len() == 4 => {
-            let v: Vec<f32> = a.iter().map(|x| x.as_float().unwrap_or(0.0)).collect();
-            [v[0].min(v[2]), v[1].min(v[3]), v[0].max(v[2]), v[1].max(v[3])]
-        }
-        _ => [0.0; 4],
-    }
-}
-
-fn label_work(left: &mut usize, count: usize) -> Result<(), &'static str> {
-    *left = left.checked_sub(count).ok_or("the number tree has too many entries")?;
-    Ok(())
-}
-
-/// `D:20260930104512-04'00'` → `2026-09-30 10:45`.
-/// A PDF date (`D:20261001123000Z`) as "2026-10-01 12:30"; other strings unchanged.
-pub fn pretty_date(s: &str) -> String {
-    let d = s.trim_start_matches("D:");
-    if let Some(d) = d.get(..12).filter(|d| d.bytes().all(|b| b.is_ascii_digit())) {
-        // Twelve ASCII digits make every slice below a UTF-8 character boundary.
-        format!("{}-{}-{} {}:{}", &d[0..4], &d[4..6], &d[6..8], &d[8..10], &d[10..12])
-    } else {
-        s.to_string()
-    }
-}
-
-/// Fetch an attachment's bytes (decoded). Capped at 1 GiB to defuse decompression bombs.
-pub fn attachment_data(bytes: &[u8], password: Option<&str>, att: &Attachment) -> Result<Vec<u8>, String> {
-    let run = || -> Result<Vec<u8>, String> {
-        let options = load_options(password);
-        let doc = Document::load_mem_with_options(bytes, options).map_err(|e| e.to_string())?;
-        let insp = Inspector::new(&doc);
-        let spec: &Object = match &att.source {
-            AttachmentSource::Document { key } => {
-                let names = doc.catalog().ok().and_then(|c| c.get(b"Names").ok()).and_then(|o| insp.dict(o)).ok_or("no /Names")?;
-                let ef = names.get(b"EmbeddedFiles").ok().and_then(|o| insp.dict(o)).ok_or("no /EmbeddedFiles")?;
-                insp.name_tree_find(ef, key, &mut NameTreeSeen::default(), 0).ok_or("attachment not found")?
-            }
-            AttachmentSource::Annotation { page, index } => {
-                let (&pid, _) = insp.page_index.iter().find(|(_, i)| **i == *page).ok_or("page not found")?;
-                let annots = doc.get_dictionary(pid).map_err(|e| e.to_string())?.get(b"Annots").map_err(|e| e.to_string())?;
-                let a = insp.resolve(annots).as_array().map_err(|e| e.to_string())?.get(*index).ok_or("annotation not found")?;
-                insp.dict(a).and_then(|d| d.get(b"FS").ok()).ok_or("annotation has no file")?
-            }
-        };
-        let fs = insp.dict(spec).ok_or("bad file specification")?;
-        let ef = fs.get(b"EF").ok().and_then(|o| insp.dict(o)).ok_or("the file is not embedded (external reference)")?;
-        let stream = ef.get(b"UF").ok().or_else(|| ef.get(b"F").ok()).map(|o| insp.resolve(o)).ok_or("no embedded stream")?;
-        let stream = stream.as_stream().map_err(|e| e.to_string())?;
-        if stream.dict.get(b"Filter").is_ok() {
-            stream.decompressed_content_with_limit(1 << 30).map_err(|e| e.to_string())
-        } else {
-            Ok(stream.content.clone())
-        }
-    };
-    catch_unwind(AssertUnwindSafe(run)).unwrap_or_else(|p| Err(format!("reading the attachment crashed: {}", crate::raster::panic_message(&p))))
-}
-
-/// An XFA packet's bytes as text: UTF-16 (little- or big-endian, told by a byte order mark or by
-/// how `<` is written) or UTF-8, as `pdfcraft_xfa::packets::decode` reads them. Lossy: only one
-/// element is looked for.
-fn xfa_packet_text(bytes: &[u8]) -> String {
-    let utf16 = |b: &[u8], from: fn([u8; 2]) -> u16| {
-        let units = b.as_chunks::<2>().0.iter().map(|c| from(*c));
-        char::decode_utf16(units).map(|c| c.unwrap_or(char::REPLACEMENT_CHARACTER)).collect::<String>()
-    };
-    match bytes {
-        [0xFF, 0xFE, rest @ ..] => utf16(rest, u16::from_le_bytes),
-        [0xFE, 0xFF, rest @ ..] => utf16(rest, u16::from_be_bytes),
-        [b'<', 0, ..] => utf16(bytes, u16::from_le_bytes),
-        [0, b'<', ..] => utf16(bytes, u16::from_be_bytes),
-        [0xEF, 0xBB, 0xBF, rest @ ..] => String::from_utf8_lossy(rest).into_owned(),
-        _ => String::from_utf8_lossy(bytes).into_owned(),
-    }
-}
-
-/// One markup tag found by [`next_tag`]: where it starts (`<`) and ends (after `>`), whether it
-/// closes (`</x>`) or closes itself (`<x/>`), and its name without a namespace prefix.
-struct Tag<'a> {
-    start: usize,
-    end: usize,
-    close: bool,
-    empty: bool,
-    local: &'a str,
-}
-
-/// The next element tag in `xml` at or after `from`, skipping comments, CDATA sections,
-/// processing instructions and declarations. A byte scan, not an XML parser: enough to find one
-/// known element in an XFA packet, whose tags Designer writes with a line break before each `>`.
-fn next_tag(xml: &str, mut from: usize) -> Option<Tag<'_>> {
-    loop {
-        let lt = from + xml.get(from..)?.find('<')?;
-        let rest = xml.get(lt..)?;
-        let skip_to = |end: &str| rest.find(end).map(|i| lt + i + end.len());
-        if rest.starts_with("<!--") {
-            from = skip_to("-->")?;
-            continue;
-        }
-        if rest.starts_with("<![CDATA[") {
-            from = skip_to("]]>")?;
-            continue;
-        }
-        if rest.starts_with("<?") || rest.starts_with("<!") {
-            from = skip_to(">")?;
-            continue;
-        }
-        let gt = lt + rest.find('>')?;
-        let inner = xml.get(lt + 1..gt)?;
-        let (close, inner) = match inner.strip_prefix('/') {
-            Some(i) => (true, i),
-            None => (false, inner),
-        };
-        let empty = !close && inner.ends_with('/');
-        let name = inner.split(|c: char| c.is_whitespace() || c == '/').next().unwrap_or_default();
-        let local = name.rsplit(':').next().unwrap_or(name);
-        return Some(Tag { start: lt, end: gt + 1, close, empty, local });
-    }
-}
-
-/// What `<name>…</name>` holds: the content of the first top-level element of `xml` called `name`
-/// (any prefix). Elements nested in other elements are not looked at. `None` when there is none,
-/// it closes itself, or it is never closed.
-fn xml_child_body<'a>(xml: &'a str, name: &str) -> Option<&'a str> {
-    let mut at = 0;
-    // The elements open around `at`, innermost last: a closing tag must name the innermost one,
-    // or the markup is malformed and has no value.
-    let mut open_tags: Vec<&str> = Vec::new();
-    // Where the wanted element's content starts, once its opening tag is seen at the top level.
-    let mut open = None;
-    loop {
-        let tag = next_tag(xml, at)?;
-        at = tag.end;
-        if tag.close {
-            if open_tags.pop()? != tag.local {
-                return None;
-            }
-            if open_tags.is_empty()
-                && let Some(start) = open
-            {
-                return xml.get(start..tag.start);
-            }
-        } else if !tag.empty {
-            if open_tags.is_empty() && tag.local == name {
-                open = Some(tag.end);
-            }
-            open_tags.push(tag.local);
-        } else if open_tags.is_empty() && tag.local == name {
-            return None;
-        }
-    }
-}
-
-/// The trimmed text at `path` (element names from the outside in, any prefix, each a child of the
-/// one before) in `xml`, if it is plain text.
-fn xml_path_text(xml: &str, path: &[&str]) -> Option<String> {
-    let body = path.iter().try_fold(xml, |within, name| xml_child_body(within, name))?;
-    let text = body.trim();
-    (!text.is_empty() && !text.contains('<')).then(|| text.to_owned())
-}
-
-/// `dynamicRender` at `config/acrobat/acrobat7` in the configuration packet: the `config` child
-/// of the `xdp` root in a whole-XDP stream, or the `config` packet itself. The same names inside
-/// the form data or the template are not the configuration.
-fn xfa_config_dynamic_render(packet: &str) -> Option<String> {
-    const IN_CONFIG: [&str; 4] = ["config", "acrobat", "acrobat7", "dynamicRender"];
-    xml_path_text(packet, &["xdp", IN_CONFIG[0], IN_CONFIG[1], IN_CONFIG[2], IN_CONFIG[3]]).or_else(|| xml_path_text(packet, &IN_CONFIG))
-}
-
 #[cfg(test)]
-mod tests {
-    #[test]
-    fn png_predictor_rows_longer_than_the_data_are_refused_before_allocating() {
-        // Vendored lopdf patch: a fuzzed `/Columns 4294967295` allocated two 4 GiB rows before
-        // reading any data. A row that cannot fit in the data is refused up front.
-        let e = lopdf::filters::png::decode_frame(&[2, 0, 0, 0], 1, 64 << 20).unwrap_err();
-        assert!(e.to_string().contains("longer than the data"), "{e}");
-        // A real frame still decodes: two 3-byte rows, the second Up-filtered.
-        assert_eq!(lopdf::filters::png::decode_frame(&[0, 1, 2, 3, 2, 1, 1, 1], 1, 3).unwrap(), [1, 2, 3, 2, 3, 4]);
-    }
-
-    #[test]
-    fn empty_png_predictor_frames_do_not_allocate_rows() {
-        // usize::MAX cannot be reserved, so the old code safely errors before allocating.
-        // An empty frame needs no rows regardless of the declared width.
-        assert!(lopdf::filters::png::decode_frame(&[], 1, usize::MAX).unwrap().is_empty());
-    }
-
-    fn tiff_predictor_stream(data: Vec<u8>, columns: i64, colors: i64, bits: i64) -> lopdf::Stream {
-        let mut params = lopdf::Dictionary::new();
-        params.set("Predictor", 2i64);
-        params.set("Columns", columns);
-        params.set("Colors", colors);
-        params.set("BitsPerComponent", bits);
-        let mut dict = lopdf::Dictionary::new();
-        dict.set("DecodeParms", params);
-        let mut stream = lopdf::Stream::new(dict, data);
-        stream.compress().unwrap();
-        assert_eq!(stream.dict.get(b"Filter").unwrap().as_name().unwrap(), b"FlateDecode");
-        stream
-    }
-
-    #[test]
-    fn tiff_subbyte_predictor_row_width_overflow_is_refused() {
-        // Each multiplication overflows before any scratch allocation in the old debug build.
-        for bits in [1, 2, 4] {
-            let stream = tiff_predictor_stream(vec![0; 64], i64::MAX, 3, bits);
-            assert!(
-                matches!(stream.decompressed_content_with_limit(64), Err(lopdf::Error::Decompress(lopdf::DecompressError::Predictor(_)))),
-                "{bits}-bit row"
-            );
-        }
-    }
-
-    #[test]
-    fn tiff_subbyte_predictor_scratch_is_bounded_by_available_samples() {
-        // 1/2-bit row widths fit usize on 32- and 64-bit hosts; Colors previously made Vec<u16>
-        // reject the capacity before allocating. A partial row has no preceding pixel.
-        for bits in [1, 2] {
-            let data = vec![0b1010_0110; 64];
-            let stream = tiff_predictor_stream(data.clone(), 1, i64::try_from(isize::MAX).unwrap(), bits);
-            assert_eq!(stream.decompressed_content_with_limit(64).unwrap(), data, "{bits}-bit row");
-        }
-    }
-
-    #[test]
-    fn tiff_subbyte_predictors_keep_components_rows_and_padding() {
-        // Repeated tiny rows compress through the public Stream API. Rows remain independent,
-        // differences wrap at each component depth, and trailing padding bits survive.
-        for (columns, colors, bits, encoded, decoded) in [
-            (16, 1, 1, vec![255, 170, 8, 255], vec![170, 204, 15, 85]),
-            (6, 1, 2, vec![85, 179], vec![108, 147]),
-            (3, 1, 4, vec![25, 16], vec![26, 176]),
-            (2, 2, 4, vec![18, 34], vec![18, 52]),
-        ] {
-            let stream = tiff_predictor_stream(encoded.repeat(32), columns, colors, bits);
-            assert_eq!(stream.decompressed_content_with_limit(128).unwrap(), decoded.repeat(32), "{bits}-bit, {colors} colours");
-        }
-    }
-
-    // Xref-stream fixtures exercise indirect /Length lookup during document loading: stream 2's /Length is `3 0 R`,
-    // `containers` lists compressed (id, container, index) entries and `objects` the other objects in the file.
-    fn compressed_length_pdf(containers: &[(u32, u32, u16)], objects: &[(u32, &[u8])]) -> Vec<u8> {
-        let mut pdf = b"%PDF-1.7\n".to_vec();
-        let ids = containers.iter().flat_map(|&(id, container, _)| [id, container]).chain(objects.iter().map(|&(id, _)| id));
-        let xref_id = ids.max().unwrap_or(3) + 1;
-        let mut records = vec![[0u8; 7]; (xref_id + 1) as usize];
-        records[0] = [0, 0, 0, 0, 0, 255, 255];
-        let mut append = |id: u32, body: &[u8]| {
-            records[id as usize][0] = 1;
-            records[id as usize][1..5].copy_from_slice(&(pdf.len() as u32).to_be_bytes());
-            pdf.extend_from_slice(format!("{id} 0 obj\n").as_bytes());
-            pdf.extend_from_slice(body);
-            pdf.extend_from_slice(b"\nendobj\n");
-        };
-        append(1, b"<< /Type /Catalog >>");
-        append(2, b"<< /Length 3 0 R >>\nstream\nhello\nendstream");
-        for &(id, body) in objects {
-            append(id, body);
-        }
-        for &(id, container, index) in containers {
-            records[id as usize][0] = 2;
-            records[id as usize][1..5].copy_from_slice(&container.to_be_bytes());
-            records[id as usize][5..7].copy_from_slice(&index.to_be_bytes());
-        }
-        let xref_offset = pdf.len();
-        records[xref_id as usize][0] = 1;
-        records[xref_id as usize][1..5].copy_from_slice(&(xref_offset as u32).to_be_bytes());
-        pdf.extend_from_slice(
-            format!("{xref_id} 0 obj\n<< /Type /XRef /Size {} /Root 1 0 R /W [1 4 2] /Length {} >>\nstream\n", records.len(), records.len() * 7)
-                .as_bytes(),
-        );
-        for record in records {
-            pdf.extend_from_slice(&record);
-        }
-        pdf.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref_offset}\n%%EOF\n").as_bytes());
-        pdf
-    }
-
-    // Stream 2's /Length starts a chain of `hops` indirect /Length lookups, each naming a new object; only the last
-    // link's /Length is direct. Compressed: link k is the integer 3 + 2k (the length it measures) alone in the object
-    // stream 4 + 2k, whose own /Length is link k + 1. Plain: link k is the stream 3 + k, whose /Length is link k + 1.
-    fn length_chain_pdf(hops: u32, compressed: bool) -> Vec<u8> {
-        let length = |hop: u32, next: u32, data: &str| if hop + 1 < hops { format!("{next} 0 R") } else { data.len().to_string() };
-        let (mut containers, mut objects) = (Vec::new(), Vec::new());
-        let mut value = 5; // the length of stream 2's data, "hello"
-        for hop in 0..hops {
-            if compressed {
-                let (id, container) = (3 + 2 * hop, 4 + 2 * hop);
-                let index = format!("{id} 0 ");
-                let data = format!("{index}{value}");
-                let dict = format!("/Type /ObjStm /N 1 /First {} /Length {}", index.len(), length(hop, id + 2, &data));
-                objects.push((container, format!("<< {dict} >>\nstream\n{data}\nendstream")));
-                containers.push((id, container, 0));
-                value = data.len();
-            } else {
-                objects.push((3 + hop, format!("<< /Length {} >>\nstream\n\nendstream", length(hop, 4 + hop, ""))));
-            }
-        }
-        let objects: Vec<_> = objects.iter().map(|(id, body)| (*id, body.as_bytes())).collect();
-        compressed_length_pdf(&containers, &objects)
-    }
-
-    // Lenient loading keeps a document whose stream 2 has an unresolvable /Length: the catalog, and stream 2's
-    // dictionary without its data.
-    fn load_without_stream_2_data(pdf: &[u8]) -> Document {
-        let doc = Document::load_mem(pdf).unwrap();
-        assert!(doc.catalog().unwrap().has_type(b"Catalog"));
-        assert!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content.is_empty());
-        doc
-    }
-
-    #[test]
-    fn compressed_object_self_container_does_not_recurse() {
-        let doc = load_without_stream_2_data(&compressed_length_pdf(&[(3, 3, 0)], &[]));
-        assert!(doc.get_object((3, 0)).is_err());
-    }
-
-    #[test]
-    fn compressed_object_mutual_containers_do_not_recurse() {
-        let doc = load_without_stream_2_data(&compressed_length_pdf(&[(3, 4, 0), (4, 3, 0)], &[]));
-        assert!(doc.get_object((3, 0)).is_err());
-        assert!(doc.get_object((4, 0)).is_err());
-    }
-
-    #[test]
-    fn object_stream_length_cycle_does_not_recurse() {
-        let pdf = compressed_length_pdf(&[(3, 4, 0)], &[(4, b"<< /Type /ObjStm /N 1 /First 4 /Length 3 0 R >>\nstream\n3 0 5\nendstream")]);
-        let doc = load_without_stream_2_data(&pdf);
-        // The container's /Length is the object it holds: the container is kept without data, so 3 never loads.
-        assert!(doc.get_object((4, 0)).unwrap().as_stream().unwrap().content.is_empty());
-        assert!(doc.get_object((3, 0)).is_err());
-    }
-
-    #[test]
-    fn compressed_object_container_chain_does_not_recurse() {
-        let containers: Vec<_> = (3..100_003).map(|id| (id, id + 1, 0)).collect();
-        let pdf = compressed_length_pdf(&containers, &[(100_003, b"<< /Type /ObjStm /N 1 /First 4 /Length 5 >>\nstream\n3 0 5\nendstream")]);
-        let doc = load_without_stream_2_data(&pdf);
-        // The object stream in the file loads, but the xref puts 3 in the compressed container 4, which is refused.
-        assert_eq!(doc.get_object((100_003, 0)).unwrap().as_stream().unwrap().content, b"3 0 5");
-        assert!(doc.get_object((3, 0)).is_err());
-    }
-
-    #[test]
-    fn compressed_objects_and_indirect_stream_length_still_load() {
-        let pdf = compressed_length_pdf(
-            &[(3, 4, 0), (5, 4, 1)],
-            &[(4, b"<< /Type /ObjStm /N 2 /First 8 /Length 17 >>\nstream\n3 0 5 2 5 (value)\nendstream")],
-        );
-        let doc = Document::load_mem_with_options(&pdf, LoadOptions { strict: true, ..Default::default() }).unwrap();
-        assert_eq!(doc.get_object((3, 0)).unwrap().as_i64().unwrap(), 5);
-        assert_eq!(doc.get_object((5, 0)).unwrap().as_str().unwrap(), b"value");
-        assert_eq!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content, b"hello");
-    }
-
-    #[test]
-    fn compressed_length_in_a_container_with_an_indirect_length_still_loads() {
-        // Two hops, as in a valid file: stream 2's /Length (3) is compressed in container 4, whose own /Length (5) is
-        // a plain indirect integer.
-        let pdf =
-            compressed_length_pdf(&[(3, 4, 0)], &[(4, b"<< /Type /ObjStm /N 1 /First 4 /Length 5 0 R >>\nstream\n3 0 5\nendstream"), (5, b"5")]);
-        let doc = Document::load_mem_with_options(&pdf, LoadOptions { strict: true, ..Default::default() }).unwrap();
-        assert_eq!(doc.get_object((3, 0)).unwrap().as_i64().unwrap(), 5);
-        assert_eq!(doc.get_object((5, 0)).unwrap().as_i64().unwrap(), 5);
-        assert_eq!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content, b"hello");
-    }
-
-    #[test]
-    fn compressed_length_chain_does_not_recurse() {
-        // Every container is an ordinary object in the file and every hop names a new object, so neither the
-        // container check nor the cycle history stops the chain; each hop recursed once more (a 512 KiB stack
-        // overflowed within 150 hops). Lookups past the cap fail: the first link never loads, while the last one,
-        // next to the direct /Length, does.
-        let hops = 5_000;
-        let doc = load_without_stream_2_data(&length_chain_pdf(hops, true));
-        assert!(doc.get_object((3, 0)).is_err());
-        assert!(doc.get_object((3 + 2 * (hops - 1), 0)).unwrap().as_i64().is_ok());
-        // The cap itself: loading link j reads its container's /Length, a chain of 2 * (hops - 1 - j) lookups, and
-        // 16 are allowed, so the 9th link from the end loads and the 10th does not.
-        assert!(doc.get_object((3 + 2 * (hops - 9), 0)).is_ok());
-        assert!(doc.get_object((3 + 2 * (hops - 10), 0)).is_err());
-    }
-
-    #[test]
-    fn plain_stream_length_chain_does_not_recurse() {
-        // The same recursion without object streams: each stream's /Length names the next stream (a 512 KiB stack
-        // overflowed within 200 hops). A stream is no length, so every link is kept as a stream without data.
-        let hops = 5_000;
-        let doc = load_without_stream_2_data(&length_chain_pdf(hops, false));
-        assert!((3..3 + hops).all(|id| doc.get_object((id, 0)).is_ok_and(|link| link.as_stream().is_ok_and(|s| s.content.is_empty()))));
-    }
-
-    fn indexed_object_stream(pairs: &[(u32, usize)], members: &[u8]) -> lopdf::Stream {
-        let mut content = Vec::new();
-        for &(id, offset) in pairs {
-            content.extend_from_slice(format!("{id} {offset} ").as_bytes());
-        }
-        let mut dict = Dictionary::new();
-        dict.set("Type", "ObjStm");
-        dict.set("N", pairs.len() as i64);
-        dict.set("First", content.len() as i64);
-        content.extend_from_slice(members);
-        lopdf::Stream::new(dict, content)
-    }
-
-    #[test]
-    fn object_stream_member_extents_bound_owned_strings() {
-        let mut members = vec![b'('; 32];
-        members.extend(vec![b'x'; 1 << 20]);
-        members.extend([b')'; 32]);
-        // Put the innermost (complete) string first in index order, then overlapping starts
-        // and duplicates. Only this first member at offset 31 may own the large string.
-        let mut pairs = vec![(100, 31)];
-        pairs.extend((0..31).map(|offset| (offset as u32 + 1, offset)));
-        pairs.extend([(200, 31), (201, 31)]);
-        let stream = indexed_object_stream(&pairs, &members);
-        let parsed = lopdf::ObjectStream::new_with_limit(&stream, Some(2 << 20)).unwrap();
-        assert_eq!(parsed.objects.get(&(100, 0)).unwrap().as_str().unwrap().len(), 1 << 20);
-        let total: usize = parsed.objects.values().filter_map(|object| object.as_str().ok()).map(<[u8]>::len).sum();
-        assert!(total <= stream.content.len(), "owned {total} string bytes from {} decoded bytes", stream.content.len());
-        assert!(!parsed.objects.contains_key(&(200, 0)));
-        assert!(!parsed.objects.contains_key(&(201, 0)));
-    }
-
-    #[test]
-    fn object_stream_member_extents_preserve_index_order_and_whitespace() {
-        let members = b" \n42\n /Name \n[true 7]\n << /Key (value) >>\n (last)";
-        // Unsorted offsets, and object 9 appears twice: its last index entry still wins.
-        let pairs = [(9, 0), (12, 21), (10, 5), (11, 12), (9, 41)];
-        let parsed = lopdf::ObjectStream::new(&indexed_object_stream(&pairs, members)).unwrap();
-        assert_eq!(parsed.objects.len(), 4);
-        assert_eq!(parsed.objects.get(&(9, 0)).unwrap().as_str().unwrap(), b"last");
-        assert_eq!(parsed.objects.get(&(10, 0)).unwrap().as_name().unwrap(), b"Name");
-        assert_eq!(parsed.objects.get(&(11, 0)).unwrap().as_array().unwrap(), &[Object::Boolean(true), Object::Integer(7)]);
-        assert_eq!(parsed.objects.get(&(12, 0)).unwrap().as_dict().unwrap().get(b"Key").unwrap().as_str().unwrap(), b"value");
-    }
-
-    #[test]
-    fn view_and_user_space_round_trip_for_every_rotation() {
-        for rotation in [0u16, 90, 180, 270] {
-            let (w, h) = if rotation % 180 == 0 { (200.0, 300.0) } else { (300.0, 200.0) };
-            let p = super::PageInfo { width: w, height: h, label: String::new(), crop: [10.0, 20.0, 210.0, 320.0], rotation };
-            for (x, y) in [(0.0, 0.0), (15.0, 40.0), (w, h)] {
-                let [ux, uy] = p.view_to_user(x, y);
-                let [vx, vy] = p.user_to_view(ux, uy);
-                assert!((vx - x).abs() < 1e-3 && (vy - y).abs() < 1e-3, "{rotation}: {x},{y} → {ux},{uy} → {vx},{vy}");
-            }
-        }
-        // Unrotated: the view's top-left is the crop box's top-left.
-        let p = super::PageInfo { width: 200.0, height: 300.0, label: String::new(), crop: [10.0, 20.0, 210.0, 320.0], rotation: 0 };
-        assert_eq!(p.view_to_user(0.0, 0.0), [10.0, 320.0]);
-        assert_eq!(p.view_rect_to_quad([0.0, 0.0, 10.0, 5.0]), [10.0, 320.0, 20.0, 320.0, 10.0, 315.0, 20.0, 315.0]);
-    }
-
-    /// #2583: a NoRotate comment is drawn upright with its top-left as displayed at the upper-left
-    /// corner of `/Rect`, its width across and its height down; a box resized as drawn maps back to
-    /// the `/Rect` that shows it. Other comments, and pages that aren't quarter-turned, keep `/Rect`.
-    #[test]
-    fn no_rotate_comments_are_shown_upright_from_their_corner_and_back() {
-        let mut note = super::Annotation {
-            page: 0,
-            subtype: "Text".into(),
-            author: None,
-            contents: None,
-            modified: None,
-            name: None,
-            in_reply_to: None,
-            rect: [40.0, 50.0, 70.0, 70.0],
-            color: None,
-            index: 0,
-            state: None,
-            quads: Vec::new(),
-            locked: false,
-            intent: None,
-            fill_sign: false,
-            no_rotate: true,
-            points: Vec::new(),
-        };
-        let rect = note.rect.map(f64::from);
-        for rotation in [0u16, 90, 180, 270, 45] {
-            let (w, h) = if rotation % 180 == 90 { (140.0, 200.0) } else { (200.0, 140.0) };
-            let p = super::PageInfo { width: w, height: h, label: String::new(), crop: [0.0, 0.0, 200.0, 140.0], rotation };
-            let shown = note.shown_rect(rotation);
-            let (a, b) = (p.user_to_view(shown[0], shown[1]), p.user_to_view(shown[2], shown[3]));
-            let [cx, cy] = p.user_to_view(40.0, 70.0);
-            let want = [cx, cy, cx + 30.0, cy + 20.0];
-            let got = [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])];
-            assert!(got.iter().zip(want).all(|(g, w)| (g - w).abs() < 1e-3), "{rotation}: shown {got:?}, want {want:?}");
-            assert_eq!(note.rect_for_shown(note.shown(rect, rotation), rotation), rect, "{rotation}");
-            // Moved by (5, -7) and resized to 50 × 10 as drawn, back to a /Rect.
-            let resized = [shown[0] as f64 + 5.0, shown[1] as f64 - 7.0, 0.0, 0.0];
-            let across = if rotation % 180 == 90 { [10.0, 50.0] } else { [50.0, 10.0] };
-            let resized = [resized[0], resized[1], resized[0] + across[0], resized[1] + across[1]];
-            let back = note.rect_for_shown(resized, rotation);
-            assert_eq!((back[2] - back[0], back[3] - back[1]), (50.0, 10.0), "{rotation}: {back:?}");
-            assert_eq!(note.shown(back, rotation), resized, "{rotation}");
-        }
-        note.no_rotate = false;
-        assert_eq!(note.shown_rect(90), note.rect);
-        assert_eq!(note.rect_for_shown([1.0, 2.0, 3.0, 4.0], 90), [1.0, 2.0, 3.0, 4.0]);
-    }
-
-    use super::*;
-
-    #[test]
-    fn roman_and_alpha_labels() {
-        assert_eq!(roman(4, MAX_LABEL_BYTES).as_deref(), Some("iv"));
-        assert_eq!(roman(1994, MAX_LABEL_BYTES).as_deref(), Some("mcmxciv"));
-        assert_eq!(alpha(1, MAX_LABEL_BYTES).as_deref(), Some("a"));
-        assert_eq!(alpha(27, MAX_LABEL_BYTES).as_deref(), Some("aa"));
-        assert_eq!(alpha(53, MAX_LABEL_BYTES).as_deref(), Some("aaa"));
-    }
-
-    // Synthetic label-only inspection fixtures: never construct an explosive branching tree.
-    fn label_info(nums: Vec<Object>, kids: Vec<Object>) -> DocInfo {
-        let mut doc = Document::with_version("1.7");
-        let mut tree = Dictionary::new();
-        tree.set("Nums", nums);
-        tree.set("Kids", kids);
-        doc.objects.insert((6, 0), Object::Dictionary(tree));
-        let mut catalog = Dictionary::new();
-        catalog.set("Type", Object::Name(b"Catalog".to_vec()));
-        catalog.set("PageLabels", Object::Reference((6, 0)));
-        doc.objects.insert((1, 0), Object::Dictionary(catalog));
-        doc.trailer.set("Root", Object::Reference((1, 0)));
-        let mut info = DocInfo {
-            pages: (1..=3)
-                .map(|n| PageInfo { width: 200.0, height: 300.0, crop: [0.0, 0.0, 200.0, 300.0], rotation: 0, label: n.to_string() })
-                .collect(),
-            ..Default::default()
-        };
-        Inspector::new(&doc).fill(&mut info);
-        info
-    }
-
-    fn label_spec(style: &str, prefix: Vec<u8>, first: i64) -> Object {
-        let mut d = Dictionary::new();
-        d.set("S", Object::Name(style.as_bytes().to_vec()));
-        d.set("P", Object::String(prefix, lopdf::StringFormat::Hexadecimal));
-        d.set("St", first);
-        Object::Dictionary(d)
-    }
-
-    fn assert_label_fallback(info: &DocInfo) {
-        assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["1", "2", "3"]);
-        assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
-        assert!(info.warnings[0].contains("Page labels"), "{:?}", info.warnings);
-        assert!(info.warnings[0].contains("physical page numbers"), "{:?}", info.warnings);
-    }
-
-    // Contributor-original, blank three-page PDFs. The public importer reads both labels and metadata.
-    fn page_prefix_space_pdf(prefix: Vec<u8>, decimal: bool, indirect: bool) -> Vec<u8> {
-        use lopdf::dictionary;
-        let mut doc = Document::with_version("1.7");
-        let pages_id = doc.new_object_id();
-        let kids: Vec<Object> = (0..3)
-            .map(|_| {
-                doc.add_object(dictionary! {
-                    "Type" => "Page",
-                    "Parent" => pages_id,
-                    "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
-                    "Resources" => Dictionary::new(),
-                })
-                .into()
-            })
-            .collect();
-        doc.objects.insert(pages_id, dictionary! { "Type" => "Pages", "Kids" => kids, "Count" => 3 }.into());
-        let prefix = Object::String(prefix, lopdf::StringFormat::Hexadecimal);
-        let prefix = if indirect { Object::Reference(doc.add_object(prefix)) } else { prefix };
-        let mut label = Dictionary::new();
-        label.set("P", prefix);
-        if decimal {
-            label.set("S", Object::Name(b"D".to_vec()));
-        }
-        let labels = dictionary! { "Nums" => vec![Object::Integer(0), Object::Dictionary(label)] };
-        let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id, "PageLabels" => labels });
-        let info_id = doc.add_object(dictionary! { "Title" => Object::string_literal("  Metadata title  ") });
-        doc.trailer.set("Root", catalog_id);
-        doc.trailer.set("Info", info_id);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).expect("write original page-prefix fixture");
-        bytes
-    }
-
-    #[test]
-    fn page_label_prefix_spaces_survive_public_inspection() {
-        let mut utf16 = vec![0xfe, 0xff];
-        utf16.extend(" Ω ".encode_utf16().flat_map(u16::to_be_bytes));
-        for (raw, prefix, decimal, indirect) in [
-            (b" leading".to_vec(), " leading", true, false),
-            (b"trailing ".to_vec(), "trailing ", true, false),
-            (b" both ".to_vec(), " both ", false, false),
-            (b" ".to_vec(), " ", false, false),
-            (b" Caf\xe9 ".to_vec(), " Café ", true, false),
-            (utf16.clone(), " Ω ", true, false),
-            (utf16, " Ω ", false, true),
-            (Vec::new(), "", true, false),
-            (Vec::new(), "", false, false),
-        ] {
-            let bytes = page_prefix_space_pdf(raw, decimal, indirect);
-            let info = inspect(Arc::new(bytes), None).expect("public import of original page-prefix fixture");
-            let expected: Vec<String> = (1..=3)
-                .map(|n| {
-                    if decimal {
-                        format!("{prefix}{n}")
-                    } else if prefix.is_empty() {
-                        n.to_string()
-                    } else {
-                        prefix.to_owned()
-                    }
-                })
-                .collect();
-            assert_eq!(
-                info.pages.iter().map(|p| p.label.clone()).collect::<Vec<_>>(),
-                expected,
-                "{prefix:?}, decimal={decimal}, indirect={indirect}"
-            );
-            assert!(info.warnings.is_empty(), "{:?}", info.warnings);
-            assert_eq!(info.title.as_deref(), Some("Metadata title"), "page-prefix decoding must not change metadata normalization");
-        }
-    }
-
-    #[test]
-    fn page_label_limits_keep_normal_pdf_numbering() {
-        for (style, first, expected) in [
-            ("r", 4, ["iv", "v", "vi"]),
-            ("R", 1994, ["MCMXCIV", "MCMXCV", "MCMXCVI"]),
-            ("a", 26, ["z", "aa", "bb"]),
-            ("A", 52, ["ZZ", "AAA", "BBB"]),
-        ] {
-            let info = label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), first)], Vec::new());
-            assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), expected);
-            assert!(info.warnings.is_empty(), "{:?}", info.warnings);
-        }
-    }
-
-    #[test]
-    fn page_label_limits_reject_long_prefixes_without_partial_labels() {
-        for prefix in [vec![b'x'; 1025], vec![b'x'; 2051]] {
-            let nums = vec![Object::Integer(0), label_spec("D", b"ok-".to_vec(), 1), Object::Integer(1), label_spec("D", prefix, 1)];
-            assert_label_fallback(&label_info(nums, Vec::new()));
-        }
-    }
-
-    #[test]
-    fn page_label_limits_count_decoded_utf8_bytes() {
-        let mut prefix = vec![0xfe, 0xff];
-        for _ in 0..342 {
-            prefix.extend_from_slice(&0x2022u16.to_be_bytes());
-        }
-        assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec("", prefix, 1)], Vec::new()));
-    }
-
-    #[test]
-    fn page_label_limits_bound_roman_and_alpha_output() {
-        // Just 1025 output bytes on the old path, so RED does not consume excessive memory.
-        for (style, first) in [("r", 1_025_000), ("a", 26 * 1024 + 1)] {
-            assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), first)], Vec::new()));
-        }
-    }
-
-    #[test]
-    fn page_label_limits_detect_one_node_cycle() {
-        let nums = vec![Object::Integer(0), label_spec("D", b"custom-".to_vec(), 1)];
-        assert_label_fallback(&label_info(nums, vec![Object::Reference((6, 0))]));
-    }
-
-    #[test]
-    fn page_label_limits_accept_utf16_ascii_at_the_output_boundary() {
-        let mut prefix = vec![0xfe, 0xff];
-        for _ in 0..1023 {
-            prefix.extend_from_slice(&u16::from(b'x').to_be_bytes());
-        }
-        let info = label_info(vec![Object::Integer(0), label_spec("D", prefix, 1)], Vec::new());
-        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
-        assert_eq!(info.pages[0].label, format!("{}1", "x".repeat(1023)));
-        assert!(info.pages.iter().all(|p| p.label.len() == MAX_LABEL_BYTES));
-    }
-
-    #[test]
-    fn page_label_limits_refuse_hostile_numbers_before_allocating() {
-        for style in ["r", "R", "a", "A"] {
-            assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), i64::MAX)], Vec::new()));
-        }
-        // Decimal labels remain small even when their first number exceeds 32-bit usize.
-        let info = label_info(vec![Object::Integer(0), label_spec("D", Vec::new(), i64::MAX)], Vec::new());
-        assert_eq!(info.pages[0].label, i64::MAX.to_string());
-        assert_eq!(info.pages[1].label, (i64::MAX as u64 + 1).to_string());
-        assert!(info.warnings.is_empty());
-    }
-
-    #[test]
-    fn page_label_limits_bound_wide_number_trees() {
-        assert_label_fallback(&label_info(Vec::new(), vec![Object::Null; MAX_LABEL_TREE_WORK + 1]));
-        let pair = [Object::Integer(0), label_spec("D", Vec::new(), 1)];
-        let nums = (0..MAX_LABEL_TREE_WORK).flat_map(|_| pair.clone()).collect();
-        assert_label_fallback(&label_info(nums, Vec::new()));
-    }
-
-    #[test]
-    fn page_label_limits_bound_total_custom_output_atomically() {
-        let doc = Document::with_version("1.7");
-        let mut tree = Dictionary::new();
-        tree.set("Nums", vec![Object::Integer(0), label_spec("", vec![b'x'; MAX_LABEL_BYTES], 1)]);
-        let mut catalog = Dictionary::new();
-        catalog.set("PageLabels", Object::Dictionary(tree));
-        let count = MAX_LABEL_TOTAL_BYTES / MAX_LABEL_BYTES + 1;
-        let mut pages: Vec<_> = (1..=count)
-            .map(|n| PageInfo { width: 200.0, height: 300.0, crop: [0.0, 0.0, 200.0, 300.0], rotation: 0, label: n.to_string() })
-            .collect();
-        let err = Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap_err();
-        assert!(err.contains("4 MiB"), "{err}");
-        assert!(pages.iter().enumerate().all(|(i, p)| p.label == (i + 1).to_string()));
-        // Exact aggregate boundary remains supported.
-        pages.pop();
-        Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap();
-        assert!(pages.iter().all(|p| p.label.len() == MAX_LABEL_BYTES));
-    }
-
-    #[test]
-    fn page_label_limits_bound_the_total_of_decoded_prefixes() {
-        // `ranges` ranges naming one shared prefix object of `prefix` bytes, without a style.
-        let shared = |ranges: i64, prefix: usize| {
-            let mut doc = Document::with_version("1.7");
-            doc.objects.insert((7, 0), Object::String(vec![b'x'; prefix], lopdf::StringFormat::Literal));
-            let mut spec = Dictionary::new();
-            spec.set("P", Object::Reference((7, 0)));
-            doc.objects.insert((8, 0), Object::Dictionary(spec));
-            let mut tree = Dictionary::new();
-            tree.set("Nums", (0..ranges).flat_map(|i| [Object::Integer(i), Object::Reference((8, 0))]).collect::<Vec<_>>());
-            let mut catalog = Dictionary::new();
-            catalog.set("PageLabels", Object::Dictionary(tree));
-            (doc, catalog)
-        };
-        let mut pages: Vec<_> =
-            (1..=3).map(|n| PageInfo { width: 200.0, height: 300.0, crop: [0.0, 0.0, 200.0, 300.0], rotation: 0, label: n.to_string() }).collect();
-        // Each range decodes its prefix, so a small file sharing one prefix object asks for a
-        // copy per range: 5,000 ranges and a 1,000-byte prefix make 5 MB, past the 4 MiB total.
-        // Three pages make three labels, far below the label total: the prefixes alone refuse it.
-        let (doc, catalog) = shared(5000, 1000);
-        let err = Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap_err();
-        assert!(err.contains("prefixes exceed 4 MiB"), "{err}");
-        assert!(pages.iter().enumerate().all(|(i, p)| p.label == (i + 1).to_string()));
-        // Exactly 4 MiB of prefixes is still read.
-        let (doc, catalog) = shared((MAX_PREFIX_TOTAL_BYTES / MAX_LABEL_BYTES) as i64, MAX_LABEL_BYTES);
-        Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap();
-        assert!(pages.iter().all(|p| p.label.len() == MAX_LABEL_BYTES));
-    }
-
-    #[test]
-    fn page_label_limits_handle_prefix_only_and_reference_cycles() {
-        let info = label_info(vec![Object::Integer(0), label_spec("", b"prefix".to_vec(), i64::MAX)], Vec::new());
-        assert!(info.warnings.is_empty());
-        assert!(info.pages.iter().all(|p| p.label == "prefix"));
-        let mut doc = Document::with_version("1.7");
-        doc.objects.insert((6, 0), Object::Reference((6, 0)));
-        let mut catalog = Dictionary::new();
-        catalog.set("PageLabels", Object::Reference((6, 0)));
-        assert!(Inspector::new(&doc).page_labels(&catalog, &mut []).unwrap_err().contains("cyclic"));
-    }
-
-    #[test]
-    fn page_label_limits_bound_depth_and_count_combined_work() {
-        for depth in [MAX_LABEL_TREE_DEPTH, MAX_LABEL_TREE_DEPTH + 1] {
-            let mut child = Dictionary::new();
-            child.set("Nums", vec![Object::Integer(0), label_spec("D", b"custom-".to_vec(), 1)]);
-            let mut child = Object::Dictionary(child);
-            for _ in 1..depth {
-                let mut parent = Dictionary::new();
-                parent.set("Kids", vec![child]);
-                child = Object::Dictionary(parent);
-            }
-            let info = label_info(Vec::new(), vec![child]);
-            if depth == MAX_LABEL_TREE_DEPTH {
-                assert!(info.warnings.is_empty());
-                assert_eq!(info.pages[0].label, "custom-1");
-            } else {
-                assert_label_fallback(&info);
-            }
-        }
-        // Each array alone fits: their combined work still must be bounded.
-        let half = MAX_LABEL_TREE_WORK / 2;
-        let spec = label_spec("D", Vec::new(), 1);
-        let nums = (0..half).flat_map(|i| [Object::Integer(i as i64), spec.clone()]).collect();
-        assert_label_fallback(&label_info(nums, vec![Object::Null; half]));
-    }
-
-    #[test]
-    fn page_label_limits_keep_the_later_of_duplicate_ranges() {
-        let nums = vec![Object::Integer(0), label_spec("D", b"first-".to_vec(), 1), Object::Integer(0), label_spec("D", b"last-".to_vec(), 1)];
-        let info = label_info(nums, Vec::new());
-        assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["last-1", "last-2", "last-3"]);
-        assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
-        assert!(info.warnings[0].contains("twice"), "{:?}", info.warnings);
-    }
-
-    #[test]
-    fn page_label_limits_keep_other_ranges_when_one_is_too_long() {
-        // Page 1 is labelled normally; pages 2–3 would need over 1024 bytes of roman numerals.
-        let nums = vec![Object::Integer(0), label_spec("D", b"ok-".to_vec(), 1), Object::Integer(1), label_spec("r", Vec::new(), 1_025_000)];
-        let info = label_info(nums, Vec::new());
-        assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["ok-1", "2", "3"]);
-        assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
-        assert!(info.warnings[0].contains("physical page numbers"), "{:?}", info.warnings);
-    }
-
-    const ATTACHMENTS: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [(notes.txt) 6 0 R] >> >> >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [4 0 R] /Resources << /Font << /F1 9 0 R >> >> >> endobj
-4 0 obj << /Type /Annot /Subtype /FileAttachment /Rect [10 10 30 30] /Contents (data.csv) /FS 8 0 R >> endobj
-5 0 obj << /Type /EmbeddedFile /Length 11 >> stream
-hello notes
-endstream endobj
-6 0 obj << /Type /Filespec /F (notes.txt) /UF (notes.txt) /EF << /F 5 0 R >> /Desc (Doc-level) >> endobj
-7 0 obj << /Type /EmbeddedFile /Length 5 >> stream
-a,b,c
-endstream endobj
-8 0 obj << /Type /Filespec /F (data.csv) /EF << /F 7 0 R >> >> endobj
-9 0 obj << /Type /Font /Subtype /Type1 /BaseFont /ABCDEF+Helvetica >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-
-    #[test]
-    fn attachments_of_both_kinds_are_listed_and_extracted() {
-        let bytes = Arc::new(ATTACHMENTS.to_vec());
-        let info = inspect(bytes.clone(), None).expect("opens");
-        let names: Vec<_> = info.attachments.iter().map(|a| a.name.as_str()).collect();
-        assert!(names.contains(&"notes.txt") && names.contains(&"data.csv"), "{names:?}");
-        for a in &info.attachments {
-            let data = attachment_data(&bytes, None, a).expect("extracts");
-            let expected: &[u8] = if a.name == "notes.txt" { b"hello notes" } else { b"a,b,c" };
-            assert_eq!(data, expected, "{}", a.name);
-        }
-        // A non-embedded /Helvetica is reported as standing in for itself: the standard-14
-        // metrics are exact, so the substitution is named rather than left implicit.
-        assert_eq!(
-            info.fonts,
-            vec![FontInfo {
-                name: "Helvetica".into(),
-                kind: "Type1".into(),
-                embedded: false,
-                subset: true,
-                encoding: None,
-                substitute: Some("Helvetica".into()),
-                substitution: Some(pdfcraft_fonts::fallback::Why::NamedStandard14.note().into()),
-            }]
-        );
-    }
-
-    const LAYERS: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R 6 0 R 7 0 R] /D << /OFF [6 0 R] /RBGroups [[5 0 R 6 0 R] [7 0 R] 8 0 R] >> >> >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [10 0 R 11 0 R] >> endobj
-5 0 obj << /Type /OCG /Name (Red) >> endobj
-6 0 obj << /Type /OCG /Name (Green) >> endobj
-7 0 obj << /Type /OCG /Name (Blue) >> endobj
-8 0 obj [6 0 R 7 0 R] endobj
-9 0 obj [/OFF 5 0 R] endobj
-10 0 obj << /Type /Annot /Subtype /Link /Rect [10 10 50 30] /A << /S /SetOCGState /State [7 0 R /ON 6 0 R /Bogus 5 0 R /Toggle 5 0 R 1 7 0 R] /PreserveRB false >> >> endobj
-11 0 obj << /Type /Annot /Subtype /Link /Rect [60 10 100 30] /A << /S /SetOCGState /State 9 0 R >> >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-
-    /// `/Trans` and `/Dur` (ISO 32000-2 §12.4.4): read with the spec's defaults for what a page
-    /// leaves out, lenient about what is out of range, and only for pages that have either.
-    const TRANSITIONS: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R 5 0 R 6 0 R 7 0 R] /Count 5 /MediaBox [0 0 200 200] >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /Trans << /Type /Trans /S /Wipe /D 2.5 /Di 270 >> /Dur 5 >> endobj
-4 0 obj << /Type /Page /Parent 2 0 R /Dur 3 >> endobj
-5 0 obj << /Type /Page /Parent 2 0 R /Trans 8 0 R >> endobj
-6 0 obj << /Type /Page /Parent 2 0 R /Trans << /S /Bogus /D (slow) /Di 45 /Dm /Q >> /Dur -1 >> endobj
-7 0 obj << /Type /Page /Parent 2 0 R >> endobj
-8 0 obj << /S /Fly /M /O /SS 0.5 /B true /Di /None /Dm /V >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-
-    #[test]
-    fn page_transitions_and_display_times_are_read() {
-        use super::TransitionStyle as S;
-        let info = inspect(Arc::new(TRANSITIONS.to_vec()), None).expect("opens");
-        let t = &info.transitions;
-        assert_eq!(t.iter().map(|t| t.page).collect::<Vec<_>>(), [0, 1, 2, 3], "pages with /Trans or /Dur, in order; page 5 has neither");
-        assert_eq!((t[0].style, t[0].duration, t[0].direction, t[0].display), (Some(S::Wipe), 2.5, Some(270), Some(5.0)));
-        assert!((t[0].horizontal, t[0].inward, t[0].scale, t[0].opaque) == (true, true, 1.0, false), "defaults: {:?}", t[0]);
-        assert_eq!((t[1].style, t[1].duration, t[1].display), (None, 1.0, Some(3.0)), "/Dur without /Trans");
-        assert_eq!(
-            (t[2].style, t[2].inward, t[2].scale, t[2].opaque, t[2].direction, t[2].horizontal),
-            (Some(S::Fly), false, 0.5, true, None, false),
-            "an indirect /Trans: {:?}",
-            t[2]
-        );
-        // Out of range: an unknown style is the spec's default R, a non-numeric /D the default
-        // second, a direction that is not one of the five falls back to 0, a bad /Dm to
-        // horizontal, and a negative /Dur is no display time.
-        assert_eq!(
-            (t[3].style, t[3].duration, t[3].direction, t[3].horizontal, t[3].display),
-            (Some(S::Replace), 1.0, Some(0), true, None),
-            "{:?}",
-            t[3]
-        );
-    }
-
-    const CUSTOM_INFO: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R >> endobj
-4 0 obj << /Title (Report) /Producer (Test) /Project (Apollo) /Revision 7 /Dept (R&D) /Trapped /False /Note <FEFF90E8> >> endobj
-trailer << /Root 1 0 R /Info 4 0 R >>
-%%EOF";
-
-    #[test]
-    fn custom_document_properties_are_listed_apart_from_the_standard_ones() {
-        let info = inspect(Arc::new(CUSTOM_INFO.to_vec()), None).expect("opens");
-        assert_eq!((info.title.as_deref(), info.producer.as_deref()), (Some("Report"), Some("Test")));
-        let mut custom = info.custom.clone();
-        custom.sort();
-        // Revision is a number, not text, so it is not listed; Trapped is a standard entry.
-        assert_eq!(
-            custom,
-            [("Dept".to_string(), "R&D".to_string()), ("Note".to_string(), "部".to_string()), ("Project".to_string(), "Apollo".to_string())]
-        );
-    }
-
-    #[test]
-    fn radio_button_layer_groups_are_read() {
-        let info = inspect(Arc::new(LAYERS.to_vec()), None).expect("opens");
-        let layers: Vec<_> = info.layers.iter().map(|l| (l.id, l.name.as_str(), l.visible)).collect();
-        assert_eq!(layers, [((5, 0), "Red", true), ((6, 0), "Green", false), ((7, 0), "Blue", true)]);
-        // A group of one constrains nothing; an indirect group is read.
-        assert_eq!(info.layer_groups, [vec![(5, 0), (6, 0)], vec![(6, 0), (7, 0)]]);
-    }
-
-    #[test]
-    fn initial_layer_visibility_is_the_default_configuration() {
-        // BaseState OFF: Red is listed ON; Green is listed both ON and OFF, and OFF wins; Blue
-        // isn't listed, so it takes the base state.
-        let pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R 6 0 R 7 0 R] /D << /BaseState /OFF /ON [5 0 R 6 0 R] /OFF [6 0 R] >> >> >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >> endobj
-5 0 obj << /Type /OCG /Name (Red) >> endobj
-6 0 obj << /Type /OCG /Name (Green) >> endobj
-7 0 obj << /Type /OCG /Name (Blue) >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let info = inspect(Arc::new(pdf.to_vec()), None).expect("opens");
-        let layers: Vec<_> = info.layers.iter().map(|l| (l.name.as_str(), l.initial)).collect();
-        assert_eq!(layers, [("Red", true), ("Green", false), ("Blue", false)]);
-    }
-
-    const ORPHAN_FIELDS: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [5 0 R 6 0 R] >> endobj
-4 0 obj << /Fields [] >> endobj
-5 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (alpha) /V (one) /Rect [10 100 90 120] >> endobj
-6 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (beta) /Rect [10 60 90 80] >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-
-    #[test]
-    fn fields_listed_only_on_the_pages_are_listed() {
-        let info = inspect(Arc::new(ORPHAN_FIELDS.to_vec()), None).expect("opens");
-        let listed: Vec<_> = info.fields.iter().map(|f| (f.name.as_str(), f.value.as_deref(), f.page)).collect();
-        assert_eq!(listed, [("alpha", Some("one"), Some(0)), ("beta", None, Some(0))], "{:?}", info.fields);
-    }
-
-    /// A `Structure` that counts the objects read through it.
-    struct CountingReads<'a> {
-        doc: &'a Document,
-        reads: std::cell::Cell<usize>,
-    }
-
-    impl Structure for CountingReads<'_> {
-        fn trailer(&self) -> &Dictionary {
-            &self.doc.trailer
-        }
-        fn get_object(&self, id: ObjectId) -> lopdf::Result<&Object> {
-            self.reads.set(self.reads.get() + 1);
-            self.doc.get_object(id)
-        }
-        fn encrypted(&self) -> bool {
-            false
-        }
-    }
-
-    /// One comment referenced many times, or a page-shared `/Annots` array, is listed once, and many
-    /// small comments sharing one large `/Contents` string stop at the retained-bytes budget.
-    #[test]
-    fn repeated_annotations_are_listed_once_within_a_byte_budget() {
-        let small = "<< /Subtype /Text /Rect [0 0 1 1] /Contents 7 0 R >> ".repeat(1200);
-        let pdf = format!(
-            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 5 0 R >> endobj\n\
-             4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 5 0 R >> endobj\n\
-             5 0 obj [{} {small}] endobj\n\
-             6 0 obj << /Type /Annot /Subtype /Text /Rect [0 0 1 1] /Contents (note) >> endobj\n\
-             7 0 obj ({}) endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
-            "6 0 R ".repeat(1000),
-            "x".repeat(64 << 10),
-        );
-        let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
-        let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
-        let mut info = DocInfo { pages: vec![page.clone(), page], ..Default::default() };
-        Inspector::new(&doc).fill(&mut info);
-        let notes = &info.annotations;
-        assert_eq!(notes.iter().filter(|a| a.contents.as_deref() == Some("note")).count(), 1);
-        assert!(notes.iter().all(|a| a.page == 0), "the shared array is the first page's");
-        assert!(notes.len() > 1);
-        assert!(notes.iter().map(retained).sum::<usize>() <= MAX_ANNOTATION_BYTES);
-    }
-
-    /// A link reached through an indirect object that holds only a reference to it is the same
-    /// annotation as the link itself, and so is a page array reached the same way: each is listed once.
-    #[test]
-    fn an_annotation_reached_through_a_reference_chain_is_listed_once() {
-        let pdf = "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 7 0 R >> endobj\n\
-             4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 8 0 R >> endobj\n\
-             5 0 obj 6 0 R endobj\n\
-             6 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 1 1] /A << /S /URI /URI (https://example.com) >> >> endobj\n\
-             7 0 obj [5 0 R 6 0 R] endobj\n\
-             8 0 obj 7 0 R endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF";
-        let mut doc = Document::load_mem(pdf.as_bytes()).expect("loads");
-        let mut saved = Vec::new();
-        doc.save_to(&mut saved).expect("saves");
-        let lazy = LazyStructure::new(Arc::new(saved), None).expect("opens");
-        let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
-        for reader in [&doc as &dyn Structure, &lazy] {
-            let mut info = DocInfo { pages: vec![page.clone(), page.clone()], ..Default::default() };
-            Inspector::new(reader).fill(&mut info);
-            assert_eq!(info.links.len(), 1, "{:?}", info.links);
-        }
-    }
-
-    /// A conversion rejected as too long, or trimmed short or to nothing, still spends the raw
-    /// length, so a string many entries share is converted only a few times.
-    #[test]
-    fn rejected_text_conversions_spend_the_budget() {
-        let mut budget = 10;
-        let mut conversions = 0;
-        for _ in 0..10 {
-            // Each 0xFF becomes the three-byte replacement character.
-            let kept = spend(&[0xFF; 5], &mut budget, |b| {
-                conversions += 1;
-                String::from_utf8_lossy(b).into_owned()
-            });
-            assert_eq!(kept, None);
-        }
-        assert_eq!((conversions, budget), (2, 0));
-
-        let pdf = "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [] /Count 0 >> endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF";
-        let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
-        let d = Dictionary::from_iter([("Contents", Object::string_literal("   "))]);
-        let mut budget = 10;
-        assert_eq!(Inspector::new(&doc).budgeted_text(&d, b"Contents", &mut budget), None);
-        assert_eq!(budget, 7);
-        // Text that trims short spends its raw length.
-        let d = Dictionary::from_iter([("Contents", Object::string_literal("      x"))]);
-        let mut budget = 10;
-        assert_eq!(Inspector::new(&doc).budgeted_text(&d, b"Contents", &mut budget).as_deref(), Some("x"));
-        assert_eq!(budget, 3);
-    }
-
-    /// An annotation attachment's `/Contents` spends the text budget only when it names the
-    /// attachment, so long descriptions of named files leave a later web address listed.
-    #[test]
-    fn a_named_attachment_leaves_its_contents_unspent() {
-        let files = "<< /Subtype /FileAttachment /Rect [0 0 1 1] /Contents 6 0 R /FS << /F (a.txt) >> >> ".repeat(20);
-        // Longer than what 20 MiB of charged `/Contents` would leave of the 16 MiB budget.
-        let uri = format!("https://example.com/{}", "a".repeat(2 << 20));
-        let pdf = format!(
-            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{files} \
-             << /Subtype /Link /Rect [0 0 1 1] /A << /S /URI /URI ({uri}) >> >>] >> endobj\n\
-             6 0 obj ({}) endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            "x".repeat(1 << 20),
-        );
-        let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
-        let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
-        let mut info = DocInfo { pages: vec![page], ..Default::default() };
-        Inspector::new(&doc).fill(&mut info);
-        assert!(info.attachments.iter().all(|a| a.name == "a.txt"));
-        assert_eq!(info.links.len(), 1);
-        assert!(matches!(&info.links[0].target, LinkTarget::Uri(u) if *u == uri));
-    }
-
-    /// Embedded files whose name-tree keys share one long string keep it, as key and as name, only
-    /// within `MAX_LINK_ATTACHMENT_TEXT_BYTES`.
-    #[test]
-    fn embedded_file_keys_sharing_a_long_string_keep_it_within_a_budget() {
-        let entries = "4 0 R << /Type /Filespec >> ".repeat(20);
-        let pdf = format!(
-            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [{entries}] >> >> >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [] /Count 0 >> endobj\n\
-             4 0 obj ({}) endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            "x".repeat(1 << 20),
-        );
-        let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
-        let mut info = DocInfo::default();
-        Inspector::new(&doc).fill(&mut info);
-        let kept: usize =
-            info.attachments.iter().map(|a| a.name.len() + if let AttachmentSource::Document { key } = &a.source { key.len() } else { 0 }).sum();
-        assert!(!info.attachments.is_empty());
-        // Past the budget an attachment still has the generic name.
-        let generic = info.attachments.len() * "attachment".len();
-        assert!(kept <= MAX_LINK_ATTACHMENT_TEXT_BYTES + generic, "{kept} bytes kept");
-    }
-
-    /// An embedded file the listing keeps is extracted, though earlier keys the listing could not
-    /// keep would fill a fresh key budget before it.
-    #[test]
-    fn a_listed_embedded_file_is_extracted_past_keys_the_listing_left_out() {
-        let skipped = "6 0 R 7 0 R ".repeat(9);
-        let pdf = format!(
-            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [{skipped}(b.txt) 9 0 R] >> >> >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [\
-             << /Subtype /Link /Rect [0 0 1 1] /A << /S /URI /URI ({}) >> >>] >> endobj\n\
-             6 0 obj ({}) endobj\n\
-             7 0 obj << /Type /Filespec /F (a.txt) >> endobj\n\
-             8 0 obj << /Type /EmbeddedFile /Length 5 >> stream\nhello\nendstream endobj\n\
-             9 0 obj << /Type /Filespec /F (b.txt) /EF << /F 8 0 R >> >> endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            "u".repeat(15 << 20),
-            "k".repeat(2 << 20),
-        );
-        let bytes = Arc::new(pdf.into_bytes());
-        let info = inspect(bytes.clone(), None).expect("opens");
-        let listed = info.attachments.iter().find(|a| a.name == "b.txt").expect("b.txt is listed");
-        assert_eq!(attachment_data(&bytes, None, listed).as_deref(), Ok(&b"hello"[..]));
-    }
-
-    /// Links and attachments sharing one long string each keep a copy only within
-    /// `MAX_LINK_ATTACHMENT_TEXT_BYTES`, and every one is still listed.
-    #[test]
-    fn links_and_attachments_sharing_a_long_string_keep_it_within_a_budget() {
-        const EACH: usize = 20;
-        let links = "<< /Subtype /Link /Rect [0 0 1 1] /A 5 0 R >> ".repeat(EACH);
-        let files = "<< /Subtype /FileAttachment /Rect [0 0 1 1] /FS 7 0 R >> ".repeat(EACH);
-        let pdf = format!(
-            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{links} {files}] >> endobj\n\
-             5 0 obj << /S /URI /URI 6 0 R >> endobj\n\
-             6 0 obj ({}) endobj\n\
-             7 0 obj << /Type /Filespec /F (a.txt) /Desc 6 0 R >> endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            "x".repeat(1 << 20),
-        );
-        let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
-        let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
-        let mut info = DocInfo { pages: vec![page], ..Default::default() };
-        Inspector::new(&doc).fill(&mut info);
-        assert_eq!(info.links.len(), EACH);
-        assert_eq!(info.attachments.len(), EACH);
-        let uris = info.links.iter().map(|l| if let LinkTarget::Uri(u) = &l.target { u.len() } else { 0 });
-        let descriptions = info.attachments.iter().map(|a| a.description.as_ref().map_or(0, String::len));
-        let kept: usize = uris.chain(descriptions).sum();
-        assert!(kept > 0 && kept <= MAX_LINK_ATTACHMENT_TEXT_BYTES, "{kept} bytes kept");
-        assert!(info.links.iter().any(|l| matches!(&l.target, LinkTarget::Other(s) if s == "URI")));
-    }
-
-    /// Links and attachments after the comment budget fills are still listed, and a JavaScript link
-    /// among them still marks the document.
-    #[test]
-    fn links_and_attachments_past_the_comment_budget_are_listed() {
-        let small = "<< /Subtype /Text /Rect [0 0 1 1] /Contents 6 0 R >> ".repeat(1100);
-        let pdf = format!(
-            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{small} \
-             << /Subtype /Link /Rect [0 0 1 1] /A << /S /JavaScript /JS (1) >> >>] >> endobj\n\
-             4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [\
-             << /Subtype /FileAttachment /Rect [0 0 1 1] /FS << /Type /Filespec /F (a.txt) >> >>] >> endobj\n\
-             6 0 obj ({}) endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
-            "x".repeat(64 << 10),
-        );
-        let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
-        let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
-        let mut info = DocInfo { pages: vec![page.clone(), page], ..Default::default() };
-        Inspector::new(&doc).fill(&mut info);
-        assert!(info.annotations.len() < 1100, "the comment budget filled");
-        assert_eq!(info.links.len(), 1);
-        assert!(info.has_javascript);
-        assert_eq!(info.attachments.len(), 1);
-    }
-
-    /// Widgets without `/P` are placed on the page that lists them with one pass over the pages'
-    /// `/Annots`, not a search of every page per field: that was O(fields × annotations), a
-    /// second to open a form of 8,000 fields. A widget two pages list is on the first of them.
-    #[test]
-    fn widgets_without_a_page_entry_are_placed_in_one_pass() {
-        const PAGES: usize = 100;
-        const PER_PAGE: usize = 10;
-        let field = |p: usize, k: usize| 4 + PAGES + p * PER_PAGE + k;
-        let mut pdf = String::from("%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm 3 0 R >> endobj\n");
-        let kids: Vec<String> = (0..PAGES).map(|p| format!("{} 0 R", 4 + p)).collect();
-        pdf += &format!("2 0 obj << /Type /Pages /Kids [{}] /Count {PAGES} >> endobj\n", kids.join(" "));
-        let fields: Vec<String> = (0..PAGES).flat_map(|p| (0..PER_PAGE).map(move |k| format!("{} 0 R", field(p, k)))).collect();
-        pdf += &format!("3 0 obj << /Fields [{}] >> endobj\n", fields.join(" "));
-        for p in 0..PAGES {
-            let mut annots: Vec<String> = (0..PER_PAGE).map(|k| format!("{} 0 R", field(p, k))).collect();
-            // The last page lists the first page's first widget too.
-            if p == PAGES - 1 {
-                annots.push(format!("{} 0 R", field(0, 0)));
-            }
-            pdf += &format!("{} 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{}] >> endobj\n", 4 + p, annots.join(" "));
-        }
-        for p in 0..PAGES {
-            for k in 0..PER_PAGE {
-                pdf += &format!("{} 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (f{p}_{k}) /Rect [10 10 90 30] >> endobj\n", field(p, k));
-            }
-        }
-        pdf += "trailer << /Root 1 0 R >>\n%%EOF";
-        let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
-        let counting = CountingReads { doc: &doc, reads: std::cell::Cell::new(0) };
-        let mut info = DocInfo {
-            pages: (0..PAGES)
-                .map(|_| PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() })
-                .collect(),
-            ..Default::default()
-        };
-        Inspector::new(&counting).fill(&mut info);
-        let placed: Vec<_> = info.fields.iter().map(|f| (f.name.clone(), f.page)).collect();
-        let want: Vec<_> = (0..PAGES).flat_map(|p| (0..PER_PAGE).map(move |k| (format!("f{p}_{k}"), Some(p)))).collect();
-        assert_eq!(placed, want);
-        // A handful of reads per page and field; searching the pages for each field read the
-        // page dictionaries about 50,000 times.
-        let reads = counting.reads.get();
-        assert!(reads < 20 * (PAGES + PAGES * PER_PAGE), "{reads} object reads");
-    }
-
-    /// #2365: the issue's fixture is two PDFs concatenated, the second cut off before its
-    /// cross-reference data, and the first's only trailer is a cross-reference stream. The
-    /// lazy reader refuses a file that needed repair, and lopdf's rebuild found no `trailer`
-    /// keyword and failed, so Document Properties showed every field empty. The rebuild now
-    /// takes the cross-reference stream's dictionary as the trailer.
-    #[test]
-    fn rebuilt_file_keeps_the_info_of_its_cross_reference_stream() {
-        let header = "%PDF-1.5\n";
-        let obj1 = "1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\n";
-        let obj2 = "2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>>endobj\n";
-        let obj3 = "3 0 obj<</Type/Page/Parent 2 0 R/MediaBox[0 0 10 10]>>endobj\n";
-        let obj4 = "4 0 obj<</Title(Kept)/Creator(Me)>>endobj\n";
-        let o1 = header.len();
-        let o2 = o1 + obj1.len();
-        let o3 = o2 + obj2.len();
-        let o4 = o3 + obj3.len();
-        let o5 = o4 + obj4.len();
-        let rows: Vec<u8> =
-            [[0u8, 0, 0, 255], [1, 0, o1 as u8, 0], [1, 0, o2 as u8, 0], [1, 0, o3 as u8, 0], [1, 0, o4 as u8, 0], [1, (o5 >> 8) as u8, o5 as u8, 0]]
-                .concat();
-        let mut bytes = format!("{header}{obj1}{obj2}{obj3}{obj4}").into_bytes();
-        bytes.extend_from_slice(format!("5 0 obj<</Type/XRef/Root 1 0 R/Info 4 0 R/Size 6/W[1 2 1]/Length {}>>stream\n", rows.len()).as_bytes());
-        bytes.extend_from_slice(&rows);
-        // A wrong startxref, and a second file after %%EOF: every reader rebuilds the table.
-        bytes.extend_from_slice(b"\nendstream\nendobj\nstartxref\n999999\n%%EOF\n%PDF-1.3\n");
-        bytes.extend_from_slice(&[b'x'; 1024]);
-
-        let info = inspect(Arc::new(bytes), None).unwrap();
-        assert_eq!(info.pages.len(), 1);
-        assert_eq!(info.title.as_deref(), Some("Kept"));
-        assert_eq!(info.creator.as_deref(), Some("Me"));
-    }
-
-    /// #2365 review: the rebuild prefers a trailer whose /Root is the catalog. A later
-    /// cross-reference stream whose /Root points at the Info dictionary used to replace the
-    /// earlier `trailer`, so Document Properties lost the catalog it should have read.
-    #[test]
-    fn rebuilt_file_prefers_a_trailer_whose_root_is_the_catalog() {
-        let mut bytes = b"%PDF-1.5\n".to_vec();
-        for body in [
-            "<</Type/Catalog/Pages 2 0 R>>",
-            "<</Type/Pages/Kids[3 0 R]/Count 1>>",
-            "<</Type/Page/Parent 2 0 R/MediaBox[0 0 10 10]>>",
-            "<</Title(Kept)/Creator(Me)>>",
-        ] {
-            let n = bytes.iter().filter(|b| **b == b'\n').count();
-            bytes.extend_from_slice(format!("{n} 0 obj{body}endobj\n").as_bytes());
-        }
-        bytes.extend_from_slice(b"trailer\n<</Size 5/Root 1 0 R/Info 4 0 R>>\n");
-        bytes.extend_from_slice(b"5 0 obj<</Type/XRef/Root 4 0 R/Size 6/W[1 2 1]/Length 4>>stream\n\x01\x00\x09\x00\nendstream\nendobj\n");
-        // A wrong startxref, and a second file after %%EOF: every reader rebuilds the table.
-        bytes.extend_from_slice(b"startxref\n999999\n%%EOF\n%PDF-1.3\n");
-        bytes.extend_from_slice(&[b'x'; 1024]);
-
-        let info = inspect(Arc::new(bytes.clone()), None).unwrap();
-        assert_eq!(info.pages.len(), 1);
-        assert_eq!(info.title.as_deref(), Some("Kept"));
-        // A later stream whose /Root names the catalog's number with another generation does
-        // not count either: loading `1 1 R` finds no such object.
-        let at = bytes.windows(10).position(|w| w == b"/Root 4 0 ").unwrap();
-        bytes[at..at + 10].copy_from_slice(b"/Root 1 1 ");
-        let info = inspect(Arc::new(bytes), None).unwrap();
-        assert_eq!((info.pages.len(), info.title.as_deref()), (1, Some("Kept")));
-    }
-
-    #[test]
-    fn lazy_structure_matches_the_compatibility_inspector() {
-        // Each fixture as lopdf writes it, and with its objects in object streams.
-        let packed = |bytes: &[u8]| {
-            let doc = pdfcraft_cos::Document::open(Arc::new(bytes.to_vec())).unwrap();
-            pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions { object_streams: true, ..Default::default() }).unwrap()
-        };
-        let fixtures = [ATTACHMENTS, LAYERS, DESTS].into_iter().flat_map(|bytes| {
-            let mut original = Document::load_mem(bytes).unwrap();
-            let mut plain = Vec::new();
-            original.save_to(&mut plain).unwrap();
-            let stm = packed(&plain);
-            [plain, stm]
-        });
-        for bytes in fixtures {
-            let lazy = LazyStructure::new(Arc::new(bytes.clone()), None).unwrap();
-            let eager = Document::load_mem(&bytes).unwrap();
-            let mut a = inspect(Arc::new(bytes), None).unwrap();
-            let mut b = DocInfo { pages: a.pages.clone(), ..Default::default() };
-            let mut c = DocInfo { pages: a.pages.clone(), ..Default::default() };
-            Inspector::new(&lazy).fill(&mut b);
-            Inspector::new(&eager).fill(&mut c);
-            assert!(!lazy.failed());
-            assert_eq!(format!("{b:?}"), format!("{c:?}"));
-            a.file_size = 0;
-            a.pdf_version.clear();
-            assert_eq!(format!("{a:?}"), format!("{c:?}"));
-        }
-    }
-
-    #[test]
-    fn links_read_set_layer_actions() {
-        let info = inspect(Arc::new(LAYERS.to_vec()), None).expect("opens");
-        let targets: Vec<_> = info.links.iter().map(|l| l.target.clone()).collect();
-        use LayerOp::{Off, On, Toggle};
-        assert_eq!(
-            targets,
-            [
-                // Groups before the first name or after an unknown one are skipped, and so is
-                // anything that isn't a group.
-                LinkTarget::SetLayers { changes: vec![(On, (6, 0)), (Toggle, (5, 0)), (Toggle, (7, 0))], preserve_rb: false },
-                // An indirect /State; /PreserveRB defaults to true.
-                LinkTarget::SetLayers { changes: vec![(Off, (5, 0))], preserve_rb: true },
-            ]
-        );
-    }
-
-    /// #4168: a Launch action naming a `.pdf` file is read as the link to that file it amounts
-    /// to, `\` separators included, and a stray `/D` (which Launch has no use for) doesn't stop
-    /// it. One naming anything else, with no file, or with `/Win` launch parameters stays an
-    /// action that isn't followed.
-    #[test]
-    fn launch_actions_that_name_a_pdf_open_it_like_a_remote_link() {
-        let pdf = "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /Annots [30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R] >> endobj\n\
-             30 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 10 10] /A << /S /Launch /F (..\\\\se\\\\se_ST.pdf) >> >> endobj\n\
-             31 0 obj << /Type /Annot /Subtype /Link /Rect [0 20 10 30] /A << /S /Launch /F << /Type /Filespec /F (chapters/Two.PDF) >> /NewWindow true >> >> endobj\n\
-             32 0 obj << /Type /Annot /Subtype /Link /Rect [0 40 10 50] /A << /S /Launch /F (tool.exe) >> >> endobj\n\
-             33 0 obj << /Type /Annot /Subtype /Link /Rect [0 60 10 70] /A << /S /Launch /F (a.pdf) /Win << /F (cmd.exe) /P (/c x) >> >> >> endobj\n\
-             34 0 obj << /Type /Annot /Subtype /Link /Rect [0 80 10 90] /A << /S /Launch /Win << /F (b.pdf) >> >> >> endobj\n\
-             35 0 obj << /Type /Annot /Subtype /Link /Rect [0 100 10 110] /A << /S /Launch /F (.pdf) >> >> endobj\n\
-             36 0 obj << /Type /Annot /Subtype /Link /Rect [0 120 10 130] /A << /S /Launch /F (dir/a\\\\b.pdf) >> >> endobj\n\
-             37 0 obj << /Type /Annot /Subtype /Link /Rect [0 140 10 150] /A << /S /Launch /FS /URL /F (https://example.com/x.pdf) >> >> endobj\n\
-             38 0 obj << /Type /Annot /Subtype /Link /Rect [0 160 10 170] /A << /S /Launch /F (c.pdf) /D 0 >> >> endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF";
-        let info = inspect(Arc::new(pdf.as_bytes().to_vec()), None).expect("opens");
-        let targets: Vec<_> = info.links.iter().map(|l| l.target.clone()).collect();
-        let launch =
-            |file: &str, new_window| LinkTarget::RemoteGoTo { launch: true, file: file.into(), destination: RemoteDestination::Default, new_window };
-        let other = || LinkTarget::Other("Launch".into());
-        assert_eq!(
-            targets,
-            [
-                launch("../se/se_ST.pdf", None),
-                launch("chapters/Two.PDF", Some(true)),
-                other(),
-                other(),
-                other(),
-                other(),
-                launch("dir/a\\b.pdf", None),
-                other(),
-                launch("c.pdf", None),
-            ]
-        );
-    }
-
-    #[test]
-    fn links_read_bounded_local_remote_go_to_actions() {
-        use DestView::{Fit, Xyz};
-        let too_long = "a".repeat(MAX_REMOTE_FILE_SPEC_BYTES + 1);
-        let wide_file = format!("<FEFF{}>", "4E00".repeat(1400));
-        let wide_name = format!("<FEFF{}>", "4E00".repeat(342));
-        let pdf = format!(
-            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /Annots [99 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R] >> endobj\n\
-             30 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 10 10] /A << /S /GoToR /F (chapters/remote.pdf) /D [2 /XYZ 10 20 1.5] /NewWindow true >> >> endobj\n\
-             31 0 obj << /Type /Annot /Subtype /Link /Rect [0 20 10 30] /A << /S /GoToR /F << /Type /Filespec /F (fallback.pdf) /UF <FEFF0066006F006F002E007000640066> >> /D [0 /Fit] /NewWindow false >> >> endobj\n\
-             32 0 obj << /Type /Annot /Subtype /Link /Rect [0 40 10 50] /A << /S /GoToR /F (remote.pdf) >> >> endobj\n\
-             33 0 obj << /Type /Annot /Subtype /Link /Rect [0 60 10 70] /A << /S /GoToR /F (chapter.pdf) /D (chapter) >> >> endobj\n\
-             34 0 obj << /Type /Annot /Subtype /Link /Rect [0 80 10 90] /A << /S /GoToR /FS /URL /F (https://example.com) /D [0 /Fit] >> >> endobj\n\
-             35 0 obj << /Type /Annot /Subtype /Link /Rect [0 100 10 110] /A << /S /GoToR /F ({too_long}) /D [0 /Fit] >> >> endobj\n\
-             36 0 obj << /Type /Annot /Subtype /Link /Rect [0 120 10 130] /A << /S /GoToR /F (chapter.pdf) /D /chapter >> >> endobj\n\
-             37 0 obj << /Type /Annot /Subtype /Link /Rect [0 140 10 150] /A << /S /GoToR /F (chapter.pdf) /D [-1 /Fit] >> >> endobj\n\
-             38 0 obj << /Type /Annot /Subtype /Link /Rect [0 160 10 170] /A << /S /GoToR /F (chapter.pdf) /D [1.5 /Fit] >> >> endobj\n\
-             39 0 obj << /Type /Annot /Subtype /Link /Rect [0 180 10 190] /A << /S /GoToR /F (chapter.pdf) /D [9223372036854775807 /Fit] >> >> endobj\n\
-             40 0 obj << /Type /Annot /Subtype /Link /Rect [0 200 10 210] /A << /S /GoToR /F << /Type /Filespec /UF {wide_file} >> /D [0 /Fit] >> >> endobj\n\
-             41 0 obj << /Type /Annot /Subtype /Link /Rect [0 220 10 230] /A << /S /GoToR /F (chapter.pdf) /D {wide_name} >> >> endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF"
-        );
-        let info = inspect(Arc::new(pdf.into_bytes()), None).expect("opens");
-        let targets: Vec<_> = info.links.iter().map(|l| (l.index, l.target.clone())).collect();
-        let huge_page_target = usize::try_from(i64::MAX)
-            .map(|page| LinkTarget::RemoteGoTo {
-                launch: false,
-                file: "chapter.pdf".into(),
-                destination: RemoteDestination::Page { page, view: Fit },
-                new_window: None,
-            })
-            .unwrap_or_else(|_| LinkTarget::Other("GoToR".into()));
-        assert_eq!(
-            targets,
-            [
-                (
-                    1,
-                    LinkTarget::RemoteGoTo {
-                        launch: false,
-                        file: "chapters/remote.pdf".into(),
-                        destination: RemoteDestination::Page { page: 2, view: Xyz { left: Some(10.0), top: Some(20.0), zoom: Some(1.5) } },
-                        new_window: Some(true),
-                    }
-                ),
-                (
-                    2,
-                    LinkTarget::RemoteGoTo {
-                        launch: false,
-                        file: "foo.pdf".into(),
-                        destination: RemoteDestination::Page { page: 0, view: Fit },
-                        new_window: Some(false),
-                    }
-                ),
-                (3, LinkTarget::RemoteGoTo { launch: false, file: "remote.pdf".into(), destination: RemoteDestination::Default, new_window: None }),
-                (
-                    4,
-                    LinkTarget::RemoteGoTo {
-                        launch: false,
-                        file: "chapter.pdf".into(),
-                        destination: RemoteDestination::Named("chapter".into()),
-                        new_window: None
-                    }
-                ),
-                (5, LinkTarget::Other("GoToR".into())),
-                (6, LinkTarget::Other("GoToR".into())),
-                (
-                    7,
-                    LinkTarget::RemoteGoTo {
-                        launch: false,
-                        file: "chapter.pdf".into(),
-                        destination: RemoteDestination::Named("chapter".into()),
-                        new_window: None
-                    }
-                ),
-                (8, LinkTarget::Other("GoToR".into())),
-                (9, LinkTarget::Other("GoToR".into())),
-                (10, huge_page_target),
-                (11, LinkTarget::Other("GoToR".into())),
-                (12, LinkTarget::Other("GoToR".into())),
-            ]
-        );
-    }
-
-    #[test]
-    fn destination_operands_become_views() {
-        use DestView::*;
-        let v = |kind: &[u8], ops: &[Option<f32>]| DestView::from_operands(Some(kind), ops);
-        // ISO 32000-2 Table 149, each type.
-        assert_eq!(v(b"XYZ", &[Some(0.0), Some(420.0), Some(0.0)]), Xyz { left: Some(0.0), top: Some(420.0), zoom: None });
-        assert_eq!(v(b"XYZ", &[Some(72.0), Some(500.0), Some(1.5)]), Xyz { left: Some(72.0), top: Some(500.0), zoom: Some(1.5) });
-        assert_eq!(v(b"Fit", &[]), Fit);
-        assert_eq!(v(b"FitB", &[]), Fit);
-        assert_eq!(v(b"FitH", &[Some(250.0)]), FitH { top: Some(250.0) });
-        assert_eq!(v(b"FitBH", &[None]), FitH { top: None });
-        assert_eq!(v(b"FitV", &[Some(120.0)]), FitV { left: Some(120.0) });
-        assert_eq!(v(b"FitBV", &[Some(5.0)]), FitV { left: Some(5.0) });
-        // FitR's corners are normalized.
-        assert_eq!(v(b"FitR", &[Some(110.0), Some(220.0), Some(10.0), Some(20.0)]), FitR { rect: [10.0, 20.0, 110.0, 220.0] });
-        // Missing operands are null; so are non-finite ones, and a zoom that isn't positive.
-        assert_eq!(v(b"XYZ", &[]), Xyz { left: None, top: None, zoom: None });
-        assert_eq!(v(b"XYZ", &[Some(f32::NAN), Some(f32::INFINITY), Some(f32::NEG_INFINITY)]), Xyz { left: None, top: None, zoom: None });
-        assert_eq!(v(b"XYZ", &[None, Some(-5.0), Some(-1.0)]), Xyz { left: None, top: Some(-5.0), zoom: None });
-        assert_eq!(v(b"XYZ", &[None, None, Some(f32::NAN)]), Xyz { left: None, top: None, zoom: None });
-        assert_eq!(v(b"FitH", &[Some(f32::NAN)]), FitH { top: None });
-        // A FitR without four usable numbers, an unknown type or no type: the top of the page.
-        assert_eq!(v(b"FitR", &[Some(1.0), Some(2.0)]), Top);
-        assert_eq!(v(b"FitR", &[Some(1.0), Some(2.0), Some(f32::INFINITY), Some(4.0)]), Top);
-        assert_eq!(v(b"Zoom", &[Some(3.0)]), Top);
-        assert_eq!(v(b"xyz", &[Some(3.0)]), Top);
-        assert_eq!(DestView::from_operands(None, &[Some(1.0)]), Top);
-    }
-
-    /// Two 300×400 pages. Bookmarks and links on page 1 go to page 2 in every destination form,
-    /// named (`/Names /Dests` and the PDF 1.1 `/Dests`) and malformed.
-    const DESTS: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R /Outlines 10 0 R /Names << /Dests 40 0 R >> /Dests << /old << /D [4 0 R /FitV 120] >> >> >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 400] >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /Annots [30 0 R 31 0 R 32 0 R 33 0 R] >> endobj
-4 0 obj << /Type /Page /Parent 2 0 R >> endobj
-10 0 obj << /Type /Outlines /First 11 0 R /Last 20 0 R /Count 10 >> endobj
-11 0 obj << /Title (xyz) /Parent 10 0 R /Next 12 0 R /Dest [4 0 R /XYZ 0 420 0] >> endobj
-12 0 obj << /Title (fith) /Parent 10 0 R /Next 13 0 R /Dest [4 0 R /FitH 250] >> endobj
-13 0 obj << /Title (named) /Parent 10 0 R /Next 14 0 R /Dest (sec) >> endobj
-14 0 obj << /Title (old named) /Parent 10 0 R /Next 15 0 R /Dest /old >> endobj
-15 0 obj << /Title (action) /Parent 10 0 R /Next 16 0 R /A << /S /GoTo /D [4 0 R /FitR 110 220 10 20] >> >> endobj
-16 0 obj << /Title (wrong types) /Parent 10 0 R /Next 17 0 R /Dest [4 0 R /XYZ (left) /Top true] >> endobj
-17 0 obj << /Title (short) /Parent 10 0 R /Next 18 0 R /Dest [4 0 R /FitR 1 2] >> endobj
-18 0 obj << /Title (no type) /Parent 10 0 R /Next 19 0 R /Dest [4 0 R] >> endobj
-19 0 obj << /Title (huge) /Parent 10 0 R /Next 20 0 R /Dest [4 0 R /XYZ 1000000000000 -5 -1] >> endobj
-20 0 obj << /Title (no page) /Parent 10 0 R /Dest [/XYZ 0 420 0] >> endobj
-30 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 10 10] /Dest [4 0 R /XYZ 72 500 1.5] >> endobj
-31 0 obj << /Type /Annot /Subtype /Link /Rect [0 20 10 30] /A << /S /GoTo /D (sec) >> >> endobj
-32 0 obj << /Type /Annot /Subtype /Link /Rect [0 40 10 50] /Dest [4 0 R /FitBH 100] >> endobj
-33 0 obj << /Type /Annot /Subtype /Link /Rect [0 60 10 70] /Dest [4 0 R /Fit] >> endobj
-40 0 obj << /Names [(sec) << /D [4 0 R /XYZ null 300 2] >>] >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-
-    #[test]
-    fn bookmarks_and_links_keep_their_destination_view() {
-        use DestView::*;
-        let info = inspect(Arc::new(DESTS.to_vec()), None).expect("opens");
-        let outline: Vec<_> = info.outline.iter().map(|o| (o.title.as_str(), o.page, o.view)).collect();
-        assert_eq!(
-            outline,
-            [
-                ("xyz", Some(1), Xyz { left: Some(0.0), top: Some(420.0), zoom: None }),
-                ("fith", Some(1), FitH { top: Some(250.0) }),
-                ("named", Some(1), Xyz { left: None, top: Some(300.0), zoom: Some(2.0) }),
-                ("old named", Some(1), FitV { left: Some(120.0) }),
-                ("action", Some(1), FitR { rect: [10.0, 20.0, 110.0, 220.0] }),
-                // Hostile operands fall back without failing the bookmark.
-                ("wrong types", Some(1), Xyz { left: None, top: None, zoom: None }),
-                ("short", Some(1), Top),
-                ("no type", Some(1), Top),
-                ("huge", Some(1), Xyz { left: Some(1e12), top: Some(-5.0), zoom: None }),
-                ("no page", None, Top),
-            ]
-        );
-        let links: Vec<_> = info.links.iter().map(|l| l.target.clone()).collect();
-        assert_eq!(
-            links,
-            [
-                LinkTarget::Page(1, Xyz { left: Some(72.0), top: Some(500.0), zoom: Some(1.5) }),
-                LinkTarget::Page(1, Xyz { left: None, top: Some(300.0), zoom: Some(2.0) }),
-                LinkTarget::Page(1, FitH { top: Some(100.0) }),
-                LinkTarget::Page(1, Fit),
-            ]
-        );
-    }
-
-    #[test]
-    fn outline_titles_decode_every_text_string_encoding() {
-        // Issue #142: CJK bookmark titles showed as mojibake or with a stray BOM.
-        let pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R /Outlines 10 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R >> endobj
-10 0 obj << /Type /Outlines /First 11 0 R /Last 16 0 R /Count 6 >> endobj
-11 0 obj << /Title <FEFF7B2C4E007AE0> /Parent 10 0 R /Next 12 0 R /Dest [3 0 R /Fit] >> endobj
-12 0 obj << /Title <EFBBBFE79BAEE5BD95> /Parent 10 0 R /Next 13 0 R /Dest [3 0 R /Fit] >> endobj
-13 0 obj << /Title <EFBBBF41FF42> /Parent 10 0 R /Next 14 0 R /Dest [3 0 R /Fit] >> endobj
-14 0 obj << /Title <E6A682E8BFB0> /Parent 10 0 R /Next 15 0 R /Dest [3 0 R /Fit] >> endobj
-15 0 obj << /Title <436166E9> /Parent 10 0 R /Next 16 0 R /Dest [3 0 R /Fit] >> endobj
-16 0 obj << /Title <FEFFFEFF0041> /Parent 10 0 R /Dest [3 0 R /Fit] >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let info = inspect(Arc::new(pdf.to_vec()), None).expect("opens");
-        let titles: Vec<_> = info.outline.iter().map(|o| o.title.as_str()).collect();
-        // UTF-16BE, UTF-8 with BOM, invalid UTF-8 after a BOM (lossy, not dropped), BOM-less
-        // raw UTF-8, PDFDocEncoding Latin-1, and a doubled BOM.
-        assert_eq!(titles, ["第一章", "目录", "A\u{FFFD}B", "概述", "Café", "A"]);
-    }
-
-    #[test]
-    fn xfa_dynamic_render_is_read_from_config_acrobat7_only() {
-        let text = xfa_config_dynamic_render;
-        let config =
-            |inner: &str| format!("<config xmlns=\"http://www.xfa.org/schema/xci/3.0/\"><acrobat><acrobat7>{inner}</acrobat7></acrobat></config>");
-        // Designer's style: a line break before each `>`.
-        assert_eq!(
-            text("<config\n><acrobat\n><acrobat7\n><dynamicRender\n>forbidden</dynamicRender\n></acrobat7\n></acrobat\n></config\n>").as_deref(),
-            Some("forbidden")
-        );
-        assert_eq!(text(&config("<xci:dynamicRender> required </xci:dynamicRender>")).as_deref(), Some("required"));
-        // Commented out, in CDATA, or a longer name: not the element.
-        assert_eq!(text(&config("<!-- a > b <dynamicRender>forbidden</dynamicRender> -->")), None);
-        assert_eq!(text(&config("<![CDATA[ a > b <dynamicRender>forbidden</dynamicRender> ]]>")), None);
-        assert_eq!(text(&config("<dynamicRenderX>forbidden</dynamicRenderX>")), None);
-        // Self-closing, empty, or holding markup: no value.
-        assert_eq!(text(&config("<dynamicRender/>")), None);
-        assert_eq!(text(&config("<dynamicRender></dynamicRender>")), None);
-        assert_eq!(text(&config("<dynamicRender><b>forbidden</b></dynamicRender>")), None);
-        // Closing tags that don't match what they close: malformed, no value (review on #3192).
-        assert_eq!(text(&config("<dynamicRender>forbidden</other>")), None);
-        assert_eq!(text("<config><acrobat><acrobat7><dynamicRender>forbidden</dynamicRender></acrobat></acrobat7></config>"), None);
-        // The same name anywhere but config/acrobat/acrobat7 (form data, another config branch).
-        let xdp = "<xdp:xdp><xfa:datasets><xfa:data><dynamicRender>forbidden</dynamicRender></xfa:data></xfa:datasets><config><present><dynamicRender>forbidden</dynamicRender></present></config></xdp:xdp>";
-        assert_eq!(text(xdp), None);
-        // A whole XDP with the config after the template.
-        let xdp = format!("<xdp:xdp><template><subform/></template>{}</xdp:xdp>", config("<dynamicRender>forbidden</dynamicRender>"));
-        assert_eq!(text(&xdp).as_deref(), Some("forbidden"));
-        // A whole config path inside the form data, before the real config packet, is data: the
-        // real packet's value counts (review on #3192).
-        let xdp = format!(
-            "<?xml version=\"1.0\"?><xdp:xdp><xfa:datasets><xfa:data>{}</xfa:data></xfa:datasets>{}</xdp:xdp>",
-            config("<dynamicRender>forbidden</dynamicRender>"),
-            config("<dynamicRender>required</dynamicRender>")
-        );
-        assert_eq!(text(&xdp).as_deref(), Some("required"));
-        // Only in the data, or nested in the template: no configuration at all.
-        let xdp =
-            format!("<xdp:xdp><xfa:datasets><xfa:data>{}</xfa:data></xfa:datasets></xdp:xdp>", config("<dynamicRender>forbidden</dynamicRender>"));
-        assert_eq!(text(&xdp), None);
-        let xdp = format!("<xdp:xdp><template>{}</template></xdp:xdp>", config("<dynamicRender>forbidden</dynamicRender>"));
-        assert_eq!(text(&xdp), None);
-        // acrobat7 must be a child of acrobat, not deeper.
-        assert_eq!(text("<config><acrobat><x><acrobat7><dynamicRender>forbidden</dynamicRender></acrobat7></x></acrobat></config>"), None);
-        // Cut short anywhere: no panic, nothing read.
-        let whole = config("<!-- x --><dynamicRender>forbidden</dynamicRender>");
-        for end in 0..whole.len() {
-            assert_eq!(text(&whole[..end]), None, "cut at {end}");
-        }
-        assert_eq!(text(&whole).as_deref(), Some("forbidden"));
-    }
-
-    #[test]
-    fn xfa_config_packets_are_read_in_utf16_too() {
-        let xml = "<config><acrobat><acrobat7><dynamicRender>forbidden</dynamicRender></acrobat7></acrobat></config>";
-        let le: Vec<u8> = xml.encode_utf16().flat_map(u16::to_le_bytes).collect();
-        let be: Vec<u8> = xml.encode_utf16().flat_map(u16::to_be_bytes).collect();
-        for bytes in [
-            le.clone(),
-            be.clone(),
-            [&[0xFF, 0xFE][..], &le].concat(),
-            [&[0xFE, 0xFF][..], &be].concat(),
-            [&[0xEF, 0xBB, 0xBF][..], xml.as_bytes()].concat(),
-        ] {
-            assert_eq!(xfa_packet_text(&bytes), xml);
-        }
-        // An odd byte or a broken surrogate doesn't stop the scan.
-        assert!(xfa_packet_text(&[0xFF, 0xFE, b'<', 0, 0x00, 0xD8, b'x']).starts_with('<'));
-    }
-
-    /// #3180: an XFA form with no fields was always taken to be dynamic, so its pages were
-    /// replaced by a layout on open, even when its configuration says it is a static form.
-    #[test]
-    fn an_xfa_form_without_fields_is_static_when_its_config_forbids_dynamic_rendering() {
-        let xfa_of = |config: &str, catalog_extra: &str| {
-            let bodies = [
-                format!("<< /Type /Catalog /Pages 2 0 R {catalog_extra} /AcroForm << /Fields [] /XFA [(config) 4 0 R (template) 5 0 R] >> >>"),
-                "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".to_string(),
-                "<< /Type /Page /Parent 2 0 R >>".to_string(),
-                format!("<< /Length {} >>\nstream\n{config}\nendstream", config.len()),
-                "<< /Length 11 >>\nstream\n<template/>\nendstream".to_string(),
-            ];
-            inspect(Arc::new(pdf_of(&bodies)), None).expect("opens").xfa
-        };
-        let config = |value: &str| {
-            format!(
-                r#"<config xmlns="http://www.xfa.org/schema/xci/3.0/"><acrobat><acrobat7><dynamicRender>{value}</dynamicRender></acrobat7></acrobat></config>"#
-            )
-        };
-        assert_eq!(xfa_of(&config("forbidden"), ""), Some(Xfa::Static));
-        assert_eq!(xfa_of(&config("required"), ""), Some(Xfa::Dynamic));
-        assert_eq!(xfa_of("<config/>", ""), Some(Xfa::Dynamic), "no field and no word from the config: dynamic, as before");
-        assert_eq!(xfa_of(&config("forbidden"), "/NeedsRendering true"), Some(Xfa::Dynamic), "/NeedsRendering still wins");
-    }
-
-    /// A file whose objects are `bodies` in order (object 1 first), with a cross-reference table.
-    fn pdf_of(bodies: &[String]) -> Vec<u8> {
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, body) in bodies.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
-        }
-        let xref = out.len();
-        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", bodies.len() + 1).as_bytes());
-        for o in offsets {
-            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", bodies.len() + 1).as_bytes());
-        out
-    }
-
-    /// A one-page file whose outline is `items` (objects 5, 6, … in order).
-    fn outline_file(items: &[String]) -> Vec<u8> {
-        let mut bodies = vec![
-            "<< /Type /Catalog /Pages 2 0 R /Outlines 4 0 R >>".to_string(),
-            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".to_string(),
-            "<< /Type /Page /Parent 2 0 R >>".to_string(),
-            format!("<< /Type /Outlines /First 5 0 R /Count {} >>", items.len()),
-        ];
-        bodies.extend(items.iter().cloned());
-        pdf_of(&bodies)
-    }
-
-    /// The titles of `items`, with children in brackets (`Parent[Child]`).
-    fn shape(items: &[OutlineItem]) -> Vec<String> {
-        items.iter().map(|o| if o.children.is_empty() { o.title.clone() } else { format!("{}[{}]", o.title, shape(&o.children).join(",")) }).collect()
-    }
-
-    /// #3193: a bookmark's colour and style (ISO 32000-2 §12.3.3, Tables 151 and 152). `/C` is
-    /// three numbers within 0–1 (one outside is kept at the edge); black, the default, and a `/C`
-    /// that isn't three numbers read as no colour. `/F` bit 1 is italic, bit 2 bold.
-    #[test]
-    fn outline_items_carry_their_colour_and_style() {
-        let titles = [
-            ("Plain", ""),
-            ("Red", "/C [1 0 0]"),
-            ("Italic", "/F 1"),
-            ("Bold", "/F 2"),
-            ("Both", "/C [0 0 1] /F 3"),
-            ("Black", "/C [0 0 0]"),
-            ("Bright", "/C [2 -1 0.5]"),
-            ("Short", "/C [1 0]"),
-            ("Long", "/C [1 0 0 0]"),
-            ("Named", "/C [1 /x 0]"),
-            ("Other bits", "/F 4"),
-        ];
-        let n = titles.len();
-        let items: Vec<String> = titles
-            .iter()
-            .enumerate()
-            .map(|(k, (title, extra))| {
-                let prev = if k == 0 { String::new() } else { format!(" /Prev {} 0 R", 4 + k) };
-                let next = if k + 1 == n { String::new() } else { format!(" /Next {} 0 R", 6 + k) };
-                format!("<< /Title ({title}) /Parent 4 0 R{prev}{next} /Dest [3 0 R /Fit] {extra} >>")
-            })
-            .collect();
-        let info = inspect(Arc::new(outline_file(&items)), None).expect("opens");
-        let got: Vec<(&str, Option<[f32; 3]>, bool, bool)> = info.outline.iter().map(|o| (o.title.as_str(), o.color, o.italic, o.bold)).collect();
-        assert_eq!(
-            got,
-            [
-                ("Plain", None, false, false),
-                ("Red", Some([1.0, 0.0, 0.0]), false, false),
-                ("Italic", None, true, false),
-                ("Bold", None, false, true),
-                ("Both", Some([0.0, 0.0, 1.0]), true, true),
-                ("Black", None, false, false),
-                ("Bright", Some([1.0, 0.0, 0.5]), false, false),
-                ("Short", None, false, false),
-                ("Long", None, false, false),
-                ("Named", None, false, false),
-                ("Other bits", None, false, false),
-            ]
-        );
-    }
-
-    #[test]
-    fn outline_window_keeps_the_first_bookmarks_and_says_when_more_follow() {
-        const COUNT: usize = OUTLINE_WINDOW + 5;
-        let items: Vec<String> = (0..COUNT)
-            .map(|k| {
-                let prev = if k == 0 { String::new() } else { format!(" /Prev {} 0 R", 4 + k) };
-                let next = if k + 1 == COUNT { String::new() } else { format!(" /Next {} 0 R", 6 + k) };
-                format!("<< /Title (Item {k}) /Parent 4 0 R{prev}{next} /Dest [3 0 R /Fit] >>")
-            })
-            .collect();
-        let info = inspect(Arc::new(outline_file(&items)), None).expect("opens");
-        assert_eq!(info.outline.len(), OUTLINE_WINDOW);
-        assert_eq!(info.outline.last().map(|o| o.title.as_str()), Some("Item 9999"));
-        assert!(info.outline_more);
-
-        let one = inspect(Arc::new(outline_file(&["<< /Title (Only) /Parent 4 0 R /Dest [3 0 R /Fit] >>".into()])), None).expect("opens");
-        assert_eq!(shape(&one.outline), ["Only"]);
-        assert!(!one.outline_more);
-    }
-
-    #[test]
-    fn outline_window_nests_no_deeper_than_its_depth_limit() {
-        // A chain of 40 bookmarks, each the first child of the one before.
-        let items: Vec<String> = (0..40)
-            .map(|k| {
-                let parent = if k == 0 { 4 } else { 4 + k };
-                let first = if k + 1 == 40 { String::new() } else { format!(" /First {} 0 R", 6 + k) };
-                format!("<< /Title (Deep {k}) /Parent {parent} 0 R{first} /Dest [3 0 R /Fit] >>")
-            })
-            .collect();
-        let info = inspect(Arc::new(outline_file(&items)), None).expect("opens");
-        let mut levels = 0;
-        let mut level = info.outline.first();
-        while let Some(item) = level {
-            levels += 1;
-            level = item.children.first();
-        }
-        assert_eq!(levels, OUTLINE_DEPTH + 1);
-        assert!(info.outline_more);
-    }
-
-    #[test]
-    fn outline_window_ends_cycles_and_broken_links_without_looping() {
-        let listed = |items: &[&str]| {
-            let items: Vec<String> = items.iter().map(|s| s.to_string()).collect();
-            shape(&inspect(Arc::new(outline_file(&items)), None).expect("opens").outline)
-        };
-        assert_eq!(listed(&["<< /Title (Self) /Parent 4 0 R /Next 5 0 R >>"]), ["Self"]);
-        assert_eq!(listed(&["<< /Title (Self) /Parent 4 0 R /First 5 0 R >>"]), ["Self"]);
-        assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 6 0 R >>", "<< /Title (B) /Parent 4 0 R /Next 5 0 R >>"]), ["A", "B"]);
-        assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /First 6 0 R >>", "<< /Title (B) /Parent 5 0 R /First 5 0 R >>"]), ["A[B]"]);
-        assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 99 0 R >>"]), ["A"]);
-        assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 6 0 R >>", "42"]), ["A"]);
-    }
-
-    #[test]
-    fn destination_points_map_to_the_displayed_page() {
-        // A crop box away from the origin: x 100..400, y 50..450.
-        let mut p = PageInfo { width: 300.0, height: 400.0, label: "1".into(), crop: [100.0, 50.0, 400.0, 450.0], rotation: 0 };
-        assert_eq!(p.dest_fraction(Some(100.0), Some(450.0), 0), [Some(0.0), Some(0.0)]);
-        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.5), Some(0.25)]);
-        // Unspecified stays unspecified; off-page and huge values are clamped to the page.
-        assert_eq!(p.dest_fraction(None, Some(350.0), 0), [None, Some(0.25)]);
-        assert_eq!(p.dest_fraction(Some(-1e30), Some(1e30), 0), [Some(0.0), Some(0.0)]);
-        assert_eq!(p.dest_fraction(Some(f32::INFINITY), Some(f32::NAN), 0), [None, None]);
-        // /Rotate 90 (clockwise): user y runs left to right across the displayed page, user x
-        // top to bottom. A view rotation adds to it.
-        p.rotation = 90;
-        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.75), Some(0.5)]);
-        assert_eq!(p.dest_fraction(None, Some(350.0), 0), [Some(0.75), None]);
-        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 90), [Some(0.5), Some(0.75)]);
-        p.rotation = 180;
-        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.5), Some(0.75)]);
-        p.rotation = 270;
-        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.25), Some(0.5)]);
-        assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 90), [Some(0.5), Some(0.25)]);
-        // A degenerate crop box never divides by zero.
-        let flat = PageInfo { crop: [0.0, 0.0, 0.0, 0.0], rotation: 0, ..p };
-        assert!(flat.dest_fraction(Some(5.0), Some(-5.0), 0).iter().all(|f| f.is_some_and(|f| (0.0..=1.0).contains(&f))));
-    }
-
-    #[test]
-    fn a_displayed_point_becomes_the_xyz_position_that_goes_back_to_it() {
-        // Every rotation, on a crop box away from the origin: pinning a displayed point and
-        // reading the destination back lands on the same fraction of the displayed page.
-        for rotation in [0u16, 90, 180, 270] {
-            let (width, height) = if rotation.is_multiple_of(180) { (300.0, 400.0) } else { (400.0, 300.0) };
-            let p = PageInfo { width, height, label: "1".into(), crop: [100.0, 50.0, 400.0, 450.0], rotation };
-            let (x, y) = (0.25 * width, 0.75 * height);
-            let near = |got: [Option<f32>; 2], want: [Option<f32>; 2]| {
-                for (g, w) in got.iter().zip(want) {
-                    match (g, w) {
-                        (Some(g), Some(w)) => assert!((g - w).abs() < 1e-4, "{rotation}: {got:?} vs {want:?}"),
-                        (None, None) => {}
-                        _ => panic!("{rotation}: {got:?} vs {want:?}"),
-                    }
-                }
-            };
-            let [l, t] = p.xyz_for_view(Some(x), Some(y));
-            assert!(l.is_some() && t.is_some(), "{rotation}: a point pins both");
-            near(p.dest_fraction(l, t, 0), [Some(0.25), Some(0.75)]);
-            // Only a height: the horizontal position is left alone, whichever user axis that is.
-            let [l, t] = p.xyz_for_view(None, Some(y));
-            assert_eq!((l.is_some(), t.is_some()), if rotation.is_multiple_of(180) { (false, true) } else { (true, false) }, "{rotation}");
-            near(p.dest_fraction(l, t, 0), [None, Some(0.75)]);
-            let [l, t] = p.xyz_for_view(Some(x), None);
-            near(p.dest_fraction(l, t, 0), [Some(0.25), None]);
-            assert_eq!(p.xyz_for_view(None, None), [None, None]);
-            assert_eq!(p.xyz_for_view(Some(f32::NAN), Some(f32::INFINITY)), [None, None], "not finite is not given");
-        }
-        // The top of an upright page is the crop box's top edge.
-        let p = PageInfo { width: 300.0, height: 400.0, label: "1".into(), crop: [100.0, 50.0, 400.0, 450.0], rotation: 0 };
-        assert_eq!(p.xyz_for_view(None, Some(0.0)), [None, Some(450.0)]);
-        assert_eq!(p.xyz_for_view(None, Some(100.0)), [None, Some(350.0)]);
-    }
-
-    #[test]
-    fn structure_failure_preserves_renderer_pages() {
-        for crash in [true, false] {
-            let mut info = DocInfo {
-                file_size: 321,
-                pdf_version: "1.7".into(),
-                pages: vec![PageInfo { width: 300.0, height: 200.0, label: "1".into(), crop: [10.0, 20.0, 210.0, 320.0], rotation: 90 }],
-                ..Default::default()
-            };
-            inspect_structure(&mut info, |tmp| {
-                tmp.pages.clear();
-                tmp.title = Some("partially inspected".into());
-                if crash {
-                    panic!("synthetic structure inspection failure");
-                }
-                Err("synthetic structure inspection failure".into())
-            });
-
-            assert_eq!(info.pages.len(), 1);
-            let page = &info.pages[0];
-            assert_eq!((page.width, page.height, page.label.as_str(), page.crop, page.rotation), (300.0, 200.0, "1", [10.0, 20.0, 210.0, 320.0], 90));
-            assert_eq!(info.file_size, 321);
-            assert_eq!(info.pdf_version, "1.7");
-            assert!(info.title.is_none());
-            assert_eq!(info.warnings.len(), 1);
-            assert!(info.warnings[0].contains("synthetic structure inspection failure"));
-            assert_eq!(info.warnings[0].contains("crashed"), crash);
-        }
-    }
-
-    #[test]
-    fn invalid_dates_with_unicode_are_unchanged() {
-        for input in ["", "D:", "D:20260930104", "D:202609x01045", "yesterday"] {
-            assert_eq!(pretty_date(input), input);
-        }
-        // Cover every position before the 12-byte prefix, including characters that
-        // straddle its end. None of these strings is an ASCII PDF date.
-        for character in ['é', '€', '😀'] {
-            for prefix_len in 0..12 {
-                let input = format!("D:{}{character}123456789012", "1".repeat(prefix_len));
-                assert_eq!(pretty_date(&input), input, "{character} after {prefix_len} digits");
-            }
-        }
-    }
-
-    #[test]
-    fn unicode_annotation_date_does_not_prevent_opening() {
-        use lopdf::dictionary;
-
-        let date = "D:12345678901éX";
-        let mut encoded_date = vec![0xFE, 0xFF];
-        encoded_date.extend(date.encode_utf16().flat_map(u16::to_be_bytes));
-        let mut doc = Document::with_version("1.7");
-        let pages_id = doc.new_object_id();
-        let annot_id = doc.add_object(dictionary! {
-            "Type" => "Annot",
-            "Subtype" => "Text",
-            "Rect" => vec![10.into(), 10.into(), 30.into(), 30.into()],
-            "M" => Object::String(encoded_date, lopdf::StringFormat::Hexadecimal),
-        });
-        let page_id = doc.add_object(dictionary! {
-            "Type" => "Page",
-            "Parent" => pages_id,
-            "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
-            "Annots" => vec![annot_id.into()],
-        });
-        doc.objects.insert(
-            pages_id,
-            dictionary! {
-                "Type" => "Pages",
-                "Kids" => vec![page_id.into()],
-                "Count" => 1,
-            }
-            .into(),
-        );
-        let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id });
-        doc.trailer.set("Root", catalog_id);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).expect("write synthetic fixture");
-
-        let info = inspect(Arc::new(bytes), None).expect("opens despite a non-date /M string");
-        assert_eq!(info.pages.len(), 1);
-        assert_eq!((info.pages[0].width, info.pages[0].height), (200.0, 300.0));
-        assert_eq!(info.annotations.len(), 1);
-        assert_eq!(info.annotations[0].modified.as_deref(), Some(date));
-        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
-    }
-
-    #[test]
-    fn carriage_returns_in_comment_text_become_line_breaks() {
-        use lopdf::dictionary;
-
-        let mut doc = Document::with_version("1.7");
-        let pages_id = doc.new_object_id();
-        let annot_id = doc.add_object(dictionary! {
-            "Type" => "Annot",
-            "Subtype" => "Text",
-            "Rect" => vec![10.into(), 10.into(), 30.into(), 30.into()],
-            // Acrobat ends lines in /Contents with CR; the interface only breaks lines at LF.
-            "Contents" => Object::string_literal("one\r\rtwo\r\nthree"),
-        });
-        let page_id = doc.add_object(dictionary! {
-            "Type" => "Page",
-            "Parent" => pages_id,
-            "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
-            "Annots" => vec![annot_id.into()],
-        });
-        doc.objects.insert(pages_id, dictionary! { "Type" => "Pages", "Kids" => vec![page_id.into()], "Count" => 1 }.into());
-        let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id });
-        doc.trailer.set("Root", catalog_id);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).expect("write synthetic fixture");
-
-        let info = inspect(Arc::new(bytes), None).expect("opens");
-        assert_eq!(info.annotations[0].contents.as_deref(), Some("one\n\ntwo\nthree"));
-    }
-
-    #[test]
-    fn dates_are_prettified() {
-        assert_eq!(pretty_date("D:20260930104512-04'00'"), "2026-09-30 10:45");
-        assert_eq!(pretty_date("yesterday"), "yesterday");
-    }
-
-    #[test]
-    fn jspdf_high_precision_mediabox_does_not_overflow_dimensions() {
-        let pdf = b"%PDF-1.3
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 3874.9606299212600788 5493.5433070866147318] >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let info = inspect(std::sync::Arc::new(pdf.to_vec()), None).expect("opens");
-        assert_eq!(info.pages.len(), 1);
-        let p = &info.pages[0];
-        assert!((p.width - 3874.96).abs() < 0.1, "width expected ~3874.96, got {}", p.width);
-        assert!((p.height - 5493.54).abs() < 0.1, "height expected ~5493.54, got {}", p.height);
-    }
-}
-
-/// "1.7" from the parser's version name ("Pdf17", "V1_7", …).
-fn version_label(name: &str) -> String {
-    let digits: Vec<char> = name.chars().filter(char::is_ascii_digit).collect();
-    match digits[..] {
-        [a, b] => format!("{a}.{b}"),
-        _ => name.to_owned(),
-    }
-}
-
-#[cfg(test)]
-mod version_tests {
-    #[test]
-    fn version_labels_read_as_numbers() {
-        assert_eq!(super::version_label("Pdf17"), "1.7");
-        assert_eq!(super::version_label("V2_0"), "2.0");
-        assert_eq!(super::version_label("Unknown"), "Unknown");
-    }
-}
-
-#[cfg(test)]
-mod substitution_tests {
-    use std::sync::Arc;
-
-    use super::{FontInfo, inspect};
-
-    /// One page naming four fonts the document does not embed: a Chinese CID font (Adobe-GB1), a
-    /// Japanese one (Adobe-Japan1), an unknown serif-flagged simple font, and an aliased
-    /// standard-14 name.
-    const NOT_EMBEDDED: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /Font << /F1 4 0 R /F2 6 0 R /F3 8 0 R /F4 9 0 R /F5 11 0 R >> >> >> endobj
-4 0 obj << /Type /Font /Subtype /Type0 /BaseFont /STSong-Light /Encoding /UniGB-UCS2-H /DescendantFonts [5 0 R] >> endobj
-5 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /STSong-Light /CIDSystemInfo << /Registry (Adobe) /Ordering (GB1) /Supplement 2 >> >> endobj
-6 0 obj << /Type /Font /Subtype /Type0 /BaseFont /KozMinPro-Regular /Encoding /UniJIS-UCS2-H /DescendantFonts [7 0 R] >> endobj
-7 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /KozMinPro-Regular /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 4 >> >> endobj
-8 0 obj << /Type /Font /Subtype /TrueType /BaseFont /SomeHouseSerif /FontDescriptor 10 0 R >> endobj
-9 0 obj << /Type /Font /Subtype /TrueType /BaseFont /ArialMT >> endobj
-10 0 obj << /Type /FontDescriptor /FontName /SomeHouseSerif /Flags 34 >> endobj
-11 0 obj << /Type /Font /Subtype /TrueType /BaseFont /HouseGrotesk /FontDescriptor 12 0 R >> endobj
-12 0 obj << /Type /FontDescriptor /FontName /HouseGrotesk /Flags 33 >> endobj
-trailer << /Size 13 /Root 1 0 R >>
-%%EOF";
-
-    fn font<'a>(fonts: &'a [FontInfo], name: &str) -> &'a FontInfo {
-        fonts.iter().find(|f| f.name == name).unwrap_or_else(|| panic!("{name} listed; got {:?}", fonts.iter().map(|f| &f.name).collect::<Vec<_>>()))
-    }
-
-    #[test]
-    fn doc_info_says_which_face_stands_in_and_why() {
-        let info = inspect(Arc::new(NOT_EMBEDDED.to_vec()), None).expect("opens");
-
-        // The one that matters most to a user: a Chinese PDF that draws nothing. Before this,
-        // doc_info said only `embedded: false` and left them to guess.
-        let cjk = font(&info.fonts, "STSong-Light");
-        assert!(!cjk.embedded);
-        assert_eq!(cjk.substitute, None, "no licensed Chinese face, so nothing stands in");
-        let why = cjk.substitution.as_deref().unwrap_or_default();
-        assert!(why.contains("no licensed face") && why.contains("rather than the wrong glyphs"), "{why}");
-
-        // An aliased standard-14 name resolves to the real face, whose metrics are exact.
-        let arial = font(&info.fonts, "ArialMT");
-        assert_eq!(arial.substitute.as_deref(), Some("Helvetica"));
-        assert!(arial.substitution.as_deref().unwrap_or_default().contains("standard 14"));
-
-        // A house font whose name merely contains "Serif" gets Times -- reported as the guess it
-        // is, not as a standard-14 name, which would be untrue of a font nobody has heard of.
-        let serif = font(&info.fonts, "SomeHouseSerif");
-        assert_eq!(serif.substitute.as_deref(), Some("Times-Roman"));
-        assert!(serif.substitution.as_deref().unwrap_or_default().contains("hints at one"), "{serif:?}");
-
-        // No hint in the name at all, so the descriptor flags decide: 33 = fixed pitch + nonsymbolic.
-        let grotesk = font(&info.fonts, "HouseGrotesk");
-        assert_eq!(grotesk.substitute.as_deref(), Some("Courier"));
-        assert!(grotesk.substitution.as_deref().unwrap_or_default().contains("descriptor flags"), "{grotesk:?}");
-
-        // Japanese depends on the optional craft-fonts build input; either way it is reported,
-        // and never as a Latin face.
-        let jpan = font(&info.fonts, "KozMinPro-Regular");
-        assert!(jpan.substitution.is_some(), "a substitution is always explained");
-        match &jpan.substitute {
-            Some(face) => {
-                assert!(!face.starts_with("Helvetica") && !face.starts_with("Times"), "a Latin face is never a Japanese substitute: {face}")
-            }
-            None => assert!(jpan.substitution.as_deref().unwrap_or_default().contains("no licensed face")),
-        }
-
-        // Nothing claims to be embedded, so every font here carries a reason.
-        assert!(info.fonts.iter().all(|f| !f.embedded && f.substitution.is_some()), "{:?}", info.fonts);
-    }
-
-    /// An embedded font is reported as faithful: nothing stands in, and there is nothing to explain.
-    const EMBEDDED: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /Font << /F1 4 0 R >> >> >> endobj
-4 0 obj << /Type /Font /Subtype /TrueType /BaseFont /ABCDEF+SomeHouseSans /FontDescriptor 5 0 R >> endobj
-5 0 obj << /Type /FontDescriptor /FontName /ABCDEF+SomeHouseSans /Flags 32 /FontFile2 6 0 R >> endobj
-6 0 obj << /Length 4 >> stream
-test
-endstream endobj
-trailer << /Size 7 /Root 1 0 R >>
-%%EOF";
-
-    #[test]
-    fn an_embedded_font_reports_no_substitution_at_all() {
-        let info = inspect(Arc::new(EMBEDDED.to_vec()), None).expect("opens");
-        let f = font(&info.fonts, "SomeHouseSans");
-        assert!(f.embedded && f.subset, "{f:?}");
-        assert_eq!((f.substitute.as_deref(), f.substitution.as_deref()), (None, None), "the document's own glyphs are shown");
-    }
-}
-
-#[cfg(test)]
-mod open_action_javascript_tests {
-    use std::sync::Arc;
-
-    use super::inspect;
-
-    /// One-page PDF whose catalog points its /OpenAction at object 4 (written by the caller).
-    fn pdf_with_open_action(action: &[u8]) -> Vec<u8> {
-        let objs: Vec<&[u8]> = vec![
-            b"<< /Type /Catalog /Pages 2 0 R /OpenAction 4 0 R >>",
-            b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
-            b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >>",
-            action,
-        ];
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, o) in objs.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
-            out.extend_from_slice(o);
-            out.extend_from_slice(b"\nendobj\n");
-        }
-        let xref = out.len();
-        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
-        for o in offsets {
-            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
-        out
-    }
-
-    #[test]
-    fn open_action_javascript_sets_has_javascript() {
-        let bytes = pdf_with_open_action(b"<< /S /JavaScript /JS (app.alert('hi')) >>");
-        let info = inspect(Arc::new(bytes), None).expect("inspects");
-        assert!(info.has_javascript, "an /OpenAction /JavaScript is JavaScript");
-    }
-
-    #[test]
-    fn open_action_goto_does_not_set_has_javascript() {
-        let bytes = pdf_with_open_action(b"<< /S /GoTo /D [3 0 R /Fit] >>");
-        let info = inspect(Arc::new(bytes), None).expect("inspects");
-        assert!(!info.has_javascript, "a /GoTo /OpenAction is not JavaScript");
-    }
-}
+mod tests;
diff --git a/crates/render/src/inspect/annotations.rs b/crates/render/src/inspect/annotations.rs
new file mode 100644
index 0000000000..07283c0473
--- /dev/null
+++ b/crates/render/src/inspect/annotations.rs
@@ -0,0 +1,474 @@
+use super::core::{limited_pdf_string, pretty_date, spend};
+use super::model::{Annotation, AttachmentSource, DestView, Field, FieldKind, LayerOp, Link, LinkTarget, RemoteDestination, link_replies};
+use super::navigation::text_string;
+use super::*;
+
+/// At most this many `/State` entries of a set-layer-visibility action are read.
+const MAX_LAYER_STATE: usize = 1024;
+
+/// File specifications retained from a remote-Go-To action are deliberately small.
+pub(super) const MAX_REMOTE_FILE_SPEC_BYTES: usize = 4096;
+
+const MAX_REMOTE_DESTINATION_NAME_BYTES: usize = 1024;
+
+/// Text and geometry `DocInfo::annotations` keeps, as counted by [`retained`]. Past it the rest
+/// are not listed: real comments stay far below, many small ones sharing one long string do not.
+pub(super) const MAX_ANNOTATION_BYTES: usize = 64 << 20;
+
+/// Web-address text the link listing, and name, description and embedded-file key text the
+/// attachment listing, keep together. Many links or attachments can share one long string, which
+/// each would otherwise copy. Past it, a link to a web address lists as a URI action without its
+/// address, an attachment under its generic name without a description, and an embedded file whose
+/// key does not fit is not listed.
+pub(super) const MAX_LINK_ATTACHMENT_TEXT_BYTES: usize = 16 << 20;
+
+/// The bytes a listed annotation keeps.
+pub(super) fn retained(a: &Annotation) -> usize {
+    let text = [&a.author, &a.contents, &a.modified, &a.name, &a.in_reply_to, &a.state, &a.intent];
+    text.into_iter()
+        .map(|t| t.as_ref().map_or(0, String::len))
+        .chain([
+            a.subtype.len(),
+            std::mem::size_of_val(a.quads.as_slice()),
+            std::mem::size_of_val(a.points.as_slice()),
+            std::mem::size_of::<Annotation>(),
+        ])
+        .fold(0, usize::saturating_add)
+}
+
+impl<'a> Inspector<'a> {
+    /// Whether an annotation is a Fill & Sign mark. Keep in step with
+    /// `pdfcraft_annot::is_fill_sign`, which the engine's comment list uses.
+    fn is_fill_sign(&self, d: &Dictionary, subtype: &str) -> bool {
+        let yes = |key: &[u8]| matches!(d.get(key).map(|o| self.resolve(o)), Ok(Object::Boolean(true)));
+        if yes(b"PCFillSign") {
+            return true;
+        }
+        match subtype {
+            "FreeText" => self.name(d, b"IT").as_deref() == Some("FreeTextTypeWriter"),
+            "Stamp" => match self.name(d, b"Name").as_deref() {
+                Some("PCCheck" | "PCCross" | "PCDot" | "PCLine" | "PCTypedSignature") => true,
+                Some("PCCustomSignature" | "PCCustomInitials") => yes(b"PCPictureImage"),
+                _ => false,
+            },
+            "Ink" => self.text(d, b"Subj").as_deref() == Some("Signature"),
+            _ => false,
+        }
+    }
+
+    // ── annotations ─────────────────────────────────────────────────────────────────────────
+
+    /// `text_budget` is what is left of [`MAX_LINK_ATTACHMENT_TEXT_BYTES`].
+    pub(super) fn annotations(&self, info: &mut DocInfo, text_budget: &mut usize) {
+        let mut pages: Vec<(ObjectId, usize)> = self.page_index.iter().map(|(&id, &page)| (id, page)).collect();
+        pages.sort_unstable_by_key(|&(_, page)| page);
+        // An annotation, or a whole `/Annots` array, that several entries or pages list is on the
+        // first of them (§12.5.2 allows one page per annotation). Both are told apart by the object
+        // a reference resolves to, since an indirect object may itself hold a reference. Where each
+        // annotation is listed is collected before any is read, so a reply's `/IRT` finds its
+        // parent by reference even when the parent comes later.
+        let mut seen_arrays = HashSet::new();
+        let mut slots: HashMap<ObjectId, (usize, usize)> = HashMap::new();
+        let mut entries = Vec::new();
+        for (id, page) in pages {
+            let Ok(page_dict) = self.doc.get_dictionary(id) else { continue };
+            if let Ok(annots) = page_dict.get(b"Annots")
+                && let Some(r) = self.resolved_id(annots)
+                && !seen_arrays.insert(r)
+            {
+                continue;
+            }
+            let Ok(Object::Array(annots)) = page_dict.get(b"Annots").map(|o| self.resolve(o)) else { continue };
+            for (index, a) in annots.iter().enumerate() {
+                if let Some(r) = self.resolved_id(a) {
+                    let Entry::Vacant(slot) = slots.entry(r) else { continue };
+                    slot.insert((page, index));
+                }
+                entries.push((page, index, a));
+            }
+        }
+        let mut kept = 0usize;
+        // Once the comment budget is spent, comments are no longer built, but links and attachments
+        // are still listed.
+        let mut comments_full = false;
+        for (page, index, a) in entries {
+            let Some(d) = self.dict(a) else { continue };
+            let Some(subtype) = self.name(d, b"Subtype") else { continue };
+            if subtype == "FileAttachment"
+                && let Ok(fs) = d.get(b"FS")
+            {
+                let fallback = |budget: &mut usize| self.budgeted_text(d, b"Contents", budget);
+                info.attachments.push(self.attachment(fs, AttachmentSource::Annotation { page, index }, text_budget, fallback));
+            }
+            if subtype == "Link" {
+                if let Some(link) = self.link(page, index, d, text_budget) {
+                    if matches!(&link.target, LinkTarget::Other(s) if s == "JavaScript") {
+                        info.has_javascript = true;
+                    }
+                    info.links.push(link);
+                }
+                continue;
+            }
+            // Not comments: form widgets, pop-ups and non-markup annotations such as the
+            // Screen annotation that drives a LaTeX `animate` player (keep in step with
+            // `pdfcraft_annot::is_comment_subtype`).
+            if matches!(subtype.as_str(), "Widget" | "Popup" | "Screen" | "Movie" | "RichMedia" | "3D" | "PrinterMark" | "TrapNet" | "Watermark") {
+                continue;
+            }
+            if comments_full {
+                continue;
+            }
+            let rect = rect4(self.resolve(d.get(b"Rect").unwrap_or(&Object::Null)));
+            let mut color = match d.get(b"C").map(|o| self.resolve(o)) {
+                Ok(Object::Array(c)) if c.len() == 3 => {
+                    let f = |i: usize| c[i].as_float().unwrap_or(0.0);
+                    Some([f(0), f(1), f(2)])
+                }
+                _ => None,
+            };
+            // A text box's /C is its background; its text colour is in /DA.
+            if subtype == "FreeText"
+                && let Some(da) = self.text(d, b"DA")
+            {
+                let t: Vec<&str> = da.split_whitespace().collect();
+                if let Some(i) = t.iter().position(|x| *x == "rg")
+                    && i >= 3
+                {
+                    let f = |k: usize| t[k].parse::<f32>().unwrap_or(0.0);
+                    color = Some([f(i - 3), f(i - 2), f(i - 1)]);
+                }
+            }
+            let quads = match d.get(b"QuadPoints").map(|o| self.resolve(o)) {
+                Ok(Object::Array(q)) => {
+                    let v: Vec<f32> = q.iter().map(|o| o.as_float().unwrap_or(0.0)).collect();
+                    v.as_chunks::<8>().0.to_vec()
+                }
+                _ => Vec::new(),
+            };
+            let in_reply_to = d.get(b"IRT").ok().and_then(|o| self.dict(o)).and_then(|p| self.text(p, b"NM"));
+            let parent = d.get(b"IRT").ok().and_then(|o| self.resolved_id(o)).and_then(|r| slots.get(&r).copied());
+            let fill_sign = self.is_fill_sign(d, &subtype);
+            // Keep in step with `pdfcraft_annot::summaries`.
+            let key: &[u8] = if subtype == "Line" { b"L" } else { b"Vertices" };
+            let points = match d.get(key).map(|o| self.resolve(o)) {
+                Ok(Object::Array(v)) if matches!(subtype.as_str(), "Line" | "PolyLine" | "Polygon") => {
+                    let v: Vec<f32> = v.iter().map(|o| o.as_float().unwrap_or(0.0)).collect();
+                    let pts: Vec<[f32; 2]> = v.as_chunks::<2>().0.to_vec();
+                    if subtype == "Line" && pts.len() != 2 { Vec::new() } else { pts }
+                }
+                _ => Vec::new(),
+            };
+            let annotation = Annotation {
+                page,
+                subtype,
+                author: self.text(d, b"T"),
+                // Acrobat ends lines with CR, which the interface would draw as nothing (keep
+                // in step with `pdfcraft_annot::summaries`).
+                contents: self.text(d, b"Contents").map(|s| s.replace("\r\n", "\n").replace('\r', "\n")),
+                modified: self.text(d, b"M").map(|m| pretty_date(&m)),
+                name: self.text(d, b"NM"),
+                in_reply_to,
+                parent,
+                grouped: self.name(d, b"RT").as_deref() == Some("Group"),
+                rect,
+                color,
+                index,
+                state: self.text(d, b"State"),
+                quads,
+                locked: d.get(b"F").ok().and_then(|f| self.resolve(f).as_i64().ok()).unwrap_or(0) & 128 != 0,
+                intent: self.name(d, b"IT"),
+                fill_sign,
+                no_rotate: d.get(b"F").is_ok_and(|f| draw_flags(self.resolve(f)) & 16 != 0),
+                points,
+            };
+            kept = kept.saturating_add(retained(&annotation));
+            if kept > MAX_ANNOTATION_BYTES {
+                comments_full = true;
+                continue;
+            }
+            info.annotations.push(annotation);
+        }
+        info.annotations.sort_by(|a, b| a.page.cmp(&b.page).then(b.rect[3].total_cmp(&a.rect[3])));
+        link_replies(&mut info.annotations);
+    }
+
+    fn link(&self, page: usize, index: usize, d: &Dictionary, text_budget: &mut usize) -> Option<Link> {
+        let rect = rect4(self.resolve(d.get(b"Rect").ok()?));
+        let target = if let Ok(dest) = d.get(b"Dest") {
+            let (page, view) = self.dest(dest, 0)?;
+            LinkTarget::Page(page, view)
+        } else {
+            let a = d.get(b"A").ok().and_then(|a| self.dict(a))?;
+            match self.name(a, b"S").as_deref() {
+                Some("GoTo") => {
+                    let (page, view) = self.dest(a.get(b"D").ok()?, 0)?;
+                    LinkTarget::Page(page, view)
+                }
+                Some("URI") => {
+                    let uri = a.get(b"URI").ok().and_then(|u| self.resolve(u).as_str().ok())?;
+                    match spend(uri, text_budget, |b| String::from_utf8_lossy(b).into_owned()) {
+                        Some(uri) => LinkTarget::Uri(uri),
+                        None => LinkTarget::Other("URI".into()),
+                    }
+                }
+                Some("SetOCGState") => self.layer_state(a),
+                Some("GoToR") => self.remote_go_to(a).unwrap_or_else(|| LinkTarget::Other("GoToR".into())),
+                Some("Launch") => self.launch_pdf(a).unwrap_or_else(|| LinkTarget::Other("Launch".into())),
+                Some(other) => LinkTarget::Other(other.to_string()),
+                None => return None,
+            }
+        };
+        Some(Link { page, index, rect, target })
+    }
+
+    fn remote_go_to(&self, action: &Dictionary) -> Option<LinkTarget> {
+        let file = self.action_file(action)?;
+        let destination = match action.get(b"D") {
+            Err(_) => RemoteDestination::Default,
+            Ok(o) => match self.resolve(o) {
+                Object::Array(items) => {
+                    let page = items.first().and_then(|o| self.resolve(o).as_i64().ok()).and_then(|n| usize::try_from(n).ok())?;
+                    let kind = items.get(1).map(|o| self.resolve(o)).and_then(|o| o.as_name().ok());
+                    let operands: [Option<f32>; 4] = std::array::from_fn(|i| items.get(i + 2).and_then(|o| self.resolve(o).as_float().ok()));
+                    RemoteDestination::Page { page, view: DestView::from_operands(kind, &operands) }
+                }
+                Object::Name(name) if name.len() <= MAX_REMOTE_DESTINATION_NAME_BYTES => {
+                    let name = String::from_utf8_lossy(name).into_owned();
+                    if name.is_empty() || name.len() > MAX_REMOTE_DESTINATION_NAME_BYTES {
+                        return None;
+                    }
+                    RemoteDestination::Named(name)
+                }
+                Object::String(bytes, _) if bytes.len() <= MAX_REMOTE_DESTINATION_NAME_BYTES => {
+                    let name = text_string(bytes);
+                    if name.is_empty() || name.len() > MAX_REMOTE_DESTINATION_NAME_BYTES {
+                        return None;
+                    }
+                    RemoteDestination::Named(name)
+                }
+                _ => return None,
+            },
+        };
+        Some(LinkTarget::RemoteGoTo { launch: false, file, destination, new_window: self.new_window(action) })
+    }
+
+    /// The non-empty local file an action's `/F` names (a string or a file specification), shared
+    /// by GoToR and Launch. A URL file system (`/FS /URL`) names no local file.
+    fn action_file(&self, action: &Dictionary) -> Option<String> {
+        if self.name(action, b"FS").as_deref() == Some("URL") {
+            return None;
+        }
+        let file = match self.resolve(action.get(b"F").ok()?) {
+            Object::String(bytes, _) => limited_pdf_string(bytes, MAX_REMOTE_FILE_SPEC_BYTES)?,
+            Object::Dictionary(spec) => {
+                if self.name(spec, b"FS").as_deref() == Some("URL") {
+                    return None;
+                }
+                spec.get(b"UF")
+                    .ok()
+                    .and_then(|o| self.pdf_text(o, MAX_REMOTE_FILE_SPEC_BYTES))
+                    .or_else(|| spec.get(b"F").ok().and_then(|o| self.pdf_text(o, MAX_REMOTE_FILE_SPEC_BYTES)))?
+            }
+            _ => return None,
+        };
+        (!file.is_empty()).then_some(file)
+    }
+
+    fn new_window(&self, action: &Dictionary) -> Option<bool> {
+        match action.get(b"NewWindow").map(|o| self.resolve(o)) {
+            Ok(Object::Boolean(value)) => Some(*value),
+            _ => None,
+        }
+    }
+
+    /// A Launch action (ISO 32000-2 §12.6.4.6, Table 207) whose `/F` names a `.pdf` file, read as
+    /// the remote Go-To to that file's first page that it amounts to (#4168). Launching anything
+    /// else, or with the deprecated `/Win` launch parameters (an application, an operation, its
+    /// arguments), is not followed: a document must not start programs. `\` separators, which
+    /// Windows writers put in such paths, are read as `/` (§7.11.2.1 separates components with
+    /// `/`) when the path has no `/` of its own. Launch has no `/D`, so one present (written
+    /// for GoToR, or junk) is ignored rather than checked as a destination.
+    fn launch_pdf(&self, action: &Dictionary) -> Option<LinkTarget> {
+        if action.has(b"Win") {
+            return None;
+        }
+        let file = self.action_file(action)?;
+        let new_window = self.new_window(action);
+        let file = if file.contains('/') { file } else { file.replace('\\', "/") };
+        let pdf = file.rsplit('/').next().is_some_and(|name| name.len() > 4 && name.to_ascii_lowercase().ends_with(".pdf"));
+        pdf.then_some(LinkTarget::RemoteGoTo { launch: true, file, destination: RemoteDestination::Default, new_window })
+    }
+
+    fn pdf_text(&self, o: &Object, max_bytes: usize) -> Option<String> {
+        match self.resolve(o) {
+            Object::String(bytes, _) => limited_pdf_string(bytes, max_bytes),
+            _ => None,
+        }
+    }
+
+    /// A set-OCG-state action: `/State` is `ON`, `OFF` or `Toggle`, each followed by the groups
+    /// it applies to; `/PreserveRB` is true unless it is `false`.
+    fn layer_state(&self, a: &Dictionary) -> LinkTarget {
+        let mut changes = Vec::new();
+        if let Ok(Object::Array(items)) = a.get(b"State").map(|o| self.resolve(o)) {
+            let mut op = None;
+            for item in items.iter().take(MAX_LAYER_STATE) {
+                match item {
+                    Object::Name(n) => {
+                        op = match n.as_slice() {
+                            b"ON" => Some(LayerOp::On),
+                            b"OFF" => Some(LayerOp::Off),
+                            b"Toggle" => Some(LayerOp::Toggle),
+                            _ => None,
+                        }
+                    }
+                    Object::Reference(id) => changes.extend(op.map(|op| (op, *id))),
+                    _ => {}
+                }
+            }
+        }
+        let preserve_rb = !matches!(a.get(b"PreserveRB").map(|o| self.resolve(o)), Ok(Object::Boolean(false)));
+        LinkTarget::SetLayers { changes, preserve_rb }
+    }
+
+    // ── form fields ─────────────────────────────────────────────────────────────────────────
+
+    pub(super) fn field(
+        &self,
+        o: &'a Object,
+        parent: Option<(&str, Option<String>, Option<i64>)>,
+        out: &mut Vec<Field>,
+        seen: &mut HashSet<ObjectId>,
+        depth: u32,
+    ) {
+        if depth > 32 {
+            return;
+        }
+        if let Object::Reference(id) = o
+            && !seen.insert(*id)
+        {
+            return;
+        }
+        let Some(d) = self.dict(o) else { return };
+        let (parent_name, parent_ft, parent_ff) = parent.unwrap_or(("", None, None));
+        let partial = self.text(d, b"T");
+        let full = match (&partial, parent_name.is_empty()) {
+            (Some(t), true) => t.clone(),
+            (Some(t), false) => format!("{parent_name}.{t}"),
+            (None, _) => parent_name.to_string(),
+        };
+        let ft = self.name(d, b"FT").or(parent_ft);
+        let ff = d.get(b"Ff").ok().and_then(|x| x.as_i64().ok()).or(parent_ff);
+        // Non-terminal: has kids that are fields (they carry /T). Widgets-only kids are terminal.
+        let kids = match d.get(b"Kids").map(|k| self.resolve(k)) {
+            Ok(Object::Array(k)) => k.as_slice(),
+            _ => &[],
+        };
+        let field_kids: Vec<_> = kids.iter().filter(|k| self.dict(k).is_some_and(|kd| kd.get(b"T").is_ok())).collect();
+        if !field_kids.is_empty() {
+            for k in field_kids {
+                self.field(k, Some((&full, ft.clone(), ff)), out, seen, depth + 1);
+            }
+            return;
+        }
+        let flags = ff.unwrap_or(0);
+        let kind = match ft.as_deref() {
+            Some("Tx") => FieldKind::Text,
+            Some("Btn") if flags & (1 << 16) != 0 => FieldKind::PushButton,
+            Some("Btn") if flags & (1 << 15) != 0 => FieldKind::Radio,
+            Some("Btn") => FieldKind::CheckBox,
+            Some("Ch") if flags & (1 << 17) != 0 => FieldKind::Combo,
+            Some("Ch") => FieldKind::List,
+            Some("Sig") => FieldKind::Signature,
+            _ => FieldKind::Unknown,
+        };
+        let value = match d.get(b"V").map(|v| self.resolve(v)) {
+            Ok(Object::Name(n)) => Some(String::from_utf8_lossy(n).into_owned()),
+            Ok(Object::String(bytes, _)) => Some(text_string(bytes)),
+            Ok(Object::Array(a)) => Some(
+                a.iter()
+                    .filter_map(|x| match self.resolve(x) {
+                        Object::String(bytes, _) => Some(text_string(bytes)),
+                        _ => None,
+                    })
+                    .collect::<Vec<_>>()
+                    .join(", "),
+            ),
+            Ok(Object::Dictionary(_)) if kind == FieldKind::Signature => Some("signed".into()),
+            _ => None,
+        };
+        // The widget is either this dict (merged field/widget) or its first kid.
+        let widget = if d.get(b"Rect").is_ok() { Some(d) } else { kids.first().and_then(|k| self.dict(k)) };
+        let page = widget.and_then(|w| w.get(b"P").ok()).and_then(|p| self.page_of(p)).or_else(|| self.find_widget_page(o, kids));
+        let has_actions = d.get(b"AA").is_ok() || widget.is_some_and(|w| w.get(b"AA").is_ok() || w.get(b"A").is_ok());
+        let rect = widget.and_then(|w| w.get(b"Rect").ok()).map(|r| rect4(self.resolve(r)));
+        out.push(Field { name: full, kind, value, page, tooltip: self.text(d, b"TU"), has_actions, rect });
+    }
+
+    /// The first page whose `/Annots` lists the field or one of its kids.
+    fn find_widget_page(&self, field: &Object, kids: &[Object]) -> Option<usize> {
+        let pages = self.annotation_pages.get_or_init(|| self.annotation_pages());
+        std::iter::once(field).chain(kids).filter_map(|o| if let Object::Reference(id) = o { pages.get(id).copied() } else { None }).min()
+    }
+
+    /// Each annotation listed in a page's `/Annots`, with the first page that lists it.
+    fn annotation_pages(&self) -> HashMap<ObjectId, usize> {
+        let mut pages = HashMap::new();
+        for (idx, &pid) in self.page_ids.iter().enumerate() {
+            let Some(annots) = self.doc.get_dictionary(pid).ok().and_then(|d| d.get(b"Annots").ok()) else { continue };
+            let Ok(annots) = self.resolve(annots).as_array() else { continue };
+            for a in annots {
+                if let Object::Reference(id) = a {
+                    pages.entry(*id).or_insert(idx);
+                }
+            }
+        }
+        pages
+    }
+
+    /// The topmost field above widget `id` (itself without a `/Parent`), or `None` when it or an
+    /// ancestor is already reachable from the `/Fields` tree, or a `/Parent` loop hides the top.
+    pub(super) fn unlisted_field(&self, id: ObjectId, seen: &HashSet<ObjectId>) -> Option<ObjectId> {
+        let mut top = id;
+        let mut visited = HashSet::from([id]);
+        loop {
+            let o = Object::Reference(top);
+            let d = self.dict(&o)?;
+            let parent = match d.get(b"Parent") {
+                Ok(Object::Reference(p)) => Some(*p),
+                _ => None,
+            };
+            let Some(p) = parent else {
+                return if seen.contains(&top) { None } else { Some(top) };
+            };
+            if !visited.insert(p) || visited.len() > 64 {
+                return None;
+            }
+            if seen.contains(&p) {
+                return None;
+            }
+            top = p;
+        }
+    }
+}
+
+/// An annotation's `/F` as the renderer reads it: a real is truncated, and a value that isn't a
+/// `u32` counts as no flags.
+fn draw_flags(o: &Object) -> u32 {
+    let f = match o {
+        Object::Integer(i) => *i,
+        Object::Real(r) => *r as i64,
+        _ => 0,
+    };
+    u32::try_from(f).unwrap_or(0)
+}
+
+fn rect4(o: &Object) -> [f32; 4] {
+    match o {
+        Object::Array(a) if a.len() == 4 => {
+            let v: Vec<f32> = a.iter().map(|x| x.as_float().unwrap_or(0.0)).collect();
+            [v[0].min(v[2]), v[1].min(v[3]), v[0].max(v[2]), v[1].max(v[3])]
+        }
+        _ => [0.0; 4],
+    }
+}
diff --git a/crates/render/src/inspect/core.rs b/crates/render/src/inspect/core.rs
new file mode 100644
index 0000000000..875d873654
--- /dev/null
+++ b/crates/render/src/inspect/core.rs
@@ -0,0 +1,417 @@
+use super::annotations::MAX_LINK_ATTACHMENT_TEXT_BYTES;
+use super::model::{AttachmentSource, PageInfo, Xfa};
+use super::navigation::text_string;
+use super::*;
+
+/// lopdf decodes object and cross-reference streams while it loads, with no limit unless one is
+/// set: a few hundred bytes of nested FlateDecode then inflate to gigabytes. Real object and
+/// xref streams are far below this.
+const LOAD_STREAM_LIMIT: usize = 256 << 20;
+
+pub(super) fn load_options(password: Option<&str>) -> LoadOptions {
+    LoadOptions { password: password.map(str::to_owned), max_decompressed_size: Some(LOAD_STREAM_LIMIT), ..LoadOptions::default() }
+}
+
+/// Check that `bytes` still open as the same document: the parser reads them and the page
+/// count matches. Content-only edits skip the full [`inspect`] (seconds on very large files)
+/// but must still catch an edit that produced something the viewer cannot display, so the
+/// caller can roll it back. Never panics: parser crashes are caught and reported.
+pub fn check_pages(bytes: Arc<Vec<u8>>, password: Option<&str>, expected: usize) -> Result<(), OpenError> {
+    let pdf = catch_unwind(AssertUnwindSafe(|| Pdf::new_with_password(bytes, password.unwrap_or(""))))
+        .map_err(|p| OpenError::Invalid(format!("the parser crashed: {}", crate::raster::panic_message(&p))))?
+        .map_err(|e| match e {
+            LoadPdfError::Decryption(DecryptionError::PasswordProtected) => {
+                if password.is_some() {
+                    OpenError::WrongPassword
+                } else {
+                    OpenError::NeedsPassword
+                }
+            }
+            LoadPdfError::Decryption(other) => OpenError::Unsupported(format!("encryption not supported: {other:?}")),
+            LoadPdfError::Invalid => OpenError::Invalid("no readable page tree or cross-reference data was found".into()),
+        })?;
+    let pages = catch_unwind(AssertUnwindSafe(|| pdf.pages().len()))
+        .map_err(|p| OpenError::Invalid(format!("the page tree could not be read: {}", crate::raster::panic_message(&p))))?;
+    if pages != expected {
+        return Err(OpenError::Invalid(format!("the edit changed the page count from {expected} to {pages}")));
+    }
+    Ok(())
+}
+
+/// Inspect a document. Fails only if the renderer itself cannot open the file (or needs a
+/// password). Never panics: parser crashes are caught and reported.
+pub fn inspect(bytes: Arc<Vec<u8>>, password: Option<&str>) -> Result<DocInfo, OpenError> {
+    let pdf = catch_unwind(AssertUnwindSafe(|| Pdf::new_with_password(bytes.clone(), password.unwrap_or(""))))
+        .map_err(|p| OpenError::Invalid(format!("the parser crashed: {}", crate::raster::panic_message(&p))))?
+        .map_err(|e| match e {
+            LoadPdfError::Decryption(DecryptionError::PasswordProtected) => {
+                if password.is_some() {
+                    OpenError::WrongPassword
+                } else {
+                    OpenError::NeedsPassword
+                }
+            }
+            LoadPdfError::Decryption(other) => OpenError::Unsupported(format!("encryption not supported: {other:?}")),
+            LoadPdfError::Invalid => OpenError::Invalid("no readable page tree or cross-reference data was found".into()),
+        })?;
+    let mut info = DocInfo { file_size: bytes.len(), pdf_version: version_label(&format!("{:?}", pdf.version())), ..Default::default() };
+    let pages = catch_unwind(AssertUnwindSafe(|| {
+        let mut out = Vec::new();
+        for (i, page) in pdf.pages().iter().enumerate() {
+            let (w, h) = page.render_dimensions();
+            let c = page.intersected_crop_box();
+            let rotation = match page.rotation() {
+                hayro::hayro_syntax::page::Rotation::None => 0,
+                hayro::hayro_syntax::page::Rotation::Horizontal => 90,
+                hayro::hayro_syntax::page::Rotation::Flipped => 180,
+                hayro::hayro_syntax::page::Rotation::FlippedHorizontal => 270,
+            };
+            let crop = [c.x0 as f32, c.y0 as f32, c.x1 as f32, c.y1 as f32];
+            // Degenerate boxes still get a usable placeholder size so layout never divides by zero.
+            let (w, h) = if w.is_finite() && h.is_finite() && w >= 1.0 && h >= 1.0 { (w, h) } else { (612.0, 792.0) };
+            out.push(PageInfo { width: w, height: h, label: (i + 1).to_string(), crop, rotation });
+        }
+        out
+    }));
+    match pages {
+        Ok(p) => info.pages = p,
+        Err(p) => return Err(OpenError::Invalid(format!("the page tree could not be read: {}", crate::raster::panic_message(&p)))),
+    }
+    let options = load_options(password);
+    // Geometry no longer needs the renderer parser. Do not overlap its allocations with
+    // structural inspection, including the compatibility fallback for damaged files.
+    drop(pdf);
+    inspect_structure(&mut info, |tmp| {
+        // The lazy reader first; lopdf's repair/tolerance path when it can't expose the same
+        // page tree or an object a panel needs. No partial result is published.
+        let lazy = catch_unwind(AssertUnwindSafe(|| {
+            let doc = LazyStructure::new(bytes.clone(), password).ok()?;
+            let mut t = DocInfo { pages: tmp.pages.clone(), ..Default::default() };
+            let inspector = Inspector::new(&doc);
+            if inspector.page_index.len() != t.pages.len() {
+                return None;
+            }
+            inspector.fill(&mut t);
+            (!doc.failed()).then_some(t)
+        }))
+        .ok()
+        .flatten();
+        if let Some(t) = lazy {
+            *tmp = t;
+            return Ok(());
+        }
+        let doc = Document::load_mem_with_options(&bytes, options).map_err(|e| e.to_string())?;
+        Inspector::new(&doc).fill(tmp);
+        Ok(())
+    });
+    if info.pages.is_empty() {
+        return Err(OpenError::Invalid("the document has no pages".into()));
+    }
+    Ok(info)
+}
+
+// Commit auxiliary metadata only after inspection succeeds; renderer geometry is the fallback.
+pub(super) fn inspect_structure(info: &mut DocInfo, fill: impl FnOnce(&mut DocInfo) -> Result<(), String>) {
+    let structure = catch_unwind(AssertUnwindSafe(|| {
+        let mut tmp = DocInfo { pages: info.pages.clone(), ..Default::default() };
+        fill(&mut tmp)?;
+        Ok::<_, String>(tmp)
+    }));
+    match structure {
+        Ok(Ok(mut filled)) => {
+            filled.file_size = info.file_size;
+            filled.pdf_version = std::mem::take(&mut info.pdf_version);
+            *info = filled;
+        }
+        Ok(Err(e)) => info.warnings.push(format!("Some document structure (bookmarks, comments, fields) could not be read: {e}")),
+        Err(p) => {
+            info.warnings.push(format!("Document structure inspection crashed and was skipped: {}", crate::raster::panic_message(&p)));
+        }
+    }
+}
+
+pub(super) struct Inspector<'a> {
+    pub(super) doc: &'a dyn Structure,
+    pub(super) page_ids: Vec<ObjectId>,
+    pub(super) page_index: HashMap<ObjectId, usize>,
+    /// Named destinations (`/Names /Dests` tree), keyed by raw string bytes, built once.
+    /// Looking each name up by walking the tree was O(links × names): minutes on manuals.
+    pub(super) named: HashMap<Vec<u8>, &'a Object>,
+    /// The page of each annotation (the first page that lists it), built when a field's widget
+    /// has no `/P`. Searching every page's `/Annots` for each such field was O(fields ×
+    /// annotations): a second on a form of 8,000 fields.
+    pub(super) annotation_pages: OnceCell<HashMap<ObjectId, usize>>,
+}
+
+impl<'a> Inspector<'a> {
+    pub(super) fn new(doc: &'a dyn Structure) -> Self {
+        let page_ids = doc.page_ids();
+        let page_index = page_ids.iter().copied().enumerate().map(|(index, id)| (id, index)).collect();
+        let mut me = Self { doc, page_ids, page_index, named: HashMap::new(), annotation_pages: OnceCell::new() };
+        let mut named = HashMap::new();
+        if let Some(tree) =
+            doc.catalog().ok().and_then(|c| c.get(b"Names").ok()).and_then(|o| me.dict(o)).and_then(|n| n.get(b"Dests").ok()).and_then(|o| me.dict(o))
+        {
+            me.name_tree_raw(tree, &mut HashSet::new(), 0, &mut named);
+        }
+        me.named = named;
+        me
+    }
+
+    pub(super) fn fill(&self, info: &mut DocInfo) {
+        // lopdf drops /Encrypt from the trailer once it has decrypted the file.
+        info.encrypted = self.doc.encrypted();
+        if let Some(d) = self.doc.trailer().get(b"Info").ok().and_then(|o| self.dict(o)) {
+            info.title = self.text(d, b"Title");
+            info.author = self.text(d, b"Author");
+            info.subject = self.text(d, b"Subject");
+            info.keywords = self.text(d, b"Keywords");
+            info.creator = self.text(d, b"Creator");
+            info.producer = self.text(d, b"Producer");
+            const STANDARD: [&[u8]; 9] =
+                [b"Title", b"Author", b"Subject", b"Keywords", b"Creator", b"Producer", b"CreationDate", b"ModDate", b"Trapped"];
+            // The same rule as the engine's list after an edit (`pdfcraft_organize::custom_info`,
+            // trimmed and without empty values): text strings only, so a name value is not a
+            // custom property, and the cap counts listed entries.
+            info.custom = d
+                .iter()
+                .filter(|(k, _)| !STANDARD.contains(&k.as_slice()))
+                .filter_map(|(k, v)| match self.resolve(v) {
+                    Object::String(bytes, _) => {
+                        let v = text_string(bytes).trim_matches(|c: char| c == '\0' || c.is_whitespace()).to_string();
+                        (!v.is_empty()).then(|| (String::from_utf8_lossy(k).into_owned(), v))
+                    }
+                    _ => None,
+                })
+                .take(256)
+                .collect();
+        }
+        let Ok(catalog) = self.doc.catalog() else { return };
+        info.tagged = catalog
+            .get(b"MarkInfo")
+            .ok()
+            .and_then(|o| self.dict(o))
+            .and_then(|m| m.get(b"Marked").ok())
+            // Any value may be written as an indirect reference, `/Marked 9 0 R` included, so the
+            // flag is resolved before it is read as a boolean (#3671).
+            .map(|o| self.resolve(o))
+            .and_then(|o| o.as_bool().ok())
+            .unwrap_or(false);
+        match self.page_labels(catalog, &mut info.pages) {
+            Ok(notes) => info.warnings.extend(notes.into_iter().map(|note| format!("Page labels: {note}."))),
+            Err(reason) => info.warnings.push(format!("Page labels were skipped: {reason}; using physical page numbers.")),
+        }
+        if let Some(first) = catalog.get(b"Outlines").ok().and_then(|o| self.dict(o)).and_then(|d| d.get(b"First").ok()) {
+            (info.outline, info.outline_more) = self.outline_window(first);
+        }
+        let mut text_budget = MAX_LINK_ATTACHMENT_TEXT_BYTES;
+        self.annotations(info, &mut text_budget);
+        self.transitions(info);
+        let mut field_seen = HashSet::new();
+        if let Some(form) = catalog.get(b"AcroForm").ok().and_then(|o| self.dict(o))
+            && let Ok(fields) = form.get(b"Fields").and_then(|o| self.resolve(o).as_array())
+        {
+            for f in fields {
+                self.field(f, None, &mut info.fields, &mut field_seen, 0);
+            }
+        }
+        // Widgets no `/Fields` entry reaches are fields too (Acrobat and the browsers fill them);
+        // each is adopted through its topmost unlisted `/Parent`, so a split field stays one.
+        for &pid in &self.page_ids {
+            let Ok(page_dict) = self.doc.get_dictionary(pid) else { continue };
+            let Ok(Object::Array(annots)) = page_dict.get(b"Annots").map(|o| self.resolve(o)) else { continue };
+            for a in annots {
+                let Some(d) = self.dict(a) else { continue };
+                if self.name(d, b"Subtype").as_deref() != Some("Widget")
+                    || (d.get(b"FT").is_err() && d.get(b"T").is_err() && d.get(b"Parent").is_err())
+                {
+                    continue;
+                }
+                if let Object::Reference(id) = a
+                    && let Some(root) = self.unlisted_field(*id, &field_seen)
+                {
+                    self.field(&Object::Reference(root), None, &mut info.fields, &mut field_seen, 0);
+                }
+            }
+        }
+        info.has_javascript |= info.fields.iter().any(|f| f.has_actions);
+        let needs_rendering = catalog.get(b"NeedsRendering").ok().and_then(|o| self.resolve(o).as_bool().ok()).unwrap_or(false);
+        if let Some(xfa) = catalog.get(b"AcroForm").ok().and_then(|o| self.dict(o)).and_then(|form| form.get(b"XFA").ok()) {
+            // A form with no fields is taken to be laid out from its template, unless its
+            // configuration says it is a static form (#3180): Designer writes
+            // `<dynamicRender>forbidden</dynamicRender>` for one, whose pages are the form.
+            let static_form = self.xfa_dynamic_render(xfa).as_deref() == Some("forbidden");
+            info.xfa = Some(if needs_rendering || (info.fields.is_empty() && !static_form) { Xfa::Dynamic } else { Xfa::Static });
+        }
+        self.layers(catalog, &mut info.layers);
+        info.layer_groups = self.layer_groups(catalog);
+        self.fonts(&mut info.fonts);
+        if let Some(names) = catalog.get(b"Names").ok().and_then(|o| self.dict(o)) {
+            if let Some(ef) = names.get(b"EmbeddedFiles").ok().and_then(|o| self.dict(o)) {
+                let mut seen = HashSet::new();
+                for (name, spec) in self.name_tree(ef, &mut seen, 0, &mut text_budget) {
+                    // The key is kept a second time when it is also the name.
+                    let fallback = |budget: &mut usize| spend(name.as_bytes(), budget, |_| name.clone());
+                    info.attachments.push(self.attachment(spec, AttachmentSource::Document { key: name.clone() }, &mut text_budget, fallback));
+                }
+            }
+            info.has_javascript |= names.get(b"JavaScript").is_ok();
+        }
+        if let Ok(action) = catalog.get(b"OpenAction")
+            && let Some(dict) = self.dict(action)
+            && dict.get(b"S").ok().and_then(|o| self.resolve(o).as_name().ok()) == Some(&b"JavaScript"[..])
+        {
+            info.has_javascript = true;
+        }
+        info.open_dest = catalog.get(b"OpenAction").ok().and_then(|o| self.open_dest(o));
+    }
+
+    pub(super) fn resolve(&self, o: &'a Object) -> &'a Object {
+        self.doc.dereference(o).map(|(_, o)| o).unwrap_or(o)
+    }
+
+    /// The object a reference ends at after following any chain of references; `None` for a
+    /// direct object or a broken reference.
+    pub(super) fn resolved_id(&self, o: &Object) -> Option<ObjectId> {
+        self.doc.dereference(o).ok().and_then(|(id, _)| id)
+    }
+
+    pub(super) fn dict(&self, o: &'a Object) -> Option<&'a Dictionary> {
+        match self.resolve(o) {
+            Object::Dictionary(d) => Some(d),
+            Object::Stream(s) => Some(&s.dict),
+            _ => None,
+        }
+    }
+
+    pub(super) fn text(&self, d: &Dictionary, key: &[u8]) -> Option<String> {
+        let s = trimmed_text(self.resolve(d.get(key).ok()?))?;
+        (!s.is_empty()).then_some(s)
+    }
+
+    /// [`Self::text`], converted and spent from `budget` as [`spend`] does, so text that trims
+    /// short or to nothing still spends its raw length.
+    pub(super) fn budgeted_text(&self, d: &Dictionary, key: &[u8], budget: &mut usize) -> Option<String> {
+        let o = self.resolve(d.get(key).ok()?);
+        let (Object::String(bytes, _) | Object::Name(bytes)) = o else { return None };
+        let text = spend(bytes, budget, |_| trimmed_text(o).unwrap_or_default())?;
+        (!text.is_empty()).then_some(text)
+    }
+
+    pub(super) fn name(&self, d: &Dictionary, key: &[u8]) -> Option<String> {
+        self.resolve(d.get(key).ok()?).as_name().ok().map(|n| String::from_utf8_lossy(n).into_owned())
+    }
+}
+
+/// A string or name value as text, without surrounding NULs and white space.
+fn trimmed_text(o: &Object) -> Option<String> {
+    let s = match o {
+        Object::String(bytes, _) => text_string(bytes),
+        Object::Name(n) => String::from_utf8_lossy(n).into_owned(),
+        _ => return None,
+    };
+    Some(s.trim_matches('\0').trim().to_string())
+}
+
+/// `convert(bytes)` when the result fits in `budget`, which it then spends by the longer of the raw
+/// and converted lengths. Bytes longer than the budget are not converted. A conversion that comes
+/// out too long spends the raw length, so a string many entries share is converted only until the
+/// budget runs out.
+pub(super) fn spend(bytes: &[u8], budget: &mut usize, convert: impl FnOnce(&[u8]) -> String) -> Option<String> {
+    if bytes.len() > *budget {
+        return None;
+    }
+    let text = convert(bytes);
+    if text.len() > *budget {
+        *budget = budget.saturating_sub(bytes.len());
+        return None;
+    }
+    // The conversion's work follows the raw length, even when the text it keeps is shorter.
+    *budget = budget.saturating_sub(text.len().max(bytes.len()));
+    Some(text)
+}
+
+pub(super) fn limited_pdf_string(bytes: &[u8], max_bytes: usize) -> Option<String> {
+    if bytes.len() > max_bytes {
+        return None;
+    }
+    let text = text_string(bytes);
+    (text.len() <= max_bytes).then_some(text)
+}
+
+/// `D:20260930104512-04'00'` → `2026-09-30 10:45`.
+/// A PDF date (`D:20261001123000Z`) as "2026-10-01 12:30"; other strings unchanged.
+pub fn pretty_date(s: &str) -> String {
+    let d = s.trim_start_matches("D:");
+    if let Some(d) = d.get(..12).filter(|d| d.bytes().all(|b| b.is_ascii_digit())) {
+        // Twelve ASCII digits make every slice below a UTF-8 character boundary.
+        format!("{}-{}-{} {}:{}", &d[0..4], &d[4..6], &d[6..8], &d[8..10], &d[10..12])
+    } else {
+        s.to_string()
+    }
+}
+
+/// "1.7" from the parser's version name ("Pdf17", "V1_7", …).
+fn version_label(name: &str) -> String {
+    let digits: Vec<char> = name.chars().filter(char::is_ascii_digit).collect();
+    match digits[..] {
+        [a, b] => format!("{a}.{b}"),
+        _ => name.to_owned(),
+    }
+}
+
+#[cfg(test)]
+mod version_tests {
+    #[test]
+    fn version_labels_read_as_numbers() {
+        assert_eq!(super::version_label("Pdf17"), "1.7");
+        assert_eq!(super::version_label("V2_0"), "2.0");
+        assert_eq!(super::version_label("Unknown"), "Unknown");
+    }
+}
+
+#[cfg(test)]
+mod open_action_javascript_tests {
+    use std::sync::Arc;
+
+    use super::inspect;
+
+    /// One-page PDF whose catalog points its /OpenAction at object 4 (written by the caller).
+    fn pdf_with_open_action(action: &[u8]) -> Vec<u8> {
+        let objs: Vec<&[u8]> = vec![
+            b"<< /Type /Catalog /Pages 2 0 R /OpenAction 4 0 R >>",
+            b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+            b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >>",
+            action,
+        ];
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+            out.extend_from_slice(o);
+            out.extend_from_slice(b"\nendobj\n");
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        out
+    }
+
+    #[test]
+    fn open_action_javascript_sets_has_javascript() {
+        let bytes = pdf_with_open_action(b"<< /S /JavaScript /JS (app.alert('hi')) >>");
+        let info = inspect(Arc::new(bytes), None).expect("inspects");
+        assert!(info.has_javascript, "an /OpenAction /JavaScript is JavaScript");
+    }
+
+    #[test]
+    fn open_action_goto_does_not_set_has_javascript() {
+        let bytes = pdf_with_open_action(b"<< /S /GoTo /D [3 0 R /Fit] >>");
+        let info = inspect(Arc::new(bytes), None).expect("inspects");
+        assert!(!info.has_javascript, "a /GoTo /OpenAction is not JavaScript");
+    }
+}
diff --git a/crates/render/src/inspect/model.rs b/crates/render/src/inspect/model.rs
new file mode 100644
index 0000000000..e5f09c9242
--- /dev/null
+++ b/crates/render/src/inspect/model.rs
@@ -0,0 +1,539 @@
+use super::*;
+
+/// What kind of XFA form a document has (`/AcroForm /XFA`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Xfa {
+    /// The pages and fields are ordinary PDF; the XFA packets describe the same form (and hold
+    /// its data, which Acrobat shows in preference to the fields).
+    Static,
+    /// The form is laid out from the XFA packets at open (`/NeedsRendering`, or no fields and a
+    /// configuration that doesn't forbid dynamic rendering): the PDF pages are only a placeholder.
+    Dynamic,
+}
+
+/// A page's presentation transition and display time (ISO 32000-2 §12.4.4): how the page comes
+/// into view in a full-screen presentation, and how long it stays before advancing. Only pages
+/// carrying `/Trans` or `/Dur` are listed. Values outside the spec's ranges fall back to the
+/// defaults rather than being refused.
+#[derive(Clone, Debug, PartialEq)]
+pub struct PageTransition {
+    pub page: usize,
+    /// `/Trans /S`; `None` when the page has only `/Dur`.
+    pub style: Option<TransitionStyle>,
+    /// `/D`: how long the transition takes, in seconds (default 1).
+    pub duration: f32,
+    /// `/Dm /H` (true) or `/V` (Split, Blinds).
+    pub horizontal: bool,
+    /// `/M /I` (true) or `/O` (Split, Box, Fly).
+    pub inward: bool,
+    /// `/Di`: 0, 90, 180, 270 or 315 degrees (Wipe, Glitter, Fly, Cover, Uncover, Push); `None`
+    /// for `/None` (Fly only).
+    pub direction: Option<u16>,
+    /// `/SS`: the Fly scale (default 1).
+    pub scale: f32,
+    /// `/B`: Fly with an opaque backdrop.
+    pub opaque: bool,
+    /// `/Dur`: seconds the page shows before the presentation advances; `None` waits for the
+    /// presenter.
+    pub display: Option<f32>,
+}
+
+/// The transition styles of ISO 32000-2 table 164 (`/Trans /S`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum TransitionStyle {
+    Split,
+    Blinds,
+    Box,
+    Wipe,
+    Dissolve,
+    Glitter,
+    /// `/R`: the next page replaces the old one with no effect (the default).
+    Replace,
+    Fly,
+    Push,
+    Cover,
+    Uncover,
+    Fade,
+}
+
+impl TransitionStyle {
+    /// The style a `/S` name means; an unknown name is `Replace`, the spec's default.
+    pub fn from_name(name: &str) -> Self {
+        match name {
+            "Split" => Self::Split,
+            "Blinds" => Self::Blinds,
+            "Box" => Self::Box,
+            "Wipe" => Self::Wipe,
+            "Dissolve" => Self::Dissolve,
+            "Glitter" => Self::Glitter,
+            "Fly" => Self::Fly,
+            "Push" => Self::Push,
+            "Cover" => Self::Cover,
+            "Uncover" => Self::Uncover,
+            "Fade" => Self::Fade,
+            _ => Self::Replace,
+        }
+    }
+
+    /// The name as written in a PDF (`/S`).
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Split => "Split",
+            Self::Blinds => "Blinds",
+            Self::Box => "Box",
+            Self::Wipe => "Wipe",
+            Self::Dissolve => "Dissolve",
+            Self::Glitter => "Glitter",
+            Self::Replace => "R",
+            Self::Fly => "Fly",
+            Self::Push => "Push",
+            Self::Cover => "Cover",
+            Self::Uncover => "Uncover",
+            Self::Fade => "Fade",
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct PageInfo {
+    /// Displayed size in points, after `/Rotate` and `/UserUnit`.
+    pub width: f32,
+    pub height: f32,
+    /// Page label (`/PageLabels`), falling back to the 1-based page number.
+    pub label: String,
+    /// Effective crop box in user space [x0, y0, x1, y1] (the visible region).
+    pub crop: [f32; 4],
+    /// Clockwise page rotation in degrees (0, 90, 180, 270).
+    pub rotation: u16,
+}
+
+impl PageInfo {
+    /// A point in view space (points, y down, after `/Rotate`; what the text layer uses) →
+    /// PDF user space.
+    pub fn view_to_user(&self, x: f32, y: f32) -> [f32; 2] {
+        let [cx0, cy0, cx1, cy1] = self.crop;
+        let (a, b) = (x / self.width.max(1e-3), y / self.height.max(1e-3));
+        let (u, v) = match self.rotation {
+            90 => (b, 1.0 - a),
+            180 => (1.0 - a, 1.0 - b),
+            270 => (1.0 - b, a),
+            _ => (a, b),
+        };
+        [cx0 + u * (cx1 - cx0), cy1 - v * (cy1 - cy0)]
+    }
+
+    /// PDF user space → view space (the inverse of [`Self::view_to_user`]).
+    pub fn user_to_view(&self, x: f32, y: f32) -> [f32; 2] {
+        let [cx0, cy0, cx1, cy1] = self.crop;
+        let (u, v) = ((x - cx0) / (cx1 - cx0).max(1e-3), (cy1 - y) / (cy1 - cy0).max(1e-3));
+        let (a, b) = match self.rotation {
+            90 => (1.0 - v, u),
+            180 => (1.0 - u, 1.0 - v),
+            270 => (v, 1.0 - u),
+            _ => (u, v),
+        };
+        [a * self.width, b * self.height]
+    }
+
+    /// A point as displayed (points from the page's top-left, y down, before any view rotation)
+    /// → the `/XYZ` position `[left, top]` in user space that puts it at the window's top-left.
+    /// Only a coordinate that is given is pinned: a bookmark made at the top of the window
+    /// leaves the horizontal position alone. On a page turned a quarter, the displayed `y` decides
+    /// the user `left` and the displayed `x` the user `top` (the inverse of [`Self::dest_fraction`]).
+    /// A value that is not finite counts as not given.
+    pub fn xyz_for_view(&self, x: Option<f32>, y: Option<f32>) -> [Option<f32>; 2] {
+        let (x, y) = (x.filter(|v| v.is_finite()), y.filter(|v| v.is_finite()));
+        let [ux, uy] = self.view_to_user(x.unwrap_or(0.0), y.unwrap_or(0.0));
+        if self.rotation.is_multiple_of(180) { [x.map(|_| ux), y.map(|_| uy)] } else { [y.map(|_| ux), x.map(|_| uy)] }
+    }
+
+    /// A destination's user-space point (each coordinate possibly unspecified) → the same point
+    /// as a fraction of the displayed page `[x, y]` (0..1 from its top-left corner, y down),
+    /// after `/Rotate` and a further clockwise `view_rotation` (0, 90, 180 or 270). On a page
+    /// turned a quarter, the user `x` decides the displayed `y` and vice versa, so each output
+    /// is `None` when the input it comes from is (or is not finite). Points off the page are
+    /// clamped to its edge.
+    pub fn dest_fraction(&self, x: Option<f32>, y: Option<f32>, view_rotation: u16) -> [Option<f32>; 2] {
+        let [cx0, cy0, cx1, cy1] = self.crop;
+        let frac = |v: f32| if v.is_finite() { Some(v.clamp(0.0, 1.0)) } else { None };
+        // Unrotated fractions across (u, from the crop's left) and down (v, from its top).
+        let u = x.and_then(|x| frac((x - cx0) / (cx1 - cx0).max(1e-3)));
+        let v = y.and_then(|y| frac((cy1 - y) / (cy1 - cy0).max(1e-3)));
+        let flip = |f: Option<f32>| f.map(|f| 1.0 - f);
+        match (u32::from(self.rotation) + u32::from(view_rotation)) % 360 {
+            90 => [flip(v), u],
+            180 => [flip(u), flip(v)],
+            270 => [v, flip(u)],
+            _ => [u, v],
+        }
+    }
+
+    /// A view-space rectangle → the normalized user-space rectangle covering the same area of the
+    /// page (`[x0, y0, x1, y1]`, `x0 <= x1`, `y0 <= y1`). Under `/Rotate` the corners swap roles,
+    /// so a view rectangle's top-left is not in general the user rectangle's `[x0, y1]`.
+    pub fn view_rect_to_user(&self, r: [f32; 4]) -> [f32; 4] {
+        let (a, b) = (self.view_to_user(r[0], r[1]), self.view_to_user(r[2], r[3]));
+        [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
+    }
+
+    /// A view-space rectangle as a text-markup quad in user space: top-left, top-right,
+    /// bottom-left, bottom-right as read on screen.
+    pub fn view_rect_to_quad(&self, r: [f32; 4]) -> [f64; 8] {
+        let mut q = [0.0; 8];
+        for (i, (x, y)) in [(r[0], r[1]), (r[2], r[1]), (r[0], r[3]), (r[2], r[3])].into_iter().enumerate() {
+            let [ux, uy] = self.view_to_user(x, y);
+            q[2 * i] = ux as f64;
+            q[2 * i + 1] = uy as f64;
+        }
+        q
+    }
+}
+
+/// A clickable link annotation.
+#[derive(Clone, Debug)]
+pub struct Link {
+    pub page: usize,
+    /// Zero-based position in the page's raw `/Annots` array.
+    pub index: usize,
+    pub rect: [f32; 4],
+    pub target: LinkTarget,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum LinkTarget {
+    /// A destination in this document: the 0-based page and where on it the view goes.
+    Page(usize, DestView),
+    Uri(String),
+    /// A set-layer-visibility action (`SetOCGState`, ISO 32000-2 §12.6.4.13): each change in
+    /// order, naming the layer by its optional content group. With `preserve_rb`, a layer turned
+    /// on turns off the other layers of its radio-button groups.
+    SetLayers {
+        changes: Vec<(LayerOp, (u32, u16))>,
+        preserve_rb: bool,
+    },
+    /// A local-file remote Go-To action. The caller resolves `file` relative to the source path.
+    /// `launch` marks a Launch action that names a PDF file (see `launch_pdf`), opened the same
+    /// way: as a document in PdfCraft, never by the operating system.
+    RemoteGoTo {
+        launch: bool,
+        file: String,
+        destination: RemoteDestination,
+        new_window: Option<bool>,
+    },
+    Other(String),
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum RemoteDestination {
+    Default,
+    Page { page: usize, view: DestView },
+    Named(String),
+}
+
+/// What a set-layer-visibility action does to a layer.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LayerOp {
+    On,
+    Off,
+    Toggle,
+}
+
+/// Where an explicit destination (ISO 32000-2 §12.3.2.2, Table 149) places its page in the
+/// window. Coordinates are PDF user space; `None` is a `null` (or unusable) operand, which keeps
+/// that part of the view as it is.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub enum DestView {
+    /// The top of the page at the current zoom: a destination with no position, or one whose
+    /// type is missing or unknown.
+    #[default]
+    Top,
+    /// `/XYZ left top zoom`: the point (left, top) at the window's upper-left corner, at `zoom`
+    /// (1.0 = 100%; 0 or null keeps the current zoom).
+    Xyz { left: Option<f32>, top: Option<f32>, zoom: Option<f32> },
+    /// `/Fit`, and `/FitB` (fit the page's content box; read as the whole page).
+    Fit,
+    /// `/FitH top`, and `/FitBH`: fit the width, with `top` at the window's top edge.
+    FitH { top: Option<f32> },
+    /// `/FitV left`, and `/FitBV`: fit the height, with `left` at the window's left edge.
+    FitV { left: Option<f32> },
+    /// `/FitR left bottom right top`: fit the rectangle `[x0, y0, x1, y1]` (normalized).
+    FitR { rect: [f32; 4] },
+}
+
+impl DestView {
+    /// The view an explicit destination array asks for, from its elements after the page
+    /// (`/XYZ left top zoom`, `/FitH top`, …). Hostile input never fails: a missing or unknown
+    /// type, or a `/FitR` without four usable numbers, is [`DestView::Top`]; a non-numeric,
+    /// non-finite or missing operand is `None`; a zoom that is not positive is `None`.
+    pub fn from_operands(kind: Option<&[u8]>, operands: &[Option<f32>]) -> Self {
+        let n = |i: usize| operands.get(i).copied().flatten().filter(|v| v.is_finite());
+        match kind {
+            Some(b"XYZ") => Self::Xyz { left: n(0), top: n(1), zoom: n(2).filter(|z| *z > 0.0) },
+            Some(b"Fit" | b"FitB") => Self::Fit,
+            Some(b"FitH" | b"FitBH") => Self::FitH { top: n(0) },
+            Some(b"FitV" | b"FitBV") => Self::FitV { left: n(0) },
+            Some(b"FitR") => match (n(0), n(1), n(2), n(3)) {
+                (Some(x0), Some(y0), Some(x1), Some(y1)) => Self::FitR { rect: [x0.min(x1), y0.min(y1), x0.max(x1), y0.max(y1)] },
+                _ => Self::Top,
+            },
+            _ => Self::Top,
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct OutlineItem {
+    pub title: String,
+    pub page: Option<usize>,
+    /// Where on `page` the bookmark goes ([`DestView::Top`] for a bookmark without a page).
+    pub view: DestView,
+    pub children: Vec<OutlineItem>,
+    /// Whether the bookmark starts open: only a positive `/Count` says so (ISO 32000-2 §12.3.3,
+    /// Table 151). A negative one is closed, and so is a missing one, which a bookmark with
+    /// children should not have.
+    pub open: bool,
+    /// The title's colour (`/C`, DeviceRGB, ISO 32000-2 §12.3.3 Table 151), or `None` for the
+    /// default black or a value that isn't three numbers.
+    pub color: Option<[f32; 3]>,
+    /// The title's style (`/F`, Table 152): bit 1 italic, bit 2 bold.
+    pub italic: bool,
+    pub bold: bool,
+}
+
+#[derive(Clone, Debug)]
+pub struct Annotation {
+    pub page: usize,
+    pub subtype: String,
+    pub author: Option<String>,
+    pub contents: Option<String>,
+    pub modified: Option<String>,
+    /// `/NM` of this annotation, and of the one it replies to (`/IRT`).
+    pub name: Option<String>,
+    pub in_reply_to: Option<String>,
+    /// The page and `/Annots` position of the comment `/IRT` points at, found by object
+    /// reference. Threads follow this rather than `/NM`, which need not be unique: PyMuPDF
+    /// names the first comment on every page `fitz-A0`. `None` when `/IRT` leads to no listed
+    /// comment ([`link_replies`]).
+    pub parent: Option<(usize, usize)>,
+    /// `/RT /Group`: grouped with the annotation `/IRT` points at (Replace Text's caret with its
+    /// strikeout) rather than a reply to it.
+    pub grouped: bool,
+    /// Rect in PDF user space: [x0, y0, x1, y1].
+    pub rect: [f32; 4],
+    pub color: Option<[f32; 3]>,
+    /// Position in the page's `/Annots` (how edits address the comment).
+    pub index: usize,
+    /// For a status reply (`/State`, Acrobat's "Set status"): the state it sets.
+    pub state: Option<String>,
+    /// Text markup quadrilaterals (`/QuadPoints`), 8 numbers each.
+    pub quads: Vec<[f32; 8]>,
+    /// The Locked flag (`/F` bit 8): the comment can't be moved, resized, restyled or deleted.
+    pub locked: bool,
+    /// `/IT`, the intent: `FreeTextCallout`, `PolygonCloud`, `FreeTextTypeWriter`…
+    pub intent: Option<String>,
+    /// A Fill & Sign mark: typed text, a check, cross, dot or line, or a typed, drawn or picture
+    /// signature or initials (the rules of `pdfcraft_annot::is_fill_sign`).
+    pub fill_sign: bool,
+    /// The NoRotate flag (`/F` bit 5), set on sticky notes and attachments: on a turned page the
+    /// appearance stays upright, turned about the upper-left corner of `rect`
+    /// ([`Self::shown_rect`]).
+    pub no_rotate: bool,
+    /// The points that shape a line (its two ends, `/L`) or connected lines, a polygon or a
+    /// cloud (their corners, `/Vertices`), in user space; empty for other comments.
+    pub points: Vec<[f32; 2]>,
+}
+
+impl Annotation {
+    /// A checkmark reply (`/StateModel /Marked`): "Marked" or "Unmarked" rather than a review status.
+    pub fn is_mark(&self) -> bool {
+        matches!(self.state.as_deref(), Some("Marked" | "Unmarked"))
+    }
+
+    /// A reply (or status reply) to another comment rather than a comment of its own.
+    pub fn is_reply(&self) -> bool {
+        self.parent.is_some()
+    }
+
+    /// A comment of its own: not a reply, and not a status or checkmark. One whose comment can't
+    /// be found (deleted from another page, or never listed) has nothing to show, so it is listed
+    /// nowhere: not as a card, on the page or in a count.
+    pub fn is_comment(&self) -> bool {
+        !self.is_reply() && self.state.is_none()
+    }
+
+    /// Whether this annotation's `/IRT` points at `other`.
+    pub fn replies_to(&self, other: &Annotation) -> bool {
+        self.parent == Some((other.page, other.index))
+    }
+
+    /// Where the comment is drawn on a page turned by `rotation` (`PageInfo::rotation`), in user
+    /// space: `rect`, or for a NoRotate comment `rect` turned upright about its upper-left corner
+    /// (see [`Self::no_rotate`]). Hit-testing, selection and anything placed beside the comment
+    /// use this, so they match the drawing.
+    pub fn shown_rect(&self, rotation: u16) -> [f32; 4] {
+        self.shown(self.rect.map(f64::from), rotation).map(|v| v as f32)
+    }
+
+    /// [`Self::shown_rect`] for this comment with its `/Rect` at `rect` (one being moved or
+    /// resized).
+    pub fn shown(&self, rect: [f64; 4], rotation: u16) -> [f64; 4] {
+        if self.no_rotate { upright_rect(rect, rotation) } else { rect }
+    }
+
+    /// The `/Rect` that shows this comment in the user-space box `shown`: the inverse of
+    /// [`Self::shown`], for a box resized as drawn.
+    pub fn rect_for_shown(&self, shown: [f64; 4], rotation: u16) -> [f64; 4] {
+        if self.no_rotate { rect_from_upright(shown, rotation) } else { shown }
+    }
+}
+
+/// The user-space box a NoRotate annotation with `/Rect` `rect` is drawn in on a page turned
+/// clockwise by `rotation` (ISO 32000-2 §12.5.3): `rect` turned as far counterclockwise about its
+/// upper-left corner `(x0, y1)`, which stays where it is on the page. As displayed, the box's
+/// top-left is that corner, the rectangle's width runs across and its height down, as on an
+/// unturned page. `rect` itself for 0 or anything that isn't a quarter turn. The vendored
+/// renderer draws the appearance there (hayro-interpret patch 37).
+fn upright_rect(rect: [f64; 4], rotation: u16) -> [f64; 4] {
+    let [x0, y0, x1, y1] = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
+    let (w, h) = (x1 - x0, y1 - y0);
+    match rotation {
+        90 => [x0, y1, x0 + h, y1 + w],
+        180 => [x0 - w, y1, x0, y1 + h],
+        270 => [x0 - h, y1 - w, x0, y1],
+        _ => [x0, y0, x1, y1],
+    }
+}
+
+/// The `/Rect` whose [`upright_rect`] is `shown`: `shown` turned back about the corner that
+/// stays put.
+fn rect_from_upright(shown: [f64; 4], rotation: u16) -> [f64; 4] {
+    let [s0, s1, s2, s3] = [shown[0].min(shown[2]), shown[1].min(shown[3]), shown[0].max(shown[2]), shown[1].max(shown[3])];
+    let (sw, sh) = (s2 - s0, s3 - s1);
+    // The upper-left corner of `/Rect` and the rectangle's width and height.
+    let ((x0, y1), w, h) = match rotation {
+        90 => ((s0, s1), sh, sw),
+        180 => ((s2, s1), sw, sh),
+        270 => ((s2, s3), sh, sw),
+        _ => return [s0, s1, s2, s3],
+    };
+    [x0, y1 - h, x0 + w, y1]
+}
+
+/// Settle the reply links of a document's annotations: a reply keeps its `parent` only when
+/// following the links reaches a comment of its own within 64 steps. An `/IRT` to an unlisted
+/// object, a pop-up, the annotation itself or a loop leaves it a comment of its own, so it stays
+/// in view instead of hanging off nothing. Both comment readers (inspect, and the engine's list
+/// after an edit) run this.
+///
+/// Only comments can be parents: both readers leave links, form widgets, pop-ups and other
+/// non-markup annotations out of `annotations` (`pdfcraft_annot::is_comment_subtype`), so an
+/// `/IRT` to one of those finds no parent here. Pop-ups are skipped again in case a caller's list
+/// has them.
+pub fn link_replies(annotations: &mut [Annotation]) {
+    let at: HashMap<(usize, usize), usize> =
+        annotations.iter().enumerate().filter(|(_, a)| a.subtype != "Popup").map(|(i, a)| ((a.page, a.index), i)).collect();
+    let links: Vec<Option<usize>> =
+        annotations.iter().enumerate().map(|(i, a)| a.parent.and_then(|p| at.get(&p).copied()).filter(|&j| j != i)).collect();
+    for (i, a) in annotations.iter_mut().enumerate() {
+        let mut up = links.get(i).copied().flatten();
+        let mut settled = false;
+        for _ in 0..64 {
+            let Some(j) = up else { break };
+            up = links.get(j).copied().flatten();
+            if up.is_none() {
+                settled = true;
+                break;
+            }
+        }
+        if !settled {
+            a.parent = None;
+        }
+    }
+}
+
+/// The comment each reply's thread starts from, by the reply's page and `/Annots` position: a
+/// reply to a reply files under that comment too. Expects links [`link_replies`] settled.
+pub fn thread_tops(annotations: &[Annotation]) -> HashMap<(usize, usize), (usize, usize)> {
+    let parents: HashMap<(usize, usize), (usize, usize)> = annotations.iter().filter_map(|a| Some(((a.page, a.index), a.parent?))).collect();
+    parents
+        .iter()
+        .map(|(&reply, &first)| {
+            let mut top = first;
+            for _ in 0..64 {
+                let Some(&up) = parents.get(&top) else { break };
+                top = up;
+            }
+            (reply, top)
+        })
+        .collect()
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FieldKind {
+    Text,
+    CheckBox,
+    Radio,
+    PushButton,
+    Combo,
+    List,
+    Signature,
+    Unknown,
+}
+
+#[derive(Clone, Debug)]
+pub struct Field {
+    pub name: String,
+    pub kind: FieldKind,
+    pub value: Option<String>,
+    pub page: Option<usize>,
+    pub tooltip: Option<String>,
+    pub has_actions: bool,
+    /// Rect of the first widget, in user space.
+    pub rect: Option<[f32; 4]>,
+}
+
+#[derive(Clone, Debug)]
+pub struct Layer {
+    /// Object number and generation of the optional content group.
+    pub id: (u32, u16),
+    pub name: String,
+    pub visible: bool,
+    /// Shown as the file opens: the default configuration (`/OCProperties /D`).
+    pub initial: bool,
+}
+
+#[derive(Clone, Debug)]
+pub struct Attachment {
+    pub name: String,
+    pub description: Option<String>,
+    pub size: Option<usize>,
+    pub source: AttachmentSource,
+}
+
+/// Where an attachment lives (so its bytes can be fetched on demand).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum AttachmentSource {
+    /// Document-level: `/Names /EmbeddedFiles` entry with this key.
+    Document { key: String },
+    /// A FileAttachment annotation: page index and position in the page's `/Annots`.
+    Annotation { page: usize, index: usize },
+}
+
+/// A font used by the document (Document Properties ▸ Fonts).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct FontInfo {
+    /// BaseFont without the subset tag.
+    pub name: String,
+    /// Type1, TrueType, Type0, Type3, MMType1, CIDFontType0/2 …
+    pub kind: String,
+    pub embedded: bool,
+    pub subset: bool,
+    pub encoding: Option<String>,
+    /// The face standing in for a program the document does not embed. `None` when the font is
+    /// embedded (nothing stands in) or when no face was available at all -- `substitution` then
+    /// says which of the two it is.
+    pub substitute: Option<String>,
+    /// Why a face was substituted, as a sentence for whoever has to act on it. `None` only when
+    /// the document's own glyphs are being shown.
+    pub substitution: Option<String>,
+}
diff --git a/crates/render/src/inspect/navigation.rs b/crates/render/src/inspect/navigation.rs
new file mode 100644
index 0000000000..173217c93b
--- /dev/null
+++ b/crates/render/src/inspect/navigation.rs
@@ -0,0 +1,550 @@
+#[cfg(test)]
+use super::core::inspect;
+use super::core::spend;
+use super::model::{DestView, OutlineItem, PageInfo};
+use super::*;
+
+/// `DocInfo::outline` holds the first this many bookmarks in outline order. Opening a document
+/// reads only this window; the rest are listed by page through `pdfcraft_organize`.
+pub(super) const OUTLINE_WINDOW: usize = 10_000;
+
+/// Deepest level `DocInfo::outline` nests (the top level is 0); deeper bookmarks are left out.
+pub(super) const OUTLINE_DEPTH: usize = 32;
+
+impl<'a> Inspector<'a> {
+    /// The destination `/OpenAction` opens at (ISO 32000-2 §7.7.2 Table 29): an explicit
+    /// destination array, a `/GoTo` action's `/D`, or (leniently, since Table 29 asks for an array
+    /// or an action) a destination name or string; a name or string is looked up as a named
+    /// destination (§12.3.2.4). Any other action (a script, a remote go-to) has none here, and
+    /// neither has a page number past the end of the document.
+    pub(super) fn open_dest(&self, action: &Object) -> Option<(usize, DestView)> {
+        let dest = match self.resolve(action) {
+            Object::Dictionary(d) => {
+                if d.get(b"S").ok().and_then(|o| self.resolve(o).as_name().ok()) != Some(&b"GoTo"[..]) {
+                    return None;
+                }
+                d.get(b"D").ok()?
+            }
+            other => other,
+        };
+        self.dest(dest, 0).filter(|(page, _)| *page < self.page_ids.len())
+    }
+
+    pub(super) fn page_of(&self, o: &Object) -> Option<usize> {
+        match o {
+            Object::Reference(id) => self.page_index.get(id).copied(),
+            // Some producers write page *numbers* in remote-style destinations.
+            Object::Integer(n) => usize::try_from(*n).ok(),
+            _ => None,
+        }
+    }
+
+    // ── destinations ────────────────────────────────────────────────────────────────────────
+
+    /// The page and view of a destination: an explicit array (`[page /XYZ left top zoom]`, …),
+    /// a dictionary with `/D`, or a named destination that resolves to one.
+    pub(super) fn dest(&self, dest: &Object, depth: u32) -> Option<(usize, DestView)> {
+        if depth > 8 {
+            return None;
+        }
+        match self.resolve(dest) {
+            Object::Array(a) => {
+                let page = a.first().and_then(|p| self.page_of(p))?;
+                let kind = a.get(1).map(|k| self.resolve(k)).and_then(|k| k.as_name().ok());
+                let operands: Vec<Option<f32>> = a.iter().skip(2).take(4).map(|o| self.resolve(o).as_float().ok()).collect();
+                Some((page, DestView::from_operands(kind, &operands)))
+            }
+            Object::Dictionary(d) => d.get(b"D").ok().and_then(|d| self.dest(d, depth + 1)),
+            Object::String(key, _) | Object::Name(key) => self.named_dest(key).and_then(|d| self.dest(d, depth + 1)),
+            _ => None,
+        }
+    }
+
+    fn named_dest(&self, key: &[u8]) -> Option<&'a Object> {
+        let catalog = self.doc.catalog().ok()?;
+        if let Some(v) = self.named.get(key) {
+            return Some(v);
+        }
+        // PDF 1.1 style /Dests dictionary.
+        catalog.get(b"Dests").ok().and_then(|o| self.dict(o)).and_then(|d| d.get(key).ok())
+    }
+
+    /// A name tree's leaves keyed by their raw key bytes (first occurrence wins).
+    pub(super) fn name_tree_raw(
+        &self,
+        node: &'a Dictionary,
+        seen: &mut HashSet<*const Dictionary>,
+        depth: u32,
+        out: &mut HashMap<Vec<u8>, &'a Object>,
+    ) {
+        if depth > 32 || !seen.insert(node as *const _) {
+            return;
+        }
+        if let Ok(Object::Array(pairs)) = node.get(b"Names").map(|o| self.resolve(o)) {
+            for pair in pairs.chunks(2) {
+                if let [k, v] = pair {
+                    let key = match self.resolve(k) {
+                        Object::String(s, _) => s.clone(),
+                        Object::Name(n) => n.clone(),
+                        _ => continue,
+                    };
+                    out.entry(key).or_insert(v);
+                }
+            }
+        }
+        if let Ok(Object::Array(kids)) = node.get(b"Kids").map(|o| self.resolve(o)) {
+            for k in kids {
+                if let Some(d) = self.dict(k) {
+                    self.name_tree_raw(d, seen, depth + 1, out);
+                }
+            }
+        }
+    }
+
+    /// The entries of an embedded-files name tree. Each string key is spent from `text_budget`
+    /// (see [`MAX_LINK_ATTACHMENT_TEXT_BYTES`]), and an entry whose key does not fit is left out.
+    pub(super) fn name_tree(
+        &self,
+        node: &'a Dictionary,
+        seen: &mut HashSet<*const Dictionary>,
+        depth: u32,
+        text_budget: &mut usize,
+    ) -> Vec<(String, &'a Object)> {
+        let mut out = Vec::new();
+        if depth > 32 || !seen.insert(node as *const _) {
+            return out;
+        }
+        if let Ok(Object::Array(pairs)) = node.get(b"Names").map(|o| self.resolve(o)) {
+            for pair in pairs.chunks(2) {
+                if let [k, v] = pair {
+                    let key = match self.resolve(k) {
+                        Object::String(bytes, _) => match spend(bytes, text_budget, text_string) {
+                            Some(key) => key,
+                            None => continue,
+                        },
+                        _ => String::new(),
+                    };
+                    out.push((key, v));
+                }
+            }
+        }
+        if let Ok(Object::Array(kids)) = node.get(b"Kids").map(|o| self.resolve(o)) {
+            for k in kids {
+                if let Some(d) = self.dict(k) {
+                    out.extend(self.name_tree(d, seen, depth + 1, text_budget));
+                }
+            }
+        }
+        out
+    }
+
+    /// The first entry of an embedded-files name tree whose key is `key`, in the order
+    /// [`Self::name_tree`] lists them, with no key budget. It keeps no key, and converts a key
+    /// object or `/Names` array that several places reference only once (a second visit cannot
+    /// match, since the first would have returned).
+    pub(super) fn name_tree_find(&self, node: &'a Dictionary, key: &str, seen: &mut NameTreeSeen, depth: u32) -> Option<&'a Object> {
+        if depth > 32 || !seen.nodes.insert(node as *const _) {
+            return None;
+        }
+        let names = node.get(b"Names").ok();
+        if let Some(names) = names
+            && self.resolved_id(names).is_none_or(|id| seen.objects.insert(id))
+            && let Object::Array(pairs) = self.resolve(names)
+        {
+            for pair in pairs.chunks(2) {
+                if let [k, v] = pair {
+                    if self.resolved_id(k).is_some_and(|id| !seen.objects.insert(id)) {
+                        continue;
+                    }
+                    let found = match self.resolve(k) {
+                        Object::String(bytes, _) => text_string(bytes) == key,
+                        _ => key.is_empty(),
+                    };
+                    if found {
+                        return Some(v);
+                    }
+                }
+            }
+        }
+        if let Ok(Object::Array(kids)) = node.get(b"Kids").map(|o| self.resolve(o)) {
+            for k in kids {
+                if let Some(d) = self.dict(k)
+                    && let Some(v) = self.name_tree_find(d, key, seen, depth + 1)
+                {
+                    return Some(v);
+                }
+            }
+        }
+        None
+    }
+
+    // ── outline ─────────────────────────────────────────────────────────────────────────────
+
+    /// The window `DocInfo::outline` keeps: the first `OUTLINE_WINDOW` bookmarks in outline order,
+    /// nested no deeper than `OUTLINE_DEPTH`, and whether any bookmark was left out. Iterative, and
+    /// each bookmark is read once, so the work and memory stay within the window.
+    pub(super) fn outline_window(&self, first: &'a Object) -> (Vec<OutlineItem>, bool) {
+        let mut seen = HashSet::new();
+        // The listed bookmarks in outline order, with their depth.
+        let mut listed: Vec<(usize, OutlineItem)> = Vec::new();
+        // One entry per open level: its next sibling, or `None` once that run of siblings has ended.
+        let mut levels: Vec<Option<&'a Object>> = vec![Some(first)];
+        let mut more = false;
+        while let Some(depth) = levels.len().checked_sub(1) {
+            let Some(slot) = levels.get_mut(depth) else { break };
+            let Some(o) = slot.take() else {
+                levels.pop();
+                continue;
+            };
+            if let Object::Reference(id) = o
+                && !seen.insert(*id)
+            {
+                continue; // cycle: this run of siblings ends here
+            }
+            let Some(d) = self.dict(o) else { continue };
+            if listed.len() >= OUTLINE_WINDOW {
+                more = true;
+                break;
+            }
+            *slot = d.get(b"Next").ok();
+            let dest = d
+                .get(b"Dest")
+                .ok()
+                .and_then(|dest| self.dest(dest, 0))
+                .or_else(|| d.get(b"A").ok().and_then(|a| self.dict(a)).and_then(|a| a.get(b"D").ok()).and_then(|dest| self.dest(dest, 0)));
+            let (page, view) = dest.map_or((None, DestView::Top), |(p, v)| (Some(p), v));
+            match d.get(b"First").ok() {
+                Some(child) if depth < OUTLINE_DEPTH => levels.push(Some(child)),
+                Some(_) => more = true,
+                None => {}
+            }
+            let open = d.get(b"Count").ok().and_then(|c| c.as_i64().ok()).is_some_and(|c| c > 0);
+            let title = self.text(d, b"Title").unwrap_or_default();
+            let color = match d.get(b"C").map(|o| self.resolve(o)) {
+                Ok(Object::Array(c)) => outline_color(c.iter().map(|v| self.resolve(v).as_float().ok())),
+                _ => None,
+            };
+            let flags = d.get(b"F").ok().and_then(|f| self.resolve(f).as_i64().ok()).unwrap_or(0);
+            let (italic, bold) = (flags & 1 != 0, flags & 2 != 0);
+            listed.push((depth, OutlineItem { title, page, view, children: Vec::new(), open, color, italic, bold }));
+        }
+        (nest_outline(listed), more)
+    }
+
+    // ── page labels (ISO 32000-2 §12.4.2) ───────────────────────────────────────────────────
+
+    fn label_object(&self, object: &'a Object) -> Result<&'a Object, &'static str> {
+        self.doc.dereference(object).map(|(_, o)| o).map_err(|_| "a number tree reference is missing or cyclic")
+    }
+
+    fn label_dict(&self, object: &'a Object) -> Result<Option<&'a Dictionary>, &'static str> {
+        Ok(match self.label_object(object)? {
+            Object::Dictionary(d) => Some(d),
+            Object::Stream(s) => Some(&s.dict),
+            _ => None,
+        })
+    }
+
+    /// Apply `/PageLabels` to `pages`. `Err`: the tree is unusable and no label is applied.
+    /// `Ok(notes)`: labels applied, with what was repaired on the way (a duplicated start page,
+    /// a range whose labels are too long to show).
+    pub(super) fn page_labels(&self, catalog: &Dictionary, pages: &mut [PageInfo]) -> Result<Vec<String>, &'static str> {
+        let mut notes = Vec::new();
+        let Ok(tree) = catalog.get(b"PageLabels") else { return Ok(notes) };
+        let Some(tree) = self.label_dict(tree)? else { return Ok(notes) };
+        let mut ranges: BTreeMap<usize, &Dictionary> = BTreeMap::new();
+        let mut stack = vec![(tree, 0usize)];
+        let mut seen = HashSet::new();
+        let mut left = MAX_LABEL_TREE_WORK;
+        while let Some((node, depth)) = stack.pop() {
+            label_work(&mut left, 1)?;
+            if depth > MAX_LABEL_TREE_DEPTH {
+                return Err("the number tree is too deep");
+            }
+            if !seen.insert(node as *const Dictionary) {
+                return Err("the number tree repeats a node or contains a cycle");
+            }
+            if let Ok(nums) = node.get(b"Nums")
+                && let Object::Array(nums) = self.label_object(nums)?
+            {
+                label_work(&mut left, nums.len().div_ceil(2))?;
+                for pair in nums.chunks(2) {
+                    if let [k, v] = pair
+                        && let (Ok(start), Some(d)) = (self.label_object(k)?.as_i64(), self.label_dict(v)?)
+                        && let Ok(start) = usize::try_from(start)
+                        && ranges.insert(start, d).is_some()
+                    {
+                        // The later range wins, as in readers that overwrite.
+                        notes.push(format!("a range starts on page {} twice; the later one is used", start.saturating_add(1)));
+                    }
+                }
+            }
+            if let Ok(kids) = node.get(b"Kids")
+                && let Object::Array(kids) = self.label_object(kids)?
+            {
+                label_work(&mut left, kids.len())?;
+                if kids.len() > MAX_LABEL_TREE_WORK.saturating_sub(stack.len()) {
+                    return Err("the number tree has too many pending nodes");
+                }
+                if !kids.is_empty() && depth == MAX_LABEL_TREE_DEPTH {
+                    return Err("the number tree is too deep");
+                }
+                for kid in kids {
+                    if let Some(d) = self.label_dict(kid)? {
+                        stack.push((d, depth + 1));
+                    }
+                }
+            }
+        }
+        // Decode each bounded prefix once, rather than once for every page in its range.
+        let mut specs = BTreeMap::new();
+        let mut prefix_total = 0usize;
+        for (start, d) in ranges {
+            let first = d.get(b"St").ok().and_then(|o| self.resolve(o).as_i64().ok()).unwrap_or(1).max(1) as u64;
+            let prefix = match d.get(b"P").ok().map(|o| self.resolve(o)) {
+                Some(Object::String(raw, _)) => {
+                    if raw.len() > MAX_PREFIX_BYTES {
+                        return Err("a raw prefix exceeds 2050 bytes");
+                    }
+                    // A label prefix is literal text, not trimmed document metadata.
+                    text_string(raw).trim_matches('\0').to_string()
+                }
+                Some(Object::Name(raw)) => {
+                    if raw.len() > MAX_PREFIX_BYTES {
+                        return Err("a raw prefix exceeds 2050 bytes");
+                    }
+                    // Retain the existing name compatibility and boundary-NUL handling.
+                    String::from_utf8_lossy(raw).trim_matches('\0').to_string()
+                }
+                _ => String::new(),
+            };
+            if prefix.len() > MAX_LABEL_BYTES {
+                return Err("a decoded prefix exceeds 1024 UTF-8 bytes");
+            }
+            // A prefix object shared by many ranges is decoded once per range: count every copy.
+            prefix_total = prefix_total.saturating_add(prefix.len());
+            if prefix_total > MAX_PREFIX_TOTAL_BYTES {
+                return Err("decoded prefixes exceed 4 MiB in total");
+            }
+            let style = d.get(b"S").ok().and_then(|o| self.resolve(o).as_name().ok());
+            specs.insert(start, (first, prefix, style));
+        }
+        let mut staged = Vec::new();
+        let mut total = 0usize;
+        for (i, _) in pages.iter().enumerate() {
+            let Some((&start, (first, prefix, style))) = specs.range(..=i).next_back() else { continue };
+            let n = if matches!(*style, Some(b"D" | b"R" | b"r" | b"A" | b"a")) {
+                let offset = u64::try_from(i - start).map_err(|_| "a page number is too large")?;
+                first.checked_add(offset).ok_or("a page number overflows")?
+            } else {
+                0 // /St is unused when the label consists only of its prefix.
+            };
+            let remaining = MAX_LABEL_BYTES - prefix.len();
+            let number = match *style {
+                Some(b"D") => Some(n.to_string()),
+                Some(b"R" | b"r") => roman(n, remaining),
+                Some(b"A" | b"a") => alpha(n, remaining),
+                _ => Some(String::new()),
+            }
+            .filter(|number| number.len() <= remaining);
+            // A label too long to show keeps that page's physical number; other ranges stay.
+            let Some(mut number) = number else {
+                let note = format!(
+                    "labels from page {} exceed {MAX_LABEL_BYTES} UTF-8 bytes; those pages show their physical page numbers",
+                    start.saturating_add(1)
+                );
+                if !notes.contains(&note) {
+                    notes.push(note);
+                }
+                continue;
+            };
+            if matches!(*style, Some(b"R" | b"A")) {
+                number.make_ascii_uppercase();
+            }
+            let mut label = prefix.clone();
+            label.push_str(&number);
+            if label.is_empty() {
+                continue; // Keep the existing physical number for an empty custom label.
+            }
+            total = total.checked_add(label.len()).ok_or("the total label size overflows")?;
+            if total > MAX_LABEL_TOTAL_BYTES {
+                return Err("custom labels exceed 4 MiB in total");
+            }
+            staged.push((i, label));
+        }
+        // A malformed later range must not leave a partially applied custom label sequence.
+        for (i, label) in staged {
+            if let Some(page) = pages.get_mut(i) {
+                page.label = label;
+            }
+        }
+        Ok(notes)
+    }
+}
+
+/// A text string's value, decoded by the same rules as the engine's object model
+/// ([`pdfcraft_cos::PdfString::to_text`]) so the panels and outline editing agree.
+pub(super) fn text_string(bytes: &[u8]) -> String {
+    pdfcraft_cos::PdfString::literal(bytes).to_text()
+}
+
+/// What [`Inspector::name_tree_find`] has visited: node dictionaries, and the key and `/Names`
+/// array objects it reached by reference.
+#[derive(Default)]
+pub(super) struct NameTreeSeen {
+    nodes: HashSet<*const Dictionary>,
+    objects: HashSet<ObjectId>,
+}
+
+/// A bookmark title's colour from its `/C` entries, each kept within 0–1 (ISO 32000-2 §12.3.3,
+/// Table 151: "An array of three numbers in the range 0.0 to 1.0, representing the components in
+/// the DeviceRGB colour space"). Black, the default, and anything that isn't three numbers give
+/// `None`.
+pub(crate) fn outline_color(values: impl Iterator<Item = Option<f32>>) -> Option<[f32; 3]> {
+    let v: Vec<Option<f32>> = values.take(4).collect();
+    let [Some(r), Some(g), Some(b)] = v.as_slice() else { return None };
+    // A number past the range, however large, is kept at its edge.
+    let rgb = [*r, *g, *b].map(|c| c.clamp(0.0, 1.0));
+    (rgb != [0.0; 3]).then_some(rgb)
+}
+
+/// Nests a pre-order list of `(depth, item)` into the outline tree.
+fn nest_outline(listed: Vec<(usize, OutlineItem)>) -> Vec<OutlineItem> {
+    let mut roots = Vec::new();
+    // The open ancestors, outermost first; each collects its children until it closes.
+    let mut open: Vec<(usize, OutlineItem)> = Vec::new();
+    for (depth, item) in listed {
+        while open.last().is_some_and(|(d, _)| *d >= depth) {
+            close_outline(&mut open, &mut roots);
+        }
+        open.push((depth, item));
+    }
+    while !open.is_empty() {
+        close_outline(&mut open, &mut roots);
+    }
+    roots
+}
+
+/// Closes the innermost open bookmark: it joins its parent's children, or the top level.
+fn close_outline(open: &mut Vec<(usize, OutlineItem)>, roots: &mut Vec<OutlineItem>) {
+    if let Some((_, item)) = open.pop() {
+        match open.last_mut() {
+            Some((_, parent)) => parent.children.push(item),
+            None => roots.push(item),
+        }
+    }
+}
+
+fn label_work(left: &mut usize, count: usize) -> Result<(), &'static str> {
+    *left = left.checked_sub(count).ok_or("the number tree has too many entries")?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod open_dest_tests {
+    use std::sync::Arc;
+
+    use super::{DestView, inspect};
+
+    /// Three 612×792 pages (objects 3, 4, 5); `catalog` is added to the catalog dictionary and
+    /// `extra` become objects 6, 7, ….
+    fn pdf(catalog: &str, extra: &[String]) -> Vec<u8> {
+        let mut objs =
+            vec![format!("<< /Type /Catalog /Pages 2 0 R {catalog} >>"), "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 >>".to_string()];
+        for _ in 0..3 {
+            objs.push("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >>".to_string());
+        }
+        objs.extend(extra.iter().cloned());
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        out
+    }
+
+    fn open_dest(catalog: &str, extra: &[String]) -> Option<(usize, DestView)> {
+        inspect(Arc::new(pdf(catalog, extra)), None).expect("inspects").open_dest
+    }
+
+    const XYZ: DestView = DestView::Xyz { left: Some(100.0), top: Some(500.0), zoom: Some(2.0) };
+
+    #[test]
+    fn an_explicit_destination_opens_at_its_page_and_position() {
+        assert_eq!(open_dest("/OpenAction [5 0 R /XYZ 100 500 2]", &[]), Some((2, XYZ)));
+        assert_eq!(open_dest("/OpenAction [4 0 R /FitH 400]", &[]), Some((1, DestView::FitH { top: Some(400.0) })));
+        // Indirect, and a zoom of 0 keeps the zoom (Table 149).
+        assert_eq!(
+            open_dest("/OpenAction 6 0 R", &["[4 0 R /XYZ 0 792 0]".into()]),
+            Some((1, DestView::Xyz { left: Some(0.0), top: Some(792.0), zoom: None }))
+        );
+    }
+
+    #[test]
+    fn a_go_to_action_opens_at_its_destination_explicit_or_named() {
+        assert_eq!(open_dest("/OpenAction << /S /GoTo /D [5 0 R /XYZ 100 500 2] >>", &[]), Some((2, XYZ)));
+        // A name, through the PDF 1.1 catalog /Dests dictionary (§12.3.2.4).
+        assert_eq!(open_dest("/OpenAction << /S /GoTo /D /there >> /Dests << /there [5 0 R /XYZ 100 500 2] >>", &[]), Some((2, XYZ)));
+        // A byte string, through the /Names /Dests name tree, whose value is a dictionary with /D.
+        assert_eq!(
+            open_dest(
+                "/OpenAction << /S /GoTo /D (there) >> /Names << /Dests 6 0 R >>",
+                &["<< /Kids [7 0 R] >>".into(), "<< /Names [(here) [3 0 R /Fit] (there) << /D [5 0 R /XYZ 100 500 2] >>] >>".into()]
+            ),
+            Some((2, XYZ))
+        );
+    }
+
+    #[test]
+    fn an_open_action_given_as_a_name_or_string_is_looked_up() {
+        assert_eq!(open_dest("/OpenAction /there /Dests << /there [4 0 R /Fit] >>", &[]), Some((1, DestView::Fit)));
+        assert_eq!(
+            open_dest("/OpenAction (there) /Names << /Dests << /Names [(there) [5 0 R /FitV 30]] >> >>", &[]),
+            Some((2, DestView::FitV { left: Some(30.0) }))
+        );
+    }
+
+    #[test]
+    fn an_open_action_that_goes_nowhere_here_has_no_destination() {
+        for catalog in [
+            "",
+            "/OpenAction << /S /JavaScript /JS (app.alert(1)) >>",
+            // A remote go-to's /D is a page of another file.
+            "/OpenAction << /S /GoToR /F (other.pdf) /D [1 /Fit] >>",
+            "/OpenAction << /D [4 0 R /Fit] >>",
+            // An unknown name, and no name dictionaries at all.
+            "/OpenAction << /S /GoTo /D /missing >> /Dests << /there [4 0 R /Fit] >>",
+            "/OpenAction /missing",
+            // A page number past the end, and a page reference that is no page.
+            "/OpenAction [7 /Fit]",
+            "/OpenAction [2 0 R /Fit]",
+            "/OpenAction 42",
+        ] {
+            assert_eq!(open_dest(catalog, &[]), None, "{catalog}");
+        }
+    }
+
+    #[test]
+    fn cyclic_and_deep_named_destinations_end() {
+        // Names that refer to each other.
+        assert_eq!(open_dest("/OpenAction /a /Dests << /a /b /b /a >>", &[]), None);
+        assert_eq!(open_dest("/OpenAction /a /Dests << /a << /D /a >> >>", &[]), None);
+        // A name tree whose node is its own kid.
+        assert_eq!(open_dest("/OpenAction (x) /Names << /Dests 6 0 R >>", &["<< /Kids [6 0 R] >>".into()]), None);
+        // A name tree deeper than the depth bound: the leaf past it isn't read.
+        let depth = 40;
+        let mut nodes: Vec<String> = (0..depth).map(|i| format!("<< /Kids [{} 0 R] >>", 7 + i)).collect();
+        nodes.push("<< /Names [(x) [4 0 R /Fit]] >>".into());
+        assert_eq!(open_dest("/OpenAction (x) /Names << /Dests 6 0 R >>", &nodes), None);
+        // A shallow one is read.
+        let shallow = ["<< /Kids [7 0 R] >>".to_string(), "<< /Kids [8 0 R] >>".into(), "<< /Names [(x) [4 0 R /Fit]] >>".into()];
+        assert_eq!(open_dest("/OpenAction (x) /Names << /Dests 6 0 R >>", &shallow), Some((1, DestView::Fit)));
+    }
+}
diff --git a/crates/render/src/inspect/resources.rs b/crates/render/src/inspect/resources.rs
new file mode 100644
index 0000000000..0386c5781f
--- /dev/null
+++ b/crates/render/src/inspect/resources.rs
@@ -0,0 +1,468 @@
+#[cfg(test)]
+use super::core::inspect;
+use super::core::{Inspector, load_options};
+use super::model::{Attachment, AttachmentSource, FontInfo, Layer, PageTransition, TransitionStyle};
+use super::navigation::NameTreeSeen;
+use super::*;
+
+/// Decoded bytes read from an XFA form's configuration packet (or a whole-XDP `/XFA` stream) to
+/// find `dynamicRender`. Designer's packets are a few kilobytes; a whole XDP can hold the template.
+const MAX_XFA_CONFIG_BYTES: usize = 16 << 20;
+
+/// At most this many layers are read from all of `/RBGroups` together.
+const MAX_LAYER_GROUP_ENTRIES: usize = 4096;
+
+impl<'a> Inspector<'a> {
+    // ── object helpers ──────────────────────────────────────────────────────────────────────
+
+    /// `/Trans` and `/Dur` of every page (ISO 32000-2 §12.4.4), in page order. Lenient: a value
+    /// outside the spec's choices takes that entry's default, and a page with neither entry is
+    /// not listed. Bounded by the page count.
+    pub(super) fn transitions(&self, info: &mut DocInfo) {
+        for (page, &pid) in self.page_ids.iter().enumerate() {
+            let Ok(d) = self.doc.get_dictionary(pid) else { continue };
+            let display = d.get(b"Dur").ok().and_then(|o| self.resolve(o).as_float().ok()).filter(|s| s.is_finite() && *s >= 0.0);
+            let trans = d.get(b"Trans").ok().and_then(|o| self.dict(o));
+            if trans.is_none() && display.is_none() {
+                continue;
+            }
+            let mut t = PageTransition {
+                page,
+                style: None,
+                duration: 1.0,
+                horizontal: true,
+                inward: true,
+                direction: Some(0),
+                scale: 1.0,
+                opaque: false,
+                display,
+            };
+            if let Some(tr) = trans {
+                t.style = Some(self.name(tr, b"S").map_or(TransitionStyle::Replace, |n| TransitionStyle::from_name(&n)));
+                let num = |key: &[u8]| tr.get(key).ok().and_then(|o| self.resolve(o).as_float().ok()).filter(|v| v.is_finite());
+                t.duration = num(b"D").filter(|d| *d >= 0.0).unwrap_or(1.0);
+                t.horizontal = self.name(tr, b"Dm").as_deref() != Some("V");
+                t.inward = self.name(tr, b"M").as_deref() != Some("O");
+                t.direction = match tr.get(b"Di").map(|o| self.resolve(o)) {
+                    Ok(Object::Name(n)) if n.as_slice() == b"None" => None,
+                    Ok(o) => match o.as_i64().ok() {
+                        Some(0) => Some(0),
+                        Some(90) => Some(90),
+                        Some(180) => Some(180),
+                        Some(270) => Some(270),
+                        Some(315) => Some(315),
+                        _ => Some(0),
+                    },
+                    Err(_) => Some(0),
+                };
+                t.scale = num(b"SS").filter(|s| *s > 0.0).unwrap_or(1.0);
+                t.opaque = matches!(tr.get(b"B").map(|o| self.resolve(o)), Ok(Object::Boolean(true)));
+            }
+            info.transitions.push(t);
+        }
+    }
+
+    /// The value of `dynamicRender` in an XFA form's configuration packet (`config`, under
+    /// `acrobat/acrobat7`): `required` for a dynamic form, `forbidden` for a static one. `/XFA` is
+    /// either one stream holding the whole XDP or an array of packet names and streams (ISO
+    /// 32000-1 §12.7.8). Lenient: `None` when the packet is missing, unreadable or over
+    /// `MAX_XFA_CONFIG_BYTES` decoded, or has no such element.
+    pub(super) fn xfa_dynamic_render(&self, xfa: &'a Object) -> Option<String> {
+        let stream = match self.resolve(xfa) {
+            Object::Array(items) => {
+                let at = items.iter().position(|o| matches!(self.resolve(o), Object::String(name, _) if name.as_slice() == b"config"))?;
+                self.resolve(items.get(at.checked_add(1)?)?)
+            }
+            whole => whole,
+        };
+        let stream = stream.as_stream().ok()?;
+        let bytes = if stream.dict.get(b"Filter").is_ok() {
+            stream.decompressed_content_with_limit(MAX_XFA_CONFIG_BYTES).ok()?
+        } else {
+            stream.content.get(..stream.content.len().min(MAX_XFA_CONFIG_BYTES))?.to_vec()
+        };
+        xfa_config_dynamic_render(&xfa_packet_text(&bytes))
+    }
+
+    // ── optional content ────────────────────────────────────────────────────────────────────
+
+    pub(super) fn layers(&self, catalog: &Dictionary, out: &mut Vec<Layer>) {
+        let Some(props) = catalog.get(b"OCProperties").ok().and_then(|o| self.dict(o)) else { return };
+        let config = props.get(b"D").ok().and_then(|o| self.dict(o));
+        let off: HashSet<ObjectId> = config
+            .and_then(|c| c.get(b"OFF").ok())
+            .and_then(|o| self.resolve(o).as_array().ok())
+            .map(|a| a.iter().filter_map(|x| x.as_reference().ok()).collect())
+            .unwrap_or_default();
+        let base_off = config.and_then(|c| self.name(c, b"BaseState")).as_deref() == Some("OFF");
+        let on: HashSet<ObjectId> = config
+            .and_then(|c| c.get(b"ON").ok())
+            .and_then(|o| self.resolve(o).as_array().ok())
+            .map(|a| a.iter().filter_map(|x| x.as_reference().ok()).collect())
+            .unwrap_or_default();
+        let Ok(Object::Array(ocgs)) = props.get(b"OCGs").map(|o| self.resolve(o)) else { return };
+        for g in ocgs {
+            let Some(d) = self.dict(g) else { continue };
+            let id = g.as_reference().ok();
+            let visible = match id {
+                Some(id) if off.contains(&id) => false,
+                Some(id) if on.contains(&id) => true,
+                _ => !base_off,
+            };
+            let Some(id) = id else { continue };
+            out.push(Layer { id, name: self.text(d, b"Name").unwrap_or_else(|| "Layer".into()), visible, initial: visible });
+        }
+    }
+
+    /// The default configuration's radio-button groups (`/RBGroups`) of two or more layers.
+    pub(super) fn layer_groups(&self, catalog: &Dictionary) -> Vec<Vec<ObjectId>> {
+        let groups = catalog
+            .get(b"OCProperties")
+            .ok()
+            .and_then(|o| self.dict(o))
+            .and_then(|p| p.get(b"D").ok())
+            .and_then(|o| self.dict(o))
+            .and_then(|c| c.get(b"RBGroups").ok())
+            .and_then(|o| self.resolve(o).as_array().ok());
+        let mut left = MAX_LAYER_GROUP_ENTRIES;
+        let mut out = Vec::new();
+        for g in groups.into_iter().flatten() {
+            let Ok(members) = self.resolve(g).as_array() else { continue };
+            let group: Vec<ObjectId> = members.iter().filter_map(|x| x.as_reference().ok()).take(left).collect();
+            left = left.saturating_sub(group.len());
+            if group.len() > 1 {
+                out.push(group);
+            }
+            if left == 0 {
+                break;
+            }
+        }
+        out
+    }
+
+    pub(super) fn fonts(&self, out: &mut Vec<FontInfo>) {
+        let mut seen = HashSet::new();
+        for &pid in &self.page_ids {
+            let Ok(fonts) = self.doc.get_page_fonts(pid) else { continue };
+            for (_, f) in fonts {
+                let base = f
+                    .get(b"BaseFont")
+                    .ok()
+                    .and_then(|o| o.as_name().ok())
+                    .map(|n| String::from_utf8_lossy(n).into_owned())
+                    .unwrap_or_else(|| "(unnamed)".into());
+                let kind = self.name(f, b"Subtype").unwrap_or_default();
+                let encoding = match f.get(b"Encoding").map(|o| self.resolve(o)) {
+                    Ok(Object::Name(n)) => Some(String::from_utf8_lossy(n).into_owned()),
+                    Ok(Object::Dictionary(_)) => Some("Custom".into()),
+                    Ok(Object::Stream(_)) => Some("Embedded CMap".into()),
+                    _ => None,
+                };
+                // Embedded: FontFile/2/3 in the descriptor (for Type0, in the descendant font).
+                let descriptor_of = |d: &'a Dictionary| d.get(b"FontDescriptor").ok().and_then(|o| self.dict(o));
+                let descendant =
+                    f.get(b"DescendantFonts").ok().and_then(|o| self.resolve(o).as_array().ok()).and_then(|a| a.first()).and_then(|o| self.dict(o));
+                let desc = descriptor_of(f).or_else(|| descendant.and_then(descriptor_of));
+                let embedded =
+                    kind == "Type3" || desc.is_some_and(|d| d.get(b"FontFile").is_ok() || d.get(b"FontFile2").is_ok() || d.get(b"FontFile3").is_ok());
+                // What the substitution chain needs beyond the name: the descriptor flags, and for
+                // a composite font the script its descendant declares (ISO 32000-2 9.7.3).
+                let flags = desc
+                    .and_then(|d| d.get(b"Flags").ok())
+                    .and_then(|o| self.resolve(o).as_i64().ok())
+                    .and_then(|n| u32::try_from(n).ok())
+                    .unwrap_or(0);
+                let ordering =
+                    descendant.and_then(|d| d.get(b"CIDSystemInfo").ok()).and_then(|o| self.dict(o)).and_then(|c| self.text(c, b"Ordering"));
+                let subset = base.len() > 7 && base.as_bytes()[6] == b'+' && base[..6].bytes().all(|b| b.is_ascii_uppercase());
+                let name = if subset { base[7..].to_string() } else { base };
+                let chosen = pdfcraft_fonts::fallback::substitute(&pdfcraft_fonts::fallback::Request {
+                    base_font: &name,
+                    embedded,
+                    flags,
+                    ordering: ordering.as_deref(),
+                });
+                let info = FontInfo {
+                    name,
+                    kind,
+                    embedded,
+                    subset,
+                    encoding,
+                    substitute: chosen.face_name(),
+                    substitution: (!chosen.why.is_faithful()).then(|| chosen.why.note().to_owned()),
+                };
+                if seen.insert((info.name.clone(), info.kind.clone(), info.embedded)) {
+                    out.push(info);
+                }
+            }
+        }
+        out.sort_by(|a, b| a.name.cmp(&b.name));
+    }
+
+    /// The attachment's name is the file specification's, else `fallback`'s, else a generic one.
+    pub(super) fn attachment(
+        &self,
+        spec: &Object,
+        source: AttachmentSource,
+        text_budget: &mut usize,
+        fallback: impl FnOnce(&mut usize) -> Option<String>,
+    ) -> Attachment {
+        let d = self.dict(spec);
+        let size =
+            d.and_then(|d| d.get(b"EF").ok()).and_then(|o| self.dict(o)).and_then(|ef| ef.get(b"F").ok().or_else(|| ef.get(b"UF").ok())).and_then(
+                |f| match self.resolve(f) {
+                    Object::Stream(s) => s
+                        .dict
+                        .get(b"Params")
+                        .ok()
+                        .and_then(|p| self.dict(p))
+                        .and_then(|p| p.get(b"Size").ok())
+                        .and_then(|s| s.as_i64().ok())
+                        .map(|s| s as usize)
+                        .or(Some(s.content.len())),
+                    _ => None,
+                },
+            );
+        let display = d
+            .and_then(|d| self.budgeted_text(d, b"UF", text_budget).or_else(|| self.budgeted_text(d, b"F", text_budget)))
+            .or_else(|| fallback(text_budget))
+            .unwrap_or_else(|| "attachment".into());
+        Attachment { name: display, description: d.and_then(|d| self.budgeted_text(d, b"Desc", text_budget)), size, source }
+    }
+}
+
+/// Fetch an attachment's bytes (decoded). Capped at 1 GiB to defuse decompression bombs.
+pub fn attachment_data(bytes: &[u8], password: Option<&str>, att: &Attachment) -> Result<Vec<u8>, String> {
+    let run = || -> Result<Vec<u8>, String> {
+        let options = load_options(password);
+        let doc = Document::load_mem_with_options(bytes, options).map_err(|e| e.to_string())?;
+        let insp = Inspector::new(&doc);
+        let spec: &Object = match &att.source {
+            AttachmentSource::Document { key } => {
+                let names = doc.catalog().ok().and_then(|c| c.get(b"Names").ok()).and_then(|o| insp.dict(o)).ok_or("no /Names")?;
+                let ef = names.get(b"EmbeddedFiles").ok().and_then(|o| insp.dict(o)).ok_or("no /EmbeddedFiles")?;
+                insp.name_tree_find(ef, key, &mut NameTreeSeen::default(), 0).ok_or("attachment not found")?
+            }
+            AttachmentSource::Annotation { page, index } => {
+                let (&pid, _) = insp.page_index.iter().find(|(_, i)| **i == *page).ok_or("page not found")?;
+                let annots = doc.get_dictionary(pid).map_err(|e| e.to_string())?.get(b"Annots").map_err(|e| e.to_string())?;
+                let a = insp.resolve(annots).as_array().map_err(|e| e.to_string())?.get(*index).ok_or("annotation not found")?;
+                insp.dict(a).and_then(|d| d.get(b"FS").ok()).ok_or("annotation has no file")?
+            }
+        };
+        let fs = insp.dict(spec).ok_or("bad file specification")?;
+        let ef = fs.get(b"EF").ok().and_then(|o| insp.dict(o)).ok_or("the file is not embedded (external reference)")?;
+        let stream = ef.get(b"UF").ok().or_else(|| ef.get(b"F").ok()).map(|o| insp.resolve(o)).ok_or("no embedded stream")?;
+        let stream = stream.as_stream().map_err(|e| e.to_string())?;
+        if stream.dict.get(b"Filter").is_ok() {
+            stream.decompressed_content_with_limit(1 << 30).map_err(|e| e.to_string())
+        } else {
+            Ok(stream.content.clone())
+        }
+    };
+    catch_unwind(AssertUnwindSafe(run)).unwrap_or_else(|p| Err(format!("reading the attachment crashed: {}", crate::raster::panic_message(&p))))
+}
+
+/// An XFA packet's bytes as text: UTF-16 (little- or big-endian, told by a byte order mark or by
+/// how `<` is written) or UTF-8, as `pdfcraft_xfa::packets::decode` reads them. Lossy: only one
+/// element is looked for.
+pub(super) fn xfa_packet_text(bytes: &[u8]) -> String {
+    let utf16 = |b: &[u8], from: fn([u8; 2]) -> u16| {
+        let units = b.as_chunks::<2>().0.iter().map(|c| from(*c));
+        char::decode_utf16(units).map(|c| c.unwrap_or(char::REPLACEMENT_CHARACTER)).collect::<String>()
+    };
+    match bytes {
+        [0xFF, 0xFE, rest @ ..] => utf16(rest, u16::from_le_bytes),
+        [0xFE, 0xFF, rest @ ..] => utf16(rest, u16::from_be_bytes),
+        [b'<', 0, ..] => utf16(bytes, u16::from_le_bytes),
+        [0, b'<', ..] => utf16(bytes, u16::from_be_bytes),
+        [0xEF, 0xBB, 0xBF, rest @ ..] => String::from_utf8_lossy(rest).into_owned(),
+        _ => String::from_utf8_lossy(bytes).into_owned(),
+    }
+}
+
+/// One markup tag found by [`next_tag`]: where it starts (`<`) and ends (after `>`), whether it
+/// closes (`</x>`) or closes itself (`<x/>`), and its name without a namespace prefix.
+struct Tag<'a> {
+    start: usize,
+    end: usize,
+    close: bool,
+    empty: bool,
+    local: &'a str,
+}
+
+/// The next element tag in `xml` at or after `from`, skipping comments, CDATA sections,
+/// processing instructions and declarations. A byte scan, not an XML parser: enough to find one
+/// known element in an XFA packet, whose tags Designer writes with a line break before each `>`.
+fn next_tag(xml: &str, mut from: usize) -> Option<Tag<'_>> {
+    loop {
+        let lt = from + xml.get(from..)?.find('<')?;
+        let rest = xml.get(lt..)?;
+        let skip_to = |end: &str| rest.find(end).map(|i| lt + i + end.len());
+        if rest.starts_with("<!--") {
+            from = skip_to("-->")?;
+            continue;
+        }
+        if rest.starts_with("<![CDATA[") {
+            from = skip_to("]]>")?;
+            continue;
+        }
+        if rest.starts_with("<?") || rest.starts_with("<!") {
+            from = skip_to(">")?;
+            continue;
+        }
+        let gt = lt + rest.find('>')?;
+        let inner = xml.get(lt + 1..gt)?;
+        let (close, inner) = match inner.strip_prefix('/') {
+            Some(i) => (true, i),
+            None => (false, inner),
+        };
+        let empty = !close && inner.ends_with('/');
+        let name = inner.split(|c: char| c.is_whitespace() || c == '/').next().unwrap_or_default();
+        let local = name.rsplit(':').next().unwrap_or(name);
+        return Some(Tag { start: lt, end: gt + 1, close, empty, local });
+    }
+}
+
+/// What `<name>…</name>` holds: the content of the first top-level element of `xml` called `name`
+/// (any prefix). Elements nested in other elements are not looked at. `None` when there is none,
+/// it closes itself, or it is never closed.
+fn xml_child_body<'a>(xml: &'a str, name: &str) -> Option<&'a str> {
+    let mut at = 0;
+    // The elements open around `at`, innermost last: a closing tag must name the innermost one,
+    // or the markup is malformed and has no value.
+    let mut open_tags: Vec<&str> = Vec::new();
+    // Where the wanted element's content starts, once its opening tag is seen at the top level.
+    let mut open = None;
+    loop {
+        let tag = next_tag(xml, at)?;
+        at = tag.end;
+        if tag.close {
+            if open_tags.pop()? != tag.local {
+                return None;
+            }
+            if open_tags.is_empty()
+                && let Some(start) = open
+            {
+                return xml.get(start..tag.start);
+            }
+        } else if !tag.empty {
+            if open_tags.is_empty() && tag.local == name {
+                open = Some(tag.end);
+            }
+            open_tags.push(tag.local);
+        } else if open_tags.is_empty() && tag.local == name {
+            return None;
+        }
+    }
+}
+
+/// The trimmed text at `path` (element names from the outside in, any prefix, each a child of the
+/// one before) in `xml`, if it is plain text.
+fn xml_path_text(xml: &str, path: &[&str]) -> Option<String> {
+    let body = path.iter().try_fold(xml, |within, name| xml_child_body(within, name))?;
+    let text = body.trim();
+    (!text.is_empty() && !text.contains('<')).then(|| text.to_owned())
+}
+
+/// `dynamicRender` at `config/acrobat/acrobat7` in the configuration packet: the `config` child
+/// of the `xdp` root in a whole-XDP stream, or the `config` packet itself. The same names inside
+/// the form data or the template are not the configuration.
+pub(super) fn xfa_config_dynamic_render(packet: &str) -> Option<String> {
+    const IN_CONFIG: [&str; 4] = ["config", "acrobat", "acrobat7", "dynamicRender"];
+    xml_path_text(packet, &["xdp", IN_CONFIG[0], IN_CONFIG[1], IN_CONFIG[2], IN_CONFIG[3]]).or_else(|| xml_path_text(packet, &IN_CONFIG))
+}
+
+#[cfg(test)]
+mod substitution_tests {
+    use std::sync::Arc;
+
+    use super::{FontInfo, inspect};
+
+    /// One page naming four fonts the document does not embed: a Chinese CID font (Adobe-GB1), a
+    /// Japanese one (Adobe-Japan1), an unknown serif-flagged simple font, and an aliased
+    /// standard-14 name.
+    const NOT_EMBEDDED: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /Font << /F1 4 0 R /F2 6 0 R /F3 8 0 R /F4 9 0 R /F5 11 0 R >> >> >> endobj
+4 0 obj << /Type /Font /Subtype /Type0 /BaseFont /STSong-Light /Encoding /UniGB-UCS2-H /DescendantFonts [5 0 R] >> endobj
+5 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /STSong-Light /CIDSystemInfo << /Registry (Adobe) /Ordering (GB1) /Supplement 2 >> >> endobj
+6 0 obj << /Type /Font /Subtype /Type0 /BaseFont /KozMinPro-Regular /Encoding /UniJIS-UCS2-H /DescendantFonts [7 0 R] >> endobj
+7 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /KozMinPro-Regular /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 4 >> >> endobj
+8 0 obj << /Type /Font /Subtype /TrueType /BaseFont /SomeHouseSerif /FontDescriptor 10 0 R >> endobj
+9 0 obj << /Type /Font /Subtype /TrueType /BaseFont /ArialMT >> endobj
+10 0 obj << /Type /FontDescriptor /FontName /SomeHouseSerif /Flags 34 >> endobj
+11 0 obj << /Type /Font /Subtype /TrueType /BaseFont /HouseGrotesk /FontDescriptor 12 0 R >> endobj
+12 0 obj << /Type /FontDescriptor /FontName /HouseGrotesk /Flags 33 >> endobj
+trailer << /Size 13 /Root 1 0 R >>
+%%EOF";
+
+    fn font<'a>(fonts: &'a [FontInfo], name: &str) -> &'a FontInfo {
+        fonts.iter().find(|f| f.name == name).unwrap_or_else(|| panic!("{name} listed; got {:?}", fonts.iter().map(|f| &f.name).collect::<Vec<_>>()))
+    }
+
+    #[test]
+    fn doc_info_says_which_face_stands_in_and_why() {
+        let info = inspect(Arc::new(NOT_EMBEDDED.to_vec()), None).expect("opens");
+
+        // The one that matters most to a user: a Chinese PDF that draws nothing. Before this,
+        // doc_info said only `embedded: false` and left them to guess.
+        let cjk = font(&info.fonts, "STSong-Light");
+        assert!(!cjk.embedded);
+        assert_eq!(cjk.substitute, None, "no licensed Chinese face, so nothing stands in");
+        let why = cjk.substitution.as_deref().unwrap_or_default();
+        assert!(why.contains("no licensed face") && why.contains("rather than the wrong glyphs"), "{why}");
+
+        // An aliased standard-14 name resolves to the real face, whose metrics are exact.
+        let arial = font(&info.fonts, "ArialMT");
+        assert_eq!(arial.substitute.as_deref(), Some("Helvetica"));
+        assert!(arial.substitution.as_deref().unwrap_or_default().contains("standard 14"));
+
+        // A house font whose name merely contains "Serif" gets Times -- reported as the guess it
+        // is, not as a standard-14 name, which would be untrue of a font nobody has heard of.
+        let serif = font(&info.fonts, "SomeHouseSerif");
+        assert_eq!(serif.substitute.as_deref(), Some("Times-Roman"));
+        assert!(serif.substitution.as_deref().unwrap_or_default().contains("hints at one"), "{serif:?}");
+
+        // No hint in the name at all, so the descriptor flags decide: 33 = fixed pitch + nonsymbolic.
+        let grotesk = font(&info.fonts, "HouseGrotesk");
+        assert_eq!(grotesk.substitute.as_deref(), Some("Courier"));
+        assert!(grotesk.substitution.as_deref().unwrap_or_default().contains("descriptor flags"), "{grotesk:?}");
+
+        // Japanese depends on the optional craft-fonts build input; either way it is reported,
+        // and never as a Latin face.
+        let jpan = font(&info.fonts, "KozMinPro-Regular");
+        assert!(jpan.substitution.is_some(), "a substitution is always explained");
+        match &jpan.substitute {
+            Some(face) => {
+                assert!(!face.starts_with("Helvetica") && !face.starts_with("Times"), "a Latin face is never a Japanese substitute: {face}")
+            }
+            None => assert!(jpan.substitution.as_deref().unwrap_or_default().contains("no licensed face")),
+        }
+
+        // Nothing claims to be embedded, so every font here carries a reason.
+        assert!(info.fonts.iter().all(|f| !f.embedded && f.substitution.is_some()), "{:?}", info.fonts);
+    }
+
+    /// An embedded font is reported as faithful: nothing stands in, and there is nothing to explain.
+    const EMBEDDED: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /Font << /F1 4 0 R >> >> >> endobj
+4 0 obj << /Type /Font /Subtype /TrueType /BaseFont /ABCDEF+SomeHouseSans /FontDescriptor 5 0 R >> endobj
+5 0 obj << /Type /FontDescriptor /FontName /ABCDEF+SomeHouseSans /Flags 32 /FontFile2 6 0 R >> endobj
+6 0 obj << /Length 4 >> stream
+test
+endstream endobj
+trailer << /Size 7 /Root 1 0 R >>
+%%EOF";
+
+    #[test]
+    fn an_embedded_font_reports_no_substitution_at_all() {
+        let info = inspect(Arc::new(EMBEDDED.to_vec()), None).expect("opens");
+        let f = font(&info.fonts, "SomeHouseSans");
+        assert!(f.embedded && f.subset, "{f:?}");
+        assert_eq!((f.substitute.as_deref(), f.substitution.as_deref()), (None, None), "the document's own glyphs are shown");
+    }
+}
diff --git a/crates/render/src/inspect/tests.rs b/crates/render/src/inspect/tests.rs
new file mode 100644
index 0000000000..a5bfec474d
--- /dev/null
+++ b/crates/render/src/inspect/tests.rs
@@ -0,0 +1,1872 @@
+#[test]
+fn png_predictor_rows_longer_than_the_data_are_refused_before_allocating() {
+    // Vendored lopdf patch: a fuzzed `/Columns 4294967295` allocated two 4 GiB rows before
+    // reading any data. A row that cannot fit in the data is refused up front.
+    let e = lopdf::filters::png::decode_frame(&[2, 0, 0, 0], 1, 64 << 20).unwrap_err();
+    assert!(e.to_string().contains("longer than the data"), "{e}");
+    // A real frame still decodes: two 3-byte rows, the second Up-filtered.
+    assert_eq!(lopdf::filters::png::decode_frame(&[0, 1, 2, 3, 2, 1, 1, 1], 1, 3).unwrap(), [1, 2, 3, 2, 3, 4]);
+}
+
+#[test]
+fn empty_png_predictor_frames_do_not_allocate_rows() {
+    // usize::MAX cannot be reserved, so the old code safely errors before allocating.
+    // An empty frame needs no rows regardless of the declared width.
+    assert!(lopdf::filters::png::decode_frame(&[], 1, usize::MAX).unwrap().is_empty());
+}
+
+fn tiff_predictor_stream(data: Vec<u8>, columns: i64, colors: i64, bits: i64) -> lopdf::Stream {
+    let mut params = lopdf::Dictionary::new();
+    params.set("Predictor", 2i64);
+    params.set("Columns", columns);
+    params.set("Colors", colors);
+    params.set("BitsPerComponent", bits);
+    let mut dict = lopdf::Dictionary::new();
+    dict.set("DecodeParms", params);
+    let mut stream = lopdf::Stream::new(dict, data);
+    stream.compress().unwrap();
+    assert_eq!(stream.dict.get(b"Filter").unwrap().as_name().unwrap(), b"FlateDecode");
+    stream
+}
+
+#[test]
+fn tiff_subbyte_predictor_row_width_overflow_is_refused() {
+    // Each multiplication overflows before any scratch allocation in the old debug build.
+    for bits in [1, 2, 4] {
+        let stream = tiff_predictor_stream(vec![0; 64], i64::MAX, 3, bits);
+        assert!(
+            matches!(stream.decompressed_content_with_limit(64), Err(lopdf::Error::Decompress(lopdf::DecompressError::Predictor(_)))),
+            "{bits}-bit row"
+        );
+    }
+}
+
+#[test]
+fn tiff_subbyte_predictor_scratch_is_bounded_by_available_samples() {
+    // 1/2-bit row widths fit usize on 32- and 64-bit hosts; Colors previously made Vec<u16>
+    // reject the capacity before allocating. A partial row has no preceding pixel.
+    for bits in [1, 2] {
+        let data = vec![0b1010_0110; 64];
+        let stream = tiff_predictor_stream(data.clone(), 1, i64::try_from(isize::MAX).unwrap(), bits);
+        assert_eq!(stream.decompressed_content_with_limit(64).unwrap(), data, "{bits}-bit row");
+    }
+}
+
+#[test]
+fn tiff_subbyte_predictors_keep_components_rows_and_padding() {
+    // Repeated tiny rows compress through the public Stream API. Rows remain independent,
+    // differences wrap at each component depth, and trailing padding bits survive.
+    for (columns, colors, bits, encoded, decoded) in [
+        (16, 1, 1, vec![255, 170, 8, 255], vec![170, 204, 15, 85]),
+        (6, 1, 2, vec![85, 179], vec![108, 147]),
+        (3, 1, 4, vec![25, 16], vec![26, 176]),
+        (2, 2, 4, vec![18, 34], vec![18, 52]),
+    ] {
+        let stream = tiff_predictor_stream(encoded.repeat(32), columns, colors, bits);
+        assert_eq!(stream.decompressed_content_with_limit(128).unwrap(), decoded.repeat(32), "{bits}-bit, {colors} colours");
+    }
+}
+
+// Xref-stream fixtures exercise indirect /Length lookup during document loading: stream 2's /Length is `3 0 R`,
+// `containers` lists compressed (id, container, index) entries and `objects` the other objects in the file.
+fn compressed_length_pdf(containers: &[(u32, u32, u16)], objects: &[(u32, &[u8])]) -> Vec<u8> {
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let ids = containers.iter().flat_map(|&(id, container, _)| [id, container]).chain(objects.iter().map(|&(id, _)| id));
+    let xref_id = ids.max().unwrap_or(3) + 1;
+    let mut records = vec![[0u8; 7]; (xref_id + 1) as usize];
+    records[0] = [0, 0, 0, 0, 0, 255, 255];
+    let mut append = |id: u32, body: &[u8]| {
+        records[id as usize][0] = 1;
+        records[id as usize][1..5].copy_from_slice(&(pdf.len() as u32).to_be_bytes());
+        pdf.extend_from_slice(format!("{id} 0 obj\n").as_bytes());
+        pdf.extend_from_slice(body);
+        pdf.extend_from_slice(b"\nendobj\n");
+    };
+    append(1, b"<< /Type /Catalog >>");
+    append(2, b"<< /Length 3 0 R >>\nstream\nhello\nendstream");
+    for &(id, body) in objects {
+        append(id, body);
+    }
+    for &(id, container, index) in containers {
+        records[id as usize][0] = 2;
+        records[id as usize][1..5].copy_from_slice(&container.to_be_bytes());
+        records[id as usize][5..7].copy_from_slice(&index.to_be_bytes());
+    }
+    let xref_offset = pdf.len();
+    records[xref_id as usize][0] = 1;
+    records[xref_id as usize][1..5].copy_from_slice(&(xref_offset as u32).to_be_bytes());
+    pdf.extend_from_slice(
+        format!("{xref_id} 0 obj\n<< /Type /XRef /Size {} /Root 1 0 R /W [1 4 2] /Length {} >>\nstream\n", records.len(), records.len() * 7)
+            .as_bytes(),
+    );
+    for record in records {
+        pdf.extend_from_slice(&record);
+    }
+    pdf.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref_offset}\n%%EOF\n").as_bytes());
+    pdf
+}
+
+// Stream 2's /Length starts a chain of `hops` indirect /Length lookups, each naming a new object; only the last
+// link's /Length is direct. Compressed: link k is the integer 3 + 2k (the length it measures) alone in the object
+// stream 4 + 2k, whose own /Length is link k + 1. Plain: link k is the stream 3 + k, whose /Length is link k + 1.
+fn length_chain_pdf(hops: u32, compressed: bool) -> Vec<u8> {
+    let length = |hop: u32, next: u32, data: &str| if hop + 1 < hops { format!("{next} 0 R") } else { data.len().to_string() };
+    let (mut containers, mut objects) = (Vec::new(), Vec::new());
+    let mut value = 5; // the length of stream 2's data, "hello"
+    for hop in 0..hops {
+        if compressed {
+            let (id, container) = (3 + 2 * hop, 4 + 2 * hop);
+            let index = format!("{id} 0 ");
+            let data = format!("{index}{value}");
+            let dict = format!("/Type /ObjStm /N 1 /First {} /Length {}", index.len(), length(hop, id + 2, &data));
+            objects.push((container, format!("<< {dict} >>\nstream\n{data}\nendstream")));
+            containers.push((id, container, 0));
+            value = data.len();
+        } else {
+            objects.push((3 + hop, format!("<< /Length {} >>\nstream\n\nendstream", length(hop, 4 + hop, ""))));
+        }
+    }
+    let objects: Vec<_> = objects.iter().map(|(id, body)| (*id, body.as_bytes())).collect();
+    compressed_length_pdf(&containers, &objects)
+}
+
+// Lenient loading keeps a document whose stream 2 has an unresolvable /Length: the catalog, and stream 2's
+// dictionary without its data.
+fn load_without_stream_2_data(pdf: &[u8]) -> Document {
+    let doc = Document::load_mem(pdf).unwrap();
+    assert!(doc.catalog().unwrap().has_type(b"Catalog"));
+    assert!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content.is_empty());
+    doc
+}
+
+#[test]
+fn compressed_object_self_container_does_not_recurse() {
+    let doc = load_without_stream_2_data(&compressed_length_pdf(&[(3, 3, 0)], &[]));
+    assert!(doc.get_object((3, 0)).is_err());
+}
+
+#[test]
+fn compressed_object_mutual_containers_do_not_recurse() {
+    let doc = load_without_stream_2_data(&compressed_length_pdf(&[(3, 4, 0), (4, 3, 0)], &[]));
+    assert!(doc.get_object((3, 0)).is_err());
+    assert!(doc.get_object((4, 0)).is_err());
+}
+
+#[test]
+fn object_stream_length_cycle_does_not_recurse() {
+    let pdf = compressed_length_pdf(&[(3, 4, 0)], &[(4, b"<< /Type /ObjStm /N 1 /First 4 /Length 3 0 R >>\nstream\n3 0 5\nendstream")]);
+    let doc = load_without_stream_2_data(&pdf);
+    // The container's /Length is the object it holds: the container is kept without data, so 3 never loads.
+    assert!(doc.get_object((4, 0)).unwrap().as_stream().unwrap().content.is_empty());
+    assert!(doc.get_object((3, 0)).is_err());
+}
+
+#[test]
+fn compressed_object_container_chain_does_not_recurse() {
+    let containers: Vec<_> = (3..100_003).map(|id| (id, id + 1, 0)).collect();
+    let pdf = compressed_length_pdf(&containers, &[(100_003, b"<< /Type /ObjStm /N 1 /First 4 /Length 5 >>\nstream\n3 0 5\nendstream")]);
+    let doc = load_without_stream_2_data(&pdf);
+    // The object stream in the file loads, but the xref puts 3 in the compressed container 4, which is refused.
+    assert_eq!(doc.get_object((100_003, 0)).unwrap().as_stream().unwrap().content, b"3 0 5");
+    assert!(doc.get_object((3, 0)).is_err());
+}
+
+#[test]
+fn compressed_objects_and_indirect_stream_length_still_load() {
+    let pdf =
+        compressed_length_pdf(&[(3, 4, 0), (5, 4, 1)], &[(4, b"<< /Type /ObjStm /N 2 /First 8 /Length 17 >>\nstream\n3 0 5 2 5 (value)\nendstream")]);
+    let doc = Document::load_mem_with_options(&pdf, LoadOptions { strict: true, ..Default::default() }).unwrap();
+    assert_eq!(doc.get_object((3, 0)).unwrap().as_i64().unwrap(), 5);
+    assert_eq!(doc.get_object((5, 0)).unwrap().as_str().unwrap(), b"value");
+    assert_eq!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content, b"hello");
+}
+
+#[test]
+fn compressed_length_in_a_container_with_an_indirect_length_still_loads() {
+    // Two hops, as in a valid file: stream 2's /Length (3) is compressed in container 4, whose own /Length (5) is
+    // a plain indirect integer.
+    let pdf = compressed_length_pdf(&[(3, 4, 0)], &[(4, b"<< /Type /ObjStm /N 1 /First 4 /Length 5 0 R >>\nstream\n3 0 5\nendstream"), (5, b"5")]);
+    let doc = Document::load_mem_with_options(&pdf, LoadOptions { strict: true, ..Default::default() }).unwrap();
+    assert_eq!(doc.get_object((3, 0)).unwrap().as_i64().unwrap(), 5);
+    assert_eq!(doc.get_object((5, 0)).unwrap().as_i64().unwrap(), 5);
+    assert_eq!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content, b"hello");
+}
+
+#[test]
+fn compressed_length_chain_does_not_recurse() {
+    // Every container is an ordinary object in the file and every hop names a new object, so neither the
+    // container check nor the cycle history stops the chain; each hop recursed once more (a 512 KiB stack
+    // overflowed within 150 hops). Lookups past the cap fail: the first link never loads, while the last one,
+    // next to the direct /Length, does.
+    let hops = 5_000;
+    let doc = load_without_stream_2_data(&length_chain_pdf(hops, true));
+    assert!(doc.get_object((3, 0)).is_err());
+    assert!(doc.get_object((3 + 2 * (hops - 1), 0)).unwrap().as_i64().is_ok());
+    // The cap itself: loading link j reads its container's /Length, a chain of 2 * (hops - 1 - j) lookups, and
+    // 16 are allowed, so the 9th link from the end loads and the 10th does not.
+    assert!(doc.get_object((3 + 2 * (hops - 9), 0)).is_ok());
+    assert!(doc.get_object((3 + 2 * (hops - 10), 0)).is_err());
+}
+
+#[test]
+fn plain_stream_length_chain_does_not_recurse() {
+    // The same recursion without object streams: each stream's /Length names the next stream (a 512 KiB stack
+    // overflowed within 200 hops). A stream is no length, so every link is kept as a stream without data.
+    let hops = 5_000;
+    let doc = load_without_stream_2_data(&length_chain_pdf(hops, false));
+    assert!((3..3 + hops).all(|id| doc.get_object((id, 0)).is_ok_and(|link| link.as_stream().is_ok_and(|s| s.content.is_empty()))));
+}
+
+fn indexed_object_stream(pairs: &[(u32, usize)], members: &[u8]) -> lopdf::Stream {
+    let mut content = Vec::new();
+    for &(id, offset) in pairs {
+        content.extend_from_slice(format!("{id} {offset} ").as_bytes());
+    }
+    let mut dict = Dictionary::new();
+    dict.set("Type", "ObjStm");
+    dict.set("N", pairs.len() as i64);
+    dict.set("First", content.len() as i64);
+    content.extend_from_slice(members);
+    lopdf::Stream::new(dict, content)
+}
+
+#[test]
+fn object_stream_member_extents_bound_owned_strings() {
+    let mut members = vec![b'('; 32];
+    members.extend(vec![b'x'; 1 << 20]);
+    members.extend([b')'; 32]);
+    // Put the innermost (complete) string first in index order, then overlapping starts
+    // and duplicates. Only this first member at offset 31 may own the large string.
+    let mut pairs = vec![(100, 31)];
+    pairs.extend((0..31).map(|offset| (offset as u32 + 1, offset)));
+    pairs.extend([(200, 31), (201, 31)]);
+    let stream = indexed_object_stream(&pairs, &members);
+    let parsed = lopdf::ObjectStream::new_with_limit(&stream, Some(2 << 20)).unwrap();
+    assert_eq!(parsed.objects.get(&(100, 0)).unwrap().as_str().unwrap().len(), 1 << 20);
+    let total: usize = parsed.objects.values().filter_map(|object| object.as_str().ok()).map(<[u8]>::len).sum();
+    assert!(total <= stream.content.len(), "owned {total} string bytes from {} decoded bytes", stream.content.len());
+    assert!(!parsed.objects.contains_key(&(200, 0)));
+    assert!(!parsed.objects.contains_key(&(201, 0)));
+}
+
+#[test]
+fn object_stream_member_extents_preserve_index_order_and_whitespace() {
+    let members = b" \n42\n /Name \n[true 7]\n << /Key (value) >>\n (last)";
+    // Unsorted offsets, and object 9 appears twice: its last index entry still wins.
+    let pairs = [(9, 0), (12, 21), (10, 5), (11, 12), (9, 41)];
+    let parsed = lopdf::ObjectStream::new(&indexed_object_stream(&pairs, members)).unwrap();
+    assert_eq!(parsed.objects.len(), 4);
+    assert_eq!(parsed.objects.get(&(9, 0)).unwrap().as_str().unwrap(), b"last");
+    assert_eq!(parsed.objects.get(&(10, 0)).unwrap().as_name().unwrap(), b"Name");
+    assert_eq!(parsed.objects.get(&(11, 0)).unwrap().as_array().unwrap(), &[Object::Boolean(true), Object::Integer(7)]);
+    assert_eq!(parsed.objects.get(&(12, 0)).unwrap().as_dict().unwrap().get(b"Key").unwrap().as_str().unwrap(), b"value");
+}
+
+#[test]
+fn view_and_user_space_round_trip_for_every_rotation() {
+    for rotation in [0u16, 90, 180, 270] {
+        let (w, h) = if rotation % 180 == 0 { (200.0, 300.0) } else { (300.0, 200.0) };
+        let p = super::PageInfo { width: w, height: h, label: String::new(), crop: [10.0, 20.0, 210.0, 320.0], rotation };
+        for (x, y) in [(0.0, 0.0), (15.0, 40.0), (w, h)] {
+            let [ux, uy] = p.view_to_user(x, y);
+            let [vx, vy] = p.user_to_view(ux, uy);
+            assert!((vx - x).abs() < 1e-3 && (vy - y).abs() < 1e-3, "{rotation}: {x},{y} → {ux},{uy} → {vx},{vy}");
+        }
+    }
+    // Unrotated: the view's top-left is the crop box's top-left.
+    let p = super::PageInfo { width: 200.0, height: 300.0, label: String::new(), crop: [10.0, 20.0, 210.0, 320.0], rotation: 0 };
+    assert_eq!(p.view_to_user(0.0, 0.0), [10.0, 320.0]);
+    assert_eq!(p.view_rect_to_quad([0.0, 0.0, 10.0, 5.0]), [10.0, 320.0, 20.0, 320.0, 10.0, 315.0, 20.0, 315.0]);
+}
+
+/// #2583: a NoRotate comment is drawn upright with its top-left as displayed at the upper-left
+/// corner of `/Rect`, its width across and its height down; a box resized as drawn maps back to
+/// the `/Rect` that shows it. Other comments, and pages that aren't quarter-turned, keep `/Rect`.
+#[test]
+fn no_rotate_comments_are_shown_upright_from_their_corner_and_back() {
+    let mut note = super::Annotation {
+        page: 0,
+        subtype: "Text".into(),
+        author: None,
+        contents: None,
+        modified: None,
+        name: None,
+        in_reply_to: None,
+        parent: None,
+        grouped: false,
+        rect: [40.0, 50.0, 70.0, 70.0],
+        color: None,
+        index: 0,
+        state: None,
+        quads: Vec::new(),
+        locked: false,
+        intent: None,
+        fill_sign: false,
+        no_rotate: true,
+        points: Vec::new(),
+    };
+    let rect = note.rect.map(f64::from);
+    for rotation in [0u16, 90, 180, 270, 45] {
+        let (w, h) = if rotation % 180 == 90 { (140.0, 200.0) } else { (200.0, 140.0) };
+        let p = super::PageInfo { width: w, height: h, label: String::new(), crop: [0.0, 0.0, 200.0, 140.0], rotation };
+        let shown = note.shown_rect(rotation);
+        let (a, b) = (p.user_to_view(shown[0], shown[1]), p.user_to_view(shown[2], shown[3]));
+        let [cx, cy] = p.user_to_view(40.0, 70.0);
+        let want = [cx, cy, cx + 30.0, cy + 20.0];
+        let got = [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])];
+        assert!(got.iter().zip(want).all(|(g, w)| (g - w).abs() < 1e-3), "{rotation}: shown {got:?}, want {want:?}");
+        assert_eq!(note.rect_for_shown(note.shown(rect, rotation), rotation), rect, "{rotation}");
+        // Moved by (5, -7) and resized to 50 × 10 as drawn, back to a /Rect.
+        let resized = [shown[0] as f64 + 5.0, shown[1] as f64 - 7.0, 0.0, 0.0];
+        let across = if rotation % 180 == 90 { [10.0, 50.0] } else { [50.0, 10.0] };
+        let resized = [resized[0], resized[1], resized[0] + across[0], resized[1] + across[1]];
+        let back = note.rect_for_shown(resized, rotation);
+        assert_eq!((back[2] - back[0], back[3] - back[1]), (50.0, 10.0), "{rotation}: {back:?}");
+        assert_eq!(note.shown(back, rotation), resized, "{rotation}");
+    }
+    note.no_rotate = false;
+    assert_eq!(note.shown_rect(90), note.rect);
+    assert_eq!(note.rect_for_shown([1.0, 2.0, 3.0, 4.0], 90), [1.0, 2.0, 3.0, 4.0]);
+}
+
+use super::*;
+
+#[test]
+fn roman_and_alpha_labels() {
+    assert_eq!(roman(4, MAX_LABEL_BYTES).as_deref(), Some("iv"));
+    assert_eq!(roman(1994, MAX_LABEL_BYTES).as_deref(), Some("mcmxciv"));
+    assert_eq!(alpha(1, MAX_LABEL_BYTES).as_deref(), Some("a"));
+    assert_eq!(alpha(27, MAX_LABEL_BYTES).as_deref(), Some("aa"));
+    assert_eq!(alpha(53, MAX_LABEL_BYTES).as_deref(), Some("aaa"));
+}
+
+// Synthetic label-only inspection fixtures: never construct an explosive branching tree.
+fn label_info(nums: Vec<Object>, kids: Vec<Object>) -> DocInfo {
+    let mut doc = Document::with_version("1.7");
+    let mut tree = Dictionary::new();
+    tree.set("Nums", nums);
+    tree.set("Kids", kids);
+    doc.objects.insert((6, 0), Object::Dictionary(tree));
+    let mut catalog = Dictionary::new();
+    catalog.set("Type", Object::Name(b"Catalog".to_vec()));
+    catalog.set("PageLabels", Object::Reference((6, 0)));
+    doc.objects.insert((1, 0), Object::Dictionary(catalog));
+    doc.trailer.set("Root", Object::Reference((1, 0)));
+    let mut info = DocInfo {
+        pages: (1..=3).map(|n| PageInfo { width: 200.0, height: 300.0, crop: [0.0, 0.0, 200.0, 300.0], rotation: 0, label: n.to_string() }).collect(),
+        ..Default::default()
+    };
+    Inspector::new(&doc).fill(&mut info);
+    info
+}
+
+fn label_spec(style: &str, prefix: Vec<u8>, first: i64) -> Object {
+    let mut d = Dictionary::new();
+    d.set("S", Object::Name(style.as_bytes().to_vec()));
+    d.set("P", Object::String(prefix, lopdf::StringFormat::Hexadecimal));
+    d.set("St", first);
+    Object::Dictionary(d)
+}
+
+fn assert_label_fallback(info: &DocInfo) {
+    assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["1", "2", "3"]);
+    assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
+    assert!(info.warnings[0].contains("Page labels"), "{:?}", info.warnings);
+    assert!(info.warnings[0].contains("physical page numbers"), "{:?}", info.warnings);
+}
+
+// Contributor-original, blank three-page PDFs. The public importer reads both labels and metadata.
+fn page_prefix_space_pdf(prefix: Vec<u8>, decimal: bool, indirect: bool) -> Vec<u8> {
+    use lopdf::dictionary;
+    let mut doc = Document::with_version("1.7");
+    let pages_id = doc.new_object_id();
+    let kids: Vec<Object> = (0..3)
+        .map(|_| {
+            doc.add_object(dictionary! {
+                "Type" => "Page",
+                "Parent" => pages_id,
+                "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
+                "Resources" => Dictionary::new(),
+            })
+            .into()
+        })
+        .collect();
+    doc.objects.insert(pages_id, dictionary! { "Type" => "Pages", "Kids" => kids, "Count" => 3 }.into());
+    let prefix = Object::String(prefix, lopdf::StringFormat::Hexadecimal);
+    let prefix = if indirect { Object::Reference(doc.add_object(prefix)) } else { prefix };
+    let mut label = Dictionary::new();
+    label.set("P", prefix);
+    if decimal {
+        label.set("S", Object::Name(b"D".to_vec()));
+    }
+    let labels = dictionary! { "Nums" => vec![Object::Integer(0), Object::Dictionary(label)] };
+    let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id, "PageLabels" => labels });
+    let info_id = doc.add_object(dictionary! { "Title" => Object::string_literal("  Metadata title  ") });
+    doc.trailer.set("Root", catalog_id);
+    doc.trailer.set("Info", info_id);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).expect("write original page-prefix fixture");
+    bytes
+}
+
+#[test]
+fn page_label_prefix_spaces_survive_public_inspection() {
+    let mut utf16 = vec![0xfe, 0xff];
+    utf16.extend(" Ω ".encode_utf16().flat_map(u16::to_be_bytes));
+    for (raw, prefix, decimal, indirect) in [
+        (b" leading".to_vec(), " leading", true, false),
+        (b"trailing ".to_vec(), "trailing ", true, false),
+        (b" both ".to_vec(), " both ", false, false),
+        (b" ".to_vec(), " ", false, false),
+        (b" Caf\xe9 ".to_vec(), " Café ", true, false),
+        (utf16.clone(), " Ω ", true, false),
+        (utf16, " Ω ", false, true),
+        (Vec::new(), "", true, false),
+        (Vec::new(), "", false, false),
+    ] {
+        let bytes = page_prefix_space_pdf(raw, decimal, indirect);
+        let info = inspect(Arc::new(bytes), None).expect("public import of original page-prefix fixture");
+        let expected: Vec<String> = (1..=3)
+            .map(|n| {
+                if decimal {
+                    format!("{prefix}{n}")
+                } else if prefix.is_empty() {
+                    n.to_string()
+                } else {
+                    prefix.to_owned()
+                }
+            })
+            .collect();
+        assert_eq!(info.pages.iter().map(|p| p.label.clone()).collect::<Vec<_>>(), expected, "{prefix:?}, decimal={decimal}, indirect={indirect}");
+        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+        assert_eq!(info.title.as_deref(), Some("Metadata title"), "page-prefix decoding must not change metadata normalization");
+    }
+}
+
+#[test]
+fn page_label_limits_keep_normal_pdf_numbering() {
+    for (style, first, expected) in
+        [("r", 4, ["iv", "v", "vi"]), ("R", 1994, ["MCMXCIV", "MCMXCV", "MCMXCVI"]), ("a", 26, ["z", "aa", "bb"]), ("A", 52, ["ZZ", "AAA", "BBB"])]
+    {
+        let info = label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), first)], Vec::new());
+        assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), expected);
+        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+    }
+}
+
+#[test]
+fn page_label_limits_reject_long_prefixes_without_partial_labels() {
+    for prefix in [vec![b'x'; 1025], vec![b'x'; 2051]] {
+        let nums = vec![Object::Integer(0), label_spec("D", b"ok-".to_vec(), 1), Object::Integer(1), label_spec("D", prefix, 1)];
+        assert_label_fallback(&label_info(nums, Vec::new()));
+    }
+}
+
+#[test]
+fn page_label_limits_count_decoded_utf8_bytes() {
+    let mut prefix = vec![0xfe, 0xff];
+    for _ in 0..342 {
+        prefix.extend_from_slice(&0x2022u16.to_be_bytes());
+    }
+    assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec("", prefix, 1)], Vec::new()));
+}
+
+#[test]
+fn page_label_limits_bound_roman_and_alpha_output() {
+    // Just 1025 output bytes on the old path, so RED does not consume excessive memory.
+    for (style, first) in [("r", 1_025_000), ("a", 26 * 1024 + 1)] {
+        assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), first)], Vec::new()));
+    }
+}
+
+#[test]
+fn page_label_limits_detect_one_node_cycle() {
+    let nums = vec![Object::Integer(0), label_spec("D", b"custom-".to_vec(), 1)];
+    assert_label_fallback(&label_info(nums, vec![Object::Reference((6, 0))]));
+}
+
+#[test]
+fn page_label_limits_accept_utf16_ascii_at_the_output_boundary() {
+    let mut prefix = vec![0xfe, 0xff];
+    for _ in 0..1023 {
+        prefix.extend_from_slice(&u16::from(b'x').to_be_bytes());
+    }
+    let info = label_info(vec![Object::Integer(0), label_spec("D", prefix, 1)], Vec::new());
+    assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+    assert_eq!(info.pages[0].label, format!("{}1", "x".repeat(1023)));
+    assert!(info.pages.iter().all(|p| p.label.len() == MAX_LABEL_BYTES));
+}
+
+#[test]
+fn page_label_limits_refuse_hostile_numbers_before_allocating() {
+    for style in ["r", "R", "a", "A"] {
+        assert_label_fallback(&label_info(vec![Object::Integer(0), label_spec(style, Vec::new(), i64::MAX)], Vec::new()));
+    }
+    // Decimal labels remain small even when their first number exceeds 32-bit usize.
+    let info = label_info(vec![Object::Integer(0), label_spec("D", Vec::new(), i64::MAX)], Vec::new());
+    assert_eq!(info.pages[0].label, i64::MAX.to_string());
+    assert_eq!(info.pages[1].label, (i64::MAX as u64 + 1).to_string());
+    assert!(info.warnings.is_empty());
+}
+
+#[test]
+fn page_label_limits_bound_wide_number_trees() {
+    assert_label_fallback(&label_info(Vec::new(), vec![Object::Null; MAX_LABEL_TREE_WORK + 1]));
+    let pair = [Object::Integer(0), label_spec("D", Vec::new(), 1)];
+    let nums = (0..MAX_LABEL_TREE_WORK).flat_map(|_| pair.clone()).collect();
+    assert_label_fallback(&label_info(nums, Vec::new()));
+}
+
+#[test]
+fn page_label_limits_bound_total_custom_output_atomically() {
+    let doc = Document::with_version("1.7");
+    let mut tree = Dictionary::new();
+    tree.set("Nums", vec![Object::Integer(0), label_spec("", vec![b'x'; MAX_LABEL_BYTES], 1)]);
+    let mut catalog = Dictionary::new();
+    catalog.set("PageLabels", Object::Dictionary(tree));
+    let count = MAX_LABEL_TOTAL_BYTES / MAX_LABEL_BYTES + 1;
+    let mut pages: Vec<_> =
+        (1..=count).map(|n| PageInfo { width: 200.0, height: 300.0, crop: [0.0, 0.0, 200.0, 300.0], rotation: 0, label: n.to_string() }).collect();
+    let err = Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap_err();
+    assert!(err.contains("4 MiB"), "{err}");
+    assert!(pages.iter().enumerate().all(|(i, p)| p.label == (i + 1).to_string()));
+    // Exact aggregate boundary remains supported.
+    pages.pop();
+    Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap();
+    assert!(pages.iter().all(|p| p.label.len() == MAX_LABEL_BYTES));
+}
+
+#[test]
+fn page_label_limits_bound_the_total_of_decoded_prefixes() {
+    // `ranges` ranges naming one shared prefix object of `prefix` bytes, without a style.
+    let shared = |ranges: i64, prefix: usize| {
+        let mut doc = Document::with_version("1.7");
+        doc.objects.insert((7, 0), Object::String(vec![b'x'; prefix], lopdf::StringFormat::Literal));
+        let mut spec = Dictionary::new();
+        spec.set("P", Object::Reference((7, 0)));
+        doc.objects.insert((8, 0), Object::Dictionary(spec));
+        let mut tree = Dictionary::new();
+        tree.set("Nums", (0..ranges).flat_map(|i| [Object::Integer(i), Object::Reference((8, 0))]).collect::<Vec<_>>());
+        let mut catalog = Dictionary::new();
+        catalog.set("PageLabels", Object::Dictionary(tree));
+        (doc, catalog)
+    };
+    let mut pages: Vec<_> =
+        (1..=3).map(|n| PageInfo { width: 200.0, height: 300.0, crop: [0.0, 0.0, 200.0, 300.0], rotation: 0, label: n.to_string() }).collect();
+    // Each range decodes its prefix, so a small file sharing one prefix object asks for a
+    // copy per range: 5,000 ranges and a 1,000-byte prefix make 5 MB, past the 4 MiB total.
+    // Three pages make three labels, far below the label total: the prefixes alone refuse it.
+    let (doc, catalog) = shared(5000, 1000);
+    let err = Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap_err();
+    assert!(err.contains("prefixes exceed 4 MiB"), "{err}");
+    assert!(pages.iter().enumerate().all(|(i, p)| p.label == (i + 1).to_string()));
+    // Exactly 4 MiB of prefixes is still read.
+    let (doc, catalog) = shared((MAX_PREFIX_TOTAL_BYTES / MAX_LABEL_BYTES) as i64, MAX_LABEL_BYTES);
+    Inspector::new(&doc).page_labels(&catalog, &mut pages).unwrap();
+    assert!(pages.iter().all(|p| p.label.len() == MAX_LABEL_BYTES));
+}
+
+#[test]
+fn page_label_limits_handle_prefix_only_and_reference_cycles() {
+    let info = label_info(vec![Object::Integer(0), label_spec("", b"prefix".to_vec(), i64::MAX)], Vec::new());
+    assert!(info.warnings.is_empty());
+    assert!(info.pages.iter().all(|p| p.label == "prefix"));
+    let mut doc = Document::with_version("1.7");
+    doc.objects.insert((6, 0), Object::Reference((6, 0)));
+    let mut catalog = Dictionary::new();
+    catalog.set("PageLabels", Object::Reference((6, 0)));
+    assert!(Inspector::new(&doc).page_labels(&catalog, &mut []).unwrap_err().contains("cyclic"));
+}
+
+#[test]
+fn page_label_limits_bound_depth_and_count_combined_work() {
+    for depth in [MAX_LABEL_TREE_DEPTH, MAX_LABEL_TREE_DEPTH + 1] {
+        let mut child = Dictionary::new();
+        child.set("Nums", vec![Object::Integer(0), label_spec("D", b"custom-".to_vec(), 1)]);
+        let mut child = Object::Dictionary(child);
+        for _ in 1..depth {
+            let mut parent = Dictionary::new();
+            parent.set("Kids", vec![child]);
+            child = Object::Dictionary(parent);
+        }
+        let info = label_info(Vec::new(), vec![child]);
+        if depth == MAX_LABEL_TREE_DEPTH {
+            assert!(info.warnings.is_empty());
+            assert_eq!(info.pages[0].label, "custom-1");
+        } else {
+            assert_label_fallback(&info);
+        }
+    }
+    // Each array alone fits: their combined work still must be bounded.
+    let half = MAX_LABEL_TREE_WORK / 2;
+    let spec = label_spec("D", Vec::new(), 1);
+    let nums = (0..half).flat_map(|i| [Object::Integer(i as i64), spec.clone()]).collect();
+    assert_label_fallback(&label_info(nums, vec![Object::Null; half]));
+}
+
+#[test]
+fn page_label_limits_keep_the_later_of_duplicate_ranges() {
+    let nums = vec![Object::Integer(0), label_spec("D", b"first-".to_vec(), 1), Object::Integer(0), label_spec("D", b"last-".to_vec(), 1)];
+    let info = label_info(nums, Vec::new());
+    assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["last-1", "last-2", "last-3"]);
+    assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
+    assert!(info.warnings[0].contains("twice"), "{:?}", info.warnings);
+}
+
+#[test]
+fn page_label_limits_keep_other_ranges_when_one_is_too_long() {
+    // Page 1 is labelled normally; pages 2–3 would need over 1024 bytes of roman numerals.
+    let nums = vec![Object::Integer(0), label_spec("D", b"ok-".to_vec(), 1), Object::Integer(1), label_spec("r", Vec::new(), 1_025_000)];
+    let info = label_info(nums, Vec::new());
+    assert_eq!(info.pages.iter().map(|p| p.label.as_str()).collect::<Vec<_>>(), ["ok-1", "2", "3"]);
+    assert_eq!(info.warnings.len(), 1, "{:?}", info.warnings);
+    assert!(info.warnings[0].contains("physical page numbers"), "{:?}", info.warnings);
+}
+
+const ATTACHMENTS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [(notes.txt) 6 0 R] >> >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [4 0 R] /Resources << /Font << /F1 9 0 R >> >> >> endobj
+4 0 obj << /Type /Annot /Subtype /FileAttachment /Rect [10 10 30 30] /Contents (data.csv) /FS 8 0 R >> endobj
+5 0 obj << /Type /EmbeddedFile /Length 11 >> stream
+hello notes
+endstream endobj
+6 0 obj << /Type /Filespec /F (notes.txt) /UF (notes.txt) /EF << /F 5 0 R >> /Desc (Doc-level) >> endobj
+7 0 obj << /Type /EmbeddedFile /Length 5 >> stream
+a,b,c
+endstream endobj
+8 0 obj << /Type /Filespec /F (data.csv) /EF << /F 7 0 R >> >> endobj
+9 0 obj << /Type /Font /Subtype /Type1 /BaseFont /ABCDEF+Helvetica >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+#[test]
+fn attachments_of_both_kinds_are_listed_and_extracted() {
+    let bytes = Arc::new(ATTACHMENTS.to_vec());
+    let info = inspect(bytes.clone(), None).expect("opens");
+    let names: Vec<_> = info.attachments.iter().map(|a| a.name.as_str()).collect();
+    assert!(names.contains(&"notes.txt") && names.contains(&"data.csv"), "{names:?}");
+    for a in &info.attachments {
+        let data = attachment_data(&bytes, None, a).expect("extracts");
+        let expected: &[u8] = if a.name == "notes.txt" { b"hello notes" } else { b"a,b,c" };
+        assert_eq!(data, expected, "{}", a.name);
+    }
+    // A non-embedded /Helvetica is reported as standing in for itself: the standard-14
+    // metrics are exact, so the substitution is named rather than left implicit.
+    assert_eq!(
+        info.fonts,
+        vec![FontInfo {
+            name: "Helvetica".into(),
+            kind: "Type1".into(),
+            embedded: false,
+            subset: true,
+            encoding: None,
+            substitute: Some("Helvetica".into()),
+            substitution: Some(pdfcraft_fonts::fallback::Why::NamedStandard14.note().into()),
+        }]
+    );
+}
+
+const LAYERS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R 6 0 R 7 0 R] /D << /OFF [6 0 R] /RBGroups [[5 0 R 6 0 R] [7 0 R] 8 0 R] >> >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [10 0 R 11 0 R] >> endobj
+5 0 obj << /Type /OCG /Name (Red) >> endobj
+6 0 obj << /Type /OCG /Name (Green) >> endobj
+7 0 obj << /Type /OCG /Name (Blue) >> endobj
+8 0 obj [6 0 R 7 0 R] endobj
+9 0 obj [/OFF 5 0 R] endobj
+10 0 obj << /Type /Annot /Subtype /Link /Rect [10 10 50 30] /A << /S /SetOCGState /State [7 0 R /ON 6 0 R /Bogus 5 0 R /Toggle 5 0 R 1 7 0 R] /PreserveRB false >> >> endobj
+11 0 obj << /Type /Annot /Subtype /Link /Rect [60 10 100 30] /A << /S /SetOCGState /State 9 0 R >> >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// `/Trans` and `/Dur` (ISO 32000-2 §12.4.4): read with the spec's defaults for what a page
+/// leaves out, lenient about what is out of range, and only for pages that have either.
+const TRANSITIONS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R 5 0 R 6 0 R 7 0 R] /Count 5 /MediaBox [0 0 200 200] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Trans << /Type /Trans /S /Wipe /D 2.5 /Di 270 >> /Dur 5 >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R /Dur 3 >> endobj
+5 0 obj << /Type /Page /Parent 2 0 R /Trans 8 0 R >> endobj
+6 0 obj << /Type /Page /Parent 2 0 R /Trans << /S /Bogus /D (slow) /Di 45 /Dm /Q >> /Dur -1 >> endobj
+7 0 obj << /Type /Page /Parent 2 0 R >> endobj
+8 0 obj << /S /Fly /M /O /SS 0.5 /B true /Di /None /Dm /V >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+#[test]
+fn page_transitions_and_display_times_are_read() {
+    use super::TransitionStyle as S;
+    let info = inspect(Arc::new(TRANSITIONS.to_vec()), None).expect("opens");
+    let t = &info.transitions;
+    assert_eq!(t.iter().map(|t| t.page).collect::<Vec<_>>(), [0, 1, 2, 3], "pages with /Trans or /Dur, in order; page 5 has neither");
+    assert_eq!((t[0].style, t[0].duration, t[0].direction, t[0].display), (Some(S::Wipe), 2.5, Some(270), Some(5.0)));
+    assert!((t[0].horizontal, t[0].inward, t[0].scale, t[0].opaque) == (true, true, 1.0, false), "defaults: {:?}", t[0]);
+    assert_eq!((t[1].style, t[1].duration, t[1].display), (None, 1.0, Some(3.0)), "/Dur without /Trans");
+    assert_eq!(
+        (t[2].style, t[2].inward, t[2].scale, t[2].opaque, t[2].direction, t[2].horizontal),
+        (Some(S::Fly), false, 0.5, true, None, false),
+        "an indirect /Trans: {:?}",
+        t[2]
+    );
+    // Out of range: an unknown style is the spec's default R, a non-numeric /D the default
+    // second, a direction that is not one of the five falls back to 0, a bad /Dm to
+    // horizontal, and a negative /Dur is no display time.
+    assert_eq!(
+        (t[3].style, t[3].duration, t[3].direction, t[3].horizontal, t[3].display),
+        (Some(S::Replace), 1.0, Some(0), true, None),
+        "{:?}",
+        t[3]
+    );
+}
+
+const CUSTOM_INFO: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R >> endobj
+4 0 obj << /Title (Report) /Producer (Test) /Project (Apollo) /Revision 7 /Dept (R&D) /Trapped /False /Note <FEFF90E8> >> endobj
+trailer << /Root 1 0 R /Info 4 0 R >>
+%%EOF";
+
+#[test]
+fn custom_document_properties_are_listed_apart_from_the_standard_ones() {
+    let info = inspect(Arc::new(CUSTOM_INFO.to_vec()), None).expect("opens");
+    assert_eq!((info.title.as_deref(), info.producer.as_deref()), (Some("Report"), Some("Test")));
+    let mut custom = info.custom.clone();
+    custom.sort();
+    // Revision is a number, not text, so it is not listed; Trapped is a standard entry.
+    assert_eq!(
+        custom,
+        [("Dept".to_string(), "R&D".to_string()), ("Note".to_string(), "部".to_string()), ("Project".to_string(), "Apollo".to_string())]
+    );
+}
+
+#[test]
+fn radio_button_layer_groups_are_read() {
+    let info = inspect(Arc::new(LAYERS.to_vec()), None).expect("opens");
+    let layers: Vec<_> = info.layers.iter().map(|l| (l.id, l.name.as_str(), l.visible)).collect();
+    assert_eq!(layers, [((5, 0), "Red", true), ((6, 0), "Green", false), ((7, 0), "Blue", true)]);
+    // A group of one constrains nothing; an indirect group is read.
+    assert_eq!(info.layer_groups, [vec![(5, 0), (6, 0)], vec![(6, 0), (7, 0)]]);
+}
+
+#[test]
+fn initial_layer_visibility_is_the_default_configuration() {
+    // BaseState OFF: Red is listed ON; Green is listed both ON and OFF, and OFF wins; Blue
+    // isn't listed, so it takes the base state.
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R 6 0 R 7 0 R] /D << /BaseState /OFF /ON [5 0 R 6 0 R] /OFF [6 0 R] >> >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >> endobj
+5 0 obj << /Type /OCG /Name (Red) >> endobj
+6 0 obj << /Type /OCG /Name (Green) >> endobj
+7 0 obj << /Type /OCG /Name (Blue) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let info = inspect(Arc::new(pdf.to_vec()), None).expect("opens");
+    let layers: Vec<_> = info.layers.iter().map(|l| (l.name.as_str(), l.initial)).collect();
+    assert_eq!(layers, [("Red", true), ("Green", false), ("Blue", false)]);
+}
+
+const ORPHAN_FIELDS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [5 0 R 6 0 R] >> endobj
+4 0 obj << /Fields [] >> endobj
+5 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (alpha) /V (one) /Rect [10 100 90 120] >> endobj
+6 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (beta) /Rect [10 60 90 80] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+#[test]
+fn fields_listed_only_on_the_pages_are_listed() {
+    let info = inspect(Arc::new(ORPHAN_FIELDS.to_vec()), None).expect("opens");
+    let listed: Vec<_> = info.fields.iter().map(|f| (f.name.as_str(), f.value.as_deref(), f.page)).collect();
+    assert_eq!(listed, [("alpha", Some("one"), Some(0)), ("beta", None, Some(0))], "{:?}", info.fields);
+}
+
+/// A `Structure` that counts the objects read through it.
+struct CountingReads<'a> {
+    doc: &'a Document,
+    reads: std::cell::Cell<usize>,
+}
+
+impl Structure for CountingReads<'_> {
+    fn trailer(&self) -> &Dictionary {
+        &self.doc.trailer
+    }
+    fn get_object(&self, id: ObjectId) -> lopdf::Result<&Object> {
+        self.reads.set(self.reads.get() + 1);
+        self.doc.get_object(id)
+    }
+    fn encrypted(&self) -> bool {
+        false
+    }
+}
+
+/// One comment referenced many times, or a page-shared `/Annots` array, is listed once, and many
+/// small comments sharing one large `/Contents` string stop at the retained-bytes budget.
+#[test]
+fn repeated_annotations_are_listed_once_within_a_byte_budget() {
+    let small = "<< /Subtype /Text /Rect [0 0 1 1] /Contents 7 0 R >> ".repeat(1200);
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 5 0 R >> endobj\n\
+             4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 5 0 R >> endobj\n\
+             5 0 obj [{} {small}] endobj\n\
+             6 0 obj << /Type /Annot /Subtype /Text /Rect [0 0 1 1] /Contents (note) >> endobj\n\
+             7 0 obj ({}) endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+        "6 0 R ".repeat(1000),
+        "x".repeat(64 << 10),
+    );
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    let mut info = DocInfo { pages: vec![page.clone(), page], ..Default::default() };
+    Inspector::new(&doc).fill(&mut info);
+    let notes = &info.annotations;
+    assert_eq!(notes.iter().filter(|a| a.contents.as_deref() == Some("note")).count(), 1);
+    assert!(notes.iter().all(|a| a.page == 0), "the shared array is the first page's");
+    assert!(notes.len() > 1);
+    assert!(notes.iter().map(retained).sum::<usize>() <= MAX_ANNOTATION_BYTES);
+}
+
+/// A link reached through an indirect object that holds only a reference to it is the same
+/// annotation as the link itself, and so is a page array reached the same way: each is listed once.
+#[test]
+fn an_annotation_reached_through_a_reference_chain_is_listed_once() {
+    let pdf = "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 7 0 R >> endobj\n\
+             4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 8 0 R >> endobj\n\
+             5 0 obj 6 0 R endobj\n\
+             6 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 1 1] /A << /S /URI /URI (https://example.com) >> >> endobj\n\
+             7 0 obj [5 0 R 6 0 R] endobj\n\
+             8 0 obj 7 0 R endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF";
+    let mut doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let mut saved = Vec::new();
+    doc.save_to(&mut saved).expect("saves");
+    let lazy = LazyStructure::new(Arc::new(saved), None).expect("opens");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    for reader in [&doc as &dyn Structure, &lazy] {
+        let mut info = DocInfo { pages: vec![page.clone(), page.clone()], ..Default::default() };
+        Inspector::new(reader).fill(&mut info);
+        assert_eq!(info.links.len(), 1, "{:?}", info.links);
+    }
+}
+
+/// A reply finds its comment where the listing keeps it: on the first page of a page-shared
+/// `/Annots` array, whether its `/IRT` names the comment or an object holding a reference to it.
+#[test]
+fn a_reply_finds_its_comment_through_a_reference_chain_and_a_shared_array() {
+    let pdf = "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 7 0 R >> endobj\n\
+             4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots 7 0 R >> endobj\n\
+             5 0 obj 6 0 R endobj\n\
+             6 0 obj << /Type /Annot /Subtype /Text /Rect [0 0 1 1] /Contents (comment) >> endobj\n\
+             7 0 obj [5 0 R 8 0 R 9 0 R] endobj\n\
+             8 0 obj << /Type /Annot /Subtype /Text /Rect [0 0 1 1] /Contents (to the comment) /IRT 6 0 R >> endobj\n\
+             9 0 obj << /Type /Annot /Subtype /Text /Rect [0 0 1 1] /Contents (through the chain) /IRT 5 0 R >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF";
+    let mut doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let mut saved = Vec::new();
+    doc.save_to(&mut saved).expect("saves");
+    let lazy = LazyStructure::new(Arc::new(saved), None).expect("opens");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    for reader in [&doc as &dyn Structure, &lazy] {
+        let mut info = DocInfo { pages: vec![page.clone(), page.clone()], ..Default::default() };
+        Inspector::new(reader).fill(&mut info);
+        let notes = &info.annotations;
+        assert_eq!(notes.len(), 3, "{notes:?}");
+        let comment = notes.iter().find(|a| a.contents.as_deref() == Some("comment")).expect("listed");
+        assert_eq!((comment.page, comment.index, comment.is_reply()), (0, 0, false));
+        for reply in ["to the comment", "through the chain"] {
+            let a = notes.iter().find(|a| a.contents.as_deref() == Some(reply)).expect("listed");
+            assert_eq!((a.page, a.parent), (0, Some((0, 0))), "{reply}");
+        }
+    }
+}
+
+/// A conversion rejected as too long, or trimmed short or to nothing, still spends the raw
+/// length, so a string many entries share is converted only a few times.
+#[test]
+fn rejected_text_conversions_spend_the_budget() {
+    let mut budget = 10;
+    let mut conversions = 0;
+    for _ in 0..10 {
+        // Each 0xFF becomes the three-byte replacement character.
+        let kept = spend(&[0xFF; 5], &mut budget, |b| {
+            conversions += 1;
+            String::from_utf8_lossy(b).into_owned()
+        });
+        assert_eq!(kept, None);
+    }
+    assert_eq!((conversions, budget), (2, 0));
+
+    let pdf = "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [] /Count 0 >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF";
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let d = Dictionary::from_iter([("Contents", Object::string_literal("   "))]);
+    let mut budget = 10;
+    assert_eq!(Inspector::new(&doc).budgeted_text(&d, b"Contents", &mut budget), None);
+    assert_eq!(budget, 7);
+    // Text that trims short spends its raw length.
+    let d = Dictionary::from_iter([("Contents", Object::string_literal("      x"))]);
+    let mut budget = 10;
+    assert_eq!(Inspector::new(&doc).budgeted_text(&d, b"Contents", &mut budget).as_deref(), Some("x"));
+    assert_eq!(budget, 3);
+}
+
+/// An annotation attachment's `/Contents` spends the text budget only when it names the
+/// attachment, so long descriptions of named files leave a later web address listed.
+#[test]
+fn a_named_attachment_leaves_its_contents_unspent() {
+    let files = "<< /Subtype /FileAttachment /Rect [0 0 1 1] /Contents 6 0 R /FS << /F (a.txt) >> >> ".repeat(20);
+    // Longer than what 20 MiB of charged `/Contents` would leave of the 16 MiB budget.
+    let uri = format!("https://example.com/{}", "a".repeat(2 << 20));
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{files} \
+             << /Subtype /Link /Rect [0 0 1 1] /A << /S /URI /URI ({uri}) >> >>] >> endobj\n\
+             6 0 obj ({}) endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        "x".repeat(1 << 20),
+    );
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    let mut info = DocInfo { pages: vec![page], ..Default::default() };
+    Inspector::new(&doc).fill(&mut info);
+    assert!(info.attachments.iter().all(|a| a.name == "a.txt"));
+    assert_eq!(info.links.len(), 1);
+    assert!(matches!(&info.links[0].target, LinkTarget::Uri(u) if *u == uri));
+}
+
+/// Embedded files whose name-tree keys share one long string keep it, as key and as name, only
+/// within `MAX_LINK_ATTACHMENT_TEXT_BYTES`.
+#[test]
+fn embedded_file_keys_sharing_a_long_string_keep_it_within_a_budget() {
+    let entries = "4 0 R << /Type /Filespec >> ".repeat(20);
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [{entries}] >> >> >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [] /Count 0 >> endobj\n\
+             4 0 obj ({}) endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        "x".repeat(1 << 20),
+    );
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let mut info = DocInfo::default();
+    Inspector::new(&doc).fill(&mut info);
+    let kept: usize =
+        info.attachments.iter().map(|a| a.name.len() + if let AttachmentSource::Document { key } = &a.source { key.len() } else { 0 }).sum();
+    assert!(!info.attachments.is_empty());
+    // Past the budget an attachment still has the generic name.
+    let generic = info.attachments.len() * "attachment".len();
+    assert!(kept <= MAX_LINK_ATTACHMENT_TEXT_BYTES + generic, "{kept} bytes kept");
+}
+
+/// An embedded file the listing keeps is extracted, though earlier keys the listing could not
+/// keep would fill a fresh key budget before it.
+#[test]
+fn a_listed_embedded_file_is_extracted_past_keys_the_listing_left_out() {
+    let skipped = "6 0 R 7 0 R ".repeat(9);
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [{skipped}(b.txt) 9 0 R] >> >> >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [\
+             << /Subtype /Link /Rect [0 0 1 1] /A << /S /URI /URI ({}) >> >>] >> endobj\n\
+             6 0 obj ({}) endobj\n\
+             7 0 obj << /Type /Filespec /F (a.txt) >> endobj\n\
+             8 0 obj << /Type /EmbeddedFile /Length 5 >> stream\nhello\nendstream endobj\n\
+             9 0 obj << /Type /Filespec /F (b.txt) /EF << /F 8 0 R >> >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        "u".repeat(15 << 20),
+        "k".repeat(2 << 20),
+    );
+    let bytes = Arc::new(pdf.into_bytes());
+    let info = inspect(bytes.clone(), None).expect("opens");
+    let listed = info.attachments.iter().find(|a| a.name == "b.txt").expect("b.txt is listed");
+    assert_eq!(attachment_data(&bytes, None, listed).as_deref(), Ok(&b"hello"[..]));
+}
+
+/// Links and attachments sharing one long string each keep a copy only within
+/// `MAX_LINK_ATTACHMENT_TEXT_BYTES`, and every one is still listed.
+#[test]
+fn links_and_attachments_sharing_a_long_string_keep_it_within_a_budget() {
+    const EACH: usize = 20;
+    let links = "<< /Subtype /Link /Rect [0 0 1 1] /A 5 0 R >> ".repeat(EACH);
+    let files = "<< /Subtype /FileAttachment /Rect [0 0 1 1] /FS 7 0 R >> ".repeat(EACH);
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{links} {files}] >> endobj\n\
+             5 0 obj << /S /URI /URI 6 0 R >> endobj\n\
+             6 0 obj ({}) endobj\n\
+             7 0 obj << /Type /Filespec /F (a.txt) /Desc 6 0 R >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        "x".repeat(1 << 20),
+    );
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    let mut info = DocInfo { pages: vec![page], ..Default::default() };
+    Inspector::new(&doc).fill(&mut info);
+    assert_eq!(info.links.len(), EACH);
+    assert_eq!(info.attachments.len(), EACH);
+    let uris = info.links.iter().map(|l| if let LinkTarget::Uri(u) = &l.target { u.len() } else { 0 });
+    let descriptions = info.attachments.iter().map(|a| a.description.as_ref().map_or(0, String::len));
+    let kept: usize = uris.chain(descriptions).sum();
+    assert!(kept > 0 && kept <= MAX_LINK_ATTACHMENT_TEXT_BYTES, "{kept} bytes kept");
+    assert!(info.links.iter().any(|l| matches!(&l.target, LinkTarget::Other(s) if s == "URI")));
+}
+
+/// Links and attachments after the comment budget fills are still listed, and a JavaScript link
+/// among them still marks the document.
+#[test]
+fn links_and_attachments_past_the_comment_budget_are_listed() {
+    let small = "<< /Subtype /Text /Rect [0 0 1 1] /Contents 6 0 R >> ".repeat(1100);
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{small} \
+             << /Subtype /Link /Rect [0 0 1 1] /A << /S /JavaScript /JS (1) >> >>] >> endobj\n\
+             4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [\
+             << /Subtype /FileAttachment /Rect [0 0 1 1] /FS << /Type /Filespec /F (a.txt) >> >>] >> endobj\n\
+             6 0 obj ({}) endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+        "x".repeat(64 << 10),
+    );
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let page = PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() };
+    let mut info = DocInfo { pages: vec![page.clone(), page], ..Default::default() };
+    Inspector::new(&doc).fill(&mut info);
+    assert!(info.annotations.len() < 1100, "the comment budget filled");
+    assert_eq!(info.links.len(), 1);
+    assert!(info.has_javascript);
+    assert_eq!(info.attachments.len(), 1);
+}
+
+/// Widgets without `/P` are placed on the page that lists them with one pass over the pages'
+/// `/Annots`, not a search of every page per field: that was O(fields × annotations), a
+/// second to open a form of 8,000 fields. A widget two pages list is on the first of them.
+#[test]
+fn widgets_without_a_page_entry_are_placed_in_one_pass() {
+    const PAGES: usize = 100;
+    const PER_PAGE: usize = 10;
+    let field = |p: usize, k: usize| 4 + PAGES + p * PER_PAGE + k;
+    let mut pdf = String::from("%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm 3 0 R >> endobj\n");
+    let kids: Vec<String> = (0..PAGES).map(|p| format!("{} 0 R", 4 + p)).collect();
+    pdf += &format!("2 0 obj << /Type /Pages /Kids [{}] /Count {PAGES} >> endobj\n", kids.join(" "));
+    let fields: Vec<String> = (0..PAGES).flat_map(|p| (0..PER_PAGE).map(move |k| format!("{} 0 R", field(p, k)))).collect();
+    pdf += &format!("3 0 obj << /Fields [{}] >> endobj\n", fields.join(" "));
+    for p in 0..PAGES {
+        let mut annots: Vec<String> = (0..PER_PAGE).map(|k| format!("{} 0 R", field(p, k))).collect();
+        // The last page lists the first page's first widget too.
+        if p == PAGES - 1 {
+            annots.push(format!("{} 0 R", field(0, 0)));
+        }
+        pdf += &format!("{} 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{}] >> endobj\n", 4 + p, annots.join(" "));
+    }
+    for p in 0..PAGES {
+        for k in 0..PER_PAGE {
+            pdf += &format!("{} 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (f{p}_{k}) /Rect [10 10 90 30] >> endobj\n", field(p, k));
+        }
+    }
+    pdf += "trailer << /Root 1 0 R >>\n%%EOF";
+    let doc = Document::load_mem(pdf.as_bytes()).expect("loads");
+    let counting = CountingReads { doc: &doc, reads: std::cell::Cell::new(0) };
+    let mut info = DocInfo {
+        pages: (0..PAGES)
+            .map(|_| PageInfo { width: 200.0, height: 200.0, crop: [0.0, 0.0, 200.0, 200.0], rotation: 0, label: String::new() })
+            .collect(),
+        ..Default::default()
+    };
+    Inspector::new(&counting).fill(&mut info);
+    let placed: Vec<_> = info.fields.iter().map(|f| (f.name.clone(), f.page)).collect();
+    let want: Vec<_> = (0..PAGES).flat_map(|p| (0..PER_PAGE).map(move |k| (format!("f{p}_{k}"), Some(p)))).collect();
+    assert_eq!(placed, want);
+    // A handful of reads per page and field; searching the pages for each field read the
+    // page dictionaries about 50,000 times.
+    let reads = counting.reads.get();
+    assert!(reads < 20 * (PAGES + PAGES * PER_PAGE), "{reads} object reads");
+}
+
+/// #2365: the issue's fixture is two PDFs concatenated, the second cut off before its
+/// cross-reference data, and the first's only trailer is a cross-reference stream. The
+/// lazy reader refuses a file that needed repair, and lopdf's rebuild found no `trailer`
+/// keyword and failed, so Document Properties showed every field empty. The rebuild now
+/// takes the cross-reference stream's dictionary as the trailer.
+#[test]
+fn rebuilt_file_keeps_the_info_of_its_cross_reference_stream() {
+    let header = "%PDF-1.5\n";
+    let obj1 = "1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\n";
+    let obj2 = "2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>>endobj\n";
+    let obj3 = "3 0 obj<</Type/Page/Parent 2 0 R/MediaBox[0 0 10 10]>>endobj\n";
+    let obj4 = "4 0 obj<</Title(Kept)/Creator(Me)>>endobj\n";
+    let o1 = header.len();
+    let o2 = o1 + obj1.len();
+    let o3 = o2 + obj2.len();
+    let o4 = o3 + obj3.len();
+    let o5 = o4 + obj4.len();
+    let rows: Vec<u8> =
+        [[0u8, 0, 0, 255], [1, 0, o1 as u8, 0], [1, 0, o2 as u8, 0], [1, 0, o3 as u8, 0], [1, 0, o4 as u8, 0], [1, (o5 >> 8) as u8, o5 as u8, 0]]
+            .concat();
+    let mut bytes = format!("{header}{obj1}{obj2}{obj3}{obj4}").into_bytes();
+    bytes.extend_from_slice(format!("5 0 obj<</Type/XRef/Root 1 0 R/Info 4 0 R/Size 6/W[1 2 1]/Length {}>>stream\n", rows.len()).as_bytes());
+    bytes.extend_from_slice(&rows);
+    // A wrong startxref, and a second file after %%EOF: every reader rebuilds the table.
+    bytes.extend_from_slice(b"\nendstream\nendobj\nstartxref\n999999\n%%EOF\n%PDF-1.3\n");
+    bytes.extend_from_slice(&[b'x'; 1024]);
+
+    let info = inspect(Arc::new(bytes), None).unwrap();
+    assert_eq!(info.pages.len(), 1);
+    assert_eq!(info.title.as_deref(), Some("Kept"));
+    assert_eq!(info.creator.as_deref(), Some("Me"));
+}
+
+/// #2365 review: the rebuild prefers a trailer whose /Root is the catalog. A later
+/// cross-reference stream whose /Root points at the Info dictionary used to replace the
+/// earlier `trailer`, so Document Properties lost the catalog it should have read.
+#[test]
+fn rebuilt_file_prefers_a_trailer_whose_root_is_the_catalog() {
+    let mut bytes = b"%PDF-1.5\n".to_vec();
+    for body in [
+        "<</Type/Catalog/Pages 2 0 R>>",
+        "<</Type/Pages/Kids[3 0 R]/Count 1>>",
+        "<</Type/Page/Parent 2 0 R/MediaBox[0 0 10 10]>>",
+        "<</Title(Kept)/Creator(Me)>>",
+    ] {
+        let n = bytes.iter().filter(|b| **b == b'\n').count();
+        bytes.extend_from_slice(format!("{n} 0 obj{body}endobj\n").as_bytes());
+    }
+    bytes.extend_from_slice(b"trailer\n<</Size 5/Root 1 0 R/Info 4 0 R>>\n");
+    bytes.extend_from_slice(b"5 0 obj<</Type/XRef/Root 4 0 R/Size 6/W[1 2 1]/Length 4>>stream\n\x01\x00\x09\x00\nendstream\nendobj\n");
+    // A wrong startxref, and a second file after %%EOF: every reader rebuilds the table.
+    bytes.extend_from_slice(b"startxref\n999999\n%%EOF\n%PDF-1.3\n");
+    bytes.extend_from_slice(&[b'x'; 1024]);
+
+    let info = inspect(Arc::new(bytes.clone()), None).unwrap();
+    assert_eq!(info.pages.len(), 1);
+    assert_eq!(info.title.as_deref(), Some("Kept"));
+    // A later stream whose /Root names the catalog's number with another generation does
+    // not count either: loading `1 1 R` finds no such object.
+    let at = bytes.windows(10).position(|w| w == b"/Root 4 0 ").unwrap();
+    bytes[at..at + 10].copy_from_slice(b"/Root 1 1 ");
+    let info = inspect(Arc::new(bytes), None).unwrap();
+    assert_eq!((info.pages.len(), info.title.as_deref()), (1, Some("Kept")));
+}
+
+#[test]
+fn lazy_structure_matches_the_compatibility_inspector() {
+    // Each fixture as lopdf writes it, and with its objects in object streams.
+    let packed = |bytes: &[u8]| {
+        let doc = pdfcraft_cos::Document::open(Arc::new(bytes.to_vec())).unwrap();
+        pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions { object_streams: true, ..Default::default() }).unwrap()
+    };
+    let fixtures = [ATTACHMENTS, LAYERS, DESTS].into_iter().flat_map(|bytes| {
+        let mut original = Document::load_mem(bytes).unwrap();
+        let mut plain = Vec::new();
+        original.save_to(&mut plain).unwrap();
+        let stm = packed(&plain);
+        [plain, stm]
+    });
+    for bytes in fixtures {
+        let lazy = LazyStructure::new(Arc::new(bytes.clone()), None).unwrap();
+        let eager = Document::load_mem(&bytes).unwrap();
+        let mut a = inspect(Arc::new(bytes), None).unwrap();
+        let mut b = DocInfo { pages: a.pages.clone(), ..Default::default() };
+        let mut c = DocInfo { pages: a.pages.clone(), ..Default::default() };
+        Inspector::new(&lazy).fill(&mut b);
+        Inspector::new(&eager).fill(&mut c);
+        assert!(!lazy.failed());
+        assert_eq!(format!("{b:?}"), format!("{c:?}"));
+        a.file_size = 0;
+        a.pdf_version.clear();
+        assert_eq!(format!("{a:?}"), format!("{c:?}"));
+    }
+}
+
+#[test]
+fn links_read_set_layer_actions() {
+    let info = inspect(Arc::new(LAYERS.to_vec()), None).expect("opens");
+    let targets: Vec<_> = info.links.iter().map(|l| l.target.clone()).collect();
+    use LayerOp::{Off, On, Toggle};
+    assert_eq!(
+        targets,
+        [
+            // Groups before the first name or after an unknown one are skipped, and so is
+            // anything that isn't a group.
+            LinkTarget::SetLayers { changes: vec![(On, (6, 0)), (Toggle, (5, 0)), (Toggle, (7, 0))], preserve_rb: false },
+            // An indirect /State; /PreserveRB defaults to true.
+            LinkTarget::SetLayers { changes: vec![(Off, (5, 0))], preserve_rb: true },
+        ]
+    );
+}
+
+/// #4168: a Launch action naming a `.pdf` file is read as the link to that file it amounts
+/// to, `\` separators included, and a stray `/D` (which Launch has no use for) doesn't stop
+/// it. One naming anything else, with no file, or with `/Win` launch parameters stays an
+/// action that isn't followed.
+#[test]
+fn launch_actions_that_name_a_pdf_open_it_like_a_remote_link() {
+    let pdf = "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /Annots [30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R] >> endobj\n\
+             30 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 10 10] /A << /S /Launch /F (..\\\\se\\\\se_ST.pdf) >> >> endobj\n\
+             31 0 obj << /Type /Annot /Subtype /Link /Rect [0 20 10 30] /A << /S /Launch /F << /Type /Filespec /F (chapters/Two.PDF) >> /NewWindow true >> >> endobj\n\
+             32 0 obj << /Type /Annot /Subtype /Link /Rect [0 40 10 50] /A << /S /Launch /F (tool.exe) >> >> endobj\n\
+             33 0 obj << /Type /Annot /Subtype /Link /Rect [0 60 10 70] /A << /S /Launch /F (a.pdf) /Win << /F (cmd.exe) /P (/c x) >> >> >> endobj\n\
+             34 0 obj << /Type /Annot /Subtype /Link /Rect [0 80 10 90] /A << /S /Launch /Win << /F (b.pdf) >> >> >> endobj\n\
+             35 0 obj << /Type /Annot /Subtype /Link /Rect [0 100 10 110] /A << /S /Launch /F (.pdf) >> >> endobj\n\
+             36 0 obj << /Type /Annot /Subtype /Link /Rect [0 120 10 130] /A << /S /Launch /F (dir/a\\\\b.pdf) >> >> endobj\n\
+             37 0 obj << /Type /Annot /Subtype /Link /Rect [0 140 10 150] /A << /S /Launch /FS /URL /F (https://example.com/x.pdf) >> >> endobj\n\
+             38 0 obj << /Type /Annot /Subtype /Link /Rect [0 160 10 170] /A << /S /Launch /F (c.pdf) /D 0 >> >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF";
+    let info = inspect(Arc::new(pdf.as_bytes().to_vec()), None).expect("opens");
+    let targets: Vec<_> = info.links.iter().map(|l| l.target.clone()).collect();
+    let launch =
+        |file: &str, new_window| LinkTarget::RemoteGoTo { launch: true, file: file.into(), destination: RemoteDestination::Default, new_window };
+    let other = || LinkTarget::Other("Launch".into());
+    assert_eq!(
+        targets,
+        [
+            launch("../se/se_ST.pdf", None),
+            launch("chapters/Two.PDF", Some(true)),
+            other(),
+            other(),
+            other(),
+            other(),
+            launch("dir/a\\b.pdf", None),
+            other(),
+            launch("c.pdf", None),
+        ]
+    );
+}
+
+#[test]
+fn links_read_bounded_local_remote_go_to_actions() {
+    use DestView::{Fit, Xyz};
+    let too_long = "a".repeat(MAX_REMOTE_FILE_SPEC_BYTES + 1);
+    let wide_file = format!("<FEFF{}>", "4E00".repeat(1400));
+    let wide_name = format!("<FEFF{}>", "4E00".repeat(342));
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /Annots [99 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R] >> endobj\n\
+             30 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 10 10] /A << /S /GoToR /F (chapters/remote.pdf) /D [2 /XYZ 10 20 1.5] /NewWindow true >> >> endobj\n\
+             31 0 obj << /Type /Annot /Subtype /Link /Rect [0 20 10 30] /A << /S /GoToR /F << /Type /Filespec /F (fallback.pdf) /UF <FEFF0066006F006F002E007000640066> >> /D [0 /Fit] /NewWindow false >> >> endobj\n\
+             32 0 obj << /Type /Annot /Subtype /Link /Rect [0 40 10 50] /A << /S /GoToR /F (remote.pdf) >> >> endobj\n\
+             33 0 obj << /Type /Annot /Subtype /Link /Rect [0 60 10 70] /A << /S /GoToR /F (chapter.pdf) /D (chapter) >> >> endobj\n\
+             34 0 obj << /Type /Annot /Subtype /Link /Rect [0 80 10 90] /A << /S /GoToR /FS /URL /F (https://example.com) /D [0 /Fit] >> >> endobj\n\
+             35 0 obj << /Type /Annot /Subtype /Link /Rect [0 100 10 110] /A << /S /GoToR /F ({too_long}) /D [0 /Fit] >> >> endobj\n\
+             36 0 obj << /Type /Annot /Subtype /Link /Rect [0 120 10 130] /A << /S /GoToR /F (chapter.pdf) /D /chapter >> >> endobj\n\
+             37 0 obj << /Type /Annot /Subtype /Link /Rect [0 140 10 150] /A << /S /GoToR /F (chapter.pdf) /D [-1 /Fit] >> >> endobj\n\
+             38 0 obj << /Type /Annot /Subtype /Link /Rect [0 160 10 170] /A << /S /GoToR /F (chapter.pdf) /D [1.5 /Fit] >> >> endobj\n\
+             39 0 obj << /Type /Annot /Subtype /Link /Rect [0 180 10 190] /A << /S /GoToR /F (chapter.pdf) /D [9223372036854775807 /Fit] >> >> endobj\n\
+             40 0 obj << /Type /Annot /Subtype /Link /Rect [0 200 10 210] /A << /S /GoToR /F << /Type /Filespec /UF {wide_file} >> /D [0 /Fit] >> >> endobj\n\
+             41 0 obj << /Type /Annot /Subtype /Link /Rect [0 220 10 230] /A << /S /GoToR /F (chapter.pdf) /D {wide_name} >> >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF"
+    );
+    let info = inspect(Arc::new(pdf.into_bytes()), None).expect("opens");
+    let targets: Vec<_> = info.links.iter().map(|l| (l.index, l.target.clone())).collect();
+    let huge_page_target = usize::try_from(i64::MAX)
+        .map(|page| LinkTarget::RemoteGoTo {
+            launch: false,
+            file: "chapter.pdf".into(),
+            destination: RemoteDestination::Page { page, view: Fit },
+            new_window: None,
+        })
+        .unwrap_or_else(|_| LinkTarget::Other("GoToR".into()));
+    assert_eq!(
+        targets,
+        [
+            (
+                1,
+                LinkTarget::RemoteGoTo {
+                    launch: false,
+                    file: "chapters/remote.pdf".into(),
+                    destination: RemoteDestination::Page { page: 2, view: Xyz { left: Some(10.0), top: Some(20.0), zoom: Some(1.5) } },
+                    new_window: Some(true),
+                }
+            ),
+            (
+                2,
+                LinkTarget::RemoteGoTo {
+                    launch: false,
+                    file: "foo.pdf".into(),
+                    destination: RemoteDestination::Page { page: 0, view: Fit },
+                    new_window: Some(false),
+                }
+            ),
+            (3, LinkTarget::RemoteGoTo { launch: false, file: "remote.pdf".into(), destination: RemoteDestination::Default, new_window: None }),
+            (
+                4,
+                LinkTarget::RemoteGoTo {
+                    launch: false,
+                    file: "chapter.pdf".into(),
+                    destination: RemoteDestination::Named("chapter".into()),
+                    new_window: None
+                }
+            ),
+            (5, LinkTarget::Other("GoToR".into())),
+            (6, LinkTarget::Other("GoToR".into())),
+            (
+                7,
+                LinkTarget::RemoteGoTo {
+                    launch: false,
+                    file: "chapter.pdf".into(),
+                    destination: RemoteDestination::Named("chapter".into()),
+                    new_window: None
+                }
+            ),
+            (8, LinkTarget::Other("GoToR".into())),
+            (9, LinkTarget::Other("GoToR".into())),
+            (10, huge_page_target),
+            (11, LinkTarget::Other("GoToR".into())),
+            (12, LinkTarget::Other("GoToR".into())),
+        ]
+    );
+}
+
+#[test]
+fn destination_operands_become_views() {
+    use DestView::*;
+    let v = |kind: &[u8], ops: &[Option<f32>]| DestView::from_operands(Some(kind), ops);
+    // ISO 32000-2 Table 149, each type.
+    assert_eq!(v(b"XYZ", &[Some(0.0), Some(420.0), Some(0.0)]), Xyz { left: Some(0.0), top: Some(420.0), zoom: None });
+    assert_eq!(v(b"XYZ", &[Some(72.0), Some(500.0), Some(1.5)]), Xyz { left: Some(72.0), top: Some(500.0), zoom: Some(1.5) });
+    assert_eq!(v(b"Fit", &[]), Fit);
+    assert_eq!(v(b"FitB", &[]), Fit);
+    assert_eq!(v(b"FitH", &[Some(250.0)]), FitH { top: Some(250.0) });
+    assert_eq!(v(b"FitBH", &[None]), FitH { top: None });
+    assert_eq!(v(b"FitV", &[Some(120.0)]), FitV { left: Some(120.0) });
+    assert_eq!(v(b"FitBV", &[Some(5.0)]), FitV { left: Some(5.0) });
+    // FitR's corners are normalized.
+    assert_eq!(v(b"FitR", &[Some(110.0), Some(220.0), Some(10.0), Some(20.0)]), FitR { rect: [10.0, 20.0, 110.0, 220.0] });
+    // Missing operands are null; so are non-finite ones, and a zoom that isn't positive.
+    assert_eq!(v(b"XYZ", &[]), Xyz { left: None, top: None, zoom: None });
+    assert_eq!(v(b"XYZ", &[Some(f32::NAN), Some(f32::INFINITY), Some(f32::NEG_INFINITY)]), Xyz { left: None, top: None, zoom: None });
+    assert_eq!(v(b"XYZ", &[None, Some(-5.0), Some(-1.0)]), Xyz { left: None, top: Some(-5.0), zoom: None });
+    assert_eq!(v(b"XYZ", &[None, None, Some(f32::NAN)]), Xyz { left: None, top: None, zoom: None });
+    assert_eq!(v(b"FitH", &[Some(f32::NAN)]), FitH { top: None });
+    // A FitR without four usable numbers, an unknown type or no type: the top of the page.
+    assert_eq!(v(b"FitR", &[Some(1.0), Some(2.0)]), Top);
+    assert_eq!(v(b"FitR", &[Some(1.0), Some(2.0), Some(f32::INFINITY), Some(4.0)]), Top);
+    assert_eq!(v(b"Zoom", &[Some(3.0)]), Top);
+    assert_eq!(v(b"xyz", &[Some(3.0)]), Top);
+    assert_eq!(DestView::from_operands(None, &[Some(1.0)]), Top);
+}
+
+/// Two 300×400 pages. Bookmarks and links on page 1 go to page 2 in every destination form,
+/// named (`/Names /Dests` and the PDF 1.1 `/Dests`) and malformed.
+const DESTS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /Outlines 10 0 R /Names << /Dests 40 0 R >> /Dests << /old << /D [4 0 R /FitV 120] >> >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Annots [30 0 R 31 0 R 32 0 R 33 0 R] >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R >> endobj
+10 0 obj << /Type /Outlines /First 11 0 R /Last 20 0 R /Count 10 >> endobj
+11 0 obj << /Title (xyz) /Parent 10 0 R /Next 12 0 R /Dest [4 0 R /XYZ 0 420 0] >> endobj
+12 0 obj << /Title (fith) /Parent 10 0 R /Next 13 0 R /Dest [4 0 R /FitH 250] >> endobj
+13 0 obj << /Title (named) /Parent 10 0 R /Next 14 0 R /Dest (sec) >> endobj
+14 0 obj << /Title (old named) /Parent 10 0 R /Next 15 0 R /Dest /old >> endobj
+15 0 obj << /Title (action) /Parent 10 0 R /Next 16 0 R /A << /S /GoTo /D [4 0 R /FitR 110 220 10 20] >> >> endobj
+16 0 obj << /Title (wrong types) /Parent 10 0 R /Next 17 0 R /Dest [4 0 R /XYZ (left) /Top true] >> endobj
+17 0 obj << /Title (short) /Parent 10 0 R /Next 18 0 R /Dest [4 0 R /FitR 1 2] >> endobj
+18 0 obj << /Title (no type) /Parent 10 0 R /Next 19 0 R /Dest [4 0 R] >> endobj
+19 0 obj << /Title (huge) /Parent 10 0 R /Next 20 0 R /Dest [4 0 R /XYZ 1000000000000 -5 -1] >> endobj
+20 0 obj << /Title (no page) /Parent 10 0 R /Dest [/XYZ 0 420 0] >> endobj
+30 0 obj << /Type /Annot /Subtype /Link /Rect [0 0 10 10] /Dest [4 0 R /XYZ 72 500 1.5] >> endobj
+31 0 obj << /Type /Annot /Subtype /Link /Rect [0 20 10 30] /A << /S /GoTo /D (sec) >> >> endobj
+32 0 obj << /Type /Annot /Subtype /Link /Rect [0 40 10 50] /Dest [4 0 R /FitBH 100] >> endobj
+33 0 obj << /Type /Annot /Subtype /Link /Rect [0 60 10 70] /Dest [4 0 R /Fit] >> endobj
+40 0 obj << /Names [(sec) << /D [4 0 R /XYZ null 300 2] >>] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+#[test]
+fn bookmarks_and_links_keep_their_destination_view() {
+    use DestView::*;
+    let info = inspect(Arc::new(DESTS.to_vec()), None).expect("opens");
+    let outline: Vec<_> = info.outline.iter().map(|o| (o.title.as_str(), o.page, o.view)).collect();
+    assert_eq!(
+        outline,
+        [
+            ("xyz", Some(1), Xyz { left: Some(0.0), top: Some(420.0), zoom: None }),
+            ("fith", Some(1), FitH { top: Some(250.0) }),
+            ("named", Some(1), Xyz { left: None, top: Some(300.0), zoom: Some(2.0) }),
+            ("old named", Some(1), FitV { left: Some(120.0) }),
+            ("action", Some(1), FitR { rect: [10.0, 20.0, 110.0, 220.0] }),
+            // Hostile operands fall back without failing the bookmark.
+            ("wrong types", Some(1), Xyz { left: None, top: None, zoom: None }),
+            ("short", Some(1), Top),
+            ("no type", Some(1), Top),
+            ("huge", Some(1), Xyz { left: Some(1e12), top: Some(-5.0), zoom: None }),
+            ("no page", None, Top),
+        ]
+    );
+    let links: Vec<_> = info.links.iter().map(|l| l.target.clone()).collect();
+    assert_eq!(
+        links,
+        [
+            LinkTarget::Page(1, Xyz { left: Some(72.0), top: Some(500.0), zoom: Some(1.5) }),
+            LinkTarget::Page(1, Xyz { left: None, top: Some(300.0), zoom: Some(2.0) }),
+            LinkTarget::Page(1, FitH { top: Some(100.0) }),
+            LinkTarget::Page(1, Fit),
+        ]
+    );
+}
+
+#[test]
+fn outline_titles_decode_every_text_string_encoding() {
+    // Issue #142: CJK bookmark titles showed as mojibake or with a stray BOM.
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /Outlines 10 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R >> endobj
+10 0 obj << /Type /Outlines /First 11 0 R /Last 16 0 R /Count 6 >> endobj
+11 0 obj << /Title <FEFF7B2C4E007AE0> /Parent 10 0 R /Next 12 0 R /Dest [3 0 R /Fit] >> endobj
+12 0 obj << /Title <EFBBBFE79BAEE5BD95> /Parent 10 0 R /Next 13 0 R /Dest [3 0 R /Fit] >> endobj
+13 0 obj << /Title <EFBBBF41FF42> /Parent 10 0 R /Next 14 0 R /Dest [3 0 R /Fit] >> endobj
+14 0 obj << /Title <E6A682E8BFB0> /Parent 10 0 R /Next 15 0 R /Dest [3 0 R /Fit] >> endobj
+15 0 obj << /Title <436166E9> /Parent 10 0 R /Next 16 0 R /Dest [3 0 R /Fit] >> endobj
+16 0 obj << /Title <FEFFFEFF0041> /Parent 10 0 R /Dest [3 0 R /Fit] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let info = inspect(Arc::new(pdf.to_vec()), None).expect("opens");
+    let titles: Vec<_> = info.outline.iter().map(|o| o.title.as_str()).collect();
+    // UTF-16BE, UTF-8 with BOM, invalid UTF-8 after a BOM (lossy, not dropped), BOM-less
+    // raw UTF-8, PDFDocEncoding Latin-1, and a doubled BOM.
+    assert_eq!(titles, ["第一章", "目录", "A\u{FFFD}B", "概述", "Café", "A"]);
+}
+
+#[test]
+fn xfa_dynamic_render_is_read_from_config_acrobat7_only() {
+    let text = xfa_config_dynamic_render;
+    let config =
+        |inner: &str| format!("<config xmlns=\"http://www.xfa.org/schema/xci/3.0/\"><acrobat><acrobat7>{inner}</acrobat7></acrobat></config>");
+    // Designer's style: a line break before each `>`.
+    assert_eq!(
+        text("<config\n><acrobat\n><acrobat7\n><dynamicRender\n>forbidden</dynamicRender\n></acrobat7\n></acrobat\n></config\n>").as_deref(),
+        Some("forbidden")
+    );
+    assert_eq!(text(&config("<xci:dynamicRender> required </xci:dynamicRender>")).as_deref(), Some("required"));
+    // Commented out, in CDATA, or a longer name: not the element.
+    assert_eq!(text(&config("<!-- a > b <dynamicRender>forbidden</dynamicRender> -->")), None);
+    assert_eq!(text(&config("<![CDATA[ a > b <dynamicRender>forbidden</dynamicRender> ]]>")), None);
+    assert_eq!(text(&config("<dynamicRenderX>forbidden</dynamicRenderX>")), None);
+    // Self-closing, empty, or holding markup: no value.
+    assert_eq!(text(&config("<dynamicRender/>")), None);
+    assert_eq!(text(&config("<dynamicRender></dynamicRender>")), None);
+    assert_eq!(text(&config("<dynamicRender><b>forbidden</b></dynamicRender>")), None);
+    // Closing tags that don't match what they close: malformed, no value (review on #3192).
+    assert_eq!(text(&config("<dynamicRender>forbidden</other>")), None);
+    assert_eq!(text("<config><acrobat><acrobat7><dynamicRender>forbidden</dynamicRender></acrobat></acrobat7></config>"), None);
+    // The same name anywhere but config/acrobat/acrobat7 (form data, another config branch).
+    let xdp = "<xdp:xdp><xfa:datasets><xfa:data><dynamicRender>forbidden</dynamicRender></xfa:data></xfa:datasets><config><present><dynamicRender>forbidden</dynamicRender></present></config></xdp:xdp>";
+    assert_eq!(text(xdp), None);
+    // A whole XDP with the config after the template.
+    let xdp = format!("<xdp:xdp><template><subform/></template>{}</xdp:xdp>", config("<dynamicRender>forbidden</dynamicRender>"));
+    assert_eq!(text(&xdp).as_deref(), Some("forbidden"));
+    // A whole config path inside the form data, before the real config packet, is data: the
+    // real packet's value counts (review on #3192).
+    let xdp = format!(
+        "<?xml version=\"1.0\"?><xdp:xdp><xfa:datasets><xfa:data>{}</xfa:data></xfa:datasets>{}</xdp:xdp>",
+        config("<dynamicRender>forbidden</dynamicRender>"),
+        config("<dynamicRender>required</dynamicRender>")
+    );
+    assert_eq!(text(&xdp).as_deref(), Some("required"));
+    // Only in the data, or nested in the template: no configuration at all.
+    let xdp = format!("<xdp:xdp><xfa:datasets><xfa:data>{}</xfa:data></xfa:datasets></xdp:xdp>", config("<dynamicRender>forbidden</dynamicRender>"));
+    assert_eq!(text(&xdp), None);
+    let xdp = format!("<xdp:xdp><template>{}</template></xdp:xdp>", config("<dynamicRender>forbidden</dynamicRender>"));
+    assert_eq!(text(&xdp), None);
+    // acrobat7 must be a child of acrobat, not deeper.
+    assert_eq!(text("<config><acrobat><x><acrobat7><dynamicRender>forbidden</dynamicRender></acrobat7></x></acrobat></config>"), None);
+    // Cut short anywhere: no panic, nothing read.
+    let whole = config("<!-- x --><dynamicRender>forbidden</dynamicRender>");
+    for end in 0..whole.len() {
+        assert_eq!(text(&whole[..end]), None, "cut at {end}");
+    }
+    assert_eq!(text(&whole).as_deref(), Some("forbidden"));
+}
+
+#[test]
+fn xfa_config_packets_are_read_in_utf16_too() {
+    let xml = "<config><acrobat><acrobat7><dynamicRender>forbidden</dynamicRender></acrobat7></acrobat></config>";
+    let le: Vec<u8> = xml.encode_utf16().flat_map(u16::to_le_bytes).collect();
+    let be: Vec<u8> = xml.encode_utf16().flat_map(u16::to_be_bytes).collect();
+    for bytes in [
+        le.clone(),
+        be.clone(),
+        [&[0xFF, 0xFE][..], &le].concat(),
+        [&[0xFE, 0xFF][..], &be].concat(),
+        [&[0xEF, 0xBB, 0xBF][..], xml.as_bytes()].concat(),
+    ] {
+        assert_eq!(xfa_packet_text(&bytes), xml);
+    }
+    // An odd byte or a broken surrogate doesn't stop the scan.
+    assert!(xfa_packet_text(&[0xFF, 0xFE, b'<', 0, 0x00, 0xD8, b'x']).starts_with('<'));
+}
+
+/// #3180: an XFA form with no fields was always taken to be dynamic, so its pages were
+/// replaced by a layout on open, even when its configuration says it is a static form.
+#[test]
+fn an_xfa_form_without_fields_is_static_when_its_config_forbids_dynamic_rendering() {
+    let xfa_of = |config: &str, catalog_extra: &str| {
+        let bodies = [
+            format!("<< /Type /Catalog /Pages 2 0 R {catalog_extra} /AcroForm << /Fields [] /XFA [(config) 4 0 R (template) 5 0 R] >> >>"),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".to_string(),
+            "<< /Type /Page /Parent 2 0 R >>".to_string(),
+            format!("<< /Length {} >>\nstream\n{config}\nendstream", config.len()),
+            "<< /Length 11 >>\nstream\n<template/>\nendstream".to_string(),
+        ];
+        inspect(Arc::new(pdf_of(&bodies)), None).expect("opens").xfa
+    };
+    let config = |value: &str| {
+        format!(
+            r#"<config xmlns="http://www.xfa.org/schema/xci/3.0/"><acrobat><acrobat7><dynamicRender>{value}</dynamicRender></acrobat7></acrobat></config>"#
+        )
+    };
+    assert_eq!(xfa_of(&config("forbidden"), ""), Some(Xfa::Static));
+    assert_eq!(xfa_of(&config("required"), ""), Some(Xfa::Dynamic));
+    assert_eq!(xfa_of("<config/>", ""), Some(Xfa::Dynamic), "no field and no word from the config: dynamic, as before");
+    assert_eq!(xfa_of(&config("forbidden"), "/NeedsRendering true"), Some(Xfa::Dynamic), "/NeedsRendering still wins");
+}
+
+/// A file whose objects are `bodies` in order (object 1 first), with a cross-reference table.
+fn pdf_of(bodies: &[String]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, body) in bodies.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", bodies.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", bodies.len() + 1).as_bytes());
+    out
+}
+
+/// A one-page file whose outline is `items` (objects 5, 6, … in order).
+fn outline_file(items: &[String]) -> Vec<u8> {
+    let mut bodies = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Outlines 4 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R >>".to_string(),
+        format!("<< /Type /Outlines /First 5 0 R /Count {} >>", items.len()),
+    ];
+    bodies.extend(items.iter().cloned());
+    pdf_of(&bodies)
+}
+
+/// The titles of `items`, with children in brackets (`Parent[Child]`).
+fn shape(items: &[OutlineItem]) -> Vec<String> {
+    items.iter().map(|o| if o.children.is_empty() { o.title.clone() } else { format!("{}[{}]", o.title, shape(&o.children).join(",")) }).collect()
+}
+
+/// #3193: a bookmark's colour and style (ISO 32000-2 §12.3.3, Tables 151 and 152). `/C` is
+/// three numbers within 0–1 (one outside is kept at the edge); black, the default, and a `/C`
+/// that isn't three numbers read as no colour. `/F` bit 1 is italic, bit 2 bold.
+#[test]
+fn outline_items_carry_their_colour_and_style() {
+    let titles = [
+        ("Plain", ""),
+        ("Red", "/C [1 0 0]"),
+        ("Italic", "/F 1"),
+        ("Bold", "/F 2"),
+        ("Both", "/C [0 0 1] /F 3"),
+        ("Black", "/C [0 0 0]"),
+        ("Bright", "/C [2 -1 0.5]"),
+        ("Short", "/C [1 0]"),
+        ("Long", "/C [1 0 0 0]"),
+        ("Named", "/C [1 /x 0]"),
+        ("Other bits", "/F 4"),
+    ];
+    let n = titles.len();
+    let items: Vec<String> = titles
+        .iter()
+        .enumerate()
+        .map(|(k, (title, extra))| {
+            let prev = if k == 0 { String::new() } else { format!(" /Prev {} 0 R", 4 + k) };
+            let next = if k + 1 == n { String::new() } else { format!(" /Next {} 0 R", 6 + k) };
+            format!("<< /Title ({title}) /Parent 4 0 R{prev}{next} /Dest [3 0 R /Fit] {extra} >>")
+        })
+        .collect();
+    let info = inspect(Arc::new(outline_file(&items)), None).expect("opens");
+    let got: Vec<(&str, Option<[f32; 3]>, bool, bool)> = info.outline.iter().map(|o| (o.title.as_str(), o.color, o.italic, o.bold)).collect();
+    assert_eq!(
+        got,
+        [
+            ("Plain", None, false, false),
+            ("Red", Some([1.0, 0.0, 0.0]), false, false),
+            ("Italic", None, true, false),
+            ("Bold", None, false, true),
+            ("Both", Some([0.0, 0.0, 1.0]), true, true),
+            ("Black", None, false, false),
+            ("Bright", Some([1.0, 0.0, 0.5]), false, false),
+            ("Short", None, false, false),
+            ("Long", None, false, false),
+            ("Named", None, false, false),
+            ("Other bits", None, false, false),
+        ]
+    );
+}
+
+#[test]
+fn outline_window_keeps_the_first_bookmarks_and_says_when_more_follow() {
+    const COUNT: usize = OUTLINE_WINDOW + 5;
+    let items: Vec<String> = (0..COUNT)
+        .map(|k| {
+            let prev = if k == 0 { String::new() } else { format!(" /Prev {} 0 R", 4 + k) };
+            let next = if k + 1 == COUNT { String::new() } else { format!(" /Next {} 0 R", 6 + k) };
+            format!("<< /Title (Item {k}) /Parent 4 0 R{prev}{next} /Dest [3 0 R /Fit] >>")
+        })
+        .collect();
+    let info = inspect(Arc::new(outline_file(&items)), None).expect("opens");
+    assert_eq!(info.outline.len(), OUTLINE_WINDOW);
+    assert_eq!(info.outline.last().map(|o| o.title.as_str()), Some("Item 9999"));
+    assert!(info.outline_more);
+
+    let one = inspect(Arc::new(outline_file(&["<< /Title (Only) /Parent 4 0 R /Dest [3 0 R /Fit] >>".into()])), None).expect("opens");
+    assert_eq!(shape(&one.outline), ["Only"]);
+    assert!(!one.outline_more);
+}
+
+#[test]
+fn outline_window_nests_no_deeper_than_its_depth_limit() {
+    // A chain of 40 bookmarks, each the first child of the one before.
+    let items: Vec<String> = (0..40)
+        .map(|k| {
+            let parent = if k == 0 { 4 } else { 4 + k };
+            let first = if k + 1 == 40 { String::new() } else { format!(" /First {} 0 R", 6 + k) };
+            format!("<< /Title (Deep {k}) /Parent {parent} 0 R{first} /Dest [3 0 R /Fit] >>")
+        })
+        .collect();
+    let info = inspect(Arc::new(outline_file(&items)), None).expect("opens");
+    let mut levels = 0;
+    let mut level = info.outline.first();
+    while let Some(item) = level {
+        levels += 1;
+        level = item.children.first();
+    }
+    assert_eq!(levels, OUTLINE_DEPTH + 1);
+    assert!(info.outline_more);
+}
+
+#[test]
+fn outline_window_ends_cycles_and_broken_links_without_looping() {
+    let listed = |items: &[&str]| {
+        let items: Vec<String> = items.iter().map(|s| s.to_string()).collect();
+        shape(&inspect(Arc::new(outline_file(&items)), None).expect("opens").outline)
+    };
+    assert_eq!(listed(&["<< /Title (Self) /Parent 4 0 R /Next 5 0 R >>"]), ["Self"]);
+    assert_eq!(listed(&["<< /Title (Self) /Parent 4 0 R /First 5 0 R >>"]), ["Self"]);
+    assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 6 0 R >>", "<< /Title (B) /Parent 4 0 R /Next 5 0 R >>"]), ["A", "B"]);
+    assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /First 6 0 R >>", "<< /Title (B) /Parent 5 0 R /First 5 0 R >>"]), ["A[B]"]);
+    assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 99 0 R >>"]), ["A"]);
+    assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 6 0 R >>", "42"]), ["A"]);
+}
+
+#[test]
+fn destination_points_map_to_the_displayed_page() {
+    // A crop box away from the origin: x 100..400, y 50..450.
+    let mut p = PageInfo { width: 300.0, height: 400.0, label: "1".into(), crop: [100.0, 50.0, 400.0, 450.0], rotation: 0 };
+    assert_eq!(p.dest_fraction(Some(100.0), Some(450.0), 0), [Some(0.0), Some(0.0)]);
+    assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.5), Some(0.25)]);
+    // Unspecified stays unspecified; off-page and huge values are clamped to the page.
+    assert_eq!(p.dest_fraction(None, Some(350.0), 0), [None, Some(0.25)]);
+    assert_eq!(p.dest_fraction(Some(-1e30), Some(1e30), 0), [Some(0.0), Some(0.0)]);
+    assert_eq!(p.dest_fraction(Some(f32::INFINITY), Some(f32::NAN), 0), [None, None]);
+    // /Rotate 90 (clockwise): user y runs left to right across the displayed page, user x
+    // top to bottom. A view rotation adds to it.
+    p.rotation = 90;
+    assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.75), Some(0.5)]);
+    assert_eq!(p.dest_fraction(None, Some(350.0), 0), [Some(0.75), None]);
+    assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 90), [Some(0.5), Some(0.75)]);
+    p.rotation = 180;
+    assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.5), Some(0.75)]);
+    p.rotation = 270;
+    assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 0), [Some(0.25), Some(0.5)]);
+    assert_eq!(p.dest_fraction(Some(250.0), Some(350.0), 90), [Some(0.5), Some(0.25)]);
+    // A degenerate crop box never divides by zero.
+    let flat = PageInfo { crop: [0.0, 0.0, 0.0, 0.0], rotation: 0, ..p };
+    assert!(flat.dest_fraction(Some(5.0), Some(-5.0), 0).iter().all(|f| f.is_some_and(|f| (0.0..=1.0).contains(&f))));
+}
+
+#[test]
+fn a_displayed_point_becomes_the_xyz_position_that_goes_back_to_it() {
+    // Every rotation, on a crop box away from the origin: pinning a displayed point and
+    // reading the destination back lands on the same fraction of the displayed page.
+    for rotation in [0u16, 90, 180, 270] {
+        let (width, height) = if rotation.is_multiple_of(180) { (300.0, 400.0) } else { (400.0, 300.0) };
+        let p = PageInfo { width, height, label: "1".into(), crop: [100.0, 50.0, 400.0, 450.0], rotation };
+        let (x, y) = (0.25 * width, 0.75 * height);
+        let near = |got: [Option<f32>; 2], want: [Option<f32>; 2]| {
+            for (g, w) in got.iter().zip(want) {
+                match (g, w) {
+                    (Some(g), Some(w)) => assert!((g - w).abs() < 1e-4, "{rotation}: {got:?} vs {want:?}"),
+                    (None, None) => {}
+                    _ => panic!("{rotation}: {got:?} vs {want:?}"),
+                }
+            }
+        };
+        let [l, t] = p.xyz_for_view(Some(x), Some(y));
+        assert!(l.is_some() && t.is_some(), "{rotation}: a point pins both");
+        near(p.dest_fraction(l, t, 0), [Some(0.25), Some(0.75)]);
+        // Only a height: the horizontal position is left alone, whichever user axis that is.
+        let [l, t] = p.xyz_for_view(None, Some(y));
+        assert_eq!((l.is_some(), t.is_some()), if rotation.is_multiple_of(180) { (false, true) } else { (true, false) }, "{rotation}");
+        near(p.dest_fraction(l, t, 0), [None, Some(0.75)]);
+        let [l, t] = p.xyz_for_view(Some(x), None);
+        near(p.dest_fraction(l, t, 0), [Some(0.25), None]);
+        assert_eq!(p.xyz_for_view(None, None), [None, None]);
+        assert_eq!(p.xyz_for_view(Some(f32::NAN), Some(f32::INFINITY)), [None, None], "not finite is not given");
+    }
+    // The top of an upright page is the crop box's top edge.
+    let p = PageInfo { width: 300.0, height: 400.0, label: "1".into(), crop: [100.0, 50.0, 400.0, 450.0], rotation: 0 };
+    assert_eq!(p.xyz_for_view(None, Some(0.0)), [None, Some(450.0)]);
+    assert_eq!(p.xyz_for_view(None, Some(100.0)), [None, Some(350.0)]);
+}
+
+#[test]
+fn structure_failure_preserves_renderer_pages() {
+    for crash in [true, false] {
+        let mut info = DocInfo {
+            file_size: 321,
+            pdf_version: "1.7".into(),
+            pages: vec![PageInfo { width: 300.0, height: 200.0, label: "1".into(), crop: [10.0, 20.0, 210.0, 320.0], rotation: 90 }],
+            ..Default::default()
+        };
+        inspect_structure(&mut info, |tmp| {
+            tmp.pages.clear();
+            tmp.title = Some("partially inspected".into());
+            if crash {
+                panic!("synthetic structure inspection failure");
+            }
+            Err("synthetic structure inspection failure".into())
+        });
+
+        assert_eq!(info.pages.len(), 1);
+        let page = &info.pages[0];
+        assert_eq!((page.width, page.height, page.label.as_str(), page.crop, page.rotation), (300.0, 200.0, "1", [10.0, 20.0, 210.0, 320.0], 90));
+        assert_eq!(info.file_size, 321);
+        assert_eq!(info.pdf_version, "1.7");
+        assert!(info.title.is_none());
+        assert_eq!(info.warnings.len(), 1);
+        assert!(info.warnings[0].contains("synthetic structure inspection failure"));
+        assert_eq!(info.warnings[0].contains("crashed"), crash);
+    }
+}
+
+#[test]
+fn invalid_dates_with_unicode_are_unchanged() {
+    for input in ["", "D:", "D:20260930104", "D:202609x01045", "yesterday"] {
+        assert_eq!(pretty_date(input), input);
+    }
+    // Cover every position before the 12-byte prefix, including characters that
+    // straddle its end. None of these strings is an ASCII PDF date.
+    for character in ['é', '€', '😀'] {
+        for prefix_len in 0..12 {
+            let input = format!("D:{}{character}123456789012", "1".repeat(prefix_len));
+            assert_eq!(pretty_date(&input), input, "{character} after {prefix_len} digits");
+        }
+    }
+}
+
+#[test]
+fn unicode_annotation_date_does_not_prevent_opening() {
+    use lopdf::dictionary;
+
+    let date = "D:12345678901éX";
+    let mut encoded_date = vec![0xFE, 0xFF];
+    encoded_date.extend(date.encode_utf16().flat_map(u16::to_be_bytes));
+    let mut doc = Document::with_version("1.7");
+    let pages_id = doc.new_object_id();
+    let annot_id = doc.add_object(dictionary! {
+        "Type" => "Annot",
+        "Subtype" => "Text",
+        "Rect" => vec![10.into(), 10.into(), 30.into(), 30.into()],
+        "M" => Object::String(encoded_date, lopdf::StringFormat::Hexadecimal),
+    });
+    let page_id = doc.add_object(dictionary! {
+        "Type" => "Page",
+        "Parent" => pages_id,
+        "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
+        "Annots" => vec![annot_id.into()],
+    });
+    doc.objects.insert(
+        pages_id,
+        dictionary! {
+            "Type" => "Pages",
+            "Kids" => vec![page_id.into()],
+            "Count" => 1,
+        }
+        .into(),
+    );
+    let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id });
+    doc.trailer.set("Root", catalog_id);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).expect("write synthetic fixture");
+
+    let info = inspect(Arc::new(bytes), None).expect("opens despite a non-date /M string");
+    assert_eq!(info.pages.len(), 1);
+    assert_eq!((info.pages[0].width, info.pages[0].height), (200.0, 300.0));
+    assert_eq!(info.annotations.len(), 1);
+    assert_eq!(info.annotations[0].modified.as_deref(), Some(date));
+    assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+}
+
+#[test]
+fn carriage_returns_in_comment_text_become_line_breaks() {
+    use lopdf::dictionary;
+
+    let mut doc = Document::with_version("1.7");
+    let pages_id = doc.new_object_id();
+    let annot_id = doc.add_object(dictionary! {
+        "Type" => "Annot",
+        "Subtype" => "Text",
+        "Rect" => vec![10.into(), 10.into(), 30.into(), 30.into()],
+        // Acrobat ends lines in /Contents with CR; the interface only breaks lines at LF.
+        "Contents" => Object::string_literal("one\r\rtwo\r\nthree"),
+    });
+    let page_id = doc.add_object(dictionary! {
+        "Type" => "Page",
+        "Parent" => pages_id,
+        "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
+        "Annots" => vec![annot_id.into()],
+    });
+    doc.objects.insert(pages_id, dictionary! { "Type" => "Pages", "Kids" => vec![page_id.into()], "Count" => 1 }.into());
+    let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id });
+    doc.trailer.set("Root", catalog_id);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).expect("write synthetic fixture");
+
+    let info = inspect(Arc::new(bytes), None).expect("opens");
+    assert_eq!(info.annotations[0].contents.as_deref(), Some("one\n\ntwo\nthree"));
+}
+
+#[test]
+fn dates_are_prettified() {
+    assert_eq!(pretty_date("D:20260930104512-04'00'"), "2026-09-30 10:45");
+    assert_eq!(pretty_date("yesterday"), "yesterday");
+}
+
+#[test]
+fn jspdf_high_precision_mediabox_does_not_overflow_dimensions() {
+    let pdf = b"%PDF-1.3
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 3874.9606299212600788 5493.5433070866147318] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let info = inspect(std::sync::Arc::new(pdf.to_vec()), None).expect("opens");
+    assert_eq!(info.pages.len(), 1);
+    let p = &info.pages[0];
+    assert!((p.width - 3874.96).abs() < 0.1, "width expected ~3874.96, got {}", p.width);
+    assert!((p.height - 5493.54).abs() < 0.1, "height expected ~5493.54, got {}", p.height);
+}
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index cc1e4af2e3..954823ef09 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -18,7 +18,7 @@ pub mod transition;
 
 pub use inspect::{
     Annotation, Attachment, AttachmentSource, DestView, DocInfo, Field, FieldKind, FontInfo, Layer, LayerOp, Link, LinkTarget, OutlineItem, PageInfo,
-    PageTransition, RemoteDestination, TransitionStyle, Xfa, attachment_data, check_pages, inspect, pretty_date,
+    PageTransition, RemoteDestination, TransitionStyle, Xfa, attachment_data, check_pages, inspect, link_replies, pretty_date, thread_tops,
 };
 pub use pixels::Pixels;
 pub use raster::{
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 90b81f30a6..c002c6ec92 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -33,6 +33,13 @@ use hayro::{RenderCache, RenderSettings, render_into, render_size};
 
 use crate::{Pixels, ReadingColors};
 
+mod pool;
+
+use pool::lock;
+#[cfg(test)]
+use pool::{BusyPublishGate, ParseGate, ParserState, PoolParser, RenderGate, Shared, same_request, worker, worker_settings};
+pub use pool::{RenderPool, Retiring};
+
 /// Monotonic-ish timer that is safe on wasm32 (where `std::time::Instant` panics).
 #[derive(Clone, Copy)]
 struct Stopwatch(#[cfg(not(target_arch = "wasm32"))] std::time::Instant);
@@ -497,7833 +504,5 @@ pub(crate) fn panic_message(p: &Box<dyn std::any::Any + Send>) -> String {
     p.downcast_ref::<&str>().map(ToString::to_string).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_else(|| "unknown panic".into())
 }
 
-/// How long one page may render before the pool gives up on it (the watchdog).
-pub const STUCK_AFTER: std::time::Duration = std::time::Duration::from_secs(20);
-
-#[cfg(not(target_arch = "wasm32"))]
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum BusyStage {
-    /// Parsing the document, shared or private. Not timed: a huge or damaged file is slow to
-    /// open, not stuck, and giving up on it would fail every page of the pool. (Parsing has
-    /// its own limits.) Rendering is timed from the moment parsing ends.
-    Parsing,
-    SharedRender,
-    Private,
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-#[derive(Clone)]
-struct Busy {
-    request: RenderRequest,
-    since: std::time::Instant,
-    stage: BusyStage,
-    cancelled: Arc<AtomicBool>,
-    valid: Arc<AtomicBool>,
-}
-
-#[cfg(all(test, not(target_arch = "wasm32")))]
-#[derive(Clone)]
-struct BusyPublishGate {
-    request: RenderRequest,
-    entered: std::sync::mpsc::Sender<()>,
-    release: Arc<Mutex<Receiver<()>>>,
-}
-
-#[cfg(all(test, not(target_arch = "wasm32")))]
-#[derive(Clone)]
-struct RenderGate {
-    page: usize,
-    shared_generation: bool,
-    claimed: Arc<std::sync::atomic::AtomicBool>,
-    entered: Arc<std::sync::Barrier>,
-    release: Arc<std::sync::Barrier>,
-    finished: Arc<std::sync::Barrier>,
-}
-
-#[cfg(all(test, not(target_arch = "wasm32")))]
-#[derive(Clone)]
-struct ParseGate {
-    entered: Arc<std::sync::Barrier>,
-    release: Arc<std::sync::Barrier>,
-}
-
-/// State shared by the pool and its workers.
-#[derive(Default)]
-struct Shared {
-    /// Desired requests, active jobs and bounded completed results share one deduplication key.
-    queue: Arc<WorkQueue>,
-    /// Per worker id: the request it is rendering and since when.
-    #[cfg(not(target_arch = "wasm32"))]
-    busy: Mutex<Vec<Option<Busy>>>,
-    /// Exact requests the watchdog gave up on: answered with an error at once, so a pathological
-    /// request cannot trap every worker in turn while other scales, tiles, or generations remain usable.
-    stuck: Mutex<std::collections::HashSet<RequestFailureKey>>,
-    stats: AtomicRenderStats,
-    /// Per worker id: set to stop that worker's render at its next content operator once nobody
-    /// can receive its answer (the pool was dropped, or the watchdog gave up on the render).
-    /// Lock `busy` first when holding both.
-    stop: Mutex<Vec<Arc<std::sync::atomic::AtomicBool>>>,
-    /// Test hook: hold one worker at the render boundary until the test releases it.
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    render_gates: Mutex<Vec<RenderGate>>,
-    /// Test hook: hold parser initialization until the test releases it.
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    parse_gate: Mutex<Option<ParseGate>>,
-    /// Test hook: make rendering this page take this long (cancellable).
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    slow_page: Mutex<Option<(usize, std::time::Duration)>>,
-    /// Test hook: make parser initialization take this long.
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    slow_parse: Mutex<Option<std::time::Duration>>,
-    /// Test hook: count parser initializations, including failed parses.
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    parses: std::sync::atomic::AtomicUsize,
-    #[cfg(not(target_arch = "wasm32"))]
-    parser: PoolParser,
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    panic_page: Mutex<Option<usize>>,
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    render_started: std::sync::atomic::AtomicUsize,
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    busy_publish_gate: Mutex<Option<BusyPublishGate>>,
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    parser_stage_entries: Mutex<Vec<RenderRequest>>,
-    #[cfg(all(test, not(target_arch = "wasm32")))]
-    shared_render_delay: Mutex<Option<std::time::Duration>>,
-}
-
-fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
-    m.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-fn same_request(a: RenderRequest, b: RenderRequest) -> bool {
-    // `preview` is excluded on purpose: it names the same work for cancellation, only the
-    // detail level of the result differs.
-    a.page == b.page && a.kind == b.kind && a.tile == b.tile && a.scale.to_bits() == b.scale.to_bits() && a.tag == b.tag
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-impl Shared {
-    fn cancel_in_flight(&self, obsolete: &[RenderRequest]) {
-        let busy = lock(&self.busy);
-        for busy in busy.iter().flatten() {
-            if obsolete.iter().copied().any(|request| same_request(request, busy.request)) {
-                busy.cancelled.store(true, Ordering::Release);
-                busy.valid.store(false, Ordering::Release);
-            }
-        }
-    }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-fn set_busy_stage(shared: &Shared, id: usize, stage: BusyStage) -> bool {
-    let mut slots = lock(&shared.busy);
-    let Some(Some(busy)) = slots.get_mut(id) else { return false };
-    if busy.stage != stage {
-        busy.stage = stage;
-        busy.since = std::time::Instant::now();
-    }
-    true
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-#[derive(Default)]
-enum ParserState {
-    #[default]
-    Empty,
-    Loading,
-    Ready(Option<Arc<Pdf>>),
-    /// A page failed after initialization: isolate subsequent work per worker.
-    Private,
-    /// Retired before it became ready (defensive: parsing is not timed, and only a shared
-    /// render retires the parser). Retrying it on every worker cannot help.
-    Failed,
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-struct PoolParser {
-    state: Mutex<ParserState>,
-    ready: std::sync::Condvar,
-    valid: Arc<AtomicBool>,
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-impl Default for PoolParser {
-    fn default() -> Self {
-        Self { state: Mutex::default(), ready: std::sync::Condvar::new(), valid: Arc::new(AtomicBool::new(true)) }
-    }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-impl PoolParser {
-    /// `None` means use a private parser. `Some(None)` is a terminal parse failure.
-    fn acquire(&self, load: impl FnOnce() -> Option<Pdf>, cancelled: impl Fn() -> bool) -> Option<Option<Arc<Pdf>>> {
-        let mut state = lock(&self.state);
-        loop {
-            if cancelled() {
-                return Some(None);
-            }
-            match &*state {
-                ParserState::Ready(pdf) => return Some(pdf.clone()),
-                ParserState::Private => return None,
-                ParserState::Failed => return Some(None),
-                ParserState::Loading => {
-                    // Drop never joins a parser. A waiting worker must still notice
-                    // its pool's disconnected wake channel while another thread is
-                    // stuck in initialization and cannot signal this condition.
-                    state = self.ready.wait_timeout(state, std::time::Duration::from_millis(50)).unwrap_or_else(std::sync::PoisonError::into_inner).0;
-                }
-                ParserState::Empty => {
-                    *state = ParserState::Loading;
-                    break;
-                }
-            }
-        }
-        drop(state);
-        // Parsing cannot hold the lifecycle mutex: watchdog/drop must remain nonblocking.
-        // Even a panic in initialization publishes one terminal failure and wakes waiters.
-        let pdf = catch_unwind(AssertUnwindSafe(load)).ok().flatten().map(Arc::new);
-        let mut state = lock(&self.state);
-        let result = match &*state {
-            ParserState::Loading => {
-                *state = ParserState::Ready(pdf.clone());
-                Some(pdf)
-            }
-            ParserState::Private => None,
-            _ => Some(None), // the watchdog retired initialization while it ran
-        };
-        self.ready.notify_all();
-        result
-    }
-
-    fn abandon(&self) {
-        self.retire();
-    }
-
-    /// After a shared render failed or timed out: later work parses privately, per worker
-    /// (for the rest of the pool's life: the old one-parser-per-worker memory use). A parser
-    /// that never became ready stays failed.
-    fn retire(&self) {
-        let mut state = lock(&self.state);
-        self.valid.store(false, Ordering::Release);
-        *state = match &*state {
-            ParserState::Loading | ParserState::Empty | ParserState::Failed => ParserState::Failed,
-            _ => ParserState::Private,
-        };
-        self.ready.notify_all();
-    }
-}
-
-/// Renders pages on worker threads, most urgent request first.
-///
-/// **Watchdog:** a render running longer than `stuck_after` (default [`STUCK_AFTER`]) is given
-/// up on. A timed-out *shared* render retires that parser and retries still-desired work
-/// privately: the page may only have been waiting behind another page's decode. A private
-/// timeout is reported as an error for that page and the page is not attempted again. Threads
-/// cannot be killed: the stuck worker is told to stop at its next content operator, exits when
-/// its render returns, and its late result is dropped; a single long operator, such as decoding
-/// a huge image, still runs to its end. At most `threads` replacements are started per pool, so
-/// a document full of pathological pages cannot spawn threads without bound. If every worker is
-/// retired after that budget is spent, pending and future requests fail explicitly instead of
-/// waiting forever.
-pub struct RenderPool {
-    shared: Arc<Shared>,
-    wake: Mutex<Vec<SyncSender<()>>>,
-    results: ResultReceiver,
-    results_tx: Arc<WorkQueue>,
-    bytes: Arc<Vec<u8>>,
-    config: RenderConfig,
-    _workers: Mutex<Vec<JoinHandle<()>>>,
-    stuck_after: std::time::Duration,
-    replacements_left: Mutex<usize>,
-    retired_workers: Mutex<usize>,
-    /// Used when threads are unavailable (wasm32 without atomics, or spawn failure): requests are
-    /// rendered on the calling thread inside `try_recv`, one per call.
-    inline: Option<std::cell::RefCell<PageRenderer>>,
-}
-
-impl RenderPool {
-    pub fn new(bytes: Arc<Vec<u8>>, threads: usize, config: RenderConfig) -> Self {
-        Self::with_mode(bytes, threads, config, false)
-    }
-
-    fn with_mode(bytes: Arc<Vec<u8>>, threads: usize, config: RenderConfig, inline: bool) -> Self {
-        let threads = if inline || cfg!(target_arch = "wasm32") { 0 } else { threads.max(1) };
-        let shared = Arc::new(Shared::default());
-        let results_tx = shared.queue.clone();
-        let results = ResultReceiver(shared.queue.clone());
-        let mut pool = Self {
-            shared,
-            wake: Mutex::new(Vec::new()),
-            results,
-            results_tx,
-            bytes: bytes.clone(),
-            config: config.clone(),
-            _workers: Mutex::new(Vec::new()),
-            stuck_after: STUCK_AFTER,
-            replacements_left: Mutex::new(threads),
-            retired_workers: Mutex::new(0),
-            inline: None,
-        };
-        for _ in 0..threads {
-            pool.spawn_worker();
-        }
-        if lock(&pool._workers).is_empty() {
-            pool.inline = Some(std::cell::RefCell::new(PageRenderer::new(bytes, config)));
-        }
-        pool
-    }
-
-    /// Start one worker thread; returns whether it started.
-    fn spawn_worker(&self) -> bool {
-        #[cfg(target_arch = "wasm32")]
-        return false;
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            let (id, stop) = {
-                let mut busy = lock(&self.shared.busy);
-                busy.push(None);
-                let stop = Arc::new(std::sync::atomic::AtomicBool::new(false));
-                lock(&self.shared.stop).push(stop.clone());
-                (busy.len() - 1, stop)
-            };
-            let (wtx, wrx) = sync_channel::<()>(1);
-            let (shared, out, bytes, config) = (self.shared.clone(), self.results_tx.clone(), self.bytes.clone(), self.config.clone());
-            match std::thread::Builder::new().name(format!("pdfcraft-render-{id}")).spawn(move || worker(id, bytes, config, shared, wrx, out, stop)) {
-                Ok(h) => {
-                    lock(&self.wake).push(wtx);
-                    lock(&self._workers).push(h);
-                    true
-                }
-                Err(e) => {
-                    log::error!("could not spawn render worker {id}: {e}");
-                    false
-                }
-            }
-        }
-    }
-
-    /// A pool without worker threads: renders inside `try_recv` (the web path; also used in tests).
-    pub fn new_inline(bytes: Arc<Vec<u8>>, config: RenderConfig) -> Self {
-        Self::with_mode(bytes, 0, config, true)
-    }
-
-    /// `true` when rendering happens on the caller's thread (no worker threads available).
-    pub fn is_inline(&self) -> bool {
-        self.inline.is_some()
-    }
-
-    /// Snapshot the work counters collected by this pool.
-    pub fn stats(&self) -> RenderStats {
-        self.inline.as_ref().map_or_else(|| self.shared.stats.snapshot(), |renderer| renderer.borrow().stats())
-    }
-
-    /// Change the watchdog limit (tests and benchmarks).
-    pub fn set_stuck_after(&mut self, limit: std::time::Duration) {
-        self.stuck_after = limit;
-    }
-
-    /// Replace desired work (most urgent first), retaining matching in-flight/completed jobs.
-    /// Obsolete results are released before they reach the caller, and active obsolete renders
-    /// are asked to stop at their next cancellation point.
-    ///
-    /// The contract: a result is delivered only while its request is in the latest queue.
-    /// A caller still waiting for a page (or text, or a thumbnail) must keep listing it in
-    /// every call, or the finished result is dropped to save memory.
-    pub fn set_queue(&self, requests: Vec<RenderRequest>) {
-        #[cfg(not(target_arch = "wasm32"))]
-        let obsolete = self.shared.queue.replace(requests);
-        #[cfg(target_arch = "wasm32")]
-        let _ = self.shared.queue.replace(requests);
-        #[cfg(not(target_arch = "wasm32"))]
-        self.shared.cancel_in_flight(&obsolete);
-        self.wake_workers();
-    }
-
-    fn wake_workers(&self) {
-        for w in lock(&self.wake).iter() {
-            // One pending wakeup is sufficient; UI polling must not grow wake channels.
-            let _ = w.try_send(());
-        }
-    }
-
-    pub fn try_recv(&self) -> Option<RenderedPage> {
-        if let Some(r) = &self.inline {
-            let req = self.shared.queue.pop()?;
-            let page = r.borrow_mut().render(req);
-            self.shared.queue.finish_inline(req);
-            return Some(page);
-        }
-        self.watchdog();
-        let page = self.results.try_recv().ok();
-        // Consuming a result releases byte/count capacity. An invalid parser generation
-        // can also requeue work without returning a page, so wake in both cases.
-        self.wake_workers();
-        page.or_else(|| {
-            let workers = lock(&self._workers).len();
-            if workers == 0 || *lock(&self.retired_workers) < workers {
-                return None;
-            }
-            // Count successful handles, not reserved busy slots: thread spawning
-            // can fail. No worker remains able to service these pending requests.
-            let request = self.shared.queue.pop()?;
-            self.shared.queue.finish_inline(request);
-            Some(RenderedPage {
-                request,
-                width: 0,
-                height: 0,
-                rgba: Pixels::default(),
-                error: Some("all render workers exceeded their time limits; close and reopen the document to try again".into()),
-                text: None,
-                warnings: Vec::new(),
-                millis: 0,
-            })
-        })
-    }
-
-    /// Give up on renders that exceeded `stuck_after` (see the type docs).
-    fn watchdog(&self) {
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            let mut gave_up = Vec::new();
-            {
-                let mut busy = lock(&self.shared.busy);
-                // Lock order: `busy`, then `stop`.
-                let stop = lock(&self.shared.stop);
-                for (id, slot) in busy.iter_mut().enumerate() {
-                    if let Some(busy) = slot.clone()
-                        && busy.stage != BusyStage::Parsing
-                        && busy.since.elapsed() > self.stuck_after
-                    {
-                        *slot = None; // the worker sees this and exits when it returns
-                        // Told to stop at its next operator; its replacement retries the page.
-                        busy.cancelled.store(true, Ordering::Release);
-                        busy.valid.store(false, Ordering::Release);
-                        if let Some(s) = stop.get(id) {
-                            s.store(true, std::sync::atomic::Ordering::Relaxed);
-                        }
-                        gave_up.push(busy);
-                    }
-                }
-            }
-            {
-                let mut retired = lock(&self.retired_workers);
-                *retired = retired.saturating_add(gave_up.len());
-            }
-            for busy in gave_up {
-                let req = busy.request;
-                self.shared.parser.retire();
-                if busy.stage == BusyStage::SharedRender {
-                    // The shared cold-decode gate can make a healthy page wait
-                    // behind another page. Only its private retry can attribute
-                    // the timeout to this page; do not blacklist it here.
-                    self.shared.queue.retry(req);
-                } else {
-                    lock(&self.shared.stuck).insert(req.into());
-                    let what = if req.kind == RequestKind::Text { "text extraction for page" } else { "page" };
-                    let error = format!(
-                        "{what} {} took longer than {:.0} s and was skipped; the page may be damaged or extremely complex",
-                        req.page + 1,
-                        self.stuck_after.as_secs_f32().max(1.0)
-                    );
-                    self.shared.queue.abandon(RenderedPage {
-                        request: req,
-                        width: 0,
-                        height: 0,
-                        rgba: Pixels::default(),
-                        error: Some(error),
-                        text: None,
-                        warnings: Vec::new(),
-                        millis: 0,
-                    });
-                }
-                let mut left = lock(&self.replacements_left);
-                if *left > 0 && self.spawn_worker() {
-                    *left -= 1;
-                }
-            }
-        }
-    }
-}
-
-/// A pool's threads after [`RenderPool::retire`]. Idle ones exit at once; one still rendering is
-/// told to stop at its next drawing operator and exits when its render returns, which a single
-/// long operator (such as decoding a huge image) can delay.
-pub struct Retiring(Vec<JoinHandle<()>>);
-
-impl Retiring {
-    /// The threads that haven't exited yet.
-    pub fn running(&mut self) -> usize {
-        self.0.retain(|h| !h.is_finished());
-        self.0.len()
-    }
-
-    /// Whether every thread has exited.
-    pub fn exited(&self) -> bool {
-        self.0.iter().all(JoinHandle::is_finished)
-    }
-}
-
-impl RenderPool {
-    /// No replacement threads: when the watchdog gives up on a render, the request (and any
-    /// later one) is answered with an error instead of starting another thread. For a caller that
-    /// bounds how many render threads exist at once: the stuck thread keeps running until its
-    /// operator returns, and a replacement would run beside it.
-    pub fn without_replacements(self) -> Self {
-        *lock(&self.replacements_left) = 0;
-        self
-    }
-
-    /// This pool's threads that haven't exited (workers and replacements; 0 when rendering inline).
-    pub fn threads(&self) -> usize {
-        lock(&self._workers).iter().filter(|h| !h.is_finished()).count()
-    }
-
-    /// Drop the pool but keep its threads' handles, for a caller that bounds how many render
-    /// threads run at once: a render the watchdog gave up on can outlive its pool.
-    pub fn retire(self) -> Retiring {
-        let handles = std::mem::take(&mut *lock(&self._workers));
-        drop(self);
-        Retiring(handles)
-    }
-}
-
-impl Drop for RenderPool {
-    fn drop(&mut self) {
-        #[cfg(not(target_arch = "wasm32"))]
-        for busy in lock(&self.shared.busy).iter().flatten() {
-            busy.cancelled.store(true, Ordering::Release);
-            busy.valid.store(false, Ordering::Release);
-        }
-        for s in lock(&self.shared.stop).iter() {
-            s.store(true, std::sync::atomic::Ordering::Relaxed);
-        }
-    }
-}
-
-/// A worker's interpreter settings: the document's, stopping once the request is cancelled.
-#[cfg(not(target_arch = "wasm32"))]
-fn worker_settings(config: &RenderConfig, stop: &Arc<std::sync::atomic::AtomicBool>) -> InterpreterSettings {
-    InterpreterSettings { cancelled: Some(stop.clone()), ..config.settings() }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-fn worker(
-    id: usize,
-    bytes: Arc<Vec<u8>>,
-    config: RenderConfig,
-    shared: Arc<Shared>,
-    wake: Receiver<()>,
-    out: Arc<WorkQueue>,
-    stop: Arc<std::sync::atomic::AtomicBool>,
-) {
-    let warnings = Arc::new(Mutex::new(Vec::new()));
-    // A local cell keeps Pdf borrows used by RenderCache stable. Drop both on an
-    // epoch change/panic before publishing an error or taking another request.
-    loop {
-        let reset_result = {
-            let parsed = std::cell::OnceCell::new();
-            loop {
-                if parsed.get().is_some_and(|(_, _, shared_generation)| *shared_generation) && !shared.parser.valid.load(Ordering::Acquire) {
-                    break None;
-                }
-                let next = shared.queue.pop();
-                let Some(req) = next else {
-                    if wake.recv().is_err() {
-                        return; // pool dropped
-                    }
-                    continue;
-                };
-                if shared.queue.cancel_obsolete(req) {
-                    continue;
-                }
-                #[cfg(all(test, not(target_arch = "wasm32")))]
-                if let Some(gate) = lock(&shared.busy_publish_gate).clone().filter(|gate| same_request(gate.request, req)) {
-                    let _ = gate.entered.send(());
-                    let _ = lock(&gate.release).recv();
-                }
-                let request_cancelled = Arc::new(AtomicBool::new(false));
-                let request_valid = Arc::new(AtomicBool::new(true));
-                if lock(&shared.stuck).contains(&req.into()) {
-                    let error = format!("page {} was skipped earlier because rendering failed or took too long", req.page + 1);
-                    let page = RenderedPage {
-                        request: req,
-                        width: 0,
-                        height: 0,
-                        rgba: Pixels::default(),
-                        error: Some(error),
-                        text: None,
-                        warnings: Vec::new(),
-                        millis: 0,
-                    };
-                    if out.send_valid(page, None).is_err() {
-                        return;
-                    }
-                    continue;
-                }
-                let start = Stopwatch::start();
-                shared.stats.record_request(req);
-                let stage = parsed.get().map_or(
-                    BusyStage::Parsing,
-                    |(_, _, shared_generation)| {
-                        if *shared_generation { BusyStage::SharedRender } else { BusyStage::Private }
-                    },
-                );
-                if let Some(slot) = lock(&shared.busy).get_mut(id) {
-                    *slot = Some(Busy {
-                        request: req,
-                        since: std::time::Instant::now(),
-                        stage,
-                        cancelled: request_cancelled.clone(),
-                        valid: request_valid.clone(),
-                    });
-                }
-                if shared.queue.cancel_obsolete(req) {
-                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
-                        return;
-                    }
-                    continue;
-                }
-                #[cfg(all(test, not(target_arch = "wasm32")))]
-                lock(&shared.parser_stage_entries).push(req);
-                // A request cancelled while it waited for the parser must not leave its abort
-                // behind as this worker's parse: every later request would then fail as unparsable.
-                let aborted = || request_cancelled.load(Ordering::Acquire) || stop.load(Ordering::Acquire);
-                if parsed.get().is_none() {
-                    let init = {
-                        let load = || {
-                            #[cfg(test)]
-                            {
-                                shared.parses.fetch_add(1, Ordering::Relaxed);
-                                if let Some(gate) = lock(&shared.parse_gate).clone() {
-                                    gate.entered.wait();
-                                    gate.release.wait();
-                                }
-                                let delay = *lock(&shared.slow_parse);
-                                if let Some(delay) = delay {
-                                    std::thread::sleep(delay);
-                                }
-                            }
-                            shared.stats.parser_builds.fetch_add(1, Ordering::Relaxed);
-                            parse(&bytes, config.password.as_deref())
-                        };
-                        match shared.parser.acquire(load, || {
-                            request_cancelled.load(Ordering::Acquire)
-                                || stop.load(Ordering::Acquire)
-                                || matches!(wake.try_recv(), Err(std::sync::mpsc::TryRecvError::Disconnected))
-                        }) {
-                            Some(pdf) => {
-                                let shared_generation = pdf.is_some();
-                                (pdf, RenderCache::new(), shared_generation)
-                            }
-                            None => {
-                                let pdf = if !request_cancelled.load(Ordering::Acquire)
-                                    && !stop.load(Ordering::Acquire)
-                                    && set_busy_stage(&shared, id, BusyStage::Parsing)
-                                {
-                                    load().map(Arc::new)
-                                } else {
-                                    None
-                                };
-                                (pdf, RenderCache::new(), false)
-                            }
-                        }
-                    };
-                    if aborted() {
-                        if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
-                            return;
-                        }
-                        // Release the active key, retrying if demand returned during parsing.
-                        shared.queue.retry(req);
-                        continue;
-                    }
-                    let _ = parsed.set(init);
-                }
-                // Set just above when it was empty.
-                let Some((pdf, cache, shared_generation)) = parsed.get() else {
-                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
-                        return;
-                    }
-                    continue;
-                };
-                // Acquisition may have waited or parsed privately after shared
-                // fallback. Retire before any render work if the watchdog gave
-                // this request to a replacement while initialization ran.
-                let stage = if *shared_generation { BusyStage::SharedRender } else { BusyStage::Private };
-                if !set_busy_stage(&shared, id, stage) {
-                    return;
-                }
-                if shared.queue.cancel_obsolete(req) {
-                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
-                        return;
-                    }
-                    continue;
-                }
-                if *shared_generation && !shared.parser.valid.load(Ordering::Acquire) {
-                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
-                        return;
-                    }
-                    break Some((
-                        finish(req, start, Err(("the shared parser was retired".into(), false)), Vec::new()),
-                        vec![request_valid, shared.parser.valid.clone()],
-                    ));
-                }
-                #[cfg(test)]
-                {
-                    shared.render_started.fetch_add(1, Ordering::Relaxed);
-                    let shared_delay = *lock(&shared.shared_render_delay);
-                    if *shared_generation && let Some(delay) = shared_delay {
-                        std::thread::sleep(delay);
-                    }
-                    // Copy out first: a guard held in the `if let` would block the other workers.
-                    let slow = *lock(&shared.slow_page);
-                    if let Some((page, delay)) = slow
-                        && page == req.page
-                    {
-                        let deadline = std::time::Instant::now() + delay;
-                        while std::time::Instant::now() < deadline && !request_cancelled.load(Ordering::Acquire) {
-                            std::thread::sleep(std::time::Duration::from_millis(1));
-                        }
-                    }
-                }
-                #[cfg(all(test, not(target_arch = "wasm32")))]
-                let render_gate = lock(&shared.render_gates)
-                    .iter()
-                    .find(|gate| {
-                        gate.page == req.page
-                            && gate.shared_generation == *shared_generation
-                            && gate.claimed.compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire).is_ok()
-                    })
-                    .cloned();
-                #[cfg(all(test, not(target_arch = "wasm32")))]
-                if let Some(gate) = &render_gate {
-                    gate.entered.wait();
-                    gate.release.wait();
-                }
-                let settings = warning_settings(&worker_settings(&config, &request_cancelled), warnings.clone());
-                lock(&warnings).clear();
-                let r = catch_unwind(AssertUnwindSafe(|| {
-                    #[cfg(test)]
-                    if *lock(&shared.panic_page) == Some(req.page) {
-                        panic!("injected page panic");
-                    }
-                    match pdf {
-                        Some(pdf) => render_page(pdf, cache, &settings, &config, req),
-                        None => Err(("the document could not be parsed".into(), false)),
-                    }
-                }))
-                .unwrap_or_else(|panic| Err((format!("renderer crashed on page {}: {}", req.page + 1, panic_message(&panic)), true)));
-                let request_warnings = take_warnings(&warnings);
-                // If the watchdog cleared our slot meanwhile, it already answered for this request
-                // and started a replacement: drop the late result and retire.
-                let abandoned = lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none());
-                if abandoned {
-                    #[cfg(all(test, not(target_arch = "wasm32")))]
-                    if let Some(gate) = render_gate {
-                        gate.finished.wait();
-                    }
-                    return;
-                }
-                let panicked = matches!(r, Err((_, true)));
-                if panicked {
-                    shared.parser.abandon();
-                    lock(&shared.stuck).insert(req.into());
-                    break Some((finish(req, start, r, request_warnings), vec![request_valid]));
-                }
-                let mut valid = vec![request_valid];
-                if *shared_generation {
-                    valid.push(shared.parser.valid.clone());
-                }
-                if *shared_generation && !shared.parser.valid.load(Ordering::Acquire) {
-                    break Some((finish(req, start, r, request_warnings), valid));
-                }
-                if out.send_valid_with_tokens(finish(req, start, r, request_warnings), valid).is_err() {
-                    return;
-                }
-            }
-        }; // drop the parser and its borrowing cache before delivering reset_result
-        if let Some((page, valid)) = reset_result
-            && out.send_valid_with_tokens(page, valid).is_err()
-        {
-            return;
-        }
-    }
-}
-
 #[cfg(test)]
-mod tests {
-    #[cfg(not(target_arch = "wasm32"))]
-    fn render_gate(page: usize, shared_generation: bool) -> super::RenderGate {
-        let barrier = || std::sync::Arc::new(std::sync::Barrier::new(2));
-        super::RenderGate {
-            page,
-            shared_generation,
-            claimed: Arc::new(std::sync::atomic::AtomicBool::new(false)),
-            entered: barrier(),
-            release: barrier(),
-            finished: barrier(),
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn parse_gate() -> super::ParseGate {
-        let barrier = || std::sync::Arc::new(std::sync::Barrier::new(2));
-        super::ParseGate { entered: barrier(), release: barrier() }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn receive_before_deadline(pool: &RenderPool) -> RenderedPage {
-        // Generous: a loaded CI machine runs many render tests at once.
-        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
-        loop {
-            if let Some(page) = pool.try_recv() {
-                return page;
-            }
-            assert!(std::time::Instant::now() < deadline, "no worker result");
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn shared_parser_is_lazy_and_initializes_once_under_contention() {
-        use std::sync::{Barrier, atomic::AtomicUsize};
-        let parser = Arc::new(PoolParser::default());
-        let loads = Arc::new(AtomicUsize::new(0));
-        let barrier = Arc::new(Barrier::new(16));
-        assert_eq!(loads.load(Ordering::Relaxed), 0);
-        let jobs: Vec<_> = (0..16)
-            .map(|_| {
-                let (parser, loads, barrier) = (parser.clone(), loads.clone(), barrier.clone());
-                std::thread::spawn(move || {
-                    barrier.wait();
-                    parser
-                        .acquire(
-                            || {
-                                loads.fetch_add(1, Ordering::Relaxed);
-                                Pdf::new(ONE_PAGE.to_vec()).ok()
-                            },
-                            || false,
-                        )
-                        .unwrap()
-                        .unwrap()
-                })
-            })
-            .collect();
-        let pdfs: Vec<_> = jobs.into_iter().map(|job| job.join().unwrap()).collect();
-        assert_eq!(loads.load(Ordering::Relaxed), 1);
-        assert!(pdfs.iter().all(|pdf| Arc::ptr_eq(pdf, &pdfs[0])));
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn initializer_panic_publishes_one_failure_and_wakes_waiters() {
-        use std::sync::{Barrier, atomic::AtomicUsize};
-        let parser = Arc::new(PoolParser::default());
-        let loads = Arc::new(AtomicUsize::new(0));
-        let barrier = Arc::new(Barrier::new(8));
-        let jobs: Vec<_> = (0..8)
-            .map(|_| {
-                let (parser, loads, barrier) = (parser.clone(), loads.clone(), barrier.clone());
-                std::thread::spawn(move || {
-                    barrier.wait();
-                    assert!(
-                        parser
-                            .acquire(
-                                || {
-                                    loads.fetch_add(1, Ordering::Relaxed);
-                                    panic!("injected parser panic");
-                                },
-                                || false
-                            )
-                            .unwrap()
-                            .is_none()
-                    );
-                })
-            })
-            .collect();
-        for job in jobs {
-            job.join().unwrap();
-        }
-        assert_eq!(loads.load(Ordering::Relaxed), 1);
-        assert!(parser.acquire(|| panic!("must not retry"), || false).unwrap().is_none());
-    }
-
-    /// The waits here only guard against a hang; they don't time anything. The initializer is
-    /// held until the end of the test, so a waiter that can't cancel waits forever and fails the
-    /// guard however long it is, and a correct one returns as soon as its thread runs. Two
-    /// seconds was too short for a busy FreeBSD VM in CI to start the threads (#1970).
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn waiting_worker_can_cancel_before_initializer_returns() {
-        use std::{
-            sync::{atomic::AtomicUsize, mpsc},
-            time::Duration,
-        };
-        const HANG_GUARD: Duration = Duration::from_secs(600);
-        let parser = Arc::new(PoolParser::default());
-        let (started_tx, started_rx) = mpsc::channel();
-        let (release_tx, release_rx) = mpsc::channel();
-        let initializer = {
-            let parser = parser.clone();
-            std::thread::spawn(move || {
-                parser.acquire(
-                    || {
-                        started_tx.send(()).unwrap();
-                        // A failed test drops the sender: that ends the hold, it is not a
-                        // second failure.
-                        let _ = release_rx.recv();
-                        Pdf::new(ONE_PAGE.to_vec()).ok()
-                    },
-                    || false,
-                )
-            })
-        };
-        started_rx.recv_timeout(HANG_GUARD).expect("the initializer starts");
-        let cancelled = Arc::new(AtomicBool::new(false));
-        let checks = Arc::new(AtomicUsize::new(0));
-        let (done_tx, done_rx) = mpsc::channel();
-        let waiter = {
-            let (parser, cancelled, checks) = (parser.clone(), cancelled.clone(), checks.clone());
-            std::thread::spawn(move || {
-                let result = parser.acquire(
-                    || panic!("must not initialize twice"),
-                    || {
-                        checks.fetch_add(1, Ordering::Relaxed);
-                        cancelled.load(Ordering::Acquire)
-                    },
-                );
-                done_tx.send(result.unwrap().is_none()).unwrap();
-            })
-        };
-        let deadline = std::time::Instant::now() + HANG_GUARD;
-        while checks.load(Ordering::Relaxed) == 0 {
-            assert!(std::time::Instant::now() < deadline, "the waiter never checked for cancellation");
-            std::thread::sleep(Duration::from_millis(1));
-        }
-        cancelled.store(true, Ordering::Release);
-        assert!(done_rx.recv_timeout(HANG_GUARD).expect("the waiter cancels while the initializer is held"));
-        waiter.join().unwrap();
-        release_tx.send(()).unwrap();
-        assert!(initializer.join().unwrap().unwrap().is_some());
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn a_retired_pool_counts_its_threads_until_they_exit() {
-        // Idle: its thread leaves as soon as the pool is gone.
-        let mut idle = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default()).retire();
-        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
-        while idle.running() > 0 && std::time::Instant::now() < deadline {
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert_eq!(idle.running(), 0);
-        // Busy in a step that can't be interrupted: still counted after the pool is dropped.
-        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_secs(2)));
-        pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, ..Default::default() }]);
-        while pool.shared.render_started.load(Ordering::Relaxed) == 0 && std::time::Instant::now() < deadline {
-            std::thread::sleep(std::time::Duration::from_millis(2));
-        }
-        let mut busy = pool.retire();
-        assert_eq!(busy.running(), 1, "the render is still under way");
-        while busy.running() > 0 && std::time::Instant::now() < deadline {
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert_eq!(busy.running(), 0, "and the thread exits when it returns");
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn a_pool_without_replacements_never_runs_a_second_thread() {
-        // The watchdog gives up on a render stuck in one long step; with no replacement, the
-        // request is answered with an error and the stuck thread is the only one.
-        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default()).without_replacements();
-        pool.set_stuck_after(std::time::Duration::from_millis(50));
-        *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_secs(2)));
-        pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, ..Default::default() }]);
-        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
-        let answer = loop {
-            assert!(pool.threads() <= 1, "{} render threads", pool.threads());
-            if let Some(page) = pool.try_recv() {
-                break page;
-            }
-            assert!(std::time::Instant::now() < deadline, "the stuck render is answered");
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        };
-        assert!(answer.error.is_some(), "answered with an error, not a second attempt");
-        assert!(pool.threads() <= 1);
-        let mut retired = pool.retire();
-        while retired.running() > 0 {
-            assert!(std::time::Instant::now() < deadline, "the stuck thread exits when its step ends");
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn page_panic_retires_shared_generation_and_healthy_pages_use_private_parsers() {
-        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 3, RenderConfig::default());
-        *lock(&pool.shared.panic_page) = Some(0);
-        // Hold page 1 at the shared render boundary until page 0 has crashed, so it can't finish
-        // in the shared generation first (then only one parse would happen).
-        let gate = render_gate(1, true);
-        *lock(&pool.shared.render_gates) = vec![gate.clone()];
-        pool.set_queue(vec![
-            RenderRequest { page: 0, scale: 1.0, ..Default::default() },
-            RenderRequest { page: 1, scale: 1.0, ..Default::default() },
-        ]);
-        let crashed = receive_before_deadline(&pool);
-        if gate.claimed.load(Ordering::Acquire) {
-            gate.entered.wait();
-            gate.release.wait();
-        }
-        let mut pages = [crashed, receive_before_deadline(&pool)];
-        pages.sort_by_key(|page| page.request.page);
-        assert!(pages[0].error.as_deref().is_some_and(|message| message.contains("crashed")));
-        assert!(pages[1].error.is_none(), "{:?}", pages[1].error);
-        assert_eq!((pages[1].width, pages[1].height), (100, 50));
-        assert!(!pool.shared.parser.valid.load(Ordering::Acquire));
-        assert!(matches!(*lock(&pool.shared.parser.state), ParserState::Private));
-        assert!((2..=4).contains(&pool.shared.parses.load(Ordering::Relaxed)));
-        let before = pool.shared.parses.load(Ordering::Relaxed);
-        // A new generation (tag) and scale of the failed page is still refused without parsing again.
-        pool.set_queue(vec![RenderRequest { page: 0, tag: 1, scale: 2.0, ..Default::default() }]);
-        assert!(receive_before_deadline(&pool).error.as_deref().is_some_and(|message| message.contains("skipped earlier")));
-        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), before, "a failed page does not trigger repeated parsing");
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn results_queued_before_invalidation_are_retried_privately() {
-        let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
-        pool.set_queue(vec![RenderRequest { tag: 77, scale: 1.0, ..Default::default() }]);
-        let mut old = pool.results.recv_timeout(std::time::Duration::from_secs(8)).unwrap();
-        old.width = 999; // a stale surface must never reach the caller
-        pool.shared.parser.abandon();
-        pool.results_tx.send_valid(old, Some(pool.shared.parser.valid.clone())).unwrap();
-        let page = receive_before_deadline(&pool);
-        assert_eq!((page.width, page.height, page.request.tag), (100, 50, 77));
-        assert!(page.error.is_none());
-        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2);
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn a_slow_parse_is_not_a_timeout_and_its_pages_render() {
-        use std::time::Duration;
-        // Shared, then the private parsers used after a shared failure.
-        for private in [false, true] {
-            let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
-            if private {
-                *lock(&pool.shared.parser.state) = ParserState::Private;
-                pool.shared.parser.valid.store(false, Ordering::Release);
-            }
-            let gate = parse_gate();
-            *lock(&pool.shared.parse_gate) = Some(gate.clone());
-            pool.set_stuck_after(Duration::ZERO);
-            let requests = if private {
-                vec![RenderRequest { page: 0, scale: 1.0, tag: 60, ..Default::default() }]
-            } else {
-                vec![
-                    RenderRequest { page: 0, scale: 1.0, tag: 60, ..Default::default() },
-                    RenderRequest { page: 1, scale: 1.0, tag: 61, ..Default::default() },
-                ]
-            };
-            pool.set_queue(requests.clone());
-            gate.entered.wait();
-            assert!(pool.try_recv().is_none(), "the watchdog must leave parsing alone");
-            assert!(lock(&pool.shared.stuck).is_empty());
-            assert_eq!(*lock(&pool.retired_workers), 0);
-            assert!(!matches!(*lock(&pool.shared.parser.state), ParserState::Failed));
-            // Rendering gets its own deadline after initialization completes.
-            pool.set_stuck_after(Duration::from_secs(60));
-            gate.release.wait();
-            let mut pages: Vec<_> = (0..requests.len()).map(|_| receive_before_deadline(&pool)).collect();
-            pages.sort_by_key(|page| page.request.page);
-            for (page, request) in pages.iter().zip(&requests) {
-                assert!(page.error.is_none(), "{:?}", page.error);
-                assert_eq!((page.width, page.height, page.request.tag), (100, 50, request.tag));
-            }
-            if !private {
-                assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 1, "one shared parse");
-                assert!(matches!(*lock(&pool.shared.parser.state), ParserState::Ready(Some(_))));
-            }
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn shared_timeouts_retry_healthy_pages_privately_before_blacklisting() {
-        use std::time::Duration;
-        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
-        pool.set_stuck_after(Duration::ZERO);
-        let shared_bad = render_gate(0, true);
-        let shared_healthy = render_gate(1, true);
-        let private_bad = render_gate(0, false);
-        *lock(&pool.shared.render_gates) = vec![shared_bad.clone(), shared_healthy.clone(), private_bad.clone()];
-        pool.set_queue(vec![
-            RenderRequest { page: 0, scale: 1.0, tag: 40, ..Default::default() },
-            RenderRequest { page: 1, scale: 1.0, tag: 41, ..Default::default() },
-        ]);
-        shared_bad.entered.wait();
-        shared_healthy.entered.wait();
-        // This watchdog pass retries both pages privately. Page 1's retry has no gate, so on a
-        // loaded machine it can finish before this same call reads the results: that early
-        // answer is the healthy page, never a timeout error.
-        let early = pool.try_recv();
-        assert!(
-            early.as_ref().is_none_or(|page| page.request.page == 1 && page.error.is_none()),
-            "shared timeouts retry instead of answering with an error: {:?}",
-            early.as_ref().map(|page| (page.request.page, &page.error))
-        );
-        shared_bad.release.wait();
-        shared_healthy.release.wait();
-        shared_bad.finished.wait();
-        shared_healthy.finished.wait();
-        private_bad.entered.wait();
-        let healthy = match early {
-            Some(page) => page,
-            None => pool.results.recv_timeout(Duration::from_secs(30)).expect("healthy private retry"),
-        };
-        assert!(healthy.error.is_none(), "{:?}", healthy.error);
-        assert_eq!((healthy.request.page, healthy.width, healthy.height, healthy.request.tag), (1, 100, 50, 41));
-        pool.watchdog();
-        let bad = pool.results.recv_timeout(Duration::from_secs(30)).expect("the held private retry times out");
-        assert!(bad.error.as_deref().is_some_and(|message| message.contains("took longer")));
-        assert_eq!(bad.request.page, 0);
-        private_bad.release.wait();
-        private_bad.finished.wait();
-        assert!(lock(&pool.shared.stuck).contains(&RequestFailureKey::from(RenderRequest { page: 0, scale: 1.0, tag: 40, ..Default::default() })));
-        assert!(!lock(&pool.shared.stuck).contains(&RequestFailureKey::from(RenderRequest { page: 1, scale: 1.0, tag: 41, ..Default::default() })));
-        assert!((2..=3).contains(&pool.shared.parses.load(Ordering::Relaxed)), "one shared parser and one or two reusable private parsers");
-        assert!(lock(&pool._workers).len() <= 4, "the existing replacement cap is unchanged");
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn exhausted_private_retry_budget_reports_pending_and_future_requests() {
-        use std::time::Duration;
-        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        pool.set_stuck_after(Duration::ZERO);
-        let shared = render_gate(0, true);
-        let private = render_gate(0, false);
-        *lock(&pool.shared.render_gates) = vec![shared.clone(), private.clone()];
-        let bad = RenderRequest { page: 0, scale: 1.0, tag: 50, ..Default::default() };
-        let healthy = RenderRequest { page: 1, scale: 1.0, tag: 51, ..Default::default() };
-        pool.set_queue(vec![bad]);
-        shared.entered.wait();
-        assert!(pool.try_recv().is_none(), "shared timeout schedules the private retry");
-        shared.release.wait();
-        shared.finished.wait();
-        private.entered.wait();
-        pool.set_queue(vec![bad, healthy]);
-        let bad_result = receive_before_deadline(&pool);
-        assert_eq!(bad_result.request, bad);
-        assert!(bad_result.error.as_deref().is_some_and(|message| message.contains("took longer")));
-        let exhausted = receive_before_deadline(&pool);
-        assert_eq!(exhausted.request, healthy);
-        assert!(exhausted.error.as_deref().is_some_and(|message| message.contains("all render workers") && message.contains("reopen")));
-        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2);
-        assert_eq!(lock(&pool._workers).len(), 2, "no threads beyond the original replacement cap");
-        assert!(!lock(&pool.shared.stuck).contains(&RequestFailureKey::from(healthy)), "the healthy page itself is not blacklisted");
-        let later = RenderRequest { tag: 52, ..healthy };
-        pool.set_queue(vec![later]);
-        let result = receive_before_deadline(&pool);
-        assert_eq!(result.request, later);
-        assert!(result.error.as_deref().is_some_and(|message| message.contains("all render workers")));
-        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2, "exhaustion performs no parser work on the consumer");
-        let workers = std::mem::take(&mut *lock(&pool._workers));
-        private.release.wait();
-        private.finished.wait();
-        for worker in workers {
-            worker.join().unwrap();
-        }
-        assert!(pool.try_recv().is_none());
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn a_failed_page_stays_refused_at_every_scale_and_generation_but_other_pages_render() {
-        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        let bad = RenderRequest { page: 0, scale: 1.0, tag: 70, ..Default::default() };
-        lock(&pool.shared.stuck).insert(bad.into());
-        for req in [bad, RenderRequest { scale: 0.5, tag: 71, ..bad }, RenderRequest { tile: Some(Tile { x: 0, y: 0, w: 8, h: 8 }), tag: 72, ..bad }]
-        {
-            pool.set_queue(vec![req]);
-            let failed = receive_before_deadline(&pool);
-            assert_eq!(failed.request, req);
-            assert!(failed.error.as_deref().is_some_and(|message| message.contains("skipped earlier")), "{req:?}: {:?}", failed.error);
-        }
-        let other = RenderRequest { page: 1, scale: 0.5, tag: 73, ..Default::default() };
-        pool.set_queue(vec![other]);
-        let rendered = receive_before_deadline(&pool);
-        assert_eq!(rendered.request, other);
-        assert!(rendered.error.is_none(), "another page still renders: {:?}", rendered.error);
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn replacing_a_request_during_initialization_skips_its_obsolete_render() {
-        use std::time::Duration;
-        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        let gate = parse_gate();
-        *lock(&pool.shared.parse_gate) = Some(gate.clone());
-        pool.set_stuck_after(Duration::ZERO);
-        pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, tag: 10, ..Default::default() }]);
-        gate.entered.wait();
-        pool.set_queue(vec![RenderRequest { page: 1, scale: 1.0, tag: 11, ..Default::default() }]);
-        assert!(pool.try_recv().is_none(), "parsing is still held");
-        pool.set_stuck_after(Duration::from_secs(60));
-        gate.release.wait();
-        let page = receive_before_deadline(&pool);
-        assert_eq!((page.request.page, page.request.tag), (1, 11));
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (100, 50));
-        assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 1, "the useful parser is retained");
-        assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 1, "obsolete page was skipped before rendering");
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn idle_and_skipped_workers_release_source_without_parsing() {
-        for skipped in [false, true] {
-            let shared = Arc::new(Shared::default());
-            if skipped {
-                let req = RenderRequest { page: 0, ..Default::default() };
-                shared.queue.replace(vec![req]);
-                lock(&shared.stuck).insert(req.into());
-            }
-            let bytes = Arc::new(ONE_PAGE.to_vec());
-            let source = Arc::downgrade(&bytes);
-            let (wake_tx, wake_rx) = sync_channel(1);
-            let out = shared.queue.clone();
-            let results = ResultReceiver(shared.queue.clone());
-            // A dropped pool disconnects this channel. Running synchronously makes this check
-            // deterministic even when a worker starts after the pool has already been replaced.
-            drop(wake_tx);
-            worker(0, bytes, RenderConfig::default(), shared.clone(), wake_rx, out, Arc::new(std::sync::atomic::AtomicBool::new(false)));
-            assert_eq!(shared.parses.load(std::sync::atomic::Ordering::Relaxed), 0);
-            assert!(source.upgrade().is_none(), "retired workers release their source bytes");
-            if skipped {
-                assert!(results.try_recv().unwrap().error.as_deref().is_some_and(|e| e.contains("skipped earlier")));
-            }
-            assert!(results.try_recv().is_err());
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn worker_reuses_parser_and_releases_source_after_rendering() {
-        let bytes = Arc::new(ONE_PAGE.to_vec());
-        let source = Arc::downgrade(&bytes);
-        let pool = RenderPool::new(bytes, 1, RenderConfig::default());
-        assert!(!pool.is_inline(), "the lifecycle check needs a native worker");
-        for (tag, kind) in [RequestKind::Pixels, RequestKind::Text, RequestKind::Pixels].into_iter().enumerate() {
-            pool.set_queue(vec![RenderRequest { page: 0, kind, scale: 1.0, tag: tag as u64, ..Default::default() }]);
-            let page = pool.results.recv_timeout(std::time::Duration::from_secs(8)).expect("worker result");
-            assert!(page.error.is_none(), "{:?}", page.error);
-            assert_eq!(page.request.tag, tag as u64);
-            match kind {
-                RequestKind::Pixels => assert_eq!((page.width, page.height), (100, 50)),
-                RequestKind::Text => assert!(page.text.is_some()),
-            }
-            assert_eq!(pool.shared.parses.load(std::sync::atomic::Ordering::Relaxed), 1, "requests reuse one parser");
-        }
-        assert_eq!(
-            pool.stats(),
-            RenderStats {
-                parser_builds: 1,
-                page_interpretations: 2,
-                render_requests: 3,
-                tile_requests: 0,
-                text_interpretations: 1,
-                rasterizations: 2
-            }
-        );
-        drop(pool);
-        let until = std::time::Instant::now() + std::time::Duration::from_secs(8);
-        while source.upgrade().is_some() {
-            assert!(std::time::Instant::now() < until, "dropped pools retire their workers and release the source");
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-    }
-
-    /// Public-API regressions run in normal workspace CI; dependency unit tests do not.
-    fn function_limits_calculator_eval(program: &str) -> Option<Vec<f32>> {
-        use hayro::hayro_interpret::Function;
-        use hayro_syntax::object::{FromBytes, Object};
-        let data = format!("<< /FunctionType 4 /Domain [] /Length {} >> stream\n{program}\nendstream", program.len());
-        let object = Object::from_bytes(data.as_bytes()).unwrap();
-        Function::new(&object)?.eval(Default::default()).map(|values| values.to_vec())
-    }
-
-    #[test]
-    fn function_limits_idiv_zero_is_refused() {
-        assert!(function_limits_calculator_eval("{ 1 0 idiv }").is_none());
-    }
-
-    #[test]
-    fn function_limits_idiv_overflow_is_refused() {
-        assert!(function_limits_calculator_eval("{ -2147483648 -1 idiv }").is_none());
-    }
-
-    #[test]
-    fn function_limits_large_logical_shifts_discard_all_bits() {
-        for shift in [32, -32, 2147483647, -2147483648] {
-            assert_eq!(function_limits_calculator_eval(&format!("{{ 7 {shift} bitshift }}")), Some(vec![0.0]));
-        }
-        assert_eq!(function_limits_calculator_eval("{ 1073741824 1 bitshift }"), Some(vec![-2147483648.0]));
-        assert_eq!(function_limits_calculator_eval("{ -2147483648 -1 bitshift }"), Some(vec![1073741824.0]));
-    }
-
-    #[test]
-    fn function_limits_rotation_accepts_the_most_negative_integer() {
-        assert_eq!(function_limits_calculator_eval("{ 1 2 3 3 -2147483648 roll }"), Some(vec![3.0, 1.0, 2.0]));
-    }
-
-    #[test]
-    fn function_limits_large_indices_are_refused() {
-        assert!(function_limits_calculator_eval("{ 1 4294967295 index }").is_none());
-    }
-
-    #[test]
-    fn function_limits_operand_stack_boundary() {
-        assert_eq!(function_limits_calculator_eval(&format!("{{ 1 {} }}", "dup ".repeat(63))).unwrap().len(), 64);
-        assert!(function_limits_calculator_eval(&format!("{{ 1 {} }}", "dup ".repeat(64))).is_none());
-    }
-
-    #[test]
-    fn function_limits_calculator_arithmetic_and_depth() {
-        for (program, expected) in [
-            ("{ -5 2 idiv }", vec![-2.0]),
-            ("{ 7 3 bitshift }", vec![56.0]),
-            ("{ 142 -3 bitshift }", vec![17.0]),
-            ("{ 1 2 3 3 -1 roll }", vec![2.0, 3.0, 1.0]),
-        ] {
-            assert_eq!(function_limits_calculator_eval(program), Some(expected));
-        }
-        let mut program = "{ 0 }".to_owned();
-        for _ in 1..64 {
-            program = format!("{{ true {program} if }}");
-        }
-        assert_eq!(function_limits_calculator_eval(&program), Some(vec![0.0]));
-        assert!(function_limits_calculator_eval(&format!("{{ true {program} if }}")).is_none());
-    }
-
-    #[test]
-    fn function_limits_calculator_work_boundary() {
-        // With no loops, each admitted operator can execute at most once. The exact parse
-        // boundary can be evaluated, while construction rejects the next operator.
-        assert_eq!(function_limits_calculator_eval(&format!("{{ {} }}", "0 pop ".repeat(5000))), Some(vec![]));
-        assert!(function_limits_calculator_eval(&format!("{{ {} 0 }}", "0 pop ".repeat(5000))).is_none());
-    }
-
-    #[test]
-    fn function_limits_calculator_work_counts_unselected_branches() {
-        // 9,996 branch operators + two procedure openings + true + ifelse = 10,000 tokens.
-        let branch = "0 pop ".repeat(2499);
-        assert_eq!(function_limits_calculator_eval(&format!("{{ true {{ {branch} }} {{ {branch} }} ifelse }}")), Some(vec![]));
-        assert!(function_limits_calculator_eval(&format!("{{ true {{ {branch} }} {{ {branch} 0 }} ifelse }}")).is_none());
-    }
-    #[test]
-    fn function_limits_public_construction_work_and_depth() {
-        use hayro::hayro_interpret::Function;
-        use hayro_syntax::object::{FromBytes, Object};
-
-        let mut data = "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >>".to_owned();
-        for _ in 1..64 {
-            data = format!("<< /FunctionType 3 /Domain [0 1] /Functions [{data}] /Bounds [] /Encode [0 1] >>");
-        }
-        let object = Object::from_bytes(data.as_bytes()).unwrap();
-        assert_eq!(Function::new(&object).unwrap().eval([0.5].into_iter().collect()).unwrap().as_slice(), &[0.5]);
-        let over = format!("<< /FunctionType 3 /Domain [0 1] /Functions [{data}] /Bounds [] /Encode [0 1] >>");
-        // The 64 functions above nest exactly 128 levels (each dictionary and its /Functions
-        // array, then the leaf's /Domain array), the parser's nesting cap. 65 nest 130, so the
-        // parser refuses them before the function-depth guard sees them (a refusal either way).
-        // `function_limits_depth_guard_refuses_a_chain_of_references` tests the guard itself.
-        assert!(Object::from_bytes(over.as_bytes()).is_none(), "the parser refuses direct nesting past its cap");
-
-        // One root plus 10,000 leaves is one node past the common budget. This input remains
-        // below a megabyte and does not attempt excessive recursion or an allocation failure.
-        let leaf = "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> ";
-        for children in [9999, 10_000] {
-            let data = format!(
-                "<< /FunctionType 3 /Domain [0 1] /Functions [{}] /Bounds [{}] /Encode [{}] >>",
-                leaf.repeat(children),
-                "0.5 ".repeat(children - 1),
-                "0 1 ".repeat(children)
-            );
-            let object = Object::from_bytes(data.as_bytes()).unwrap();
-            assert_eq!(Function::new(&object).is_some(), children == 9999);
-        }
-    }
-    /// Stitching functions that each name the next through `N 0 R` nest no direct objects, so
-    /// the parser's nesting cap doesn't stop them and the function-depth guard does.
-    #[test]
-    fn function_limits_depth_guard_refuses_a_chain_of_references() {
-        use hayro::hayro_interpret::Function;
-        use hayro_syntax::object::{Object, ObjectIdentifier};
-        for functions in [64, 65] {
-            // Objects 4 onwards: each stitching function names the next one; the last is a leaf.
-            let objects: String = (4..4 + functions)
-                .map(|number| {
-                    let body = if number < 3 + functions {
-                        format!("<< /FunctionType 3 /Domain [0 1] /Functions [{} 0 R] /Bounds [] /Encode [0 1] >>", number + 1)
-                    } else {
-                        "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >>".to_owned()
-                    };
-                    format!("{number} 0 obj {body} endobj\n")
-                })
-                .collect();
-            let parsed = hayro_syntax::Pdf::new(
-                format!(
-                    "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                     2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-                     3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
-                     {objects}trailer << /Root 1 0 R >>\n%%EOF"
-                )
-                .into_bytes(),
-            )
-            .unwrap();
-            let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
-            let function = Function::new(&object);
-            if functions == 64 {
-                assert_eq!(function.unwrap().eval([0.5].into_iter().collect()).unwrap().as_slice(), &[0.5]);
-            } else {
-                assert!(function.is_none(), "65 functions are one past the function-depth guard");
-            }
-        }
-    }
-    #[test]
-    fn function_limits_stitching_cycles_are_refused_and_shared_children_work() {
-        use hayro::hayro_interpret::Function;
-        use hayro_syntax::object::{Object, ObjectIdentifier};
-
-        let pdf = |functions: &str| {
-            hayro_syntax::Pdf::new(
-                format!(
-                    "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
-             {functions}\ntrailer << /Root 1 0 R >>\n%%EOF"
-                )
-                .into_bytes(),
-            )
-            .unwrap()
-        };
-        for functions in [
-            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [4 0 R] /Bounds [] /Encode [0 1] >> endobj",
-            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R] /Bounds [] /Encode [0 1] >> endobj\n5 0 obj << /FunctionType 3 /Domain [0 1] /Functions [4 0 R] /Bounds [] /Encode [0 1] >> endobj",
-            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [] /Bounds [] /Encode [] >> endobj",
-            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [99 0 R] /Bounds [] /Encode [0 1] >> endobj",
-            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R 99 0 R] /Bounds [0.5] /Encode [0 1 0 1] >> endobj\n5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj",
-        ] {
-            let parsed = pdf(functions);
-            let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
-            assert!(Function::new(&object).is_none(), "accepted invalid children: {functions}");
-        }
-        let parsed = pdf(
-            "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R 5 0 R] /Bounds [0.5] /Encode [0 1 0 1] >> endobj\n5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj",
-        );
-        let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
-        let function = Function::new(&object).unwrap();
-        let output = function.eval([0.75].into_iter().collect()).unwrap();
-        assert!((output[0] - 0.5).abs() < 0.001);
-    }
-
-    #[test]
-    fn function_limits_shared_references_count_toward_construction_work() {
-        use hayro::hayro_interpret::Function;
-        use hayro_syntax::object::{Object, ObjectIdentifier};
-        for children in [9999, 10_000] {
-            let bytes = format!(
-                "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
-                 4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [{}] /Bounds [{}] /Encode [{}] >> endobj\n\
-                 5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj\n\
-                 trailer << /Root 1 0 R >>\n%%EOF",
-                "5 0 R ".repeat(children),
-                "0.5 ".repeat(children - 1),
-                "0 1 ".repeat(children)
-            )
-            .into_bytes();
-            let parsed = hayro_syntax::Pdf::new(bytes).unwrap();
-            let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
-            assert_eq!(Function::new(&object).is_some(), children == 9999);
-        }
-    }
-    #[test]
-    fn function_limits_invalid_calculator_keeps_the_page_renderable() {
-        use super::*;
-        let program = "{ pop 1 0 idiv }";
-        let content = "/S sh 0 0 1 rg 0 0 20 20 re f";
-        let bytes = format!(
-            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] /Resources << /Shading << /S 4 0 R >> >> /Contents 6 0 R >> endobj\n\
-             4 0 obj << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 20 0] /Function 5 0 R >> endobj\n\
-             5 0 obj << /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >> stream\n{program}\nendstream endobj\n\
-             6 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            program.len(),
-            content.len()
-        )
-        .into_bytes();
-        let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (20, 20));
-        let (pixels, remainder) = page.rgba.as_chunks::<4>();
-        assert!(remainder.is_empty());
-        assert!(pixels.iter().all(|pixel| *pixel == [0, 0, 255, 255]));
-    }
-    /// #1203: a /Lab colour space must honour its own /WhitePoint. The old path
-    /// fed every Lab value to the ICC transform as if the white point were D50,
-    /// shifting non-D50 pages several levels per channel (for example a D65
-    /// blue came out 45 levels too red). Conversion and expected values follow
-    /// ISO 32000-2 §8.6.5.4 with the space's own /WhitePoint [0.9505 1 1.089].
-    #[test]
-    fn lab_honours_the_space_white_point() {
-        use super::*;
-        let render = |l: f32, a: f32, b: f32| -> [u8; 4] {
-            let content = format!("/L cs {l} {a} {b} sc 0 0 200 200 re f");
-            let bytes = format!(
-                "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /L [/Lab << /WhitePoint [0.9505 1 1.089] /Range [-100 100 -100 100] >>] >> >> /Contents 4 0 R >> endobj\n\
-                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-                 trailer << /Root 1 0 R >>\n%%EOF",
-                content.len()
-            )
-            .into_bytes();
-            let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
-                page: 0,
-                kind: RequestKind::Pixels,
-                tile: None,
-                scale: 1.0,
-                tag: 0,
-                preview: false,
-            });
-            assert!(page.error.is_none(), "Lab ({l} {a} {b}): {:?}", page.error);
-            assert_eq!((page.width, page.height), (200, 200));
-            page.rgba[(100 * page.width as usize + 100) * 4..][..4].try_into().unwrap()
-        };
-
-        for (l, a, b, expected) in [
-            (40.0, 20.0, -60.0, [19, 90, 194, 255]),
-            (70.0, -50.0, 30.0, [77, 193, 114, 255]),
-            (60.0, 0.0, -40.0, [87, 148, 215, 255]),
-            (50.0, 60.0, 40.0, [217, 61, 55, 255]),
-            (30.0, 40.0, 20.0, [130, 37, 42, 255]),
-        ] {
-            let got = render(l, a, b);
-            for (channel, (got, want)) in got.iter().zip(expected).enumerate() {
-                assert!((*got).abs_diff(want) <= 2, "Lab ({l} {a} {b}) channel {channel}: got {got:?}, expected {expected:?}");
-            }
-        }
-    }
-    /// #1203: an `/Indexed` palette over Lab looks its entries up as
-    /// `byte / 255`, which must map onto L* 0..100 and the a*/b* /Range. They
-    /// were read as raw L*a*b* (L* below 1), so such palettes drew near black.
-    #[test]
-    fn indexed_palettes_over_lab_keep_their_colours() {
-        use super::*;
-        let lab = "[/Lab << /WhitePoint [0.9505 1 1.089] /Range [-100 100 -100 100] >>]";
-        let render = |content: &str| -> [u8; 4] {
-            let bytes = format!(
-                "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /L {lab} /I [/Indexed {lab} 1 <000000 80CCB2>] >> >> /Contents 4 0 R >> endobj\n\
-                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-                 trailer << /Root 1 0 R >>\n%%EOF",
-                content.len()
-            )
-            .into_bytes();
-            let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
-                page: 0,
-                kind: RequestKind::Pixels,
-                tile: None,
-                scale: 1.0,
-                tag: 0,
-                preview: false,
-            });
-            assert!(page.error.is_none(), "{content}: {:?}", page.error);
-            assert_eq!((page.width, page.height), (200, 200));
-            let start = (100 * page.width as usize + 100) * 4;
-            let mut pixel = [0; 4];
-            pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
-            pixel
-        };
-
-        // Palette entry 1 is <80 CC B2>: L* = 128/255·100, a* = -100 + 204/255·200,
-        // b* = -100 + 178/255·200, about Lab (50.2 60 39.6): a warm red.
-        let indexed = render("/I cs 1 sc 0 0 200 200 re f");
-        let direct = render(&format!(
-            "/L cs {} {} {} sc 0 0 200 200 re f",
-            128.0 / 255.0 * 100.0,
-            -100.0 + 204.0 / 255.0 * 200.0,
-            -100.0 + 178.0 / 255.0 * 200.0
-        ));
-        for (channel, (got, want)) in indexed.iter().zip(direct).enumerate() {
-            assert!(got.abs_diff(want) <= 1, "channel {channel}: indexed {indexed:?}, direct {direct:?}");
-        }
-        assert!(indexed[0] > 180, "the palette red must not render near black: {indexed:?}");
-    }
-    #[test]
-    fn watchdog_skips_a_stuck_page_and_keeps_rendering() {
-        use super::*;
-        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        // Exercise the original private-worker replacement guarantee. Shared
-        // contention gets one isolated attempt, covered by the tests above.
-        *lock(&pool.shared.parser.state) = ParserState::Private;
-        pool.shared.parser.valid.store(false, Ordering::Release);
-        pool.set_stuck_after(std::time::Duration::ZERO);
-        let gate = render_gate(0, false);
-        *lock(&pool.shared.render_gates) = vec![gate.clone()];
-        let req = |page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() };
-        pool.set_queue(vec![req(0)]);
-        gate.entered.wait();
-        let first = pool.try_recv().expect("the watchdog answers while the render is held");
-        assert!(first.error.as_deref().is_some_and(|e| e.contains("took longer")), "{:?}", first.error);
-        // A zero allowance would give up on the healthy page 2 as well.
-        pool.set_stuck_after(std::time::Duration::from_secs(60));
-        // The single worker is stuck, yet page 2 still renders (on the replacement worker).
-        pool.set_queue(vec![req(1)]);
-        let second = receive_before_deadline(&pool);
-        assert!(second.error.is_none() && second.request.page == 1, "{:?}", second.error);
-        // Asking for the stuck page again fails fast instead of trapping another worker.
-        pool.set_queue(vec![req(0)]);
-        let again = receive_before_deadline(&pool);
-        assert!(again.error.as_deref().is_some_and(|e| e.contains("skipped earlier")), "{:?}", again.error);
-        // The released worker notices its slot was cleared; its late result is dropped.
-        gate.release.wait();
-        gate.finished.wait();
-        assert!(pool.try_recv().is_none());
-    }
-
-    #[test]
-    fn a_request_being_rendered_is_not_rendered_again() {
-        use super::*;
-        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
-        let gate = render_gate(0, true);
-        *lock(&pool.shared.render_gates) = vec![gate.clone()];
-        let req = |page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() };
-        pool.set_queue(vec![req(0)]);
-        gate.entered.wait();
-        // What the canvas sends next: the page it is still waiting for, then another one.
-        pool.set_queue(vec![req(0), req(1)]);
-        let other = receive_before_deadline(&pool);
-        assert!(other.error.is_none(), "{:?}", other.error);
-        assert_eq!(other.request.page, 1);
-        // Page 2 went to the idle worker instead of waiting behind a second copy of page 1.
-        assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 2, "each page rendered once");
-        gate.release.wait();
-        let first = receive_before_deadline(&pool);
-        assert!(first.error.is_none(), "{:?}", first.error);
-        assert_eq!(first.request.page, 0);
-        assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 2, "each page rendered once");
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn replacing_an_in_flight_request_does_not_delay_the_replacement() {
-        use super::*;
-        use std::time::{Duration, Instant};
-
-        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        let a = RenderRequest { page: 0, scale: 0.5, tag: 101, ..Default::default() };
-        let b = RenderRequest { page: 1, scale: 0.5, tag: 102, ..Default::default() };
-        *lock(&pool.shared.slow_page) = Some((a.page, Duration::from_secs(10)));
-        pool.set_queue(vec![a]);
-
-        let started = Instant::now();
-        while pool.shared.render_started.load(Ordering::Relaxed) == 0 {
-            assert!(started.elapsed() < Duration::from_secs(2), "request A never started");
-            std::thread::sleep(Duration::from_millis(1));
-        }
-
-        let replaced = Instant::now();
-        pool.set_queue(vec![b]);
-        assert!(lock(&pool.shared.busy).iter().flatten().any(|busy| busy.cancelled.load(Ordering::Acquire)), "request A was not cancelled");
-        let page = receive_before_deadline(&pool);
-        assert_eq!(page.request, b);
-        assert!(page.error.is_none(), "replacement request failed: {:?}", page.error);
-        assert!(replaced.elapsed() < Duration::from_secs(3), "obsolete request A delayed B");
-
-        let deadline = Instant::now() + Duration::from_millis(100);
-        while Instant::now() < deadline {
-            assert!(pool.try_recv().is_none(), "obsolete request produced a result");
-            std::thread::sleep(Duration::from_millis(5));
-        }
-    }
-
-    /// A request cancelled while its worker waited for the shared parse must not leave that
-    /// worker unable to render: the abort is not a parse result.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn a_request_cancelled_while_waiting_for_the_parse_leaves_its_worker_usable() {
-        use super::*;
-        use std::time::{Duration, Instant};
-
-        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
-        *lock(&pool.shared.slow_parse) = Some(Duration::from_millis(500));
-        let a = RenderRequest { page: 0, scale: 0.5, tag: 301, ..Default::default() };
-        let c = RenderRequest { page: 1, scale: 0.5, tag: 302, ..Default::default() };
-        pool.set_queue(vec![a, c]);
-        let started = Instant::now();
-        while lock(&pool.shared.busy).iter().flatten().count() < 2 {
-            assert!(started.elapsed() < Duration::from_secs(2), "both requests never started");
-            std::thread::sleep(Duration::from_millis(1));
-        }
-        *lock(&pool.shared.slow_parse) = None;
-        for round in 0..4u64 {
-            let x = RenderRequest { page: 0, scale: 0.5, tag: 400 + 2 * round, ..Default::default() };
-            let y = RenderRequest { page: 1, scale: 0.5, tag: 401 + 2 * round, ..Default::default() };
-            pool.set_queue(vec![x, y]);
-            for _ in 0..2 {
-                let page = receive_before_deadline(&pool);
-                assert!(page.request == x || page.request == y, "round {round}: obsolete {:?}", page.request);
-                assert!(page.error.is_none(), "round {round}: {:?}", page.error);
-            }
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn check_cancelled_parse_request_requeue(renew_before_abort: bool) {
-        use super::*;
-        use std::{sync::mpsc, time::Duration};
-
-        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        let a = RenderRequest { page: 0, kind: RequestKind::Text, scale: 1.0, tag: 501, ..Default::default() };
-        let b = RenderRequest { page: 1, scale: 1.0, tag: 502, ..Default::default() };
-        let parse = parse_gate();
-        *lock(&pool.shared.parse_gate) = Some(parse.clone());
-        let (entered_tx, entered_rx) = mpsc::channel();
-        let (release_tx, release_rx) = mpsc::channel();
-        *lock(&pool.shared.busy_publish_gate) = Some(BusyPublishGate { request: b, entered: entered_tx, release: Arc::new(Mutex::new(release_rx)) });
-
-        pool.set_queue(vec![a]);
-        parse.entered.wait();
-        pool.set_queue(vec![b]);
-        if renew_before_abort {
-            // B stays first so the worker reaches its gate even when aborting A requeues it.
-            pool.set_queue(vec![b, a]);
-        }
-        parse.release.wait();
-        entered_rx.recv_timeout(Duration::from_secs(2)).expect("the worker finished aborting A and reached B");
-        // The parse hook's lock can span its barrier waits; clear it only after parsing returned.
-        *lock(&pool.shared.parse_gate) = None;
-        if !renew_before_abort {
-            pool.set_queue(vec![a]);
-        }
-        // B holds the sole worker, so this observes queue admission without racing a worker pop.
-        let pending = pool.shared.queue.pop();
-        if let Some(request) = pending {
-            pool.shared.queue.retry(request);
-        }
-        pool.set_queue(vec![a]);
-        // Release the worker before the regression assertion, including on the unfixed baseline.
-        release_tx.send(()).unwrap();
-        assert_eq!(pending, Some(a), "aborting a parse must release its active request identity");
-
-        let page = receive_before_deadline(&pool);
-        assert_eq!(page.request, a);
-        assert!(page.error.is_none(), "renewed text request failed: {:?}", page.error);
-        assert!(page.text.is_some(), "the exact cancelled text request completed");
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn cancelled_parse_request_can_be_requested_again() {
-        check_cancelled_parse_request_requeue(false);
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn cancelled_parse_request_renewed_before_abort_is_requeued() {
-        check_cancelled_parse_request_requeue(true);
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn request_removed_before_busy_publication_skips_parser_acquisition() {
-        use std::{sync::mpsc, time::Duration};
-
-        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        let a = RenderRequest { page: 0, scale: 0.5, tag: 201, ..Default::default() };
-        let b = RenderRequest { page: 1, scale: 0.5, tag: 202, ..Default::default() };
-        let (entered_tx, entered_rx) = mpsc::channel();
-        let (release_tx, release_rx) = mpsc::channel();
-        *lock(&pool.shared.busy_publish_gate) = Some(BusyPublishGate { request: a, entered: entered_tx, release: Arc::new(Mutex::new(release_rx)) });
-
-        pool.set_queue(vec![a]);
-        entered_rx.recv_timeout(Duration::from_secs(2)).expect("request A passed its first obsolescence check");
-        assert!(!lock(&pool.shared.busy).iter().flatten().any(|busy| same_request(busy.request, a)));
-        pool.set_queue(vec![b]);
-        release_tx.send(()).unwrap();
-
-        let page = receive_before_deadline(&pool);
-        assert_eq!(page.request, b);
-        assert!(page.error.is_none(), "replacement request failed: {:?}", page.error);
-        assert_eq!(*lock(&pool.shared.parser_stage_entries), vec![b], "obsolete A must not enter parser acquisition");
-        assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 1, "only replacement B is rasterized");
-        assert!(pool.try_recv().is_none(), "obsolete request A did not publish a stale result");
-    }
-
-    #[test]
-    fn re_sent_queues_render_each_page_once() {
-        use super::*;
-        let pages = 12;
-        let mut pdf = format!(
-            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 200 200] >> endobj\n",
-            (0..pages).map(|i| format!("{} 0 R", 4 + i)).collect::<Vec<_>>().join(" ")
-        );
-        let body: String = (0..3000).map(|k| format!("{} {} 5 5 re f\n", k * 7 % 195, k * 13 % 195)).collect();
-        pdf += &format!("3 0 obj << /Length {} >> stream\n{body}endstream endobj\n", body.len());
-        for i in 0..pages {
-            pdf += &format!("{} 0 obj << /Type /Page /Parent 2 0 R /Contents 3 0 R >> endobj\n", 4 + i);
-        }
-        pdf += "trailer << /Root 1 0 R >>\n%%EOF";
-        let pool = RenderPool::new(Arc::new(pdf.into_bytes()), 3, RenderConfig::default());
-        let wanted: Vec<RenderRequest> = (0..pages)
-            .map(|page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 2000, ..Default::default() })
-            .collect();
-        // The canvas's loop: take what arrived, then queue every page still missing whenever
-        // that list changes (requests already rendering included).
-        let mut got = vec![0; pages];
-        let mut last = Vec::new();
-        let t = std::time::Instant::now();
-        while got.contains(&0) || lock(&pool.shared.busy).iter().any(Option::is_some) {
-            assert!(t.elapsed() < std::time::Duration::from_secs(30), "rendered so far: {got:?}");
-            while let Some(p) = pool.try_recv() {
-                assert!(p.error.is_none(), "{:?}", p.error);
-                got[p.request.page] += 1;
-            }
-            let queue: Vec<RenderRequest> = wanted.iter().copied().filter(|r| got[r.page] == 0).collect();
-            if queue != last {
-                pool.set_queue(queue.clone());
-                last = queue;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(1));
-        }
-        while let Some(p) = pool.try_recv() {
-            got[p.request.page] += 1;
-        }
-        assert_eq!(got, vec![1; pages]);
-        assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), pages, "no duplicated work was hidden by delivery filtering");
-    }
-
-    #[test]
-    fn effective_scale_never_exceeds_the_caps() {
-        for (w, h, s) in [(934_775_807.0, 792.0, 0.25), (612.0, 792.0, 0.0), (1.0e9, 1.0e9, 1.0), (612.0, 792.0, 2.0)] {
-            let k = super::effective_scale(w, h, s);
-            assert!(k > 0.0 && k.is_finite(), "{w}×{h} @ {s}: {k}");
-            assert!(w * k <= super::MAX_SIDE + 1.0 && h * k <= super::MAX_SIDE + 1.0, "{w}×{h} @ {s}: {k}");
-            assert!(w * k * h * k <= super::MAX_PIXELS * 1.01, "{w}×{h} @ {s}: {k}");
-        }
-        assert_eq!(super::effective_scale(612.0, 792.0, 2.0), 2.0);
-    }
-
-    use super::*;
-
-    // Metadata-only: the test budget is 128 pixels and no image buffer is allocated.
-    #[test]
-    fn image_resampling_rejects_anisotropic_target_growth() {
-        assert_eq!(hayro::image_resampling_size(16, 1, 1, 16, 0.5, 32.0, 128, true), None);
-        assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 32.0, 128, true), None);
-        assert_eq!(hayro::image_resampling_size(16, 1, 4, 64, 0.5, 32.0, 128, true), None);
-    }
-
-    #[test]
-    fn image_resampling_bounds_intermediate_before_planning() {
-        // Source and destination are each 128 pixels, but their crossed dimensions are 256.
-        assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 0.5, 2.0, 128, true), None);
-    }
-
-    #[test]
-    fn image_resampling_rejects_invalid_sources_and_scales() {
-        assert_eq!(hayro::image_resampling_size(4, 4, 3, 47, 0.5, 0.5, 128, true), None);
-        assert_eq!(hayro::image_resampling_size(4, 4, 3, 49, 0.5, 0.5, 128, true), None);
-        for scale in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY, -1.0, 0.0] {
-            assert_eq!(hayro::image_resampling_size(4, 4, 3, 48, 0.5, scale, 128, true), None);
-        }
-    }
-
-    #[test]
-    fn image_resampling_keeps_valid_sizes_and_exact_limits() {
-        assert_eq!(hayro::image_resampling_size(16, 8, 1, 128, 0.5, 0.5, 128, true), Some((8, 4)));
-        assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 8.0, 128, true), Some((8, 8)));
-        assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 1.0, 1.0, 128, true), Some((16, 8)));
-        assert_eq!(hayro::image_resampling_size(0, 8, 1, 0, 1.0, 1.0, 128, true), None);
-        assert_eq!(hayro::image_resampling_size(16, 9, 1, 144, 1.0, 1.0, 128, true), None);
-        assert_eq!(hayro::image_resampling_size(65_536, 1, 1, 65_536, 1.0, 1.0, u64::MAX, true), None);
-        for channels in [1, 3, 4] {
-            assert_eq!(hayro::image_resampling_size(65_536, 1, channels, 65_536 * channels, 1.0 / 4096.0, 1.0, 65_536, true), Some((16, 1)));
-        }
-        assert_eq!(hayro::image_resampling_size(65_535, 1, 1, 65_535, 1.0, 1.0, 65_535, true), Some((65_535, 1)));
-        assert_eq!(hayro::image_resampling_size((1 << 20) + 1, 1, 1, (1 << 20) + 1, 1.0 / 4096.0, 1.0, 1 << 28, true), None);
-    }
-
-    #[test]
-    fn image_resampling_padded_backend_dimensions_stay_checked() {
-        // A Type 3 image's two-pixel frame may reach u16::MAX exactly, never wrap to zero.
-        assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5, true), Some((65_535, 5)));
-        assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5 - 1, true), None);
-        assert_eq!(hayro::image_resampling_size(65_532 + 4, 1 + 4, 4, 65_536 * 5 * 4, 1.0, 1.0, 1 << 28, true), None);
-    }
-
-    /// Nearest-neighbour copies source pixels and needs no filter tables, so a source wider than the
-    /// Catmull-Rom side cap still shrinks. The pixel budget applies to it all the same.
-    #[test]
-    fn image_resampling_nearest_accepts_wide_sources_the_filter_refuses() {
-        let wide: u32 = (1 << 20) + 1;
-        assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 1 << 28, true), None);
-        assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 1 << 28, false), Some((257, 1)));
-        assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 256, false), None);
-    }
-
-    fn strip_image_pdf(width: u32, body: &str, space: &str, encoded: &str, alpha: Option<&str>) -> Vec<u8> {
-        let (mask_ref, mask_obj) = match alpha {
-            Some(data) => (
-                "/SMask 6 0 R",
-                format!(
-                    "6 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n",
-                    data.len() + 1
-                ),
-            ),
-            None => ("", String::new()),
-        };
-        format!(
-            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 4] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{body}endstream endobj\n\
-             5 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height 1 /ColorSpace /{space} /BitsPerComponent 8 {mask_ref} /Filter /ASCIIHexDecode /Length {} >> stream\n{encoded}>\nendstream endobj\n\
-             {mask_obj}trailer << /Root 1 0 R >>\n%%EOF", body.len(), encoded.len() + 1,
-        ).into_bytes()
-    }
-
-    // Safe on the original renderer too: 192 KiB RGB / 64 KiB gray sources shrink to 16 pixels.
-    #[test]
-    fn image_resampling_wide_sources_shrink_before_backend_side_limits() {
-        for (space, encoded, expected) in
-            [("DeviceRGB", "ff0000".repeat(65_536), [255, 0, 0, 255]), ("DeviceGray", "7f".repeat(65_536), [127, 127, 127, 255])]
-        {
-            let pdf = strip_image_pdf(65_536, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", space, &encoded, None);
-            let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-            assert!(page.error.is_none(), "{space}: {:?}", page.error);
-            assert_eq!((page.width, page.height), (20, 4));
-            let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
-            assert_eq!(pixel(1), &[255, 255, 255, 255], "{space}: left placement");
-            assert_eq!(pixel(3), &expected, "{space}: source image was not dropped");
-            assert_eq!(pixel(17), &expected, "{space}: right placement");
-            assert_eq!(pixel(19), &[255, 255, 255, 255], "{space}: right placement");
-        }
-    }
-
-    #[test]
-    fn image_resampling_wide_transparent_sources_still_shrink() {
-        let data = "ff0000".repeat(65_536);
-        let alpha = "7f".repeat(65_536);
-        let pdf = strip_image_pdf(65_536, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceRGB", &data, Some(&alpha));
-        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (20, 4));
-        assert_eq!(&page.rgba[(20 + 3) * 4..][..4], &[255, 128, 128, 255]);
-    }
-
-    /// A source wider than the filter's 2^20-pixel side cap is shrunk by nearest-neighbour rather
-    /// than refused and skipped (the default, `/Interpolate` omitted, is nearest).
-    #[test]
-    fn wide_non_interpolated_sources_draw_after_shrinking() {
-        let data = "7f".repeat(1_100_000);
-        let pdf = strip_image_pdf(1_100_000, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceGray", &data, None);
-        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (20, 4));
-        let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
-        assert_eq!(pixel(1), &[255, 255, 255, 255]);
-        assert_eq!(pixel(3), &[127, 127, 127, 255], "source image was not dropped");
-        assert_eq!(pixel(17), &[127, 127, 127, 255]);
-        assert_eq!(pixel(19), &[255, 255, 255, 255]);
-    }
-
-    #[test]
-    fn image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement() {
-        let data = "ff0000".repeat(16);
-        let alpha = "7f".repeat(8);
-        let pdf = strip_image_pdf(16, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceRGB", &data, Some(&alpha));
-        let pdf = String::from_utf8(pdf)
-            .unwrap()
-            .replace("6 0 obj << /Type /XObject /Subtype /Image /Width 16", "6 0 obj << /Type /XObject /Subtype /Image /Width 8");
-        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (20, 4));
-        let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
-        assert_eq!(pixel(1), &[255, 255, 255, 255]);
-        assert_eq!(pixel(3), &[255, 128, 128, 255]);
-        assert_eq!(pixel(17), &[255, 128, 128, 255]);
-        assert_eq!(pixel(19), &[255, 255, 255, 255]);
-    }
-    // GREEN-only integration: the original renderer would attempt GiB buffers. The source is
-    // only 96 KiB, and the fixed guard rejects the target before the resampling plan/allocation.
-    #[test]
-    fn resampling_fallback_preserves_original_geometry_and_pixels() {
-        let data = "ff0000".repeat(32_767);
-        let body = "q 16383.5 0 0 1000000000 2 2 cm /Im0 Do Q\n";
-        let pdf = format!(
-            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{body}endstream endobj\n\
-             5 0 obj << /Type /XObject /Subtype /Image /Width 32767 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Interpolate true /Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            body.len(),
-            data.len() + 1,
-        );
-        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (20, 20));
-        let pixel = |x: usize, y: usize| &page.rgba[(y * 20 + x) * 4..][..4];
-        assert_eq!(pixel(0, 5), &[255, 255, 255, 255]);
-        assert_eq!(pixel(3, 5), &[255, 0, 0, 255]);
-        assert_eq!(pixel(19, 5), &[255, 0, 0, 255]);
-    }
-
-    const ONE_PAGE: &[u8] = b"%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
-4 0 obj << /Length 35 >> stream
-0 0 1 rg 10 10 30 20 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-
-    const ONE_PAGE_TWICE: &[u8] = b"%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
-4 0 obj << /Length 35 >> stream
-0 0 1 rg 10 10 30 20 re f
-endstream endobj
-5 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-
-    fn heavy_vector_pdf(commands: usize, text_at_end: bool) -> Vec<u8> {
-        let mut body = String::with_capacity(commands * 42 + 64);
-        for i in 0..commands {
-            let x = (i % 280) as u32;
-            let y = ((i / 280) % 280) as u32;
-            body.push_str(&format!("0 0 0 rg {x} {y} 1 1 re f\n"));
-        }
-        if text_at_end {
-            body.push_str("BT /F1 18 Tf 20 280 Td (TRAILING_MARKER) Tj ET\n");
-        }
-        format!(
-            "%PDF-1.4\n\
-             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{body}endstream endobj\n\
-             5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            body.len()
-        )
-        .into_bytes()
-    }
-
-    #[test]
-    fn heavy_vector_fixture_preserves_trailing_text_and_raster_output() {
-        let mut renderer = PageRenderer::new(Arc::new(heavy_vector_pdf(5_000, true)), RenderConfig::default());
-        let pixels = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
-        assert!(pixels.error.is_none(), "heavy vector render failed: {:?}", pixels.error);
-        assert!(pixels.rgba.as_chunks::<4>().0.iter().any(|pixel| *pixel != [255, 255, 255, 255]));
-        let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
-        assert!(text.error.is_none(), "heavy vector text failed: {:?}", text.error);
-        assert!(text.text.is_some_and(|page| page.plain_text().contains("TRAILING_MARKER")));
-        assert_eq!(
-            renderer.stats(),
-            RenderStats {
-                parser_builds: 1,
-                page_interpretations: 1,
-                render_requests: 2,
-                tile_requests: 0,
-                text_interpretations: 1,
-                rasterizations: 1
-            }
-        );
-    }
-
-    #[test]
-    fn large_resource_indexes_preserve_pixels_and_text() {
-        // #307: opening pages used to retain a hash table for every large resource
-        // dictionary on every page, even before rendering. The vendored lazy index
-        // must still resolve late keys, inherited resources and repeated renders.
-        fn fixture(large: bool) -> Vec<u8> {
-            let mut fonts = String::new();
-            let mut forms = String::new();
-            if large {
-                for i in 0..100 {
-                    fonts.push_str(&format!("/UnusedFont{i} 6 0 R "));
-                    forms.push_str(&format!("/UnusedForm{i} 7 0 R "));
-                }
-            }
-            let body = "BT /F1 12 Tf 10 55 Td (Shared resources) Tj ET q 1 0 0 1 10 10 cm /Last Do Q";
-            let form = "0 0 1 rg 0 0 30 20 re f";
-            format!(
-                "%PDF-1.7\n\
-                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R 8 0 R] /Count 2 /MediaBox [0 0 150 100] /Resources 5 0 R >> endobj\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n\
-                 4 0 obj << /Length {} >> stream\n{body}\nendstream endobj\n\
-                 5 0 obj << /Font << {fonts}/F1 6 0 R >> /XObject << {forms}/Last 7 0 R >> >> endobj\n\
-                 6 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n\
-                 7 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 20] /Length {} >> stream\n{form}\nendstream endobj\n\
-                 8 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources 5 0 R /Rotate 90 >> endobj\n\
-                 trailer << /Root 1 0 R >>\n%%EOF",
-                body.len(),
-                form.len()
-            )
-            .into_bytes()
-        }
-        let mut small = PageRenderer::new(Arc::new(fixture(false)), RenderConfig::default());
-        let mut large = PageRenderer::new(Arc::new(fixture(true)), RenderConfig::default());
-        for page in [0, 1, 0] {
-            for scale in [1.0, 2.0] {
-                let req = RenderRequest { page, scale, ..Default::default() };
-                let (a, b) = (small.render(req), large.render(req));
-                assert!(a.error.is_none() && b.error.is_none());
-                assert_eq!((a.width, a.height, &a.rgba), (b.width, b.height, &b.rgba));
-                assert!(b.rgba.as_chunks::<4>().0.contains(&[0, 0, 255, 255]));
-            }
-            let req = RenderRequest { page, kind: RequestKind::Text, ..Default::default() };
-            let (a, b) = (small.render(req), large.render(req));
-            assert!(a.error.is_none() && b.error.is_none());
-            assert_eq!(a.text.as_ref().unwrap().plain_text(), b.text.as_ref().unwrap().plain_text());
-            assert!(b.text.as_ref().unwrap().plain_text().contains("Shared resources"));
-        }
-    }
-
-    #[test]
-    fn shared_form_xobject_uses_each_pages_resource_context() {
-        let form = "/CS1 cs 0.5 0.5 0.5 sc 10 10 30 30 re f";
-        let page_content = "/F Do";
-        let pdf = format!(
-            "%PDF-1.7\n\
-             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R 6 0 R] /Count 2 /MediaBox [0 0 50 50] >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /Resources << /XObject << /F 4 0 R >> /ColorSpace << /CS1 /DeviceRGB >> >> /Contents 5 0 R >> endobj\n\
-             4 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 50 50] /Length {} >> stream\n{form}\nendstream endobj\n\
-             5 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n\
-             6 0 obj << /Type /Page /Parent 2 0 R /Resources << /XObject << /F 4 0 R >> /ColorSpace << /CS1 [/CalRGB << /WhitePoint [0.9505 1 1.089] /Gamma [2 2 2] /Matrix [1 0 0 0 1 0 0 0 1] >>] >> >> /Contents 7 0 R >> endobj\n\
-             7 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            form.len(),
-            page_content.len(),
-            page_content.len()
-        )
-        .into_bytes();
-        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let first = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
-        let second = renderer.render(RenderRequest { page: 1, scale: 1.0, ..Default::default() });
-        assert!(first.error.is_none() && second.error.is_none(), "{:?} / {:?}", first.error, second.error);
-
-        let pixel = |page: &RenderedPage| {
-            let offset = ((20 * page.width + 20) * 4) as usize;
-            [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
-        };
-        let first_pixel = pixel(&first);
-        let second_pixel = pixel(&second);
-        assert_ne!(first_pixel, second_pixel, "the same Form XObject must resolve /CS1 in each page's resources");
-        assert_ne!(first_pixel, [255, 255, 255, 255]);
-        assert_ne!(second_pixel, [255, 255, 255, 255]);
-    }
-
-    #[test]
-    fn shared_soft_mask_uses_each_inherited_resource_context() {
-        let page_body = "/A Do /B Do";
-        let form_a = "/GS gs 1 0 0 rg 0 0 40 40 re f";
-        let form_b = "/GS gs 0 0 1 rg 60 0 40 40 re f";
-        let mask_body = "/FILL Do";
-        let white = "1 g 0 0 100 100 re f";
-        let black = "0 g 0 0 100 100 re f";
-        let pdf = format!(
-            "%PDF-1.7\n\
-             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 100 100] >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /Resources << /XObject << /A 4 0 R /B 5 0 R >> >> /Contents 6 0 R >> endobj\n\
-             4 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Resources << /ExtGState << /GS 8 0 R >> /XObject << /FILL 9 0 R >> >> /Length {} >> stream\n{form_a}\nendstream endobj\n\
-             5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Resources << /ExtGState << /GS 8 0 R >> /XObject << /FILL 10 0 R >> >> /Length {} >> stream\n{form_b}\nendstream endobj\n\
-             6 0 obj << /Length {} >> stream\n{page_body}\nendstream endobj\n\
-             8 0 obj << /Type /ExtGState /SMask 11 0 R >> endobj\n\
-             9 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >> stream\n{white}\nendstream endobj\n\
-             10 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >> stream\n{black}\nendstream endobj\n\
-             11 0 obj << /Type /Mask /S /Luminosity /G 12 0 R >> endobj\n\
-             12 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /CS /DeviceGray >> /Length {} >> stream\n{mask_body}\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            form_a.len(),
-            form_b.len(),
-            page_body.len(),
-            white.len(),
-            black.len(),
-            mask_body.len()
-        )
-        .into_bytes();
-        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        let pixel = |x: u32, y: u32| {
-            let offset = ((y * page.width + x) * 4) as usize;
-            [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
-        };
-        assert_eq!(pixel(20, 80), [255, 0, 0, 255], "the white inherited mask makes form A visible");
-        assert_eq!(pixel(80, 80), [255, 255, 255, 255], "the black inherited mask must not reuse form A's cached pixels");
-    }
-
-    #[test]
-    fn renders_a_blue_rectangle() {
-        let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
-        pool.set_queue(vec![RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 7, ..Default::default() }]);
-        let page = loop {
-            if let Some(p) = pool.try_recv() {
-                break p;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        };
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height, page.request.tag), (100, 50, 7));
-        // Pixel (20, 30) in y-down device space is inside the rect drawn at y 10..30 (y-up).
-        let px = |x: u32, y: u32| &page.rgba[((y * page.width + x) * 4) as usize..][..4];
-        assert_eq!(px(20, 30), &[0, 0, 255, 255]);
-        assert_eq!(px(80, 5), &[255, 255, 255, 255]);
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn page_pixels_are_invariant_to_render_worker_count() {
-        let blue = "0 0 1 rg 10 10 30 20 re f";
-        let red = "1 0 0 rg 20 5 40 35 re f";
-        let pdf = format!(
-            "%PDF-1.4\n\
-             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 /MediaBox [0 0 100 50] >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{blue}\nendstream endobj\n\
-             5 0 obj << /Type /Page /Parent 2 0 R /Contents 6 0 R >> endobj\n\
-             6 0 obj << /Length {} >> stream\n{red}\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            blue.len(),
-            red.len()
-        )
-        .into_bytes();
-        let bytes = Arc::new(pdf);
-        let mut reference = PageRenderer::new(bytes.clone(), RenderConfig::default());
-        let expected: Vec<_> = (0..2).map(|page| reference.render(RenderRequest { page, scale: 1.0, ..Default::default() })).collect();
-        assert!(expected.iter().all(|page| page.error.is_none()));
-
-        for workers in [1, 2, 4] {
-            let pool = RenderPool::new(bytes.clone(), workers, RenderConfig::default());
-            pool.set_queue((0..2).map(|page| RenderRequest { page, scale: 1.0, ..Default::default() }).collect());
-            let mut actual = [receive_before_deadline(&pool), receive_before_deadline(&pool)];
-            actual.sort_by_key(|page| page.request.page);
-            for (page, (actual, expected)) in actual.iter().zip(&expected).enumerate() {
-                assert!(actual.error.is_none(), "{workers} workers, page {page}: {:?}", actual.error);
-                assert_eq!(
-                    (actual.width, actual.height, &actual.rgba),
-                    (expected.width, expected.height, &expected.rgba),
-                    "{workers} workers, page {page}"
-                );
-            }
-        }
-    }
-
-    #[test]
-    fn pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over() {
-        let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
-        let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, ..Default::default() });
-        assert!(out.error.is_none(), "{:?}", out.error);
-        // The same bytes as hayro's own render to a pixmap, with the same settings.
-        let pdf = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
-        let pages = pdf.pages();
-        let page = pages.first().expect("a page");
-        let rs = RenderSettings { x_scale: 2.0, y_scale: 2.0, width: Some(200), height: Some(100), bg_color: WHITE, ..Default::default() };
-        let plain = hayro::render(page, &RenderCache::new(), &RenderConfig::default().settings(), &rs);
-        assert_eq!((out.width, out.height), (200, 100));
-        assert_eq!(&*out.rgba, plain.data_as_u8_slice());
-        // Whole pixels, aligned, handed over without a copy.
-        let at = out.rgba.as_ptr();
-        assert_eq!(at as usize % 4, 0);
-        let words = out.rgba.into_words();
-        assert_eq!(words.as_ptr().cast::<u8>(), at);
-    }
-
-    #[test]
-    fn render_into_a_buffer_of_the_wrong_length_leaves_it_untouched() {
-        let pdf = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
-        let pages = pdf.pages();
-        let page = pages.first().expect("a page");
-        let rs = RenderSettings { width: Some(10), height: Some(10), bg_color: WHITE, ..Default::default() };
-        let settings = RenderConfig::default().settings();
-        for len in [0, 399, 401, 4000] {
-            let mut buf = vec![7u8; len];
-            render_into(page, &RenderCache::new(), &settings, &rs, &mut buf);
-            assert!(buf.iter().all(|&b| b == 7), "a {len}-byte buffer was written");
-        }
-    }
-
-    #[test]
-    fn missing_page_and_garbage_input_fail_gracefully() {
-        let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
-        assert!(r.render(RenderRequest { page: 9, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }).error.is_some());
-        let mut g = PageRenderer::new(Arc::new(b"not a pdf at all".to_vec()), RenderConfig::default());
-        assert_eq!(g.page_count(), 0);
-        assert!(g.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }).error.is_some());
-    }
-
-    #[test]
-    fn scale_is_clamped_for_huge_pages() {
-        // A 200-inch-square page at 4x would be 57,600 px per side.
-        let s = effective_scale(14_400.0, 14_400.0, 4.0);
-        assert!(14_400.0 * s <= MAX_SIDE + 0.5);
-        assert!((14_400.0 * s).powi(2) <= MAX_PIXELS * 1.01);
-    }
-
-    #[test]
-    fn strict_whole_page_render_refuses_cap_reduction_but_tiles_remain_available() {
-        let pdf = b"%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 14400 14400] /Contents 4 0 R >> endobj
-4 0 obj << /Length 0 >> stream
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let config = RenderConfig { reject_oversize: true, ..RenderConfig::default() };
-        let mut renderer = PageRenderer::new(Arc::new(pdf.to_vec()), config);
-        let whole = renderer.render(RenderRequest { page: 0, scale: 4.0, ..Default::default() });
-        assert!(whole.error.as_deref().is_some_and(|error| error.contains("exceeds renderer limits")));
-        let tile = renderer.render(RenderRequest { page: 0, tile: Some(Tile { x: 0, y: 0, w: 32, h: 32 }), scale: 4.0, ..Default::default() });
-        assert!(tile.error.is_none(), "tiled rendering must remain available: {:?}", tile.error);
-        assert_eq!((tile.width, tile.height), (32, 32));
-    }
-
-    fn allocation_budget_page(width: f32, height: f32, content: &str) -> Arc<Vec<u8>> {
-        Arc::new(format!("%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {width} {height}] /Contents 4 0 R >> endobj\n4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF", content.len()).into_bytes())
-    }
-
-    #[test]
-    fn rounded_pixel_budget_rejects_before_actual_allocation() {
-        use crate::pixels::allocation_probe::{Attempts, observe};
-        for reject_oversize in [false, true] {
-            let mut renderer = PageRenderer::new(allocation_budget_page(8000.5, 7999.5, ""), RenderConfig { reject_oversize, ..Default::default() });
-            assert_eq!(renderer.page_count(), 1);
-            let (out, attempts) = observe(|| renderer.render(RenderRequest { scale: 1.0, ..Default::default() }));
-            assert_eq!(attempts, Attempts::default(), "rounded over-cap raster reached allocator; strict={reject_oversize}");
-            assert_eq!(out.error.as_deref(), Some("page 1 raster size 8001x8000 exceeds renderer pixel limit"));
-            assert_eq!((out.width, out.height), (0, 0));
-            assert!(out.rgba.is_empty());
-            assert_eq!(renderer.stats().parser_builds, 1, "normal rejection must not trigger panic recovery");
-        }
-    }
-
-    #[test]
-    fn rounded_pixel_budget_allows_exact_cap_to_reach_allocator() {
-        use crate::pixels::allocation_probe::{Attempts, observe};
-        for reject_oversize in [false, true] {
-            let mut renderer = PageRenderer::new(allocation_budget_page(8000.0, 8000.0, ""), RenderConfig { reject_oversize, ..Default::default() });
-            let (out, attempts) = observe(|| renderer.render(RenderRequest { scale: 1.0, ..Default::default() }));
-            assert_eq!(attempts, Attempts { calls: 1, first: Some((8000, 8000)) });
-            // The test probe refuses the actual allocation: this is admission evidence,
-            // not a successful giant-raster rendering or a 256MB test allocation.
-            assert_eq!(out.error.as_deref(), Some("page 1 is too large to render"));
-            assert_eq!((out.width, out.height), (0, 0));
-            assert!(out.rgba.is_empty());
-            assert_eq!(renderer.stats().parser_builds, 1);
-        }
-    }
-
-    #[test]
-    fn rounded_pixel_budget_preserves_small_pixels_and_large_page_tiles() {
-        let mut previous = None;
-        for reject_oversize in [false, true] {
-            let config = RenderConfig { reject_oversize, ..Default::default() };
-            let mut small = PageRenderer::new(allocation_budget_page(16.0, 12.0, "0 0 1 rg 4 3 8 6 re f"), config.clone());
-            let out = small.render(RenderRequest { scale: 1.0, ..Default::default() });
-            assert!(out.error.is_none(), "{:?}", out.error);
-            assert_eq!((out.width, out.height), (16, 12));
-            let expected: Vec<u8> = (0..12)
-                .flat_map(|y| {
-                    (0..16).flat_map(move |x| if (4..12).contains(&x) && (3..9).contains(&y) { [0, 0, 255, 255] } else { [255, 255, 255, 255] })
-                })
-                .collect();
-            assert_eq!(&*out.rgba, expected.as_slice());
-            if let Some(previous) = &previous {
-                assert_eq!(previous, &out.rgba);
-            }
-            previous = Some(out.rgba);
-            let mut large = PageRenderer::new(allocation_budget_page(8000.5, 7999.5, ""), config);
-            let tile = large.render(RenderRequest { scale: 1.0, tile: Some(Tile { x: 0, y: 0, w: 32, h: 32 }), ..Default::default() });
-            assert!(tile.error.is_none(), "{:?}", tile.error);
-            assert_eq!((tile.width, tile.height), (32, 32));
-            assert_eq!(&*tile.rgba, &[255; 32 * 32 * 4]);
-            assert_eq!(large.stats().parser_builds, 1);
-        }
-    }
-
-    #[test]
-    fn rounded_pixel_budget_invalid_requests_never_reach_allocator() {
-        use crate::pixels::allocation_probe::{Attempts, observe};
-        for reject_oversize in [false, true] {
-            let mut renderer = PageRenderer::new(allocation_budget_page(16.0, 12.0, ""), RenderConfig { reject_oversize, ..Default::default() });
-            let (out, attempts) = observe(|| renderer.render(RenderRequest { page: 1, scale: 1.0, ..Default::default() }));
-            assert_eq!(attempts, Attempts::default());
-            assert!(out.error.is_some());
-            assert_eq!((out.width, out.height), (0, 0));
-            assert!(out.rgba.is_empty());
-            assert_eq!(renderer.stats().parser_builds, 1);
-        }
-        let mut renderer = PageRenderer::new(allocation_budget_page(16.0, 12.0, ""), RenderConfig { reject_oversize: true, ..Default::default() });
-        for scale in [0.0, -1.0, f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
-            let (out, attempts) = observe(|| renderer.render(RenderRequest { scale, ..Default::default() }));
-            assert_eq!(attempts, Attempts::default());
-            assert!(out.error.as_deref().is_some_and(|error| error.contains("exceeds renderer limits")));
-            assert_eq!((out.width, out.height), (0, 0));
-            assert!(out.rgba.is_empty());
-            assert_eq!(renderer.stats().parser_builds, 1);
-        }
-    }
-
-    /// Issue #102: an A4 page (595.28×841.89 pt) rendered 595×841 at 72 dpi, dropping the last
-    /// partial row and column. Like pdftoppm it is now 596×842, the edge pixels partly covered.
-    #[test]
-    fn fractional_page_sizes_round_up() {
-        let pdf = b"%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 595.28 841.89] /Contents 4 0 R >> endobj
-4 0 obj << /Length 31 >> stream
-0 0 1 rg 0 0 595.28 841.89 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
-        let req = RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() };
-        let p = r.render(req);
-        assert!(p.error.is_none(), "{:?}", p.error);
-        assert_eq!((p.width, p.height), (596, 842));
-        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        assert_eq!(px(594, 840), vec![0, 0, 255, 255]);
-        // The partial column and row blend the fill into the white page.
-        for (x, y) in [(595, 400), (300, 841), (595, 841)] {
-            let c = px(x, y);
-            assert!(c[0] < 255 && c[2] == 255, "({x}, {y}) is not partly covered: {c:?}");
-        }
-        assert_eq!(r.render(RenderRequest { scale: 300.0 / 72.0, ..req }).width, 2481);
-        // A tile over the corner draws the same edge pixels.
-        let t = r.render(RenderRequest { tile: Some(Tile { x: 594, y: 840, w: 2, h: 2 }), ..req });
-        assert_eq!((t.width, t.height), (2, 2));
-        assert_eq!(&t.rgba[12..16], &px(595, 841)[..]);
-        // Float noise doesn't add a row: Letter at 150 dpi is 1275 px wide.
-        assert_eq!((device_pixels(612.0, 150.0 / 72.0), device_pixels(0.2, 1.0), device_pixels(f32::NAN, 1.0)), (1275, 1, 1));
-    }
-
-    /// A checkbox whose `/AP /N` is a state dictionary must draw the `/AS` state; a NoView
-    /// annotation must not draw at all. (Regression test for the vendored hayro patch.)
-    #[test]
-    fn widget_appearance_states() {
-        let pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R 7 0 R] >> endobj
-4 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /T (cb) /V /Yes /AS /Yes /Rect [10 10 30 30]
-   /AP << /N << /Yes 5 0 R /Off 6 0 R >> >> >> endobj
-5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
-1 0 0 rg 0 0 20 20 re f
-endstream endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
-0 0 1 rg 0 0 20 20 re f
-endstream endobj
-7 0 obj << /Type /Annot /Subtype /Square /F 32 /Rect [60 60 90 90] /AP << /N 8 0 R >> >> endobj
-8 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 24 >> stream
-0 1 0 rg 0 0 30 30 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
-        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(p.error.is_none(), "{:?}", p.error);
-        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        assert_eq!(px(20, 80), vec![255, 0, 0, 255], "checkbox must show its /Yes state");
-        assert_eq!(px(75, 25), vec![255, 255, 255, 255], "NoView annotation must not be drawn");
-    }
-
-    /// Quartz writes `/AP /N` as an indirect dictionary of states, and the next object in
-    /// the file is often some other stream. That dictionary must not be read as that stream,
-    /// or the checkbox (whose real appearance is `/AS`) is skipped.
-    #[test]
-    fn indirect_appearance_state_dict_is_not_another_stream() {
-        let pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R] >> endobj
-4 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /T (cb) /V /Yes /AS /Yes /Rect [10 10 30 30]
-   /AP 9 0 R >> endobj
-9 0 obj << /N 10 0 R >> endobj
-10 0 obj << /Yes 5 0 R /Off 6 0 R >> endobj
-11 0 obj << /Length 24 >> stream
-0 0 1 rg 0 0 20 20 re f
-endstream
-endobj
-5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
-1 0 0 rg 0 0 20 20 re f
-endstream
-endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
-0 1 0 rg 0 0 20 20 re f
-endstream
-endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
-        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(p.error.is_none(), "{:?}", p.error);
-        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        assert_eq!(px(20, 80), vec![255, 0, 0, 255], "checkbox must show the /Yes appearance, not the decoy stream");
-    }
-
-    /// Microsoft Reporting Services (bank statements, invoices) writes `stream \r\n`, a space
-    /// before the line break. The content stream was then taken to start at the space and the
-    /// page rendered blank, while Preview, Chrome and Poppler showed it. Vendored hayro-syntax
-    /// patch: spaces and tabs before the line break are skipped, with the right `/Length` and
-    /// with a wrong one. Spaces with no line break after them never start stream data.
-    #[test]
-    fn space_before_the_line_break_after_stream_still_renders() {
-        let pdf = |eol: &str, length: u32| {
-            format!(
-                "%PDF-1.3\r\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\r\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\r\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R >> endobj\r\n\
-                 4 0 obj << /Length {length} >> stream{eol}0 0 0 rg 20 20 60 60 re f\r\nendstream\r\nendobj\r\n\
-                 trailer << /Root 1 0 R >>\r\n%%EOF"
-            )
-            .into_bytes()
-        };
-        for (eol, length) in [(" \r\n", 25), (" \n", 25), ("\t \r", 25), (" \r\n", 999), ("\r\n", 25)] {
-            let mut r = PageRenderer::new(Arc::new(pdf(eol, length)), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{eol:?}: {:?}", p.error);
-            let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-            assert_eq!(px(50, 50), vec![0, 0, 0, 255], "stream{eol:?} (/Length {length}) must draw the square");
-            assert_eq!(px(5, 5), vec![255, 255, 255, 255], "outside the square stays white");
-        }
-    }
-
-    /// An appearance whose /BBox is a line or a point, or whose /Matrix collapses it to one, has
-    /// no mapping onto the annotation's /Rect: the scale (/Rect size over transformed box size)
-    /// divided by zero, and the infinite or NaN matrix reached the device with everything the
-    /// appearance drew. Vendored hayro-interpret patch: such appearances are skipped. Clipped to
-    /// their box they show nothing, and MuPDF and Poppler draw nothing for them either.
-    #[test]
-    fn degenerate_annotation_appearances_are_skipped() {
-        use hayro::hayro_interpret::font::Glyph;
-        use hayro::hayro_interpret::hayro_syntax::Pdf;
-        use hayro::hayro_interpret::{
-            BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, Paint, PathDrawMode, SoftMask, TransformExt, interpret_page,
-        };
-        use kurbo::{Affine, BezPath, Rect};
-
-        /// Counts the geometry that reaches a device, and how much of it is not finite.
-        #[derive(Default)]
-        struct Geometry {
-            drawn: usize,
-            non_finite: usize,
-        }
-        impl Geometry {
-            fn see(&mut self, finite: bool) {
-                self.drawn += 1;
-                self.non_finite += usize::from(!finite);
-            }
-        }
-        impl<'a> Device<'a> for Geometry {
-            fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
-            fn set_blend_mode(&mut self, _: BlendMode) {}
-            fn draw_path(&mut self, path: &BezPath, transform: Affine, _: &Paint<'a>, _: &PathDrawMode) {
-                self.see(path.is_finite() && transform.is_finite());
-            }
-            fn push_clip_path(&mut self, clip: &ClipPath) {
-                self.see(clip.path.is_finite());
-            }
-            fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
-            fn draw_glyph(&mut self, _: &Glyph<'a>, transform: Affine, glyph_transform: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {
-                self.see(transform.is_finite() && glyph_transform.is_finite());
-            }
-            fn draw_image(&mut self, _: Image<'a, '_>, transform: Affine) {
-                self.see(transform.is_finite());
-            }
-            fn pop_clip_path(&mut self) {}
-            fn pop_transparency_group(&mut self) {}
-        }
-
-        let pdf = |form: &str| {
-            let content = "1 0 0 rg 0 0 20 20 re f BT /F1 12 Tf 2 5 Td (Hi) Tj ET";
-            format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R] >> endobj
-4 0 obj << /Type /Annot /Subtype /Square /Rect [10 10 60 40] /AP << /N 5 0 R >> >> endobj
-5 0 obj << /Type /XObject /Subtype /Form {form} /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> >> /Length {} >> stream
-{content}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            )
-        };
-        let geometry = |bytes: &[u8]| {
-            let parsed = Pdf::new(Arc::new(bytes.to_vec())).expect("parses");
-            let page = &parsed.pages()[0];
-            let cache = InterpreterCache::new();
-            let initial = page.initial_transform(true).to_kurbo();
-            let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, 100.0, 100.0), &cache, page.xref(), InterpreterSettings::default());
-            let mut device = Geometry::default();
-            interpret_page(page, &mut ctx, &mut device);
-            device
-        };
-        let render = |bytes: Vec<u8>| {
-            let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
-            r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() })
-        };
-        for (case, form) in [
-            ("zero-width /BBox", "/BBox [0 0 0 20]"),
-            ("zero-height /BBox", "/BBox [0 0 20 0]"),
-            ("point /BBox", "/BBox [5 5 5 5]"),
-            ("/Matrix with a zero column", "/BBox [0 0 20 20] /Matrix [0 0 0 1 0 0]"),
-            ("/Matrix with a zero row", "/BBox [0 0 20 20] /Matrix [1 0 0 0 0 0]"),
-        ] {
-            let bytes = pdf(form).into_bytes();
-            let device = geometry(&bytes);
-            assert_eq!(device.non_finite, 0, "{case}: {} of {} drawing calls were not finite", device.non_finite, device.drawn);
-            let p = render(bytes);
-            assert!(p.error.is_none(), "{case}: {:?}", p.error);
-            assert!(p.rgba.as_chunks::<4>().0.iter().all(|c| *c == [255, 255, 255, 255]), "{case}: nothing is drawn");
-        }
-
-        // A valid appearance still reaches the device, and fills its /Rect and only its /Rect.
-        let valid = pdf("/BBox [0 0 20 20]").into_bytes();
-        let device = geometry(&valid);
-        assert!(device.drawn >= 4 && device.non_finite == 0, "{} drawn, {} non-finite", device.drawn, device.non_finite);
-        let p = render(valid);
-        assert!(p.error.is_none(), "{:?}", p.error);
-        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        assert_eq!(px(11, 61), vec![255, 0, 0, 255]);
-        assert_eq!(px(58, 88), vec![255, 0, 0, 255]);
-        assert_eq!(px(61, 75), vec![255, 255, 255, 255], "right of /Rect");
-        assert_eq!(px(30, 58), vec![255, 255, 255, 255], "above /Rect");
-    }
-
-    /// ISO 32000-2 §12.5.5: the transformed appearance box is scaled and translated so that its
-    /// lower-left and upper-right corners land on those of /Rect. The translation ignored the
-    /// scale, so a box that doesn't start at the origin and differs in size from /Rect was drawn
-    /// shifted, partly outside /Rect (vendored hayro-interpret patch). MuPDF, Poppler, PDFium and
-    /// pdf.js fill /Rect exactly for each of these.
-    #[test]
-    fn annotation_appearance_box_maps_onto_rect() {
-        let filled = |form: &str, content: &str| {
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R] >> endobj
-4 0 obj << /Type /Annot /Subtype /Square /Rect [10 10 60 40] /AP << /N 5 0 R >> >> endobj
-5 0 obj << /Type /XObject /Subtype /Form {form} /Length {} >> stream
-{content}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{form}: {:?}", p.error);
-            // The bounding box of everything drawn, in device pixels.
-            let (mut x0, mut y0, mut x1, mut y1) = (u32::MAX, u32::MAX, 0, 0);
-            for y in 0..p.height {
-                for x in 0..p.width {
-                    if p.rgba[((y * p.width + x) * 4) as usize..][..4] != [255, 255, 255, 255] {
-                        (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
-                    }
-                }
-            }
-            (x0, y0, x1, y1)
-        };
-        // /Rect [10 10 60 40] is device x 10..=59, y 60..=89.
-        let rect = (10, 60, 59, 89);
-        for (form, content) in [
-            ("/BBox [10 10 30 30]", "1 0 0 rg 10 10 20 20 re f"),
-            ("/BBox [0 0 20 20] /Matrix [1 0 0 1 10 10]", "1 0 0 rg 0 0 20 20 re f"),
-            ("/BBox [-20 -5 0 15]", "1 0 0 rg -20 -5 20 20 re f"),
-            // Unchanged: a box at the origin, and an offset box as large as /Rect.
-            ("/BBox [0 0 20 20]", "1 0 0 rg 0 0 20 20 re f"),
-            ("/BBox [100 100 150 130]", "1 0 0 rg 100 100 50 30 re f"),
-        ] {
-            assert_eq!(filled(form, content), rect, "{form}");
-        }
-    }
-
-    /// #2583, #1869: a sticky note carries the NoRotate flag (`/F` bit 5), so on a page with
-    /// `/Rotate` its icon stays upright as displayed, turned about the upper-left corner of its
-    /// `/Rect`, which stays where it is on the page (ISO 32000-2 §12.5.3). It was drawn turned with
-    /// the page, in `/Rect` as displayed (vendored hayro-interpret patch 37). A note without the
-    /// flag still turns with the page. `Annotation::shown_rect` is where the UI hit-tests the
-    /// note, and must be where it is drawn.
-    #[test]
-    fn no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages() {
-        // A 30 × 20 appearance: red in its top-left quarter, blue elsewhere.
-        let content = "0 0 1 rg 0 0 30 20 re f 1 0 0 rg 0 10 15 10 re f";
-        for rotation in [0u16, 90, 180, 270] {
-            let objects = [
-                "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
-                "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
-                format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 140] /Rotate {rotation} /Annots [4 0 R 5 0 R] >>"),
-                // NoRotate (and Print), as PdfCraft and Acrobat save notes.
-                "<< /Type /Annot /Subtype /Text /F 20 /Rect [40 50 70 70] /AP << /N 6 0 R >> >>".to_string(),
-                // The same appearance without the flag.
-                "<< /Type /Annot /Subtype /Text /F 4 /Rect [120 50 150 70] /AP << /N 6 0 R >> >>".to_string(),
-                format!("<< /Type /XObject /Subtype /Form /BBox [0 0 30 20] /Length {} >>\nstream\n{content}\nendstream", content.len()),
-            ];
-            let mut pdf = b"%PDF-1.7\n".to_vec();
-            let mut offsets = Vec::new();
-            for (i, object) in objects.iter().enumerate() {
-                offsets.push(pdf.len());
-                pdf.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
-            }
-            let xref = pdf.len();
-            pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
-            for offset in offsets {
-                pdf.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
-            }
-            pdf.extend_from_slice(format!("trailer << /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
-            let pdf = Arc::new(pdf);
-            let info = crate::inspect(pdf.clone(), None).expect("opens");
-            let page = &info.pages[0];
-            assert_eq!(page.rotation, rotation);
-            let mut r = PageRenderer::new(pdf, RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
-            assert!(p.error.is_none(), "{:?}", p.error);
-            // Displayed-page points are device pixels at scale 1.
-            let px = |x: f32, y: f32| -> [u8; 4] {
-                let (x, y) = (x.clamp(0.0, p.width as f32 - 1.0) as u32, y.clamp(0.0, p.height as f32 - 1.0) as u32);
-                p.rgba[((y * p.width + x) * 4) as usize..][..4].try_into().unwrap()
-            };
-            let red: fn([u8; 4]) -> bool = |c| c[0] > 200 && c[1] < 60 && c[2] < 60;
-            let blue: fn([u8; 4]) -> bool = |c| c[2] > 200 && c[0] < 60 && c[1] < 60;
-            let paper: fn([u8; 4]) -> bool = |c| c.iter().all(|v| *v > 240);
-
-            // The NoRotate note: its upper-left corner (40, 70) is the top-left of an upright
-            // 30 × 20 icon as displayed, red quarter top-left.
-            let [cx, cy] = page.user_to_view(40.0, 70.0);
-            for ((dx, dy), want, what) in [
-                ((7.5, 5.0), red, "red top-left quarter"),
-                ((22.5, 5.0), blue, "blue top-right"),
-                ((7.5, 15.0), blue, "blue bottom-left"),
-                ((22.5, 15.0), blue, "blue bottom-right"),
-                ((-3.0, 10.0), paper, "paper left of the icon"),
-                ((10.0, -3.0), paper, "paper above the icon"),
-                ((33.0, 10.0), paper, "paper right of its 30 pt width"),
-                ((10.0, 23.0), paper, "paper below its 20 pt height"),
-            ] {
-                let c = px(cx + dx, cy + dy);
-                assert!(want(c), "rotation {rotation}: NoRotate note at corner + ({dx}, {dy}) is {c:?}, want {what}");
-            }
-            let note = info.annotations.iter().find(|a| a.no_rotate).expect("the NoRotate note is listed");
-            let shown = note.shown_rect(rotation);
-            let (a, b) = (page.user_to_view(shown[0], shown[1]), page.user_to_view(shown[2], shown[3]));
-            let box_ = [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])];
-            let want = [cx, cy, cx + 30.0, cy + 20.0];
-            assert!(box_.iter().zip(want).all(|(v, w)| (v - w).abs() < 0.01), "rotation {rotation}: shown {box_:?}, drawn {want:?}");
-
-            // The note without the flag turns with the page: its red quarter stays at the
-            // user-space top-left of /Rect, at the displayed top-left only when unturned.
-            let plain = info.annotations.iter().find(|a| !a.no_rotate).expect("the plain note is listed");
-            assert_eq!(plain.shown_rect(rotation), plain.rect);
-            let [rx, ry] = page.user_to_view(127.5, 65.0);
-            let [bx, by] = page.user_to_view(142.5, 55.0);
-            assert!(red(px(rx, ry)) && blue(px(bx, by)), "rotation {rotation}: the plain note's appearance turns with the page");
-            let (a, b) = (page.user_to_view(120.0, 50.0), page.user_to_view(150.0, 70.0));
-            let corner = px(a[0].min(b[0]) + 4.0, a[1].min(b[1]) + 4.0);
-            assert_eq!(red(corner), rotation == 0, "rotation {rotation}: displayed top-left of the plain note is {corner:?}");
-        }
-    }
-
-    /// #1968: the highlight appearance other editors write, a transparency group whose content is
-    /// filled with `/BM /Multiply`, drew as an opaque block over the text. Every `/Group` form
-    /// got a layer of its own, so the Multiply blended with that layer's transparent backdrop
-    /// and the layer then covered the page. Vendored hayro-interpret patch: a group that is not
-    /// isolated (ISO 32000-2 §11.4.7: its elements composite with what is already on the page)
-    /// and is entered at full opacity, with no soft mask and Normal blending, has no backdrop of
-    /// its own to offer, so its content is drawn straight onto the page. An isolated group
-    /// (`/I true`) keeps its blank backdrop, and a group entered at partial opacity still gets
-    /// its layer so that opacity applies to the group as a whole.
-    #[test]
-    fn a_multiply_highlight_inside_a_transparency_group_keeps_the_text() {
-        // `annots`: the form drawn as the highlight's appearance; `page`: drawn from the page
-        // content instead, with the extra graphics state in front of the `Do`.
-        let render = |group: &str, annots: &str, page: &str| {
-            let content = format!("0 g 100 40 10 20 re f {page}");
-            let form = "/GS0 gs 1 1 0 rg 15 35 105 30 re f";
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R {annots} /Resources << /XObject << /Fx 6 0 R >> /ExtGState << /Half << /ca 0.5 >> >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Annot /Subtype /Highlight /Rect [15 35 120 65] /QuadPoints [15 65 120 65 15 35 120 35] /C [1 1 0] /AP << /N 6 0 R >> >> endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [15 35 120 65] {group} /Resources << /ExtGState << /GS0 << /BM /Multiply /CA 1 /ca 1 >> >> >> /Length {} >> stream
-{form}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len(),
-                form.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{group}: {:?}", p.error);
-            p
-        };
-        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        let (white, black, yellow) = (vec![255, 255, 255, 255], vec![0, 0, 0, 255], vec![255, 255, 0, 255]);
-        let annots = "/Annots [5 0 R]";
-        let plain = "/Group << /S /Transparency /CS /DeviceRGB >>";
-        let explicit = "/Group << /S /Transparency /CS /DeviceRGB /I false /K false >>";
-        for group in [plain, explicit, ""] {
-            for (annots, page) in [(annots, ""), ("", "/Fx Do")] {
-                let p = render(group, annots, page);
-                assert_eq!(px(&p, 30, 50), yellow, "{group} {page}: filled with the highlight colour");
-                assert_eq!(px(&p, 105, 50), black, "{group} {page}: Multiply keeps the text underneath");
-                assert_eq!(px(&p, 150, 50), white, "{group} {page}: outside the appearance");
-            }
-        }
-        // Isolated: the group's own transparent backdrop is all the Multiply sees (§11.4.7).
-        let p = render("/Group << /S /Transparency /CS /DeviceRGB /I true >>", annots, "");
-        assert_eq!(px(&p, 105, 50), yellow, "an isolated group starts from a blank backdrop");
-        // Entered at half opacity, the group is still composited as one: half yellow over white.
-        let p = render(plain, "", "/Half gs /Fx Do");
-        let half = px(&p, 30, 50);
-        assert!(half[0] == 255 && half[1] == 255 && (120..=136).contains(&half[2]), "{half:?}");
-        assert_eq!(px(&p, 150, 50), white);
-    }
-
-    /// A Highlight annotation without an appearance stream (common in older and generated files)
-    /// was not drawn at all. Vendored hayro-interpret patch: its /QuadPoints are filled with /C at
-    /// /CA, blended with Multiply, as PdfCraft draws its own highlights (pdfcraft-annot); MuPDF,
-    /// Poppler and PDFium draw these fixtures the same way. An /AP still wins, malformed
-    /// /QuadPoints or no /C draw nothing, and Hidden, NoView and "Hide all comments" still apply.
-    #[test]
-    fn highlights_without_an_appearance_are_drawn() {
-        let render = |annot: &str, config: RenderConfig| {
-            let content = "0 g 100 40 10 20 re f";
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Annots [5 0 R] >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Annot /Subtype /Highlight /Rect [15 35 120 65] {annot} >> endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [15 35 120 65] /Length 24 >> stream
-0 0 1 rg 15 35 50 30 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), config);
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{annot}: {:?}", p.error);
-            p
-        };
-        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        let (white, black, yellow) = (vec![255, 255, 255, 255], vec![0, 0, 0, 255], vec![255, 255, 0, 255]);
-        let quad = "/QuadPoints [15 65 120 65 15 35 120 35]";
-
-        let p = render(&format!("{quad} /C [1 1 0]"), RenderConfig::default());
-        assert_eq!(px(&p, 30, 50), yellow, "the quad is filled with /C");
-        assert_eq!(px(&p, 105, 50), black, "Multiply keeps what is underneath");
-        assert_eq!(px(&p, 150, 50), white, "outside the quad");
-        assert_eq!(px(&p, 30, 30), white, "above the quad");
-
-        // Two quads (one per line of text); the gap between them stays white.
-        let p = render("/QuadPoints [15 65 60 65 15 50 60 50 70 50 120 50 70 35 120 35] /C [0 1 1]", RenderConfig::default());
-        assert_eq!(px(&p, 30, 40), vec![0, 255, 255, 255]);
-        assert_eq!(px(&p, 90, 60), vec![0, 255, 255, 255]);
-        assert_eq!((px(&p, 90, 40), px(&p, 30, 60)), (white.clone(), white.clone()));
-
-        // /CA and gray /C.
-        let p = render(&format!("{quad} /C [1 0 0] /CA 0.5"), RenderConfig::default());
-        let half = px(&p, 30, 50);
-        assert!(half[0] == 255 && (126..=129).contains(&half[1]) && half[1] == half[2], "{half:?}");
-        let p = render(&format!("{quad} /C [0.5]"), RenderConfig::default());
-        let gray = px(&p, 30, 50);
-        assert!((126..=129).contains(&gray[0]) && gray[0] == gray[1] && gray[1] == gray[2], "{gray:?}");
-
-        // An appearance stream wins: the blue form, not a yellow highlight.
-        let p = render(&format!("{quad} /C [1 1 0] /AP << /N 6 0 R >>"), RenderConfig::default());
-        assert_eq!(px(&p, 30, 50), vec![0, 0, 255, 255]);
-        assert_eq!(px(&p, 90, 50), white, "no highlight outside the appearance's own drawing");
-
-        // Nothing is drawn for malformed geometry, no colour, or a hidden annotation.
-        let hide = RenderConfig { hide_comments: true, ..RenderConfig::default() };
-        for (annot, config) in [
-            ("/QuadPoints [10 10 20] /C [1 1 0]", RenderConfig::default()),
-            ("/QuadPoints [15 65 120 65 15 35 /x 35] /C [1 1 0]", RenderConfig::default()),
-            ("/QuadPoints [] /C [1 1 0]", RenderConfig::default()),
-            ("/QuadPoints 7 /C [1 1 0]", RenderConfig::default()),
-            (quad, RenderConfig::default()),
-            (&format!("{quad} /C []"), RenderConfig::default()),
-            (&format!("{quad} /C [1 1]"), RenderConfig::default()),
-            (&format!("{quad} /C [1 1 0] /F 2"), RenderConfig::default()),
-            (&format!("{quad} /C [1 1 0] /F 32"), RenderConfig::default()),
-            (&format!("{quad} /C [1 1 0]"), hide),
-        ] {
-            let p = render(annot, config);
-            assert_eq!(px(&p, 30, 50), white, "{annot}");
-            assert_eq!(px(&p, 105, 50), black, "{annot}");
-        }
-    }
-
-    #[test]
-    fn hiding_comments_keeps_fields() {
-        let pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R 6 0 R] >> endobj
-4 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (t) /Rect [10 10 30 30] /AP << /N 5 0 R >> >> endobj
-5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
-1 0 0 rg 0 0 20 20 re f
-endstream endobj
-6 0 obj << /Type /Annot /Subtype /Square /F 4 /Rect [60 60 90 90] /AP << /N 7 0 R >> >> endobj
-7 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 24 >> stream
-0 1 0 rg 0 0 30 30 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let render = |hide: bool| {
-            let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig { hide_comments: hide, ..RenderConfig::default() });
-            r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() })
-        };
-        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        let shown = render(false);
-        assert_eq!(px(&shown, 75, 25), vec![0, 255, 0, 255], "the comment is drawn");
-        let hidden = render(true);
-        assert_eq!(px(&hidden, 75, 25), vec![255, 255, 255, 255], "Hide all comments");
-        assert_eq!(px(&hidden, 20, 80), vec![255, 0, 0, 255], "fields stay");
-    }
-
-    /// ISO 32000-2 Table 167: Invisible hides an annotation of a type that isn't standard and
-    /// nothing else; §12.5.6.14: a popup has no appearance of its own, so its `/AP` isn't painted.
-    #[test]
-    fn invisible_unknown_annotations_and_popups_paint_nothing() {
-        let annots = [
-            "/Subtype /MyCustomType /F 0",
-            "/Subtype /MyCustomType /F 1",
-            "/Subtype /MyCustomType /F 5",
-            "/F 1",
-            "/Subtype /Square /F 1",
-            "/Subtype /Popup /F 4 /Open true",
-        ];
-        let mut pdf = String::from("%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n");
-        pdf.push_str("2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n");
-        let refs: Vec<String> = (0..annots.len()).map(|i| format!("{} 0 R", 10 + i)).collect();
-        pdf.push_str(&format!("3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 50] /Annots [{}] >> endobj\n", refs.join(" ")));
-        pdf.push_str("4 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 24 >> stream\n0 1 0 rg 0 0 30 30 re f\nendstream endobj\n");
-        for (i, a) in annots.iter().enumerate() {
-            let x = 10 + 50 * i;
-            pdf.push_str(&format!("{} 0 obj << /Type /Annot {a} /Rect [{x} 10 {} 40] /AP << /N 4 0 R >> >> endobj\n", 10 + i, x + 30));
-        }
-        pdf.push_str("trailer << /Root 1 0 R >>\n%%EOF");
-        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        let px = |x: u32| p.rgba[((25 * p.width + x) * 4) as usize..][..4].to_vec();
-        let (green, white) = (vec![0, 255, 0, 255], vec![255, 255, 255, 255]);
-        assert_eq!(px(25), green, "an unknown type without Invisible is drawn");
-        assert_eq!(px(75), white, "Invisible hides an unknown type");
-        assert_eq!(px(125), white, "even with the Print flag");
-        assert_eq!(px(175), white, "no Subtype is no standard type");
-        assert_eq!(px(225), green, "Invisible means nothing for a standard type");
-        assert_eq!(px(275), white, "a popup's appearance is not painted on the page");
-    }
-
-    #[test]
-    fn inline_pool_renders_in_priority_order() {
-        let pool = RenderPool::new_inline(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
-        assert!(pool.is_inline());
-        assert!(pool.try_recv().is_none());
-        pool.set_queue(vec![
-            RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 1, ..Default::default() },
-            RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 2, ..Default::default() },
-        ]);
-        assert_eq!(pool.try_recv().map(|p| p.request.tag), Some(1));
-        assert_eq!(pool.try_recv().map(|p| (p.request.tag, p.width)), Some((2, 50)));
-        assert!(pool.try_recv().is_none());
-    }
-
-    #[test]
-    fn dropping_the_pool_cancels_its_renders() {
-        const TEXT: &[u8] = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length 35 >> stream
-BT /F1 12 Tf 20 70 Td (Hello) Tj ET
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
-        let flag = lock(&pool.shared.stop).first().cloned().expect("one worker");
-        let settings = worker_settings(&pool.config, &flag);
-        assert!(settings.cancelled.as_ref().is_some_and(|c| Arc::ptr_eq(c, &flag)));
-        let shapes = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
-        let text = Pdf::new(Arc::new(TEXT.to_vec())).expect("parses");
-        let pages = shapes.pages();
-        let page = pages.first().expect("a page");
-        let rs = RenderSettings { bg_color: WHITE, ..Default::default() };
-        let blue = |s: &InterpreterSettings| {
-            let p = hayro::render(page, &RenderCache::new(), s, &rs).sample(20, 30);
-            [p.r, p.g, p.b, p.a] == [0, 0, 255, 255]
-        };
-        let glyphs = |s: &InterpreterSettings| crate::text::extract_page(&text, 0, s).map_or(0, |t| t.glyphs.len());
-        assert!(blue(&settings) && glyphs(&settings) == 5, "a live pool renders and reads everything");
-        drop(pool);
-        assert!(flag.load(std::sync::atomic::Ordering::Relaxed));
-        assert!(!blue(&settings) && glyphs(&settings) == 0, "once the pool is gone, interpretation stops before drawing");
-    }
-
-    #[test]
-    fn the_watchdog_stops_the_render_it_gives_up_on() {
-        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
-        // Private parsers: a shared render's first timeout is retried privately, which would
-        // give up on (and stop) a second worker too.
-        *lock(&pool.shared.parser.state) = ParserState::Private;
-        pool.shared.parser.valid.store(false, Ordering::Release);
-        pool.set_stuck_after(std::time::Duration::ZERO);
-        let gate = render_gate(0, false);
-        *lock(&pool.shared.render_gates) = vec![gate.clone()];
-        pool.set_queue(vec![RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() }]);
-        gate.entered.wait();
-        let first = pool.try_recv().expect("the watchdog answers for the held render");
-        assert!(first.error.as_deref().is_some_and(|e| e.contains("took longer")), "{:?}", first.error);
-        // The abandoned worker is told to stop at its next operator; its replacement isn't.
-        let stop: Vec<bool> = lock(&pool.shared.stop).iter().map(|s| s.load(std::sync::atomic::Ordering::Relaxed)).collect();
-        assert_eq!(stop, vec![true, false]);
-        gate.release.wait();
-        gate.finished.wait();
-        assert!(pool.try_recv().is_none(), "the abandoned render must not publish a late result");
-    }
-
-    #[test]
-    fn extracts_text_with_positions() {
-        let pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length 60 >> stream
-BT /F1 12 Tf 20 70 Td (Hello World) Tj 0 -30 Td (Second) Tj ET
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
-        let out = r.render(RenderRequest { page: 0, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(out.error.is_none(), "{:?}", out.error);
-        let t = out.text.expect("text");
-        assert_eq!(t.plain_text(), "Hello World\nSecond");
-        // "H" sits at x=20, baseline y=70 (y-up) → view y ≈ 100-70 = 30 at the baseline.
-        let h = &t.glyphs[0].rect;
-        assert!((h[0] - 20.0).abs() < 0.5 && h[1] < 30.0 && h[3] > 30.0, "{h:?}");
-        assert_eq!(t.find("world").len(), 1);
-    }
-
-    #[test]
-    fn layer_override_hides_content() {
-        let pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R] /D << /Order [5 0 R] >> >> >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Properties << /L1 5 0 R >> >> >> endobj
-4 0 obj << /Length 44 >> stream
-/OC /L1 BDC 1 0 0 rg 0 0 100 100 re f EMC
-endstream endobj
-5 0 obj << /Type /OCG /Name (Red) >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let px = |cfg: RenderConfig| {
-            let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), cfg);
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() });
-            p.rgba[..4].to_vec()
-        };
-        assert_eq!(px(RenderConfig::default()), vec![255, 0, 0, 255], "layer is on by default");
-        let off = RenderConfig { layers: Arc::new(vec![(5, 0, false)]), ..Default::default() };
-        assert_eq!(px(off), vec![255, 255, 255, 255], "toggled-off layer must not draw");
-    }
-
-    /// #2986: an optional content membership dictionary with a visibility expression (`/VE`,
-    /// ISO 32000-2 §8.11.2.2) shows its content only when the expression is true, and the
-    /// expression takes precedence over `/OCGs` and `/P`. It was ignored, so content under it
-    /// stayed visible when its layers were hidden. A malformed expression falls back to `/OCGs`.
-    #[test]
-    fn visibility_expressions_decide_what_a_membership_dictionary_shows() {
-        let render = |ocmd: &str, off: &[i32]| {
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R 6 0 R] /D << /Order [5 0 R 6 0 R] >> >> >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Properties << /M1 7 0 R >> >> >> endobj
-4 0 obj << /Length 44 >> stream
-/OC /M1 BDC 1 0 0 rg 0 0 100 100 re f EMC
-endstream endobj
-5 0 obj << /Type /OCG /Name (A) >> endobj
-6 0 obj << /Type /OCG /Name (B) >> endobj
-7 0 obj {ocmd} endobj
-trailer << /Root 1 0 R >>
-%%EOF"
-            );
-            let layers = off.iter().map(|n| (*n, 0, false)).collect();
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig { layers: Arc::new(layers), ..Default::default() });
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() });
-            p.rgba[..4] == [255, 0, 0, 255]
-        };
-        let and = "<< /Type /OCMD /VE [/And 5 0 R 6 0 R] >>";
-        assert!(render(and, &[]), "And: both on");
-        assert!(!render(and, &[5]), "And: one off");
-        let or = "<< /Type /OCMD /VE [/Or 5 0 R 6 0 R] >>";
-        assert!(render(or, &[5]), "Or: one on");
-        assert!(!render(or, &[5, 6]), "Or: both off");
-        let not = "<< /Type /OCMD /VE [/Not 5 0 R] >>";
-        assert!(!render(not, &[]), "Not: the group is on");
-        assert!(render(not, &[5]), "Not: the group is off");
-        let nested = "<< /Type /OCMD /VE [/And [/Not 5 0 R] 6 0 R] >>";
-        assert!(render(nested, &[5]), "nested: A off, B on");
-        assert!(!render(nested, &[]), "nested: A on");
-        // /VE wins over /OCGs and /P.
-        let both = "<< /Type /OCMD /OCGs [5 0 R] /P /AllOn /VE [/Not 5 0 R] >>";
-        assert!(render(both, &[5]), "the expression, not /P, decides");
-        // A malformed expression falls back to /OCGs and /P.
-        // So is one naming an object that isn't a listed group: a missing one, or the page
-        // (review on #2987).
-        for bad in ["[/Xor 5 0 R]", "[/Not 5 0 R 6 0 R]", "[/And]", "[5 0 R]", "[/And (5)]", "[/Or 8 0 R]", "[/Or 3 0 R]"] {
-            let ocmd = format!("<< /Type /OCMD /OCGs [5 0 R] /VE {bad} >>");
-            assert!(render(&ocmd, &[]), "{bad}: /OCGs on");
-            assert!(!render(&ocmd, &[5]), "{bad}: /OCGs off");
-        }
-        // Nesting past the limit is malformed too, and does not recurse without end.
-        let deep = format!("<< /Type /OCMD /OCGs [5 0 R] /VE {}5 0 R{} >>", "[/Not ".repeat(41), "]".repeat(41));
-        assert!(!render(&deep, &[5]), "too deep: /OCGs decides");
-    }
-
-    /// From `cargo xtask fuzz`: a tiling pattern with no /Resources inherits the page's, where
-    /// its own name points back at it. It painted itself until the stack overflowed (vendored
-    /// hayro-interpret patch: `MAX_PAINT_NESTING`). Ordinary patterns must still paint.
-    #[test]
-    fn self_referencing_tiling_pattern_terminates() {
-        let pdf = |pattern_body: &str| {
-            format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
-4 0 obj << /Length 30 >> stream
-/Pattern cs /P1 scn 0 0 40 40 re f
-endstream endobj
-5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Length {} >> stream
-{pattern_body}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                pattern_body.len()
-            )
-        };
-        let render = |doc: String| {
-            let mut r = PageRenderer::new(Arc::new(doc.into_bytes()), RenderConfig::default());
-            r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() })
-        };
-        let looped = render(pdf("/Pattern cs /P1 scn 0 0 10 10 re f"));
-        assert_eq!((looped.width, looped.height), (40, 40));
-        let red = render(pdf("1 0 0 rg 0 0 10 10 re f"));
-        assert!(red.error.is_none(), "{:?}", red.error);
-        assert_eq!(&red.rgba[((20 * 40 + 20) * 4)..][..4], &[255, 0, 0, 255], "a normal tiling pattern still paints");
-    }
-
-    #[test]
-    fn tiling_pattern_form_cycles_are_bounded_and_finite_nesting_paints() {
-        let cases = [
-            ("self-cycle", "/Pattern cs /P1 scn 0 0 10 10 re f 0 0 1 rg 0 0 10 10 re f"),
-            ("pattern-form-cycle", "/F Do 0 0 1 rg 0 0 10 10 re f"),
-            ("finite-nesting", "/Pattern cs /P2 scn 0 0 10 10 re f"),
-        ];
-        let pattern_b = "0 0 1 rg 0 0 10 10 re f";
-        let form = "/Pattern cs /P1 scn 0 0 10 10 re f";
-        let page_content = "/Pattern cs /P1 scn 0 0 40 40 re f 1 0 0 rg 32 32 8 8 re f";
-        for (case, pattern_a) in cases {
-            let pdf = format!(
-                "%PDF-1.7\n\
-                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 40 40] >> endobj\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R /P2 6 0 R >> /XObject << /F 7 0 R >> >> >> endobj\n\
-                 4 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n\
-                 5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Length {} >> stream\n{pattern_a}\nendstream endobj\n\
-                 6 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Length {} >> stream\n{pattern_b}\nendstream endobj\n\
-                 7 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 10 10] /Length {} >> stream\n{form}\nendstream endobj\n\
-                 trailer << /Root 1 0 R >>\n%%EOF",
-                page_content.len(),
-                pattern_a.len(),
-                pattern_b.len(),
-                form.len()
-            )
-            .into_bytes();
-            let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-                let _ = tx.send(renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() }));
-            });
-            let page = rx.recv_timeout(std::time::Duration::from_secs(10)).unwrap_or_else(|_| panic!("{case}: render did not finish"));
-            assert!(page.error.is_none(), "{case}: {:?}", page.error);
-            assert_eq!((page.width, page.height), (40, 40), "{case}");
-            let pixel = |x: u32, y: u32| {
-                let offset = ((y * page.width + x) * 4) as usize;
-                [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
-            };
-            assert_eq!(pixel(1, 38), [0, 0, 255, 255], "{case}: nested pattern content paints");
-            assert_eq!(pixel(35, 4), [255, 0, 0, 255], "{case}: page content after the pattern still paints");
-        }
-    }
-
-    /// A shaded Type 3 glyph must use bounds in device coordinates at every position.
-    #[test]
-    fn shaded_type3_glyph_draws_at_multiple_positions() {
-        let content = "BT /F 30 Tf 1 0 0 1 50 70 Tm (A) Tj 1 0 0 1 220 70 Tm (A) Tj ET";
-        let glyph = "100 0 d0 0 0 100 100 re W n /S sh";
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 150] /Resources << /Font << /F 5 0 R >> >> /Contents 4 0 R >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 100 100] /FontMatrix [0.01 0 0 0.01 0 0] /CharProcs << /A 6 0 R >> /Encoding << /Differences [65 /A] >> /FirstChar 65 /LastChar 65 /Widths [100] /Resources << /Shading << /S 7 0 R >> >> >> endobj
-6 0 obj << /Length {} >> stream
-{glyph}
-endstream endobj
-7 0 obj << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [0 0 1] /N 1 >> /Extend [true true] >> endobj
-trailer << /Root 1 0 R >>
-%%EOF", content.len(), glyph.len()
-        );
-        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        for x in [65usize, 235] {
-            let pixel = &page.rgba[(65 * 300 + x) * 4..][..4];
-            assert!(pixel[0] < 240 && pixel[2] < 240 && pixel[1] < 10, "glyph at {x}: {pixel:?}");
-        }
-    }
-
-    /// From `cargo xtask fuzz`: a Type 3 font without /Resources inherits the page's, where its
-    /// own name is defined, and its glyph shows text in itself (vendored patch:
-    /// `MAX_PAINT_NESTING`). Must terminate; a normal Type 3 glyph must still paint.
-    #[test]
-    fn self_referencing_type3_glyph_terminates() {
-        let pdf = |proc_body: &str| {
-            format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length 31 >> stream
-BT /F1 20 Tf 10 10 Td (A) Tj ET
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 1 1] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [1]
-  /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> >> endobj
-6 0 obj << /Length {} >> stream
-{proc_body}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                proc_body.len()
-            )
-        };
-        let render = |doc: String| {
-            let mut r = PageRenderer::new(Arc::new(doc.into_bytes()), RenderConfig::default());
-            r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() })
-        };
-        let looped = render(pdf("1 0 d0 BT /F1 1 Tf (A) Tj ET 0 0 1 1 re f"));
-        assert_eq!((looped.width, looped.height), (40, 40));
-        let plain = render(pdf("1 0 d0 0 0 1 1 re f"));
-        assert!(plain.error.is_none(), "{:?}", plain.error);
-        assert!(plain.rgba.as_chunks::<4>().0.iter().any(|p| p[0] < 128), "a normal Type 3 glyph still paints");
-    }
-
-    /// From `cargo xtask fuzz`: a tiling pattern whose /XStep and /YStep dwarf its /BBox got a
-    /// cell pixmap of `step × scale` pixels, bounded only by u16 (2 GB and more). The vendored
-    /// hayro patch `tiling_cell_scale` keeps the cell within 3000 pixels a side.
-    #[test]
-    fn tiling_cells_stay_small_whatever_the_step() {
-        assert_eq!(hayro::tiling_cell_scale(2.0, 10.0, 3000.0), 2.0, "ordinary cells keep their scale");
-        for step in [1.0e5f32, -1.0e5, 4.0e9] {
-            let s = hayro::tiling_cell_scale(2.0, step, 3000.0);
-            assert!(s * step.abs() <= 3000.5, "{step}: {s}");
-        }
-        assert_eq!(hayro::tiling_cell_scale(2.0, f32::INFINITY, 3000.0), 2.0);
-        assert_eq!(hayro::tiling_cell_scale(2.0, 0.0, 3000.0), 2.0);
-        // End to end: such a pattern renders, and the page's other content still draws.
-        let content = "/Pattern cs /P1 scn 0 0 40 40 re f 1 0 0 rg 0 0 4 4 re f";
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 100000 /YStep 100000 /Length 20 >> stream
-0 0 1 rg 0 0 10 10 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255]);
-    }
-
-    /// One page `w` × `h` points whose content `content` paints with pattern `/P1`: a 10 × 10 cell
-    /// of blue with `/XStep step /YStep step` and pattern matrix `matrix`. Its RGBA pixels.
-    fn tiling_page(w: usize, h: usize, content: &str, step: &str, matrix: &str) -> Vec<u8> {
-        let cell = "0 0 1 rg 0 0 10 10 re f";
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {w} {h}] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 3 /BBox [0 0 10 10] /XStep {step} /YStep {step} /Matrix [{matrix}] /Length {} >> stream
-{cell}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len(),
-            cell.len()
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        page.rgba.to_vec()
-    }
-
-    /// #3349: PowerPoint (PDFMaker) writes a picture fill as a tiling pattern drawn once, with
-    /// `/XStep 2147480100 /YStep 2147480100` and a matrix that flips y. Fitting such a step into
-    /// a cell pixmap shrank the picture below a pixel, so it vanished. The cell's `/BBox` is drawn
-    /// at full scale, once, filled or stroked: where it is it shows, and around it (left, right,
-    /// above, below) nothing repeats or smears.
-    #[test]
-    fn a_tiling_pattern_drawn_once_shows_its_cell() {
-        let at = |px: &[u8], w: usize, x: usize, y: usize| px[(y * w + x) * 4..][..3].to_vec();
-        let (blue, white) = (vec![0, 0, 255], vec![255, 255, 255]);
-        // The cell at user x 10..20 and, flipped, y 10..20: device rows 20..30.
-        let once = tiling_page(40, 40, "/Pattern cs /P1 scn 0 0 40 40 re f", "2147480100", "1 0 0 -1 10 20");
-        assert_eq!(at(&once, 40, 15, 25), blue, "the cell");
-        for (x, y, side) in [(5, 25, "left"), (25, 25, "right"), (15, 15, "above"), (15, 35, "below")] {
-            assert_eq!(at(&once, 40, x, y), white, "nothing {side} of it");
-        }
-        // Stroked: a wide line across the cell shows it too.
-        let stroked = tiling_page(40, 40, "/Pattern CS /P1 SCN 20 w 0 15 m 40 15 l S", "2147480100", "1 0 0 -1 10 20");
-        assert_eq!(at(&stroked, 40, 15, 25), blue, "a stroke with the pattern");
-        assert_eq!(at(&stroked, 40, 25, 25), white);
-        // An ordinary step still tiles.
-        let tiled = tiling_page(40, 40, "/Pattern cs /P1 scn 0 0 40 40 re f", "20", "1 0 0 1 0 0");
-        assert_eq!(at(&tiled, 40, 25, 35), blue, "a step of 20 repeats the cell");
-    }
-
-    /// #3356 review: a `/BBox` too thin to divide by (not zero, which is refused, but 1e-40
-    /// wide) makes the cell scale infinite; it keeps the old path, so no infinite or NaN
-    /// geometry reaches the cell renderer, the page renders and what follows still draws.
-    #[test]
-    fn a_tiling_cell_too_thin_to_scale_keeps_the_old_path() {
-        assert!(hayro::usable_cell_scale(2.0, 1.0));
-        for (xs, ys) in [(f32::INFINITY, 1.0), (1.0, f32::NAN), (0.0, 1.0), (1.0, -2.0)] {
-            assert!(!hayro::usable_cell_scale(xs, ys), "{xs} {ys}");
-        }
-        let thin = "0.0000000000000000000000000000000000000001";
-        let content = "/Pattern cs /P1 scn 0 0 40 40 re f 1 0 0 rg 0 0 4 4 re f";
-        let cell = "0 0 1 rg 0 0 10 10 re f";
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 3 /BBox [0 0 {thin} 10] /XStep 2147480100 /YStep 2147480100 /Length {} >> stream
-{cell}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len(),
-            cell.len()
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "what follows still draws");
-        assert_eq!(&page.rgba[((20 * 40 + 20) * 4)..][..3], &[255, 255, 255], "the degenerate cell draws nothing");
-    }
-
-    /// #3349: a step too large for a cell pixmap is drawn as one cell only when the painted area
-    /// can't reach another: a page wide (or tall) enough to show the next cell, or the one before,
-    /// still tiles them.
-    #[test]
-    fn a_large_step_still_tiles_where_the_next_cell_shows() {
-        let at = |px: &[u8], w: usize, x: usize, y: usize| px[(y * w + x) * 4..][..3].to_vec();
-        let blue = vec![0, 0, 255];
-        // Steps of 3100 points: over 3000 pixels at this scale, so the cell is shrunk to fit,
-        // by 3000/3100; a pixel 4 points into a cell is blue either way.
-        let wide = "/Pattern cs /P1 scn 0 0 3200 20 re f";
-        let next = tiling_page(3200, 20, wide, "3100", "1 0 0 1 0 0");
-        assert_eq!(at(&next, 3200, 3104, 15), blue, "the cell to the right");
-        let before = tiling_page(3200, 20, wide, "3100", "1 0 0 1 3100 0");
-        assert_eq!(at(&before, 3200, 4, 15), blue, "the cell to the left");
-        let tall = "/Pattern cs /P1 scn 0 0 20 3200 re f";
-        let above = tiling_page(20, 3200, tall, "3100", "1 0 0 1 0 0");
-        assert_eq!(at(&above, 20, 4, 3200 - 3104), blue, "the cell above");
-        let below = tiling_page(20, 3200, tall, "3100", "1 0 0 1 0 3100");
-        assert_eq!(at(&below, 20, 4, 3200 - 4), blue, "the cell below");
-        // A stroke counts with its width: this line ends at x 3080, short of the next cell at
-        // 3100, but its square cap reaches 3110.
-        let stroked = tiling_page(3200, 20, "/Pattern CS /P1 SCN 60 w 2 J 0 10 m 3080 10 l S", "3100", "1 0 0 1 0 0");
-        assert_eq!(at(&stroked, 3200, 3104, 15), blue, "the next cell, under the stroke's cap");
-        // A miter reaches further than the line width (review on #3356): this join's vertex is
-        // at x 3085, 15 short of the next cell with a 10-wide line, but its miter tip, 45 long
-        // under the default limit of 10, reaches 3130.
-        let mitered = tiling_page(3200, 20, "/Pattern CS /P1 SCN 10 w 0 j 3000 0 m 3085 10 l 3000 20 l S", "3100", "1 0 0 1 0 0");
-        // The tip narrows to a point, so this pixel is partly covered: blue, not white.
-        let tip = at(&mitered, 3200, 3104, 10);
-        assert!(tip[0] < 160 && tip[1] < 160 && tip[2] > 200, "the next cell, under the miter's tip: {tip:?}");
-        // Under a skew, a direction between the axes stretches more than either axis (review on
-        // #3356). This join's vertex is at device x 2980 and its miter tip, along that direction,
-        // at 3107: the larger axis stretch (1.118) put the reach at 3092, short of the next cell;
-        // the most any direction stretches (1.461) puts it at 3126.
-        let skewed = tiling_page(
-            3200,
-            20,
-            "/Pattern CS /P1 SCN 1 0 1 0.5 0 0 cm 20 w 0 j 2783.936 -366.118 m 3033.6 -53.6 l 2721.082 -303.264 l S",
-            "3100",
-            "1 0 0 1 0 0",
-        );
-        // The tip narrows to a point, so its pixels are partly covered.
-        let under_tip = (3100..3108).flat_map(|x| (10..20).map(move |y| (x, y))).map(|(x, y)| at(&skewed, 3200, x, y));
-        assert!(
-            under_tip.clone().any(|px| px[0] < 200 && px[1] < 200 && px[2] > 240),
-            "the next cell, under the skewed miter's tip: {:?}",
-            under_tip.collect::<Vec<_>>()
-        );
-    }
-
-    /// Contributor-original JPEG 2000: one unsigned 8-bit pixel per component, one tile,
-    /// no decomposition, reversible wavelet, and one empty packet per component. Empty
-    /// coefficients decode to the midpoint (128) after the unsigned DC level shift.
-    fn jpx_midpoint_pdf(bpc: u8, components: u16) -> Vec<u8> {
-        let mut codestream = vec![0xff, 0x4f, 0xff, 0x51]; // SOC, SIZ.
-        codestream.extend_from_slice(&(38 + 3 * components).to_be_bytes());
-        codestream.extend_from_slice(&0_u16.to_be_bytes()); // Rsiz.
-        for value in [1_u32, 1, 0, 0, 1, 1, 0, 0] {
-            codestream.extend_from_slice(&value.to_be_bytes());
-        }
-        codestream.extend_from_slice(&components.to_be_bytes());
-        for _ in 0..components {
-            codestream.extend_from_slice(&[7, 1, 1]); // Eight bits, no subsampling.
-        }
-        // COD: LRCP, one layer, no transform between components, 64x64 codeblocks,
-        // zero decomposition levels, reversible wavelet. QCD: no quantization.
-        codestream.extend_from_slice(&[0xff, 0x52, 0, 12, 0, 0, 0, 1, 0, 0, 4, 4, 0, 1]);
-        codestream.extend_from_slice(&[0xff, 0x5c, 0, 4, 0x40, 0x40]);
-        codestream.extend_from_slice(&[0xff, 0x90, 0, 10, 0, 0]); // SOT, tile zero.
-        codestream.extend_from_slice(&(14 + u32::from(components)).to_be_bytes());
-        codestream.extend_from_slice(&[0, 1, 0xff, 0x93]); // One tile part, SOD.
-        codestream.extend(std::iter::repeat_n(0, usize::from(components)));
-        codestream.extend_from_slice(&[0xff, 0xd9]); // EOC.
-
-        let content = "q 20 0 0 20 5 5 cm /Im1 Do Q 1 0 0 rg 0 0 4 4 re f";
-        let mut pdf = format!(
-            "%PDF-1.7\n\
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
-4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent {bpc} /Filter /JPXDecode /Length {} >> stream\n",
-            content.len(),
-            codestream.len()
-        )
-        .into_bytes();
-        pdf.extend_from_slice(&codestream);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
-        pdf
-    }
-
-    /// [`jpx_midpoint_pdf`]'s codestream (every sample 128) wrapped in a JP2 file whose header
-    /// has a colour specification naming enumerated colour space `enumerated`.
-    fn jp2_midpoint_pdf(components: u16, enumerated: u32) -> Vec<u8> {
-        let raw = jpx_midpoint_pdf(8, components);
-        let start = raw.windows(4).position(|w| w == [0xff, 0x4f, 0xff, 0x51]).unwrap();
-        let end = raw.windows(2).rposition(|w| w == [0xff, 0xd9]).unwrap() + 2;
-        let codestream = &raw[start..end];
-        let jp2_box = |kind: &[u8], body: &[u8]| [&((8 + body.len()) as u32).to_be_bytes()[..], kind, body].concat();
-        let mut ihdr = Vec::new();
-        ihdr.extend_from_slice(&1_u32.to_be_bytes()); // height
-        ihdr.extend_from_slice(&1_u32.to_be_bytes()); // width
-        ihdr.extend_from_slice(&components.to_be_bytes());
-        ihdr.extend_from_slice(&[7, 7, 0, 0]); // 8 bits, wavelet, colour known, no IPR
-        let colr = [&[1, 0, 0][..], &enumerated.to_be_bytes()].concat();
-        let jp2 = [
-            vec![0, 0, 0, 12, b'j', b'P', b' ', b' ', 0x0d, 0x0a, 0x87, 0x0a],
-            jp2_box(b"ftyp", b"jp2 \0\0\0\0jp2 "),
-            jp2_box(b"jp2h", &[jp2_box(b"ihdr", &ihdr), jp2_box(b"colr", &colr)].concat()),
-            jp2_box(b"jp2c", codestream),
-        ]
-        .concat();
-        let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
-        let mut pdf = format!(
-            "%PDF-1.7\n\
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
-4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /Filter /JPXDecode /Length {} >> stream\n",
-            content.len(),
-            jp2.len()
-        )
-        .into_bytes();
-        pdf.extend_from_slice(&jp2);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
-        pdf
-    }
-
-    /// Review on #3184: a palette image whose indices are 1-bit samples (`ihdr` BPC 0, `Ssiz` 0)
-    /// and whose palette holds 8-bit colours. Its colours are decoded to 8 bits; rescaling them
-    /// to the indices' 1-bit precision kept only 0 or 255 per channel. Contributor-original:
-    /// one 1×1 tile with an empty packet, so its one sample is the 1-bit midpoint (index 1).
-    #[test]
-    fn a_jp2_palette_keeps_its_colours_whatever_the_index_precision() {
-        let mut codestream = vec![0xff, 0x4f, 0xff, 0x51, 0, 41, 0, 0]; // SOC, SIZ (Lsiz 41), Rsiz.
-        for value in [1_u32, 1, 0, 0, 1, 1, 0, 0] {
-            codestream.extend_from_slice(&value.to_be_bytes());
-        }
-        codestream.extend_from_slice(&[0, 1, 0, 1, 1]); // One component: 1 bit, no subsampling.
-        codestream.extend_from_slice(&[0xff, 0x52, 0, 12, 0, 0, 0, 1, 0, 0, 4, 4, 0, 1]);
-        codestream.extend_from_slice(&[0xff, 0x5c, 0, 4, 0x40, 0x40]);
-        codestream.extend_from_slice(&[0xff, 0x90, 0, 10, 0, 0, 0, 0, 0, 15, 0, 1, 0xff, 0x93, 0]);
-        codestream.extend_from_slice(&[0xff, 0xd9]);
-        let jp2_box = |kind: &[u8], body: &[u8]| [&((8 + body.len()) as u32).to_be_bytes()[..], kind, body].concat();
-        let ihdr = [&1_u32.to_be_bytes()[..], &1_u32.to_be_bytes(), &[0, 1, 0, 7, 0, 0]].concat();
-        let colr = [&[1, 0, 0][..], &16_u32.to_be_bytes()].concat(); // sRGB
-        // pclr: two entries, three 8-bit columns: red, then (64, 128, 192).
-        let pclr = [0, 2, 3, 7, 7, 7, 255, 0, 0, 64, 128, 192];
-        // cmap: channels 0..2 come from component 0 through palette columns 0..2.
-        let cmap = [0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 2];
-        let jp2 = [
-            vec![0, 0, 0, 12, b'j', b'P', b' ', b' ', 0x0d, 0x0a, 0x87, 0x0a],
-            jp2_box(b"ftyp", b"jp2 \0\0\0\0jp2 "),
-            jp2_box(b"jp2h", &[jp2_box(b"ihdr", &ihdr), jp2_box(b"colr", &colr), jp2_box(b"pclr", &pclr), jp2_box(b"cmap", &cmap)].concat()),
-            jp2_box(b"jp2c", &codestream),
-        ]
-        .concat();
-        let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
-        // No /ColorSpace (and no /BitsPerComponent): the JP2 header gives the colours, through its
-        // palette (ISO 32000-2 §7.4.9). With an /Indexed space the image holds raw indices at
-        // their own precision, so index 1 picks the space's entry 1, not entry 255.
-        let lut = format!("FF00004080C0{}00FF00", "000000".repeat(253));
-        for colour_space in [String::new(), format!("/ColorSpace [/Indexed /DeviceRGB 255 <{lut}>] ")] {
-            let mut pdf = format!(
-                "%PDF-1.7\n\
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
-4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 {colour_space}/Filter /JPXDecode /Length {} >> stream\n",
-                content.len(),
-                jp2.len()
-            )
-            .into_bytes();
-            pdf.extend_from_slice(&jp2);
-            pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(page.error.is_none(), "{:?}", page.error);
-            let px = &page.rgba[((40 - 15) * 40 + 15) * 4..][..3];
-            assert!(px.iter().zip([64u8, 128, 192]).all(|(a, b)| a.abs_diff(b) <= 2), "{colour_space:.30}: entry 1: {px:?}");
-        }
-    }
-
-    /// #3306: a JP2 image whose colour specification names an enumerated colour space the
-    /// decoder refuses (CIEJab in a veraPDF fixture, or YPbPr, or bilevel for one component) is
-    /// drawn as if it had none, by its component count, as MuPDF and Poppler draw it: the
-    /// midpoint image shows mid-grey instead of nothing. A space the decoder knows (sRGB) is
-    /// drawn as before.
-    #[test]
-    fn a_jp2_image_in_a_refused_enumerated_colour_space_is_drawn() {
-        for (components, enumerated) in [(3, 19), (3, 22), (1, 15), (3, 16)] {
-            let mut r = PageRenderer::new(Arc::new(jp2_midpoint_pdf(components, enumerated)), RenderConfig::default());
-            let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(page.error.is_none(), "{enumerated}: {:?}", page.error);
-            let px = &page.rgba[((40 - 15) * 40 + 15) * 4..][..3];
-            assert!(px.iter().all(|&v| (120..=136).contains(&v)), "enum {enumerated}, {components} component(s): {px:?}");
-        }
-    }
-
-    #[test]
-    fn jpx_stream_bit_depth_boundaries_do_not_panic() {
-        use hayro::hayro_syntax::bit_reader::BitReader;
-        use hayro::hayro_syntax::object::stream::ImageDecodeParams;
-
-        for (bpc, expected) in [(1, 1), (8, 128), (16, 32_896), (31, 1_077_952_576), (32, 2_155_905_152)] {
-            let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(bpc, 1))).unwrap();
-            let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
-            let decoded = stream.decoded_image(&ImageDecodeParams { bpc: Some(bpc), ..Default::default() }).unwrap();
-            let image = decoded.image_data.unwrap();
-            assert_eq!((image.width, image.height, image.bits_per_component), (1, 1, bpc));
-            assert_eq!(decoded.data.len(), usize::from(bpc).div_ceil(8));
-            assert_eq!(BitReader::new(&decoded.data).read(bpc), Some(expected), "{bpc}-bit midpoint");
-        }
-    }
-
-    #[test]
-    fn jpx_streams_reject_out_of_range_bit_depths() {
-        use hayro::hayro_syntax::object::stream::ImageDecodeParams;
-
-        for bpc in [0, 33, 255] {
-            let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(bpc, 1))).unwrap();
-            let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
-            assert!(stream.decoded_image(&ImageDecodeParams { bpc: Some(bpc), ..Default::default() }).is_err());
-        }
-    }
-
-    #[test]
-    fn jpx_gray_rgb_and_alpha_keep_eight_bit_samples() {
-        use hayro::hayro_syntax::object::stream::ImageDecodeParams;
-
-        for components in [1, 3, 4] {
-            let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(8, components))).unwrap();
-            let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
-            let decoded = stream.decoded_image(&ImageDecodeParams::default()).unwrap();
-            let expected_colors = usize::from(components.min(3));
-            assert_eq!(decoded.data.as_ref(), vec![128; expected_colors]);
-            let alpha = decoded.image_data.unwrap().alpha;
-            assert_eq!(alpha, (components == 4).then(|| vec![128]));
-        }
-    }
-
-    #[test]
-    fn jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering() {
-        for bpc in [8, 32] {
-            let mut renderer = PageRenderer::new(Arc::new(jpx_midpoint_pdf(bpc, 1)), RenderConfig::default());
-            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(page.error.is_none(), "{bpc} bits: {:?}", page.error);
-            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "other page content draws");
-            if bpc == 8 {
-                assert_eq!(&page.rgba[((25 * 40 + 15) * 4)..][..4], &[128, 128, 128, 255], "the valid image paints gray");
-            }
-        }
-    }
-
-    /// From the nightly `cargo xtask fuzz` (CI caps each child at 4 GiB): a stencil mask claiming
-    /// /W 4294967295 and a CCITT image claiming /Columns 4294967295 each allocated 4 GiB while
-    /// decoding (locally: 9.6 GB and 4.3 GB). Vendored hayro patches `image_size_ok` and
-    /// `ccitt_size_ok` refuse such sizes before decoding; the rest of the page still draws.
-    #[test]
-    fn absurd_mask_and_fax_sizes_are_refused_before_decoding() {
-        assert!(hayro::hayro_interpret::image_size_ok(8000, 8000));
-        assert!(!hayro::hayro_interpret::image_size_ok(4_294_967_295, 2));
-        assert!(!hayro::hayro_interpret::image_size_ok(0, 10));
-        assert!(hayro::hayro_syntax::ccitt_size_ok(1728, 2200), "a fax page");
-        assert!(!hayro::hayro_syntax::ccitt_size_ok(4_294_967_295, 26));
-        assert!(!hayro::hayro_syntax::ccitt_size_ok(1 << 19, 1 << 12));
-        let page = |content: &str, xobject: &str| {
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj {xobject} endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            );
-            let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-            });
-            let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("an absurd image must not stall the renderer");
-            assert!(page.error.is_none(), "{:?}", page.error);
-            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
-        };
-        let red = "1 0 0 rg 0 0 4 4 re f";
-        page(&format!("q 20 0 0 20 5 5 cm BI /W 4294967295 /H 2 /IM true /BPC 1 ID \u{0}\u{ff}\u{ff}\u{0} EI Q {red}"), "<< >>");
-        let fax = "<< /Type /XObject /Subtype /Image /Width 81 /Height 26 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /CCITTFaxDecode /DecodeParms << /Columns 4294967295 /Rows 26 /K -1 >> /Length 4 >> stream\n\u{0}\u{0}\u{0}\u{0}\nendstream";
-        page(&format!("q 20 0 0 20 5 5 cm /Im1 Do Q {red}"), fax);
-    }
-
-    /// Scanners and fax services write Group 4 pages with `/Rows 0`, which ISO 32000-2 Table 11
-    /// defines as "height not predetermined" (the default), not as zero rows. Such a page used to
-    /// render blank. The image is an 8 × 4 all-black Group 4 stream, hand-encoded from ITU-T T.6:
-    /// one horizontal-mode row (white 0, black 8), three V0 rows, then EOFB.
-    #[test]
-    fn group4_fax_with_rows_zero_decodes_to_the_image_height() {
-        const ALL_BLACK_8X4: [u8; 6] = [0x26, 0xa2, 0xfe, 0x00, 0x20, 0x02];
-        for rows in ["", "/Rows 4", "/Rows 0"] {
-            let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
-            let mut pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /CCITTFaxDecode /DecodeParms << /K -1 /Columns 8 {rows} >> /Length {} >> stream\n",
-                content.len(),
-                ALL_BLACK_8X4.len()
-            )
-            .into_bytes();
-            pdf.extend_from_slice(&ALL_BLACK_8X4);
-            pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
-            let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(page.error.is_none(), "{rows:?}: {:?}", page.error);
-            assert_eq!(&page.rgba[((24 * 40 + 15) * 4)..][..4], &[0, 0, 0, 255], "{rows:?}: the fax image paints black");
-            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 255, 255, 255], "{rows:?}: outside the image stays white");
-        }
-    }
-
-    /// #3308: a fax image whose `/Rows` says fewer rows than its `/Height` (a plotter driver wrote
-    /// `/Rows` equal to `/Columns`) is decoded to its height: only the first `/Rows` rows were
-    /// decoded and the rest drawn black, as MuPDF and Acrobat don't. `/BlackIs1` turns the fixture
-    /// white, so rows left undecoded show as black. Also through an `/Indexed` colour space, the
-    /// filter's other output path.
-    #[test]
-    fn group4_fax_with_rows_below_its_height_decodes_to_the_image_height() {
-        const ALL_BLACK_8X4: [u8; 6] = [0x26, 0xa2, 0xfe, 0x00, 0x20, 0x02];
-        for (space, rows) in [("/DeviceGray", "/Rows 2"), ("[/Indexed /DeviceRGB 1 <000000FFFFFF>]", "/Rows 2"), ("/DeviceGray", "/Rows 4")] {
-            let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
-            let mut pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace {space} /BitsPerComponent 1 /Filter /CCITTFaxDecode /DecodeParms << /K -1 /Columns 8 {rows} /BlackIs1 true >> /Length {} >> stream
-",
-                content.len(),
-                ALL_BLACK_8X4.len()
-            )
-            .into_bytes();
-            pdf.extend_from_slice(&ALL_BLACK_8X4);
-            pdf.extend_from_slice(
-                b"
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            );
-            let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(page.error.is_none(), "{space} {rows}: {:?}", page.error);
-            for y in [17, 22, 27, 32] {
-                assert_eq!(&page.rgba[((y * 40 + 15) * 4)..][..4], &[255, 255, 255, 255], "{space} {rows}: image row at y {y} is decoded");
-            }
-        }
-    }
-
-    #[test]
-    fn tiff_predictor_packed_rgb_rows_keep_their_byte_boundaries() {
-        use hayro_syntax::object::{FromBytes, Object};
-        use std::io::Write;
-
-        // Red then green, with only the real sample bits compared: row padding may change.
-        // The three-column case also checks horizontal differencing: red/green/blue and
-        // green/red/blue, whose one-bit component differences wrap modulo two.
-        struct RowCase {
-            bpc: u8,
-            columns: u32,
-            encoded: &'static [u8],
-            expected: &'static [u8],
-            masks: &'static [u8],
-        }
-        let cases = [
-            RowCase { bpc: 1, columns: 1, encoded: &[0x80, 0x40], expected: &[0x80, 0x40], masks: &[0xe0] },
-            RowCase { bpc: 2, columns: 1, encoded: &[0xc0, 0x30], expected: &[0xc0, 0x30], masks: &[0xfc] },
-            RowCase { bpc: 4, columns: 1, encoded: &[0xf0, 0, 0x0f, 0], expected: &[0xf0, 0, 0x0f, 0], masks: &[0xff, 0xf0] },
-            RowCase { bpc: 1, columns: 3, encoded: &[0x99, 0x80, 0x5a, 0x80], expected: &[0x88, 0x80, 0x50, 0x80], masks: &[0xff, 0x80] },
-            RowCase { bpc: 8, columns: 1, encoded: &[255, 0, 0, 0, 255, 0], expected: &[255, 0, 0, 0, 255, 0], masks: &[0xff, 0xff, 0xff] },
-        ];
-        for RowCase { bpc, columns, encoded, expected, masks } in cases {
-            let mut encoder = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
-            encoder.write_all(encoded).unwrap();
-            let compressed = encoder.finish().unwrap();
-            let mut bytes = format!(
-                "<< /Filter /FlateDecode /DecodeParms << /Predictor 2 /Colors 3 /BitsPerComponent {bpc} /Columns {columns} >> /Length {} >> stream\n",
-                compressed.len()
-            )
-            .into_bytes();
-            bytes.extend_from_slice(&compressed);
-            bytes.extend_from_slice(b"\nendstream");
-            let Object::Stream(stream) = Object::from_bytes(&bytes).unwrap() else { panic!("stream expected") };
-            let decoded = stream.decoded().unwrap();
-            assert_eq!(decoded.len(), expected.len());
-            for ((actual, expected), mask) in decoded.iter().zip(expected).zip(masks.iter().cycle()) {
-                assert_eq!(actual & mask, *expected, "{bpc}-bit RGB, {columns} columns");
-            }
-        }
-    }
-
-    #[test]
-    fn tiff_predictor_packed_rgb_image_renders_every_row() {
-        use std::io::Write;
-
-        let mut encoder = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
-        encoder.write_all(&[0x80, 0x40]).unwrap();
-        let compressed = encoder.finish().unwrap();
-        let content = "q 40 0 0 40 0 0 cm /Im1 Do Q";
-        let mut pdf = format!(
-            "%PDF-1.7\n\
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
-4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 1 /Filter /FlateDecode /DecodeParms << /Predictor 2 /Colors 3 /BitsPerComponent 1 /Columns 1 >> /Length {} >> stream\n",
-            content.len(),
-            compressed.len()
-        )
-        .into_bytes();
-        pdf.extend_from_slice(&compressed);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (40, 40));
-        let pixel = |y: usize| &page.rgba[((y * 40 + 20) * 4)..][..4];
-        assert_eq!(pixel(10), &[255, 0, 0, 255]);
-        assert_eq!(pixel(30), &[0, 255, 0, 255]);
-    }
-
-    /// From the nightly `cargo xtask fuzz`: a FlateDecode predictor with `/Columns
-    /// 9223372036854775807` wrapped to a 2^61-byte row allocation (an abort on any machine), and
-    /// a line width of 9223372036854775807 made stroke expansion allocate 10 GB. Vendored hayro
-    /// patches: saturating predictor rows refused when longer than the data, and stroke widths
-    /// clamped to a few canvases. The page still renders, with the huge stroke covering it.
-    #[test]
-    fn absurd_predictor_columns_and_line_widths_render() {
-        let render = |streams: &[&str]| {
-            let mut objs = String::new();
-            let mut refs = Vec::new();
-            for (i, s) in streams.iter().enumerate() {
-                let n = 4 + i;
-                refs.push(format!("{n} 0 R"));
-                objs.push_str(&format!("{n} 0 obj {s} endobj\n"));
-            }
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [{}] >> endobj
-{objs}trailer << /Root 1 0 R >>
-%%EOF",
-                refs.join(" ")
-            );
-            let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-            });
-            let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("must not stall the renderer");
-            assert!(page.error.is_none(), "{:?}", page.error);
-            page
-        };
-        let plain = |content: &str| format!("<< /Length {} >> stream\n{content}\nendstream", content.len());
-        // Stored (uncompressed) zlib data, so the stream needs no encoder: header, one final
-        // stored block of two bytes, checksum.
-        let predicted = "<< /Filter /FlateDecode /DecodeParms << /Predictor 12 /Columns 9223372036854775807 >> /Length 13 >> stream\nx\u{1}\u{1}\u{2}\u{0}\u{fd}\u{ff}\u{0}\u{0}\u{0}\u{1}\u{0}\u{1}\nendstream";
-        let page = render(&[predicted, &plain("1 0 0 rg 0 0 4 4 re f")]);
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the other content stream draws");
-        let page = render(&[&plain("1 0 0 RG 9223372036854775807 w 10 20 m 30 20 l S")]);
-        // Butt caps: the stroke covers the band over the segment (x 10 to 30) top to bottom.
-        for (x, y) in [(20, 0), (20, 39), (12, 0), (28, 39)] {
-            assert_eq!(&page.rgba[((y * 40 + x) * 4)..][..4], &[255, 0, 0, 255], "({x}, {y}) under the huge stroke");
-        }
-        assert_eq!(&page.rgba[((20 * 40 + 2) * 4)..][..4], &[255, 255, 255, 255], "beyond the butt cap");
-    }
-
-    /// Render a 40 × 40 pt page at 1:1 on its own thread, with `/GS1` (from `gs1`) in its
-    /// resources, and fail instead of waiting when the renderer stalls.
-    fn render_with_gs1(content: &str, gs1: &str) -> RenderedPage {
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /ExtGState << /GS1 {gs1} >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        );
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        page
-    }
-
-    /// The pixel at device (x, y), y down, of a 40-pixel-wide page.
-    fn px40(page: &RenderedPage, x: usize, y: usize) -> &[u8] {
-        &page.rgba[((y * 40 + x) * 4)..][..4]
-    }
-
-    /// From `cargo xtask fuzz`: an ExtGState `/D [[11] 0]` on a line that starts at x =
-    /// 92234775807 cut it into billions of dashes, and stroke expansion allocated more than
-    /// 5 GB. A tiny dash on an ordinary line does the same (`[0.000001] 0 d` on 20 pt passed
-    /// 10 GB), and so does a long pattern on many short subpaths, because every subpath restarts
-    /// it. Vendored hayro patch: a stroke whose dash pattern could cut it into more than
-    /// `MAX_DASHES_PER_STROKE` pieces is drawn solid.
-    #[test]
-    fn dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render() {
-        let red = [255, 0, 0, 255];
-        // The fuzzed shape. A line that far out isn't drawn even undashed (its coordinates are
-        // beyond the rasterizer's range), so this case only proves the page finishes and the
-        // content after the stroke is drawn.
-        let page = render_with_gs1("1 0 0 RG 4 w /GS1 gs 92234775807 20 m 30 20 l S 0 0 1 rg 0 0 4 4 re f", "<< /D [[11] 0] >>");
-        assert_eq!(px40(&page, 1, 38), &[0, 0, 255, 255], "the square after the stroke is drawn");
-        for (what, content, gs1) in [
-            ("a tiny dash on an ordinary line", "1 0 0 RG 4 w [0.000001] 0 d 10 20 m 30 20 l S", "<< >>"),
-            ("a tiny dash from an ExtGState", "1 0 0 RG 4 w /GS1 gs 10 20 m 30 20 l S", "<< /D [[0.000001] 0] >>"),
-            (
-                "a tiny dash under a shrinking matrix",
-                "1 0 0 RG 0.0000001 0 0 0.0000001 0 0 cm 40000000 w [1] 0 d 100000000 200000000 m 300000000 200000000 l S",
-                "<< >>",
-            ),
-        ] {
-            let page = render_with_gs1(content, gs1);
-            // Device row 20 is user y 20; the stroke covers x 10 to 30.
-            for x in [12, 20, 28] {
-                assert_eq!(px40(&page, x, 20), &red, "{what}: ({x}, 20) is drawn, solid");
-            }
-            assert_eq!(px40(&page, 35, 20), &[255, 255, 255, 255], "{what}: beyond the end of the line");
-        }
-        // A long pattern on many short subpaths: 9,999 tiny dashes, then a long one, restarted on
-        // each of 10,000 subpaths 0.01 pt long, is 100 million pieces from a 300 KB stream.
-        let mut many = String::from("1 0 0 RG 4 w [");
-        many.push_str(&"0.000001 ".repeat(9_999));
-        many.push_str("1000] 0 d ");
-        many.push_str(&"10 20 m 10.01 20 l ".repeat(10_000));
-        many.push_str("S 0 0 1 rg 0 0 4 4 re f");
-        let page = render_with_gs1(&many, "<< >>");
-        assert_eq!(px40(&page, 1, 38), &[0, 0, 255, 255], "a pattern restarted on many subpaths finishes");
-        // A fine pattern below the cap still dashes: 200,000 pieces of 0.0001 pt cover about
-        // half of each pixel, so the line is neither solid red nor missing.
-        let page = render_with_gs1("1 0 0 RG 4 w [0.0001] 0 d 10 20 m 30 20 l S", "<< >>");
-        let p = px40(&page, 20, 20);
-        assert!(p[0] == 255 && (40..=215).contains(&p[1]), "a fine dash below the cap is drawn dashed: {p:?}");
-        // An ordinary dash pattern still dashes: butt-capped 4 pt dashes from x 0.
-        let page = render_with_gs1("1 0 0 RG 4 w [4 4] 0 d 0 20 m 40 20 l S", "<< >>");
-        assert_eq!(px40(&page, 2, 20), &red, "inside the first dash");
-        assert_eq!(px40(&page, 6, 20), &[255, 255, 255, 255], "inside the first gap");
-        assert_eq!(px40(&page, 10, 20), &red, "inside the second dash");
-    }
-
-    /// From `cargo xtask fuzz` triage: a dash array whose entries sum to less than zero made
-    /// kurbo's search for the starting dash loop for ever (`[-1 -1] 0 d` never finished).
-    /// ISO 32000-2 §8.4.3.6 requires nonnegative entries. Vendored hayro patch: a pattern with a
-    /// negative entry, or a period that isn't positive, is drawn solid.
-    #[test]
-    fn invalid_dash_patterns_terminate_and_are_drawn_solid() {
-        for (what, content, gs1) in [
-            ("[-1 -1]", "1 0 0 RG 4 w [-1 -1] 0 d 10 20 m 30 20 l S", "<< >>"),
-            ("[-1] with a phase", "1 0 0 RG 4 w [-1] 5 d 10 20 m 30 20 l S", "<< >>"),
-            ("[-2 -3] from an ExtGState", "1 0 0 RG 4 w /GS1 gs 10 20 m 30 20 l S", "<< /D [[-2 -3] 0] >>"),
-            ("[-1 3], a negative entry in a positive period", "1 0 0 RG 4 w [-1 3] 0 d 10 20 m 30 20 l S", "<< >>"),
-        ] {
-            let page = render_with_gs1(content, gs1);
-            for x in [12, 20, 28] {
-                assert_eq!(px40(&page, x, 20), &[255, 0, 0, 255], "{what}: ({x}, 20) is drawn, solid");
-            }
-        }
-    }
-
-    /// From the nightly `cargo xtask fuzz`: a Type 3 glyph that shows several glyphs of its own
-    /// font. The nesting cap bounds the depth but not the breadth: eight glyphs per glyph, sixteen
-    /// deep, is 8^16 paints. Vendored hayro-interpret patch: nested paints (forms, Type 3 glyphs,
-    /// tiling patterns inside one another) share a per-page budget.
-    #[test]
-    fn type3_glyphs_that_fan_out_into_themselves_finish() {
-        let pdf = "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length 53 >> stream
-BT /F1 20 Tf 10 10 Td (A) Tj ET 1 0 0 rg 0 0 4 4 re f
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 1 1] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [1]
-  /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> >> endobj
-6 0 obj << /Length 48 >> stream
-1 0 d0 BT /F1 1 Tf (AAAAAAAA) Tj ET 0 0 1 1 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf.as_bytes().to_vec()), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("a self-multiplying Type 3 glyph must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
-    }
-
-    /// `depth` direct arrays (`array`), dictionaries with a key (`dict`) or both in turn (`mixed`)
-    /// around `null`.
-    fn nested(depth: usize, kind: &str) -> String {
-        let is_dict = |level| kind == "dict" || (kind == "mixed" && level % 2 == 0);
-        let mut value = String::new();
-        for level in 0..depth {
-            value.push_str(if is_dict(level) { "<< /N " } else { "[" });
-        }
-        value.push_str("null");
-        for level in (0..depth).rev() {
-            value.push_str(if is_dict(level) { " >>" } else { "]" });
-        }
-        value
-    }
-
-    /// `depth` dictionaries nested without keys (`<< << >> >>`), closed or not.
-    fn keyless(depth: usize, closed: bool) -> String {
-        let mut value = "<< ".repeat(depth);
-        if closed {
-            value.push_str(&">> ".repeat(depth));
-        }
-        value
-    }
-
-    /// A 40 × 40 page that runs `content`, with a correct xref table and `trailer` at the end
-    /// of a trailer that also points at an `/Info` title.
-    fn nesting_pdf(trailer: &str, content: &str) -> Vec<u8> {
-        let mut bytes = b"%PDF-1.7\n".to_vec();
-        let mut offsets = vec![0];
-        for (index, body) in [
-            "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
-            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
-            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << >> >>".to_string(),
-            format!("<< /Length {} >> stream\n{content}\nendstream", content.len()),
-            "<< /Title (Nested) >>".to_string(),
-        ]
-        .iter()
-        .enumerate()
-        {
-            offsets.push(bytes.len());
-            bytes.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", index + 1).as_bytes());
-        }
-        let xref = bytes.len();
-        bytes.extend_from_slice(b"xref\n0 6\n0000000000 65535 f \n");
-        for offset in &offsets[1..] {
-            bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
-        }
-        bytes.extend_from_slice(format!("trailer << /Size 6 /Root 1 0 R /Info 5 0 R {trailer} >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
-        bytes
-    }
-
-    /// Opens `bytes` and renders its one page, which must render without an error.
-    fn nesting_render(bytes: Vec<u8>) -> RenderedPage {
-        let parsed = Pdf::new(bytes.clone()).expect("xref repair can recover the catalog when the trailer is malformed");
-        assert_eq!(parsed.pages().len(), 1);
-        let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (40, 40));
-        page
-    }
-
-    /// Direct arrays and dictionaries used to recurse without a bound while skipping even
-    /// unused trailer values and content operands. Exercise the vendored patch in workspace CI.
-    #[test]
-    fn deeply_nested_direct_objects_do_not_overflow_the_stack() {
-        use hayro_syntax::object::Object;
-        use hayro_syntax::reader::{Reader, ReaderExt};
-        let pdf = |unused: &str, content: &str| nesting_pdf(&format!("/Unused {unused}"), content);
-        let paint = "1 0 0 rg 0 0 4 4 re f";
-        for kind in ["array", "dict", "mixed"] {
-            // Run the crash reproducer first, so the unpatched red state is a stack overflow.
-            let page = nesting_render(pdf(&nested(100_000, kind), paint));
-            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{kind}: repaired trailer");
-            for depth in [20, 128, 129] {
-                let value = nested(depth, kind);
-                let siblings = format!("{value} [] []");
-                let mut reader = Reader::new(siblings.as_bytes());
-                assert_eq!(reader.skip::<Object<'_>>(false).is_some(), depth <= 128, "{kind}: depth {depth}");
-                if depth > 128 {
-                    assert_eq!(reader.offset(), 0, "failed skips restore the offset");
-                    reader.jump(value.len());
-                }
-                // A failed skip must unwind its depth; successful siblings must not accumulate it.
-                for _ in 0..2 {
-                    reader.skip_white_spaces();
-                    assert!(reader.skip::<Object<'_>>(false).is_some());
-                }
-                let page = nesting_render(pdf(&value, paint));
-                assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{kind}: depth {depth}");
-            }
-            // Many siblings exercise the offset constructor and ensure depth is per nesting.
-            let siblings = "[] ".repeat(256);
-            let mut reader = Reader::new_with(siblings.as_bytes(), 0);
-            for _ in 0..256 {
-                assert!(reader.skip::<Object<'_>>(false).is_some());
-                reader.skip_white_spaces();
-            }
-        }
-        // Content-stream arrays take the Object path, rather than MaybeRef<Object>.
-        for depth in [100_000, 20, 128, 129] {
-            let value = nested(depth, "array");
-            let mut reader = Reader::new(value.as_bytes());
-            assert_eq!(reader.skip::<Object<'_>>(true).is_some(), depth <= 128, "content: depth {depth}");
-            let content = format!("{value} discard {paint}");
-            let page = nesting_render(pdf("null", &content));
-            if depth <= 128 {
-                assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "content: depth {depth}");
-            }
-        }
-    }
-
-    /// A dictionary with an object where a key belongs is repaired by reading that object, not
-    /// skipping it, and that read recursed without a bound when the object was another such
-    /// dictionary: `<<` 100,000 times aborted the process. Here as a content-stream operand.
-    #[test]
-    fn dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack() {
-        for closed in [true, false] {
-            let content = format!("1 0 0 rg 0 0 4 4 re f {} discard", keyless(100_000, closed));
-            let page = nesting_render(nesting_pdf("", &content));
-            assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
-        }
-    }
-
-    /// The same, where a key of the trailer belongs: the xref table can't be used, and repair
-    /// finds the catalog.
-    #[test]
-    fn dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack() {
-        for closed in [true, false] {
-            let page = nesting_render(nesting_pdf(&keyless(100_000, closed), "1 0 0 rg 0 0 4 4 re f"));
-            assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
-        }
-    }
-
-    /// The same as the properties of marked content (`/Tag <<<<<< … BDC`).
-    #[test]
-    fn dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack() {
-        for closed in [true, false] {
-            let properties = if closed { "<<".repeat(100_000) + &">>".repeat(100_000) } else { "<<".repeat(100_000) };
-            let content = format!("1 0 0 rg 0 0 4 4 re f /Tag {properties} BDC 0 0 1 rg 36 36 4 4 re f EMC");
-            let page = nesting_render(nesting_pdf("", &content));
-            assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
-        }
-    }
-
-    /// Through the same three paths, dictionaries without keys are read up to the nesting cap
-    /// (128 dictionaries in all) and refused one past it.
-    #[test]
-    fn dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap() {
-        use hayro_syntax::object::{FromBytes, Object};
-        use hayro_syntax::reader::{Reader, ReaderExt};
-        let (red, blue, white) = ([255, 0, 0, 255], [0, 0, 255, 255], [255, 255, 255, 255]);
-        for depth in [128, 129] {
-            let within = depth <= 128;
-            let value = keyless(depth, true);
-            assert_eq!(Object::from_bytes(value.as_bytes()).is_some(), within, "object: {depth}");
-            assert_eq!(Reader::new(value.as_bytes()).read_without_context::<Object<'_>>().is_some(), within, "operand: {depth}");
-            // Content reading stops at an operand it can't read, so the blue square is drawn
-            // only when the dictionaries were read.
-            let properties = "<<".repeat(depth) + &">>".repeat(depth);
-            for (path, operand) in [("operand", format!("{value} discard")), ("BDC", format!("/Tag {properties} BDC"))] {
-                let content = format!("1 0 0 rg 0 0 4 4 re f {operand} 0 0 1 rg 36 36 4 4 re f");
-                let page = nesting_render(nesting_pdf("", &content));
-                assert_eq!(px40(&page, 1, 38), &red, "{path}: {depth}");
-                assert_eq!(px40(&page, 38, 1), if within { &blue } else { &white }, "{path}: {depth}");
-            }
-            // The trailer is the outermost dictionary. Within the cap it is read (with its
-            // /Info); past it, repair recovers the catalog but not the trailer.
-            let bytes = nesting_pdf(&keyless(depth - 1, true), "1 0 0 rg 0 0 4 4 re f");
-            let parsed = Pdf::new(bytes.clone()).expect("the trailer or repair finds the catalog");
-            assert_eq!(parsed.metadata().title, within.then(|| b"Nested".to_vec()), "trailer: {depth}");
-            assert_eq!(px40(&nesting_render(bytes), 1, 38), &red, "trailer: {depth}");
-        }
-    }
-
-    /// The cap must also fit small stacks: skip, read, iterate down with the array iterators and
-    /// format (`{:?}`) the deepest nesting it admits, of arrays, dictionaries, both and
-    /// dictionaries without keys, on a 512 KiB thread in a debug build. Measured when this was
-    /// written (macOS arm64, dev profile): at most about 100 KiB, for `{:?}` of 128 dictionaries.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn nesting_at_the_cap_fits_a_512_kib_stack() {
-        use hayro_syntax::object::{FromBytes, Object};
-        use hayro_syntax::reader::{Reader, ReaderExt};
-        let worker = std::thread::Builder::new().stack_size(512 * 1024).spawn(|| {
-            // (kind, arrays and dictionaries `{:?}` shows, levels walked down to the end)
-            for (kind, arrays, dicts, levels) in [("array", 128, 0, 129), ("dict", 0, 128, 129), ("mixed", 64, 64, 129), ("keyless", 0, 1, 1)] {
-                let value = if kind == "keyless" { keyless(128, true) } else { nested(128, kind) };
-                assert!(Reader::new(value.as_bytes()).skip::<Object<'_>>(false).is_some(), "{kind}: skip");
-                assert!(Reader::new(value.as_bytes()).skip::<Object<'_>>(true).is_some(), "{kind}: skip in content");
-                assert!(Reader::new(value.as_bytes()).read_without_context::<Object<'_>>().is_some(), "{kind}: operand");
-                let object = Object::from_bytes(value.as_bytes()).expect("the cap admits 128 levels");
-                let shown = format!("{object:?}");
-                assert_eq!((shown.matches("Array(").count(), shown.matches("Dict(").count()), (arrays, dicts), "{kind}: {{:?}}");
-                let (mut walked, mut next) = (0, Some(object));
-                while let Some(object) = next.take() {
-                    walked += 1;
-                    next = match object {
-                        Object::Array(array) => {
-                            assert_eq!(array.raw_iter().count(), 1, "{kind}: raw_iter");
-                            assert!(array.flex_iter().next::<Object<'_>>().is_some(), "{kind}: flex_iter");
-                            array.iter::<Object<'_>>().next()
-                        }
-                        Object::Dict(dict) => dict.get::<Object<'_>>("N"),
-                        _ => None,
-                    };
-                }
-                assert_eq!(walked, levels, "{kind}: iterate");
-            }
-        });
-        // A stack overflow aborts the process; a failed check is a panic, shown as it is.
-        if let Err(panic) = worker.expect("spawn a 512 KiB thread").join() {
-            std::panic::resume_unwind(panic);
-        }
-    }
-
-    /// From the nightly `cargo xtask fuzz`: many small inline images, each with "EI" (followed
-    /// by a space) inside its data, and no text anywhere. To decide whether such an "EI" ends the
-    /// data, the parser re-read the rest of the stream as content, and that re-read did the same
-    /// for every inline image it met, nesting through the whole stream: 50 images (3 KB) ran for
-    /// over ten minutes. Vendored hayro-syntax patch: the re-read doesn't nest, and the search is
-    /// bounded.
-    #[test]
-    fn inline_images_with_ei_in_their_data_parse_in_linear_time() {
-        let image = b"q 1 0 0 1 0 0 cm\nBI\n/IM true\n/W 8\n/H 2\n/BPC 1\nID \x01 EI \x02\nEI Q\n";
-        let content: Vec<u8> = image.iter().copied().cycle().take(image.len() * 200).collect();
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut iter = hayro::hayro_syntax::content::TypedIter::new(&content);
-            let mut ops = 0usize;
-            while iter.next().is_some() {
-                ops += 1;
-            }
-            let _ = tx.send(ops);
-        });
-        let ops = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("inline images must not stall the parser");
-        assert!(ops >= 200 * 4, "every image and its q/cm/Q are read: {ops}");
-    }
-
-    /// From the nightly `cargo xtask fuzz`: a JBIG2 image whose stream declares a page and a
-    /// generic region of 65535 × 65535 pixels (each side within JBIG2's limit) behind a small
-    /// /Width and /Height: decoding its 4.3 billion pixels one by one took minutes. Vendored
-    /// hayro-jbig2 patch: at most 2^28 pixels per bitmap, and 2^26 per symbol dictionary.
-    #[test]
-    fn jbig2_regions_of_billions_of_pixels_are_refused() {
-        // Embedded JBIG2 segments (ISO 14492 §7.2): page information, then an immediate generic
-        // region, both 65535 × 65535, followed by arithmetic-coded data.
-        let mut jbig2 = Vec::new();
-        let mut segment = |number: u32, kind: u8, data: &[u8]| {
-            jbig2.extend_from_slice(&number.to_be_bytes());
-            jbig2.extend_from_slice(&[kind, 0, 1]);
-            jbig2.extend_from_slice(&u32::try_from(data.len()).unwrap().to_be_bytes());
-            jbig2.extend_from_slice(data);
-        };
-        let side = 65535u32.to_be_bytes();
-        let mut page = Vec::new();
-        page.extend_from_slice(&side);
-        page.extend_from_slice(&side);
-        page.extend_from_slice(&[0; 8]); // resolution
-        page.extend_from_slice(&[0, 0, 0]); // flags, striping
-        segment(0, 48, &page);
-        let mut region = Vec::new();
-        region.extend_from_slice(&side);
-        region.extend_from_slice(&side);
-        region.extend_from_slice(&[0; 9]); // x, y, combination operator
-        region.push(0); // arithmetic coding, template 0
-        region.extend_from_slice(&[3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // AT pixels
-        region.extend_from_slice(&[0x5a; 64]);
-        segment(1, 38, &region);
-        let content = b"q 20 0 0 20 5 5 cm /Im1 Do Q 1 0 0 rg 0 0 4 4 re f";
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
-        pdf.extend_from_slice(content);
-        pdf.extend_from_slice(b"\nendstream endobj\n");
-        pdf.extend_from_slice(
-            format!("5 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 8 /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n", jbig2.len())
-                .as_bytes(),
-        );
-        pdf.extend_from_slice(&jbig2);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("a huge JBIG2 region must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
-    }
-
-    /// From `cargo xtask fuzz`: one changed byte in a symbol dictionary's arithmetic-coded data
-    /// hung the renderer. Two of its loops can stop advancing: an export run of length 0, and a
-    /// height class whose first width is already the end-of-class marker. Past the end of its
-    /// data the decoder can return those for ever. Vendored hayro-jbig2 patch: at most one height
-    /// class per new symbol and `2 × symbols + 1` export runs, each plus `EXTRA_EMPTY_STEPS`.
-    /// These synthetic dictionaries (two new symbols each, a few bytes of arbitrary data) decode
-    /// the same way. In the second every class after the first symbol adds 13 to the height, so it
-    /// only fails when the height overflows `u32`, after 330 million empty classes (about five
-    /// seconds; a delta of 0 would never end). The page draws it as twenty images, so that the
-    /// stall without the patch is well past the timeout on any machine.
-    #[test]
-    fn jbig2_symbol_dictionaries_that_never_advance_terminate() {
-        for (what, data, copies) in
-            [("zero-length export runs", &[0x05, 0x70, 0x05, 0x14, 0x02, 0x1d, 0x56, 0x3f][..], 1), ("empty height classes", &[0x06, 0x99][..], 20)]
-        {
-            // Embedded JBIG2 segments (ISO 14492 §7.2): page information, then a symbol dictionary.
-            let mut jbig2 = Vec::new();
-            let mut segment = |number: u32, kind: u8, data: &[u8]| {
-                jbig2.extend_from_slice(&number.to_be_bytes());
-                jbig2.extend_from_slice(&[kind, 0, 1]);
-                jbig2.extend_from_slice(&u32::try_from(data.len()).unwrap().to_be_bytes());
-                jbig2.extend_from_slice(data);
-            };
-            let mut page = Vec::new();
-            page.extend_from_slice(&8u32.to_be_bytes());
-            page.extend_from_slice(&8u32.to_be_bytes());
-            page.extend_from_slice(&[0; 8]); // resolution
-            page.extend_from_slice(&[0, 0, 0]); // flags, striping
-            segment(0, 48, &page);
-            let mut dictionary = vec![0, 0]; // arithmetic coding, template 0, no refinement
-            dictionary.extend_from_slice(&[3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // AT pixels
-            dictionary.extend_from_slice(&1u32.to_be_bytes()); // exported symbols
-            dictionary.extend_from_slice(&2u32.to_be_bytes()); // new symbols
-            dictionary.extend_from_slice(data);
-            segment(1, 0, &dictionary);
-            // Each copy is its own image XObject (5, 6, …), all drawn by the page.
-            let images: Vec<usize> = (5..5 + copies).collect();
-            let mut content: String = images.iter().map(|n| format!("q 20 0 0 20 5 5 cm /Im{n} Do Q ")).collect();
-            content.push_str("1 0 0 rg 0 0 4 4 re f");
-            let names: String = images.iter().map(|n| format!("/Im{n} {n} 0 R ")).collect();
-            let mut pdf = format!("%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << {names}>> >> >> endobj\n").into_bytes();
-            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
-            for n in &images {
-                pdf.extend_from_slice(
-                    format!("{n} 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 8 /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n", jbig2.len())
-                        .as_bytes(),
-                );
-                pdf.extend_from_slice(&jbig2);
-                pdf.extend_from_slice(b"\nendstream endobj\n");
-            }
-            pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
-            let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-            });
-            let page = rx
-                .recv_timeout(std::time::Duration::from_secs(20))
-                .unwrap_or_else(|_| panic!("{what}: a JBIG2 symbol dictionary must not stall the renderer"));
-            assert!(page.error.is_none(), "{what}: {:?}", page.error);
-            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{what}: the rest of the page draws");
-        }
-    }
-
-    /// Item 1 of storytold/pdfcraft#623: a page's content used to be cut at `MAX_DECODED_STREAM`,
-    /// so everything after the cut was lost (the text and the title block of the A1 sample). Content
-    /// that expands by a few times over is read to its end, however large it is.
-    #[test]
-    fn page_content_past_the_old_cap_renders() {
-        let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
-        // Blocks of a comment and a run of blanks. Each compresses about thirty times over, well
-        // within the budget that `ContentReader` allows.
-        let mut content = Vec::with_capacity(limit + (8 << 20));
-        let mut state = 0x2545_f491_4f6c_dd1d_u64;
-        while content.len() < limit + (8 << 20) {
-            content.push(b'%');
-            for _ in 0..3 {
-                state = state.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1);
-                content.push(b'a' + ((state >> 33) % 26) as u8);
-            }
-            content.push(b'\n');
-            content.resize(content.len() + 128, b' ');
-        }
-        content.extend_from_slice(b"1 0 0 rg 0 0 4 4 re f");
-        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
-        std::io::Write::write_all(&mut z, &content).unwrap();
-        let stream = z.finish().unwrap();
-        assert!(content.len() < 64 * stream.len(), "the content expands by less than the budget allows");
-
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", stream.len()).as_bytes());
-        pdf.extend_from_slice(&stream);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(120)).expect("a large page must render");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert!(!page.warnings.contains(&RenderWarning::ContentTruncated), "nothing was cut");
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the square after the old cap draws");
-    }
-
-    /// The content stream is interpreted a window at a time. An inline image with more data than
-    /// a window is read whole, and what follows it is still drawn.
-    #[test]
-    fn inline_images_longer_than_a_window_are_read_whole() {
-        let mut content = b"q 300 0 0 300 0 0 cm BI /W 300 /H 300 /BPC 8 /CS /G ID ".to_vec();
-        content.extend(std::iter::repeat_n(0x80_u8, 300 * 300));
-        content.extend_from_slice(b" EI Q 1 0 0 rg 0 0 4 4 re f");
-        let pdf = one_page_pdf(&content, "");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("an inline image must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        let pixel = |x: u32, y: u32| {
-            let offset = ((y * page.width + x) * 4) as usize;
-            [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
-        };
-        assert_eq!(pixel(1, 38), [255, 0, 0, 255], "the square after the image draws");
-        let grey = pixel(30, 5);
-        assert!(grey[0] == grey[1] && grey[1] == grey[2] && grey[0] < 255, "the image covers the page: {grey:?}");
-    }
-
-    /// A five-point open polyline is not a rectangle. `path_as_rect` took any five-element path
-    /// whose points covered the four corners of its bounding box for that box, and a `MoveTo` with
-    /// four `LineTo` is five elements, so an open zigzag stroked with `S` was painted as its
-    /// bounding rectangle: the peak between its ends vanished and the open side came out closed.
-    #[test]
-    fn a_five_point_polyline_is_not_painted_as_its_bounding_box() {
-        // The ends and the points beside them sit on the four corners of the bounding box; the
-        // peak at (20, 20) lies between them and is on no corner.
-        let content = b"0 0 0 RG 2 w 30 30 m 30 10 l 20 20 l 10 10 l 10 30 l S".to_vec();
-        let pdf = one_page_pdf(&content, "");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("the polyline must render");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        // Device y counts down the 40 pt page, so the two ends at y = 30 are on row 10.
-        let dark = |x: u32, y: u32| {
-            let offset = ((y * page.width + x) * 4) as usize;
-            page.rgba[offset] < 128
-        };
-        assert!((17..=23).any(|x| (17..=23).any(|y| dark(x, y))), "the peak between the ends draws");
-        assert!(!(14..=26).any(|x| dark(x, 10)), "the side the path leaves open stays open");
-    }
-
-    /// Five points all on the corners still need not trace the rectangle: three sides and a step
-    /// back along the third is such a path, and it was painted as the box -- drawing a fourth
-    /// side the path does not have (FredApps on #3327).
-    #[test]
-    fn a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle() {
-        // Bottom, right, top, then back along the top. The left side is never drawn.
-        let content = b"0 0 0 RG 2 w 10 10 m 30 10 l 30 30 l 10 30 l 30 30 l S".to_vec();
-        let pdf = one_page_pdf(&content, "");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("the path must render");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        let dark = |x: u32, y: u32| {
-            let offset = ((y * page.width + x) * 4) as usize;
-            page.rgba[offset] < 128
-        };
-        // Device y counts down the 40 pt page: the bottom side at y = 10 is row 30.
-        assert!((14..=26).any(|x| dark(x, 30)), "the sides the path does draw are drawn");
-        assert!(!(14..=26).any(|y| dark(10, y)), "the left side it never draws is not drawn");
-    }
-
-    /// A rectangle still takes the rectangle route, written either way: `m l l l` and closed, or
-    /// `m l l l l` back to its first corner.
-    #[test]
-    fn a_rectangle_is_still_painted_as_a_rectangle() {
-        for content in [&b"0 0 0 rg 10 10 m 30 10 l 30 30 l 10 30 l f"[..], &b"0 0 0 rg 10 10 m 30 10 l 30 30 l 10 30 l 10 10 l f"[..]] {
-            let pdf = one_page_pdf(content, "");
-            let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
-            });
-            let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("the rectangle must render");
-            assert!(page.error.is_none(), "{:?}", page.error);
-            let pixel = |x: u32, y: u32| {
-                let offset = ((y * page.width + x) * 4) as usize;
-                page.rgba[offset]
-            };
-            assert!(pixel(20, 20) < 128, "the rectangle is filled");
-            assert_eq!(pixel(5, 5), 255, "and nothing outside it is");
-        }
-    }
-
-    /// A one-page PDF whose content is the stream `stream`, with the entries `dict` in its
-    /// dictionary.
-    fn one_page_pdf(stream: &[u8], dict: &str) -> Vec<u8> {
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << {dict} /Length {} >> stream\n", stream.len()).as_bytes());
-        pdf.extend_from_slice(stream);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        pdf
-    }
-
-    /// A document whose `pages` page dictionaries all live in one (uncompressed) object stream,
-    /// found through a cross-reference stream: every page shows the content `0 0 1 rg 10 10 80 80
-    /// re f` on a 100 pt square, except the last, which is 50 × 100 pt.
-    fn pages_in_one_object_stream(pages: usize) -> Vec<u8> {
-        // 1 catalog, 2 page tree, 3 content, 4 the object stream, 5.. the pages, then the xref.
-        let page = |n: usize| {
-            let size = if n + 1 == pages { "50 100" } else { "100 100" };
-            format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 {size}] /Contents 3 0 R >>\n")
-        };
-        let (mut index, mut body) = (String::new(), String::new());
-        for n in 0..pages {
-            index.push_str(&format!("{} {} ", n + 5, body.len()));
-            body.push_str(&page(n));
-        }
-        index.push('\n');
-        let kids: Vec<String> = (0..pages).map(|n| format!("{} 0 R", n + 5)).collect();
-        let content = "0 0 1 rg 10 10 80 80 re f";
-        let mut pdf = b"%PDF-1.5\n".to_vec();
-        let mut offsets = Vec::new();
-        for (num, obj) in [
-            (1, "<< /Type /Catalog /Pages 2 0 R >>".to_string()),
-            (2, format!("<< /Type /Pages /Kids [{}] /Count {pages} >>", kids.join(" "))),
-            (3, format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len())),
-            (
-                4,
-                format!(
-                    "<< /Type /ObjStm /N {pages} /First {} /Length {} >>\nstream\n{index}{body}\nendstream",
-                    index.len(),
-                    index.len() + body.len()
-                ),
-            ),
-        ] {
-            offsets.push(pdf.len());
-            pdf.extend_from_slice(format!("{num} 0 obj\n{obj}\nendobj\n").as_bytes());
-        }
-        // Cross-reference stream rows of /W [1 4 4]: free 0, objects 1–4 in the file, the pages
-        // at their index in object 4, and the cross-reference stream itself.
-        let xref_num = pages + 5;
-        let xref_at = pdf.len();
-        let mut rows = vec![0u8, 0, 0, 0, 0, 0, 0, 0xff, 0xff];
-        let row = |kind: u8, a: usize, b: usize| [[kind].as_slice(), &(a as u32).to_be_bytes(), &(b as u32).to_be_bytes()].concat();
-        for at in &offsets {
-            rows.extend(row(1, *at, 0));
-        }
-        for n in 0..pages {
-            rows.extend(row(2, 4, n));
-        }
-        rows.extend(row(1, xref_at, 0));
-        pdf.extend_from_slice(
-            format!("{xref_num} 0 obj\n<< /Type /XRef /Size {} /W [1 4 4] /Root 1 0 R /Length {} >>\nstream\n", xref_num + 1, rows.len()).as_bytes(),
-        );
-        pdf.extend_from_slice(&rows);
-        pdf.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref_at}\n%%EOF\n").as_bytes());
-        pdf
-    }
-
-    /// An object stream's index of `objnum offset` pairs is read once, not for every object
-    /// fetched from it (vendored hayro-syntax patch 22). Read again each time, all of a stream of
-    /// N objects took N² steps: a Firefox page keeping 65,542 objects in one stream took 37 s to
-    /// draw and 40 s to extract its text. These 40,000 pages in one stream took about a minute
-    /// to open that way; now a fraction of a second. The last page, at the end of the index,
-    /// still has its own size.
-    #[test]
-    fn objects_in_one_large_object_stream_are_read_in_linear_time() {
-        const PAGES: usize = 40_000;
-        let pdf = pages_in_one_object_stream(PAGES);
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let first = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
-            let last = r.render(RenderRequest { page: PAGES - 1, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
-            let _ = tx.send((first, last));
-        });
-        let (first, last) =
-            rx.recv_timeout(std::time::Duration::from_secs(20)).expect("reading every object of one object stream must not take quadratic time");
-        assert!(first.error.is_none(), "{:?}", first.error);
-        assert_eq!((first.width, first.height), (100, 100));
-        assert_eq!(rgb_at(&first.rgba, first.width as usize, 50, 50), [0, 0, 255]);
-        assert!(last.error.is_none(), "{:?}", last.error);
-        assert_eq!((last.width, last.height), (50, 100), "the last page is read from its own offset");
-    }
-
-    /// #2946: ScanSoft PDF Create! writes the `post` table version of every font it embeds with
-    /// its 16-bit halves swapped (`00 00 00 03` for 3.0). Such a font must still be used, drawing
-    /// exactly as with a correct version; a version that is neither (9.0) is still refused and
-    /// drawn with a substitute, as before.
-    #[test]
-    fn a_font_whose_post_version_has_swapped_halves_is_still_used() {
-        let font = include_bytes!("../../../assets/fonts/JetBrainsMono-Regular.ttf");
-        // The `post` table's offset, from the table directory.
-        let tables = usize::from(u16::from_be_bytes([font[4], font[5]]));
-        let post = (0..tables)
-            .map(|i| &font[12 + 16 * i..28 + 16 * i])
-            .find(|e| &e[..4] == b"post")
-            .map(|e| u32::from_be_bytes([e[8], e[9], e[10], e[11]]) as usize)
-            .expect("the test font has a post table");
-        let render_with = |version: [u8; 4], encoding: &str| -> Vec<u8> {
-            let mut program = font.to_vec();
-            program[post..post + 4].copy_from_slice(&version);
-            let content = b"BT /F1 28 Tf 10 40 Td (Hamburg 0123) Tj ET";
-            let widths = vec!["600"; 95].join(" ");
-            let objects: Vec<Vec<u8>> = vec![
-                b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
-                b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
-                b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 80] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>".to_vec(),
-                [format!("<< /Length {} >>\nstream\n", content.len()).into_bytes(), content.to_vec(), b"\nendstream".to_vec()].concat(),
-                format!("<< /Type /Font /Subtype /TrueType /BaseFont /JetBrainsMono-Regular /FirstChar 32 /LastChar 126 /Widths [{widths}] /FontDescriptor 6 0 R /Encoding {encoding} >>").into_bytes(),
-                b"<< /Type /FontDescriptor /FontName /JetBrainsMono-Regular /Flags 32 /FontBBox [-1000 -300 1000 1000] /ItalicAngle 0 /Ascent 1020 /Descent -300 /CapHeight 730 /StemV 80 /FontFile2 7 0 R >>".to_vec(),
-                [format!("<< /Length {} >>\nstream\n", program.len()).into_bytes(), program, b"\nendstream".to_vec()].concat(),
-            ];
-            let mut pdf = b"%PDF-1.7\n".to_vec();
-            let mut offsets = Vec::new();
-            for (i, o) in objects.iter().enumerate() {
-                offsets.push(pdf.len());
-                pdf.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
-                pdf.extend_from_slice(o);
-                pdf.extend_from_slice(b"\nendobj\n");
-            }
-            let xref = pdf.len();
-            pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
-            for o in offsets {
-                pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-            }
-            pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
-            let page = PageRenderer::new(Arc::new(pdf), RenderConfig::default()).render(RenderRequest {
-                page: 0,
-                kind: RequestKind::Pixels,
-                tile: None,
-                scale: 2.0,
-                tag: 0,
-                preview: false,
-            });
-            assert!(page.error.is_none(), "{:?}", page.error);
-            page.rgba.to_vec()
-        };
-        let render = |version: [u8; 4]| render_with(version, "/WinAnsiEncoding");
-        let correct = render([0, 3, 0, 0]);
-        assert_eq!(render([0, 0, 0, 3]), correct, "3.0 with swapped halves draws with the embedded font");
-        assert_eq!(render([0, 0, 0, 2]), render([0, 2, 0, 0]), "2.0 with swapped halves too");
-        assert_ne!(render([0, 9, 0, 0]), correct, "an unknown version is still refused");
-        // A /Differences name only the font's own post table knows (W's alternate, `W.cv07`)
-        // is found through a swapped 2.0 table too (review on #2949).
-        let alternate = |version: [u8; 4]| render_with(version, "<< /BaseEncoding /WinAnsiEncoding /Differences [72 /W.cv07] >>");
-        assert_ne!(alternate([0, 2, 0, 0]), render([0, 2, 0, 0]), "the alternate W draws instead of H");
-        assert_eq!(alternate([0, 0, 0, 2]), alternate([0, 2, 0, 0]), "and also with swapped halves");
-    }
-
-    /// A page whose content expands far beyond its compressed stream stops at the expansion budget,
-    /// which is 64 times the compressed size and at least `MAX_DECODED_STREAM`, and the page says so.
-    #[test]
-    fn content_bombs_stop_at_the_budget_and_say_so() {
-        let bomb = zlib_zeros(hayro::hayro_syntax::MAX_DECODED_STREAM + (32 << 20));
-        let pdf = one_page_pdf(&bomb, "/Filter /FlateDecode");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a content bomb must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert!(page.warnings.contains(&RenderWarning::ContentTruncated), "the cut content is observable");
-    }
-
-    /// A stream read in pieces of any size gives the same bytes: stored and dynamic blocks, and in
-    /// a `/Contents` array a stream that is not Flate-coded, between two that are.
-    #[test]
-    fn content_reader_returns_the_same_bytes_in_any_pieces() {
-        use hayro::hayro_syntax::Pdf;
-        use std::io::Write;
-        let mut plain = Vec::new();
-        for i in 0..40_000_u32 {
-            plain.extend_from_slice(format!("{} {} l\n", i % 977, i % 613).as_bytes());
-        }
-        let zlib = |data: &[u8], level| {
-            let mut z = flate2::write::ZlibEncoder::new(Vec::new(), level);
-            z.write_all(data).unwrap();
-            z.finish().unwrap()
-        };
-        let read = |pdf: Vec<u8>, piece: usize| {
-            let doc = Pdf::new(pdf).expect("parses");
-            let page = doc.pages().first().expect("one page");
-            let mut content = page.content_reader();
-            let mut out = Vec::new();
-            while content.read_into(&mut out, piece) > 0 {}
-            out
-        };
-        let pieces = [1, 3, 64, 4096, 65_536, 1_000_000];
-
-        for level in [flate2::Compression::none(), flate2::Compression::best()] {
-            let pdf = one_page_pdf(&zlib(&plain, level), "/Filter /FlateDecode");
-            for piece in pieces {
-                assert!(read(pdf.clone(), piece) == plain, "piece {piece}");
-            }
-        }
-
-        // A `/Contents` array: Flate, then ASCIIHex (decoded whole), then Flate. As before, each
-        // stream is followed by a space.
-        let hex: String = plain[..100].iter().map(|b| format!("{b:02x}")).collect::<String>() + ">";
-        let first = zlib(&plain, flate2::Compression::default());
-        let last = zlib(&plain[..50], flate2::Compression::default());
-        let mut expected = plain.clone();
-        expected.push(b' ');
-        expected.extend_from_slice(&plain[..100]);
-        expected.push(b' ');
-        expected.extend_from_slice(&plain[..50]);
-        expected.push(b' ');
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [4 0 R 5 0 R 6 0 R] >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", first.len()).as_bytes());
-        pdf.extend_from_slice(&first);
-        pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /Filter /ASCIIHexDecode /Length {} >> stream\n", hex.len()).as_bytes());
-        pdf.extend_from_slice(hex.as_bytes());
-        pdf.extend_from_slice(format!("\nendstream endobj\n6 0 obj << /Filter /FlateDecode /Length {} >> stream\n", last.len()).as_bytes());
-        pdf.extend_from_slice(&last);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        for piece in pieces {
-            assert!(read(pdf.clone(), piece) == expected, "the array: piece {piece}");
-        }
-    }
-
-    /// Zlib data that inflates to `len` zero bytes.
-    fn zlib_zeros(len: usize) -> Vec<u8> {
-        use std::io::Write;
-        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
-        let chunk = vec![0u8; 1 << 20];
-        let mut left = len;
-        while left > 0 {
-            let n = left.min(chunk.len());
-            z.write_all(&chunk[..n]).unwrap();
-            left -= n;
-        }
-        z.finish().unwrap()
-    }
-
-    /// A raw deflate stream that flate2 rejects at once and the fallback inflater expands to at
-    /// least `len` zero bytes: a one-byte stored block whose length check is wrong (flate2 refuses
-    /// it, the fallback carries on), then a fixed-Huffman block of 258-byte copies.
-    fn deflate_for_the_fallback(len: usize) -> Vec<u8> {
-        let mut out = vec![0b000]; // not final, stored; the rest of the byte is padding
-        out.extend_from_slice(&[1, 0, 0, 0, 0]); // LEN 1, NLEN 0 (should be !1), the byte 0
-        let (mut acc, mut bits) = (0u64, 0u32);
-        // Deflate packs bits from the least significant end; Huffman codes go most significant
-        // bit first.
-        let mut put = |value: u32, n: u32, huffman: bool| {
-            for i in 0..n {
-                let bit = if huffman { (value >> (n - 1 - i)) & 1 } else { (value >> i) & 1 };
-                acc |= u64::from(bit) << bits;
-                bits += 1;
-                if bits == 8 {
-                    out.push(acc as u8);
-                    (acc, bits) = (0, 0);
-                }
-            }
-        };
-        put(1, 1, false); // final block
-        put(1, 2, false); // fixed Huffman codes
-        for _ in 0..len / 258 + 1 {
-            put(0b1100_0101, 8, true); // length code 285: 258 bytes
-            put(0, 5, true); // distance code 0: 1 byte back
-        }
-        put(0, 7, true); // end of block
-        put(0, 7, false); // flush
-        out
-    }
-
-    /// LZW codes (MSB first, early change) for `fills` table fills of zero runs: after a clear,
-    /// code 0, then every code is the one being defined (the previous entry plus a zero), so
-    /// entry n holds n - 256 zeros. One fill is about 7 MB of output from 5 KB of codes.
-    fn lzw_zeros(fills: usize) -> Vec<u8> {
-        let width = |size: usize| match size + 1 {
-            2048.. => 12,
-            1024.. => 11,
-            512.. => 10,
-            _ => 9,
-        };
-        let (mut out, mut acc, mut bits) = (Vec::new(), 0u64, 0u32);
-        let mut emit = |code: usize, w: u32| {
-            acc = (acc << w) | code as u64;
-            bits += w;
-            while bits >= 8 {
-                bits -= 8;
-                out.push((acc >> bits) as u8);
-            }
-        };
-        let mut size = 258;
-        for _ in 0..fills {
-            emit(256, width(size)); // clear
-            size = 258;
-            emit(0, width(size));
-            for code in 258..4096 {
-                emit(code, width(size));
-                size = code + 1;
-            }
-        }
-        emit(257, width(size)); // end of data
-        emit(0, 7); // flush the last partial byte
-        out
-    }
-
-    /// Found while triaging `cargo xtask fuzz` on Windows, by hand rather than by the fuzzer
-    /// (random mutations almost never make a high-ratio stream): a 2 MB page whose content
-    /// stream, or whose 8 × 8 image, inflated to 2 GB took the renderer past 3 GB in under a
-    /// second. Flate (through flate2 and through the fallback inflater), LZW, RunLength and ASCII85
-    /// (#1796: each `z` is four bytes, here after Flate) expand without limit. Vendored hayro-syntax patch: each stops at `MAX_DECODED_STREAM`, and an image
-    /// of known size at its own rows.
-    #[test]
-    fn decompression_bombs_stop_at_the_stream_limit() {
-        use hayro::hayro_syntax::object::stream::ImageDecodeParams;
-        use hayro::hayro_syntax::object::{Object, Stream};
-        let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
-        let big = limit + (32 << 20);
-        let mut run_length = [0x81u8, 0].repeat(big / 128 + 1); // runs of 128 zeros
-        run_length.push(128);
-        let mut a85 = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
-        std::io::Write::write_all(&mut a85, &b"z".repeat(big / 4 + 1)).unwrap();
-        let streams: [(&str, Vec<u8>); 5] = [
-            ("/FlateDecode", zlib_zeros(big)),
-            ("/FlateDecode", deflate_for_the_fallback(big)),
-            ("/LZWDecode", lzw_zeros(big / 7_000_000 + 1)),
-            ("/RunLengthDecode", run_length),
-            ("[/FlateDecode /ASCII85Decode]", a85.finish().unwrap()),
-        ];
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] >> endobj\n".to_vec();
-        for (i, (filter, data)) in streams.iter().enumerate() {
-            pdf.extend_from_slice(format!("{} 0 obj << /Filter {filter} /Length {} >> stream\n", i + 4, data.len()).as_bytes());
-            pdf.extend_from_slice(data);
-            pdf.extend_from_slice(b"\nendstream endobj\n");
-        }
-        pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
-        let doc = Pdf::new(pdf).expect("parses");
-        let found: Vec<Stream<'_>> = doc.objects().into_iter().filter_map(|o| if let Object::Stream(s) = o { Some(s) } else { None }).collect();
-        assert_eq!(found.len(), 5, "all five bomb streams are found");
-        for stream in &found {
-            let what = format!("{:?}", stream.filters());
-            let decoded = stream.decoded().expect("a bomb still decodes, up to the limit");
-            assert_eq!(decoded.len(), limit, "{what}: stops at MAX_DECODED_STREAM, not at {big} bytes");
-            // An 8 × 8 one-byte grey image has 64 pixel bytes, plus at most a predictor tag byte
-            // for each.
-            let params = ImageDecodeParams { bpc: Some(8), num_components: Some(1), width: 8, height: 8, ..ImageDecodeParams::default() };
-            let image = stream.decoded_image(&params).expect("decodes as an image");
-            assert!(image.data.len() <= 128, "{what}: an 8 × 8 image decodes at most 128 bytes, not {}", image.data.len());
-        }
-    }
-
-    #[test]
-    fn form_cycles_are_bounded_and_finite_nesting_paints() {
-        let cases = [
-            ("self-cycle", "/A Do 0 0 1 rg 0 0 8 8 re f", "0 0 1 rg 0 0 8 8 re f"),
-            ("two-form-cycle", "/B Do 0 0 1 rg 0 0 8 8 re f", "/A Do 0 0 1 rg 0 0 8 8 re f"),
-            ("finite-nesting", "/B Do", "0 0 1 rg 0 0 8 8 re f"),
-        ];
-        let page_content = "/A Do 1 0 0 rg 32 32 8 8 re f";
-        for (case, form_a, form_b) in cases {
-            let pdf = format!(
-                "%PDF-1.7\n\
-                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 40 40] >> endobj\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /A 5 0 R /B 6 0 R >> >> >> endobj\n\
-                 4 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n\
-                 5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Length {} >> stream\n{form_a}\nendstream endobj\n\
-                 6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Length {} >> stream\n{form_b}\nendstream endobj\n\
-                 trailer << /Root 1 0 R >>\n%%EOF",
-                page_content.len(),
-                form_a.len(),
-                form_b.len()
-            )
-            .into_bytes();
-            let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-                let _ = tx.send(renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() }));
-            });
-            let page = rx.recv_timeout(std::time::Duration::from_secs(10)).unwrap_or_else(|_| panic!("{case}: render did not finish"));
-            assert!(page.error.is_none(), "{case}: {:?}", page.error);
-            assert_eq!((page.width, page.height), (40, 40), "{case}");
-            let pixel = |x: u32, y: u32| {
-                let offset = ((y * page.width + x) * 4) as usize;
-                [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
-            };
-            assert_eq!(pixel(3, 35), [0, 0, 255, 255], "{case}: nested form content paints");
-            assert_eq!(pixel(35, 4), [255, 0, 0, 255], "{case}: page content after the form still paints");
-        }
-    }
-
-    /// Review of the decompression-bomb fix: one stream stopping at `MAX_DECODED_STREAM` isn't
-    /// enough when streams add up. A page's `/Contents` array can name the same bomb many times,
-    /// and a form that paints itself nests fifty deep, each level keeping its content while the
-    /// next runs. Vendored patches: a `/Contents` array shares one `MAX_DECODED_STREAM`
-    /// (hayro-syntax), and page contents, forms, tiling patterns and Type 3 glyphs share a
-    /// per-page budget (hayro-interpret `MAX_PAGE_CONTENT`).
-    #[test]
-    fn page_contents_and_nested_forms_share_one_budget() {
-        let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
-        let bomb = zlib_zeros(limit + (32 << 20));
-        // Three references to one bomb in /Contents decode no more than one stream's worth.
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [4 0 R 4 0 R 4 0 R] >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", bomb.len()).as_bytes());
-        pdf.extend_from_slice(&bomb);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let doc = Pdf::new(pdf).expect("parses");
-        let page = doc.pages().first().expect("one page");
-        let contents = page.page_stream().map_or(0, <[u8]>::len);
-        assert!(contents <= limit + 3, "the /Contents array decodes {contents} bytes, over one stream's {limit}");
-
-        // A form that paints itself before 256 MiB of spaces: every level would keep its content.
-        let mut content = b"/Fm0 Do ".to_vec();
-        content.resize(limit, b' ');
-        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
-        std::io::Write::write_all(&mut z, &content).unwrap();
-        let form = z.finish().unwrap();
-        drop(content);
-        let page_content = b"/Fm0 Do 1 0 0 rg 0 0 4 4 re f";
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Fm0 5 0 R >> >> >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", page_content.len()).as_bytes());
-        pdf.extend_from_slice(page_content);
-        pdf.extend_from_slice(b"\nendstream endobj\n");
-        pdf.extend_from_slice(
-            format!("5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Resources << /XObject << /Fm0 5 0 R >> >> /Filter /FlateDecode /Length {} >> stream\n", form.len()).as_bytes(),
-        );
-        pdf.extend_from_slice(&form);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-        });
-        // Only a guard against a hang: the shared budget is checked by the warnings below, which
-        // come out the same on every machine. The render decodes and reads 512 MiB of content,
-        // a third of a second on a desktop, and a busy FreeBSD VM in CI ran past the minute this
-        // used to allow.
-        let page = rx.recv_timeout(std::time::Duration::from_secs(600)).expect("a self-painting form must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert!(page.warnings.contains(&RenderWarning::ContentTruncated), "the skipped nested content is observable");
-        assert_eq!(
-            page.warnings.iter().filter(|w| **w == RenderWarning::ContentTruncated).count(),
-            1,
-            "reported once per page, not once per nested paint"
-        );
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
-    }
-
-    /// The page content budget counts what is held at once, not everything decoded: a form
-    /// with 2 MiB of content painted three hundred times (600 MiB in all) draws every time.
-    #[test]
-    fn content_painted_again_and_again_keeps_drawing() {
-        let mut content = b"1 0 0 rg 0 0 4 4 re f ".to_vec();
-        content.resize(2 << 20, b' ');
-        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
-        std::io::Write::write_all(&mut z, &content).unwrap();
-        let form = z.finish().unwrap();
-        let mut page_content = "/Fm0 Do ".repeat(299);
-        page_content.push_str("q 1 0 0 1 30 30 cm /Fm0 Do Q");
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Fm0 5 0 R >> >> >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n", page_content.len()).as_bytes());
-        pdf.extend_from_slice(
-            format!("5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Filter /FlateDecode /Length {} >> stream\n", form.len()).as_bytes(),
-        );
-        pdf.extend_from_slice(&form);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        // The last paint is at user (30, 30)–(34, 34): device row 40 - 32 = 8.
-        assert_eq!(&page.rgba[((8 * 40 + 32) * 4)..][..4], &[255, 0, 0, 255], "the 300th paint is drawn");
-    }
-
-    /// Review of the decompression-bomb fix: a Type 0 sampled function read every sample of its
-    /// stream into a 4-byte value, then a table entry each, so 256 MiB of 1-bit samples asked for
-    /// over 8 GB. Vendored hayro-interpret patch: at most `MAX_SAMPLE_VALUES` samples, read no
-    /// further than `/Size` asks.
-    #[test]
-    fn sampled_functions_with_billions_of_samples_are_refused() {
-        let bomb = zlib_zeros(hayro::hayro_syntax::MAX_DECODED_STREAM + (32 << 20));
-        let page_content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", page_content.len()).as_bytes());
-        pdf.extend_from_slice(page_content);
-        pdf.extend_from_slice(
-            b"\nendstream endobj\n5 0 obj << /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Function 6 0 R >> endobj\n",
-        );
-        pdf.extend_from_slice(
-            format!("6 0 obj << /FunctionType 0 /Domain [0 1] /Range [0 1] /Size [1073741824] /BitsPerSample 1 /Filter /FlateDecode /Length {} >> stream\n", bomb.len()).as_bytes(),
-        );
-        pdf.extend_from_slice(&bomb);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a sampled-function bomb must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
-    }
-
-    /// A sampled function kept its samples in a hash map keyed by each point of its grid, built
-    /// again every time a shading using it was painted (vendored hayro-interpret patch 31).
-    /// InDesign pages paint 4096-sample gradient ramps dozens of times, and `bug1721218` in the
-    /// pdf.js corpus spent most of its 1.5 s hashing them. The samples are now one flat array
-    /// indexed by strides: this page paints a 2,097,152-sample ramp (the most a table may hold)
-    /// 30 times, which took 38 seconds through the hash map.
-    ///
-    /// The build each paint does is timed against reading the function's samples, the part of it
-    /// no table can skip, not against a deadline: through the hash map it took about a hundred
-    /// times as long as the read, through the flat array about as long. A deadline can't tell
-    /// them apart on every machine: the hash map's 30 paints took 14 s on one desktop, the flat
-    /// array's over 10 s on a busy FreeBSD VM in CI. No counter does either (both read every
-    /// sample on every build), so the test compares two times taken on this thread, the fastest
-    /// of several rounds of each: a stall from other work (other tests, swapping) would have to
-    /// slow every build and spare a read to fail it.
-    #[test]
-    fn shadings_with_large_sampled_functions_paint_quickly() {
-        use hayro::hayro_interpret::Function;
-        use hayro_syntax::bit_reader::BitReader;
-        use hayro_syntax::object::{FromBytes, Object};
-        use std::time::{Duration, Instant};
-
-        const SAMPLES: usize = 1 << 21;
-        let samples = zlib_zeros(SAMPLES);
-        let function = format!(
-            "<< /FunctionType 0 /Domain [0 1] /Range [0 1] /Size [{SAMPLES}] /BitsPerSample 8 /Filter /FlateDecode /Length {} >>",
-            samples.len()
-        );
-        // Black ramp on the left half, 30 times over; a red square after it.
-        let content = "q 0 0 20 40 re W n /Sh0 sh Q\n".repeat(30) + "1 0 0 rg 36 36 4 4 re f";
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
-        pdf.extend_from_slice(b"5 0 obj << /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Function 6 0 R >> endobj\n");
-        pdf.extend_from_slice(format!("6 0 obj {function} stream\n").as_bytes());
-        pdf.extend_from_slice(&samples);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let page = render_first_page(pdf);
-        assert_eq!(rgb_at(&page.rgba, 40, 5, 20), [0, 0, 0], "the ramp is drawn");
-        assert_eq!(rgb_at(&page.rgba, 40, 30, 20), [255, 255, 255], "outside the clip");
-        assert_eq!(rgb_at(&page.rgba, 40, 38, 2), [255, 0, 0], "the rest of the page draws");
-
-        // What each paint does: build the function from its stream. Timed against reading the
-        // stream's samples, the part of the build no table can skip.
-        let mut bytes = format!("{function} stream\n").into_bytes();
-        bytes.extend_from_slice(&samples);
-        bytes.extend_from_slice(b"\nendstream");
-        let object = Object::from_bytes(&bytes).expect("a stream object");
-        let Object::Stream(stream) = &object else { panic!("the function is a stream") };
-        let (mut build, mut read) = (Duration::MAX, Duration::MAX);
-        for _ in 0..8 {
-            let started = Instant::now();
-            let function = Function::new(&object);
-            assert!(function.is_some(), "a sampled function");
-            drop(function);
-            build = build.min(started.elapsed());
-
-            let started = Instant::now();
-            let decoded = stream.decoded().expect("the samples decode");
-            let mut reader = BitReader::new(&decoded);
-            let mut values = Vec::new();
-            while values.len() < SAMPLES
-                && let Some(value) = reader.read(8)
-            {
-                values.push(value);
-            }
-            assert_eq!(std::hint::black_box(&values).len(), SAMPLES);
-            drop(values);
-            read = read.min(started.elapsed());
-        }
-        assert!(
-            build < read * 10,
-            "building a {SAMPLES}-sample function took {build:?}, over ten times the {read:?} reading its samples takes (a hash map took a hundred times)"
-        );
-    }
-
-    /// Patch 31's flat table gives every sampled function the values the hash map gave: points
-    /// on the grid, multilinear interpolation between them (first input varying fastest), and no
-    /// value where a sample the interpolation needs is missing from a short stream.
-    #[test]
-    fn sampled_functions_interpolate_their_grid_as_before() {
-        use hayro::hayro_interpret::Function;
-        use hayro_syntax::object::{FromBytes, Object};
-
-        // Size [3 2], two outputs: out0 = 40 i + 60 j (linear), out1 = 100 i j (bilinear only).
-        let mut samples = Vec::new();
-        for j in 0..2u8 {
-            for i in 0..3u8 {
-                samples.extend_from_slice(&[40 * i + 60 * j, 100 * i * j]);
-            }
-        }
-        let function = |data: &[u8]| {
-            let mut bytes =
-                format!("<< /FunctionType 0 /Domain [0 1 0 1] /Range [0 1 0 1] /Size [3 2] /BitsPerSample 8 /Length {} >> stream\n", data.len())
-                    .into_bytes();
-            bytes.extend_from_slice(data);
-            bytes.extend_from_slice(b"\nendstream");
-            bytes
-        };
-        let whole = function(&samples);
-        let f = Function::new(&Object::from_bytes(&whole).expect("a stream object")).expect("a sampled function");
-        for (x, y) in [(0.0, 0.0), (1.0, 1.0), (0.5, 0.0), (0.25, 0.5), (0.75, 0.25), (0.1, 0.9), (1.0, 0.3)] {
-            let (gi, gj) = (2.0 * x, y);
-            let got = f.eval([x, y].into_iter().collect()).expect("every sample is present");
-            let want = [(40.0 * gi + 60.0 * gj) / 255.0, 100.0 * gi.min(1.0) * gj / 255.0 + 100.0 * (gi - 1.0).max(0.0) * gj / 255.0];
-            assert!(got.len() == 2 && got.iter().zip(want).all(|(g, w)| (g - w).abs() < 1e-5), "({x}, {y}): got {got:?}, want {want:?}");
-        }
-        // Only the j = 0 row: points on it evaluate, points needing j = 1 have no value.
-        let short = function(&samples[..6]);
-        let f = Function::new(&Object::from_bytes(&short).expect("a stream object")).expect("a sampled function");
-        assert_eq!(f.eval([0.5, 0.0].into_iter().collect()).map(|v| v.to_vec()), Some(vec![40.0 / 255.0, 0.0]));
-        assert_eq!(f.eval([0.5, 0.5].into_iter().collect()), None);
-    }
-
-    /// From `cargo xtask fuzz`: a mesh shading whose points lie far off the page (a 147-byte
-    /// Coons patch stream decoded onto ±40000) was sampled pixel by pixel over its whole
-    /// bounding box, up to 65536 × 65536 entries: a synthetic page passed 6 GB in six seconds.
-    /// Vendored hayro-interpret patch: mesh shadings are sampled only where they are drawn,
-    /// within eight visits per pixel of that area plus four per triangle in it.
-    #[test]
-    fn mesh_shadings_far_off_the_page_render() {
-        let render = |shading: Vec<u8>| {
-            let content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
-            let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
-            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
-            pdf.extend_from_slice(content);
-            pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj ");
-            pdf.extend_from_slice(&shading);
-            pdf.extend_from_slice(b" endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-            let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-            });
-            let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a mesh shading must not stall the renderer");
-            assert!(page.error.is_none(), "{:?}", page.error);
-            page
-        };
-        let stream = |dict: &str, data: &[u8]| {
-            let mut s = format!("<< {dict} /Length {} >> stream\n", data.len()).into_bytes();
-            s.extend_from_slice(data);
-            s.extend_from_slice(b"\nendstream");
-            s
-        };
-        // One Coons patch (flag, 12 points, 4 colours) with 8-bit coordinates around its square.
-        let mut coons = vec![0u8];
-        for p in [(0, 0), (0, 85), (0, 170), (0, 255), (85, 255), (170, 255), (255, 255), (255, 170), (255, 85), (255, 0), (170, 0), (85, 0)] {
-            coons.extend_from_slice(&[p.0, p.1]);
-        }
-        coons.extend_from_slice(&[255, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 0]);
-        // A free-form triangle mesh: three vertices (flag, x, y, colour).
-        let triangles = [0u8, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255];
-        let mesh = "/ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8";
-        let far = "/Decode [-40000 40000 -40000 40000 0 1 0 1 0 1]";
-        for (what, shading) in [
-            ("a Coons patch", stream(&format!("/ShadingType 6 {mesh} {far}"), &coons)),
-            ("a triangle mesh", stream(&format!("/ShadingType 4 {mesh} {far}"), &triangles)),
-        ] {
-            let page = render(shading);
-            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{what} far off the page: the rest of the page draws");
-        }
-        // A patch on the page, and the part of the huge one that covers it, are still shaded:
-        // the centre is neither white nor transparent.
-        for (what, decode) in [("on the page", "[0 40 0 40 0 1 0 1 0 1]"), ("covering the page", "[-40000 40000 -40000 40000 0 1 0 1 0 1]")] {
-            let page = render(stream(&format!("/ShadingType 6 {mesh} /Decode {decode}"), &coons));
-            let centre = &page.rgba[((20 * 40 + 20) * 4)..][..4];
-            assert!(centre != [255, 255, 255, 255] && centre[3] == 255, "a patch {what} is shaded: {centre:?}");
-        }
-        // A patch filling a 4 × 4 pt rectangle as a pattern is 722 triangles of a fraction of a
-        // pixel each: far more visits than its 16 pixels give, which the per-triangle allowance
-        // covers. The rectangle's middle is shaded.
-        let content = b"/Pattern cs /P0 scn 10 10 4 4 re f";
-        let shading = stream(&format!("/ShadingType 6 {mesh} /Decode [10 14 10 14 0 1 0 1 0 1]"), &coons);
-        let mut pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P0 << /PatternType 2 /Shading 5 0 R >> >> >> >> endobj
-".to_vec();
-        pdf.extend_from_slice(
-            format!(
-                "4 0 obj << /Length {} >> stream
-",
-                content.len()
-            )
-            .as_bytes(),
-        );
-        pdf.extend_from_slice(content);
-        pdf.extend_from_slice(
-            b"
-endstream endobj
-5 0 obj ",
-        );
-        pdf.extend_from_slice(&shading);
-        pdf.extend_from_slice(
-            b" endobj
-trailer << /Root 1 0 R >>
-%%EOF
-",
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        let middle = &page.rgba[((28 * 40 + 12) * 4)..][..4];
-        assert!(middle != [255, 255, 255, 255] && middle[3] == 255, "a small patch is shaded: {middle:?}");
-    }
-
-    /// Coons and tensor-product patches put each corner's colour at its corner and blend them
-    /// in between. Patch 33 interpolates each point of a patch's 20 × 20 triangle grid once
-    /// instead of once per cell touching it, and moves vertices instead of copying them; these
-    /// colours (taken before that change) pin that every vertex still gets its own point's colour.
-    #[test]
-    fn patch_meshes_keep_their_corner_colours() {
-        // Points on a 4 × 4 grid over the 40 pt page, in stream order: the 12 boundary points
-        // (both patch types), then a tensor patch's four interior ones.
-        let grid = |x: u8, y: u8| [x * 85, y * 85];
-        let boundary = [(0, 0), (0, 1), (0, 2), (0, 3), (1, 3), (2, 3), (3, 3), (3, 2), (3, 1), (3, 0), (2, 0), (1, 0)];
-        let interior = [(1, 1), (1, 2), (2, 2), (2, 1)];
-        let colours = [255u8, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 0];
-        let patch = |points: &[(u8, u8)]| {
-            let mut data = vec![0u8];
-            data.extend(points.iter().flat_map(|(x, y)| grid(*x, *y)));
-            data.extend_from_slice(&colours);
-            data
-        };
-        let render = |shading_type: u8, data: Vec<u8>| {
-            let content = b"/Sh0 sh";
-            let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
-            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
-            pdf.extend_from_slice(content);
-            pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /ShadingType {shading_type} /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 40 0 40 0 1 0 1 0 1] /Length {} >> stream\n", data.len()).as_bytes());
-            pdf.extend_from_slice(&data);
-            pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-            render_first_page(pdf)
-        };
-        let coons = render(6, patch(&boundary));
-        let tensor = render(7, patch(&[&boundary[..], &interior[..]].concat()));
-        // Near each corner (top-left, bottom-left, bottom-right, top-right in the raster), the
-        // centre, and a point between them.
-        let want = [
-            ((5, 5), [32, 199, 28]),
-            ((5, 34), [217, 61, 5]),
-            ((34, 34), [217, 190, 32]),
-            ((34, 5), [32, 61, 190]),
-            ((20, 20), [127, 128, 64]),
-            ((12, 27), [172, 110, 25]),
-        ];
-        for (what, page) in [("Coons", &coons), ("tensor", &tensor)] {
-            for ((x, y), colour) in want {
-                let got = rgb_at(&page.rgba, 40, x, y);
-                assert!(got.iter().zip(colour).all(|(g, w)| g.abs_diff(w) <= 1), "{what} patch at ({x}, {y}): got {got:?}, want {colour:?}");
-            }
-        }
-    }
-
-    /// The other half of the mesh-shading patch: ten thousand triangles that each cover half
-    /// of this 1000 × 1000 canvas walked their bounding boxes ten thousand times over (ten
-    /// billion visits). The visit budget stops that work at eight per pixel plus four per
-    /// triangle.
-    #[test]
-    fn many_overlapping_mesh_triangles_finish() {
-        // Each triangle: three vertices of flag, x, y, red, green, blue; half of the page.
-        let one = [0u8, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255];
-        let triangles = one.repeat(10_000);
-        let content = b"/Sh0 sh";
-        let mut pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj
-"
-        .to_vec();
-        pdf.extend_from_slice(
-            format!(
-                "4 0 obj << /Length {} >> stream
-",
-                content.len()
-            )
-            .as_bytes(),
-        );
-        pdf.extend_from_slice(content);
-        pdf.extend_from_slice(
-            format!("
-endstream endobj
-5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 40 0 40 0 1 0 1 0 1] /Length {} >> stream
-", triangles.len())
-                .as_bytes(),
-        );
-        pdf.extend_from_slice(&triangles);
-        pdf.extend_from_slice(
-            b"
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF
-",
-        );
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 25.0, tag: 0, ..Default::default() }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("overlapping mesh triangles must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (1000, 1000));
-        // The triangles cover the lower left half: a pixel there is shaded.
-        let p = &page.rgba[((900 * 1000 + 100) * 4)..][..4];
-        assert!(p != [255, 255, 255, 255] && p[3] == 255, "the triangles are drawn: {p:?}");
-    }
-
-    /// Two triangles of a mesh that share an edge cover it together. The sampler tested each
-    /// pixel's corner, and only strictly inside a triangle, so the diagonal two triangles share
-    /// was left white wherever it ran through the samples, and so was a pixel row or column
-    /// along the mesh's own sides. Vendored hayro-interpret patch 36.
-    #[test]
-    fn mesh_triangles_sharing_an_edge_leave_no_seam() {
-        // A red square from 10 to 40 on a 50 × 50 page, cut along its diagonal; in device space
-        // the diagonal runs through pixel centres and corners alike.
-        let vertex = |flag: u8, x: u8, y: u8| [flag, x, y, 255, 0, 0];
-        let (lo, hi) = (10, 40);
-        let mut triangles = Vec::new();
-        for [a, b, c] in [[(lo, lo), (hi, lo), (hi, hi)], [(lo, lo), (hi, hi), (lo, hi)]] {
-            for (x, y) in [a, b, c] {
-                triangles.extend(vertex(0, x, y));
-            }
-        }
-        // Each triangle as its own three vertices, and the second one as a strip (flag 1).
-        let mut strip = Vec::new();
-        for (flag, (x, y)) in [(0, (lo, lo)), (0, (hi, lo)), (0, (hi, hi)), (2, (lo, hi))] {
-            strip.extend(vertex(flag, x, y));
-        }
-        for (label, data) in [("separate triangles", triangles), ("a strip", strip)] {
-            let content = b"/Sh0 sh";
-            let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 50 50] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
-            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
-            pdf.extend_from_slice(content);
-            pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 255 0 255 0 1 0 1 0 1] /Length {} >> stream\n", data.len()).as_bytes());
-            pdf.extend_from_slice(&data);
-            pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(page.error.is_none(), "{label}: {:?}", page.error);
-            assert_eq!((page.width, page.height), (50, 50));
-            let (mut white_inside, mut red_outside) = (Vec::new(), Vec::new());
-            for y in 0..50_usize {
-                for x in 0..50_usize {
-                    let p = &page.rgba[(y * 50 + x) * 4..][..4];
-                    let inside = (10..40).contains(&x) && (10..40).contains(&y);
-                    if inside && p != [255, 0, 0, 255] {
-                        white_inside.push((x, y));
-                    } else if !inside && p != [255, 255, 255, 255] {
-                        red_outside.push((x, y));
-                    }
-                }
-            }
-            assert!(white_inside.is_empty(), "{label}: unshaded pixels inside the square: {white_inside:?}");
-            assert!(red_outside.is_empty(), "{label}: shaded pixels outside the square: {red_outside:?}");
-        }
-
-        // One triangle alone, the square's upper left half: a pixel whose corner lies on its
-        // diagonal is taken by its centre, so one wholly across the diagonal (x + y ≥ 50 in
-        // device space) is not shaded, and one wholly inside is.
-        let mut data = Vec::new();
-        for (x, y) in [(lo, lo), (hi, hi), (lo, hi)] {
-            data.extend(vertex(0, x, y));
-        }
-        let content = b"/Sh0 sh";
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 50 50] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
-        pdf.extend_from_slice(content);
-        pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 255 0 255 0 1 0 1 0 1] /Length {} >> stream\n", data.len()).as_bytes());
-        pdf.extend_from_slice(&data);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        let (mut spilled, mut missing) = (Vec::new(), Vec::new());
-        for y in 10..40_usize {
-            for x in 10..40_usize {
-                let p = &page.rgba[(y * 50 + x) * 4..][..4];
-                if x + y >= 50 && p == [255, 0, 0, 255] {
-                    spilled.push((x, y));
-                } else if x + y + 2 <= 50 && p != [255, 0, 0, 255] {
-                    missing.push((x, y));
-                }
-            }
-        }
-        assert!(spilled.is_empty(), "shaded pixels wholly across the diagonal: {spilled:?}");
-        assert!(missing.is_empty(), "unshaded pixels wholly inside the triangle: {missing:?}");
-    }
-
-    /// A pixel whose corner is inside one triangle and whose centre is inside its neighbour
-    /// takes the colour at its corner, whichever triangle comes first (patch 36): the
-    /// centre-coverage pass only fills pixels no triangle has given a colour yet. Here the
-    /// shared diagonal lies at x + y = 50.25 in device space, so pixel (20, 30) has its corner
-    /// in the red triangle and its centre in the blue one.
-    #[test]
-    fn a_shared_edge_pixel_keeps_the_colour_at_its_corner() {
-        let vertex = |x: u8, y: u8, rgb: [u8; 3]| [0, x, y, rgb[0], rgb[1], rgb[2]];
-        let (lo, hi) = (10, 40);
-        let (red, blue) = ([255, 0, 0], [0, 0, 255]);
-        // In PDF space the red triangle is the square's upper left half, the blue one the lower
-        // right; `cm` moves both down a quarter point.
-        let red_triangle = [(lo, lo, red), (hi, hi, red), (lo, hi, red)];
-        let blue_triangle = [(lo, lo, blue), (hi, lo, blue), (hi, hi, blue)];
-        for (label, order) in [("red first", [red_triangle, blue_triangle]), ("blue first", [blue_triangle, red_triangle])] {
-            let mut data = Vec::new();
-            for triangle in order {
-                for (x, y, rgb) in triangle {
-                    data.extend(vertex(x, y, rgb));
-                }
-            }
-            let content = b"1 0 0 1 0 -0.25 cm /Sh0 sh";
-            let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 50 50] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
-            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
-            pdf.extend_from_slice(content);
-            pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 255 0 255 0 1 0 1 0 1] /Length {} >> stream\n", data.len()).as_bytes());
-            pdf.extend_from_slice(&data);
-            pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(page.error.is_none(), "{label}: {:?}", page.error);
-            let pixel = |x: usize, y: usize| page.rgba[(y * 50 + x) * 4..][..4].to_vec();
-            assert_eq!(pixel(20, 30), [255, 0, 0, 255], "{label}: the corner of pixel (20, 30) is in the red triangle");
-            // Controls: wholly inside one triangle or the other.
-            assert_eq!(pixel(15, 20), [255, 0, 0, 255], "{label}");
-            assert_eq!(pixel(35, 30), [0, 0, 255, 255], "{label}");
-        }
-    }
-
-    /// Review of the mesh-shading patch: every patch was cut into 722 triangles before anything
-    /// limited them (about 150 KB per patch), and a lattice mesh with `/VerticesPerRow 0` pushed
-    /// empty rows for ever. Vendored hayro-interpret patch: patches are triangulated one at a
-    /// time, meshes hold at most `MAX_MESH_PATCHES` patches and `MAX_MESH_TRIANGLES` triangles,
-    /// and a lattice needs two vertices per row.
-    #[test]
-    fn mesh_shadings_with_many_patches_or_no_rows_finish() {
-        let render = |shading: Vec<u8>| {
-            let content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
-            let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
-            pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
-            pdf.extend_from_slice(content);
-            pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj ");
-            pdf.extend_from_slice(&shading);
-            pdf.extend_from_slice(b" endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-            let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-                let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-            });
-            let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a mesh shading must not stall the renderer");
-            assert!(page.error.is_none(), "{:?}", page.error);
-            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
-        };
-        let stream = |dict: &str, data: &[u8]| {
-            let mut s = format!("<< {dict} /Length {} >> stream\n", data.len()).into_bytes();
-            s.extend_from_slice(data);
-            s.extend_from_slice(b"\nendstream");
-            s
-        };
-        let mesh = "/ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8";
-        // Forty thousand Coons patches beside the page: 6 GB of triangles if collected first.
-        let mut coons = vec![0u8];
-        for p in [(0, 0), (0, 85), (0, 170), (0, 255), (85, 255), (170, 255), (255, 255), (255, 170), (255, 85), (255, 0), (170, 0), (85, 0)] {
-            coons.extend_from_slice(&[p.0, p.1]);
-        }
-        coons.extend_from_slice(&[255, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 0]);
-        render(stream(&format!("/ShadingType 6 {mesh} /BitsPerFlag 8 /Decode [100 140 100 140 0 1 0 1 0 1]"), &coons.repeat(40_000)));
-        // A lattice with no vertices per row.
-        render(stream(&format!("/ShadingType 5 {mesh} /VerticesPerRow 0 /Decode [0 40 0 40 0 1 0 1 0 1]"), &[0u8; 64]));
-    }
-
-    /// From the nightly `cargo xtask fuzz`: an embedded Type 1 font program holding a long run of
-    /// integers. read-fonts 0.39 (through skrifa 0.42) looked ahead after every integer by
-    /// parsing the next token, which looked ahead again, recursing through the whole run: a long
-    /// run hung, and 20,000 numbers overflowed the stack and aborted the process. Fixed upstream:
-    /// the vendored hayro-interpret now uses skrifa 0.47 (read-fonts 0.44).
-    #[test]
-    fn type1_font_programs_with_long_runs_of_numbers_load_quickly() {
-        let mut font = b"%!PS-AdobeFont-1.0: Fuzz 001\n/FontMatrix [0.001 0 0 0.001 0 0] readonly def\n".to_vec();
-        for _ in 0..20_000 {
-            font.extend_from_slice(b"1 ");
-        }
-        let content = b"BT /F1 12 Tf 5 20 Td (Hi) Tj ET 1 0 0 rg 0 0 4 4 re f";
-        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n".to_vec();
-        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
-        pdf.extend_from_slice(content);
-        pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Fuzz /FontDescriptor 6 0 R >> endobj\n");
-        pdf.extend_from_slice(b"6 0 obj << /Type /FontDescriptor /FontName /Fuzz /Flags 32 /FontBBox [0 0 1000 1000] /ItalicAngle 0 /Ascent 800 /Descent -200 /CapHeight 700 /StemV 80 /FontFile 7 0 R >> endobj\n");
-        pdf.extend_from_slice(format!("7 0 obj << /Length {} /Length1 {} /Length2 0 /Length3 0 >> stream\n", font.len(), font.len()).as_bytes());
-        pdf.extend_from_slice(&font);
-        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("a Type 1 font must not stall the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
-    }
-
-    /// From `cargo xtask fuzz`: an inline image claiming /W 4294967295 over four bytes of data
-    /// hung in resampling (vendored hayro patch: `MAX_IMAGE_PIXELS`).
-    #[test]
-    fn absurd_image_dimensions_are_skipped() {
-        let content = "q 20 0 0 20 5 5 cm BI /W 4294967295 /H 2 /BPC 8 /CS /G ID \u{0}\u{ff}\u{ff}\u{0} EI Q 1 0 0 rg 0 0 4 4 re f";
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        );
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
-        });
-        let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("an absurd image must not hang the renderer");
-        assert!(page.error.is_none(), "{:?}", page.error);
-        // The rest of the page still draws: the red square at the bottom left (y-down: last rows).
-        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255]);
-    }
-
-    /// Hex-encodes `bytes` for an `/ASCIIHexDecode` stream.
-    fn hex(bytes: &[u8]) -> String {
-        bytes.iter().map(|b| format!("{b:02x}")).collect()
-    }
-
-    /// An 8×4 source of 2×2 blocks: block column `x / 2` and row `y / 2` takes `levels[(y / 2) * 4 + x / 2]`.
-    fn block_source<T: Copy>(levels: [T; 8]) -> Vec<T> {
-        (0..32).map(|i| levels[(i / 16) * 4 + (i % 8) / 2]).collect()
-    }
-
-    /// Draws one `size` image of colour space `space` (`data` as raw samples, with an optional gray
-    /// `/SMask` of the same size) at 1:1 on a `device`-sized page, writing `/Interpolate` when given.
-    fn draw_minified_image(
-        space: &str,
-        size: (u32, u32),
-        interpolate: Option<bool>,
-        data: &[u8],
-        alpha: Option<&[u8]>,
-        device: (u32, u32),
-    ) -> RenderedPage {
-        let (width, height) = size;
-        let interp = interpolate.map_or_else(String::new, |value| format!("/Interpolate {value} "));
-        let (smask, mask) = match alpha {
-            Some(alpha) => (
-                "/SMask 6 0 R ",
-                format!(
-                    "6 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height {height} /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length {} >> stream\n{}>\nendstream endobj\n",
-                    hex(alpha).len() + 1,
-                    hex(alpha)
-                ),
-            ),
-            None => ("", String::new()),
-        };
-        let image = hex(data);
-        let content = format!("q {} 0 0 {} 0 0 cm /Im0 Do Q", device.0, device.1);
-        let pdf = format!(
-            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {} {}] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-             5 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height {height} /ColorSpace /{space} /BitsPerComponent 8 {interp}{smask}/Filter /ASCIIHexDecode /Length {} >> stream\n{image}>\nendstream endobj\n\
-             {mask}trailer << /Root 1 0 R >>\n%%EOF\n",
-            device.0,
-            device.1,
-            content.len(),
-            image.len() + 1
-        );
-        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), device);
-        page
-    }
-
-    /// Issue #624: an image drawn below its source resolution was pre-resampled with Catmull-Rom
-    /// even when `/Interpolate` was false (or absent, whose PDF default is false). That blends
-    /// neighboring samples before the renderer's later non-interpolating image sampler sees them,
-    /// making scans, screenshots and rasterized text look soft.
-    #[test]
-    fn non_interpolated_images_are_not_smoothed_when_minified() {
-        // Top band K W R G, bottom band B Y M C. Nearest 8×4 → 4×2 sampling picks each block's
-        // pixel, so every device pixel is one palette colour; Catmull-Rom blends across blocks.
-        let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
-        let rgb: Vec<u8> = block_source(palette).concat();
-        let exact: Vec<[u8; 4]> = palette.iter().map(|c| [c[0], c[1], c[2], 255]).collect();
-        let pixels = |p: &RenderedPage| p.rgba.as_chunks::<4>().0.to_vec();
-
-        // `/Interpolate` defaults to false, and explicit false is equivalent.
-        let omitted = draw_minified_image("DeviceRGB", (8, 4), None, &rgb, None, (4, 2));
-        assert_eq!(pixels(&omitted), exact, "default interpolation");
-        let disabled = draw_minified_image("DeviceRGB", (8, 4), Some(false), &rgb, None, (4, 2));
-        assert_eq!(&omitted.rgba[..], &disabled.rgba[..], "/Interpolate false must match the default");
-
-        // The fix must not disable interpolation: the same source asking for it blends blocks.
-        let enabled = draw_minified_image("DeviceRGB", (8, 4), Some(true), &rgb, None, (4, 2));
-        assert_ne!(pixels(&enabled), exact, "/Interpolate true should still blend");
-        assert!(pixels(&enabled).iter().any(|px| px[..3].iter().any(|&c| (32..=223).contains(&c))), "/Interpolate true made no mid-tone");
-    }
-
-    /// A shrunk, interpolated image whose edges fall between device pixels is snapped to whole
-    /// pixels (shrunk once to that size, drawn 1:1). Before, the shrunk raster was sampled a second
-    /// time at the fractional offset, so every edge of a scan was a blended, soft pixel.
-    #[test]
-    fn interpolated_minified_image_edges_snap_to_whole_pixels() {
-        let black = vec![0u8; 40 * 40];
-        let content = "q 10 0 0 10 0.4 0.4 cm /Im0 Do Q";
-        let image = hex(&black);
-        let pdf = format!(
-            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 11 11] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-             5 0 obj << /Type /XObject /Subtype /Image /Width 40 /Height 40 /ColorSpace /DeviceGray /BitsPerComponent 8 /Interpolate true /Filter /ASCIIHexDecode /Length {} >> stream\n{image}>\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF\n",
-            content.len(),
-            image.len() + 1
-        );
-        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (11, 11));
-        let gray = |x: usize, y: usize| page.rgba[(y * 11 + x) * 4];
-        // Device box 0.4..10.4 × 0.6..10.6 snaps to columns 0..10 and rows 1..11.
-        for y in 1..11 {
-            for x in 0..10 {
-                assert_eq!(gray(x, y), 0, "pixel ({x}, {y}) inside the snapped image");
-            }
-            assert_eq!(gray(10, y), 255, "column 10 is outside the snapped image (row {y})");
-        }
-        for x in 0..11 {
-            assert_eq!(gray(x, 0), 255, "row 0 is outside the snapped image (column {x})");
-        }
-    }
-
-    #[test]
-    fn non_interpolated_gray_images_are_not_smoothed_when_minified() {
-        let levels = [0u8, 255, 85, 170, 40, 200, 120, 230];
-        let page = draw_minified_image("DeviceGray", (8, 4), None, &block_source(levels), None, (4, 2));
-        let expected: Vec<[u8; 4]> = levels.iter().map(|&v| [v, v, v, 255]).collect();
-        assert_eq!(page.rgba.as_chunks::<4>().0.to_vec(), expected);
-    }
-
-    #[test]
-    fn non_integer_minification_samples_the_same_columns() {
-        // Ten columns drawn six pixels wide: centre sampling reads columns 0, 2, 4, 5, 7 and 9.
-        let ramp = [10u8, 20, 30, 40, 50, 60, 70, 80, 90, 100];
-        let page = draw_minified_image("DeviceGray", (10, 1), None, &ramp, None, (6, 1));
-        let grays: Vec<u8> = page.rgba.as_chunks::<4>().0.iter().map(|px| px[0]).collect();
-        assert_eq!(grays, [10, 30, 50, 60, 80, 100]);
-    }
-
-    #[test]
-    fn non_integer_minification_samples_colour_and_mask_from_the_same_columns() {
-        // Ten gray columns with a soft mask, drawn six pixels wide: columns 0, 2, 4, 5, 7 and 9 are
-        // sampled, so the mask must pick the same columns as the colours.
-        let ramp = [10u8, 20, 30, 40, 50, 60, 70, 80, 90, 100];
-        let mask = [255u8, 0, 0, 0, 255, 255, 0, 0, 0, 255];
-        let page = draw_minified_image("DeviceGray", (10, 1), None, &ramp, Some(&mask), (6, 1));
-        // Opaque columns keep their gray; transparent columns show the white page.
-        assert_eq!(
-            page.rgba.as_chunks::<4>().0.to_vec(),
-            vec![[10, 10, 10, 255], [255, 255, 255, 255], [50, 50, 50, 255], [60, 60, 60, 255], [255, 255, 255, 255], [100, 100, 100, 255]]
-        );
-    }
-
-    #[test]
-    fn non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified() {
-        let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
-        let rgb: Vec<u8> = block_source(palette).concat();
-        let alpha = block_source([255u8, 0, 128, 255, 0, 255, 64, 128]);
-        let page = draw_minified_image("DeviceRGB", (8, 4), None, &rgb, Some(&alpha), (4, 2));
-        // Premultiplied colours composited over the white page: alpha 0 shows the page.
-        let expected = vec![
-            [0, 0, 0, 255],
-            [255, 255, 255, 255],
-            [255, 127, 127, 255],
-            [0, 255, 0, 255],
-            [255, 255, 255, 255],
-            [255, 255, 0, 255],
-            [255, 191, 255, 255],
-            [127, 255, 255, 255],
-        ];
-        assert_eq!(page.rgba.as_chunks::<4>().0.to_vec(), expected);
-    }
-
-    /// Issue #1649: Word can save text as a tiny black image whose `/SMask` is a high-resolution
-    /// bitmap of the glyphs, so the mask alone carries the text. Shrinking that mask by
-    /// nearest-neighbour keeps one sample in N, and a stroke thinner than N mask pixels vanished:
-    /// the text came out broken and aliased. Here a one-column stroke of an 8-column mask is drawn
-    /// 4 pixels wide; nearest reads columns 1, 3, 5 and 7 and misses the stroke in column 2.
-    #[test]
-    fn shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes() {
-        let mask: [u8; 8] = [0, 0, 255, 0, 0, 0, 0, 0];
-        let content = "q 4 0 0 1 0 0 cm /Im0 Do Q";
-        let pdf = format!(
-            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 4 1] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-             5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /SMask 6 0 R /Filter /ASCIIHexDecode /Length 3 >> stream\n00>\nendstream endobj\n\
-             6 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length {} >> stream\n{}>\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF\n",
-            content.len(),
-            hex(&mask).len() + 1,
-            hex(&mask)
-        );
-        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(page.error.is_none(), "{:?}", page.error);
-        assert_eq!((page.width, page.height), (4, 1));
-        let grays: Vec<u8> = page.rgba.as_chunks::<4>().0.iter().map(|px| px[0]).collect();
-        // The stroke covers half of device pixel 1, so it is a mid-tone; the far side stays white.
-        assert!((64..=191).contains(&grays[1]), "the stroke is lost or not a mid-tone: {grays:?}");
-        assert_eq!(grays[3], 255, "{grays:?}");
-    }
-
-    /// Type 3 glyph images used to be sampled bicubically (`ImageQuality::High`) whatever their
-    /// `/Interpolate`, which blends the nearest pre-resize back in. The glyph is 4.6 × 2.3 pixels
-    /// and its image pre-resizes to 5 × 3, so the final draw samples fractionally and bicubic
-    /// filtering would blend palette colours. Interior pixels must stay palette colours unless the
-    /// image asks for interpolation.
-    #[test]
-    fn non_interpolated_type3_glyph_images_are_not_smoothed_when_minified() {
-        let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
-        let data = hex(&block_source(palette).concat());
-        let render = |interp: &str| {
-            let content = "BT /F1 1 Tf 0 0.7 Td (A) Tj ET";
-            let glyph = "4.6 0 d0 q 4.6 0 0 2.3 0 0 cm /Im0 Do Q";
-            let pdf = format!(
-                "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 5 3] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n\
-                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-                 5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [5] /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> /Resources << /XObject << /Im0 7 0 R >> >> >> endobj\n\
-                 6 0 obj << /Length {} >> stream\n{glyph}\nendstream endobj\n\
-                 7 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace /DeviceRGB /BitsPerComponent 8 {interp}/Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n\
-                 trailer << /Root 1 0 R >>\n%%EOF\n",
-                content.len(),
-                glyph.len(),
-                data.len() + 1
-            );
-            let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
-            assert!(page.error.is_none(), "{:?}", page.error);
-            assert_eq!((page.width, page.height), (5, 3));
-            page
-        };
-        // The glyph fully covers columns 0–3 and rows 0–1.
-        let interior = |p: &RenderedPage| -> Vec<[u8; 3]> {
-            (0..2).flat_map(|y| (0..4).map(move |x| (y * 5 + x) * 4)).map(|i| [p.rgba[i], p.rgba[i + 1], p.rgba[i + 2]]).collect()
-        };
-
-        let omitted = render("");
-        for px in interior(&omitted) {
-            assert!(palette.contains(&px), "non-interpolated glyph image was smoothed to {px:?}");
-        }
-        let enabled = render("/Interpolate true ");
-        assert!(interior(&enabled).iter().any(|px| !palette.contains(px)), "/Interpolate true glyph image should still be sampled bicubically");
-    }
-
-    /// From `cargo xtask fuzz`: a CID font whose /W range spans every u32 inserted billions of
-    /// widths (vendored hayro-interpret patch: `MAX_CID`). Must finish quickly.
-    #[test]
-    fn huge_cid_width_ranges_terminate() {
-        let pdf = "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length 35 >> stream
-BT /F1 12 Tf 10 10 Td <0041> Tj ET
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /Helvetica /Encoding /Identity-H /DescendantFonts [6 0 R] >> endobj
-6 0 obj << /Type /Font /Subtype /CIDFontType2 /BaseFont /Helvetica /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >>
-  /FontDescriptor 7 0 R /W [0 4294967295 500] /W2 [0 4294967295 -1000 250 880] >> endobj
-7 0 obj << /Type /FontDescriptor /FontName /Helvetica /Flags 32 /FontBBox [0 -200 1000 900] /ItalicAngle 0 /Ascent 800 /Descent -200 /CapHeight 700 /StemV 80 >> endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(pdf.as_bytes().to_vec()), RenderConfig::default());
-            let px = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            let text = r.render(RenderRequest { page: 0, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            let _ = tx.send((px.error, text.error));
-        });
-        let (px, text) = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("rendering a huge /W range must not hang");
-        assert!(px.is_none() && text.is_none(), "{px:?} {text:?}");
-    }
-
-    /// "BBBA" at 20 pt in a Type 3 font whose glyph (for both codes) is a solid 300 × 700 box,
-    /// with the given /FirstChar, /LastChar and /Widths. No font program is needed, and Type 3
-    /// widths are read like those of every other simple font.
-    fn type3_boxes(widths: &str) -> Vec<u8> {
-        let content = "BT /F1 20 Tf 20 40 Td (BBBA) Tj ET";
-        format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 1000 1000] /FontMatrix [0.001 0 0 0.001 0 0] {widths}
-  /Encoding << /Differences [65 /a /a] >> /CharProcs << /a 6 0 R >> >> endobj
-6 0 obj << /Length 27 >> stream
-600 0 d0 100 0 400 700 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        )
-        .into_bytes()
-    }
-
-    /// Simple-font widths (vendored hayro-interpret patch to `read_widths`): an entry of /Widths
-    /// that isn't a number ended the array, so every later code lost its width, and a /LastChar
-    /// below /FirstChar (or one that overflowed) made the whole font fail to load, replaced by a
-    /// standard font. MuPDF, Poppler, PDFium and pdf.js skip just that entry and keep the font.
-    #[test]
-    fn malformed_simple_font_widths_keep_later_widths_and_the_font() {
-        let render = |widths: &str| {
-            let mut r = PageRenderer::new(Arc::new(type3_boxes(widths)), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{widths}: {:?}", p.error);
-            p
-        };
-        // Glyph boxes span x 22..28 plus 12 pt per advance, and y 46..60 (y down).
-        let inked = |p: &RenderedPage, x: u32| (47..59).all(|y| p.rgba[((y * p.width + x) * 4) as usize] < 64);
-        for widths in [
-            "/FirstChar 65 /LastChar 66 /Widths [600 600]",
-            "/FirstChar 65 /LastChar 66 /Widths [null 600]",
-            "/FirstChar 65 /LastChar 66 /Widths [/W 600]",
-        ] {
-            let p = render(widths);
-            assert!([25, 37, 49, 61].iter().all(|x| inked(&p, *x)), "{widths}: each B advances 600");
-            assert!(!inked(&p, 31), "{widths}");
-        }
-        for widths in ["/FirstChar 66 /LastChar 65 /Widths [600 600]", "/FirstChar 4294967295 /LastChar 66 /Widths [600 600]"] {
-            let p = render(widths);
-            // The font's own box, drawn without advances (no width applies), not a stand-in font.
-            assert!(inked(&p, 23) && inked(&p, 27), "{widths}: the Type 3 glyph is drawn");
-            assert!(!inked(&p, 37), "{widths}: no width, no advance");
-        }
-    }
-
-    /// Simple-font widths (vendored hayro-interpret patch to `read_widths`): /FirstChar sized an
-    /// allocation, one entry per code below it, before any width was read. 50,000,000 already
-    /// took 276 MB; 4294967295 asks for 34 GB. Codes of a simple font stop at 255.
-    #[test]
-    fn huge_simple_font_first_char_terminates() {
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let mut r = PageRenderer::new(Arc::new(type3_boxes("/FirstChar 4294967295 /LastChar 4294967295 /Widths [600]")), RenderConfig::default());
-            let px = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            let text = r.render(RenderRequest { page: 0, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            let _ = tx.send((px, text.error));
-        });
-        let (px, text) = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("a huge /FirstChar must not exhaust memory");
-        assert!(px.error.is_none() && text.is_none(), "{:?} {text:?}", px.error);
-        assert!(px.rgba[((50 * px.width + 25) * 4) as usize] < 64, "the glyph is drawn");
-    }
-
-    /// Accented letters in non-embedded fonts (vendored hayro-interpret patch to
-    /// `StandardKind`): the stand-ins for the standard fonts hold only the glyphs of the
-    /// Standard, WinAnsi and Mac Roman encodings, so a letter a font names beyond those in its
-    /// /Differences drew nothing. iText 2 writes Turkish this way (`/Gbreve`, `/Idotaccent`,
-    /// `/Scedilla`, `/gbreve`, `/scedilla` over Ð, Ý, Þ, ð, þ), and a Turkish letter had blanks
-    /// for Ğ, İ, Ş, ğ and ş. Each is now its base letter with the accent above or below it.
-    #[test]
-    fn accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts() {
-        let letters = ["G", "Gbreve", "S", "Scedilla", "I", "Idotaccent", "g", "gbreve", "s", "scedilla"];
-        let mut content = String::new();
-        for (i, _) in letters.iter().enumerate() {
-            content.push_str(&format!("BT /F1 40 Tf {} 20 Td <{:02X}> Tj ET\n", 10 + 40 * i, 65 + i));
-        }
-        let differences = letters.iter().map(|n| format!("/{n}")).collect::<Vec<_>>().join(" ");
-        let pdf = format!(
-            "%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 420 80] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}endstream endobj
-5 0 obj << /Type /Font /Subtype /TrueType /BaseFont /TimesNewRomanPSMT /FirstChar 65 /LastChar 74
-  /Widths [722 722 556 556 333 333 500 500 389 389] /FontDescriptor 6 0 R
-  /Encoding << /Type /Encoding /Differences [65 {differences}] >> >> endobj
-6 0 obj << /Type /FontDescriptor /FontName /TimesNewRomanPSMT /Flags 32 /FontBBox [-568 -306 2045 1039]
-  /ItalicAngle 0 /Ascent 693 /Descent -215 /CapHeight 662 /StemV 80 >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(p.error.is_none(), "{:?}", p.error);
-        // The dark pixels of the i-th letter: how many, and its top and bottom rows (y down).
-        let ink = |i: u32| {
-            let (mut count, mut top, mut bottom) = (0, u32::MAX, 0);
-            for y in 0..p.height {
-                for x in (8 + 40 * i)..(46 + 40 * i).min(p.width) {
-                    if p.rgba[((y * p.width + x) * 4) as usize] < 128 {
-                        count += 1;
-                        top = top.min(y);
-                        bottom = bottom.max(y);
-                    }
-                }
-            }
-            (count, top, bottom)
-        };
-        for (pair, above) in [(0, true), (1, false), (2, true), (3, true), (4, false)] {
-            let (base, accented) = (ink(2 * pair), ink(2 * pair + 1));
-            let name = letters[2 * pair as usize + 1];
-            assert!(base.0 > 0, "{name}: the base letter draws");
-            assert!(accented.0 > base.0, "{name} draws its letter and accent: {accented:?} vs {base:?}");
-            if above {
-                assert!(accented.1 + 2 < base.1, "{name}: the accent sits above the letter: {accented:?} vs {base:?}");
-            } else {
-                assert!(accented.2 > base.2 + 2, "{name}: the accent hangs below the letter: {accented:?} vs {base:?}");
-            }
-        }
-    }
-
-    /// Comma-below letters in non-embedded standard fonts (vendored hayro-interpret patch to
-    /// `StandardKind`). The stand-ins have neither these letters nor a `commaaccent` to build
-    /// them from, so Romanian ș Ș (a form laid out from its XFA template names `/scommaaccent`)
-    /// and Latvian ķ ļ ņ ŗ Ģ drew nothing, and ț Ț drew a cedilla. Each is now its letter with a
-    /// comma under it, apart from the letter and inside the descender, whichever name the font
-    /// gives it: the glyph list calls the Latvian letters `/Kcedilla`…, and `uni` names say only
-    /// the code point.
-    #[test]
-    fn comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter() {
-        let pairs = [
-            ("s", "uni0219"),
-            ("t", "uni021B"),
-            ("T", "uni021A"),
-            ("K", "uni0136"),
-            ("k", "kcedilla"),
-            ("G", "uni0122"),
-            ("G", "Gcedilla"),
-            ("R", "uni0156"),
-            ("s", "scommaaccent"),
-            ("S", "Scommaaccent"),
-            ("t", "tcommaaccent"),
-            ("T", "Tcommaaccent"),
-            ("k", "kcommaaccent"),
-            ("K", "Kcommaaccent"),
-            ("l", "lcommaaccent"),
-            ("L", "Lcommaaccent"),
-            ("n", "ncommaaccent"),
-            ("N", "Ncommaaccent"),
-            ("r", "rcommaaccent"),
-            ("R", "Rcommaaccent"),
-            ("G", "Gcommaaccent"),
-        ];
-        let letters: Vec<&str> = pairs.iter().flat_map(|(base, accented)| [*base, *accented]).collect();
-        let (size, baseline) = (40u32, 60u32);
-        for font in ["Helvetica", "Times-Roman", "Courier", "Helvetica-BoldOblique"] {
-            let mut content = String::new();
-            for i in 0..letters.len() {
-                content.push_str(&format!("BT /F1 {size} Tf {} {} Td <{:02X}> Tj ET\n", 10 + 40 * i, 80 - baseline, 1 + i));
-            }
-            let differences = letters.iter().map(|n| format!("/{n}")).collect::<Vec<_>>().join(" ");
-            let pdf = format!(
-                "%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {} 80] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}endstream endobj
-5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /{font}
-  /Encoding << /Type /Encoding /BaseEncoding /WinAnsiEncoding /Differences [1 {differences}] >> >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                20 + 40 * letters.len(),
-                content.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{font}: {:?}", p.error);
-            // The rows (y down) of the i-th letter that have dark pixels.
-            let ink_rows = |i: u32| -> Vec<u32> {
-                (0..p.height).filter(|y| ((8 + 40 * i)..(48 + 40 * i).min(p.width)).any(|x| p.rgba[((y * p.width + x) * 4) as usize] < 128)).collect()
-            };
-            for (pair, (_, name)) in pairs.iter().enumerate() {
-                let (base, accented) = (ink_rows(2 * pair as u32), ink_rows(2 * pair as u32 + 1));
-                let (Some(&base_bottom), Some(&bottom)) = (base.last(), accented.last()) else {
-                    panic!("{font} {name}: draws nothing ({} rows of its base letter)", base.len());
-                };
-                assert!(bottom > base_bottom + 2, "{font} {name}: a mark hangs below the letter ({bottom} vs {base_bottom})");
-                assert!(
-                    (base_bottom + 1..bottom).any(|y| !accented.contains(&y)),
-                    "{font} {name}: the mark is apart from the letter, a comma and not a cedilla"
-                );
-                assert!(bottom < baseline + size * 3 / 10, "{font} {name}: the comma stays within the descender ({bottom})");
-            }
-        }
-    }
-
-    // Contributor-original classic-xref vector fixtures; no embedded or external assets.
-    fn raw_crop_unit_pdf(unit: f64, rotation: i32, crop: [f64; 4], marker: Option<[f64; 4]>) -> Vec<u8> {
-        let bounds = crop.map(|n| n.to_string()).join(" ");
-        let body = marker.map(|rect| format!("0 0 0 rg {} re f\n", rect.map(|n| n.to_string()).join(" "))).unwrap_or_default();
-        let objects = [
-            "<< /Type /Catalog /Pages 2 0 R >>".to_owned(),
-            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_owned(),
-            format!(
-                "<< /Type /Page /Parent 2 0 R /MediaBox [{bounds}] /CropBox [{bounds}] /UserUnit {unit} /Rotate {rotation} /Resources << >> /Contents 4 0 R >>"
-            ),
-            format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
-        ];
-        let mut bytes = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, object) in objects.iter().enumerate() {
-            offsets.push(bytes.len());
-            bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
-        }
-        let xref = bytes.len();
-        bytes.extend_from_slice(b"xref\n0 5\n0000000000 65535 f \n");
-        for offset in offsets {
-            bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
-        }
-        bytes.extend_from_slice(format!("trailer << /Size 5 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
-        bytes
-    }
-
-    #[test]
-    fn raw_crop_user_unit_inspection_keeps_observed_dimensions() {
-        let bytes = raw_crop_unit_pdf(4096.0, 0, [0.0, 0.0, 0.1, 0.1], None);
-        let info = crate::inspect(Arc::new(bytes), None).expect("original valid raw-0.1 PDF");
-        assert_eq!(info.pages.len(), 1);
-        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
-        let page = &info.pages[0];
-        assert!(
-            (page.width - 409.6).abs() < 0.0001 && (page.height - 409.6).abs() < 0.0001,
-            "raw 0.1 at UserUnit4096 is 409.6 points, got {} by {}",
-            page.width,
-            page.height
-        );
-    }
-
-    #[test]
-    fn raw_crop_unit_floor_corners_match_nonzero_origin_and_rotations() {
-        use hayro::hayro_interpret::TransformExt;
-
-        for (unit, width, height, dx, dy) in
-            [(1.0, 1.0, 1.0, 0.125, 0.25), (4096.0, 512.0, 1024.0, 512.0, 1024.0), (75000.0, 9375.0, 18750.0, 9375.0, 18750.0)]
-        {
-            for rotation in [0, 90, 180, 270] {
-                let bytes = raw_crop_unit_pdf(unit, rotation, [10.0, 20.0, 10.125, 20.25], None);
-                let info = crate::inspect(Arc::new(bytes.clone()), None).expect("original valid offset crop");
-                assert!(info.warnings.is_empty(), "{:?}", info.warnings);
-                let dimensions = if rotation % 180 == 0 { (width as f32, height as f32) } else { (height as f32, width as f32) };
-                assert_eq!((info.pages[0].width, info.pages[0].height), dimensions, "unit={unit}, rotation={rotation}");
-                let pdf = Pdf::new(Arc::new(bytes)).expect("same PDF parser");
-                let page = pdf.pages().first().expect("one page");
-                assert_eq!(page.base_dimensions(), ((width / unit) as f32, (height / unit) as f32));
-                let transform = page.initial_transform(true).to_kurbo();
-                let (origin, opposite) = match rotation {
-                    0 => ([0.0, height], [dx, height - dy]),
-                    90 => ([0.0, 0.0], [dy, dx]),
-                    180 => ([width, 0.0], [width - dx, dy]),
-                    _ => ([height, width], [height - dy, width - dx]),
-                };
-                for (point, expected) in [(kurbo::Point::new(10.0, 20.0), origin), (kurbo::Point::new(10.125, 20.25), opposite)] {
-                    let actual = transform * point;
-                    assert!(
-                        (actual.x - expected[0]).abs() < 1e-9 && (actual.y - expected[1]).abs() < 1e-9,
-                        "unit={unit}, rotation={rotation}, point={point:?}: {actual:?} != {expected:?}"
-                    );
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn raw_crop_unit_floor_reciprocal_does_not_trigger_letter_fallback() {
-        for unit in [1.0, 41.0, 47.0] {
-            let bytes = raw_crop_unit_pdf(unit, 0, [0.0, 0.0, 0.01, 0.01], None);
-            let pdf = Pdf::new(Arc::new(bytes.clone())).expect("ordinary small crop");
-            let page = pdf.pages().first().expect("one page");
-            let (width, height) = page.base_dimensions();
-            // In f32, the nearest reciprocal of 41 or 47 multiplies back to 0.99999994.
-            assert!(
-                width * page.user_unit() >= 1.0 && height * page.user_unit() >= 1.0,
-                "unit={unit}: floor must not round below one physical point"
-            );
-            let info = crate::inspect(Arc::new(bytes), None).expect("inspect the same small crop");
-            let page = &info.pages[0];
-            assert!(
-                (1.0..=1.000001).contains(&page.width) && (1.0..=1.000001).contains(&page.height),
-                "unit={unit}: one-point floor must not become a Letter placeholder: {} by {}",
-                page.width,
-                page.height
-            );
-            assert!(info.warnings.is_empty(), "{:?}", info.warnings);
-        }
-    }
-
-    #[test]
-    fn raw_crop_unit_floor_preserves_nearly_zero_fallback() {
-        for unit in [1.0, 4096.0, 75000.0] {
-            for side in [0.0, 0.0001] {
-                let bytes = raw_crop_unit_pdf(unit, 0, [0.0, 0.0, side, side], None);
-                let pdf = Pdf::new(Arc::new(bytes)).expect("existing degenerate-page fallback");
-                let page = pdf.pages().first().expect("one page");
-                // Existing A4 raw fallback remains raw A4, then scales by the page unit.
-                let expected = (595.2755905511812_f64 as f32, 841.8897637795277_f64 as f32);
-                assert_eq!(page.base_dimensions(), expected, "unit={unit}, raw side={side}");
-                assert_eq!(page.render_dimensions(), (expected.0 * unit as f32, expected.1 * unit as f32));
-            }
-        }
-    }
-
-    fn raw_crop_ink(page: &RenderedPage) -> ([u32; 4], usize) {
-        let (mut left, mut top, mut right, mut bottom, mut count) = (page.width, page.height, 0, 0, 0);
-        for (i, pixel) in page.rgba.as_chunks::<4>().0.iter().enumerate() {
-            if pixel[0] < 128 && pixel[1] < 128 && pixel[2] < 128 {
-                let (x, y) = (i as u32 % page.width, i as u32 / page.width);
-                left = left.min(x);
-                top = top.min(y);
-                right = right.max(x + 1);
-                bottom = bottom.max(y + 1);
-                count += 1;
-            }
-        }
-        assert!(count > 0, "original vector marker must draw");
-        ([left, top, right, bottom], count)
-    }
-
-    #[test]
-    fn raw_crop_user_unit_vector_rasters_match_physical_controls() {
-        for (unit, scale, width, height, physical_width, physical_height, rects) in [
-            (
-                4096.0,
-                0.5,
-                256,
-                512,
-                512.0,
-                1024.0,
-                [[32.0, 320.0, 96.0, 448.0], [64.0, 32.0, 192.0, 96.0], [160.0, 64.0, 224.0, 192.0], [320.0, 160.0, 448.0, 224.0]],
-            ),
-            (
-                75000.0,
-                0.04,
-                375,
-                750,
-                9375.0,
-                18750.0,
-                [
-                    [46.875, 468.75, 140.625, 656.25],
-                    [93.75, 46.875, 281.25, 140.625],
-                    [234.375, 93.75, 328.125, 281.25],
-                    [468.75, 234.375, 656.25, 328.125],
-                ],
-            ),
-        ] {
-            for (index, rotation) in [0, 90, 180, 270].into_iter().enumerate() {
-                let raw_crop = [10.0, 20.0, 10.125, 20.25];
-                let raw_marker = [10.015625, 20.03125, 0.03125, 0.0625];
-                let control_crop = raw_crop.map(|n| n * unit);
-                let control_marker = raw_marker.map(|n| n * unit);
-                let physical = if rotation % 180 == 0 { (physical_width, physical_height) } else { (physical_height, physical_width) };
-                let pixels = if rotation % 180 == 0 { (width, height) } else { (height, width) };
-                let render = |bytes: Vec<u8>| {
-                    let info = crate::inspect(Arc::new(bytes.clone()), None).expect("bounded original vector PDF");
-                    assert_eq!((info.pages[0].width, info.pages[0].height), physical, "check dimensions before any raster allocation");
-                    let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
-                    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale, ..Default::default() });
-                    assert!(page.error.is_none(), "{:?}", page.error);
-                    assert_eq!((page.width, page.height), pixels);
-                    page
-                };
-                let high = render(raw_crop_unit_pdf(unit, rotation, raw_crop, Some(raw_marker)));
-                let control = render(raw_crop_unit_pdf(1.0, rotation, control_crop, Some(control_marker)));
-                let (bbox, count) = raw_crop_ink(&high);
-                for (actual, expected) in bbox.into_iter().zip(rects[index]) {
-                    assert!((f64::from(actual) - expected).abs() <= 1.0, "unit={unit}, rotation={rotation}: {bbox:?} != {:?}", rects[index]);
-                }
-                let (control_bbox, control_count) = raw_crop_ink(&control);
-                assert_eq!(bbox, control_bbox, "unit={unit}, rotation={rotation}: marker placement");
-                assert_eq!(count, control_count, "unit={unit}, rotation={rotation}: visible marker ink");
-                assert!(high.rgba == control.rgba, "unit={unit}, rotation={rotation}: physically equivalent crops render identically");
-            }
-        }
-    }
-
-    /// A page's `/UserUnit` (the size of its unit in points) scales the page and everything on
-    /// it, after the crop box and before `/Rotate`, as Acrobat shows such pages: with
-    /// `/UserUnit 2`, scale 1 renders pixel for pixel what scale 2 renders without it. As in
-    /// Acrobat, values below 1, values that aren't numbers and a value on a parent `/Pages`
-    /// node count as 1, and values over 75,000 count as 75,000.
-    #[test]
-    fn user_unit_scales_the_page_and_everything_on_it() {
-        let content = "1 0 0 rg 20 10 30 20 re f BT /F1 18 Tf 15 50 Td (Hg) Tj ET q 16 0 0 8 60 30 cm BI /W 2 /H 2 /CS /RGB /BPC 8 /F /AHx ID 0000FFFF000000FF00FFFF00> EI Q";
-        let pdf = |page: &str, parent: &str| {
-            format!(
-                "%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 {parent} >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 80] /CropBox [10 6 90 76] {page} /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
-6 0 obj 2 endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            )
-            .into_bytes()
-        };
-        let render = |bytes: Vec<u8>, scale: f32| {
-            let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{:?}", p.error);
-            p
-        };
-        let glyphs = |bytes: Vec<u8>| {
-            let parsed = Pdf::new(Arc::new(bytes)).expect("parses");
-            crate::text::extract_page(&parsed, 0, &InterpreterSettings::default()).expect("text").glyphs
-        };
-        let size = |bytes: Vec<u8>| {
-            let p = &crate::inspect(Arc::new(bytes), None).expect("opens").pages[0];
-            (p.width, p.height)
-        };
-        for rotate in [0, 90, 180, 270] {
-            let turned = format!("/Rotate {rotate}");
-            let (w, h) = if rotate % 180 == 0 { (80.0, 70.0) } else { (70.0, 80.0) };
-            let plain = render(pdf(&turned, ""), 2.0);
-            let one = render(pdf(&turned, ""), 1.0);
-            let plain_glyphs = glyphs(pdf(&turned, ""));
-            for unit in ["/UserUnit 2", "/UserUnit 6 0 R"] {
-                let page = format!("{turned} {unit}");
-                assert_eq!(size(pdf(&page, "")), (w * 2.0, h * 2.0), "{page}");
-                let doubled = render(pdf(&page, ""), 1.0);
-                assert_eq!((doubled.width, doubled.height), (plain.width, plain.height), "{page}");
-                assert!(doubled.rgba == plain.rgba, "{page}: the page renders as at twice the scale");
-                let doubled_glyphs = glyphs(pdf(&page, ""));
-                assert_eq!(doubled_glyphs.len(), plain_glyphs.len(), "{page}");
-                for (d, p) in doubled_glyphs.iter().zip(&plain_glyphs) {
-                    assert_eq!(d.rect, p.rect.map(|v| v * 2.0), "{page}: text layer");
-                }
-            }
-            for unit in ["/UserUnit 1", "/UserUnit 0", "/UserUnit -1", "/UserUnit 0.5", "/UserUnit /Two", "/UserUnit (2)"] {
-                let page = format!("{turned} {unit}");
-                assert_eq!(size(pdf(&page, "")), (w, h), "{page}");
-                assert!(render(pdf(&page, ""), 1.0).rgba == one.rgba, "{page} counts as 1");
-            }
-            assert_eq!(size(pdf(&turned, "/UserUnit 2")), (w, h), "not inherited from /Pages");
-            assert!(render(pdf(&turned, "/UserUnit 2"), 1.0).rgba == one.rgba, "not inherited from /Pages");
-            for unit in ["/UserUnit 75000", "/UserUnit 100000"] {
-                assert_eq!(size(pdf(&format!("{turned} {unit}"), "")), (w * 75_000.0, h * 75_000.0), "{unit}");
-            }
-        }
-    }
-
-    #[test]
-    fn tiles_match_full_render() {
-        let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
-        let full = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, ..Default::default() });
-        let tile = Tile { x: 30, y: 40, w: 50, h: 30 };
-        let part = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: Some(tile), scale: 2.0, tag: 0, ..Default::default() });
-        assert_eq!((part.width, part.height), (50, 30));
-        for y in 0..30u32 {
-            for x in 0..50u32 {
-                let a = &full.rgba[(((y + 40) * full.width + x + 30) * 4) as usize..][..4];
-                let b = &part.rgba[((y * 50 + x) * 4) as usize..][..4];
-                assert_eq!(a, b, "pixel {x},{y}");
-            }
-        }
-    }
-
-    /// White-on-black: the page clears black, the black filled rectangle maps to the text colour,
-    /// and the image's pixels are byte-identical to the plain render — photos never pass through
-    /// the mapping, not even its white quadrant, which would map to black if they did.
-    #[test]
-    fn reading_colors_map_solid_paints_and_leave_images() {
-        let content = "0 0 0 rg 10 10 30 20 re f\nq 20 0 0 10 60 20 cm /Im Do Q";
-        let pdf = format!(
-            "%PDF-1.4\n\
-             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R /Resources << /XObject << /Im 6 0 R >> >> >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-             6 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 25 >> stream\nFF000000FF00000000FFFFFFFF>\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            content.len()
-        )
-        .into_bytes();
-        let req = RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, preview: false };
-        let render = |reading_colors: ReadingColors| {
-            let mut r = PageRenderer::new(Arc::new(pdf.clone()), RenderConfig { reading_colors, ..Default::default() });
-            let page = r.render(req);
-            assert!(page.error.is_none(), "{:?}", page.error);
-            page
-        };
-        let off = render(ReadingColors::default());
-        let on = render(ReadingColors::WHITE_ON_BLACK);
-        assert_eq!((on.width, on.height), (200, 100));
-        fn pixel(page: &RenderedPage, x: u32, y: u32) -> &[u8] {
-            &page.rgba[((y * page.width + x) * 4) as usize..][..4]
-        }
-
-        // The page clears to the setting's background instead of white.
-        assert_eq!(pixel(&off, 5, 5), &[255, 255, 255, 255]);
-        assert_eq!(pixel(&on, 5, 5), &[0, 0, 0, 255]);
-        // The black rectangle maps to the text colour.
-        assert_eq!(pixel(&off, 50, 60), &[0, 0, 0, 255]);
-        assert_eq!(pixel(&on, 50, 60), &[255, 255, 255, 255]);
-        // The whole image area (the interior of device pixels 120..160 × 40..60) is untouched.
-        for y in 44..56u32 {
-            for x in 124..156u32 {
-                assert_eq!(pixel(&on, x, y), pixel(&off, x, y), "image pixel {x},{y}");
-            }
-        }
-        assert_eq!(pixel(&on, 150, 55), &[255, 255, 255, 255], "the image's white quadrant stays white");
-    }
-
-    /// #2975: a stencil mask (`/ImageMask true`) is painted in the fill colour at the fill
-    /// opacity, once: at `ca 0.5` it is as opaque as a rectangle filled at `ca 0.5` beside it
-    /// (it was a quarter as opaque, the opacity applied by both the image's group and its paint).
-    /// The same holds when the fill is a pattern, whose paint keeps the opacity in force when it
-    /// was set with `scn`: an uncoloured tiling pattern and a shading pattern.
-    #[test]
-    fn stencil_masks_are_drawn_at_the_fill_opacity_once() {
-        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..3].to_vec();
-        let fills = [("colour", "0 0 1 rg"), ("uncoloured tiling pattern", "/CsP cs 0 0 1 /Tp scn"), ("shading pattern", "/Pattern cs /Sp scn")];
-        for (fill_name, fill) in fills {
-            for alpha in ["1", "0.5", "0.25"] {
-                let content = format!("/A gs {fill} q 100 0 0 100 20 50 cm /Msk Do Q 160 50 100 100 re f");
-                let tile = "0 0 10 10 re f";
-                let pdf = format!(
-                    "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /ExtGState << /A << /ca {alpha} >> >> /XObject << /Msk 5 0 R >> /ColorSpace << /CsP [/Pattern /DeviceRGB] >> /Pattern << /Tp 6 0 R /Sp 7 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Length 2 >> stream
-\0\0
-endstream endobj
-6 0 obj << /Type /Pattern /PatternType 1 /PaintType 2 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >> /Length {} >> stream
-{tile}
-endstream endobj
-7 0 obj << /Type /Pattern /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 300 0] /Extend [true true] /Function << /FunctionType 2 /Domain [0 1] /C0 [0 0 1] /C1 [0 0 1] /N 1 >> >> >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                    content.len(),
-                    tile.len()
-                );
-                let p = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default()).render(RenderRequest {
-                    page: 0,
-                    kind: RequestKind::Pixels,
-                    tile: None,
-                    scale: 1.0,
-                    tag: 0,
-                    ..Default::default()
-                });
-                assert!(p.error.is_none(), "{fill_name}, ca {alpha}: {:?}", p.error);
-                // Pixel rows run top down: PDF (70, 100) is in the mask, (210, 100) in the rectangle.
-                let (mask, rect) = (px(&p, 70, 100), px(&p, 210, 100));
-                assert!(rect != [255, 255, 255], "{fill_name}, ca {alpha}: the rectangle is painted");
-                assert!(mask.iter().zip(&rect).all(|(m, r)| m.abs_diff(*r) <= 1), "{fill_name}, ca {alpha}: mask {mask:?}, rectangle {rect:?}");
-            }
-        }
-    }
-
-    /// #2971: in a knockout transparency group (`/K true`) each element composites with the
-    /// group's initial backdrop, not with the elements drawn before it in the group, over the
-    /// element's shape. A blue square at 50 % opacity over a red one at 50 % shows only the blue
-    /// where they overlap; without `/K` the two blend. The same holds for an image (its shape
-    /// is its rectangle; a soft-masked image's shape is its mask, so its transparent part leaves
-    /// what is under it) and for a nested group (its shape is the union of its elements'
-    /// shapes, while its own elements still blend with each other).
-    #[test]
-    fn knockout_groups_replace_what_their_elements_cover() {
-        let render_as = |group: &str, form: &str, preview: bool| {
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /XObject << /Fm1 5 0 R >> /ExtGState << /G << /ca 0.5 >> >> >> >> endobj
-4 0 obj << /Length 39 >> stream
-/Fm1 Do /G gs 0 1 0 rg 10 10 30 30 re f
-endstream endobj
-5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency {group} >> /Resources << /ExtGState << /A << /ca 0.5 >> >> /XObject << /In 6 0 R /Msk 7 0 R /Neu 8 0 R /Img 9 0 R /Sm 10 0 R /Nimg 12 0 R /Deep 13 0 R /Shg 16 0 R /Big 17 0 R >> >> /Length {} >> stream
-{form}
-endstream endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /A << /ca 0.5 >> >> >> /Length 34 >> stream
-/A gs 0 0 1 rg 100 50 150 120 re f
-endstream endobj
-7 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Filter /ASCIIHexDecode /Length 5 >> stream
-0000>
-endstream endobj
-8 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> >> /Length 62 >> stream
-/H gs 0 1 0 rg 80 40 100 100 re f 0 0 1 rg 130 80 100 100 re f
-endstream endobj
-9 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 7 >> stream
-0000FF>
-endstream endobj
-10 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /SMask 11 0 R /Filter /ASCIIHexDecode /Length 13 >> stream
-0000FF0000FF>
-endstream endobj
-11 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 5 >> stream
-00FF>
-endstream endobj
-12 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> /XObject << /Img 9 0 R >> >> /Length 38 >> stream
-/H gs q 160 0 0 100 60 50 cm /Img Do Q
-endstream endobj
-13 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> /XObject << /In3 14 0 R >> >> /Length 13 >> stream
-/H gs /In3 Do
-endstream endobj
-14 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Length 28 >> stream
-0 0 1 rg 100 50 150 120 re f
-endstream endobj
-15 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 1 0] /Function << /FunctionType 2 /Domain [0 1] /C0 [0 0 1] /C1 [0 0 1] /N 1 >> /Extend [true true] /BBox [100 50 140 170] >> >> endobj
-16 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /Pattern << /P 15 0 R >> >> /Length 38 >> stream
-/Pattern cs /P scn 100 50 150 120 re f
-endstream endobj
-17 0 obj << /Type /XObject /Subtype /Image /Width 20000 /Height 20000 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 7 >> stream
-0000FF>
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                form.len()
-            );
-            let p = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default()).render(RenderRequest {
-                page: 0,
-                kind: RequestKind::Pixels,
-                tile: None,
-                scale: 1.0,
-                tag: 0,
-                preview,
-            });
-            assert!(p.error.is_none(), "{group} {form}: {:?}", p.error);
-            p
-        };
-        let render = |group: &str, form: &str| render_as(group, form, false);
-        // Pixel rows run top down: PDF (x, y) is pixel (x, 200 - y).
-        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((200 - y) * p.width + x) as usize * 4..][..3].to_vec();
-        let check = |p: &RenderedPage, x: u32, y: u32, want: [u8; 3], what: &str| {
-            let got = px(p, x, y);
-            assert!(got.iter().zip(want).all(|(a, b)| a.abs_diff(b) <= 2), "{what}: {got:?}, expected {want:?}");
-        };
-        let red = "/A gs 1 0 0 rg 20 20 150 150 re f ";
-        let ko = "/I true /K true";
-
-        let squares = render(ko, &format!("{red}0 0 1 rg 100 50 150 120 re f"));
-        check(&squares, 130, 100, [128, 128, 255], "knocked out");
-        check(&squares, 50, 40, [255, 128, 128], "red alone");
-        check(&squares, 210, 100, [128, 128, 255], "blue alone");
-        check(&squares, 280, 190, [255, 255, 255], "paper");
-        // Page content after the group composites normally again: green at 50 % over the red.
-        check(&squares, 30, 30, [128, 191, 64], "after the group");
-        let plain = render("/I true", &format!("{red}0 0 1 rg 100 50 150 120 re f"));
-        check(&plain, 130, 100, [128, 64, 191], "blended without /K");
-
-        // An image at 50 % replaces the red under its rectangle.
-        let image = render(ko, &format!("{red}q 160 0 0 100 60 50 cm /Img Do Q"));
-        check(&image, 100, 100, [128, 128, 255], "image knocks out");
-        check(&image, 40, 40, [255, 128, 128], "red beside the image");
-        // A soft-masked image: its transparent left half leaves the red, its opaque half replaces it.
-        let masked = render(ko, "1 0 0 rg 20 20 150 150 re f q 160 0 0 100 60 50 cm /Sm Do Q");
-        check(&masked, 100, 100, [255, 0, 0], "under the transparent half");
-        check(&masked, 155, 100, [0, 0, 255], "under the opaque half");
-
-        // A nested group entered at 50 % (blue at 25 % in all) replaces the red under its shape.
-        let nested = render(ko, &format!("{red}/In Do"));
-        check(&nested, 130, 100, [191, 191, 255], "nested group knocks out");
-        check(&nested, 50, 40, [255, 128, 128], "red beside the nested group");
-        // A nested group at full opacity: it knocks out the red as a whole, and its own two
-        // squares at 50 % still blend with each other where they overlap.
-        let neutral = render(ko, "1 0 0 rg 20 20 150 150 re f /Neu Do");
-        check(&neutral, 100, 60, [128, 255, 128], "green over the knocked-out red");
-        check(&neutral, 150, 110, [64, 128, 191], "the nested squares blend");
-        check(&neutral, 40, 40, [255, 0, 0], "red beside the nested group");
-
-        // An image inside a nested group is drawn once (blue at 50 %), over the knocked-out red.
-        let nested_image = render(ko, "1 0 0 rg 20 20 150 150 re f /Nimg Do");
-        check(&nested_image, 100, 100, [128, 128, 255], "image in a nested group");
-        // A group inside a nested group knocks out the red as well.
-        let deep = render(ko, "1 0 0 rg 20 20 150 150 re f /Deep Do");
-        check(&deep, 130, 100, [128, 128, 255], "group in a nested group");
-        check(&deep, 40, 40, [255, 0, 0], "red beside it");
-
-        // A stencil mask must not erase the red beside it.
-        let stencil = render(ko, &format!("{red}0 0 1 rg q 150 0 0 120 100 50 cm /Msk Do Q"));
-        check(&stencil, 50, 40, [255, 128, 128], "red beside a stencil");
-        // Where the stencil paints (every sample 0), its blue is drawn (review on #2974: the check
-        // above alone passed even if the stencil drew nothing). A stencil composites as it did
-        // before rather than knocking the red out, and its exact colour also depends on #2975 (a
-        // stencil's fill opacity applied twice), so only "blue was drawn here" is pinned.
-        let under = px(&stencil, 130, 100);
-        assert!(under != [255, 128, 128] && under[2] >= 150 && under[0] < 230, "stencil drew nothing: {under:?}");
-
-        // A shading's /BBox clips it (ISO 32000-2 Table 77), so a shading fill's shape is its path
-        // inside the box: the erase pass must clear only that, or the red outside the box but
-        // inside the path stays erased (review on #2974).
-        let shaded = render(ko, &format!("{red}/Shg Do"));
-        check(&shaded, 120, 100, [128, 128, 255], "the shading inside its box");
-        check(&shaded, 155, 100, [255, 128, 128], "red outside the shading's box");
-
-        // An image that isn't decoded (here over the renderer's pixel limit) draws nothing, so it
-        // must not clear what is under its rectangle either (review on #2974).
-        let undecoded = render(ko, &format!("{red}q 160 0 0 100 60 50 cm /Big Do Q"));
-        check(&undecoded, 100, 100, [255, 128, 128], "red under an image that isn't drawn");
-        // Nor one a preview skips for covering only a few device pixels (review on #2974): the
-        // red under a 3 x 3 image stays in a preview, and a final render knocks it out.
-        let tiny = format!("{red}q 3 0 0 3 100 100 cm /Img Do Q");
-        check(&render_as(ko, &tiny, true), 101, 101, [255, 128, 128], "red under a preview's skipped image");
-        check(&render_as(ko, &tiny, false), 101, 101, [128, 128, 255], "the tiny image in a final render");
-    }
-
-    /// #2970: a page's objects composite with a transparent backdrop and the page group is then
-    /// put on the paper, so a separable blend mode only blends where something was drawn. A
-    /// green fill with `/BM /Screen` (or Lighten, Difference…) half over a red square is yellow
-    /// (or whatever the mode gives) over the red, and plain green over the empty page: blending
-    /// with the white paper made it white or magenta.
-    #[test]
-    fn blend_modes_over_an_empty_part_of_the_page_keep_their_colour() {
-        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        for (mode, over_red) in [
-            ("Normal", Some([0, 255, 0])),
-            ("Multiply", Some([0, 0, 0])),
-            ("Screen", Some([255, 255, 0])),
-            ("Lighten", Some([255, 255, 0])),
-            ("Difference", Some([255, 255, 0])),
-            ("Exclusion", Some([255, 255, 0])),
-            ("ColorDodge", Some([255, 0, 0])),
-            ("Overlay", Some([255, 0, 0])),
-            // The non-separable modes mix hue, saturation and luminosity; over an empty part of
-            // the page they too must keep the source colour.
-            ("Hue", None),
-            ("Saturation", None),
-            ("Color", None),
-            ("Luminosity", None),
-        ] {
-            let content = "1 0 0 rg 20 20 150 150 re f /G1 gs 0 1 0 rg 100 50 150 120 re f";
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /ExtGState << /G1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /ExtGState /BM /{mode} >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            );
-            let p = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default()).render(RenderRequest {
-                page: 0,
-                kind: RequestKind::Pixels,
-                tile: None,
-                scale: 1.0,
-                tag: 0,
-                ..Default::default()
-            });
-            assert!(p.error.is_none(), "{mode}: {:?}", p.error);
-            // Pixel rows run top down: PDF (210, 100) and (130, 100) are rows 100 from the top.
-            assert_eq!(px(&p, 210, 100), vec![0, 255, 0, 255], "{mode} over the empty page");
-            if let Some(over_red) = over_red {
-                assert_eq!(px(&p, 130, 100)[..3], over_red, "{mode} over the red square");
-            }
-            assert_eq!(px(&p, 280, 10), vec![255, 255, 255, 255], "{mode}: the paper stays white");
-        }
-    }
-
-    /// A transparent page leaves what nothing paints see-through, so it can be laid over another
-    /// raster: with reading colours on, and in a tile, too. Painted pixels stay premultiplied.
-    #[test]
-    fn transparent_pages_paint_only_their_content() {
-        let content = "0 0 1 rg 10 10 30 20 re f /GS gs 0.5 g 60 10 30 20 re f";
-        let pdf = format!(
-            "%PDF-1.4\n\
-             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R /Resources << /ExtGState << /GS << /ca 0.5 >> >> >> >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            content.len()
-        )
-        .into_bytes();
-        let pixel = |page: &RenderedPage, x: u32, y: u32| page.rgba[((y * page.width + x) * 4) as usize..][..4].to_vec();
-        for reading_colors in [ReadingColors::default(), ReadingColors::WHITE_ON_BLACK] {
-            let config = RenderConfig { transparent: true, reading_colors, ..Default::default() };
-            let mut r = PageRenderer::new(Arc::new(pdf.clone()), config.clone());
-            let page = r.render(RenderRequest { page: 0, scale: 2.0, ..Default::default() });
-            assert!(page.error.is_none(), "{:?}", page.error);
-            assert_eq!(pixel(&page, 5, 5), [0, 0, 0, 0], "{reading_colors:?}: nothing painted, nothing shown");
-            assert_eq!(pixel(&page, 50, 60)[3], 255, "{reading_colors:?}: the opaque rectangle covers");
-            assert_eq!(pixel(&page, 150, 60), [64, 64, 64, 128], "{reading_colors:?}: half-transparent grey, premultiplied");
-            let tile = r.render(RenderRequest { page: 0, scale: 2.0, tile: Some(Tile { x: 0, y: 40, w: 100, h: 60 }), ..Default::default() });
-            assert_eq!((pixel(&tile, 5, 5), pixel(&tile, 50, 20)), (pixel(&page, 5, 45), pixel(&page, 50, 60)), "{reading_colors:?}");
-            let pool = RenderPool::new(Arc::new(pdf.clone()), 1, config);
-            pool.set_queue(vec![RenderRequest { page: 0, scale: 2.0, ..Default::default() }]);
-            let pooled = loop {
-                if let Some(p) = pool.try_recv() {
-                    break p;
-                }
-                std::thread::sleep(std::time::Duration::from_millis(5));
-            };
-            assert_eq!(pooled.rgba, page.rgba, "{reading_colors:?}: the pool renders the same");
-        }
-        let opaque = PageRenderer::new(Arc::new(pdf), RenderConfig::default()).render(RenderRequest { page: 0, scale: 2.0, ..Default::default() });
-        assert_eq!(pixel(&opaque, 5, 5), [255, 255, 255, 255], "pages are still white by default");
-    }
-
-    /// Reading colours replace *document* colours, never annotation colours (issue #1548): a
-    /// highlight keeps its `/C`, so on a dark background the content under it shows through the
-    /// Multiply blend in the highlight's colour instead of being darkened into invisibility.
-    /// Both annotation paths are covered: the `/AP` appearance stream and the no-`/AP`
-    /// `/QuadPoints` fallback.
-    #[test]
-    fn reading_colors_keep_highlight_annotations_readable() {
-        let content = "0 g 100 40 10 20 re f";
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Annots [5 0 R] >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Annot /Subtype /Highlight /Rect [15 35 120 65] /QuadPoints [15 65 120 65 15 35 120 35] /C [1 1 0] {{annot}} >> endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [15 35 120 65] /Length 24 >> stream
-0 0 1 rg 15 35 50 30 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        );
-        let render = |annot: &str| {
-            let mut r = PageRenderer::new(
-                Arc::new(pdf.replace("{annot}", annot).into_bytes()),
-                RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() },
-            );
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{annot}: {:?}", p.error);
-            p
-        };
-        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-
-        // No /AP: the page's black rectangle is remapped to white (document line art), the
-        // yellow fill is not, so Multiply leaves the content under the quad yellow — readable.
-        let p = render("");
-        assert_eq!(px(&p, 5, 5), vec![0, 0, 0, 255], "the page clears to the background");
-        assert_eq!(px(&p, 105, 50), vec![255, 255, 0, 255], "content under the quad shows through in the highlight's colour");
-        assert_eq!(px(&p, 30, 50), vec![0, 0, 0, 255], "the band itself multiplies into the dark background, as in Acrobat");
-        assert_eq!(px(&p, 150, 50), vec![0, 0, 0, 255], "outside the quad");
-
-        // With /AP the appearance's blue is an annotation colour too and stays blue instead of
-        // being remapped towards white by its luminance.
-        let p = render("/AP << /N 6 0 R >>");
-        assert_eq!(px(&p, 30, 50), vec![0, 0, 255, 255], "the appearance keeps its own colour");
-        assert_eq!(px(&p, 90, 50), vec![0, 0, 0, 255], "outside the appearance's own drawing");
-    }
-
-    /// A print-preview request (`PRINT_TAG`) renders the document's true colours even though
-    /// the document's config carries reading colours: a preview's job is fidelity to the
-    /// printout, which is imposed from the uncoloured document. Covers both render paths —
-    /// the inline `PageRenderer` and a pool worker.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn print_preview_requests_render_with_reading_colors_off() {
-        let content = "0 0 0 rg 10 10 30 20 re f";
-        let pdf = Arc::new(
-            format!(
-                "%PDF-1.4\n\
-                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 100 50] >> endobj\n\
-                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n\
-                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-                 trailer << /Root 1 0 R >>\n%%EOF",
-                content.len()
-            )
-            .into_bytes(),
-        );
-        fn px(page: &RenderedPage, x: u32, y: u32) -> &[u8] {
-            &page.rgba[((y * page.width + x) * 4) as usize..][..4]
-        }
-
-        // The page and its black rectangle in their true colours.
-        let mut plain = PageRenderer::new(pdf.clone(), RenderConfig::default());
-        let truth = plain.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, preview: false });
-        assert!(truth.error.is_none(), "{:?}", truth.error);
-        assert_eq!(px(&truth, 5, 5), &[255, 255, 255, 255]);
-        assert_eq!(px(&truth, 50, 60), &[0, 0, 0, 255]);
-
-        let mut recoloured = PageRenderer::new(pdf.clone(), RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() });
-        // A plain request honours the setting: the page clears black, the rect maps white.
-        let on = recoloured.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, preview: false });
-        assert_eq!(px(&on, 5, 5), &[0, 0, 0, 255]);
-        assert_eq!(px(&on, 50, 60), &[255, 255, 255, 255]);
-        // A print-preview request ignores the setting and matches the true colours exactly.
-        let preview = RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: PRINT_TAG, preview: false };
-        let off = recoloured.render(preview);
-        assert_eq!(px(&off, 5, 5), &[255, 255, 255, 255]);
-        assert_eq!(px(&off, 50, 60), &[0, 0, 0, 255]);
-        assert_eq!(off.rgba, truth.rgba);
-
-        // The same override on the worker path the print dialog's canvas renders through.
-        let pool = RenderPool::new(pdf, 1, RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() });
-        pool.set_queue(vec![preview]);
-        let worker = loop {
-            if let Some(p) = pool.try_recv() {
-                break p;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        };
-        assert!(worker.error.is_none(), "{:?}", worker.error);
-        assert_eq!(worker.rgba, truth.rgba);
-    }
-
-    /// A recoloured tile must equal the crop of the recoloured full render, or zooming would
-    /// flash wrong colours at tile seams.
-    #[test]
-    fn reading_colors_tiles_match_full_render() {
-        let mut r =
-            PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() });
-        let full = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, preview: false });
-        let tile = Tile { x: 30, y: 40, w: 50, h: 30 };
-        let part = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: Some(tile), scale: 2.0, tag: 0, preview: false });
-        assert!(full.error.is_none() && part.error.is_none(), "{:?} {:?}", full.error, part.error);
-        assert_eq!((part.width, part.height), (50, 30));
-        for y in 0..30u32 {
-            for x in 0..50u32 {
-                let a = &full.rgba[(((y + 40) * full.width + x + 30) * 4) as usize..][..4];
-                let b = &part.rgba[((y * 50 + x) * 4) as usize..][..4];
-                assert_eq!(a, b, "pixel {x},{y}");
-            }
-        }
-        // The colours are really on: the page cleared black and the blue rectangle mapped towards
-        // white (its luminance is 7.2%, so 255·(1−0.0722) ≈ 237).
-        assert_eq!(&full.rgba[..4], &[0, 0, 0, 255]);
-        assert_eq!(&full.rgba[((60 * full.width + 50) * 4) as usize..][..4], &[237, 237, 237, 255]);
-    }
-
-    // A tile seam must not change the raster when large-page work is stitched back together.
-    #[test]
-    fn stitched_render_partitions_match_a_whole_render() {
-        let content =
-            "0 0 1 rg 0 0 200 200 re f\n1 0 0 RG 2 w 0 100 m 200 100 l S\nBT /F1 18 Tf 20 150 Td (tile text) Tj ET\nq 40 0 0 40 100 100 cm /Im Do Q";
-        let pdf = format!(
-            "%PDF-1.4\n\
-             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
-             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
-             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im 6 0 R >> >> >> endobj\n\
-             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
-             5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n\
-             6 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 25 >> stream\nFF000000FF00000000FFFFFFFF>\nendstream endobj\n\
-             trailer << /Root 1 0 R >>\n%%EOF",
-            content.len()
-        );
-        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let request = RenderRequest { scale: 6.0, ..Default::default() };
-        let whole = renderer.render(request);
-        assert!(whole.error.is_none(), "{:?}", whole.error);
-        assert_eq!((whole.width, whole.height), (1200, 1200));
-
-        let mut assert_partition = |tile_width: u32, tile_height: u32| {
-            let mut stitched = vec![0; whole.rgba.len()];
-            for y in (0..whole.height).step_by(tile_height as usize) {
-                for x in (0..whole.width).step_by(tile_width as usize) {
-                    let tile = Tile { x, y, w: tile_width.min(whole.width - x), h: tile_height.min(whole.height - y) };
-                    let part = renderer.render(RenderRequest { tile: Some(tile), ..request });
-                    assert!(part.error.is_none(), "tile {tile:?}: {:?}", part.error);
-                    assert_eq!((part.width, part.height), (tile.w, tile.h));
-                    for row in 0..tile.h {
-                        let src = (row * tile.w * 4) as usize;
-                        let dst = ((y + row) * whole.width * 4 + x * 4) as usize;
-                        let len = (tile.w * 4) as usize;
-                        stitched[dst..dst + len].copy_from_slice(&part.rgba[src..src + len]);
-                    }
-                }
-            }
-            assert_eq!(stitched.as_slice(), whole.rgba.as_ref(), "partition {tile_width}×{tile_height}");
-        };
-
-        for bands in [2, 4, 8] {
-            assert_partition(whole.width, whole.height.div_ceil(bands));
-        }
-        assert_partition(1024, 1024);
-        assert_partition(127, 131);
-    }
-
-    /// hayro skips drawing a path that can't paint the canvas (vendored patch (9)), so a tile no
-    /// longer strokes every path of its page. Every tile, and the whole page, is byte for byte
-    /// what it was without skipping, where paint reaches past a path into the next tile: round
-    /// and square caps, a sharp miter, a rotated and a stretched matrix, a hairline, dashes, a
-    /// curve, text, and a page shown rotated.
-    ///
-    /// Images are skipped the same way (vendored patch (10)): an image on a tile, one crossing
-    /// tile lines, and one fully off the page.
-    #[test]
-    fn skipping_paths_off_the_canvas_changes_no_pixel() {
-        // Tiles of 80 device pixels at scale 2 meet every 40 pt; each mark crosses such a line
-        // only with its stroke width, caps, miter or antialiasing. The last one is off the page.
-        let content = "1 0 0 RG 20 w 1 J 10 30 m 35 30 l S
-2 J 10 60 m 35 70 l S
-0 J 0 j 10 M 8 w 100 50 m 118 60 l 100 70 S
-q 0.7071 0.7071 -0.7071 0.7071 160 20 cm 15 w 1 J 0 0 m 20 0 l S Q
-0 w 0 0 0 RG 79.9 100 m 79.9 140 l S
-1 0 0 rg 80.3 150 20 20 re f
-0 0 1 RG 6 w [8 4] 0 d 1 J 130 100 m 205 160 l S [] 0 d
-0 1 0 RG 3 w 10 200 m 10 290 70 290 70 200 c S
-BT /F1 30 Tf 70 205 Td (Hg) Tj ET
-q 4 0 0 0.25 0 0 cm 12 w 1 J 2 500 m 8 500 l S Q
-300 300 m 320 320 l S
-q 10 0 0 10 5 5 cm /Im0 Do Q
-q 30 0 0 30 100 100 cm /Im0 Do Q
-q 5 0 0 5 500 500 cm /Im0 Do Q";
-        // A 4x4 RGB image of plain `A` bytes (no `endstream` inside, so the raw stream parses).
-        let pixels = "A".repeat(4 * 4 * 3);
-        for rotate in [0, 90] {
-            let pdf = format!(
-                "%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 240 240] /Rotate {rotate} /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
-6 0 obj << /Type /XObject /Subtype /Image /Width 4 /Height 4 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length {} >> stream
-{pixels}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len(),
-                pixels.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let mut both = |tile| {
-                let req = RenderRequest { scale: 2.0, tile, ..Default::default() };
-                let skipped = r.render(req);
-                hayro::set_skip_offscreen_paths(false);
-                let drawn = r.render(req);
-                hayro::set_skip_offscreen_paths(true);
-                assert!(skipped.error.is_none() && drawn.error.is_none(), "{:?}", skipped.error);
-                assert!(skipped.rgba == drawn.rgba, "/Rotate {rotate}: {tile:?} changed");
-            };
-            both(None);
-            for y in (0..480).step_by(80) {
-                for x in (0..480).step_by(80) {
-                    both(Some(Tile { x, y, w: 80, h: 80 }));
-                }
-            }
-        }
-    }
-
-    /// Previews skip images that would cover only a few device pixels (vendored patch (11)):
-    /// a tiny draw is missing from the preview but present in the final, while a large draw
-    /// is in both. Finals never set the flag, so they draw everything.
-    #[test]
-    fn preview_renders_skip_tiny_images_but_finals_draw_everything() {
-        let content = "q 50 0 0 50 100 100 cm /Im0 Do Q
-q 0.5 0 0 0.5 10 10 cm /Im0 Do Q";
-        let pixels = "A".repeat(4 * 4 * 3);
-        let pdf = format!(
-            "%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 240 240] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /XObject /Subtype /Image /Width 4 /Height 4 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length {} >> stream
-{pixels}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len(),
-            pixels.len()
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let mut render = |preview| r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview });
-        let first = render(false);
-        let second = render(false);
-        assert!(first.error.is_none(), "{:?}", first.error);
-        assert_eq!(first.rgba, second.rgba, "finals are deterministic");
-        let gray = first.rgba.as_chunks::<4>().0.iter().filter(|px| px[0] == 0x41 && px[1] == 0x41 && px[2] == 0x41).count();
-        assert!(gray > 1000, "the large image draws {gray} pixels");
-        let preview = render(true);
-        assert!(preview.error.is_none(), "{:?}", preview.error);
-        assert_ne!(preview.rgba, first.rgba, "the tiny image is skipped only in the preview");
-    }
-
-    /// A page whose stream objects 5, 6, … are `objects` (dictionary, data), drawn by `content`
-    /// with `resources`, on a 130 × 70 pt page.
-    fn image_cache_pdf(content: &str, resources: &str, objects: &[(&str, &[u8])]) -> Vec<u8> {
-        let mut pdf = format!(
-            "%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 130 70] /Contents 4 0 R /Resources {resources} >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-",
-            content.len()
-        )
-        .into_bytes();
-        for (i, (dict, data)) in objects.iter().enumerate() {
-            pdf.extend(format!("{} 0 obj {dict} stream\n", i + 5).bytes());
-            pdf.extend_from_slice(data);
-            pdf.extend_from_slice(b"\nendstream endobj\n");
-        }
-        pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
-        pdf
-    }
-
-    /// The RGB of the pixel at (`x`, `y`) (from the top left) of a `width`-pixel-wide RGBA raster.
-    fn rgb_at(rgba: &[u8], width: usize, x: usize, y: usize) -> [u8; 3] {
-        let i = (y * width + x) * 4;
-        [rgba[i], rgba[i + 1], rgba[i + 2]]
-    }
-
-    const ONE_PIXEL_RGB: &str = "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length 3 >>";
-
-    /// Two images whose dictionaries are byte for byte the same (uncompressed, one size) but
-    /// whose pixels differ each draw their own: the decoded-image cache tells them apart by the
-    /// stream, not by the dictionary's bytes alone, in one render and across renders sharing a
-    /// cache, and previews never hand their entries to a final render.
-    #[test]
-    fn decoded_images_with_identical_dictionaries_keep_their_own_pixels() {
-        let pdf = image_cache_pdf(
-            // B over A at the same place and size (so one decode target): B must show. A alone
-            // on the right, at a size of its own.
-            "q 50 0 0 50 10 10 cm /A Do Q q 50 0 0 50 10 10 cm /B Do Q q 40 0 0 40 80 15 cm /A Do Q",
-            "<< /XObject << /A 5 0 R /B 6 0 R >> >>",
-            &[(ONE_PIXEL_RGB, b"\xff\x00\x00"), (ONE_PIXEL_RGB, b"\x00\x00\xff")],
-        );
-        let req = |preview| RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview };
-        let mut r = PageRenderer::new(Arc::new(pdf.clone()), RenderConfig::default());
-        let out = r.render(req(false));
-        assert!(out.error.is_none(), "{:?}", out.error);
-        let w = out.width as usize;
-        assert_eq!(rgb_at(&out.rgba, w, 35, 35), [0, 0, 255], "the second image drew the first one's pixels");
-        assert_eq!(rgb_at(&out.rgba, w, 100, 35), [255, 0, 0]);
-        // One cache across a preview and then a final render, as a render worker keeps it.
-        let pdf = parse(&Arc::new(pdf), None).expect("parses");
-        let cache = RenderCache::new();
-        let settings = InterpreterSettings::default();
-        let preview = render_page(&pdf, &cache, &settings, &RenderConfig::default(), req(true)).expect("preview renders");
-        let fin = render_page(&pdf, &cache, &settings, &RenderConfig::default(), req(false)).expect("final renders");
-        let fresh = render_page(&pdf, &RenderCache::new(), &settings, &RenderConfig::default(), req(false)).expect("final renders");
-        assert_eq!(rgb_at(&preview.2, w, 35, 35), [0, 0, 255]);
-        assert_eq!(&fin.2[..], &fresh.2[..], "a final render after a preview matches one with a fresh cache");
-    }
-
-    /// An image drawn under a transfer function (`/TR`) is decoded with it, even when the same
-    /// image was drawn without one just before (and the other way round).
-    #[test]
-    fn decoded_images_under_a_transfer_function_are_not_shared() {
-        let pdf = image_cache_pdf(
-            // The image, then the same image at the same place under the inverting function
-            // (one decode target), then the image alone on the right.
-            "q 50 0 0 50 10 10 cm /A Do Q q /Inv gs 50 0 0 50 10 10 cm /A Do Q q 40 0 0 40 80 15 cm /A Do Q",
-            "<< /XObject << /A 5 0 R >> /ExtGState << /Inv << /TR 6 0 R >> >> >>",
-            &[(ONE_PIXEL_RGB, b"\xff\x00\x00"), ("<< /FunctionType 4 /Domain [0 1] /Range [0 1] /Length 14 >>", b"{ 1 exch sub }")],
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
-        assert!(out.error.is_none(), "{:?}", out.error);
-        let w = out.width as usize;
-        assert_eq!(rgb_at(&out.rgba, w, 35, 35), [0, 255, 255], "the transfer function was not applied to a cached image");
-        assert_eq!(rgb_at(&out.rgba, w, 100, 35), [255, 0, 0]);
-    }
-
-    /// The decoded-image cache keyed every decode by the size the image is drawn at, but only
-    /// a JPX stream decodes differently for a size: a scan was decoded again at every zoom step
-    /// and kept once per zoom level (vendored hayro-interpret patch 32). An image drawn at five
-    /// sizes is now decoded once, unless JPX decodes it or its soft mask.
-    #[test]
-    fn decoded_images_serve_every_size_they_are_drawn_at() {
-        use hayro::hayro_interpret::font::Glyph;
-        use hayro::hayro_interpret::hayro_syntax::Pdf;
-        use hayro::hayro_interpret::{
-            BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, Paint, PathDrawMode, SoftMask, TransformExt, interpret_page,
-        };
-        use kurbo::{Affine, BezPath, Rect};
-        use std::io::Write;
-
-        /// Asks for every raster image at the size it is drawn at, as the renderer does, and
-        /// counts the decoded images it was handed.
-        #[derive(Default)]
-        struct Draws(usize);
-        impl<'a> Device<'a> for Draws {
-            fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
-            fn set_blend_mode(&mut self, _: BlendMode) {}
-            fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'a>, _: &PathDrawMode) {}
-            fn push_clip_path(&mut self, _: &ClipPath) {}
-            fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
-            fn draw_glyph(&mut self, _: &Glyph<'a>, _: Affine, _: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {}
-            fn draw_image(&mut self, image: Image<'a, '_>, transform: Affine) {
-                let [a, b, c, d, ..] = transform.as_coeffs();
-                let target = ((a.hypot(b) * f64::from(image.width())).ceil() as u32, (c.hypot(d) * f64::from(image.height())).ceil() as u32);
-                if let Image::Raster(r) = image {
-                    r.with_rgba(|_, _| self.0 += 1, Some(target));
-                }
-            }
-            fn pop_clip_path(&mut self) {}
-            fn pop_transparency_group(&mut self) {}
-        }
-
-        let flate = |data: &[u8]| {
-            let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
-            z.write_all(data).unwrap();
-            z.finish().unwrap()
-        };
-        let pixels = flate(&(0..64 * 64 * 3).map(|i| (i % 251) as u8).collect::<Vec<_>>());
-        let image = |extra: &str| {
-            format!(
-                "<< /Type /XObject /Subtype /Image /Width 64 /Height 64 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /FlateDecode {extra}/Length {} >>",
-                pixels.len()
-            )
-        };
-        let (plain, jpx_masked) = (image(""), image("/SMask 7 0 R "));
-        let jpx_mask =
-            "<< /Type /XObject /Subtype /Image /Width 64 /Height 64 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /JPXDecode /Length 4 >>";
-        // `name` drawn at five sizes, from 10 to 40 pt square.
-        let decodes = |name: &str| {
-            let content = [(10, 0, 0), (20, 12, 0), (30, 34, 0), (40, 66, 0), (25, 100, 40)]
-                .map(|(s, x, y)| format!("q {s} 0 0 {s} {x} {y} cm /{name} Do Q"))
-                .join(" ");
-            let bytes = image_cache_pdf(
-                &content,
-                "<< /XObject << /A 5 0 R /B 6 0 R >> >>",
-                &[(&plain, &pixels), (&jpx_masked, &pixels), (jpx_mask, b"\0\0\0\0")],
-            );
-            let parsed = Pdf::new(Arc::new(bytes)).expect("parses");
-            let page = &parsed.pages()[0];
-            let cache = InterpreterCache::new();
-            let initial = page.initial_transform(true).to_kurbo();
-            let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, 130.0, 70.0), &cache, page.xref(), InterpreterSettings::default());
-            let mut device = Draws::default();
-            interpret_page(page, &mut ctx, &mut device);
-            assert_eq!(device.0, 5, "every draw of /{name} was handed its pixels");
-            cache.decoded_image_decodes()
-        };
-        assert_eq!(decodes("A"), 1, "a Flate image decodes the same at every size");
-        assert_eq!(decodes("B"), 5, "a JPX soft mask decodes for the size it is drawn at");
-    }
-
-    // ICC profiles whose stream dictionaries are the same (vendored hayro-interpret patch 48).
-    mod icc_profile_cache;
-
-    // A symbolic TrueType font draws through its (3, 0) cmap subtable first (#4156).
-    mod symbolic_truetype_cmap;
-
-    /// Render `pdf`'s first page at 72 dpi with no time limit beyond the test's own.
-    fn render_first_page(pdf: Vec<u8>) -> RenderedPage {
-        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-        let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
-        assert!(out.error.is_none(), "{:?}", out.error);
-        out
-    }
-
-    /// A spot-colour image runs its tint transform once per possible sample, not once per pixel
-    /// (vendored hayro-interpret patch 28). Fillable character sheets draw their background art
-    /// as an 8-bit DeviceN image whose tint transform is a PostScript calculator program: run for
-    /// each of a 3304 × 4105 background's pixels, every page took four seconds and 430 MB to
-    /// draw, again after each field was filled. This image (2048 × 2048, a 9,000-operator
-    /// program) took about 40 seconds that way; from a 256-entry table it takes milliseconds.
-    /// The runs are counted (patch 34) rather than timed: a deadline also failed when a slow,
-    /// busy CI machine took longer than it allowed, and the count is the same on every machine.
-    #[test]
-    fn spot_colour_images_run_their_tint_transform_once_per_sample_value() {
-        const SIDE: usize = 2048;
-        // 8,990 operators that change nothing (the calculator allows 10,000 a run), then
-        // tint t → RGB (1 − t, t, 0).
-        let program = format!("{{ {}dup 1 exch sub exch 0 }}", "dup pop ".repeat(4495));
-        // Each row: tint 0 on the left half, tint 1 on the right.
-        let row: Vec<u8> = [vec![0u8; SIDE / 2], vec![255u8; SIDE / 2]].concat();
-        let data = row.repeat(SIDE);
-        let image = format!(
-            "<< /Type /XObject /Subtype /Image /Width {SIDE} /Height {SIDE} /ColorSpace [/Separation /Spot /DeviceRGB 6 0 R] /BitsPerComponent 8 /Length {} >>",
-            data.len()
-        );
-        let function = format!("<< /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >>", program.len());
-        let pdf =
-            image_cache_pdf("q 130 0 0 70 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data), (&function, program.as_bytes())]);
-        // The count is per thread, and this render runs on this one.
-        let before = hayro::hayro_interpret::color::tint_transform_runs();
-        let out = render_first_page(pdf);
-        let runs = hayro::hayro_interpret::color::tint_transform_runs() - before;
-        assert_eq!(runs, 256, "the tint transform runs once per possible sample value, not once for each of the {} pixels", SIDE * SIDE);
-        let w = out.width as usize;
-        assert_eq!(rgb_at(&out.rgba, w, 10, 35), [255, 0, 0], "tint 0");
-        assert_eq!(rgb_at(&out.rgba, w, 120, 35), [0, 255, 0], "tint 1");
-    }
-
-    /// Images converted through patch 28's table keep the colour of every sample: the samples of
-    /// a pixel in order, each through its own `/Decode` range, rows that end mid-byte, and an image
-    /// whose data stops part-way through a row (that row is padded with decoded zeros, as before).
-    #[test]
-    fn images_converted_through_a_table_keep_every_samples_colour() {
-        let close = |got: [u8; 3], want: [u8; 3], at: (usize, usize)| {
-            assert!(got.iter().zip(want).all(|(g, w)| g.abs_diff(w) <= 1), "pixel {at:?}: got {got:?}, want {want:?}");
-        };
-        // DeviceN of two inks at 4 bits (256 possible pixels) shown as RGB (a, b, 0), the first
-        // ink's range reversed. 32 × 16 pixels, each drawn 4 pt square.
-        let mut data = Vec::new();
-        for y in 0..16 {
-            for x in 0..32 {
-                let (a, b) = (x % 16, (x / 16 + 2 * y) % 16);
-                data.push(((a << 4) | b) as u8);
-            }
-        }
-        let image = format!(
-            "<< /Type /XObject /Subtype /Image /Width 32 /Height 16 /ColorSpace [/DeviceN [/A /B] /DeviceRGB 6 0 R] /BitsPerComponent 4 /Decode [1 0 0 1] /Length {} >>",
-            data.len()
-        );
-        let pdf = image_cache_pdf(
-            "q 128 0 0 64 0 0 cm /A Do Q",
-            "<< /XObject << /A 5 0 R >> >>",
-            &[(&image, &data), ("<< /FunctionType 4 /Domain [0 1 0 1] /Range [0 1 0 1 0 1] /Length 5 >>", b"{ 0 }")],
-        );
-        let out = render_first_page(pdf);
-        let w = out.width as usize;
-        for y in 0..16 {
-            for x in 0..32 {
-                let (a, b) = (x % 16, (x / 16 + 2 * y) % 16);
-                // The 64 pt image sits at the bottom of the 70 pt page.
-                close(rgb_at(&out.rgba, w, 4 * x + 2, 6 + 4 * y + 2), [(255 - 17 * a) as u8, (17 * b) as u8, 0], (x, y));
-            }
-        }
-
-        // DeviceGray at 2 bits, reversed: 31 pixels (62 bits, so each row ends mid-byte) by 6.
-        let sample = |x: usize, y: usize| (x + y) % 4;
-        let mut data = Vec::new();
-        for y in 0..6 {
-            let mut row = [0u8; 8];
-            for x in 0..31 {
-                row[x / 4] |= (sample(x, y) as u8) << (6 - 2 * (x % 4));
-            }
-            data.extend_from_slice(&row);
-        }
-        let image = format!(
-            "<< /Type /XObject /Subtype /Image /Width 31 /Height 6 /ColorSpace /DeviceGray /BitsPerComponent 2 /Decode [1 0] /Length {} >>",
-            data.len()
-        );
-        let pdf = image_cache_pdf("q 124 0 0 60 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data)]);
-        let out = render_first_page(pdf);
-        let w = out.width as usize;
-        for y in 0..6 {
-            for x in 0..31 {
-                // The 60 pt image at the bottom of the page: rows 10 pt high.
-                close(rgb_at(&out.rgba, w, 4 * x + 2, 10 + 10 * y + 5), [(255 - 85 * sample(x, y)) as u8; 3], (x, y));
-            }
-        }
-
-        // DeviceGray at 8 bits through the range [0.2 0.8] (so not drawn from the raw bytes):
-        // 31 × 12 declared, data for 8 rows and the first 12 pixels of the 9th.
-        let sample = |x: usize, y: usize| (x * 7 + y * 3) % 256;
-        let mut data = Vec::new();
-        for y in 0..9 {
-            let row: Vec<u8> = (0..31).map(|x| sample(x, y) as u8).collect();
-            data.extend_from_slice(if y < 8 { &row[..] } else { &row[..12] });
-        }
-        let image = format!(
-            "<< /Type /XObject /Subtype /Image /Width 31 /Height 12 /ColorSpace /DeviceGray /BitsPerComponent 8 /Decode [0.2 0.8] /Length {} >>",
-            data.len()
-        );
-        let pdf = image_cache_pdf("q 124 0 0 60 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data)]);
-        let out = render_first_page(pdf);
-        let w = out.width as usize;
-        for y in 0..9 {
-            for x in 0..31 {
-                // The rest of the 9th row is decoded zero (black), not sample 0 (0.2 under this range).
-                let gray = if y < 8 || x < 12 { (51.0 + 0.6 * sample(x, y) as f64).round() as u8 } else { 0 };
-                // The rows present keep the declared rows' height: 60 pt / 12.
-                close(rgb_at(&out.rgba, w, 4 * x + 2, 10 + 5 * y + 2), [gray; 3], (x, y));
-            }
-        }
-    }
-
-    /// Patch 28's table converts each entry on its own: a tint transform that gives the wrong
-    /// number of components for a sample value the image never uses leaves the colours of the
-    /// values it does use alone. Converted as one batch, the one component tint 0 gives here
-    /// shifted every later entry, and tint 1's red came out black (PR #1691 review).
-    #[test]
-    fn a_malformed_tint_for_an_unused_sample_keeps_the_used_colours() {
-        // Tint 0 gives one component instead of the three `/Range` declares; any other tint red.
-        let program = b"{ dup 0 eq { pop 0 } { pop 1 0 0 } ifelse }";
-        // 32 × 32 = 1,024 pixels, more than the table's 256 entries, all sample 255 (tint 1).
-        let data = [255u8; 32 * 32];
-        let centre = |space: &str| {
-            let image = format!(
-                "<< /Type /XObject /Subtype /Image /Width 32 /Height 32 /ColorSpace [{space} /DeviceRGB 6 0 R] /BitsPerComponent 8 /Length {} >>",
-                data.len()
-            );
-            let function = format!("<< /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >>", program.len());
-            let pdf = image_cache_pdf("q 130 0 0 70 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data), (&function, program)]);
-            let out = render_first_page(pdf);
-            rgb_at(&out.rgba, out.width as usize, 65, 35)
-        };
-        assert_eq!([centre("/Separation /Spot"), centre("/DeviceN [/Spot]")], [[255, 0, 0]; 2], "Separation, then one-ink DeviceN");
-    }
-
-    /// A Japanese CID font that isn't embedded (Adobe-Japan1, as `HeiseiMin-W3` with
-    /// `UniJIS-UCS2-H` in #260's test file) drew nothing: hayro's substitutes for fonts that
-    /// aren't embedded are Latin-only. With craft-fonts (the build input release builds embed),
-    /// such text now draws in a Japanese face; without it, nothing changes.
-    #[test]
-    fn non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face() {
-        let pdf = |base_font: &str| {
-            let content = "BT /F1 40 Tf 5 15 Td <65E5672C> Tj ET";
-            format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /{base_font} /Encoding /UniJIS-UCS2-H /DescendantFonts [6 0 R] >> endobj
-6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /{base_font} /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 2 >>
-  /FontDescriptor 7 0 R /DW 1000 >> endobj
-7 0 obj << /Type /FontDescriptor /FontName /{base_font} /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            )
-        };
-        for base_font in ["HeiseiMin-W3", "HeiseiKakuGo-W5"] {
-            let mut r = PageRenderer::new(Arc::new(pdf(base_font).into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{base_font}: {:?}", p.error);
-            let inked = p.rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
-            if pdfcraft_fonts::document_japanese_font().is_none() {
-                eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
-                continue;
-            }
-            // 日本 at 40 pt covers a few hundred dark pixels; a blank or missing-glyph run doesn't.
-            assert!(inked > 300, "{base_font}: 日本 is drawn ({inked} dark pixels)");
-        }
-    }
-
-    // #3601: UniJIS-UCS2-HW-H maps code 0x0020 to CID 231 / U+2002. The PDF's
-    // explicit 500-unit width must win over the substitute's ordinary-space width.
-    fn japanese_spacing_pdf(content: &str, widths: &str) -> Vec<u8> {
-        format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 180 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /MS-Mincho /Encoding /UniJIS-UCS2-HW-H /DescendantFonts [6 0 R] >> endobj
-6 0 obj << /Type /Font /Subtype /CIDFontType2 /BaseFont /MS-Mincho /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 4 >>
-  /FontDescriptor 7 0 R /DW 1000 {widths} >> endobj
-7 0 obj << /Type /FontDescriptor /FontName /MS-Mincho /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        )
-        .into_bytes()
-    }
-
-    #[test]
-    fn japanese_substitute_missing_spaces_draw_no_ink() {
-        if pdfcraft_fonts::document_japanese_font().is_none() {
-            eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
-            return;
-        }
-        let out = render_first_page(japanese_spacing_pdf("BT /F1 20 Tf 10 30 Td <002000200020> Tj ET", "/W [231 [500]]"));
-        assert!(out.rgba.as_chunks::<4>().0.iter().all(|pixel| *pixel == [255; 4]), "spacing glyphs must leave the page white");
-    }
-
-    #[test]
-    fn japanese_substitute_spaces_keep_pdf_widths_and_unicode() {
-        if pdfcraft_fonts::document_japanese_font().is_none() {
-            eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
-            return;
-        }
-        for (widths, second_x) in [("/W [231 [500]]", 50), ("", 70)] {
-            let pdf = japanese_spacing_pdf("BT /F1 20 Tf 10 30 Td <65E500200020672C> Tj ET", widths);
-            let out = render_first_page(pdf.clone());
-            // 日 advances 20 pt; each space advances 10 pt (/W) or 20 pt (/DW).
-            // A second independent text matrix pins 本 at the expected original PDF position.
-            let reference = format!("BT /F1 20 Tf 1 0 0 1 10 30 Tm <65E5> Tj 1 0 0 1 {second_x} 30 Tm <672C> Tj ET");
-            let expected = render_first_page(japanese_spacing_pdf(&reference, widths));
-            assert!(expected.rgba.as_chunks::<4>().0.iter().any(|pixel| pixel[0] < 128), "the Japanese control must draw ink");
-            assert!(out.rgba.as_ref() == expected.rgba.as_ref(), "spaces must be blank without changing {widths:?} advances");
-            let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
-            let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
-            assert!(text.error.is_none(), "{:?}", text.error);
-            let glyphs: String = text.text.unwrap().glyphs.iter().map(|glyph| glyph.text.as_str()).collect();
-            assert_eq!(glyphs, "日\u{2002}\u{2002}本", "glyph substitution must not rewrite Unicode");
-        }
-    }
-
-    /// Half-width katakana are common in Japanese documents set in a non-embedded Mincho font
-    /// such as HeiseiMin-W3. The Mincho substitute must have those glyphs: one that lacks them
-    /// (Shippori Mincho) draws them as .notdef.
-    #[test]
-    fn mincho_substitute_covers_half_width_katakana() {
-        use hayro::hayro_interpret::font::FallbackFontQuery;
-        use hayro::hayro_interpret::hayro_cmap::CharacterCollection;
-        use skrifa::MetadataProvider;
-        let query = FontQuery::Fallback(FallbackFontQuery {
-            post_script_name: Some("HeiseiMin-W3".into()),
-            character_collection: Some(CharacterCollection { family: CidFamily::AdobeJapan1, supplement: 2 }),
-            ..FallbackFontQuery::default()
-        });
-        let Some((data, index)) = super::japanese_fallback(&query) else {
-            eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
-            return;
-        };
-        let font = skrifa::FontRef::from_index((*data).as_ref(), index).expect("a craft-fonts face parses");
-        let charmap = font.charmap();
-        let missing: Vec<char> = ('\u{FF61}'..='\u{FF9F}').chain(['日', '本']).filter(|&c| charmap.map(c).is_none()).collect();
-        assert!(missing.is_empty(), "the Mincho substitute lacks {missing:?}");
-    }
-
-    /// 𠮷 (U+20BB7, Adobe-Japan1 CID 13706) in a non-embedded Japanese font: neither craft-fonts
-    /// substitute has it, and hayro drew the substitute's glyph 13706 instead, which is
-    /// unrelated (in BIZ UDPGothic, "Ｑ"). It draws the substitute's .notdef now, while 吉, which
-    /// the substitutes have, still draws.
-    #[test]
-    fn cids_a_substitute_lacks_are_not_drawn_as_other_glyphs() {
-        if pdfcraft_fonts::document_japanese_font().is_none() {
-            eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
-            return;
-        }
-        let render = |base_font: &str, encoding: &str, code: &str| {
-            let content = format!("BT /F1 40 Tf 5 15 Td <{code}> Tj ET");
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 60 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /{base_font} /Encoding /{encoding} /DescendantFonts [6 0 R] >> endobj
-6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /{base_font} /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 6 >>
-  /FontDescriptor 7 0 R /DW 1000 >> endobj
-7 0 obj << /Type /FontDescriptor /FontName /{base_font} /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{base_font} <{code}>: {:?}", p.error);
-            p.rgba
-        };
-        let inked = |rgba: &[u8]| rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
-        for base_font in ["HeiseiMin-W3", "HeiseiKakuGo-W5"] {
-            let notdef = render(base_font, "Identity-H", "0000");
-            let missing = render(base_font, "UniJIS-UTF16-H", "D842DFB7");
-            let covered = render(base_font, "UniJIS-UTF16-H", "5409");
-            assert!(missing == notdef, "{base_font}: 𠮷 draws .notdef ({} dark pixels, .notdef {})", inked(&missing), inked(&notdef));
-            assert!(inked(&covered) > 300 && covered != notdef, "{base_font}: 吉 is drawn ({} dark pixels)", inked(&covered));
-        }
-    }
-
-    #[test]
-    fn japanese_font_names_pick_mincho_or_gothic() {
-        use super::JapaneseFace::{Gothic, Mincho};
-        for (name, serif, bold, face) in [
-            ("HeiseiMin-W3", false, false, Mincho),
-            ("KozMinPro-Regular", false, false, Mincho),
-            ("Ryumin-Light", false, false, Mincho),
-            ("MS-PMincho", false, false, Mincho),
-            ("HiraMinProN-W3", false, false, Mincho),
-            ("HeiseiKakuGo-W5", true, false, Gothic { bold: false }),
-            ("KozGoPro-Bold", true, true, Gothic { bold: true }),
-            ("GothicBBB-Medium", true, false, Gothic { bold: false }),
-            ("MS-Gothic", false, false, Gothic { bold: false }),
-            ("HiraKakuProN-W6", false, true, Gothic { bold: true }),
-            ("Unknown-Japanese", true, false, Mincho),
-            ("Unknown-Japanese", false, false, Gothic { bold: false }),
-        ] {
-            assert_eq!(super::japanese_face(name, serif, bold), face, "{name}");
-        }
-    }
-
-    /// Adobe-Japan1 maps the JIS X 0208 forms of the kanji that JIS X 0213:2004 redrew (噂, 逢,
-    /// 溢, …) to a variation sequence: CID 1247 is 噂 U+E0100. A non-embedded Japanese font drew
-    /// such a CID as an unrelated glyph, since the substitute has no glyph for a sequence. It
-    /// draws the substitute's glyph for that form now, and its 噂 for a form it doesn't have.
-    #[test]
-    fn variation_sequences_draw_their_kanji_in_a_substitute() {
-        if pdfcraft_fonts::document_japanese_font().is_none() {
-            eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
-            return;
-        }
-        let render = |base_font: &str, encoding: &str, to_unicode: &str, code: &str| {
-            let content = format!("BT /F1 40 Tf 5 15 Td <{code}> Tj ET");
-            let cmap = format!(
-                "/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CMapName /Test def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespacerange 1 beginbfchar <0001> <{to_unicode}> endbfchar endcmap CMapName currentdict /CMap defineresource pop end end"
-            );
-            // Code <0001> through `/ToUnicode` when the encoding is Identity-H; otherwise no
-            // `/ToUnicode`, so the CID goes through Adobe-Japan1-UCS2.
-            let to_unicode = if encoding == "Identity-H" { "/ToUnicode 8 0 R" } else { "" };
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 60 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /{base_font} /Encoding /{encoding} /DescendantFonts [6 0 R] {to_unicode} >> endobj
-6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /{base_font} /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 6 >>
-  /FontDescriptor 7 0 R /DW 1000 >> endobj
-7 0 obj << /Type /FontDescriptor /FontName /{base_font} /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
-8 0 obj << /Length {} >> stream
-{cmap}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len(),
-                cmap.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{base_font} <{code}>: {:?}", p.error);
-            p.rgba
-        };
-        let inked = |rgba: &[u8]| rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
-        for base_font in ["HeiseiMin-W3", "HeiseiKakuGo-W5"] {
-            let collection = render(base_font, "UniJIS-UCS2-H", "", "5642");
-            let form = render(base_font, "Identity-H", "5642DB40DD00", "0001");
-            let character = render(base_font, "Identity-H", "5642", "0001");
-            let unknown_form = render(base_font, "Identity-H", "5642DB40DD05", "0001");
-            assert!(inked(&form) > 300, "{base_font}: 噂 U+E0100 is drawn ({} dark pixels)", inked(&form));
-            assert!(collection == form, "{base_font}: CID 1247 draws 噂 U+E0100");
-            assert!(form != character, "{base_font}: the form differs from the face's default 噂");
-            assert!(unknown_form == character, "{base_font}: a form the face lacks draws its 噂");
-        }
-    }
-
-    /// InDesign fades are luminosity soft masks whose group is one extended axial `sh`: a
-    /// gradient over the whole page. hayro 0.7 sampled each one pixel by pixel through the
-    /// shading function, so a report page with 40 of them took 15 s at 144 dpi. Vendored hayro
-    /// patch (backport of hayro 0.8): axial and radial shadings that a native gradient can
-    /// represent exactly are drawn as one, with stops placed at stitching-function bounds.
-    #[test]
-    fn axial_and_radial_shadings_draw_as_native_gradients() {
-        use hayro::hayro_interpret::font::Glyph;
-        use hayro::hayro_interpret::hayro_syntax::Pdf;
-        use hayro::hayro_interpret::pattern::Pattern;
-        use hayro::hayro_interpret::{
-            BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, Paint, PathDrawMode, SoftMask, TransformExt, interpret_page,
-        };
-        use kurbo::{Affine, BezPath, Rect, Shape};
-
-        /// For every shading painted, the offsets of its native gradient stops, or `None` when
-        /// it has to be sampled pixel by pixel.
-        #[derive(Default)]
-        struct Gradients(Vec<Option<Vec<f32>>>);
-        impl<'a> Device<'a> for Gradients {
-            fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
-            fn set_blend_mode(&mut self, _: BlendMode) {}
-            fn draw_path(&mut self, path: &BezPath, transform: Affine, paint: &Paint<'a>, _: &PathDrawMode) {
-                if let Paint::Pattern(pattern) = paint
-                    && let Pattern::Shading(s) = pattern.as_ref()
-                {
-                    let bbox = (transform * path.clone()).bounding_box();
-                    let native = s.encode().as_svg_gradient(bbox, 0.01);
-                    self.0.push(native.map(|g| g.stops.iter().map(|stop| stop.offset).collect()));
-                }
-            }
-            fn push_clip_path(&mut self, _: &ClipPath) {}
-            fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
-            fn draw_glyph(&mut self, _: &Glyph<'a>, _: Affine, _: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {}
-            fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
-            fn pop_clip_path(&mut self) {}
-            fn pop_transparency_group(&mut self) {}
-        }
-
-        // A 40 × 20 pt page painting `/Sh0 sh`, with optional extra objects from 6 0 obj on.
-        let pdf = |shading: &str, extra: &str| {
-            let content = "/Sh0 sh";
-            format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 20] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj {shading} endobj
-{extra}trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            )
-            .into_bytes()
-        };
-        let gradients = |bytes: &[u8]| {
-            let parsed = Pdf::new(Arc::new(bytes.to_vec())).expect("parses");
-            let page = &parsed.pages()[0];
-            let cache = InterpreterCache::new();
-            let initial = page.initial_transform(true).to_kurbo();
-            let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, 40.0, 20.0), &cache, page.xref(), InterpreterSettings::default());
-            let mut device = Gradients::default();
-            interpret_page(page, &mut ctx, &mut device);
-            device.0
-        };
-        let render = |bytes: Vec<u8>| {
-            let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
-            assert!(p.error.is_none(), "{:?}", p.error);
-            p
-        };
-        let grey = |p: &RenderedPage, x: u32| i32::from(p.rgba[((10 * p.width + x) * 4) as usize]);
-        let ramp = "/FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1";
-        // A function-based shading (always sampled) that draws the same picture is the reference;
-        // its /Range clamps to 0..1.
-        let sampled = |code: &str| {
-            let extra =
-                format!("6 0 obj << /FunctionType 4 /Domain [0 40 0 20] /Range [0 1] /Length {} >> stream\n{code}\nendstream endobj\n", code.len());
-            pdf("<< /ShadingType 1 /ColorSpace /DeviceGray /Domain [0 40 0 20] /Function 6 0 R >>", &extra)
-        };
-
-        // A steep extended axial ramp, x 10 to 14: one stop at each end, drawn at pixel centres
-        // (a half-pixel shift would move each pixel 32 levels) and padded on both sides.
-        let axial = pdf(&format!("<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [10 0 14 0] /Extend [true true] /Function << {ramp} >> >>"), "");
-        assert_eq!(gradients(&axial), vec![Some(vec![0.0, 1.0])], "an extended axial shading is a native gradient");
-        let native = render(axial);
-        let reference = render(sampled("{ pop 10 sub 4 div }"));
-        for (x, expected) in [(2, 0), (9, 0), (10, 32), (11, 96), (12, 159), (13, 223), (14, 255), (30, 255)] {
-            assert!((grey(&native, x) - expected).abs() <= 4, "axial, x {x}: {} instead of {expected}", grey(&native, x));
-            assert!(
-                (grey(&native, x) - grey(&reference, x)).abs() <= 4,
-                "axial, x {x}: native {} vs sampled {}",
-                grey(&native, x),
-                grey(&reference, x)
-            );
-        }
-
-        // An extended radial shading matches the sampled one everywhere.
-        let radial =
-            pdf(&format!("<< /ShadingType 3 /ColorSpace /DeviceGray /Coords [20 10 0 20 10 8] /Extend [true true] /Function << {ramp} >> >>"), "");
-        assert!(matches!(gradients(&radial).as_slice(), [Some(_)]), "an extended radial shading is a native gradient");
-        let native = render(radial);
-        let reference = render(sampled("{ 10 sub dup mul exch 20 sub dup mul add sqrt 8 div }"));
-        let worst = native.rgba.iter().zip(reference.rgba.iter()).map(|(a, b)| a.abs_diff(*b)).max();
-        assert!(worst.is_some_and(|d| d <= 4), "radial: native and sampled differ by {worst:?} levels");
-
-        // A stitched function peaking at a quarter of the way gets a stop exactly at its bound.
-        let stitched = pdf(
-            "<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Extend [true true] /Function << /FunctionType 3 /Domain [0 1] /Bounds [0.25] /Encode [0 1 0 1] /Functions [<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>] >> >>",
-            "",
-        );
-        let stops = gradients(&stitched);
-        assert!(matches!(stops.as_slice(), [Some(offsets)] if offsets.contains(&0.25)), "a stop at the stitching bound: {stops:?}");
-        let native = render(stitched);
-        for (x, expected) in [(0, 13), (9, 242), (10, 250), (39, 4)] {
-            assert!((grey(&native, x) - expected).abs() <= 4, "stitched, x {x}: {} instead of {expected}", grey(&native, x));
-        }
-
-        // Without /Extend the area beyond the axis keeps the background, which a native gradient
-        // can't leave out: still sampled. Function-based shadings are always sampled.
-        let unextended = pdf(&format!("<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [10 0 14 0] /Function << {ramp} >> >>"), "");
-        assert_eq!(gradients(&unextended), vec![None], "an axial shading without /Extend that covers more than its axis");
-        assert_eq!(gradients(&sampled("{ pop pop 0.5 }")), vec![None], "a function-based shading");
-
-        // The report's case: a luminosity soft mask whose group is one extended axial `sh` over
-        // the page. Red through a mask fading in from x 0 to 40 over white: 255, 255 − t, 255 − t.
-        let content = "/M gs 1 0 0 rg 0 0 40 20 re f";
-        let masked = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 20] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /ExtGState /SMask << /Type /Mask /S /Luminosity /G 6 0 R >> >> endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [-32768 -32768 32767 32767] /Group << /S /Transparency /CS /DeviceGray >> /Resources << /Shading << /Sh0 << /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Extend [true true] /Function << {ramp} >> >> >> >> /Length 7 >> stream
-/Sh0 sh
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        );
-        let p = render(masked.into_bytes());
-        for x in [2u32, 20, 37] {
-            let px = &p.rgba[((10 * p.width + x) * 4) as usize..][..4];
-            let faded = 255 - (255.0 * (f64::from(x) + 0.5) / 40.0).round() as i32;
-            assert!(px[0] == 255 && (i32::from(px[1]) - faded).abs() <= 4 && px[1] == px[2], "masked, x {x}: {px:?}, green and blue {faded}");
-        }
-    }
-
-    /// An alpha soft mask whose transparency group has no /CS (as Chrome writes gradient text)
-    /// must still mask. Regression test for the vendored hayro-interpret patch.
-    #[test]
-    fn soft_mask_without_group_colour_space_is_applied() {
-        let pdf = b"%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> >> >> endobj
-4 0 obj << /Length 31 >> stream
-/M gs 1 0 0 rg 0 0 100 100 re f
-endstream endobj
-5 0 obj << /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 6 0 R >> >> endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >> stream
-0 g 0 0 50 100 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
-        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        assert_eq!(px(25, 50), vec![255, 0, 0, 255], "inside the mask");
-        assert_eq!(px(75, 50), vec![255, 255, 255, 255], "outside the mask");
-    }
-
-    /// Issue #2128: PowerPoint fades a gradient fill (an axial shading pattern) through a soft
-    /// mask. vello_cpu 0.0.8 copies an opaque gradient straight over fully covered tiles,
-    /// skipping the mask, so the fade came out solid. Images get around that by declaring
-    /// transparency while a mask or blend mode is set; native gradients can't, so they are
-    /// sampled as a texture then.
-    #[test]
-    fn soft_mask_applies_to_a_shading_pattern_fill() {
-        let content = "/Pattern cs /P0 scn /M gs 0 0 100 100 re f";
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> /Pattern << /P0 7 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 6 0 R >> >> endobj
-6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /CS /DeviceRGB >> /Length 20 >> stream
-0 g 0 0 50 100 re f
-endstream endobj
-7 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Extend [true true] /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [1 0 0] /N 1 >> >> >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        assert_eq!(px(25, 50), vec![255, 0, 0, 255], "inside the mask");
-        assert_eq!(px(75, 50), vec![255, 255, 255, 255], "outside the mask");
-    }
-
-    /// Issue #3176: `CA` / `ca` belong to the graphics state at paint time, so a `gs` after
-    /// `SCN` / `scn` still fades a shading pattern, and a stroke takes the stroke alpha. The
-    /// pattern took the fill alpha current at `scn`/`SCN`, so both shapes came out opaque.
-    #[test]
-    fn shading_pattern_uses_the_alpha_current_at_paint_time() {
-        let content = "/Pattern CS /P0 SCN /S1 gs 10 w 0 75 m 100 75 l S /Pattern cs /P0 scn /F1 gs 0 0 100 50 re f";
-        let pdf = format!(
-            "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R
-  /Resources << /ExtGState << /S1 << /CA 0.25 >> /F1 << /ca 0.25 >> >> /Pattern << /P0 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Extend [true true]
-  /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [1 0 0] /N 1 >> >> >> endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-            content.len()
-        );
-        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-        assert!(p.error.is_none(), "{:?}", p.error);
-        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        // Red at 25% over white is about (255, 191, 191); opaque red would be (255, 0, 0).
-        for (what, x, y) in [("the stroke under /CA 0.25", 50, 25), ("the fill under /ca 0.25", 50, 75)] {
-            let c = px(x, y);
-            assert!(c[0] >= 250 && (185..=197).contains(&c[1]) && (185..=197).contains(&c[2]), "{what}: {c:?}");
-        }
-    }
-
-    /// ISO 32000-2 §8.5.4: `W` / `W*` clip with the current path once whichever path-painting
-    /// operator ends it has painted it, `S`, `f` or `B` as much as `n`. The vendored interpreter
-    /// applied the clip only on `n`: after `re W* S` everything later painted outside the clip,
-    /// and the forgotten clip stayed pending, so a later `re n` (even after `Q`) clipped
-    /// content that should show. MuPDF, Poppler and PDFium clip in every case below.
-    #[test]
-    fn clipping_path_applies_after_any_painting_operator() {
-        let render = |content: &str| {
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{content}: {:?}", p.error);
-            p
-        };
-        let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
-        let red = vec![255, 0, 0, 255];
-        // The clip is the square x 20..60, y 20..60 (device rows 40..80); then the page is filled red.
-        for op in ["n", "S", "s", "f", "F", "f*", "B", "B*", "b", "b*"] {
-            for clip in ["W", "W*"] {
-                let p = render(&format!("q 0 0 1 RG 4 w 0.8 g 20 20 40 40 re {clip} {op} 1 0 0 rg 0 0 100 100 re f Q"));
-                assert_eq!(px(&p, 40, 60), red, "{clip} {op}: inside the clip");
-                assert_ne!(px(&p, 5, 5), red, "{clip} {op}: outside the clip");
-                assert_ne!(px(&p, 95, 95), red, "{clip} {op}: outside the clip");
-                // The operator that ends the path paints under the old clip: the outer half of
-                // the 4 pt stroke (x 18..20) shows outside the new one.
-                let stroked = !["n", "f", "F", "f*"].contains(&op);
-                let edge = if stroked { vec![0, 0, 255, 255] } else { vec![255, 255, 255, 255] };
-                assert_eq!(px(&p, 18, 60), edge, "{clip} {op}: just outside the clip");
-            }
-        }
-        // A clip is used once: it doesn't linger for a later `n`, inside or outside `q`/`Q`.
-        for content in [
-            "q 0 0 1 RG 70 70 10 10 re W S Q q 10 10 20 20 re n 1 0 0 rg 0 0 100 100 re f Q",
-            "q 0 0 1 RG 0 0 100 100 re W S 10 10 20 20 re n 1 0 0 rg 0 0 100 100 re f Q",
-        ] {
-            let p = render(content);
-            assert!([(5, 5), (50, 50), (95, 95)].iter().all(|(x, y)| px(&p, *x, *y) == red), "{content}: no stray clip");
-        }
-    }
-
-    /// ISO 32000-1 §9.3.6: only text rendering mode 3 has any effect on a Type 3 font (vendored
-    /// hayro-interpret patch in `show_glyph`). Print-stream PDFs set `2 Tr` for Type 3 bitmap
-    /// fonts, and the glyph procedure ran twice (fill, then stroke), so its anti-aliased edges
-    /// doubled up and the text looked bold; under `1 Tr` an uncoloured glyph took the stroking
-    /// colour, and under `7 Tr` it disappeared. Both glyph kinds have edges between pixels.
-    #[test]
-    fn text_rendering_modes_other_than_invisible_draw_type3_glyphs_as_filled() {
-        let render = |glyph: &str, mode: u8| {
-            let content = format!("BT 1 0 0 RG 6 w 0 g /F1 20 Tf {mode} Tr 10.3 10.3 Td (A) Tj ET");
-            let pdf = format!(
-                "%PDF-1.7
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
-4 0 obj << /Length {} >> stream
-{content}
-endstream endobj
-5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 1 1] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [1]
-  /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> >> endobj
-6 0 obj << /Length {} >> stream
-{glyph}
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF",
-                content.len(),
-                glyph.len()
-            );
-            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{glyph} {mode} Tr: {:?}", p.error);
-            p.rgba
-        };
-        for glyph in ["1 0 0 0 1 1 d1 0.12 0.12 0.71 0.71 re f", "1 0 d0 0.12 0.12 0.71 0.71 re f"] {
-            let filled = render(glyph, 0);
-            assert!(filled.as_chunks::<4>().0.iter().any(|p| p[0] < 128), "{glyph}: the glyph paints");
-            for mode in [1, 2, 4, 5, 6, 7] {
-                assert!(render(glyph, mode) == filled, "{glyph}: {mode} Tr draws as 0 Tr");
-            }
-            assert!(render(glyph, 3).as_chunks::<4>().0.iter().all(|p| p[..3] == [255, 255, 255]), "{glyph}: 3 Tr hides the glyph");
-        }
-    }
-
-    // #1201: /DefaultGray, /DefaultRGB and /DefaultCMYK (vendored hayro-interpret patch 38).
-    mod default_colour_spaces;
-
-    // #4260: DeviceN colours with many inks, and tint transforms that cannot be evaluated
-    // (vendored hayro-syntax patch 28, hayro-interpret patch 55).
-    mod devicen_inks;
-
-    /// #3109 / #3116: clipping-only text (`7 Tr`) installs a clip for subsequent painting
-    /// but draws no pixels itself.
-    #[test]
-    fn test_clip_only_text_raster_preserves_clipping_without_painting() {
-        let pdf_bytes = |content: &str| {
-            Arc::new(
-                format!(
-                    "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
-                    content.len()
-                )
-                .into_bytes(),
-            )
-        };
-        let render = |content: &str| {
-            let mut r = PageRenderer::new(pdf_bytes(content), RenderConfig::default());
-            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
-            assert!(p.error.is_none(), "{content}: {:?}", p.error);
-            p
-        };
-        let white = [255, 255, 255, 255];
-
-        // The text alone paints nothing.
-        let p = render("BT /F1 40 Tf 7 Tr 20 60 Td (Hi) Tj ET");
-        assert!(p.rgba.as_chunks::<4>().0.iter().all(|c| *c == white), "7 Tr alone leaves the page blank");
-
-        // A fill afterwards shows only through the text-shaped clip.
-        let p = render("q BT /F1 40 Tf 7 Tr 20 60 Td (Hi) Tj ET 0 0 1 rg 0 0 200 100 re f Q");
-        let pixels = p.rgba.as_chunks::<4>().0;
-        assert!(pixels.contains(&[0, 0, 255, 255]), "fill shows through the 7 Tr clip");
-        assert!(pixels.contains(&white), "the clip is text-shaped, not the whole page");
-    }
-}
+mod tests;
diff --git a/crates/render/src/raster/pool.rs b/crates/render/src/raster/pool.rs
new file mode 100644
index 0000000000..81447263d8
--- /dev/null
+++ b/crates/render/src/raster/pool.rs
@@ -0,0 +1,755 @@
+use super::*;
+
+/// How long one page may render before the pool gives up on it (the watchdog).
+pub const STUCK_AFTER: std::time::Duration = std::time::Duration::from_secs(20);
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum BusyStage {
+    /// Parsing the document, shared or private. Not timed: a huge or damaged file is slow to
+    /// open, not stuck, and giving up on it would fail every page of the pool. (Parsing has
+    /// its own limits.) Rendering is timed from the moment parsing ends.
+    Parsing,
+    SharedRender,
+    Private,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Clone)]
+pub(super) struct Busy {
+    pub(super) request: RenderRequest,
+    since: std::time::Instant,
+    stage: BusyStage,
+    pub(super) cancelled: Arc<AtomicBool>,
+    valid: Arc<AtomicBool>,
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+#[derive(Clone)]
+pub(super) struct BusyPublishGate {
+    pub(super) request: RenderRequest,
+    pub(super) entered: std::sync::mpsc::Sender<()>,
+    pub(super) release: Arc<Mutex<Receiver<()>>>,
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+#[derive(Clone)]
+pub(super) struct RenderGate {
+    pub(super) page: usize,
+    pub(super) shared_generation: bool,
+    pub(super) claimed: Arc<std::sync::atomic::AtomicBool>,
+    pub(super) entered: Arc<std::sync::Barrier>,
+    pub(super) release: Arc<std::sync::Barrier>,
+    pub(super) finished: Arc<std::sync::Barrier>,
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+#[derive(Clone)]
+pub(super) struct ParseGate {
+    pub(super) entered: Arc<std::sync::Barrier>,
+    pub(super) release: Arc<std::sync::Barrier>,
+}
+
+/// State shared by the pool and its workers.
+#[derive(Default)]
+pub(super) struct Shared {
+    /// Desired requests, active jobs and bounded completed results share one deduplication key.
+    pub(super) queue: Arc<WorkQueue>,
+    /// Per worker id: the request it is rendering and since when.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(super) busy: Mutex<Vec<Option<Busy>>>,
+    /// Exact requests the watchdog gave up on: answered with an error at once, so a pathological
+    /// request cannot trap every worker in turn while other scales, tiles, or generations remain usable.
+    pub(super) stuck: Mutex<std::collections::HashSet<RequestFailureKey>>,
+    stats: AtomicRenderStats,
+    /// Per worker id: set to stop that worker's render at its next content operator once nobody
+    /// can receive its answer (the pool was dropped, or the watchdog gave up on the render).
+    /// Lock `busy` first when holding both.
+    pub(super) stop: Mutex<Vec<Arc<std::sync::atomic::AtomicBool>>>,
+    /// Test hook: hold one worker at the render boundary until the test releases it.
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) render_gates: Mutex<Vec<RenderGate>>,
+    /// Test hook: hold parser initialization until the test releases it.
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) parse_gate: Mutex<Option<ParseGate>>,
+    /// Test hook: make rendering this page take this long (cancellable).
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) slow_page: Mutex<Option<(usize, std::time::Duration)>>,
+    /// Test hook: make parser initialization take this long.
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) slow_parse: Mutex<Option<std::time::Duration>>,
+    /// Test hook: count parser initializations, including failed parses.
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) parses: std::sync::atomic::AtomicUsize,
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(super) parser: PoolParser,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) panic_page: Mutex<Option<usize>>,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) render_started: std::sync::atomic::AtomicUsize,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) busy_publish_gate: Mutex<Option<BusyPublishGate>>,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    pub(super) parser_stage_entries: Mutex<Vec<RenderRequest>>,
+    #[cfg(all(test, not(target_arch = "wasm32")))]
+    shared_render_delay: Mutex<Option<std::time::Duration>>,
+}
+
+pub(super) fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
+    m.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) fn same_request(a: RenderRequest, b: RenderRequest) -> bool {
+    // `preview` is excluded on purpose: it names the same work for cancellation, only the
+    // detail level of the result differs.
+    a.page == b.page && a.kind == b.kind && a.tile == b.tile && a.scale.to_bits() == b.scale.to_bits() && a.tag == b.tag
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Shared {
+    fn cancel_in_flight(&self, obsolete: &[RenderRequest]) {
+        let busy = lock(&self.busy);
+        for busy in busy.iter().flatten() {
+            if obsolete.iter().copied().any(|request| same_request(request, busy.request)) {
+                busy.cancelled.store(true, Ordering::Release);
+                busy.valid.store(false, Ordering::Release);
+            }
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn set_busy_stage(shared: &Shared, id: usize, stage: BusyStage) -> bool {
+    let mut slots = lock(&shared.busy);
+    let Some(Some(busy)) = slots.get_mut(id) else { return false };
+    if busy.stage != stage {
+        busy.stage = stage;
+        busy.since = std::time::Instant::now();
+    }
+    true
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Default)]
+pub(super) enum ParserState {
+    #[default]
+    Empty,
+    Loading,
+    Ready(Option<Arc<Pdf>>),
+    /// A page failed after initialization: isolate subsequent work per worker.
+    Private,
+    /// Retired before it became ready (defensive: parsing is not timed, and only a shared
+    /// render retires the parser). Retrying it on every worker cannot help.
+    Failed,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) struct PoolParser {
+    pub(super) state: Mutex<ParserState>,
+    ready: std::sync::Condvar,
+    pub(super) valid: Arc<AtomicBool>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Default for PoolParser {
+    fn default() -> Self {
+        Self { state: Mutex::default(), ready: std::sync::Condvar::new(), valid: Arc::new(AtomicBool::new(true)) }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl PoolParser {
+    /// `None` means use a private parser. `Some(None)` is a terminal parse failure.
+    pub(super) fn acquire(&self, load: impl FnOnce() -> Option<Pdf>, cancelled: impl Fn() -> bool) -> Option<Option<Arc<Pdf>>> {
+        let mut state = lock(&self.state);
+        loop {
+            if cancelled() {
+                return Some(None);
+            }
+            match &*state {
+                ParserState::Ready(pdf) => return Some(pdf.clone()),
+                ParserState::Private => return None,
+                ParserState::Failed => return Some(None),
+                ParserState::Loading => {
+                    // Drop never joins a parser. A waiting worker must still notice
+                    // its pool's disconnected wake channel while another thread is
+                    // stuck in initialization and cannot signal this condition.
+                    state = self.ready.wait_timeout(state, std::time::Duration::from_millis(50)).unwrap_or_else(std::sync::PoisonError::into_inner).0;
+                }
+                ParserState::Empty => {
+                    *state = ParserState::Loading;
+                    break;
+                }
+            }
+        }
+        drop(state);
+        // Parsing cannot hold the lifecycle mutex: watchdog/drop must remain nonblocking.
+        // Even a panic in initialization publishes one terminal failure and wakes waiters.
+        let pdf = catch_unwind(AssertUnwindSafe(load)).ok().flatten().map(Arc::new);
+        let mut state = lock(&self.state);
+        let result = match &*state {
+            ParserState::Loading => {
+                *state = ParserState::Ready(pdf.clone());
+                Some(pdf)
+            }
+            ParserState::Private => None,
+            _ => Some(None), // the watchdog retired initialization while it ran
+        };
+        self.ready.notify_all();
+        result
+    }
+
+    pub(super) fn abandon(&self) {
+        self.retire();
+    }
+
+    /// After a shared render failed or timed out: later work parses privately, per worker
+    /// (for the rest of the pool's life: the old one-parser-per-worker memory use). A parser
+    /// that never became ready stays failed.
+    fn retire(&self) {
+        let mut state = lock(&self.state);
+        self.valid.store(false, Ordering::Release);
+        *state = match &*state {
+            ParserState::Loading | ParserState::Empty | ParserState::Failed => ParserState::Failed,
+            _ => ParserState::Private,
+        };
+        self.ready.notify_all();
+    }
+}
+
+/// Renders pages on worker threads, most urgent request first.
+///
+/// **Watchdog:** a render running longer than `stuck_after` (default [`STUCK_AFTER`]) is given
+/// up on. A timed-out *shared* render retires that parser and retries still-desired work
+/// privately: the page may only have been waiting behind another page's decode. A private
+/// timeout is reported as an error for that page and the page is not attempted again. Threads
+/// cannot be killed: the stuck worker is told to stop at its next content operator, exits when
+/// its render returns, and its late result is dropped; a single long operator, such as decoding
+/// a huge image, still runs to its end. At most `threads` replacements are started per pool, so
+/// a document full of pathological pages cannot spawn threads without bound. If every worker is
+/// retired after that budget is spent, pending and future requests fail explicitly instead of
+/// waiting forever.
+pub struct RenderPool {
+    pub(super) shared: Arc<Shared>,
+    wake: Mutex<Vec<SyncSender<()>>>,
+    pub(super) results: ResultReceiver,
+    pub(super) results_tx: Arc<WorkQueue>,
+    bytes: Arc<Vec<u8>>,
+    pub(super) config: RenderConfig,
+    pub(super) _workers: Mutex<Vec<JoinHandle<()>>>,
+    stuck_after: std::time::Duration,
+    replacements_left: Mutex<usize>,
+    pub(super) retired_workers: Mutex<usize>,
+    /// Used when threads are unavailable (wasm32 without atomics, or spawn failure): requests are
+    /// rendered on the calling thread inside `try_recv`, one per call.
+    inline: Option<std::cell::RefCell<PageRenderer>>,
+}
+
+impl RenderPool {
+    pub fn new(bytes: Arc<Vec<u8>>, threads: usize, config: RenderConfig) -> Self {
+        Self::with_mode(bytes, threads, config, false)
+    }
+
+    fn with_mode(bytes: Arc<Vec<u8>>, threads: usize, config: RenderConfig, inline: bool) -> Self {
+        let threads = if inline || cfg!(target_arch = "wasm32") { 0 } else { threads.max(1) };
+        let shared = Arc::new(Shared::default());
+        let results_tx = shared.queue.clone();
+        let results = ResultReceiver(shared.queue.clone());
+        let mut pool = Self {
+            shared,
+            wake: Mutex::new(Vec::new()),
+            results,
+            results_tx,
+            bytes: bytes.clone(),
+            config: config.clone(),
+            _workers: Mutex::new(Vec::new()),
+            stuck_after: STUCK_AFTER,
+            replacements_left: Mutex::new(threads),
+            retired_workers: Mutex::new(0),
+            inline: None,
+        };
+        for _ in 0..threads {
+            pool.spawn_worker();
+        }
+        if lock(&pool._workers).is_empty() {
+            pool.inline = Some(std::cell::RefCell::new(PageRenderer::new(bytes, config)));
+        }
+        pool
+    }
+
+    /// Start one worker thread; returns whether it started.
+    fn spawn_worker(&self) -> bool {
+        #[cfg(target_arch = "wasm32")]
+        return false;
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let (id, stop) = {
+                let mut busy = lock(&self.shared.busy);
+                busy.push(None);
+                let stop = Arc::new(std::sync::atomic::AtomicBool::new(false));
+                lock(&self.shared.stop).push(stop.clone());
+                (busy.len() - 1, stop)
+            };
+            let (wtx, wrx) = sync_channel::<()>(1);
+            let (shared, out, bytes, config) = (self.shared.clone(), self.results_tx.clone(), self.bytes.clone(), self.config.clone());
+            match std::thread::Builder::new().name(format!("pdfcraft-render-{id}")).spawn(move || worker(id, bytes, config, shared, wrx, out, stop)) {
+                Ok(h) => {
+                    lock(&self.wake).push(wtx);
+                    lock(&self._workers).push(h);
+                    true
+                }
+                Err(e) => {
+                    log::error!("could not spawn render worker {id}: {e}");
+                    false
+                }
+            }
+        }
+    }
+
+    /// A pool without worker threads: renders inside `try_recv` (the web path; also used in tests).
+    pub fn new_inline(bytes: Arc<Vec<u8>>, config: RenderConfig) -> Self {
+        Self::with_mode(bytes, 0, config, true)
+    }
+
+    /// `true` when rendering happens on the caller's thread (no worker threads available).
+    pub fn is_inline(&self) -> bool {
+        self.inline.is_some()
+    }
+
+    /// Snapshot the work counters collected by this pool.
+    pub fn stats(&self) -> RenderStats {
+        self.inline.as_ref().map_or_else(|| self.shared.stats.snapshot(), |renderer| renderer.borrow().stats())
+    }
+
+    /// Change the watchdog limit (tests and benchmarks).
+    pub fn set_stuck_after(&mut self, limit: std::time::Duration) {
+        self.stuck_after = limit;
+    }
+
+    /// Replace desired work (most urgent first), retaining matching in-flight/completed jobs.
+    /// Obsolete results are released before they reach the caller, and active obsolete renders
+    /// are asked to stop at their next cancellation point.
+    ///
+    /// The contract: a result is delivered only while its request is in the latest queue.
+    /// A caller still waiting for a page (or text, or a thumbnail) must keep listing it in
+    /// every call, or the finished result is dropped to save memory.
+    pub fn set_queue(&self, requests: Vec<RenderRequest>) {
+        #[cfg(not(target_arch = "wasm32"))]
+        let obsolete = self.shared.queue.replace(requests);
+        #[cfg(target_arch = "wasm32")]
+        let _ = self.shared.queue.replace(requests);
+        #[cfg(not(target_arch = "wasm32"))]
+        self.shared.cancel_in_flight(&obsolete);
+        self.wake_workers();
+    }
+
+    fn wake_workers(&self) {
+        for w in lock(&self.wake).iter() {
+            // One pending wakeup is sufficient; UI polling must not grow wake channels.
+            let _ = w.try_send(());
+        }
+    }
+
+    pub fn try_recv(&self) -> Option<RenderedPage> {
+        if let Some(r) = &self.inline {
+            let req = self.shared.queue.pop()?;
+            let page = r.borrow_mut().render(req);
+            self.shared.queue.finish_inline(req);
+            return Some(page);
+        }
+        self.watchdog();
+        let page = self.results.try_recv().ok();
+        // Consuming a result releases byte/count capacity. An invalid parser generation
+        // can also requeue work without returning a page, so wake in both cases.
+        self.wake_workers();
+        page.or_else(|| {
+            let workers = lock(&self._workers).len();
+            if workers == 0 || *lock(&self.retired_workers) < workers {
+                return None;
+            }
+            // Count successful handles, not reserved busy slots: thread spawning
+            // can fail. No worker remains able to service these pending requests.
+            let request = self.shared.queue.pop()?;
+            self.shared.queue.finish_inline(request);
+            Some(RenderedPage {
+                request,
+                width: 0,
+                height: 0,
+                rgba: Pixels::default(),
+                error: Some("all render workers exceeded their time limits; close and reopen the document to try again".into()),
+                text: None,
+                warnings: Vec::new(),
+                millis: 0,
+            })
+        })
+    }
+
+    /// Give up on renders that exceeded `stuck_after` (see the type docs).
+    pub(super) fn watchdog(&self) {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let mut gave_up = Vec::new();
+            {
+                let mut busy = lock(&self.shared.busy);
+                // Lock order: `busy`, then `stop`.
+                let stop = lock(&self.shared.stop);
+                for (id, slot) in busy.iter_mut().enumerate() {
+                    if let Some(busy) = slot.clone()
+                        && busy.stage != BusyStage::Parsing
+                        && busy.since.elapsed() > self.stuck_after
+                    {
+                        *slot = None; // the worker sees this and exits when it returns
+                        // Told to stop at its next operator; its replacement retries the page.
+                        busy.cancelled.store(true, Ordering::Release);
+                        busy.valid.store(false, Ordering::Release);
+                        if let Some(s) = stop.get(id) {
+                            s.store(true, std::sync::atomic::Ordering::Relaxed);
+                        }
+                        gave_up.push(busy);
+                    }
+                }
+            }
+            {
+                let mut retired = lock(&self.retired_workers);
+                *retired = retired.saturating_add(gave_up.len());
+            }
+            for busy in gave_up {
+                let req = busy.request;
+                self.shared.parser.retire();
+                if busy.stage == BusyStage::SharedRender {
+                    // The shared cold-decode gate can make a healthy page wait
+                    // behind another page. Only its private retry can attribute
+                    // the timeout to this page; do not blacklist it here.
+                    self.shared.queue.retry(req);
+                } else {
+                    lock(&self.shared.stuck).insert(req.into());
+                    let what = if req.kind == RequestKind::Text { "text extraction for page" } else { "page" };
+                    let error = format!(
+                        "{what} {} took longer than {:.0} s and was skipped; the page may be damaged or extremely complex",
+                        req.page + 1,
+                        self.stuck_after.as_secs_f32().max(1.0)
+                    );
+                    self.shared.queue.abandon(RenderedPage {
+                        request: req,
+                        width: 0,
+                        height: 0,
+                        rgba: Pixels::default(),
+                        error: Some(error),
+                        text: None,
+                        warnings: Vec::new(),
+                        millis: 0,
+                    });
+                }
+                let mut left = lock(&self.replacements_left);
+                if *left > 0 && self.spawn_worker() {
+                    *left -= 1;
+                }
+            }
+        }
+    }
+}
+
+/// A pool's threads after [`RenderPool::retire`]. Idle ones exit at once; one still rendering is
+/// told to stop at its next drawing operator and exits when its render returns, which a single
+/// long operator (such as decoding a huge image) can delay.
+pub struct Retiring(pub(crate) Vec<JoinHandle<()>>);
+
+impl Retiring {
+    /// The threads that haven't exited yet.
+    pub fn running(&mut self) -> usize {
+        self.0.retain(|h| !h.is_finished());
+        self.0.len()
+    }
+
+    /// Whether every thread has exited.
+    pub fn exited(&self) -> bool {
+        self.0.iter().all(JoinHandle::is_finished)
+    }
+}
+
+impl RenderPool {
+    /// No replacement threads: when the watchdog gives up on a render, the request (and any
+    /// later one) is answered with an error instead of starting another thread. For a caller that
+    /// bounds how many render threads exist at once: the stuck thread keeps running until its
+    /// operator returns, and a replacement would run beside it.
+    pub fn without_replacements(self) -> Self {
+        *lock(&self.replacements_left) = 0;
+        self
+    }
+
+    /// This pool's threads that haven't exited (workers and replacements; 0 when rendering inline).
+    pub fn threads(&self) -> usize {
+        lock(&self._workers).iter().filter(|h| !h.is_finished()).count()
+    }
+
+    /// Drop the pool but keep its threads' handles, for a caller that bounds how many render
+    /// threads run at once: a render the watchdog gave up on can outlive its pool.
+    pub fn retire(self) -> Retiring {
+        let handles = std::mem::take(&mut *lock(&self._workers));
+        drop(self);
+        Retiring(handles)
+    }
+}
+
+impl Drop for RenderPool {
+    fn drop(&mut self) {
+        #[cfg(not(target_arch = "wasm32"))]
+        for busy in lock(&self.shared.busy).iter().flatten() {
+            busy.cancelled.store(true, Ordering::Release);
+            busy.valid.store(false, Ordering::Release);
+        }
+        for s in lock(&self.shared.stop).iter() {
+            s.store(true, std::sync::atomic::Ordering::Relaxed);
+        }
+    }
+}
+
+/// A worker's interpreter settings: the document's, stopping once the request is cancelled.
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) fn worker_settings(config: &RenderConfig, stop: &Arc<std::sync::atomic::AtomicBool>) -> InterpreterSettings {
+    InterpreterSettings { cancelled: Some(stop.clone()), ..config.settings() }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) fn worker(
+    id: usize,
+    bytes: Arc<Vec<u8>>,
+    config: RenderConfig,
+    shared: Arc<Shared>,
+    wake: Receiver<()>,
+    out: Arc<WorkQueue>,
+    stop: Arc<std::sync::atomic::AtomicBool>,
+) {
+    let warnings = Arc::new(Mutex::new(Vec::new()));
+    // A local cell keeps Pdf borrows used by RenderCache stable. Drop both on an
+    // epoch change/panic before publishing an error or taking another request.
+    loop {
+        let reset_result = {
+            let parsed = std::cell::OnceCell::new();
+            loop {
+                if parsed.get().is_some_and(|(_, _, shared_generation)| *shared_generation) && !shared.parser.valid.load(Ordering::Acquire) {
+                    break None;
+                }
+                let next = shared.queue.pop();
+                let Some(req) = next else {
+                    if wake.recv().is_err() {
+                        return; // pool dropped
+                    }
+                    continue;
+                };
+                if shared.queue.cancel_obsolete(req) {
+                    continue;
+                }
+                #[cfg(all(test, not(target_arch = "wasm32")))]
+                if let Some(gate) = lock(&shared.busy_publish_gate).clone().filter(|gate| same_request(gate.request, req)) {
+                    let _ = gate.entered.send(());
+                    let _ = lock(&gate.release).recv();
+                }
+                let request_cancelled = Arc::new(AtomicBool::new(false));
+                let request_valid = Arc::new(AtomicBool::new(true));
+                if lock(&shared.stuck).contains(&req.into()) {
+                    let error = format!("page {} was skipped earlier because rendering failed or took too long", req.page + 1);
+                    let page = RenderedPage {
+                        request: req,
+                        width: 0,
+                        height: 0,
+                        rgba: Pixels::default(),
+                        error: Some(error),
+                        text: None,
+                        warnings: Vec::new(),
+                        millis: 0,
+                    };
+                    if out.send_valid(page, None).is_err() {
+                        return;
+                    }
+                    continue;
+                }
+                let start = Stopwatch::start();
+                shared.stats.record_request(req);
+                let stage = parsed.get().map_or(
+                    BusyStage::Parsing,
+                    |(_, _, shared_generation)| {
+                        if *shared_generation { BusyStage::SharedRender } else { BusyStage::Private }
+                    },
+                );
+                if let Some(slot) = lock(&shared.busy).get_mut(id) {
+                    *slot = Some(Busy {
+                        request: req,
+                        since: std::time::Instant::now(),
+                        stage,
+                        cancelled: request_cancelled.clone(),
+                        valid: request_valid.clone(),
+                    });
+                }
+                if shared.queue.cancel_obsolete(req) {
+                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
+                        return;
+                    }
+                    continue;
+                }
+                #[cfg(all(test, not(target_arch = "wasm32")))]
+                lock(&shared.parser_stage_entries).push(req);
+                // A request cancelled while it waited for the parser must not leave its abort
+                // behind as this worker's parse: every later request would then fail as unparsable.
+                let aborted = || request_cancelled.load(Ordering::Acquire) || stop.load(Ordering::Acquire);
+                if parsed.get().is_none() {
+                    let init = {
+                        let load = || {
+                            #[cfg(test)]
+                            {
+                                shared.parses.fetch_add(1, Ordering::Relaxed);
+                                if let Some(gate) = lock(&shared.parse_gate).clone() {
+                                    gate.entered.wait();
+                                    gate.release.wait();
+                                }
+                                let delay = *lock(&shared.slow_parse);
+                                if let Some(delay) = delay {
+                                    std::thread::sleep(delay);
+                                }
+                            }
+                            shared.stats.parser_builds.fetch_add(1, Ordering::Relaxed);
+                            parse(&bytes, config.password.as_deref())
+                        };
+                        match shared.parser.acquire(load, || {
+                            request_cancelled.load(Ordering::Acquire)
+                                || stop.load(Ordering::Acquire)
+                                || matches!(wake.try_recv(), Err(std::sync::mpsc::TryRecvError::Disconnected))
+                        }) {
+                            Some(pdf) => {
+                                let shared_generation = pdf.is_some();
+                                (pdf, RenderCache::new(), shared_generation)
+                            }
+                            None => {
+                                let pdf = if !request_cancelled.load(Ordering::Acquire)
+                                    && !stop.load(Ordering::Acquire)
+                                    && set_busy_stage(&shared, id, BusyStage::Parsing)
+                                {
+                                    load().map(Arc::new)
+                                } else {
+                                    None
+                                };
+                                (pdf, RenderCache::new(), false)
+                            }
+                        }
+                    };
+                    if aborted() {
+                        if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
+                            return;
+                        }
+                        // Release the active key, retrying if demand returned during parsing.
+                        shared.queue.retry(req);
+                        continue;
+                    }
+                    let _ = parsed.set(init);
+                }
+                // Set just above when it was empty.
+                let Some((pdf, cache, shared_generation)) = parsed.get() else {
+                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
+                        return;
+                    }
+                    continue;
+                };
+                // Acquisition may have waited or parsed privately after shared
+                // fallback. Retire before any render work if the watchdog gave
+                // this request to a replacement while initialization ran.
+                let stage = if *shared_generation { BusyStage::SharedRender } else { BusyStage::Private };
+                if !set_busy_stage(&shared, id, stage) {
+                    return;
+                }
+                if shared.queue.cancel_obsolete(req) {
+                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
+                        return;
+                    }
+                    continue;
+                }
+                if *shared_generation && !shared.parser.valid.load(Ordering::Acquire) {
+                    if lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none()) {
+                        return;
+                    }
+                    break Some((
+                        finish(req, start, Err(("the shared parser was retired".into(), false)), Vec::new()),
+                        vec![request_valid, shared.parser.valid.clone()],
+                    ));
+                }
+                #[cfg(test)]
+                {
+                    shared.render_started.fetch_add(1, Ordering::Relaxed);
+                    let shared_delay = *lock(&shared.shared_render_delay);
+                    if *shared_generation && let Some(delay) = shared_delay {
+                        std::thread::sleep(delay);
+                    }
+                    // Copy out first: a guard held in the `if let` would block the other workers.
+                    let slow = *lock(&shared.slow_page);
+                    if let Some((page, delay)) = slow
+                        && page == req.page
+                    {
+                        let deadline = std::time::Instant::now() + delay;
+                        while std::time::Instant::now() < deadline && !request_cancelled.load(Ordering::Acquire) {
+                            std::thread::sleep(std::time::Duration::from_millis(1));
+                        }
+                    }
+                }
+                #[cfg(all(test, not(target_arch = "wasm32")))]
+                let render_gate = lock(&shared.render_gates)
+                    .iter()
+                    .find(|gate| {
+                        gate.page == req.page
+                            && gate.shared_generation == *shared_generation
+                            && gate.claimed.compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire).is_ok()
+                    })
+                    .cloned();
+                #[cfg(all(test, not(target_arch = "wasm32")))]
+                if let Some(gate) = &render_gate {
+                    gate.entered.wait();
+                    gate.release.wait();
+                }
+                let settings = warning_settings(&worker_settings(&config, &request_cancelled), warnings.clone());
+                lock(&warnings).clear();
+                let r = catch_unwind(AssertUnwindSafe(|| {
+                    #[cfg(test)]
+                    if *lock(&shared.panic_page) == Some(req.page) {
+                        panic!("injected page panic");
+                    }
+                    match pdf {
+                        Some(pdf) => render_page(pdf, cache, &settings, &config, req),
+                        None => Err(("the document could not be parsed".into(), false)),
+                    }
+                }))
+                .unwrap_or_else(|panic| Err((format!("renderer crashed on page {}: {}", req.page + 1, panic_message(&panic)), true)));
+                let request_warnings = take_warnings(&warnings);
+                // If the watchdog cleared our slot meanwhile, it already answered for this request
+                // and started a replacement: drop the late result and retire.
+                let abandoned = lock(&shared.busy).get_mut(id).is_none_or(|slot| slot.take().is_none());
+                if abandoned {
+                    #[cfg(all(test, not(target_arch = "wasm32")))]
+                    if let Some(gate) = render_gate {
+                        gate.finished.wait();
+                    }
+                    return;
+                }
+                let panicked = matches!(r, Err((_, true)));
+                if panicked {
+                    shared.parser.abandon();
+                    lock(&shared.stuck).insert(req.into());
+                    break Some((finish(req, start, r, request_warnings), vec![request_valid]));
+                }
+                let mut valid = vec![request_valid];
+                if *shared_generation {
+                    valid.push(shared.parser.valid.clone());
+                }
+                if *shared_generation && !shared.parser.valid.load(Ordering::Acquire) {
+                    break Some((finish(req, start, r, request_warnings), valid));
+                }
+                if out.send_valid_with_tokens(finish(req, start, r, request_warnings), valid).is_err() {
+                    return;
+                }
+            }
+        }; // drop the parser and its borrowing cache before delivering reset_result
+        if let Some((page, valid)) = reset_result
+            && out.send_valid_with_tokens(page, valid).is_err()
+        {
+            return;
+        }
+    }
+}
diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs
new file mode 100644
index 0000000000..36299d74fd
--- /dev/null
+++ b/crates/render/src/raster/tests.rs
@@ -0,0 +1,7037 @@
+#[cfg(not(target_arch = "wasm32"))]
+fn render_gate(page: usize, shared_generation: bool) -> super::RenderGate {
+    let barrier = || std::sync::Arc::new(std::sync::Barrier::new(2));
+    super::RenderGate {
+        page,
+        shared_generation,
+        claimed: Arc::new(std::sync::atomic::AtomicBool::new(false)),
+        entered: barrier(),
+        release: barrier(),
+        finished: barrier(),
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn parse_gate() -> super::ParseGate {
+    let barrier = || std::sync::Arc::new(std::sync::Barrier::new(2));
+    super::ParseGate { entered: barrier(), release: barrier() }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn receive_before_deadline(pool: &RenderPool) -> RenderedPage {
+    // Generous: a loaded CI machine runs many render tests at once.
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    loop {
+        if let Some(page) = pool.try_recv() {
+            return page;
+        }
+        assert!(std::time::Instant::now() < deadline, "no worker result");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn shared_parser_is_lazy_and_initializes_once_under_contention() {
+    use std::sync::{Barrier, atomic::AtomicUsize};
+    let parser = Arc::new(PoolParser::default());
+    let loads = Arc::new(AtomicUsize::new(0));
+    let barrier = Arc::new(Barrier::new(16));
+    assert_eq!(loads.load(Ordering::Relaxed), 0);
+    let jobs: Vec<_> = (0..16)
+        .map(|_| {
+            let (parser, loads, barrier) = (parser.clone(), loads.clone(), barrier.clone());
+            std::thread::spawn(move || {
+                barrier.wait();
+                parser
+                    .acquire(
+                        || {
+                            loads.fetch_add(1, Ordering::Relaxed);
+                            Pdf::new(ONE_PAGE.to_vec()).ok()
+                        },
+                        || false,
+                    )
+                    .unwrap()
+                    .unwrap()
+            })
+        })
+        .collect();
+    let pdfs: Vec<_> = jobs.into_iter().map(|job| job.join().unwrap()).collect();
+    assert_eq!(loads.load(Ordering::Relaxed), 1);
+    assert!(pdfs.iter().all(|pdf| Arc::ptr_eq(pdf, &pdfs[0])));
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn initializer_panic_publishes_one_failure_and_wakes_waiters() {
+    use std::sync::{Barrier, atomic::AtomicUsize};
+    let parser = Arc::new(PoolParser::default());
+    let loads = Arc::new(AtomicUsize::new(0));
+    let barrier = Arc::new(Barrier::new(8));
+    let jobs: Vec<_> = (0..8)
+        .map(|_| {
+            let (parser, loads, barrier) = (parser.clone(), loads.clone(), barrier.clone());
+            std::thread::spawn(move || {
+                barrier.wait();
+                assert!(
+                    parser
+                        .acquire(
+                            || {
+                                loads.fetch_add(1, Ordering::Relaxed);
+                                panic!("injected parser panic");
+                            },
+                            || false
+                        )
+                        .unwrap()
+                        .is_none()
+                );
+            })
+        })
+        .collect();
+    for job in jobs {
+        job.join().unwrap();
+    }
+    assert_eq!(loads.load(Ordering::Relaxed), 1);
+    assert!(parser.acquire(|| panic!("must not retry"), || false).unwrap().is_none());
+}
+
+/// The waits here only guard against a hang; they don't time anything. The initializer is
+/// held until the end of the test, so a waiter that can't cancel waits forever and fails the
+/// guard however long it is, and a correct one returns as soon as its thread runs. Two
+/// seconds was too short for a busy FreeBSD VM in CI to start the threads (#1970).
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn waiting_worker_can_cancel_before_initializer_returns() {
+    use std::{
+        sync::{atomic::AtomicUsize, mpsc},
+        time::Duration,
+    };
+    const HANG_GUARD: Duration = Duration::from_secs(600);
+    let parser = Arc::new(PoolParser::default());
+    let (started_tx, started_rx) = mpsc::channel();
+    let (release_tx, release_rx) = mpsc::channel();
+    let initializer = {
+        let parser = parser.clone();
+        std::thread::spawn(move || {
+            parser.acquire(
+                || {
+                    started_tx.send(()).unwrap();
+                    // A failed test drops the sender: that ends the hold, it is not a
+                    // second failure.
+                    let _ = release_rx.recv();
+                    Pdf::new(ONE_PAGE.to_vec()).ok()
+                },
+                || false,
+            )
+        })
+    };
+    started_rx.recv_timeout(HANG_GUARD).expect("the initializer starts");
+    let cancelled = Arc::new(AtomicBool::new(false));
+    let checks = Arc::new(AtomicUsize::new(0));
+    let (done_tx, done_rx) = mpsc::channel();
+    let waiter = {
+        let (parser, cancelled, checks) = (parser.clone(), cancelled.clone(), checks.clone());
+        std::thread::spawn(move || {
+            let result = parser.acquire(
+                || panic!("must not initialize twice"),
+                || {
+                    checks.fetch_add(1, Ordering::Relaxed);
+                    cancelled.load(Ordering::Acquire)
+                },
+            );
+            done_tx.send(result.unwrap().is_none()).unwrap();
+        })
+    };
+    let deadline = std::time::Instant::now() + HANG_GUARD;
+    while checks.load(Ordering::Relaxed) == 0 {
+        assert!(std::time::Instant::now() < deadline, "the waiter never checked for cancellation");
+        std::thread::sleep(Duration::from_millis(1));
+    }
+    cancelled.store(true, Ordering::Release);
+    assert!(done_rx.recv_timeout(HANG_GUARD).expect("the waiter cancels while the initializer is held"));
+    waiter.join().unwrap();
+    release_tx.send(()).unwrap();
+    assert!(initializer.join().unwrap().unwrap().is_some());
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn a_retired_pool_counts_its_threads_until_they_exit() {
+    // Idle: its thread leaves as soon as the pool is gone.
+    let mut idle = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default()).retire();
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    while idle.running() > 0 && std::time::Instant::now() < deadline {
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(idle.running(), 0);
+    // Busy in a step that can't be interrupted: still counted after the pool is dropped.
+    let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_secs(2)));
+    pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, ..Default::default() }]);
+    while pool.shared.render_started.load(Ordering::Relaxed) == 0 && std::time::Instant::now() < deadline {
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    let mut busy = pool.retire();
+    assert_eq!(busy.running(), 1, "the render is still under way");
+    while busy.running() > 0 && std::time::Instant::now() < deadline {
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(busy.running(), 0, "and the thread exits when it returns");
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn a_pool_without_replacements_never_runs_a_second_thread() {
+    // The watchdog gives up on a render stuck in one long step; with no replacement, the
+    // request is answered with an error and the stuck thread is the only one.
+    let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default()).without_replacements();
+    pool.set_stuck_after(std::time::Duration::from_millis(50));
+    *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_secs(2)));
+    pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, ..Default::default() }]);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    let answer = loop {
+        assert!(pool.threads() <= 1, "{} render threads", pool.threads());
+        if let Some(page) = pool.try_recv() {
+            break page;
+        }
+        assert!(std::time::Instant::now() < deadline, "the stuck render is answered");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    };
+    assert!(answer.error.is_some(), "answered with an error, not a second attempt");
+    assert!(pool.threads() <= 1);
+    let mut retired = pool.retire();
+    while retired.running() > 0 {
+        assert!(std::time::Instant::now() < deadline, "the stuck thread exits when its step ends");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn page_panic_retires_shared_generation_and_healthy_pages_use_private_parsers() {
+    let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 3, RenderConfig::default());
+    *lock(&pool.shared.panic_page) = Some(0);
+    // Hold page 1 at the shared render boundary until page 0 has crashed, so it can't finish
+    // in the shared generation first (then only one parse would happen).
+    let gate = render_gate(1, true);
+    *lock(&pool.shared.render_gates) = vec![gate.clone()];
+    pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, ..Default::default() }, RenderRequest { page: 1, scale: 1.0, ..Default::default() }]);
+    let crashed = receive_before_deadline(&pool);
+    if gate.claimed.load(Ordering::Acquire) {
+        gate.entered.wait();
+        gate.release.wait();
+    }
+    let mut pages = [crashed, receive_before_deadline(&pool)];
+    pages.sort_by_key(|page| page.request.page);
+    assert!(pages[0].error.as_deref().is_some_and(|message| message.contains("crashed")));
+    assert!(pages[1].error.is_none(), "{:?}", pages[1].error);
+    assert_eq!((pages[1].width, pages[1].height), (100, 50));
+    assert!(!pool.shared.parser.valid.load(Ordering::Acquire));
+    assert!(matches!(*lock(&pool.shared.parser.state), ParserState::Private));
+    assert!((2..=4).contains(&pool.shared.parses.load(Ordering::Relaxed)));
+    let before = pool.shared.parses.load(Ordering::Relaxed);
+    // A new generation (tag) and scale of the failed page is still refused without parsing again.
+    pool.set_queue(vec![RenderRequest { page: 0, tag: 1, scale: 2.0, ..Default::default() }]);
+    assert!(receive_before_deadline(&pool).error.as_deref().is_some_and(|message| message.contains("skipped earlier")));
+    assert_eq!(pool.shared.parses.load(Ordering::Relaxed), before, "a failed page does not trigger repeated parsing");
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn results_queued_before_invalidation_are_retried_privately() {
+    let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
+    pool.set_queue(vec![RenderRequest { tag: 77, scale: 1.0, ..Default::default() }]);
+    let mut old = pool.results.recv_timeout(std::time::Duration::from_secs(8)).unwrap();
+    old.width = 999; // a stale surface must never reach the caller
+    pool.shared.parser.abandon();
+    pool.results_tx.send_valid(old, Some(pool.shared.parser.valid.clone())).unwrap();
+    let page = receive_before_deadline(&pool);
+    assert_eq!((page.width, page.height, page.request.tag), (100, 50, 77));
+    assert!(page.error.is_none());
+    assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2);
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn a_slow_parse_is_not_a_timeout_and_its_pages_render() {
+    use std::time::Duration;
+    // Shared, then the private parsers used after a shared failure.
+    for private in [false, true] {
+        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
+        if private {
+            *lock(&pool.shared.parser.state) = ParserState::Private;
+            pool.shared.parser.valid.store(false, Ordering::Release);
+        }
+        let gate = parse_gate();
+        *lock(&pool.shared.parse_gate) = Some(gate.clone());
+        pool.set_stuck_after(Duration::ZERO);
+        let requests = if private {
+            vec![RenderRequest { page: 0, scale: 1.0, tag: 60, ..Default::default() }]
+        } else {
+            vec![
+                RenderRequest { page: 0, scale: 1.0, tag: 60, ..Default::default() },
+                RenderRequest { page: 1, scale: 1.0, tag: 61, ..Default::default() },
+            ]
+        };
+        pool.set_queue(requests.clone());
+        gate.entered.wait();
+        assert!(pool.try_recv().is_none(), "the watchdog must leave parsing alone");
+        assert!(lock(&pool.shared.stuck).is_empty());
+        assert_eq!(*lock(&pool.retired_workers), 0);
+        assert!(!matches!(*lock(&pool.shared.parser.state), ParserState::Failed));
+        // Rendering gets its own deadline after initialization completes.
+        pool.set_stuck_after(Duration::from_secs(60));
+        gate.release.wait();
+        let mut pages: Vec<_> = (0..requests.len()).map(|_| receive_before_deadline(&pool)).collect();
+        pages.sort_by_key(|page| page.request.page);
+        for (page, request) in pages.iter().zip(&requests) {
+            assert!(page.error.is_none(), "{:?}", page.error);
+            assert_eq!((page.width, page.height, page.request.tag), (100, 50, request.tag));
+        }
+        if !private {
+            assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 1, "one shared parse");
+            assert!(matches!(*lock(&pool.shared.parser.state), ParserState::Ready(Some(_))));
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn shared_timeouts_retry_healthy_pages_privately_before_blacklisting() {
+    use std::time::Duration;
+    let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
+    pool.set_stuck_after(Duration::ZERO);
+    let shared_bad = render_gate(0, true);
+    let shared_healthy = render_gate(1, true);
+    let private_bad = render_gate(0, false);
+    *lock(&pool.shared.render_gates) = vec![shared_bad.clone(), shared_healthy.clone(), private_bad.clone()];
+    pool.set_queue(vec![
+        RenderRequest { page: 0, scale: 1.0, tag: 40, ..Default::default() },
+        RenderRequest { page: 1, scale: 1.0, tag: 41, ..Default::default() },
+    ]);
+    shared_bad.entered.wait();
+    shared_healthy.entered.wait();
+    // This watchdog pass retries both pages privately. Page 1's retry has no gate, so on a
+    // loaded machine it can finish before this same call reads the results: that early
+    // answer is the healthy page, never a timeout error.
+    let early = pool.try_recv();
+    assert!(
+        early.as_ref().is_none_or(|page| page.request.page == 1 && page.error.is_none()),
+        "shared timeouts retry instead of answering with an error: {:?}",
+        early.as_ref().map(|page| (page.request.page, &page.error))
+    );
+    shared_bad.release.wait();
+    shared_healthy.release.wait();
+    shared_bad.finished.wait();
+    shared_healthy.finished.wait();
+    private_bad.entered.wait();
+    let healthy = match early {
+        Some(page) => page,
+        None => pool.results.recv_timeout(Duration::from_secs(30)).expect("healthy private retry"),
+    };
+    assert!(healthy.error.is_none(), "{:?}", healthy.error);
+    assert_eq!((healthy.request.page, healthy.width, healthy.height, healthy.request.tag), (1, 100, 50, 41));
+    pool.watchdog();
+    let bad = pool.results.recv_timeout(Duration::from_secs(30)).expect("the held private retry times out");
+    assert!(bad.error.as_deref().is_some_and(|message| message.contains("took longer")));
+    assert_eq!(bad.request.page, 0);
+    private_bad.release.wait();
+    private_bad.finished.wait();
+    assert!(lock(&pool.shared.stuck).contains(&RequestFailureKey::from(RenderRequest { page: 0, scale: 1.0, tag: 40, ..Default::default() })));
+    assert!(!lock(&pool.shared.stuck).contains(&RequestFailureKey::from(RenderRequest { page: 1, scale: 1.0, tag: 41, ..Default::default() })));
+    assert!((2..=3).contains(&pool.shared.parses.load(Ordering::Relaxed)), "one shared parser and one or two reusable private parsers");
+    assert!(lock(&pool._workers).len() <= 4, "the existing replacement cap is unchanged");
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn exhausted_private_retry_budget_reports_pending_and_future_requests() {
+    use std::time::Duration;
+    let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    pool.set_stuck_after(Duration::ZERO);
+    let shared = render_gate(0, true);
+    let private = render_gate(0, false);
+    *lock(&pool.shared.render_gates) = vec![shared.clone(), private.clone()];
+    let bad = RenderRequest { page: 0, scale: 1.0, tag: 50, ..Default::default() };
+    let healthy = RenderRequest { page: 1, scale: 1.0, tag: 51, ..Default::default() };
+    pool.set_queue(vec![bad]);
+    shared.entered.wait();
+    assert!(pool.try_recv().is_none(), "shared timeout schedules the private retry");
+    shared.release.wait();
+    shared.finished.wait();
+    private.entered.wait();
+    pool.set_queue(vec![bad, healthy]);
+    let bad_result = receive_before_deadline(&pool);
+    assert_eq!(bad_result.request, bad);
+    assert!(bad_result.error.as_deref().is_some_and(|message| message.contains("took longer")));
+    let exhausted = receive_before_deadline(&pool);
+    assert_eq!(exhausted.request, healthy);
+    assert!(exhausted.error.as_deref().is_some_and(|message| message.contains("all render workers") && message.contains("reopen")));
+    assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2);
+    assert_eq!(lock(&pool._workers).len(), 2, "no threads beyond the original replacement cap");
+    assert!(!lock(&pool.shared.stuck).contains(&RequestFailureKey::from(healthy)), "the healthy page itself is not blacklisted");
+    let later = RenderRequest { tag: 52, ..healthy };
+    pool.set_queue(vec![later]);
+    let result = receive_before_deadline(&pool);
+    assert_eq!(result.request, later);
+    assert!(result.error.as_deref().is_some_and(|message| message.contains("all render workers")));
+    assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 2, "exhaustion performs no parser work on the consumer");
+    let workers = std::mem::take(&mut *lock(&pool._workers));
+    private.release.wait();
+    private.finished.wait();
+    for worker in workers {
+        worker.join().unwrap();
+    }
+    assert!(pool.try_recv().is_none());
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn a_failed_page_stays_refused_at_every_scale_and_generation_but_other_pages_render() {
+    let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    let bad = RenderRequest { page: 0, scale: 1.0, tag: 70, ..Default::default() };
+    lock(&pool.shared.stuck).insert(bad.into());
+    for req in [bad, RenderRequest { scale: 0.5, tag: 71, ..bad }, RenderRequest { tile: Some(Tile { x: 0, y: 0, w: 8, h: 8 }), tag: 72, ..bad }] {
+        pool.set_queue(vec![req]);
+        let failed = receive_before_deadline(&pool);
+        assert_eq!(failed.request, req);
+        assert!(failed.error.as_deref().is_some_and(|message| message.contains("skipped earlier")), "{req:?}: {:?}", failed.error);
+    }
+    let other = RenderRequest { page: 1, scale: 0.5, tag: 73, ..Default::default() };
+    pool.set_queue(vec![other]);
+    let rendered = receive_before_deadline(&pool);
+    assert_eq!(rendered.request, other);
+    assert!(rendered.error.is_none(), "another page still renders: {:?}", rendered.error);
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn replacing_a_request_during_initialization_skips_its_obsolete_render() {
+    use std::time::Duration;
+    let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    let gate = parse_gate();
+    *lock(&pool.shared.parse_gate) = Some(gate.clone());
+    pool.set_stuck_after(Duration::ZERO);
+    pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, tag: 10, ..Default::default() }]);
+    gate.entered.wait();
+    pool.set_queue(vec![RenderRequest { page: 1, scale: 1.0, tag: 11, ..Default::default() }]);
+    assert!(pool.try_recv().is_none(), "parsing is still held");
+    pool.set_stuck_after(Duration::from_secs(60));
+    gate.release.wait();
+    let page = receive_before_deadline(&pool);
+    assert_eq!((page.request.page, page.request.tag), (1, 11));
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (100, 50));
+    assert_eq!(pool.shared.parses.load(Ordering::Relaxed), 1, "the useful parser is retained");
+    assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 1, "obsolete page was skipped before rendering");
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn idle_and_skipped_workers_release_source_without_parsing() {
+    for skipped in [false, true] {
+        let shared = Arc::new(Shared::default());
+        if skipped {
+            let req = RenderRequest { page: 0, ..Default::default() };
+            shared.queue.replace(vec![req]);
+            lock(&shared.stuck).insert(req.into());
+        }
+        let bytes = Arc::new(ONE_PAGE.to_vec());
+        let source = Arc::downgrade(&bytes);
+        let (wake_tx, wake_rx) = sync_channel(1);
+        let out = shared.queue.clone();
+        let results = ResultReceiver(shared.queue.clone());
+        // A dropped pool disconnects this channel. Running synchronously makes this check
+        // deterministic even when a worker starts after the pool has already been replaced.
+        drop(wake_tx);
+        worker(0, bytes, RenderConfig::default(), shared.clone(), wake_rx, out, Arc::new(std::sync::atomic::AtomicBool::new(false)));
+        assert_eq!(shared.parses.load(std::sync::atomic::Ordering::Relaxed), 0);
+        assert!(source.upgrade().is_none(), "retired workers release their source bytes");
+        if skipped {
+            assert!(results.try_recv().unwrap().error.as_deref().is_some_and(|e| e.contains("skipped earlier")));
+        }
+        assert!(results.try_recv().is_err());
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn worker_reuses_parser_and_releases_source_after_rendering() {
+    let bytes = Arc::new(ONE_PAGE.to_vec());
+    let source = Arc::downgrade(&bytes);
+    let pool = RenderPool::new(bytes, 1, RenderConfig::default());
+    assert!(!pool.is_inline(), "the lifecycle check needs a native worker");
+    for (tag, kind) in [RequestKind::Pixels, RequestKind::Text, RequestKind::Pixels].into_iter().enumerate() {
+        pool.set_queue(vec![RenderRequest { page: 0, kind, scale: 1.0, tag: tag as u64, ..Default::default() }]);
+        let page = pool.results.recv_timeout(std::time::Duration::from_secs(8)).expect("worker result");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!(page.request.tag, tag as u64);
+        match kind {
+            RequestKind::Pixels => assert_eq!((page.width, page.height), (100, 50)),
+            RequestKind::Text => assert!(page.text.is_some()),
+        }
+        assert_eq!(pool.shared.parses.load(std::sync::atomic::Ordering::Relaxed), 1, "requests reuse one parser");
+    }
+    assert_eq!(
+        pool.stats(),
+        RenderStats { parser_builds: 1, page_interpretations: 2, render_requests: 3, tile_requests: 0, text_interpretations: 1, rasterizations: 2 }
+    );
+    drop(pool);
+    let until = std::time::Instant::now() + std::time::Duration::from_secs(8);
+    while source.upgrade().is_some() {
+        assert!(std::time::Instant::now() < until, "dropped pools retire their workers and release the source");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+}
+
+/// Public-API regressions run in normal workspace CI; dependency unit tests do not.
+fn function_limits_calculator_eval(program: &str) -> Option<Vec<f32>> {
+    use hayro::hayro_interpret::Function;
+    use hayro_syntax::object::{FromBytes, Object};
+    let data = format!("<< /FunctionType 4 /Domain [] /Length {} >> stream\n{program}\nendstream", program.len());
+    let object = Object::from_bytes(data.as_bytes()).unwrap();
+    Function::new(&object)?.eval(Default::default()).map(|values| values.to_vec())
+}
+
+#[test]
+fn function_limits_idiv_zero_is_refused() {
+    assert!(function_limits_calculator_eval("{ 1 0 idiv }").is_none());
+}
+
+#[test]
+fn function_limits_idiv_overflow_is_refused() {
+    assert!(function_limits_calculator_eval("{ -2147483648 -1 idiv }").is_none());
+}
+
+#[test]
+fn function_limits_large_logical_shifts_discard_all_bits() {
+    for shift in [32, -32, 2147483647, -2147483648] {
+        assert_eq!(function_limits_calculator_eval(&format!("{{ 7 {shift} bitshift }}")), Some(vec![0.0]));
+    }
+    assert_eq!(function_limits_calculator_eval("{ 1073741824 1 bitshift }"), Some(vec![-2147483648.0]));
+    assert_eq!(function_limits_calculator_eval("{ -2147483648 -1 bitshift }"), Some(vec![1073741824.0]));
+}
+
+#[test]
+fn function_limits_rotation_accepts_the_most_negative_integer() {
+    assert_eq!(function_limits_calculator_eval("{ 1 2 3 3 -2147483648 roll }"), Some(vec![3.0, 1.0, 2.0]));
+}
+
+#[test]
+fn function_limits_large_indices_are_refused() {
+    assert!(function_limits_calculator_eval("{ 1 4294967295 index }").is_none());
+}
+
+#[test]
+fn function_limits_operand_stack_boundary() {
+    assert_eq!(function_limits_calculator_eval(&format!("{{ 1 {} }}", "dup ".repeat(63))).unwrap().len(), 64);
+    assert!(function_limits_calculator_eval(&format!("{{ 1 {} }}", "dup ".repeat(64))).is_none());
+}
+
+#[test]
+fn function_limits_calculator_arithmetic_and_depth() {
+    for (program, expected) in [
+        ("{ -5 2 idiv }", vec![-2.0]),
+        ("{ 7 3 bitshift }", vec![56.0]),
+        ("{ 142 -3 bitshift }", vec![17.0]),
+        ("{ 1 2 3 3 -1 roll }", vec![2.0, 3.0, 1.0]),
+    ] {
+        assert_eq!(function_limits_calculator_eval(program), Some(expected));
+    }
+    let mut program = "{ 0 }".to_owned();
+    for _ in 1..64 {
+        program = format!("{{ true {program} if }}");
+    }
+    assert_eq!(function_limits_calculator_eval(&program), Some(vec![0.0]));
+    assert!(function_limits_calculator_eval(&format!("{{ true {program} if }}")).is_none());
+}
+
+#[test]
+fn function_limits_calculator_work_boundary() {
+    // With no loops, each admitted operator can execute at most once. The exact parse
+    // boundary can be evaluated, while construction rejects the next operator.
+    assert_eq!(function_limits_calculator_eval(&format!("{{ {} }}", "0 pop ".repeat(5000))), Some(vec![]));
+    assert!(function_limits_calculator_eval(&format!("{{ {} 0 }}", "0 pop ".repeat(5000))).is_none());
+}
+
+#[test]
+fn function_limits_calculator_work_counts_unselected_branches() {
+    // 9,996 branch operators + two procedure openings + true + ifelse = 10,000 tokens.
+    let branch = "0 pop ".repeat(2499);
+    assert_eq!(function_limits_calculator_eval(&format!("{{ true {{ {branch} }} {{ {branch} }} ifelse }}")), Some(vec![]));
+    assert!(function_limits_calculator_eval(&format!("{{ true {{ {branch} }} {{ {branch} 0 }} ifelse }}")).is_none());
+}
+#[test]
+fn function_limits_public_construction_work_and_depth() {
+    use hayro::hayro_interpret::Function;
+    use hayro_syntax::object::{FromBytes, Object};
+
+    let mut data = "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >>".to_owned();
+    for _ in 1..64 {
+        data = format!("<< /FunctionType 3 /Domain [0 1] /Functions [{data}] /Bounds [] /Encode [0 1] >>");
+    }
+    let object = Object::from_bytes(data.as_bytes()).unwrap();
+    assert_eq!(Function::new(&object).unwrap().eval([0.5].into_iter().collect()).unwrap().as_slice(), &[0.5]);
+    let over = format!("<< /FunctionType 3 /Domain [0 1] /Functions [{data}] /Bounds [] /Encode [0 1] >>");
+    // The 64 functions above nest exactly 128 levels (each dictionary and its /Functions
+    // array, then the leaf's /Domain array), the parser's nesting cap. 65 nest 130, so the
+    // parser refuses them before the function-depth guard sees them (a refusal either way).
+    // `function_limits_depth_guard_refuses_a_chain_of_references` tests the guard itself.
+    assert!(Object::from_bytes(over.as_bytes()).is_none(), "the parser refuses direct nesting past its cap");
+
+    // One root plus 10,000 leaves is one node past the common budget. This input remains
+    // below a megabyte and does not attempt excessive recursion or an allocation failure.
+    let leaf = "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> ";
+    for children in [9999, 10_000] {
+        let data = format!(
+            "<< /FunctionType 3 /Domain [0 1] /Functions [{}] /Bounds [{}] /Encode [{}] >>",
+            leaf.repeat(children),
+            "0.5 ".repeat(children - 1),
+            "0 1 ".repeat(children)
+        );
+        let object = Object::from_bytes(data.as_bytes()).unwrap();
+        assert_eq!(Function::new(&object).is_some(), children == 9999);
+    }
+}
+/// Stitching functions that each name the next through `N 0 R` nest no direct objects, so
+/// the parser's nesting cap doesn't stop them and the function-depth guard does.
+#[test]
+fn function_limits_depth_guard_refuses_a_chain_of_references() {
+    use hayro::hayro_interpret::Function;
+    use hayro_syntax::object::{Object, ObjectIdentifier};
+    for functions in [64, 65] {
+        // Objects 4 onwards: each stitching function names the next one; the last is a leaf.
+        let objects: String = (4..4 + functions)
+            .map(|number| {
+                let body = if number < 3 + functions {
+                    format!("<< /FunctionType 3 /Domain [0 1] /Functions [{} 0 R] /Bounds [] /Encode [0 1] >>", number + 1)
+                } else {
+                    "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >>".to_owned()
+                };
+                format!("{number} 0 obj {body} endobj\n")
+            })
+            .collect();
+        let parsed = hayro_syntax::Pdf::new(
+            format!(
+                "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                     2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                     3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
+                     {objects}trailer << /Root 1 0 R >>\n%%EOF"
+            )
+            .into_bytes(),
+        )
+        .unwrap();
+        let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
+        let function = Function::new(&object);
+        if functions == 64 {
+            assert_eq!(function.unwrap().eval([0.5].into_iter().collect()).unwrap().as_slice(), &[0.5]);
+        } else {
+            assert!(function.is_none(), "65 functions are one past the function-depth guard");
+        }
+    }
+}
+#[test]
+fn function_limits_stitching_cycles_are_refused_and_shared_children_work() {
+    use hayro::hayro_interpret::Function;
+    use hayro_syntax::object::{Object, ObjectIdentifier};
+
+    let pdf = |functions: &str| {
+        hayro_syntax::Pdf::new(
+            format!(
+                "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
+             {functions}\ntrailer << /Root 1 0 R >>\n%%EOF"
+            )
+            .into_bytes(),
+        )
+        .unwrap()
+    };
+    for functions in [
+        "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [4 0 R] /Bounds [] /Encode [0 1] >> endobj",
+        "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R] /Bounds [] /Encode [0 1] >> endobj\n5 0 obj << /FunctionType 3 /Domain [0 1] /Functions [4 0 R] /Bounds [] /Encode [0 1] >> endobj",
+        "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [] /Bounds [] /Encode [] >> endobj",
+        "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [99 0 R] /Bounds [] /Encode [0 1] >> endobj",
+        "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R 99 0 R] /Bounds [0.5] /Encode [0 1 0 1] >> endobj\n5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj",
+    ] {
+        let parsed = pdf(functions);
+        let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
+        assert!(Function::new(&object).is_none(), "accepted invalid children: {functions}");
+    }
+    let parsed = pdf(
+        "4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [5 0 R 5 0 R] /Bounds [0.5] /Encode [0 1 0 1] >> endobj\n5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj",
+    );
+    let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
+    let function = Function::new(&object).unwrap();
+    let output = function.eval([0.75].into_iter().collect()).unwrap();
+    assert!((output[0] - 0.5).abs() < 0.001);
+}
+
+#[test]
+fn function_limits_shared_references_count_toward_construction_work() {
+    use hayro::hayro_interpret::Function;
+    use hayro_syntax::object::{Object, ObjectIdentifier};
+    for children in [9999, 10_000] {
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
+                 4 0 obj << /FunctionType 3 /Domain [0 1] /Functions [{}] /Bounds [{}] /Encode [{}] >> endobj\n\
+                 5 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            "5 0 R ".repeat(children),
+            "0.5 ".repeat(children - 1),
+            "0 1 ".repeat(children)
+        )
+        .into_bytes();
+        let parsed = hayro_syntax::Pdf::new(bytes).unwrap();
+        let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
+        assert_eq!(Function::new(&object).is_some(), children == 9999);
+    }
+}
+#[test]
+fn function_limits_invalid_calculator_keeps_the_page_renderable() {
+    use super::*;
+    let program = "{ pop 1 0 idiv }";
+    let content = "/S sh 0 0 1 rg 0 0 20 20 re f";
+    let bytes = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] /Resources << /Shading << /S 4 0 R >> >> /Contents 6 0 R >> endobj\n\
+             4 0 obj << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 20 0] /Function 5 0 R >> endobj\n\
+             5 0 obj << /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >> stream\n{program}\nendstream endobj\n\
+             6 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        program.len(),
+        content.len()
+    )
+    .into_bytes();
+    let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (20, 20));
+    let (pixels, remainder) = page.rgba.as_chunks::<4>();
+    assert!(remainder.is_empty());
+    assert!(pixels.iter().all(|pixel| *pixel == [0, 0, 255, 255]));
+}
+/// #1203: a /Lab colour space must honour its own /WhitePoint. The old path
+/// fed every Lab value to the ICC transform as if the white point were D50,
+/// shifting non-D50 pages several levels per channel (for example a D65
+/// blue came out 45 levels too red). Conversion and expected values follow
+/// ISO 32000-2 §8.6.5.4 with the space's own /WhitePoint [0.9505 1 1.089].
+#[test]
+fn lab_honours_the_space_white_point() {
+    use super::*;
+    let render = |l: f32, a: f32, b: f32| -> [u8; 4] {
+        let content = format!("/L cs {l} {a} {b} sc 0 0 200 200 re f");
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /L [/Lab << /WhitePoint [0.9505 1 1.089] /Range [-100 100 -100 100] >>] >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "Lab ({l} {a} {b}): {:?}", page.error);
+        assert_eq!((page.width, page.height), (200, 200));
+        page.rgba[(100 * page.width as usize + 100) * 4..][..4].try_into().unwrap()
+    };
+
+    for (l, a, b, expected) in [
+        (40.0, 20.0, -60.0, [19, 90, 194, 255]),
+        (70.0, -50.0, 30.0, [77, 193, 114, 255]),
+        (60.0, 0.0, -40.0, [87, 148, 215, 255]),
+        (50.0, 60.0, 40.0, [217, 61, 55, 255]),
+        (30.0, 40.0, 20.0, [130, 37, 42, 255]),
+    ] {
+        let got = render(l, a, b);
+        for (channel, (got, want)) in got.iter().zip(expected).enumerate() {
+            assert!((*got).abs_diff(want) <= 2, "Lab ({l} {a} {b}) channel {channel}: got {got:?}, expected {expected:?}");
+        }
+    }
+}
+/// #1203: an `/Indexed` palette over Lab looks its entries up as
+/// `byte / 255`, which must map onto L* 0..100 and the a*/b* /Range. They
+/// were read as raw L*a*b* (L* below 1), so such palettes drew near black.
+#[test]
+fn indexed_palettes_over_lab_keep_their_colours() {
+    use super::*;
+    let lab = "[/Lab << /WhitePoint [0.9505 1 1.089] /Range [-100 100 -100 100] >>]";
+    let render = |content: &str| -> [u8; 4] {
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /L {lab} /I [/Indexed {lab} 1 <000000 80CCB2>] >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{content}: {:?}", page.error);
+        assert_eq!((page.width, page.height), (200, 200));
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+
+    // Palette entry 1 is <80 CC B2>: L* = 128/255·100, a* = -100 + 204/255·200,
+    // b* = -100 + 178/255·200, about Lab (50.2 60 39.6): a warm red.
+    let indexed = render("/I cs 1 sc 0 0 200 200 re f");
+    let direct =
+        render(&format!("/L cs {} {} {} sc 0 0 200 200 re f", 128.0 / 255.0 * 100.0, -100.0 + 204.0 / 255.0 * 200.0, -100.0 + 178.0 / 255.0 * 200.0));
+    for (channel, (got, want)) in indexed.iter().zip(direct).enumerate() {
+        assert!(got.abs_diff(want) <= 1, "channel {channel}: indexed {indexed:?}, direct {direct:?}");
+    }
+    assert!(indexed[0] > 180, "the palette red must not render near black: {indexed:?}");
+}
+#[test]
+fn watchdog_skips_a_stuck_page_and_keeps_rendering() {
+    use super::*;
+    let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    // Exercise the original private-worker replacement guarantee. Shared
+    // contention gets one isolated attempt, covered by the tests above.
+    *lock(&pool.shared.parser.state) = ParserState::Private;
+    pool.shared.parser.valid.store(false, Ordering::Release);
+    pool.set_stuck_after(std::time::Duration::ZERO);
+    let gate = render_gate(0, false);
+    *lock(&pool.shared.render_gates) = vec![gate.clone()];
+    let req = |page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() };
+    pool.set_queue(vec![req(0)]);
+    gate.entered.wait();
+    let first = pool.try_recv().expect("the watchdog answers while the render is held");
+    assert!(first.error.as_deref().is_some_and(|e| e.contains("took longer")), "{:?}", first.error);
+    // A zero allowance would give up on the healthy page 2 as well.
+    pool.set_stuck_after(std::time::Duration::from_secs(60));
+    // The single worker is stuck, yet page 2 still renders (on the replacement worker).
+    pool.set_queue(vec![req(1)]);
+    let second = receive_before_deadline(&pool);
+    assert!(second.error.is_none() && second.request.page == 1, "{:?}", second.error);
+    // Asking for the stuck page again fails fast instead of trapping another worker.
+    pool.set_queue(vec![req(0)]);
+    let again = receive_before_deadline(&pool);
+    assert!(again.error.as_deref().is_some_and(|e| e.contains("skipped earlier")), "{:?}", again.error);
+    // The released worker notices its slot was cleared; its late result is dropped.
+    gate.release.wait();
+    gate.finished.wait();
+    assert!(pool.try_recv().is_none());
+}
+
+#[test]
+fn a_request_being_rendered_is_not_rendered_again() {
+    use super::*;
+    let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
+    let gate = render_gate(0, true);
+    *lock(&pool.shared.render_gates) = vec![gate.clone()];
+    let req = |page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() };
+    pool.set_queue(vec![req(0)]);
+    gate.entered.wait();
+    // What the canvas sends next: the page it is still waiting for, then another one.
+    pool.set_queue(vec![req(0), req(1)]);
+    let other = receive_before_deadline(&pool);
+    assert!(other.error.is_none(), "{:?}", other.error);
+    assert_eq!(other.request.page, 1);
+    // Page 2 went to the idle worker instead of waiting behind a second copy of page 1.
+    assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 2, "each page rendered once");
+    gate.release.wait();
+    let first = receive_before_deadline(&pool);
+    assert!(first.error.is_none(), "{:?}", first.error);
+    assert_eq!(first.request.page, 0);
+    assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 2, "each page rendered once");
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn replacing_an_in_flight_request_does_not_delay_the_replacement() {
+    use super::*;
+    use std::time::{Duration, Instant};
+
+    let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    let a = RenderRequest { page: 0, scale: 0.5, tag: 101, ..Default::default() };
+    let b = RenderRequest { page: 1, scale: 0.5, tag: 102, ..Default::default() };
+    *lock(&pool.shared.slow_page) = Some((a.page, Duration::from_secs(10)));
+    pool.set_queue(vec![a]);
+
+    let started = Instant::now();
+    while pool.shared.render_started.load(Ordering::Relaxed) == 0 {
+        assert!(started.elapsed() < Duration::from_secs(2), "request A never started");
+        std::thread::sleep(Duration::from_millis(1));
+    }
+
+    let replaced = Instant::now();
+    pool.set_queue(vec![b]);
+    assert!(lock(&pool.shared.busy).iter().flatten().any(|busy| busy.cancelled.load(Ordering::Acquire)), "request A was not cancelled");
+    let page = receive_before_deadline(&pool);
+    assert_eq!(page.request, b);
+    assert!(page.error.is_none(), "replacement request failed: {:?}", page.error);
+    assert!(replaced.elapsed() < Duration::from_secs(3), "obsolete request A delayed B");
+
+    let deadline = Instant::now() + Duration::from_millis(100);
+    while Instant::now() < deadline {
+        assert!(pool.try_recv().is_none(), "obsolete request produced a result");
+        std::thread::sleep(Duration::from_millis(5));
+    }
+}
+
+/// A request cancelled while its worker waited for the shared parse must not leave that
+/// worker unable to render: the abort is not a parse result.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn a_request_cancelled_while_waiting_for_the_parse_leaves_its_worker_usable() {
+    use super::*;
+    use std::time::{Duration, Instant};
+
+    let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 2, RenderConfig::default());
+    *lock(&pool.shared.slow_parse) = Some(Duration::from_millis(500));
+    let a = RenderRequest { page: 0, scale: 0.5, tag: 301, ..Default::default() };
+    let c = RenderRequest { page: 1, scale: 0.5, tag: 302, ..Default::default() };
+    pool.set_queue(vec![a, c]);
+    let started = Instant::now();
+    while lock(&pool.shared.busy).iter().flatten().count() < 2 {
+        assert!(started.elapsed() < Duration::from_secs(2), "both requests never started");
+        std::thread::sleep(Duration::from_millis(1));
+    }
+    *lock(&pool.shared.slow_parse) = None;
+    for round in 0..4u64 {
+        let x = RenderRequest { page: 0, scale: 0.5, tag: 400 + 2 * round, ..Default::default() };
+        let y = RenderRequest { page: 1, scale: 0.5, tag: 401 + 2 * round, ..Default::default() };
+        pool.set_queue(vec![x, y]);
+        for _ in 0..2 {
+            let page = receive_before_deadline(&pool);
+            assert!(page.request == x || page.request == y, "round {round}: obsolete {:?}", page.request);
+            assert!(page.error.is_none(), "round {round}: {:?}", page.error);
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn check_cancelled_parse_request_requeue(renew_before_abort: bool) {
+    use super::*;
+    use std::{sync::mpsc, time::Duration};
+
+    let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    let a = RenderRequest { page: 0, kind: RequestKind::Text, scale: 1.0, tag: 501, ..Default::default() };
+    let b = RenderRequest { page: 1, scale: 1.0, tag: 502, ..Default::default() };
+    let parse = parse_gate();
+    *lock(&pool.shared.parse_gate) = Some(parse.clone());
+    let (entered_tx, entered_rx) = mpsc::channel();
+    let (release_tx, release_rx) = mpsc::channel();
+    *lock(&pool.shared.busy_publish_gate) = Some(BusyPublishGate { request: b, entered: entered_tx, release: Arc::new(Mutex::new(release_rx)) });
+
+    pool.set_queue(vec![a]);
+    parse.entered.wait();
+    pool.set_queue(vec![b]);
+    if renew_before_abort {
+        // B stays first so the worker reaches its gate even when aborting A requeues it.
+        pool.set_queue(vec![b, a]);
+    }
+    parse.release.wait();
+    entered_rx.recv_timeout(Duration::from_secs(2)).expect("the worker finished aborting A and reached B");
+    // The parse hook's lock can span its barrier waits; clear it only after parsing returned.
+    *lock(&pool.shared.parse_gate) = None;
+    if !renew_before_abort {
+        pool.set_queue(vec![a]);
+    }
+    // B holds the sole worker, so this observes queue admission without racing a worker pop.
+    let pending = pool.shared.queue.pop();
+    if let Some(request) = pending {
+        pool.shared.queue.retry(request);
+    }
+    pool.set_queue(vec![a]);
+    // Release the worker before the regression assertion, including on the unfixed baseline.
+    release_tx.send(()).unwrap();
+    assert_eq!(pending, Some(a), "aborting a parse must release its active request identity");
+
+    let page = receive_before_deadline(&pool);
+    assert_eq!(page.request, a);
+    assert!(page.error.is_none(), "renewed text request failed: {:?}", page.error);
+    assert!(page.text.is_some(), "the exact cancelled text request completed");
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn cancelled_parse_request_can_be_requested_again() {
+    check_cancelled_parse_request_requeue(false);
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn cancelled_parse_request_renewed_before_abort_is_requeued() {
+    check_cancelled_parse_request_requeue(true);
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn request_removed_before_busy_publication_skips_parser_acquisition() {
+    use std::{sync::mpsc, time::Duration};
+
+    let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    let a = RenderRequest { page: 0, scale: 0.5, tag: 201, ..Default::default() };
+    let b = RenderRequest { page: 1, scale: 0.5, tag: 202, ..Default::default() };
+    let (entered_tx, entered_rx) = mpsc::channel();
+    let (release_tx, release_rx) = mpsc::channel();
+    *lock(&pool.shared.busy_publish_gate) = Some(BusyPublishGate { request: a, entered: entered_tx, release: Arc::new(Mutex::new(release_rx)) });
+
+    pool.set_queue(vec![a]);
+    entered_rx.recv_timeout(Duration::from_secs(2)).expect("request A passed its first obsolescence check");
+    assert!(!lock(&pool.shared.busy).iter().flatten().any(|busy| same_request(busy.request, a)));
+    pool.set_queue(vec![b]);
+    release_tx.send(()).unwrap();
+
+    let page = receive_before_deadline(&pool);
+    assert_eq!(page.request, b);
+    assert!(page.error.is_none(), "replacement request failed: {:?}", page.error);
+    assert_eq!(*lock(&pool.shared.parser_stage_entries), vec![b], "obsolete A must not enter parser acquisition");
+    assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), 1, "only replacement B is rasterized");
+    assert!(pool.try_recv().is_none(), "obsolete request A did not publish a stale result");
+}
+
+#[test]
+fn re_sent_queues_render_each_page_once() {
+    use super::*;
+    let pages = 12;
+    let mut pdf = format!(
+        "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 200 200] >> endobj\n",
+        (0..pages).map(|i| format!("{} 0 R", 4 + i)).collect::<Vec<_>>().join(" ")
+    );
+    let body: String = (0..3000).map(|k| format!("{} {} 5 5 re f\n", k * 7 % 195, k * 13 % 195)).collect();
+    pdf += &format!("3 0 obj << /Length {} >> stream\n{body}endstream endobj\n", body.len());
+    for i in 0..pages {
+        pdf += &format!("{} 0 obj << /Type /Page /Parent 2 0 R /Contents 3 0 R >> endobj\n", 4 + i);
+    }
+    pdf += "trailer << /Root 1 0 R >>\n%%EOF";
+    let pool = RenderPool::new(Arc::new(pdf.into_bytes()), 3, RenderConfig::default());
+    let wanted: Vec<RenderRequest> =
+        (0..pages).map(|page| RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 2000, ..Default::default() }).collect();
+    // The canvas's loop: take what arrived, then queue every page still missing whenever
+    // that list changes (requests already rendering included).
+    let mut got = vec![0; pages];
+    let mut last = Vec::new();
+    let t = std::time::Instant::now();
+    while got.contains(&0) || lock(&pool.shared.busy).iter().any(Option::is_some) {
+        assert!(t.elapsed() < std::time::Duration::from_secs(30), "rendered so far: {got:?}");
+        while let Some(p) = pool.try_recv() {
+            assert!(p.error.is_none(), "{:?}", p.error);
+            got[p.request.page] += 1;
+        }
+        let queue: Vec<RenderRequest> = wanted.iter().copied().filter(|r| got[r.page] == 0).collect();
+        if queue != last {
+            pool.set_queue(queue.clone());
+            last = queue;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(1));
+    }
+    while let Some(p) = pool.try_recv() {
+        got[p.request.page] += 1;
+    }
+    assert_eq!(got, vec![1; pages]);
+    assert_eq!(pool.shared.render_started.load(Ordering::Relaxed), pages, "no duplicated work was hidden by delivery filtering");
+}
+
+#[test]
+fn effective_scale_never_exceeds_the_caps() {
+    for (w, h, s) in [(934_775_807.0, 792.0, 0.25), (612.0, 792.0, 0.0), (1.0e9, 1.0e9, 1.0), (612.0, 792.0, 2.0)] {
+        let k = super::effective_scale(w, h, s);
+        assert!(k > 0.0 && k.is_finite(), "{w}×{h} @ {s}: {k}");
+        assert!(w * k <= super::MAX_SIDE + 1.0 && h * k <= super::MAX_SIDE + 1.0, "{w}×{h} @ {s}: {k}");
+        assert!(w * k * h * k <= super::MAX_PIXELS * 1.01, "{w}×{h} @ {s}: {k}");
+    }
+    assert_eq!(super::effective_scale(612.0, 792.0, 2.0), 2.0);
+}
+
+use super::*;
+
+// Metadata-only: the test budget is 128 pixels and no image buffer is allocated.
+#[test]
+fn image_resampling_rejects_anisotropic_target_growth() {
+    assert_eq!(hayro::image_resampling_size(16, 1, 1, 16, 0.5, 32.0, 128, true), None);
+    assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 32.0, 128, true), None);
+    assert_eq!(hayro::image_resampling_size(16, 1, 4, 64, 0.5, 32.0, 128, true), None);
+}
+
+#[test]
+fn image_resampling_bounds_intermediate_before_planning() {
+    // Source and destination are each 128 pixels, but their crossed dimensions are 256.
+    assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 0.5, 2.0, 128, true), None);
+}
+
+#[test]
+fn image_resampling_rejects_invalid_sources_and_scales() {
+    assert_eq!(hayro::image_resampling_size(4, 4, 3, 47, 0.5, 0.5, 128, true), None);
+    assert_eq!(hayro::image_resampling_size(4, 4, 3, 49, 0.5, 0.5, 128, true), None);
+    for scale in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY, -1.0, 0.0] {
+        assert_eq!(hayro::image_resampling_size(4, 4, 3, 48, 0.5, scale, 128, true), None);
+    }
+}
+
+#[test]
+fn image_resampling_keeps_valid_sizes_and_exact_limits() {
+    assert_eq!(hayro::image_resampling_size(16, 8, 1, 128, 0.5, 0.5, 128, true), Some((8, 4)));
+    assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 8.0, 128, true), Some((8, 8)));
+    assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 1.0, 1.0, 128, true), Some((16, 8)));
+    assert_eq!(hayro::image_resampling_size(0, 8, 1, 0, 1.0, 1.0, 128, true), None);
+    assert_eq!(hayro::image_resampling_size(16, 9, 1, 144, 1.0, 1.0, 128, true), None);
+    assert_eq!(hayro::image_resampling_size(65_536, 1, 1, 65_536, 1.0, 1.0, u64::MAX, true), None);
+    for channels in [1, 3, 4] {
+        assert_eq!(hayro::image_resampling_size(65_536, 1, channels, 65_536 * channels, 1.0 / 4096.0, 1.0, 65_536, true), Some((16, 1)));
+    }
+    assert_eq!(hayro::image_resampling_size(65_535, 1, 1, 65_535, 1.0, 1.0, 65_535, true), Some((65_535, 1)));
+    assert_eq!(hayro::image_resampling_size((1 << 20) + 1, 1, 1, (1 << 20) + 1, 1.0 / 4096.0, 1.0, 1 << 28, true), None);
+}
+
+#[test]
+fn image_resampling_padded_backend_dimensions_stay_checked() {
+    // A Type 3 image's two-pixel frame may reach u16::MAX exactly, never wrap to zero.
+    assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5, true), Some((65_535, 5)));
+    assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5 - 1, true), None);
+    assert_eq!(hayro::image_resampling_size(65_532 + 4, 1 + 4, 4, 65_536 * 5 * 4, 1.0, 1.0, 1 << 28, true), None);
+}
+
+/// Nearest-neighbour copies source pixels and needs no filter tables, so a source wider than the
+/// Catmull-Rom side cap still shrinks. The pixel budget applies to it all the same.
+#[test]
+fn image_resampling_nearest_accepts_wide_sources_the_filter_refuses() {
+    let wide: u32 = (1 << 20) + 1;
+    assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 1 << 28, true), None);
+    assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 1 << 28, false), Some((257, 1)));
+    assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 256, false), None);
+}
+
+fn strip_image_pdf(width: u32, body: &str, space: &str, encoded: &str, alpha: Option<&str>) -> Vec<u8> {
+    let (mask_ref, mask_obj) = match alpha {
+        Some(data) => (
+            "/SMask 6 0 R",
+            format!(
+                "6 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n",
+                data.len() + 1
+            ),
+        ),
+        None => ("", String::new()),
+    };
+    format!(
+        "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 4] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{body}endstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height 1 /ColorSpace /{space} /BitsPerComponent 8 {mask_ref} /Filter /ASCIIHexDecode /Length {} >> stream\n{encoded}>\nendstream endobj\n\
+             {mask_obj}trailer << /Root 1 0 R >>\n%%EOF", body.len(), encoded.len() + 1,
+    ).into_bytes()
+}
+
+// Safe on the original renderer too: 192 KiB RGB / 64 KiB gray sources shrink to 16 pixels.
+#[test]
+fn image_resampling_wide_sources_shrink_before_backend_side_limits() {
+    for (space, encoded, expected) in
+        [("DeviceRGB", "ff0000".repeat(65_536), [255, 0, 0, 255]), ("DeviceGray", "7f".repeat(65_536), [127, 127, 127, 255])]
+    {
+        let pdf = strip_image_pdf(65_536, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", space, &encoded, None);
+        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{space}: {:?}", page.error);
+        assert_eq!((page.width, page.height), (20, 4));
+        let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
+        assert_eq!(pixel(1), &[255, 255, 255, 255], "{space}: left placement");
+        assert_eq!(pixel(3), &expected, "{space}: source image was not dropped");
+        assert_eq!(pixel(17), &expected, "{space}: right placement");
+        assert_eq!(pixel(19), &[255, 255, 255, 255], "{space}: right placement");
+    }
+}
+
+#[test]
+fn image_resampling_wide_transparent_sources_still_shrink() {
+    let data = "ff0000".repeat(65_536);
+    let alpha = "7f".repeat(65_536);
+    let pdf = strip_image_pdf(65_536, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceRGB", &data, Some(&alpha));
+    let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (20, 4));
+    assert_eq!(&page.rgba[(20 + 3) * 4..][..4], &[255, 128, 128, 255]);
+}
+
+/// A source wider than the filter's 2^20-pixel side cap is shrunk by nearest-neighbour rather
+/// than refused and skipped (the default, `/Interpolate` omitted, is nearest).
+#[test]
+fn wide_non_interpolated_sources_draw_after_shrinking() {
+    let data = "7f".repeat(1_100_000);
+    let pdf = strip_image_pdf(1_100_000, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceGray", &data, None);
+    let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (20, 4));
+    let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
+    assert_eq!(pixel(1), &[255, 255, 255, 255]);
+    assert_eq!(pixel(3), &[127, 127, 127, 255], "source image was not dropped");
+    assert_eq!(pixel(17), &[127, 127, 127, 255]);
+    assert_eq!(pixel(19), &[255, 255, 255, 255]);
+}
+
+#[test]
+fn image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement() {
+    let data = "ff0000".repeat(16);
+    let alpha = "7f".repeat(8);
+    let pdf = strip_image_pdf(16, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceRGB", &data, Some(&alpha));
+    let pdf = String::from_utf8(pdf)
+        .unwrap()
+        .replace("6 0 obj << /Type /XObject /Subtype /Image /Width 16", "6 0 obj << /Type /XObject /Subtype /Image /Width 8");
+    let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (20, 4));
+    let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
+    assert_eq!(pixel(1), &[255, 255, 255, 255]);
+    assert_eq!(pixel(3), &[255, 128, 128, 255]);
+    assert_eq!(pixel(17), &[255, 128, 128, 255]);
+    assert_eq!(pixel(19), &[255, 255, 255, 255]);
+}
+// GREEN-only integration: the original renderer would attempt GiB buffers. The source is
+// only 96 KiB, and the fixed guard rejects the target before the resampling plan/allocation.
+#[test]
+fn resampling_fallback_preserves_original_geometry_and_pixels() {
+    let data = "ff0000".repeat(32_767);
+    let body = "q 16383.5 0 0 1000000000 2 2 cm /Im0 Do Q\n";
+    let pdf = format!(
+        "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{body}endstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width 32767 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Interpolate true /Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        body.len(),
+        data.len() + 1,
+    );
+    let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (20, 20));
+    let pixel = |x: usize, y: usize| &page.rgba[(y * 20 + x) * 4..][..4];
+    assert_eq!(pixel(0, 5), &[255, 255, 255, 255]);
+    assert_eq!(pixel(3, 5), &[255, 0, 0, 255]);
+    assert_eq!(pixel(19, 5), &[255, 0, 0, 255]);
+}
+
+const ONE_PAGE: &[u8] = b"%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
+4 0 obj << /Length 35 >> stream
+0 0 1 rg 10 10 30 20 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+const ONE_PAGE_TWICE: &[u8] = b"%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
+4 0 obj << /Length 35 >> stream
+0 0 1 rg 10 10 30 20 re f
+endstream endobj
+5 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+fn heavy_vector_pdf(commands: usize, text_at_end: bool) -> Vec<u8> {
+    let mut body = String::with_capacity(commands * 42 + 64);
+    for i in 0..commands {
+        let x = (i % 280) as u32;
+        let y = ((i / 280) % 280) as u32;
+        body.push_str(&format!("0 0 0 rg {x} {y} 1 1 re f\n"));
+    }
+    if text_at_end {
+        body.push_str("BT /F1 18 Tf 20 280 Td (TRAILING_MARKER) Tj ET\n");
+    }
+    format!(
+        "%PDF-1.4\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{body}endstream endobj\n\
+             5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        body.len()
+    )
+    .into_bytes()
+}
+
+#[test]
+fn heavy_vector_fixture_preserves_trailing_text_and_raster_output() {
+    let mut renderer = PageRenderer::new(Arc::new(heavy_vector_pdf(5_000, true)), RenderConfig::default());
+    let pixels = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(pixels.error.is_none(), "heavy vector render failed: {:?}", pixels.error);
+    assert!(pixels.rgba.as_chunks::<4>().0.iter().any(|pixel| *pixel != [255, 255, 255, 255]));
+    let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
+    assert!(text.error.is_none(), "heavy vector text failed: {:?}", text.error);
+    assert!(text.text.is_some_and(|page| page.plain_text().contains("TRAILING_MARKER")));
+    assert_eq!(
+        renderer.stats(),
+        RenderStats { parser_builds: 1, page_interpretations: 1, render_requests: 2, tile_requests: 0, text_interpretations: 1, rasterizations: 1 }
+    );
+}
+
+#[test]
+fn large_resource_indexes_preserve_pixels_and_text() {
+    // #307: opening pages used to retain a hash table for every large resource
+    // dictionary on every page, even before rendering. The vendored lazy index
+    // must still resolve late keys, inherited resources and repeated renders.
+    fn fixture(large: bool) -> Vec<u8> {
+        let mut fonts = String::new();
+        let mut forms = String::new();
+        if large {
+            for i in 0..100 {
+                fonts.push_str(&format!("/UnusedFont{i} 6 0 R "));
+                forms.push_str(&format!("/UnusedForm{i} 7 0 R "));
+            }
+        }
+        let body = "BT /F1 12 Tf 10 55 Td (Shared resources) Tj ET q 1 0 0 1 10 10 cm /Last Do Q";
+        let form = "0 0 1 rg 0 0 30 20 re f";
+        format!(
+            "%PDF-1.7\n\
+                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R 8 0 R] /Count 2 /MediaBox [0 0 150 100] /Resources 5 0 R >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{body}\nendstream endobj\n\
+                 5 0 obj << /Font << {fonts}/F1 6 0 R >> /XObject << {forms}/Last 7 0 R >> >> endobj\n\
+                 6 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n\
+                 7 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 20] /Length {} >> stream\n{form}\nendstream endobj\n\
+                 8 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources 5 0 R /Rotate 90 >> endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            body.len(),
+            form.len()
+        )
+        .into_bytes()
+    }
+    let mut small = PageRenderer::new(Arc::new(fixture(false)), RenderConfig::default());
+    let mut large = PageRenderer::new(Arc::new(fixture(true)), RenderConfig::default());
+    for page in [0, 1, 0] {
+        for scale in [1.0, 2.0] {
+            let req = RenderRequest { page, scale, ..Default::default() };
+            let (a, b) = (small.render(req), large.render(req));
+            assert!(a.error.is_none() && b.error.is_none());
+            assert_eq!((a.width, a.height, &a.rgba), (b.width, b.height, &b.rgba));
+            assert!(b.rgba.as_chunks::<4>().0.contains(&[0, 0, 255, 255]));
+        }
+        let req = RenderRequest { page, kind: RequestKind::Text, ..Default::default() };
+        let (a, b) = (small.render(req), large.render(req));
+        assert!(a.error.is_none() && b.error.is_none());
+        assert_eq!(a.text.as_ref().unwrap().plain_text(), b.text.as_ref().unwrap().plain_text());
+        assert!(b.text.as_ref().unwrap().plain_text().contains("Shared resources"));
+    }
+}
+
+#[test]
+fn shared_form_xobject_uses_each_pages_resource_context() {
+    let form = "/CS1 cs 0.5 0.5 0.5 sc 10 10 30 30 re f";
+    let page_content = "/F Do";
+    let pdf = format!(
+        "%PDF-1.7\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R 6 0 R] /Count 2 /MediaBox [0 0 50 50] >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /Resources << /XObject << /F 4 0 R >> /ColorSpace << /CS1 /DeviceRGB >> >> /Contents 5 0 R >> endobj\n\
+             4 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 50 50] /Length {} >> stream\n{form}\nendstream endobj\n\
+             5 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n\
+             6 0 obj << /Type /Page /Parent 2 0 R /Resources << /XObject << /F 4 0 R >> /ColorSpace << /CS1 [/CalRGB << /WhitePoint [0.9505 1 1.089] /Gamma [2 2 2] /Matrix [1 0 0 0 1 0 0 0 1] >>] >> >> /Contents 7 0 R >> endobj\n\
+             7 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        form.len(),
+        page_content.len(),
+        page_content.len()
+    )
+    .into_bytes();
+    let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let first = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    let second = renderer.render(RenderRequest { page: 1, scale: 1.0, ..Default::default() });
+    assert!(first.error.is_none() && second.error.is_none(), "{:?} / {:?}", first.error, second.error);
+
+    let pixel = |page: &RenderedPage| {
+        let offset = ((20 * page.width + 20) * 4) as usize;
+        [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
+    };
+    let first_pixel = pixel(&first);
+    let second_pixel = pixel(&second);
+    assert_ne!(first_pixel, second_pixel, "the same Form XObject must resolve /CS1 in each page's resources");
+    assert_ne!(first_pixel, [255, 255, 255, 255]);
+    assert_ne!(second_pixel, [255, 255, 255, 255]);
+}
+
+#[test]
+fn shared_soft_mask_uses_each_inherited_resource_context() {
+    let page_body = "/A Do /B Do";
+    let form_a = "/GS gs 1 0 0 rg 0 0 40 40 re f";
+    let form_b = "/GS gs 0 0 1 rg 60 0 40 40 re f";
+    let mask_body = "/FILL Do";
+    let white = "1 g 0 0 100 100 re f";
+    let black = "0 g 0 0 100 100 re f";
+    let pdf = format!(
+        "%PDF-1.7\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 100 100] >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /Resources << /XObject << /A 4 0 R /B 5 0 R >> >> /Contents 6 0 R >> endobj\n\
+             4 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Resources << /ExtGState << /GS 8 0 R >> /XObject << /FILL 9 0 R >> >> /Length {} >> stream\n{form_a}\nendstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Resources << /ExtGState << /GS 8 0 R >> /XObject << /FILL 10 0 R >> >> /Length {} >> stream\n{form_b}\nendstream endobj\n\
+             6 0 obj << /Length {} >> stream\n{page_body}\nendstream endobj\n\
+             8 0 obj << /Type /ExtGState /SMask 11 0 R >> endobj\n\
+             9 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >> stream\n{white}\nendstream endobj\n\
+             10 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >> stream\n{black}\nendstream endobj\n\
+             11 0 obj << /Type /Mask /S /Luminosity /G 12 0 R >> endobj\n\
+             12 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /CS /DeviceGray >> /Length {} >> stream\n{mask_body}\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        form_a.len(),
+        form_b.len(),
+        page_body.len(),
+        white.len(),
+        black.len(),
+        mask_body.len()
+    )
+    .into_bytes();
+    let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    let pixel = |x: u32, y: u32| {
+        let offset = ((y * page.width + x) * 4) as usize;
+        [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
+    };
+    assert_eq!(pixel(20, 80), [255, 0, 0, 255], "the white inherited mask makes form A visible");
+    assert_eq!(pixel(80, 80), [255, 255, 255, 255], "the black inherited mask must not reuse form A's cached pixels");
+}
+
+#[test]
+fn renders_a_blue_rectangle() {
+    let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
+    pool.set_queue(vec![RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 7, ..Default::default() }]);
+    let page = loop {
+        if let Some(p) = pool.try_recv() {
+            break p;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    };
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height, page.request.tag), (100, 50, 7));
+    // Pixel (20, 30) in y-down device space is inside the rect drawn at y 10..30 (y-up).
+    let px = |x: u32, y: u32| &page.rgba[((y * page.width + x) * 4) as usize..][..4];
+    assert_eq!(px(20, 30), &[0, 0, 255, 255]);
+    assert_eq!(px(80, 5), &[255, 255, 255, 255]);
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn page_pixels_are_invariant_to_render_worker_count() {
+    let blue = "0 0 1 rg 10 10 30 20 re f";
+    let red = "1 0 0 rg 20 5 40 35 re f";
+    let pdf = format!(
+        "%PDF-1.4\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 /MediaBox [0 0 100 50] >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{blue}\nendstream endobj\n\
+             5 0 obj << /Type /Page /Parent 2 0 R /Contents 6 0 R >> endobj\n\
+             6 0 obj << /Length {} >> stream\n{red}\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        blue.len(),
+        red.len()
+    )
+    .into_bytes();
+    let bytes = Arc::new(pdf);
+    let mut reference = PageRenderer::new(bytes.clone(), RenderConfig::default());
+    let expected: Vec<_> = (0..2).map(|page| reference.render(RenderRequest { page, scale: 1.0, ..Default::default() })).collect();
+    assert!(expected.iter().all(|page| page.error.is_none()));
+
+    for workers in [1, 2, 4] {
+        let pool = RenderPool::new(bytes.clone(), workers, RenderConfig::default());
+        pool.set_queue((0..2).map(|page| RenderRequest { page, scale: 1.0, ..Default::default() }).collect());
+        let mut actual = [receive_before_deadline(&pool), receive_before_deadline(&pool)];
+        actual.sort_by_key(|page| page.request.page);
+        for (page, (actual, expected)) in actual.iter().zip(&expected).enumerate() {
+            assert!(actual.error.is_none(), "{workers} workers, page {page}: {:?}", actual.error);
+            assert_eq!(
+                (actual.width, actual.height, &actual.rgba),
+                (expected.width, expected.height, &expected.rgba),
+                "{workers} workers, page {page}"
+            );
+        }
+    }
+}
+
+#[test]
+fn pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over() {
+    let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
+    let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, ..Default::default() });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    // The same bytes as hayro's own render to a pixmap, with the same settings.
+    let pdf = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
+    let pages = pdf.pages();
+    let page = pages.first().expect("a page");
+    let rs = RenderSettings { x_scale: 2.0, y_scale: 2.0, width: Some(200), height: Some(100), bg_color: WHITE, ..Default::default() };
+    let plain = hayro::render(page, &RenderCache::new(), &RenderConfig::default().settings(), &rs);
+    assert_eq!((out.width, out.height), (200, 100));
+    assert_eq!(&*out.rgba, plain.data_as_u8_slice());
+    // Whole pixels, aligned, handed over without a copy.
+    let at = out.rgba.as_ptr();
+    assert_eq!(at as usize % 4, 0);
+    let words = out.rgba.into_words();
+    assert_eq!(words.as_ptr().cast::<u8>(), at);
+}
+
+#[test]
+fn render_into_a_buffer_of_the_wrong_length_leaves_it_untouched() {
+    let pdf = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
+    let pages = pdf.pages();
+    let page = pages.first().expect("a page");
+    let rs = RenderSettings { width: Some(10), height: Some(10), bg_color: WHITE, ..Default::default() };
+    let settings = RenderConfig::default().settings();
+    for len in [0, 399, 401, 4000] {
+        let mut buf = vec![7u8; len];
+        render_into(page, &RenderCache::new(), &settings, &rs, &mut buf);
+        assert!(buf.iter().all(|&b| b == 7), "a {len}-byte buffer was written");
+    }
+}
+
+#[test]
+fn missing_page_and_garbage_input_fail_gracefully() {
+    let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
+    assert!(r.render(RenderRequest { page: 9, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }).error.is_some());
+    let mut g = PageRenderer::new(Arc::new(b"not a pdf at all".to_vec()), RenderConfig::default());
+    assert_eq!(g.page_count(), 0);
+    assert!(g.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }).error.is_some());
+}
+
+#[test]
+fn scale_is_clamped_for_huge_pages() {
+    // A 200-inch-square page at 4x would be 57,600 px per side.
+    let s = effective_scale(14_400.0, 14_400.0, 4.0);
+    assert!(14_400.0 * s <= MAX_SIDE + 0.5);
+    assert!((14_400.0 * s).powi(2) <= MAX_PIXELS * 1.01);
+}
+
+#[test]
+fn strict_whole_page_render_refuses_cap_reduction_but_tiles_remain_available() {
+    let pdf = b"%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 14400 14400] /Contents 4 0 R >> endobj
+4 0 obj << /Length 0 >> stream
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let config = RenderConfig { reject_oversize: true, ..RenderConfig::default() };
+    let mut renderer = PageRenderer::new(Arc::new(pdf.to_vec()), config);
+    let whole = renderer.render(RenderRequest { page: 0, scale: 4.0, ..Default::default() });
+    assert!(whole.error.as_deref().is_some_and(|error| error.contains("exceeds renderer limits")));
+    let tile = renderer.render(RenderRequest { page: 0, tile: Some(Tile { x: 0, y: 0, w: 32, h: 32 }), scale: 4.0, ..Default::default() });
+    assert!(tile.error.is_none(), "tiled rendering must remain available: {:?}", tile.error);
+    assert_eq!((tile.width, tile.height), (32, 32));
+}
+
+fn allocation_budget_page(width: f32, height: f32, content: &str) -> Arc<Vec<u8>> {
+    Arc::new(format!("%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {width} {height}] /Contents 4 0 R >> endobj\n4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF", content.len()).into_bytes())
+}
+
+#[test]
+fn rounded_pixel_budget_rejects_before_actual_allocation() {
+    use crate::pixels::allocation_probe::{Attempts, observe};
+    for reject_oversize in [false, true] {
+        let mut renderer = PageRenderer::new(allocation_budget_page(8000.5, 7999.5, ""), RenderConfig { reject_oversize, ..Default::default() });
+        assert_eq!(renderer.page_count(), 1);
+        let (out, attempts) = observe(|| renderer.render(RenderRequest { scale: 1.0, ..Default::default() }));
+        assert_eq!(attempts, Attempts::default(), "rounded over-cap raster reached allocator; strict={reject_oversize}");
+        assert_eq!(out.error.as_deref(), Some("page 1 raster size 8001x8000 exceeds renderer pixel limit"));
+        assert_eq!((out.width, out.height), (0, 0));
+        assert!(out.rgba.is_empty());
+        assert_eq!(renderer.stats().parser_builds, 1, "normal rejection must not trigger panic recovery");
+    }
+}
+
+#[test]
+fn rounded_pixel_budget_allows_exact_cap_to_reach_allocator() {
+    use crate::pixels::allocation_probe::{Attempts, observe};
+    for reject_oversize in [false, true] {
+        let mut renderer = PageRenderer::new(allocation_budget_page(8000.0, 8000.0, ""), RenderConfig { reject_oversize, ..Default::default() });
+        let (out, attempts) = observe(|| renderer.render(RenderRequest { scale: 1.0, ..Default::default() }));
+        assert_eq!(attempts, Attempts { calls: 1, first: Some((8000, 8000)) });
+        // The test probe refuses the actual allocation: this is admission evidence,
+        // not a successful giant-raster rendering or a 256MB test allocation.
+        assert_eq!(out.error.as_deref(), Some("page 1 is too large to render"));
+        assert_eq!((out.width, out.height), (0, 0));
+        assert!(out.rgba.is_empty());
+        assert_eq!(renderer.stats().parser_builds, 1);
+    }
+}
+
+#[test]
+fn rounded_pixel_budget_preserves_small_pixels_and_large_page_tiles() {
+    let mut previous = None;
+    for reject_oversize in [false, true] {
+        let config = RenderConfig { reject_oversize, ..Default::default() };
+        let mut small = PageRenderer::new(allocation_budget_page(16.0, 12.0, "0 0 1 rg 4 3 8 6 re f"), config.clone());
+        let out = small.render(RenderRequest { scale: 1.0, ..Default::default() });
+        assert!(out.error.is_none(), "{:?}", out.error);
+        assert_eq!((out.width, out.height), (16, 12));
+        let expected: Vec<u8> = (0..12)
+            .flat_map(|y| {
+                (0..16).flat_map(move |x| if (4..12).contains(&x) && (3..9).contains(&y) { [0, 0, 255, 255] } else { [255, 255, 255, 255] })
+            })
+            .collect();
+        assert_eq!(&*out.rgba, expected.as_slice());
+        if let Some(previous) = &previous {
+            assert_eq!(previous, &out.rgba);
+        }
+        previous = Some(out.rgba);
+        let mut large = PageRenderer::new(allocation_budget_page(8000.5, 7999.5, ""), config);
+        let tile = large.render(RenderRequest { scale: 1.0, tile: Some(Tile { x: 0, y: 0, w: 32, h: 32 }), ..Default::default() });
+        assert!(tile.error.is_none(), "{:?}", tile.error);
+        assert_eq!((tile.width, tile.height), (32, 32));
+        assert_eq!(&*tile.rgba, &[255; 32 * 32 * 4]);
+        assert_eq!(large.stats().parser_builds, 1);
+    }
+}
+
+#[test]
+fn rounded_pixel_budget_invalid_requests_never_reach_allocator() {
+    use crate::pixels::allocation_probe::{Attempts, observe};
+    for reject_oversize in [false, true] {
+        let mut renderer = PageRenderer::new(allocation_budget_page(16.0, 12.0, ""), RenderConfig { reject_oversize, ..Default::default() });
+        let (out, attempts) = observe(|| renderer.render(RenderRequest { page: 1, scale: 1.0, ..Default::default() }));
+        assert_eq!(attempts, Attempts::default());
+        assert!(out.error.is_some());
+        assert_eq!((out.width, out.height), (0, 0));
+        assert!(out.rgba.is_empty());
+        assert_eq!(renderer.stats().parser_builds, 1);
+    }
+    let mut renderer = PageRenderer::new(allocation_budget_page(16.0, 12.0, ""), RenderConfig { reject_oversize: true, ..Default::default() });
+    for scale in [0.0, -1.0, f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+        let (out, attempts) = observe(|| renderer.render(RenderRequest { scale, ..Default::default() }));
+        assert_eq!(attempts, Attempts::default());
+        assert!(out.error.as_deref().is_some_and(|error| error.contains("exceeds renderer limits")));
+        assert_eq!((out.width, out.height), (0, 0));
+        assert!(out.rgba.is_empty());
+        assert_eq!(renderer.stats().parser_builds, 1);
+    }
+}
+
+/// Issue #102: an A4 page (595.28×841.89 pt) rendered 595×841 at 72 dpi, dropping the last
+/// partial row and column. Like pdftoppm it is now 596×842, the edge pixels partly covered.
+#[test]
+fn fractional_page_sizes_round_up() {
+    let pdf = b"%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 595.28 841.89] /Contents 4 0 R >> endobj
+4 0 obj << /Length 31 >> stream
+0 0 1 rg 0 0 595.28 841.89 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
+    let req = RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() };
+    let p = r.render(req);
+    assert!(p.error.is_none(), "{:?}", p.error);
+    assert_eq!((p.width, p.height), (596, 842));
+    let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    assert_eq!(px(594, 840), vec![0, 0, 255, 255]);
+    // The partial column and row blend the fill into the white page.
+    for (x, y) in [(595, 400), (300, 841), (595, 841)] {
+        let c = px(x, y);
+        assert!(c[0] < 255 && c[2] == 255, "({x}, {y}) is not partly covered: {c:?}");
+    }
+    assert_eq!(r.render(RenderRequest { scale: 300.0 / 72.0, ..req }).width, 2481);
+    // A tile over the corner draws the same edge pixels.
+    let t = r.render(RenderRequest { tile: Some(Tile { x: 594, y: 840, w: 2, h: 2 }), ..req });
+    assert_eq!((t.width, t.height), (2, 2));
+    assert_eq!(&t.rgba[12..16], &px(595, 841)[..]);
+    // Float noise doesn't add a row: Letter at 150 dpi is 1275 px wide.
+    assert_eq!((device_pixels(612.0, 150.0 / 72.0), device_pixels(0.2, 1.0), device_pixels(f32::NAN, 1.0)), (1275, 1, 1));
+}
+
+/// A checkbox whose `/AP /N` is a state dictionary must draw the `/AS` state; a NoView
+/// annotation must not draw at all. (Regression test for the vendored hayro patch.)
+#[test]
+fn widget_appearance_states() {
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R 7 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /T (cb) /V /Yes /AS /Yes /Rect [10 10 30 30]
+   /AP << /N << /Yes 5 0 R /Off 6 0 R >> >> >> endobj
+5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
+1 0 0 rg 0 0 20 20 re f
+endstream endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
+0 0 1 rg 0 0 20 20 re f
+endstream endobj
+7 0 obj << /Type /Annot /Subtype /Square /F 32 /Rect [60 60 90 90] /AP << /N 8 0 R >> >> endobj
+8 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 24 >> stream
+0 1 0 rg 0 0 30 30 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
+    let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(p.error.is_none(), "{:?}", p.error);
+    let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    assert_eq!(px(20, 80), vec![255, 0, 0, 255], "checkbox must show its /Yes state");
+    assert_eq!(px(75, 25), vec![255, 255, 255, 255], "NoView annotation must not be drawn");
+}
+
+/// Quartz writes `/AP /N` as an indirect dictionary of states, and the next object in
+/// the file is often some other stream. That dictionary must not be read as that stream,
+/// or the checkbox (whose real appearance is `/AS`) is skipped.
+#[test]
+fn indirect_appearance_state_dict_is_not_another_stream() {
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /T (cb) /V /Yes /AS /Yes /Rect [10 10 30 30]
+   /AP 9 0 R >> endobj
+9 0 obj << /N 10 0 R >> endobj
+10 0 obj << /Yes 5 0 R /Off 6 0 R >> endobj
+11 0 obj << /Length 24 >> stream
+0 0 1 rg 0 0 20 20 re f
+endstream
+endobj
+5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
+1 0 0 rg 0 0 20 20 re f
+endstream
+endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
+0 1 0 rg 0 0 20 20 re f
+endstream
+endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
+    let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(p.error.is_none(), "{:?}", p.error);
+    let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    assert_eq!(px(20, 80), vec![255, 0, 0, 255], "checkbox must show the /Yes appearance, not the decoy stream");
+}
+
+/// Microsoft Reporting Services (bank statements, invoices) writes `stream \r\n`, a space
+/// before the line break. The content stream was then taken to start at the space and the
+/// page rendered blank, while Preview, Chrome and Poppler showed it. Vendored hayro-syntax
+/// patch: spaces and tabs before the line break are skipped, with the right `/Length` and
+/// with a wrong one. Spaces with no line break after them never start stream data.
+#[test]
+fn space_before_the_line_break_after_stream_still_renders() {
+    let pdf = |eol: &str, length: u32| {
+        format!(
+            "%PDF-1.3\r\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\r\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\r\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R >> endobj\r\n\
+                 4 0 obj << /Length {length} >> stream{eol}0 0 0 rg 20 20 60 60 re f\r\nendstream\r\nendobj\r\n\
+                 trailer << /Root 1 0 R >>\r\n%%EOF"
+        )
+        .into_bytes()
+    };
+    for (eol, length) in [(" \r\n", 25), (" \n", 25), ("\t \r", 25), (" \r\n", 999), ("\r\n", 25)] {
+        let mut r = PageRenderer::new(Arc::new(pdf(eol, length)), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{eol:?}: {:?}", p.error);
+        let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+        assert_eq!(px(50, 50), vec![0, 0, 0, 255], "stream{eol:?} (/Length {length}) must draw the square");
+        assert_eq!(px(5, 5), vec![255, 255, 255, 255], "outside the square stays white");
+    }
+}
+
+/// An appearance whose /BBox is a line or a point, or whose /Matrix collapses it to one, has
+/// no mapping onto the annotation's /Rect: the scale (/Rect size over transformed box size)
+/// divided by zero, and the infinite or NaN matrix reached the device with everything the
+/// appearance drew. Vendored hayro-interpret patch: such appearances are skipped. Clipped to
+/// their box they show nothing, and MuPDF and Poppler draw nothing for them either.
+#[test]
+fn degenerate_annotation_appearances_are_skipped() {
+    use hayro::hayro_interpret::font::Glyph;
+    use hayro::hayro_interpret::hayro_syntax::Pdf;
+    use hayro::hayro_interpret::{
+        BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, Paint, PathDrawMode, SoftMask, TransformExt, interpret_page,
+    };
+    use kurbo::{Affine, BezPath, Rect};
+
+    /// Counts the geometry that reaches a device, and how much of it is not finite.
+    #[derive(Default)]
+    struct Geometry {
+        drawn: usize,
+        non_finite: usize,
+    }
+    impl Geometry {
+        fn see(&mut self, finite: bool) {
+            self.drawn += 1;
+            self.non_finite += usize::from(!finite);
+        }
+    }
+    impl<'a> Device<'a> for Geometry {
+        fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+        fn set_blend_mode(&mut self, _: BlendMode) {}
+        fn draw_path(&mut self, path: &BezPath, transform: Affine, _: &Paint<'a>, _: &PathDrawMode) {
+            self.see(path.is_finite() && transform.is_finite());
+        }
+        fn push_clip_path(&mut self, clip: &ClipPath) {
+            self.see(clip.path.is_finite());
+        }
+        fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
+        fn draw_glyph(&mut self, _: &Glyph<'a>, transform: Affine, glyph_transform: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {
+            self.see(transform.is_finite() && glyph_transform.is_finite());
+        }
+        fn draw_image(&mut self, _: Image<'a, '_>, transform: Affine) {
+            self.see(transform.is_finite());
+        }
+        fn pop_clip_path(&mut self) {}
+        fn pop_transparency_group(&mut self) {}
+    }
+
+    let pdf = |form: &str| {
+        let content = "1 0 0 rg 0 0 20 20 re f BT /F1 12 Tf 2 5 Td (Hi) Tj ET";
+        format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Square /Rect [10 10 60 40] /AP << /N 5 0 R >> >> endobj
+5 0 obj << /Type /XObject /Subtype /Form {form} /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> >> /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        )
+    };
+    let geometry = |bytes: &[u8]| {
+        let parsed = Pdf::new(Arc::new(bytes.to_vec())).expect("parses");
+        let page = &parsed.pages()[0];
+        let cache = InterpreterCache::new();
+        let initial = page.initial_transform(true).to_kurbo();
+        let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, 100.0, 100.0), &cache, page.xref(), InterpreterSettings::default());
+        let mut device = Geometry::default();
+        interpret_page(page, &mut ctx, &mut device);
+        device
+    };
+    let render = |bytes: Vec<u8>| {
+        let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+        r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() })
+    };
+    for (case, form) in [
+        ("zero-width /BBox", "/BBox [0 0 0 20]"),
+        ("zero-height /BBox", "/BBox [0 0 20 0]"),
+        ("point /BBox", "/BBox [5 5 5 5]"),
+        ("/Matrix with a zero column", "/BBox [0 0 20 20] /Matrix [0 0 0 1 0 0]"),
+        ("/Matrix with a zero row", "/BBox [0 0 20 20] /Matrix [1 0 0 0 0 0]"),
+    ] {
+        let bytes = pdf(form).into_bytes();
+        let device = geometry(&bytes);
+        assert_eq!(device.non_finite, 0, "{case}: {} of {} drawing calls were not finite", device.non_finite, device.drawn);
+        let p = render(bytes);
+        assert!(p.error.is_none(), "{case}: {:?}", p.error);
+        assert!(p.rgba.as_chunks::<4>().0.iter().all(|c| *c == [255, 255, 255, 255]), "{case}: nothing is drawn");
+    }
+
+    // A valid appearance still reaches the device, and fills its /Rect and only its /Rect.
+    let valid = pdf("/BBox [0 0 20 20]").into_bytes();
+    let device = geometry(&valid);
+    assert!(device.drawn >= 4 && device.non_finite == 0, "{} drawn, {} non-finite", device.drawn, device.non_finite);
+    let p = render(valid);
+    assert!(p.error.is_none(), "{:?}", p.error);
+    let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    assert_eq!(px(11, 61), vec![255, 0, 0, 255]);
+    assert_eq!(px(58, 88), vec![255, 0, 0, 255]);
+    assert_eq!(px(61, 75), vec![255, 255, 255, 255], "right of /Rect");
+    assert_eq!(px(30, 58), vec![255, 255, 255, 255], "above /Rect");
+}
+
+/// ISO 32000-2 §12.5.5: the transformed appearance box is scaled and translated so that its
+/// lower-left and upper-right corners land on those of /Rect. The translation ignored the
+/// scale, so a box that doesn't start at the origin and differs in size from /Rect was drawn
+/// shifted, partly outside /Rect (vendored hayro-interpret patch). MuPDF, Poppler, PDFium and
+/// pdf.js fill /Rect exactly for each of these.
+#[test]
+fn annotation_appearance_box_maps_onto_rect() {
+    let filled = |form: &str, content: &str| {
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Square /Rect [10 10 60 40] /AP << /N 5 0 R >> >> endobj
+5 0 obj << /Type /XObject /Subtype /Form {form} /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{form}: {:?}", p.error);
+        // The bounding box of everything drawn, in device pixels.
+        let (mut x0, mut y0, mut x1, mut y1) = (u32::MAX, u32::MAX, 0, 0);
+        for y in 0..p.height {
+            for x in 0..p.width {
+                if p.rgba[((y * p.width + x) * 4) as usize..][..4] != [255, 255, 255, 255] {
+                    (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
+                }
+            }
+        }
+        (x0, y0, x1, y1)
+    };
+    // /Rect [10 10 60 40] is device x 10..=59, y 60..=89.
+    let rect = (10, 60, 59, 89);
+    for (form, content) in [
+        ("/BBox [10 10 30 30]", "1 0 0 rg 10 10 20 20 re f"),
+        ("/BBox [0 0 20 20] /Matrix [1 0 0 1 10 10]", "1 0 0 rg 0 0 20 20 re f"),
+        ("/BBox [-20 -5 0 15]", "1 0 0 rg -20 -5 20 20 re f"),
+        // Unchanged: a box at the origin, and an offset box as large as /Rect.
+        ("/BBox [0 0 20 20]", "1 0 0 rg 0 0 20 20 re f"),
+        ("/BBox [100 100 150 130]", "1 0 0 rg 100 100 50 30 re f"),
+    ] {
+        assert_eq!(filled(form, content), rect, "{form}");
+    }
+}
+
+/// #2583, #1869: a sticky note carries the NoRotate flag (`/F` bit 5), so on a page with
+/// `/Rotate` its icon stays upright as displayed, turned about the upper-left corner of its
+/// `/Rect`, which stays where it is on the page (ISO 32000-2 §12.5.3). It was drawn turned with
+/// the page, in `/Rect` as displayed (vendored hayro-interpret patch 37). A note without the
+/// flag still turns with the page. `Annotation::shown_rect` is where the UI hit-tests the
+/// note, and must be where it is drawn.
+#[test]
+fn no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages() {
+    // A 30 × 20 appearance: red in its top-left quarter, blue elsewhere.
+    let content = "0 0 1 rg 0 0 30 20 re f 1 0 0 rg 0 10 15 10 re f";
+    for rotation in [0u16, 90, 180, 270] {
+        let objects = [
+            "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+            format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 140] /Rotate {rotation} /Annots [4 0 R 5 0 R] >>"),
+            // NoRotate (and Print), as PdfCraft and Acrobat save notes.
+            "<< /Type /Annot /Subtype /Text /F 20 /Rect [40 50 70 70] /AP << /N 6 0 R >> >>".to_string(),
+            // The same appearance without the flag.
+            "<< /Type /Annot /Subtype /Text /F 4 /Rect [120 50 150 70] /AP << /N 6 0 R >> >>".to_string(),
+            format!("<< /Type /XObject /Subtype /Form /BBox [0 0 30 20] /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        ];
+        let mut pdf = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, object) in objects.iter().enumerate() {
+            offsets.push(pdf.len());
+            pdf.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = pdf.len();
+        pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+        for offset in offsets {
+            pdf.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+        }
+        pdf.extend_from_slice(format!("trailer << /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+        let pdf = Arc::new(pdf);
+        let info = crate::inspect(pdf.clone(), None).expect("opens");
+        let page = &info.pages[0];
+        assert_eq!(page.rotation, rotation);
+        let mut r = PageRenderer::new(pdf, RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+        assert!(p.error.is_none(), "{:?}", p.error);
+        // Displayed-page points are device pixels at scale 1.
+        let px = |x: f32, y: f32| -> [u8; 4] {
+            let (x, y) = (x.clamp(0.0, p.width as f32 - 1.0) as u32, y.clamp(0.0, p.height as f32 - 1.0) as u32);
+            p.rgba[((y * p.width + x) * 4) as usize..][..4].try_into().unwrap()
+        };
+        let red: fn([u8; 4]) -> bool = |c| c[0] > 200 && c[1] < 60 && c[2] < 60;
+        let blue: fn([u8; 4]) -> bool = |c| c[2] > 200 && c[0] < 60 && c[1] < 60;
+        let paper: fn([u8; 4]) -> bool = |c| c.iter().all(|v| *v > 240);
+
+        // The NoRotate note: its upper-left corner (40, 70) is the top-left of an upright
+        // 30 × 20 icon as displayed, red quarter top-left.
+        let [cx, cy] = page.user_to_view(40.0, 70.0);
+        for ((dx, dy), want, what) in [
+            ((7.5, 5.0), red, "red top-left quarter"),
+            ((22.5, 5.0), blue, "blue top-right"),
+            ((7.5, 15.0), blue, "blue bottom-left"),
+            ((22.5, 15.0), blue, "blue bottom-right"),
+            ((-3.0, 10.0), paper, "paper left of the icon"),
+            ((10.0, -3.0), paper, "paper above the icon"),
+            ((33.0, 10.0), paper, "paper right of its 30 pt width"),
+            ((10.0, 23.0), paper, "paper below its 20 pt height"),
+        ] {
+            let c = px(cx + dx, cy + dy);
+            assert!(want(c), "rotation {rotation}: NoRotate note at corner + ({dx}, {dy}) is {c:?}, want {what}");
+        }
+        let note = info.annotations.iter().find(|a| a.no_rotate).expect("the NoRotate note is listed");
+        let shown = note.shown_rect(rotation);
+        let (a, b) = (page.user_to_view(shown[0], shown[1]), page.user_to_view(shown[2], shown[3]));
+        let box_ = [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])];
+        let want = [cx, cy, cx + 30.0, cy + 20.0];
+        assert!(box_.iter().zip(want).all(|(v, w)| (v - w).abs() < 0.01), "rotation {rotation}: shown {box_:?}, drawn {want:?}");
+
+        // The note without the flag turns with the page: its red quarter stays at the
+        // user-space top-left of /Rect, at the displayed top-left only when unturned.
+        let plain = info.annotations.iter().find(|a| !a.no_rotate).expect("the plain note is listed");
+        assert_eq!(plain.shown_rect(rotation), plain.rect);
+        let [rx, ry] = page.user_to_view(127.5, 65.0);
+        let [bx, by] = page.user_to_view(142.5, 55.0);
+        assert!(red(px(rx, ry)) && blue(px(bx, by)), "rotation {rotation}: the plain note's appearance turns with the page");
+        let (a, b) = (page.user_to_view(120.0, 50.0), page.user_to_view(150.0, 70.0));
+        let corner = px(a[0].min(b[0]) + 4.0, a[1].min(b[1]) + 4.0);
+        assert_eq!(red(corner), rotation == 0, "rotation {rotation}: displayed top-left of the plain note is {corner:?}");
+    }
+}
+
+/// #1968: the highlight appearance other editors write, a transparency group whose content is
+/// filled with `/BM /Multiply`, drew as an opaque block over the text. Every `/Group` form
+/// got a layer of its own, so the Multiply blended with that layer's transparent backdrop
+/// and the layer then covered the page. Vendored hayro-interpret patch: a group that is not
+/// isolated (ISO 32000-2 §11.4.7: its elements composite with what is already on the page)
+/// and is entered at full opacity, with no soft mask and Normal blending, has no backdrop of
+/// its own to offer, so its content is drawn straight onto the page. An isolated group
+/// (`/I true`) keeps its blank backdrop, and a group entered at partial opacity still gets
+/// its layer so that opacity applies to the group as a whole.
+#[test]
+fn a_multiply_highlight_inside_a_transparency_group_keeps_the_text() {
+    // `annots`: the form drawn as the highlight's appearance; `page`: drawn from the page
+    // content instead, with the extra graphics state in front of the `Do`.
+    let render = |group: &str, annots: &str, page: &str| {
+        let content = format!("0 g 100 40 10 20 re f {page}");
+        let form = "/GS0 gs 1 1 0 rg 15 35 105 30 re f";
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R {annots} /Resources << /XObject << /Fx 6 0 R >> /ExtGState << /Half << /ca 0.5 >> >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Annot /Subtype /Highlight /Rect [15 35 120 65] /QuadPoints [15 65 120 65 15 35 120 35] /C [1 1 0] /AP << /N 6 0 R >> >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [15 35 120 65] {group} /Resources << /ExtGState << /GS0 << /BM /Multiply /CA 1 /ca 1 >> >> >> /Length {} >> stream
+{form}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len(),
+            form.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{group}: {:?}", p.error);
+        p
+    };
+    let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    let (white, black, yellow) = (vec![255, 255, 255, 255], vec![0, 0, 0, 255], vec![255, 255, 0, 255]);
+    let annots = "/Annots [5 0 R]";
+    let plain = "/Group << /S /Transparency /CS /DeviceRGB >>";
+    let explicit = "/Group << /S /Transparency /CS /DeviceRGB /I false /K false >>";
+    for group in [plain, explicit, ""] {
+        for (annots, page) in [(annots, ""), ("", "/Fx Do")] {
+            let p = render(group, annots, page);
+            assert_eq!(px(&p, 30, 50), yellow, "{group} {page}: filled with the highlight colour");
+            assert_eq!(px(&p, 105, 50), black, "{group} {page}: Multiply keeps the text underneath");
+            assert_eq!(px(&p, 150, 50), white, "{group} {page}: outside the appearance");
+        }
+    }
+    // Isolated: the group's own transparent backdrop is all the Multiply sees (§11.4.7).
+    let p = render("/Group << /S /Transparency /CS /DeviceRGB /I true >>", annots, "");
+    assert_eq!(px(&p, 105, 50), yellow, "an isolated group starts from a blank backdrop");
+    // Entered at half opacity, the group is still composited as one: half yellow over white.
+    let p = render(plain, "", "/Half gs /Fx Do");
+    let half = px(&p, 30, 50);
+    assert!(half[0] == 255 && half[1] == 255 && (120..=136).contains(&half[2]), "{half:?}");
+    assert_eq!(px(&p, 150, 50), white);
+}
+
+/// A Highlight annotation without an appearance stream (common in older and generated files)
+/// was not drawn at all. Vendored hayro-interpret patch: its /QuadPoints are filled with /C at
+/// /CA, blended with Multiply, as PdfCraft draws its own highlights (pdfcraft-annot); MuPDF,
+/// Poppler and PDFium draw these fixtures the same way. An /AP still wins, malformed
+/// /QuadPoints or no /C draw nothing, and Hidden, NoView and "Hide all comments" still apply.
+#[test]
+fn highlights_without_an_appearance_are_drawn() {
+    let render = |annot: &str, config: RenderConfig| {
+        let content = "0 g 100 40 10 20 re f";
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Annots [5 0 R] >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Annot /Subtype /Highlight /Rect [15 35 120 65] {annot} >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [15 35 120 65] /Length 24 >> stream
+0 0 1 rg 15 35 50 30 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), config);
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{annot}: {:?}", p.error);
+        p
+    };
+    let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    let (white, black, yellow) = (vec![255, 255, 255, 255], vec![0, 0, 0, 255], vec![255, 255, 0, 255]);
+    let quad = "/QuadPoints [15 65 120 65 15 35 120 35]";
+
+    let p = render(&format!("{quad} /C [1 1 0]"), RenderConfig::default());
+    assert_eq!(px(&p, 30, 50), yellow, "the quad is filled with /C");
+    assert_eq!(px(&p, 105, 50), black, "Multiply keeps what is underneath");
+    assert_eq!(px(&p, 150, 50), white, "outside the quad");
+    assert_eq!(px(&p, 30, 30), white, "above the quad");
+
+    // Two quads (one per line of text); the gap between them stays white.
+    let p = render("/QuadPoints [15 65 60 65 15 50 60 50 70 50 120 50 70 35 120 35] /C [0 1 1]", RenderConfig::default());
+    assert_eq!(px(&p, 30, 40), vec![0, 255, 255, 255]);
+    assert_eq!(px(&p, 90, 60), vec![0, 255, 255, 255]);
+    assert_eq!((px(&p, 90, 40), px(&p, 30, 60)), (white.clone(), white.clone()));
+
+    // /CA and gray /C.
+    let p = render(&format!("{quad} /C [1 0 0] /CA 0.5"), RenderConfig::default());
+    let half = px(&p, 30, 50);
+    assert!(half[0] == 255 && (126..=129).contains(&half[1]) && half[1] == half[2], "{half:?}");
+    let p = render(&format!("{quad} /C [0.5]"), RenderConfig::default());
+    let gray = px(&p, 30, 50);
+    assert!((126..=129).contains(&gray[0]) && gray[0] == gray[1] && gray[1] == gray[2], "{gray:?}");
+
+    // An appearance stream wins: the blue form, not a yellow highlight.
+    let p = render(&format!("{quad} /C [1 1 0] /AP << /N 6 0 R >>"), RenderConfig::default());
+    assert_eq!(px(&p, 30, 50), vec![0, 0, 255, 255]);
+    assert_eq!(px(&p, 90, 50), white, "no highlight outside the appearance's own drawing");
+
+    // Nothing is drawn for malformed geometry, no colour, or a hidden annotation.
+    let hide = RenderConfig { hide_comments: true, ..RenderConfig::default() };
+    for (annot, config) in [
+        ("/QuadPoints [10 10 20] /C [1 1 0]", RenderConfig::default()),
+        ("/QuadPoints [15 65 120 65 15 35 /x 35] /C [1 1 0]", RenderConfig::default()),
+        ("/QuadPoints [] /C [1 1 0]", RenderConfig::default()),
+        ("/QuadPoints 7 /C [1 1 0]", RenderConfig::default()),
+        (quad, RenderConfig::default()),
+        (&format!("{quad} /C []"), RenderConfig::default()),
+        (&format!("{quad} /C [1 1]"), RenderConfig::default()),
+        (&format!("{quad} /C [1 1 0] /F 2"), RenderConfig::default()),
+        (&format!("{quad} /C [1 1 0] /F 32"), RenderConfig::default()),
+        (&format!("{quad} /C [1 1 0]"), hide),
+    ] {
+        let p = render(annot, config);
+        assert_eq!(px(&p, 30, 50), white, "{annot}");
+        assert_eq!(px(&p, 105, 50), black, "{annot}");
+    }
+}
+
+#[test]
+fn hiding_comments_keeps_fields() {
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Annots [4 0 R 6 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (t) /Rect [10 10 30 30] /AP << /N 5 0 R >> >> endobj
+5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 24 >> stream
+1 0 0 rg 0 0 20 20 re f
+endstream endobj
+6 0 obj << /Type /Annot /Subtype /Square /F 4 /Rect [60 60 90 90] /AP << /N 7 0 R >> >> endobj
+7 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 24 >> stream
+0 1 0 rg 0 0 30 30 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let render = |hide: bool| {
+        let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig { hide_comments: hide, ..RenderConfig::default() });
+        r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() })
+    };
+    let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    let shown = render(false);
+    assert_eq!(px(&shown, 75, 25), vec![0, 255, 0, 255], "the comment is drawn");
+    let hidden = render(true);
+    assert_eq!(px(&hidden, 75, 25), vec![255, 255, 255, 255], "Hide all comments");
+    assert_eq!(px(&hidden, 20, 80), vec![255, 0, 0, 255], "fields stay");
+}
+
+/// ISO 32000-2 Table 167: Invisible hides an annotation of a type that isn't standard and
+/// nothing else; §12.5.6.14: a popup has no appearance of its own, so its `/AP` isn't painted.
+#[test]
+fn invisible_unknown_annotations_and_popups_paint_nothing() {
+    let annots = [
+        "/Subtype /MyCustomType /F 0",
+        "/Subtype /MyCustomType /F 1",
+        "/Subtype /MyCustomType /F 5",
+        "/F 1",
+        "/Subtype /Square /F 1",
+        "/Subtype /Popup /F 4 /Open true",
+    ];
+    let mut pdf = String::from("%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n");
+    pdf.push_str("2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n");
+    let refs: Vec<String> = (0..annots.len()).map(|i| format!("{} 0 R", 10 + i)).collect();
+    pdf.push_str(&format!("3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 50] /Annots [{}] >> endobj\n", refs.join(" ")));
+    pdf.push_str("4 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 24 >> stream\n0 1 0 rg 0 0 30 30 re f\nendstream endobj\n");
+    for (i, a) in annots.iter().enumerate() {
+        let x = 10 + 50 * i;
+        pdf.push_str(&format!("{} 0 obj << /Type /Annot {a} /Rect [{x} 10 {} 40] /AP << /N 4 0 R >> >> endobj\n", 10 + i, x + 30));
+    }
+    pdf.push_str("trailer << /Root 1 0 R >>\n%%EOF");
+    let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    let px = |x: u32| p.rgba[((25 * p.width + x) * 4) as usize..][..4].to_vec();
+    let (green, white) = (vec![0, 255, 0, 255], vec![255, 255, 255, 255]);
+    assert_eq!(px(25), green, "an unknown type without Invisible is drawn");
+    assert_eq!(px(75), white, "Invisible hides an unknown type");
+    assert_eq!(px(125), white, "even with the Print flag");
+    assert_eq!(px(175), white, "no Subtype is no standard type");
+    assert_eq!(px(225), green, "Invisible means nothing for a standard type");
+    assert_eq!(px(275), white, "a popup's appearance is not painted on the page");
+}
+
+#[test]
+fn inline_pool_renders_in_priority_order() {
+    let pool = RenderPool::new_inline(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
+    assert!(pool.is_inline());
+    assert!(pool.try_recv().is_none());
+    pool.set_queue(vec![
+        RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 1, ..Default::default() },
+        RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 2, ..Default::default() },
+    ]);
+    assert_eq!(pool.try_recv().map(|p| p.request.tag), Some(1));
+    assert_eq!(pool.try_recv().map(|p| (p.request.tag, p.width)), Some((2, 50)));
+    assert!(pool.try_recv().is_none());
+}
+
+#[test]
+fn dropping_the_pool_cancels_its_renders() {
+    const TEXT: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length 35 >> stream
+BT /F1 12 Tf 20 70 Td (Hello) Tj ET
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let pool = RenderPool::new(Arc::new(ONE_PAGE.to_vec()), 1, RenderConfig::default());
+    let flag = lock(&pool.shared.stop).first().cloned().expect("one worker");
+    let settings = worker_settings(&pool.config, &flag);
+    assert!(settings.cancelled.as_ref().is_some_and(|c| Arc::ptr_eq(c, &flag)));
+    let shapes = Pdf::new(Arc::new(ONE_PAGE.to_vec())).expect("parses");
+    let text = Pdf::new(Arc::new(TEXT.to_vec())).expect("parses");
+    let pages = shapes.pages();
+    let page = pages.first().expect("a page");
+    let rs = RenderSettings { bg_color: WHITE, ..Default::default() };
+    let blue = |s: &InterpreterSettings| {
+        let p = hayro::render(page, &RenderCache::new(), s, &rs).sample(20, 30);
+        [p.r, p.g, p.b, p.a] == [0, 0, 255, 255]
+    };
+    let glyphs = |s: &InterpreterSettings| crate::text::extract_page(&text, 0, s).map_or(0, |t| t.glyphs.len());
+    assert!(blue(&settings) && glyphs(&settings) == 5, "a live pool renders and reads everything");
+    drop(pool);
+    assert!(flag.load(std::sync::atomic::Ordering::Relaxed));
+    assert!(!blue(&settings) && glyphs(&settings) == 0, "once the pool is gone, interpretation stops before drawing");
+}
+
+#[test]
+fn the_watchdog_stops_the_render_it_gives_up_on() {
+    let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+    // Private parsers: a shared render's first timeout is retried privately, which would
+    // give up on (and stop) a second worker too.
+    *lock(&pool.shared.parser.state) = ParserState::Private;
+    pool.shared.parser.valid.store(false, Ordering::Release);
+    pool.set_stuck_after(std::time::Duration::ZERO);
+    let gate = render_gate(0, false);
+    *lock(&pool.shared.render_gates) = vec![gate.clone()];
+    pool.set_queue(vec![RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() }]);
+    gate.entered.wait();
+    let first = pool.try_recv().expect("the watchdog answers for the held render");
+    assert!(first.error.as_deref().is_some_and(|e| e.contains("took longer")), "{:?}", first.error);
+    // The abandoned worker is told to stop at its next operator; its replacement isn't.
+    let stop: Vec<bool> = lock(&pool.shared.stop).iter().map(|s| s.load(std::sync::atomic::Ordering::Relaxed)).collect();
+    assert_eq!(stop, vec![true, false]);
+    gate.release.wait();
+    gate.finished.wait();
+    assert!(pool.try_recv().is_none(), "the abandoned render must not publish a late result");
+}
+
+#[test]
+fn extracts_text_with_positions() {
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length 60 >> stream
+BT /F1 12 Tf 20 70 Td (Hello World) Tj 0 -30 Td (Second) Tj ET
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
+    let out = r.render(RenderRequest { page: 0, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    let t = out.text.expect("text");
+    assert_eq!(t.plain_text(), "Hello World\nSecond");
+    // "H" sits at x=20, baseline y=70 (y-up) → view y ≈ 100-70 = 30 at the baseline.
+    let h = &t.glyphs[0].rect;
+    assert!((h[0] - 20.0).abs() < 0.5 && h[1] < 30.0 && h[3] > 30.0, "{h:?}");
+    assert_eq!(t.find("world").len(), 1);
+}
+
+#[test]
+fn layer_override_hides_content() {
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R] /D << /Order [5 0 R] >> >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Properties << /L1 5 0 R >> >> >> endobj
+4 0 obj << /Length 44 >> stream
+/OC /L1 BDC 1 0 0 rg 0 0 100 100 re f EMC
+endstream endobj
+5 0 obj << /Type /OCG /Name (Red) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let px = |cfg: RenderConfig| {
+        let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), cfg);
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() });
+        p.rgba[..4].to_vec()
+    };
+    assert_eq!(px(RenderConfig::default()), vec![255, 0, 0, 255], "layer is on by default");
+    let off = RenderConfig { layers: Arc::new(vec![(5, 0, false)]), ..Default::default() };
+    assert_eq!(px(off), vec![255, 255, 255, 255], "toggled-off layer must not draw");
+}
+
+/// #2986: an optional content membership dictionary with a visibility expression (`/VE`,
+/// ISO 32000-2 §8.11.2.2) shows its content only when the expression is true, and the
+/// expression takes precedence over `/OCGs` and `/P`. It was ignored, so content under it
+/// stayed visible when its layers were hidden. A malformed expression falls back to `/OCGs`.
+#[test]
+fn visibility_expressions_decide_what_a_membership_dictionary_shows() {
+    let render = |ocmd: &str, off: &[i32]| {
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R 6 0 R] /D << /Order [5 0 R 6 0 R] >> >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Properties << /M1 7 0 R >> >> >> endobj
+4 0 obj << /Length 44 >> stream
+/OC /M1 BDC 1 0 0 rg 0 0 100 100 re f EMC
+endstream endobj
+5 0 obj << /Type /OCG /Name (A) >> endobj
+6 0 obj << /Type /OCG /Name (B) >> endobj
+7 0 obj {ocmd} endobj
+trailer << /Root 1 0 R >>
+%%EOF"
+        );
+        let layers = off.iter().map(|n| (*n, 0, false)).collect();
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig { layers: Arc::new(layers), ..Default::default() });
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 0.5, tag: 0, ..Default::default() });
+        p.rgba[..4] == [255, 0, 0, 255]
+    };
+    let and = "<< /Type /OCMD /VE [/And 5 0 R 6 0 R] >>";
+    assert!(render(and, &[]), "And: both on");
+    assert!(!render(and, &[5]), "And: one off");
+    let or = "<< /Type /OCMD /VE [/Or 5 0 R 6 0 R] >>";
+    assert!(render(or, &[5]), "Or: one on");
+    assert!(!render(or, &[5, 6]), "Or: both off");
+    let not = "<< /Type /OCMD /VE [/Not 5 0 R] >>";
+    assert!(!render(not, &[]), "Not: the group is on");
+    assert!(render(not, &[5]), "Not: the group is off");
+    let nested = "<< /Type /OCMD /VE [/And [/Not 5 0 R] 6 0 R] >>";
+    assert!(render(nested, &[5]), "nested: A off, B on");
+    assert!(!render(nested, &[]), "nested: A on");
+    // /VE wins over /OCGs and /P.
+    let both = "<< /Type /OCMD /OCGs [5 0 R] /P /AllOn /VE [/Not 5 0 R] >>";
+    assert!(render(both, &[5]), "the expression, not /P, decides");
+    // A malformed expression falls back to /OCGs and /P.
+    // So is one naming an object that isn't a listed group: a missing one, or the page
+    // (review on #2987).
+    for bad in ["[/Xor 5 0 R]", "[/Not 5 0 R 6 0 R]", "[/And]", "[5 0 R]", "[/And (5)]", "[/Or 8 0 R]", "[/Or 3 0 R]"] {
+        let ocmd = format!("<< /Type /OCMD /OCGs [5 0 R] /VE {bad} >>");
+        assert!(render(&ocmd, &[]), "{bad}: /OCGs on");
+        assert!(!render(&ocmd, &[5]), "{bad}: /OCGs off");
+    }
+    // Nesting past the limit is malformed too, and does not recurse without end.
+    let deep = format!("<< /Type /OCMD /OCGs [5 0 R] /VE {}5 0 R{} >>", "[/Not ".repeat(41), "]".repeat(41));
+    assert!(!render(&deep, &[5]), "too deep: /OCGs decides");
+}
+
+/// From `cargo xtask fuzz`: a tiling pattern with no /Resources inherits the page's, where
+/// its own name points back at it. It painted itself until the stack overflowed (vendored
+/// hayro-interpret patch: `MAX_PAINT_NESTING`). Ordinary patterns must still paint.
+#[test]
+fn self_referencing_tiling_pattern_terminates() {
+    let pdf = |pattern_body: &str| {
+        format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
+4 0 obj << /Length 30 >> stream
+/Pattern cs /P1 scn 0 0 40 40 re f
+endstream endobj
+5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Length {} >> stream
+{pattern_body}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            pattern_body.len()
+        )
+    };
+    let render = |doc: String| {
+        let mut r = PageRenderer::new(Arc::new(doc.into_bytes()), RenderConfig::default());
+        r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() })
+    };
+    let looped = render(pdf("/Pattern cs /P1 scn 0 0 10 10 re f"));
+    assert_eq!((looped.width, looped.height), (40, 40));
+    let red = render(pdf("1 0 0 rg 0 0 10 10 re f"));
+    assert!(red.error.is_none(), "{:?}", red.error);
+    assert_eq!(&red.rgba[((20 * 40 + 20) * 4)..][..4], &[255, 0, 0, 255], "a normal tiling pattern still paints");
+}
+
+#[test]
+fn tiling_pattern_form_cycles_are_bounded_and_finite_nesting_paints() {
+    let cases = [
+        ("self-cycle", "/Pattern cs /P1 scn 0 0 10 10 re f 0 0 1 rg 0 0 10 10 re f"),
+        ("pattern-form-cycle", "/F Do 0 0 1 rg 0 0 10 10 re f"),
+        ("finite-nesting", "/Pattern cs /P2 scn 0 0 10 10 re f"),
+    ];
+    let pattern_b = "0 0 1 rg 0 0 10 10 re f";
+    let form = "/Pattern cs /P1 scn 0 0 10 10 re f";
+    let page_content = "/Pattern cs /P1 scn 0 0 40 40 re f 1 0 0 rg 32 32 8 8 re f";
+    for (case, pattern_a) in cases {
+        let pdf = format!(
+            "%PDF-1.7\n\
+                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 40 40] >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R /P2 6 0 R >> /XObject << /F 7 0 R >> >> >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n\
+                 5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Length {} >> stream\n{pattern_a}\nendstream endobj\n\
+                 6 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Length {} >> stream\n{pattern_b}\nendstream endobj\n\
+                 7 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 10 10] /Length {} >> stream\n{form}\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            page_content.len(),
+            pattern_a.len(),
+            pattern_b.len(),
+            form.len()
+        )
+        .into_bytes();
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(10)).unwrap_or_else(|_| panic!("{case}: render did not finish"));
+        assert!(page.error.is_none(), "{case}: {:?}", page.error);
+        assert_eq!((page.width, page.height), (40, 40), "{case}");
+        let pixel = |x: u32, y: u32| {
+            let offset = ((y * page.width + x) * 4) as usize;
+            [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
+        };
+        assert_eq!(pixel(1, 38), [0, 0, 255, 255], "{case}: nested pattern content paints");
+        assert_eq!(pixel(35, 4), [255, 0, 0, 255], "{case}: page content after the pattern still paints");
+    }
+}
+
+/// A shaded Type 3 glyph must use bounds in device coordinates at every position.
+#[test]
+fn shaded_type3_glyph_draws_at_multiple_positions() {
+    let content = "BT /F 30 Tf 1 0 0 1 50 70 Tm (A) Tj 1 0 0 1 220 70 Tm (A) Tj ET";
+    let glyph = "100 0 d0 0 0 100 100 re W n /S sh";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 150] /Resources << /Font << /F 5 0 R >> >> /Contents 4 0 R >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 100 100] /FontMatrix [0.01 0 0 0.01 0 0] /CharProcs << /A 6 0 R >> /Encoding << /Differences [65 /A] >> /FirstChar 65 /LastChar 65 /Widths [100] /Resources << /Shading << /S 7 0 R >> >> >> endobj
+6 0 obj << /Length {} >> stream
+{glyph}
+endstream endobj
+7 0 obj << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [0 0 1] /N 1 >> /Extend [true true] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF", content.len(), glyph.len()
+    );
+    let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    for x in [65usize, 235] {
+        let pixel = &page.rgba[(65 * 300 + x) * 4..][..4];
+        assert!(pixel[0] < 240 && pixel[2] < 240 && pixel[1] < 10, "glyph at {x}: {pixel:?}");
+    }
+}
+
+/// From `cargo xtask fuzz`: a Type 3 font without /Resources inherits the page's, where its
+/// own name is defined, and its glyph shows text in itself (vendored patch:
+/// `MAX_PAINT_NESTING`). Must terminate; a normal Type 3 glyph must still paint.
+#[test]
+fn self_referencing_type3_glyph_terminates() {
+    let pdf = |proc_body: &str| {
+        format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length 31 >> stream
+BT /F1 20 Tf 10 10 Td (A) Tj ET
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 1 1] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [1]
+  /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> >> endobj
+6 0 obj << /Length {} >> stream
+{proc_body}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            proc_body.len()
+        )
+    };
+    let render = |doc: String| {
+        let mut r = PageRenderer::new(Arc::new(doc.into_bytes()), RenderConfig::default());
+        r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() })
+    };
+    let looped = render(pdf("1 0 d0 BT /F1 1 Tf (A) Tj ET 0 0 1 1 re f"));
+    assert_eq!((looped.width, looped.height), (40, 40));
+    let plain = render(pdf("1 0 d0 0 0 1 1 re f"));
+    assert!(plain.error.is_none(), "{:?}", plain.error);
+    assert!(plain.rgba.as_chunks::<4>().0.iter().any(|p| p[0] < 128), "a normal Type 3 glyph still paints");
+}
+
+/// From `cargo xtask fuzz`: a tiling pattern whose /XStep and /YStep dwarf its /BBox got a
+/// cell pixmap of `step × scale` pixels, bounded only by u16 (2 GB and more). The vendored
+/// hayro patch `tiling_cell_scale` keeps the cell within 3000 pixels a side.
+#[test]
+fn tiling_cells_stay_small_whatever_the_step() {
+    assert_eq!(hayro::tiling_cell_scale(2.0, 10.0, 3000.0), 2.0, "ordinary cells keep their scale");
+    for step in [1.0e5f32, -1.0e5, 4.0e9] {
+        let s = hayro::tiling_cell_scale(2.0, step, 3000.0);
+        assert!(s * step.abs() <= 3000.5, "{step}: {s}");
+    }
+    assert_eq!(hayro::tiling_cell_scale(2.0, f32::INFINITY, 3000.0), 2.0);
+    assert_eq!(hayro::tiling_cell_scale(2.0, 0.0, 3000.0), 2.0);
+    // End to end: such a pattern renders, and the page's other content still draws.
+    let content = "/Pattern cs /P1 scn 0 0 40 40 re f 1 0 0 rg 0 0 4 4 re f";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 100000 /YStep 100000 /Length 20 >> stream
+0 0 1 rg 0 0 10 10 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255]);
+}
+
+/// One page `w` × `h` points whose content `content` paints with pattern `/P1`: a 10 × 10 cell
+/// of blue with `/XStep step /YStep step` and pattern matrix `matrix`. Its RGBA pixels.
+fn tiling_page(w: usize, h: usize, content: &str, step: &str, matrix: &str) -> Vec<u8> {
+    let cell = "0 0 1 rg 0 0 10 10 re f";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {w} {h}] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 3 /BBox [0 0 10 10] /XStep {step} /YStep {step} /Matrix [{matrix}] /Length {} >> stream
+{cell}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len(),
+        cell.len()
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    page.rgba.to_vec()
+}
+
+/// #3349: PowerPoint (PDFMaker) writes a picture fill as a tiling pattern drawn once, with
+/// `/XStep 2147480100 /YStep 2147480100` and a matrix that flips y. Fitting such a step into
+/// a cell pixmap shrank the picture below a pixel, so it vanished. The cell's `/BBox` is drawn
+/// at full scale, once, filled or stroked: where it is it shows, and around it (left, right,
+/// above, below) nothing repeats or smears.
+#[test]
+fn a_tiling_pattern_drawn_once_shows_its_cell() {
+    let at = |px: &[u8], w: usize, x: usize, y: usize| px[(y * w + x) * 4..][..3].to_vec();
+    let (blue, white) = (vec![0, 0, 255], vec![255, 255, 255]);
+    // The cell at user x 10..20 and, flipped, y 10..20: device rows 20..30.
+    let once = tiling_page(40, 40, "/Pattern cs /P1 scn 0 0 40 40 re f", "2147480100", "1 0 0 -1 10 20");
+    assert_eq!(at(&once, 40, 15, 25), blue, "the cell");
+    for (x, y, side) in [(5, 25, "left"), (25, 25, "right"), (15, 15, "above"), (15, 35, "below")] {
+        assert_eq!(at(&once, 40, x, y), white, "nothing {side} of it");
+    }
+    // Stroked: a wide line across the cell shows it too.
+    let stroked = tiling_page(40, 40, "/Pattern CS /P1 SCN 20 w 0 15 m 40 15 l S", "2147480100", "1 0 0 -1 10 20");
+    assert_eq!(at(&stroked, 40, 15, 25), blue, "a stroke with the pattern");
+    assert_eq!(at(&stroked, 40, 25, 25), white);
+    // An ordinary step still tiles.
+    let tiled = tiling_page(40, 40, "/Pattern cs /P1 scn 0 0 40 40 re f", "20", "1 0 0 1 0 0");
+    assert_eq!(at(&tiled, 40, 25, 35), blue, "a step of 20 repeats the cell");
+}
+
+/// #3356 review: a `/BBox` too thin to divide by (not zero, which is refused, but 1e-40
+/// wide) makes the cell scale infinite; it keeps the old path, so no infinite or NaN
+/// geometry reaches the cell renderer, the page renders and what follows still draws.
+#[test]
+fn a_tiling_cell_too_thin_to_scale_keeps_the_old_path() {
+    assert!(hayro::usable_cell_scale(2.0, 1.0));
+    for (xs, ys) in [(f32::INFINITY, 1.0), (1.0, f32::NAN), (0.0, 1.0), (1.0, -2.0)] {
+        assert!(!hayro::usable_cell_scale(xs, ys), "{xs} {ys}");
+    }
+    let thin = "0.0000000000000000000000000000000000000001";
+    let content = "/Pattern cs /P1 scn 0 0 40 40 re f 1 0 0 rg 0 0 4 4 re f";
+    let cell = "0 0 1 rg 0 0 10 10 re f";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 3 /BBox [0 0 {thin} 10] /XStep 2147480100 /YStep 2147480100 /Length {} >> stream
+{cell}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len(),
+        cell.len()
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "what follows still draws");
+    assert_eq!(&page.rgba[((20 * 40 + 20) * 4)..][..3], &[255, 255, 255], "the degenerate cell draws nothing");
+}
+
+/// #3349: a step too large for a cell pixmap is drawn as one cell only when the painted area
+/// can't reach another: a page wide (or tall) enough to show the next cell, or the one before,
+/// still tiles them.
+#[test]
+fn a_large_step_still_tiles_where_the_next_cell_shows() {
+    let at = |px: &[u8], w: usize, x: usize, y: usize| px[(y * w + x) * 4..][..3].to_vec();
+    let blue = vec![0, 0, 255];
+    // Steps of 3100 points: over 3000 pixels at this scale, so the cell is shrunk to fit,
+    // by 3000/3100; a pixel 4 points into a cell is blue either way.
+    let wide = "/Pattern cs /P1 scn 0 0 3200 20 re f";
+    let next = tiling_page(3200, 20, wide, "3100", "1 0 0 1 0 0");
+    assert_eq!(at(&next, 3200, 3104, 15), blue, "the cell to the right");
+    let before = tiling_page(3200, 20, wide, "3100", "1 0 0 1 3100 0");
+    assert_eq!(at(&before, 3200, 4, 15), blue, "the cell to the left");
+    let tall = "/Pattern cs /P1 scn 0 0 20 3200 re f";
+    let above = tiling_page(20, 3200, tall, "3100", "1 0 0 1 0 0");
+    assert_eq!(at(&above, 20, 4, 3200 - 3104), blue, "the cell above");
+    let below = tiling_page(20, 3200, tall, "3100", "1 0 0 1 0 3100");
+    assert_eq!(at(&below, 20, 4, 3200 - 4), blue, "the cell below");
+    // A stroke counts with its width: this line ends at x 3080, short of the next cell at
+    // 3100, but its square cap reaches 3110.
+    let stroked = tiling_page(3200, 20, "/Pattern CS /P1 SCN 60 w 2 J 0 10 m 3080 10 l S", "3100", "1 0 0 1 0 0");
+    assert_eq!(at(&stroked, 3200, 3104, 15), blue, "the next cell, under the stroke's cap");
+    // A miter reaches further than the line width (review on #3356): this join's vertex is
+    // at x 3085, 15 short of the next cell with a 10-wide line, but its miter tip, 45 long
+    // under the default limit of 10, reaches 3130.
+    let mitered = tiling_page(3200, 20, "/Pattern CS /P1 SCN 10 w 0 j 3000 0 m 3085 10 l 3000 20 l S", "3100", "1 0 0 1 0 0");
+    // The tip narrows to a point, so this pixel is partly covered: blue, not white.
+    let tip = at(&mitered, 3200, 3104, 10);
+    assert!(tip[0] < 160 && tip[1] < 160 && tip[2] > 200, "the next cell, under the miter's tip: {tip:?}");
+    // Under a skew, a direction between the axes stretches more than either axis (review on
+    // #3356). This join's vertex is at device x 2980 and its miter tip, along that direction,
+    // at 3107: the larger axis stretch (1.118) put the reach at 3092, short of the next cell;
+    // the most any direction stretches (1.461) puts it at 3126.
+    let skewed = tiling_page(
+        3200,
+        20,
+        "/Pattern CS /P1 SCN 1 0 1 0.5 0 0 cm 20 w 0 j 2783.936 -366.118 m 3033.6 -53.6 l 2721.082 -303.264 l S",
+        "3100",
+        "1 0 0 1 0 0",
+    );
+    // The tip narrows to a point, so its pixels are partly covered.
+    let under_tip = (3100..3108).flat_map(|x| (10..20).map(move |y| (x, y))).map(|(x, y)| at(&skewed, 3200, x, y));
+    assert!(
+        under_tip.clone().any(|px| px[0] < 200 && px[1] < 200 && px[2] > 240),
+        "the next cell, under the skewed miter's tip: {:?}",
+        under_tip.collect::<Vec<_>>()
+    );
+}
+
+/// Contributor-original JPEG 2000: one unsigned 8-bit pixel per component, one tile,
+/// no decomposition, reversible wavelet, and one empty packet per component. Empty
+/// coefficients decode to the midpoint (128) after the unsigned DC level shift.
+fn jpx_midpoint_pdf(bpc: u8, components: u16) -> Vec<u8> {
+    let mut codestream = vec![0xff, 0x4f, 0xff, 0x51]; // SOC, SIZ.
+    codestream.extend_from_slice(&(38 + 3 * components).to_be_bytes());
+    codestream.extend_from_slice(&0_u16.to_be_bytes()); // Rsiz.
+    for value in [1_u32, 1, 0, 0, 1, 1, 0, 0] {
+        codestream.extend_from_slice(&value.to_be_bytes());
+    }
+    codestream.extend_from_slice(&components.to_be_bytes());
+    for _ in 0..components {
+        codestream.extend_from_slice(&[7, 1, 1]); // Eight bits, no subsampling.
+    }
+    // COD: LRCP, one layer, no transform between components, 64x64 codeblocks,
+    // zero decomposition levels, reversible wavelet. QCD: no quantization.
+    codestream.extend_from_slice(&[0xff, 0x52, 0, 12, 0, 0, 0, 1, 0, 0, 4, 4, 0, 1]);
+    codestream.extend_from_slice(&[0xff, 0x5c, 0, 4, 0x40, 0x40]);
+    codestream.extend_from_slice(&[0xff, 0x90, 0, 10, 0, 0]); // SOT, tile zero.
+    codestream.extend_from_slice(&(14 + u32::from(components)).to_be_bytes());
+    codestream.extend_from_slice(&[0, 1, 0xff, 0x93]); // One tile part, SOD.
+    codestream.extend(std::iter::repeat_n(0, usize::from(components)));
+    codestream.extend_from_slice(&[0xff, 0xd9]); // EOC.
+
+    let content = "q 20 0 0 20 5 5 cm /Im1 Do Q 1 0 0 rg 0 0 4 4 re f";
+    let mut pdf = format!(
+        "%PDF-1.7\n\
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
+4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent {bpc} /Filter /JPXDecode /Length {} >> stream\n",
+        content.len(),
+        codestream.len()
+    )
+    .into_bytes();
+    pdf.extend_from_slice(&codestream);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
+    pdf
+}
+
+/// [`jpx_midpoint_pdf`]'s codestream (every sample 128) wrapped in a JP2 file whose header
+/// has a colour specification naming enumerated colour space `enumerated`.
+fn jp2_midpoint_pdf(components: u16, enumerated: u32) -> Vec<u8> {
+    let raw = jpx_midpoint_pdf(8, components);
+    let start = raw.windows(4).position(|w| w == [0xff, 0x4f, 0xff, 0x51]).unwrap();
+    let end = raw.windows(2).rposition(|w| w == [0xff, 0xd9]).unwrap() + 2;
+    let codestream = &raw[start..end];
+    let jp2_box = |kind: &[u8], body: &[u8]| [&((8 + body.len()) as u32).to_be_bytes()[..], kind, body].concat();
+    let mut ihdr = Vec::new();
+    ihdr.extend_from_slice(&1_u32.to_be_bytes()); // height
+    ihdr.extend_from_slice(&1_u32.to_be_bytes()); // width
+    ihdr.extend_from_slice(&components.to_be_bytes());
+    ihdr.extend_from_slice(&[7, 7, 0, 0]); // 8 bits, wavelet, colour known, no IPR
+    let colr = [&[1, 0, 0][..], &enumerated.to_be_bytes()].concat();
+    let jp2 = [
+        vec![0, 0, 0, 12, b'j', b'P', b' ', b' ', 0x0d, 0x0a, 0x87, 0x0a],
+        jp2_box(b"ftyp", b"jp2 \0\0\0\0jp2 "),
+        jp2_box(b"jp2h", &[jp2_box(b"ihdr", &ihdr), jp2_box(b"colr", &colr)].concat()),
+        jp2_box(b"jp2c", codestream),
+    ]
+    .concat();
+    let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
+    let mut pdf = format!(
+        "%PDF-1.7\n\
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
+4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /Filter /JPXDecode /Length {} >> stream\n",
+        content.len(),
+        jp2.len()
+    )
+    .into_bytes();
+    pdf.extend_from_slice(&jp2);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
+    pdf
+}
+
+/// Review on #3184: a palette image whose indices are 1-bit samples (`ihdr` BPC 0, `Ssiz` 0)
+/// and whose palette holds 8-bit colours. Its colours are decoded to 8 bits; rescaling them
+/// to the indices' 1-bit precision kept only 0 or 255 per channel. Contributor-original:
+/// one 1×1 tile with an empty packet, so its one sample is the 1-bit midpoint (index 1).
+#[test]
+fn a_jp2_palette_keeps_its_colours_whatever_the_index_precision() {
+    let mut codestream = vec![0xff, 0x4f, 0xff, 0x51, 0, 41, 0, 0]; // SOC, SIZ (Lsiz 41), Rsiz.
+    for value in [1_u32, 1, 0, 0, 1, 1, 0, 0] {
+        codestream.extend_from_slice(&value.to_be_bytes());
+    }
+    codestream.extend_from_slice(&[0, 1, 0, 1, 1]); // One component: 1 bit, no subsampling.
+    codestream.extend_from_slice(&[0xff, 0x52, 0, 12, 0, 0, 0, 1, 0, 0, 4, 4, 0, 1]);
+    codestream.extend_from_slice(&[0xff, 0x5c, 0, 4, 0x40, 0x40]);
+    codestream.extend_from_slice(&[0xff, 0x90, 0, 10, 0, 0, 0, 0, 0, 15, 0, 1, 0xff, 0x93, 0]);
+    codestream.extend_from_slice(&[0xff, 0xd9]);
+    let jp2_box = |kind: &[u8], body: &[u8]| [&((8 + body.len()) as u32).to_be_bytes()[..], kind, body].concat();
+    let ihdr = [&1_u32.to_be_bytes()[..], &1_u32.to_be_bytes(), &[0, 1, 0, 7, 0, 0]].concat();
+    let colr = [&[1, 0, 0][..], &16_u32.to_be_bytes()].concat(); // sRGB
+    // pclr: two entries, three 8-bit columns: red, then (64, 128, 192).
+    let pclr = [0, 2, 3, 7, 7, 7, 255, 0, 0, 64, 128, 192];
+    // cmap: channels 0..2 come from component 0 through palette columns 0..2.
+    let cmap = [0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 2];
+    let jp2 = [
+        vec![0, 0, 0, 12, b'j', b'P', b' ', b' ', 0x0d, 0x0a, 0x87, 0x0a],
+        jp2_box(b"ftyp", b"jp2 \0\0\0\0jp2 "),
+        jp2_box(b"jp2h", &[jp2_box(b"ihdr", &ihdr), jp2_box(b"colr", &colr), jp2_box(b"pclr", &pclr), jp2_box(b"cmap", &cmap)].concat()),
+        jp2_box(b"jp2c", &codestream),
+    ]
+    .concat();
+    let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
+    // No /ColorSpace (and no /BitsPerComponent): the JP2 header gives the colours, through its
+    // palette (ISO 32000-2 §7.4.9). With an /Indexed space the image holds raw indices at
+    // their own precision, so index 1 picks the space's entry 1, not entry 255.
+    let lut = format!("FF00004080C0{}00FF00", "000000".repeat(253));
+    for colour_space in [String::new(), format!("/ColorSpace [/Indexed /DeviceRGB 255 <{lut}>] ")] {
+        let mut pdf = format!(
+            "%PDF-1.7\n\
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
+4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 {colour_space}/Filter /JPXDecode /Length {} >> stream\n",
+            content.len(),
+            jp2.len()
+        )
+        .into_bytes();
+        pdf.extend_from_slice(&jp2);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        let px = &page.rgba[((40 - 15) * 40 + 15) * 4..][..3];
+        assert!(px.iter().zip([64u8, 128, 192]).all(|(a, b)| a.abs_diff(b) <= 2), "{colour_space:.30}: entry 1: {px:?}");
+    }
+}
+
+/// #3306: a JP2 image whose colour specification names an enumerated colour space the
+/// decoder refuses (CIEJab in a veraPDF fixture, or YPbPr, or bilevel for one component) is
+/// drawn as if it had none, by its component count, as MuPDF and Poppler draw it: the
+/// midpoint image shows mid-grey instead of nothing. A space the decoder knows (sRGB) is
+/// drawn as before.
+#[test]
+fn a_jp2_image_in_a_refused_enumerated_colour_space_is_drawn() {
+    for (components, enumerated) in [(3, 19), (3, 22), (1, 15), (3, 16)] {
+        let mut r = PageRenderer::new(Arc::new(jp2_midpoint_pdf(components, enumerated)), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{enumerated}: {:?}", page.error);
+        let px = &page.rgba[((40 - 15) * 40 + 15) * 4..][..3];
+        assert!(px.iter().all(|&v| (120..=136).contains(&v)), "enum {enumerated}, {components} component(s): {px:?}");
+    }
+}
+
+#[test]
+fn jpx_stream_bit_depth_boundaries_do_not_panic() {
+    use hayro::hayro_syntax::bit_reader::BitReader;
+    use hayro::hayro_syntax::object::stream::ImageDecodeParams;
+
+    for (bpc, expected) in [(1, 1), (8, 128), (16, 32_896), (31, 1_077_952_576), (32, 2_155_905_152)] {
+        let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(bpc, 1))).unwrap();
+        let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
+        let decoded = stream.decoded_image(&ImageDecodeParams { bpc: Some(bpc), ..Default::default() }).unwrap();
+        let image = decoded.image_data.unwrap();
+        assert_eq!((image.width, image.height, image.bits_per_component), (1, 1, bpc));
+        assert_eq!(decoded.data.len(), usize::from(bpc).div_ceil(8));
+        assert_eq!(BitReader::new(&decoded.data).read(bpc), Some(expected), "{bpc}-bit midpoint");
+    }
+}
+
+#[test]
+fn jpx_streams_reject_out_of_range_bit_depths() {
+    use hayro::hayro_syntax::object::stream::ImageDecodeParams;
+
+    for bpc in [0, 33, 255] {
+        let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(bpc, 1))).unwrap();
+        let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
+        assert!(stream.decoded_image(&ImageDecodeParams { bpc: Some(bpc), ..Default::default() }).is_err());
+    }
+}
+
+#[test]
+fn jpx_gray_rgb_and_alpha_keep_eight_bit_samples() {
+    use hayro::hayro_syntax::object::stream::ImageDecodeParams;
+
+    for components in [1, 3, 4] {
+        let pdf = Pdf::new(Arc::new(jpx_midpoint_pdf(8, components))).unwrap();
+        let stream = pdf.objects().into_iter().filter_map(|object| object.into_stream()).find(|stream| !stream.filters().is_empty()).unwrap();
+        let decoded = stream.decoded_image(&ImageDecodeParams::default()).unwrap();
+        let expected_colors = usize::from(components.min(3));
+        assert_eq!(decoded.data.as_ref(), vec![128; expected_colors]);
+        let alpha = decoded.image_data.unwrap().alpha;
+        assert_eq!(alpha, (components == 4).then(|| vec![128]));
+    }
+}
+
+#[test]
+fn jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering() {
+    for bpc in [8, 32] {
+        let mut renderer = PageRenderer::new(Arc::new(jpx_midpoint_pdf(bpc, 1)), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{bpc} bits: {:?}", page.error);
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "other page content draws");
+        if bpc == 8 {
+            assert_eq!(&page.rgba[((25 * 40 + 15) * 4)..][..4], &[128, 128, 128, 255], "the valid image paints gray");
+        }
+    }
+}
+
+/// From the nightly `cargo xtask fuzz` (CI caps each child at 4 GiB): a stencil mask claiming
+/// /W 4294967295 and a CCITT image claiming /Columns 4294967295 each allocated 4 GiB while
+/// decoding (locally: 9.6 GB and 4.3 GB). Vendored hayro patches `image_size_ok` and
+/// `ccitt_size_ok` refuse such sizes before decoding; the rest of the page still draws.
+#[test]
+fn absurd_mask_and_fax_sizes_are_refused_before_decoding() {
+    assert!(hayro::hayro_interpret::image_size_ok(8000, 8000));
+    assert!(!hayro::hayro_interpret::image_size_ok(4_294_967_295, 2));
+    assert!(!hayro::hayro_interpret::image_size_ok(0, 10));
+    assert!(hayro::hayro_syntax::ccitt_size_ok(1728, 2200), "a fax page");
+    assert!(!hayro::hayro_syntax::ccitt_size_ok(4_294_967_295, 26));
+    assert!(!hayro::hayro_syntax::ccitt_size_ok(1 << 19, 1 << 12));
+    let page = |content: &str, xobject: &str| {
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj {xobject} endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("an absurd image must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+    };
+    let red = "1 0 0 rg 0 0 4 4 re f";
+    page(&format!("q 20 0 0 20 5 5 cm BI /W 4294967295 /H 2 /IM true /BPC 1 ID \u{0}\u{ff}\u{ff}\u{0} EI Q {red}"), "<< >>");
+    let fax = "<< /Type /XObject /Subtype /Image /Width 81 /Height 26 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /CCITTFaxDecode /DecodeParms << /Columns 4294967295 /Rows 26 /K -1 >> /Length 4 >> stream\n\u{0}\u{0}\u{0}\u{0}\nendstream";
+    page(&format!("q 20 0 0 20 5 5 cm /Im1 Do Q {red}"), fax);
+}
+
+/// Scanners and fax services write Group 4 pages with `/Rows 0`, which ISO 32000-2 Table 11
+/// defines as "height not predetermined" (the default), not as zero rows. Such a page used to
+/// render blank. The image is an 8 × 4 all-black Group 4 stream, hand-encoded from ITU-T T.6:
+/// one horizontal-mode row (white 0, black 8), three V0 rows, then EOFB.
+#[test]
+fn group4_fax_with_rows_zero_decodes_to_the_image_height() {
+    const ALL_BLACK_8X4: [u8; 6] = [0x26, 0xa2, 0xfe, 0x00, 0x20, 0x02];
+    for rows in ["", "/Rows 4", "/Rows 0"] {
+        let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
+        let mut pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /CCITTFaxDecode /DecodeParms << /K -1 /Columns 8 {rows} >> /Length {} >> stream\n",
+            content.len(),
+            ALL_BLACK_8X4.len()
+        )
+        .into_bytes();
+        pdf.extend_from_slice(&ALL_BLACK_8X4);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
+        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{rows:?}: {:?}", page.error);
+        assert_eq!(&page.rgba[((24 * 40 + 15) * 4)..][..4], &[0, 0, 0, 255], "{rows:?}: the fax image paints black");
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 255, 255, 255], "{rows:?}: outside the image stays white");
+    }
+}
+
+/// #3308: a fax image whose `/Rows` says fewer rows than its `/Height` (a plotter driver wrote
+/// `/Rows` equal to `/Columns`) is decoded to its height: only the first `/Rows` rows were
+/// decoded and the rest drawn black, as MuPDF and Acrobat don't. `/BlackIs1` turns the fixture
+/// white, so rows left undecoded show as black. Also through an `/Indexed` colour space, the
+/// filter's other output path.
+#[test]
+fn group4_fax_with_rows_below_its_height_decodes_to_the_image_height() {
+    const ALL_BLACK_8X4: [u8; 6] = [0x26, 0xa2, 0xfe, 0x00, 0x20, 0x02];
+    for (space, rows) in [("/DeviceGray", "/Rows 2"), ("[/Indexed /DeviceRGB 1 <000000FFFFFF>]", "/Rows 2"), ("/DeviceGray", "/Rows 4")] {
+        let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
+        let mut pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace {space} /BitsPerComponent 1 /Filter /CCITTFaxDecode /DecodeParms << /K -1 /Columns 8 {rows} /BlackIs1 true >> /Length {} >> stream
+",
+            content.len(),
+            ALL_BLACK_8X4.len()
+        )
+        .into_bytes();
+        pdf.extend_from_slice(&ALL_BLACK_8X4);
+        pdf.extend_from_slice(
+            b"
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        );
+        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{space} {rows}: {:?}", page.error);
+        for y in [17, 22, 27, 32] {
+            assert_eq!(&page.rgba[((y * 40 + 15) * 4)..][..4], &[255, 255, 255, 255], "{space} {rows}: image row at y {y} is decoded");
+        }
+    }
+}
+
+#[test]
+fn tiff_predictor_packed_rgb_rows_keep_their_byte_boundaries() {
+    use hayro_syntax::object::{FromBytes, Object};
+    use std::io::Write;
+
+    // Red then green, with only the real sample bits compared: row padding may change.
+    // The three-column case also checks horizontal differencing: red/green/blue and
+    // green/red/blue, whose one-bit component differences wrap modulo two.
+    struct RowCase {
+        bpc: u8,
+        columns: u32,
+        encoded: &'static [u8],
+        expected: &'static [u8],
+        masks: &'static [u8],
+    }
+    let cases = [
+        RowCase { bpc: 1, columns: 1, encoded: &[0x80, 0x40], expected: &[0x80, 0x40], masks: &[0xe0] },
+        RowCase { bpc: 2, columns: 1, encoded: &[0xc0, 0x30], expected: &[0xc0, 0x30], masks: &[0xfc] },
+        RowCase { bpc: 4, columns: 1, encoded: &[0xf0, 0, 0x0f, 0], expected: &[0xf0, 0, 0x0f, 0], masks: &[0xff, 0xf0] },
+        RowCase { bpc: 1, columns: 3, encoded: &[0x99, 0x80, 0x5a, 0x80], expected: &[0x88, 0x80, 0x50, 0x80], masks: &[0xff, 0x80] },
+        RowCase { bpc: 8, columns: 1, encoded: &[255, 0, 0, 0, 255, 0], expected: &[255, 0, 0, 0, 255, 0], masks: &[0xff, 0xff, 0xff] },
+    ];
+    for RowCase { bpc, columns, encoded, expected, masks } in cases {
+        let mut encoder = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+        encoder.write_all(encoded).unwrap();
+        let compressed = encoder.finish().unwrap();
+        let mut bytes = format!(
+            "<< /Filter /FlateDecode /DecodeParms << /Predictor 2 /Colors 3 /BitsPerComponent {bpc} /Columns {columns} >> /Length {} >> stream\n",
+            compressed.len()
+        )
+        .into_bytes();
+        bytes.extend_from_slice(&compressed);
+        bytes.extend_from_slice(b"\nendstream");
+        let Object::Stream(stream) = Object::from_bytes(&bytes).unwrap() else { panic!("stream expected") };
+        let decoded = stream.decoded().unwrap();
+        assert_eq!(decoded.len(), expected.len());
+        for ((actual, expected), mask) in decoded.iter().zip(expected).zip(masks.iter().cycle()) {
+            assert_eq!(actual & mask, *expected, "{bpc}-bit RGB, {columns} columns");
+        }
+    }
+}
+
+#[test]
+fn tiff_predictor_packed_rgb_image_renders_every_row() {
+    use std::io::Write;
+
+    let mut encoder = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+    encoder.write_all(&[0x80, 0x40]).unwrap();
+    let compressed = encoder.finish().unwrap();
+    let content = "q 40 0 0 40 0 0 cm /Im1 Do Q";
+    let mut pdf = format!(
+        "%PDF-1.7\n\
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
+4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 1 /Filter /FlateDecode /DecodeParms << /Predictor 2 /Colors 3 /BitsPerComponent 1 /Columns 1 >> /Length {} >> stream\n",
+        content.len(),
+        compressed.len()
+    )
+    .into_bytes();
+    pdf.extend_from_slice(&compressed);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (40, 40));
+    let pixel = |y: usize| &page.rgba[((y * 40 + 20) * 4)..][..4];
+    assert_eq!(pixel(10), &[255, 0, 0, 255]);
+    assert_eq!(pixel(30), &[0, 255, 0, 255]);
+}
+
+/// From the nightly `cargo xtask fuzz`: a FlateDecode predictor with `/Columns
+/// 9223372036854775807` wrapped to a 2^61-byte row allocation (an abort on any machine), and
+/// a line width of 9223372036854775807 made stroke expansion allocate 10 GB. Vendored hayro
+/// patches: saturating predictor rows refused when longer than the data, and stroke widths
+/// clamped to a few canvases. The page still renders, with the huge stroke covering it.
+#[test]
+fn absurd_predictor_columns_and_line_widths_render() {
+    let render = |streams: &[&str]| {
+        let mut objs = String::new();
+        let mut refs = Vec::new();
+        for (i, s) in streams.iter().enumerate() {
+            let n = 4 + i;
+            refs.push(format!("{n} 0 R"));
+            objs.push_str(&format!("{n} 0 obj {s} endobj\n"));
+        }
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [{}] >> endobj
+{objs}trailer << /Root 1 0 R >>
+%%EOF",
+            refs.join(" ")
+        );
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        page
+    };
+    let plain = |content: &str| format!("<< /Length {} >> stream\n{content}\nendstream", content.len());
+    // Stored (uncompressed) zlib data, so the stream needs no encoder: header, one final
+    // stored block of two bytes, checksum.
+    let predicted = "<< /Filter /FlateDecode /DecodeParms << /Predictor 12 /Columns 9223372036854775807 >> /Length 13 >> stream\nx\u{1}\u{1}\u{2}\u{0}\u{fd}\u{ff}\u{0}\u{0}\u{0}\u{1}\u{0}\u{1}\nendstream";
+    let page = render(&[predicted, &plain("1 0 0 rg 0 0 4 4 re f")]);
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the other content stream draws");
+    let page = render(&[&plain("1 0 0 RG 9223372036854775807 w 10 20 m 30 20 l S")]);
+    // Butt caps: the stroke covers the band over the segment (x 10 to 30) top to bottom.
+    for (x, y) in [(20, 0), (20, 39), (12, 0), (28, 39)] {
+        assert_eq!(&page.rgba[((y * 40 + x) * 4)..][..4], &[255, 0, 0, 255], "({x}, {y}) under the huge stroke");
+    }
+    assert_eq!(&page.rgba[((20 * 40 + 2) * 4)..][..4], &[255, 255, 255, 255], "beyond the butt cap");
+}
+
+/// Render a 40 × 40 pt page at 1:1 on its own thread, with `/GS1` (from `gs1`) in its
+/// resources, and fail instead of waiting when the renderer stalls.
+fn render_with_gs1(content: &str, gs1: &str) -> RenderedPage {
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /ExtGState << /GS1 {gs1} >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    page
+}
+
+/// The pixel at device (x, y), y down, of a 40-pixel-wide page.
+fn px40(page: &RenderedPage, x: usize, y: usize) -> &[u8] {
+    &page.rgba[((y * 40 + x) * 4)..][..4]
+}
+
+/// From `cargo xtask fuzz`: an ExtGState `/D [[11] 0]` on a line that starts at x =
+/// 92234775807 cut it into billions of dashes, and stroke expansion allocated more than
+/// 5 GB. A tiny dash on an ordinary line does the same (`[0.000001] 0 d` on 20 pt passed
+/// 10 GB), and so does a long pattern on many short subpaths, because every subpath restarts
+/// it. Vendored hayro patch: a stroke whose dash pattern could cut it into more than
+/// `MAX_DASHES_PER_STROKE` pieces is drawn solid.
+#[test]
+fn dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render() {
+    let red = [255, 0, 0, 255];
+    // The fuzzed shape. A line that far out isn't drawn even undashed (its coordinates are
+    // beyond the rasterizer's range), so this case only proves the page finishes and the
+    // content after the stroke is drawn.
+    let page = render_with_gs1("1 0 0 RG 4 w /GS1 gs 92234775807 20 m 30 20 l S 0 0 1 rg 0 0 4 4 re f", "<< /D [[11] 0] >>");
+    assert_eq!(px40(&page, 1, 38), &[0, 0, 255, 255], "the square after the stroke is drawn");
+    for (what, content, gs1) in [
+        ("a tiny dash on an ordinary line", "1 0 0 RG 4 w [0.000001] 0 d 10 20 m 30 20 l S", "<< >>"),
+        ("a tiny dash from an ExtGState", "1 0 0 RG 4 w /GS1 gs 10 20 m 30 20 l S", "<< /D [[0.000001] 0] >>"),
+        (
+            "a tiny dash under a shrinking matrix",
+            "1 0 0 RG 0.0000001 0 0 0.0000001 0 0 cm 40000000 w [1] 0 d 100000000 200000000 m 300000000 200000000 l S",
+            "<< >>",
+        ),
+    ] {
+        let page = render_with_gs1(content, gs1);
+        // Device row 20 is user y 20; the stroke covers x 10 to 30.
+        for x in [12, 20, 28] {
+            assert_eq!(px40(&page, x, 20), &red, "{what}: ({x}, 20) is drawn, solid");
+        }
+        assert_eq!(px40(&page, 35, 20), &[255, 255, 255, 255], "{what}: beyond the end of the line");
+    }
+    // A long pattern on many short subpaths: 9,999 tiny dashes, then a long one, restarted on
+    // each of 10,000 subpaths 0.01 pt long, is 100 million pieces from a 300 KB stream.
+    let mut many = String::from("1 0 0 RG 4 w [");
+    many.push_str(&"0.000001 ".repeat(9_999));
+    many.push_str("1000] 0 d ");
+    many.push_str(&"10 20 m 10.01 20 l ".repeat(10_000));
+    many.push_str("S 0 0 1 rg 0 0 4 4 re f");
+    let page = render_with_gs1(&many, "<< >>");
+    assert_eq!(px40(&page, 1, 38), &[0, 0, 255, 255], "a pattern restarted on many subpaths finishes");
+    // A fine pattern below the cap still dashes: 200,000 pieces of 0.0001 pt cover about
+    // half of each pixel, so the line is neither solid red nor missing.
+    let page = render_with_gs1("1 0 0 RG 4 w [0.0001] 0 d 10 20 m 30 20 l S", "<< >>");
+    let p = px40(&page, 20, 20);
+    assert!(p[0] == 255 && (40..=215).contains(&p[1]), "a fine dash below the cap is drawn dashed: {p:?}");
+    // An ordinary dash pattern still dashes: butt-capped 4 pt dashes from x 0.
+    let page = render_with_gs1("1 0 0 RG 4 w [4 4] 0 d 0 20 m 40 20 l S", "<< >>");
+    assert_eq!(px40(&page, 2, 20), &red, "inside the first dash");
+    assert_eq!(px40(&page, 6, 20), &[255, 255, 255, 255], "inside the first gap");
+    assert_eq!(px40(&page, 10, 20), &red, "inside the second dash");
+}
+
+/// From `cargo xtask fuzz` triage: a dash array whose entries sum to less than zero made
+/// kurbo's search for the starting dash loop for ever (`[-1 -1] 0 d` never finished).
+/// ISO 32000-2 §8.4.3.6 requires nonnegative entries. Vendored hayro patch: a pattern with a
+/// negative entry, or a period that isn't positive, is drawn solid.
+#[test]
+fn invalid_dash_patterns_terminate_and_are_drawn_solid() {
+    for (what, content, gs1) in [
+        ("[-1 -1]", "1 0 0 RG 4 w [-1 -1] 0 d 10 20 m 30 20 l S", "<< >>"),
+        ("[-1] with a phase", "1 0 0 RG 4 w [-1] 5 d 10 20 m 30 20 l S", "<< >>"),
+        ("[-2 -3] from an ExtGState", "1 0 0 RG 4 w /GS1 gs 10 20 m 30 20 l S", "<< /D [[-2 -3] 0] >>"),
+        ("[-1 3], a negative entry in a positive period", "1 0 0 RG 4 w [-1 3] 0 d 10 20 m 30 20 l S", "<< >>"),
+    ] {
+        let page = render_with_gs1(content, gs1);
+        for x in [12, 20, 28] {
+            assert_eq!(px40(&page, x, 20), &[255, 0, 0, 255], "{what}: ({x}, 20) is drawn, solid");
+        }
+    }
+}
+
+/// From the nightly `cargo xtask fuzz`: a Type 3 glyph that shows several glyphs of its own
+/// font. The nesting cap bounds the depth but not the breadth: eight glyphs per glyph, sixteen
+/// deep, is 8^16 paints. Vendored hayro-interpret patch: nested paints (forms, Type 3 glyphs,
+/// tiling patterns inside one another) share a per-page budget.
+#[test]
+fn type3_glyphs_that_fan_out_into_themselves_finish() {
+    let pdf = "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length 53 >> stream
+BT /F1 20 Tf 10 10 Td (A) Tj ET 1 0 0 rg 0 0 4 4 re f
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 1 1] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [1]
+  /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> >> endobj
+6 0 obj << /Length 48 >> stream
+1 0 d0 BT /F1 1 Tf (AAAAAAAA) Tj ET 0 0 1 1 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf.as_bytes().to_vec()), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("a self-multiplying Type 3 glyph must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+}
+
+/// `depth` direct arrays (`array`), dictionaries with a key (`dict`) or both in turn (`mixed`)
+/// around `null`.
+fn nested(depth: usize, kind: &str) -> String {
+    let is_dict = |level| kind == "dict" || (kind == "mixed" && level % 2 == 0);
+    let mut value = String::new();
+    for level in 0..depth {
+        value.push_str(if is_dict(level) { "<< /N " } else { "[" });
+    }
+    value.push_str("null");
+    for level in (0..depth).rev() {
+        value.push_str(if is_dict(level) { " >>" } else { "]" });
+    }
+    value
+}
+
+/// `depth` dictionaries nested without keys (`<< << >> >>`), closed or not.
+fn keyless(depth: usize, closed: bool) -> String {
+    let mut value = "<< ".repeat(depth);
+    if closed {
+        value.push_str(&">> ".repeat(depth));
+    }
+    value
+}
+
+/// A 40 × 40 page that runs `content`, with a correct xref table and `trailer` at the end
+/// of a trailer that also points at an `/Info` title.
+fn nesting_pdf(trailer: &str, content: &str) -> Vec<u8> {
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = vec![0];
+    for (index, body) in [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << >> >>".to_string(),
+        format!("<< /Length {} >> stream\n{content}\nendstream", content.len()),
+        "<< /Title (Nested) >>".to_string(),
+    ]
+    .iter()
+    .enumerate()
+    {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", index + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(b"xref\n0 6\n0000000000 65535 f \n");
+    for offset in &offsets[1..] {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer << /Size 6 /Root 1 0 R /Info 5 0 R {trailer} >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    bytes
+}
+
+/// Opens `bytes` and renders its one page, which must render without an error.
+fn nesting_render(bytes: Vec<u8>) -> RenderedPage {
+    let parsed = Pdf::new(bytes.clone()).expect("xref repair can recover the catalog when the trailer is malformed");
+    assert_eq!(parsed.pages().len(), 1);
+    let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (40, 40));
+    page
+}
+
+/// Direct arrays and dictionaries used to recurse without a bound while skipping even
+/// unused trailer values and content operands. Exercise the vendored patch in workspace CI.
+#[test]
+fn deeply_nested_direct_objects_do_not_overflow_the_stack() {
+    use hayro_syntax::object::Object;
+    use hayro_syntax::reader::{Reader, ReaderExt};
+    let pdf = |unused: &str, content: &str| nesting_pdf(&format!("/Unused {unused}"), content);
+    let paint = "1 0 0 rg 0 0 4 4 re f";
+    for kind in ["array", "dict", "mixed"] {
+        // Run the crash reproducer first, so the unpatched red state is a stack overflow.
+        let page = nesting_render(pdf(&nested(100_000, kind), paint));
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{kind}: repaired trailer");
+        for depth in [20, 128, 129] {
+            let value = nested(depth, kind);
+            let siblings = format!("{value} [] []");
+            let mut reader = Reader::new(siblings.as_bytes());
+            assert_eq!(reader.skip::<Object<'_>>(false).is_some(), depth <= 128, "{kind}: depth {depth}");
+            if depth > 128 {
+                assert_eq!(reader.offset(), 0, "failed skips restore the offset");
+                reader.jump(value.len());
+            }
+            // A failed skip must unwind its depth; successful siblings must not accumulate it.
+            for _ in 0..2 {
+                reader.skip_white_spaces();
+                assert!(reader.skip::<Object<'_>>(false).is_some());
+            }
+            let page = nesting_render(pdf(&value, paint));
+            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{kind}: depth {depth}");
+        }
+        // Many siblings exercise the offset constructor and ensure depth is per nesting.
+        let siblings = "[] ".repeat(256);
+        let mut reader = Reader::new_with(siblings.as_bytes(), 0);
+        for _ in 0..256 {
+            assert!(reader.skip::<Object<'_>>(false).is_some());
+            reader.skip_white_spaces();
+        }
+    }
+    // Content-stream arrays take the Object path, rather than MaybeRef<Object>.
+    for depth in [100_000, 20, 128, 129] {
+        let value = nested(depth, "array");
+        let mut reader = Reader::new(value.as_bytes());
+        assert_eq!(reader.skip::<Object<'_>>(true).is_some(), depth <= 128, "content: depth {depth}");
+        let content = format!("{value} discard {paint}");
+        let page = nesting_render(pdf("null", &content));
+        if depth <= 128 {
+            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "content: depth {depth}");
+        }
+    }
+}
+
+/// A dictionary with an object where a key belongs is repaired by reading that object, not
+/// skipping it, and that read recursed without a bound when the object was another such
+/// dictionary: `<<` 100,000 times aborted the process. Here as a content-stream operand.
+#[test]
+fn dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack() {
+    for closed in [true, false] {
+        let content = format!("1 0 0 rg 0 0 4 4 re f {} discard", keyless(100_000, closed));
+        let page = nesting_render(nesting_pdf("", &content));
+        assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
+    }
+}
+
+/// The same, where a key of the trailer belongs: the xref table can't be used, and repair
+/// finds the catalog.
+#[test]
+fn dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack() {
+    for closed in [true, false] {
+        let page = nesting_render(nesting_pdf(&keyless(100_000, closed), "1 0 0 rg 0 0 4 4 re f"));
+        assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
+    }
+}
+
+/// The same as the properties of marked content (`/Tag <<<<<< … BDC`).
+#[test]
+fn dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack() {
+    for closed in [true, false] {
+        let properties = if closed { "<<".repeat(100_000) + &">>".repeat(100_000) } else { "<<".repeat(100_000) };
+        let content = format!("1 0 0 rg 0 0 4 4 re f /Tag {properties} BDC 0 0 1 rg 36 36 4 4 re f EMC");
+        let page = nesting_render(nesting_pdf("", &content));
+        assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
+    }
+}
+
+/// Through the same three paths, dictionaries without keys are read up to the nesting cap
+/// (128 dictionaries in all) and refused one past it.
+#[test]
+fn dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap() {
+    use hayro_syntax::object::{FromBytes, Object};
+    use hayro_syntax::reader::{Reader, ReaderExt};
+    let (red, blue, white) = ([255, 0, 0, 255], [0, 0, 255, 255], [255, 255, 255, 255]);
+    for depth in [128, 129] {
+        let within = depth <= 128;
+        let value = keyless(depth, true);
+        assert_eq!(Object::from_bytes(value.as_bytes()).is_some(), within, "object: {depth}");
+        assert_eq!(Reader::new(value.as_bytes()).read_without_context::<Object<'_>>().is_some(), within, "operand: {depth}");
+        // Content reading stops at an operand it can't read, so the blue square is drawn
+        // only when the dictionaries were read.
+        let properties = "<<".repeat(depth) + &">>".repeat(depth);
+        for (path, operand) in [("operand", format!("{value} discard")), ("BDC", format!("/Tag {properties} BDC"))] {
+            let content = format!("1 0 0 rg 0 0 4 4 re f {operand} 0 0 1 rg 36 36 4 4 re f");
+            let page = nesting_render(nesting_pdf("", &content));
+            assert_eq!(px40(&page, 1, 38), &red, "{path}: {depth}");
+            assert_eq!(px40(&page, 38, 1), if within { &blue } else { &white }, "{path}: {depth}");
+        }
+        // The trailer is the outermost dictionary. Within the cap it is read (with its
+        // /Info); past it, repair recovers the catalog but not the trailer.
+        let bytes = nesting_pdf(&keyless(depth - 1, true), "1 0 0 rg 0 0 4 4 re f");
+        let parsed = Pdf::new(bytes.clone()).expect("the trailer or repair finds the catalog");
+        assert_eq!(parsed.metadata().title, within.then(|| b"Nested".to_vec()), "trailer: {depth}");
+        assert_eq!(px40(&nesting_render(bytes), 1, 38), &red, "trailer: {depth}");
+    }
+}
+
+/// The cap must also fit small stacks: skip, read, iterate down with the array iterators and
+/// format (`{:?}`) the deepest nesting it admits, of arrays, dictionaries, both and
+/// dictionaries without keys, on a 512 KiB thread in a debug build. Measured when this was
+/// written (macOS arm64, dev profile): at most about 100 KiB, for `{:?}` of 128 dictionaries.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn nesting_at_the_cap_fits_a_512_kib_stack() {
+    use hayro_syntax::object::{FromBytes, Object};
+    use hayro_syntax::reader::{Reader, ReaderExt};
+    let worker = std::thread::Builder::new().stack_size(512 * 1024).spawn(|| {
+        // (kind, arrays and dictionaries `{:?}` shows, levels walked down to the end)
+        for (kind, arrays, dicts, levels) in [("array", 128, 0, 129), ("dict", 0, 128, 129), ("mixed", 64, 64, 129), ("keyless", 0, 1, 1)] {
+            let value = if kind == "keyless" { keyless(128, true) } else { nested(128, kind) };
+            assert!(Reader::new(value.as_bytes()).skip::<Object<'_>>(false).is_some(), "{kind}: skip");
+            assert!(Reader::new(value.as_bytes()).skip::<Object<'_>>(true).is_some(), "{kind}: skip in content");
+            assert!(Reader::new(value.as_bytes()).read_without_context::<Object<'_>>().is_some(), "{kind}: operand");
+            let object = Object::from_bytes(value.as_bytes()).expect("the cap admits 128 levels");
+            let shown = format!("{object:?}");
+            assert_eq!((shown.matches("Array(").count(), shown.matches("Dict(").count()), (arrays, dicts), "{kind}: {{:?}}");
+            let (mut walked, mut next) = (0, Some(object));
+            while let Some(object) = next.take() {
+                walked += 1;
+                next = match object {
+                    Object::Array(array) => {
+                        assert_eq!(array.raw_iter().count(), 1, "{kind}: raw_iter");
+                        assert!(array.flex_iter().next::<Object<'_>>().is_some(), "{kind}: flex_iter");
+                        array.iter::<Object<'_>>().next()
+                    }
+                    Object::Dict(dict) => dict.get::<Object<'_>>("N"),
+                    _ => None,
+                };
+            }
+            assert_eq!(walked, levels, "{kind}: iterate");
+        }
+    });
+    // A stack overflow aborts the process; a failed check is a panic, shown as it is.
+    if let Err(panic) = worker.expect("spawn a 512 KiB thread").join() {
+        std::panic::resume_unwind(panic);
+    }
+}
+
+/// From the nightly `cargo xtask fuzz`: many small inline images, each with "EI" (followed
+/// by a space) inside its data, and no text anywhere. To decide whether such an "EI" ends the
+/// data, the parser re-read the rest of the stream as content, and that re-read did the same
+/// for every inline image it met, nesting through the whole stream: 50 images (3 KB) ran for
+/// over ten minutes. Vendored hayro-syntax patch: the re-read doesn't nest, and the search is
+/// bounded.
+#[test]
+fn inline_images_with_ei_in_their_data_parse_in_linear_time() {
+    let image = b"q 1 0 0 1 0 0 cm\nBI\n/IM true\n/W 8\n/H 2\n/BPC 1\nID \x01 EI \x02\nEI Q\n";
+    let content: Vec<u8> = image.iter().copied().cycle().take(image.len() * 200).collect();
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut iter = hayro::hayro_syntax::content::TypedIter::new(&content);
+        let mut ops = 0usize;
+        while iter.next().is_some() {
+            ops += 1;
+        }
+        let _ = tx.send(ops);
+    });
+    let ops = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("inline images must not stall the parser");
+    assert!(ops >= 200 * 4, "every image and its q/cm/Q are read: {ops}");
+}
+
+/// From the nightly `cargo xtask fuzz`: a JBIG2 image whose stream declares a page and a
+/// generic region of 65535 × 65535 pixels (each side within JBIG2's limit) behind a small
+/// /Width and /Height: decoding its 4.3 billion pixels one by one took minutes. Vendored
+/// hayro-jbig2 patch: at most 2^28 pixels per bitmap, and 2^26 per symbol dictionary.
+#[test]
+fn jbig2_regions_of_billions_of_pixels_are_refused() {
+    // Embedded JBIG2 segments (ISO 14492 §7.2): page information, then an immediate generic
+    // region, both 65535 × 65535, followed by arithmetic-coded data.
+    let mut jbig2 = Vec::new();
+    let mut segment = |number: u32, kind: u8, data: &[u8]| {
+        jbig2.extend_from_slice(&number.to_be_bytes());
+        jbig2.extend_from_slice(&[kind, 0, 1]);
+        jbig2.extend_from_slice(&u32::try_from(data.len()).unwrap().to_be_bytes());
+        jbig2.extend_from_slice(data);
+    };
+    let side = 65535u32.to_be_bytes();
+    let mut page = Vec::new();
+    page.extend_from_slice(&side);
+    page.extend_from_slice(&side);
+    page.extend_from_slice(&[0; 8]); // resolution
+    page.extend_from_slice(&[0, 0, 0]); // flags, striping
+    segment(0, 48, &page);
+    let mut region = Vec::new();
+    region.extend_from_slice(&side);
+    region.extend_from_slice(&side);
+    region.extend_from_slice(&[0; 9]); // x, y, combination operator
+    region.push(0); // arithmetic coding, template 0
+    region.extend_from_slice(&[3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // AT pixels
+    region.extend_from_slice(&[0x5a; 64]);
+    segment(1, 38, &region);
+    let content = b"q 20 0 0 20 5 5 cm /Im1 Do Q 1 0 0 rg 0 0 4 4 re f";
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+    pdf.extend_from_slice(content);
+    pdf.extend_from_slice(b"\nendstream endobj\n");
+    pdf.extend_from_slice(
+        format!("5 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 8 /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n", jbig2.len())
+            .as_bytes(),
+    );
+    pdf.extend_from_slice(&jbig2);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("a huge JBIG2 region must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+}
+
+/// From `cargo xtask fuzz`: one changed byte in a symbol dictionary's arithmetic-coded data
+/// hung the renderer. Two of its loops can stop advancing: an export run of length 0, and a
+/// height class whose first width is already the end-of-class marker. Past the end of its
+/// data the decoder can return those for ever. Vendored hayro-jbig2 patch: at most one height
+/// class per new symbol and `2 × symbols + 1` export runs, each plus `EXTRA_EMPTY_STEPS`.
+/// These synthetic dictionaries (two new symbols each, a few bytes of arbitrary data) decode
+/// the same way. In the second every class after the first symbol adds 13 to the height, so it
+/// only fails when the height overflows `u32`, after 330 million empty classes (about five
+/// seconds; a delta of 0 would never end). The page draws it as twenty images, so that the
+/// stall without the patch is well past the timeout on any machine.
+#[test]
+fn jbig2_symbol_dictionaries_that_never_advance_terminate() {
+    for (what, data, copies) in
+        [("zero-length export runs", &[0x05, 0x70, 0x05, 0x14, 0x02, 0x1d, 0x56, 0x3f][..], 1), ("empty height classes", &[0x06, 0x99][..], 20)]
+    {
+        // Embedded JBIG2 segments (ISO 14492 §7.2): page information, then a symbol dictionary.
+        let mut jbig2 = Vec::new();
+        let mut segment = |number: u32, kind: u8, data: &[u8]| {
+            jbig2.extend_from_slice(&number.to_be_bytes());
+            jbig2.extend_from_slice(&[kind, 0, 1]);
+            jbig2.extend_from_slice(&u32::try_from(data.len()).unwrap().to_be_bytes());
+            jbig2.extend_from_slice(data);
+        };
+        let mut page = Vec::new();
+        page.extend_from_slice(&8u32.to_be_bytes());
+        page.extend_from_slice(&8u32.to_be_bytes());
+        page.extend_from_slice(&[0; 8]); // resolution
+        page.extend_from_slice(&[0, 0, 0]); // flags, striping
+        segment(0, 48, &page);
+        let mut dictionary = vec![0, 0]; // arithmetic coding, template 0, no refinement
+        dictionary.extend_from_slice(&[3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // AT pixels
+        dictionary.extend_from_slice(&1u32.to_be_bytes()); // exported symbols
+        dictionary.extend_from_slice(&2u32.to_be_bytes()); // new symbols
+        dictionary.extend_from_slice(data);
+        segment(1, 0, &dictionary);
+        // Each copy is its own image XObject (5, 6, …), all drawn by the page.
+        let images: Vec<usize> = (5..5 + copies).collect();
+        let mut content: String = images.iter().map(|n| format!("q 20 0 0 20 5 5 cm /Im{n} Do Q ")).collect();
+        content.push_str("1 0 0 rg 0 0 4 4 re f");
+        let names: String = images.iter().map(|n| format!("/Im{n} {n} 0 R ")).collect();
+        let mut pdf = format!("%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << {names}>> >> >> endobj\n").into_bytes();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
+        for n in &images {
+            pdf.extend_from_slice(
+                format!("{n} 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 8 /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n", jbig2.len())
+                    .as_bytes(),
+            );
+            pdf.extend_from_slice(&jbig2);
+            pdf.extend_from_slice(b"\nendstream endobj\n");
+        }
+        pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+        });
+        let page = rx
+            .recv_timeout(std::time::Duration::from_secs(20))
+            .unwrap_or_else(|_| panic!("{what}: a JBIG2 symbol dictionary must not stall the renderer"));
+        assert!(page.error.is_none(), "{what}: {:?}", page.error);
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{what}: the rest of the page draws");
+    }
+}
+
+/// Item 1 of storytold/pdfcraft#623: a page's content used to be cut at `MAX_DECODED_STREAM`,
+/// so everything after the cut was lost (the text and the title block of the A1 sample). Content
+/// that expands by a few times over is read to its end, however large it is.
+#[test]
+fn page_content_past_the_old_cap_renders() {
+    let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
+    // Blocks of a comment and a run of blanks. Each compresses about thirty times over, well
+    // within the budget that `ContentReader` allows.
+    let mut content = Vec::with_capacity(limit + (8 << 20));
+    let mut state = 0x2545_f491_4f6c_dd1d_u64;
+    while content.len() < limit + (8 << 20) {
+        content.push(b'%');
+        for _ in 0..3 {
+            state = state.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1);
+            content.push(b'a' + ((state >> 33) % 26) as u8);
+        }
+        content.push(b'\n');
+        content.resize(content.len() + 128, b' ');
+    }
+    content.extend_from_slice(b"1 0 0 rg 0 0 4 4 re f");
+    let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+    std::io::Write::write_all(&mut z, &content).unwrap();
+    let stream = z.finish().unwrap();
+    assert!(content.len() < 64 * stream.len(), "the content expands by less than the budget allows");
+
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", stream.len()).as_bytes());
+    pdf.extend_from_slice(&stream);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(120)).expect("a large page must render");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert!(!page.warnings.contains(&RenderWarning::ContentTruncated), "nothing was cut");
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the square after the old cap draws");
+}
+
+/// The content stream is interpreted a window at a time. An inline image with more data than
+/// a window is read whole, and what follows it is still drawn.
+#[test]
+fn inline_images_longer_than_a_window_are_read_whole() {
+    let mut content = b"q 300 0 0 300 0 0 cm BI /W 300 /H 300 /BPC 8 /CS /G ID ".to_vec();
+    content.extend(std::iter::repeat_n(0x80_u8, 300 * 300));
+    content.extend_from_slice(b" EI Q 1 0 0 rg 0 0 4 4 re f");
+    let pdf = one_page_pdf(&content, "");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("an inline image must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    let pixel = |x: u32, y: u32| {
+        let offset = ((y * page.width + x) * 4) as usize;
+        [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
+    };
+    assert_eq!(pixel(1, 38), [255, 0, 0, 255], "the square after the image draws");
+    let grey = pixel(30, 5);
+    assert!(grey[0] == grey[1] && grey[1] == grey[2] && grey[0] < 255, "the image covers the page: {grey:?}");
+}
+
+/// A five-point open polyline is not a rectangle. `path_as_rect` took any five-element path
+/// whose points covered the four corners of its bounding box for that box, and a `MoveTo` with
+/// four `LineTo` is five elements, so an open zigzag stroked with `S` was painted as its
+/// bounding rectangle: the peak between its ends vanished and the open side came out closed.
+#[test]
+fn a_five_point_polyline_is_not_painted_as_its_bounding_box() {
+    // The ends and the points beside them sit on the four corners of the bounding box; the
+    // peak at (20, 20) lies between them and is on no corner.
+    let content = b"0 0 0 RG 2 w 30 30 m 30 10 l 20 20 l 10 10 l 10 30 l S".to_vec();
+    let pdf = one_page_pdf(&content, "");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("the polyline must render");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    // Device y counts down the 40 pt page, so the two ends at y = 30 are on row 10.
+    let dark = |x: u32, y: u32| {
+        let offset = ((y * page.width + x) * 4) as usize;
+        page.rgba[offset] < 128
+    };
+    assert!((17..=23).any(|x| (17..=23).any(|y| dark(x, y))), "the peak between the ends draws");
+    assert!(!(14..=26).any(|x| dark(x, 10)), "the side the path leaves open stays open");
+}
+
+/// Five points all on the corners still need not trace the rectangle: three sides and a step
+/// back along the third is such a path, and it was painted as the box -- drawing a fourth
+/// side the path does not have (FredApps on #3327).
+#[test]
+fn a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle() {
+    // Bottom, right, top, then back along the top. The left side is never drawn.
+    let content = b"0 0 0 RG 2 w 10 10 m 30 10 l 30 30 l 10 30 l 30 30 l S".to_vec();
+    let pdf = one_page_pdf(&content, "");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("the path must render");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    let dark = |x: u32, y: u32| {
+        let offset = ((y * page.width + x) * 4) as usize;
+        page.rgba[offset] < 128
+    };
+    // Device y counts down the 40 pt page: the bottom side at y = 10 is row 30.
+    assert!((14..=26).any(|x| dark(x, 30)), "the sides the path does draw are drawn");
+    assert!(!(14..=26).any(|y| dark(10, y)), "the left side it never draws is not drawn");
+}
+
+/// A rectangle still takes the rectangle route, written either way: `m l l l` and closed, or
+/// `m l l l l` back to its first corner.
+#[test]
+fn a_rectangle_is_still_painted_as_a_rectangle() {
+    for content in [&b"0 0 0 rg 10 10 m 30 10 l 30 30 l 10 30 l f"[..], &b"0 0 0 rg 10 10 m 30 10 l 30 30 l 10 30 l 10 10 l f"[..]] {
+        let pdf = one_page_pdf(content, "");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("the rectangle must render");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        let pixel = |x: u32, y: u32| {
+            let offset = ((y * page.width + x) * 4) as usize;
+            page.rgba[offset]
+        };
+        assert!(pixel(20, 20) < 128, "the rectangle is filled");
+        assert_eq!(pixel(5, 5), 255, "and nothing outside it is");
+    }
+}
+
+/// A one-page PDF whose content is the stream `stream`, with the entries `dict` in its
+/// dictionary.
+fn one_page_pdf(stream: &[u8], dict: &str) -> Vec<u8> {
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << {dict} /Length {} >> stream\n", stream.len()).as_bytes());
+    pdf.extend_from_slice(stream);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    pdf
+}
+
+/// A document whose `pages` page dictionaries all live in one (uncompressed) object stream,
+/// found through a cross-reference stream: every page shows the content `0 0 1 rg 10 10 80 80
+/// re f` on a 100 pt square, except the last, which is 50 × 100 pt.
+fn pages_in_one_object_stream(pages: usize) -> Vec<u8> {
+    // 1 catalog, 2 page tree, 3 content, 4 the object stream, 5.. the pages, then the xref.
+    let page = |n: usize| {
+        let size = if n + 1 == pages { "50 100" } else { "100 100" };
+        format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 {size}] /Contents 3 0 R >>\n")
+    };
+    let (mut index, mut body) = (String::new(), String::new());
+    for n in 0..pages {
+        index.push_str(&format!("{} {} ", n + 5, body.len()));
+        body.push_str(&page(n));
+    }
+    index.push('\n');
+    let kids: Vec<String> = (0..pages).map(|n| format!("{} 0 R", n + 5)).collect();
+    let content = "0 0 1 rg 10 10 80 80 re f";
+    let mut pdf = b"%PDF-1.5\n".to_vec();
+    let mut offsets = Vec::new();
+    for (num, obj) in [
+        (1, "<< /Type /Catalog /Pages 2 0 R >>".to_string()),
+        (2, format!("<< /Type /Pages /Kids [{}] /Count {pages} >>", kids.join(" "))),
+        (3, format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len())),
+        (4, format!("<< /Type /ObjStm /N {pages} /First {} /Length {} >>\nstream\n{index}{body}\nendstream", index.len(), index.len() + body.len())),
+    ] {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{num} 0 obj\n{obj}\nendobj\n").as_bytes());
+    }
+    // Cross-reference stream rows of /W [1 4 4]: free 0, objects 1–4 in the file, the pages
+    // at their index in object 4, and the cross-reference stream itself.
+    let xref_num = pages + 5;
+    let xref_at = pdf.len();
+    let mut rows = vec![0u8, 0, 0, 0, 0, 0, 0, 0xff, 0xff];
+    let row = |kind: u8, a: usize, b: usize| [[kind].as_slice(), &(a as u32).to_be_bytes(), &(b as u32).to_be_bytes()].concat();
+    for at in &offsets {
+        rows.extend(row(1, *at, 0));
+    }
+    for n in 0..pages {
+        rows.extend(row(2, 4, n));
+    }
+    rows.extend(row(1, xref_at, 0));
+    pdf.extend_from_slice(
+        format!("{xref_num} 0 obj\n<< /Type /XRef /Size {} /W [1 4 4] /Root 1 0 R /Length {} >>\nstream\n", xref_num + 1, rows.len()).as_bytes(),
+    );
+    pdf.extend_from_slice(&rows);
+    pdf.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref_at}\n%%EOF\n").as_bytes());
+    pdf
+}
+
+/// An object stream's index of `objnum offset` pairs is read once, not for every object
+/// fetched from it (vendored hayro-syntax patch 22). Read again each time, all of a stream of
+/// N objects took N² steps: a Firefox page keeping 65,542 objects in one stream took 37 s to
+/// draw and 40 s to extract its text. These 40,000 pages in one stream took about a minute
+/// to open that way; now a fraction of a second. The last page, at the end of the index,
+/// still has its own size.
+#[test]
+fn objects_in_one_large_object_stream_are_read_in_linear_time() {
+    const PAGES: usize = 40_000;
+    let pdf = pages_in_one_object_stream(PAGES);
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let first = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+        let last = r.render(RenderRequest { page: PAGES - 1, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+        let _ = tx.send((first, last));
+    });
+    let (first, last) =
+        rx.recv_timeout(std::time::Duration::from_secs(20)).expect("reading every object of one object stream must not take quadratic time");
+    assert!(first.error.is_none(), "{:?}", first.error);
+    assert_eq!((first.width, first.height), (100, 100));
+    assert_eq!(rgb_at(&first.rgba, first.width as usize, 50, 50), [0, 0, 255]);
+    assert!(last.error.is_none(), "{:?}", last.error);
+    assert_eq!((last.width, last.height), (50, 100), "the last page is read from its own offset");
+}
+
+/// #2946: ScanSoft PDF Create! writes the `post` table version of every font it embeds with
+/// its 16-bit halves swapped (`00 00 00 03` for 3.0). Such a font must still be used, drawing
+/// exactly as with a correct version; a version that is neither (9.0) is still refused and
+/// drawn with a substitute, as before.
+#[test]
+fn a_font_whose_post_version_has_swapped_halves_is_still_used() {
+    let font = include_bytes!("../../../../assets/fonts/JetBrainsMono-Regular.ttf");
+    // The `post` table's offset, from the table directory.
+    let tables = usize::from(u16::from_be_bytes([font[4], font[5]]));
+    let post = (0..tables)
+        .map(|i| &font[12 + 16 * i..28 + 16 * i])
+        .find(|e| &e[..4] == b"post")
+        .map(|e| u32::from_be_bytes([e[8], e[9], e[10], e[11]]) as usize)
+        .expect("the test font has a post table");
+    let render_with = |version: [u8; 4], encoding: &str| -> Vec<u8> {
+        let mut program = font.to_vec();
+        program[post..post + 4].copy_from_slice(&version);
+        let content = b"BT /F1 28 Tf 10 40 Td (Hamburg 0123) Tj ET";
+        let widths = vec!["600"; 95].join(" ");
+        let objects: Vec<Vec<u8>> = vec![
+            b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+            b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+            b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 80] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>".to_vec(),
+            [format!("<< /Length {} >>\nstream\n", content.len()).into_bytes(), content.to_vec(), b"\nendstream".to_vec()].concat(),
+            format!("<< /Type /Font /Subtype /TrueType /BaseFont /JetBrainsMono-Regular /FirstChar 32 /LastChar 126 /Widths [{widths}] /FontDescriptor 6 0 R /Encoding {encoding} >>").into_bytes(),
+            b"<< /Type /FontDescriptor /FontName /JetBrainsMono-Regular /Flags 32 /FontBBox [-1000 -300 1000 1000] /ItalicAngle 0 /Ascent 1020 /Descent -300 /CapHeight 730 /StemV 80 /FontFile2 7 0 R >>".to_vec(),
+            [format!("<< /Length {} >>\nstream\n", program.len()).into_bytes(), program, b"\nendstream".to_vec()].concat(),
+        ];
+        let mut pdf = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objects.iter().enumerate() {
+            offsets.push(pdf.len());
+            pdf.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+            pdf.extend_from_slice(o);
+            pdf.extend_from_slice(b"\nendobj\n");
+        }
+        let xref = pdf.len();
+        pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+        for o in offsets {
+            pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+        let page = PageRenderer::new(Arc::new(pdf), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 2.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        page.rgba.to_vec()
+    };
+    let render = |version: [u8; 4]| render_with(version, "/WinAnsiEncoding");
+    let correct = render([0, 3, 0, 0]);
+    assert_eq!(render([0, 0, 0, 3]), correct, "3.0 with swapped halves draws with the embedded font");
+    assert_eq!(render([0, 0, 0, 2]), render([0, 2, 0, 0]), "2.0 with swapped halves too");
+    assert_ne!(render([0, 9, 0, 0]), correct, "an unknown version is still refused");
+    // A /Differences name only the font's own post table knows (W's alternate, `W.cv07`)
+    // is found through a swapped 2.0 table too (review on #2949).
+    let alternate = |version: [u8; 4]| render_with(version, "<< /BaseEncoding /WinAnsiEncoding /Differences [72 /W.cv07] >>");
+    assert_ne!(alternate([0, 2, 0, 0]), render([0, 2, 0, 0]), "the alternate W draws instead of H");
+    assert_eq!(alternate([0, 0, 0, 2]), alternate([0, 2, 0, 0]), "and also with swapped halves");
+}
+
+/// A page whose content expands far beyond its compressed stream stops at the expansion budget,
+/// which is 64 times the compressed size and at least `MAX_DECODED_STREAM`, and the page says so.
+#[test]
+fn content_bombs_stop_at_the_budget_and_say_so() {
+    let bomb = zlib_zeros(hayro::hayro_syntax::MAX_DECODED_STREAM + (32 << 20));
+    let pdf = one_page_pdf(&bomb, "/Filter /FlateDecode");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a content bomb must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert!(page.warnings.contains(&RenderWarning::ContentTruncated), "the cut content is observable");
+}
+
+/// A stream read in pieces of any size gives the same bytes: stored and dynamic blocks, and in
+/// a `/Contents` array a stream that is not Flate-coded, between two that are.
+#[test]
+fn content_reader_returns_the_same_bytes_in_any_pieces() {
+    use hayro::hayro_syntax::Pdf;
+    use std::io::Write;
+    let mut plain = Vec::new();
+    for i in 0..40_000_u32 {
+        plain.extend_from_slice(format!("{} {} l\n", i % 977, i % 613).as_bytes());
+    }
+    let zlib = |data: &[u8], level| {
+        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), level);
+        z.write_all(data).unwrap();
+        z.finish().unwrap()
+    };
+    let read = |pdf: Vec<u8>, piece: usize| {
+        let doc = Pdf::new(pdf).expect("parses");
+        let page = doc.pages().first().expect("one page");
+        let mut content = page.content_reader();
+        let mut out = Vec::new();
+        while content.read_into(&mut out, piece) > 0 {}
+        out
+    };
+    let pieces = [1, 3, 64, 4096, 65_536, 1_000_000];
+
+    for level in [flate2::Compression::none(), flate2::Compression::best()] {
+        let pdf = one_page_pdf(&zlib(&plain, level), "/Filter /FlateDecode");
+        for piece in pieces {
+            assert!(read(pdf.clone(), piece) == plain, "piece {piece}");
+        }
+    }
+
+    // A `/Contents` array: Flate, then ASCIIHex (decoded whole), then Flate. As before, each
+    // stream is followed by a space.
+    let hex: String = plain[..100].iter().map(|b| format!("{b:02x}")).collect::<String>() + ">";
+    let first = zlib(&plain, flate2::Compression::default());
+    let last = zlib(&plain[..50], flate2::Compression::default());
+    let mut expected = plain.clone();
+    expected.push(b' ');
+    expected.extend_from_slice(&plain[..100]);
+    expected.push(b' ');
+    expected.extend_from_slice(&plain[..50]);
+    expected.push(b' ');
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [4 0 R 5 0 R 6 0 R] >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", first.len()).as_bytes());
+    pdf.extend_from_slice(&first);
+    pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /Filter /ASCIIHexDecode /Length {} >> stream\n", hex.len()).as_bytes());
+    pdf.extend_from_slice(hex.as_bytes());
+    pdf.extend_from_slice(format!("\nendstream endobj\n6 0 obj << /Filter /FlateDecode /Length {} >> stream\n", last.len()).as_bytes());
+    pdf.extend_from_slice(&last);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    for piece in pieces {
+        assert!(read(pdf.clone(), piece) == expected, "the array: piece {piece}");
+    }
+}
+
+/// Zlib data that inflates to `len` zero bytes.
+fn zlib_zeros(len: usize) -> Vec<u8> {
+    use std::io::Write;
+    let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
+    let chunk = vec![0u8; 1 << 20];
+    let mut left = len;
+    while left > 0 {
+        let n = left.min(chunk.len());
+        z.write_all(&chunk[..n]).unwrap();
+        left -= n;
+    }
+    z.finish().unwrap()
+}
+
+/// A raw deflate stream that flate2 rejects at once and the fallback inflater expands to at
+/// least `len` zero bytes: a one-byte stored block whose length check is wrong (flate2 refuses
+/// it, the fallback carries on), then a fixed-Huffman block of 258-byte copies.
+fn deflate_for_the_fallback(len: usize) -> Vec<u8> {
+    let mut out = vec![0b000]; // not final, stored; the rest of the byte is padding
+    out.extend_from_slice(&[1, 0, 0, 0, 0]); // LEN 1, NLEN 0 (should be !1), the byte 0
+    let (mut acc, mut bits) = (0u64, 0u32);
+    // Deflate packs bits from the least significant end; Huffman codes go most significant
+    // bit first.
+    let mut put = |value: u32, n: u32, huffman: bool| {
+        for i in 0..n {
+            let bit = if huffman { (value >> (n - 1 - i)) & 1 } else { (value >> i) & 1 };
+            acc |= u64::from(bit) << bits;
+            bits += 1;
+            if bits == 8 {
+                out.push(acc as u8);
+                (acc, bits) = (0, 0);
+            }
+        }
+    };
+    put(1, 1, false); // final block
+    put(1, 2, false); // fixed Huffman codes
+    for _ in 0..len / 258 + 1 {
+        put(0b1100_0101, 8, true); // length code 285: 258 bytes
+        put(0, 5, true); // distance code 0: 1 byte back
+    }
+    put(0, 7, true); // end of block
+    put(0, 7, false); // flush
+    out
+}
+
+/// LZW codes (MSB first, early change) for `fills` table fills of zero runs: after a clear,
+/// code 0, then every code is the one being defined (the previous entry plus a zero), so
+/// entry n holds n - 256 zeros. One fill is about 7 MB of output from 5 KB of codes.
+fn lzw_zeros(fills: usize) -> Vec<u8> {
+    let width = |size: usize| match size + 1 {
+        2048.. => 12,
+        1024.. => 11,
+        512.. => 10,
+        _ => 9,
+    };
+    let (mut out, mut acc, mut bits) = (Vec::new(), 0u64, 0u32);
+    let mut emit = |code: usize, w: u32| {
+        acc = (acc << w) | code as u64;
+        bits += w;
+        while bits >= 8 {
+            bits -= 8;
+            out.push((acc >> bits) as u8);
+        }
+    };
+    let mut size = 258;
+    for _ in 0..fills {
+        emit(256, width(size)); // clear
+        size = 258;
+        emit(0, width(size));
+        for code in 258..4096 {
+            emit(code, width(size));
+            size = code + 1;
+        }
+    }
+    emit(257, width(size)); // end of data
+    emit(0, 7); // flush the last partial byte
+    out
+}
+
+/// Found while triaging `cargo xtask fuzz` on Windows, by hand rather than by the fuzzer
+/// (random mutations almost never make a high-ratio stream): a 2 MB page whose content
+/// stream, or whose 8 × 8 image, inflated to 2 GB took the renderer past 3 GB in under a
+/// second. Flate (through flate2 and through the fallback inflater), LZW, RunLength and ASCII85
+/// (#1796: each `z` is four bytes, here after Flate) expand without limit. Vendored hayro-syntax patch: each stops at `MAX_DECODED_STREAM`, and an image
+/// of known size at its own rows.
+#[test]
+fn decompression_bombs_stop_at_the_stream_limit() {
+    use hayro::hayro_syntax::object::stream::ImageDecodeParams;
+    use hayro::hayro_syntax::object::{Object, Stream};
+    let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
+    let big = limit + (32 << 20);
+    let mut run_length = [0x81u8, 0].repeat(big / 128 + 1); // runs of 128 zeros
+    run_length.push(128);
+    let mut a85 = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
+    std::io::Write::write_all(&mut a85, &b"z".repeat(big / 4 + 1)).unwrap();
+    let streams: [(&str, Vec<u8>); 5] = [
+        ("/FlateDecode", zlib_zeros(big)),
+        ("/FlateDecode", deflate_for_the_fallback(big)),
+        ("/LZWDecode", lzw_zeros(big / 7_000_000 + 1)),
+        ("/RunLengthDecode", run_length),
+        ("[/FlateDecode /ASCII85Decode]", a85.finish().unwrap()),
+    ];
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] >> endobj\n".to_vec();
+    for (i, (filter, data)) in streams.iter().enumerate() {
+        pdf.extend_from_slice(format!("{} 0 obj << /Filter {filter} /Length {} >> stream\n", i + 4, data.len()).as_bytes());
+        pdf.extend_from_slice(data);
+        pdf.extend_from_slice(b"\nendstream endobj\n");
+    }
+    pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+    let doc = Pdf::new(pdf).expect("parses");
+    let found: Vec<Stream<'_>> = doc.objects().into_iter().filter_map(|o| if let Object::Stream(s) = o { Some(s) } else { None }).collect();
+    assert_eq!(found.len(), 5, "all five bomb streams are found");
+    for stream in &found {
+        let what = format!("{:?}", stream.filters());
+        let decoded = stream.decoded().expect("a bomb still decodes, up to the limit");
+        assert_eq!(decoded.len(), limit, "{what}: stops at MAX_DECODED_STREAM, not at {big} bytes");
+        // An 8 × 8 one-byte grey image has 64 pixel bytes, plus at most a predictor tag byte
+        // for each.
+        let params = ImageDecodeParams { bpc: Some(8), num_components: Some(1), width: 8, height: 8, ..ImageDecodeParams::default() };
+        let image = stream.decoded_image(&params).expect("decodes as an image");
+        assert!(image.data.len() <= 128, "{what}: an 8 × 8 image decodes at most 128 bytes, not {}", image.data.len());
+    }
+}
+
+#[test]
+fn form_cycles_are_bounded_and_finite_nesting_paints() {
+    let cases = [
+        ("self-cycle", "/A Do 0 0 1 rg 0 0 8 8 re f", "0 0 1 rg 0 0 8 8 re f"),
+        ("two-form-cycle", "/B Do 0 0 1 rg 0 0 8 8 re f", "/A Do 0 0 1 rg 0 0 8 8 re f"),
+        ("finite-nesting", "/B Do", "0 0 1 rg 0 0 8 8 re f"),
+    ];
+    let page_content = "/A Do 1 0 0 rg 32 32 8 8 re f";
+    for (case, form_a, form_b) in cases {
+        let pdf = format!(
+            "%PDF-1.7\n\
+                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 40 40] >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /A 5 0 R /B 6 0 R >> >> >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n\
+                 5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Length {} >> stream\n{form_a}\nendstream endobj\n\
+                 6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Length {} >> stream\n{form_b}\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            page_content.len(),
+            form_a.len(),
+            form_b.len()
+        )
+        .into_bytes();
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(10)).unwrap_or_else(|_| panic!("{case}: render did not finish"));
+        assert!(page.error.is_none(), "{case}: {:?}", page.error);
+        assert_eq!((page.width, page.height), (40, 40), "{case}");
+        let pixel = |x: u32, y: u32| {
+            let offset = ((y * page.width + x) * 4) as usize;
+            [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
+        };
+        assert_eq!(pixel(3, 35), [0, 0, 255, 255], "{case}: nested form content paints");
+        assert_eq!(pixel(35, 4), [255, 0, 0, 255], "{case}: page content after the form still paints");
+    }
+}
+
+/// Review of the decompression-bomb fix: one stream stopping at `MAX_DECODED_STREAM` isn't
+/// enough when streams add up. A page's `/Contents` array can name the same bomb many times,
+/// and a form that paints itself nests fifty deep, each level keeping its content while the
+/// next runs. Vendored patches: a `/Contents` array shares one `MAX_DECODED_STREAM`
+/// (hayro-syntax), and page contents, forms, tiling patterns and Type 3 glyphs share a
+/// per-page budget (hayro-interpret `MAX_PAGE_CONTENT`).
+#[test]
+fn page_contents_and_nested_forms_share_one_budget() {
+    let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
+    let bomb = zlib_zeros(limit + (32 << 20));
+    // Three references to one bomb in /Contents decode no more than one stream's worth.
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [4 0 R 4 0 R 4 0 R] >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", bomb.len()).as_bytes());
+    pdf.extend_from_slice(&bomb);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let doc = Pdf::new(pdf).expect("parses");
+    let page = doc.pages().first().expect("one page");
+    let contents = page.page_stream().map_or(0, <[u8]>::len);
+    assert!(contents <= limit + 3, "the /Contents array decodes {contents} bytes, over one stream's {limit}");
+
+    // A form that paints itself before 256 MiB of spaces: every level would keep its content.
+    let mut content = b"/Fm0 Do ".to_vec();
+    content.resize(limit, b' ');
+    let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
+    std::io::Write::write_all(&mut z, &content).unwrap();
+    let form = z.finish().unwrap();
+    drop(content);
+    let page_content = b"/Fm0 Do 1 0 0 rg 0 0 4 4 re f";
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Fm0 5 0 R >> >> >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", page_content.len()).as_bytes());
+    pdf.extend_from_slice(page_content);
+    pdf.extend_from_slice(b"\nendstream endobj\n");
+    pdf.extend_from_slice(
+        format!("5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Resources << /XObject << /Fm0 5 0 R >> >> /Filter /FlateDecode /Length {} >> stream\n", form.len()).as_bytes(),
+    );
+    pdf.extend_from_slice(&form);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+    });
+    // Only a guard against a hang: the shared budget is checked by the warnings below, which
+    // come out the same on every machine. The render decodes and reads 512 MiB of content,
+    // a third of a second on a desktop, and a busy FreeBSD VM in CI ran past the minute this
+    // used to allow.
+    let page = rx.recv_timeout(std::time::Duration::from_secs(600)).expect("a self-painting form must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert!(page.warnings.contains(&RenderWarning::ContentTruncated), "the skipped nested content is observable");
+    assert_eq!(
+        page.warnings.iter().filter(|w| **w == RenderWarning::ContentTruncated).count(),
+        1,
+        "reported once per page, not once per nested paint"
+    );
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+}
+
+/// The page content budget counts what is held at once, not everything decoded: a form
+/// with 2 MiB of content painted three hundred times (600 MiB in all) draws every time.
+#[test]
+fn content_painted_again_and_again_keeps_drawing() {
+    let mut content = b"1 0 0 rg 0 0 4 4 re f ".to_vec();
+    content.resize(2 << 20, b' ');
+    let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());
+    std::io::Write::write_all(&mut z, &content).unwrap();
+    let form = z.finish().unwrap();
+    let mut page_content = "/Fm0 Do ".repeat(299);
+    page_content.push_str("q 1 0 0 1 30 30 cm /Fm0 Do Q");
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Fm0 5 0 R >> >> >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{page_content}\nendstream endobj\n", page_content.len()).as_bytes());
+    pdf.extend_from_slice(
+        format!("5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 40 40] /Filter /FlateDecode /Length {} >> stream\n", form.len()).as_bytes(),
+    );
+    pdf.extend_from_slice(&form);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    // The last paint is at user (30, 30)–(34, 34): device row 40 - 32 = 8.
+    assert_eq!(&page.rgba[((8 * 40 + 32) * 4)..][..4], &[255, 0, 0, 255], "the 300th paint is drawn");
+}
+
+/// Review of the decompression-bomb fix: a Type 0 sampled function read every sample of its
+/// stream into a 4-byte value, then a table entry each, so 256 MiB of 1-bit samples asked for
+/// over 8 GB. Vendored hayro-interpret patch: at most `MAX_SAMPLE_VALUES` samples, read no
+/// further than `/Size` asks.
+#[test]
+fn sampled_functions_with_billions_of_samples_are_refused() {
+    let bomb = zlib_zeros(hayro::hayro_syntax::MAX_DECODED_STREAM + (32 << 20));
+    let page_content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", page_content.len()).as_bytes());
+    pdf.extend_from_slice(page_content);
+    pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj << /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Function 6 0 R >> endobj\n");
+    pdf.extend_from_slice(
+        format!(
+            "6 0 obj << /FunctionType 0 /Domain [0 1] /Range [0 1] /Size [1073741824] /BitsPerSample 1 /Filter /FlateDecode /Length {} >> stream\n",
+            bomb.len()
+        )
+        .as_bytes(),
+    );
+    pdf.extend_from_slice(&bomb);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a sampled-function bomb must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+}
+
+/// A sampled function kept its samples in a hash map keyed by each point of its grid, built
+/// again every time a shading using it was painted (vendored hayro-interpret patch 31).
+/// InDesign pages paint 4096-sample gradient ramps dozens of times, and `bug1721218` in the
+/// pdf.js corpus spent most of its 1.5 s hashing them. The samples are now one flat array
+/// indexed by strides: this page paints a 2,097,152-sample ramp (the most a table may hold)
+/// 30 times, which took 38 seconds through the hash map.
+///
+/// The build each paint does is timed against reading the function's samples, the part of it
+/// no table can skip, not against a deadline: through the hash map it took about a hundred
+/// times as long as the read, through the flat array about as long. A deadline can't tell
+/// them apart on every machine: the hash map's 30 paints took 14 s on one desktop, the flat
+/// array's over 10 s on a busy FreeBSD VM in CI. No counter does either (both read every
+/// sample on every build), so the test compares two times taken on this thread, the fastest
+/// of several rounds of each: a stall from other work (other tests, swapping) would have to
+/// slow every build and spare a read to fail it.
+#[test]
+fn shadings_with_large_sampled_functions_paint_quickly() {
+    use hayro::hayro_interpret::Function;
+    use hayro_syntax::bit_reader::BitReader;
+    use hayro_syntax::object::{FromBytes, Object};
+    use std::time::{Duration, Instant};
+
+    const SAMPLES: usize = 1 << 21;
+    let samples = zlib_zeros(SAMPLES);
+    let function =
+        format!("<< /FunctionType 0 /Domain [0 1] /Range [0 1] /Size [{SAMPLES}] /BitsPerSample 8 /Filter /FlateDecode /Length {} >>", samples.len());
+    // Black ramp on the left half, 30 times over; a red square after it.
+    let content = "q 0 0 20 40 re W n /Sh0 sh Q\n".repeat(30) + "1 0 0 rg 36 36 4 4 re f";
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
+    pdf.extend_from_slice(b"5 0 obj << /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Function 6 0 R >> endobj\n");
+    pdf.extend_from_slice(format!("6 0 obj {function} stream\n").as_bytes());
+    pdf.extend_from_slice(&samples);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let page = render_first_page(pdf);
+    assert_eq!(rgb_at(&page.rgba, 40, 5, 20), [0, 0, 0], "the ramp is drawn");
+    assert_eq!(rgb_at(&page.rgba, 40, 30, 20), [255, 255, 255], "outside the clip");
+    assert_eq!(rgb_at(&page.rgba, 40, 38, 2), [255, 0, 0], "the rest of the page draws");
+
+    // What each paint does: build the function from its stream. Timed against reading the
+    // stream's samples, the part of the build no table can skip.
+    let mut bytes = format!("{function} stream\n").into_bytes();
+    bytes.extend_from_slice(&samples);
+    bytes.extend_from_slice(b"\nendstream");
+    let object = Object::from_bytes(&bytes).expect("a stream object");
+    let Object::Stream(stream) = &object else { panic!("the function is a stream") };
+    let (mut build, mut read) = (Duration::MAX, Duration::MAX);
+    for _ in 0..8 {
+        let started = Instant::now();
+        let function = Function::new(&object);
+        assert!(function.is_some(), "a sampled function");
+        drop(function);
+        build = build.min(started.elapsed());
+
+        let started = Instant::now();
+        let decoded = stream.decoded().expect("the samples decode");
+        let mut reader = BitReader::new(&decoded);
+        let mut values = Vec::new();
+        while values.len() < SAMPLES
+            && let Some(value) = reader.read(8)
+        {
+            values.push(value);
+        }
+        assert_eq!(std::hint::black_box(&values).len(), SAMPLES);
+        drop(values);
+        read = read.min(started.elapsed());
+    }
+    assert!(
+        build < read * 10,
+        "building a {SAMPLES}-sample function took {build:?}, over ten times the {read:?} reading its samples takes (a hash map took a hundred times)"
+    );
+}
+
+/// Patch 31's flat table gives every sampled function the values the hash map gave: points
+/// on the grid, multilinear interpolation between them (first input varying fastest), and no
+/// value where a sample the interpolation needs is missing from a short stream.
+#[test]
+fn sampled_functions_interpolate_their_grid_as_before() {
+    use hayro::hayro_interpret::Function;
+    use hayro_syntax::object::{FromBytes, Object};
+
+    // Size [3 2], two outputs: out0 = 40 i + 60 j (linear), out1 = 100 i j (bilinear only).
+    let mut samples = Vec::new();
+    for j in 0..2u8 {
+        for i in 0..3u8 {
+            samples.extend_from_slice(&[40 * i + 60 * j, 100 * i * j]);
+        }
+    }
+    let function = |data: &[u8]| {
+        let mut bytes =
+            format!("<< /FunctionType 0 /Domain [0 1 0 1] /Range [0 1 0 1] /Size [3 2] /BitsPerSample 8 /Length {} >> stream\n", data.len())
+                .into_bytes();
+        bytes.extend_from_slice(data);
+        bytes.extend_from_slice(b"\nendstream");
+        bytes
+    };
+    let whole = function(&samples);
+    let f = Function::new(&Object::from_bytes(&whole).expect("a stream object")).expect("a sampled function");
+    for (x, y) in [(0.0, 0.0), (1.0, 1.0), (0.5, 0.0), (0.25, 0.5), (0.75, 0.25), (0.1, 0.9), (1.0, 0.3)] {
+        let (gi, gj) = (2.0 * x, y);
+        let got = f.eval([x, y].into_iter().collect()).expect("every sample is present");
+        let want = [(40.0 * gi + 60.0 * gj) / 255.0, 100.0 * gi.min(1.0) * gj / 255.0 + 100.0 * (gi - 1.0).max(0.0) * gj / 255.0];
+        assert!(got.len() == 2 && got.iter().zip(want).all(|(g, w)| (g - w).abs() < 1e-5), "({x}, {y}): got {got:?}, want {want:?}");
+    }
+    // Only the j = 0 row: points on it evaluate, points needing j = 1 have no value.
+    let short = function(&samples[..6]);
+    let f = Function::new(&Object::from_bytes(&short).expect("a stream object")).expect("a sampled function");
+    assert_eq!(f.eval([0.5, 0.0].into_iter().collect()).map(|v| v.to_vec()), Some(vec![40.0 / 255.0, 0.0]));
+    assert_eq!(f.eval([0.5, 0.5].into_iter().collect()), None);
+}
+
+/// From `cargo xtask fuzz`: a mesh shading whose points lie far off the page (a 147-byte
+/// Coons patch stream decoded onto ±40000) was sampled pixel by pixel over its whole
+/// bounding box, up to 65536 × 65536 entries: a synthetic page passed 6 GB in six seconds.
+/// Vendored hayro-interpret patch: mesh shadings are sampled only where they are drawn,
+/// within eight visits per pixel of that area plus four per triangle in it.
+#[test]
+fn mesh_shadings_far_off_the_page_render() {
+    let render = |shading: Vec<u8>| {
+        let content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj ");
+        pdf.extend_from_slice(&shading);
+        pdf.extend_from_slice(b" endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a mesh shading must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        page
+    };
+    let stream = |dict: &str, data: &[u8]| {
+        let mut s = format!("<< {dict} /Length {} >> stream\n", data.len()).into_bytes();
+        s.extend_from_slice(data);
+        s.extend_from_slice(b"\nendstream");
+        s
+    };
+    // One Coons patch (flag, 12 points, 4 colours) with 8-bit coordinates around its square.
+    let mut coons = vec![0u8];
+    for p in [(0, 0), (0, 85), (0, 170), (0, 255), (85, 255), (170, 255), (255, 255), (255, 170), (255, 85), (255, 0), (170, 0), (85, 0)] {
+        coons.extend_from_slice(&[p.0, p.1]);
+    }
+    coons.extend_from_slice(&[255, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 0]);
+    // A free-form triangle mesh: three vertices (flag, x, y, colour).
+    let triangles = [0u8, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255];
+    let mesh = "/ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8";
+    let far = "/Decode [-40000 40000 -40000 40000 0 1 0 1 0 1]";
+    for (what, shading) in [
+        ("a Coons patch", stream(&format!("/ShadingType 6 {mesh} {far}"), &coons)),
+        ("a triangle mesh", stream(&format!("/ShadingType 4 {mesh} {far}"), &triangles)),
+    ] {
+        let page = render(shading);
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{what} far off the page: the rest of the page draws");
+    }
+    // A patch on the page, and the part of the huge one that covers it, are still shaded:
+    // the centre is neither white nor transparent.
+    for (what, decode) in [("on the page", "[0 40 0 40 0 1 0 1 0 1]"), ("covering the page", "[-40000 40000 -40000 40000 0 1 0 1 0 1]")] {
+        let page = render(stream(&format!("/ShadingType 6 {mesh} /Decode {decode}"), &coons));
+        let centre = &page.rgba[((20 * 40 + 20) * 4)..][..4];
+        assert!(centre != [255, 255, 255, 255] && centre[3] == 255, "a patch {what} is shaded: {centre:?}");
+    }
+    // A patch filling a 4 × 4 pt rectangle as a pattern is 722 triangles of a fraction of a
+    // pixel each: far more visits than its 16 pixels give, which the per-triangle allowance
+    // covers. The rectangle's middle is shaded.
+    let content = b"/Pattern cs /P0 scn 10 10 4 4 re f";
+    let shading = stream(&format!("/ShadingType 6 {mesh} /Decode [10 14 10 14 0 1 0 1 0 1]"), &coons);
+    let mut pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Pattern << /P0 << /PatternType 2 /Shading 5 0 R >> >> >> >> endobj
+".to_vec();
+    pdf.extend_from_slice(
+        format!(
+            "4 0 obj << /Length {} >> stream
+",
+            content.len()
+        )
+        .as_bytes(),
+    );
+    pdf.extend_from_slice(content);
+    pdf.extend_from_slice(
+        b"
+endstream endobj
+5 0 obj ",
+    );
+    pdf.extend_from_slice(&shading);
+    pdf.extend_from_slice(
+        b" endobj
+trailer << /Root 1 0 R >>
+%%EOF
+",
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    let middle = &page.rgba[((28 * 40 + 12) * 4)..][..4];
+    assert!(middle != [255, 255, 255, 255] && middle[3] == 255, "a small patch is shaded: {middle:?}");
+}
+
+/// Coons and tensor-product patches put each corner's colour at its corner and blend them
+/// in between. Patch 33 interpolates each point of a patch's 20 × 20 triangle grid once
+/// instead of once per cell touching it, and moves vertices instead of copying them; these
+/// colours (taken before that change) pin that every vertex still gets its own point's colour.
+#[test]
+fn patch_meshes_keep_their_corner_colours() {
+    // Points on a 4 × 4 grid over the 40 pt page, in stream order: the 12 boundary points
+    // (both patch types), then a tensor patch's four interior ones.
+    let grid = |x: u8, y: u8| [x * 85, y * 85];
+    let boundary = [(0, 0), (0, 1), (0, 2), (0, 3), (1, 3), (2, 3), (3, 3), (3, 2), (3, 1), (3, 0), (2, 0), (1, 0)];
+    let interior = [(1, 1), (1, 2), (2, 2), (2, 1)];
+    let colours = [255u8, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 0];
+    let patch = |points: &[(u8, u8)]| {
+        let mut data = vec![0u8];
+        data.extend(points.iter().flat_map(|(x, y)| grid(*x, *y)));
+        data.extend_from_slice(&colours);
+        data
+    };
+    let render = |shading_type: u8, data: Vec<u8>| {
+        let content = b"/Sh0 sh";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /ShadingType {shading_type} /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 40 0 40 0 1 0 1 0 1] /Length {} >> stream\n", data.len()).as_bytes());
+        pdf.extend_from_slice(&data);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        render_first_page(pdf)
+    };
+    let coons = render(6, patch(&boundary));
+    let tensor = render(7, patch(&[&boundary[..], &interior[..]].concat()));
+    // Near each corner (top-left, bottom-left, bottom-right, top-right in the raster), the
+    // centre, and a point between them.
+    let want = [
+        ((5, 5), [32, 199, 28]),
+        ((5, 34), [217, 61, 5]),
+        ((34, 34), [217, 190, 32]),
+        ((34, 5), [32, 61, 190]),
+        ((20, 20), [127, 128, 64]),
+        ((12, 27), [172, 110, 25]),
+    ];
+    for (what, page) in [("Coons", &coons), ("tensor", &tensor)] {
+        for ((x, y), colour) in want {
+            let got = rgb_at(&page.rgba, 40, x, y);
+            assert!(got.iter().zip(colour).all(|(g, w)| g.abs_diff(w) <= 1), "{what} patch at ({x}, {y}): got {got:?}, want {colour:?}");
+        }
+    }
+}
+
+/// The other half of the mesh-shading patch: ten thousand triangles that each cover half
+/// of this 1000 × 1000 canvas walked their bounding boxes ten thousand times over (ten
+/// billion visits). The visit budget stops that work at eight per pixel plus four per
+/// triangle.
+#[test]
+fn many_overlapping_mesh_triangles_finish() {
+    // Each triangle: three vertices of flag, x, y, red, green, blue; half of the page.
+    let one = [0u8, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255, 0, 0, 0, 255, 0, 0, 255];
+    let triangles = one.repeat(10_000);
+    let content = b"/Sh0 sh";
+    let mut pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj
+"
+    .to_vec();
+    pdf.extend_from_slice(
+        format!(
+            "4 0 obj << /Length {} >> stream
+",
+            content.len()
+        )
+        .as_bytes(),
+    );
+    pdf.extend_from_slice(content);
+    pdf.extend_from_slice(
+        format!("
+endstream endobj
+5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 40 0 40 0 1 0 1 0 1] /Length {} >> stream
+", triangles.len())
+            .as_bytes(),
+    );
+    pdf.extend_from_slice(&triangles);
+    pdf.extend_from_slice(
+        b"
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF
+",
+    );
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 25.0, tag: 0, ..Default::default() }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("overlapping mesh triangles must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (1000, 1000));
+    // The triangles cover the lower left half: a pixel there is shaded.
+    let p = &page.rgba[((900 * 1000 + 100) * 4)..][..4];
+    assert!(p != [255, 255, 255, 255] && p[3] == 255, "the triangles are drawn: {p:?}");
+}
+
+/// Two triangles of a mesh that share an edge cover it together. The sampler tested each
+/// pixel's corner, and only strictly inside a triangle, so the diagonal two triangles share
+/// was left white wherever it ran through the samples, and so was a pixel row or column
+/// along the mesh's own sides. Vendored hayro-interpret patch 36.
+#[test]
+fn mesh_triangles_sharing_an_edge_leave_no_seam() {
+    // A red square from 10 to 40 on a 50 × 50 page, cut along its diagonal; in device space
+    // the diagonal runs through pixel centres and corners alike.
+    let vertex = |flag: u8, x: u8, y: u8| [flag, x, y, 255, 0, 0];
+    let (lo, hi) = (10, 40);
+    let mut triangles = Vec::new();
+    for [a, b, c] in [[(lo, lo), (hi, lo), (hi, hi)], [(lo, lo), (hi, hi), (lo, hi)]] {
+        for (x, y) in [a, b, c] {
+            triangles.extend(vertex(0, x, y));
+        }
+    }
+    // Each triangle as its own three vertices, and the second one as a strip (flag 1).
+    let mut strip = Vec::new();
+    for (flag, (x, y)) in [(0, (lo, lo)), (0, (hi, lo)), (0, (hi, hi)), (2, (lo, hi))] {
+        strip.extend(vertex(flag, x, y));
+    }
+    for (label, data) in [("separate triangles", triangles), ("a strip", strip)] {
+        let content = b"/Sh0 sh";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 50 50] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 255 0 255 0 1 0 1 0 1] /Length {} >> stream\n", data.len()).as_bytes());
+        pdf.extend_from_slice(&data);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{label}: {:?}", page.error);
+        assert_eq!((page.width, page.height), (50, 50));
+        let (mut white_inside, mut red_outside) = (Vec::new(), Vec::new());
+        for y in 0..50_usize {
+            for x in 0..50_usize {
+                let p = &page.rgba[(y * 50 + x) * 4..][..4];
+                let inside = (10..40).contains(&x) && (10..40).contains(&y);
+                if inside && p != [255, 0, 0, 255] {
+                    white_inside.push((x, y));
+                } else if !inside && p != [255, 255, 255, 255] {
+                    red_outside.push((x, y));
+                }
+            }
+        }
+        assert!(white_inside.is_empty(), "{label}: unshaded pixels inside the square: {white_inside:?}");
+        assert!(red_outside.is_empty(), "{label}: shaded pixels outside the square: {red_outside:?}");
+    }
+
+    // One triangle alone, the square's upper left half: a pixel whose corner lies on its
+    // diagonal is taken by its centre, so one wholly across the diagonal (x + y ≥ 50 in
+    // device space) is not shaded, and one wholly inside is.
+    let mut data = Vec::new();
+    for (x, y) in [(lo, lo), (hi, hi), (lo, hi)] {
+        data.extend(vertex(0, x, y));
+    }
+    let content = b"/Sh0 sh";
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 50 50] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+    pdf.extend_from_slice(content);
+    pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 255 0 255 0 1 0 1 0 1] /Length {} >> stream\n", data.len()).as_bytes());
+    pdf.extend_from_slice(&data);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    let (mut spilled, mut missing) = (Vec::new(), Vec::new());
+    for y in 10..40_usize {
+        for x in 10..40_usize {
+            let p = &page.rgba[(y * 50 + x) * 4..][..4];
+            if x + y >= 50 && p == [255, 0, 0, 255] {
+                spilled.push((x, y));
+            } else if x + y + 2 <= 50 && p != [255, 0, 0, 255] {
+                missing.push((x, y));
+            }
+        }
+    }
+    assert!(spilled.is_empty(), "shaded pixels wholly across the diagonal: {spilled:?}");
+    assert!(missing.is_empty(), "unshaded pixels wholly inside the triangle: {missing:?}");
+}
+
+/// A pixel whose corner is inside one triangle and whose centre is inside its neighbour
+/// takes the colour at its corner, whichever triangle comes first (patch 36): the
+/// centre-coverage pass only fills pixels no triangle has given a colour yet. Here the
+/// shared diagonal lies at x + y = 50.25 in device space, so pixel (20, 30) has its corner
+/// in the red triangle and its centre in the blue one.
+#[test]
+fn a_shared_edge_pixel_keeps_the_colour_at_its_corner() {
+    let vertex = |x: u8, y: u8, rgb: [u8; 3]| [0, x, y, rgb[0], rgb[1], rgb[2]];
+    let (lo, hi) = (10, 40);
+    let (red, blue) = ([255, 0, 0], [0, 0, 255]);
+    // In PDF space the red triangle is the square's upper left half, the blue one the lower
+    // right; `cm` moves both down a quarter point.
+    let red_triangle = [(lo, lo, red), (hi, hi, red), (lo, hi, red)];
+    let blue_triangle = [(lo, lo, blue), (hi, lo, blue), (hi, hi, blue)];
+    for (label, order) in [("red first", [red_triangle, blue_triangle]), ("blue first", [blue_triangle, red_triangle])] {
+        let mut data = Vec::new();
+        for triangle in order {
+            for (x, y, rgb) in triangle {
+                data.extend(vertex(x, y, rgb));
+            }
+        }
+        let content = b"1 0 0 1 0 -0.25 cm /Sh0 sh";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 50 50] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 255 0 255 0 1 0 1 0 1] /Length {} >> stream\n", data.len()).as_bytes());
+        pdf.extend_from_slice(&data);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{label}: {:?}", page.error);
+        let pixel = |x: usize, y: usize| page.rgba[(y * 50 + x) * 4..][..4].to_vec();
+        assert_eq!(pixel(20, 30), [255, 0, 0, 255], "{label}: the corner of pixel (20, 30) is in the red triangle");
+        // Controls: wholly inside one triangle or the other.
+        assert_eq!(pixel(15, 20), [255, 0, 0, 255], "{label}");
+        assert_eq!(pixel(35, 30), [0, 0, 255, 255], "{label}");
+    }
+}
+
+/// Review of the mesh-shading patch: every patch was cut into 722 triangles before anything
+/// limited them (about 150 KB per patch), and a lattice mesh with `/VerticesPerRow 0` pushed
+/// empty rows for ever. Vendored hayro-interpret patch: patches are triangulated one at a
+/// time, meshes hold at most `MAX_MESH_PATCHES` patches and `MAX_MESH_TRIANGLES` triangles,
+/// and a lattice needs two vertices per row.
+#[test]
+fn mesh_shadings_with_many_patches_or_no_rows_finish() {
+    let render = |shading: Vec<u8>| {
+        let content = b"/Sh0 sh 1 0 0 rg 0 0 4 4 re f";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj ");
+        pdf.extend_from_slice(&shading);
+        pdf.extend_from_slice(b" endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a mesh shading must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+    };
+    let stream = |dict: &str, data: &[u8]| {
+        let mut s = format!("<< {dict} /Length {} >> stream\n", data.len()).into_bytes();
+        s.extend_from_slice(data);
+        s.extend_from_slice(b"\nendstream");
+        s
+    };
+    let mesh = "/ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8";
+    // Forty thousand Coons patches beside the page: 6 GB of triangles if collected first.
+    let mut coons = vec![0u8];
+    for p in [(0, 0), (0, 85), (0, 170), (0, 255), (85, 255), (170, 255), (255, 255), (255, 170), (255, 85), (255, 0), (170, 0), (85, 0)] {
+        coons.extend_from_slice(&[p.0, p.1]);
+    }
+    coons.extend_from_slice(&[255, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 0]);
+    render(stream(&format!("/ShadingType 6 {mesh} /BitsPerFlag 8 /Decode [100 140 100 140 0 1 0 1 0 1]"), &coons.repeat(40_000)));
+    // A lattice with no vertices per row.
+    render(stream(&format!("/ShadingType 5 {mesh} /VerticesPerRow 0 /Decode [0 40 0 40 0 1 0 1 0 1]"), &[0u8; 64]));
+}
+
+/// From the nightly `cargo xtask fuzz`: an embedded Type 1 font program holding a long run of
+/// integers. read-fonts 0.39 (through skrifa 0.42) looked ahead after every integer by
+/// parsing the next token, which looked ahead again, recursing through the whole run: a long
+/// run hung, and 20,000 numbers overflowed the stack and aborted the process. Fixed upstream:
+/// the vendored hayro-interpret now uses skrifa 0.47 (read-fonts 0.44).
+#[test]
+fn type1_font_programs_with_long_runs_of_numbers_load_quickly() {
+    let mut font = b"%!PS-AdobeFont-1.0: Fuzz 001\n/FontMatrix [0.001 0 0 0.001 0 0] readonly def\n".to_vec();
+    for _ in 0..20_000 {
+        font.extend_from_slice(b"1 ");
+    }
+    let content = b"BT /F1 12 Tf 5 20 Td (Hi) Tj ET 1 0 0 rg 0 0 4 4 re f";
+    let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n".to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+    pdf.extend_from_slice(content);
+    pdf.extend_from_slice(b"\nendstream endobj\n5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Fuzz /FontDescriptor 6 0 R >> endobj\n");
+    pdf.extend_from_slice(b"6 0 obj << /Type /FontDescriptor /FontName /Fuzz /Flags 32 /FontBBox [0 0 1000 1000] /ItalicAngle 0 /Ascent 800 /Descent -200 /CapHeight 700 /StemV 80 /FontFile 7 0 R >> endobj\n");
+    pdf.extend_from_slice(format!("7 0 obj << /Length {} /Length1 {} /Length2 0 /Length3 0 >> stream\n", font.len(), font.len()).as_bytes());
+    pdf.extend_from_slice(&font);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("a Type 1 font must not stall the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
+}
+
+/// From `cargo xtask fuzz`: an inline image claiming /W 4294967295 over four bytes of data
+/// hung in resampling (vendored hayro patch: `MAX_IMAGE_PIXELS`).
+#[test]
+fn absurd_image_dimensions_are_skipped() {
+    let content = "q 20 0 0 20 5 5 cm BI /W 4294967295 /H 2 /BPC 8 /CS /G ID \u{0}\u{ff}\u{ff}\u{0} EI Q 1 0 0 rg 0 0 4 4 re f";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }));
+    });
+    let page = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("an absurd image must not hang the renderer");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    // The rest of the page still draws: the red square at the bottom left (y-down: last rows).
+    assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255]);
+}
+
+/// Hex-encodes `bytes` for an `/ASCIIHexDecode` stream.
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|b| format!("{b:02x}")).collect()
+}
+
+/// An 8×4 source of 2×2 blocks: block column `x / 2` and row `y / 2` takes `levels[(y / 2) * 4 + x / 2]`.
+fn block_source<T: Copy>(levels: [T; 8]) -> Vec<T> {
+    (0..32).map(|i| levels[(i / 16) * 4 + (i % 8) / 2]).collect()
+}
+
+/// Draws one `size` image of colour space `space` (`data` as raw samples, with an optional gray
+/// `/SMask` of the same size) at 1:1 on a `device`-sized page, writing `/Interpolate` when given.
+fn draw_minified_image(
+    space: &str,
+    size: (u32, u32),
+    interpolate: Option<bool>,
+    data: &[u8],
+    alpha: Option<&[u8]>,
+    device: (u32, u32),
+) -> RenderedPage {
+    let (width, height) = size;
+    let interp = interpolate.map_or_else(String::new, |value| format!("/Interpolate {value} "));
+    let (smask, mask) = match alpha {
+        Some(alpha) => (
+            "/SMask 6 0 R ",
+            format!(
+                "6 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height {height} /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length {} >> stream\n{}>\nendstream endobj\n",
+                hex(alpha).len() + 1,
+                hex(alpha)
+            ),
+        ),
+        None => ("", String::new()),
+    };
+    let image = hex(data);
+    let content = format!("q {} 0 0 {} 0 0 cm /Im0 Do Q", device.0, device.1);
+    let pdf = format!(
+        "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {} {}] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height {height} /ColorSpace /{space} /BitsPerComponent 8 {interp}{smask}/Filter /ASCIIHexDecode /Length {} >> stream\n{image}>\nendstream endobj\n\
+             {mask}trailer << /Root 1 0 R >>\n%%EOF\n",
+        device.0,
+        device.1,
+        content.len(),
+        image.len() + 1
+    );
+    let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), device);
+    page
+}
+
+/// Issue #624: an image drawn below its source resolution was pre-resampled with Catmull-Rom
+/// even when `/Interpolate` was false (or absent, whose PDF default is false). That blends
+/// neighboring samples before the renderer's later non-interpolating image sampler sees them,
+/// making scans, screenshots and rasterized text look soft.
+#[test]
+fn non_interpolated_images_are_not_smoothed_when_minified() {
+    // Top band K W R G, bottom band B Y M C. Nearest 8×4 → 4×2 sampling picks each block's
+    // pixel, so every device pixel is one palette colour; Catmull-Rom blends across blocks.
+    let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
+    let rgb: Vec<u8> = block_source(palette).concat();
+    let exact: Vec<[u8; 4]> = palette.iter().map(|c| [c[0], c[1], c[2], 255]).collect();
+    let pixels = |p: &RenderedPage| p.rgba.as_chunks::<4>().0.to_vec();
+
+    // `/Interpolate` defaults to false, and explicit false is equivalent.
+    let omitted = draw_minified_image("DeviceRGB", (8, 4), None, &rgb, None, (4, 2));
+    assert_eq!(pixels(&omitted), exact, "default interpolation");
+    let disabled = draw_minified_image("DeviceRGB", (8, 4), Some(false), &rgb, None, (4, 2));
+    assert_eq!(&omitted.rgba[..], &disabled.rgba[..], "/Interpolate false must match the default");
+
+    // The fix must not disable interpolation: the same source asking for it blends blocks.
+    let enabled = draw_minified_image("DeviceRGB", (8, 4), Some(true), &rgb, None, (4, 2));
+    assert_ne!(pixels(&enabled), exact, "/Interpolate true should still blend");
+    assert!(pixels(&enabled).iter().any(|px| px[..3].iter().any(|&c| (32..=223).contains(&c))), "/Interpolate true made no mid-tone");
+}
+
+/// A shrunk, interpolated image whose edges fall between device pixels is snapped to whole
+/// pixels (shrunk once to that size, drawn 1:1). Before, the shrunk raster was sampled a second
+/// time at the fractional offset, so every edge of a scan was a blended, soft pixel.
+#[test]
+fn interpolated_minified_image_edges_snap_to_whole_pixels() {
+    let black = vec![0u8; 40 * 40];
+    let content = "q 10 0 0 10 0.4 0.4 cm /Im0 Do Q";
+    let image = hex(&black);
+    let pdf = format!(
+        "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 11 11] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width 40 /Height 40 /ColorSpace /DeviceGray /BitsPerComponent 8 /Interpolate true /Filter /ASCIIHexDecode /Length {} >> stream\n{image}>\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF\n",
+        content.len(),
+        image.len() + 1
+    );
+    let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (11, 11));
+    let gray = |x: usize, y: usize| page.rgba[(y * 11 + x) * 4];
+    // Device box 0.4..10.4 × 0.6..10.6 snaps to columns 0..10 and rows 1..11.
+    for y in 1..11 {
+        for x in 0..10 {
+            assert_eq!(gray(x, y), 0, "pixel ({x}, {y}) inside the snapped image");
+        }
+        assert_eq!(gray(10, y), 255, "column 10 is outside the snapped image (row {y})");
+    }
+    for x in 0..11 {
+        assert_eq!(gray(x, 0), 255, "row 0 is outside the snapped image (column {x})");
+    }
+}
+
+#[test]
+fn non_interpolated_gray_images_are_not_smoothed_when_minified() {
+    let levels = [0u8, 255, 85, 170, 40, 200, 120, 230];
+    let page = draw_minified_image("DeviceGray", (8, 4), None, &block_source(levels), None, (4, 2));
+    let expected: Vec<[u8; 4]> = levels.iter().map(|&v| [v, v, v, 255]).collect();
+    assert_eq!(page.rgba.as_chunks::<4>().0.to_vec(), expected);
+}
+
+#[test]
+fn non_integer_minification_samples_the_same_columns() {
+    // Ten columns drawn six pixels wide: centre sampling reads columns 0, 2, 4, 5, 7 and 9.
+    let ramp = [10u8, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+    let page = draw_minified_image("DeviceGray", (10, 1), None, &ramp, None, (6, 1));
+    let grays: Vec<u8> = page.rgba.as_chunks::<4>().0.iter().map(|px| px[0]).collect();
+    assert_eq!(grays, [10, 30, 50, 60, 80, 100]);
+}
+
+#[test]
+fn non_integer_minification_samples_colour_and_mask_from_the_same_columns() {
+    // Ten gray columns with a soft mask, drawn six pixels wide: columns 0, 2, 4, 5, 7 and 9 are
+    // sampled, so the mask must pick the same columns as the colours.
+    let ramp = [10u8, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+    let mask = [255u8, 0, 0, 0, 255, 255, 0, 0, 0, 255];
+    let page = draw_minified_image("DeviceGray", (10, 1), None, &ramp, Some(&mask), (6, 1));
+    // Opaque columns keep their gray; transparent columns show the white page.
+    assert_eq!(
+        page.rgba.as_chunks::<4>().0.to_vec(),
+        vec![[10, 10, 10, 255], [255, 255, 255, 255], [50, 50, 50, 255], [60, 60, 60, 255], [255, 255, 255, 255], [100, 100, 100, 255]]
+    );
+}
+
+#[test]
+fn non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified() {
+    let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
+    let rgb: Vec<u8> = block_source(palette).concat();
+    let alpha = block_source([255u8, 0, 128, 255, 0, 255, 64, 128]);
+    let page = draw_minified_image("DeviceRGB", (8, 4), None, &rgb, Some(&alpha), (4, 2));
+    // Premultiplied colours composited over the white page: alpha 0 shows the page.
+    let expected = vec![
+        [0, 0, 0, 255],
+        [255, 255, 255, 255],
+        [255, 127, 127, 255],
+        [0, 255, 0, 255],
+        [255, 255, 255, 255],
+        [255, 255, 0, 255],
+        [255, 191, 255, 255],
+        [127, 255, 255, 255],
+    ];
+    assert_eq!(page.rgba.as_chunks::<4>().0.to_vec(), expected);
+}
+
+/// Issue #1649: Word can save text as a tiny black image whose `/SMask` is a high-resolution
+/// bitmap of the glyphs, so the mask alone carries the text. Shrinking that mask by
+/// nearest-neighbour keeps one sample in N, and a stroke thinner than N mask pixels vanished:
+/// the text came out broken and aliased. Here a one-column stroke of an 8-column mask is drawn
+/// 4 pixels wide; nearest reads columns 1, 3, 5 and 7 and misses the stroke in column 2.
+#[test]
+fn shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes() {
+    let mask: [u8; 8] = [0, 0, 255, 0, 0, 0, 0, 0];
+    let content = "q 4 0 0 1 0 0 cm /Im0 Do Q";
+    let pdf = format!(
+        "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 4 1] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /SMask 6 0 R /Filter /ASCIIHexDecode /Length 3 >> stream\n00>\nendstream endobj\n\
+             6 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length {} >> stream\n{}>\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF\n",
+        content.len(),
+        hex(&mask).len() + 1,
+        hex(&mask)
+    );
+    let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!((page.width, page.height), (4, 1));
+    let grays: Vec<u8> = page.rgba.as_chunks::<4>().0.iter().map(|px| px[0]).collect();
+    // The stroke covers half of device pixel 1, so it is a mid-tone; the far side stays white.
+    assert!((64..=191).contains(&grays[1]), "the stroke is lost or not a mid-tone: {grays:?}");
+    assert_eq!(grays[3], 255, "{grays:?}");
+}
+
+/// Type 3 glyph images used to be sampled bicubically (`ImageQuality::High`) whatever their
+/// `/Interpolate`, which blends the nearest pre-resize back in. The glyph is 4.6 × 2.3 pixels
+/// and its image pre-resizes to 5 × 3, so the final draw samples fractionally and bicubic
+/// filtering would blend palette colours. Interior pixels must stay palette colours unless the
+/// image asks for interpolation.
+#[test]
+fn non_interpolated_type3_glyph_images_are_not_smoothed_when_minified() {
+    let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
+    let data = hex(&block_source(palette).concat());
+    let render = |interp: &str| {
+        let content = "BT /F1 1 Tf 0 0.7 Td (A) Tj ET";
+        let glyph = "4.6 0 d0 q 4.6 0 0 2.3 0 0 cm /Im0 Do Q";
+        let pdf = format!(
+            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 5 3] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [5] /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> /Resources << /XObject << /Im0 7 0 R >> >> >> endobj\n\
+                 6 0 obj << /Length {} >> stream\n{glyph}\nendstream endobj\n\
+                 7 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace /DeviceRGB /BitsPerComponent 8 {interp}/Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF\n",
+            content.len(),
+            glyph.len(),
+            data.len() + 1
+        );
+        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (5, 3));
+        page
+    };
+    // The glyph fully covers columns 0–3 and rows 0–1.
+    let interior = |p: &RenderedPage| -> Vec<[u8; 3]> {
+        (0..2).flat_map(|y| (0..4).map(move |x| (y * 5 + x) * 4)).map(|i| [p.rgba[i], p.rgba[i + 1], p.rgba[i + 2]]).collect()
+    };
+
+    let omitted = render("");
+    for px in interior(&omitted) {
+        assert!(palette.contains(&px), "non-interpolated glyph image was smoothed to {px:?}");
+    }
+    let enabled = render("/Interpolate true ");
+    assert!(interior(&enabled).iter().any(|px| !palette.contains(px)), "/Interpolate true glyph image should still be sampled bicubically");
+}
+
+/// From `cargo xtask fuzz`: a CID font whose /W range spans every u32 inserted billions of
+/// widths (vendored hayro-interpret patch: `MAX_CID`). Must finish quickly.
+#[test]
+fn huge_cid_width_ranges_terminate() {
+    let pdf = "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length 35 >> stream
+BT /F1 12 Tf 10 10 Td <0041> Tj ET
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /Helvetica /Encoding /Identity-H /DescendantFonts [6 0 R] >> endobj
+6 0 obj << /Type /Font /Subtype /CIDFontType2 /BaseFont /Helvetica /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >>
+  /FontDescriptor 7 0 R /W [0 4294967295 500] /W2 [0 4294967295 -1000 250 880] >> endobj
+7 0 obj << /Type /FontDescriptor /FontName /Helvetica /Flags 32 /FontBBox [0 -200 1000 900] /ItalicAngle 0 /Ascent 800 /Descent -200 /CapHeight 700 /StemV 80 >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(pdf.as_bytes().to_vec()), RenderConfig::default());
+        let px = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        let text = r.render(RenderRequest { page: 0, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        let _ = tx.send((px.error, text.error));
+    });
+    let (px, text) = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("rendering a huge /W range must not hang");
+    assert!(px.is_none() && text.is_none(), "{px:?} {text:?}");
+}
+
+/// "BBBA" at 20 pt in a Type 3 font whose glyph (for both codes) is a solid 300 × 700 box,
+/// with the given /FirstChar, /LastChar and /Widths. No font program is needed, and Type 3
+/// widths are read like those of every other simple font.
+fn type3_boxes(widths: &str) -> Vec<u8> {
+    let content = "BT /F1 20 Tf 20 40 Td (BBBA) Tj ET";
+    format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 1000 1000] /FontMatrix [0.001 0 0 0.001 0 0] {widths}
+  /Encoding << /Differences [65 /a /a] >> /CharProcs << /a 6 0 R >> >> endobj
+6 0 obj << /Length 27 >> stream
+600 0 d0 100 0 400 700 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    )
+    .into_bytes()
+}
+
+/// Simple-font widths (vendored hayro-interpret patch to `read_widths`): an entry of /Widths
+/// that isn't a number ended the array, so every later code lost its width, and a /LastChar
+/// below /FirstChar (or one that overflowed) made the whole font fail to load, replaced by a
+/// standard font. MuPDF, Poppler, PDFium and pdf.js skip just that entry and keep the font.
+#[test]
+fn malformed_simple_font_widths_keep_later_widths_and_the_font() {
+    let render = |widths: &str| {
+        let mut r = PageRenderer::new(Arc::new(type3_boxes(widths)), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{widths}: {:?}", p.error);
+        p
+    };
+    // Glyph boxes span x 22..28 plus 12 pt per advance, and y 46..60 (y down).
+    let inked = |p: &RenderedPage, x: u32| (47..59).all(|y| p.rgba[((y * p.width + x) * 4) as usize] < 64);
+    for widths in [
+        "/FirstChar 65 /LastChar 66 /Widths [600 600]",
+        "/FirstChar 65 /LastChar 66 /Widths [null 600]",
+        "/FirstChar 65 /LastChar 66 /Widths [/W 600]",
+    ] {
+        let p = render(widths);
+        assert!([25, 37, 49, 61].iter().all(|x| inked(&p, *x)), "{widths}: each B advances 600");
+        assert!(!inked(&p, 31), "{widths}");
+    }
+    for widths in ["/FirstChar 66 /LastChar 65 /Widths [600 600]", "/FirstChar 4294967295 /LastChar 66 /Widths [600 600]"] {
+        let p = render(widths);
+        // The font's own box, drawn without advances (no width applies), not a stand-in font.
+        assert!(inked(&p, 23) && inked(&p, 27), "{widths}: the Type 3 glyph is drawn");
+        assert!(!inked(&p, 37), "{widths}: no width, no advance");
+    }
+}
+
+/// Simple-font widths (vendored hayro-interpret patch to `read_widths`): /FirstChar sized an
+/// allocation, one entry per code below it, before any width was read. 50,000,000 already
+/// took 276 MB; 4294967295 asks for 34 GB. Codes of a simple font stop at 255.
+#[test]
+fn huge_simple_font_first_char_terminates() {
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut r = PageRenderer::new(Arc::new(type3_boxes("/FirstChar 4294967295 /LastChar 4294967295 /Widths [600]")), RenderConfig::default());
+        let px = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        let text = r.render(RenderRequest { page: 0, kind: RequestKind::Text, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        let _ = tx.send((px, text.error));
+    });
+    let (px, text) = rx.recv_timeout(std::time::Duration::from_secs(20)).expect("a huge /FirstChar must not exhaust memory");
+    assert!(px.error.is_none() && text.is_none(), "{:?} {text:?}", px.error);
+    assert!(px.rgba[((50 * px.width + 25) * 4) as usize] < 64, "the glyph is drawn");
+}
+
+/// Accented letters in non-embedded fonts (vendored hayro-interpret patch to
+/// `StandardKind`): the stand-ins for the standard fonts hold only the glyphs of the
+/// Standard, WinAnsi and Mac Roman encodings, so a letter a font names beyond those in its
+/// /Differences drew nothing. iText 2 writes Turkish this way (`/Gbreve`, `/Idotaccent`,
+/// `/Scedilla`, `/gbreve`, `/scedilla` over Ð, Ý, Þ, ð, þ), and a Turkish letter had blanks
+/// for Ğ, İ, Ş, ğ and ş. Each is now its base letter with the accent above or below it.
+#[test]
+fn accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts() {
+    let letters = ["G", "Gbreve", "S", "Scedilla", "I", "Idotaccent", "g", "gbreve", "s", "scedilla"];
+    let mut content = String::new();
+    for (i, _) in letters.iter().enumerate() {
+        content.push_str(&format!("BT /F1 40 Tf {} 20 Td <{:02X}> Tj ET\n", 10 + 40 * i, 65 + i));
+    }
+    let differences = letters.iter().map(|n| format!("/{n}")).collect::<Vec<_>>().join(" ");
+    let pdf = format!(
+        "%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 420 80] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}endstream endobj
+5 0 obj << /Type /Font /Subtype /TrueType /BaseFont /TimesNewRomanPSMT /FirstChar 65 /LastChar 74
+  /Widths [722 722 556 556 333 333 500 500 389 389] /FontDescriptor 6 0 R
+  /Encoding << /Type /Encoding /Differences [65 {differences}] >> >> endobj
+6 0 obj << /Type /FontDescriptor /FontName /TimesNewRomanPSMT /Flags 32 /FontBBox [-568 -306 2045 1039]
+  /ItalicAngle 0 /Ascent 693 /Descent -215 /CapHeight 662 /StemV 80 >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(p.error.is_none(), "{:?}", p.error);
+    // The dark pixels of the i-th letter: how many, and its top and bottom rows (y down).
+    let ink = |i: u32| {
+        let (mut count, mut top, mut bottom) = (0, u32::MAX, 0);
+        for y in 0..p.height {
+            for x in (8 + 40 * i)..(46 + 40 * i).min(p.width) {
+                if p.rgba[((y * p.width + x) * 4) as usize] < 128 {
+                    count += 1;
+                    top = top.min(y);
+                    bottom = bottom.max(y);
+                }
+            }
+        }
+        (count, top, bottom)
+    };
+    for (pair, above) in [(0, true), (1, false), (2, true), (3, true), (4, false)] {
+        let (base, accented) = (ink(2 * pair), ink(2 * pair + 1));
+        let name = letters[2 * pair as usize + 1];
+        assert!(base.0 > 0, "{name}: the base letter draws");
+        assert!(accented.0 > base.0, "{name} draws its letter and accent: {accented:?} vs {base:?}");
+        if above {
+            assert!(accented.1 + 2 < base.1, "{name}: the accent sits above the letter: {accented:?} vs {base:?}");
+        } else {
+            assert!(accented.2 > base.2 + 2, "{name}: the accent hangs below the letter: {accented:?} vs {base:?}");
+        }
+    }
+}
+
+/// Comma-below letters in non-embedded standard fonts (vendored hayro-interpret patch to
+/// `StandardKind`). The stand-ins have neither these letters nor a `commaaccent` to build
+/// them from, so Romanian ș Ș (a form laid out from its XFA template names `/scommaaccent`)
+/// and Latvian ķ ļ ņ ŗ Ģ drew nothing, and ț Ț drew a cedilla. Each is now its letter with a
+/// comma under it, apart from the letter and inside the descender, whichever name the font
+/// gives it: the glyph list calls the Latvian letters `/Kcedilla`…, and `uni` names say only
+/// the code point.
+#[test]
+fn comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter() {
+    let pairs = [
+        ("s", "uni0219"),
+        ("t", "uni021B"),
+        ("T", "uni021A"),
+        ("K", "uni0136"),
+        ("k", "kcedilla"),
+        ("G", "uni0122"),
+        ("G", "Gcedilla"),
+        ("R", "uni0156"),
+        ("s", "scommaaccent"),
+        ("S", "Scommaaccent"),
+        ("t", "tcommaaccent"),
+        ("T", "Tcommaaccent"),
+        ("k", "kcommaaccent"),
+        ("K", "Kcommaaccent"),
+        ("l", "lcommaaccent"),
+        ("L", "Lcommaaccent"),
+        ("n", "ncommaaccent"),
+        ("N", "Ncommaaccent"),
+        ("r", "rcommaaccent"),
+        ("R", "Rcommaaccent"),
+        ("G", "Gcommaaccent"),
+    ];
+    let letters: Vec<&str> = pairs.iter().flat_map(|(base, accented)| [*base, *accented]).collect();
+    let (size, baseline) = (40u32, 60u32);
+    for font in ["Helvetica", "Times-Roman", "Courier", "Helvetica-BoldOblique"] {
+        let mut content = String::new();
+        for i in 0..letters.len() {
+            content.push_str(&format!("BT /F1 {size} Tf {} {} Td <{:02X}> Tj ET\n", 10 + 40 * i, 80 - baseline, 1 + i));
+        }
+        let differences = letters.iter().map(|n| format!("/{n}")).collect::<Vec<_>>().join(" ");
+        let pdf = format!(
+            "%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {} 80] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /{font}
+  /Encoding << /Type /Encoding /BaseEncoding /WinAnsiEncoding /Differences [1 {differences}] >> >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            20 + 40 * letters.len(),
+            content.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{font}: {:?}", p.error);
+        // The rows (y down) of the i-th letter that have dark pixels.
+        let ink_rows = |i: u32| -> Vec<u32> {
+            (0..p.height).filter(|y| ((8 + 40 * i)..(48 + 40 * i).min(p.width)).any(|x| p.rgba[((y * p.width + x) * 4) as usize] < 128)).collect()
+        };
+        for (pair, (_, name)) in pairs.iter().enumerate() {
+            let (base, accented) = (ink_rows(2 * pair as u32), ink_rows(2 * pair as u32 + 1));
+            let (Some(&base_bottom), Some(&bottom)) = (base.last(), accented.last()) else {
+                panic!("{font} {name}: draws nothing ({} rows of its base letter)", base.len());
+            };
+            assert!(bottom > base_bottom + 2, "{font} {name}: a mark hangs below the letter ({bottom} vs {base_bottom})");
+            assert!(
+                (base_bottom + 1..bottom).any(|y| !accented.contains(&y)),
+                "{font} {name}: the mark is apart from the letter, a comma and not a cedilla"
+            );
+            assert!(bottom < baseline + size * 3 / 10, "{font} {name}: the comma stays within the descender ({bottom})");
+        }
+    }
+}
+
+// Contributor-original classic-xref vector fixtures; no embedded or external assets.
+fn raw_crop_unit_pdf(unit: f64, rotation: i32, crop: [f64; 4], marker: Option<[f64; 4]>) -> Vec<u8> {
+    let bounds = crop.map(|n| n.to_string()).join(" ");
+    let body = marker.map(|rect| format!("0 0 0 rg {} re f\n", rect.map(|n| n.to_string()).join(" "))).unwrap_or_default();
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_owned(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_owned(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [{bounds}] /CropBox [{bounds}] /UserUnit {unit} /Rotate {rotation} /Resources << >> /Contents 4 0 R >>"
+        ),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(b"xref\n0 5\n0000000000 65535 f \n");
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer << /Size 5 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    bytes
+}
+
+#[test]
+fn raw_crop_user_unit_inspection_keeps_observed_dimensions() {
+    let bytes = raw_crop_unit_pdf(4096.0, 0, [0.0, 0.0, 0.1, 0.1], None);
+    let info = crate::inspect(Arc::new(bytes), None).expect("original valid raw-0.1 PDF");
+    assert_eq!(info.pages.len(), 1);
+    assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+    let page = &info.pages[0];
+    assert!(
+        (page.width - 409.6).abs() < 0.0001 && (page.height - 409.6).abs() < 0.0001,
+        "raw 0.1 at UserUnit4096 is 409.6 points, got {} by {}",
+        page.width,
+        page.height
+    );
+}
+
+#[test]
+fn raw_crop_unit_floor_corners_match_nonzero_origin_and_rotations() {
+    use hayro::hayro_interpret::TransformExt;
+
+    for (unit, width, height, dx, dy) in
+        [(1.0, 1.0, 1.0, 0.125, 0.25), (4096.0, 512.0, 1024.0, 512.0, 1024.0), (75000.0, 9375.0, 18750.0, 9375.0, 18750.0)]
+    {
+        for rotation in [0, 90, 180, 270] {
+            let bytes = raw_crop_unit_pdf(unit, rotation, [10.0, 20.0, 10.125, 20.25], None);
+            let info = crate::inspect(Arc::new(bytes.clone()), None).expect("original valid offset crop");
+            assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+            let dimensions = if rotation % 180 == 0 { (width as f32, height as f32) } else { (height as f32, width as f32) };
+            assert_eq!((info.pages[0].width, info.pages[0].height), dimensions, "unit={unit}, rotation={rotation}");
+            let pdf = Pdf::new(Arc::new(bytes)).expect("same PDF parser");
+            let page = pdf.pages().first().expect("one page");
+            assert_eq!(page.base_dimensions(), ((width / unit) as f32, (height / unit) as f32));
+            let transform = page.initial_transform(true).to_kurbo();
+            let (origin, opposite) = match rotation {
+                0 => ([0.0, height], [dx, height - dy]),
+                90 => ([0.0, 0.0], [dy, dx]),
+                180 => ([width, 0.0], [width - dx, dy]),
+                _ => ([height, width], [height - dy, width - dx]),
+            };
+            for (point, expected) in [(kurbo::Point::new(10.0, 20.0), origin), (kurbo::Point::new(10.125, 20.25), opposite)] {
+                let actual = transform * point;
+                assert!(
+                    (actual.x - expected[0]).abs() < 1e-9 && (actual.y - expected[1]).abs() < 1e-9,
+                    "unit={unit}, rotation={rotation}, point={point:?}: {actual:?} != {expected:?}"
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn raw_crop_unit_floor_reciprocal_does_not_trigger_letter_fallback() {
+    for unit in [1.0, 41.0, 47.0] {
+        let bytes = raw_crop_unit_pdf(unit, 0, [0.0, 0.0, 0.01, 0.01], None);
+        let pdf = Pdf::new(Arc::new(bytes.clone())).expect("ordinary small crop");
+        let page = pdf.pages().first().expect("one page");
+        let (width, height) = page.base_dimensions();
+        // In f32, the nearest reciprocal of 41 or 47 multiplies back to 0.99999994.
+        assert!(width * page.user_unit() >= 1.0 && height * page.user_unit() >= 1.0, "unit={unit}: floor must not round below one physical point");
+        let info = crate::inspect(Arc::new(bytes), None).expect("inspect the same small crop");
+        let page = &info.pages[0];
+        assert!(
+            (1.0..=1.000001).contains(&page.width) && (1.0..=1.000001).contains(&page.height),
+            "unit={unit}: one-point floor must not become a Letter placeholder: {} by {}",
+            page.width,
+            page.height
+        );
+        assert!(info.warnings.is_empty(), "{:?}", info.warnings);
+    }
+}
+
+#[test]
+fn raw_crop_unit_floor_preserves_nearly_zero_fallback() {
+    for unit in [1.0, 4096.0, 75000.0] {
+        for side in [0.0, 0.0001] {
+            let bytes = raw_crop_unit_pdf(unit, 0, [0.0, 0.0, side, side], None);
+            let pdf = Pdf::new(Arc::new(bytes)).expect("existing degenerate-page fallback");
+            let page = pdf.pages().first().expect("one page");
+            // Existing A4 raw fallback remains raw A4, then scales by the page unit.
+            let expected = (595.2755905511812_f64 as f32, 841.8897637795277_f64 as f32);
+            assert_eq!(page.base_dimensions(), expected, "unit={unit}, raw side={side}");
+            assert_eq!(page.render_dimensions(), (expected.0 * unit as f32, expected.1 * unit as f32));
+        }
+    }
+}
+
+fn raw_crop_ink(page: &RenderedPage) -> ([u32; 4], usize) {
+    let (mut left, mut top, mut right, mut bottom, mut count) = (page.width, page.height, 0, 0, 0);
+    for (i, pixel) in page.rgba.as_chunks::<4>().0.iter().enumerate() {
+        if pixel[0] < 128 && pixel[1] < 128 && pixel[2] < 128 {
+            let (x, y) = (i as u32 % page.width, i as u32 / page.width);
+            left = left.min(x);
+            top = top.min(y);
+            right = right.max(x + 1);
+            bottom = bottom.max(y + 1);
+            count += 1;
+        }
+    }
+    assert!(count > 0, "original vector marker must draw");
+    ([left, top, right, bottom], count)
+}
+
+#[test]
+fn raw_crop_user_unit_vector_rasters_match_physical_controls() {
+    for (unit, scale, width, height, physical_width, physical_height, rects) in [
+        (
+            4096.0,
+            0.5,
+            256,
+            512,
+            512.0,
+            1024.0,
+            [[32.0, 320.0, 96.0, 448.0], [64.0, 32.0, 192.0, 96.0], [160.0, 64.0, 224.0, 192.0], [320.0, 160.0, 448.0, 224.0]],
+        ),
+        (
+            75000.0,
+            0.04,
+            375,
+            750,
+            9375.0,
+            18750.0,
+            [
+                [46.875, 468.75, 140.625, 656.25],
+                [93.75, 46.875, 281.25, 140.625],
+                [234.375, 93.75, 328.125, 281.25],
+                [468.75, 234.375, 656.25, 328.125],
+            ],
+        ),
+    ] {
+        for (index, rotation) in [0, 90, 180, 270].into_iter().enumerate() {
+            let raw_crop = [10.0, 20.0, 10.125, 20.25];
+            let raw_marker = [10.015625, 20.03125, 0.03125, 0.0625];
+            let control_crop = raw_crop.map(|n| n * unit);
+            let control_marker = raw_marker.map(|n| n * unit);
+            let physical = if rotation % 180 == 0 { (physical_width, physical_height) } else { (physical_height, physical_width) };
+            let pixels = if rotation % 180 == 0 { (width, height) } else { (height, width) };
+            let render = |bytes: Vec<u8>| {
+                let info = crate::inspect(Arc::new(bytes.clone()), None).expect("bounded original vector PDF");
+                assert_eq!((info.pages[0].width, info.pages[0].height), physical, "check dimensions before any raster allocation");
+                let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+                let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale, ..Default::default() });
+                assert!(page.error.is_none(), "{:?}", page.error);
+                assert_eq!((page.width, page.height), pixels);
+                page
+            };
+            let high = render(raw_crop_unit_pdf(unit, rotation, raw_crop, Some(raw_marker)));
+            let control = render(raw_crop_unit_pdf(1.0, rotation, control_crop, Some(control_marker)));
+            let (bbox, count) = raw_crop_ink(&high);
+            for (actual, expected) in bbox.into_iter().zip(rects[index]) {
+                assert!((f64::from(actual) - expected).abs() <= 1.0, "unit={unit}, rotation={rotation}: {bbox:?} != {:?}", rects[index]);
+            }
+            let (control_bbox, control_count) = raw_crop_ink(&control);
+            assert_eq!(bbox, control_bbox, "unit={unit}, rotation={rotation}: marker placement");
+            assert_eq!(count, control_count, "unit={unit}, rotation={rotation}: visible marker ink");
+            assert!(high.rgba == control.rgba, "unit={unit}, rotation={rotation}: physically equivalent crops render identically");
+        }
+    }
+}
+
+/// A page's `/UserUnit` (the size of its unit in points) scales the page and everything on
+/// it, after the crop box and before `/Rotate`, as Acrobat shows such pages: with
+/// `/UserUnit 2`, scale 1 renders pixel for pixel what scale 2 renders without it. As in
+/// Acrobat, values below 1, values that aren't numbers and a value on a parent `/Pages`
+/// node count as 1, and values over 75,000 count as 75,000.
+#[test]
+fn user_unit_scales_the_page_and_everything_on_it() {
+    let content = "1 0 0 rg 20 10 30 20 re f BT /F1 18 Tf 15 50 Td (Hg) Tj ET q 16 0 0 8 60 30 cm BI /W 2 /H 2 /CS /RGB /BPC 8 /F /AHx ID 0000FFFF000000FF00FFFF00> EI Q";
+    let pdf = |page: &str, parent: &str| {
+        format!(
+            "%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 {parent} >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 80] /CropBox [10 6 90 76] {page} /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+6 0 obj 2 endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        )
+        .into_bytes()
+    };
+    let render = |bytes: Vec<u8>, scale: f32| {
+        let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{:?}", p.error);
+        p
+    };
+    let glyphs = |bytes: Vec<u8>| {
+        let parsed = Pdf::new(Arc::new(bytes)).expect("parses");
+        crate::text::extract_page(&parsed, 0, &InterpreterSettings::default()).expect("text").glyphs
+    };
+    let size = |bytes: Vec<u8>| {
+        let p = &crate::inspect(Arc::new(bytes), None).expect("opens").pages[0];
+        (p.width, p.height)
+    };
+    for rotate in [0, 90, 180, 270] {
+        let turned = format!("/Rotate {rotate}");
+        let (w, h) = if rotate % 180 == 0 { (80.0, 70.0) } else { (70.0, 80.0) };
+        let plain = render(pdf(&turned, ""), 2.0);
+        let one = render(pdf(&turned, ""), 1.0);
+        let plain_glyphs = glyphs(pdf(&turned, ""));
+        for unit in ["/UserUnit 2", "/UserUnit 6 0 R"] {
+            let page = format!("{turned} {unit}");
+            assert_eq!(size(pdf(&page, "")), (w * 2.0, h * 2.0), "{page}");
+            let doubled = render(pdf(&page, ""), 1.0);
+            assert_eq!((doubled.width, doubled.height), (plain.width, plain.height), "{page}");
+            assert!(doubled.rgba == plain.rgba, "{page}: the page renders as at twice the scale");
+            let doubled_glyphs = glyphs(pdf(&page, ""));
+            assert_eq!(doubled_glyphs.len(), plain_glyphs.len(), "{page}");
+            for (d, p) in doubled_glyphs.iter().zip(&plain_glyphs) {
+                assert_eq!(d.rect, p.rect.map(|v| v * 2.0), "{page}: text layer");
+            }
+        }
+        for unit in ["/UserUnit 1", "/UserUnit 0", "/UserUnit -1", "/UserUnit 0.5", "/UserUnit /Two", "/UserUnit (2)"] {
+            let page = format!("{turned} {unit}");
+            assert_eq!(size(pdf(&page, "")), (w, h), "{page}");
+            assert!(render(pdf(&page, ""), 1.0).rgba == one.rgba, "{page} counts as 1");
+        }
+        assert_eq!(size(pdf(&turned, "/UserUnit 2")), (w, h), "not inherited from /Pages");
+        assert!(render(pdf(&turned, "/UserUnit 2"), 1.0).rgba == one.rgba, "not inherited from /Pages");
+        for unit in ["/UserUnit 75000", "/UserUnit 100000"] {
+            assert_eq!(size(pdf(&format!("{turned} {unit}"), "")), (w * 75_000.0, h * 75_000.0), "{unit}");
+        }
+    }
+}
+
+#[test]
+fn tiles_match_full_render() {
+    let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig::default());
+    let full = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, ..Default::default() });
+    let tile = Tile { x: 30, y: 40, w: 50, h: 30 };
+    let part = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: Some(tile), scale: 2.0, tag: 0, ..Default::default() });
+    assert_eq!((part.width, part.height), (50, 30));
+    for y in 0..30u32 {
+        for x in 0..50u32 {
+            let a = &full.rgba[(((y + 40) * full.width + x + 30) * 4) as usize..][..4];
+            let b = &part.rgba[((y * 50 + x) * 4) as usize..][..4];
+            assert_eq!(a, b, "pixel {x},{y}");
+        }
+    }
+}
+
+/// White-on-black: the page clears black, the black filled rectangle maps to the text colour,
+/// and the image's pixels are byte-identical to the plain render — photos never pass through
+/// the mapping, not even its white quadrant, which would map to black if they did.
+#[test]
+fn reading_colors_map_solid_paints_and_leave_images() {
+    let content = "0 0 0 rg 10 10 30 20 re f\nq 20 0 0 10 60 20 cm /Im Do Q";
+    let pdf = format!(
+        "%PDF-1.4\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R /Resources << /XObject << /Im 6 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             6 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 25 >> stream\nFF000000FF00000000FFFFFFFF>\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        content.len()
+    )
+    .into_bytes();
+    let req = RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, preview: false };
+    let render = |reading_colors: ReadingColors| {
+        let mut r = PageRenderer::new(Arc::new(pdf.clone()), RenderConfig { reading_colors, ..Default::default() });
+        let page = r.render(req);
+        assert!(page.error.is_none(), "{:?}", page.error);
+        page
+    };
+    let off = render(ReadingColors::default());
+    let on = render(ReadingColors::WHITE_ON_BLACK);
+    assert_eq!((on.width, on.height), (200, 100));
+    fn pixel(page: &RenderedPage, x: u32, y: u32) -> &[u8] {
+        &page.rgba[((y * page.width + x) * 4) as usize..][..4]
+    }
+
+    // The page clears to the setting's background instead of white.
+    assert_eq!(pixel(&off, 5, 5), &[255, 255, 255, 255]);
+    assert_eq!(pixel(&on, 5, 5), &[0, 0, 0, 255]);
+    // The black rectangle maps to the text colour.
+    assert_eq!(pixel(&off, 50, 60), &[0, 0, 0, 255]);
+    assert_eq!(pixel(&on, 50, 60), &[255, 255, 255, 255]);
+    // The whole image area (the interior of device pixels 120..160 × 40..60) is untouched.
+    for y in 44..56u32 {
+        for x in 124..156u32 {
+            assert_eq!(pixel(&on, x, y), pixel(&off, x, y), "image pixel {x},{y}");
+        }
+    }
+    assert_eq!(pixel(&on, 150, 55), &[255, 255, 255, 255], "the image's white quadrant stays white");
+}
+
+/// #2975: a stencil mask (`/ImageMask true`) is painted in the fill colour at the fill
+/// opacity, once: at `ca 0.5` it is as opaque as a rectangle filled at `ca 0.5` beside it
+/// (it was a quarter as opaque, the opacity applied by both the image's group and its paint).
+/// The same holds when the fill is a pattern, whose paint keeps the opacity in force when it
+/// was set with `scn`: an uncoloured tiling pattern and a shading pattern.
+#[test]
+fn stencil_masks_are_drawn_at_the_fill_opacity_once() {
+    let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..3].to_vec();
+    let fills = [("colour", "0 0 1 rg"), ("uncoloured tiling pattern", "/CsP cs 0 0 1 /Tp scn"), ("shading pattern", "/Pattern cs /Sp scn")];
+    for (fill_name, fill) in fills {
+        for alpha in ["1", "0.5", "0.25"] {
+            let content = format!("/A gs {fill} q 100 0 0 100 20 50 cm /Msk Do Q 160 50 100 100 re f");
+            let tile = "0 0 10 10 re f";
+            let pdf = format!(
+                "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /ExtGState << /A << /ca {alpha} >> >> /XObject << /Msk 5 0 R >> /ColorSpace << /CsP [/Pattern /DeviceRGB] >> /Pattern << /Tp 6 0 R /Sp 7 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Length 2 >> stream
+\0\0
+endstream endobj
+6 0 obj << /Type /Pattern /PatternType 1 /PaintType 2 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >> /Length {} >> stream
+{tile}
+endstream endobj
+7 0 obj << /Type /Pattern /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 300 0] /Extend [true true] /Function << /FunctionType 2 /Domain [0 1] /C0 [0 0 1] /C1 [0 0 1] /N 1 >> >> >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+                content.len(),
+                tile.len()
+            );
+            let p = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default()).render(RenderRequest {
+                page: 0,
+                kind: RequestKind::Pixels,
+                tile: None,
+                scale: 1.0,
+                tag: 0,
+                ..Default::default()
+            });
+            assert!(p.error.is_none(), "{fill_name}, ca {alpha}: {:?}", p.error);
+            // Pixel rows run top down: PDF (70, 100) is in the mask, (210, 100) in the rectangle.
+            let (mask, rect) = (px(&p, 70, 100), px(&p, 210, 100));
+            assert!(rect != [255, 255, 255], "{fill_name}, ca {alpha}: the rectangle is painted");
+            assert!(mask.iter().zip(&rect).all(|(m, r)| m.abs_diff(*r) <= 1), "{fill_name}, ca {alpha}: mask {mask:?}, rectangle {rect:?}");
+        }
+    }
+}
+
+/// #2971: in a knockout transparency group (`/K true`) each element composites with the
+/// group's initial backdrop, not with the elements drawn before it in the group, over the
+/// element's shape. A blue square at 50 % opacity over a red one at 50 % shows only the blue
+/// where they overlap; without `/K` the two blend. The same holds for an image (its shape
+/// is its rectangle; a soft-masked image's shape is its mask, so its transparent part leaves
+/// what is under it) and for a nested group (its shape is the union of its elements'
+/// shapes, while its own elements still blend with each other).
+#[test]
+fn knockout_groups_replace_what_their_elements_cover() {
+    let render_as = |group: &str, form: &str, preview: bool| {
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /XObject << /Fm1 5 0 R >> /ExtGState << /G << /ca 0.5 >> >> >> >> endobj
+4 0 obj << /Length 39 >> stream
+/Fm1 Do /G gs 0 1 0 rg 10 10 30 30 re f
+endstream endobj
+5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency {group} >> /Resources << /ExtGState << /A << /ca 0.5 >> >> /XObject << /In 6 0 R /Msk 7 0 R /Neu 8 0 R /Img 9 0 R /Sm 10 0 R /Nimg 12 0 R /Deep 13 0 R /Shg 16 0 R /Big 17 0 R >> >> /Length {} >> stream
+{form}
+endstream endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /A << /ca 0.5 >> >> >> /Length 34 >> stream
+/A gs 0 0 1 rg 100 50 150 120 re f
+endstream endobj
+7 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Filter /ASCIIHexDecode /Length 5 >> stream
+0000>
+endstream endobj
+8 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> >> /Length 62 >> stream
+/H gs 0 1 0 rg 80 40 100 100 re f 0 0 1 rg 130 80 100 100 re f
+endstream endobj
+9 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 7 >> stream
+0000FF>
+endstream endobj
+10 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /SMask 11 0 R /Filter /ASCIIHexDecode /Length 13 >> stream
+0000FF0000FF>
+endstream endobj
+11 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 5 >> stream
+00FF>
+endstream endobj
+12 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> /XObject << /Img 9 0 R >> >> /Length 38 >> stream
+/H gs q 160 0 0 100 60 50 cm /Img Do Q
+endstream endobj
+13 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> /XObject << /In3 14 0 R >> >> /Length 13 >> stream
+/H gs /In3 Do
+endstream endobj
+14 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Length 28 >> stream
+0 0 1 rg 100 50 150 120 re f
+endstream endobj
+15 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 1 0] /Function << /FunctionType 2 /Domain [0 1] /C0 [0 0 1] /C1 [0 0 1] /N 1 >> /Extend [true true] /BBox [100 50 140 170] >> >> endobj
+16 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /Pattern << /P 15 0 R >> >> /Length 38 >> stream
+/Pattern cs /P scn 100 50 150 120 re f
+endstream endobj
+17 0 obj << /Type /XObject /Subtype /Image /Width 20000 /Height 20000 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 7 >> stream
+0000FF>
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            form.len()
+        );
+        let p = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview,
+        });
+        assert!(p.error.is_none(), "{group} {form}: {:?}", p.error);
+        p
+    };
+    let render = |group: &str, form: &str| render_as(group, form, false);
+    // Pixel rows run top down: PDF (x, y) is pixel (x, 200 - y).
+    let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((200 - y) * p.width + x) as usize * 4..][..3].to_vec();
+    let check = |p: &RenderedPage, x: u32, y: u32, want: [u8; 3], what: &str| {
+        let got = px(p, x, y);
+        assert!(got.iter().zip(want).all(|(a, b)| a.abs_diff(b) <= 2), "{what}: {got:?}, expected {want:?}");
+    };
+    let red = "/A gs 1 0 0 rg 20 20 150 150 re f ";
+    let ko = "/I true /K true";
+
+    let squares = render(ko, &format!("{red}0 0 1 rg 100 50 150 120 re f"));
+    check(&squares, 130, 100, [128, 128, 255], "knocked out");
+    check(&squares, 50, 40, [255, 128, 128], "red alone");
+    check(&squares, 210, 100, [128, 128, 255], "blue alone");
+    check(&squares, 280, 190, [255, 255, 255], "paper");
+    // Page content after the group composites normally again: green at 50 % over the red.
+    check(&squares, 30, 30, [128, 191, 64], "after the group");
+    let plain = render("/I true", &format!("{red}0 0 1 rg 100 50 150 120 re f"));
+    check(&plain, 130, 100, [128, 64, 191], "blended without /K");
+
+    // An image at 50 % replaces the red under its rectangle.
+    let image = render(ko, &format!("{red}q 160 0 0 100 60 50 cm /Img Do Q"));
+    check(&image, 100, 100, [128, 128, 255], "image knocks out");
+    check(&image, 40, 40, [255, 128, 128], "red beside the image");
+    // A soft-masked image: its transparent left half leaves the red, its opaque half replaces it.
+    let masked = render(ko, "1 0 0 rg 20 20 150 150 re f q 160 0 0 100 60 50 cm /Sm Do Q");
+    check(&masked, 100, 100, [255, 0, 0], "under the transparent half");
+    check(&masked, 155, 100, [0, 0, 255], "under the opaque half");
+
+    // A nested group entered at 50 % (blue at 25 % in all) replaces the red under its shape.
+    let nested = render(ko, &format!("{red}/In Do"));
+    check(&nested, 130, 100, [191, 191, 255], "nested group knocks out");
+    check(&nested, 50, 40, [255, 128, 128], "red beside the nested group");
+    // A nested group at full opacity: it knocks out the red as a whole, and its own two
+    // squares at 50 % still blend with each other where they overlap.
+    let neutral = render(ko, "1 0 0 rg 20 20 150 150 re f /Neu Do");
+    check(&neutral, 100, 60, [128, 255, 128], "green over the knocked-out red");
+    check(&neutral, 150, 110, [64, 128, 191], "the nested squares blend");
+    check(&neutral, 40, 40, [255, 0, 0], "red beside the nested group");
+
+    // An image inside a nested group is drawn once (blue at 50 %), over the knocked-out red.
+    let nested_image = render(ko, "1 0 0 rg 20 20 150 150 re f /Nimg Do");
+    check(&nested_image, 100, 100, [128, 128, 255], "image in a nested group");
+    // A group inside a nested group knocks out the red as well.
+    let deep = render(ko, "1 0 0 rg 20 20 150 150 re f /Deep Do");
+    check(&deep, 130, 100, [128, 128, 255], "group in a nested group");
+    check(&deep, 40, 40, [255, 0, 0], "red beside it");
+
+    // A stencil mask must not erase the red beside it.
+    let stencil = render(ko, &format!("{red}0 0 1 rg q 150 0 0 120 100 50 cm /Msk Do Q"));
+    check(&stencil, 50, 40, [255, 128, 128], "red beside a stencil");
+    // Where the stencil paints (every sample 0), its blue is drawn (review on #2974: the check
+    // above alone passed even if the stencil drew nothing). A stencil composites as it did
+    // before rather than knocking the red out, and its exact colour also depends on #2975 (a
+    // stencil's fill opacity applied twice), so only "blue was drawn here" is pinned.
+    let under = px(&stencil, 130, 100);
+    assert!(under != [255, 128, 128] && under[2] >= 150 && under[0] < 230, "stencil drew nothing: {under:?}");
+
+    // A shading's /BBox clips it (ISO 32000-2 Table 77), so a shading fill's shape is its path
+    // inside the box: the erase pass must clear only that, or the red outside the box but
+    // inside the path stays erased (review on #2974).
+    let shaded = render(ko, &format!("{red}/Shg Do"));
+    check(&shaded, 120, 100, [128, 128, 255], "the shading inside its box");
+    check(&shaded, 155, 100, [255, 128, 128], "red outside the shading's box");
+
+    // An image that isn't decoded (here over the renderer's pixel limit) draws nothing, so it
+    // must not clear what is under its rectangle either (review on #2974).
+    let undecoded = render(ko, &format!("{red}q 160 0 0 100 60 50 cm /Big Do Q"));
+    check(&undecoded, 100, 100, [255, 128, 128], "red under an image that isn't drawn");
+    // Nor one a preview skips for covering only a few device pixels (review on #2974): the
+    // red under a 3 x 3 image stays in a preview, and a final render knocks it out.
+    let tiny = format!("{red}q 3 0 0 3 100 100 cm /Img Do Q");
+    check(&render_as(ko, &tiny, true), 101, 101, [255, 128, 128], "red under a preview's skipped image");
+    check(&render_as(ko, &tiny, false), 101, 101, [128, 128, 255], "the tiny image in a final render");
+}
+
+/// #2970: a page's objects composite with a transparent backdrop and the page group is then
+/// put on the paper, so a separable blend mode only blends where something was drawn. A
+/// green fill with `/BM /Screen` (or Lighten, Difference…) half over a red square is yellow
+/// (or whatever the mode gives) over the red, and plain green over the empty page: blending
+/// with the white paper made it white or magenta.
+#[test]
+fn blend_modes_over_an_empty_part_of_the_page_keep_their_colour() {
+    let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    for (mode, over_red) in [
+        ("Normal", Some([0, 255, 0])),
+        ("Multiply", Some([0, 0, 0])),
+        ("Screen", Some([255, 255, 0])),
+        ("Lighten", Some([255, 255, 0])),
+        ("Difference", Some([255, 255, 0])),
+        ("Exclusion", Some([255, 255, 0])),
+        ("ColorDodge", Some([255, 0, 0])),
+        ("Overlay", Some([255, 0, 0])),
+        // The non-separable modes mix hue, saturation and luminosity; over an empty part of
+        // the page they too must keep the source colour.
+        ("Hue", None),
+        ("Saturation", None),
+        ("Color", None),
+        ("Luminosity", None),
+    ] {
+        let content = "1 0 0 rg 20 20 150 150 re f /G1 gs 0 1 0 rg 100 50 150 120 re f";
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /ExtGState << /G1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /ExtGState /BM /{mode} >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let p = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            ..Default::default()
+        });
+        assert!(p.error.is_none(), "{mode}: {:?}", p.error);
+        // Pixel rows run top down: PDF (210, 100) and (130, 100) are rows 100 from the top.
+        assert_eq!(px(&p, 210, 100), vec![0, 255, 0, 255], "{mode} over the empty page");
+        if let Some(over_red) = over_red {
+            assert_eq!(px(&p, 130, 100)[..3], over_red, "{mode} over the red square");
+        }
+        assert_eq!(px(&p, 280, 10), vec![255, 255, 255, 255], "{mode}: the paper stays white");
+    }
+}
+
+/// A transparent page leaves what nothing paints see-through, so it can be laid over another
+/// raster: with reading colours on, and in a tile, too. Painted pixels stay premultiplied.
+#[test]
+fn transparent_pages_paint_only_their_content() {
+    let content = "0 0 1 rg 10 10 30 20 re f /GS gs 0.5 g 60 10 30 20 re f";
+    let pdf = format!(
+        "%PDF-1.4\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R /Resources << /ExtGState << /GS << /ca 0.5 >> >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        content.len()
+    )
+    .into_bytes();
+    let pixel = |page: &RenderedPage, x: u32, y: u32| page.rgba[((y * page.width + x) * 4) as usize..][..4].to_vec();
+    for reading_colors in [ReadingColors::default(), ReadingColors::WHITE_ON_BLACK] {
+        let config = RenderConfig { transparent: true, reading_colors, ..Default::default() };
+        let mut r = PageRenderer::new(Arc::new(pdf.clone()), config.clone());
+        let page = r.render(RenderRequest { page: 0, scale: 2.0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!(pixel(&page, 5, 5), [0, 0, 0, 0], "{reading_colors:?}: nothing painted, nothing shown");
+        assert_eq!(pixel(&page, 50, 60)[3], 255, "{reading_colors:?}: the opaque rectangle covers");
+        assert_eq!(pixel(&page, 150, 60), [64, 64, 64, 128], "{reading_colors:?}: half-transparent grey, premultiplied");
+        let tile = r.render(RenderRequest { page: 0, scale: 2.0, tile: Some(Tile { x: 0, y: 40, w: 100, h: 60 }), ..Default::default() });
+        assert_eq!((pixel(&tile, 5, 5), pixel(&tile, 50, 20)), (pixel(&page, 5, 45), pixel(&page, 50, 60)), "{reading_colors:?}");
+        let pool = RenderPool::new(Arc::new(pdf.clone()), 1, config);
+        pool.set_queue(vec![RenderRequest { page: 0, scale: 2.0, ..Default::default() }]);
+        let pooled = loop {
+            if let Some(p) = pool.try_recv() {
+                break p;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        };
+        assert_eq!(pooled.rgba, page.rgba, "{reading_colors:?}: the pool renders the same");
+    }
+    let opaque = PageRenderer::new(Arc::new(pdf), RenderConfig::default()).render(RenderRequest { page: 0, scale: 2.0, ..Default::default() });
+    assert_eq!(pixel(&opaque, 5, 5), [255, 255, 255, 255], "pages are still white by default");
+}
+
+/// Reading colours replace *document* colours, never annotation colours (issue #1548): a
+/// highlight keeps its `/C`, so on a dark background the content under it shows through the
+/// Multiply blend in the highlight's colour instead of being darkened into invisibility.
+/// Both annotation paths are covered: the `/AP` appearance stream and the no-`/AP`
+/// `/QuadPoints` fallback.
+#[test]
+fn reading_colors_keep_highlight_annotations_readable() {
+    let content = "0 g 100 40 10 20 re f";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Annots [5 0 R] >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Annot /Subtype /Highlight /Rect [15 35 120 65] /QuadPoints [15 65 120 65 15 35 120 35] /C [1 1 0] {{annot}} >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [15 35 120 65] /Length 24 >> stream
+0 0 1 rg 15 35 50 30 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let render = |annot: &str| {
+        let mut r = PageRenderer::new(
+            Arc::new(pdf.replace("{annot}", annot).into_bytes()),
+            RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() },
+        );
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{annot}: {:?}", p.error);
+        p
+    };
+    let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+
+    // No /AP: the page's black rectangle is remapped to white (document line art), the
+    // yellow fill is not, so Multiply leaves the content under the quad yellow — readable.
+    let p = render("");
+    assert_eq!(px(&p, 5, 5), vec![0, 0, 0, 255], "the page clears to the background");
+    assert_eq!(px(&p, 105, 50), vec![255, 255, 0, 255], "content under the quad shows through in the highlight's colour");
+    assert_eq!(px(&p, 30, 50), vec![0, 0, 0, 255], "the band itself multiplies into the dark background, as in Acrobat");
+    assert_eq!(px(&p, 150, 50), vec![0, 0, 0, 255], "outside the quad");
+
+    // With /AP the appearance's blue is an annotation colour too and stays blue instead of
+    // being remapped towards white by its luminance.
+    let p = render("/AP << /N 6 0 R >>");
+    assert_eq!(px(&p, 30, 50), vec![0, 0, 255, 255], "the appearance keeps its own colour");
+    assert_eq!(px(&p, 90, 50), vec![0, 0, 0, 255], "outside the appearance's own drawing");
+}
+
+/// A print-preview request (`PRINT_TAG`) renders the document's true colours even though
+/// the document's config carries reading colours: a preview's job is fidelity to the
+/// printout, which is imposed from the uncoloured document. Covers both render paths —
+/// the inline `PageRenderer` and a pool worker.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn print_preview_requests_render_with_reading_colors_off() {
+    let content = "0 0 0 rg 10 10 30 20 re f";
+    let pdf = Arc::new(
+        format!(
+            "%PDF-1.4\n\
+                 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 100 50] >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes(),
+    );
+    fn px(page: &RenderedPage, x: u32, y: u32) -> &[u8] {
+        &page.rgba[((y * page.width + x) * 4) as usize..][..4]
+    }
+
+    // The page and its black rectangle in their true colours.
+    let mut plain = PageRenderer::new(pdf.clone(), RenderConfig::default());
+    let truth = plain.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, preview: false });
+    assert!(truth.error.is_none(), "{:?}", truth.error);
+    assert_eq!(px(&truth, 5, 5), &[255, 255, 255, 255]);
+    assert_eq!(px(&truth, 50, 60), &[0, 0, 0, 255]);
+
+    let mut recoloured = PageRenderer::new(pdf.clone(), RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() });
+    // A plain request honours the setting: the page clears black, the rect maps white.
+    let on = recoloured.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, preview: false });
+    assert_eq!(px(&on, 5, 5), &[0, 0, 0, 255]);
+    assert_eq!(px(&on, 50, 60), &[255, 255, 255, 255]);
+    // A print-preview request ignores the setting and matches the true colours exactly.
+    let preview = RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: PRINT_TAG, preview: false };
+    let off = recoloured.render(preview);
+    assert_eq!(px(&off, 5, 5), &[255, 255, 255, 255]);
+    assert_eq!(px(&off, 50, 60), &[0, 0, 0, 255]);
+    assert_eq!(off.rgba, truth.rgba);
+
+    // The same override on the worker path the print dialog's canvas renders through.
+    let pool = RenderPool::new(pdf, 1, RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() });
+    pool.set_queue(vec![preview]);
+    let worker = loop {
+        if let Some(p) = pool.try_recv() {
+            break p;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    };
+    assert!(worker.error.is_none(), "{:?}", worker.error);
+    assert_eq!(worker.rgba, truth.rgba);
+}
+
+/// A recoloured tile must equal the crop of the recoloured full render, or zooming would
+/// flash wrong colours at tile seams.
+#[test]
+fn reading_colors_tiles_match_full_render() {
+    let mut r = PageRenderer::new(Arc::new(ONE_PAGE.to_vec()), RenderConfig { reading_colors: ReadingColors::WHITE_ON_BLACK, ..Default::default() });
+    let full = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 2.0, tag: 0, preview: false });
+    let tile = Tile { x: 30, y: 40, w: 50, h: 30 };
+    let part = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: Some(tile), scale: 2.0, tag: 0, preview: false });
+    assert!(full.error.is_none() && part.error.is_none(), "{:?} {:?}", full.error, part.error);
+    assert_eq!((part.width, part.height), (50, 30));
+    for y in 0..30u32 {
+        for x in 0..50u32 {
+            let a = &full.rgba[(((y + 40) * full.width + x + 30) * 4) as usize..][..4];
+            let b = &part.rgba[((y * 50 + x) * 4) as usize..][..4];
+            assert_eq!(a, b, "pixel {x},{y}");
+        }
+    }
+    // The colours are really on: the page cleared black and the blue rectangle mapped towards
+    // white (its luminance is 7.2%, so 255·(1−0.0722) ≈ 237).
+    assert_eq!(&full.rgba[..4], &[0, 0, 0, 255]);
+    assert_eq!(&full.rgba[((60 * full.width + 50) * 4) as usize..][..4], &[237, 237, 237, 255]);
+}
+
+// A tile seam must not change the raster when large-page work is stitched back together.
+#[test]
+fn stitched_render_partitions_match_a_whole_render() {
+    let content =
+        "0 0 1 rg 0 0 200 200 re f\n1 0 0 RG 2 w 0 100 m 200 100 l S\nBT /F1 18 Tf 20 150 Td (tile text) Tj ET\nq 40 0 0 40 100 100 cm /Im Do Q";
+    let pdf = format!(
+        "%PDF-1.4\n\
+             1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im 6 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n\
+             6 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 25 >> stream\nFF000000FF00000000FFFFFFFF>\nendstream endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        content.len()
+    );
+    let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let request = RenderRequest { scale: 6.0, ..Default::default() };
+    let whole = renderer.render(request);
+    assert!(whole.error.is_none(), "{:?}", whole.error);
+    assert_eq!((whole.width, whole.height), (1200, 1200));
+
+    let mut assert_partition = |tile_width: u32, tile_height: u32| {
+        let mut stitched = vec![0; whole.rgba.len()];
+        for y in (0..whole.height).step_by(tile_height as usize) {
+            for x in (0..whole.width).step_by(tile_width as usize) {
+                let tile = Tile { x, y, w: tile_width.min(whole.width - x), h: tile_height.min(whole.height - y) };
+                let part = renderer.render(RenderRequest { tile: Some(tile), ..request });
+                assert!(part.error.is_none(), "tile {tile:?}: {:?}", part.error);
+                assert_eq!((part.width, part.height), (tile.w, tile.h));
+                for row in 0..tile.h {
+                    let src = (row * tile.w * 4) as usize;
+                    let dst = ((y + row) * whole.width * 4 + x * 4) as usize;
+                    let len = (tile.w * 4) as usize;
+                    stitched[dst..dst + len].copy_from_slice(&part.rgba[src..src + len]);
+                }
+            }
+        }
+        assert_eq!(stitched.as_slice(), whole.rgba.as_ref(), "partition {tile_width}×{tile_height}");
+    };
+
+    for bands in [2, 4, 8] {
+        assert_partition(whole.width, whole.height.div_ceil(bands));
+    }
+    assert_partition(1024, 1024);
+    assert_partition(127, 131);
+}
+
+/// hayro skips drawing a path that can't paint the canvas (vendored patch (9)), so a tile no
+/// longer strokes every path of its page. Every tile, and the whole page, is byte for byte
+/// what it was without skipping, where paint reaches past a path into the next tile: round
+/// and square caps, a sharp miter, a rotated and a stretched matrix, a hairline, dashes, a
+/// curve, text, and a page shown rotated.
+///
+/// Images are skipped the same way (vendored patch (10)): an image on a tile, one crossing
+/// tile lines, and one fully off the page.
+#[test]
+fn skipping_paths_off_the_canvas_changes_no_pixel() {
+    // Tiles of 80 device pixels at scale 2 meet every 40 pt; each mark crosses such a line
+    // only with its stroke width, caps, miter or antialiasing. The last one is off the page.
+    let content = "1 0 0 RG 20 w 1 J 10 30 m 35 30 l S
+2 J 10 60 m 35 70 l S
+0 J 0 j 10 M 8 w 100 50 m 118 60 l 100 70 S
+q 0.7071 0.7071 -0.7071 0.7071 160 20 cm 15 w 1 J 0 0 m 20 0 l S Q
+0 w 0 0 0 RG 79.9 100 m 79.9 140 l S
+1 0 0 rg 80.3 150 20 20 re f
+0 0 1 RG 6 w [8 4] 0 d 1 J 130 100 m 205 160 l S [] 0 d
+0 1 0 RG 3 w 10 200 m 10 290 70 290 70 200 c S
+BT /F1 30 Tf 70 205 Td (Hg) Tj ET
+q 4 0 0 0.25 0 0 cm 12 w 1 J 2 500 m 8 500 l S Q
+300 300 m 320 320 l S
+q 10 0 0 10 5 5 cm /Im0 Do Q
+q 30 0 0 30 100 100 cm /Im0 Do Q
+q 5 0 0 5 500 500 cm /Im0 Do Q";
+    // A 4x4 RGB image of plain `A` bytes (no `endstream` inside, so the raw stream parses).
+    let pixels = "A".repeat(4 * 4 * 3);
+    for rotate in [0, 90] {
+        let pdf = format!(
+            "%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 240 240] /Rotate {rotate} /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+6 0 obj << /Type /XObject /Subtype /Image /Width 4 /Height 4 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length {} >> stream
+{pixels}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len(),
+            pixels.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let mut both = |tile| {
+            let req = RenderRequest { scale: 2.0, tile, ..Default::default() };
+            let skipped = r.render(req);
+            hayro::set_skip_offscreen_paths(false);
+            let drawn = r.render(req);
+            hayro::set_skip_offscreen_paths(true);
+            assert!(skipped.error.is_none() && drawn.error.is_none(), "{:?}", skipped.error);
+            assert!(skipped.rgba == drawn.rgba, "/Rotate {rotate}: {tile:?} changed");
+        };
+        both(None);
+        for y in (0..480).step_by(80) {
+            for x in (0..480).step_by(80) {
+                both(Some(Tile { x, y, w: 80, h: 80 }));
+            }
+        }
+    }
+}
+
+/// Previews skip images that would cover only a few device pixels (vendored patch (11)):
+/// a tiny draw is missing from the preview but present in the final, while a large draw
+/// is in both. Finals never set the flag, so they draw everything.
+#[test]
+fn preview_renders_skip_tiny_images_but_finals_draw_everything() {
+    let content = "q 50 0 0 50 100 100 cm /Im0 Do Q
+q 0.5 0 0 0.5 10 10 cm /Im0 Do Q";
+    let pixels = "A".repeat(4 * 4 * 3);
+    let pdf = format!(
+        "%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 240 240] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /XObject /Subtype /Image /Width 4 /Height 4 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length {} >> stream
+{pixels}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len(),
+        pixels.len()
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let mut render = |preview| r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview });
+    let first = render(false);
+    let second = render(false);
+    assert!(first.error.is_none(), "{:?}", first.error);
+    assert_eq!(first.rgba, second.rgba, "finals are deterministic");
+    let gray = first.rgba.as_chunks::<4>().0.iter().filter(|px| px[0] == 0x41 && px[1] == 0x41 && px[2] == 0x41).count();
+    assert!(gray > 1000, "the large image draws {gray} pixels");
+    let preview = render(true);
+    assert!(preview.error.is_none(), "{:?}", preview.error);
+    assert_ne!(preview.rgba, first.rgba, "the tiny image is skipped only in the preview");
+}
+
+/// A page whose stream objects 5, 6, … are `objects` (dictionary, data), drawn by `content`
+/// with `resources`, on a 130 × 70 pt page.
+fn image_cache_pdf(content: &str, resources: &str, objects: &[(&str, &[u8])]) -> Vec<u8> {
+    let mut pdf = format!(
+        "%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 130 70] /Contents 4 0 R /Resources {resources} >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+",
+        content.len()
+    )
+    .into_bytes();
+    for (i, (dict, data)) in objects.iter().enumerate() {
+        pdf.extend(format!("{} 0 obj {dict} stream\n", i + 5).bytes());
+        pdf.extend_from_slice(data);
+        pdf.extend_from_slice(b"\nendstream endobj\n");
+    }
+    pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+    pdf
+}
+
+/// The RGB of the pixel at (`x`, `y`) (from the top left) of a `width`-pixel-wide RGBA raster.
+fn rgb_at(rgba: &[u8], width: usize, x: usize, y: usize) -> [u8; 3] {
+    let i = (y * width + x) * 4;
+    [rgba[i], rgba[i + 1], rgba[i + 2]]
+}
+
+const ONE_PIXEL_RGB: &str = "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length 3 >>";
+
+/// Two images whose dictionaries are byte for byte the same (uncompressed, one size) but
+/// whose pixels differ each draw their own: the decoded-image cache tells them apart by the
+/// stream, not by the dictionary's bytes alone, in one render and across renders sharing a
+/// cache, and previews never hand their entries to a final render.
+#[test]
+fn decoded_images_with_identical_dictionaries_keep_their_own_pixels() {
+    let pdf = image_cache_pdf(
+        // B over A at the same place and size (so one decode target): B must show. A alone
+        // on the right, at a size of its own.
+        "q 50 0 0 50 10 10 cm /A Do Q q 50 0 0 50 10 10 cm /B Do Q q 40 0 0 40 80 15 cm /A Do Q",
+        "<< /XObject << /A 5 0 R /B 6 0 R >> >>",
+        &[(ONE_PIXEL_RGB, b"\xff\x00\x00"), (ONE_PIXEL_RGB, b"\x00\x00\xff")],
+    );
+    let req = |preview| RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview };
+    let mut r = PageRenderer::new(Arc::new(pdf.clone()), RenderConfig::default());
+    let out = r.render(req(false));
+    assert!(out.error.is_none(), "{:?}", out.error);
+    let w = out.width as usize;
+    assert_eq!(rgb_at(&out.rgba, w, 35, 35), [0, 0, 255], "the second image drew the first one's pixels");
+    assert_eq!(rgb_at(&out.rgba, w, 100, 35), [255, 0, 0]);
+    // One cache across a preview and then a final render, as a render worker keeps it.
+    let pdf = parse(&Arc::new(pdf), None).expect("parses");
+    let cache = RenderCache::new();
+    let settings = InterpreterSettings::default();
+    let preview = render_page(&pdf, &cache, &settings, &RenderConfig::default(), req(true)).expect("preview renders");
+    let fin = render_page(&pdf, &cache, &settings, &RenderConfig::default(), req(false)).expect("final renders");
+    let fresh = render_page(&pdf, &RenderCache::new(), &settings, &RenderConfig::default(), req(false)).expect("final renders");
+    assert_eq!(rgb_at(&preview.2, w, 35, 35), [0, 0, 255]);
+    assert_eq!(&fin.2[..], &fresh.2[..], "a final render after a preview matches one with a fresh cache");
+}
+
+/// An image drawn under a transfer function (`/TR`) is decoded with it, even when the same
+/// image was drawn without one just before (and the other way round).
+#[test]
+fn decoded_images_under_a_transfer_function_are_not_shared() {
+    let pdf = image_cache_pdf(
+        // The image, then the same image at the same place under the inverting function
+        // (one decode target), then the image alone on the right.
+        "q 50 0 0 50 10 10 cm /A Do Q q /Inv gs 50 0 0 50 10 10 cm /A Do Q q 40 0 0 40 80 15 cm /A Do Q",
+        "<< /XObject << /A 5 0 R >> /ExtGState << /Inv << /TR 6 0 R >> >> >>",
+        &[(ONE_PIXEL_RGB, b"\xff\x00\x00"), ("<< /FunctionType 4 /Domain [0 1] /Range [0 1] /Length 14 >>", b"{ 1 exch sub }")],
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    let w = out.width as usize;
+    assert_eq!(rgb_at(&out.rgba, w, 35, 35), [0, 255, 255], "the transfer function was not applied to a cached image");
+    assert_eq!(rgb_at(&out.rgba, w, 100, 35), [255, 0, 0]);
+}
+
+/// The decoded-image cache keyed every decode by the size the image is drawn at, but only
+/// a JPX stream decodes differently for a size: a scan was decoded again at every zoom step
+/// and kept once per zoom level (vendored hayro-interpret patch 32). An image drawn at five
+/// sizes is now decoded once, unless JPX decodes it or its soft mask.
+#[test]
+fn decoded_images_serve_every_size_they_are_drawn_at() {
+    use hayro::hayro_interpret::font::Glyph;
+    use hayro::hayro_interpret::hayro_syntax::Pdf;
+    use hayro::hayro_interpret::{
+        BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, Paint, PathDrawMode, SoftMask, TransformExt, interpret_page,
+    };
+    use kurbo::{Affine, BezPath, Rect};
+    use std::io::Write;
+
+    /// Asks for every raster image at the size it is drawn at, as the renderer does, and
+    /// counts the decoded images it was handed.
+    #[derive(Default)]
+    struct Draws(usize);
+    impl<'a> Device<'a> for Draws {
+        fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+        fn set_blend_mode(&mut self, _: BlendMode) {}
+        fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'a>, _: &PathDrawMode) {}
+        fn push_clip_path(&mut self, _: &ClipPath) {}
+        fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
+        fn draw_glyph(&mut self, _: &Glyph<'a>, _: Affine, _: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {}
+        fn draw_image(&mut self, image: Image<'a, '_>, transform: Affine) {
+            let [a, b, c, d, ..] = transform.as_coeffs();
+            let target = ((a.hypot(b) * f64::from(image.width())).ceil() as u32, (c.hypot(d) * f64::from(image.height())).ceil() as u32);
+            if let Image::Raster(r) = image {
+                r.with_rgba(|_, _| self.0 += 1, Some(target));
+            }
+        }
+        fn pop_clip_path(&mut self) {}
+        fn pop_transparency_group(&mut self) {}
+    }
+
+    let flate = |data: &[u8]| {
+        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
+        z.write_all(data).unwrap();
+        z.finish().unwrap()
+    };
+    let pixels = flate(&(0..64 * 64 * 3).map(|i| (i % 251) as u8).collect::<Vec<_>>());
+    let image = |extra: &str| {
+        format!(
+            "<< /Type /XObject /Subtype /Image /Width 64 /Height 64 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /FlateDecode {extra}/Length {} >>",
+            pixels.len()
+        )
+    };
+    let (plain, jpx_masked) = (image(""), image("/SMask 7 0 R "));
+    let jpx_mask =
+        "<< /Type /XObject /Subtype /Image /Width 64 /Height 64 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /JPXDecode /Length 4 >>";
+    // `name` drawn at five sizes, from 10 to 40 pt square.
+    let decodes = |name: &str| {
+        let content = [(10, 0, 0), (20, 12, 0), (30, 34, 0), (40, 66, 0), (25, 100, 40)]
+            .map(|(s, x, y)| format!("q {s} 0 0 {s} {x} {y} cm /{name} Do Q"))
+            .join(" ");
+        let bytes = image_cache_pdf(
+            &content,
+            "<< /XObject << /A 5 0 R /B 6 0 R >> >>",
+            &[(&plain, &pixels), (&jpx_masked, &pixels), (jpx_mask, b"\0\0\0\0")],
+        );
+        let parsed = Pdf::new(Arc::new(bytes)).expect("parses");
+        let page = &parsed.pages()[0];
+        let cache = InterpreterCache::new();
+        let initial = page.initial_transform(true).to_kurbo();
+        let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, 130.0, 70.0), &cache, page.xref(), InterpreterSettings::default());
+        let mut device = Draws::default();
+        interpret_page(page, &mut ctx, &mut device);
+        assert_eq!(device.0, 5, "every draw of /{name} was handed its pixels");
+        cache.decoded_image_decodes()
+    };
+    assert_eq!(decodes("A"), 1, "a Flate image decodes the same at every size");
+    assert_eq!(decodes("B"), 5, "a JPX soft mask decodes for the size it is drawn at");
+}
+
+// ICC profiles whose stream dictionaries are the same (vendored hayro-interpret patch 48).
+mod icc_profile_cache;
+
+// A symbolic TrueType font draws through its (3, 0) cmap subtable first (#4156).
+mod symbolic_truetype_cmap;
+
+/// Render `pdf`'s first page at 72 dpi with no time limit beyond the test's own.
+fn render_first_page(pdf: Vec<u8>) -> RenderedPage {
+    let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    out
+}
+
+/// A spot-colour image runs its tint transform once per possible sample, not once per pixel
+/// (vendored hayro-interpret patch 28). Fillable character sheets draw their background art
+/// as an 8-bit DeviceN image whose tint transform is a PostScript calculator program: run for
+/// each of a 3304 × 4105 background's pixels, every page took four seconds and 430 MB to
+/// draw, again after each field was filled. This image (2048 × 2048, a 9,000-operator
+/// program) took about 40 seconds that way; from a 256-entry table it takes milliseconds.
+/// The runs are counted (patch 34) rather than timed: a deadline also failed when a slow,
+/// busy CI machine took longer than it allowed, and the count is the same on every machine.
+#[test]
+fn spot_colour_images_run_their_tint_transform_once_per_sample_value() {
+    const SIDE: usize = 2048;
+    // 8,990 operators that change nothing (the calculator allows 10,000 a run), then
+    // tint t → RGB (1 − t, t, 0).
+    let program = format!("{{ {}dup 1 exch sub exch 0 }}", "dup pop ".repeat(4495));
+    // Each row: tint 0 on the left half, tint 1 on the right.
+    let row: Vec<u8> = [vec![0u8; SIDE / 2], vec![255u8; SIDE / 2]].concat();
+    let data = row.repeat(SIDE);
+    let image = format!(
+        "<< /Type /XObject /Subtype /Image /Width {SIDE} /Height {SIDE} /ColorSpace [/Separation /Spot /DeviceRGB 6 0 R] /BitsPerComponent 8 /Length {} >>",
+        data.len()
+    );
+    let function = format!("<< /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >>", program.len());
+    let pdf = image_cache_pdf("q 130 0 0 70 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data), (&function, program.as_bytes())]);
+    // The count is per thread, and this render runs on this one.
+    let before = hayro::hayro_interpret::color::tint_transform_runs();
+    let out = render_first_page(pdf);
+    let runs = hayro::hayro_interpret::color::tint_transform_runs() - before;
+    assert_eq!(runs, 256, "the tint transform runs once per possible sample value, not once for each of the {} pixels", SIDE * SIDE);
+    let w = out.width as usize;
+    assert_eq!(rgb_at(&out.rgba, w, 10, 35), [255, 0, 0], "tint 0");
+    assert_eq!(rgb_at(&out.rgba, w, 120, 35), [0, 255, 0], "tint 1");
+}
+
+/// Images converted through patch 28's table keep the colour of every sample: the samples of
+/// a pixel in order, each through its own `/Decode` range, rows that end mid-byte, and an image
+/// whose data stops part-way through a row (that row is padded with decoded zeros, as before).
+#[test]
+fn images_converted_through_a_table_keep_every_samples_colour() {
+    let close = |got: [u8; 3], want: [u8; 3], at: (usize, usize)| {
+        assert!(got.iter().zip(want).all(|(g, w)| g.abs_diff(w) <= 1), "pixel {at:?}: got {got:?}, want {want:?}");
+    };
+    // DeviceN of two inks at 4 bits (256 possible pixels) shown as RGB (a, b, 0), the first
+    // ink's range reversed. 32 × 16 pixels, each drawn 4 pt square.
+    let mut data = Vec::new();
+    for y in 0..16 {
+        for x in 0..32 {
+            let (a, b) = (x % 16, (x / 16 + 2 * y) % 16);
+            data.push(((a << 4) | b) as u8);
+        }
+    }
+    let image = format!(
+        "<< /Type /XObject /Subtype /Image /Width 32 /Height 16 /ColorSpace [/DeviceN [/A /B] /DeviceRGB 6 0 R] /BitsPerComponent 4 /Decode [1 0 0 1] /Length {} >>",
+        data.len()
+    );
+    let pdf = image_cache_pdf(
+        "q 128 0 0 64 0 0 cm /A Do Q",
+        "<< /XObject << /A 5 0 R >> >>",
+        &[(&image, &data), ("<< /FunctionType 4 /Domain [0 1 0 1] /Range [0 1 0 1 0 1] /Length 5 >>", b"{ 0 }")],
+    );
+    let out = render_first_page(pdf);
+    let w = out.width as usize;
+    for y in 0..16 {
+        for x in 0..32 {
+            let (a, b) = (x % 16, (x / 16 + 2 * y) % 16);
+            // The 64 pt image sits at the bottom of the 70 pt page.
+            close(rgb_at(&out.rgba, w, 4 * x + 2, 6 + 4 * y + 2), [(255 - 17 * a) as u8, (17 * b) as u8, 0], (x, y));
+        }
+    }
+
+    // DeviceGray at 2 bits, reversed: 31 pixels (62 bits, so each row ends mid-byte) by 6.
+    let sample = |x: usize, y: usize| (x + y) % 4;
+    let mut data = Vec::new();
+    for y in 0..6 {
+        let mut row = [0u8; 8];
+        for x in 0..31 {
+            row[x / 4] |= (sample(x, y) as u8) << (6 - 2 * (x % 4));
+        }
+        data.extend_from_slice(&row);
+    }
+    let image = format!(
+        "<< /Type /XObject /Subtype /Image /Width 31 /Height 6 /ColorSpace /DeviceGray /BitsPerComponent 2 /Decode [1 0] /Length {} >>",
+        data.len()
+    );
+    let pdf = image_cache_pdf("q 124 0 0 60 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data)]);
+    let out = render_first_page(pdf);
+    let w = out.width as usize;
+    for y in 0..6 {
+        for x in 0..31 {
+            // The 60 pt image at the bottom of the page: rows 10 pt high.
+            close(rgb_at(&out.rgba, w, 4 * x + 2, 10 + 10 * y + 5), [(255 - 85 * sample(x, y)) as u8; 3], (x, y));
+        }
+    }
+
+    // DeviceGray at 8 bits through the range [0.2 0.8] (so not drawn from the raw bytes):
+    // 31 × 12 declared, data for 8 rows and the first 12 pixels of the 9th.
+    let sample = |x: usize, y: usize| (x * 7 + y * 3) % 256;
+    let mut data = Vec::new();
+    for y in 0..9 {
+        let row: Vec<u8> = (0..31).map(|x| sample(x, y) as u8).collect();
+        data.extend_from_slice(if y < 8 { &row[..] } else { &row[..12] });
+    }
+    let image = format!(
+        "<< /Type /XObject /Subtype /Image /Width 31 /Height 12 /ColorSpace /DeviceGray /BitsPerComponent 8 /Decode [0.2 0.8] /Length {} >>",
+        data.len()
+    );
+    let pdf = image_cache_pdf("q 124 0 0 60 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data)]);
+    let out = render_first_page(pdf);
+    let w = out.width as usize;
+    for y in 0..9 {
+        for x in 0..31 {
+            // The rest of the 9th row is decoded zero (black), not sample 0 (0.2 under this range).
+            let gray = if y < 8 || x < 12 { (51.0 + 0.6 * sample(x, y) as f64).round() as u8 } else { 0 };
+            // The rows present keep the declared rows' height: 60 pt / 12.
+            close(rgb_at(&out.rgba, w, 4 * x + 2, 10 + 5 * y + 2), [gray; 3], (x, y));
+        }
+    }
+}
+
+/// Patch 28's table converts each entry on its own: a tint transform that gives the wrong
+/// number of components for a sample value the image never uses leaves the colours of the
+/// values it does use alone. Converted as one batch, the one component tint 0 gives here
+/// shifted every later entry, and tint 1's red came out black (PR #1691 review).
+#[test]
+fn a_malformed_tint_for_an_unused_sample_keeps_the_used_colours() {
+    // Tint 0 gives one component instead of the three `/Range` declares; any other tint red.
+    let program = b"{ dup 0 eq { pop 0 } { pop 1 0 0 } ifelse }";
+    // 32 × 32 = 1,024 pixels, more than the table's 256 entries, all sample 255 (tint 1).
+    let data = [255u8; 32 * 32];
+    let centre = |space: &str| {
+        let image = format!(
+            "<< /Type /XObject /Subtype /Image /Width 32 /Height 32 /ColorSpace [{space} /DeviceRGB 6 0 R] /BitsPerComponent 8 /Length {} >>",
+            data.len()
+        );
+        let function = format!("<< /FunctionType 4 /Domain [0 1] /Range [0 1 0 1 0 1] /Length {} >>", program.len());
+        let pdf = image_cache_pdf("q 130 0 0 70 0 0 cm /A Do Q", "<< /XObject << /A 5 0 R >> >>", &[(&image, &data), (&function, program)]);
+        let out = render_first_page(pdf);
+        rgb_at(&out.rgba, out.width as usize, 65, 35)
+    };
+    assert_eq!([centre("/Separation /Spot"), centre("/DeviceN [/Spot]")], [[255, 0, 0]; 2], "Separation, then one-ink DeviceN");
+}
+
+/// A Japanese CID font that isn't embedded (Adobe-Japan1, as `HeiseiMin-W3` with
+/// `UniJIS-UCS2-H` in #260's test file) drew nothing: hayro's substitutes for fonts that
+/// aren't embedded are Latin-only. With craft-fonts (the build input release builds embed),
+/// such text now draws in a Japanese face; without it, nothing changes.
+#[test]
+fn non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face() {
+    let pdf = |base_font: &str| {
+        let content = "BT /F1 40 Tf 5 15 Td <65E5672C> Tj ET";
+        format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /{base_font} /Encoding /UniJIS-UCS2-H /DescendantFonts [6 0 R] >> endobj
+6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /{base_font} /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 2 >>
+  /FontDescriptor 7 0 R /DW 1000 >> endobj
+7 0 obj << /Type /FontDescriptor /FontName /{base_font} /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        )
+    };
+    for base_font in ["HeiseiMin-W3", "HeiseiKakuGo-W5"] {
+        let mut r = PageRenderer::new(Arc::new(pdf(base_font).into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{base_font}: {:?}", p.error);
+        let inked = p.rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
+        if pdfcraft_fonts::document_japanese_font().is_none() {
+            eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
+            continue;
+        }
+        // 日本 at 40 pt covers a few hundred dark pixels; a blank or missing-glyph run doesn't.
+        assert!(inked > 300, "{base_font}: 日本 is drawn ({inked} dark pixels)");
+    }
+}
+
+// #3601: UniJIS-UCS2-HW-H maps code 0x0020 to CID 231 / U+2002. The PDF's
+// explicit 500-unit width must win over the substitute's ordinary-space width.
+fn japanese_spacing_pdf(content: &str, widths: &str) -> Vec<u8> {
+    format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 180 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /MS-Mincho /Encoding /UniJIS-UCS2-HW-H /DescendantFonts [6 0 R] >> endobj
+6 0 obj << /Type /Font /Subtype /CIDFontType2 /BaseFont /MS-Mincho /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 4 >>
+  /FontDescriptor 7 0 R /DW 1000 {widths} >> endobj
+7 0 obj << /Type /FontDescriptor /FontName /MS-Mincho /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    )
+    .into_bytes()
+}
+
+#[test]
+fn japanese_substitute_missing_spaces_draw_no_ink() {
+    if pdfcraft_fonts::document_japanese_font().is_none() {
+        eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
+        return;
+    }
+    let out = render_first_page(japanese_spacing_pdf("BT /F1 20 Tf 10 30 Td <002000200020> Tj ET", "/W [231 [500]]"));
+    assert!(out.rgba.as_chunks::<4>().0.iter().all(|pixel| *pixel == [255; 4]), "spacing glyphs must leave the page white");
+}
+
+#[test]
+fn japanese_substitute_spaces_keep_pdf_widths_and_unicode() {
+    if pdfcraft_fonts::document_japanese_font().is_none() {
+        eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
+        return;
+    }
+    for (widths, second_x) in [("/W [231 [500]]", 50), ("", 70)] {
+        let pdf = japanese_spacing_pdf("BT /F1 20 Tf 10 30 Td <65E500200020672C> Tj ET", widths);
+        let out = render_first_page(pdf.clone());
+        // 日 advances 20 pt; each space advances 10 pt (/W) or 20 pt (/DW).
+        // A second independent text matrix pins 本 at the expected original PDF position.
+        let reference = format!("BT /F1 20 Tf 1 0 0 1 10 30 Tm <65E5> Tj 1 0 0 1 {second_x} 30 Tm <672C> Tj ET");
+        let expected = render_first_page(japanese_spacing_pdf(&reference, widths));
+        assert!(expected.rgba.as_chunks::<4>().0.iter().any(|pixel| pixel[0] < 128), "the Japanese control must draw ink");
+        assert!(out.rgba.as_ref() == expected.rgba.as_ref(), "spaces must be blank without changing {widths:?} advances");
+        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
+        assert!(text.error.is_none(), "{:?}", text.error);
+        let glyphs: String = text.text.unwrap().glyphs.iter().map(|glyph| glyph.text.as_str()).collect();
+        assert_eq!(glyphs, "日\u{2002}\u{2002}本", "glyph substitution must not rewrite Unicode");
+    }
+}
+
+/// Half-width katakana are common in Japanese documents set in a non-embedded Mincho font
+/// such as HeiseiMin-W3. The Mincho substitute must have those glyphs: one that lacks them
+/// (Shippori Mincho) draws them as .notdef.
+#[test]
+fn mincho_substitute_covers_half_width_katakana() {
+    use hayro::hayro_interpret::font::FallbackFontQuery;
+    use hayro::hayro_interpret::hayro_cmap::CharacterCollection;
+    use skrifa::MetadataProvider;
+    let query = FontQuery::Fallback(FallbackFontQuery {
+        post_script_name: Some("HeiseiMin-W3".into()),
+        character_collection: Some(CharacterCollection { family: CidFamily::AdobeJapan1, supplement: 2 }),
+        ..FallbackFontQuery::default()
+    });
+    let Some((data, index)) = super::japanese_fallback(&query) else {
+        eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
+        return;
+    };
+    let font = skrifa::FontRef::from_index((*data).as_ref(), index).expect("a craft-fonts face parses");
+    let charmap = font.charmap();
+    let missing: Vec<char> = ('\u{FF61}'..='\u{FF9F}').chain(['日', '本']).filter(|&c| charmap.map(c).is_none()).collect();
+    assert!(missing.is_empty(), "the Mincho substitute lacks {missing:?}");
+}
+
+/// 𠮷 (U+20BB7, Adobe-Japan1 CID 13706) in a non-embedded Japanese font: neither craft-fonts
+/// substitute has it, and hayro drew the substitute's glyph 13706 instead, which is
+/// unrelated (in BIZ UDPGothic, "Ｑ"). It draws the substitute's .notdef now, while 吉, which
+/// the substitutes have, still draws.
+#[test]
+fn cids_a_substitute_lacks_are_not_drawn_as_other_glyphs() {
+    if pdfcraft_fonts::document_japanese_font().is_none() {
+        eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
+        return;
+    }
+    let render = |base_font: &str, encoding: &str, code: &str| {
+        let content = format!("BT /F1 40 Tf 5 15 Td <{code}> Tj ET");
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 60 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /{base_font} /Encoding /{encoding} /DescendantFonts [6 0 R] >> endobj
+6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /{base_font} /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 6 >>
+  /FontDescriptor 7 0 R /DW 1000 >> endobj
+7 0 obj << /Type /FontDescriptor /FontName /{base_font} /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{base_font} <{code}>: {:?}", p.error);
+        p.rgba
+    };
+    let inked = |rgba: &[u8]| rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
+    for base_font in ["HeiseiMin-W3", "HeiseiKakuGo-W5"] {
+        let notdef = render(base_font, "Identity-H", "0000");
+        let missing = render(base_font, "UniJIS-UTF16-H", "D842DFB7");
+        let covered = render(base_font, "UniJIS-UTF16-H", "5409");
+        assert!(missing == notdef, "{base_font}: 𠮷 draws .notdef ({} dark pixels, .notdef {})", inked(&missing), inked(&notdef));
+        assert!(inked(&covered) > 300 && covered != notdef, "{base_font}: 吉 is drawn ({} dark pixels)", inked(&covered));
+    }
+}
+
+#[test]
+fn japanese_font_names_pick_mincho_or_gothic() {
+    use super::JapaneseFace::{Gothic, Mincho};
+    for (name, serif, bold, face) in [
+        ("HeiseiMin-W3", false, false, Mincho),
+        ("KozMinPro-Regular", false, false, Mincho),
+        ("Ryumin-Light", false, false, Mincho),
+        ("MS-PMincho", false, false, Mincho),
+        ("HiraMinProN-W3", false, false, Mincho),
+        ("HeiseiKakuGo-W5", true, false, Gothic { bold: false }),
+        ("KozGoPro-Bold", true, true, Gothic { bold: true }),
+        ("GothicBBB-Medium", true, false, Gothic { bold: false }),
+        ("MS-Gothic", false, false, Gothic { bold: false }),
+        ("HiraKakuProN-W6", false, true, Gothic { bold: true }),
+        ("Unknown-Japanese", true, false, Mincho),
+        ("Unknown-Japanese", false, false, Gothic { bold: false }),
+    ] {
+        assert_eq!(super::japanese_face(name, serif, bold), face, "{name}");
+    }
+}
+
+/// Adobe-Japan1 maps the JIS X 0208 forms of the kanji that JIS X 0213:2004 redrew (噂, 逢,
+/// 溢, …) to a variation sequence: CID 1247 is 噂 U+E0100. A non-embedded Japanese font drew
+/// such a CID as an unrelated glyph, since the substitute has no glyph for a sequence. It
+/// draws the substitute's glyph for that form now, and its 噂 for a form it doesn't have.
+#[test]
+fn variation_sequences_draw_their_kanji_in_a_substitute() {
+    if pdfcraft_fonts::document_japanese_font().is_none() {
+        eprintln!("built without craft-fonts (CRAFT_FONTS_DIR unset): no Japanese face to check");
+        return;
+    }
+    let render = |base_font: &str, encoding: &str, to_unicode: &str, code: &str| {
+        let content = format!("BT /F1 40 Tf 5 15 Td <{code}> Tj ET");
+        let cmap = format!(
+            "/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CMapName /Test def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespacerange 1 beginbfchar <0001> <{to_unicode}> endbfchar endcmap CMapName currentdict /CMap defineresource pop end end"
+        );
+        // Code <0001> through `/ToUnicode` when the encoding is Identity-H; otherwise no
+        // `/ToUnicode`, so the CID goes through Adobe-Japan1-UCS2.
+        let to_unicode = if encoding == "Identity-H" { "/ToUnicode 8 0 R" } else { "" };
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 60 60] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type0 /BaseFont /{base_font} /Encoding /{encoding} /DescendantFonts [6 0 R] {to_unicode} >> endobj
+6 0 obj << /Type /Font /Subtype /CIDFontType0 /BaseFont /{base_font} /CIDSystemInfo << /Registry (Adobe) /Ordering (Japan1) /Supplement 6 >>
+  /FontDescriptor 7 0 R /DW 1000 >> endobj
+7 0 obj << /Type /FontDescriptor /FontName /{base_font} /Flags 6 /FontBBox [0 -141 1000 859] /ItalicAngle 0 /Ascent 859 /Descent -141 /CapHeight 700 /StemV 80 >> endobj
+8 0 obj << /Length {} >> stream
+{cmap}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len(),
+            cmap.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{base_font} <{code}>: {:?}", p.error);
+        p.rgba
+    };
+    let inked = |rgba: &[u8]| rgba.as_chunks::<4>().0.iter().filter(|c| c[0] < 128).count();
+    for base_font in ["HeiseiMin-W3", "HeiseiKakuGo-W5"] {
+        let collection = render(base_font, "UniJIS-UCS2-H", "", "5642");
+        let form = render(base_font, "Identity-H", "5642DB40DD00", "0001");
+        let character = render(base_font, "Identity-H", "5642", "0001");
+        let unknown_form = render(base_font, "Identity-H", "5642DB40DD05", "0001");
+        assert!(inked(&form) > 300, "{base_font}: 噂 U+E0100 is drawn ({} dark pixels)", inked(&form));
+        assert!(collection == form, "{base_font}: CID 1247 draws 噂 U+E0100");
+        assert!(form != character, "{base_font}: the form differs from the face's default 噂");
+        assert!(unknown_form == character, "{base_font}: a form the face lacks draws its 噂");
+    }
+}
+
+/// InDesign fades are luminosity soft masks whose group is one extended axial `sh`: a
+/// gradient over the whole page. hayro 0.7 sampled each one pixel by pixel through the
+/// shading function, so a report page with 40 of them took 15 s at 144 dpi. Vendored hayro
+/// patch (backport of hayro 0.8): axial and radial shadings that a native gradient can
+/// represent exactly are drawn as one, with stops placed at stitching-function bounds.
+#[test]
+fn axial_and_radial_shadings_draw_as_native_gradients() {
+    use hayro::hayro_interpret::font::Glyph;
+    use hayro::hayro_interpret::hayro_syntax::Pdf;
+    use hayro::hayro_interpret::pattern::Pattern;
+    use hayro::hayro_interpret::{
+        BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, Paint, PathDrawMode, SoftMask, TransformExt, interpret_page,
+    };
+    use kurbo::{Affine, BezPath, Rect, Shape};
+
+    /// For every shading painted, the offsets of its native gradient stops, or `None` when
+    /// it has to be sampled pixel by pixel.
+    #[derive(Default)]
+    struct Gradients(Vec<Option<Vec<f32>>>);
+    impl<'a> Device<'a> for Gradients {
+        fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+        fn set_blend_mode(&mut self, _: BlendMode) {}
+        fn draw_path(&mut self, path: &BezPath, transform: Affine, paint: &Paint<'a>, _: &PathDrawMode) {
+            if let Paint::Pattern(pattern) = paint
+                && let Pattern::Shading(s) = pattern.as_ref()
+            {
+                let bbox = (transform * path.clone()).bounding_box();
+                let native = s.encode().as_svg_gradient(bbox, 0.01);
+                self.0.push(native.map(|g| g.stops.iter().map(|stop| stop.offset).collect()));
+            }
+        }
+        fn push_clip_path(&mut self, _: &ClipPath) {}
+        fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
+        fn draw_glyph(&mut self, _: &Glyph<'a>, _: Affine, _: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {}
+        fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
+        fn pop_clip_path(&mut self) {}
+        fn pop_transparency_group(&mut self) {}
+    }
+
+    // A 40 × 20 pt page painting `/Sh0 sh`, with optional extra objects from 6 0 obj on.
+    let pdf = |shading: &str, extra: &str| {
+        let content = "/Sh0 sh";
+        format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 20] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj {shading} endobj
+{extra}trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        )
+        .into_bytes()
+    };
+    let gradients = |bytes: &[u8]| {
+        let parsed = Pdf::new(Arc::new(bytes.to_vec())).expect("parses");
+        let page = &parsed.pages()[0];
+        let cache = InterpreterCache::new();
+        let initial = page.initial_transform(true).to_kurbo();
+        let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, 40.0, 20.0), &cache, page.xref(), InterpreterSettings::default());
+        let mut device = Gradients::default();
+        interpret_page(page, &mut ctx, &mut device);
+        device.0
+    };
+    let render = |bytes: Vec<u8>| {
+        let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+        assert!(p.error.is_none(), "{:?}", p.error);
+        p
+    };
+    let grey = |p: &RenderedPage, x: u32| i32::from(p.rgba[((10 * p.width + x) * 4) as usize]);
+    let ramp = "/FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1";
+    // A function-based shading (always sampled) that draws the same picture is the reference;
+    // its /Range clamps to 0..1.
+    let sampled = |code: &str| {
+        let extra =
+            format!("6 0 obj << /FunctionType 4 /Domain [0 40 0 20] /Range [0 1] /Length {} >> stream\n{code}\nendstream endobj\n", code.len());
+        pdf("<< /ShadingType 1 /ColorSpace /DeviceGray /Domain [0 40 0 20] /Function 6 0 R >>", &extra)
+    };
+
+    // A steep extended axial ramp, x 10 to 14: one stop at each end, drawn at pixel centres
+    // (a half-pixel shift would move each pixel 32 levels) and padded on both sides.
+    let axial = pdf(&format!("<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [10 0 14 0] /Extend [true true] /Function << {ramp} >> >>"), "");
+    assert_eq!(gradients(&axial), vec![Some(vec![0.0, 1.0])], "an extended axial shading is a native gradient");
+    let native = render(axial);
+    let reference = render(sampled("{ pop 10 sub 4 div }"));
+    for (x, expected) in [(2, 0), (9, 0), (10, 32), (11, 96), (12, 159), (13, 223), (14, 255), (30, 255)] {
+        assert!((grey(&native, x) - expected).abs() <= 4, "axial, x {x}: {} instead of {expected}", grey(&native, x));
+        assert!((grey(&native, x) - grey(&reference, x)).abs() <= 4, "axial, x {x}: native {} vs sampled {}", grey(&native, x), grey(&reference, x));
+    }
+
+    // An extended radial shading matches the sampled one everywhere.
+    let radial =
+        pdf(&format!("<< /ShadingType 3 /ColorSpace /DeviceGray /Coords [20 10 0 20 10 8] /Extend [true true] /Function << {ramp} >> >>"), "");
+    assert!(matches!(gradients(&radial).as_slice(), [Some(_)]), "an extended radial shading is a native gradient");
+    let native = render(radial);
+    let reference = render(sampled("{ 10 sub dup mul exch 20 sub dup mul add sqrt 8 div }"));
+    let worst = native.rgba.iter().zip(reference.rgba.iter()).map(|(a, b)| a.abs_diff(*b)).max();
+    assert!(worst.is_some_and(|d| d <= 4), "radial: native and sampled differ by {worst:?} levels");
+
+    // A stitched function peaking at a quarter of the way gets a stop exactly at its bound.
+    let stitched = pdf(
+        "<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Extend [true true] /Function << /FunctionType 3 /Domain [0 1] /Bounds [0.25] /Encode [0 1 0 1] /Functions [<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>] >> >>",
+        "",
+    );
+    let stops = gradients(&stitched);
+    assert!(matches!(stops.as_slice(), [Some(offsets)] if offsets.contains(&0.25)), "a stop at the stitching bound: {stops:?}");
+    let native = render(stitched);
+    for (x, expected) in [(0, 13), (9, 242), (10, 250), (39, 4)] {
+        assert!((grey(&native, x) - expected).abs() <= 4, "stitched, x {x}: {} instead of {expected}", grey(&native, x));
+    }
+
+    // Without /Extend the area beyond the axis keeps the background, which a native gradient
+    // can't leave out: still sampled. Function-based shadings are always sampled.
+    let unextended = pdf(&format!("<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [10 0 14 0] /Function << {ramp} >> >>"), "");
+    assert_eq!(gradients(&unextended), vec![None], "an axial shading without /Extend that covers more than its axis");
+    assert_eq!(gradients(&sampled("{ pop pop 0.5 }")), vec![None], "a function-based shading");
+
+    // The report's case: a luminosity soft mask whose group is one extended axial `sh` over
+    // the page. Red through a mask fading in from x 0 to 40 over white: 255, 255 − t, 255 − t.
+    let content = "/M gs 1 0 0 rg 0 0 40 20 re f";
+    let masked = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 20] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /ExtGState /SMask << /Type /Mask /S /Luminosity /G 6 0 R >> >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [-32768 -32768 32767 32767] /Group << /S /Transparency /CS /DeviceGray >> /Resources << /Shading << /Sh0 << /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Extend [true true] /Function << {ramp} >> >> >> >> /Length 7 >> stream
+/Sh0 sh
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let p = render(masked.into_bytes());
+    for x in [2u32, 20, 37] {
+        let px = &p.rgba[((10 * p.width + x) * 4) as usize..][..4];
+        let faded = 255 - (255.0 * (f64::from(x) + 0.5) / 40.0).round() as i32;
+        assert!(px[0] == 255 && (i32::from(px[1]) - faded).abs() <= 4 && px[1] == px[2], "masked, x {x}: {px:?}, green and blue {faded}");
+    }
+}
+
+/// An alpha soft mask whose transparency group has no /CS (as Chrome writes gradient text)
+/// must still mask. Regression test for the vendored hayro-interpret patch.
+#[test]
+fn soft_mask_without_group_colour_space_is_applied() {
+    let pdf = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> >> >> endobj
+4 0 obj << /Length 31 >> stream
+/M gs 1 0 0 rg 0 0 100 100 re f
+endstream endobj
+5 0 obj << /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 6 0 R >> >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >> stream
+0 g 0 0 50 100 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), RenderConfig::default());
+    let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    assert_eq!(px(25, 50), vec![255, 0, 0, 255], "inside the mask");
+    assert_eq!(px(75, 50), vec![255, 255, 255, 255], "outside the mask");
+}
+
+/// Issue #2128: PowerPoint fades a gradient fill (an axial shading pattern) through a soft
+/// mask. vello_cpu 0.0.8 copies an opaque gradient straight over fully covered tiles,
+/// skipping the mask, so the fade came out solid. Images get around that by declaring
+/// transparency while a mask or blend mode is set; native gradients can't, so they are
+/// sampled as a texture then.
+#[test]
+fn soft_mask_applies_to_a_shading_pattern_fill() {
+    let content = "/Pattern cs /P0 scn /M gs 0 0 100 100 re f";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> /Pattern << /P0 7 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 6 0 R >> >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /CS /DeviceRGB >> /Length 20 >> stream
+0 g 0 0 50 100 re f
+endstream endobj
+7 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Extend [true true] /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [1 0 0] /N 1 >> >> >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    assert_eq!(px(25, 50), vec![255, 0, 0, 255], "inside the mask");
+    assert_eq!(px(75, 50), vec![255, 255, 255, 255], "outside the mask");
+}
+
+/// Issue #3176: `CA` / `ca` belong to the graphics state at paint time, so a `gs` after
+/// `SCN` / `scn` still fades a shading pattern, and a stroke takes the stroke alpha. The
+/// pattern took the fill alpha current at `scn`/`SCN`, so both shapes came out opaque.
+#[test]
+fn shading_pattern_uses_the_alpha_current_at_paint_time() {
+    let content = "/Pattern CS /P0 SCN /S1 gs 10 w 0 75 m 100 75 l S /Pattern cs /P0 scn /F1 gs 0 0 100 50 re f";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R
+  /Resources << /ExtGState << /S1 << /CA 0.25 >> /F1 << /ca 0.25 >> >> /Pattern << /P0 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Extend [true true]
+  /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [1 0 0] /N 1 >> >> >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    );
+    let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+    let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+    assert!(p.error.is_none(), "{:?}", p.error);
+    let px = |x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    // Red at 25% over white is about (255, 191, 191); opaque red would be (255, 0, 0).
+    for (what, x, y) in [("the stroke under /CA 0.25", 50, 25), ("the fill under /ca 0.25", 50, 75)] {
+        let c = px(x, y);
+        assert!(c[0] >= 250 && (185..=197).contains(&c[1]) && (185..=197).contains(&c[2]), "{what}: {c:?}");
+    }
+}
+
+/// ISO 32000-2 §8.5.4: `W` / `W*` clip with the current path once whichever path-painting
+/// operator ends it has painted it, `S`, `f` or `B` as much as `n`. The vendored interpreter
+/// applied the clip only on `n`: after `re W* S` everything later painted outside the clip,
+/// and the forgotten clip stayed pending, so a later `re n` (even after `Q`) clipped
+/// content that should show. MuPDF, Poppler and PDFium clip in every case below.
+#[test]
+fn clipping_path_applies_after_any_painting_operator() {
+    let render = |content: &str| {
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{content}: {:?}", p.error);
+        p
+    };
+    let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec();
+    let red = vec![255, 0, 0, 255];
+    // The clip is the square x 20..60, y 20..60 (device rows 40..80); then the page is filled red.
+    for op in ["n", "S", "s", "f", "F", "f*", "B", "B*", "b", "b*"] {
+        for clip in ["W", "W*"] {
+            let p = render(&format!("q 0 0 1 RG 4 w 0.8 g 20 20 40 40 re {clip} {op} 1 0 0 rg 0 0 100 100 re f Q"));
+            assert_eq!(px(&p, 40, 60), red, "{clip} {op}: inside the clip");
+            assert_ne!(px(&p, 5, 5), red, "{clip} {op}: outside the clip");
+            assert_ne!(px(&p, 95, 95), red, "{clip} {op}: outside the clip");
+            // The operator that ends the path paints under the old clip: the outer half of
+            // the 4 pt stroke (x 18..20) shows outside the new one.
+            let stroked = !["n", "f", "F", "f*"].contains(&op);
+            let edge = if stroked { vec![0, 0, 255, 255] } else { vec![255, 255, 255, 255] };
+            assert_eq!(px(&p, 18, 60), edge, "{clip} {op}: just outside the clip");
+        }
+    }
+    // A clip is used once: it doesn't linger for a later `n`, inside or outside `q`/`Q`.
+    for content in [
+        "q 0 0 1 RG 70 70 10 10 re W S Q q 10 10 20 20 re n 1 0 0 rg 0 0 100 100 re f Q",
+        "q 0 0 1 RG 0 0 100 100 re W S 10 10 20 20 re n 1 0 0 rg 0 0 100 100 re f Q",
+    ] {
+        let p = render(content);
+        assert!([(5, 5), (50, 50), (95, 95)].iter().all(|(x, y)| px(&p, *x, *y) == red), "{content}: no stray clip");
+    }
+}
+
+/// ISO 32000-2 §9.3.6: text in a Type 3 font is rendered from its glyph descriptions in every
+/// text rendering mode but 3 and 7 (vendored hayro-interpret patches 42 and 64 in
+/// `show_glyph`). Print-stream PDFs set `2 Tr` for Type 3 bitmap fonts, and the glyph
+/// procedure ran twice (fill, then stroke), so its anti-aliased edges doubled up and the text
+/// looked bold; under `1 Tr` an uncoloured glyph took the stroking colour. Modes 3 and 7
+/// render nothing (`tests/it/type3_text_clip.rs` covers the clip). Both glyph kinds have
+/// edges between pixels.
+#[test]
+fn rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled() {
+    let render = |glyph: &str, mode: u8| {
+        let content = format!("BT 1 0 0 RG 6 w 0 g /F1 20 Tf {mode} Tr 10.3 10.3 Td (A) Tj ET");
+        let pdf = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 1 1] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [1]
+  /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> >> endobj
+6 0 obj << /Length {} >> stream
+{glyph}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len(),
+            glyph.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{glyph} {mode} Tr: {:?}", p.error);
+        p.rgba
+    };
+    for glyph in ["1 0 0 0 1 1 d1 0.12 0.12 0.71 0.71 re f", "1 0 d0 0.12 0.12 0.71 0.71 re f"] {
+        let filled = render(glyph, 0);
+        assert!(filled.as_chunks::<4>().0.iter().any(|p| p[0] < 128), "{glyph}: the glyph paints");
+        for mode in [1, 2, 4, 5, 6] {
+            assert!(render(glyph, mode) == filled, "{glyph}: {mode} Tr draws as 0 Tr");
+        }
+        for mode in [3, 7] {
+            assert!(render(glyph, mode).as_chunks::<4>().0.iter().all(|p| p[..3] == [255, 255, 255]), "{glyph}: {mode} Tr hides the glyph");
+        }
+    }
+}
+
+// #1201: /DefaultGray, /DefaultRGB and /DefaultCMYK (vendored hayro-interpret patch 38).
+mod default_colour_spaces;
+
+// #4260: DeviceN colours with many inks, and tint transforms that cannot be evaluated
+// (vendored hayro-syntax patch 28, hayro-interpret patch 55).
+mod devicen_inks;
+
+/// #3109 / #3116: clipping-only text (`7 Tr`) installs a clip for subsequent painting
+/// but draws no pixels itself.
+#[test]
+fn test_clip_only_text_raster_preserves_clipping_without_painting() {
+    let pdf_bytes = |content: &str| {
+        Arc::new(
+            format!(
+                "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+                content.len()
+            )
+            .into_bytes(),
+        )
+    };
+    let render = |content: &str| {
+        let mut r = PageRenderer::new(pdf_bytes(content), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(p.error.is_none(), "{content}: {:?}", p.error);
+        p
+    };
+    let white = [255, 255, 255, 255];
+
+    // The text alone paints nothing.
+    let p = render("BT /F1 40 Tf 7 Tr 20 60 Td (Hi) Tj ET");
+    assert!(p.rgba.as_chunks::<4>().0.iter().all(|c| *c == white), "7 Tr alone leaves the page blank");
+
+    // A fill afterwards shows only through the text-shaped clip.
+    let p = render("q BT /F1 40 Tf 7 Tr 20 60 Td (Hi) Tj ET 0 0 1 rg 0 0 200 100 re f Q");
+    let pixels = p.rgba.as_chunks::<4>().0;
+    assert!(pixels.contains(&[0, 0, 255, 255]), "fill shows through the 7 Tr clip");
+    assert!(pixels.contains(&white), "the clip is text-shaped, not the whole page");
+}
diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 1e522b83f1..054262ee35 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -370,3134 +370,22 @@ impl PageText {
     }
 }
 
-/// Largest sine of the angle between a glyph's writing direction and a flow's for the glyph to be
-/// laid out in that flow's frame. Turning an em box by θ moves its edges along the line by up to
-/// h·sin θ, so below the layout's word-gap tolerance (`WORD_GAP` · h) the boxes still read as they
-/// would unturned.
-const DIRECTION_TOLERANCE: f64 = WORD_GAP as f64;
-
-/// A word gap is wider than the line's typical letter gap by this fraction of the line height.
-const WORD_GAP: f32 = 0.15;
-
-/// A glyph with its writing direction to the nearest quarter turn (right, down, left, up) and as
-/// a unit vector.
-type Drawn = (usize, [f64; 2], TextGlyph);
-
-struct TextDevice {
-    /// Every glyph in content order.
-    glyphs: Vec<Drawn>,
-    /// How many marked content sequences are open.
-    depth: usize,
-    /// The outermost open `/ActualText` replacement: its depth, text and the glyphs drawn inside
-    /// it (with no text of their own yet).
-    actual: Option<(usize, String, Vec<Drawn>)>,
-    /// Every `/ActualText` replacement made on the page.
-    replaced: Vec<Replaced>,
-    filter: TextFilter,
-    excluded_depth: Option<usize>,
-    actual_filtered: bool,
-    partial_replacement: bool,
-}
-
-/// An `/ActualText` replacement: the glyph standing for it in `TextDevice::glyphs` (none for an
-/// empty replacement), its text, and the text and box of each replaced glyph that has Unicode of
-/// its own.
-struct Replaced {
-    at: Option<usize>,
-    text: String,
-    originals: Vec<(String, [f32; 4])>,
-}
-
-/// Grid cell size, in points, for finding the glyphs drawn at a place.
-const CELL: f32 = 8.0;
-
-/// Most grid cells searched around one place: a glyph so tall its tolerance spans more is skipped.
-const MAX_CELLS: i64 = 4096;
-
-/// Most work (grid cells visited plus glyphs compared) the redraw dedupe in `TextDevice::finish`
-/// may do on one page. A hostile page stacking ~10^5 glyphs and ~10^5 replacements at one spot
-/// would otherwise make ~10^10 comparisons; past the budget the remaining replacements keep
-/// their unmarked redraws (the text reads twice, as it would without `/ActualText`).
-const MAX_REDRAW_WORK: usize = 1 << 22;
-
-/// Most replacement text bytes the redraw dedupe in `TextDevice::finish` copies on one page.
-const MAX_REDRAW_TEXT: usize = 1 << 22;
-
-#[cfg(test)]
-thread_local! {
-    /// Replacement text bytes given to redraws on this thread.
-    static REDRAW_TEXT_BYTES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-fn cell(v: f32) -> i64 {
-    // Glyph boxes are finite (`draw_glyph` and `merge` drop the rest); `as` saturates.
-    (v / CELL).floor() as i64
-}
-
-/// How far a redrawn glyph may sit from the one it redraws: a fifth of its height, as in `redraws`.
-fn redraw_tolerance(rect: &[f32; 4]) -> f32 {
-    0.2 * (rect[3] - rect[1]).max(0.1)
-}
-
-/// One glyph carrying `text`, boxed around `drawn` in their writing direction; `None` when they
-/// span several lines or writing directions (one box would break selection and line grouping).
-fn merge(drawn: &[Drawn], text: String) -> Option<Drawn> {
-    let first = drawn.first()?;
-    let (quarter, u) = (first.0, first.1);
-    // Across the line: from the writing direction a quarter turn towards the line's bottom.
-    let n = [-u[1], u[0]];
-    let along = |p: &[f32; 2]| f64::from(p[0]) * u[0] + f64::from(p[1]) * u[1];
-    let across = |p: &[f32; 2]| f64::from(p[0]) * n[0] + f64::from(p[1]) * n[1];
-    let height = across(&first.2.quad[0]) - across(&first.2.quad[3]);
-    let (mut s0, mut s1, mut t0, mut t1) = (f64::INFINITY, f64::NEG_INFINITY, f64::INFINITY, f64::NEG_INFINITY);
-    for p in drawn.iter().flat_map(|d| d.2.quad.iter()) {
-        (s0, s1) = (s0.min(along(p)), s1.max(along(p)));
-        (t0, t1) = (t0.min(across(p)), t1.max(across(p)));
-    }
-    let one_line = drawn.iter().all(|d| compatible(u, d.1)) && t1 - t0 <= 2.0 * height.abs();
-    if !(one_line && s0.is_finite() && s1.is_finite() && t0.is_finite() && t1.is_finite()) {
-        return None;
-    }
-    // The edge towards the next line is the one the first glyph's quad starts on.
-    let (near, far) = if height >= 0.0 { (t1, t0) } else { (t0, t1) };
-    let point = |s: f64, t: f64| [(s * u[0] + t * n[0]) as f32, (s * u[1] + t * n[1]) as f32];
-    let quad = [point(s0, near), point(s1, near), point(s1, far), point(s0, far)];
-    let rect = quad.iter().fold([f32::INFINITY, f32::INFINITY, f32::NEG_INFINITY, f32::NEG_INFINITY], |r, p| {
-        [r[0].min(p[0]), r[1].min(p[1]), r[2].max(p[0]), r[3].max(p[1])]
-    });
-    Some((quarter, u, TextGlyph { text, rect, quad, direction: first.2.direction }))
-}
-
-impl TextDevice {
-    fn new() -> Self {
-        TextDevice {
-            glyphs: Vec::new(),
-            depth: 0,
-            actual: None,
-            replaced: Vec::new(),
-            filter: TextFilter::default(),
-            excluded_depth: None,
-            actual_filtered: false,
-            partial_replacement: false,
-        }
-    }
-
-    /// Ends the open `/ActualText` replacement (ISO 32000-2 §14.9.4): its glyphs become one glyph
-    /// carrying the replacement text, boxed around them all. Chrome (Skia) writes one around
-    /// each Thai, Indic or Arabic cluster whose shaped glyphs (a tone mark moved clear of a vowel,
-    /// a ligature) have no Unicode of their own, so without it those marks are lost and the
-    /// words can't be found.
-    ///
-    /// A replacement spanning several lines or writing directions stays per glyph (each glyph's own
-    /// Unicode). An empty one (a soft hyphen at a line break, say) stands for no text at all.
-    fn end_actual_text(&mut self) {
-        let Some((_, text, drawn)) = self.actual.take() else { return };
-        if std::mem::take(&mut self.actual_filtered) {
-            // ActualText has no mapping from replacement words to individual glyphs. A mixed
-            // span cannot be filtered honestly; a wholly excluded span can simply be omitted.
-            self.partial_replacement |= !drawn.is_empty();
-            return;
-        }
-        let Some(glyph) = merge(&drawn, text.clone()) else {
-            self.glyphs.extend(drawn.into_iter().filter(|d| !d.2.text.chars().all(char::is_control)));
-            return;
-        };
-        let originals = drawn.iter().filter(|d| !d.2.text.chars().all(char::is_control)).map(|d| (d.2.text.clone(), d.2.rect)).collect();
-        let at = if text.chars().all(char::is_control) {
-            None
-        } else {
-            self.glyphs.push(glyph);
-            Some(self.glyphs.len() - 1)
-        };
-        self.replaced.push(Replaced { at, text, originals });
-    }
-
-    /// Ends the page. Some producers draw text twice, the copy for an outline, shadow or
-    /// glow, and mark only one drawing with `/ActualText` (Canva). The unmarked redraw of a
-    /// replacement's glyphs (the same text at the same places, in content order) takes the same
-    /// replacement, so the two read alike and line layout drops the copy as a redraw.
-    fn finish(&mut self) {
-        self.end_actual_text();
-        if self.replaced.is_empty() {
-            return;
-        }
-        let mut taken = vec![false; self.glyphs.len()];
-        for at in self.replaced.iter().filter_map(|r| r.at) {
-            if let Some(t) = taken.get_mut(at) {
-                *t = true;
-            }
-        }
-        let mut grid: HashMap<(i64, i64), Vec<usize>> = HashMap::new();
-        for (i, g) in self.glyphs.iter().enumerate() {
-            if !taken.get(i).copied().unwrap_or(true) {
-                grid.entry((cell(g.2.rect[0]), cell(g.2.rect[1]))).or_default().push(i);
-            }
-        }
-        // Redraws found: the glyph range and the replacement standing for it.
-        let mut redraws: Vec<(std::ops::Range<usize>, usize)> = Vec::new();
-        let mut budget = MAX_REDRAW_WORK;
-        'replacements: for (k, r) in self.replaced.iter().enumerate() {
-            let Some((_, rect)) = r.originals.first() else { continue };
-            let tol = redraw_tolerance(rect);
-            let (x0, x1, y0, y1) = (cell(rect[0] - tol), cell(rect[0] + tol), cell(rect[1] - tol), cell(rect[1] + tol));
-            if x1.saturating_sub(x0).saturating_add(1).saturating_mul(y1.saturating_sub(y0).saturating_add(1)) > MAX_CELLS {
-                continue;
-            }
-            // Checking one candidate walks its run twice (free, then same).
-            let candidate_cost = r.originals.len().saturating_mul(2).saturating_add(1);
-            for key in (x0..=x1).flat_map(|x| (y0..=y1).map(move |y| (x, y))) {
-                let Some(rest) = budget.checked_sub(1) else { break 'replacements };
-                budget = rest;
-                for &i in grid.get(&key).map_or(&[][..], Vec::as_slice) {
-                    let Some(rest) = budget.checked_sub(candidate_cost) else { break 'replacements };
-                    budget = rest;
-                    let Some(range) = i.checked_add(r.originals.len()).map(|end| i..end) else { continue };
-                    let Some(run) = self.glyphs.get(range.clone()) else { continue };
-                    let free = taken.get(range.clone()).is_some_and(|t| t.iter().all(|t| !t));
-                    let same = run.iter().zip(&r.originals).all(|(g, (text, o))| {
-                        let tol = redraw_tolerance(o);
-                        g.2.text == *text && (g.2.rect[0] - o[0]).abs() < tol && (g.2.rect[1] - o[1]).abs() < tol
-                    });
-                    if free && same {
-                        if let Some(t) = taken.get_mut(range.clone()) {
-                            t.fill(true);
-                        }
-                        redraws.push((range, k));
-                    }
-                }
-            }
-        }
-        if redraws.is_empty() {
-            return;
-        }
-        redraws.sort_by_key(|(range, _)| range.start);
-        let glyphs = std::mem::take(&mut self.glyphs);
-        let mut redraws = redraws.into_iter().peekable();
-        let mut text_left = MAX_REDRAW_TEXT;
-        let mut i = 0;
-        while let Some(g) = glyphs.get(i) {
-            let Some((range, k)) = redraws.next_if(|(range, _)| range.start == i) else {
-                self.glyphs.push(g.clone());
-                i += 1;
-                continue;
-            };
-            let run = glyphs.get(range.clone()).unwrap_or_default();
-            let replacement = self.replaced.get(k).map_or("", |r| r.text.as_str());
-            // Each redraw takes its own copy of the replacement, and one long replacement can
-            // have many redraws: past the budget a redraw keeps its glyphs, as past the work budget.
-            let Some(left) = text_left.checked_sub(replacement.len()) else {
-                self.glyphs.extend_from_slice(run);
-                i = range.end.max(i + 1);
-                continue;
-            };
-            text_left = left;
-            let text = replacement.to_owned();
-            #[cfg(test)]
-            REDRAW_TEXT_BYTES.with(|c| c.set(c.get() + text.len()));
-            if !text.chars().all(char::is_control) {
-                match merge(run, text) {
-                    Some(glyph) => self.glyphs.push(glyph),
-                    None => self.glyphs.extend_from_slice(run),
-                }
-            }
-            i = range.end.max(i + 1);
-        }
-    }
-}
-
-/// Whether `PDFCRAFT_TEXT_DEBUG` is set. `draw_glyph` runs once per glyph and `getenv` scans the
-/// whole environment under a lock, so read it once.
-fn text_debug() -> bool {
-    static DEBUG: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
-    *DEBUG.get_or_init(|| std::env::var_os("PDFCRAFT_TEXT_DEBUG").is_some())
-}
-
-impl<'a> Device<'a> for TextDevice {
-    fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
-    fn set_blend_mode(&mut self, _: BlendMode) {}
-    fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'a>, _: &PathDrawMode) {}
-    fn push_clip_path(&mut self, _: &ClipPath) {}
-    fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
-    fn draw_glyph(&mut self, glyph: &Glyph<'a>, transform: Affine, glyph_transform: Affine, _: &Paint<'a>, mode: &GlyphDrawMode) {
-        if self.excluded_depth.is_some() || (self.filter.images && matches!(mode, GlyphDrawMode::Invisible)) {
-            self.actual_filtered |= self.actual.is_some();
-            return;
-        }
-        // Inside an `/ActualText` replacement only the glyph's box matters.
-        let replaced = self.actual.is_some();
-        let text = match glyph.as_unicode() {
-            Some(hayro::hayro_interpret::hayro_cmap::BfString::Char(c)) => c.to_string(),
-            Some(hayro::hayro_interpret::hayro_cmap::BfString::String(s)) => s,
-            None if replaced => String::new(),
-            None => {
-                if text_debug() {
-                    eprintln!(
-                        "NOUNICODE {} {:?}",
-                        if matches!(glyph, Glyph::Type3(_)) { "t3" } else { "ol" },
-                        (transform * glyph_transform).as_coeffs()
-                    );
-                }
-                return;
-            }
-        };
-        if !replaced && text.chars().all(char::is_control) {
-            return;
-        }
-        // Glyph space → view space. Glyph space uses 1000 units per em for outline glyphs; the em
-        // box spans descender (−200) to ascender (800), the advance gives the width.
-        let t = transform * glyph_transform;
-        if text_debug() {
-            let kind = if matches!(glyph, Glyph::Type3(_)) { "t3" } else { "ol" };
-            eprintln!("{kind} {text:?} transform={:?} glyph_transform={:?}", transform.as_coeffs(), glyph_transform.as_coeffs());
-        }
-        let advance = match glyph {
-            Glyph::Outline(g) => {
-                g.advance_width().filter(|a| *a > 0.0).map(f64::from).unwrap_or_else(|| g.outline().bounding_box().width().max(500.0))
-            }
-            Glyph::Type3(g) => g.advance_width().filter(|a| a.is_finite() && *a > 0.0).map(f64::from).unwrap_or(600.0),
-        };
-        // The baseline direction in view space (y down).
-        let coefficients = t.as_coeffs();
-        let (dx, dy) = if matches!(glyph, Glyph::Outline(g) if g.is_vertical()) {
-            // PDF vertical fonts advance along negative glyph-space y (WMode 1), while
-            // keeping the glyph outline upright. Its x axis is not the writing direction.
-            (-coefficients[2], -coefficients[3])
-        } else {
-            (coefficients[0], coefficients[1])
-        };
-        let dir = if dx.abs() >= dy.abs() {
-            if dx >= 0.0 { 0 } else { 2 }
-        } else if dy > 0.0 {
-            1
-        } else {
-            3
-        };
-        let em = Rect::new(0.0, -200.0, advance, 800.0);
-        let corners = if matches!(glyph, Glyph::Outline(g) if g.is_vertical()) {
-            [(em.x0, em.y1), (em.x0, em.y0), (em.x1, em.y0), (em.x1, em.y1)]
-        } else {
-            [(em.x0, em.y0), (em.x1, em.y0), (em.x1, em.y1), (em.x0, em.y1)]
-        }
-        .map(|(x, y)| t * kurbo::Point::new(x, y));
-        let b = corners.iter().fold(Rect::new(f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY), |b, p| {
-            Rect::new(b.x0.min(p.x), b.y0.min(p.y), b.x1.max(p.x), b.y1.max(p.y))
-        });
-        if !(b.x0.is_finite() && b.y0.is_finite() && b.x1.is_finite() && b.y1.is_finite()) || b.width() > 10_000.0 || b.height() > 10_000.0 {
-            return;
-        }
-        let length = dx.hypot(dy);
-        let direction = if length.is_finite() && length > 0.0 { [dx / length, dy / length] } else { [1.0, 0.0] };
-        // A glyph whose Unicode is several characters (a ligature such as "ffi") stays one glyph
-        // with its own box: the PDF gives no position for the characters inside it.
-        let glyph = TextGlyph {
-            text,
-            rect: [b.x0 as f32, b.y0 as f32, b.x1 as f32, b.y1 as f32],
-            quad: corners.map(|p| [p.x as f32, p.y as f32]),
-            direction: direction.map(|d| d as f32),
-        };
-        match &mut self.actual {
-            Some((_, _, drawn)) => drawn.push((dir, direction, glyph)),
-            None => self.glyphs.push((dir, direction, glyph)),
-        }
-    }
-    fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
-    fn pop_clip_path(&mut self) {}
-    fn pop_transparency_group(&mut self) {}
-    fn begin_marked_content(&mut self, tag: &[u8], mcid: Option<i32>) {
-        self.depth = self.depth.saturating_add(1);
-        if self.excluded_depth.is_none() && self.filter.excludes(tag, mcid) {
-            self.excluded_depth = Some(self.depth);
-        }
-    }
-    fn actual_text(&mut self, text: &[u8]) {
-        // A replacement nested in another is already covered by the outer one.
-        if self.actual.is_none() && self.excluded_depth.is_none() {
-            self.actual = Some((self.depth, pdfcraft_cos::PdfString::literal(text).to_text(), Vec::new()));
-        }
-    }
-    fn end_marked_content(&mut self) {
-        if self.actual.as_ref().is_some_and(|(depth, _, _)| *depth == self.depth) {
-            self.end_actual_text();
-        }
-        if self.excluded_depth == Some(self.depth) {
-            self.excluded_depth = None;
-        }
-        self.depth = self.depth.saturating_sub(1);
-    }
-}
-
-/// Extract the text of one page. Panics inside the interpreter are the caller's to catch.
-pub(crate) fn extract_page(pdf: &Pdf, page: usize, settings: &InterpreterSettings) -> Option<PageText> {
-    extract_page_filtered(pdf, page, settings, TextFilter::default()).ok()
-}
-
-pub(crate) fn extract_page_filtered(pdf: &Pdf, page: usize, settings: &InterpreterSettings, filter: TextFilter) -> Result<PageText, String> {
-    let pages = pdf.pages();
-    let p = pages.get(page).ok_or("the page could not be read")?;
-    let (w, h) = p.render_dimensions();
-    let cache = InterpreterCache::new();
-    // Annotation appearances are included: form-field values and comment text are searchable,
-    // as in Acrobat, and match what other extractors report.
-    let settings = settings.clone();
-    let initial = p.initial_transform(true).to_kurbo();
-    let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, w as f64, h as f64), &cache, p.xref(), settings);
-    let mut dev = TextDevice::new();
-    dev.filter = filter;
-    interpret_page(p, &mut ctx, &mut dev);
-    // A replacement the content never closed ends with the page.
-    dev.finish();
-    if dev.partial_replacement {
-        return Err("a replacement text span mixes included and excluded content; disable the exclusions to count this page".into());
-    }
-    let glyphs = dev.glyphs;
-    // Text on a curved path: glyphs that each continue the previous one's line while the
-    // direction turns. Each such run is one line.
-    let turned = |u: [f64; 2]| u[0].abs().min(u[1].abs()) > DIRECTION_TOLERANCE;
-    let mut in_curve = vec![false; glyphs.len()];
-    // Turned text: curved runs, and straight flows along one writing direction. The two are kept
-    // apart so finding a glyph's direction scans only the directions (a few dozen at most: each
-    // differs from the others by more than the tolerance), not every curved run.
-    let mut curves: Vec<Vec<usize>> = Vec::new();
-    let mut straight: Vec<([f64; 2], Vec<usize>)> = Vec::new();
-    let mut start = 0;
-    for end in 1..=glyphs.len() {
-        if end < glyphs.len() && continues(&glyphs[end - 1], &glyphs[end]) {
-            continue;
-        }
-        let run = &glyphs[start..end];
-        if run.iter().any(|g| turned(g.1)) && run.iter().any(|g| !compatible(run[0].1, g.1)) {
-            in_curve[start..end].fill(true);
-            curves.push((start..end).collect());
-        }
-        start = end;
-    }
-    let mut quarters: [Vec<usize>; 4] = Default::default();
-    for (i, (quarter, u, _)) in glyphs.iter().enumerate() {
-        if in_curve[i] {
-            continue;
-        }
-        if !turned(*u) {
-            if let Some(q) = quarters.get_mut(*quarter) {
-                q.push(i);
-            }
-        } else if let Some((_, ids)) = straight.iter_mut().find(|(d, _)| compatible(*d, *u)) {
-            ids.push(i);
-        } else {
-            straight.push((*u, vec![i]));
-        }
-    }
-    // A horizontal heading must not force a vertical body back into horizontal line grouping.
-    // Group each writing direction independently, then join flows from their topmost position.
-    let upright = |quarters: [Vec<usize>; 4]| {
-        let mut flows: Vec<Flow> = quarters
-            .into_iter()
-            .enumerate()
-            .filter(|(_, ids)| !ids.is_empty())
-            .map(|(quarter, ids)| {
-                let rects = ids.iter().map(|&i| to_upright(glyphs[i].2.rect, quarter as u8, w, h)).collect();
-                arrange_flow(&glyphs, ids, rects, Some(quarter as u8))
-            })
-            .collect();
-        flows.sort_by(|a, b| a.top.total_cmp(&b.top));
-        flows
-    };
-    let flows = upright(quarters);
-    let mut extra: Vec<Flow> = curves
-        .into_iter()
-        .map(|ids| (None, ids))
-        .chain(straight.into_iter().map(|(u, ids)| (Some(u), ids)))
-        .map(|(u, ids)| {
-            let rects = match u {
-                // Turned text is laid out along its own baseline.
-                Some(u) => ids.iter().map(|&i| along_baseline(&glyphs[i].2.quad, u).map(|c| c as f32)).collect(),
-                None => unrolled(ids.iter().map(|&i| &glyphs[i])),
-            };
-            arrange_flow(&glyphs, ids, rects, None)
-        })
-        .collect();
-    // Turned text takes the place in the reading order where laying it out among the nearest
-    // quarter turn's text puts its first glyph.
-    let mut rank = Vec::new();
-    if !extra.is_empty() {
-        rank = vec![usize::MAX; glyphs.len()];
-        let mut nearest: [Vec<usize>; 4] = Default::default();
-        for (i, g) in glyphs.iter().enumerate() {
-            if let Some(q) = nearest.get_mut(g.0) {
-                q.push(i);
-            }
-        }
-        for (r, i) in upright(nearest).into_iter().flat_map(|f| f.ids).enumerate() {
-            rank[i] = r;
-        }
-    }
-    let first = |ids: &[usize]| ids.iter().filter_map(|&i| rank.get(i).copied()).min().unwrap_or(usize::MAX);
-    extra.sort_by_key(|f| first(&f.ids));
-    let mut extra = extra.into_iter().peekable();
-    let mut slots: Vec<Option<TextGlyph>> = glyphs.into_iter().map(|g| Some(g.2)).collect();
-    let mut text = PageText::default();
-    let mut emit = |text: &mut PageText, ids: &[usize], line_of: &[u32], space_before: &[bool], quarter: Option<u8>| {
-        let offset = text.line_of.last().map_or(0, |line| line.saturating_add(1));
-        for ((&i, &line), &space) in ids.iter().zip(line_of).zip(space_before) {
-            let Some(mut g) = slots.get_mut(i).and_then(Option::take) else { continue };
-            if let Some(quarter) = quarter {
-                g.rect = from_upright(to_upright(g.rect, quarter, w, h), quarter, w, h);
-            }
-            text.glyphs.push(g);
-            text.line_of.push(line.saturating_add(offset));
-            text.space_before.push(space);
-        }
-    };
-    for flow in flows {
-        let mut k = 0;
-        while k < flow.ids.len() {
-            let line = flow.line_of[k];
-            let end = flow.line_of[k..].iter().position(|l| *l != line).map_or(flow.ids.len(), |n| k + n);
-            let before = first(&flow.ids[k..end]);
-            while let Some(f) = extra.next_if(|f| first(&f.ids) < before) {
-                emit(&mut text, &f.ids, &f.line_of, &f.space_before, None);
-            }
-            emit(&mut text, &flow.ids[k..end], &vec![0; end - k], &flow.space_before[k..end], flow.quarter);
-            k = end;
-        }
-    }
-    for f in extra {
-        emit(&mut text, &f.ids, &f.line_of, &f.space_before, None);
-    }
-    Ok(text)
-}
-
-/// Glyphs in reading order, as indices into the page's glyphs, with their lines and word gaps.
-struct Flow {
-    /// The top of the flow's topmost glyph in view space.
-    top: f32,
-    /// The quarter turn whose frame the flow was laid out in.
-    quarter: Option<u8>,
-    ids: Vec<usize>,
-    line_of: Vec<u32>,
-    space_before: Vec<bool>,
-}
-
-/// Lay out the page's glyphs `ids`, giving each the box at the same position in `rects`.
-fn arrange_flow(glyphs: &[Drawn], ids: Vec<usize>, rects: Vec<[f32; 4]>, quarter: Option<u8>) -> Flow {
-    let top = ids.iter().filter_map(|&i| glyphs.get(i)).map(|g| g.2.rect[1]).fold(f32::INFINITY, f32::min);
-    let framed: Vec<TextGlyph> = ids.iter().zip(rects).filter_map(|(&i, rect)| glyphs.get(i).map(|g| TextGlyph { rect, ..g.2.clone() })).collect();
-    let (order, line_of, space_before) = arrange(&framed);
-    let ids = order.into_iter().filter_map(|k| ids.get(k).copied()).collect();
-    Flow { top, quarter, ids, line_of, space_before }
-}
-
-/// Boxes for a run of glyphs set along a curve: each glyph's box along its own direction, placed
-/// where the pen moved in the previous glyph's direction. The path straightened out.
-fn unrolled<'g>(run: impl Iterator<Item = &'g Drawn>) -> Vec<[f32; 4]> {
-    let mut pen = [0.0, 0.0];
-    let mut previous: Option<([f64; 2], [f64; 4])> = None;
-    run.map(|(_, u, g)| {
-        let b = along_baseline(&g.quad, *u);
-        if let Some((pu, pb)) = previous {
-            let at = along_baseline(&g.quad, pu);
-            pen = [pen[0] + at[0] - pb[0], pen[1] + (at[1] + at[3] - pb[1] - pb[3]) / 2.0];
-        }
-        previous = Some((*u, b));
-        let half = (b[3] - b[1]) / 2.0;
-        [pen[0], pen[1] - half, pen[0] + b[2] - b[0], pen[1] + half].map(|c| c as f32)
-    })
-    .collect()
-}
-
-/// View-space box → the frame where text runs left to right, for text running `quarter` × 90°
-/// clockwise from that in a `w` × `h` view (1: text runs downwards).
-fn to_upright(r: [f32; 4], quarter: u8, w: f32, h: f32) -> [f32; 4] {
-    let [x0, y0, x1, y1] = r;
-    match quarter {
-        1 => [y0, w - x1, y1, w - x0],
-        2 => [w - x1, h - y1, w - x0, h - y0],
-        3 => [h - y1, x0, h - y0, x1],
-        _ => r,
-    }
-}
-
-/// Whether two writing directions are close enough to share a frame ([`DIRECTION_TOLERANCE`]).
-fn compatible(a: [f64; 2], b: [f64; 2]) -> bool {
-    a[0] * b[0] + a[1] * b[1] > 0.0 && (a[0] * b[1] - a[1] * b[0]).abs() <= DIRECTION_TOLERANCE
-}
-
-/// Whether glyph `g` continues the line of glyph `p` (content order), by the test `layout` uses
-/// for consecutive glyphs, taken in `p`'s own frame. The direction may turn by less than half a
-/// quarter turn, as text set along a curve does.
-fn continues(p: &Drawn, g: &Drawn) -> bool {
-    let (pu, gu) = (p.1, g.1);
-    if (pu[0] * gu[1] - pu[1] * gu[0]).abs() >= pu[0] * gu[0] + pu[1] * gu[1] {
-        return false;
-    }
-    let (pb, gb, own) = (along_baseline(&p.2.quad, pu), along_baseline(&g.2.quad, pu), along_baseline(&g.2.quad, gu));
-    let h = (pb[3] - pb[1]).min(own[3] - own[1]).max(0.1);
-    let cy = |b: [f64; 4]| (b[1] + b[3]) / 2.0;
-    (cy(gb) - cy(pb)).abs() < h * 0.5 && gb[0] - pb[2] < h * 3.0 && gb[0] > pb[0] - h * 2.0
-}
-
-/// A view-space quad → its box in the frame where `u` runs left to right and `u` turned a
-/// quarter clockwise runs downwards. Along `u` it spans the middles of the quad's start and end
-/// sides, so a skewed glyph is no wider than its advance; across, it spans every corner.
-fn along_baseline(quad: &[[f32; 2]; 4], u: [f64; 2]) -> [f64; 4] {
-    let p = quad.map(|[x, y]| [f64::from(x) * u[0] + f64::from(y) * u[1], f64::from(y) * u[0] - f64::from(x) * u[1]]);
-    let (a0, a1) = ((p[0][0] + p[3][0]) / 2.0, (p[1][0] + p[2][0]) / 2.0);
-    let (c0, c1) = p.iter().fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), q| (lo.min(q[1]), hi.max(q[1])));
-    [a0.min(a1), c0, a0.max(a1), c1]
-}
-
-/// The inverse of [`to_upright`].
-fn from_upright(r: [f32; 4], quarter: u8, w: f32, h: f32) -> [f32; 4] {
-    let [u0, v0, u1, v1] = r;
-    match quarter {
-        1 => [w - v1, u0, w - v0, u1],
-        2 => [w - u1, h - v1, w - u0, h - v0],
-        3 => [v0, h - u1, v1, h - u0],
-        _ => r,
-    }
-}
-
 use hayro::hayro_interpret::TransformExt;
 
-fn is_rtl(c: char) -> bool {
-    matches!(c as u32, 0x0590..=0x08FF | 0xFB1D..=0xFDFF | 0xFE70..=0xFEFF | 0x10800..=0x10FFF | 0x1E800..=0x1EFFF)
-}
+mod device;
+mod layout;
+mod order;
 
-/// Scripts written with explicit spaces whose combining signs can sit apart from their base
-/// (Indic, Thai, Lao, Myanmar, Khmer): never infer a space inside a tight cluster.
-fn is_complex(c: char) -> bool {
-    matches!(c as u32, 0x0300..=0x036F | 0x0900..=0x0DFF | 0x0E00..=0x0EFF | 0x1000..=0x109F | 0x1780..=0x17FF)
-}
-
-fn is_cjk(c: char) -> bool {
-    matches!(c as u32, 0x2E80..=0x9FFF | 0xAC00..=0xD7AF | 0xF900..=0xFAFF | 0xFF00..=0xFFEF | 0x20000..=0x3134F | 0x1100..=0x11FF)
-}
-
-/// Glyphs `start..end` of the glyph list [`arrange`] lays out, drawn one after another.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-struct Run {
-    start: usize,
-    end: usize,
-}
-
-impl Run {
-    fn len(self) -> usize {
-        self.end.saturating_sub(self.start)
-    }
-
-    fn range(self) -> std::ops::Range<usize> {
-        self.start..self.end
-    }
-}
-
-/// Marks an absent link in a union-find or run list.
-const NONE: usize = usize::MAX;
-
-/// A segment: runs drawn on one baseline, placed together. Its glyph order is worked out when it is emitted, so a
-/// segment holds run ranges and geometry only.
-struct Seg {
-    /// The first run. Merged segments keep their other runs in `extra`.
-    first: Run,
-    /// The other runs of a merged segment. Boxed, and absent for most segments.
-    extra: Option<Box<SegExtra>>,
-    bbox: [f32; 4],
-    h: f32,
-}
-
-#[derive(Default)]
-struct SegExtra {
-    more: Vec<Run>,
-}
-
-impl Seg {
-    fn new(first: Run, bbox: [f32; 4], h: f32) -> Self {
-        Seg { first, extra: None, bbox, h }
-    }
-
-    fn cy(&self) -> f32 {
-        (self.bbox[1] + self.bbox[3]) / 2.0
-    }
-
-    fn runs(&self) -> impl Iterator<Item = Run> + '_ {
-        std::iter::once(self.first).chain(self.extra.iter().flat_map(|e| e.more.iter().copied()))
-    }
-
-    fn merge(&mut self, other: Seg) {
-        union(&mut self.bbox, &other.bbox);
-        self.h = self.h.max(other.h);
-        let extra = self.extra.get_or_insert_with(Default::default);
-        extra.more.push(other.first);
-        if let Some(o) = other.extra {
-            extra.more.extend(o.more);
-        }
-    }
-}
-
-/// Two glyphs of different runs that overlap by more than this fraction of the line height collide.
-const RUN_COLLISION: f32 = 0.25;
-/// A run that starts inside the runs before it by more than this fraction of the line height starts a new word.
-const RUN_OVERLAP_SPACE: f32 = 0.5;
-/// Earlier runs with the same key that a run is checked against for a redraw, newest first. A run past this limit is kept,
-/// so a page costs at most this many checks per run, however many runs share a key.
-const REDRAW_CANDIDATES: usize = 32;
-/// Pair tests that the collision sweep may make per glyph of a segment. Ordinary text overlaps each glyph with about one
-/// neighbour, so it stays far below this. A segment that needs more is dense, and [`collide`] joins its runs instead.
-const COLLIDE_PAIRS_PER_GLYPH: usize = 16;
-/// Glyph positions within a fifth of their height are considered the same for redraws.
-const REDRAW_POSITION_TOLERANCE: f32 = 0.2;
-/// A reset needs three matching glyphs at the start of the run, keeping local kerning from splitting it.
-const REDRAW_PREFIX_GLYPHS: usize = 3;
-
-/// Reusable buffers, so a page allocates them once rather than per segment. Glyph placement works in them, one
-/// segment at a time, when the segment is emitted.
-#[derive(Default)]
-struct Scratch {
-    /// The glyphs of the text runs, each with its run, in x order.
-    owner: Vec<(usize, usize)>,
-    /// The text runs of the segment (runs that are not all zero-width).
-    text: Vec<Run>,
-    /// The glyphs of the zero-width runs, in run order.
-    marks: Vec<usize>,
-    /// Union-find parents over `text`, and for each root the list of its runs through `next`.
-    parent: Vec<usize>,
-    head: Vec<usize>,
-    next: Vec<usize>,
-    /// The runs of one colliding component, by left edge.
-    rows: Vec<Row>,
-    /// The glyphs of one colliding component: each run's glyphs in x order, in run order.
-    group: Vec<usize>,
-    /// The units to place, and their glyphs in `flat`.
-    units: Vec<Unit>,
-    flat: Vec<usize>,
-    /// The current segment's glyphs in visual reading order, and its forced word breaks.
-    placed: Vec<usize>,
-    breaks: Vec<usize>,
-    /// The gaps between the current segment's glyphs, and its glyphs in logical order when it has right-to-left text.
-    gaps: Vec<f32>,
-    logical: Vec<usize>,
-    /// `placed` with the marks merged in, built before it is swapped in.
-    merged: Vec<usize>,
-}
-
-/// One run of a colliding component.
-struct Row {
-    left: f32,
-    right: f32,
-    /// The run's first glyph in content order, which is its smallest index.
-    first: usize,
-    /// The run's glyph with the smallest x, where a word break is recorded.
-    lead: usize,
-    /// The run's glyphs in `Scratch::group`.
-    glyphs: std::ops::Range<usize>,
-}
-
-/// A part of a segment placed as one: a free glyph, or a colliding component.
-struct Unit {
-    left: f32,
-    first: usize,
-    /// The unit's glyphs in `Scratch::flat`.
-    glyphs: std::ops::Range<usize>,
-}
-
-fn union_find(parent: &mut [usize], mut r: usize) -> usize {
-    while parent[r] != r {
-        parent[r] = parent[parent[r]];
-        r = parent[r];
-    }
-    r
-}
-
-/// A 64-bit fingerprint of a run's glyph texts. Each text is hashed with its length, so ["ab", "c"] and
-/// ["a", "bc"] differ. Equal fingerprints are only candidates: `redraws` decides.
-fn fingerprint(glyphs: &[&TextGlyph], run: Run) -> u64 {
-    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
-    for g in run.range().filter_map(|i| glyphs.get(i)) {
-        for b in (g.text.len() as u64).to_le_bytes().into_iter().chain(g.text.bytes()) {
-            h = (h ^ u64::from(b)).wrapping_mul(0x0000_0100_0000_01b3);
-        }
-    }
-    h
-}
-
-/// Whether run `b` redraws run `a` glyph for glyph: the same text, each glyph within a fifth of its
-/// height of the same glyph in `a`.
-fn redraws(glyphs: &[&TextGlyph], a: Run, b: Run) -> bool {
-    a.len() == b.len()
-        && a.range().zip(b.range()).all(|(i, j)| match (glyphs.get(i), glyphs.get(j)) {
-            (Some(p), Some(g)) => {
-                let tol = REDRAW_POSITION_TOLERANCE * (g.rect[3] - g.rect[1]).max(0.1);
-                p.text == g.text && (p.rect[0] - g.rect[0]).abs() < tol && (p.rect[1] - g.rect[1]).abs() < tol
-            }
-            _ => false,
-        })
-}
-
-fn within_position_tolerance(a: f32, b: f32, tolerance: f32) -> bool {
-    (a - b).abs().partial_cmp(&tolerance) == Some(std::cmp::Ordering::Less)
-}
-
-/// Whether `next` restarts `start` after the run has advanced by a glyph height. The fixed prefix
-/// bounds this check and requires more than a single backward adjustment to split a run.
-fn restarts_run(glyphs: &[&TextGlyph], start: usize, next: usize, progress: f32) -> bool {
-    let (Some(first), Some(candidate)) = (glyphs.get(start), glyphs.get(next)) else { return false };
-    let tol = REDRAW_POSITION_TOLERANCE * (candidate.rect[3] - candidate.rect[1]).max(0.1);
-    if first.text != candidate.text
-        || !within_position_tolerance(first.rect[0], candidate.rect[0], tol)
-        || !within_position_tolerance(first.rect[1], candidate.rect[1], tol)
-    {
-        return false;
-    }
-    let h = (first.rect[3] - first.rect[1]).max(0.1);
-    if !progress.is_finite() || progress <= h {
-        return false;
-    }
-    for offset in 1..REDRAW_PREFIX_GLYPHS {
-        let (Some(a), Some(b)) = (start.checked_add(offset).and_then(|i| glyphs.get(i)), next.checked_add(offset).and_then(|i| glyphs.get(i))) else {
-            return false;
-        };
-        let tol = REDRAW_POSITION_TOLERANCE * (b.rect[3] - b.rect[1]).max(0.1);
-        if a.text != b.text || !within_position_tolerance(a.rect[0], b.rect[0], tol) || !within_position_tolerance(a.rect[1], b.rect[1], tol) {
-            return false;
-        }
-    }
-    true
-}
-
-/// Puts a segment's glyphs in visual reading order into `sc.placed`, and its forced word breaks into `sc.breaks`.
-///
-/// Glyphs are placed by x. Runs that collide, meaning that glyphs of different runs overprint each other, stay whole
-/// and are placed by their left edge. Runs that only interleave along the line, such as symbols between letters, keep
-/// their glyph-by-glyph order, so the common case is one sort. A run of zero-width glyphs (a combining mark) has no
-/// extent of its own, so it goes next to the glyph it starts at.
-fn place_glyphs(glyphs: &[&TextGlyph], height: &dyn Fn(usize) -> f32, s: &Seg, sc: &mut Scratch) {
-    let x0 = |i: usize| glyphs[i].rect[0];
-    let zero_width = |i: usize| glyphs[i].rect[2] - glyphs[i].rect[0] <= 0.05 * height(i);
-    sc.text.clear();
-    sc.marks.clear();
-    sc.placed.clear();
-    sc.breaks.clear();
-    for run in s.runs() {
-        if run.range().all(&zero_width) {
-            sc.marks.extend(run.range());
-        } else {
-            sc.text.push(run);
-        }
-    }
-    if sc.text.len() <= 1 {
-        // A single run cannot collide with itself: its glyphs only need sorting by x.
-        sc.placed.extend(sc.text.iter().flat_map(|run| run.range()));
-        sc.placed.sort_unstable_by(|a, b| x0(*a).total_cmp(&x0(*b)).then(a.cmp(b)));
-    } else {
-        collide(glyphs, height, s.h, sc);
-    }
-    // Each mark goes before the first placed glyph whose x is greater than its own. Marks are visited in x order, and
-    // that position never moves back, so one pass over `placed` puts all of them in.
-    sc.marks.sort_by(|a, b| x0(*a).total_cmp(&x0(*b)));
-    if !sc.marks.is_empty() {
-        sc.merged.clear();
-        let mut next = 0;
-        for &m in &sc.marks {
-            while next < sc.placed.len() && x0(sc.placed[next]) <= x0(m) {
-                sc.merged.push(sc.placed[next]);
-                next += 1;
-            }
-            sc.merged.push(m);
-        }
-        sc.merged.extend_from_slice(&sc.placed[next..]);
-        std::mem::swap(&mut sc.placed, &mut sc.merged);
-    }
-}
-
-/// `place_glyphs` for a segment of two or more text runs. `h` is the segment's line height. Returns whether the segment
-/// was too dense to sweep ([`COLLIDE_PAIRS_PER_GLYPH`]), in which case all its text runs form one component.
-///
-/// The sweep tests each glyph against the glyphs after it that start before its right edge. Its work is bounded by the
-/// budget, so a page costs O(glyphs) pair tests plus the sorts. A dense segment is joined with one pass over its runs,
-/// which keeps each run whole. It may keep runs whole that do not overprint, but never interleaves overprinted glyphs.
-fn collide(glyphs: &[&TextGlyph], height: &dyn Fn(usize) -> f32, h: f32, sc: &mut Scratch) -> bool {
-    let x0 = |i: usize| glyphs[i].rect[0];
-    let runs = sc.text.len();
-    sc.owner.clear();
-    for (r, run) in sc.text.iter().enumerate() {
-        sc.owner.extend(run.range().map(|i| (i, r)));
-    }
-    sc.owner.sort_unstable_by(|a, b| x0(a.0).total_cmp(&x0(b.0)).then(a.0.cmp(&b.0)));
-    sc.parent.clear();
-    sc.parent.extend(0..runs);
-    let mut budget = COLLIDE_PAIRS_PER_GLYPH.saturating_mul(sc.owner.len());
-    let mut collided = false;
-    let mut dense = false;
-    'sweep: for a in 0..sc.owner.len() {
-        let (i, ri) = sc.owner[a];
-        let (x1, hi) = (glyphs[i].rect[2], height(i));
-        for b in a + 1..sc.owner.len() {
-            let (j, rj) = sc.owner[b];
-            if x0(j) >= x1 {
-                break;
-            }
-            if budget == 0 {
-                dense = true;
-                break 'sweep;
-            }
-            budget -= 1;
-            let (ra, rb) = (union_find(&mut sc.parent, ri), union_find(&mut sc.parent, rj));
-            let overlap = x1.min(glyphs[j].rect[2]) - x0(j);
-            if ra != rb && overlap > RUN_COLLISION * hi.min(height(j)) {
-                sc.parent[ra] = rb;
-                collided = true;
-            }
-        }
-    }
-    if dense {
-        // Run 0 is its own root, so every run now has it as its root.
-        sc.parent.iter_mut().for_each(|p| *p = 0);
-        collided = true;
-    }
-    if !collided {
-        sc.placed.extend(sc.owner.iter().map(|&(i, _)| i));
-        return dense;
-    }
-
-    // Link each component's runs, so they can be walked without a map.
-    sc.head.clear();
-    sc.head.resize(runs, NONE);
-    sc.next.clear();
-    sc.next.resize(runs, NONE);
-    for r in 0..runs {
-        let root = union_find(&mut sc.parent, r);
-        sc.next[r] = sc.head[root];
-        sc.head[root] = r;
-    }
-    sc.units.clear();
-    sc.flat.clear();
-    for root in 0..runs {
-        if union_find(&mut sc.parent, root) != root {
-            continue;
-        }
-        let head = sc.head[root];
-        if sc.next[head] == NONE {
-            // A run that collides with nothing is placed glyph by glyph.
-            for i in sc.text[head].range() {
-                let at = sc.flat.len();
-                sc.flat.push(i);
-                sc.units.push(Unit { left: x0(i), first: i, glyphs: at..at + 1 });
-            }
-            continue;
-        }
-        sc.rows.clear();
-        sc.group.clear();
-        let mut m = head;
-        while m != NONE {
-            let run = sc.text[m];
-            let start = sc.group.len();
-            sc.group.extend(run.range());
-            sc.group[start..].sort_unstable_by(|a, b| x0(*a).total_cmp(&x0(*b)).then(a.cmp(b)));
-            let left = sc.group[start..].iter().map(|&i| x0(i)).fold(f32::INFINITY, f32::min);
-            let right = sc.group[start..].iter().map(|&i| glyphs[i].rect[2]).fold(f32::NEG_INFINITY, f32::max);
-            let lead = sc.group[start];
-            sc.rows.push(Row { left, right, first: run.start, lead, glyphs: start..sc.group.len() });
-            m = sc.next[m];
-        }
-        sc.rows.sort_unstable_by(|a, b| a.left.total_cmp(&b.left).then(a.first.cmp(&b.first)));
-        let start = sc.flat.len();
-        let mut reach = f32::NEG_INFINITY;
-        for row in &sc.rows {
-            if row.left < reach - h * RUN_OVERLAP_SPACE {
-                sc.breaks.push(row.lead);
-            }
-            reach = reach.max(row.right);
-            sc.flat.extend_from_slice(&sc.group[row.glyphs.clone()]);
-        }
-        let left = sc.rows.iter().map(|r| r.left).fold(f32::INFINITY, f32::min);
-        let first = sc.rows.iter().map(|r| r.first).min().unwrap_or(0);
-        sc.units.push(Unit { left, first, glyphs: start..sc.flat.len() });
-    }
-    sc.units.sort_unstable_by(|a, b| a.left.total_cmp(&b.left).then(a.first.cmp(&b.first)));
-    for unit in &sc.units {
-        sc.placed.extend_from_slice(&sc.flat[unit.glyphs.clone()]);
-    }
-    // Sorted, so that each glyph's membership is a binary search rather than a scan of the breaks.
-    sc.breaks.sort_unstable();
-    dense
-}
-
-/// Simplified bidi class of a glyph or word gap (UAX #9: strong L/R, numbers, neutrals).
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum Bidi {
-    L,
-    R,
-    Num,
-    N,
-}
-
-fn bidi_class(text: &str) -> Bidi {
-    if text.chars().any(|c| is_rtl(c) && !c.is_numeric()) {
-        Bidi::R
-    } else if text.chars().any(char::is_numeric) {
-        Bidi::Num
-    } else if text.chars().any(char::is_alphabetic) {
-        Bidi::L
-    } else {
-        Bidi::N
-    }
-}
-
-/// Reorders a line of `idx` from visual to logical order with a simplified bidi level pass (#2667), carrying the
-/// word gaps along: `spaces[w]` is a gap left of `idx[w]` (#1062). The paragraph is right-to-left when it has
-/// more right-to-left than left-to-right glyphs; numbers keep their left-to-right order, and neutrals
-/// (punctuation, gaps) take the direction of their neighbours, or the paragraph's between opposite ones.
-fn reverse_rtl(glyphs: &[&TextGlyph], idx: &mut [usize], spaces: &mut [bool]) {
-    // Glyphs and word gaps (None) in visual order.
-    let mut items: Vec<(Option<usize>, Bidi)> = Vec::with_capacity(idx.len() * 2);
-    for (w, &i) in idx.iter().enumerate() {
-        if w > 0 && spaces.get(w).copied().unwrap_or(false) {
-            items.push((None, Bidi::N));
-        }
-        items.push((Some(i), bidi_class(&glyphs[i].text)));
-    }
-    let texts: Vec<&str> = items.iter().map(|it| it.0.map_or("", |i| glyphs[i].text.as_str())).collect();
-    let text = |k: usize| texts.get(k).copied().unwrap_or("");
-    let count = |b: Bidi| items.iter().filter(|it| it.1 == b).count();
-    let para = if count(Bidi::R) > count(Bidi::L) { Bidi::R } else { Bidi::L };
-    let n = items.len();
-    // W4: a single separator between two digits belongs to the number.
-    for k in 1..n.saturating_sub(1) {
-        let sep = matches!(text(k), "." | "," | ":" | "/" | "+" | "-" | "\u{066B}" | "\u{066C}");
-        if sep && items[k - 1].1 == Bidi::Num && items[k + 1].1 == Bidi::Num {
-            items[k].1 = Bidi::Num;
-        }
-    }
-    // W5: terminators (percent, currency) next to a number belong to it.
-    let term =
-        |s: &str| !s.is_empty() && s.chars().all(|c| matches!(c, '%' | '‰' | '#' | '$' | '¢'..='¥' | '°' | '\u{066A}' | '\u{20A0}'..='\u{20CF}'));
-    for k in 1..n {
-        if items[k].1 == Bidi::N && items[k - 1].1 == Bidi::Num && term(text(k)) {
-            items[k].1 = Bidi::Num;
-        }
-    }
-    for k in (0..n.saturating_sub(1)).rev() {
-        if items[k].1 == Bidi::N && items[k + 1].1 == Bidi::Num && term(text(k)) {
-            items[k].1 = Bidi::Num;
-        }
-    }
-    // W7: a number after left-to-right text (or at the start of a left-to-right paragraph) is left-to-right.
-    let mut strong = para;
-    for it in &mut items {
-        match it.1 {
-            Bidi::L | Bidi::R => strong = it.1,
-            Bidi::Num if strong == Bidi::L => it.1 = Bidi::L,
-            _ => {}
-        }
-    }
-    // N1/N2: neutrals between same-direction text take it (numbers count as right-to-left), else the paragraph's.
-    let dir = |b: Bidi| if b == Bidi::L { Bidi::L } else { Bidi::R };
-    let mut k = 0;
-    while k < n {
-        if items[k].1 != Bidi::N {
-            k += 1;
-            continue;
-        }
-        let mut e = k;
-        while e < n && items[e].1 == Bidi::N {
-            e += 1;
-        }
-        let before = if k == 0 { para } else { dir(items[k - 1].1) };
-        let after = if e == n { para } else { dir(items[e].1) };
-        let resolved = if before == after { before } else { para };
-        for it in &mut items[k..e] {
-            it.1 = resolved;
-        }
-        k = e;
-    }
-    // Levels (I1/I2), then L2: reverse every run at or above each level, highest first.
-    let rtl_para = para == Bidi::R;
-    let levels: Vec<u8> = items
-        .iter()
-        .map(|it| match it.1 {
-            Bidi::R => 1,
-            Bidi::Num => 2,
-            _ if rtl_para => 2,
-            _ => 0,
-        })
-        .collect();
-    let mut order: Vec<usize> = (0..n).collect();
-    for level in (1..=levels.iter().copied().max().unwrap_or(0)).rev() {
-        let mut k = 0;
-        while k < n {
-            if levels[order[k]] < level {
-                k += 1;
-                continue;
-            }
-            let mut e = k;
-            while e < n && levels[order[e]] >= level {
-                e += 1;
-            }
-            order[k..e].reverse();
-            k = e;
-        }
-    }
-    let mut j = 0;
-    let mut gap = false;
-    for &o in &order {
-        match items[o].0 {
-            None => gap = true,
-            Some(i) => {
-                if let (Some(slot), Some(space)) = (idx.get_mut(j), spaces.get_mut(j)) {
-                    *slot = i;
-                    *space = gap && j > 0;
-                }
-                gap = false;
-                j += 1;
-            }
-        }
-    }
-}
-
-fn union(a: &mut [f32; 4], b: &[f32; 4]) {
-    a[0] = a[0].min(b[0]);
-    a[1] = a[1].min(b[1]);
-    a[2] = a[2].max(b[2]);
-    a[3] = a[3].max(b[3]);
-}
-
-/// Reading-order layout. Glyphs are reordered so that `glyphs` is in reading order, lines are
-/// numbered in that order, and word gaps are inferred per line.
-///
-/// Heuristics (documented so they can be tuned and tested; plan/architecture.md §8):
-/// 1. *Segments:* consecutive glyphs (content order) on one baseline with no column-sized gap.
-///    A smaller glyph right next to the previous one (a sub- or superscript) stays in the segment.
-///    Segments on the same baseline that nearly touch are merged (text drawn out of order).
-/// 2. *Blocks:* segments stacked with line-sized gaps and overlapping horizontally.
-/// 3. *Block order:* repeatedly take the top-most remaining block, preferring a block to its left
-///    that overlaps it vertically (so columns read left, then right). A column goes on first (#3658):
-///    the nearest block below the last one, overlapping it horizontally and at most 2.5 heights of
-///    its last line below it, comes next, unless an unread block sits above it in its own span, sits
-///    beside it on its left, or shares its first line (the first lines overlap by at least 30% of the
-///    taller one: a table or form row, which reads across, even with labels and values in different
-///    sizes or on shifted baselines).
-///    Known limit: when a paragraph in the next column starts on the same line as the continuation
-///    (text on a baseline grid), it counts as a row and the top-most rule applies, so the column
-///    order of #3658 is lost there. Telling prose from a row in that case needs more evidence.
-/// 4. Within a segment glyphs run left to right; runs of right-to-left script are reversed so the
-///    text comes out in logical order.
-pub fn layout(glyphs: Vec<TextGlyph>) -> PageText {
-    let (order, line_of, space_before) = arrange(&glyphs);
-    let mut slots: Vec<Option<TextGlyph>> = glyphs.into_iter().map(Some).collect();
-    // Each glyph is emitted exactly once.
-    let glyphs = order.iter().filter_map(|i| slots.get_mut(*i).and_then(Option::take)).collect();
-    PageText { glyphs, line_of, space_before }
-}
-
-/// [`layout`] as the reading order of indices into `glyphs`, with each one's line and word gap.
-fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
-    // Drop "fake bold" duplicates: the same character redrawn at (almost) the same place. A redraw
-    // also overlaps most of its own width: a narrow letter in condensed text (80 Tz and below) sits
-    // closer than a fifth of its height to its double, as the second "l" of "Alle" (#1467), and
-    // OCR layers squeeze words to 20 Tz and below (#2457). Only a zero-width mark, which has no
-    // width to overlap, is matched by its height alone.
-    let mut keep = vec![true; glyphs.len()];
-    for i in 1..glyphs.len() {
-        let g = &glyphs[i];
-        let h = (g.rect[3] - g.rect[1]).max(0.1);
-        let w = g.rect[2] - g.rect[0];
-        let dx = if w > 0.0 { (h * 0.2).min(w * 0.5) } else { h * 0.2 };
-        for j in (i.saturating_sub(4)..i).rev() {
-            let p = &glyphs[j];
-            if keep[j] && p.text == g.text && (p.rect[0] - g.rect[0]).abs() < dx && (p.rect[1] - g.rect[1]).abs() < h * 0.2 {
-                keep[i] = false;
-                break;
-            }
-        }
-    }
-    let kept: Vec<usize> = (0..glyphs.len()).filter(|i| keep[*i]).collect();
-    let glyphs: Vec<&TextGlyph> = kept.iter().map(|i| &glyphs[*i]).collect();
-    let n = glyphs.len();
-    if n == 0 {
-        return Default::default();
-    }
-    let height = |i: usize| (glyphs[i].rect[3] - glyphs[i].rect[1]).max(0.1);
-    let cy = |i: usize| (glyphs[i].rect[1] + glyphs[i].rect[3]) / 2.0;
-
-    // 1. Segments in content order. Every run is a range of consecutive glyphs.
-    let mut segs: Vec<Seg> = Vec::new();
-    let mut run_start_x = 0.0;
-    let mut furthest_progress = 0.0;
-    for i in 0..n {
-        let g = glyphs[i].rect;
-        let cont = segs.last().is_some_and(|s| {
-            let Some(p) = s.first.end.checked_sub(1) else { return false };
-            let ph = height(p).min(height(i));
-            let gap = g[0] - glyphs[p].rect[2];
-            // A sub- or superscript is a smaller glyph on a shifted baseline: its em box centre sits off the line by
-            // more than half its own height, but by less than half the height of the full-size glyph beside it.
-            let centre_limit = if gap.abs() < ph { height(p).max(height(i)) * 0.5 } else { ph * 0.5 };
-            (cy(i) - cy(p)).abs() < centre_limit && gap < ph * 3.0 && g[0] > glyphs[p].rect[0] - ph * 2.0
-        });
-        let reset = cont && segs.last().is_some_and(|s| restarts_run(&glyphs, s.first.start, i, furthest_progress));
-        if cont
-            && !reset
-            && let Some(s) = segs.last_mut()
-        {
-            s.first.end = i + 1;
-            union(&mut s.bbox, &g);
-            s.h = s.h.max(height(i));
-            furthest_progress = furthest_progress.max((g[0] - run_start_x).abs()).max((g[2] - run_start_x).abs());
-        } else {
-            segs.push(Seg::new(Run { start: i, end: i + 1 }, g, height(i)));
-            run_start_x = g[0];
-            furthest_progress = 0.0;
-        }
-    }
-    // A run that redraws an earlier run at the same place (doubled or shadowed text) is dropped, as a doubled glyph is
-    // above. Runs are keyed by a fingerprint of their glyph texts and a grid cell a fifth of a line high. A key leads to
-    // the latest retained run with it, and `older[k]` links each retained run to the previous one with the same key, so
-    // the earlier candidates are checked newest first, up to `REDRAW_CANDIDATES`. Both exist only for this pass.
-    let retained = {
-        let candidates = segs.iter().filter(|s| s.first.len() >= 2).count();
-        let mut latest: HashMap<(u64, i32, i32), usize> = HashMap::with_capacity(candidates);
-        let mut older = vec![NONE; segs.len()];
-        let mut kept_runs = 0;
-        for i in 0..segs.len() {
-            let run = segs[i].first;
-            if run.len() >= 2 {
-                let tol = 0.2 * segs[i].h;
-                let (cx, cy_) = ((glyphs[run.start].rect[0] / tol).floor() as i32, (glyphs[run.start].rect[1] / tol).floor() as i32);
-                let fp = fingerprint(&glyphs, run);
-                let mut checks = REDRAW_CANDIDATES;
-                let twin = (-1..=1i32).any(|dx| {
-                    (-1..=1i32).any(|dy| {
-                        let mut link = latest.get(&(fp, cx.saturating_add(dx), cy_.saturating_add(dy))).copied();
-                        while let Some(k) = link {
-                            let Some(prev) = segs.get(k) else { break };
-                            if checks == 0 {
-                                return false;
-                            }
-                            checks -= 1;
-                            if redraws(&glyphs, prev.first, run) {
-                                return true;
-                            }
-                            link = older.get(k).copied().filter(|&o| o != NONE);
-                        }
-                        false
-                    })
-                });
-                if twin {
-                    continue;
-                }
-                older[kept_runs] = latest.insert((fp, cx, cy_), kept_runs).unwrap_or(NONE);
-            }
-            segs.swap(kept_runs, i);
-            kept_runs += 1;
-        }
-        kept_runs
-    };
-    segs.truncate(retained);
-    // Merge same-baseline segments that nearly touch.
-    let mut merged = true;
-    while merged {
-        merged = false;
-        'outer: for a in 0..segs.len() {
-            for b in 0..segs.len() {
-                if a == b {
-                    continue;
-                }
-                let (sa, sb) = (&segs[a], &segs[b]);
-                let h = sa.h.min(sb.h);
-                let gap = (sb.bbox[0] - sa.bbox[2]).max(sa.bbox[0] - sb.bbox[2]);
-                if (sa.cy() - sb.cy()).abs() < h * 0.3 && (sa.h / sb.h - 1.0).abs() < 0.35 && gap < h * 1.2 {
-                    let sb = segs.remove(b);
-                    let a = if b < a { a - 1 } else { a };
-                    segs[a].merge(sb);
-                    merged = true;
-                    break 'outer;
-                }
-            }
-        }
-    }
-
-    // 2. Blocks.
-    let mut by_top: Vec<usize> = (0..segs.len()).collect();
-    by_top.sort_by(|a, b| segs[*a].bbox[1].total_cmp(&segs[*b].bbox[1]));
-    let mut blocks: Vec<(Vec<usize>, [f32; 4])> = Vec::new();
-    for si in by_top {
-        let s = &segs[si];
-        let target = blocks.iter().position(|(members, bb)| {
-            let Some(&m) = members.last() else { return false };
-            let last = &segs[m];
-            let vgap = s.bbox[1] - last.bbox[3];
-            let overlap = s.bbox[2].min(bb[2]) - s.bbox[0].max(bb[0]);
-            let minw = (s.bbox[2] - s.bbox[0]).min(bb[2] - bb[0]).max(1.0);
-            vgap > -last.h * 0.5 && vgap < last.h.max(s.h) * 1.1 && overlap > minw * 0.3 && (last.h / s.h - 1.0).abs() < 0.6
-        });
-        match target {
-            Some(b) => {
-                blocks[b].0.push(si);
-                let bb = s.bbox;
-                union(&mut blocks[b].1, &bb);
-            }
-            None => blocks.push((vec![si], s.bbox)),
-        }
-    }
-
-    // 3. Block order.
-    let mut remaining: Vec<usize> = (0..blocks.len()).collect();
-    let mut block_order: Vec<usize> = Vec::with_capacity(blocks.len());
-    // A block to the left of `cb` that shares at least half the height of the shorter one: it reads first.
-    let beside_left = |cb: &[f32; 4], lb: &[f32; 4]| {
-        let v = lb[3].min(cb[3]) - lb[1].max(cb[1]);
-        lb[2] <= cb[0] + 1.0 && v > 0.5 * (lb[3] - lb[1]).min(cb[3] - cb[1])
-    };
-    // The box of a block's first line. Every block is created with one segment, so the block's own box is a fallback
-    // that is never used.
-    let first_line = |b: usize| blocks[b].0.first().and_then(|&s| segs.get(s)).map_or(blocks[b].1, |s| s.bbox);
-    while let Some(&top) = remaining.iter().min_by(|a, b| blocks[**a].1[1].total_cmp(&blocks[**b].1[1])) {
-        // A column goes on past a paragraph gap (#3658): the nearest block below the one just read that overlaps it
-        // horizontally comes next, if the gap above it is at most two and a half heights of the last line read (a
-        // footer, a footnote or a caption under a figure is further) and no other unread block
-        // - sits above it in its own horizontal span (the rest of a column above a full-width heading or footnote),
-        // - is beside it on its left, or
-        // - shares its first line: their first lines overlap by at least 30% of the taller one (a table or form row,
-        //   which reads across, even with labels and values in different sizes or on shifted baselines; a line that
-        //   only touches it, or a small superscript or footnote marker, is not a row).
-        let next_in_column = block_order.last().and_then(|&prev| {
-            let pb = blocks[prev].1;
-            // The gap is measured in the height of the block's last line, which borders it.
-            let pl = blocks[prev].0.last().and_then(|&s| segs.get(s)).map_or(pb, |s| s.bbox);
-            let tol = (pl[3] - pl[1]).max(0.1) * 0.5;
-            let c = remaining
-                .iter()
-                .copied()
-                .filter(|&c| {
-                    let cb = blocks[c].1;
-                    let overlap = cb[2].min(pb[2]) - cb[0].max(pb[0]);
-                    let minw = (cb[2] - cb[0]).min(pb[2] - pb[0]).max(1.0);
-                    cb[1] >= pb[3] - tol && overlap > minw * 0.3
-                })
-                .min_by(|a, b| blocks[*a].1[1].total_cmp(&blocks[*b].1[1]))?;
-            let cb = blocks[c].1;
-            if cb[1] - pb[3] >= tol * 5.0 {
-                return None;
-            }
-            let cl = first_line(c);
-            let blocked = remaining.iter().any(|&r| {
-                if r == c {
-                    return false;
-                }
-                let rb = blocks[r].1;
-                let rl = first_line(r);
-                let shared = rl[3].min(cl[3]) - rl[1].max(cl[1]);
-                let row = shared > 0.3 * (rl[3] - rl[1]).max(cl[3] - cl[1]);
-                (rb[1] < cb[1] && rb[2].min(cb[2]) > rb[0].max(cb[0])) || beside_left(&cb, &rb) || row
-            });
-            (!blocked).then_some(c)
-        });
-        let pick = next_in_column.unwrap_or_else(|| {
-            let tb = blocks[top].1;
-            remaining
-                .iter()
-                .copied()
-                .filter(|c| beside_left(&tb, &blocks[*c].1))
-                .min_by(|a, b| blocks[*a].1[0].total_cmp(&blocks[*b].1[0]))
-                .unwrap_or(top)
-        });
-        remaining.retain(|r| *r != pick);
-        block_order.push(pick);
-    }
-
-    // 4. Emit each segment in block order. Its glyphs are placed here, into scratch that every segment reuses, and
-    // appended straight to the output. Blocks and their order use only segment boxes, so placement can wait until now.
-    let mut order: Vec<usize> = Vec::with_capacity(n);
-    let mut line_of: Vec<u32> = Vec::with_capacity(n);
-    let mut space_before: Vec<bool> = Vec::with_capacity(n);
-    let mut line = 0u32;
-    let mut sc = Scratch::default();
-    // `spaces[w]`: a word gap left of the w-th glyph of the segment, by position on the line, not by drawing order
-    // (#1062). Reused by every segment.
-    let mut spaces: Vec<bool> = Vec::new();
-    for b in block_order {
-        for &si in &blocks[b].0 {
-            place_glyphs(&glyphs, &height, &segs[si], &mut sc);
-            let h = segs[si].h;
-            // Word gaps relative to this line's typical letter gap (handles tracking).
-            // Long runs of repeated punctuation belong to leaders, not letter tracking: a TOC leader
-            // must not raise the threshold above the word gaps in its title (#3086).
-            sc.gaps.clear();
-            sc.gaps.extend(sc.placed.windows(2).enumerate().filter_map(|(w, pair)| {
-                let &[p, c] = pair else { return None };
-                let (p, c) = (glyphs.get(p)?, glyphs.get(c)?);
-                if p.text == c.text && p.text.chars().all(|ch| !ch.is_alphanumeric() && !ch.is_whitespace()) {
-                    // Keep short tracked punctuation, including an ellipsis with a final period.
-                    // Treat five or more matching glyphs as a leader. Three neighbours on each
-                    // side suffice to classify this pair, bounding work even on long runs.
-                    let same = |&&i: &&usize| glyphs.get(i).is_some_and(|g| g.text == p.text);
-                    let before = sc.placed.get(..w).unwrap_or_default().iter().rev().take(3).take_while(same).count();
-                    let after = sc.placed.get(w.saturating_add(2)..).unwrap_or_default().iter().take(3).take_while(same).count();
-                    if before + after >= 3 {
-                        return None;
-                    }
-                }
-                Some(c.rect[0] - p.rect[2])
-            }));
-            sc.gaps.sort_by(f32::total_cmp);
-            let typical = sc.gaps.get(sc.gaps.len() / 3).copied().unwrap_or(0.0).max(0.0);
-            let threshold = (typical + h * WORD_GAP).max(h * WORD_GAP);
-            spaces.clear();
-            spaces.resize(sc.placed.len(), false);
-            for (w, pair) in sc.placed.windows(2).enumerate() {
-                let &[p, c] = pair else { continue };
-                let gap = glyphs[c].rect[0] - glyphs[p].rect[2];
-                let (pt, ct) = (&glyphs[p].text, &glyphs[c].text);
-                let cjk = pt.chars().any(is_cjk) && ct.chars().any(is_cjk) && gap < h * 0.5;
-                let tight_cluster = (pt.chars().any(is_complex) || ct.chars().any(is_complex)) && gap < h * 0.6;
-                let run_start = sc.breaks.binary_search(&c).is_ok();
-                if let Some(space) = spaces.get_mut(w + 1) {
-                    *space = (gap > threshold || run_start) && !cjk && !tight_cluster && !pt.trim().is_empty() && !ct.trim().is_empty();
-                }
-            }
-            // Right-to-left spans are reversed (visual → logical) with their gaps, and only then is a second copy made.
-            let has_rtl = sc.placed.iter().any(|&i| glyphs[i].text.chars().any(is_rtl));
-            if has_rtl {
-                sc.logical.clear();
-                sc.logical.extend_from_slice(&sc.placed);
-                reverse_rtl(&glyphs, &mut sc.logical, &mut spaces);
-            }
-            let idx: &[usize] = if has_rtl { &sc.logical } else { &sc.placed };
-            order.extend_from_slice(idx);
-            line_of.resize(order.len(), line);
-            // `spaces[0]` stays false: the first glyph of a segment never takes a space.
-            space_before.extend(spaces.iter().take(idx.len()));
-            space_before.resize(order.len(), false);
-            line += 1;
-        }
-    }
-    (order.into_iter().map(|i| kept[i]).collect(), line_of, space_before)
-}
+use device::WORD_GAP;
+#[cfg(test)]
+use device::{MAX_REDRAW_TEXT, REDRAW_TEXT_BYTES, Replaced, TextDevice};
+pub(crate) use device::{extract_page, extract_page_filtered};
+pub use layout::layout;
+#[cfg(test)]
+use layout::{from_upright, to_upright};
+use layout::{is_rtl, union};
+#[cfg(test)]
+use order::{Run, Scratch, collide, restarts_run};
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn em_box(text: &str, x0: f32, y0: f32, x1: f32, y1: f32) -> TextGlyph {
-        TextGlyph { text: text.into(), rect: [x0, y0, x1, y1], quad: [[x0, y0], [x1, y0], [x1, y1], [x0, y1]], direction: [1.0, 0.0] }
-    }
-
-    #[test]
-    fn subscript_stays_in_its_word() {
-        // "CO2-E": an 8.1 pt "CO" and "-E", with a 4.7 pt "2" drawn 2.7 pt lower (#3174).
-        let glyphs = vec![
-            em_box("C", 0.0, 92.5, 5.0, 100.6),
-            em_box("O", 5.0, 92.5, 11.0, 100.6),
-            em_box("2", 11.0, 97.9, 13.5, 102.6),
-            em_box("-", 13.5, 92.5, 16.0, 100.6),
-            em_box("E", 16.0, 92.5, 21.0, 100.6),
-        ];
-        assert_eq!(layout(glyphs).plain_text(), "CO2-E");
-    }
-
-    #[test]
-    fn identity_v_columns_are_searchable_in_reading_order() {
-        use lopdf::{Document, Object, Stream, dictionary};
-        for encoding in ["Identity-V", "UniJIS-UCS2-V"] {
-            let mut doc = Document::with_version("1.7");
-            let cmap = b"/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /TestUnicode def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespacerange 5 beginbfchar <0001> <65E5> <0002> <672C> <0003> <8A9E> <0004> <6587> <0005> <7AE0> endbfchar endcmap CMapName currentdict /CMap defineresource pop end end";
-            let cmap = if encoding == "Identity-V" {
-                cmap.to_vec()
-            } else {
-                let mut mapping = String::from_utf8(cmap.to_vec()).unwrap();
-                for (code, unicode) in [("0001", "65E5"), ("0002", "672C"), ("0003", "8A9E"), ("0004", "6587"), ("0005", "7AE0")] {
-                    mapping = mapping.replace(&format!("<{code}> <{unicode}>"), &format!("<{unicode}> <{unicode}>"));
-                }
-                mapping.into_bytes()
-            };
-            let unicode = doc.add_object(Stream::new(dictionary! {}, cmap));
-            let cid = doc.add_object(dictionary! {
-            "Type" => "Font", "Subtype" => "CIDFontType2", "BaseFont" => "TestVertical",
-            "CIDSystemInfo" => dictionary! { "Registry" => Object::string_literal("Adobe"), "Ordering" => Object::string_literal("Identity"), "Supplement" => 0 },
-            "DW" => 1000, "DW2" => vec![Object::Integer(880), Object::Integer(-1000)], "CIDToGIDMap" => "Identity"
-        });
-            let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type0", "BaseFont" => "TestVertical", "Encoding" => encoding, "DescendantFonts" => vec![Object::Reference(cid)], "ToUnicode" => unicode });
-            let horizontal = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type0", "BaseFont" => "TestVertical", "Encoding" => "Identity-H", "DescendantFonts" => vec![Object::Reference(cid)], "ToUnicode" => unicode });
-            let (first, second) = if encoding == "Identity-V" { ("000100020003", "00040005") } else { ("65E5672C8A9E", "65877AE0") };
-            let operators =
-                format!("BT /H1 20 Tf 1 0 0 1 40 280 Tm <{first}> Tj /F1 20 Tf 1 0 0 1 200 250 Tm <{first}> Tj 1 0 0 1 170 250 Tm <{second}> Tj ET");
-            let content = doc.add_object(Stream::new(dictionary! {}, operators.into_bytes()));
-            let pages = doc.new_object_id();
-            let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font, "H1" => horizontal}}, "Contents" => content });
-            doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
-            let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
-            doc.trailer.set("Root", catalog);
-            let mut bytes = Vec::new();
-            doc.save_to(&mut bytes).unwrap();
-            let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
-            let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
-            assert_eq!(text.plain_text(), "日本語\n日本語\n文章");
-            assert_eq!(text.find("日本語"), vec![0..3, 3..6]);
-            assert_eq!(text.find("文章"), vec![6..8]);
-            let rects = text.line_rects(3..6);
-            assert_eq!(rects.len(), 1);
-            assert!(rects[0][3] - rects[0][1] > rects[0][2] - rects[0][0], "a vertical search highlight: {rects:?}");
-            assert!(text.glyphs[3].rect[0] > text.glyphs[6].rect[0], "columns read right to left in page view coordinates");
-        }
-    }
-
-    /// WSCAD writes `/ToUnicode /Identity-H`, a name rather than a CMap stream, on Type 0 fonts
-    /// whose two-byte codes are UTF-16 code units. The codes read as that Unicode text (as in
-    /// Acrobat), so the page's text can be selected and found; before, it had none. Controls (here a
-    /// DEL and a C1 control at the line ends) are not text.
-    #[test]
-    fn identity_to_unicode_names_give_text() {
-        use lopdf::{Document, Object, Stream, dictionary};
-        for name in ["Identity-H", "Identity-V"] {
-            let mut doc = Document::with_version("1.4");
-            let cid = doc.add_object(dictionary! {
-                "Type" => "Font", "Subtype" => "CIDFontType2", "BaseFont" => "RobotoMono-Regular",
-                "CIDSystemInfo" => dictionary! { "Registry" => Object::string_literal("Adobe"), "Ordering" => Object::string_literal("Identity"), "Supplement" => 0 },
-                "DW" => 600, "CIDToGIDMap" => "Identity"
-            });
-            let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type0", "BaseFont" => "RobotoMono-Regular", "Encoding" => "Identity-H", "DescendantFonts" => vec![Object::Reference(cid)], "ToUnicode" => name });
-            let operators = "BT /F1 12 Tf 1 0 0 1 20 250 Tm <004400650063006B0062006C006100740074007F> Tj 1 0 0 1 20 200 Tm <005A00FC0072006900630068002020AC0085> Tj ET";
-            let content = doc.add_object(Stream::new(dictionary! {}, operators.as_bytes().to_vec()));
-            let pages = doc.new_object_id();
-            let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
-            doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
-            let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
-            doc.trailer.set("Root", catalog);
-            let mut bytes = Vec::new();
-            doc.save_to(&mut bytes).unwrap();
-            let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
-            let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
-            assert_eq!(text.plain_text(), "Deckblatt\nZürich €", "{name}");
-            assert_eq!(text.find("zürich"), vec![9..15], "{name}: glyphs 9 to 14");
-        }
-    }
-
-    /// One page per text matrix, each showing `codes` in Helvetica whose `/ToUnicode` maps the
-    /// codes in `unicode` (a `bfchar` body) to several characters.
-    fn ligature_pages(unicode: &str, codes: &str, matrices: &[&str]) -> Pdf {
-        use lopdf::{Document, Object, Stream, dictionary};
-        let mut doc = Document::with_version("1.7");
-        let cmap = format!(
-            "/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /TestLigatures def /CMapType 2 def 1 begincodespacerange <00> <FF> endcodespacerange {unicode} endcmap CMapName currentdict /CMap defineresource pop end end"
-        );
-        let to_unicode = doc.add_object(Stream::new(dictionary! {}, cmap.into_bytes()));
-        let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Helvetica", "ToUnicode" => to_unicode });
-        let pages = doc.new_object_id();
-        let mut kids = Vec::new();
-        for m in matrices {
-            let content = doc.add_object(Stream::new(dictionary! {}, format!("BT /F1 20 Tf {m} Tm ({codes}) Tj ET").into_bytes()));
-            let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
-            kids.push(Object::Reference(page));
-        }
-        let count = kids.len() as i64;
-        doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => kids, "Count" => count}.into());
-        let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
-        doc.trailer.set("Root", catalog);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).unwrap();
-        Pdf::new(std::sync::Arc::new(bytes)).unwrap()
-    }
-
-    #[test]
-    fn a_ligature_is_one_glyph_in_every_writing_direction() {
-        // "o", one glyph for "ffi", "c", "e": "office", turned 0°, 90°, 180° and 270°. The same
-        // codes without the ligature mapping ("oWce") are the control for the glyph box.
-        let turns = ["1 0 0 1 100 150", "0 1 -1 0 150 100", "-1 0 0 -1 200 150", "0 -1 1 0 150 200"];
-        let ligature = ligature_pages("1 beginbfchar <57> <006600660069> endbfchar", "oWce", &turns);
-        let control = ligature_pages("", "oWce", &turns);
-        for (page, turn) in turns.iter().enumerate() {
-            let text = extract_page(&ligature, page, &InterpreterSettings::default()).unwrap();
-            let plain = extract_page(&control, page, &InterpreterSettings::default()).unwrap();
-            assert_eq!(plain.plain_text(), "oWce", "Tm {turn}");
-            assert_eq!(text.plain_text(), "office", "Tm {turn}");
-            assert_eq!(text.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["o", "ffi", "c", "e"], "Tm {turn}");
-            assert_eq!(text.glyphs[1].rect, plain.glyphs[1].rect, "the painted glyph's box, Tm {turn}");
-            assert_eq!(text.find("ffi"), vec![1..2], "Tm {turn}");
-            assert_eq!(text.find("of"), vec![0..2], "a match ending inside the ligature covers it, Tm {turn}");
-            assert_eq!(text.line_rects(0..4).len(), 1, "one line, Tm {turn}");
-        }
-    }
-
-    /// One page per content stream, in Helvetica (`/F1`), with `/P1` in the resources'
-    /// `/Properties` naming the `/ActualText` "fi".
-    fn marked_pages(contents: &[&str]) -> Pdf {
-        use lopdf::{Document, Object, Stream, dictionary};
-        let mut doc = Document::with_version("1.7");
-        let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Helvetica" });
-        let pages = doc.new_object_id();
-        let mut kids = Vec::new();
-        for c in contents {
-            let content = doc.add_object(Stream::new(dictionary! {}, c.as_bytes().to_vec()));
-            let resources = dictionary! {
-                "Font" => dictionary! {"F1" => font},
-                "Properties" => dictionary! {"P1" => dictionary! {"ActualText" => Object::string_literal("fi")}},
-            };
-            let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => resources, "Contents" => content });
-            kids.push(Object::Reference(page));
-        }
-        let count = kids.len() as i64;
-        doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => kids, "Count" => count}.into());
-        let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
-        doc.trailer.set("Root", catalog);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).unwrap();
-        Pdf::new(std::sync::Arc::new(bytes)).unwrap()
-    }
-
-    fn marked_text(pdf: &Pdf, page: usize) -> PageText {
-        extract_page(pdf, page, &InterpreterSettings::default()).unwrap()
-    }
-
-    #[test]
-    fn redraws_of_a_long_replacement_share_a_text_budget() {
-        let long = "0041".repeat(32 * 1024);
-        let redraws = 200;
-        let content = format!(
-            "BT /F1 20 Tf 1 0 0 1 100 150 Tm /Span <</ActualText <FEFF{long}>>> BDC (x) Tj EMC {} ET",
-            "1 0 0 1 100 150 Tm (x) Tj ".repeat(redraws)
-        );
-        let pdf = marked_pages(&[&content]);
-        REDRAW_TEXT_BYTES.with(|c| c.set(0));
-        let text = marked_text(&pdf, 0);
-        let given = REDRAW_TEXT_BYTES.with(|c| c.get());
-        assert!(given <= MAX_REDRAW_TEXT, "{given} bytes of replacement text given to {redraws} redraws");
-        assert!(text.plain_text().starts_with("AAAA"));
-        // A short replacement still covers its redraw.
-        let pdf = marked_pages(&["BT /F1 20 Tf 1 0 0 1 100 150 Tm /Span <</ActualText (fi)>> BDC (x) Tj EMC 1 0 0 1 100 150 Tm (x) Tj ET"]);
-        REDRAW_TEXT_BYTES.with(|c| c.set(0));
-        assert_eq!(marked_text(&pdf, 0).plain_text(), "fi");
-        assert_eq!(REDRAW_TEXT_BYTES.with(|c| c.get()), 2);
-    }
-
-    #[test]
-    fn text_after_an_inline_image_survives_a_non_ascii_byte_before_a_later_ei() {
-        // Everyday content both ways: a string with a byte above 0x7F, and a later word holding
-        // a capital "EI". The end-of-data look-ahead used to read the string's bytes as image
-        // data, so the image swallowed the rest of the page.
-        let pdf = marked_pages(&[
-            "BI /W 1 /H 1 /BPC 8 /CS /DeviceGray ID \0 EI BT /F1 20 Tf 1 0 0 1 20 200 Tm (Gr\u{fc}\u{df}e) Tj 1 0 0 1 20 150 Tm (EINGANG) Tj ET",
-        ]);
-
-        assert!(marked_text(&pdf, 0).plain_text().contains("EINGANG"), "the text after the inline image was not extracted");
-    }
-
-    #[test]
-    fn actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction() {
-        // Chrome marks each shaped Thai cluster this way: "น้ำ" (U+0E19 U+0E49 U+0E33) here stands
-        // for the two glyphs "xy", between "a" and "b". The same codes unmarked are the control.
-        let turns = ["1 0 0 1 100 150", "0 1 -1 0 150 100", "-1 0 0 -1 200 150", "0 -1 1 0 150 200"];
-        let marked: Vec<String> =
-            turns.iter().map(|m| format!("BT /F1 20 Tf {m} Tm (a) Tj /Span <</ActualText <FEFF0E190E490E33>>> BDC (xy) Tj EMC (b) Tj ET")).collect();
-        let plain: Vec<String> = turns.iter().map(|m| format!("BT /F1 20 Tf {m} Tm (axyb) Tj ET")).collect();
-        let marked = marked_pages(&marked.iter().map(String::as_str).collect::<Vec<_>>());
-        let plain = marked_pages(&plain.iter().map(String::as_str).collect::<Vec<_>>());
-        for (page, turn) in turns.iter().enumerate() {
-            let text = marked_text(&marked, page);
-            let control = marked_text(&plain, page);
-            assert_eq!(control.plain_text(), "axyb", "Tm {turn}");
-            assert_eq!(text.plain_text(), "aน้ำb", "Tm {turn}");
-            assert_eq!(text.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["a", "น้ำ", "b"], "Tm {turn}");
-            assert_eq!(text.find("น้ำ"), vec![1..2], "Tm {turn}");
-            assert_eq!(text.line_rects(0..3).len(), 1, "one line, Tm {turn}");
-            // The replacement's box is the union of the boxes of the glyphs it replaces.
-            let (x, y) = (&control.glyphs[1].rect, &control.glyphs[2].rect);
-            let union = [x[0].min(y[0]), x[1].min(y[1]), x[2].max(y[2]), x[3].max(y[3])];
-            for (got, want) in text.glyphs[1].rect.iter().zip(union) {
-                assert!((got - want).abs() < 0.01, "box {:?} ≠ {union:?}, Tm {turn}", text.glyphs[1].rect);
-            }
-            assert_eq!(text.glyphs[1].direction, control.glyphs[1].direction, "Tm {turn}");
-        }
-    }
-
-    #[test]
-    fn redraw_dedupe_work_is_bounded_on_hostile_pages() {
-        // 100,000 replacements and 100,000 unmarked glyphs that never match, all at one spot:
-        // unbounded, every replacement would compare every glyph (10^10 comparisons).
-        const N: usize = 100_000;
-        let glyph = |text: &str| {
-            let quad = [[100.0, 110.0], [110.0, 110.0], [110.0, 100.0], [100.0, 100.0]];
-            (0, [1.0, 0.0], TextGlyph { text: text.into(), rect: [100.0, 100.0, 110.0, 110.0], quad, direction: [1.0, 0.0] })
-        };
-        let mut dev = TextDevice::new();
-        // A genuine redraw first: it is still deduplicated within the budget.
-        dev.glyphs.push(glyph("fi"));
-        dev.glyphs.push(glyph("x"));
-        dev.replaced.push(Replaced { at: Some(0), text: "fi".into(), originals: vec![("x".into(), [100.0, 100.0, 110.0, 110.0])] });
-        dev.glyphs.extend((0..N).map(|_| glyph("y")));
-        for _ in 0..N {
-            dev.glyphs.push(glyph("z"));
-            let at = dev.glyphs.len() - 1;
-            dev.replaced.push(Replaced { at: Some(at), text: "z".into(), originals: vec![("q".into(), [100.0, 100.0, 110.0, 110.0])] });
-        }
-        let started = std::time::Instant::now();
-        dev.finish();
-        assert!(started.elapsed() < std::time::Duration::from_secs(30), "took {:?}", started.elapsed());
-        assert_eq!(dev.glyphs.len(), 2 * N + 2, "unmatched glyphs are kept");
-        assert_eq!(dev.glyphs[1].2.text, "fi", "the redraw found within the budget takes the replacement");
-    }
-
-    #[test]
-    fn actual_text_follows_the_pdf_rules_for_marked_content() {
-        let pdf = marked_pages(&[
-            // Named in the resources' /Properties.
-            "BT /F1 20 Tf 1 0 0 1 100 150 Tm (o) Tj /Span /P1 BDC (W) Tj EMC (ce) Tj ET",
-            // Nested: the outermost replacement covers everything inside it.
-            "BT /F1 20 Tf 1 0 0 1 100 150 Tm /Span <</ActualText (AB)>> BDC /Span <</ActualText (Z)>> BDC (x) Tj EMC (y) Tj EMC ET",
-            // Empty: the marked glyphs stand for no text (a soft hyphen at a line break); the gap
-            // the hyphen leaves still reads as one.
-            "BT /F1 20 Tf 1 0 0 1 100 150 Tm (co) Tj /Span <</ActualText ()>> BDC (-) Tj EMC (op) Tj ET",
-            // Across two lines: each glyph keeps its own text, so selection and lines still work.
-            "BT /F1 20 Tf 1 0 0 1 100 150 Tm /Span <</ActualText (Q)>> BDC (x) Tj 0 -40 Td (y) Tj EMC ET",
-            // Unbalanced: a stray EMC first, and a replacement the page never closes.
-            "EMC BT /F1 20 Tf 1 0 0 1 100 150 Tm (a) Tj /Span <</ActualText (fi)>> BDC (xy) Tj ET",
-            // Marked content without /ActualText changes nothing.
-            "BT /F1 20 Tf 1 0 0 1 100 150 Tm /P <</MCID 0>> BDC (ab) Tj EMC /Artifact BMC (c) Tj EMC ET",
-        ]);
-        let plain: Vec<String> = (0..6).map(|p| marked_text(&pdf, p).plain_text()).collect();
-        assert_eq!(plain, ["ofice", "AB", "co op", "x\ny", "afi", "abc"]);
-    }
-
-    #[test]
-    fn an_unmarked_redraw_of_actual_text_reads_as_the_same_text() {
-        // Canva draws text twice (an outline or shadow) and marks only one drawing. The copy,
-        // before or after the marked one and half a point off, takes the same replacement and is
-        // dropped as a redraw; the same codes elsewhere on the page keep their own text.
-        let marked = "BT /F1 20 Tf 1 0 0 1 100 150 Tm (a) Tj /Span <</ActualText <FEFF0E190E490E33>>> BDC (xy) Tj EMC (b) Tj ET";
-        let copy = "BT /F1 20 Tf 1 0 0 1 100.5 150.5 Tm (axyb) Tj ET";
-        let elsewhere = "BT /F1 20 Tf 1 0 0 1 100 50 Tm (axyb) Tj ET";
-        let pdf = marked_pages(&[&format!("{marked} {copy} {elsewhere}"), &format!("{copy} {marked} {elsewhere}")]);
-        for page in 0..2 {
-            assert_eq!(marked_text(&pdf, page).plain_text(), "aน้ำb\naxyb", "page {page}");
-        }
-    }
-
-    /// Issue #3109: text drawn in clipping mode (`7 Tr`) sets the clip for a subsequent fill,
-    /// shading or image without painting the glyphs directly, and must still reach `TextDevice`
-    /// with the same boxes and search ranges as modes 0–6.
-    #[test]
-    fn clipping_mode_text_is_extracted_and_searchable_like_other_rendering_modes() {
-        let fill_through = " 0 0 1 rg 0 0 300 300 re f";
-        let mut pages: Vec<String> =
-            (0..=7).map(|mode| format!("q BT /F1 24 Tf {mode} Tr 72 150 Td () Tj [(Hello) -200 (World)] TJ ET{fill_through} Q")).collect();
-        // Page 8: /ActualText wrapping 7 Tr clip-only text.
-        pages.push(format!("q /Span <</ActualText (Hello World)>> BDC BT /F1 24 Tf 7 Tr 72 150 Td (Glyphs) Tj ET EMC{fill_through} Q"));
-        // Page 9: 0 Tr underpainting followed by 7 Tr at the same position (outline/gradient overlay) deduplicates.
-        pages.push(format!("BT /F1 24 Tf 0 Tr 72 150 Td (Hello World) Tj ET q BT /F1 24 Tf 7 Tr 72 150 Td (Hello World) Tj ET{fill_through} Q"));
-        // Page 10: 90° turned 7 Tr text.
-        pages.push(format!("q BT /F1 24 Tf 7 Tr 0 1 -1 0 150 100 Tm (Hello World) Tj ET{fill_through} Q"));
-        // Page 11: 7 Tr without any fill-through (visually blank, still extractable).
-        pages.push("BT /F1 24 Tf 7 Tr 72 150 Td (Hello World) Tj ET".into());
-
-        let refs: Vec<&str> = pages.iter().map(String::as_str).collect();
-        let pdf = marked_pages(&refs);
-        let control = marked_text(&pdf, 0);
-        assert_eq!(control.plain_text(), "Hello World");
-        let control_rects = control.line_rects(0..5);
-        assert_eq!(control_rects.len(), 1);
-        for mode in 0..=7 {
-            let text = marked_text(&pdf, mode);
-            assert_eq!(text.plain_text(), "Hello World", "mode {mode} Tr");
-            assert_eq!(text.find("hello"), vec![0..5], "mode {mode} Tr");
-            assert_eq!(text.find_opts("Hello", true, true), vec![0..5], "mode {mode} Tr");
-            assert_eq!(
-                text.find_with(|chars| chars.starts_with(&['H', 'e', 'l', 'l', 'o']).then_some(0..5).into_iter().collect()),
-                vec![0..5],
-                "mode {mode} Tr"
-            );
-            assert_eq!(text.line_rects(0..5), control_rects, "mode {mode} Tr");
-            assert_eq!(text.glyphs, control.glyphs, "mode {mode} Tr");
-        }
-        let actual = marked_text(&pdf, 8);
-        assert_eq!(actual.plain_text(), "Hello World");
-        assert_eq!(actual.find("Hello"), vec![0..1]);
-
-        let deduped = marked_text(&pdf, 9);
-        assert_eq!(deduped.plain_text(), "Hello World");
-
-        let turned = marked_text(&pdf, 10);
-        assert_eq!(turned.plain_text(), "Hello World");
-        assert_eq!(turned.find("World"), vec![6..11]);
-
-        let unfilled = marked_text(&pdf, 11);
-        assert_eq!(unfilled.plain_text(), "Hello World");
-
-        // Visual check: page 7 (`7 Tr` + blue fill-through) paints blue only inside the clipped
-        // glyph outlines, whereas page 11 (`7 Tr` alone) paints no ink at all.
-        let mut renderer = crate::PageRenderer::new(std::sync::Arc::new(pdf.data().as_ref().to_vec()), crate::RenderConfig::default());
-        let filled_px = renderer.render(crate::RenderRequest { page: 7, kind: crate::RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(filled_px.error.is_none());
-        let blue_pixels = filled_px.rgba.as_chunks::<4>().0.iter().filter(|p| p[0] < 32 && p[1] < 32 && p[2] > 200).count();
-        let white_pixels = filled_px.rgba.as_chunks::<4>().0.iter().filter(|p| p[..3] == [255, 255, 255]).count();
-        assert!(blue_pixels > 50 && white_pixels > 80_000, "blue={blue_pixels}, white={white_pixels}");
-
-        let unfilled_px = renderer.render(crate::RenderRequest { page: 11, kind: crate::RequestKind::Pixels, scale: 1.0, ..Default::default() });
-        assert!(unfilled_px.error.is_none());
-        assert!(unfilled_px.rgba.as_chunks::<4>().0.iter().all(|p| p[..3] == [255, 255, 255]));
-    }
-
-    #[test]
-    fn clipping_mode_filter_keeps_titles_and_excludes_ocr() {
-        let pdf = marked_pages(&[
-            "q BT /F1 24 Tf 7 Tr 30 200 Td (Clipped heading) Tj ET 0 0 1 rg 0 0 300 300 re f Q BT /F1 12 Tf 3 Tr 30 100 Td (Hidden OCR) Tj ET",
-            "q /Span <</ActualText (Accessible heading)>> BDC BT /F1 24 Tf 7 Tr 30 200 Td (Clipped heading) Tj ET EMC 0 0 1 rg 0 0 300 300 re f Q",
-        ]);
-        assert!(marked_text(&pdf, 0).plain_text().contains("Hidden OCR"));
-        for (page, expected) in [(0, "Clipped heading"), (1, "Accessible heading")] {
-            let text = extract_page_filtered(&pdf, page, &InterpreterSettings::default(), TextFilter { images: true, ..Default::default() }).unwrap();
-            assert_eq!(text.plain_text(), expected);
-            assert!(!text.find("heading").is_empty());
-        }
-    }
-
-    /// One page per `(encoding, content)`, in Helvetica (`/F1`).
-    fn encoded_pages(pages: &[(lopdf::Object, &[u8])]) -> Pdf {
-        use lopdf::{Document, Object, Stream, dictionary};
-        let mut doc = Document::with_version("1.7");
-        let pages_id = doc.new_object_id();
-        let mut kids = Vec::new();
-        for (encoding, content) in pages {
-            let font =
-                doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Helvetica", "Encoding" => encoding.clone() });
-            let content = doc.add_object(Stream::new(dictionary! {}, content.to_vec()));
-            let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages_id, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
-            kids.push(Object::Reference(page));
-        }
-        let count = kids.len() as i64;
-        doc.objects.insert(pages_id, dictionary! {"Type" => "Pages", "Kids" => kids, "Count" => count}.into());
-        let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages_id});
-        doc.trailer.set("Root", catalog);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).unwrap();
-        Pdf::new(std::sync::Arc::new(bytes)).unwrap()
-    }
-
-    /// The Annex D.2 alias codes extract as the ink they draw, not as formatting characters.
-    ///
-    /// WinAnsiEncoding gives 0xAD and 0xA0 the glyph names `hyphen` and `space`, the names it
-    /// also gives 0x2D and 0x20, and MacRomanEncoding gives 0xCA `space`. Reporting the Adobe
-    /// Glyph List values U+00AD and U+00A0 for them hid visible text: a soft hyphen is invisible,
-    /// so "well-known" written that way matched no search and no redaction pattern.
-    /// `XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 of them.
-    ///
-    /// A `/Differences` entry naming `sfthyphen` or `nbspace` is a deliberate statement about one
-    /// code and keeps its glyph list value. pdftotext draws the same line: on this fixture it
-    /// reads the base-encoded codes as "a-b a b" and the named ones as U+00AD.
-    #[test]
-    fn the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space() {
-        use lopdf::{Object, dictionary};
-        let name = |n: &str| Object::Name(n.as_bytes().to_vec());
-        let differences = Object::Dictionary(dictionary! {
-            "Type" => "Encoding",
-            "BaseEncoding" => "WinAnsiEncoding",
-            "Differences" => vec![Object::Integer(88), name("sfthyphen"), Object::Integer(89), name("nbspace")],
-        });
-        let pdf = encoded_pages(&[
-            (name("WinAnsiEncoding"), &b"BT /F1 20 Tf 1 0 0 1 20 150 Tm (a\xadb\xa0c) Tj ET"[..]),
-            (name("MacRomanEncoding"), &b"BT /F1 20 Tf 1 0 0 1 20 150 Tm (a\xcab) Tj ET"[..]),
-            (differences, &b"BT /F1 20 Tf 1 0 0 1 20 150 Tm (aXbYc) Tj ET"[..]),
-        ]);
-        let texts =
-            |page| extract_page(&pdf, page, &InterpreterSettings::default()).unwrap().glyphs.iter().map(|g| g.text.clone()).collect::<Vec<_>>();
-        assert_eq!(texts(0), ["a", "-", "b", " ", "c"], "WinAnsi 0xAD and 0xA0");
-        assert_eq!(texts(1), ["a", " ", "b"], "MacRoman 0xCA");
-        assert_eq!(texts(2), ["a", "\u{ad}", "b", "\u{a0}", "c"], "a named glyph keeps its glyph list value");
-    }
-
-    /// #3169, #3170: glyph names outside the Adobe Glyph List still read as text. Ligature
-    /// (`f_i`) and suffixed (`hyphen.case`) names go by the glyph list specification's full
-    /// mapping. A name that only numbers the glyph (`c251` small caps, `C39`, `C174`, `C39.sc`)
-    /// reads as nothing, not as a guess from the code (review on #3239: with `/C1` at 233,
-    /// StandardEncoding's 233 would read `Ø` for a glyph drawn as `é`), and so do a ZapfDingbats
-    /// name (`a12`) and a name with no meaning left (`foo`).
-    #[test]
-    fn glyph_names_outside_the_glyph_list_still_read_as_text() {
-        use lopdf::{Object, dictionary};
-        let name = |n: &str| Object::Name(n.as_bytes().to_vec());
-        let differences = Object::Dictionary(dictionary! {
-            "Type" => "Encoding",
-            "Differences" => vec![
-                Object::Integer(30), name("f_i"), name("f_l"), Object::Integer(2), name("hyphen.case"),
-                Object::Integer(39), name("C39"), Object::Integer(97), name("c251"), Object::Integer(174), name("C174"),
-                Object::Integer(88), name("a12"), name("foo"), name("uni00660069"),
-                Object::Integer(61), name("C39.sc"), Object::Integer(233), name("C1"),
-            ],
-        });
-        // One glyph per line: the test font has none of these glyphs, so they have no width, and
-        // on one line a later `fi` would sit on the first and be dropped as its fake-bold copy.
-        let mut content = b"BT /F1 20 Tf 20 290 Td".to_vec();
-        for code in *b"\x1e\x1f\x02'a\xaeXYZ=\xe9" {
-            content.extend_from_slice(b" (");
-            content.push(code);
-            content.extend_from_slice(b") Tj 0 -25 Td");
-        }
-        content.extend_from_slice(b" ET");
-        let pdf = encoded_pages(&[(differences, &content[..])]);
-        let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap().plain_text();
-        let lines: Vec<&str> = text.lines().map(str::trim).filter(|l| !l.is_empty()).collect();
-        assert_eq!(lines, ["fi", "fl", "-", "fi"], "{text:?}");
-    }
-
-    /// Review on #3239: the glyph list specification's `uni` and `u` forms take uppercase hex
-    /// digits only, and map a name with lowercase ones to nothing ("uni20ac" in its examples).
-    /// Names upstream's own lookup can't read (several groups, a suffix) show it: lowercase reads
-    /// as nothing, uppercase as its characters. A bare `uni20ac` or `u1040c` is still read by
-    /// upstream's lenient `unicode_from_name`, outside this mapping.
-    #[test]
-    fn glyph_names_with_lowercase_hex_read_as_nothing() {
-        use lopdf::{Object, dictionary};
-        let name = |n: &str| Object::Name(n.as_bytes().to_vec());
-        let differences = Object::Dictionary(dictionary! {
-            "Type" => "Encoding",
-            "Differences" => vec![Object::Integer(65), name("uni20ac0308"), name("uni20AC0308"), name("u1040c.alt"), name("u1040C.alt"), name("f_uni20ac"), name("f_uni20AC")],
-        });
-        let pdf = encoded_pages(&[(
-            differences,
-            &b"BT /F1 20 Tf 20 180 Td (A) Tj 0 -25 Td (B) Tj 0 -25 Td (C) Tj 0 -25 Td (D) Tj 0 -25 Td (E) Tj 0 -25 Td (F) Tj ET"[..],
-        )]);
-        // One glyph per line, so each name's text stays its own (and a name read as nothing
-        // leaves no line).
-        let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap().plain_text();
-        let lines: Vec<&str> = text.lines().map(str::trim).filter(|l| !l.is_empty()).collect();
-        assert_eq!(lines, ["\u{20ac}\u{308}", "\u{1040c}", "f", "f\u{20ac}"], "{text:?}");
-    }
-
-    #[test]
-    fn narrow_ligatures_keep_every_letter() {
-        // Split evenly, this "ffi" put its two "f"s so close that the second was dropped as a
-        // fake-bold copy of the first.
-        let pdf = ligature_pages("1 beginbfchar <62> <006600660069> endbfchar", "obce", &["1 0 0 1 100 150"]);
-        let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
-        assert_eq!(text.plain_text(), "office");
-    }
-
-    #[test]
-    fn right_to_left_ligatures_keep_their_logical_order() {
-        // "سلام" drawn left to right as meem, alef, lam, seen; then with lam-alef as one glyph.
-        let letters = ligature_pages("4 beginbfchar <61> <0645> <62> <0644> <63> <0633> <64> <0627> endbfchar", "adbc", &["1 0 0 1 100 150"]);
-        let ligature = ligature_pages("3 beginbfchar <61> <0645> <62> <06440627> <63> <0633> endbfchar", "abc", &["1 0 0 1 100 150"]);
-        for pdf in [letters, ligature] {
-            assert_eq!(extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap().plain_text(), "سلام");
-        }
-        // "بَاب" with beh and its fatha as one glyph, as Add text writes shaped Arabic: the mark
-        // stays after its letter.
-        let marked = ligature_pages("3 beginbfchar <61> <0628064E> <62> <0627> <63> <0628> endbfchar", "cba", &["1 0 0 1 100 150"]);
-        assert_eq!(extract_page(&marked, 0, &InterpreterSettings::default()).unwrap().plain_text(), "بَاب");
-    }
-
-    #[test]
-    fn vertical_ligatures_stay_in_their_column() {
-        use lopdf::{Document, Object, Stream, dictionary};
-        let mut doc = Document::with_version("1.7");
-        // CID 2 is one glyph for "株式".
-        let cmap = b"/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /TestUnicode def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespacerange 3 beginbfchar <0001> <65E5> <0002> <682A5F0F> <0003> <8A9E> endbfchar endcmap CMapName currentdict /CMap defineresource pop end end";
-        let unicode = doc.add_object(Stream::new(dictionary! {}, cmap.to_vec()));
-        let cid = doc.add_object(dictionary! {
-            "Type" => "Font", "Subtype" => "CIDFontType2", "BaseFont" => "TestVertical",
-            "CIDSystemInfo" => dictionary! { "Registry" => Object::string_literal("Adobe"), "Ordering" => Object::string_literal("Identity"), "Supplement" => 0 },
-            "DW" => 1000, "DW2" => vec![Object::Integer(880), Object::Integer(-1000)], "CIDToGIDMap" => "Identity"
-        });
-        let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type0", "BaseFont" => "TestVertical", "Encoding" => "Identity-V", "DescendantFonts" => vec![Object::Reference(cid)], "ToUnicode" => unicode });
-        let content = doc.add_object(Stream::new(dictionary! {}, b"BT /F1 20 Tf 1 0 0 1 200 250 Tm <000100020003> Tj ET".to_vec()));
-        let pages = doc.new_object_id();
-        let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
-        doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
-        let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
-        doc.trailer.set("Root", catalog);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).unwrap();
-        let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
-        let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
-        assert_eq!(text.plain_text(), "日株式語");
-        assert_eq!(text.glyphs.len(), 3);
-        assert_eq!(text.line_rects(0..3).len(), 1, "one column");
-    }
-
-    #[test]
-    fn upright_mapping_round_trips() {
-        let r = [10.0, 20.0, 30.0, 25.0];
-        for q in 0..4 {
-            assert_eq!(from_upright(to_upright(r, q, 300.0, 200.0), q, 300.0, 200.0), r, "quarter {q}");
-        }
-        // A 90° page: the view's top-right corner is the upright top-left.
-        assert_eq!(to_upright([290.0, 0.0, 300.0, 10.0], 1, 300.0, 200.0), [0.0, 0.0, 10.0, 10.0]);
-    }
-
-    #[test]
-    fn turkish_dotted_and_dotless_i_match_in_any_case() {
-        // "İSTANBUL IRMAK KIŞ" on one line: each word typed in lower case must find it, and the
-        // reverse. `to_lowercase` alone made `İ` two characters and left `ı` unmatched.
-        let mut v = Vec::new();
-        word(&mut v, "İSTANBUL", 10.0, 10.0, 7.0);
-        word(&mut v, "IRMAK", 80.0, 10.0, 7.0);
-        word(&mut v, "KIŞ", 130.0, 10.0, 7.0);
-        let upper = layout(v);
-        assert_eq!(upper.plain_text(), "İSTANBUL IRMAK KIŞ");
-        assert_eq!(upper.find("istanbul"), vec![0..8]);
-        assert_eq!(upper.find("İstanbul"), vec![0..8]);
-        assert_eq!(upper.find("ırmak"), vec![8..13]);
-        assert_eq!(upper.find("kış"), vec![13..16]);
-        assert_eq!(upper.find("istanbul ırmak kış"), vec![0..16], "a phrase across the words");
-        assert_eq!(upper.find_opts("ırmak", false, true), vec![8..13], "whole words");
-        assert!(upper.find_opts("istanbul", true, false).is_empty(), "case-sensitive search stays exact");
-        assert_eq!(upper.find_opts("İSTANBUL", true, false), vec![0..8]);
-
-        let mut v = Vec::new();
-        word(&mut v, "istanbul", 10.0, 10.0, 7.0);
-        word(&mut v, "ırmak", 80.0, 10.0, 7.0);
-        word(&mut v, "kış", 130.0, 10.0, 7.0);
-        let lower = layout(v);
-        assert_eq!(lower.find("İSTANBUL"), vec![0..8]);
-        assert_eq!(lower.find("IRMAK"), vec![8..13]);
-        assert_eq!(lower.find("KIŞ"), vec![13..16]);
-    }
-
-    #[test]
-    fn greek_sigma_forms_match_without_changing_exact_search_or_glyph_ranges() {
-        let mut v = Vec::new();
-        word(&mut v, "κόσμος", 10.0, 10.0, 7.0);
-        word(&mut v, "ΚΌΣΜΟΣ", 80.0, 10.0, 7.0);
-        word(&mut v, "σςΣ", 150.0, 10.0, 7.0);
-        let text = layout(v);
-        assert_eq!(text.plain_text(), "κόσμος ΚΌΣΜΟΣ σςΣ");
-        for query in ["κόσμος", "ΚΌΣΜΟΣ"] {
-            assert_eq!(text.find(query), vec![0..6, 6..12]);
-            assert_eq!(text.find_opts(query, false, true), vec![0..6, 6..12]);
-        }
-        for query in ["σ", "ς", "Σ"] {
-            assert_eq!(text.find(query), vec![2..3, 5..6, 8..9, 11..12, 12..13, 13..14, 14..15]);
-            assert!(text.find_opts(query, false, true).is_empty());
-        }
-        assert_eq!(text.find_opts("κόσμος", true, false), vec![0..6]);
-        assert_eq!(text.find_opts("ΚΌΣΜΟΣ", true, false), vec![6..12]);
-        assert_eq!(text.find_opts("ς", true, false), vec![5..6, 13..14]);
-        assert_eq!(text.find_opts_limited("ς", false, false, 2), vec![2..3, 5..6]);
-        assert_eq!(text.line_rects(text.find("κόσμος")[1].clone()), text.line_rects(6..12));
-    }
-
-    #[test]
-    fn case_folding_keeps_one_character_per_character() {
-        for s in ["İSTANBUL", "ırmak", "Hello WORLD", "ÇAĞLAR", "Straße", "ΣΟΦΙΑ", "Σσς", "日本語"] {
-            assert_eq!(fold_case(s).chars().count(), s.chars().count(), "{s}");
-        }
-        assert_eq!(fold_case("Hello WORLD"), "hello world");
-        assert_eq!(fold_case("ÇAĞLAR Şişli"), "çağlar şişli");
-        assert_eq!(fold_case("İIıi"), "iiii");
-        assert_eq!(fold_case("Σσς"), "σσσ");
-    }
-
-    fn g(t: &str, x0: f32, y0: f32, x1: f32) -> TextGlyph {
-        let rect = [x0, y0, x1, y0 + 10.0];
-        TextGlyph { text: t.into(), rect, quad: [[x0, y0], [x1, y0], [x1, rect[3]], [x0, rect[3]]], direction: [1.0, 0.0] }
-    }
-
-    /// A glyph whose em box is `w` × `h` at `origin`, advancing along `dir` with its up edge along
-    /// `up` (a unit step of each), as a sheared or turned text matrix draws it.
-    fn tilted(t: &str, origin: [f32; 2], dir: [f32; 2], up: [f32; 2], w: f32, h: f32) -> TextGlyph {
-        let p = |a: f32, b: f32| [origin[0] + dir[0] * a + up[0] * b, origin[1] + dir[1] * a + up[1] * b];
-        let quad = [p(0.0, 0.0), p(w, 0.0), p(w, h), p(0.0, h)];
-        let xs = quad.map(|q| q[0]);
-        let ys = quad.map(|q| q[1]);
-        let rect = [
-            xs.iter().copied().fold(f32::MAX, f32::min),
-            ys.iter().copied().fold(f32::MAX, f32::min),
-            xs.iter().copied().fold(f32::MIN, f32::max),
-            ys.iter().copied().fold(f32::MIN, f32::max),
-        ];
-        TextGlyph { text: t.into(), rect, quad, direction: dir }
-    }
-
-    /// #3693: pointing at the middle of a glyph in sheared or turned text finds that glyph, not
-    /// the one before it whose bounding box overlaps it.
-    #[test]
-    fn nearest_finds_the_glyph_under_the_pointer_in_sheared_and_turned_text() {
-        let s = std::f32::consts::FRAC_1_SQRT_2;
-        // (writing direction, up edge) in view space (y down): upright, sheared 0.35, turned 45°.
-        for (dir, up) in [([1.0, 0.0], [0.0, -1.0]), ([1.0, 0.0], [0.35, -1.0]), ([s, -s], [-s, -s])] {
-            let mut advance = 0.0;
-            let glyphs: Vec<TextGlyph> = "film in the list of tiny jilt flit"
-                .chars()
-                .map(|c| {
-                    let w = if "filjt ".contains(c) { 3.0 } else { 6.0 };
-                    let g = tilted(&c.to_string(), [50.0 + dir[0] * advance, 300.0 + dir[1] * advance], dir, up, w, 14.0);
-                    advance += w;
-                    g
-                })
-                .collect();
-            let t = layout(glyphs.clone());
-            assert_eq!(t.glyphs.len(), glyphs.len(), "layout kept every glyph");
-            for (i, g) in glyphs.iter().enumerate() {
-                let cx = g.quad.iter().map(|q| q[0]).sum::<f32>() / 4.0;
-                let cy = g.quad.iter().map(|q| q[1]).sum::<f32>() / 4.0;
-                assert_eq!(t.nearest(cx, cy), Some(i), "dir {dir:?} up {up:?}: glyph {i} ({})", g.text);
-            }
-            // Past either end of the line, the end glyph is still the nearest.
-            let (first, last) = (&glyphs[0], &glyphs[glyphs.len() - 1]);
-            assert_eq!(t.nearest(first.quad[0][0] - dir[0] * 8.0, first.quad[0][1] - dir[1] * 8.0), Some(0));
-            assert_eq!(t.nearest(last.quad[1][0] + dir[0] * 8.0, last.quad[1][1] + dir[1] * 8.0), Some(glyphs.len() - 1));
-        }
-    }
-
-    #[test]
-    fn a_degenerate_or_nan_quad_holds_no_point() {
-        assert!(!quad_contains(&[[1.0, 1.0]; 4], 1.0, 1.0));
-        assert!(!quad_contains(&[[0.0, 0.0], [1.0, 0.0], [f32::NAN, 1.0], [0.0, 1.0]], 0.5, 0.5));
-        assert!(quad_contains(&[[0.0, 0.0], [4.0, 0.0], [4.0, 4.0], [0.0, 4.0]], 4.0, 2.0));
-        // Wound the other way.
-        assert!(quad_contains(&[[0.0, 0.0], [0.0, 4.0], [4.0, 4.0], [4.0, 0.0]], 2.0, 2.0));
-    }
-
-    #[test]
-    fn lines_words_and_search() {
-        // "Hello world" on line 1, "Next" on line 2.
-        let mut v = Vec::new();
-        for (i, c) in "Hello".chars().enumerate() {
-            v.push(g(&c.to_string(), 10.0 + i as f32 * 6.0, 10.0, 16.0 + i as f32 * 6.0));
-        }
-        for (i, c) in "world".chars().enumerate() {
-            v.push(g(&c.to_string(), 50.0 + i as f32 * 6.0, 10.0, 56.0 + i as f32 * 6.0));
-        }
-        for (i, c) in "Next".chars().enumerate() {
-            v.push(g(&c.to_string(), 10.0 + i as f32 * 6.0, 30.0, 16.0 + i as f32 * 6.0));
-        }
-        let t = layout(v);
-        assert_eq!(t.plain_text(), "Hello world\nNext");
-        assert_eq!(t.find("WORLD next"), vec![5..14]);
-        assert_eq!(t.find("o"), vec![4..5, 6..7]);
-        assert_eq!(t.line_rects(3..12).len(), 2);
-        assert_eq!(t.nearest(52.0, 14.0), Some(5));
-    }
-
-    /// #1315: a custom match that ends on a reconstructed word or line separator does not take
-    /// the following glyph.
-    #[test]
-    fn a_match_ending_on_a_separator_stops_before_the_next_glyph() {
-        let glyphs: Vec<TextGlyph> = "quickbrown"
-            .chars()
-            .enumerate()
-            .map(|(i, c)| {
-                let x = i as f32 * 6.0;
-                g(&c.to_string(), x, 0.0, x + 6.0)
-            })
-            .collect();
-        for line_break in [false, true] {
-            let mut space_before = vec![false; 10];
-            space_before[5] = !line_break;
-            let line_of = (0..10).map(|i| u32::from(line_break && i >= 5)).collect();
-            let page = PageText { glyphs: glyphs.clone(), line_of, space_before };
-            let plain = if line_break { "quick\nbrown" } else { "quick brown" };
-            assert_eq!(page.plain_text(), plain);
-            assert_eq!(page.find("quick "), vec![0..5]);
-            let span = |r: std::ops::Range<usize>| Vec::from([r]);
-            assert_eq!(page.find_with(|_| span(0..5)), vec![0..5]);
-            assert_eq!(page.find_with(|_| span(5..11)), vec![5..10]);
-            assert_eq!(page.find_with(|_| span(6..11)), vec![5..10]);
-            let hits = page.find_with(|_| span(0..6));
-            assert_eq!(page.text_of(hits[0].clone()), "quick");
-            assert_eq!(hits, vec![0..5]);
-        }
-    }
-
-    #[test]
-    fn phrase_search_ignores_repeated_spaces() {
-        // "quick  brown" drawn with two space glyphs in a row. Text extraction keeps both spaces,
-        // but the phrase search has always collapsed runs of whitespace in the query, so the page
-        // text has to be collapsed the same way or the phrase is never found (#814).
-        let mut v = Vec::new();
-        word(&mut v, "quick", 10.0, 10.0, 6.0);
-        v.push(g(" ", 46.0, 10.0, 52.0));
-        v.push(g(" ", 52.0, 10.0, 58.0));
-        word(&mut v, "brown", 58.0, 10.0, 6.0);
-        let n = v.len();
-        let t = PageText { glyphs: v, line_of: vec![0; n], space_before: vec![false; n] };
-        assert_eq!(t.plain_text(), "quick  brown");
-        assert_eq!(t.find("quick brown"), vec![0..12]);
-        assert_eq!(t.find("quick  brown"), vec![0..12], "the query's own run of spaces is collapsed too");
-        assert_eq!(t.find("quick\tbrown"), vec![0..12]);
-        assert_eq!(t.find("quick"), vec![0..5]);
-        assert_eq!(t.find("brown"), vec![7..12]);
-        assert_eq!(t.find_opts_limited("o", false, false, 0), Vec::new());
-        assert!(t.find("quick absent").is_empty());
-    }
-
-    #[test]
-    fn limited_search_stops_after_the_requested_matches() {
-        let mut glyphs = Vec::new();
-        word(&mut glyphs, "oooo", 10.0, 10.0, 6.0);
-        let text = layout(glyphs);
-        assert_eq!(text.find_opts_limited("o", false, false, 2), vec![0..1, 1..2]);
-        assert_eq!(text.find_opts_limited("o", false, false, 10), vec![0..1, 1..2, 2..3, 3..4]);
-    }
-
-    fn word(v: &mut Vec<TextGlyph>, s: &str, x: f32, y: f32, advance: f32) {
-        for (i, c) in s.chars().enumerate() {
-            let x0 = x + i as f32 * advance;
-            v.push(g(&c.to_string(), x0, y, x0 + 6.0));
-        }
-    }
-
-    #[test]
-    fn fake_bold_duplicates_are_removed() {
-        let mut v = Vec::new();
-        for (i, c) in "Bold".chars().enumerate() {
-            let x = 10.0 + i as f32 * 7.0;
-            v.push(g(&c.to_string(), x, 10.0, x + 6.0));
-            v.push(g(&c.to_string(), x + 0.3, 10.0, x + 6.3));
-        }
-        assert_eq!(layout(v).plain_text(), "Bold");
-        // A zero-width combining mark redrawn on itself is dropped too.
-        let v = vec![g("e", 10.0, 10.0, 16.0), g("\u{301}", 13.0, 10.0, 13.0), g("e", 10.0, 10.0, 16.0), g("\u{301}", 13.0, 10.0, 13.0)];
-        assert_eq!(layout(v).plain_text(), "e\u{301}");
-    }
-
-    /// #1467: condensed text (80 Tz and below, OCR layers fitted to the scan) sets narrow letters
-    /// closer than a fifth of their height apart; a doubled letter there is two letters, not a redraw.
-    #[test]
-    fn condensed_double_letters_are_kept() {
-        for scale in [0.8, 0.65, 0.5] {
-            let mut v = Vec::new();
-            let mut x = 10.0;
-            // Helvetica advances at 10 pt, in thousandths of an em.
-            for (c, adv) in [('A', 667.0), ('l', 222.0), ('l', 222.0), ('e', 556.0)] {
-                let w = adv / 100.0 * scale;
-                v.push(g(&c.to_string(), x, 10.0, x + w));
-                x += w;
-            }
-            assert_eq!(layout(v.clone()).plain_text(), "Alle", "at {scale} horizontal scaling");
-            // Each letter redrawn a fifth of a point to the right is still one letter.
-            let bold: Vec<TextGlyph> = v.iter().flat_map(|c| [c.clone(), g(&c.text, c.rect[0] + 0.2, 10.0, c.rect[2] + 0.2)]).collect();
-            assert_eq!(layout(bold).plain_text(), "Alle", "fake bold at {scale} horizontal scaling");
-        }
-    }
-
-    /// #2457: OCR text layers squeeze each word into its box down to 20 Tz and below, where a
-    /// narrow letter is less than a twentieth of its height wide. Doubled letters, and letters
-    /// repeated two or three places on, are still letters there, not redraws.
-    #[test]
-    fn ocr_condensed_double_letters_are_kept() {
-        // Helvetica advances, in thousandths of an em.
-        let adv = |c: char| match c {
-            'M' => 833.0,
-            'K' | 'B' => 667.0,
-            'W' => 944.0,
-            'I' | 't' | 'f' => 278.0,
-            'i' | 'l' => 222.0,
-            'm' => 833.0,
-            'r' => 333.0,
-            's' => 500.0,
-            _ => 556.0,
-        };
-        for scale in [0.2, 0.1, 0.05] {
-            for word in ["Hallo", "Mitte", "Wille", "Kommission", "Illustration", "still", "Brunnen", "Kaffee"] {
-                let mut v = Vec::new();
-                let mut x = 10.0;
-                for c in word.chars() {
-                    let w = adv(c) / 100.0 * scale;
-                    v.push(g(&c.to_string(), x, 10.0, x + w));
-                    x += w;
-                }
-                assert_eq!(layout(v.clone()).plain_text(), word, "at {scale} horizontal scaling");
-                // Each letter drawn twice at the same place is still one letter.
-                let bold: Vec<TextGlyph> = v.iter().flat_map(|c| [c.clone(), c.clone()]).collect();
-                assert_eq!(layout(bold).plain_text(), word, "fake bold at {scale} horizontal scaling");
-                // And redrawn a quarter of its own width to the right (the match reaches half of it).
-                let shifted: Vec<TextGlyph> = v
-                    .iter()
-                    .flat_map(|c| {
-                        let d = (c.rect[2] - c.rect[0]) * 0.25;
-                        [c.clone(), g(&c.text, c.rect[0] + d, 10.0, c.rect[2] + d)]
-                    })
-                    .collect();
-                assert_eq!(layout(shifted).plain_text(), word, "shifted fake bold at {scale} horizontal scaling");
-            }
-        }
-    }
-
-    #[test]
-    fn two_columns_read_left_then_right_even_if_drawn_interleaved() {
-        let mut v = Vec::new();
-        // Drawn row by row across both columns, as some producers do.
-        word(&mut v, "Left1", 10.0, 10.0, 6.0);
-        word(&mut v, "Right1", 200.0, 10.0, 6.0);
-        word(&mut v, "Left2", 10.0, 24.0, 6.0);
-        word(&mut v, "Right2", 200.0, 24.0, 6.0);
-        let t = layout(v);
-        assert_eq!(t.plain_text(), "Left1\nLeft2\nRight1\nRight2");
-    }
-
-    /// Lays out one-word lines, each `(text, x, y)`, 10 pt high: 14 pt apart is a line in a paragraph, 24 pt a
-    /// paragraph gap.
-    fn lines(at: &[(&str, f32, f32)]) -> String {
-        let mut v = Vec::new();
-        for &(s, x, y) in at {
-            word(&mut v, s, x, y, 6.0);
-        }
-        layout(v).plain_text()
-    }
-
-    #[test]
-    fn a_column_reads_on_past_a_paragraph_gap() {
-        // #3658: a heading and paragraph A at the top of the left column, a paragraph gap, then paragraph B, which
-        // goes on at the top of the right column, and paragraph C below it.
-        let two = [
-            ("Heading", 10.0, 10.0),
-            ("A1", 10.0, 30.0),
-            ("A2", 10.0, 44.0),
-            ("A3", 10.0, 58.0),
-            ("B1", 10.0, 82.0),
-            ("B2", 10.0, 96.0),
-            ("B3", 200.0, 30.0),
-            ("B4", 200.0, 44.0),
-            ("C1", 200.0, 68.0),
-            ("C2", 200.0, 82.0),
-        ];
-        assert_eq!(lines(&two), "Heading\nA1\nA2\nA3\nB1\nB2\nB3\nB4\nC1\nC2");
-        // Three columns, each with a gap at a different height.
-        let three = [
-            ("A1", 10.0, 10.0),
-            ("A2", 10.0, 24.0),
-            ("B1", 10.0, 48.0),
-            ("C1", 150.0, 10.0),
-            ("D1", 150.0, 38.0),
-            ("D2", 150.0, 52.0),
-            ("E1", 290.0, 10.0),
-            ("E2", 290.0, 24.0),
-            ("E3", 290.0, 38.0),
-            ("F1", 290.0, 62.0),
-        ];
-        assert_eq!(lines(&three), "A1\nA2\nB1\nC1\nD1\nD2\nE1\nE2\nE3\nF1");
-    }
-
-    #[test]
-    fn a_column_reads_on_past_a_line_that_only_touches_it() {
-        // The #3658 page with a right-column paragraph whose first line touches B1's by 1 pt or 0.1 pt, or whose
-        // second line carries a 6 pt footnote marker reaching up beside B2: none of them is a row with B1.
-        let page = |extra: &[(&str, f32, f32, f32)]| {
-            let mut v = Vec::new();
-            let left = [("H", 10.0, 10.0), ("A1", 10.0, 30.0), ("A2", 10.0, 44.0), ("A3", 10.0, 58.0), ("B1", 10.0, 82.0), ("B2", 10.0, 96.0)];
-            for &(s, x, y) in left.iter().chain(&[("R1", 200.0, 30.0), ("R2", 200.0, 44.0)]) {
-                word(&mut v, s, x, y, 6.0);
-            }
-            for &(s, x, y, h) in extra {
-                for (i, c) in s.chars().enumerate() {
-                    let x0 = x + i as f32 * h * 0.6;
-                    v.push(em_box(&c.to_string(), x0, y, x0 + h * 0.6, y + h));
-                }
-            }
-            layout(v).plain_text().replace('\n', " ")
-        };
-        assert_eq!(page(&[("S1", 200.0, 91.0, 10.0), ("S2", 200.0, 105.0, 10.0)]), "H A1 A2 A3 B1 B2 R1 R2 S1 S2", "1 pt touch");
-        assert_eq!(page(&[("S1", 200.0, 72.1, 10.0), ("S2", 200.0, 86.1, 10.0)]), "H A1 A2 A3 B1 B2 R1 R2 S1 S2", "0.1 pt touch");
-        let marker = page(&[("S1", 200.0, 68.0, 10.0), ("x", 200.0, 96.0, 10.0), ("9", 206.5, 90.0, 6.0), ("S2y", 214.0, 96.0, 10.0)]);
-        assert!(marker.starts_with("H A1 A2 A3 B1 B2 R1 R2 S1 "), "footnote marker: {marker}");
-    }
-
-    #[test]
-    fn a_full_width_line_ends_the_columns_above_it() {
-        // Two columns, a full-width heading, two more columns and a full-width footnote. The left column stops at the
-        // heading and the footnote: the right column above each one reads first.
-        let page = [
-            ("L1", 10.0, 10.0),
-            ("L2", 10.0, 24.0),
-            ("L3", 10.0, 48.0),
-            ("R1", 200.0, 10.0),
-            ("R2", 200.0, 38.0),
-            ("Fullwidthheading", 10.0, 80.0),
-            ("L4", 10.0, 110.0),
-            ("L5", 10.0, 124.0),
-            ("L6", 10.0, 148.0),
-            ("R3", 200.0, 110.0),
-            ("R4", 200.0, 138.0),
-            ("Fullwidthfootnote", 10.0, 200.0),
-        ];
-        // The two full-width lines run past the right column (x = 286 and 304) at 18 pt a letter.
-        let mut v = Vec::new();
-        for &(s, x, y) in &page {
-            word(&mut v, s, x, y, if s.len() > 2 { 18.0 } else { 6.0 });
-        }
-        assert_eq!(layout(v).plain_text(), "L1\nL2\nL3\nR1\nR2\nFullwidthheading\nL4\nL5\nL6\nR3\nR4\nFullwidthfootnote");
-    }
-
-    #[test]
-    fn table_rows_apart_still_read_across() {
-        // Rows a paragraph gap apart whose cells start level read row by row, as before #3658.
-        let rows = [("Name", 10.0, 10.0), ("Qty", 100.0, 10.0), ("Apple", 10.0, 34.0), ("12", 100.0, 34.0), ("Pear", 10.0, 58.0), ("7", 100.0, 58.0)];
-        assert_eq!(lines(&rows), "Name\nQty\nApple\n12\nPear\n7");
-    }
-
-    #[test]
-    fn form_rows_in_mixed_sizes_still_read_across() {
-        // 8 pt labels beside 12 pt values on one baseline, rows 30 pt apart: the tops differ by 4 pt, but the first
-        // lines overlap, so each row reads label then value.
-        let mut v = Vec::new();
-        let sized = |v: &mut Vec<TextGlyph>, s: &str, x: f32, base: f32, h: f32| {
-            for (i, c) in s.chars().enumerate() {
-                let x0 = x + i as f32 * h * 0.6;
-                v.push(em_box(&c.to_string(), x0, base - h, x0 + h * 0.6, base));
-            }
-        };
-        for (i, (label, value)) in [("Name", "Alice"), ("Street", "Main"), ("City", "Oslo")].into_iter().enumerate() {
-            let base = 20.0 + 30.0 * i as f32;
-            sized(&mut v, label, 10.0, base, 8.0);
-            sized(&mut v, value, 100.0, base, 12.0);
-        }
-        assert_eq!(layout(v).plain_text(), "Name\nAlice\nStreet\nMain\nCity\nOslo");
-        // Values drawn 6 pt below their labels, rows a paragraph gap apart.
-        let offset =
-            [("Name", 10.0, 10.0), ("Val1", 100.0, 16.0), ("Addr", 10.0, 40.0), ("Val2", 100.0, 46.0), ("City", 10.0, 70.0), ("Val3", 100.0, 76.0)];
-        assert_eq!(lines(&offset), "Name\nVal1\nAddr\nVal2\nCity\nVal3");
-    }
-
-    #[test]
-    fn a_column_does_not_jump_to_a_distant_footer_footnote_or_caption() {
-        // A page number far below the left column reads after the right column.
-        let footer = [
-            ("L1", 10.0, 10.0),
-            ("L2", 10.0, 24.0),
-            ("L3", 10.0, 48.0),
-            ("R1", 200.0, 10.0),
-            ("R2", 200.0, 24.0),
-            ("R3", 200.0, 48.0),
-            ("Pg7", 10.0, 400.0),
-        ];
-        assert_eq!(lines(&footer), "L1\nL2\nR1\nR2\nL3\nR3\nPg7");
-        // So does a footnote under the left column only, with the page number under the right one.
-        let footnote = [
-            ("L1", 10.0, 10.0),
-            ("L2", 10.0, 24.0),
-            ("L3", 10.0, 48.0),
-            ("R1", 200.0, 10.0),
-            ("R2", 200.0, 24.0),
-            ("R3", 200.0, 48.0),
-            ("Note", 10.0, 380.0),
-            ("Pg7", 200.0, 400.0),
-        ];
-        assert_eq!(lines(&footnote), "L1\nL2\nR1\nR2\nL3\nR3\nNote\nPg7");
-        // A caption under a full-width figure (no text from 70 to 250), as narrow as the left column, reads after both
-        // columns above the figure and before the columns below it.
-        let caption = [
-            ("L1", 10.0, 10.0),
-            ("L2", 10.0, 24.0),
-            ("L3", 10.0, 38.0),
-            ("R1", 200.0, 10.0),
-            ("R2", 200.0, 24.0),
-            ("R3", 200.0, 38.0),
-            ("Cap", 10.0, 260.0),
-            ("M1", 10.0, 290.0),
-            ("M2", 10.0, 304.0),
-            ("N1", 200.0, 290.0),
-            ("N2", 200.0, 304.0),
-        ];
-        assert_eq!(lines(&caption), "L1\nL2\nL3\nR1\nR2\nR3\nCap\nM1\nM2\nN1\nN2");
-    }
-
-    #[test]
-    fn many_column_paragraphs_order_in_bounded_time() {
-        // 2000 paragraphs in two columns, the right one offset by half a paragraph: every block is a column
-        // continuation, and choosing each one scans the remaining blocks.
-        let mut v = Vec::new();
-        for i in 0..1000u16 {
-            let y = 10.0 + 24.0 * f32::from(i);
-            word(&mut v, "L", 10.0, y, 6.0);
-            word(&mut v, "R", 200.0, y + 12.0, 6.0);
-        }
-        let start = std::time::Instant::now();
-        let text = layout(v).plain_text();
-        assert!(start.elapsed() < std::time::Duration::from_secs(5), "{:?}", start.elapsed());
-        // Compared without printing 4000 characters on failure.
-        let expected = format!("{}{}", "L\n".repeat(1000), "R\n".repeat(999) + "R");
-        assert!(text == expected, "the first R reads after {:?} lines, not 1000", text.find('R').map(|i| i / 2));
-    }
-
-    #[test]
-    fn tracked_text_keeps_letters_together() {
-        let mut v = Vec::new();
-        word(&mut v, "CHAPTER", 10.0, 10.0, 9.0); // 3pt tracking between 6pt-wide letters
-        word(&mut v, "FOUR", 10.0 + 7.0 * 9.0 + 5.0, 10.0, 9.0);
-        assert_eq!(layout(v).plain_text(), "CHAPTER FOUR");
-    }
-
-    #[test]
-    fn toc_leaders_do_not_hide_word_gaps() {
-        use lopdf::{Document, Object, Stream, dictionary};
-        for dots in [0, 5, 10, 20, 40, 60] {
-            for (words, expected) in [
-                ("(Was)-333(ist)-333(OTRS?)", "Was ist OTRS?"),
-                ("(Das)-333(OTRS)-333(Web-Interface)", "Das OTRS Web-Interface"),
-                ("(Neuen)-333(Zugang)-333(beantragen)", "Neuen Zugang beantragen"),
-            ] {
-                // The issue's LaTeX TJ spacing, without embedding the corpus PDF or a font asset.
-                let mut doc = Document::with_version("1.7");
-                let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Times-Roman" });
-                let operators = format!("BT /F1 10 Tf 10 100 Td [{words}-441{}-1663(7)] TJ ET", "-500(.)".repeat(dots));
-                let content = doc.add_object(Stream::new(dictionary! {}, operators.into_bytes()));
-                let pages = doc.new_object_id();
-                let page = doc.add_object(dictionary! {
-                    "Type" => "Page", "Parent" => pages,
-                    "MediaBox" => vec![0.into(), 0.into(), 800.into(), Object::Integer(200)],
-                    "Resources" => dictionary! { "Font" => dictionary! { "F1" => font } }, "Contents" => content
-                });
-                doc.objects.insert(pages, dictionary! { "Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1 }.into());
-                let catalog = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages });
-                doc.trailer.set("Root", catalog);
-                let mut bytes = Vec::new();
-                doc.save_to(&mut bytes).unwrap();
-                let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
-                let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
-                assert_eq!(text.plain_text(), format!("{expected} {}7", ". ".repeat(dots)), "{dots} leader dots");
-                let hits = text.find_opts(expected, true, true);
-                assert_eq!(hits.len(), 1, "{expected:?}, {dots} leader dots");
-                assert_eq!(text.text_of(hits[0].clone()), expected);
-                assert_eq!(text.line_rects(hits[0].clone()).len(), 1);
-                assert_eq!(text.find(&expected.to_lowercase()), hits);
-                assert!(text.find(&expected.replace(' ', "")).is_empty());
-            }
-        }
-    }
-
-    #[test]
-    fn short_tracked_ellipses_remain_searchable() {
-        for dots in [3, 4] {
-            let mut v = Vec::new();
-            for i in 0..dots {
-                let x = 10.0 + i as f32 * 4.0;
-                v.push(g(".", x, 10.0, x + 2.0));
-            }
-            let ellipsis = ".".repeat(dots);
-            let text = layout(v.clone());
-            assert_eq!(text.plain_text(), ellipsis);
-            assert_eq!(text.find(&ellipsis), vec![0..dots]);
-            v.insert(0, g("A", 0.0, 10.0, 6.0));
-            let x = 12.0 + dots as f32 * 4.0;
-            v.push(g("B", x, 10.0, x + 6.0));
-            let text = layout(v);
-            let expected = format!("A {ellipsis} B");
-            assert_eq!(text.plain_text(), expected);
-            assert_eq!(text.find(&expected), vec![0..dots + 2]);
-        }
-    }
-
-    #[test]
-    fn leaders_preserve_tracking_in_letters_numbers_and_punctuation() {
-        for advance in [9.0, 12.0] {
-            for leader in [".", "-", "…"] {
-                let mut v = Vec::new();
-                word(&mut v, "CHAPTER-1", 10.0, 10.0, advance);
-                let x = 10.0 + 9.0 * advance + 5.0;
-                word(&mut v, "1.4", x, 10.0, advance);
-                let mut x = x + 3.0 * advance + 5.0;
-                for _ in 0..60 {
-                    v.push(g(leader, x, 10.0, x + 2.5));
-                    x += 11.0;
-                }
-                let text = layout(v);
-                assert_eq!(text.plain_text(), format!("CHAPTER-1 1.4 {}", vec![leader; 60].join(" ")));
-                assert_eq!(text.find("chapter-1 1.4"), vec![0..12]);
-            }
-        }
-        // Decimal punctuation and repeated letters/digits still use their original tracking estimate.
-        for value in ["1.4", "1111", "llll"] {
-            let mut v = Vec::new();
-            word(&mut v, value, 10.0, 10.0, 12.0);
-            assert_eq!(layout(v).plain_text(), value);
-        }
-    }
-
-    #[test]
-    fn rtl_runs_come_out_in_logical_order_and_cjk_has_no_spaces() {
-        let mut v = Vec::new();
-        // Hebrew "שלום" drawn visually right-to-left: ם ו ל ש from left to right.
-        word(&mut v, "םולש", 10.0, 10.0, 6.0);
-        assert_eq!(layout(v).plain_text(), "שלום");
-        let mut v = Vec::new();
-        word(&mut v, "每个字", 10.0, 10.0, 9.0);
-        assert_eq!(layout(v).plain_text(), "每个字");
-    }
-
-    /// #1062: the word gap stays between the runs when the right-hand run is drawn first, and
-    /// between the words of a right-to-left line.
-    #[test]
-    fn word_gaps_follow_position_not_drawing_order() {
-        let mut v = Vec::new();
-        word(&mut v, "19.4", 40.0, 10.0, 6.0);
-        word(&mut v, "20.0", 10.0, 10.0, 6.0);
-        assert_eq!(layout(v).plain_text(), "20.0 19.4");
-        let mut v = Vec::new();
-        // "שלום עולם" drawn visually: עולם reversed on the left, שלום reversed on the right.
-        word(&mut v, "םלוע", 10.0, 10.0, 6.0);
-        word(&mut v, "םולש", 40.0, 10.0, 6.0);
-        assert_eq!(layout(v).plain_text(), "שלום עולם");
-    }
-
-    /// #2667: a number or punctuation on a right-to-left line must not split it into separately reversed words.
-    #[test]
-    fn rtl_line_with_number_and_punctuation_reads_in_logical_order() {
-        let line = |words: &[&str]| {
-            let mut v = Vec::new();
-            let mut x = 10.0;
-            for w in words {
-                word(&mut v, w, x, 10.0, 6.0);
-                x += w.chars().count() as f32 * 6.0 + 6.0;
-            }
-            layout(v).plain_text()
-        };
-        // Each line as drawn, left to right.
-        assert_eq!(line(&["םילקש", "120", "ריחמ"]), "מחיר 120 שקלים");
-        assert_eq!(line(&[".הקידב", "ךמסמ", "והז", ":תירבע"]), "עברית: זהו מסמך בדיקה.");
-        assert_eq!(line(&["باتك", "12.5", "ددع"]), "عدد 12.5 كتاب");
-        assert_eq!(line(&["םלוע", "םולש"]), "שלום עולם");
-        assert_eq!(line(&["Total", "םולש", "price"]), "Total שלום price");
-    }
-
-    /// Two lines, "ab cd" and "e fg": words stop at blank glyphs, word gaps and line ends.
-    #[test]
-    fn words_and_lines_around_a_glyph() {
-        let t = PageText {
-            glyphs: Vec::from(["a", "b", " ", "c", "d", "e", "f", "g"].map(|s| TextGlyph {
-                text: s.into(),
-                rect: [0.0; 4],
-                quad: [[0.0; 2]; 4],
-                direction: [1.0, 0.0],
-            })),
-            line_of: vec![0, 0, 0, 0, 0, 1, 1, 1],
-            space_before: vec![false, false, false, false, false, false, true, false],
-        };
-        assert_eq!(t.word_at(1), Some((0, 1)));
-        assert_eq!(t.word_at(3), Some((3, 4)));
-        assert_eq!(t.word_at(4), Some((3, 4)));
-        assert_eq!(t.word_at(5), Some((5, 5)));
-        assert_eq!(t.word_at(7), Some((6, 7)));
-        assert_eq!(t.line_at(2), Some((0, 4)));
-        assert_eq!(t.line_at(6), Some((5, 7)));
-        assert_eq!(t.word_at(8), None);
-        assert_eq!(t.line_at(8), None);
-        assert_eq!(PageText::default().line_at(0), None);
-    }
-
-    /// A 400 × 400 page drawing `ops` with Helvetica as /F1 and Courier as /F2.
-    fn text_page(ops: &str) -> Pdf {
-        use lopdf::{Document, Object, Stream, dictionary};
-        let mut doc = Document::with_version("1.7");
-        let helvetica = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Helvetica" });
-        let courier = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Courier" });
-        let content = doc.add_object(Stream::new(dictionary! {}, ops.as_bytes().to_vec()));
-        let pages = doc.new_object_id();
-        let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(400), Object::Integer(400)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => helvetica, "F2" => courier}}, "Contents" => content });
-        doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
-        let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
-        doc.trailer.set("Root", catalog);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).unwrap();
-        Pdf::new(std::sync::Arc::new(bytes)).unwrap()
-    }
-
-    /// `body` shown in /F`font` at `size` with its baseline turned `degrees` counter-clockwise.
-    fn turned(degrees: f64, font: u8, size: f64, x: f64, y: f64, body: &str) -> String {
-        let (s, c) = degrees.to_radians().sin_cos();
-        format!("BT /F{font} {size} Tf {c:.6} {s:.6} {:.6} {c:.6} {x:.4} {y:.4} Tm {body} ET\n", -s)
-    }
-
-    fn page_text(ops: &str) -> String {
-        extract_page(&text_page(ops), 0, &InterpreterSettings::default()).unwrap().plain_text()
-    }
-
-    #[test]
-    fn short_doubled_word_at_same_origin_does_not_interleave() {
-        let ops = "BT /F1 12 Tf 50 Tz 1 0 0 1 100 200 Tm (world) Tj ET\n".repeat(2);
-        assert_single_word(page_glyphs(&ops));
-    }
-
-    #[test]
-    fn short_near_shadow_does_not_interleave() {
-        let ops = "BT /F1 12 Tf 50 Tz 1 0 0 1 100 200 Tm (world) Tj ET\nBT /F1 12 Tf 50 Tz 1 0 0 1 101 200 Tm (world) Tj ET\n";
-        assert_single_word(page_glyphs(ops));
-    }
-
-    #[test]
-    fn turned_short_doubled_word_does_not_interleave() {
-        let one = turned(37.0, 1, 12.0, 100.0, 200.0, "50 Tz (world) Tj");
-        assert_single_word(page_glyphs(&(one.clone() + &one)));
-    }
-
-    #[test]
-    fn large_backward_tj_adjustment_stays_in_one_run() {
-        let text = page_glyphs("BT /F1 12 Tf 50 Tz 1 0 0 1 100 200 Tm [(wor) 3000 (ld)] TJ ET");
-        assert_eq!(text.plain_text(), "ld wor");
-        assert_eq!(text.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["l", "d", "w", "o", "r"]);
-        assert!(text.line_of.iter().all(|line| *line == 0));
-        assert_eq!(text.space_before, [false, false, true, false, false]);
-    }
-
-    #[test]
-    fn reset_prefix_requires_one_glyph_height_of_progress() {
-        let mut glyphs = Vec::new();
-        word(&mut glyphs, "abc", 10.0, 10.0, 6.0);
-        word(&mut glyphs, "abc", 10.0, 10.0, 6.0);
-        let glyphs: Vec<&TextGlyph> = glyphs.iter().collect();
-        assert!(!restarts_run(&glyphs, 0, 3, 9.99));
-        assert!(!restarts_run(&glyphs, 0, 3, 10.0));
-        assert!(restarts_run(&glyphs, 0, 3, 10.01));
-    }
-
-    #[test]
-    fn reset_prefix_uses_the_existing_redraw_position_tolerance() {
-        let mut near = Vec::new();
-        word(&mut near, "abc", 10.0, 10.0, 6.0);
-        word(&mut near, "abc", 11.99, 10.0, 6.0);
-        let near: Vec<&TextGlyph> = near.iter().collect();
-        assert!(restarts_run(&near, 0, 3, 10.01));
-
-        let mut far = Vec::new();
-        word(&mut far, "abc", 10.0, 10.0, 6.0);
-        word(&mut far, "abc", 12.01, 10.0, 6.0);
-        let far: Vec<&TextGlyph> = far.iter().collect();
-        assert!(!restarts_run(&far, 0, 3, 10.01));
-    }
-
-    #[test]
-    fn reset_prefix_rejects_non_finite_positions() {
-        let mut glyphs = Vec::new();
-        word(&mut glyphs, "abc", 10.0, 10.0, 6.0);
-        word(&mut glyphs, "abc", 10.0, 10.0, 6.0);
-        glyphs[3].rect[0] = f32::NAN;
-        let glyphs: Vec<&TextGlyph> = glyphs.iter().collect();
-        assert!(!restarts_run(&glyphs, 0, 3, 10.01));
-    }
-
-    #[test]
-    fn turned_lines_group_along_their_baseline() {
-        // Two lines 13 pt apart, words separated by TJ offsets (no space glyphs), the second
-        // line drawn first. Turned away from the quarter turns, the lines' boxes overlap.
-        for degrees in [12.0, 30.0, 37.0, 45.0, 60.0, 135.0, 200.0, 300.0, -45.0] {
-            let (s, c) = f64::to_radians(degrees).sin_cos();
-            let second = turned(degrees, 1, 12.0, 200.0 + s * 13.0, 200.0 - c * 13.0, "[(Second) -400 (line) -400 (here)] TJ");
-            let first = turned(degrees, 1, 12.0, 200.0, 200.0, "[(First) -400 (line) -400 (text)] TJ");
-            assert_eq!(page_text(&(second + &first)), "First line text\nSecond line here", "{degrees}°");
-        }
-    }
-
-    #[test]
-    fn crossing_turned_lines_stay_apart() {
-        // Lines at 30° and −30° crossing each other, their glyphs drawn alternately.
-        let (up, down) = ("Upward words here", "Downward words now");
-        let mut ops = String::new();
-        let (s, c) = f64::to_radians(30.0).sin_cos();
-        for (k, (a, b)) in up.chars().zip(down.chars()).enumerate() {
-            let along = 7.2 * k as f64;
-            ops += &turned(30.0, 2, 12.0, 100.0 + c * along, 150.0 + s * along, &format!("({a}) Tj"));
-            ops += &turned(-30.0, 2, 12.0, 100.0 + c * along, 250.0 - s * along, &format!("({b}) Tj"));
-        }
-        ops += &turned(-30.0, 2, 12.0, 100.0 + c * 7.2 * 17.0, 250.0 - s * 7.2 * 17.0, "(w) Tj");
-        assert_eq!(page_text(&ops), "Downward words now\nUpward words here");
-    }
-
-    #[test]
-    fn text_along_a_curve_is_one_line() {
-        // Courier glyphs (7.2 pt advance) set on circles of radius 90 around (200, 200): over
-        // the top reading clockwise, under the bottom reading counter-clockwise, and a full ring.
-        let arc = |text: &str, from: f64, clockwise: bool, radius: f64| {
-            let step = (7.2 / radius).to_degrees() * if clockwise { -1.0 } else { 1.0 };
-            let mut ops = String::new();
-            for (k, ch) in text.chars().enumerate() {
-                let a = from + step * k as f64;
-                let (s, c) = a.to_radians().sin_cos();
-                ops += &turned(if clockwise { a - 90.0 } else { a + 90.0 }, 2, 12.0, 200.0 + radius * c, 200.0 + radius * s, &format!("({ch}) Tj"));
-            }
-            ops
-        };
-        assert_eq!(page_text(&arc("CURVED STAMP TEXT", 150.0, true, 90.0)), "CURVED STAMP TEXT");
-        assert_eq!(page_text(&arc("BOTTOM ARC WORDS", 220.0, false, 90.0)), "BOTTOM ARC WORDS");
-        assert_eq!(page_text(&arc("ROUND SEAL OF THE COMPANY LIMITED", 180.0, true, 50.0)), "ROUND SEAL OF THE COMPANY LIMITED");
-    }
-
-    #[test]
-    fn sheared_text_keeps_its_word_gaps() {
-        // The baseline climbs at about 31° while the glyphs stay upright.
-        let ops = "BT /F1 12 Tf 1 0.6 0 1 100 200 Tm [(Sheared) -400 (first)] TJ 1 0.6 0 1 100 187 Tm [(Sheared) -400 (second)] TJ ET";
-        assert_eq!(page_text(ops), "Sheared first\nSheared second");
-    }
-
-    #[test]
-    fn turned_text_keeps_its_place_in_the_reading_order() {
-        // A turned label between a heading and its caption reads between them, as it did when
-        // it was laid out with the horizontal text; a vertical body still follows its heading.
-        let ops = "BT /F1 14 Tf 1 0 0 1 50 360 Tm (Heading above) Tj ET\n".to_string()
-            + &turned(30.0, 1, 12.0, 80.0, 250.0, "(Turned label) Tj")
-            + "BT /F1 12 Tf 1 0 0 1 50 150 Tm (Caption below) Tj ET\n";
-        assert_eq!(page_text(&ops), "Heading above\nTurned label\nCaption below");
-    }
-
-    #[test]
-    fn turned_glyphs_keep_their_shape_and_direction() {
-        // 30° counter-clockwise on the page is 30° up from the x axis in view space (y down).
-        let pdf = text_page(&(turned(30.0, 1, 20.0, 100.0, 100.0, "(Ab) Tj") + "BT /F1 20 Tf 1 0 0.5 1 100 300 Tm (Ab) Tj ET"));
-        let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
-        assert_eq!(text.plain_text(), "Ab\nAb");
-        for g in &text.glyphs {
-            assert!(g.quad.iter().flatten().chain(&g.direction).chain(&g.rect).all(|c| c.is_finite()), "{g:?}");
-            let bounds = g.quad.iter().fold([f32::INFINITY, f32::INFINITY, f32::NEG_INFINITY, f32::NEG_INFINITY], |r, p| {
-                [r[0].min(p[0]), r[1].min(p[1]), r[2].max(p[0]), r[3].max(p[1])]
-            });
-            assert_eq!(g.rect, bounds, "the box bounds the quad");
-            let [x, y] = [g.quad[1][0] - g.quad[0][0], g.quad[1][1] - g.quad[0][1]];
-            assert!(
-                (x * g.direction[1] - y * g.direction[0]).abs() < 1e-3 && x * g.direction[0] + y * g.direction[1] > 0.0,
-                "quad[0] → quad[1] runs along the direction: {g:?}"
-            );
-        }
-        let (skewed, turned) = (&text.glyphs[0], &text.glyphs[2]);
-        assert!((turned.direction[0] - 30f32.to_radians().cos()).abs() < 1e-6 && (turned.direction[1] + 0.5).abs() < 1e-6, "{turned:?}");
-        assert_eq!(skewed.direction, [1.0, 0.0]);
-        let slant = skewed.quad[3][0] - skewed.quad[0][0];
-        assert!((slant - 10.0).abs() < 1e-3, "the skewed glyph's upright edge leans by half its 20 pt height: {skewed:?}");
-    }
-
-    /// The operators drawing each `(text, text matrix)` run in Helvetica 12 pt, one text object per run.
-    fn run_ops(runs: &[(&str, &str)]) -> String {
-        runs.iter().map(|(text, tm)| format!("BT /F1 12 Tf {tm} Tm ({text}) Tj ET\n")).collect()
-    }
-
-    fn page_glyphs(ops: &str) -> PageText {
-        extract_page(&text_page(ops), 0, &InterpreterSettings::default()).unwrap()
-    }
-
-    fn assert_single_word(text: PageText) {
-        assert_eq!(text.plain_text(), "world");
-        assert_eq!(text.glyphs.iter().map(|g| g.text.as_str()).collect::<String>(), "world");
-        assert_eq!(text.line_of, [0; 5]);
-        assert_eq!(text.space_before, [false; 5]);
-    }
-
-    #[test]
-    fn runs_printed_over_each_other_stay_whole_at_any_angle() {
-        // Two runs that start at one point (exact overprint), that start 40 pt along and 3 pt down
-        // (shifted), and that are 14 pt apart (clear): at 0° and at 37°, each run comes out whole.
-        let tm = |angle: f32, along: f32, down: f32| {
-            let (s, c) = angle.to_radians().sin_cos();
-            let (x, y) = (100.0 + along * c - down * s, 200.0 + along * s + down * c);
-            format!("{c:.6} {s:.6} {:.6} {c:.6} {x:.4} {y:.4}", -s)
-        };
-        let (alpha, delta) = ("Alpha beta gamma", "Delta epsilon zeta");
-        for angle in [0.0, 37.0] {
-            for (along, down) in [(0.0, 0.0), (40.0, -3.0), (0.0, -14.0)] {
-                let text = page_glyphs(&run_ops(&[(alpha, &tm(angle, 0.0, 0.0)), (delta, &tm(angle, along, down))]));
-                for run in [alpha, delta] {
-                    assert!(
-                        !text.find(run).is_empty(),
-                        "{run:?} whole at {angle}° with the second run {along} pt along and {down} pt across: {:?}",
-                        text.plain_text()
-                    );
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn a_run_drawn_over_a_line_leaves_the_line_whole() {
-        // "XX" is drawn over the middle of "beta" after the line, so it is a run of its own that
-        // overlaps the line. The line must still come out as one whole line.
-        let text = page_glyphs(&run_ops(&[("Alpha beta gamma", "1 0 0 1 100 200"), ("XX", "1 0 0 1 136 200")]));
-        let flat = text.plain_text();
-        assert!(flat.contains("Alpha beta gamma"), "{flat:?}");
-        assert!(flat.contains("XX") && !flat.contains('\n'), "{flat:?}");
-    }
-
-    #[test]
-    fn a_combining_mark_drawn_last_stays_with_its_letter() {
-        // "ab", then a far-off "Z", then a zero-width combining mark at the start of "b". The mark
-        // is a run of its own, but it has no extent, so it goes back next to "b".
-        let mut v = Vec::new();
-        word(&mut v, "ab", 10.0, 10.0, 6.0);
-        v.push(g("Z", 200.0, 10.0, 206.0));
-        v.push(g("\u{301}", 16.0, 10.0, 16.0));
-        let t = layout(v);
-        assert_eq!(t.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["a", "b", "\u{301}", "Z"]);
-    }
-
-    #[test]
-    fn runs_differing_only_in_glyph_boundaries_are_not_redraws() {
-        // "ab" + "c" and "a" + "bc" have the same letters over the same places, but the glyph
-        // boundaries differ, so the second is not a redraw of the first and both stay.
-        let mut v = vec![g("ab", 10.0, 10.0, 16.0), g("c", 16.0, 10.0, 22.0)];
-        v.push(g("Z", 200.0, 10.0, 206.0));
-        v.push(g("a", 10.0, 10.0, 16.0));
-        v.push(g("bc", 16.0, 10.0, 22.0));
-        assert_eq!(layout(v).glyphs.len(), 5);
-    }
-
-    #[test]
-    fn many_combining_marks_stay_with_their_letters() {
-        // 400 letters on one line, then a zero-width mark at the start of each one, drawn after the whole line:
-        // the marks form one run of their own, and each goes back next to its letter, in order.
-        let letters: Vec<String> = (0..400).map(|i| char::from(b'a' + (i % 26) as u8).to_string()).collect();
-        let mut v = Vec::new();
-        for (i, c) in letters.iter().enumerate() {
-            let x = 10.0 + i as f32 * 6.0;
-            v.push(g(c, x, 10.0, x + 6.0));
-        }
-        for i in 0..letters.len() {
-            let x = 10.0 + i as f32 * 6.0;
-            v.push(g("\u{301}", x, 10.0, x));
-        }
-        let t = layout(v);
-        let expected: Vec<&str> = letters.iter().flat_map(|c| [c.as_str(), "\u{301}"]).collect();
-        assert_eq!(t.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), expected);
-        assert!(t.line_of.iter().all(|line| *line == 0));
-    }
-
-    /// `count` runs of three glyphs, each starting within 3 pt of x = 10 on one baseline, so they all overprint one
-    /// another. Every glyph has a text of its own, so no glyph is taken for a fake-bold copy. With `separated`, each run
-    /// follows a far-off glyph, which makes it a run of its own.
-    fn overprinted_runs(count: usize, separated: bool) -> Vec<TextGlyph> {
-        let mut v = Vec::new();
-        for k in 0..count {
-            let text: String = (0..3).map(|i| char::from_u32(0x4E00 + (3 * k + i) as u32).unwrap()).collect();
-            word(&mut v, &text, 10.0 + (k * 7 % 31) as f32 * 0.1, 10.0, 6.0);
-            if separated {
-                let far = char::from_u32(0x2500 + k as u32).unwrap().to_string();
-                v.push(g(&far, 500.0, 10.0, 506.0));
-            }
-        }
-        v
-    }
-
-    #[test]
-    fn a_dense_overprint_joins_its_runs_and_keeps_each_whole() {
-        // 150 runs of three glyphs: about 100 000 overlapping pairs, far more than the sweep's budget. The segment is
-        // joined as one component, so the sweep is skipped, and each run still comes out whole.
-        let v = overprinted_runs(150, false);
-        let refs: Vec<&TextGlyph> = v.iter().collect();
-        let height = |i: usize| (refs[i].rect[3] - refs[i].rect[1]).max(0.1);
-        let mut sc = Scratch { text: (0..150).map(|k| Run { start: 3 * k, end: 3 * k + 3 }).collect(), ..Default::default() };
-        assert!(collide(&refs, &height, 10.0, &mut sc), "more pairs than the budget");
-        assert_eq!(sc.units.len(), 1, "one component");
-
-        let v = overprinted_runs(150, true);
-        let runs: Vec<String> = (0..150).map(|k| v[4 * k..4 * k + 3].iter().map(|g| g.text.as_str()).collect()).collect();
-        let t = layout(v);
-        assert_eq!(t.glyphs.len(), 600);
-        for run in &runs {
-            assert!(!t.find(run).is_empty(), "{run:?} whole in {:?}", t.plain_text());
-        }
-    }
-
-    #[test]
-    fn overlapping_rows_each_start_a_word() {
-        // 60 rows of three glyphs, each row starting 2 pt right of the one before and overprinting it, so every row
-        // is a forced word break. The rows are separated by far-off glyphs, which makes each one a run of its own.
-        // Every glyph has a text of its own, so no glyph is taken for a fake-bold copy.
-        let mut v = Vec::new();
-        let mut rows = Vec::new();
-        for k in 0..60 {
-            let text: String = (0..3).map(|i| char::from_u32(0x0400 + (3 * k + i) as u32).unwrap()).collect();
-            word(&mut v, &text, 10.0 + 2.0 * k as f32, 10.0, 6.0);
-            v.push(g(&char::from_u32(0x0500 + k as u32).unwrap().to_string(), 500.0, 10.0, 506.0));
-            rows.push(text);
-        }
-        let t = layout(v);
-        let expected: String = rows.join(" ");
-        assert!(t.plain_text().starts_with(&expected), "{:?}", t.plain_text());
-    }
-
-    #[test]
-    fn a_long_line_keeps_every_word_gap() {
-        // 1500 five-letter words on one line, a word gap after each: every gap is found, and only those.
-        let mut v = Vec::new();
-        let mut words = Vec::new();
-        for w in 0..1500 {
-            let text: String = (0..5).map(|i| char::from(b'a' + ((w * 7 + i * 3) % 26) as u8)).collect();
-            word(&mut v, &text, 10.0 + w as f32 * 36.0, 10.0, 6.0);
-            words.push(text);
-        }
-        assert_eq!(layout(v).plain_text(), words.join(" "));
-    }
-
-    #[test]
-    fn a_redraw_is_found_among_look_alike_runs_up_to_the_candidate_limit() {
-        // 40 runs of "abc" share a text and a grid cell, but each differs from every other by more than a fifth of a
-        // line in its second or third glyph, so none redraws another. A run of "abc" at the place of the newest run is
-        // found, as the newest candidates are checked first. One at the place of the oldest run is 40 candidates back,
-        // past the limit, so it is kept.
-        let abc = |v: &mut Vec<TextGlyph>, k: usize| {
-            let (b, c) = (16.0 + 2.5 * (k % 4) as f32, 22.0 + 2.5 * (k / 4) as f32);
-            v.push(g("a", 10.0, 10.0, 16.0));
-            v.push(g("b", b, 10.0, b + 6.0));
-            v.push(g("c", c, 10.0, c + 6.0));
-        };
-        let far = |v: &mut Vec<TextGlyph>| {
-            for _ in 0..4 {
-                let x = 500.0 + 10.0 * v.len() as f32;
-                v.push(g("|", x, 10.0, x + 6.0));
-            }
-        };
-        let mut v = Vec::new();
-        for k in 0..40 {
-            abc(&mut v, k);
-            far(&mut v);
-        }
-        abc(&mut v, 39);
-        far(&mut v);
-        assert_eq!(layout(v.clone()).glyphs.iter().filter(|g| g.text == "a").count(), 40);
-        abc(&mut v, 0);
-        assert_eq!(layout(v).glyphs.iter().filter(|g| g.text == "a").count(), 41);
-    }
-
-    #[test]
-    fn a_run_redrawn_at_the_same_place_is_printed_once() {
-        // "Hello world" drawn again 0.1 pt away (doubled text) prints once. The same words far
-        // below are a separate line, as they are not a redraw.
-        let ops = run_ops(&[("Hello world", "1 0 0 1 100 200"), ("Hello world", "1 0 0 1 100.1 200.1"), ("Hello world", "1 0 0 1 100 100")]);
-        assert_eq!(page_text(&ops), "Hello world\nHello world");
-    }
-
-    #[test]
-    fn a_redraw_is_found_past_an_earlier_run_with_the_same_key() {
-        // Two "Hello" runs share a text and a grid cell but do not redraw each other: the second is
-        // tracked wider. A third run redraws the second and is dropped. A far-off "Z" keeps each run
-        // a segment of its own.
-        let mut v = Vec::new();
-        word(&mut v, "Hello", 10.0, 10.0, 6.0);
-        v.push(g("Z", 200.0, 10.0, 206.0));
-        word(&mut v, "Hello", 10.5, 10.0, 9.0);
-        v.push(g("Z", 300.0, 10.0, 306.0));
-        word(&mut v, "Hello", 10.6, 10.0, 9.0);
-        let t = layout(v);
-        assert_eq!(t.glyphs.iter().filter(|g| g.text == "H").count(), 2, "{:?}", t.plain_text());
-        assert_eq!(t.glyphs.len(), 12);
-    }
-
-    #[test]
-    fn runs_that_only_touch_or_overlap_slightly_still_join() {
-        // "beta" is drawn first, then "Alpha" to its left: 2 pt apart (touching) or 2 pt overlapping
-        // (negative spacing). Both come out as one line in reading order. Where the word space goes
-        // for reversed fragments is not asserted here.
-        let mut v = Vec::new();
-        word(&mut v, "beta", 42.0, 10.0, 6.0);
-        word(&mut v, "Alpha", 10.0, 10.0, 6.0);
-        let t = layout(v);
-        assert_eq!(t.plain_text().replace(' ', ""), "Alphabeta");
-        assert!(t.line_of.iter().all(|line| *line == 0));
-        let mut v = Vec::new();
-        word(&mut v, "beta", 38.0, 10.0, 6.0);
-        word(&mut v, "Alpha", 10.0, 10.0, 6.0);
-        let t = layout(v);
-        assert_eq!(t.plain_text(), "Alphabeta");
-    }
-
-    /// A three-row table, "Name Qty / Apple 12 / Pear 7": the columns sit far enough apart that
-    /// reading order takes one column, then the other.
-    fn table() -> PageText {
-        let mut v = Vec::new();
-        for (row, (name, qty)) in [("Name", "Qty"), ("Apple", "12"), ("Pear", "7")].into_iter().enumerate() {
-            let y = 10.0 + row as f32 * 14.0;
-            word(&mut v, name, 10.0, y, 6.0);
-            word(&mut v, qty, 100.0, y, 6.0);
-        }
-        layout(v)
-    }
-
-    /// Issue #740: a column selection takes only what is inside the rectangle.
-    #[test]
-    fn a_column_selection_takes_one_table_column() {
-        let t = table();
-        assert_eq!(t.plain_text(), "Name\nApple\nPear\nQty\n12\n7", "reading order is column by column");
-        let qty = t.glyphs_in([95.0, 0.0, 130.0, 60.0]);
-        assert_eq!(t.column_text(&qty), "Qty\n12\n7");
-        assert_eq!(t.glyph_rects(&qty).len(), 3, "one highlight per row");
-        // Corners in either order.
-        assert_eq!(t.glyphs_in([130.0, 60.0, 95.0, 0.0]), qty);
-    }
-
-    /// Across columns the text comes out row by row, cells separated by tabs.
-    #[test]
-    fn a_column_selection_across_columns_reads_row_by_row() {
-        let t = table();
-        let all = t.glyphs_in([0.0, 0.0, 200.0, 60.0]);
-        assert_eq!(t.column_text(&all), "Name\tQty\nApple\t12\nPear\t7");
-        // The middle row only, and only the start of "Apple": centres decide.
-        let part = t.glyphs_in([0.0, 25.0, 31.0, 33.0]);
-        assert_eq!(t.column_text(&part), "Appl");
-        assert_eq!(t.glyph_rects(&part), vec![[10.0, 24.0, 34.0, 34.0]]);
-    }
-
-    /// A rectangle that misses every glyph, or is not a number, selects nothing.
-    #[test]
-    fn an_empty_or_degenerate_column_selection_is_empty() {
-        let t = table();
-        for r in [[300.0, 300.0, 400.0, 400.0], [f32::NAN, 0.0, 200.0, 60.0], [50.0, 50.0, 50.0, 50.0]] {
-            let none = t.glyphs_in(r);
-            assert!(none.is_empty(), "{r:?}");
-            assert_eq!(t.column_text(&none), "");
-            assert!(t.glyph_rects(&none).is_empty());
-        }
-        assert_eq!(PageText::default().column_text(&[0, 7, usize::MAX]), "", "indices past the text are ignored");
-    }
-
-    /// Right-to-left rows put their cells right to left.
-    #[test]
-    fn right_to_left_rows_read_right_to_left() {
-        let mut v = Vec::new();
-        // "שלום" (right) and "עולם" (left), each drawn visually.
-        word(&mut v, "םולש", 100.0, 10.0, 6.0);
-        word(&mut v, "םלוע", 10.0, 10.0, 6.0);
-        let t = layout(v);
-        let all = t.glyphs_in([0.0, 0.0, 200.0, 30.0]);
-        assert_eq!(t.column_text(&all), "שלום\tעולם");
-    }
-
-    /// Vertical lines (CJK vertical writing) come out one per row, in reading order.
-    #[test]
-    fn vertical_lines_keep_reading_order() {
-        // Written downwards: the em box's edge towards the next line is its left one.
-        let cell = |t: &str, x: f32, y: f32| TextGlyph {
-            text: t.into(),
-            rect: [x, y, x + 10.0, y + 10.0],
-            quad: [[x, y], [x, y + 10.0], [x + 10.0, y + 10.0], [x + 10.0, y]],
-            direction: [0.0, 1.0],
-        };
-        let t = PageText {
-            // Right column 日本 first, then the left column 語文, each top to bottom.
-            glyphs: vec![cell("日", 40.0, 10.0), cell("本", 40.0, 20.0), cell("語", 20.0, 10.0), cell("文", 20.0, 20.0)],
-            line_of: vec![0, 0, 1, 1],
-            space_before: vec![false; 4],
-        };
-        let all = t.glyphs_in([0.0, 0.0, 60.0, 40.0]);
-        assert_eq!(t.column_text(&all), "日本\n語文");
-    }
-
-    /// An embedded TrueType font with no `/Encoding`, flagged `flags`, its `/ToUnicode` (if
-    /// any) mapping only printable ASCII, as OCR engines write the text layer of a scan.
-    fn ocr_layer_text(flags: i64, ascii_to_unicode: bool) -> String {
-        use lopdf::{Document, Object, Stream, dictionary};
-        let mut doc = Document::with_version("1.7");
-        let program = doc.add_object(Stream::new(dictionary! {}, include_bytes!("../../../assets/fonts/Inter-Regular.ttf").to_vec()));
-        let descriptor =
-            doc.add_object(dictionary! { "Type" => "FontDescriptor", "FontName" => "Inter-Regular", "Flags" => flags, "FontFile2" => program });
-        let mut font = dictionary! { "Type" => "Font", "Subtype" => "TrueType", "BaseFont" => "Inter-Regular", "FontDescriptor" => descriptor };
-        if ascii_to_unicode {
-            let cmap = b"/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CMapName /Ascii def /CMapType 2 def 1 begincodespacerange <00> <FF> endcodespacerange 1 beginbfrange <20> <7E> <0020> endbfrange endcmap CMapName currentdict /CMap defineresource pop end end";
-            font.set("ToUnicode", doc.add_object(Stream::new(dictionary! {}, cmap.to_vec())));
-        }
-        let font = doc.add_object(font);
-        // WinAnsi bytes: "Rückfragen für Überhitzungsschutz: können, weiß, Café".
-        let mut ops = b"BT /F1 14 Tf 1 0 0 1 20 200 Tm (".to_vec();
-        ops.extend_from_slice(b"R\xfcckfragen f\xfcr \xdcberhitzungsschutz: k\xf6nnen, wei\xdf, Caf\xe9");
-        ops.extend_from_slice(b") Tj ET");
-        let content = doc.add_object(Stream::new(dictionary! {}, ops));
-        let pages = doc.new_object_id();
-        let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(400), Object::Integer(400)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
-        doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
-        let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
-        doc.trailer.set("Root", catalog);
-        let mut bytes = Vec::new();
-        doc.save_to(&mut bytes).unwrap();
-        let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
-        extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap().plain_text()
-    }
-
-    #[test]
-    fn truetype_without_an_encoding_reads_its_codes_as_win_ansi() {
-        // Café: 0xE9 is /Oslash in StandardEncoding, so reading the codes as Standard first and
-        // WinAnsi only for the gaps would still give "CafØ".
-        let expected = "Rückfragen für Überhitzungsschutz: können, weiß, Café";
-        assert_eq!(ocr_layer_text(4, false), expected, "symbolic, no /ToUnicode");
-        assert_eq!(ocr_layer_text(32, true), expected, "nonsymbolic, /ToUnicode for ASCII only");
-    }
-}
+mod tests;
diff --git a/crates/render/src/text/device.rs b/crates/render/src/text/device.rs
new file mode 100644
index 0000000000..eba4d9c1c3
--- /dev/null
+++ b/crates/render/src/text/device.rs
@@ -0,0 +1,498 @@
+use super::layout::{Flow, along_baseline, arrange_flow, compatible, continues, from_upright, to_upright, unrolled};
+use super::*;
+
+/// Largest sine of the angle between a glyph's writing direction and a flow's for the glyph to be
+/// laid out in that flow's frame. Turning an em box by θ moves its edges along the line by up to
+/// h·sin θ, so below the layout's word-gap tolerance (`WORD_GAP` · h) the boxes still read as they
+/// would unturned.
+pub(super) const DIRECTION_TOLERANCE: f64 = WORD_GAP as f64;
+
+/// A word gap is wider than the line's typical letter gap by this fraction of the line height.
+pub(super) const WORD_GAP: f32 = 0.15;
+
+/// A glyph with its writing direction to the nearest quarter turn (right, down, left, up) and as
+/// a unit vector.
+pub(super) type Drawn = (usize, [f64; 2], TextGlyph);
+
+pub(super) struct TextDevice {
+    /// Every glyph in content order.
+    pub(super) glyphs: Vec<Drawn>,
+    /// How many marked content sequences are open.
+    depth: usize,
+    /// The outermost open `/ActualText` replacement: its depth, text and the glyphs drawn inside
+    /// it (with no text of their own yet).
+    actual: Option<(usize, String, Vec<Drawn>)>,
+    /// Every `/ActualText` replacement made on the page.
+    pub(super) replaced: Vec<Replaced>,
+    filter: TextFilter,
+    excluded_depth: Option<usize>,
+    actual_filtered: bool,
+    partial_replacement: bool,
+}
+
+/// An `/ActualText` replacement: the glyph standing for it in `TextDevice::glyphs` (none for an
+/// empty replacement), its text, and the text and box of each replaced glyph that has Unicode of
+/// its own.
+pub(super) struct Replaced {
+    pub(super) at: Option<usize>,
+    pub(super) text: String,
+    pub(super) originals: Vec<(String, [f32; 4])>,
+}
+
+/// Grid cell size, in points, for finding the glyphs drawn at a place.
+const CELL: f32 = 8.0;
+
+/// Most grid cells searched around one place: a glyph so tall its tolerance spans more is skipped.
+const MAX_CELLS: i64 = 4096;
+
+/// Most work (grid cells visited plus glyphs compared) the redraw dedupe in `TextDevice::finish`
+/// may do on one page. A hostile page stacking ~10^5 glyphs and ~10^5 replacements at one spot
+/// would otherwise make ~10^10 comparisons; past the budget the remaining replacements keep
+/// their unmarked redraws (the text reads twice, as it would without `/ActualText`).
+const MAX_REDRAW_WORK: usize = 1 << 22;
+
+/// Most replacement text bytes the redraw dedupe in `TextDevice::finish` copies on one page.
+pub(super) const MAX_REDRAW_TEXT: usize = 1 << 22;
+
+#[cfg(test)]
+thread_local! {
+    /// Replacement text bytes given to redraws on this thread.
+    pub(super) static REDRAW_TEXT_BYTES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+fn cell(v: f32) -> i64 {
+    // Glyph boxes are finite (`draw_glyph` and `merge` drop the rest); `as` saturates.
+    (v / CELL).floor() as i64
+}
+
+/// How far a redrawn glyph may sit from the one it redraws: a fifth of its height, as in `redraws`.
+fn redraw_tolerance(rect: &[f32; 4]) -> f32 {
+    0.2 * (rect[3] - rect[1]).max(0.1)
+}
+
+/// One glyph carrying `text`, boxed around `drawn` in their writing direction; `None` when they
+/// span several lines or writing directions (one box would break selection and line grouping).
+fn merge(drawn: &[Drawn], text: String) -> Option<Drawn> {
+    let first = drawn.first()?;
+    let (quarter, u) = (first.0, first.1);
+    // Across the line: from the writing direction a quarter turn towards the line's bottom.
+    let n = [-u[1], u[0]];
+    let along = |p: &[f32; 2]| f64::from(p[0]) * u[0] + f64::from(p[1]) * u[1];
+    let across = |p: &[f32; 2]| f64::from(p[0]) * n[0] + f64::from(p[1]) * n[1];
+    let height = across(&first.2.quad[0]) - across(&first.2.quad[3]);
+    let (mut s0, mut s1, mut t0, mut t1) = (f64::INFINITY, f64::NEG_INFINITY, f64::INFINITY, f64::NEG_INFINITY);
+    for p in drawn.iter().flat_map(|d| d.2.quad.iter()) {
+        (s0, s1) = (s0.min(along(p)), s1.max(along(p)));
+        (t0, t1) = (t0.min(across(p)), t1.max(across(p)));
+    }
+    let one_line = drawn.iter().all(|d| compatible(u, d.1)) && t1 - t0 <= 2.0 * height.abs();
+    if !(one_line && s0.is_finite() && s1.is_finite() && t0.is_finite() && t1.is_finite()) {
+        return None;
+    }
+    // The edge towards the next line is the one the first glyph's quad starts on.
+    let (near, far) = if height >= 0.0 { (t1, t0) } else { (t0, t1) };
+    let point = |s: f64, t: f64| [(s * u[0] + t * n[0]) as f32, (s * u[1] + t * n[1]) as f32];
+    let quad = [point(s0, near), point(s1, near), point(s1, far), point(s0, far)];
+    let rect = quad.iter().fold([f32::INFINITY, f32::INFINITY, f32::NEG_INFINITY, f32::NEG_INFINITY], |r, p| {
+        [r[0].min(p[0]), r[1].min(p[1]), r[2].max(p[0]), r[3].max(p[1])]
+    });
+    Some((quarter, u, TextGlyph { text, rect, quad, direction: first.2.direction }))
+}
+
+impl TextDevice {
+    pub(super) fn new() -> Self {
+        TextDevice {
+            glyphs: Vec::new(),
+            depth: 0,
+            actual: None,
+            replaced: Vec::new(),
+            filter: TextFilter::default(),
+            excluded_depth: None,
+            actual_filtered: false,
+            partial_replacement: false,
+        }
+    }
+
+    /// Ends the open `/ActualText` replacement (ISO 32000-2 §14.9.4): its glyphs become one glyph
+    /// carrying the replacement text, boxed around them all. Chrome (Skia) writes one around
+    /// each Thai, Indic or Arabic cluster whose shaped glyphs (a tone mark moved clear of a vowel,
+    /// a ligature) have no Unicode of their own, so without it those marks are lost and the
+    /// words can't be found.
+    ///
+    /// A replacement spanning several lines or writing directions stays per glyph (each glyph's own
+    /// Unicode). An empty one (a soft hyphen at a line break, say) stands for no text at all.
+    fn end_actual_text(&mut self) {
+        let Some((_, text, drawn)) = self.actual.take() else { return };
+        if std::mem::take(&mut self.actual_filtered) {
+            // ActualText has no mapping from replacement words to individual glyphs. A mixed
+            // span cannot be filtered honestly; a wholly excluded span can simply be omitted.
+            self.partial_replacement |= !drawn.is_empty();
+            return;
+        }
+        let Some(glyph) = merge(&drawn, text.clone()) else {
+            self.glyphs.extend(drawn.into_iter().filter(|d| !d.2.text.chars().all(char::is_control)));
+            return;
+        };
+        let originals = drawn.iter().filter(|d| !d.2.text.chars().all(char::is_control)).map(|d| (d.2.text.clone(), d.2.rect)).collect();
+        let at = if text.chars().all(char::is_control) {
+            None
+        } else {
+            self.glyphs.push(glyph);
+            Some(self.glyphs.len() - 1)
+        };
+        self.replaced.push(Replaced { at, text, originals });
+    }
+
+    /// Ends the page. Some producers draw text twice, the copy for an outline, shadow or
+    /// glow, and mark only one drawing with `/ActualText` (Canva). The unmarked redraw of a
+    /// replacement's glyphs (the same text at the same places, in content order) takes the same
+    /// replacement, so the two read alike and line layout drops the copy as a redraw.
+    pub(super) fn finish(&mut self) {
+        self.end_actual_text();
+        if self.replaced.is_empty() {
+            return;
+        }
+        let mut taken = vec![false; self.glyphs.len()];
+        for at in self.replaced.iter().filter_map(|r| r.at) {
+            if let Some(t) = taken.get_mut(at) {
+                *t = true;
+            }
+        }
+        let mut grid: HashMap<(i64, i64), Vec<usize>> = HashMap::new();
+        for (i, g) in self.glyphs.iter().enumerate() {
+            if !taken.get(i).copied().unwrap_or(true) {
+                grid.entry((cell(g.2.rect[0]), cell(g.2.rect[1]))).or_default().push(i);
+            }
+        }
+        // Redraws found: the glyph range and the replacement standing for it.
+        let mut redraws: Vec<(std::ops::Range<usize>, usize)> = Vec::new();
+        let mut budget = MAX_REDRAW_WORK;
+        'replacements: for (k, r) in self.replaced.iter().enumerate() {
+            let Some((_, rect)) = r.originals.first() else { continue };
+            let tol = redraw_tolerance(rect);
+            let (x0, x1, y0, y1) = (cell(rect[0] - tol), cell(rect[0] + tol), cell(rect[1] - tol), cell(rect[1] + tol));
+            if x1.saturating_sub(x0).saturating_add(1).saturating_mul(y1.saturating_sub(y0).saturating_add(1)) > MAX_CELLS {
+                continue;
+            }
+            // Checking one candidate walks its run twice (free, then same).
+            let candidate_cost = r.originals.len().saturating_mul(2).saturating_add(1);
+            for key in (x0..=x1).flat_map(|x| (y0..=y1).map(move |y| (x, y))) {
+                let Some(rest) = budget.checked_sub(1) else { break 'replacements };
+                budget = rest;
+                for &i in grid.get(&key).map_or(&[][..], Vec::as_slice) {
+                    let Some(rest) = budget.checked_sub(candidate_cost) else { break 'replacements };
+                    budget = rest;
+                    let Some(range) = i.checked_add(r.originals.len()).map(|end| i..end) else { continue };
+                    let Some(run) = self.glyphs.get(range.clone()) else { continue };
+                    let free = taken.get(range.clone()).is_some_and(|t| t.iter().all(|t| !t));
+                    let same = run.iter().zip(&r.originals).all(|(g, (text, o))| {
+                        let tol = redraw_tolerance(o);
+                        g.2.text == *text && (g.2.rect[0] - o[0]).abs() < tol && (g.2.rect[1] - o[1]).abs() < tol
+                    });
+                    if free && same {
+                        if let Some(t) = taken.get_mut(range.clone()) {
+                            t.fill(true);
+                        }
+                        redraws.push((range, k));
+                    }
+                }
+            }
+        }
+        if redraws.is_empty() {
+            return;
+        }
+        redraws.sort_by_key(|(range, _)| range.start);
+        let glyphs = std::mem::take(&mut self.glyphs);
+        let mut redraws = redraws.into_iter().peekable();
+        let mut text_left = MAX_REDRAW_TEXT;
+        let mut i = 0;
+        while let Some(g) = glyphs.get(i) {
+            let Some((range, k)) = redraws.next_if(|(range, _)| range.start == i) else {
+                self.glyphs.push(g.clone());
+                i += 1;
+                continue;
+            };
+            let run = glyphs.get(range.clone()).unwrap_or_default();
+            let replacement = self.replaced.get(k).map_or("", |r| r.text.as_str());
+            // Each redraw takes its own copy of the replacement, and one long replacement can
+            // have many redraws: past the budget a redraw keeps its glyphs, as past the work budget.
+            let Some(left) = text_left.checked_sub(replacement.len()) else {
+                self.glyphs.extend_from_slice(run);
+                i = range.end.max(i + 1);
+                continue;
+            };
+            text_left = left;
+            let text = replacement.to_owned();
+            #[cfg(test)]
+            REDRAW_TEXT_BYTES.with(|c| c.set(c.get() + text.len()));
+            if !text.chars().all(char::is_control) {
+                match merge(run, text) {
+                    Some(glyph) => self.glyphs.push(glyph),
+                    None => self.glyphs.extend_from_slice(run),
+                }
+            }
+            i = range.end.max(i + 1);
+        }
+    }
+}
+
+/// Whether `PDFCRAFT_TEXT_DEBUG` is set. `draw_glyph` runs once per glyph and `getenv` scans the
+/// whole environment under a lock, so read it once.
+fn text_debug() -> bool {
+    static DEBUG: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
+    *DEBUG.get_or_init(|| std::env::var_os("PDFCRAFT_TEXT_DEBUG").is_some())
+}
+
+impl<'a> Device<'a> for TextDevice {
+    fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+    fn set_blend_mode(&mut self, _: BlendMode) {}
+    fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'a>, _: &PathDrawMode) {}
+    fn push_clip_path(&mut self, _: &ClipPath) {}
+    fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
+    fn draw_glyph(&mut self, glyph: &Glyph<'a>, transform: Affine, glyph_transform: Affine, _: &Paint<'a>, mode: &GlyphDrawMode) {
+        if self.excluded_depth.is_some() || (self.filter.images && matches!(mode, GlyphDrawMode::Invisible)) {
+            self.actual_filtered |= self.actual.is_some();
+            return;
+        }
+        // Inside an `/ActualText` replacement only the glyph's box matters.
+        let replaced = self.actual.is_some();
+        let text = match glyph.as_unicode() {
+            Some(hayro::hayro_interpret::hayro_cmap::BfString::Char(c)) => c.to_string(),
+            Some(hayro::hayro_interpret::hayro_cmap::BfString::String(s)) => s,
+            None if replaced => String::new(),
+            None => {
+                if text_debug() {
+                    eprintln!(
+                        "NOUNICODE {} {:?}",
+                        if matches!(glyph, Glyph::Type3(_)) { "t3" } else { "ol" },
+                        (transform * glyph_transform).as_coeffs()
+                    );
+                }
+                return;
+            }
+        };
+        if !replaced && text.chars().all(char::is_control) {
+            return;
+        }
+        // Glyph space → view space. Glyph space uses 1000 units per em for outline glyphs; the em
+        // box spans descender (−200) to ascender (800), the advance gives the width.
+        let t = transform * glyph_transform;
+        if text_debug() {
+            let kind = if matches!(glyph, Glyph::Type3(_)) { "t3" } else { "ol" };
+            eprintln!("{kind} {text:?} transform={:?} glyph_transform={:?}", transform.as_coeffs(), glyph_transform.as_coeffs());
+        }
+        let advance = match glyph {
+            Glyph::Outline(g) => {
+                g.advance_width().filter(|a| *a > 0.0).map(f64::from).unwrap_or_else(|| g.outline().bounding_box().width().max(500.0))
+            }
+            Glyph::Type3(g) => g.advance_width().filter(|a| a.is_finite() && *a > 0.0).map(f64::from).unwrap_or(600.0),
+        };
+        // The baseline direction in view space (y down).
+        let coefficients = t.as_coeffs();
+        let (dx, dy) = if matches!(glyph, Glyph::Outline(g) if g.is_vertical()) {
+            // PDF vertical fonts advance along negative glyph-space y (WMode 1), while
+            // keeping the glyph outline upright. Its x axis is not the writing direction.
+            (-coefficients[2], -coefficients[3])
+        } else {
+            (coefficients[0], coefficients[1])
+        };
+        let dir = if dx.abs() >= dy.abs() {
+            if dx >= 0.0 { 0 } else { 2 }
+        } else if dy > 0.0 {
+            1
+        } else {
+            3
+        };
+        let em = Rect::new(0.0, -200.0, advance, 800.0);
+        let corners = if matches!(glyph, Glyph::Outline(g) if g.is_vertical()) {
+            [(em.x0, em.y1), (em.x0, em.y0), (em.x1, em.y0), (em.x1, em.y1)]
+        } else {
+            [(em.x0, em.y0), (em.x1, em.y0), (em.x1, em.y1), (em.x0, em.y1)]
+        }
+        .map(|(x, y)| t * kurbo::Point::new(x, y));
+        let b = corners.iter().fold(Rect::new(f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY), |b, p| {
+            Rect::new(b.x0.min(p.x), b.y0.min(p.y), b.x1.max(p.x), b.y1.max(p.y))
+        });
+        if !(b.x0.is_finite() && b.y0.is_finite() && b.x1.is_finite() && b.y1.is_finite()) || b.width() > 10_000.0 || b.height() > 10_000.0 {
+            return;
+        }
+        let length = dx.hypot(dy);
+        let direction = if length.is_finite() && length > 0.0 { [dx / length, dy / length] } else { [1.0, 0.0] };
+        // A glyph whose Unicode is several characters (a ligature such as "ffi") stays one glyph
+        // with its own box: the PDF gives no position for the characters inside it.
+        let glyph = TextGlyph {
+            text,
+            rect: [b.x0 as f32, b.y0 as f32, b.x1 as f32, b.y1 as f32],
+            quad: corners.map(|p| [p.x as f32, p.y as f32]),
+            direction: direction.map(|d| d as f32),
+        };
+        match &mut self.actual {
+            Some((_, _, drawn)) => drawn.push((dir, direction, glyph)),
+            None => self.glyphs.push((dir, direction, glyph)),
+        }
+    }
+    fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
+    fn pop_clip_path(&mut self) {}
+    fn pop_transparency_group(&mut self) {}
+    fn begin_marked_content(&mut self, tag: &[u8], mcid: Option<i32>) {
+        self.depth = self.depth.saturating_add(1);
+        if self.excluded_depth.is_none() && self.filter.excludes(tag, mcid) {
+            self.excluded_depth = Some(self.depth);
+        }
+    }
+    fn actual_text(&mut self, text: &[u8]) {
+        // A replacement nested in another is already covered by the outer one.
+        if self.actual.is_none() && self.excluded_depth.is_none() {
+            self.actual = Some((self.depth, pdfcraft_cos::PdfString::literal(text).to_text(), Vec::new()));
+        }
+    }
+    fn end_marked_content(&mut self) {
+        if self.actual.as_ref().is_some_and(|(depth, _, _)| *depth == self.depth) {
+            self.end_actual_text();
+        }
+        if self.excluded_depth == Some(self.depth) {
+            self.excluded_depth = None;
+        }
+        self.depth = self.depth.saturating_sub(1);
+    }
+}
+
+/// Extract the text of one page. Panics inside the interpreter are the caller's to catch.
+pub(crate) fn extract_page(pdf: &Pdf, page: usize, settings: &InterpreterSettings) -> Option<PageText> {
+    extract_page_filtered(pdf, page, settings, TextFilter::default()).ok()
+}
+
+pub(crate) fn extract_page_filtered(pdf: &Pdf, page: usize, settings: &InterpreterSettings, filter: TextFilter) -> Result<PageText, String> {
+    let pages = pdf.pages();
+    let p = pages.get(page).ok_or("the page could not be read")?;
+    let (w, h) = p.render_dimensions();
+    let cache = InterpreterCache::new();
+    // Annotation appearances are included: form-field values and comment text are searchable,
+    // as in Acrobat, and match what other extractors report.
+    let settings = settings.clone();
+    let initial = p.initial_transform(true).to_kurbo();
+    let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, w as f64, h as f64), &cache, p.xref(), settings);
+    let mut dev = TextDevice::new();
+    dev.filter = filter;
+    interpret_page(p, &mut ctx, &mut dev);
+    // A replacement the content never closed ends with the page.
+    dev.finish();
+    if dev.partial_replacement {
+        return Err("a replacement text span mixes included and excluded content; disable the exclusions to count this page".into());
+    }
+    let glyphs = dev.glyphs;
+    // Text on a curved path: glyphs that each continue the previous one's line while the
+    // direction turns. Each such run is one line.
+    let turned = |u: [f64; 2]| u[0].abs().min(u[1].abs()) > DIRECTION_TOLERANCE;
+    let mut in_curve = vec![false; glyphs.len()];
+    // Turned text: curved runs, and straight flows along one writing direction. The two are kept
+    // apart so finding a glyph's direction scans only the directions (a few dozen at most: each
+    // differs from the others by more than the tolerance), not every curved run.
+    let mut curves: Vec<Vec<usize>> = Vec::new();
+    let mut straight: Vec<([f64; 2], Vec<usize>)> = Vec::new();
+    let mut start = 0;
+    for end in 1..=glyphs.len() {
+        if end < glyphs.len() && continues(&glyphs[end - 1], &glyphs[end]) {
+            continue;
+        }
+        let run = &glyphs[start..end];
+        if run.iter().any(|g| turned(g.1)) && run.iter().any(|g| !compatible(run[0].1, g.1)) {
+            in_curve[start..end].fill(true);
+            curves.push((start..end).collect());
+        }
+        start = end;
+    }
+    let mut quarters: [Vec<usize>; 4] = Default::default();
+    for (i, (quarter, u, _)) in glyphs.iter().enumerate() {
+        if in_curve[i] {
+            continue;
+        }
+        if !turned(*u) {
+            if let Some(q) = quarters.get_mut(*quarter) {
+                q.push(i);
+            }
+        } else if let Some((_, ids)) = straight.iter_mut().find(|(d, _)| compatible(*d, *u)) {
+            ids.push(i);
+        } else {
+            straight.push((*u, vec![i]));
+        }
+    }
+    // A horizontal heading must not force a vertical body back into horizontal line grouping.
+    // Group each writing direction independently, then join flows from their topmost position.
+    let upright = |quarters: [Vec<usize>; 4]| {
+        let mut flows: Vec<Flow> = quarters
+            .into_iter()
+            .enumerate()
+            .filter(|(_, ids)| !ids.is_empty())
+            .map(|(quarter, ids)| {
+                let rects = ids.iter().map(|&i| to_upright(glyphs[i].2.rect, quarter as u8, w, h)).collect();
+                arrange_flow(&glyphs, ids, rects, Some(quarter as u8))
+            })
+            .collect();
+        flows.sort_by(|a, b| a.top.total_cmp(&b.top));
+        flows
+    };
+    let flows = upright(quarters);
+    let mut extra: Vec<Flow> = curves
+        .into_iter()
+        .map(|ids| (None, ids))
+        .chain(straight.into_iter().map(|(u, ids)| (Some(u), ids)))
+        .map(|(u, ids)| {
+            let rects = match u {
+                // Turned text is laid out along its own baseline.
+                Some(u) => ids.iter().map(|&i| along_baseline(&glyphs[i].2.quad, u).map(|c| c as f32)).collect(),
+                None => unrolled(ids.iter().map(|&i| &glyphs[i])),
+            };
+            arrange_flow(&glyphs, ids, rects, None)
+        })
+        .collect();
+    // Turned text takes the place in the reading order where laying it out among the nearest
+    // quarter turn's text puts its first glyph.
+    let mut rank = Vec::new();
+    if !extra.is_empty() {
+        rank = vec![usize::MAX; glyphs.len()];
+        let mut nearest: [Vec<usize>; 4] = Default::default();
+        for (i, g) in glyphs.iter().enumerate() {
+            if let Some(q) = nearest.get_mut(g.0) {
+                q.push(i);
+            }
+        }
+        for (r, i) in upright(nearest).into_iter().flat_map(|f| f.ids).enumerate() {
+            rank[i] = r;
+        }
+    }
+    let first = |ids: &[usize]| ids.iter().filter_map(|&i| rank.get(i).copied()).min().unwrap_or(usize::MAX);
+    extra.sort_by_key(|f| first(&f.ids));
+    let mut extra = extra.into_iter().peekable();
+    let mut slots: Vec<Option<TextGlyph>> = glyphs.into_iter().map(|g| Some(g.2)).collect();
+    let mut text = PageText::default();
+    let mut emit = |text: &mut PageText, ids: &[usize], line_of: &[u32], space_before: &[bool], quarter: Option<u8>| {
+        let offset = text.line_of.last().map_or(0, |line| line.saturating_add(1));
+        for ((&i, &line), &space) in ids.iter().zip(line_of).zip(space_before) {
+            let Some(mut g) = slots.get_mut(i).and_then(Option::take) else { continue };
+            if let Some(quarter) = quarter {
+                g.rect = from_upright(to_upright(g.rect, quarter, w, h), quarter, w, h);
+            }
+            text.glyphs.push(g);
+            text.line_of.push(line.saturating_add(offset));
+            text.space_before.push(space);
+        }
+    };
+    for flow in flows {
+        let mut k = 0;
+        while k < flow.ids.len() {
+            let line = flow.line_of[k];
+            let end = flow.line_of[k..].iter().position(|l| *l != line).map_or(flow.ids.len(), |n| k + n);
+            let before = first(&flow.ids[k..end]);
+            while let Some(f) = extra.next_if(|f| first(&f.ids) < before) {
+                emit(&mut text, &f.ids, &f.line_of, &f.space_before, None);
+            }
+            emit(&mut text, &flow.ids[k..end], &vec![0; end - k], &flow.space_before[k..end], flow.quarter);
+            k = end;
+        }
+    }
+    for f in extra {
+        emit(&mut text, &f.ids, &f.line_of, &f.space_before, None);
+    }
+    Ok(text)
+}
diff --git a/crates/render/src/text/layout.rs b/crates/render/src/text/layout.rs
new file mode 100644
index 0000000000..302184aebc
--- /dev/null
+++ b/crates/render/src/text/layout.rs
@@ -0,0 +1,427 @@
+use super::device::{DIRECTION_TOLERANCE, Drawn, WORD_GAP};
+use super::order::{NONE, REDRAW_CANDIDATES, Run, Scratch, Seg, fingerprint, place_glyphs, redraws, restarts_run, reverse_rtl};
+use super::*;
+
+/// Glyphs in reading order, as indices into the page's glyphs, with their lines and word gaps.
+pub(super) struct Flow {
+    /// The top of the flow's topmost glyph in view space.
+    pub(super) top: f32,
+    /// The quarter turn whose frame the flow was laid out in.
+    pub(super) quarter: Option<u8>,
+    pub(super) ids: Vec<usize>,
+    pub(super) line_of: Vec<u32>,
+    pub(super) space_before: Vec<bool>,
+}
+
+/// Lay out the page's glyphs `ids`, giving each the box at the same position in `rects`.
+pub(super) fn arrange_flow(glyphs: &[Drawn], ids: Vec<usize>, rects: Vec<[f32; 4]>, quarter: Option<u8>) -> Flow {
+    let top = ids.iter().filter_map(|&i| glyphs.get(i)).map(|g| g.2.rect[1]).fold(f32::INFINITY, f32::min);
+    let framed: Vec<TextGlyph> = ids.iter().zip(rects).filter_map(|(&i, rect)| glyphs.get(i).map(|g| TextGlyph { rect, ..g.2.clone() })).collect();
+    let (order, line_of, space_before) = arrange(&framed);
+    let ids = order.into_iter().filter_map(|k| ids.get(k).copied()).collect();
+    Flow { top, quarter, ids, line_of, space_before }
+}
+
+/// Boxes for a run of glyphs set along a curve: each glyph's box along its own direction, placed
+/// where the pen moved in the previous glyph's direction. The path straightened out.
+pub(super) fn unrolled<'g>(run: impl Iterator<Item = &'g Drawn>) -> Vec<[f32; 4]> {
+    let mut pen = [0.0, 0.0];
+    let mut previous: Option<([f64; 2], [f64; 4])> = None;
+    run.map(|(_, u, g)| {
+        let b = along_baseline(&g.quad, *u);
+        if let Some((pu, pb)) = previous {
+            let at = along_baseline(&g.quad, pu);
+            pen = [pen[0] + at[0] - pb[0], pen[1] + (at[1] + at[3] - pb[1] - pb[3]) / 2.0];
+        }
+        previous = Some((*u, b));
+        let half = (b[3] - b[1]) / 2.0;
+        [pen[0], pen[1] - half, pen[0] + b[2] - b[0], pen[1] + half].map(|c| c as f32)
+    })
+    .collect()
+}
+
+/// View-space box → the frame where text runs left to right, for text running `quarter` × 90°
+/// clockwise from that in a `w` × `h` view (1: text runs downwards).
+pub(super) fn to_upright(r: [f32; 4], quarter: u8, w: f32, h: f32) -> [f32; 4] {
+    let [x0, y0, x1, y1] = r;
+    match quarter {
+        1 => [y0, w - x1, y1, w - x0],
+        2 => [w - x1, h - y1, w - x0, h - y0],
+        3 => [h - y1, x0, h - y0, x1],
+        _ => r,
+    }
+}
+
+/// Whether two writing directions are close enough to share a frame ([`DIRECTION_TOLERANCE`]).
+pub(super) fn compatible(a: [f64; 2], b: [f64; 2]) -> bool {
+    a[0] * b[0] + a[1] * b[1] > 0.0 && (a[0] * b[1] - a[1] * b[0]).abs() <= DIRECTION_TOLERANCE
+}
+
+/// Whether glyph `g` continues the line of glyph `p` (content order), by the test `layout` uses
+/// for consecutive glyphs, taken in `p`'s own frame. The direction may turn by less than half a
+/// quarter turn, as text set along a curve does.
+pub(super) fn continues(p: &Drawn, g: &Drawn) -> bool {
+    let (pu, gu) = (p.1, g.1);
+    if (pu[0] * gu[1] - pu[1] * gu[0]).abs() >= pu[0] * gu[0] + pu[1] * gu[1] {
+        return false;
+    }
+    let (pb, gb, own) = (along_baseline(&p.2.quad, pu), along_baseline(&g.2.quad, pu), along_baseline(&g.2.quad, gu));
+    let h = (pb[3] - pb[1]).min(own[3] - own[1]).max(0.1);
+    let cy = |b: [f64; 4]| (b[1] + b[3]) / 2.0;
+    (cy(gb) - cy(pb)).abs() < h * 0.5 && gb[0] - pb[2] < h * 3.0 && gb[0] > pb[0] - h * 2.0
+}
+
+/// A view-space quad → its box in the frame where `u` runs left to right and `u` turned a
+/// quarter clockwise runs downwards. Along `u` it spans the middles of the quad's start and end
+/// sides, so a skewed glyph is no wider than its advance; across, it spans every corner.
+pub(super) fn along_baseline(quad: &[[f32; 2]; 4], u: [f64; 2]) -> [f64; 4] {
+    let p = quad.map(|[x, y]| [f64::from(x) * u[0] + f64::from(y) * u[1], f64::from(y) * u[0] - f64::from(x) * u[1]]);
+    let (a0, a1) = ((p[0][0] + p[3][0]) / 2.0, (p[1][0] + p[2][0]) / 2.0);
+    let (c0, c1) = p.iter().fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), q| (lo.min(q[1]), hi.max(q[1])));
+    [a0.min(a1), c0, a0.max(a1), c1]
+}
+
+/// The inverse of [`to_upright`].
+pub(super) fn from_upright(r: [f32; 4], quarter: u8, w: f32, h: f32) -> [f32; 4] {
+    let [u0, v0, u1, v1] = r;
+    match quarter {
+        1 => [w - v1, u0, w - v0, u1],
+        2 => [w - u1, h - v1, w - u0, h - v0],
+        3 => [v0, h - u1, v1, h - u0],
+        _ => r,
+    }
+}
+
+pub(super) fn is_rtl(c: char) -> bool {
+    matches!(c as u32, 0x0590..=0x08FF | 0xFB1D..=0xFDFF | 0xFE70..=0xFEFF | 0x10800..=0x10FFF | 0x1E800..=0x1EFFF)
+}
+
+/// Scripts written with explicit spaces whose combining signs can sit apart from their base
+/// (Indic, Thai, Lao, Myanmar, Khmer): never infer a space inside a tight cluster.
+fn is_complex(c: char) -> bool {
+    matches!(c as u32, 0x0300..=0x036F | 0x0900..=0x0DFF | 0x0E00..=0x0EFF | 0x1000..=0x109F | 0x1780..=0x17FF)
+}
+
+fn is_cjk(c: char) -> bool {
+    matches!(c as u32, 0x2E80..=0x9FFF | 0xAC00..=0xD7AF | 0xF900..=0xFAFF | 0xFF00..=0xFFEF | 0x20000..=0x3134F | 0x1100..=0x11FF)
+}
+
+pub(super) fn union(a: &mut [f32; 4], b: &[f32; 4]) {
+    a[0] = a[0].min(b[0]);
+    a[1] = a[1].min(b[1]);
+    a[2] = a[2].max(b[2]);
+    a[3] = a[3].max(b[3]);
+}
+
+/// Reading-order layout. Glyphs are reordered so that `glyphs` is in reading order, lines are
+/// numbered in that order, and word gaps are inferred per line.
+///
+/// Heuristics (documented so they can be tuned and tested; plan/architecture.md §8):
+/// 1. *Segments:* consecutive glyphs (content order) on one baseline with no column-sized gap.
+///    A smaller glyph right next to the previous one (a sub- or superscript) stays in the segment.
+///    Segments on the same baseline that nearly touch are merged (text drawn out of order).
+/// 2. *Blocks:* segments stacked with line-sized gaps and overlapping horizontally.
+/// 3. *Block order:* repeatedly take the top-most remaining block, preferring a block to its left
+///    that overlaps it vertically (so columns read left, then right). A column goes on first (#3658):
+///    the nearest block below the last one, overlapping it horizontally and at most 2.5 heights of
+///    its last line below it, comes next, unless an unread block sits above it in its own span, sits
+///    beside it on its left, or shares its first line (the first lines overlap by at least 30% of the
+///    taller one: a table or form row, which reads across, even with labels and values in different
+///    sizes or on shifted baselines).
+///    Known limit: when a paragraph in the next column starts on the same line as the continuation
+///    (text on a baseline grid), it counts as a row and the top-most rule applies, so the column
+///    order of #3658 is lost there. Telling prose from a row in that case needs more evidence.
+/// 4. Within a segment glyphs run left to right; runs of right-to-left script are reversed so the
+///    text comes out in logical order.
+pub fn layout(glyphs: Vec<TextGlyph>) -> PageText {
+    let (order, line_of, space_before) = arrange(&glyphs);
+    let mut slots: Vec<Option<TextGlyph>> = glyphs.into_iter().map(Some).collect();
+    // Each glyph is emitted exactly once.
+    let glyphs = order.iter().filter_map(|i| slots.get_mut(*i).and_then(Option::take)).collect();
+    PageText { glyphs, line_of, space_before }
+}
+
+/// [`layout`] as the reading order of indices into `glyphs`, with each one's line and word gap.
+fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
+    // Drop "fake bold" duplicates: the same character redrawn at (almost) the same place. A redraw
+    // also overlaps most of its own width: a narrow letter in condensed text (80 Tz and below) sits
+    // closer than a fifth of its height to its double, as the second "l" of "Alle" (#1467), and
+    // OCR layers squeeze words to 20 Tz and below (#2457). Only a zero-width mark, which has no
+    // width to overlap, is matched by its height alone.
+    let mut keep = vec![true; glyphs.len()];
+    for i in 1..glyphs.len() {
+        let g = &glyphs[i];
+        let h = (g.rect[3] - g.rect[1]).max(0.1);
+        let w = g.rect[2] - g.rect[0];
+        let dx = if w > 0.0 { (h * 0.2).min(w * 0.5) } else { h * 0.2 };
+        for j in (i.saturating_sub(4)..i).rev() {
+            let p = &glyphs[j];
+            if keep[j] && p.text == g.text && (p.rect[0] - g.rect[0]).abs() < dx && (p.rect[1] - g.rect[1]).abs() < h * 0.2 {
+                keep[i] = false;
+                break;
+            }
+        }
+    }
+    let kept: Vec<usize> = (0..glyphs.len()).filter(|i| keep[*i]).collect();
+    let glyphs: Vec<&TextGlyph> = kept.iter().map(|i| &glyphs[*i]).collect();
+    let n = glyphs.len();
+    if n == 0 {
+        return Default::default();
+    }
+    let height = |i: usize| (glyphs[i].rect[3] - glyphs[i].rect[1]).max(0.1);
+    let cy = |i: usize| (glyphs[i].rect[1] + glyphs[i].rect[3]) / 2.0;
+
+    // 1. Segments in content order. Every run is a range of consecutive glyphs.
+    let mut segs: Vec<Seg> = Vec::new();
+    let mut run_start_x = 0.0;
+    let mut furthest_progress = 0.0;
+    for i in 0..n {
+        let g = glyphs[i].rect;
+        let cont = segs.last().is_some_and(|s| {
+            let Some(p) = s.first.end.checked_sub(1) else { return false };
+            let ph = height(p).min(height(i));
+            let gap = g[0] - glyphs[p].rect[2];
+            // A sub- or superscript is a smaller glyph on a shifted baseline: its em box centre sits off the line by
+            // more than half its own height, but by less than half the height of the full-size glyph beside it.
+            let centre_limit = if gap.abs() < ph { height(p).max(height(i)) * 0.5 } else { ph * 0.5 };
+            (cy(i) - cy(p)).abs() < centre_limit && gap < ph * 3.0 && g[0] > glyphs[p].rect[0] - ph * 2.0
+        });
+        let reset = cont && segs.last().is_some_and(|s| restarts_run(&glyphs, s.first.start, i, furthest_progress));
+        if cont
+            && !reset
+            && let Some(s) = segs.last_mut()
+        {
+            s.first.end = i + 1;
+            union(&mut s.bbox, &g);
+            s.h = s.h.max(height(i));
+            furthest_progress = furthest_progress.max((g[0] - run_start_x).abs()).max((g[2] - run_start_x).abs());
+        } else {
+            segs.push(Seg::new(Run { start: i, end: i + 1 }, g, height(i)));
+            run_start_x = g[0];
+            furthest_progress = 0.0;
+        }
+    }
+    // A run that redraws an earlier run at the same place (doubled or shadowed text) is dropped, as a doubled glyph is
+    // above. Runs are keyed by a fingerprint of their glyph texts and a grid cell a fifth of a line high. A key leads to
+    // the latest retained run with it, and `older[k]` links each retained run to the previous one with the same key, so
+    // the earlier candidates are checked newest first, up to `REDRAW_CANDIDATES`. Both exist only for this pass.
+    let retained = {
+        let candidates = segs.iter().filter(|s| s.first.len() >= 2).count();
+        let mut latest: HashMap<(u64, i32, i32), usize> = HashMap::with_capacity(candidates);
+        let mut older = vec![NONE; segs.len()];
+        let mut kept_runs = 0;
+        for i in 0..segs.len() {
+            let run = segs[i].first;
+            if run.len() >= 2 {
+                let tol = 0.2 * segs[i].h;
+                let (cx, cy_) = ((glyphs[run.start].rect[0] / tol).floor() as i32, (glyphs[run.start].rect[1] / tol).floor() as i32);
+                let fp = fingerprint(&glyphs, run);
+                let mut checks = REDRAW_CANDIDATES;
+                let twin = (-1..=1i32).any(|dx| {
+                    (-1..=1i32).any(|dy| {
+                        let mut link = latest.get(&(fp, cx.saturating_add(dx), cy_.saturating_add(dy))).copied();
+                        while let Some(k) = link {
+                            let Some(prev) = segs.get(k) else { break };
+                            if checks == 0 {
+                                return false;
+                            }
+                            checks -= 1;
+                            if redraws(&glyphs, prev.first, run) {
+                                return true;
+                            }
+                            link = older.get(k).copied().filter(|&o| o != NONE);
+                        }
+                        false
+                    })
+                });
+                if twin {
+                    continue;
+                }
+                older[kept_runs] = latest.insert((fp, cx, cy_), kept_runs).unwrap_or(NONE);
+            }
+            segs.swap(kept_runs, i);
+            kept_runs += 1;
+        }
+        kept_runs
+    };
+    segs.truncate(retained);
+    // Merge same-baseline segments that nearly touch.
+    let mut merged = true;
+    while merged {
+        merged = false;
+        'outer: for a in 0..segs.len() {
+            for b in 0..segs.len() {
+                if a == b {
+                    continue;
+                }
+                let (sa, sb) = (&segs[a], &segs[b]);
+                let h = sa.h.min(sb.h);
+                let gap = (sb.bbox[0] - sa.bbox[2]).max(sa.bbox[0] - sb.bbox[2]);
+                if (sa.cy() - sb.cy()).abs() < h * 0.3 && (sa.h / sb.h - 1.0).abs() < 0.35 && gap < h * 1.2 {
+                    let sb = segs.remove(b);
+                    let a = if b < a { a - 1 } else { a };
+                    segs[a].merge(sb);
+                    merged = true;
+                    break 'outer;
+                }
+            }
+        }
+    }
+
+    // 2. Blocks.
+    let mut by_top: Vec<usize> = (0..segs.len()).collect();
+    by_top.sort_by(|a, b| segs[*a].bbox[1].total_cmp(&segs[*b].bbox[1]));
+    let mut blocks: Vec<(Vec<usize>, [f32; 4])> = Vec::new();
+    for si in by_top {
+        let s = &segs[si];
+        let target = blocks.iter().position(|(members, bb)| {
+            let Some(&m) = members.last() else { return false };
+            let last = &segs[m];
+            let vgap = s.bbox[1] - last.bbox[3];
+            let overlap = s.bbox[2].min(bb[2]) - s.bbox[0].max(bb[0]);
+            let minw = (s.bbox[2] - s.bbox[0]).min(bb[2] - bb[0]).max(1.0);
+            vgap > -last.h * 0.5 && vgap < last.h.max(s.h) * 1.1 && overlap > minw * 0.3 && (last.h / s.h - 1.0).abs() < 0.6
+        });
+        match target {
+            Some(b) => {
+                blocks[b].0.push(si);
+                let bb = s.bbox;
+                union(&mut blocks[b].1, &bb);
+            }
+            None => blocks.push((vec![si], s.bbox)),
+        }
+    }
+
+    // 3. Block order.
+    let mut remaining: Vec<usize> = (0..blocks.len()).collect();
+    let mut block_order: Vec<usize> = Vec::with_capacity(blocks.len());
+    // A block to the left of `cb` that shares at least half the height of the shorter one: it reads first.
+    let beside_left = |cb: &[f32; 4], lb: &[f32; 4]| {
+        let v = lb[3].min(cb[3]) - lb[1].max(cb[1]);
+        lb[2] <= cb[0] + 1.0 && v > 0.5 * (lb[3] - lb[1]).min(cb[3] - cb[1])
+    };
+    // The box of a block's first line. Every block is created with one segment, so the block's own box is a fallback
+    // that is never used.
+    let first_line = |b: usize| blocks[b].0.first().and_then(|&s| segs.get(s)).map_or(blocks[b].1, |s| s.bbox);
+    while let Some(&top) = remaining.iter().min_by(|a, b| blocks[**a].1[1].total_cmp(&blocks[**b].1[1])) {
+        // A column goes on past a paragraph gap (#3658): the nearest block below the one just read that overlaps it
+        // horizontally comes next, if the gap above it is at most two and a half heights of the last line read (a
+        // footer, a footnote or a caption under a figure is further) and no other unread block
+        // - sits above it in its own horizontal span (the rest of a column above a full-width heading or footnote),
+        // - is beside it on its left, or
+        // - shares its first line: their first lines overlap by at least 30% of the taller one (a table or form row,
+        //   which reads across, even with labels and values in different sizes or on shifted baselines; a line that
+        //   only touches it, or a small superscript or footnote marker, is not a row).
+        let next_in_column = block_order.last().and_then(|&prev| {
+            let pb = blocks[prev].1;
+            // The gap is measured in the height of the block's last line, which borders it.
+            let pl = blocks[prev].0.last().and_then(|&s| segs.get(s)).map_or(pb, |s| s.bbox);
+            let tol = (pl[3] - pl[1]).max(0.1) * 0.5;
+            let c = remaining
+                .iter()
+                .copied()
+                .filter(|&c| {
+                    let cb = blocks[c].1;
+                    let overlap = cb[2].min(pb[2]) - cb[0].max(pb[0]);
+                    let minw = (cb[2] - cb[0]).min(pb[2] - pb[0]).max(1.0);
+                    cb[1] >= pb[3] - tol && overlap > minw * 0.3
+                })
+                .min_by(|a, b| blocks[*a].1[1].total_cmp(&blocks[*b].1[1]))?;
+            let cb = blocks[c].1;
+            if cb[1] - pb[3] >= tol * 5.0 {
+                return None;
+            }
+            let cl = first_line(c);
+            let blocked = remaining.iter().any(|&r| {
+                if r == c {
+                    return false;
+                }
+                let rb = blocks[r].1;
+                let rl = first_line(r);
+                let shared = rl[3].min(cl[3]) - rl[1].max(cl[1]);
+                let row = shared > 0.3 * (rl[3] - rl[1]).max(cl[3] - cl[1]);
+                (rb[1] < cb[1] && rb[2].min(cb[2]) > rb[0].max(cb[0])) || beside_left(&cb, &rb) || row
+            });
+            (!blocked).then_some(c)
+        });
+        let pick = next_in_column.unwrap_or_else(|| {
+            let tb = blocks[top].1;
+            remaining
+                .iter()
+                .copied()
+                .filter(|c| beside_left(&tb, &blocks[*c].1))
+                .min_by(|a, b| blocks[*a].1[0].total_cmp(&blocks[*b].1[0]))
+                .unwrap_or(top)
+        });
+        remaining.retain(|r| *r != pick);
+        block_order.push(pick);
+    }
+
+    // 4. Emit each segment in block order. Its glyphs are placed here, into scratch that every segment reuses, and
+    // appended straight to the output. Blocks and their order use only segment boxes, so placement can wait until now.
+    let mut order: Vec<usize> = Vec::with_capacity(n);
+    let mut line_of: Vec<u32> = Vec::with_capacity(n);
+    let mut space_before: Vec<bool> = Vec::with_capacity(n);
+    let mut line = 0u32;
+    let mut sc = Scratch::default();
+    // `spaces[w]`: a word gap left of the w-th glyph of the segment, by position on the line, not by drawing order
+    // (#1062). Reused by every segment.
+    let mut spaces: Vec<bool> = Vec::new();
+    for b in block_order {
+        for &si in &blocks[b].0 {
+            place_glyphs(&glyphs, &height, &segs[si], &mut sc);
+            let h = segs[si].h;
+            // Word gaps relative to this line's typical letter gap (handles tracking).
+            // Long runs of repeated punctuation belong to leaders, not letter tracking: a TOC leader
+            // must not raise the threshold above the word gaps in its title (#3086).
+            sc.gaps.clear();
+            sc.gaps.extend(sc.placed.windows(2).enumerate().filter_map(|(w, pair)| {
+                let &[p, c] = pair else { return None };
+                let (p, c) = (glyphs.get(p)?, glyphs.get(c)?);
+                if p.text == c.text && p.text.chars().all(|ch| !ch.is_alphanumeric() && !ch.is_whitespace()) {
+                    // Keep short tracked punctuation, including an ellipsis with a final period.
+                    // Treat five or more matching glyphs as a leader. Three neighbours on each
+                    // side suffice to classify this pair, bounding work even on long runs.
+                    let same = |&&i: &&usize| glyphs.get(i).is_some_and(|g| g.text == p.text);
+                    let before = sc.placed.get(..w).unwrap_or_default().iter().rev().take(3).take_while(same).count();
+                    let after = sc.placed.get(w.saturating_add(2)..).unwrap_or_default().iter().take(3).take_while(same).count();
+                    if before + after >= 3 {
+                        return None;
+                    }
+                }
+                Some(c.rect[0] - p.rect[2])
+            }));
+            sc.gaps.sort_by(f32::total_cmp);
+            let typical = sc.gaps.get(sc.gaps.len() / 3).copied().unwrap_or(0.0).max(0.0);
+            let threshold = (typical + h * WORD_GAP).max(h * WORD_GAP);
+            spaces.clear();
+            spaces.resize(sc.placed.len(), false);
+            for (w, pair) in sc.placed.windows(2).enumerate() {
+                let &[p, c] = pair else { continue };
+                let gap = glyphs[c].rect[0] - glyphs[p].rect[2];
+                let (pt, ct) = (&glyphs[p].text, &glyphs[c].text);
+                let cjk = pt.chars().any(is_cjk) && ct.chars().any(is_cjk) && gap < h * 0.5;
+                let tight_cluster = (pt.chars().any(is_complex) || ct.chars().any(is_complex)) && gap < h * 0.6;
+                let run_start = sc.breaks.binary_search(&c).is_ok();
+                if let Some(space) = spaces.get_mut(w + 1) {
+                    *space = (gap > threshold || run_start) && !cjk && !tight_cluster && !pt.trim().is_empty() && !ct.trim().is_empty();
+                }
+            }
+            // Right-to-left spans are reversed (visual → logical) with their gaps, and only then is a second copy made.
+            let has_rtl = sc.placed.iter().any(|&i| glyphs[i].text.chars().any(is_rtl));
+            if has_rtl {
+                sc.logical.clear();
+                sc.logical.extend_from_slice(&sc.placed);
+                reverse_rtl(&glyphs, &mut sc.logical, &mut spaces);
+            }
+            let idx: &[usize] = if has_rtl { &sc.logical } else { &sc.placed };
+            order.extend_from_slice(idx);
+            line_of.resize(order.len(), line);
+            // `spaces[0]` stays false: the first glyph of a segment never takes a space.
+            space_before.extend(spaces.iter().take(idx.len()));
+            space_before.resize(order.len(), false);
+            line += 1;
+        }
+    }
+    (order.into_iter().map(|i| kept[i]).collect(), line_of, space_before)
+}
diff --git a/crates/render/src/text/order.rs b/crates/render/src/text/order.rs
new file mode 100644
index 0000000000..6892d3f2ab
--- /dev/null
+++ b/crates/render/src/text/order.rs
@@ -0,0 +1,487 @@
+use super::layout::{is_rtl, union};
+use super::*;
+
+/// Glyphs `start..end` of the glyph list [`arrange`] lays out, drawn one after another.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) struct Run {
+    pub(super) start: usize,
+    pub(super) end: usize,
+}
+
+impl Run {
+    pub(super) fn len(self) -> usize {
+        self.end.saturating_sub(self.start)
+    }
+
+    fn range(self) -> std::ops::Range<usize> {
+        self.start..self.end
+    }
+}
+
+/// Marks an absent link in a union-find or run list.
+pub(super) const NONE: usize = usize::MAX;
+
+/// A segment: runs drawn on one baseline, placed together. Its glyph order is worked out when it is emitted, so a
+/// segment holds run ranges and geometry only.
+pub(super) struct Seg {
+    /// The first run. Merged segments keep their other runs in `extra`.
+    pub(super) first: Run,
+    /// The other runs of a merged segment. Boxed, and absent for most segments.
+    extra: Option<Box<SegExtra>>,
+    pub(super) bbox: [f32; 4],
+    pub(super) h: f32,
+}
+
+#[derive(Default)]
+struct SegExtra {
+    more: Vec<Run>,
+}
+
+impl Seg {
+    pub(super) fn new(first: Run, bbox: [f32; 4], h: f32) -> Self {
+        Seg { first, extra: None, bbox, h }
+    }
+
+    pub(super) fn cy(&self) -> f32 {
+        (self.bbox[1] + self.bbox[3]) / 2.0
+    }
+
+    fn runs(&self) -> impl Iterator<Item = Run> + '_ {
+        std::iter::once(self.first).chain(self.extra.iter().flat_map(|e| e.more.iter().copied()))
+    }
+
+    pub(super) fn merge(&mut self, other: Seg) {
+        union(&mut self.bbox, &other.bbox);
+        self.h = self.h.max(other.h);
+        let extra = self.extra.get_or_insert_with(Default::default);
+        extra.more.push(other.first);
+        if let Some(o) = other.extra {
+            extra.more.extend(o.more);
+        }
+    }
+}
+
+/// Two glyphs of different runs that overlap by more than this fraction of the line height collide.
+const RUN_COLLISION: f32 = 0.25;
+
+/// A run that starts inside the runs before it by more than this fraction of the line height starts a new word.
+const RUN_OVERLAP_SPACE: f32 = 0.5;
+
+/// Earlier runs with the same key that a run is checked against for a redraw, newest first. A run past this limit is kept,
+/// so a page costs at most this many checks per run, however many runs share a key.
+pub(super) const REDRAW_CANDIDATES: usize = 32;
+
+/// Pair tests that the collision sweep may make per glyph of a segment. Ordinary text overlaps each glyph with about one
+/// neighbour, so it stays far below this. A segment that needs more is dense, and [`collide`] joins its runs instead.
+const COLLIDE_PAIRS_PER_GLYPH: usize = 16;
+
+/// Glyph positions within a fifth of their height are considered the same for redraws.
+const REDRAW_POSITION_TOLERANCE: f32 = 0.2;
+
+/// A reset needs three matching glyphs at the start of the run, keeping local kerning from splitting it.
+const REDRAW_PREFIX_GLYPHS: usize = 3;
+
+/// Reusable buffers, so a page allocates them once rather than per segment. Glyph placement works in them, one
+/// segment at a time, when the segment is emitted.
+#[derive(Default)]
+pub(super) struct Scratch {
+    /// The glyphs of the text runs, each with its run, in x order.
+    pub(super) owner: Vec<(usize, usize)>,
+    /// The text runs of the segment (runs that are not all zero-width).
+    pub(super) text: Vec<Run>,
+    /// The glyphs of the zero-width runs, in run order.
+    pub(super) marks: Vec<usize>,
+    /// Union-find parents over `text`, and for each root the list of its runs through `next`.
+    pub(super) parent: Vec<usize>,
+    pub(super) head: Vec<usize>,
+    pub(super) next: Vec<usize>,
+    /// The runs of one colliding component, by left edge.
+    pub(super) rows: Vec<Row>,
+    /// The glyphs of one colliding component: each run's glyphs in x order, in run order.
+    pub(super) group: Vec<usize>,
+    /// The units to place, and their glyphs in `flat`.
+    pub(super) units: Vec<Unit>,
+    pub(super) flat: Vec<usize>,
+    /// The current segment's glyphs in visual reading order, and its forced word breaks.
+    pub(super) placed: Vec<usize>,
+    pub(super) breaks: Vec<usize>,
+    /// The gaps between the current segment's glyphs, and its glyphs in logical order when it has right-to-left text.
+    pub(super) gaps: Vec<f32>,
+    pub(super) logical: Vec<usize>,
+    /// `placed` with the marks merged in, built before it is swapped in.
+    pub(super) merged: Vec<usize>,
+}
+
+/// One run of a colliding component.
+pub(super) struct Row {
+    left: f32,
+    right: f32,
+    /// The run's first glyph in content order, which is its smallest index.
+    first: usize,
+    /// The run's glyph with the smallest x, where a word break is recorded.
+    lead: usize,
+    /// The run's glyphs in `Scratch::group`.
+    glyphs: std::ops::Range<usize>,
+}
+
+/// A part of a segment placed as one: a free glyph, or a colliding component.
+pub(super) struct Unit {
+    left: f32,
+    first: usize,
+    /// The unit's glyphs in `Scratch::flat`.
+    glyphs: std::ops::Range<usize>,
+}
+
+fn union_find(parent: &mut [usize], mut r: usize) -> usize {
+    while parent[r] != r {
+        parent[r] = parent[parent[r]];
+        r = parent[r];
+    }
+    r
+}
+
+/// A 64-bit fingerprint of a run's glyph texts. Each text is hashed with its length, so ["ab", "c"] and
+/// ["a", "bc"] differ. Equal fingerprints are only candidates: `redraws` decides.
+pub(super) fn fingerprint(glyphs: &[&TextGlyph], run: Run) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for g in run.range().filter_map(|i| glyphs.get(i)) {
+        for b in (g.text.len() as u64).to_le_bytes().into_iter().chain(g.text.bytes()) {
+            h = (h ^ u64::from(b)).wrapping_mul(0x0000_0100_0000_01b3);
+        }
+    }
+    h
+}
+
+/// Whether run `b` redraws run `a` glyph for glyph: the same text, each glyph within a fifth of its
+/// height of the same glyph in `a`.
+pub(super) fn redraws(glyphs: &[&TextGlyph], a: Run, b: Run) -> bool {
+    a.len() == b.len()
+        && a.range().zip(b.range()).all(|(i, j)| match (glyphs.get(i), glyphs.get(j)) {
+            (Some(p), Some(g)) => {
+                let tol = REDRAW_POSITION_TOLERANCE * (g.rect[3] - g.rect[1]).max(0.1);
+                p.text == g.text && (p.rect[0] - g.rect[0]).abs() < tol && (p.rect[1] - g.rect[1]).abs() < tol
+            }
+            _ => false,
+        })
+}
+
+fn within_position_tolerance(a: f32, b: f32, tolerance: f32) -> bool {
+    (a - b).abs().partial_cmp(&tolerance) == Some(std::cmp::Ordering::Less)
+}
+
+/// Whether `next` restarts `start` after the run has advanced by a glyph height. The fixed prefix
+/// bounds this check and requires more than a single backward adjustment to split a run.
+pub(super) fn restarts_run(glyphs: &[&TextGlyph], start: usize, next: usize, progress: f32) -> bool {
+    let (Some(first), Some(candidate)) = (glyphs.get(start), glyphs.get(next)) else { return false };
+    let tol = REDRAW_POSITION_TOLERANCE * (candidate.rect[3] - candidate.rect[1]).max(0.1);
+    if first.text != candidate.text
+        || !within_position_tolerance(first.rect[0], candidate.rect[0], tol)
+        || !within_position_tolerance(first.rect[1], candidate.rect[1], tol)
+    {
+        return false;
+    }
+    let h = (first.rect[3] - first.rect[1]).max(0.1);
+    if !progress.is_finite() || progress <= h {
+        return false;
+    }
+    for offset in 1..REDRAW_PREFIX_GLYPHS {
+        let (Some(a), Some(b)) = (start.checked_add(offset).and_then(|i| glyphs.get(i)), next.checked_add(offset).and_then(|i| glyphs.get(i))) else {
+            return false;
+        };
+        let tol = REDRAW_POSITION_TOLERANCE * (b.rect[3] - b.rect[1]).max(0.1);
+        if a.text != b.text || !within_position_tolerance(a.rect[0], b.rect[0], tol) || !within_position_tolerance(a.rect[1], b.rect[1], tol) {
+            return false;
+        }
+    }
+    true
+}
+
+/// Puts a segment's glyphs in visual reading order into `sc.placed`, and its forced word breaks into `sc.breaks`.
+///
+/// Glyphs are placed by x. Runs that collide, meaning that glyphs of different runs overprint each other, stay whole
+/// and are placed by their left edge. Runs that only interleave along the line, such as symbols between letters, keep
+/// their glyph-by-glyph order, so the common case is one sort. A run of zero-width glyphs (a combining mark) has no
+/// extent of its own, so it goes next to the glyph it starts at.
+pub(super) fn place_glyphs(glyphs: &[&TextGlyph], height: &dyn Fn(usize) -> f32, s: &Seg, sc: &mut Scratch) {
+    let x0 = |i: usize| glyphs[i].rect[0];
+    let zero_width = |i: usize| glyphs[i].rect[2] - glyphs[i].rect[0] <= 0.05 * height(i);
+    sc.text.clear();
+    sc.marks.clear();
+    sc.placed.clear();
+    sc.breaks.clear();
+    for run in s.runs() {
+        if run.range().all(&zero_width) {
+            sc.marks.extend(run.range());
+        } else {
+            sc.text.push(run);
+        }
+    }
+    if sc.text.len() <= 1 {
+        // A single run cannot collide with itself: its glyphs only need sorting by x.
+        sc.placed.extend(sc.text.iter().flat_map(|run| run.range()));
+        sc.placed.sort_unstable_by(|a, b| x0(*a).total_cmp(&x0(*b)).then(a.cmp(b)));
+    } else {
+        collide(glyphs, height, s.h, sc);
+    }
+    // Each mark goes before the first placed glyph whose x is greater than its own. Marks are visited in x order, and
+    // that position never moves back, so one pass over `placed` puts all of them in.
+    sc.marks.sort_by(|a, b| x0(*a).total_cmp(&x0(*b)));
+    if !sc.marks.is_empty() {
+        sc.merged.clear();
+        let mut next = 0;
+        for &m in &sc.marks {
+            while next < sc.placed.len() && x0(sc.placed[next]) <= x0(m) {
+                sc.merged.push(sc.placed[next]);
+                next += 1;
+            }
+            sc.merged.push(m);
+        }
+        sc.merged.extend_from_slice(&sc.placed[next..]);
+        std::mem::swap(&mut sc.placed, &mut sc.merged);
+    }
+}
+
+/// `place_glyphs` for a segment of two or more text runs. `h` is the segment's line height. Returns whether the segment
+/// was too dense to sweep ([`COLLIDE_PAIRS_PER_GLYPH`]), in which case all its text runs form one component.
+///
+/// The sweep tests each glyph against the glyphs after it that start before its right edge. Its work is bounded by the
+/// budget, so a page costs O(glyphs) pair tests plus the sorts. A dense segment is joined with one pass over its runs,
+/// which keeps each run whole. It may keep runs whole that do not overprint, but never interleaves overprinted glyphs.
+pub(super) fn collide(glyphs: &[&TextGlyph], height: &dyn Fn(usize) -> f32, h: f32, sc: &mut Scratch) -> bool {
+    let x0 = |i: usize| glyphs[i].rect[0];
+    let runs = sc.text.len();
+    sc.owner.clear();
+    for (r, run) in sc.text.iter().enumerate() {
+        sc.owner.extend(run.range().map(|i| (i, r)));
+    }
+    sc.owner.sort_unstable_by(|a, b| x0(a.0).total_cmp(&x0(b.0)).then(a.0.cmp(&b.0)));
+    sc.parent.clear();
+    sc.parent.extend(0..runs);
+    let mut budget = COLLIDE_PAIRS_PER_GLYPH.saturating_mul(sc.owner.len());
+    let mut collided = false;
+    let mut dense = false;
+    'sweep: for a in 0..sc.owner.len() {
+        let (i, ri) = sc.owner[a];
+        let (x1, hi) = (glyphs[i].rect[2], height(i));
+        for b in a + 1..sc.owner.len() {
+            let (j, rj) = sc.owner[b];
+            if x0(j) >= x1 {
+                break;
+            }
+            if budget == 0 {
+                dense = true;
+                break 'sweep;
+            }
+            budget -= 1;
+            let (ra, rb) = (union_find(&mut sc.parent, ri), union_find(&mut sc.parent, rj));
+            let overlap = x1.min(glyphs[j].rect[2]) - x0(j);
+            if ra != rb && overlap > RUN_COLLISION * hi.min(height(j)) {
+                sc.parent[ra] = rb;
+                collided = true;
+            }
+        }
+    }
+    if dense {
+        // Run 0 is its own root, so every run now has it as its root.
+        sc.parent.iter_mut().for_each(|p| *p = 0);
+        collided = true;
+    }
+    if !collided {
+        sc.placed.extend(sc.owner.iter().map(|&(i, _)| i));
+        return dense;
+    }
+
+    // Link each component's runs, so they can be walked without a map.
+    sc.head.clear();
+    sc.head.resize(runs, NONE);
+    sc.next.clear();
+    sc.next.resize(runs, NONE);
+    for r in 0..runs {
+        let root = union_find(&mut sc.parent, r);
+        sc.next[r] = sc.head[root];
+        sc.head[root] = r;
+    }
+    sc.units.clear();
+    sc.flat.clear();
+    for root in 0..runs {
+        if union_find(&mut sc.parent, root) != root {
+            continue;
+        }
+        let head = sc.head[root];
+        if sc.next[head] == NONE {
+            // A run that collides with nothing is placed glyph by glyph.
+            for i in sc.text[head].range() {
+                let at = sc.flat.len();
+                sc.flat.push(i);
+                sc.units.push(Unit { left: x0(i), first: i, glyphs: at..at + 1 });
+            }
+            continue;
+        }
+        sc.rows.clear();
+        sc.group.clear();
+        let mut m = head;
+        while m != NONE {
+            let run = sc.text[m];
+            let start = sc.group.len();
+            sc.group.extend(run.range());
+            sc.group[start..].sort_unstable_by(|a, b| x0(*a).total_cmp(&x0(*b)).then(a.cmp(b)));
+            let left = sc.group[start..].iter().map(|&i| x0(i)).fold(f32::INFINITY, f32::min);
+            let right = sc.group[start..].iter().map(|&i| glyphs[i].rect[2]).fold(f32::NEG_INFINITY, f32::max);
+            let lead = sc.group[start];
+            sc.rows.push(Row { left, right, first: run.start, lead, glyphs: start..sc.group.len() });
+            m = sc.next[m];
+        }
+        sc.rows.sort_unstable_by(|a, b| a.left.total_cmp(&b.left).then(a.first.cmp(&b.first)));
+        let start = sc.flat.len();
+        let mut reach = f32::NEG_INFINITY;
+        for row in &sc.rows {
+            if row.left < reach - h * RUN_OVERLAP_SPACE {
+                sc.breaks.push(row.lead);
+            }
+            reach = reach.max(row.right);
+            sc.flat.extend_from_slice(&sc.group[row.glyphs.clone()]);
+        }
+        let left = sc.rows.iter().map(|r| r.left).fold(f32::INFINITY, f32::min);
+        let first = sc.rows.iter().map(|r| r.first).min().unwrap_or(0);
+        sc.units.push(Unit { left, first, glyphs: start..sc.flat.len() });
+    }
+    sc.units.sort_unstable_by(|a, b| a.left.total_cmp(&b.left).then(a.first.cmp(&b.first)));
+    for unit in &sc.units {
+        sc.placed.extend_from_slice(&sc.flat[unit.glyphs.clone()]);
+    }
+    // Sorted, so that each glyph's membership is a binary search rather than a scan of the breaks.
+    sc.breaks.sort_unstable();
+    dense
+}
+
+/// Simplified bidi class of a glyph or word gap (UAX #9: strong L/R, numbers, neutrals).
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Bidi {
+    L,
+    R,
+    Num,
+    N,
+}
+
+fn bidi_class(text: &str) -> Bidi {
+    if text.chars().any(|c| is_rtl(c) && !c.is_numeric()) {
+        Bidi::R
+    } else if text.chars().any(char::is_numeric) {
+        Bidi::Num
+    } else if text.chars().any(char::is_alphabetic) {
+        Bidi::L
+    } else {
+        Bidi::N
+    }
+}
+
+/// Reorders a line of `idx` from visual to logical order with a simplified bidi level pass (#2667), carrying the
+/// word gaps along: `spaces[w]` is a gap left of `idx[w]` (#1062). The paragraph is right-to-left when it has
+/// more right-to-left than left-to-right glyphs; numbers keep their left-to-right order, and neutrals
+/// (punctuation, gaps) take the direction of their neighbours, or the paragraph's between opposite ones.
+pub(super) fn reverse_rtl(glyphs: &[&TextGlyph], idx: &mut [usize], spaces: &mut [bool]) {
+    // Glyphs and word gaps (None) in visual order.
+    let mut items: Vec<(Option<usize>, Bidi)> = Vec::with_capacity(idx.len() * 2);
+    for (w, &i) in idx.iter().enumerate() {
+        if w > 0 && spaces.get(w).copied().unwrap_or(false) {
+            items.push((None, Bidi::N));
+        }
+        items.push((Some(i), bidi_class(&glyphs[i].text)));
+    }
+    let texts: Vec<&str> = items.iter().map(|it| it.0.map_or("", |i| glyphs[i].text.as_str())).collect();
+    let text = |k: usize| texts.get(k).copied().unwrap_or("");
+    let count = |b: Bidi| items.iter().filter(|it| it.1 == b).count();
+    let para = if count(Bidi::R) > count(Bidi::L) { Bidi::R } else { Bidi::L };
+    let n = items.len();
+    // W4: a single separator between two digits belongs to the number.
+    for k in 1..n.saturating_sub(1) {
+        let sep = matches!(text(k), "." | "," | ":" | "/" | "+" | "-" | "\u{066B}" | "\u{066C}");
+        if sep && items[k - 1].1 == Bidi::Num && items[k + 1].1 == Bidi::Num {
+            items[k].1 = Bidi::Num;
+        }
+    }
+    // W5: terminators (percent, currency) next to a number belong to it.
+    let term =
+        |s: &str| !s.is_empty() && s.chars().all(|c| matches!(c, '%' | '‰' | '#' | '$' | '¢'..='¥' | '°' | '\u{066A}' | '\u{20A0}'..='\u{20CF}'));
+    for k in 1..n {
+        if items[k].1 == Bidi::N && items[k - 1].1 == Bidi::Num && term(text(k)) {
+            items[k].1 = Bidi::Num;
+        }
+    }
+    for k in (0..n.saturating_sub(1)).rev() {
+        if items[k].1 == Bidi::N && items[k + 1].1 == Bidi::Num && term(text(k)) {
+            items[k].1 = Bidi::Num;
+        }
+    }
+    // W7: a number after left-to-right text (or at the start of a left-to-right paragraph) is left-to-right.
+    let mut strong = para;
+    for it in &mut items {
+        match it.1 {
+            Bidi::L | Bidi::R => strong = it.1,
+            Bidi::Num if strong == Bidi::L => it.1 = Bidi::L,
+            _ => {}
+        }
+    }
+    // N1/N2: neutrals between same-direction text take it (numbers count as right-to-left), else the paragraph's.
+    let dir = |b: Bidi| if b == Bidi::L { Bidi::L } else { Bidi::R };
+    let mut k = 0;
+    while k < n {
+        if items[k].1 != Bidi::N {
+            k += 1;
+            continue;
+        }
+        let mut e = k;
+        while e < n && items[e].1 == Bidi::N {
+            e += 1;
+        }
+        let before = if k == 0 { para } else { dir(items[k - 1].1) };
+        let after = if e == n { para } else { dir(items[e].1) };
+        let resolved = if before == after { before } else { para };
+        for it in &mut items[k..e] {
+            it.1 = resolved;
+        }
+        k = e;
+    }
+    // Levels (I1/I2), then L2: reverse every run at or above each level, highest first.
+    let rtl_para = para == Bidi::R;
+    let levels: Vec<u8> = items
+        .iter()
+        .map(|it| match it.1 {
+            Bidi::R => 1,
+            Bidi::Num => 2,
+            _ if rtl_para => 2,
+            _ => 0,
+        })
+        .collect();
+    let mut order: Vec<usize> = (0..n).collect();
+    for level in (1..=levels.iter().copied().max().unwrap_or(0)).rev() {
+        let mut k = 0;
+        while k < n {
+            if levels[order[k]] < level {
+                k += 1;
+                continue;
+            }
+            let mut e = k;
+            while e < n && levels[order[e]] >= level {
+                e += 1;
+            }
+            order[k..e].reverse();
+            k = e;
+        }
+    }
+    let mut j = 0;
+    let mut gap = false;
+    for &o in &order {
+        match items[o].0 {
+            None => gap = true,
+            Some(i) => {
+                if let (Some(slot), Some(space)) = (idx.get_mut(j), spaces.get_mut(j)) {
+                    *slot = i;
+                    *space = gap && j > 0;
+                }
+                gap = false;
+                j += 1;
+            }
+        }
+    }
+}
diff --git a/crates/render/src/text/tests.rs b/crates/render/src/text/tests.rs
new file mode 100644
index 0000000000..34493248bf
--- /dev/null
+++ b/crates/render/src/text/tests.rs
@@ -0,0 +1,1761 @@
+use super::*;
+
+fn em_box(text: &str, x0: f32, y0: f32, x1: f32, y1: f32) -> TextGlyph {
+    TextGlyph { text: text.into(), rect: [x0, y0, x1, y1], quad: [[x0, y0], [x1, y0], [x1, y1], [x0, y1]], direction: [1.0, 0.0] }
+}
+
+#[test]
+fn subscript_stays_in_its_word() {
+    // "CO2-E": an 8.1 pt "CO" and "-E", with a 4.7 pt "2" drawn 2.7 pt lower (#3174).
+    let glyphs = vec![
+        em_box("C", 0.0, 92.5, 5.0, 100.6),
+        em_box("O", 5.0, 92.5, 11.0, 100.6),
+        em_box("2", 11.0, 97.9, 13.5, 102.6),
+        em_box("-", 13.5, 92.5, 16.0, 100.6),
+        em_box("E", 16.0, 92.5, 21.0, 100.6),
+    ];
+    assert_eq!(layout(glyphs).plain_text(), "CO2-E");
+}
+
+#[test]
+fn identity_v_columns_are_searchable_in_reading_order() {
+    use lopdf::{Document, Object, Stream, dictionary};
+    for encoding in ["Identity-V", "UniJIS-UCS2-V"] {
+        let mut doc = Document::with_version("1.7");
+        let cmap = b"/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /TestUnicode def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespacerange 5 beginbfchar <0001> <65E5> <0002> <672C> <0003> <8A9E> <0004> <6587> <0005> <7AE0> endbfchar endcmap CMapName currentdict /CMap defineresource pop end end";
+        let cmap = if encoding == "Identity-V" {
+            cmap.to_vec()
+        } else {
+            let mut mapping = String::from_utf8(cmap.to_vec()).unwrap();
+            for (code, unicode) in [("0001", "65E5"), ("0002", "672C"), ("0003", "8A9E"), ("0004", "6587"), ("0005", "7AE0")] {
+                mapping = mapping.replace(&format!("<{code}> <{unicode}>"), &format!("<{unicode}> <{unicode}>"));
+            }
+            mapping.into_bytes()
+        };
+        let unicode = doc.add_object(Stream::new(dictionary! {}, cmap));
+        let cid = doc.add_object(dictionary! {
+        "Type" => "Font", "Subtype" => "CIDFontType2", "BaseFont" => "TestVertical",
+        "CIDSystemInfo" => dictionary! { "Registry" => Object::string_literal("Adobe"), "Ordering" => Object::string_literal("Identity"), "Supplement" => 0 },
+        "DW" => 1000, "DW2" => vec![Object::Integer(880), Object::Integer(-1000)], "CIDToGIDMap" => "Identity"
+    });
+        let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type0", "BaseFont" => "TestVertical", "Encoding" => encoding, "DescendantFonts" => vec![Object::Reference(cid)], "ToUnicode" => unicode });
+        let horizontal = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type0", "BaseFont" => "TestVertical", "Encoding" => "Identity-H", "DescendantFonts" => vec![Object::Reference(cid)], "ToUnicode" => unicode });
+        let (first, second) = if encoding == "Identity-V" { ("000100020003", "00040005") } else { ("65E5672C8A9E", "65877AE0") };
+        let operators =
+            format!("BT /H1 20 Tf 1 0 0 1 40 280 Tm <{first}> Tj /F1 20 Tf 1 0 0 1 200 250 Tm <{first}> Tj 1 0 0 1 170 250 Tm <{second}> Tj ET");
+        let content = doc.add_object(Stream::new(dictionary! {}, operators.into_bytes()));
+        let pages = doc.new_object_id();
+        let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font, "H1" => horizontal}}, "Contents" => content });
+        doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
+        let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
+        doc.trailer.set("Root", catalog);
+        let mut bytes = Vec::new();
+        doc.save_to(&mut bytes).unwrap();
+        let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
+        let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
+        assert_eq!(text.plain_text(), "日本語\n日本語\n文章");
+        assert_eq!(text.find("日本語"), vec![0..3, 3..6]);
+        assert_eq!(text.find("文章"), vec![6..8]);
+        let rects = text.line_rects(3..6);
+        assert_eq!(rects.len(), 1);
+        assert!(rects[0][3] - rects[0][1] > rects[0][2] - rects[0][0], "a vertical search highlight: {rects:?}");
+        assert!(text.glyphs[3].rect[0] > text.glyphs[6].rect[0], "columns read right to left in page view coordinates");
+    }
+}
+
+/// WSCAD writes `/ToUnicode /Identity-H`, a name rather than a CMap stream, on Type 0 fonts
+/// whose two-byte codes are UTF-16 code units. The codes read as that Unicode text (as in
+/// Acrobat), so the page's text can be selected and found; before, it had none. Controls (here a
+/// DEL and a C1 control at the line ends) are not text.
+#[test]
+fn identity_to_unicode_names_give_text() {
+    use lopdf::{Document, Object, Stream, dictionary};
+    for name in ["Identity-H", "Identity-V"] {
+        let mut doc = Document::with_version("1.4");
+        let cid = doc.add_object(dictionary! {
+            "Type" => "Font", "Subtype" => "CIDFontType2", "BaseFont" => "RobotoMono-Regular",
+            "CIDSystemInfo" => dictionary! { "Registry" => Object::string_literal("Adobe"), "Ordering" => Object::string_literal("Identity"), "Supplement" => 0 },
+            "DW" => 600, "CIDToGIDMap" => "Identity"
+        });
+        let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type0", "BaseFont" => "RobotoMono-Regular", "Encoding" => "Identity-H", "DescendantFonts" => vec![Object::Reference(cid)], "ToUnicode" => name });
+        let operators = "BT /F1 12 Tf 1 0 0 1 20 250 Tm <004400650063006B0062006C006100740074007F> Tj 1 0 0 1 20 200 Tm <005A00FC0072006900630068002020AC0085> Tj ET";
+        let content = doc.add_object(Stream::new(dictionary! {}, operators.as_bytes().to_vec()));
+        let pages = doc.new_object_id();
+        let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
+        doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
+        let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
+        doc.trailer.set("Root", catalog);
+        let mut bytes = Vec::new();
+        doc.save_to(&mut bytes).unwrap();
+        let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
+        let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
+        assert_eq!(text.plain_text(), "Deckblatt\nZürich €", "{name}");
+        assert_eq!(text.find("zürich"), vec![9..15], "{name}: glyphs 9 to 14");
+    }
+}
+
+/// One page per text matrix, each showing `codes` in Helvetica whose `/ToUnicode` maps the
+/// codes in `unicode` (a `bfchar` body) to several characters.
+fn ligature_pages(unicode: &str, codes: &str, matrices: &[&str]) -> Pdf {
+    use lopdf::{Document, Object, Stream, dictionary};
+    let mut doc = Document::with_version("1.7");
+    let cmap = format!(
+        "/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /TestLigatures def /CMapType 2 def 1 begincodespacerange <00> <FF> endcodespacerange {unicode} endcmap CMapName currentdict /CMap defineresource pop end end"
+    );
+    let to_unicode = doc.add_object(Stream::new(dictionary! {}, cmap.into_bytes()));
+    let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Helvetica", "ToUnicode" => to_unicode });
+    let pages = doc.new_object_id();
+    let mut kids = Vec::new();
+    for m in matrices {
+        let content = doc.add_object(Stream::new(dictionary! {}, format!("BT /F1 20 Tf {m} Tm ({codes}) Tj ET").into_bytes()));
+        let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
+        kids.push(Object::Reference(page));
+    }
+    let count = kids.len() as i64;
+    doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => kids, "Count" => count}.into());
+    let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
+    doc.trailer.set("Root", catalog);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).unwrap();
+    Pdf::new(std::sync::Arc::new(bytes)).unwrap()
+}
+
+#[test]
+fn a_ligature_is_one_glyph_in_every_writing_direction() {
+    // "o", one glyph for "ffi", "c", "e": "office", turned 0°, 90°, 180° and 270°. The same
+    // codes without the ligature mapping ("oWce") are the control for the glyph box.
+    let turns = ["1 0 0 1 100 150", "0 1 -1 0 150 100", "-1 0 0 -1 200 150", "0 -1 1 0 150 200"];
+    let ligature = ligature_pages("1 beginbfchar <57> <006600660069> endbfchar", "oWce", &turns);
+    let control = ligature_pages("", "oWce", &turns);
+    for (page, turn) in turns.iter().enumerate() {
+        let text = extract_page(&ligature, page, &InterpreterSettings::default()).unwrap();
+        let plain = extract_page(&control, page, &InterpreterSettings::default()).unwrap();
+        assert_eq!(plain.plain_text(), "oWce", "Tm {turn}");
+        assert_eq!(text.plain_text(), "office", "Tm {turn}");
+        assert_eq!(text.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["o", "ffi", "c", "e"], "Tm {turn}");
+        assert_eq!(text.glyphs[1].rect, plain.glyphs[1].rect, "the painted glyph's box, Tm {turn}");
+        assert_eq!(text.find("ffi"), vec![1..2], "Tm {turn}");
+        assert_eq!(text.find("of"), vec![0..2], "a match ending inside the ligature covers it, Tm {turn}");
+        assert_eq!(text.line_rects(0..4).len(), 1, "one line, Tm {turn}");
+    }
+}
+
+/// One page per content stream, in Helvetica (`/F1`), with `/P1` in the resources'
+/// `/Properties` naming the `/ActualText` "fi".
+fn marked_pages(contents: &[&str]) -> Pdf {
+    use lopdf::{Document, Object, Stream, dictionary};
+    let mut doc = Document::with_version("1.7");
+    let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Helvetica" });
+    let pages = doc.new_object_id();
+    let mut kids = Vec::new();
+    for c in contents {
+        let content = doc.add_object(Stream::new(dictionary! {}, c.as_bytes().to_vec()));
+        let resources = dictionary! {
+            "Font" => dictionary! {"F1" => font},
+            "Properties" => dictionary! {"P1" => dictionary! {"ActualText" => Object::string_literal("fi")}},
+        };
+        let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => resources, "Contents" => content });
+        kids.push(Object::Reference(page));
+    }
+    let count = kids.len() as i64;
+    doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => kids, "Count" => count}.into());
+    let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
+    doc.trailer.set("Root", catalog);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).unwrap();
+    Pdf::new(std::sync::Arc::new(bytes)).unwrap()
+}
+
+fn marked_text(pdf: &Pdf, page: usize) -> PageText {
+    extract_page(pdf, page, &InterpreterSettings::default()).unwrap()
+}
+
+#[test]
+fn redraws_of_a_long_replacement_share_a_text_budget() {
+    let long = "0041".repeat(32 * 1024);
+    let redraws = 200;
+    let content = format!(
+        "BT /F1 20 Tf 1 0 0 1 100 150 Tm /Span <</ActualText <FEFF{long}>>> BDC (x) Tj EMC {} ET",
+        "1 0 0 1 100 150 Tm (x) Tj ".repeat(redraws)
+    );
+    let pdf = marked_pages(&[&content]);
+    REDRAW_TEXT_BYTES.with(|c| c.set(0));
+    let text = marked_text(&pdf, 0);
+    let given = REDRAW_TEXT_BYTES.with(|c| c.get());
+    assert!(given <= MAX_REDRAW_TEXT, "{given} bytes of replacement text given to {redraws} redraws");
+    assert!(text.plain_text().starts_with("AAAA"));
+    // A short replacement still covers its redraw.
+    let pdf = marked_pages(&["BT /F1 20 Tf 1 0 0 1 100 150 Tm /Span <</ActualText (fi)>> BDC (x) Tj EMC 1 0 0 1 100 150 Tm (x) Tj ET"]);
+    REDRAW_TEXT_BYTES.with(|c| c.set(0));
+    assert_eq!(marked_text(&pdf, 0).plain_text(), "fi");
+    assert_eq!(REDRAW_TEXT_BYTES.with(|c| c.get()), 2);
+}
+
+#[test]
+fn text_after_an_inline_image_survives_a_non_ascii_byte_before_a_later_ei() {
+    // Everyday content both ways: a string with a byte above 0x7F, and a later word holding
+    // a capital "EI". The end-of-data look-ahead used to read the string's bytes as image
+    // data, so the image swallowed the rest of the page.
+    let pdf = marked_pages(&[
+        "BI /W 1 /H 1 /BPC 8 /CS /DeviceGray ID \0 EI BT /F1 20 Tf 1 0 0 1 20 200 Tm (Gr\u{fc}\u{df}e) Tj 1 0 0 1 20 150 Tm (EINGANG) Tj ET",
+    ]);
+
+    assert!(marked_text(&pdf, 0).plain_text().contains("EINGANG"), "the text after the inline image was not extracted");
+}
+
+#[test]
+fn actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction() {
+    // Chrome marks each shaped Thai cluster this way: "น้ำ" (U+0E19 U+0E49 U+0E33) here stands
+    // for the two glyphs "xy", between "a" and "b". The same codes unmarked are the control.
+    let turns = ["1 0 0 1 100 150", "0 1 -1 0 150 100", "-1 0 0 -1 200 150", "0 -1 1 0 150 200"];
+    let marked: Vec<String> =
+        turns.iter().map(|m| format!("BT /F1 20 Tf {m} Tm (a) Tj /Span <</ActualText <FEFF0E190E490E33>>> BDC (xy) Tj EMC (b) Tj ET")).collect();
+    let plain: Vec<String> = turns.iter().map(|m| format!("BT /F1 20 Tf {m} Tm (axyb) Tj ET")).collect();
+    let marked = marked_pages(&marked.iter().map(String::as_str).collect::<Vec<_>>());
+    let plain = marked_pages(&plain.iter().map(String::as_str).collect::<Vec<_>>());
+    for (page, turn) in turns.iter().enumerate() {
+        let text = marked_text(&marked, page);
+        let control = marked_text(&plain, page);
+        assert_eq!(control.plain_text(), "axyb", "Tm {turn}");
+        assert_eq!(text.plain_text(), "aน้ำb", "Tm {turn}");
+        assert_eq!(text.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["a", "น้ำ", "b"], "Tm {turn}");
+        assert_eq!(text.find("น้ำ"), vec![1..2], "Tm {turn}");
+        assert_eq!(text.line_rects(0..3).len(), 1, "one line, Tm {turn}");
+        // The replacement's box is the union of the boxes of the glyphs it replaces.
+        let (x, y) = (&control.glyphs[1].rect, &control.glyphs[2].rect);
+        let union = [x[0].min(y[0]), x[1].min(y[1]), x[2].max(y[2]), x[3].max(y[3])];
+        for (got, want) in text.glyphs[1].rect.iter().zip(union) {
+            assert!((got - want).abs() < 0.01, "box {:?} ≠ {union:?}, Tm {turn}", text.glyphs[1].rect);
+        }
+        assert_eq!(text.glyphs[1].direction, control.glyphs[1].direction, "Tm {turn}");
+    }
+}
+
+#[test]
+fn redraw_dedupe_work_is_bounded_on_hostile_pages() {
+    // 100,000 replacements and 100,000 unmarked glyphs that never match, all at one spot:
+    // unbounded, every replacement would compare every glyph (10^10 comparisons).
+    const N: usize = 100_000;
+    let glyph = |text: &str| {
+        let quad = [[100.0, 110.0], [110.0, 110.0], [110.0, 100.0], [100.0, 100.0]];
+        (0, [1.0, 0.0], TextGlyph { text: text.into(), rect: [100.0, 100.0, 110.0, 110.0], quad, direction: [1.0, 0.0] })
+    };
+    let mut dev = TextDevice::new();
+    // A genuine redraw first: it is still deduplicated within the budget.
+    dev.glyphs.push(glyph("fi"));
+    dev.glyphs.push(glyph("x"));
+    dev.replaced.push(Replaced { at: Some(0), text: "fi".into(), originals: vec![("x".into(), [100.0, 100.0, 110.0, 110.0])] });
+    dev.glyphs.extend((0..N).map(|_| glyph("y")));
+    for _ in 0..N {
+        dev.glyphs.push(glyph("z"));
+        let at = dev.glyphs.len() - 1;
+        dev.replaced.push(Replaced { at: Some(at), text: "z".into(), originals: vec![("q".into(), [100.0, 100.0, 110.0, 110.0])] });
+    }
+    let started = std::time::Instant::now();
+    dev.finish();
+    assert!(started.elapsed() < std::time::Duration::from_secs(30), "took {:?}", started.elapsed());
+    assert_eq!(dev.glyphs.len(), 2 * N + 2, "unmatched glyphs are kept");
+    assert_eq!(dev.glyphs[1].2.text, "fi", "the redraw found within the budget takes the replacement");
+}
+
+#[test]
+fn actual_text_follows_the_pdf_rules_for_marked_content() {
+    let pdf = marked_pages(&[
+        // Named in the resources' /Properties.
+        "BT /F1 20 Tf 1 0 0 1 100 150 Tm (o) Tj /Span /P1 BDC (W) Tj EMC (ce) Tj ET",
+        // Nested: the outermost replacement covers everything inside it.
+        "BT /F1 20 Tf 1 0 0 1 100 150 Tm /Span <</ActualText (AB)>> BDC /Span <</ActualText (Z)>> BDC (x) Tj EMC (y) Tj EMC ET",
+        // Empty: the marked glyphs stand for no text (a soft hyphen at a line break); the gap
+        // the hyphen leaves still reads as one.
+        "BT /F1 20 Tf 1 0 0 1 100 150 Tm (co) Tj /Span <</ActualText ()>> BDC (-) Tj EMC (op) Tj ET",
+        // Across two lines: each glyph keeps its own text, so selection and lines still work.
+        "BT /F1 20 Tf 1 0 0 1 100 150 Tm /Span <</ActualText (Q)>> BDC (x) Tj 0 -40 Td (y) Tj EMC ET",
+        // Unbalanced: a stray EMC first, and a replacement the page never closes.
+        "EMC BT /F1 20 Tf 1 0 0 1 100 150 Tm (a) Tj /Span <</ActualText (fi)>> BDC (xy) Tj ET",
+        // Marked content without /ActualText changes nothing.
+        "BT /F1 20 Tf 1 0 0 1 100 150 Tm /P <</MCID 0>> BDC (ab) Tj EMC /Artifact BMC (c) Tj EMC ET",
+    ]);
+    let plain: Vec<String> = (0..6).map(|p| marked_text(&pdf, p).plain_text()).collect();
+    assert_eq!(plain, ["ofice", "AB", "co op", "x\ny", "afi", "abc"]);
+}
+
+#[test]
+fn an_unmarked_redraw_of_actual_text_reads_as_the_same_text() {
+    // Canva draws text twice (an outline or shadow) and marks only one drawing. The copy,
+    // before or after the marked one and half a point off, takes the same replacement and is
+    // dropped as a redraw; the same codes elsewhere on the page keep their own text.
+    let marked = "BT /F1 20 Tf 1 0 0 1 100 150 Tm (a) Tj /Span <</ActualText <FEFF0E190E490E33>>> BDC (xy) Tj EMC (b) Tj ET";
+    let copy = "BT /F1 20 Tf 1 0 0 1 100.5 150.5 Tm (axyb) Tj ET";
+    let elsewhere = "BT /F1 20 Tf 1 0 0 1 100 50 Tm (axyb) Tj ET";
+    let pdf = marked_pages(&[&format!("{marked} {copy} {elsewhere}"), &format!("{copy} {marked} {elsewhere}")]);
+    for page in 0..2 {
+        assert_eq!(marked_text(&pdf, page).plain_text(), "aน้ำb\naxyb", "page {page}");
+    }
+}
+
+/// Issue #3109: text drawn in clipping mode (`7 Tr`) sets the clip for a subsequent fill,
+/// shading or image without painting the glyphs directly, and must still reach `TextDevice`
+/// with the same boxes and search ranges as modes 0–6.
+#[test]
+fn clipping_mode_text_is_extracted_and_searchable_like_other_rendering_modes() {
+    let fill_through = " 0 0 1 rg 0 0 300 300 re f";
+    let mut pages: Vec<String> =
+        (0..=7).map(|mode| format!("q BT /F1 24 Tf {mode} Tr 72 150 Td () Tj [(Hello) -200 (World)] TJ ET{fill_through} Q")).collect();
+    // Page 8: /ActualText wrapping 7 Tr clip-only text.
+    pages.push(format!("q /Span <</ActualText (Hello World)>> BDC BT /F1 24 Tf 7 Tr 72 150 Td (Glyphs) Tj ET EMC{fill_through} Q"));
+    // Page 9: 0 Tr underpainting followed by 7 Tr at the same position (outline/gradient overlay) deduplicates.
+    pages.push(format!("BT /F1 24 Tf 0 Tr 72 150 Td (Hello World) Tj ET q BT /F1 24 Tf 7 Tr 72 150 Td (Hello World) Tj ET{fill_through} Q"));
+    // Page 10: 90° turned 7 Tr text.
+    pages.push(format!("q BT /F1 24 Tf 7 Tr 0 1 -1 0 150 100 Tm (Hello World) Tj ET{fill_through} Q"));
+    // Page 11: 7 Tr without any fill-through (visually blank, still extractable).
+    pages.push("BT /F1 24 Tf 7 Tr 72 150 Td (Hello World) Tj ET".into());
+
+    let refs: Vec<&str> = pages.iter().map(String::as_str).collect();
+    let pdf = marked_pages(&refs);
+    let control = marked_text(&pdf, 0);
+    assert_eq!(control.plain_text(), "Hello World");
+    let control_rects = control.line_rects(0..5);
+    assert_eq!(control_rects.len(), 1);
+    for mode in 0..=7 {
+        let text = marked_text(&pdf, mode);
+        assert_eq!(text.plain_text(), "Hello World", "mode {mode} Tr");
+        assert_eq!(text.find("hello"), vec![0..5], "mode {mode} Tr");
+        assert_eq!(text.find_opts("Hello", true, true), vec![0..5], "mode {mode} Tr");
+        assert_eq!(
+            text.find_with(|chars| chars.starts_with(&['H', 'e', 'l', 'l', 'o']).then_some(0..5).into_iter().collect()),
+            vec![0..5],
+            "mode {mode} Tr"
+        );
+        assert_eq!(text.line_rects(0..5), control_rects, "mode {mode} Tr");
+        assert_eq!(text.glyphs, control.glyphs, "mode {mode} Tr");
+    }
+    let actual = marked_text(&pdf, 8);
+    assert_eq!(actual.plain_text(), "Hello World");
+    assert_eq!(actual.find("Hello"), vec![0..1]);
+
+    let deduped = marked_text(&pdf, 9);
+    assert_eq!(deduped.plain_text(), "Hello World");
+
+    let turned = marked_text(&pdf, 10);
+    assert_eq!(turned.plain_text(), "Hello World");
+    assert_eq!(turned.find("World"), vec![6..11]);
+
+    let unfilled = marked_text(&pdf, 11);
+    assert_eq!(unfilled.plain_text(), "Hello World");
+
+    // Visual check: page 7 (`7 Tr` + blue fill-through) paints blue only inside the clipped
+    // glyph outlines, whereas page 11 (`7 Tr` alone) paints no ink at all.
+    let mut renderer = crate::PageRenderer::new(std::sync::Arc::new(pdf.data().as_ref().to_vec()), crate::RenderConfig::default());
+    let filled_px = renderer.render(crate::RenderRequest { page: 7, kind: crate::RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(filled_px.error.is_none());
+    let blue_pixels = filled_px.rgba.as_chunks::<4>().0.iter().filter(|p| p[0] < 32 && p[1] < 32 && p[2] > 200).count();
+    let white_pixels = filled_px.rgba.as_chunks::<4>().0.iter().filter(|p| p[..3] == [255, 255, 255]).count();
+    assert!(blue_pixels > 50 && white_pixels > 80_000, "blue={blue_pixels}, white={white_pixels}");
+
+    let unfilled_px = renderer.render(crate::RenderRequest { page: 11, kind: crate::RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    assert!(unfilled_px.error.is_none());
+    assert!(unfilled_px.rgba.as_chunks::<4>().0.iter().all(|p| p[..3] == [255, 255, 255]));
+}
+
+#[test]
+fn clipping_mode_filter_keeps_titles_and_excludes_ocr() {
+    let pdf = marked_pages(&[
+        "q BT /F1 24 Tf 7 Tr 30 200 Td (Clipped heading) Tj ET 0 0 1 rg 0 0 300 300 re f Q BT /F1 12 Tf 3 Tr 30 100 Td (Hidden OCR) Tj ET",
+        "q /Span <</ActualText (Accessible heading)>> BDC BT /F1 24 Tf 7 Tr 30 200 Td (Clipped heading) Tj ET EMC 0 0 1 rg 0 0 300 300 re f Q",
+    ]);
+    assert!(marked_text(&pdf, 0).plain_text().contains("Hidden OCR"));
+    for (page, expected) in [(0, "Clipped heading"), (1, "Accessible heading")] {
+        let text = extract_page_filtered(&pdf, page, &InterpreterSettings::default(), TextFilter { images: true, ..Default::default() }).unwrap();
+        assert_eq!(text.plain_text(), expected);
+        assert!(!text.find("heading").is_empty());
+    }
+}
+
+/// ISO 32000-2 §9.3.6: Type 3 text under `7 Tr` is not rendered (vendored hayro-interpret
+/// patch 64), but it is still clipping text, not an invisible text layer: the filter that
+/// drops OCR layers keeps it, as it keeps clipping text in other fonts.
+#[test]
+fn clipping_mode_type3_text_is_kept_by_the_ocr_filter() {
+    let font = "<< /Type /Font /Subtype /Type3 /FontBBox [0 0 1000 1000] /FontMatrix [0.001 0 0 0.001 0 0] \
+                    /CharProcs << /A 6 0 R >> /Encoding << /Type /Encoding /Differences [65 /A] >> \
+                    /FirstChar 65 /LastChar 65 /Widths [1000] >>";
+    let glyph = "1000 0 100 0 900 800 d1 100 0 800 800 re f";
+    let content = "BT /T3 24 Tf 7 Tr 30 200 Td (AAA) Tj ET BT /T3 12 Tf 3 Tr 30 100 Td (A) Tj ET";
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /T3 5 0 R >> >> >>".to_string(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        font.to_string(),
+        format!("<< /Length {} >>\nstream\n{glyph}\nendstream", glyph.len()),
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer << /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
+    let all = extract_page_filtered(&pdf, 0, &InterpreterSettings::default(), TextFilter::default()).unwrap();
+    assert_eq!(all.plain_text().matches('A').count(), 4, "{:?}", all.plain_text());
+    let filtered = extract_page_filtered(&pdf, 0, &InterpreterSettings::default(), TextFilter { images: true, ..Default::default() }).unwrap();
+    assert_eq!(filtered.plain_text().trim(), "AAA", "the 7 Tr text stays, the 3 Tr layer goes");
+}
+
+/// One page per `(encoding, content)`, in Helvetica (`/F1`).
+fn encoded_pages(pages: &[(lopdf::Object, &[u8])]) -> Pdf {
+    use lopdf::{Document, Object, Stream, dictionary};
+    let mut doc = Document::with_version("1.7");
+    let pages_id = doc.new_object_id();
+    let mut kids = Vec::new();
+    for (encoding, content) in pages {
+        let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Helvetica", "Encoding" => encoding.clone() });
+        let content = doc.add_object(Stream::new(dictionary! {}, content.to_vec()));
+        let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages_id, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
+        kids.push(Object::Reference(page));
+    }
+    let count = kids.len() as i64;
+    doc.objects.insert(pages_id, dictionary! {"Type" => "Pages", "Kids" => kids, "Count" => count}.into());
+    let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages_id});
+    doc.trailer.set("Root", catalog);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).unwrap();
+    Pdf::new(std::sync::Arc::new(bytes)).unwrap()
+}
+
+/// The Annex D.2 alias codes extract as the ink they draw, not as formatting characters.
+///
+/// WinAnsiEncoding gives 0xAD and 0xA0 the glyph names `hyphen` and `space`, the names it
+/// also gives 0x2D and 0x20, and MacRomanEncoding gives 0xCA `space`. Reporting the Adobe
+/// Glyph List values U+00AD and U+00A0 for them hid visible text: a soft hyphen is invisible,
+/// so "well-known" written that way matched no search and no redaction pattern.
+/// `XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 of them.
+///
+/// A `/Differences` entry naming `sfthyphen` or `nbspace` is a deliberate statement about one
+/// code and keeps its glyph list value. pdftotext draws the same line: on this fixture it
+/// reads the base-encoded codes as "a-b a b" and the named ones as U+00AD.
+#[test]
+fn the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space() {
+    use lopdf::{Object, dictionary};
+    let name = |n: &str| Object::Name(n.as_bytes().to_vec());
+    let differences = Object::Dictionary(dictionary! {
+        "Type" => "Encoding",
+        "BaseEncoding" => "WinAnsiEncoding",
+        "Differences" => vec![Object::Integer(88), name("sfthyphen"), Object::Integer(89), name("nbspace")],
+    });
+    let pdf = encoded_pages(&[
+        (name("WinAnsiEncoding"), &b"BT /F1 20 Tf 1 0 0 1 20 150 Tm (a\xadb\xa0c) Tj ET"[..]),
+        (name("MacRomanEncoding"), &b"BT /F1 20 Tf 1 0 0 1 20 150 Tm (a\xcab) Tj ET"[..]),
+        (differences, &b"BT /F1 20 Tf 1 0 0 1 20 150 Tm (aXbYc) Tj ET"[..]),
+    ]);
+    let texts = |page| extract_page(&pdf, page, &InterpreterSettings::default()).unwrap().glyphs.iter().map(|g| g.text.clone()).collect::<Vec<_>>();
+    assert_eq!(texts(0), ["a", "-", "b", " ", "c"], "WinAnsi 0xAD and 0xA0");
+    assert_eq!(texts(1), ["a", " ", "b"], "MacRoman 0xCA");
+    assert_eq!(texts(2), ["a", "\u{ad}", "b", "\u{a0}", "c"], "a named glyph keeps its glyph list value");
+}
+
+/// #3169, #3170: glyph names outside the Adobe Glyph List still read as text. Ligature
+/// (`f_i`) and suffixed (`hyphen.case`) names go by the glyph list specification's full
+/// mapping. A name that only numbers the glyph (`c251` small caps, `C39`, `C174`, `C39.sc`)
+/// reads as nothing, not as a guess from the code (review on #3239: with `/C1` at 233,
+/// StandardEncoding's 233 would read `Ø` for a glyph drawn as `é`), and so do a ZapfDingbats
+/// name (`a12`) and a name with no meaning left (`foo`).
+#[test]
+fn glyph_names_outside_the_glyph_list_still_read_as_text() {
+    use lopdf::{Object, dictionary};
+    let name = |n: &str| Object::Name(n.as_bytes().to_vec());
+    let differences = Object::Dictionary(dictionary! {
+        "Type" => "Encoding",
+        "Differences" => vec![
+            Object::Integer(30), name("f_i"), name("f_l"), Object::Integer(2), name("hyphen.case"),
+            Object::Integer(39), name("C39"), Object::Integer(97), name("c251"), Object::Integer(174), name("C174"),
+            Object::Integer(88), name("a12"), name("foo"), name("uni00660069"),
+            Object::Integer(61), name("C39.sc"), Object::Integer(233), name("C1"),
+        ],
+    });
+    // One glyph per line: the test font has none of these glyphs, so they have no width, and
+    // on one line a later `fi` would sit on the first and be dropped as its fake-bold copy.
+    let mut content = b"BT /F1 20 Tf 20 290 Td".to_vec();
+    for code in *b"\x1e\x1f\x02'a\xaeXYZ=\xe9" {
+        content.extend_from_slice(b" (");
+        content.push(code);
+        content.extend_from_slice(b") Tj 0 -25 Td");
+    }
+    content.extend_from_slice(b" ET");
+    let pdf = encoded_pages(&[(differences, &content[..])]);
+    let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap().plain_text();
+    let lines: Vec<&str> = text.lines().map(str::trim).filter(|l| !l.is_empty()).collect();
+    assert_eq!(lines, ["fi", "fl", "-", "fi"], "{text:?}");
+}
+
+/// Review on #3239: the glyph list specification's `uni` and `u` forms take uppercase hex
+/// digits only, and map a name with lowercase ones to nothing ("uni20ac" in its examples).
+/// Names upstream's own lookup can't read (several groups, a suffix) show it: lowercase reads
+/// as nothing, uppercase as its characters. A bare `uni20ac` or `u1040c` is still read by
+/// upstream's lenient `unicode_from_name`, outside this mapping.
+#[test]
+fn glyph_names_with_lowercase_hex_read_as_nothing() {
+    use lopdf::{Object, dictionary};
+    let name = |n: &str| Object::Name(n.as_bytes().to_vec());
+    let differences = Object::Dictionary(dictionary! {
+        "Type" => "Encoding",
+        "Differences" => vec![Object::Integer(65), name("uni20ac0308"), name("uni20AC0308"), name("u1040c.alt"), name("u1040C.alt"), name("f_uni20ac"), name("f_uni20AC")],
+    });
+    let pdf = encoded_pages(&[(
+        differences,
+        &b"BT /F1 20 Tf 20 180 Td (A) Tj 0 -25 Td (B) Tj 0 -25 Td (C) Tj 0 -25 Td (D) Tj 0 -25 Td (E) Tj 0 -25 Td (F) Tj ET"[..],
+    )]);
+    // One glyph per line, so each name's text stays its own (and a name read as nothing
+    // leaves no line).
+    let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap().plain_text();
+    let lines: Vec<&str> = text.lines().map(str::trim).filter(|l| !l.is_empty()).collect();
+    assert_eq!(lines, ["\u{20ac}\u{308}", "\u{1040c}", "f", "f\u{20ac}"], "{text:?}");
+}
+
+#[test]
+fn narrow_ligatures_keep_every_letter() {
+    // Split evenly, this "ffi" put its two "f"s so close that the second was dropped as a
+    // fake-bold copy of the first.
+    let pdf = ligature_pages("1 beginbfchar <62> <006600660069> endbfchar", "obce", &["1 0 0 1 100 150"]);
+    let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
+    assert_eq!(text.plain_text(), "office");
+}
+
+#[test]
+fn right_to_left_ligatures_keep_their_logical_order() {
+    // "سلام" drawn left to right as meem, alef, lam, seen; then with lam-alef as one glyph.
+    let letters = ligature_pages("4 beginbfchar <61> <0645> <62> <0644> <63> <0633> <64> <0627> endbfchar", "adbc", &["1 0 0 1 100 150"]);
+    let ligature = ligature_pages("3 beginbfchar <61> <0645> <62> <06440627> <63> <0633> endbfchar", "abc", &["1 0 0 1 100 150"]);
+    for pdf in [letters, ligature] {
+        assert_eq!(extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap().plain_text(), "سلام");
+    }
+    // "بَاب" with beh and its fatha as one glyph, as Add text writes shaped Arabic: the mark
+    // stays after its letter.
+    let marked = ligature_pages("3 beginbfchar <61> <0628064E> <62> <0627> <63> <0628> endbfchar", "cba", &["1 0 0 1 100 150"]);
+    assert_eq!(extract_page(&marked, 0, &InterpreterSettings::default()).unwrap().plain_text(), "بَاب");
+}
+
+#[test]
+fn vertical_ligatures_stay_in_their_column() {
+    use lopdf::{Document, Object, Stream, dictionary};
+    let mut doc = Document::with_version("1.7");
+    // CID 2 is one glyph for "株式".
+    let cmap = b"/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /TestUnicode def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespacerange 3 beginbfchar <0001> <65E5> <0002> <682A5F0F> <0003> <8A9E> endbfchar endcmap CMapName currentdict /CMap defineresource pop end end";
+    let unicode = doc.add_object(Stream::new(dictionary! {}, cmap.to_vec()));
+    let cid = doc.add_object(dictionary! {
+        "Type" => "Font", "Subtype" => "CIDFontType2", "BaseFont" => "TestVertical",
+        "CIDSystemInfo" => dictionary! { "Registry" => Object::string_literal("Adobe"), "Ordering" => Object::string_literal("Identity"), "Supplement" => 0 },
+        "DW" => 1000, "DW2" => vec![Object::Integer(880), Object::Integer(-1000)], "CIDToGIDMap" => "Identity"
+    });
+    let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type0", "BaseFont" => "TestVertical", "Encoding" => "Identity-V", "DescendantFonts" => vec![Object::Reference(cid)], "ToUnicode" => unicode });
+    let content = doc.add_object(Stream::new(dictionary! {}, b"BT /F1 20 Tf 1 0 0 1 200 250 Tm <000100020003> Tj ET".to_vec()));
+    let pages = doc.new_object_id();
+    let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(300), Object::Integer(300)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
+    doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
+    let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
+    doc.trailer.set("Root", catalog);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).unwrap();
+    let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
+    let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
+    assert_eq!(text.plain_text(), "日株式語");
+    assert_eq!(text.glyphs.len(), 3);
+    assert_eq!(text.line_rects(0..3).len(), 1, "one column");
+}
+
+#[test]
+fn upright_mapping_round_trips() {
+    let r = [10.0, 20.0, 30.0, 25.0];
+    for q in 0..4 {
+        assert_eq!(from_upright(to_upright(r, q, 300.0, 200.0), q, 300.0, 200.0), r, "quarter {q}");
+    }
+    // A 90° page: the view's top-right corner is the upright top-left.
+    assert_eq!(to_upright([290.0, 0.0, 300.0, 10.0], 1, 300.0, 200.0), [0.0, 0.0, 10.0, 10.0]);
+}
+
+#[test]
+fn turkish_dotted_and_dotless_i_match_in_any_case() {
+    // "İSTANBUL IRMAK KIŞ" on one line: each word typed in lower case must find it, and the
+    // reverse. `to_lowercase` alone made `İ` two characters and left `ı` unmatched.
+    let mut v = Vec::new();
+    word(&mut v, "İSTANBUL", 10.0, 10.0, 7.0);
+    word(&mut v, "IRMAK", 80.0, 10.0, 7.0);
+    word(&mut v, "KIŞ", 130.0, 10.0, 7.0);
+    let upper = layout(v);
+    assert_eq!(upper.plain_text(), "İSTANBUL IRMAK KIŞ");
+    assert_eq!(upper.find("istanbul"), vec![0..8]);
+    assert_eq!(upper.find("İstanbul"), vec![0..8]);
+    assert_eq!(upper.find("ırmak"), vec![8..13]);
+    assert_eq!(upper.find("kış"), vec![13..16]);
+    assert_eq!(upper.find("istanbul ırmak kış"), vec![0..16], "a phrase across the words");
+    assert_eq!(upper.find_opts("ırmak", false, true), vec![8..13], "whole words");
+    assert!(upper.find_opts("istanbul", true, false).is_empty(), "case-sensitive search stays exact");
+    assert_eq!(upper.find_opts("İSTANBUL", true, false), vec![0..8]);
+
+    let mut v = Vec::new();
+    word(&mut v, "istanbul", 10.0, 10.0, 7.0);
+    word(&mut v, "ırmak", 80.0, 10.0, 7.0);
+    word(&mut v, "kış", 130.0, 10.0, 7.0);
+    let lower = layout(v);
+    assert_eq!(lower.find("İSTANBUL"), vec![0..8]);
+    assert_eq!(lower.find("IRMAK"), vec![8..13]);
+    assert_eq!(lower.find("KIŞ"), vec![13..16]);
+}
+
+#[test]
+fn greek_sigma_forms_match_without_changing_exact_search_or_glyph_ranges() {
+    let mut v = Vec::new();
+    word(&mut v, "κόσμος", 10.0, 10.0, 7.0);
+    word(&mut v, "ΚΌΣΜΟΣ", 80.0, 10.0, 7.0);
+    word(&mut v, "σςΣ", 150.0, 10.0, 7.0);
+    let text = layout(v);
+    assert_eq!(text.plain_text(), "κόσμος ΚΌΣΜΟΣ σςΣ");
+    for query in ["κόσμος", "ΚΌΣΜΟΣ"] {
+        assert_eq!(text.find(query), vec![0..6, 6..12]);
+        assert_eq!(text.find_opts(query, false, true), vec![0..6, 6..12]);
+    }
+    for query in ["σ", "ς", "Σ"] {
+        assert_eq!(text.find(query), vec![2..3, 5..6, 8..9, 11..12, 12..13, 13..14, 14..15]);
+        assert!(text.find_opts(query, false, true).is_empty());
+    }
+    assert_eq!(text.find_opts("κόσμος", true, false), vec![0..6]);
+    assert_eq!(text.find_opts("ΚΌΣΜΟΣ", true, false), vec![6..12]);
+    assert_eq!(text.find_opts("ς", true, false), vec![5..6, 13..14]);
+    assert_eq!(text.find_opts_limited("ς", false, false, 2), vec![2..3, 5..6]);
+    assert_eq!(text.line_rects(text.find("κόσμος")[1].clone()), text.line_rects(6..12));
+}
+
+#[test]
+fn case_folding_keeps_one_character_per_character() {
+    for s in ["İSTANBUL", "ırmak", "Hello WORLD", "ÇAĞLAR", "Straße", "ΣΟΦΙΑ", "Σσς", "日本語"] {
+        assert_eq!(fold_case(s).chars().count(), s.chars().count(), "{s}");
+    }
+    assert_eq!(fold_case("Hello WORLD"), "hello world");
+    assert_eq!(fold_case("ÇAĞLAR Şişli"), "çağlar şişli");
+    assert_eq!(fold_case("İIıi"), "iiii");
+    assert_eq!(fold_case("Σσς"), "σσσ");
+}
+
+fn g(t: &str, x0: f32, y0: f32, x1: f32) -> TextGlyph {
+    let rect = [x0, y0, x1, y0 + 10.0];
+    TextGlyph { text: t.into(), rect, quad: [[x0, y0], [x1, y0], [x1, rect[3]], [x0, rect[3]]], direction: [1.0, 0.0] }
+}
+
+/// A glyph whose em box is `w` × `h` at `origin`, advancing along `dir` with its up edge along
+/// `up` (a unit step of each), as a sheared or turned text matrix draws it.
+fn tilted(t: &str, origin: [f32; 2], dir: [f32; 2], up: [f32; 2], w: f32, h: f32) -> TextGlyph {
+    let p = |a: f32, b: f32| [origin[0] + dir[0] * a + up[0] * b, origin[1] + dir[1] * a + up[1] * b];
+    let quad = [p(0.0, 0.0), p(w, 0.0), p(w, h), p(0.0, h)];
+    let xs = quad.map(|q| q[0]);
+    let ys = quad.map(|q| q[1]);
+    let rect = [
+        xs.iter().copied().fold(f32::MAX, f32::min),
+        ys.iter().copied().fold(f32::MAX, f32::min),
+        xs.iter().copied().fold(f32::MIN, f32::max),
+        ys.iter().copied().fold(f32::MIN, f32::max),
+    ];
+    TextGlyph { text: t.into(), rect, quad, direction: dir }
+}
+
+/// #3693: pointing at the middle of a glyph in sheared or turned text finds that glyph, not
+/// the one before it whose bounding box overlaps it.
+#[test]
+fn nearest_finds_the_glyph_under_the_pointer_in_sheared_and_turned_text() {
+    let s = std::f32::consts::FRAC_1_SQRT_2;
+    // (writing direction, up edge) in view space (y down): upright, sheared 0.35, turned 45°.
+    for (dir, up) in [([1.0, 0.0], [0.0, -1.0]), ([1.0, 0.0], [0.35, -1.0]), ([s, -s], [-s, -s])] {
+        let mut advance = 0.0;
+        let glyphs: Vec<TextGlyph> = "film in the list of tiny jilt flit"
+            .chars()
+            .map(|c| {
+                let w = if "filjt ".contains(c) { 3.0 } else { 6.0 };
+                let g = tilted(&c.to_string(), [50.0 + dir[0] * advance, 300.0 + dir[1] * advance], dir, up, w, 14.0);
+                advance += w;
+                g
+            })
+            .collect();
+        let t = layout(glyphs.clone());
+        assert_eq!(t.glyphs.len(), glyphs.len(), "layout kept every glyph");
+        for (i, g) in glyphs.iter().enumerate() {
+            let cx = g.quad.iter().map(|q| q[0]).sum::<f32>() / 4.0;
+            let cy = g.quad.iter().map(|q| q[1]).sum::<f32>() / 4.0;
+            assert_eq!(t.nearest(cx, cy), Some(i), "dir {dir:?} up {up:?}: glyph {i} ({})", g.text);
+        }
+        // Past either end of the line, the end glyph is still the nearest.
+        let (first, last) = (&glyphs[0], &glyphs[glyphs.len() - 1]);
+        assert_eq!(t.nearest(first.quad[0][0] - dir[0] * 8.0, first.quad[0][1] - dir[1] * 8.0), Some(0));
+        assert_eq!(t.nearest(last.quad[1][0] + dir[0] * 8.0, last.quad[1][1] + dir[1] * 8.0), Some(glyphs.len() - 1));
+    }
+}
+
+#[test]
+fn a_degenerate_or_nan_quad_holds_no_point() {
+    assert!(!quad_contains(&[[1.0, 1.0]; 4], 1.0, 1.0));
+    assert!(!quad_contains(&[[0.0, 0.0], [1.0, 0.0], [f32::NAN, 1.0], [0.0, 1.0]], 0.5, 0.5));
+    assert!(quad_contains(&[[0.0, 0.0], [4.0, 0.0], [4.0, 4.0], [0.0, 4.0]], 4.0, 2.0));
+    // Wound the other way.
+    assert!(quad_contains(&[[0.0, 0.0], [0.0, 4.0], [4.0, 4.0], [4.0, 0.0]], 2.0, 2.0));
+}
+
+#[test]
+fn lines_words_and_search() {
+    // "Hello world" on line 1, "Next" on line 2.
+    let mut v = Vec::new();
+    for (i, c) in "Hello".chars().enumerate() {
+        v.push(g(&c.to_string(), 10.0 + i as f32 * 6.0, 10.0, 16.0 + i as f32 * 6.0));
+    }
+    for (i, c) in "world".chars().enumerate() {
+        v.push(g(&c.to_string(), 50.0 + i as f32 * 6.0, 10.0, 56.0 + i as f32 * 6.0));
+    }
+    for (i, c) in "Next".chars().enumerate() {
+        v.push(g(&c.to_string(), 10.0 + i as f32 * 6.0, 30.0, 16.0 + i as f32 * 6.0));
+    }
+    let t = layout(v);
+    assert_eq!(t.plain_text(), "Hello world\nNext");
+    assert_eq!(t.find("WORLD next"), vec![5..14]);
+    assert_eq!(t.find("o"), vec![4..5, 6..7]);
+    assert_eq!(t.line_rects(3..12).len(), 2);
+    assert_eq!(t.nearest(52.0, 14.0), Some(5));
+}
+
+/// #1315: a custom match that ends on a reconstructed word or line separator does not take
+/// the following glyph.
+#[test]
+fn a_match_ending_on_a_separator_stops_before_the_next_glyph() {
+    let glyphs: Vec<TextGlyph> = "quickbrown"
+        .chars()
+        .enumerate()
+        .map(|(i, c)| {
+            let x = i as f32 * 6.0;
+            g(&c.to_string(), x, 0.0, x + 6.0)
+        })
+        .collect();
+    for line_break in [false, true] {
+        let mut space_before = vec![false; 10];
+        space_before[5] = !line_break;
+        let line_of = (0..10).map(|i| u32::from(line_break && i >= 5)).collect();
+        let page = PageText { glyphs: glyphs.clone(), line_of, space_before };
+        let plain = if line_break { "quick\nbrown" } else { "quick brown" };
+        assert_eq!(page.plain_text(), plain);
+        assert_eq!(page.find("quick "), vec![0..5]);
+        let span = |r: std::ops::Range<usize>| Vec::from([r]);
+        assert_eq!(page.find_with(|_| span(0..5)), vec![0..5]);
+        assert_eq!(page.find_with(|_| span(5..11)), vec![5..10]);
+        assert_eq!(page.find_with(|_| span(6..11)), vec![5..10]);
+        let hits = page.find_with(|_| span(0..6));
+        assert_eq!(page.text_of(hits[0].clone()), "quick");
+        assert_eq!(hits, vec![0..5]);
+    }
+}
+
+#[test]
+fn phrase_search_ignores_repeated_spaces() {
+    // "quick  brown" drawn with two space glyphs in a row. Text extraction keeps both spaces,
+    // but the phrase search has always collapsed runs of whitespace in the query, so the page
+    // text has to be collapsed the same way or the phrase is never found (#814).
+    let mut v = Vec::new();
+    word(&mut v, "quick", 10.0, 10.0, 6.0);
+    v.push(g(" ", 46.0, 10.0, 52.0));
+    v.push(g(" ", 52.0, 10.0, 58.0));
+    word(&mut v, "brown", 58.0, 10.0, 6.0);
+    let n = v.len();
+    let t = PageText { glyphs: v, line_of: vec![0; n], space_before: vec![false; n] };
+    assert_eq!(t.plain_text(), "quick  brown");
+    assert_eq!(t.find("quick brown"), vec![0..12]);
+    assert_eq!(t.find("quick  brown"), vec![0..12], "the query's own run of spaces is collapsed too");
+    assert_eq!(t.find("quick\tbrown"), vec![0..12]);
+    assert_eq!(t.find("quick"), vec![0..5]);
+    assert_eq!(t.find("brown"), vec![7..12]);
+    assert_eq!(t.find_opts_limited("o", false, false, 0), Vec::new());
+    assert!(t.find("quick absent").is_empty());
+}
+
+#[test]
+fn limited_search_stops_after_the_requested_matches() {
+    let mut glyphs = Vec::new();
+    word(&mut glyphs, "oooo", 10.0, 10.0, 6.0);
+    let text = layout(glyphs);
+    assert_eq!(text.find_opts_limited("o", false, false, 2), vec![0..1, 1..2]);
+    assert_eq!(text.find_opts_limited("o", false, false, 10), vec![0..1, 1..2, 2..3, 3..4]);
+}
+
+fn word(v: &mut Vec<TextGlyph>, s: &str, x: f32, y: f32, advance: f32) {
+    for (i, c) in s.chars().enumerate() {
+        let x0 = x + i as f32 * advance;
+        v.push(g(&c.to_string(), x0, y, x0 + 6.0));
+    }
+}
+
+#[test]
+fn fake_bold_duplicates_are_removed() {
+    let mut v = Vec::new();
+    for (i, c) in "Bold".chars().enumerate() {
+        let x = 10.0 + i as f32 * 7.0;
+        v.push(g(&c.to_string(), x, 10.0, x + 6.0));
+        v.push(g(&c.to_string(), x + 0.3, 10.0, x + 6.3));
+    }
+    assert_eq!(layout(v).plain_text(), "Bold");
+    // A zero-width combining mark redrawn on itself is dropped too.
+    let v = vec![g("e", 10.0, 10.0, 16.0), g("\u{301}", 13.0, 10.0, 13.0), g("e", 10.0, 10.0, 16.0), g("\u{301}", 13.0, 10.0, 13.0)];
+    assert_eq!(layout(v).plain_text(), "e\u{301}");
+}
+
+/// #1467: condensed text (80 Tz and below, OCR layers fitted to the scan) sets narrow letters
+/// closer than a fifth of their height apart; a doubled letter there is two letters, not a redraw.
+#[test]
+fn condensed_double_letters_are_kept() {
+    for scale in [0.8, 0.65, 0.5] {
+        let mut v = Vec::new();
+        let mut x = 10.0;
+        // Helvetica advances at 10 pt, in thousandths of an em.
+        for (c, adv) in [('A', 667.0), ('l', 222.0), ('l', 222.0), ('e', 556.0)] {
+            let w = adv / 100.0 * scale;
+            v.push(g(&c.to_string(), x, 10.0, x + w));
+            x += w;
+        }
+        assert_eq!(layout(v.clone()).plain_text(), "Alle", "at {scale} horizontal scaling");
+        // Each letter redrawn a fifth of a point to the right is still one letter.
+        let bold: Vec<TextGlyph> = v.iter().flat_map(|c| [c.clone(), g(&c.text, c.rect[0] + 0.2, 10.0, c.rect[2] + 0.2)]).collect();
+        assert_eq!(layout(bold).plain_text(), "Alle", "fake bold at {scale} horizontal scaling");
+    }
+}
+
+/// #2457: OCR text layers squeeze each word into its box down to 20 Tz and below, where a
+/// narrow letter is less than a twentieth of its height wide. Doubled letters, and letters
+/// repeated two or three places on, are still letters there, not redraws.
+#[test]
+fn ocr_condensed_double_letters_are_kept() {
+    // Helvetica advances, in thousandths of an em.
+    let adv = |c: char| match c {
+        'M' => 833.0,
+        'K' | 'B' => 667.0,
+        'W' => 944.0,
+        'I' | 't' | 'f' => 278.0,
+        'i' | 'l' => 222.0,
+        'm' => 833.0,
+        'r' => 333.0,
+        's' => 500.0,
+        _ => 556.0,
+    };
+    for scale in [0.2, 0.1, 0.05] {
+        for word in ["Hallo", "Mitte", "Wille", "Kommission", "Illustration", "still", "Brunnen", "Kaffee"] {
+            let mut v = Vec::new();
+            let mut x = 10.0;
+            for c in word.chars() {
+                let w = adv(c) / 100.0 * scale;
+                v.push(g(&c.to_string(), x, 10.0, x + w));
+                x += w;
+            }
+            assert_eq!(layout(v.clone()).plain_text(), word, "at {scale} horizontal scaling");
+            // Each letter drawn twice at the same place is still one letter.
+            let bold: Vec<TextGlyph> = v.iter().flat_map(|c| [c.clone(), c.clone()]).collect();
+            assert_eq!(layout(bold).plain_text(), word, "fake bold at {scale} horizontal scaling");
+            // And redrawn a quarter of its own width to the right (the match reaches half of it).
+            let shifted: Vec<TextGlyph> = v
+                .iter()
+                .flat_map(|c| {
+                    let d = (c.rect[2] - c.rect[0]) * 0.25;
+                    [c.clone(), g(&c.text, c.rect[0] + d, 10.0, c.rect[2] + d)]
+                })
+                .collect();
+            assert_eq!(layout(shifted).plain_text(), word, "shifted fake bold at {scale} horizontal scaling");
+        }
+    }
+}
+
+#[test]
+fn two_columns_read_left_then_right_even_if_drawn_interleaved() {
+    let mut v = Vec::new();
+    // Drawn row by row across both columns, as some producers do.
+    word(&mut v, "Left1", 10.0, 10.0, 6.0);
+    word(&mut v, "Right1", 200.0, 10.0, 6.0);
+    word(&mut v, "Left2", 10.0, 24.0, 6.0);
+    word(&mut v, "Right2", 200.0, 24.0, 6.0);
+    let t = layout(v);
+    assert_eq!(t.plain_text(), "Left1\nLeft2\nRight1\nRight2");
+}
+
+/// Lays out one-word lines, each `(text, x, y)`, 10 pt high: 14 pt apart is a line in a paragraph, 24 pt a
+/// paragraph gap.
+fn lines(at: &[(&str, f32, f32)]) -> String {
+    let mut v = Vec::new();
+    for &(s, x, y) in at {
+        word(&mut v, s, x, y, 6.0);
+    }
+    layout(v).plain_text()
+}
+
+#[test]
+fn a_column_reads_on_past_a_paragraph_gap() {
+    // #3658: a heading and paragraph A at the top of the left column, a paragraph gap, then paragraph B, which
+    // goes on at the top of the right column, and paragraph C below it.
+    let two = [
+        ("Heading", 10.0, 10.0),
+        ("A1", 10.0, 30.0),
+        ("A2", 10.0, 44.0),
+        ("A3", 10.0, 58.0),
+        ("B1", 10.0, 82.0),
+        ("B2", 10.0, 96.0),
+        ("B3", 200.0, 30.0),
+        ("B4", 200.0, 44.0),
+        ("C1", 200.0, 68.0),
+        ("C2", 200.0, 82.0),
+    ];
+    assert_eq!(lines(&two), "Heading\nA1\nA2\nA3\nB1\nB2\nB3\nB4\nC1\nC2");
+    // Three columns, each with a gap at a different height.
+    let three = [
+        ("A1", 10.0, 10.0),
+        ("A2", 10.0, 24.0),
+        ("B1", 10.0, 48.0),
+        ("C1", 150.0, 10.0),
+        ("D1", 150.0, 38.0),
+        ("D2", 150.0, 52.0),
+        ("E1", 290.0, 10.0),
+        ("E2", 290.0, 24.0),
+        ("E3", 290.0, 38.0),
+        ("F1", 290.0, 62.0),
+    ];
+    assert_eq!(lines(&three), "A1\nA2\nB1\nC1\nD1\nD2\nE1\nE2\nE3\nF1");
+}
+
+#[test]
+fn a_column_reads_on_past_a_line_that_only_touches_it() {
+    // The #3658 page with a right-column paragraph whose first line touches B1's by 1 pt or 0.1 pt, or whose
+    // second line carries a 6 pt footnote marker reaching up beside B2: none of them is a row with B1.
+    let page = |extra: &[(&str, f32, f32, f32)]| {
+        let mut v = Vec::new();
+        let left = [("H", 10.0, 10.0), ("A1", 10.0, 30.0), ("A2", 10.0, 44.0), ("A3", 10.0, 58.0), ("B1", 10.0, 82.0), ("B2", 10.0, 96.0)];
+        for &(s, x, y) in left.iter().chain(&[("R1", 200.0, 30.0), ("R2", 200.0, 44.0)]) {
+            word(&mut v, s, x, y, 6.0);
+        }
+        for &(s, x, y, h) in extra {
+            for (i, c) in s.chars().enumerate() {
+                let x0 = x + i as f32 * h * 0.6;
+                v.push(em_box(&c.to_string(), x0, y, x0 + h * 0.6, y + h));
+            }
+        }
+        layout(v).plain_text().replace('\n', " ")
+    };
+    assert_eq!(page(&[("S1", 200.0, 91.0, 10.0), ("S2", 200.0, 105.0, 10.0)]), "H A1 A2 A3 B1 B2 R1 R2 S1 S2", "1 pt touch");
+    assert_eq!(page(&[("S1", 200.0, 72.1, 10.0), ("S2", 200.0, 86.1, 10.0)]), "H A1 A2 A3 B1 B2 R1 R2 S1 S2", "0.1 pt touch");
+    let marker = page(&[("S1", 200.0, 68.0, 10.0), ("x", 200.0, 96.0, 10.0), ("9", 206.5, 90.0, 6.0), ("S2y", 214.0, 96.0, 10.0)]);
+    assert!(marker.starts_with("H A1 A2 A3 B1 B2 R1 R2 S1 "), "footnote marker: {marker}");
+}
+
+#[test]
+fn a_full_width_line_ends_the_columns_above_it() {
+    // Two columns, a full-width heading, two more columns and a full-width footnote. The left column stops at the
+    // heading and the footnote: the right column above each one reads first.
+    let page = [
+        ("L1", 10.0, 10.0),
+        ("L2", 10.0, 24.0),
+        ("L3", 10.0, 48.0),
+        ("R1", 200.0, 10.0),
+        ("R2", 200.0, 38.0),
+        ("Fullwidthheading", 10.0, 80.0),
+        ("L4", 10.0, 110.0),
+        ("L5", 10.0, 124.0),
+        ("L6", 10.0, 148.0),
+        ("R3", 200.0, 110.0),
+        ("R4", 200.0, 138.0),
+        ("Fullwidthfootnote", 10.0, 200.0),
+    ];
+    // The two full-width lines run past the right column (x = 286 and 304) at 18 pt a letter.
+    let mut v = Vec::new();
+    for &(s, x, y) in &page {
+        word(&mut v, s, x, y, if s.len() > 2 { 18.0 } else { 6.0 });
+    }
+    assert_eq!(layout(v).plain_text(), "L1\nL2\nL3\nR1\nR2\nFullwidthheading\nL4\nL5\nL6\nR3\nR4\nFullwidthfootnote");
+}
+
+#[test]
+fn table_rows_apart_still_read_across() {
+    // Rows a paragraph gap apart whose cells start level read row by row, as before #3658.
+    let rows = [("Name", 10.0, 10.0), ("Qty", 100.0, 10.0), ("Apple", 10.0, 34.0), ("12", 100.0, 34.0), ("Pear", 10.0, 58.0), ("7", 100.0, 58.0)];
+    assert_eq!(lines(&rows), "Name\nQty\nApple\n12\nPear\n7");
+}
+
+#[test]
+fn form_rows_in_mixed_sizes_still_read_across() {
+    // 8 pt labels beside 12 pt values on one baseline, rows 30 pt apart: the tops differ by 4 pt, but the first
+    // lines overlap, so each row reads label then value.
+    let mut v = Vec::new();
+    let sized = |v: &mut Vec<TextGlyph>, s: &str, x: f32, base: f32, h: f32| {
+        for (i, c) in s.chars().enumerate() {
+            let x0 = x + i as f32 * h * 0.6;
+            v.push(em_box(&c.to_string(), x0, base - h, x0 + h * 0.6, base));
+        }
+    };
+    for (i, (label, value)) in [("Name", "Alice"), ("Street", "Main"), ("City", "Oslo")].into_iter().enumerate() {
+        let base = 20.0 + 30.0 * i as f32;
+        sized(&mut v, label, 10.0, base, 8.0);
+        sized(&mut v, value, 100.0, base, 12.0);
+    }
+    assert_eq!(layout(v).plain_text(), "Name\nAlice\nStreet\nMain\nCity\nOslo");
+    // Values drawn 6 pt below their labels, rows a paragraph gap apart.
+    let offset =
+        [("Name", 10.0, 10.0), ("Val1", 100.0, 16.0), ("Addr", 10.0, 40.0), ("Val2", 100.0, 46.0), ("City", 10.0, 70.0), ("Val3", 100.0, 76.0)];
+    assert_eq!(lines(&offset), "Name\nVal1\nAddr\nVal2\nCity\nVal3");
+}
+
+#[test]
+fn a_column_does_not_jump_to_a_distant_footer_footnote_or_caption() {
+    // A page number far below the left column reads after the right column.
+    let footer = [
+        ("L1", 10.0, 10.0),
+        ("L2", 10.0, 24.0),
+        ("L3", 10.0, 48.0),
+        ("R1", 200.0, 10.0),
+        ("R2", 200.0, 24.0),
+        ("R3", 200.0, 48.0),
+        ("Pg7", 10.0, 400.0),
+    ];
+    assert_eq!(lines(&footer), "L1\nL2\nR1\nR2\nL3\nR3\nPg7");
+    // So does a footnote under the left column only, with the page number under the right one.
+    let footnote = [
+        ("L1", 10.0, 10.0),
+        ("L2", 10.0, 24.0),
+        ("L3", 10.0, 48.0),
+        ("R1", 200.0, 10.0),
+        ("R2", 200.0, 24.0),
+        ("R3", 200.0, 48.0),
+        ("Note", 10.0, 380.0),
+        ("Pg7", 200.0, 400.0),
+    ];
+    assert_eq!(lines(&footnote), "L1\nL2\nR1\nR2\nL3\nR3\nNote\nPg7");
+    // A caption under a full-width figure (no text from 70 to 250), as narrow as the left column, reads after both
+    // columns above the figure and before the columns below it.
+    let caption = [
+        ("L1", 10.0, 10.0),
+        ("L2", 10.0, 24.0),
+        ("L3", 10.0, 38.0),
+        ("R1", 200.0, 10.0),
+        ("R2", 200.0, 24.0),
+        ("R3", 200.0, 38.0),
+        ("Cap", 10.0, 260.0),
+        ("M1", 10.0, 290.0),
+        ("M2", 10.0, 304.0),
+        ("N1", 200.0, 290.0),
+        ("N2", 200.0, 304.0),
+    ];
+    assert_eq!(lines(&caption), "L1\nL2\nL3\nR1\nR2\nR3\nCap\nM1\nM2\nN1\nN2");
+}
+
+#[test]
+fn many_column_paragraphs_order_in_bounded_time() {
+    // 2000 paragraphs in two columns, the right one offset by half a paragraph: every block is a column
+    // continuation, and choosing each one scans the remaining blocks.
+    let mut v = Vec::new();
+    for i in 0..1000u16 {
+        let y = 10.0 + 24.0 * f32::from(i);
+        word(&mut v, "L", 10.0, y, 6.0);
+        word(&mut v, "R", 200.0, y + 12.0, 6.0);
+    }
+    let start = std::time::Instant::now();
+    let text = layout(v).plain_text();
+    assert!(start.elapsed() < std::time::Duration::from_secs(5), "{:?}", start.elapsed());
+    // Compared without printing 4000 characters on failure.
+    let expected = format!("{}{}", "L\n".repeat(1000), "R\n".repeat(999) + "R");
+    assert!(text == expected, "the first R reads after {:?} lines, not 1000", text.find('R').map(|i| i / 2));
+}
+
+#[test]
+fn tracked_text_keeps_letters_together() {
+    let mut v = Vec::new();
+    word(&mut v, "CHAPTER", 10.0, 10.0, 9.0); // 3pt tracking between 6pt-wide letters
+    word(&mut v, "FOUR", 10.0 + 7.0 * 9.0 + 5.0, 10.0, 9.0);
+    assert_eq!(layout(v).plain_text(), "CHAPTER FOUR");
+}
+
+#[test]
+fn toc_leaders_do_not_hide_word_gaps() {
+    use lopdf::{Document, Object, Stream, dictionary};
+    for dots in [0, 5, 10, 20, 40, 60] {
+        for (words, expected) in [
+            ("(Was)-333(ist)-333(OTRS?)", "Was ist OTRS?"),
+            ("(Das)-333(OTRS)-333(Web-Interface)", "Das OTRS Web-Interface"),
+            ("(Neuen)-333(Zugang)-333(beantragen)", "Neuen Zugang beantragen"),
+        ] {
+            // The issue's LaTeX TJ spacing, without embedding the corpus PDF or a font asset.
+            let mut doc = Document::with_version("1.7");
+            let font = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Times-Roman" });
+            let operators = format!("BT /F1 10 Tf 10 100 Td [{words}-441{}-1663(7)] TJ ET", "-500(.)".repeat(dots));
+            let content = doc.add_object(Stream::new(dictionary! {}, operators.into_bytes()));
+            let pages = doc.new_object_id();
+            let page = doc.add_object(dictionary! {
+                "Type" => "Page", "Parent" => pages,
+                "MediaBox" => vec![0.into(), 0.into(), 800.into(), Object::Integer(200)],
+                "Resources" => dictionary! { "Font" => dictionary! { "F1" => font } }, "Contents" => content
+            });
+            doc.objects.insert(pages, dictionary! { "Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1 }.into());
+            let catalog = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages });
+            doc.trailer.set("Root", catalog);
+            let mut bytes = Vec::new();
+            doc.save_to(&mut bytes).unwrap();
+            let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
+            let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
+            assert_eq!(text.plain_text(), format!("{expected} {}7", ". ".repeat(dots)), "{dots} leader dots");
+            let hits = text.find_opts(expected, true, true);
+            assert_eq!(hits.len(), 1, "{expected:?}, {dots} leader dots");
+            assert_eq!(text.text_of(hits[0].clone()), expected);
+            assert_eq!(text.line_rects(hits[0].clone()).len(), 1);
+            assert_eq!(text.find(&expected.to_lowercase()), hits);
+            assert!(text.find(&expected.replace(' ', "")).is_empty());
+        }
+    }
+}
+
+#[test]
+fn short_tracked_ellipses_remain_searchable() {
+    for dots in [3, 4] {
+        let mut v = Vec::new();
+        for i in 0..dots {
+            let x = 10.0 + i as f32 * 4.0;
+            v.push(g(".", x, 10.0, x + 2.0));
+        }
+        let ellipsis = ".".repeat(dots);
+        let text = layout(v.clone());
+        assert_eq!(text.plain_text(), ellipsis);
+        assert_eq!(text.find(&ellipsis), vec![0..dots]);
+        v.insert(0, g("A", 0.0, 10.0, 6.0));
+        let x = 12.0 + dots as f32 * 4.0;
+        v.push(g("B", x, 10.0, x + 6.0));
+        let text = layout(v);
+        let expected = format!("A {ellipsis} B");
+        assert_eq!(text.plain_text(), expected);
+        assert_eq!(text.find(&expected), vec![0..dots + 2]);
+    }
+}
+
+#[test]
+fn leaders_preserve_tracking_in_letters_numbers_and_punctuation() {
+    for advance in [9.0, 12.0] {
+        for leader in [".", "-", "…"] {
+            let mut v = Vec::new();
+            word(&mut v, "CHAPTER-1", 10.0, 10.0, advance);
+            let x = 10.0 + 9.0 * advance + 5.0;
+            word(&mut v, "1.4", x, 10.0, advance);
+            let mut x = x + 3.0 * advance + 5.0;
+            for _ in 0..60 {
+                v.push(g(leader, x, 10.0, x + 2.5));
+                x += 11.0;
+            }
+            let text = layout(v);
+            assert_eq!(text.plain_text(), format!("CHAPTER-1 1.4 {}", vec![leader; 60].join(" ")));
+            assert_eq!(text.find("chapter-1 1.4"), vec![0..12]);
+        }
+    }
+    // Decimal punctuation and repeated letters/digits still use their original tracking estimate.
+    for value in ["1.4", "1111", "llll"] {
+        let mut v = Vec::new();
+        word(&mut v, value, 10.0, 10.0, 12.0);
+        assert_eq!(layout(v).plain_text(), value);
+    }
+}
+
+#[test]
+fn rtl_runs_come_out_in_logical_order_and_cjk_has_no_spaces() {
+    let mut v = Vec::new();
+    // Hebrew "שלום" drawn visually right-to-left: ם ו ל ש from left to right.
+    word(&mut v, "םולש", 10.0, 10.0, 6.0);
+    assert_eq!(layout(v).plain_text(), "שלום");
+    let mut v = Vec::new();
+    word(&mut v, "每个字", 10.0, 10.0, 9.0);
+    assert_eq!(layout(v).plain_text(), "每个字");
+}
+
+/// #1062: the word gap stays between the runs when the right-hand run is drawn first, and
+/// between the words of a right-to-left line.
+#[test]
+fn word_gaps_follow_position_not_drawing_order() {
+    let mut v = Vec::new();
+    word(&mut v, "19.4", 40.0, 10.0, 6.0);
+    word(&mut v, "20.0", 10.0, 10.0, 6.0);
+    assert_eq!(layout(v).plain_text(), "20.0 19.4");
+    let mut v = Vec::new();
+    // "שלום עולם" drawn visually: עולם reversed on the left, שלום reversed on the right.
+    word(&mut v, "םלוע", 10.0, 10.0, 6.0);
+    word(&mut v, "םולש", 40.0, 10.0, 6.0);
+    assert_eq!(layout(v).plain_text(), "שלום עולם");
+}
+
+/// #2667: a number or punctuation on a right-to-left line must not split it into separately reversed words.
+#[test]
+fn rtl_line_with_number_and_punctuation_reads_in_logical_order() {
+    let line = |words: &[&str]| {
+        let mut v = Vec::new();
+        let mut x = 10.0;
+        for w in words {
+            word(&mut v, w, x, 10.0, 6.0);
+            x += w.chars().count() as f32 * 6.0 + 6.0;
+        }
+        layout(v).plain_text()
+    };
+    // Each line as drawn, left to right.
+    assert_eq!(line(&["םילקש", "120", "ריחמ"]), "מחיר 120 שקלים");
+    assert_eq!(line(&[".הקידב", "ךמסמ", "והז", ":תירבע"]), "עברית: זהו מסמך בדיקה.");
+    assert_eq!(line(&["باتك", "12.5", "ددع"]), "عدد 12.5 كتاب");
+    assert_eq!(line(&["םלוע", "םולש"]), "שלום עולם");
+    assert_eq!(line(&["Total", "םולש", "price"]), "Total שלום price");
+}
+
+/// Two lines, "ab cd" and "e fg": words stop at blank glyphs, word gaps and line ends.
+#[test]
+fn words_and_lines_around_a_glyph() {
+    let t = PageText {
+        glyphs: Vec::from(["a", "b", " ", "c", "d", "e", "f", "g"].map(|s| TextGlyph {
+            text: s.into(),
+            rect: [0.0; 4],
+            quad: [[0.0; 2]; 4],
+            direction: [1.0, 0.0],
+        })),
+        line_of: vec![0, 0, 0, 0, 0, 1, 1, 1],
+        space_before: vec![false, false, false, false, false, false, true, false],
+    };
+    assert_eq!(t.word_at(1), Some((0, 1)));
+    assert_eq!(t.word_at(3), Some((3, 4)));
+    assert_eq!(t.word_at(4), Some((3, 4)));
+    assert_eq!(t.word_at(5), Some((5, 5)));
+    assert_eq!(t.word_at(7), Some((6, 7)));
+    assert_eq!(t.line_at(2), Some((0, 4)));
+    assert_eq!(t.line_at(6), Some((5, 7)));
+    assert_eq!(t.word_at(8), None);
+    assert_eq!(t.line_at(8), None);
+    assert_eq!(PageText::default().line_at(0), None);
+}
+
+/// A 400 × 400 page drawing `ops` with Helvetica as /F1 and Courier as /F2.
+fn text_page(ops: &str) -> Pdf {
+    use lopdf::{Document, Object, Stream, dictionary};
+    let mut doc = Document::with_version("1.7");
+    let helvetica = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Helvetica" });
+    let courier = doc.add_object(dictionary! { "Type" => "Font", "Subtype" => "Type1", "BaseFont" => "Courier" });
+    let content = doc.add_object(Stream::new(dictionary! {}, ops.as_bytes().to_vec()));
+    let pages = doc.new_object_id();
+    let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(400), Object::Integer(400)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => helvetica, "F2" => courier}}, "Contents" => content });
+    doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
+    let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
+    doc.trailer.set("Root", catalog);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).unwrap();
+    Pdf::new(std::sync::Arc::new(bytes)).unwrap()
+}
+
+/// `body` shown in /F`font` at `size` with its baseline turned `degrees` counter-clockwise.
+fn turned(degrees: f64, font: u8, size: f64, x: f64, y: f64, body: &str) -> String {
+    let (s, c) = degrees.to_radians().sin_cos();
+    format!("BT /F{font} {size} Tf {c:.6} {s:.6} {:.6} {c:.6} {x:.4} {y:.4} Tm {body} ET\n", -s)
+}
+
+fn page_text(ops: &str) -> String {
+    extract_page(&text_page(ops), 0, &InterpreterSettings::default()).unwrap().plain_text()
+}
+
+#[test]
+fn short_doubled_word_at_same_origin_does_not_interleave() {
+    let ops = "BT /F1 12 Tf 50 Tz 1 0 0 1 100 200 Tm (world) Tj ET\n".repeat(2);
+    assert_single_word(page_glyphs(&ops));
+}
+
+#[test]
+fn short_near_shadow_does_not_interleave() {
+    let ops = "BT /F1 12 Tf 50 Tz 1 0 0 1 100 200 Tm (world) Tj ET\nBT /F1 12 Tf 50 Tz 1 0 0 1 101 200 Tm (world) Tj ET\n";
+    assert_single_word(page_glyphs(ops));
+}
+
+#[test]
+fn turned_short_doubled_word_does_not_interleave() {
+    let one = turned(37.0, 1, 12.0, 100.0, 200.0, "50 Tz (world) Tj");
+    assert_single_word(page_glyphs(&(one.clone() + &one)));
+}
+
+#[test]
+fn large_backward_tj_adjustment_stays_in_one_run() {
+    let text = page_glyphs("BT /F1 12 Tf 50 Tz 1 0 0 1 100 200 Tm [(wor) 3000 (ld)] TJ ET");
+    assert_eq!(text.plain_text(), "ld wor");
+    assert_eq!(text.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["l", "d", "w", "o", "r"]);
+    assert!(text.line_of.iter().all(|line| *line == 0));
+    assert_eq!(text.space_before, [false, false, true, false, false]);
+}
+
+#[test]
+fn reset_prefix_requires_one_glyph_height_of_progress() {
+    let mut glyphs = Vec::new();
+    word(&mut glyphs, "abc", 10.0, 10.0, 6.0);
+    word(&mut glyphs, "abc", 10.0, 10.0, 6.0);
+    let glyphs: Vec<&TextGlyph> = glyphs.iter().collect();
+    assert!(!restarts_run(&glyphs, 0, 3, 9.99));
+    assert!(!restarts_run(&glyphs, 0, 3, 10.0));
+    assert!(restarts_run(&glyphs, 0, 3, 10.01));
+}
+
+#[test]
+fn reset_prefix_uses_the_existing_redraw_position_tolerance() {
+    let mut near = Vec::new();
+    word(&mut near, "abc", 10.0, 10.0, 6.0);
+    word(&mut near, "abc", 11.99, 10.0, 6.0);
+    let near: Vec<&TextGlyph> = near.iter().collect();
+    assert!(restarts_run(&near, 0, 3, 10.01));
+
+    let mut far = Vec::new();
+    word(&mut far, "abc", 10.0, 10.0, 6.0);
+    word(&mut far, "abc", 12.01, 10.0, 6.0);
+    let far: Vec<&TextGlyph> = far.iter().collect();
+    assert!(!restarts_run(&far, 0, 3, 10.01));
+}
+
+#[test]
+fn reset_prefix_rejects_non_finite_positions() {
+    let mut glyphs = Vec::new();
+    word(&mut glyphs, "abc", 10.0, 10.0, 6.0);
+    word(&mut glyphs, "abc", 10.0, 10.0, 6.0);
+    glyphs[3].rect[0] = f32::NAN;
+    let glyphs: Vec<&TextGlyph> = glyphs.iter().collect();
+    assert!(!restarts_run(&glyphs, 0, 3, 10.01));
+}
+
+#[test]
+fn turned_lines_group_along_their_baseline() {
+    // Two lines 13 pt apart, words separated by TJ offsets (no space glyphs), the second
+    // line drawn first. Turned away from the quarter turns, the lines' boxes overlap.
+    for degrees in [12.0, 30.0, 37.0, 45.0, 60.0, 135.0, 200.0, 300.0, -45.0] {
+        let (s, c) = f64::to_radians(degrees).sin_cos();
+        let second = turned(degrees, 1, 12.0, 200.0 + s * 13.0, 200.0 - c * 13.0, "[(Second) -400 (line) -400 (here)] TJ");
+        let first = turned(degrees, 1, 12.0, 200.0, 200.0, "[(First) -400 (line) -400 (text)] TJ");
+        assert_eq!(page_text(&(second + &first)), "First line text\nSecond line here", "{degrees}°");
+    }
+}
+
+#[test]
+fn crossing_turned_lines_stay_apart() {
+    // Lines at 30° and −30° crossing each other, their glyphs drawn alternately.
+    let (up, down) = ("Upward words here", "Downward words now");
+    let mut ops = String::new();
+    let (s, c) = f64::to_radians(30.0).sin_cos();
+    for (k, (a, b)) in up.chars().zip(down.chars()).enumerate() {
+        let along = 7.2 * k as f64;
+        ops += &turned(30.0, 2, 12.0, 100.0 + c * along, 150.0 + s * along, &format!("({a}) Tj"));
+        ops += &turned(-30.0, 2, 12.0, 100.0 + c * along, 250.0 - s * along, &format!("({b}) Tj"));
+    }
+    ops += &turned(-30.0, 2, 12.0, 100.0 + c * 7.2 * 17.0, 250.0 - s * 7.2 * 17.0, "(w) Tj");
+    assert_eq!(page_text(&ops), "Downward words now\nUpward words here");
+}
+
+#[test]
+fn text_along_a_curve_is_one_line() {
+    // Courier glyphs (7.2 pt advance) set on circles of radius 90 around (200, 200): over
+    // the top reading clockwise, under the bottom reading counter-clockwise, and a full ring.
+    let arc = |text: &str, from: f64, clockwise: bool, radius: f64| {
+        let step = (7.2 / radius).to_degrees() * if clockwise { -1.0 } else { 1.0 };
+        let mut ops = String::new();
+        for (k, ch) in text.chars().enumerate() {
+            let a = from + step * k as f64;
+            let (s, c) = a.to_radians().sin_cos();
+            ops += &turned(if clockwise { a - 90.0 } else { a + 90.0 }, 2, 12.0, 200.0 + radius * c, 200.0 + radius * s, &format!("({ch}) Tj"));
+        }
+        ops
+    };
+    assert_eq!(page_text(&arc("CURVED STAMP TEXT", 150.0, true, 90.0)), "CURVED STAMP TEXT");
+    assert_eq!(page_text(&arc("BOTTOM ARC WORDS", 220.0, false, 90.0)), "BOTTOM ARC WORDS");
+    assert_eq!(page_text(&arc("ROUND SEAL OF THE COMPANY LIMITED", 180.0, true, 50.0)), "ROUND SEAL OF THE COMPANY LIMITED");
+}
+
+#[test]
+fn sheared_text_keeps_its_word_gaps() {
+    // The baseline climbs at about 31° while the glyphs stay upright.
+    let ops = "BT /F1 12 Tf 1 0.6 0 1 100 200 Tm [(Sheared) -400 (first)] TJ 1 0.6 0 1 100 187 Tm [(Sheared) -400 (second)] TJ ET";
+    assert_eq!(page_text(ops), "Sheared first\nSheared second");
+}
+
+#[test]
+fn turned_text_keeps_its_place_in_the_reading_order() {
+    // A turned label between a heading and its caption reads between them, as it did when
+    // it was laid out with the horizontal text; a vertical body still follows its heading.
+    let ops = "BT /F1 14 Tf 1 0 0 1 50 360 Tm (Heading above) Tj ET\n".to_string()
+        + &turned(30.0, 1, 12.0, 80.0, 250.0, "(Turned label) Tj")
+        + "BT /F1 12 Tf 1 0 0 1 50 150 Tm (Caption below) Tj ET\n";
+    assert_eq!(page_text(&ops), "Heading above\nTurned label\nCaption below");
+}
+
+#[test]
+fn turned_glyphs_keep_their_shape_and_direction() {
+    // 30° counter-clockwise on the page is 30° up from the x axis in view space (y down).
+    let pdf = text_page(&(turned(30.0, 1, 20.0, 100.0, 100.0, "(Ab) Tj") + "BT /F1 20 Tf 1 0 0.5 1 100 300 Tm (Ab) Tj ET"));
+    let text = extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap();
+    assert_eq!(text.plain_text(), "Ab\nAb");
+    for g in &text.glyphs {
+        assert!(g.quad.iter().flatten().chain(&g.direction).chain(&g.rect).all(|c| c.is_finite()), "{g:?}");
+        let bounds = g.quad.iter().fold([f32::INFINITY, f32::INFINITY, f32::NEG_INFINITY, f32::NEG_INFINITY], |r, p| {
+            [r[0].min(p[0]), r[1].min(p[1]), r[2].max(p[0]), r[3].max(p[1])]
+        });
+        assert_eq!(g.rect, bounds, "the box bounds the quad");
+        let [x, y] = [g.quad[1][0] - g.quad[0][0], g.quad[1][1] - g.quad[0][1]];
+        assert!(
+            (x * g.direction[1] - y * g.direction[0]).abs() < 1e-3 && x * g.direction[0] + y * g.direction[1] > 0.0,
+            "quad[0] → quad[1] runs along the direction: {g:?}"
+        );
+    }
+    let (skewed, turned) = (&text.glyphs[0], &text.glyphs[2]);
+    assert!((turned.direction[0] - 30f32.to_radians().cos()).abs() < 1e-6 && (turned.direction[1] + 0.5).abs() < 1e-6, "{turned:?}");
+    assert_eq!(skewed.direction, [1.0, 0.0]);
+    let slant = skewed.quad[3][0] - skewed.quad[0][0];
+    assert!((slant - 10.0).abs() < 1e-3, "the skewed glyph's upright edge leans by half its 20 pt height: {skewed:?}");
+}
+
+/// The operators drawing each `(text, text matrix)` run in Helvetica 12 pt, one text object per run.
+fn run_ops(runs: &[(&str, &str)]) -> String {
+    runs.iter().map(|(text, tm)| format!("BT /F1 12 Tf {tm} Tm ({text}) Tj ET\n")).collect()
+}
+
+fn page_glyphs(ops: &str) -> PageText {
+    extract_page(&text_page(ops), 0, &InterpreterSettings::default()).unwrap()
+}
+
+fn assert_single_word(text: PageText) {
+    assert_eq!(text.plain_text(), "world");
+    assert_eq!(text.glyphs.iter().map(|g| g.text.as_str()).collect::<String>(), "world");
+    assert_eq!(text.line_of, [0; 5]);
+    assert_eq!(text.space_before, [false; 5]);
+}
+
+#[test]
+fn runs_printed_over_each_other_stay_whole_at_any_angle() {
+    // Two runs that start at one point (exact overprint), that start 40 pt along and 3 pt down
+    // (shifted), and that are 14 pt apart (clear): at 0° and at 37°, each run comes out whole.
+    let tm = |angle: f32, along: f32, down: f32| {
+        let (s, c) = angle.to_radians().sin_cos();
+        let (x, y) = (100.0 + along * c - down * s, 200.0 + along * s + down * c);
+        format!("{c:.6} {s:.6} {:.6} {c:.6} {x:.4} {y:.4}", -s)
+    };
+    let (alpha, delta) = ("Alpha beta gamma", "Delta epsilon zeta");
+    for angle in [0.0, 37.0] {
+        for (along, down) in [(0.0, 0.0), (40.0, -3.0), (0.0, -14.0)] {
+            let text = page_glyphs(&run_ops(&[(alpha, &tm(angle, 0.0, 0.0)), (delta, &tm(angle, along, down))]));
+            for run in [alpha, delta] {
+                assert!(
+                    !text.find(run).is_empty(),
+                    "{run:?} whole at {angle}° with the second run {along} pt along and {down} pt across: {:?}",
+                    text.plain_text()
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn a_run_drawn_over_a_line_leaves_the_line_whole() {
+    // "XX" is drawn over the middle of "beta" after the line, so it is a run of its own that
+    // overlaps the line. The line must still come out as one whole line.
+    let text = page_glyphs(&run_ops(&[("Alpha beta gamma", "1 0 0 1 100 200"), ("XX", "1 0 0 1 136 200")]));
+    let flat = text.plain_text();
+    assert!(flat.contains("Alpha beta gamma"), "{flat:?}");
+    assert!(flat.contains("XX") && !flat.contains('\n'), "{flat:?}");
+}
+
+#[test]
+fn a_combining_mark_drawn_last_stays_with_its_letter() {
+    // "ab", then a far-off "Z", then a zero-width combining mark at the start of "b". The mark
+    // is a run of its own, but it has no extent, so it goes back next to "b".
+    let mut v = Vec::new();
+    word(&mut v, "ab", 10.0, 10.0, 6.0);
+    v.push(g("Z", 200.0, 10.0, 206.0));
+    v.push(g("\u{301}", 16.0, 10.0, 16.0));
+    let t = layout(v);
+    assert_eq!(t.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["a", "b", "\u{301}", "Z"]);
+}
+
+#[test]
+fn runs_differing_only_in_glyph_boundaries_are_not_redraws() {
+    // "ab" + "c" and "a" + "bc" have the same letters over the same places, but the glyph
+    // boundaries differ, so the second is not a redraw of the first and both stay.
+    let mut v = vec![g("ab", 10.0, 10.0, 16.0), g("c", 16.0, 10.0, 22.0)];
+    v.push(g("Z", 200.0, 10.0, 206.0));
+    v.push(g("a", 10.0, 10.0, 16.0));
+    v.push(g("bc", 16.0, 10.0, 22.0));
+    assert_eq!(layout(v).glyphs.len(), 5);
+}
+
+#[test]
+fn many_combining_marks_stay_with_their_letters() {
+    // 400 letters on one line, then a zero-width mark at the start of each one, drawn after the whole line:
+    // the marks form one run of their own, and each goes back next to its letter, in order.
+    let letters: Vec<String> = (0..400).map(|i| char::from(b'a' + (i % 26) as u8).to_string()).collect();
+    let mut v = Vec::new();
+    for (i, c) in letters.iter().enumerate() {
+        let x = 10.0 + i as f32 * 6.0;
+        v.push(g(c, x, 10.0, x + 6.0));
+    }
+    for i in 0..letters.len() {
+        let x = 10.0 + i as f32 * 6.0;
+        v.push(g("\u{301}", x, 10.0, x));
+    }
+    let t = layout(v);
+    let expected: Vec<&str> = letters.iter().flat_map(|c| [c.as_str(), "\u{301}"]).collect();
+    assert_eq!(t.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), expected);
+    assert!(t.line_of.iter().all(|line| *line == 0));
+}
+
+/// `count` runs of three glyphs, each starting within 3 pt of x = 10 on one baseline, so they all overprint one
+/// another. Every glyph has a text of its own, so no glyph is taken for a fake-bold copy. With `separated`, each run
+/// follows a far-off glyph, which makes it a run of its own.
+fn overprinted_runs(count: usize, separated: bool) -> Vec<TextGlyph> {
+    let mut v = Vec::new();
+    for k in 0..count {
+        let text: String = (0..3).map(|i| char::from_u32(0x4E00 + (3 * k + i) as u32).unwrap()).collect();
+        word(&mut v, &text, 10.0 + (k * 7 % 31) as f32 * 0.1, 10.0, 6.0);
+        if separated {
+            let far = char::from_u32(0x2500 + k as u32).unwrap().to_string();
+            v.push(g(&far, 500.0, 10.0, 506.0));
+        }
+    }
+    v
+}
+
+#[test]
+fn a_dense_overprint_joins_its_runs_and_keeps_each_whole() {
+    // 150 runs of three glyphs: about 100 000 overlapping pairs, far more than the sweep's budget. The segment is
+    // joined as one component, so the sweep is skipped, and each run still comes out whole.
+    let v = overprinted_runs(150, false);
+    let refs: Vec<&TextGlyph> = v.iter().collect();
+    let height = |i: usize| (refs[i].rect[3] - refs[i].rect[1]).max(0.1);
+    let mut sc = Scratch { text: (0..150).map(|k| Run { start: 3 * k, end: 3 * k + 3 }).collect(), ..Default::default() };
+    assert!(collide(&refs, &height, 10.0, &mut sc), "more pairs than the budget");
+    assert_eq!(sc.units.len(), 1, "one component");
+
+    let v = overprinted_runs(150, true);
+    let runs: Vec<String> = (0..150).map(|k| v[4 * k..4 * k + 3].iter().map(|g| g.text.as_str()).collect()).collect();
+    let t = layout(v);
+    assert_eq!(t.glyphs.len(), 600);
+    for run in &runs {
+        assert!(!t.find(run).is_empty(), "{run:?} whole in {:?}", t.plain_text());
+    }
+}
+
+#[test]
+fn overlapping_rows_each_start_a_word() {
+    // 60 rows of three glyphs, each row starting 2 pt right of the one before and overprinting it, so every row
+    // is a forced word break. The rows are separated by far-off glyphs, which makes each one a run of its own.
+    // Every glyph has a text of its own, so no glyph is taken for a fake-bold copy.
+    let mut v = Vec::new();
+    let mut rows = Vec::new();
+    for k in 0..60 {
+        let text: String = (0..3).map(|i| char::from_u32(0x0400 + (3 * k + i) as u32).unwrap()).collect();
+        word(&mut v, &text, 10.0 + 2.0 * k as f32, 10.0, 6.0);
+        v.push(g(&char::from_u32(0x0500 + k as u32).unwrap().to_string(), 500.0, 10.0, 506.0));
+        rows.push(text);
+    }
+    let t = layout(v);
+    let expected: String = rows.join(" ");
+    assert!(t.plain_text().starts_with(&expected), "{:?}", t.plain_text());
+}
+
+#[test]
+fn a_long_line_keeps_every_word_gap() {
+    // 1500 five-letter words on one line, a word gap after each: every gap is found, and only those.
+    let mut v = Vec::new();
+    let mut words = Vec::new();
+    for w in 0..1500 {
+        let text: String = (0..5).map(|i| char::from(b'a' + ((w * 7 + i * 3) % 26) as u8)).collect();
+        word(&mut v, &text, 10.0 + w as f32 * 36.0, 10.0, 6.0);
+        words.push(text);
+    }
+    assert_eq!(layout(v).plain_text(), words.join(" "));
+}
+
+#[test]
+fn a_redraw_is_found_among_look_alike_runs_up_to_the_candidate_limit() {
+    // 40 runs of "abc" share a text and a grid cell, but each differs from every other by more than a fifth of a
+    // line in its second or third glyph, so none redraws another. A run of "abc" at the place of the newest run is
+    // found, as the newest candidates are checked first. One at the place of the oldest run is 40 candidates back,
+    // past the limit, so it is kept.
+    let abc = |v: &mut Vec<TextGlyph>, k: usize| {
+        let (b, c) = (16.0 + 2.5 * (k % 4) as f32, 22.0 + 2.5 * (k / 4) as f32);
+        v.push(g("a", 10.0, 10.0, 16.0));
+        v.push(g("b", b, 10.0, b + 6.0));
+        v.push(g("c", c, 10.0, c + 6.0));
+    };
+    let far = |v: &mut Vec<TextGlyph>| {
+        for _ in 0..4 {
+            let x = 500.0 + 10.0 * v.len() as f32;
+            v.push(g("|", x, 10.0, x + 6.0));
+        }
+    };
+    let mut v = Vec::new();
+    for k in 0..40 {
+        abc(&mut v, k);
+        far(&mut v);
+    }
+    abc(&mut v, 39);
+    far(&mut v);
+    assert_eq!(layout(v.clone()).glyphs.iter().filter(|g| g.text == "a").count(), 40);
+    abc(&mut v, 0);
+    assert_eq!(layout(v).glyphs.iter().filter(|g| g.text == "a").count(), 41);
+}
+
+#[test]
+fn a_run_redrawn_at_the_same_place_is_printed_once() {
+    // "Hello world" drawn again 0.1 pt away (doubled text) prints once. The same words far
+    // below are a separate line, as they are not a redraw.
+    let ops = run_ops(&[("Hello world", "1 0 0 1 100 200"), ("Hello world", "1 0 0 1 100.1 200.1"), ("Hello world", "1 0 0 1 100 100")]);
+    assert_eq!(page_text(&ops), "Hello world\nHello world");
+}
+
+#[test]
+fn a_redraw_is_found_past_an_earlier_run_with_the_same_key() {
+    // Two "Hello" runs share a text and a grid cell but do not redraw each other: the second is
+    // tracked wider. A third run redraws the second and is dropped. A far-off "Z" keeps each run
+    // a segment of its own.
+    let mut v = Vec::new();
+    word(&mut v, "Hello", 10.0, 10.0, 6.0);
+    v.push(g("Z", 200.0, 10.0, 206.0));
+    word(&mut v, "Hello", 10.5, 10.0, 9.0);
+    v.push(g("Z", 300.0, 10.0, 306.0));
+    word(&mut v, "Hello", 10.6, 10.0, 9.0);
+    let t = layout(v);
+    assert_eq!(t.glyphs.iter().filter(|g| g.text == "H").count(), 2, "{:?}", t.plain_text());
+    assert_eq!(t.glyphs.len(), 12);
+}
+
+#[test]
+fn runs_that_only_touch_or_overlap_slightly_still_join() {
+    // "beta" is drawn first, then "Alpha" to its left: 2 pt apart (touching) or 2 pt overlapping
+    // (negative spacing). Both come out as one line in reading order. Where the word space goes
+    // for reversed fragments is not asserted here.
+    let mut v = Vec::new();
+    word(&mut v, "beta", 42.0, 10.0, 6.0);
+    word(&mut v, "Alpha", 10.0, 10.0, 6.0);
+    let t = layout(v);
+    assert_eq!(t.plain_text().replace(' ', ""), "Alphabeta");
+    assert!(t.line_of.iter().all(|line| *line == 0));
+    let mut v = Vec::new();
+    word(&mut v, "beta", 38.0, 10.0, 6.0);
+    word(&mut v, "Alpha", 10.0, 10.0, 6.0);
+    let t = layout(v);
+    assert_eq!(t.plain_text(), "Alphabeta");
+}
+
+/// A three-row table, "Name Qty / Apple 12 / Pear 7": the columns sit far enough apart that
+/// reading order takes one column, then the other.
+fn table() -> PageText {
+    let mut v = Vec::new();
+    for (row, (name, qty)) in [("Name", "Qty"), ("Apple", "12"), ("Pear", "7")].into_iter().enumerate() {
+        let y = 10.0 + row as f32 * 14.0;
+        word(&mut v, name, 10.0, y, 6.0);
+        word(&mut v, qty, 100.0, y, 6.0);
+    }
+    layout(v)
+}
+
+/// Issue #740: a column selection takes only what is inside the rectangle.
+#[test]
+fn a_column_selection_takes_one_table_column() {
+    let t = table();
+    assert_eq!(t.plain_text(), "Name\nApple\nPear\nQty\n12\n7", "reading order is column by column");
+    let qty = t.glyphs_in([95.0, 0.0, 130.0, 60.0]);
+    assert_eq!(t.column_text(&qty), "Qty\n12\n7");
+    assert_eq!(t.glyph_rects(&qty).len(), 3, "one highlight per row");
+    // Corners in either order.
+    assert_eq!(t.glyphs_in([130.0, 60.0, 95.0, 0.0]), qty);
+}
+
+/// Across columns the text comes out row by row, cells separated by tabs.
+#[test]
+fn a_column_selection_across_columns_reads_row_by_row() {
+    let t = table();
+    let all = t.glyphs_in([0.0, 0.0, 200.0, 60.0]);
+    assert_eq!(t.column_text(&all), "Name\tQty\nApple\t12\nPear\t7");
+    // The middle row only, and only the start of "Apple": centres decide.
+    let part = t.glyphs_in([0.0, 25.0, 31.0, 33.0]);
+    assert_eq!(t.column_text(&part), "Appl");
+    assert_eq!(t.glyph_rects(&part), vec![[10.0, 24.0, 34.0, 34.0]]);
+}
+
+/// A rectangle that misses every glyph, or is not a number, selects nothing.
+#[test]
+fn an_empty_or_degenerate_column_selection_is_empty() {
+    let t = table();
+    for r in [[300.0, 300.0, 400.0, 400.0], [f32::NAN, 0.0, 200.0, 60.0], [50.0, 50.0, 50.0, 50.0]] {
+        let none = t.glyphs_in(r);
+        assert!(none.is_empty(), "{r:?}");
+        assert_eq!(t.column_text(&none), "");
+        assert!(t.glyph_rects(&none).is_empty());
+    }
+    assert_eq!(PageText::default().column_text(&[0, 7, usize::MAX]), "", "indices past the text are ignored");
+}
+
+/// Right-to-left rows put their cells right to left.
+#[test]
+fn right_to_left_rows_read_right_to_left() {
+    let mut v = Vec::new();
+    // "שלום" (right) and "עולם" (left), each drawn visually.
+    word(&mut v, "םולש", 100.0, 10.0, 6.0);
+    word(&mut v, "םלוע", 10.0, 10.0, 6.0);
+    let t = layout(v);
+    let all = t.glyphs_in([0.0, 0.0, 200.0, 30.0]);
+    assert_eq!(t.column_text(&all), "שלום\tעולם");
+}
+
+/// Vertical lines (CJK vertical writing) come out one per row, in reading order.
+#[test]
+fn vertical_lines_keep_reading_order() {
+    // Written downwards: the em box's edge towards the next line is its left one.
+    let cell = |t: &str, x: f32, y: f32| TextGlyph {
+        text: t.into(),
+        rect: [x, y, x + 10.0, y + 10.0],
+        quad: [[x, y], [x, y + 10.0], [x + 10.0, y + 10.0], [x + 10.0, y]],
+        direction: [0.0, 1.0],
+    };
+    let t = PageText {
+        // Right column 日本 first, then the left column 語文, each top to bottom.
+        glyphs: vec![cell("日", 40.0, 10.0), cell("本", 40.0, 20.0), cell("語", 20.0, 10.0), cell("文", 20.0, 20.0)],
+        line_of: vec![0, 0, 1, 1],
+        space_before: vec![false; 4],
+    };
+    let all = t.glyphs_in([0.0, 0.0, 60.0, 40.0]);
+    assert_eq!(t.column_text(&all), "日本\n語文");
+}
+
+/// An embedded TrueType font with no `/Encoding`, flagged `flags`, its `/ToUnicode` (if
+/// any) mapping only printable ASCII, as OCR engines write the text layer of a scan.
+fn ocr_layer_text(flags: i64, ascii_to_unicode: bool) -> String {
+    use lopdf::{Document, Object, Stream, dictionary};
+    let mut doc = Document::with_version("1.7");
+    let program = doc.add_object(Stream::new(dictionary! {}, include_bytes!("../../../../assets/fonts/Inter-Regular.ttf").to_vec()));
+    let descriptor =
+        doc.add_object(dictionary! { "Type" => "FontDescriptor", "FontName" => "Inter-Regular", "Flags" => flags, "FontFile2" => program });
+    let mut font = dictionary! { "Type" => "Font", "Subtype" => "TrueType", "BaseFont" => "Inter-Regular", "FontDescriptor" => descriptor };
+    if ascii_to_unicode {
+        let cmap = b"/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CMapName /Ascii def /CMapType 2 def 1 begincodespacerange <00> <FF> endcodespacerange 1 beginbfrange <20> <7E> <0020> endbfrange endcmap CMapName currentdict /CMap defineresource pop end end";
+        font.set("ToUnicode", doc.add_object(Stream::new(dictionary! {}, cmap.to_vec())));
+    }
+    let font = doc.add_object(font);
+    // WinAnsi bytes: "Rückfragen für Überhitzungsschutz: können, weiß, Café".
+    let mut ops = b"BT /F1 14 Tf 1 0 0 1 20 200 Tm (".to_vec();
+    ops.extend_from_slice(b"R\xfcckfragen f\xfcr \xdcberhitzungsschutz: k\xf6nnen, wei\xdf, Caf\xe9");
+    ops.extend_from_slice(b") Tj ET");
+    let content = doc.add_object(Stream::new(dictionary! {}, ops));
+    let pages = doc.new_object_id();
+    let page = doc.add_object(dictionary! { "Type" => "Page", "Parent" => pages, "MediaBox" => vec![Object::Integer(0), Object::Integer(0), Object::Integer(400), Object::Integer(400)], "Resources" => dictionary! {"Font" => dictionary! {"F1" => font}}, "Contents" => content });
+    doc.objects.insert(pages, dictionary! {"Type" => "Pages", "Kids" => vec![Object::Reference(page)], "Count" => 1}.into());
+    let catalog = doc.add_object(dictionary! {"Type" => "Catalog", "Pages" => pages});
+    doc.trailer.set("Root", catalog);
+    let mut bytes = Vec::new();
+    doc.save_to(&mut bytes).unwrap();
+    let pdf = Pdf::new(std::sync::Arc::new(bytes)).unwrap();
+    extract_page(&pdf, 0, &InterpreterSettings::default()).unwrap().plain_text()
+}
+
+#[test]
+fn truetype_without_an_encoding_reads_its_codes_as_win_ansi() {
+    // Café: 0xE9 is /Oslash in StandardEncoding, so reading the codes as Standard first and
+    // WinAnsi only for the gaps would still give "CafØ".
+    let expected = "Rückfragen für Überhitzungsschutz: können, weiß, Café";
+    assert_eq!(ocr_layer_text(4, false), expected, "symbolic, no /ToUnicode");
+    assert_eq!(ocr_layer_text(32, true), expected, "nonsymbolic, /ToUnicode for ASCII only");
+}
diff --git a/crates/render/tests/it/luminosity_group_space.rs b/crates/render/tests/it/luminosity_group_space.rs
new file mode 100644
index 0000000000..d4f54c1a77
--- /dev/null
+++ b/crates/render/tests/it/luminosity_group_space.rs
@@ -0,0 +1,132 @@
+//! A luminosity soft mask takes its values from the gray of its group's colour (ISO 32000-2
+//! §11.5.3). In a `/DeviceCMYK` group that gray is `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)`
+//! (§10.4.2.3), so 100% K masks fully, whatever profile CMYK is displayed through.
+
+use std::sync::Arc;
+
+use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind};
+
+/// The page's grey backdrop, `0.5 g`, as the renderer writes it.
+const BACKDROP: f64 = 128.0;
+
+fn pdf(objects: &[String]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, body) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    out
+}
+
+fn stream(dict: &str, content: &str) -> String {
+    format!("<< {dict} /Length {} >>\nstream\n{content}\nendstream", content.len())
+}
+
+fn render(bytes: Vec<u8>) -> (Vec<u8>, u32) {
+    let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+    let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, preview: false });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    (page.rgba.to_vec(), page.width)
+}
+
+fn pixel(rgba: &[u8], width: u32, x: u32, y: u32) -> [u8; 3] {
+    let offset = usize::try_from((y * width + x) * 4).unwrap();
+    [rgba[offset], rgba[offset + 1], rgba[offset + 2]]
+}
+
+/// Red filled over the grey backdrop under a luminosity mask whose group, in `space`, paints its
+/// left half with `paint`; its right half is the backdrop `/BC` (`bc`, when given). Returns the
+/// mask values read back from the left and the right half.
+fn mask_values(space: &str, paint: &str, bc: Option<&str>) -> (f64, f64) {
+    let bc = bc.map(|bc| format!("/BC {bc}")).unwrap_or_default();
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> >> >>".to_string(),
+        stream("", "0.5 g 0 0 100 100 re f /M gs 1 0 0 rg 0 0 100 100 re f"),
+        format!("<< /Type /ExtGState /SMask << /Type /Mask /S /Luminosity /G 6 0 R {bc} >> >>"),
+        stream(
+            &format!("/Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /CS {space} >>"),
+            &format!("{paint} 0 0 50 100 re f"),
+        ),
+    ];
+    let (rgba, width) = render(pdf(&objects));
+    let value = |x| {
+        let [r, g, b] = pixel(&rgba, width, x, 50);
+        // Red over grey: red rises from the backdrop to 255 and green and blue fall to 0 as the
+        // mask goes from 0 to 1.
+        let from_red = (f64::from(r) - BACKDROP) / (255.0 - BACKDROP);
+        let from_green = (BACKDROP - f64::from(g)) / BACKDROP;
+        let from_blue = (BACKDROP - f64::from(b)) / BACKDROP;
+        assert!(
+            (from_red - from_green).abs() < 0.03 && (from_green - from_blue).abs() < 0.03,
+            "{space} {paint}: pixel {:?} is not red over the backdrop",
+            [r, g, b]
+        );
+        from_green
+    };
+    (value(25), value(75))
+}
+
+fn assert_mask(space: &str, paint: &str, bc: Option<&str>, left: f64, right: f64) {
+    let (got_left, got_right) = mask_values(space, paint, bc);
+    assert!((got_left - left).abs() < 0.02, "{space} group, `{paint}`: mask {got_left:.3}, expected {left}");
+    assert!((got_right - right).abs() < 0.02, "{space} group, /BC {bc:?}: mask {got_right:.3}, expected {right}");
+}
+
+#[test]
+fn black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully() {
+    assert_mask("/DeviceCMYK", "0 0 0 1 k", None, 0.0, 0.0);
+    assert_mask("/DeviceCMYK", "0 0 0 0 k", None, 1.0, 0.0);
+    assert_mask("/DeviceCMYK", "0 0 0 0.5 k", None, 0.5, 0.0);
+}
+
+#[test]
+fn each_process_ink_in_a_device_cmyk_group_masks_by_its_weight() {
+    assert_mask("/DeviceCMYK", "1 0 0 0 k", None, 0.7, 0.0);
+    assert_mask("/DeviceCMYK", "0 1 0 0 k", None, 0.41, 0.0);
+    assert_mask("/DeviceCMYK", "0 0 1 0 k", None, 0.89, 0.0);
+    assert_mask("/DeviceCMYK", "1 1 1 1 k", None, 0.0, 0.0);
+    // The stroking colour too, and a colour selected with `cs`/`sc`.
+    assert_mask("/DeviceCMYK", "0 0 0 1 K 0 0 0 1 k 50 w 25 0 m 25 100 l S", None, 0.0, 0.0);
+    assert_mask("/DeviceCMYK", "/DeviceCMYK cs 0 0 0 0.5 sc", None, 0.5, 0.0);
+}
+
+#[test]
+fn a_device_cmyk_backdrop_colour_masks_by_its_gray() {
+    assert_mask("/DeviceCMYK", "0 0 0 1 k", Some("[0 0 0 0]"), 0.0, 1.0);
+    assert_mask("/DeviceCMYK", "0 0 0 0 k", Some("[0 0 0 1]"), 1.0, 0.0);
+    assert_mask("/DeviceCMYK", "0 0 0 1 k", Some("[1 0 0 0]"), 0.0, 0.7);
+}
+
+#[test]
+fn gray_and_rgb_groups_mask_as_before() {
+    assert_mask("/DeviceGray", "0 g", None, 0.0, 0.0);
+    assert_mask("/DeviceGray", "1 g", Some("[1]"), 1.0, 1.0);
+    assert_mask("/DeviceGray", "0.5 g", None, 0.5, 0.0);
+    assert_mask("/DeviceRGB", "0 0 0 rg", None, 0.0, 0.0);
+    assert_mask("/DeviceRGB", "1 1 1 rg", Some("[1 1 1]"), 1.0, 1.0);
+    assert_mask("/DeviceRGB", "0.5 0.5 0.5 rg", None, 0.5, 0.0);
+}
+
+#[test]
+fn device_cmyk_on_the_page_keeps_its_display_colour() {
+    // Only a luminosity mask in a DeviceCMYK group reads CMYK as its gray. On the page, CMYK is
+    // displayed through the CMYK profile as before, where 100% K is a dark grey.
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R >>".to_string(),
+        stream("", "0 0 0 1 k 0 0 100 100 re f"),
+    ];
+    let (rgba, width) = render(pdf(&objects));
+    let [r, g, b] = pixel(&rgba, width, 50, 50);
+    assert!(r > 10 && g > 10 && b > 10 && r < 80, "100% K on the page: {:?}", [r, g, b]);
+}
diff --git a/crates/render/tests/it/main.rs b/crates/render/tests/it/main.rs
index 3c556b6096..7c396b6f50 100644
--- a/crates/render/tests/it/main.rs
+++ b/crates/render/tests/it/main.rs
@@ -3,6 +3,10 @@
 mod cid_fallback_query;
 mod inline_image_ei;
 mod jbig2_invariants;
+mod luminosity_group_space;
 mod named_form_properties;
 mod search;
+mod separation_all;
 mod substitute_widths;
+mod tiling_cell_placement;
+mod type3_text_clip;
diff --git a/crates/render/tests/it/separation_all.rs b/crates/render/tests/it/separation_all.rs
new file mode 100644
index 0000000000..5b519e0e3a
--- /dev/null
+++ b/crates/render/tests/it/separation_all.rs
@@ -0,0 +1,145 @@
+//! Contributor-original synthetic pages for the special colourant names of a Separation colour
+//! space (ISO 32000-2 §8.6.6.4): `/All` paints every colourant of the output device at once, so
+//! on screen a tint t is the gray 1 − t whatever the alternate space and tint transform say;
+//! `/None` paints nothing; any other name goes through its alternate space.
+use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RenderedPage};
+use std::sync::Arc;
+
+/// A tint transform into DeviceCMYK that gives cyan: tint t → (t, 0, 0, 0). Through it a tint
+/// draws light or full cyan, never a neutral gray, so a gray result proves it was not used.
+const CYAN: &str = "<< /FunctionType 2 /Domain [0 1] /C0 [0 0 0 0] /C1 [1 0 0 0] /N 1 >>";
+
+/// A PDF of the given objects (object 1 the catalog), with a cross-reference table. Each object
+/// is its bytes: a stream's data need not be text.
+fn pdf(objects: &[Vec<u8>]) -> Vec<u8> {
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        bytes.extend_from_slice(object);
+        bytes.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer << /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    bytes
+}
+
+fn stream(dict: &str, data: &[u8]) -> Vec<u8> {
+    let mut bytes = format!("<< {dict} /Length {} >>\nstream\n", data.len()).into_bytes();
+    bytes.extend_from_slice(data);
+    bytes.extend_from_slice(b"\nendstream");
+    bytes
+}
+
+/// A 300 × 100 pt page drawing `content` with `resources`, then `extra` as objects 5 onwards.
+fn page(content: &str, resources: &str, extra: &[Vec<u8>]) -> Vec<u8> {
+    let mut objects = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 100] /Contents 4 0 R /Resources {resources} >>").into_bytes(),
+        stream("", content.as_bytes()),
+    ];
+    objects.extend_from_slice(extra);
+    pdf(&objects)
+}
+
+fn render(pdf: Vec<u8>) -> RenderedPage {
+    let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let out = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    assert_eq!((out.width, out.height), (300, 100));
+    out
+}
+
+/// The RGB of the pixel at (`x`, `y`) pt from the page's top left.
+fn rgb(out: &RenderedPage, x: usize, y: usize) -> [u8; 3] {
+    let at = (y * out.width as usize + x) * 4;
+    let pixel = out.rgba.get(at..at + 3).expect("the pixel lies on the page");
+    [pixel[0], pixel[1], pixel[2]]
+}
+
+/// `got` is the neutral gray `want`, give or take one level of rounding.
+fn assert_gray(got: [u8; 3], want: u8, what: &str) {
+    assert!(got.iter().all(|c| c.abs_diff(want) <= 1), "{what}: got {got:?}, want gray {want}");
+}
+
+/// Three boxes filled with `cs` at tints 0, 0.5 and 1, left to right.
+fn three_tints(space: &str) -> RenderedPage {
+    let content = "/CS0 cs 0 scn 0 0 100 100 re f 0.5 scn 100 0 100 100 re f 1 scn 200 0 100 100 re f";
+    render(page(content, "<< /ColorSpace << /CS0 5 0 R >> >>", &[space.as_bytes().to_vec(), CYAN.as_bytes().to_vec()]))
+}
+
+#[test]
+fn separation_all_fills_paint_the_complemented_tint_as_gray() {
+    let out = three_tints("[/Separation /All /DeviceCMYK 6 0 R]");
+    assert_gray(rgb(&out, 50, 50), 255, "tint 0 paints no colourant: white");
+    assert_gray(rgb(&out, 150, 50), 128, "tint 0.5 paints half of every colourant: 50% gray");
+    assert_gray(rgb(&out, 250, 50), 0, "tint 1 paints every colourant: black");
+}
+
+#[test]
+fn separation_all_strokes_paint_the_complemented_tint_as_gray() {
+    let content = "/CS0 CS 0.25 SCN 40 w 0 50 m 300 50 l S";
+    let out =
+        render(page(content, "<< /ColorSpace << /CS0 5 0 R >> >>", &[b"[/Separation /All /DeviceCMYK 6 0 R]".to_vec(), CYAN.as_bytes().to_vec()]));
+    assert_gray(rgb(&out, 150, 50), 191, "a stroke at tint 0.25: 75% gray");
+}
+
+#[test]
+fn separation_none_paints_nothing() {
+    // A red background, so "nothing" is told apart from white.
+    let content = "1 0 0 rg 0 0 300 100 re f /CS0 cs 0 scn 0 0 100 100 re f 0.5 scn 100 0 100 100 re f 1 scn 200 0 100 100 re f";
+    let out =
+        render(page(content, "<< /ColorSpace << /CS0 5 0 R >> >>", &[b"[/Separation /None /DeviceCMYK 6 0 R]".to_vec(), CYAN.as_bytes().to_vec()]));
+    for x in [50, 150, 250] {
+        assert_eq!(rgb(&out, x, 50), [255, 0, 0], "a /None fill at x = {x} leaves the background");
+    }
+}
+
+#[test]
+fn a_named_separation_still_paints_through_its_alternate() {
+    let out = three_tints("[/Separation /Cyan /DeviceCMYK 6 0 R]");
+    let [white, half, full] = [rgb(&out, 50, 50), rgb(&out, 150, 50), rgb(&out, 250, 50)];
+    assert_gray(white, 255, "tint 0 of a named colourant");
+    for (what, colour) in [("tint 0.5", half), ("tint 1", full)] {
+        // Cyan: red well below green and blue.
+        assert!(colour[0] < colour[1] && colour[0] < colour[2] && colour[2] > 200, "{what} of /Cyan is cyan: {colour:?}");
+    }
+    assert!(full[0] < half[0], "full cyan is deeper than half: {full:?} against {half:?}");
+}
+
+#[test]
+fn a_device_n_space_naming_all_still_paints_through_its_alternate() {
+    // §8.6.6.4 gives All its meaning in a Separation space; a DeviceN space keeps its alternate.
+    let out = three_tints("[/DeviceN [/All] /DeviceCMYK 6 0 R]");
+    let half = rgb(&out, 150, 50);
+    assert!(half[0] < half[1] && half[0] < half[2], "DeviceN [/All] at 0.5 draws its tint transform's cyan: {half:?}");
+}
+
+#[test]
+fn separation_all_images_paint_each_sample_as_the_complemented_gray() {
+    // Three 8-bit samples: tints 0, 128/255 and 1.
+    let data = [0u8, 128, 255];
+    let image =
+        stream("/Type /XObject /Subtype /Image /Width 3 /Height 1 /ColorSpace [/Separation /All /DeviceCMYK 6 0 R] /BitsPerComponent 8", &data);
+    let out = render(page("q 300 0 0 100 0 0 cm /Im Do Q", "<< /XObject << /Im 5 0 R >> >>", &[image, CYAN.as_bytes().to_vec()]));
+    assert_gray(rgb(&out, 50, 50), 255, "sample 0");
+    assert_gray(rgb(&out, 150, 50), 127, "sample 128");
+    assert_gray(rgb(&out, 250, 50), 0, "sample 255");
+}
+
+#[test]
+fn separation_all_shadings_paint_the_complemented_gray() {
+    // An axial shading from tint 0 at x = 0 to tint 1 at x = 300, painted with `sh`.
+    let shading = "<< /ShadingType 2 /ColorSpace [/Separation /All /DeviceCMYK 6 0 R] /Coords [0 0 300 0] /Function << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> /Extend [true true] >>";
+    let out = render(page("/Sh sh", "<< /Shading << /Sh 5 0 R >> >>", &[shading.as_bytes().to_vec(), CYAN.as_bytes().to_vec()]));
+    for (x, want) in [(1usize, 254u8), (150, 128), (298, 1)] {
+        let got = rgb(&out, x, 50);
+        assert!(got.iter().all(|c| c.abs_diff(want) <= 3), "shading at x = {x}: got {got:?}, want gray near {want}");
+    }
+}
diff --git a/crates/render/tests/it/tiling_cell_placement.rs b/crates/render/tests/it/tiling_cell_placement.rs
new file mode 100644
index 0000000000..3a57f15085
--- /dev/null
+++ b/crates/render/tests/it/tiling_cell_placement.rs
@@ -0,0 +1,191 @@
+//! Tiling pattern cells sit at whole multiples of `/XStep` and `/YStep` in pattern space
+//! (ISO 32000-2 8.7.3.1, Table 74), at any rendering scale, however far they are from the
+//! pattern's origin.
+//!
+//! Each page is filled (or stroked) with a pattern whose 20 × 20 cell holds one 6 × 6 blue square
+//! at (7, 7). At 110 dpi a step is 30.56 device pixels; every probe finds the blue square in a
+//! disc around where the pattern matrix puts it and checks that its centroid is within one
+//! device pixel of that place.
+
+use std::sync::Arc;
+
+use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind};
+
+/// The rendering scale for 110 dpi: a step of 20 points is 30.56 pixels, not a whole number.
+const SCALE: f64 = 110.0 / 72.0;
+/// The page is `SIDE` × `SIDE` points.
+const SIDE: f64 = 400.0;
+
+/// One page `SIDE` points square whose content `content` paints with `/P1`: the 20-point cell
+/// with its blue square, `/XStep` and `/YStep` 20, under pattern matrix `matrix`.
+fn page_pdf(content: &str, matrix: [f64; 6]) -> Vec<u8> {
+    let cell = "0 0 1 rg 7 7 6 6 re f";
+    let m = matrix.map(|v| format!("{v}")).join(" ");
+    format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {SIDE} {SIDE}] /Contents 4 0 R /Resources << /Pattern << /P1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Pattern /PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 20 20] /XStep 20 /YStep 20 /Matrix [{m}] /Length {} >> stream
+{cell}
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len(),
+        cell.len()
+    )
+    .into_bytes()
+}
+
+struct Page {
+    rgba: Vec<u8>,
+    width: usize,
+    height: usize,
+}
+
+fn render(content: &str, matrix: [f64; 6]) -> Page {
+    let mut r = PageRenderer::new(Arc::new(page_pdf(content, matrix)), RenderConfig::default());
+    let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: SCALE as f32, tag: 0, ..Default::default() });
+    assert!(page.error.is_none(), "{:?}", page.error);
+    Page { rgba: page.rgba.to_vec(), width: page.width as usize, height: page.height as usize }
+}
+
+/// The device position of pattern-space point `(x, y)`: the pattern matrix to page space, then
+/// page space to device pixels (y down).
+fn device(matrix: [f64; 6], x: f64, y: f64) -> (f64, f64) {
+    let [a, b, c, d, e, f] = matrix;
+    let (px, py) = (a * x + c * y + e, b * x + d * y + f);
+    (px * SCALE, (SIDE - py) * SCALE)
+}
+
+/// The centroid of blue (weighted by how far each pixel is from white) in the disc of `radius`
+/// pixels around `(cx, cy)`, and the total weight. `None` when the disc leaves the page.
+fn blue_centroid(page: &Page, cx: f64, cy: f64, radius: f64) -> Option<((f64, f64), f64)> {
+    let (x0, x1) = ((cx - radius).floor(), (cx + radius).ceil());
+    let (y0, y1) = ((cy - radius).floor(), (cy + radius).ceil());
+    if x0 < 0.0 || y0 < 0.0 || x1 >= page.width as f64 || y1 >= page.height as f64 {
+        return None;
+    }
+    let (mut sum, mut sx, mut sy) = (0.0, 0.0, 0.0);
+    for j in (y0 as usize)..=(y1 as usize) {
+        for i in (x0 as usize)..=(x1 as usize) {
+            let (px, py) = (i as f64 + 0.5, j as f64 + 0.5);
+            if (px - cx).powi(2) + (py - cy).powi(2) > radius * radius {
+                continue;
+            }
+            let red = *page.rgba.get((j * page.width + i) * 4)?;
+            let w = f64::from(255 - red) / 255.0;
+            sum += w;
+            sx += w * px;
+            sy += w * py;
+        }
+    }
+    (sum > 0.0).then(|| ((sx / sum, sy / sum), sum))
+}
+
+/// Checks every cell `(k, m)` whose blue square's centre falls in the page rectangle `area`
+/// (points: x0, y0, x1, y1): its square is found where the matrix puts it, within one pixel.
+/// Returns how many cells were checked.
+fn assert_cells_in_place(page: &Page, matrix: [f64; 6], area: [f64; 4], what: &str) -> usize {
+    let [a, b, c, d, _, _] = matrix;
+    // The square is 6 × 6 at (7, 7); its centre is (10, 10) in the cell. A disc of 6 cell
+    // units around it holds the whole square (half-diagonal 4.24) and no neighbour (7 away).
+    let units = (a * a + b * b).sqrt().min((c * c + d * d).sqrt());
+    let radius = 6.0 * units * SCALE;
+    let area_px = 36.0 * units * units * SCALE * SCALE;
+    let mut checked = 0;
+    for k in -60..60 {
+        for m in -60..60 {
+            let (cx_cell, cy_cell) = (20.0 * f64::from(k) + 10.0, 20.0 * f64::from(m) + 10.0);
+            let [ea, eb, ec, ed, ee, ef] = matrix;
+            let (px, py) = (ea * cx_cell + ec * cy_cell + ee, eb * cx_cell + ed * cy_cell + ef);
+            if px < area[0] || px > area[2] || py < area[1] || py > area[3] {
+                continue;
+            }
+            let (cx, cy) = device(matrix, cx_cell, cy_cell);
+            let Some(((gx, gy), weight)) = blue_centroid(page, cx, cy, radius) else { continue };
+            assert!(weight > 0.8 * area_px, "{what}: cell ({k}, {m}) at ({cx:.1}, {cy:.1}) only partly there: {weight:.1} of {area_px:.1}");
+            assert!(
+                (gx - cx).abs() <= 1.0 && (gy - cy).abs() <= 1.0,
+                "{what}: cell ({k}, {m}) should be centred at ({cx:.2}, {cy:.2}) px, found at ({gx:.2}, {gy:.2})"
+            );
+            checked += 1;
+        }
+    }
+    checked
+}
+
+const IDENTITY: [f64; 6] = [1.0, 0.0, 0.0, 1.0, 0.0, 0.0];
+
+/// A fill far from the pattern's origin: the cells 300 to 400 points away (15 to 19 steps) are
+/// where 15 to 19 steps put them, not 0.44 pixel further for every step.
+#[test]
+fn far_cells_of_a_fill_sit_at_whole_steps() {
+    let page = render("/Pattern cs /P1 scn 0 0 400 400 re f", IDENTITY);
+    let near = assert_cells_in_place(&page, IDENTITY, [0.0, 0.0, 100.0, 100.0], "near the origin");
+    let far = assert_cells_in_place(&page, IDENTITY, [290.0, 290.0, 400.0, 400.0], "far from the origin");
+    assert!(near >= 16 && far >= 16, "{near} near, {far} far");
+}
+
+/// The same under a pattern matrix that scales by 1.49 and turns by 30 degrees: a step is
+/// 45.5 pixels along each turned axis.
+#[test]
+fn far_cells_sit_at_whole_steps_under_a_turned_scaled_matrix() {
+    let (scale, turn) = (1.49_f64, 30_f64.to_radians());
+    let matrix = [scale * turn.cos(), scale * turn.sin(), -scale * turn.sin(), scale * turn.cos(), 3.0, 5.0];
+    let page = render("/Pattern cs /P1 scn 0 0 400 400 re f", matrix);
+    let far = assert_cells_in_place(&page, matrix, [250.0, 250.0, 390.0, 390.0], "turned and scaled");
+    assert!(far >= 6, "{far} cells checked");
+}
+
+/// A stroke painted with the pattern: the cells under a wide border far from the origin are
+/// in place on every side of it.
+#[test]
+fn far_cells_of_a_stroke_sit_at_whole_steps() {
+    let page = render("/Pattern CS /P1 SCN 40 w 200 200 180 180 re S", IDENTITY);
+    let mut checked = 0;
+    // The border is 40 points wide around the square from (200, 200) to (380, 380).
+    for band in [[180.0, 180.0, 400.0, 220.0], [180.0, 360.0, 400.0, 400.0], [180.0, 180.0, 220.0, 400.0], [360.0, 180.0, 400.0, 400.0]] {
+        checked += assert_cells_in_place(&page, IDENTITY, band, "stroke");
+    }
+    assert!(checked >= 20, "{checked} cells checked");
+    // Inside the border nothing is painted.
+    let (cx, cy) = device(IDENTITY, 290.0, 290.0);
+    let at = ((cy as usize) * page.width + cx as usize) * 4;
+    assert_eq!(page.rgba.get(at..at + 3), Some(&[255, 255, 255][..]), "inside the stroked square");
+}
+
+/// The cell pixmap's side and the scale its cell is drawn at: one step is exactly the side, the
+/// side stays within 1 and the cap whatever the step, and nothing odd reaches the cast.
+#[test]
+fn a_cell_pixmap_spans_exactly_one_step() {
+    // 110 dpi, a step of 20: 30.56 pixels, drawn at 31 / 20.
+    assert_eq!(hayro::tiling_cell_pixels(110.0 / 72.0, 20.0, 3000.0), (31, 31.0 / 20.0));
+    assert_eq!(hayro::tiling_cell_pixels(110.0 / 72.0, -20.0, 3000.0), (31, 31.0 / 20.0), "a negative step");
+    for (scale, step) in [(1.0_f32, 7.3_f32), (2.37, 0.9), (0.013, 1234.5), (3.0, 999.9), (1.0, 2.0e9)] {
+        let (side, drawn) = hayro::tiling_cell_pixels(scale, step, 3000.0);
+        assert!((1..=3000).contains(&side), "{scale} {step}: {side}");
+        let span = drawn * f64::from(step);
+        assert!((span - f64::from(side)).abs() < 1e-9 * f64::from(side), "{scale} {step}: a step spans {span}, not {side}");
+        if f64::from(scale) * f64::from(step) <= 3000.0 {
+            assert!((span - f64::from(scale) * f64::from(step)).abs() <= 0.5 + 1e-9, "{scale} {step}: drawn {drawn}");
+        }
+    }
+    // A step under half a pixel still gets one pixel (a 0 × N pixmap can't be sampled).
+    assert_eq!(hayro::tiling_cell_pixels(0.03, 10.0, 3000.0), (1, 0.1));
+    // Steps and scales that aren't finite and positive: the side is bounded, the scale kept.
+    assert_eq!(hayro::tiling_cell_pixels(2.0, f32::INFINITY, 3000.0), (3000, 2.0));
+    assert_eq!(hayro::tiling_cell_pixels(2.0, 0.0, 3000.0), (1, 2.0));
+    let (side, drawn) = hayro::tiling_cell_pixels(f32::NAN, 20.0, 3000.0);
+    assert!(side == 1 && drawn.is_nan());
+    // A cap past u16::MAX is lowered to it, and the scale follows the side the pixmap gets.
+    let (side, drawn) = hayro::tiling_cell_pixels(2.0, 1.0e6, 1.0e9);
+    assert_eq!(side, u16::MAX, "the cap is at most u16::MAX");
+    assert!((drawn * 1.0e6 - f64::from(u16::MAX)).abs() < 1e-6, "a step spans the side: {drawn}");
+    // A cap that is not a whole number, or not a number, is a whole number of pixels.
+    assert_eq!(hayro::tiling_cell_pixels(1.0, 100.0, 30.7), (30, 0.3));
+    assert_eq!(hayro::tiling_cell_pixels(1.0, 100.0, f32::NAN), (1, 0.01));
+}
diff --git a/crates/render/tests/it/type3_text_clip.rs b/crates/render/tests/it/type3_text_clip.rs
new file mode 100644
index 0000000000..2cdfce5d81
--- /dev/null
+++ b/crates/render/tests/it/type3_text_clip.rs
@@ -0,0 +1,163 @@
+//! Contributor-original synthetic pages: text in a Type 3 font in the text rendering modes
+//! (ISO 32000-2 §9.3.6, Table 104). For a Type 3 font, modes 3 and 7 render nothing, the other
+//! modes render the glyph descriptions, and modes 4 to 7 add nothing to the clipping path
+//! (vendored hayro-interpret patch 64).
+use pdfcraft_render::{PageRenderer, RenderConfig, RenderRequest, RequestKind};
+use std::sync::Arc;
+
+/// Glyph procedures in a 1000-unit glyph space (`/FontMatrix [0.001 0 0 0.001 0 0]`), named
+/// by the letters that show them: the `/Differences` give them codes 65 (`A`) on, in order.
+const GLYPHS: &[(&str, &[u8])] = &[
+    // A: a square, x 100..900, y 0..800.
+    ("A", b"1000 0 100 0 900 800 d1 100 0 800 800 re f"),
+    // B: a triangle on the baseline with its apex at the top middle.
+    ("B", b"1000 0 0 0 1000 1000 d1 0 0 m 1000 0 l 500 1000 l f"),
+    // C: a coloured glyph (`d0`): a blue square.
+    ("C", b"1000 0 d0 0 0 1 rg 100 0 800 800 re f"),
+    // D: shows four of itself, nesting until the paint budget runs out.
+    ("D", b"1000 0 0 0 1000 1000 d1 BT /T3 1000 Tf 0 0 Td (DDDD) Tj ET"),
+];
+
+fn pdf(content: &str) -> Vec<u8> {
+    let names: String = GLYPHS.iter().map(|(n, _)| format!("/{n} ")).collect();
+    let procs: String = GLYPHS.iter().enumerate().map(|(i, (n, _))| format!("/{n} {} 0 R ", 6 + i)).collect();
+    let widths = vec!["1000"; GLYPHS.len()].join(" ");
+    let mut objects: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Font << /T3 5 0 R /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> >> >>".to_vec(),
+        stream(content.as_bytes()),
+        format!(
+            "<< /Type /Font /Subtype /Type3 /FontBBox [0 0 1000 1000] /FontMatrix [0.001 0 0 0.001 0 0] \
+             /CharProcs << {procs}>> /Encoding << /Type /Encoding /Differences [65 {names}] >> \
+             /FirstChar 65 /LastChar {} /Widths [{widths}] >>",
+            64 + GLYPHS.len()
+        )
+        .into_bytes(),
+    ];
+    objects.extend(GLYPHS.iter().map(|(_, body)| stream(body)));
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(object);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer << /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    out
+}
+
+fn stream(body: &[u8]) -> Vec<u8> {
+    let mut s = format!("<< /Length {} >>\nstream\n", body.len()).into_bytes();
+    s.extend_from_slice(body);
+    s.extend_from_slice(b"\nendstream");
+    s
+}
+
+/// A 100 x 100 pixel rendering of a 100 x 100 pt page; `at(x, y)` reads the pixel at page
+/// coordinates (y up).
+struct Page(Vec<u8>);
+
+impl Page {
+    fn render(content: &str) -> Self {
+        let mut renderer = PageRenderer::new(Arc::new(pdf(content)), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{content}: {:?}", page.error);
+        assert_eq!((page.width, page.height), (100, 100), "{content}");
+        Self(page.rgba.to_vec())
+    }
+
+    fn at(&self, x: usize, y: usize) -> [u8; 3] {
+        let i = ((99 - y) * 100 + x) * 4;
+        match self.0.get(i..i + 3) {
+            Some([r, g, b]) => [*r, *g, *b],
+            _ => panic!("pixel {x},{y} is off the page"),
+        }
+    }
+
+    /// Whether any pixel is dark in every channel: a glyph painted in the default black.
+    fn has_black(&self) -> bool {
+        self.0.as_chunks::<4>().0.iter().any(|p| p[0] < 128 && p[1] < 128 && p[2] < 128)
+    }
+}
+
+const RED: [u8; 3] = [255, 0, 0];
+const BLUE: [u8; 3] = [0, 0, 255];
+const WHITE: [u8; 3] = [255, 255, 255];
+
+/// `ABA` at 20 pt from (10, 40): squares x 12..28 and 52..68 (y 40..56), and a triangle from
+/// (30, 40) and (50, 40) up to (40, 60).
+const ABA: &str = "/T3 20 Tf 10 40 Td (ABA) Tj";
+
+#[test]
+fn clip_only_type3_text_is_not_rendered_and_leaves_no_clip() {
+    // The fill stops at x 60, inside the second square: a glyph painted under `7 Tr` would show
+    // past it as a bar beside the box.
+    let page = Page::render(&format!("BT 7 Tr {ABA} ET 1 0 0 rg 0 0 60 100 re f"));
+    assert_eq!(page.at(20, 48), RED, "the fill over the first square");
+    assert_eq!(page.at(5, 5), RED, "no clip: the fill covers its whole box");
+    assert_eq!(page.at(29, 45), RED, "no clip between the glyphs either");
+    assert_eq!(page.at(33, 57), RED, "no clip beside the triangle");
+    assert_eq!(page.at(64, 48), WHITE, "the second square past the fill is not rendered");
+    assert_eq!(page.at(80, 80), WHITE, "outside the fill");
+    assert!(!page.has_black(), "7 Tr renders no glyph");
+
+    // Alone, neither shape glyphs nor a coloured glyph leave a mark.
+    for text in [ABA, "/T3 20 Tf 10 40 Td (C) Tj"] {
+        let page = Page::render(&format!("BT 7 Tr {text} ET"));
+        assert!(page.0.as_chunks::<4>().0.iter().all(|p| p[..3] == WHITE), "7 Tr {text} renders nothing");
+    }
+}
+
+#[test]
+fn invisible_type3_text_is_not_rendered() {
+    for text in [ABA, "/T3 20 Tf 10 40 Td (C) Tj"] {
+        let page = Page::render(&format!("BT 3 Tr {text} ET"));
+        assert!(page.0.as_chunks::<4>().0.iter().all(|p| p[..3] == WHITE), "3 Tr {text} renders nothing");
+    }
+}
+
+#[test]
+fn other_modes_render_type3_glyphs_filled_and_never_clip() {
+    for mode in [0, 1, 2, 4, 5, 6] {
+        let page = Page::render(&format!("BT 0 0 1 rg 1 1 0 RG 6 w {mode} Tr {ABA} ET 1 0 0 rg 0 0 60 100 re f"));
+        assert_eq!(page.at(64, 48), BLUE, "{mode} Tr: the glyph is rendered, in the fill colour");
+        assert_eq!(page.at(70, 48), WHITE, "{mode} Tr: and not stroked");
+        assert_eq!(page.at(20, 48), RED, "{mode} Tr: the later fill over the glyph");
+        assert_eq!(page.at(5, 5), RED, "{mode} Tr: the later fill is not clipped");
+        assert_eq!(page.at(29, 45), RED, "{mode} Tr: not clipped between the glyphs");
+        assert!(!page.has_black(), "{mode} Tr");
+    }
+    // A coloured glyph keeps its own colour.
+    let page = Page::render("BT 1 0 0 rg 4 Tr /T3 20 Tf 10 40 Td (C) Tj ET");
+    assert_eq!(page.at(20, 48), BLUE);
+}
+
+#[test]
+fn only_outline_glyphs_shape_a_clip_shared_with_type3_text() {
+    // `I` in Helvetica at 40 pt from (60, 10): its stem covers (65, 20). The square A from
+    // (10, 40) at 20 pt adds nothing to the clip and is not rendered.
+    let page = Page::render("BT 7 Tr /F1 40 Tf 60 10 Td (I) Tj /T3 20 Tf -50 30 Td (A) Tj ET 1 0 0 rg 0 0 100 100 re f");
+    assert_eq!(page.at(65, 20), RED, "inside the outline glyph's clip");
+    assert_eq!(page.at(20, 48), WHITE, "the Type 3 square neither clips nor paints");
+    assert_eq!(page.at(5, 5), WHITE, "outside the clip");
+    assert!(!page.has_black());
+}
+
+#[test]
+fn self_nesting_type3_text_in_a_clip_mode_stays_bounded() {
+    // Every D shows four Ds: unbounded this is 4^n procedures. The paint nesting depth and the
+    // page's paint budget stop it; the page must still render.
+    for mode in [4, 6, 7] {
+        let content = format!("BT {mode} Tr /T3 20 Tf 10 40 Td (DD) Tj ET 1 0 0 rg 0 0 100 100 re f");
+        let page = Page::render(&content);
+        assert_eq!(page.at(5, 5), RED, "{content}: no clip");
+        assert!(!page.has_black(), "{content}");
+    }
+}
diff --git a/crates/sign/Cargo.toml b/crates/sign/Cargo.toml
index 4f1f0d4094..3c0f207a98 100644
--- a/crates/sign/Cargo.toml
+++ b/crates/sign/Cargo.toml
@@ -18,7 +18,7 @@ pdfcraft-model = { workspace = true }
 thiserror.workspace = true
 # ASN.1 UTCTime/GeneralizedTime conversion goes through chrono (no hand-rolled calendar code).
 chrono = { workspace = true }
-base64 = "0.22"
+base64 = "0.23"
 sha1 = "0.11"
 sha2 = "0.11"
 p256 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
diff --git a/crates/sign/src/dss.rs b/crates/sign/src/dss.rs
index e095ec7491..0d82c797a7 100644
--- a/crates/sign/src/dss.rs
+++ b/crates/sign/src/dss.rs
@@ -93,7 +93,9 @@ pub fn embed(doc: &Document, evidence: &Evidence) -> Result<Vec<u8>, SignError>
     }
     let dss_ref = doc.add(Object::Dict(dss));
     doc.update_dict(root, |c| c.set(b"DSS".to_vec(), Object::Ref(dss_ref)))?;
-    Ok(pdfcraft_cos::write_incremental(&doc, &SaveOptions::default())?)
+    // What the user removed again before this (a cleared redaction mark) stays out of the file,
+    // as in a save; the store and everything in it are reachable from the catalog.
+    Ok(pdfcraft_cos::write_incremental(&doc, &SaveOptions { drop_unlinked: true, ..SaveOptions::default() })?)
 }
 
 /// Store one DER blob as a `/Type /Embed` stream.
diff --git a/crates/sign/src/pdf.rs b/crates/sign/src/pdf.rs
index b522a855e5..75b42f9905 100644
--- a/crates/sign/src/pdf.rs
+++ b/crates/sign/src/pdf.rs
@@ -23,397 +23,29 @@ use crate::keys::DigestAlg;
 use crate::pkcs12::DigitalId;
 use crate::x509::{Certificate, build_chain, build_chain_noted};
 
+mod changes;
+mod listing;
+mod signing;
+mod types;
+mod validate;
+
+#[cfg(test)]
+use changes::only_grew;
+#[cfg(test)]
+use listing::{DISCOVERY_CACHE_LIMIT, is_document_timestamp};
+pub use listing::{DigestCache, list, list_cached};
+pub(crate) use signing::fmt;
+pub use signing::{Appearance, AppearanceLabels, SignOptions, display_date, sign, sign_with_timestamp, timestamp_document};
+pub use types::{Detail, Fill, Modification, Status, TrustStore, WORDINGS, Words, in_english, kind};
+pub(crate) use validate::signature_contents;
+pub use validate::validate;
+#[cfg(test)]
+use validate::{DssEvidence, MAX_DSS_BYTES, MAX_DSS_ENTRIES};
+
 #[cfg(test)]
 #[path = "pdf_discovery_tests.rs"]
 mod discovery_tests;
 
-/// Digests of signed byte ranges (and parsed signed revisions), kept across revalidations of
-/// one document: incremental edits only append to the file, so the signed bytes and their
-/// digest don't change, and rehashing a large file on every edit was the expensive part of
-/// validation (120 MB: 84 ms per comment edit before, 6 ms after). Keyed by the ranges, the
-/// algorithm and a sampled fingerprint of the covered bytes; use one cache per document, whose
-/// bytes only ever grow.
-#[derive(Debug, Default)]
-pub struct DigestCache {
-    map: std::sync::Mutex<HashMap<RangeKey, Vec<u8>>>,
-    /// Signed revisions opened for change classification, by length and fingerprint.
-    revisions: std::sync::Mutex<HashMap<(usize, [u8; 32]), Document>>,
-    /// Candidate identities only: validation still uses current bytes and current trust.
-    discovery: std::sync::Mutex<Option<TimestampCandidates>>,
-    #[cfg(test)]
-    discovery_scans: std::sync::atomic::AtomicUsize,
-}
-
-/// Keep only the most recently visited source/overlay. In particular, this must not retain
-/// a Document, its bytes, or parsed signature dictionaries across edits and saves.
-#[derive(Debug)]
-struct TimestampCandidates {
-    source: pdfcraft_cos::SourceIdentity,
-    modified: Vec<u32>,
-    candidates: Vec<ObjRef>,
-}
-
-const DISCOVERY_CACHE_LIMIT: usize = 4096;
-
-fn is_document_timestamp(object: &Object) -> bool {
-    object.as_dict().is_some_and(|d| is_doc_timestamp(d) && d.contains(b"ByteRange"))
-}
-
-/// Only dictionary/null edits have a local effect on candidate membership. Changes to an
-/// object stream or a scalar used as an indirect /Length can affect unedited objects too.
-/// Checking both the original and current objects also covers freeing those dependencies.
-/// Unsupported or unreadable edits deliberately fall back to the complete bounded scan.
-fn changed_timestamp_candidates(doc: &Document, numbers: &[u32]) -> Option<Vec<ObjRef>> {
-    for (reference, object) in doc.scan_original_objects_subset(numbers.to_vec()) {
-        match object.ok()?.as_ref() {
-            Object::Dict(_) => {}
-            Object::Null if matches!(doc.xref_entry(reference.num), None | Some(pdfcraft_cos::XrefEntry::Free { .. })) => {}
-            _ => return None,
-        }
-    }
-    let mut candidates = Vec::new();
-    for (reference, object) in doc.scan_objects_subset(numbers.to_vec()) {
-        let object = object.ok()?;
-        if !matches!(object.as_ref(), Object::Dict(_) | Object::Null) {
-            return None;
-        }
-        if is_document_timestamp(&object) {
-            candidates.push(reference);
-        }
-    }
-    Some(candidates)
-}
-
-/// (end of first range, start of second, end of second, algorithm, fingerprint).
-type RangeKey = (usize, usize, usize, DigestAlg, [u8; 32]);
-
-/// 64 KiB sampled from across `covered`, plus its length.
-fn fingerprint(covered: &[u8]) -> [u8; 32] {
-    let mut parts: Vec<&[u8]> = (0..64)
-        .map(|i| {
-            let at = covered.len().saturating_sub(1024) * i / 63;
-            &covered[at..(at + 1024).min(covered.len())]
-        })
-        .collect();
-    let len = (covered.len() as u64).to_be_bytes();
-    parts.push(&len);
-    DigestAlg::Sha256.digest(&parts).try_into().unwrap_or([0; 32])
-}
-
-impl DigestCache {
-    fn timestamp_candidates(&self, doc: &Document) -> Vec<ObjRef> {
-        let mut slot = self.discovery.lock().ok();
-        let previous = slot.as_mut().and_then(|slot| slot.take());
-        let source = doc.source_identity();
-        let modified = doc.modified_objects();
-        // Reconstructed/unknown input and output-security changes take the original path.
-        let eligible = slot.is_some()
-            && doc.repair_log().is_empty()
-            && !doc.revisions().is_empty()
-            && !doc.encryption_changed()
-            && modified.len() <= DISCOVERY_CACHE_LIMIT;
-        if eligible && let Some(previous) = previous.filter(|previous| previous.source == source) {
-            // Undo/redo can remove overlays as well as add them. Revisit the union so an
-            // original candidate replaced or freed in the last snapshot can reappear.
-            let mut changed = previous.modified;
-            changed.extend_from_slice(&modified);
-            changed.sort_unstable();
-            changed.dedup();
-            if changed.len() <= DISCOVERY_CACHE_LIMIT
-                && let Some(mut candidates) = changed_timestamp_candidates(doc, &changed)
-            {
-                candidates.extend(previous.candidates.into_iter().filter(|r| changed.binary_search(&r.num).is_err()));
-                candidates.sort_unstable_by_key(|r| r.num);
-                if candidates.len() <= DISCOVERY_CACHE_LIMIT
-                    && let Some(slot) = slot.as_mut()
-                {
-                    **slot = Some(TimestampCandidates { source, modified, candidates: candidates.clone() });
-                }
-                return candidates;
-            }
-        }
-        #[cfg(test)]
-        self.discovery_scans.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-        let mut complete = true;
-        let candidates: Vec<_> = doc
-            .scan_objects_checked()
-            .filter_map(|(reference, object)| match object {
-                Ok(object) => is_document_timestamp(&object).then_some(reference),
-                Err(_) => {
-                    complete = false;
-                    None
-                }
-            })
-            .collect();
-        if eligible
-            && complete
-            && candidates.len() <= DISCOVERY_CACHE_LIMIT
-            && changed_timestamp_candidates(doc, &modified).is_some()
-            && let Some(slot) = slot.as_mut()
-        {
-            **slot = Some(TimestampCandidates { source, modified, candidates: candidates.clone() });
-        }
-        candidates
-    }
-
-    /// The signed revision `bytes[..end]`, parsed (and kept). An encrypted one is opened with
-    /// `doc`'s own key (the same `/Encrypt` and `/ID`), so a user password the document was
-    /// opened with is neither needed again nor kept here (#1808).
-    fn revision(&self, doc: &Document, bytes: &[u8], end: usize) -> Option<Document> {
-        let key = (end, fingerprint(&bytes[..end]));
-        if let Some(d) = self.revisions.lock().ok().and_then(|m| m.get(&key).cloned()) {
-            return Some(d);
-        }
-        let d = doc.open_with_same_credentials(Arc::new(bytes[..end].to_vec())).ok()?;
-        if let Ok(mut m) = self.revisions.lock() {
-            if m.len() > 8 {
-                m.clear();
-            }
-            m.insert(key, d.clone());
-        }
-        Some(d)
-    }
-
-    fn digest(&self, alg: DigestAlg, bytes: &[u8], l0: usize, o1: usize, end: usize) -> Vec<u8> {
-        let key = (l0, o1, end, alg, fingerprint(&bytes[..end]));
-        if let Some(d) = self.map.lock().ok().and_then(|m| m.get(&key).cloned()) {
-            return d;
-        }
-        let d = alg.digest(&[&bytes[..l0], &bytes[o1..end]]);
-        if let Ok(mut m) = self.map.lock() {
-            if m.len() > 64 {
-                m.clear();
-            }
-            m.insert(key, d.clone());
-        }
-        d
-    }
-}
-
-/// Certificates the user trusts for signing (Acrobat: Trusted Certificates).
-#[derive(Clone, Debug, Default)]
-pub struct TrustStore {
-    pub certs: Vec<Certificate>,
-}
-
-impl TrustStore {
-    fn trusts(&self, c: &Certificate) -> bool {
-        self.certs.iter().any(|t| t.raw == c.raw)
-    }
-}
-
-/// Acrobat's three verdicts.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Status {
-    /// Intact, signed by a trusted identity, and any later changes are permitted.
-    Valid,
-    /// Intact, but the signer's identity can't be established (not trusted), or validity
-    /// couldn't be determined.
-    Unknown,
-    /// The signed bytes changed, the signature doesn't verify, or later changes aren't permitted.
-    Invalid,
-}
-
-/// What a change made after signing is called: the words [`Modification`] lists it by, and the
-/// vocabulary a signature's details speak of changes in.
-///
-/// They are words of ours, not the document's, so an interface reading in another language
-/// translates each of them; [`ALL`](kind::ALL) is the whole vocabulary.
-pub mod kind {
-    pub const PAGE_CONTENT: &str = "page content";
-    pub const FORM_FILL: &str = "form fill";
-    pub const COMMENTS: &str = "comments";
-    pub const SIGNATURE: &str = "signature";
-    pub const SECURITY_STORE: &str = "document security store";
-    pub const METADATA: &str = "metadata";
-    pub const LINKS: &str = "links";
-    pub const STRUCTURE: &str = "document structure";
-    pub const PAGES: &str = "pages added or removed";
-    pub const OTHER: &str = "other changes";
-    /// Not a change but the reason there is nothing to compare: the signed revision itself could not
-    /// be read, so what came after it cannot be allowed.
-    pub const UNREADABLE: &str = "the signed version could not be read";
-
-    /// Every word above, for an interface to translate.
-    pub const ALL: &[&str] = &[PAGE_CONTENT, FORM_FILL, COMMENTS, SIGNATURE, SECURITY_STORE, METADATA, LINKS, STRUCTURE, PAGES, OTHER, UNREADABLE];
-}
-
-/// Changes made after signing.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum Modification {
-    /// The signature covers the whole file.
-    None,
-    /// Later revisions only make changes the signature permits, listed in the words of [`kind`].
-    Allowed(Vec<&'static str>),
-    /// Later revisions make changes it doesn't permit, listed in the words of [`kind`].
-    Disallowed(Vec<&'static str>),
-}
-
-/// One of the sentences that explain a signature's verdict.
-///
-/// [`message`](Detail::message) is the sentence in English, ready to read. An interface that reads in
-/// another language says it with [`Detail::said`] instead, out of [`pattern`](Detail::pattern) —
-/// wording of ours, listed in [`WORDINGS`] — and [`fill`](Detail::fill), whatever goes in it.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Detail {
-    /// The sentence in English.
-    pub message: String,
-    /// The sentence as it is worded here, with `{}` where the fill goes.
-    pub pattern: &'static str,
-    pub fill: Fill,
-}
-
-/// What goes where a [`Detail`]'s pattern has `{}`.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum Fill {
-    /// Nothing: the pattern is the whole sentence.
-    Nothing,
-    /// The changes made after signing, as [`Modification`] lists them: words of ours, each one in
-    /// [`kind::ALL`], said one after another.
-    Changes(Vec<&'static str>),
-    /// What a reader could not make of the signature, in its own words. It goes in as it stands: it
-    /// names the structure that is wrong, which is a developer's business and reads the same
-    /// everywhere.
-    Reason(String),
-    /// A value out of the signature itself — a time, the evidence a revocation came from — written
-    /// as it stands, the way a certificate's name or date is.
-    Value(String),
-    /// Two certificates' own names, for the wording that says one was not used to vouch for the
-    /// other. They go in the order the wording puts its two holes in, which a language may reverse.
-    Names(String, String),
-}
-
-impl Detail {
-    /// The sentence said in the language `words` translates into.
-    ///
-    /// The wording is translated, and what fills it goes in afterwards — the changes translated too —
-    /// so nothing put in can be mistaken for a hole of its own. With [`in_english`] this is
-    /// [`message`](Detail::message).
-    pub fn said(&self, words: Words) -> String {
-        let said = words(self.pattern);
-        match &self.fill {
-            Fill::Nothing => said,
-            Fill::Changes(c) => said.replacen("{}", &c.iter().map(|k| words(k)).collect::<Vec<_>>().join(", "), 1),
-            Fill::Reason(r) | Fill::Value(r) => said.replacen("{}", r, 1),
-            // Both holes are cut out of the wording first, so neither name can be taken for the other's.
-            Fill::Names(a, b) => {
-                let mut parts = said.splitn(3, "{}");
-                match (parts.next(), parts.next(), parts.next()) {
-                    (Some(p0), Some(p1), Some(p2)) => format!("{p0}{a}{p1}{b}{p2}"),
-                    // A wording with one hole, or none: say it as it is rather than guess.
-                    _ => said,
-                }
-            }
-        }
-    }
-
-    /// The whole sentence, with no hole in it.
-    pub(crate) fn plain(pattern: &'static str) -> Detail {
-        Detail::of(pattern, Fill::Nothing)
-    }
-
-    /// The sentence and what fills its hole. The English is said once, here, so it and
-    /// [`Detail::said`] cannot drift apart.
-    pub(crate) fn of(pattern: &'static str, fill: Fill) -> Detail {
-        let mut d = Detail { message: String::new(), pattern, fill };
-        d.message = d.said(&in_english);
-        d
-    }
-}
-
-/// How an interface says one of this crate's wordings in its own language: it is handed the English
-/// and gives back what it reads. [`in_english`] is the one that keeps the English.
-pub type Words<'a> = &'a dyn Fn(&str) -> String;
-
-/// [`Words`] that leaves the English as it is.
-pub fn in_english(wording: &str) -> String {
-    wording.to_owned()
-}
-
-/// Every sentence this crate says about a signature: what [`SignatureInfo::details`] can hold, and
-/// the summaries [`SignatureInfo::summary`] chooses between.
-///
-/// An interface reading in another language translates these and the words in [`kind::ALL`], which
-/// go into the two sentences that list changes. The rest of what it shows comes from elsewhere and
-/// goes through as it stands: the certificate's names and dates, and a reader's own detail in
-/// [`Fill::Reason`]. A test in this crate keeps the list in step with the code.
-pub const WORDINGS: &[&str] = &[
-    // What the signature's own structure says, before anything is verified.
-    "The signature has no valid byte range.",
-    "The signature's byte range does not match the file.",
-    "The signature's byte range does not exclude exactly its contents.",
-    "The signature contents are not hexadecimal.",
-    "The signature could not be read ({}).",
-    "PdfCraft can't check this signature yet: {}.",
-    "The signature uses the legacy adbe.x509.rsa_sha1 format.",
-    // What was read leniently on the way, each sentence worded where the reading happens.
-    "The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.",
-    "The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.",
-    "The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.",
-    "The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.",
-    "The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.",
-    "The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.",
-    "The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.",
-    "The signature's signed attributes have no content type, which CMS requires; it was read anyway.",
-    // What a signature that validates with an old hash or a small key still does not prove.
-    "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.",
-    "This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.",
-    "This signature uses an RSA key shorter than 2048 bits, which is no longer considered strong enough for signatures. It still validates, but it should not be relied on.",
-    // Whether the signed bytes and the signature still agree.
-    "The signature's signed attributes have no message digest, so the signature does not cover the document.",
-    "The signature's signed attributes name a content type other than data, so it is not a signature of the document.",
-    "The document has been altered or corrupted since the signature was applied.",
-    "The signer's certificate is not in the signature.",
-    "The signature value does not match the signer's certificate: the signature is corrupt.",
-    "The signature could not be checked ({}).",
-    "The signature could not be verified ({}).",
-    // What came after the signature.
-    "This document has not been modified since this signature was applied.",
-    "The document has been modified since this signature was applied, but the changes are permitted ({}).",
-    "The document has been altered since this signature was applied in ways it does not permit ({}).",
-    // Who signed, and when.
-    "The signer's certificate was not valid at the time of signing.",
-    "The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).",
-    "The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).",
-    "The signer's certificate has critical extensions PdfCraft does not recognize ({}).",
-    // Why a certificate that matched the issuer was not used to build the chain.
-    "The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.",
-    "The certificate of {} has critical extensions PdfCraft does not recognize, so it is not used to vouch for {}.",
-    "The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.",
-    "The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.",
-    "The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.",
-    "The signer's identity is valid.",
-    "The signature includes an embedded timestamp.",
-    "Signing time is from the clock on the signer's computer.",
-    // What the signature's own timestamp token proves, if it carries one.
-    "The signature's timestamp token does not cover the signature value.",
-    "The signature's timestamp token could not be verified ({}).",
-    "The embedded timestamp token is valid and its authority is trusted; trusted time is {}.",
-    "The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.",
-    // What the document's own revocation evidence says about the signer.
-    "The signer's certificate has been revoked ({}).",
-    "The document's embedded revocation information shows that the signer's certificate has not been revoked.",
-    // A standalone document timestamp, which is checked on its own.
-    "The timestamp has no valid byte range.",
-    "The timestamp's byte range does not match the file.",
-    "The timestamp's byte range does not exclude exactly its contents.",
-    "The timestamp contents are not hexadecimal.",
-    "The timestamp token could not be read ({}).",
-    "The document has been altered or corrupted since the timestamp was applied.",
-    "The timestamp authority's certificate was not valid at the time of timestamping.",
-    "The timestamp authority's certificate is not issued for time stamping.",
-    "This document has not been modified since this timestamp was applied.",
-    "The document has been modified since this timestamp was applied, but the changes are permitted ({}).",
-    "The document has been altered since this timestamp was applied in ways it does not permit ({}).",
-    "The timestamp token is valid and its authority is trusted.",
-    "The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.",
-    // The one line that stands for all of it.
-    "Unsigned signature field",
-    "Signature is valid",
-    "Signature validity is unknown",
-    "Signature is invalid",
-];
-
 /// One signature field.
 #[derive(Clone, Debug)]
 pub struct SignatureInfo {
@@ -473,2034 +105,3 @@ impl SignatureInfo {
         }
     }
 }
-
-pub(crate) fn text(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
-    let o = doc.resolve(d.get(key)?);
-    let s = match &*o {
-        Object::String(s) => s.to_text(),
-        Object::Name(n) => String::from_utf8_lossy(n).into_owned(),
-        _ => return None,
-    };
-    let s = s.trim_matches('\0').trim().to_string();
-    (!s.is_empty()).then_some(s)
-}
-
-struct Field {
-    name: String,
-    /// The field dictionary (and its widget(s)).
-    r: Option<ObjRef>,
-    dict: Dict,
-    widgets: Vec<(Option<ObjRef>, Dict)>,
-}
-
-impl Field {
-    /// The signature dictionary in /V. A field without one is unsigned, whether /V is missing,
-    /// null or not a dictionary.
-    fn signature(&self, doc: &Document) -> Option<Dict> {
-        self.dict.get(b"V").map(|v| doc.resolve(v)).and_then(|v| v.as_dict().cloned())
-    }
-
-    /// True when /V holds something that is neither null nor a signature dictionary: signing the
-    /// field would overwrite a value we can't read as a signature.
-    fn has_foreign_value(&self, doc: &Document) -> bool {
-        self.dict.get(b"V").map(|v| doc.resolve(v)).is_some_and(|v| !matches!(*v, Object::Null) && v.as_dict().is_none())
-    }
-}
-
-/// Every signature field, depth first in `/Fields` order.
-fn sig_fields(doc: &Document) -> Vec<Field> {
-    let mut out = Vec::new();
-    let Some(root) = doc.root() else { return out };
-    let Some(af) = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned()) else {
-        return out;
-    };
-    let Some(fields) = af.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned()) else { return out };
-    let mut seen = HashSet::new();
-    let mut stack: Vec<(Object, String, Option<Vec<u8>>)> = fields.into_iter().rev().map(|f| (f, String::new(), None)).collect();
-    while let Some((o, prefix, inherited_ft)) = stack.pop() {
-        if let Some(r) = o.as_ref()
-            && !seen.insert(r)
-        {
-            continue;
-        }
-        let Some(d) = doc.resolve(&o).as_dict().cloned() else { continue };
-        let part = text(doc, &d, b"T");
-        let name = match (&part, prefix.is_empty()) {
-            (Some(p), true) => p.clone(),
-            (Some(p), false) => format!("{prefix}.{p}"),
-            (None, _) => prefix.clone(),
-        };
-        let ft = d.name(b"FT").map(<[u8]>::to_vec).or(inherited_ft);
-        let kids: Vec<Object> = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
-        // Kids with a /T are fields; others are this field's widgets.
-        let (sub, widgets): (Vec<Object>, Vec<Object>) = kids.into_iter().partition(|k| doc.resolve(k).as_dict().is_some_and(|kd| kd.contains(b"T")));
-        for k in sub.into_iter().rev() {
-            stack.push((k, name.clone(), ft.clone()));
-        }
-        if ft.as_deref() == Some(b"Sig") && part.is_some() {
-            let mut ws: Vec<(Option<ObjRef>, Dict)> =
-                widgets.iter().filter_map(|w| doc.resolve(w).as_dict().cloned().map(|wd| (w.as_ref(), wd))).collect();
-            if d.name(b"Subtype") == Some(b"Widget") {
-                ws.insert(0, (o.as_ref(), d.clone()));
-            }
-            out.push(Field { name, r: o.as_ref(), dict: d, widgets: ws });
-        }
-    }
-    out
-}
-
-/// Which page holds each annotation.
-fn annot_pages(doc: &Document) -> HashMap<ObjRef, usize> {
-    let mut map = HashMap::new();
-    for (i, p) in pdfcraft_annot::page_refs(doc).unwrap_or_default().into_iter().enumerate() {
-        if let Some(a) = doc.get(p).as_dict().and_then(|d| d.get(b"Annots").map(|a| doc.resolve(a))).and_then(|a| a.as_array().cloned()) {
-            for r in a.iter().filter_map(Object::as_ref) {
-                map.insert(r, i);
-            }
-        }
-    }
-    map
-}
-
-fn nums(doc: &Document, d: &Dict, key: &[u8]) -> Option<Vec<f64>> {
-    doc.resolve(d.get(key)?).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect())
-}
-
-/// List and validate every signature field. `bytes` is the file as stored (the ranges index it).
-pub fn list(doc: &Document, bytes: &[u8], trust: &TrustStore) -> Vec<SignatureInfo> {
-    list_cached(doc, bytes, trust, &DigestCache::default())
-}
-
-/// [`list`], reusing digests and standalone-timestamp discovery from `cache`. Field/widget
-/// structure and validation against `bytes` and `trust` are read again on every call.
-pub fn list_cached(doc: &Document, bytes: &[u8], trust: &TrustStore, cache: &DigestCache) -> Vec<SignatureInfo> {
-    let pages = annot_pages(doc);
-    let mut out = Vec::new();
-    let mut field_values: HashSet<ObjRef> = HashSet::new();
-    for f in sig_fields(doc) {
-        if let Some(v_ref) = f.dict.get(b"V").and_then(Object::as_ref) {
-            field_values.insert(v_ref);
-        }
-        let widget = f.widgets.first();
-        let page = widget.and_then(|(r, w)| r.and_then(|r| pages.get(&r).copied()).or_else(|| w.reference(b"P").and_then(|p| page_index(doc, p))));
-        let rect = widget
-            .and_then(|(_, w)| nums(doc, w, b"Rect"))
-            .filter(|r| r.len() == 4)
-            .map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]);
-        // Shown when it has a box, and its widget isn't Hidden (2) or NoView (32), as the forms
-        // crate reads a widget's flags.
-        let flags = widget.and_then(|(_, w)| w.get(b"F")).and_then(|o| doc.resolve(o).as_int()).unwrap_or(0);
-        let visible = rect.is_some_and(|r| r[2] - r[0] > 0.5 && r[3] - r[1] > 0.5) && flags & (2 | 32) == 0;
-        let v = f.signature(doc);
-        let mut info = SignatureInfo {
-            field: f.name.clone(),
-            signed: v.is_some(),
-            page,
-            rect,
-            visible,
-            signer: None,
-            certificate: None,
-            chain: Vec::new(),
-            date: None,
-            signing_time: None,
-            reason: None,
-            location: None,
-            contact: None,
-            sub_filter: None,
-            doc_timestamp: false,
-            certify: None,
-            revision: 0,
-            signed_len: 0,
-            digest: None,
-            algorithm: None,
-            timestamp: false,
-            timestamp_time: None,
-            status: Status::Unknown,
-            modification: Modification::None,
-            details: Vec::new(),
-        };
-        if let Some(v) = v {
-            validate_into(doc, bytes, trust, &v, &mut info, cache);
-        }
-        out.push(info);
-    }
-    // Standalone document timestamps (ISO 32000-2 §12.8.2.2) live outside AcroForm fields.
-    let candidates = cache.timestamp_candidates(doc).into_iter().map(|r| r.num).collect();
-    for (r, o) in doc.scan_objects_subset(candidates) {
-        if field_values.contains(&r) {
-            continue;
-        }
-        let Ok(o) = o else { continue };
-        let Some(d) = o.as_dict() else { continue };
-        if !is_document_timestamp(&o) {
-            continue;
-        }
-        let mut info = SignatureInfo {
-            field: "DocumentTimestamp".to_string(),
-            signed: true,
-            page: None,
-            rect: None,
-            visible: false,
-            signer: None,
-            certificate: None,
-            chain: Vec::new(),
-            date: None,
-            signing_time: None,
-            reason: None,
-            location: None,
-            contact: None,
-            sub_filter: Some("ETSI.RFC3161".to_string()),
-            doc_timestamp: true,
-            certify: None,
-            revision: 0,
-            signed_len: 0,
-            digest: None,
-            algorithm: None,
-            timestamp: true,
-            timestamp_time: None,
-            status: Status::Unknown,
-            modification: Modification::None,
-            details: Vec::new(),
-        };
-        validate_doc_timestamp(doc, bytes, d, &mut info, cache, trust);
-        out.push(info);
-    }
-    out
-}
-
-fn page_index(doc: &Document, p: ObjRef) -> Option<usize> {
-    pdfcraft_annot::page_refs(doc).ok()?.iter().position(|r| *r == p)
-}
-
-/// A widget's `/MK /R` as a quarter turn (0, 90, 180 or 270); missing, malformed or not a
-/// multiple of 90 counts as 0, as `pdfcraft-forms` reads it for the fields it draws.
-fn mk_rotation(doc: &Document, widget: &Dict) -> i64 {
-    let r = widget
-        .get(b"MK")
-        .map(|mk| doc.resolve(mk))
-        .and_then(|mk| mk.as_dict().and_then(|mk| mk.get(b"R")).map(|r| doc.resolve(r)))
-        .and_then(|r| r.as_int().or_else(|| r.as_f64().filter(|v| v.is_finite() && v.abs() <= 1.0e6).map(|v| v.round() as i64)));
-    r.map(|r| r.rem_euclid(360)).filter(|q| matches!(q, 90 | 180 | 270)).unwrap_or(0)
-}
-
-/// Validate one signature dictionary.
-pub fn validate(doc: &Document, bytes: &[u8], trust: &TrustStore, field: &str) -> Option<SignatureInfo> {
-    list(doc, bytes, trust).into_iter().find(|s| s.field == field)
-}
-
-fn unhex(s: &[u8]) -> Option<Vec<u8>> {
-    let digits: Vec<u8> = s.iter().copied().filter(|c| !c.is_ascii_whitespace()).collect();
-    let val = |c: u8| (c as char).to_digit(16).map(|d| d as u8);
-    digits.chunks(2).map(|p| Some(val(p[0])? << 4 | p.get(1).map_or(Some(0), |c| val(*c))?)).collect()
-}
-
-/// A document timestamp dictionary: `/SubFilter /ETSI.RFC3161`, typed `/DocTimeStamp`
-/// (ISO 32000-2 §12.8.5) or, as older writers have it, `/Sig`.
-fn is_doc_timestamp(d: &Dict) -> bool {
-    d.name(b"SubFilter") == Some(b"ETSI.RFC3161") && matches!(d.name(b"Type"), Some(b"DocTimeStamp" | b"Sig"))
-}
-
-/// The DocMDP permission level (`/P`, 1–3) of signature value `v`, or `None` for an approval
-/// signature.
-fn docmdp(doc: &Document, v: &Dict) -> Option<u8> {
-    v.get(b"Reference")
-        .map(|r| doc.resolve(r))
-        .and_then(|r| r.as_array().cloned())
-        .into_iter()
-        .flatten()
-        .filter_map(|r| doc.resolve(&r).as_dict().cloned())
-        .find(|r| r.name(b"TransformMethod") == Some(b"DocMDP"))
-        .map(|r| r.get(b"TransformParams").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().and_then(|p| p.int(b"P"))).unwrap_or(2).clamp(1, 3) as u8)
-}
-
-fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, info: &mut SignatureInfo, cache: &DigestCache) {
-    // A document timestamp can also be the value of a signature field (Documenso writes
-    // `Timestamp_1` that way). Its `/Contents` is a bare RFC 3161 token, not a signature over the
-    // document, so it must not be read as one.
-    if is_doc_timestamp(v) {
-        info.sub_filter = Some("ETSI.RFC3161".to_string());
-        info.doc_timestamp = true;
-        info.timestamp = true;
-        validate_doc_timestamp(doc, bytes, v, info, cache, trust);
-        return;
-    }
-    info.date = text(doc, v, b"M");
-    info.reason = text(doc, v, b"Reason");
-    info.location = text(doc, v, b"Location");
-    info.contact = text(doc, v, b"ContactInfo");
-    info.sub_filter = v.name(b"SubFilter").map(|s| String::from_utf8_lossy(s).into_owned());
-    info.signer = text(doc, v, b"Name");
-    info.certify = docmdp(doc, v);
-    let invalid = |info: &mut SignatureInfo, why: Detail| {
-        info.status = Status::Invalid;
-        info.details.push(why);
-    };
-    // Byte ranges: [0 a b c] with the gap holding exactly the hex /Contents.
-    let Some(br) = nums(doc, v, b"ByteRange").filter(|b| b.len() == 4 && b.iter().all(|x| *x >= 0.0)) else {
-        return invalid(info, Detail::plain("The signature has no valid byte range."));
-    };
-    let [o0, l0, o1, l1] = [br[0] as usize, br[1] as usize, br[2] as usize, br[3] as usize];
-    if o0 != 0 || o1 < l0 || o1.checked_add(l1).is_none_or(|end| end > bytes.len()) || o1 - l0 < 2 {
-        return invalid(info, Detail::plain("The signature's byte range does not match the file."));
-    }
-    let gap = &bytes[l0..o1];
-    if gap.first() != Some(&b'<') || gap.last() != Some(&b'>') {
-        return invalid(info, Detail::plain("The signature's byte range does not exclude exactly its contents."));
-    }
-    let Some(contents) = unhex(&gap[1..gap.len() - 1]) else { return invalid(info, Detail::plain("The signature contents are not hexadecimal.")) };
-    let covered = o1 + l1;
-    info.signed_len = covered;
-    // The signed revision's number: its cross-reference sections (1 for a reconstructed file).
-    info.revision = cache.revision(doc, bytes, covered).map_or(1, |d| d.revisions().len().max(1));
-    // What can't be checked is unknown, not invalid: only data that is wrong or fails its check
-    // is "invalid".
-    let unsupported = |info: &mut SignatureInfo, why: &str| {
-        info.status = Status::Unknown;
-        // What is not supported yet is named by the reader, in its own words.
-        info.details.push(Detail::of("PdfCraft can't check this signature yet: {}.", Fill::Reason(why.to_owned())));
-    };
-    if info.sub_filter.as_deref() == Some("adbe.x509.rsa_sha1") {
-        return validate_x509_rsa_sha1(doc, bytes, trust, v, info, cache, (l0, o1, covered), &contents);
-    }
-    let sd = match SignedData::parse(&contents) {
-        Ok(sd) => sd,
-        Err(SignError::Unsupported(e)) => return unsupported(info, &e),
-        // What the reader made of it goes in as it stands: it is a developer's detail, not a sentence.
-        Err(e) => return invalid(info, Detail::of("The signature could not be read ({}).", Fill::Reason(e.to_string()))),
-    };
-    let s = &sd.signer;
-    // A quirk is a whole sentence the reader words for itself, so it goes on the list in `WORDINGS`.
-    info.details.extend(sd.quirks.iter().copied().map(Detail::plain));
-    info.digest = Some(s.digest);
-    info.timestamp = s.timestamp;
-    let mut unverified_time = None;
-    if let Some(raw) = &s.timestamp_token {
-        match crate::timestamp::parse_token(raw) {
-            Ok(t) => {
-                let imprint = t.digest.digest(&[&s.signature]);
-                if imprint != t.imprint {
-                    info.details.push(Detail::plain("The signature's timestamp token does not cover the signature value."));
-                } else {
-                    // Only a token from a trusted authority (valid when it stamped) is trusted
-                    // time; otherwise its time is reported but validation uses the signer's
-                    // own claimed time, as without a timestamp.
-                    let mut pool = crate::timestamp::token_certs(raw);
-                    pool.extend(trust.certs.iter().cloned());
-                    let tsa = t.signer_certificate();
-                    let trusted_tsa = tsa
-                        .as_ref()
-                        .is_some_and(|c| c.valid_at(t.gen_time) && build_chain(c, &pool, Some(t.gen_time)).iter().any(|x| trust.trusts(x)));
-                    if !trusted_tsa {
-                        unverified_time = Some(t.gen_time);
-                    } else if tsa.as_ref().is_some_and(Certificate::may_timestamp) {
-                        info.timestamp_time = Some(t.gen_time);
-                    } else {
-                        info.details.push(Detail::plain("The timestamp authority's certificate is not issued for time stamping."));
-                    }
-                }
-            }
-            Err(e) => info.details.push(Detail::of("The signature's timestamp token could not be verified ({}).", Fill::Reason(e.to_string()))),
-        }
-    }
-    // The digest the signature commits to.
-    let content_digest = match &sd.content {
-        // adbe.pkcs7.sha1: the document's SHA-1 digest is the signed content.
-        Some(c) => {
-            if *c != cache.digest(DigestAlg::Sha1, bytes, l0, o1, covered) {
-                return invalid(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
-            }
-            s.digest.digest(&[c])
-        }
-        None => cache.digest(s.digest, bytes, l0, o1, covered),
-    };
-    // With signed attributes the signature is made over them, not over the document: their
-    // message digest is what ties it to the signed bytes, and their content type says what those
-    // bytes are (data, for a document). RFC 5652 §5.3 requires both.
-    if s.signed_attrs.is_some() {
-        match s.content_type.as_deref() {
-            Some(crate::cms::DATA) => {}
-            Some(_) => {
-                return invalid(
-                    info,
-                    Detail::plain("The signature's signed attributes name a content type other than data, so it is not a signature of the document."),
-                );
-            }
-            None => {
-                info.details.push(Detail::plain("The signature's signed attributes have no content type, which CMS requires; it was read anyway."))
-            }
-        }
-        if s.message_digest.is_none() {
-            return invalid(
-                info,
-                Detail::plain("The signature's signed attributes have no message digest, so the signature does not cover the document."),
-            );
-        }
-    }
-    // A PDF signature signs data: the document, or (adbe.pkcs7.sha1) its digest. A content-type
-    // attribute was checked above, and `SignedData::parse` refuses one that differs from
-    // `eContentType`; without that attribute, `eContentType` is the only place that says so.
-    if sd.econtent_type != crate::cms::DATA {
-        let why = SignError::Malformed("CMS: the encapsulated content is not data".into());
-        return invalid(info, Detail::of("The signature could not be read ({}).", Fill::Reason(why.to_string())));
-    }
-    if let Some(md) = &s.message_digest
-        && *md != content_digest
-    {
-        return invalid(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
-    }
-    let Some(cert) = sd.signer_certificate().cloned() else {
-        return invalid(info, Detail::plain("The signer's certificate is not in the signature."));
-    };
-    info.algorithm = Some(format!("{} with {}", cert.public_key.describe(), s.scheme_digest.unwrap_or(s.digest).name()));
-    info.signer = Some(cert.display_name());
-    let mut notes = Vec::new();
-    match sd.verify_signature_noting(&cert, &content_digest, &mut notes) {
-        // A note is a whole sentence the reader words for itself, like a quirk.
-        Ok(true) => info.details.extend(notes.into_iter().map(Detail::plain)),
-        Ok(false) => {
-            info.certificate = Some(cert);
-            return invalid(info, Detail::plain("The signature value does not match the signer's certificate: the signature is corrupt."));
-        }
-        Err(SignError::Unsupported(e)) => {
-            info.certificate = Some(cert);
-            return unsupported(info, &e);
-        }
-        Err(e) => {
-            info.certificate = Some(cert);
-            return invalid(info, Detail::of("The signature could not be checked ({}).", Fill::Reason(e.to_string())));
-        }
-    }
-    finish_validation(doc, bytes, trust, info, cache, covered, cert, &sd.certificates, s.signing_time, unverified_time);
-}
-
-/// The verdict once the signature value has been checked: chain and trust, the signing time
-/// against the certificate's validity, and what later revisions changed.
-#[allow(clippy::too_many_arguments)]
-fn finish_validation(
-    doc: &Document,
-    bytes: &[u8],
-    trust: &TrustStore,
-    info: &mut SignatureInfo,
-    cache: &DigestCache,
-    covered: usize,
-    cert: Certificate,
-    embedded: &[Certificate],
-    cms_time: Option<Time>,
-    unverified_time: Option<Time>,
-) {
-    info.signing_time = cms_time.or_else(|| info.date.as_deref().and_then(Time::from_pdf));
-    let mut pool = embedded.to_vec();
-    pool.extend(trust.certs.iter().cloned());
-    // The time the chain is judged at: trusted timestamp, else the signer's claimed time.
-    let at = info.timestamp_time.or(info.signing_time);
-    let (chain, refused) = build_chain_noted(&cert, &pool, at);
-    let chain: Vec<Certificate> = chain.into_iter().cloned().collect();
-    let trusted = chain.iter().any(|c| trust.trusts(c));
-    info.chain = chain;
-    info.certificate = Some(cert.clone());
-    if let Some(why) = refused
-        && !trusted
-    {
-        info.details.push(why);
-    }
-    // Revocation evidence embedded in the document security store, if any. A verified
-    // revocation is final: later blocks must not soften the verdict.
-    let signer = info.chain.first().cloned();
-    let revocation = check_dss_revocation(doc, signer.as_ref(), &at, info);
-    let revoked = revocation == DssRevocation::Revoked;
-    // Changes after signing.
-    info.modification = if covered == bytes.len() || bytes[covered..].iter().all(|b| b.is_ascii_whitespace() || *b == 0) {
-        Modification::None
-    } else {
-        // The permissions are the signed revision's: a later one can rewrite `/P` (#1788). This
-        // signature is the one whose byte range ends that revision.
-        let old = cache.revision(doc, bytes, covered);
-        if let Some(old) = &old
-            && let Some(v) = sig_fields(old)
-                .iter()
-                .filter_map(|f| f.signature(old))
-                .find(|v| nums(old, v, b"ByteRange").is_some_and(|b| b.len() == 4 && b[2] + b[3] == covered as f64))
-        {
-            info.certify = docmdp(old, &v);
-        }
-        classify_changes(doc, old, info.certify)
-    };
-    let mut problems = false;
-    // The changes are handed over as the words they are, not stitched into the sentence, so an
-    // interface can say both in its own language.
-    match &info.modification {
-        Modification::None => info.details.push(Detail::plain("This document has not been modified since this signature was applied.")),
-        Modification::Allowed(kinds) => info.details.push(Detail::of(
-            "The document has been modified since this signature was applied, but the changes are permitted ({}).",
-            Fill::Changes(kinds.clone()),
-        )),
-        Modification::Disallowed(kinds) => {
-            let said = Detail::of(
-                "The document has been altered since this signature was applied in ways it does not permit ({}).",
-                Fill::Changes(kinds.clone()),
-            );
-            info.status = Status::Invalid;
-            info.details.push(said);
-            problems = true;
-        }
-    }
-    if revocation == DssRevocation::Incomplete {
-        if !problems {
-            info.status = Status::Unknown;
-        }
-        problems = true;
-    }
-    if let Some(t) = info.timestamp_time.or(info.signing_time)
-        && !cert.valid_at(t)
-    {
-        info.details.push(Detail::plain("The signer's certificate was not valid at the time of signing."));
-        // A verified revocation already made the signature invalid; keep it that way.
-        if !problems && !revoked {
-            info.status = Status::Unknown;
-        }
-        problems = true;
-    }
-    if let Some(why) = cert.signing_problem() {
-        info.details.push(why);
-        if !problems && !revoked {
-            info.status = Status::Unknown;
-        }
-        problems = true;
-    }
-    if !trusted {
-        info.details.push(Detail::plain(
-            "The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.",
-        ));
-        if !problems && !revoked {
-            info.status = Status::Unknown;
-        }
-    } else {
-        info.details.push(Detail::plain("The signer's identity is valid."));
-        if !problems && !revoked {
-            info.status = Status::Valid;
-        }
-    }
-    if info.timestamp {
-        info.details.push(Detail::plain("The signature includes an embedded timestamp."));
-    } else {
-        info.details.push(Detail::plain("Signing time is from the clock on the signer's computer."));
-    }
-    if let Some(t) = info.timestamp_time {
-        info.details
-            .push(Detail::of("The embedded timestamp token is valid and its authority is trusted; trusted time is {}.", Fill::Value(t.to_string())));
-    } else if let Some(t) = unverified_time {
-        info.details.push(Detail::of(
-            "The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.",
-            Fill::Value(t.to_string()),
-        ));
-    }
-}
-
-/// Distinct evidence streams read from one `/DSS` array.
-const MAX_DSS_ENTRIES: usize = 1024;
-/// Decoded bytes read from one `/DSS` array; real CRLs and OCSP responses are kilobytes each.
-const MAX_DSS_BYTES: usize = 64 << 20;
-
-/// The decoded streams of the `/DSS` evidence array `key` (`/CRLs`, `/OCSPs`), one at a time so
-/// each is checked before the next decodes: each stream once and within the evidence size cap,
-/// at most [`MAX_DSS_ENTRIES`] distinct ones and [`MAX_DSS_BYTES`] together. A stream past a cap
-/// sets [`DssEvidence::cut`] and ends the iteration.
-struct DssEvidence<'a> {
-    doc: &'a Document,
-    items: std::vec::IntoIter<Object>,
-    seen: HashSet<ObjRef>,
-    taken: usize,
-    left: usize,
-    /// A cap stopped the array being read in full.
-    cut: bool,
-}
-
-impl<'a> DssEvidence<'a> {
-    fn new(doc: &'a Document, dss: &Dict, key: &[u8]) -> Self {
-        let items = dss.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
-        DssEvidence { doc, items: items.into_iter(), seen: HashSet::new(), taken: 0, left: MAX_DSS_BYTES, cut: false }
-    }
-}
-
-impl Iterator for DssEvidence<'_> {
-    type Item = Vec<u8>;
-
-    fn next(&mut self) -> Option<Vec<u8>> {
-        if self.cut {
-            return None;
-        }
-        // Repeats are skipped before the caps count anything, so repeating one stream cannot use
-        // them up; the scan of the array itself is bounded by the parser's cap on array length.
-        for item in self.items.by_ref() {
-            if item.as_ref().is_some_and(|r| !self.seen.insert(r)) {
-                continue;
-            }
-            let o = self.doc.resolve(&item);
-            let Object::Stream(s) = o.as_ref() else { continue };
-            if self.taken >= MAX_DSS_ENTRIES {
-                self.cut = true;
-                return None;
-            }
-            self.taken += 1;
-            // A stream past the evidence cap would not parse as evidence either.
-            let Ok(bytes) = s.decoded_within(crate::revocation::MAX_EVIDENCE) else { continue };
-            let Some(left) = self.left.checked_sub(bytes.len()) else {
-                self.cut = true;
-                return None;
-            };
-            self.left = left;
-            return Some(bytes);
-        }
-        None
-    }
-}
-
-/// What the catalog's `/DSS` says about the signer's certificate.
-#[derive(Clone, Copy, Debug, PartialEq)]
-enum DssRevocation {
-    /// Verified evidence revokes it.
-    Revoked,
-    /// A cap stopped the evidence being read in full, and what was read does not revoke it.
-    Incomplete,
-    /// All of the evidence was read, and none of it revokes it.
-    NotRevoked,
-}
-
-/// Check the revocation evidence in the catalog's `/DSS` against the signer's chain at `at`.
-/// Only evidence whose signature verifies against the issuer counts; returns whether the
-/// certificate is revoked (which invalidates the signature), or whether a cap kept the check from
-/// reading all of the evidence.
-fn check_dss_revocation(doc: &Document, signer: Option<&Certificate>, at: &Option<Time>, info: &mut SignatureInfo) -> DssRevocation {
-    use crate::revocation::{CertificateList, OcspResponse, RevocationStatus};
-    let (Some(signer), Some(at)) = (signer, *at) else { return DssRevocation::NotRevoked };
-    let Some(root) = doc.root() else { return DssRevocation::NotRevoked };
-    let Some(dss) = doc.get(root).as_dict().and_then(|c| c.get(b"DSS").cloned()).map(|d| doc.resolve(&d)).and_then(|d| d.as_dict().cloned()) else {
-        return DssRevocation::NotRevoked;
-    };
-    let issuer = info.chain.get(1).unwrap_or(signer);
-    // A verified revocation wins; "good" from any covering evidence is reported, but never
-    // contradicts a revocation.
-    let mut revoked = None;
-    let mut covered = false;
-    let mut sources = Vec::new();
-    let mut crls = DssEvidence::new(doc, &dss, b"CRLs");
-    for r in crls.by_ref() {
-        let Ok(list) = CertificateList::parse(&r) else { continue };
-        sources.push("CRL");
-        match list.check(signer, issuer, at) {
-            RevocationStatus::Revoked { at } => {
-                revoked = Some(at);
-                break;
-            }
-            RevocationStatus::Good => covered = true,
-            RevocationStatus::Unknown => {}
-        }
-    }
-    let mut cut = crls.cut;
-    if revoked.is_none() {
-        let mut ocsps = DssEvidence::new(doc, &dss, b"OCSPs");
-        for r in ocsps.by_ref() {
-            let Ok(resp) = OcspResponse::parse(&r) else { continue };
-            sources.push("OCSP");
-            match resp.check(signer, issuer, at) {
-                RevocationStatus::Revoked { at } => {
-                    revoked = Some(at);
-                    break;
-                }
-                RevocationStatus::Good => covered = true,
-                RevocationStatus::Unknown => {}
-            }
-        }
-        cut |= ocsps.cut;
-    }
-    match revoked {
-        Some(at) => {
-            info.status = Status::Invalid;
-            // The evidence and the date go in together: one hole, so a reader can put the
-            // sentence's parts in whatever order its language wants.
-            info.details.push(Detail::of("The signer's certificate has been revoked ({}).", Fill::Value(format!("{}, {at}", sources.join(", ")))));
-            DssRevocation::Revoked
-        }
-        // Evidence past a cap may revoke the certificate, so a partial check proves nothing.
-        None if cut => {
-            info.details.push(Detail::of(
-                "The signature could not be checked ({}).",
-                Fill::Reason("the /DSS holds more revocation evidence than PdfCraft reads".into()),
-            ));
-            DssRevocation::Incomplete
-        }
-        None if covered => {
-            info.details
-                .push(Detail::plain("The document's embedded revocation information shows that the signer's certificate has not been revoked."));
-            DssRevocation::NotRevoked
-        }
-        None => DssRevocation::NotRevoked,
-    }
-}
-
-/// Validate a standalone document timestamp dictionary (`/ETSI.RFC3161`): the token must be
-/// cryptographically valid and its message imprint must cover the file's signed bytes.
-fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut SignatureInfo, cache: &DigestCache, trust: &TrustStore) {
-    info.date = text(doc, v, b"M");
-    let invalid = |info: &mut SignatureInfo, why: Detail| {
-        info.status = Status::Invalid;
-        info.details.push(why);
-    };
-    let Some(br) = nums(doc, v, b"ByteRange").filter(|b| b.len() == 4 && b.iter().all(|x| *x >= 0.0)) else {
-        return invalid(info, Detail::plain("The timestamp has no valid byte range."));
-    };
-    let [o0, l0, o1, l1] = [br[0] as usize, br[1] as usize, br[2] as usize, br[3] as usize];
-    if o0 != 0 || o1 < l0 || o1.checked_add(l1).is_none_or(|end| end > bytes.len()) || o1 - l0 < 2 {
-        return invalid(info, Detail::plain("The timestamp's byte range does not match the file."));
-    }
-    let gap = &bytes[l0..o1];
-    if gap.first() != Some(&b'<') || gap.last() != Some(&b'>') {
-        return invalid(info, Detail::plain("The timestamp's byte range does not exclude exactly its contents."));
-    }
-    let Some(contents) = unhex(&gap[1..gap.len() - 1]) else {
-        return invalid(info, Detail::plain("The timestamp contents are not hexadecimal."));
-    };
-    let covered = o1 + l1;
-    info.signed_len = covered;
-    info.revision = cache.revision(doc, bytes, covered).map_or(1, |d| d.revisions().len().max(1));
-    let token = match crate::timestamp::parse_token(&contents) {
-        Ok(t) => t,
-        Err(e) => return invalid(info, Detail::of("The timestamp token could not be read ({}).", Fill::Reason(e.to_string()))),
-    };
-    info.digest = Some(token.digest);
-    info.timestamp_time = Some(token.gen_time);
-    info.algorithm = Some(format!("RFC 3161 timestamp ({})", token.digest.name()));
-    let doc_digest = token.digest.digest(&[&bytes[..l0], &bytes[o1..covered]]);
-    if doc_digest != token.imprint {
-        return invalid(info, Detail::plain("The document has been altered or corrupted since the timestamp was applied."));
-    }
-    if let Some(cert) = token.signer_certificate() {
-        info.signer = Some(cert.display_name());
-        info.certificate = Some(cert.clone());
-        if !cert.valid_at(token.gen_time) {
-            info.status = Status::Unknown;
-            info.details.push(Detail::plain("The timestamp authority's certificate was not valid at the time of timestamping."));
-        }
-        if !cert.may_timestamp() {
-            info.status = Status::Unknown;
-            info.details.push(Detail::plain("The timestamp authority's certificate is not issued for time stamping."));
-        }
-    }
-    info.modification = if covered == bytes.len() || bytes[covered..].iter().all(|b| b.is_ascii_whitespace() || *b == 0) {
-        Modification::None
-    } else {
-        classify_changes(doc, cache.revision(doc, bytes, covered), None)
-    };
-    match &info.modification {
-        Modification::None => info.details.push(Detail::plain("This document has not been modified since this timestamp was applied.")),
-        Modification::Allowed(kinds) => info.details.push(Detail::of(
-            "The document has been modified since this timestamp was applied, but the changes are permitted ({}).",
-            Fill::Changes(kinds.clone()),
-        )),
-        Modification::Disallowed(kinds) => {
-            info.status = Status::Invalid;
-            info.details.push(Detail::of(
-                "The document has been altered since this timestamp was applied in ways it does not permit ({}).",
-                Fill::Changes(kinds.clone()),
-            ));
-        }
-    }
-    if info.status != Status::Invalid {
-        // An untrusted TSA is not proof of anything: the verdict stays Unknown, like an
-        // ordinary signature from an unknown signer.
-        let mut pool = crate::timestamp::token_certs(&contents);
-        pool.extend(trust.certs.iter().cloned());
-        // A trusted authority whose certificate was not valid at the time it stamped proves
-        // nothing either (its detail is already recorded above): never upgrade that to Valid.
-        // Nor does one whose certificate is not issued for time stamping.
-        let may_stamp = token.signer_certificate().is_some_and(|c| c.valid_at(token.gen_time) && c.may_timestamp());
-        let trusted_tsa = token.signer_certificate().is_some_and(|c| build_chain(&c, &pool, Some(token.gen_time)).iter().any(|x| trust.trusts(x)));
-        if trusted_tsa && may_stamp {
-            info.status = Status::Valid;
-            info.details.push(Detail::plain("The timestamp token is valid and its authority is trusted."));
-        } else if trusted_tsa {
-            info.status = Status::Unknown;
-        } else {
-            info.status = Status::Unknown;
-            info.details
-                .push(Detail::plain("The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates."));
-        }
-    }
-}
-
-/// The DER `/Contents` of every signature dictionary in the file (field signatures and
-/// document timestamps), for `/VRI` keys and evidence selection.
-pub(crate) fn signature_contents(doc: &Document) -> Vec<Vec<u8>> {
-    let mut out = Vec::new();
-    let mut seen: HashSet<ObjRef> = HashSet::new();
-    let mut add = |d: &Dict, r: Option<ObjRef>| {
-        if let Some(r) = r
-            && !seen.insert(r)
-        {
-            return;
-        }
-        let contents = d.get(b"Contents").map(|c| doc.resolve(c));
-        let Some(s) = contents.as_deref().and_then(Object::as_string) else { return };
-        // Hex strings decode to the DER when parsed; a literal string carries hex text.
-        let der = if s.hex { Some(s.bytes.clone()) } else { unhex(&s.bytes) };
-        if let Some(der) = der {
-            out.push(der);
-        }
-    };
-    for f in sig_fields(doc) {
-        if let Some(v) = f.dict.get(b"V") {
-            let d = doc.resolve(v);
-            if let Some(dd) = d.as_dict() {
-                add(dd, v.as_ref());
-            }
-        }
-    }
-    for (r, o) in doc.scan_objects() {
-        let Some(d) = o.as_dict() else { continue };
-        if is_doc_timestamp(d) {
-            add(d, Some(r));
-        }
-    }
-    out
-}
-
-/// `adbe.x509.rsa_sha1` (ISO 32000-2 §12.8.3.2, deprecated): `/Contents` is the PKCS #1
-/// signature as a DER OCTET STRING over the SHA-1 digest of the byte ranges, and `/Cert` holds the
-/// signer's certificate (then any others) as DER byte strings.
-#[allow(clippy::too_many_arguments)]
-fn validate_x509_rsa_sha1(
-    doc: &Document,
-    bytes: &[u8],
-    trust: &TrustStore,
-    v: &Dict,
-    info: &mut SignatureInfo,
-    cache: &DigestCache,
-    (l0, o1, covered): (usize, usize, usize),
-    contents: &[u8],
-) {
-    let fail = |info: &mut SignatureInfo, why: Detail| {
-        info.status = Status::Invalid;
-        info.details.push(why);
-    };
-    let certs: Vec<Certificate> = match v.get(b"Cert").map(|c| doc.resolve(c)).as_deref() {
-        Some(Object::Array(a)) => a.iter().filter_map(|c| doc.resolve(c).as_string().map(|s| s.bytes.clone())).collect::<Vec<_>>(),
-        Some(Object::String(s)) => vec![s.bytes.clone()],
-        _ => Vec::new(),
-    }
-    .iter()
-    .filter_map(|raw| Certificate::parse(raw).ok())
-    .collect();
-    let Some(cert) = certs.first().cloned() else { return fail(info, Detail::plain("The signer's certificate is not in the signature.")) };
-    let signature = match crate::der::Tlv::parse_ber(contents).and_then(|(t, _)| t.octets("signature").map(|o| o.into_owned())) {
-        Ok(sig) => sig,
-        // What the reader made of it goes in as it stands: it is a developer's detail, not a sentence.
-        Err(e) => return fail(info, Detail::of("The signature could not be read ({}).", Fill::Reason(e.to_string()))),
-    };
-    info.digest = Some(DigestAlg::Sha1);
-    info.algorithm = Some(format!("{} with SHA-1", cert.public_key.describe()));
-    info.signer = Some(cert.display_name());
-    let digest = cache.digest(DigestAlg::Sha1, bytes, l0, o1, covered);
-    let mut notes = Vec::new();
-    match cert.public_key.verify_noting(crate::keys::Scheme::RsaPkcs1, DigestAlg::Sha1, &digest, &signature, &mut notes) {
-        // A note is a whole sentence the reader words for itself, so it goes on the list in `WORDINGS`.
-        Ok(true) => info.details.extend(notes.into_iter().map(Detail::plain)),
-        Ok(false) => {
-            info.certificate = Some(cert);
-            return fail(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
-        }
-        // Only what PdfCraft doesn't support yet is "can't check"; a key or value that is
-        // malformed is a signature that doesn't verify (as on the CMS path).
-        Err(SignError::Unsupported(e)) => {
-            info.certificate = Some(cert);
-            info.status = Status::Unknown;
-            // What is not supported yet is named by the reader, in its own words.
-            info.details.push(Detail::of("PdfCraft can't check this signature yet: {}.", Fill::Reason(e.to_string())));
-            return;
-        }
-        Err(e) => {
-            info.certificate = Some(cert);
-            return fail(info, Detail::of("The signature could not be verified ({}).", Fill::Reason(e.to_string())));
-        }
-    }
-    info.details.push(Detail::plain("The signature uses the legacy adbe.x509.rsa_sha1 format."));
-    info.details.extend(DigestAlg::Sha1.weakness().map(Detail::plain));
-    finish_validation(doc, bytes, trust, info, cache, covered, cert, &certs, None, None);
-}
-
-/// What later revisions changed, classified as Acrobat reports it, under DocMDP `p` (or none:
-/// an approval signature permits form fill, comments and further signatures).
-fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Modification {
-    let Some(old) = old else {
-        return Modification::Disallowed(vec![kind::UNREADABLE]);
-    };
-    let old_content: HashSet<ObjRef> = pdfcraft_annot::page_refs(&old)
-        .unwrap_or_default()
-        .into_iter()
-        .flat_map(|pg| {
-            let c = old.get(pg).as_dict().and_then(|d| d.get(b"Contents").cloned());
-            match c {
-                Some(Object::Ref(r)) => match &*old.get(r) {
-                    Object::Array(a) => a.iter().filter_map(Object::as_ref).chain([r]).collect::<Vec<_>>(),
-                    _ => vec![r],
-                },
-                Some(Object::Array(a)) => a.iter().filter_map(Object::as_ref).collect(),
-                _ => Vec::new(),
-            }
-        })
-        .collect();
-    // The signed revision's document-level XMP stream.
-    let old_metadata = old.root().and_then(|root| old.get(root).as_dict().and_then(|c| c.get(b"Metadata").and_then(Object::as_ref)));
-    // The signed revision's XFA data packets: filling the form rewrites them.
-    let old_xfa_data = xfa_data_packets(&old);
-    // What each object was in the signed revision: its pages, and its trailer /Info. A changed
-    // object is judged by the role it held when signed, never by the labels or keys its new,
-    // attacker-written version carries (relabelling a signed page /Type /Sig, or dropping its
-    // /Type and adding /ModDate, must not reclassify it away from page content).
-    let signed_pages: HashSet<ObjRef> = pdfcraft_annot::page_refs(&old).unwrap_or_default().into_iter().collect();
-    // The signed pages' /Annots arrays that are objects of their own. Adding an annotation updates
-    // such an array in place (the page dictionary does not change), so it is judged like a
-    // page's inline /Annots: by the annotations it gained.
-    let signed_annots: HashSet<ObjRef> =
-        signed_pages.iter().filter_map(|pg| old.get(*pg).as_dict().and_then(|d| d.get(b"Annots").and_then(Object::as_ref))).collect();
-    // What each signed page draws from, by the role it held when signed (#1787).
-    let signed_resources = signed_page_resources(&old, &signed_pages);
-    let old_info = old.trailer().get(b"Info").and_then(Object::as_ref);
-    let (mut allowed, mut disallowed): (Vec<&'static str>, Vec<&'static str>) = (Vec::new(), Vec::new());
-    let dss = dss_parts(doc, &old);
-    // Stored at the same place in both (and not edited since): the same bytes, unchanged.
-    let same_place = |num: u32| -> bool {
-        use pdfcraft_cos::XrefEntry;
-        if doc.is_edited(num) {
-            return false;
-        }
-        match (doc.xref_entry(num), old.xref_entry(num)) {
-            (Some(a @ XrefEntry::InFile { .. }), Some(b)) => a == b,
-            (Some(a @ XrefEntry::InStream { stream, .. }), Some(b)) => {
-                a == b && !doc.is_edited(stream) && doc.xref_entry(stream) == old.xref_entry(stream)
-            }
-            _ => false,
-        }
-    };
-    // A later cross-reference section may carry an entry this reader sets aside (an in-use entry
-    // at offset 0, a second entry for one object, a reserved entry type). The renderer may follow
-    // it and draw another object than the one compared below, so the page could show new content
-    // while every comparison here finds the signed object untouched. No writer has a reason to
-    // add such an entry after signing: it is never a permitted change.
-    for (_, num) in doc.xref_oddities().iter().filter(|o| !old.xref_oddities().contains(o)) {
-        let r = ObjRef { num: *num, generation: doc.generation(*num) };
-        let what = if old_content.contains(&r) || signed_pages.contains(&r) { kind::PAGE_CONTENT } else { kind::OTHER };
-        if !disallowed.contains(&what) {
-            disallowed.push(what);
-        }
-    }
-    // The trailer chooses the catalog. A later revision that points it at another catalog (one
-    // already in the signed file, so no object changes) shows another document.
-    if doc.root() != old.root() {
-        disallowed.push(kind::STRUCTURE);
-    }
-    for num in doc.object_numbers() {
-        if same_place(num) {
-            continue;
-        }
-        let r = ObjRef { num, generation: doc.generation(num) };
-        let new = doc.get(r);
-        let before = old.try_get(num).ok().filter(|o| !matches!(**o, Object::Null));
-        if before.as_deref() == Some(&*new) {
-            // The same content at a new place. That is true for the renderer as well only when
-            // the entry locates the object itself: where this reader had to search for the
-            // object, another reader may arrive at a different one.
-            if !doc.is_edited(num) && !doc.xref_entry_is_exact(num) && !disallowed.contains(&kind::OTHER) {
-                disallowed.push(kind::OTHER);
-            }
-            continue;
-        }
-        // A resource of a signed page is page content whatever keys its new version carries
-        // (#1787): a /FT or /Subtype /Widget written by whoever rewrote a font, an XObject or a
-        // graphics state does not make that a form fill. A container (the resources dictionary,
-        // a category dictionary) that kept every entry it had and only gained names changes
-        // nothing the signed content draws, and is judged as before.
-        let kept_entries = |d: &Dict| before.as_deref().and_then(Object::as_dict).is_some_and(|b| b.iter().all(|(k, v)| d.get(k) == Some(v)));
-        let resource_kind = match (signed_resources.get(&r), &*new) {
-            (Some(false), _) => Some(kind::PAGE_CONTENT),
-            (Some(true), Object::Dict(d)) if kept_entries(d) => None,
-            (Some(true), _) => Some(kind::PAGE_CONTENT),
-            (None, _) => None,
-        };
-        let what = match (resource_kind, &*new) {
-            (Some(k), _) => k,
-            // The Document Security Store's own arrays and dictionaries, when they only grew.
-            (_, _) if dss.contains(&num) => kind::SECURITY_STORE,
-            // A signed page's indirect /Annots array, still an array: what it lost, then what it
-            // gained. Dropping a signed annotation is never hidden behind an added signature.
-            (_, Object::Array(now)) if signed_annots.contains(&r) && before.as_deref().is_some_and(|b| b.as_array().is_some()) => {
-                let was: HashSet<ObjRef> =
-                    before.as_deref().and_then(Object::as_array).map(|a| a.iter().filter_map(Object::as_ref).collect()).unwrap_or_default();
-                let kept: HashSet<ObjRef> = now.iter().filter_map(Object::as_ref).collect();
-                let removed: Vec<ObjRef> = was.iter().filter(|r| !kept.contains(r)).copied().collect();
-                if removed.is_empty() {
-                    let added: Vec<ObjRef> = now.iter().filter_map(Object::as_ref).filter(|r| !was.contains(r)).collect();
-                    added_annots(doc, &added)
-                } else if removed.iter().any(|r| old.get(*r).as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Widget"))) {
-                    // A form field or signature widget taken off the page: no permission covers it.
-                    kind::OTHER
-                } else {
-                    // Deleting comments is a comment change (permitted at P 3 only).
-                    kind::COMMENTS
-                }
-            }
-            (_, Object::Dict(d)) => {
-                let was = before.as_deref().and_then(Object::as_dict);
-                if signed_pages.contains(&r) {
-                    // A signed page is always judged by what the page shows, whatever it is now
-                    // relabelled: a rewritten /Contents or /Resources is a page content change.
-                    page_change_kind(doc, &old, d, was)
-                } else if was.is_some() && Some(r) == old_info {
-                    // Only the signed revision's own /Info dictionary is a metadata change.
-                    kind::METADATA
-                } else {
-                    change_kind(doc, &old, d, was)
-                }
-            }
-            (_, Object::Stream(s)) => {
-                // File plumbing is what the stream was when signed: the /Type it has now is
-                // written by whoever changed it, and the renderer ignores /Type (a page's Form
-                // XObject relabelled /ObjStm still draws its new content).
-                let was_plumbing = matches!(before.as_deref(), Some(Object::Stream(b)) if matches!(b.dict.name(b"Type"), Some(b"XRef" | b"ObjStm")));
-                if old_content.contains(&r) {
-                    kind::PAGE_CONTENT
-                } else if before.is_none() || was_plumbing {
-                    continue;
-                } else if s.dict.name(b"Type") == Some(b"Metadata") && Some(r) == old_metadata {
-                    // Only the signed catalog's XMP stream. A /Type /Metadata label on anything
-                    // else, even one it already had when signed (a page's Form XObject: the
-                    // renderer ignores /Type), does not make rewriting it a metadata change.
-                    kind::METADATA
-                } else if old_xfa_data.contains(&r) {
-                    // The form's XFA data (`datasets`) or state (`form`) as the signed revision
-                    // named it: filling an XFA form rewrites these, as a Reader Extensions (UR3)
-                    // save of a certified form does (#2759). The role comes from the signed
-                    // revision, so a later one can't name page content as XFA data.
-                    kind::FORM_FILL
-                } else {
-                    kind::OTHER
-                }
-            }
-            _ if before.is_none() => continue,
-            _ => kind::OTHER,
-        };
-        let ok = match (what, p) {
-            (kind::SIGNATURE | kind::SECURITY_STORE, _) => true,
-            (kind::FORM_FILL, Some(2 | 3) | None) => true,
-            (kind::COMMENTS, Some(3) | None) => true,
-            // Every save updates /Info (ModDate), signing included.
-            (kind::METADATA, _) => true,
-            _ => false,
-        };
-        let list = if ok { &mut allowed } else { &mut disallowed };
-        if !list.contains(&what) {
-            list.push(what);
-        }
-    }
-    // An object the signed revision had and this one frees is a change too, and the loop above
-    // only sees objects that still exist. File plumbing (cross-reference and object streams) is
-    // rewritten by every save and is not a change.
-    let current: HashSet<u32> = doc.object_numbers().into_iter().collect();
-    for num in old.object_numbers().into_iter().filter(|n| !current.contains(n)) {
-        let r = ObjRef { num, generation: old.generation(num) };
-        let was = old.get(r);
-        let signed_role = old_content.contains(&r) || signed_pages.contains(&r) || signed_resources.contains_key(&r);
-        // A signed page's content or resource is judged by that role, whatever /Type its stream carried.
-        if !signed_role && matches!(&*was, Object::Stream(s) if matches!(s.dict.name(b"Type"), Some(b"XRef" | b"ObjStm"))) {
-            continue;
-        }
-        let what = if signed_role { kind::PAGE_CONTENT } else { kind::OTHER };
-        if !disallowed.contains(&what) {
-            disallowed.push(what);
-        }
-    }
-    if disallowed.is_empty() { Modification::Allowed(allowed) } else { Modification::Disallowed(disallowed) }
-}
-
-/// The streams of `doc`'s XFA form that hold its data and state: the `datasets` and `form`
-/// packets of the AcroForm's `/XFA` array (name, stream, name, stream, …). A form given as one
-/// XFA stream holds its template too, and is not listed.
-fn xfa_data_packets(doc: &Document) -> HashSet<ObjRef> {
-    let Some(form) = acroform(doc) else { return HashSet::new() };
-    let Some(xfa) = form.get(b"XFA").map(|x| doc.resolve(x)) else { return HashSet::new() };
-    let Object::Array(xfa) = &*xfa else { return HashSet::new() };
-    xfa.as_chunks::<2>()
-        .0
-        .iter()
-        .filter(|[name, _]| doc.resolve(name).as_string().is_some_and(|s| matches!(s.to_text().as_str(), "datasets" | "form")))
-        .filter_map(|[_, packet]| packet.as_ref())
-        .collect()
-}
-
-/// Where an object sits in the Document Security Store (ISO 32000-2 §12.8.4.3).
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum DssRole {
-    /// The `/DSS` dictionary.
-    Dss,
-    /// A `/Certs`, `/CRLs`, `/OCSPs` (or a VRI entry's `/Cert`, `/CRL`, `/OCSP`) array.
-    DataArray,
-    /// A certificate, CRL, OCSP response or timestamp token stream.
-    Data,
-    /// The `/VRI` dictionary.
-    VriMap,
-    /// One entry of `/VRI`.
-    VriEntry,
-}
-
-/// The indirect objects the catalog's `/DSS` reaches by the keys the standard defines, and the
-/// role each plays there. Any other key is not followed: `/DSS << /X 5 0 R >>` does not make
-/// object 5 part of the store.
-fn dss_walk(doc: &Document) -> Vec<(ObjRef, DssRole)> {
-    const LIMIT: usize = 100_000;
-    let mut out = Vec::new();
-    let Some(dss) = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|c| c.get(b"DSS").cloned())) else { return out };
-    // The roles nest at most four deep (DSS, VRI, entry, array, data), so no seen-set is needed.
-    let mut stack = vec![(dss, DssRole::Dss)];
-    let mut steps = 0usize;
-    while let Some((o, role)) = stack.pop() {
-        steps += 1;
-        if steps > LIMIT {
-            break;
-        }
-        if let Object::Ref(r) = &o {
-            out.push((*r, role));
-        }
-        match (role, &*doc.resolve(&o)) {
-            (DssRole::Dss, Object::Dict(d)) => {
-                for (k, v) in d.iter() {
-                    match k.as_slice() {
-                        b"Certs" | b"CRLs" | b"OCSPs" => stack.push((v.clone(), DssRole::DataArray)),
-                        b"VRI" => stack.push((v.clone(), DssRole::VriMap)),
-                        _ => {}
-                    }
-                }
-            }
-            (DssRole::DataArray, Object::Array(a)) => stack.extend(a.iter().map(|v| (v.clone(), DssRole::Data))),
-            (DssRole::VriMap, Object::Dict(d)) => stack.extend(d.iter().map(|(_, v)| (v.clone(), DssRole::VriEntry))),
-            (DssRole::VriEntry, Object::Dict(d)) => {
-                for (k, v) in d.iter() {
-                    match k.as_slice() {
-                        b"Cert" | b"CRL" | b"OCSP" => stack.push((v.clone(), DssRole::DataArray)),
-                        b"TS" => stack.push((v.clone(), DssRole::Data)),
-                        _ => {}
-                    }
-                }
-            }
-            _ => {}
-        }
-    }
-    out
-}
-
-/// Whether `now` only adds to `before`: an array keeps every element, a dictionary keeps every
-/// entry (an entry that is an array or dictionary may itself have grown).
-fn only_grew(doc: &Document, old: &Document, before: &Object, now: &Object, depth: u8) -> bool {
-    /// Arrays of anything but references are compared element by element (quadratic), so only
-    /// up to this size; a store's `/Certs`/`/CRLs`/`/OCSPs` are references, compared as sets.
-    const MAX_COMPARED: usize = 10_000;
-    match (before, now) {
-        (Object::Array(b), Object::Array(n)) => {
-            if b.len() > n.len() {
-                return false;
-            }
-            let refs = |a: &[Object]| a.iter().map(Object::as_ref).collect::<Option<HashSet<ObjRef>>>();
-            match (refs(b), refs(n)) {
-                (Some(b), Some(n)) => b.is_subset(&n),
-                _ => b.len() <= MAX_COMPARED && n.len() <= MAX_COMPARED && b.iter().all(|x| n.contains(x)),
-            }
-        }
-        (Object::Dict(b), Object::Dict(n)) => b.iter().all(|(k, v)| match n.get(k) {
-            Some(nv) => nv == v || (depth < 4 && only_grew(doc, old, &old.resolve(v), &doc.resolve(nv), depth + 1)),
-            None => false,
-        }),
-        _ => before == now,
-    }
-}
-
-/// The objects of the Document Security Store that count as validation data added after
-/// signing: its dictionary, `/Certs`/`/CRLs`/`/OCSPs` arrays, `/VRI` and its entries, when
-/// - they are reached by the standard's keys and have the shape of their role, and
-/// - they are new, or were already part of the signed store and have only grown.
-///
-/// An existing object is never made "document security store" by pointing the store at it: the
-/// page's `/Contents` array, or a dictionary labelled `/Type /DSS`, keep being judged as what they
-/// are. The data streams need no entry here: new objects are not changes, and rewriting an
-/// existing one is judged on its own.
-fn dss_parts(doc: &Document, old: &Document) -> HashSet<u32> {
-    let signed: HashSet<u32> = dss_walk(old).into_iter().map(|(r, _)| r.num).collect();
-    let is_stream = |o: &Object| matches!(&*doc.resolve(o), Object::Stream(_));
-    let mut parts = HashSet::new();
-    for (r, role) in dss_walk(doc) {
-        let now = doc.get(r);
-        let shaped = match (role, &*now) {
-            (DssRole::Dss, Object::Dict(d)) => d.iter().all(|(k, _)| matches!(k.as_slice(), b"Type" | b"Certs" | b"CRLs" | b"OCSPs" | b"VRI")),
-            (DssRole::DataArray, Object::Array(a)) => a.iter().all(|e| matches!(e, Object::Ref(_)) && is_stream(e)),
-            (DssRole::VriMap, Object::Dict(d)) => d.iter().all(|(_, v)| matches!(&*doc.resolve(v), Object::Dict(_))),
-            (DssRole::VriEntry, Object::Dict(d)) => {
-                d.iter().all(|(k, _)| matches!(k.as_slice(), b"Type" | b"Cert" | b"CRL" | b"OCSP" | b"TU" | b"TS"))
-            }
-            _ => false,
-        };
-        let before = old.try_get(r.num).ok().filter(|o| !matches!(**o, Object::Null));
-        let history = match before {
-            None => true,
-            Some(b) => signed.contains(&r.num) && only_grew(doc, old, &b, &now, 0),
-        };
-        if shaped && history {
-            parts.insert(r.num);
-        }
-    }
-    parts
-}
-
-/// What adding `added` annotations amounts to: signing (signature widgets only), form fill
-/// (other widgets) or comments.
-fn added_annots(doc: &Document, added: &[ObjRef]) -> &'static str {
-    let kinds: Vec<(bool, bool)> = added
-        .iter()
-        .map(|r| {
-            let o = doc.get(*r);
-            let d = o.as_dict();
-            (d.is_some_and(|d| d.name(b"Subtype") == Some(b"Widget")), d.is_some_and(|d| d.name(b"FT") == Some(b"Sig")))
-        })
-        .collect();
-    if !kinds.is_empty() && kinds.iter().all(|(w, s)| *w && *s) {
-        kind::SIGNATURE
-    } else if !kinds.is_empty() && kinds.iter().all(|(w, _)| *w) {
-        kind::FORM_FILL
-    } else {
-        kind::COMMENTS
-    }
-}
-
-fn refs(doc: &Document, o: Option<&Object>) -> Vec<ObjRef> {
-    o.map(|o| doc.resolve(o)).and_then(|a| a.as_array().map(|a| a.iter().filter_map(Object::as_ref).collect())).unwrap_or_default()
-}
-
-/// The interactive form dictionary of a document, resolved.
-fn acroform(doc: &Document) -> Option<Dict> {
-    let c = doc.get(doc.root()?).as_dict()?.get(b"AcroForm").cloned()?;
-    doc.resolve(&c).as_dict().cloned()
-}
-
-/// An AcroForm change that only adds signature fields (and sets `/SigFlags`) is signing.
-/// Without `before`, the signed revision's AcroForm (wherever it was) is the reference.
-fn acroform_kind(doc: &Document, old: &Document, now: &Dict, before: Option<&Dict>) -> &'static str {
-    let fallback = acroform(old).unwrap_or_default();
-    let before = before.unwrap_or(&fallback);
-    let strip = |d: &Dict| -> Vec<(Vec<u8>, Object)> {
-        let mut v: Vec<(Vec<u8>, Object)> =
-            d.iter().filter(|(k, _)| !matches!(k.as_slice(), b"Fields" | b"SigFlags")).map(|(k, o)| (k.to_vec(), o.clone())).collect();
-        v.sort_by(|a, b| a.0.cmp(&b.0));
-        v
-    };
-    if strip(now) != strip(before) {
-        return kind::FORM_FILL;
-    }
-    let old_fields = refs(old, before.get(b"Fields"));
-    let added: Vec<ObjRef> = refs(doc, now.get(b"Fields")).into_iter().filter(|r| !old_fields.contains(r)).collect();
-    if added.is_empty() || added_annots(doc, &added) == kind::SIGNATURE { kind::SIGNATURE } else { kind::FORM_FILL }
-}
-
-/// Dictionary entries in a stable order, without `keys`.
-fn without(x: &Dict, keys: &[&[u8]]) -> Vec<(Vec<u8>, Object)> {
-    let mut v: Vec<(Vec<u8>, Object)> = x.iter().filter(|(k, _)| !keys.contains(&k.as_slice())).map(|(k, o)| (k.to_vec(), o.clone())).collect();
-    v.sort_by(|a, b| a.0.cmp(&b.0));
-    v
-}
-
-/// Whether a dictionary was a signature object: a signature or timestamp value, a signature
-/// reference or its transform parameters, or a signature form field. Used to decide from the
-/// signed revision, so a later relabel of some other object cannot pose as a signature change.
-fn is_signature_dict(d: &Dict) -> bool {
-    matches!(d.name(b"Type"), Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams")) || d.name(b"FT") == Some(b"Sig")
-}
-
-/// The objects the signed pages draw from, by reference, with the role each held when signed
-/// (#1787): `true` for a container (a page's resources dictionary, or one of its category
-/// dictionaries), where a name added later can't be reached by unchanged content; `false` for
-/// everything reached from a container's entries (fonts and their files, XObjects and their own
-/// resources, graphics states and soft masks, colour spaces, patterns, shadings, optional-content
-/// properties), where any change changes what the page shows. Resources are the page's own or
-/// inherited. Bounded by depth and by the number of objects visited; past the bound the rest is
-/// judged as before.
-fn signed_page_resources(old: &Document, pages: &HashSet<ObjRef>) -> HashMap<ObjRef, bool> {
-    const CATEGORIES: [&[u8]; 7] = [b"Font", b"XObject", b"ExtGState", b"ColorSpace", b"Pattern", b"Shading", b"Properties"];
-    const MAX_VISITED: usize = 50_000;
-    const MAX_DEPTH: u8 = 32;
-    const MAX_INHERITANCE: usize = 64;
-
-    /// Everything reachable from `o` is content the page draws (a leaf role, overriding a
-    /// container one reached by another path). A signed page or the catalog reached this way
-    /// (a `/P` or `/Parent` back-reference) keeps the role of its own: the walk stops there.
-    fn reach(old: &Document, o: &Object, depth: u8, stop: &HashSet<ObjRef>, roles: &mut HashMap<ObjRef, bool>) {
-        if roles.len() >= MAX_VISITED || depth > MAX_DEPTH {
-            return;
-        }
-        let resolved;
-        let o = match o {
-            Object::Ref(r) => {
-                if stop.contains(r) || roles.insert(*r, false).is_some() {
-                    return;
-                }
-                resolved = old.get(*r);
-                &*resolved
-            }
-            other => other,
-        };
-        match o {
-            Object::Dict(d) => d.iter().for_each(|(_, v)| reach(old, v, depth + 1, stop, roles)),
-            Object::Stream(s) => s.dict.iter().for_each(|(_, v)| reach(old, v, depth + 1, stop, roles)),
-            Object::Array(a) => a.iter().for_each(|v| reach(old, v, depth + 1, stop, roles)),
-            _ => {}
-        }
-    }
-
-    /// A page's `/Resources`, its own or the nearest ancestor's.
-    fn resources(old: &Document, page: ObjRef) -> Option<Object> {
-        let mut seen = HashSet::new();
-        let mut cur = page;
-        while seen.insert(cur) && seen.len() <= MAX_INHERITANCE {
-            let d = old.get(cur);
-            let d = d.as_dict()?;
-            if let Some(r) = d.get(b"Resources") {
-                return Some(r.clone());
-            }
-            cur = d.get(b"Parent").and_then(Object::as_ref)?;
-        }
-        None
-    }
-
-    let mut roles = HashMap::new();
-    let mut stop = pages.clone();
-    stop.extend(old.root());
-    for page in pages {
-        let Some(res) = resources(old, *page) else { continue };
-        let container = |o: &Object, roles: &mut HashMap<ObjRef, bool>| -> Arc<Object> {
-            match o {
-                Object::Ref(r) => {
-                    roles.entry(*r).or_insert(true);
-                    old.get(*r)
-                }
-                other => Arc::new(other.clone()),
-            }
-        };
-        let res = container(&res, &mut roles);
-        let Some(d) = res.as_dict() else { continue };
-        for category in CATEGORIES {
-            let Some(v) = d.get(category) else { continue };
-            let category = container(v, &mut roles);
-            if let Some(entries) = category.as_dict() {
-                entries.iter().for_each(|(_, entry)| reach(old, entry, 0, &stop, &mut roles));
-            }
-        }
-    }
-    roles
-}
-
-/// A changed object that was a page in the signed revision, judged by what the page shows rather
-/// than by any `/Type` its new version carries. Only added annotations are permitted; any other
-/// difference (content, resources, a relabelled or dropped `/Type`) is a page content change.
-fn page_change_kind(doc: &Document, old: &Document, d: &Dict, before: Option<&Dict>) -> &'static str {
-    match before {
-        Some(b) if without(d, &[b"Annots"]) != without(b, &[b"Annots"]) => kind::PAGE_CONTENT,
-        Some(b) => {
-            let was = refs(old, b.get(b"Annots"));
-            let added: Vec<ObjRef> = refs(doc, d.get(b"Annots")).into_iter().filter(|r| !was.contains(r)).collect();
-            added_annots(doc, &added)
-        }
-        None => kind::PAGE_CONTENT,
-    }
-}
-
-/// Whether the catalog `d` keeps every developer extension the signed catalog `b` declared, each
-/// with the same value: it may only declare more.
-fn extensions_kept(doc: &Document, old: &Document, d: &Dict, b: &Dict) -> bool {
-    let now = d.get(b"Extensions").map(|e| doc.resolve(e)).and_then(|e| e.as_dict().cloned());
-    let was = b.get(b"Extensions").map(|e| old.resolve(e)).and_then(|e| e.as_dict().cloned());
-    match (was, now) {
-        (None, _) => true,
-        (Some(was), Some(now)) => was.iter().all(|(k, v)| now.get(k) == Some(v)),
-        (Some(_), None) => false,
-    }
-}
-
-fn change_kind(doc: &Document, old: &Document, d: &Dict, before: Option<&Dict>) -> &'static str {
-    let ty = d.name(b"Type");
-    // A later revision cannot make an existing object a signature by relabelling it: a signature
-    // change is only a brand-new object, or one that was already a signature object when signed.
-    let signature_ok = before.is_none_or(is_signature_dict);
-    // A signature widget that already held a signature is what the signature shows: moving it or
-    // swapping its appearance can hide the signed page under it. Judged by the signed revision,
-    // so relabelling the widget now does not change that.
-    if before.is_some_and(|b| {
-        b.name(b"Subtype") == Some(b"Widget") && b.name(b"FT") == Some(b"Sig") && b.get(b"V").is_some_and(|v| old.resolve(v).as_dict().is_some())
-    }) && before != Some(d)
-    {
-        return kind::PAGE_CONTENT;
-    }
-    match ty {
-        // Only a new signature value or policy: rewriting a signed one is not a signature (#1788).
-        Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams") if before.is_none() => return kind::SIGNATURE,
-        Some(b"Catalog") => {
-            let keys: &[&[u8]] = &[b"AcroForm", b"DSS", b"Perms", b"Metadata", b"NeedsRendering", b"Extensions"];
-            return match before {
-                Some(b) if without(d, keys) != without(b, keys) => kind::STRUCTURE,
-                // Developer extensions (ISO 32000-2 §7.12) only declare what the file uses. A
-                // writer adding a /DSS also declares the ESIC extension it belongs to, so a
-                // declaration may be added, but none that was signed may change or go.
-                Some(b) if !extensions_kept(doc, old, d, b) => kind::STRUCTURE,
-                Some(b) => {
-                    if d.get(b"AcroForm") != b.get(b"AcroForm") {
-                        // Compare the forms themselves, inline or not.
-                        let now = acroform(doc).unwrap_or_default();
-                        acroform_kind(doc, old, &now, None)
-                    } else if b.get(b"Perms") != d.get(b"Perms") {
-                        kind::SIGNATURE
-                    } else {
-                        kind::METADATA
-                    }
-                }
-                None => kind::FORM_FILL,
-            };
-        }
-        Some(b"Page") => {
-            return match before {
-                Some(b) if without(d, &[b"Annots"]) != without(b, &[b"Annots"]) => kind::PAGE_CONTENT,
-                Some(b) => {
-                    let was = refs(old, b.get(b"Annots"));
-                    let added: Vec<ObjRef> = refs(doc, d.get(b"Annots")).into_iter().filter(|r| !was.contains(r)).collect();
-                    added_annots(doc, &added)
-                }
-                None => kind::COMMENTS,
-            };
-        }
-        Some(b"Pages") => return if before.is_some() { kind::PAGES } else { kind::STRUCTURE },
-        _ => {}
-    }
-    match d.name(b"Subtype") {
-        Some(b"Widget") => return if d.name(b"FT") == Some(b"Sig") && signature_ok { kind::SIGNATURE } else { kind::FORM_FILL },
-        Some(b"Link") => return kind::LINKS,
-        Some(_) if ty == Some(b"Annot") || d.contains(b"Rect") => return kind::COMMENTS,
-        _ => {}
-    }
-    if d.name(b"FT") == Some(b"Sig") && signature_ok {
-        return kind::SIGNATURE;
-    }
-    if d.contains(b"Fields") {
-        return acroform_kind(doc, old, d, before);
-    }
-    if d.contains(b"FT") || (d.contains(b"T") && d.contains(b"Kids")) || d.contains(b"DR") {
-        return kind::FORM_FILL;
-    }
-    if before.is_none() {
-        // New objects referenced by changed ones (fonts, appearance resources).
-        return kind::FORM_FILL;
-    }
-    kind::OTHER
-}
-
-// ── signing ─────────────────────────────────────────────────────────────────────────────────
-
-/// What the visible signature shows (Acrobat: Configure Signature Appearance).
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Appearance {
-    pub name: bool,
-    pub date: bool,
-    pub reason: bool,
-    pub location: bool,
-    pub distinguished_name: bool,
-    pub labels: bool,
-}
-
-impl Default for Appearance {
-    fn default() -> Self {
-        Self { name: true, date: true, reason: false, location: false, distinguished_name: false, labels: true }
-    }
-}
-
-/// The words of the labels of a visible signature.
-///
-/// They are stamped into the document, so the caller chooses them: an interface that speaks
-/// another language passes them in that language. The defaults are the English ones.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct AppearanceLabels {
-    pub signed_by: String,
-    pub distinguished_name: String,
-    pub reason: String,
-    pub location: String,
-    pub date: String,
-}
-
-impl Default for AppearanceLabels {
-    fn default() -> Self {
-        Self {
-            signed_by: "Digitally signed by".into(),
-            distinguished_name: "DN: ".into(),
-            reason: "Reason: ".into(),
-            location: "Location: ".into(),
-            date: "Date: ".into(),
-        }
-    }
-}
-
-impl AppearanceLabels {
-    /// Each label with its field name (`signed_by`, `distinguished_name`, `reason`, `location`,
-    /// `date`), in the order the visible signature shows them.
-    pub fn fields(&self) -> [(&'static str, &str); 5] {
-        [
-            ("signed_by", self.signed_by.as_str()),
-            ("distinguished_name", self.distinguished_name.as_str()),
-            ("reason", self.reason.as_str()),
-            ("location", self.location.as_str()),
-            ("date", self.date.as_str()),
-        ]
-    }
-
-    /// The first label, with its field name, that has a character the visible signature's font
-    /// can't draw, and that character. Signing refuses such a label when it is shown, so an
-    /// interface checks its translated labels here and falls back to [`Default`] if one fails.
-    pub fn first_undrawable(&self) -> Option<(&'static str, char)> {
-        self.fields().into_iter().find_map(|(field, text)| pdfcraft_fonts::first_undrawable(text).map(|c| (field, c)))
-    }
-}
-
-#[derive(Clone, Debug, Default)]
-pub struct SignOptions {
-    /// Sign this existing, unsigned signature field.
-    pub field: Option<String>,
-    /// Or create a field on this page (0-based) with this rectangle (`None`: invisible).
-    pub page: usize,
-    pub rect: Option<[f64; 4]>,
-    /// Name for a new field (default `Signature1`, `Signature2`…).
-    pub new_field_name: Option<String>,
-    pub reason: Option<String>,
-    pub location: Option<String>,
-    pub contact: Option<String>,
-    /// The signing time as a PDF date (`/M`), from the caller's clock.
-    pub date: String,
-    /// Certify with these DocMDP permissions (1 no changes, 2 form fill and signing, 3 also comments).
-    pub certify: Option<u8>,
-    pub appearance: Appearance,
-    /// The words of the labels the visible signature shows.
-    pub appearance_labels: AppearanceLabels,
-    /// A drawing, typed signature or image shown where the large name would be.
-    pub graphic: Option<crate::graphic::Graphic>,
-}
-
-/// What an encrypted document's permissions (ISO 32000-2 §7.6.4.2, Table 22) allow when it was
-/// opened with the user password (the owner may do anything): signing an existing, empty
-/// signature field is filling in a form field (bit 9, or bit 6); creating a new signature
-/// field needs bits 6 and 4; certifying sets the catalog's `/Perms`, a document change (bit 4).
-/// The signature's `/Contents` stays unencrypted (`pdfcraft-cos` exempts it, §7.6.2), so the
-/// placeholder can be patched after hashing exactly as in an unencrypted file.
-fn check_signing_permissions(doc: &Document, opts: &SignOptions) -> Result<(), SignError> {
-    let Some(p) = doc.permissions() else { return Ok(()) };
-    let refuse = |what: &str| {
-        Err(SignError::Pdf(format!(
-            "the document's security settings don't allow {what}; open it with the permissions password, or sign an existing signature field"
-        )))
-    };
-    if opts.field.is_some() && !p.fill_forms() {
-        return Err(SignError::Pdf(
-            "the document's security settings don't allow filling in form fields or signing; open it with the permissions password to sign it".into(),
-        ));
-    }
-    if opts.field.is_none() && !(p.annotate() && p.modify()) {
-        return refuse("adding new signature fields");
-    }
-    if opts.certify.is_some() && !p.modify() {
-        return refuse("certifying it");
-    }
-    Ok(())
-}
-
-/// Placeholder `/ByteRange` values: fixed width, patched after writing.
-const BR_MARK: [i64; 3] = [1_111_111_111, 2_222_222_222, 3_333_333_333];
-
-/// Sign `doc` with `id`; returns the signed file (an incremental update when possible).
-pub fn sign(doc: &Document, id: &DigitalId, opts: &SignOptions) -> Result<Vec<u8>, SignError> {
-    sign_inner(doc, id, opts, None)
-}
-
-/// Sign and embed an RFC 3161 signature timestamp from `tsa` (PAdES B-T). The transport is the
-/// caller's: this crate never opens a socket, and a rejected or malformed token fails the
-/// signing before any file is produced.
-pub fn sign_with_timestamp(
-    doc: &Document,
-    id: &DigitalId,
-    opts: &SignOptions,
-    tsa: &dyn crate::timestamp::TimestampAuthority,
-) -> Result<Vec<u8>, SignError> {
-    sign_inner(doc, id, opts, Some(tsa))
-}
-
-/// Extra `/Contents` headroom for an attached RFC 3161 token (a TSA response with its
-/// certificate chain is typically 4–8 KiB; the token is also size-capped on parsing).
-const TOKEN_RESERVE: usize = 16 * 1024;
-
-fn sign_inner(
-    doc: &Document,
-    id: &DigitalId,
-    opts: &SignOptions,
-    tsa: Option<&dyn crate::timestamp::TimestampAuthority>,
-) -> Result<Vec<u8>, SignError> {
-    // A pending security change would make the incremental save a full rewrite that applies
-    // or removes protection as it signs (and breaks existing signatures): save it first.
-    if doc.encryption_changed() {
-        return Err(SignError::Pdf("save the document's new security settings before signing it".into()));
-    }
-    check_signing_permissions(doc, opts)?;
-    let mut doc = doc.clone();
-    let root = doc.root().ok_or_else(|| SignError::Pdf("the document has no catalog".into()))?;
-    let alg = id.key.preferred_digest();
-    let reserve =
-        8192 + id.certificate.raw.len() + id.chain.iter().map(|c| c.raw.len()).sum::<usize>() + if tsa.is_some() { TOKEN_RESERVE } else { 0 };
-    let name = id.certificate.display_name();
-    // The signature dictionary.
-    let mut v = Dict::new();
-    v.set(b"Type".to_vec(), Object::name("Sig"));
-    v.set(b"Filter".to_vec(), Object::name("Adobe.PPKLite"));
-    v.set(b"SubFilter".to_vec(), Object::name("ETSI.CAdES.detached"));
-    v.set(b"ByteRange".to_vec(), Object::Array([0].iter().chain(BR_MARK.iter()).map(|n| Object::Int(*n)).collect()));
-    v.set(b"Contents".to_vec(), Object::String(PdfString { bytes: vec![0; reserve], hex: true }));
-    v.set(b"M".to_vec(), PdfString::literal(opts.date.as_bytes().to_vec()));
-    v.set(b"Name".to_vec(), PdfString::text(&name));
-    for (k, val) in [(&b"Reason"[..], &opts.reason), (b"Location", &opts.location), (b"ContactInfo", &opts.contact)] {
-        if let Some(s) = val.as_deref().filter(|s| !s.trim().is_empty()) {
-            v.set(k.to_vec(), PdfString::text(s));
-        }
-    }
-    let mut app = Dict::new();
-    app.set(b"Name".to_vec(), Object::name("PdfCraft"));
-    let mut build = Dict::new();
-    build.set(b"App".to_vec(), Object::Dict(app));
-    v.set(b"Prop_Build".to_vec(), Object::Dict(build));
-    if let Some(p) = opts.certify {
-        let mut tp = Dict::new();
-        tp.set(b"Type".to_vec(), Object::name("TransformParams"));
-        tp.set(b"P".to_vec(), Object::Int(p.clamp(1, 3) as i64));
-        tp.set(b"V".to_vec(), Object::name("1.2"));
-        let mut sr = Dict::new();
-        sr.set(b"Type".to_vec(), Object::name("SigRef"));
-        sr.set(b"TransformMethod".to_vec(), Object::name("DocMDP"));
-        sr.set(b"TransformParams".to_vec(), Object::Dict(tp));
-        v.set(b"Reference".to_vec(), Object::Array(vec![Object::Dict(sr)]));
-    }
-    let sig = doc.add(Object::Dict(v.clone()));
-    if opts.certify.is_some() {
-        // Catalog /Perms /DocMDP points at the certification signature.
-        let mut perms = Dict::new();
-        perms.set(b"DocMDP".to_vec(), Object::Ref(sig));
-        doc.update_dict(root, |c| c.set(b"Perms".to_vec(), Object::Dict(perms)))?;
-    }
-    // The field and its widget.
-    let pages = pdfcraft_annot::page_refs(&doc).map_err(|e| SignError::Pdf(e.to_string()))?;
-    let existing = opts
-        .field
-        .as_deref()
-        .map(|n| sig_fields(&doc).into_iter().find(|f| f.name == n).ok_or_else(|| SignError::Pdf(format!("there is no signature field {n:?}"))));
-    // `turn`: how far the appearance is turned to read upright (`/MK /R`, counterclockwise).
-    let (widget, rect, turn) = match existing {
-        Some(f) => {
-            let f = f?;
-            if f.signature(&doc).is_some() {
-                return Err(SignError::Pdf(format!("the field {:?} is already signed", f.name)));
-            }
-            if f.has_foreign_value(&doc) {
-                return Err(SignError::Pdf(format!("the value of the field {:?} is not a signature", f.name)));
-            }
-            let fr = f.r.ok_or_else(|| SignError::Pdf("the field is not an indirect object".into()))?;
-            doc.update_dict(fr, |d| d.set(b"V".to_vec(), Object::Ref(sig)))?;
-            let (wr, wd) = f.widgets.first().cloned().ok_or_else(|| SignError::Pdf("the field has no widget".into()))?;
-            let rect = nums(&doc, &wd, b"Rect").filter(|r| r.len() == 4).map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]);
-            // The field's own rotation, as a form author set it: an existing field is not
-            // reoriented, so one without `/MK /R` is drawn as before.
-            (wr.unwrap_or(fr), rect.unwrap_or([0.0; 4]), mk_rotation(&doc, &wd))
-        }
-        None => {
-            let page = *pages.get(opts.page).ok_or_else(|| SignError::Pdf(format!("page {} does not exist", opts.page + 1)))?;
-            let taken: HashSet<String> = sig_fields(&doc).into_iter().map(|f| f.name).collect();
-            let fname = opts
-                .new_field_name
-                .clone()
-                .unwrap_or_else(|| (1..).map(|i| format!("Signature{i}")).find(|n| !taken.contains(n)).unwrap_or_default());
-            let rect = opts.rect.unwrap_or([0.0; 4]);
-            let mut w = Dict::new();
-            w.set(b"Type".to_vec(), Object::name("Annot"));
-            w.set(b"Subtype".to_vec(), Object::name("Widget"));
-            w.set(b"FT".to_vec(), Object::name("Sig"));
-            w.set(b"T".to_vec(), PdfString::text(&fname));
-            w.set(b"V".to_vec(), Object::Ref(sig));
-            w.set(b"Rect".to_vec(), Object::Array(rect.iter().map(|x| Object::Real(*x)).collect()));
-            w.set(b"P".to_vec(), Object::Ref(page));
-            // Print + Locked.
-            w.set(b"F".to_vec(), Object::Int(4 | 128));
-            // On a page shown turned, the signature reads upright as the page is displayed: the
-            // widget is turned back by the page's rotation (ISO 32000-2 §12.5.6.19, `/MK /R`).
-            let turn = pdfcraft_model::pages(&doc).get(opts.page).map_or(0, |p| p.rotation(&doc));
-            if turn != 0 {
-                let mut mk = Dict::new();
-                mk.set(b"R".to_vec(), Object::Int(turn));
-                w.set(b"MK".to_vec(), Object::Dict(mk));
-            }
-            let wr = doc.add(Object::Dict(w));
-            // Page /Annots (indirect arrays are updated in place).
-            let pd = doc.get(page).as_dict().cloned().unwrap_or_default();
-            match pd.get(b"Annots") {
-                Some(Object::Ref(ar)) => {
-                    let mut a = doc.get(*ar).as_array().cloned().unwrap_or_default();
-                    a.push(Object::Ref(wr));
-                    doc.set(*ar, Object::Array(a));
-                }
-                other => {
-                    let mut a = other.and_then(|o| o.as_array().cloned()).unwrap_or_default();
-                    a.push(Object::Ref(wr));
-                    doc.update_dict(page, |d| d.set(b"Annots".to_vec(), Object::Array(a)))?;
-                }
-            }
-            // AcroForm /Fields and /SigFlags (signatures exist, append only).
-            let catalog = doc.get(root).as_dict().cloned().unwrap_or_default();
-            let (af_ref, mut af) = match catalog.get(b"AcroForm") {
-                Some(Object::Ref(r)) => (Some(*r), doc.get(*r).as_dict().cloned().unwrap_or_default()),
-                Some(Object::Dict(d)) => (None, d.clone()),
-                _ => (None, Dict::new()),
-            };
-            let mut fields = match af.get(b"Fields") {
-                Some(Object::Ref(r)) => doc.get(*r).as_array().cloned().unwrap_or_default(),
-                Some(Object::Array(a)) => a.clone(),
-                _ => Vec::new(),
-            };
-            fields.push(Object::Ref(wr));
-            af.set(b"Fields".to_vec(), Object::Array(fields));
-            af.set(b"SigFlags".to_vec(), Object::Int(3));
-            match af_ref {
-                Some(r) => doc.set(r, Object::Dict(af)),
-                // Inline (or new) AcroForms stay in the catalog.
-                None => doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(af)))?,
-            }
-            (wr, rect, turn)
-        }
-    };
-    if opts.field.is_some() {
-        doc.update_dict(root, |c| {
-            if let Some(Object::Dict(af)) = c.get_mut(b"AcroForm") {
-                af.set(b"SigFlags".to_vec(), Object::Int(3));
-            }
-        })?;
-        if let Some(Object::Ref(r)) = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").cloned()) {
-            doc.update_dict(r, |af| af.set(b"SigFlags".to_vec(), Object::Int(3)))?;
-        }
-    }
-    // The appearance.
-    let ap = appearance(&mut doc, rect, turn, &name, &id.certificate, opts)?;
-    let ap_ref = doc.add(Object::Stream(ap));
-    let mut apd = Dict::new();
-    apd.set(b"N".to_vec(), Object::Ref(ap_ref));
-    doc.update_dict(widget, |w| w.set(b"AP".to_vec(), Object::Dict(apd)))?;
-    // Write with the placeholders, then patch them.
-    let save = SaveOptions { mod_date: Some(opts.date.clone()), object_streams: false, ..SaveOptions::default() };
-    let mut out = pdfcraft_cos::write_incremental(&doc, &save)?;
-    let (br_at, gap) = locate(&out, reserve)?;
-    let (start, end) = gap;
-    let ranges = [0usize, start, end, out.len() - end];
-    let mut br_text = format!("0 {} {} {}", ranges[1], ranges[2], ranges[3]).into_bytes();
-    let width = format!("0 {} {} {}", BR_MARK[0], BR_MARK[1], BR_MARK[2]).len();
-    if br_text.len() > width {
-        return Err(SignError::Pdf("the document is too large to sign".into()));
-    }
-    br_text.resize(width, b' ');
-    out[br_at..br_at + width].copy_from_slice(&br_text);
-    let digest = alg.digest(&[&out[..start], &out[end..]]);
-    let base = crate::cms::sign_detached(&id.key, &id.certificate, &id.chain, alg, &digest)?;
-    let cms = match tsa {
-        None => base,
-        Some(t) => {
-            // The imprint covers the signature value, which attaching an unsigned attribute
-            // does not change (PAdES B-T).
-            let sd = SignedData::parse(&base)?;
-            let q = crate::timestamp::TimestampQuery::new(DigestAlg::Sha256, DigestAlg::Sha256.digest(&[&sd.signer.signature]))?;
-            let resp = t.timestamp(&q.encode()?)?;
-            let token = crate::timestamp::parse_response(&resp, &q)?;
-            crate::cms::attach_timestamp_token(&base, &token.raw)?
-        }
-    };
-    if cms.len() > reserve {
-        return Err(SignError::Pdf("the signature does not fit its placeholder".into()));
-    }
-    let hex: Vec<u8> = cms.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
-    out[start + 1..start + 1 + hex.len()].copy_from_slice(&hex);
-    Ok(out)
-}
-
-/// Append a document timestamp (ISO 32000-2 §12.8.2.2): a standalone signature dictionary
-/// whose `/Contents` is an RFC 3161 token covering the whole current file (`/ETSI.RFC3161`).
-/// The transport is the caller's; a rejected or malformed token produces no file.
-pub fn timestamp_document(doc: &Document, tsa: &dyn crate::timestamp::TimestampAuthority, date: &str) -> Result<Vec<u8>, SignError> {
-    // A pending security change would make the incremental save a full rewrite that applies
-    // or removes protection as it signs (and breaks existing signatures): save it first.
-    if doc.encryption_changed() {
-        return Err(SignError::Pdf("save the document's new security settings before signing it".into()));
-    }
-    if doc.permissions().is_some_and(|p| !p.fill_forms()) {
-        return Err(SignError::Pdf(
-            "the document's security settings don't allow signing; open it with the permissions password to timestamp it".into(),
-        ));
-    }
-    let mut doc = doc.clone();
-    let mut v = Dict::new();
-    v.set(b"Type".to_vec(), Object::name("DocTimeStamp"));
-    v.set(b"Filter".to_vec(), Object::name("Adobe.PPKLite"));
-    v.set(b"SubFilter".to_vec(), Object::name("ETSI.RFC3161"));
-    v.set(b"ByteRange".to_vec(), Object::Array([0].iter().chain(BR_MARK.iter()).map(|n| Object::Int(*n)).collect()));
-    v.set(b"Contents".to_vec(), Object::String(PdfString { bytes: vec![0; TOKEN_RESERVE], hex: true }));
-    v.set(b"M".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
-    let mut app = Dict::new();
-    app.set(b"Name".to_vec(), Object::name("PdfCraft"));
-    let mut build = Dict::new();
-    build.set(b"App".to_vec(), Object::Dict(app));
-    v.set(b"Prop_Build".to_vec(), Object::Dict(build));
-    doc.add(Object::Dict(v));
-    let save = SaveOptions { mod_date: Some(date.to_string()), object_streams: false, ..SaveOptions::default() };
-    let mut out = pdfcraft_cos::write_incremental(&doc, &save)?;
-    let (br_at, gap) = locate(&out, TOKEN_RESERVE)?;
-    let (start, end) = gap;
-    let ranges = [0usize, start, end, out.len() - end];
-    let mut br_text = format!("0 {} {} {}", ranges[1], ranges[2], ranges[3]).into_bytes();
-    let width = format!("0 {} {} {}", BR_MARK[0], BR_MARK[1], BR_MARK[2]).len();
-    if br_text.len() > width {
-        return Err(SignError::Pdf("the document is too large to timestamp".into()));
-    }
-    br_text.resize(width, b' ');
-    out[br_at..br_at + width].copy_from_slice(&br_text);
-    let q = crate::timestamp::TimestampQuery::new(DigestAlg::Sha256, DigestAlg::Sha256.digest(&[&out[..start], &out[end..]]))?;
-    let resp = tsa.timestamp(&q.encode()?)?;
-    let token = crate::timestamp::parse_response(&resp, &q)?;
-    let hex: Vec<u8> = token.raw.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
-    if hex.len() > TOKEN_RESERVE * 2 {
-        return Err(SignError::Pdf("the timestamp token does not fit its placeholder".into()));
-    }
-    out[start + 1..start + 1 + hex.len()].copy_from_slice(&hex);
-    Ok(out)
-}
-
-/// Find the placeholders in the written file: the offset of the ByteRange numbers, and the
-/// `<…>` hex string's span. The ByteRange marker is unique; the Contents placeholder is the one
-/// in the same object (a full save may renumber objects, so they are not found by number).
-fn locate(out: &[u8], reserve: usize) -> Result<(usize, (usize, usize)), SignError> {
-    let mark = format!("0 {} {} {}", BR_MARK[0], BR_MARK[1], BR_MARK[2]);
-    let hits: Vec<usize> = out.windows(mark.len()).enumerate().filter(|(_, w)| *w == mark.as_bytes()).map(|(i, _)| i).collect();
-    let [br] = hits.as_slice() else { return Err(SignError::Pdf("ByteRange placeholder not found".into())) };
-    let start = out[..*br].windows(3).rposition(|w| w == b"obj").ok_or_else(|| SignError::Pdf("signature object not found".into()))?;
-    let end = br + out[*br..].windows(6).position(|w| w == b"endobj").ok_or_else(|| SignError::Pdf("unterminated signature object".into()))?;
-    let region = &out[start..end];
-    let mut zeros = vec![b'<'];
-    zeros.extend(std::iter::repeat_n(b'0', reserve * 2));
-    zeros.push(b'>');
-    let c = region.windows(zeros.len()).position(|w| w == zeros.as_slice()).ok_or_else(|| SignError::Pdf("Contents placeholder not found".into()))?;
-    Ok((*br, (start + c, start + c + zeros.len())))
-}
-
-/// "2026.10.02 14:03:11 +02'00'" from a PDF date.
-pub fn display_date(pdf: &str) -> String {
-    let s = pdf.strip_prefix("D:").unwrap_or(pdf);
-    let g = |r: std::ops::Range<usize>| s.get(r).unwrap_or("00");
-    let tz = match s.get(14..).filter(|z| !z.is_empty()) {
-        Some(z) if z.starts_with('Z') => " Z".to_string(),
-        Some(z) => format!(" {z}"),
-        None => String::new(),
-    };
-    format!("{}.{}.{} {}:{}:{}{tz}", g(0..4), g(4..6), g(6..8), g(8..10), g(10..12), g(12..14))
-}
-
-/// The visible signature: the signer's name large on the left, or the graphic in its place, and
-/// the details on the right (Acrobat's standard layout), in Helvetica, or in the bundled Inter
-/// font when a detail needs characters beyond Western European. A graphic with no details beside
-/// it fills the box. An error, before anything is drawn, when a detail it writes (the signer's
-/// name, the certificate's subject, the reason or the location) has a character neither font can
-/// draw: signing invisibly, or leaving that part out, still works. A graphic doesn't change this:
-/// the name it replaces on the left is still among the details. A label that is drawn
-/// ([`AppearanceLabels`], the caller's words) must be drawable in Helvetica, and is refused otherwise.
-///
-/// `turn` is the widget's `/MK /R` (0, 90, 180 or 270; anything else counts as 0): the layout is
-/// drawn upright in the box as turned by it, and a `/Matrix` maps that box onto `rect`.
-fn appearance(doc: &mut Document, rect: [f64; 4], turn: i64, name: &str, cert: &Certificate, opts: &SignOptions) -> Result<Stream, SignError> {
-    use pdfcraft_fonts::{first_undrawable, helvetica_width, inter_width, literal, undrawable_message, win_ansi, wrap, wrap_with};
-    let turn = if matches!(turn, 90 | 180 | 270) { turn } else { 0 };
-    let (rw, rh) = ((rect[2] - rect[0]).max(0.0), (rect[3] - rect[1]).max(0.0));
-    // The upright layout box: a quarter turn swaps its sides.
-    let (w, h) = if turn % 180 == 0 { (rw, rh) } else { (rh, rw) };
-    let a = &opts.appearance;
-    let dn = cert.subject.display();
-    let mut needs_unicode = false;
-    if w > 1.0 && h > 1.0 {
-        let shown = [
-            (a.name, "the signer's name", Some(name)),
-            (a.distinguished_name, "the certificate's subject", Some(dn.as_str())),
-            (a.reason, "the reason", opts.reason.as_deref()),
-            (a.location, "the location", opts.location.as_deref()),
-        ];
-        for (on, what, text) in shown {
-            if on
-                && let Some(s) = text
-                && first_undrawable(s).is_some()
-            {
-                for c in s.chars() {
-                    if matches!(c, '\n' | '\r') {
-                        continue;
-                    }
-                    if !pdfcraft_fonts::embedding::covers(pdfcraft_fonts::INTER_REGULAR, &c.to_string()) {
-                        return Err(SignError::Unsupported(format!(
-                            "{}; sign without a visible appearance, or leave {what} out of it",
-                            undrawable_message(&format!("{what} of the visible signature"), c)
-                        )));
-                    }
-                }
-                needs_unicode = true;
-            }
-        }
-        // The labels are the caller's words (a translation), checked as the details are: only
-        // those that are drawn, as each is drawn only beside its detail.
-        let has = |v: Option<&str>| v.is_some_and(|v| !v.is_empty());
-        let drawn = [a.name, a.distinguished_name, a.reason && has(opts.reason.as_deref()), a.location && has(opts.location.as_deref()), a.date];
-        let mut labels = opts.appearance_labels.fields().into_iter().zip(drawn).filter(|&(_, on)| a.labels && on);
-        if let Some((field, c)) = labels.find_map(|((field, text), _)| first_undrawable(text).map(|c| (field, c))) {
-            return Err(SignError::Unsupported(format!(
-                "{}; pass that label in Western European characters, or leave the labels out of the visible signature",
-                undrawable_message(&format!("the {field} label of the visible signature"), c)
-            )));
-        }
-    }
-    let mut lines: Vec<String> = Vec::new();
-    let label = |l: &str, v: &str| if a.labels { format!("{l}{v}") } else { v.to_string() };
-    // The labels are the caller's words, so a signature signed in another language reads in it.
-    let wording = &opts.appearance_labels;
-    if a.name {
-        lines.push(if a.labels { wording.signed_by.clone() } else { String::new() });
-        lines.push(name.to_string());
-    }
-    if a.distinguished_name {
-        lines.push(label(&wording.distinguished_name, &dn));
-    }
-    if a.reason
-        && let Some(r) = opts.reason.as_deref().filter(|r| !r.is_empty())
-    {
-        lines.push(label(&wording.reason, r));
-    }
-    if a.location
-        && let Some(l) = opts.location.as_deref().filter(|l| !l.is_empty())
-    {
-        lines.push(label(&wording.location, l));
-    }
-    if a.date {
-        lines.push(label(&wording.date, &display_date(&opts.date)));
-    }
-    lines.retain(|l| !l.is_empty());
-    let mut out = Vec::new();
-    let mut image = None;
-    let mut fonts = Dict::new();
-    let (font_tag, metrics) = if needs_unicode {
-        let tag = pdfcraft_fonts::embedding::embed(doc, &mut fonts, pdfcraft_fonts::INTER_REGULAR, "Inter")
-            .map_err(|e| SignError::Pdf(format!("failed to embed signature font: {e}")))?;
-        let font_dict = fonts
-            .get(tag.as_bytes())
-            .map(|o| doc.resolve(o))
-            .and_then(|o| o.as_dict().cloned())
-            .ok_or_else(|| SignError::Pdf("embedded signature font dictionary not found".into()))?;
-        let m = pdfcraft_fonts::pdf::Metrics::from_dict(doc, &font_dict);
-        (tag, Some(m))
-    } else {
-        let mut font = Dict::new();
-        font.set(b"Type".to_vec(), Object::name("Font"));
-        font.set(b"Subtype".to_vec(), Object::name("Type1"));
-        font.set(b"BaseFont".to_vec(), Object::name("Helvetica"));
-        font.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-        fonts.set(b"Helv".to_vec(), Object::Dict(font));
-        ("Helv".to_string(), None)
-    };
-    let measure = |s: &str, sz: f64| -> f64 { if needs_unicode { inter_width(s, sz) } else { helvetica_width(s, sz) } };
-    let wrap_text =
-        |s: &str, sz: f64, max_w: f64| -> Vec<String> { if needs_unicode { wrap_with(s, sz, max_w, inter_width) } else { wrap(s, sz, max_w) } };
-    let encode_line =
-        |l: &str| -> Vec<u8> { if let Some(m) = &metrics { literal(&m.encode(l).unwrap_or_else(|| win_ansi(l))) } else { literal(&win_ansi(l)) } };
-    if w > 1.0 && h > 1.0 {
-        let pad = (h * 0.06).clamp(1.0, 6.0);
-        let (left_w, right_x) = match (&opts.graphic, a.name) {
-            (Some(_), _) if lines.is_empty() => (w, pad),
-            (Some(_), _) | (None, true) => (w * 0.5, w * 0.5 + pad),
-            (None, false) => (0.0, pad),
-        };
-        let right_w = (w - right_x - pad).max(1.0);
-        if let Some(g) = &opts.graphic {
-            let (ops, im) = g.draw(doc, [pad, pad, (left_w - 2.0 * pad).max(0.0), (h - 2.0 * pad).max(0.0)])?;
-            out.extend(ops.bytes());
-            image = im;
-        }
-        out.extend_from_slice(b"BT\n0 g\n");
-        if a.name && opts.graphic.is_none() {
-            // The name fills the left half.
-            let mut size = (h * 0.4).min(36.0);
-            let fit = (left_w - 2.0 * pad).max(1.0);
-            let longest = measure(name, 1.0).max(0.01);
-            size = size.min(fit / longest).max(4.0);
-            let words = wrap_text(name, size, fit);
-            let total = words.len() as f64 * size * 1.1;
-            let mut y = (h + total) / 2.0 - size * 0.85;
-            for l in &words {
-                out.extend(format!("/{font_tag} {} Tf 1 0 0 1 {} {} Tm ", fmt(size), fmt(pad), fmt(y)).bytes());
-                out.extend(encode_line(l));
-                out.extend_from_slice(b" Tj\n");
-                y -= size * 1.1;
-            }
-        }
-        // The details, shrunk to fit the right side.
-        let mut size = (h / (lines.len().max(1) as f64 * 1.15)).min(12.0);
-        let wrapped = loop {
-            let all: Vec<String> = lines.iter().flat_map(|l| wrap_text(l, size, right_w)).collect();
-            if all.len() as f64 * size * 1.15 <= h - 2.0 * pad || size <= 3.0 {
-                break all;
-            }
-            size *= 0.9;
-        };
-        let mut y = h - pad - size * 0.9;
-        for l in &wrapped {
-            out.extend(format!("/{font_tag} {} Tf 1 0 0 1 {} {} Tm ", fmt(size), fmt(right_x), fmt(y)).bytes());
-            out.extend(encode_line(l));
-            out.extend_from_slice(b" Tj\n");
-            y -= size * 1.15;
-        }
-        out.extend_from_slice(b"ET\n");
-    }
-    let mut d = Dict::new();
-    d.set(b"Type".to_vec(), Object::name("XObject"));
-    d.set(b"Subtype".to_vec(), Object::name("Form"));
-    d.set(b"BBox".to_vec(), Object::Array([0.0, 0.0, w, h].iter().map(|x| Object::Real(*x)).collect()));
-    if turn != 0 {
-        // Viewers fit the box, transformed by `/Matrix`, to the widget's `/Rect` (ISO 32000-2
-        // §12.5.5); this one lands on `rect` exactly, turned as `/MK /R` says.
-        let mut m = pdfcraft_model::view_matrix_for(turn, [rect[0], rect[1], rect[0] + rw, rect[1] + rh]);
-        if !m.iter().all(|x| x.is_finite()) {
-            // A caller's non-finite corner: the turn alone, which viewers fit to `/Rect` the same.
-            m = pdfcraft_model::view_matrix_for(turn, [0.0; 4]);
-        }
-        d.set(b"Matrix".to_vec(), Object::Array(m.iter().map(|x| Object::Real(*x)).collect()));
-    }
-    let mut res = Dict::new();
-    res.set(b"Font".to_vec(), Object::Dict(fonts));
-    if let Some(im) = image {
-        let mut xobjects = Dict::new();
-        xobjects.set(b"Im1".to_vec(), Object::Ref(im));
-        res.set(b"XObject".to_vec(), Object::Dict(xobjects));
-    }
-    d.set(b"Resources".to_vec(), Object::Dict(res));
-    Ok(Stream::flate(d, &out))
-}
-
-pub(crate) fn fmt(v: f64) -> String {
-    let s = format!("{v:.2}");
-    s.trim_end_matches('0').trim_end_matches('.').to_string()
-}
diff --git a/crates/sign/src/pdf/changes.rs b/crates/sign/src/pdf/changes.rs
new file mode 100644
index 0000000000..2c66418a6c
--- /dev/null
+++ b/crates/sign/src/pdf/changes.rs
@@ -0,0 +1,579 @@
+use super::types::{Modification, kind};
+use super::*;
+
+/// What later revisions changed, classified as Acrobat reports it, under DocMDP `p` (or none:
+/// an approval signature permits form fill, comments and further signatures).
+pub(super) fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Modification {
+    let Some(old) = old else {
+        return Modification::Disallowed(vec![kind::UNREADABLE]);
+    };
+    let old_content: HashSet<ObjRef> = pdfcraft_annot::page_refs(&old)
+        .unwrap_or_default()
+        .into_iter()
+        .flat_map(|pg| {
+            let c = old.get(pg).as_dict().and_then(|d| d.get(b"Contents").cloned());
+            match c {
+                Some(Object::Ref(r)) => match &*old.get(r) {
+                    Object::Array(a) => a.iter().filter_map(Object::as_ref).chain([r]).collect::<Vec<_>>(),
+                    _ => vec![r],
+                },
+                Some(Object::Array(a)) => a.iter().filter_map(Object::as_ref).collect(),
+                _ => Vec::new(),
+            }
+        })
+        .collect();
+    // The signed revision's document-level XMP stream.
+    let old_metadata = old.root().and_then(|root| old.get(root).as_dict().and_then(|c| c.get(b"Metadata").and_then(Object::as_ref)));
+    // The signed revision's XFA data packets: filling the form rewrites them.
+    let old_xfa_data = xfa_data_packets(&old);
+    // What each object was in the signed revision: its pages, and its trailer /Info. A changed
+    // object is judged by the role it held when signed, never by the labels or keys its new,
+    // attacker-written version carries (relabelling a signed page /Type /Sig, or dropping its
+    // /Type and adding /ModDate, must not reclassify it away from page content).
+    let signed_pages: HashSet<ObjRef> = pdfcraft_annot::page_refs(&old).unwrap_or_default().into_iter().collect();
+    // The signed pages' /Annots arrays that are objects of their own. Adding an annotation updates
+    // such an array in place (the page dictionary does not change), so it is judged like a
+    // page's inline /Annots: by the annotations it gained.
+    let signed_annots: HashSet<ObjRef> =
+        signed_pages.iter().filter_map(|pg| old.get(*pg).as_dict().and_then(|d| d.get(b"Annots").and_then(Object::as_ref))).collect();
+    // What each signed page draws from, by the role it held when signed (#1787).
+    let signed_resources = signed_page_resources(&old, &signed_pages);
+    let old_info = old.trailer().get(b"Info").and_then(Object::as_ref);
+    let (mut allowed, mut disallowed): (Vec<&'static str>, Vec<&'static str>) = (Vec::new(), Vec::new());
+    let dss = dss_parts(doc, &old);
+    // Stored at the same place in both (and not edited since): the same bytes, unchanged.
+    let same_place = |num: u32| -> bool {
+        use pdfcraft_cos::XrefEntry;
+        if doc.is_edited(num) {
+            return false;
+        }
+        match (doc.xref_entry(num), old.xref_entry(num)) {
+            (Some(a @ XrefEntry::InFile { .. }), Some(b)) => a == b,
+            (Some(a @ XrefEntry::InStream { stream, .. }), Some(b)) => {
+                a == b && !doc.is_edited(stream) && doc.xref_entry(stream) == old.xref_entry(stream)
+            }
+            _ => false,
+        }
+    };
+    // A later cross-reference section may carry an entry this reader sets aside (an in-use entry
+    // at offset 0, a second entry for one object, a reserved entry type). The renderer may follow
+    // it and draw another object than the one compared below, so the page could show new content
+    // while every comparison here finds the signed object untouched. No writer has a reason to
+    // add such an entry after signing: it is never a permitted change.
+    for (_, num) in doc.xref_oddities().iter().filter(|o| !old.xref_oddities().contains(o)) {
+        let r = ObjRef { num: *num, generation: doc.generation(*num) };
+        let what = if old_content.contains(&r) || signed_pages.contains(&r) { kind::PAGE_CONTENT } else { kind::OTHER };
+        if !disallowed.contains(&what) {
+            disallowed.push(what);
+        }
+    }
+    // The trailer chooses the catalog. A later revision that points it at another catalog (one
+    // already in the signed file, so no object changes) shows another document.
+    if doc.root() != old.root() {
+        disallowed.push(kind::STRUCTURE);
+    }
+    for num in doc.object_numbers() {
+        if same_place(num) {
+            continue;
+        }
+        let r = ObjRef { num, generation: doc.generation(num) };
+        let new = doc.get(r);
+        let before = old.try_get(num).ok().filter(|o| !matches!(**o, Object::Null));
+        if before.as_deref() == Some(&*new) {
+            // The same content at a new place. That is true for the renderer as well only when
+            // the entry locates the object itself: where this reader had to search for the
+            // object, another reader may arrive at a different one.
+            if !doc.is_edited(num) && !doc.xref_entry_is_exact(num) && !disallowed.contains(&kind::OTHER) {
+                disallowed.push(kind::OTHER);
+            }
+            continue;
+        }
+        // A resource of a signed page is page content whatever keys its new version carries
+        // (#1787): a /FT or /Subtype /Widget written by whoever rewrote a font, an XObject or a
+        // graphics state does not make that a form fill. A container (the resources dictionary,
+        // a category dictionary) that kept every entry it had and only gained names changes
+        // nothing the signed content draws, and is judged as before.
+        let kept_entries = |d: &Dict| before.as_deref().and_then(Object::as_dict).is_some_and(|b| b.iter().all(|(k, v)| d.get(k) == Some(v)));
+        let resource_kind = match (signed_resources.get(&r), &*new) {
+            (Some(false), _) => Some(kind::PAGE_CONTENT),
+            (Some(true), Object::Dict(d)) if kept_entries(d) => None,
+            (Some(true), _) => Some(kind::PAGE_CONTENT),
+            (None, _) => None,
+        };
+        let what = match (resource_kind, &*new) {
+            (Some(k), _) => k,
+            // The Document Security Store's own arrays and dictionaries, when they only grew.
+            (_, _) if dss.contains(&num) => kind::SECURITY_STORE,
+            // A signed page's indirect /Annots array, still an array: what it lost, then what it
+            // gained. Dropping a signed annotation is never hidden behind an added signature.
+            (_, Object::Array(now)) if signed_annots.contains(&r) && before.as_deref().is_some_and(|b| b.as_array().is_some()) => {
+                let was: HashSet<ObjRef> =
+                    before.as_deref().and_then(Object::as_array).map(|a| a.iter().filter_map(Object::as_ref).collect()).unwrap_or_default();
+                let kept: HashSet<ObjRef> = now.iter().filter_map(Object::as_ref).collect();
+                let removed: Vec<ObjRef> = was.iter().filter(|r| !kept.contains(r)).copied().collect();
+                if removed.is_empty() {
+                    let added: Vec<ObjRef> = now.iter().filter_map(Object::as_ref).filter(|r| !was.contains(r)).collect();
+                    added_annots(doc, &added)
+                } else if removed.iter().any(|r| old.get(*r).as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Widget"))) {
+                    // A form field or signature widget taken off the page: no permission covers it.
+                    kind::OTHER
+                } else {
+                    // Deleting comments is a comment change (permitted at P 3 only).
+                    kind::COMMENTS
+                }
+            }
+            (_, Object::Dict(d)) => {
+                let was = before.as_deref().and_then(Object::as_dict);
+                if signed_pages.contains(&r) {
+                    // A signed page is always judged by what the page shows, whatever it is now
+                    // relabelled: a rewritten /Contents or /Resources is a page content change.
+                    page_change_kind(doc, &old, d, was)
+                } else if was.is_some() && Some(r) == old_info {
+                    // Only the signed revision's own /Info dictionary is a metadata change.
+                    kind::METADATA
+                } else {
+                    change_kind(doc, &old, d, was)
+                }
+            }
+            (_, Object::Stream(s)) => {
+                // File plumbing is what the stream was when signed: the /Type it has now is
+                // written by whoever changed it, and the renderer ignores /Type (a page's Form
+                // XObject relabelled /ObjStm still draws its new content).
+                let was_plumbing = matches!(before.as_deref(), Some(Object::Stream(b)) if matches!(b.dict.name(b"Type"), Some(b"XRef" | b"ObjStm")));
+                if old_content.contains(&r) {
+                    kind::PAGE_CONTENT
+                } else if before.is_none() || was_plumbing {
+                    continue;
+                } else if s.dict.name(b"Type") == Some(b"Metadata") && Some(r) == old_metadata {
+                    // Only the signed catalog's XMP stream. A /Type /Metadata label on anything
+                    // else, even one it already had when signed (a page's Form XObject: the
+                    // renderer ignores /Type), does not make rewriting it a metadata change.
+                    kind::METADATA
+                } else if old_xfa_data.contains(&r) {
+                    // The form's XFA data (`datasets`) or state (`form`) as the signed revision
+                    // named it: filling an XFA form rewrites these, as a Reader Extensions (UR3)
+                    // save of a certified form does (#2759). The role comes from the signed
+                    // revision, so a later one can't name page content as XFA data.
+                    kind::FORM_FILL
+                } else {
+                    kind::OTHER
+                }
+            }
+            _ if before.is_none() => continue,
+            _ => kind::OTHER,
+        };
+        let ok = match (what, p) {
+            (kind::SIGNATURE | kind::SECURITY_STORE, _) => true,
+            (kind::FORM_FILL, Some(2 | 3) | None) => true,
+            (kind::COMMENTS, Some(3) | None) => true,
+            // Every save updates /Info (ModDate), signing included.
+            (kind::METADATA, _) => true,
+            _ => false,
+        };
+        let list = if ok { &mut allowed } else { &mut disallowed };
+        if !list.contains(&what) {
+            list.push(what);
+        }
+    }
+    // An object the signed revision had and this one frees is a change too, and the loop above
+    // only sees objects that still exist. File plumbing (cross-reference and object streams) is
+    // rewritten by every save and is not a change.
+    let current: HashSet<u32> = doc.object_numbers().into_iter().collect();
+    for num in old.object_numbers().into_iter().filter(|n| !current.contains(n)) {
+        let r = ObjRef { num, generation: old.generation(num) };
+        let was = old.get(r);
+        let signed_role = old_content.contains(&r) || signed_pages.contains(&r) || signed_resources.contains_key(&r);
+        // A signed page's content or resource is judged by that role, whatever /Type its stream carried.
+        if !signed_role && matches!(&*was, Object::Stream(s) if matches!(s.dict.name(b"Type"), Some(b"XRef" | b"ObjStm"))) {
+            continue;
+        }
+        let what = if signed_role { kind::PAGE_CONTENT } else { kind::OTHER };
+        if !disallowed.contains(&what) {
+            disallowed.push(what);
+        }
+    }
+    if disallowed.is_empty() { Modification::Allowed(allowed) } else { Modification::Disallowed(disallowed) }
+}
+
+/// The streams of `doc`'s XFA form that hold its data and state: the `datasets` and `form`
+/// packets of the AcroForm's `/XFA` array (name, stream, name, stream, …). A form given as one
+/// XFA stream holds its template too, and is not listed.
+fn xfa_data_packets(doc: &Document) -> HashSet<ObjRef> {
+    let Some(form) = acroform(doc) else { return HashSet::new() };
+    let Some(xfa) = form.get(b"XFA").map(|x| doc.resolve(x)) else { return HashSet::new() };
+    let Object::Array(xfa) = &*xfa else { return HashSet::new() };
+    xfa.as_chunks::<2>()
+        .0
+        .iter()
+        .filter(|[name, _]| doc.resolve(name).as_string().is_some_and(|s| matches!(s.to_text().as_str(), "datasets" | "form")))
+        .filter_map(|[_, packet]| packet.as_ref())
+        .collect()
+}
+
+/// Where an object sits in the Document Security Store (ISO 32000-2 §12.8.4.3).
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum DssRole {
+    /// The `/DSS` dictionary.
+    Dss,
+    /// A `/Certs`, `/CRLs`, `/OCSPs` (or a VRI entry's `/Cert`, `/CRL`, `/OCSP`) array.
+    DataArray,
+    /// A certificate, CRL, OCSP response or timestamp token stream.
+    Data,
+    /// The `/VRI` dictionary.
+    VriMap,
+    /// One entry of `/VRI`.
+    VriEntry,
+}
+
+/// The indirect objects the catalog's `/DSS` reaches by the keys the standard defines, and the
+/// role each plays there. Any other key is not followed: `/DSS << /X 5 0 R >>` does not make
+/// object 5 part of the store.
+fn dss_walk(doc: &Document) -> Vec<(ObjRef, DssRole)> {
+    const LIMIT: usize = 100_000;
+    let mut out = Vec::new();
+    let Some(dss) = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|c| c.get(b"DSS").cloned())) else { return out };
+    // The roles nest at most four deep (DSS, VRI, entry, array, data), so no seen-set is needed.
+    let mut stack = vec![(dss, DssRole::Dss)];
+    let mut steps = 0usize;
+    while let Some((o, role)) = stack.pop() {
+        steps += 1;
+        if steps > LIMIT {
+            break;
+        }
+        if let Object::Ref(r) = &o {
+            out.push((*r, role));
+        }
+        match (role, &*doc.resolve(&o)) {
+            (DssRole::Dss, Object::Dict(d)) => {
+                for (k, v) in d.iter() {
+                    match k.as_slice() {
+                        b"Certs" | b"CRLs" | b"OCSPs" => stack.push((v.clone(), DssRole::DataArray)),
+                        b"VRI" => stack.push((v.clone(), DssRole::VriMap)),
+                        _ => {}
+                    }
+                }
+            }
+            (DssRole::DataArray, Object::Array(a)) => stack.extend(a.iter().map(|v| (v.clone(), DssRole::Data))),
+            (DssRole::VriMap, Object::Dict(d)) => stack.extend(d.iter().map(|(_, v)| (v.clone(), DssRole::VriEntry))),
+            (DssRole::VriEntry, Object::Dict(d)) => {
+                for (k, v) in d.iter() {
+                    match k.as_slice() {
+                        b"Cert" | b"CRL" | b"OCSP" => stack.push((v.clone(), DssRole::DataArray)),
+                        b"TS" => stack.push((v.clone(), DssRole::Data)),
+                        _ => {}
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    out
+}
+
+/// Whether `now` only adds to `before`: an array keeps every element, a dictionary keeps every
+/// entry (an entry that is an array or dictionary may itself have grown).
+pub(crate) fn only_grew(doc: &Document, old: &Document, before: &Object, now: &Object, depth: u8) -> bool {
+    /// Arrays of anything but references are compared element by element (quadratic), so only
+    /// up to this size; a store's `/Certs`/`/CRLs`/`/OCSPs` are references, compared as sets.
+    const MAX_COMPARED: usize = 10_000;
+    match (before, now) {
+        (Object::Array(b), Object::Array(n)) => {
+            if b.len() > n.len() {
+                return false;
+            }
+            let refs = |a: &[Object]| a.iter().map(Object::as_ref).collect::<Option<HashSet<ObjRef>>>();
+            match (refs(b), refs(n)) {
+                (Some(b), Some(n)) => b.is_subset(&n),
+                _ => b.len() <= MAX_COMPARED && n.len() <= MAX_COMPARED && b.iter().all(|x| n.contains(x)),
+            }
+        }
+        (Object::Dict(b), Object::Dict(n)) => b.iter().all(|(k, v)| match n.get(k) {
+            Some(nv) => nv == v || (depth < 4 && only_grew(doc, old, &old.resolve(v), &doc.resolve(nv), depth + 1)),
+            None => false,
+        }),
+        _ => before == now,
+    }
+}
+
+/// The objects of the Document Security Store that count as validation data added after
+/// signing: its dictionary, `/Certs`/`/CRLs`/`/OCSPs` arrays, `/VRI` and its entries, when
+/// - they are reached by the standard's keys and have the shape of their role, and
+/// - they are new, or were already part of the signed store and have only grown.
+///
+/// An existing object is never made "document security store" by pointing the store at it: the
+/// page's `/Contents` array, or a dictionary labelled `/Type /DSS`, keep being judged as what they
+/// are. The data streams need no entry here: new objects are not changes, and rewriting an
+/// existing one is judged on its own.
+fn dss_parts(doc: &Document, old: &Document) -> HashSet<u32> {
+    let signed: HashSet<u32> = dss_walk(old).into_iter().map(|(r, _)| r.num).collect();
+    let is_stream = |o: &Object| matches!(&*doc.resolve(o), Object::Stream(_));
+    let mut parts = HashSet::new();
+    for (r, role) in dss_walk(doc) {
+        let now = doc.get(r);
+        let shaped = match (role, &*now) {
+            (DssRole::Dss, Object::Dict(d)) => d.iter().all(|(k, _)| matches!(k.as_slice(), b"Type" | b"Certs" | b"CRLs" | b"OCSPs" | b"VRI")),
+            (DssRole::DataArray, Object::Array(a)) => a.iter().all(|e| matches!(e, Object::Ref(_)) && is_stream(e)),
+            (DssRole::VriMap, Object::Dict(d)) => d.iter().all(|(_, v)| matches!(&*doc.resolve(v), Object::Dict(_))),
+            (DssRole::VriEntry, Object::Dict(d)) => {
+                d.iter().all(|(k, _)| matches!(k.as_slice(), b"Type" | b"Cert" | b"CRL" | b"OCSP" | b"TU" | b"TS"))
+            }
+            _ => false,
+        };
+        let before = old.try_get(r.num).ok().filter(|o| !matches!(**o, Object::Null));
+        let history = match before {
+            None => true,
+            Some(b) => signed.contains(&r.num) && only_grew(doc, old, &b, &now, 0),
+        };
+        if shaped && history {
+            parts.insert(r.num);
+        }
+    }
+    parts
+}
+
+/// What adding `added` annotations amounts to: signing (signature widgets only), form fill
+/// (other widgets) or comments.
+fn added_annots(doc: &Document, added: &[ObjRef]) -> &'static str {
+    let kinds: Vec<(bool, bool)> = added
+        .iter()
+        .map(|r| {
+            let o = doc.get(*r);
+            let d = o.as_dict();
+            (d.is_some_and(|d| d.name(b"Subtype") == Some(b"Widget")), d.is_some_and(|d| d.name(b"FT") == Some(b"Sig")))
+        })
+        .collect();
+    if !kinds.is_empty() && kinds.iter().all(|(w, s)| *w && *s) {
+        kind::SIGNATURE
+    } else if !kinds.is_empty() && kinds.iter().all(|(w, _)| *w) {
+        kind::FORM_FILL
+    } else {
+        kind::COMMENTS
+    }
+}
+
+fn refs(doc: &Document, o: Option<&Object>) -> Vec<ObjRef> {
+    o.map(|o| doc.resolve(o)).and_then(|a| a.as_array().map(|a| a.iter().filter_map(Object::as_ref).collect())).unwrap_or_default()
+}
+
+/// The interactive form dictionary of a document, resolved.
+fn acroform(doc: &Document) -> Option<Dict> {
+    let c = doc.get(doc.root()?).as_dict()?.get(b"AcroForm").cloned()?;
+    doc.resolve(&c).as_dict().cloned()
+}
+
+/// An AcroForm change that only adds signature fields (and sets `/SigFlags`) is signing.
+/// Without `before`, the signed revision's AcroForm (wherever it was) is the reference.
+fn acroform_kind(doc: &Document, old: &Document, now: &Dict, before: Option<&Dict>) -> &'static str {
+    let fallback = acroform(old).unwrap_or_default();
+    let before = before.unwrap_or(&fallback);
+    let strip = |d: &Dict| -> Vec<(Vec<u8>, Object)> {
+        let mut v: Vec<(Vec<u8>, Object)> =
+            d.iter().filter(|(k, _)| !matches!(k.as_slice(), b"Fields" | b"SigFlags")).map(|(k, o)| (k.to_vec(), o.clone())).collect();
+        v.sort_by(|a, b| a.0.cmp(&b.0));
+        v
+    };
+    if strip(now) != strip(before) {
+        return kind::FORM_FILL;
+    }
+    let old_fields = refs(old, before.get(b"Fields"));
+    let added: Vec<ObjRef> = refs(doc, now.get(b"Fields")).into_iter().filter(|r| !old_fields.contains(r)).collect();
+    if added.is_empty() || added_annots(doc, &added) == kind::SIGNATURE { kind::SIGNATURE } else { kind::FORM_FILL }
+}
+
+/// Dictionary entries in a stable order, without `keys`.
+fn without(x: &Dict, keys: &[&[u8]]) -> Vec<(Vec<u8>, Object)> {
+    let mut v: Vec<(Vec<u8>, Object)> = x.iter().filter(|(k, _)| !keys.contains(&k.as_slice())).map(|(k, o)| (k.to_vec(), o.clone())).collect();
+    v.sort_by(|a, b| a.0.cmp(&b.0));
+    v
+}
+
+/// Whether a dictionary was a signature object: a signature or timestamp value, a signature
+/// reference or its transform parameters, or a signature form field. Used to decide from the
+/// signed revision, so a later relabel of some other object cannot pose as a signature change.
+fn is_signature_dict(d: &Dict) -> bool {
+    matches!(d.name(b"Type"), Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams")) || d.name(b"FT") == Some(b"Sig")
+}
+
+/// The objects the signed pages draw from, by reference, with the role each held when signed
+/// (#1787): `true` for a container (a page's resources dictionary, or one of its category
+/// dictionaries), where a name added later can't be reached by unchanged content; `false` for
+/// everything reached from a container's entries (fonts and their files, XObjects and their own
+/// resources, graphics states and soft masks, colour spaces, patterns, shadings, optional-content
+/// properties), where any change changes what the page shows. Resources are the page's own or
+/// inherited. Bounded by depth and by the number of objects visited; past the bound the rest is
+/// judged as before.
+fn signed_page_resources(old: &Document, pages: &HashSet<ObjRef>) -> HashMap<ObjRef, bool> {
+    const CATEGORIES: [&[u8]; 7] = [b"Font", b"XObject", b"ExtGState", b"ColorSpace", b"Pattern", b"Shading", b"Properties"];
+    const MAX_VISITED: usize = 50_000;
+    const MAX_DEPTH: u8 = 32;
+    const MAX_INHERITANCE: usize = 64;
+
+    /// Everything reachable from `o` is content the page draws (a leaf role, overriding a
+    /// container one reached by another path). A signed page or the catalog reached this way
+    /// (a `/P` or `/Parent` back-reference) keeps the role of its own: the walk stops there.
+    fn reach(old: &Document, o: &Object, depth: u8, stop: &HashSet<ObjRef>, roles: &mut HashMap<ObjRef, bool>) {
+        if roles.len() >= MAX_VISITED || depth > MAX_DEPTH {
+            return;
+        }
+        let resolved;
+        let o = match o {
+            Object::Ref(r) => {
+                if stop.contains(r) || roles.insert(*r, false).is_some() {
+                    return;
+                }
+                resolved = old.get(*r);
+                &*resolved
+            }
+            other => other,
+        };
+        match o {
+            Object::Dict(d) => d.iter().for_each(|(_, v)| reach(old, v, depth + 1, stop, roles)),
+            Object::Stream(s) => s.dict.iter().for_each(|(_, v)| reach(old, v, depth + 1, stop, roles)),
+            Object::Array(a) => a.iter().for_each(|v| reach(old, v, depth + 1, stop, roles)),
+            _ => {}
+        }
+    }
+
+    /// A page's `/Resources`, its own or the nearest ancestor's.
+    fn resources(old: &Document, page: ObjRef) -> Option<Object> {
+        let mut seen = HashSet::new();
+        let mut cur = page;
+        while seen.insert(cur) && seen.len() <= MAX_INHERITANCE {
+            let d = old.get(cur);
+            let d = d.as_dict()?;
+            if let Some(r) = d.get(b"Resources") {
+                return Some(r.clone());
+            }
+            cur = d.get(b"Parent").and_then(Object::as_ref)?;
+        }
+        None
+    }
+
+    let mut roles = HashMap::new();
+    let mut stop = pages.clone();
+    stop.extend(old.root());
+    for page in pages {
+        let Some(res) = resources(old, *page) else { continue };
+        let container = |o: &Object, roles: &mut HashMap<ObjRef, bool>| -> Arc<Object> {
+            match o {
+                Object::Ref(r) => {
+                    roles.entry(*r).or_insert(true);
+                    old.get(*r)
+                }
+                other => Arc::new(other.clone()),
+            }
+        };
+        let res = container(&res, &mut roles);
+        let Some(d) = res.as_dict() else { continue };
+        for category in CATEGORIES {
+            let Some(v) = d.get(category) else { continue };
+            let category = container(v, &mut roles);
+            if let Some(entries) = category.as_dict() {
+                entries.iter().for_each(|(_, entry)| reach(old, entry, 0, &stop, &mut roles));
+            }
+        }
+    }
+    roles
+}
+
+/// A changed object that was a page in the signed revision, judged by what the page shows rather
+/// than by any `/Type` its new version carries. Only added annotations are permitted; any other
+/// difference (content, resources, a relabelled or dropped `/Type`) is a page content change.
+fn page_change_kind(doc: &Document, old: &Document, d: &Dict, before: Option<&Dict>) -> &'static str {
+    match before {
+        Some(b) if without(d, &[b"Annots"]) != without(b, &[b"Annots"]) => kind::PAGE_CONTENT,
+        Some(b) => {
+            let was = refs(old, b.get(b"Annots"));
+            let added: Vec<ObjRef> = refs(doc, d.get(b"Annots")).into_iter().filter(|r| !was.contains(r)).collect();
+            added_annots(doc, &added)
+        }
+        None => kind::PAGE_CONTENT,
+    }
+}
+
+/// Whether the catalog `d` keeps every developer extension the signed catalog `b` declared, each
+/// with the same value: it may only declare more.
+fn extensions_kept(doc: &Document, old: &Document, d: &Dict, b: &Dict) -> bool {
+    let now = d.get(b"Extensions").map(|e| doc.resolve(e)).and_then(|e| e.as_dict().cloned());
+    let was = b.get(b"Extensions").map(|e| old.resolve(e)).and_then(|e| e.as_dict().cloned());
+    match (was, now) {
+        (None, _) => true,
+        (Some(was), Some(now)) => was.iter().all(|(k, v)| now.get(k) == Some(v)),
+        (Some(_), None) => false,
+    }
+}
+
+fn change_kind(doc: &Document, old: &Document, d: &Dict, before: Option<&Dict>) -> &'static str {
+    let ty = d.name(b"Type");
+    // A later revision cannot make an existing object a signature by relabelling it: a signature
+    // change is only a brand-new object, or one that was already a signature object when signed.
+    let signature_ok = before.is_none_or(is_signature_dict);
+    // A signature widget that already held a signature is what the signature shows: moving it or
+    // swapping its appearance can hide the signed page under it. Judged by the signed revision,
+    // so relabelling the widget now does not change that.
+    if before.is_some_and(|b| {
+        b.name(b"Subtype") == Some(b"Widget") && b.name(b"FT") == Some(b"Sig") && b.get(b"V").is_some_and(|v| old.resolve(v).as_dict().is_some())
+    }) && before != Some(d)
+    {
+        return kind::PAGE_CONTENT;
+    }
+    match ty {
+        // Only a new signature value or policy: rewriting a signed one is not a signature (#1788).
+        Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams") if before.is_none() => return kind::SIGNATURE,
+        Some(b"Catalog") => {
+            let keys: &[&[u8]] = &[b"AcroForm", b"DSS", b"Perms", b"Metadata", b"NeedsRendering", b"Extensions"];
+            return match before {
+                Some(b) if without(d, keys) != without(b, keys) => kind::STRUCTURE,
+                // Developer extensions (ISO 32000-2 §7.12) only declare what the file uses. A
+                // writer adding a /DSS also declares the ESIC extension it belongs to, so a
+                // declaration may be added, but none that was signed may change or go.
+                Some(b) if !extensions_kept(doc, old, d, b) => kind::STRUCTURE,
+                Some(b) => {
+                    if d.get(b"AcroForm") != b.get(b"AcroForm") {
+                        // Compare the forms themselves, inline or not.
+                        let now = acroform(doc).unwrap_or_default();
+                        acroform_kind(doc, old, &now, None)
+                    } else if b.get(b"Perms") != d.get(b"Perms") {
+                        kind::SIGNATURE
+                    } else {
+                        kind::METADATA
+                    }
+                }
+                None => kind::FORM_FILL,
+            };
+        }
+        Some(b"Page") => {
+            return match before {
+                Some(b) if without(d, &[b"Annots"]) != without(b, &[b"Annots"]) => kind::PAGE_CONTENT,
+                Some(b) => {
+                    let was = refs(old, b.get(b"Annots"));
+                    let added: Vec<ObjRef> = refs(doc, d.get(b"Annots")).into_iter().filter(|r| !was.contains(r)).collect();
+                    added_annots(doc, &added)
+                }
+                None => kind::COMMENTS,
+            };
+        }
+        Some(b"Pages") => return if before.is_some() { kind::PAGES } else { kind::STRUCTURE },
+        _ => {}
+    }
+    match d.name(b"Subtype") {
+        Some(b"Widget") => return if d.name(b"FT") == Some(b"Sig") && signature_ok { kind::SIGNATURE } else { kind::FORM_FILL },
+        Some(b"Link") => return kind::LINKS,
+        Some(_) if ty == Some(b"Annot") || d.contains(b"Rect") => return kind::COMMENTS,
+        _ => {}
+    }
+    if d.name(b"FT") == Some(b"Sig") && signature_ok {
+        return kind::SIGNATURE;
+    }
+    if d.contains(b"Fields") {
+        return acroform_kind(doc, old, d, before);
+    }
+    if d.contains(b"FT") || (d.contains(b"T") && d.contains(b"Kids")) || d.contains(b"DR") {
+        return kind::FORM_FILL;
+    }
+    if before.is_none() {
+        // New objects referenced by changed ones (fonts, appearance resources).
+        return kind::FORM_FILL;
+    }
+    kind::OTHER
+}
diff --git a/crates/sign/src/pdf/listing.rs b/crates/sign/src/pdf/listing.rs
new file mode 100644
index 0000000000..88379b1836
--- /dev/null
+++ b/crates/sign/src/pdf/listing.rs
@@ -0,0 +1,375 @@
+use super::types::{Modification, Status, TrustStore};
+use super::validate::{is_doc_timestamp, validate_doc_timestamp, validate_into};
+use super::*;
+
+/// Digests of signed byte ranges (and parsed signed revisions), kept across revalidations of
+/// one document: incremental edits only append to the file, so the signed bytes and their
+/// digest don't change, and rehashing a large file on every edit was the expensive part of
+/// validation (120 MB: 84 ms per comment edit before, 6 ms after). Keyed by the ranges, the
+/// algorithm and a sampled fingerprint of the covered bytes; use one cache per document, whose
+/// bytes only ever grow.
+#[derive(Debug, Default)]
+pub struct DigestCache {
+    map: std::sync::Mutex<HashMap<RangeKey, Vec<u8>>>,
+    /// Signed revisions opened for change classification, by length and fingerprint.
+    revisions: std::sync::Mutex<HashMap<(usize, [u8; 32]), Document>>,
+    /// Candidate identities only: validation still uses current bytes and current trust.
+    pub(crate) discovery: std::sync::Mutex<Option<TimestampCandidates>>,
+    #[cfg(test)]
+    pub(crate) discovery_scans: std::sync::atomic::AtomicUsize,
+}
+
+/// Keep only the most recently visited source/overlay. In particular, this must not retain
+/// a Document, its bytes, or parsed signature dictionaries across edits and saves.
+#[derive(Debug)]
+pub(crate) struct TimestampCandidates {
+    source: pdfcraft_cos::SourceIdentity,
+    modified: Vec<u32>,
+    pub(crate) candidates: Vec<ObjRef>,
+}
+
+pub(crate) const DISCOVERY_CACHE_LIMIT: usize = 4096;
+
+pub(crate) fn is_document_timestamp(object: &Object) -> bool {
+    object.as_dict().is_some_and(|d| is_doc_timestamp(d) && d.contains(b"ByteRange"))
+}
+
+/// Only dictionary/null edits have a local effect on candidate membership. Changes to an
+/// object stream or a scalar used as an indirect /Length can affect unedited objects too.
+/// Checking both the original and current objects also covers freeing those dependencies.
+/// Unsupported or unreadable edits deliberately fall back to the complete bounded scan.
+fn changed_timestamp_candidates(doc: &Document, numbers: &[u32]) -> Option<Vec<ObjRef>> {
+    for (reference, object) in doc.scan_original_objects_subset(numbers.to_vec()) {
+        match object.ok()?.as_ref() {
+            Object::Dict(_) => {}
+            Object::Null if matches!(doc.xref_entry(reference.num), None | Some(pdfcraft_cos::XrefEntry::Free { .. })) => {}
+            _ => return None,
+        }
+    }
+    let mut candidates = Vec::new();
+    for (reference, object) in doc.scan_objects_subset(numbers.to_vec()) {
+        let object = object.ok()?;
+        if !matches!(object.as_ref(), Object::Dict(_) | Object::Null) {
+            return None;
+        }
+        if is_document_timestamp(&object) {
+            candidates.push(reference);
+        }
+    }
+    Some(candidates)
+}
+
+/// (end of first range, start of second, end of second, algorithm, fingerprint).
+type RangeKey = (usize, usize, usize, DigestAlg, [u8; 32]);
+
+/// 64 KiB sampled from across `covered`, plus its length.
+fn fingerprint(covered: &[u8]) -> [u8; 32] {
+    let mut parts: Vec<&[u8]> = (0..64)
+        .map(|i| {
+            let at = covered.len().saturating_sub(1024) * i / 63;
+            &covered[at..(at + 1024).min(covered.len())]
+        })
+        .collect();
+    let len = (covered.len() as u64).to_be_bytes();
+    parts.push(&len);
+    DigestAlg::Sha256.digest(&parts).try_into().unwrap_or([0; 32])
+}
+
+impl DigestCache {
+    pub(crate) fn timestamp_candidates(&self, doc: &Document) -> Vec<ObjRef> {
+        let mut slot = self.discovery.lock().ok();
+        let previous = slot.as_mut().and_then(|slot| slot.take());
+        let source = doc.source_identity();
+        let modified = doc.modified_objects();
+        // Reconstructed/unknown input and output-security changes take the original path.
+        let eligible = slot.is_some()
+            && doc.repair_log().is_empty()
+            && !doc.revisions().is_empty()
+            && !doc.encryption_changed()
+            && modified.len() <= DISCOVERY_CACHE_LIMIT;
+        if eligible && let Some(previous) = previous.filter(|previous| previous.source == source) {
+            // Undo/redo can remove overlays as well as add them. Revisit the union so an
+            // original candidate replaced or freed in the last snapshot can reappear.
+            let mut changed = previous.modified;
+            changed.extend_from_slice(&modified);
+            changed.sort_unstable();
+            changed.dedup();
+            if changed.len() <= DISCOVERY_CACHE_LIMIT
+                && let Some(mut candidates) = changed_timestamp_candidates(doc, &changed)
+            {
+                candidates.extend(previous.candidates.into_iter().filter(|r| changed.binary_search(&r.num).is_err()));
+                candidates.sort_unstable_by_key(|r| r.num);
+                if candidates.len() <= DISCOVERY_CACHE_LIMIT
+                    && let Some(slot) = slot.as_mut()
+                {
+                    **slot = Some(TimestampCandidates { source, modified, candidates: candidates.clone() });
+                }
+                return candidates;
+            }
+        }
+        #[cfg(test)]
+        self.discovery_scans.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        let mut complete = true;
+        let candidates: Vec<_> = doc
+            .scan_objects_checked()
+            .filter_map(|(reference, object)| match object {
+                Ok(object) => is_document_timestamp(&object).then_some(reference),
+                Err(_) => {
+                    complete = false;
+                    None
+                }
+            })
+            .collect();
+        if eligible
+            && complete
+            && candidates.len() <= DISCOVERY_CACHE_LIMIT
+            && changed_timestamp_candidates(doc, &modified).is_some()
+            && let Some(slot) = slot.as_mut()
+        {
+            **slot = Some(TimestampCandidates { source, modified, candidates: candidates.clone() });
+        }
+        candidates
+    }
+
+    /// The signed revision `bytes[..end]`, parsed (and kept). An encrypted one is opened with
+    /// `doc`'s own key (the same `/Encrypt` and `/ID`), so a user password the document was
+    /// opened with is neither needed again nor kept here (#1808).
+    pub(super) fn revision(&self, doc: &Document, bytes: &[u8], end: usize) -> Option<Document> {
+        let key = (end, fingerprint(&bytes[..end]));
+        if let Some(d) = self.revisions.lock().ok().and_then(|m| m.get(&key).cloned()) {
+            return Some(d);
+        }
+        let d = doc.open_with_same_credentials(Arc::new(bytes[..end].to_vec())).ok()?;
+        if let Ok(mut m) = self.revisions.lock() {
+            if m.len() > 8 {
+                m.clear();
+            }
+            m.insert(key, d.clone());
+        }
+        Some(d)
+    }
+
+    pub(super) fn digest(&self, alg: DigestAlg, bytes: &[u8], l0: usize, o1: usize, end: usize) -> Vec<u8> {
+        let key = (l0, o1, end, alg, fingerprint(&bytes[..end]));
+        if let Some(d) = self.map.lock().ok().and_then(|m| m.get(&key).cloned()) {
+            return d;
+        }
+        let d = alg.digest(&[&bytes[..l0], &bytes[o1..end]]);
+        if let Ok(mut m) = self.map.lock() {
+            if m.len() > 64 {
+                m.clear();
+            }
+            m.insert(key, d.clone());
+        }
+        d
+    }
+}
+
+pub(crate) fn text(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
+    let o = doc.resolve(d.get(key)?);
+    let s = match &*o {
+        Object::String(s) => s.to_text(),
+        Object::Name(n) => String::from_utf8_lossy(n).into_owned(),
+        _ => return None,
+    };
+    let s = s.trim_matches('\0').trim().to_string();
+    (!s.is_empty()).then_some(s)
+}
+
+pub(super) struct Field {
+    pub(super) name: String,
+    /// The field dictionary (and its widget(s)).
+    pub(super) r: Option<ObjRef>,
+    pub(super) dict: Dict,
+    pub(super) widgets: Vec<(Option<ObjRef>, Dict)>,
+}
+
+impl Field {
+    /// The signature dictionary in /V. A field without one is unsigned, whether /V is missing,
+    /// null or not a dictionary.
+    pub(super) fn signature(&self, doc: &Document) -> Option<Dict> {
+        self.dict.get(b"V").map(|v| doc.resolve(v)).and_then(|v| v.as_dict().cloned())
+    }
+
+    /// True when /V holds something that is neither null nor a signature dictionary: signing the
+    /// field would overwrite a value we can't read as a signature.
+    pub(super) fn has_foreign_value(&self, doc: &Document) -> bool {
+        self.dict.get(b"V").map(|v| doc.resolve(v)).is_some_and(|v| !matches!(*v, Object::Null) && v.as_dict().is_none())
+    }
+}
+
+/// Every signature field, depth first in `/Fields` order.
+pub(super) fn sig_fields(doc: &Document) -> Vec<Field> {
+    let mut out = Vec::new();
+    let Some(root) = doc.root() else { return out };
+    let Some(af) = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned()) else {
+        return out;
+    };
+    let Some(fields) = af.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned()) else { return out };
+    let mut seen = HashSet::new();
+    let mut stack: Vec<(Object, String, Option<Vec<u8>>)> = fields.into_iter().rev().map(|f| (f, String::new(), None)).collect();
+    while let Some((o, prefix, inherited_ft)) = stack.pop() {
+        if let Some(r) = o.as_ref()
+            && !seen.insert(r)
+        {
+            continue;
+        }
+        let Some(d) = doc.resolve(&o).as_dict().cloned() else { continue };
+        let part = text(doc, &d, b"T");
+        let name = match (&part, prefix.is_empty()) {
+            (Some(p), true) => p.clone(),
+            (Some(p), false) => format!("{prefix}.{p}"),
+            (None, _) => prefix.clone(),
+        };
+        let ft = d.name(b"FT").map(<[u8]>::to_vec).or(inherited_ft);
+        let kids: Vec<Object> = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+        // Kids with a /T are fields; others are this field's widgets.
+        let (sub, widgets): (Vec<Object>, Vec<Object>) = kids.into_iter().partition(|k| doc.resolve(k).as_dict().is_some_and(|kd| kd.contains(b"T")));
+        for k in sub.into_iter().rev() {
+            stack.push((k, name.clone(), ft.clone()));
+        }
+        if ft.as_deref() == Some(b"Sig") && part.is_some() {
+            let mut ws: Vec<(Option<ObjRef>, Dict)> =
+                widgets.iter().filter_map(|w| doc.resolve(w).as_dict().cloned().map(|wd| (w.as_ref(), wd))).collect();
+            if d.name(b"Subtype") == Some(b"Widget") {
+                ws.insert(0, (o.as_ref(), d.clone()));
+            }
+            out.push(Field { name, r: o.as_ref(), dict: d, widgets: ws });
+        }
+    }
+    out
+}
+
+/// Which page holds each annotation.
+fn annot_pages(doc: &Document) -> HashMap<ObjRef, usize> {
+    let mut map = HashMap::new();
+    for (i, p) in pdfcraft_annot::page_refs(doc).unwrap_or_default().into_iter().enumerate() {
+        if let Some(a) = doc.get(p).as_dict().and_then(|d| d.get(b"Annots").map(|a| doc.resolve(a))).and_then(|a| a.as_array().cloned()) {
+            for r in a.iter().filter_map(Object::as_ref) {
+                map.insert(r, i);
+            }
+        }
+    }
+    map
+}
+
+pub(super) fn nums(doc: &Document, d: &Dict, key: &[u8]) -> Option<Vec<f64>> {
+    doc.resolve(d.get(key)?).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect())
+}
+
+/// List and validate every signature field. `bytes` is the file as stored (the ranges index it).
+pub fn list(doc: &Document, bytes: &[u8], trust: &TrustStore) -> Vec<SignatureInfo> {
+    list_cached(doc, bytes, trust, &DigestCache::default())
+}
+
+/// [`list`], reusing digests and standalone-timestamp discovery from `cache`. Field/widget
+/// structure and validation against `bytes` and `trust` are read again on every call.
+pub fn list_cached(doc: &Document, bytes: &[u8], trust: &TrustStore, cache: &DigestCache) -> Vec<SignatureInfo> {
+    let pages = annot_pages(doc);
+    let mut out = Vec::new();
+    let mut field_values: HashSet<ObjRef> = HashSet::new();
+    for f in sig_fields(doc) {
+        if let Some(v_ref) = f.dict.get(b"V").and_then(Object::as_ref) {
+            field_values.insert(v_ref);
+        }
+        let widget = f.widgets.first();
+        let page = widget.and_then(|(r, w)| r.and_then(|r| pages.get(&r).copied()).or_else(|| w.reference(b"P").and_then(|p| page_index(doc, p))));
+        let rect = widget
+            .and_then(|(_, w)| nums(doc, w, b"Rect"))
+            .filter(|r| r.len() == 4)
+            .map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]);
+        // Shown when it has a box, and its widget isn't Hidden (2) or NoView (32), as the forms
+        // crate reads a widget's flags.
+        let flags = widget.and_then(|(_, w)| w.get(b"F")).and_then(|o| doc.resolve(o).as_int()).unwrap_or(0);
+        let visible = rect.is_some_and(|r| r[2] - r[0] > 0.5 && r[3] - r[1] > 0.5) && flags & (2 | 32) == 0;
+        let v = f.signature(doc);
+        let mut info = SignatureInfo {
+            field: f.name.clone(),
+            signed: v.is_some(),
+            page,
+            rect,
+            visible,
+            signer: None,
+            certificate: None,
+            chain: Vec::new(),
+            date: None,
+            signing_time: None,
+            reason: None,
+            location: None,
+            contact: None,
+            sub_filter: None,
+            doc_timestamp: false,
+            certify: None,
+            revision: 0,
+            signed_len: 0,
+            digest: None,
+            algorithm: None,
+            timestamp: false,
+            timestamp_time: None,
+            status: Status::Unknown,
+            modification: Modification::None,
+            details: Vec::new(),
+        };
+        if let Some(v) = v {
+            validate_into(doc, bytes, trust, &v, &mut info, cache);
+        }
+        out.push(info);
+    }
+    // Standalone document timestamps (ISO 32000-2 §12.8.2.2) live outside AcroForm fields.
+    let candidates = cache.timestamp_candidates(doc).into_iter().map(|r| r.num).collect();
+    for (r, o) in doc.scan_objects_subset(candidates) {
+        if field_values.contains(&r) {
+            continue;
+        }
+        let Ok(o) = o else { continue };
+        let Some(d) = o.as_dict() else { continue };
+        if !is_document_timestamp(&o) {
+            continue;
+        }
+        let mut info = SignatureInfo {
+            field: "DocumentTimestamp".to_string(),
+            signed: true,
+            page: None,
+            rect: None,
+            visible: false,
+            signer: None,
+            certificate: None,
+            chain: Vec::new(),
+            date: None,
+            signing_time: None,
+            reason: None,
+            location: None,
+            contact: None,
+            sub_filter: Some("ETSI.RFC3161".to_string()),
+            doc_timestamp: true,
+            certify: None,
+            revision: 0,
+            signed_len: 0,
+            digest: None,
+            algorithm: None,
+            timestamp: true,
+            timestamp_time: None,
+            status: Status::Unknown,
+            modification: Modification::None,
+            details: Vec::new(),
+        };
+        validate_doc_timestamp(doc, bytes, d, &mut info, cache, trust);
+        out.push(info);
+    }
+    out
+}
+
+fn page_index(doc: &Document, p: ObjRef) -> Option<usize> {
+    pdfcraft_annot::page_refs(doc).ok()?.iter().position(|r| *r == p)
+}
+
+/// A widget's `/MK /R` as a quarter turn (0, 90, 180 or 270); missing, malformed or not a
+/// multiple of 90 counts as 0, as `pdfcraft-forms` reads it for the fields it draws.
+pub(super) fn mk_rotation(doc: &Document, widget: &Dict) -> i64 {
+    let r = widget
+        .get(b"MK")
+        .map(|mk| doc.resolve(mk))
+        .and_then(|mk| mk.as_dict().and_then(|mk| mk.get(b"R")).map(|r| doc.resolve(r)))
+        .and_then(|r| r.as_int().or_else(|| r.as_f64().filter(|v| v.is_finite() && v.abs() <= 1.0e6).map(|v| v.round() as i64)));
+    r.map(|r| r.rem_euclid(360)).filter(|q| matches!(q, 90 | 180 | 270)).unwrap_or(0)
+}
diff --git a/crates/sign/src/pdf/signing.rs b/crates/sign/src/pdf/signing.rs
new file mode 100644
index 0000000000..0d00c68a61
--- /dev/null
+++ b/crates/sign/src/pdf/signing.rs
@@ -0,0 +1,610 @@
+use super::listing::{mk_rotation, nums, sig_fields};
+use super::*;
+
+// ── signing ─────────────────────────────────────────────────────────────────────────────────
+
+/// What the visible signature shows (Acrobat: Configure Signature Appearance).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Appearance {
+    pub name: bool,
+    pub date: bool,
+    pub reason: bool,
+    pub location: bool,
+    pub distinguished_name: bool,
+    pub labels: bool,
+}
+
+impl Default for Appearance {
+    fn default() -> Self {
+        Self { name: true, date: true, reason: false, location: false, distinguished_name: false, labels: true }
+    }
+}
+
+/// The words of the labels of a visible signature.
+///
+/// They are stamped into the document, so the caller chooses them: an interface that speaks
+/// another language passes them in that language. The defaults are the English ones.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AppearanceLabels {
+    pub signed_by: String,
+    pub distinguished_name: String,
+    pub reason: String,
+    pub location: String,
+    pub date: String,
+}
+
+impl Default for AppearanceLabels {
+    fn default() -> Self {
+        Self {
+            signed_by: "Digitally signed by".into(),
+            distinguished_name: "DN: ".into(),
+            reason: "Reason: ".into(),
+            location: "Location: ".into(),
+            date: "Date: ".into(),
+        }
+    }
+}
+
+impl AppearanceLabels {
+    /// Each label with its field name (`signed_by`, `distinguished_name`, `reason`, `location`,
+    /// `date`), in the order the visible signature shows them.
+    pub fn fields(&self) -> [(&'static str, &str); 5] {
+        [
+            ("signed_by", self.signed_by.as_str()),
+            ("distinguished_name", self.distinguished_name.as_str()),
+            ("reason", self.reason.as_str()),
+            ("location", self.location.as_str()),
+            ("date", self.date.as_str()),
+        ]
+    }
+
+    /// The first label, with its field name, that has a character the visible signature's font
+    /// can't draw, and that character. Signing refuses such a label when it is shown, so an
+    /// interface checks its translated labels here and falls back to [`Default`] if one fails.
+    pub fn first_undrawable(&self) -> Option<(&'static str, char)> {
+        self.fields().into_iter().find_map(|(field, text)| pdfcraft_fonts::first_undrawable(text).map(|c| (field, c)))
+    }
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct SignOptions {
+    /// Sign this existing, unsigned signature field.
+    pub field: Option<String>,
+    /// Or create a field on this page (0-based) with this rectangle (`None`: invisible).
+    pub page: usize,
+    pub rect: Option<[f64; 4]>,
+    /// Name for a new field (default `Signature1`, `Signature2`…).
+    pub new_field_name: Option<String>,
+    pub reason: Option<String>,
+    pub location: Option<String>,
+    pub contact: Option<String>,
+    /// The signing time as a PDF date (`/M`), from the caller's clock.
+    pub date: String,
+    /// Certify with these DocMDP permissions (1 no changes, 2 form fill and signing, 3 also comments).
+    pub certify: Option<u8>,
+    pub appearance: Appearance,
+    /// The words of the labels the visible signature shows.
+    pub appearance_labels: AppearanceLabels,
+    /// A drawing, typed signature or image shown where the large name would be.
+    pub graphic: Option<crate::graphic::Graphic>,
+}
+
+/// What an encrypted document's permissions (ISO 32000-2 §7.6.4.2, Table 22) allow when it was
+/// opened with the user password (the owner may do anything): signing an existing, empty
+/// signature field is filling in a form field (bit 9, or bit 6); creating a new signature
+/// field needs bits 6 and 4; certifying sets the catalog's `/Perms`, a document change (bit 4).
+/// The signature's `/Contents` stays unencrypted (`pdfcraft-cos` exempts it, §7.6.2), so the
+/// placeholder can be patched after hashing exactly as in an unencrypted file.
+fn check_signing_permissions(doc: &Document, opts: &SignOptions) -> Result<(), SignError> {
+    let Some(p) = doc.permissions() else { return Ok(()) };
+    let refuse = |what: &str| {
+        Err(SignError::Pdf(format!(
+            "the document's security settings don't allow {what}; open it with the permissions password, or sign an existing signature field"
+        )))
+    };
+    if opts.field.is_some() && !p.fill_forms() {
+        return Err(SignError::Pdf(
+            "the document's security settings don't allow filling in form fields or signing; open it with the permissions password to sign it".into(),
+        ));
+    }
+    if opts.field.is_none() && !(p.annotate() && p.modify()) {
+        return refuse("adding new signature fields");
+    }
+    if opts.certify.is_some() && !p.modify() {
+        return refuse("certifying it");
+    }
+    Ok(())
+}
+
+/// Placeholder `/ByteRange` values: fixed width, patched after writing.
+const BR_MARK: [i64; 3] = [1_111_111_111, 2_222_222_222, 3_333_333_333];
+
+/// Sign `doc` with `id`; returns the signed file (an incremental update when possible).
+pub fn sign(doc: &Document, id: &DigitalId, opts: &SignOptions) -> Result<Vec<u8>, SignError> {
+    sign_inner(doc, id, opts, None)
+}
+
+/// Sign and embed an RFC 3161 signature timestamp from `tsa` (PAdES B-T). The transport is the
+/// caller's: this crate never opens a socket, and a rejected or malformed token fails the
+/// signing before any file is produced.
+pub fn sign_with_timestamp(
+    doc: &Document,
+    id: &DigitalId,
+    opts: &SignOptions,
+    tsa: &dyn crate::timestamp::TimestampAuthority,
+) -> Result<Vec<u8>, SignError> {
+    sign_inner(doc, id, opts, Some(tsa))
+}
+
+/// Extra `/Contents` headroom for an attached RFC 3161 token (a TSA response with its
+/// certificate chain is typically 4–8 KiB; the token is also size-capped on parsing).
+const TOKEN_RESERVE: usize = 16 * 1024;
+
+fn sign_inner(
+    doc: &Document,
+    id: &DigitalId,
+    opts: &SignOptions,
+    tsa: Option<&dyn crate::timestamp::TimestampAuthority>,
+) -> Result<Vec<u8>, SignError> {
+    // A pending security change would make the incremental save a full rewrite that applies
+    // or removes protection as it signs (and breaks existing signatures): save it first.
+    if doc.encryption_changed() {
+        return Err(SignError::Pdf("save the document's new security settings before signing it".into()));
+    }
+    check_signing_permissions(doc, opts)?;
+    let mut doc = doc.clone();
+    let root = doc.root().ok_or_else(|| SignError::Pdf("the document has no catalog".into()))?;
+    let alg = id.key.preferred_digest();
+    let reserve =
+        8192 + id.certificate.raw.len() + id.chain.iter().map(|c| c.raw.len()).sum::<usize>() + if tsa.is_some() { TOKEN_RESERVE } else { 0 };
+    let name = id.certificate.display_name();
+    // The signature dictionary.
+    let mut v = Dict::new();
+    v.set(b"Type".to_vec(), Object::name("Sig"));
+    v.set(b"Filter".to_vec(), Object::name("Adobe.PPKLite"));
+    v.set(b"SubFilter".to_vec(), Object::name("ETSI.CAdES.detached"));
+    v.set(b"ByteRange".to_vec(), Object::Array([0].iter().chain(BR_MARK.iter()).map(|n| Object::Int(*n)).collect()));
+    v.set(b"Contents".to_vec(), Object::String(PdfString { bytes: vec![0; reserve], hex: true }));
+    v.set(b"M".to_vec(), PdfString::literal(opts.date.as_bytes().to_vec()));
+    v.set(b"Name".to_vec(), PdfString::text(&name));
+    for (k, val) in [(&b"Reason"[..], &opts.reason), (b"Location", &opts.location), (b"ContactInfo", &opts.contact)] {
+        if let Some(s) = val.as_deref().filter(|s| !s.trim().is_empty()) {
+            v.set(k.to_vec(), PdfString::text(s));
+        }
+    }
+    let mut app = Dict::new();
+    app.set(b"Name".to_vec(), Object::name("PdfCraft"));
+    let mut build = Dict::new();
+    build.set(b"App".to_vec(), Object::Dict(app));
+    v.set(b"Prop_Build".to_vec(), Object::Dict(build));
+    if let Some(p) = opts.certify {
+        let mut tp = Dict::new();
+        tp.set(b"Type".to_vec(), Object::name("TransformParams"));
+        tp.set(b"P".to_vec(), Object::Int(p.clamp(1, 3) as i64));
+        tp.set(b"V".to_vec(), Object::name("1.2"));
+        let mut sr = Dict::new();
+        sr.set(b"Type".to_vec(), Object::name("SigRef"));
+        sr.set(b"TransformMethod".to_vec(), Object::name("DocMDP"));
+        sr.set(b"TransformParams".to_vec(), Object::Dict(tp));
+        v.set(b"Reference".to_vec(), Object::Array(vec![Object::Dict(sr)]));
+    }
+    let sig = doc.add(Object::Dict(v.clone()));
+    if opts.certify.is_some() {
+        // Catalog /Perms /DocMDP points at the certification signature.
+        let mut perms = Dict::new();
+        perms.set(b"DocMDP".to_vec(), Object::Ref(sig));
+        doc.update_dict(root, |c| c.set(b"Perms".to_vec(), Object::Dict(perms)))?;
+    }
+    // The field and its widget.
+    let pages = pdfcraft_annot::page_refs(&doc).map_err(|e| SignError::Pdf(e.to_string()))?;
+    let existing = opts
+        .field
+        .as_deref()
+        .map(|n| sig_fields(&doc).into_iter().find(|f| f.name == n).ok_or_else(|| SignError::Pdf(format!("there is no signature field {n:?}"))));
+    // `turn`: how far the appearance is turned to read upright (`/MK /R`, counterclockwise).
+    let (widget, rect, turn) = match existing {
+        Some(f) => {
+            let f = f?;
+            if f.signature(&doc).is_some() {
+                return Err(SignError::Pdf(format!("the field {:?} is already signed", f.name)));
+            }
+            if f.has_foreign_value(&doc) {
+                return Err(SignError::Pdf(format!("the value of the field {:?} is not a signature", f.name)));
+            }
+            let fr = f.r.ok_or_else(|| SignError::Pdf("the field is not an indirect object".into()))?;
+            doc.update_dict(fr, |d| d.set(b"V".to_vec(), Object::Ref(sig)))?;
+            let (wr, wd) = f.widgets.first().cloned().ok_or_else(|| SignError::Pdf("the field has no widget".into()))?;
+            let rect = nums(&doc, &wd, b"Rect").filter(|r| r.len() == 4).map(|r| [r[0].min(r[2]), r[1].min(r[3]), r[0].max(r[2]), r[1].max(r[3])]);
+            // The field's own rotation, as a form author set it: an existing field is not
+            // reoriented, so one without `/MK /R` is drawn as before.
+            (wr.unwrap_or(fr), rect.unwrap_or([0.0; 4]), mk_rotation(&doc, &wd))
+        }
+        None => {
+            let page = *pages.get(opts.page).ok_or_else(|| SignError::Pdf(format!("page {} does not exist", opts.page + 1)))?;
+            let taken: HashSet<String> = sig_fields(&doc).into_iter().map(|f| f.name).collect();
+            let fname = opts
+                .new_field_name
+                .clone()
+                .unwrap_or_else(|| (1..).map(|i| format!("Signature{i}")).find(|n| !taken.contains(n)).unwrap_or_default());
+            let rect = opts.rect.unwrap_or([0.0; 4]);
+            let mut w = Dict::new();
+            w.set(b"Type".to_vec(), Object::name("Annot"));
+            w.set(b"Subtype".to_vec(), Object::name("Widget"));
+            w.set(b"FT".to_vec(), Object::name("Sig"));
+            w.set(b"T".to_vec(), PdfString::text(&fname));
+            w.set(b"V".to_vec(), Object::Ref(sig));
+            w.set(b"Rect".to_vec(), Object::Array(rect.iter().map(|x| Object::Real(*x)).collect()));
+            w.set(b"P".to_vec(), Object::Ref(page));
+            // Print + Locked.
+            w.set(b"F".to_vec(), Object::Int(4 | 128));
+            // On a page shown turned, the signature reads upright as the page is displayed: the
+            // widget is turned back by the page's rotation (ISO 32000-2 §12.5.6.19, `/MK /R`).
+            let turn = pdfcraft_model::pages(&doc).get(opts.page).map_or(0, |p| p.rotation(&doc));
+            if turn != 0 {
+                let mut mk = Dict::new();
+                mk.set(b"R".to_vec(), Object::Int(turn));
+                w.set(b"MK".to_vec(), Object::Dict(mk));
+            }
+            let wr = doc.add(Object::Dict(w));
+            // Page /Annots (indirect arrays are updated in place).
+            let pd = doc.get(page).as_dict().cloned().unwrap_or_default();
+            match pd.get(b"Annots") {
+                Some(Object::Ref(ar)) => {
+                    let mut a = doc.get(*ar).as_array().cloned().unwrap_or_default();
+                    a.push(Object::Ref(wr));
+                    doc.set(*ar, Object::Array(a));
+                }
+                other => {
+                    let mut a = other.and_then(|o| o.as_array().cloned()).unwrap_or_default();
+                    a.push(Object::Ref(wr));
+                    doc.update_dict(page, |d| d.set(b"Annots".to_vec(), Object::Array(a)))?;
+                }
+            }
+            // AcroForm /Fields and /SigFlags (signatures exist, append only).
+            let catalog = doc.get(root).as_dict().cloned().unwrap_or_default();
+            let (af_ref, mut af) = match catalog.get(b"AcroForm") {
+                Some(Object::Ref(r)) => (Some(*r), doc.get(*r).as_dict().cloned().unwrap_or_default()),
+                Some(Object::Dict(d)) => (None, d.clone()),
+                _ => (None, Dict::new()),
+            };
+            let mut fields = match af.get(b"Fields") {
+                Some(Object::Ref(r)) => doc.get(*r).as_array().cloned().unwrap_or_default(),
+                Some(Object::Array(a)) => a.clone(),
+                _ => Vec::new(),
+            };
+            fields.push(Object::Ref(wr));
+            af.set(b"Fields".to_vec(), Object::Array(fields));
+            af.set(b"SigFlags".to_vec(), Object::Int(3));
+            match af_ref {
+                Some(r) => doc.set(r, Object::Dict(af)),
+                // Inline (or new) AcroForms stay in the catalog.
+                None => doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(af)))?,
+            }
+            (wr, rect, turn)
+        }
+    };
+    if opts.field.is_some() {
+        doc.update_dict(root, |c| {
+            if let Some(Object::Dict(af)) = c.get_mut(b"AcroForm") {
+                af.set(b"SigFlags".to_vec(), Object::Int(3));
+            }
+        })?;
+        if let Some(Object::Ref(r)) = doc.get(root).as_dict().and_then(|c| c.get(b"AcroForm").cloned()) {
+            doc.update_dict(r, |af| af.set(b"SigFlags".to_vec(), Object::Int(3)))?;
+        }
+    }
+    // The appearance.
+    let ap = appearance(&mut doc, rect, turn, &name, &id.certificate, opts)?;
+    let ap_ref = doc.add(Object::Stream(ap));
+    let mut apd = Dict::new();
+    apd.set(b"N".to_vec(), Object::Ref(ap_ref));
+    doc.update_dict(widget, |w| w.set(b"AP".to_vec(), Object::Dict(apd)))?;
+    // Write with the placeholders, then patch them. What the user removed again before signing
+    // (a cleared redaction mark) stays out of the file, as in a save; what signing added is
+    // reachable (the signature through the field's `/V`), and the placeholders are found in the
+    // written bytes.
+    let save = SaveOptions { mod_date: Some(opts.date.clone()), object_streams: false, drop_unlinked: true, ..SaveOptions::default() };
+    let mut out = pdfcraft_cos::write_incremental(&doc, &save)?;
+    let (br_at, gap) = locate(&out, reserve)?;
+    let (start, end) = gap;
+    let ranges = [0usize, start, end, out.len() - end];
+    let mut br_text = format!("0 {} {} {}", ranges[1], ranges[2], ranges[3]).into_bytes();
+    let width = format!("0 {} {} {}", BR_MARK[0], BR_MARK[1], BR_MARK[2]).len();
+    if br_text.len() > width {
+        return Err(SignError::Pdf("the document is too large to sign".into()));
+    }
+    br_text.resize(width, b' ');
+    out[br_at..br_at + width].copy_from_slice(&br_text);
+    let digest = alg.digest(&[&out[..start], &out[end..]]);
+    let base = crate::cms::sign_detached(&id.key, &id.certificate, &id.chain, alg, &digest)?;
+    let cms = match tsa {
+        None => base,
+        Some(t) => {
+            // The imprint covers the signature value, which attaching an unsigned attribute
+            // does not change (PAdES B-T).
+            let sd = SignedData::parse(&base)?;
+            let q = crate::timestamp::TimestampQuery::new(DigestAlg::Sha256, DigestAlg::Sha256.digest(&[&sd.signer.signature]))?;
+            let resp = t.timestamp(&q.encode()?)?;
+            let token = crate::timestamp::parse_response(&resp, &q)?;
+            crate::cms::attach_timestamp_token(&base, &token.raw)?
+        }
+    };
+    if cms.len() > reserve {
+        return Err(SignError::Pdf("the signature does not fit its placeholder".into()));
+    }
+    let hex: Vec<u8> = cms.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
+    out[start + 1..start + 1 + hex.len()].copy_from_slice(&hex);
+    Ok(out)
+}
+
+/// Append a document timestamp (ISO 32000-2 §12.8.2.2): a standalone signature dictionary
+/// whose `/Contents` is an RFC 3161 token covering the whole current file (`/ETSI.RFC3161`).
+/// The transport is the caller's; a rejected or malformed token produces no file.
+pub fn timestamp_document(doc: &Document, tsa: &dyn crate::timestamp::TimestampAuthority, date: &str) -> Result<Vec<u8>, SignError> {
+    // A pending security change would make the incremental save a full rewrite that applies
+    // or removes protection as it signs (and breaks existing signatures): save it first.
+    if doc.encryption_changed() {
+        return Err(SignError::Pdf("save the document's new security settings before signing it".into()));
+    }
+    if doc.permissions().is_some_and(|p| !p.fill_forms()) {
+        return Err(SignError::Pdf(
+            "the document's security settings don't allow signing; open it with the permissions password to timestamp it".into(),
+        ));
+    }
+    let mut doc = doc.clone();
+    // What the user removed again before this (a cleared redaction mark) stays out of the file,
+    // as in a save. Nothing refers to the timestamp either, so the leftovers go first and the
+    // save keeps everything.
+    doc.free_unlinked_additions();
+    let mut v = Dict::new();
+    v.set(b"Type".to_vec(), Object::name("DocTimeStamp"));
+    v.set(b"Filter".to_vec(), Object::name("Adobe.PPKLite"));
+    v.set(b"SubFilter".to_vec(), Object::name("ETSI.RFC3161"));
+    v.set(b"ByteRange".to_vec(), Object::Array([0].iter().chain(BR_MARK.iter()).map(|n| Object::Int(*n)).collect()));
+    v.set(b"Contents".to_vec(), Object::String(PdfString { bytes: vec![0; TOKEN_RESERVE], hex: true }));
+    v.set(b"M".to_vec(), PdfString::literal(date.as_bytes().to_vec()));
+    let mut app = Dict::new();
+    app.set(b"Name".to_vec(), Object::name("PdfCraft"));
+    let mut build = Dict::new();
+    build.set(b"App".to_vec(), Object::Dict(app));
+    v.set(b"Prop_Build".to_vec(), Object::Dict(build));
+    doc.add(Object::Dict(v));
+    let save = SaveOptions { mod_date: Some(date.to_string()), object_streams: false, ..SaveOptions::default() };
+    let mut out = pdfcraft_cos::write_incremental(&doc, &save)?;
+    let (br_at, gap) = locate(&out, TOKEN_RESERVE)?;
+    let (start, end) = gap;
+    let ranges = [0usize, start, end, out.len() - end];
+    let mut br_text = format!("0 {} {} {}", ranges[1], ranges[2], ranges[3]).into_bytes();
+    let width = format!("0 {} {} {}", BR_MARK[0], BR_MARK[1], BR_MARK[2]).len();
+    if br_text.len() > width {
+        return Err(SignError::Pdf("the document is too large to timestamp".into()));
+    }
+    br_text.resize(width, b' ');
+    out[br_at..br_at + width].copy_from_slice(&br_text);
+    let q = crate::timestamp::TimestampQuery::new(DigestAlg::Sha256, DigestAlg::Sha256.digest(&[&out[..start], &out[end..]]))?;
+    let resp = tsa.timestamp(&q.encode()?)?;
+    let token = crate::timestamp::parse_response(&resp, &q)?;
+    let hex: Vec<u8> = token.raw.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
+    if hex.len() > TOKEN_RESERVE * 2 {
+        return Err(SignError::Pdf("the timestamp token does not fit its placeholder".into()));
+    }
+    out[start + 1..start + 1 + hex.len()].copy_from_slice(&hex);
+    Ok(out)
+}
+
+/// Find the placeholders in the written file: the offset of the ByteRange numbers, and the
+/// `<…>` hex string's span. The ByteRange marker is unique; the Contents placeholder is the one
+/// in the same object (a full save may renumber objects, so they are not found by number).
+fn locate(out: &[u8], reserve: usize) -> Result<(usize, (usize, usize)), SignError> {
+    let mark = format!("0 {} {} {}", BR_MARK[0], BR_MARK[1], BR_MARK[2]);
+    let hits: Vec<usize> = out.windows(mark.len()).enumerate().filter(|(_, w)| *w == mark.as_bytes()).map(|(i, _)| i).collect();
+    let [br] = hits.as_slice() else { return Err(SignError::Pdf("ByteRange placeholder not found".into())) };
+    let start = out[..*br].windows(3).rposition(|w| w == b"obj").ok_or_else(|| SignError::Pdf("signature object not found".into()))?;
+    let end = br + out[*br..].windows(6).position(|w| w == b"endobj").ok_or_else(|| SignError::Pdf("unterminated signature object".into()))?;
+    let region = &out[start..end];
+    let mut zeros = vec![b'<'];
+    zeros.extend(std::iter::repeat_n(b'0', reserve * 2));
+    zeros.push(b'>');
+    let c = region.windows(zeros.len()).position(|w| w == zeros.as_slice()).ok_or_else(|| SignError::Pdf("Contents placeholder not found".into()))?;
+    Ok((*br, (start + c, start + c + zeros.len())))
+}
+
+/// "2026.10.02 14:03:11 +02'00'" from a PDF date.
+pub fn display_date(pdf: &str) -> String {
+    let s = pdf.strip_prefix("D:").unwrap_or(pdf);
+    let g = |r: std::ops::Range<usize>| s.get(r).unwrap_or("00");
+    let tz = match s.get(14..).filter(|z| !z.is_empty()) {
+        Some(z) if z.starts_with('Z') => " Z".to_string(),
+        Some(z) => format!(" {z}"),
+        None => String::new(),
+    };
+    format!("{}.{}.{} {}:{}:{}{tz}", g(0..4), g(4..6), g(6..8), g(8..10), g(10..12), g(12..14))
+}
+
+/// The visible signature: the signer's name large on the left, or the graphic in its place, and
+/// the details on the right (Acrobat's standard layout), in Helvetica, or in the bundled Inter
+/// font when a detail needs characters beyond Western European. A graphic with no details beside
+/// it fills the box. An error, before anything is drawn, when a detail it writes (the signer's
+/// name, the certificate's subject, the reason or the location) has a character neither font can
+/// draw: signing invisibly, or leaving that part out, still works. A graphic doesn't change this:
+/// the name it replaces on the left is still among the details. A label that is drawn
+/// ([`AppearanceLabels`], the caller's words) must be drawable in Helvetica, and is refused otherwise.
+///
+/// `turn` is the widget's `/MK /R` (0, 90, 180 or 270; anything else counts as 0): the layout is
+/// drawn upright in the box as turned by it, and a `/Matrix` maps that box onto `rect`.
+fn appearance(doc: &mut Document, rect: [f64; 4], turn: i64, name: &str, cert: &Certificate, opts: &SignOptions) -> Result<Stream, SignError> {
+    use pdfcraft_fonts::{first_undrawable, helvetica_width, inter_width, literal, undrawable_message, win_ansi, wrap, wrap_with};
+    let turn = if matches!(turn, 90 | 180 | 270) { turn } else { 0 };
+    let (rw, rh) = ((rect[2] - rect[0]).max(0.0), (rect[3] - rect[1]).max(0.0));
+    // The upright layout box: a quarter turn swaps its sides.
+    let (w, h) = if turn % 180 == 0 { (rw, rh) } else { (rh, rw) };
+    let a = &opts.appearance;
+    let dn = cert.subject.display();
+    let mut needs_unicode = false;
+    if w > 1.0 && h > 1.0 {
+        let shown = [
+            (a.name, "the signer's name", Some(name)),
+            (a.distinguished_name, "the certificate's subject", Some(dn.as_str())),
+            (a.reason, "the reason", opts.reason.as_deref()),
+            (a.location, "the location", opts.location.as_deref()),
+        ];
+        for (on, what, text) in shown {
+            if on
+                && let Some(s) = text
+                && first_undrawable(s).is_some()
+            {
+                for c in s.chars() {
+                    if matches!(c, '\n' | '\r') {
+                        continue;
+                    }
+                    if !pdfcraft_fonts::embedding::covers(pdfcraft_fonts::INTER_REGULAR, &c.to_string()) {
+                        return Err(SignError::Unsupported(format!(
+                            "{}; sign without a visible appearance, or leave {what} out of it",
+                            undrawable_message(&format!("{what} of the visible signature"), c)
+                        )));
+                    }
+                }
+                needs_unicode = true;
+            }
+        }
+        // The labels are the caller's words (a translation), checked as the details are: only
+        // those that are drawn, as each is drawn only beside its detail.
+        let has = |v: Option<&str>| v.is_some_and(|v| !v.is_empty());
+        let drawn = [a.name, a.distinguished_name, a.reason && has(opts.reason.as_deref()), a.location && has(opts.location.as_deref()), a.date];
+        let mut labels = opts.appearance_labels.fields().into_iter().zip(drawn).filter(|&(_, on)| a.labels && on);
+        if let Some((field, c)) = labels.find_map(|((field, text), _)| first_undrawable(text).map(|c| (field, c))) {
+            return Err(SignError::Unsupported(format!(
+                "{}; pass that label in Western European characters, or leave the labels out of the visible signature",
+                undrawable_message(&format!("the {field} label of the visible signature"), c)
+            )));
+        }
+    }
+    let mut lines: Vec<String> = Vec::new();
+    let label = |l: &str, v: &str| if a.labels { format!("{l}{v}") } else { v.to_string() };
+    // The labels are the caller's words, so a signature signed in another language reads in it.
+    let wording = &opts.appearance_labels;
+    if a.name {
+        lines.push(if a.labels { wording.signed_by.clone() } else { String::new() });
+        lines.push(name.to_string());
+    }
+    if a.distinguished_name {
+        lines.push(label(&wording.distinguished_name, &dn));
+    }
+    if a.reason
+        && let Some(r) = opts.reason.as_deref().filter(|r| !r.is_empty())
+    {
+        lines.push(label(&wording.reason, r));
+    }
+    if a.location
+        && let Some(l) = opts.location.as_deref().filter(|l| !l.is_empty())
+    {
+        lines.push(label(&wording.location, l));
+    }
+    if a.date {
+        lines.push(label(&wording.date, &display_date(&opts.date)));
+    }
+    lines.retain(|l| !l.is_empty());
+    let mut out = Vec::new();
+    let mut image = None;
+    let mut fonts = Dict::new();
+    let (font_tag, metrics) = if needs_unicode {
+        let tag = pdfcraft_fonts::embedding::embed(doc, &mut fonts, pdfcraft_fonts::INTER_REGULAR, "Inter")
+            .map_err(|e| SignError::Pdf(format!("failed to embed signature font: {e}")))?;
+        let font_dict = fonts
+            .get(tag.as_bytes())
+            .map(|o| doc.resolve(o))
+            .and_then(|o| o.as_dict().cloned())
+            .ok_or_else(|| SignError::Pdf("embedded signature font dictionary not found".into()))?;
+        let m = pdfcraft_fonts::pdf::Metrics::from_dict(doc, &font_dict);
+        (tag, Some(m))
+    } else {
+        let mut font = Dict::new();
+        font.set(b"Type".to_vec(), Object::name("Font"));
+        font.set(b"Subtype".to_vec(), Object::name("Type1"));
+        font.set(b"BaseFont".to_vec(), Object::name("Helvetica"));
+        font.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+        fonts.set(b"Helv".to_vec(), Object::Dict(font));
+        ("Helv".to_string(), None)
+    };
+    let measure = |s: &str, sz: f64| -> f64 { if needs_unicode { inter_width(s, sz) } else { helvetica_width(s, sz) } };
+    let wrap_text =
+        |s: &str, sz: f64, max_w: f64| -> Vec<String> { if needs_unicode { wrap_with(s, sz, max_w, inter_width) } else { wrap(s, sz, max_w) } };
+    let encode_line =
+        |l: &str| -> Vec<u8> { if let Some(m) = &metrics { literal(&m.encode(l).unwrap_or_else(|| win_ansi(l))) } else { literal(&win_ansi(l)) } };
+    if w > 1.0 && h > 1.0 {
+        let pad = (h * 0.06).clamp(1.0, 6.0);
+        let (left_w, right_x) = match (&opts.graphic, a.name) {
+            (Some(_), _) if lines.is_empty() => (w, pad),
+            (Some(_), _) | (None, true) => (w * 0.5, w * 0.5 + pad),
+            (None, false) => (0.0, pad),
+        };
+        let right_w = (w - right_x - pad).max(1.0);
+        if let Some(g) = &opts.graphic {
+            let (ops, im) = g.draw(doc, [pad, pad, (left_w - 2.0 * pad).max(0.0), (h - 2.0 * pad).max(0.0)])?;
+            out.extend(ops.bytes());
+            image = im;
+        }
+        out.extend_from_slice(b"BT\n0 g\n");
+        if a.name && opts.graphic.is_none() {
+            // The name fills the left half.
+            let mut size = (h * 0.4).min(36.0);
+            let fit = (left_w - 2.0 * pad).max(1.0);
+            let longest = measure(name, 1.0).max(0.01);
+            size = size.min(fit / longest).max(4.0);
+            let words = wrap_text(name, size, fit);
+            let total = words.len() as f64 * size * 1.1;
+            let mut y = (h + total) / 2.0 - size * 0.85;
+            for l in &words {
+                out.extend(format!("/{font_tag} {} Tf 1 0 0 1 {} {} Tm ", fmt(size), fmt(pad), fmt(y)).bytes());
+                out.extend(encode_line(l));
+                out.extend_from_slice(b" Tj\n");
+                y -= size * 1.1;
+            }
+        }
+        // The details, shrunk to fit the right side.
+        let mut size = (h / (lines.len().max(1) as f64 * 1.15)).min(12.0);
+        let wrapped = loop {
+            let all: Vec<String> = lines.iter().flat_map(|l| wrap_text(l, size, right_w)).collect();
+            if all.len() as f64 * size * 1.15 <= h - 2.0 * pad || size <= 3.0 {
+                break all;
+            }
+            size *= 0.9;
+        };
+        let mut y = h - pad - size * 0.9;
+        for l in &wrapped {
+            out.extend(format!("/{font_tag} {} Tf 1 0 0 1 {} {} Tm ", fmt(size), fmt(right_x), fmt(y)).bytes());
+            out.extend(encode_line(l));
+            out.extend_from_slice(b" Tj\n");
+            y -= size * 1.15;
+        }
+        out.extend_from_slice(b"ET\n");
+    }
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Form"));
+    d.set(b"BBox".to_vec(), Object::Array([0.0, 0.0, w, h].iter().map(|x| Object::Real(*x)).collect()));
+    if turn != 0 {
+        // Viewers fit the box, transformed by `/Matrix`, to the widget's `/Rect` (ISO 32000-2
+        // §12.5.5); this one lands on `rect` exactly, turned as `/MK /R` says.
+        let mut m = pdfcraft_model::view_matrix_for(turn, [rect[0], rect[1], rect[0] + rw, rect[1] + rh]);
+        if !m.iter().all(|x| x.is_finite()) {
+            // A caller's non-finite corner: the turn alone, which viewers fit to `/Rect` the same.
+            m = pdfcraft_model::view_matrix_for(turn, [0.0; 4]);
+        }
+        d.set(b"Matrix".to_vec(), Object::Array(m.iter().map(|x| Object::Real(*x)).collect()));
+    }
+    let mut res = Dict::new();
+    res.set(b"Font".to_vec(), Object::Dict(fonts));
+    if let Some(im) = image {
+        let mut xobjects = Dict::new();
+        xobjects.set(b"Im1".to_vec(), Object::Ref(im));
+        res.set(b"XObject".to_vec(), Object::Dict(xobjects));
+    }
+    d.set(b"Resources".to_vec(), Object::Dict(res));
+    Ok(Stream::flate(d, &out))
+}
+
+pub(crate) fn fmt(v: f64) -> String {
+    let s = format!("{v:.2}");
+    s.trim_end_matches('0').trim_end_matches('.').to_string()
+}
diff --git a/crates/sign/src/pdf/types.rs b/crates/sign/src/pdf/types.rs
new file mode 100644
index 0000000000..c061bc3699
--- /dev/null
+++ b/crates/sign/src/pdf/types.rs
@@ -0,0 +1,225 @@
+use super::*;
+
+/// Certificates the user trusts for signing (Acrobat: Trusted Certificates).
+#[derive(Clone, Debug, Default)]
+pub struct TrustStore {
+    pub certs: Vec<Certificate>,
+}
+
+impl TrustStore {
+    pub(super) fn trusts(&self, c: &Certificate) -> bool {
+        self.certs.iter().any(|t| t.raw == c.raw)
+    }
+}
+
+/// Acrobat's three verdicts.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Status {
+    /// Intact, signed by a trusted identity, and any later changes are permitted.
+    Valid,
+    /// Intact, but the signer's identity can't be established (not trusted), or validity
+    /// couldn't be determined.
+    Unknown,
+    /// The signed bytes changed, the signature doesn't verify, or later changes aren't permitted.
+    Invalid,
+}
+
+/// What a change made after signing is called: the words [`Modification`] lists it by, and the
+/// vocabulary a signature's details speak of changes in.
+///
+/// They are words of ours, not the document's, so an interface reading in another language
+/// translates each of them; [`ALL`](kind::ALL) is the whole vocabulary.
+pub mod kind {
+    pub const PAGE_CONTENT: &str = "page content";
+    pub const FORM_FILL: &str = "form fill";
+    pub const COMMENTS: &str = "comments";
+    pub const SIGNATURE: &str = "signature";
+    pub const SECURITY_STORE: &str = "document security store";
+    pub const METADATA: &str = "metadata";
+    pub const LINKS: &str = "links";
+    pub const STRUCTURE: &str = "document structure";
+    pub const PAGES: &str = "pages added or removed";
+    pub const OTHER: &str = "other changes";
+    /// Not a change but the reason there is nothing to compare: the signed revision itself could not
+    /// be read, so what came after it cannot be allowed.
+    pub const UNREADABLE: &str = "the signed version could not be read";
+
+    /// Every word above, for an interface to translate.
+    pub const ALL: &[&str] = &[PAGE_CONTENT, FORM_FILL, COMMENTS, SIGNATURE, SECURITY_STORE, METADATA, LINKS, STRUCTURE, PAGES, OTHER, UNREADABLE];
+}
+
+/// Changes made after signing.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Modification {
+    /// The signature covers the whole file.
+    None,
+    /// Later revisions only make changes the signature permits, listed in the words of [`kind`].
+    Allowed(Vec<&'static str>),
+    /// Later revisions make changes it doesn't permit, listed in the words of [`kind`].
+    Disallowed(Vec<&'static str>),
+}
+
+/// One of the sentences that explain a signature's verdict.
+///
+/// [`message`](Detail::message) is the sentence in English, ready to read. An interface that reads in
+/// another language says it with [`Detail::said`] instead, out of [`pattern`](Detail::pattern) —
+/// wording of ours, listed in [`WORDINGS`] — and [`fill`](Detail::fill), whatever goes in it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Detail {
+    /// The sentence in English.
+    pub message: String,
+    /// The sentence as it is worded here, with `{}` where the fill goes.
+    pub pattern: &'static str,
+    pub fill: Fill,
+}
+
+/// What goes where a [`Detail`]'s pattern has `{}`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Fill {
+    /// Nothing: the pattern is the whole sentence.
+    Nothing,
+    /// The changes made after signing, as [`Modification`] lists them: words of ours, each one in
+    /// [`kind::ALL`], said one after another.
+    Changes(Vec<&'static str>),
+    /// What a reader could not make of the signature, in its own words. It goes in as it stands: it
+    /// names the structure that is wrong, which is a developer's business and reads the same
+    /// everywhere.
+    Reason(String),
+    /// A value out of the signature itself — a time, the evidence a revocation came from — written
+    /// as it stands, the way a certificate's name or date is.
+    Value(String),
+    /// Two certificates' own names, for the wording that says one was not used to vouch for the
+    /// other. They go in the order the wording puts its two holes in, which a language may reverse.
+    Names(String, String),
+}
+
+impl Detail {
+    /// The sentence said in the language `words` translates into.
+    ///
+    /// The wording is translated, and what fills it goes in afterwards — the changes translated too —
+    /// so nothing put in can be mistaken for a hole of its own. With [`in_english`] this is
+    /// [`message`](Detail::message).
+    pub fn said(&self, words: Words) -> String {
+        let said = words(self.pattern);
+        match &self.fill {
+            Fill::Nothing => said,
+            Fill::Changes(c) => said.replacen("{}", &c.iter().map(|k| words(k)).collect::<Vec<_>>().join(", "), 1),
+            Fill::Reason(r) | Fill::Value(r) => said.replacen("{}", r, 1),
+            // Both holes are cut out of the wording first, so neither name can be taken for the other's.
+            Fill::Names(a, b) => {
+                let mut parts = said.splitn(3, "{}");
+                match (parts.next(), parts.next(), parts.next()) {
+                    (Some(p0), Some(p1), Some(p2)) => format!("{p0}{a}{p1}{b}{p2}"),
+                    // A wording with one hole, or none: say it as it is rather than guess.
+                    _ => said,
+                }
+            }
+        }
+    }
+
+    /// The whole sentence, with no hole in it.
+    pub(crate) fn plain(pattern: &'static str) -> Detail {
+        Detail::of(pattern, Fill::Nothing)
+    }
+
+    /// The sentence and what fills its hole. The English is said once, here, so it and
+    /// [`Detail::said`] cannot drift apart.
+    pub(crate) fn of(pattern: &'static str, fill: Fill) -> Detail {
+        let mut d = Detail { message: String::new(), pattern, fill };
+        d.message = d.said(&in_english);
+        d
+    }
+}
+
+/// How an interface says one of this crate's wordings in its own language: it is handed the English
+/// and gives back what it reads. [`in_english`] is the one that keeps the English.
+pub type Words<'a> = &'a dyn Fn(&str) -> String;
+
+/// [`Words`] that leaves the English as it is.
+pub fn in_english(wording: &str) -> String {
+    wording.to_owned()
+}
+
+/// Every sentence this crate says about a signature: what [`SignatureInfo::details`] can hold, and
+/// the summaries [`SignatureInfo::summary`] chooses between.
+///
+/// An interface reading in another language translates these and the words in [`kind::ALL`], which
+/// go into the two sentences that list changes. The rest of what it shows comes from elsewhere and
+/// goes through as it stands: the certificate's names and dates, and a reader's own detail in
+/// [`Fill::Reason`]. A test in this crate keeps the list in step with the code.
+pub const WORDINGS: &[&str] = &[
+    // What the signature's own structure says, before anything is verified.
+    "The signature has no valid byte range.",
+    "The signature's byte range does not match the file.",
+    "The signature's byte range does not exclude exactly its contents.",
+    "The signature contents are not hexadecimal.",
+    "The signature could not be read ({}).",
+    "PdfCraft can't check this signature yet: {}.",
+    "The signature uses the legacy adbe.x509.rsa_sha1 format.",
+    // What was read leniently on the way, each sentence worded where the reading happens.
+    "The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.",
+    "The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.",
+    "The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.",
+    "The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.",
+    "The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.",
+    "The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.",
+    "The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.",
+    "The signature's signed attributes have no content type, which CMS requires; it was read anyway.",
+    // What a signature that validates with an old hash or a small key still does not prove.
+    "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.",
+    "This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.",
+    "This signature uses an RSA key shorter than 2048 bits, which is no longer considered strong enough for signatures. It still validates, but it should not be relied on.",
+    // Whether the signed bytes and the signature still agree.
+    "The signature's signed attributes have no message digest, so the signature does not cover the document.",
+    "The signature's signed attributes name a content type other than data, so it is not a signature of the document.",
+    "The document has been altered or corrupted since the signature was applied.",
+    "The signer's certificate is not in the signature.",
+    "The signature value does not match the signer's certificate: the signature is corrupt.",
+    "The signature could not be checked ({}).",
+    "The signature could not be verified ({}).",
+    // What came after the signature.
+    "This document has not been modified since this signature was applied.",
+    "The document has been modified since this signature was applied, but the changes are permitted ({}).",
+    "The document has been altered since this signature was applied in ways it does not permit ({}).",
+    // Who signed, and when.
+    "The signer's certificate was not valid at the time of signing.",
+    "The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).",
+    "The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).",
+    "The signer's certificate has critical extensions PdfCraft does not recognize ({}).",
+    // Why a certificate that matched the issuer was not used to build the chain.
+    "The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.",
+    "The certificate of {} has critical extensions PdfCraft does not recognize, so it is not used to vouch for {}.",
+    "The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.",
+    "The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.",
+    "The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.",
+    "The signer's identity is valid.",
+    "The signature includes an embedded timestamp.",
+    "Signing time is from the clock on the signer's computer.",
+    // What the signature's own timestamp token proves, if it carries one.
+    "The signature's timestamp token does not cover the signature value.",
+    "The signature's timestamp token could not be verified ({}).",
+    "The embedded timestamp token is valid and its authority is trusted; trusted time is {}.",
+    "The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.",
+    // What the document's own revocation evidence says about the signer.
+    "The signer's certificate has been revoked ({}).",
+    "The document's embedded revocation information shows that the signer's certificate has not been revoked.",
+    // A standalone document timestamp, which is checked on its own.
+    "The timestamp has no valid byte range.",
+    "The timestamp's byte range does not match the file.",
+    "The timestamp's byte range does not exclude exactly its contents.",
+    "The timestamp contents are not hexadecimal.",
+    "The timestamp token could not be read ({}).",
+    "The document has been altered or corrupted since the timestamp was applied.",
+    "The timestamp authority's certificate was not valid at the time of timestamping.",
+    "The timestamp authority's certificate is not issued for time stamping.",
+    "This document has not been modified since this timestamp was applied.",
+    "The document has been modified since this timestamp was applied, but the changes are permitted ({}).",
+    "The document has been altered since this timestamp was applied in ways it does not permit ({}).",
+    "The timestamp token is valid and its authority is trusted.",
+    "The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.",
+    // The one line that stands for all of it.
+    "Unsigned signature field",
+    "Signature is valid",
+    "Signature validity is unknown",
+    "Signature is invalid",
+];
diff --git a/crates/sign/src/pdf/validate.rs b/crates/sign/src/pdf/validate.rs
new file mode 100644
index 0000000000..1f0b8c3424
--- /dev/null
+++ b/crates/sign/src/pdf/validate.rs
@@ -0,0 +1,649 @@
+use super::changes::classify_changes;
+use super::listing::{DigestCache, list, nums, sig_fields, text};
+use super::types::{Detail, Fill, Modification, Status, TrustStore};
+use super::*;
+
+/// Validate one signature dictionary.
+pub fn validate(doc: &Document, bytes: &[u8], trust: &TrustStore, field: &str) -> Option<SignatureInfo> {
+    list(doc, bytes, trust).into_iter().find(|s| s.field == field)
+}
+
+fn unhex(s: &[u8]) -> Option<Vec<u8>> {
+    let digits: Vec<u8> = s.iter().copied().filter(|c| !c.is_ascii_whitespace()).collect();
+    let val = |c: u8| (c as char).to_digit(16).map(|d| d as u8);
+    digits.chunks(2).map(|p| Some(val(p[0])? << 4 | p.get(1).map_or(Some(0), |c| val(*c))?)).collect()
+}
+
+/// A document timestamp dictionary: `/SubFilter /ETSI.RFC3161`, typed `/DocTimeStamp`
+/// (ISO 32000-2 §12.8.5) or, as older writers have it, `/Sig`.
+pub(super) fn is_doc_timestamp(d: &Dict) -> bool {
+    d.name(b"SubFilter") == Some(b"ETSI.RFC3161") && matches!(d.name(b"Type"), Some(b"DocTimeStamp" | b"Sig"))
+}
+
+/// The DocMDP permission level (`/P`, 1–3) of signature value `v`, or `None` for an approval
+/// signature.
+fn docmdp(doc: &Document, v: &Dict) -> Option<u8> {
+    v.get(b"Reference")
+        .map(|r| doc.resolve(r))
+        .and_then(|r| r.as_array().cloned())
+        .into_iter()
+        .flatten()
+        .filter_map(|r| doc.resolve(&r).as_dict().cloned())
+        .find(|r| r.name(b"TransformMethod") == Some(b"DocMDP"))
+        .map(|r| r.get(b"TransformParams").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().and_then(|p| p.int(b"P"))).unwrap_or(2).clamp(1, 3) as u8)
+}
+
+pub(super) fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, info: &mut SignatureInfo, cache: &DigestCache) {
+    // A document timestamp can also be the value of a signature field (Documenso writes
+    // `Timestamp_1` that way). Its `/Contents` is a bare RFC 3161 token, not a signature over the
+    // document, so it must not be read as one.
+    if is_doc_timestamp(v) {
+        info.sub_filter = Some("ETSI.RFC3161".to_string());
+        info.doc_timestamp = true;
+        info.timestamp = true;
+        validate_doc_timestamp(doc, bytes, v, info, cache, trust);
+        return;
+    }
+    info.date = text(doc, v, b"M");
+    info.reason = text(doc, v, b"Reason");
+    info.location = text(doc, v, b"Location");
+    info.contact = text(doc, v, b"ContactInfo");
+    info.sub_filter = v.name(b"SubFilter").map(|s| String::from_utf8_lossy(s).into_owned());
+    info.signer = text(doc, v, b"Name");
+    info.certify = docmdp(doc, v);
+    let invalid = |info: &mut SignatureInfo, why: Detail| {
+        info.status = Status::Invalid;
+        info.details.push(why);
+    };
+    // Byte ranges: [0 a b c] with the gap holding exactly the hex /Contents.
+    let Some(br) = nums(doc, v, b"ByteRange").filter(|b| b.len() == 4 && b.iter().all(|x| *x >= 0.0)) else {
+        return invalid(info, Detail::plain("The signature has no valid byte range."));
+    };
+    let [o0, l0, o1, l1] = [br[0] as usize, br[1] as usize, br[2] as usize, br[3] as usize];
+    if o0 != 0 || o1 < l0 || o1.checked_add(l1).is_none_or(|end| end > bytes.len()) || o1 - l0 < 2 {
+        return invalid(info, Detail::plain("The signature's byte range does not match the file."));
+    }
+    let gap = &bytes[l0..o1];
+    if gap.first() != Some(&b'<') || gap.last() != Some(&b'>') {
+        return invalid(info, Detail::plain("The signature's byte range does not exclude exactly its contents."));
+    }
+    let Some(contents) = unhex(&gap[1..gap.len() - 1]) else { return invalid(info, Detail::plain("The signature contents are not hexadecimal.")) };
+    let covered = o1 + l1;
+    info.signed_len = covered;
+    // The signed revision's number: its cross-reference sections (1 for a reconstructed file).
+    info.revision = cache.revision(doc, bytes, covered).map_or(1, |d| d.revisions().len().max(1));
+    // What can't be checked is unknown, not invalid: only data that is wrong or fails its check
+    // is "invalid".
+    let unsupported = |info: &mut SignatureInfo, why: &str| {
+        info.status = Status::Unknown;
+        // What is not supported yet is named by the reader, in its own words.
+        info.details.push(Detail::of("PdfCraft can't check this signature yet: {}.", Fill::Reason(why.to_owned())));
+    };
+    if info.sub_filter.as_deref() == Some("adbe.x509.rsa_sha1") {
+        return validate_x509_rsa_sha1(doc, bytes, trust, v, info, cache, (l0, o1, covered), &contents);
+    }
+    let sd = match SignedData::parse(&contents) {
+        Ok(sd) => sd,
+        Err(SignError::Unsupported(e)) => return unsupported(info, &e),
+        // What the reader made of it goes in as it stands: it is a developer's detail, not a sentence.
+        Err(e) => return invalid(info, Detail::of("The signature could not be read ({}).", Fill::Reason(e.to_string()))),
+    };
+    let s = &sd.signer;
+    // A quirk is a whole sentence the reader words for itself, so it goes on the list in `WORDINGS`.
+    info.details.extend(sd.quirks.iter().copied().map(Detail::plain));
+    info.digest = Some(s.digest);
+    info.timestamp = s.timestamp;
+    let mut unverified_time = None;
+    if let Some(raw) = &s.timestamp_token {
+        match crate::timestamp::parse_token(raw) {
+            Ok(t) => {
+                let imprint = t.digest.digest(&[&s.signature]);
+                if imprint != t.imprint {
+                    info.details.push(Detail::plain("The signature's timestamp token does not cover the signature value."));
+                } else {
+                    // Only a token from a trusted authority (valid when it stamped) is trusted
+                    // time; otherwise its time is reported but validation uses the signer's
+                    // own claimed time, as without a timestamp.
+                    let mut pool = crate::timestamp::token_certs(raw);
+                    pool.extend(trust.certs.iter().cloned());
+                    let tsa = t.signer_certificate();
+                    let trusted_tsa = tsa
+                        .as_ref()
+                        .is_some_and(|c| c.valid_at(t.gen_time) && build_chain(c, &pool, Some(t.gen_time)).iter().any(|x| trust.trusts(x)));
+                    if !trusted_tsa {
+                        unverified_time = Some(t.gen_time);
+                    } else if tsa.as_ref().is_some_and(Certificate::may_timestamp) {
+                        info.timestamp_time = Some(t.gen_time);
+                    } else {
+                        info.details.push(Detail::plain("The timestamp authority's certificate is not issued for time stamping."));
+                    }
+                }
+            }
+            Err(e) => info.details.push(Detail::of("The signature's timestamp token could not be verified ({}).", Fill::Reason(e.to_string()))),
+        }
+    }
+    // The digest the signature commits to.
+    let content_digest = match &sd.content {
+        // adbe.pkcs7.sha1: the document's SHA-1 digest is the signed content.
+        Some(c) => {
+            if *c != cache.digest(DigestAlg::Sha1, bytes, l0, o1, covered) {
+                return invalid(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
+            }
+            s.digest.digest(&[c])
+        }
+        None => cache.digest(s.digest, bytes, l0, o1, covered),
+    };
+    // With signed attributes the signature is made over them, not over the document: their
+    // message digest is what ties it to the signed bytes, and their content type says what those
+    // bytes are (data, for a document). RFC 5652 §5.3 requires both.
+    if s.signed_attrs.is_some() {
+        match s.content_type.as_deref() {
+            Some(crate::cms::DATA) => {}
+            Some(_) => {
+                return invalid(
+                    info,
+                    Detail::plain("The signature's signed attributes name a content type other than data, so it is not a signature of the document."),
+                );
+            }
+            None => {
+                info.details.push(Detail::plain("The signature's signed attributes have no content type, which CMS requires; it was read anyway."))
+            }
+        }
+        if s.message_digest.is_none() {
+            return invalid(
+                info,
+                Detail::plain("The signature's signed attributes have no message digest, so the signature does not cover the document."),
+            );
+        }
+    }
+    // A PDF signature signs data: the document, or (adbe.pkcs7.sha1) its digest. A content-type
+    // attribute was checked above, and `SignedData::parse` refuses one that differs from
+    // `eContentType`; without that attribute, `eContentType` is the only place that says so.
+    if sd.econtent_type != crate::cms::DATA {
+        let why = SignError::Malformed("CMS: the encapsulated content is not data".into());
+        return invalid(info, Detail::of("The signature could not be read ({}).", Fill::Reason(why.to_string())));
+    }
+    if let Some(md) = &s.message_digest
+        && *md != content_digest
+    {
+        return invalid(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
+    }
+    let Some(cert) = sd.signer_certificate().cloned() else {
+        return invalid(info, Detail::plain("The signer's certificate is not in the signature."));
+    };
+    info.algorithm = Some(format!("{} with {}", cert.public_key.describe(), s.scheme_digest.unwrap_or(s.digest).name()));
+    info.signer = Some(cert.display_name());
+    let mut notes = Vec::new();
+    match sd.verify_signature_noting(&cert, &content_digest, &mut notes) {
+        // A note is a whole sentence the reader words for itself, like a quirk.
+        Ok(true) => info.details.extend(notes.into_iter().map(Detail::plain)),
+        Ok(false) => {
+            info.certificate = Some(cert);
+            return invalid(info, Detail::plain("The signature value does not match the signer's certificate: the signature is corrupt."));
+        }
+        Err(SignError::Unsupported(e)) => {
+            info.certificate = Some(cert);
+            return unsupported(info, &e);
+        }
+        Err(e) => {
+            info.certificate = Some(cert);
+            return invalid(info, Detail::of("The signature could not be checked ({}).", Fill::Reason(e.to_string())));
+        }
+    }
+    finish_validation(doc, bytes, trust, info, cache, covered, cert, &sd.certificates, s.signing_time, unverified_time);
+}
+
+/// The verdict once the signature value has been checked: chain and trust, the signing time
+/// against the certificate's validity, and what later revisions changed.
+#[allow(clippy::too_many_arguments)]
+fn finish_validation(
+    doc: &Document,
+    bytes: &[u8],
+    trust: &TrustStore,
+    info: &mut SignatureInfo,
+    cache: &DigestCache,
+    covered: usize,
+    cert: Certificate,
+    embedded: &[Certificate],
+    cms_time: Option<Time>,
+    unverified_time: Option<Time>,
+) {
+    info.signing_time = cms_time.or_else(|| info.date.as_deref().and_then(Time::from_pdf));
+    let mut pool = embedded.to_vec();
+    pool.extend(trust.certs.iter().cloned());
+    // The time the chain is judged at: trusted timestamp, else the signer's claimed time.
+    let at = info.timestamp_time.or(info.signing_time);
+    let (chain, refused) = build_chain_noted(&cert, &pool, at);
+    let chain: Vec<Certificate> = chain.into_iter().cloned().collect();
+    let trusted = chain.iter().any(|c| trust.trusts(c));
+    info.chain = chain;
+    info.certificate = Some(cert.clone());
+    if let Some(why) = refused
+        && !trusted
+    {
+        info.details.push(why);
+    }
+    // Revocation evidence embedded in the document security store, if any. A verified
+    // revocation is final: later blocks must not soften the verdict.
+    let signer = info.chain.first().cloned();
+    let revocation = check_dss_revocation(doc, signer.as_ref(), &at, info);
+    let revoked = revocation == DssRevocation::Revoked;
+    // Changes after signing.
+    info.modification = if covered == bytes.len() || bytes[covered..].iter().all(|b| b.is_ascii_whitespace() || *b == 0) {
+        Modification::None
+    } else {
+        // The permissions are the signed revision's: a later one can rewrite `/P` (#1788). This
+        // signature is the one whose byte range ends that revision.
+        let old = cache.revision(doc, bytes, covered);
+        if let Some(old) = &old
+            && let Some(v) = sig_fields(old)
+                .iter()
+                .filter_map(|f| f.signature(old))
+                .find(|v| nums(old, v, b"ByteRange").is_some_and(|b| b.len() == 4 && b[2] + b[3] == covered as f64))
+        {
+            info.certify = docmdp(old, &v);
+        }
+        classify_changes(doc, old, info.certify)
+    };
+    let mut problems = false;
+    // The changes are handed over as the words they are, not stitched into the sentence, so an
+    // interface can say both in its own language.
+    match &info.modification {
+        Modification::None => info.details.push(Detail::plain("This document has not been modified since this signature was applied.")),
+        Modification::Allowed(kinds) => info.details.push(Detail::of(
+            "The document has been modified since this signature was applied, but the changes are permitted ({}).",
+            Fill::Changes(kinds.clone()),
+        )),
+        Modification::Disallowed(kinds) => {
+            let said = Detail::of(
+                "The document has been altered since this signature was applied in ways it does not permit ({}).",
+                Fill::Changes(kinds.clone()),
+            );
+            info.status = Status::Invalid;
+            info.details.push(said);
+            problems = true;
+        }
+    }
+    if revocation == DssRevocation::Incomplete {
+        if !problems {
+            info.status = Status::Unknown;
+        }
+        problems = true;
+    }
+    if let Some(t) = info.timestamp_time.or(info.signing_time)
+        && !cert.valid_at(t)
+    {
+        info.details.push(Detail::plain("The signer's certificate was not valid at the time of signing."));
+        // A verified revocation already made the signature invalid; keep it that way.
+        if !problems && !revoked {
+            info.status = Status::Unknown;
+        }
+        problems = true;
+    }
+    if let Some(why) = cert.signing_problem() {
+        info.details.push(why);
+        if !problems && !revoked {
+            info.status = Status::Unknown;
+        }
+        problems = true;
+    }
+    if !trusted {
+        info.details.push(Detail::plain(
+            "The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.",
+        ));
+        if !problems && !revoked {
+            info.status = Status::Unknown;
+        }
+    } else {
+        info.details.push(Detail::plain("The signer's identity is valid."));
+        if !problems && !revoked {
+            info.status = Status::Valid;
+        }
+    }
+    if info.timestamp {
+        info.details.push(Detail::plain("The signature includes an embedded timestamp."));
+    } else {
+        info.details.push(Detail::plain("Signing time is from the clock on the signer's computer."));
+    }
+    if let Some(t) = info.timestamp_time {
+        info.details
+            .push(Detail::of("The embedded timestamp token is valid and its authority is trusted; trusted time is {}.", Fill::Value(t.to_string())));
+    } else if let Some(t) = unverified_time {
+        info.details.push(Detail::of(
+            "The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.",
+            Fill::Value(t.to_string()),
+        ));
+    }
+}
+
+/// Distinct evidence streams read from one `/DSS` array.
+pub(crate) const MAX_DSS_ENTRIES: usize = 1024;
+
+/// Decoded bytes read from one `/DSS` array; real CRLs and OCSP responses are kilobytes each.
+pub(crate) const MAX_DSS_BYTES: usize = 64 << 20;
+
+/// The decoded streams of the `/DSS` evidence array `key` (`/CRLs`, `/OCSPs`), one at a time so
+/// each is checked before the next decodes: each stream once and within the evidence size cap,
+/// at most [`MAX_DSS_ENTRIES`] distinct ones and [`MAX_DSS_BYTES`] together. A stream past a cap
+/// sets [`DssEvidence::cut`] and ends the iteration.
+pub(crate) struct DssEvidence<'a> {
+    doc: &'a Document,
+    items: std::vec::IntoIter<Object>,
+    seen: HashSet<ObjRef>,
+    taken: usize,
+    left: usize,
+    /// A cap stopped the array being read in full.
+    pub(crate) cut: bool,
+}
+
+impl<'a> DssEvidence<'a> {
+    pub(crate) fn new(doc: &'a Document, dss: &Dict, key: &[u8]) -> Self {
+        let items = dss.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
+        DssEvidence { doc, items: items.into_iter(), seen: HashSet::new(), taken: 0, left: MAX_DSS_BYTES, cut: false }
+    }
+}
+
+impl Iterator for DssEvidence<'_> {
+    type Item = Vec<u8>;
+
+    fn next(&mut self) -> Option<Vec<u8>> {
+        if self.cut {
+            return None;
+        }
+        // Repeats are skipped before the caps count anything, so repeating one stream cannot use
+        // them up; the scan of the array itself is bounded by the parser's cap on array length.
+        for item in self.items.by_ref() {
+            if item.as_ref().is_some_and(|r| !self.seen.insert(r)) {
+                continue;
+            }
+            let o = self.doc.resolve(&item);
+            let Object::Stream(s) = o.as_ref() else { continue };
+            if self.taken >= MAX_DSS_ENTRIES {
+                self.cut = true;
+                return None;
+            }
+            self.taken += 1;
+            // A stream past the evidence cap would not parse as evidence either.
+            let Ok(bytes) = s.decoded_within(crate::revocation::MAX_EVIDENCE) else { continue };
+            let Some(left) = self.left.checked_sub(bytes.len()) else {
+                self.cut = true;
+                return None;
+            };
+            self.left = left;
+            return Some(bytes);
+        }
+        None
+    }
+}
+
+/// What the catalog's `/DSS` says about the signer's certificate.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum DssRevocation {
+    /// Verified evidence revokes it.
+    Revoked,
+    /// A cap stopped the evidence being read in full, and what was read does not revoke it.
+    Incomplete,
+    /// All of the evidence was read, and none of it revokes it.
+    NotRevoked,
+}
+
+/// Check the revocation evidence in the catalog's `/DSS` against the signer's chain at `at`.
+/// Only evidence whose signature verifies against the issuer counts; returns whether the
+/// certificate is revoked (which invalidates the signature), or whether a cap kept the check from
+/// reading all of the evidence.
+fn check_dss_revocation(doc: &Document, signer: Option<&Certificate>, at: &Option<Time>, info: &mut SignatureInfo) -> DssRevocation {
+    use crate::revocation::{CertificateList, OcspResponse, RevocationStatus};
+    let (Some(signer), Some(at)) = (signer, *at) else { return DssRevocation::NotRevoked };
+    let Some(root) = doc.root() else { return DssRevocation::NotRevoked };
+    let Some(dss) = doc.get(root).as_dict().and_then(|c| c.get(b"DSS").cloned()).map(|d| doc.resolve(&d)).and_then(|d| d.as_dict().cloned()) else {
+        return DssRevocation::NotRevoked;
+    };
+    let issuer = info.chain.get(1).unwrap_or(signer);
+    // A verified revocation wins; "good" from any covering evidence is reported, but never
+    // contradicts a revocation.
+    let mut revoked = None;
+    let mut covered = false;
+    let mut sources = Vec::new();
+    let mut crls = DssEvidence::new(doc, &dss, b"CRLs");
+    for r in crls.by_ref() {
+        let Ok(list) = CertificateList::parse(&r) else { continue };
+        sources.push("CRL");
+        match list.check(signer, issuer, at) {
+            RevocationStatus::Revoked { at } => {
+                revoked = Some(at);
+                break;
+            }
+            RevocationStatus::Good => covered = true,
+            RevocationStatus::Unknown => {}
+        }
+    }
+    let mut cut = crls.cut;
+    if revoked.is_none() {
+        let mut ocsps = DssEvidence::new(doc, &dss, b"OCSPs");
+        for r in ocsps.by_ref() {
+            let Ok(resp) = OcspResponse::parse(&r) else { continue };
+            sources.push("OCSP");
+            match resp.check(signer, issuer, at) {
+                RevocationStatus::Revoked { at } => {
+                    revoked = Some(at);
+                    break;
+                }
+                RevocationStatus::Good => covered = true,
+                RevocationStatus::Unknown => {}
+            }
+        }
+        cut |= ocsps.cut;
+    }
+    match revoked {
+        Some(at) => {
+            info.status = Status::Invalid;
+            // The evidence and the date go in together: one hole, so a reader can put the
+            // sentence's parts in whatever order its language wants.
+            info.details.push(Detail::of("The signer's certificate has been revoked ({}).", Fill::Value(format!("{}, {at}", sources.join(", ")))));
+            DssRevocation::Revoked
+        }
+        // Evidence past a cap may revoke the certificate, so a partial check proves nothing.
+        None if cut => {
+            info.details.push(Detail::of(
+                "The signature could not be checked ({}).",
+                Fill::Reason("the /DSS holds more revocation evidence than PdfCraft reads".into()),
+            ));
+            DssRevocation::Incomplete
+        }
+        None if covered => {
+            info.details
+                .push(Detail::plain("The document's embedded revocation information shows that the signer's certificate has not been revoked."));
+            DssRevocation::NotRevoked
+        }
+        None => DssRevocation::NotRevoked,
+    }
+}
+
+/// Validate a standalone document timestamp dictionary (`/ETSI.RFC3161`): the token must be
+/// cryptographically valid and its message imprint must cover the file's signed bytes.
+pub(super) fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut SignatureInfo, cache: &DigestCache, trust: &TrustStore) {
+    info.date = text(doc, v, b"M");
+    let invalid = |info: &mut SignatureInfo, why: Detail| {
+        info.status = Status::Invalid;
+        info.details.push(why);
+    };
+    let Some(br) = nums(doc, v, b"ByteRange").filter(|b| b.len() == 4 && b.iter().all(|x| *x >= 0.0)) else {
+        return invalid(info, Detail::plain("The timestamp has no valid byte range."));
+    };
+    let [o0, l0, o1, l1] = [br[0] as usize, br[1] as usize, br[2] as usize, br[3] as usize];
+    if o0 != 0 || o1 < l0 || o1.checked_add(l1).is_none_or(|end| end > bytes.len()) || o1 - l0 < 2 {
+        return invalid(info, Detail::plain("The timestamp's byte range does not match the file."));
+    }
+    let gap = &bytes[l0..o1];
+    if gap.first() != Some(&b'<') || gap.last() != Some(&b'>') {
+        return invalid(info, Detail::plain("The timestamp's byte range does not exclude exactly its contents."));
+    }
+    let Some(contents) = unhex(&gap[1..gap.len() - 1]) else {
+        return invalid(info, Detail::plain("The timestamp contents are not hexadecimal."));
+    };
+    let covered = o1 + l1;
+    info.signed_len = covered;
+    info.revision = cache.revision(doc, bytes, covered).map_or(1, |d| d.revisions().len().max(1));
+    let token = match crate::timestamp::parse_token(&contents) {
+        Ok(t) => t,
+        Err(e) => return invalid(info, Detail::of("The timestamp token could not be read ({}).", Fill::Reason(e.to_string()))),
+    };
+    info.digest = Some(token.digest);
+    info.timestamp_time = Some(token.gen_time);
+    info.algorithm = Some(format!("RFC 3161 timestamp ({})", token.digest.name()));
+    let doc_digest = token.digest.digest(&[&bytes[..l0], &bytes[o1..covered]]);
+    if doc_digest != token.imprint {
+        return invalid(info, Detail::plain("The document has been altered or corrupted since the timestamp was applied."));
+    }
+    if let Some(cert) = token.signer_certificate() {
+        info.signer = Some(cert.display_name());
+        info.certificate = Some(cert.clone());
+        if !cert.valid_at(token.gen_time) {
+            info.status = Status::Unknown;
+            info.details.push(Detail::plain("The timestamp authority's certificate was not valid at the time of timestamping."));
+        }
+        if !cert.may_timestamp() {
+            info.status = Status::Unknown;
+            info.details.push(Detail::plain("The timestamp authority's certificate is not issued for time stamping."));
+        }
+    }
+    info.modification = if covered == bytes.len() || bytes[covered..].iter().all(|b| b.is_ascii_whitespace() || *b == 0) {
+        Modification::None
+    } else {
+        classify_changes(doc, cache.revision(doc, bytes, covered), None)
+    };
+    match &info.modification {
+        Modification::None => info.details.push(Detail::plain("This document has not been modified since this timestamp was applied.")),
+        Modification::Allowed(kinds) => info.details.push(Detail::of(
+            "The document has been modified since this timestamp was applied, but the changes are permitted ({}).",
+            Fill::Changes(kinds.clone()),
+        )),
+        Modification::Disallowed(kinds) => {
+            info.status = Status::Invalid;
+            info.details.push(Detail::of(
+                "The document has been altered since this timestamp was applied in ways it does not permit ({}).",
+                Fill::Changes(kinds.clone()),
+            ));
+        }
+    }
+    if info.status != Status::Invalid {
+        // An untrusted TSA is not proof of anything: the verdict stays Unknown, like an
+        // ordinary signature from an unknown signer.
+        let mut pool = crate::timestamp::token_certs(&contents);
+        pool.extend(trust.certs.iter().cloned());
+        // A trusted authority whose certificate was not valid at the time it stamped proves
+        // nothing either (its detail is already recorded above): never upgrade that to Valid.
+        // Nor does one whose certificate is not issued for time stamping.
+        let may_stamp = token.signer_certificate().is_some_and(|c| c.valid_at(token.gen_time) && c.may_timestamp());
+        let trusted_tsa = token.signer_certificate().is_some_and(|c| build_chain(&c, &pool, Some(token.gen_time)).iter().any(|x| trust.trusts(x)));
+        if trusted_tsa && may_stamp {
+            info.status = Status::Valid;
+            info.details.push(Detail::plain("The timestamp token is valid and its authority is trusted."));
+        } else if trusted_tsa {
+            info.status = Status::Unknown;
+        } else {
+            info.status = Status::Unknown;
+            info.details
+                .push(Detail::plain("The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates."));
+        }
+    }
+}
+
+/// The DER `/Contents` of every signature dictionary in the file (field signatures and
+/// document timestamps), for `/VRI` keys and evidence selection.
+pub(crate) fn signature_contents(doc: &Document) -> Vec<Vec<u8>> {
+    let mut out = Vec::new();
+    let mut seen: HashSet<ObjRef> = HashSet::new();
+    let mut add = |d: &Dict, r: Option<ObjRef>| {
+        if let Some(r) = r
+            && !seen.insert(r)
+        {
+            return;
+        }
+        let contents = d.get(b"Contents").map(|c| doc.resolve(c));
+        let Some(s) = contents.as_deref().and_then(Object::as_string) else { return };
+        // Hex strings decode to the DER when parsed; a literal string carries hex text.
+        let der = if s.hex { Some(s.bytes.clone()) } else { unhex(&s.bytes) };
+        if let Some(der) = der {
+            out.push(der);
+        }
+    };
+    for f in sig_fields(doc) {
+        if let Some(v) = f.dict.get(b"V") {
+            let d = doc.resolve(v);
+            if let Some(dd) = d.as_dict() {
+                add(dd, v.as_ref());
+            }
+        }
+    }
+    for (r, o) in doc.scan_objects() {
+        let Some(d) = o.as_dict() else { continue };
+        if is_doc_timestamp(d) {
+            add(d, Some(r));
+        }
+    }
+    out
+}
+
+/// `adbe.x509.rsa_sha1` (ISO 32000-2 §12.8.3.2, deprecated): `/Contents` is the PKCS #1
+/// signature as a DER OCTET STRING over the SHA-1 digest of the byte ranges, and `/Cert` holds the
+/// signer's certificate (then any others) as DER byte strings.
+#[allow(clippy::too_many_arguments)]
+fn validate_x509_rsa_sha1(
+    doc: &Document,
+    bytes: &[u8],
+    trust: &TrustStore,
+    v: &Dict,
+    info: &mut SignatureInfo,
+    cache: &DigestCache,
+    (l0, o1, covered): (usize, usize, usize),
+    contents: &[u8],
+) {
+    let fail = |info: &mut SignatureInfo, why: Detail| {
+        info.status = Status::Invalid;
+        info.details.push(why);
+    };
+    let certs: Vec<Certificate> = match v.get(b"Cert").map(|c| doc.resolve(c)).as_deref() {
+        Some(Object::Array(a)) => a.iter().filter_map(|c| doc.resolve(c).as_string().map(|s| s.bytes.clone())).collect::<Vec<_>>(),
+        Some(Object::String(s)) => vec![s.bytes.clone()],
+        _ => Vec::new(),
+    }
+    .iter()
+    .filter_map(|raw| Certificate::parse(raw).ok())
+    .collect();
+    let Some(cert) = certs.first().cloned() else { return fail(info, Detail::plain("The signer's certificate is not in the signature.")) };
+    let signature = match crate::der::Tlv::parse_ber(contents).and_then(|(t, _)| t.octets("signature").map(|o| o.into_owned())) {
+        Ok(sig) => sig,
+        // What the reader made of it goes in as it stands: it is a developer's detail, not a sentence.
+        Err(e) => return fail(info, Detail::of("The signature could not be read ({}).", Fill::Reason(e.to_string()))),
+    };
+    info.digest = Some(DigestAlg::Sha1);
+    info.algorithm = Some(format!("{} with SHA-1", cert.public_key.describe()));
+    info.signer = Some(cert.display_name());
+    let digest = cache.digest(DigestAlg::Sha1, bytes, l0, o1, covered);
+    let mut notes = Vec::new();
+    match cert.public_key.verify_noting(crate::keys::Scheme::RsaPkcs1, DigestAlg::Sha1, &digest, &signature, &mut notes) {
+        // A note is a whole sentence the reader words for itself, so it goes on the list in `WORDINGS`.
+        Ok(true) => info.details.extend(notes.into_iter().map(Detail::plain)),
+        Ok(false) => {
+            info.certificate = Some(cert);
+            return fail(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
+        }
+        // Only what PdfCraft doesn't support yet is "can't check"; a key or value that is
+        // malformed is a signature that doesn't verify (as on the CMS path).
+        Err(SignError::Unsupported(e)) => {
+            info.certificate = Some(cert);
+            info.status = Status::Unknown;
+            // What is not supported yet is named by the reader, in its own words.
+            info.details.push(Detail::of("PdfCraft can't check this signature yet: {}.", Fill::Reason(e.to_string())));
+            return;
+        }
+        Err(e) => {
+            info.certificate = Some(cert);
+            return fail(info, Detail::of("The signature could not be verified ({}).", Fill::Reason(e.to_string())));
+        }
+    }
+    info.details.push(Detail::plain("The signature uses the legacy adbe.x509.rsa_sha1 format."));
+    info.details.extend(DigestAlg::Sha1.weakness().map(Detail::plain));
+    finish_validation(doc, bytes, trust, info, cache, covered, cert, &certs, None, None);
+}
diff --git a/crates/sign/tests/it/pdf.rs b/crates/sign/tests/it/pdf.rs
index d71e616ce7..2ebb27d2a5 100644
--- a/crates/sign/tests/it/pdf.rs
+++ b/crates/sign/tests/it/pdf.rs
@@ -2,7 +2,7 @@
 
 use std::sync::Arc;
 
-use pdfcraft_cos::{Document, Object, PdfString, SaveOptions, write_incremental};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, SaveOptions, write_incremental};
 use pdfcraft_sign::{
     Certificate, Detail, DigitalId, Modification, Name, SignError, SignOptions, Status, Time, TimestampAuthority, TrustStore, WORDINGS, der,
     in_english, kind, pkcs12, signatures,
@@ -815,6 +815,71 @@ fn sign_then_ltv_then_timestamp_makes_a_b_lta_file() {
     assert_eq!(stamp.status, Status::Valid, "{:?}", stamp.details);
 }
 
+/// A redaction mark and a reply to it, added to the page and removed again before signing (what
+/// clearing a mark leaves behind), are in none of the signing outputs: a signature, a timestamped
+/// one, embedded revocation evidence or a document timestamp. Nothing can take them out of a
+/// signed revision afterwards. Each output still validates.
+#[test]
+fn what_was_removed_before_signing_is_not_signed() {
+    use pdfcraft_sign::dss::{self, Evidence};
+    let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
+    let tsa = TestTsa { id: tsa_id(), time: Time { year: 2026, month: 10, day: 6, hour: 12, minute: 0, second: 0 } };
+    let anchor = id.chain.first().cloned().unwrap_or_else(|| id.certificate.clone());
+    let trust = TrustStore { certs: vec![anchor, tsa.id.certificate.clone()] };
+    let text = |s: &str| Object::String(PdfString::literal(s.as_bytes().to_vec()));
+    let dict = |entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        entries.iter().for_each(|(k, v)| d.set(k.as_bytes().to_vec(), v.clone()));
+        Object::Dict(d)
+    };
+    let cleared = |bytes: &[u8]| {
+        let mut doc = open(bytes);
+        let page = ObjRef::new(3, 0);
+        let annots = doc.get(page).as_dict().and_then(|d| d.get(b"Annots").cloned()).unwrap();
+        let mark = doc.add(dict(&[
+            ("Type", Object::name("Annot")),
+            ("Subtype", Object::name("Redact")),
+            ("Rect", Object::Array([80, 140, 100, 180].map(Object::Int).to_vec())),
+            ("OverlayText", text("MARKED OVERLAY")),
+            ("T", text("Mark Author")),
+            ("P", Object::Ref(page)),
+        ]));
+        let reply = doc.add(dict(&[
+            ("Type", Object::name("Annot")),
+            ("Subtype", Object::name("Text")),
+            ("IRT", Object::Ref(mark)),
+            ("Contents", text("REPLY TO THE MARK")),
+            ("T", text("Replier")),
+        ]));
+        let mut with = annots.as_array().cloned().unwrap();
+        with.extend([Object::Ref(mark), Object::Ref(reply)]);
+        doc.update_dict(page, |d| d.set(b"Annots".to_vec(), Object::Array(with))).unwrap();
+        doc.update_dict(page, |d| d.set(b"Annots".to_vec(), annots.clone())).unwrap();
+        doc
+    };
+    let unsigned = fixture();
+    let signed = pdfcraft_sign::sign(&open(&unsigned), &id, &opts()).unwrap();
+    let evidence = Evidence { certs: vec![id.certificate.raw.clone()], ocsps: Vec::new(), crls: Vec::new() };
+    let outputs = [
+        ("sign", &unsigned, pdfcraft_sign::sign(&cleared(&unsigned), &id, &opts()).unwrap()),
+        ("sign_with_timestamp", &unsigned, pdfcraft_sign::sign_with_timestamp(&cleared(&unsigned), &id, &opts(), &tsa).unwrap()),
+        ("dss::embed", &signed, dss::embed(&cleared(&signed), &evidence).unwrap()),
+        ("timestamp_document", &unsigned, pdfcraft_sign::timestamp_document(&cleared(&unsigned), &tsa, "D:20261006120000Z").unwrap()),
+    ];
+    for (what, input, out) in outputs {
+        assert!(out.starts_with(input), "{what}: an incremental update");
+        let holds = |s: &str| out.windows(s.len()).any(|w| w == s.as_bytes());
+        for trace in ["/Redact", "MARKED OVERLAY", "Mark Author", "REPLY TO THE MARK", "Replier"] {
+            assert!(!holds(trace), "{what} wrote {trace:?}");
+        }
+        let doc = open(&out);
+        assert!(doc.repair_log().is_empty(), "{what}: {:?}", doc.repair_log());
+        let all: Vec<_> = signatures(&doc, &out, &trust).into_iter().filter(|s| s.signed).collect();
+        assert_eq!(all.iter().filter(|s| s.doc_timestamp).count(), usize::from(what == "timestamp_document"), "{what}");
+        assert!(!all.is_empty() && all.iter().all(|s| s.status == Status::Valid), "{what}: {all:?}");
+    }
+}
+
 #[test]
 fn an_embedded_verified_revocation_invalidates_the_signature() {
     use pdfcraft_sign::dss::{self, Evidence};
@@ -2491,7 +2556,17 @@ fn appearance_label_outside_helvetica_is_refused_beside_an_embedded_font_name()
 /// the files. An interface then has these to translate and only these.
 #[test]
 fn wordings_are_complete() {
-    let source = include_str!("../../src/pdf.rs");
+    // `pdf.rs` and the modules it was split into, read as one text.
+    let source = [
+        include_str!("../../src/pdf.rs"),
+        include_str!("../../src/pdf/changes.rs"),
+        include_str!("../../src/pdf/listing.rs"),
+        include_str!("../../src/pdf/signing.rs"),
+        include_str!("../../src/pdf/types.rs"),
+        include_str!("../../src/pdf/validate.rs"),
+    ]
+    .concat();
+    let source = source.as_str();
     // The modules below `pdf` word whole sentences too: how a signature value had to be read, and
     // what a certificate does not allow.
     let elsewhere = [
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 39eaff6076..804b5ea22a 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -11,7 +11,11 @@ workspace = true
 
 [dependencies]
 craft-ui = { workspace = true }
-# macOS: a window close quits through `terminate:` (the Touch Bar crash, #1136); elsewhere a no-op.
+# The menus: native on macOS, an egui bar elsewhere, from one definition (menus.rs).
+craft-menu = { workspace = true }
+craft-keymap = { workspace = true }
+# Quit from the menus asks the window to close, so the unsaved-changes check runs; on macOS a window
+# close also quits through `terminate:` (the Touch Bar crash, #1136).
 craft-quit = { workspace = true, features = ["egui"] }
 pdfcraft-fonts = { workspace = true }
 pdfcraft-engine = { workspace = true }
@@ -19,28 +23,32 @@ pdfcraft-cos = { workspace = true }
 pdfcraft-render = { workspace = true }
 pdfcraft-model = { workspace = true }
 pdfcraft-platform = { workspace = true }
-egui = { workspace = true, features = ["bytemuck"] }
+egui = { workspace = true, features = ["bytemuck", "default_fonts", "monochrome_emoji_fonts"] }
 egui_extras = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "persistence", "links"] }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "persistence", "links", "clipboard"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 # UTC/calendar display (combine modified-time stamp, the form date picker) goes through chrono
 # (no hand-rolled calendar code); std-only, so it stays wasm-safe.
 chrono = { workspace = true }
+# Monotonic deadlines for work that runs in `logic` with no UI pass (native and web).
+web-time = { workspace = true }
 # Hands rendered rasters to egui as its pixels, without copying; already in the tree through egui and wgpu.
 bytemuck = { version = "1", features = ["extern_crate_alloc"] }
 
 rfd = { workspace = true }
 png = "0.18"
-base64 = "0.22"
-# Right-to-left file names in the chrome (egui shapes but does not reorder); already in the tree.
+base64 = "0.23"
+# Unicode bidi paragraph segmentation for right-to-left comment wrapping; egui 0.37's epaint owns
+# display reordering. Already in the tree through egui’s epaint.
 unicode-bidi = "0.3"
 # Checks that an installed fallback font parses and has the glyphs, and reads the vertical metrics
 # that put fallback faces on the interface's baseline (#1676); the same skrifa egui uses.
 skrifa = "0.44"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+craft-update = { workspace = true }
 # Control-channel tokens.
 getrandom = "0.4"
 # Create ▸ Clipboard (images; already in the tree through egui-winit).
@@ -79,8 +87,12 @@ js-sys = "0.3"
 web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "HtmlIFrameElement", "HtmlImageElement", "HtmlCollection", "Node", "EventTarget", "Navigator"] }
 
 [dev-dependencies]
+craft-update = { workspace = true }
 pdfcraft-xfa = { workspace = true }
 egui_kittest = { workspace = true, features = ["eframe", "wgpu"] }
+# Tests draw PdfCraft text without a system provider: the bundled and monochrome emoji faces must
+# be enabled on the test graph itself (a dependency's dev-features do not propagate).
+egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
 image = { version = "0.25", default-features = false, features = ["png"] }
 # Glyph-coverage test of the interface fonts; the same skrifa pdfcraft-fonts already uses.
 skrifa = "0.44"
diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
new file mode 100644
index 0000000000..8925a0dca1
--- /dev/null
+++ b/crates/ui-egui/src/app.rs
@@ -0,0 +1,610 @@
+use super::hooks::OsEvent;
+use super::state::{
+    Dialog, DocumentCopyJob, GridFile, LeftPanel, LinkOrigin, Mode, NumberDraft, PasswordPrompt, PendingLink, PropsTab, QuickTool, RecentFile,
+    RightPanel, UnlockPrompt,
+};
+#[cfg(not(target_arch = "wasm32"))]
+use super::state::{OpenOutcome, OpenRequest, PendingRemoteLink};
+use super::*;
+
+mod clipboard;
+mod commands;
+mod control;
+mod files;
+mod frame;
+mod input;
+mod keys;
+mod links;
+mod prefs;
+mod window;
+
+pub(crate) use clipboard::{copy_refused, print_refused};
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) use files::same_file;
+use frame::migrate_panel_state;
+pub(crate) use prefs::{MAX_AUTHOR_CHARS, date_text_for_pdf};
+
+impl Default for PdfCraftApp {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl PdfCraftApp {
+    /// Construct an application with the default session, panels, theme and control state.
+    pub fn new() -> Self {
+        Self {
+            session: Session::new(),
+            views: Vec::new(),
+            closed_tabs: Vec::new(),
+            active: None,
+            mode: Mode::AllTools,
+            default_mode: Mode::AllTools,
+            view_defaults: Default::default(),
+            units: Default::default(),
+            date_format_draft: None,
+            mode_override: None,
+            left: LeftPanel::AllTools,
+            side_panels: Default::default(),
+            left_open: true,
+            right: None,
+            last_right: RightPanel::Comments,
+            right_before_read: None,
+            comments_panel_closed: false,
+            right_panel_closed: false,
+            quick_tool: QuickTool::Select,
+            space_hand: None,
+            full_screen_tool: None,
+            comment_prefs: Default::default(),
+            theme: ThemeKind::Light,
+            // A fresh install follows the desktop's appearance (#1248); saved settings override.
+            theme_preference: ThemePreference::System,
+            reading_colors: Default::default(),
+            #[cfg(target_os = "linux")]
+            desktop_theme: None,
+            #[cfg(target_os = "linux")]
+            desktop_theme_enabled: false,
+            scroll_speed: scroll_speed::ScrollSpeed::default(),
+            animation_effects: motion::AnimationEffects::default(),
+            motion: motion::Motion::default(),
+            language: i18n::AUTO.to_string(),
+            ui_scale: None,
+            system_text_scale: 1.0,
+            ui_scale_applied: None,
+            flatten_fill_sign_on_save: false,
+            fill_text_size: fill_sign::TEXT_SIZE,
+            dialog: None,
+            updates: updates::Updates::default(),
+            printer_source: None,
+            options_source: None,
+            print_tasks: print_ui::PrintTasks::default(),
+            palette_open: false,
+            palette_query: String::new(),
+            all_tools_expanded: false,
+            all_tools_full: false,
+            all_tools_query: String::new(),
+            all_tools_tab: (None, false),
+            recent: Vec::new(),
+            reopen_last_session: false,
+            restore_last_view: true,
+            last_views: Vec::new(),
+            last_session: Default::default(),
+            quit_session: None,
+            reload_changed_files: true,
+            show_secured_notice: true,
+            always_default_view: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            watch: Default::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            open_worker: None,
+            #[cfg(not(target_arch = "wasm32"))]
+            pending_opens: Vec::new(),
+            #[cfg(not(target_arch = "wasm32"))]
+            next_open_token: 0,
+            #[cfg(all(test, not(target_arch = "wasm32")))]
+            open_prepare_gate: None,
+            pinned: Default::default(),
+            toast: None,
+            integrated_titlebar: false,
+            window_controls: None,
+            system_title_bar: false,
+            app_frame_shown: None,
+            password_prompt: None,
+            document_copy: None,
+            unlock_prompt: None,
+            full_screen: false,
+            inbox: Default::default(),
+            startup_inbox: Default::default(),
+            startup_superseded: false,
+            failed_inbox: Default::default(),
+            unsaved_flag: Default::default(),
+            os_events: None,
+            host_save: None,
+            host_dirty: None,
+            close_request: None,
+            save_prompt_button: Default::default(),
+            save_prompt_seen: false,
+            save_prompt_attention: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            pending_overwrite: None,
+            save_override: None,
+            props_draft: None,
+            view_draft: None,
+            custom_draft: None,
+            requests: Default::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            pickers: Default::default(),
+            #[cfg(not(target_arch = "wasm32"))]
+            pick_override: None,
+            export_dir_override: None,
+            split_draft: SplitDraft::default(),
+            extract_draft: ExtractDraft::default(),
+            rotate_draft: RotateDraft::default(),
+            summary_sort: Default::default(),
+            sign_draft: None,
+            digital_ids: Vec::new(),
+            sig_expanded: Vec::new(),
+            a11y_options: a11y_ui::A11yOptions::default(),
+            ocr_draft: ocr_ui::OcrDraft::default(),
+            ocr_run: None,
+            ocr_batch: None,
+            run_inline: false,
+            custom_actions: Vec::new(),
+            wizard: Default::default(),
+            action_run: None,
+            action_files_override: None,
+            pdfa: Default::default(),
+            compare_old: None,
+            compare: None,
+            js_console: Default::default(),
+            doc_js: Default::default(),
+            a11y: a11y_ui::A11yState::default(),
+            tags_state: Default::default(),
+            a11y_skipped: Default::default(),
+            alt_draft: Default::default(),
+            os_key_store_ids: false,
+            cert_viewer: None,
+            space_audit: Vec::new(),
+            space_audit_of: None,
+            combine_draft: Vec::new(),
+            combine_conflicts: Default::default(),
+            combine_tab: Default::default(),
+            combine_columns: Default::default(),
+            combine_view: Default::default(),
+            combine_zoom: 1.0,
+            organize_zoom: 1.0,
+            combine_thumbs: Default::default(),
+            image_import: None,
+            custom_stamps: Vec::new(),
+            stamp_draft: Default::default(),
+            optimize_draft: OptimizeDraft::default(),
+            optimize_run: None,
+            progress_notice: None,
+            page_clipboard: None,
+            grid_drop: None,
+            last_snapshot: None,
+            last_copied_image: None,
+            last_copied_file: None,
+            system_clipboard: true,
+            clipboard_override: None,
+            v_pressed: false,
+            attach_override: None,
+            duplicate_draft: None,
+            field_table_draft: None,
+            form_preview: false,
+            window_title: String::new(),
+            recovery: None,
+            recoverable: Vec::new(),
+            recovery_keys: Default::default(),
+            last_autosave: None,
+            allow_quit: false,
+            deferred_commands: Vec::new(),
+            native_menu: None,
+            menu_input: Vec::new(),
+            dialog_seen: None,
+            dialog_epoch: 0,
+            ctx: None,
+            #[cfg(not(target_arch = "wasm32"))]
+            window_state: Default::default(),
+            styled: false,
+            fonts_ready: false,
+            fonts_cjk: theme::CjkPreference::Default,
+            control: None,
+            bookmark_rename: None,
+            last_opened_url: None,
+            community_card_closed: false,
+            pending_link: None,
+            pending_full_screen: None,
+            pending_remote_link: None,
+            protect_draft: Default::default(),
+            boxes_draft: Default::default(),
+            marks_draft: Default::default(),
+            export_draft: Default::default(),
+            export_status: None,
+            signature: None,
+            initials: None,
+            signature_draft: Default::default(),
+            signature_preview: None,
+            signature_photo: None,
+            saved_signature_previews: [None, None],
+            sign_graphic: sign_ui::SignGraphic::Name,
+            sign_graphic_preview: None,
+            #[cfg(target_arch = "wasm32")]
+            signature_images: Default::default(),
+            comment_props: None,
+            field_props: None,
+            bulk_field_props: None,
+            redact_prefs: RedactPrefs::default(),
+            redact_defaults: RedactPrefs::default(),
+            redact_before: None,
+            redact_pages_draft: RedactPagesDraft::default(),
+            redact_search: RedactSearchDraft::default(),
+            hidden_draft: HiddenDraft::default(),
+            print_draft: PrintDraft::default(),
+            link_draft: None,
+            text_style: content_ui::default_style(),
+            replace_draft: None,
+            number_draft: NumberDraft { from: 1, to: 1, style: pdfcraft_engine::LabelStyle::Decimal, prefix: String::new(), start: 1 },
+            word_count_draft: word_count_ui::Draft::default(),
+        }
+    }
+
+    /// Fields are being edited (Prepare a form or its Calculation order is open, or a field tool
+    /// is picked), unless the form is being previewed.
+    pub fn is_preparing(&self) -> bool {
+        ((self.left_open && matches!(self.left, LeftPanel::Tool("form") | LeftPanel::CalculationOrder))
+            || matches!(self.quick_tool, QuickTool::Field(_)))
+            && !self.form_preview
+    }
+
+    /// A number that changes whenever the open dialog changes (opened, closed or replaced by
+    /// another), checked every frame. A picker started from a dialog's Browse… button answers
+    /// only into the same showing of that dialog.
+    pub(crate) fn dialog_epoch(&mut self) -> u64 {
+        if self.dialog != self.dialog_seen {
+            self.dialog_seen = self.dialog;
+            self.dialog_epoch = self.dialog_epoch.wrapping_add(1);
+        }
+        self.dialog_epoch
+    }
+
+    pub fn active_ids(&self) -> Option<(usize, DocId)> {
+        self.active.and_then(|i| self.views.get(i).map(|v| (i, v.id)))
+    }
+
+    /// A dialog or prompt is open over the window: the keyboard is its own, and nothing may act
+    /// on the document underneath it.
+    pub(crate) fn modal_open(&self) -> bool {
+        self.dialog.is_some()
+            || self.close_request.is_some()
+            || self.password_prompt.is_some()
+            || self.unlock_prompt.is_some()
+            || self.pending_link.is_some()
+            || self.pending_remote_link.is_some()
+            || self.updates.open
+    }
+
+    pub fn notify(&mut self, msg: impl Into<String>) {
+        self.toast = Some((msg.into(), 0.0));
+    }
+
+    /// Notify with a static message in the UI language.
+    pub fn notify_tr(&mut self, text: &str) {
+        self.notify(tl!(text).to_string());
+    }
+
+    /// Notify with an error's own text. Engine and OS messages are not translated: matching their
+    /// English wording would break silently whenever it changes.
+    pub fn notify_error(&mut self, error: impl std::fmt::Display) {
+        self.notify(error.to_string());
+    }
+
+    /// Notify with a `{name}`-style template in the UI language (placeholders filled once).
+    pub fn notify_fmt(&mut self, template: &str, args: &[(&str, &str)]) {
+        self.notify(i18n::fmt(tl!(template), args));
+    }
+
+    /// `true` while any open document still waits for page renders (used by headless capture).
+    pub fn render_pending(&self) -> bool {
+        self.views.iter().any(|v| v.render_pending())
+    }
+}
+
+impl eframe::App for PdfCraftApp {
+    /// While files are dragged over the window the system sends no pointer moves, so egui
+    /// would keep the place the pointer entered at: tell it where the pointer really is, so the
+    /// page grid can show (and use) the gap under it.
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        // The button's release a window move or resize kept from egui.
+        window_controls::release_after_desktop_grab(ctx, raw);
+        self.prepare_raw_input(ctx, raw);
+        if raw.hovered_files.is_empty() && raw.dropped_files.is_empty() {
+            return;
+        }
+        if let Some(pos) = drag_pointer::in_window(ctx) {
+            raw.events.push(egui::Event::PointerMoved(pos));
+        }
+        ctx.request_repaint();
+    }
+
+    fn save(&mut self, storage: &mut dyn eframe::Storage) {
+        // eframe has just stored the window as it is now: not while it is minimized.
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let minimized = self.ctx.as_ref().is_some_and(|c| c.input(|i| i.viewport().minimized == Some(true)));
+            self.window_state.keep(storage, minimized);
+        }
+        storage.set_string("pdfcraft", self.persist());
+    }
+
+    /// Each frame's work before drawing: opens, operating-system and control-channel requests,
+    /// the quit guard, shortcuts, and the background jobs' results.
+    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        self.ctx = Some(ctx.clone());
+        #[cfg(not(target_arch = "wasm32"))]
+        self.window_state.repair(ctx);
+        self.dialog_epoch();
+        // Notices raised outside `ui` (opened files, OS events, the control channel) translate too.
+        let lang = i18n::Lang::from_pref(&self.language);
+        i18n::set_current(lang);
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            if let Some(worker) = &self.open_worker {
+                worker.set_context(ctx);
+            }
+            self.poll_pending_opens();
+        }
+        // Chinese wants its own faces before the Japanese ones (one baseline per line).
+        let cjk = theme::CjkPreference::for_language(lang.code());
+        if !self.styled {
+            egui_extras::install_image_loaders(ctx);
+            theme::install_fonts_for(ctx, cjk);
+            self.fonts_cjk = cjk;
+            theme::apply(ctx, self.theme);
+            self.styled = true;
+        } else {
+            self.fonts_ready = true;
+            if cjk != self.fonts_cjk {
+                // Same family names as before, so named fonts stay valid while the new set loads.
+                theme::install_fonts_for(ctx, cjk);
+                self.fonts_cjk = cjk;
+            }
+        }
+        self.sync_theme(ctx);
+        let native = ctx.native_pixels_per_point().unwrap_or(1.0);
+        ui_scale::sync(ctx, ui_scale::zoom(self.ui_scale, self.system_text_scale, native), &mut self.ui_scale_applied);
+        // Remember user work even if its tab is subsequently closed or Home is selected.
+        self.startup_superseded |= !self.views.is_empty() || self.combine_showing() || self.dialog.is_some() || self.password_prompt.is_some();
+        // Also done in `raw_input_hook`, before input; here for hosts that don't call the hook.
+        self.scroll_speed.set_line_speed(ctx);
+        // Motion reads this frame's wheel input, so it begins in `ui`, in a known UI phase:
+        // `logic` also runs alone while hidden, where the input events and time are stale.
+        // Before taking this frame's drop: the grid must be drawn once with the pointer where
+        // the files were let go before the gap is read.
+        self.finish_grid_drop(ctx);
+        // Showing a document hides the Combine files tab.
+        if self.active.is_some() {
+            self.combine_tab.focused = false;
+        }
+        #[cfg(target_arch = "wasm32")]
+        self.process_signature_images();
+        let dropped = ctx.input(|i| i.raw.dropped_files.clone());
+        #[cfg(not(target_arch = "wasm32"))]
+        let dropped = self.drop_on_signature_pad(dropped);
+        #[cfg(not(target_arch = "wasm32"))]
+        let dropped = self.drop_on_grid(dropped, ctx);
+        for f in dropped {
+            // Files dropped on the Combine files tab join its list instead of opening.
+            if self.combine_showing() {
+                self.drop_into_combine(f, ctx);
+            } else {
+                self.open_dropped(f, ctx);
+            }
+        }
+        let arrived: Vec<(String, Vec<u8>)> = self.inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
+        for (name, bytes) in arrived {
+            if let Err(e) = self.open_bytes(&name, None, bytes) {
+                self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
+            }
+        }
+        // Don't replace a pending prompt or import. A startup file may need its own password
+        // prompt, so its bytes stay queued until the current interaction finishes.
+        #[cfg(not(target_arch = "wasm32"))]
+        let opening = !self.pending_opens.is_empty();
+        #[cfg(target_arch = "wasm32")]
+        let opening = false;
+        if !opening
+            && self.password_prompt.is_none()
+            && self.image_import.is_none()
+            && self.dialog.is_none()
+            && self.close_request.is_none()
+            && self.pending_link.is_none()
+            && self.pending_remote_link.is_none()
+        {
+            let startup = self.startup_inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
+            for (name, bytes) in startup {
+                let activate = !self.startup_superseded;
+                if let Err(e) = self.open_bytes_with_focus(&name, None, bytes, activate) {
+                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e)]);
+                }
+            }
+        }
+        let failed: Vec<(String, String)> = self.failed_inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
+        for (name, e) in failed {
+            self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e)]);
+        }
+        let os_events = self.os_events.as_mut().map(|poll| poll()).unwrap_or_default();
+        for e in os_events {
+            match e {
+                #[cfg(not(target_arch = "wasm32"))]
+                OsEvent::Open(paths) => {
+                    paths.iter().for_each(|p| {
+                        self.open_path(p);
+                    });
+                    // Files handed to the running app (Finder, or another launch): bring its
+                    // window to the front, also when minimized or full screen on another Space.
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(false));
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
+                }
+                #[cfg(target_arch = "wasm32")]
+                OsEvent::Open(_) => {}
+                // Like closing the window: `guard_quit` asks about unsaved changes.
+                OsEvent::Quit => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
+            }
+        }
+        if let Some((_, id)) = self.active_ids() {
+            let out = self.session.take_js_output(id);
+            self.handle_js(id, out);
+        }
+        if let Some(mut control) = self.control.take() {
+            control.tick(ctx, self);
+            self.control = Some(control);
+        }
+        self.guard_quit(ctx);
+        // macOS: quit through `terminate:` instead of dropping the window (Touch Bar crash, #1136).
+        #[cfg(target_os = "macos")]
+        craft_quit::on_close_request(ctx);
+        self.autosave_tick(ctx, web_time::Instant::now());
+        // Reload documents whose files a build rewrote (#431).
+        #[cfg(not(target_arch = "wasm32"))]
+        self.watch_files();
+        if self.host_dirty.is_some() {
+            let dirty = self.first_dirty().is_some();
+            if let Some(report) = self.host_dirty.as_mut() {
+                report(dirty);
+            }
+        }
+        self.poll_updates();
+        self.poll_print();
+        // Shortcuts deferred last frame: the text field has taken that frame's typing since.
+        let deferred = std::mem::take(&mut self.deferred_commands);
+        self.native_menu_clicks(ctx);
+        // The keys a menu click stands for (⌘C, Delete…), before anything reads this frame's keys.
+        if !self.menu_input.is_empty() {
+            let events = std::mem::take(&mut self.menu_input);
+            ctx.input_mut(|i| i.events.extend(events));
+        }
+        self.shortcuts(ctx);
+        // Scrolling and group-drag previews are transient: never resume after changing tabs,
+        // opening a modal/palette, or returning to a window that lost focus.
+        let blocked = self.modal_open() || self.palette_open || !ctx.input(|i| i.focused);
+        for (index, view) in self.views.iter_mut().enumerate() {
+            view.objects.set_input_blocked(blocked || self.active != Some(index));
+            if blocked || self.active != Some(index) {
+                view.auto_scroll.cancel();
+            }
+        }
+        // A field that refused its value this frame keeps the shortcut from saving or printing
+        // behind the user's back; so does a save prompt opened since.
+        if self.process_pending_edits() && self.close_request.is_none() {
+            for (id, doc) in deferred {
+                // Only in the document the shortcut was pressed in.
+                if self.active_ids().map(|(_, active)| active) == doc {
+                    self.execute(id);
+                }
+            }
+        }
+        self.poll_export();
+        self.auto_ocr_scanned_page();
+        self.poll_ocr();
+        self.poll_optimize();
+        self.poll_action();
+        self.process_file_requests();
+        #[cfg(not(target_arch = "wasm32"))]
+        self.process_picked();
+        // Last, after everything that can open or answer the "save changes?" question.
+        self.attend_save_prompt(ctx);
+        self.sync_native_menu(ctx);
+    }
+
+    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+        let ctx = ui.ctx().clone();
+        i18n::set_current(i18n::Lang::from_pref(&self.language));
+        // A language change switches stock chrome between LTR and RTL before anything is drawn.
+        theme::sync_direction(&ctx);
+        // Fonts registered via set_fonts only take effect next frame; named families would panic now.
+        if !self.fonts_ready {
+            ctx.request_repaint();
+            return;
+        }
+        // Before any widget reads this frame's wheel input or draws.
+        self.motion.begin_pass(&ctx, self.animation_effects);
+        // One-time 0.36 -> 0.37 panel persistence migration, before any panel stores or reads state.
+        migrate_panel_state(ui);
+        for view in &mut self.views {
+            view.begin_render_frame();
+        }
+        // The window shows the active document's name (or title, if it asks for that).
+        let title = self
+            .active
+            .and_then(|i| crate::canvas::tab_label(self, i))
+            .or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
+            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name} — PdfCraft"));
+        if title != self.window_title {
+            ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
+            self.window_title = title;
+        }
+        // The accessible window takes the same name, so a screen reader (AT-SPI on Linux, UIA on
+        // Windows) can tell it apart (#4614). egui builds the root node afresh every pass.
+        ctx.accesskit_node_builder(egui::accesskit_root_id(), |root| root.set_label(self.window_title.as_str()));
+        if self.full_screen && self.active.is_some() {
+            // Full screen: the page on black, nothing else, as Acrobat's Full Screen Mode (Esc
+            // or ⌘L to leave).
+            egui::CentralPanel::default().frame(egui::Frame::NONE.fill(egui::Color32::BLACK)).show(ui, |ui| {
+                if let Some(i) = self.active {
+                    match compare_ui::side_by_side(self, i) {
+                        Some((old, new)) => compare_ui::compare_area(self, old, new, ui),
+                        None => canvas::document_area(self, i, ui),
+                    }
+                }
+            });
+            dialogs::show(self, &ctx);
+            // Notices too: a refused field value or a failed save must be seen in full screen.
+            self.show_progress(&ctx);
+            widgets::toast(self, &ctx);
+            self.finish_render_frame(&ctx);
+            if let Some(mut control) = self.control.take() {
+                control.finish_frame(&ctx, self);
+                self.control = Some(control);
+            }
+            return;
+        }
+        self.sync_window_frame(&ctx);
+        if self.draws_window_frame() {
+            window_controls::resize_edges(&ctx);
+        }
+        chrome::tab_strip(self, ui);
+        chrome::mode_bar(self, ui);
+        // Whichever way another tab came to the front, it shows instead of the expanded view.
+        if self.all_tools_full && self.all_tools_tab != self.shown_tab() {
+            self.all_tools_full = false;
+        }
+        side_panels::show(self, ui);
+        let t = theme::Tokens::get(&ctx);
+        egui::CentralPanel::default().frame(egui::Frame::NONE.fill(t.pasteboard)).show(ui, |ui| {
+            if self.mode == Mode::AllTools && self.all_tools_full {
+                all_tools_ui::show(self, ui);
+            } else {
+                match self.active {
+                    None if self.combine_showing() => combine_ui::page(self, ui),
+                    None => home::show(self, ui),
+                    Some(index) => match compare_ui::side_by_side(self, index) {
+                        Some((old, new)) => compare_ui::compare_area(self, old, new, ui),
+                        None => canvas::document_area(self, index, ui),
+                    },
+                }
+            }
+        });
+        self.process_pending_edits();
+        palette::show(self, &ctx);
+        dialogs::show(self, &ctx);
+        self.show_progress(&ctx);
+        widgets::toast(self, &ctx);
+        self.finish_render_frame(&ctx);
+        // Screenshots are issued only after a settled pass that really drew the window.
+        if let Some(mut control) = self.control.take() {
+            control.finish_frame(&ctx, self);
+            self.control = Some(control);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/app/clipboard.rs b/crates/ui-egui/src/app/clipboard.rs
new file mode 100644
index 0000000000..6641d93a86
--- /dev/null
+++ b/crates/ui-egui/src/app/clipboard.rs
@@ -0,0 +1,81 @@
+use super::*;
+
+/// Why nothing can be copied out of the document: its security doesn't allow it (Table 22,
+/// bit 5; #568).
+pub(crate) fn copy_refused() -> &'static str {
+    tl!("The document's security settings don't allow copying text and images")
+}
+
+pub(crate) fn print_refused() -> &'static str {
+    tl!("The document's security settings don't allow printing")
+}
+
+impl PdfCraftApp {
+    /// Whether text and images may be copied out of document `id`; says why not when they may
+    /// not. Reading aloud and accessibility tools don't ask (assistive technology may read
+    /// anything, §7.6.4.2).
+    pub(crate) fn may_copy(&mut self, id: DocId) -> bool {
+        if self.session.get(id).is_none_or(pdfcraft_engine::Document::allows_copying) {
+            return true;
+        }
+        self.notify(copy_refused().to_string());
+        false
+    }
+
+    /// ⌘C copies the selected text, unless a text field has the keyboard (it copies its own).
+    pub(super) fn copy_key(&mut self, i: usize, ctx: &egui::Context) {
+        // ⌘C arrives as a Copy event on most platforms.
+        let copy = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Copy)));
+        if !copy || ctx.egui_wants_keyboard_input() {
+            return;
+        }
+        self.copy_selected_text(i, ctx);
+    }
+
+    /// Shared permission gate for copying selected page text from menus and keyboard events.
+    /// After Select All of the document (#2639), pages whose text wasn't read for display are read
+    /// off the UI thread ([`DocumentCopy`]), and the clipboard gets the text when they're done.
+    pub(crate) fn copy_selected_text(&mut self, i: usize, ctx: &egui::Context) -> bool {
+        // A newer copy wins: a whole-document copy still reading must not replace it later.
+        self.document_copy = None;
+        let Some(v) = self.views.get(i) else { return false };
+        let id = v.id;
+        if v.all_text && !v.pages_without_text().is_empty() {
+            // Checked before any page is read: a document that refuses copying reads nothing.
+            if !self.may_copy(id) {
+                return false;
+            }
+            let Some(job) = self.views.get(i).and_then(|v| Some(DocumentCopyJob::of(v, self.session.get(id)?))) else { return false };
+            self.document_copy = Some(DocumentCopy::start(id, job, ctx));
+            return true;
+        }
+        let Some(text) = v.selected_text().filter(|text| !text.is_empty()) else { return false };
+        if !self.may_copy(id) {
+            return false;
+        }
+        ctx.copy_text(text);
+        true
+    }
+
+    /// The clipboard text of a whole-document copy, once its pages are read; dropped with the
+    /// document it was copied from, and by any later copy (a text field's, a comment's), which
+    /// it must not replace. Run at the end of the frame, so it sees this frame's copies.
+    pub(crate) fn finish_document_copy(&mut self, ctx: &egui::Context) {
+        let Some(c) = &self.document_copy else { return };
+        let copied = ctx.output(|o| o.commands.iter().any(|c| matches!(c, egui::OutputCommand::CopyText(_) | egui::OutputCommand::CopyImage(_))));
+        if copied || !self.views.iter().any(|v| v.id == c.doc) {
+            self.document_copy = None;
+            return;
+        }
+        match c.rx.try_recv() {
+            Ok(text) => {
+                self.document_copy = None;
+                if !text.is_empty() {
+                    ctx.copy_text(text);
+                }
+            }
+            Err(std::sync::mpsc::TryRecvError::Empty) => ctx.request_repaint_after(std::time::Duration::from_millis(50)),
+            Err(std::sync::mpsc::TryRecvError::Disconnected) => self.document_copy = None,
+        }
+    }
+}
diff --git a/crates/ui-egui/src/app/commands.rs b/crates/ui-egui/src/app/commands.rs
new file mode 100644
index 0000000000..986ec745d4
--- /dev/null
+++ b/crates/ui-egui/src/app/commands.rs
@@ -0,0 +1,195 @@
+use super::*;
+
+impl PdfCraftApp {
+    /// Run a catalogue command. Commands that aren't implemented yet say which milestone ships them.
+    pub fn run_command(&mut self, command: &str) {
+        if let Some(spec) = pdfcraft_engine::commands::command(command) {
+            use pdfcraft_engine::commands::Needs;
+            // A tool that needs a document, chosen with none open, asks for the file and then
+            // runs on it, instead of only saying to open one first.
+            let needs_document = !matches!(spec.needs, Needs::Nothing | Needs::Undo | Needs::Redo);
+            let is_tool = pdfcraft_engine::catalog::TOOL_GROUPS
+                .iter()
+                .flat_map(|g| g.sections.iter().flat_map(|s| s.items.iter()))
+                .any(|i| i.command == spec.id);
+            if self.active.is_none() && needs_document && is_tool && !self.command_enabled(spec) {
+                self.open_then_run(spec);
+                return;
+            }
+            self.execute(command);
+            return;
+        }
+        // Not implemented yet: say which milestone ships it.
+        let when = pdfcraft_engine::catalog::TOOL_GROUPS
+            .iter()
+            .flat_map(|g| g.sections.iter().flat_map(|s| s.items.iter()))
+            .find(|i| i.command == command)
+            .map(|i| match i.availability {
+                pdfcraft_engine::catalog::Availability::Planned(m) => crate::i18n::fmt(tl!("ships in milestone {m}"), &[("m", m)]),
+                pdfcraft_engine::catalog::Availability::Provider => tl!("needs an AI provider (off by default)").to_string(),
+                pdfcraft_engine::catalog::Availability::Ready => tl!("is available").to_string(),
+            })
+            .unwrap_or_else(|| tl!("is not available yet").to_string());
+        self.notify_fmt("`{command}` {when}", &[("command", command), ("when", &when)]);
+    }
+
+    /// Ask for a file to open, then run `spec` on it once it is open (or unlocked). Nothing runs
+    /// when the picker is cancelled or the file doesn't open.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open_then_run(&mut self, spec: &'static pdfcraft_engine::commands::CommandSpec) {
+        self.startup_superseded = true;
+        let dialog = Self::open_picker().set_title(tl!(spec.label).trim_end_matches('…'));
+        let command = spec.id;
+        self.ask_one(pickers::Ask::File(dialog), None, move |app, path| {
+            let path = path.to_string_lossy().into_owned();
+            app.open_path_then(&path, Some(command));
+        });
+    }
+
+    /// Browsers read the picked file asynchronously; it opens, and the tool can be chosen again.
+    #[cfg(target_arch = "wasm32")]
+    fn open_then_run(&mut self, _spec: &'static pdfcraft_engine::commands::CommandSpec) {
+        self.open_dialog();
+    }
+
+    pub(crate) fn reveal_tools(&mut self) {
+        self.left_open = true;
+    }
+
+    /// Enter a tool from the catalogue, Home, palette or control channel. Organize is a
+    /// workspace, so opening its panel also opens the page grid (without toggling it off).
+    pub(crate) fn select_tool(&mut self, id: &'static str) {
+        // The tool's panel shows, not the expanded All tools view over it.
+        self.all_tools_full = false;
+        self.left = LeftPanel::Tool(id);
+        self.reveal_tools();
+        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) {
+            if id == "organize" {
+                view.open_organize();
+            } else {
+                view.organize = false;
+            }
+        }
+    }
+
+    /// Select the workspace and its matching tool panel, just like the mode bar. The tool goes
+    /// with the workspace as [`Self::enter_mode`] sets it.
+    pub(crate) fn select_mode(&mut self, mode: Mode) {
+        self.enter_mode(mode);
+        self.reveal_tools();
+        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) {
+            view.organize = false;
+        }
+        self.left = match mode {
+            Mode::Edit => LeftPanel::Tool("edit"),
+            Mode::Convert => LeftPanel::Tool("export"),
+            Mode::Sign => LeftPanel::Tool("fill_sign"),
+            _ => LeftPanel::AllTools,
+        };
+    }
+
+    /// Changes the workspace and the tool that goes with it. The mode bar (through
+    /// [`Self::select_mode`]), the Read mode command and the tool panels' back arrows all come
+    /// here, so they leave Edit alike. Edit turns on Edit text & images at once, as Acrobat does:
+    /// every paragraph and image on the page gets its box and is editable with one click. Leaving
+    /// Edit puts the editing tools down again and applies a paragraph still open in the editor.
+    pub(crate) fn enter_mode(&mut self, mode: Mode) {
+        self.mode = mode;
+        // Another workspace puts the expanded All tools view away.
+        if mode != Mode::AllTools {
+            self.all_tools_full = false;
+        }
+        if mode == Mode::Edit {
+            self.quick_tool = QuickTool::EditText;
+        } else if matches!(self.quick_tool, QuickTool::EditText | QuickTool::AddText) {
+            self.put_down_edit_text();
+        }
+        // Read mode hides the quick toolbar, so no other tool may stay active there. Opening a
+        // document with Read as the default mode comes here without `switch_mode`.
+        if mode == Mode::Read {
+            self.quick_tool = QuickTool::Select;
+        }
+    }
+
+    /// Fill the workspace with the expanded All tools view, entering All tools the way the mode
+    /// bar does: leaving Read restores its right panel and leaving Edit puts the editing tool down.
+    pub(crate) fn expand_all_tools(&mut self) {
+        if self.mode != Mode::AllTools {
+            self.switch_mode(Mode::AllTools, true);
+        }
+        self.all_tools_full = true;
+        self.all_tools_tab = self.shown_tab();
+    }
+
+    /// The tab at the front: the active document, or else whether Combine files shows over Home.
+    pub(super) fn shown_tab(&self) -> (Option<DocId>, bool) {
+        (self.active.and_then(|i| self.views.get(i)).map(|v| v.id), self.combine_showing())
+    }
+
+    /// Back to the Select tool from an editing tool. A paragraph still open in the editor is
+    /// applied, as clicking away from it does; left open, its page would keep showing the
+    /// paragraph's text removed with no editor over it.
+    pub(crate) fn put_down_edit_text(&mut self) {
+        self.quick_tool = QuickTool::Select;
+        if let Some(ed) = self.active.and_then(|i| self.views.get_mut(i)).and_then(|v| v.line_editor.take())
+            && let Some(edit) = edit_text_ui::finished_edit(ed)
+        {
+            self.apply_edit(edit);
+        }
+    }
+
+    /// Switches workspace because the user chose to (mode bar, Read mode command). Entering Read
+    /// mode closes the right panel, as Acrobat's Read mode hides its panes, and leaving it reopens
+    /// that panel. The rail stays in Read mode, and its buttons open panels there too (#932).
+    /// Read mode hides the quick toolbar, so entering it also puts the current tool down.
+    pub(crate) fn switch_mode(&mut self, mode: Mode, select_tools: bool) {
+        let was_read = self.mode == Mode::Read;
+        if select_tools {
+            self.select_mode(mode);
+        } else {
+            self.enter_mode(mode);
+        }
+        if mode == Mode::Read && !was_read {
+            self.right_before_read = self.right.take();
+            // An editing tool is put down so its open paragraph is applied, as `select_mode` does.
+            if matches!(self.quick_tool, QuickTool::EditText | QuickTool::AddText) {
+                self.put_down_edit_text();
+            } else {
+                self.quick_tool = QuickTool::Select;
+            }
+        } else if mode != Mode::Read && was_read {
+            let before = self.right_before_read.take();
+            if self.right.is_none() {
+                self.right = before;
+            }
+        }
+    }
+
+    /// Opens a right panel, or closes it with `None`, because the user chose to. Closing Comments
+    /// keeps comment tools from reopening it; opening it again lets them (#225). A choice made in
+    /// Read mode replaces the pane saved on the way in, so leaving Read mode doesn't undo it.
+    pub fn choose_right_panel(&mut self, panel: Option<RightPanel>) {
+        if self.mode == Mode::Read {
+            self.right_before_read = None;
+        }
+        if panel == Some(RightPanel::Comments) {
+            self.comments_panel_closed = false;
+        } else if panel.is_none() && self.right == Some(RightPanel::Comments) {
+            self.comments_panel_closed = true;
+        }
+        if panel.is_some() {
+            self.right_panel_closed = false;
+        } else if self.right.is_some() {
+            self.right_panel_closed = true;
+        }
+        self.right = panel;
+        if let Some(panel) = panel {
+            self.last_right = panel;
+        }
+    }
+
+    /// F4: closes the side panel, or reopens the one open last.
+    pub(crate) fn toggle_side_panel(&mut self) {
+        self.choose_right_panel(if self.right.is_some() { None } else { Some(self.last_right) });
+    }
+}
diff --git a/crates/ui-egui/src/app/control.rs b/crates/ui-egui/src/app/control.rs
new file mode 100644
index 0000000000..bb5a65cb34
--- /dev/null
+++ b/crates/ui-egui/src/app/control.rs
@@ -0,0 +1,392 @@
+use super::*;
+use crate::control;
+
+impl PdfCraftApp {
+    /// Enable the UI control channel on `ctx` (opt-in; see [`control`]). Returns a client that
+    /// sends requests to this app; [`control::serve`] exposes it on loopback.
+    pub fn attach_control(&mut self, ctx: &egui::Context) -> control::ControlClient {
+        let (control, client) = control::attach(ctx);
+        self.control = Some(control);
+        client
+    }
+
+    /// Apply a named view option (`--page 3`, `--panel bookmarks`, `--theme dark`, …).
+    ///
+    /// This is the seed of the UI control channel (M3.9): the same verbs become `ui.set` calls.
+    pub fn set_option(&mut self, key: &str, value: &str) -> Result<(), String> {
+        let view = self.active.and_then(|i| self.views.get_mut(i));
+        match (key, view) {
+            ("language", _) => {
+                let language = i18n::normalize_pref(value).ok_or_else(|| {
+                    let codes: Vec<&str> = std::iter::once(i18n::AUTO).chain(i18n::Lang::all().map(i18n::Lang::code)).collect();
+                    format!("language must be one of {}", codes.join(", "))
+                })?;
+                self.language = language.to_string();
+            }
+            ("theme", _) => {
+                let preference = match value {
+                    "system" => ThemePreference::System,
+                    "light" => ThemePreference::Light,
+                    "dark" => ThemePreference::Dark,
+                    _ => return Err("theme must be light, dark, or system".into()),
+                };
+                self.set_theme_preference(preference);
+            }
+            ("scroll_speed", _) => {
+                self.scroll_speed = scroll_speed::ScrollSpeed::parse(value).ok_or("scroll_speed must be slow, normal, or fast")?;
+            }
+            ("animation_effects", _) => {
+                self.animation_effects = motion::AnimationEffects::parse(value).ok_or("animation_effects must be system, on, or off")?;
+            }
+            ("panel", _) => {
+                self.right = match value {
+                    "comments" => Some(RightPanel::Comments),
+                    "bookmarks" => Some(RightPanel::Bookmarks),
+                    "pages" => Some(RightPanel::Pages),
+                    "fields" => Some(RightPanel::Fields),
+                    "layers" => Some(RightPanel::Layers),
+                    "attachments" => Some(RightPanel::Attachments),
+                    "signatures" => Some(RightPanel::Signatures),
+                    "accessibility" => Some(RightPanel::Accessibility),
+                    "tags" => Some(RightPanel::Tags),
+                    "search" => Some(RightPanel::Search),
+                    "compare" => Some(RightPanel::Compare),
+                    "none" => None,
+                    other => return Err(format!("unknown panel {other}")),
+                }
+            }
+            ("mode", _) => {
+                let mode = Mode::parse(value).unwrap_or(Mode::AllTools);
+                self.mode_override = Some(mode);
+                self.mode = mode;
+                // As switch_mode: another workspace puts the expanded All tools view away.
+                if mode != Mode::AllTools {
+                    self.all_tools_full = false;
+                }
+            }
+            ("default-mode", _) => {
+                self.default_mode = Mode::parse(value).ok_or("default-mode must be all, read, edit, convert or sign")?;
+            }
+            ("date-format", _) => self.session.set_date_format(value)?,
+            ("date-language", _) => self.session.set_date_language(Some(value).filter(|v| *v != "auto"))?,
+            ("tool", _) => {
+                let g = pdfcraft_engine::catalog::group(value).ok_or_else(|| format!("unknown tool {value}"))?;
+                self.select_tool(g.id);
+            }
+            ("left", _) => self.left_open = value != "closed",
+            ("home", _) => {
+                self.active = None;
+                // With no document open the expanded All tools view covers Home itself, so no
+                // other tab comes forward to put it away.
+                self.all_tools_full = false;
+            }
+            ("dialog", _) => {
+                self.dialog = match value {
+                    "properties" => Some(Dialog::Properties(PropsTab::Description)),
+                    "security" => Some(Dialog::Properties(PropsTab::Security)),
+                    "fonts" => Some(Dialog::Properties(PropsTab::Fonts)),
+                    "custom" => Some(Dialog::Properties(PropsTab::Custom)),
+                    "advanced" => Some(Dialog::Properties(PropsTab::Advanced)),
+                    "space-audit" => Some(Dialog::Properties(PropsTab::SpaceAudit)),
+                    "shortcuts" => Some(Dialog::Shortcuts),
+                    "split" => Some(Dialog::Split),
+                    "protect" => Some(Dialog::Protect),
+                    "page-boxes" => Some(Dialog::PageBoxes),
+                    "header-footer" => Some(Dialog::Marks(pdfcraft_engine::MarkKind::HeaderFooter)),
+                    "watermark" => Some(Dialog::Marks(pdfcraft_engine::MarkKind::Watermark)),
+                    "background" => Some(Dialog::Marks(pdfcraft_engine::MarkKind::Background)),
+                    "export-image" => Some(Dialog::Export(export_ui::ExportKind::Image)),
+                    "word-count" => Some(Dialog::WordCount),
+                    "export-text" => Some(Dialog::Export(export_ui::ExportKind::Text)),
+                    "export-all-images" => Some(Dialog::Export(export_ui::ExportKind::AllImages)),
+                    "accessibility-options" => Some(Dialog::AccessibilityOptions),
+                    "recognize-text" => Some(Dialog::RecognizeText),
+                    "js-console" => Some(Dialog::JsConsole),
+                    "document-js" => Some(Dialog::DocumentJs),
+                    "preferences" => Some(Dialog::Preferences),
+                    "compare-files" => Some(Dialog::CompareFiles),
+                    "action-wizard" => Some(Dialog::ActionWizard),
+                    "pdfa" => Some(Dialog::PdfA),
+                    "signature" => Some(Dialog::Signature),
+                    "optimize" => Some(Dialog::Optimize),
+                    "sign" | "certify" => {
+                        // Sign with a Digital ID for an invisible signature on the current page.
+                        let page = self.active.map_or(0, |i| self.views[i].current);
+                        self.start_signing(page, None, None, (value == "certify").then_some(2));
+                        Some(Dialog::Sign)
+                    }
+                    "number-pages" => {
+                        // Same path as the menu, so the page range is seeded.
+                        self.execute("page.number");
+                        Some(Dialog::NumberPages)
+                    }
+                    "none" => None,
+                    _ => Some(Dialog::About),
+                }
+            }
+            ("tools", _) if value == "full" => self.expand_all_tools(),
+            ("tools", _) => {
+                self.all_tools_full = false;
+                self.all_tools_expanded = value != "collapsed";
+            }
+            ("palette", _) => {
+                self.palette_open = true;
+                self.palette_query = value.to_string();
+            }
+            ("page", Some(v)) => v.go_to_page(value.parse::<usize>().map_err(|e| e.to_string())?.saturating_sub(1)),
+            ("zoom", Some(v)) => v.set_zoom(DocView::parse_zoom_percent(value).ok_or("zoom must be a percentage above 0")?),
+            ("layout", Some(v)) => {
+                let (layout, continuous) = canvas::parse_display_token(value).ok_or("layout must be single, continuous, two-up or two-page")?;
+                v.set_display(layout, continuous);
+            }
+            ("continuous", Some(v)) => match value {
+                "on" => v.set_continuous(true),
+                "off" => v.set_continuous(false),
+                _ => return Err("continuous must be on or off".into()),
+            },
+            ("page-gaps", Some(_)) => {
+                let show = match value {
+                    "on" => true,
+                    "off" => false,
+                    _ => return Err("page-gaps must be on or off".into()),
+                };
+                self.set_active_page_gaps(show);
+            }
+            ("default-page-gaps", _) => {
+                self.view_defaults.show_page_gaps = match value {
+                    "on" => true,
+                    "off" => false,
+                    _ => return Err("default-page-gaps must be on or off".into()),
+                };
+            }
+            ("cover", Some(v)) => {
+                let on = match value {
+                    "on" => true,
+                    "off" => false,
+                    _ => return Err("cover must be on or off".into()),
+                };
+                if on && !v.cover_applies() {
+                    return Err("switch to two-page view first to show the cover page".into());
+                }
+                v.set_cover(on);
+            }
+            ("default-layout", _) => {
+                let (layout, continuous) =
+                    canvas::parse_display_token(value).ok_or("default-layout must be single, continuous, two-up or two-page")?;
+                (self.view_defaults.layout, self.view_defaults.continuous) = (layout, continuous);
+            }
+            ("default-continuous", _) => {
+                self.view_defaults.continuous = match value {
+                    "on" => true,
+                    "off" => false,
+                    _ => return Err("default-continuous must be on or off".into()),
+                };
+            }
+            ("default-zoom", _) => {
+                self.view_defaults =
+                    self.view_defaults.with_zoom(value).ok_or("default-zoom must be fit-width, fit-page or a percentage from 8 to 6400")?;
+            }
+            ("always-default-view", _) => {
+                self.always_default_view = match value {
+                    "on" => true,
+                    "off" => false,
+                    _ => return Err("always-default-view must be on or off".into()),
+                };
+            }
+            ("tools-side", _) => {
+                self.side_panels.tools_side = match value {
+                    "left" => side_panels::ToolsSide::Left,
+                    "right" => side_panels::ToolsSide::Right,
+                    _ => return Err("tools-side must be left or right".into()),
+                }
+            }
+            ("organize", Some(v)) => {
+                if value == "off" {
+                    v.organize = false;
+                } else {
+                    v.open_organize();
+                }
+            }
+            // Inspector thumbnail size, in percent, independent of document and grid zoom.
+            ("thumbnail-zoom", Some(v)) => {
+                let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
+                if !percent.is_finite() || !canvas::THUMBNAIL_ZOOM_RANGE.contains(&(percent / 100.0)) {
+                    return Err("thumbnail-zoom must be between 50 and 150".into());
+                }
+                v.set_thumbnail_zoom(percent / 100.0);
+            }
+            // `--grid-zoom 150`: the size of the pages in the organize grid, in percent.
+            ("grid-zoom", Some(v)) => {
+                let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
+                if !percent.is_finite() || !canvas::GRID_ZOOM_RANGE.contains(&(percent / 100.0)) {
+                    return Err("grid-zoom must be between 50 and 300".into());
+                }
+                v.set_grid_zoom(percent / 100.0);
+                // The grid's size is one for every document, as it is remembered.
+                self.organize_zoom = v.grid_zoom();
+            }
+            ("rotate", Some(v)) => {
+                let deg: u16 = value.parse().map_err(|_| "rotate: 0, 90, 180 or 270")?;
+                if !deg.is_multiple_of(90) {
+                    return Err("rotate: 0, 90, 180 or 270".into());
+                }
+                v.rotation = deg % 360;
+            }
+            ("layer", _) => {
+                // `--layer "Name=off"` / `"Name=on"`
+                let (name, state) = value.rsplit_once('=').ok_or("expected NAME=on|off")?;
+                let (i, id) = self.active_ids().ok_or("`layer` needs an open document")?;
+                let idx = self
+                    .session
+                    .get(id)
+                    .and_then(|d| d.info.layers.iter().position(|l| l.name == name))
+                    .ok_or_else(|| format!("no layer named {name}"))?;
+                if self.session.set_layer_visible(id, idx, state != "off") {
+                    self.views[i].invalidate_content();
+                }
+            }
+            ("find", Some(v)) => {
+                v.open_find();
+                if let Some(f) = v.find.as_mut() {
+                    f.query = value.to_string();
+                }
+                v.rerun_find();
+            }
+            ("fields", Some(v)) => v.highlight_fields = value != "off",
+            ("select", Some(v)) => {
+                // The same physical page ranges as the Organize Pages selection field.
+                let pages = crate::page_selection_ui::parse(value, v.page_count()).map_err(|e| e.to_string())?;
+                v.select_pages(&pages);
+            }
+            ("notice", Some(v)) => v.notice_dismissed = value == "off",
+            ("quick", _) => {
+                // `--quick select|hand|note|freetext|highlight|underline|strikeout|ink|line|arrow|square|circle`
+                self.quick_tool = match value {
+                    "select" => QuickTool::Select,
+                    measure if measure.starts_with("measure-") => QuickTool::Measure(
+                        measure_ui::Tool::from_name(measure.trim_start_matches("measure-")).ok_or_else(|| format!("unknown tool {measure}"))?,
+                    ),
+                    "hand" => QuickTool::Hand,
+                    "crop" => QuickTool::Crop,
+                    "enhance-camera" => QuickTool::EnhanceCamera,
+                    "redact" => QuickTool::Redact,
+                    "add-text" => QuickTool::AddText,
+                    "edit-text" => QuickTool::EditText,
+                    "link" => QuickTool::Link,
+                    "sign" => QuickTool::SignArea { certify: false },
+                    "marquee-zoom" => QuickTool::MarqueeZoom,
+                    "snapshot" => QuickTool::Snapshot,
+                    "column-select" => QuickTool::ColumnSelect,
+                    "certify" => QuickTool::SignArea { certify: true },
+                    custom if custom.starts_with("custom-stamp-") => {
+                        let i: usize = custom[13..].parse().map_err(|_| format!("bad stamp {custom}"))?;
+                        if i >= self.custom_stamps.len() {
+                            return Err(format!("there are {} custom stamps", self.custom_stamps.len()));
+                        }
+                        QuickTool::CustomStamp(i)
+                    }
+                    stamp if stamp.starts_with("stamp-") => QuickTool::Stamp(
+                        pdfcraft_engine::StampKind::ALL
+                            .into_iter()
+                            .find(|k| k.name().trim_start_matches("PC").eq_ignore_ascii_case(&stamp[6..]))
+                            .ok_or_else(|| format!("unknown stamp {stamp}"))?,
+                    ),
+                    field if field.starts_with("field-") => QuickTool::Field(
+                        prepare::FieldTool::from_command(&format!("form.add.{}", &field[6..])).ok_or_else(|| format!("unknown tool {field}"))?,
+                    ),
+                    fill if fill.starts_with("fill-") => QuickTool::Fill(
+                        fill_sign::FillTool::from_command(&format!("sign.fill.{}", &fill[5..])).ok_or_else(|| format!("unknown tool {fill}"))?,
+                    ),
+                    other => {
+                        let t = comments::CommentTool::from_command(&format!("comment.{other}")).ok_or_else(|| format!("unknown tool {other}"))?;
+                        self.comment_prefs.group_tool[t.group()] = t;
+                        QuickTool::Comment(t)
+                    }
+                };
+            }
+            ("author", _) => self.comment_prefs.author = value.to_string(),
+            ("comment-tool-pinned", _) => {
+                self.comment_prefs.pinned = match value {
+                    "true" => true,
+                    "false" => false,
+                    _ => return Err("comment-tool-pinned must be true or false".into()),
+                };
+            }
+            ("hide-empty-highlight-hover", _) => {
+                self.comment_prefs.hide_empty_highlight_hover = match value {
+                    "true" => true,
+                    "false" => false,
+                    _ => return Err("hide-empty-highlight-hover must be true or false".into()),
+                };
+            }
+            ("ui-scale", _) => self.ui_scale = ui_scale::parse(value)?,
+            // `--secured-notice false`: no notice above the pages that a document is secured.
+            ("secured-notice", _) => {
+                self.show_secured_notice = match value {
+                    "true" => true,
+                    "false" => false,
+                    _ => return Err("secured-notice must be true or false".into()),
+                };
+            }
+            ("system-title-bar", _) => {
+                self.system_title_bar = match value {
+                    "true" => true,
+                    "false" => false,
+                    _ => return Err("system-title-bar must be true or false".into()),
+                };
+            }
+            ("flatten-fill-sign", _) => {
+                self.flatten_fill_sign_on_save = match value {
+                    "true" => true,
+                    "false" => false,
+                    _ => return Err("flatten-fill-sign must be true or false".into()),
+                };
+            }
+            ("comment", Some(v)) => {
+                // `--comment 2:4` selects the 4th annotation of page 2 (1-based, as comment_list reports).
+                let (p, i) = value.split_once(':').ok_or("comment: PAGE:INDEX")?;
+                let (p, i): (usize, usize) =
+                    (p.trim().parse().map_err(|_| "comment: PAGE:INDEX")?, i.trim().parse().map_err(|_| "comment: PAGE:INDEX")?);
+                v.comments.selected = Some((p.saturating_sub(1), i.saturating_sub(1)));
+                v.comments.reveal = true;
+            }
+            // `--combine-view list`: Combine files as thumbnails (grid) or as the table (list).
+            ("combine-view", _) => {
+                self.combine_view = combine_ui::CombineView::parse(value).ok_or("combine-view must be grid or list")?;
+            }
+            // `--combine-zoom 150`: the size of the cards in the Combine grid, in percent.
+            ("combine-zoom", _) => {
+                let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
+                if !percent.is_finite() || !combine_grid::ZOOM_RANGE.contains(&(percent / 100.0)) {
+                    let (lo, hi) = (combine_grid::ZOOM_RANGE.start(), combine_grid::ZOOM_RANGE.end());
+                    return Err(format!("combine-zoom must be between {} and {}", lo * 100.0, hi * 100.0));
+                }
+                self.set_combine_zoom(percent / 100.0);
+            }
+            (k, None)
+                if [
+                    "page",
+                    "zoom",
+                    "layout",
+                    "continuous",
+                    "page-gaps",
+                    "cover",
+                    "organize",
+                    "grid-zoom",
+                    "thumbnail-zoom",
+                    "fields",
+                    "find",
+                    "rotate",
+                    "select",
+                    "notice",
+                    "comment",
+                ]
+                .contains(&k) =>
+            {
+                return Err(format!("`{k}` needs an open document"));
+            }
+            (other, _) => return Err(format!("unknown option {other}")),
+        }
+        Ok(())
+    }
+}
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
new file mode 100644
index 0000000000..3c68dc5619
--- /dev/null
+++ b/crates/ui-egui/src/app/files.rs
@@ -0,0 +1,682 @@
+use super::*;
+
+/// Whether `a` and `b` name the same file: equal, or equal once made absolute against the
+/// current directory (links are not resolved, as in `last_session`).
+pub(crate) fn same_file(a: &str, b: &str) -> bool {
+    a == b || matches!((std::path::absolute(a), std::path::absolute(b)), (Ok(x), Ok(y)) if x == y)
+}
+
+impl PdfCraftApp {
+    /// Open a document the way it asks to be opened: navigation panel, layout, magnification,
+    /// page and the place on it (Document Properties ▸ Initial View, `/OpenAction`). With Always
+    /// use my default zoom and page layout on, the layout and magnification stay at the defaults
+    /// the view opened with, and the view goes to the opening page's top.
+    fn apply_initial_view(&mut self, index: usize, v: &pdfcraft_engine::InitialView) {
+        use pdfcraft_engine::{InitialLayout as L, Magnification as M, Navigation as N};
+        let pages = self.session.get(self.views[index].id).map_or(0, |d| d.info.pages.len());
+        // A right panel the user closed stays closed, whatever the document asks for (#2884).
+        // A document that asks for full screen gets the panel it names for outside it
+        // (`/NonFullScreenPageMode`, Table 147), there when the prompt is declined or full
+        // screen is left.
+        let navigation = if v.full_screen { v.non_full_screen } else { v.navigation };
+        if self.active == Some(index) && !self.right_panel_closed {
+            match navigation {
+                N::PageOnly => {}
+                N::Bookmarks => self.right = Some(RightPanel::Bookmarks),
+                N::Pages => self.right = Some(RightPanel::Pages),
+                N::Attachments => self.right = Some(RightPanel::Attachments),
+                N::Layers => self.right = Some(RightPanel::Layers),
+            }
+        }
+        let view = &mut self.views[index];
+        if !self.always_default_view {
+            match v.layout {
+                // The view opened in Default page display already.
+                L::Default => {}
+                L::SinglePage => (view.layout, view.continuous) = (canvas::PageLayout::Single, false),
+                L::SinglePageContinuous => (view.layout, view.continuous) = (canvas::PageLayout::Single, true),
+                L::TwoUp => (view.layout, view.continuous) = (canvas::PageLayout::TwoUp, false),
+                L::TwoUpContinuous => (view.layout, view.continuous) = (canvas::PageLayout::TwoUp, true),
+                L::TwoUpCoverPage => {
+                    (view.layout, view.continuous, view.cover) = (canvas::PageLayout::TwoUp, false, true);
+                }
+                L::TwoUpContinuousCoverPage => {
+                    (view.layout, view.continuous, view.cover) = (canvas::PageLayout::TwoUp, true, true);
+                }
+            }
+            match v.magnification {
+                // The view opened at the default zoom already.
+                M::Default => {}
+                M::ActualSize => view.set_zoom(1.0),
+                M::Percent(p) => view.set_zoom((p / 100.0) as f32),
+                M::FitPage | M::FitVisible => view.fit = canvas::Fit::Page,
+                M::FitWidth => view.fit = canvas::Fit::Width,
+                M::FitHeight => view.fit = canvas::Fit::Height,
+            }
+        }
+        // The opening destination (`/OpenAction`, named destinations resolved): its page, and
+        // where on it and how large, as a bookmark or link to it would (ISO 32000-2 Table 149).
+        // With the default view kept, only the page.
+        let info = self.session.get(view.id).map(|d| &d.info);
+        match info.and_then(|i| i.open_dest.filter(|(page, _)| *page < pages).map(|d| (i, d))) {
+            Some((info, (page, dest))) if !self.always_default_view => view.go_to_dest(page, dest, info),
+            Some((_, (page, _))) => {
+                if page > 0 {
+                    view.go_to_page(page);
+                }
+            }
+            None if v.page > 0 && v.page < pages => view.go_to_page(v.page),
+            None => {}
+        }
+    }
+
+    /// Open a document and make it the active tab. Encrypted files raise the password prompt.
+    pub fn open_bytes(&mut self, name: &str, path: Option<String>, bytes: Vec<u8>) -> Result<(), String> {
+        self.startup_superseded = true;
+        self.open_bytes_with_focus(name, path, bytes, true)
+    }
+
+    pub(super) fn open_bytes_with_focus(&mut self, name: &str, path: Option<String>, bytes: Vec<u8>, activate: bool) -> Result<(), String> {
+        // Images and text files become new, unsaved PDFs (Create a PDF).
+        let active = self.active;
+        if let Some(r) = self.open_converted(name, &bytes) {
+            if !activate {
+                self.active = active;
+            }
+            return r;
+        }
+        self.try_open(name, path, std::sync::Arc::new(bytes), None, activate)
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn schedule_open(&mut self, request: OpenRequest) -> Result<u64, String> {
+        if self.open_worker.is_none() {
+            self.open_worker = Some(
+                open_worker::OpenWorker::new(
+                    #[cfg(test)]
+                    self.open_prepare_gate.clone(),
+                )
+                .map_err(|e| format!("couldn't start the document-open worker: {e}"))?,
+            );
+        }
+        let token = self.next_open_token.wrapping_add(1);
+        let worker = self.open_worker.as_ref().ok_or("the document-open worker is unavailable")?;
+        if let Some(ctx) = &self.ctx {
+            worker.set_context(ctx);
+        }
+        let receiver =
+            worker.submit(token, self.session.open_context(), request.name.clone(), request.path.clone(), request.password, request.input)?;
+        self.next_open_token = token;
+        self.pending_opens.push(PendingOpen {
+            token,
+            receiver,
+            name: request.name,
+            path: request.path,
+            stamp: request.stamp,
+            activate: request.activate,
+            after_open: request.after_open,
+            recovered: request.recovered,
+            then: request.then,
+        });
+        Ok(token)
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn poll_pending_opens(&mut self) {
+        let pending_opens = std::mem::take(&mut self.pending_opens);
+        let mut remaining = pending_opens.into_iter();
+        let mut waiting = Vec::new();
+        while let Some(pending) = remaining.next() {
+            // A tool, password prompt or file picker belongs to the document just admitted.
+            // Keep later replies queued so another open cannot change its recipient.
+            if self.modal_open() || self.pickers.pending() {
+                waiting.push(pending);
+                waiting.extend(remaining);
+                break;
+            }
+            match pending.receiver.try_recv() {
+                Ok(result) if result.token == pending.token => self.finish_pending_open(pending, result.kind),
+                Ok(_) => waiting.push(pending),
+                Err(std::sync::mpsc::TryRecvError::Empty) => waiting.push(pending),
+                Err(std::sync::mpsc::TryRecvError::Disconnected) => {
+                    self.notify_fmt("Couldn't open {name}: the background worker stopped", &[("name", &pending.name)]);
+                }
+            }
+        }
+        // A completion may schedule another open; preserve those requests as well as the
+        // earlier waiting replies, without consuming a blocked receiver's result.
+        waiting.append(&mut self.pending_opens);
+        self.pending_opens = waiting;
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn finish_pending_open(&mut self, pending: PendingOpen, kind: open_worker::ResultKind) {
+        match kind {
+            open_worker::ResultKind::ReadFailed(reason) => {
+                self.notify_fmt("Couldn't read {name}: {e}", &[("name", &pending.name), ("e", &reason)]);
+            }
+            open_worker::ResultKind::RemoteFailed(reason) => {
+                self.notify_fmt("Couldn't follow linked PDF: {reason}", &[("reason", &reason)]);
+            }
+            open_worker::ResultKind::RecoveryFailed(reason) => {
+                self.notify_fmt("Couldn't recover {name}: {e}", &[("name", &pending.name), ("e", &reason)]);
+            }
+            open_worker::ResultKind::Failed(reason) => {
+                self.notify_fmt("Couldn't open {name}: {reason}", &[("name", &pending.name), ("reason", &reason)]);
+            }
+            open_worker::ResultKind::Conversion(bytes) => match self.open_converted(&pending.name, &bytes) {
+                Some(Ok(())) => {
+                    if let Some(command) = pending.then {
+                        self.execute(command);
+                    }
+                }
+                Some(Err(error)) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error)]),
+                None => {}
+            },
+            open_worker::ResultKind::Prepared { bytes, result } => match *result {
+                Ok(prepared) => match self.finish_open(&pending.name, pending.path.clone(), bytes.len(), prepared, pending.activate) {
+                    Ok(id) => {
+                        if pending.path.is_some() {
+                            self.watch.known_as(id, pending.stamp);
+                        }
+                        if let Some(destination) = pending.after_open {
+                            self.apply_remote_destination(destination);
+                        }
+                        if let Some(meta) = &pending.recovered {
+                            self.finish_recovery(meta);
+                        }
+                        if let Some(command) = pending.then {
+                            self.execute(command);
+                        }
+                    }
+                    Err(error) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error)]),
+                },
+                Err(error @ (pdfcraft_render::OpenError::NeedsPassword | pdfcraft_render::OpenError::WrongPassword)) => {
+                    let password_error =
+                        matches!(error, pdfcraft_render::OpenError::WrongPassword).then(|| "Incorrect password. Try again.".to_string());
+                    self.password_prompt = Some(PasswordPrompt {
+                        name: pending.name,
+                        path: pending.path,
+                        bytes,
+                        stamp: pending.stamp,
+                        input: String::new(),
+                        error: password_error,
+                        activate: pending.activate,
+                        recovered: pending.recovered,
+                        then: pending.then,
+                        after_open: pending.after_open,
+                    });
+                }
+                Err(error) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error.to_string())]),
+            },
+        }
+    }
+
+    fn try_open(
+        &mut self,
+        name: &str,
+        path: Option<String>,
+        bytes: std::sync::Arc<Vec<u8>>,
+        password: Option<&str>,
+        activate: bool,
+    ) -> Result<(), String> {
+        use pdfcraft_render::OpenError;
+        let prepared = match self.session.prepare_open(name, path.clone(), bytes.clone(), password) {
+            Ok(prepared) => prepared,
+            Err(e @ (OpenError::NeedsPassword | OpenError::WrongPassword)) => {
+                let error = matches!(e, OpenError::WrongPassword).then(|| "Incorrect password. Try again.".to_string());
+                #[cfg(not(target_arch = "wasm32"))]
+                let stamp = path.as_deref().and_then(file_watch::Stamp::at);
+                self.password_prompt = Some(PasswordPrompt {
+                    name: name.to_string(),
+                    path,
+                    bytes,
+                    #[cfg(not(target_arch = "wasm32"))]
+                    stamp,
+                    input: String::new(),
+                    error,
+                    activate,
+                    recovered: None,
+                    then: None,
+                    after_open: None,
+                });
+                return Ok(());
+            }
+            Err(e) => return Err(e.to_string()),
+        };
+        self.finish_open(name, path, bytes.len(), prepared, activate).map(|_| ())
+    }
+
+    fn finish_open(
+        &mut self,
+        name: &str,
+        path: Option<String>,
+        size: usize,
+        prepared: pdfcraft_engine::PreparedDocument,
+        activate: bool,
+    ) -> Result<DocId, String> {
+        let id = self.session.commit_open(prepared);
+        self.password_prompt = None;
+        // The reading-colours preference is app-wide: a newly opened document starts with it.
+        // Idempotent: the engine returns `false` when the document has the setting already.
+        self.session.set_reading_colors(id, self.reading_colors);
+        let doc = self.session.get(id).ok_or("the document could not be opened")?;
+        let pages = doc.info.pages.len();
+        // Acrobat opens straight to the Comments panel when a document has comments.
+        // Read mode opens with the panes closed; the rail still opens them (#932). A right panel
+        // the user closed stays closed (#1590).
+        let opening_mode = self.mode_override.unwrap_or(self.default_mode);
+        let initial = doc.initial_view();
+        if activate && self.right.is_none() && !self.right_panel_closed && opening_mode != Mode::Read {
+            self.right = if !doc.info.annotations.is_empty() {
+                Some(RightPanel::Comments)
+            // A full-screen document names its panel for outside full screen, and with
+            // `/NonFullScreenPageMode /UseNone` (the default) no outline is visible (Table 147).
+            } else if !doc.info.outline.is_empty() && !initial.full_screen {
+                Some(RightPanel::Bookmarks)
+            } else {
+                None
+            };
+        }
+        let view = DocView::new(id, &doc.info, self.view_defaults);
+        self.views.push(view);
+        if activate {
+            self.active = Some(self.views.len() - 1);
+        }
+        self.apply_initial_view(self.views.len() - 1, &initial);
+        // Where the reader left off wins over the file's own initial view (#1767).
+        self.apply_last_view(self.views.len() - 1);
+        // After both, so full screen shows one fitted page and leaving it comes back to them.
+        if self.full_screen
+            && let Some(view) = self.views.last_mut()
+        {
+            view.enter_presentation();
+        }
+        // Full screen is asked for, never taken: a document can't put the app in full screen on
+        // its own (the prompt is `dialogs::full_screen_prompt`).
+        if activate && initial.full_screen {
+            self.pending_full_screen = Some(id);
+        }
+        if activate
+            && self.left_open
+            && self.left == LeftPanel::Tool("organize")
+            && let Some(view) = self.views.last_mut()
+        {
+            view.open_organize();
+        }
+        // The document shows, not the expanded All tools view over it (whichever workspace opens).
+        if activate {
+            self.all_tools_full = false;
+        }
+        if activate && let Some(mode) = self.mode_override {
+            // Explicit mode options do not reset independent --tool / --left choices.
+            self.mode = mode;
+        } else if activate && self.mode != self.default_mode {
+            // Switch workspace like the mode bar, but a left panel the user (or `--left closed`)
+            // closed stays closed, and an unchanged mode keeps the tool panel the user chose.
+            let left_open = self.left_open;
+            self.select_mode(self.default_mode);
+            self.left_open = left_open;
+        }
+        if let Some(p) = path {
+            #[cfg(target_os = "macos")]
+            macos_association::repair(std::path::Path::new(&p));
+            self.recent.retain(|r| r.path != p);
+            self.recent.insert(0, RecentFile { name: name.to_string(), path: p, pages, size });
+            self.recent.truncate(12);
+        }
+        // What the form's scripts said while it opened (messages, errors) shows now, not with
+        // the next edit.
+        // Background documents keep their script output until their tab is selected: a print
+        // or save request must never act on the current document instead.
+        if activate {
+            let out = self.session.take_js_output(id);
+            self.handle_js(id, out);
+        }
+        Ok(id)
+    }
+
+    /// Edit ▸ Attach a file…: choose a file, then attach it to the active document and show
+    /// the Attachments panel with it.
+    pub fn attach_file_dialog(&mut self) {
+        if self.active_ids().is_none() {
+            return;
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let dialog = rfd::AsyncFileDialog::new().set_title(tl!("Attach a file").to_string());
+            let target = self.active_ids().map(|(_, id)| id);
+            self.ask_one(pickers::Ask::File(dialog), target, |app, path| app.attach_file(&path));
+        }
+        #[cfg(target_arch = "wasm32")]
+        self.notify_tr("Attaching files is not available on the web yet");
+    }
+
+    /// Attach the file at `path` to the active document (document level: the Attachments
+    /// panel, not a paper-clip comment on a page).
+    pub fn attach_file(&mut self, path: &std::path::Path) {
+        let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+        let bytes = match std::fs::read(path) {
+            Ok(b) => b,
+            Err(e) => {
+                self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
+                return;
+            }
+        };
+        let mime = pdfcraft_engine::mime_for_name(&name).map(str::to_string);
+        if self.apply_edit(pdfcraft_engine::Edit::AddAttachment { name, bytes, description: None, mime }) {
+            self.choose_right_panel(Some(RightPanel::Attachments));
+        }
+    }
+
+    /// Save an attachment to disk, or open a PDF attachment in a new tab.
+    pub fn attachment_action(&mut self, doc: DocId, index: usize, open: bool) {
+        let Some(d) = self.session.get(doc) else { return };
+        let Some(att) = d.info.attachments.get(index).cloned() else { return };
+        let data = pdfcraft_render::attachment_data(&d.bytes, d.password.as_deref(), &att);
+        match (data, open) {
+            (Err(e), _) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &att.name), ("e", &e.to_string())]),
+            (Ok(bytes), true) => {
+                // The tab name later names files written from the tab (Split, Extract pages).
+                if let Err(e) = self.open_bytes(&crate::files::attachment_file_name(&att.name), None, bytes) {
+                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &att.name), ("e", &e.to_string())]);
+                }
+            }
+            (Ok(bytes), false) => {
+                #[cfg(not(target_arch = "wasm32"))]
+                self.ask_one(
+                    pickers::Ask::Save(rfd::AsyncFileDialog::new().set_file_name(crate::files::attachment_file_name(&att.name))),
+                    None,
+                    move |app, path| match crate::editing::write_atomically(&path.to_string_lossy(), &bytes) {
+                        Ok(()) => app.notify_fmt("Saved {name}", &[("name", &path.display().to_string())]),
+                        Err(e) => app.notify_fmt("Couldn't save: {e}", &[("e", &e.to_string())]),
+                    },
+                );
+                #[cfg(target_arch = "wasm32")]
+                self.notify_fmt("Downloading attachments on the web arrives with M3.10 ({n} bytes ready)", &[("n", &bytes.len().to_string())]);
+            }
+        }
+    }
+
+    /// [`Self::attachment_action`] for the file of the attachment comment at (page, index).
+    pub fn comment_attachment_action(&mut self, doc: DocId, page: usize, index: usize, open: bool) {
+        let source = pdfcraft_render::AttachmentSource::Annotation { page, index };
+        // The menus offer the items only for a listed file, so a miss is a comment gone since.
+        if let Some(i) = self.session.get(doc).and_then(|d| d.info.attachments.iter().position(|a| a.source == source)) {
+            self.attachment_action(doc, i, open);
+        }
+    }
+
+    /// Answer the password prompt (`None` cancels).
+    pub fn submit_password(&mut self, password: Option<String>) {
+        let Some(p) = self.password_prompt.take() else { return };
+        let Some(pw) = password else {
+            // A cancelled recovery goes back on offer; its snapshot stays in the store and must
+            // not attach itself to whatever document is unlocked next (#813).
+            if let Some(meta) = p.recovered {
+                self.recoverable.push(meta);
+            }
+            return;
+        };
+        #[cfg(not(target_arch = "wasm32"))]
+        if self.ctx.is_some() && !self.run_inline {
+            let result = self.schedule_open(OpenRequest {
+                name: p.name.clone(),
+                path: p.path.clone(),
+                stamp: p.stamp,
+                input: open_worker::Input::Bytes(p.bytes.clone()),
+                password: Some(pw),
+                activate: p.activate,
+                after_open: p.after_open.clone(),
+                recovered: p.recovered.clone(),
+                then: p.then,
+            });
+            if let Err(error) = result {
+                let mut prompt = p;
+                prompt.error = Some(error);
+                self.password_prompt = Some(prompt);
+            }
+            return;
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        let (path_for_watch, stamp_for_watch) = (p.path.clone(), p.stamp);
+        let after_open = p.after_open.clone();
+        match self.try_open(&p.name, p.path, p.bytes, Some(&pw), p.activate) {
+            Err(e) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &p.name), ("e", &e.to_string())]),
+            // A recovered encrypted document is open once its prompt is gone.
+            Ok(()) if self.password_prompt.is_none() => {
+                #[cfg(not(target_arch = "wasm32"))]
+                if let Some(path) = path_for_watch.as_deref()
+                    && let Some(id) = self
+                        .views
+                        .iter()
+                        .rev()
+                        .find_map(|view| self.session.get(view.id).and_then(|doc| (doc.path.as_deref() == Some(path)).then_some(view.id)))
+                {
+                    self.watch.known_as(id, stamp_for_watch);
+                }
+                if let Some(destination) = after_open {
+                    self.apply_remote_destination(destination);
+                }
+                if let Some(meta) = &p.recovered {
+                    self.finish_recovery(meta);
+                }
+                if let Some(command) = p.then {
+                    self.execute(command);
+                }
+            }
+            // Wrong password: the new prompt is for the same bytes, so it keeps the snapshot
+            // and the tool waiting for it.
+            Ok(()) => {
+                if let Some(prompt) = self.password_prompt.as_mut() {
+                    prompt.recovered = p.recovered;
+                    prompt.then = p.then;
+                    prompt.after_open = after_open;
+                }
+            }
+        }
+    }
+
+    /// Ask for the active document's permissions password, then run `then` (if any).
+    pub(crate) fn request_unlock(&mut self, then: Option<&'static str>) {
+        let Some(doc) = self.active_ids().and_then(|(_, id)| self.session.get(id)) else { return };
+        self.unlock_prompt = Some(UnlockPrompt::new(doc, then));
+    }
+
+    /// Answer the permissions password prompt (`None` cancels).
+    pub fn submit_unlock(&mut self, password: Option<String>) {
+        let Some(mut p) = self.unlock_prompt.take() else { return };
+        let Some(pw) = password else { return };
+        match self.session.unlock(p.doc, &pw) {
+            // Carry on with what asked for the password, if its document is still the one shown.
+            Ok(()) => match p.then {
+                Some(command) if self.active_ids().is_some_and(|(_, id)| id == p.doc) => {
+                    self.execute(command);
+                }
+                _ => self.notify_tr("Restrictions lifted"),
+            },
+            Err(pdfcraft_engine::EditError::WrongPassword) => {
+                p.input.clear();
+                p.error = Some("Incorrect password. Try again.".to_string());
+                self.unlock_prompt = Some(p);
+            }
+            Err(e) => self.notify_fmt("Couldn't unlock {name}: {e}", &[("name", &p.name), ("e", &e.to_string())]),
+        }
+    }
+
+    /// The tab already showing the file at `path` (the same path, or one that names the same
+    /// file once made absolute).
+    pub(crate) fn tab_showing(&self, path: &str) -> Option<usize> {
+        self.views.iter().position(|v| self.session.get(v.id).and_then(|d| d.path.as_deref()).is_some_and(|p| same_file(p, path)))
+    }
+
+    /// Open a file from a recent list: focus the tab already showing it, else open it (File ▸
+    /// Open Recent and the Home view's list share this).
+    pub fn open_recent(&mut self, path: &str) {
+        if let Some(i) = self.tab_showing(path) {
+            self.active = Some(i);
+        } else {
+            #[cfg(not(target_arch = "wasm32"))]
+            self.open_path(path);
+        }
+        #[cfg(target_arch = "wasm32")]
+        let _ = path;
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn open_path(&mut self, path: &str) -> OpenOutcome {
+        self.open_path_then(path, None)
+    }
+
+    /// Keep a chosen tool with its file until preparation and any password entry finish. The
+    /// return value is the programmatic open contract (#1620): callers that must know whether
+    /// the file opened, focused its tab, was handed to the background worker, or failed.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn open_path_then(&mut self, path: &str, then: Option<&'static str>) -> OpenOutcome {
+        // One file, one tab (#2166): a file that is open already comes to the front instead,
+        // and the tool it was opened for runs on it. One still being opened is left to that.
+        if let Some(i) = self.tab_showing(path) {
+            self.startup_superseded = true;
+            self.active = Some(i);
+            if let Some(command) = then {
+                self.execute(command);
+            }
+            return OpenOutcome::Focused;
+        }
+        if self.pending_opens.iter().any(|p| p.path.as_deref().is_some_and(|p| same_file(p, path))) {
+            return OpenOutcome::Pending;
+        }
+        let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
+        // Taken before reading: a build that rewrites the file meanwhile still counts as a change.
+        let stamp = file_watch::Stamp::at(path);
+        // Before the first frame there is no interaction to keep responsive; this also preserves
+        // deterministic inline startup and test flows. Once live, reading and preparation use
+        // the bounded worker and commit on the UI thread.
+        if self.ctx.is_none() || self.run_inline {
+            match std::fs::read(path) {
+                Ok(bytes) => {
+                    let before = self.views.len();
+                    if let Err(error) = self.open_bytes(&name, Some(path.to_string()), bytes) {
+                        self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
+                        return OpenOutcome::Failed;
+                    }
+                    if let Some(prompt) = self.password_prompt.as_mut().filter(|p| p.path.as_deref() == Some(path)) {
+                        // Encrypted: the tool runs once the password is in.
+                        prompt.then = then;
+                    } else if self.views.len() > before {
+                        if let Some(doc) = self.views.last().map(|view| view.id) {
+                            self.watch.known_as(doc, stamp);
+                        }
+                        if let Some(command) = then {
+                            self.execute(command);
+                        }
+                    } else {
+                        // Open reported success but added no tab and raised no prompt; the
+                        // control channel answers this as a failure to open.
+                        return OpenOutcome::Failed;
+                    }
+                    OpenOutcome::Opened
+                }
+                Err(error) => {
+                    self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &error.to_string())]);
+                    OpenOutcome::Failed
+                }
+            }
+        } else {
+            self.startup_superseded = true;
+            match self.schedule_open(OpenRequest {
+                name: name.clone(),
+                path: Some(path.to_string()),
+                stamp,
+                input: open_worker::Input::Path(std::path::PathBuf::from(path)),
+                password: None,
+                activate: true,
+                after_open: None,
+                recovered: None,
+                then,
+            }) {
+                Ok(_) => OpenOutcome::Pending,
+                Err(error) => {
+                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
+                    OpenOutcome::Failed
+                }
+            }
+        }
+    }
+
+    /// The File ▸ Open picker: PDFs, and images and text that become PDFs.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(super) fn open_picker() -> rfd::AsyncFileDialog {
+        rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).add_filter(tl!("Images and text (converted to PDF)"), &create_ui::CONVERTIBLE)
+    }
+
+    pub fn open_dialog(&mut self) {
+        self.startup_superseded = true;
+        #[cfg(not(target_arch = "wasm32"))]
+        self.pick(
+            pickers::PickFor::Open,
+            rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).add_filter(tl!("Images and text (converted to PDF)"), &create_ui::CONVERTIBLE),
+            true,
+        );
+        // Browsers pick files asynchronously; the bytes arrive through `inbox`.
+        #[cfg(target_arch = "wasm32")]
+        {
+            let inbox = self.inbox.clone();
+            let ctx = self.ctx.clone();
+            wasm_bindgen_futures::spawn_local(async move {
+                if let Some(h) = rfd::AsyncFileDialog::new()
+                    .add_filter("PDF", &["pdf"])
+                    .add_filter(tl!("Images and text"), &create_ui::CONVERTIBLE)
+                    .pick_file()
+                    .await
+                {
+                    let bytes = h.read().await;
+                    if let Ok(mut q) = inbox.lock() {
+                        q.push((h.file_name(), bytes));
+                    }
+                    // The read may finish while the app is idle: wake it to open the file.
+                    if let Some(ctx) = ctx {
+                        ctx.request_repaint();
+                    }
+                }
+            });
+        }
+    }
+
+    pub fn close_tab(&mut self, index: usize) {
+        if index >= self.views.len() {
+            return;
+        }
+        self.remember_view(index);
+        let id = self.views.remove(index).id;
+        #[cfg(not(target_arch = "wasm32"))]
+        if let Some(path) = self.session.get(id).and_then(|d| d.path.clone()) {
+            if self.closed_tabs.len() == 10 {
+                self.closed_tabs.remove(0);
+            }
+            self.closed_tabs.push(path);
+        }
+        self.forget_recovery(id);
+        self.session.close(id);
+        self.active = match self.active {
+            _ if self.views.is_empty() => None,
+            Some(a) if a > index => Some(a - 1),
+            Some(a) if a >= self.views.len() => Some(self.views.len() - 1),
+            other => other,
+        };
+    }
+
+    /// Moves the tab at `from` so it sits at `to` (#1537). The same document stays active
+    /// wherever it lands; an index out of range changes nothing.
+    pub fn move_tab(&mut self, from: usize, to: usize) {
+        if from >= self.views.len() || to >= self.views.len() || from == to {
+            return;
+        }
+        let active = self.active_ids().map(|(_, id)| id);
+        let view = self.views.remove(from);
+        self.views.insert(to, view);
+        if let Some(id) = active {
+            self.active = self.views.iter().position(|v| v.id == id);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/app/frame.rs b/crates/ui-egui/src/app/frame.rs
new file mode 100644
index 0000000000..e0a8370c60
--- /dev/null
+++ b/crates/ui-egui/src/app/frame.rs
@@ -0,0 +1,191 @@
+use super::*;
+
+impl PdfCraftApp {
+    /// Draw the running job's progress card and pass a Cancel click on to the job.
+    pub(super) fn show_progress(&mut self, ctx: &egui::Context) {
+        if widgets::progress_notice(self, ctx) {
+            self.cancel_optimize();
+        }
+    }
+
+    pub(super) fn sync_theme(&mut self, ctx: &egui::Context) {
+        #[cfg_attr(not(target_os = "linux"), expect(unused_mut))]
+        let mut system = ctx.system_theme().map(|theme| theme == egui::Theme::Dark);
+        #[cfg(target_os = "linux")]
+        {
+            let active = self.theme_preference == ThemePreference::System;
+            if self.desktop_theme_enabled && active && self.desktop_theme.is_none() {
+                let ctx = ctx.clone();
+                self.desktop_theme = Some(pdfcraft_platform::desktop_theme::DesktopTheme::start(move || ctx.request_repaint()));
+            }
+            if let Some(desktop) = &self.desktop_theme {
+                desktop.set_active(active);
+                // The standard portal supplies Linux desktop appearance. No preference
+                // must clear an earlier answer rather than retaining stale dark chrome.
+                system = desktop.get().map(|appearance| appearance == pdfcraft_platform::desktop_theme::DesktopAppearance::Dark);
+            }
+        }
+        let kind = self.theme_preference.resolve(system, ThemeKind::Light);
+        if kind != self.theme {
+            self.theme = kind;
+            theme::apply(ctx, kind);
+        }
+    }
+}
+
+/// Root-level panel salts whose 0.36 persisted state key changed in 0.37.
+///
+/// The shared rail and side panes now own their state. The legacy `rail` and
+/// `read_right_panel` entries are inert; the former `rail-nav` footer is no longer migrated.
+const PANEL_SALTS: [&str; 4] = ["tab_strip", "mode_bar", "rail", "read_right_panel"];
+
+/// Copy persisted 0.36 panel sizes to 0.37's parent-scope key, once, before the first panel.
+///
+/// 0.36 stored [`egui::PanelState`] under the panel's own `Id::unique(salt)`; 0.37 derives it
+/// from the parent `Ui`'s scope plus an `IdSalt`. A missing copy would reset a width the user
+/// chose. The old entry is left untouched, so rolling back to 0.36 still finds it.
+pub(super) fn migrate_panel_state(ui: &egui::Ui) {
+    if ui.ctx().viewport_id() != egui::ViewportId::ROOT {
+        return;
+    }
+    for salt in PANEL_SALTS {
+        migrate_panel_state_from(ui, salt);
+    }
+}
+
+/// Copy one 0.36 panel's state to the key derived from this exact parent `Ui`.
+///
+/// The parent must be the `Ui` the panel is shown in (for a nested panel, the panel's content
+/// `Ui`), because 0.37's key includes that `Ui`'s scope.
+pub(crate) fn migrate_panel_state_from(ui: &egui::Ui, salt: &str) {
+    let old = egui::Id::unique(salt);
+    let new = ui.scope_id().with_salt(egui::IdSalt::new(salt));
+    if old == new || egui::PanelState::load(ui.ctx(), new).is_some() {
+        return;
+    }
+    if let Some(state) = egui::PanelState::load(ui.ctx(), old) {
+        ui.ctx().data_mut(|data| data.insert_persisted(new, state));
+        log::debug!("migrated panel {salt} state {:?}", state.size());
+    }
+}
+
+impl PdfCraftApp {
+    /// The parts of [`eframe::App::raw_input_hook`] that must run before egui's input hooks:
+    /// publish this pass's input-target generation to the control plugin, and hand the wheel
+    /// input to the reduced-motion reader.
+    ///
+    /// A test host that drives the app without eframe's raw hook can call this first, so its
+    /// frame ordering matches production instead of hiding focus-change bugs.
+    #[doc(hidden)]
+    pub fn prepare_raw_input(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        // The control plugin's input hook runs next: give it this pass's input generation.
+        if let Some(control) = &self.control {
+            control.set_epoch(self.input_epoch());
+        }
+        // Before egui reads this frame's wheel input.
+        self.scroll_speed.apply(ctx, raw);
+        // The native menu's key equivalents.
+        if let Some(native) = self.native_menu.as_mut() {
+            native.raw_input(raw);
+        }
+    }
+}
+
+impl PdfCraftApp {
+    pub(crate) fn finish_render_frame(&mut self, ctx: &egui::Context) {
+        self.finish_document_copy(ctx);
+        // The Combine grid's thumbnails, whichever tab shows (renders under way still finish).
+        self.combine_thumbs_frame(ctx);
+        // Retire hidden documents before admitting the visible document's textures, so the
+        // three cache limits apply to the application, regardless of how many tabs are open.
+        // Side by side: the comparison's old file renders alongside the active one.
+        let partner = self.active.and_then(|i| compare_ui::side_by_side(self, i)).map(|(old, _)| old);
+        for (i, view) in self.views.iter_mut().enumerate() {
+            if Some(i) != self.active
+                && Some(i) != partner
+                && let Some(doc) = self.session.get(view.id)
+            {
+                view.suspend_rendering(&doc.renderer);
+            }
+        }
+        for i in self.active.into_iter().chain(partner) {
+            if let Some(view) = self.views.get_mut(i)
+                && let Some(doc) = self.session.get(view.id)
+            {
+                view.finish_render_frame(ctx, &doc.info, &doc.renderer);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod panel_migration_tests {
+    use super::*;
+
+    fn state(width: f32) -> egui::PanelState {
+        egui::PanelState { outer_rect: egui::Rect::from_min_size(egui::pos2(0.0, 0.0), egui::vec2(width, 900.0)) }
+    }
+
+    /// 0.36 stored a panel's persisted size under `Id::unique(salt)`. 0.37 derives the key from
+    /// the root `Ui`'s scope; the upgrade must carry the chosen width over, not reset it.
+    #[test]
+    fn upgrade_from_036_panel_memory_keeps_width() {
+        let ctx = egui::Context::default();
+        let old = egui::Id::unique("rail");
+        ctx.data_mut(|d| d.insert_persisted(old, state(287.0)));
+        let mut migrated = None;
+        let mut new_id = None;
+        let output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            migrate_panel_state(ui);
+            new_id = Some(ui.scope_id().with_salt(egui::IdSalt::new("rail")));
+            migrated = egui::PanelState::load(ui.ctx(), new_id.expect("an id"));
+        });
+        output.drop_without_applying_deltas();
+        let migrated = migrated.expect("the 0.36 panel width migrates to the 0.37 key");
+        assert!((migrated.size().x - 287.0).abs() <= 1.0, "width survives: {:?}", migrated.size());
+        assert_eq!(new_id.unwrap(), ctx.viewport_id().root_ui_id().with_salt(egui::IdSalt::new("rail")));
+        assert!(egui::PanelState::load(&ctx, old).is_some(), "the old key stays for rollback");
+    }
+
+    /// A synthetic nested panel is keyed from its own parent `Ui`, not the root.
+    /// Migrating it at the root would silently miss its 0.36 state; the fixture uses
+    /// legacy rail names but does not model the current shared rail implementation.
+    #[test]
+    fn nested_panel_state_migrates_from_its_actual_parent_ui() {
+        let ctx = egui::Context::default();
+        let old = egui::Id::unique("rail-nav");
+        ctx.data_mut(|d| d.insert_persisted(old, state(140.0)));
+        let mut nested_id = None;
+        let mut migrated = None;
+        let output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            egui::Panel::right("rail").resizable(false).exact_size(48.0).show(ui, |ui| {
+                migrate_panel_state_from(ui, "rail-nav");
+                // The key egui will use for the nested panel shown in this same Ui.
+                let key = ui.scope_id().with_salt(egui::IdSalt::new("rail-nav"));
+                nested_id = Some(key);
+                migrated = egui::PanelState::load(ui.ctx(), key);
+                egui::Panel::bottom("rail-nav").resizable(false).show(ui, |_ui| {});
+            });
+        });
+        output.drop_without_applying_deltas();
+        let migrated = migrated.expect("the nested 0.36 state migrates to its parent-scoped key");
+        assert_eq!(migrated.size().x, 140.0);
+        assert_ne!(nested_id.unwrap(), ctx.viewport_id().root_ui_id().with_salt(egui::IdSalt::new("rail-nav")), "the nested key is not the root key");
+    }
+
+    /// The one-time copy must never overwrite state a 0.37 run has already stored.
+    #[test]
+    fn migration_does_not_replace_a_037_panel_state() {
+        let ctx = egui::Context::default();
+        let old = egui::Id::unique("rail");
+        let new = ctx.viewport_id().root_ui_id().with_salt(egui::IdSalt::new("rail"));
+        ctx.data_mut(|d| {
+            d.insert_persisted(old, state(287.0));
+            d.insert_persisted(new, state(412.0));
+        });
+        let output = ctx.run_ui(egui::RawInput::default(), |ui| migrate_panel_state(ui));
+        output.drop_without_applying_deltas();
+        let kept = egui::PanelState::load(&ctx, new).expect("the 0.37 state");
+        assert_eq!(kept.size().x, 412.0);
+    }
+}
diff --git a/crates/ui-egui/src/app/input.rs b/crates/ui-egui/src/app/input.rs
new file mode 100644
index 0000000000..ad554c1dfd
--- /dev/null
+++ b/crates/ui-egui/src/app/input.rs
@@ -0,0 +1,140 @@
+use super::*;
+
+/// Read a file dropped on a page grid (see [`GridFile`]).
+fn read_grid_file((name, source): GridFile) -> Result<(String, Vec<u8>), (String, String)> {
+    let bytes = match source {
+        Ok(bytes) => bytes,
+        Err(path) => std::fs::read(&path).map_err(|e| (name.clone(), e.to_string()))?,
+    };
+    Ok((name, bytes))
+}
+
+impl PdfCraftApp {
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(super) fn open_dropped(&mut self, f: egui::DroppedFileHandle, _ctx: &egui::Context) {
+        let p = f.path().to_string_lossy().into_owned();
+        if !p.is_empty() && f.path().is_absolute() {
+            self.open_path(&p);
+            return;
+        }
+        let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
+        match f.bytes() {
+            Ok(bytes) => {
+                if self.ctx.is_some() && !self.run_inline {
+                    let result = self.schedule_open(OpenRequest {
+                        name: name.clone(),
+                        path: None,
+                        stamp: None,
+                        input: open_worker::Input::Bytes(std::sync::Arc::new(bytes)),
+                        password: None,
+                        activate: true,
+                        after_open: None,
+                        recovered: None,
+                        then: None,
+                    });
+                    if let Err(error) = result {
+                        self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
+                    }
+                } else if let Err(error) = self.open_bytes(&name, None, bytes) {
+                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
+                }
+            }
+            Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e.to_string())]),
+        }
+    }
+
+    /// The document whose page grid is showing and may take pages, if any.
+    fn grid_target(&self) -> Option<pdfcraft_engine::DocId> {
+        let view = self.active.and_then(|i| self.views.get(i)).filter(|v| v.organize)?;
+        (self.dialog.is_none() && self.session.get(view.id)?.allows_assembly()).then_some(view.id)
+    }
+
+    /// The document whose Pages panel is under the pointer and may take pages, if any.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn panel_target(&self, ctx: &egui::Context) -> Option<pdfcraft_engine::DocId> {
+        let view = self.active.and_then(|i| self.views.get(i))?;
+        let pointer = ctx.input(|i| i.pointer.hover_pos())?;
+        let over = view.pages_panel.is_some_and(|panel| panel.contains(pointer));
+        (over && self.dialog.is_none() && self.session.get(view.id)?.allows_assembly()).then_some(view.id)
+    }
+
+    /// Files dropped on the Pages panel, or while the page grid shows, are inserted into the
+    /// document rather than opened: they are kept until [`Self::finish_grid_drop`] knows the
+    /// gap. Returns the files not taken.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(super) fn drop_on_grid(&mut self, dropped: Vec<egui::DroppedFileHandle>, ctx: &egui::Context) -> Vec<egui::DroppedFileHandle> {
+        if dropped.is_empty() {
+            return dropped;
+        }
+        // The panel first: the grid takes files dropped anywhere in the window.
+        let (id, panel) = match (self.panel_target(ctx), self.grid_target()) {
+            (Some(id), _) => (id, true),
+            (None, Some(id)) => (id, false),
+            (None, None) => return dropped,
+        };
+        let mut files = Vec::new();
+        for f in &dropped {
+            let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
+            if f.path().is_absolute() {
+                files.push((name, Err(f.path().to_path_buf())));
+                continue;
+            }
+            match f.bytes() {
+                Ok(b) => files.push((name, Ok(b))),
+                Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e)]),
+            }
+        }
+        if !files.is_empty() {
+            // Where there is no telling where the pointer is during the drag, its place arrives
+            // with the first move after the drop.
+            ctx.request_repaint();
+            self.grid_drop = Some(GridDrop { doc: id, panel, files, deadline: web_time::Instant::now() + std::time::Duration::from_secs(1) });
+        }
+        Vec::new()
+    }
+
+    /// Insert files dropped on the page grid or the Pages panel at the gap under the pointer,
+    /// or at the end when the pointer hasn't shown up in time.
+    pub(super) fn finish_grid_drop(&mut self, ctx: &egui::Context) {
+        let Some(GridDrop { doc: id, panel, deadline, .. }) = &self.grid_drop else { return };
+        let (id, panel, deadline) = (*id, *panel, *deadline);
+        let still = if panel {
+            self.dialog.is_none()
+                && self.active_ids().map(|(_, active)| active) == Some(id)
+                && self.session.get(id).is_some_and(|d| d.allows_assembly())
+        } else {
+            self.grid_target() == Some(id)
+        };
+        if !still {
+            self.grid_drop = None;
+            return self.notify_tr("The document changed while you were choosing a file, so nothing was changed.");
+        }
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return };
+        let gap = match if panel { view.panel_gap } else { view.grid_gap } {
+            Some(gap) => gap,
+            None if web_time::Instant::now() >= deadline => usize::MAX,
+            None => return ctx.request_repaint(),
+        };
+        view.insert_at = Some(gap);
+        if let Some(drop) = self.grid_drop.take() {
+            self.insert_each(drop.files.into_iter().map(read_grid_file));
+        }
+    }
+
+    /// Browsers read dropped files asynchronously; the bytes land in `inbox` and open next frame.
+    #[cfg(target_arch = "wasm32")]
+    pub(super) fn open_dropped(&mut self, f: egui::DroppedFileHandle, ctx: &egui::Context) {
+        self.startup_superseded = true;
+        let inbox = self.inbox.clone();
+        let ctx = ctx.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
+            if let Ok(bytes) = f.bytes_async().await
+                && let Ok(mut q) = inbox.lock()
+            {
+                q.push((name, bytes));
+                ctx.request_repaint();
+            }
+        });
+    }
+}
diff --git a/crates/ui-egui/src/app/keys.rs b/crates/ui-egui/src/app/keys.rs
new file mode 100644
index 0000000000..cdc696f95b
--- /dev/null
+++ b/crates/ui-egui/src/app/keys.rs
@@ -0,0 +1,116 @@
+use super::*;
+
+impl PdfCraftApp {
+    pub(super) fn shortcuts(&mut self, ctx: &egui::Context) {
+        use egui::Key;
+        let pasted = self.paste_key_released(ctx);
+        // "Save changes?" is modal: its keys are its own (⌘D is Don't save there, not Document
+        // properties; Escape cancels it rather than clearing a selection), and nothing may run
+        // underneath it. They are read here, before the canvas can consume them.
+        if self.close_request.is_some() {
+            // These dialogs are drawn after the save prompt and own the keyboard while open.
+            // Don't let Escape or Return resolve unsaved work underneath one.
+            let covered = self.pending_link.is_some()
+                || self.pending_remote_link.is_some()
+                || self.pending_full_screen.is_some()
+                || self.updates.open
+                || self.dialog.is_some()
+                || self.unlock_prompt.is_some();
+            if !covered && let Some(choice) = dialogs::save_prompt_key(ctx, &mut self.save_prompt_button) {
+                self.resolve_close(ctx, choice);
+            }
+            return;
+        }
+        // The other dialogs and prompts are modal too (⌘W closed the file behind Preferences,
+        // #870).
+        if self.modal_open() {
+            return;
+        }
+        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i))
+            && view.auto_scroll.escape(ctx)
+        {
+            return;
+        }
+        // The in-window menu bar holds the keys while one of its menus is open or it has the
+        // keyboard (Alt, F10); a command shortcut leaves it and runs.
+        craft_menu::bar::leave_for_shortcut(ctx);
+        if !craft_menu::bar::is_open(ctx) && !craft_menu::bar::is_focused(ctx) {
+            self.registry_shortcuts(ctx);
+        }
+        // (Esc closes a Combine file shown large first.)
+        if self.full_screen && self.combine_tab.preview.is_none() && ctx.input(|i| i.key_pressed(Key::Escape)) {
+            self.set_full_screen(ctx, false);
+        }
+        if let Some(i) = self.active {
+            // Select all belongs to the document or page grid, unless a text field or
+            // overlay owns the keyboard. Other canvas shortcuts keep their own handling.
+            if self.dialog.is_none()
+                && !self.palette_open
+                && !ctx.egui_wants_keyboard_input()
+                && ctx.input_mut(|input| input.consume_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, Key::A)))
+            {
+                if self.is_preparing() {
+                    if let Some(doc) = self.session.get(self.views[i].id) {
+                        prepare::select_all(&mut self.views[i], &doc.form);
+                    }
+                } else {
+                    self.views[i].select_all();
+                }
+            }
+            self.tool_keys(i, ctx);
+            if self.quick_tool == QuickTool::EditText
+                && let Some(doc) = self.session.get(self.views[i].id).filter(|d| d.allows_modification())
+            {
+                object_ui::nudge_keys(ctx, &mut self.views[i], doc);
+                object_ui::delete_keys(ctx, &mut self.views[i]);
+            } else if let Some(doc) = self.session.get(self.views[i].id).filter(|d| d.allows_annotation()) {
+                comments::nudge_keys(ctx, &mut self.views[i], &doc.info);
+            }
+            // A selected field moves with the arrows too (Prepare a form, #2608), before the view
+            // turns the page with them.
+            if self.is_preparing()
+                && let Some(doc) = self.session.get(self.views[i].id).filter(|d| d.allows_modification())
+            {
+                prepare::nudge_keys(ctx, &mut self.views[i], doc);
+            }
+            canvas::shortcuts(&mut self.views[i], ctx, self.scroll_speed);
+            self.copy_key(i, ctx);
+            self.paste_image_key(i, ctx, pasted);
+            self.image_pick_keys(i, ctx);
+        }
+    }
+}
+
+impl PdfCraftApp {
+    /// The quick tools' keys, as in Acrobat: V selects, H pans, and holding Space pans until it
+    /// is released. Plain letters, so not while a text field, a form field, a dialog or the
+    /// palette has the keyboard.
+    fn tool_keys(&mut self, i: usize, ctx: &egui::Context) {
+        use egui::Key;
+        let free = self.dialog.is_none() && !self.palette_open && !ctx.egui_wants_keyboard_input() && self.views[i].forms.focus.is_none();
+        let (plain, space) = ctx.input(|input| (input.modifiers.is_none(), input.key_down(Key::Space)));
+        if let Some(previous) = self.space_hand
+            && !space
+        {
+            self.space_hand = None;
+            if self.quick_tool == QuickTool::Hand {
+                self.quick_tool = previous;
+            }
+        }
+        if !free || !plain {
+            return;
+        }
+        if ctx.input(|input| input.key_pressed(Key::V)) {
+            self.quick_tool = QuickTool::Select;
+            self.space_hand = None;
+        }
+        if ctx.input(|input| input.key_pressed(Key::H)) {
+            self.quick_tool = QuickTool::Hand;
+            self.space_hand = None;
+        }
+        if space && self.space_hand.is_none() && self.quick_tool != QuickTool::Hand {
+            self.space_hand = Some(self.quick_tool);
+            self.quick_tool = QuickTool::Hand;
+        }
+    }
+}
diff --git a/crates/ui-egui/src/app/links.rs b/crates/ui-egui/src/app/links.rs
new file mode 100644
index 0000000000..77f9519972
--- /dev/null
+++ b/crates/ui-egui/src/app/links.rs
@@ -0,0 +1,125 @@
+use super::*;
+
+impl PdfCraftApp {
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn open_remote_link(&mut self, source: DocId, file: String, destination: pdfcraft_render::RemoteDestination) {
+        if self.pending_remote_link.is_some() || self.pending_link.is_some() {
+            return;
+        }
+        let Some(source_doc) = self.session.get(source) else { return };
+        let source_path = source_doc.path.clone();
+        let path = match pdfcraft_engine::resolve_remote_document_path(source_path.as_deref().map(std::path::Path::new), &file) {
+            Ok(path) => path,
+            Err(e) => {
+                self.notify_fmt("Couldn't follow linked PDF: {reason}", &[("reason", &e.to_string())]);
+                return;
+            }
+        };
+        if pdfcraft_engine::remote_document_path_is_absolute(&file) {
+            self.pending_remote_link = Some(PendingRemoteLink { source, path, destination });
+            return;
+        }
+        self.open_resolved_remote_link(path, destination);
+    }
+
+    /// Take a pending request exactly once. Closing its source invalidates the request.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn resolve_pending_remote_link(&mut self, open: bool) {
+        if let Some(pending) = self.pending_remote_link.take()
+            && open
+            && self.session.get(pending.source).is_some()
+        {
+            self.open_resolved_remote_link(pending.path, pending.destination);
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open_resolved_remote_link(&mut self, path: std::path::PathBuf, destination: pdfcraft_render::RemoteDestination) {
+        let path = path.to_string_lossy().into_owned();
+        let name = std::path::Path::new(&path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.clone());
+        let stamp = file_watch::Stamp::at(&path);
+        self.startup_superseded = true;
+        let result = self.schedule_open(OpenRequest {
+            name: name.clone(),
+            path: Some(path.clone()),
+            stamp,
+            input: open_worker::Input::RemotePath(std::path::PathBuf::from(path)),
+            password: None,
+            activate: true,
+            after_open: Some(destination),
+            recovered: None,
+            then: None,
+        });
+        if let Err(error) = result {
+            self.notify_fmt("Couldn't follow linked PDF: {reason}", &[("reason", &error)]);
+        }
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    pub(crate) fn open_remote_link(&mut self, _source: DocId, _file: String, _destination: pdfcraft_render::RemoteDestination) {
+        self.notify_tr("Local cross-PDF links require the desktop app");
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    pub fn resolve_pending_remote_link(&mut self, _open: bool) {
+        self.pending_remote_link = None;
+    }
+
+    pub(super) fn apply_remote_destination(&mut self, destination: pdfcraft_render::RemoteDestination) {
+        let Some(index) = self.views.len().checked_sub(1) else { return };
+        let Some(doc) = self.session.get(self.views[index].id) else { return };
+        let warning = match destination {
+            pdfcraft_render::RemoteDestination::Default => None,
+            pdfcraft_render::RemoteDestination::Named(_) => Some("The linked PDF opened, but its named destination was not applied."),
+            pdfcraft_render::RemoteDestination::Page { page, view } if page < doc.info.pages.len() => {
+                self.views[index].go_to_dest(page, view, &doc.info);
+                None
+            }
+            pdfcraft_render::RemoteDestination::Page { .. } => Some("The linked PDF opened, but its page destination was out of range."),
+        };
+        if let Some(warning) = warning {
+            self.notify_tr(warning);
+        }
+    }
+
+    /// Open a web link in the system browser (a new tab on the web). Only for PdfCraft's own
+    /// links; an address that came from a document goes through [`Self::request_document_url`].
+    pub fn open_url(&mut self, url: &str) {
+        if let Some(ctx) = &self.ctx {
+            ctx.open_url(egui::OpenUrl::new_tab(url));
+        }
+        self.last_opened_url = Some(url.to_string());
+    }
+
+    /// A document asks to open `url` (a link, a button's URI action or `app.launchURL`). Web and
+    /// email addresses wait for the user to allow them; anything else is refused with a notice
+    /// (#90, #91). While one request is waiting, further ones are dropped, so a script can't
+    /// queue up a stream of dialogs.
+    pub fn request_document_url(&mut self, url: &str, origin: LinkOrigin) {
+        match pdfcraft_engine::links::document_url(url) {
+            Ok(url) => {
+                if self.pending_link.is_none() && self.pending_remote_link.is_none() {
+                    self.pending_link = Some(PendingLink { url, origin });
+                }
+            }
+            Err(e) => {
+                use pdfcraft_engine::links::BlockedLink;
+                let template = if matches!(e, BlockedLink::MailFile | BlockedLink::MailEncodedWord) {
+                    "{who} in this document tried to open an address PdfCraft won't open: {e}."
+                } else {
+                    "{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents."
+                };
+                self.notify_fmt(template, &[("who", tl!(origin.noun())), ("e", &e.to_string())]);
+            }
+        }
+    }
+
+    /// The user's answer to [`Self::pending_link`]: open it, or drop it.
+    pub fn resolve_pending_link(&mut self, open: bool) {
+        if let Some(p) = self.pending_link.take()
+            && open
+        {
+            self.open_url(&p.url);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/app/prefs.rs b/crates/ui-egui/src/app/prefs.rs
new file mode 100644
index 0000000000..ac8ac644ee
--- /dev/null
+++ b/crates/ui-egui/src/app/prefs.rs
@@ -0,0 +1,337 @@
+use super::*;
+
+/// [`PdfCraftApp::date_text`] for callers that already borrow other parts of the app.
+pub(crate) fn date_text(session: &Session, fmt: Option<&str>) -> Result<String, String> {
+    let lang = session.date_language().unwrap_or(i18n::current().code());
+    session.today_text(fmt, Some(lang))
+}
+
+/// Today in Preferences ▸ Date format for stamping into a PDF; refused when it has characters
+/// Fill & Sign can't write yet (see [`pdfcraft_engine::dates::unwritable`]).
+pub(crate) fn date_text_for_pdf(session: &Session) -> Result<String, String> {
+    let lang = session.date_language().unwrap_or(i18n::current().code());
+    session.today_text_for_pdf(None, Some(lang))
+}
+
+/// The longest author name kept (Preferences ▸ Identity, restored settings).
+pub(crate) const MAX_AUTHOR_CHARS: usize = 200;
+
+/// A restored colour: an `[r, g, b]` array of finite numbers, each clamped to 0–1 (restored
+/// settings are untrusted). Anything else (a string, a wrong length, a null or a non-finite
+/// number) is refused whole, so the caller keeps its default.
+fn rgb_triple(v: &serde_json::Value) -> Option<[f64; 3]> {
+    let a = v.as_array()?;
+    if a.len() != 3 {
+        return None;
+    }
+    let mut out = [0.0f64; 3];
+    for (slot, x) in out.iter_mut().zip(a.iter()) {
+        let n = x.as_f64()?;
+        if !n.is_finite() {
+            return None;
+        }
+        *slot = n.clamp(0.0, 1.0);
+    }
+    Some(out)
+}
+
+impl PdfCraftApp {
+    pub fn set_theme_preference(&mut self, preference: ThemePreference) {
+        self.theme_preference = preference;
+        if let Some(ctx) = self.ctx.clone() {
+            self.sync_theme(&ctx);
+            theme::apply(&ctx, self.theme);
+        } else {
+            self.theme = preference.resolve(None, ThemeKind::Light);
+        }
+    }
+
+    /// The app-wide reading-colours preference: sets it and applies it to every open document,
+    /// not just the active one (Preferences ▸ Reading colours, Acrobat's Replace Document
+    /// Colors). A document the change actually touches re-renders.
+    pub fn set_reading_colors(&mut self, colors: pdfcraft_render::ReadingColors) {
+        self.reading_colors = colors;
+        for i in 0..self.views.len() {
+            // Idempotent per document: the engine says whether anything changed.
+            if self.session.set_reading_colors(self.views[i].id, colors) {
+                self.views[i].invalidate_content();
+            }
+        }
+    }
+
+    /// Enable the Linux desktop portal in a native window. Headless contexts keep
+    /// their supplied input and never connect to the user's session bus.
+    #[cfg(target_os = "linux")]
+    pub fn enable_desktop_theme(&mut self) {
+        self.desktop_theme_enabled = true;
+    }
+
+    /// Today in `fmt` (or Preferences ▸ Date format), with month and weekday names in the date
+    /// language, or the interface language when it follows that.
+    pub fn date_text(&self, fmt: Option<&str>) -> Result<String, String> {
+        date_text(&self.session, fmt)
+    }
+
+    /// Serialize the user's persistent state (recent files, theme). Local only.
+    pub fn persist(&self) -> String {
+        let trusted: Vec<String> = self.session.trusted_certificates().iter().map(pdfcraft_engine::sign::x509::to_pem).collect();
+        let mut v = serde_json::json!({
+            "side_panels": self.side_panels.to_json(self.left_open),
+            "docking_right": self.right,
+            "recent": self.recent,
+            "reopen_last_session": self.reopen_last_session,
+            "restore_last_view": self.restore_last_view,
+            "last_views": self.last_views_to_save(),
+            // Kept only while the preference is on.
+            "last_session": self.reopen_last_session.then(|| self.session_to_save()),
+            "reload_changed_files": self.reload_changed_files,
+            "system_title_bar": self.system_title_bar,
+            "pinned_folders": self.pinned.folders,
+            "theme": self.theme_preference,
+            "scroll_speed": self.scroll_speed,
+            "animation_effects": self.animation_effects,
+            "default_mode": self.default_mode,
+            "default_layout": canvas::display_token(self.view_defaults.layout, self.view_defaults.continuous),
+            "default_zoom": self.view_defaults.zoom_name(),
+            "always_default_view": self.always_default_view,
+            "highlight_fields": self.view_defaults.highlight_fields,
+            "units": self.units,
+            "language": self.language,
+            "reading_colors": self.reading_colors,
+            // Null follows the system's text scaling.
+            "ui_scale": self.ui_scale,
+            "flatten_fill_sign": self.flatten_fill_sign_on_save,
+            "fill_text_size": self.fill_text_size,
+            "date_format": self.session.date_format(),
+            // Null follows the interface language.
+            "date_language": self.session.date_language(),
+            "author": self.comment_prefs.author,
+            // Per-tool comment defaults (colours, opacity, widths), so Make Current
+            // Properties Default survives a restart (#340).
+            "comment_styles": self
+                .comment_prefs
+                .styles()
+                .map(|(t, s)| serde_json::json!({
+                    "tool": t.command(),
+                    "color": s.color,
+                    "opacity": s.opacity,
+                    "width": s.width,
+                    "fill": s.fill,
+                }))
+                .collect::<Vec<_>>(),
+            // Drawn signatures keep their original form (older settings read the same).
+            "signature": match &self.signature { Some(fill_sign::SavedSig::Drawn(s)) => Some(s), _ => None },
+            "signature_text": match &self.signature { Some(fill_sign::SavedSig::Typed(t)) => Some(t), _ => None },
+            "signature_image": match &self.signature { Some(s @ fill_sign::SavedSig::Image(_)) => Some(s), _ => None },
+            "initials": self.initials,
+            "sign_graphic": self.sign_graphic,
+            // macOS Keychain and Windows store identities are read from their OS key stores each time.
+            "digital_ids": self.digital_ids.iter().filter(|e| !e.path.starts_with("keychain:") && !e.path.starts_with("windows:")).collect::<Vec<_>>(),
+            "trusted": trusted,
+            "custom_stamps": stamps_ui::encode(&self.custom_stamps),
+            "javascript": self.session.javascript(),
+            "actions": actions_ui::encode(&self.custom_actions),
+            "combine_columns": self.combine_columns.to_json(),
+            "combine_view": self.combine_view.as_str(),
+            "combine_zoom": self.combine_zoom,
+            "comments_panel_closed": self.comments_panel_closed,
+            "right_panel_closed": self.right_panel_closed,
+        });
+        // Set apart: one more key inside the macro above passes serde_json's recursion limit.
+        v["default_page_gaps"] = serde_json::Value::Bool(self.view_defaults.show_page_gaps);
+        v["redact_prefs"] = self.redact_defaults.to_json();
+        // Set outside json! above, which is at serde_json's macro recursion limit.
+        v["hide_empty_highlight_hover"] = serde_json::Value::Bool(self.comment_prefs.hide_empty_highlight_hover);
+        v["comment_tool_pinned"] = serde_json::Value::Bool(self.comment_prefs.pinned);
+        v["show_secured_notice"] = serde_json::Value::Bool(self.show_secured_notice);
+        v["organize_zoom"] = serde_json::json!(self.organize_zoom);
+        // Canonical names survive changes to the order of PAPERS and do not depend on UI language.
+        v["print_paper"] = serde_json::json!(pdfcraft_engine::print::PAPERS.get(self.print_draft.paper).map(|(name, _)| *name));
+        v.to_string()
+    }
+
+    /// Restore state written by `persist`. Unknown or malformed data is ignored.
+    pub fn restore(&mut self, json: &str) {
+        let Ok(v) = serde_json::from_str::<serde_json::Value>(json) else { return };
+        let panels = side_panels::restore(&v);
+        self.side_panels = panels.panels;
+        if let Some(open) = panels.tools_open {
+            self.left_open = open;
+        }
+        if let Some(right) = v.get("docking_right") {
+            self.right = serde_json::from_value(right.clone()).ok().flatten().filter(|_| !panels.side_closed);
+        }
+        self.combine_columns = combine_ui::Columns::from_json(&v["combine_columns"]);
+        if let Some(view) = v["combine_view"].as_str().and_then(combine_ui::CombineView::parse) {
+            self.combine_view = view;
+        }
+        if let Some(zoom) = v["combine_zoom"].as_f64() {
+            self.set_combine_zoom(zoom as f32);
+        }
+        // Clamped like any grid zoom when the grid next shows; nonsense keeps the usual size.
+        if let Some(zoom) = v["organize_zoom"].as_f64().map(|z| z as f32).filter(|z| z.is_finite()) {
+            self.organize_zoom = zoom.clamp(*canvas::GRID_ZOOM_RANGE.start(), *canvas::GRID_ZOOM_RANGE.end());
+        }
+        if let Ok(r) = serde_json::from_value::<Vec<RecentFile>>(v["recent"].clone()) {
+            // Only keep entries whose files still exist.
+            #[cfg(not(target_arch = "wasm32"))]
+            let r: Vec<RecentFile> = r.into_iter().filter(|f| std::path::Path::new(&f.path).exists()).collect();
+            self.recent = r;
+        }
+        if let Some(on) = v["reopen_last_session"].as_bool() {
+            self.reopen_last_session = on;
+        }
+        if let Some(on) = v["restore_last_view"].as_bool() {
+            self.restore_last_view = on;
+        }
+        self.restore_last_views(&v["last_views"]);
+        self.last_session = last_session::LastSession::from_json(&v["last_session"]);
+        if let Some(on) = v["system_title_bar"].as_bool() {
+            self.system_title_bar = on;
+        }
+        if let Some(on) = v["reload_changed_files"].as_bool() {
+            self.reload_changed_files = on;
+        }
+        if let Some(on) = v["show_secured_notice"].as_bool() {
+            self.show_secured_notice = on;
+        }
+        self.pinned.restore(&v["pinned_folders"]);
+        if let Ok(preference) = serde_json::from_value::<ThemePreference>(v["theme"].clone()) {
+            self.set_theme_preference(preference);
+        }
+        if let Ok(speed) = serde_json::from_value::<scroll_speed::ScrollSpeed>(v["scroll_speed"].clone()) {
+            self.scroll_speed = speed;
+        }
+        if let Ok(effects) = serde_json::from_value::<motion::AnimationEffects>(v["animation_effects"].clone()) {
+            self.animation_effects = effects;
+        }
+        if let Ok(mode) = serde_json::from_value::<Mode>(v["default_mode"].clone()) {
+            self.default_mode = mode;
+        }
+        if let Some((layout, continuous)) = v["default_layout"].as_str().and_then(canvas::parse_display_token) {
+            (self.view_defaults.layout, self.view_defaults.continuous) = (layout, continuous);
+        }
+        if let Some(show) = v["default_page_gaps"].as_bool() {
+            self.view_defaults.show_page_gaps = show;
+        }
+        if let Ok(units) = serde_json::from_value::<units::Unit>(v["units"].clone()) {
+            self.units = units;
+        }
+        if let Some(on) = v["always_default_view"].as_bool() {
+            self.always_default_view = on;
+        }
+        if let Some(paper) = v
+            .get("print_paper")
+            .and_then(serde_json::Value::as_str)
+            .and_then(|name| pdfcraft_engine::print::PAPERS.iter().position(|(canonical, _)| *canonical == name))
+        {
+            self.print_draft.paper = paper;
+        }
+        if let Some(on) = v["highlight_fields"].as_bool() {
+            self.view_defaults.highlight_fields = on;
+        }
+        if let Some(closed) = v["comments_panel_closed"].as_bool() {
+            self.comments_panel_closed = closed;
+        }
+        if let Some(closed) = v["right_panel_closed"].as_bool() {
+            self.right_panel_closed = closed;
+        }
+        if let Some(defaults) = v["default_zoom"].as_str().and_then(|zoom| self.view_defaults.with_zoom(zoom)) {
+            self.view_defaults = defaults;
+        }
+        if let Some(language) = v["language"].as_str().and_then(i18n::normalize_pref) {
+            self.language = language.to_string();
+        }
+        if let Some(on) = v["flatten_fill_sign"].as_bool() {
+            self.flatten_fill_sign_on_save = on;
+        }
+        if let Some(size) = v["fill_text_size"].as_f64().and_then(fill_sign::valid_text_size) {
+            self.fill_text_size = size;
+        }
+        if let Some(prefs) = RedactPrefs::from_json(&v["redact_prefs"]) {
+            self.redact_prefs = prefs.clone();
+            self.redact_defaults = prefs;
+        }
+        // Settings are untrusted: an unreadable value (a colour that isn't three bytes, say)
+        // fails to deserialize and keeps Off.
+        if let Ok(colors) = serde_json::from_value::<pdfcraft_render::ReadingColors>(v["reading_colors"].clone()) {
+            self.reading_colors = colors;
+        }
+        // Settings are untrusted: a size out of range follows the system instead.
+        self.ui_scale = v["ui_scale"].as_f64().and_then(ui_scale::valid);
+        // Settings are untrusted: an unusable pattern keeps the default.
+        if let Some(f) = v["date_format"].as_str() {
+            let _ = self.session.set_date_format(f);
+        }
+        if let Some(l) = v["date_language"].as_str() {
+            let _ = self.session.set_date_language(Some(l));
+        }
+        // An empty or missing name keeps the login-name default; settings are untrusted, so the
+        // name is cut to a sane length.
+        if let Some(author) = v["author"].as_str().map(str::trim).filter(|a| !a.is_empty()) {
+            self.comment_prefs.author = author.chars().take(MAX_AUTHOR_CHARS).collect();
+        }
+        if let Some(hide) = v["hide_empty_highlight_hover"].as_bool() {
+            self.comment_prefs.hide_empty_highlight_hover = hide;
+        }
+        if let Some(pinned) = v["comment_tool_pinned"].as_bool() {
+            self.comment_prefs.pinned = pinned;
+        }
+        // Per-tool comment styles (#340): each field goes through its clamping setter, so a
+        // malformed or hostile entry is clamped or ignored rather than trusted.
+        if let Some(styles) = v["comment_styles"].as_array() {
+            for e in styles {
+                let Some(tool) = e["tool"].as_str().and_then(crate::comments::CommentTool::from_command) else { continue };
+                if let Some(c) = rgb_triple(&e["color"]) {
+                    self.comment_prefs.set_color(tool, c);
+                }
+                if let Some(o) = e["opacity"].as_f64() {
+                    self.comment_prefs.set_opacity(tool, o);
+                }
+                if let Some(w) = e["width"].as_f64() {
+                    self.comment_prefs.set_width(tool, w);
+                }
+                // `"fill": null` is a saved "no fill", which clears a tool's default fill; a
+                // missing or malformed fill keeps it.
+                let fill = match e.get("fill") {
+                    Some(serde_json::Value::Null) => Some(None),
+                    Some(v) => rgb_triple(v).map(Some),
+                    None => None,
+                };
+                if let Some(fill) = fill {
+                    let mut s = self.comment_prefs.style(tool);
+                    s.fill = fill;
+                    self.comment_prefs.set_style(tool, s);
+                }
+            }
+        }
+        if let Ok(s) = serde_json::from_value::<Vec<Vec<[f32; 2]>>>(v["signature"].clone())
+            && s.iter().all(|st| st.iter().all(|p| p.iter().all(|x| x.is_finite())))
+        {
+            self.signature = Some(fill_sign::SavedSig::Drawn(s));
+        }
+        if let Some(t) = v["signature_text"].as_str().filter(|t| !t.trim().is_empty()) {
+            self.signature = Some(fill_sign::SavedSig::Typed(t.to_string()));
+        }
+        if let Ok(s @ fill_sign::SavedSig::Image(_)) = serde_json::from_value::<fill_sign::SavedSig>(v["signature_image"].clone()) {
+            self.signature = Some(s);
+        }
+        if let Ok(i) = serde_json::from_value::<fill_sign::SavedSig>(v["initials"].clone()) {
+            self.initials = Some(i);
+        }
+        // An unreadable choice (a damaged image) falls back to the name.
+        self.sign_graphic = serde_json::from_value(v["sign_graphic"].clone()).unwrap_or_default();
+        if let Ok(ids) = serde_json::from_value::<Vec<DigitalIdEntry>>(v["digital_ids"].clone()) {
+            self.digital_ids = ids;
+        }
+        self.custom_stamps = stamps_ui::decode(&v["custom_stamps"]);
+        self.custom_actions = actions_ui::decode(&v["actions"]);
+        if let Some(on) = v["javascript"].as_bool() {
+            self.session.set_javascript(on);
+        }
+        if let Ok(pems) = serde_json::from_value::<Vec<String>>(v["trusted"].clone()) {
+            let certs = pems.iter().filter_map(|p| pdfcraft_engine::sign::x509::load_certificates(p.as_bytes()).ok()).flatten().collect();
+            self.apply_trusted_certificates(certs);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/app/window.rs b/crates/ui-egui/src/app/window.rs
new file mode 100644
index 0000000000..c950b54a55
--- /dev/null
+++ b/crates/ui-egui/src/app/window.rs
@@ -0,0 +1,62 @@
+use super::*;
+
+impl PdfCraftApp {
+    /// Whether the app draws the window's title bar, buttons and resize edges: the desktop leaves
+    /// the frame to the app and Use system title bar is off.
+    pub fn draws_window_frame(&self) -> bool {
+        self.window_controls.is_some() && !self.system_title_bar
+    }
+
+    /// Follow Use system title bar at once: the window starts without winit's frame wherever the
+    /// app may draw its own, and gets it back (or loses it again) when the preference changes.
+    pub(super) fn sync_window_frame(&mut self, ctx: &egui::Context) {
+        if self.window_controls.is_none() {
+            return;
+        }
+        let app_frame = self.draws_window_frame();
+        if self.app_frame_shown != Some(app_frame) {
+            // The window opens undecorated, so only a change from that needs a command.
+            if self.app_frame_shown.is_some() || !app_frame {
+                ctx.send_viewport_cmd(egui::ViewportCommand::Decorations(!app_frame));
+            }
+            self.app_frame_shown = Some(app_frame);
+        }
+    }
+
+    /// Enter or leave full-screen reading (Acrobat: View ▸ Full Screen Mode, ⌘L).
+    pub fn set_full_screen(&mut self, ctx: &egui::Context, on: bool) {
+        self.apply_full_screen(on);
+        ctx.send_viewport_cmd(egui::ViewportCommand::Fullscreen(on));
+    }
+
+    /// The full-screen state without the window: every document shows one page (or spread) at a
+    /// time fitted to the screen while it is on (Acrobat's Full Screen Mode, #379, #1459), and
+    /// gets its display back when it is off.
+    pub fn apply_full_screen(&mut self, on: bool) {
+        // A click turns the page only with the Select tool, and full screen hides the tools:
+        // select it there, and give the tool back on leaving (review on #2070).
+        if on && !self.full_screen {
+            self.full_screen_tool = Some(self.quick_tool);
+            self.quick_tool = QuickTool::Select;
+        } else if !on && let Some(tool) = self.full_screen_tool.take() {
+            self.quick_tool = tool;
+        }
+        self.full_screen = on;
+        for view in &mut self.views {
+            if on {
+                view.enter_presentation();
+            } else {
+                view.leave_presentation();
+            }
+        }
+    }
+
+    /// Answer the Full Screen mode prompt a document raised on opening: enter it, or leave the
+    /// window as it is.
+    pub fn resolve_full_screen_prompt(&mut self, ctx: &egui::Context, allow: bool) {
+        let Some(id) = self.pending_full_screen.take() else { return };
+        if allow && self.session.get(id).is_some() {
+            self.set_full_screen(ctx, true);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/bidi.rs b/crates/ui-egui/src/bidi.rs
index 50cae547e3..e08c6b9df1 100644
--- a/crates/ui-egui/src/bidi.rs
+++ b/crates/ui-egui/src/bidi.rs
@@ -1,18 +1,18 @@
-//! Visual order for single-line interface text that may hold right-to-left script (file names,
-//! document titles).
+//! Wrapping right-to-left text into logical lines, and test-only display-order helpers.
 //!
-//! egui shapes each font-face run with the script's own direction, so the letters of an Arabic
-//! word join and run right to left, but it places the runs themselves left to right in logical
-//! order: `واحد اثنين.pdf` would show its two words swapped. [`visual`] puts the runs in display
-//! order and leaves the letters of each word alone for the shaper.
-//!
-//! [`display_rtl`] does the same for the labels of a right-to-left interface language (the Arabic
-//! catalog), whose base direction is right to left.
+//! egui 0.37's epaint shapes text with the Unicode bidirectional algorithm (UAX #9), so
+//! production code passes it logical (typing-order) text: [`wrap`] breaks a comment into logical
+//! lines and lets epaint reorder each one. [`visual`], [`visual_auto`] and [`display_rtl`] are
+//! kept for the tests that prove the old preordering is gone; they must not be used for painting
+//! with egui 0.37, where they would reverse mixed-direction text a second time.
 
+#[cfg(test)]
 use std::borrow::Cow;
 use std::ops::Range;
 
-use unicode_bidi::{BidiInfo, Level, ParagraphInfo};
+use unicode_bidi::BidiInfo;
+#[cfg(test)]
+use unicode_bidi::{Level, ParagraphInfo};
 
 /// `text` rearranged for an egui call that lays out one line. Text without right-to-left
 /// characters comes back borrowed and unchanged.
@@ -20,6 +20,7 @@ use unicode_bidi::{BidiInfo, Level, ParagraphInfo};
 /// The base direction is left to right, as the interface is: a file name keeps its extension
 /// at the end, the way the window title shows it. Use it for painting only; accessibility
 /// labels and anything stored keep the logical text.
+#[cfg(test)]
 pub fn visual(text: &str) -> Cow<'_, str> {
     if !text.chars().any(is_rtl_script) {
         return Cow::Borrowed(text);
@@ -30,6 +31,7 @@ pub fn visual(text: &str) -> Cow<'_, str> {
 }
 
 /// `text` in display order for the paragraph direction `base`, appended to `out`.
+#[cfg(test)]
 fn push_visual(out: &mut String, text: &str, base: Level) {
     let info = BidiInfo::new(text, Some(base));
     for para in &info.paragraphs {
@@ -39,6 +41,7 @@ fn push_visual(out: &mut String, text: &str, base: Level) {
 
 /// The `line` of paragraph `para` (a non-empty byte range of `text`) in display order, as egui
 /// needs it, appended to `out`.
+#[cfg(test)]
 fn push_line(out: &mut String, text: &str, info: &BidiInfo<'_>, para: &ParagraphInfo, line: Range<usize>) {
     let (levels, runs) = info.visual_runs(para, line);
     // First the true display order, every character left to right as it appears on screen.
@@ -62,6 +65,7 @@ fn push_line(out: &mut String, text: &str, info: &BidiInfo<'_>, para: &Paragraph
 /// each such stretch goes back to logical order. What lies between them (spaces, punctuation,
 /// Latin) is drawn by the Latin face left to right and stays as it is. The stretches include
 /// Persian and Arabic-Indic digits: Arabic script to the shaper, though they read left to right.
+#[cfg(test)]
 fn push_for_shaper(out: &mut String, shown: &str) {
     let mut stretch: Vec<char> = Vec::new();
     for c in shown.chars() {
@@ -78,7 +82,7 @@ fn push_for_shaper(out: &mut String, shown: &str) {
 /// One line of wrapped text (see [`wrap`]).
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct Line {
-    /// The line in display order, for one egui call that lays out one line.
+    /// The line in logical (reading) order. epaint shapes and reorders it for display.
     pub text: String,
     /// The paragraph reads right to left: the line belongs against the right edge.
     pub rtl: bool,
@@ -89,14 +93,44 @@ pub fn has_rtl(text: &str) -> bool {
     text.chars().any(is_rtl_script)
 }
 
+/// The paragraph direction for translated interface text: explicitly right to left for Arabic,
+/// Kurdish and Persian, and `TextDirection::Auto` otherwise. A label whose first strong character is
+/// Latin or a `{placeholder}` must not fall back to a left-to-right paragraph in an RTL locale.
+pub fn ui_direction() -> egui::epaint::text::TextDirection {
+    if crate::i18n::current().rtl() { egui::epaint::text::TextDirection::RightToLeft } else { egui::epaint::text::TextDirection::Auto }
+}
+
+/// Lay out one line of translated interface text with the locale's explicit base direction.
+pub fn layout_ui(ui: &egui::Ui, text: impl Into<String>, font: egui::FontId, color: egui::Color32) -> std::sync::Arc<egui::Galley> {
+    layout_one_line(ui, text, font, color, ui_direction())
+}
+
+/// Lay out one line of file or path text left to right, so an Arabic file name keeps `.pdf` at
+/// its visual end exactly as a Latin one does. The text stays logical for accessibility.
+pub fn layout_ltr(ui: &egui::Ui, text: impl Into<String>, font: egui::FontId, color: egui::Color32) -> std::sync::Arc<egui::Galley> {
+    layout_one_line(ui, text, font, color, egui::epaint::text::TextDirection::LeftToRight)
+}
+
+fn layout_one_line(
+    ui: &egui::Ui,
+    text: impl Into<String>,
+    font: egui::FontId,
+    color: egui::Color32,
+    direction: egui::epaint::text::TextDirection,
+) -> std::sync::Arc<egui::Galley> {
+    let mut job = egui::text::LayoutJob::simple_singleline(text.into(), font, color);
+    job.direction = direction;
+    ui.painter().layout_job(job)
+}
+
 /// Multi-line text with right-to-left script (a comment in Persian, Arabic, Hebrew), broken
-/// into lines that `fits` accepts (it measures a line in logical order) and each put in display
-/// order by the Unicode bidirectional algorithm (UAX #9).
+/// into logical-order lines that `fits` accepts (it measures a line in logical order).
 ///
-/// Every paragraph takes its direction from its first strong character, as `dir="auto"` does,
-/// so a Persian comment reads right to left with its Latin words and numbers left to right
-/// inside it. Lines break between words, in reading order, and a word wider than a line
-/// between characters. Use it for painting; copying and accessibility keep the logical text.
+/// The lines keep reading order and each line's paragraph direction ([`Line::rtl`]): egui 0.37's
+/// epaint already shapes every line with the Unicode bidirectional algorithm (UAX #9), so
+/// preordering here would reorder mixed Persian/Latin text a second time. Lines break between
+/// words, in reading order, and a word wider than a line between characters. Copying and
+/// accessibility use the same logical text.
 pub fn wrap(text: &str, mut fits: impl FnMut(&str) -> bool) -> Vec<Line> {
     let info = BidiInfo::new(text, None);
     let mut lines = Vec::new();
@@ -109,12 +143,7 @@ pub fn wrap(text: &str, mut fits: impl FnMut(&str) -> bool) -> Vec<Line> {
         let content = para.range.start..para.range.start.saturating_add(whole.trim_end_matches(is_paragraph_separator).len());
         let rtl = para.level.is_rtl();
         for line in break_lines(text, content, &mut fits) {
-            let mut out = String::new();
-            // unicode-bidi indexes the first level of a line, so an empty one would panic.
-            if !line.is_empty() {
-                push_line(&mut out, text, &info, para, line);
-            }
-            lines.push(Line { text: out, rtl });
+            lines.push(Line { text: text.get(line).unwrap_or_default().to_owned(), rtl });
         }
     }
     lines
@@ -122,12 +151,18 @@ pub fn wrap(text: &str, mut fits: impl FnMut(&str) -> bool) -> Vec<Line> {
 
 /// One line of `text` in display order, its direction from its first strong character (an
 /// author's name). Text without right-to-left characters comes back borrowed and unchanged.
+///
+/// Only the bidi unit tests use this now: interface labels keep logical text and let the egui
+/// fork reorder, so no production call site preorders a label.
+#[cfg(test)]
 pub fn visual_auto(text: &str) -> Cow<'_, str> {
     if !has_rtl(text) {
         return Cow::Borrowed(text);
     }
-    let lines: Vec<String> = wrap(text, |_| true).into_iter().map(|l| l.text).collect();
-    Cow::Owned(lines.join("\n"))
+    let base = BidiInfo::new(text, None).paragraphs.first().map_or(Level::ltr(), |para| para.level);
+    let mut out = String::with_capacity(text.len());
+    push_visual(&mut out, text, base);
+    Cow::Owned(out)
 }
 
 /// The byte ranges of the lines `range` of `text` breaks into: as many words as `fits` accepts
@@ -209,7 +244,9 @@ fn is_paragraph_separator(c: char) -> bool {
 /// - A short caption's closing colon stays on the right too, next to the widget it captions.
 ///
 /// Text without right-to-left characters comes back unchanged. Like [`visual`], this is for
-/// painting one line; a label egui wraps breaks at the wrong end.
+/// painting one line; a label egui wraps breaks at the wrong end. Kept for the tests that prove
+/// the old preordering is gone; production catalogs stay logical.
+#[cfg(test)]
 pub fn display_rtl(text: &str) -> String {
     if !text.chars().any(is_rtl_script) {
         return text.to_owned();
@@ -225,13 +262,17 @@ pub fn display_rtl(text: &str) -> String {
 }
 
 /// The most words a caption may have for its closing colon to stay on the right.
+#[cfg(test)]
 const CAPTION_WORDS: usize = 3;
 /// First of the private-use characters that stand for placeholders while a line is reordered.
 /// They are strong left-to-right, like the names they replace.
+#[cfg(test)]
 const PLACEHOLDER_BASE: u32 = 0xE000;
 /// Placeholders protected per line; a line with more keeps the rest as plain text.
+#[cfg(test)]
 const MAX_PLACEHOLDERS: usize = 64;
 
+#[cfg(test)]
 fn push_rtl_line(out: &mut String, line: &str) {
     let edge = |c: char| c.is_whitespace() || c == '·';
     let core = line.trim_start_matches(edge);
@@ -266,6 +307,7 @@ fn push_rtl_line(out: &mut String, line: &str) {
 /// `text` with each `{name}` placeholder and each keyboard shortcut (`⇧⌘+`) replaced by one
 /// stand-in character, and what they replaced, in order. A shortcut's symbols have no direction
 /// of their own, so left alone they would be drawn in reverse.
+#[cfg(test)]
 fn mask_placeholders(text: &str) -> (String, Vec<&str>) {
     let mut masked = String::with_capacity(text.len());
     let mut names: Vec<&str> = Vec::new();
@@ -286,6 +328,7 @@ fn mask_placeholders(text: &str) -> (String, Vec<&str>) {
 }
 
 /// The byte range of the first placeholder or keyboard shortcut in `text`.
+#[cfg(test)]
 fn next_atom(text: &str) -> Option<(usize, usize)> {
     let placeholder = text.find('{').and_then(|open| {
         let len = text.get(open..)?.find('}')?;
@@ -308,6 +351,7 @@ fn next_atom(text: &str) -> Option<(usize, usize)> {
 }
 
 /// The modifier-key symbols of keyboard shortcuts: ⌘ ⇧ ⌥ ⌃.
+#[cfg(test)]
 fn is_modifier_key(c: char) -> bool {
     matches!(c, '\u{2318}' | '\u{21E7}' | '\u{2325}' | '\u{2303}')
 }
@@ -320,15 +364,18 @@ fn is_rtl_script(c: char) -> bool {
 
 /// The zero-width (non-)joiners inside a word (Persian `می‌روم`): egui shapes them with the
 /// letter before them.
+#[cfg(test)]
 fn is_joiner(c: char) -> bool {
     matches!(c, '\u{200C}' | '\u{200D}')
 }
 
 /// Direction marks, embeddings, overrides and isolates: they steer the reordering and are not drawn.
+#[cfg(test)]
 fn is_bidi_control(c: char) -> bool {
     matches!(c, '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}')
 }
 
+#[cfg(test)]
 fn mirrored(c: char) -> char {
     match c {
         '(' => ')',
@@ -346,258 +393,4 @@ fn mirrored(c: char) -> char {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn text_without_rtl_is_borrowed_unchanged() {
-        for s in ["", "report.pdf", "日本語の文字.pdf", "a (b) [c]", "caf\u{00E9} \u{200E}x"] {
-            assert!(matches!(visual(s), Cow::Borrowed(v) if v == s), "{s:?}");
-        }
-    }
-
-    #[test]
-    fn arabic_words_swap_and_the_extension_stays_last() {
-        // The reported name: "one two.pdf" in Arabic.
-        assert_eq!(visual("واحد اثنين.pdf"), "اثنين واحد.pdf");
-        assert_eq!(visual("ملف.pdf"), "ملف.pdf");
-        assert_eq!(visual("تقرير نهائي جدا.pdf"), "جدا نهائي تقرير.pdf");
-    }
-
-    #[test]
-    fn latin_and_numbers_keep_their_own_order() {
-        assert_eq!(visual("report واحد اثنين final.pdf"), "report اثنين واحد final.pdf");
-        // A number inside right-to-left text reads left to right, to the left of what precedes it.
-        assert_eq!(visual("ملف 2024.pdf"), "2024 ملف.pdf");
-        assert_eq!(visual(r"C:\Users\me\واحد اثنين\a.pdf"), r"C:\Users\me\اثنين واحد\a.pdf");
-    }
-
-    #[test]
-    fn hebrew_and_brackets() {
-        assert_eq!(visual("שלום עולם.pdf"), "עולם שלום.pdf");
-        // Brackets between right-to-left words flip with the direction.
-        assert_eq!(visual("واحد (اثنين) ثلاثة.pdf"), "ثلاثة (اثنين) واحد.pdf");
-    }
-
-    #[test]
-    fn direction_controls_are_not_drawn() {
-        assert_eq!(visual("\u{202B}واحد اثنين\u{202C}.pdf"), "اثنين واحد.pdf");
-        assert_eq!(visual("\u{200F}واحد\u{061C}"), "واحد");
-    }
-
-    #[test]
-    fn rtl_labels_read_right_to_left() {
-        // No right-to-left characters: unchanged.
-        for s in ["", "Save as…", "{n} pages", "日本語"] {
-            assert_eq!(display_rtl(s), s);
-        }
-        assert_eq!(display_rtl("حفظ"), "حفظ");
-        // "Save as…": the second word and the ellipsis end up on the left.
-        assert_eq!(display_rtl("حفظ باسم…"), "…باسم حفظ");
-        // Latin words and numbers keep their own order inside the line.
-        assert_eq!(display_rtl("إنشاء PDF من ملف"), "ملف من PDF إنشاء");
-        assert_eq!(display_rtl("تصدير إلى Microsoft Word الآن"), "الآن Microsoft Word إلى تصدير");
-        assert_eq!(display_rtl("صالح لمدة 5 سنوات"), "سنوات 5 لمدة صالح");
-        // Keyboard shortcuts are not reversed.
-        assert_eq!(display_rtl("طباعة (⌘P)"), "(⌘P) طباعة");
-        assert_eq!(display_rtl("تدوير العرض (⇧⌘+)"), "(⇧⌘+) العرض تدوير");
-        assert_eq!(display_rtl("التمرير مع ⌘ أيضًا"), "أيضًا ⌘ مع التمرير");
-        assert_eq!(display_rtl("نص (عادي)"), "(عادي) نص");
-    }
-
-    #[test]
-    fn rtl_labels_keep_placeholders_whole() {
-        // Two placeholders around a colon stay together, left to right: a file name and its error.
-        assert_eq!(display_rtl("تعذّر فتح {name}: {e}"), "{name}: {e} فتح تعذّر");
-        assert_eq!(display_rtl("فشل {label}، السبب {e}"), "{e} السبب ،{label} فشل");
-        assert_eq!(display_rtl("{n} صفحات"), "صفحات {n}");
-        assert_eq!(display_rtl("الصفحة {p} من {n}"), "{n} من {p} الصفحة");
-        // Adjacent placeholders keep their order, as numbers around a slash would.
-        assert_eq!(display_rtl("جارٍ البحث… {s}/{p}"), "{s}/{p} …البحث جارٍ");
-        // Braces that are not a placeholder are ordinary punctuation.
-        assert_eq!(display_rtl("حرف } واحد"), "واحد { حرف");
-        let many = format!("ا {}", "{a} ".repeat(200));
-        assert_eq!(display_rtl(&many).matches("{a}").count(), 200);
-    }
-
-    #[test]
-    fn rtl_labels_keep_their_edges() {
-        // Edge spaces and separator dots stay where the code concatenates.
-        assert_eq!(display_rtl(" (صفحة {p})"), " ({p} صفحة)");
-        assert_eq!(display_rtl(" · محمي بكلمة مرور"), " · مرور بكلمة محمي");
-        assert_eq!(display_rtl("سلسلة المفاتيح  ·  "), "المفاتيح سلسلة  ·  ");
-        // A caption's colon stays next to its widget; a sentence's colon ends the sentence.
-        assert_eq!(display_rtl("الاسم:"), "الاسم:");
-        assert_eq!(display_rtl("صادرة عن: "), "عن صادرة: ");
-        assert_eq!(display_rtl("اختر المعرّف الرقمي الذي تريد استخدامه:"), ":استخدامه تريد الذي الرقمي المعرّف اختر");
-        // Each line is its own paragraph.
-        assert_eq!(display_rtl("تعذّر عرض الصفحة.\n{e}"), ".الصفحة عرض تعذّر\n{e}");
-    }
-
-    #[test]
-    fn rtl_labels_never_panic_on_odd_input() {
-        let long = "ا {n} ".repeat(20_000);
-        for s in [
-            "ا{",
-            "ا}",
-            "ا{}",
-            "ا{{{",
-            "}ا{",
-            "ا\u{E000}{n}",
-            "⌘",
-            "ا ⌘",
-            "⌘ا⌘{",
-            "ا (⇧⌘",
-            "\u{064B}:",
-            ":",
-            "ا:",
-            " : ا : ",
-            "ا\n\n\nب",
-            "\u{202E}ا{n}",
-            long.as_str(),
-        ] {
-            let v = display_rtl(s);
-            assert!(v.chars().count() <= s.chars().count(), "{:?}", s.chars().take(12).collect::<String>());
-        }
-    }
-
-    /// `wrap` with a width of `n` characters.
-    fn wrap_at(text: &str, n: usize) -> Vec<Line> {
-        wrap(text, |s| s.chars().count() <= n)
-    }
-
-    fn rtl(text: &str) -> Line {
-        Line { text: text.to_owned(), rtl: true }
-    }
-
-    fn ltr(text: &str) -> Line {
-        Line { text: text.to_owned(), rtl: false }
-    }
-
-    #[test]
-    fn persian_paragraph_reads_right_to_left() {
-        // "I go to school": the words come out in reverse for egui's left-to-right placement.
-        assert_eq!(wrap_at("من به مدرسه می‌روم", 80), [rtl("می‌روم مدرسه به من")]);
-        // The zero-width non-joiner keeps a word whole, so the shaper gets it as one run.
-        assert_eq!(wrap_at("کتاب‌ها", 80), [rtl("کتاب‌ها")]);
-    }
-
-    #[test]
-    fn arabic_lines_break_in_reading_order() {
-        // The first words go on the first line, each line reordered on its own.
-        assert_eq!(wrap_at("واحد اثنين ثلاثة أربعة", 11), [rtl("اثنين واحد"), rtl("أربعة ثلاثة")]);
-        assert_eq!(wrap_at("واحد اثنين ثلاثة أربعة", 80), [rtl("أربعة ثلاثة اثنين واحد")]);
-    }
-
-    #[test]
-    fn base_direction_comes_from_the_first_strong_character() {
-        // Latin first: a left-to-right paragraph with an Arabic phrase inside it.
-        assert_eq!(wrap_at("See واحد اثنين here", 80), [ltr("See اثنين واحد here")]);
-        // Persian first: right to left, the Latin words and the number left to right inside it.
-        assert_eq!(wrap_at("فایل PDF نسخه 2 است", 80), [rtl("است 2 نسخه PDF فایل")]);
-        assert_eq!(wrap_at("سلام Hello World", 80), [rtl("Hello World سلام")]);
-        // Leading neutrals and numbers don't decide it.
-        assert_eq!(wrap_at("12. واحد اثنين", 80), [rtl("اثنين واحد .12")]);
-        // Each paragraph finds its own direction.
-        assert_eq!(wrap_at("واحد اثنين\nOK then\n\nשלום עולם", 80), [rtl("اثنين واحد"), ltr("OK then"), ltr(""), rtl("עולם שלום")]);
-    }
-
-    #[test]
-    fn rtl_punctuation_and_brackets() {
-        // The sentence's full stop ends up on the left, brackets flip.
-        assert_eq!(wrap_at("سلام دنیا.", 80), [rtl(".دنیا سلام")]);
-        assert_eq!(wrap_at("واحد (اثنين) ثلاثة", 80), [rtl("ثلاثة (اثنين) واحد")]);
-        assert_eq!(wrap_at("آیا آماده است؟", 80), [rtl("است؟ آماده آیا")]);
-    }
-
-    #[test]
-    fn persian_digits_go_to_the_shaper_reversed() {
-        // Persian and Arabic-Indic digits are Arabic script, which egui's shaper lays out right to
-        // left; they read left to right, so they are handed over reversed.
-        assert_eq!(wrap_at("سال ۱۴۰۲ شمسی", 80), [rtl("شمسی ۲۰۴۱ سال")]);
-        assert_eq!(wrap_at("صفحه ١٢", 80), [rtl("٢١ صفحه")]);
-        // Glued to a word, number and word swap places within one shaped run.
-        assert_eq!(wrap_at("ب۱۲", 80), [rtl("ب۲۱")]);
-    }
-
-    #[test]
-    fn wrapping_handles_odd_widths_and_input() {
-        assert_eq!(wrap_at("", 10), Vec::<Line>::new());
-        // A word wider than the line is broken between characters.
-        assert_eq!(wrap_at("abcdefghij واحد", 4), [ltr("abcd"), ltr("efgh"), ltr("ij"), ltr("واحد")]);
-        // Extra spaces between words don't make empty lines; \r\n is one break.
-        assert_eq!(wrap_at("واحد    اثنين\r\nب", 5), [rtl("واحد"), rtl("اثنين"), rtl("ب")]);
-        // Nothing fits: one character per line, never an endless loop.
-        assert_eq!(wrap("واحد", |_| false).len(), 4);
-        let long = "ا ب ۱ (ج) ".repeat(5_000);
-        for s in ["\u{202E}ا\u{202C}b", "\u{064B}", "\n\n", "\u{2029}ا", long.as_str()] {
-            let lines = wrap_at(s, 7);
-            let shown: usize = lines.iter().map(|l| l.text.chars().count()).sum();
-            assert!(shown <= s.chars().count(), "{:?}", s.chars().take(12).collect::<String>());
-        }
-    }
-
-    /// The characters egui puts on screen for each line of `text`, left to right, zero-width
-    /// ones left out, with the interface fonts.
-    fn on_screen(text: &str) -> Vec<String> {
-        let ctx = egui::Context::default();
-        ctx.set_fonts(crate::theme::font_definitions());
-        let mut shown = Vec::new();
-        let output = ctx.run_ui(egui::RawInput::default(), |ui| {
-            for line in wrap(text, |_| true) {
-                let galley = ui.painter().layout_no_wrap(line.text, egui::FontId::proportional(13.0), egui::Color32::WHITE);
-                let glyphs = galley.rows.iter().flat_map(|row| row.glyphs.iter());
-                shown.push(glyphs.filter(|g| g.advance_width > 0.0).map(|g| g.chr).collect());
-            }
-        });
-        output.drop_without_applying_deltas();
-        shown
-    }
-
-    fn rev(s: &str) -> String {
-        s.chars().rev().collect()
-    }
-
-    #[test]
-    fn egui_draws_lines_in_reading_order() {
-        // Only with an Arabic-script face (the craft-fonts build input, as in CI); without one
-        // egui has no shaper run to check.
-        if pdfcraft_fonts::ui_arabic_fonts().is_empty() {
-            return;
-        }
-        assert_eq!(on_screen("من به مدرسه می\u{200C}روم"), [rev("من به مدرسه میروم")]);
-        assert_eq!(on_screen("فایل PDF نسخه 2 است"), [format!("{} 2 {} PDF {}", rev("است"), rev("نسخه"), rev("فایل"))]);
-        assert_eq!(on_screen("سال ۱۴۰۲ شمسی"), [format!("{} ۱۴۰۲ {}", rev("شمسی"), rev("سال"))]);
-        assert_eq!(on_screen("ب۱۲"), ["۱۲ب"]);
-        assert_eq!(on_screen("See واحد اثنين here"), [format!("See {} {} here", rev("اثنين"), rev("واحد"))]);
-        assert_eq!(on_screen("واحد (اثنين)."), [format!(".({}) {}", rev("اثنين"), rev("واحد"))]);
-    }
-
-    #[test]
-    fn single_line_with_its_own_direction() {
-        assert!(matches!(visual_auto("Ada Lovelace"), Cow::Borrowed("Ada Lovelace")));
-        assert_eq!(visual_auto("علی رضایی"), "رضایی علی");
-        assert_eq!(visual_auto("علی 2"), "2 علی");
-        assert_eq!(visual_auto("Team علی رضایی"), "Team رضایی علی");
-    }
-
-    #[test]
-    fn odd_input_never_panics() {
-        let long = "ا ب ".repeat(20_000);
-        let odd = [
-            "\u{064B}",
-            "\u{064B}\u{064C} \u{0301}",
-            "\u{202E}\u{202E}\u{202E}ا",
-            "\u{2067}ا\u{2066}b",
-            "ا\nب\r\nج\u{2029}د",
-            "\u{FEFF}ا\u{0000}ب",
-            "ا\u{10FFFF}\u{E000}ب",
-            "((((ا]]]]",
-            long.as_str(),
-        ];
-        for s in odd {
-            let v = visual(s);
-            assert!(v.chars().count() <= s.chars().count(), "{:?}", s.chars().take(12).collect::<String>());
-        }
-    }
-}
+mod tests;
diff --git a/crates/ui-egui/src/bidi/tests.rs b/crates/ui-egui/src/bidi/tests.rs
new file mode 100644
index 0000000000..e57feebe21
--- /dev/null
+++ b/crates/ui-egui/src/bidi/tests.rs
@@ -0,0 +1,340 @@
+use super::*;
+
+#[test]
+fn text_without_rtl_is_borrowed_unchanged() {
+    for s in ["", "report.pdf", "日本語の文字.pdf", "a (b) [c]", "caf\u{00E9} \u{200E}x"] {
+        assert!(matches!(visual(s), Cow::Borrowed(v) if v == s), "{s:?}");
+    }
+}
+
+#[test]
+fn arabic_words_swap_and_the_extension_stays_last() {
+    // The reported name: "one two.pdf" in Arabic.
+    assert_eq!(visual("واحد اثنين.pdf"), "اثنين واحد.pdf");
+    assert_eq!(visual("ملف.pdf"), "ملف.pdf");
+    assert_eq!(visual("تقرير نهائي جدا.pdf"), "جدا نهائي تقرير.pdf");
+}
+
+#[test]
+fn latin_and_numbers_keep_their_own_order() {
+    assert_eq!(visual("report واحد اثنين final.pdf"), "report اثنين واحد final.pdf");
+    // A number inside right-to-left text reads left to right, to the left of what precedes it.
+    assert_eq!(visual("ملف 2024.pdf"), "2024 ملف.pdf");
+    assert_eq!(visual(r"C:\Users\me\واحد اثنين\a.pdf"), r"C:\Users\me\اثنين واحد\a.pdf");
+}
+
+#[test]
+fn hebrew_and_brackets() {
+    assert_eq!(visual("שלום עולם.pdf"), "עולם שלום.pdf");
+    // Brackets between right-to-left words flip with the direction.
+    assert_eq!(visual("واحد (اثنين) ثلاثة.pdf"), "ثلاثة (اثنين) واحد.pdf");
+}
+
+#[test]
+fn direction_controls_are_not_drawn() {
+    assert_eq!(visual("\u{202B}واحد اثنين\u{202C}.pdf"), "اثنين واحد.pdf");
+    assert_eq!(visual("\u{200F}واحد\u{061C}"), "واحد");
+}
+
+#[test]
+fn rtl_labels_read_right_to_left() {
+    // No right-to-left characters: unchanged.
+    for s in ["", "Save as…", "{n} pages", "日本語"] {
+        assert_eq!(display_rtl(s), s);
+    }
+    assert_eq!(display_rtl("حفظ"), "حفظ");
+    // "Save as…": the second word and the ellipsis end up on the left.
+    assert_eq!(display_rtl("حفظ باسم…"), "…باسم حفظ");
+    // Latin words and numbers keep their own order inside the line.
+    assert_eq!(display_rtl("إنشاء PDF من ملف"), "ملف من PDF إنشاء");
+    assert_eq!(display_rtl("تصدير إلى Microsoft Word الآن"), "الآن Microsoft Word إلى تصدير");
+    assert_eq!(display_rtl("صالح لمدة 5 سنوات"), "سنوات 5 لمدة صالح");
+    // Keyboard shortcuts are not reversed.
+    assert_eq!(display_rtl("طباعة (⌘P)"), "(⌘P) طباعة");
+    assert_eq!(display_rtl("تدوير العرض (⇧⌘+)"), "(⇧⌘+) العرض تدوير");
+    assert_eq!(display_rtl("التمرير مع ⌘ أيضًا"), "أيضًا ⌘ مع التمرير");
+    assert_eq!(display_rtl("نص (عادي)"), "(عادي) نص");
+}
+
+#[test]
+fn rtl_labels_keep_placeholders_whole() {
+    // Two placeholders around a colon stay together, left to right: a file name and its error.
+    assert_eq!(display_rtl("تعذّر فتح {name}: {e}"), "{name}: {e} فتح تعذّر");
+    assert_eq!(display_rtl("فشل {label}، السبب {e}"), "{e} السبب ،{label} فشل");
+    assert_eq!(display_rtl("{n} صفحات"), "صفحات {n}");
+    assert_eq!(display_rtl("الصفحة {p} من {n}"), "{n} من {p} الصفحة");
+    // Adjacent placeholders keep their order, as numbers around a slash would.
+    assert_eq!(display_rtl("جارٍ البحث… {s}/{p}"), "{s}/{p} …البحث جارٍ");
+    // Braces that are not a placeholder are ordinary punctuation.
+    assert_eq!(display_rtl("حرف } واحد"), "واحد { حرف");
+    let many = format!("ا {}", "{a} ".repeat(200));
+    assert_eq!(display_rtl(&many).matches("{a}").count(), 200);
+}
+
+#[test]
+fn rtl_labels_keep_their_edges() {
+    // Edge spaces and separator dots stay where the code concatenates.
+    assert_eq!(display_rtl(" (صفحة {p})"), " ({p} صفحة)");
+    assert_eq!(display_rtl(" · محمي بكلمة مرور"), " · مرور بكلمة محمي");
+    assert_eq!(display_rtl("سلسلة المفاتيح  ·  "), "المفاتيح سلسلة  ·  ");
+    // A caption's colon stays next to its widget; a sentence's colon ends the sentence.
+    assert_eq!(display_rtl("الاسم:"), "الاسم:");
+    assert_eq!(display_rtl("صادرة عن: "), "عن صادرة: ");
+    assert_eq!(display_rtl("اختر المعرّف الرقمي الذي تريد استخدامه:"), ":استخدامه تريد الذي الرقمي المعرّف اختر");
+    // Each line is its own paragraph.
+    assert_eq!(display_rtl("تعذّر عرض الصفحة.\n{e}"), ".الصفحة عرض تعذّر\n{e}");
+}
+
+#[test]
+fn rtl_labels_never_panic_on_odd_input() {
+    let long = "ا {n} ".repeat(20_000);
+    for s in [
+        "ا{",
+        "ا}",
+        "ا{}",
+        "ا{{{",
+        "}ا{",
+        "ا\u{E000}{n}",
+        "⌘",
+        "ا ⌘",
+        "⌘ا⌘{",
+        "ا (⇧⌘",
+        "\u{064B}:",
+        ":",
+        "ا:",
+        " : ا : ",
+        "ا\n\n\nب",
+        "\u{202E}ا{n}",
+        long.as_str(),
+    ] {
+        let v = display_rtl(s);
+        assert!(v.chars().count() <= s.chars().count(), "{:?}", s.chars().take(12).collect::<String>());
+    }
+}
+
+/// `wrap` with a width of `n` characters.
+fn wrap_at(text: &str, n: usize) -> Vec<Line> {
+    wrap(text, |s| s.chars().count() <= n)
+}
+
+fn rtl(text: &str) -> Line {
+    Line { text: text.to_owned(), rtl: true }
+}
+
+fn ltr(text: &str) -> Line {
+    Line { text: text.to_owned(), rtl: false }
+}
+
+/// Check that a Persian paragraph, including words joined by a zero-width non-joiner, reaches epaint as
+/// one logical right-to-left run.
+#[test]
+fn persian_paragraph_keeps_logical_order_for_epaint() {
+    // The line stays in reading order; epaint shapes and reorders it (see `on_screen`).
+    assert_eq!(wrap_at("من به مدرسه می‌روم", 80), [rtl("من به مدرسه می‌روم")]);
+    // The zero-width non-joiner keeps a word whole, so the shaper gets it as one run.
+    assert_eq!(wrap_at("کتاب‌ها", 80), [rtl("کتاب‌ها")]);
+}
+
+/// Check that Arabic text wraps into lines in logical reading order rather than visual order.
+#[test]
+fn arabic_lines_break_in_reading_order() {
+    // The first words go on the first line, in logical order for epaint to reorder.
+    assert_eq!(wrap_at("واحد اثنين ثلاثة أربعة", 11), [rtl("واحد اثنين"), rtl("ثلاثة أربعة")]);
+    assert_eq!(wrap_at("واحد اثنين ثلاثة أربعة", 80), [rtl("واحد اثنين ثلاثة أربعة")]);
+}
+
+/// Check that each paragraph takes its base direction from its first strong character, not from leading
+/// numbers or neutral text.
+#[test]
+fn base_direction_comes_from_the_first_strong_character() {
+    // Latin first: a left-to-right paragraph with an Arabic phrase inside it.
+    assert_eq!(wrap_at("See واحد اثنين here", 80), [ltr("See واحد اثنين here")]);
+    // Persian first: right to left, with the Latin words and number in reading order.
+    assert_eq!(wrap_at("فایل PDF نسخه 2 است", 80), [rtl("فایل PDF نسخه 2 است")]);
+    assert_eq!(wrap_at("سلام Hello World", 80), [rtl("سلام Hello World")]);
+    // Leading neutrals and numbers don't decide it.
+    assert_eq!(wrap_at("12. واحد اثنين", 80), [rtl("12. واحد اثنين")]);
+    // Each paragraph finds its own direction.
+    assert_eq!(wrap_at("واحد اثنين\nOK then\n\nשלום עולם", 80), [rtl("واحد اثنين"), ltr("OK then"), ltr(""), rtl("שלום עולם")]);
+}
+
+/// Check that right-to-left punctuation and brackets stay in logical order for epaint to mirror when
+/// displaying.
+#[test]
+fn rtl_punctuation_and_brackets() {
+    // Logical text: epaint mirrors punctuation and brackets for display.
+    assert_eq!(wrap_at("سلام دنیا.", 80), [rtl("سلام دنیا.")]);
+    assert_eq!(wrap_at("واحد (اثنين) ثلاثة", 80), [rtl("واحد (اثنين) ثلاثة")]);
+    assert_eq!(wrap_at("آیا آماده است؟", 80), [rtl("آیا آماده است؟")]);
+}
+
+/// Check that Persian and Arabic-Indic digits stay in logical order inside a right-to-left paragraph.
+#[test]
+fn persian_digits_go_to_the_shaper_reversed() {
+    // Persian and Arabic-Indic digits stay in logical order; epaint's shaper preserves their
+    // left-to-right reading inside the right-to-left paragraph.
+    assert_eq!(wrap_at("سال ۱۴۰۲ شمسی", 80), [rtl("سال ۱۴۰۲ شمسی")]);
+    assert_eq!(wrap_at("صفحه ١٢", 80), [rtl("صفحه ١٢")]);
+    assert_eq!(wrap_at("ب۱۲", 80), [rtl("ب۱۲")]);
+}
+
+#[test]
+fn wrapping_handles_odd_widths_and_input() {
+    assert_eq!(wrap_at("", 10), Vec::<Line>::new());
+    // A word wider than the line is broken between characters.
+    assert_eq!(wrap_at("abcdefghij واحد", 4), [ltr("abcd"), ltr("efgh"), ltr("ij"), ltr("واحد")]);
+    // Extra spaces between words don't make empty lines; \r\n is one break.
+    assert_eq!(wrap_at("واحد    اثنين\r\nب", 5), [rtl("واحد"), rtl("اثنين"), rtl("ب")]);
+    // Nothing fits: one character per line, never an endless loop.
+    assert_eq!(wrap("واحد", |_| false).len(), 4);
+    let long = "ا ب ۱ (ج) ".repeat(5_000);
+    for s in ["\u{202E}ا\u{202C}b", "\u{064B}", "\n\n", "\u{2029}ا", long.as_str()] {
+        let lines = wrap_at(s, 7);
+        let shown: usize = lines.iter().map(|l| l.text.chars().count()).sum();
+        assert!(shown <= s.chars().count(), "{:?}", s.chars().take(12).collect::<String>());
+    }
+}
+
+/// The characters egui puts on screen for each line of `text`, left to right, zero-width
+/// ones left out, with the interface fonts.
+fn on_screen(text: &str) -> Vec<String> {
+    let ctx = egui::Context::default();
+    ctx.set_fonts(crate::theme::font_definitions());
+    let mut shown = Vec::new();
+    let output = ctx.run_ui(egui::RawInput::default(), |ui| {
+        for line in wrap(text, |_| true) {
+            let galley = ui.painter().layout_no_wrap(line.text, egui::FontId::proportional(13.0), egui::Color32::WHITE);
+            let atlas = ui.fonts_mut(|fonts| fonts.image());
+            let mut visual = String::new();
+            for row in &galley.rows {
+                // 0.37 keeps glyphs in logical order for selection. Read their actual
+                // positions to test visual order instead of assuming vector order.
+                let mut glyphs: Vec<_> = row.glyphs.iter().filter(|g| g.advance_width > 0.0).collect();
+                glyphs.sort_by(|a, b| a.pos.x.total_cmp(&b.pos.x));
+                visual.extend(glyphs.into_iter().map(|g| match g.chr {
+                    // `chr` remains logical even when the shaper mirrors the painted
+                    // bracket. Read the bitmap's middle-row ink to check what is visible.
+                    '(' | ')' => {
+                        let [x0, y0] = g.uv_rect.min.map(usize::from);
+                        let [x1, y1] = g.uv_rect.max.map(usize::from);
+                        let y = usize::midpoint(y0, y1);
+                        let ink: Vec<f32> = (x0..x1).map(|x| f32::from(atlas[(x, y)].a())).collect();
+                        let total: f32 = ink.iter().sum();
+                        assert!(total > 0.0 && !ink.is_empty(), "a bracket must have visible ink");
+                        let center = ink.iter().enumerate().map(|(i, alpha)| i as f32 * alpha).sum::<f32>() / total;
+                        if center < (ink.len() - 1) as f32 / 2.0 { '(' } else { ')' }
+                    }
+                    _ => g.chr,
+                }));
+            }
+            shown.push(visual);
+        }
+    });
+    output.drop_without_applying_deltas();
+    shown
+}
+
+fn rev(s: &str) -> String {
+    s.chars().rev().collect()
+}
+
+#[test]
+fn egui_draws_lines_in_reading_order() {
+    // Only with an Arabic-script face (the craft-fonts build input, as in CI); without one
+    // egui has no shaper run to check.
+    if pdfcraft_fonts::ui_arabic_fonts().is_empty() {
+        return;
+    }
+    assert_eq!(on_screen("من به مدرسه می\u{200C}روم"), [rev("من به مدرسه میروم")]);
+    assert_eq!(on_screen("فایل PDF نسخه 2 است"), [format!("{} 2 {} PDF {}", rev("است"), rev("نسخه"), rev("فایل"))]);
+    assert_eq!(on_screen("سال ۱۴۰۲ شمسی"), [format!("{} ۱۴۰۲ {}", rev("شمسی"), rev("سال"))]);
+    assert_eq!(on_screen("ب۱۲"), ["۱۲ب"]);
+    assert_eq!(on_screen("See واحد اثنين here"), [format!("See {} {} here", rev("اثنين"), rev("واحد"))]);
+    assert_eq!(on_screen("واحد (اثنين)."), [format!(".({}) {}", rev("اثنين"), rev("واحد"))]);
+}
+
+/// A file name keeps its extension at the visual end even when the first strong word is
+/// Arabic: with an explicit `LeftToRight` base, `.pdf` is right of every Arabic glyph.
+#[test]
+fn file_names_are_laid_out_left_to_right() {
+    if pdfcraft_fonts::ui_arabic_fonts().is_empty() {
+        return;
+    }
+    let ctx = egui::Context::default();
+    ctx.set_fonts(crate::theme::font_definitions());
+    let mut positions: Vec<(char, f32)> = Vec::new();
+    ctx.run_ui(egui::RawInput::default(), |ui| {
+        let galley = layout_ltr(ui, "واحد اثنين.pdf", egui::FontId::proportional(13.0), egui::Color32::WHITE);
+        positions = galley.rows.iter().flat_map(|row| row.glyphs.iter().map(|g| (g.chr, g.pos.x))).collect();
+    })
+    .drop_without_applying_deltas();
+    let rightmost_arabic = positions.iter().filter(|(c, _)| is_rtl_script(*c)).map(|(_, x)| *x).fold(f32::MIN, f32::max);
+    let leftmost_extension = positions.iter().filter(|(c, _)| matches!(*c, '.' | 'p' | 'd' | 'f')).map(|(_, x)| *x).fold(f32::MAX, f32::min);
+    assert!(rightmost_arabic < leftmost_extension, "the extension must stay to the right: {positions:?}");
+    let last = positions.iter().filter(|(c, _)| !c.is_whitespace()).max_by(|a, b| a.1.total_cmp(&b.1));
+    assert_eq!(last.map(|(c, _)| *c), Some('f'), "the painted line ends in the extension");
+}
+
+/// Arabic/Kurdish labels get an explicit right-to-left paragraph, even when their first
+/// strong character is Latin. With English the same text stays left to right.
+#[test]
+fn arabic_ui_labels_use_an_explicit_paragraph_direction() {
+    if pdfcraft_fonts::ui_arabic_fonts().is_empty() {
+        return;
+    }
+    let previous = crate::i18n::current();
+    let ctx = egui::Context::default();
+    ctx.set_fonts(crate::theme::font_definitions());
+    let read = |lang: &str| {
+        crate::i18n::set_current(crate::i18n::Lang::from_code(lang).expect("registered language"));
+        let mut got = None;
+        ctx.run_ui(egui::RawInput::default(), |ui| {
+            let galley = layout_ui(ui, "PDF واحد", egui::FontId::proportional(13.0), egui::Color32::WHITE);
+            let positions: Vec<_> = galley.rows.iter().flat_map(|row| row.glyphs.iter().map(|g| (g.chr, g.pos.x))).collect();
+            got = Some((galley.job.direction, positions));
+        })
+        .drop_without_applying_deltas();
+        got.expect("one layout")
+    };
+    let (direction, positions) = read("ar");
+    crate::i18n::set_current(previous);
+    assert_eq!(direction, egui::epaint::text::TextDirection::RightToLeft);
+    let p = positions.iter().find(|(c, _)| *c == 'P').map(|(_, x)| *x).expect("a Latin P");
+    let rightmost_arabic = positions.iter().filter(|(c, _)| is_rtl_script(*c)).map(|(_, x)| *x).fold(f32::MIN, f32::max);
+    assert!(p > rightmost_arabic, "in an RTL paragraph the first Latin run is at the right: {positions:?}");
+
+    let (direction, positions) = read("en");
+    crate::i18n::set_current(previous);
+    assert_eq!(direction, egui::epaint::text::TextDirection::Auto);
+    let p = positions.iter().find(|(c, _)| *c == 'P').map(|(_, x)| *x).expect("a Latin P");
+    let leftmost_arabic = positions.iter().filter(|(c, _)| is_rtl_script(*c)).map(|(_, x)| *x).fold(f32::MAX, f32::min);
+    assert!(p < leftmost_arabic, "with English the Latin run stays at the left: {positions:?}");
+}
+
+#[test]
+fn single_line_with_its_own_direction() {
+    assert!(matches!(visual_auto("Ada Lovelace"), Cow::Borrowed("Ada Lovelace")));
+    assert_eq!(visual_auto("علی رضایی"), "رضایی علی");
+    assert_eq!(visual_auto("علی 2"), "2 علی");
+    assert_eq!(visual_auto("Team علی رضایی"), "Team رضایی علی");
+}
+
+#[test]
+fn odd_input_never_panics() {
+    let long = "ا ب ".repeat(20_000);
+    let odd = [
+        "\u{064B}",
+        "\u{064B}\u{064C} \u{0301}",
+        "\u{202E}\u{202E}\u{202E}ا",
+        "\u{2067}ا\u{2066}b",
+        "ا\nب\r\nج\u{2029}د",
+        "\u{FEFF}ا\u{0000}ب",
+        "ا\u{10FFFF}\u{E000}ب",
+        "((((ا]]]]",
+        long.as_str(),
+    ];
+    for s in odd {
+        let v = visual(s);
+        assert!(v.chars().count() <= s.chars().count(), "{:?}", s.chars().take(12).collect::<String>());
+    }
+}
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index a0e80e0aab..edcd645693 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -12,68 +12,67 @@ use egui::{Align2, Color32, CornerRadius, Pos2, Rect, Sense, Stroke, TextureHand
 use pdfcraft_engine::{DocId, Edit};
 use pdfcraft_render::{DestView, DocInfo, LayerOp, LinkTarget, PRINT_TAG, PageText, RenderPool, RenderRequest, RequestKind, Tile, device_pixels};
 
+use crate::page_pointer::PagePointer;
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, QuickTool, RightPanel, comments, icons, widgets};
 
+mod area;
+pub(super) mod autoscroll;
+mod bars;
+mod cache;
+pub(super) mod crop;
+mod find;
+pub(super) mod fling;
+pub(super) mod image_pick;
+mod navigation;
+mod organize;
+pub(super) mod page_pointer;
+pub mod scroll_speed;
+mod selection;
+pub(super) mod signature_drag;
+pub(super) mod wheel_boost;
+pub(super) mod wheel_pager;
+mod xform;
+mod zoom;
+pub(super) mod zoom_snap;
+
+pub(crate) use area::signature_badges;
+use area::{
+    SUPPRESS_SECS, SUPPRESS_TAIL_SECS, annotation_hover_text, drawing_edge_pointer, glide_interrupted, page_scroll, presentation_click, run_button,
+    set_layers, zoom_anchor,
+};
+#[cfg(test)]
+use bars::in_size_hint_zone;
+use bars::{Notice, notices, page_size_hint, quick_bar};
+pub use cache::RasterMemory;
+pub(crate) use cache::{BASE_SIDE, TILE_THRESHOLD, texture_image, thumbnail_rows};
+#[cfg(test)]
+use cache::{
+    GRAYSCALE_TAG, GRID_TAG, MAX_CACHED_TEXT_PAGES, MAX_THUMB_DEMAND, PAGE_BYTES, THUMB_BYTES, THUMB_H, THUMB_TAG, THUMB_W, TILE, grayscale,
+    rgba_bytes,
+};
+use cache::{OLD_TILES, PageTex, STALE_TAG, TEXT_TAG, TILE_BYTES, scale_tag, tag_scale, texture_bytes, tile_side};
+pub use find::Find;
+use find::find_bar;
+pub use navigation::shortcuts;
+pub(crate) use organize::drop_gap;
+#[cfg(test)]
+pub(crate) use organize::grid_page_rect;
+use organize::organize_grid;
+#[cfg(test)]
+use organize::sharp_enough;
+use selection::{Selection, Span, click_unit, selection_actions};
+pub use xform::PageXform;
+use xform::snap_to_pixels;
+use zoom::anchored_scroll;
+pub use zoom::{GRID_ZOOM_RANGE, THUMBNAIL_ZOOM_RANGE};
+
 /// Logical pixels per PDF point at 100% (96 dpi, like browsers).
 pub const PT: f32 = 96.0 / 72.0;
 const GAP: f32 = 14.0;
 const MARGIN: f32 = 28.0;
 /// Horizontal gutter that keeps pages clear of the floating quick-action bar.
 const SIDE: f32 = 70.0;
-const THUMB_TAG: u64 = 1 << 63;
-const TEXT_TAG: u64 = 1 << 62;
-/// A page rendered for the organize grid at the size it is drawn there.
-const GRID_TAG: u64 = 1 << 61;
-/// Preview rasters tagged with this bit are converted to luminance on receipt, matching the
-/// monochrome print requested by Print ▸ Print in grayscale. It is a bit of its own: the
-/// renderer's print bit ([`PRINT_TAG`]) is carried by every print preview, so sharing it would
-/// turn colour previews into monochrome ones too.
-const GRAYSCALE_TAG: u64 = 1 << 59;
-/// The tag of a raster that is out of date (shown until its replacement arrives).
-const STALE_TAG: u64 = u64::MAX;
-/// Pages whose raster would exceed this many device pixels on a side are drawn in tiles.
-pub(crate) const TILE_THRESHOLD: f32 = 4096.0;
-/// Base device-pixel side of a page tile. The actual side grows with the zoom
-/// ([`tile_side`]), so a zoomed viewport is covered by a few tiles instead of many.
-const TILE: u32 = 1024;
-/// Longest side of the backdrop drawn under tiles, and of a live page preview (signature drag).
-pub(crate) const BASE_SIDE: f32 = 2048.0;
-/// Thumbnail slot before density scaling. The pages panel draws at most 150 logical points and
-/// the organize grid about 146; when the byte budget allows, density reaches the screen so those
-/// images are sampled down instead of stretched.
-const THUMB_W: f32 = 240.0;
-const THUMB_H: f32 = 320.0;
-const THUMB_BYTES: usize = 24 * 1024 * 1024;
-const PAGE_BYTES: usize = 128 * 1024 * 1024;
-const TILE_BYTES: usize = 128 * 1024 * 1024;
-const UPLOAD_BYTES_PER_FRAME: usize = 16 * 1024 * 1024;
-const RESULTS_PER_FRAME: usize = 8;
-/// A defensive ceiling for unusually large viewports / n-up previews.
-const MAX_THUMB_DEMAND: usize = 256;
-/// At most this many whole-page rasters are cached beyond the ones on screen.
-const MAX_CACHED_PAGES: usize = 24;
-/// At most this many text layers are cached beyond visible, selected and matched pages.
-/// Text layers are glyph structs, far smaller than rasters; deliberately independent of
-/// `MAX_CACHED_PAGES` so raster tuning never silently retunes text memory.
-const MAX_CACHED_TEXT_PAGES: usize = 24;
-
-fn rgba_bytes(width: usize, height: usize) -> usize {
-    width.saturating_mul(height).saturating_mul(4)
-}
-
-fn texture_bytes(tex: &TextureHandle) -> usize {
-    let [w, h] = tex.size();
-    rgba_bytes(w, h)
-}
-
-/// Visible grid rows, plus one adjacent row in either direction. Work is independent of
-/// document length, including after a large scroll jump.
-pub(crate) fn thumbnail_rows(top: f32, bottom: f32, row_height: f32, rows: usize) -> Range<usize> {
-    let first = (top.max(0.0) / row_height).floor() as usize;
-    let end = (bottom.max(0.0) / row_height).ceil() as usize;
-    first.saturating_sub(1).min(rows)..end.saturating_add(1).min(rows)
-}
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Fit {
@@ -226,94 +225,6 @@ impl ViewDefaults {
     }
 }
 
-/// The find bar (⌘F): query, matches across the document, current match.
-#[derive(Default)]
-pub struct Find {
-    pub query: String,
-    /// (page, glyph range) in document order.
-    pub matches: Vec<(usize, Range<usize>)>,
-    pub current: Option<usize>,
-    pub focus: bool,
-    pub case_query: String,
-    /// Find options (Acrobat's: case-sensitive, whole words only).
-    pub case_sensitive: bool,
-    pub whole_words: bool,
-    /// Shown in the Search panel (Advanced Search) instead of the find bar.
-    pub in_panel: bool,
-}
-
-/// A text selection on one page.
-#[derive(Clone, Copy, Debug, PartialEq)]
-struct Selection {
-    page: usize,
-    span: Span,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-enum Span {
-    /// Reading order, between two glyph indices.
-    Run { anchor: usize, head: usize },
-    /// Column select (#740): the glyphs inside a rectangle in page view space, drawn from the
-    /// corner the drag started at (`rect[0..2]`) to the pointer (`rect[2..4]`).
-    Column { rect: [f32; 4] },
-}
-
-impl Selection {
-    fn run(page: usize, anchor: usize, head: usize) -> Self {
-        Self { page, span: Span::Run { anchor, head } }
-    }
-
-    fn range(anchor: usize, head: usize) -> Range<usize> {
-        anchor.min(head)..anchor.max(head).saturating_add(1)
-    }
-
-    /// One rectangle per selected piece of a line, in view space (highlighting, markup quads).
-    fn rects(&self, text: &PageText) -> Vec<[f32; 4]> {
-        match self.span {
-            Span::Run { anchor, head } => text.line_rects(Self::range(anchor, head)),
-            Span::Column { rect } => text.glyph_rects(&text.glyphs_in(rect)),
-        }
-    }
-
-    /// The selected text, as Copy puts it on the clipboard.
-    fn text(&self, text: &PageText) -> String {
-        match self.span {
-            Span::Run { anchor, head } => text.text_of(Self::range(anchor, head)),
-            Span::Column { rect } => text.column_text(&text.glyphs_in(rect)),
-        }
-    }
-}
-
-/// The glyphs `clicks` quick clicks select around glyph `a`: two the word, three the line, more
-/// the page.
-fn click_unit(text: &PageText, clicks: u32, a: usize) -> Option<(usize, usize)> {
-    match clicks {
-        2 => text.word_at(a),
-        3 => text.line_at(a),
-        _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
-    }
-}
-
-struct PageTex {
-    tag: u64,
-    tex: TextureHandle,
-}
-
-/// Retained RGBA texture accounting for automation and performance regressions. These
-/// surface bytes exclude driver overhead and temporary upload buffers; they are not RSS.
-#[derive(Clone, Copy, Debug, Default, serde::Serialize)]
-pub struct RasterMemory {
-    pub thumbnail_count: usize,
-    pub thumbnail_bytes: usize,
-    pub page_count: usize,
-    pub page_bytes: usize,
-    pub tile_count: usize,
-    pub tile_bytes: usize,
-    pub thumbnail_demand: usize,
-    /// Last submitted missing results; workers may have completed some since submission.
-    pub pending_requests: usize,
-}
-
 /// A historical snapshot opened from another document: View signed version opens the bytes
 /// a signature covers, View revision an earlier incremental revision. Repeats reuse the tab,
 /// and the tab and notice bar name what it is, instead of piling up identical tabs.
@@ -334,30 +245,6 @@ pub struct Snapshot {
     pub from: String,
 }
 
-/// A validation badge drawn over a signature widget: the widget rectangle (user space), the verdict it shows, and its hover text.
-pub(crate) struct SignatureBadge {
-    pub rect: [f64; 4],
-    pub status: pdfcraft_engine::SignatureStatus,
-    pub summary: &'static str,
-}
-
-/// The validation badges drawn over one page's signature widgets: signed, visible widgets
-/// on this page with coordinates that survive the cast to screen space. Hostile files can
-/// carry NaN, infinite or gigantic rectangles, which must never reach the painter.
-pub(crate) fn signature_badges(signatures: &[pdfcraft_engine::SignatureInfo], page: usize) -> Vec<SignatureBadge> {
-    signatures
-        .iter()
-        .filter(|s| s.signed && s.visible && s.page == Some(page))
-        .filter_map(|s| {
-            s.rect.filter(|r| r.iter().all(|v| v.is_finite() && v.abs() < f32::MAX as f64)).map(|rect| SignatureBadge {
-                rect,
-                status: s.status,
-                summary: s.summary(),
-            })
-        })
-        .collect()
-}
-
 /// The name shown for a document tab, the window title and the Combine picker.
 /// A snapshot reads like its source document, plus the snapshot suffix that tells
 /// the tabs apart. Without a title the file name (which already carries the suffix)
@@ -637,30 +524,6 @@ pub struct DocView {
     slow_pages: HashSet<usize>,
 }
 
-/// The page grid's zoom range and the step of its buttons and keys.
-pub const GRID_ZOOM_RANGE: std::ops::RangeInclusive<f32> = 0.5..=3.0;
-/// Thumbnail size in the Pages inspector, relative to its usual size.
-pub const THUMBNAIL_ZOOM_RANGE: std::ops::RangeInclusive<f32> = 0.5..=1.5;
-const GRID_ZOOM_STEP: f32 = 1.25;
-/// How far a sharp grid render may be from the size drawn before it is redone: a pinch changes
-/// the size on every frame, and a slightly soft or slightly large image is fine meanwhile.
-const GRID_SHARP: std::ops::RangeInclusive<f32> = 0.9..=1.6;
-
-/// Whether an image `have` device pixels wide is good enough to draw `want` pixels wide.
-fn sharp_enough(have: u32, want: f32) -> bool {
-    want > 0.0 && GRID_SHARP.contains(&(have as f32 / want))
-}
-
-/// Thumbnail device-pixel density when `demand` pages share the thumbnail allowance.
-fn thumbnail_density(demand: usize, ppp: f32) -> f32 {
-    let per_thumb = THUMB_BYTES / demand.max(1).next_power_of_two();
-    ppp.clamp(0.25, 4.0).min((per_thumb as f32 / (4.0 * THUMB_W * THUMB_H)).sqrt() * 0.98)
-}
-
-fn thumbnail_scale(width: f32, height: f32, density: f32) -> f32 {
-    (THUMB_W / width.max(1.0)).min(THUMB_H / height.max(1.0)) * density
-}
-
 /// Organize-toolbar actions that need the app (file pickers, new tabs, dialogs).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum ViewAction {
@@ -696,29 +559,6 @@ pub enum ViewAction {
 }
 
 impl DocView {
-    pub fn raster_memory(&self) -> RasterMemory {
-        RasterMemory {
-            thumbnail_count: self.thumbs.len(),
-            thumbnail_bytes: self.thumbs.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex))),
-            page_count: self.pages.len(),
-            page_bytes: self.pages.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex))),
-            tile_count: self.tiles.len(),
-            tile_bytes: self.tiles.values().fold(0usize, |n, tex| n.saturating_add(texture_bytes(tex))),
-            thumbnail_demand: self.thumb_demand.len(),
-            pending_requests: self.last_queue.len(),
-        }
-    }
-
-    /// Where `page` is drawn on screen this frame (`None` when it is not on screen).
-    pub fn page_screen_rect(&self, page: usize) -> Option<Rect> {
-        self.screen_xforms.iter().find(|(p, _)| *p == page).map(|(_, xf)| xf.rect)
-    }
-
-    /// The document area on screen.
-    pub fn viewport_rect(&self) -> Rect {
-        self.viewport_screen
-    }
-
     /// Whether a middle-button scrolling gesture is active (tests and automation).
     pub fn auto_scrolling(&self) -> bool {
         self.auto_scroll.active()
@@ -729,11 +569,28 @@ impl DocView {
         self.auto_scroll.panning()
     }
 
-    /// Pages that could not be rendered, with the reason (for automation; 0-based pages).
-    pub fn page_errors(&self) -> Vec<(usize, &str)> {
-        let mut v: Vec<(usize, &str)> = self.errors.iter().map(|(p, e)| (*p, e.as_str())).collect();
-        v.sort_unstable_by_key(|(p, _)| *p);
-        v
+    /// Abandon only pointer previews: clearing egui's held button must not commit an app-owned
+    /// grab through a tool's `!primary_down` fallback. Keep selections, text drafts and edits
+    /// that were already completed before cancellation.
+    pub(crate) fn cancel_pointer_gestures(&mut self) {
+        self.marquee = None;
+        self.marquee_done = None;
+        self.comments.gesture = None;
+        self.links.drag = None;
+        self.sign.drag = None;
+        self.redact_drag = None;
+        self.crop_drag = None;
+        self.block_drag = None;
+        self.org_drag = None;
+        self.panel_drag = None;
+        self.selection_drag = false;
+        self.auto_scroll.cancel();
+        self.prepare.cancel_pointer_gesture();
+        self.content.cancel_pointer_gesture();
+        self.objects.cancel_pointer_gesture();
+        if let Some(image) = &mut self.image_selection {
+            image.cancel_pointer_gesture();
+        }
     }
 
     /// A view of a newly opened document, shown as `defaults` say. Opening a file then applies
@@ -937,401 +794,11 @@ impl DocView {
         self.page_input_reselect = true;
     }
 
-    /// Open Organize Pages on the page being read (issue #1910). An empty selection means the
-    /// current page, so a selection left from earlier that does not include it is dropped, and
-    /// the grid scrolls its cell into view. Every way into the grid goes through here; closing
-    /// it is a plain `organize = false`.
-    pub fn open_organize(&mut self) {
-        self.organize = true;
-        if !self.selected.is_empty() && !self.selected.contains(&self.current) {
-            self.clear_page_selection(Some(self.current));
-        }
-        self.grid_reveal = Some(self.current);
-    }
-
-    /// Pages an organize command acts on: the selection, or the current page.
-    pub fn target_pages(&self) -> Vec<usize> {
-        if self.selected.is_empty() { vec![self.current] } else { self.selected.iter().copied().collect() }
-    }
-
     /// Select pages in the organize grid (tests, automation). Empty clears the selection.
     pub(crate) fn page_count(&self) -> usize {
         self.page_count
     }
 
-    pub fn select_pages(&mut self, pages: &[usize]) {
-        self.selected = pages.iter().copied().filter(|p| *p < self.page_count).collect();
-        if let Some(first) = self.selected.first() {
-            self.current = *first;
-        }
-    }
-
-    /// A click on page `i`'s thumbnail, in the organize grid or the Pages panel. ⇧ selects the
-    /// range from the anchor (or the current page); ⌘/Ctrl toggles the page; a plain click
-    /// selects only it. `seed_current` is for the Pages panel, where an empty selection means
-    /// the current page: the first ⌘-click on another page keeps the current one selected too.
-    pub fn click_page(&mut self, i: usize, modifiers: egui::Modifiers, seed_current: bool) {
-        if i >= self.page_count {
-            return;
-        }
-        if modifiers.shift {
-            let a = self.select_anchor.unwrap_or(self.current);
-            self.selected = (a.min(i)..=a.max(i)).collect();
-        } else if modifiers.command {
-            if seed_current && self.selected.is_empty() && i != self.current {
-                self.selected.insert(self.current);
-            }
-            if !self.selected.remove(&i) {
-                self.selected.insert(i);
-            }
-            self.select_anchor = Some(i);
-        } else {
-            self.selected = [i].into();
-            self.select_anchor = Some(i);
-        }
-    }
-
-    /// Drop the page selection; a later ⇧-click ranges from `anchor`.
-    pub fn clear_page_selection(&mut self, anchor: Option<usize>) {
-        self.selected.clear();
-        self.select_anchor = anchor.filter(|a| *a < self.page_count);
-    }
-
-    pub fn render_pending(&self) -> bool {
-        !self.last_queue.is_empty() || self.text_background.pending() || self.move_background.pending()
-    }
-
-    /// The cached tile keys of a page, as (scale tag, tile x, tile y) (diagnostics and tests).
-    pub fn tiles_debug(&self, page: usize) -> Vec<(u64, u32, u32)> {
-        let mut k: Vec<(u64, u32, u32)> = self.tiles.keys().filter(|key| key.0 == page).map(|key| (key.1, key.2, key.3)).collect();
-        k.sort_unstable();
-        k
-    }
-
-    /// Re-render every page and text layer (the document's appearance changed, e.g. a layer
-    /// was toggled). Out-of-date rasters stay on screen until their replacements arrive, so the
-    /// view never flashes blank.
-    pub fn invalidate_content(&mut self) {
-        // Undo, redo and other document-wide changes: a released drawing's preview would be a ghost.
-        self.comments.settling.clear();
-        for p in self.pages.values_mut() {
-            p.tag = STALE_TAG;
-        }
-        self.stale_thumbs.extend(self.thumbs.keys().copied());
-        for slot in self.print_pages.values_mut() {
-            slot.0 = STALE_TAG;
-        }
-        // Pages may have moved: a sharp render of another page would be worse than a soft one.
-        self.grid_pages.clear();
-        self.tiles.clear();
-        self.stale_tiles.clear();
-        self.forms.unbaked.clear();
-        self.texts.clear();
-        self.text_failed.clear();
-        self.errors.clear();
-        self.slow_pages.clear();
-        self.waiting_since.clear();
-        self.last_queue.clear();
-        self.selection = None;
-        self.all_text = false;
-        if let Some(f) = self.find.as_mut() {
-            f.matches.clear();
-            f.current = None;
-        }
-    }
-
-    /// Only `page` changed (a comment was added, edited or removed): re-render that page and
-    /// re-read its text, keep everything else. Out-of-date tiles stay on screen until replacements arrive.
-    pub fn page_changed(&mut self, page: usize) {
-        if let Some(p) = self.pages.get_mut(&page) {
-            p.tag = STALE_TAG;
-        }
-        if self.thumbs.contains_key(&page) {
-            self.stale_thumbs.insert(page);
-        }
-        if let Some(slot) = self.print_pages.get_mut(&page) {
-            slot.0 = STALE_TAG;
-        }
-        let current_tag = if self.current_scale_tag != 0 {
-            self.current_scale_tag
-        } else {
-            self.tiles.keys().filter(|k| k.0 == page).map(|k| k.1).max().unwrap_or(0)
-        };
-        self.tiles.retain(|key, _| key.0 != page || key.1 == current_tag);
-        self.stale_tiles.retain(|key| key.0 != page || key.1 == current_tag);
-        for &key in self.tiles.keys() {
-            if key.0 == page && key.1 == current_tag {
-                self.stale_tiles.insert(key);
-            }
-        }
-        self.slow_pages.remove(&page);
-        self.texts.remove(&page);
-        self.text_failed.remove(&page);
-        self.errors.remove(&page);
-        self.last_queue.clear();
-        if self.selection.is_some_and(|s| s.page == page) {
-            self.selection = None;
-        }
-    }
-
-    /// Pages drawn last frame and their screen rectangles.
-    pub fn visible_page_rects(&self) -> Vec<(usize, Rect)> {
-        self.screen_xforms.iter().map(|(p, xf)| (*p, xf.rect)).collect()
-    }
-
-    /// Where `page` is drawn this frame, with its coordinate mapping.
-    pub(crate) fn page_xform(&self, page: usize) -> Option<PageXform> {
-        self.screen_xforms.iter().find(|(p, _)| *p == page).map(|(_, xf)| *xf)
-    }
-
-    /// The text selection as markup quadrilaterals in user space: (page, quads).
-    pub(crate) fn selection_quads(&self, info: &DocInfo) -> Option<(usize, Vec<[f64; 8]>)> {
-        let s = self.selection?;
-        let text = self.texts.get(&s.page)?;
-        let page = info.pages.get(s.page)?;
-        let quads: Vec<[f64; 8]> = s.rects(text).into_iter().map(|r| page.view_rect_to_quad(r)).collect();
-        (!quads.is_empty()).then_some((s.page, quads))
-    }
-
-    /// Where a bookmark made now should go: the page and the `/XYZ` position `[left, top]` in user
-    /// space. With text selected it is the corner of the selection that shows at its top-left
-    /// (its page, both coordinates); otherwise the top of the window (the page showing there, and
-    /// only the position along the window's vertical, so the reader's other scroll position and
-    /// zoom are kept). `None` before the first frame has laid pages out, when the bookmark just
-    /// goes to the current page.
-    pub(crate) fn bookmark_position(&self, info: &DocInfo) -> Option<(usize, [Option<f32>; 2])> {
-        if let Some(sel) = self.selection
-            && let Some(text) = self.texts.get(&sel.page)
-            && let Some(p) = info.pages.get(sel.page)
-        {
-            // The selection's bounds in view space, which View ▸ Rotate View leaves unturned: the
-            // corner at the screen's top-left is a different one for each quarter turn.
-            let [x0, y0, x1, y1] = sel.rects(text).iter().fold([f32::INFINITY, f32::INFINITY, f32::NEG_INFINITY, f32::NEG_INFINITY], |b, r| {
-                [b[0].min(r[0]), b[1].min(r[1]), b[2].max(r[2]), b[3].max(r[3])]
-            });
-            let (x, y) = match self.rotation {
-                90 => (x0, y1),
-                180 => (x1, y1),
-                270 => (x1, y0),
-                _ => (x0, y0),
-            };
-            if x.is_finite() && y.is_finite() {
-                return Some((sel.page, p.xyz_for_view(Some(x), Some(y))));
-            }
-        }
-        // The page showing at the window's top edge: one that crosses it (the first, in a spread
-        // of pages of different heights, whose shorter page can start below it), else the
-        // nearest one below.
-        let top = self.viewport_screen.top();
-        let showing = || self.screen_xforms.iter().filter(|(_, xf)| xf.rect.bottom() > top);
-        let (page, xf) = showing()
-            .filter(|(_, xf)| xf.rect.top() <= top)
-            .min_by_key(|(p, _)| *p)
-            .or_else(|| showing().min_by(|a, b| a.1.rect.top().total_cmp(&b.1.rect.top()).then(a.0.cmp(&b.0))))?;
-        let p = info.pages.get(*page)?;
-        // Above the page (in the gap before it) is the page's own top. The window's vertical is
-        // the view's y, or its x when the view is turned a quarter.
-        let (x, y) = xf.screen_to_view(pos2(xf.rect.center().x, top.max(xf.rect.top())));
-        let at = if xf.rot.is_multiple_of(180) {
-            p.xyz_for_view(None, Some(y.clamp(0.0, p.height)))
-        } else {
-            p.xyz_for_view(Some(x.clamp(0.0, p.width)), None)
-        };
-        Some((*page, at))
-    }
-
-    /// The user-space `[left, top]` at the window's top-left (where `/XYZ` puts its point), on the
-    /// page showing there: what a destination's null coordinate keeps (ISO 32000-2 §12.3.2.2).
-    /// Acrobat keeps the place this way across pages, so a CAD sheet's cross-reference opens the
-    /// next sheet where the reader was looking. A coordinate is `None` along a screen axis the
-    /// page fits, which keeps the layout's own placement (centred, or the page's top); the whole
-    /// place is `None` before the first frame has laid pages out.
-    fn place_at_corner(&self, info: &DocInfo) -> Option<[Option<f32>; 2]> {
-        let area = self.viewport_screen;
-        if !area.is_positive() {
-            return None;
-        }
-        let corner = area.min + vec2(SIDE, 0.0);
-        let (page, xf) = self
-            .screen_xforms
-            .iter()
-            .filter(|(_, xf)| xf.rect.is_positive())
-            .min_by(|a, b| a.1.rect.distance_sq_to_pos(corner).total_cmp(&b.1.rect.distance_sq_to_pos(corner)).then(a.0.cmp(&b.0)))?;
-        let p = info.pages.get(*page)?;
-        let (x, y) = xf.screen_to_view(corner.clamp(xf.rect.min, xf.rect.max));
-        // `max` drops a NaN size, so the bounds stay ordered and `clamp` can't panic.
-        let (x, y) = (x.clamp(0.0, p.width.max(0.0)), y.clamp(0.0, p.height.max(0.0)));
-        // The page counts with its side gutters, as the layout places it.
-        let wide = xf.rect.width() + 2.0 * SIDE > area.width();
-        let tall = xf.rect.height() > area.height();
-        // The view's x runs across the screen unless the view is turned a quarter.
-        let (keep_x, keep_y) = if xf.rot.is_multiple_of(180) { (wide, tall) } else { (tall, wide) };
-        Some(p.xyz_for_view(keep_x.then_some(x), keep_y.then_some(y)))
-    }
-
-    /// A page's thumbnail texture, when rendered.
-    pub(crate) fn thumb_id(&self, page: usize) -> Option<egui::TextureId> {
-        self.thumbs.get(&page).map(|t| t.tex.id())
-    }
-
-    /// The whole-page raster on screen for `page` (the low-res backdrop of a tiled page), if any.
-    pub(crate) fn page_raster(&self, page: usize) -> Option<egui::TextureId> {
-        self.pages.get(&page).map(|p| p.tex.id())
-    }
-
-    /// Whether `page`'s whole-page raster (a tiled page's backdrop too) is still the one from
-    /// before its last change, whatever its tiles are.
-    pub(crate) fn page_raster_out_of_date(&self, page: usize) -> bool {
-        self.pages.get(&page).is_some_and(|p| p.tag == STALE_TAG)
-    }
-
-    /// Whether `page` is still drawn, somewhere, as it was before its last change: its whole-page
-    /// raster (a tiled page's backdrop too) or any of its tiles waits for a replacement.
-    pub(crate) fn page_out_of_date(&self, page: usize) -> bool {
-        self.pages.get(&page).is_some_and(|p| p.tag == STALE_TAG) || self.stale_tiles.iter().any(|k| k.0 == page)
-    }
-
-    /// The print preview's picture of `page`: the sheet raster when it has arrived, otherwise the
-    /// thumbnail.
-    pub(crate) fn page_preview(&self, page: usize) -> Option<egui::TextureId> {
-        self.print_pages.get(&page).map(|(_, tex)| tex.id()).or_else(|| self.thumb_id(page))
-    }
-
-    pub(crate) fn page_text(&self, page: usize) -> Option<Arc<PageText>> {
-        self.texts.get(&page).cloned()
-    }
-
-    pub(crate) fn clear_selection(&mut self) {
-        self.selection = None;
-        self.actions_dismissed = None;
-    }
-
-    /// Select text on `page` from glyph `from` to glyph `to` (tests and automation).
-    pub fn select_text(&mut self, page: usize, from: usize, to: usize) {
-        self.all_text = false;
-        self.selection = Some(Selection::run(page, from, to));
-    }
-
-    /// Open the find bar (or focus it if already open).
-    pub fn open_find(&mut self) {
-        let f = self.find.get_or_insert_with(Find::default);
-        f.focus = true;
-    }
-
-    /// Re-run the search on all pages whose text is known (after the query changed).
-    pub fn rerun_find(&mut self) {
-        let Some(f) = self.find.as_mut() else { return };
-        f.case_query = f.query.clone();
-        f.matches.clear();
-        f.current = None;
-        if f.case_query.trim().is_empty() {
-            return;
-        }
-        let mut pages: Vec<usize> = self.texts.keys().copied().collect();
-        pages.sort();
-        for &p in &pages {
-            if let Some(text) = self.texts.get(&p) {
-                f.matches.extend(text.find_opts(&f.case_query, f.case_sensitive, f.whole_words).into_iter().map(|r| (p, r)));
-            }
-        }
-        f.matches.sort_by_key(|(p, r)| (*p, r.start));
-        if !f.matches.is_empty() {
-            // First match at or after the page being viewed.
-            let cur = self.current;
-            let i = f.matches.iter().position(|(p, _)| *p >= cur).unwrap_or(0);
-            f.current = Some(i);
-            let (p, _) = f.matches[i];
-            self.flash_match(p);
-        }
-    }
-
-    fn refresh_find_page(&mut self, page: usize) {
-        let (Some(f), Some(text)) = (self.find.as_mut(), self.texts.get(&page)) else { return };
-        if f.case_query.trim().is_empty() {
-            return;
-        }
-        let current_key = f.current.and_then(|c| f.matches.get(c).cloned());
-        f.matches.retain(|(p, _)| *p != page);
-        f.matches.extend(text.find_opts(&f.case_query, f.case_sensitive, f.whole_words).into_iter().map(|r| (page, r)));
-        f.matches.sort_by_key(|(p, r)| (*p, r.start));
-        f.current = current_key.as_ref().and_then(|k| f.matches.iter().position(|m| m == k));
-        if f.current.is_none() && !f.matches.is_empty() {
-            // First match at or after the page being viewed.
-            let cur = self.current;
-            let i = f.matches.iter().position(|(p, _)| *p >= cur).unwrap_or(0);
-            f.current = Some(i);
-            let (p, _) = f.matches[i];
-            if current_key.is_none() {
-                self.flash_match(p);
-            }
-        }
-    }
-
-    /// Go to match `i` (the Search panel's results).
-    pub fn go_to_match(&mut self, i: usize) {
-        let Some(f) = self.find.as_mut() else { return };
-        let Some(&(p, _)) = f.matches.get(i) else { return };
-        f.current = Some(i);
-        self.go_to_page(p);
-        self.goto_point = None;
-        self.flash_match(p);
-    }
-
-    /// Move to the next/previous match.
-    pub fn find_step(&mut self, forward: bool) {
-        let Some(f) = self.find.as_mut() else { return };
-        if f.matches.is_empty() {
-            return;
-        }
-        let n = f.matches.len();
-        let c = f.current.unwrap_or(0);
-        let next = if forward { (c + 1) % n } else { (c + n - 1) % n };
-        f.current = Some(next);
-        let p = f.matches[next].0;
-        // Only explicit search navigation joins history; background refresh uses flash_match alone.
-        self.go_to_page(p);
-        self.goto_point = None;
-        self.flash_match(p);
-    }
-
-    fn flash_match(&mut self, page: usize) {
-        let frac = self
-            .find
-            .as_ref()
-            .and_then(|f| f.current.and_then(|c| f.matches.get(c)))
-            .and_then(|(p, r)| self.texts.get(p).and_then(|t| t.glyphs.get(r.start)).map(|g| g.rect[1]))
-            .zip(self.page_heights.get(page).copied())
-            .map(|(y, h)| ((y - 60.0) / h).clamp(0.0, 1.0))
-            .unwrap_or(0.0);
-        self.goto = Some((page, frac));
-        self.current = page;
-        self.reset_coarse_state();
-    }
-
-    /// Screen position of the centre of glyph `glyph` on `page`, if that page is on screen and its
-    /// text layer is loaded (used by UI tests and automation to aim pointer input).
-    pub fn glyph_screen_pos(&self, page: usize, glyph: usize) -> Option<Pos2> {
-        let (_, xf) = self.screen_xforms.iter().find(|(p, _)| *p == page)?;
-        let g = self.texts.get(&page)?.glyphs.get(glyph)?;
-        Some(xf.view_rect(g.rect).center())
-    }
-
-    /// Selected text, if any (⌘C).
-    /// The selected text: of the pages read so far, after Select All of the document (Copy reads
-    /// the others, [`DocView::pages_without_text`]).
-    pub fn selected_text(&self) -> Option<String> {
-        if self.all_text {
-            return Some(self.whole_text(&HashMap::new())).filter(|x| !x.is_empty());
-        }
-        let s = self.selection?;
-        let t = self.texts.get(&s.page)?;
-        Some(s.text(t)).filter(|x| !x.is_empty())
-    }
-
-    pub fn thumb(&self, page: usize) -> Option<&TextureHandle> {
-        self.thumbs.get(&page).map(|t| &t.tex)
-    }
-
     /// Drops wheel state after a discontinuous jump so the destination cannot
     /// inherit momentum from the previous viewport.
     fn reset_coarse_state(&mut self) {
@@ -1339,1376 +806,6 @@ impl DocView {
         self.wheel_boost_x.reset();
         self.wheel_boost_y.reset();
     }
-
-    pub fn go_to_page(&mut self, page: usize) {
-        let page = page.min(self.page_count.saturating_sub(1));
-        if page != self.current {
-            // The view history (Previous view / Next view).
-            if self.back.last() != Some(&self.current) {
-                self.back.push(self.current);
-                if self.back.len() > 200 {
-                    self.back.remove(0);
-                }
-            }
-            self.forward.clear();
-        }
-        // Partial wheel motion belongs to the old place.
-        self.reset_coarse_state();
-        self.goto = Some((page, 0.0));
-        self.current = page;
-    }
-
-    /// Reveal a user-space rectangle without changing zoom, centred where the scroll bounds allow.
-    pub(crate) fn reveal_rect(&mut self, page: usize, rect: [f32; 4], info: &DocInfo) {
-        self.go_to_page(page);
-        self.goto_point = None;
-        let Some(p) = info.pages.get(self.current) else { return };
-        if !rect.iter().all(|v| v.is_finite()) {
-            return;
-        }
-        // Halve before adding so even large finite coordinates cannot overflow the midpoint.
-        let x = rect[0] * 0.5 + rect[2] * 0.5;
-        let y = rect[1] * 0.5 + rect[3] * 0.5;
-        let [fx, fy] = p.dest_fraction(Some(x), Some(y), self.rotation);
-        self.goto_point = Some((self.current, fx, fy, vec2(self.viewport_w, self.viewport_h) / 2.0));
-    }
-
-    /// Go to a destination, a bookmark's or a link's (ISO 32000-2 §12.3.2.2): its page, scrolled
-    /// and zoomed as `dest` asks, as Acrobat does. `/XYZ` puts (left, top) at the window's
-    /// top-left at its zoom (null or 0 keeps the zoom); `/Fit`, `/FitH` and `/FitV` switch to fit
-    /// page, width and height with `top` or `left` at the window's edge; `/FitR` zooms so the
-    /// rectangle fits, centred. The `B` (content box) forms are read as the page. A null `/XYZ`
-    /// coordinate keeps the reader's place: the same user-space point stays at the window's
-    /// top-left on the new page, as Acrobat does. A point past the end of the document scrolls
-    /// as far as it can.
-    pub fn go_to_dest(&mut self, page: usize, dest: DestView, info: &DocInfo) {
-        // Read before the jump: it is where the reader is now.
-        let kept = match dest {
-            DestView::Xyz { left, top, .. } if left.is_none() || top.is_none() => self.place_at_corner(info),
-            _ => None,
-        };
-        self.go_to_page(page);
-        let page = self.current;
-        self.goto_point = None;
-        let Some(p) = info.pages.get(page) else { return };
-        let point = |x: Option<f32>, y: Option<f32>| p.dest_fraction(x, y, self.rotation);
-        // The window's top-left as far as pages go: its left edge is the gutter that keeps them
-        // clear of the floating quick-action bar, so `left` 0 shows the page's edge beside it.
-        let corner = vec2(SIDE, 0.0);
-        let (fx, fy, rel) = match dest {
-            DestView::Top => return,
-            DestView::Xyz { left, top, zoom } => {
-                if let Some(z) = zoom {
-                    self.zoom = z.clamp(0.08, 64.0);
-                    self.fit = Fit::None;
-                    self.zoom_anchor = None;
-                }
-                let [kept_left, kept_top] = kept.unwrap_or([None, None]);
-                let [fx, fy] = point(left.or(kept_left), top.or(kept_top));
-                (fx, fy, corner)
-            }
-            DestView::Fit => {
-                self.fit = Fit::Page;
-                return;
-            }
-            DestView::FitH { top } => {
-                self.fit = Fit::Width;
-                let [fx, fy] = point(None, top);
-                (fx, fy, corner)
-            }
-            DestView::FitV { left } => {
-                self.fit = Fit::Height;
-                let [fx, fy] = point(left, None);
-                (fx, fy, corner)
-            }
-            DestView::FitR { rect } => {
-                let ([Some(ax), Some(ay)], [Some(bx), Some(by)]) = (point(Some(rect[0]), Some(rect[3])), point(Some(rect[2]), Some(rect[1]))) else {
-                    return;
-                };
-                // The rectangle as displayed, in points (it can be turned a quarter).
-                let (dw, dh) = self.display_size(p);
-                let (w, h) = ((ax - bx).abs() * dw, (ay - by).abs() * dh);
-                if w >= 1.0 && h >= 1.0 && self.viewport_w >= 1.0 && self.viewport_h >= 1.0 {
-                    self.zoom = (self.viewport_w / (w * PT)).min(self.viewport_h / (h * PT)).clamp(0.08, 64.0);
-                    self.fit = Fit::None;
-                    self.zoom_anchor = None;
-                }
-                (Some((ax + bx) / 2.0), Some((ay + by) / 2.0), vec2(self.viewport_w, self.viewport_h) / 2.0)
-            }
-        };
-        if fx.is_some() || fy.is_some() {
-            self.goto_point = Some((page, fx, fy, rel));
-        }
-    }
-
-    /// Next page (`true`) or previous page. In two-page view this moves a whole spread: the other
-    /// page of the spread is already on screen, so stepping to it wouldn't move the view (#70).
-    pub fn step_page(&mut self, forward: bool) {
-        let c = self.current;
-        let last = self.page_count.saturating_sub(1);
-        let (target, first) = match self.layout {
-            PageLayout::TwoUp => {
-                let first = self.spread_first(c);
-                let target = match (forward, self.cover && c == 0) {
-                    (true, true) => 1,
-                    (true, false) => first.saturating_add(2),
-                    (false, _) if self.cover && first <= 1 => 0,
-                    (false, _) => first.saturating_sub(2),
-                };
-                (target, first)
-            }
-            PageLayout::Single if forward => (c + 1, c),
-            PageLayout::Single => (c.saturating_sub(1), c),
-        };
-        // Past either end there is nowhere to go: stay put rather than re-align the view, which
-        // would scroll the page back to its top.
-        if if forward { target > last } else { first == 0 } {
-            return;
-        }
-        self.go_to_page(target);
-    }
-
-    /// Page-editor focus and drafts belong to a document, even while another tab is active.
-    pub(crate) fn page_input_id(&self) -> egui::Id {
-        egui::Id::new(("page-input", self.id.0))
-    }
-
-    /// The idle page box and unchanged-input lookup share the same label fallback.
-    pub(crate) fn current_page_label(&self, label: Option<&str>) -> String {
-        label.filter(|l| !l.is_empty()).map(str::to_owned).unwrap_or_else(|| (self.current + 1).to_string())
-    }
-
-    /// Retain the current page when `typed` exactly matches its displayed label, even if
-    /// another page has that label. Otherwise resolve a trimmed label (case-insensitive),
-    /// then a physical page number. `false` when it names no page.
-    pub fn go_to_typed(&mut self, typed: &str, labels: &[String]) -> bool {
-        // Compare the displayed value before trimming: a label may itself contain spaces.
-        // Repeated labels occur in restarted sections and prefix-only ranges.
-        if self.current < self.page_count && self.current_page_label(labels.get(self.current).map(String::as_str)) == typed {
-            return true;
-        }
-        let t = typed.trim();
-        let page = labels
-            .iter()
-            .position(|l| !l.is_empty() && l.eq_ignore_ascii_case(t))
-            .or_else(|| t.parse::<usize>().ok().filter(|n| *n >= 1).map(|n| n - 1));
-        match page {
-            Some(p) if p < self.page_count => {
-                self.go_to_page(p);
-                true
-            }
-            _ => false,
-        }
-    }
-
-    /// View ▸ Page navigation ▸ Previous view (`false`) / Next view (`true`).
-    pub fn view_history(&mut self, forward: bool) -> bool {
-        let (from, to) = if forward { (&mut self.forward, &mut self.back) } else { (&mut self.back, &mut self.forward) };
-        let Some(page) = from.pop() else { return false };
-        to.push(self.current);
-        let page = page.min(self.page_count.saturating_sub(1));
-        self.goto = Some((page, 0.0));
-        self.current = page;
-        self.reset_coarse_state();
-        true
-    }
-
-    /// Select all: every page in Organize, or every word on the current page.
-    pub fn select_all(&mut self) -> bool {
-        if self.organize {
-            self.selected = (0..self.page_count).collect();
-            // Keep the current page as the anchor for the next Shift-click.
-            self.select_anchor = (self.page_count > 0).then_some(self.current);
-            return !self.selected.is_empty();
-        }
-        // Scrolling continuously, Select All takes the whole document's text (#2639); one page at
-        // a time, the page shown.
-        // Like the page's, true once some text is selected: the pages whose text isn't read yet are
-        // read when the selection is copied.
-        if self.continuous && self.page_count > 1 {
-            self.selection = None;
-            self.all_text = true;
-            return self.selected_text().is_some();
-        }
-        self.all_text = false;
-        let page = self.current;
-        let Some(t) = self.texts.get(&page) else { return false };
-        if t.glyphs.is_empty() {
-            return false;
-        }
-        self.selection = Some(Selection::run(page, 0, t.glyphs.len() - 1));
-        true
-    }
-
-    /// Pages whose text [`DocView::whole_text`] still needs: not read yet, nor failed.
-    pub(crate) fn pages_without_text(&self) -> Vec<usize> {
-        (0..self.page_count).filter(|p| !self.texts.contains_key(p) && !self.text_failed.contains(p)).collect()
-    }
-
-    /// The whole document's text in page order, one page after another on new lines, from the
-    /// pages' text read so far and `more` (pages read for this, keyed by page).
-    pub(crate) fn whole_text(&self, more: &HashMap<usize, Arc<PageText>>) -> String {
-        let mut out = String::new();
-        for p in 0..self.page_count {
-            let Some(t) = self.texts.get(&p).or_else(|| more.get(&p)) else { continue };
-            let text = t.text_of(0..t.glyphs.len());
-            if text.is_empty() {
-                continue;
-            }
-            if !out.is_empty() {
-                out.push('\n');
-            }
-            out.push_str(&text);
-        }
-        out
-    }
-
-    /// Rotate the view 90° clockwise or counter-clockwise (View ▸ Rotate View, ⇧⌘+ / ⇧⌘−).
-    pub fn rotate_view(&mut self, clockwise: bool) {
-        self.rotation = (self.rotation + if clockwise { 90 } else { 270 }) % 360;
-        self.goto = Some((self.current, 0.0));
-        self.reset_coarse_state();
-    }
-
-    /// Switch the zoom mode, keeping the current page in view.
-    pub fn set_fit(&mut self, fit: Fit) {
-        self.fit = fit;
-        self.goto = Some((self.current, 0.0));
-        self.reset_coarse_state();
-    }
-
-    /// Full screen, as Acrobat's Full Screen Mode (#379, #1459): one page at a time (or one
-    /// spread, when two-page view was on: #1353), fitted to the screen, from the current page.
-    /// The display it replaces is kept for [`Self::leave_presentation`]. A no-op while presenting.
-    pub fn enter_presentation(&mut self) {
-        if self.presentation.is_some() {
-            return;
-        }
-        self.presentation =
-            Some(SavedDisplay { layout: self.layout, continuous: self.continuous, cover: self.cover, fit: self.fit, zoom: self.zoom });
-        self.continuous = false;
-        self.fit = Fit::Page;
-        self.selection = None;
-        self.goto = Some((self.current, 0.0));
-    }
-
-    /// Leave full screen: the display from before it comes back, at the page reached meanwhile.
-    pub fn leave_presentation(&mut self) {
-        let Some(saved) = self.presentation.take() else { return };
-        self.layout = saved.layout;
-        self.continuous = saved.continuous;
-        self.cover = saved.cover;
-        self.fit = saved.fit;
-        self.zoom = saved.zoom;
-        self.goto = Some((self.current, 0.0));
-    }
-
-    /// The display shown outside full screen: the one presenting replaced, or the current one.
-    pub fn normal_display(&self) -> SavedDisplay {
-        self.presentation.unwrap_or(SavedDisplay {
-            layout: self.layout,
-            continuous: self.continuous,
-            cover: self.cover,
-            fit: self.fit,
-            zoom: self.zoom,
-        })
-    }
-
-    /// Whether the view is in full screen's one-page-at-a-time display.
-    pub fn presenting(&self) -> bool {
-        self.presentation.is_some()
-    }
-
-    /// Switch the base page display (Single or Two-page), leaving continuous scrolling as it is.
-    /// A no-op when the layout is already current, so re-selecting it never yanks a scrolled view
-    /// back to the top.
-    pub fn set_layout(&mut self, layout: PageLayout) {
-        if self.layout == layout {
-            return;
-        }
-        self.layout = layout;
-        self.goto = Some((self.current, 0.0));
-        self.reset_coarse_state();
-    }
-
-    /// Whether the view scrolls continuously (as opposed to one page or spread at a time).
-    pub fn continuous(&self) -> bool {
-        self.continuous
-    }
-
-    /// Change page separation without editing the PDF or losing the reader's place.
-    pub fn set_page_gaps(&mut self, show: bool) {
-        if self.show_page_gaps == show {
-            return;
-        }
-        if !self.organize && self.viewport_screen.is_positive() {
-            let at = self.viewport_screen.center();
-            if let Some((page, r)) = self
-                .screen_rects
-                .iter()
-                .filter(|(_, r)| r.is_positive())
-                .min_by(|(_, a), (_, b)| a.distance_sq_to_pos(at).total_cmp(&b.distance_sq_to_pos(at)))
-            {
-                let fraction = (at - r.min) / r.size();
-                self.zoom_anchor = Some((*page, fraction.x, fraction.y, at - self.viewport_screen.min));
-            }
-        }
-        self.show_page_gaps = show;
-    }
-
-    /// Separation between adjacent page rectangles, in logical screen points.
-    fn page_gap(&self) -> f32 {
-        if self.show_page_gaps { GAP } else { 0.0 }
-    }
-
-    /// Turn continuous scrolling on or off, keeping the current page in view. A no-op when it is
-    /// already in that state.
-    pub fn set_continuous(&mut self, continuous: bool) {
-        if self.continuous != continuous {
-            self.continuous = continuous;
-            // Select All of the document belongs to continuous scrolling.
-            self.all_text = false;
-            self.goto = Some((self.current, 0.0));
-            self.reset_coarse_state();
-        }
-    }
-
-    /// Set the whole page display at once (the base layout and continuous scrolling together),
-    /// as the control channel and settings do through a single [`display_token`].
-    pub fn set_display(&mut self, layout: PageLayout, continuous: bool) {
-        self.set_layout(layout);
-        self.set_continuous(continuous);
-    }
-
-    /// Set the cover page in two-page view. A no-op unless something changed.
-    pub fn set_cover(&mut self, cover: bool) {
-        if self.cover != cover {
-            self.cover = cover;
-            self.goto = Some((self.current, 0.0));
-            self.reset_coarse_state();
-        }
-    }
-
-    /// Whether the cover page setting applies: only two-page view has a cover page.
-    pub fn cover_applies(&self) -> bool {
-        self.layout == PageLayout::TwoUp
-    }
-
-    /// One wheel event in a non-continuous view, where the wheel turns pages or spreads (the
-    /// rules are in `wheel_pager`): `dy` is its vertical delta (negative scrolls down) and `now`
-    /// is egui time. With `can_turn` false the gesture is followed but the page stays. Returns
-    /// whether the page turned.
-    pub fn single_page_wheel(&mut self, unit: egui::MouseWheelUnit, dy: f32, phase: egui::TouchPhase, now: f64, can_turn: bool) -> bool {
-        if self.continuous {
-            return false;
-        }
-        let Some(forward) = self.wheel.feed(unit, dy, phase, now, can_turn) else { return false };
-        let before = self.current;
-        self.step_page(forward);
-        self.current != before
-    }
-
-    /// One wheel event in a non-continuous view whose page is taller than the window, where the
-    /// wheel pans (#1924). Once the view is at the bottom (top) edge, scrolling on turns to the
-    /// next (previous) page, which shows its top (bottom). A smooth gesture that panned the page
-    /// has to end first (see `WheelPager::feed_edge`). `can_turn` is false when something else
-    /// owns the wheel. Returns whether the page turned.
-    pub fn single_page_wheel_edge(&mut self, unit: egui::MouseWheelUnit, dy: f32, phase: egui::TouchPhase, now: f64, can_turn: bool) -> bool {
-        if self.continuous {
-            return false;
-        }
-        // Only an up-to-date view counts: the page drawn is the shown one, with no jump pending.
-        let edge = self.goto.is_none()
-            && self.goto_point.is_none()
-            && self.single_edges.is_some_and(|(page, top, bottom)| page == self.current && if dy < 0.0 { bottom } else { top });
-        let Some(forward) = self.wheel.feed_edge(unit, dy, phase, now, can_turn && edge) else { return false };
-        let before = self.current;
-        self.step_page(forward);
-        if self.current == before {
-            return false;
-        }
-        if !forward {
-            // Going back lands on the bottom of the previous page.
-            self.goto = Some((self.current, 1.0));
-        }
-        self.single_edges = None;
-        true
-    }
-
-    /// Displayed page size in points for this view rotation.
-    fn display_size(&self, p: &pdfcraft_render::PageInfo) -> (f32, f32) {
-        if self.rotation % 180 == 90 { (p.height, p.width) } else { (p.width, p.height) }
-    }
-
-    /// Marquee Zoom: zoom so `r` (on screen) fills the window, centred.
-    pub fn zoom_to_rect(&mut self, r: Rect) {
-        let Some((page, pr)) = self.screen_rects.iter().find(|(_, pr)| pr.contains(r.center())).copied() else { return };
-        let k = (self.viewport_screen.width() / r.width().max(1.0)).min(self.viewport_screen.height() / r.height().max(1.0));
-        let f = (r.center() - pr.min) / pr.size();
-        self.zoom = (self.zoom * k).clamp(0.08, 64.0);
-        self.fit = Fit::None;
-        self.zoom_anchor = Some((page, f.x.clamp(0.0, 1.0), f.y.clamp(0.0, 1.0), self.viewport_screen.center() - self.viewport_screen.min));
-    }
-
-    /// View ▸ Zoom ▸ Fit Visible: zoom so the visible content of `page` (display-normalised
-    /// [x0, y0, x1, y1], i.e. after view rotation) spans the window's width, its left edge at
-    /// the window's left and its top at the top.
-    pub fn fit_content(&mut self, page: usize, content: [f32; 4]) -> bool {
-        const PAD: f32 = 16.0;
-        let Some((_, pr)) = self.screen_rects.iter().find(|(p, _)| *p == page).copied() else { return false };
-        let w = (content[2] - content[0]).max(0.01) * pr.width();
-        let k = (self.viewport_screen.width() - 2.0 * PAD).max(50.0) / w.max(1.0);
-        self.zoom = (self.zoom * k).clamp(0.08, 64.0);
-        self.fit = Fit::None;
-        self.zoom_anchor = Some((page, content[0].clamp(0.0, 1.0), content[1].clamp(0.0, 1.0), vec2(PAD, MARGIN)));
-        true
-    }
-
-    /// How large the page grid draws its pages (1.0 = the usual thumbnails).
-    pub fn grid_zoom(&self) -> f32 {
-        self.grid_zoom
-    }
-
-    /// Scale of the thumbnails in the Pages inspector (1.0 is the usual size).
-    pub fn thumbnail_zoom(&self) -> f32 {
-        self.thumbnail_zoom
-    }
-
-    /// Resize the inspector thumbnails, keeping the current page in view after layout.
-    /// Out-of-range values are clamped; non-finite values are ignored.
-    pub fn set_thumbnail_zoom(&mut self, zoom: f32) {
-        if zoom.is_finite() {
-            let zoom = zoom.clamp(*THUMBNAIL_ZOOM_RANGE.start(), *THUMBNAIL_ZOOM_RANGE.end());
-            if zoom != self.thumbnail_zoom {
-                self.thumbnail_zoom = zoom;
-                self.panel_followed = None;
-            }
-        }
-    }
-
-    /// Zoom the page grid; out-of-range values are clamped and nonsense is ignored.
-    pub fn set_grid_zoom(&mut self, zoom: f32) {
-        if zoom.is_finite() {
-            self.grid_zoom = zoom.clamp(*GRID_ZOOM_RANGE.start(), *GRID_ZOOM_RANGE.end());
-        }
-    }
-
-    /// How many device pixels wide the grid's sharp render of `page` is, if it has one.
-    pub fn grid_page_pixels(&self, page: usize) -> Option<u32> {
-        self.grid_pages.get(&page).map(|(w, _)| *w)
-    }
-
-    /// Zoom keeping the centre of the view still.
-    pub fn set_zoom(&mut self, zoom: f32) {
-        // CLI/view options can set zoom before the first layout. Rect::NOTHING has no
-        // finite centre yet, but an initial zoom still needs to leave the default fit mode.
-        let centre = if self.viewport_screen.is_positive() { self.viewport_screen.center() } else { Pos2::ZERO };
-        self.zoom_at(zoom, centre);
-    }
-
-    /// Zoom keeping the document point under `screen_pos` still (pinch, ⌘-scroll).
-    pub fn zoom_at(&mut self, zoom: f32, screen_pos: Pos2) {
-        if !zoom.is_finite() || !screen_pos.is_finite() {
-            return;
-        }
-        let zoom = zoom.clamp(0.08, 64.0);
-        if zoom == self.zoom && self.fit == Fit::None {
-            return;
-        }
-        // In gutters/gaps, anchor relative to the nearest page rather than jumping to its top.
-        // Fractions outside 0..1 preserve the pointer's position outside the page as well.
-        let anchor =
-            self.screen_rects.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(screen_pos).total_cmp(&b.distance_sq_to_pos(screen_pos))).map(
-                |(p, r)| {
-                    let f = (screen_pos - r.min) / r.size();
-                    (*p, f.x, f.y, screen_pos - self.viewport_screen.min)
-                },
-            );
-        self.zoom = zoom;
-        self.fit = Fit::None;
-        match anchor {
-            Some(a) => self.zoom_anchor = Some(a),
-            // Nothing on screen yet (e.g. a launch option): align the current page instead.
-            None => self.goto = Some((self.current, 0.0)),
-        }
-    }
-
-    /// A zoom typed as a percentage ("150", "150%", " 62.5 % ") as a zoom factor; `None` unless it is a
-    /// finite, positive number. `set_zoom` clamps it to the supported range.
-    pub fn parse_zoom_percent(typed: &str) -> Option<f32> {
-        let percent = typed.trim().trim_end_matches('%').trim_end().parse::<f32>().ok()?;
-        (percent.is_finite() && percent > 0.0).then_some(percent / 100.0)
-    }
-
-    /// Standard zoom steps (as in Acrobat's zoom menu).
-    pub fn zoom_step(&mut self, up: bool) {
-        const STEPS: [f32; 17] = [0.1, 0.25, 0.33, 0.5, 0.66, 0.75, 1.0, 1.25, 1.5, 2.0, 3.0, 4.0, 6.0, 8.0, 12.0, 16.0, 32.0];
-        let z = self.zoom;
-        let next = if up { STEPS.iter().copied().find(|s| *s > z * 1.01) } else { STEPS.iter().rev().copied().find(|s| *s < z * 0.99) };
-        if let Some(n) = next {
-            self.set_zoom(n);
-        }
-    }
-
-    /// Start collecting demand from every consumer before scheduling or uploading results.
-    pub(crate) fn begin_render_frame(&mut self) {
-        self.frame_geometry_changed = false;
-        self.pages_panel = None;
-        self.panel_gap = None;
-        self.thumb_demand.clear();
-        self.frame_queue.clear();
-        self.frame_visible.clear();
-    }
-
-    pub(crate) fn need_thumbnail(&mut self, page: usize, visible: bool) {
-        if page >= self.page_count {
-            return;
-        }
-        if let Some(priority) = self.thumb_demand.get_mut(&page) {
-            *priority |= visible;
-        } else if self.thumb_demand.len() < MAX_THUMB_DEMAND {
-            self.thumb_demand.insert(page, visible);
-        } else if visible && let Some(prefetch) = self.thumb_demand.iter().find_map(|(&p, &v)| (!v).then_some(p)) {
-            self.thumb_demand.remove(&prefetch);
-            self.thumb_demand.insert(page, true);
-        }
-    }
-
-    /// Only the displayed document owns raster textures. Tabs keep their document and view
-    /// state, but do not each retain a separate full application texture allowance.
-    pub(crate) fn suspend_rendering(&mut self, pool: &RenderPool) {
-        self.begin_render_frame();
-        self.pages.clear();
-        self.tiles.clear();
-        self.thumbs.clear();
-        self.grid_pages.clear();
-        self.print_pages.clear();
-        self.stale_thumbs.clear();
-        self.stale_tiles.clear();
-        self.waiting_since.clear();
-        // Signature previews own a separate renderer and image/background textures.
-        self.signature_drag = Default::default();
-        self.text_background = Default::default();
-        self.move_background = Default::default();
-        if !self.last_queue.is_empty() {
-            pool.set_queue(Vec::new());
-            self.last_queue.clear();
-        }
-        // Results already finished for this tab would otherwise sit in its pool, rasters and
-        // all, until the tab is shown again. (An inline pool renders inside try_recv: skip it.)
-        if !pool.is_inline() {
-            while pool.try_recv().is_some() {}
-        }
-    }
-
-    fn thumbnail_requests(&self, info: &DocInfo, ppp: f32) -> Vec<RenderRequest> {
-        let mut pages: Vec<_> = self.thumb_demand.iter().map(|(&p, &visible)| (p, visible)).collect();
-        pages.sort_unstable_by_key(|&(p, visible)| (!visible, p));
-        // At high DPI or in a very large viewport every demanded cell still fits the same
-        // byte allowance. Both dimensions are capped, including tall/wide page boxes.
-        // The count is rounded up to a power of two: the scale is part of each request's tag,
-        // so a density that followed every row scrolling in or out would re-render them all.
-        let density = thumbnail_density(pages.len(), ppp);
-        pages
-            .into_iter()
-            .filter_map(|(page, _)| {
-                let p = info.pages.get(page)?;
-                let scale = thumbnail_scale(p.width, p.height, density);
-                Some(RenderRequest {
-                    page,
-                    kind: RequestKind::Pixels,
-                    tile: None,
-                    scale,
-                    tag: THUMB_TAG | u64::from(scale.to_bits()),
-                    // Thumbnails are previews: tiny images are skipped for them.
-                    preview: true,
-                })
-            })
-            .collect()
-    }
-
-    /// Admit current demand within explicit byte limits. Cached and pending surfaces share
-    /// the allowance, so an evicted page can be requested again without a permanent done set.
-    fn prepare_render_queue(&mut self, info: &DocInfo, ppp: f32) -> Vec<RenderRequest> {
-        let requests = std::mem::take(&mut self.frame_queue);
-        let mut queue = Vec::new();
-        let mut pages = HashSet::new();
-        let mut tiles = HashSet::new();
-        let mut tile_tags = HashSet::new();
-        let mut grid = Vec::new();
-        let (mut page_bytes, mut tile_bytes) = (0usize, 0usize);
-        for req in requests.iter().filter(|r| r.kind == RequestKind::Pixels) {
-            let Some(p) = info.pages.get(req.page) else { continue };
-            // Organize-grid renders: only the cells in view that need one (organize_grid).
-            if req.tag & GRID_TAG != 0 {
-                grid.push(*req);
-                continue;
-            }
-            // Print-preview rasters: a few sheets at the pane's size (the dialog bounds them).
-            if req.tag & PRINT_TAG != 0 {
-                if !self.errors.contains_key(&req.page) {
-                    queue.push(*req);
-                }
-                continue;
-            }
-            // On-screen work is always admitted (the viewport bounds it); the limits only
-            // decide how much prefetch fits beside it.
-            let visible = self.frame_visible.contains(&req.page);
-            if let Some(tile) = req.tile {
-                // Keyed by exact device-pixel origin: the tile side varies with the zoom
-                // (`tile_side`), so grid indices would need the scale to decode.
-                let key = (req.page, req.tag, tile.x, tile.y);
-                let bytes = rgba_bytes(tile.w as usize, tile.h as usize);
-                if (!visible && tile_bytes.saturating_add(bytes) > TILE_BYTES) || !tiles.insert(key) {
-                    continue;
-                }
-                tile_bytes = tile_bytes.saturating_add(bytes);
-                tile_tags.insert(req.tag);
-                if !self.tiles.contains_key(&key) || self.stale_tiles.contains(&key) {
-                    queue.push(*req);
-                }
-            } else {
-                let bytes = rgba_bytes(device_pixels(p.width, req.scale) as usize, device_pixels(p.height, req.scale) as usize);
-                if (!visible && (page_bytes.saturating_add(bytes) > PAGE_BYTES || pages.len() >= MAX_CACHED_PAGES)) || !pages.insert(req.page) {
-                    continue;
-                }
-                page_bytes = page_bytes.saturating_add(bytes);
-                if self.pages.get(&req.page).is_none_or(|p| p.tag != req.tag) {
-                    queue.push(*req);
-                }
-            }
-        }
-        // Pages no longer demanded stay cached while the allowance has room, nearest to the
-        // current page first, so turning back a page shows it at once instead of rendering.
-        let mut undemanded: Vec<usize> = self.pages.keys().copied().filter(|p| !pages.contains(p)).collect();
-        undemanded.sort_by_key(|p| p.abs_diff(self.current));
-        let mut kept = pages.len();
-        for page in undemanded {
-            let bytes = self.pages.get(&page).map_or(0, |p| texture_bytes(&p.tex));
-            if kept < MAX_CACHED_PAGES && page_bytes.saturating_add(bytes) <= PAGE_BYTES {
-                page_bytes = page_bytes.saturating_add(bytes);
-                kept += 1;
-                pages.insert(page);
-            }
-        }
-        self.pages.retain(|p, _| pages.contains(p));
-        // Tiles of an earlier zoom (not a demanded scale) stay while the canvas keeps them, a
-        // bounded few under a page whose current tiles are still missing (OLD_TILES). Tiles of a
-        // page on screen stay too even when this frame does not demand them (#2196): the viewport
-        // moves while zooming, so a tile that was sharp a moment ago falls outside the demanded
-        // rectangle, and dropping it made every pan or zoom back a cold miss that re-blurred the
-        // page and re-interpreted it once per tile. The per-frame cap below (OLD_TILES,
-        // nearest scale first) is what bounds how much of that stays.
-        self.tiles.retain(|key, _| tiles.contains(key) || !tile_tags.contains(&key.1) || self.frame_visible.contains(&key.0));
-        self.stale_tiles.retain(|key| self.tiles.contains_key(key));
-        queue.extend(grid);
-        // Opening (or turning to) a page queues its pixels alongside thumbnails and
-        // text extraction. The workers would otherwise spend the first seconds on
-        // thumbnails and search text while the visible page stays blank: hold those
-        // until no visible main-page raster is still missing. Errored pages never
-        // block: they are never re-requested.
-        let visible_mains_pending = queue.iter().any(|r| {
-            r.kind == RequestKind::Pixels
-                && r.tag & (GRID_TAG | PRINT_TAG | THUMB_TAG | TEXT_TAG) == 0
-                && self.frame_visible.contains(&r.page)
-                && !self.errors.contains_key(&r.page)
-        });
-        if visible_mains_pending {
-            // Caches are kept; demand is re-evaluated next frame once pixels arrive.
-            return queue;
-        }
-        let thumbs = self.thumbnail_requests(info, ppp);
-        let mut thumb_bytes = 0usize;
-        let mut admitted = HashSet::new();
-        for req in thumbs {
-            let Some(p) = info.pages.get(req.page) else { continue };
-            let bytes = rgba_bytes(device_pixels(p.width, req.scale) as usize, device_pixels(p.height, req.scale) as usize);
-            if thumb_bytes.saturating_add(bytes) > THUMB_BYTES || self.errors.contains_key(&req.page) {
-                continue;
-            }
-            thumb_bytes += bytes;
-            admitted.insert(req.page);
-            if self.thumbs.get(&req.page).is_none_or(|t| t.tag != req.tag) || self.stale_thumbs.contains(&req.page) {
-                queue.push(req);
-            }
-        }
-        self.thumbs.retain(|p, _| admitted.contains(p));
-        self.stale_thumbs.retain(|p| admitted.contains(p));
-        self.retain_text_layers();
-        // Visible main pages and thumbnails take precedence over background search work.
-        queue.extend(requests.into_iter().filter(|r| r.kind == RequestKind::Text));
-        queue
-    }
-
-    /// Drop text layers nothing can still need. Every visited page's text used to stay
-    /// cached for the session. Keep visible, selected and matched pages plus the nearest
-    /// prefetch window; evicted pages re-extract on revisit. (Count window only: unlike
-    /// rasters there is no byte budget here.) While a search is active keep everything:
-    /// demand still wants every page, so evicting would re-request evicted pages each
-    /// frame and churn the workers. Failures are never evicted either: they cost nothing
-    /// to remember, and evicting one would re-request and re-fail it every frame.
-    fn retain_text_layers(&mut self) {
-        if self.texts.len() <= MAX_CACHED_TEXT_PAGES {
-            return;
-        }
-        if self.find.as_ref().is_some_and(|f| !f.case_query.trim().is_empty()) {
-            return;
-        }
-        let mut keep: HashSet<usize> = self.frame_visible.clone();
-        if let Some(s) = self.selection {
-            keep.insert(s.page);
-        }
-        if let Some(f) = self.find.as_ref() {
-            keep.extend(f.matches.iter().map(|(p, _)| *p));
-        }
-        let mut rest: Vec<usize> = self.texts.keys().filter(|p| !keep.contains(*p)).copied().collect();
-        rest.sort_by_key(|p| p.abs_diff(self.current));
-        keep.extend(rest.into_iter().take(MAX_CACHED_TEXT_PAGES));
-        self.texts.retain(|p, _| keep.contains(p));
-    }
-
-    pub(crate) fn finish_render_frame(&mut self, ctx: &egui::Context, info: &DocInfo, pool: &RenderPool) {
-        if self.frame_geometry_changed {
-            // Dialogs and edits can replace pages after the canvas collected demand. Its
-            // scales and indexes belong to the old pages, not to the new renderer (#3149).
-            self.begin_render_frame();
-            self.last_queue.clear();
-            pool.set_queue(Vec::new());
-            ctx.request_repaint();
-            return;
-        }
-        let queue = self.prepare_render_queue(info, ctx.pixels_per_point());
-        if queue != self.last_queue {
-            pool.set_queue(queue.clone());
-            self.last_queue = queue;
-        }
-        if !self.hold_rasters {
-            self.receive(ctx, pool);
-        }
-        if !self.last_queue.is_empty() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(30));
-        }
-    }
-
-    /// Pull a bounded batch of current results into textures. Demand is committed first, so
-    /// offscreen results and obsolete scale/configuration tags never allocate a ColorImage.
-    pub fn receive(&mut self, ctx: &egui::Context, pool: &RenderPool) {
-        let budget = if pool.is_inline() { 1 } else { RESULTS_PER_FRAME };
-        let mut uploaded = 0usize;
-        #[cfg(not(target_arch = "wasm32"))]
-        let started = std::time::Instant::now();
-        for _ in 0..budget {
-            let Some(r) = pool.try_recv() else { break };
-            uploaded = uploaded.saturating_add(self.receive_result(ctx, r));
-            // One whole-page upload may exceed the frame allowance; it must still progress.
-            if uploaded >= UPLOAD_BYTES_PER_FRAME {
-                break;
-            }
-            #[cfg(not(target_arch = "wasm32"))]
-            if started.elapsed() >= std::time::Duration::from_millis(4) {
-                break;
-            }
-        }
-    }
-
-    fn receive_result(&mut self, ctx: &egui::Context, r: pdfcraft_render::RenderedPage) -> usize {
-        if !self.last_queue.contains(&r.request) {
-            return 0;
-        }
-        ctx.request_repaint();
-        if r.request.kind == RequestKind::Text {
-            match r.text {
-                Some(t) => {
-                    self.texts.insert(r.request.page, t);
-                    self.refresh_find_page(r.request.page);
-                }
-                None => {
-                    log::warn!("page {} text: {}", r.request.page + 1, r.error.unwrap_or_default());
-                    self.text_failed.insert(r.request.page);
-                    if let Some(f) = self.find.as_mut() {
-                        let current_key = f.current.and_then(|c| f.matches.get(c).cloned());
-                        f.matches.retain(|(p, _)| *p != r.request.page);
-                        f.current = current_key.and_then(|k| f.matches.iter().position(|m| *m == k));
-                        if f.current.is_none() && !f.matches.is_empty() {
-                            let cur = self.current;
-                            f.current = Some(f.matches.iter().position(|(p, _)| *p >= cur).unwrap_or(0));
-                        }
-                    }
-                }
-            }
-            return 0;
-        }
-        if let Some(e) = r.error {
-            log::warn!("page {}: {e}", r.request.page + 1);
-            self.errors.insert(r.request.page, e);
-            return 0;
-        }
-        // Even current demand may have been sized with obsolete geometry or a different
-        // device limit. Check before cache eviction, conversion and every upload path.
-        let max_side = ctx.input(|i| i.max_texture_side);
-        if r.width == 0 || r.height == 0 || r.width as usize > max_side || r.height as usize > max_side {
-            return 0;
-        }
-        // Remember heavy pages: only these get the zoom/pan settle holds, so fast pages
-        // never pay added latency. Stale entries die with the tiles on edits.
-        if r.millis >= SLOW_MILLIS {
-            self.slow_pages.insert(r.request.page);
-        }
-        let page = r.request.page;
-        let bytes = rgba_bytes(r.width as usize, r.height as usize);
-        if bytes != r.rgba.len() || !self.admit_texture(r.request, bytes) {
-            return 0;
-        }
-        // The length was checked above, so the renderer's buffer becomes the texture data as is.
-        let img = texture_image([r.width as usize, r.height as usize], r.rgba);
-        if let Some(t) = r.request.tile {
-            let key = (page, r.request.tag, t.x, t.y);
-            let tex = ctx.load_texture(format!("tile-{:?}-{page}-{}-{}", self.id, t.x, t.y), img, TextureOptions::LINEAR);
-            self.tiles.insert(key, tex);
-            self.stale_tiles.remove(&key);
-            if !self.stale_tiles.iter().any(|k| k.0 == page) {
-                self.forms.unbaked.retain(|(_, p)| *p != page);
-                self.comments.page_rendered(page);
-            }
-            if !self.page_out_of_date(page) {
-                self.text_background.page_received(page);
-            }
-        } else if r.request.tag & PRINT_TAG != 0 {
-            let tex = ctx.load_texture(
-                format!("print-{:?}-{page}", self.id),
-                if r.request.tag & GRAYSCALE_TAG != 0 { grayscale(img) } else { img },
-                TextureOptions::LINEAR,
-            );
-            self.print_pages.insert(page, (r.request.tag, tex));
-        } else if r.request.tag & GRID_TAG != 0 {
-            let tex = ctx.load_texture(format!("grid-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
-            self.grid_pages.insert(page, (r.width, tex));
-        } else if r.request.tag & THUMB_TAG != 0 {
-            let tex = ctx.load_texture(format!("thumb-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
-            self.thumbs.insert(page, PageTex { tag: r.request.tag, tex });
-            self.stale_thumbs.remove(&page);
-        } else {
-            let tex = ctx.load_texture(format!("page-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
-            self.pages.insert(page, PageTex { tag: r.request.tag, tex });
-            self.signature_drag.page_received(page);
-            self.move_background.page_received(page);
-            if !self.page_out_of_date(page) {
-                self.text_background.page_received(page);
-            }
-            self.comments.page_rendered(page);
-            self.waiting_since.remove(&page);
-            if !self.stale_tiles.iter().any(|k| k.0 == page) {
-                self.forms.unbaked.retain(|(_, p)| *p != page);
-            }
-        }
-        bytes
-    }
-
-    /// Check real dimensions before conversion, including stale textures kept during edits.
-    /// Dropping an old handle releases its backend allocation after the current frame.
-    fn admit_texture(&mut self, req: RenderRequest, bytes: usize) -> bool {
-        // An on-screen page or tile is always taken (the viewport bounds it): it may evict
-        // off-screen rasters but never another on-screen one, and is never refused.
-        let visible = req.tag & THUMB_TAG == 0 && self.frame_visible.contains(&req.page);
-        // Organize-grid renders are bounded by the cells in view (organize_grid). Print
-        // previews are the sheets around the one on screen.
-        if req.tag & (GRID_TAG | PRINT_TAG) != 0 {
-            return true;
-        }
-        if let Some(t) = req.tile {
-            let key = (req.page, req.tag, t.x, t.y);
-            self.tiles.remove(&key);
-            let retained = self.tiles.values().fold(0usize, |n, tex| n.saturating_add(texture_bytes(tex)));
-            visible || bytes <= TILE_BYTES.saturating_sub(retained)
-        } else {
-            let thumb = req.tag & THUMB_TAG != 0;
-            let (cache, limit) = if thumb { (&mut self.thumbs, THUMB_BYTES) } else { (&mut self.pages, PAGE_BYTES) };
-            cache.remove(&req.page);
-            let mut retained = cache.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex)));
-            // A zoom/DPI change can temporarily retain larger stale images than the new
-            // demand estimates. Evict those first, then let the current demand refill them.
-            let on_screen = |p: &usize| !thumb && self.frame_visible.contains(p);
-            while retained.saturating_add(bytes) > limit {
-                let Some(page) = cache.keys().copied().filter(|p| !on_screen(p)).max_by_key(|p| p.abs_diff(self.current)) else { break };
-                if let Some(old) = cache.remove(&page) {
-                    retained = retained.saturating_sub(texture_bytes(&old.tex));
-                }
-            }
-            visible || bytes <= limit.saturating_sub(retained)
-        }
-    }
-
-    /// The first page of the two-page spread page `c` is in: spreads are [0, 1], [2, 3], … or,
-    /// with a cover page, [0], [1, 2], [3, 4], ….
-    fn spread_first(&self, c: usize) -> usize {
-        if self.cover { c.saturating_sub((c + 1) % 2) } else { c - c % 2 }
-    }
-
-    fn fit_zoom(&mut self, info: &DocInfo) {
-        let largest = |side: fn((f32, f32)) -> f32| info.pages.iter().map(|p| side(self.display_size(p))).fold(1.0, f32::max);
-        let max_w = largest(|s| s.0);
-        // A single page shown on its own fits that page, and full screen in two-page view fits
-        // the spread it shows (review on #2070). Every other display (scrolling, or two-page
-        // view in the window) fits its largest page, so the zoom holds still while pages of
-        // other sizes scroll or page past.
-        let (w, h) = if self.layout == PageLayout::Single && !self.continuous {
-            info.pages.get(self.current).map_or_else(|| (max_w, largest(|s| s.1)), |p| self.display_size(p))
-        } else if self.presentation.is_some() && self.layout == PageLayout::TwoUp && !self.continuous {
-            let first = self.spread_first(self.current);
-            let last = if self.cover && first == 0 { 0 } else { first.saturating_add(1) };
-            let spread: Vec<(f32, f32)> = info.pages.iter().skip(first).take(last - first + 1).map(|p| self.display_size(p)).collect();
-            if spread.is_empty() {
-                (max_w, largest(|s| s.1))
-            } else {
-                (spread.iter().map(|s| s.0).fold(1.0, f32::max), spread.iter().map(|s| s.1).fold(1.0, f32::max))
-            }
-        } else {
-            (max_w, largest(|s| s.1))
-        };
-        let avail_w = (self.viewport_w - 2.0 * SIDE).max(100.0);
-        let per_row = if self.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
-        match self.fit {
-            Fit::Width => self.zoom = (avail_w - self.page_gap() * (per_row - 1.0)) / (w * PT * per_row),
-            Fit::Page => {
-                let zw = (avail_w - self.page_gap() * (per_row - 1.0)) / (w * PT * per_row);
-                let zh = (self.viewport_h - 2.0 * MARGIN) / (h * PT);
-                self.zoom = zw.min(zh);
-            }
-            Fit::Height => self.zoom = (self.viewport_h - 2.0 * MARGIN) / (h * PT),
-            Fit::None => {}
-        }
-        self.zoom = self.zoom.clamp(0.08, 64.0);
-    }
-
-    /// Width of the scroll content. Single-page view sizes it to the page it shows, so a
-    /// wider page elsewhere in the document can't push the shown one off-centre.
-    fn content_width(&self, info: &DocInfo, avail_w: f32) -> f32 {
-        let single = (self.layout == PageLayout::Single && !self.continuous).then(|| self.current.min(info.pages.len().saturating_sub(1)));
-        let shown = info.pages.iter().enumerate().filter(|&(i, _)| single.is_none_or(|c| c == i));
-        let max_w = shown.map(|(_, p)| self.display_size(p).0).fold(0.0, f32::max);
-        let per_row = if self.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
-        (max_w * self.zoom * PT * per_row + 2.0 * SIDE).max(avail_w)
-    }
-
-    /// Page rects in content coordinates (origin at the scroll content's top-left).
-    fn layout(&self, info: &DocInfo, content_w: f32, ppp: f32) -> Vec<Rect> {
-        let s = self.zoom * PT;
-        let gap = self.page_gap();
-        let page_size = |p: &pdfcraft_render::PageInfo| {
-            let (w, h) = self.display_size(p);
-            if self.show_page_gaps {
-                vec2(w * s, h * s)
-            } else {
-                // Match the raster's whole physical pixels. Snapping each page's origin
-                // independently with fractional sizes would leave hairline seams.
-                vec2(device_pixels(w, s * ppp) as f32 / ppp, device_pixels(h, s * ppp) as f32 / ppp)
-            }
-        };
-        let mut rects = Vec::with_capacity(info.pages.len());
-        let mut y = MARGIN;
-        match self.layout {
-            PageLayout::Single => {
-                for p in &info.pages {
-                    let size = page_size(p);
-                    rects.push(Rect::from_min_size(pos2(((content_w - size.x) / 2.0).max(SIDE), y), size));
-                    y += size.y + gap;
-                }
-            }
-            PageLayout::TwoUp => {
-                // With a cover page, the first page sits alone on the right.
-                let rows: Vec<&[pdfcraft_render::PageInfo]> = if self.cover && !info.pages.is_empty() {
-                    std::iter::once(&info.pages[..1]).chain(info.pages[1..].chunks(2)).collect()
-                } else {
-                    info.pages.chunks(2).collect()
-                };
-                for (ri, pair) in rows.into_iter().enumerate() {
-                    let sizes: Vec<Vec2> = pair.iter().map(page_size).collect();
-                    let row_w: f32 = sizes.iter().map(|v| v.x).sum::<f32>() + gap * (sizes.len() as f32 - 1.0);
-                    let row_h = sizes.iter().map(|v| v.y).fold(0.0, f32::max);
-                    let mut x = if self.cover && ri == 0 { (content_w / 2.0 + gap / 2.0).max(SIDE) } else { ((content_w - row_w) / 2.0).max(SIDE) };
-                    for size in sizes {
-                        rects.push(Rect::from_min_size(pos2(x, y + (row_h - size.y) / 2.0), size));
-                        x += size.x + gap;
-                    }
-                    y += row_h + gap;
-                }
-            }
-        }
-        rects
-    }
-
-    fn render_scale(&self, ppp: f32) -> f32 {
-        // Exactly the device scale: a raster at any other scale is resampled on screen, which
-        // blurs every line and glyph (#260).
-        self.zoom * PT * ppp
-    }
-
-    /// Set whether the print preview rasters become luminance before upload. Toggling it drops
-    /// the colour previews: new requests carry the grayscale tag, so stale ones are replaced.
-    pub(crate) fn set_print_grayscale(&mut self, grayscale: bool) {
-        if self.grayscale != grayscale {
-            self.grayscale = grayscale;
-            self.print_pages.clear();
-        }
-    }
-
-    /// Queue sharp rasters for the print preview. Pages that leave the nearby sheets are dropped.
-    /// Previews render with reading colours off (the request's tag tells the renderer): they must
-    /// match the printout, which is imposed from the uncoloured document.
-    pub(crate) fn queue_print_previews(&mut self, pages: &[(usize, f32)]) {
-        self.print_pages.retain(|page, _| pages.iter().any(|(p, _)| p == page));
-        for &(page, scale) in pages {
-            if self.errors.contains_key(&page) || !scale.is_finite() || scale <= 0.0 {
-                continue;
-            }
-            let tag = scale_tag(scale) | PRINT_TAG | if self.grayscale { GRAYSCALE_TAG } else { 0 };
-            let fresh = self.print_pages.get(&page).is_some_and(|(have, _)| *have == tag);
-            if !fresh {
-                self.frame_queue.push(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale, tag, preview: false });
-            }
-        }
-    }
-}
-
-/// The hover popup for an annotation. Replies and Fill & Sign marks (typed text, checks, signatures)
-/// show none: they are page content being edited, not comments.
-fn annotation_hover_text(a: &pdfcraft_render::Annotation) -> Option<String> {
-    if a.in_reply_to.is_some() || a.fill_sign {
-        return None;
-    }
-    let who = a.author.clone().unwrap_or_else(|| a.subtype.clone());
-    let body = a.contents.clone().unwrap_or_default();
-    Some(if body.is_empty() { who } else { format!("{who}\n{body}") })
-}
-
-/// The scroll offset that puts `point` (content coordinates) at `rel` in the viewport, kept within
-/// the content as egui keeps it. egui clamps only after drawing, so an offset past the end showed
-/// the page misplaced for a frame and then jumped (zooming out beside a page that fits).
-fn anchored_scroll(point: Pos2, rel: Vec2, content: Vec2, viewport: Vec2) -> Vec2 {
-    let max = vec2((content.x - viewport.x).max(0.0), (content.y - viewport.y).max(0.0));
-    vec2((point.x - rel.x).clamp(0.0, max.x), (point.y - rel.y).clamp(0.0, max.y))
-}
-
-/// The request tag for a raster at `scale`: equal tags mean the same scale (to 1/65536).
-fn scale_tag(scale: f32) -> u64 {
-    (f64::from(scale) * 65536.0).round() as u64
-}
-
-/// The scale of a raster tagged by [`scale_tag`].
-fn tag_scale(tag: u64) -> f32 {
-    (tag as f64 / 65536.0) as f32
-}
-
-/// Device-pixel side of a page tile at `scale` for a page `page_max_px` device pixels on
-/// its long side. Each tile costs a full page interpret, so tiles grow with the zoom and
-/// with the page: a zoomed viewport, or a giant sheet shown whole, is covered by a few
-/// large tiles instead of dozens of small ones. Bounded by the render backend (tile sides
-/// above 4096 are clamped there) and kept granular at ordinary zooms.
-fn tile_side(scale: f32, page_max_px: u32) -> u32 {
-    if !scale.is_finite() || scale <= 0.0 {
-        return TILE;
-    }
-    let by_zoom = (TILE as f32 * (scale / 6.0)).clamp(TILE as f32, 4096.0) as u32;
-    // At most four tiles along the long side, so a giant sheet needs a handful of
-    // interprets instead of dozens.
-    by_zoom.max(page_max_px.div_ceil(4).min(4096))
-}
-
-/// Tiles of earlier zooms kept for a page while its current tiles are rendered.
-const OLD_TILES: usize = 64;
-
-/// A page whose raster took at least this long is heavy: zoom/pan holds apply to it,
-/// so gestures stay on stretched surfaces instead of queueing full-page interprets.
-const SLOW_MILLIS: u32 = 500;
-
-/// `r` moved so its corner lies on a whole physical pixel, so that a raster drawn from there
-/// maps texel for texel onto the screen.
-fn snap_to_pixels(r: Rect, ppp: f32) -> Rect {
-    let snap = |v: f32| (v * ppp).round() / ppp;
-    Rect::from_min_size(pos2(snap(r.min.x), snap(r.min.y)), r.size())
-}
-
-/// Maps between a page's coordinate spaces and the screen, including view rotation.
-///
-/// *View space* is the page as rendered (points, y down, the document's own `/Rotate` applied);
-/// normalised page coordinates `(u, v)` are view space divided by the page size. The view
-/// rotation (View ▸ Rotate View) turns the page clockwise on screen by `rot` degrees.
-#[derive(Clone, Copy)]
-pub struct PageXform {
-    /// The page's rectangle on screen (already rotated, so width/height may be swapped).
-    pub rect: Rect,
-    pub rot: u16,
-    /// Page size in view space (unrotated by the view).
-    pub pw: f32,
-    pub ph: f32,
-}
-
-impl PageXform {
-    /// Screen pixels per page point. The view's rotation swaps the rectangle's sides, so a page
-    /// turned a quarter shows its width down the screen.
-    pub(crate) fn zoom(&self) -> f32 {
-        let across = if self.rot % 180 == 90 { self.rect.height() } else { self.rect.width() };
-        across / self.pw.max(1.0)
-    }
-
-    /// Draw an image in the PDF user-space `rect` as a custom stamp's appearance draws it: turned
-    /// back by `turn` (the page /Rotate it was placed for), so with the page's own rotation it
-    /// reads upright as displayed.
-    pub(crate) fn paint_user_image(
-        &self,
-        painter: &egui::Painter,
-        tex: egui::TextureId,
-        p: &pdfcraft_render::PageInfo,
-        rect: [f64; 4],
-        turn: i64,
-        color: Color32,
-    ) {
-        let mut mesh = egui::Mesh::with_texture(tex);
-        let (w, h) = (rect[2] - rect[0], rect[3] - rect[1]);
-        let (shown_w, shown_h) = if turn % 180 == 0 { (w, h) } else { (h, w) };
-        let [a, b, c, d, e, f] = pdfcraft_model::view_matrix_for(turn, rect);
-        for (u, v) in [(0.0_f32, 0.0_f32), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
-            // The texture's (u, v), from its top-left, in the picture's upright frame, then in user space.
-            let (dx, dy) = (f64::from(u) * shown_w, f64::from(1.0 - v) * shown_h);
-            let (x, y) = (a * dx + c * dy + e, b * dx + d * dy + f);
-            let q = p.user_to_view(x as f32, y as f32);
-            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(q[0] / self.pw, q[1] / self.ph), uv: pos2(u, v), color });
-        }
-        mesh.add_triangle(0, 1, 2);
-        mesh.add_triangle(0, 2, 3);
-        painter.add(egui::Shape::mesh(mesh));
-    }
-    pub fn norm_to_screen(&self, u: f32, v: f32) -> Pos2 {
-        let (a, b) = match self.rot {
-            90 => (1.0 - v, u),
-            180 => (1.0 - u, 1.0 - v),
-            270 => (v, 1.0 - u),
-            _ => (u, v),
-        };
-        pos2(self.rect.left() + a * self.rect.width(), self.rect.top() + b * self.rect.height())
-    }
-
-    pub fn screen_to_norm(&self, p: Pos2) -> (f32, f32) {
-        let (a, b) = ((p.x - self.rect.left()) / self.rect.width().max(1e-3), (p.y - self.rect.top()) / self.rect.height().max(1e-3));
-        match self.rot {
-            90 => (b, 1.0 - a),
-            180 => (1.0 - a, 1.0 - b),
-            270 => (1.0 - b, a),
-            _ => (a, b),
-        }
-    }
-
-    /// Screen point → view space (points).
-    pub fn screen_to_view(&self, p: Pos2) -> (f32, f32) {
-        let (u, v) = self.screen_to_norm(p);
-        (u * self.pw, v * self.ph)
-    }
-
-    /// A view-space rect [x0, y0, x1, y1] → screen rect.
-    pub fn view_rect(&self, g: [f32; 4]) -> Rect {
-        Rect::from_two_pos(self.norm_to_screen(g[0] / self.pw, g[1] / self.ph), self.norm_to_screen(g[2] / self.pw, g[3] / self.ph))
-    }
-
-    /// A PDF user-space rect (crop box, document `/Rotate`) → screen rect.
-    pub fn user_rect(&self, info: &DocInfo, page: usize, r: [f32; 4]) -> Rect {
-        let p = &info.pages[page];
-        let [cx0, cy0, cx1, cy1] = p.crop;
-        let (cw, ch) = ((cx1 - cx0).max(1.0), (cy1 - cy0).max(1.0));
-        let norm = |x: f32, y: f32| -> (f32, f32) {
-            let (u, v) = ((x - cx0) / cw, (cy1 - y) / ch);
-            match p.rotation {
-                90 => (1.0 - v, u),
-                180 => (1.0 - u, 1.0 - v),
-                270 => (v, 1.0 - u),
-                _ => (u, v),
-            }
-        };
-        let (a, b) = (norm(r[0], r[1]), norm(r[2], r[3]));
-        Rect::from_two_pos(self.norm_to_screen(a.0, a.1), self.norm_to_screen(b.0, b.1))
-    }
-
-    /// This transform resized to a raster of `px` device pixels (width, height before the view
-    /// rotation), so each of its texels covers one screen pixel. The rectangle's corner must
-    /// already be on a whole pixel ([`snap_to_pixels`]).
-    fn texel_aligned(&self, px: [usize; 2], ppp: f32) -> PageXform {
-        let (w, h) = (px[0] as f32 / ppp, px[1] as f32 / ppp);
-        let size = if self.rot % 180 == 90 { vec2(h, w) } else { vec2(w, h) };
-        PageXform { rect: Rect::from_min_size(self.rect.min, size), ..*self }
-    }
-
-    /// Draw a texture covering the normalised page region, rotated with the view.
-    pub fn paint_image(&self, painter: &egui::Painter, tex: egui::TextureId, u0: f32, v0: f32, u1: f32, v1: f32) {
-        let mut mesh = egui::Mesh::with_texture(tex);
-        let corners = [(u0, v0, 0.0, 0.0), (u1, v0, 1.0, 0.0), (u1, v1, 1.0, 1.0), (u0, v1, 0.0, 1.0)];
-        for (u, v, tu, tv) in corners {
-            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(u, v), uv: pos2(tu, tv), color: Color32::WHITE });
-        }
-        mesh.add_triangle(0, 1, 2);
-        mesh.add_triangle(0, 2, 3);
-        painter.add(egui::Shape::mesh(mesh));
-    }
-}
-
-pub fn shortcuts(view: &mut DocView, ctx: &egui::Context, speed: crate::scroll_speed::ScrollSpeed) {
-    use egui::{Key, KeyboardShortcut, Modifiers};
-    if ctx.input_mut(|i| i.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::F))) {
-        view.open_find();
-    }
-    let cmd = |k| KeyboardShortcut::new(Modifiers::COMMAND, k);
-    let pressed = |s: KeyboardShortcut| ctx.input_mut(|i| i.consume_shortcut(&s));
-    // ⌘G / ⇧⌘G step through the matches from the find field too, as in Acrobat and Preview
-    // (#2669): ahead of the text-input check, but only while there is a search to step.
-    if view.find.is_some() {
-        if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::G)) {
-            view.find_step(false);
-        } else if pressed(cmd(Key::G)) {
-            view.find_step(true);
-        }
-    }
-    // A focused check box or radio button holds egui's keyboard focus only for Space, and a
-    // radio button for the arrows that move within its group: the other page keys still work.
-    let form_box = view.forms.keys.filter(|(id, _)| ctx.memory(|m| m.focused()) == Some(*id));
-    if ctx.egui_wants_keyboard_input() && form_box.is_none() {
-        return;
-    }
-    let arrows = !form_box.is_some_and(|(_, radio)| radio);
-    // Rotation first: egui matches ⌘+ loosely with respect to Shift.
-    if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::Plus))
-        || pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::Equals))
-    {
-        view.rotate_view(true);
-    }
-    if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::Minus)) {
-        view.rotate_view(false);
-    }
-    // In the page grid ⌘+ / ⌘− / ⌘0 size its pages instead (looking is always allowed).
-    let (zoom_in, zoom_out, zoom_reset) = (pressed(cmd(Key::Plus)) || pressed(cmd(Key::Equals)), pressed(cmd(Key::Minus)), pressed(cmd(Key::Num0)));
-    if view.organize {
-        if zoom_in {
-            view.grid_zoom_request = Some(view.grid_zoom * GRID_ZOOM_STEP);
-        }
-        if zoom_out {
-            view.grid_zoom_request = Some(view.grid_zoom / GRID_ZOOM_STEP);
-        }
-        if zoom_reset {
-            view.grid_zoom_request = Some(1.0);
-        }
-    } else {
-        if zoom_in {
-            view.zoom_step(true);
-        }
-        if zoom_out {
-            view.zoom_step(false);
-        }
-        if zoom_reset {
-            view.fit = Fit::Page;
-            view.goto = Some((view.current, 0.0));
-        }
-    }
-    if pressed(cmd(Key::Num1)) {
-        view.set_zoom(1.0);
-    }
-    if pressed(cmd(Key::Num2)) {
-        view.fit = Fit::Width;
-        view.goto = Some((view.current, 0.0));
-    }
-    if pressed(cmd(Key::OpenBracket)) {
-        view.view_history(false);
-    }
-    if pressed(cmd(Key::CloseBracket)) {
-        view.view_history(true);
-    }
-    let key = |k| (arrows || !matches!(k, Key::ArrowLeft | Key::ArrowRight | Key::ArrowUp | Key::ArrowDown)) && ctx.input(|i| i.key_pressed(k));
-    // An open menu takes Escape first and closes; the selection stays for the next one (#3535).
-    if key(Key::Escape) && !egui::Popup::is_any_open(ctx) {
-        if view.camera.is_some() || view.camera_done.is_some() {
-            view.pending_action = Some(ViewAction::CancelCamera);
-        } else if view.selection.is_some() || view.all_text {
-            view.selection = None;
-            view.all_text = false;
-        } else {
-            view.find = None;
-        }
-    }
-    if key(Key::Home) {
-        view.go_to_page(0);
-    }
-    if key(Key::End) {
-        view.go_to_page(usize::MAX);
-    }
-    // Full screen: Space and Enter go forward a page and Backspace back, as in Acrobat (the
-    // arrows and Page Up / Page Down already turn pages where nothing scrolls, below).
-    if view.presentation.is_some() {
-        if key(Key::Space) || key(Key::Enter) {
-            view.step_page(true);
-        }
-        if key(Key::Backspace) {
-            view.step_page(false);
-        }
-    }
-    // As in Acrobat: → / ← go to the next / previous page in every layout (#185), and so do
-    // ⌘Page Down / ⌘Page Up, or plain Page Down / Page Up in single-page view.
-    let command = ctx.input(|i| i.modifiers.command);
-    let scrolls = view.continuous;
-    if key(Key::ArrowRight) || (key(Key::PageDown) && (command || !scrolls)) {
-        view.step_page(true);
-    }
-    if key(Key::ArrowLeft) || (key(Key::PageUp) && (command || !scrolls)) {
-        view.step_page(false);
-    }
-    // ↓ / ↑ scroll a line, and Page Down / Page Up a screen where the pages scroll. In
-    // single-page view, ↓ / ↑ turn the page once there is nothing left to scroll that way, as
-    // the wheel does (#273): always on a page that fits.
-    // The Scroll speed preference sets how far ↓ / ↑ go as well as the wheel (#985); Page Down /
-    // Page Up keep a screen.
-    if !command {
-        let line = KEY_SCROLL_LINE * speed.factor();
-        let screen = (view.viewport_h - KEY_SCROLL_LINE).max(KEY_SCROLL_LINE);
-        let steps = [(Key::ArrowDown, line), (Key::ArrowUp, -line), (Key::PageDown, screen), (Key::PageUp, -screen)];
-        for (k, by) in steps {
-            let arrow = matches!(k, Key::ArrowDown | Key::ArrowUp);
-            if !key(k) || !(scrolls || arrow) {
-                continue;
-            }
-            let forward = k == Key::ArrowDown;
-            // Only an up-to-date view counts: the page drawn is the current one, with no jump pending.
-            let at_end = !scrolls
-                && view.goto.is_none()
-                && view.single_edges.is_some_and(|(page, top, bottom)| page == view.current && if forward { bottom } else { top });
-            if at_end {
-                let before = view.current;
-                view.step_page(forward);
-                if !forward && view.current != before {
-                    // Going back up lands on the bottom of the previous page.
-                    view.goto = Some((view.current, 1.0));
-                }
-                view.single_edges = None;
-            } else {
-                view.key_scroll += by;
-            }
-        }
-    }
-}
-
-/// How far ↓ / ↑ scroll at Normal speed (Scroll speed halves or doubles it). Page Down / Page Up
-/// keep this much of the previous screen in view.
-const KEY_SCROLL_LINE: f32 = 40.0;
-/// Suppression window for egui's eased copy of point input.
-///
-/// egui 0.36.2 drains `WheelState::after_events` tail deltas by 90% per 0.1 s.
-const SUPPRESS_SECS: f64 = 0.25;
-/// Short rolling extension while egui still has an unprocessed wheel tail.
-const SUPPRESS_TAIL_SECS: f64 = 0.05;
-
-// The viewer moves between docking and the central panel as modes change; keep its scroll
-// identity tied to the document instead of either parent UI.
-fn page_scroll<R>(
-    ui: &mut egui::Ui,
-    scroll: egui::ScrollArea,
-    id: egui::Id,
-    draw: impl FnOnce(&mut egui::Ui, egui::Rect) -> R,
-) -> egui::scroll_area::ScrollAreaOutput<R> {
-    ui.scope_builder(egui::UiBuilder::new().id(id), |ui| scroll.show_viewport(ui, draw)).inner
 }
 
 /// Draws the document tab at `index`: its notice bars, then its pages (or the Organize grid) in a
@@ -2717,6 +814,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     // Keyboard scrolling applies to this frame's page view only, never later.
     let key_scroll = std::mem::take(&mut app.views[index].key_scroll);
+    if key_scroll != 0.0 {
+        app.views[index].end_find_following();
+    }
     // The Search panel closed: its search moves to the find bar.
     let search_open = app.right == Some(crate::RightPanel::Search);
     if let Some(f) = app.views[index].find.as_mut()
@@ -2791,7 +891,8 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         None => {}
     }
     // No dialog, close prompt or palette over the page: only then does page input count.
-    let unobstructed = !app.modal_open() && !app.palette_open;
+    let modal = app.modal_open();
+    let unobstructed = !modal && !app.palette_open;
     let organize_zoom = app.organize_zoom;
     let view = &mut app.views[index];
     if view.organize {
@@ -2835,11 +936,8 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     // Full screen: a click on the document goes forward a page and a shift-click back, as in
     // Acrobat, unless the click did something else (a link, a word selected). Decided below,
     // once the pages have had the click.
-    let present_click = view.presentation.is_some()
-        && navigation_enabled
-        && ui.rect_contains_pointer(navigation_rect)
-        && ui.input(|i| i.pointer.primary_clicked())
-        && app.quick_tool == QuickTool::Select;
+    let present_click =
+        view.presentation.is_some() && navigation_enabled && presentation_click(ui, navigation_rect) && app.quick_tool == QuickTool::Select;
     // Shift as held now, or as the click's own event carried it (a synthetic click).
     let present_back = present_click
         && ui.input(|i| {
@@ -2850,7 +948,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         });
     if zoom_delta.is_finite() && zoom_delta > 0.0 && zoom_delta != 1.0 && navigation_enabled && ui.rect_contains_pointer(navigation_rect) {
         let z = view.zoom * zoom_delta;
-        match ui.input(|i| i.pointer.hover_pos()) {
+        match zoom_anchor(ui) {
             Some(p) => view.zoom_at(z, p),
             None => view.set_zoom(z),
         }
@@ -2866,7 +964,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     // Drawing a comment: the pointer in a band along any edge (or just past it) scrolls the view
     // that way, so a point beyond what is shown can be reached without letting go of the tool.
     let edge_delta = if unobstructed && matches!(view.comments.gesture, Some(comments::Gesture::Draw { .. })) {
-        let (pointer, dt) = ui.input(|i| (if i.pointer.any_down() { i.pointer.latest_pos() } else { i.pointer.hover_pos() }, i.stable_dt));
+        let (pointer, dt) = drawing_edge_pointer(ui);
         crate::autoscroll::edge_scroll(pointer, avail, dt)
     } else {
         Vec2::ZERO
@@ -2915,7 +1013,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         // even while the page can't turn.
         ui.input(|i| {
             for e in &i.events {
-                if let egui::Event::MouseWheel { unit, delta, phase, modifiers } = e {
+                if let egui::Event::MouseWheel { unit, delta, phase, modifiers, .. } = e {
                     // Zooming (⌘ or Ctrl) and sideways scrolling (Shift) never turn pages.
                     let dy = if modifiers.command || modifiers.ctrl || modifiers.shift { 0.0 } else { delta.y };
                     if fits {
@@ -2966,8 +1064,14 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         line_base.y = 0.0;
         boost_extra.y = 0.0;
     }
-    if now < view.precise_scroll_until {
-        if ui.input(|i| i.is_scrolling()) {
+    // egui smooths a Point event that moved at least 8 points, keeping part of it for later
+    // passes. Suppression must outlive that whole action: once it expired after a fixed 0.25 s,
+    // the last few eased points leaked through the ScrollArea after a precise 1:1 scroll (held
+    // point input measured 33 points for a 30-point event). Keep hiding the eased copy until
+    // egui says the action is over, then forget the suppression.
+    let scrolling = ui.input(|i| i.is_scrolling());
+    if now < view.precise_scroll_until || (view.precise_scroll_until != 0.0 && scrolling) {
+        if scrolling {
             // Keep hiding egui's unprocessed copy until it has drained. The short rolling grace
             // avoids a delayed duplicate without prolonging suppression after the tail is gone.
             view.precise_scroll_until = view.precise_scroll_until.max(now + SUPPRESS_TAIL_SECS);
@@ -2989,10 +1093,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         }
     } else {
         precise_scroll = Vec2::ZERO;
-        if line_base != Vec2::ZERO || has_page {
-            // Selection handling below uses zero to distinguish an inactive window.
-            view.precise_scroll_until = 0.0;
-        }
+        // Selection handling below uses zero to distinguish an inactive window. Clearing a past
+        // deadline also keeps a later line/page action from being mistaken for the old tail.
+        view.precise_scroll_until = 0.0;
     }
     if has_page && paging_owns_vertical {
         // Page input belongs to egui on the free axis; the pager still owns vertical motion.
@@ -3006,7 +1109,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let may_glide = !paging_owns_vertical && !middle_gesture && navigation_enabled && unobstructed && animates;
     let over_page = ui.rect_contains_pointer(avail);
     ui.input(|i| view.fling.read(&i.events, now, may_glide && over_page));
-    let interrupted = ui.input(|i| i.pointer.any_pressed() || i.events.iter().any(|e| matches!(e, egui::Event::Key { pressed: true, .. })));
+    let interrupted = glide_interrupted(ui);
     if !may_glide || interrupted || key_scroll != 0.0 || auto_delta != Vec2::ZERO || zoom_delta != 1.0 {
         view.fling.stop();
     }
@@ -3014,6 +1117,14 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     if view.fling.gliding() {
         ui.ctx().request_repaint();
     }
+    // Any reader-owned motion ends automatic search following, even when it stays on the same
+    // page: the wheel, keyboard, middle-button auto-scroll, a drawing's edge scroll, or the
+    // momentum left by a touchpad swipe. The automatic flash uses `goto`, not these deltas, so
+    // its programmatic scroll is never mistaken for a reader action.
+    let wheel_scrolled = precise_scroll != Vec2::ZERO || line_base != Vec2::ZERO || boost_extra != Vec2::ZERO || has_page;
+    if wheel_scrolled || auto_delta != Vec2::ZERO || edge_delta != Vec2::ZERO || glide != Vec2::ZERO {
+        view.end_find_following();
+    }
     // The wheel may have turned the page above: draw the row it turned to. Measured from the old
     // row, the jump to the new page scrolled both out of view, a blank frame on every turn forward.
     let row = shown_row(view);
@@ -3063,6 +1174,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         } else {
             ui.input(|i| i.pointer.delta())
         };
+        if moved != Vec2::ZERO {
+            view.end_find_following();
+        }
         // Within the content, as egui keeps it: past an end the page would show there for a
         // frame and spring back. `max` is never NaN or below zero, so the clamp can't panic.
         let max = vec2((content_w - avail.width()).max(0.0), (content_h - avail.height()).max(0.0));
@@ -3164,15 +1278,6 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let mut open_signature = false;
     let mut hover_text: Option<(Pos2, String)> = None;
     let mut badge_hover: Option<(Pos2, String)> = None;
-    // A dialog, save prompt or palette covers the page. Hover tips are drawn above those
-    // windows, so a comment under the pointer would otherwise float over the dialog.
-    let page_covered = app.dialog.is_some()
-        || app.close_request.is_some()
-        || app.palette_open
-        || app.password_prompt.is_some()
-        || app.pending_link.is_some()
-        || app.pending_remote_link.is_some()
-        || app.updates.open;
     let mut clicked_link: Option<LinkTarget> = None;
     let mut remote_open: Option<(pdfcraft_engine::DocId, String, pdfcraft_render::RemoteDestination)> = None;
     let mut canvas_action: Option<comments::CanvasAction> = None;
@@ -3214,7 +1319,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         }
     }
     let selection_wheel = view.selection_drag && navigation_enabled && unobstructed && !single_paging && ui.rect_contains_pointer(avail);
-    let out = page_scroll(ui, scroll, egui::Id::new(("page-view-scope", view.id)), |ui, viewport| {
+    let out = page_scroll(ui, scroll, egui::Id::unique(("page-view-scope", view.id)), |ui, viewport| {
         // egui's drag responses accept every pointer button. Keep a wheel gesture from also
         // selecting text, drawing a mark, or panning with the Hand tool.
         if middle_gesture {
@@ -3261,11 +1366,14 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         let mut best_overlap = -1.0f32;
         let mut current_overlap = -1.0f32;
         let mut current_height = f32::INFINITY;
-        let pointer = ui.input(|i| i.pointer.hover_pos());
+        // The pointer as the pages see it: nothing over them (a dialog from the frame it opens),
+        // or a press they hold. The page modules read it rather than egui's raw pointer state.
+        let ptr = PagePointer::read(ui, &resp, modal);
+        let pointer = ptr.pos;
         // A press on a page makes it the current one (as in Acrobat), so a page command with
         // no selection (Rotate, Delete) acts on the page the reader pointed at, not on a page
         // gone to earlier that still shows whole beside it.
-        let pressed = unobstructed && ui.input(|i| i.pointer.primary_pressed()) && ui.rect_contains_pointer(avail);
+        let pressed = unobstructed && ptr.pressed().is_some();
         let mut pressed_page = None;
         if resp.secondary_clicked() {
             // Set again below when the right-click lands on a link.
@@ -3420,15 +1528,14 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             }
             view.text_background.paint(painter, &xf, i, view.line_editor.as_ref(), view.content.draft.as_ref());
             if editing_content {
-                let page_tex = view.pages.get(&i).map(|p| p.tex.id());
-                view.move_background.paint(ui, painter, &xf, i, info, &view.content, page_tex);
+                view.move_background.paint(painter, &xf, i, info, &view.content, pointer);
             }
             if view.show_page_gaps {
                 painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(0.5, t.border.gamma_multiply(0.8)), egui::StrokeKind::Outside);
             }
 
             // Comments: tools, selection, moving and resizing come before text selection.
-            let pcx = comments::PageCx { page: i, xf: &xf, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
+            let pcx = comments::PageCx { page: i, xf: &xf, ptr: &ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
             if let QuickTool::Measure(measure_tool) = tool {
                 crate::measure_ui::page_input(ui, &resp, doc, view, &pcx, measure_tool, units);
             }
@@ -3437,7 +1544,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             // every viewing mode); then comments; then text selection.
             if let QuickTool::Stamp(kind) = tool
                 && allowed
-                && let Some(p) = ui.input(|inp| inp.pointer.hover_pos()).filter(|p| xf.rect.contains(*p))
+                && let Some(p) = ptr.within(xf.rect)
             {
                 ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
                 if resp.clicked() {
@@ -3461,7 +1568,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             }
             if let Some(cs) = custom_stamp.as_ref()
                 && allowed
-                && let Some(p) = ui.input(|inp| inp.pointer.hover_pos()).filter(|p| xf.rect.contains(*p))
+                && let Some(p) = ptr.within(xf.rect)
             {
                 ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
                 if resp.clicked() {
@@ -3482,12 +1589,13 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             // Over a mark already placed, the Fill & Sign tool picks it up (comments, below).
             if let QuickTool::Fill(ft) = tool
                 && allowed
-                && !comments::fill_grabs(ui, &pcx, view)
+                && !comments::fill_grabs(&pcx, view)
             {
                 match crate::fill_sign::page_input(
                     ui,
                     &resp,
                     &xf,
+                    &ptr,
                     i,
                     info,
                     ft,
@@ -3511,15 +1619,15 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 }
             }
             if matches!(tool, QuickTool::SignArea { .. }) {
-                crate::sign_ui::page_input(ui, &resp, &xf, i, info, view);
+                crate::sign_ui::page_input(ui, &resp, &xf, &ptr, i, info, view);
             }
             if matches!(tool, QuickTool::MarqueeZoom | QuickTool::Snapshot) {
-                crate::zoom_snap::page_input(ui, &resp, &xf, i, view);
+                crate::zoom_snap::page_input(ui, &resp, &xf, &ptr, i, view);
             }
             if tool == QuickTool::EnhanceCamera {
-                crate::camera_ui::page_input(ui, &resp, &xf, i, view, can_modify);
+                crate::camera_ui::page_input(ui, &resp, &xf, &ptr, i, view, can_modify);
             }
-            if tool == QuickTool::Crop && crate::crop::page_input(ui, &resp, &xf, i, info, view, can_crop) {
+            if tool == QuickTool::Crop && crate::crop::page_input(ui, &resp, &xf, &ptr, i, info, view, can_crop) {
                 view.current = i;
                 open_boxes = true;
             }
@@ -3531,7 +1639,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 };
                 // While a table is being set up, nothing else is drawn or moved.
                 let allowed = can_modify && table_preview.is_none() && open_table.is_none();
-                let o = crate::prepare::page_input(ui, &resp, &xf, i, info, &form, field_tool, allowed, view);
+                let o = crate::prepare::page_input(ui, &resp, &xf, &ptr, i, info, &form, field_tool, allowed, view);
                 field_props |= o.properties;
                 field_placed |= o.placed;
                 open_table = open_table.or(o.table);
@@ -3539,10 +1647,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             } else {
                 use crate::forms_ui::FieldPointer;
                 let field = if tool == QuickTool::Select
-                    && !(editing_content && can_modify && crate::content_ui::select_grabs(ui, &xf, i, info, &added, view))
-                    && !comments::select_grabs(ui, &pcx, view)
+                    && !(editing_content && can_modify && crate::content_ui::select_grabs(&xf, &ptr, i, info, &added, view))
+                    && !comments::select_grabs(&pcx, view)
                 {
-                    crate::forms_ui::page_input(ui, &resp, &xf, i, info, &form, can_fill, view)
+                    crate::forms_ui::page_input(ui, &resp, &xf, &ptr, i, info, &form, can_fill, view)
                 } else {
                     FieldPointer::Away
                 };
@@ -3556,11 +1664,11 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     let (vx, vy) = xf.screen_to_view(p);
                     text.as_ref().is_some_and(|t| t.glyphs.iter().any(|g| vx >= g.rect[0] && vx <= g.rect[2] && vy >= g.rect[1] && vy <= g.rect[3]))
                 };
-                crate::redact_ui::page_input(ui, &resp, &xf, i, info, over_text, view)
+                crate::redact_ui::page_input(ui, &resp, &xf, &ptr, i, info, over_text, view)
             };
-            let image_owns_pointer = tool == QuickTool::EditText && crate::edit_text_ui::image_owns_pointer(ui, &xf, i, info, view);
+            let image_owns_pointer = tool == QuickTool::EditText && crate::edit_text_ui::image_owns_pointer(ui, &xf, &ptr, i, info, view);
             let on_objects =
-                !image_owns_pointer && tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(ui, &resp, &xf, i, doc, view);
+                !image_owns_pointer && tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(ui, &resp, &xf, &ptr, i, doc, view);
             let lines = if matches!(tool, QuickTool::AddText | QuickTool::EditText) && can_modify {
                 let generation = doc.edit_generation();
                 match view.edit_lines.get(&i) {
@@ -3592,6 +1700,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                         ui,
                         &resp,
                         &xf,
+                        &ptr,
                         i,
                         info,
                         &added,
@@ -3620,11 +1729,13 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 };
                 // Editable text takes precedence over background/overlapping artwork. Both
                 // inventories are painted every frame, even when text owns the pointer.
-                let text_used = crate::edit_text_ui::page_input(ui, &resp, &xf, i, doc, &lines, view, !others_own_pointer && !image_owns_pointer);
+                let text_used =
+                    crate::edit_text_ui::page_input(ui, &resp, &xf, &ptr, i, doc, &lines, view, !others_own_pointer && !image_owns_pointer);
                 let image_used = crate::edit_text_ui::image_input(
                     ui,
                     &resp,
                     &xf,
+                    &ptr,
                     i,
                     info,
                     &images,
@@ -3634,7 +1745,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 );
                 !others_own_pointer && (text_used || image_used)
             };
-            let on_link = tool == QuickTool::Link && can_modify && crate::link_ui::page_input(ui, &resp, &xf, i, info, &doc_links, view);
+            let on_link = tool == QuickTool::Link && can_modify && crate::link_ui::page_input(ui, &resp, &xf, &ptr, i, info, &doc_links, view);
             if tool == QuickTool::Select
                 && resp.secondary_clicked()
                 && can_modify
@@ -3712,23 +1823,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     } else if over_text && cursor_free {
                         ui.ctx().set_cursor_icon(egui::CursorIcon::Text);
                     }
-                    let press_here = ui
-                        .input(|inp| {
-                            inp.pointer.press_origin().or_else(|| {
-                                // A press and release can arrive in one pass; egui has already
-                                // cleared press_origin, but the press still starts multi-click selection.
-                                inp.events.iter().find_map(|event| match event {
-                                    egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, .. }
-                                        if pos.is_finite() =>
-                                    {
-                                        Some(*pos)
-                                    }
-                                    _ => None,
-                                })
-                            })
-                        })
-                        .is_some_and(|o| r.contains(o));
-                    let pressed = ui.input(|inp| inp.pointer.primary_pressed());
+                    // The pages' press, kept when its release came in the same frame (#2100): it
+                    // still starts multi-click selection.
+                    let press_here = ptr.origin.is_some_and(|o| r.contains(o));
+                    let pressed = ptr.pressed().is_some();
                     if pressed && press_here && !over_link {
                         let now = ui.input(|inp| inp.time);
                         // The same limits egui uses to count clicks on release.
@@ -3753,7 +1851,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                         // re-drag over text whose bar Copy closed would keep the bar hidden.
                         view.actions_dismissed = None;
                         view.selection_drag = true;
-                        let origin = ui.input(|inp| inp.pointer.press_origin()).unwrap_or(p);
+                        let origin = ptr.origin.unwrap_or(p);
                         let (ox, oy) = xf.screen_to_view(origin);
                         if view.clicks < 2 {
                             view.selection = if column {
@@ -3843,11 +1941,11 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 crate::redact_ui::after_text(&resp, i, info, view);
             }
             if area_tool {
-                crate::redact_ui::paint(ui, painter, i, view);
+                crate::redact_ui::paint(painter, i, view, pointer);
             }
             comments::paint_page(ui, painter, &pcx, view);
             if editing_content {
-                crate::content_ui::paint_page(ui, painter, &xf, i, info, &added, view);
+                crate::content_ui::paint_page(painter, &xf, i, info, &added, view, pointer);
             }
             if tool == QuickTool::EditText {
                 crate::object_ui::paint(painter, &xf, i, info, &view.objects);
@@ -3856,38 +1954,39 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 crate::camera_ui::paint(painter, &xf, i, view);
             }
             if tool == QuickTool::Link {
-                crate::link_ui::paint(ui, painter, &xf, i, info, &doc_links, view);
+                crate::link_ui::paint(painter, &xf, i, info, &doc_links, view, pointer);
             }
             if preparing {
-                crate::prepare::paint_page(ui, painter, &xf, i, info, &form, view);
+                crate::prepare::paint_page(ui, painter, &xf, i, info, &form, view, pointer);
                 if let Some(preview) = &table_preview {
                     crate::field_table_ui::paint_preview(painter, &xf, i, preview);
                 }
                 if calc_order {
                     let selected = view.prepare.selected.as_ref().map(|(name, _)| name.as_str());
-                    if let Some(name) = crate::calc_order_ui::paint_page(ui, painter, &xf, i, info, &form, &view.calc_order, generation, selected) {
+                    if let Some(name) =
+                        crate::calc_order_ui::paint_page(painter, &xf, i, info, &form, &view.calc_order, generation, selected, pointer)
+                    {
                         calc_hover = Some(name);
                     }
                 }
             } else {
-                crate::forms_ui::paint_page(ui, painter, &xf, i, info, &form, view);
+                crate::forms_ui::paint_page(painter, &xf, i, info, &form, view, pointer);
             }
 
             // Form-field highlight (Acrobat's "Highlight existing fields"); required fields get a
-            // red border. Radio buttons are round, and so is theirs (as in Acrobat). Only what can
-            // be filled is marked: a read-only widget (its field's, or a radio button's own) is
-            // left as it is drawn.
+            // red border. Radio buttons and round XFA check boxes are round, and so is theirs (as
+            // in Acrobat). Only what can be filled is marked: a read-only widget (its field's, or a
+            // radio button's own) is left as it is drawn.
             if view.highlight_fields {
                 for f in form.iter() {
                     let required = f.has(pdfcraft_engine::field_flags::REQUIRED);
-                    let round = f.kind == pdfcraft_engine::FormFieldKind::Radio;
                     for w in f.widgets.iter().filter(|w| w.page == Some(i) && !w.hidden && !w.read_only) {
                         let r = w.rect;
                         let sr = xf.user_rect(info, i, [r[0] as f32, r[1] as f32, r[2] as f32, r[3] as f32]);
                         let tint = Color32::from_rgba_unmultiplied(0x6E, 0x8E, 0xF5, 48);
                         let (width, color) =
                             if required { (2.0, Color32::from_rgb(0xE3, 0x22, 0x22)) } else { (1.0, Color32::from_rgb(0x6E, 0x8E, 0xF5)) };
-                        if round {
+                        if w.round {
                             let radius = sr.width().min(sr.height()) / 2.0;
                             painter.circle_filled(sr.center(), radius, tint);
                             painter.circle_stroke(sr.center(), radius - width / 2.0, Stroke::new(width, color));
@@ -3898,9 +1997,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     }
                 }
             }
-            // Fill & Sign keeps its placement cursor clear of link/comment hover feedback.
-            if !page_covered
-                && !matches!(tool, QuickTool::Fill(_))
+            // Fill & Sign keeps its placement cursor clear of link/comment hover feedback. Tips
+            // draw above the palette, so none shows while it is open, even beside it.
+            if !matches!(tool, QuickTool::Fill(_))
+                && unobstructed
                 && let Some(p) = pointer
             {
                 for l in info.links.iter().filter(|l| l.page == i) {
@@ -4022,10 +2122,11 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             && navigation_enabled
             && unobstructed
             && !single_paging
-            && let Some(p) = ui.input(|i| i.pointer.latest_pos())
+            && let Some(p) = ptr.pos
         {
             let dy = crate::autoscroll::edge_delta(p.y, avail, ui.input(|i| i.stable_dt));
             if dy != 0.0 {
+                view.end_find_following();
                 ui.scroll_with_delta_animation(vec2(0.0, dy), egui::style::ScrollAnimation::none());
                 // Keep scrolling while the pointer rests there and sends no events.
                 ui.ctx().request_repaint();
@@ -4129,7 +2230,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 && let Some((page, at)) = view.comments.context_at
             {
                 // The page's content is parsed once per right-click, not on every frame the menu is open.
-                let key = egui::Id::new("copy-image-under-menu");
+                let key = egui::Id::unique("copy-image-under-menu");
                 let cached = ui.data(|d| d.get_temp::<(usize, [f64; 2], Option<usize>)>(key)).filter(|c| c.0 == page && c.1 == at);
                 let hit = match cached {
                     Some(c) => c.2,
@@ -4160,7 +2261,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         // below the window's top). Within a point, as for wheel paging, so layout rounding
         // can't hide an edge.
         let max_y = (out.content_size.y - out.inner_rect.height()).max(0.0);
-        (page, out.state.offset.y <= MARGIN - view.page_gap() + 1.0, out.state.offset.y >= max_y - 1.0)
+        (page, out.state.clamped_offset().y <= MARGIN - view.page_gap() + 1.0, out.state.clamped_offset().y >= max_y - 1.0)
     });
 
     view.viewport_screen = out.inner_rect;
@@ -4175,7 +2276,20 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     // backdrop/older tiles instead of queueing a storm of interprets (one per frame) that
     // the workers cannot cancel mid-operator. Fresh tiles go out once the pan settles;
     // pages with nothing on screen yet still queue.
-    let scroll_offset = out.state.offset;
+    let scroll_offset = out.state.clamped_offset();
+    // The document ScrollArea's own scroll surfaces move the offset without the wheel deltas
+    // above: its two scroll-bar tracks/handles and, for touch or the Hand tool, its drag
+    // background. The output gives us the area id, and egui's pinned ScrollArea registers those
+    // widgets under `id.with(0)` (horizontal), `id.with(1)` (vertical) and `id.with("area")`.
+    // Ask for their exact responses instead of treating any held drag as scrolling: a text
+    // selection, a panel splitter or another widget's drag must not excuse the programmatic jump
+    // a search flash makes, while a track click (which moves the offset with no pointer motion)
+    // must still count as the reader scrolling.
+    let scroll_surface = |id: egui::Id| ui.ctx().read_response(id).is_some_and(|r| r.is_pointer_button_down_on() || r.dragged() || r.clicked());
+    let pointer_scrolling = scroll_surface(out.id.with(0usize)) || scroll_surface(out.id.with(1usize)) || scroll_surface(out.id.with("area"));
+    if pointer_scrolling && (scroll_offset - view.last_scroll).length() > 2.0 {
+        view.end_find_following();
+    }
     let now_settle = ui.input(|i| i.time);
     if (scroll_offset - view.last_scroll).length() > 2.0 {
         view.pan_hold_until = now_settle + 0.25;
@@ -4307,7 +2421,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     view.frame_visible = visible_now.iter().copied().collect();
 
     if let Some((pos, text)) = hover_text {
-        egui::Area::new(egui::Id::new("canvas-hover")).order(egui::Order::Tooltip).fixed_pos(pos + vec2(14.0, 16.0)).show(ui.ctx(), |ui| {
+        // Click-through, as a tooltip is: the pages lose the pointer under anything that isn't.
+        let tip = egui::Area::new(egui::Id::unique("canvas-hover")).order(egui::Order::Tooltip).interactable(false);
+        tip.fixed_pos(pos + vec2(14.0, 16.0)).show(ui.ctx(), |ui| {
             egui::Frame::popup(ui.style()).show(ui, |ui| {
                 ui.set_max_width(320.0);
                 ui.label(text);
@@ -4538,2889 +2654,11 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     }
 }
 
-#[derive(Clone, Copy)]
-enum SelectionAction {
-    Note,
-    Markup(comments::CommentTool),
-    Replace,
-    Copy,
-}
-
-/// Actions on an existing text selection, next to the selected words.
-fn selection_actions(
-    ui: &mut egui::Ui,
-    viewport: Rect,
-    view: &mut DocView,
-    info: &DocInfo,
-    prefs: &comments::CommentPrefs,
-    can_comment: bool,
-    can_copy: bool,
-) -> bool {
-    if ui.input(|input| input.pointer.is_decidedly_dragging()) {
-        return false;
-    }
-    let Some(selection) = view.selection else {
-        view.actions_dismissed = None;
-        return false;
-    };
-    if view.actions_dismissed == Some(selection) {
-        return false;
-    }
-    let Some(text) = view.texts.get(&selection.page) else { return false };
-    let Some(xf) = view.page_xform(selection.page) else { return false };
-    let Some(last) = selection.rects(text).last().copied() else { return false };
-    let selected = selection.text(text);
-    if selected.is_empty() {
-        return false;
-    }
-    let rect = xf.view_rect(last);
-    if !viewport.intersects(rect) {
-        return false;
-    }
-    let x = rect.left().clamp(viewport.left() + 8.0, (viewport.right() - 520.0).max(viewport.left() + 8.0));
-    let y = if rect.bottom() + 48.0 < viewport.bottom() { rect.bottom() + 6.0 } else { (rect.top() - 44.0).max(viewport.top() + 6.0) };
-    let mut chosen = None;
-    egui::Area::new(egui::Id::new(("text-selection-actions", view.id.0))).order(egui::Order::Foreground).fixed_pos(pos2(x, y)).show(ui.ctx(), |ui| {
-        egui::Frame::popup(ui.style()).show(ui, |ui| {
-            ui.horizontal(|ui| {
-                for (label, action) in [
-                    (tl!("Add comment"), SelectionAction::Note),
-                    (tl!("Highlight"), SelectionAction::Markup(comments::CommentTool::Highlight)),
-                    (tl!("Underline"), SelectionAction::Markup(comments::CommentTool::Underline)),
-                    (tl!("Strikethrough"), SelectionAction::Markup(comments::CommentTool::StrikeOut)),
-                    (tl!("Replace text"), SelectionAction::Replace),
-                ] {
-                    if ui.add_enabled(can_comment, egui::Button::new(label)).clicked() {
-                        chosen = Some(action);
-                    }
-                }
-                if ui.add_enabled(can_copy, egui::Button::new(tl!("Copy"))).clicked() {
-                    chosen = Some(SelectionAction::Copy);
-                }
-            });
-        });
-    });
-    let Some(action) = chosen else { return false };
-    if let SelectionAction::Copy = action {
-        // Copying closes the bar but keeps the words selected, for ⌘C or a second action.
-        view.actions_dismissed = Some(selection);
-        return true;
-    }
-    let Some((page, quads)) = view.selection_quads(info) else { return false };
-    let last = quads.last().copied().unwrap_or_default();
-    let at = [last[2].max(last[6]), last[1].max(last[3])];
-    view.clear_selection();
-    match action {
-        SelectionAction::Note | SelectionAction::Replace => {
-            if matches!(action, SelectionAction::Replace) {
-                view.comments.replace = Some(quads);
-            }
-            view.comments.composer = Some(comments::Composer {
-                page,
-                at,
-                kind: if matches!(action, SelectionAction::Replace) { comments::ComposerKind::Replace } else { comments::ComposerKind::Note },
-                text: String::new(),
-                focus: true,
-            });
-        }
-        SelectionAction::Markup(tool) => {
-            // Every markup button carries a markup tool; anything else adds nothing.
-            let Some(kind) = tool.markup() else { return false };
-            view.pending_edit = Some(Edit::AddAnnotation(pdfcraft_engine::NewAnnotation {
-                page,
-                shape: pdfcraft_engine::Shape::TextMarkup { kind, quads },
-                style: prefs.style(tool),
-                contents: String::new(),
-                author: prefs.author.clone(),
-            }));
-        }
-        // Copy is dispatched through the app after the view borrow ends.
-        SelectionAction::Copy => {}
-    }
-    false
-}
-
-/// Run a push button's action (the ones that need no JavaScript engine).
-fn run_button(app: &mut PdfCraftApp, index: usize, name: &str, action: pdfcraft_engine::form_scripts::ButtonAction) {
-    use pdfcraft_engine::form_scripts::ButtonAction as B;
-    let pages = app.session.get(app.views[index].id).map_or(0, |d| d.info.pages.len());
-    match action {
-        B::Reset { fields, exclude } => {
-            let all: Vec<String> = app.session.get(app.views[index].id).map(|d| d.form.iter().map(|f| f.name.clone()).collect()).unwrap_or_default();
-            let listed = |n: &String| fields.iter().any(|f| n == f || n.starts_with(&format!("{f}.")));
-            let names = match (fields.is_empty(), exclude) {
-                (true, _) => None,
-                (false, false) => Some(all.iter().filter(|n| listed(n)).cloned().collect()),
-                (false, true) => Some(all.iter().filter(|n| !listed(n)).cloned().collect()),
-            };
-            app.views[index].forms.focus = None;
-            app.views[index].pending_edit = Some(pdfcraft_engine::Edit::ResetForm { names });
-        }
-        B::Named(n) => match n.as_str() {
-            "Print" => app.open_print(),
-            // What PdfCraft's XFA buttons use, and what a script's `execMenuItem("Save")`
-            // does too: the Save As dialog, so a click never overwrites the file unasked.
-            "SaveAs" => app.run_command("file.save_as"),
-            "NextPage" => app.views[index].step_page(true),
-            "PrevPage" => app.views[index].step_page(false),
-            "FirstPage" => app.views[index].go_to_page(0),
-            "LastPage" => app.views[index].go_to_page(pages.saturating_sub(1)),
-            other => app.notify_fmt("{name}: the {other} action isn't supported yet", &[("name", name), ("other", other)]),
-        },
-        B::Uri(u) => app.request_document_url(&u, crate::LinkOrigin::Button),
-        B::GoTo(p) => app.views[index].go_to_page(p.min(pages.saturating_sub(1))),
-        B::ShowHide { fields, hide } => {
-            let listed = |n: &String| fields.iter().any(|f| n == f || n.starts_with(&format!("{f}.")));
-            // `display.hidden` 1, `display.visible` 0, as a script setting `field.display` would.
-            let changes: Vec<pdfcraft_engine::FieldChange> = app
-                .session
-                .get(app.views[index].id)
-                .map(|d| d.form.iter().filter(|f| listed(&f.name)).map(|f| f.name.clone()).collect::<Vec<_>>())
-                .unwrap_or_default()
-                .into_iter()
-                .map(|name| pdfcraft_engine::FieldChange {
-                    name,
-                    value: None,
-                    read_only: None,
-                    required: None,
-                    display: Some(if hide { 1 } else { 0 }),
-                })
-                .collect();
-            if !changes.is_empty() {
-                let label = if hide { "Hide a field" } else { "Show a field" };
-                app.views[index].pending_edit =
-                    Some(pdfcraft_engine::Edit::Batch { label: label.into(), edits: vec![pdfcraft_engine::Edit::ApplyScriptChanges { changes }] });
-            }
-        }
-        B::SetLayers { changes, preserve_rb } => {
-            use pdfcraft_engine::form_scripts::LayerOp as Op;
-            let changes: Vec<(LayerOp, (u32, u16))> = changes
-                .into_iter()
-                .map(|(op, ocg)| {
-                    let op = match op {
-                        Op::On => LayerOp::On,
-                        Op::Off => LayerOp::Off,
-                        Op::Toggle => LayerOp::Toggle,
-                    };
-                    (op, ocg)
-                })
-                .collect();
-            set_layers(app, index, &changes, preserve_rb);
-        }
-        B::Alert(m) => app.notify(m),
-        B::Submit(url) => app.notify_fmt(
-            "{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.",
-            &[("name", name), ("url", &url)],
-        ),
-        B::ImportIcon => app.choose_field_image(name),
-        B::Script(js) => {
-            let id = app.views[index].id;
-            app.run_button_script(id, name, &js);
-        }
-    }
-}
-
-/// Run a set-layer-visibility action from a button or link. It changes what is shown, as the
-/// Layers panel does (which follows), not the document.
-fn set_layers(app: &mut PdfCraftApp, index: usize, changes: &[(LayerOp, (u32, u16))], preserve_rb: bool) {
-    let id = app.views[index].id;
-    if app.session.set_layer_state(id, changes, preserve_rb) {
-        app.views[index].invalidate_content();
-    }
-}
-
-/// Whether `p` lies in the bottom-left quadrant of `area`, where the page size shows (#1855).
-fn in_size_hint_zone(area: Rect, p: Pos2) -> bool {
-    p.x >= area.min.x && p.x < area.center().x && p.y > area.center().y && p.y <= area.max.y
-}
-
-/// The current page's size, floating at the bottom-left of the document area while the pointer is
-/// in that quadrant, as Acrobat does. Same formatter and unit as Document Properties.
-fn page_size_hint(view: &DocView, info: &DocInfo, units: crate::units::Unit, area: Rect, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
-    let Some(page) = info.pages.get(view.current) else { return };
-    let inside = unobstructed && ui.input(|i| i.pointer.hover_pos()).is_some_and(|p| in_size_hint_zone(area, p));
-    if !inside {
-        return;
-    }
-    let text = units.size(f64::from(page.width), f64::from(page.height));
-    egui::Area::new(egui::Id::new("page-size-hint"))
-        .order(egui::Order::Foreground)
-        .interactable(false)
-        .pivot(egui::Align2::LEFT_BOTTOM)
-        .fixed_pos(area.left_bottom() + vec2(14.0, -14.0))
-        .show(ui.ctx(), |ui| {
-            egui::Frame::NONE
-                .fill(t.card)
-                .stroke(Stroke::new(1.0, t.border))
-                .corner_radius(CornerRadius::same(6))
-                .inner_margin(egui::Margin::symmetric(8, 4))
-                .show(ui, |ui| {
-                    ui.add(egui::Label::new(egui::RichText::new(text).color(t.text)).selectable(false));
-                });
-        });
-}
-
-/// Acrobat-style floating find bar at the top-right of the document area.
-fn find_bar(view: &mut DocView, pages: usize, area: Rect, ui: &mut egui::Ui, t: &Tokens) {
-    let Some(find) = view.find.as_mut() else { return };
-    // The Search panel shows this search.
-    if find.in_panel {
-        return;
-    }
-    let mut close = false;
-    let mut step: Option<bool> = None;
-    let searched = view.texts.len() + view.text_failed.len();
-    egui::Area::new(egui::Id::new("find-bar"))
-        .order(egui::Order::Middle)
-        .pivot(Align2::RIGHT_TOP)
-        .fixed_pos(area.right_top() + vec2(-18.0, 12.0))
-        .show(ui.ctx(), |ui| {
-            egui::Frame::NONE
-                .fill(t.card)
-                .stroke(Stroke::new(1.0, t.border))
-                .corner_radius(CornerRadius::same(10))
-                .shadow(egui::Shadow { offset: [0, 4], blur: 16, spread: 0, color: Color32::from_black_alpha(if t.dark() { 90 } else { 30 }) })
-                .inner_margin(egui::Margin::symmetric(10, 6))
-                .show(ui, |ui| {
-                    ui.horizontal(|ui| {
-                        ui.add(icons::image("search", 16.0, t.text_muted));
-                        let edit = egui::TextEdit::singleline(&mut find.query)
-                            .id(egui::Id::new("find-input"))
-                            .hint_text(tl!("Find text"))
-                            .desired_width(220.0)
-                            .frame(egui::Frame::NONE);
-                        let r = ui.add(edit);
-                        if find.focus {
-                            r.request_focus();
-                            find.focus = false;
-                        }
-                        if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
-                            step = Some(!ui.input(|i| i.modifiers.shift));
-                            r.request_focus();
-                        }
-                        if r.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                            close = true;
-                        }
-                        let status = if find.query.trim().is_empty() {
-                            String::new()
-                        } else if find.matches.is_empty() {
-                            if searched < pages {
-                                crate::i18n::fmt(tl!("Searching… {s}/{p}"), &[("s", &searched.to_string()), ("p", &pages.to_string())])
-                            } else {
-                                tl!("No matches").to_string()
-                            }
-                        } else {
-                            let more = if searched < pages { "+" } else { "" };
-                            crate::i18n::fmt(
-                                tl!("{c} of {n}{more}"),
-                                &[
-                                    ("c", &find.current.map(|c| c + 1).unwrap_or(0).to_string()),
-                                    ("n", &find.matches.len().to_string()),
-                                    ("more", more),
-                                ],
-                            )
-                        };
-                        ui.label(egui::RichText::new(status).font(theme::regular(12.0)).color(t.text_muted));
-                        let tip = crate::commands::key_tip(ui.ctx(), tl!("Previous ({key})"), crate::commands::FIND_PREV);
-                        if icons::button(ui, "chevron-up", 26.0, false, &tip).clicked() {
-                            step = Some(false);
-                        }
-                        let tip = crate::commands::key_tip(ui.ctx(), tl!("Next ({key})"), crate::commands::FIND_NEXT);
-                        if icons::button(ui, "chevron-down", 26.0, false, &tip).clicked() {
-                            step = Some(true);
-                        }
-                        let opts = icons::button(ui, "settings-2", 26.0, find.case_sensitive || find.whole_words, tl!("Find options"));
-                        egui::Popup::menu(&opts).show(|ui| {
-                            let a = ui.add(widgets::checkbox(&mut find.whole_words, tl!("Whole words only"))).changed();
-                            let b = ui.add(widgets::checkbox(&mut find.case_sensitive, tl!("Case-sensitive"))).changed();
-                            if a || b {
-                                // Search again with the new options.
-                                find.case_query.clear();
-                            }
-                        });
-                        if icons::button(ui, "x", 26.0, false, tl!("Close (Esc)")).clicked() {
-                            close = true;
-                        }
-                    });
-                });
-        });
-    if close {
-        view.find = None;
-        return;
-    }
-    if find.query != find.case_query {
-        view.rerun_find();
-    }
-    if let Some(forward) = step {
-        view.find_step(forward);
-    }
-}
-
 /// The prepare-mode field menu's choices.
 enum FieldMenu {
     Properties,
     Duplicate(String),
 }
 
-/// What the notice bar's buttons ask for.
-enum Notice {
-    /// Reload the file that changed on disk, dropping unsaved changes.
-    Reload,
-    Security,
-    Signatures,
-    Repairs,
-    /// Highlight fields was turned on or off.
-    FieldHighlights(bool),
-    /// Open the JavaScript console (the form's scripts were turned off; the error is there).
-    Console,
-    /// Unlock… (enter the permissions password).
-    Unlock,
-    /// Close this historical snapshot tab (View signed version / View revision).
-    Close,
-    /// Stop showing the secured-document notice, in every document (#4035).
-    HideSecured,
-}
-
-/// The notice bar above the pages: a file changed on disk first, then what a historical
-/// snapshot is, then the signature status bar, a form's scripts having been turned
-/// off, security, forms and warnings.
-fn notices(
-    view: &mut DocView,
-    doc: &pdfcraft_engine::Document,
-    secured: bool,
-    repaired: bool,
-    signed: Option<(&str, Color32, &str, String)>,
-    ui: &mut egui::Ui,
-    t: &Tokens,
-) -> Option<Notice> {
-    let info = &doc.info;
-    let xfa = doc.xfa.as_ref();
-    // The file changed on disk while this document has unsaved changes (#431): ask before
-    // replacing it, ahead of every other notice.
-    if view.disk_changed {
-        let mut reload = false;
-        egui::Frame::NONE.fill(t.accent_soft).inner_margin(egui::Margin::symmetric(14, 7)).show(ui, |ui| {
-            ui.horizontal(|ui| {
-                ui.add(icons::image("rotate-cw", 16.0, t.accent_text));
-                ui.label(
-                    egui::RichText::new(tl!(
-                        "This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version."
-                    ))
-                    .color(t.text),
-                );
-                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                    if icons::button(ui, "x", 22.0, false, tl!("Dismiss")).clicked() {
-                        view.disk_changed = false;
-                    }
-                    reload = crate::widgets::pill_button(ui, tl!("Reload"), false).clicked();
-                });
-            });
-        });
-        return reload.then_some(Notice::Reload);
-    }
-    // A historical snapshot (View signed version / View revision): what it is, above the
-    // signature and security bars, so the tab is never mistaken for the live document.
-    if let Some(snap) = view.snapshot.as_ref() {
-        let mut close = false;
-        let text = if snap.kind == SnapshotKind::SignedVersion {
-            crate::i18n::fmt(
-                tl!("You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original."),
-                &[("from", &snap.from), ("rev", &snap.revision.to_string())],
-            )
-        } else {
-            crate::i18n::fmt(
-                tl!("You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original."),
-                &[("rev", &snap.revision.to_string()), ("from", &snap.from)],
-            )
-        };
-        notice_bar(ui, t, "clock", t.accent_text, text, |ui| {
-            if crate::widgets::pill_button(ui, tl!("Close"), true).clicked() {
-                close = true;
-            }
-        });
-        if close {
-            return Some(Notice::Close);
-        }
-    }
-    if let Some((icon, color, template, arg)) = signed {
-        let mut open = false;
-        notice_bar(ui, t, icon, color, crate::i18n::fmt(tl!(template), &[("by", &arg)]), |ui| {
-            if crate::widgets::pill_button(ui, tl!("Signature panel"), false).clicked() {
-                open = true;
-            }
-        });
-        return open.then_some(Notice::Signatures);
-    }
-    if view.notice_dismissed {
-        return None;
-    }
-    let mut open_security = false;
-    let mut unlock = false;
-    let mut hide_secured = false;
-    let mut open_repairs = false;
-    let mut open_console = false;
-    let mut toggled = None;
-    // A form whose scripts were turned off no longer calculates or answers its buttons: that
-    // comes before what else there is to say about the document.
-    let scripts_off = doc.xfa_scripts_off();
-    // What the document is as a form, if it is one: what the bar says first, secured or not.
-    let form = if let Some(x) = xfa {
-        let lang = crate::i18n::current();
-        let pages = crate::i18n::trn(lang, x.pages as u64, "{n} page", "{n} pages");
-        let fields = crate::i18n::trn(lang, x.fields as u64, "{n} field", "{n} fields");
-        let mut text =
-            crate::i18n::fmt(tl!("Dynamic XFA form laid out from its template: {pages}, {fields}."), &[("pages", &pages), ("fields", &fields)]);
-        if !x.warnings.is_empty() {
-            // The notes are clauses ("a picture is left out"); the first starts a sentence here.
-            let notes = x.warnings.join("; ");
-            let mut chars = notes.chars();
-            text.push(' ');
-            text.extend(chars.next().into_iter().flat_map(char::to_uppercase));
-            text.push_str(chars.as_str());
-            text.push('.');
-        }
-        Some(("text-cursor-input", text, true))
-    } else if info.xfa == Some(pdfcraft_render::Xfa::Dynamic) {
-        Some((
-            "triangle-alert",
-            tl!("This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.").to_string(),
-            false,
-        ))
-    } else if info.xfa == Some(pdfcraft_render::Xfa::Static) {
-        Some((
-            "text-cursor-input",
-            tl!("XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.").to_string(),
-            true,
-        ))
-    } else if info.fields.iter().any(|f| f.kind != pdfcraft_render::FieldKind::PushButton) {
-        // Push buttons alone (LaTeX `animate` frames, navigation buttons) leave nothing to fill in.
-        Some((
-            "text-cursor-input",
-            crate::i18n::fmt(tl!("This document contains {n} interactive form fields."), &[("n", &info.fields.len().to_string())]),
-            true,
-        ))
-    } else {
-        None
-    };
-    let msg = if scripts_off {
-        Some(("triangle-alert", crate::js_ui::scripts_off_notice(), true))
-    } else if secured {
-        // A secured form still says what it is, and keeps Highlight fields: the security
-        // sentence follows the form's.
-        let security = tl!("This document is secured. Some changes are restricted by its security settings.");
-        Some(match form {
-            Some((icon, text, fields)) => (icon, format!("{text} {security}"), fields),
-            None => ("lock", security.to_string(), false),
-        })
-    } else if form.is_some() {
-        form
-    } else if repaired {
-        Some(("bandage", tl!("This file was damaged and has been repaired. Saving keeps the repaired version.").to_string(), false))
-    } else if !info.warnings.is_empty() {
-        Some(("triangle-alert", info.warnings[0].clone(), false))
-    } else {
-        None
-    };
-    let (icon, text, fields) = msg?;
-    notice_bar(ui, t, icon, t.accent_text, text, |ui| {
-        if icons::button(ui, "x", 22.0, false, tl!("Dismiss")).clicked() {
-            view.notice_dismissed = true;
-        }
-        if fields {
-            let label = if view.highlight_fields { tl!("Hide field highlights") } else { tl!("Highlight fields") };
-            if crate::widgets::pill_button(ui, label, view.highlight_fields).clicked() {
-                view.highlight_fields = !view.highlight_fields;
-                toggled = Some(Notice::FieldHighlights(view.highlight_fields));
-            }
-        }
-        if scripts_off && crate::widgets::pill_button(ui, tl!("JavaScript Console"), false).clicked() {
-            open_console = true;
-        }
-        if secured && crate::widgets::pill_button(ui, tl!("Security settings"), false).clicked() {
-            open_security = true;
-        }
-        if secured && doc.can_unlock() && crate::widgets::pill_button(ui, tl!("Unlock…"), true).clicked() {
-            unlock = true;
-        }
-        // Only when the bar shows the security message: a form's stopped scripts come first.
-        if secured && !scripts_off && crate::widgets::pill_button(ui, tl!("Don't show again"), false).clicked() {
-            hide_secured = true;
-        }
-        if repaired && !secured && info.fields.is_empty() && crate::widgets::pill_button(ui, tl!("Details"), false).clicked() {
-            open_repairs = true;
-        }
-    });
-    if open_repairs {
-        return Some(Notice::Repairs);
-    }
-    if open_console {
-        return Some(Notice::Console);
-    }
-    if unlock {
-        return Some(Notice::Unlock);
-    }
-    if hide_secured {
-        return Some(Notice::HideSecured);
-    }
-    open_security.then_some(Notice::Security).or(toggled)
-}
-
-/// One notice bar: an icon and a message on the left, `buttons` (added right to left) on the
-/// right. The buttons are laid out first, so the message only gets the width they leave: it
-/// wraps there (or, when very little is left, is cut short with the full text on hover) instead
-/// of running under the buttons and past the document area into the side panel (#785). The
-/// buttons are centred on a row of button height, and the message's first line is centred on
-/// the same row; a wrapped message grows the bar downwards.
-fn notice_bar(ui: &mut egui::Ui, t: &Tokens, icon: &str, icon_color: Color32, text: String, buttons: impl FnOnce(&mut egui::Ui)) {
-    const ROW: f32 = 28.0;
-    const ICON: f32 = 16.0;
-    egui::Frame::NONE.fill(t.accent_soft).inner_margin(egui::Margin::symmetric(14, 7)).show(ui, |ui| {
-        let width = ui.available_width();
-        ui.allocate_ui_with_layout(vec2(width, ROW), egui::Layout::right_to_left(egui::Align::Center), |ui| {
-            ui.set_min_height(ROW);
-            buttons(ui);
-            let rest = ui.available_width().max(0.0);
-            ui.allocate_ui_with_layout(vec2(rest, ROW), egui::Layout::top_down(egui::Align::Min), |ui| {
-                let font = egui::TextStyle::Body.resolve(ui.style());
-                let line = ui.fonts_mut(|f| f.row_height(&font)).max(ICON);
-                ui.add_space(((ROW - line) / 2.0).max(0.0));
-                ui.with_layout(egui::Layout::left_to_right(egui::Align::Min), |ui| {
-                    let (slot, _) = ui.allocate_exact_size(vec2(ICON, line), Sense::hover());
-                    icons::paint(ui, Rect::from_center_size(slot.center(), vec2(ICON, ICON)), icon, ICON, icon_color);
-                    let label = egui::Label::new(egui::RichText::new(text).color(t.text));
-                    // Wrapping into a sliver would stack the message a few letters per line.
-                    ui.add(if ui.available_width() >= 120.0 { label.wrap() } else { label.truncate() });
-                });
-            });
-        });
-    });
-}
-
-/// The floating quick-action bar at the left edge of the document area.
-fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
-    let t = Tokens::get(ui.ctx());
-    let pos = area.left_top() + vec2(14.0, 14.0);
-    egui::Area::new(egui::Id::new("quick-bar")).order(egui::Order::Middle).fixed_pos(pos).show(ui.ctx(), |ui| {
-        egui::Frame::NONE
-            .fill(t.card)
-            .stroke(Stroke::new(1.0, t.border))
-            .corner_radius(CornerRadius::same(12))
-            .shadow(egui::Shadow { offset: [0, 4], blur: 16, spread: 0, color: Color32::from_black_alpha(if t.dark() { 100 } else { 28 }) })
-            .inner_margin(egui::Margin::same(6))
-            .show(ui, |ui| {
-                ui.spacing_mut().item_spacing.y = 2.0;
-                ui.vertical(|ui| {
-                    if icons::button(ui, "mouse-pointer-2", 32.0, app.quick_tool == QuickTool::Select, tl!("Select (V)")).clicked() {
-                        app.quick_tool = QuickTool::Select;
-                    }
-                    if icons::button(ui, "hand", 32.0, app.quick_tool == QuickTool::Hand, tl!("Hand (H)")).clicked() {
-                        app.quick_tool = QuickTool::Hand;
-                    }
-                    // Comment ▸, Highlight ▸, Draw ▸ (Acrobat's comment toolbar groups). Clicking a
-                    // group selects its last-used tool; clicking it again opens the flyout.
-                    for g in 0..comments::GROUPS.len() {
-                        let current = app.comment_prefs.group_tool[g];
-                        let active = matches!(app.quick_tool, QuickTool::Comment(t) if t.group() == g);
-                        let resp = icons::button(ui, current.icon(), 32.0, active, tl!(current.label()));
-                        // A small corner triangle marks the flyout.
-                        let r = resp.rect;
-                        let tri = [r.right_bottom() + vec2(-4.0, -4.0), r.right_bottom() + vec2(-9.0, -4.0), r.right_bottom() + vec2(-4.0, -9.0)];
-                        ui.painter().add(egui::Shape::convex_polygon(tri.to_vec(), if active { t.accent } else { t.text_faint }, Stroke::NONE));
-                        let open = (resp.clicked() && active) || resp.secondary_clicked();
-                        if resp.clicked() && !active {
-                            app.execute(current.command());
-                        }
-                        egui::Popup::menu(&resp)
-                            .open_memory(open.then_some(egui::SetOpenCommand::Toggle))
-                            .align(egui::RectAlign::RIGHT_START)
-                            .gap(6.0)
-                            .show(|ui| {
-                                for tool in comments::GROUPS[g] {
-                                    let on = app.quick_tool == QuickTool::Comment(*tool);
-                                    let (row, click) = ui.allocate_exact_size(vec2(180.0, 28.0), Sense::click());
-                                    let press = theme::Press::track(ui, &click);
-                                    press.wash(ui, row, 4, on);
-                                    let body = row.translate(press.offset());
-                                    icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
-                                    let reserve = if on { 28.0 } else { 8.0 };
-                                    crate::widgets::paint_left(
-                                        ui,
-                                        body.left_center() + vec2(34.0, 0.0),
-                                        tl!(tool.label()),
-                                        theme::regular(13.0),
-                                        t.text,
-                                        (row.width() - 34.0 - reserve).max(0.0),
-                                    );
-                                    if on {
-                                        icons::paint(
-                                            ui,
-                                            Rect::from_min_size(body.right_top() + vec2(-24.0, 7.0), vec2(14.0, 14.0)),
-                                            "check",
-                                            14.0,
-                                            t.accent,
-                                        );
-                                    }
-                                    let click = theme::hand(click);
-                                    let info = tl!(tool.label()).to_string();
-                                    click.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, on, info.clone()));
-                                    if click.clicked() {
-                                        app.execute(tool.command());
-                                        ui.close();
-                                    }
-                                }
-                            });
-                    }
-                    // Edit text & images, while the Edit workspace is open (Acrobat's Edit toolbar)
-                    // or the tool is in use.
-                    if app.mode == crate::Mode::Edit || app.quick_tool == QuickTool::EditText {
-                        let on = app.quick_tool == QuickTool::EditText;
-                        if icons::button(ui, "text-cursor-input", 32.0, on, tl!("Edit text & images")).clicked() {
-                            if on {
-                                app.put_down_edit_text();
-                            } else {
-                                app.quick_tool = QuickTool::EditText;
-                            }
-                        }
-                    }
-                    // Fill & Sign ▸ (text, marks, date, signature).
-                    let current_fill = match app.quick_tool {
-                        QuickTool::Fill(f) => Some(f),
-                        _ => None,
-                    };
-                    let shown = current_fill.unwrap_or(crate::fill_sign::FillTool::Text);
-                    let resp = icons::button(
-                        ui,
-                        if current_fill.is_some() { shown.icon() } else { "pen-line" },
-                        32.0,
-                        current_fill.is_some(),
-                        tl!("Fill & Sign"),
-                    );
-                    let r = resp.rect;
-                    let tri = [r.right_bottom() + vec2(-4.0, -4.0), r.right_bottom() + vec2(-9.0, -4.0), r.right_bottom() + vec2(-4.0, -9.0)];
-                    ui.painter().add(egui::Shape::convex_polygon(
-                        tri.to_vec(),
-                        if current_fill.is_some() { t.accent } else { t.text_faint },
-                        Stroke::NONE,
-                    ));
-                    if resp.clicked() && current_fill.is_none() {
-                        app.execute(shown.command());
-                    }
-                    let open = (resp.clicked() && current_fill.is_some()) || resp.secondary_clicked();
-                    egui::Popup::menu(&resp)
-                        .open_memory(open.then_some(egui::SetOpenCommand::Toggle))
-                        .align(egui::RectAlign::RIGHT_START)
-                        .gap(6.0)
-                        .show(|ui| {
-                            for tool in crate::fill_sign::FILL_TOOLS {
-                                if matches!(tool, crate::fill_sign::FillTool::Signature | crate::fill_sign::FillTool::Initials) {
-                                    continue;
-                                }
-                                let on = current_fill == Some(tool);
-                                let (row, click) = ui.allocate_exact_size(vec2(180.0, 28.0), Sense::click());
-                                let press = theme::Press::track(ui, &click);
-                                press.wash(ui, row, 4, on);
-                                let body = row.translate(press.offset());
-                                icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
-                                let reserve = if on { 28.0 } else { 8.0 };
-                                crate::widgets::paint_left(
-                                    ui,
-                                    body.left_center() + vec2(34.0, 0.0),
-                                    tl!(tool.label()),
-                                    theme::regular(13.0),
-                                    t.text,
-                                    (row.width() - 34.0 - reserve).max(0.0),
-                                );
-                                if on {
-                                    icons::paint(
-                                        ui,
-                                        Rect::from_min_size(body.right_top() + vec2(-24.0, 7.0), vec2(14.0, 14.0)),
-                                        "check",
-                                        14.0,
-                                        t.accent,
-                                    );
-                                }
-                                let click = theme::hand(click);
-                                let info = tl!(tool.label()).to_string();
-                                click.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, on, info.clone()));
-                                if click.clicked() {
-                                    app.execute(tool.command());
-                                    ui.close();
-                                }
-                            }
-                            ui.separator();
-                            if let Some(command) = crate::fill_sign::signature_entries(ui, app, &t) {
-                                app.execute(command);
-                                ui.close();
-                            }
-                        });
-                    if matches!(current_fill, Some(crate::fill_sign::FillTool::Text | crate::fill_sign::FillTool::Date)) {
-                        ui.label(tl!("Font size:"));
-                        let size = ui.add(
-                            egui::DragValue::new(&mut app.fill_text_size)
-                                .range(crate::fill_sign::MIN_TEXT_SIZE..=crate::fill_sign::MAX_TEXT_SIZE)
-                                .speed(0.25)
-                                .suffix(" pt"),
-                        );
-                        // #1274: the size also applies to the Fill & Sign text that is selected,
-                        // once per change (a typed value, or the end of a drag), so a drag adds
-                        // one undo step and not one per frame.
-                        if ((size.changed() && !size.dragged()) || size.drag_stopped())
-                            && let Some((index, id)) = app.active_ids()
-                            && let Some((page, annotation)) = app.views.get(index).and_then(|view| view.comments.selected)
-                            && app.session.get(id).is_some_and(|doc| {
-                                doc.allows_annotation()
-                                    && doc
-                                        .info
-                                        .annotations
-                                        .iter()
-                                        .any(|a| a.page == page && a.index == annotation && a.fill_sign && a.subtype == "FreeText" && !a.locked)
-                            })
-                        {
-                            app.apply_edit(Edit::FontSizeAnnotation { page, index: annotation, size: app.fill_text_size });
-                        }
-                    }
-                    if let QuickTool::Comment(tool) = app.quick_tool {
-                        let (r, _) = ui.allocate_exact_size(vec2(32.0, 9.0), Sense::hover());
-                        ui.painter().hline(r.x_range().shrink(6.0), r.center().y, Stroke::new(1.0, t.divider));
-                        if let Some(color) = comments::quick_bar_controls(ui, tool, &mut app.comment_prefs)
-                            && let Some((index, id)) = app.active_ids()
-                            && let Some((page, annotation)) = app.views.get(index).and_then(|view| view.comments.selected)
-                            && app.session.get(id).is_some_and(|doc| {
-                                doc.allows_annotation()
-                                    && doc
-                                        .info
-                                        .annotations
-                                        .iter()
-                                        .any(|a| a.page == page && a.index == annotation && a.in_reply_to.is_none() && comments::made_by(a, tool))
-                            })
-                        {
-                            app.apply_edit(Edit::StyleAnnotation {
-                                page,
-                                index: annotation,
-                                color: Some(color),
-                                opacity: None,
-                                width: None,
-                                endings: None,
-                            });
-                        }
-                    }
-                });
-            });
-    });
-}
-
-/// Where a page of `page` size (points, as shown: after its rotation) is drawn in the grid cell
-/// `cell`: as large as the picture area allows and centred in it, so a landscape or rotated page
-/// fills the cell's width in its middle, as Acrobat draws it, instead of a small strip at the top.
-/// The picture area leaves room for the page number and actions below. Its sides narrow only when
-/// a picture that wide would reach the selection checkbox in the cell's corner.
-pub(crate) fn grid_page_rect(cell: Rect, page: Vec2) -> Rect {
-    let area = Rect::from_min_max(pos2(cell.left(), cell.top() + 16.0), pos2(cell.right(), cell.bottom() - 72.0));
-    // A page size from a damaged file can be zero, NaN or infinite; draw such a page square.
-    let side = |v: f32| if v.is_finite() { v.max(1.0) } else { 1.0 };
-    let (w, h) = (side(page.x), side(page.y));
-    let fit = |margin: f32| {
-        let s = ((area.width() - 2.0 * margin).max(1.0) / w).min(area.height().max(1.0) / h);
-        Rect::from_center_size(area.center(), vec2(w * s, h * s))
-    };
-    let wide = fit(16.0);
-    // The checkbox sits at (8, 8)-(28, 28) from the cell's corner; keep 4 px clear of it.
-    let checkbox = Rect::from_min_size(cell.min + vec2(8.0, 8.0), Vec2::splat(20.0)).expand(4.0);
-    if wide.intersects(checkbox) { fit(30.0) } else { wide }
-}
-
-/// The organize toolbar: page operations on the selection (Acrobat's Organize Pages bar).
-fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
-    let targets = view.target_pages();
-    let n = info.pages.len();
-    let (first, last) = (targets.first().copied().unwrap_or(0), targets.last().copied().unwrap_or(0));
-    egui::Frame::NONE.fill(t.chrome).inner_margin(egui::Margin::symmetric(16, 8)).show(ui, |ui| {
-        ui.horizontal(|ui| {
-            ui.spacing_mut().item_spacing.x = 4.0;
-            let label = match view.selected.len() {
-                0 => crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &(view.current + 1).to_string()), ("n", &n.to_string())]),
-                1 => tl!("1 page selected").to_string(),
-                k => crate::i18n::fmt(tl!("{n} pages selected"), &[("n", &k.to_string())]),
-            };
-            // Fixed width so the buttons never shift as the selection text changes.
-            ui.add_sized([150.0, 30.0], egui::Label::new(egui::RichText::new(label).font(theme::medium(13.0)).color(t.text_muted)).truncate());
-            ui.add_enabled_ui(editable, |ui| {
-                ui.add_space(8.0);
-                if ui.add_enabled_ui(first > 0, |ui| icons::button(ui, "chevron-left", 30.0, false, tl!("Move earlier"))).inner.clicked() {
-                    view.pending_edit = Some(Edit::MovePages { pages: targets.clone(), to: first - 1 });
-                }
-                if ui.add_enabled_ui(last + 1 < n, |ui| icons::button(ui, "chevron-right", 30.0, false, tl!("Move later"))).inner.clicked() {
-                    view.pending_edit = Some(Edit::MovePages { pages: targets.clone(), to: first + 1 });
-                }
-            });
-            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                if widgets::ghost_button(ui, "x", tl!("Close")).on_hover_text(tl!("Back to the document")).clicked() {
-                    view.organize = false;
-                }
-                // What the grid shows is what is saved.
-                let save = ui.add_enabled_ui(dirty, |ui| widgets::pill_button(ui, tl!("Save pages"), true)).inner;
-                if save.on_hover_text(tl!("Save these pages as one PDF")).on_disabled_hover_text(tl!("No changes to save")).clicked() {
-                    view.pending_action = Some(ViewAction::Save);
-                }
-                ui.add_space(8.0);
-                // Page size in the grid (right to left: in, the percentage, out).
-                let zoom = view.grid_zoom;
-                if ui
-                    .add_enabled_ui(zoom < *GRID_ZOOM_RANGE.end(), |ui| icons::button(ui, "zoom-in", 30.0, false, tl!("Larger pages")))
-                    .inner
-                    .clicked()
-                {
-                    view.grid_zoom_request = Some(zoom * GRID_ZOOM_STEP);
-                }
-                let percent = egui::Button::new(egui::RichText::new(format!("{:.0}%", zoom * 100.0)).font(theme::medium(12.0)).color(t.text_muted))
-                    .frame(false);
-                let percent = ui.add_sized([44.0, 30.0], percent);
-                percent.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Reset page size")));
-                if percent.on_hover_text(tl!("Reset page size")).clicked() {
-                    view.grid_zoom_request = Some(1.0);
-                }
-                if ui
-                    .add_enabled_ui(zoom > *GRID_ZOOM_RANGE.start(), |ui| icons::button(ui, "zoom-out", 30.0, false, tl!("Smaller pages")))
-                    .inner
-                    .clicked()
-                {
-                    view.grid_zoom_request = Some(zoom / GRID_ZOOM_STEP);
-                }
-            });
-        });
-    });
-    // Keys act on the selection unless a text field or a dialog has them (Delete under
-    // Preferences deleted the selected pages).
-    if editable && unobstructed && !ui.ctx().egui_wants_keyboard_input() {
-        use egui::{Key, Modifiers};
-        let (del, esc) = ui.input_mut(|i| {
-            (
-                i.consume_key(Modifiers::NONE, Key::Delete) || i.consume_key(Modifiers::NONE, Key::Backspace),
-                i.consume_key(Modifiers::NONE, Key::Escape),
-            )
-        });
-        // ⌘C / ⌘X / ⌘V copy, cut and paste pages (egui delivers them as clipboard events).
-        let (copy, cut, paste) = ui.input(|i| {
-            let any = |f: &dyn Fn(&egui::Event) -> bool| i.events.iter().any(f);
-            (any(&|e| matches!(e, egui::Event::Copy)), any(&|e| matches!(e, egui::Event::Cut)), any(&|e| matches!(e, egui::Event::Paste(_))))
-        });
-        if copy || cut {
-            view.pending_action = Some(ViewAction::CopyPages { cut });
-        }
-        if paste {
-            view.pending_action = Some(ViewAction::PastePages);
-        }
-        if del && targets.len() < n {
-            view.pending_edit = Some(Edit::DeletePages { pages: targets });
-        }
-        if esc {
-            view.selected.clear();
-        }
-    }
-}
-
-/// Organize pages: a thumbnail grid (Acrobat's Organize Pages view). Click selects, ⌘-click
-/// toggles, ⇧-click extends; double-click opens the page.
-/// The gap (0 = before the first page, n = after the last) the pointer points at in the grid.
-pub(crate) fn drop_gap(cells: &[(usize, Rect)], p: Pos2) -> Option<usize> {
-    let (i, r) = cells.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(p).total_cmp(&b.distance_sq_to_pos(p)))?;
-    Some(if p.x < r.center().x { *i } else { i + 1 })
-}
-
-/// Ctrl (Option on macOS) held when a page drag drops copies the dragged pages into the gap
-/// instead of moving them, as Acrobat's Organize Pages does.
-///
-/// The OS comes from the context, not `cfg!`: the wasm build runs on macOS too, where
-/// `cfg!(target_os = "macos")` is false, so Option has to copy there as well (#3092 review).
-fn copy_modifier(ctx: &egui::Context, m: &egui::Modifiers) -> bool {
-    if crate::commands::mac_shortcuts(ctx) { m.alt } else { m.ctrl }
-}
-
-/// A "+" on a gap of the page grid: insert files there. Returns whether it was clicked.
-fn gap_button(ui: &mut egui::Ui, gap: usize, at: Pos2, height: f32, label: String, t: &Tokens) -> bool {
-    let resp = ui.interact(Rect::from_center_size(at, Vec2::splat(22.0)), ui.id().with(("org-gap", gap)), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label.clone()));
-    let hot = resp.hovered();
-    if hot {
-        ui.painter().line_segment([pos2(at.x, at.y - height / 2.0), pos2(at.x, at.y + height / 2.0)], Stroke::new(3.0, t.accent));
-    }
-    ui.painter().circle(at, 9.0, if hot { t.accent } else { t.chrome }, Stroke::new(1.0, if hot { t.accent } else { t.border }));
-    let ink = Stroke::new(1.5, if hot { Color32::WHITE } else { t.text_muted });
-    ui.painter().line_segment([at - vec2(4.0, 0.0), at + vec2(4.0, 0.0)], ink);
-    ui.painter().line_segment([at - vec2(0.0, 4.0), at + vec2(0.0, 4.0)], ink);
-    resp.on_hover_text(label).clicked()
-}
-
-fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
-    let ppp = ui.ctx().pixels_per_point();
-    // The page image scales with the zoom; the padding and the page number don't.
-    let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 88.0);
-    let anchor = view.grid_anchor.take();
-    let reveal = view.grid_reveal.take();
-    let mut open_page = None;
-    organize_toolbar(view, info, editable, dirty, unobstructed, ui, t);
-    let viewport = ui.available_rect_before_wrap();
-    view.viewport_screen = viewport;
-    let auto_delta = if unobstructed {
-        view.auto_scroll.update(ui, viewport, true)
-    } else {
-        view.auto_scroll.cancel();
-        Vec2::ZERO
-    };
-    let middle_gesture = view.auto_scroll.blocks_input();
-    let mut cells: Vec<(usize, Rect)> = Vec::new();
-    // The pages in view that are drawn larger than their thumbnails, and those of them that
-    // need a sharper render than they have. The width is the size drawn, in device pixels.
-    let (mut in_view, mut sharper): (Vec<(usize, f32)>, Vec<RenderRequest>) = (Vec::new(), Vec::new());
-    // The source cell can scroll out of the virtualized rows during a drag.
-    let mut drop = view.org_drag.is_some() && ui.input(|i| i.pointer.primary_released());
-    egui::ScrollArea::vertical().auto_shrink([false, false]).show_viewport(ui, |ui, clip| {
-        if middle_gesture {
-            let opacity = ui.opacity();
-            ui.disable();
-            ui.set_opacity(opacity);
-        }
-        if auto_delta != Vec2::ZERO {
-            ui.scroll_with_delta_animation(auto_delta, egui::style::ScrollAnimation::none());
-        }
-        ui.add_space(20.0);
-        let cols = ((ui.available_width() - 40.0) / cell.x).floor().max(1.0) as usize;
-        let rows = info.pages.len().div_ceil(cols);
-        let left = (ui.available_width() - cols as f32 * cell.x) / 2.0;
-        let (grid, _) = ui.allocate_exact_size(vec2(ui.available_width(), rows as f32 * cell.y), Sense::hover());
-        // The page Organize opened on may lie in a row the virtualized grid has not laid out,
-        // so its cell is computed rather than found.
-        if let Some(page) = reveal.filter(|p| *p < info.pages.len()) {
-            let row = page / cols;
-            let col = page % cols;
-            let c = Rect::from_min_size(pos2(grid.left() + left + col as f32 * cell.x, grid.top() + row as f32 * cell.y), cell);
-            ui.scroll_to_rect_animation(c, Some(egui::Align::Center), egui::style::ScrollAnimation::none());
-        }
-        for row in thumbnail_rows(clip.top() - 20.0, clip.bottom() - 20.0, cell.y, rows) {
-            let row_rect = Rect::from_min_size(grid.min + vec2(0.0, row as f32 * cell.y), vec2(grid.width(), cell.y));
-            for col in 0..cols {
-                let i = row * cols + col;
-                let Some(p) = info.pages.get(i) else { break };
-                let c = Rect::from_min_size(pos2(row_rect.left() + left + col as f32 * cell.x, row_rect.top()), cell);
-                view.need_thumbnail(i, c.intersects(ui.clip_rect()));
-                let resp = ui.interact(c, ui.id().with(("org", i)), if editable { Sense::click_and_drag() } else { Sense::click() });
-                cells.push((i, c));
-                if let Some((_, above)) = anchor.filter(|(page, _)| *page == i) {
-                    ui.scroll_to_rect_animation(c.translate(vec2(0.0, -above)), Some(egui::Align::Min), egui::style::ScrollAnimation::none());
-                }
-                // Drag pages to move them (the selection, or the page grabbed).
-                if resp.drag_started() {
-                    if !view.selected.contains(&i) {
-                        view.selected = [i].into();
-                        view.select_anchor = Some(i);
-                    }
-                    let mut pages: Vec<usize> = view.selected.iter().copied().collect();
-                    pages.sort_unstable();
-                    view.org_drag = Some(pages);
-                }
-                if resp.drag_stopped() {
-                    drop = true;
-                }
-                let page_label = crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.label)]);
-                resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, view.selected.contains(&i), page_label.clone()));
-                let pr = grid_page_rect(c, vec2(p.width, p.height));
-                let size = pr.size();
-                let selected = view.selected.contains(&i) || (view.selected.is_empty() && i == view.current);
-                if selected || resp.hovered() {
-                    ui.painter().rect_filled(c.shrink(6.0), CornerRadius::same(8), if selected { t.accent_soft } else { t.hover });
-                }
-                if view.selected.contains(&i) {
-                    ui.painter().rect_stroke(c.shrink(6.0), CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
-                }
-                ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
-                ui.painter().rect_filled(pr, CornerRadius::ZERO, Color32::WHITE);
-                // A page drawn larger than its thumbnail gets a render at the size drawn, while
-                // it is in view; until that arrives the thumbnail stands in.
-                let want = size.x * ppp;
-                let thumb = view.thumbs.get(&i).map(|t| &t.tex);
-                let thumb_ok = thumb.is_some_and(|t| t.size()[0] as f32 >= want * GRID_SHARP.start());
-                let sharp = view.grid_pages.get(&i).filter(|_| !thumb_ok);
-                if !thumb_ok && ui.is_rect_visible(c) {
-                    in_view.push((i, want));
-                    if !sharp.is_some_and(|(w, _)| sharp_enough(*w, want)) && !view.errors.contains_key(&i) {
-                        sharper.push(RenderRequest {
-                            page: i,
-                            kind: RequestKind::Pixels,
-                            tile: None,
-                            scale: want / p.width.max(1.0),
-                            tag: GRID_TAG,
-                            // Grid cells are previews: tiny images are skipped for them.
-                            preview: true,
-                        });
-                    }
-                }
-                if let Some(tex) = sharp.map(|(_, t)| t).or(thumb) {
-                    ui.painter().image(tex.id(), pr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
-                }
-                ui.painter().rect_stroke(pr, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
-                let label_font = theme::medium(12.0);
-                let label_w = (c.width() - 12.0).max(0.0);
-                let page_label = crate::widgets::fit_line(&p.label, label_w, |s| crate::widgets::text_width(ui, s, &label_font));
-                let label_pos = pos2(c.center().x, c.bottom() - 48.0);
-                ui.painter().with_clip_rect(Rect::from_center_size(label_pos, vec2(label_w, 18.0))).text(
-                    label_pos,
-                    Align2::CENTER_CENTER,
-                    page_label,
-                    label_font,
-                    t.text_muted,
-                );
-                // The checkbox toggles just this page without requiring a modifier. Keep it
-                // outside the page image, including on very tall or wide pages.
-                let mut checked = view.selected.contains(&i);
-                let check_rect = Rect::from_min_size(c.min + vec2(8.0, 8.0), Vec2::splat(20.0));
-                let check = ui.push_id(("org-check", i), |ui| ui.put(check_rect, widgets::checkbox_without_text(&mut checked))).inner;
-                let label = crate::i18n::fmt(tl!("Select page {label}"), &[("label", &p.label)]);
-                check.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, checked, label.clone()));
-                if check.on_hover_text(label).changed() {
-                    view.click_page(i, egui::Modifiers::COMMAND, false);
-                    // The document shows the page picked here when the grid closes, as after a
-                    // Pages-panel click, so reopening the grid keeps the pick (issue #1910).
-                    view.go_to_page(i);
-                }
-                // Local actions always target the labelled page. The toolbar above the grid
-                // remains the place for actions on the whole selection.
-                if selected || resp.contains_pointer() || resp.has_focus() {
-                    let actions = Rect::from_center_size(pos2(c.center().x, c.bottom() - 24.0), vec2(84.0, 26.0));
-                    ui.scope_builder(
-                        egui::UiBuilder::new().id_salt(("org-actions", i)).max_rect(actions).layout(egui::Layout::left_to_right(egui::Align::Center)),
-                        |ui| {
-                            ui.spacing_mut().item_spacing.x = 3.0;
-                            ui.add_enabled_ui(editable, |ui| {
-                                for (icon, degrees, key) in
-                                    [("rotate-ccw", -90, "Rotate page {label} counterclockwise"), ("rotate-cw", 90, "Rotate page {label} clockwise")]
-                                {
-                                    let label = crate::i18n::fmt(tl!(key), &[("label", &p.label)]);
-                                    if icons::button(ui, icon, 26.0, false, &label).clicked() {
-                                        view.pending_edit = Some(Edit::RotatePages { pages: vec![i], degrees });
-                                    }
-                                }
-                                let label = crate::i18n::fmt(tl!("Delete page {label}"), &[("label", &p.label)]);
-                                if ui.add_enabled_ui(info.pages.len() > 1, |ui| icons::button(ui, "trash-2", 26.0, false, &label)).inner.clicked() {
-                                    view.pending_edit = Some(Edit::DeletePages { pages: vec![i] });
-                                }
-                            });
-                        },
-                    );
-                }
-                if resp.clicked() {
-                    let m = ui.input(|i| i.modifiers);
-                    view.click_page(i, m, false);
-                    view.go_to_page(i);
-                }
-                if resp.double_clicked() {
-                    open_page = Some(i);
-                }
-                // Right-click: Extract, Replace, Cut, Copy, Paste (on the selection, or this page).
-                resp.context_menu(|ui| {
-                    if !view.selected.contains(&i) {
-                        view.selected = [i].into();
-                        view.go_to_page(i);
-                    }
-                    if ui.button(tl!("Extract pages")).clicked() {
-                        view.pending_action = Some(ViewAction::Extract);
-                        ui.close();
-                    }
-                    if ui.button(tl!("Split document…")).clicked() {
-                        view.pending_action = Some(ViewAction::SplitBeforeSelected);
-                        ui.close();
-                    }
-                    if ui.add_enabled(editable, egui::Button::new(tl!("Replace pages…"))).clicked() {
-                        view.pending_action = Some(ViewAction::ReplacePages);
-                        ui.close();
-                    }
-                    ui.separator();
-                    if ui.add_enabled(editable, egui::Button::new(tl!("Cut"))).clicked() {
-                        view.pending_action = Some(ViewAction::CopyPages { cut: true });
-                        ui.close();
-                    }
-                    if ui.button(tl!("Copy")).clicked() {
-                        view.pending_action = Some(ViewAction::CopyPages { cut: false });
-                        ui.close();
-                    }
-                    if ui.add_enabled(editable, egui::Button::new(tl!("Paste after"))).clicked() {
-                        view.pending_action = Some(ViewAction::PastePages);
-                        ui.close();
-                    }
-                });
-            }
-        }
-        // Between pages (and at both ends): insert files right there.
-        if editable && !middle_gesture && view.org_drag.is_none() {
-            let mid = |r: &Rect| r.top() + 16.0 + (cell.y - 88.0) / 2.0;
-            for (i, c) in &cells {
-                let label = info
-                    .pages
-                    .get(*i)
-                    .map(|p| crate::i18n::fmt(tl!("Insert a file before page {label}"), &[("label", &p.label)]))
-                    .unwrap_or_default();
-                if gap_button(ui, *i, pos2(c.left(), mid(c)), cell.y - 88.0, label, t) {
-                    view.pending_action = Some(ViewAction::InsertFromFileAt(*i));
-                }
-            }
-            if let Some((i, c)) = cells.last()
-                && i + 1 == info.pages.len()
-                && gap_button(ui, i + 1, pos2(c.right(), mid(c)), cell.y - 88.0, tl!("Insert a file at the end").to_string(), t)
-            {
-                view.pending_action = Some(ViewAction::InsertFromFileAt(i + 1));
-            }
-        }
-        // While dragging: the gap the pages would go to, drawn as a bar.
-        if let (Some(pages), Some(p)) = (view.org_drag.clone(), ui.input(|i| i.pointer.hover_pos())) {
-            // Ctrl (Option on macOS) held over the drop copies the pages; see #2997.
-            let copying = copy_modifier(ui.ctx(), &ui.input(|i| i.modifiers));
-            if let Some(gap) = drop_gap(&cells, p) {
-                let x = match cells.iter().find(|(i, _)| *i == gap) {
-                    Some((_, r)) => r.left() + 3.0,
-                    None => cells.last().map_or(0.0, |(_, r)| r.right() - 3.0),
-                };
-                let row = cells.iter().find(|(i, _)| *i == gap).or(cells.last()).map(|(_, r)| r.y_range()).unwrap_or(egui::Rangef::new(0.0, 0.0));
-                ui.painter().line_segment([pos2(x, row.min + 10.0), pos2(x, row.max - 10.0)], Stroke::new(3.0, t.accent));
-                let mut text_at = p + vec2(14.0, 14.0);
-                if copying {
-                    // A "+" by the pointer: this drop copies the pages, it doesn't move them.
-                    let badge = p + vec2(12.0, 12.0);
-                    ui.painter().circle(badge, 9.0, t.accent, Stroke::new(1.0, t.accent));
-                    let ink = Stroke::new(1.5, Color32::WHITE);
-                    ui.painter().line_segment([badge - vec2(4.0, 0.0), badge + vec2(4.0, 0.0)], ink);
-                    ui.painter().line_segment([badge - vec2(0.0, 4.0), badge + vec2(0.0, 4.0)], ink);
-                    text_at.x += 18.0;
-                }
-                ui.painter().text(
-                    text_at,
-                    Align2::LEFT_TOP,
-                    if pages.len() == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &pages.len().to_string())]) },
-                    theme::medium(12.0),
-                    t.accent_text,
-                );
-            }
-            if drop {
-                view.org_drag = None;
-                if let Some(gap) = drop_gap(&cells, p) {
-                    if copying {
-                        // The copies land at the gap as it is: nothing leaves its place.
-                        view.pending_edit = Some(Edit::DuplicatePages { pages: pages.clone(), at: Some(gap) });
-                        view.selected = (gap..gap + pages.len()).collect();
-                    } else {
-                        // `to` counts positions without the moving pages.
-                        let to = gap - pages.iter().filter(|x| **x < gap).count();
-                        let first = pages[0];
-                        let contiguous = pages.windows(2).all(|w| w[1] == w[0] + 1);
-                        if !(contiguous && to == first) {
-                            view.pending_edit = Some(Edit::MovePages { pages: pages.clone(), to });
-                            view.selected = (to..to + pages.len()).collect();
-                        }
-                    }
-                }
-            }
-        } else if drop {
-            view.org_drag = None;
-        }
-    });
-    // Files dragged in from outside go to the gap under the pointer. Some platforms don't say
-    // where the pointer is until the files are dropped; then the whole grid is the target.
-    let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| viewport.contains(*p));
-    view.grid_gap = pointer.filter(|_| editable && view.org_drag.is_none()).and_then(|p| drop_gap(&cells, p));
-    if editable && ui.input(|i| !i.raw.hovered_files.is_empty()) {
-        let painter = ui.painter().with_clip_rect(viewport);
-        painter.rect_stroke(viewport.shrink(2.0), CornerRadius::same(6), Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
-        if let Some(gap) = view.grid_gap {
-            let at = cells.iter().find(|(i, _)| *i == gap).map(|(_, r)| (r.left() + 3.0, r.y_range()));
-            if let Some((x, row)) = at.or(cells.last().map(|(_, r)| (r.right() - 3.0, r.y_range()))) {
-                painter.line_segment([pos2(x, row.min + 10.0), pos2(x, row.max - 10.0)], Stroke::new(3.0, t.accent));
-            }
-        }
-        // A "+" that follows the pointer.
-        if let Some(p) = pointer {
-            let at = p + vec2(16.0, 16.0);
-            painter.circle_filled(at, 9.0, t.accent);
-            painter.line_segment([at - vec2(4.0, 0.0), at + vec2(4.0, 0.0)], Stroke::new(1.5, Color32::WHITE));
-            painter.line_segment([at - vec2(0.0, 4.0), at + vec2(0.0, 4.0)], Stroke::new(1.5, Color32::WHITE));
-        }
-    }
-    view.auto_scroll.paint(ui, viewport);
-    // Pinch, or Ctrl/⌘ with the wheel, zooms the grid about the page under the pointer.
-    let pinch = crate::motion::zoom_delta(ui.ctx());
-    if (pinch - 1.0).abs() > 0.001 && pointer.is_some() && !middle_gesture {
-        view.grid_zoom_request = Some(view.grid_zoom * pinch);
-    }
-    if let Some(zoom) = view.grid_zoom_request.take() {
-        let before = view.grid_zoom;
-        view.set_grid_zoom(zoom);
-        if view.grid_zoom != before {
-            // Keep the page under the pointer (or else the first one in view) where it is.
-            let under = pointer.and_then(|p| cells.iter().find(|(_, r)| r.contains(p)));
-            let anchor = under.or_else(|| cells.iter().find(|(_, r)| r.bottom() > viewport.top()));
-            view.grid_anchor = anchor.map(|(i, r)| (*i, r.top() - viewport.top()));
-            ui.ctx().request_repaint();
-        }
-    }
-    // When this frame's thumbnail will cover the cell, drop the sharp render without waiting
-    // for that texture to arrive.
-    let density = thumbnail_density(view.thumb_demand.len(), ppp);
-    in_view.retain(|&(page, want)| {
-        info.pages.get(page).is_none_or(|p| (device_pixels(p.width, thumbnail_scale(p.width, p.height, density)) as f32) < want * GRID_SHARP.start())
-    });
-    sharper.retain(|req| in_view.iter().any(|(page, _)| *page == req.page));
-    view.grid_pages.retain(|page, _| in_view.iter().any(|(kept, _)| kept == page));
-    // Sharp renders of the pages in view join this frame's demand ahead of the thumbnails.
-    view.frame_queue.extend(sharper);
-    if let Some(p) = open_page {
-        view.organize = false;
-        view.go_to_page(p);
-    }
-}
-
-/// A rendered raster as texture data. Its words are premultiplied RGBA bytes, exactly
-/// `Color32`s, so the renderer's buffer becomes the image without a copy on the UI thread.
-pub(crate) fn texture_image(size: [usize; 2], pixels: pdfcraft_render::Pixels) -> egui::ColorImage {
-    match bytemuck::allocation::try_cast_vec::<u32, Color32>(pixels.into_words()) {
-        Ok(px) if px.len() == size[0].saturating_mul(size[1]) => egui::ColorImage::new(size, px),
-        Ok(px) => egui::ColorImage::from_rgba_premultiplied(size, bytemuck::cast_slice(&px)),
-        Err((_, words)) => egui::ColorImage::from_rgba_premultiplied(size, bytemuck::cast_slice(&words)),
-    }
-}
-
-/// A luminance preview for a monochrome print. `Color32` stores premultiplied pixels, so a
-/// non-opaque colour's alpha is restored after multiplying the unmultiplied RGB by its
-/// luminance. This uses the display gamma-space weights users expect in editors/print dialogs,
-/// not the linear-light coefficients of a colour-managed render.
-fn grayscale(mut img: egui::ColorImage) -> egui::ColorImage {
-    for c in img.pixels.iter_mut() {
-        let a = c.a();
-        let luminance = f32::from(c.r()) * 0.299_f32 + f32::from(c.g()) * 0.587_f32 + f32::from(c.b()) * 0.114_f32;
-        let gray = if a == 0 || a == 255 {
-            luminance.round() as u8
-        } else {
-            // Unmultiply first, so translucent content keeps its paper-relative luminance.
-            let f = f32::from(a) / 255.0;
-            let un = [f32::from(c.r()) / f, f32::from(c.g()) / f, f32::from(c.b()) / f];
-            let l = un[0] * 0.299_f32 + un[1] * 0.587_f32 + un[2] * 0.114_f32;
-            (f * l).round() as u8
-        };
-        *c = Color32::from_rgba_premultiplied(gray, gray, gray, a);
-    }
-    img
-}
-
 #[cfg(test)]
-mod tests {
-    #[test]
-    fn zoom_anchor_scroll_stays_within_the_content() {
-        let (content, viewport) = (vec2(1000.0, 2000.0), vec2(800.0, 600.0));
-        // Past the end: clamped to the maximum (200, 1400), not left for egui to snap back.
-        assert_eq!(anchored_scroll(pos2(900.0, 1900.0), vec2(0.0, 0.0), content, viewport), vec2(200.0, 1400.0));
-        // Before the start.
-        assert_eq!(anchored_scroll(pos2(10.0, 10.0), vec2(300.0, 300.0), content, viewport), Vec2::ZERO);
-        // Inside: unchanged.
-        assert_eq!(anchored_scroll(pos2(150.0, 800.0), vec2(100.0, 100.0), content, viewport), vec2(50.0, 700.0));
-        // Content smaller than the viewport: no scrolling.
-        assert_eq!(anchored_scroll(pos2(400.0, 400.0), Vec2::ZERO, vec2(500.0, 500.0), viewport), vec2(0.0, 0.0));
-    }
-
-    #[test]
-    fn page_size_hint_zone_is_the_bottom_left_quadrant() {
-        let area = Rect::from_min_max(pos2(100.0, 50.0), pos2(500.0, 450.0));
-        assert!(in_size_hint_zone(area, pos2(110.0, 440.0)));
-        assert!(!in_size_hint_zone(area, pos2(110.0, 100.0)), "top-left");
-        assert!(!in_size_hint_zone(area, pos2(400.0, 440.0)), "bottom-right");
-        assert!(!in_size_hint_zone(area, pos2(50.0, 440.0)), "outside");
-        assert!(!in_size_hint_zone(area, pos2(f32::NAN, 440.0)));
-    }
-
-    use super::*;
-
-    #[test]
-    fn typed_zoom_percentages_parse() {
-        for (typed, zoom) in [("150", 1.5), ("150%", 1.5), (" 62.5 % ", 0.625), ("6400%", 64.0)] {
-            assert_eq!(DocView::parse_zoom_percent(typed), Some(zoom), "{typed}");
-        }
-        for typed in ["", "%", "abc", "0", "-50", "NaN", "inf", "1e40", "150%%x", "%150"] {
-            assert_eq!(DocView::parse_zoom_percent(typed), None, "{typed}");
-        }
-    }
-
-    /// A rotated (landscape) page is drawn as wide as the cell allows and centred in the picture
-    /// area, as Acrobat draws it, not as a small strip pinned to the top; a portrait page still
-    /// fills the area's height; neither covers the checkbox corner or the label below.
-    #[test]
-    fn grid_pages_are_centred_and_as_large_as_the_cell_allows() {
-        let cell = Rect::from_min_size(pos2(100.0, 50.0), vec2(190.0, 282.0));
-        let area = Rect::from_min_max(pos2(cell.left(), cell.top() + 16.0), pos2(cell.right(), cell.bottom() - 72.0));
-        let checkbox = Rect::from_min_size(cell.min + vec2(8.0, 8.0), Vec2::splat(20.0));
-        let landscape = grid_page_rect(cell, vec2(842.0, 595.0));
-        assert!((landscape.center().y - area.center().y).abs() < 0.01, "centred vertically: {landscape:?}");
-        assert!((landscape.center().x - cell.center().x).abs() < 0.01);
-        assert!((landscape.width() - (cell.width() - 32.0)).abs() < 0.01, "as wide as the cell allows: {landscape:?}");
-        assert!(!landscape.intersects(checkbox));
-        let portrait = grid_page_rect(cell, vec2(595.0, 842.0));
-        assert!(area.contains_rect(portrait), "inside the picture area: {portrait:?}");
-        assert!((portrait.center().y - area.center().y).abs() < 0.01);
-        assert!(portrait.left() >= checkbox.right(), "clear of the checkbox: {portrait:?}");
-        // Degenerate sizes still give a finite rectangle inside the cell.
-        for page in [vec2(0.0, 0.0), vec2(1e9, 1.0), vec2(1.0, 1e9), vec2(f32::NAN, 10.0), vec2(f32::INFINITY, 10.0)] {
-            let r = grid_page_rect(cell, page);
-            assert!(r.is_finite() && cell.contains_rect(r), "{page:?} -> {r:?}");
-        }
-    }
-
-    fn annotation(fill_sign: bool) -> pdfcraft_render::Annotation {
-        pdfcraft_render::Annotation {
-            page: 0,
-            subtype: "FreeText".into(),
-            author: None,
-            contents: Some("Hello".into()),
-            modified: None,
-            name: None,
-            in_reply_to: None,
-            rect: [0.0; 4],
-            color: None,
-            index: 0,
-            state: None,
-            quads: Vec::new(),
-            locked: false,
-            intent: None,
-            fill_sign,
-            no_rotate: false,
-            points: Vec::new(),
-        }
-    }
-
-    #[test]
-    fn hover_popup_skips_fill_and_sign_marks() {
-        assert_eq!(annotation_hover_text(&annotation(false)).as_deref(), Some("FreeText\nHello"));
-        assert_eq!(annotation_hover_text(&annotation(true)), None);
-    }
-
-    fn signature(signed: bool, visible: bool, page: Option<usize>, rect: Option<[f64; 4]>) -> pdfcraft_engine::SignatureInfo {
-        pdfcraft_engine::SignatureInfo {
-            field: "Signature1".into(),
-            signed,
-            page,
-            rect,
-            visible,
-            signer: None,
-            certificate: None,
-            chain: Vec::new(),
-            date: None,
-            signing_time: None,
-            reason: None,
-            location: None,
-            contact: None,
-            sub_filter: None,
-            doc_timestamp: false,
-            certify: None,
-            revision: 1,
-            signed_len: 0,
-            digest: None,
-            algorithm: None,
-            timestamp: false,
-            timestamp_time: None,
-            status: pdfcraft_engine::SignatureStatus::Valid,
-            modification: pdfcraft_engine::sign::Modification::None,
-            details: Vec::new(),
-        }
-    }
-
-    #[test]
-    fn signature_badges_keep_signed_visible_widgets_on_the_page() {
-        let rect = [10.0, 10.0, 100.0, 50.0];
-        let signatures =
-            vec![signature(true, true, Some(0), Some(rect)), signature(true, true, Some(1), Some(rect)), signature(true, true, Some(0), Some(rect))];
-        let badges = signature_badges(&signatures, 0);
-        assert_eq!(badges.len(), 2);
-        assert_eq!(badges[0].rect, rect);
-    }
-
-    #[test]
-    fn signature_badges_skip_unsigned_invisible_and_unplaced_fields() {
-        let rect = [10.0, 10.0, 100.0, 50.0];
-        let signatures = vec![
-            signature(false, true, Some(0), Some(rect)),
-            signature(true, false, Some(0), Some(rect)),
-            signature(true, true, Some(0), None),
-            signature(true, true, Some(0), Some(rect)),
-        ];
-        let badges = signature_badges(&signatures, 0);
-        assert_eq!(badges.len(), 1);
-        assert_eq!(badges[0].rect, rect);
-    }
-
-    #[test]
-    fn signature_badges_skip_rectangles_that_cannot_reach_the_screen() {
-        let hostile = vec![
-            [f64::NAN, 10.0, 100.0, 50.0],
-            [10.0, f64::INFINITY, 100.0, 50.0],
-            [10.0, 10.0, f64::NEG_INFINITY, 50.0],
-            [10.0, 10.0, 1e300, 50.0],
-            [10.0, 10.0, 100.0, 50.0],
-        ];
-        let signatures: Vec<_> = hostile.into_iter().map(|rect| signature(true, true, Some(0), Some(rect))).collect();
-        let badges = signature_badges(&signatures, 0);
-        assert_eq!(badges.len(), 1);
-    }
-
-    #[test]
-    fn page_zoom_reads_the_side_the_page_width_is_on() {
-        // A 200 x 100 pt page at 2 pixels per point: 400 x 200 on screen, or 200 x 400 turned.
-        let xf = |rot: u16, size: Vec2| PageXform { rect: Rect::from_min_size(Pos2::ZERO, size), rot, pw: 200.0, ph: 100.0 };
-        for rot in [0, 180] {
-            assert_eq!(xf(rot, vec2(400.0, 200.0)).zoom(), 2.0, "{rot}");
-        }
-        for rot in [90, 270] {
-            assert_eq!(xf(rot, vec2(200.0, 400.0)).zoom(), 2.0, "{rot}: the width runs down the screen");
-        }
-    }
-
-    #[test]
-    fn snapshot_tabs_read_like_their_source_plus_the_suffix() {
-        let snap = Snapshot { kind: SnapshotKind::SignedVersion, revision: 1, from: "report.pdf".into() };
-        assert_eq!(snapshot_tab_name("Report", "report.pdf", &snap), "Report (signed version)");
-        let rev = Snapshot { kind: SnapshotKind::Revision, revision: 2, from: "report.pdf".into() };
-        assert_eq!(snapshot_tab_name("Report", "report.pdf", &rev), "Report (revision 2)");
-        assert_eq!(snapshot_tab_name("report.pdf", "report.pdf", &snap), "report.pdf");
-        assert_eq!(snapshot_tab_name("report (revision 2).pdf", "report (revision 2).pdf", &rev), "report (revision 2).pdf");
-    }
-
-    #[test]
-    fn grayscale_converts_colours_to_their_luminance() {
-        let img = egui::ColorImage::new([2, 1], vec![Color32::from_rgb(255, 0, 0), Color32::from_rgba_premultiplied(0, 51, 102, 128)]);
-        let gray = grayscale(img);
-        let opaque = gray.pixels[0];
-        assert_eq!(opaque.to_array(), [76, 76, 76, 255]);
-        // Unmultiply RGB first, so a translucent colour keeps its paper-relative luminance.
-        let translucent = gray.pixels[1];
-        assert_eq!(translucent.to_array(), [42, 42, 42, 128]);
-    }
-
-    #[test]
-    fn black_white_and_transparents_are_preserved_by_grayscale() {
-        let img = egui::ColorImage::new([3, 1], vec![Color32::BLACK, Color32::WHITE, Color32::TRANSPARENT]);
-        let gray = grayscale(img);
-        assert_eq!(gray.pixels[0].to_array(), [0, 0, 0, 255]);
-        assert_eq!(gray.pixels[1].to_array(), [255, 255, 255, 255]);
-        assert_eq!(gray.pixels[2].to_array(), [0, 0, 0, 0]);
-    }
-
-    #[test]
-    fn rendered_rasters_become_texture_images_without_a_copy() {
-        let pdf = b"%PDF-1.4
-1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
-2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
-3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
-4 0 obj << /Length 35 >> stream
-0 0 1 rg 10 10 30 20 re f
-endstream endobj
-trailer << /Root 1 0 R >>
-%%EOF";
-        let mut r = pdfcraft_render::PageRenderer::new(Arc::new(pdf.to_vec()), Default::default());
-        let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.5, tag: 0, preview: false });
-        assert!(out.error.is_none(), "{:?}", out.error);
-        let size = [out.width as usize, out.height as usize];
-        let copied = egui::ColorImage::from_rgba_premultiplied(size, &out.rgba);
-        let at = out.rgba.as_ptr();
-        let img = texture_image(size, out.rgba);
-        assert_eq!(img, copied);
-        assert_eq!(img.pixels.as_ptr().cast::<u8>(), at, "the renderer's own buffer");
-    }
-
-    #[test]
-    fn tiles_stay_granular_up_close_and_cover_giant_sheets_in_a_handful() {
-        // Ordinary zooms keep 1024 px tiles; degenerate scales fall back to it, never zero.
-        assert_eq!(tile_side(1.0, 2000), TILE);
-        assert_eq!(tile_side(4.0, 2000), TILE);
-        assert_eq!(tile_side(f32::NAN, 2000), TILE);
-        assert_eq!(tile_side(f32::INFINITY, 2000), TILE);
-        assert_eq!(tile_side(0.0, 2000), TILE);
-        // Zoomed viewports need a few large tiles instead of many small ones.
-        assert_eq!(tile_side(12.0, 2000), 2048);
-        assert_eq!(tile_side(20.0, 2000), 3413);
-        assert_eq!(tile_side(100.0, 2000), 4096);
-        // A giant sheet at fit width (6740 px long side) is covered four tiles a side.
-        assert_eq!(tile_side(96.0 / 72.0, 6740), 1685);
-        // The backend clamps tile sides at 4096.
-        assert_eq!(tile_side(20.0, 100_000), 4096);
-    }
-
-    #[test]
-    fn grid_zoom_is_clamped_and_sharp_renders_tolerate_a_pinch() {
-        assert!(sharp_enough(900, 876.0) && sharp_enough(800, 876.0) && sharp_enough(1300, 876.0));
-        assert!(!sharp_enough(264, 876.0), "a thumbnail stretched over a zoomed page");
-        assert!(!sharp_enough(876, 200.0), "far larger than drawn: wasteful");
-        assert!(!sharp_enough(100, 0.0) && !sharp_enough(100, f32::NAN));
-        let mut v = view(3, PageLayout::Single, true);
-        for odd in [f32::NAN, f32::INFINITY] {
-            v.set_grid_zoom(odd);
-            assert_eq!(v.grid_zoom(), 1.0);
-        }
-        v.set_grid_zoom(99.0);
-        assert_eq!(v.grid_zoom(), 3.0);
-        v.set_grid_zoom(-4.0);
-        assert_eq!(v.grid_zoom(), 0.5);
-    }
-
-    fn view(pages: usize, layout: PageLayout, continuous: bool) -> DocView {
-        let info = pdfcraft_render::DocInfo {
-            pages: (0..pages)
-                .map(|_| pdfcraft_render::PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 })
-                .collect(),
-            ..Default::default()
-        };
-        DocView::new(DocId(1), &info, ViewDefaults { layout, continuous, ..Default::default() })
-    }
-
-    fn history_search_view() -> DocView {
-        let mut v = view(5, PageLayout::Single, true);
-        v.texts.insert(
-            3,
-            pdfcraft_render::PageText {
-                glyphs: vec![pdfcraft_render::TextGlyph {
-                    text: "match".into(),
-                    rect: [20.0, 260.0, 60.0, 280.0],
-                    quad: [[20.0, 260.0], [60.0, 260.0], [60.0, 280.0], [20.0, 280.0]],
-                    direction: [1.0, 0.0],
-                }],
-                line_of: vec![0],
-                space_before: vec![false],
-            }
-            .into(),
-        );
-        v.find = Some(Find { matches: vec![(3, 0..1), (3, 0..1), (1, 0..1)], current: Some(2), ..Default::default() });
-        v
-    }
-
-    #[test]
-    fn explicit_search_jumps_record_history_and_keep_match_destination() {
-        for step in [None, Some(true), Some(false)] {
-            let mut v = history_search_view();
-            v.page_input = "draft in progress".into();
-            v.goto_point = Some((3, Some(0.8), Some(0.9), Vec2::ZERO));
-            if let Some(forward) = step {
-                v.find_step(forward);
-            } else {
-                v.go_to_match(0);
-            }
-            assert_eq!(v.back, vec![0], "explicit search jump must remember its origin");
-            assert_eq!(v.goto, Some((3, 0.5)), "keep the match offset instead of the page top");
-            assert_eq!(v.current, 3);
-            assert_eq!(v.current_page_label(None), "4");
-            // Chrome refreshes the idle page box; navigation must not overwrite a draft
-            // that may still be focused. DocView does not own the editor's focus state.
-            assert_eq!(v.page_input, "draft in progress");
-            assert!(v.goto_point.is_none(), "an earlier link destination cannot override the search offset");
-            v.go_to_match(1);
-            assert_eq!(v.back, vec![0], "same-page matches do not duplicate history");
-            assert!(v.view_history(false));
-            assert_eq!(v.current, 0);
-            assert!(v.view_history(true));
-            assert_eq!(v.current, 3);
-            assert!(v.view_history(false));
-            v.go_to_match(2);
-            assert!(v.forward.is_empty(), "a new explicit jump discards Forward");
-            assert_eq!(v.back, vec![0]);
-        }
-    }
-
-    #[test]
-    fn automatic_search_updates_do_not_record_history_or_discard_forward() {
-        let mut v = history_search_view();
-        v.forward = vec![4];
-        v.find = Some(Find { query: "match".into(), ..Default::default() });
-        v.rerun_find();
-        assert_eq!(v.current, 3);
-        assert_eq!(v.goto, Some((3, 0.5)));
-        assert!(v.back.is_empty());
-        assert_eq!(v.forward, vec![4]);
-        v.current = 0;
-        v.find.as_mut().unwrap().current = None;
-        v.refresh_find_page(3);
-        assert_eq!(v.current, 3);
-        assert!(v.back.is_empty());
-        assert_eq!(v.forward, vec![4]);
-    }
-
-    #[test]
-    fn text_layers_evict_far_pages_but_keep_visible_and_matches() {
-        let info = thumbnail_info(100);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        v.current = 50;
-        v.frame_visible = HashSet::from([50, 51]);
-        for p in 0..100 {
-            v.texts.insert(p, Arc::new(PageText::default()));
-        }
-        v.text_failed.insert(0);
-        v.text_failed.insert(99);
-        v.find = Some(Find { matches: vec![(0, 0..1)], ..Default::default() });
-        let _ = v.prepare_render_queue(&info, 1.0);
-        assert!(v.texts.contains_key(&50) && v.texts.contains_key(&51), "visible pages stay");
-        assert!(v.texts.contains_key(&0), "matched pages stay");
-        assert!(v.texts.contains_key(&49), "nearest prefetch window stays");
-        assert!(!v.texts.contains_key(&99), "far pages go");
-        assert_eq!(v.texts.len(), 2 + 1 + MAX_CACHED_TEXT_PAGES, "visible + matched + prefetch window");
-        assert!(v.text_failed.contains(&0) && v.text_failed.contains(&99), "failures are bytes-free: never evict");
-    }
-
-    /// A PDF of one line of text on each page, `lines[i]` on page `i`.
-    fn text_pages_pdf(lines: &[&str]) -> Vec<u8> {
-        let n = lines.len();
-        // 1 catalog, 2 pages, 3 font, then a page and its content stream for each line.
-        let mut objects = vec![
-            "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
-            format!("<< /Type /Pages /Count {n} /Kids [{}] >>", (0..n).map(|i| format!("{} 0 R", 4 + 2 * i)).collect::<Vec<_>>().join(" ")),
-            "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_string(),
-        ];
-        for (i, line) in lines.iter().enumerate() {
-            let content = format!("BT /F1 18 Tf 72 700 Td ({line}) Tj ET");
-            objects.push(format!(
-                "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 3 0 R >> >> /Contents {} 0 R >>",
-                5 + 2 * i
-            ));
-            objects.push(format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()));
-        }
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, o) in objects.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend(format!("{} 0 obj\n{o}\nendobj\n", i + 1).bytes());
-        }
-        let xref = out.len();
-        out.extend(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).bytes());
-        for o in offsets {
-            out.extend(format!("{o:010} 00000 n \n").bytes());
-        }
-        out.extend(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).bytes());
-        out
-    }
-
-    /// #2639: scrolling continuously, Select All takes every page's text, and Copy gets all of it
-    /// in page order, reading the pages whose text wasn't read for display.
-    #[test]
-    fn select_all_copies_the_whole_document_while_scrolling_continuously() {
-        let mut app = PdfCraftApp::new();
-        app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
-        let v = &mut app.views[0];
-        assert!(v.continuous, "continuous scrolling is the default");
-        assert!(v.texts.is_empty(), "no page's text read yet");
-        // Nothing shown is selected yet (false, as for a page whose text isn't read), but the whole
-        // document is: Copy reads every page.
-        assert!(!v.select_all());
-        assert!(v.all_text && v.selection.is_none());
-        assert_eq!(v.pages_without_text(), vec![0, 1, 2]);
-        // Copy reads the pages off the UI thread; the clipboard gets the text once they're read.
-        let ctx = egui::Context::default();
-        assert!(app.copy_selected_text(0, &ctx), "the copy starts");
-        assert!(app.document_copy.is_some(), "reading the pages, not on this thread");
-        let mut text = None;
-        for _ in 0..500 {
-            let mut out = ctx.run_ui(egui::RawInput::default(), |ui| app.finish_document_copy(ui.ctx()));
-            out.textures_delta.clear();
-            text = out.platform_output.commands.iter().find_map(|c| match c {
-                egui::OutputCommand::CopyText(t) => Some(t.clone()),
-                _ => None,
-            });
-            if text.is_some() {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(10));
-        }
-        let text = text.expect("the copied text arrives");
-        assert!(app.document_copy.is_none(), "done");
-        let at = |w: &str| text.find(w).unwrap_or_else(|| panic!("{w:?} missing from {text:?}"));
-        assert!(at("Alpha") < at("Bravo") && at("Bravo") < at("Charlie"), "page order: {text:?}");
-        assert_eq!(text.lines().count(), 3, "a line per page: {text:?}");
-        // A new scope ends it: one page at a time, Select All is the page's again.
-        app.views[0].set_continuous(false);
-        assert!(!app.views[0].all_text, "not after switching to one page at a time");
-        // So do a page selection and a change of the document's content (an edit, undo).
-        app.views[0].set_continuous(true);
-        app.views[0].select_all();
-        app.views[0].select_text(0, 0, 0);
-        assert!(!app.views[0].all_text, "a page selection replaces it");
-        app.views[0].select_all();
-        app.views[0].invalidate_content();
-        assert!(!app.views[0].all_text, "not past an edit of the document");
-    }
-
-    /// A whole-document copy reads the pages without text, keeps those already read and skips
-    /// those that failed before.
-    #[test]
-    fn a_document_copy_reads_only_the_pages_it_needs() {
-        let mut app = PdfCraftApp::new();
-        app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
-        app.views[0].text_failed.insert(2);
-        let job = crate::DocumentCopyJob::of(&app.views[0], app.session.get(app.views[0].id).unwrap());
-        let kinds: Vec<_> = job.pages.iter().map(|p| matches!(p, crate::CopyPage::ToRead)).collect();
-        assert_eq!(kinds, vec![true, true, false], "pages 1 and 2 to read, page 3 failed before");
-        assert!(matches!(job.pages[2], crate::CopyPage::Skip));
-    }
-
-    /// A later copy wins: a whole-document copy still reading its pages never replaces what was
-    /// copied after it started, from the page or anywhere else (a text field, a comment).
-    #[test]
-    fn a_later_copy_cancels_a_document_copy_still_reading() {
-        let mut app = PdfCraftApp::new();
-        app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
-        let ctx = egui::Context::default();
-        // Another copy in the same frame (here a text field's) drops it.
-        app.views[0].select_all();
-        assert!(app.copy_selected_text(0, &ctx) && app.document_copy.is_some());
-        let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
-            ui.ctx().copy_text("a word".to_owned());
-            app.finish_document_copy(ui.ctx());
-        });
-        out.textures_delta.clear();
-        assert!(app.document_copy.is_none(), "cancelled");
-        let copies: Vec<_> = out.platform_output.commands.iter().filter(|c| matches!(c, egui::OutputCommand::CopyText(_))).collect();
-        assert_eq!(copies, vec![&egui::OutputCommand::CopyText("a word".to_owned())], "the later copy stays");
-        // So does copying a page selection.
-        app.views[0].select_all();
-        assert!(app.copy_selected_text(0, &ctx) && app.document_copy.is_some());
-        app.views[0].select_text(0, 0, 5);
-        app.copy_selected_text(0, &ctx);
-        assert!(app.document_copy.is_none(), "a page selection's copy cancels it");
-    }
-
-    /// A press anywhere on a page ends Select All of the document, whatever the tool (here the
-    /// Hand, which selects no text) and whether the page's text is read yet.
-    #[test]
-    fn a_press_on_a_page_ends_select_all_of_the_document() {
-        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
-            let mut app = PdfCraftApp::new();
-            app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
-            app
-        });
-        let mut on_screen = None;
-        for _ in 0..600 {
-            h.run_steps(2);
-            on_screen = h.state().views[0].page_screen_rect(0);
-            if on_screen.is_some() {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        let r = on_screen.expect("the first page is on screen");
-        h.state_mut().quick_tool = crate::QuickTool::Hand;
-        h.state_mut().views[0].select_all();
-        assert!(h.state().views[0].all_text);
-        let at = r.center();
-        h.event(egui::Event::PointerMoved(at));
-        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
-        h.run_steps(1);
-        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
-        h.run_steps(2);
-        assert!(!h.state().views[0].all_text, "a press on the page ends it");
-
-        // A press while a dialog is up lands on the dialog, not the page: the selection stays.
-        h.state_mut().views[0].select_all();
-        h.state_mut().dialog = Some(crate::Dialog::JsConsole);
-        h.run_steps(2);
-        h.event(egui::Event::PointerMoved(at));
-        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
-        h.run_steps(1);
-        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
-        h.run_steps(2);
-        assert!(h.state().views[0].all_text, "a press beneath a dialog doesn't end it");
-    }
-
-    /// The pages of a whole-document copy come out in order whatever was read before, and a
-    /// cancelled copy gives nothing (a new copy or a closed document cancels the old one).
-    #[test]
-    fn a_document_copy_reads_in_page_order_and_stops_when_cancelled() {
-        let mut app = PdfCraftApp::new();
-        app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
-        // The middle page's text read for display already; the others read by the copy.
-        let doc = app.session.get(app.views[0].id).unwrap();
-        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), Default::default());
-        let middle = r.render(RenderRequest { page: 1, kind: RequestKind::Text, ..Default::default() }).text.unwrap();
-        app.views[0].texts.insert(1, middle);
-        let job = || crate::DocumentCopyJob::of(&app.views[0], app.session.get(app.views[0].id).unwrap());
-        let text = job().text(&std::sync::atomic::AtomicBool::new(false)).unwrap();
-        assert!(text.find("Alpha").unwrap() < text.find("Bravo").unwrap() && text.find("Bravo").unwrap() < text.find("Charlie").unwrap(), "{text:?}");
-        assert_eq!(job().text(&std::sync::atomic::AtomicBool::new(true)), None, "cancelled");
-    }
-
-    /// Select All keeps to the page shown one page at a time, and in a document of one page; of
-    /// the document, it reads the text already read and doesn't ask again for failed pages.
-    #[test]
-    fn select_all_of_the_document_only_while_scrolling_through_several_pages() {
-        let info = thumbnail_info(3);
-        let one_line = |s: &str| PageText {
-            glyphs: s
-                .chars()
-                .map(|c| pdfcraft_render::TextGlyph { text: c.into(), rect: [0.0, 0.0, 10.0, 10.0], quad: [[0.0, 0.0]; 4], direction: [1.0, 0.0] })
-                .collect(),
-            line_of: s.chars().map(|_| 0).collect(),
-            space_before: s.chars().map(|_| false).collect(),
-        };
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        for p in 0..3 {
-            v.texts.insert(p, Arc::new(one_line("abc")));
-        }
-        v.continuous = false;
-        v.current = 1;
-        assert!(v.select_all());
-        assert!(!v.all_text && v.selection.is_some_and(|s| s.page == 1), "one page at a time: the page shown");
-        let single = thumbnail_info(1);
-        let mut w = DocView::new(DocId(2), &single, ViewDefaults::default());
-        w.texts.insert(0, Arc::new(one_line("abc")));
-        assert!(w.select_all());
-        assert!(!w.all_text && w.selection.is_some(), "a one-page document: that page");
-        // Text read for display is used; pages that failed aren't asked for again.
-        let mut d = DocView::new(DocId(3), &info, ViewDefaults::default());
-        d.texts.insert(1, Arc::new(one_line("abc")));
-        d.text_failed.insert(2);
-        assert!(d.select_all() && d.all_text);
-        assert_eq!(d.pages_without_text(), vec![0]);
-    }
-
-    #[test]
-    fn text_layers_keep_the_selection_page() {
-        let info = thumbnail_info(100);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        let text = PageText {
-            glyphs: vec![pdfcraft_render::TextGlyph { text: "x".into(), rect: [0.0, 0.0, 10.0, 10.0], quad: [[0.0, 0.0]; 4], direction: [1.0, 0.0] }],
-            line_of: vec![0],
-            space_before: vec![false],
-        };
-        for p in 0..100 {
-            v.texts.insert(p, Arc::new(text.clone()));
-        }
-        v.select_text(0, 0, 0);
-        v.current = 90;
-        v.frame_visible = HashSet::from([90, 91]);
-        let _ = v.prepare_render_queue(&info, 1.0);
-        assert_eq!(v.selected_text().as_deref(), Some("x"), "stale selections still copy");
-    }
-
-    #[test]
-    fn text_layers_stay_while_a_search_is_active() {
-        let info = thumbnail_info(100);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        v.current = 50;
-        v.frame_visible = HashSet::from([50]);
-        for p in 0..100 {
-            v.texts.insert(p, Arc::new(PageText::default()));
-        }
-        v.find = Some(Find { query: "dup".into(), case_query: "dup".into(), matches: vec![(0, 0..1)], ..Default::default() });
-        let _ = v.prepare_render_queue(&info, 1.0);
-        assert_eq!(v.texts.len(), 100, "evicting mid-search would churn the workers");
-    }
-
-    fn thumbnail_info(count: usize) -> DocInfo {
-        DocInfo {
-            pages: (0..count)
-                .map(|i| {
-                    let (width, height) = match i % 3 {
-                        0 => (612.0, 792.0),
-                        1 => (200.0, 4000.0),
-                        _ => (4000.0, 200.0),
-                    };
-                    pdfcraft_render::PageInfo { width, height, label: (i + 1).to_string(), crop: [0.0, 0.0, width, height], rotation: 0 }
-                })
-                .collect(),
-            ..Default::default()
-        }
-    }
-
-    #[test]
-    fn ten_thousand_pages_only_demand_viewport_and_prefetch_at_both_densities() {
-        let info = thumbnail_info(10_000);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        let cols = 4;
-        let rows = info.pages.len().div_ceil(cols);
-        for ppp in [1.0, 2.0] {
-            for row in [0, 1234, rows - 1] {
-                v.begin_render_frame();
-                let range = thumbnail_rows(row as f32 * 250.0, row as f32 * 250.0 + 750.0, 250.0, rows);
-                for p in range.start * cols..(range.end * cols).min(info.pages.len()) {
-                    v.need_thumbnail(p, p / cols == row);
-                }
-                let queue = v.prepare_render_queue(&info, ppp);
-                assert!(queue.len() <= 5 * cols, "only three visible rows and two prefetch rows");
-                assert_eq!(queue.first().unwrap().page / cols, row, "visible cells precede prefetch");
-                let bytes: usize = queue
-                    .iter()
-                    .map(|r| {
-                        let p = &info.pages[r.page];
-                        let (w, h) = (device_pixels(p.width, r.scale), device_pixels(p.height, r.scale));
-                        assert!(w <= (THUMB_W * ppp).ceil() as u32);
-                        assert!(h <= (THUMB_H * ppp).ceil() as u32);
-                        rgba_bytes(w as usize, h as usize)
-                    })
-                    .sum();
-                assert!(bytes <= THUMB_BYTES);
-                assert_eq!(queue, v.prepare_render_queue(&info, ppp), "unchanged demand reconstructs the same work");
-            }
-        }
-    }
-
-    #[test]
-    fn oversized_thumbnail_viewport_scales_all_admitted_cells_to_one_budget() {
-        let info = thumbnail_info(10_000);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        for page in 0..MAX_THUMB_DEMAND {
-            v.need_thumbnail(page, true);
-        }
-        let queue = v.prepare_render_queue(&info, 2.0);
-        assert_eq!(queue.len(), MAX_THUMB_DEMAND);
-        let bytes: usize = queue
-            .iter()
-            .map(|r| {
-                let p = &info.pages[r.page];
-                rgba_bytes(device_pixels(p.width, r.scale) as usize, device_pixels(p.height, r.scale) as usize)
-            })
-            .sum();
-        assert!(bytes <= THUMB_BYTES);
-    }
-
-    fn solid_result(request: RenderRequest, w: u32, h: u32) -> pdfcraft_render::RenderedPage {
-        pdfcraft_render::RenderedPage {
-            request,
-            width: w,
-            height: h,
-            rgba: pdfcraft_render::Pixels::from(vec![u32::MAX; rgba_bytes(w as usize, h as usize) / 4]),
-            text: None,
-            error: None,
-            warnings: Vec::new(),
-            millis: 0,
-        }
-    }
-
-    /// #3149: the replacement dialog commits after the canvas collected this frame's demand.
-    #[test]
-    fn replacing_a_page_after_layout_never_uploads_an_oversized_texture() {
-        let ctx = egui::Context::default();
-        ctx.input_mut(|i| i.max_texture_side = 2048);
-        let mut app = PdfCraftApp::new();
-        let original = app.session.create_blank(200.0, 300.0, 1).unwrap();
-        let replacement = app.session.create_blank(400.0, 500.0, 1).unwrap();
-        app.open_bytes("original.pdf", None, original.as_ref().clone()).unwrap();
-        let request = RenderRequest { scale: 4.7, tag: scale_tag(4.7), ..Default::default() };
-        app.views[0].frame_queue = vec![request];
-        app.views[0].frame_visible.insert(0);
-        assert!(app.apply_edit(Edit::ReplacePages { pages: vec![0], name: "replacement.pdf".into(), bytes: replacement, src_pages: vec![0] }));
-        let doc = app.session.get(app.views[0].id).unwrap();
-        assert_eq!((doc.info.pages[0].width, doc.info.pages[0].height), (400.0, 500.0));
-        let edited_bytes = doc.bytes.clone();
-        let pool = RenderPool::new_inline(doc.display.clone(), Default::default());
-        app.views[0].finish_render_frame(&ctx, &doc.info, &pool);
-        assert!(app.views[0].last_queue.is_empty(), "old geometry must not reach the replacement renderer");
-
-        // The next layout can render a bounded backdrop and sharp tiles at the same zoom.
-        let backdrop = RenderRequest { scale: 2048.0 / 500.0, tag: scale_tag(2048.0 / 500.0), ..request };
-        let tile = RenderRequest { tile: Some(Tile { x: 0, y: 0, w: 1024, h: 1024 }), ..request };
-        for _ in 0..2 {
-            let view = &mut app.views[0];
-            view.begin_render_frame();
-            view.frame_visible.insert(0);
-            view.frame_queue = vec![backdrop, tile];
-            view.finish_render_frame(&ctx, &doc.info, &pool);
-        }
-        let view = &app.views[0];
-        assert_eq!(view.pages.get(&0).unwrap().tex.size(), [1639, 2048]);
-        assert_eq!(view.tiles.get(&(0, tile.tag, 0, 0)).unwrap().size(), [1024, 1024]);
-        assert!(view.errors.is_empty());
-        assert_eq!(doc.bytes, edited_bytes, "rendering preserves the unsaved edit");
-        assert!(doc.dirty);
-        assert_eq!(doc.can_undo(), Some("Replace page"));
-    }
-
-    #[test]
-    fn oversized_raster_results_do_not_replace_cached_textures() {
-        let ctx = egui::Context::default();
-        ctx.input_mut(|i| i.max_texture_side = 64);
-        for request in [
-            RenderRequest::default(),
-            RenderRequest { tag: THUMB_TAG, ..Default::default() },
-            RenderRequest { tag: GRID_TAG, ..Default::default() },
-            RenderRequest { tag: PRINT_TAG, ..Default::default() },
-            RenderRequest { tile: Some(Tile { x: 0, y: 0, w: 64, h: 32 }), ..Default::default() },
-        ] {
-            let mut view = DocView::new(DocId(1), &thumbnail_info(1), ViewDefaults::default());
-            view.last_queue = vec![request];
-            let texture = |v: &DocView| {
-                v.pages
-                    .values()
-                    .map(|p| &p.tex)
-                    .chain(v.thumbs.values().map(|p| &p.tex))
-                    .chain(v.grid_pages.values().map(|(_, t)| t))
-                    .chain(v.print_pages.values().map(|(_, t)| t))
-                    .chain(v.tiles.values())
-                    .map(|t| (t.id(), t.size()))
-                    .collect::<Vec<_>>()
-            };
-            assert_eq!(view.receive_result(&ctx, solid_result(request, 64, 32)), 64 * 32 * 4);
-            let cached = texture(&view);
-            assert_eq!(cached.len(), 1);
-            for (w, h) in [(65, 32), (32, 65), (65, 65), (0, 32), (32, 0)] {
-                assert_eq!(view.receive_result(&ctx, solid_result(request, w, h)), 0, "{request:?}: {w}x{h}");
-                assert_eq!(texture(&view), cached, "an invalid result must keep the previous raster");
-            }
-            assert_eq!(view.receive_result(&ctx, solid_result(request, 32, 64)), 32 * 64 * 4);
-            assert_eq!(texture(&view)[0].1, [32, 64], "valid results still make progress");
-        }
-    }
-
-    /// A print preview carries the renderer's print bit; the bit that asks for luminance is
-    /// its own, so a colour preview is not converted to monochrome and the two modes are told
-    /// apart by their tags.
-    #[test]
-    fn print_preview_tag_distinguishes_grayscale_from_colour() {
-        let mut v = view(1, PageLayout::Single, true);
-        v.set_print_grayscale(false);
-        v.queue_print_previews(&[(0, 1.0)]);
-        let colour = v.frame_queue.last().expect("a print preview was queued").tag;
-        assert_ne!(colour & PRINT_TAG, 0, "a print preview carries the renderer's print bit");
-        assert_eq!(colour & GRAYSCALE_TAG, 0, "a colour print preview must not ask for luminance");
-
-        v.set_print_grayscale(true);
-        v.queue_print_previews(&[(0, 1.0)]);
-        let gray = v.frame_queue.last().expect("a grayscale print preview was queued").tag;
-        assert_ne!(gray & GRAYSCALE_TAG, 0, "a grayscale print preview asks for luminance");
-        assert_ne!(gray, colour, "the two print preview modes must not share a tag");
-    }
-
-    #[test]
-    fn thumbnails_release_on_scroll_panel_close_and_request_again_after_eviction() {
-        let ctx = egui::Context::default();
-        let info = thumbnail_info(10_000);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        v.need_thumbnail(0, true);
-        let first = v.prepare_render_queue(&info, 1.0);
-        v.last_queue = first.clone();
-        assert_eq!(v.receive_result(&ctx, solid_result(first[0], 132, 171)), 132 * 171 * 4);
-        assert!(v.prepare_render_queue(&info, 1.0).is_empty());
-        v.begin_render_frame();
-        v.need_thumbnail(9999, true);
-        v.prepare_render_queue(&info, 1.0);
-        assert!(v.thumbs.is_empty(), "jump releases old handles");
-        v.begin_render_frame();
-        v.need_thumbnail(0, true);
-        assert_eq!(v.prepare_render_queue(&info, 1.0), first, "an evicted result must be requested again");
-        v.begin_render_frame();
-        assert!(v.prepare_render_queue(&info, 1.0).is_empty(), "closing consumers cancels thumbnail work");
-    }
-
-    #[test]
-    fn stale_results_are_rejected_before_conversion_after_dpi_invalidation_and_suspend() {
-        let ctx = egui::Context::default();
-        let info = thumbnail_info(1);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        v.need_thumbnail(0, true);
-        let first = v.prepare_render_queue(&info, 1.0)[0];
-        v.last_queue = v.prepare_render_queue(&info, 2.0);
-        // Valid pixels: only the request gate can keep these out (a size check can't).
-        let obsolete = || solid_result(first, 132, 171);
-        assert_eq!(v.receive_result(&ctx, obsolete()), 0);
-        assert!(v.thumbs.is_empty(), "a result for the old DPI is not uploaded");
-        // The same result is uploaded while its request is current.
-        v.last_queue = vec![first];
-        assert_eq!(v.receive_result(&ctx, obsolete()), 132 * 171 * 4);
-        v.thumbs.clear();
-        v.invalidate_content();
-        assert_eq!(v.receive_result(&ctx, obsolete()), 0);
-        assert!(v.thumbs.is_empty(), "nor after the content changed");
-        let pool = RenderPool::new_inline(Arc::new(Vec::new()), Default::default());
-        v.last_queue = vec![first];
-        v.suspend_rendering(&pool);
-        assert_eq!(v.receive_result(&ctx, obsolete()), 0);
-        assert!(v.thumbs.is_empty(), "nor after the tab was suspended");
-    }
-
-    #[test]
-    fn editing_after_layout_preserves_stale_page_until_replacement() {
-        let ctx = egui::Context::default();
-        let info = thumbnail_info(1);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        let req = RenderRequest { scale: 1.0, tag: 1000, ..Default::default() };
-        v.last_queue = vec![req];
-        v.receive_result(&ctx, solid_result(req, 10, 10));
-        v.frame_queue = vec![req];
-        v.page_changed(0);
-        assert_eq!(v.prepare_render_queue(&info, 1.0), vec![req]);
-        assert_eq!(v.pages.get(&0).unwrap().tag, STALE_TAG);
-    }
-
-    /// #1858: a released drawing stays painted from its points until a raster that has it
-    /// arrives. A page raster that lands before the drawing's edit is applied (in full screen the
-    /// edit waits for the next frame, and a render already under way can finish first) is of the
-    /// document without it, and must not end the preview.
-    #[test]
-    fn a_raster_from_before_a_drawing_is_committed_keeps_it_drawn() {
-        let ctx = egui::Context::default();
-        let info = thumbnail_info(1);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        let req = RenderRequest { scale: 1.0, tag: 1000, ..Default::default() };
-        v.comments.settle(0.0, 0, crate::comments::CommentTool::Ink, &[[10.0, 10.0], [40.0, 30.0]]);
-        v.last_queue = vec![req];
-        assert!(v.receive_result(&ctx, solid_result(req, 10, 10)) > 0, "the raster is taken");
-        assert_eq!(v.comments.settling_len(), 1, "a raster from before the commit doesn't have the stroke");
-        v.comments.drawings_committed();
-        v.last_queue = vec![req];
-        assert!(v.receive_result(&ctx, solid_result(req, 10, 10)) > 0);
-        assert_eq!(v.comments.settling_len(), 0, "a raster after the commit draws it");
-        // An edit that fails leaves nothing to wait for.
-        v.comments.settle(0.0, 0, crate::comments::CommentTool::Ink, &[[10.0, 10.0], [40.0, 30.0]]);
-        v.comments.drawings_refused();
-        assert_eq!(v.comments.settling_len(), 0, "a refused drawing isn't left painted");
-    }
-
-    #[test]
-    fn page_and_tile_admission_accounts_for_bytes_before_count_limits() {
-        let mut info = thumbnail_info(40);
-        for p in &mut info.pages {
-            p.width = 4000.0;
-            p.height = 4000.0;
-        }
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        v.frame_queue = (0..40).map(|page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() }).collect();
-        let queue = v.prepare_render_queue(&info, 1.0);
-        assert_eq!(queue.len(), 2, "128 MiB admits two 4000-square pages, not 24");
-        v.frame_queue = (0..40)
-            .map(|page| RenderRequest { page, scale: 1.0, tag: 1000, tile: Some(Tile { x: 0, y: 0, w: 1024, h: 1024 }), ..Default::default() })
-            .collect();
-        assert_eq!(v.prepare_render_queue(&info, 1.0).len(), 32);
-        assert!(!v.admit_texture(RenderRequest::default(), PAGE_BYTES + 1));
-    }
-
-    #[test]
-    fn on_screen_pages_and_tiles_are_admitted_beyond_the_prefetch_allowance() {
-        let ctx = egui::Context::default();
-        let mut info = thumbnail_info(40);
-        for p in &mut info.pages {
-            p.width = 2000.0;
-            p.height = 2000.0;
-        }
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        // Ten 16 MB pages on screen (a zoomed-out HiDPI view) exceed the 128 MiB allowance.
-        v.frame_visible = (0..10).collect();
-        v.frame_queue = (0..40).map(|page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() }).collect();
-        let queue = v.prepare_render_queue(&info, 1.0);
-        let pages: Vec<usize> = queue.iter().map(|r| r.page).collect();
-        assert_eq!(pages, (0..10).collect::<Vec<_>>(), "every on-screen page, and no prefetch past the allowance");
-        v.last_queue = queue.clone();
-        for req in &queue {
-            assert!(v.receive_result(&ctx, solid_result(*req, 2000, 2000)) > 0, "on-screen page {} uploaded", req.page);
-        }
-        assert_eq!(v.pages.len(), 10, "none evicted another on-screen page");
-        // A 5K viewport needs more 1024-pixel tiles than the tile allowance holds.
-        v.frame_queue = (0..40)
-            .map(|x| RenderRequest { page: 0, scale: 1.0, tag: 1000, tile: Some(Tile { x: x * TILE, y: 0, w: 1024, h: 1024 }), ..Default::default() })
-            .collect();
-        assert_eq!(v.prepare_render_queue(&info, 1.0).len(), 40);
-    }
-
-    #[test]
-    fn a_page_turned_back_to_is_still_cached() {
-        let ctx = egui::Context::default();
-        let info = thumbnail_info(10);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        let req = |page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() };
-        v.frame_visible = [0].into();
-        v.frame_queue = vec![req(0)];
-        v.last_queue = v.prepare_render_queue(&info, 1.0);
-        v.receive_result(&ctx, solid_result(req(0), 100, 130));
-        // Single-page view moves on to page 1: page 0 is no longer demanded.
-        v.begin_render_frame();
-        v.current = 1;
-        v.frame_visible = [1].into();
-        v.frame_queue = vec![req(1)];
-        assert_eq!(v.prepare_render_queue(&info, 1.0), vec![req(1)]);
-        assert!(v.pages.contains_key(&0), "kept while the allowance has room");
-        // And back: nothing to render.
-        v.begin_render_frame();
-        v.current = 0;
-        v.frame_visible = [0].into();
-        v.frame_queue = vec![req(0)];
-        assert!(v.prepare_render_queue(&info, 1.0).is_empty());
-    }
-
-    #[test]
-    fn visible_pages_render_before_thumbnails_and_text() {
-        let ctx = egui::Context::default();
-        let info = thumbnail_info(4);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        let main = RenderRequest { page: 0, scale: 1.0, tag: 1000, ..Default::default() };
-        let text = RenderRequest { page: 0, kind: RequestKind::Text, scale: 1.0, tag: TEXT_TAG, ..Default::default() };
-        // Opening page 0 queues its pixels and text alongside Pages-panel thumbnails.
-        v.begin_render_frame();
-        v.frame_visible = [0].into();
-        v.frame_queue = vec![main, text];
-        for p in 1..4 {
-            v.need_thumbnail(p, true);
-        }
-        let queue = v.prepare_render_queue(&info, 1.0);
-        assert_eq!(queue, vec![main], "visible pixels first: no thumbnails or text yet");
-        // Once the visible raster arrives, background work is admitted.
-        v.last_queue = queue;
-        assert!(v.receive_result(&ctx, solid_result(main, 100, 130)) > 0);
-        v.begin_render_frame();
-        v.frame_visible = [0].into();
-        v.frame_queue = vec![text];
-        for p in 1..4 {
-            v.need_thumbnail(p, true);
-        }
-        let queue = v.prepare_render_queue(&info, 1.0);
-        assert!(queue.iter().any(|r| r.kind == RequestKind::Text), "text admitted after pixels");
-        assert!(queue.iter().any(|r| r.tag & THUMB_TAG != 0), "thumbnails admitted after pixels");
-        assert!(!queue.iter().any(|r| r.kind == RequestKind::Pixels && r.tag & THUMB_TAG == 0), "no main pixels re-requested");
-        // An errored visible page never holds background work back.
-        v.errors.insert(0, "gone".to_string());
-        v.begin_render_frame();
-        v.frame_visible = [0].into();
-        v.frame_queue = vec![main, text];
-        for p in 1..4 {
-            v.need_thumbnail(p, true);
-        }
-        let queue = v.prepare_render_queue(&info, 1.0);
-        assert!(queue.iter().any(|r| r.kind == RequestKind::Text), "text admitted despite the error");
-        assert!(queue.iter().any(|r| r.tag & THUMB_TAG != 0), "thumbnails still admitted");
-    }
-
-    #[test]
-    fn thumbnail_tags_do_not_change_as_a_row_scrolls_in_or_out() {
-        let info = thumbnail_info(10_000);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        let tags = |v: &mut DocView, cells: usize| {
-            v.begin_render_frame();
-            for page in 0..cells {
-                v.need_thumbnail(page, true);
-            }
-            v.thumbnail_requests(&info, 2.0).into_iter().map(|r| (r.page, r.tag)).collect::<HashMap<_, _>>()
-        };
-        // 2x on a large screen: about 70 cells, give or take a row of six.
-        let (a, b) = (tags(&mut v, 70), tags(&mut v, 76));
-        assert!((0..70).all(|p| a[&p] == b[&p]), "a row more or less re-renders nothing");
-    }
-
-    #[test]
-    fn many_open_documents_share_one_raster_allowance_and_close_releases_handles() {
-        let ctx = egui::Context::default();
-        let mut app = PdfCraftApp::new();
-        let bytes = app.session.create_blank(612.0, 792.0, 1).unwrap();
-        let mut expected = Vec::new();
-        for index in 0..6 {
-            app.open_bytes(&format!("synthetic-{index}.pdf"), None, bytes.as_ref().clone()).unwrap();
-            let info = app.session.get(app.views.last().unwrap().id).unwrap().info.clone();
-            let view = app.views.last_mut().unwrap();
-            view.begin_render_frame();
-            view.need_thumbnail(0, true);
-            let request = view.thumbnail_requests(&info, ctx.pixels_per_point()).into_iter().next().unwrap();
-            let page = info.pages.get(request.page).unwrap();
-            let dimensions = (device_pixels(page.width, request.scale), device_pixels(page.height, request.scale));
-            view.last_queue = vec![request];
-            assert_eq!(
-                view.receive_result(&ctx, solid_result(request, dimensions.0, dimensions.1)),
-                rgba_bytes(dimensions.0 as usize, dimensions.1 as usize)
-            );
-            assert_eq!(view.thumbs.get(&0).unwrap().tag, request.tag);
-            assert_eq!(view.thumbs.get(&0).unwrap().tex.size(), [dimensions.0 as usize, dimensions.1 as usize]);
-
-            view.begin_render_frame();
-            view.need_thumbnail(0, true);
-            let queue = view.prepare_render_queue(&info, ctx.pixels_per_point());
-            assert!(queue.is_empty(), "the synthetic thumbnail satisfies current demand");
-            view.last_queue = queue;
-            expected.push((request, dimensions));
-        }
-        assert_eq!(app.views.len(), 6, "all six documents were opened");
-        assert_eq!(app.active_ids().map(|(index, _)| index), Some(5));
-        assert!(app.views.iter().zip(&expected).all(|(view, (request, dimensions))| {
-            view.thumbs.len() == 1
-                && view
-                    .thumbs
-                    .get(&0)
-                    .is_some_and(|thumb| thumb.tag == request.tag && thumb.tex.size() == [dimensions.0 as usize, dimensions.1 as usize])
-        }));
-
-        app.finish_render_frame(&ctx);
-        let total: usize = app.views.iter().map(|v| v.thumbs.values().map(|p| texture_bytes(&p.tex)).sum::<usize>()).sum();
-        let (active_request, active_dimensions) = expected.last().unwrap();
-        let active_bytes = rgba_bytes(active_dimensions.0 as usize, active_dimensions.1 as usize);
-        assert_eq!(total, active_bytes, "only the active view retains a thumbnail");
-        assert!(total <= THUMB_BYTES, "retained thumbnails stay within the existing allowance");
-        assert!(app.views.iter().take(5).all(|v| v.thumbs.is_empty() && v.last_queue.is_empty()));
-        let active = app.views.last().unwrap();
-        assert_eq!(active.thumbs.len(), 1);
-        assert_eq!(active.thumbs.get(&0).unwrap().tag, active_request.tag);
-        assert!(active.last_queue.is_empty(), "the current thumbnail is already cached");
-        for view in &app.views {
-            let doc = app.session.get(view.id).unwrap();
-            assert_eq!(doc.renderer.stats().render_requests, 0, "the fixture must not launch a native render");
-        }
-
-        app.close_tab(5);
-        assert_eq!(app.views.len(), 5, "closing the active tab drops its owning view");
-        assert!(app.views.iter().all(|v| v.thumbs.is_empty()));
-    }
-
-    #[test]
-    fn suspended_signature_preview_releases_layers_and_rebuilds_without_editing() {
-        let ctx = egui::Context::default();
-        let mut png = std::io::Cursor::new(Vec::new());
-        image::RgbaImage::from_pixel(12, 4, image::Rgba([20, 30, 40, 255])).write_to(&mut png, image::ImageFormat::Png).unwrap();
-        let image = pdfcraft_engine::SignatureImage::from_bytes(png.get_ref()).unwrap();
-        let mut session = pdfcraft_engine::Session::new();
-        let blank = session.create_blank(300.0, 400.0, 1).unwrap();
-        let id = session.open_new("signature-preview.pdf", blank).unwrap();
-        let info = session.get(id).unwrap().info.pages[0].clone();
-        session.apply(id, image.edit(0, &info, [20.0, 100.0], false, "Test").unwrap()).unwrap();
-        let doc = session.get(id).unwrap();
-        let bytes = doc.bytes.clone();
-        let generation = doc.edit_generation();
-        let mut v = DocView::new(id, &doc.info, ViewDefaults::default());
-        v.comments.selected = Some((0, 0));
-        v.signature_drag.prepare(&ctx, doc, v.comments.selected, 1.0);
-        assert!(v.signature_drag.contains(0, 0));
-
-        v.suspend_rendering(&doc.renderer);
-        assert!(!v.signature_drag.contains(0, 0), "inactive tabs release the preview pool and textures");
-        assert_eq!(v.comments.selected, Some((0, 0)), "the user's selection survives suspension");
-        v.signature_drag.prepare(&ctx, doc, v.comments.selected, 1.0);
-        assert!(v.signature_drag.contains(0, 0), "reactivating the view rebuilds the selected image's preview");
-        assert!(Arc::ptr_eq(&bytes, &doc.bytes));
-        assert_eq!(doc.edit_generation(), generation);
-        assert_eq!(doc.can_undo(), Some("Add signature"));
-        assert!(doc.dirty);
-    }
-
-    #[test]
-    fn suspending_a_view_releases_owned_raster_textures_and_queue_state() {
-        let ctx = egui::Context::default();
-        let mut view = view(2, PageLayout::Single, true);
-        let texture = |name| ctx.load_texture(name, egui::ColorImage::filled([1, 1], Color32::WHITE), TextureOptions::LINEAR);
-        let request = RenderRequest { page: 0, scale: 1.0, tag: 1, ..Default::default() };
-        view.pages.insert(0, PageTex { tag: request.tag, tex: texture("suspended-page") });
-        view.thumbs.insert(1, PageTex { tag: THUMB_TAG, tex: texture("suspended-thumbnail") });
-        view.tiles.insert((0, request.tag, 0, 0), texture("suspended-tile"));
-        view.grid_pages.insert(1, (1, texture("suspended-grid-page")));
-        view.print_pages.insert(1, (PRINT_TAG, texture("suspended-print-page")));
-        view.stale_thumbs.insert(1);
-        view.waiting_since.insert(0, 1.0);
-        view.last_queue = vec![request];
-        view.frame_queue = vec![request];
-        view.frame_visible.insert(0);
-        view.need_thumbnail(1, true);
-
-        let pool = RenderPool::new_inline(Arc::new(Vec::new()), Default::default());
-        view.suspend_rendering(&pool);
-
-        assert!(view.pages.is_empty(), "page handles are released");
-        assert!(view.thumbs.is_empty(), "thumbnail handles are released");
-        assert!(view.tiles.is_empty(), "tile handles are released");
-        assert!(view.grid_pages.is_empty(), "organize-grid handles are released");
-        assert!(view.print_pages.is_empty(), "print-preview handles are released");
-        assert!(view.stale_thumbs.is_empty(), "stale thumbnail bookkeeping is cleared");
-        assert!(view.waiting_since.is_empty(), "waiting bookkeeping is cleared");
-        assert!(view.last_queue.is_empty() && !view.render_pending(), "queued demand is retired");
-        assert!(view.frame_queue.is_empty() && view.frame_visible.is_empty() && view.thumb_demand.is_empty());
-    }
-
-    /// Edit text & images keeps its boxes while page input is blocked (the window unfocused, a
-    /// dialog or the palette open): the page's paragraphs are still measured for the latest edit
-    /// and drawn, instead of vanishing until the pointer comes back.
-    #[test]
-    fn edit_text_boxes_stay_drawn_while_page_input_is_blocked() {
-        let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
-            let mut app = PdfCraftApp::new();
-            let bytes = app.session.create_blank(300.0, 400.0, 1).unwrap();
-            app.open_bytes("blank.pdf", None, bytes.as_ref().clone()).unwrap();
-            app.quick_tool = QuickTool::EditText;
-            app
-        });
-        h.run_steps(3);
-        // Block page input the way the window losing focus does.
-        h.state_mut().palette_open = true;
-        h.run_steps(2);
-        assert!(h.state_mut().apply_edit(Edit::RotatePages { pages: vec![0], degrees: 90 }));
-        h.run_steps(3);
-        let app = h.state();
-        let generation = app.session.get(app.views[0].id).unwrap().edit_generation();
-        assert_eq!(app.views[0].edit_lines.get(&0).map(|(g, _)| *g), Some(generation), "the boxes follow the edit while input is blocked");
-    }
-
-    #[test]
-    fn virtualized_organizer_keeps_insert_gaps_at_document_positions() {
-        use egui_kittest::kittest::Queryable;
-
-        let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
-            let mut app = PdfCraftApp::new();
-            let bytes = app.session.create_blank(300.0, 400.0, 100).unwrap();
-            app.open_bytes("organize-gaps.pdf", None, bytes.as_ref().clone()).unwrap();
-            app.views[0].organize = true;
-            app
-        });
-        h.run_steps(4);
-        assert!(h.state().views[0].thumb_demand.len() < 50);
-        assert_eq!(h.query_all_by_label("Insert a file at the end").count(), 0, "the last virtualized cell is not the final page");
-        let center = h.state().views[0].viewport_rect().center();
-        h.hover_at(center);
-        h.event(egui::Event::MouseWheel {
-            unit: egui::MouseWheelUnit::Point,
-            delta: vec2(0.0, -100_000.0),
-            phase: egui::TouchPhase::Move,
-            modifiers: egui::Modifiers::NONE,
-        });
-        // Well past egui's longest scroll animation (about 0.3 s).
-        h.run_steps(40);
-        h.get_by_label("Insert a file at the end");
-        let before_last = h.get_by_label("Insert a file before page 100").rect().center();
-        h.hover_at(before_last);
-        h.run_steps(2);
-        assert_eq!(h.state().views[0].grid_gap, Some(99), "external drops use the document index after virtualized scrolling");
-        assert!(h.state().views[0].thumb_demand.len() < 50);
-    }
-
-    #[test]
-    fn real_shell_pages_organizer_and_print_only_collect_current_thumbnail_consumers() {
-        let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
-            let mut app = PdfCraftApp::new();
-            let bytes = app.session.create_blank(612.0, 792.0, 10_000).unwrap();
-            app.open_bytes("synthetic-ten-thousand.pdf", None, bytes.as_ref().clone()).unwrap();
-            app.right = Some(RightPanel::Pages);
-            app
-        });
-        h.run_steps(4);
-        assert!((1..20).contains(&h.state().views[0].thumb_demand.len()));
-        h.state_mut().right = None;
-        h.state_mut().views[0].organize = true;
-        h.run_steps(2);
-        assert!((1..50).contains(&h.state().views[0].thumb_demand.len()));
-        h.state_mut().views[0].organize = false;
-        h.state_mut().dialog = Some(crate::Dialog::Print);
-        h.state_mut().print_draft.sheet = 9999;
-        h.run_steps(2);
-        assert_eq!(h.state().views[0].thumb_demand.keys().copied().collect::<Vec<_>>(), vec![9999]);
-        h.state_mut().print_draft.handling = crate::PrintHandling::Booklet;
-        h.state_mut().print_draft.sheet = 0;
-        h.run_steps(2);
-        assert_eq!(h.state().views[0].thumb_demand.len(), 2, "booklet only needs its two placed pages");
-        h.state_mut().dialog = None;
-        h.run_steps(2);
-        assert!(h.state().views[0].thumb_demand.is_empty());
-        assert!(h.state().views[0].thumbs.is_empty());
-    }
-
-    /// One mouse-wheel notch (a line) at `at` seconds.
-    fn notch(v: &mut DocView, dy: f32, at: f64) -> bool {
-        v.single_page_wheel(egui::MouseWheelUnit::Line, dy, egui::TouchPhase::Move, at, true)
-    }
-
-    #[test]
-    fn thumbnails_cover_the_panel_on_a_high_dpi_screen() {
-        // Pages panel slot is at most 150 logical points. At 2 px/pt a letter page's thumbnail
-        // must be at least that wide, so the panel samples it down instead of stretching it.
-        let info = thumbnail_info(1);
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        v.need_thumbnail(0, true);
-        let queue = v.prepare_render_queue(&info, 2.0);
-        let scale = queue.first().expect("one thumbnail").scale;
-        assert!(612.0 * scale >= 150.0 * 2.0, "{scale}");
-    }
-
-    #[test]
-    fn notches_turn_pages_and_stop_at_the_ends() {
-        let mut v = view(3, PageLayout::Single, false);
-        assert!(notch(&mut v, -1.0, 1.0) && notch(&mut v, -1.0, 1.05));
-        assert_eq!(v.current, 2);
-        assert!(!notch(&mut v, -1.0, 1.1), "nothing turns past the last page");
-        assert!(notch(&mut v, 1.0, 1.2));
-        assert_eq!(v.current, 1);
-    }
-
-    #[test]
-    fn notches_turn_two_page_spreads() {
-        // Two-page view, shown one spread at a time (not continuous): a notch turns a whole
-        // spread at once, not a single page (#752).
-        let mut v = view(4, PageLayout::TwoUp, false);
-        assert!(notch(&mut v, -1.0, 1.0));
-        assert_eq!(v.current, 2, "a notch turns from the first spread to the second");
-        assert!(notch(&mut v, 1.0, 1.1));
-        assert_eq!(v.current, 0, "a notch back turns to the previous spread");
-    }
-
-    #[test]
-    fn continuous_views_ignore_the_wheel_for_paging() {
-        // Scrolling views let the ScrollArea handle the wheel; it never turns pages.
-        for layout in [PageLayout::Single, PageLayout::TwoUp] {
-            let mut v = view(3, layout, true);
-            assert!(!notch(&mut v, -1.0, 1.0), "{layout:?} continuous ignores the wheel");
-            assert_eq!(v.current, 0);
-        }
-    }
-
-    #[test]
-    fn navigation_drops_partial_wheel_motion() {
-        use egui::{MouseWheelUnit::Point, TouchPhase::Move, TouchPhase::Start};
-        let mut v = view(3, PageLayout::Single, false);
-        assert!(!v.single_page_wheel(Point, 0.0, Start, 1.0, true));
-        assert!(!v.single_page_wheel(Point, -30.0, Move, 1.02, true));
-        v.go_to_page(1);
-        // The same touch has to move a full notch's worth again before it turns.
-        assert!(!v.single_page_wheel(Point, -30.0, Move, 1.04, true));
-        assert!(v.single_page_wheel(Point, -30.0, Move, 1.06, true));
-        assert_eq!(v.current, 2);
-    }
-
-    #[test]
-    fn reselecting_the_layout_does_not_scroll_to_top() {
-        let mut v = view(3, PageLayout::Single, true);
-        v.goto = None;
-        v.set_layout(PageLayout::Single);
-        assert!(v.goto.is_none(), "re-selecting the current layout is a no-op");
-        v.set_continuous(true);
-        assert!(v.goto.is_none(), "re-selecting the current continuity is a no-op");
-        v.set_layout(PageLayout::TwoUp);
-        assert_eq!(v.goto, Some((0, 0.0)), "switching the base layout aligns the current page");
-        v.goto = None;
-        v.set_continuous(false);
-        assert_eq!(v.goto, Some((0, 0.0)), "toggling continuous scrolling aligns the current page");
-    }
-
-    #[test]
-    fn fit_page_and_height_hold_still_while_mixed_page_sizes_scroll_past() {
-        let page =
-            |width: f32, height: f32| pdfcraft_render::PageInfo { width, height, label: String::new(), crop: [0.0, 0.0, width, height], rotation: 0 };
-        let info = DocInfo { pages: vec![page(300.0, 400.0), page(600.0, 800.0)], ..Default::default() };
-        for fit in [Fit::Page, Fit::Height] {
-            let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-            (v.fit, v.viewport_w, v.viewport_h) = (fit, 1000.0, 800.0);
-            v.fit_zoom(&info);
-            let zoom = v.zoom;
-            v.current = 1;
-            v.fit_zoom(&info);
-            assert_eq!(v.zoom, zoom, "{fit:?}: scrolling onto a bigger page keeps the zoom");
-            // A single page shown on its own (not scrolling) fits each one.
-            (v.layout, v.continuous) = (PageLayout::Single, false);
-            v.fit_zoom(&info);
-            let big = v.zoom;
-            v.current = 0;
-            v.fit_zoom(&info);
-            assert!(v.zoom > big, "{fit:?}: single-page view fits the page it shows");
-        }
-    }
-
-    /// Review on #2070: full screen in two-page view fits the spread it shows, the cover page
-    /// on its own included; two-page view in the window keeps one zoom for the document.
-    #[test]
-    fn full_screen_two_page_view_fits_the_spread_it_shows() {
-        let page =
-            |width: f32, height: f32| pdfcraft_render::PageInfo { width, height, label: String::new(), crop: [0.0, 0.0, width, height], rotation: 0 };
-        // Spreads [0, 1] small, [2, 3] large; with a cover page [0], [1, 2] mixed, [3].
-        let info = DocInfo { pages: vec![page(300.0, 400.0), page(300.0, 400.0), page(600.0, 800.0), page(600.0, 800.0)], ..Default::default() };
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        (v.layout, v.continuous, v.viewport_w, v.viewport_h) = (PageLayout::TwoUp, false, 1000.0, 800.0);
-        v.fit = Fit::Page;
-        v.fit_zoom(&info);
-        let windowed = v.zoom;
-        v.enter_presentation();
-        v.fit_zoom(&info);
-        let small = v.zoom;
-        assert!(small > windowed * 1.9, "the small spread fills the screen: {small} vs {windowed}");
-        v.current = 3;
-        v.fit_zoom(&info);
-        assert!((v.zoom - windowed).abs() < 1e-4, "the large spread fits as before");
-        v.current = 1;
-        v.fit_zoom(&info);
-        assert_eq!(v.zoom, small, "page 2 is in the first spread");
-        // With a cover page: [0] alone, then [1, 2] (the large page decides), then [3].
-        v.cover = true;
-        v.current = 0;
-        v.fit_zoom(&info);
-        assert_eq!(v.zoom, small, "the cover page alone");
-        v.current = 1;
-        v.fit_zoom(&info);
-        assert!((v.zoom - windowed).abs() < 1e-4, "page 2 shares a spread with the large page 3");
-        // Scrolling while in full screen fits the document, as scrolling does in the window.
-        (v.continuous, v.current) = (true, 0);
-        v.fit_zoom(&info);
-        assert!((v.zoom - windowed).abs() < 1e-4, "continuous full screen keeps one zoom");
-        v.continuous = false;
-        // The cover page is a spread of its own even when the next page is larger.
-        let mixed = DocInfo { pages: vec![page(300.0, 400.0), page(600.0, 800.0), page(600.0, 800.0)], ..Default::default() };
-        v.current = 0;
-        v.fit_zoom(&mixed);
-        assert_eq!(v.zoom, small, "the small cover alone, not with page 2");
-        // Leaving full screen brings the document-wide fit back.
-        v.leave_presentation();
-        (v.fit, v.current) = (Fit::Page, 0);
-        (v.layout, v.continuous) = (PageLayout::TwoUp, false);
-        v.fit_zoom(&info);
-        assert!((v.zoom - windowed).abs() < 1e-4, "in the window, one zoom for the document");
-    }
-
-    #[test]
-    fn fit_width_fits_the_shown_page_in_single_page_view_only() {
-        let page =
-            |width: f32, height: f32| pdfcraft_render::PageInfo { width, height, label: String::new(), crop: [0.0, 0.0, width, height], rotation: 0 };
-        let info = DocInfo { pages: vec![page(300.0, 400.0), page(600.0, 400.0)], ..Default::default() };
-        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
-        (v.fit, v.viewport_w, v.viewport_h) = (Fit::Width, 1000.0, 800.0);
-        v.layout = PageLayout::Single;
-        v.continuous = false;
-        v.fit_zoom(&info);
-        let narrow = v.zoom;
-        // The shown page fills the width between the side gutters, not centred for the wide page.
-        let shown = v.layout(&info, v.content_width(&info, 1000.0), 1.0)[0];
-        assert!((shown.left() - SIDE).abs() < 1e-2 && (shown.width() - 860.0).abs() < 1e-2, "{shown:?}");
-        v.current = 1;
-        v.fit_zoom(&info);
-        assert!((narrow / v.zoom - 2.0).abs() < 1e-3, "the narrow page gets twice the zoom of the wide one");
-        // Scrolling views keep one zoom for the whole document.
-        v.continuous = true;
-        v.fit_zoom(&info);
-        let wide = v.zoom;
-        v.current = 0;
-        v.fit_zoom(&info);
-        assert_eq!(v.zoom, wide, "continuous fit width holds still across page sizes");
-    }
-
-    #[test]
-    fn layouts_match_their_commands_and_names() {
-        for l in PageLayout::ORDER {
-            let spec = pdfcraft_engine::commands::command(l.command()).expect("registered");
-            assert_eq!((l.label(), l.icon()), (spec.label, spec.icon), "{l:?}");
-            assert_eq!(PageLayout::from_command(l.command()), Some(l));
-            assert_eq!(PageLayout::try_parse(l.as_str()), Some(l));
-        }
-        assert_eq!(PageLayout::try_parse(" Two-Up "), Some(PageLayout::TwoUp));
-        assert_eq!(PageLayout::try_parse("facing"), None);
-    }
-
-    #[test]
-    fn a_null_xyz_coordinate_keeps_the_readers_place_on_the_new_page() {
-        // CAD exports link each cross-reference as `/XYZ null null 0`. Acrobat keeps the
-        // point at the window's top-left (and the zoom) when following one to another sheet.
-        let info = pdfcraft_render::DocInfo {
-            pages: (0..3)
-                .map(|_| pdfcraft_render::PageInfo { width: 842.0, height: 595.0, label: String::new(), crop: [0.0, 0.0, 842.0, 595.0], rotation: 0 })
-                .collect(),
-            ..Default::default()
-        };
-        // Page 1 at 400 %, scrolled so its point 200 pt across and 125 pt down is at the corner
-        // where /XYZ puts its point.
-        let zoomed = |rot: u16, size: Vec2| {
-            let mut v = view(3, PageLayout::Single, true);
-            v.rotation = rot;
-            v.viewport_screen = Rect::from_min_size(Pos2::ZERO, vec2(1000.0, 600.0));
-            v.screen_xforms = vec![(0, PageXform { rect: Rect::from_min_size(pos2(SIDE - 800.0, -500.0), size), rot, pw: 842.0, ph: 595.0 })];
-            v
-        };
-        let near = |a: Option<f32>, b: f32| a.is_some_and(|a| (a - b).abs() < 1e-4);
-        let mut v = zoomed(0, vec2(4.0 * 842.0, 4.0 * 595.0));
-        v.go_to_dest(1, DestView::Xyz { left: None, top: None, zoom: None }, &info);
-        let (page, fx, fy, rel) = v.goto_point.expect("the place is kept");
-        assert_eq!((v.current, page, rel), (1, 1, vec2(SIDE, 0.0)));
-        assert!(near(fx, 200.0 / 842.0) && near(fy, 125.0 / 595.0), "{fx:?} {fy:?}");
-        // A coordinate the destination gives wins; only the null one is kept.
-        let mut v = zoomed(0, vec2(4.0 * 842.0, 4.0 * 595.0));
-        v.go_to_dest(2, DestView::Xyz { left: Some(421.0), top: None, zoom: Some(4.0) }, &info);
-        let (_, fx, fy, _) = v.goto_point.expect("the place is kept");
-        assert!(near(fx, 0.5) && near(fy, 125.0 / 595.0), "{fx:?} {fy:?}");
-        // With the view turned a quarter, the point under the corner is still the one kept.
-        let mut v = zoomed(90, vec2(4.0 * 595.0, 4.0 * 842.0));
-        v.go_to_dest(1, DestView::Xyz { left: None, top: None, zoom: None }, &info);
-        let (_, fx, fy, _) = v.goto_point.expect("the place is kept");
-        assert!(near(fx, 800.0 / (4.0 * 595.0)) && near(fy, 500.0 / (4.0 * 842.0)), "{fx:?} {fy:?}");
-        // A page that fits the window keeps the layout's placement: no point, as before.
-        let mut v = zoomed(0, vec2(800.0, 565.0));
-        v.go_to_dest(1, DestView::Xyz { left: None, top: None, zoom: None }, &info);
-        assert_eq!((v.current, v.goto, v.goto_point), (1, Some((1, 0.0)), None));
-    }
-
-    #[test]
-    fn destinations_set_the_zoom_mode_and_the_point_to_show() {
-        let info = pdfcraft_render::DocInfo {
-            pages: (0..3)
-                .map(|_| pdfcraft_render::PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 })
-                .collect(),
-            ..Default::default()
-        };
-        let mut v = view(3, PageLayout::Single, true);
-        v.fit = Fit::Width;
-        // No position (or a malformed one): the top of the page, zoom as it was.
-        v.go_to_dest(1, DestView::Top, &info);
-        assert_eq!((v.current, v.goto, v.goto_point, v.fit), (1, Some((1, 0.0)), None, Fit::Width));
-        // /XYZ with a null zoom keeps the zoom mode; its point is a quarter down page 3.
-        v.go_to_dest(2, DestView::Xyz { left: None, top: Some(300.0), zoom: None }, &info);
-        assert_eq!((v.current, v.fit, v.goto_point), (2, Fit::Width, Some((2, None, Some(0.25), vec2(SIDE, 0.0)))));
-        v.go_to_dest(0, DestView::Xyz { left: Some(150.0), top: None, zoom: Some(2.5) }, &info);
-        assert_eq!((v.fit, v.zoom, v.goto_point), (Fit::None, 2.5, Some((0, Some(0.5), None, vec2(SIDE, 0.0)))));
-        // A zoom beyond the view's range is clamped to it.
-        v.go_to_dest(0, DestView::Xyz { left: None, top: None, zoom: Some(1e30) }, &info);
-        assert_eq!((v.zoom, v.goto_point), (64.0, None));
-        v.go_to_dest(0, DestView::Fit, &info);
-        assert_eq!((v.fit, v.goto_point), (Fit::Page, None));
-        v.go_to_dest(0, DestView::FitH { top: Some(100.0) }, &info);
-        assert_eq!((v.fit, v.goto_point), (Fit::Width, Some((0, None, Some(0.75), vec2(SIDE, 0.0)))));
-        v.go_to_dest(0, DestView::FitV { left: Some(75.0) }, &info);
-        assert_eq!((v.fit, v.goto_point), (Fit::Height, Some((0, Some(0.25), None, vec2(SIDE, 0.0)))));
-        // /FitR: the zoom that fits a 100×50 pt rectangle in an 800×600 window, centred.
-        (v.viewport_w, v.viewport_h) = (800.0, 600.0);
-        v.go_to_dest(0, DestView::FitR { rect: [0.0, 300.0, 100.0, 350.0] }, &info);
-        assert_eq!(v.fit, Fit::None);
-        assert!((v.zoom - 8.0 / PT).abs() < 1e-4, "{}", v.zoom);
-        let (page, fx, fy, rel) = v.goto_point.expect("a point to show");
-        assert_eq!((page, rel), (0, vec2(400.0, 300.0)));
-        assert!((fx.unwrap_or(-1.0) - 50.0 / 300.0).abs() < 1e-4 && (fy.unwrap_or(-1.0) - 75.0 / 400.0).abs() < 1e-4, "{fx:?} {fy:?}");
-        // A page past the end goes to the last page; a page the document info lacks, to its top.
-        v.go_to_dest(usize::MAX, DestView::FitH { top: Some(100.0) }, &info);
-        assert_eq!((v.current, v.goto_point.map(|g| g.0)), (2, Some(2)));
-        let empty = pdfcraft_render::DocInfo::default();
-        v.go_to_dest(1, DestView::FitH { top: Some(100.0) }, &empty);
-        assert_eq!((v.current, v.goto_point), (1, None));
-    }
-
-    #[test]
-    fn page_text_failure_preserves_valid_search_match_without_jitter() {
-        let mut v = view(3, PageLayout::Single, true);
-        v.current = 1;
-        v.find = Some(Find {
-            query: "test".into(),
-            case_query: "test".into(),
-            matches: vec![(0, 0..4), (1, 5..9)],
-            current: Some(0),
-            ..Default::default()
-        });
-        let req = RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() };
-        v.last_queue = vec![req];
-        let ctx = egui::Context::default();
-        v.receive_result(
-            &ctx,
-            pdfcraft_render::RenderedPage {
-                request: req,
-                width: 0,
-                height: 0,
-                rgba: Default::default(),
-                error: Some("extraction failed".into()),
-                text: None,
-                warnings: Vec::new(),
-                millis: 0,
-            },
-        );
-        // Active match was on page 0 which failed: current should fall back to match on page 1 without jitter
-        assert_eq!(v.find.as_ref().unwrap().current, Some(0));
-        assert_eq!(v.find.as_ref().unwrap().matches, vec![(1, 5..9)]);
-        assert!(v.goto.is_none());
-    }
-
-    /// A page whose picture moved can get its whole-page raster back before its last stale tile.
-    /// From then on the raster has the picture where it went: it is drawn from there, not from
-    /// where it was (which the raster now shows empty), and another drag starts from there too.
-    #[test]
-    fn a_moved_picture_is_drawn_from_the_fresh_raster_while_a_tile_is_still_stale() {
-        let content = b"q 60 0 0 60 40 260 cm /Im0 Do Q";
-        let objs: Vec<Vec<u8>> = vec![
-            b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
-            b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".to_vec(),
-            b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >>".to_vec(),
-            [format!("<< /Length {} >>\nstream\n", content.len()).as_bytes(), content.as_slice(), b"\nendstream"].concat(),
-            [
-                b"<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 3 >>\nstream\n".as_slice(),
-                &[200, 30, 30],
-                b"\nendstream",
-            ]
-            .concat(),
-        ];
-        let mut bytes = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, o) in objs.iter().enumerate() {
-            offsets.push(bytes.len());
-            bytes.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
-            bytes.extend_from_slice(o);
-            bytes.extend_from_slice(b"\nendobj\n");
-        }
-        let xref = bytes.len();
-        bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
-        for o in offsets {
-            bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
-        let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 1100.0)).build_eframe(move |_cc| {
-            let mut app = PdfCraftApp::new();
-            app.set_option("language", "en").unwrap();
-            app.open_bytes("picture.pdf", None, bytes.clone()).unwrap();
-            app.set_option("zoom", "100").unwrap();
-            app.quick_tool = QuickTool::EditText;
-            app
-        });
-        let settle = |h: &mut egui_kittest::Harness<'static, PdfCraftApp>| {
-            for _ in 0..400 {
-                h.step();
-                if !h.state().render_pending() {
-                    return;
-                }
-                std::thread::sleep(std::time::Duration::from_millis(5));
-            }
-        };
-        h.run_steps(4);
-        settle(&mut h);
-        let page = h.state().views[0].page_screen_rect(0).unwrap();
-        let at = |x: f32, y: f32| egui::pos2(page.left() + x / 300.0 * page.width(), page.top() + (400.0 - y) / 400.0 * page.height());
-        let red = |pixels: &image::RgbaImage, r: Rect| {
-            let (w, hh) = (pixels.width(), pixels.height());
-            (r.top().max(0.0) as u32..(r.bottom() as u32).min(hh))
-                .flat_map(|y| (r.left().max(0.0) as u32..(r.right() as u32).min(w)).map(move |x| (x, y)))
-                .filter(|(x, y)| matches!(pixels.get_pixel(*x, *y).0, [r, g, b, _] if r > 150 && g < 90 && b < 90))
-                .count()
-        };
-        let (old, new) = (Rect::from_two_pos(at(42.0, 262.0), at(98.0, 318.0)), Rect::from_two_pos(at(182.0, 82.0), at(238.0, 138.0)));
-        // Select the picture and drag it, without overlap, from (40, 260) to (180, 80).
-        let drag = |h: &mut egui_kittest::Harness<'static, PdfCraftApp>, from: Pos2, to: Pos2, release: bool| {
-            h.hover_at(from);
-            h.run_steps(1);
-            h.drag_at(from);
-            h.run_steps(1);
-            for k in 1..=4 {
-                h.hover_at(from + (to - from) * (k as f32 / 4.0));
-                h.run_steps(1);
-            }
-            if release {
-                h.drop_at(to);
-                h.step();
-            }
-        };
-        let (grab, put) = (at(70.0, 290.0), at(210.0, 110.0));
-        h.hover_at(grab);
-        h.run_steps(1);
-        h.drag_at(grab);
-        h.run_steps(1);
-        h.drop_at(grab);
-        h.run_steps(3);
-        assert!(h.state().views[0].image_selection.is_some(), "the picture is selected");
-        h.state_mut().views[0].hold_rasters = true;
-        drag(&mut h, grab, put, true);
-        // One tile stays stale, as a tile result arriving after the whole-page raster would; then
-        // the whole-page raster is let through.
-        let tile = h.ctx.load_texture("stale-tile", egui::ColorImage::new([1, 1], vec![Color32::TRANSPARENT]), TextureOptions::LINEAR);
-        h.state_mut().views[0].tiles.insert((0, 1, 0, 0), tile);
-        h.state_mut().views[0].stale_tiles.insert((0, 1, 0, 0));
-        h.state_mut().views[0].hold_rasters = false;
-        for _ in 0..400 {
-            h.step();
-            if !h.state().views[0].page_raster_out_of_date(0) {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert!(!h.state().views[0].page_raster_out_of_date(0), "the whole-page raster is fresh");
-        assert!(h.state().views[0].page_out_of_date(0), "a tile is still stale");
-        h.run_steps(2);
-        let pixels = h.render().unwrap();
-        assert!(red(&pixels, new) > 100, "the picture shows where it went");
-        assert_eq!(red(&pixels, old), 0, "and not where it was");
-        // Another drag in that interval takes its pixels from where the raster has them.
-        let further = at(210.0, 200.0);
-        drag(&mut h, put, further, false);
-        let pixels = h.render().unwrap();
-        let moving = Rect::from_two_pos(at(182.0, 172.0), at(238.0, 228.0));
-        assert!(red(&pixels, moving) > 100, "the dragged picture is drawn from the fresh raster");
-        assert_eq!(red(&pixels, old), 0, "nothing shows where it first was");
-        h.state_mut().views[0].stale_tiles.clear();
-        h.state_mut().views[0].tiles.clear();
-    }
-}
+mod tests;
diff --git a/crates/ui-egui/src/canvas/area.rs b/crates/ui-egui/src/canvas/area.rs
new file mode 100644
index 0000000000..d7997a79a0
--- /dev/null
+++ b/crates/ui-egui/src/canvas/area.rs
@@ -0,0 +1,168 @@
+use super::*;
+
+/// A validation badge drawn over a signature widget: the widget rectangle (user space), the verdict it shows, and its hover text.
+pub(crate) struct SignatureBadge {
+    pub rect: [f64; 4],
+    pub status: pdfcraft_engine::SignatureStatus,
+    pub summary: &'static str,
+}
+
+/// The validation badges drawn over one page's signature widgets: signed, visible widgets
+/// on this page with coordinates that survive the cast to screen space. Hostile files can
+/// carry NaN, infinite or gigantic rectangles, which must never reach the painter.
+pub(crate) fn signature_badges(signatures: &[pdfcraft_engine::SignatureInfo], page: usize) -> Vec<SignatureBadge> {
+    signatures
+        .iter()
+        .filter(|s| s.signed && s.visible && s.page == Some(page))
+        .filter_map(|s| {
+            s.rect.filter(|r| r.iter().all(|v| v.is_finite() && v.abs() < f32::MAX as f64)).map(|rect| SignatureBadge {
+                rect,
+                status: s.status,
+                summary: s.summary(),
+            })
+        })
+        .collect()
+}
+
+/// The hover popup for an annotation. Replies and Fill & Sign marks (typed text, checks, signatures)
+/// show none: they are page content being edited, not comments.
+pub(super) fn annotation_hover_text(a: &pdfcraft_render::Annotation) -> Option<String> {
+    if a.is_reply() || a.fill_sign {
+        return None;
+    }
+    let who = a.author.clone().unwrap_or_else(|| a.subtype.clone());
+    let body = a.contents.clone().unwrap_or_default();
+    Some(if body.is_empty() { who } else { format!("{who}\n{body}") })
+}
+
+/// Suppression window for egui's eased copy of point input.
+///
+/// egui 0.36.2 drains `WheelState::after_events` tail deltas by 90% per 0.1 s.
+pub(super) const SUPPRESS_SECS: f64 = 0.25;
+
+/// Short rolling extension while egui still has an unprocessed wheel tail.
+pub(super) const SUPPRESS_TAIL_SECS: f64 = 0.05;
+
+// Keep the viewer's scroll identity tied to the document instead of its parent UI.
+pub(super) fn page_scroll<R>(
+    ui: &mut egui::Ui,
+    scroll: egui::ScrollArea,
+    id: egui::Id,
+    draw: impl FnOnce(&mut egui::Ui, egui::Rect) -> R,
+) -> egui::scroll_area::ScrollAreaOutput<R> {
+    ui.scope_builder(egui::UiBuilder::new().scope_id(id), |ui| scroll.show_viewport(ui, draw)).inner
+}
+
+/// Run a push button's action (the ones that need no JavaScript engine).
+pub(super) fn run_button(app: &mut PdfCraftApp, index: usize, name: &str, action: pdfcraft_engine::form_scripts::ButtonAction) {
+    use pdfcraft_engine::form_scripts::ButtonAction as B;
+    let pages = app.session.get(app.views[index].id).map_or(0, |d| d.info.pages.len());
+    match action {
+        B::Reset { fields, exclude } => {
+            let all: Vec<String> = app.session.get(app.views[index].id).map(|d| d.form.iter().map(|f| f.name.clone()).collect()).unwrap_or_default();
+            let listed = |n: &String| fields.iter().any(|f| n == f || n.starts_with(&format!("{f}.")));
+            let names = match (fields.is_empty(), exclude) {
+                (true, _) => None,
+                (false, false) => Some(all.iter().filter(|n| listed(n)).cloned().collect()),
+                (false, true) => Some(all.iter().filter(|n| !listed(n)).cloned().collect()),
+            };
+            app.views[index].forms.focus = None;
+            app.views[index].pending_edit = Some(pdfcraft_engine::Edit::ResetForm { names });
+        }
+        B::Named(n) => match n.as_str() {
+            "Print" => app.open_print(),
+            // What PdfCraft's XFA buttons use, and what a script's `execMenuItem("Save")`
+            // does too: the Save As dialog, so a click never overwrites the file unasked.
+            "SaveAs" => app.run_command("file.save_as"),
+            "NextPage" => app.views[index].step_page(true),
+            "PrevPage" => app.views[index].step_page(false),
+            "FirstPage" => app.views[index].go_to_page(0),
+            "LastPage" => app.views[index].go_to_page(pages.saturating_sub(1)),
+            other => app.notify_fmt("{name}: the {other} action isn't supported yet", &[("name", name), ("other", other)]),
+        },
+        B::Uri(u) => app.request_document_url(&u, crate::LinkOrigin::Button),
+        B::GoTo(p) => app.views[index].go_to_page(p.min(pages.saturating_sub(1))),
+        B::ShowHide { fields, hide } => {
+            let listed = |n: &String| fields.iter().any(|f| n == f || n.starts_with(&format!("{f}.")));
+            // `display.hidden` 1, `display.visible` 0, as a script setting `field.display` would.
+            let changes: Vec<pdfcraft_engine::FieldChange> = app
+                .session
+                .get(app.views[index].id)
+                .map(|d| d.form.iter().filter(|f| listed(&f.name)).map(|f| f.name.clone()).collect::<Vec<_>>())
+                .unwrap_or_default()
+                .into_iter()
+                .map(|name| pdfcraft_engine::FieldChange {
+                    name,
+                    value: None,
+                    read_only: None,
+                    required: None,
+                    display: Some(if hide { 1 } else { 0 }),
+                })
+                .collect();
+            if !changes.is_empty() {
+                let label = if hide { "Hide a field" } else { "Show a field" };
+                app.views[index].pending_edit =
+                    Some(pdfcraft_engine::Edit::Batch { label: label.into(), edits: vec![pdfcraft_engine::Edit::ApplyScriptChanges { changes }] });
+            }
+        }
+        B::SetLayers { changes, preserve_rb } => {
+            use pdfcraft_engine::form_scripts::LayerOp as Op;
+            let changes: Vec<(LayerOp, (u32, u16))> = changes
+                .into_iter()
+                .map(|(op, ocg)| {
+                    let op = match op {
+                        Op::On => LayerOp::On,
+                        Op::Off => LayerOp::Off,
+                        Op::Toggle => LayerOp::Toggle,
+                    };
+                    (op, ocg)
+                })
+                .collect();
+            set_layers(app, index, &changes, preserve_rb);
+        }
+        B::Alert(m) => app.notify(m),
+        B::Submit(url) => app.notify_fmt(
+            "{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.",
+            &[("name", name), ("url", &url)],
+        ),
+        B::ImportIcon => app.choose_field_image(name),
+        B::Script(js) => {
+            let id = app.views[index].id;
+            app.run_button_script(id, name, &js);
+        }
+    }
+}
+
+/// Run a set-layer-visibility action from a button or link. It changes what is shown, as the
+/// Layers panel does (which follows), not the document.
+pub(super) fn set_layers(app: &mut PdfCraftApp, index: usize, changes: &[(LayerOp, (u32, u16))], preserve_rb: bool) {
+    let id = app.views[index].id;
+    if app.session.set_layer_state(id, changes, preserve_rb) {
+        app.views[index].invalidate_content();
+    }
+}
+
+/// Where a pinch or ⌘-scroll zooms the view about: the pointer, wherever it is over the view. Not
+/// page input: it is read before the pages' widget exists, once `rect_contains_pointer` has found
+/// the view under the pointer.
+pub(super) fn zoom_anchor(ui: &egui::Ui) -> Option<Pos2> {
+    ui.input(|i| i.pointer.hover_pos())
+}
+
+/// The pointer and frame time that scroll the view while a comment is drawn. Not page input: it is
+/// read before the pages' widget exists, and the pointer may be past the view's edge.
+pub(super) fn drawing_edge_pointer(ui: &egui::Ui) -> (Option<Pos2>, f32) {
+    ui.input(|i| (i.pointer.latest_pos(), i.stable_dt))
+}
+
+/// A press anywhere, or a key, stops the touchpad's glide (#531).
+pub(super) fn glide_interrupted(ui: &egui::Ui) -> bool {
+    ui.input(|i| i.pointer.any_pressed() || i.events.iter().any(|e| matches!(e, egui::Event::Key { pressed: true, .. })))
+}
+
+/// Full screen's click on the document, which turns the page: a primary click this frame with the
+/// view on top under it in `area`. Not page input: it is read before the pages' widget exists, and
+/// the turn waits until the pages have had the click.
+pub(super) fn presentation_click(ui: &egui::Ui, area: Rect) -> bool {
+    ui.rect_contains_pointer(area) && ui.input(|i| i.pointer.primary_clicked())
+}
diff --git a/crates/ui-egui/src/autoscroll.rs b/crates/ui-egui/src/canvas/autoscroll.rs
similarity index 100%
rename from crates/ui-egui/src/autoscroll.rs
rename to crates/ui-egui/src/canvas/autoscroll.rs
diff --git a/crates/ui-egui/src/canvas/bars.rs b/crates/ui-egui/src/canvas/bars.rs
new file mode 100644
index 0000000000..4d916a1b8c
--- /dev/null
+++ b/crates/ui-egui/src/canvas/bars.rs
@@ -0,0 +1,487 @@
+use super::*;
+
+/// Whether `p` lies in the bottom-left quadrant of `area`, where the page size shows (#1855).
+pub(super) fn in_size_hint_zone(area: Rect, p: Pos2) -> bool {
+    p.x >= area.min.x && p.x < area.center().x && p.y > area.center().y && p.y <= area.max.y
+}
+
+/// The current page's size, floating at the bottom-left of the document area while the pointer is
+/// in that quadrant, as Acrobat does. Same formatter and unit as Document Properties.
+pub(super) fn page_size_hint(
+    view: &DocView,
+    info: &DocInfo,
+    units: crate::units::Unit,
+    area: Rect,
+    unobstructed: bool,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+) {
+    let Some(page) = info.pages.get(view.current) else { return };
+    let inside = unobstructed && ui.input(|i| i.pointer.hover_pos()).is_some_and(|p| in_size_hint_zone(area, p));
+    if !inside {
+        return;
+    }
+    let text = units.size(f64::from(page.width), f64::from(page.height));
+    egui::Area::new(egui::Id::unique("page-size-hint"))
+        .order(egui::Order::Foreground)
+        .interactable(false)
+        .pivot(egui::Align2::LEFT_BOTTOM)
+        .fixed_pos(area.left_bottom() + vec2(14.0, -14.0))
+        .show(ui.ctx(), |ui| {
+            egui::Frame::NONE
+                .fill(t.card)
+                .stroke(Stroke::new(1.0, t.border))
+                .corner_radius(CornerRadius::same(6))
+                .inner_margin(egui::Margin::symmetric(8, 4))
+                .show(ui, |ui| {
+                    ui.add(egui::Label::new(egui::RichText::new(text).color(t.text)).selectable(false));
+                });
+        });
+}
+
+/// What the notice bar's buttons ask for.
+pub(super) enum Notice {
+    /// Reload the file that changed on disk, dropping unsaved changes.
+    Reload,
+    Security,
+    Signatures,
+    Repairs,
+    /// Highlight fields was turned on or off.
+    FieldHighlights(bool),
+    /// Open the JavaScript console (the form's scripts were turned off; the error is there).
+    Console,
+    /// Unlock… (enter the permissions password).
+    Unlock,
+    /// Close this historical snapshot tab (View signed version / View revision).
+    Close,
+    /// Stop showing the secured-document notice, in every document (#4035).
+    HideSecured,
+}
+
+/// The notice bar above the pages: a file changed on disk first, then what a historical
+/// snapshot is, then the signature status bar, a form's scripts having been turned
+/// off, security, forms and warnings.
+pub(super) fn notices(
+    view: &mut DocView,
+    doc: &pdfcraft_engine::Document,
+    secured: bool,
+    repaired: bool,
+    signed: Option<(&str, Color32, &str, String)>,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+) -> Option<Notice> {
+    let info = &doc.info;
+    let xfa = doc.xfa.as_ref();
+    // The file changed on disk while this document has unsaved changes (#431): ask before
+    // replacing it, ahead of every other notice.
+    if view.disk_changed {
+        let mut reload = false;
+        egui::Frame::NONE.fill(t.accent_soft).inner_margin(egui::Margin::symmetric(14, 7)).show(ui, |ui| {
+            ui.horizontal(|ui| {
+                ui.add(icons::image("rotate-cw", 16.0, t.accent_text));
+                ui.label(
+                    egui::RichText::new(tl!(
+                        "This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version."
+                    ))
+                    .color(t.text),
+                );
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if icons::button(ui, "x", 22.0, false, tl!("Dismiss")).clicked() {
+                        view.disk_changed = false;
+                    }
+                    reload = crate::widgets::pill_button(ui, tl!("Reload"), false).clicked();
+                });
+            });
+        });
+        return reload.then_some(Notice::Reload);
+    }
+    // A historical snapshot (View signed version / View revision): what it is, above the
+    // signature and security bars, so the tab is never mistaken for the live document.
+    if let Some(snap) = view.snapshot.as_ref() {
+        let mut close = false;
+        let text = if snap.kind == SnapshotKind::SignedVersion {
+            crate::i18n::fmt(
+                tl!("You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original."),
+                &[("from", &snap.from), ("rev", &snap.revision.to_string())],
+            )
+        } else {
+            crate::i18n::fmt(
+                tl!("You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original."),
+                &[("rev", &snap.revision.to_string()), ("from", &snap.from)],
+            )
+        };
+        notice_bar(ui, t, "clock", t.accent_text, text, |ui| {
+            if crate::widgets::pill_button(ui, tl!("Close"), true).clicked() {
+                close = true;
+            }
+        });
+        if close {
+            return Some(Notice::Close);
+        }
+    }
+    if let Some((icon, color, template, arg)) = signed {
+        let mut open = false;
+        notice_bar(ui, t, icon, color, crate::i18n::fmt(tl!(template), &[("by", &arg)]), |ui| {
+            if crate::widgets::pill_button(ui, tl!("Signature panel"), false).clicked() {
+                open = true;
+            }
+        });
+        return open.then_some(Notice::Signatures);
+    }
+    if view.notice_dismissed {
+        return None;
+    }
+    let mut open_security = false;
+    let mut unlock = false;
+    let mut hide_secured = false;
+    let mut open_repairs = false;
+    let mut open_console = false;
+    let mut toggled = None;
+    // A form whose scripts were turned off no longer calculates or answers its buttons: that
+    // comes before what else there is to say about the document.
+    let scripts_off = doc.xfa_scripts_off();
+    // What the document is as a form, if it is one: what the bar says first, secured or not.
+    let form = if let Some(x) = xfa {
+        let lang = crate::i18n::current();
+        let pages = crate::i18n::trn(lang, x.pages as u64, "{n} page", "{n} pages");
+        let fields = crate::i18n::trn(lang, x.fields as u64, "{n} field", "{n} fields");
+        let mut text =
+            crate::i18n::fmt(tl!("Dynamic XFA form laid out from its template: {pages}, {fields}."), &[("pages", &pages), ("fields", &fields)]);
+        if !x.warnings.is_empty() {
+            // The notes are clauses ("a picture is left out"); the first starts a sentence here.
+            let notes = x.warnings.join("; ");
+            let mut chars = notes.chars();
+            text.push(' ');
+            text.extend(chars.next().into_iter().flat_map(char::to_uppercase));
+            text.push_str(chars.as_str());
+            text.push('.');
+        }
+        Some(("text-cursor-input", text, true))
+    } else if info.xfa == Some(pdfcraft_render::Xfa::Dynamic) {
+        Some((
+            "triangle-alert",
+            tl!("This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.").to_string(),
+            false,
+        ))
+    } else if info.xfa == Some(pdfcraft_render::Xfa::Static) {
+        Some((
+            "text-cursor-input",
+            tl!("XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.").to_string(),
+            true,
+        ))
+    } else if info.fields.iter().any(|f| f.kind != pdfcraft_render::FieldKind::PushButton) {
+        // Push buttons alone (LaTeX `animate` frames, navigation buttons) leave nothing to fill in.
+        Some((
+            "text-cursor-input",
+            crate::i18n::fmt(tl!("This document contains {n} interactive form fields."), &[("n", &info.fields.len().to_string())]),
+            true,
+        ))
+    } else {
+        None
+    };
+    let msg = if scripts_off {
+        Some(("triangle-alert", crate::js_ui::scripts_off_notice(), true))
+    } else if secured {
+        // A secured form still says what it is, and keeps Highlight fields: the security
+        // sentence follows the form's.
+        let security = tl!("This document is secured. Some changes are restricted by its security settings.");
+        Some(match form {
+            Some((icon, text, fields)) => (icon, format!("{text} {security}"), fields),
+            None => ("lock", security.to_string(), false),
+        })
+    } else if form.is_some() {
+        form
+    } else if repaired {
+        Some(("bandage", tl!("This file was damaged and has been repaired. Saving keeps the repaired version.").to_string(), false))
+    } else if !info.warnings.is_empty() {
+        Some(("triangle-alert", info.warnings[0].clone(), false))
+    } else {
+        None
+    };
+    let (icon, text, fields) = msg?;
+    notice_bar(ui, t, icon, t.accent_text, text, |ui| {
+        if icons::button(ui, "x", 22.0, false, tl!("Dismiss")).clicked() {
+            view.notice_dismissed = true;
+        }
+        if fields {
+            let label = if view.highlight_fields { tl!("Hide field highlights") } else { tl!("Highlight fields") };
+            if crate::widgets::pill_button(ui, label, view.highlight_fields).clicked() {
+                view.highlight_fields = !view.highlight_fields;
+                toggled = Some(Notice::FieldHighlights(view.highlight_fields));
+            }
+        }
+        if scripts_off && crate::widgets::pill_button(ui, tl!("JavaScript Console"), false).clicked() {
+            open_console = true;
+        }
+        if secured && crate::widgets::pill_button(ui, tl!("Security settings"), false).clicked() {
+            open_security = true;
+        }
+        if secured && doc.can_unlock() && crate::widgets::pill_button(ui, tl!("Unlock…"), true).clicked() {
+            unlock = true;
+        }
+        // Only when the bar shows the security message: a form's stopped scripts come first.
+        if secured && !scripts_off && crate::widgets::pill_button(ui, tl!("Don't show again"), false).clicked() {
+            hide_secured = true;
+        }
+        if repaired && !secured && info.fields.is_empty() && crate::widgets::pill_button(ui, tl!("Details"), false).clicked() {
+            open_repairs = true;
+        }
+    });
+    if open_repairs {
+        return Some(Notice::Repairs);
+    }
+    if open_console {
+        return Some(Notice::Console);
+    }
+    if unlock {
+        return Some(Notice::Unlock);
+    }
+    if hide_secured {
+        return Some(Notice::HideSecured);
+    }
+    open_security.then_some(Notice::Security).or(toggled)
+}
+
+/// One notice bar: an icon and a message on the left, `buttons` (added right to left) on the
+/// right. The buttons are laid out first, so the message only gets the width they leave: it
+/// wraps there (or, when very little is left, is cut short with the full text on hover) instead
+/// of running under the buttons and past the document area into the side panel (#785). The
+/// buttons are centred on a row of button height, and the message's first line is centred on
+/// the same row; a wrapped message grows the bar downwards.
+fn notice_bar(ui: &mut egui::Ui, t: &Tokens, icon: &str, icon_color: Color32, text: String, buttons: impl FnOnce(&mut egui::Ui)) {
+    const ROW: f32 = 28.0;
+    const ICON: f32 = 16.0;
+    egui::Frame::NONE.fill(t.accent_soft).inner_margin(egui::Margin::symmetric(14, 7)).show(ui, |ui| {
+        let width = ui.available_width();
+        ui.allocate_ui_with_layout(vec2(width, ROW), egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            ui.set_min_height(ROW);
+            buttons(ui);
+            let rest = ui.available_width().max(0.0);
+            ui.allocate_ui_with_layout(vec2(rest, ROW), egui::Layout::top_down(egui::Align::Min), |ui| {
+                let font = egui::TextStyle::Body.resolve(ui.style());
+                let line = ui.fonts_mut(|f| f.row_height(&font)).max(ICON);
+                ui.add_space(((ROW - line) / 2.0).max(0.0));
+                ui.with_layout(egui::Layout::left_to_right(egui::Align::Min), |ui| {
+                    let (slot, _) = ui.allocate_exact_size(vec2(ICON, line), Sense::hover());
+                    icons::paint(ui, Rect::from_center_size(slot.center(), vec2(ICON, ICON)), icon, ICON, icon_color);
+                    let label = egui::Label::new(egui::RichText::new(text).color(t.text));
+                    // Wrapping into a sliver would stack the message a few letters per line.
+                    ui.add(if ui.available_width() >= 120.0 { label.wrap() } else { label.truncate() });
+                });
+            });
+        });
+    });
+}
+
+/// The floating quick-action bar at the left edge of the document area.
+pub(super) fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    let pos = area.left_top() + vec2(14.0, 14.0);
+    egui::Area::new(egui::Id::unique("quick-bar")).order(egui::Order::Middle).fixed_pos(pos).show(ui.ctx(), |ui| {
+        egui::Frame::NONE
+            .fill(t.card)
+            .stroke(Stroke::new(1.0, t.border))
+            .corner_radius(CornerRadius::same(12))
+            .shadow(egui::Shadow { offset: [0, 4], blur: 16, spread: 0, color: Color32::from_black_alpha(if t.dark() { 100 } else { 28 }) })
+            .inner_margin(egui::Margin::same(6))
+            .show(ui, |ui| {
+                ui.spacing_mut().item_spacing.y = 2.0;
+                ui.vertical(|ui| {
+                    if icons::button(ui, "mouse-pointer-2", 32.0, app.quick_tool == QuickTool::Select, tl!("Select (V)")).clicked() {
+                        app.quick_tool = QuickTool::Select;
+                    }
+                    if icons::button(ui, "hand", 32.0, app.quick_tool == QuickTool::Hand, tl!("Hand (H)")).clicked() {
+                        app.quick_tool = QuickTool::Hand;
+                    }
+                    // Comment ▸, Highlight ▸, Draw ▸ (Acrobat's comment toolbar groups). Clicking a
+                    // group selects its last-used tool; clicking it again opens the flyout.
+                    for g in 0..comments::GROUPS.len() {
+                        let current = app.comment_prefs.group_tool[g];
+                        let active = matches!(app.quick_tool, QuickTool::Comment(t) if t.group() == g);
+                        let resp = icons::button(ui, current.icon(), 32.0, active, tl!(current.label()));
+                        // A small corner triangle marks the flyout.
+                        let r = resp.rect;
+                        let tri = [r.right_bottom() + vec2(-4.0, -4.0), r.right_bottom() + vec2(-9.0, -4.0), r.right_bottom() + vec2(-4.0, -9.0)];
+                        ui.painter().add(egui::Shape::convex_polygon(tri.to_vec(), if active { t.accent } else { t.text_faint }, Stroke::NONE));
+                        let open = (resp.clicked() && active) || resp.secondary_clicked();
+                        if resp.clicked() && !active {
+                            app.execute(current.command());
+                        }
+                        egui::Popup::menu(&resp)
+                            .open_memory(open.then_some(egui::SetOpenCommand::Toggle))
+                            .align(egui::RectAlign::RIGHT_START)
+                            .gap(6.0)
+                            .show(|ui| {
+                                for tool in comments::GROUPS[g] {
+                                    let on = app.quick_tool == QuickTool::Comment(*tool);
+                                    let (row, click) = ui.allocate_exact_size(vec2(180.0, 28.0), Sense::click());
+                                    let press = theme::Press::track(ui, &click);
+                                    press.wash(ui, row, 4, on);
+                                    let body = row.translate(press.offset());
+                                    icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
+                                    let reserve = if on { 28.0 } else { 8.0 };
+                                    crate::widgets::paint_left(
+                                        ui,
+                                        body.left_center() + vec2(34.0, 0.0),
+                                        tl!(tool.label()),
+                                        theme::regular(13.0),
+                                        t.text,
+                                        (row.width() - 34.0 - reserve).max(0.0),
+                                    );
+                                    if on {
+                                        icons::paint(
+                                            ui,
+                                            Rect::from_min_size(body.right_top() + vec2(-24.0, 7.0), vec2(14.0, 14.0)),
+                                            "check",
+                                            14.0,
+                                            t.accent,
+                                        );
+                                    }
+                                    let click = theme::hand(click);
+                                    let info = tl!(tool.label()).to_string();
+                                    click.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, on, info.clone()));
+                                    if click.clicked() {
+                                        app.execute(tool.command());
+                                        ui.close();
+                                    }
+                                }
+                            });
+                    }
+                    // Edit text & images, while the Edit workspace is open (Acrobat's Edit toolbar)
+                    // or the tool is in use.
+                    if app.mode == crate::Mode::Edit || app.quick_tool == QuickTool::EditText {
+                        let on = app.quick_tool == QuickTool::EditText;
+                        if icons::button(ui, "text-cursor-input", 32.0, on, tl!("Edit text & images")).clicked() {
+                            if on {
+                                app.put_down_edit_text();
+                            } else {
+                                app.quick_tool = QuickTool::EditText;
+                            }
+                        }
+                    }
+                    // Fill & Sign ▸ (text, marks, date, signature).
+                    let current_fill = match app.quick_tool {
+                        QuickTool::Fill(f) => Some(f),
+                        _ => None,
+                    };
+                    let shown = current_fill.unwrap_or(crate::fill_sign::FillTool::Text);
+                    let resp = icons::button(
+                        ui,
+                        if current_fill.is_some() { shown.icon() } else { "pen-line" },
+                        32.0,
+                        current_fill.is_some(),
+                        tl!("Fill & Sign"),
+                    );
+                    let r = resp.rect;
+                    let tri = [r.right_bottom() + vec2(-4.0, -4.0), r.right_bottom() + vec2(-9.0, -4.0), r.right_bottom() + vec2(-4.0, -9.0)];
+                    ui.painter().add(egui::Shape::convex_polygon(
+                        tri.to_vec(),
+                        if current_fill.is_some() { t.accent } else { t.text_faint },
+                        Stroke::NONE,
+                    ));
+                    if resp.clicked() && current_fill.is_none() {
+                        app.execute(shown.command());
+                    }
+                    let open = (resp.clicked() && current_fill.is_some()) || resp.secondary_clicked();
+                    egui::Popup::menu(&resp)
+                        .open_memory(open.then_some(egui::SetOpenCommand::Toggle))
+                        .align(egui::RectAlign::RIGHT_START)
+                        .gap(6.0)
+                        .show(|ui| {
+                            for tool in crate::fill_sign::FILL_TOOLS {
+                                if matches!(tool, crate::fill_sign::FillTool::Signature | crate::fill_sign::FillTool::Initials) {
+                                    continue;
+                                }
+                                let on = current_fill == Some(tool);
+                                let (row, click) = ui.allocate_exact_size(vec2(180.0, 28.0), Sense::click());
+                                let press = theme::Press::track(ui, &click);
+                                press.wash(ui, row, 4, on);
+                                let body = row.translate(press.offset());
+                                icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
+                                let reserve = if on { 28.0 } else { 8.0 };
+                                crate::widgets::paint_left(
+                                    ui,
+                                    body.left_center() + vec2(34.0, 0.0),
+                                    tl!(tool.label()),
+                                    theme::regular(13.0),
+                                    t.text,
+                                    (row.width() - 34.0 - reserve).max(0.0),
+                                );
+                                if on {
+                                    icons::paint(
+                                        ui,
+                                        Rect::from_min_size(body.right_top() + vec2(-24.0, 7.0), vec2(14.0, 14.0)),
+                                        "check",
+                                        14.0,
+                                        t.accent,
+                                    );
+                                }
+                                let click = theme::hand(click);
+                                let info = tl!(tool.label()).to_string();
+                                click.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, on, info.clone()));
+                                if click.clicked() {
+                                    app.execute(tool.command());
+                                    ui.close();
+                                }
+                            }
+                            ui.separator();
+                            if let Some(command) = crate::fill_sign::signature_entries(ui, app, &t) {
+                                app.execute(command);
+                                ui.close();
+                            }
+                        });
+                    if matches!(current_fill, Some(crate::fill_sign::FillTool::Text | crate::fill_sign::FillTool::Date)) {
+                        ui.label(tl!("Font size:"));
+                        let size = ui.add(
+                            egui::DragValue::new(&mut app.fill_text_size)
+                                .range(crate::fill_sign::MIN_TEXT_SIZE..=crate::fill_sign::MAX_TEXT_SIZE)
+                                .speed(0.25)
+                                .suffix(" pt"),
+                        );
+                        // #1274: the size also applies to the Fill & Sign text that is selected,
+                        // once per change (a typed value, or the end of a drag), so a drag adds
+                        // one undo step and not one per frame.
+                        if ((size.changed() && !size.dragged()) || size.drag_stopped())
+                            && let Some((index, id)) = app.active_ids()
+                            && let Some((page, annotation)) = app.views.get(index).and_then(|view| view.comments.selected)
+                            && app.session.get(id).is_some_and(|doc| {
+                                doc.allows_annotation()
+                                    && doc
+                                        .info
+                                        .annotations
+                                        .iter()
+                                        .any(|a| a.page == page && a.index == annotation && a.fill_sign && a.subtype == "FreeText" && !a.locked)
+                            })
+                        {
+                            app.apply_edit(Edit::FontSizeAnnotation { page, index: annotation, size: app.fill_text_size });
+                        }
+                    }
+                    if let QuickTool::Comment(tool) = app.quick_tool {
+                        let (r, _) = ui.allocate_exact_size(vec2(32.0, 9.0), Sense::hover());
+                        ui.painter().hline(r.x_range().shrink(6.0), r.center().y, Stroke::new(1.0, t.divider));
+                        if let Some(color) = comments::quick_bar_controls(ui, tool, &mut app.comment_prefs)
+                            && let Some((index, id)) = app.active_ids()
+                            && let Some((page, annotation)) = app.views.get(index).and_then(|view| view.comments.selected)
+                            && app.session.get(id).is_some_and(|doc| {
+                                doc.allows_annotation()
+                                    && doc
+                                        .info
+                                        .annotations
+                                        .iter()
+                                        .any(|a| a.page == page && a.index == annotation && !a.is_reply() && comments::made_by(a, tool))
+                            })
+                        {
+                            app.apply_edit(Edit::StyleAnnotation {
+                                page,
+                                index: annotation,
+                                color: Some(color),
+                                opacity: None,
+                                width: None,
+                                endings: None,
+                            });
+                        }
+                    }
+                });
+            });
+    });
+}
diff --git a/crates/ui-egui/src/canvas/cache.rs b/crates/ui-egui/src/canvas/cache.rs
new file mode 100644
index 0000000000..d8a1d1d445
--- /dev/null
+++ b/crates/ui-egui/src/canvas/cache.rs
@@ -0,0 +1,736 @@
+use super::find::Follow;
+use super::*;
+
+pub(super) const THUMB_TAG: u64 = 1 << 63;
+
+pub(super) const TEXT_TAG: u64 = 1 << 62;
+
+/// A page rendered for the organize grid at the size it is drawn there.
+pub(super) const GRID_TAG: u64 = 1 << 61;
+
+/// Preview rasters tagged with this bit are converted to luminance on receipt, matching the
+/// monochrome print requested by Print ▸ Print in grayscale. It is a bit of its own: the
+/// renderer's print bit ([`PRINT_TAG`]) is carried by every print preview, so sharing it would
+/// turn colour previews into monochrome ones too.
+pub(super) const GRAYSCALE_TAG: u64 = 1 << 59;
+
+/// The tag of a raster that is out of date (shown until its replacement arrives).
+pub(super) const STALE_TAG: u64 = u64::MAX;
+
+/// Pages whose raster would exceed this many device pixels on a side are drawn in tiles.
+pub(crate) const TILE_THRESHOLD: f32 = 4096.0;
+
+/// Base device-pixel side of a page tile. The actual side grows with the zoom
+/// ([`tile_side`]), so a zoomed viewport is covered by a few tiles instead of many.
+pub(super) const TILE: u32 = 1024;
+
+/// Longest side of the backdrop drawn under tiles, and of a live page preview (signature drag).
+pub(crate) const BASE_SIDE: f32 = 2048.0;
+
+/// Thumbnail slot before density scaling. The pages panel draws at most 150 logical points and
+/// the organize grid about 146; when the byte budget allows, density reaches the screen so those
+/// images are sampled down instead of stretched.
+pub(super) const THUMB_W: f32 = 240.0;
+
+pub(super) const THUMB_H: f32 = 320.0;
+
+pub(super) const THUMB_BYTES: usize = 24 * 1024 * 1024;
+
+pub(super) const PAGE_BYTES: usize = 128 * 1024 * 1024;
+
+pub(super) const TILE_BYTES: usize = 128 * 1024 * 1024;
+
+const UPLOAD_BYTES_PER_FRAME: usize = 16 * 1024 * 1024;
+
+const RESULTS_PER_FRAME: usize = 8;
+
+/// A defensive ceiling for unusually large viewports / n-up previews.
+pub(super) const MAX_THUMB_DEMAND: usize = 256;
+
+/// At most this many whole-page rasters are cached beyond the ones on screen.
+const MAX_CACHED_PAGES: usize = 24;
+
+/// At most this many text layers are cached beyond visible, selected and matched pages.
+/// Text layers are glyph structs, far smaller than rasters; deliberately independent of
+/// `MAX_CACHED_PAGES` so raster tuning never silently retunes text memory.
+pub(super) const MAX_CACHED_TEXT_PAGES: usize = 24;
+
+pub(super) fn rgba_bytes(width: usize, height: usize) -> usize {
+    width.saturating_mul(height).saturating_mul(4)
+}
+
+pub(super) fn texture_bytes(tex: &TextureHandle) -> usize {
+    let [w, h] = tex.size();
+    rgba_bytes(w, h)
+}
+
+/// Visible grid rows, plus one adjacent row in either direction. Work is independent of
+/// document length, including after a large scroll jump.
+pub(crate) fn thumbnail_rows(top: f32, bottom: f32, row_height: f32, rows: usize) -> Range<usize> {
+    let first = (top.max(0.0) / row_height).floor() as usize;
+    let end = (bottom.max(0.0) / row_height).ceil() as usize;
+    first.saturating_sub(1).min(rows)..end.saturating_add(1).min(rows)
+}
+
+pub(super) struct PageTex {
+    pub(super) tag: u64,
+    pub(super) tex: TextureHandle,
+}
+
+/// Retained RGBA texture accounting for automation and performance regressions. These
+/// surface bytes exclude driver overhead and temporary upload buffers; they are not RSS.
+#[derive(Clone, Copy, Debug, Default, serde::Serialize)]
+pub struct RasterMemory {
+    pub thumbnail_count: usize,
+    pub thumbnail_bytes: usize,
+    pub page_count: usize,
+    pub page_bytes: usize,
+    pub tile_count: usize,
+    pub tile_bytes: usize,
+    pub thumbnail_demand: usize,
+    /// Last submitted missing results; workers may have completed some since submission.
+    pub pending_requests: usize,
+}
+
+/// Thumbnail device-pixel density when `demand` pages share the thumbnail allowance.
+pub(super) fn thumbnail_density(demand: usize, ppp: f32) -> f32 {
+    let per_thumb = THUMB_BYTES / demand.max(1).next_power_of_two();
+    ppp.clamp(0.25, 4.0).min((per_thumb as f32 / (4.0 * THUMB_W * THUMB_H)).sqrt() * 0.98)
+}
+
+pub(super) fn thumbnail_scale(width: f32, height: f32, density: f32) -> f32 {
+    (THUMB_W / width.max(1.0)).min(THUMB_H / height.max(1.0)) * density
+}
+
+impl DocView {
+    pub fn raster_memory(&self) -> RasterMemory {
+        RasterMemory {
+            thumbnail_count: self.thumbs.len(),
+            thumbnail_bytes: self.thumbs.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex))),
+            page_count: self.pages.len(),
+            page_bytes: self.pages.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex))),
+            tile_count: self.tiles.len(),
+            tile_bytes: self.tiles.values().fold(0usize, |n, tex| n.saturating_add(texture_bytes(tex))),
+            thumbnail_demand: self.thumb_demand.len(),
+            pending_requests: self.last_queue.len(),
+        }
+    }
+
+    /// Pages that could not be rendered, with the reason (for automation; 0-based pages).
+    pub fn page_errors(&self) -> Vec<(usize, &str)> {
+        let mut v: Vec<(usize, &str)> = self.errors.iter().map(|(p, e)| (*p, e.as_str())).collect();
+        v.sort_unstable_by_key(|(p, _)| *p);
+        v
+    }
+
+    pub fn render_pending(&self) -> bool {
+        !self.last_queue.is_empty() || self.text_background.pending() || self.move_background.pending()
+    }
+
+    /// The cached tile keys of a page, as (scale tag, tile x, tile y) (diagnostics and tests).
+    pub fn tiles_debug(&self, page: usize) -> Vec<(u64, u32, u32)> {
+        let mut k: Vec<(u64, u32, u32)> = self.tiles.keys().filter(|key| key.0 == page).map(|key| (key.1, key.2, key.3)).collect();
+        k.sort_unstable();
+        k
+    }
+
+    /// Re-render every page and text layer (the document's appearance changed, e.g. a layer
+    /// was toggled). Out-of-date rasters stay on screen until their replacements arrive, so the
+    /// view never flashes blank.
+    pub fn invalidate_content(&mut self) {
+        // Undo, redo and other document-wide changes: a released drawing's preview would be a ghost.
+        self.comments.settling.clear();
+        for p in self.pages.values_mut() {
+            p.tag = STALE_TAG;
+        }
+        self.stale_thumbs.extend(self.thumbs.keys().copied());
+        for slot in self.print_pages.values_mut() {
+            slot.0 = STALE_TAG;
+        }
+        // Pages may have moved: a sharp render of another page would be worse than a soft one.
+        self.grid_pages.clear();
+        self.tiles.clear();
+        self.stale_tiles.clear();
+        self.forms.unbaked.clear();
+        self.texts.clear();
+        self.text_failed.clear();
+        self.errors.clear();
+        self.slow_pages.clear();
+        self.waiting_since.clear();
+        self.last_queue.clear();
+        self.selection = None;
+        self.all_text = false;
+        // A content change is not reader navigation: keep the automatic anchor so the
+        // re-extracted layers still follow it, and keep `follow_ended` so a reader who already
+        // took over stays in control. `document_changed` clamps `current`; if the view no longer
+        // sits where the automatic choice left it, `follow_page` ends it.
+        if let Some(f) = self.find.as_mut() {
+            f.matches.clear();
+            f.current = None;
+        }
+    }
+
+    /// Only `page` changed (a comment was added, edited or removed): re-render that page and
+    /// re-read its text, keep everything else. Out-of-date tiles stay on screen until replacements arrive.
+    pub fn page_changed(&mut self, page: usize) {
+        if let Some(p) = self.pages.get_mut(&page) {
+            p.tag = STALE_TAG;
+        }
+        if self.thumbs.contains_key(&page) {
+            self.stale_thumbs.insert(page);
+        }
+        if let Some(slot) = self.print_pages.get_mut(&page) {
+            slot.0 = STALE_TAG;
+        }
+        let current_tag = if self.current_scale_tag != 0 {
+            self.current_scale_tag
+        } else {
+            self.tiles.keys().filter(|k| k.0 == page).map(|k| k.1).max().unwrap_or(0)
+        };
+        self.tiles.retain(|key, _| key.0 != page || key.1 == current_tag);
+        self.stale_tiles.retain(|key| key.0 != page || key.1 == current_tag);
+        for &key in self.tiles.keys() {
+            if key.0 == page && key.1 == current_tag {
+                self.stale_tiles.insert(key);
+            }
+        }
+        self.slow_pages.remove(&page);
+        self.texts.remove(&page);
+        self.text_failed.remove(&page);
+        self.errors.remove(&page);
+        self.last_queue.clear();
+        if self.selection.is_some_and(|s| s.page == page) {
+            self.selection = None;
+        }
+    }
+
+    /// A page's thumbnail texture, when rendered.
+    pub(crate) fn thumb_id(&self, page: usize) -> Option<egui::TextureId> {
+        self.thumbs.get(&page).map(|t| t.tex.id())
+    }
+
+    /// The whole-page raster on screen for `page` (the low-res backdrop of a tiled page), if any.
+    pub(crate) fn page_raster(&self, page: usize) -> Option<egui::TextureId> {
+        self.pages.get(&page).map(|p| p.tex.id())
+    }
+
+    /// Whether `page`'s whole-page raster (a tiled page's backdrop too) is still the one from
+    /// before its last change, whatever its tiles are.
+    pub(crate) fn page_raster_out_of_date(&self, page: usize) -> bool {
+        self.pages.get(&page).is_some_and(|p| p.tag == STALE_TAG)
+    }
+
+    /// Whether `page` is still drawn, somewhere, as it was before its last change: its whole-page
+    /// raster (a tiled page's backdrop too) or any of its tiles waits for a replacement.
+    pub(crate) fn page_out_of_date(&self, page: usize) -> bool {
+        self.pages.get(&page).is_some_and(|p| p.tag == STALE_TAG) || self.stale_tiles.iter().any(|k| k.0 == page)
+    }
+
+    /// The print preview's picture of `page`: the sheet raster when it has arrived, otherwise the
+    /// thumbnail.
+    pub(crate) fn page_preview(&self, page: usize) -> Option<egui::TextureId> {
+        self.print_pages.get(&page).map(|(_, tex)| tex.id()).or_else(|| self.thumb_id(page))
+    }
+
+    pub(crate) fn page_text(&self, page: usize) -> Option<Arc<PageText>> {
+        self.texts.get(&page).cloned()
+    }
+
+    pub fn thumb(&self, page: usize) -> Option<&TextureHandle> {
+        self.thumbs.get(&page).map(|t| &t.tex)
+    }
+
+    /// How many device pixels wide the grid's sharp render of `page` is, if it has one.
+    pub fn grid_page_pixels(&self, page: usize) -> Option<u32> {
+        self.grid_pages.get(&page).map(|(w, _)| *w)
+    }
+
+    /// Start collecting demand from every consumer before scheduling or uploading results.
+    pub(crate) fn begin_render_frame(&mut self) {
+        self.frame_geometry_changed = false;
+        self.pages_panel = None;
+        self.panel_gap = None;
+        self.thumb_demand.clear();
+        self.frame_queue.clear();
+        self.frame_visible.clear();
+    }
+
+    pub(crate) fn need_thumbnail(&mut self, page: usize, visible: bool) {
+        if page >= self.page_count {
+            return;
+        }
+        if let Some(priority) = self.thumb_demand.get_mut(&page) {
+            *priority |= visible;
+        } else if self.thumb_demand.len() < MAX_THUMB_DEMAND {
+            self.thumb_demand.insert(page, visible);
+        } else if visible && let Some(prefetch) = self.thumb_demand.iter().find_map(|(&p, &v)| (!v).then_some(p)) {
+            self.thumb_demand.remove(&prefetch);
+            self.thumb_demand.insert(page, true);
+        }
+    }
+
+    /// Only the displayed document owns raster textures. Tabs keep their document and view
+    /// state, but do not each retain a separate full application texture allowance.
+    pub(crate) fn suspend_rendering(&mut self, pool: &RenderPool) {
+        self.begin_render_frame();
+        self.pages.clear();
+        self.tiles.clear();
+        self.thumbs.clear();
+        self.grid_pages.clear();
+        self.print_pages.clear();
+        self.stale_thumbs.clear();
+        self.stale_tiles.clear();
+        self.waiting_since.clear();
+        // Signature previews own a separate renderer and image/background textures.
+        self.signature_drag = Default::default();
+        self.text_background = Default::default();
+        self.move_background = Default::default();
+        if !self.last_queue.is_empty() {
+            pool.set_queue(Vec::new());
+            self.last_queue.clear();
+        }
+        // Results already finished for this tab would otherwise sit in its pool, rasters and
+        // all, until the tab is shown again. (An inline pool renders inside try_recv: skip it.)
+        if !pool.is_inline() {
+            while pool.try_recv().is_some() {}
+        }
+    }
+
+    pub(super) fn thumbnail_requests(&self, info: &DocInfo, ppp: f32) -> Vec<RenderRequest> {
+        let mut pages: Vec<_> = self.thumb_demand.iter().map(|(&p, &visible)| (p, visible)).collect();
+        pages.sort_unstable_by_key(|&(p, visible)| (!visible, p));
+        // At high DPI or in a very large viewport every demanded cell still fits the same
+        // byte allowance. Both dimensions are capped, including tall/wide page boxes.
+        // The count is rounded up to a power of two: the scale is part of each request's tag,
+        // so a density that followed every row scrolling in or out would re-render them all.
+        let density = thumbnail_density(pages.len(), ppp);
+        pages
+            .into_iter()
+            .filter_map(|(page, _)| {
+                let p = info.pages.get(page)?;
+                let scale = thumbnail_scale(p.width, p.height, density);
+                Some(RenderRequest {
+                    page,
+                    kind: RequestKind::Pixels,
+                    tile: None,
+                    scale,
+                    tag: THUMB_TAG | u64::from(scale.to_bits()),
+                    // Thumbnails are previews: tiny images are skipped for them.
+                    preview: true,
+                })
+            })
+            .collect()
+    }
+
+    /// Admit current demand within explicit byte limits. Cached and pending surfaces share
+    /// the allowance, so an evicted page can be requested again without a permanent done set.
+    pub(super) fn prepare_render_queue(&mut self, info: &DocInfo, ppp: f32) -> Vec<RenderRequest> {
+        let requests = std::mem::take(&mut self.frame_queue);
+        let mut queue = Vec::new();
+        let mut pages = HashSet::new();
+        let mut tiles = HashSet::new();
+        let mut tile_tags = HashSet::new();
+        let mut grid = Vec::new();
+        let (mut page_bytes, mut tile_bytes) = (0usize, 0usize);
+        for req in requests.iter().filter(|r| r.kind == RequestKind::Pixels) {
+            let Some(p) = info.pages.get(req.page) else { continue };
+            // Organize-grid renders: only the cells in view that need one (organize_grid).
+            if req.tag & GRID_TAG != 0 {
+                grid.push(*req);
+                continue;
+            }
+            // Print-preview rasters: a few sheets at the pane's size (the dialog bounds them).
+            if req.tag & PRINT_TAG != 0 {
+                if !self.errors.contains_key(&req.page) {
+                    queue.push(*req);
+                }
+                continue;
+            }
+            // On-screen work is always admitted (the viewport bounds it); the limits only
+            // decide how much prefetch fits beside it.
+            let visible = self.frame_visible.contains(&req.page);
+            if let Some(tile) = req.tile {
+                // Keyed by exact device-pixel origin: the tile side varies with the zoom
+                // (`tile_side`), so grid indices would need the scale to decode.
+                let key = (req.page, req.tag, tile.x, tile.y);
+                let bytes = rgba_bytes(tile.w as usize, tile.h as usize);
+                if (!visible && tile_bytes.saturating_add(bytes) > TILE_BYTES) || !tiles.insert(key) {
+                    continue;
+                }
+                tile_bytes = tile_bytes.saturating_add(bytes);
+                tile_tags.insert(req.tag);
+                if !self.tiles.contains_key(&key) || self.stale_tiles.contains(&key) {
+                    queue.push(*req);
+                }
+            } else {
+                let bytes = rgba_bytes(device_pixels(p.width, req.scale) as usize, device_pixels(p.height, req.scale) as usize);
+                if (!visible && (page_bytes.saturating_add(bytes) > PAGE_BYTES || pages.len() >= MAX_CACHED_PAGES)) || !pages.insert(req.page) {
+                    continue;
+                }
+                page_bytes = page_bytes.saturating_add(bytes);
+                if self.pages.get(&req.page).is_none_or(|p| p.tag != req.tag) {
+                    queue.push(*req);
+                }
+            }
+        }
+        // Pages no longer demanded stay cached while the allowance has room, nearest to the
+        // current page first, so turning back a page shows it at once instead of rendering.
+        let mut undemanded: Vec<usize> = self.pages.keys().copied().filter(|p| !pages.contains(p)).collect();
+        undemanded.sort_by_key(|p| p.abs_diff(self.current));
+        let mut kept = pages.len();
+        for page in undemanded {
+            let bytes = self.pages.get(&page).map_or(0, |p| texture_bytes(&p.tex));
+            if kept < MAX_CACHED_PAGES && page_bytes.saturating_add(bytes) <= PAGE_BYTES {
+                page_bytes = page_bytes.saturating_add(bytes);
+                kept += 1;
+                pages.insert(page);
+            }
+        }
+        self.pages.retain(|p, _| pages.contains(p));
+        // Tiles of an earlier zoom (not a demanded scale) stay while the canvas keeps them, a
+        // bounded few under a page whose current tiles are still missing (OLD_TILES). Tiles of a
+        // page on screen stay too even when this frame does not demand them (#2196): the viewport
+        // moves while zooming, so a tile that was sharp a moment ago falls outside the demanded
+        // rectangle, and dropping it made every pan or zoom back a cold miss that re-blurred the
+        // page and re-interpreted it once per tile. The per-frame cap below (OLD_TILES,
+        // nearest scale first) is what bounds how much of that stays.
+        self.tiles.retain(|key, _| tiles.contains(key) || !tile_tags.contains(&key.1) || self.frame_visible.contains(&key.0));
+        self.stale_tiles.retain(|key| self.tiles.contains_key(key));
+        queue.extend(grid);
+        // Opening (or turning to) a page queues its pixels alongside thumbnails and
+        // text extraction. The workers would otherwise spend the first seconds on
+        // thumbnails and search text while the visible page stays blank: hold those
+        // until no visible main-page raster is still missing. Errored pages never
+        // block: they are never re-requested.
+        let visible_mains_pending = queue.iter().any(|r| {
+            r.kind == RequestKind::Pixels
+                && r.tag & (GRID_TAG | PRINT_TAG | THUMB_TAG | TEXT_TAG) == 0
+                && self.frame_visible.contains(&r.page)
+                && !self.errors.contains_key(&r.page)
+        });
+        if visible_mains_pending {
+            // Caches are kept; demand is re-evaluated next frame once pixels arrive.
+            return queue;
+        }
+        let thumbs = self.thumbnail_requests(info, ppp);
+        let mut thumb_bytes = 0usize;
+        let mut admitted = HashSet::new();
+        for req in thumbs {
+            let Some(p) = info.pages.get(req.page) else { continue };
+            let bytes = rgba_bytes(device_pixels(p.width, req.scale) as usize, device_pixels(p.height, req.scale) as usize);
+            if thumb_bytes.saturating_add(bytes) > THUMB_BYTES || self.errors.contains_key(&req.page) {
+                continue;
+            }
+            thumb_bytes += bytes;
+            admitted.insert(req.page);
+            if self.thumbs.get(&req.page).is_none_or(|t| t.tag != req.tag) || self.stale_thumbs.contains(&req.page) {
+                queue.push(req);
+            }
+        }
+        self.thumbs.retain(|p, _| admitted.contains(p));
+        self.stale_thumbs.retain(|p| admitted.contains(p));
+        self.retain_text_layers();
+        // Visible main pages and thumbnails take precedence over background search work.
+        queue.extend(requests.into_iter().filter(|r| r.kind == RequestKind::Text));
+        queue
+    }
+
+    /// Drop text layers nothing can still need. Every visited page's text used to stay
+    /// cached for the session. Keep visible, selected and matched pages plus the nearest
+    /// prefetch window; evicted pages re-extract on revisit. (Count window only: unlike
+    /// rasters there is no byte budget here.) While a search is active keep everything:
+    /// demand still wants every page, so evicting would re-request evicted pages each
+    /// frame and churn the workers. Failures are never evicted either: they cost nothing
+    /// to remember, and evicting one would re-request and re-fail it every frame.
+    fn retain_text_layers(&mut self) {
+        if self.texts.len() <= MAX_CACHED_TEXT_PAGES {
+            return;
+        }
+        if self.find.as_ref().is_some_and(|f| !f.case_query.trim().is_empty()) {
+            return;
+        }
+        let mut keep: HashSet<usize> = self.frame_visible.clone();
+        if let Some(s) = self.selection {
+            keep.insert(s.page);
+        }
+        if let Some(f) = self.find.as_ref() {
+            keep.extend(f.matches.iter().map(|(p, _)| *p));
+        }
+        let mut rest: Vec<usize> = self.texts.keys().filter(|p| !keep.contains(*p)).copied().collect();
+        rest.sort_by_key(|p| p.abs_diff(self.current));
+        keep.extend(rest.into_iter().take(MAX_CACHED_TEXT_PAGES));
+        self.texts.retain(|p, _| keep.contains(p));
+    }
+
+    pub(crate) fn finish_render_frame(&mut self, ctx: &egui::Context, info: &DocInfo, pool: &RenderPool) {
+        if self.frame_geometry_changed {
+            // Dialogs and edits can replace pages after the canvas collected demand. Its
+            // scales and indexes belong to the old pages, not to the new renderer (#3149).
+            self.begin_render_frame();
+            self.last_queue.clear();
+            pool.set_queue(Vec::new());
+            ctx.request_repaint();
+            return;
+        }
+        let queue = self.prepare_render_queue(info, ctx.pixels_per_point());
+        if queue != self.last_queue {
+            pool.set_queue(queue.clone());
+            self.last_queue = queue;
+        }
+        if !self.hold_rasters {
+            self.receive(ctx, pool);
+        }
+        if !self.last_queue.is_empty() {
+            ctx.request_repaint_after(std::time::Duration::from_millis(30));
+        }
+    }
+
+    /// Pull a bounded batch of current results into textures. Demand is committed first, so
+    /// offscreen results and obsolete scale/configuration tags never allocate a ColorImage.
+    pub fn receive(&mut self, ctx: &egui::Context, pool: &RenderPool) {
+        let budget = if pool.is_inline() { 1 } else { RESULTS_PER_FRAME };
+        let mut uploaded = 0usize;
+        #[cfg(not(target_arch = "wasm32"))]
+        let started = std::time::Instant::now();
+        for _ in 0..budget {
+            let Some(r) = pool.try_recv() else { break };
+            uploaded = uploaded.saturating_add(self.receive_result(ctx, r));
+            // One whole-page upload may exceed the frame allowance; it must still progress.
+            if uploaded >= UPLOAD_BYTES_PER_FRAME {
+                break;
+            }
+            #[cfg(not(target_arch = "wasm32"))]
+            if started.elapsed() >= std::time::Duration::from_millis(4) {
+                break;
+            }
+        }
+    }
+
+    pub(super) fn receive_result(&mut self, ctx: &egui::Context, r: pdfcraft_render::RenderedPage) -> usize {
+        if !self.last_queue.contains(&r.request) {
+            return 0;
+        }
+        ctx.request_repaint();
+        if r.request.kind == RequestKind::Text {
+            match r.text {
+                Some(t) => {
+                    self.texts.insert(r.request.page, t);
+                    self.refresh_find_page(r.request.page);
+                }
+                None => {
+                    log::warn!("page {} text: {}", r.request.page + 1, r.error.unwrap_or_default());
+                    self.text_failed.insert(r.request.page);
+                    if let Some(f) = self.find.as_mut() {
+                        let previous = f.current.and_then(|c| f.matches.get(c).cloned());
+                        let follow = f.follow_page(self.current);
+                        f.matches.retain(|(p, _)| *p != r.request.page);
+                        match follow {
+                            // An automatic choice keeps following its anchor; a failure never
+                            // flashes, so the view stays exactly where it was.
+                            Follow::Active(from) => f.current = f.first_at_or_after(from),
+                            Follow::Ended | Follow::Never => {
+                                let preserved = previous.as_ref().and_then(|k| f.matches.iter().position(|m| m == k));
+                                f.current = preserved.or_else(|| f.first_at_or_after(self.current));
+                            }
+                        }
+                    }
+                }
+            }
+            return 0;
+        }
+        if let Some(e) = r.error {
+            log::warn!("page {}: {e}", r.request.page + 1);
+            self.errors.insert(r.request.page, e);
+            return 0;
+        }
+        // Even current demand may have been sized with obsolete geometry or a different
+        // device limit. Check before cache eviction, conversion and every upload path.
+        let max_side = ctx.input(|i| i.max_texture_side);
+        if r.width == 0 || r.height == 0 || r.width as usize > max_side || r.height as usize > max_side {
+            return 0;
+        }
+        // Remember heavy pages: only these get the zoom/pan settle holds, so fast pages
+        // never pay added latency. Stale entries die with the tiles on edits.
+        if r.millis >= SLOW_MILLIS {
+            self.slow_pages.insert(r.request.page);
+        }
+        let page = r.request.page;
+        let bytes = rgba_bytes(r.width as usize, r.height as usize);
+        if bytes != r.rgba.len() || !self.admit_texture(r.request, bytes) {
+            return 0;
+        }
+        // The length was checked above, so the renderer's buffer becomes the texture data as is.
+        let img = texture_image([r.width as usize, r.height as usize], r.rgba);
+        if let Some(t) = r.request.tile {
+            let key = (page, r.request.tag, t.x, t.y);
+            let tex = ctx.load_texture(format!("tile-{:?}-{page}-{}-{}", self.id, t.x, t.y), img, TextureOptions::LINEAR);
+            self.tiles.insert(key, tex);
+            self.stale_tiles.remove(&key);
+            if !self.stale_tiles.iter().any(|k| k.0 == page) {
+                self.forms.unbaked.retain(|(_, p)| *p != page);
+                self.comments.page_rendered(page);
+            }
+            if !self.page_out_of_date(page) {
+                self.text_background.page_received(page);
+            }
+        } else if r.request.tag & PRINT_TAG != 0 {
+            let tex = ctx.load_texture(
+                format!("print-{:?}-{page}", self.id),
+                if r.request.tag & GRAYSCALE_TAG != 0 { grayscale(img) } else { img },
+                TextureOptions::LINEAR,
+            );
+            self.print_pages.insert(page, (r.request.tag, tex));
+        } else if r.request.tag & GRID_TAG != 0 {
+            let tex = ctx.load_texture(format!("grid-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
+            self.grid_pages.insert(page, (r.width, tex));
+        } else if r.request.tag & THUMB_TAG != 0 {
+            let tex = ctx.load_texture(format!("thumb-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
+            self.thumbs.insert(page, PageTex { tag: r.request.tag, tex });
+            self.stale_thumbs.remove(&page);
+        } else {
+            let tex = ctx.load_texture(format!("page-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
+            self.pages.insert(page, PageTex { tag: r.request.tag, tex });
+            self.signature_drag.page_received(page);
+            self.move_background.page_received(page);
+            if !self.page_out_of_date(page) {
+                self.text_background.page_received(page);
+            }
+            self.comments.page_rendered(page);
+            self.waiting_since.remove(&page);
+            if !self.stale_tiles.iter().any(|k| k.0 == page) {
+                self.forms.unbaked.retain(|(_, p)| *p != page);
+            }
+        }
+        bytes
+    }
+
+    /// Check real dimensions before conversion, including stale textures kept during edits.
+    /// Dropping an old handle releases its backend allocation after the current frame.
+    pub(super) fn admit_texture(&mut self, req: RenderRequest, bytes: usize) -> bool {
+        // An on-screen page or tile is always taken (the viewport bounds it): it may evict
+        // off-screen rasters but never another on-screen one, and is never refused.
+        let visible = req.tag & THUMB_TAG == 0 && self.frame_visible.contains(&req.page);
+        // Organize-grid renders are bounded by the cells in view (organize_grid). Print
+        // previews are the sheets around the one on screen.
+        if req.tag & (GRID_TAG | PRINT_TAG) != 0 {
+            return true;
+        }
+        if let Some(t) = req.tile {
+            let key = (req.page, req.tag, t.x, t.y);
+            self.tiles.remove(&key);
+            let retained = self.tiles.values().fold(0usize, |n, tex| n.saturating_add(texture_bytes(tex)));
+            visible || bytes <= TILE_BYTES.saturating_sub(retained)
+        } else {
+            let thumb = req.tag & THUMB_TAG != 0;
+            let (cache, limit) = if thumb { (&mut self.thumbs, THUMB_BYTES) } else { (&mut self.pages, PAGE_BYTES) };
+            cache.remove(&req.page);
+            let mut retained = cache.values().fold(0usize, |n, p| n.saturating_add(texture_bytes(&p.tex)));
+            // A zoom/DPI change can temporarily retain larger stale images than the new
+            // demand estimates. Evict those first, then let the current demand refill them.
+            let on_screen = |p: &usize| !thumb && self.frame_visible.contains(p);
+            while retained.saturating_add(bytes) > limit {
+                let Some(page) = cache.keys().copied().filter(|p| !on_screen(p)).max_by_key(|p| p.abs_diff(self.current)) else { break };
+                if let Some(old) = cache.remove(&page) {
+                    retained = retained.saturating_sub(texture_bytes(&old.tex));
+                }
+            }
+            visible || bytes <= limit.saturating_sub(retained)
+        }
+    }
+
+    pub(super) fn render_scale(&self, ppp: f32) -> f32 {
+        // Exactly the device scale: a raster at any other scale is resampled on screen, which
+        // blurs every line and glyph (#260).
+        self.zoom * PT * ppp
+    }
+
+    /// Set whether the print preview rasters become luminance before upload. Toggling it drops
+    /// the colour previews: new requests carry the grayscale tag, so stale ones are replaced.
+    pub(crate) fn set_print_grayscale(&mut self, grayscale: bool) {
+        if self.grayscale != grayscale {
+            self.grayscale = grayscale;
+            self.print_pages.clear();
+        }
+    }
+
+    /// Queue sharp rasters for the print preview. Pages that leave the nearby sheets are dropped.
+    /// Previews render with reading colours off (the request's tag tells the renderer): they must
+    /// match the printout, which is imposed from the uncoloured document.
+    pub(crate) fn queue_print_previews(&mut self, pages: &[(usize, f32)]) {
+        self.print_pages.retain(|page, _| pages.iter().any(|(p, _)| p == page));
+        for &(page, scale) in pages {
+            if self.errors.contains_key(&page) || !scale.is_finite() || scale <= 0.0 {
+                continue;
+            }
+            let tag = scale_tag(scale) | PRINT_TAG | if self.grayscale { GRAYSCALE_TAG } else { 0 };
+            let fresh = self.print_pages.get(&page).is_some_and(|(have, _)| *have == tag);
+            if !fresh {
+                self.frame_queue.push(RenderRequest { page, kind: RequestKind::Pixels, tile: None, scale, tag, preview: false });
+            }
+        }
+    }
+}
+
+/// The request tag for a raster at `scale`: equal tags mean the same scale (to 1/65536).
+pub(super) fn scale_tag(scale: f32) -> u64 {
+    (f64::from(scale) * 65536.0).round() as u64
+}
+
+/// The scale of a raster tagged by [`scale_tag`].
+pub(super) fn tag_scale(tag: u64) -> f32 {
+    (tag as f64 / 65536.0) as f32
+}
+
+/// Device-pixel side of a page tile at `scale` for a page `page_max_px` device pixels on
+/// its long side. Each tile costs a full page interpret, so tiles grow with the zoom and
+/// with the page: a zoomed viewport, or a giant sheet shown whole, is covered by a few
+/// large tiles instead of dozens of small ones. Bounded by the render backend (tile sides
+/// above 4096 are clamped there) and kept granular at ordinary zooms.
+pub(super) fn tile_side(scale: f32, page_max_px: u32) -> u32 {
+    if !scale.is_finite() || scale <= 0.0 {
+        return TILE;
+    }
+    let by_zoom = (TILE as f32 * (scale / 6.0)).clamp(TILE as f32, 4096.0) as u32;
+    // At most four tiles along the long side, so a giant sheet needs a handful of
+    // interprets instead of dozens.
+    by_zoom.max(page_max_px.div_ceil(4).min(4096))
+}
+
+/// Tiles of earlier zooms kept for a page while its current tiles are rendered.
+pub(super) const OLD_TILES: usize = 64;
+
+/// A page whose raster took at least this long is heavy: zoom/pan holds apply to it,
+/// so gestures stay on stretched surfaces instead of queueing full-page interprets.
+const SLOW_MILLIS: u32 = 500;
+
+/// A rendered raster as texture data. Its words are premultiplied RGBA bytes, exactly
+/// `Color32`s, so the renderer's buffer becomes the image without a copy on the UI thread.
+pub(crate) fn texture_image(size: [usize; 2], pixels: pdfcraft_render::Pixels) -> egui::ColorImage {
+    match bytemuck::allocation::try_cast_vec::<u32, Color32>(pixels.into_words()) {
+        Ok(px) if px.len() == size[0].saturating_mul(size[1]) => egui::ColorImage::new(size, px),
+        Ok(px) => egui::ColorImage::from_rgba_premultiplied(size, bytemuck::cast_slice(&px)),
+        Err((_, words)) => egui::ColorImage::from_rgba_premultiplied(size, bytemuck::cast_slice(&words)),
+    }
+}
+
+/// A luminance preview for a monochrome print. `Color32` stores premultiplied pixels, so a
+/// non-opaque colour's alpha is restored after multiplying the unmultiplied RGB by its
+/// luminance. This uses the display gamma-space weights users expect in editors/print dialogs,
+/// not the linear-light coefficients of a colour-managed render.
+pub(super) fn grayscale(mut img: egui::ColorImage) -> egui::ColorImage {
+    for c in img.pixels.iter_mut() {
+        let a = c.a();
+        let luminance = f32::from(c.r()) * 0.299_f32 + f32::from(c.g()) * 0.587_f32 + f32::from(c.b()) * 0.114_f32;
+        let gray = if a == 0 || a == 255 {
+            luminance.round() as u8
+        } else {
+            // Unmultiply first, so translucent content keeps its paper-relative luminance.
+            let f = f32::from(a) / 255.0;
+            let un = [f32::from(c.r()) / f, f32::from(c.g()) / f, f32::from(c.b()) / f];
+            let l = un[0] * 0.299_f32 + un[1] * 0.587_f32 + un[2] * 0.114_f32;
+            (f * l).round() as u8
+        };
+        *c = Color32::from_rgba_premultiplied(gray, gray, gray, a);
+    }
+    img
+}
diff --git a/crates/ui-egui/src/crop.rs b/crates/ui-egui/src/canvas/crop.rs
similarity index 95%
rename from crates/ui-egui/src/crop.rs
rename to crates/ui-egui/src/canvas/crop.rs
index 1344a30f33..1f1e1aa131 100644
--- a/crates/ui-egui/src/crop.rs
+++ b/crates/ui-egui/src/canvas/crop.rs
@@ -6,6 +6,7 @@ use pdfcraft_engine::{BoxSpec, Edit, PageBox};
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
 
 /// A crop rectangle being dragged: (page, start on screen).
 pub type CropDrag = Option<(usize, Pos2)>;
@@ -17,17 +18,18 @@ fn to_user(xf: &PageXform, info: &DocInfo, page: usize, p: Pos2) -> [f64; 2] {
 }
 
 /// Crop gestures on one page. Returns `Some(true)` to open Set Page Boxes for this page.
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn page_input(
     ui: &egui::Ui,
     resp: &egui::Response,
     xf: &PageXform,
+    ptr: &PagePointer,
     page: usize,
     info: &DocInfo,
     view: &mut DocView,
     allowed: bool,
 ) -> bool {
-    let pointer = ui.input(|i| i.pointer.hover_pos());
-    let origin = ui.input(|i| i.pointer.press_origin());
+    let (pointer, origin) = (ptr.pos, ptr.origin);
     if pointer.is_some_and(|p| xf.rect.contains(p)) {
         ui.ctx().set_cursor_icon(if allowed { egui::CursorIcon::Crosshair } else { egui::CursorIcon::NotAllowed });
     }
diff --git a/crates/ui-egui/src/canvas/find.rs b/crates/ui-egui/src/canvas/find.rs
new file mode 100644
index 0000000000..d44ad9d5e2
--- /dev/null
+++ b/crates/ui-egui/src/canvas/find.rs
@@ -0,0 +1,301 @@
+use super::*;
+
+/// The find bar (⌘F): query, matches across the document, current match.
+#[derive(Default)]
+pub struct Find {
+    pub query: String,
+    /// (page, glyph range) in document order.
+    pub matches: Vec<(usize, Range<usize>)>,
+    pub current: Option<usize>,
+    /// The page a search started from while its match is picked automatically: a text layer
+    /// that arrives out of order can still supply an earlier match, and the automatic choice
+    /// follows this page. Cleared when the user picks a match or moves the view themselves.
+    pub auto_from: Option<usize>,
+    /// The page the automatic choice last put the view on (the search's starting page until it
+    /// chose anything). Compared with the viewed page, it tells an automatic scroll from one
+    /// the reader made themselves; `None` with `auto_from` once the choice is the user's.
+    pub auto_page: Option<usize>,
+    /// The reader ended automatic following (by navigating, scrolling, or picking a match).
+    /// This is distinct from a search that never followed: a late match must be listed without
+    /// being revealed by scrolling, even when the reader moved before the first match arrived.
+    pub follow_ended: bool,
+    pub focus: bool,
+    pub case_query: String,
+    /// Find options (Acrobat's: case-sensitive, whole words only).
+    pub case_sensitive: bool,
+    pub whole_words: bool,
+    /// Shown in the Search panel (Advanced Search) instead of the find bar.
+    pub in_panel: bool,
+}
+
+/// What a text layer arriving after a search began may do with the automatic choice.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum Follow {
+    /// The reader has not moved the view since the automatic choice: it may follow `from`.
+    Active(usize),
+    /// The reader navigated, scrolled or picked a match, so no automatic choice may reveal.
+    Ended,
+    /// No automatic choice is being followed (the search has not started, or the reader chose).
+    Never,
+}
+
+impl Find {
+    /// The first match at or after `page`, or the first match when none follows (the search
+    /// wraps round the document).
+    pub(super) fn first_at_or_after(&self, page: usize) -> Option<usize> {
+        self.matches.iter().position(|(p, _)| *p >= page).or_else(|| (!self.matches.is_empty()).then_some(0))
+    }
+
+    /// How a text layer arriving now relates to the automatic choice. Once the reader has moved
+    /// the view (page box, Pages panel, outline, view history or any scrolling), automatic
+    /// following ends: a later layer must not pull them back to an anchor-derived match.
+    /// `Ended` is deliberately distinct from `Never`, so a first match arriving after that move
+    /// is not revealed by a flash meant only for a search that is still following.
+    pub(super) fn follow_page(&mut self, viewed: usize) -> Follow {
+        if self.follow_ended {
+            return Follow::Ended;
+        }
+        match (self.auto_from, self.auto_page) {
+            (Some(from), Some(page)) if page == viewed => Follow::Active(from),
+            (Some(_), _) | (_, Some(_)) => {
+                self.stop_following();
+                Follow::Ended
+            }
+            (None, None) => Follow::Never,
+        }
+    }
+
+    /// Ends automatic following: the selected match is now the user's choice to keep.
+    fn stop_following(&mut self) {
+        self.auto_from = None;
+        self.auto_page = None;
+        self.follow_ended = true;
+    }
+}
+
+impl DocView {
+    /// Open the find bar (or focus it if already open).
+    pub fn open_find(&mut self) {
+        let f = self.find.get_or_insert_with(Find::default);
+        f.focus = true;
+    }
+
+    /// Re-run the search on all pages whose text is known (after the query changed).
+    pub fn rerun_find(&mut self) {
+        let Some(f) = self.find.as_mut() else { return };
+        f.case_query = f.query.clone();
+        f.matches.clear();
+        f.current = None;
+        // Refining the query keeps the page the reader started searching from, even when an
+        // automatic choice has already scrolled them to a match. Only a view the reader moved
+        // themselves re-anchors the search on the page now shown.
+        let from = match (f.auto_from, f.auto_page) {
+            (Some(from), Some(page)) if !f.follow_ended && page == self.current => from,
+            _ => self.current,
+        };
+        f.auto_from = Some(from);
+        f.auto_page = Some(self.current);
+        f.follow_ended = false;
+        if f.case_query.trim().is_empty() {
+            return;
+        }
+        let mut pages: Vec<usize> = self.texts.keys().copied().collect();
+        pages.sort();
+        for &p in &pages {
+            if let Some(text) = self.texts.get(&p) {
+                f.matches.extend(text.find_opts(&f.case_query, f.case_sensitive, f.whole_words).into_iter().map(|r| (p, r)));
+            }
+        }
+        f.matches.sort_by_key(|(p, r)| (*p, r.start));
+        // First match at or after the page the search started from.
+        if let Some(i) = f.first_at_or_after(from)
+            && let Some(&(p, _)) = f.matches.get(i)
+        {
+            f.current = Some(i);
+            f.auto_page = Some(p);
+            self.flash_match(p);
+        }
+    }
+
+    pub(super) fn refresh_find_page(&mut self, page: usize) {
+        let (Some(f), Some(text)) = (self.find.as_mut(), self.texts.get(&page)) else { return };
+        if f.case_query.trim().is_empty() {
+            return;
+        }
+        let previous = f.current.and_then(|c| f.matches.get(c).cloned());
+        // An automatic choice follows the page it was anchored on, so a page whose text
+        // arrives late can still supply an earlier match. Once the reader has moved the view,
+        // this arrival must not pull them back; the choice then becomes theirs to keep.
+        let follow = f.follow_page(self.current);
+        f.matches.retain(|(p, _)| *p != page);
+        f.matches.extend(text.find_opts(&f.case_query, f.case_sensitive, f.whole_words).into_iter().map(|r| (page, r)));
+        f.matches.sort_by_key(|(p, r)| (*p, r.start));
+        if let Follow::Active(from) = follow {
+            f.current = f.first_at_or_after(from);
+            let selected = f.current.and_then(|i| f.matches.get(i).cloned());
+            // Follow a changed automatic choice; the view is still where the last one left it.
+            if selected != previous
+                && let Some((p, _)) = selected
+            {
+                f.auto_page = Some(p);
+                self.flash_match(p);
+            }
+            return;
+        }
+        // A match the user picked keeps its identity, exactly as before automatic following.
+        // When it is gone (or none was picked), the first match at or after the viewed page is
+        // selected for the panel, but the view stays put: `Ended` and `Never` have no automatic
+        // choice to reveal, and a reader who moved before the first layer arrived must not be
+        // pulled back by that late match.
+        let preserved = previous.as_ref().and_then(|k| f.matches.iter().position(|m| m == k));
+        f.current = preserved.or_else(|| f.first_at_or_after(self.current));
+    }
+
+    /// Go to match `i` (the Search panel's results).
+    pub fn go_to_match(&mut self, i: usize) {
+        let Some(f) = self.find.as_mut() else { return };
+        let Some(&(p, _)) = f.matches.get(i) else { return };
+        f.current = Some(i);
+        f.stop_following();
+        self.go_to_page(p);
+        self.goto_point = None;
+        self.flash_match(p);
+    }
+
+    /// Move to the next/previous match.
+    pub fn find_step(&mut self, forward: bool) {
+        let Some(f) = self.find.as_mut() else { return };
+        if f.matches.is_empty() {
+            return;
+        }
+        let n = f.matches.len();
+        let c = f.current.unwrap_or(0);
+        let next = if forward { (c + 1) % n } else { (c + n - 1) % n };
+        f.current = Some(next);
+        f.stop_following();
+        let p = f.matches[next].0;
+        // Only explicit search navigation joins history; background refresh uses flash_match alone.
+        self.go_to_page(p);
+        self.goto_point = None;
+        self.flash_match(p);
+    }
+
+    fn flash_match(&mut self, page: usize) {
+        let frac = self
+            .find
+            .as_ref()
+            .and_then(|f| f.current.and_then(|c| f.matches.get(c)))
+            .and_then(|(p, r)| self.texts.get(p).and_then(|t| t.glyphs.get(r.start)).map(|g| g.rect[1]))
+            .zip(self.page_heights.get(page).copied())
+            .map(|(y, h)| ((y - 60.0) / h).clamp(0.0, 1.0))
+            .unwrap_or(0.0);
+        self.goto = Some((page, frac));
+        self.current = page;
+        self.reset_coarse_state();
+    }
+
+    /// Ends automatic search following after the reader navigated or scrolled the view. A
+    /// programmatic search flash never comes through here; it sets `goto` and `current` directly
+    /// so that its own scroll cannot be mistaken for the reader's.
+    pub(super) fn end_find_following(&mut self) {
+        if let Some(f) = self.find.as_mut() {
+            f.stop_following();
+        }
+    }
+}
+
+/// Acrobat-style floating find bar at the top-right of the document area.
+pub(super) fn find_bar(view: &mut DocView, pages: usize, area: Rect, ui: &mut egui::Ui, t: &Tokens) {
+    let Some(find) = view.find.as_mut() else { return };
+    // The Search panel shows this search.
+    if find.in_panel {
+        return;
+    }
+    let mut close = false;
+    let mut step: Option<bool> = None;
+    let searched = view.texts.len() + view.text_failed.len();
+    egui::Area::new(egui::Id::unique("find-bar"))
+        .order(egui::Order::Middle)
+        .pivot(Align2::RIGHT_TOP)
+        .fixed_pos(area.right_top() + vec2(-18.0, 12.0))
+        .show(ui.ctx(), |ui| {
+            egui::Frame::NONE
+                .fill(t.card)
+                .stroke(Stroke::new(1.0, t.border))
+                .corner_radius(CornerRadius::same(10))
+                .shadow(egui::Shadow { offset: [0, 4], blur: 16, spread: 0, color: Color32::from_black_alpha(if t.dark() { 90 } else { 30 }) })
+                .inner_margin(egui::Margin::symmetric(10, 6))
+                .show(ui, |ui| {
+                    ui.horizontal(|ui| {
+                        ui.add(icons::image("search", 16.0, t.text_muted));
+                        let edit = egui::TextEdit::singleline(&mut find.query)
+                            .id(egui::Id::unique("find-input"))
+                            .hint_text(tl!("Find text"))
+                            .desired_width(220.0)
+                            .frame(egui::Frame::NONE);
+                        let r = ui.add(edit).accessible_name(tl!("Find text"));
+                        if find.focus {
+                            r.request_focus();
+                            find.focus = false;
+                        }
+                        if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                            step = Some(!ui.input(|i| i.modifiers.shift));
+                            r.request_focus();
+                        }
+                        if r.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+                            close = true;
+                        }
+                        let status = if find.query.trim().is_empty() {
+                            String::new()
+                        } else if find.matches.is_empty() {
+                            if searched < pages {
+                                crate::i18n::fmt(tl!("Searching… {s}/{p}"), &[("s", &searched.to_string()), ("p", &pages.to_string())])
+                            } else {
+                                tl!("No matches").to_string()
+                            }
+                        } else {
+                            let more = if searched < pages { "+" } else { "" };
+                            crate::i18n::fmt(
+                                tl!("{c} of {n}{more}"),
+                                &[
+                                    ("c", &find.current.map(|c| c + 1).unwrap_or(0).to_string()),
+                                    ("n", &find.matches.len().to_string()),
+                                    ("more", more),
+                                ],
+                            )
+                        };
+                        ui.label(egui::RichText::new(status).font(theme::regular(12.0)).color(t.text_muted));
+                        let tip = crate::commands::key_tip(ui.ctx(), tl!("Previous ({key})"), crate::commands::FIND_PREV);
+                        if icons::button(ui, "chevron-up", 26.0, false, &tip).clicked() {
+                            step = Some(false);
+                        }
+                        let tip = crate::commands::key_tip(ui.ctx(), tl!("Next ({key})"), crate::commands::FIND_NEXT);
+                        if icons::button(ui, "chevron-down", 26.0, false, &tip).clicked() {
+                            step = Some(true);
+                        }
+                        let opts = icons::button(ui, "settings-2", 26.0, find.case_sensitive || find.whole_words, tl!("Find options"));
+                        egui::Popup::menu(&opts).show(|ui| {
+                            let a = ui.add(widgets::checkbox(&mut find.whole_words, tl!("Whole words only"))).changed();
+                            let b = ui.add(widgets::checkbox(&mut find.case_sensitive, tl!("Case-sensitive"))).changed();
+                            if a || b {
+                                // Search again with the new options.
+                                find.case_query.clear();
+                            }
+                        });
+                        if icons::button(ui, "x", 26.0, false, tl!("Close (Esc)")).clicked() {
+                            close = true;
+                        }
+                    });
+                });
+        });
+    if close {
+        view.find = None;
+        return;
+    }
+    if find.query != find.case_query {
+        view.rerun_find();
+    }
+    if let Some(forward) = step {
+        view.find_step(forward);
+    }
+}
diff --git a/crates/ui-egui/src/fling.rs b/crates/ui-egui/src/canvas/fling.rs
similarity index 91%
rename from crates/ui-egui/src/fling.rs
rename to crates/ui-egui/src/canvas/fling.rs
index cce004ce53..b5eafe69d1 100644
--- a/crates/ui-egui/src/fling.rs
+++ b/crates/ui-egui/src/canvas/fling.rs
@@ -64,7 +64,7 @@ impl Fling {
     /// (animations off, single-page paging, a zoom, a dialog).
     pub(crate) fn read(&mut self, events: &[Event], now: f64, glide: bool) {
         for event in events {
-            let Event::MouseWheel { unit, delta, phase, modifiers } = event else { continue };
+            let Event::MouseWheel { unit, delta, phase, modifiers, .. } = event else { continue };
             self.stop();
             // Zooming, a mouse wheel and sideways Shift scrolling never glide.
             if *unit != MouseWheelUnit::Point || modifiers.command || modifiers.ctrl || modifiers.shift {
@@ -160,7 +160,13 @@ mod tests {
     use egui::{Modifiers, vec2};
 
     fn wheel(dy: f32, phase: TouchPhase) -> Event {
-        Event::MouseWheel { unit: MouseWheelUnit::Point, delta: vec2(0.0, dy), phase, modifiers: Modifiers::NONE }
+        Event::MouseWheel {
+            unit: MouseWheelUnit::Point,
+            delta: vec2(0.0, dy),
+            phase,
+            modifiers: Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        }
     }
 
     /// A swipe of `moves` passes of `dy` each, 60 per second, lifted the pass after the last.
@@ -213,6 +219,7 @@ mod tests {
         assert!(!fling.gliding(), "the finger rested before it lifted");
     }
 
+    /// Check that new finger or wheel input stops an in-progress glide.
     #[test]
     fn new_input_stops_a_glide() {
         let mut fling = Fling::new(true);
@@ -222,11 +229,18 @@ mod tests {
 
         let mut fling = Fling::new(true);
         let now = swipe(&mut fling, -25.0, 6);
-        let notch = Event::MouseWheel { unit: MouseWheelUnit::Line, delta: vec2(0.0, -1.0), phase: TouchPhase::Move, modifiers: Modifiers::NONE };
+        let notch = Event::MouseWheel {
+            unit: MouseWheelUnit::Line,
+            delta: vec2(0.0, -1.0),
+            phase: TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        };
         fling.read(&[notch], now + 0.1, true);
         assert!(!fling.gliding(), "a wheel notch");
     }
 
+    /// Check that disabled flinging, a false glide flag, and a command-modified zoom gesture prevent glide.
     #[test]
     fn no_glide_where_it_is_off_or_not_wanted() {
         let mut off = Fling::new(false);
@@ -242,7 +256,13 @@ mod tests {
         assert!(!fling.gliding(), "animations off, paging or a dialog");
 
         let mut zoom = Fling::new(true);
-        let ctrl = |phase| Event::MouseWheel { unit: MouseWheelUnit::Point, delta: vec2(0.0, -25.0), phase, modifiers: Modifiers::COMMAND };
+        let ctrl = |phase| Event::MouseWheel {
+            unit: MouseWheelUnit::Point,
+            delta: vec2(0.0, -25.0),
+            phase,
+            modifiers: Modifiers::COMMAND,
+            source: egui::MouseWheelSource::Unknown,
+        };
         zoom.read(&[ctrl(TouchPhase::Start)], 0.0, true);
         zoom.read(&[ctrl(TouchPhase::Move)], dt, true);
         zoom.read(&[ctrl(TouchPhase::Move)], 2.0 * dt, true);
diff --git a/crates/ui-egui/src/image_pick.rs b/crates/ui-egui/src/canvas/image_pick.rs
similarity index 100%
rename from crates/ui-egui/src/image_pick.rs
rename to crates/ui-egui/src/canvas/image_pick.rs
diff --git a/crates/ui-egui/src/canvas/navigation.rs b/crates/ui-egui/src/canvas/navigation.rs
new file mode 100644
index 0000000000..1cf3be91ed
--- /dev/null
+++ b/crates/ui-egui/src/canvas/navigation.rs
@@ -0,0 +1,445 @@
+use super::zoom::GRID_ZOOM_STEP;
+use super::*;
+
+impl DocView {
+    /// Where a bookmark made now should go: the page and the `/XYZ` position `[left, top]` in user
+    /// space. With text selected it is the corner of the selection that shows at its top-left
+    /// (its page, both coordinates); otherwise the top of the window (the page showing there, and
+    /// only the position along the window's vertical, so the reader's other scroll position and
+    /// zoom are kept). `None` before the first frame has laid pages out, when the bookmark just
+    /// goes to the current page.
+    pub(crate) fn bookmark_position(&self, info: &DocInfo) -> Option<(usize, [Option<f32>; 2])> {
+        if let Some(sel) = self.selection
+            && let Some(text) = self.texts.get(&sel.page)
+            && let Some(p) = info.pages.get(sel.page)
+        {
+            // The selection's bounds in view space, which View ▸ Rotate View leaves unturned: the
+            // corner at the screen's top-left is a different one for each quarter turn.
+            let [x0, y0, x1, y1] = sel.rects(text).iter().fold([f32::INFINITY, f32::INFINITY, f32::NEG_INFINITY, f32::NEG_INFINITY], |b, r| {
+                [b[0].min(r[0]), b[1].min(r[1]), b[2].max(r[2]), b[3].max(r[3])]
+            });
+            let (x, y) = match self.rotation {
+                90 => (x0, y1),
+                180 => (x1, y1),
+                270 => (x1, y0),
+                _ => (x0, y0),
+            };
+            if x.is_finite() && y.is_finite() {
+                return Some((sel.page, p.xyz_for_view(Some(x), Some(y))));
+            }
+        }
+        // The page showing at the window's top edge: one that crosses it (the first, in a spread
+        // of pages of different heights, whose shorter page can start below it), else the
+        // nearest one below.
+        let top = self.viewport_screen.top();
+        let showing = || self.screen_xforms.iter().filter(|(_, xf)| xf.rect.bottom() > top);
+        let (page, xf) = showing()
+            .filter(|(_, xf)| xf.rect.top() <= top)
+            .min_by_key(|(p, _)| *p)
+            .or_else(|| showing().min_by(|a, b| a.1.rect.top().total_cmp(&b.1.rect.top()).then(a.0.cmp(&b.0))))?;
+        let p = info.pages.get(*page)?;
+        // Above the page (in the gap before it) is the page's own top. The window's vertical is
+        // the view's y, or its x when the view is turned a quarter.
+        let (x, y) = xf.screen_to_view(pos2(xf.rect.center().x, top.max(xf.rect.top())));
+        let at = if xf.rot.is_multiple_of(180) {
+            p.xyz_for_view(None, Some(y.clamp(0.0, p.height)))
+        } else {
+            p.xyz_for_view(Some(x.clamp(0.0, p.width)), None)
+        };
+        Some((*page, at))
+    }
+
+    /// The user-space `[left, top]` at the window's top-left (where `/XYZ` puts its point), on the
+    /// page showing there: what a destination's null coordinate keeps (ISO 32000-2 §12.3.2.2).
+    /// Acrobat keeps the place this way across pages, so a CAD sheet's cross-reference opens the
+    /// next sheet where the reader was looking. A coordinate is `None` along a screen axis the
+    /// page fits, which keeps the layout's own placement (centred, or the page's top); the whole
+    /// place is `None` before the first frame has laid pages out.
+    fn place_at_corner(&self, info: &DocInfo) -> Option<[Option<f32>; 2]> {
+        let area = self.viewport_screen;
+        if !area.is_positive() {
+            return None;
+        }
+        let corner = area.min + vec2(SIDE, 0.0);
+        let (page, xf) = self
+            .screen_xforms
+            .iter()
+            .filter(|(_, xf)| xf.rect.is_positive())
+            .min_by(|a, b| a.1.rect.distance_sq_to_pos(corner).total_cmp(&b.1.rect.distance_sq_to_pos(corner)).then(a.0.cmp(&b.0)))?;
+        let p = info.pages.get(*page)?;
+        let (x, y) = xf.screen_to_view(corner.clamp(xf.rect.min, xf.rect.max));
+        // `max` drops a NaN size, so the bounds stay ordered and `clamp` can't panic.
+        let (x, y) = (x.clamp(0.0, p.width.max(0.0)), y.clamp(0.0, p.height.max(0.0)));
+        // The page counts with its side gutters, as the layout places it.
+        let wide = xf.rect.width() + 2.0 * SIDE > area.width();
+        let tall = xf.rect.height() > area.height();
+        // The view's x runs across the screen unless the view is turned a quarter.
+        let (keep_x, keep_y) = if xf.rot.is_multiple_of(180) { (wide, tall) } else { (tall, wide) };
+        Some(p.xyz_for_view(keep_x.then_some(x), keep_y.then_some(y)))
+    }
+
+    pub fn go_to_page(&mut self, page: usize) {
+        let page = page.min(self.page_count.saturating_sub(1));
+        self.end_find_following();
+        if page != self.current {
+            // The view history (Previous view / Next view).
+            if self.back.last() != Some(&self.current) {
+                self.back.push(self.current);
+                if self.back.len() > 200 {
+                    self.back.remove(0);
+                }
+            }
+            self.forward.clear();
+        }
+        // Partial wheel motion belongs to the old place.
+        self.reset_coarse_state();
+        self.goto = Some((page, 0.0));
+        self.current = page;
+    }
+
+    /// Reveal a user-space rectangle without changing zoom, centred where the scroll bounds allow.
+    pub(crate) fn reveal_rect(&mut self, page: usize, rect: [f32; 4], info: &DocInfo) {
+        self.go_to_page(page);
+        self.goto_point = None;
+        let Some(p) = info.pages.get(self.current) else { return };
+        if !rect.iter().all(|v| v.is_finite()) {
+            return;
+        }
+        // Halve before adding so even large finite coordinates cannot overflow the midpoint.
+        let x = rect[0] * 0.5 + rect[2] * 0.5;
+        let y = rect[1] * 0.5 + rect[3] * 0.5;
+        let [fx, fy] = p.dest_fraction(Some(x), Some(y), self.rotation);
+        self.goto_point = Some((self.current, fx, fy, vec2(self.viewport_w, self.viewport_h) / 2.0));
+    }
+
+    /// Go to a destination, a bookmark's or a link's (ISO 32000-2 §12.3.2.2): its page, scrolled
+    /// and zoomed as `dest` asks, as Acrobat does. `/XYZ` puts (left, top) at the window's
+    /// top-left at its zoom (null or 0 keeps the zoom); `/Fit`, `/FitH` and `/FitV` switch to fit
+    /// page, width and height with `top` or `left` at the window's edge; `/FitR` zooms so the
+    /// rectangle fits, centred. The `B` (content box) forms are read as the page. A null `/XYZ`
+    /// coordinate keeps the reader's place: the same user-space point stays at the window's
+    /// top-left on the new page, as Acrobat does. A point past the end of the document scrolls
+    /// as far as it can.
+    pub fn go_to_dest(&mut self, page: usize, dest: DestView, info: &DocInfo) {
+        // Read before the jump: it is where the reader is now.
+        let kept = match dest {
+            DestView::Xyz { left, top, .. } if left.is_none() || top.is_none() => self.place_at_corner(info),
+            _ => None,
+        };
+        self.go_to_page(page);
+        let page = self.current;
+        self.goto_point = None;
+        let Some(p) = info.pages.get(page) else { return };
+        let point = |x: Option<f32>, y: Option<f32>| p.dest_fraction(x, y, self.rotation);
+        // The window's top-left as far as pages go: its left edge is the gutter that keeps them
+        // clear of the floating quick-action bar, so `left` 0 shows the page's edge beside it.
+        let corner = vec2(SIDE, 0.0);
+        let (fx, fy, rel) = match dest {
+            DestView::Top => return,
+            DestView::Xyz { left, top, zoom } => {
+                if let Some(z) = zoom {
+                    self.zoom = z.clamp(0.08, 64.0);
+                    self.fit = Fit::None;
+                    self.zoom_anchor = None;
+                }
+                let [kept_left, kept_top] = kept.unwrap_or([None, None]);
+                let [fx, fy] = point(left.or(kept_left), top.or(kept_top));
+                (fx, fy, corner)
+            }
+            DestView::Fit => {
+                self.fit = Fit::Page;
+                return;
+            }
+            DestView::FitH { top } => {
+                self.fit = Fit::Width;
+                let [fx, fy] = point(None, top);
+                (fx, fy, corner)
+            }
+            DestView::FitV { left } => {
+                self.fit = Fit::Height;
+                let [fx, fy] = point(left, None);
+                (fx, fy, corner)
+            }
+            DestView::FitR { rect } => {
+                let ([Some(ax), Some(ay)], [Some(bx), Some(by)]) = (point(Some(rect[0]), Some(rect[3])), point(Some(rect[2]), Some(rect[1]))) else {
+                    return;
+                };
+                // The rectangle as displayed, in points (it can be turned a quarter).
+                let (dw, dh) = self.display_size(p);
+                let (w, h) = ((ax - bx).abs() * dw, (ay - by).abs() * dh);
+                if w >= 1.0 && h >= 1.0 && self.viewport_w >= 1.0 && self.viewport_h >= 1.0 {
+                    self.zoom = (self.viewport_w / (w * PT)).min(self.viewport_h / (h * PT)).clamp(0.08, 64.0);
+                    self.fit = Fit::None;
+                    self.zoom_anchor = None;
+                }
+                (Some((ax + bx) / 2.0), Some((ay + by) / 2.0), vec2(self.viewport_w, self.viewport_h) / 2.0)
+            }
+        };
+        if fx.is_some() || fy.is_some() {
+            self.goto_point = Some((page, fx, fy, rel));
+        }
+    }
+
+    /// Next page (`true`) or previous page. In two-page view this moves a whole spread: the other
+    /// page of the spread is already on screen, so stepping to it wouldn't move the view (#70).
+    pub fn step_page(&mut self, forward: bool) {
+        let c = self.current;
+        let last = self.page_count.saturating_sub(1);
+        let (target, first) = match self.layout {
+            PageLayout::TwoUp => {
+                let first = self.spread_first(c);
+                let target = match (forward, self.cover && c == 0) {
+                    (true, true) => 1,
+                    (true, false) => first.saturating_add(2),
+                    (false, _) if self.cover && first <= 1 => 0,
+                    (false, _) => first.saturating_sub(2),
+                };
+                (target, first)
+            }
+            PageLayout::Single if forward => (c + 1, c),
+            PageLayout::Single => (c.saturating_sub(1), c),
+        };
+        // Past either end there is nowhere to go: stay put rather than re-align the view, which
+        // would scroll the page back to its top.
+        if if forward { target > last } else { first == 0 } {
+            return;
+        }
+        self.go_to_page(target);
+    }
+
+    /// Page-editor focus and drafts belong to a document, even while another tab is active.
+    pub(crate) fn page_input_id(&self) -> egui::Id {
+        egui::Id::unique(("page-input", self.id.0))
+    }
+
+    /// The idle page box and unchanged-input lookup share the same label fallback.
+    pub(crate) fn current_page_label(&self, label: Option<&str>) -> String {
+        label.filter(|l| !l.is_empty()).map(str::to_owned).unwrap_or_else(|| (self.current + 1).to_string())
+    }
+
+    /// Retain the current page when `typed` exactly matches its displayed label, even if
+    /// another page has that label. Otherwise resolve a trimmed label (case-insensitive),
+    /// then a physical page number. `false` when it names no page.
+    pub fn go_to_typed(&mut self, typed: &str, labels: &[String]) -> bool {
+        // Compare the displayed value before trimming: a label may itself contain spaces.
+        // Repeated labels occur in restarted sections and prefix-only ranges.
+        if self.current < self.page_count && self.current_page_label(labels.get(self.current).map(String::as_str)) == typed {
+            return true;
+        }
+        let t = typed.trim();
+        let page = labels
+            .iter()
+            .position(|l| !l.is_empty() && l.eq_ignore_ascii_case(t))
+            .or_else(|| t.parse::<usize>().ok().filter(|n| *n >= 1).map(|n| n - 1));
+        match page {
+            Some(p) if p < self.page_count => {
+                self.go_to_page(p);
+                true
+            }
+            _ => false,
+        }
+    }
+
+    /// View ▸ Page navigation ▸ Previous view (`false`) / Next view (`true`).
+    pub fn view_history(&mut self, forward: bool) -> bool {
+        let has_target = if forward { !self.forward.is_empty() } else { !self.back.is_empty() };
+        if !has_target {
+            return false;
+        }
+        self.end_find_following();
+        let (from, to) = if forward { (&mut self.forward, &mut self.back) } else { (&mut self.back, &mut self.forward) };
+        let Some(page) = from.pop() else { return false };
+        to.push(self.current);
+        let page = page.min(self.page_count.saturating_sub(1));
+        self.goto = Some((page, 0.0));
+        self.current = page;
+        self.reset_coarse_state();
+        true
+    }
+
+    /// One wheel event in a non-continuous view, where the wheel turns pages or spreads (the
+    /// rules are in `wheel_pager`): `dy` is its vertical delta (negative scrolls down) and `now`
+    /// is egui time. With `can_turn` false the gesture is followed but the page stays. Returns
+    /// whether the page turned.
+    pub fn single_page_wheel(&mut self, unit: egui::MouseWheelUnit, dy: f32, phase: egui::TouchPhase, now: f64, can_turn: bool) -> bool {
+        if self.continuous {
+            return false;
+        }
+        let Some(forward) = self.wheel.feed(unit, dy, phase, now, can_turn) else { return false };
+        let before = self.current;
+        self.step_page(forward);
+        self.current != before
+    }
+
+    /// One wheel event in a non-continuous view whose page is taller than the window, where the
+    /// wheel pans (#1924). Once the view is at the bottom (top) edge, scrolling on turns to the
+    /// next (previous) page, which shows its top (bottom). A smooth gesture that panned the page
+    /// has to end first (see `WheelPager::feed_edge`). `can_turn` is false when something else
+    /// owns the wheel. Returns whether the page turned.
+    pub fn single_page_wheel_edge(&mut self, unit: egui::MouseWheelUnit, dy: f32, phase: egui::TouchPhase, now: f64, can_turn: bool) -> bool {
+        if self.continuous {
+            return false;
+        }
+        // Only an up-to-date view counts: the page drawn is the shown one, with no jump pending.
+        let edge = self.goto.is_none()
+            && self.goto_point.is_none()
+            && self.single_edges.is_some_and(|(page, top, bottom)| page == self.current && if dy < 0.0 { bottom } else { top });
+        let Some(forward) = self.wheel.feed_edge(unit, dy, phase, now, can_turn && edge) else { return false };
+        let before = self.current;
+        self.step_page(forward);
+        if self.current == before {
+            return false;
+        }
+        if !forward {
+            // Going back lands on the bottom of the previous page.
+            self.goto = Some((self.current, 1.0));
+        }
+        self.single_edges = None;
+        true
+    }
+}
+
+pub fn shortcuts(view: &mut DocView, ctx: &egui::Context, speed: crate::scroll_speed::ScrollSpeed) {
+    use egui::{Key, KeyboardShortcut, Modifiers};
+    if ctx.input_mut(|i| i.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::F))) {
+        view.open_find();
+    }
+    let cmd = |k| KeyboardShortcut::new(Modifiers::COMMAND, k);
+    let pressed = |s: KeyboardShortcut| ctx.input_mut(|i| i.consume_shortcut(&s));
+    // ⌘G / ⇧⌘G step through the matches from the find field too, as in Acrobat and Preview
+    // (#2669): ahead of the text-input check, but only while there is a search to step.
+    if view.find.is_some() {
+        if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::G)) {
+            view.find_step(false);
+        } else if pressed(cmd(Key::G)) {
+            view.find_step(true);
+        }
+    }
+    // A focused check box or radio button holds egui's keyboard focus only for Space, and a
+    // radio button for the arrows that move within its group: the other page keys still work.
+    let form_box = view.forms.keys.filter(|(id, _)| ctx.memory(|m| m.focused()) == Some(*id));
+    if ctx.egui_wants_keyboard_input() && form_box.is_none() {
+        return;
+    }
+    let arrows = !form_box.is_some_and(|(_, radio)| radio);
+    // Rotation first: egui matches ⌘+ loosely with respect to Shift.
+    if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::Plus))
+        || pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::Equals))
+    {
+        view.rotate_view(true);
+    }
+    if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::Minus)) {
+        view.rotate_view(false);
+    }
+    // In the page grid ⌘+ / ⌘− / ⌘0 size its pages instead (looking is always allowed).
+    let (zoom_in, zoom_out, zoom_reset) = (pressed(cmd(Key::Plus)) || pressed(cmd(Key::Equals)), pressed(cmd(Key::Minus)), pressed(cmd(Key::Num0)));
+    if view.organize {
+        if zoom_in {
+            view.grid_zoom_request = Some(view.grid_zoom * GRID_ZOOM_STEP);
+        }
+        if zoom_out {
+            view.grid_zoom_request = Some(view.grid_zoom / GRID_ZOOM_STEP);
+        }
+        if zoom_reset {
+            view.grid_zoom_request = Some(1.0);
+        }
+    } else {
+        if zoom_in {
+            view.zoom_step(true);
+        }
+        if zoom_out {
+            view.zoom_step(false);
+        }
+        if zoom_reset {
+            view.fit = Fit::Page;
+            view.goto = Some((view.current, 0.0));
+        }
+    }
+    if pressed(cmd(Key::Num1)) {
+        view.set_zoom(1.0);
+    }
+    if pressed(cmd(Key::Num2)) {
+        view.fit = Fit::Width;
+        view.goto = Some((view.current, 0.0));
+    }
+    if pressed(cmd(Key::OpenBracket)) {
+        view.view_history(false);
+    }
+    if pressed(cmd(Key::CloseBracket)) {
+        view.view_history(true);
+    }
+    let key = |k| (arrows || !matches!(k, Key::ArrowLeft | Key::ArrowRight | Key::ArrowUp | Key::ArrowDown)) && ctx.input(|i| i.key_pressed(k));
+    // An open menu takes Escape first and closes; the selection stays for the next one (#3535).
+    if key(Key::Escape) && !egui::Popup::is_any_open(ctx) {
+        if view.camera.is_some() || view.camera_done.is_some() {
+            view.pending_action = Some(ViewAction::CancelCamera);
+        } else if view.selection.is_some() || view.all_text {
+            view.selection = None;
+            view.all_text = false;
+        } else {
+            view.find = None;
+        }
+    }
+    if key(Key::Home) {
+        view.go_to_page(0);
+    }
+    if key(Key::End) {
+        view.go_to_page(usize::MAX);
+    }
+    // Full screen: Space and Enter go forward a page and Backspace back, as in Acrobat (the
+    // arrows and Page Up / Page Down already turn pages where nothing scrolls, below).
+    if view.presentation.is_some() {
+        if key(Key::Space) || key(Key::Enter) {
+            view.step_page(true);
+        }
+        if key(Key::Backspace) {
+            view.step_page(false);
+        }
+    }
+    // As in Acrobat: → / ← go to the next / previous page in every layout (#185), and so do
+    // ⌘Page Down / ⌘Page Up, or plain Page Down / Page Up in single-page view.
+    let command = ctx.input(|i| i.modifiers.command);
+    let scrolls = view.continuous;
+    if key(Key::ArrowRight) || (key(Key::PageDown) && (command || !scrolls)) {
+        view.step_page(true);
+    }
+    if key(Key::ArrowLeft) || (key(Key::PageUp) && (command || !scrolls)) {
+        view.step_page(false);
+    }
+    // ↓ / ↑ scroll a line, and Page Down / Page Up a screen where the pages scroll. In
+    // single-page view, ↓ / ↑ turn the page once there is nothing left to scroll that way, as
+    // the wheel does (#273): always on a page that fits.
+    // The Scroll speed preference sets how far ↓ / ↑ go as well as the wheel (#985); Page Down /
+    // Page Up keep a screen.
+    if !command {
+        let line = KEY_SCROLL_LINE * speed.factor();
+        let screen = (view.viewport_h - KEY_SCROLL_LINE).max(KEY_SCROLL_LINE);
+        let steps = [(Key::ArrowDown, line), (Key::ArrowUp, -line), (Key::PageDown, screen), (Key::PageUp, -screen)];
+        for (k, by) in steps {
+            let arrow = matches!(k, Key::ArrowDown | Key::ArrowUp);
+            if !key(k) || !(scrolls || arrow) {
+                continue;
+            }
+            let forward = k == Key::ArrowDown;
+            // Only an up-to-date view counts: the page drawn is the current one, with no jump pending.
+            let at_end = !scrolls
+                && view.goto.is_none()
+                && view.single_edges.is_some_and(|(page, top, bottom)| page == view.current && if forward { bottom } else { top });
+            if at_end {
+                let before = view.current;
+                view.step_page(forward);
+                if !forward && view.current != before {
+                    // Going back up lands on the bottom of the previous page.
+                    view.goto = Some((view.current, 1.0));
+                }
+                view.single_edges = None;
+            } else {
+                view.key_scroll += by;
+            }
+        }
+    }
+}
+
+/// How far ↓ / ↑ scroll at Normal speed (Scroll speed halves or doubles it). Page Down / Page Up
+/// keep this much of the previous screen in view.
+const KEY_SCROLL_LINE: f32 = 40.0;
diff --git a/crates/ui-egui/src/canvas/organize.rs b/crates/ui-egui/src/canvas/organize.rs
new file mode 100644
index 0000000000..3eae2cc379
--- /dev/null
+++ b/crates/ui-egui/src/canvas/organize.rs
@@ -0,0 +1,535 @@
+use super::cache::{GRID_TAG, thumbnail_density, thumbnail_rows, thumbnail_scale};
+use super::zoom::{GRID_ZOOM_RANGE, GRID_ZOOM_STEP};
+use super::*;
+
+/// How far a sharp grid render may be from the size drawn before it is redone: a pinch changes
+/// the size on every frame, and a slightly soft or slightly large image is fine meanwhile.
+const GRID_SHARP: std::ops::RangeInclusive<f32> = 0.9..=1.6;
+
+/// Whether an image `have` device pixels wide is good enough to draw `want` pixels wide.
+pub(super) fn sharp_enough(have: u32, want: f32) -> bool {
+    want > 0.0 && GRID_SHARP.contains(&(have as f32 / want))
+}
+
+impl DocView {
+    /// Open Organize Pages on the page being read (issue #1910). An empty selection means the
+    /// current page, so a selection left from earlier that does not include it is dropped, and
+    /// the grid scrolls its cell into view. Every way into the grid goes through here; closing
+    /// it is a plain `organize = false`.
+    pub fn open_organize(&mut self) {
+        self.organize = true;
+        if !self.selected.is_empty() && !self.selected.contains(&self.current) {
+            self.clear_page_selection(Some(self.current));
+        }
+        self.grid_reveal = Some(self.current);
+    }
+
+    /// Pages an organize command acts on: the selection, or the current page.
+    pub fn target_pages(&self) -> Vec<usize> {
+        if self.selected.is_empty() { vec![self.current] } else { self.selected.iter().copied().collect() }
+    }
+
+    pub fn select_pages(&mut self, pages: &[usize]) {
+        self.selected = pages.iter().copied().filter(|p| *p < self.page_count).collect();
+        if let Some(first) = self.selected.first() {
+            self.current = *first;
+        }
+    }
+
+    /// A click on page `i`'s thumbnail, in the organize grid or the Pages panel. ⇧ selects the
+    /// range from the anchor (or the current page); ⌘/Ctrl toggles the page; a plain click
+    /// selects only it. `seed_current` is for the Pages panel, where an empty selection means
+    /// the current page: the first ⌘-click on another page keeps the current one selected too.
+    pub fn click_page(&mut self, i: usize, modifiers: egui::Modifiers, seed_current: bool) {
+        if i >= self.page_count {
+            return;
+        }
+        if modifiers.shift {
+            let a = self.select_anchor.unwrap_or(self.current);
+            self.selected = (a.min(i)..=a.max(i)).collect();
+        } else if modifiers.command {
+            if seed_current && self.selected.is_empty() && i != self.current {
+                self.selected.insert(self.current);
+            }
+            if !self.selected.remove(&i) {
+                self.selected.insert(i);
+            }
+            self.select_anchor = Some(i);
+        } else {
+            self.selected = [i].into();
+            self.select_anchor = Some(i);
+        }
+    }
+
+    /// Drop the page selection; a later ⇧-click ranges from `anchor`.
+    pub fn clear_page_selection(&mut self, anchor: Option<usize>) {
+        self.selected.clear();
+        self.select_anchor = anchor.filter(|a| *a < self.page_count);
+    }
+}
+
+/// Where a page of `page` size (points, as shown: after its rotation) is drawn in the grid cell
+/// `cell`: as large as the picture area allows and centred in it, so a landscape or rotated page
+/// fills the cell's width in its middle, as Acrobat draws it, instead of a small strip at the top.
+/// The picture area leaves room for the page number and actions below. Its sides narrow only when
+/// a picture that wide would reach the selection checkbox in the cell's corner.
+pub(crate) fn grid_page_rect(cell: Rect, page: Vec2) -> Rect {
+    let area = Rect::from_min_max(pos2(cell.left(), cell.top() + 16.0), pos2(cell.right(), cell.bottom() - 72.0));
+    // A page size from a damaged file can be zero, NaN or infinite; draw such a page square.
+    let side = |v: f32| if v.is_finite() { v.max(1.0) } else { 1.0 };
+    let (w, h) = (side(page.x), side(page.y));
+    let fit = |margin: f32| {
+        let s = ((area.width() - 2.0 * margin).max(1.0) / w).min(area.height().max(1.0) / h);
+        Rect::from_center_size(area.center(), vec2(w * s, h * s))
+    };
+    let wide = fit(16.0);
+    // The checkbox sits at (8, 8)-(28, 28) from the cell's corner; keep 4 px clear of it.
+    let checkbox = Rect::from_min_size(cell.min + vec2(8.0, 8.0), Vec2::splat(20.0)).expand(4.0);
+    if wide.intersects(checkbox) { fit(30.0) } else { wide }
+}
+
+/// The organize toolbar: page operations on the selection (Acrobat's Organize Pages bar).
+fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
+    let targets = view.target_pages();
+    let n = info.pages.len();
+    let (first, last) = (targets.first().copied().unwrap_or(0), targets.last().copied().unwrap_or(0));
+    egui::Frame::NONE.fill(t.chrome).inner_margin(egui::Margin::symmetric(16, 8)).show(ui, |ui| {
+        ui.horizontal(|ui| {
+            ui.spacing_mut().item_spacing.x = 4.0;
+            let label = match view.selected.len() {
+                0 => crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &(view.current + 1).to_string()), ("n", &n.to_string())]),
+                1 => tl!("1 page selected").to_string(),
+                k => crate::i18n::fmt(tl!("{n} pages selected"), &[("n", &k.to_string())]),
+            };
+            // Fixed width so the buttons never shift as the selection text changes.
+            ui.add_sized([150.0, 30.0], egui::Label::new(egui::RichText::new(label).font(theme::medium(13.0)).color(t.text_muted)).truncate());
+            ui.add_enabled_ui(editable, |ui| {
+                ui.add_space(8.0);
+                if ui.add_enabled_ui(first > 0, |ui| icons::button(ui, "chevron-left", 30.0, false, tl!("Move earlier"))).inner.clicked() {
+                    view.pending_edit = Some(Edit::MovePages { pages: targets.clone(), to: first - 1 });
+                }
+                if ui.add_enabled_ui(last + 1 < n, |ui| icons::button(ui, "chevron-right", 30.0, false, tl!("Move later"))).inner.clicked() {
+                    view.pending_edit = Some(Edit::MovePages { pages: targets.clone(), to: first + 1 });
+                }
+            });
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if widgets::ghost_button(ui, "x", tl!("Close")).on_hover_text(tl!("Back to the document")).clicked() {
+                    view.organize = false;
+                }
+                // What the grid shows is what is saved.
+                let save = ui.add_enabled_ui(dirty, |ui| widgets::pill_button(ui, tl!("Save pages"), true)).inner;
+                if save.on_hover_text(tl!("Save these pages as one PDF")).on_disabled_hover_text(tl!("No changes to save")).clicked() {
+                    view.pending_action = Some(ViewAction::Save);
+                }
+                ui.add_space(8.0);
+                // Page size in the grid (right to left: in, the percentage, out).
+                let zoom = view.grid_zoom;
+                if ui
+                    .add_enabled_ui(zoom < *GRID_ZOOM_RANGE.end(), |ui| icons::button(ui, "zoom-in", 30.0, false, tl!("Larger pages")))
+                    .inner
+                    .clicked()
+                {
+                    view.grid_zoom_request = Some(zoom * GRID_ZOOM_STEP);
+                }
+                let percent = egui::Button::new(egui::RichText::new(format!("{:.0}%", zoom * 100.0)).font(theme::medium(12.0)).color(t.text_muted))
+                    .frame(false);
+                let percent = ui.add_sized([44.0, 30.0], percent);
+                percent.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Reset page size")));
+                if percent.on_hover_text(tl!("Reset page size")).clicked() {
+                    view.grid_zoom_request = Some(1.0);
+                }
+                if ui
+                    .add_enabled_ui(zoom > *GRID_ZOOM_RANGE.start(), |ui| icons::button(ui, "zoom-out", 30.0, false, tl!("Smaller pages")))
+                    .inner
+                    .clicked()
+                {
+                    view.grid_zoom_request = Some(zoom / GRID_ZOOM_STEP);
+                }
+            });
+        });
+    });
+    // Keys act on the selection unless a text field or a dialog has them (Delete under
+    // Preferences deleted the selected pages).
+    if editable && unobstructed && !ui.ctx().egui_wants_keyboard_input() {
+        use egui::{Key, Modifiers};
+        let (del, esc) = ui.input_mut(|i| {
+            (
+                i.consume_key(Modifiers::NONE, Key::Delete) || i.consume_key(Modifiers::NONE, Key::Backspace),
+                i.consume_key(Modifiers::NONE, Key::Escape),
+            )
+        });
+        // ⌘C / ⌘X / ⌘V copy, cut and paste pages (egui delivers them as clipboard events).
+        let (copy, cut, paste) = ui.input(|i| {
+            let any = |f: &dyn Fn(&egui::Event) -> bool| i.events.iter().any(f);
+            (any(&|e| matches!(e, egui::Event::Copy)), any(&|e| matches!(e, egui::Event::Cut)), any(&|e| matches!(e, egui::Event::Paste(_))))
+        });
+        if copy || cut {
+            view.pending_action = Some(ViewAction::CopyPages { cut });
+        }
+        if paste {
+            view.pending_action = Some(ViewAction::PastePages);
+        }
+        if del && targets.len() < n {
+            view.pending_edit = Some(Edit::DeletePages { pages: targets });
+        }
+        if esc {
+            view.selected.clear();
+        }
+    }
+}
+
+/// Organize pages: a thumbnail grid (Acrobat's Organize Pages view). Click selects, ⌘-click
+/// toggles, ⇧-click extends; double-click opens the page.
+/// The gap (0 = before the first page, n = after the last) the pointer points at in the grid.
+pub(crate) fn drop_gap(cells: &[(usize, Rect)], p: Pos2) -> Option<usize> {
+    let (i, r) = cells.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(p).total_cmp(&b.distance_sq_to_pos(p)))?;
+    Some(if p.x < r.center().x { *i } else { i + 1 })
+}
+
+/// Ctrl (Option on macOS) held when a page drag drops copies the dragged pages into the gap
+/// instead of moving them, as Acrobat's Organize Pages does.
+///
+/// The OS comes from the context, not `cfg!`: the wasm build runs on macOS too, where
+/// `cfg!(target_os = "macos")` is false, so Option has to copy there as well (#3092 review).
+fn copy_modifier(ctx: &egui::Context, m: &egui::Modifiers) -> bool {
+    if crate::commands::mac_shortcuts(ctx) { m.alt } else { m.ctrl }
+}
+
+/// A "+" on a gap of the page grid: insert files there. Returns whether it was clicked.
+fn gap_button(ui: &mut egui::Ui, gap: usize, at: Pos2, height: f32, label: String, t: &Tokens) -> bool {
+    let resp = ui.interact(Rect::from_center_size(at, Vec2::splat(22.0)), ui.scope_id().with(("org-gap", gap)), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label.clone()));
+    let hot = resp.hovered();
+    if hot {
+        ui.painter().line_segment([pos2(at.x, at.y - height / 2.0), pos2(at.x, at.y + height / 2.0)], Stroke::new(3.0, t.accent));
+    }
+    ui.painter().circle(at, 9.0, if hot { t.accent } else { t.chrome }, Stroke::new(1.0, if hot { t.accent } else { t.border }));
+    let ink = Stroke::new(1.5, if hot { Color32::WHITE } else { t.text_muted });
+    ui.painter().line_segment([at - vec2(4.0, 0.0), at + vec2(4.0, 0.0)], ink);
+    ui.painter().line_segment([at - vec2(0.0, 4.0), at + vec2(0.0, 4.0)], ink);
+    resp.on_hover_text(label).clicked()
+}
+
+pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
+    let ppp = ui.ctx().pixels_per_point();
+    // The page image scales with the zoom; the padding and the page number don't.
+    let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 88.0);
+    let anchor = view.grid_anchor.take();
+    let reveal = view.grid_reveal.take();
+    let mut open_page = None;
+    organize_toolbar(view, info, editable, dirty, unobstructed, ui, t);
+    let viewport = ui.available_rect_before_wrap();
+    view.viewport_screen = viewport;
+    let auto_delta = if unobstructed {
+        view.auto_scroll.update(ui, viewport, true)
+    } else {
+        view.auto_scroll.cancel();
+        Vec2::ZERO
+    };
+    let middle_gesture = view.auto_scroll.blocks_input();
+    let mut cells: Vec<(usize, Rect)> = Vec::new();
+    // The pages in view that are drawn larger than their thumbnails, and those of them that
+    // need a sharper render than they have. The width is the size drawn, in device pixels.
+    let (mut in_view, mut sharper): (Vec<(usize, f32)>, Vec<RenderRequest>) = (Vec::new(), Vec::new());
+    // The source cell can scroll out of the virtualized rows during a drag.
+    let mut drop = view.org_drag.is_some() && ui.input(|i| i.pointer.primary_released());
+    egui::ScrollArea::vertical().auto_shrink([false, false]).show_viewport(ui, |ui, clip| {
+        if middle_gesture {
+            let opacity = ui.opacity();
+            ui.disable();
+            ui.set_opacity(opacity);
+        }
+        if auto_delta != Vec2::ZERO {
+            ui.scroll_with_delta_animation(auto_delta, egui::style::ScrollAnimation::none());
+        }
+        ui.add_space(20.0);
+        let cols = ((ui.available_width() - 40.0) / cell.x).floor().max(1.0) as usize;
+        let rows = info.pages.len().div_ceil(cols);
+        let left = (ui.available_width() - cols as f32 * cell.x) / 2.0;
+        let (grid, _) = ui.allocate_exact_size(vec2(ui.available_width(), rows as f32 * cell.y), Sense::hover());
+        // The page Organize opened on may lie in a row the virtualized grid has not laid out,
+        // so its cell is computed rather than found.
+        if let Some(page) = reveal.filter(|p| *p < info.pages.len()) {
+            let row = page / cols;
+            let col = page % cols;
+            let c = Rect::from_min_size(pos2(grid.left() + left + col as f32 * cell.x, grid.top() + row as f32 * cell.y), cell);
+            ui.scroll_to_rect_animation(c, Some(egui::Align::Center), egui::style::ScrollAnimation::none());
+        }
+        for row in thumbnail_rows(clip.top() - 20.0, clip.bottom() - 20.0, cell.y, rows) {
+            let row_rect = Rect::from_min_size(grid.min + vec2(0.0, row as f32 * cell.y), vec2(grid.width(), cell.y));
+            for col in 0..cols {
+                let i = row * cols + col;
+                let Some(p) = info.pages.get(i) else { break };
+                let c = Rect::from_min_size(pos2(row_rect.left() + left + col as f32 * cell.x, row_rect.top()), cell);
+                view.need_thumbnail(i, c.intersects(ui.clip_rect()));
+                let resp = ui.interact(c, ui.scope_id().with(("org", i)), if editable { Sense::click_and_drag() } else { Sense::click() });
+                cells.push((i, c));
+                if let Some((_, above)) = anchor.filter(|(page, _)| *page == i) {
+                    ui.scroll_to_rect_animation(c.translate(vec2(0.0, -above)), Some(egui::Align::Min), egui::style::ScrollAnimation::none());
+                }
+                // Drag pages to move them (the selection, or the page grabbed).
+                if resp.drag_started() {
+                    if !view.selected.contains(&i) {
+                        view.selected = [i].into();
+                        view.select_anchor = Some(i);
+                    }
+                    let mut pages: Vec<usize> = view.selected.iter().copied().collect();
+                    pages.sort_unstable();
+                    view.org_drag = Some(pages);
+                }
+                if resp.drag_stopped() {
+                    drop = true;
+                }
+                let page_label = crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.label)]);
+                resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, view.selected.contains(&i), page_label.clone()));
+                let pr = grid_page_rect(c, vec2(p.width, p.height));
+                let size = pr.size();
+                let selected = view.selected.contains(&i) || (view.selected.is_empty() && i == view.current);
+                if selected || resp.hovered() {
+                    ui.painter().rect_filled(c.shrink(6.0), CornerRadius::same(8), if selected { t.accent_soft } else { t.hover });
+                }
+                if view.selected.contains(&i) {
+                    ui.painter().rect_stroke(c.shrink(6.0), CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
+                }
+                ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+                ui.painter().rect_filled(pr, CornerRadius::ZERO, Color32::WHITE);
+                // A page drawn larger than its thumbnail gets a render at the size drawn, while
+                // it is in view; until that arrives the thumbnail stands in.
+                let want = size.x * ppp;
+                let thumb = view.thumbs.get(&i).map(|t| &t.tex);
+                let thumb_ok = thumb.is_some_and(|t| t.size()[0] as f32 >= want * GRID_SHARP.start());
+                let sharp = view.grid_pages.get(&i).filter(|_| !thumb_ok);
+                if !thumb_ok && ui.is_rect_visible(c) {
+                    in_view.push((i, want));
+                    if !sharp.is_some_and(|(w, _)| sharp_enough(*w, want)) && !view.errors.contains_key(&i) {
+                        sharper.push(RenderRequest {
+                            page: i,
+                            kind: RequestKind::Pixels,
+                            tile: None,
+                            scale: want / p.width.max(1.0),
+                            tag: GRID_TAG,
+                            // Grid cells are previews: tiny images are skipped for them.
+                            preview: true,
+                        });
+                    }
+                }
+                if let Some(tex) = sharp.map(|(_, t)| t).or(thumb) {
+                    ui.painter().image(tex.id(), pr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+                }
+                ui.painter().rect_stroke(pr, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
+                let label_font = theme::medium(12.0);
+                let label_w = (c.width() - 12.0).max(0.0);
+                let page_label = crate::widgets::fit_line(&p.label, label_w, |s| crate::widgets::text_width(ui, s, &label_font));
+                let label_pos = pos2(c.center().x, c.bottom() - 48.0);
+                ui.painter().with_clip_rect(Rect::from_center_size(label_pos, vec2(label_w, 18.0))).text(
+                    label_pos,
+                    Align2::CENTER_CENTER,
+                    page_label,
+                    label_font,
+                    t.text_muted,
+                );
+                // The checkbox toggles just this page without requiring a modifier. Keep it
+                // outside the page image, including on very tall or wide pages.
+                let mut checked = view.selected.contains(&i);
+                let check_rect = Rect::from_min_size(c.min + vec2(8.0, 8.0), Vec2::splat(20.0));
+                let check = ui.push_id(("org-check", i), |ui| ui.put(check_rect, widgets::checkbox_without_text(&mut checked))).inner;
+                let label = crate::i18n::fmt(tl!("Select page {label}"), &[("label", &p.label)]);
+                check.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, checked, label.clone()));
+                if check.on_hover_text(label).changed() {
+                    view.click_page(i, egui::Modifiers::COMMAND, false);
+                    // The document shows the page picked here when the grid closes, as after a
+                    // Pages-panel click, so reopening the grid keeps the pick (issue #1910).
+                    view.go_to_page(i);
+                }
+                // Local actions always target the labelled page. The toolbar above the grid
+                // remains the place for actions on the whole selection.
+                if selected || resp.contains_pointer() || resp.has_focus() {
+                    let actions = Rect::from_center_size(pos2(c.center().x, c.bottom() - 24.0), vec2(84.0, 26.0));
+                    ui.scope_builder(
+                        egui::UiBuilder::new().id_salt(("org-actions", i)).max_rect(actions).layout(egui::Layout::left_to_right(egui::Align::Center)),
+                        |ui| {
+                            ui.spacing_mut().item_spacing.x = 3.0;
+                            ui.add_enabled_ui(editable, |ui| {
+                                for (icon, degrees, key) in
+                                    [("rotate-ccw", -90, "Rotate page {label} counterclockwise"), ("rotate-cw", 90, "Rotate page {label} clockwise")]
+                                {
+                                    let label = crate::i18n::fmt(tl!(key), &[("label", &p.label)]);
+                                    if icons::button(ui, icon, 26.0, false, &label).clicked() {
+                                        view.pending_edit = Some(Edit::RotatePages { pages: vec![i], degrees });
+                                    }
+                                }
+                                let label = crate::i18n::fmt(tl!("Delete page {label}"), &[("label", &p.label)]);
+                                if ui.add_enabled_ui(info.pages.len() > 1, |ui| icons::button(ui, "trash-2", 26.0, false, &label)).inner.clicked() {
+                                    view.pending_edit = Some(Edit::DeletePages { pages: vec![i] });
+                                }
+                            });
+                        },
+                    );
+                }
+                if resp.clicked() {
+                    let m = ui.input(|i| i.modifiers);
+                    view.click_page(i, m, false);
+                    view.go_to_page(i);
+                }
+                if resp.double_clicked() {
+                    open_page = Some(i);
+                }
+                // Right-click: Extract, Replace, Cut, Copy, Paste (on the selection, or this page).
+                resp.context_menu(|ui| {
+                    if !view.selected.contains(&i) {
+                        view.selected = [i].into();
+                        view.go_to_page(i);
+                    }
+                    if ui.button(tl!("Extract pages")).clicked() {
+                        view.pending_action = Some(ViewAction::Extract);
+                        ui.close();
+                    }
+                    if ui.button(tl!("Split document…")).clicked() {
+                        view.pending_action = Some(ViewAction::SplitBeforeSelected);
+                        ui.close();
+                    }
+                    if ui.add_enabled(editable, egui::Button::new(tl!("Replace pages…"))).clicked() {
+                        view.pending_action = Some(ViewAction::ReplacePages);
+                        ui.close();
+                    }
+                    ui.separator();
+                    if ui.add_enabled(editable, egui::Button::new(tl!("Cut"))).clicked() {
+                        view.pending_action = Some(ViewAction::CopyPages { cut: true });
+                        ui.close();
+                    }
+                    if ui.button(tl!("Copy")).clicked() {
+                        view.pending_action = Some(ViewAction::CopyPages { cut: false });
+                        ui.close();
+                    }
+                    if ui.add_enabled(editable, egui::Button::new(tl!("Paste after"))).clicked() {
+                        view.pending_action = Some(ViewAction::PastePages);
+                        ui.close();
+                    }
+                });
+            }
+        }
+        // Between pages (and at both ends): insert files right there.
+        if editable && !middle_gesture && view.org_drag.is_none() {
+            let mid = |r: &Rect| r.top() + 16.0 + (cell.y - 88.0) / 2.0;
+            for (i, c) in &cells {
+                let label = info
+                    .pages
+                    .get(*i)
+                    .map(|p| crate::i18n::fmt(tl!("Insert a file before page {label}"), &[("label", &p.label)]))
+                    .unwrap_or_default();
+                if gap_button(ui, *i, pos2(c.left(), mid(c)), cell.y - 88.0, label, t) {
+                    view.pending_action = Some(ViewAction::InsertFromFileAt(*i));
+                }
+            }
+            if let Some((i, c)) = cells.last()
+                && i + 1 == info.pages.len()
+                && gap_button(ui, i + 1, pos2(c.right(), mid(c)), cell.y - 88.0, tl!("Insert a file at the end").to_string(), t)
+            {
+                view.pending_action = Some(ViewAction::InsertFromFileAt(i + 1));
+            }
+        }
+        // While dragging: the gap the pages would go to, drawn as a bar.
+        if let (Some(pages), Some(p)) = (view.org_drag.clone(), ui.input(|i| i.pointer.hover_pos())) {
+            // Ctrl (Option on macOS) held over the drop copies the pages; see #2997.
+            let copying = copy_modifier(ui.ctx(), &ui.input(|i| i.modifiers));
+            if let Some(gap) = drop_gap(&cells, p) {
+                let x = match cells.iter().find(|(i, _)| *i == gap) {
+                    Some((_, r)) => r.left() + 3.0,
+                    None => cells.last().map_or(0.0, |(_, r)| r.right() - 3.0),
+                };
+                let row = cells.iter().find(|(i, _)| *i == gap).or(cells.last()).map(|(_, r)| r.y_range()).unwrap_or(egui::Rangef::new(0.0, 0.0));
+                ui.painter().line_segment([pos2(x, row.min + 10.0), pos2(x, row.max - 10.0)], Stroke::new(3.0, t.accent));
+                let mut text_at = p + vec2(14.0, 14.0);
+                if copying {
+                    // A "+" by the pointer: this drop copies the pages, it doesn't move them.
+                    let badge = p + vec2(12.0, 12.0);
+                    ui.painter().circle(badge, 9.0, t.accent, Stroke::new(1.0, t.accent));
+                    let ink = Stroke::new(1.5, Color32::WHITE);
+                    ui.painter().line_segment([badge - vec2(4.0, 0.0), badge + vec2(4.0, 0.0)], ink);
+                    ui.painter().line_segment([badge - vec2(0.0, 4.0), badge + vec2(0.0, 4.0)], ink);
+                    text_at.x += 18.0;
+                }
+                ui.painter().text(
+                    text_at,
+                    Align2::LEFT_TOP,
+                    if pages.len() == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &pages.len().to_string())]) },
+                    theme::medium(12.0),
+                    t.accent_text,
+                );
+            }
+            if drop {
+                view.org_drag = None;
+                if let Some(gap) = drop_gap(&cells, p) {
+                    if copying {
+                        // The copies land at the gap as it is: nothing leaves its place.
+                        view.pending_edit = Some(Edit::DuplicatePages { pages: pages.clone(), at: Some(gap) });
+                        view.selected = (gap..gap + pages.len()).collect();
+                    } else {
+                        // `to` counts positions without the moving pages.
+                        let to = gap - pages.iter().filter(|x| **x < gap).count();
+                        let first = pages[0];
+                        let contiguous = pages.windows(2).all(|w| w[1] == w[0] + 1);
+                        if !(contiguous && to == first) {
+                            view.pending_edit = Some(Edit::MovePages { pages: pages.clone(), to });
+                            view.selected = (to..to + pages.len()).collect();
+                        }
+                    }
+                }
+            }
+        } else if drop {
+            view.org_drag = None;
+        }
+    });
+    // Files dragged in from outside go to the gap under the pointer. Some platforms don't say
+    // where the pointer is until the files are dropped; then the whole grid is the target.
+    let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| viewport.contains(*p));
+    view.grid_gap = pointer.filter(|_| editable && view.org_drag.is_none()).and_then(|p| drop_gap(&cells, p));
+    if editable && ui.input(|i| !i.raw.hovered_files.is_empty()) {
+        let painter = ui.painter().with_clip_rect(viewport);
+        painter.rect_stroke(viewport.shrink(2.0), CornerRadius::same(6), Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
+        if let Some(gap) = view.grid_gap {
+            let at = cells.iter().find(|(i, _)| *i == gap).map(|(_, r)| (r.left() + 3.0, r.y_range()));
+            if let Some((x, row)) = at.or(cells.last().map(|(_, r)| (r.right() - 3.0, r.y_range()))) {
+                painter.line_segment([pos2(x, row.min + 10.0), pos2(x, row.max - 10.0)], Stroke::new(3.0, t.accent));
+            }
+        }
+        // A "+" that follows the pointer.
+        if let Some(p) = pointer {
+            let at = p + vec2(16.0, 16.0);
+            painter.circle_filled(at, 9.0, t.accent);
+            painter.line_segment([at - vec2(4.0, 0.0), at + vec2(4.0, 0.0)], Stroke::new(1.5, Color32::WHITE));
+            painter.line_segment([at - vec2(0.0, 4.0), at + vec2(0.0, 4.0)], Stroke::new(1.5, Color32::WHITE));
+        }
+    }
+    view.auto_scroll.paint(ui, viewport);
+    // Pinch, or Ctrl/⌘ with the wheel, zooms the grid about the page under the pointer.
+    let pinch = crate::motion::zoom_delta(ui.ctx());
+    if (pinch - 1.0).abs() > 0.001 && pointer.is_some() && !middle_gesture {
+        view.grid_zoom_request = Some(view.grid_zoom * pinch);
+    }
+    if let Some(zoom) = view.grid_zoom_request.take() {
+        let before = view.grid_zoom;
+        view.set_grid_zoom(zoom);
+        if view.grid_zoom != before {
+            // Keep the page under the pointer (or else the first one in view) where it is.
+            let under = pointer.and_then(|p| cells.iter().find(|(_, r)| r.contains(p)));
+            let anchor = under.or_else(|| cells.iter().find(|(_, r)| r.bottom() > viewport.top()));
+            view.grid_anchor = anchor.map(|(i, r)| (*i, r.top() - viewport.top()));
+            ui.ctx().request_repaint();
+        }
+    }
+    // When this frame's thumbnail will cover the cell, drop the sharp render without waiting
+    // for that texture to arrive.
+    let density = thumbnail_density(view.thumb_demand.len(), ppp);
+    in_view.retain(|&(page, want)| {
+        info.pages.get(page).is_none_or(|p| (device_pixels(p.width, thumbnail_scale(p.width, p.height, density)) as f32) < want * GRID_SHARP.start())
+    });
+    sharper.retain(|req| in_view.iter().any(|(page, _)| *page == req.page));
+    view.grid_pages.retain(|page, _| in_view.iter().any(|(kept, _)| kept == page));
+    // Sharp renders of the pages in view join this frame's demand ahead of the thumbnails.
+    view.frame_queue.extend(sharper);
+    if let Some(p) = open_page {
+        view.organize = false;
+        view.go_to_page(p);
+    }
+}
diff --git a/crates/ui-egui/src/canvas/page_pointer.rs b/crates/ui-egui/src/canvas/page_pointer.rs
new file mode 100644
index 0000000000..f0df1d92f1
--- /dev/null
+++ b/crates/ui-egui/src/canvas/page_pointer.rs
@@ -0,0 +1,116 @@
+//! The pointer as the pages see it, read once per frame from the page view's content widget.
+//!
+//! egui knows what is drawn over the pages (a dialog, a menu, the palette, the quick bar, the
+//! chrome over a page scrolled under it) and which widget holds a drag (a panel's tab carried
+//! over them), and keeps a press with the widget it began on until release. egui's raw pointer
+//! state knows none of that, and its hover position is gone on the frame
+//! a touch or a Windows pen lifts: egui-winit sends `PointerGone` with every touch release, and
+//! winit reports Windows pen input as touch. So page modules read [`PagePointer`], never egui's
+//! pointer positions or button states; a test below keeps it that way.
+//!
+//! Dialogs are drawn after the pages, so on the frame one opens egui has not met its layer yet:
+//! the reading also takes whether one is open.
+
+use egui::{Event, PointerButton, Pos2, Rect};
+
+/// A primary-button press or release, and where it happened.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Edge {
+    Press(Pos2),
+    Release(Pos2),
+}
+
+/// How many of a frame's presses and releases are kept. A frame holds one or two (a click, a
+/// double-click in a slow frame), but one after a stall can hold any number.
+const MAX_EDGES: usize = 8;
+
+/// One frame's pointer, as the pages see it.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct PagePointer {
+    /// Where the pointer is, while the pages are what egui has under it and no other widget holds
+    /// a drag (a panel's tab carried over them), or while they hold a press (until the frame of
+    /// its release, past a page's edge included). With a dialog open only a drag the pages
+    /// already have keeps it. It is egui's `interact_pos`, which still has the position on the
+    /// frame a touch lifts.
+    pub pos: Option<Pos2>,
+    /// Where the press the pages hold began, also on the frame of its release when the press
+    /// came in that same frame (egui has forgotten it by then). `None` for a press that began on
+    /// something else.
+    pub origin: Option<Pos2>,
+    /// This frame's primary presses and releases of a press the pages hold, in order.
+    pub edges: Vec<Edge>,
+    /// The primary button is down, wherever it was pressed: a gesture ends once it is up.
+    pub primary_down: bool,
+    /// Some button is down, wherever it was pressed.
+    pub any_down: bool,
+}
+
+impl PagePointer {
+    /// The pointer for `resp`, the content widget that holds every page, allocated in `ui`, while
+    /// a dialog is open over the window or not (`modal`).
+    pub(crate) fn read(ui: &egui::Ui, resp: &egui::Response, modal: bool) -> Self {
+        let (at, origin, edges, primary_down, any_down) =
+            ui.input(|i| (i.pointer.interact_pos(), i.pointer.press_origin(), edges(&i.events), i.pointer.primary_down(), i.pointer.any_down()));
+        // egui's own answer to "do the pages hold a press?": from the press on until the frame
+        // of its click, release or drag stop. A drag can outlive egui's press while the
+        // pointer is outside the window. With a dialog open only a drag counts, up to the frame
+        // it stops: on the frame one opens egui still gives the pages a press that lands under
+        // it, and its click.
+        let held = resp.dragged() || resp.drag_stopped() || (!modal && resp.interact_pointer_pos().is_some());
+        // `contains_pointer` alone also holds a few points under the edge of an Area over the
+        // pages (egui's interact radius), so the top layer there must be the pages' own. A
+        // dialog covers them from the frame it opens, before egui knows its layer.
+        let layer = ui.layer_id();
+        let on_top =
+            |p: &Pos2| !modal && !dragged_elsewhere(ui, resp) && resp.contains_pointer() && ui.ctx().layer_id_at(*p).is_none_or(|l| l == layer);
+        let pos = at.filter(|p| held || on_top(p));
+        if !held {
+            return Self { pos, origin: None, edges: Vec::new(), primary_down, any_down };
+        }
+        Self { pos, origin: origin.or_else(|| first_press(&edges)), edges, primary_down, any_down }
+    }
+
+    /// Where the pointer is, when it is inside `r`.
+    pub(crate) fn within(&self, r: Rect) -> Option<Pos2> {
+        self.pos.filter(|p| r.contains(*p))
+    }
+
+    /// Where this frame's first primary press was.
+    pub(crate) fn pressed(&self) -> Option<Pos2> {
+        first_press(&self.edges)
+    }
+}
+
+/// Whether egui gives the drag to a widget that is not the pages' (a panel's tab, a floating panel's
+/// grip): egui hovers nothing else until it stops, though it still reports the pages under the
+/// pointer. A widget on the pages (a form field's editor) keeps them.
+fn dragged_elsewhere(ui: &egui::Ui, resp: &egui::Response) -> bool {
+    let ctx = ui.ctx();
+    ctx.dragged_id().is_some_and(|id| {
+        id != resp.id && !ctx.read_response(id).is_some_and(|r| r.layer_id == resp.layer_id && resp.interact_rect.contains_rect(r.interact_rect))
+    })
+}
+
+fn first_press(edges: &[Edge]) -> Option<Pos2> {
+    edges.iter().find_map(|e| match e {
+        Edge::Press(p) => Some(*p),
+        Edge::Release(_) => None,
+    })
+}
+
+/// The first [`MAX_EDGES`] primary presses and releases among `events`, in order.
+fn edges(events: &[Event]) -> Vec<Edge> {
+    events
+        .iter()
+        .filter_map(|e| match e {
+            Event::PointerButton { pos, button: PointerButton::Primary, pressed, .. } if pos.is_finite() => {
+                Some(if *pressed { Edge::Press(*pos) } else { Edge::Release(*pos) })
+            }
+            _ => None,
+        })
+        .take(MAX_EDGES)
+        .collect()
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/canvas/page_pointer/tests.rs b/crates/ui-egui/src/canvas/page_pointer/tests.rs
new file mode 100644
index 0000000000..29630b7150
--- /dev/null
+++ b/crates/ui-egui/src/canvas/page_pointer/tests.rs
@@ -0,0 +1,324 @@
+use super::*;
+use egui::{Context, Modifiers, Sense, TouchDeviceId, TouchId, TouchPhase, pos2, vec2};
+
+/// The pages' widget: x 0..200, y 0..200 of a 400×400 screen.
+const PAGES: Rect = Rect { min: Pos2::ZERO, max: Pos2 { x: 200.0, y: 200.0 } };
+/// An Area drawn over the pages' lower right corner.
+const OVER: Rect = Rect { min: Pos2 { x: 120.0, y: 120.0 }, max: Pos2 { x: 260.0, y: 260.0 } };
+
+fn button(pos: Pos2, button: PointerButton, pressed: bool) -> Event {
+    Event::PointerButton { pos, button, pressed, modifiers: Modifiers::NONE }
+}
+
+fn touch(phase: TouchPhase, pos: Pos2) -> Event {
+    Event::Touch { device_id: TouchDeviceId(1), id: TouchId(1), phase, pos, force: None }
+}
+
+/// Runs one frame of the pages' widget (and the Area over it, with `area`) and returns what
+/// the pages see.
+fn frame(ctx: &Context, events: Vec<Event>, area: bool) -> PagePointer {
+    frame_with(ctx, events, area, false)
+}
+
+/// [`frame`], with a dialog open (`modal`) whose layer egui has not met.
+fn frame_with(ctx: &Context, events: Vec<Event>, area: bool, modal: bool) -> PagePointer {
+    let mut seen = PagePointer::default();
+    let input = egui::RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(400.0, 400.0))), events, ..Default::default() };
+    let mut output = ctx.run_ui(input, |ui| {
+        let (_, resp) = ui.allocate_exact_size(PAGES.size(), Sense::click_and_drag());
+        seen = PagePointer::read(ui, &resp, modal);
+        if area {
+            egui::Area::new(egui::Id::unique("over")).fixed_pos(OVER.min).show(ui.ctx(), |ui| {
+                ui.allocate_exact_size(OVER.size(), Sense::hover());
+            });
+        }
+    });
+    // An input-only test has no renderer to take the font texture.
+    output.textures_delta.clear();
+    seen
+}
+
+#[test]
+fn a_touch_tap_keeps_its_position_on_the_frame_it_lifts() {
+    let ctx = Context::default();
+    let p = pos2(50.0, 60.0);
+    frame(&ctx, vec![], false);
+    let down = frame(&ctx, vec![touch(TouchPhase::Start, p), Event::PointerMoved(p), button(p, PointerButton::Primary, true)], false);
+    assert_eq!((down.pos, down.origin, down.pressed()), (Some(p), Some(p), Some(p)));
+    // egui-winit ends a touch with the release and `PointerGone` in one frame.
+    let up = frame(&ctx, vec![touch(TouchPhase::End, p), button(p, PointerButton::Primary, false), Event::PointerGone], false);
+    assert_eq!(ctx.input(|i| i.pointer.hover_pos()), None, "egui's hover position is gone");
+    assert_eq!(up.pos, Some(p), "the pages still know where the finger lifted");
+    assert_eq!(up.edges, [Edge::Release(p)]);
+    assert_eq!(frame(&ctx, vec![], false), PagePointer::default(), "and forget it the frame after");
+}
+
+#[test]
+fn a_press_and_release_in_one_frame_keep_the_press() {
+    let ctx = Context::default();
+    let p = pos2(50.0, 60.0);
+    frame(&ctx, vec![Event::PointerMoved(p)], false);
+    let click = frame(&ctx, vec![button(p, PointerButton::Primary, true), button(p, PointerButton::Primary, false)], false);
+    assert_eq!(ctx.input(|i| i.pointer.press_origin()), None, "egui has forgotten the press");
+    assert_eq!(click.origin, Some(p));
+    assert_eq!(click.edges, [Edge::Press(p), Edge::Release(p)]);
+}
+
+#[test]
+fn something_drawn_over_the_pages_hides_the_pointer() {
+    let ctx = Context::default();
+    // The Area and the widget rects egui hit-tests against come from the frame before.
+    frame(&ctx, vec![], true);
+    frame(&ctx, vec![], true);
+    let beside = pos2(100.0, 100.0);
+    assert_eq!(frame(&ctx, vec![Event::PointerMoved(beside)], true).pos, Some(beside));
+    // Inside the Area, and just inside its edge where egui's interact radius still finds the
+    // pages' widget.
+    for p in [pos2(160.0, 160.0), pos2(122.0, 150.0)] {
+        assert_eq!(frame(&ctx, vec![Event::PointerMoved(p)], true).pos, None, "{p:?}");
+    }
+    // Off the pages altogether.
+    assert_eq!(frame(&ctx, vec![Event::PointerMoved(pos2(300.0, 50.0))], true).pos, None);
+    // A press on the Area is not the pages' press, though the button is down all the same.
+    let p = pos2(160.0, 160.0);
+    let press = frame(&ctx, vec![button(p, PointerButton::Primary, true)], true);
+    assert_eq!(press, PagePointer { primary_down: true, any_down: true, ..PagePointer::default() });
+}
+
+#[test]
+fn a_press_on_the_pages_keeps_the_pointer_until_its_release() {
+    let ctx = Context::default();
+    frame(&ctx, vec![], true);
+    frame(&ctx, vec![], true);
+    let start = pos2(40.0, 40.0);
+    frame(&ctx, vec![Event::PointerMoved(start), button(start, PointerButton::Primary, true)], true);
+    // Dragged over the Area and off the pages: still theirs.
+    for p in [pos2(160.0, 160.0), pos2(300.0, 50.0)] {
+        let held = frame(&ctx, vec![Event::PointerMoved(p)], true);
+        assert_eq!((held.pos, held.origin, held.primary_down), (Some(p), Some(start), true), "{p:?}");
+    }
+    let end = pos2(300.0, 60.0);
+    let up = frame(&ctx, vec![Event::PointerMoved(end), button(end, PointerButton::Primary, false)], true);
+    assert_eq!((up.pos, up.edges.as_slice()), (Some(end), [Edge::Release(end)].as_slice()), "the release is the pages' too");
+    assert!(!up.primary_down && !up.any_down, "and the button is up");
+    assert_eq!(frame(&ctx, vec![], true).pos, None, "then off the pages, the pointer is not theirs");
+}
+
+#[test]
+fn a_dialog_hides_the_pointer_and_its_clicks_but_not_a_drag_the_pages_have() {
+    let ctx = Context::default();
+    let p = pos2(50.0, 50.0);
+    frame(&ctx, vec![Event::PointerMoved(p)], false);
+    assert_eq!(frame(&ctx, vec![], false).pos, Some(p));
+    assert_eq!(frame_with(&ctx, vec![], false, true).pos, None, "no pointer under a dialog, before egui knows its layer too");
+    let click = frame_with(&ctx, vec![button(p, PointerButton::Primary, true), button(p, PointerButton::Primary, false)], false, true);
+    assert_eq!((click.pos, click.origin, click.edges.as_slice()), (None, None, [].as_slice()), "nor a click egui gives the pages then");
+    // A drag the pages already have when a dialog opens goes on until its release.
+    frame(&ctx, vec![button(p, PointerButton::Primary, true)], false);
+    frame(&ctx, vec![Event::PointerMoved(pos2(80.0, 50.0))], false);
+    let q = pos2(110.0, 50.0);
+    let dragging = frame_with(&ctx, vec![Event::PointerMoved(q)], false, true);
+    assert_eq!((dragging.pos, dragging.origin), (Some(q), Some(p)), "a drag the pages have keeps its pointer under a dialog");
+    let up = frame_with(&ctx, vec![button(q, PointerButton::Primary, false)], false, true);
+    assert_eq!(up.edges.as_slice(), [Edge::Release(q)].as_slice(), "and its release");
+}
+
+#[test]
+fn a_secondary_press_is_some_button_down_but_no_primary_edge() {
+    let ctx = Context::default();
+    let p = pos2(50.0, 60.0);
+    frame(&ctx, vec![Event::PointerMoved(p)], false);
+    let right = frame(&ctx, vec![button(p, PointerButton::Secondary, true)], false);
+    assert_eq!((right.pos, right.any_down, right.primary_down, right.edges.len()), (Some(p), true, false, 0));
+}
+
+#[test]
+fn edges_are_primary_finite_in_order_and_capped() {
+    let p = pos2(1.0, 2.0);
+    let q = pos2(3.0, 4.0);
+    let events = vec![
+        button(p, PointerButton::Secondary, true),
+        button(p, PointerButton::Primary, true),
+        Event::PointerMoved(q),
+        button(pos2(f32::NAN, 0.0), PointerButton::Primary, false),
+        button(q, PointerButton::Primary, false),
+    ];
+    assert_eq!(edges(&events), [Edge::Press(p), Edge::Release(q)]);
+    let many: Vec<Event> = (0..100).map(|i| button(p, PointerButton::Primary, i % 2 == 0)).collect();
+    assert_eq!(edges(&many).len(), MAX_EDGES);
+    assert_eq!(first_press(&[Edge::Release(q), Edge::Press(p), Edge::Press(q)]), Some(p));
+}
+
+/// The page modules: the per-page chain in `canvas::document_area` and what it calls.
+const PAGE_MODULES: [&str; 35] = [
+    "canvas.rs",
+    "canvas/area.rs",
+    "canvas/bars.rs",
+    "canvas/cache.rs",
+    "canvas/find.rs",
+    "canvas/navigation.rs",
+    "canvas/organize.rs",
+    "canvas/selection.rs",
+    "canvas/xform.rs",
+    "canvas/zoom.rs",
+    "tools/comments.rs",
+    "tools/comments/composer.rs",
+    "tools/comments/geometry.rs",
+    "tools/comments/input.rs",
+    "tools/comments/menu.rs",
+    "tools/comments/paint.rs",
+    "tools/comments/state.rs",
+    "tools/forms_ui.rs",
+    "tools/prepare.rs",
+    "tools/fill_sign.rs",
+    "tools/fill_sign/scan.rs",
+    "tools/sign_ui.rs",
+    "canvas/crop.rs",
+    "canvas/zoom_snap.rs",
+    "tools/camera_ui.rs",
+    "tools/measure_ui.rs",
+    "tools/redact_ui.rs",
+    "tools/link_ui.rs",
+    "tools/content_ui.rs",
+    "tools/edit_text_ui.rs",
+    "tools/edit_text_ui/image.rs",
+    "tools/object_ui.rs",
+    "canvas/image_pick.rs",
+    "canvas/signature_drag.rs",
+    "tools/calc_order_ui.rs",
+];
+
+/// egui's raw pointer state: where the pointer is, and which buttons are down or went down.
+const RAW_READS: [&str; 21] = [
+    "hover_pos()",
+    "interact_pos()",
+    "latest_pos()",
+    "press_origin()",
+    "pointer_hover_pos()",
+    "pointer_interact_pos()",
+    "pointer_latest_pos()",
+    "primary_down()",
+    "primary_pressed()",
+    "primary_released()",
+    "primary_clicked()",
+    "any_down()",
+    "any_pressed()",
+    "any_released()",
+    "any_click()",
+    // These take the button, so they match up to the parenthesis.
+    "button_down(",
+    "button_pressed(",
+    "button_released(",
+    "button_clicked(",
+    "button_double_clicked(",
+    "button_triple_clicked(",
+];
+
+/// Functions in the page modules that are not page input and read egui's pointer state
+/// themselves: (file, function, why).
+const NOT_PAGE_INPUT: [(&str, &str, &str); 11] = [
+    ("canvas/area.rs", "zoom_anchor", "a pinch zooms the whole view, and is read before the pages' widget exists"),
+    ("canvas/area.rs", "drawing_edge_pointer", "scrolls the view at its edges, read before the pages' widget exists"),
+    ("canvas/area.rs", "glide_interrupted", "a press anywhere stops the touchpad's glide"),
+    ("canvas/area.rs", "presentation_click", "full screen's click to turn the page, read before the pages' widget exists"),
+    ("canvas/bars.rs", "page_size_hint", "the page size hint sits in the view's corner, not on a page"),
+    ("canvas/organize.rs", "organize_grid", "Organize Pages shows thumbnails, not pages"),
+    ("tools/comments/input.rs", "keys", "keyboard handling after the pages: a drag cancelled with Escape ends once no button is down"),
+    ("tools/forms_ui.rs", "overlay", "the field editor is an Area of its own over the page"),
+    ("tools/content_ui.rs", "editor", "the added-text editor is an Area of its own over the page"),
+    ("tools/edit_text_ui.rs", "overlay", "the paragraph editor is an Area of its own over the page"),
+    ("tools/fill_sign/scan.rs", "scan_tab", "the signature dialog's Scan tab"),
+];
+
+/// The function a `fn` line declares, laid out as rustfmt does (`pub`, `const` and the like
+/// before `fn`).
+fn declares(line: &str) -> Option<&str> {
+    let mut rest = line;
+    loop {
+        let before = rest;
+        for prefix in ["pub(crate) ", "pub(super) ", "pub ", "const ", "async ", "unsafe "] {
+            rest = rest.strip_prefix(prefix).unwrap_or(rest);
+        }
+        if rest == before {
+            break;
+        }
+    }
+    let rest = rest.strip_prefix("fn ")?;
+    rest.find(|c: char| !(c.is_alphanumeric() || c == '_')).map(|end| &rest[..end])
+}
+
+/// Whether `line` calls `read`, and not a longer name that ends in it.
+fn reads(line: &str, read: &str) -> bool {
+    line.match_indices(read).any(|(at, _)| !line[..at].ends_with(|c: char| c.is_alphanumeric() || c == '_'))
+}
+
+/// Page modules read the pointer only through `PagePointer`. egui's raw state misses what is
+/// drawn over the pages and where a touch lifted, so a raw read in a page module brings back
+/// the bugs `PagePointer` fixed: a cursor or a press through a dialog, a tap that does nothing.
+#[test]
+fn page_modules_read_the_pointer_only_through_page_pointer() {
+    let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+    let mut problems = Vec::new();
+    let mut needed = vec![false; NOT_PAGE_INPUT.len()];
+    for file in PAGE_MODULES {
+        let source = std::fs::read_to_string(src.join(file)).expect("page module").replace("\r\n", "\n");
+        // Tests drive egui's input themselves.
+        let code = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
+        // The top-level function, or method of an `impl`, that each line is in.
+        let (mut function, mut in_impl) = (None, false);
+        for (n, line) in code.lines().enumerate() {
+            if line.starts_with("impl") {
+                (function, in_impl) = (None, true);
+            } else if line == "}" {
+                (function, in_impl) = (None, false);
+            } else if let Some(name) = declares(line).or_else(|| line.strip_prefix("    ").filter(|_| in_impl).and_then(declares)) {
+                function = Some(name);
+            }
+            if line.trim_start().starts_with("//") {
+                continue;
+            }
+            for read in RAW_READS.into_iter().filter(|read| reads(line, read)) {
+                match NOT_PAGE_INPUT.iter().position(|(f, name, _)| *f == file && function == Some(*name)) {
+                    Some(k) => needed[k] = true,
+                    None => problems.push(format!(
+                        "src/{file}:{}: `{read}` reads egui's pointer state in a page module. Read `PagePointer` \
+                             (src/page_pointer.rs) instead: it knows what is drawn over the pages and where a touch \
+                             lifted. Not page input? Add the function to NOT_PAGE_INPUT there, with why.",
+                        n + 1
+                    )),
+                }
+            }
+        }
+    }
+    for ((file, name, _), needed) in NOT_PAGE_INPUT.iter().zip(needed) {
+        if !needed {
+            problems.push(format!("src/{file}: fn {name} reads no pointer state any more: remove it from NOT_PAGE_INPUT."));
+        }
+    }
+    // A module that takes the page pointer is a page module, so it is checked too.
+    let mut dirs = vec![src.clone()];
+    while let Some(dir) = dirs.pop() {
+        for entry in std::fs::read_dir(dir).expect("source directory") {
+            let path = entry.expect("source entry").path();
+            // Tests drive egui's input themselves, in test modules and in test files.
+            let stem = path.file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default();
+            if stem == "tests" || stem.ends_with("_tests") {
+                continue;
+            }
+            if path.is_dir() {
+                dirs.push(path);
+                continue;
+            }
+            if path.extension().is_none_or(|ext| ext != "rs") {
+                continue;
+            }
+            let file =
+                path.strip_prefix(&src).expect("under src").components().map(|c| c.as_os_str().to_string_lossy()).collect::<Vec<_>>().join("/");
+            let source = std::fs::read_to_string(&path).expect("source file");
+            if file != "canvas/page_pointer.rs" && source.contains("PagePointer") && !PAGE_MODULES.contains(&file.as_str()) {
+                problems.push(format!("src/{file} takes the page pointer: add it to PAGE_MODULES."));
+            }
+        }
+    }
+    assert!(problems.is_empty(), "{}", problems.join("\n"));
+}
diff --git a/crates/ui-egui/src/scroll_speed.rs b/crates/ui-egui/src/canvas/scroll_speed.rs
similarity index 95%
rename from crates/ui-egui/src/scroll_speed.rs
rename to crates/ui-egui/src/canvas/scroll_speed.rs
index e5a2b453f4..ebb6a34c41 100644
--- a/crates/ui-egui/src/scroll_speed.rs
+++ b/crates/ui-egui/src/canvas/scroll_speed.rs
@@ -90,7 +90,13 @@ mod tests {
 
     fn wheel(unit: egui::MouseWheelUnit, dy: f32, command: bool) -> egui::Event {
         let modifiers = egui::Modifiers { command, ..egui::Modifiers::NONE };
-        egui::Event::MouseWheel { unit, delta: egui::vec2(0.0, dy), phase: egui::TouchPhase::Move, modifiers }
+        egui::Event::MouseWheel {
+            unit,
+            delta: egui::vec2(0.0, dy),
+            phase: egui::TouchPhase::Move,
+            modifiers,
+            source: egui::MouseWheelSource::Unknown,
+        }
     }
 
     #[test]
diff --git a/crates/ui-egui/src/canvas/selection.rs b/crates/ui-egui/src/canvas/selection.rs
new file mode 100644
index 0000000000..43d5990c57
--- /dev/null
+++ b/crates/ui-egui/src/canvas/selection.rs
@@ -0,0 +1,250 @@
+use super::*;
+
+/// A text selection on one page.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) struct Selection {
+    pub(super) page: usize,
+    pub(super) span: Span,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) enum Span {
+    /// Reading order, between two glyph indices.
+    Run { anchor: usize, head: usize },
+    /// Column select (#740): the glyphs inside a rectangle in page view space, drawn from the
+    /// corner the drag started at (`rect[0..2]`) to the pointer (`rect[2..4]`).
+    Column { rect: [f32; 4] },
+}
+
+impl Selection {
+    pub(super) fn run(page: usize, anchor: usize, head: usize) -> Self {
+        Self { page, span: Span::Run { anchor, head } }
+    }
+
+    fn range(anchor: usize, head: usize) -> Range<usize> {
+        anchor.min(head)..anchor.max(head).saturating_add(1)
+    }
+
+    /// One rectangle per selected piece of a line, in view space (highlighting, markup quads).
+    pub(super) fn rects(&self, text: &PageText) -> Vec<[f32; 4]> {
+        match self.span {
+            Span::Run { anchor, head } => text.line_rects(Self::range(anchor, head)),
+            Span::Column { rect } => text.glyph_rects(&text.glyphs_in(rect)),
+        }
+    }
+
+    /// The selected text, as Copy puts it on the clipboard.
+    pub(super) fn text(&self, text: &PageText) -> String {
+        match self.span {
+            Span::Run { anchor, head } => text.text_of(Self::range(anchor, head)),
+            Span::Column { rect } => text.column_text(&text.glyphs_in(rect)),
+        }
+    }
+}
+
+/// The glyphs `clicks` quick clicks select around glyph `a`: two the word, three the line, more
+/// the page.
+pub(super) fn click_unit(text: &PageText, clicks: u32, a: usize) -> Option<(usize, usize)> {
+    match clicks {
+        2 => text.word_at(a),
+        3 => text.line_at(a),
+        _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
+    }
+}
+
+impl DocView {
+    /// The text selection as markup quadrilaterals in user space: (page, quads).
+    pub(crate) fn selection_quads(&self, info: &DocInfo) -> Option<(usize, Vec<[f64; 8]>)> {
+        let s = self.selection?;
+        let text = self.texts.get(&s.page)?;
+        let page = info.pages.get(s.page)?;
+        let quads: Vec<[f64; 8]> = s.rects(text).into_iter().map(|r| page.view_rect_to_quad(r)).collect();
+        (!quads.is_empty()).then_some((s.page, quads))
+    }
+
+    pub(crate) fn clear_selection(&mut self) {
+        self.selection = None;
+        self.actions_dismissed = None;
+    }
+
+    /// Select text on `page` from glyph `from` to glyph `to` (tests and automation).
+    pub fn select_text(&mut self, page: usize, from: usize, to: usize) {
+        self.all_text = false;
+        self.selection = Some(Selection::run(page, from, to));
+    }
+
+    /// Screen position of the centre of glyph `glyph` on `page`, if that page is on screen and its
+    /// text layer is loaded (used by UI tests and automation to aim pointer input).
+    pub fn glyph_screen_pos(&self, page: usize, glyph: usize) -> Option<Pos2> {
+        let (_, xf) = self.screen_xforms.iter().find(|(p, _)| *p == page)?;
+        let g = self.texts.get(&page)?.glyphs.get(glyph)?;
+        Some(xf.view_rect(g.rect).center())
+    }
+
+    /// Selected text, if any (⌘C).
+    /// The selected text: of the pages read so far, after Select All of the document (Copy reads
+    /// the others, [`DocView::pages_without_text`]).
+    pub fn selected_text(&self) -> Option<String> {
+        if self.all_text {
+            return Some(self.whole_text(&HashMap::new())).filter(|x| !x.is_empty());
+        }
+        let s = self.selection?;
+        let t = self.texts.get(&s.page)?;
+        Some(s.text(t)).filter(|x| !x.is_empty())
+    }
+
+    /// Select all: every page in Organize, or every word on the current page.
+    pub fn select_all(&mut self) -> bool {
+        if self.organize {
+            self.selected = (0..self.page_count).collect();
+            // Keep the current page as the anchor for the next Shift-click.
+            self.select_anchor = (self.page_count > 0).then_some(self.current);
+            return !self.selected.is_empty();
+        }
+        // Scrolling continuously, Select All takes the whole document's text (#2639); one page at
+        // a time, the page shown.
+        // Like the page's, true once some text is selected: the pages whose text isn't read yet are
+        // read when the selection is copied.
+        if self.continuous && self.page_count > 1 {
+            self.selection = None;
+            self.all_text = true;
+            return self.selected_text().is_some();
+        }
+        self.all_text = false;
+        let page = self.current;
+        let Some(t) = self.texts.get(&page) else { return false };
+        if t.glyphs.is_empty() {
+            return false;
+        }
+        self.selection = Some(Selection::run(page, 0, t.glyphs.len() - 1));
+        true
+    }
+
+    /// Pages whose text [`DocView::whole_text`] still needs: not read yet, nor failed.
+    pub(crate) fn pages_without_text(&self) -> Vec<usize> {
+        (0..self.page_count).filter(|p| !self.texts.contains_key(p) && !self.text_failed.contains(p)).collect()
+    }
+
+    /// The whole document's text in page order, one page after another on new lines, from the
+    /// pages' text read so far and `more` (pages read for this, keyed by page).
+    pub(crate) fn whole_text(&self, more: &HashMap<usize, Arc<PageText>>) -> String {
+        let mut out = String::new();
+        for p in 0..self.page_count {
+            let Some(t) = self.texts.get(&p).or_else(|| more.get(&p)) else { continue };
+            let text = t.text_of(0..t.glyphs.len());
+            if text.is_empty() {
+                continue;
+            }
+            if !out.is_empty() {
+                out.push('\n');
+            }
+            out.push_str(&text);
+        }
+        out
+    }
+}
+
+#[derive(Clone, Copy)]
+enum SelectionAction {
+    Note,
+    Markup(comments::CommentTool),
+    Replace,
+    Copy,
+}
+
+/// Actions on an existing text selection, next to the selected words.
+pub(super) fn selection_actions(
+    ui: &mut egui::Ui,
+    viewport: Rect,
+    view: &mut DocView,
+    info: &DocInfo,
+    prefs: &comments::CommentPrefs,
+    can_comment: bool,
+    can_copy: bool,
+) -> bool {
+    if ui.input(|input| input.pointer.is_decidedly_dragging()) {
+        return false;
+    }
+    let Some(selection) = view.selection else {
+        view.actions_dismissed = None;
+        return false;
+    };
+    if view.actions_dismissed == Some(selection) {
+        return false;
+    }
+    let Some(text) = view.texts.get(&selection.page) else { return false };
+    let Some(xf) = view.page_xform(selection.page) else { return false };
+    let Some(last) = selection.rects(text).last().copied() else { return false };
+    let selected = selection.text(text);
+    if selected.is_empty() {
+        return false;
+    }
+    let rect = xf.view_rect(last);
+    if !viewport.intersects(rect) {
+        return false;
+    }
+    let x = rect.left().clamp(viewport.left() + 8.0, (viewport.right() - 520.0).max(viewport.left() + 8.0));
+    let y = if rect.bottom() + 48.0 < viewport.bottom() { rect.bottom() + 6.0 } else { (rect.top() - 44.0).max(viewport.top() + 6.0) };
+    let mut chosen = None;
+    egui::Area::new(egui::Id::unique(("text-selection-actions", view.id.0))).order(egui::Order::Foreground).fixed_pos(pos2(x, y)).show(
+        ui.ctx(),
+        |ui| {
+            egui::Frame::popup(ui.style()).show(ui, |ui| {
+                ui.horizontal(|ui| {
+                    for (label, action) in [
+                        (tl!("Add comment"), SelectionAction::Note),
+                        (tl!("Highlight"), SelectionAction::Markup(comments::CommentTool::Highlight)),
+                        (tl!("Underline"), SelectionAction::Markup(comments::CommentTool::Underline)),
+                        (tl!("Strikethrough"), SelectionAction::Markup(comments::CommentTool::StrikeOut)),
+                        (tl!("Replace text"), SelectionAction::Replace),
+                    ] {
+                        if ui.add_enabled(can_comment, egui::Button::new(label)).clicked() {
+                            chosen = Some(action);
+                        }
+                    }
+                    if ui.add_enabled(can_copy, egui::Button::new(tl!("Copy"))).clicked() {
+                        chosen = Some(SelectionAction::Copy);
+                    }
+                });
+            });
+        },
+    );
+    let Some(action) = chosen else { return false };
+    if let SelectionAction::Copy = action {
+        // Copying closes the bar but keeps the words selected, for ⌘C or a second action.
+        view.actions_dismissed = Some(selection);
+        return true;
+    }
+    let Some((page, quads)) = view.selection_quads(info) else { return false };
+    let last = quads.last().copied().unwrap_or_default();
+    let at = [last[2].max(last[6]), last[1].max(last[3])];
+    view.clear_selection();
+    match action {
+        SelectionAction::Note | SelectionAction::Replace => {
+            if matches!(action, SelectionAction::Replace) {
+                view.comments.replace = Some(quads);
+            }
+            view.comments.composer = Some(comments::Composer {
+                page,
+                at,
+                kind: if matches!(action, SelectionAction::Replace) { comments::ComposerKind::Replace } else { comments::ComposerKind::Note },
+                text: String::new(),
+                focus: true,
+            });
+        }
+        SelectionAction::Markup(tool) => {
+            // Every markup button carries a markup tool; anything else adds nothing.
+            let Some(kind) = tool.markup() else { return false };
+            view.pending_edit = Some(Edit::AddAnnotation(pdfcraft_engine::NewAnnotation {
+                page,
+                shape: pdfcraft_engine::Shape::TextMarkup { kind, quads },
+                style: prefs.style(tool),
+                contents: String::new(),
+                author: prefs.author.clone(),
+            }));
+        }
+        // Copy is dispatched through the app after the view borrow ends.
+        SelectionAction::Copy => {}
+    }
+    false
+}
diff --git a/crates/ui-egui/src/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
similarity index 98%
rename from crates/ui-egui/src/signature_drag.rs
rename to crates/ui-egui/src/canvas/signature_drag.rs
index 788f333e68..e574d68ec4 100644
--- a/crates/ui-egui/src/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -186,8 +186,8 @@ impl SignatureDrag {
         {
             return;
         }
-        let (pointer, shift) = painter.ctx().input(|i| (i.pointer.hover_pos(), i.modifiers.shift));
-        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, pending);
+        let shift = painter.ctx().input(|i| i.modifiers.shift);
+        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), cx.ptr.pos, shift, pending);
         let painter = painter.with_clip_rect(painter.clip_rect().intersect(cx.xf.rect));
         cx.xf.paint_image(&painter, background.id(), 0.0, 0.0, 1.0, 1.0);
         match &layers.front {
diff --git a/crates/ui-egui/src/canvas/tests.rs b/crates/ui-egui/src/canvas/tests.rs
new file mode 100644
index 0000000000..01eba9b0b1
--- /dev/null
+++ b/crates/ui-egui/src/canvas/tests.rs
@@ -0,0 +1,2034 @@
+#[test]
+fn zoom_anchor_scroll_stays_within_the_content() {
+    let (content, viewport) = (vec2(1000.0, 2000.0), vec2(800.0, 600.0));
+    // Past the end: clamped to the maximum (200, 1400), not left for egui to snap back.
+    assert_eq!(anchored_scroll(pos2(900.0, 1900.0), vec2(0.0, 0.0), content, viewport), vec2(200.0, 1400.0));
+    // Before the start.
+    assert_eq!(anchored_scroll(pos2(10.0, 10.0), vec2(300.0, 300.0), content, viewport), Vec2::ZERO);
+    // Inside: unchanged.
+    assert_eq!(anchored_scroll(pos2(150.0, 800.0), vec2(100.0, 100.0), content, viewport), vec2(50.0, 700.0));
+    // Content smaller than the viewport: no scrolling.
+    assert_eq!(anchored_scroll(pos2(400.0, 400.0), Vec2::ZERO, vec2(500.0, 500.0), viewport), vec2(0.0, 0.0));
+}
+
+#[test]
+fn page_size_hint_zone_is_the_bottom_left_quadrant() {
+    let area = Rect::from_min_max(pos2(100.0, 50.0), pos2(500.0, 450.0));
+    assert!(in_size_hint_zone(area, pos2(110.0, 440.0)));
+    assert!(!in_size_hint_zone(area, pos2(110.0, 100.0)), "top-left");
+    assert!(!in_size_hint_zone(area, pos2(400.0, 440.0)), "bottom-right");
+    assert!(!in_size_hint_zone(area, pos2(50.0, 440.0)), "outside");
+    assert!(!in_size_hint_zone(area, pos2(f32::NAN, 440.0)));
+}
+
+use super::*;
+
+#[test]
+fn typed_zoom_percentages_parse() {
+    for (typed, zoom) in [("150", 1.5), ("150%", 1.5), (" 62.5 % ", 0.625), ("6400%", 64.0)] {
+        assert_eq!(DocView::parse_zoom_percent(typed), Some(zoom), "{typed}");
+    }
+    for typed in ["", "%", "abc", "0", "-50", "NaN", "inf", "1e40", "150%%x", "%150"] {
+        assert_eq!(DocView::parse_zoom_percent(typed), None, "{typed}");
+    }
+}
+
+/// A rotated (landscape) page is drawn as wide as the cell allows and centred in the picture
+/// area, as Acrobat draws it, not as a small strip pinned to the top; a portrait page still
+/// fills the area's height; neither covers the checkbox corner or the label below.
+#[test]
+fn grid_pages_are_centred_and_as_large_as_the_cell_allows() {
+    let cell = Rect::from_min_size(pos2(100.0, 50.0), vec2(190.0, 282.0));
+    let area = Rect::from_min_max(pos2(cell.left(), cell.top() + 16.0), pos2(cell.right(), cell.bottom() - 72.0));
+    let checkbox = Rect::from_min_size(cell.min + vec2(8.0, 8.0), Vec2::splat(20.0));
+    let landscape = grid_page_rect(cell, vec2(842.0, 595.0));
+    assert!((landscape.center().y - area.center().y).abs() < 0.01, "centred vertically: {landscape:?}");
+    assert!((landscape.center().x - cell.center().x).abs() < 0.01);
+    assert!((landscape.width() - (cell.width() - 32.0)).abs() < 0.01, "as wide as the cell allows: {landscape:?}");
+    assert!(!landscape.intersects(checkbox));
+    let portrait = grid_page_rect(cell, vec2(595.0, 842.0));
+    assert!(area.contains_rect(portrait), "inside the picture area: {portrait:?}");
+    assert!((portrait.center().y - area.center().y).abs() < 0.01);
+    assert!(portrait.left() >= checkbox.right(), "clear of the checkbox: {portrait:?}");
+    // Degenerate sizes still give a finite rectangle inside the cell.
+    for page in [vec2(0.0, 0.0), vec2(1e9, 1.0), vec2(1.0, 1e9), vec2(f32::NAN, 10.0), vec2(f32::INFINITY, 10.0)] {
+        let r = grid_page_rect(cell, page);
+        assert!(r.is_finite() && cell.contains_rect(r), "{page:?} -> {r:?}");
+    }
+}
+
+fn annotation(fill_sign: bool) -> pdfcraft_render::Annotation {
+    pdfcraft_render::Annotation {
+        page: 0,
+        subtype: "FreeText".into(),
+        author: None,
+        contents: Some("Hello".into()),
+        modified: None,
+        name: None,
+        in_reply_to: None,
+        parent: None,
+        grouped: false,
+        rect: [0.0; 4],
+        color: None,
+        index: 0,
+        state: None,
+        quads: Vec::new(),
+        locked: false,
+        intent: None,
+        fill_sign,
+        no_rotate: false,
+        points: Vec::new(),
+    }
+}
+
+#[test]
+fn hover_popup_skips_fill_and_sign_marks() {
+    assert_eq!(annotation_hover_text(&annotation(false)).as_deref(), Some("FreeText\nHello"));
+    assert_eq!(annotation_hover_text(&annotation(true)), None);
+}
+
+fn signature(signed: bool, visible: bool, page: Option<usize>, rect: Option<[f64; 4]>) -> pdfcraft_engine::SignatureInfo {
+    pdfcraft_engine::SignatureInfo {
+        field: "Signature1".into(),
+        signed,
+        page,
+        rect,
+        visible,
+        signer: None,
+        certificate: None,
+        chain: Vec::new(),
+        date: None,
+        signing_time: None,
+        reason: None,
+        location: None,
+        contact: None,
+        sub_filter: None,
+        doc_timestamp: false,
+        certify: None,
+        revision: 1,
+        signed_len: 0,
+        digest: None,
+        algorithm: None,
+        timestamp: false,
+        timestamp_time: None,
+        status: pdfcraft_engine::SignatureStatus::Valid,
+        modification: pdfcraft_engine::sign::Modification::None,
+        details: Vec::new(),
+    }
+}
+
+#[test]
+fn signature_badges_keep_signed_visible_widgets_on_the_page() {
+    let rect = [10.0, 10.0, 100.0, 50.0];
+    let signatures =
+        vec![signature(true, true, Some(0), Some(rect)), signature(true, true, Some(1), Some(rect)), signature(true, true, Some(0), Some(rect))];
+    let badges = signature_badges(&signatures, 0);
+    assert_eq!(badges.len(), 2);
+    assert_eq!(badges[0].rect, rect);
+}
+
+#[test]
+fn signature_badges_skip_unsigned_invisible_and_unplaced_fields() {
+    let rect = [10.0, 10.0, 100.0, 50.0];
+    let signatures = vec![
+        signature(false, true, Some(0), Some(rect)),
+        signature(true, false, Some(0), Some(rect)),
+        signature(true, true, Some(0), None),
+        signature(true, true, Some(0), Some(rect)),
+    ];
+    let badges = signature_badges(&signatures, 0);
+    assert_eq!(badges.len(), 1);
+    assert_eq!(badges[0].rect, rect);
+}
+
+#[test]
+fn signature_badges_skip_rectangles_that_cannot_reach_the_screen() {
+    let hostile = vec![
+        [f64::NAN, 10.0, 100.0, 50.0],
+        [10.0, f64::INFINITY, 100.0, 50.0],
+        [10.0, 10.0, f64::NEG_INFINITY, 50.0],
+        [10.0, 10.0, 1e300, 50.0],
+        [10.0, 10.0, 100.0, 50.0],
+    ];
+    let signatures: Vec<_> = hostile.into_iter().map(|rect| signature(true, true, Some(0), Some(rect))).collect();
+    let badges = signature_badges(&signatures, 0);
+    assert_eq!(badges.len(), 1);
+}
+
+#[test]
+fn page_zoom_reads_the_side_the_page_width_is_on() {
+    // A 200 x 100 pt page at 2 pixels per point: 400 x 200 on screen, or 200 x 400 turned.
+    let xf = |rot: u16, size: Vec2| PageXform { rect: Rect::from_min_size(Pos2::ZERO, size), rot, pw: 200.0, ph: 100.0 };
+    for rot in [0, 180] {
+        assert_eq!(xf(rot, vec2(400.0, 200.0)).zoom(), 2.0, "{rot}");
+    }
+    for rot in [90, 270] {
+        assert_eq!(xf(rot, vec2(200.0, 400.0)).zoom(), 2.0, "{rot}: the width runs down the screen");
+    }
+}
+
+#[test]
+fn snapshot_tabs_read_like_their_source_plus_the_suffix() {
+    let snap = Snapshot { kind: SnapshotKind::SignedVersion, revision: 1, from: "report.pdf".into() };
+    assert_eq!(snapshot_tab_name("Report", "report.pdf", &snap), "Report (signed version)");
+    let rev = Snapshot { kind: SnapshotKind::Revision, revision: 2, from: "report.pdf".into() };
+    assert_eq!(snapshot_tab_name("Report", "report.pdf", &rev), "Report (revision 2)");
+    assert_eq!(snapshot_tab_name("report.pdf", "report.pdf", &snap), "report.pdf");
+    assert_eq!(snapshot_tab_name("report (revision 2).pdf", "report (revision 2).pdf", &rev), "report (revision 2).pdf");
+}
+
+#[test]
+fn grayscale_converts_colours_to_their_luminance() {
+    let img = egui::ColorImage::new([2, 1], vec![Color32::from_rgb(255, 0, 0), Color32::from_rgba_premultiplied(0, 51, 102, 128)]);
+    let gray = grayscale(img);
+    let opaque = gray.pixels[0];
+    assert_eq!(opaque.to_array(), [76, 76, 76, 255]);
+    // Unmultiply RGB first, so a translucent colour keeps its paper-relative luminance.
+    let translucent = gray.pixels[1];
+    assert_eq!(translucent.to_array(), [42, 42, 42, 128]);
+}
+
+#[test]
+fn black_white_and_transparents_are_preserved_by_grayscale() {
+    let img = egui::ColorImage::new([3, 1], vec![Color32::BLACK, Color32::WHITE, Color32::TRANSPARENT]);
+    let gray = grayscale(img);
+    assert_eq!(gray.pixels[0].to_array(), [0, 0, 0, 255]);
+    assert_eq!(gray.pixels[1].to_array(), [255, 255, 255, 255]);
+    assert_eq!(gray.pixels[2].to_array(), [0, 0, 0, 0]);
+}
+
+#[test]
+fn rendered_rasters_become_texture_images_without_a_copy() {
+    let pdf = b"%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Contents 4 0 R >> endobj
+4 0 obj << /Length 35 >> stream
+0 0 1 rg 10 10 30 20 re f
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut r = pdfcraft_render::PageRenderer::new(Arc::new(pdf.to_vec()), Default::default());
+    let out = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.5, tag: 0, preview: false });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    let size = [out.width as usize, out.height as usize];
+    let copied = egui::ColorImage::from_rgba_premultiplied(size, &out.rgba);
+    let at = out.rgba.as_ptr();
+    let img = texture_image(size, out.rgba);
+    assert_eq!(img, copied);
+    assert_eq!(img.pixels.as_ptr().cast::<u8>(), at, "the renderer's own buffer");
+}
+
+#[test]
+fn tiles_stay_granular_up_close_and_cover_giant_sheets_in_a_handful() {
+    // Ordinary zooms keep 1024 px tiles; degenerate scales fall back to it, never zero.
+    assert_eq!(tile_side(1.0, 2000), TILE);
+    assert_eq!(tile_side(4.0, 2000), TILE);
+    assert_eq!(tile_side(f32::NAN, 2000), TILE);
+    assert_eq!(tile_side(f32::INFINITY, 2000), TILE);
+    assert_eq!(tile_side(0.0, 2000), TILE);
+    // Zoomed viewports need a few large tiles instead of many small ones.
+    assert_eq!(tile_side(12.0, 2000), 2048);
+    assert_eq!(tile_side(20.0, 2000), 3413);
+    assert_eq!(tile_side(100.0, 2000), 4096);
+    // A giant sheet at fit width (6740 px long side) is covered four tiles a side.
+    assert_eq!(tile_side(96.0 / 72.0, 6740), 1685);
+    // The backend clamps tile sides at 4096.
+    assert_eq!(tile_side(20.0, 100_000), 4096);
+}
+
+#[test]
+fn grid_zoom_is_clamped_and_sharp_renders_tolerate_a_pinch() {
+    assert!(sharp_enough(900, 876.0) && sharp_enough(800, 876.0) && sharp_enough(1300, 876.0));
+    assert!(!sharp_enough(264, 876.0), "a thumbnail stretched over a zoomed page");
+    assert!(!sharp_enough(876, 200.0), "far larger than drawn: wasteful");
+    assert!(!sharp_enough(100, 0.0) && !sharp_enough(100, f32::NAN));
+    let mut v = view(3, PageLayout::Single, true);
+    for odd in [f32::NAN, f32::INFINITY] {
+        v.set_grid_zoom(odd);
+        assert_eq!(v.grid_zoom(), 1.0);
+    }
+    v.set_grid_zoom(99.0);
+    assert_eq!(v.grid_zoom(), 3.0);
+    v.set_grid_zoom(-4.0);
+    assert_eq!(v.grid_zoom(), 0.5);
+}
+
+fn view(pages: usize, layout: PageLayout, continuous: bool) -> DocView {
+    let info = pdfcraft_render::DocInfo {
+        pages: (0..pages)
+            .map(|_| pdfcraft_render::PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 })
+            .collect(),
+        ..Default::default()
+    };
+    DocView::new(DocId(1), &info, ViewDefaults { layout, continuous, ..Default::default() })
+}
+
+fn history_search_view() -> DocView {
+    let mut v = view(5, PageLayout::Single, true);
+    v.texts.insert(
+        3,
+        pdfcraft_render::PageText {
+            glyphs: vec![pdfcraft_render::TextGlyph {
+                text: "match".into(),
+                rect: [20.0, 260.0, 60.0, 280.0],
+                quad: [[20.0, 260.0], [60.0, 260.0], [60.0, 280.0], [20.0, 280.0]],
+                direction: [1.0, 0.0],
+            }],
+            line_of: vec![0],
+            space_before: vec![false],
+        }
+        .into(),
+    );
+    v.find = Some(Find { matches: vec![(3, 0..1), (3, 0..1), (1, 0..1)], current: Some(2), ..Default::default() });
+    v
+}
+
+#[test]
+fn explicit_search_jumps_record_history_and_keep_match_destination() {
+    for step in [None, Some(true), Some(false)] {
+        let mut v = history_search_view();
+        v.page_input = "draft in progress".into();
+        v.goto_point = Some((3, Some(0.8), Some(0.9), Vec2::ZERO));
+        if let Some(forward) = step {
+            v.find_step(forward);
+        } else {
+            v.go_to_match(0);
+        }
+        assert_eq!(v.back, vec![0], "explicit search jump must remember its origin");
+        assert_eq!(v.goto, Some((3, 0.5)), "keep the match offset instead of the page top");
+        assert_eq!(v.current, 3);
+        assert_eq!(v.current_page_label(None), "4");
+        // Chrome refreshes the idle page box; navigation must not overwrite a draft
+        // that may still be focused. DocView does not own the editor's focus state.
+        assert_eq!(v.page_input, "draft in progress");
+        assert!(v.goto_point.is_none(), "an earlier link destination cannot override the search offset");
+        v.go_to_match(1);
+        assert_eq!(v.back, vec![0], "same-page matches do not duplicate history");
+        assert!(v.view_history(false));
+        assert_eq!(v.current, 0);
+        assert!(v.view_history(true));
+        assert_eq!(v.current, 3);
+        assert!(v.view_history(false));
+        v.go_to_match(2);
+        assert!(v.forward.is_empty(), "a new explicit jump discards Forward");
+        assert_eq!(v.back, vec![0]);
+    }
+}
+
+#[test]
+fn automatic_search_updates_do_not_record_history_or_discard_forward() {
+    let mut v = history_search_view();
+    v.forward = vec![4];
+    v.find = Some(Find { query: "match".into(), ..Default::default() });
+    v.rerun_find();
+    assert_eq!(v.current, 3);
+    assert_eq!(v.goto, Some((3, 0.5)));
+    assert!(v.back.is_empty());
+    assert_eq!(v.forward, vec![4]);
+    v.find.as_mut().unwrap().current = None;
+    v.texts.insert(1, Arc::new(find_test_text("match")));
+    v.refresh_find_page(1);
+    assert_eq!(v.current, 1, "an automatic late match still follows its anchor");
+    assert!(v.back.is_empty(), "automatic search updates do not record history");
+    assert_eq!(v.forward, vec![4]);
+}
+
+/// One glyph per character on one line, for the search-order tests below.
+fn find_test_text(s: &str) -> PageText {
+    PageText {
+        glyphs: s
+            .chars()
+            .map(|c| pdfcraft_render::TextGlyph { text: c.into(), rect: [0.0, 0.0, 10.0, 10.0], quad: [[0.0, 0.0]; 4], direction: [1.0, 0.0] })
+            .collect(),
+        line_of: s.chars().map(|_| 0).collect(),
+        space_before: s.chars().map(|_| false).collect(),
+    }
+}
+
+/// A text-layer result for `page`, for the search tests below.
+fn find_text_result(page: usize, text: &str) -> pdfcraft_render::RenderedPage {
+    pdfcraft_render::RenderedPage {
+        request: RenderRequest { page, kind: RequestKind::Text, tag: TEXT_TAG, ..Default::default() },
+        width: 0,
+        height: 0,
+        rgba: Default::default(),
+        error: None,
+        text: Some(Arc::new(find_test_text(text))),
+        warnings: Vec::new(),
+        millis: 0,
+    }
+}
+
+/// Text layers arrive in whatever order the workers finish, not in page order. A search
+/// started on page 1 must settle on page 1's match even when page 2's text arrives first,
+/// instead of keeping the later match picked only because page 1 had not been read yet.
+#[test]
+fn automatic_search_match_follows_the_viewed_page_when_text_arrives_out_of_order() {
+    let mut v = view(2, PageLayout::Single, true);
+    v.current = 0;
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    assert_eq!(v.find.as_ref().unwrap().current, None, "no text yet, so no match");
+
+    let ctx = egui::Context::default();
+    let request = |page| RenderRequest { page, kind: RequestKind::Text, tag: TEXT_TAG, ..Default::default() };
+    let result = |page, text: &str| pdfcraft_render::RenderedPage {
+        request: request(page),
+        width: 0,
+        height: 0,
+        rgba: Default::default(),
+        error: None,
+        text: Some(Arc::new(find_test_text(text))),
+        warnings: Vec::new(),
+        millis: 0,
+    };
+    v.last_queue = vec![request(1), request(0)];
+    // Page 2's text finishes first, as it can when the workers race.
+    v.receive_result(&ctx, result(1, "Second page sample text"));
+    assert_eq!(v.find.as_ref().unwrap().current, Some(0), "the only known match is picked while page 1 is pending");
+
+    v.receive_result(&ctx, result(0, "Panel sample draft notes"));
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(f.matches.iter().map(|(p, _)| *p).collect::<Vec<_>>(), vec![0, 1]);
+    assert_eq!(f.current, Some(0), "page 1's match takes over once its text arrives");
+    assert_eq!(v.current, 0, "the view follows the first match at or after the page being viewed");
+}
+
+/// A match the user picked (a click in the Search panel, or ⌘G) is not moved by a text
+/// layer that arrives later: only automatic choices follow the viewed page.
+#[test]
+fn a_user_picked_search_match_stays_put_when_earlier_text_arrives() {
+    let mut v = view(2, PageLayout::Single, true);
+    v.current = 0;
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    v.texts.insert(1, Arc::new(find_test_text("Second page sample text")));
+    v.refresh_find_page(1);
+    v.go_to_match(0);
+    assert_eq!(v.find.as_ref().unwrap().auto_from, None, "an explicit choice is not automatic");
+
+    v.texts.insert(0, Arc::new(find_test_text("Panel sample draft notes")));
+    v.refresh_find_page(0);
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(f.matches.iter().map(|(p, _)| *p).collect::<Vec<_>>(), vec![0, 1]);
+    assert_eq!(f.current, Some(1), "the picked match keeps its identity after page 1 is inserted");
+    assert_eq!(v.current, 1, "the user's page does not change under them");
+}
+
+/// The automatic choice may move the view only while the reader has left it where that
+/// choice put it. Navigating by the page box/Pages panel/outline or by view history is the
+/// reader's decision: a text layer arriving afterwards must not pull them back to an
+/// anchor-derived match. (The harness covers same-page wheel and pointer scrolling.)
+#[test]
+fn a_late_automatic_match_does_not_override_the_readers_navigation() {
+    enum Nav {
+        Page,
+        History,
+    }
+    for nav in [Nav::Page, Nav::History] {
+        let mut v = view(3, PageLayout::Single, true);
+        v.current = 0;
+        v.texts.insert(2, Arc::new(find_test_text("Second page sample")));
+        v.find = Some(Find { query: "sample".into(), ..Default::default() });
+        v.rerun_find();
+        assert_eq!((v.current, v.find.as_ref().unwrap().auto_page), (2, Some(2)), "the automatic match was shown");
+        match nav {
+            // The page box, the Pages panel and outline destinations all end here.
+            Nav::Page => v.go_to_page(1),
+            // View ▸ Page navigation ▸ Previous view writes `current` directly.
+            Nav::History => {
+                v.back = vec![1];
+                assert!(v.view_history(false));
+            }
+        }
+        assert_eq!(v.current, 1);
+        v.texts.insert(0, Arc::new(find_test_text("First page sample")));
+        v.refresh_find_page(0);
+        let f = v.find.as_ref().unwrap();
+        assert_eq!(f.auto_from, None, "the reader's navigation ends automatic following");
+        assert_eq!(f.auto_page, None);
+        assert_eq!(v.current, 1, "a late match cannot pull the reader back");
+    }
+}
+
+/// Typing on while the results arrive must not re-anchor the search on a page the automatic
+/// flash picked. The anchor stays the page the reader was on when they started searching.
+#[test]
+fn refining_the_query_keeps_the_page_the_search_started_from() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 0;
+    v.texts.insert(2, Arc::new(find_test_text("Second page sample text")));
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    assert_eq!((v.current, v.find.as_ref().unwrap().auto_from), (2, Some(0)), "the first query's match scrolled the view");
+
+    // Page 1 has a match for the refined query, and so has page 3. Anchored on the page the
+    // automatic flash reached, the search would pick page 3; the starting page picks page 1.
+    v.texts.insert(0, Arc::new(find_test_text("Panel draft text")));
+    v.find.as_mut().unwrap().query = "text".into();
+    v.rerun_find();
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(f.auto_from, Some(0), "refinement keeps the page the reader searched from");
+    assert_eq!(f.matches.first().map(|(p, _)| *p), Some(0));
+    assert_eq!(f.current, Some(0));
+    assert_eq!(v.current, 0);
+}
+
+/// ⌘G / Ctrl+G goes through `find_step`, an explicit choice like a Search-panel click: a
+/// text layer arriving later must not undo it.
+#[test]
+fn keyboard_find_step_is_explicit_and_a_late_text_layer_cannot_undo_it() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 0;
+    v.texts.insert(1, Arc::new(find_test_text("first sample")));
+    v.texts.insert(2, Arc::new(find_test_text("second sample")));
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    assert_eq!((v.current, v.find.as_ref().unwrap().auto_from), (1, Some(0)));
+
+    let ctx = egui::Context::default();
+    ctx.input_mut(|i| {
+        i.events.push(egui::Event::Key { key: egui::Key::G, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    });
+    shortcuts(&mut v, &ctx, Default::default());
+
+    assert_eq!(v.current, 2, "the keyboard step chose the next match");
+    assert_eq!(v.find.as_ref().unwrap().auto_from, None, "the keyboard step is the user's choice");
+    assert_eq!(v.back, vec![1], "an explicit search jump records its origin");
+
+    v.texts.insert(0, Arc::new(find_test_text("intro sample")));
+    v.refresh_find_page(0);
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(v.current, 2, "the chosen match keeps the view");
+    assert_eq!(f.current.and_then(|i| f.matches.get(i)).map(|(p, _)| *p), Some(2));
+}
+
+/// A page whose text extraction failed keeps the automatic anchor: the failure selects the
+/// next match without moving the view, and a later text layer can still follow the anchor.
+#[test]
+fn a_failed_text_layer_keeps_the_automatic_anchor_without_jitter() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 0;
+    v.texts.insert(1, Arc::new(find_test_text("first sample")));
+    v.texts.insert(2, Arc::new(find_test_text("second sample")));
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    assert_eq!((v.current, v.find.as_ref().unwrap().auto_page), (1, Some(1)));
+
+    let goto = v.goto;
+    let ctx = egui::Context::default();
+    let request = RenderRequest { page: 1, kind: RequestKind::Text, ..Default::default() };
+    v.last_queue = vec![request];
+    v.receive_result(
+        &ctx,
+        pdfcraft_render::RenderedPage {
+            request,
+            width: 0,
+            height: 0,
+            rgba: Default::default(),
+            error: Some("extraction failed".into()),
+            text: None,
+            warnings: Vec::new(),
+            millis: 0,
+        },
+    );
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(f.matches.iter().map(|(p, _)| *p).collect::<Vec<_>>(), vec![2]);
+    assert_eq!(f.current, Some(0), "the remaining match is selected");
+    assert_eq!((f.auto_from, f.auto_page), (Some(0), Some(1)), "a failure does not end automatic following");
+    assert_eq!(v.current, 1, "a failure never moves the view");
+    assert_eq!(v.goto, goto, "a failure never flashes the match");
+
+    // The search still follows its original page when that page's text arrives.
+    v.last_queue = vec![RenderRequest { page: 0, kind: RequestKind::Text, tag: TEXT_TAG, ..Default::default() }];
+    v.receive_result(&ctx, find_text_result(0, "intro sample"));
+    assert_eq!(v.current, 0, "the anchor's earlier match takes over");
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(f.current.and_then(|i| f.matches.get(i)).map(|(p, _)| *p), Some(0));
+}
+
+/// A reader who navigated before a page's text failed is not pulled back by a later
+/// matching layer: the failure path must preserve the same `Ended` state as a successful
+/// one, and the result list may select the late match without revealing it.
+#[test]
+fn a_failed_text_layer_after_navigation_does_not_reveal_a_late_match() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 0;
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    v.go_to_page(2);
+    let moved = v.goto;
+    assert!(v.find.as_ref().unwrap().follow_ended, "the reader navigated before any match arrived");
+
+    let ctx = egui::Context::default();
+    let failed = RenderRequest { page: 1, kind: RequestKind::Text, tag: TEXT_TAG, ..Default::default() };
+    v.last_queue = vec![failed];
+    v.receive_result(
+        &ctx,
+        pdfcraft_render::RenderedPage {
+            request: failed,
+            width: 0,
+            height: 0,
+            rgba: Default::default(),
+            error: Some("extraction failed".into()),
+            text: None,
+            warnings: Vec::new(),
+            millis: 0,
+        },
+    );
+    let f = v.find.as_ref().unwrap();
+    assert!(f.follow_ended, "a failure after navigation does not restart following");
+    assert_eq!((f.auto_from, f.auto_page), (None, None));
+    assert_eq!(v.current, 2, "a failure never moves the view");
+    assert_eq!(v.goto, moved);
+
+    let arrived = RenderRequest { page: 0, kind: RequestKind::Text, tag: TEXT_TAG, ..Default::default() };
+    v.last_queue = vec![arrived];
+    v.receive_result(&ctx, find_text_result(0, "intro sample"));
+    let f = v.find.as_ref().unwrap();
+    assert!(f.follow_ended);
+    assert_eq!((f.auto_from, f.auto_page), (None, None));
+    assert_eq!(v.current, 2, "the late matching layer does not pull the reader back");
+    assert_eq!(v.goto, moved, "no flash was issued");
+    assert_eq!(f.current.and_then(|i| f.matches.get(i)).map(|(p, _)| *p), Some(0), "the result list still selects the late match");
+}
+
+/// The reader can navigate before any text layer has supplied a match. That navigation
+/// still ends automatic following, so the first late match is listed but not revealed by
+/// a flash that would pull the reader back.
+#[test]
+fn navigation_before_the_first_match_is_not_overridden_by_a_late_text_layer() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 0;
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(f.current, None, "no text layer has arrived yet");
+    assert_eq!((f.auto_from, f.auto_page), (Some(0), Some(0)));
+
+    v.go_to_page(2);
+    assert_eq!(v.goto, Some((2, 0.0)), "the reader moved to page 3");
+    assert!(v.find.as_ref().unwrap().follow_ended, "moving the view ends automatic following");
+
+    let ctx = egui::Context::default();
+    let request = RenderRequest { page: 1, kind: RequestKind::Text, tag: TEXT_TAG, ..Default::default() };
+    v.last_queue = vec![request];
+    v.receive_result(&ctx, find_text_result(1, "late sample"));
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(v.current, 2, "the late first match does not pull the reader back");
+    assert_eq!(v.goto, Some((2, 0.0)), "no flash was issued");
+    assert_eq!((f.auto_from, f.auto_page), (None, None));
+    assert_eq!(f.current.and_then(|i| f.matches.get(i)).map(|(p, _)| *p), Some(1), "the result list still selects the match");
+}
+
+/// A page-box jump to the page already shown is still the reader's navigation: automatic
+/// following must end, so a late earlier match is listed without moving the view. (The
+/// harness covers wheel, scrollbar and pointer scrolling through the production paint path.)
+#[test]
+fn a_same_page_page_box_jump_ends_automatic_following() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 0;
+    v.texts.insert(1, Arc::new(find_test_text("first sample")));
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    assert_eq!((v.current, v.find.as_ref().unwrap().auto_page), (1, Some(1)), "the automatic choice is on page 2");
+
+    // Choosing the page already shown still ends following; it stays on page 2 at its top.
+    v.go_to_page(1);
+    let shown = v.goto;
+    assert_eq!(shown, Some((1, 0.0)));
+
+    v.texts.insert(0, Arc::new(find_test_text("intro sample")));
+    v.refresh_find_page(0);
+    let f = v.find.as_ref().unwrap();
+    assert!(f.follow_ended);
+    assert_eq!((f.auto_from, f.auto_page), (None, None));
+    assert_eq!(v.current, 1, "the late earlier match does not move the reader within the page");
+    assert_eq!(v.goto, shown, "no flash was issued");
+    assert_eq!(f.current.and_then(|i| f.matches.get(i)).map(|(p, _)| *p), Some(1), "the page-2 match stays selected");
+}
+
+/// A document-wide invalidation (a layer toggle, an edit, undo/redo) clears results for
+/// re-extraction but is not the reader navigating. Automatic following keeps its anchor so
+/// the re-extracted layers still reveal the automatic choice; a reader who already took
+/// over stays in control. If `document_changed` clamps the view away from that anchor, the
+/// next layer ends following instead of revealing a match from the stale page.
+#[test]
+fn content_invalidation_keeps_the_following_state() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 0;
+    v.texts.insert(1, Arc::new(find_test_text("first sample")));
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    assert_eq!((v.current, v.find.as_ref().unwrap().auto_page), (1, Some(1)), "the automatic choice is on page 2");
+
+    v.invalidate_content();
+    let f = v.find.as_ref().unwrap();
+    assert!(f.matches.is_empty() && f.current.is_none(), "results wait for the re-extracted text");
+    assert!(!f.follow_ended, "a content change is not reader navigation");
+    assert_eq!((f.auto_from, f.auto_page), (Some(0), Some(1)));
+
+    // Re-extracted text still follows the page the search started from.
+    let ctx = egui::Context::default();
+    let request = RenderRequest { page: 0, kind: RequestKind::Text, tag: TEXT_TAG, ..Default::default() };
+    v.last_queue = vec![request];
+    v.receive_result(&ctx, find_text_result(0, "intro sample"));
+    assert_eq!(v.current, 0, "the re-extracted match is revealed by the still-active search");
+    let f = v.find.as_ref().unwrap();
+    assert!(!f.follow_ended);
+    assert_eq!((f.auto_from, f.auto_page), (Some(0), Some(0)));
+
+    // A reader who navigated first keeps the view they chose across the invalidation.
+    v.go_to_page(2);
+    let moved = v.goto;
+    assert!(v.find.as_ref().unwrap().follow_ended);
+    v.invalidate_content();
+    let f = v.find.as_ref().unwrap();
+    assert!(f.follow_ended);
+    assert_eq!((f.auto_from, f.auto_page), (None, None));
+    v.last_queue = vec![request];
+    v.receive_result(&ctx, find_text_result(0, "late sample"));
+    assert_eq!(v.current, 2, "no delayed reveal after the reader navigated");
+    assert_eq!(v.goto, moved, "no flash was issued");
+    let f = v.find.as_ref().unwrap();
+    assert_eq!(f.current.and_then(|i| f.matches.get(i)).map(|(p, _)| *p), Some(0), "the result list still selects the late match");
+}
+
+/// A document edit can shrink the page count. `document_changed` clamps `current` but leaves
+/// the automatic anchor's page index alone; a re-extracted layer must then end following
+/// rather than reveal a match by scrolling from a page that no longer exists.
+#[test]
+fn a_page_count_shrink_ends_following_before_a_late_reveal() {
+    let mut v = view(5, PageLayout::Single, true);
+    v.current = 0;
+    v.texts.insert(4, Arc::new(find_test_text("last sample")));
+    v.find = Some(Find { query: "sample".into(), ..Default::default() });
+    v.rerun_find();
+    assert_eq!((v.current, v.find.as_ref().unwrap().auto_page), (4, Some(4)), "the automatic choice is on the last page");
+
+    let info = pdfcraft_render::DocInfo {
+        pages: (0..2)
+            .map(|_| pdfcraft_render::PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 })
+            .collect(),
+        ..Default::default()
+    };
+    v.document_changed(&info);
+    assert_eq!(v.current, 1, "the view clamps to the last remaining page");
+    let f = v.find.as_ref().unwrap();
+    assert!(!f.follow_ended, "the content change itself keeps the automatic state");
+    assert_eq!((f.auto_from, f.auto_page), (Some(0), Some(4)), "the anchor still names the removed page");
+    let goto = v.goto;
+
+    let ctx = egui::Context::default();
+    let request = RenderRequest { page: 0, kind: RequestKind::Text, tag: TEXT_TAG, ..Default::default() };
+    v.last_queue = vec![request];
+    v.receive_result(&ctx, find_text_result(0, "intro sample"));
+    let f = v.find.as_ref().unwrap();
+    assert!(f.follow_ended, "a layer for the remaining pages ends the stale follow");
+    assert_eq!((f.auto_from, f.auto_page), (None, None));
+    assert_eq!(v.current, 1, "the late layer cannot pull the view back");
+    assert_eq!(v.goto, goto, "no flash was issued");
+    assert_eq!(f.current.and_then(|i| f.matches.get(i)).map(|(p, _)| *p), Some(0), "the result list still selects the match");
+}
+
+/// Typing refinements while text layers keep arriving must keep the page the search began
+/// on, not re-anchor on whichever page an earlier automatic flash happened to show.
+#[test]
+fn rapid_query_edits_interleaved_with_text_results_keep_the_start_anchor() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 0;
+    v.find = Some(Find { query: "sam".into(), ..Default::default() });
+    v.rerun_find();
+    assert!(v.find.as_ref().unwrap().current.is_none());
+
+    let edits = [("samp", 2, "Page three sample", 2), ("sampl", 1, "Page two sample", 1), ("sample", 0, "Page one sample", 0)];
+    for (query, page, text, shown) in edits {
+        v.find.as_mut().unwrap().query = query.into();
+        v.rerun_find();
+        let f = v.find.as_ref().unwrap();
+        assert_eq!(f.auto_from, Some(0), "refinement keeps the page the reader started from");
+        assert!(!f.follow_ended);
+        v.texts.insert(page, Arc::new(find_test_text(text)));
+        v.refresh_find_page(page);
+        let f = v.find.as_ref().unwrap();
+        assert_eq!(v.current, shown, "the late page follows the automatic anchor {shown}");
+        assert_eq!((f.auto_from, f.auto_page), (Some(0), Some(shown)));
+        assert!(!f.follow_ended, "the automatic flash itself does not end following");
+    }
+    assert!(v.back.is_empty(), "automatic search updates do not record history");
+}
+
+#[test]
+fn text_layers_evict_far_pages_but_keep_visible_and_matches() {
+    let info = thumbnail_info(100);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    v.current = 50;
+    v.frame_visible = HashSet::from([50, 51]);
+    for p in 0..100 {
+        v.texts.insert(p, Arc::new(PageText::default()));
+    }
+    v.text_failed.insert(0);
+    v.text_failed.insert(99);
+    v.find = Some(Find { matches: vec![(0, 0..1)], ..Default::default() });
+    let _ = v.prepare_render_queue(&info, 1.0);
+    assert!(v.texts.contains_key(&50) && v.texts.contains_key(&51), "visible pages stay");
+    assert!(v.texts.contains_key(&0), "matched pages stay");
+    assert!(v.texts.contains_key(&49), "nearest prefetch window stays");
+    assert!(!v.texts.contains_key(&99), "far pages go");
+    assert_eq!(v.texts.len(), 2 + 1 + MAX_CACHED_TEXT_PAGES, "visible + matched + prefetch window");
+    assert!(v.text_failed.contains(&0) && v.text_failed.contains(&99), "failures are bytes-free: never evict");
+}
+
+/// A PDF of one line of text on each page, `lines[i]` on page `i`.
+fn text_pages_pdf(lines: &[&str]) -> Vec<u8> {
+    let n = lines.len();
+    // 1 catalog, 2 pages, 3 font, then a page and its content stream for each line.
+    let mut objects = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        format!("<< /Type /Pages /Count {n} /Kids [{}] >>", (0..n).map(|i| format!("{} 0 R", 4 + 2 * i)).collect::<Vec<_>>().join(" ")),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_string(),
+    ];
+    for (i, line) in lines.iter().enumerate() {
+        let content = format!("BT /F1 18 Tf 72 700 Td ({line}) Tj ET");
+        objects.push(format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 3 0 R >> >> /Contents {} 0 R >>",
+            5 + 2 * i
+        ));
+        objects.push(format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend(format!("{} 0 obj\n{o}\nendobj\n", i + 1).bytes());
+    }
+    let xref = out.len();
+    out.extend(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).bytes());
+    for o in offsets {
+        out.extend(format!("{o:010} 00000 n \n").bytes());
+    }
+    out.extend(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).bytes());
+    out
+}
+
+/// #2639: scrolling continuously, Select All takes every page's text, and Copy gets all of it
+/// in page order, reading the pages whose text wasn't read for display.
+#[test]
+fn select_all_copies_the_whole_document_while_scrolling_continuously() {
+    let mut app = PdfCraftApp::new();
+    app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
+    let v = &mut app.views[0];
+    assert!(v.continuous, "continuous scrolling is the default");
+    assert!(v.texts.is_empty(), "no page's text read yet");
+    // Nothing shown is selected yet (false, as for a page whose text isn't read), but the whole
+    // document is: Copy reads every page.
+    assert!(!v.select_all());
+    assert!(v.all_text && v.selection.is_none());
+    assert_eq!(v.pages_without_text(), vec![0, 1, 2]);
+    // Copy reads the pages off the UI thread; the clipboard gets the text once they're read.
+    let ctx = egui::Context::default();
+    assert!(app.copy_selected_text(0, &ctx), "the copy starts");
+    assert!(app.document_copy.is_some(), "reading the pages, not on this thread");
+    let mut text = None;
+    for _ in 0..500 {
+        let mut out = ctx.run_ui(egui::RawInput::default(), |ui| app.finish_document_copy(ui.ctx()));
+        out.textures_delta.clear();
+        text = out.platform_output.commands.iter().find_map(|c| match c {
+            egui::OutputCommand::CopyText(t) => Some(t.clone()),
+            _ => None,
+        });
+        if text.is_some() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    let text = text.expect("the copied text arrives");
+    assert!(app.document_copy.is_none(), "done");
+    let at = |w: &str| text.find(w).unwrap_or_else(|| panic!("{w:?} missing from {text:?}"));
+    assert!(at("Alpha") < at("Bravo") && at("Bravo") < at("Charlie"), "page order: {text:?}");
+    assert_eq!(text.lines().count(), 3, "a line per page: {text:?}");
+    // A new scope ends it: one page at a time, Select All is the page's again.
+    app.views[0].set_continuous(false);
+    assert!(!app.views[0].all_text, "not after switching to one page at a time");
+    // So do a page selection and a change of the document's content (an edit, undo).
+    app.views[0].set_continuous(true);
+    app.views[0].select_all();
+    app.views[0].select_text(0, 0, 0);
+    assert!(!app.views[0].all_text, "a page selection replaces it");
+    app.views[0].select_all();
+    app.views[0].invalidate_content();
+    assert!(!app.views[0].all_text, "not past an edit of the document");
+}
+
+/// A whole-document copy reads the pages without text, keeps those already read and skips
+/// those that failed before.
+#[test]
+fn a_document_copy_reads_only_the_pages_it_needs() {
+    let mut app = PdfCraftApp::new();
+    app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
+    app.views[0].text_failed.insert(2);
+    let job = crate::DocumentCopyJob::of(&app.views[0], app.session.get(app.views[0].id).unwrap());
+    let kinds: Vec<_> = job.pages.iter().map(|p| matches!(p, crate::CopyPage::ToRead)).collect();
+    assert_eq!(kinds, vec![true, true, false], "pages 1 and 2 to read, page 3 failed before");
+    assert!(matches!(job.pages[2], crate::CopyPage::Skip));
+}
+
+/// A later copy wins: a whole-document copy still reading its pages never replaces what was
+/// copied after it started, from the page or anywhere else (a text field, a comment).
+#[test]
+fn a_later_copy_cancels_a_document_copy_still_reading() {
+    let mut app = PdfCraftApp::new();
+    app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
+    let ctx = egui::Context::default();
+    // Another copy in the same frame (here a text field's) drops it.
+    app.views[0].select_all();
+    assert!(app.copy_selected_text(0, &ctx) && app.document_copy.is_some());
+    let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
+        ui.ctx().copy_text("a word".to_owned());
+        app.finish_document_copy(ui.ctx());
+    });
+    out.textures_delta.clear();
+    assert!(app.document_copy.is_none(), "cancelled");
+    let copies: Vec<_> = out.platform_output.commands.iter().filter(|c| matches!(c, egui::OutputCommand::CopyText(_))).collect();
+    assert_eq!(copies, vec![&egui::OutputCommand::CopyText("a word".to_owned())], "the later copy stays");
+    // So does copying a page selection.
+    app.views[0].select_all();
+    assert!(app.copy_selected_text(0, &ctx) && app.document_copy.is_some());
+    app.views[0].select_text(0, 0, 5);
+    app.copy_selected_text(0, &ctx);
+    assert!(app.document_copy.is_none(), "a page selection's copy cancels it");
+}
+
+/// A press anywhere on a page ends Select All of the document, whatever the tool (here the
+/// Hand, which selects no text) and whether the page's text is read yet.
+#[test]
+fn a_press_on_a_page_ends_select_all_of_the_document() {
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
+        app
+    });
+    let mut on_screen = None;
+    for _ in 0..600 {
+        h.run_steps(2);
+        on_screen = h.state().views[0].page_screen_rect(0);
+        if on_screen.is_some() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let r = on_screen.expect("the first page is on screen");
+    h.state_mut().quick_tool = crate::QuickTool::Hand;
+    h.state_mut().views[0].select_all();
+    assert!(h.state().views[0].all_text);
+    let at = r.center();
+    h.event(egui::Event::PointerMoved(at));
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+    assert!(!h.state().views[0].all_text, "a press on the page ends it");
+
+    // A press while a dialog is up lands on the dialog, not the page: the selection stays.
+    h.state_mut().views[0].select_all();
+    h.state_mut().dialog = Some(crate::Dialog::JsConsole);
+    h.run_steps(2);
+    h.event(egui::Event::PointerMoved(at));
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+    assert!(h.state().views[0].all_text, "a press beneath a dialog doesn't end it");
+}
+
+/// The pages of a whole-document copy come out in order whatever was read before, and a
+/// cancelled copy gives nothing (a new copy or a closed document cancels the old one).
+#[test]
+fn a_document_copy_reads_in_page_order_and_stops_when_cancelled() {
+    let mut app = PdfCraftApp::new();
+    app.open_bytes("three.pdf", None, text_pages_pdf(&["Alpha one", "Bravo two", "Charlie three"])).unwrap();
+    // The middle page's text read for display already; the others read by the copy.
+    let doc = app.session.get(app.views[0].id).unwrap();
+    let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), Default::default());
+    let middle = r.render(RenderRequest { page: 1, kind: RequestKind::Text, ..Default::default() }).text.unwrap();
+    app.views[0].texts.insert(1, middle);
+    let job = || crate::DocumentCopyJob::of(&app.views[0], app.session.get(app.views[0].id).unwrap());
+    let text = job().text(&std::sync::atomic::AtomicBool::new(false)).unwrap();
+    assert!(text.find("Alpha").unwrap() < text.find("Bravo").unwrap() && text.find("Bravo").unwrap() < text.find("Charlie").unwrap(), "{text:?}");
+    assert_eq!(job().text(&std::sync::atomic::AtomicBool::new(true)), None, "cancelled");
+}
+
+/// Select All keeps to the page shown one page at a time, and in a document of one page; of
+/// the document, it reads the text already read and doesn't ask again for failed pages.
+#[test]
+fn select_all_of_the_document_only_while_scrolling_through_several_pages() {
+    let info = thumbnail_info(3);
+    let one_line = |s: &str| PageText {
+        glyphs: s
+            .chars()
+            .map(|c| pdfcraft_render::TextGlyph { text: c.into(), rect: [0.0, 0.0, 10.0, 10.0], quad: [[0.0, 0.0]; 4], direction: [1.0, 0.0] })
+            .collect(),
+        line_of: s.chars().map(|_| 0).collect(),
+        space_before: s.chars().map(|_| false).collect(),
+    };
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    for p in 0..3 {
+        v.texts.insert(p, Arc::new(one_line("abc")));
+    }
+    v.continuous = false;
+    v.current = 1;
+    assert!(v.select_all());
+    assert!(!v.all_text && v.selection.is_some_and(|s| s.page == 1), "one page at a time: the page shown");
+    let single = thumbnail_info(1);
+    let mut w = DocView::new(DocId(2), &single, ViewDefaults::default());
+    w.texts.insert(0, Arc::new(one_line("abc")));
+    assert!(w.select_all());
+    assert!(!w.all_text && w.selection.is_some(), "a one-page document: that page");
+    // Text read for display is used; pages that failed aren't asked for again.
+    let mut d = DocView::new(DocId(3), &info, ViewDefaults::default());
+    d.texts.insert(1, Arc::new(one_line("abc")));
+    d.text_failed.insert(2);
+    assert!(d.select_all() && d.all_text);
+    assert_eq!(d.pages_without_text(), vec![0]);
+}
+
+#[test]
+fn text_layers_keep_the_selection_page() {
+    let info = thumbnail_info(100);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    let text = PageText {
+        glyphs: vec![pdfcraft_render::TextGlyph { text: "x".into(), rect: [0.0, 0.0, 10.0, 10.0], quad: [[0.0, 0.0]; 4], direction: [1.0, 0.0] }],
+        line_of: vec![0],
+        space_before: vec![false],
+    };
+    for p in 0..100 {
+        v.texts.insert(p, Arc::new(text.clone()));
+    }
+    v.select_text(0, 0, 0);
+    v.current = 90;
+    v.frame_visible = HashSet::from([90, 91]);
+    let _ = v.prepare_render_queue(&info, 1.0);
+    assert_eq!(v.selected_text().as_deref(), Some("x"), "stale selections still copy");
+}
+
+#[test]
+fn text_layers_stay_while_a_search_is_active() {
+    let info = thumbnail_info(100);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    v.current = 50;
+    v.frame_visible = HashSet::from([50]);
+    for p in 0..100 {
+        v.texts.insert(p, Arc::new(PageText::default()));
+    }
+    v.find = Some(Find { query: "dup".into(), case_query: "dup".into(), matches: vec![(0, 0..1)], ..Default::default() });
+    let _ = v.prepare_render_queue(&info, 1.0);
+    assert_eq!(v.texts.len(), 100, "evicting mid-search would churn the workers");
+}
+
+fn thumbnail_info(count: usize) -> DocInfo {
+    DocInfo {
+        pages: (0..count)
+            .map(|i| {
+                let (width, height) = match i % 3 {
+                    0 => (612.0, 792.0),
+                    1 => (200.0, 4000.0),
+                    _ => (4000.0, 200.0),
+                };
+                pdfcraft_render::PageInfo { width, height, label: (i + 1).to_string(), crop: [0.0, 0.0, width, height], rotation: 0 }
+            })
+            .collect(),
+        ..Default::default()
+    }
+}
+
+#[test]
+fn ten_thousand_pages_only_demand_viewport_and_prefetch_at_both_densities() {
+    let info = thumbnail_info(10_000);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    let cols = 4;
+    let rows = info.pages.len().div_ceil(cols);
+    for ppp in [1.0, 2.0] {
+        for row in [0, 1234, rows - 1] {
+            v.begin_render_frame();
+            let range = thumbnail_rows(row as f32 * 250.0, row as f32 * 250.0 + 750.0, 250.0, rows);
+            for p in range.start * cols..(range.end * cols).min(info.pages.len()) {
+                v.need_thumbnail(p, p / cols == row);
+            }
+            let queue = v.prepare_render_queue(&info, ppp);
+            assert!(queue.len() <= 5 * cols, "only three visible rows and two prefetch rows");
+            assert_eq!(queue.first().unwrap().page / cols, row, "visible cells precede prefetch");
+            let bytes: usize = queue
+                .iter()
+                .map(|r| {
+                    let p = &info.pages[r.page];
+                    let (w, h) = (device_pixels(p.width, r.scale), device_pixels(p.height, r.scale));
+                    assert!(w <= (THUMB_W * ppp).ceil() as u32);
+                    assert!(h <= (THUMB_H * ppp).ceil() as u32);
+                    rgba_bytes(w as usize, h as usize)
+                })
+                .sum();
+            assert!(bytes <= THUMB_BYTES);
+            assert_eq!(queue, v.prepare_render_queue(&info, ppp), "unchanged demand reconstructs the same work");
+        }
+    }
+}
+
+#[test]
+fn oversized_thumbnail_viewport_scales_all_admitted_cells_to_one_budget() {
+    let info = thumbnail_info(10_000);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    for page in 0..MAX_THUMB_DEMAND {
+        v.need_thumbnail(page, true);
+    }
+    let queue = v.prepare_render_queue(&info, 2.0);
+    assert_eq!(queue.len(), MAX_THUMB_DEMAND);
+    let bytes: usize = queue
+        .iter()
+        .map(|r| {
+            let p = &info.pages[r.page];
+            rgba_bytes(device_pixels(p.width, r.scale) as usize, device_pixels(p.height, r.scale) as usize)
+        })
+        .sum();
+    assert!(bytes <= THUMB_BYTES);
+}
+
+fn solid_result(request: RenderRequest, w: u32, h: u32) -> pdfcraft_render::RenderedPage {
+    pdfcraft_render::RenderedPage {
+        request,
+        width: w,
+        height: h,
+        rgba: pdfcraft_render::Pixels::from(vec![u32::MAX; rgba_bytes(w as usize, h as usize) / 4]),
+        text: None,
+        error: None,
+        warnings: Vec::new(),
+        millis: 0,
+    }
+}
+
+/// #3149: the replacement dialog commits after the canvas collected this frame's demand.
+#[test]
+fn replacing_a_page_after_layout_never_uploads_an_oversized_texture() {
+    let ctx = egui::Context::default();
+    ctx.input_mut(|i| i.max_texture_side = 2048);
+    let mut app = PdfCraftApp::new();
+    let original = app.session.create_blank(200.0, 300.0, 1).unwrap();
+    let replacement = app.session.create_blank(400.0, 500.0, 1).unwrap();
+    app.open_bytes("original.pdf", None, original.as_ref().clone()).unwrap();
+    let request = RenderRequest { scale: 4.7, tag: scale_tag(4.7), ..Default::default() };
+    app.views[0].frame_queue = vec![request];
+    app.views[0].frame_visible.insert(0);
+    assert!(app.apply_edit(Edit::ReplacePages { pages: vec![0], name: "replacement.pdf".into(), bytes: replacement, src_pages: vec![0] }));
+    let doc = app.session.get(app.views[0].id).unwrap();
+    assert_eq!((doc.info.pages[0].width, doc.info.pages[0].height), (400.0, 500.0));
+    let edited_bytes = doc.bytes.clone();
+    let pool = RenderPool::new_inline(doc.display.clone(), Default::default());
+    app.views[0].finish_render_frame(&ctx, &doc.info, &pool);
+    assert!(app.views[0].last_queue.is_empty(), "old geometry must not reach the replacement renderer");
+
+    // The next layout can render a bounded backdrop and sharp tiles at the same zoom.
+    let backdrop = RenderRequest { scale: 2048.0 / 500.0, tag: scale_tag(2048.0 / 500.0), ..request };
+    let tile = RenderRequest { tile: Some(Tile { x: 0, y: 0, w: 1024, h: 1024 }), ..request };
+    for _ in 0..2 {
+        let view = &mut app.views[0];
+        view.begin_render_frame();
+        view.frame_visible.insert(0);
+        view.frame_queue = vec![backdrop, tile];
+        view.finish_render_frame(&ctx, &doc.info, &pool);
+    }
+    let view = &app.views[0];
+    assert_eq!(view.pages.get(&0).unwrap().tex.size(), [1639, 2048]);
+    assert_eq!(view.tiles.get(&(0, tile.tag, 0, 0)).unwrap().size(), [1024, 1024]);
+    assert!(view.errors.is_empty());
+    assert_eq!(doc.bytes, edited_bytes, "rendering preserves the unsaved edit");
+    assert!(doc.dirty);
+    assert_eq!(doc.can_undo(), Some("Replace page"));
+}
+
+#[test]
+fn oversized_raster_results_do_not_replace_cached_textures() {
+    let ctx = egui::Context::default();
+    ctx.input_mut(|i| i.max_texture_side = 64);
+    for request in [
+        RenderRequest::default(),
+        RenderRequest { tag: THUMB_TAG, ..Default::default() },
+        RenderRequest { tag: GRID_TAG, ..Default::default() },
+        RenderRequest { tag: PRINT_TAG, ..Default::default() },
+        RenderRequest { tile: Some(Tile { x: 0, y: 0, w: 64, h: 32 }), ..Default::default() },
+    ] {
+        let mut view = DocView::new(DocId(1), &thumbnail_info(1), ViewDefaults::default());
+        view.last_queue = vec![request];
+        let texture = |v: &DocView| {
+            v.pages
+                .values()
+                .map(|p| &p.tex)
+                .chain(v.thumbs.values().map(|p| &p.tex))
+                .chain(v.grid_pages.values().map(|(_, t)| t))
+                .chain(v.print_pages.values().map(|(_, t)| t))
+                .chain(v.tiles.values())
+                .map(|t| (t.id(), t.size()))
+                .collect::<Vec<_>>()
+        };
+        assert_eq!(view.receive_result(&ctx, solid_result(request, 64, 32)), 64 * 32 * 4);
+        let cached = texture(&view);
+        assert_eq!(cached.len(), 1);
+        for (w, h) in [(65, 32), (32, 65), (65, 65), (0, 32), (32, 0)] {
+            assert_eq!(view.receive_result(&ctx, solid_result(request, w, h)), 0, "{request:?}: {w}x{h}");
+            assert_eq!(texture(&view), cached, "an invalid result must keep the previous raster");
+        }
+        assert_eq!(view.receive_result(&ctx, solid_result(request, 32, 64)), 32 * 64 * 4);
+        assert_eq!(texture(&view)[0].1, [32, 64], "valid results still make progress");
+    }
+}
+
+/// A print preview carries the renderer's print bit; the bit that asks for luminance is
+/// its own, so a colour preview is not converted to monochrome and the two modes are told
+/// apart by their tags.
+#[test]
+fn print_preview_tag_distinguishes_grayscale_from_colour() {
+    let mut v = view(1, PageLayout::Single, true);
+    v.set_print_grayscale(false);
+    v.queue_print_previews(&[(0, 1.0)]);
+    let colour = v.frame_queue.last().expect("a print preview was queued").tag;
+    assert_ne!(colour & PRINT_TAG, 0, "a print preview carries the renderer's print bit");
+    assert_eq!(colour & GRAYSCALE_TAG, 0, "a colour print preview must not ask for luminance");
+
+    v.set_print_grayscale(true);
+    v.queue_print_previews(&[(0, 1.0)]);
+    let gray = v.frame_queue.last().expect("a grayscale print preview was queued").tag;
+    assert_ne!(gray & GRAYSCALE_TAG, 0, "a grayscale print preview asks for luminance");
+    assert_ne!(gray, colour, "the two print preview modes must not share a tag");
+}
+
+#[test]
+fn thumbnails_release_on_scroll_panel_close_and_request_again_after_eviction() {
+    let ctx = egui::Context::default();
+    let info = thumbnail_info(10_000);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    v.need_thumbnail(0, true);
+    let first = v.prepare_render_queue(&info, 1.0);
+    v.last_queue = first.clone();
+    assert_eq!(v.receive_result(&ctx, solid_result(first[0], 132, 171)), 132 * 171 * 4);
+    assert!(v.prepare_render_queue(&info, 1.0).is_empty());
+    v.begin_render_frame();
+    v.need_thumbnail(9999, true);
+    v.prepare_render_queue(&info, 1.0);
+    assert!(v.thumbs.is_empty(), "jump releases old handles");
+    v.begin_render_frame();
+    v.need_thumbnail(0, true);
+    assert_eq!(v.prepare_render_queue(&info, 1.0), first, "an evicted result must be requested again");
+    v.begin_render_frame();
+    assert!(v.prepare_render_queue(&info, 1.0).is_empty(), "closing consumers cancels thumbnail work");
+}
+
+#[test]
+fn stale_results_are_rejected_before_conversion_after_dpi_invalidation_and_suspend() {
+    let ctx = egui::Context::default();
+    let info = thumbnail_info(1);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    v.need_thumbnail(0, true);
+    let first = v.prepare_render_queue(&info, 1.0)[0];
+    v.last_queue = v.prepare_render_queue(&info, 2.0);
+    // Valid pixels: only the request gate can keep these out (a size check can't).
+    let obsolete = || solid_result(first, 132, 171);
+    assert_eq!(v.receive_result(&ctx, obsolete()), 0);
+    assert!(v.thumbs.is_empty(), "a result for the old DPI is not uploaded");
+    // The same result is uploaded while its request is current.
+    v.last_queue = vec![first];
+    assert_eq!(v.receive_result(&ctx, obsolete()), 132 * 171 * 4);
+    v.thumbs.clear();
+    v.invalidate_content();
+    assert_eq!(v.receive_result(&ctx, obsolete()), 0);
+    assert!(v.thumbs.is_empty(), "nor after the content changed");
+    let pool = RenderPool::new_inline(Arc::new(Vec::new()), Default::default());
+    v.last_queue = vec![first];
+    v.suspend_rendering(&pool);
+    assert_eq!(v.receive_result(&ctx, obsolete()), 0);
+    assert!(v.thumbs.is_empty(), "nor after the tab was suspended");
+}
+
+#[test]
+fn editing_after_layout_preserves_stale_page_until_replacement() {
+    let ctx = egui::Context::default();
+    let info = thumbnail_info(1);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    let req = RenderRequest { scale: 1.0, tag: 1000, ..Default::default() };
+    v.last_queue = vec![req];
+    v.receive_result(&ctx, solid_result(req, 10, 10));
+    v.frame_queue = vec![req];
+    v.page_changed(0);
+    assert_eq!(v.prepare_render_queue(&info, 1.0), vec![req]);
+    assert_eq!(v.pages.get(&0).unwrap().tag, STALE_TAG);
+}
+
+/// #1858: a released drawing stays painted from its points until a raster that has it
+/// arrives. A page raster that lands before the drawing's edit is applied (in full screen the
+/// edit waits for the next frame, and a render already under way can finish first) is of the
+/// document without it, and must not end the preview.
+#[test]
+fn a_raster_from_before_a_drawing_is_committed_keeps_it_drawn() {
+    let ctx = egui::Context::default();
+    let info = thumbnail_info(1);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    let req = RenderRequest { scale: 1.0, tag: 1000, ..Default::default() };
+    v.comments.settle(0.0, 0, crate::comments::CommentTool::Ink, &[[10.0, 10.0], [40.0, 30.0]]);
+    v.last_queue = vec![req];
+    assert!(v.receive_result(&ctx, solid_result(req, 10, 10)) > 0, "the raster is taken");
+    assert_eq!(v.comments.settling_len(), 1, "a raster from before the commit doesn't have the stroke");
+    v.comments.drawings_committed();
+    v.last_queue = vec![req];
+    assert!(v.receive_result(&ctx, solid_result(req, 10, 10)) > 0);
+    assert_eq!(v.comments.settling_len(), 0, "a raster after the commit draws it");
+    // An edit that fails leaves nothing to wait for.
+    v.comments.settle(0.0, 0, crate::comments::CommentTool::Ink, &[[10.0, 10.0], [40.0, 30.0]]);
+    v.comments.drawings_refused();
+    assert_eq!(v.comments.settling_len(), 0, "a refused drawing isn't left painted");
+}
+
+#[test]
+fn page_and_tile_admission_accounts_for_bytes_before_count_limits() {
+    let mut info = thumbnail_info(40);
+    for p in &mut info.pages {
+        p.width = 4000.0;
+        p.height = 4000.0;
+    }
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    v.frame_queue = (0..40).map(|page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() }).collect();
+    let queue = v.prepare_render_queue(&info, 1.0);
+    assert_eq!(queue.len(), 2, "128 MiB admits two 4000-square pages, not 24");
+    v.frame_queue = (0..40)
+        .map(|page| RenderRequest { page, scale: 1.0, tag: 1000, tile: Some(Tile { x: 0, y: 0, w: 1024, h: 1024 }), ..Default::default() })
+        .collect();
+    assert_eq!(v.prepare_render_queue(&info, 1.0).len(), 32);
+    assert!(!v.admit_texture(RenderRequest::default(), PAGE_BYTES + 1));
+}
+
+#[test]
+fn on_screen_pages_and_tiles_are_admitted_beyond_the_prefetch_allowance() {
+    let ctx = egui::Context::default();
+    let mut info = thumbnail_info(40);
+    for p in &mut info.pages {
+        p.width = 2000.0;
+        p.height = 2000.0;
+    }
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    // Ten 16 MB pages on screen (a zoomed-out HiDPI view) exceed the 128 MiB allowance.
+    v.frame_visible = (0..10).collect();
+    v.frame_queue = (0..40).map(|page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() }).collect();
+    let queue = v.prepare_render_queue(&info, 1.0);
+    let pages: Vec<usize> = queue.iter().map(|r| r.page).collect();
+    assert_eq!(pages, (0..10).collect::<Vec<_>>(), "every on-screen page, and no prefetch past the allowance");
+    v.last_queue = queue.clone();
+    for req in &queue {
+        assert!(v.receive_result(&ctx, solid_result(*req, 2000, 2000)) > 0, "on-screen page {} uploaded", req.page);
+    }
+    assert_eq!(v.pages.len(), 10, "none evicted another on-screen page");
+    // A 5K viewport needs more 1024-pixel tiles than the tile allowance holds.
+    v.frame_queue = (0..40)
+        .map(|x| RenderRequest { page: 0, scale: 1.0, tag: 1000, tile: Some(Tile { x: x * TILE, y: 0, w: 1024, h: 1024 }), ..Default::default() })
+        .collect();
+    assert_eq!(v.prepare_render_queue(&info, 1.0).len(), 40);
+}
+
+#[test]
+fn a_page_turned_back_to_is_still_cached() {
+    let ctx = egui::Context::default();
+    let info = thumbnail_info(10);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    let req = |page| RenderRequest { page, scale: 1.0, tag: 1000, ..Default::default() };
+    v.frame_visible = [0].into();
+    v.frame_queue = vec![req(0)];
+    v.last_queue = v.prepare_render_queue(&info, 1.0);
+    v.receive_result(&ctx, solid_result(req(0), 100, 130));
+    // Single-page view moves on to page 1: page 0 is no longer demanded.
+    v.begin_render_frame();
+    v.current = 1;
+    v.frame_visible = [1].into();
+    v.frame_queue = vec![req(1)];
+    assert_eq!(v.prepare_render_queue(&info, 1.0), vec![req(1)]);
+    assert!(v.pages.contains_key(&0), "kept while the allowance has room");
+    // And back: nothing to render.
+    v.begin_render_frame();
+    v.current = 0;
+    v.frame_visible = [0].into();
+    v.frame_queue = vec![req(0)];
+    assert!(v.prepare_render_queue(&info, 1.0).is_empty());
+}
+
+#[test]
+fn visible_pages_render_before_thumbnails_and_text() {
+    let ctx = egui::Context::default();
+    let info = thumbnail_info(4);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    let main = RenderRequest { page: 0, scale: 1.0, tag: 1000, ..Default::default() };
+    let text = RenderRequest { page: 0, kind: RequestKind::Text, scale: 1.0, tag: TEXT_TAG, ..Default::default() };
+    // Opening page 0 queues its pixels and text alongside Pages-panel thumbnails.
+    v.begin_render_frame();
+    v.frame_visible = [0].into();
+    v.frame_queue = vec![main, text];
+    for p in 1..4 {
+        v.need_thumbnail(p, true);
+    }
+    let queue = v.prepare_render_queue(&info, 1.0);
+    assert_eq!(queue, vec![main], "visible pixels first: no thumbnails or text yet");
+    // Once the visible raster arrives, background work is admitted.
+    v.last_queue = queue;
+    assert!(v.receive_result(&ctx, solid_result(main, 100, 130)) > 0);
+    v.begin_render_frame();
+    v.frame_visible = [0].into();
+    v.frame_queue = vec![text];
+    for p in 1..4 {
+        v.need_thumbnail(p, true);
+    }
+    let queue = v.prepare_render_queue(&info, 1.0);
+    assert!(queue.iter().any(|r| r.kind == RequestKind::Text), "text admitted after pixels");
+    assert!(queue.iter().any(|r| r.tag & THUMB_TAG != 0), "thumbnails admitted after pixels");
+    assert!(!queue.iter().any(|r| r.kind == RequestKind::Pixels && r.tag & THUMB_TAG == 0), "no main pixels re-requested");
+    // An errored visible page never holds background work back.
+    v.errors.insert(0, "gone".to_string());
+    v.begin_render_frame();
+    v.frame_visible = [0].into();
+    v.frame_queue = vec![main, text];
+    for p in 1..4 {
+        v.need_thumbnail(p, true);
+    }
+    let queue = v.prepare_render_queue(&info, 1.0);
+    assert!(queue.iter().any(|r| r.kind == RequestKind::Text), "text admitted despite the error");
+    assert!(queue.iter().any(|r| r.tag & THUMB_TAG != 0), "thumbnails still admitted");
+}
+
+#[test]
+fn thumbnail_tags_do_not_change_as_a_row_scrolls_in_or_out() {
+    let info = thumbnail_info(10_000);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    let tags = |v: &mut DocView, cells: usize| {
+        v.begin_render_frame();
+        for page in 0..cells {
+            v.need_thumbnail(page, true);
+        }
+        v.thumbnail_requests(&info, 2.0).into_iter().map(|r| (r.page, r.tag)).collect::<HashMap<_, _>>()
+    };
+    // 2x on a large screen: about 70 cells, give or take a row of six.
+    let (a, b) = (tags(&mut v, 70), tags(&mut v, 76));
+    assert!((0..70).all(|p| a[&p] == b[&p]), "a row more or less re-renders nothing");
+}
+
+#[test]
+fn many_open_documents_share_one_raster_allowance_and_close_releases_handles() {
+    let ctx = egui::Context::default();
+    let mut app = PdfCraftApp::new();
+    let bytes = app.session.create_blank(612.0, 792.0, 1).unwrap();
+    let mut expected = Vec::new();
+    for index in 0..6 {
+        app.open_bytes(&format!("synthetic-{index}.pdf"), None, bytes.as_ref().clone()).unwrap();
+        let info = app.session.get(app.views.last().unwrap().id).unwrap().info.clone();
+        let view = app.views.last_mut().unwrap();
+        view.begin_render_frame();
+        view.need_thumbnail(0, true);
+        let request = view.thumbnail_requests(&info, ctx.pixels_per_point()).into_iter().next().unwrap();
+        let page = info.pages.get(request.page).unwrap();
+        let dimensions = (device_pixels(page.width, request.scale), device_pixels(page.height, request.scale));
+        view.last_queue = vec![request];
+        assert_eq!(
+            view.receive_result(&ctx, solid_result(request, dimensions.0, dimensions.1)),
+            rgba_bytes(dimensions.0 as usize, dimensions.1 as usize)
+        );
+        assert_eq!(view.thumbs.get(&0).unwrap().tag, request.tag);
+        assert_eq!(view.thumbs.get(&0).unwrap().tex.size(), [dimensions.0 as usize, dimensions.1 as usize]);
+
+        view.begin_render_frame();
+        view.need_thumbnail(0, true);
+        let queue = view.prepare_render_queue(&info, ctx.pixels_per_point());
+        assert!(queue.is_empty(), "the synthetic thumbnail satisfies current demand");
+        view.last_queue = queue;
+        expected.push((request, dimensions));
+    }
+    assert_eq!(app.views.len(), 6, "all six documents were opened");
+    assert_eq!(app.active_ids().map(|(index, _)| index), Some(5));
+    assert!(app.views.iter().zip(&expected).all(|(view, (request, dimensions))| {
+        view.thumbs.len() == 1
+            && view.thumbs.get(&0).is_some_and(|thumb| thumb.tag == request.tag && thumb.tex.size() == [dimensions.0 as usize, dimensions.1 as usize])
+    }));
+
+    app.finish_render_frame(&ctx);
+    let total: usize = app.views.iter().map(|v| v.thumbs.values().map(|p| texture_bytes(&p.tex)).sum::<usize>()).sum();
+    let (active_request, active_dimensions) = expected.last().unwrap();
+    let active_bytes = rgba_bytes(active_dimensions.0 as usize, active_dimensions.1 as usize);
+    assert_eq!(total, active_bytes, "only the active view retains a thumbnail");
+    assert!(total <= THUMB_BYTES, "retained thumbnails stay within the existing allowance");
+    assert!(app.views.iter().take(5).all(|v| v.thumbs.is_empty() && v.last_queue.is_empty()));
+    let active = app.views.last().unwrap();
+    assert_eq!(active.thumbs.len(), 1);
+    assert_eq!(active.thumbs.get(&0).unwrap().tag, active_request.tag);
+    assert!(active.last_queue.is_empty(), "the current thumbnail is already cached");
+    for view in &app.views {
+        let doc = app.session.get(view.id).unwrap();
+        assert_eq!(doc.renderer.stats().render_requests, 0, "the fixture must not launch a native render");
+    }
+
+    app.close_tab(5);
+    assert_eq!(app.views.len(), 5, "closing the active tab drops its owning view");
+    assert!(app.views.iter().all(|v| v.thumbs.is_empty()));
+}
+
+#[test]
+fn suspended_signature_preview_releases_layers_and_rebuilds_without_editing() {
+    let ctx = egui::Context::default();
+    let mut png = std::io::Cursor::new(Vec::new());
+    image::RgbaImage::from_pixel(12, 4, image::Rgba([20, 30, 40, 255])).write_to(&mut png, image::ImageFormat::Png).unwrap();
+    let image = pdfcraft_engine::SignatureImage::from_bytes(png.get_ref()).unwrap();
+    let mut session = pdfcraft_engine::Session::new();
+    let blank = session.create_blank(300.0, 400.0, 1).unwrap();
+    let id = session.open_new("signature-preview.pdf", blank).unwrap();
+    let info = session.get(id).unwrap().info.pages[0].clone();
+    session.apply(id, image.edit(0, &info, [20.0, 100.0], false, "Test").unwrap()).unwrap();
+    let doc = session.get(id).unwrap();
+    let bytes = doc.bytes.clone();
+    let generation = doc.edit_generation();
+    let mut v = DocView::new(id, &doc.info, ViewDefaults::default());
+    v.comments.selected = Some((0, 0));
+    v.signature_drag.prepare(&ctx, doc, v.comments.selected, 1.0);
+    assert!(v.signature_drag.contains(0, 0));
+
+    v.suspend_rendering(&doc.renderer);
+    assert!(!v.signature_drag.contains(0, 0), "inactive tabs release the preview pool and textures");
+    assert_eq!(v.comments.selected, Some((0, 0)), "the user's selection survives suspension");
+    v.signature_drag.prepare(&ctx, doc, v.comments.selected, 1.0);
+    assert!(v.signature_drag.contains(0, 0), "reactivating the view rebuilds the selected image's preview");
+    assert!(Arc::ptr_eq(&bytes, &doc.bytes));
+    assert_eq!(doc.edit_generation(), generation);
+    assert_eq!(doc.can_undo(), Some("Add signature"));
+    assert!(doc.dirty);
+}
+
+#[test]
+fn suspending_a_view_releases_owned_raster_textures_and_queue_state() {
+    let ctx = egui::Context::default();
+    let mut view = view(2, PageLayout::Single, true);
+    let texture = |name| ctx.load_texture(name, egui::ColorImage::filled([1, 1], Color32::WHITE), TextureOptions::LINEAR);
+    let request = RenderRequest { page: 0, scale: 1.0, tag: 1, ..Default::default() };
+    view.pages.insert(0, PageTex { tag: request.tag, tex: texture("suspended-page") });
+    view.thumbs.insert(1, PageTex { tag: THUMB_TAG, tex: texture("suspended-thumbnail") });
+    view.tiles.insert((0, request.tag, 0, 0), texture("suspended-tile"));
+    view.grid_pages.insert(1, (1, texture("suspended-grid-page")));
+    view.print_pages.insert(1, (PRINT_TAG, texture("suspended-print-page")));
+    view.stale_thumbs.insert(1);
+    view.waiting_since.insert(0, 1.0);
+    view.last_queue = vec![request];
+    view.frame_queue = vec![request];
+    view.frame_visible.insert(0);
+    view.need_thumbnail(1, true);
+
+    let pool = RenderPool::new_inline(Arc::new(Vec::new()), Default::default());
+    view.suspend_rendering(&pool);
+
+    assert!(view.pages.is_empty(), "page handles are released");
+    assert!(view.thumbs.is_empty(), "thumbnail handles are released");
+    assert!(view.tiles.is_empty(), "tile handles are released");
+    assert!(view.grid_pages.is_empty(), "organize-grid handles are released");
+    assert!(view.print_pages.is_empty(), "print-preview handles are released");
+    assert!(view.stale_thumbs.is_empty(), "stale thumbnail bookkeeping is cleared");
+    assert!(view.waiting_since.is_empty(), "waiting bookkeeping is cleared");
+    assert!(view.last_queue.is_empty() && !view.render_pending(), "queued demand is retired");
+    assert!(view.frame_queue.is_empty() && view.frame_visible.is_empty() && view.thumb_demand.is_empty());
+}
+
+/// Edit text & images keeps its boxes while page input is blocked (the window unfocused, a
+/// dialog or the palette open): the page's paragraphs are still measured for the latest edit
+/// and drawn, instead of vanishing until the pointer comes back.
+#[test]
+fn edit_text_boxes_stay_drawn_while_page_input_is_blocked() {
+    let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        let bytes = app.session.create_blank(300.0, 400.0, 1).unwrap();
+        app.open_bytes("blank.pdf", None, bytes.as_ref().clone()).unwrap();
+        app.quick_tool = QuickTool::EditText;
+        app
+    });
+    h.run_steps(3);
+    // Block page input the way the window losing focus does.
+    h.state_mut().palette_open = true;
+    h.run_steps(2);
+    assert!(h.state_mut().apply_edit(Edit::RotatePages { pages: vec![0], degrees: 90 }));
+    h.run_steps(3);
+    let app = h.state();
+    let generation = app.session.get(app.views[0].id).unwrap().edit_generation();
+    assert_eq!(app.views[0].edit_lines.get(&0).map(|(g, _)| *g), Some(generation), "the boxes follow the edit while input is blocked");
+}
+
+#[test]
+fn virtualized_organizer_keeps_insert_gaps_at_document_positions() {
+    use egui_kittest::kittest::Queryable;
+
+    let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        let bytes = app.session.create_blank(300.0, 400.0, 100).unwrap();
+        app.open_bytes("organize-gaps.pdf", None, bytes.as_ref().clone()).unwrap();
+        app.views[0].organize = true;
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state().views[0].thumb_demand.len() < 50);
+    assert_eq!(h.query_all_by_label("Insert a file at the end").count(), 0, "the last virtualized cell is not the final page");
+    let center = h.state().views[0].viewport_rect().center();
+    h.hover_at(center);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, -100_000.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    // Well past egui's longest scroll animation (about 0.3 s).
+    h.run_steps(40);
+    h.get_by_label("Insert a file at the end");
+    let before_last = h.get_by_label("Insert a file before page 100").rect().center();
+    h.hover_at(before_last);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].grid_gap, Some(99), "external drops use the document index after virtualized scrolling");
+    assert!(h.state().views[0].thumb_demand.len() < 50);
+}
+
+#[test]
+fn real_shell_pages_organizer_and_print_only_collect_current_thumbnail_consumers() {
+    let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        let bytes = app.session.create_blank(612.0, 792.0, 10_000).unwrap();
+        app.open_bytes("synthetic-ten-thousand.pdf", None, bytes.as_ref().clone()).unwrap();
+        app.right = Some(RightPanel::Pages);
+        app
+    });
+    h.run_steps(4);
+    assert!((1..20).contains(&h.state().views[0].thumb_demand.len()));
+    h.state_mut().right = None;
+    h.state_mut().views[0].organize = true;
+    h.run_steps(2);
+    assert!((1..50).contains(&h.state().views[0].thumb_demand.len()));
+    h.state_mut().views[0].organize = false;
+    h.state_mut().dialog = Some(crate::Dialog::Print);
+    h.state_mut().print_draft.sheet = 9999;
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].thumb_demand.keys().copied().collect::<Vec<_>>(), vec![9999]);
+    h.state_mut().print_draft.handling = crate::PrintHandling::Booklet;
+    h.state_mut().print_draft.sheet = 0;
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].thumb_demand.len(), 2, "booklet only needs its two placed pages");
+    h.state_mut().dialog = None;
+    h.run_steps(2);
+    assert!(h.state().views[0].thumb_demand.is_empty());
+    assert!(h.state().views[0].thumbs.is_empty());
+}
+
+/// One mouse-wheel notch (a line) at `at` seconds.
+fn notch(v: &mut DocView, dy: f32, at: f64) -> bool {
+    v.single_page_wheel(egui::MouseWheelUnit::Line, dy, egui::TouchPhase::Move, at, true)
+}
+
+#[test]
+fn thumbnails_cover_the_panel_on_a_high_dpi_screen() {
+    // Pages panel slot is at most 150 logical points. At 2 px/pt a letter page's thumbnail
+    // must be at least that wide, so the panel samples it down instead of stretching it.
+    let info = thumbnail_info(1);
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    v.need_thumbnail(0, true);
+    let queue = v.prepare_render_queue(&info, 2.0);
+    let scale = queue.first().expect("one thumbnail").scale;
+    assert!(612.0 * scale >= 150.0 * 2.0, "{scale}");
+}
+
+#[test]
+fn notches_turn_pages_and_stop_at_the_ends() {
+    let mut v = view(3, PageLayout::Single, false);
+    assert!(notch(&mut v, -1.0, 1.0) && notch(&mut v, -1.0, 1.05));
+    assert_eq!(v.current, 2);
+    assert!(!notch(&mut v, -1.0, 1.1), "nothing turns past the last page");
+    assert!(notch(&mut v, 1.0, 1.2));
+    assert_eq!(v.current, 1);
+}
+
+#[test]
+fn notches_turn_two_page_spreads() {
+    // Two-page view, shown one spread at a time (not continuous): a notch turns a whole
+    // spread at once, not a single page (#752).
+    let mut v = view(4, PageLayout::TwoUp, false);
+    assert!(notch(&mut v, -1.0, 1.0));
+    assert_eq!(v.current, 2, "a notch turns from the first spread to the second");
+    assert!(notch(&mut v, 1.0, 1.1));
+    assert_eq!(v.current, 0, "a notch back turns to the previous spread");
+}
+
+#[test]
+fn continuous_views_ignore_the_wheel_for_paging() {
+    // Scrolling views let the ScrollArea handle the wheel; it never turns pages.
+    for layout in [PageLayout::Single, PageLayout::TwoUp] {
+        let mut v = view(3, layout, true);
+        assert!(!notch(&mut v, -1.0, 1.0), "{layout:?} continuous ignores the wheel");
+        assert_eq!(v.current, 0);
+    }
+}
+
+#[test]
+fn navigation_drops_partial_wheel_motion() {
+    use egui::{MouseWheelUnit::Point, TouchPhase::Move, TouchPhase::Start};
+    let mut v = view(3, PageLayout::Single, false);
+    assert!(!v.single_page_wheel(Point, 0.0, Start, 1.0, true));
+    assert!(!v.single_page_wheel(Point, -30.0, Move, 1.02, true));
+    v.go_to_page(1);
+    // The same touch has to move a full notch's worth again before it turns.
+    assert!(!v.single_page_wheel(Point, -30.0, Move, 1.04, true));
+    assert!(v.single_page_wheel(Point, -30.0, Move, 1.06, true));
+    assert_eq!(v.current, 2);
+}
+
+#[test]
+fn reselecting_the_layout_does_not_scroll_to_top() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.goto = None;
+    v.set_layout(PageLayout::Single);
+    assert!(v.goto.is_none(), "re-selecting the current layout is a no-op");
+    v.set_continuous(true);
+    assert!(v.goto.is_none(), "re-selecting the current continuity is a no-op");
+    v.set_layout(PageLayout::TwoUp);
+    assert_eq!(v.goto, Some((0, 0.0)), "switching the base layout aligns the current page");
+    v.goto = None;
+    v.set_continuous(false);
+    assert_eq!(v.goto, Some((0, 0.0)), "toggling continuous scrolling aligns the current page");
+}
+
+#[test]
+fn fit_page_and_height_hold_still_while_mixed_page_sizes_scroll_past() {
+    let page =
+        |width: f32, height: f32| pdfcraft_render::PageInfo { width, height, label: String::new(), crop: [0.0, 0.0, width, height], rotation: 0 };
+    let info = DocInfo { pages: vec![page(300.0, 400.0), page(600.0, 800.0)], ..Default::default() };
+    for fit in [Fit::Page, Fit::Height] {
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        (v.fit, v.viewport_w, v.viewport_h) = (fit, 1000.0, 800.0);
+        v.fit_zoom(&info);
+        let zoom = v.zoom;
+        v.current = 1;
+        v.fit_zoom(&info);
+        assert_eq!(v.zoom, zoom, "{fit:?}: scrolling onto a bigger page keeps the zoom");
+        // A single page shown on its own (not scrolling) fits each one.
+        (v.layout, v.continuous) = (PageLayout::Single, false);
+        v.fit_zoom(&info);
+        let big = v.zoom;
+        v.current = 0;
+        v.fit_zoom(&info);
+        assert!(v.zoom > big, "{fit:?}: single-page view fits the page it shows");
+    }
+}
+
+/// Review on #2070: full screen in two-page view fits the spread it shows, the cover page
+/// on its own included; two-page view in the window keeps one zoom for the document.
+#[test]
+fn full_screen_two_page_view_fits_the_spread_it_shows() {
+    let page =
+        |width: f32, height: f32| pdfcraft_render::PageInfo { width, height, label: String::new(), crop: [0.0, 0.0, width, height], rotation: 0 };
+    // Spreads [0, 1] small, [2, 3] large; with a cover page [0], [1, 2] mixed, [3].
+    let info = DocInfo { pages: vec![page(300.0, 400.0), page(300.0, 400.0), page(600.0, 800.0), page(600.0, 800.0)], ..Default::default() };
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    (v.layout, v.continuous, v.viewport_w, v.viewport_h) = (PageLayout::TwoUp, false, 1000.0, 800.0);
+    v.fit = Fit::Page;
+    v.fit_zoom(&info);
+    let windowed = v.zoom;
+    v.enter_presentation();
+    v.fit_zoom(&info);
+    let small = v.zoom;
+    assert!(small > windowed * 1.9, "the small spread fills the screen: {small} vs {windowed}");
+    v.current = 3;
+    v.fit_zoom(&info);
+    assert!((v.zoom - windowed).abs() < 1e-4, "the large spread fits as before");
+    v.current = 1;
+    v.fit_zoom(&info);
+    assert_eq!(v.zoom, small, "page 2 is in the first spread");
+    // With a cover page: [0] alone, then [1, 2] (the large page decides), then [3].
+    v.cover = true;
+    v.current = 0;
+    v.fit_zoom(&info);
+    assert_eq!(v.zoom, small, "the cover page alone");
+    v.current = 1;
+    v.fit_zoom(&info);
+    assert!((v.zoom - windowed).abs() < 1e-4, "page 2 shares a spread with the large page 3");
+    // Scrolling while in full screen fits the document, as scrolling does in the window.
+    (v.continuous, v.current) = (true, 0);
+    v.fit_zoom(&info);
+    assert!((v.zoom - windowed).abs() < 1e-4, "continuous full screen keeps one zoom");
+    v.continuous = false;
+    // The cover page is a spread of its own even when the next page is larger.
+    let mixed = DocInfo { pages: vec![page(300.0, 400.0), page(600.0, 800.0), page(600.0, 800.0)], ..Default::default() };
+    v.current = 0;
+    v.fit_zoom(&mixed);
+    assert_eq!(v.zoom, small, "the small cover alone, not with page 2");
+    // Leaving full screen brings the document-wide fit back.
+    v.leave_presentation();
+    (v.fit, v.current) = (Fit::Page, 0);
+    (v.layout, v.continuous) = (PageLayout::TwoUp, false);
+    v.fit_zoom(&info);
+    assert!((v.zoom - windowed).abs() < 1e-4, "in the window, one zoom for the document");
+}
+
+#[test]
+fn fit_width_fits_the_shown_page_in_single_page_view_only() {
+    let page =
+        |width: f32, height: f32| pdfcraft_render::PageInfo { width, height, label: String::new(), crop: [0.0, 0.0, width, height], rotation: 0 };
+    let info = DocInfo { pages: vec![page(300.0, 400.0), page(600.0, 400.0)], ..Default::default() };
+    let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+    (v.fit, v.viewport_w, v.viewport_h) = (Fit::Width, 1000.0, 800.0);
+    v.layout = PageLayout::Single;
+    v.continuous = false;
+    v.fit_zoom(&info);
+    let narrow = v.zoom;
+    // The shown page fills the width between the side gutters, not centred for the wide page.
+    let shown = v.layout(&info, v.content_width(&info, 1000.0), 1.0)[0];
+    assert!((shown.left() - SIDE).abs() < 1e-2 && (shown.width() - 860.0).abs() < 1e-2, "{shown:?}");
+    v.current = 1;
+    v.fit_zoom(&info);
+    assert!((narrow / v.zoom - 2.0).abs() < 1e-3, "the narrow page gets twice the zoom of the wide one");
+    // Scrolling views keep one zoom for the whole document.
+    v.continuous = true;
+    v.fit_zoom(&info);
+    let wide = v.zoom;
+    v.current = 0;
+    v.fit_zoom(&info);
+    assert_eq!(v.zoom, wide, "continuous fit width holds still across page sizes");
+}
+
+#[test]
+fn layouts_match_their_commands_and_names() {
+    for l in PageLayout::ORDER {
+        let spec = pdfcraft_engine::commands::command(l.command()).expect("registered");
+        assert_eq!((l.label(), l.icon()), (spec.label, spec.icon), "{l:?}");
+        assert_eq!(PageLayout::from_command(l.command()), Some(l));
+        assert_eq!(PageLayout::try_parse(l.as_str()), Some(l));
+    }
+    assert_eq!(PageLayout::try_parse(" Two-Up "), Some(PageLayout::TwoUp));
+    assert_eq!(PageLayout::try_parse("facing"), None);
+}
+
+#[test]
+fn a_null_xyz_coordinate_keeps_the_readers_place_on_the_new_page() {
+    // CAD exports link each cross-reference as `/XYZ null null 0`. Acrobat keeps the
+    // point at the window's top-left (and the zoom) when following one to another sheet.
+    let info = pdfcraft_render::DocInfo {
+        pages: (0..3)
+            .map(|_| pdfcraft_render::PageInfo { width: 842.0, height: 595.0, label: String::new(), crop: [0.0, 0.0, 842.0, 595.0], rotation: 0 })
+            .collect(),
+        ..Default::default()
+    };
+    // Page 1 at 400 %, scrolled so its point 200 pt across and 125 pt down is at the corner
+    // where /XYZ puts its point.
+    let zoomed = |rot: u16, size: Vec2| {
+        let mut v = view(3, PageLayout::Single, true);
+        v.rotation = rot;
+        v.viewport_screen = Rect::from_min_size(Pos2::ZERO, vec2(1000.0, 600.0));
+        v.screen_xforms = vec![(0, PageXform { rect: Rect::from_min_size(pos2(SIDE - 800.0, -500.0), size), rot, pw: 842.0, ph: 595.0 })];
+        v
+    };
+    let near = |a: Option<f32>, b: f32| a.is_some_and(|a| (a - b).abs() < 1e-4);
+    let mut v = zoomed(0, vec2(4.0 * 842.0, 4.0 * 595.0));
+    v.go_to_dest(1, DestView::Xyz { left: None, top: None, zoom: None }, &info);
+    let (page, fx, fy, rel) = v.goto_point.expect("the place is kept");
+    assert_eq!((v.current, page, rel), (1, 1, vec2(SIDE, 0.0)));
+    assert!(near(fx, 200.0 / 842.0) && near(fy, 125.0 / 595.0), "{fx:?} {fy:?}");
+    // A coordinate the destination gives wins; only the null one is kept.
+    let mut v = zoomed(0, vec2(4.0 * 842.0, 4.0 * 595.0));
+    v.go_to_dest(2, DestView::Xyz { left: Some(421.0), top: None, zoom: Some(4.0) }, &info);
+    let (_, fx, fy, _) = v.goto_point.expect("the place is kept");
+    assert!(near(fx, 0.5) && near(fy, 125.0 / 595.0), "{fx:?} {fy:?}");
+    // With the view turned a quarter, the point under the corner is still the one kept.
+    let mut v = zoomed(90, vec2(4.0 * 595.0, 4.0 * 842.0));
+    v.go_to_dest(1, DestView::Xyz { left: None, top: None, zoom: None }, &info);
+    let (_, fx, fy, _) = v.goto_point.expect("the place is kept");
+    assert!(near(fx, 800.0 / (4.0 * 595.0)) && near(fy, 500.0 / (4.0 * 842.0)), "{fx:?} {fy:?}");
+    // A page that fits the window keeps the layout's placement: no point, as before.
+    let mut v = zoomed(0, vec2(800.0, 565.0));
+    v.go_to_dest(1, DestView::Xyz { left: None, top: None, zoom: None }, &info);
+    assert_eq!((v.current, v.goto, v.goto_point), (1, Some((1, 0.0)), None));
+}
+
+#[test]
+fn destinations_set_the_zoom_mode_and_the_point_to_show() {
+    let info = pdfcraft_render::DocInfo {
+        pages: (0..3)
+            .map(|_| pdfcraft_render::PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 })
+            .collect(),
+        ..Default::default()
+    };
+    let mut v = view(3, PageLayout::Single, true);
+    v.fit = Fit::Width;
+    // No position (or a malformed one): the top of the page, zoom as it was.
+    v.go_to_dest(1, DestView::Top, &info);
+    assert_eq!((v.current, v.goto, v.goto_point, v.fit), (1, Some((1, 0.0)), None, Fit::Width));
+    // /XYZ with a null zoom keeps the zoom mode; its point is a quarter down page 3.
+    v.go_to_dest(2, DestView::Xyz { left: None, top: Some(300.0), zoom: None }, &info);
+    assert_eq!((v.current, v.fit, v.goto_point), (2, Fit::Width, Some((2, None, Some(0.25), vec2(SIDE, 0.0)))));
+    v.go_to_dest(0, DestView::Xyz { left: Some(150.0), top: None, zoom: Some(2.5) }, &info);
+    assert_eq!((v.fit, v.zoom, v.goto_point), (Fit::None, 2.5, Some((0, Some(0.5), None, vec2(SIDE, 0.0)))));
+    // A zoom beyond the view's range is clamped to it.
+    v.go_to_dest(0, DestView::Xyz { left: None, top: None, zoom: Some(1e30) }, &info);
+    assert_eq!((v.zoom, v.goto_point), (64.0, None));
+    v.go_to_dest(0, DestView::Fit, &info);
+    assert_eq!((v.fit, v.goto_point), (Fit::Page, None));
+    v.go_to_dest(0, DestView::FitH { top: Some(100.0) }, &info);
+    assert_eq!((v.fit, v.goto_point), (Fit::Width, Some((0, None, Some(0.75), vec2(SIDE, 0.0)))));
+    v.go_to_dest(0, DestView::FitV { left: Some(75.0) }, &info);
+    assert_eq!((v.fit, v.goto_point), (Fit::Height, Some((0, Some(0.25), None, vec2(SIDE, 0.0)))));
+    // /FitR: the zoom that fits a 100×50 pt rectangle in an 800×600 window, centred.
+    (v.viewport_w, v.viewport_h) = (800.0, 600.0);
+    v.go_to_dest(0, DestView::FitR { rect: [0.0, 300.0, 100.0, 350.0] }, &info);
+    assert_eq!(v.fit, Fit::None);
+    assert!((v.zoom - 8.0 / PT).abs() < 1e-4, "{}", v.zoom);
+    let (page, fx, fy, rel) = v.goto_point.expect("a point to show");
+    assert_eq!((page, rel), (0, vec2(400.0, 300.0)));
+    assert!((fx.unwrap_or(-1.0) - 50.0 / 300.0).abs() < 1e-4 && (fy.unwrap_or(-1.0) - 75.0 / 400.0).abs() < 1e-4, "{fx:?} {fy:?}");
+    // A page past the end goes to the last page; a page the document info lacks, to its top.
+    v.go_to_dest(usize::MAX, DestView::FitH { top: Some(100.0) }, &info);
+    assert_eq!((v.current, v.goto_point.map(|g| g.0)), (2, Some(2)));
+    let empty = pdfcraft_render::DocInfo::default();
+    v.go_to_dest(1, DestView::FitH { top: Some(100.0) }, &empty);
+    assert_eq!((v.current, v.goto_point), (1, None));
+}
+
+#[test]
+fn page_text_failure_preserves_valid_search_match_without_jitter() {
+    let mut v = view(3, PageLayout::Single, true);
+    v.current = 1;
+    v.find =
+        Some(Find { query: "test".into(), case_query: "test".into(), matches: vec![(0, 0..4), (1, 5..9)], current: Some(0), ..Default::default() });
+    let req = RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() };
+    v.last_queue = vec![req];
+    let ctx = egui::Context::default();
+    v.receive_result(
+        &ctx,
+        pdfcraft_render::RenderedPage {
+            request: req,
+            width: 0,
+            height: 0,
+            rgba: Default::default(),
+            error: Some("extraction failed".into()),
+            text: None,
+            warnings: Vec::new(),
+            millis: 0,
+        },
+    );
+    // Active match was on page 0 which failed: current should fall back to match on page 1 without jitter
+    assert_eq!(v.find.as_ref().unwrap().current, Some(0));
+    assert_eq!(v.find.as_ref().unwrap().matches, vec![(1, 5..9)]);
+    assert!(v.goto.is_none());
+}
+
+/// A page whose picture moved can get its whole-page raster back before its last stale tile.
+/// From then on the raster has the picture where it went: it is drawn from there, not from
+/// where it was (which the raster now shows empty), and another drag starts from there too.
+#[test]
+fn a_moved_picture_is_drawn_from_the_fresh_raster_while_a_tile_is_still_stale() {
+    let content = b"q 60 0 0 60 40 260 cm /Im0 Do Q";
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >>".to_vec(),
+        [format!("<< /Length {} >>\nstream\n", content.len()).as_bytes(), content.as_slice(), b"\nendstream"].concat(),
+        [
+            b"<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 3 >>\nstream\n".as_slice(),
+            &[200, 30, 30],
+            b"\nendstream",
+        ]
+        .concat(),
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        bytes.extend_from_slice(o);
+        bytes.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 1100.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.pdf", None, bytes.clone()).unwrap();
+        app.set_option("zoom", "100").unwrap();
+        app.quick_tool = QuickTool::EditText;
+        app
+    });
+    let settle = |h: &mut egui_kittest::Harness<'static, PdfCraftApp>| {
+        for _ in 0..400 {
+            h.step();
+            if !h.state().render_pending() {
+                return;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+    };
+    h.run_steps(4);
+    settle(&mut h);
+    let page = h.state().views[0].page_screen_rect(0).unwrap();
+    let at = |x: f32, y: f32| egui::pos2(page.left() + x / 300.0 * page.width(), page.top() + (400.0 - y) / 400.0 * page.height());
+    let red = |pixels: &image::RgbaImage, r: Rect| {
+        let (w, hh) = (pixels.width(), pixels.height());
+        (r.top().max(0.0) as u32..(r.bottom() as u32).min(hh))
+            .flat_map(|y| (r.left().max(0.0) as u32..(r.right() as u32).min(w)).map(move |x| (x, y)))
+            .filter(|(x, y)| matches!(pixels.get_pixel(*x, *y).0, [r, g, b, _] if r > 150 && g < 90 && b < 90))
+            .count()
+    };
+    let (old, new) = (Rect::from_two_pos(at(42.0, 262.0), at(98.0, 318.0)), Rect::from_two_pos(at(182.0, 82.0), at(238.0, 138.0)));
+    // Select the picture and drag it, without overlap, from (40, 260) to (180, 80).
+    let drag = |h: &mut egui_kittest::Harness<'static, PdfCraftApp>, from: Pos2, to: Pos2, release: bool| {
+        h.hover_at(from);
+        h.run_steps(1);
+        h.drag_at(from);
+        h.run_steps(1);
+        for k in 1..=4 {
+            h.hover_at(from + (to - from) * (k as f32 / 4.0));
+            h.run_steps(1);
+        }
+        if release {
+            h.drop_at(to);
+            h.step();
+        }
+    };
+    let (grab, put) = (at(70.0, 290.0), at(210.0, 110.0));
+    h.hover_at(grab);
+    h.run_steps(1);
+    h.drag_at(grab);
+    h.run_steps(1);
+    h.drop_at(grab);
+    h.run_steps(3);
+    assert!(h.state().views[0].image_selection.is_some(), "the picture is selected");
+    h.state_mut().views[0].hold_rasters = true;
+    drag(&mut h, grab, put, true);
+    // One tile stays stale, as a tile result arriving after the whole-page raster would; then
+    // the whole-page raster is let through.
+    let tile = h.ctx.load_texture("stale-tile", egui::ColorImage::new([1, 1], vec![Color32::TRANSPARENT]), TextureOptions::LINEAR);
+    h.state_mut().views[0].tiles.insert((0, 1, 0, 0), tile);
+    h.state_mut().views[0].stale_tiles.insert((0, 1, 0, 0));
+    h.state_mut().views[0].hold_rasters = false;
+    for _ in 0..400 {
+        h.step();
+        if !h.state().views[0].page_raster_out_of_date(0) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(!h.state().views[0].page_raster_out_of_date(0), "the whole-page raster is fresh");
+    assert!(h.state().views[0].page_out_of_date(0), "a tile is still stale");
+    h.run_steps(2);
+    let pixels = h.render().unwrap();
+    assert!(red(&pixels, new) > 100, "the picture shows where it went");
+    assert_eq!(red(&pixels, old), 0, "and not where it was");
+    // Another drag in that interval takes its pixels from where the raster has them.
+    let further = at(210.0, 200.0);
+    drag(&mut h, put, further, false);
+    let pixels = h.render().unwrap();
+    let moving = Rect::from_two_pos(at(182.0, 172.0), at(238.0, 228.0));
+    assert!(red(&pixels, moving) > 100, "the dragged picture is drawn from the fresh raster");
+    assert_eq!(red(&pixels, old), 0, "nothing shows where it first was");
+    h.state_mut().views[0].stale_tiles.clear();
+    h.state_mut().views[0].tiles.clear();
+}
diff --git a/crates/ui-egui/src/wheel_boost.rs b/crates/ui-egui/src/canvas/wheel_boost.rs
similarity index 94%
rename from crates/ui-egui/src/wheel_boost.rs
rename to crates/ui-egui/src/canvas/wheel_boost.rs
index b9d474565e..10ccbbbaa7 100644
--- a/crates/ui-egui/src/wheel_boost.rs
+++ b/crates/ui-egui/src/canvas/wheel_boost.rs
@@ -313,11 +313,23 @@ mod tests {
     }
 
     fn wheel(unit: egui::MouseWheelUnit, dx: f32, dy: f32) -> egui::Event {
-        egui::Event::MouseWheel { unit, delta: egui::vec2(dx, dy), phase: egui::TouchPhase::Move, modifiers: egui::Modifiers::NONE }
+        egui::Event::MouseWheel {
+            unit,
+            delta: egui::vec2(dx, dy),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        }
     }
 
     fn shifted(unit: egui::MouseWheelUnit, dx: f32, dy: f32) -> egui::Event {
-        egui::Event::MouseWheel { unit, delta: egui::vec2(dx, dy), phase: egui::TouchPhase::Move, modifiers: egui::Modifiers::SHIFT }
+        egui::Event::MouseWheel {
+            unit,
+            delta: egui::vec2(dx, dy),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::SHIFT,
+            source: egui::MouseWheelSource::Unknown,
+        }
     }
 
     #[test]
@@ -379,6 +391,7 @@ mod tests {
         assert_eq!(input.page, egui::vec2(-1.0, 0.0));
     }
 
+    /// Check that NaN, zero, negative or infinite scales and non-wheel events add nothing.
     #[test]
     fn invalid_scales_and_events_contribute_nothing() {
         use egui::MouseWheelUnit::Line;
@@ -386,8 +399,13 @@ mod tests {
             let input = accumulate(&[wheel(Line, 0.0, -1.0)], bad, false);
             assert_eq!(input.line, egui::Vec2::ZERO, "line scale {bad}");
         }
-        let zoom =
-            egui::Event::MouseWheel { unit: Line, delta: egui::vec2(0.0, -1.0), phase: egui::TouchPhase::Move, modifiers: egui::Modifiers::COMMAND };
+        let zoom = egui::Event::MouseWheel {
+            unit: Line,
+            delta: egui::vec2(0.0, -1.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::COMMAND,
+            source: egui::MouseWheelSource::Unknown,
+        };
         let key = egui::Event::Key { key: egui::Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE };
         let input = accumulate(&[zoom, key, wheel(Line, 0.0, f32::NAN)], 100.0, false);
         assert_eq!(input, FrameInput::default());
diff --git a/crates/ui-egui/src/wheel_pager.rs b/crates/ui-egui/src/canvas/wheel_pager.rs
similarity index 100%
rename from crates/ui-egui/src/wheel_pager.rs
rename to crates/ui-egui/src/canvas/wheel_pager.rs
diff --git a/crates/ui-egui/src/canvas/xform.rs b/crates/ui-egui/src/canvas/xform.rs
new file mode 100644
index 0000000000..24ff25f7d1
--- /dev/null
+++ b/crates/ui-egui/src/canvas/xform.rs
@@ -0,0 +1,151 @@
+use super::*;
+
+impl DocView {
+    /// Where `page` is drawn on screen this frame (`None` when it is not on screen).
+    pub fn page_screen_rect(&self, page: usize) -> Option<Rect> {
+        self.screen_xforms.iter().find(|(p, _)| *p == page).map(|(_, xf)| xf.rect)
+    }
+
+    /// The document area on screen.
+    pub fn viewport_rect(&self) -> Rect {
+        self.viewport_screen
+    }
+
+    /// Pages drawn last frame and their screen rectangles.
+    pub fn visible_page_rects(&self) -> Vec<(usize, Rect)> {
+        self.screen_xforms.iter().map(|(p, xf)| (*p, xf.rect)).collect()
+    }
+
+    /// Where `page` is drawn this frame, with its coordinate mapping.
+    pub(crate) fn page_xform(&self, page: usize) -> Option<PageXform> {
+        self.screen_xforms.iter().find(|(p, _)| *p == page).map(|(_, xf)| *xf)
+    }
+}
+
+/// `r` moved so its corner lies on a whole physical pixel, so that a raster drawn from there
+/// maps texel for texel onto the screen.
+pub(super) fn snap_to_pixels(r: Rect, ppp: f32) -> Rect {
+    let snap = |v: f32| (v * ppp).round() / ppp;
+    Rect::from_min_size(pos2(snap(r.min.x), snap(r.min.y)), r.size())
+}
+
+/// Maps between a page's coordinate spaces and the screen, including view rotation.
+///
+/// *View space* is the page as rendered (points, y down, the document's own `/Rotate` applied);
+/// normalised page coordinates `(u, v)` are view space divided by the page size. The view
+/// rotation (View ▸ Rotate View) turns the page clockwise on screen by `rot` degrees.
+#[derive(Clone, Copy)]
+pub struct PageXform {
+    /// The page's rectangle on screen (already rotated, so width/height may be swapped).
+    pub rect: Rect,
+    pub rot: u16,
+    /// Page size in view space (unrotated by the view).
+    pub pw: f32,
+    pub ph: f32,
+}
+
+impl PageXform {
+    /// Screen pixels per page point. The view's rotation swaps the rectangle's sides, so a page
+    /// turned a quarter shows its width down the screen.
+    pub(crate) fn zoom(&self) -> f32 {
+        let across = if self.rot % 180 == 90 { self.rect.height() } else { self.rect.width() };
+        across / self.pw.max(1.0)
+    }
+
+    /// Draw an image in the PDF user-space `rect` as a custom stamp's appearance draws it: turned
+    /// back by `turn` (the page /Rotate it was placed for), so with the page's own rotation it
+    /// reads upright as displayed.
+    pub(crate) fn paint_user_image(
+        &self,
+        painter: &egui::Painter,
+        tex: egui::TextureId,
+        p: &pdfcraft_render::PageInfo,
+        rect: [f64; 4],
+        turn: i64,
+        color: Color32,
+    ) {
+        let mut mesh = egui::Mesh::with_texture(tex);
+        let (w, h) = (rect[2] - rect[0], rect[3] - rect[1]);
+        let (shown_w, shown_h) = if turn % 180 == 0 { (w, h) } else { (h, w) };
+        let [a, b, c, d, e, f] = pdfcraft_model::view_matrix_for(turn, rect);
+        for (u, v) in [(0.0_f32, 0.0_f32), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
+            // The texture's (u, v), from its top-left, in the picture's upright frame, then in user space.
+            let (dx, dy) = (f64::from(u) * shown_w, f64::from(1.0 - v) * shown_h);
+            let (x, y) = (a * dx + c * dy + e, b * dx + d * dy + f);
+            let q = p.user_to_view(x as f32, y as f32);
+            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(q[0] / self.pw, q[1] / self.ph), uv: pos2(u, v), color });
+        }
+        mesh.add_triangle(0, 1, 2);
+        mesh.add_triangle(0, 2, 3);
+        painter.add(egui::Shape::mesh(mesh));
+    }
+    pub fn norm_to_screen(&self, u: f32, v: f32) -> Pos2 {
+        let (a, b) = match self.rot {
+            90 => (1.0 - v, u),
+            180 => (1.0 - u, 1.0 - v),
+            270 => (v, 1.0 - u),
+            _ => (u, v),
+        };
+        pos2(self.rect.left() + a * self.rect.width(), self.rect.top() + b * self.rect.height())
+    }
+
+    pub fn screen_to_norm(&self, p: Pos2) -> (f32, f32) {
+        let (a, b) = ((p.x - self.rect.left()) / self.rect.width().max(1e-3), (p.y - self.rect.top()) / self.rect.height().max(1e-3));
+        match self.rot {
+            90 => (b, 1.0 - a),
+            180 => (1.0 - a, 1.0 - b),
+            270 => (1.0 - b, a),
+            _ => (a, b),
+        }
+    }
+
+    /// Screen point → view space (points).
+    pub fn screen_to_view(&self, p: Pos2) -> (f32, f32) {
+        let (u, v) = self.screen_to_norm(p);
+        (u * self.pw, v * self.ph)
+    }
+
+    /// A view-space rect [x0, y0, x1, y1] → screen rect.
+    pub fn view_rect(&self, g: [f32; 4]) -> Rect {
+        Rect::from_two_pos(self.norm_to_screen(g[0] / self.pw, g[1] / self.ph), self.norm_to_screen(g[2] / self.pw, g[3] / self.ph))
+    }
+
+    /// A PDF user-space rect (crop box, document `/Rotate`) → screen rect.
+    pub fn user_rect(&self, info: &DocInfo, page: usize, r: [f32; 4]) -> Rect {
+        let p = &info.pages[page];
+        let [cx0, cy0, cx1, cy1] = p.crop;
+        let (cw, ch) = ((cx1 - cx0).max(1.0), (cy1 - cy0).max(1.0));
+        let norm = |x: f32, y: f32| -> (f32, f32) {
+            let (u, v) = ((x - cx0) / cw, (cy1 - y) / ch);
+            match p.rotation {
+                90 => (1.0 - v, u),
+                180 => (1.0 - u, 1.0 - v),
+                270 => (v, 1.0 - u),
+                _ => (u, v),
+            }
+        };
+        let (a, b) = (norm(r[0], r[1]), norm(r[2], r[3]));
+        Rect::from_two_pos(self.norm_to_screen(a.0, a.1), self.norm_to_screen(b.0, b.1))
+    }
+
+    /// This transform resized to a raster of `px` device pixels (width, height before the view
+    /// rotation), so each of its texels covers one screen pixel. The rectangle's corner must
+    /// already be on a whole pixel ([`snap_to_pixels`]).
+    pub(super) fn texel_aligned(&self, px: [usize; 2], ppp: f32) -> PageXform {
+        let (w, h) = (px[0] as f32 / ppp, px[1] as f32 / ppp);
+        let size = if self.rot % 180 == 90 { vec2(h, w) } else { vec2(w, h) };
+        PageXform { rect: Rect::from_min_size(self.rect.min, size), ..*self }
+    }
+
+    /// Draw a texture covering the normalised page region, rotated with the view.
+    pub fn paint_image(&self, painter: &egui::Painter, tex: egui::TextureId, u0: f32, v0: f32, u1: f32, v1: f32) {
+        let mut mesh = egui::Mesh::with_texture(tex);
+        let corners = [(u0, v0, 0.0, 0.0), (u1, v0, 1.0, 0.0), (u1, v1, 1.0, 1.0), (u0, v1, 0.0, 1.0)];
+        for (u, v, tu, tv) in corners {
+            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(u, v), uv: pos2(tu, tv), color: Color32::WHITE });
+        }
+        mesh.add_triangle(0, 1, 2);
+        mesh.add_triangle(0, 2, 3);
+        painter.add(egui::Shape::mesh(mesh));
+    }
+}
diff --git a/crates/ui-egui/src/canvas/zoom.rs b/crates/ui-egui/src/canvas/zoom.rs
new file mode 100644
index 0000000000..b6a9669fd0
--- /dev/null
+++ b/crates/ui-egui/src/canvas/zoom.rs
@@ -0,0 +1,359 @@
+use super::*;
+
+/// The page grid's zoom range and the step of its buttons and keys.
+pub const GRID_ZOOM_RANGE: std::ops::RangeInclusive<f32> = 0.5..=3.0;
+
+/// Thumbnail size in the Pages inspector, relative to its usual size.
+pub const THUMBNAIL_ZOOM_RANGE: std::ops::RangeInclusive<f32> = 0.5..=1.5;
+
+pub(super) const GRID_ZOOM_STEP: f32 = 1.25;
+
+impl DocView {
+    /// Rotate the view 90° clockwise or counter-clockwise (View ▸ Rotate View, ⇧⌘+ / ⇧⌘−).
+    pub fn rotate_view(&mut self, clockwise: bool) {
+        self.rotation = (self.rotation + if clockwise { 90 } else { 270 }) % 360;
+        self.goto = Some((self.current, 0.0));
+        self.reset_coarse_state();
+    }
+
+    /// Switch the zoom mode, keeping the current page in view.
+    pub fn set_fit(&mut self, fit: Fit) {
+        self.fit = fit;
+        self.goto = Some((self.current, 0.0));
+        self.reset_coarse_state();
+    }
+
+    /// Full screen, as Acrobat's Full Screen Mode (#379, #1459): one page at a time (or one
+    /// spread, when two-page view was on: #1353), fitted to the screen, from the current page.
+    /// The display it replaces is kept for [`Self::leave_presentation`]. A no-op while presenting.
+    pub fn enter_presentation(&mut self) {
+        if self.presentation.is_some() {
+            return;
+        }
+        self.presentation =
+            Some(SavedDisplay { layout: self.layout, continuous: self.continuous, cover: self.cover, fit: self.fit, zoom: self.zoom });
+        self.continuous = false;
+        self.fit = Fit::Page;
+        self.selection = None;
+        self.goto = Some((self.current, 0.0));
+    }
+
+    /// Leave full screen: the display from before it comes back, at the page reached meanwhile.
+    pub fn leave_presentation(&mut self) {
+        let Some(saved) = self.presentation.take() else { return };
+        self.layout = saved.layout;
+        self.continuous = saved.continuous;
+        self.cover = saved.cover;
+        self.fit = saved.fit;
+        self.zoom = saved.zoom;
+        self.goto = Some((self.current, 0.0));
+    }
+
+    /// The display shown outside full screen: the one presenting replaced, or the current one.
+    pub fn normal_display(&self) -> SavedDisplay {
+        self.presentation.unwrap_or(SavedDisplay {
+            layout: self.layout,
+            continuous: self.continuous,
+            cover: self.cover,
+            fit: self.fit,
+            zoom: self.zoom,
+        })
+    }
+
+    /// Whether the view is in full screen's one-page-at-a-time display.
+    pub fn presenting(&self) -> bool {
+        self.presentation.is_some()
+    }
+
+    /// Switch the base page display (Single or Two-page), leaving continuous scrolling as it is.
+    /// A no-op when the layout is already current, so re-selecting it never yanks a scrolled view
+    /// back to the top.
+    pub fn set_layout(&mut self, layout: PageLayout) {
+        if self.layout == layout {
+            return;
+        }
+        self.layout = layout;
+        self.goto = Some((self.current, 0.0));
+        self.reset_coarse_state();
+    }
+
+    /// Whether the view scrolls continuously (as opposed to one page or spread at a time).
+    pub fn continuous(&self) -> bool {
+        self.continuous
+    }
+
+    /// Change page separation without editing the PDF or losing the reader's place.
+    pub fn set_page_gaps(&mut self, show: bool) {
+        if self.show_page_gaps == show {
+            return;
+        }
+        if !self.organize && self.viewport_screen.is_positive() {
+            let at = self.viewport_screen.center();
+            if let Some((page, r)) = self
+                .screen_rects
+                .iter()
+                .filter(|(_, r)| r.is_positive())
+                .min_by(|(_, a), (_, b)| a.distance_sq_to_pos(at).total_cmp(&b.distance_sq_to_pos(at)))
+            {
+                let fraction = (at - r.min) / r.size();
+                self.zoom_anchor = Some((*page, fraction.x, fraction.y, at - self.viewport_screen.min));
+            }
+        }
+        self.show_page_gaps = show;
+    }
+
+    /// Separation between adjacent page rectangles, in logical screen points.
+    pub(super) fn page_gap(&self) -> f32 {
+        if self.show_page_gaps { GAP } else { 0.0 }
+    }
+
+    /// Turn continuous scrolling on or off, keeping the current page in view. A no-op when it is
+    /// already in that state.
+    pub fn set_continuous(&mut self, continuous: bool) {
+        if self.continuous != continuous {
+            self.continuous = continuous;
+            // Select All of the document belongs to continuous scrolling.
+            self.all_text = false;
+            self.goto = Some((self.current, 0.0));
+            self.reset_coarse_state();
+        }
+    }
+
+    /// Set the whole page display at once (the base layout and continuous scrolling together),
+    /// as the control channel and settings do through a single [`display_token`].
+    pub fn set_display(&mut self, layout: PageLayout, continuous: bool) {
+        self.set_layout(layout);
+        self.set_continuous(continuous);
+    }
+
+    /// Set the cover page in two-page view. A no-op unless something changed.
+    pub fn set_cover(&mut self, cover: bool) {
+        if self.cover != cover {
+            self.cover = cover;
+            self.goto = Some((self.current, 0.0));
+            self.reset_coarse_state();
+        }
+    }
+
+    /// Whether the cover page setting applies: only two-page view has a cover page.
+    pub fn cover_applies(&self) -> bool {
+        self.layout == PageLayout::TwoUp
+    }
+
+    /// Displayed page size in points for this view rotation.
+    pub(super) fn display_size(&self, p: &pdfcraft_render::PageInfo) -> (f32, f32) {
+        if self.rotation % 180 == 90 { (p.height, p.width) } else { (p.width, p.height) }
+    }
+
+    /// Marquee Zoom: zoom so `r` (on screen) fills the window, centred.
+    pub fn zoom_to_rect(&mut self, r: Rect) {
+        let Some((page, pr)) = self.screen_rects.iter().find(|(_, pr)| pr.contains(r.center())).copied() else { return };
+        let k = (self.viewport_screen.width() / r.width().max(1.0)).min(self.viewport_screen.height() / r.height().max(1.0));
+        let f = (r.center() - pr.min) / pr.size();
+        self.zoom = (self.zoom * k).clamp(0.08, 64.0);
+        self.fit = Fit::None;
+        self.zoom_anchor = Some((page, f.x.clamp(0.0, 1.0), f.y.clamp(0.0, 1.0), self.viewport_screen.center() - self.viewport_screen.min));
+    }
+
+    /// View ▸ Zoom ▸ Fit Visible: zoom so the visible content of `page` (display-normalised
+    /// [x0, y0, x1, y1], i.e. after view rotation) spans the window's width, its left edge at
+    /// the window's left and its top at the top.
+    pub fn fit_content(&mut self, page: usize, content: [f32; 4]) -> bool {
+        const PAD: f32 = 16.0;
+        let Some((_, pr)) = self.screen_rects.iter().find(|(p, _)| *p == page).copied() else { return false };
+        let w = (content[2] - content[0]).max(0.01) * pr.width();
+        let k = (self.viewport_screen.width() - 2.0 * PAD).max(50.0) / w.max(1.0);
+        self.zoom = (self.zoom * k).clamp(0.08, 64.0);
+        self.fit = Fit::None;
+        self.zoom_anchor = Some((page, content[0].clamp(0.0, 1.0), content[1].clamp(0.0, 1.0), vec2(PAD, MARGIN)));
+        true
+    }
+
+    /// How large the page grid draws its pages (1.0 = the usual thumbnails).
+    pub fn grid_zoom(&self) -> f32 {
+        self.grid_zoom
+    }
+
+    /// Scale of the thumbnails in the Pages inspector (1.0 is the usual size).
+    pub fn thumbnail_zoom(&self) -> f32 {
+        self.thumbnail_zoom
+    }
+
+    /// Resize the inspector thumbnails, keeping the current page in view after layout.
+    /// Out-of-range values are clamped; non-finite values are ignored.
+    pub fn set_thumbnail_zoom(&mut self, zoom: f32) {
+        if zoom.is_finite() {
+            let zoom = zoom.clamp(*THUMBNAIL_ZOOM_RANGE.start(), *THUMBNAIL_ZOOM_RANGE.end());
+            if zoom != self.thumbnail_zoom {
+                self.thumbnail_zoom = zoom;
+                self.panel_followed = None;
+            }
+        }
+    }
+
+    /// Zoom the page grid; out-of-range values are clamped and nonsense is ignored.
+    pub fn set_grid_zoom(&mut self, zoom: f32) {
+        if zoom.is_finite() {
+            self.grid_zoom = zoom.clamp(*GRID_ZOOM_RANGE.start(), *GRID_ZOOM_RANGE.end());
+        }
+    }
+
+    /// Zoom keeping the centre of the view still.
+    pub fn set_zoom(&mut self, zoom: f32) {
+        // CLI/view options can set zoom before the first layout. Rect::NOTHING has no
+        // finite centre yet, but an initial zoom still needs to leave the default fit mode.
+        let centre = if self.viewport_screen.is_positive() { self.viewport_screen.center() } else { Pos2::ZERO };
+        self.zoom_at(zoom, centre);
+    }
+
+    /// Zoom keeping the document point under `screen_pos` still (pinch, ⌘-scroll).
+    pub fn zoom_at(&mut self, zoom: f32, screen_pos: Pos2) {
+        if !zoom.is_finite() || !screen_pos.is_finite() {
+            return;
+        }
+        let zoom = zoom.clamp(0.08, 64.0);
+        if zoom == self.zoom && self.fit == Fit::None {
+            return;
+        }
+        // In gutters/gaps, anchor relative to the nearest page rather than jumping to its top.
+        // Fractions outside 0..1 preserve the pointer's position outside the page as well.
+        let anchor =
+            self.screen_rects.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(screen_pos).total_cmp(&b.distance_sq_to_pos(screen_pos))).map(
+                |(p, r)| {
+                    let f = (screen_pos - r.min) / r.size();
+                    (*p, f.x, f.y, screen_pos - self.viewport_screen.min)
+                },
+            );
+        self.zoom = zoom;
+        self.fit = Fit::None;
+        match anchor {
+            Some(a) => self.zoom_anchor = Some(a),
+            // Nothing on screen yet (e.g. a launch option): align the current page instead.
+            None => self.goto = Some((self.current, 0.0)),
+        }
+    }
+
+    /// A zoom typed as a percentage ("150", "150%", " 62.5 % ") as a zoom factor; `None` unless it is a
+    /// finite, positive number. `set_zoom` clamps it to the supported range.
+    pub fn parse_zoom_percent(typed: &str) -> Option<f32> {
+        let percent = typed.trim().trim_end_matches('%').trim_end().parse::<f32>().ok()?;
+        (percent.is_finite() && percent > 0.0).then_some(percent / 100.0)
+    }
+
+    /// Standard zoom steps (as in Acrobat's zoom menu).
+    pub fn zoom_step(&mut self, up: bool) {
+        const STEPS: [f32; 17] = [0.1, 0.25, 0.33, 0.5, 0.66, 0.75, 1.0, 1.25, 1.5, 2.0, 3.0, 4.0, 6.0, 8.0, 12.0, 16.0, 32.0];
+        let z = self.zoom;
+        let next = if up { STEPS.iter().copied().find(|s| *s > z * 1.01) } else { STEPS.iter().rev().copied().find(|s| *s < z * 0.99) };
+        if let Some(n) = next {
+            self.set_zoom(n);
+        }
+    }
+
+    /// The first page of the two-page spread page `c` is in: spreads are [0, 1], [2, 3], … or,
+    /// with a cover page, [0], [1, 2], [3, 4], ….
+    pub(super) fn spread_first(&self, c: usize) -> usize {
+        if self.cover { c.saturating_sub((c + 1) % 2) } else { c - c % 2 }
+    }
+
+    pub(super) fn fit_zoom(&mut self, info: &DocInfo) {
+        let largest = |side: fn((f32, f32)) -> f32| info.pages.iter().map(|p| side(self.display_size(p))).fold(1.0, f32::max);
+        let max_w = largest(|s| s.0);
+        // A single page shown on its own fits that page, and full screen in two-page view fits
+        // the spread it shows (review on #2070). Every other display (scrolling, or two-page
+        // view in the window) fits its largest page, so the zoom holds still while pages of
+        // other sizes scroll or page past.
+        let (w, h) = if self.layout == PageLayout::Single && !self.continuous {
+            info.pages.get(self.current).map_or_else(|| (max_w, largest(|s| s.1)), |p| self.display_size(p))
+        } else if self.presentation.is_some() && self.layout == PageLayout::TwoUp && !self.continuous {
+            let first = self.spread_first(self.current);
+            let last = if self.cover && first == 0 { 0 } else { first.saturating_add(1) };
+            let spread: Vec<(f32, f32)> = info.pages.iter().skip(first).take(last - first + 1).map(|p| self.display_size(p)).collect();
+            if spread.is_empty() {
+                (max_w, largest(|s| s.1))
+            } else {
+                (spread.iter().map(|s| s.0).fold(1.0, f32::max), spread.iter().map(|s| s.1).fold(1.0, f32::max))
+            }
+        } else {
+            (max_w, largest(|s| s.1))
+        };
+        let avail_w = (self.viewport_w - 2.0 * SIDE).max(100.0);
+        let per_row = if self.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
+        match self.fit {
+            Fit::Width => self.zoom = (avail_w - self.page_gap() * (per_row - 1.0)) / (w * PT * per_row),
+            Fit::Page => {
+                let zw = (avail_w - self.page_gap() * (per_row - 1.0)) / (w * PT * per_row);
+                let zh = (self.viewport_h - 2.0 * MARGIN) / (h * PT);
+                self.zoom = zw.min(zh);
+            }
+            Fit::Height => self.zoom = (self.viewport_h - 2.0 * MARGIN) / (h * PT),
+            Fit::None => {}
+        }
+        self.zoom = self.zoom.clamp(0.08, 64.0);
+    }
+
+    /// Width of the scroll content. Single-page view sizes it to the page it shows, so a
+    /// wider page elsewhere in the document can't push the shown one off-centre.
+    pub(super) fn content_width(&self, info: &DocInfo, avail_w: f32) -> f32 {
+        let single = (self.layout == PageLayout::Single && !self.continuous).then(|| self.current.min(info.pages.len().saturating_sub(1)));
+        let shown = info.pages.iter().enumerate().filter(|&(i, _)| single.is_none_or(|c| c == i));
+        let max_w = shown.map(|(_, p)| self.display_size(p).0).fold(0.0, f32::max);
+        let per_row = if self.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
+        (max_w * self.zoom * PT * per_row + 2.0 * SIDE).max(avail_w)
+    }
+
+    /// Page rects in content coordinates (origin at the scroll content's top-left).
+    pub(super) fn layout(&self, info: &DocInfo, content_w: f32, ppp: f32) -> Vec<Rect> {
+        let s = self.zoom * PT;
+        let gap = self.page_gap();
+        let page_size = |p: &pdfcraft_render::PageInfo| {
+            let (w, h) = self.display_size(p);
+            if self.show_page_gaps {
+                vec2(w * s, h * s)
+            } else {
+                // Match the raster's whole physical pixels. Snapping each page's origin
+                // independently with fractional sizes would leave hairline seams.
+                vec2(device_pixels(w, s * ppp) as f32 / ppp, device_pixels(h, s * ppp) as f32 / ppp)
+            }
+        };
+        let mut rects = Vec::with_capacity(info.pages.len());
+        let mut y = MARGIN;
+        match self.layout {
+            PageLayout::Single => {
+                for p in &info.pages {
+                    let size = page_size(p);
+                    rects.push(Rect::from_min_size(pos2(((content_w - size.x) / 2.0).max(SIDE), y), size));
+                    y += size.y + gap;
+                }
+            }
+            PageLayout::TwoUp => {
+                // With a cover page, the first page sits alone on the right.
+                let rows: Vec<&[pdfcraft_render::PageInfo]> = if self.cover && !info.pages.is_empty() {
+                    std::iter::once(&info.pages[..1]).chain(info.pages[1..].chunks(2)).collect()
+                } else {
+                    info.pages.chunks(2).collect()
+                };
+                for (ri, pair) in rows.into_iter().enumerate() {
+                    let sizes: Vec<Vec2> = pair.iter().map(page_size).collect();
+                    let row_w: f32 = sizes.iter().map(|v| v.x).sum::<f32>() + gap * (sizes.len() as f32 - 1.0);
+                    let row_h = sizes.iter().map(|v| v.y).fold(0.0, f32::max);
+                    let mut x = if self.cover && ri == 0 { (content_w / 2.0 + gap / 2.0).max(SIDE) } else { ((content_w - row_w) / 2.0).max(SIDE) };
+                    for size in sizes {
+                        rects.push(Rect::from_min_size(pos2(x, y + (row_h - size.y) / 2.0), size));
+                        x += size.x + gap;
+                    }
+                    y += row_h + gap;
+                }
+            }
+        }
+        rects
+    }
+}
+
+/// The scroll offset that puts `point` (content coordinates) at `rel` in the viewport, kept within
+/// the content as egui keeps it. egui clamps only after drawing, so an offset past the end showed
+/// the page misplaced for a frame and then jumped (zooming out beside a page that fits).
+pub(super) fn anchored_scroll(point: Pos2, rel: Vec2, content: Vec2, viewport: Vec2) -> Vec2 {
+    let max = vec2((content.x - viewport.x).max(0.0), (content.y - viewport.y).max(0.0));
+    vec2((point.x - rel.x).clamp(0.0, max.x), (point.y - rel.y).clamp(0.0, max.y))
+}
diff --git a/crates/ui-egui/src/zoom_snap.rs b/crates/ui-egui/src/canvas/zoom_snap.rs
similarity index 98%
rename from crates/ui-egui/src/zoom_snap.rs
rename to crates/ui-egui/src/canvas/zoom_snap.rs
index eb2cc86727..e0315763fa 100644
--- a/crates/ui-egui/src/zoom_snap.rs
+++ b/crates/ui-egui/src/canvas/zoom_snap.rs
@@ -5,6 +5,7 @@ use egui::{Color32, CornerRadius, Pos2, Rect, Stroke};
 use pdfcraft_render::{RenderConfig, RenderRequest, RequestKind, Tile};
 
 use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
 use crate::{PdfCraftApp, QuickTool};
 
 /// A finished gesture: (page, the rectangle on screen, the same in page view points
@@ -12,9 +13,8 @@ use crate::{PdfCraftApp, QuickTool};
 pub type Marquee = (usize, Rect, [f32; 4]);
 
 /// Drag a rectangle on page `page` (Marquee Zoom, Snapshot).
-pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, page: usize, view: &mut DocView) {
-    let pointer = ui.input(|i| i.pointer.hover_pos());
-    let origin = ui.input(|i| i.pointer.press_origin());
+pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, ptr: &PagePointer, page: usize, view: &mut DocView) {
+    let (pointer, origin) = (ptr.pos, ptr.origin);
     if pointer.is_some_and(|p| xf.rect.contains(p)) {
         ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
     }
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index 2723d16c23..b81ac2d58c 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -1,6 +1,7 @@
 //! Window chrome: tab strip (with the integrated macOS title bar), mode bar, right rail.
 
-use egui::{Align, Align2, Color32, CornerRadius, Layout, Rect, Sense, Stroke, vec2};
+use craft_ui::panes::{Edge, Rail, RailItem, RailRequest};
+use egui::{Align, Color32, CornerRadius, Layout, Rect, Sense, Stroke, vec2};
 
 use crate::canvas::{DocView, Fit, PageLayout};
 use crate::theme::{self, ThemePreference, Tokens};
@@ -26,6 +27,8 @@ const TAB_STRIP: f32 = 38.0;
 const TAB_HEIGHT: f32 = 30.0;
 const STRIP_BUTTON: f32 = 28.0;
 
+/// Draw the window's tab strip: home and open controls, shrinkable and scrollable document tabs with drag
+/// reordering, and platform window controls.
 pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     // macOS: the strip is the 28 pt title bar, so the traffic lights are centred in it; tabs and
@@ -38,7 +41,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         .frame(egui::Frame::NONE.fill(t.titlebar).inner_margin(egui::Margin { left, right: 10, top: 0, bottom: 0 }))
         .show(ui, |ui| {
             let full = ui.max_rect();
-            let drag = ui.interact(full, ui.id().with("titledrag"), Sense::click_and_drag());
+            let drag = ui.interact(full, ui.scope_id().with("titledrag"), Sense::click_and_drag());
             if drag.drag_started() {
                 window_controls::desktop_grab(ui.ctx(), egui::ViewportCommand::StartDrag);
             }
@@ -92,7 +95,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 }
                 let cap = tab_cap(&natural, tabs_width, gap, TAB_MIN_WIDTH);
                 // Where the tabs were scrolled to last frame, and how far they can go.
-                let scroll_id = ui.id().with("tab_scroll");
+                let scroll_id = ui.scope_id().with("tab_scroll");
                 let (offset, max_offset) = ui.data(|d| d.get_temp::<(f32, f32)>(scroll_id)).unwrap_or((0.0, 0.0));
                 let mut scroll_to = None;
                 if overflow && arrow(ui, "chevron-left", offset > 0.5, tl!("Scroll tabs left")) {
@@ -102,7 +105,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 // the strip jumping to it.
                 let state = (app.active_ids().map(|(_, id)| id), app.views.len(), app.combine_showing());
                 let changed = ui.data_mut(|data| {
-                    let id = ui.id().with("active_tab");
+                    let id = ui.scope_id().with("active_tab");
                     let changed = data.get_temp::<(Option<pdfcraft_engine::DocId>, usize, bool)>(id) != Some(state);
                     data.insert_temp(id, state);
                     changed
@@ -131,7 +134,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                 let file = (name != doc.name).then_some(doc.name.as_str());
                                 let response = tab(
                                     ui,
-                                    ui.id().with(("document-tab", app.views[i].id)),
+                                    ui.scope_id().with(("document-tab", app.views[i].id)),
                                     &t,
                                     "file-text",
                                     &name,
@@ -213,7 +216,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                 let mut close = None;
                                 let response = tab(
                                     ui,
-                                    ui.id().with("combine-tab"),
+                                    ui.scope_id().with("combine-tab"),
                                     &t,
                                     "files",
                                     tl!("Combine files"),
@@ -239,7 +242,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                         });
                     });
                     let max = (out.content_size.x - out.inner_rect.width()).max(0.0);
-                    ui.data_mut(|d| d.insert_temp(scroll_id, (out.state.offset.x, max)));
+                    ui.data_mut(|d| d.insert_temp(scroll_id, (out.state.clamped_offset().x, max)));
                     // A tab dragged to either edge of a strip that scrolls brings the hidden tabs in.
                     if let Some(x) = drag_x
                         && max > 0.0
@@ -252,7 +255,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                             0.0
                         };
                         if step != 0.0 {
-                            ui.data_mut(|d| d.insert_temp(scroll_id.with("to"), (out.state.offset.x + step).clamp(0.0, max)));
+                            ui.data_mut(|d| d.insert_temp(scroll_id.with("to"), (out.state.clamped_offset().x + step).clamp(0.0, max)));
                             ui.ctx().request_repaint();
                         }
                     }
@@ -308,25 +311,6 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         });
 }
 
-/// Both theme entry points use the same choices and command path.
-fn theme_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
-    for (preference, command, label) in [
-        (ThemePreference::System, "view.theme.system", "Use system setting"),
-        (ThemePreference::Light, "view.theme.light", "Light gray"),
-        (ThemePreference::Dark, "view.theme.dark", "Dark gray"),
-    ] {
-        if ui.add(widgets::radio(app.theme_preference == preference, tl!(label))).clicked() {
-            app.execute(command);
-            ui.close();
-        }
-    }
-    ui.separator();
-    if ui.button(tl!("Appearance settings…")).clicked() {
-        app.dialog = Some(Dialog::Preferences);
-        ui.close();
-    }
-}
-
 /// The right-click menu on the title bar's theme button.
 fn appearance_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     if ui.button(tl!("Appearance settings…")).clicked() {
@@ -383,7 +367,7 @@ fn tab_name(name: &str) -> String {
 
 /// The width a tab takes when nothing has to shrink.
 fn tab_natural_width(ui: &egui::Ui, t: &Tokens, name: &str) -> f32 {
-    let label = crate::bidi::visual(&tab_name(name)).into_owned();
+    let label = tab_name(name);
     ui.fonts_mut(|f| f.layout_no_wrap(label, theme::regular(13.0), t.text).size().x) + TAB_CHROME
 }
 
@@ -411,6 +395,8 @@ fn tab_cap(natural: &[f32], budget: f32, gap: f32, min: f32) -> Option<f32> {
     None
 }
 
+/// Draw one tab with its icon, elided label, close button and unsaved dot; records a close request and
+/// returns the tab response for drag handling.
 #[allow(clippy::too_many_arguments)]
 fn tab(
     ui: &mut egui::Ui,
@@ -432,13 +418,13 @@ fn tab(
     // A shrunk tab shows as much of its name as fits (the tooltip has all of it).
     if let Some(cap) = cap {
         let room = (cap - TAB_CHROME).max(0.0);
-        label = ui.fonts_mut(|f| {
-            crate::panels::ellipsized_prefix(&label, |s| f.layout_no_wrap(crate::bidi::visual(s).into_owned(), font.clone(), t.text).size().x <= room)
-        });
+        label = crate::panels::ellipsized_prefix(&label, |s| crate::bidi::layout_ltr(ui, s.to_owned(), font.clone(), t.text).size().x <= room);
     }
-    // Painted text only: the accessibility name below keeps the logical order.
-    let label = crate::bidi::visual(&label).into_owned();
-    let text_w = ui.fonts_mut(|f| f.layout_no_wrap(label.clone(), font.clone(), t.text).size().x);
+    // Logical text, laid out explicitly left to right: the fork shapes and reorders it once,
+    // and an Arabic file name keeps its extension at the visual end. AccessKit names stay logical.
+    let label_color = if active { t.text } else { t.text_muted };
+    let label_galley = crate::bidi::layout_ltr(ui, label.clone(), font.clone(), label_color);
+    let text_w = label_galley.size().x;
     let width = cap.map_or(text_w + TAB_CHROME, |cap| (text_w + TAB_CHROME).min(cap));
     // Full strip height so the active tab sits on the mode bar instead of floating in the title bar.
     let height = ui.available_height().max(height);
@@ -462,7 +448,7 @@ fn tab(
             15.0,
             if active { t.accent } else { t.text_muted },
         );
-        ui.painter().text(rect.min + vec2(28.0, rect.height() / 2.0), Align2::LEFT_CENTER, label, font, if active { t.text } else { t.text_muted });
+        ui.painter().galley(rect.min + vec2(28.0, (rect.height() - label_galley.size().y) / 2.0), label_galley.clone(), label_color);
     });
     let x_rect = Rect::from_center_size(rect.right_center() - vec2(16.0, 0.0), vec2(20.0, 20.0));
     let x = ui.interact(x_rect, id.with("close"), Sense::click());
@@ -478,14 +464,10 @@ fn tab(
         *close = Some(index);
     }
     let shown = match file {
-        Some(file) => std::borrow::Cow::Owned(format!("{}\n{}", crate::bidi::visual(name), crate::bidi::visual(file))),
-        None => crate::bidi::visual(name),
+        Some(file) => format!("{name}\n{file}"),
+        None => name.to_string(),
     };
-    theme::hand(resp).on_hover_text(if dirty {
-        crate::i18n::fmt(tl!("{name} — unsaved changes"), &[("name", shown.as_ref())])
-    } else {
-        shown.into_owned()
-    })
+    theme::hand(resp).on_hover_text(if dirty { crate::i18n::fmt(tl!("{name} — unsaved changes"), &[("name", &shown)]) } else { shown })
 }
 
 pub fn mode_bar(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
@@ -496,10 +478,13 @@ pub fn mode_bar(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         .show(ui, |ui| {
             ui.horizontal_centered(|ui| {
                 ui.spacing_mut().item_spacing.x = 2.0;
-                main_menu(app, ui);
-                ui.add_space(6.0);
-                ui.painter().vline(ui.cursor().left(), ui.max_rect().y_range().shrink(12.0), Stroke::new(1.0, t.divider));
-                ui.add_space(10.0);
+                // The menus, unless the native macOS menu bar has them.
+                if app.native_menu.is_none() {
+                    app.menu_bar_ui(ui);
+                    ui.add_space(6.0);
+                    ui.painter().vline(ui.cursor().left(), ui.max_rect().y_range().shrink(12.0), Stroke::new(1.0, t.divider));
+                    ui.add_space(10.0);
+                }
                 // Acrobat's mode bar has no Read tab: reading is what the viewer does with no tool
                 // in use. Read mode (the panes hidden) stays a View command and a default workspace.
                 for (mode, label) in [(Mode::AllTools, "All tools"), (Mode::Edit, "Edit"), (Mode::Convert, "Convert"), (Mode::Sign, "E-Sign")] {
@@ -539,103 +524,8 @@ pub fn mode_bar(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         });
 }
 
-/// Keep menus usable when their contents are taller than the window.
-pub(crate) fn scroll_menu(ui: &mut egui::Ui, add: impl FnOnce(&mut egui::Ui)) {
-    let height = (ui.ctx().content_rect().height() - 24.0).max(40.0);
-    egui::ScrollArea::vertical().max_height(height).auto_shrink([true, true]).show(ui, add);
-}
-
-fn main_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
-    let t = Tokens::get(ui.ctx());
-    let resp = widgets::ghost_button(ui, "panel-left", tl!("Menu"));
-    egui::Popup::menu(&resp).show(|ui| {
-        scroll_menu(ui, |ui| {
-            ui.set_min_width(230.0);
-            ui.menu_button(tl!("File"), |ui| scroll_menu(ui, |ui| crate::commands::registry_menu(app, ui, "File")));
-            ui.menu_button(tl!("Edit"), |ui| scroll_menu(ui, |ui| crate::commands::registry_menu(app, ui, "Edit")));
-            ui.menu_button(tl!("Pages"), |ui| scroll_menu(ui, |ui| crate::commands::registry_menu(app, ui, "Pages")));
-            ui.menu_button(tl!("View"), |ui| {
-                scroll_menu(ui, |ui| {
-                    if let Some(i) = app.active {
-                        let v = &mut app.views[i];
-                        let ctx = ui.ctx().clone();
-                        let key = |s| crate::commands::shortcut_label(&ctx, s);
-                        use crate::commands::{ACTUAL_SIZE, FIT_WIDTH, NEXT_VIEW, PAGE_LEVEL, PREV_VIEW, ROTATE_CCW, ROTATE_CW, ZOOM_IN, ZOOM_OUT};
-                        ui.label(egui::RichText::new(tl!("Zoom")).color(t.text_faint).small());
-                        if widgets::menu_item(ui, tl!("Actual size"), &key(ACTUAL_SIZE)).clicked() {
-                            v.set_zoom(1.0);
-                        }
-                        if widgets::menu_item(ui, tl!("Zoom to page level"), &key(PAGE_LEVEL)).clicked() {
-                            v.fit = Fit::Page;
-                        }
-                        if widgets::menu_item(ui, tl!("Fit to width"), &key(FIT_WIDTH)).clicked() {
-                            v.fit = Fit::Width;
-                        }
-                        if widgets::menu_item(ui, tl!("Fit to height"), "").clicked() {
-                            v.fit = Fit::Height;
-                            v.goto = Some((v.current, 0.0));
-                        }
-                        if widgets::menu_item(ui, tl!("Fit visible"), &crate::commands::command_shortcut_label(&ctx, "view.fit_visible")).clicked() {
-                            ui.close();
-                            app.execute("view.fit_visible");
-                            return;
-                        }
-                        if widgets::menu_item(ui, tl!("Zoom in"), &key(ZOOM_IN)).clicked() {
-                            v.zoom_step(true);
-                        }
-                        if widgets::menu_item(ui, tl!("Zoom out"), &key(ZOOM_OUT)).clicked() {
-                            v.zoom_step(false);
-                        }
-                        if widgets::menu_item(ui, tl!("Rotate view clockwise"), &key(ROTATE_CW)).clicked() {
-                            v.rotate_view(true);
-                        }
-                        if widgets::menu_item(ui, tl!("Rotate view counterclockwise"), &key(ROTATE_CCW)).clicked() {
-                            v.rotate_view(false);
-                        }
-                        ui.separator();
-                        ui.label(egui::RichText::new(tl!("Page navigation")).color(t.text_faint).small());
-                        if ui.add_enabled(!v.back.is_empty(), egui::Button::new(tl!("Previous view")).shortcut_text(key(PREV_VIEW))).clicked() {
-                            v.view_history(false);
-                        }
-                        if ui.add_enabled(!v.forward.is_empty(), egui::Button::new(tl!("Next view")).shortcut_text(key(NEXT_VIEW))).clicked() {
-                            v.view_history(true);
-                        }
-                        ui.separator();
-                        if let Some(id) = page_display_menu(ui, &app.views[i]) {
-                            app.execute(id);
-                        }
-                        ui.separator();
-                    }
-                    crate::commands::registry_menu(app, ui, "View");
-                    ui.menu_button(tl!("Display theme"), |ui| theme_menu(app, ui));
-                    ui.menu_button(tl!("Side panels"), |ui| {
-                        scroll_menu(ui, |ui| {
-                            for (p, label) in [
-                                (RightPanel::Comments, tl!("Comments")),
-                                (RightPanel::Bookmarks, tl!("Bookmarks")),
-                                (RightPanel::Pages, tl!("Pages")),
-                                (RightPanel::Fields, tl!("Fields")),
-                                (RightPanel::Layers, tl!("Layers")),
-                                (RightPanel::Attachments, tl!("Attachments")),
-                                (RightPanel::Signatures, tl!("Signatures")),
-                                (RightPanel::Accessibility, tl!("Accessibility Checker")),
-                                (RightPanel::Tags, tl!("Tags")),
-                                (RightPanel::Search, tl!("Search")),
-                                (RightPanel::Compare, tl!("Compare")),
-                            ] {
-                                if ui.add(widgets::radio(app.right == Some(p), tl!(label))).clicked() {
-                                    app.choose_right_panel(Some(p));
-                                }
-                            }
-                        })
-                    });
-                })
-            });
-            ui.menu_button(tl!("Help"), |ui| scroll_menu(ui, |ui| crate::commands::registry_menu(app, ui, "Help")));
-        })
-    });
-}
-
+/// Draw the right tool rail with page navigation, history, zoom, rotation and page-display controls for the
+/// active view.
 pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     let Some((index, id)) = app.active_ids() else { return };
@@ -651,166 +541,165 @@ pub fn right_rail(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     );
     let page_count = doc.info.pages.len();
     let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
-    egui::Panel::right("rail")
-        .resizable(false)
-        .exact_size(48.0)
+    let item = |panel: RightPanel, icon: &str, label: &str, marker: Option<&str>| {
+        let item = RailItem::new(panel, icons::source(icon), tl!(label)).marker(marker.is_some());
+        match marker {
+            Some(marker) => item.marker_label(tl!(marker)),
+            None => item,
+        }
+    };
+    let has = |has: bool, label: &'static str| has.then_some(label);
+    let mut items = vec![
+        item(RightPanel::Comments, "message-square-text", "Comments", has(has_comments, "Has comments")),
+        item(RightPanel::Bookmarks, "bookmark", "Bookmarks", has(has_outline, "Has bookmarks")),
+        item(RightPanel::Pages, "files", "Page thumbnails", None),
+        item(RightPanel::Fields, "text-cursor-input", "Form fields", has(has_fields, "Has form fields")),
+        item(RightPanel::Layers, "layers", "Layers", has(has_layers, "Has layers")),
+        item(RightPanel::Attachments, "paperclip", "Attachments", has(has_files, "Has attachments")),
+        item(RightPanel::Signatures, "signature", "Signatures", has(has_signatures, "Signed")),
+    ];
+    if has_check {
+        items.push(item(RightPanel::Accessibility, "accessibility", "Accessibility Checker", None));
+    }
+    items.push(item(RightPanel::Tags, "tag", "Tags", None));
+    let view = &mut app.views[index];
+    let mut page_display = None;
+    let rail = Rail::new(egui::Id::unique("rail"))
+        .edge(Edge::End)
         .frame(egui::Frame::NONE.fill(t.chrome).inner_margin(egui::Margin::symmetric(6, 8)).stroke(Stroke::new(1.0, t.divider)))
-        .show(ui, |ui| {
-            // Page navigation cluster at the bottom (as in Acrobat's rail). It is a panel of its own so
-            // that in a short window the buttons above scroll instead of running into it (#3282).
-            let view = &mut app.views[index];
-            let mut page_display = None;
-            egui::Panel::bottom("rail-nav").frame(egui::Frame::NONE).show_separator_line(false).resizable(false).show(ui, |ui| {
-                ui.with_layout(Layout::bottom_up(Align::Center), |ui| {
-                    ui.spacing_mut().item_spacing.y = 2.0;
-                    let tip = crate::commands::key_tip(ui.ctx(), tl!("Zoom out ({key})"), crate::commands::ZOOM_OUT);
-                    if icons::button(ui, "zoom-out", 32.0, false, &tip).clicked() {
-                        view.zoom_step(false);
+        .show(ui, &items, app.right.as_ref(), |ui| {
+            // Page navigation cluster at the bottom, a panel of its own so that in a short
+            // window the buttons above scroll instead of running into it (#3282).
+            ui.with_layout(Layout::bottom_up(Align::Center), |ui| {
+                ui.spacing_mut().item_spacing.y = 2.0;
+                let tip = crate::commands::key_tip(ui.ctx(), tl!("Zoom out ({key})"), crate::commands::ZOOM_OUT);
+                if icons::button(ui, "zoom-out", 32.0, false, &tip).clicked() {
+                    view.zoom_step(false);
+                }
+                let tip = crate::commands::key_tip(ui.ctx(), tl!("Zoom in ({key})"), crate::commands::ZOOM_IN);
+                if icons::button(ui, "zoom-in", 32.0, false, &tip).clicked() {
+                    view.zoom_step(true);
+                }
+                // Between rotate and zoom, as in Acrobat. Its command runs once `view` is free.
+                let tip = crate::i18n::fmt(tl!("Page display: {layout}"), &[("layout", tl!(view.layout.label()))]);
+                let resp = icons::button(ui, view.layout.icon(), 32.0, false, &tip);
+                page_display = egui::Popup::menu(&resp)
+                    .show(|ui| {
+                        ui.set_min_width(220.0);
+                        rail_view_menu(ui, view)
+                    })
+                    .and_then(|r| r.inner);
+                let tip = crate::commands::key_tip(ui.ctx(), tl!("Rotate view clockwise ({key})"), crate::commands::ROTATE_CW);
+                if icons::button(ui, "rotate-cw", 32.0, false, &tip).clicked() {
+                    view.rotate_view(true);
+                }
+                // Not `columns-2` while fitting the page: that is the two-page view's icon.
+                let fit_icon = if view.fit == Fit::Width { "maximize" } else { "maximize-2" };
+                if icons::button(ui, fit_icon, 32.0, false, tl!("Toggle fit page / fit width")).clicked() {
+                    view.fit = if view.fit == Fit::Width { Fit::Page } else { Fit::Width };
+                    view.goto = Some((view.current, 0.0));
+                }
+                let id = egui::Id::unique("zoom-input");
+                let draft = id.with("draft");
+                let mut typed = ui.data(|d| d.get_temp::<String>(draft)).unwrap_or_else(|| format!("{:.0}%", view.zoom * 100.0));
+                let edit = egui::TextEdit::singleline(&mut typed)
+                    .id(id)
+                    .desired_width(40.0)
+                    .align(egui::Align2::CENTER_TOP)
+                    .font(theme::medium(11.0))
+                    .text_color(t.text_muted)
+                    .frame(egui::Frame::NONE)
+                    .margin(vec2(2.0, 2.0));
+                let r = ui.add(edit).on_hover_text(tl!("Zoom — type a percentage and press Enter"));
+                ui.ctx().accesskit_node_builder(id, |node| node.set_label(tl!("Zoom")));
+                if r.gained_focus() {
+                    let mut state = egui::TextEdit::load_state(ui.ctx(), id).unwrap_or_default();
+                    let all = egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(typed.chars().count()));
+                    state.cursor.set_char_range(Some(all));
+                    state.store(ui.ctx(), id);
+                }
+                if r.has_focus() {
+                    ui.data_mut(|d| d.insert_temp(draft, typed.clone()));
+                } else {
+                    ui.data_mut(|d| d.remove::<String>(draft));
+                    if r.lost_focus()
+                        && ui.input(|i| i.key_pressed(egui::Key::Enter))
+                        && let Some(zoom) = DocView::parse_zoom_percent(&typed)
+                    {
+                        view.set_zoom(zoom);
                     }
-                    let tip = crate::commands::key_tip(ui.ctx(), tl!("Zoom in ({key})"), crate::commands::ZOOM_IN);
-                    if icons::button(ui, "zoom-in", 32.0, false, &tip).clicked() {
-                        view.zoom_step(true);
+                }
+                ui.add_space(6.0);
+                if icons::button(ui, "chevron-down", 30.0, false, tl!("Next page")).clicked() {
+                    view.step_page(true);
+                }
+                if icons::button(ui, "chevron-up", 30.0, false, tl!("Previous page")).clicked() {
+                    view.step_page(false);
+                }
+                // History is distinct from stepping to the adjacent page, and belongs to this tab.
+                for (forward, icon, label, shortcut, enabled) in [
+                    (true, "chevron-right", tl!("Next view"), crate::commands::NEXT_VIEW, !view.forward.is_empty()),
+                    (false, "chevron-left", tl!("Previous view"), crate::commands::PREV_VIEW, !view.back.is_empty()),
+                ] {
+                    let tip = format!("{label} ({})", crate::commands::shortcut_label(ui.ctx(), shortcut));
+                    if ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, 30.0, false, &tip)).inner.clicked() {
+                        view.view_history(forward);
                     }
-                    // Between rotate and zoom, as in Acrobat. Its command runs once `view` is free.
-                    let tip = crate::i18n::fmt(tl!("Page display: {layout}"), &[("layout", tl!(view.layout.label()))]);
-                    let resp = icons::button(ui, view.layout.icon(), 32.0, false, &tip);
-                    page_display = egui::Popup::menu(&resp)
-                        .show(|ui| {
-                            ui.set_min_width(220.0);
-                            rail_view_menu(ui, view)
-                        })
-                        .and_then(|r| r.inner);
-                    let tip = crate::commands::key_tip(ui.ctx(), tl!("Rotate view clockwise ({key})"), crate::commands::ROTATE_CW);
-                    if icons::button(ui, "rotate-cw", 32.0, false, &tip).clicked() {
-                        view.rotate_view(true);
+                }
+                let font = theme::regular(11.0);
+                let mut position = page_position(view.current, page_count, labels.get(view.current).map_or("", String::as_str));
+                if widgets::text_width(ui, &position, &font) > ui.available_width() {
+                    position = page_count.to_string();
+                }
+                // Out of range (an empty document), like `page_position`: "Page 0 of 0", never past the end.
+                let shown = if view.current < page_count { view.current + 1 } else { page_count };
+                let of = crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &shown.to_string()), ("n", &page_count.to_string())]);
+                ui.label(egui::RichText::new(position).font(font).color(t.text_muted)).on_hover_text(of);
+                let page_input_id = view.page_input_id();
+                // Consume replacement selection once, including when the editor has lost focus.
+                let reselect = std::mem::take(&mut view.page_input_reselect);
+                // Navigation updates the idle display, never the text being edited.
+                if !ui.memory(|m| m.has_focus(page_input_id)) {
+                    view.page_input = view.current_page_label(labels.get(view.current).map(String::as_str));
+                } else if reselect {
+                    // The replacement changed the label while egui retained this editor's cursor.
+                    let mut state = egui::TextEdit::load_state(ui.ctx(), page_input_id).unwrap_or_default();
+                    let end = egui::text::CCursor::new(view.page_input.chars().count());
+                    state.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(0), end)));
+                    state.store(ui.ctx(), page_input_id);
+                }
+                let edit = egui::TextEdit::singleline(&mut view.page_input)
+                    .id(page_input_id)
+                    .desired_width(34.0)
+                    .align(egui::Align2::CENTER_TOP)
+                    .font(theme::medium(12.0))
+                    .margin(vec2(2.0, 4.0));
+                let r = egui::Frame::NONE
+                    .fill(t.field)
+                    .stroke(Stroke::new(1.0, t.border))
+                    .corner_radius(CornerRadius::same(5))
+                    .show(ui, |ui| ui.add(edit))
+                    .inner
+                    .on_hover_text(tl!("Current page — type a page number or label (such as iv) and press Enter"))
+                    .accessible_name(tl!("Current page"));
+                if r.lost_focus() {
+                    if ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                        // A page label first (logical page numbers, as Acrobat), then a number.
+                        let typed = view.page_input.clone();
+                        view.go_to_typed(&typed, &labels);
                     }
-                    // Not `columns-2` while fitting the page: that is the two-page view's icon.
-                    let fit_icon = if view.fit == Fit::Width { "maximize" } else { "maximize-2" };
-                    if icons::button(ui, fit_icon, 32.0, false, tl!("Toggle fit page / fit width")).clicked() {
-                        view.fit = if view.fit == Fit::Width { Fit::Page } else { Fit::Width };
-                        view.goto = Some((view.current, 0.0));
-                    }
-                    let id = egui::Id::new("zoom-input");
-                    let draft = id.with("draft");
-                    let mut typed = ui.data(|d| d.get_temp::<String>(draft)).unwrap_or_else(|| format!("{:.0}%", view.zoom * 100.0));
-                    let edit = egui::TextEdit::singleline(&mut typed)
-                        .id(id)
-                        .desired_width(40.0)
-                        .horizontal_align(Align::Center)
-                        .font(theme::medium(11.0))
-                        .text_color(t.text_muted)
-                        .frame(egui::Frame::NONE)
-                        .margin(vec2(2.0, 2.0));
-                    let r = ui.add(edit).on_hover_text(tl!("Zoom — type a percentage and press Enter"));
-                    ui.ctx().accesskit_node_builder(id, |node| node.set_label(tl!("Zoom")));
-                    if r.gained_focus() {
-                        let mut state = egui::TextEdit::load_state(ui.ctx(), id).unwrap_or_default();
-                        let all = egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(typed.chars().count()));
-                        state.cursor.set_char_range(Some(all));
-                        state.store(ui.ctx(), id);
-                    }
-                    if r.has_focus() {
-                        ui.data_mut(|d| d.insert_temp(draft, typed.clone()));
-                    } else {
-                        ui.data_mut(|d| d.remove::<String>(draft));
-                        if r.lost_focus()
-                            && ui.input(|i| i.key_pressed(egui::Key::Enter))
-                            && let Some(zoom) = DocView::parse_zoom_percent(&typed)
-                        {
-                            view.set_zoom(zoom);
-                        }
-                    }
-                    ui.add_space(6.0);
-                    if icons::button(ui, "chevron-down", 30.0, false, tl!("Next page")).clicked() {
-                        view.step_page(true);
-                    }
-                    if icons::button(ui, "chevron-up", 30.0, false, tl!("Previous page")).clicked() {
-                        view.step_page(false);
-                    }
-                    // History is distinct from stepping to the adjacent page, and belongs to this tab.
-                    for (forward, icon, label, shortcut, enabled) in [
-                        (true, "chevron-right", tl!("Next view"), crate::commands::NEXT_VIEW, !view.forward.is_empty()),
-                        (false, "chevron-left", tl!("Previous view"), crate::commands::PREV_VIEW, !view.back.is_empty()),
-                    ] {
-                        let tip = format!("{label} ({})", crate::commands::shortcut_label(ui.ctx(), shortcut));
-                        if ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, 30.0, false, &tip)).inner.clicked() {
-                            view.view_history(forward);
-                        }
-                    }
-                    let font = theme::regular(11.0);
-                    let mut position = page_position(view.current, page_count, labels.get(view.current).map_or("", String::as_str));
-                    if widgets::text_width(ui, &position, &font) > ui.available_width() {
-                        position = page_count.to_string();
-                    }
-                    // Out of range (an empty document), like `page_position`: "Page 0 of 0", never past the end.
-                    let shown = if view.current < page_count { view.current + 1 } else { page_count };
-                    let of = crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &shown.to_string()), ("n", &page_count.to_string())]);
-                    ui.label(egui::RichText::new(position).font(font).color(t.text_muted)).on_hover_text(of);
-                    let page_input_id = view.page_input_id();
-                    // Consume replacement selection once, including when the editor has lost focus.
-                    let reselect = std::mem::take(&mut view.page_input_reselect);
-                    // Navigation updates the idle display, never the text being edited.
-                    if !ui.memory(|m| m.has_focus(page_input_id)) {
-                        view.page_input = view.current_page_label(labels.get(view.current).map(String::as_str));
-                    } else if reselect {
-                        // The replacement changed the label while egui retained this editor's cursor.
-                        let mut state = egui::TextEdit::load_state(ui.ctx(), page_input_id).unwrap_or_default();
-                        let end = egui::text::CCursor::new(view.page_input.chars().count());
-                        state.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(0), end)));
-                        state.store(ui.ctx(), page_input_id);
-                    }
-                    let edit = egui::TextEdit::singleline(&mut view.page_input)
-                        .id(page_input_id)
-                        .desired_width(34.0)
-                        .horizontal_align(Align::Center)
-                        .font(theme::medium(12.0))
-                        .margin(vec2(2.0, 4.0));
-                    let r = egui::Frame::NONE
-                        .fill(t.field)
-                        .stroke(Stroke::new(1.0, t.border))
-                        .corner_radius(CornerRadius::same(5))
-                        .show(ui, |ui| ui.add(edit))
-                        .inner
-                        .on_hover_text(tl!("Current page — type a page number or label (such as iv) and press Enter"));
-                    if r.lost_focus() {
-                        if ui.input(|i| i.key_pressed(egui::Key::Enter)) {
-                            // A page label first (logical page numbers, as Acrobat), then a number.
-                            let typed = view.page_input.clone();
-                            view.go_to_typed(&typed, &labels);
-                        }
-                        view.page_input = view.current_page_label(labels.get(view.current).map(String::as_str));
-                    }
-                });
-            });
-            egui::ScrollArea::vertical().id_salt("rail-panels").show(ui, |ui| {
-                ui.spacing_mut().item_spacing.y = 4.0;
-                let mut rail_button = |ui: &mut egui::Ui, panel: RightPanel, icon: &str, tip: &str, has: bool| {
-                    let selected = app.right == Some(panel) && (app.mode == Mode::Read || app.docking.exposed(crate::docking::Panel::Inspector));
-                    let r = icons::button(ui, icon, 34.0, selected, tl!(tip));
-                    if has && !selected {
-                        let c = r.rect.right_top() + vec2(-8.0, 8.0);
-                        ui.painter().circle_filled(c, 3.0, t.accent);
-                    }
-                    if r.clicked() {
-                        app.choose_right_panel(if selected { None } else { Some(panel) });
-                    }
-                };
-                rail_button(ui, RightPanel::Comments, "message-square-text", "Comments", has_comments);
-                rail_button(ui, RightPanel::Bookmarks, "bookmark", "Bookmarks", has_outline);
-                rail_button(ui, RightPanel::Pages, "files", "Page thumbnails", false);
-                rail_button(ui, RightPanel::Fields, "text-cursor-input", "Form fields", has_fields);
-                rail_button(ui, RightPanel::Layers, "layers", "Layers", has_layers);
-                rail_button(ui, RightPanel::Attachments, "paperclip", "Attachments", has_files);
-                rail_button(ui, RightPanel::Signatures, "signature", "Signatures", has_signatures);
-                if has_check {
-                    rail_button(ui, RightPanel::Accessibility, "accessibility", "Accessibility Checker", false);
+                    view.page_input = view.current_page_label(labels.get(view.current).map(String::as_str));
                 }
-                rail_button(ui, RightPanel::Tags, "tag", "Tags", false);
             });
-            if let Some(id) = page_display {
-                app.execute(id);
-            }
         });
+    match rail.request {
+        Some(RailRequest::Open(panel)) => app.choose_right_panel(Some(panel)),
+        Some(RailRequest::Close(_)) => app.choose_right_panel(None),
+        _ => {}
+    }
+    if let Some(id) = page_display {
+        app.execute(id);
+    }
 }
 
 /// What the rail shows under the page box: the page count, or, when the current page's label is
@@ -820,7 +709,7 @@ fn page_position(current: usize, count: usize, label: &str) -> String {
     if label.is_empty() || label == number || current >= count { count.to_string() } else { format!("{number}/{count}") }
 }
 
-/// View ▸ Page display and the rail's Page display menu: the layouts and the cover page.
+/// The rail's Page display menu: the layouts and the cover page (also View ▸ Page display).
 /// Returns the command a click asks for, for the caller to run.
 fn page_display_menu(ui: &mut egui::Ui, view: &DocView) -> Option<&'static str> {
     let t = Tokens::get(ui.ctx());
diff --git a/crates/ui-egui/src/combine_grid.rs b/crates/ui-egui/src/combine_grid.rs
deleted file mode 100644
index ee3b03f698..0000000000
--- a/crates/ui-egui/src/combine_grid.rs
+++ /dev/null
@@ -1,1698 +0,0 @@
-//! Combine files as a grid: a thumbnail of the first page each file contributes, drawn as a
-//! stack when it contributes more than one, with its name below. Cards are selected and moved
-//! with the same [`RowAction`]s as the table's rows, so both views share the selection, the
-//! order and the undo history.
-//!
-//! Thumbnails render off the UI thread through [`RenderPool`] (its panic guard, size caps and
-//! watchdog), one small pool per thumbnail. Only missing ones are asked for, those in view first.
-//! At most [`MAX_THREADS`] render threads exist at once, counted as threads, not pools: the pools
-//! start no watchdog replacements ([`RenderPool::without_replacements`]), and a pool's threads
-//! count until they have actually exited ([`RenderPool::retire`]), so a render the watchdog gave
-//! up on, or one whose file left the list, holds its place until its thread is gone. A thread
-//! stuck for good in one step that can't be interrupted keeps its place for good: threads can't
-//! be killed safely. On the web the pool renders on the UI thread inside `try_recv`, with no
-//! watchdog: there, at most one thumbnail per frame, only one waits at a time (its pool holds the
-//! parsed document), and a very slow page still stalls that frame (as in the document view).
-
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use egui::{Align2, Color32, CornerRadius, Rect, Sense, Stroke, TextureHandle, Vec2, pos2, vec2};
-use pdfcraft_render::{RenderConfig, RenderPool, RenderRequest, Retiring};
-
-use crate::PdfCraftApp;
-use crate::combine_ui::{CombineFile, ERROR, Lock, RowAction, WARNING};
-use crate::icons;
-use crate::theme::{self, Tokens};
-
-/// Render threads for thumbnails at once, counting those of retired pools until they exit.
-const MAX_THREADS: usize = 3;
-/// Results taken per frame, and the bytes they may upload.
-const UPLOADS_PER_FRAME: usize = 4;
-const UPLOAD_BYTES_PER_FRAME: usize = 8 << 20;
-/// Thumbnail textures kept, in bytes. Those out of view go first, longest unseen first; those in
-/// view are kept even over budget (at most a screenful of thumbnails of at most [`MAX_SIDE`]).
-const TEXTURE_BUDGET: usize = 32 << 20;
-/// The longest side of a thumbnail, in pixels.
-/// (Room for a Letter page at 500% on a screen of 1.5 pixels per point; sharper screens upscale a
-/// little at the largest sizes.) This only binds near the top of the zoom range: a card below it
-/// asks for less than this and costs no more than it did. Near the top one thumbnail is a few
-/// megabytes, so [`TEXTURE_BUDGET`] and [`UPLOAD_BYTES_PER_FRAME`] keep the cache at a screenful
-/// plus one frame's uploads — and at the top of the range a screenful is a card or two, because a
-/// card is wider than most windows.
-const MAX_SIDE: f32 = 1536.0;
-/// Thumbnail sizes round up to this many pixels, so a slightly different layout reuses them.
-const SIZE_STEP: u32 = 16;
-/// The box a page is fitted in at 100%, and the room the card adds around it (for the hover bar
-/// and the stack above it, the name and a note below), which doesn't scale.
-const PAPER: Vec2 = vec2(132.0, 172.0);
-const AROUND: Vec2 = vec2(52.0, 90.0);
-/// From the top of a card to its page box: room for the hover bar, which sits mostly above the
-/// page.
-const ABOVE: f32 = 32.0;
-/// The hover bar's height; a quarter of it overlaps the page.
-const BAR_H: f32 = 34.0;
-/// The grid's zoom range, and the sizes its buttons and keys step through (the slider, the wheel
-/// and a pinch go anywhere between).
-pub(crate) const ZOOM_RANGE: std::ops::RangeInclusive<f32> = 0.6..=5.0;
-const ZOOM_STEPS: [f32; 11] = [0.6, 0.8, 1.0, 1.25, 1.5, 1.75, 2.0, 2.5, 3.0, 4.0, 5.0];
-
-/// The next size up (or down) from `zoom`; the end of the range stays put.
-pub(crate) fn zoom_step(zoom: f32, larger: bool) -> f32 {
-    let next =
-        if larger { ZOOM_STEPS.iter().copied().find(|s| *s > zoom + 0.001) } else { ZOOM_STEPS.iter().rev().copied().find(|s| *s < zoom - 0.001) };
-    next.unwrap_or(if larger { *ZOOM_RANGE.end() } else { *ZOOM_RANGE.start() })
-}
-/// Space above the first row of cards.
-const TOP: f32 = 12.0;
-/// A thumbnail's place: the file (by id) and the page (0-based, in the file). A file's card and
-/// the card of its first page when expanded show the same thumbnail.
-type Slot = (u64, usize);
-/// The page shown large (a card's magnifier) is kept beside the thumbnails under this slot, so it
-/// shares their threads, their limits and their checks.
-const PREVIEW: Slot = (u64::MAX, 0);
-/// The longest side of the page shown large, in pixels.
-const PREVIEW_SIDE: f32 = 2048.0;
-/// A file whose render is done keeps its document open this long (seconds), so the next page of
-/// the same file renders without reading the whole file again.
-const KEEP_OPEN: f64 = 2.0;
-/// The most pages one file can be spread out into (each is a card, laid out every frame).
-pub(crate) const MAX_EXPAND: usize = 2000;
-/// The shape drawn for a page whose size is unknown (US Letter); nothing is rendered for it.
-const FALLBACK_PAGE: (f32, f32) = (612.0, 792.0);
-/// Icons drawn on the (always white) paper, in either theme: the light theme's muted text, which
-/// keeps its contrast on white where the dark theme's doesn't.
-const ON_PAPER: Color32 = Color32::from_rgb(0x5E, 0x5E, 0x66);
-
-/// What the grid has for a file (tests and the control channel).
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum ThumbState {
-    /// Nothing yet: not in view, or nothing to draw (locked, unreadable, a bad page range, a page
-    /// whose size is unknown).
-    None,
-    /// Being rendered.
-    Pending,
-    /// A thumbnail of page `page` (0-based), `width` × `height` pixels.
-    Ready { page: usize, width: u32, height: u32 },
-    /// The page couldn't be drawn.
-    Failed(String),
-}
-
-/// A card being dragged: which file, and the list as it was (see [`RowAction::DropAt`]).
-#[derive(Clone, Copy)]
-struct GridDrag {
-    file: u64,
-    revision: u64,
-    /// A page card's page (entry id, place among its pages): that page moves, not its file.
-    page: Option<(u64, usize)>,
-}
-
-/// Everything a thumbnail depends on: the file's bytes, how it was read (its password), the page
-/// and the size. A cached thumbnail is used only while all of them still match.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-struct Key {
-    /// The address of the file's shared bytes: the same file, even after undo brings it back.
-    source: usize,
-    auth: u64,
-    page: usize,
-    px: [u32; 2],
-}
-
-impl Key {
-    fn same_page(&self, other: &Key) -> bool {
-        (self.source, self.auth, self.page) == (other.source, other.auth, other.page)
-    }
-}
-
-struct Entry {
-    key: Key,
-    tex: Option<TextureHandle>,
-    error: Option<String>,
-    /// The frame the card last showed it.
-    seen: u64,
-    bytes: usize,
-}
-
-struct Job {
-    slot: Slot,
-    key: Key,
-    pool: RenderPool,
-    tag: u64,
-}
-
-/// A pool whose render is done, with its document still open: kept a moment for the next page of
-/// the same file, read the same way.
-struct Open {
-    source: usize,
-    auth: u64,
-    pool: RenderPool,
-    /// When its render finished (seconds).
-    since: f64,
-}
-
-/// A thumbnail a card needs this frame.
-struct Want {
-    slot: Slot,
-    key: Key,
-    bytes: Arc<Vec<u8>>,
-    password: Option<Arc<str>>,
-    scale: f32,
-    visible: bool,
-}
-
-/// The grid's thumbnails and the renders under way.
-#[derive(Default)]
-pub(crate) struct Thumbs {
-    entries: HashMap<Slot, Entry>,
-    jobs: Vec<Job>,
-    /// Pools done rendering, their documents still open (their threads count).
-    open: Vec<Open>,
-    /// Threads of pools let go of, until they exit.
-    retiring: Vec<Retiring>,
-    frame: u64,
-    next_tag: u64,
-    wants: Vec<Want>,
-    /// Render on the UI thread, as the web build does (tests).
-    #[cfg(test)]
-    inline: bool,
-}
-
-/// What a card can draw now.
-enum Look {
-    Ready(egui::TextureId),
-    Failed(String),
-    /// Not ready; an older thumbnail of the same page may stand in.
-    Pending(Option<egui::TextureId>),
-}
-
-impl Thumbs {
-    /// Forget every thumbnail (the tab closed). Renders under way are let go of: told to stop at
-    /// their next drawing operator, and counted until their threads exit.
-    pub(crate) fn clear(&mut self) {
-        self.entries.clear();
-        self.wants.clear();
-        for job in self.jobs.drain(..) {
-            self.retiring.push(job.pool.retire());
-        }
-        for open in self.open.drain(..) {
-            self.retiring.push(open.pool.retire());
-        }
-    }
-
-    /// Render threads that exist now (real threads, not pools): those of pools at work, of pools
-    /// keeping a document open, and of pools let go of.
-    fn threads(&mut self) -> usize {
-        self.retiring.retain_mut(|r| r.running() > 0);
-        let retiring: usize = self.retiring.iter_mut().map(Retiring::running).sum();
-        let working: usize = self.jobs.iter().map(|j| j.pool.threads()).sum();
-        let open: usize = self.open.iter().map(|o| o.pool.threads()).sum();
-        working.saturating_add(open).saturating_add(retiring)
-    }
-
-    fn look(&mut self, slot: Slot, key: Key) -> Look {
-        let frame = self.frame;
-        match self.entries.get_mut(&slot) {
-            Some(e) if e.key == key => {
-                e.seen = frame;
-                match (&e.tex, &e.error) {
-                    (Some(tex), _) => Look::Ready(tex.id()),
-                    (None, Some(err)) => Look::Failed(err.clone()),
-                    (None, None) => Look::Pending(None),
-                }
-            }
-            // Another size of the same page stands in until this one arrives. A page that failed
-            // isn't tried again at another size: it would fail (or hang) the same way, each zoom.
-            Some(e) if e.key.same_page(&key) => {
-                e.seen = frame;
-                match &e.error {
-                    Some(err) if e.tex.is_none() => Look::Failed(err.clone()),
-                    _ => Look::Pending(e.tex.as_ref().map(TextureHandle::id)),
-                }
-            }
-            _ => Look::Pending(None),
-        }
-    }
-
-    fn state(&self, slot: Slot) -> ThumbState {
-        if let Some(e) = self.entries.get(&slot) {
-            if let Some(tex) = &e.tex {
-                let [w, h] = tex.size();
-                return ThumbState::Ready {
-                    page: e.key.page,
-                    width: u32::try_from(w).unwrap_or(u32::MAX),
-                    height: u32::try_from(h).unwrap_or(u32::MAX),
-                };
-            }
-            if let Some(err) = &e.error {
-                return ThumbState::Failed(err.clone());
-            }
-        }
-        if self.jobs.iter().any(|j| j.slot == slot) { ThumbState::Pending } else { ThumbState::None }
-    }
-
-    /// Once per frame, whatever shows: drop what no longer matches the list, take finished
-    /// renders, start those the grid asked for and keep the textures within budget. `current`
-    /// says what a thumbnail must match now (looked up, so the cost follows the files and the
-    /// thumbnails kept, not the pages of an expanded file).
-    fn finish(&mut self, ctx: &egui::Context, current: &dyn Fn(Slot) -> Option<Key>) {
-        let now = ctx.input(|i| i.time);
-        // Reconcile with the list as it is now (undo, redo, unlock, a new range, removal): a
-        // thumbnail of another page, password or file is never shown again.
-        self.entries.retain(|slot, e| current(*slot).is_some_and(|k| k.same_page(&e.key)));
-        // Renders nobody wants any more are let go of now (on the web, before they would render).
-        let (keep, gone): (Vec<Job>, Vec<Job>) = self.jobs.drain(..).partition(|job| current(job.slot).is_some_and(|k| k.same_page(&job.key)));
-        self.jobs = keep;
-        self.retiring.extend(gone.into_iter().map(|job| job.pool.retire()));
-        // Documents kept open past their time are closed.
-        let (keep, gone): (Vec<Open>, Vec<Open>) = self.open.drain(..).partition(|o| now - o.since < KEEP_OPEN);
-        self.open = keep;
-        self.retiring.extend(gone.into_iter().map(|o| o.pool.retire()));
-
-        // Finished renders, a few per frame. A pool without threads (the web) renders inside
-        // `try_recv`: at most one of those per frame.
-        let gpu_side = ctx.input(|i| i.max_texture_side);
-        let max_side = gpu_side.min(2 * MAX_SIDE as usize);
-        let (mut taken, mut uploaded, mut inline_used) = (0usize, 0usize, false);
-        let mut i = 0;
-        while i < self.jobs.len() {
-            if taken >= UPLOADS_PER_FRAME || uploaded >= UPLOAD_BYTES_PER_FRAME {
-                break;
-            }
-            let Some(job) = self.jobs.get(i) else { break };
-            if job.pool.is_inline() {
-                if inline_used {
-                    i += 1;
-                    continue;
-                }
-                inline_used = true;
-            }
-            // Not done yet, or not this job's answer (cannot happen with one request per pool):
-            // keep waiting. A pool without threads answers on the call that renders, so there no
-            // answer is one that never comes: the thumbnail fails rather than hold up the rest.
-            let answer = job.pool.try_recv().filter(|out| out.request.tag == job.tag);
-            if answer.is_none() && !job.pool.is_inline() {
-                i += 1;
-                continue;
-            }
-            let job = self.jobs.swap_remove(i);
-            taken += 1;
-            // A pool that rendered (rather than failed or hung) can keep its document open.
-            let healthy = answer.as_ref().is_some_and(|out| out.error.is_none());
-            let failed = |e: String| Entry { key: job.key, tex: None, error: Some(e), seen: self.frame, bytes: 0 };
-            let entry = match answer {
-                None => failed("the page wasn't drawn".to_owned()),
-                Some(out) => match out.error {
-                    Some(e) => failed(e),
-                    None => match texture(
-                        ctx,
-                        job.slot,
-                        [out.width, out.height],
-                        out.rgba,
-                        if job.slot == PREVIEW { gpu_side.min(PREVIEW_SIDE as usize) } else { max_side },
-                    ) {
-                        Ok((tex, bytes)) => {
-                            uploaded = uploaded.saturating_add(bytes);
-                            Entry { key: job.key, tex: Some(tex), error: None, seen: self.frame, bytes }
-                        }
-                        Err(e) => failed(e),
-                    },
-                },
-            };
-            self.entries.insert(job.slot, entry);
-            // Its document stays open a moment for the file's next page (its thread, idle, still
-            // counts); otherwise its thread (idle, or finishing a render the watchdog gave up on)
-            // counts until it exits.
-            if healthy && job.pool.threads() <= 1 && self.open.len() < MAX_THREADS {
-                self.open.push(Open { source: job.key.source, auth: job.key.auth, pool: job.pool, since: now });
-            } else {
-                self.retiring.push(job.pool.retire());
-            }
-        }
-
-        // New renders: the cards in view first, in grid order; one per thumbnail at a time.
-        let mut wants = std::mem::take(&mut self.wants);
-        wants.sort_by_key(|w| (w.slot != PREVIEW, !w.visible));
-        // A pool without threads (the web) parses its document when it is made and keeps it until
-        // it renders, one per frame: while one waits, nothing else starts.
-        // (Nor in the frame that rendered one: one heavy step per frame on the UI thread.)
-        let mut threads = if inline_used || self.jobs.iter().any(|j| j.pool.is_inline()) { MAX_THREADS } else { self.threads() };
-        let mut waiting = false;
-        for w in wants {
-            // Wanted for the list as it is now (not changed by this frame's action); one render
-            // per thumbnail at a time; and a want made earlier this frame may have just been
-            // answered.
-            if current(w.slot).is_none_or(|k| !k.same_page(&w.key))
-                || self.jobs.iter().any(|j| j.slot == w.slot)
-                || self.entries.get(&w.slot).is_some_and(|e| e.key == w.key)
-            {
-                continue;
-            }
-            // The same file, read the same way, still open from a render just done: no new read of
-            // the file (and its thread is already counted). On the web, not while another waits.
-            let inline_waiting = self.jobs.iter().any(|j| j.pool.is_inline());
-            if let Some(k) =
-                self.open.iter().position(|o| o.source == w.key.source && o.auth == w.key.auth && !(o.pool.is_inline() && inline_waiting))
-            {
-                let pool = self.open.swap_remove(k).pool;
-                self.next_tag = self.next_tag.wrapping_add(1);
-                let tag = self.next_tag;
-                pool.set_queue(vec![RenderRequest { page: w.key.page, scale: w.scale, tag, ..Default::default() }]);
-                if pool.is_inline() {
-                    threads = MAX_THREADS;
-                }
-                self.jobs.push(Job { slot: w.slot, key: w.key, pool, tag });
-                continue;
-            }
-            if threads >= MAX_THREADS {
-                // A document kept open for another file gives its thread up: it exits, and this
-                // starts then.
-                if let Some(k) = self.open.iter().enumerate().min_by(|(_, a), (_, b)| a.since.total_cmp(&b.since)).map(|(k, _)| k) {
-                    let open = self.open.swap_remove(k);
-                    self.retiring.push(open.pool.retire());
-                }
-                waiting = true;
-                break;
-            }
-            let config = RenderConfig { password: w.password, ..Default::default() };
-            #[cfg(test)]
-            let pool = if self.inline { RenderPool::new_inline(w.bytes, config) } else { RenderPool::new(w.bytes, 1, config).without_replacements() };
-            #[cfg(not(test))]
-            let pool = RenderPool::new(w.bytes, 1, config).without_replacements();
-            self.next_tag = self.next_tag.wrapping_add(1);
-            let tag = self.next_tag;
-            // The request stays in the pool's queue (it is never replaced) until its answer.
-            pool.set_queue(vec![RenderRequest { page: w.key.page, scale: w.scale, tag, ..Default::default() }]);
-            threads = if pool.is_inline() { MAX_THREADS } else { threads.saturating_add(1) };
-            self.jobs.push(Job { slot: w.slot, key: w.key, pool, tag });
-        }
-
-        // Within budget: drop the thumbnails out of view longest unseen first.
-        // (The page shown large has its own: one texture, gone when it closes.)
-        let mut total: usize = self.entries.iter().filter(|(f, _)| **f != PREVIEW).map(|(_, e)| e.bytes).sum();
-        if total > TEXTURE_BUDGET {
-            let mut old: Vec<(u64, Slot, usize)> = self
-                .entries
-                .iter()
-                .filter(|(f, e)| **f != PREVIEW && e.seen != self.frame && e.bytes > 0)
-                .map(|(f, e)| (e.seen, *f, e.bytes))
-                .collect();
-            old.sort_unstable();
-            for (_, slot, bytes) in old {
-                if total <= TEXTURE_BUDGET {
-                    break;
-                }
-                self.entries.remove(&slot);
-                total = total.saturating_sub(bytes);
-            }
-        }
-
-        // The cards were drawn before these results arrived: draw them again. Keep polling while
-        // renders are under way, and while a thumbnail waits for a thread to exit (not when
-        // nothing waits: a thread exiting changes nothing on screen).
-        if taken > 0 || self.jobs.iter().any(|j| j.pool.is_inline()) {
-            ctx.request_repaint();
-        } else if !self.jobs.is_empty() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(16));
-        } else if waiting {
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        } else if !self.open.is_empty() {
-            // To close the documents kept open when their time is up.
-            ctx.request_repaint_after(std::time::Duration::from_secs_f64(KEEP_OPEN));
-        }
-        self.frame = self.frame.wrapping_add(1);
-    }
-}
-
-/// A rendered thumbnail as a texture, and its size in bytes. A raster that doesn't add up, or is
-/// larger than a thumbnail can be (or than the GPU accepts), is refused, never uploaded.
-fn texture(
-    ctx: &egui::Context,
-    slot: Slot,
-    size: [u32; 2],
-    pixels: pdfcraft_render::Pixels,
-    max_side: usize,
-) -> Result<(TextureHandle, usize), String> {
-    let [w, h] = size.map(|v| v as usize);
-    if w == 0 || h == 0 || w > max_side || h > max_side {
-        return Err(format!("the thumbnail came back {w}×{h} pixels"));
-    }
-    let bytes = w.checked_mul(h).and_then(|p| p.checked_mul(4)).ok_or("the thumbnail is too large")?;
-    if pixels.len() != bytes {
-        return Err("the thumbnail came back incomplete".to_owned());
-    }
-    let image = crate::canvas::texture_image([w, h], pixels);
-    Ok((ctx.load_texture(format!("combine-thumb-{}-{}", slot.0, slot.1), image, egui::TextureOptions::LINEAR), bytes))
-}
-
-/// `name` shortened in the middle to what `fits`, keeping its extension ("Pilot Boat Ad….pdf").
-pub(crate) fn fit_name(name: &str, fits: impl Fn(&str) -> bool) -> String {
-    if fits(name) {
-        return name.to_owned();
-    }
-    // A short extension after the last dot (a dot is one byte, so these are char boundaries).
-    let split = name.rfind('.').filter(|p| *p > 0 && name.len() - p <= 6);
-    let (stem, ext) = match split {
-        Some(p) => (name.get(..p).unwrap_or(name), name.get(p..).unwrap_or("")),
-        None => (name, ""),
-    };
-    let chars: Vec<char> = stem.chars().collect();
-    let with = |n: usize| format!("{}…{ext}", chars.iter().take(n).collect::<String>());
-    // The longest start of the stem that fits, found by halving.
-    let (mut lo, mut hi) = (0usize, chars.len());
-    while lo < hi {
-        let mid = lo + (hi - lo).div_ceil(2);
-        if fits(&with(mid)) { lo = mid } else { hi = mid - 1 }
-    }
-    with(lo)
-}
-
-/// The box a page is fitted in at `zoom` (clamped to [`ZOOM_RANGE`]).
-fn paper_box(zoom: f32) -> Vec2 {
-    let zoom = if zoom.is_finite() { zoom.clamp(*ZOOM_RANGE.start(), *ZOOM_RANGE.end()) } else { 1.0 };
-    PAPER * zoom
-}
-
-/// The size to draw a page of `w` × `h` points in `fit`; `None` for a size that isn't one.
-fn paper_size(w: f32, h: f32, fit: Vec2) -> Option<Vec2> {
-    if !(w.is_finite() && h.is_finite() && w > 0.0 && h > 0.0) {
-        return None;
-    }
-    let s = (fit.x / w).min(fit.y / h);
-    s.is_finite().then(|| vec2(w * s, h * s))
-}
-
-/// How many cards of `cell` fit across `width` (at least one).
-fn columns_in(width: f32, cell: Vec2) -> usize {
-    ((width - 16.0) / cell.x).floor().max(1.0) as usize
-}
-
-/// What one place in the grid shows: a file's card, or (the file expanded) one of the pages it
-/// adds.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) struct Cell {
-    /// The file, by its place in the list.
-    pub(crate) file: usize,
-    /// For a page: its place among the pages the file adds, the page (0-based, in the file) and
-    /// how many it adds.
-    pub(crate) page: Option<(usize, usize, usize)>,
-}
-
-/// The pages an expanded file shows: in its range's order, and sorted (to look one up), for the
-/// range and page count they were worked out for.
-#[derive(Clone, Debug)]
-pub(crate) struct PageList {
-    of: (String, usize),
-    pub(crate) order: Arc<[usize]>,
-    sorted: Arc<[usize]>,
-}
-
-/// The pages an expanded file shows, worked out again only when its range or page count
-/// changes; `None` when it can't be shown as its pages (locked, unreadable, a bad range, no page,
-/// or more than [`MAX_EXPAND`]).
-pub(crate) fn pages_shown(cache: &mut HashMap<u64, PageList>, f: &CombineFile) -> Option<PageList> {
-    if f.lock.is_some() || f.problem.is_some() {
-        return None;
-    }
-    let list = match cache.get(&f.id) {
-        Some(list) if list.of.0 == f.range && list.of.1 == f.pages => list.clone(),
-        _ => {
-            let order = f.pages_taken().ok()?;
-            let mut sorted = order.clone();
-            sorted.sort_unstable();
-            let list = PageList { of: (f.range.clone(), f.pages), order: Arc::from(order), sorted: Arc::from(sorted) };
-            cache.insert(f.id, list.clone());
-            list
-        }
-    };
-    // (One page shows as a page card too: a file split into parts may leave one page in a part.)
-    (!list.order.is_empty() && list.order.len() <= MAX_EXPAND).then_some(list)
-}
-
-/// The grid's places, in order: each file's card, or its pages when it is expanded.
-fn layout(app: &mut PdfCraftApp) -> Vec<Cell> {
-    let tab = &mut app.combine_tab;
-    let mut cells = Vec::with_capacity(app.combine_draft.len());
-    for (file, f) in app.combine_draft.iter().enumerate() {
-        match tab.expanded.contains(&f.id).then(|| pages_shown(&mut tab.page_lists, f)).flatten() {
-            Some(list) => {
-                let of = list.order.len();
-                cells.extend(list.order.iter().enumerate().map(|(nth, &page)| Cell { file, page: Some((nth, page, of)) }));
-            }
-            None => cells.push(Cell { file, page: None }),
-        }
-    }
-    cells
-}
-
-/// The file gap (0 = before the first file, n = after the last) a drop before place `at` means: a
-/// drop inside an expanded file's pages goes to the nearer end of that file.
-fn file_gap(cells: &[Cell], at: usize, files: usize) -> usize {
-    match cells.get(at) {
-        None => files,
-        Some(Cell { file, page: Some((nth, _, of)) }) if *nth > 0 => {
-            if nth.saturating_mul(2) < *of {
-                *file
-            } else {
-                file.saturating_add(1)
-            }
-        }
-        Some(c) => c.file,
-    }
-}
-
-/// The grid of files, in the card that holds the list. Returns what the user did.
-pub(crate) fn grid(
-    app: &mut PdfCraftApp,
-    ui: &mut egui::Ui,
-    t: &Tokens,
-    checks: &[Result<usize, String>],
-    selected: &[bool],
-    twice: &[bool],
-) -> Option<RowAction> {
-    let ctx = ui.ctx().clone();
-    let ppp = ctx.pixels_per_point();
-    let mut action = None;
-    let revision = app.combine_tab.revision;
-    let drag = egui::DragAndDrop::payload::<GridDrag>(&ctx).map(|d| *d);
-    // The card dragged may scroll out of the rows drawn, so its release is watched here.
-    let released = drag.is_some() && ctx.input(|i| i.pointer.any_released());
-    let n = app.combine_draft.len();
-    let places = layout(app);
-    // Each file's first place (for the keys and to scroll to it).
-    let mut first_place = vec![0usize; n];
-    for (at, c) in places.iter().enumerate().rev() {
-        if let Some(slot) = first_place.get_mut(c.file) {
-            *slot = at;
-        }
-    }
-    app.combine_tab.grid_places = places.iter().map(|c| c.file).collect();
-    // Pages counted over the list (an entry that can't be split counting as one, see
-    // `moved_pages`): where each place's pages start, for a page dropped before it.
-    let counts: Vec<usize> = app
-        .combine_draft
-        .iter_mut()
-        .map(|f| if f.lock.is_none() && f.problem.is_none() { f.selection().ok().filter(|k| *k > 0).unwrap_or(1) } else { 1 })
-        .collect();
-    let mut page_at = Vec::with_capacity(places.len());
-    let mut total_pages = 0usize;
-    for c in &places {
-        page_at.push(total_pages);
-        total_pages = total_pages.saturating_add(if c.page.is_some() { 1 } else { counts.get(c.file).copied().unwrap_or(1) });
-    }
-    let picked_pages = app.combine_tab.selected_pages.clone();
-    let reveal = app.combine_tab.reveal.take();
-    let fit = paper_box(app.combine_zoom);
-    let cell = fit + AROUND;
-    let mut cells: Vec<(usize, Rect)> = Vec::new();
-    let viewport = ui.available_rect_before_wrap();
-    let pointer = ctx.pointer_latest_pos();
-    let files = &mut app.combine_draft;
-    let thumbs = &mut app.combine_thumbs;
-    let columns = &mut app.combine_tab.grid_columns;
-
-    // Over the grid itself, not over a menu or dialog above it.
-    let over_grid = ui.rect_contains_pointer(viewport);
-    let mut width = viewport.width();
-    let mut focused_card = None;
-    let output = egui::ScrollArea::vertical().id_salt("combine-grid").auto_shrink([false, false]).show_viewport(ui, |ui, clip| {
-        // Dragging near the top or bottom edge scrolls.
-        if drag.is_some()
-            && let Some(p) = pointer
-            && viewport.contains(p)
-        {
-            let edge = 40.0;
-            let delta = if p.y < viewport.top() + edge {
-                12.0
-            } else if p.y > viewport.bottom() - edge {
-                -12.0
-            } else {
-                0.0
-            };
-            if delta != 0.0 {
-                ui.scroll_with_delta(vec2(0.0, delta));
-                ctx.request_repaint();
-            }
-        }
-        ui.add_space(TOP);
-        width = ui.available_width();
-        let cols = columns_in(width, cell);
-        *columns = cols;
-        let rows = places.len().div_ceil(cols);
-        let left = ((width - cols as f32 * cell.x) / 2.0).max(0.0);
-        let (area, _) = ui.allocate_exact_size(vec2(width, rows as f32 * cell.y), Sense::hover());
-        let cell_rect = |i: usize| {
-            let (row, col) = (i / cols, i % cols);
-            Rect::from_min_size(pos2(area.left() + left + col as f32 * cell.x, area.top() + row as f32 * cell.y), cell)
-        };
-        if let Some(i) = reveal.and_then(|id| files.iter().position(|f| f.id == id)) {
-            ui.scroll_to_rect(cell_rect(first_place.get(i).copied().unwrap_or(0)), None);
-        }
-        for row in crate::canvas::thumbnail_rows(clip.top() - TOP, clip.bottom() - TOP, cell.y, rows) {
-            let first = row.saturating_mul(cols);
-            let in_row = places.get(first..first.saturating_add(cols).min(places.len())).unwrap_or_default();
-            // An expanded file's pages on this row share a tinted band, so they read as one file.
-            let mut run = 0;
-            while run < in_row.len() {
-                let Some(start) = in_row.get(run).copied() else { break };
-                let mut end = run;
-                while in_row.get(end.saturating_add(1)).is_some_and(|c| c.file == start.file && c.page.is_some()) {
-                    end = end.saturating_add(1);
-                }
-                if start.page.is_some() {
-                    let band = cell_rect(first.saturating_add(run)).union(cell_rect(first.saturating_add(end))).shrink2(vec2(2.0, 4.0));
-                    ui.painter().rect_filled(band, CornerRadius::same(10), t.accent_soft.gamma_multiply(0.45));
-                }
-                run = end.saturating_add(1);
-            }
-            for (col, place) in in_row.iter().enumerate() {
-                let i = first.saturating_add(col);
-                let Some(f) = files.get_mut(place.file) else { break };
-                let c = cell_rect(i);
-                cells.push((i, c));
-                let card = Card {
-                    i: place.file,
-                    page: place.page,
-                    rect: c,
-                    check: checks.get(place.file).cloned().unwrap_or(Ok(f.pages)),
-                    selected: selected.get(place.file).copied().unwrap_or(false)
-                        || place.page.is_some_and(|(nth, ..)| picked_pages.contains(&(f.id, nth))),
-                    twice: twice.get(place.file).copied().unwrap_or(false),
-                    revision,
-                    ppp,
-                    fit,
-                };
-                let card_id = card.id(ui, f);
-                if let Some(a) = card.show(ui, t, f, thumbs) {
-                    action = Some(a);
-                }
-                if ui.memory(|m| m.has_focus(card_id)) {
-                    focused_card = Some((card_id, f.id, place.page.map_or(0, |p| p.0)));
-                }
-            }
-        }
-        // While a page card is dragged: the page gap it would go to (any place, between any two
-        // pages), drawn at the nearest card's edge, and how many pages go.
-        if let Some(d) = drag
-            && let Some(page) = d.page
-            && let Some(p) = pointer
-        {
-            let at = crate::canvas::drop_gap(&cells, p);
-            let nearest = cells.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(p).total_cmp(&b.distance_sq_to_pos(p)));
-            if let Some((_, r)) = nearest {
-                let x = if p.x < r.center().x { r.left() + 2.0 } else { r.right() - 2.0 };
-                ui.painter().line_segment([pos2(x, r.top() + 10.0), pos2(x, r.bottom() - 30.0)], Stroke::new(3.0, t.accent));
-            }
-            let moving = if picked_pages.contains(&page) { picked_pages.len() } else { 1 };
-            let label = if moving == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &moving.to_string())]) };
-            ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, label, theme::medium(12.0), t.accent_text);
-            if released
-                && viewport.contains(p)
-                && let Some(at) = at
-            {
-                let gap = page_at.get(at).copied().unwrap_or(total_pages);
-                action = Some(RowAction::MovePages { page, revision: d.revision, gap });
-            }
-        } else if let Some(d) = drag
-            && let Some(p) = pointer
-        {
-            // A file's card: the file gap it would go to, drawn as a bar, and how many files go.
-            let gap = crate::canvas::drop_gap(&cells, p).map(|at| file_gap(&places, at, n));
-            // Drawn at the end of the file before the gap or the start of the one after (an
-            // expanded file's pages are never split), whichever is nearer the pointer.
-            if let Some(gap) = gap {
-                let before = gap
-                    .checked_sub(1)
-                    .and_then(|f| first_place.get(f.saturating_add(1)).map(|next| next.saturating_sub(1)).or(places.len().checked_sub(1)));
-                let after = first_place.get(gap).copied();
-                let ends = [before.map(|at| cell_rect(at).right() - 2.0).zip(before), after.map(|at| cell_rect(at).left() + 2.0).zip(after)];
-                let nearest = ends.into_iter().flatten().min_by(|(xa, a), (xb, b)| {
-                    let da = pos2(*xa, cell_rect(*a).center().y).distance_sq(p);
-                    let db = pos2(*xb, cell_rect(*b).center().y).distance_sq(p);
-                    da.total_cmp(&db)
-                });
-                if let Some((x, at)) = nearest {
-                    let r = cell_rect(at);
-                    ui.painter().line_segment([pos2(x, r.top() + 10.0), pos2(x, r.bottom() - 30.0)], Stroke::new(3.0, t.accent));
-                }
-            }
-            let moving = files
-                .iter()
-                .position(|f| f.id == d.file)
-                .map_or(1, |i| if selected.get(i).copied().unwrap_or(false) { selected.iter().filter(|s| **s).count() } else { 1 });
-            let label = if moving == 1 { tl!("1 file").to_string() } else { crate::i18n::fmt(tl!("{n} files"), &[("n", &moving.to_string())]) };
-            ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, label, theme::medium(12.0), t.accent_text);
-            // Dropped in the grid: there. Anywhere else: nothing moves.
-            if released
-                && viewport.contains(p)
-                && let Some(gap) = gap
-            {
-                action = Some(RowAction::DropAt { file: d.file, revision: d.revision, gap });
-            }
-        }
-    });
-
-    app.combine_tab.card_focus = focused_card.map(|(id, ..)| id);
-    app.combine_tab.card_focus_at = focused_card.map(|(_, file, nth)| (file, nth));
-
-    // Pinch, or Ctrl/⌘ with the wheel, over the grid zooms it.
-    let pinch = crate::motion::zoom_delta(&ctx);
-    if (pinch - 1.0).abs() > 0.001 && over_grid {
-        app.combine_tab.zoom_request = Some(app.combine_zoom * pinch);
-    }
-    // A zoom asked for this frame (toolbar, keys, pinch) applies now the grid has been laid out:
-    // the card under the pointer (or else the first in view) keeps its place on screen. Not while
-    // a card is dragged: the grid under it would change.
-    if let Some(zoom) = app.combine_tab.zoom_request.take()
-        && drag.is_none()
-    {
-        let before = app.combine_zoom;
-        app.set_combine_zoom(zoom);
-        if app.combine_zoom != before {
-            // The same card all through one gesture (a slider drag, a turn of the wheel): the
-            // first in view changes as the cards reflow, and following it would drift. A card is
-            // kept by its file and its place among the file's pages.
-            let now = ctx.input(|i| i.time);
-            let gesture = app.combine_tab.zoom_anchor.filter(|a| now - a.3 < 0.5).and_then(|(id, nth, above, _)| {
-                let file = app.combine_draft.iter().position(|f| f.id == id)?;
-                Some((first_place.get(file)?.saturating_add(nth).min(places.len().saturating_sub(1)), above))
-            });
-            // Cards just outside the view are drawn too (under the toolbar, say): the pointer
-            // counts only over the grid.
-            let under = pointer.filter(|_| over_grid).and_then(|p| cells.iter().find(|(_, r)| r.contains(p)));
-            let anchor = gesture
-                .or_else(|| under.or_else(|| cells.iter().find(|(_, r)| r.bottom() > viewport.top())).map(|(i, r)| (*i, r.top() - viewport.top())));
-            app.combine_tab.zoom_anchor = anchor.and_then(|(i, above)| {
-                let place = places.get(i)?;
-                Some((app.combine_draft.get(place.file)?.id, place.page.map_or(0, |p| p.0), above, now))
-            });
-            if let Some((i, above)) = anchor {
-                // Where it will be: its row at the new size, as far below the top as it is now;
-                // within what can be scrolled to, so zooming out at the bottom shows no gap.
-                let cell = paper_box(app.combine_zoom) + AROUND;
-                let cols = columns_in(width, cell);
-                let content = TOP + places.len().div_ceil(cols) as f32 * cell.y;
-                let y = (TOP + (i / cols) as f32 * cell.y - above).min(content - viewport.height()).max(0.0);
-                // Set as the scroll position itself, before the next frame draws anything: no
-                // jump, and no scroll still animating (to a card revealed by the keys, say) can
-                // carry it elsewhere.
-                let mut state = egui::scroll_area::State::default();
-                state.offset = vec2(0.0, y);
-                state.store(&ctx, output.id);
-            }
-            ctx.request_repaint();
-        }
-    }
-
-    action
-}
-
-/// One card's place and what it shows.
-struct Card {
-    /// The file, by its place in the list.
-    i: usize,
-    /// A page card (the file expanded): its place among the pages the file adds, the page and how
-    /// many it adds. `None` for the file's own card.
-    page: Option<(usize, usize, usize)>,
-    rect: Rect,
-    check: Result<usize, String>,
-    selected: bool,
-    twice: bool,
-    revision: u64,
-    ppp: f32,
-    /// The box the page is fitted in (the zoom).
-    fit: Vec2,
-}
-
-impl Card {
-    fn id(&self, ui: &egui::Ui, f: &CombineFile) -> egui::Id {
-        match self.page {
-            None => ui.id().with(("combine-card", f.id)),
-            Some((nth, ..)) => ui.id().with(("combine-page", f.id, nth)),
-        }
-    }
-
-    fn show(&self, ui: &mut egui::Ui, t: &Tokens, f: &mut CombineFile, thumbs: &mut Thumbs) -> Option<RowAction> {
-        let mut action = None;
-        let c = self.rect;
-        let id = self.id(ui, f);
-        let resp = ui.interact(c.shrink(4.0), id, Sense::click_and_drag());
-        let name = f.name.clone();
-        // A page card: "Page 3", and the file it belongs to.
-        let page_label = self.page.map(|(_, p, _)| crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.saturating_add(1).to_string())]));
-        let label = match &page_label {
-            Some(page) => format!("{page} · {name}"),
-            None => name.clone(),
-        };
-        // As the organize grid's pages: a check box that is on when selected; and, for screen
-        // readers, selected as items in a list are.
-        resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, self.selected, &label));
-        let pages = match self.page {
-            // For screen readers: which page of how many.
-            Some((_, p, _)) => crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &p.saturating_add(1).to_string()), ("n", &f.pages.to_string())]),
-            None if f.pages == 1 => tl!("1 page").to_string(),
-            None => crate::i18n::fmt(tl!("{n} pages"), &[("n", &f.pages.to_string())]),
-        };
-        let painter = ui.painter_at(c);
-
-        // Selected and hovered cards.
-        if self.selected || resp.hovered() {
-            painter.rect_filled(c.shrink(6.0), CornerRadius::same(8), if self.selected { t.accent_soft } else { t.hover });
-        }
-        if self.selected {
-            painter.rect_stroke(c.shrink(6.0), CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
-        }
-
-        // The page, fitted in the paper box (top-aligned, room above for the stack).
-        let page = match self.page {
-            Some((_, p, _)) => Ok(p),
-            None => f.first_page(),
-        };
-        // The page's own size, when it is known and is one.
-        let known = page.as_ref().ok().and_then(|p| f.sizes.get(*p).copied()).filter(|(w, h)| paper_size(*w, *h, self.fit).is_some());
-        let size_pt = known.unwrap_or(FALLBACK_PAGE);
-        let size = paper_size(size_pt.0, size_pt.1, self.fit).unwrap_or(self.fit);
-        let top = c.top() + ABOVE;
-        let paper = Rect::from_min_size(pos2(c.center().x - size.x / 2.0 - 3.0, top + (self.fit.y - size.y)), size);
-        // A file's card that adds more than one page: sheets behind it.
-        let takes = self.check.as_ref().map_or(f.pages, |k| *k);
-        if self.page.is_none() && takes > 1 {
-            for d in [6.0, 3.0] {
-                let sheet = paper.translate(vec2(d, -d));
-                painter.rect_filled(sheet, CornerRadius::ZERO, Color32::WHITE);
-                painter.rect_stroke(sheet, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
-            }
-        }
-        painter.rect_filled(paper.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
-        painter.rect_filled(paper, CornerRadius::ZERO, Color32::WHITE);
-
-        // What goes on the paper: the thumbnail, or why there isn't one.
-        let mut why: Option<(&str, Color32, String)> = None;
-        if let Some(lock) = f.lock {
-            let text = match lock {
-                Lock::Open => tl!("Password-protected"),
-                Lock::Permissions => tl!("Its security settings don't allow copying pages"),
-            };
-            why = Some(("lock", ON_PAPER, text.to_owned()));
-        } else if let Some(p) = &f.problem {
-            why = Some(("circle-x", ERROR, p.clone()));
-        } else {
-            match page {
-                Err(e) => why = Some(("circle-x", ERROR, e)),
-                // The pages couldn't be counted, or the page's size is unknown (some passwords
-                // open a file for combining but not for reading it here): nothing is drawn (the
-                // engine decides at Combine), and the card says so rather than look blank.
-                Ok(p) if p >= f.pages || known.is_none() => why = Some(("eye-off", ON_PAPER, tl!("No preview").to_owned())),
-                Ok(p) => {
-                    // Pixels per point: the size the paper is drawn at, on both sides, and never a
-                    // side longer than a thumbnail's (a long, thin page fits by its long side).
-                    let (w, h) = size_pt;
-                    let scale = (size.x * self.ppp / w).min(size.y * self.ppp / h).min(MAX_SIDE / w.max(h));
-                    let px = [w * scale, h * scale].map(|v| (v.max(1.0).ceil() as u32).div_ceil(SIZE_STEP).saturating_mul(SIZE_STEP));
-                    let key = Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page: p, px };
-                    let look = thumbs.look((f.group, p), key);
-                    let mut want = false;
-                    match look {
-                        Look::Ready(tex) => {
-                            painter.image(tex, paper, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
-                        }
-                        Look::Failed(e) => why = Some(("triangle-alert", WARNING, crate::i18n::fmt(tl!("Preview unavailable: {e}"), &[("e", &e)]))),
-                        Look::Pending(stand_in) => {
-                            if let Some(tex) = stand_in {
-                                painter.image(tex, paper, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
-                            }
-                            want = true;
-                        }
-                    }
-                    if want && scale.is_finite() && scale > 0.0 {
-                        thumbs.wants.push(Want {
-                            slot: (f.group, p),
-                            key,
-                            bytes: f.bytes.clone(),
-                            password: f.password().map(Arc::from),
-                            scale,
-                            visible: ui.is_rect_visible(c),
-                        });
-                    }
-                }
-            }
-        }
-        if let Some((icon, colour, _)) = &why {
-            icons::paint(ui, Rect::from_center_size(paper.center(), Vec2::splat(28.0)), icon, 28.0, *colour);
-        }
-        // For screen readers: the pages, and why no page is shown (otherwise only in the tooltip).
-        let description = match &why {
-            Some((_, _, reason)) => format!("{pages}. {reason}"),
-            None => pages.clone(),
-        };
-        ui.ctx().accesskit_node_builder(id, |node| {
-            node.set_selected(self.selected);
-            node.set_description(description);
-        });
-        painter.rect_stroke(paper, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
-
-        // A warning that doesn't stop it being combined: a badge on the file's card.
-        let warned = self.page.is_none() && (!f.notes.is_empty() || self.twice);
-        if warned && why.as_ref().is_none_or(|(icon, ..)| *icon == "eye-off") {
-            let r = Rect::from_center_size(paper.right_top() + vec2(-2.0, 2.0), Vec2::splat(18.0));
-            painter.circle_filled(r.center(), 10.0, t.card);
-            icons::paint(ui, r, "triangle-alert", 15.0, WARNING);
-        }
-
-        // The name, shortened in the middle to fit, and the pages taken when a range is set; on a
-        // page card, the page first and the file's name below it, smaller.
-        let name_y = top + self.fit.y + 16.0;
-        let max_w = c.width() - 20.0;
-        let (font, colour, y) = match &page_label {
-            Some(page) => {
-                painter.text(pos2(c.center().x, name_y), Align2::CENTER_CENTER, page, theme::semibold(12.5), t.text);
-                (theme::regular(11.5), t.text_muted, name_y + 17.0)
-            }
-            None => (theme::medium(12.5), t.text, name_y),
-        };
-        let fits = |s: &str| painter.layout_no_wrap(crate::bidi::visual(s).into_owned(), font.clone(), colour).size().x <= max_w;
-        let shown = crate::bidi::visual(&fit_name(&f.name, fits)).into_owned();
-        painter.text(pos2(c.center().x, y), Align2::CENTER_CENTER, shown, font, colour);
-        let note = if self.page.is_none() && !f.range.trim().is_empty() {
-            match &self.check {
-                Ok(k) => Some((crate::i18n::fmt(tl!("Pages: {k} of {n}"), &[("k", &k.to_string()), ("n", &f.pages.to_string())]), t.text_muted)),
-                Err(_) => Some((tl!("Check the pages").to_owned(), ERROR)),
-            }
-        } else {
-            None
-        };
-        if let Some((text, colour)) = note {
-            painter.text(pos2(c.center().x, name_y + 17.0), Align2::CENTER_CENTER, text, theme::regular(11.5), colour);
-        }
-
-        // On hover, the card's own actions along the top of the page (not while a card is
-        // dragged): remove this file only, and show it large when there is a page to show. Drawn
-        // over the card, so a click on one doesn't select or move it.
-        let previewable = why.is_none();
-        // A file that adds more pages than one can be spread out into them.
-        let expandable = self.page.is_none() && takes > 1 && takes <= MAX_EXPAND && f.lock.is_none() && f.problem.is_none() && self.check.is_ok();
-        // Shown large: the file from its first page, or a page card's page.
-        let preview = match self.page {
-            Some((nth, ..)) => RowAction::PreviewAt(f.id, nth),
-            None => RowAction::Preview(f.id),
-        };
-        // The card's own actions, in this order: expand (or, on a page, collapse), remove (the file,
-        // or the page), show large.
-        let mut buttons: Vec<(&str, String, RowAction)> = Vec::new();
-        if expandable {
-            buttons.push(("maximize-2", tl!("Expand").to_owned(), RowAction::Expand(f.id, true)));
-        }
-        if let Some((nth, ..)) = self.page {
-            buttons.push(("minimize-2", tl!("Collapse").to_owned(), RowAction::Expand(f.id, false)));
-            buttons.push(("trash-2", tl!("Remove page").to_owned(), RowAction::RemovePages(Some((f.id, nth)))));
-        } else {
-            buttons.push(("trash-2", crate::i18n::fmt(tl!("Remove {name}"), &[("name", &f.name)]), RowAction::RemoveFile(f.id)));
-        }
-        if previewable {
-            buttons.push(("search", tl!("Preview").to_owned(), preview));
-        }
-        // Nothing of the card shows over a dialog (the preview, the password box).
-        let covered = ui.ctx().memory(|m| m.top_modal_layer().is_some());
-        let mut over_bar = false;
-        if !covered && ui.rect_contains_pointer(c.shrink(4.0)) && !egui::DragAndDrop::has_any_payload(ui.ctx()) {
-            let count = buttons.len() as f32;
-            // Mostly above the page (a quarter over its top edge), so it hides little of it, and
-            // never the name below.
-            let y = paper.top() + BAR_H / 4.0 - BAR_H / 2.0;
-            let bar = Rect::from_center_size(pos2(paper.center().x, y), vec2(count * 26.0 + (count - 1.0).max(0.0) * 2.0 + 8.0, BAR_H));
-            over_bar = ui.rect_contains_pointer(bar);
-            painter.rect(bar, CornerRadius::same(8), t.card, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-            let mut bar_ui = ui.new_child(egui::UiBuilder::new().max_rect(bar.shrink(4.0)).layout(egui::Layout::left_to_right(egui::Align::Center)));
-            bar_ui.spacing_mut().item_spacing.x = 2.0;
-            for (icon, label, act) in &buttons {
-                if icons::button(&mut bar_ui, icon, 26.0, false, label).clicked() {
-                    action = Some(act.clone());
-                }
-            }
-        }
-
-        // The full name and everything known about the file, on hover (on a page card, which page).
-        let mut tip = match &page_label {
-            Some(page) => format!("{}\n{page}", f.name),
-            None => format!("{}\n{pages} · {}", f.name, crate::panels::human_size(f.bytes.len())),
-        };
-        for line in why.iter().map(|(_, _, s)| s).chain(&f.notes) {
-            tip.push('\n');
-            tip.push_str(line);
-        }
-        if self.twice {
-            tip.push('\n');
-            tip.push_str(tl!("Added more than once"));
-        }
-        // Page ranges are typed in the list.
-        if self.page.is_none() && self.check.is_err() {
-            tip.push('\n');
-            tip.push_str(tl!("Switch to List view to change the pages it takes."));
-        }
-        // (Over the bar, its buttons say what they do instead.)
-        let resp = if covered || over_bar { resp } else { resp.on_hover_text(tip) };
-
-        // The same actions on a right click, show large first (and Unlock… for a locked file).
-        let at = resp.rect.left_bottom();
-        let locked = f.lock.is_some();
-        resp.context_menu(|ui| {
-            let item = |ui: &mut egui::Ui, icon: &str, label: &str| {
-                ui.add(egui::Button::image_and_text(icons::image(icon, 15.0, ui.visuals().text_color()), label)).clicked()
-            };
-            for (icon, label, act) in buttons.iter().rev() {
-                // (Remove names its file, as the trash button does.)
-                if item(ui, icon, label) {
-                    action = Some(act.clone());
-                    ui.close();
-                }
-            }
-            if locked && item(ui, "lock-open", tl!("Unlock…")) {
-                action = Some(RowAction::Unlock(Some(self.i), at));
-                ui.close();
-            }
-        });
-        if resp.drag_started() {
-            egui::DragAndDrop::set_payload(ui.ctx(), GridDrag { file: f.id, revision: self.revision, page: self.page.map(|(nth, ..)| (f.id, nth)) });
-        }
-        if resp.clicked() {
-            let mods = resp.ctx.input(|i| i.modifiers);
-            action = Some(match self.page {
-                Some((nth, ..)) => RowAction::ClickPage(f.id, nth, mods),
-                None => RowAction::Click(self.i, mods),
-            });
-        }
-        action
-    }
-}
-
-/// The file a card's magnifier opened, shown large over the page: one of the pages it adds at a
-/// time, flipped with the buttons or the Left and Right keys; Esc, the close button or a click
-/// outside closes it. It closes by itself when the file leaves the list or has nothing to show.
-pub(crate) fn preview(app: &mut PdfCraftApp, ctx: &egui::Context, t: &Tokens) {
-    // The command palette goes over everything: the preview waits under it (drawn again after).
-    if app.palette_open {
-        return;
-    }
-    let Some(p) = app.combine_tab.preview.as_mut() else { return };
-    let Some(f) = app.combine_draft.iter().find(|f| f.id == p.file).filter(|f| f.lock.is_none() && f.problem.is_none()) else {
-        app.combine_tab.preview = None;
-        return;
-    };
-    // The pages it adds, worked out again only when its range changes.
-    let pages = match &p.pages {
-        Some(((range, count), pages)) if *range == f.range && *count == f.pages => pages.clone(),
-        _ => match f.pages_taken() {
-            Ok(pages) => {
-                let pages: Arc<[usize]> = Arc::from(pages);
-                p.pages = Some(((f.range.clone(), f.pages), pages.clone()));
-                pages
-            }
-            Err(_) => {
-                app.combine_tab.preview = None;
-                return;
-            }
-        },
-    };
-    let n = pages.len();
-    p.at = p.at.min(n.saturating_sub(1));
-    let Some(&page) = pages.get(p.at) else {
-        app.combine_tab.preview = None;
-        return;
-    };
-    p.page = Some(page);
-    let at = p.at;
-    // Flipped with the keys (the grid's arrows wait while this shows), unless a text field has
-    // them.
-    let typing = ctx.text_edit_focused();
-    let (back, on) = ctx.input_mut(|i| {
-        for k in [egui::Key::Plus, egui::Key::Equals, egui::Key::Minus, egui::Key::Num0] {
-            i.consume_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, k));
-        }
-        if typing {
-            return (false, false);
-        }
-        (
-            i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowLeft) | i.consume_key(egui::Modifiers::NONE, egui::Key::PageUp),
-            i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowRight) | i.consume_key(egui::Modifiers::NONE, egui::Key::PageDown),
-        )
-    });
-    let (mut step, mut close) = (i64::from(on) - i64::from(back), false);
-    let screen = ctx.content_rect();
-    let width = (screen.width() * 0.86).max(320.0);
-    let body_h = (screen.height() * 0.86 - 110.0).max(200.0);
-    let ppp = ctx.pixels_per_point();
-    // No larger than the GPU takes, or the render would be refused.
-    let longest = ctx.input(|i| i.max_texture_side as f32).min(PREVIEW_SIDE);
-    let thumbs = &mut app.combine_thumbs;
-    let modal = egui::Modal::new(egui::Id::new("combine-preview")).show(ctx, |ui| {
-        ui.set_width(width);
-        ui.horizontal(|ui| {
-            ui.label(egui::RichText::new(crate::bidi::visual(&f.name)).font(theme::semibold(15.0)));
-            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                if icons::button(ui, "x", 30.0, false, tl!("Close")).clicked() {
-                    close = true;
-                }
-                let of = crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &(at + 1).to_string()), ("n", &n.to_string())]);
-                ui.label(egui::RichText::new(of).color(t.text_muted));
-            });
-        });
-        ui.add_space(8.0);
-        // The page, as large as fits.
-        let (area, _) = ui.allocate_exact_size(vec2(width, body_h), Sense::hover());
-        let known = f.sizes.get(page).copied().filter(|(w, h)| paper_size(*w, *h, area.size()).is_some());
-        let (w, h) = known.unwrap_or(FALLBACK_PAGE);
-        let size = paper_size(w, h, area.size() - vec2(8.0, 8.0)).unwrap_or(area.size());
-        let paper = Rect::from_center_size(area.center(), size);
-        let painter = ui.painter_at(area);
-        painter.rect_filled(paper.translate(vec2(0.0, 2.0)), CornerRadius::same(1), t.page_shadow);
-        painter.rect_filled(paper, CornerRadius::ZERO, Color32::WHITE);
-        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
-        if known.is_some() {
-            let scale = (size.x * ppp / w).min(size.y * ppp / h).min(longest / w.max(h));
-            let px = [w * scale, h * scale].map(|v| (v.max(1.0).ceil() as u32).div_ceil(SIZE_STEP).saturating_mul(SIZE_STEP));
-            let key = Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page, px };
-            match thumbs.look(PREVIEW, key) {
-                Look::Ready(tex) => {
-                    painter.image(tex, paper, uv, Color32::WHITE);
-                }
-                Look::Failed(e) => {
-                    let text = crate::i18n::fmt(tl!("Preview unavailable: {e}"), &[("e", &e)]);
-                    painter.text(paper.center(), Align2::CENTER_CENTER, text, theme::regular(13.0), ON_PAPER);
-                }
-                Look::Pending(stand_in) => {
-                    // A smaller render of this page stands in: the last size shown, or its card's.
-                    let card = thumbs.entries.get(&(f.group, page)).filter(|e| e.key.auth == f.auth).and_then(|e| e.tex.as_ref());
-                    if let Some(tex) = stand_in.or(card.map(TextureHandle::id)) {
-                        painter.image(tex, paper, uv, Color32::WHITE);
-                    }
-                    if scale.is_finite() && scale > 0.0 {
-                        thumbs.wants.push(Want {
-                            slot: PREVIEW,
-                            key,
-                            bytes: f.bytes.clone(),
-                            password: f.password().map(Arc::from),
-                            scale,
-                            visible: true,
-                        });
-                    }
-                }
-            }
-        } else {
-            icons::paint(ui, Rect::from_center_size(paper.center(), Vec2::splat(36.0)), "eye-off", 36.0, ON_PAPER);
-        }
-        painter.rect_stroke(paper, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
-        ui.add_space(8.0);
-        // Previous and next, centred below.
-        ui.horizontal(|ui| {
-            ui.add_space((width - 2.0 * 30.0 - 6.0) / 2.0);
-            if ui.add_enabled_ui(at > 0, |ui| icons::button(ui, "chevron-left", 30.0, false, tl!("Previous page"))).inner.clicked() {
-                step = -1;
-            }
-            if ui.add_enabled_ui(at + 1 < n, |ui| icons::button(ui, "chevron-right", 30.0, false, tl!("Next page"))).inner.clicked() {
-                step = 1;
-            }
-        });
-    });
-    if close || modal.should_close() {
-        app.combine_tab.preview = None;
-    } else if let Some(p) = app.combine_tab.preview.as_mut() {
-        p.at = match step {
-            s if s < 0 => p.at.saturating_sub(1),
-            s if s > 0 => (p.at + 1).min(n.saturating_sub(1)),
-            _ => p.at,
-        };
-    }
-}
-
-impl PdfCraftApp {
-    /// The file shown large, the page on screen (0-based, in the file) and its render, while it
-    /// shows (tests and the control channel).
-    pub fn combine_preview(&self) -> Option<(String, usize, ThumbState)> {
-        let p = self.combine_tab.preview.as_ref()?;
-        let f = self.combine_draft.iter().find(|f| f.id == p.file)?;
-        Some((f.name.clone(), p.page?, self.combine_thumbs.state(PREVIEW)))
-    }
-
-    /// Size the Combine grid's cards (1.0 = the usual); out-of-range values are clamped and
-    /// nonsense is ignored.
-    pub fn set_combine_zoom(&mut self, zoom: f32) {
-        if zoom.is_finite() {
-            self.combine_zoom = zoom.clamp(*ZOOM_RANGE.start(), *ZOOM_RANGE.end());
-        }
-    }
-
-    /// Every frame, whatever shows: take finished thumbnails, start those the grid asked for (only
-    /// while it is drawn), and let go of what no longer matches the list, so renders under way
-    /// finish and release their threads in the list view, on Home or in a document tab too.
-    pub(crate) fn combine_thumbs_frame(&mut self, ctx: &egui::Context) {
-        // What each thumbnail must match now (cards out of view included): each file's first page,
-        // and an expanded file's pages (looked up in its sorted list, never listed one by one).
-        // (By file: the parts a file is split into share its thumbnails.)
-        struct Shown {
-            source: usize,
-            auth: u64,
-            pages: Vec<usize>,
-        }
-        let mut shown: HashMap<u64, Shown> = HashMap::with_capacity(self.combine_draft.len());
-        let tab = &mut self.combine_tab;
-        for f in self.combine_draft.iter_mut() {
-            let Ok(first) = f.first_page() else { continue };
-            let sorted = tab.expanded.contains(&f.id).then(|| pages_shown(&mut tab.page_lists, f)).flatten().map(|l| l.sorted);
-            let entry = shown.entry(f.group).or_insert_with(|| Shown { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, pages: Vec::new() });
-            entry.pages.push(first);
-            entry.pages.extend(sorted.iter().flat_map(|s| s.iter().copied()));
-        }
-        for s in shown.values_mut() {
-            s.pages.sort_unstable();
-            s.pages.dedup();
-        }
-        // The page shown large, while it shows: leaving the tab closes it.
-        if !self.combine_showing() {
-            self.combine_tab.preview = None;
-        }
-        let preview = self.combine_tab.preview.as_ref().and_then(|p| {
-            let page = p.page?;
-            let f = self.combine_draft.iter().find(|f| f.id == p.file)?;
-            Some(Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page, px: [0, 0] })
-        });
-        let current = |slot: Slot| -> Option<Key> {
-            if slot == PREVIEW {
-                return preview;
-            }
-            let (id, page) = slot;
-            let s = shown.get(&id)?;
-            s.pages.binary_search(&page).is_ok().then_some(Key { source: s.source, auth: s.auth, page, px: [0, 0] })
-        };
-        self.combine_thumbs.finish(ctx, &current);
-    }
-
-    /// The single pages selected: each one's entry (by place in the list) and page (0-based, in
-    /// the file), in list order (tests and the control channel).
-    pub fn combine_selected_pages(&self) -> Vec<(usize, usize)> {
-        let mut out = Vec::new();
-        for (i, f) in self.combine_draft.iter().enumerate() {
-            let pages = f.pages_taken().unwrap_or_default();
-            for (nth, page) in pages.iter().enumerate() {
-                if self.combine_tab.selected_pages.contains(&(f.id, nth)) {
-                    out.push((i, *page));
-                }
-            }
-        }
-        out
-    }
-
-    /// Each entry's name and the pages it takes (0-based, in order): a file split into parts is
-    /// several entries (tests and the control channel).
-    pub fn combine_parts_shown(&self) -> Vec<(String, Vec<usize>)> {
-        self.combine_draft.iter().map(|f| (f.name.clone(), f.pages_taken().unwrap_or_default())).collect()
-    }
-
-    /// The files shown as their pages in the grid, by place in the list (tests and the control
-    /// channel).
-    pub fn combine_expanded(&self) -> Vec<usize> {
-        self.combine_draft.iter().enumerate().filter(|(_, f)| self.combine_tab.expanded.contains(&f.id)).map(|(i, _)| i).collect()
-    }
-
-    /// An expanded file's page cards: each page (0-based, in the file) and its thumbnail; empty
-    /// for a file shown as its card (tests and the control channel).
-    pub fn combine_page_thumbnails(&self, file: usize) -> Vec<(usize, ThumbState)> {
-        let Some(f) = self.combine_draft.get(file).filter(|f| self.combine_tab.expanded.contains(&f.id)) else { return Vec::new() };
-        let pages = f.pages_taken().unwrap_or_default();
-        pages.into_iter().map(|p| (p, self.combine_thumbs.state((f.group, p)))).collect()
-    }
-
-    /// Each listed file's grid thumbnail, in list order (tests and the control channel).
-    pub fn combine_thumbnails(&self) -> Vec<ThumbState> {
-        self.combine_draft.iter().map(|f| f.first_taken().map_or(ThumbState::None, |p| self.combine_thumbs.state((f.group, p)))).collect()
-    }
-
-    /// Thumbnail renders under way (tests: never more than a few).
-    pub fn combine_thumbnails_rendering(&self) -> usize {
-        self.combine_thumbs.jobs.len()
-    }
-
-    /// Render threads for thumbnails that exist now (counted from the threads themselves),
-    /// including those of finished or abandoned renders that haven't exited yet (tests: never
-    /// more than three).
-    pub fn combine_thumbnail_threads(&mut self) -> usize {
-        self.combine_thumbs.threads()
-    }
-
-    /// Whether no thumbnail render is under way and every render thread has exited (tests).
-    pub fn combine_thumbnail_threads_exited(&self) -> bool {
-        self.combine_thumbs.jobs.is_empty() && self.combine_thumbs.retiring.iter().all(Retiring::exited)
-    }
-
-    /// Thumbnail textures held (tests: none once the tab is closed).
-    pub fn combine_thumbnail_textures(&self) -> usize {
-        self.combine_thumbs.entries.values().filter(|e| e.tex.is_some()).count()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::collections::BTreeSet;
-
-    use super::*;
-    use crate::combine_ui::{moved_order, step_to};
-
-    #[test]
-    fn long_names_keep_their_extension_and_whole_characters() {
-        let fits = |n: usize| move |s: &str| s.chars().count() <= n;
-        assert_eq!(fit_name("short.pdf", fits(20)), "short.pdf");
-        assert_eq!(fit_name("# 227 Pilot Boat Advance.pdf", fits(18)), "# 227 Pilot B….pdf");
-        // Multi-byte characters are never cut in half.
-        assert_eq!(fit_name("Überweisungsbestätigung.pdf", fits(12)), "Überwei….pdf");
-        assert_eq!(fit_name("日本語のファイル名です.pdf", fits(8)), "日本語….pdf");
-        // No extension, or a dot that isn't one.
-        assert_eq!(fit_name("README-without-extension", fits(10)), "README-wi…");
-        assert_eq!(fit_name(".hidden-file-name", fits(8)), ".hidden…");
-        // Nothing fits: the ellipsis and the extension.
-        assert_eq!(fit_name("abcdef.pdf", fits(0)), "….pdf");
-    }
-
-    #[test]
-    fn paper_sizes_fit_the_box_and_bad_sizes_are_refused() {
-        // The box follows the zoom, within its range; nonsense is 100%.
-        assert_eq!(paper_box(1.0), PAPER);
-        assert_eq!(paper_box(2.0), PAPER * 2.0);
-        assert_eq!(paper_box(99.0), PAPER * 5.0);
-        assert_eq!(paper_box(-1.0), PAPER * 0.6);
-        assert_eq!(paper_box(f32::NAN), PAPER);
-        for zoom in [0.6, 1.0, 2.0, 5.0] {
-            let fit = paper_box(zoom);
-            // Letter is a little wider than the box: it fills the width. A tall page fills the height.
-            let letter = paper_size(612.0, 792.0, fit).unwrap();
-            assert!((letter.x - fit.x).abs() < 0.01 && letter.y <= fit.y + 0.01, "{letter:?}");
-            let tall = paper_size(612.0, 1008.0, fit).unwrap();
-            assert!((tall.y - fit.y).abs() < 0.01 && tall.x <= fit.x + 0.01, "{tall:?}");
-            let landscape = paper_size(792.0, 612.0, fit).unwrap();
-            assert!((landscape.x - fit.x).abs() < 0.01 && landscape.y < fit.y, "{landscape:?}");
-            for (w, h) in [(0.0, 792.0), (612.0, -1.0), (f32::NAN, 1.0), (f32::INFINITY, 1.0), (1e-30, 1e30)] {
-                let s = paper_size(w, h, fit);
-                assert!(s.is_none_or(|s| s.x.is_finite() && s.y.is_finite() && s.x <= fit.x + 0.01 && s.y <= fit.y + 0.01), "{w}×{h}: {s:?}");
-            }
-        }
-    }
-
-    #[test]
-    fn zoom_buttons_step_through_round_sizes() {
-        let mut z = 0.6;
-        let mut up = vec![z];
-        while z < 5.0 {
-            z = zoom_step(z, true);
-            up.push(z);
-        }
-        assert_eq!(up, ZOOM_STEPS);
-        assert_eq!(zoom_step(5.0, true), 5.0, "the largest stays put");
-        assert_eq!(zoom_step(0.6, false), 0.6, "the smallest stays put");
-        // From anywhere the slider left it, to the next round size.
-        assert_eq!(zoom_step(1.1, true), 1.25);
-        assert_eq!(zoom_step(1.1, false), 1.0);
-        assert_eq!(zoom_step(1.953, true), 2.0);
-        assert_eq!(zoom_step(1.0000001, true), 1.25, "a hair over a size counts as that size");
-    }
-
-    #[test]
-    fn the_cards_zoom_far_enough_to_read_a_value() {
-        // #2531: the grid stopped at 200%, which was not enough to read invoice values while
-        // reordering the pages of a statement. It has to reach 500%.
-        assert_eq!(*ZOOM_RANGE.end(), 5.0, "the grid stops at {}%, not 500%", ZOOM_RANGE.end() * 100.0);
-        assert_eq!(paper_box(5.0), PAPER * 5.0, "500% is kept, not clamped to the old ceiling");
-        // Every round size above the old 200% ceiling is a step the toolbar can reach.
-        let mut z = *ZOOM_RANGE.start();
-        let mut up = vec![z];
-        while z < *ZOOM_RANGE.end() {
-            z = zoom_step(z, true);
-            up.push(z);
-        }
-        for want in [2.5, 3.0, 4.0, 5.0] {
-            assert!(up.contains(&want), "no step reaches {want}%: {up:?}");
-        }
-        // A card stays sharp at the ceiling instead of upscaled from the old 768px cap. A Letter
-        // page fills the height of the box, so at 500% it needs PAPER.y * 5.0 points of it, which
-        // on a 1.5 pixels-per-point screen is this many pixels.
-        let wanted = PAPER.y * 5.0 * 1.5;
-        assert!(MAX_SIDE >= wanted, "MAX_SIDE {MAX_SIDE} is under the {wanted}px a card needs at 500%");
-    }
-
-    #[test]
-    fn arrow_keys_step_by_file_and_by_row() {
-        // The list: one at a time, staying put at both ends.
-        assert_eq!(step_to(0, 5, 1, false), 0);
-        assert_eq!(step_to(4, 5, 1, true), 4);
-        assert_eq!(step_to(2, 5, 1, true), 3);
-        // A grid of 3 per row and 8 files: rows [0 1 2] [3 4 5] [6 7].
-        assert_eq!(step_to(1, 8, 3, true), 4, "down one row, same column");
-        assert_eq!(step_to(5, 8, 3, true), 7, "a short last row is reached at its last file");
-        assert_eq!(step_to(6, 8, 3, true), 6, "the last row goes no further down");
-        assert_eq!(step_to(2, 8, 3, false), 2, "the first row goes no further up");
-        assert_eq!(step_to(7, 8, 3, false), 4);
-        // Out-of-range starts and empty lists don't panic.
-        assert_eq!(step_to(99, 8, 3, false), 4);
-        assert_eq!(step_to(0, 0, 3, true), 0);
-        assert_eq!(step_to(0, 1, 0, true), 0);
-    }
-
-    #[test]
-    fn moves_to_a_gap_keep_order_and_report_no_ops() {
-        let ids = [10, 11, 12, 13, 14];
-        let set = |v: &[u64]| v.iter().copied().collect::<BTreeSet<u64>>();
-        // One file to the start, to the end, and between others.
-        assert_eq!(moved_order(&ids, &set(&[13]), 0), Some(vec![13, 10, 11, 12, 14]));
-        assert_eq!(moved_order(&ids, &set(&[10]), 5), Some(vec![11, 12, 13, 14, 10]));
-        assert_eq!(moved_order(&ids, &set(&[10]), 3), Some(vec![11, 12, 10, 13, 14]));
-        // A discontiguous selection gathers at the gap, in list order.
-        assert_eq!(moved_order(&ids, &set(&[10, 12, 14]), 2), Some(vec![11, 10, 12, 14, 13]));
-        assert_eq!(moved_order(&ids, &set(&[11, 13]), 5), Some(vec![10, 12, 14, 11, 13]));
-        // Dropping a file next to itself, or a block inside itself, changes nothing.
-        assert_eq!(moved_order(&ids, &set(&[12]), 2), None);
-        assert_eq!(moved_order(&ids, &set(&[12]), 3), None);
-        assert_eq!(moved_order(&ids, &set(&[11, 12, 13]), 2), None);
-        // Nothing to move, unknown files and gaps past the end are harmless.
-        assert_eq!(moved_order(&ids, &set(&[]), 1), None);
-        assert_eq!(moved_order(&ids, &set(&[99]), 1), None);
-        assert_eq!(moved_order(&ids, &set(&[10]), 99), Some(vec![11, 12, 13, 14, 10]));
-    }
-
-    /// A PDF of `pages` pages of `w` × `h` points.
-    fn pdf(pages: usize, w: u32, h: u32) -> Arc<Vec<u8>> {
-        let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
-        let kids: Vec<String> = (0..pages).map(|i| format!("{} 0 R", 3 + 2 * i)).collect();
-        objs.push(format!("<< /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 {w} {h}] >>", kids.join(" ")));
-        for i in 0..pages {
-            objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R >>", 4 + 2 * i));
-            let body = "0.2 0.4 0.8 rg 0 0 10 10 re f";
-            objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
-        }
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, o) in objs.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
-        }
-        let xref = out.len();
-        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
-        for o in offsets {
-            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
-        Arc::new(out)
-    }
-
-    fn key_of(bytes: &Arc<Vec<u8>>) -> Key {
-        Key { source: Arc::as_ptr(bytes) as usize, auth: 1, page: 0, px: [32, 48] }
-    }
-
-    fn want(file: u64, bytes: &Arc<Vec<u8>>) -> Want {
-        Want { slot: (file, 0), key: key_of(bytes), bytes: bytes.clone(), password: None, scale: 0.15, visible: true }
-    }
-
-    fn listing(files: &[(u64, &Arc<Vec<u8>>)]) -> HashMap<Slot, Key> {
-        files.iter().map(|(f, b)| ((*f, 0), key_of(b))).collect()
-    }
-
-    /// One frame of `finish`, as the app runs it; how soon it asks to be drawn again.
-    fn frame(ctx: &egui::Context, thumbs: &mut Thumbs, current: &HashMap<Slot, Key>) -> std::time::Duration {
-        let mut out = ctx.run_ui(egui::RawInput::default(), |ui| thumbs.finish(ui.ctx(), &|slot| current.get(&slot).copied()));
-        // No GPU here: the texture uploads are taken as done.
-        out.textures_delta.clear();
-        out.viewport_output.get(&egui::ViewportId::ROOT).map_or(std::time::Duration::MAX, |v| v.repaint_delay)
-    }
-
-    #[test]
-    fn a_thumbnail_that_arrives_is_drawn_without_waiting_for_input() {
-        // Regression: the cards are drawn before results are taken; the last result used to
-        // leave its card blank until the next mouse move.
-        let ctx = egui::Context::default();
-        let mut thumbs = Thumbs::default();
-        let bytes = pdf(1, 200, 300);
-        let current = listing(&[(1, &bytes)]);
-        thumbs.wants.push(want(1, &bytes));
-        frame(&ctx, &mut thumbs, &current);
-        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
-        loop {
-            let delay = frame(&ctx, &mut thumbs, &current);
-            if thumbs.entries.get(&(1, 0)).is_some_and(|e| e.tex.is_some()) {
-                assert_eq!(delay, std::time::Duration::ZERO, "the frame that took the result asks for another");
-                break;
-            }
-            assert!(std::time::Instant::now() < deadline, "the thumbnail arrives");
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-    }
-
-    #[test]
-    fn a_result_for_a_file_that_changed_is_never_shown() {
-        let ctx = egui::Context::default();
-        let mut thumbs = Thumbs::default();
-        let bytes = pdf(1, 200, 300);
-        thumbs.wants.push(want(1, &bytes));
-        frame(&ctx, &mut thumbs, &listing(&[(1, &bytes)]));
-        assert_eq!(thumbs.jobs.len(), 1, "the render started");
-        // The file leaves the list (or is unlocked differently) while it renders.
-        let other = pdf(1, 200, 300);
-        let changed = listing(&[(1, &other)]);
-        frame(&ctx, &mut thumbs, &changed);
-        assert!(thumbs.jobs.is_empty(), "let go of at once");
-        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
-        while thumbs.threads() > 0 {
-            assert!(std::time::Instant::now() < deadline, "its thread exits");
-            frame(&ctx, &mut thumbs, &changed);
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert!(thumbs.entries.is_empty(), "its result is never kept");
-    }
-
-    #[test]
-    fn textures_over_budget_go_longest_unseen_first_and_those_in_view_stay() {
-        let ctx = egui::Context::default();
-        let mut thumbs = Thumbs::default();
-        let tex = |n: &str| ctx.load_texture(n, egui::ColorImage::new([1, 1], vec![Color32::WHITE]), egui::TextureOptions::LINEAR);
-        let files: Vec<Arc<Vec<u8>>> = (0..4).map(|_| pdf(1, 200, 300)).collect();
-        thumbs.frame = 10;
-        // Seen at frames 1, 5 and 9 (out of view now), and 10 (in view), 20 MB each as counted.
-        for (i, seen) in [1u64, 5, 9, 10].into_iter().enumerate() {
-            let key = key_of(&files[i]);
-            thumbs.entries.insert((i as u64, 0), Entry { key, tex: Some(tex(&format!("t{i}"))), error: None, seen, bytes: 20 << 20 });
-        }
-        let current: HashMap<Slot, Key> = files.iter().enumerate().map(|(i, b)| ((i as u64, 0), key_of(b))).collect();
-        frame(&ctx, &mut thumbs, &current);
-        let mut kept: Vec<u64> = thumbs.entries.keys().map(|k| k.0).collect();
-        kept.sort_unstable();
-        assert_eq!(kept, [3], "80 MB: the three out of view go, oldest first; the one in view stays even over budget");
-    }
-
-    #[test]
-    fn render_threads_never_exceed_three_while_files_come_and_go() {
-        let ctx = egui::Context::default();
-        let mut thumbs = Thumbs::default();
-        let files: Vec<Arc<Vec<u8>>> = (0..12).map(|i| pdf(1 + i % 3, 200, 300)).collect();
-        let mut most = 0;
-        for round in 0..120u64 {
-            // A different handful of files every few frames: renders are abandoned all the time.
-            let start = (round / 3 % 4 * 3) as usize;
-            let shown: Vec<(u64, &Arc<Vec<u8>>)> = (start..start + 4).map(|i| (i as u64, &files[i % files.len()])).collect();
-            for (file, bytes) in &shown {
-                thumbs.wants.push(want(*file, bytes));
-            }
-            frame(&ctx, &mut thumbs, &listing(&shown));
-            let threads = thumbs.threads();
-            most = most.max(threads);
-            assert!(threads <= MAX_THREADS, "round {round}: {threads} render threads");
-            std::thread::sleep(std::time::Duration::from_millis(2));
-        }
-        assert!(most > 0, "renders did run");
-    }
-
-    #[test]
-    fn on_the_web_one_thumbnail_waits_at_a_time() {
-        // Regression: pools that render on the UI thread have no threads to count, so three
-        // started every frame while one finished, each holding its parsed document.
-        let ctx = egui::Context::default();
-        let mut thumbs = Thumbs { inline: true, ..Default::default() };
-        let files: Vec<Arc<Vec<u8>>> = (0..6).map(|_| pdf(1, 200, 300)).collect();
-        let shown: Vec<(u64, &Arc<Vec<u8>>)> = files.iter().enumerate().map(|(i, b)| (i as u64, b)).collect();
-        // One heavy step a frame on the UI thread: a parse, then the next frame its render.
-        for round in 0..14 {
-            for (file, bytes) in &shown {
-                thumbs.wants.push(want(*file, bytes));
-            }
-            frame(&ctx, &mut thumbs, &listing(&shown));
-            assert!(thumbs.jobs.len() <= 1, "round {round}: {} renders waiting", thumbs.jobs.len());
-            assert!(thumbs.jobs.iter().all(|j| j.pool.is_inline()));
-        }
-        assert!(thumbs.entries.values().filter(|e| e.tex.is_some()).count() == 6, "all six drawn, one heavy step per frame");
-    }
-
-    #[test]
-    fn the_next_page_of_a_file_reuses_its_open_document_until_it_closes() {
-        // Regression: each page of an expanded file read (parsed) the whole file again.
-        let ctx = egui::Context::default();
-        let mut thumbs = Thumbs::default();
-        let bytes = pdf(3, 200, 300);
-        let first = key_of(&bytes);
-        let second = Key { page: 1, ..first };
-        let current: HashMap<Slot, Key> = [((1, 0), first), ((1, 1), second)].into_iter().collect();
-        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
-        let drawn = |thumbs: &Thumbs, slot: Slot| thumbs.entries.get(&slot).is_some_and(|e| e.tex.is_some());
-        while !drawn(&thumbs, (1, 0)) {
-            assert!(std::time::Instant::now() < deadline, "page 1 is drawn");
-            thumbs.wants.push(want(1, &bytes));
-            frame(&ctx, &mut thumbs, &current);
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert_eq!(thumbs.open.len(), 1, "its document stays open a moment");
-        // Page 2 of the same file, read the same way: that open document renders it.
-        thumbs.wants.push(Want { slot: (1, 1), key: second, ..want(1, &bytes) });
-        frame(&ctx, &mut thumbs, &current);
-        assert!(thumbs.open.is_empty() && thumbs.jobs.len() == 1, "reused, not a new pool: {} open, {} jobs", thumbs.open.len(), thumbs.jobs.len());
-        while !drawn(&thumbs, (1, 1)) {
-            assert!(std::time::Instant::now() < deadline, "page 2 is drawn");
-            frame(&ctx, &mut thumbs, &current);
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert!(thumbs.threads() <= MAX_THREADS);
-        // Unused, it closes after a while, and its thread goes.
-        while thumbs.threads() > 0 || !thumbs.open.is_empty() {
-            assert!(std::time::Instant::now() < deadline, "the open document closes and its thread exits");
-            frame(&ctx, &mut thumbs, &current);
-        }
-    }
-
-    #[test]
-    fn a_page_that_failed_is_not_tried_again_at_another_size() {
-        // Regression: each zoom step asked for a new render of a page that had failed (or hung
-        // for the watchdog's 20 s), filling the render threads.
-        // (A card asks for a render only when it looks Pending.)
-        let mut thumbs = Thumbs::default();
-        let bytes = pdf(1, 200, 300);
-        let key = key_of(&bytes);
-        thumbs.entries.insert((1, 0), Entry { key, tex: None, error: Some("broken".into()), seen: 0, bytes: 0 });
-        let larger = Key { px: [key.px[0] + 64, key.px[1] + 64], ..key };
-        assert!(matches!(thumbs.look((1, 0), larger), Look::Failed(e) if e == "broken"), "the failure stands at another size");
-        // Another read of the file (a new password) is a new page: tried again.
-        let reread = Key { auth: 2, ..key };
-        assert!(matches!(thumbs.look((1, 0), reread), Look::Pending(None)));
-    }
-
-    #[test]
-    fn on_the_web_a_render_that_never_answers_fails_and_lets_the_rest_through() {
-        // A pool without threads answers on the call that renders: no answer then never comes.
-        // It used to wait for good, so nothing else started and every frame asked for another.
-        let ctx = egui::Context::default();
-        let mut thumbs = Thumbs { inline: true, ..Default::default() };
-        let (silent, next) = (pdf(1, 200, 300), pdf(1, 200, 300));
-        let pool = RenderPool::new_inline(silent.clone(), RenderConfig::default());
-        // Nothing queued: this pool has nothing to answer with.
-        thumbs.jobs.push(Job { slot: (1, 0), key: key_of(&silent), pool, tag: 7 });
-        let current = listing(&[(1, &silent), (2, &next)]);
-        for _ in 0..4 {
-            thumbs.wants.push(want(2, &next));
-            frame(&ctx, &mut thumbs, &current);
-        }
-        assert!(thumbs.entries.get(&(1, 0)).is_some_and(|e| e.tex.is_none() && e.error.is_some()), "the silent one failed");
-        assert!(thumbs.entries.get(&(2, 0)).is_some_and(|e| e.tex.is_some()), "the next one was drawn");
-        assert!(thumbs.jobs.is_empty());
-        assert!(frame(&ctx, &mut thumbs, &current) > std::time::Duration::ZERO, "no more frames asked for at once");
-    }
-}
diff --git a/crates/ui-egui/src/combine_ui.rs b/crates/ui-egui/src/combine_ui.rs
deleted file mode 100644
index 62d9163154..0000000000
--- a/crates/ui-egui/src/combine_ui.rs
+++ /dev/null
@@ -1,2825 +0,0 @@
-//! Combine files, in its own tab: the files to combine, in order, each with the pages to take
-//! (all, or a range such as "1-3, 6"), its size, when it was modified and anything that stops it
-//! being combined. Rows are selected like files in a file manager (click, Ctrl/⌘+click,
-//! Shift+click), moved with the toolbar, the keyboard or by dragging, and sorted by clicking a
-//! column heading; PDFs dropped on the tab join the list. Every change to the list can be undone.
-
-use std::cmp::Ordering;
-use std::collections::{BTreeSet, HashMap};
-use std::sync::Arc;
-use std::time::SystemTime;
-
-use egui::{Align, Color32, CornerRadius, Layout, Modifiers, Rect, Sense, Stroke, vec2};
-use egui_extras::{Column, TableBuilder};
-use pdfcraft_engine::SourceProblem;
-
-use crate::theme::{self, Tokens};
-use crate::{PdfCraftApp, icons, widgets};
-
-/// Same reds and ambers as the signature status (`sign_ui`).
-pub(crate) const ERROR: Color32 = Color32::from_rgb(0xD7, 0x37, 0x3F);
-pub(crate) const WARNING: Color32 = Color32::from_rgb(0xE6, 0x86, 0x19);
-/// Undo steps kept for the list (each holds the list itself; the files' bytes are shared).
-const HISTORY: usize = 100;
-
-/// Files found in a folder are added up to this many at a time.
-#[cfg(not(target_arch = "wasm32"))]
-const MAX_FOLDER_FILES: usize = 1000;
-/// How deep "Add folder and subfolders" looks.
-#[cfg(not(target_arch = "wasm32"))]
-const MAX_FOLDER_DEPTH: usize = 16;
-
-/// A column of the list: what it shows and what it sorts by.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum SortKey {
-    Name,
-    Pages,
-    Size,
-    Modified,
-    Warnings,
-}
-
-impl SortKey {
-    pub const ALL: [SortKey; 5] = [SortKey::Name, SortKey::Pages, SortKey::Size, SortKey::Modified, SortKey::Warnings];
-
-    fn index(self) -> usize {
-        self as usize
-    }
-
-    fn label(self) -> &'static str {
-        match self {
-            SortKey::Name => tl!("File name"),
-            SortKey::Pages => tl!("Pages"),
-            SortKey::Size => tl!("Size"),
-            SortKey::Modified => tl!("Modified"),
-            SortKey::Warnings => tl!("Warnings"),
-        }
-    }
-
-    /// The narrowest the column may be dragged.
-    fn min_width(self) -> f32 {
-        match self {
-            SortKey::Name => 120.0,
-            SortKey::Pages => 110.0,
-            SortKey::Size => 60.0,
-            SortKey::Modified => 80.0,
-            SortKey::Warnings => 100.0,
-        }
-    }
-}
-
-/// The columns' order and widths, as the user arranged them (kept in the settings).
-#[derive(Clone, Debug, PartialEq)]
-pub struct Columns {
-    pub order: [SortKey; 5],
-    /// By [`SortKey::index`]; `None` until a column is resized: fitted to the window until then.
-    pub widths: Option<[f32; 5]>,
-}
-
-impl Default for Columns {
-    fn default() -> Self {
-        Columns { order: SortKey::ALL, widths: None }
-    }
-}
-
-impl Columns {
-    pub(crate) fn to_json(&self) -> serde_json::Value {
-        serde_json::json!({ "order": self.order, "widths": self.widths })
-    }
-
-    /// Settings written by [`Self::to_json`]; anything malformed gives the default layout.
-    pub(crate) fn from_json(v: &serde_json::Value) -> Self {
-        let order = serde_json::from_value::<Vec<SortKey>>(v["order"].clone())
-            .ok()
-            .filter(|o| SortKey::ALL.iter().all(|k| o.contains(k)))
-            .and_then(|o| <[SortKey; 5]>::try_from(o).ok())
-            .unwrap_or(SortKey::ALL);
-        let widths = serde_json::from_value::<[f32; 5]>(v["widths"].clone())
-            .ok()
-            .filter(|w| w.iter().all(|x| x.is_finite()))
-            .map(|w| std::array::from_fn(|i| w[i].clamp(SortKey::ALL[i].min_width(), 4000.0)));
-        Columns { order, widths }
-    }
-
-    /// The widths to show: the user's, or the window's width shared out.
-    fn resolved(&self, available: f32) -> [f32; 5] {
-        if let Some(w) = self.widths {
-            return w;
-        }
-        let fixed = 170.0 + 84.0 + 110.0;
-        let flexible = (available - fixed).max(260.0);
-        [(flexible * 0.55).max(140.0), 170.0, 84.0, 110.0, (flexible * 0.45).max(120.0)]
-    }
-}
-
-/// How the files are shown: a thumbnail of each (the default, to see what goes where) or the
-/// table (kept in the settings).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub enum CombineView {
-    #[default]
-    Grid,
-    List,
-}
-
-impl CombineView {
-    pub fn as_str(self) -> &'static str {
-        match self {
-            CombineView::Grid => "grid",
-            CombineView::List => "list",
-        }
-    }
-
-    pub fn parse(s: &str) -> Option<Self> {
-        match s {
-            "grid" => Some(CombineView::Grid),
-            "list" => Some(CombineView::List),
-            _ => None,
-        }
-    }
-}
-
-/// A column heading being dragged to a new place.
-#[derive(Clone, Copy)]
-struct HeadingDrag(SortKey);
-
-enum HeadingEvent {
-    Sort(SortKey),
-    /// Put column `kind` before (or after) column `to`.
-    Move {
-        kind: SortKey,
-        to: SortKey,
-        after: bool,
-    },
-    Reset,
-}
-
-/// The Combine files tab. It shows in the Home slot (`active == None`) while `focused`.
-#[derive(Clone, Debug, Default)]
-pub struct CombineTab {
-    pub open: bool,
-    pub focused: bool,
-    /// The selected rows, by [`CombineFile::id`], so a selection survives sorting and moving.
-    pub selected: BTreeSet<u64>,
-    /// Where a Shift+click or Shift+arrow range starts, and where it ends.
-    anchor: Option<u64>,
-    cursor: Option<u64>,
-    /// The column the list is sorted by and whether ascending; cleared when rows are moved.
-    pub sort: Option<(SortKey, bool)>,
-    undo: Vec<Snapshot>,
-    redo: Vec<Snapshot>,
-    /// The list as it was when a Pages field took the keyboard, recorded on its first change.
-    range_edit: Option<Snapshot>,
-    next_id: u64,
-    /// Bumped to make the table take its column widths afresh (columns moved or reset, or the
-    /// window resized while the widths follow it).
-    layout: u64,
-    /// The width the columns were last fitted to.
-    fitted: f32,
-    /// The password box of Unlock…, while it shows.
-    unlock: Option<UnlockPrompt>,
-    /// Bumped on every change to the list, so a grid drag that began before one is dropped.
-    pub(crate) revision: u64,
-    /// Exact-content duplicate warnings, shared by both views until the list changes.
-    duplicates: Option<(u64, Arc<[bool]>)>,
-    /// The file the keyboard moved to, for the grid to scroll into view.
-    pub(crate) reveal: Option<u64>,
-    /// Files per grid row as last drawn (Up/Down move a row in the grid).
-    pub(crate) grid_columns: usize,
-    /// A grid zoom asked for this frame (toolbar, keys, pinch); the grid applies it once it has
-    /// laid out, so it can keep the same cards in view.
-    pub(crate) zoom_request: Option<f32>,
-    /// The card size slider, which takes the arrow keys while it has the keyboard.
-    pub(crate) zoom_slider: Option<egui::Id>,
-    /// The card kept in place through a zoom gesture: its file, its place among the file's pages
-    /// (0 for the file's own card), how far below the top of the grid it was, and when the grid
-    /// last zoomed (seconds).
-    pub(crate) zoom_anchor: Option<(u64, usize, f32, f64)>,
-    /// Files shown as their pages in the grid (a view, not an edit: no undo step).
-    pub(crate) expanded: BTreeSet<u64>,
-    /// The pages each expanded file shows, worked out again only when its range changes.
-    pub(crate) page_lists: HashMap<u64, crate::combine_grid::PageList>,
-    /// The file (by place in the list) at each place of the grid as last drawn: Up and Down step
-    /// a row of cards, page cards included.
-    pub(crate) grid_places: Vec<usize>,
-    /// A file shown large (a card's magnifier), while it shows.
-    pub(crate) preview: Option<Preview>,
-    /// The card that had the keyboard last frame: Space shows its file large; on any other focused
-    /// widget Space is that widget's.
-    pub(crate) card_focus: Option<egui::Id>,
-    /// That card's file and its place among the file's pages (0 for the file's own card): Space
-    /// on a page card shows that page.
-    pub(crate) card_focus_at: Option<(u64, usize)>,
-    /// Single pages selected in the grid (an expanded file's page cards), by entry id and place
-    /// among the entry's pages; the files' selection is empty while any is.
-    pub(crate) selected_pages: BTreeSet<(u64, usize)>,
-    /// The page a Shift-click selects from.
-    pub(crate) page_anchor: Option<(u64, usize)>,
-    /// "Leave out files that can't be read?", asked when Combine is clicked with such files in the
-    /// list.
-    pub(crate) confirm_skip: bool,
-}
-
-/// The pages a range takes, and the range and page count they were worked out for.
-pub(crate) type PagesTaken = ((String, usize), Arc<[usize]>);
-
-/// A file shown large: which, the place among the pages it adds, and those pages (worked out
-/// again only when its page range or page count changes).
-#[derive(Clone, Debug)]
-pub(crate) struct Preview {
-    pub(crate) file: u64,
-    pub(crate) at: usize,
-    /// The page (0-based, in the file) on screen, for the thumbnails to render.
-    pub(crate) page: Option<usize>,
-    pub(crate) pages: Option<PagesTaken>,
-}
-
-/// A password: kept in memory only, never printed (debug output ends up in logs).
-#[derive(Clone, Default)]
-pub struct Secret(String);
-
-impl std::fmt::Debug for Secret {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str(if self.0.is_empty() { "\"\"" } else { "…" })
-    }
-}
-
-/// Which password a protected file still needs before it can be combined.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Lock {
-    /// The password that opens it.
-    Open,
-    /// It opens, but only its permissions (owner) password allows copying its pages.
-    Permissions,
-}
-
-/// The combine list's field-name conflicts, computed once per list (it opens the files):
-/// for each file, the renames combining would make of its form fields. Keyed by the file ids
-/// and their lock state, so unlocking a file refreshes it.
-#[derive(Default, Debug)]
-pub struct ConflictPreview {
-    key: (Vec<u64>, Vec<bool>),
-    per_file: Vec<Vec<(String, String)>>,
-}
-
-impl ConflictPreview {
-    /// Bring the preview in step with `files`, opening them through the engine when the list
-    /// changed. A file split into parts is combined as one file, once — each group's first
-    /// entry stands for it, as the combine does — and every part shows the file's preview.
-    /// A file that cannot be opened previews as nothing (its row says why).
-    fn refresh(&mut self, session: &pdfcraft_engine::Session, files: &[CombineFile]) {
-        let key = (files.iter().map(|f| f.id).collect(), files.iter().map(|f| f.password.is_some()).collect());
-        if self.key == key && self.per_file.len() == files.len() {
-            return;
-        }
-        let mut groups: Vec<u64> = Vec::new();
-        let mut sources: Vec<pdfcraft_engine::CombineSource> = Vec::new();
-        let mut passwords: Vec<Option<&str>> = Vec::new();
-        for f in files {
-            if groups.contains(&f.group) {
-                continue;
-            }
-            groups.push(f.group);
-            sources.push((f.name.clone(), f.bytes.clone(), None));
-            passwords.push(f.password.as_ref().map(|p| p.0.as_str()));
-        }
-        let per_group = session.combine_field_conflicts(&sources, &passwords);
-        self.per_file =
-            files.iter().map(|f| groups.iter().position(|g| *g == f.group).and_then(|at| per_group.get(at)).cloned().unwrap_or_default()).collect();
-        self.key = key;
-    }
-}
-
-/// Unlock…'s password box: the rows it unlocks and what has been typed.
-#[derive(Clone, Debug)]
-struct UnlockPrompt {
-    rows: Vec<u64>,
-    input: Secret,
-    show: bool,
-    error: Option<String>,
-    /// Where the box opens (below the link or button that asked for it).
-    at: egui::Pos2,
-    focused: bool,
-}
-
-/// What can be known about a file up front, opened with a password or not.
-#[derive(Clone)]
-struct Assessed {
-    pages: usize,
-    /// Each page's displayed size in points (empty when the inspector couldn't read it).
-    sizes: Arc<[(f32, f32)]>,
-    problem: Option<String>,
-    lock: Option<Lock>,
-    notes: Vec<String>,
-}
-
-enum AssessError {
-    WrongPassword,
-    Unreadable(String),
-}
-
-/// Read `bytes` (with `password`, if given) for the list: pages, what stops it being combined
-/// and which password would help, and warnings.
-fn assess(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<Assessed, AssessError> {
-    // The engine that combines decides whether the password works; the inspector (which may
-    // not accept every password the engine does, e.g. an RC4 owner password) adds the details.
-    let check = pdfcraft_engine::combine_source_check(bytes, password);
-    if check == Err(SourceProblem::WrongPassword) {
-        return Err(AssessError::WrongPassword);
-    }
-    let info = pdfcraft_render::inspect(bytes.clone(), password);
-    if let (Err(SourceProblem::Unreadable(e)), Err(_)) = (&check, &info) {
-        return Err(AssessError::Unreadable(e.clone()));
-    }
-    let info = info.ok();
-    let pages = match &info {
-        Some(i) => i.pages.len(),
-        None => pdfcraft_engine::source_page_count(bytes, password).unwrap_or(0),
-    };
-    let sizes: Arc<[(f32, f32)]> = match &info {
-        Some(i) => i.pages.iter().map(|p| (p.width, p.height)).collect(),
-        None => Arc::from(Vec::new()),
-    };
-    let encrypted = password.is_some() || info.as_ref().is_some_and(|i| i.encrypted);
-    let warnings = info.map(|i| i.warnings).unwrap_or_default();
-    let (problem, lock) = match check {
-        Ok(()) => (None, None),
-        Err(SourceProblem::Password) => (Some(tl!("Password-protected").to_string()), Some(Lock::Open)),
-        Err(SourceProblem::WrongPassword) => return Err(AssessError::WrongPassword),
-        Err(SourceProblem::NotPermitted) if password.is_some() => (
-            Some(tl!("Opened, but its security settings don't allow combining. Enter the permissions password.").to_string()),
-            Some(Lock::Permissions),
-        ),
-        Err(SourceProblem::NotPermitted) => (Some(tl!("Its security settings don't allow copying pages").to_string()), Some(Lock::Permissions)),
-        Err(SourceProblem::Unreadable(e)) => (Some(crate::i18n::fmt(tl!("Can't be read: {e}"), &[("e", &e)])), None),
-    };
-    let mut notes = Vec::new();
-    // The combined file is a new, unprotected document: protection doesn't carry over.
-    if encrypted && problem.is_none() {
-        notes.push(if password.is_some() {
-            tl!("Unlocked: the combined file won't be password-protected").to_string()
-        } else {
-            tl!("Protected: the combined file won't keep its security settings").to_string()
-        });
-    }
-    notes.extend(warnings.into_iter().take(5));
-    Ok(Assessed { pages, sizes, problem, lock, notes })
-}
-
-#[derive(Clone, Debug)]
-struct Snapshot {
-    files: Vec<CombineFile>,
-    selected: BTreeSet<u64>,
-    sort: Option<(SortKey, bool)>,
-}
-
-/// A file arriving in the list (picked, dropped or already open).
-pub(crate) struct Incoming {
-    pub name: String,
-    pub bytes: Arc<Vec<u8>>,
-    pub modified: Option<SystemTime>,
-    /// Something to tell the user about where it came from.
-    pub note: Option<String>,
-    /// The open document it is, when it came from a tab.
-    pub open_doc: Option<pdfcraft_engine::DocId>,
-}
-
-/// A new value for [`CombineFile::auth`]: counted for the whole run, outside the undo history.
-fn next_auth() -> u64 {
-    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
-    NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
-}
-
-/// A page range checked: the pages it takes and the first of them (0-based), or why it's wrong.
-type RangeCheck = Result<(usize, usize), String>;
-
-#[derive(Clone, Debug)]
-pub struct CombineFile {
-    /// Stable while the file is in the list (selection, undo).
-    pub id: u64,
-    /// The file it is (part of): the entries a file is split into (a page moved between another
-    /// file's pages) share it. Combined as one file, unlocked together, counted once.
-    pub(crate) group: u64,
-    pub name: String,
-    pub bytes: Arc<Vec<u8>>,
-    /// The file as it was added: `bytes` itself for a PDF, the image or text it was made from
-    /// otherwise (converted anew, with its own date, each time it is added).
-    source: Arc<Vec<u8>>,
-    pub pages: usize,
-    /// Each page's displayed size in points; shared, so undo snapshots don't copy it.
-    pub(crate) sizes: Arc<[(f32, f32)]>,
-    /// How the file was read (with which password): a new value every time it is read, never
-    /// reused, not even after undo, so a thumbnail made another way is never taken for this one.
-    pub(crate) auth: u64,
-    /// The pages to take ("" = all).
-    pub range: String,
-    /// When the file was last modified (desktop picks and drops only).
-    pub modified: Option<SystemTime>,
-    /// Why the file can't be combined (password, security settings), if so.
-    pub problem: Option<String>,
-    /// The password that would let it be combined, while one is needed.
-    pub lock: Option<Lock>,
-    /// The password it was unlocked with.
-    password: Option<Secret>,
-    /// Warnings that don't stop it being combined.
-    pub notes: Vec<String>,
-    /// Where it came from, shown among the warnings (e.g. an open document's unsaved changes).
-    origin_note: Option<String>,
-    /// The open document it is, when it came from a tab: Add open documents leaves it out.
-    open_doc: Option<pdfcraft_engine::DocId>,
-    /// The range last checked and the result: the number of pages it takes and the first of
-    /// them (0-based), or why it is wrong.
-    checked: Option<(String, RangeCheck)>,
-}
-
-impl CombineTab {
-    fn duplicate_warnings(&mut self, files: &[CombineFile]) -> Arc<[bool]> {
-        if let Some((revision, flags)) = &self.duplicates
-            && *revision == self.revision
-        {
-            return flags.clone();
-        }
-        // Only same-named, same-sized files can be repeats. Avoid reading the bytes of
-        // unrelated files, and never count a source split into parts as several additions.
-        let mut candidates: HashMap<(&str, usize), Vec<usize>> = HashMap::new();
-        for (i, f) in files.iter().enumerate() {
-            candidates.entry((&f.name, f.source.len())).or_default().push(i);
-        }
-        let mut twice = vec![false; files.len()];
-        for indices in candidates.values() {
-            let Some(first) = indices.first().and_then(|i| files.get(*i)) else { continue };
-            if indices.iter().all(|i| files.get(*i).is_some_and(|f| f.group == first.group)) {
-                continue;
-            }
-            // Slice keys check exact bytes even when their hashes collide.
-            let mut contents: HashMap<&[u8], Vec<usize>> = HashMap::new();
-            for &i in indices {
-                if let Some(f) = files.get(i) {
-                    contents.entry(f.source.as_slice()).or_default().push(i);
-                }
-            }
-            for copies in contents.values() {
-                let Some(first) = copies.first().and_then(|i| files.get(*i)) else { continue };
-                if copies.iter().any(|i| files.get(*i).is_some_and(|f| f.group != first.group)) {
-                    for &i in copies {
-                        if let Some(flag) = twice.get_mut(i) {
-                            *flag = true;
-                        }
-                    }
-                }
-            }
-        }
-        let flags: Arc<[bool]> = twice.into();
-        self.duplicates = Some((self.revision, flags.clone()));
-        flags
-    }
-}
-
-impl CombineFile {
-    fn take(&mut self, a: Assessed, password: Option<Secret>) {
-        self.pages = a.pages;
-        self.sizes = a.sizes;
-        self.problem = a.problem;
-        self.lock = a.lock;
-        self.password = password;
-        self.auth = next_auth();
-        self.notes = self.origin_note.iter().cloned().chain(a.notes).collect();
-        self.checked = None;
-    }
-
-    /// Whether the file can't be read at all (damaged, or a type that can't be made into a PDF):
-    /// it stays in the list, with why, and Combine leaves it out once the user agrees. A
-    /// password-protected file can be unlocked instead, so it isn't one.
-    pub(crate) fn unreadable(&self) -> bool {
-        self.problem.is_some() && self.lock.is_none()
-    }
-
-    /// The password the file was unlocked with, if any.
-    pub(crate) fn password(&self) -> Option<&str> {
-        self.password.as_ref().map(|p| p.0.as_str())
-    }
-
-    /// The number of pages `range` takes, or why it can't be used. Checked again only when the
-    /// range changes.
-    pub fn selection(&mut self) -> Result<usize, String> {
-        self.checked_range().map(|(count, _)| count)
-    }
-
-    /// The first page (0-based) the range takes, in its order ("3, 1" starts with page 3): the
-    /// page the grid shows for the file.
-    pub fn first_page(&mut self) -> Result<usize, String> {
-        self.checked_range().map(|(_, first)| first)
-    }
-
-    /// The first page the range takes, without updating the cache (read-only callers).
-    pub(crate) fn first_taken(&self) -> Option<usize> {
-        match &self.checked {
-            Some((range, result)) if *range == self.range => result.as_ref().ok().map(|(_, first)| *first),
-            _ => self.pages_taken().ok()?.first().copied(),
-        }
-    }
-
-    /// Every page (0-based) the range takes, in its order: what the preview flips through.
-    pub(crate) fn pages_taken(&self) -> Result<Vec<usize>, String> {
-        if self.range.trim().is_empty() {
-            return Ok((0..self.pages).collect());
-        }
-        match pdfcraft_engine::print::select_pages(self.pages, Some(&self.range), &[], pdfcraft_engine::print::Subset::All, false) {
-            Ok(p) if p.is_empty() => Err(tl!("No pages selected").to_string()),
-            Ok(p) => Ok(p),
-            Err(e) => Err(e.to_string()),
-        }
-    }
-
-    fn checked_range(&mut self) -> RangeCheck {
-        if let Some((range, result)) = &self.checked
-            && *range == self.range
-        {
-            return result.clone();
-        }
-        let result = if self.range.trim().is_empty() {
-            // (A file whose pages couldn't be counted is left to the engine, as before; the grid
-            // checks the first page against the page count.)
-            Ok((self.pages, 0))
-        } else {
-            match pdfcraft_engine::print::select_pages(self.pages, Some(&self.range), &[], pdfcraft_engine::print::Subset::All, false) {
-                Ok(p) => match p.first() {
-                    Some(first) => Ok((p.len(), *first)),
-                    None => Err(tl!("No pages selected").to_string()),
-                },
-                Err(e) => Err(e.to_string()),
-            }
-        };
-        self.checked = Some((self.range.clone(), result.clone()));
-        result
-    }
-
-    /// 0 = can't be combined, 1 = has warnings, 2 = fine: the Warnings column's sort order.
-    fn severity(&mut self) -> u8 {
-        if self.problem.is_some() || self.selection().is_err() {
-            0
-        } else if !self.notes.is_empty() {
-            1
-        } else {
-            2
-        }
-    }
-}
-
-#[derive(Clone)]
-pub(crate) enum RowAction {
-    /// A click on row `i` (Ctrl/⌘ toggles it, Shift selects up to it).
-    Click(usize, Modifiers),
-    SelectAll,
-    /// An arrow key: `by` files on (1 in the list, or along a grid row; a grid row's length for
-    /// Up/Down in the grid). With Shift the selection grows.
-    Step {
-        down: bool,
-        by: usize,
-        extend: bool,
-    },
-    MoveUp,
-    MoveDown,
-    Remove,
-    /// One file's card trash: that file only, whatever else is selected.
-    RemoveFile(u64),
-    /// One file's magnifier: show it large.
-    Preview(u64),
-    /// Space: show the file the keyboard is on (or the first selected) large.
-    PreviewSelected,
-    /// A page card's magnifier: show its file large, from that page (its place among the pages
-    /// the file adds).
-    PreviewAt(u64, usize),
-    /// Show one file as its pages in the grid (`true`), or as its card again.
-    Expand(u64, bool),
-    /// Every file that adds more than one page, as its pages (`true`), or all as cards again.
-    ExpandAll(bool),
-    /// A click on a page card: that page (by entry id and place among its pages) selected,
-    /// Ctrl/⌘ toggling it, Shift selecting up to it.
-    ClickPage(u64, usize, Modifiers),
-    /// A page card (and the rest of the selected pages, if it is selected) dropped before page
-    /// `gap` of the list (see [`moved_pages`]), if the list hasn't changed since the drag began.
-    MovePages {
-        page: (u64, usize),
-        revision: u64,
-        gap: usize,
-    },
-    /// One page's trash (`Some`), or the selected pages: out of the list.
-    RemovePages(Option<(u64, usize)>),
-    /// Row `from` (and the rest of the selection, if it is selected) dropped on row `to`.
-    Drop {
-        from: usize,
-        to: usize,
-    },
-    /// A grid card (and the rest of the selection, if it is selected) dropped at `gap`
-    /// (0 = before the first file, n = after the last), if the list hasn't changed since the
-    /// drag began.
-    DropAt {
-        file: u64,
-        revision: u64,
-        gap: usize,
-    },
-    Sort(SortKey),
-    /// Unlock… on row `i` (and the rest of the selection, if it is selected), or on the
-    /// selection (`None`); the password box opens at the position.
-    Unlock(Option<usize>, egui::Pos2),
-}
-
-/// What the table reports besides row actions.
-#[derive(Default)]
-struct TableEvents {
-    action: Option<RowAction>,
-    range_focused: bool,
-    range_changed: bool,
-}
-
-/// The Combine files page.
-pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
-    let t = Tokens::get(ui.ctx());
-    let files_hovering = ui.ctx().input(|i| !i.raw.hovered_files.is_empty());
-    // Ranges are checked before anything below reads them.
-    let checks: Vec<Result<usize, String>> = app.combine_draft.iter_mut().map(CombineFile::selection).collect();
-    // Same-named form fields across the files are renamed when combining: preview it once per
-    // list, so the Warnings column can say so before anything is combined.
-    app.combine_conflicts.refresh(&app.session, &app.combine_draft);
-    let conflicts = app.combine_conflicts.per_file.clone();
-    let twice = app.combine_tab.duplicate_warnings(&app.combine_draft);
-    let n = app.combine_draft.len();
-    let ids: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
-    app.combine_tab.selected.retain(|id| ids.contains(id));
-    // Pages stay picked only while they show (a grid card of an expanded file), so the trash or
-    // Delete never takes a page the user can't see.
-    {
-        let tab = &mut app.combine_tab;
-        if app.combine_view == CombineView::Grid {
-            let shown: BTreeSet<(u64, usize)> = app
-                .combine_draft
-                .iter_mut()
-                .filter(|f| tab.expanded.contains(&f.id))
-                .flat_map(|f| {
-                    let id = f.id;
-                    (0..f.selection().unwrap_or(0)).map(move |nth| (id, nth))
-                })
-                .collect();
-            tab.selected_pages.retain(|p| shown.contains(p));
-        } else {
-            tab.selected_pages.clear();
-        }
-        if tab.selected_pages.is_empty() {
-            tab.page_anchor = None;
-        }
-    }
-    // A file stays expanded only while it can show as its pages (not locked again by undo, nor
-    // edited down to one page or a bad range): it doesn't come back expanded by itself.
-    {
-        let tab = &mut app.combine_tab;
-        let draft = &app.combine_draft;
-        let lists = &mut tab.page_lists;
-        tab.expanded.retain(|id| draft.iter().find(|f| f.id == *id).is_some_and(|f| crate::combine_grid::pages_shown(lists, f).is_some()));
-        let expanded = &tab.expanded;
-        tab.page_lists.retain(|id, _| expanded.contains(id));
-    }
-    let selected: Vec<bool> = ids.iter().map(|id| app.combine_tab.selected.contains(id)).collect();
-    let count = selected.iter().filter(|s| **s).count();
-    let blocker = blocker(&app.combine_draft, &checks);
-    let grid = app.combine_view == CombineView::Grid;
-    let columns = grid.then_some(app.combine_tab.grid_columns);
-    // The keyboard is the list's unless a text field, the password box or the size slider has it.
-    let slider_focused = grid && app.combine_tab.zoom_slider.is_some_and(|id| ui.memory(|m| m.has_focus(id)));
-    // (Nor while a file is shown large: its window may only open or close this frame.)
-    let covered = app.combine_tab.unlock.is_some() || app.combine_tab.preview.is_some() || app.combine_tab.confirm_skip;
-    let focus = ui.memory(|m| m.focused());
-    let space = focus.is_none() || focus == app.combine_tab.card_focus;
-    let any_picked = count > 0 || !app.combine_tab.selected_pages.is_empty();
-    let keys = if covered || slider_focused { None } else { keyboard(ui, n, any_picked, columns, space) };
-    let mut events = TableEvents { action: keys, ..Default::default() };
-    // ⌘+ / ⌘− / ⌘0 size the grid's cards (instead of the whole window's text).
-    if grid && n > 0 && !covered {
-        app.combine_tab.zoom_request = zoom_keys(ui, app.combine_zoom).or(app.combine_tab.zoom_request);
-    }
-    // An arrow pressed or a zoom asked for in the list has nothing for the grid to do later.
-    if !grid {
-        app.combine_tab.reveal = None;
-        app.combine_tab.zoom_request = None;
-    }
-    let mut combine = false;
-
-    egui::Frame::NONE.inner_margin(egui::Margin::symmetric(28, 20)).show(ui, |ui| {
-        // Title and Combine.
-        ui.horizontal(|ui| {
-            ui.label(egui::RichText::new(tl!("Combine files")).font(theme::semibold(20.0)));
-            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-                let response = ui.add_enabled_ui(blocker.is_none(), |ui| widgets::icon_pill(ui, "files", tl!("Combine"), true)).inner;
-                if let Some(why) = &blocker {
-                    response.clone().on_disabled_hover_text(why);
-                }
-                if response.clicked() {
-                    combine = true;
-                }
-            });
-        });
-        let hint = if grid {
-            tl!("Files are combined in the order shown. Drag them to change it.")
-        } else {
-            tl!("Files are combined from top to bottom. Leave Pages empty to take every page.")
-        };
-        ui.label(egui::RichText::new(hint).color(t.text_faint));
-        ui.add_space(12.0);
-
-        // Toolbar: on two lines when the window is narrow.
-        ui.horizontal_wrapped(|ui| {
-            ui.spacing_mut().item_spacing.x = 6.0;
-            // Where the line ends (an overflowing line would move it).
-            let edge = ui.max_rect().right();
-            add_menu(app, ui);
-            let open_docs: Vec<(usize, String)> =
-                app.views.iter().enumerate().filter_map(|(i, _)| crate::canvas::tab_label(app, i).map(|name| (i, name))).collect();
-            let response = ui.add_enabled_ui(!open_docs.is_empty(), |ui| widgets::icon_pill(ui, "file-plus", tl!("Add open documents"), false)).inner;
-            response.clone().on_disabled_hover_text(tl!("No documents are open"));
-            egui::Popup::menu(&response).show(|ui| {
-                if open_docs.len() > 1 && ui.button(tl!("All open documents")).clicked() {
-                    app.add_open_documents(&open_docs.iter().map(|(i, _)| *i).collect::<Vec<_>>());
-                    ui.close();
-                }
-                for (i, name) in &open_docs {
-                    if ui.button(crate::bidi::visual(name).as_ref()).clicked() {
-                        app.add_open_documents(&[*i]);
-                        ui.close();
-                    }
-                }
-            });
-            group(ui, &t, edge, 4.0 * 30.0 + 3.0 * 6.0);
-            // Moves need a selected row with room to move; the buttons stay put either way.
-            let can_up = selected.iter().skip_while(|s| **s).any(|s| *s);
-            let can_down = selected.iter().rev().skip_while(|s| **s).any(|s| *s);
-            let why = tl!("Select a file first");
-            let pages_picked = app.combine_tab.selected_pages.len();
-            let remove = match (pages_picked, count) {
-                (1, _) => tl!("Remove page").to_string(),
-                (k, _) if k > 1 => crate::i18n::fmt(tl!("Remove {n} pages"), &[("n", &k.to_string())]),
-                (_, 1) => {
-                    let name = app.combine_draft.iter().find(|f| app.combine_tab.selected.contains(&f.id)).map_or("", |f| f.name.as_str());
-                    crate::i18n::fmt(tl!("Remove {name}"), &[("name", name)])
-                }
-                (_, 0) => tl!("Remove").to_string(),
-                (_, k) => crate::i18n::fmt(tl!("Remove {n} files"), &[("n", &k.to_string())]),
-            };
-            if tool(ui, can_up, "chevron-up", tl!("Move up"), why).clicked() {
-                events.action = Some(RowAction::MoveUp);
-            }
-            if tool(ui, can_down, "chevron-down", tl!("Move down"), why).clicked() {
-                events.action = Some(RowAction::MoveDown);
-            }
-            if tool(ui, count > 0 || pages_picked > 0, "trash-2", &remove, why).clicked() {
-                events.action = Some(RowAction::Remove);
-            }
-            let locked = app.combine_draft.iter().any(|f| f.lock.is_some() && app.combine_tab.selected.contains(&f.id));
-            let unlock = tool(ui, locked, "lock-open", tl!("Unlock…"), tl!("Select a password-protected file first"));
-            if unlock.clicked() {
-                events.action = Some(RowAction::Unlock(None, unlock.rect.left_bottom() + vec2(0.0, 6.0)));
-            }
-            group(ui, &t, edge, 2.0 * 30.0 + 6.0);
-            let (undo, redo) = (!app.combine_tab.undo.is_empty(), !app.combine_tab.redo.is_empty());
-            if tool(ui, undo, "undo-2", tl!("Undo"), tl!("Nothing to undo")).clicked() {
-                app.execute("edit.undo");
-            }
-            if tool(ui, redo, "redo-2", tl!("Redo"), tl!("Nothing to redo")).clicked() {
-                app.execute("edit.redo");
-            }
-            group(ui, &t, edge, 2.0 * 30.0 + 6.0);
-            // Thumbnails or the table; the choice is kept in the settings.
-            for (view, icon, label) in [(CombineView::Grid, "layout-grid", tl!("Grid view")), (CombineView::List, "list", tl!("List view"))] {
-                if icons::button(ui, icon, 30.0, app.combine_view == view, label).clicked() {
-                    app.combine_view = view;
-                }
-            }
-            if count > 1 {
-                ui.add_space(6.0);
-                ui.label(egui::RichText::new(crate::i18n::fmt(tl!("{n} selected"), &[("n", &count.to_string())])).color(t.text_muted));
-            }
-            if grid && n > 0 {
-                // Every file as its pages, or all as cards again.
-                group(ui, &t, edge, 2.0 * 30.0 + 6.0);
-                let can_expand = app.combine_draft.iter_mut().any(|f| !app.combine_tab.expanded.contains(&f.id) && expandable(f));
-                if ui.add_enabled_ui(can_expand, |ui| icons::button(ui, "maximize-2", 30.0, false, tl!("Expand all"))).inner.clicked() {
-                    events.action = Some(RowAction::ExpandAll(true));
-                }
-                let can_collapse = !app.combine_tab.expanded.is_empty();
-                if ui.add_enabled_ui(can_collapse, |ui| icons::button(ui, "minimize-2", 30.0, false, tl!("Collapse all"))).inner.clicked() {
-                    events.action = Some(RowAction::ExpandAll(false));
-                }
-                zoom_controls(app, ui, &t, edge);
-            }
-        });
-        ui.add_space(10.0);
-
-        // The list, in a card that highlights while files are dragged over the window.
-        let footer_h = 34.0;
-        let card_h = (ui.available_height() - footer_h).max(120.0);
-        let stroke = if files_hovering { Stroke::new(2.0, t.accent) } else { Stroke::new(1.0, t.border) };
-        egui::Frame::NONE.fill(t.card).stroke(stroke).corner_radius(CornerRadius::same(t.radius)).inner_margin(egui::Margin::symmetric(8, 6)).show(
-            ui,
-            |ui| {
-                ui.set_min_height(card_h - 12.0);
-                // The grid scrolls inside the card, leaving room for the totals below it.
-                if grid {
-                    ui.set_max_height(card_h - 12.0);
-                }
-                ui.set_width(ui.available_width());
-                if n == 0 {
-                    empty_state(app, ui, &t, files_hovering);
-                // The view as the toolbar left it: a click on List view this frame starts no
-                // thumbnail renders.
-                } else if app.combine_view == CombineView::Grid {
-                    if let Some(action) = crate::combine_grid::grid(app, ui, &t, &checks, &selected, &twice) {
-                        events.action = Some(action);
-                    }
-                } else {
-                    let table_events = table(app, ui, &t, &checks, &selected, &conflicts, &twice);
-                    events.range_focused |= table_events.range_focused;
-                    events.range_changed |= table_events.range_changed;
-                    if table_events.action.is_some() {
-                        events.action = table_events.action;
-                    }
-                }
-            },
-        );
-
-        // A file shown large, over everything.
-        crate::combine_grid::preview(app, ui.ctx(), &t);
-
-        // Totals.
-        ui.add_space(8.0);
-        if n > 0 {
-            ui.horizontal(|ui| {
-                let pages: usize = checks.iter().filter_map(|c| c.as_ref().ok()).sum();
-                // Each file's size once, however many parts it is in.
-                let mut counted = BTreeSet::new();
-                let size: usize = app.combine_draft.iter().filter(|f| counted.insert(f.group)).map(|f| f.bytes.len()).sum();
-                // A file split into parts counts once.
-                let n = app.combine_draft.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len();
-                let files = if n == 1 { tl!("1 file").to_string() } else { crate::i18n::fmt(tl!("{n} files"), &[("n", &n.to_string())]) };
-                let pages = if pages == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &pages.to_string())]) };
-                ui.label(egui::RichText::new(format!("{files} · {pages} · {}", crate::panels::human_size(size))).color(t.text_muted));
-                let bad = app
-                    .combine_draft
-                    .iter()
-                    .zip(&checks)
-                    .filter(|(f, c)| f.problem.is_some() || c.is_err())
-                    .map(|(f, _)| f.group)
-                    .collect::<BTreeSet<u64>>()
-                    .len();
-                if bad > 0 {
-                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-                        let text = if bad == 1 {
-                            tl!("1 file needs attention").to_string()
-                        } else {
-                            crate::i18n::fmt(tl!("{n} files need attention"), &[("n", &bad.to_string())])
-                        };
-                        ui.label(egui::RichText::new(text).color(ERROR));
-                    });
-                }
-            });
-        }
-    });
-
-    // A Pages field taking the keyboard remembers the list; its first change makes the undo step.
-    if events.range_focused {
-        app.combine_tab.range_edit = Some(app.combine_snapshot());
-    }
-    if events.range_changed
-        && let Some(before) = app.combine_tab.range_edit.take()
-    {
-        app.combine_push_undo(before);
-    }
-    unlock_prompt(app, ui.ctx());
-    if let Some(action) = events.action {
-        app.combine_apply(action);
-    }
-    if combine && blocker.is_none() {
-        if app.combine_draft.iter().any(CombineFile::unreadable) {
-            app.combine_tab.confirm_skip = true;
-        } else {
-            app.combine_staged();
-        }
-    }
-    skip_prompt(app, ui.ctx());
-}
-
-/// Most files the prompt names; the rest are counted.
-const SKIP_PROMPT_NAMES: usize = 8;
-
-/// "Leave out files that can't be read?": names them and why, then combines the others, or not.
-fn skip_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    if !app.combine_tab.confirm_skip {
-        return;
-    }
-    let t = Tokens::get(ctx);
-    let mut left_out: Vec<(&str, &str)> = Vec::new();
-    let mut seen = BTreeSet::new();
-    for f in app.combine_draft.iter().filter(|f| f.unreadable() && seen.insert(f.group)) {
-        left_out.push((f.name.as_str(), f.problem.as_deref().unwrap_or_default()));
-    }
-    let mut choice: Option<bool> = None;
-    let modal = egui::Modal::new(egui::Id::new("combine-skip")).show(ctx, |ui| {
-        ui.set_width(460.0);
-        ui.horizontal(|ui| {
-            ui.add(icons::image("triangle-alert", 22.0, ERROR));
-            ui.add(egui::Label::new(egui::RichText::new(tl!("Leave out files that can't be read?")).font(theme::semibold(16.0))).wrap());
-        });
-        ui.add_space(6.0);
-        ui.label(egui::RichText::new(tl!("These files can't be read, so they won't be in the combined PDF:")).color(t.text_muted));
-        ui.add_space(6.0);
-        for (name, why) in left_out.iter().take(SKIP_PROMPT_NAMES) {
-            ui.horizontal_wrapped(|ui| {
-                ui.label(egui::RichText::new(format!("• {}", crate::bidi::visual(name))).strong());
-                ui.label(egui::RichText::new(*why).color(t.text_muted));
-            });
-        }
-        if left_out.len() > SKIP_PROMPT_NAMES {
-            let more = (left_out.len() - SKIP_PROMPT_NAMES).to_string();
-            ui.label(egui::RichText::new(crate::i18n::fmt(tl!("and {n} more"), &[("n", &more)])).color(t.text_muted));
-        }
-        ui.add_space(14.0);
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, tl!("Combine the rest"), true).clicked() {
-                choice = Some(true);
-            }
-            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                choice = Some(false);
-            }
-        });
-    });
-    if choice.is_none() && modal.should_close() {
-        choice = Some(false);
-    }
-    if let Some(go) = choice {
-        app.combine_tab.confirm_skip = false;
-        if go {
-            app.combine_staged();
-        }
-    }
-}
-
-/// Unlock…'s password box, floating below what opened it. Enter unlocks, Escape or a click
-/// elsewhere closes it.
-fn unlock_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let Some(mut prompt) = app.combine_tab.unlock.take() else { return };
-    let t = Tokens::get(ctx);
-    let files: Vec<&CombineFile> = app.combine_draft.iter().filter(|f| prompt.rows.contains(&f.id)).collect();
-    let title = match files.as_slice() {
-        [one] => crate::i18n::fmt(tl!("Unlock {name}"), &[("name", &one.name)]),
-        many => crate::i18n::fmt(tl!("Unlock {n} files"), &[("n", &many.len().to_string())]),
-    };
-    let explain = if files.iter().all(|f| f.lock == Some(Lock::Permissions)) {
-        tl!("Enter the permissions password to allow combining")
-    } else {
-        tl!("Enter the password that opens it")
-    };
-    let batch = files.len() > 1;
-    let (mut submit, mut cancel) = (false, false);
-    let area = egui::Area::new(egui::Id::new("combine-unlock")).order(egui::Order::Foreground).fixed_pos(prompt.at).show(ctx, |ui| {
-        egui::Frame::popup(ui.style()).inner_margin(egui::Margin::same(14)).show(ui, |ui| {
-            ui.set_width(340.0);
-            ui.horizontal(|ui| {
-                ui.add(icons::image("lock", 16.0, t.icon));
-                ui.add(egui::Label::new(egui::RichText::new(&title).font(theme::semibold(14.0))).truncate());
-            });
-            ui.add_space(4.0);
-            ui.label(egui::RichText::new(explain).color(t.text_muted));
-            if batch {
-                ui.label(egui::RichText::new(tl!("The same password is tried on each file.")).small().color(t.text_faint));
-            }
-            ui.add_space(8.0);
-            ui.horizontal(|ui| {
-                crate::widgets::begin_dialog(ui);
-                let field = ui.add(crate::widgets::line(&mut prompt.input.0).password(!prompt.show).hint_text(tl!("Password")).desired_width(290.0));
-                if !prompt.focused {
-                    field.request_focus();
-                    prompt.focused = true;
-                }
-                if field.changed() {
-                    prompt.error = None;
-                }
-                if field.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
-                    submit = true;
-                }
-                let (icon, tip) = if prompt.show { ("eye-off", tl!("Hide password")) } else { ("eye", tl!("Show password")) };
-                if icons::button(ui, icon, 26.0, false, tip).clicked() {
-                    prompt.show = !prompt.show;
-                }
-            });
-            if let Some(e) = &prompt.error {
-                ui.label(egui::RichText::new(e).color(ERROR));
-            }
-            ui.add_space(6.0);
-            ui.label(egui::RichText::new(tl!("The password is only used to read the file; it isn't saved.")).small().color(t.text_faint));
-            ui.add_space(8.0);
-            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-                if ui.add_enabled_ui(!prompt.input.0.is_empty(), |ui| widgets::pill_button(ui, tl!("Unlock"), true)).inner.clicked() {
-                    submit = true;
-                }
-                if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                    cancel = true;
-                }
-            });
-        });
-    });
-    if ctx.input(|i| i.key_pressed(egui::Key::Escape)) || area.response.clicked_elsewhere() {
-        cancel = true;
-    }
-    if submit && !prompt.input.0.is_empty() {
-        let rows = prompt.rows.clone();
-        if app.combine_unlock(&rows, &prompt.input.0) {
-            return;
-        }
-        prompt.error = Some(tl!("Wrong password").to_string());
-        prompt.focused = false;
-    }
-    if !cancel {
-        app.combine_tab.unlock = Some(prompt);
-    }
-}
-
-fn separator(ui: &mut egui::Ui, t: &Tokens) {
-    ui.add_space(4.0);
-    // As tall as the buttons on this line (the toolbar can take two).
-    let top = ui.cursor().top();
-    ui.painter().vline(ui.cursor().left(), (top + 4.0)..=(top + 26.0), Stroke::new(1.0, t.divider));
-    ui.add_space(6.0);
-}
-
-/// Before a group of toolbar buttons `width` wide: a divider, or a new line when the group
-/// doesn't fit before `edge` (the toolbar wraps between groups, never inside one).
-fn group(ui: &mut egui::Ui, t: &Tokens, edge: f32, width: f32) {
-    if edge - ui.cursor().min.x < width + 10.0 {
-        ui.end_row();
-    } else {
-        separator(ui, t);
-    }
-}
-
-/// A toolbar icon button, disabled with a reason.
-fn tool(ui: &mut egui::Ui, enabled: bool, icon: &str, label: &str, disabled_why: &str) -> egui::Response {
-    ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, 30.0, false, label)).inner.on_disabled_hover_text(disabled_why)
-}
-
-/// Whether a file can be shown as its pages: readable, unlocked, and adding more than one.
-fn expandable(f: &mut CombineFile) -> bool {
-    f.lock.is_none() && f.problem.is_none() && f.selection().is_ok_and(|k| k > 1 && k <= crate::combine_grid::MAX_EXPAND)
-}
-
-/// Why Combine can't run yet, if so.
-fn blocker(files: &[CombineFile], checks: &[Result<usize, String>]) -> Option<String> {
-    // (A file split into parts is still one file.) Files that can't be read are left out, so
-    // they don't count.
-    if files.iter().filter(|f| !f.unreadable()).map(|f| f.group).collect::<BTreeSet<u64>>().len() < 2 {
-        return Some(match files.iter().find(|f| f.unreadable()) {
-            Some(f) => {
-                crate::i18n::fmt(tl!("{name} can't be combined: {why}"), &[("name", &f.name), ("why", f.problem.as_deref().unwrap_or_default())])
-            }
-            None => tl!("Add at least two files").to_string(),
-        });
-    }
-    for (f, check) in files.iter().zip(checks) {
-        if f.unreadable() {
-            continue;
-        }
-        if let Some(p) = &f.problem {
-            return Some(crate::i18n::fmt(tl!("{name} can't be combined: {why}"), &[("name", &f.name), ("why", p)]));
-        }
-        if let Err(e) = check {
-            return Some(crate::i18n::fmt(tl!("Check the pages of {name}: {why}"), &[("name", &f.name), ("why", e)]));
-        }
-    }
-    None
-}
-
-/// While no text field has the keyboard: Up/Down select (Shift extends), Alt+Up/Down move the
-/// selection, Delete removes it, Ctrl/⌘+A selects every file. In the grid (`columns` per row)
-/// Left/Right step one file and Up/Down one row.
-pub(crate) fn keyboard(ui: &egui::Ui, n: usize, any_selected: bool, grid_columns: Option<usize>, space: bool) -> Option<RowAction> {
-    // A focused card or button still leaves the arrows to the list; a text field, an open menu
-    // or a dialog doesn't.
-    let ctx = ui.ctx();
-    if n == 0 || ctx.text_edit_focused() || egui::Popup::is_any_open(ctx) || ctx.memory(|m| m.top_modal_layer().is_some()) {
-        return None;
-    }
-    use egui::Key;
-    ui.ctx().input_mut(|i| {
-        if i.consume_key(Modifiers::COMMAND, Key::A) {
-            return Some(RowAction::SelectAll);
-        }
-        // As Quick Look: the file the keyboard is on, large (the way there without a pointer). A
-        // focused button keeps its Space.
-        if any_selected && space && i.consume_key(Modifiers::NONE, Key::Space) {
-            return Some(RowAction::PreviewSelected);
-        }
-        if any_selected {
-            if i.consume_key(Modifiers::ALT, Key::ArrowUp) {
-                return Some(RowAction::MoveUp);
-            }
-            if i.consume_key(Modifiers::ALT, Key::ArrowDown) {
-                return Some(RowAction::MoveDown);
-            }
-            if i.consume_key(Modifiers::NONE, Key::Delete) || i.consume_key(Modifiers::NONE, Key::Backspace) {
-                return Some(RowAction::Remove);
-            }
-        }
-        let row = grid_columns.unwrap_or(1).max(1);
-        let mut keys = vec![(false, row, Key::ArrowUp), (true, row, Key::ArrowDown)];
-        if grid_columns.is_some() {
-            keys.extend([(false, 1, Key::ArrowLeft), (true, 1, Key::ArrowRight)]);
-        }
-        for (down, by, key) in keys {
-            // Shift first: a plain arrow also matches with Shift held (egui ignores an extra
-            // Shift), which would step instead of extending.
-            if i.consume_key(Modifiers::SHIFT, key) {
-                return Some(RowAction::Step { down, by, extend: true });
-            }
-            if i.consume_key(Modifiers::NONE, key) {
-                return Some(RowAction::Step { down, by, extend: false });
-            }
-        }
-        None
-    })
-}
-
-/// ⌘+ (or ⌘=), ⌘− and ⌘0, while no text field, menu or dialog has the keyboard: the grid zoom
-/// they ask for, from `zoom`.
-fn zoom_keys(ui: &egui::Ui, zoom: f32) -> Option<f32> {
-    use crate::combine_grid::zoom_step;
-    use egui::{Key, KeyboardShortcut};
-    let ctx = ui.ctx();
-    if ctx.text_edit_focused() || egui::Popup::is_any_open(ctx) || ctx.memory(|m| m.top_modal_layer().is_some()) {
-        return None;
-    }
-    // All of them are taken (several can arrive in one slow frame), so none is left for egui to
-    // zoom the whole window with.
-    let (larger, smaller, reset) = ctx.input_mut(|i| {
-        let mut pressed = |k| i.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, k));
-        (pressed(Key::Plus) | pressed(Key::Equals), pressed(Key::Minus), pressed(Key::Num0))
-    });
-    match (larger, smaller, reset) {
-        (_, _, true) => Some(1.0),
-        (true, false, _) => Some(zoom_step(zoom, true)),
-        (false, true, _) => Some(zoom_step(zoom, false)),
-        _ => None,
-    }
-}
-
-/// The grid's card size, at the right of the toolbar (right to left: larger, the percentage, the
-/// slider, smaller), as the page grid's.
-fn zoom_controls(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, edge: f32) {
-    use crate::combine_grid::{ZOOM_RANGE, zoom_step};
-    let zoom = app.combine_zoom;
-    // Two buttons, the percentage, the slider and the spaces between: on a line of their own when
-    // they don't fit beside the rest.
-    let needed = 30.0 + 44.0 + 96.0 + 30.0 + 4.0 * ui.spacing().item_spacing.x + 8.0;
-    if edge - ui.cursor().min.x < needed {
-        ui.end_row();
-    }
-    // Right-aligned on the line, up to its end.
-    let line = Rect::from_min_max(ui.cursor().min, egui::pos2(edge, ui.cursor().min.y + 30.0));
-    ui.scope_builder(egui::UiBuilder::new().max_rect(line).layout(Layout::right_to_left(Align::Center)), |ui| {
-        let larger = ui.add_enabled_ui(zoom < *ZOOM_RANGE.end(), |ui| icons::button(ui, "zoom-in", 30.0, false, tl!("Larger pages"))).inner;
-        if larger.clicked() {
-            app.combine_tab.zoom_request = Some(zoom_step(zoom, true));
-        }
-        let percent =
-            egui::Button::new(egui::RichText::new(format!("{:.0}%", zoom * 100.0)).font(theme::medium(12.0)).color(t.text_muted)).frame(false);
-        let percent = ui.add_sized([44.0, 30.0], percent);
-        percent.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Reset page size")));
-        if percent.on_hover_text(tl!("Reset page size")).clicked() {
-            app.combine_tab.zoom_request = Some(1.0);
-        }
-        let mut value = zoom;
-        ui.spacing_mut().slider_width = 96.0;
-        let slider = ui.add(egui::Slider::new(&mut value, ZOOM_RANGE).show_value(false));
-        // Read out as a percentage, as shown beside it.
-        slider.widget_info(|| egui::WidgetInfo::slider(true, f64::from(value * 100.0).round(), tl!("Page size")));
-        app.combine_tab.zoom_slider = Some(slider.id);
-        if slider.on_hover_text(tl!("Page size")).changed() {
-            app.combine_tab.zoom_request = Some(value);
-        }
-        let smaller = ui.add_enabled_ui(zoom > *ZOOM_RANGE.start(), |ui| icons::button(ui, "zoom-out", 30.0, false, tl!("Smaller pages"))).inner;
-        if smaller.clicked() {
-            app.combine_tab.zoom_request = Some(zoom_step(zoom, false));
-        }
-    });
-}
-
-fn empty_state(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, files_hovering: bool) {
-    ui.vertical_centered(|ui| {
-        ui.add_space((ui.available_height() / 2.0 - 70.0).max(16.0));
-        ui.add(icons::image("files", 40.0, if files_hovering { t.accent } else { t.text_faint }));
-        ui.add_space(10.0);
-        ui.label(egui::RichText::new(tl!("Add the files to combine")).font(theme::medium(15.0)));
-        ui.add_space(4.0);
-        ui.label(egui::RichText::new(tl!("Drop PDFs, images, text files or folders here, or choose them.")).color(t.text_faint));
-        ui.add_space(12.0);
-        let folders = cfg!(not(target_arch = "wasm32"));
-        // Centre the buttons: measure them first.
-        let font = theme::medium(12.5);
-        let width = |s: &str| ui.fonts_mut(|f| f.layout_no_wrap(s.to_owned(), font.clone(), t.text).size().x);
-        let total = width(tl!("Add files…")) + 26.0 + if folders { width(tl!("Add folder…")) + 46.0 + 8.0 } else { 0.0 };
-        ui.horizontal(|ui| {
-            ui.add_space(((ui.available_width() - total) / 2.0).max(0.0));
-            ui.spacing_mut().item_spacing.x = 8.0;
-            if widgets::pill_button(ui, tl!("Add files…"), true).clicked() {
-                app.combine_dialog();
-            }
-            if folders && widgets::icon_pill(ui, "folder", tl!("Add folder…"), false).clicked() {
-                app.combine_add_folder(false);
-            }
-        });
-    });
-}
-
-/// "Add files…" with a menu of the other ways to add: folders (desktop).
-fn add_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
-    if !cfg!(not(target_arch = "wasm32")) {
-        if widgets::icon_pill(ui, "plus", tl!("Add files…"), false).clicked() {
-            app.combine_dialog();
-        }
-        return;
-    }
-    let (main, more) = widgets::split_pill(ui, "plus", tl!("Add files…"), tl!("More ways to add files"));
-    if main.clicked() {
-        app.combine_dialog();
-    }
-    egui::Popup::menu(&more).show(|ui| {
-        ui.set_min_width(220.0);
-        let item = |ui: &mut egui::Ui, icon: &str, label: &str| {
-            ui.add(egui::Button::image_and_text(icons::image(icon, 15.0, ui.visuals().text_color()), label))
-        };
-        if item(ui, "file-plus", tl!("Add files…")).clicked() {
-            app.combine_dialog();
-            ui.close();
-        }
-        if item(ui, "folder", tl!("Add folder…")).on_hover_text(tl!("Every PDF, image and text file in the folder")).clicked() {
-            app.combine_add_folder(false);
-            ui.close();
-        }
-        if item(ui, "folder-open", tl!("Add folder and subfolders…"))
-            .on_hover_text(tl!("Every PDF, image and text file in the folder and the folders inside it"))
-            .clicked()
-        {
-            app.combine_add_folder(true);
-            ui.close();
-        }
-    });
-}
-
-/// The file table.
-fn table(
-    app: &mut PdfCraftApp,
-    ui: &mut egui::Ui,
-    t: &Tokens,
-    checks: &[Result<usize, String>],
-    selected: &[bool],
-    conflicts: &[Vec<(String, String)>],
-    twice: &[bool],
-) -> TableEvents {
-    let mut events = TableEvents::default();
-    let dragging = egui::DragAndDrop::has_payload_of_type::<usize>(ui.ctx());
-    // Until the user resizes a column, the widths follow the window.
-    let gap = ui.spacing().item_spacing.x;
-    let available = ui.available_width() - 18.0 - gap * 6.0;
-    if app.combine_columns.widths.is_none() && (available - app.combine_tab.fitted).abs() > 1.0 {
-        app.combine_tab.fitted = available;
-        app.combine_tab.layout = app.combine_tab.layout.wrapping_add(1);
-    }
-    let widths = app.combine_columns.resolved(available);
-    let rows = Rows { checks, selected, twice, conflicts, dragging, sort: app.combine_tab.sort };
-    let mut heading_event = None;
-    let mut shown = None;
-    egui::ScrollArea::horizontal()
-        .id_salt("combine-files-h")
-        .show(ui, |ui| table_body(app, ui, t, &rows, widths, &mut events, &mut heading_event, &mut shown));
-    // A column resized by hand keeps its width from now on.
-    if let Some(shown) = shown
-        && shown.iter().zip(&widths).any(|(a, b)| (a - b).abs() > 0.5)
-    {
-        app.combine_columns.widths = Some(shown);
-    }
-    match heading_event {
-        Some(HeadingEvent::Sort(key)) => events.action = Some(RowAction::Sort(key)),
-        Some(HeadingEvent::Move { kind, to, after }) => {
-            let mut order: Vec<SortKey> = app.combine_columns.order.iter().copied().filter(|k| *k != kind).collect();
-            let at = order.iter().position(|k| *k == to).map_or(order.len(), |p| if after { p + 1 } else { p });
-            order.insert(at, kind);
-            if let Ok(order) = <[SortKey; 5]>::try_from(order) {
-                app.combine_columns.order = order;
-                app.combine_tab.layout = app.combine_tab.layout.wrapping_add(1);
-            }
-        }
-        Some(HeadingEvent::Reset) => {
-            app.combine_columns = Columns::default();
-            app.combine_tab.fitted = 0.0;
-        }
-        None => {}
-    }
-    events
-}
-
-/// What every row needs to know.
-struct Rows<'a> {
-    checks: &'a [Result<usize, String>],
-    selected: &'a [bool],
-    twice: &'a [bool],
-    /// What combining would rename of this file's form fields (the field-name conflict preview).
-    conflicts: &'a [Vec<(String, String)>],
-    dragging: bool,
-    sort: Option<(SortKey, bool)>,
-}
-
-/// A column heading: the whole cell sorts by its column when clicked, moves the column when
-/// dragged, and offers Reset columns on a right-click.
-fn heading(ui: &mut egui::Ui, t: &Tokens, key: SortKey, sort: Option<(SortKey, bool)>) -> Option<HeadingEvent> {
-    let text = key.label();
-    let rect = ui.max_rect();
-    let response = ui.allocate_rect(rect, Sense::click_and_drag());
-    let arrow = sort.filter(|(k, _)| *k == key).map(|(_, ascending)| ascending);
-    let state = match arrow {
-        Some(true) => tl!("sorted ascending"),
-        Some(false) => tl!("sorted descending"),
-        None => "",
-    };
-    let a11y = if state.is_empty() { text.to_owned() } else { format!("{text}, {state}") };
-    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &a11y));
-    let being_dragged = egui::DragAndDrop::payload::<HeadingDrag>(ui.ctx()).is_some_and(|p| p.0 == key);
-    if being_dragged || response.is_pointer_button_down_on() {
-        ui.painter().rect_filled(rect, CornerRadius::same(4), t.pressed);
-    } else if response.hovered() {
-        ui.painter().rect_filled(rect, CornerRadius::same(4), t.hover);
-    }
-    let colour = if arrow.is_some() { t.text } else { t.text_muted };
-    let galley = ui.painter().layout_no_wrap(text.to_owned(), theme::medium(12.5), colour);
-    let text_pos = egui::pos2(rect.left() + 4.0, rect.center().y - galley.size().y / 2.0);
-    let text_w = galley.size().x;
-    ui.painter().with_clip_rect(rect).galley(text_pos, galley, colour);
-    if let Some(ascending) = arrow {
-        let r = Rect::from_center_size(egui::pos2(rect.left() + text_w + 14.0, rect.center().y), vec2(12.0, 12.0));
-        icons::paint(ui, r, if ascending { "chevron-up" } else { "chevron-down" }, 12.0, t.text);
-    }
-    if response.drag_started() {
-        egui::DragAndDrop::set_payload(ui.ctx(), HeadingDrag(key));
-    }
-    // Another heading dragged over this one: a line where it would go.
-    let after = |r: &egui::Response| r.ctx.pointer_latest_pos().is_some_and(|p| p.x > rect.center().x);
-    if let Some(dragged) = response.dnd_hover_payload::<HeadingDrag>()
-        && dragged.0 != key
-    {
-        let x = if after(&response) { rect.right() } else { rect.left() };
-        ui.painter().with_clip_rect(rect.expand(3.0)).vline(x, rect.y_range(), Stroke::new(2.5, t.accent));
-    }
-    let mut event = None;
-    if let Some(dragged) = response.dnd_release_payload::<HeadingDrag>()
-        && dragged.0 != key
-    {
-        event = Some(HeadingEvent::Move { kind: dragged.0, to: key, after: after(&response) });
-    }
-    let response = response
-        .on_hover_cursor(if being_dragged { egui::CursorIcon::Grabbing } else { egui::CursorIcon::PointingHand })
-        .on_hover_text(tl!("Click to sort, drag to move the column. Drag its edge to resize it."));
-    response.context_menu(|ui| {
-        if ui.button(tl!("Reset columns")).clicked() {
-            event = Some(HeadingEvent::Reset);
-            ui.close();
-        }
-    });
-    if response.clicked() {
-        event = Some(HeadingEvent::Sort(key));
-    }
-    event
-}
-
-#[allow(clippy::too_many_arguments)]
-fn table_body(
-    app: &mut PdfCraftApp,
-    ui: &mut egui::Ui,
-    t: &Tokens,
-    rows: &Rows,
-    widths: [f32; 5],
-    events: &mut TableEvents,
-    heading_event: &mut Option<HeadingEvent>,
-    shown: &mut Option<[f32; 5]>,
-) {
-    let n = app.combine_draft.len();
-    let order = app.combine_columns.order;
-    // The heading being dragged follows the pointer.
-    if let (Some(dragged), Some(pos)) = (egui::DragAndDrop::payload::<HeadingDrag>(ui.ctx()), ui.ctx().pointer_latest_pos()) {
-        let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("combine-heading-drag")));
-        let galley = painter.layout_no_wrap(dragged.0.label().to_owned(), theme::medium(12.5), t.text);
-        let r = Rect::from_min_size(pos + vec2(10.0, 8.0), galley.size() + vec2(16.0, 8.0));
-        painter.rect(r, CornerRadius::same(4), t.card, Stroke::new(1.0, t.accent), egui::StrokeKind::Inside);
-        painter.galley(r.min + vec2(8.0, 4.0), galley, t.text);
-    }
-    let mut builder = TableBuilder::new(ui)
-        // Columns moved, reset or refitted: a new table state, built from `widths`.
-        .id_salt(("combine-files", app.combine_tab.layout))
-        .striped(true)
-        .sense(Sense::click())
-        .auto_shrink([false, true])
-        .cell_layout(Layout::left_to_right(Align::Center))
-        .column(Column::exact(18.0));
-    for kind in order {
-        builder = builder.column(Column::initial(widths[kind.index()]).at_least(kind.min_width()).resizable(true).clip(true));
-    }
-    builder
-        .header(26.0, |mut row| {
-            row.col(|_| {});
-            for kind in order {
-                row.col(|ui| {
-                    if let Some(e) = heading(ui, t, kind, rows.sort) {
-                        *heading_event = Some(e);
-                    }
-                });
-            }
-        })
-        .body(|mut body| {
-            if !body.ui_mut().is_sizing_pass() {
-                let w = body.widths();
-                let mut out = widths;
-                for (kind, width) in order.iter().zip(w.iter().skip(1)) {
-                    out[kind.index()] = *width;
-                }
-                *shown = Some(out);
-            }
-            for i in 0..n {
-                let Some(f) = app.combine_draft.get_mut(i) else { break };
-                let check = rows.checks.get(i).cloned().unwrap_or(Ok(f.pages));
-                body.row(32.0, |mut row| {
-                    row.set_selected(rows.selected.get(i).copied().unwrap_or(false));
-                    // Drag handle.
-                    row.col(|ui| {
-                        let id = ui.id().with(("combine-drag", f.id));
-                        ui.dnd_drag_source(id, i, |ui| {
-                            let (rect, resp) = ui.allocate_exact_size(vec2(12.0, 18.0), Sense::hover());
-                            grip(ui, rect, if resp.hovered() || rows.dragging { t.text_muted } else { t.text_faint });
-                        })
-                        .response
-                        .on_hover_cursor(egui::CursorIcon::Grab)
-                        .on_hover_text(tl!("Drag to reorder"));
-                    });
-                    for kind in order {
-                        row.col(|ui| match kind {
-                            SortKey::Name => {
-                                ui.add(icons::image("file-text", 16.0, t.icon));
-                                ui.add(egui::Label::new(crate::bidi::visual(&f.name).as_ref()).truncate().selectable(false));
-                            }
-                            // The range field and how many pages it takes.
-                            SortKey::Pages => {
-                                crate::widgets::begin_dialog(ui);
-                                let edit = ui.add_enabled(
-                                    f.problem.is_none(),
-                                    crate::widgets::line(&mut f.range).frame(egui::Frame::NONE).hint_text(tl!("All pages")).desired_width(88.0),
-                                );
-                                // A visible field on plain and striped rows alike; red when the range is wrong.
-                                let border = if check.is_err() { Stroke::new(1.5, ERROR) } else { Stroke::new(1.0, t.border) };
-                                ui.painter().rect_stroke(edit.rect, CornerRadius::same(4), border, egui::StrokeKind::Inside);
-                                if let Err(e) = &check {
-                                    edit.clone().on_hover_text(e);
-                                } else {
-                                    edit.clone()
-                                        .on_hover_text(crate::i18n::fmt(tl!("Pages of {name} to combine, e.g. 1-3, 6"), &[("name", &f.name)]));
-                                }
-                                if edit.gained_focus() {
-                                    events.range_focused = true;
-                                    events.action = Some(RowAction::Click(i, Modifiers::NONE));
-                                }
-                                if edit.changed() {
-                                    events.range_changed = true;
-                                }
-                                let count = match (&check, f.problem.is_some()) {
-                                    (_, true) => "—".to_string(),
-                                    (Ok(k), _) => crate::i18n::fmt(tl!("{k} of {n}"), &[("k", &k.to_string()), ("n", &f.pages.to_string())]),
-                                    (Err(_), _) => crate::i18n::fmt(tl!("? of {n}"), &[("n", &f.pages.to_string())]),
-                                };
-                                ui.label(egui::RichText::new(count).small().color(if check.is_err() { ERROR } else { t.text_faint }));
-                            }
-                            SortKey::Size => {
-                                ui.label(egui::RichText::new(crate::panels::human_size(f.bytes.len())).color(t.text_muted));
-                            }
-                            SortKey::Modified => match f.modified {
-                                Some(m) => {
-                                    ui.label(egui::RichText::new(ago(m)).color(t.text_muted)).on_hover_text(utc_stamp(m));
-                                }
-                                None => {
-                                    ui.label(egui::RichText::new("—").color(t.text_faint));
-                                }
-                            },
-                            // Blocking problems first, in red.
-                            SortKey::Warnings => {
-                                let mut errors: Vec<String> = f.problem.iter().cloned().collect();
-                                if let Err(e) = &check {
-                                    errors.push(e.clone());
-                                }
-                                let mut warnings = f.notes.clone();
-                                if rows.twice.get(i).copied().unwrap_or(false) {
-                                    warnings.push(tl!("Added more than once").to_string());
-                                }
-                                if let Some(renames) = rows.conflicts.get(i).filter(|r| !r.is_empty()) {
-                                    let shown: Vec<String> = renames.iter().take(3).map(|(old, new)| format!("{old} → {new}")).collect();
-                                    let list = shown.join(", ");
-                                    warnings.push(crate::i18n::fmt(
-                                        &crate::i18n::trn(
-                                            crate::i18n::current(),
-                                            renames.len() as u64,
-                                            "{n} field name collides with earlier files and will be renamed: {list}",
-                                            "{n} field names collide with earlier files and will be renamed: {list}",
-                                        ),
-                                        &[("list", &list)],
-                                    ));
-                                }
-                                let (icon, colour, first) = match (errors.first(), warnings.first()) {
-                                    (Some(e), _) => ("circle-x", ERROR, e.clone()),
-                                    (None, Some(w)) => ("triangle-alert", WARNING, w.clone()),
-                                    (None, None) => return,
-                                };
-                                let all = errors.iter().chain(&warnings).cloned().collect::<Vec<_>>().join("\n");
-                                ui.add(icons::image(icon, 15.0, colour));
-                                if f.lock.is_some() {
-                                    let link =
-                                        ui.add(egui::Link::new(egui::RichText::new(tl!("Unlock…")).color(t.accent))).on_hover_text(match f.lock {
-                                            Some(Lock::Permissions) => tl!("Enter the permissions password to allow combining"),
-                                            _ => tl!("Enter the password that opens it"),
-                                        });
-                                    if link.clicked() {
-                                        events.action = Some(RowAction::Unlock(Some(i), link.rect.left_bottom() + vec2(0.0, 6.0)));
-                                    }
-                                }
-                                ui.add(
-                                    egui::Label::new(egui::RichText::new(first).color(if colour == ERROR { ERROR } else { t.text }))
-                                        .truncate()
-                                        .selectable(false),
-                                )
-                                .on_hover_text(all);
-                            }
-                        });
-                    }
-                    let response = row.response();
-                    if f.lock.is_some() {
-                        let at = response.rect.left_bottom();
-                        response.context_menu(|ui| {
-                            if ui
-                                .add(egui::Button::image_and_text(icons::image("lock-open", 15.0, ui.visuals().text_color()), tl!("Unlock…")))
-                                .clicked()
-                            {
-                                events.action = Some(RowAction::Unlock(Some(i), at));
-                                ui.close();
-                            }
-                        });
-                    }
-                    if response.clicked() {
-                        let modifiers = response.ctx.input(|i| i.modifiers);
-                        events.action = Some(RowAction::Click(i, modifiers));
-                    }
-                    // A row dragged over this one goes where the line is drawn.
-                    if let Some(from) = response.dnd_hover_payload::<usize>().map(|p| *p) {
-                        let r = response.rect;
-                        let y = if from > i { r.top() } else { r.bottom() };
-                        if from != i {
-                            response.ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("combine-drop-line"))).hline(
-                                r.x_range(),
-                                y,
-                                Stroke::new(2.0, t.accent),
-                            );
-                        }
-                    }
-                    if let Some(from) = response.dnd_release_payload::<usize>().map(|p| *p) {
-                        events.action = Some(RowAction::Drop { from, to: i });
-                    }
-                });
-            }
-        });
-}
-
-/// The PDFs, images and text files in `dir` (and, if `recursive`, the folders inside it, not
-/// following links), in natural order, at most [`MAX_FOLDER_FILES`]; and whether there were more.
-#[cfg(not(target_arch = "wasm32"))]
-fn combinable_in(dir: &std::path::Path, recursive: bool) -> (Vec<std::path::PathBuf>, bool) {
-    let mut found = Vec::new();
-    let mut more = false;
-    let mut folders = vec![(dir.to_path_buf(), 0usize)];
-    'walk: while let Some((folder, depth)) = folders.pop() {
-        let Ok(entries) = std::fs::read_dir(&folder) else { continue };
-        for entry in entries.flatten() {
-            let Ok(kind) = entry.file_type() else { continue };
-            let path = entry.path();
-            if kind.is_dir() {
-                let hidden = entry.file_name().to_string_lossy().starts_with('.');
-                if recursive && !hidden && depth < MAX_FOLDER_DEPTH {
-                    folders.push((path, depth + 1));
-                }
-            } else if path.extension().is_some_and(|e| combinable(&e.to_string_lossy())) && path.is_file() {
-                if found.len() >= MAX_FOLDER_FILES {
-                    more = true;
-                    break 'walk;
-                }
-                found.push(path);
-            }
-        }
-    }
-    found.sort_by(|a, b| natural(&a.to_string_lossy(), &b.to_string_lossy()));
-    (found, more)
-}
-
-/// Whether a file with extension `ext` can join the list: a PDF, or an image or text file that
-/// becomes one.
-fn combinable(ext: &str) -> bool {
-    std::iter::once("pdf").chain(pdfcraft_engine::CONVERTIBLE).any(|c| ext.eq_ignore_ascii_case(c))
-}
-
-/// A file's bookmark in the combined PDF: its name without ".pdf", or without the extension of
-/// the image or text file it was made from.
-fn title_of(name: &str) -> &str {
-    match name.rsplit_once('.') {
-        Some((stem, ext)) if !stem.is_empty() && combinable(ext) => stem,
-        _ => name,
-    }
-}
-
-/// File names in the order people expect: case-insensitive, with numbers by value
-/// ("scan2" before "scan10").
-fn natural(a: &str, b: &str) -> Ordering {
-    let (mut a, mut b) = (a.chars().peekable(), b.chars().peekable());
-    loop {
-        match (a.peek().copied(), b.peek().copied()) {
-            (None, None) => return Ordering::Equal,
-            (None, Some(_)) => return Ordering::Less,
-            (Some(_), None) => return Ordering::Greater,
-            (Some(x), Some(y)) if x.is_ascii_digit() && y.is_ascii_digit() => {
-                let take = |it: &mut std::iter::Peekable<std::str::Chars>| {
-                    let mut digits = String::new();
-                    while let Some(c) = it.peek().copied().filter(char::is_ascii_digit) {
-                        digits.push(c);
-                        it.next();
-                    }
-                    digits.trim_start_matches('0').to_owned()
-                };
-                let (x, y) = (take(&mut a), take(&mut b));
-                // Without leading zeros, a longer run of digits is a larger number.
-                match x.len().cmp(&y.len()).then_with(|| x.cmp(&y)) {
-                    Ordering::Equal => {}
-                    other => return other,
-                }
-            }
-            (Some(x), Some(y)) => {
-                match x.to_lowercase().cmp(y.to_lowercase()) {
-                    Ordering::Equal => {}
-                    other => return other,
-                }
-                a.next();
-                b.next();
-            }
-        }
-    }
-}
-
-/// Where an arrow key goes from `at` among `n` files, `by` at a time (1 in the list; a grid
-/// row's length for Up/Down in the grid). It stays put on the first row going up and on the last
-/// row going down; a short last row is reached from the row above at its last file.
-pub(crate) fn step_to(at: usize, n: usize, by: usize, down: bool) -> usize {
-    let by = by.max(1);
-    let last = n.saturating_sub(1);
-    let at = at.min(last);
-    if down {
-        if at >= last / by * by { at } else { at.saturating_add(by).min(last) }
-    } else if at < by {
-        at
-    } else {
-        at - by
-    }
-}
-
-/// The order after moving the files `moving` (keeping their order) to `gap` in `ids` as it is
-/// (0 = before the first, `ids.len()` = after the last); `None` when nothing would change.
-pub(crate) fn moved_order(ids: &[u64], moving: &BTreeSet<u64>, gap: usize) -> Option<Vec<u64>> {
-    let gap = gap.min(ids.len());
-    // The gap counted among the files that stay.
-    let before = ids.get(..gap).map_or(0, |s| s.iter().filter(|id| moving.contains(id)).count());
-    let (taken, mut rest): (Vec<u64>, Vec<u64>) = ids.iter().partition(|id| moving.contains(id));
-    if taken.is_empty() {
-        return None;
-    }
-    let at = gap.saturating_sub(before).min(rest.len());
-    rest.splice(at..at, taken);
-    (rest != ids).then_some(rest)
-}
-
-/// A page range (1-based: "1-3, 6, 9-7") that takes exactly `pages` (0-based, in that order)
-/// from a file of `count` pages; empty (every page) when that is all of them in order.
-pub(crate) fn range_of(pages: &[usize], count: usize) -> String {
-    if pages.len() == count && pages.iter().enumerate().all(|(i, p)| i == *p) {
-        return String::new();
-    }
-    let mut parts: Vec<String> = Vec::new();
-    let mut i = 0;
-    while let Some(&start) = pages.get(i) {
-        // The longest run going up (or down) one page at a time from here.
-        let step = |a: usize, b: usize| {
-            if b == a.wrapping_add(1) {
-                1
-            } else if a == b.wrapping_add(1) {
-                -1
-            } else {
-                0
-            }
-        };
-        let dir = pages.get(i + 1).map_or(0, |&next| step(start, next));
-        let mut end = i;
-        while dir != 0 && pages.get(end + 1).is_some_and(|&next| pages.get(end).is_some_and(|&cur| step(cur, next) == dir)) {
-            end += 1;
-        }
-        let last = pages.get(end).copied().unwrap_or(start);
-        parts.push(if end == i { format!("{}", start.saturating_add(1)) } else { format!("{}-{}", start.saturating_add(1), last.saturating_add(1)) });
-        i = end + 1;
-    }
-    parts.join(", ")
-}
-
-/// One list entry, for moving and removing single pages: its file (`group`: the parts of one
-/// file split around share it) and the pages it takes, in order; `None` when they can't be
-/// listed (a locked file, a bad range): such an entry only ever moves whole.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub(crate) struct Part {
-    pub(crate) id: u64,
-    pub(crate) group: u64,
-    pub(crate) pages: Option<Vec<usize>>,
-}
-
-/// One page in the list's order, or an entry that moves whole.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum Item {
-    Page { group: u64, from: u64, nth: usize, page: usize },
-    Whole(u64),
-}
-
-/// Every page in the list's order (and the entries that can't be split, whole).
-fn items_of(parts: &[Part]) -> Vec<Item> {
-    let mut items = Vec::new();
-    for p in parts {
-        match &p.pages {
-            Some(pages) => items.extend(pages.iter().enumerate().map(|(nth, &page)| Item::Page { group: p.group, from: p.id, nth, page })),
-            None => items.push(Item::Whole(p.id)),
-        }
-    }
-    items
-}
-
-/// Entries again from `items`: a file's pages side by side are one entry (its first unused id
-/// among them, else a new one from `new_id`); entries that move whole keep theirs.
-fn parts_of(items: &[Item], parts: &[Part], new_id: &mut dyn FnMut() -> u64) -> Vec<Part> {
-    let mut out: Vec<Part> = Vec::new();
-    let mut used: BTreeSet<u64> = BTreeSet::new();
-    let mut run: Vec<Item> = Vec::new();
-    let mut close = |run: &mut Vec<Item>, out: &mut Vec<Part>, used: &mut BTreeSet<u64>| {
-        let Some(Item::Page { group, .. }) = run.first().copied() else { return };
-        let id = run.iter().find_map(|i| match i {
-            Item::Page { from, .. } if !used.contains(from) => Some(*from),
-            _ => None,
-        });
-        let id = id.unwrap_or_else(&mut *new_id);
-        used.insert(id);
-        let pages = run.iter().filter_map(|i| if let Item::Page { page, .. } = i { Some(*page) } else { None }).collect();
-        out.push(Part { id, group, pages: Some(pages) });
-        run.clear();
-    };
-    for item in items {
-        match item {
-            Item::Whole(id) => {
-                close(&mut run, &mut out, &mut used);
-                if let Some(p) = parts.iter().find(|p| p.id == *id) {
-                    used.insert(*id);
-                    out.push(p.clone());
-                }
-            }
-            Item::Page { group, .. } => {
-                if run.first().is_some_and(|f| !matches!(f, Item::Page { group: g, .. } if g == group)) {
-                    close(&mut run, &mut out, &mut used);
-                }
-                run.push(*item);
-            }
-        }
-    }
-    close(&mut run, &mut out, &mut used);
-    out
-}
-
-/// The entries after moving the pages `moving` (by entry id and place among its pages), in
-/// their order, to before page `gap` of the list (counted over every page, an entry that can't be
-/// split counting as one; 0 = before the first): a page moved between another file's pages
-/// splits its file into parts, and parts of one file brought side by side join. `None` when
-/// nothing would change.
-pub(crate) fn moved_pages(parts: &[Part], moving: &BTreeSet<(u64, usize)>, gap: usize, new_id: &mut dyn FnMut() -> u64) -> Option<Vec<Part>> {
-    let items = items_of(parts);
-    let gap = gap.min(items.len());
-    let picked = |i: &Item| matches!(i, Item::Page { from, nth, .. } if moving.contains(&(*from, *nth)));
-    let before = items.get(..gap).map_or(0, |s| s.iter().filter(|i| picked(i)).count());
-    let (taken, mut rest): (Vec<Item>, Vec<Item>) = items.iter().partition(|i| picked(i));
-    if taken.is_empty() {
-        return None;
-    }
-    let at = gap.saturating_sub(before).min(rest.len());
-    rest.splice(at..at, taken);
-    let out = parts_of(&rest, parts, new_id);
-    (out != parts).then_some(out)
-}
-
-/// The entries after taking out the pages `removing` (by entry id and place among its pages);
-/// an entry left with none goes, and parts of one file left side by side join. `None` when
-/// nothing would change.
-pub(crate) fn removed_pages(parts: &[Part], removing: &BTreeSet<(u64, usize)>, new_id: &mut dyn FnMut() -> u64) -> Option<Vec<Part>> {
-    let items: Vec<Item> =
-        items_of(parts).into_iter().filter(|i| !matches!(i, Item::Page { from, nth, .. } if removing.contains(&(*from, *nth)))).collect();
-    let out = parts_of(&items, parts, new_id);
-    (out != parts).then_some(out)
-}
-
-/// Six dots: the drag handle.
-fn grip(ui: &egui::Ui, rect: Rect, colour: Color32) {
-    for dx in [-2.5, 2.5] {
-        for dy in [-5.0, 0.0, 5.0] {
-            ui.painter().circle_filled(rect.center() + vec2(dx, dy), 1.4, colour);
-        }
-    }
-}
-
-/// How long ago `time` was ("5 min ago"); a date after a week. Relative times need no time zone.
-pub(crate) fn ago(time: SystemTime) -> String {
-    let secs = SystemTime::now().duration_since(time).map(|d| d.as_secs()).unwrap_or(0);
-    let (mins, hours, days) = (secs / 60, secs / 3600, secs / 86_400);
-    match () {
-        _ if mins == 0 => tl!("just now").to_string(),
-        _ if hours == 0 => crate::i18n::fmt(tl!("{n} min ago"), &[("n", &mins.to_string())]),
-        _ if days == 0 => crate::i18n::fmt(tl!("{n} h ago"), &[("n", &hours.to_string())]),
-        _ if days == 1 => tl!("yesterday").to_string(),
-        _ if days < 7 => crate::i18n::fmt(tl!("{n} days ago"), &[("n", &days.to_string())]),
-        _ => utc_stamp(time).get(..10).unwrap_or_default().to_string(),
-    }
-}
-
-/// `time` as "2026-10-08 14:05 UTC". A clock before 1970 reads as the epoch; past chrono's year
-/// 262143 range the proleptic Gregorian date is kept via the 400-year cycle, not the epoch.
-fn utc_stamp(time: SystemTime) -> String {
-    let secs = time.duration_since(SystemTime::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
-    let (days, rem) = (secs / 86_400, secs % 86_400);
-    let (y, m, d) = civil_from_days(days);
-    // `{y:04}` rather than `%Y`, which writes a `+` before years past 9999.
-    format!("{y:04}-{m:02}-{d:02} {:02}:{:02} UTC", rem / 3600, rem % 3600 / 60)
-}
-
-/// Days since 1970-01-01 → proleptic Gregorian (year, month, day).
-///
-/// A pre-1970 time already clamps to the epoch (`unwrap_or(0)`), so `days` is an unsigned count
-/// that can run past `NaiveDate`'s ±262143-year range, where the old hand-rolled converter still
-/// produced a date. The Gregorian calendar repeats every 400 years (146_097 days), so chrono
-/// converts the day within one cycle and whole cycles go back into the year (an `i128`, then
-/// saturated into `i64`), keeping chrono as the only calendar logic and reproducing the old
-/// result exactly. 1970-01-01 is `num_days_from_ce` 719_163.
-fn civil_from_days(days: u64) -> (i64, u32, u32) {
-    use chrono::Datelike;
-    let (cycles, rest) = (days / 146_097, days % 146_097);
-    // `rest + 719_163` is 719_163..865_259, always a valid CE day.
-    match i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt) {
-        Some(d) => {
-            let y = i128::from(d.year()) + i128::from(cycles) * 400;
-            (i64::try_from(y).unwrap_or(i64::MAX), d.month(), d.day())
-        }
-        None => (1970, 1, 1), // unreachable
-    }
-}
-
-impl PdfCraftApp {
-    /// Show the Combine files tab (File ▸ Combine files…), opening it if needed.
-    pub fn open_combine_tab(&mut self) {
-        self.combine_tab.open = true;
-        self.combine_tab.focused = true;
-        self.active = None;
-    }
-
-    /// Whether the Combine files tab is the one showing.
-    pub fn combine_showing(&self) -> bool {
-        self.active.is_none() && self.combine_tab.open && self.combine_tab.focused
-    }
-
-    /// The selected rows, top to bottom (tests and automation).
-    pub fn combine_selection(&self) -> Vec<usize> {
-        self.combine_draft.iter().enumerate().filter(|(_, f)| self.combine_tab.selected.contains(&f.id)).map(|(i, _)| i).collect()
-    }
-
-    /// Select these rows (tests and automation).
-    pub fn select_combine_rows(&mut self, rows: &[usize]) {
-        // Files picked: no page stays picked (the trash and Delete act on these files).
-        self.combine_tab.selected_pages.clear();
-        self.combine_tab.page_anchor = None;
-        self.combine_tab.selected = rows.iter().filter_map(|i| self.combine_draft.get(*i)).map(|f| f.id).collect();
-        let last = rows.last().and_then(|i| self.combine_draft.get(*i)).map(|f| f.id);
-        (self.combine_tab.anchor, self.combine_tab.cursor) = (last, last);
-    }
-
-    fn combine_snapshot(&self) -> Snapshot {
-        Snapshot { files: self.combine_draft.clone(), selected: self.combine_tab.selected.clone(), sort: self.combine_tab.sort }
-    }
-
-    fn combine_restore(&mut self, s: Snapshot) {
-        self.combine_draft = s.files;
-        self.combine_tab.selected = s.selected;
-        self.combine_tab.selected_pages.clear();
-        self.combine_tab.page_anchor = None;
-        self.combine_tab.sort = s.sort;
-        self.combine_tab.range_edit = None;
-        self.combine_tab.revision = self.combine_tab.revision.wrapping_add(1);
-        // A Pages field with the keyboard would otherwise keep typing into the restored list
-        // without an undo step.
-        if let Some(ctx) = &self.ctx {
-            ctx.memory_mut(|m| m.stop_text_input());
-        }
-    }
-
-    fn combine_push_undo(&mut self, before: Snapshot) {
-        self.combine_tab.revision = self.combine_tab.revision.wrapping_add(1);
-        let undo = &mut self.combine_tab.undo;
-        undo.push(before);
-        if undo.len() > HISTORY {
-            undo.remove(0);
-        }
-        self.combine_tab.redo.clear();
-    }
-
-    /// Remember the list before a change, for Undo.
-    fn combine_record(&mut self) {
-        let now = self.combine_snapshot();
-        self.combine_push_undo(now);
-        self.combine_tab.range_edit = None;
-    }
-
-    pub(crate) fn combine_can_undo(&self, undo: bool) -> bool {
-        if undo { !self.combine_tab.undo.is_empty() } else { !self.combine_tab.redo.is_empty() }
-    }
-
-    /// Edit ▸ Undo / Redo (⌘Z, ⇧⌘Z) while the Combine files tab shows.
-    pub(crate) fn combine_history_step(&mut self, undo: bool) {
-        // ⌘Z in the password box is not about the list.
-        if self.combine_tab.unlock.is_some() {
-            return;
-        }
-        let (from, to) =
-            if undo { (&mut self.combine_tab.undo, &mut self.combine_tab.redo) } else { (&mut self.combine_tab.redo, &mut self.combine_tab.undo) };
-        let Some(state) = from.pop() else { return };
-        let now = Snapshot { files: self.combine_draft.clone(), selected: self.combine_tab.selected.clone(), sort: self.combine_tab.sort };
-        to.push(now);
-        self.combine_restore(state);
-    }
-
-    fn combine_sort(&mut self, key: SortKey, ascending: bool) {
-        let list = &mut self.combine_draft;
-        let mut keyed: Vec<(u8, CombineFile)> = list.drain(..).map(|mut f| (f.severity(), f)).collect();
-        keyed.sort_by(|(sa, a), (sb, b)| {
-            let order = match key {
-                SortKey::Name => natural(&a.name, &b.name),
-                SortKey::Pages => a.pages.cmp(&b.pages),
-                SortKey::Size => a.bytes.len().cmp(&b.bytes.len()),
-                SortKey::Modified => match (a.modified, b.modified) {
-                    (Some(x), Some(y)) => x.cmp(&y),
-                    // Unknown times last, whichever the direction.
-                    (x, y) => return x.is_none().cmp(&y.is_none()).then_with(|| natural(&a.name, &b.name)),
-                },
-                SortKey::Warnings => sa.cmp(sb),
-            };
-            let order = if ascending { order } else { order.reverse() };
-            order.then_with(|| natural(&a.name, &b.name))
-        });
-        *list = keyed.into_iter().map(|(_, f)| f).collect();
-        self.combine_tab.sort = Some((key, ascending));
-    }
-
-    /// The list as parts, for page edits: each entry's pages, or `None` for one that can't be
-    /// split (locked, unreadable, a bad range).
-    fn combine_parts(&self) -> Vec<Part> {
-        self.combine_draft
-            .iter()
-            .map(|f| Part {
-                id: f.id,
-                group: f.group,
-                // (No page listed, e.g. its pages couldn't be counted: it moves whole, never lost.)
-                pages: (f.lock.is_none() && f.problem.is_none()).then(|| f.pages_taken().ok()).flatten().filter(|p| !p.is_empty()),
-            })
-            .collect()
-    }
-
-    /// Make the list `parts`, as one undo step: entries kept by id, new parts made from their
-    /// file's other entries, each taking exactly its pages (its range rewritten). The parts of a
-    /// file shown as its pages stay shown so; the page selection is let go of.
-    fn combine_set_parts(&mut self, parts: Vec<Part>) {
-        self.combine_record();
-        self.combine_put_parts(parts);
-        let tab = &mut self.combine_tab;
-        tab.selected_pages.clear();
-        tab.page_anchor = None;
-        // An order made by hand isn't sorted any more.
-        tab.sort = None;
-    }
-
-    /// Join the parts of a file that have come to be side by side (no undo step of its own: it
-    /// belongs to the change that brought them together).
-    fn combine_join_parts(&mut self) {
-        let parts = self.combine_parts();
-        // Nothing to join unless some file is in more than one part.
-        let groups: BTreeSet<u64> = parts.iter().map(|p| p.group).collect();
-        if groups.len() == parts.len() {
-            return;
-        }
-        let next = &mut self.combine_tab.next_id;
-        let mut new_id = || {
-            let id = *next;
-            *next = next.wrapping_add(1);
-            id
-        };
-        let joined = parts_of(&items_of(&parts), &parts, &mut new_id);
-        if joined != parts {
-            self.combine_put_parts(joined);
-        }
-    }
-
-    /// Make the list `parts`: entries kept by id, new parts made from their file's other entries,
-    /// each taking exactly its pages (its range rewritten only when they differ).
-    fn combine_put_parts(&mut self, parts: Vec<Part>) {
-        let old = std::mem::take(&mut self.combine_draft);
-        let expanded: BTreeSet<u64> = old.iter().filter(|f| self.combine_tab.expanded.contains(&f.id)).map(|f| f.group).collect();
-        for p in parts {
-            let Some(base) = old.iter().find(|f| f.id == p.id).or_else(|| old.iter().find(|f| f.group == p.group)) else { continue };
-            let mut f = base.clone();
-            f.id = p.id;
-            // (A range that already takes these pages stays as the user typed it.)
-            if let Some(pages) = &p.pages
-                && f.pages_taken().ok().as_ref() != Some(pages)
-            {
-                f.range = range_of(pages, f.pages);
-                f.checked = None;
-            }
-            if expanded.contains(&f.group) {
-                self.combine_tab.expanded.insert(f.id);
-            }
-            self.combine_draft.push(f);
-        }
-        let ids: BTreeSet<u64> = self.combine_draft.iter().map(|f| f.id).collect();
-        self.combine_tab.selected.retain(|id| ids.contains(id));
-    }
-
-    /// A page card clicked: that page selected (Ctrl/⌘ toggles it, Shift selects every page from
-    /// the last one clicked, in the list's order); the files' selection is let go of.
-    fn combine_click_page(&mut self, id: u64, nth: usize, m: Modifiers) {
-        let page = (id, nth);
-        let tab = &mut self.combine_tab;
-        tab.selected.clear();
-        tab.cursor = Some(id);
-        if m.shift
-            && let Some(from) = tab.page_anchor
-        {
-            // Every page between the two, as the grid shows them.
-            let order: Vec<(u64, usize)> = self
-                .combine_draft
-                .iter()
-                .filter(|f| tab.expanded.contains(&f.id))
-                .flat_map(|f| (0..f.pages_taken().map_or(0, |p| p.len())).map(move |n| (f.id, n)))
-                .collect();
-            let (a, b) = (order.iter().position(|p| *p == from), order.iter().position(|p| *p == page));
-            if let (Some(a), Some(b)) = (a, b) {
-                if !m.command {
-                    tab.selected_pages.clear();
-                }
-                tab.selected_pages.extend(order.get(a.min(b)..=a.max(b)).unwrap_or_default().iter().copied());
-                return;
-            }
-        }
-        if m.command {
-            if !tab.selected_pages.remove(&page) {
-                tab.selected_pages.insert(page);
-            }
-        } else {
-            tab.selected_pages = BTreeSet::from([page]);
-        }
-        tab.page_anchor = Some(page);
-    }
-
-    /// Move `moving` to `gap`, as one undo step; a move that changes nothing leaves the list,
-    /// its sort and the history alone.
-    fn combine_move_to_gap(&mut self, moving: BTreeSet<u64>, gap: usize) {
-        let ids: Vec<u64> = self.combine_draft.iter().map(|f| f.id).collect();
-        let Some(order) = moved_order(&ids, &moving, gap) else { return };
-        self.combine_record();
-        let rank: std::collections::HashMap<u64, usize> = order.iter().enumerate().map(|(i, id)| (*id, i)).collect();
-        self.combine_draft.sort_by_key(|f| rank.get(&f.id).copied().unwrap_or(usize::MAX));
-        self.combine_tab.selected = moving.into_iter().filter(|id| rank.contains_key(id)).collect();
-        self.combine_tab.sort = None;
-    }
-
-    pub(crate) fn combine_apply(&mut self, action: RowAction) {
-        let page_edit = matches!(action, RowAction::ClickPage(..) | RowAction::MovePages { .. } | RowAction::RemovePages(_));
-        self.combine_apply_once(action);
-        // One kind of selection at a time: files picked (by a click, the keys, a drop, Unlock…)
-        // let go of the pages picked, so the trash never takes pages the user no longer means.
-        if !self.combine_tab.selected.is_empty() {
-            self.combine_tab.selected_pages.clear();
-            self.combine_tab.page_anchor = None;
-        }
-        // A file's parts brought side by side (the file between them removed or moved away) are
-        // one entry again, as in the same undo step.
-        if !page_edit {
-            self.combine_join_parts();
-        }
-    }
-
-    fn combine_apply_once(&mut self, action: RowAction) {
-        // The trash and Delete act on the selected pages while there are any.
-        let action = match action {
-            // (Files picked come first: the two are never both picked, but if they ever were, the
-            // files the user sees picked are what goes.)
-            RowAction::Remove if self.combine_tab.selected.is_empty() && !self.combine_tab.selected_pages.is_empty() => RowAction::RemovePages(None),
-            a => a,
-        };
-        // Page edits work on the list as parts.
-        match action {
-            RowAction::ClickPage(id, nth, m) => return self.combine_click_page(id, nth, m),
-            RowAction::MovePages { page, revision, gap } => {
-                if revision != self.combine_tab.revision {
-                    return;
-                }
-                let moving =
-                    if self.combine_tab.selected_pages.contains(&page) { self.combine_tab.selected_pages.clone() } else { BTreeSet::from([page]) };
-                let parts = self.combine_parts();
-                let next = &mut self.combine_tab.next_id;
-                let mut new_id = || {
-                    let id = *next;
-                    *next = next.wrapping_add(1);
-                    id
-                };
-                if let Some(moved) = moved_pages(&parts, &moving, gap, &mut new_id) {
-                    self.combine_set_parts(moved);
-                }
-                return;
-            }
-            RowAction::RemovePages(one) => {
-                let removing = match one {
-                    Some(page) => BTreeSet::from([page]),
-                    None => self.combine_tab.selected_pages.clone(),
-                };
-                if removing.is_empty() {
-                    return;
-                }
-                let parts = self.combine_parts();
-                let next = &mut self.combine_tab.next_id;
-                let mut new_id = || {
-                    let id = *next;
-                    *next = next.wrapping_add(1);
-                    id
-                };
-                // (Nothing to take out: no undo step, the redo history kept.)
-                if let Some(left) = removed_pages(&parts, &removing, &mut new_id) {
-                    self.combine_set_parts(left);
-                }
-                return;
-            }
-            _ => {}
-        }
-        // A file's card clicked (or the list's keys): the files are selected, no page.
-        if matches!(action, RowAction::Click(..) | RowAction::SelectAll | RowAction::Step { .. }) {
-            self.combine_tab.selected_pages.clear();
-        }
-        let ids: Vec<u64> = self.combine_draft.iter().map(|f| f.id).collect();
-        let n = ids.len();
-        let index_of = |id: Option<u64>| id.and_then(|id| ids.iter().position(|x| *x == id));
-        let tab = &mut self.combine_tab;
-        match action {
-            RowAction::Click(i, m) => {
-                let Some(&id) = ids.get(i) else { return };
-                if m.shift {
-                    let from = index_of(tab.anchor).unwrap_or(i);
-                    let range = ids.get(from.min(i)..=from.max(i)).unwrap_or_default();
-                    if !m.command {
-                        tab.selected.clear();
-                    }
-                    tab.selected.extend(range.iter().copied());
-                    tab.cursor = Some(id);
-                } else if m.command {
-                    if !tab.selected.remove(&id) {
-                        tab.selected.insert(id);
-                    }
-                    (tab.anchor, tab.cursor) = (Some(id), Some(id));
-                } else {
-                    tab.selected = BTreeSet::from([id]);
-                    (tab.anchor, tab.cursor) = (Some(id), Some(id));
-                }
-            }
-            RowAction::SelectAll => {
-                tab.selected = ids.iter().copied().collect();
-            }
-            RowAction::Step { down, by, extend } => {
-                // With files shown as their pages, Up and Down go a row of cards (from the last
-                // of a file's cards down, from its first up) to the file there.
-                let places = &tab.grid_places;
-                let rows_of_cards = by > 1 && places.len() > n;
-                let next = match index_of(tab.cursor) {
-                    Some(c) if rows_of_cards => {
-                        let from = if down { places.iter().rposition(|f| *f == c) } else { places.iter().position(|f| *f == c) };
-                        from.and_then(|at| places.get(step_to(at, places.len(), by, down)).copied()).unwrap_or(c)
-                    }
-                    Some(c) => step_to(c, n, by, down),
-                    None if down => 0,
-                    None => n.saturating_sub(1),
-                };
-                let Some(&id) = ids.get(next) else { return };
-                if extend {
-                    let from = index_of(tab.anchor).unwrap_or(next);
-                    tab.selected = ids.get(from.min(next)..=from.max(next)).unwrap_or_default().iter().copied().collect();
-                } else {
-                    tab.selected = BTreeSet::from([id]);
-                    tab.anchor = Some(id);
-                }
-                tab.cursor = Some(id);
-                tab.reveal = Some(id);
-            }
-            RowAction::MoveUp | RowAction::MoveDown => {
-                let up = matches!(action, RowAction::MoveUp);
-                let selected: Vec<bool> = ids.iter().map(|id| tab.selected.contains(id)).collect();
-                let movable =
-                    if up { selected.iter().skip_while(|s| **s).any(|s| *s) } else { selected.iter().rev().skip_while(|s| **s).any(|s| *s) };
-                if !movable {
-                    return;
-                }
-                self.combine_record();
-                let list = &mut self.combine_draft;
-                let sel = &self.combine_tab.selected;
-                // Each selected file steps past its unselected neighbour; blocks move together.
-                if up {
-                    for i in 1..list.len() {
-                        if sel.contains(&list[i].id) && !sel.contains(&list[i - 1].id) {
-                            list.swap(i, i - 1);
-                        }
-                    }
-                } else {
-                    for i in (0..list.len().saturating_sub(1)).rev() {
-                        if sel.contains(&list[i].id) && !sel.contains(&list[i + 1].id) {
-                            list.swap(i, i + 1);
-                        }
-                    }
-                }
-                self.combine_tab.sort = None;
-            }
-            RowAction::Remove => {
-                let Some(first) = ids.iter().position(|id| tab.selected.contains(id)) else { return };
-                self.combine_record();
-                let sel = std::mem::take(&mut self.combine_tab.selected);
-                self.combine_draft.retain(|f| !sel.contains(&f.id));
-                // The file that took the first removed one's place is selected next.
-                let next = self.combine_draft.get(first).or(self.combine_draft.last()).map(|f| f.id);
-                self.combine_tab.selected = next.into_iter().collect();
-                (self.combine_tab.anchor, self.combine_tab.cursor) = (next, next);
-            }
-            RowAction::RemoveFile(id) => {
-                if !ids.contains(&id) {
-                    return;
-                }
-                self.combine_record();
-                self.combine_draft.retain(|f| f.id != id);
-                // The rest of the selection stays as it was.
-                self.combine_tab.selected.remove(&id);
-                if self.combine_tab.anchor == Some(id) {
-                    self.combine_tab.anchor = None;
-                }
-                if self.combine_tab.cursor == Some(id) {
-                    self.combine_tab.cursor = None;
-                }
-            }
-            RowAction::Preview(id) => {
-                if ids.contains(&id) {
-                    self.combine_tab.preview = Some(Preview { file: id, at: 0, page: None, pages: None });
-                }
-            }
-            RowAction::PreviewAt(id, at) => {
-                if ids.contains(&id) {
-                    self.combine_tab.preview = Some(Preview { file: id, at, page: None, pages: None });
-                }
-            }
-            RowAction::Expand(id, on) => {
-                if on {
-                    if self.combine_draft.iter_mut().any(|f| f.id == id && expandable(f)) {
-                        self.combine_tab.expanded.insert(id);
-                    }
-                } else {
-                    self.combine_tab.expanded.remove(&id);
-                    // Its card may be far from where its pages were: brought into view.
-                    self.combine_tab.reveal = Some(id);
-                }
-            }
-            RowAction::ExpandAll(on) => {
-                self.combine_tab.expanded =
-                    if on { self.combine_draft.iter_mut().filter_map(|f| expandable(f).then_some(f.id)).collect() } else { BTreeSet::new() };
-                if !on {
-                    self.combine_tab.reveal = self.combine_tab.cursor;
-                }
-            }
-            RowAction::PreviewSelected => {
-                // The file the keyboard is on, or the first selected; with pages selected, the
-                // page card that has the keyboard, or the first selected page.
-                let first_page = tab.selected_pages.iter().min_by_key(|(id, nth)| (ids.iter().position(|x| x == id), *nth)).copied();
-                let page = tab.card_focus_at.filter(|p| tab.selected_pages.contains(p)).or(first_page);
-                let id = tab
-                    .cursor
-                    .filter(|c| tab.selected.contains(c))
-                    .or_else(|| ids.iter().copied().find(|id| tab.selected.contains(id)))
-                    .or(page.map(|(id, _)| id));
-                // Only what its card would offer a magnifier for (unlocked, readable, measured).
-                let shows = |id: u64| self.combine_draft.iter().any(|f| f.id == id && f.lock.is_none() && f.problem.is_none() && !f.sizes.is_empty());
-                if let Some(id) = id.filter(|id| shows(*id)) {
-                    // From the page card that has the keyboard (or the selected page), if it's one
-                    // of this file's.
-                    let at = self.combine_tab.card_focus_at.or(page).filter(|(file, _)| *file == id).map_or(0, |(_, nth)| nth);
-                    self.combine_tab.preview = Some(Preview { file: id, at, page: None, pages: None });
-                }
-            }
-            // (Page edits were done above.)
-            RowAction::ClickPage(..) | RowAction::MovePages { .. } | RowAction::RemovePages(_) => {}
-            RowAction::Drop { from, to } => {
-                let (Some(&dragged), Some(&target)) = (ids.get(from), ids.get(to)) else { return };
-                // Dragging a selected file takes the whole selection along.
-                let moving: BTreeSet<u64> = if tab.selected.contains(&dragged) { tab.selected.clone() } else { BTreeSet::from([dragged]) };
-                // Dropped on the selection itself: nothing to do.
-                if moving.contains(&target) {
-                    return;
-                }
-                // Below the row when dragged down, above it when dragged up.
-                self.combine_move_to_gap(moving, if from < to { to + 1 } else { to });
-            }
-            RowAction::DropAt { file, revision, gap } => {
-                // The list changed under the drag (e.g. undo): the gap no longer means the same.
-                if revision != tab.revision || !ids.contains(&file) {
-                    return;
-                }
-                let moving: BTreeSet<u64> = if tab.selected.contains(&file) { tab.selected.clone() } else { BTreeSet::from([file]) };
-                self.combine_move_to_gap(moving, gap);
-            }
-            RowAction::Unlock(row, at) => {
-                let locked: BTreeSet<u64> = self.combine_draft.iter().filter(|f| f.lock.is_some()).map(|f| f.id).collect();
-                let rows: Vec<u64> = match row.and_then(|i| ids.get(i).copied()) {
-                    // A selected row brings the rest of the selection.
-                    Some(id) if tab.selected.contains(&id) => {
-                        ids.iter().copied().filter(|x| tab.selected.contains(x) && locked.contains(x)).collect()
-                    }
-                    Some(id) => {
-                        tab.selected = BTreeSet::from([id]);
-                        (tab.anchor, tab.cursor) = (Some(id), Some(id));
-                        vec![id]
-                    }
-                    None => ids.iter().copied().filter(|x| tab.selected.contains(x) && locked.contains(x)).collect(),
-                };
-                self.combine_ask_password(rows, at);
-            }
-            RowAction::Sort(key) => {
-                let ascending = !matches!(tab.sort, Some((k, true)) if k == key);
-                self.combine_record();
-                self.combine_sort(key, ascending);
-            }
-        }
-    }
-
-    /// Close the Combine files tab and forget its list; the last document shows, if any.
-    pub fn close_combine_tab(&mut self) {
-        let showing = self.combine_showing();
-        // (Revisions keep counting: a drag begun before can never match a list made after.)
-        let revision = self.combine_tab.revision.wrapping_add(1);
-        self.combine_tab = CombineTab { revision, ..CombineTab::default() };
-        self.combine_draft.clear();
-        self.combine_thumbs.clear();
-        if showing {
-            self.active = self.views.len().checked_sub(1);
-        }
-    }
-
-    /// Add picked files to the Combine files list (and show it).
-    pub(crate) fn stage_combine(&mut self, files: Vec<(String, Vec<u8>)>) {
-        let incoming =
-            files.into_iter().map(|(name, bytes)| Incoming { name, bytes: Arc::new(bytes), modified: None, note: None, open_doc: None }).collect();
-        self.stage_combine_with(incoming);
-    }
-
-    /// Add files to the Combine files list, with what can be known about them up front.
-    pub(crate) fn stage_combine_with(&mut self, files: Vec<Incoming>) {
-        let mut added = Vec::new();
-        for Incoming { name, bytes, modified, note, open_doc } in files {
-            // Images and text files become PDFs as they join the list (#569): from then on they
-            // are ordinary files, with pages, thumbnails and page ranges.
-            // A file that can't be read joins the list all the same, with why (the Warnings
-            // column, its card); Combine asks before leaving it out.
-            let unreadable = |e: &str| Assessed {
-                pages: 0,
-                sizes: Arc::from(Vec::new()),
-                problem: Some(crate::i18n::fmt(tl!("Can't be read: {e}"), &[("e", e)])),
-                lock: None,
-                notes: Vec::new(),
-            };
-            let source = bytes.clone();
-            let (bytes, assessed) = match self.session.as_pdf(&name, &bytes) {
-                Ok(pdf) => {
-                    let assessed = assess(&pdf, None);
-                    (pdf, assessed)
-                }
-                Err(e) => {
-                    // (The engine's message names the file, which the row already shows.)
-                    let e = match e {
-                        pdfcraft_engine::EditError::Source(m) => m,
-                        other => other.to_string(),
-                    };
-                    let why = e.strip_prefix(&format!("{name}: ")).unwrap_or(&e).to_string();
-                    (bytes, Ok(unreadable(&why)))
-                }
-            };
-            let assessed = match assessed {
-                Ok(a) => a,
-                Err(AssessError::Unreadable(e)) => unreadable(&e),
-                Err(AssessError::WrongPassword) => {
-                    self.notify_fmt("Couldn't add {name}: {e}", &[("name", &name), ("e", "the password is wrong")]);
-                    continue;
-                }
-            };
-            let mut f = CombineFile {
-                id: 0,
-                group: 0,
-                name,
-                bytes,
-                source,
-                pages: 0,
-                range: String::new(),
-                modified,
-                problem: None,
-                lock: None,
-                password: None,
-                sizes: Arc::from(Vec::new()),
-                auth: 0,
-                notes: Vec::new(),
-                origin_note: note,
-                open_doc,
-                checked: None,
-            };
-            f.take(assessed, None);
-            added.push(f);
-        }
-        if !added.is_empty() {
-            self.combine_record();
-            for mut f in added {
-                f.id = self.combine_tab.next_id;
-                f.group = f.id;
-                self.combine_tab.next_id = self.combine_tab.next_id.wrapping_add(1);
-                self.combine_draft.push(f);
-            }
-            // A sorted list stays sorted; new files simply join the end otherwise.
-            if let Some((key, ascending)) = self.combine_tab.sort {
-                self.combine_sort(key, ascending);
-            }
-        }
-        self.open_combine_tab();
-    }
-
-    /// Open Unlock…'s password box for `rows`, at `at`.
-    fn combine_ask_password(&mut self, rows: Vec<u64>, at: egui::Pos2) {
-        if rows.is_empty() {
-            return;
-        }
-        self.combine_tab.unlock = Some(UnlockPrompt { rows, input: Secret::default(), show: false, error: None, at, focused: false });
-    }
-
-    /// Try `password` on the protected files `rows` (as one undo step). Returns false when it
-    /// opened none of them.
-    pub fn combine_unlock(&mut self, rows: &[u64], password: &str) -> bool {
-        // A file split into parts is unlocked as one: each file once, all its parts alike.
-        let groups: BTreeSet<u64> =
-            rows.iter().filter_map(|id| self.combine_draft.iter().find(|f| f.id == *id && f.lock.is_some())).map(|f| f.group).collect();
-        let mut accepted = Vec::new();
-        for group in &groups {
-            let Some(f) = self.combine_draft.iter().find(|f| f.group == *group) else { continue };
-            if let Ok(a) = assess(&f.bytes, Some(password)) {
-                accepted.push((*group, a));
-            }
-        }
-        if accepted.is_empty() {
-            return false;
-        }
-        self.combine_record();
-        let tried = groups.len();
-        let mut unlocked = 0;
-        for (group, a) in accepted {
-            let mut auth = None;
-            for f in self.combine_draft.iter_mut().filter(|f| f.group == group) {
-                f.take(a.clone(), Some(Secret(password.to_owned())));
-                // Read once: one way of reading for all its parts (their thumbnails are shared).
-                f.auth = *auth.get_or_insert(f.auth);
-            }
-            unlocked += usize::from(self.combine_draft.iter().any(|f| f.group == group && f.lock.is_none()));
-        }
-        if tried > 1 {
-            self.notify_fmt("Unlocked {n} of {m} files", &[("n", &unlocked.to_string()), ("m", &tried.to_string())]);
-        }
-        true
-    }
-
-    /// Unlock… for the files the user named in tests and automation (by row).
-    pub fn combine_unlock_rows(&mut self, rows: &[usize], password: &str) -> bool {
-        let ids: Vec<u64> = rows.iter().filter_map(|i| self.combine_draft.get(*i)).map(|f| f.id).collect();
-        self.combine_unlock(&ids, password)
-    }
-
-    /// Add every PDF, image and text file in a folder the user picks (and its subfolders, if
-    /// `recursive`).
-    pub fn combine_add_folder(&mut self, recursive: bool) {
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            let title = if recursive { tl!("Add folder and subfolders") } else { tl!("Add folder") };
-            let dialog = rfd::AsyncFileDialog::new().set_title(title);
-            self.ask_one(crate::pickers::Ask::Folder(dialog), None, move |app, dir| app.add_folder_to_combine(&dir, recursive));
-        }
-        #[cfg(target_arch = "wasm32")]
-        let _ = recursive;
-    }
-
-    /// Add the PDFs, images and text files in `dir` to the Combine files list, as one undo step.
-    #[cfg(not(target_arch = "wasm32"))]
-    pub(crate) fn add_folder_to_combine(&mut self, dir: &std::path::Path, recursive: bool) {
-        let (paths, more) = combinable_in(dir, recursive);
-        let folder = dir.file_name().map_or_else(|| dir.to_string_lossy().into_owned(), |n| n.to_string_lossy().into_owned());
-        if paths.is_empty() {
-            self.notify_fmt("No PDFs, images or text files found in {folder}", &[("folder", &folder)]);
-            self.open_combine_tab();
-            return;
-        }
-        self.use_paths(crate::files::FilePurpose::Combine, &paths);
-        if more {
-            self.notify_fmt("Added the first {n} files in {folder}", &[("n", &MAX_FOLDER_FILES.to_string()), ("folder", &folder)]);
-        }
-    }
-
-    /// Add documents open in tabs (by tab index), as they are now; those already in the list
-    /// stay out (#1356). The same document, not the same name: two files called alike are two.
-    pub(crate) fn add_open_documents(&mut self, tabs: &[usize]) {
-        let mut incoming = Vec::new();
-        for &i in tabs {
-            let Some(doc) = self.views.get(i).and_then(|v| self.session.get(v.id)) else { continue };
-            if self.combine_draft.iter().any(|f| f.open_doc == Some(doc.id)) {
-                continue;
-            }
-            #[cfg(not(target_arch = "wasm32"))]
-            let modified = if doc.dirty { None } else { doc.path.as_ref().and_then(|p| std::fs::metadata(p).and_then(|m| m.modified()).ok()) };
-            #[cfg(target_arch = "wasm32")]
-            let modified = None;
-            let note = doc.dirty.then(|| tl!("Includes unsaved changes").to_string());
-            let name = if doc.name.to_ascii_lowercase().ends_with(".pdf") { doc.name.clone() } else { format!("{}.pdf", doc.name) };
-            incoming.push(Incoming { name, bytes: doc.bytes.clone(), modified, note, open_doc: Some(doc.id) });
-        }
-        self.stage_combine_with(incoming);
-    }
-
-    /// Combine the listed files into a new, unsaved document; the tab makes way for it.
-    /// Files that can't be read are left out (the user was asked).
-    pub fn combine_staged(&mut self) {
-        let files: Vec<&CombineFile> = self.combine_draft.iter().filter(|f| !f.unreadable()).collect();
-        if files.is_empty() {
-            return;
-        }
-        // Each file once, however many parts it is in.
-        let count = files.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len();
-        let groups: Vec<u64> = files.iter().map(|f| f.group).collect();
-        let sources: Vec<(String, Arc<Vec<u8>>, Option<String>)> =
-            files.iter().map(|f| (title_of(&f.name).to_string(), f.bytes.clone(), Some(f.range.clone()).filter(|r| !r.trim().is_empty()))).collect();
-        let passwords: Vec<Option<&str>> = files.iter().map(|f| f.password.as_ref().map(|p| p.0.as_str())).collect();
-        match self.session.combine_grouped(&sources, &groups, &passwords) {
-            Ok(bytes) => {
-                self.close_combine_tab();
-                let message = crate::i18n::fmt(tl!("Combined {n} files"), &[("n", &count.to_string())]);
-                self.open_created("Combined.pdf", bytes, &message)
-            }
-            // The list stays, so the user can fix it.
-            Err(e) => self.notify_fmt("Couldn't combine files: {e}", &[("e", &e.to_string())]),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn utc_stamp_is_utc_minutes_and_clamps_pre_epoch() {
-        use std::time::Duration;
-        let at = |s: u64| utc_stamp(SystemTime::UNIX_EPOCH + Duration::from_secs(s));
-        assert_eq!(at(0), "1970-01-01 00:00 UTC");
-        assert_eq!(at(1_791_446_357), "2026-10-08 07:59 UTC");
-        // The 400-year leap rule.
-        assert_eq!(at(951_782_400), "2000-02-29 00:00 UTC");
-        // A clock before 1970 reads as the epoch, as the old `unwrap_or(0)` did.
-        assert_eq!(utc_stamp(SystemTime::UNIX_EPOCH - Duration::from_secs(5)), "1970-01-01 00:00 UTC");
-        // Past chrono's range keeps the proleptic Gregorian date the old code gave, not the epoch.
-        // Windows' SystemTime holds only up to about year 30828, so this is checked where it fits.
-        if let Some(far) = SystemTime::UNIX_EPOCH.checked_add(Duration::from_secs(10_000_000_000_000)) {
-            assert_eq!(utc_stamp(far), "318857-05-20 17:46 UTC");
-        }
-        // Windows' SystemTime can't hold u64::MAX / 2 seconds, so it is only checked where it exists.
-        if let Some(far) = SystemTime::UNIX_EPOCH.checked_add(Duration::from_secs(u64::MAX / 2)) {
-            assert_eq!(utc_stamp(far), "292277026596-12-04 15:30 UTC");
-        }
-        // Years past 9999 keep the plain zero-padded year (no `+`).
-        assert_eq!(at(253_402_300_800), "10000-01-01 00:00 UTC");
-    }
-
-    /// A one-page PDF that opens with "pw".
-    fn locked() -> Vec<u8> {
-        let objs = [
-            "<< /Type /Catalog /Pages 2 0 R >>",
-            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
-            "<< /Type /Page /Parent 2 0 R >>",
-        ];
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, o) in objs.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
-        }
-        let xref = out.len();
-        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
-        for o in offsets {
-            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
-        let mut doc = pdfcraft_cos::Document::open(Arc::new(out)).unwrap();
-        doc.set_encryption(&pdfcraft_cos::NewEncryption {
-            algorithm: pdfcraft_cos::Algorithm::Aes256,
-            user_password: "pw",
-            owner_password: "owner",
-            permissions: -1,
-            encrypt_metadata: true,
-            seed: [4; 32],
-        })
-        .unwrap();
-        pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
-    }
-
-    #[test]
-    fn duplicate_warnings_reuse_results_and_track_removal_and_parts() {
-        let bytes = locked();
-        let mut app = PdfCraftApp::new();
-        app.stage_combine(vec![("same.pdf".into(), bytes.clone())]);
-        let mut part = app.combine_draft[0].clone();
-        part.id = 99;
-        app.combine_draft.push(part);
-        let first = app.combine_tab.duplicate_warnings(&app.combine_draft);
-        assert_eq!(&*first, &[false, false], "parts of one source are not duplicate additions");
-        let again = app.combine_tab.duplicate_warnings(&app.combine_draft);
-        assert!(Arc::ptr_eq(&first, &again), "unchanged frames reuse the result without scanning files");
-        app.stage_combine(vec![("same.pdf".into(), bytes)]);
-        assert_eq!(&*app.combine_tab.duplicate_warnings(&app.combine_draft), &[true, true, true]);
-        let duplicate = app.combine_draft.last().unwrap().id;
-        app.combine_apply(RowAction::RemoveFile(duplicate));
-        assert_eq!(&*app.combine_tab.duplicate_warnings(&app.combine_draft), &[false, false]);
-        app.combine_history_step(true);
-        assert_eq!(&*app.combine_tab.duplicate_warnings(&app.combine_draft), &[true, true, true]);
-        app.close_combine_tab();
-        assert!(app.combine_tab.duplicate_warnings(&app.combine_draft).is_empty());
-    }
-
-    /// #1303: an image or text file is converted anew, with its own date, each time it is added,
-    /// so it is the file as added that is compared, not the PDF made from it.
-    #[test]
-    fn the_same_image_or_text_file_added_twice_is_a_duplicate() {
-        static NOW: std::sync::atomic::AtomicI64 = std::sync::atomic::AtomicI64::new(1_700_000_000);
-        let mut png = std::io::Cursor::new(Vec::new());
-        image::RgbaImage::from_pixel(12, 4, image::Rgba([20, 30, 40, 255])).write_to(&mut png, image::ImageFormat::Png).unwrap();
-        let png = png.into_inner();
-        let warnings = |first: (&str, &[u8]), second: (&str, &[u8])| {
-            let mut app = PdfCraftApp::new();
-            app.session = std::mem::take(&mut app.session).with_clock(|| NOW.fetch_add(1, std::sync::atomic::Ordering::Relaxed));
-            for (name, bytes) in [first, second] {
-                app.stage_combine(vec![(name.into(), bytes.to_vec())]);
-            }
-            assert_ne!(app.combine_draft[0].bytes, app.combine_draft[1].bytes, "each addition is converted with its own date");
-            app.combine_tab.duplicate_warnings(&app.combine_draft).to_vec()
-        };
-        assert_eq!(warnings(("notes.txt", b"Hello"), ("notes.txt", b"Hello")), [true, true], "the same text file");
-        assert_eq!(warnings(("photo.png", &png), ("photo.png", &png)), [true, true], "the same image");
-        assert_eq!(warnings(("notes.txt", b"Hello"), ("notes.txt", b"World")), [false, false], "different text, same name and size");
-    }
-
-    #[test]
-    fn every_read_of_a_file_is_new_even_after_undo() {
-        // Regression: the read counter lived in the undo history, so unlock → undo → unlock (with
-        // another password) could repeat a value and keep a thumbnail of the other read.
-        let mut app = PdfCraftApp::new();
-        app.stage_combine(vec![("secret.pdf".into(), locked())]);
-        let added = app.combine_draft[0].auth;
-        assert!(app.combine_unlock_rows(&[0], "pw"));
-        let first = app.combine_draft[0].auth;
-        app.combine_history_step(true);
-        assert_eq!(app.combine_draft[0].auth, added, "undo brings back the file as it was read");
-        assert!(app.combine_unlock_rows(&[0], "owner"));
-        let second = app.combine_draft[0].auth;
-        assert!(second != first && second != added, "added {added}, unlocked {first}, unlocked again {second}");
-    }
-
-    #[test]
-    fn moves_by_rank_never_lose_or_repeat_a_file() {
-        let mut app = PdfCraftApp::new();
-        app.stage_combine((0..6).map(|i| (format!("f{i}.pdf"), locked())).collect());
-        let mut ids: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
-        for (moving, gap) in [(vec![0usize, 2, 4], 6), (vec![5], 0), (vec![1, 3], 3)] {
-            let set: BTreeSet<u64> = moving.iter().filter_map(|i| ids.get(*i).copied()).collect();
-            app.combine_move_to_gap(set, gap);
-            let mut now: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
-            ids = now.clone();
-            now.sort_unstable();
-            assert_eq!(now, (0..6).collect::<Vec<u64>>(), "every file once");
-        }
-    }
-
-    #[test]
-    fn bookmarks_are_named_without_the_extension_of_a_converted_file() {
-        assert_eq!(title_of("report.pdf"), "report");
-        assert_eq!(title_of("REPORT.PDF"), "REPORT");
-        assert_eq!(title_of("scan.2024.JPG"), "scan.2024");
-        assert_eq!(title_of("notes.txt"), "notes");
-        assert_eq!(title_of("v1.2"), "v1.2", "not a known extension");
-        assert_eq!(title_of(".png"), ".png", "nothing would be left");
-    }
-
-    #[test]
-    fn page_lists_become_the_shortest_range() {
-        assert_eq!(range_of(&[0, 1, 2], 3), "", "every page in order: no range");
-        assert_eq!(range_of(&[0, 1, 2], 5), "1-3");
-        assert_eq!(range_of(&[2, 0, 3], 5), "3, 1, 4");
-        assert_eq!(range_of(&[8, 7, 6, 0], 9), "9-7, 1");
-        assert_eq!(range_of(&[0, 0, 1], 2), "1, 1-2");
-        assert_eq!(range_of(&[4], 9), "5");
-        assert_eq!(range_of(&[], 3), "");
-        // Whatever comes out reads back as the same pages.
-        for pages in [vec![0, 1, 2, 5, 4, 3, 3, 7], vec![9, 0, 9, 1], vec![2, 1, 0, 1, 2]] {
-            let range = range_of(&pages, 10);
-            let back = pdfcraft_engine::print::select_pages(10, Some(&range), &[], pdfcraft_engine::print::Subset::All, false).unwrap();
-            assert_eq!(back, pages, "{range}");
-        }
-    }
-
-    fn part(id: u64, group: u64, pages: &[usize]) -> Part {
-        Part { id, group, pages: Some(pages.to_vec()) }
-    }
-
-    #[test]
-    fn a_page_moved_between_another_files_pages_splits_its_file_and_parts_rejoin() {
-        let mut next = 100;
-        let mut new_id = || {
-            next += 1;
-            next
-        };
-        // A: pages 1-3, B: pages 1-2.
-        let list = [part(1, 1, &[0, 1, 2]), part(2, 2, &[0, 1])];
-        // A's page 3 between B's pages: A splits around B's first page.
-        let moved = moved_pages(&list, &BTreeSet::from([(1, 2)]), 4, &mut new_id).unwrap();
-        assert_eq!(moved, [part(1, 1, &[0, 1]), part(2, 2, &[0]), part(101, 1, &[2]), part(102, 2, &[1])]);
-        // Back where it was: the parts join again, under their first ids.
-        let back = moved_pages(&moved, &BTreeSet::from([(101, 0)]), 2, &mut new_id).unwrap();
-        assert_eq!(back, [part(1, 1, &[0, 1, 2]), part(2, 2, &[0, 1])]);
-        // Within a file: only its order changes.
-        let within = moved_pages(&list, &BTreeSet::from([(1, 0)]), 3, &mut new_id).unwrap();
-        assert_eq!(within, [part(1, 1, &[1, 2, 0]), part(2, 2, &[0, 1])]);
-        // Several pages carried together keep their order.
-        let both = moved_pages(&list, &BTreeSet::from([(1, 0), (1, 2)]), 5, &mut new_id).unwrap();
-        assert_eq!(both, [part(1, 1, &[1]), part(2, 2, &[0, 1]), part(103, 1, &[0, 2])]);
-        // Dropped where it is, or nothing picked: no change.
-        assert_eq!(moved_pages(&list, &BTreeSet::from([(1, 1)]), 1, &mut new_id), None);
-        assert_eq!(moved_pages(&list, &BTreeSet::from([(9, 9)]), 0, &mut new_id), None);
-        // A file that can't be split moves whole, and pages move around it.
-        let locked = [part(1, 1, &[0, 1]), Part { id: 3, group: 3, pages: None }];
-        let around = moved_pages(&locked, &BTreeSet::from([(1, 0)]), 3, &mut new_id).unwrap();
-        assert_eq!(around, [part(1, 1, &[1]), Part { id: 3, group: 3, pages: None }, part(104, 1, &[0])]);
-    }
-
-    #[test]
-    fn removing_pages_drops_emptied_parts_and_joins_what_meets() {
-        let mut next = 200;
-        let mut new_id = || {
-            next += 1;
-            next
-        };
-        // A split around B: A[1], B[1], A[2].
-        let list = [part(1, 1, &[0]), part(2, 2, &[0]), part(3, 1, &[1])];
-        // B goes: A's two parts meet and join.
-        assert_eq!(removed_pages(&list, &BTreeSet::from([(2, 0)]), &mut new_id), Some(vec![part(1, 1, &[0, 1])]));
-        // One page of a part.
-        let two = [part(1, 1, &[0, 1, 2])];
-        assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 1)]), &mut new_id), Some(vec![part(1, 1, &[0, 2])]));
-        // Every page: nothing left. Repeated pages are told apart by their place.
-        assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 0), (1, 1), (1, 2)]), &mut new_id), Some(Vec::new()));
-        let repeats = [part(1, 1, &[0, 0])];
-        assert_eq!(removed_pages(&repeats, &BTreeSet::from([(1, 1)]), &mut new_id), Some(vec![part(1, 1, &[0])]));
-        // A page that isn't there: nothing changes, and it says so.
-        assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 9)]), &mut new_id), None);
-    }
-}
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 4b400ef0c7..26fad6f77c 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -10,7 +10,6 @@ use pdfcraft_engine::commands::{self, COMMANDS, CommandSpec, Shortcut};
 use crate::{
     Dialog, Mode, PdfCraftApp, PropsTab, RightPanel, SaveTarget,
     theme::{ThemeKind, ThemePreference},
-    widgets,
 };
 
 /// Keys the document view handles itself (`canvas::shortcuts`), for the View menu, tooltips and
@@ -157,10 +156,12 @@ impl PdfCraftApp {
         let targets = active.map(|i| self.views[i].target_pages()).unwrap_or_default();
         match id {
             "ui.dock.reset" => {
-                if let Err(error) = crate::docking::command(self, true, &serde_json::Value::Null) {
+                if let Err(error) = crate::side_panels::command(self, true, &serde_json::Value::Null) {
                     self.notify(error);
                 }
             }
+            "view.side_panel" => self.toggle_side_panel(),
+            "view.tools_pane" => self.left_open = !self.left_open,
             "file.open" => self.open_dialog(),
             "file.open_recent" => match self.recent.first().map(|r| r.path.clone()) {
                 // The palette runs commands without a submenu: open the most recent file.
@@ -390,6 +391,7 @@ impl PdfCraftApp {
                     K::Background
                 };
                 self.marks_draft.replace = id.ends_with(".update");
+                self.marks_draft.preview = None;
                 self.dialog = Some(Dialog::Marks(kind));
             }
             "edit.bates" => {
@@ -400,6 +402,7 @@ impl PdfCraftApp {
                     self.marks_draft.hf.text[5] = "<<Bates Number#6#1##>>".into();
                 }
                 self.marks_draft.focused_box = 5;
+                self.marks_draft.preview = None;
                 self.dialog = Some(Dialog::Marks(pdfcraft_engine::MarkKind::HeaderFooter));
             }
             "edit.header_footer.remove" | "edit.watermark.remove" | "edit.background.remove" => {
@@ -720,11 +723,6 @@ impl PdfCraftApp {
         // Buttons also own keyboard focus for Tab/Enter activation, but they must not
         // suppress document shortcuts. Text editors retain their own undo/redo handling.
         let typing = ctx.text_edit_focused();
-        // A form field's editor is open on the page: its text isn't in the document until
-        // committed. (Not egui's keyboard focus: an Escape in this frame has already cleared that,
-        // while the field has yet to see the Escape and discard its draft.)
-        let active = self.active_ids();
-        let form_typing = active.and_then(|(i, _)| self.views.get(i)).is_some_and(|v| v.forms.focus.is_some());
         let mut specs: Vec<&CommandSpec> = COMMANDS.iter().filter(|c| c.shortcut.is_some()).collect();
         specs.sort_by_key(|c| std::cmp::Reverse(c.shortcut.map(|s| s.modifier_count()).unwrap_or(0)));
         for spec in specs {
@@ -748,23 +746,29 @@ impl PdfCraftApp {
                 m |= Modifiers::CTRL;
             }
             if ctx.input_mut(|i| i.consume_shortcut(&KeyboardShortcut::new(m, key))) {
-                if form_typing {
-                    // A form field has the keyboard: let it take this frame's typing (and
-                    // Escape) first, so ⌘S saves what's on screen (#166). Runs next frame, for
-                    // this document only.
-                    self.deferred_commands.push((spec.id, active.map(|(_, id)| id)));
-                    ctx.request_repaint();
-                } else if spec.id == "file.close" && active.is_none() && crate::commands::mac_shortcuts(ctx) && !cfg!(target_arch = "wasm32") {
-                    // macOS ⌘W closes the last window when no document tabs remain (#869).
-                    // Route through the normal viewport-close path (and its quit guard),
-                    // not the disabled document-only `file.close` command.
-                    ctx.send_viewport_cmd(egui::ViewportCommand::Close);
-                } else {
-                    self.execute(spec.id);
-                }
+                self.dispatch_command(ctx, spec.id);
             }
         }
     }
+
+    /// Run a registry command from its shortcut or a menu, which share this path.
+    pub(crate) fn dispatch_command(&mut self, ctx: &egui::Context, id: &'static str) {
+        let active = self.active_ids();
+        let form_typing = active.and_then(|(i, _)| self.views.get(i)).is_some_and(|v| v.forms.focus.is_some());
+        if form_typing {
+            // A form field has the keyboard: let it take this frame's typing (and Escape) first,
+            // so ⌘S saves what's on screen (#166). Runs next frame, for this document only.
+            self.deferred_commands.push((id, active.map(|(_, id)| id)));
+            ctx.request_repaint();
+        } else if id == "file.close" && active.is_none() && crate::commands::mac_shortcuts(ctx) && !cfg!(target_arch = "wasm32") {
+            // macOS ⌘W closes the last window when no document tabs remain (#869). Route through
+            // the normal viewport-close path (and its quit guard), not the disabled document-only
+            // `file.close` command.
+            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+        } else {
+            self.execute(id);
+        }
+    }
 }
 
 /// The tab after `current` of `count` (before it when `forward` is false), wrapping around. From
@@ -785,57 +789,6 @@ fn tab_after(current: Option<usize>, count: usize, forward: bool) -> Option<usiz
     })
 }
 
-/// Render a top-level menu's registered commands (with live labels, shortcuts and enablement).
-pub(crate) fn registry_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui, menu: &str) {
-    for spec in commands::menu(menu) {
-        let label = commands::current_label(spec, &app.session, app.active_ids().map(|(_, id)| id));
-        let label = crate::i18n::menu_label(spec.id, &label);
-        // Open Recent is a submenu of the live recent list, not one action: disabled while the
-        // list is empty, otherwise each entry opens its file (or focuses the tab showing it), and
-        // Clear Recent Files at the foot empties the list (#430).
-        if spec.id == "file.open_recent" {
-            if app.recent.is_empty() {
-                ui.add_enabled(false, egui::Button::new(label));
-                continue;
-            }
-            let mut open: Option<String> = None;
-            let mut clear = false;
-            ui.menu_button(label, |ui| {
-                crate::chrome::scroll_menu(ui, |ui| {
-                    for r in &app.recent {
-                        if ui.button(&r.name).on_hover_text(&r.path).clicked() {
-                            open = Some(r.path.clone());
-                            ui.close();
-                        }
-                    }
-                    ui.separator();
-                    if ui.button(tl!("Clear Recent Files")).clicked() {
-                        clear = true;
-                        ui.close();
-                    }
-                })
-            });
-            if let Some(p) = open {
-                app.open_recent(&p);
-                ui.close();
-            }
-            if clear {
-                app.execute("file.clear_recent");
-                ui.close();
-            }
-            continue;
-        }
-        let shortcut = spec.shortcut.or((spec.id == "edit.copy").then_some(COPY)).map(|s| shortcut_label(ui.ctx(), s)).unwrap_or_default();
-        let enabled = app.command_enabled(spec);
-        let resp = ui.add_enabled(enabled, egui::Button::new(label).shortcut_text(shortcut));
-        if resp.clicked() {
-            app.execute(spec.id);
-            ui.close();
-        }
-    }
-    let _ = widgets::menu_item;
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
deleted file mode 100644
index b5c016750a..0000000000
--- a/crates/ui-egui/src/comments.rs
+++ /dev/null
@@ -1,2657 +0,0 @@
-//! Commenting in the document view (execution plan M5.3–M5.4; Acrobat's "Add comments").
-//!
-//! - **Tools** ([`CommentTool`]): sticky note, text box, highlight / underline / strikethrough
-//!   (driven by text selection), freehand, line, arrow, rectangle, oval. They live in the quick
-//!   bar in three flyout groups, as in Acrobat's comment toolbar (audit `a14-*`).
-//! - **On the page:** drawing gestures with live previews; with the Select tool, comments can be
-//!   hovered, selected (blue frame with 8 round handles), moved, resized (rectangles, ovals and
-//!   text boxes), edited (double-click) and deleted (⌫ / Delete); a context menu offers Edit,
-//!   Reply, Set status, Colour and Delete.
-//! - **Composer:** the floating "Add a comment" card used for new notes, text boxes and edits.
-//!
-//! Everything is turned into `pdfcraft_engine::Edit`s, queued on the view as `pending_edit` and
-//! applied by the app, so each change is one undo step.
-
-use egui::{Color32, CornerRadius, Pos2, Rect, Sense, Stroke, pos2, vec2};
-use pdfcraft_engine::{Edit, LineEnding, Markup, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, Style};
-use pdfcraft_render::{Annotation, DocInfo, PageInfo, PageText};
-
-use crate::canvas::{DocView, PageXform};
-use crate::theme::{self, Tokens};
-use crate::{QuickTool, icons};
-
-/// Acrobat's selection blue for annotation frames and handles (11-visual-spec §5).
-const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub enum CommentTool {
-    Note,
-    TextBox,
-    Highlight,
-    Underline,
-    StrikeOut,
-    Squiggly,
-    Ink,
-    Line,
-    Arrow,
-    Rectangle,
-    Oval,
-    Polygon,
-    PolyLine,
-    Cloud,
-    Callout,
-    Caret,
-    ReplaceText,
-    Attach,
-    Eraser,
-}
-
-/// The quick-bar flyout groups, in Acrobat's order: Comment ▸, Highlight ▸, Draw ▸.
-pub const GROUPS: [&[CommentTool]; 3] = [
-    &[CommentTool::Note, CommentTool::TextBox, CommentTool::Callout, CommentTool::Attach],
-    &[CommentTool::Highlight, CommentTool::Underline, CommentTool::StrikeOut, CommentTool::Squiggly, CommentTool::Caret, CommentTool::ReplaceText],
-    &[
-        CommentTool::Ink,
-        CommentTool::Line,
-        CommentTool::Arrow,
-        CommentTool::Rectangle,
-        CommentTool::Oval,
-        CommentTool::PolyLine,
-        CommentTool::Polygon,
-        CommentTool::Cloud,
-        CommentTool::Eraser,
-    ],
-];
-
-pub const ALL: [CommentTool; 19] = [
-    CommentTool::Eraser,
-    CommentTool::ReplaceText,
-    CommentTool::Attach,
-    CommentTool::Polygon,
-    CommentTool::PolyLine,
-    CommentTool::Cloud,
-    CommentTool::Callout,
-    CommentTool::Caret,
-    CommentTool::Note,
-    CommentTool::TextBox,
-    CommentTool::Highlight,
-    CommentTool::Underline,
-    CommentTool::StrikeOut,
-    CommentTool::Squiggly,
-    CommentTool::Ink,
-    CommentTool::Line,
-    CommentTool::Arrow,
-    CommentTool::Rectangle,
-    CommentTool::Oval,
-];
-
-impl CommentTool {
-    pub fn command(self) -> &'static str {
-        match self {
-            Self::Note => "comment.note",
-            Self::TextBox => "comment.freetext",
-            Self::Highlight => "comment.highlight",
-            Self::Underline => "comment.underline",
-            Self::StrikeOut => "comment.strikeout",
-            Self::Squiggly => "comment.squiggly",
-            Self::Ink => "comment.ink",
-            Self::Line => "comment.line",
-            Self::Arrow => "comment.arrow",
-            Self::Rectangle => "comment.square",
-            Self::Oval => "comment.circle",
-            Self::Polygon => "comment.polygon",
-            Self::PolyLine => "comment.polyline",
-            Self::Cloud => "comment.cloud",
-            Self::Callout => "comment.callout",
-            Self::Caret => "comment.caret",
-            Self::ReplaceText => "comment.replace",
-            Self::Attach => "comment.attach",
-            Self::Eraser => "comment.eraser",
-        }
-    }
-
-    pub fn from_command(id: &str) -> Option<Self> {
-        ALL.into_iter().find(|t| t.command() == id)
-    }
-
-    pub fn label(self) -> &'static str {
-        match self {
-            Self::Note => "Add a sticky note",
-            Self::TextBox => "Add a text box",
-            Self::Highlight => "Highlight",
-            Self::Underline => "Underline",
-            Self::StrikeOut => "Strikethrough",
-            Self::Squiggly => "Squiggly underline",
-            Self::Ink => "Draw",
-            Self::Line => "Line",
-            Self::Arrow => "Arrow",
-            Self::Rectangle => "Rectangle",
-            Self::Oval => "Oval",
-            Self::Polygon => "Polygon",
-            Self::PolyLine => "Connected lines",
-            Self::Cloud => "Cloud",
-            Self::Callout => "Add a callout",
-            Self::Caret => "Insert text",
-            Self::ReplaceText => "Replace text",
-            Self::Attach => "Attach file",
-            Self::Eraser => "Eraser",
-        }
-    }
-
-    pub fn icon(self) -> &'static str {
-        match self {
-            Self::Note => "message-square-plus",
-            Self::TextBox => "type",
-            Self::Highlight => "highlighter",
-            Self::Underline => "underline",
-            Self::StrikeOut => "strikethrough",
-            Self::Squiggly => "spline",
-            Self::Ink => "pencil",
-            Self::Line => "minus",
-            Self::Arrow => "move-right",
-            Self::Rectangle => "square",
-            Self::Oval => "circle",
-            Self::Polygon => "pentagon",
-            Self::PolyLine => "spline",
-            Self::Cloud => "cloud",
-            Self::Callout => "message-square-quote",
-            Self::Caret => "text-cursor-input",
-            Self::ReplaceText => "replace",
-            Self::Attach => "paperclip",
-            Self::Eraser => "eraser",
-        }
-    }
-
-    pub fn group(self) -> usize {
-        GROUPS.iter().position(|g| g.contains(&self)).unwrap_or(0)
-    }
-
-    pub fn markup(self) -> Option<Markup> {
-        match self {
-            Self::Highlight => Some(Markup::Highlight),
-            Self::Underline => Some(Markup::Underline),
-            Self::StrikeOut => Some(Markup::StrikeOut),
-            Self::Squiggly => Some(Markup::Squiggly),
-            _ => None,
-        }
-    }
-
-    /// Tools that draw with a drag gesture.
-    pub fn draws(self) -> bool {
-        matches!(self, Self::Ink | Self::Line | Self::Arrow | Self::Rectangle | Self::Oval | Self::Eraser)
-    }
-
-    /// Tools that place points one click at a time (double-click or Enter finishes).
-    pub fn clicks_points(self) -> bool {
-        matches!(self, Self::Polygon | Self::PolyLine | Self::Cloud)
-    }
-
-    /// Whether the line-thickness control applies.
-    pub fn has_width(self) -> bool {
-        self.draws() || self.clicks_points() || matches!(self, Self::TextBox | Self::Callout)
-    }
-
-    /// Text comments may have no border while retaining visible text or fill.
-    fn min_width(self) -> f64 {
-        if matches!(self, Self::TextBox | Self::Callout) { 0.0 } else { 0.5 }
-    }
-
-    /// Whether the fill-colour control applies to this tool.
-    pub fn has_fill(self) -> bool {
-        matches!(self, Self::Rectangle | Self::Oval | Self::Polygon | Self::Cloud | Self::TextBox | Self::Callout)
-    }
-
-    /// A placeholder shape of this kind (for per-tool default styles).
-    fn sample(self) -> Shape {
-        match self {
-            Self::Note => Shape::Note { at: [0.0; 2], icon: NoteIcon::Comment },
-            Self::TextBox => Shape::TextBox { rect: [0.0; 4], font_size: 12.0 },
-            Self::Highlight | Self::Underline | Self::StrikeOut | Self::Squiggly => {
-                Shape::TextMarkup { kind: self.markup().unwrap_or(Markup::Highlight), quads: Vec::new() }
-            }
-            Self::Ink => Shape::Ink { strokes: Vec::new() },
-            Self::Line => Shape::Line { from: [0.0; 2], to: [0.0; 2], start: LineEnding::None, end: LineEnding::None },
-            Self::Arrow => Shape::Line { from: [0.0; 2], to: [0.0; 2], start: LineEnding::None, end: LineEnding::OpenArrow },
-            Self::Rectangle => Shape::Rectangle { rect: [0.0; 4] },
-            Self::Oval => Shape::Oval { rect: [0.0; 4] },
-            Self::Polygon => Shape::Polygon { vertices: Vec::new(), cloud: false },
-            Self::Cloud => Shape::Polygon { vertices: Vec::new(), cloud: true },
-            Self::PolyLine => Shape::PolyLine { vertices: Vec::new(), start: LineEnding::None, end: LineEnding::None },
-            Self::Callout => Shape::Callout { rect: [0.0; 4], knee: [0.0; 2], point: [0.0; 2], font_size: 10.0, ending: LineEnding::OpenArrow },
-            Self::Caret => Shape::Caret { rect: [0.0; 4] },
-            Self::ReplaceText => Shape::TextMarkup { kind: Markup::StrikeOut, quads: Vec::new() },
-            Self::Eraser => Shape::Ink { strokes: Vec::new() },
-            Self::Attach => Shape::Attachment { at: [0.0; 2], icon: pdfcraft_engine::AttachIcon::PushPin, file: String::new(), data: Vec::new() },
-        }
-    }
-}
-
-/// The comment swatches (our palette, close to Acrobat's quick colours).
-pub const SWATCHES: [(&str, Rgb); 10] = [
-    ("Yellow", [1.0, 0.94, 0.0]),
-    ("Orange", [1.0, 0.54, 0.0]),
-    ("Red", [0.89, 0.13, 0.13]),
-    ("Pink", [1.0, 0.37, 0.64]),
-    ("Purple", [0.54, 0.25, 0.82]),
-    ("Blue", [0.0, 0.47, 0.84]),
-    ("Light blue", [0.36, 0.75, 0.98]),
-    ("Green", [0.18, 0.62, 0.36]),
-    ("Gray", [0.5, 0.5, 0.5]),
-    ("Black", [0.0, 0.0, 0.0]),
-];
-
-pub fn color32(c: Rgb) -> Color32 {
-    let b = |v: f64| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
-    Color32::from_rgb(b(c[0]), b(c[1]), b(c[2]))
-}
-
-/// Commenting preferences shared by every document (author, per-tool styles, pin).
-#[derive(Clone, Debug)]
-pub struct CommentPrefs {
-    /// `/T` of new comments (Acrobat: Preferences ▸ Identity, default the login name).
-    pub author: String,
-    styles: Vec<(CommentTool, Style)>,
-    /// Keep the tool selected after use (the pin).
-    pub pinned: bool,
-    /// The tool each flyout group shows (the last one used).
-    pub group_tool: [CommentTool; 3],
-    /// Hide hover previews on highlight annotations when they contain no comment text beyond the author.
-    pub hide_empty_highlight_hover: bool,
-}
-
-impl Default for CommentPrefs {
-    fn default() -> Self {
-        Self {
-            author: login_name(),
-            styles: ALL.iter().map(|t| (*t, Style::default_for(&t.sample()))).collect(),
-            pinned: false,
-            group_tool: [CommentTool::Note, CommentTool::Highlight, CommentTool::Ink],
-            hide_empty_highlight_hover: false,
-        }
-    }
-}
-
-impl CommentPrefs {
-    pub fn style(&self, tool: CommentTool) -> Style {
-        self.styles.iter().find(|(t, _)| *t == tool).map(|(_, s)| s.clone()).unwrap_or_default()
-    }
-
-    /// Every tool with its current default style (the persisted settings read this).
-    pub fn styles(&self) -> impl Iterator<Item = (CommentTool, &Style)> {
-        self.styles.iter().map(|(t, s)| (*t, s))
-    }
-
-    pub fn set_color(&mut self, tool: CommentTool, c: Rgb) {
-        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
-            s.color = c;
-        }
-    }
-
-    pub fn set_width(&mut self, tool: CommentTool, w: f64) {
-        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
-            s.width = w.clamp(tool.min_width(), 12.0);
-        }
-    }
-
-    /// The tool's opacity, 10–100 % (an invisible comment can't be found again).
-    pub fn set_opacity(&mut self, tool: CommentTool, o: f64) {
-        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
-            s.opacity = if o.is_finite() { o.clamp(0.1, 1.0) } else { 1.0 };
-        }
-    }
-
-    /// The tool's fill (`None`: no fill).
-    pub fn set_fill(&mut self, tool: CommentTool, fill: Option<Rgb>) {
-        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
-            s.fill = if tool.has_fill() { fill.filter(|c| c.iter().all(|x| x.is_finite())).map(|c| c.map(|x| x.clamp(0.0, 1.0))) } else { None };
-        }
-    }
-
-    pub fn set_style(&mut self, tool: CommentTool, style: Style) {
-        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
-            *s = style;
-        }
-    }
-}
-
-/// Whether `tool` makes comments like `a`. Arrows are saved as plain Line annotations with an
-/// ending, so the Line and Arrow tools both match a line.
-pub(crate) fn made_by(a: &Annotation, tool: CommentTool) -> bool {
-    match tool_for(a) {
-        Some(CommentTool::Line) => matches!(tool, CommentTool::Line | CommentTool::Arrow),
-        made => made == Some(tool),
-    }
-}
-
-/// The tool whose defaults "Make Current Properties Default" should update.
-///
-/// Arrows are stored as Line annotations. An arrow ending belongs to the Arrow tool, so its
-/// defaults stay separate from a plain line.
-pub(crate) fn tool_for_default(a: &Annotation, endings: Option<&[LineEnding]>) -> Option<CommentTool> {
-    match tool_for(a) {
-        Some(CommentTool::Line) if endings.is_some_and(|ends| ends.iter().copied().any(arrow_ending)) => Some(CommentTool::Arrow),
-        other => other,
-    }
-}
-
-fn arrow_ending(ending: LineEnding) -> bool {
-    matches!(ending, LineEnding::OpenArrow | LineEnding::ClosedArrow | LineEnding::ROpenArrow | LineEnding::RClosedArrow)
-}
-
-/// The tool that makes comments like `a` (for Make Current Properties Default).
-pub fn tool_for(a: &Annotation) -> Option<CommentTool> {
-    Some(match (a.subtype.as_str(), a.intent.as_deref()) {
-        ("Text", _) => CommentTool::Note,
-        ("FreeText", Some("FreeTextCallout")) => CommentTool::Callout,
-        ("FreeText", Some("FreeTextTypeWriter")) => return None,
-        ("FreeText", _) => CommentTool::TextBox,
-        ("Highlight", _) => CommentTool::Highlight,
-        ("Underline", _) => CommentTool::Underline,
-        ("StrikeOut", Some("StrikeOutTextEdit")) => CommentTool::ReplaceText,
-        ("StrikeOut", _) => CommentTool::StrikeOut,
-        ("Squiggly", _) => CommentTool::Squiggly,
-        ("Ink", _) => CommentTool::Ink,
-        ("Line", _) => CommentTool::Line,
-        ("Square", _) => CommentTool::Rectangle,
-        ("Circle", _) => CommentTool::Oval,
-        ("Polygon", Some("PolygonCloud")) => CommentTool::Cloud,
-        ("Polygon", _) => CommentTool::Polygon,
-        ("PolyLine", _) => CommentTool::PolyLine,
-        ("Caret", _) => CommentTool::Caret,
-        ("FileAttachment", _) => CommentTool::Attach,
-        _ => return None,
-    })
-}
-
-/// The user's login name, which Acrobat uses as the default comment author.
-fn login_name() -> String {
-    #[cfg(not(target_arch = "wasm32"))]
-    for var in ["USER", "USERNAME", "LOGNAME"] {
-        if let Ok(v) = std::env::var(var)
-            && !v.trim().is_empty()
-        {
-            return v;
-        }
-    }
-    "Guest".into()
-}
-
-/// A drag in progress on a page.
-#[derive(Clone, Debug, PartialEq)]
-pub enum Gesture {
-    /// Drawing with a tool: points in user space (ink: the stroke; polygons: the vertices
-    /// clicked so far; others: start and end).
-    Draw { page: usize, tool: CommentTool, points: Vec<[f64; 2]> },
-    /// Moving a comment, from the press position on screen.
-    Move { page: usize, index: usize, from: Pos2 },
-    /// Resizing a comment by one of its handles: (dx, dy) ∈ {-1, 0, 1}² says which sides move.
-    Resize { page: usize, index: usize, handle: (i8, i8), from: Pos2, aspect_ratio: Option<f32> },
-    /// Dragging point `point` of a line, connected lines, a polygon or a cloud (its `points`
-    /// before the drag, in user space) to where the pointer is.
-    Reshape { page: usize, index: usize, point: usize, points: Vec<[f64; 2]> },
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum ComposerKind {
-    Note,
-    /// A text box; `size` is the box dragged out (displayed width and height, in user space
-    /// units), `None` after a click: then the box fits its text.
-    TextBox {
-        size: Option<[f64; 2]>,
-    },
-    /// A callout whose arrow touches `point`; the composer's anchor is the text box's top-left.
-    Callout {
-        point: [f64; 2],
-    },
-    /// Insert text at the anchor (the caret's tip); `size` is the side of the caret's square box,
-    /// in user space units.
-    Caret {
-        size: f64,
-    },
-    /// Replace the selected text (`CommentView::replace` holds the quads).
-    Replace,
-    /// Edit the text of the comment at this index on the composer's page.
-    Edit(usize),
-}
-
-/// The floating "Add a comment" card.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Composer {
-    pub page: usize,
-    /// Anchor in user space (the note's top-left, the text box's top-left, the comment's corner).
-    pub at: [f64; 2],
-    pub kind: ComposerKind,
-    pub text: String,
-    pub focus: bool,
-}
-
-/// A released drawing gesture waiting for the page raster to show its annotation.
-#[derive(Clone, Debug, PartialEq)]
-pub(crate) struct Settling {
-    pub page: usize,
-    pub tool: CommentTool,
-    pub points: Vec<[f64; 2]>,
-    /// Frame time (seconds) at release; a raster that never arrives must not leave a ghost.
-    pub since: f64,
-    /// Its annotation is in the document, so a raster of the page from now on draws it. Until
-    /// then a raster is of the document without it (in full screen the edit is applied the frame
-    /// after the release, and a raster already on its way can arrive in between).
-    pub committed: bool,
-}
-
-/// Longest a released drawing stays painted without its page raster, and how many are kept.
-const SETTLE_SECS: f64 = 20.0;
-const SETTLE_MAX: usize = 16;
-
-impl CommentView {
-    /// Remember a released drag drawing so it stays on screen until its page is re-rendered.
-    pub(crate) fn settle(&mut self, now: f64, page: usize, tool: CommentTool, points: &[[f64; 2]]) {
-        if !matches!(tool, CommentTool::Ink | CommentTool::Line | CommentTool::Arrow | CommentTool::Rectangle | CommentTool::Oval) {
-            return;
-        }
-        self.settling.retain(|s| now - s.since < SETTLE_SECS);
-        if self.settling.len() >= SETTLE_MAX {
-            self.settling.remove(0);
-        }
-        self.settling.push(Settling { page, tool, points: points.to_vec(), since: now, committed: false });
-    }
-
-    /// How many released drawings are still painted from their points (waiting for a raster).
-    pub fn settling_len(&self) -> usize {
-        self.settling.len()
-    }
-
-    /// A fresh raster of `page` is on screen: it draws the committed annotations itself. One
-    /// still waiting for its edit isn't in that raster, and stays drawn from its points.
-    pub(crate) fn page_rendered(&mut self, page: usize) {
-        self.settling.retain(|s| s.page != page || !s.committed);
-    }
-
-    /// The edit adding the released drawings was applied: rasters from now on draw them.
-    pub(crate) fn drawings_committed(&mut self) {
-        for s in &mut self.settling {
-            s.committed = true;
-        }
-    }
-
-    /// The edit adding the released drawings failed: nothing will draw them.
-    pub(crate) fn drawings_refused(&mut self) {
-        self.settling.retain(|s| s.committed);
-    }
-}
-
-/// Per-document commenting state.
-#[derive(Clone, Debug, Default)]
-pub struct CommentView {
-    /// The selected comment: (page, index in `/Annots`).
-    pub selected: Option<(usize, usize)>,
-    pub gesture: Option<Gesture>,
-    /// Drawings just released: shown from their points until the page raster that includes the
-    /// committed annotation arrives, so the stroke never vanishes in between (#1858).
-    pub(crate) settling: Vec<Settling>,
-    /// Escape ends egui's drag too; ignore its synthetic release until the mouse is up.
-    cancelled_drag: bool,
-    pub composer: Option<Composer>,
-    /// Reply being typed under the selected card.
-    pub reply: String,
-    /// Inline edit of a card's text in the Comments panel: (page, index, text).
-    pub editing: Option<(usize, usize, String)>,
-    /// The panel should scroll the selected card into view.
-    pub reveal: bool,
-    /// The "Add a comment" box at the top of the Comments panel.
-    pub add_box: String,
-    /// The Comments panel's search query (`None`: search closed).
-    pub search: Option<String>,
-    /// Comment types, authors and statuses hidden by the panel's filter.
-    pub hidden_types: Vec<String>,
-    pub hidden_authors: Vec<String>,
-    pub hidden_statuses: Vec<String>,
-    /// Colours (`RRGGBB`, empty for none) and checkmark states ("Checked", "Unchecked") hidden.
-    pub hidden_colors: Vec<String>,
-    pub hidden_checks: Vec<String>,
-    /// How the panel orders comments.
-    pub sort: SortBy,
-    /// Pages whose group is folded in the panel (when sorted by page).
-    pub collapsed_pages: Vec<usize>,
-    /// Comment Properties was asked for from the panel: (page, index).
-    pub props_request: Option<(usize, usize)>,
-    /// Make Current Properties Default was asked for: (page, index).
-    pub default_request: Option<(usize, usize)>,
-    /// A file attachment comment's file was asked for: (page, index, open it in a new tab
-    /// rather than save it).
-    pub attachment_request: Option<(usize, usize, bool)>,
-    /// Replace Text: the struck-out text's quads while the replacement is typed.
-    pub replace: Option<Vec<[f64; 8]>>,
-    /// Attach file: where the icon goes (page, top-left in user space), for the app to pick a file.
-    pub attach_at: Option<(usize, [f64; 2])>,
-    pub search_focus: bool,
-    /// Where the canvas context menu was opened: (page, user-space point).
-    pub context_at: Option<(usize, [f64; 2])>,
-    /// A one-shot tool just finished; the app returns to the Select tool unless pinned.
-    pub tool_done: bool,
-    /// What the inline editor (`editing`) does with the keyboard the next time it is drawn.
-    pub(crate) editor_focus: Option<EditorFocus>,
-}
-
-/// A one-off change to the keyboard focus of the Comments panel's inline editor. The editor
-/// never asks for the keyboard on its own: when it did so on every frame, it took the keyboard
-/// back after every click elsewhere, and the tool keys (V, H) were typed into it (#2669).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) enum EditorFocus {
-    /// The editor just opened: it takes the keyboard, once.
-    Take,
-    /// Another comment was added: the editor keeps its text but gives the keyboard back.
-    Release,
-}
-
-impl CommentView {
-    /// Takes back the last point of a polygon, cloud or connected lines being drawn; the first
-    /// point's removal cancels the drawing. Returns whether there was such a drawing.
-    pub fn undo_point(&mut self) -> bool {
-        let Some(Gesture::Draw { tool, points, .. }) = self.gesture.as_mut() else { return false };
-        if !tool.clicks_points() {
-            return false;
-        }
-        points.pop();
-        if points.is_empty() {
-            self.gesture = None;
-        }
-        true
-    }
-
-    /// Open the inline editor on comment (page, index) with `text`. It takes the keyboard once,
-    /// as it opens; after that the keyboard goes wherever the user clicks.
-    pub(crate) fn open_editor(&mut self, page: usize, index: usize, text: String) {
-        self.editing = Some((page, index, text));
-        self.editor_focus = Some(EditorFocus::Take);
-    }
-
-    /// A comment was just added. The editor open on another one must not keep the keyboard, or
-    /// the tool keys pressed next are typed into it (#2669): an empty editor closes, and one
-    /// holding text stays open with it, without the keyboard.
-    pub(crate) fn comment_added(&mut self) {
-        if self.editing.as_ref().is_some_and(|(_, _, text)| !text.is_empty()) {
-            self.editor_focus = Some(EditorFocus::Release);
-        } else {
-            self.editing = None;
-            self.editor_focus = None;
-        }
-    }
-}
-
-/// Comments panel order (Acrobat: Sort by page, author, date, type, colour).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub enum SortBy {
-    #[default]
-    Page,
-    Author,
-    Date,
-    Type,
-    Color,
-}
-
-/// What a page needs to know to handle comment input.
-pub(crate) struct PageCx<'a> {
-    pub page: usize,
-    pub xf: &'a PageXform,
-    pub info: &'a DocInfo,
-    pub tool: QuickTool,
-    pub prefs: &'a CommentPrefs,
-    /// A redaction mark's fill while the pointer is over it, and its opacity (Redaction Tool
-    /// Properties).
-    pub redact_mark: ([f64; 3], f64),
-    /// The document allows commenting.
-    pub allowed: bool,
-    /// Comments are hidden (Hide all comments): nothing to select.
-    pub hidden: bool,
-}
-
-impl PageCx<'_> {
-    fn to_user(&self, p: Pos2) -> [f64; 2] {
-        let (vx, vy) = self.xf.screen_to_view(p);
-        let u = self.info.pages[self.page].view_to_user(vx, vy);
-        [u[0] as f64, u[1] as f64]
-    }
-
-    fn to_screen(&self, p: [f64; 2]) -> Pos2 {
-        let v = self.info.pages[self.page].user_to_view(p[0] as f32, p[1] as f32);
-        self.xf.norm_to_screen(v[0] / self.xf.pw, v[1] / self.xf.ph)
-    }
-
-    /// The page's clockwise `/Rotate`.
-    fn rotation(&self) -> u16 {
-        self.info.pages.get(self.page).map_or(0, |p| p.rotation)
-    }
-
-    /// Where a comment is drawn on screen (a sticky note stays upright on a turned page).
-    fn screen_rect(&self, a: &Annotation) -> Rect {
-        self.xf.user_rect(self.info, self.page, a.shown_rect(self.rotation()))
-    }
-
-    /// Top-level comments on this page, in paint order.
-    fn comments(&self) -> impl Iterator<Item = &Annotation> {
-        self.info.annotations.iter().filter(move |a| !self.hidden && a.page == self.page && a.in_reply_to.is_none() && a.subtype != "Popup")
-    }
-
-    /// Where a comment is on screen: one rectangle, or one per marked line for text markup.
-    pub(crate) fn screen_rects<'b>(&'b self, a: &'b Annotation) -> impl Iterator<Item = Rect> + 'b {
-        let quads = if is_markup(&a.subtype) { a.quads.as_slice() } else { &[] };
-        let fallback = quads.is_empty().then(|| self.screen_rect(a));
-        quads
-            .iter()
-            .map(|q| {
-                let xs = [q[0], q[2], q[4], q[6]];
-                let ys = [q[1], q[3], q[5], q[7]];
-                let (x0, x1) = (xs.iter().copied().fold(f32::MAX, f32::min), xs.iter().copied().fold(f32::MIN, f32::max));
-                let (y0, y1) = (ys.iter().copied().fold(f32::MAX, f32::min), ys.iter().copied().fold(f32::MIN, f32::max));
-                self.xf.user_rect(self.info, self.page, [x0, y0, x1, y1])
-            })
-            .chain(fallback)
-    }
-
-    /// A redaction mark's areas: one per marked quad, or its rectangle.
-    fn redact_rects(&self, a: &Annotation) -> Vec<Rect> {
-        if a.quads.is_empty() {
-            return vec![self.screen_rect(a)];
-        }
-        a.quads
-            .iter()
-            .map(|q| {
-                let xs = [q[0], q[2], q[4], q[6]];
-                let ys = [q[1], q[3], q[5], q[7]];
-                let (x0, x1) = (xs.iter().copied().fold(f32::MAX, f32::min), xs.iter().copied().fold(f32::MIN, f32::max));
-                let (y0, y1) = (ys.iter().copied().fold(f32::MAX, f32::min), ys.iter().copied().fold(f32::MIN, f32::max));
-                self.xf.user_rect(self.info, self.page, [x0, y0, x1, y1])
-            })
-            .collect()
-    }
-
-    /// The topmost comment under `p`.
-    fn hit(&self, p: Pos2) -> Option<&Annotation> {
-        self.comments().filter(|a| self.screen_rects(a).any(|r| r.expand(3.0).contains(p))).last()
-    }
-
-    pub(crate) fn get(&self, index: usize) -> Option<&Annotation> {
-        self.comments().find(|a| a.index == index)
-    }
-
-    pub(crate) fn rect_to_user(&self, r: Rect) -> [f64; 4] {
-        let (a, b) = (self.to_user(r.left_top()), self.to_user(r.right_bottom()));
-        [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
-    }
-
-    /// The same geometry drives the live image, its handles, and the edit on release.
-    /// `shift` is whether Shift is held now: it keeps the box's proportions from a corner.
-    pub(crate) fn adjusted_rect(
-        &self,
-        a: &Annotation,
-        gesture: Option<&Gesture>,
-        pointer: Option<Pos2>,
-        shift: bool,
-        pending: Option<&Edit>,
-    ) -> Rect {
-        let r = self.screen_rect(a);
-        if let Some(Edit::ResizeAnnotation { page, index, rect }) = pending
-            && (*page, *index) == (self.page, a.index)
-        {
-            return self.xf.user_rect(self.info, self.page, a.shown(*rect, self.rotation()).map(|v| v as f32));
-        }
-        if let Some(Edit::MoveAnnotation { page, index, dx, dy }) = pending
-            && (*page, *index) == (self.page, a.index)
-        {
-            let r = a.shown_rect(self.rotation());
-            return self.xf.user_rect(self.info, self.page, [r[0] + *dx as f32, r[1] + *dy as f32, r[2] + *dx as f32, r[3] + *dy as f32]);
-        }
-        match (gesture, pointer) {
-            (Some(Gesture::Move { page, index, from }), Some(p)) if (*page, *index) == (self.page, a.index) => r.translate(p - *from),
-            (Some(Gesture::Resize { page, index, handle, from, aspect_ratio }), Some(p)) if (*page, *index) == (self.page, a.index) => {
-                resized(r, *handle, p - *from, corner_ratio(r, *aspect_ratio, shift))
-            }
-            _ => r,
-        }
-    }
-}
-
-fn is_markup(subtype: &str) -> bool {
-    matches!(subtype, "Highlight" | "Underline" | "StrikeOut" | "Squiggly")
-}
-
-/// Rectangles, ovals, text boxes, stamps and drawings (drawn signatures among them). A callout's
-/// `/Rect` also holds its leader line, so it only moves.
-fn resizable(a: &Annotation) -> bool {
-    matches!(a.subtype.as_str(), "Square" | "Circle" | "FreeText" | "Stamp" | "Ink") && a.intent.as_deref() != Some("FreeTextCallout")
-}
-
-/// Lines, connected lines, polygons and clouds: their ends and corners have handles of their own
-/// (measurements keep the points they measured, and a locked comment its shape).
-fn reshapable(a: &Annotation) -> bool {
-    matches!(a.subtype.as_str(), "Line" | "PolyLine" | "Polygon")
-        && !a.points.is_empty()
-        && !a.locked
-        && !a.intent.as_deref().is_some_and(|i| i.ends_with("Dimension"))
-}
-
-/// Whether `tool` picks up a line's end and corner handles: the Select and Fill & Sign tools.
-/// The drawing tools draw from where they are pressed, so a new line starts at the end of the
-/// one just drawn rather than dragging it.
-fn grabs_points(tool: QuickTool) -> bool {
-    !matches!(tool, QuickTool::Comment(t) if t.draws() || t.clicks_points())
-}
-
-/// The point of `a` (an end or a corner) whose handle is at `p` on screen.
-fn point_handle(cx: &PageCx<'_>, a: &Annotation, p: Pos2) -> Option<usize> {
-    a.points.iter().position(|q| cx.to_screen([f64::from(q[0]), f64::from(q[1])]).distance(p) <= 7.0)
-}
-
-/// `points` with point `i` moved to `to`; with Shift, held to the nearest 45° from the point
-/// before it (a line's other end; the first corner turns about the second).
-pub(crate) fn reshaped(points: &[[f64; 2]], i: usize, to: [f64; 2], shift: bool) -> Vec<[f64; 2]> {
-    let mut out = points.to_vec();
-    let anchor = if i == 0 { points.get(1) } else { points.get(i - 1) };
-    let to = match anchor {
-        Some(a) if shift => pdfcraft_engine::measure::snap::constrain(*a, to),
-        _ => to,
-    };
-    if let Some(p) = out.get_mut(i) {
-        *p = to;
-    }
-    out
-}
-
-const HANDLES: [(i8, i8); 8] = [(-1, -1), (0, -1), (1, -1), (1, 0), (1, 1), (0, 1), (-1, 1), (-1, 0)];
-
-fn handle_pos(r: Rect, (hx, hy): (i8, i8)) -> Pos2 {
-    let x = match hx {
-        -1 => r.left(),
-        0 => r.center().x,
-        _ => r.right(),
-    };
-    let y = match hy {
-        -1 => r.top(),
-        0 => r.center().y,
-        _ => r.bottom(),
-    };
-    pos2(x, y)
-}
-
-/// The proportions a corner drag of `r` keeps: the box's own fixed ratio (an image signature's),
-/// else `r`'s current one while Shift is held, else none.
-pub(crate) fn corner_ratio(r: Rect, fixed: Option<f32>, shift: bool) -> Option<f32> {
-    fixed.or_else(|| (shift && r.width() > 0.0 && r.height() > 0.0).then(|| r.width() / r.height()))
-}
-
-pub(crate) fn resized(r: Rect, (hx, hy): (i8, i8), d: egui::Vec2, aspect_ratio: Option<f32>) -> Rect {
-    if hx != 0
-        && hy != 0
-        && let Some(ratio) = aspect_ratio.filter(|v| v.is_finite() && *v > 0.0)
-    {
-        // As in content_ui, the larger requested dimension drives proportional corner resizing.
-        // Keep the opposite corner fixed and prevent crossing it from flipping the image.
-        let width = (r.width() + f32::from(hx) * d.x).max((r.height() + f32::from(hy) * d.y) * ratio).max(4.0).max(4.0 * ratio);
-        let anchor = handle_pos(r, (-hx, -hy));
-        return Rect::from_two_pos(anchor, anchor + vec2(f32::from(hx) * width, f32::from(hy) * width / ratio));
-    }
-    let mut r = r;
-    match hx {
-        -1 => r.min.x += d.x,
-        1 => r.max.x += d.x,
-        _ => {}
-    }
-    match hy {
-        -1 => r.min.y += d.y,
-        1 => r.max.y += d.y,
-        _ => {}
-    }
-    Rect::from_two_pos(r.min, r.max)
-}
-
-/// Comment input on one page, before text selection runs. Returns `true` when the pointer
-/// gesture belongs to commenting (text selection must ignore it).
-pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>, view: &mut DocView) -> bool {
-    let pointer = ui.input(|i| i.pointer.hover_pos());
-    let origin = ui.input(|i| i.pointer.press_origin());
-    let page_rect = cx.xf.rect;
-    let pressed_here = origin.is_some_and(|o| page_rect.contains(o));
-    let over_page = pointer.is_some_and(|p| page_rect.contains(p));
-    let fill_grab = fill_grabs(ui, cx, view);
-    let draw_grab = draw_grabs(ui, cx, view);
-    let caret_text = if cx.tool == QuickTool::Comment(CommentTool::Caret) { view.page_text(cx.page) } else { None };
-    let cv = &mut view.comments;
-    if cv.gesture.is_some() && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
-        cv.gesture = None;
-        cv.cancelled_drag = true;
-        return true;
-    }
-    if cv.cancelled_drag {
-        return true;
-    }
-    if resp.secondary_clicked()
-        && let Some(p) = pointer.filter(|p| page_rect.contains(*p))
-    {
-        cv.context_at = Some((cx.page, cx.to_user(p)));
-        cv.selected = cx.hit(p).map(|a| (cx.page, a.index));
-    }
-    match cx.tool {
-        // The shape just drawn is selected with its handles showing: they resize it without a
-        // trip to the Select tool (#2338). Anywhere else the tool keeps drawing.
-        QuickTool::Comment(_) if draw_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
-        QuickTool::Comment(tool) if tool.draws() => {
-            if !cx.allowed {
-                return false;
-            }
-            if over_page {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
-            }
-            if resp.drag_started()
-                && pressed_here
-                && let Some(o) = origin
-            {
-                cv.gesture = Some(Gesture::Draw { page: cx.page, tool, points: vec![cx.to_user(o)] });
-                cv.selected = None;
-            }
-            if let Some(Gesture::Draw { page, tool, points }) = cv.gesture.as_mut()
-                && *page == cx.page
-                && let Some(p) = pointer
-            {
-                let p = clamp_to(page_rect, p);
-                let u = cx.to_user(p);
-                if matches!(*tool, CommentTool::Ink | CommentTool::Eraser) {
-                    let last = points.last().map(|l| cx.to_screen(*l)).unwrap_or(p);
-                    if last.distance(p) >= 1.5 {
-                        points.push(u);
-                    }
-                } else {
-                    points.truncate(1);
-                    points.push(u);
-                }
-            }
-            if resp.drag_stopped()
-                && let Some(Gesture::Draw { page, tool, points }) = cv.gesture.clone()
-                && page == cx.page
-            {
-                cv.gesture = None;
-                if tool == CommentTool::Eraser {
-                    view.pending_edit = erase(cx, &points);
-                } else if let Some(shape) = drawn_shape(tool, &points) {
-                    let now = ui.input(|i| i.time);
-                    cv.settle(now, page, tool, &points);
-                    view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
-                }
-            }
-            // A quick press/release does not start an egui drag, but Acrobat's Draw tool treats
-            // it as a one-point ink stroke (a dot). The appearance uses round line caps, so a
-            // single PDF point is visible and remains editable like any other drawing.
-            if tool == CommentTool::Ink
-                && resp.clicked()
-                && over_page
-                && let Some(p) = pointer
-                && let Some(shape) = drawn_shape(tool, &[cx.to_user(p)])
-            {
-                cv.selected = None;
-                let now = ui.input(|i| i.time);
-                cv.settle(now, cx.page, tool, &[cx.to_user(p)]);
-                view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
-            }
-            true
-        }
-        QuickTool::Comment(tool) if tool.clicks_points() => {
-            if !cx.allowed {
-                return false;
-            }
-            if over_page {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
-            }
-            let finish = resp.double_clicked() || ui.input(|i| i.key_pressed(egui::Key::Enter));
-            // Backspace (or Delete) takes back the last point, e.g. after a wrong click; Undo does too.
-            // Only while a drawing is in progress: otherwise Delete belongs to the selected comment.
-            if matches!(cv.gesture, Some(Gesture::Draw { page, .. }) if page == cx.page)
-                && !ui.ctx().egui_wants_keyboard_input()
-                && ui.input_mut(|i| {
-                    i.consume_key(egui::Modifiers::NONE, egui::Key::Backspace) || i.consume_key(egui::Modifiers::NONE, egui::Key::Delete)
-                })
-            {
-                cv.undo_point();
-                return true;
-            }
-            if resp.clicked()
-                && over_page
-                && let Some(p) = pointer
-            {
-                let u = cx.to_user(p);
-                match cv.gesture.as_mut() {
-                    Some(Gesture::Draw { page, tool: t, points }) if *page == cx.page && *t == tool => {
-                        // Clicking the first point again closes a polygon.
-                        let closes = points.len() >= 3 && tool != CommentTool::PolyLine && cx.to_screen(points[0]).distance(p) <= 6.0;
-                        let repeat = points.last().is_some_and(|l| cx.to_screen(*l).distance(p) < 2.0);
-                        if closes {
-                            let pts = std::mem::take(points);
-                            cv.gesture = None;
-                            if let Some(shape) = drawn_shape(tool, &pts) {
-                                view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
-                            }
-                            return true;
-                        }
-                        if !repeat {
-                            points.push(u);
-                        }
-                    }
-                    _ => {
-                        cv.gesture = Some(Gesture::Draw { page: cx.page, tool, points: vec![u] });
-                        cv.selected = None;
-                    }
-                }
-            }
-            if finish
-                && let Some(Gesture::Draw { page, tool: t, points }) = cv.gesture.clone()
-                && page == cx.page
-                && t == tool
-            {
-                cv.gesture = None;
-                if let Some(shape) = drawn_shape(tool, &points) {
-                    view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
-                }
-            }
-            true
-        }
-        QuickTool::Comment(CommentTool::Callout) => {
-            // Drag from what the callout points at to where its text box goes.
-            if !cx.allowed {
-                return false;
-            }
-            if over_page {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
-            }
-            if resp.drag_started()
-                && pressed_here
-                && let Some(o) = origin
-            {
-                cv.gesture = Some(Gesture::Draw { page: cx.page, tool: CommentTool::Callout, points: vec![cx.to_user(o)] });
-                cv.selected = None;
-            }
-            if let Some(Gesture::Draw { page, points, .. }) = cv.gesture.as_mut()
-                && *page == cx.page
-                && let Some(p) = pointer
-            {
-                points.truncate(1);
-                points.push(cx.to_user(clamp_to(page_rect, p)));
-            }
-            if resp.drag_stopped()
-                && let Some(Gesture::Draw { page, points, .. }) = cv.gesture.clone()
-                && page == cx.page
-            {
-                cv.gesture = None;
-                if let [point, at] = points[..]
-                    && (point[0] - at[0]).hypot(point[1] - at[1]) >= 8.0
-                {
-                    cv.composer = Some(Composer { page, at, kind: ComposerKind::Callout { point }, text: String::new(), focus: true });
-                }
-            }
-            true
-        }
-        QuickTool::Comment(CommentTool::Attach) => {
-            if !cx.allowed {
-                return false;
-            }
-            if over_page {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
-            }
-            if resp.clicked()
-                && over_page
-                && let Some(p) = pointer
-            {
-                cv.attach_at = Some((cx.page, cx.to_user(p)));
-                cv.selected = None;
-            }
-            true
-        }
-        QuickTool::Comment(CommentTool::Caret) => {
-            if !cx.allowed {
-                return false;
-            }
-            if over_page {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Text);
-            }
-            if resp.clicked()
-                && over_page
-                && let Some(p) = pointer
-            {
-                let (vx, vy) = cx.xf.screen_to_view(p);
-                let snapped = cx.info.pages.get(cx.page).zip(caret_text.as_deref()).and_then(|(page, t)| snapped_caret(page, t, vx, vy));
-                let (at, size) = snapped.unwrap_or_else(|| (cx.to_user(p), CARET_SIZE));
-                cv.composer = Some(Composer { page: cx.page, at, kind: ComposerKind::Caret { size }, text: String::new(), focus: true });
-                cv.selected = None;
-            }
-            true
-        }
-        QuickTool::Comment(tool @ (CommentTool::Note | CommentTool::TextBox)) => {
-            if !cx.allowed {
-                return false;
-            }
-            if over_page {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
-            }
-            // A text box also takes a drag, as in Acrobat: the box is drawn at that size and its
-            // text wraps inside it (#2669).
-            if tool == CommentTool::TextBox {
-                if resp.drag_started()
-                    && pressed_here
-                    && let Some(o) = origin
-                {
-                    cv.gesture = Some(Gesture::Draw { page: cx.page, tool, points: vec![cx.to_user(o)] });
-                    cv.selected = None;
-                }
-                if let Some(Gesture::Draw { page, points, .. }) = cv.gesture.as_mut()
-                    && *page == cx.page
-                    && let Some(p) = pointer
-                {
-                    points.truncate(1);
-                    points.push(cx.to_user(clamp_to(page_rect, p)));
-                }
-                if resp.drag_stopped()
-                    && let Some(Gesture::Draw { page, points, .. }) = cv.gesture.clone()
-                    && page == cx.page
-                {
-                    cv.gesture = None;
-                    if let (Some(first), Some(last)) = (points.first(), points.last()) {
-                        let r = Rect::from_two_pos(cx.to_screen(*first), cx.to_screen(*last));
-                        // A drag of a few pixels is a click: the box fits its text.
-                        let drawn =
-                            (r.width() >= 6.0 && r.height() >= 6.0).then(|| cx.info.pages.get(page)).flatten().map(|p| drawn_box(p, *first, *last));
-                        let (at, size) = drawn.map_or((*first, None), |(at, size)| (at, Some(size)));
-                        cv.composer = Some(Composer { page, at, kind: ComposerKind::TextBox { size }, text: String::new(), focus: true });
-                    }
-                }
-            }
-            if resp.clicked()
-                && over_page
-                && let Some(p) = pointer
-            {
-                let kind = if tool == CommentTool::Note { ComposerKind::Note } else { ComposerKind::TextBox { size: None } };
-                cv.composer = Some(Composer { page: cx.page, at: cx.to_user(p), kind, text: String::new(), focus: true });
-                cv.selected = None;
-            }
-            true
-        }
-        QuickTool::Select => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
-        QuickTool::Fill(_) if fill_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
-        _ => false,
-    }
-}
-
-/// With a Fill & Sign tool, the Fill & Sign marks already on the page are picked up as with the
-/// Select tool, as in Acrobat: hovering one shows the move cursor, a click selects it, a drag
-/// moves it and the selected one's handles resize it. Elsewhere the tool places its mark. While
-/// the button is down the press decides; otherwise the pointer (egui clears the press origin on
-/// release, so a click is located by the pointer).
-pub(crate) fn fill_grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView) -> bool {
-    matches!(cx.tool, QuickTool::Fill(_)) && grabs(ui, cx, view, |a| a.fill_sign)
-}
-
-/// With the Select tool, a comment that would move (not text markup) is picked up before a form
-/// field under it, so a signature placed over a field can still be dragged off it.
-pub(crate) fn select_grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView) -> bool {
-    cx.tool == QuickTool::Select && grabs(ui, cx, view, |a| !is_markup(&a.subtype))
-}
-
-/// With a shape tool (rectangle, oval, line, polygon…), the selected comment's resize handles
-/// are picked up as with the Select tool, so the shape just drawn can be resized straight away
-/// (#2338). Only the handles: a press anywhere else, the shape itself included, still draws.
-pub(crate) fn draw_grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView) -> bool {
-    let QuickTool::Comment(tool) = cx.tool else { return false };
-    if !(tool.draws() || tool.clicks_points()) || tool == CommentTool::Eraser || cx.hidden {
-        return false;
-    }
-    let cv = &view.comments;
-    if matches!(cv.gesture, Some(Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page) {
-        return true;
-    }
-    // A polygon being clicked out keeps its clicks, even near an old shape's handle.
-    if cv.gesture.is_some() {
-        return false;
-    }
-    press_point(ui, cx).is_some_and(|p| on_handle(cx, view, p, |_| true))
-}
-
-/// Whether the press (or, with no button down, the pointer) is on a `pick` comment or on the
-/// selected one's resize handles.
-fn grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView, pick: impl Fn(&Annotation) -> bool) -> bool {
-    if cx.hidden {
-        return false;
-    }
-    if matches!(view.comments.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page)
-    {
-        return true;
-    }
-    let Some(p) = press_point(ui, cx) else { return false };
-    on_handle(cx, view, p, &pick) || cx.hit(p).is_some_and(pick)
-}
-
-/// Where a gesture on this page is decided: the press while the button is down, otherwise the
-/// pointer (egui clears the press origin on release). `None` off the page.
-fn press_point(ui: &egui::Ui, cx: &PageCx<'_>) -> Option<Pos2> {
-    let (pointer, origin, down) = ui.input(|i| (i.pointer.hover_pos(), i.pointer.press_origin(), i.pointer.any_down()));
-    (if down { origin } else { pointer }).filter(|p| cx.xf.rect.contains(*p))
-}
-
-/// Whether `p` is on a resize handle of the selected comment, when it is a resizable `pick`.
-fn on_handle(cx: &PageCx<'_>, view: &DocView, p: Pos2, pick: impl Fn(&Annotation) -> bool) -> bool {
-    view.comments.selected.filter(|(page, _)| *page == cx.page).and_then(|(_, i)| cx.get(i)).filter(|a| pick(a) && cx.allowed).is_some_and(|a| {
-        (resizable(a) && HANDLES.into_iter().any(|h| handle_pos(cx.screen_rect(a), h).distance(p) <= 7.0))
-            || (grabs_points(cx.tool) && reshapable(a) && point_handle(cx, a, p).is_some())
-    })
-}
-
-fn clamp_to(r: Rect, p: Pos2) -> Pos2 {
-    pos2(p.x.clamp(r.left(), r.right()), p.y.clamp(r.top(), r.bottom()))
-}
-
-/// The Select tool: hover, select, move, resize, edit, delete.
-fn select_input(
-    ui: &egui::Ui,
-    resp: &egui::Response,
-    cx: &PageCx<'_>,
-    view: &mut DocView,
-    pointer: Option<Pos2>,
-    origin: Option<Pos2>,
-    pressed_here: bool,
-) -> bool {
-    let cv = &mut view.comments;
-    let selected = cv.selected.filter(|(p, _)| *p == cx.page).and_then(|(_, i)| cx.get(i));
-    // Handles of a selected, resizable comment.
-    let handle_at = |p: Pos2| -> Option<(i8, i8)> {
-        let a = selected.filter(|a| cx.allowed && resizable(a))?;
-        let r = cx.screen_rect(a);
-        HANDLES.into_iter().find(|h| handle_pos(r, *h).distance(p) <= 7.0)
-    };
-    // Ends and corners of a selected line, connected lines, polygon or cloud.
-    let point_at =
-        |p: Pos2| -> Option<usize> { selected.filter(|a| cx.allowed && grabs_points(cx.tool) && reshapable(a)).and_then(|a| point_handle(cx, a, p)) };
-    let mut consumed = false;
-    if let Some(p) = pointer {
-        if point_at(p).is_some() {
-            ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
-        } else if let Some(h) = handle_at(p) {
-            ui.ctx().set_cursor_icon(match h {
-                (0, _) => egui::CursorIcon::ResizeVertical,
-                (_, 0) => egui::CursorIcon::ResizeHorizontal,
-                (-1, -1) | (1, 1) => egui::CursorIcon::ResizeNwSe,
-                _ => egui::CursorIcon::ResizeNeSw,
-            });
-        } else if let Some(a) = cx.hit(p) {
-            let movable = cx.allowed && !is_markup(&a.subtype);
-            ui.ctx().set_cursor_icon(if movable { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand });
-        }
-    }
-    if resp.drag_started()
-        && pressed_here
-        && let Some(o) = origin
-    {
-        if let (Some(point), Some(a)) = (point_at(o), selected) {
-            let points = a.points.iter().map(|q| [f64::from(q[0]), f64::from(q[1])]).collect();
-            cv.gesture = Some(Gesture::Reshape { page: cx.page, index: a.index, point, points });
-            consumed = true;
-        } else if let (Some(h), Some(a)) = (handle_at(o), selected) {
-            // On screen, the image is also turned by the view's rotation.
-            let turned = !cx.xf.rot.is_multiple_of(180);
-            let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).map(|ratio| if turned { ratio.recip() } else { ratio });
-            // A drawn signature keeps its shape from the corners, as image signatures do.
-            let aspect_ratio = aspect_ratio.or_else(|| {
-                let r = cx.screen_rect(a);
-                (a.fill_sign && a.subtype == "Ink" && r.height() > 0.0).then(|| r.width() / r.height())
-            });
-            cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: h, from: o, aspect_ratio });
-            consumed = true;
-        } else if let Some(a) = cx.hit(o)
-            && !is_markup(&a.subtype)
-        {
-            cv.selected = Some((cx.page, a.index));
-            cv.reveal = true;
-            if cx.allowed {
-                cv.gesture = Some(Gesture::Move { page: cx.page, index: a.index, from: o });
-            }
-            consumed = true;
-        }
-    }
-    if matches!(cv.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page) {
-        consumed = true;
-    }
-    if resp.drag_stopped()
-        && let Some(p) = pointer
-    {
-        match cv.gesture.clone() {
-            Some(Gesture::Move { page, index, from }) if page == cx.page => {
-                cv.gesture = None;
-                let (a, b) = (cx.to_user(from), cx.to_user(p));
-                let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
-                if from.distance(p) >= 2.0 {
-                    view.pending_edit = Some(Edit::MoveAnnotation { page, index, dx, dy });
-                }
-            }
-            Some(Gesture::Resize { page, index, handle, from, aspect_ratio }) if page == cx.page => {
-                cv.gesture = None;
-                if let Some(a) = cx.get(index) {
-                    let from_rect = cx.screen_rect(a);
-                    let shift = ui.input(|i| i.modifiers.shift);
-                    let r = resized(from_rect, handle, p - from, corner_ratio(from_rect, aspect_ratio, shift));
-                    let rect = a.rect_for_shown(cx.rect_to_user(r), cx.rotation());
-                    if r.width() >= 4.0 && r.height() >= 4.0 {
-                        view.pending_edit = Some(Edit::ResizeAnnotation { page, index, rect });
-                    }
-                }
-            }
-            Some(Gesture::Reshape { page, index, point, points }) if page == cx.page => {
-                cv.gesture = None;
-                let shift = ui.input(|i| i.modifiers.shift);
-                let moved = points.get(point).is_some_and(|q| cx.to_screen(*q).distance(p) >= 2.0);
-                if moved {
-                    view.pending_edit = Some(Edit::ReshapeAnnotation { page, index, points: reshaped(&points, point, cx.to_user(p), shift) });
-                }
-            }
-            _ => {}
-        }
-    }
-    // (egui clears the press origin on release, so clicks are located by the pointer.)
-    let on_page = pointer.is_some_and(|p| cx.xf.rect.contains(p));
-    if resp.clicked() && on_page {
-        let follow_link = cx.tool == QuickTool::Select
-            && !consumed
-            && cv.gesture.is_none()
-            && !resp.double_clicked()
-            && pointer
-                .is_some_and(|p| cx.info.links.iter().any(|link| link.page == cx.page && cx.xf.user_rect(cx.info, cx.page, link.rect).contains(p)));
-        match pointer.and_then(|p| cx.hit(p)) {
-            Some(a) if a.subtype == "Highlight" && follow_link => {
-                // A plain click follows the link beneath text highlighting. Keep other
-                // annotations and active gestures in control of their own input.
-                cv.selected = None;
-            }
-            Some(a) => {
-                cv.selected = Some((cx.page, a.index));
-                cv.reveal = true;
-                consumed = true;
-            }
-            None => cv.selected = None,
-        }
-    }
-    if resp.double_clicked()
-        && on_page
-        && cx.allowed
-        && let Some(a) = pointer.and_then(|p| cx.hit(p))
-    {
-        cv.selected = Some((cx.page, a.index));
-        cv.composer = Some(Composer {
-            page: cx.page,
-            at: edit_anchor(cx.info, a),
-            kind: ComposerKind::Edit(a.index),
-            text: a.contents.clone().unwrap_or_default(),
-            focus: true,
-        });
-        consumed = true;
-    }
-    consumed
-}
-
-/// After text selection ran: a markup tool turns a finished selection into a comment; Replace
-/// Text asks for the replacement.
-pub(crate) fn page_after_text(resp: &egui::Response, cx: &PageCx<'_>, view: &mut DocView) {
-    let QuickTool::Comment(tool) = cx.tool else { return };
-    if tool == CommentTool::ReplaceText && cx.allowed && (resp.drag_stopped() || resp.double_clicked()) {
-        if let Some((page, quads)) = view.selection_quads(cx.info).filter(|(p, _)| *p == cx.page) {
-            view.clear_selection();
-            let last = quads.last().copied().unwrap_or_default();
-            let at = [last[2].max(last[6]), last[1].max(last[3])];
-            view.comments.replace = Some(quads);
-            view.comments.composer = Some(Composer { page, at, kind: ComposerKind::Replace, text: String::new(), focus: true });
-        }
-        return;
-    }
-    if tool.markup().is_none() || !cx.allowed || !(resp.drag_stopped() || resp.double_clicked()) {
-        return;
-    }
-    if let Some(kind) = tool.markup()
-        && let Some((page, quads)) = view.selection_quads(cx.info).filter(|(p, _)| *p == cx.page)
-    {
-        view.clear_selection();
-        view.pending_edit = Some(new_comment(cx, tool, Shape::TextMarkup { kind, quads }, String::new()));
-        let _ = page;
-    }
-}
-
-/// Paint comment selection, hover and gesture previews on a page.
-pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView) {
-    let cv = &view.comments;
-    let pointer = ui.input(|i| i.pointer.hover_pos());
-    // A redaction mark shows its fill while the pointer is over it, as Acrobat's does, so the
-    // marked area reads before anything is applied.
-    if cv.gesture.is_none()
-        && let Some(a) = pointer.and_then(|p| cx.hit(p))
-        && a.subtype == "Redact"
-    {
-        let ([r, g, b], opacity) = cx.redact_mark;
-        let fill = Color32::from_rgba_unmultiplied((r * 255.0) as u8, (g * 255.0) as u8, (b * 255.0) as u8, (opacity.clamp(0.0, 1.0) * 255.0) as u8);
-        for rect in cx.redact_rects(a) {
-            painter.rect_filled(rect, CornerRadius::ZERO, fill);
-        }
-    }
-    if cv.gesture.is_none()
-        && let Some(a) = pointer.and_then(|p| cx.hit(p))
-        && (cx.tool == QuickTool::Select || matches!(cx.tool, QuickTool::Fill(_)) && a.fill_sign)
-        && cv.selected != Some((cx.page, a.index))
-    {
-        for r in cx.screen_rects(a) {
-            painter.rect_stroke(r.expand(2.0), CornerRadius::same(2), Stroke::new(1.0, SELECT_BLUE.gamma_multiply(0.7)), egui::StrokeKind::Outside);
-        }
-    }
-    if let Some((page, index)) = cv.selected
-        && page == cx.page
-        && let Some(a) = cx.get(index)
-    {
-        if is_markup(&a.subtype) && !a.quads.is_empty() {
-            for r in cx.screen_rects(a) {
-                painter.rect_stroke(r.expand(2.0), CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Middle);
-            }
-            return paint_gesture(painter, cx, view);
-        }
-        if view.signature_drag.contains(page, index) && matches!(cv.gesture, Some(Gesture::Move { page: p, index: i, .. }) if (p, i) == (page, index))
-        {
-            return paint_gesture(painter, cx, view);
-        }
-        let shift = ui.input(|i| i.modifiers.shift);
-        if cx.allowed && grabs_points(cx.tool) && reshapable(a) {
-            return paint_points(painter, cx, view, a, pointer, shift);
-        }
-        let r = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, view.pending_edit.as_ref()).expand(2.0);
-        painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Middle);
-        if cx.allowed && resizable(a) {
-            for h in HANDLES {
-                let c = handle_pos(r, h);
-                painter.circle(c, 4.5, Color32::WHITE, Stroke::new(1.0, SELECT_BLUE));
-            }
-        }
-    }
-    paint_gesture(painter, cx, view);
-}
-
-/// A selected line, connected lines, polygon or cloud: a handle on each end or corner and, while
-/// one is dragged (or its edit is on its way), the new shape over the old.
-/// The points a selected line, polygon or cloud is drawn with while it changes: an end or corner
-/// being dragged, the whole comment being moved by its body, or the edit just released (until the
-/// page is drawn again). `None` while it isn't changing.
-fn changing_points(
-    gesture: Option<&Gesture>,
-    pending: Option<&Edit>,
-    (page, index): (usize, usize),
-    points: &[[f64; 2]],
-    to_user: impl Fn(Pos2) -> [f64; 2],
-    pointer: Option<Pos2>,
-    shift: bool,
-) -> Option<Vec<[f64; 2]>> {
-    let shifted = |dx: f64, dy: f64| points.iter().map(|q| [q[0] + dx, q[1] + dy]).collect();
-    match (gesture, pending) {
-        (Some(Gesture::Reshape { page: p, index: i, point, points: from }), _) if (*p, *i) == (page, index) => {
-            pointer.map(|at| reshaped(from, *point, to_user(at), shift))
-        }
-        (Some(Gesture::Move { page: p, index: i, from }), _) if (*p, *i) == (page, index) => pointer.map(|at| {
-            let (a, b) = (to_user(*from), to_user(at));
-            shifted(b[0] - a[0], b[1] - a[1])
-        }),
-        (_, Some(Edit::ReshapeAnnotation { page: p, index: i, points: to })) if (*p, *i) == (page, index) => Some(to.clone()),
-        (_, Some(Edit::MoveAnnotation { page: p, index: i, dx, dy })) if (*p, *i) == (page, index) => Some(shifted(*dx, *dy)),
-        _ => None,
-    }
-}
-
-fn paint_points(painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView, a: &Annotation, pointer: Option<Pos2>, shift: bool) {
-    let cv = &view.comments;
-    let points: Vec<[f64; 2]> = a.points.iter().map(|q| [f64::from(q[0]), f64::from(q[1])]).collect();
-    let changing = changing_points(cv.gesture.as_ref(), view.pending_edit.as_ref(), (cx.page, a.index), &points, |p| cx.to_user(p), pointer, shift);
-    let changed = changing.is_some();
-    let points = changing.unwrap_or(points);
-    let screen: Vec<Pos2> = points.iter().map(|q| cx.to_screen(*q)).collect();
-    if changed {
-        let stroke = Stroke::new(1.5, SELECT_BLUE);
-        painter.add(if a.subtype == "Polygon" {
-            egui::Shape::closed_line(screen.clone(), stroke)
-        } else {
-            egui::Shape::line(screen.clone(), stroke)
-        });
-    }
-    for c in screen {
-        painter.circle(c, 4.5, Color32::WHITE, Stroke::new(1.0, SELECT_BLUE));
-    }
-    paint_gesture(painter, cx, view);
-}
-
-fn paint_gesture(painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView) {
-    let now = painter.ctx().input(|i| i.time);
-    for s in view.comments.settling.iter().filter(|s| s.page == cx.page && now - s.since < SETTLE_SECS) {
-        paint_draw(painter, cx, &s.tool, &s.points);
-    }
-    if let Some(Gesture::Draw { page, tool, points }) = &view.comments.gesture
-        && *page == cx.page
-    {
-        paint_draw(painter, cx, tool, points);
-    }
-}
-
-/// A drawing tool's shape from its points (a live drag, or a released one still settling).
-fn paint_draw(painter: &egui::Painter, cx: &PageCx<'_>, tool: &CommentTool, points: &[[f64; 2]]) {
-    {
-        let style = cx.prefs.style(*tool);
-        let zoom = cx.xf.zoom();
-        let stroke = Stroke::new((style.width as f32 * zoom).max(1.0), color32(style.color));
-        let pts: Vec<Pos2> = points.iter().map(|p| cx.to_screen(*p)).collect();
-        match tool {
-            CommentTool::Ink => {
-                painter.add(egui::Shape::line(pts, stroke));
-            }
-            CommentTool::Eraser => {
-                // As wide as what it rubs out (see `erase`).
-                let width = (2.0 * eraser_radius_px(style.width)) as f32;
-                painter.add(egui::Shape::line(pts, Stroke::new(width, Color32::from_gray(128).gamma_multiply(0.35))));
-            }
-            CommentTool::Line | CommentTool::Arrow if pts.len() == 2 => {
-                painter.line_segment([pts[0], pts[1]], stroke);
-                if *tool == CommentTool::Arrow {
-                    let d = (pts[0] - pts[1]).normalized();
-                    let s = (6.0 + 3.0 * style.width as f32) * zoom;
-                    let rot = |v: egui::Vec2, a: f32| vec2(v.x * a.cos() - v.y * a.sin(), v.x * a.sin() + v.y * a.cos());
-                    for a in [0.52f32, -0.52] {
-                        painter.line_segment([pts[1], pts[1] + rot(d, a) * s], stroke);
-                    }
-                }
-            }
-            CommentTool::Rectangle if pts.len() == 2 => {
-                painter.rect_stroke(Rect::from_two_pos(pts[0], pts[1]), CornerRadius::ZERO, stroke, egui::StrokeKind::Inside);
-            }
-            CommentTool::Oval if pts.len() == 2 => {
-                let r = Rect::from_two_pos(pts[0], pts[1]);
-                painter.add(egui::Shape::ellipse_stroke(r.center(), r.size() / 2.0, stroke));
-            }
-            CommentTool::Polygon | CommentTool::PolyLine | CommentTool::Cloud => {
-                // The vertices so far, and a rubber band to the pointer.
-                let mut line = pts.clone();
-                if let Some(p) = painter.ctx().input(|i| i.pointer.hover_pos()) {
-                    line.push(p);
-                }
-                painter.add(egui::Shape::line(line, stroke));
-                if let Some(first) = pts.first().filter(|_| *tool != CommentTool::PolyLine && pts.len() >= 3) {
-                    painter.circle_stroke(*first, 5.0, Stroke::new(1.0, SELECT_BLUE));
-                }
-            }
-            CommentTool::TextBox if pts.len() == 2 => {
-                painter.rect_stroke(Rect::from_two_pos(pts[0], pts[1]), CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Inside);
-            }
-            CommentTool::Callout if pts.len() == 2 => {
-                painter.line_segment([pts[0], pts[1]], stroke);
-                painter.rect_stroke(Rect::from_min_size(pts[1], vec2(160.0, 40.0) * zoom), CornerRadius::ZERO, stroke, egui::StrokeKind::Inside);
-            }
-            _ => {}
-        }
-    }
-}
-
-/// The shape a finished drawing gesture makes (`None` if it is too small to mean anything).
-fn drawn_shape(tool: CommentTool, points: &[[f64; 2]]) -> Option<Shape> {
-    let (first, last) = (*points.first()?, *points.last()?);
-    let far = (first[0] - last[0]).hypot(first[1] - last[1]) >= 2.0;
-    let rect = [first[0].min(last[0]), first[1].min(last[1]), first[0].max(last[0]), first[1].max(last[1])];
-    let big = rect[2] - rect[0] >= 2.0 && rect[3] - rect[1] >= 2.0;
-    match tool {
-        CommentTool::Ink if !points.is_empty() => Some(Shape::Ink { strokes: vec![points.to_vec()] }),
-        CommentTool::Line | CommentTool::Arrow if far => Some(Shape::Line {
-            from: first,
-            to: last,
-            start: LineEnding::None,
-            end: if tool == CommentTool::Arrow { LineEnding::OpenArrow } else { LineEnding::None },
-        }),
-        CommentTool::Rectangle if big => Some(Shape::Rectangle { rect }),
-        CommentTool::Oval if big => Some(Shape::Oval { rect }),
-        CommentTool::Polygon | CommentTool::Cloud if points.len() >= 3 => {
-            Some(Shape::Polygon { vertices: points.to_vec(), cloud: tool == CommentTool::Cloud })
-        }
-        CommentTool::PolyLine if points.len() >= 2 => {
-            Some(Shape::PolyLine { vertices: points.to_vec(), start: LineEnding::None, end: LineEnding::None })
-        }
-        _ => None,
-    }
-}
-
-/// The eraser's radius on screen, in pixels, from its thickness setting (#3747): three pixels
-/// per point, so the default 2 pt keeps the 12-pixel eraser it always had, and the thickness
-/// slider's 0.5–12 pt gives 3 to 72 pixels across. A setting that isn't a number is the default.
-fn eraser_radius_px(width: f64) -> f64 {
-    3.0 * if width.is_finite() { width.clamp(0.5, 12.0) } else { 2.0 }
-}
-
-/// Eraser: rub out drawings along `path` (user space); one undo step for all of them. It rubs
-/// as wide on screen as its preview, whatever the zoom.
-fn erase(cx: &PageCx<'_>, path: &[[f64; 2]]) -> Option<Edit> {
-    let zoom = f64::from(cx.xf.zoom());
-    // A page with no size on screen has nothing to rub out (and no finite radius).
-    if !(zoom.is_finite() && zoom > 0.0) {
-        return None;
-    }
-    // Exactly the preview's width: no floor, which at a high zoom rubbed past it.
-    let radius = eraser_radius_px(cx.prefs.style(CommentTool::Eraser).width) / zoom;
-    let b = path.iter().fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |r, p| [r[0].min(p[0]), r[1].min(p[1]), r[2].max(p[0]), r[3].max(p[1])]);
-    let mut hits: Vec<usize> = cx
-        .comments()
-        .filter(|a| a.subtype == "Ink" && !a.locked)
-        .filter(|a| {
-            let r = a.rect;
-            (r[0] as f64) <= b[2] + radius && (r[2] as f64) >= b[0] - radius && (r[1] as f64) <= b[3] + radius && (r[3] as f64) >= b[1] - radius
-        })
-        .map(|a| a.index)
-        .collect();
-    if hits.is_empty() {
-        return None;
-    }
-    // Later indices first: deleting an emptied drawing shifts the ones after it.
-    hits.sort_unstable_by(|a, b| b.cmp(a));
-    let edits = hits.into_iter().map(|index| Edit::EraseInk { page: cx.page, index, path: path.to_vec(), radius }).collect();
-    Some(Edit::Batch { label: "Erase".into(), edits })
-}
-
-/// Where the composer for editing `a` opens: the top-right corner of the comment as drawn on the
-/// displayed page.
-fn edit_anchor(info: &DocInfo, a: &Annotation) -> [f64; 2] {
-    let Some(p) = info.pages.get(a.page) else { return [f64::from(a.rect[2]), f64::from(a.rect[3])] };
-    let r = a.shown_rect(p.rotation);
-    let (u, v) = (p.user_to_view(r[0], r[1]), p.user_to_view(r[2], r[3]));
-    p.view_to_user(u[0].max(v[0]), u[1].min(v[1])).map(f64::from)
-}
-
-/// Whether comment `index` on the composer's page is at least partly inside `viewport`, as drawn.
-fn edited_in_view(cx: &PageCx<'_>, index: usize, viewport: Rect) -> bool {
-    cx.info.annotations.iter().any(|a| a.page == cx.page && a.index == index && viewport.intersects(cx.screen_rect(a)))
-}
-
-fn new_comment(cx: &PageCx<'_>, tool: CommentTool, shape: Shape, contents: String) -> Edit {
-    Edit::AddAnnotation(NewAnnotation { page: cx.page, shape, style: cx.prefs.style(tool), contents, author: cx.prefs.author.clone() })
-}
-
-/// The floating composer card (new note, new text box, edit). Returns the edit to apply.
-pub(crate) fn composer(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, prefs: &CommentPrefs) -> Option<Edit> {
-    let c = view.comments.composer.as_ref()?;
-    let page = c.page;
-    let Some(xf) = view.page_xform(page) else {
-        // Scrolled away: keep the draft until the page is back, and give it the keyboard then.
-        if let Some(c) = view.comments.composer.as_mut() {
-            c.focus = true;
-        }
-        return None;
-    };
-    let cx = PageCx { page, xf: &xf, info, tool: QuickTool::Select, prefs, allowed: true, hidden: false, redact_mark: ([0.89, 0.13, 0.13], 1.0) };
-    let anchor = cx.to_screen(c.at);
-    let viewport = view.viewport_rect();
-    let t = Tokens::get(ctx);
-    let mut post = false;
-    let mut cancel = false;
-    let c = view.comments.composer.as_mut()?;
-    let title = match c.kind {
-        ComposerKind::Note => "Sticky note",
-        ComposerKind::TextBox { .. } => "Text box",
-        ComposerKind::Callout { .. } => "Callout",
-        ComposerKind::Caret { .. } => "Inserted text",
-        ComposerKind::Replace => "Replacement text",
-        ComposerKind::Edit(_) => "Edit comment",
-    };
-    // Its comment scrolled out of the document: keep the draft until it is back, rather than
-    // pushing the card into the window over the mode bar and toolbar (#4021). An edited comment
-    // that is only partly scrolled away keeps its card, at the nearest point inside the document.
-    let mut anchor = anchor;
-    if !viewport.contains(anchor) {
-        let part_visible = matches!(c.kind, ComposerKind::Edit(index) if edited_in_view(&cx, index, viewport));
-        if !part_visible {
-            c.focus = true;
-            return None;
-        }
-        anchor = anchor.clamp(viewport.min, viewport.max);
-    }
-    let pos = pos2(anchor.x + 12.0, anchor.y);
-    let area = egui::Area::new(egui::Id::new(("comment-composer", view.id.0))).order(egui::Order::Foreground).constrain_to(viewport);
-    area.fixed_pos(pos).show(ctx, |ui| {
-        egui::Frame::popup(ui.style()).inner_margin(egui::Margin::same(12)).corner_radius(CornerRadius::same(8)).show(ui, |ui| {
-            ui.set_width(260.0);
-            ui.horizontal(|ui| {
-                ui.label(egui::RichText::new(crate::bidi::visual_auto(&prefs.author)).font(theme::semibold(13.0)));
-                ui.label(egui::RichText::new(tl!(title)).font(theme::regular(11.5)).color(t.text_faint));
-            });
-            ui.add_space(6.0);
-            let hint = match c.kind {
-                ComposerKind::TextBox { .. } | ComposerKind::Callout { .. } => tl!("Type text"),
-                ComposerKind::Caret { .. } => tl!("Text to insert"),
-                ComposerKind::Replace => tl!("Replacement text"),
-                _ => tl!("Add a comment"),
-            };
-            let edit =
-                ui.add(egui::TextEdit::multiline(&mut c.text).hint_text(hint).desired_rows(3).desired_width(f32::INFINITY).id_salt("composer-text"));
-            if c.focus {
-                edit.request_focus();
-                c.focus = false;
-            }
-            let enter = submit_key(ui, &edit, false);
-            if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                cancel = true;
-            }
-            ui.add_space(8.0);
-            ui.horizontal(|ui| {
-                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                    let can_post = !c.text.trim().is_empty() || matches!(c.kind, ComposerKind::Edit(_));
-                    if ui
-                        .add_enabled(
-                            can_post,
-                            egui::Button::new(egui::RichText::new(tl!("Post")).color(Color32::WHITE)).fill(t.accent).corner_radius(14),
-                        )
-                        .clicked()
-                        || (enter && can_post)
-                    {
-                        post = true;
-                    }
-                    if ui.add(egui::Button::new(tl!("Cancel")).corner_radius(14)).clicked() {
-                        cancel = true;
-                    }
-                });
-            });
-        });
-    });
-    if cancel {
-        view.comments.composer = None;
-        return None;
-    }
-    if !post {
-        return None;
-    }
-    let c = view.comments.composer.take()?;
-    let text = c.text.trim_end().to_string();
-    match c.kind {
-        ComposerKind::Edit(index) => Some(Edit::SetAnnotationContents { page, index, text }),
-        ComposerKind::Note => {
-            view.comments.tool_done = true;
-            Some(new_comment(&cx, CommentTool::Note, Shape::Note { at: c.at, icon: NoteIcon::Comment }, text))
-        }
-        ComposerKind::TextBox { size } => {
-            view.comments.tool_done = true;
-            let rotation = page_rotation(info, page);
-            let border = prefs.style(CommentTool::TextBox).width;
-            let rect = match (size, info.pages.get(page)) {
-                (Some(size), Some(p)) => drawn_text_box_rect(p, c.at, size, &text, 12.0, border),
-                _ => text_box_rect(c.at, &text, 12.0, rotation),
-            };
-            Some(new_comment(&cx, CommentTool::TextBox, Shape::TextBox { rect, font_size: 12.0 }, text))
-        }
-        ComposerKind::Callout { point } => {
-            view.comments.tool_done = true;
-            // A callout's leader and box stay in user-space axes (its appearance isn't turned).
-            let rect = text_box_rect(c.at, &text, 10.0, 0);
-            let side = if point[0] < rect[0] {
-                rect[0]
-            } else if point[0] > rect[2] {
-                rect[2]
-            } else {
-                (rect[0] + rect[2]) / 2.0
-            };
-            let knee = [(point[0] + side) / 2.0, (rect[1] + rect[3]) / 2.0];
-            Some(new_comment(&cx, CommentTool::Callout, Shape::Callout { rect, knee, point, font_size: 10.0, ending: LineEnding::OpenArrow }, text))
-        }
-        ComposerKind::Replace => {
-            view.comments.tool_done = true;
-            let quads = view.comments.replace.take()?;
-            Some(Edit::ReplaceText {
-                page,
-                quads,
-                text,
-                author: prefs.author.clone(),
-                strike: prefs.style(CommentTool::ReplaceText),
-                caret: prefs.style(CommentTool::Caret),
-            })
-        }
-        ComposerKind::Caret { size } => {
-            view.comments.tool_done = true;
-            let [x, y] = c.at;
-            let half = size / 2.0;
-            Some(new_comment(&cx, CommentTool::Caret, Shape::Caret { rect: [x - half, y - size, x + half, y] }, text))
-        }
-    }
-}
-
-/// Submit only from the focused comment editor. Match each key event's modifiers exactly,
-/// so Shift+Enter stays a newline and another editor cannot submit this draft. Replies also
-/// keep their existing unmodified Enter-to-post behavior.
-pub(crate) fn submit_key(ui: &mut egui::Ui, field: &egui::Response, plain_enter: bool) -> bool {
-    field.has_focus()
-        && ui.input_mut(|input| {
-            let mut submit = false;
-            input.events.retain(|event| {
-                let matched = matches!(event,
-                    egui::Event::Key { key: egui::Key::Enter, pressed: true, modifiers, .. }
-                        if modifiers.matches_exact(egui::Modifiers::CTRL)
-                            || modifiers.matches_exact(egui::Modifiers::COMMAND)
-                            || plain_enter && modifiers.matches_exact(egui::Modifiers::NONE)
-                );
-                submit |= matched;
-                !matched
-            });
-            submit
-        })
-}
-
-/// The side of the caret's box, in user space units, away from text.
-const CARET_SIZE: f64 = 8.0;
-
-/// [`caret_snap`] in the page's user space: the caret's tip and the side of its box.
-///
-/// The caret is drawn upright in user space, so it only snaps on an unrotated page, where up on
-/// the page is up on screen; its size goes through the same mapping as the tip, so a page with
-/// `/UserUnit` gets a caret of the same size relative to its text.
-pub(crate) fn snapped_caret(page: &PageInfo, text: &PageText, vx: f32, vy: f32) -> Option<([f64; 2], f64)> {
-    if !page.rotation.is_multiple_of(360) {
-        return None;
-    }
-    let ([x, y], size) = caret_snap(text, vx, vy)?;
-    let tip = page.view_to_user(x, y);
-    let foot = page.view_to_user(x, y + size);
-    let side = f64::from(tip[1] - foot[1]);
-    (side.is_finite() && side > 0.0).then(|| ([f64::from(tip[0]), f64::from(tip[1])], side))
-}
-
-/// Insert text: where a click puts the caret's tip (view space) and how tall the caret is.
-///
-/// On upright, horizontal text the tip snaps to the nearer edge of the character under (or
-/// next to) the click, on the line's baseline, and the caret's side is half the text's em size
-/// (clamped to 4–36 view-space points; [`snapped_caret`] maps it to user space): the
-/// proposal marks an insertion point in the text, as a proofreader's caret does. Elsewhere
-/// (away from text, or on turned, sloped or vertical text) it returns `None` and the caret stays
-/// at the click. A ligature is one glyph, so the caret goes before or after it, never inside.
-pub(crate) fn caret_snap(text: &PageText, vx: f32, vy: f32) -> Option<([f32; 2], f32)> {
-    let g = text.glyphs.get(text.nearest(vx, vy)?)?;
-    if !(g.direction[0] > 0.0 && g.direction[1].abs() <= 0.02) {
-        return None;
-    }
-    // Close enough to belong to this glyph: within half an em of its box.
-    let [x0, y0, x1, y1] = g.rect;
-    let slack = (y1 - y0) / 2.0;
-    if !(slack.is_finite() && slack > 0.0) || vx < x0 - slack || vx > x1 + slack || vy < y0 - slack || vy > y1 + slack {
-        return None;
-    }
-    // The em box runs from 0.2 em below the baseline to 0.8 em above it (`pdfcraft_render`'s
-    // text extraction); `quad` is its bottom edge in the writing direction, then its top edge
-    // backwards. Take the side of the box the click is nearer to: its foot and head.
-    let [q0, q1, q2, q3] = g.quad;
-    let (foot, head) = if vx < (q0[0] + q1[0]) / 2.0 { (q0, q3) } else { (q1, q2) };
-    let em = (head[0] - foot[0]).hypot(head[1] - foot[1]);
-    if !(em.is_finite() && em > 0.0) {
-        return None;
-    }
-    let baseline = [foot[0] + 0.2 * (head[0] - foot[0]), foot[1] + 0.2 * (head[1] - foot[1])];
-    Some((baseline, (em / 2.0).clamp(4.0, 36.0)))
-}
-
-/// A text box sized to its text (at most 300 pt wide), hanging from its top-left corner.
-/// The box for `text` at `size` with its displayed top-left corner at `at`, on a page turned by
-/// `rotation` (its `/Rotate`): on a quarter-turned page it is taller than wide in user space.
-pub fn text_box_rect(at: [f64; 2], text: &str, size: f64, rotation: i64) -> [f64; 4] {
-    use pdfcraft_engine::annot_text::{text_width, wrap};
-    let pad = 2.0;
-    let longest = text.lines().map(|l| text_width(l, size)).fold(0.0, f64::max);
-    let w = (longest + 2.0 * pad + 4.0).clamp(40.0, 300.0);
-    let lines = wrap(text, size, w - 2.0 * pad).len().max(1);
-    let h = lines as f64 * size * 1.2 + 2.0 * pad + 2.0;
-    pdfcraft_engine::text_box_at(rotation, at, w, h).unwrap_or([at[0], at[1] - h, at[0] + w, at[1]])
-}
-
-/// The box dragged between user-space points `a` and `b`: its displayed top-left corner (user
-/// space) and its displayed width and height. Measured in the page's view space, so the view's
-/// own rotation and zoom (View > Rotate View) do not turn or scale it.
-fn drawn_box(page: &PageInfo, a: [f64; 2], b: [f64; 2]) -> ([f64; 2], [f64; 2]) {
-    let (a, b) = (page.user_to_view(a[0] as f32, a[1] as f32), page.user_to_view(b[0] as f32, b[1] as f32));
-    let at = page.view_to_user(a[0].min(b[0]), a[1].min(b[1]));
-    ([f64::from(at[0]), f64::from(at[1])], [f64::from((a[0] - b[0]).abs()), f64::from((a[1] - b[1]).abs())])
-}
-
-/// A text box dragged out `size` (displayed width and height) from its displayed top-left corner
-/// `at`, with a border `border` wide: the text wraps to its width inside the border, as its
-/// appearance lays it out. When the text needs more lines the box grows down, and moves up to stay
-/// on the page; text that cannot fit even so keeps the drawn height and is clipped.
-pub fn drawn_text_box_rect(page: &PageInfo, at: [f64; 2], size: [f64; 2], text: &str, font_size: f64, border: f64) -> [f64; 4] {
-    use pdfcraft_engine::annot_text::wrap;
-    let pad = 2.0 + border.max(0.0);
-    let [w, drawn] = size;
-    let lines = wrap(text, font_size, (w - 2.0 * pad).max(1.0)).len().max(1);
-    let needed = lines as f64 * font_size * 1.2 + 2.0 * pad + 2.0;
-    let [vx, vy] = page.user_to_view(at[0] as f32, at[1] as f32).map(f64::from);
-    let bottom = f64::from(page.height);
-    let (top, h) = if needed <= drawn || needed > bottom { (vy, drawn) } else { (vy.min(bottom - needed).max(0.0), needed) };
-    let at = page.view_to_user(vx as f32, top as f32).map(f64::from);
-    pdfcraft_engine::text_box_at(i64::from(page.rotation), at, w, h).unwrap_or([at[0], at[1] - h, at[0] + w, at[1]])
-}
-
-/// The `/Rotate` of `page` (0 when it is unknown).
-pub(crate) fn page_rotation(info: &DocInfo, page: usize) -> i64 {
-    info.pages.get(page).map_or(0, |p| i64::from(p.rotation))
-}
-
-/// Delete / Escape handling for comments (only while no text field has focus).
-pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView, tool: &mut QuickTool, allowed: bool) {
-    if !ctx.input(|i| i.pointer.any_down()) {
-        view.comments.cancelled_drag = false;
-    }
-    if ctx.egui_wants_keyboard_input() {
-        return;
-    }
-    let cv = &mut view.comments;
-    if ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
-        // One step back per press: cancel the gesture, then deselect, then drop the tool.
-        let cancelled = cv.gesture.take().is_some() || cv.selected.take().is_some();
-        if !cancelled && matches!(tool, QuickTool::Comment(_)) {
-            *tool = QuickTool::Select;
-        }
-    }
-    if allowed
-        && let Some((page, index)) = cv.selected
-        && ctx.input(|i| i.key_pressed(egui::Key::Delete) || i.key_pressed(egui::Key::Backspace))
-    {
-        cv.selected = None;
-        view.pending_edit = Some(Edit::DeleteAnnotation { page, index });
-    }
-}
-
-/// The arrow keys move the selected comment a screen pixel; with ⌘/Ctrl or Shift, ten. Up is up
-/// on screen whatever the zoom, the page's rotation and the view's; the keys are taken before
-/// the view scrolls or turns the page with them. Each press is one undo step. Text markup stays
-/// with its text, and a locked comment where it is.
-pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) {
-    if ctx.egui_wants_keyboard_input() || view.pending_edit.is_some() {
-        return;
-    }
-    let cv = &view.comments;
-    if cv.gesture.is_some() || cv.composer.is_some() {
-        return;
-    }
-    let Some((page, index)) = cv.selected else { return };
-    let movable =
-        info.annotations.iter().any(|a| a.page == page && a.index == index && a.in_reply_to.is_none() && !is_markup(&a.subtype) && !a.locked);
-    let (Some(xf), Some(p)) = (view.page_xform(page), info.pages.get(page)) else { return };
-    if !movable {
-        return;
-    }
-    use egui::{Key, Modifiers};
-    let mut step = egui::Vec2::ZERO;
-    ctx.input_mut(|i| {
-        for (key, direction) in
-            [(Key::ArrowLeft, vec2(-1.0, 0.0)), (Key::ArrowRight, vec2(1.0, 0.0)), (Key::ArrowUp, vec2(0.0, -1.0)), (Key::ArrowDown, vec2(0.0, 1.0))]
-        {
-            // The modified patterns first: a plain one also matches a Shift press.
-            if i.consume_key(Modifiers::COMMAND, key) || i.consume_key(Modifiers::SHIFT, key) {
-                step += direction * 10.0;
-            } else if i.consume_key(Modifiers::NONE, key) {
-                step += direction;
-            }
-        }
-    });
-    if step == egui::Vec2::ZERO {
-        return;
-    }
-    // The step on screen, in user space: from the page's centre to `step` pixels away.
-    let user = |s: Pos2| {
-        let (vx, vy) = xf.screen_to_view(s);
-        let u = p.view_to_user(vx, vy);
-        [f64::from(u[0]), f64::from(u[1])]
-    };
-    let (a, b) = (user(xf.rect.center()), user(xf.rect.center() + step));
-    let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
-    if dx.is_finite() && dy.is_finite() && (dx != 0.0 || dy != 0.0) {
-        view.pending_edit = Some(Edit::MoveAnnotation { page, index, dx, dy });
-    }
-}
-
-/// Save attachment… and, for a PDF, Open in a new tab, first in a file attachment comment's
-/// menus as in the Attachments panel: the comment is where the reader finds its file. Reading
-/// the file changes nothing, so a read-only document offers them too.
-pub(crate) fn attachment_items(ui: &mut egui::Ui, view: &mut DocView, info: &DocInfo, a: &Annotation) {
-    let source = pdfcraft_render::AttachmentSource::Annotation { page: a.page, index: a.index };
-    let Some(file) = info.attachments.iter().find(|f| f.source == source) else { return };
-    if ui.button(tl!("Save attachment…")).clicked() {
-        view.comments.attachment_request = Some((a.page, a.index, false));
-        ui.close();
-    }
-    if file.name.to_lowercase().ends_with(".pdf") && ui.button(tl!("Open in a new tab")).clicked() {
-        view.comments.attachment_request = Some((a.page, a.index, true));
-        ui.close();
-    }
-    ui.separator();
-}
-
-/// Items of the canvas context menu for the selected comment (or the page).
-/// `can_modify`: the document's pages may change (Flatten comments draws into them).
-pub(crate) fn context_menu(
-    ui: &mut egui::Ui,
-    view: &mut DocView,
-    info: &DocInfo,
-    prefs: &CommentPrefs,
-    allowed: bool,
-    can_modify: bool,
-) -> Option<CanvasAction> {
-    let mut action = None;
-    let selected = view.comments.selected.and_then(|(p, i)| info.annotations.iter().find(|a| a.page == p && a.index == i && a.in_reply_to.is_none()));
-    match selected {
-        Some(a) => {
-            let (page, index) = (a.page, a.index);
-            attachment_items(ui, view, info, a);
-            if ui.add_enabled(allowed, egui::Button::new(tl!("Edit text…"))).clicked() {
-                view.comments.composer = Some(Composer {
-                    page,
-                    at: edit_anchor(info, a),
-                    kind: ComposerKind::Edit(index),
-                    text: a.contents.clone().unwrap_or_default(),
-                    focus: true,
-                });
-                ui.close();
-            }
-            if ui.add_enabled(allowed, egui::Button::new(tl!("Reply"))).clicked() {
-                view.comments.reveal = true;
-                action = Some(CanvasAction::OpenComments);
-                ui.close();
-            }
-            ui.add_enabled_ui(allowed, |ui| {
-                ui.menu_button(tl!("Set status"), |ui| {
-                    for s in [ReviewState::None, ReviewState::Accepted, ReviewState::Cancelled, ReviewState::Completed, ReviewState::Rejected] {
-                        if ui.button(tl!(s.name())).clicked() {
-                            action =
-                                Some(CanvasAction::Edit(Box::new(Edit::SetAnnotationStatus { page, index, state: s, author: prefs.author.clone() })));
-                            ui.close();
-                        }
-                    }
-                });
-                let keep_open = egui::containers::menu::MenuConfig::new().close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside);
-                let _ = egui::containers::menu::SubMenuButton::new(tl!("Colour")).config(keep_open).ui(ui, |ui| {
-                    if let Some(c) = swatch_grid(ui, a.color.map(|c| c.map(f64::from))) {
-                        action = Some(CanvasAction::Edit(Box::new(Edit::StyleAnnotation {
-                            page,
-                            index,
-                            color: Some(c),
-                            opacity: None,
-                            width: None,
-                            endings: None,
-                        })));
-                        ui.close();
-                    }
-                });
-            });
-            let thread: Vec<&pdfcraft_render::Annotation> = info.annotations.iter().filter(|r| a.name.is_some() && r.in_reply_to == a.name).collect();
-            let marked = crate::comments_panel::is_marked(&thread);
-            if ui.add_enabled(allowed, egui::Button::new(tl!(if marked { "Remove checkmark" } else { "Mark with checkmark" }))).clicked() {
-                action = Some(CanvasAction::Edit(Box::new(Edit::MarkAnnotation { page, index, marked: !marked, author: prefs.author.clone() })));
-                ui.close();
-            }
-            if ui.button(tl!("Copy text")).clicked() {
-                ui.ctx().copy_text(a.contents.clone().unwrap_or_default());
-                ui.close();
-            }
-            ui.separator();
-            if ui.add_enabled(allowed && !a.locked, egui::Button::new(tl!("Delete"))).clicked() {
-                view.comments.selected = None;
-                action = Some(CanvasAction::Edit(Box::new(Edit::DeleteAnnotation { page, index })));
-                ui.close();
-            }
-            if ui.add_enabled(allowed, egui::Button::new(tl!("Properties…"))).clicked() {
-                action = Some(CanvasAction::Properties(page, index));
-                ui.close();
-            }
-            if ui.add_enabled(tool_for(a).is_some(), egui::Button::new(tl!("Make Current Properties Default"))).clicked() {
-                view.comments.default_request = Some((page, index));
-                ui.close();
-            }
-        }
-        None => {
-            if let Some((page, at)) = view.comments.context_at
-                && ui.add_enabled(allowed, egui::Button::new(tl!("Add a sticky note here"))).clicked()
-            {
-                view.comments.composer = Some(Composer { page, at, kind: ComposerKind::Note, text: String::new(), focus: true });
-                ui.close();
-            }
-            if ui.button(tl!("Comments panel")).clicked() {
-                action = Some(CanvasAction::OpenComments);
-                ui.close();
-            }
-        }
-    }
-    // Every comment of the document into its pages, as Comment ▸ Flatten comments does: signed
-    // or reviewed pages whose comments should no longer move.
-    if !info.annotations.is_empty() {
-        ui.separator();
-        if ui.add_enabled(can_modify, egui::Button::new(tl!("Flatten comments"))).clicked() {
-            view.comments.selected = None;
-            action = Some(CanvasAction::Edit(Box::new(Edit::Flatten { comments: true, fields: false })));
-            ui.close();
-        }
-    }
-    action
-}
-
-/// What the canvas asks the app to do.
-#[derive(Clone, Debug, PartialEq)]
-pub enum CanvasAction {
-    Edit(Box<Edit>),
-    OpenComments,
-    /// Comment Properties for (page, index).
-    Properties(usize, usize),
-    /// Copy Image: image (page, index in `page_images`) to the clipboard.
-    CopyImage(usize, usize),
-    /// Copy Image in Original Format: the same image as a file (JPEG as stored, else PNG).
-    CopyImageFile(usize, usize),
-}
-
-/// How many custom colours the "Recent colours" row keeps.
-const RECENT_CUSTOM: usize = 5;
-
-fn recent_custom_id() -> egui::Id {
-    egui::Id::new("pdfcraft-recent-custom-colours")
-}
-
-/// Custom colours picked with "Other colour…" this session, newest first (#1193).
-pub fn recent_custom_colours(ctx: &egui::Context) -> Vec<Rgb> {
-    ctx.data(|d| d.get_temp::<Vec<Rgb>>(recent_custom_id())).unwrap_or_default()
-}
-
-/// Put `c` first in the recent custom colours (once, at most [`RECENT_CUSTOM`]). Colours that are
-/// already swatches are not repeated there.
-pub fn remember_custom_colour(ctx: &egui::Context, c: Rgb) {
-    if !c.iter().all(|v| v.is_finite()) || SWATCHES.iter().any(|(_, s)| same_colour(s, &c)) {
-        return;
-    }
-    let c = c.map(|v| v.clamp(0.0, 1.0));
-    ctx.data_mut(|d| {
-        let recent = d.get_temp_mut_or_default::<Vec<Rgb>>(recent_custom_id());
-        recent.retain(|r| !same_colour(r, &c));
-        recent.insert(0, c);
-        recent.truncate(RECENT_CUSTOM);
-    });
-}
-
-fn same_colour(a: &Rgb, b: &Rgb) -> bool {
-    a.iter().zip(b).all(|(x, y)| (x - y).abs() < 0.02)
-}
-
-fn rgb_of(c: Color32) -> Rgb {
-    [c.r(), c.g(), c.b()].map(|v| f64::from(v) / 255.0)
-}
-
-/// One round swatch; `on` rings it as the current colour.
-fn swatch(ui: &mut egui::Ui, c: Rgb, on: bool, tooltip: &str) -> egui::Response {
-    let (r, resp) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tooltip));
-    ui.painter().circle_filled(r.center(), 9.0, color32(c));
-    ui.painter().circle_stroke(r.center(), 9.0, Stroke::new(1.0, Color32::from_black_alpha(40)));
-    if on || resp.hovered() {
-        ui.painter().circle_stroke(r.center(), 11.0, Stroke::new(1.5, SELECT_BLUE));
-    }
-    resp.on_hover_text(tooltip)
-}
-
-/// The "+" swatch that opens "Other colour…": a ring with a plus, the size of a swatch.
-fn other_colour_swatch(ui: &mut egui::Ui, open: bool) -> egui::Response {
-    let (r, resp) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::click());
-    let ink = ui.visuals().widgets.inactive.fg_stroke.color;
-    ui.painter().circle_stroke(r.center(), 9.0, Stroke::new(1.0, ink.gamma_multiply(0.6)));
-    let c = r.center();
-    for d in [vec2(4.5, 0.0), vec2(0.0, 4.5)] {
-        ui.painter().line_segment([c - d, c + d], Stroke::new(1.5, ink));
-    }
-    if open || resp.hovered() {
-        ui.painter().circle_stroke(c, 11.0, Stroke::new(1.5, SELECT_BLUE));
-    }
-    let label = tl!("Other colour…");
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, open, label));
-    resp.on_hover_text(label)
-}
-
-/// A grid of colour swatches with a "+" swatch for "Other colour…" (a full picker, as Acrobat's
-/// quick colours offer) and, once used, the recent custom colours; returns the colour chosen.
-/// The "+" sits in the first row, so the grid is no taller than before until the picker opens.
-pub fn swatch_grid(ui: &mut egui::Ui, current: Option<Rgb>) -> Option<Rgb> {
-    let mut picked = None;
-    let on = |c: &Rgb| current.is_some_and(|cur| same_colour(&cur, c));
-    // Keyed on this grid's own place in the parent, so two grids in one dialog open their
-    // pickers separately.
-    let base = ui.next_auto_id();
-    ui.skip_ahead_auto_ids(1);
-    let open_id = base.with("other-colour");
-    let value_id = open_id.with("value");
-    let mut open = ui.data(|d| d.get_temp::<bool>(open_id)).unwrap_or(false);
-    egui::Grid::new(base.with("swatches")).spacing(vec2(6.0, 6.0)).show(ui, |ui| {
-        for (i, (name, c)) in SWATCHES.iter().enumerate() {
-            if swatch(ui, *c, on(c), tl!(name)).clicked() {
-                picked = Some(*c);
-            }
-            if i == 4 && other_colour_swatch(ui, open).clicked() {
-                open = !open;
-                // Start from the current colour each time the picker opens.
-                ui.data_mut(|d| d.insert_temp(value_id, current.map_or(Color32::BLACK, color32)));
-            }
-            if i % 5 == 4 {
-                ui.end_row();
-            }
-        }
-    });
-    let recent = recent_custom_colours(ui.ctx());
-    if !recent.is_empty() {
-        ui.label(egui::RichText::new(tl!("Recent colours")).small());
-        ui.horizontal(|ui| {
-            ui.spacing_mut().item_spacing.x = 6.0;
-            for c in &recent {
-                let [r, g, b, _] = color32(*c).to_array();
-                if swatch(ui, *c, on(c), &format!("#{r:02X}{g:02X}{b:02X}")).clicked() {
-                    picked = Some(*c);
-                }
-            }
-        });
-    }
-    if open && picked.is_none() {
-        let mut value = ui.data(|d| d.get_temp::<Color32>(value_id)).unwrap_or_else(|| current.map_or(Color32::BLACK, color32));
-        egui::widgets::color_picker::color_picker_color32(ui, &mut value, egui::widgets::color_picker::Alpha::Opaque);
-        ui.data_mut(|d| d.insert_temp(value_id, value));
-        // Dragging in the picker previews nothing; Apply commits once (one undo step).
-        if ui.button(tl!("Apply")).clicked() {
-            let c = rgb_of(value);
-            remember_custom_colour(ui.ctx(), c);
-            picked = Some(c);
-        }
-    }
-    if picked.is_some() {
-        open = false;
-    }
-    ui.data_mut(|d| d.insert_temp(open_id, open));
-    picked
-}
-
-/// "No fill" and the colour swatches; returns the choice clicked (`Some(None)`: no fill).
-pub fn fill_picker(ui: &mut egui::Ui, current: Option<Rgb>) -> Option<Option<Rgb>> {
-    let mut picked = None;
-    ui.push_id("fill-picker", |ui| {
-        ui.vertical(|ui| {
-            if ui.selectable_label(current.is_none(), tl!("No fill")).clicked() {
-                picked = Some(None);
-            }
-            if let Some(c) = swatch_grid(ui, current) {
-                picked = Some(Some(c));
-            }
-        });
-    });
-    picked
-}
-
-/// The comment tools' extra quick-bar controls: pin, colour, fill, opacity and thickness.
-pub(crate) fn quick_bar_controls(ui: &mut egui::Ui, tool: CommentTool, prefs: &mut CommentPrefs) -> Option<Rgb> {
-    let style = prefs.style(tool);
-    let mut selected_color = None;
-    if icons::button(ui, "pin", 32.0, prefs.pinned, if prefs.pinned { tl!("Keep tool selected: on") } else { tl!("Keep tool selected") }).clicked() {
-        prefs.pinned = !prefs.pinned;
-    }
-    let (r, resp) = ui.allocate_exact_size(vec2(32.0, 32.0), Sense::click());
-    ui.painter().circle_filled(r.center(), 9.0, color32(style.color));
-    ui.painter().circle_stroke(r.center(), 9.0, Stroke::new(1.0, Color32::from_black_alpha(50)));
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Colour")));
-    let resp = resp.on_hover_text(tl!("Colour"));
-    egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
-        if let Some(c) = swatch_grid(ui, Some(style.color)) {
-            prefs.set_color(tool, c);
-            selected_color = Some(c);
-            ui.close();
-        }
-    });
-    if tool.has_fill() {
-        let resp = fill_button(ui, style.fill);
-        egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
-            ui.label(egui::RichText::new(tl!("Fill colour")).font(theme::semibold(12.0)));
-            if let Some(f) = fill_picker(ui, style.fill) {
-                prefs.set_fill(tool, f);
-                ui.close();
-            }
-        });
-    }
-    let resp = icons::button(ui, "blend", 32.0, false, tl!("Opacity"));
-    egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
-        ui.set_min_width(180.0);
-        let mut percent = (style.opacity * 100.0).round();
-        ui.label(egui::RichText::new(tl!("Opacity")).font(theme::semibold(12.0)));
-        if ui.add(egui::Slider::new(&mut percent, 10.0..=100.0).step_by(5.0).suffix(" %")).changed() {
-            prefs.set_opacity(tool, percent / 100.0);
-        }
-    });
-    if tool.has_width() {
-        let resp = icons::button(ui, "sliders-horizontal", 32.0, false, tl!("Line thickness"));
-        egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
-            ui.set_min_width(180.0);
-            let mut w = style.width;
-            ui.label(egui::RichText::new(tl!("Line thickness")).font(theme::semibold(12.0)));
-            if ui.add(egui::Slider::new(&mut w, tool.min_width()..=12.0).step_by(0.5).suffix(" pt")).changed() {
-                prefs.set_width(tool, w);
-            }
-        });
-    }
-    selected_color
-}
-
-/// The quick bar's fill button: a filled square in the fill colour, or a crossed-out outline
-/// for no fill.
-fn fill_button(ui: &mut egui::Ui, fill: Option<Rgb>) -> egui::Response {
-    let (r, resp) = ui.allocate_exact_size(vec2(32.0, 32.0), Sense::click());
-    let sq = Rect::from_center_size(r.center(), vec2(16.0, 16.0));
-    let edge = Stroke::new(1.0, Color32::from_black_alpha(90));
-    match fill {
-        Some(c) => {
-            ui.painter().rect_filled(sq, 2.0, color32(c));
-        }
-        None => {
-            ui.painter().line_segment([sq.left_bottom(), sq.right_top()], Stroke::new(1.5, Color32::from_rgb(0xD3, 0x2F, 0x2F)));
-        }
-    }
-    ui.painter().rect_stroke(sq, 2.0, edge, egui::StrokeKind::Inside);
-    if resp.hovered() {
-        ui.painter().rect_stroke(r.shrink(2.0), 6.0, Stroke::new(1.0, Color32::from_black_alpha(40)), egui::StrokeKind::Inside);
-    }
-    let label = match fill {
-        Some(_) => tl!("Fill colour"),
-        None => tl!("Fill colour: none"),
-    };
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label));
-    resp.on_hover_text(label)
-}
-
-/// Status badge icon and label for a review state name.
-pub fn status_badge(state: &str) -> Option<(&'static str, &'static str, Color32)> {
-    match state {
-        "Accepted" => Some(("thumbs-up", "Accepted", Color32::from_rgb(0x2D, 0x9D, 0x5B))),
-        "Rejected" => Some(("thumbs-down", "Rejected", Color32::from_rgb(0xD3, 0x2F, 0x2F))),
-        "Cancelled" => Some(("circle-x", "Cancelled", Color32::from_rgb(0x8E, 0x8E, 0x8E))),
-        "Completed" => Some(("check", "Completed", Color32::from_rgb(0x2D, 0x9D, 0x5B))),
-        _ => None,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A selected line is drawn where it is going: moved by its body (both ends follow the
-    /// pointer), with an end dragged (that end alone), and as released until the page is drawn.
-    #[test]
-    fn a_moved_or_reshaped_line_is_drawn_at_its_new_points() {
-        let line = [[10.0, 10.0], [50.0, 10.0]];
-        let to_user = |p: Pos2| [f64::from(p.x), f64::from(p.y)];
-        let moving = Gesture::Move { page: 0, index: 3, from: pos2(20.0, 10.0) };
-        let at = Some(pos2(25.0, 30.0));
-        assert_eq!(changing_points(Some(&moving), None, (0, 3), &line, to_user, at, false), Some(vec![[15.0, 30.0], [55.0, 30.0]]));
-        assert_eq!(changing_points(Some(&moving), None, (0, 4), &line, to_user, at, false), None, "another comment's move");
-        let released = Edit::MoveAnnotation { page: 0, index: 3, dx: 5.0, dy: 20.0 };
-        assert_eq!(changing_points(None, Some(&released), (0, 3), &line, to_user, None, false), Some(vec![[15.0, 30.0], [55.0, 30.0]]));
-        let dragging = Gesture::Reshape { page: 0, index: 3, point: 1, points: line.to_vec() };
-        let to = Some(pos2(60.0, 10.0));
-        assert_eq!(changing_points(Some(&dragging), None, (0, 3), &line, to_user, to, false), Some(vec![[10.0, 10.0], [60.0, 10.0]]));
-        assert_eq!(changing_points(None, None, (0, 3), &line, to_user, to, false), None, "not changing");
-    }
-
-    /// A sticky note on a page turned a quarter is drawn upright beside its `/Rect`: an edit
-    /// composer stays open while the drawn note is partly in view, even with `/Rect` out of it.
-    #[test]
-    fn an_upright_note_on_a_turned_page_is_in_view_where_it_is_drawn() {
-        let note = |no_rotate| Annotation {
-            page: 0,
-            subtype: "Text".into(),
-            author: None,
-            contents: None,
-            modified: None,
-            name: None,
-            in_reply_to: None,
-            rect: [40.0, 20.0, 70.0, 40.0],
-            color: None,
-            index: 0,
-            state: None,
-            quads: Vec::new(),
-            locked: false,
-            intent: None,
-            fill_sign: false,
-            no_rotate,
-            points: Vec::new(),
-        };
-        let page = PageInfo { width: 140.0, height: 200.0, label: String::new(), crop: [0.0, 0.0, 200.0, 140.0], rotation: 90 };
-        let xf = PageXform { rect: Rect::from_min_size(Pos2::ZERO, vec2(140.0, 200.0)), rot: 0, pw: 140.0, ph: 200.0 };
-        let prefs = CommentPrefs::default();
-        // Screen x is user y here: `/Rect` spans x 20..40, the upright note x 40..70.
-        let viewport = Rect::from_min_max(pos2(50.0, 0.0), pos2(140.0, 200.0));
-        for (no_rotate, in_view) in [(true, true), (false, false)] {
-            let info = DocInfo { pages: vec![page.clone()], annotations: vec![note(no_rotate)], ..Default::default() };
-            let cx = PageCx {
-                page: 0,
-                xf: &xf,
-                info: &info,
-                tool: QuickTool::Select,
-                prefs: &prefs,
-                allowed: true,
-                hidden: false,
-                redact_mark: ([0.0; 3], 1.0),
-            };
-            assert_eq!(edited_in_view(&cx, 0, viewport), in_view, "no_rotate: {no_rotate}");
-        }
-    }
-
-    use pdfcraft_render::TextGlyph;
-
-    /// One glyph per character, `w` points wide, on a line of `em`-point text whose baseline is at `y`, drawn
-    /// along `direction` (a unit vector in view space, y down).
-    fn line(chars: &str, x: f32, y: f32, w: f32, em: f32, direction: [f32; 2]) -> PageText {
-        let [dx, dy] = direction;
-        // "Up" for the glyph: its writing direction turned a quarter counterclockwise (y down).
-        let [ux, uy] = [dy, -dx];
-        let glyphs = chars
-            .chars()
-            .enumerate()
-            .map(|(i, c)| {
-                let start = [x + dx * w * i as f32, y + dy * w * i as f32];
-                let at = |along: f32, up: f32| [start[0] + dx * along + ux * up, start[1] + dy * along + uy * up];
-                let quad = [at(0.0, -0.2 * em), at(w, -0.2 * em), at(w, 0.8 * em), at(0.0, 0.8 * em)];
-                let xs = quad.map(|p| p[0]);
-                let ys = quad.map(|p| p[1]);
-                let rect = [
-                    xs.into_iter().fold(f32::INFINITY, f32::min),
-                    ys.into_iter().fold(f32::INFINITY, f32::min),
-                    xs.into_iter().fold(f32::NEG_INFINITY, f32::max),
-                    ys.into_iter().fold(f32::NEG_INFINITY, f32::max),
-                ];
-                TextGlyph { text: c.to_string(), rect, quad, direction }
-            })
-            .collect::<Vec<_>>();
-        let n = glyphs.len();
-        PageText { glyphs, line_of: vec![0; n], space_before: vec![false; n] }
-    }
-
-    fn near(a: Option<([f32; 2], f32)>, b: ([f32; 2], f32)) -> bool {
-        a.is_some_and(|([x, y], s)| (x - b.0[0]).abs() < 1e-3 && (y - b.0[1]).abs() < 1e-3 && (s - b.1).abs() < 1e-3)
-    }
-
-    #[test]
-    fn the_caret_snaps_to_the_nearer_edge_on_the_baseline() {
-        let text = line("abcd", 20.0, 100.0, 10.0, 14.0, [1.0, 0.0]);
-        // "c" spans 40..50: its left half snaps before it, its right half after it.
-        assert!(near(caret_snap(&text, 43.0, 95.0), ([40.0, 100.0], 7.0)));
-        assert!(near(caret_snap(&text, 47.0, 92.0), ([50.0, 100.0], 7.0)));
-        // Just past the last character, on the line: after it.
-        assert!(near(caret_snap(&text, 63.0, 99.0), ([60.0, 100.0], 7.0)));
-    }
-
-    #[test]
-    fn the_snapped_caret_follows_the_page_into_user_space() {
-        let text = line("abcd", 20.0, 100.0, 10.0, 14.0, [1.0, 0.0]);
-        let page = |rotation, user_unit: f32| PageInfo {
-            width: 300.0 * user_unit,
-            height: 200.0 * user_unit,
-            label: "1".into(),
-            crop: [0.0, 0.0, 300.0, 200.0],
-            rotation,
-        };
-        // An unrotated page: view y = 100 is user y = 100 (y up from the bottom of a 200 pt page).
-        let (tip, side) = snapped_caret(&page(0, 1.0), &text, 43.0, 95.0).expect("snaps");
-        assert!((tip[0] - 40.0).abs() < 1e-3 && (tip[1] - 100.0).abs() < 1e-3 && (side - 7.0).abs() < 1e-3);
-        // /UserUnit 2: the view is twice as large, so the same text is half as many user units.
-        let doubled = line("abcd", 40.0, 200.0, 20.0, 28.0, [1.0, 0.0]);
-        let (tip, side) = snapped_caret(&page(0, 2.0), &doubled, 86.0, 190.0).expect("snaps");
-        assert!((tip[0] - 40.0).abs() < 1e-3 && (tip[1] - 100.0).abs() < 1e-3 && (side - 7.0).abs() < 1e-3, "{tip:?} {side}");
-        // A rotated page: the caret would lie on its side, so it stays at the click.
-        for rotation in [90, 180, 270] {
-            assert_eq!(snapped_caret(&page(rotation, 1.0), &text, 43.0, 95.0), None, "/Rotate {rotation}");
-        }
-    }
-
-    #[test]
-    fn away_from_upright_horizontal_text_the_caret_stays_at_the_click() {
-        let text = line("abcd", 20.0, 100.0, 10.0, 14.0, [1.0, 0.0]);
-        assert_eq!(caret_snap(&text, 200.0, 100.0), None, "far to the right");
-        assert_eq!(caret_snap(&text, 40.0, 40.0), None, "far above the line");
-        assert_eq!(caret_snap(&PageText::default(), 40.0, 100.0), None, "no text");
-        for (direction, what) in [([0.0, 1.0], "vertical"), ([-1.0, 0.0], "upside down"), ([0.995, 0.0998], "sloped")] {
-            let turned = line("abcd", 20.0, 100.0, 10.0, 14.0, direction);
-            let [x0, y0, x1, y1] = turned.glyphs[2].rect;
-            assert_eq!(caret_snap(&turned, (x0 + x1) / 2.0, (y0 + y1) / 2.0), None, "{what}");
-        }
-    }
-
-    #[test]
-    fn recent_custom_colours_dedupe_cap_and_skip_swatches() {
-        // #1193: "Other colour…" remembers what it applied, newest first.
-        let ctx = egui::Context::default();
-        assert!(recent_custom_colours(&ctx).is_empty());
-        for i in 0..7 {
-            remember_custom_colour(&ctx, [0.1 * f64::from(i), 0.3, 0.7]);
-        }
-        let recent = recent_custom_colours(&ctx);
-        assert_eq!(recent.len(), RECENT_CUSTOM, "capped");
-        assert!(same_colour(&recent[0], &[0.6, 0.3, 0.7]), "newest first: {recent:?}");
-        remember_custom_colour(&ctx, [0.2, 0.3, 0.7]);
-        let again = recent_custom_colours(&ctx);
-        assert_eq!(again.len(), RECENT_CUSTOM);
-        assert!(
-            same_colour(&again[0], &[0.2, 0.3, 0.7]) && again.iter().filter(|c| same_colour(c, &[0.2, 0.3, 0.7])).count() == 1,
-            "moved, not repeated"
-        );
-        // Swatches and unusable values are not remembered; out-of-range ones are clamped.
-        remember_custom_colour(&ctx, SWATCHES[0].1);
-        remember_custom_colour(&ctx, [f64::NAN, 0.0, 0.0]);
-        assert!(same_colour(&recent_custom_colours(&ctx)[0], &[0.2, 0.3, 0.7]));
-        remember_custom_colour(&ctx, [1.7, -0.5, 0.25]);
-        assert!(same_colour(&recent_custom_colours(&ctx)[0], &[1.0, 0.0, 0.25]));
-    }
-
-    #[test]
-    fn other_colour_applies_the_picked_colour_once() {
-        // #1193: the swatch grid has a full picker; Apply returns its colour and remembers it.
-        use egui_kittest::kittest::Queryable;
-        let current = [0.2, 0.4, 0.6];
-        let mut h = egui_kittest::Harness::new_ui_state(
-            |ui, picked: &mut Vec<Rgb>| {
-                if let Some(c) = swatch_grid(ui, Some(current)) {
-                    picked.push(c);
-                }
-            },
-            Vec::new(),
-        );
-        h.run();
-        assert!(h.query_by_label("Apply").is_none(), "the picker starts closed");
-        assert!(h.query_by_label("Recent colours").is_none());
-        h.get_by_label("Other colour…").click();
-        h.run();
-        h.get_by_label("Apply").click();
-        h.run();
-        let picked = h.state().clone();
-        assert_eq!(picked.len(), 1, "one choice: {picked:?}");
-        assert!(same_colour(&picked[0], &current), "the picker opens on the current colour: {picked:?}");
-        assert!(h.query_by_label("Apply").is_none(), "applying closes the picker");
-        assert!(h.query_by_label("Recent colours").is_some(), "the colour is offered again");
-    }
-
-    #[test]
-    fn two_grids_in_one_parent_open_their_pickers_separately() {
-        // Redaction properties and Prepare a form draw two grids in one parent ui.
-        use egui_kittest::kittest::Queryable;
-        let mut h = egui_kittest::Harness::new_ui(|ui| {
-            let _ = swatch_grid(ui, Some([0.2, 0.4, 0.6]));
-            let _ = swatch_grid(ui, Some([0.6, 0.4, 0.2]));
-        });
-        h.run();
-        let plus = h.query_all_by_label("Other colour…").collect::<Vec<_>>();
-        assert_eq!(plus.len(), 2);
-        plus[0].click();
-        h.run();
-        assert_eq!(h.query_all_by_label("Apply").count(), 1, "only the first grid's picker opens");
-    }
-
-    #[test]
-    fn other_colour_opens_the_picker_inside_the_quick_bar_popup() {
-        use egui_kittest::kittest::Queryable;
-        let mut h = egui_kittest::Harness::new_ui_state(
-            |ui, prefs: &mut CommentPrefs| {
-                let _ = quick_bar_controls(ui, CommentTool::Highlight, prefs);
-            },
-            CommentPrefs::default(),
-        );
-        h.run();
-        h.get_by_label("Colour").click();
-        h.run();
-        h.get_by_label("Other colour…").click();
-        h.run();
-        assert!(h.query_by_label("Apply").is_some(), "the popup stays open with the picker showing");
-        h.get_by_label("Apply").click();
-        h.run();
-        assert!(h.query_by_label("Other colour…").is_none(), "applying a colour closes the popup");
-    }
-
-    #[test]
-    fn other_colour_opens_the_picker_inside_the_quick_bar_fill_popup() {
-        use egui_kittest::kittest::Queryable;
-        let prefs = CommentPrefs::default();
-        let fill_label = if prefs.style(CommentTool::Rectangle).fill.is_some() { "Fill colour" } else { "Fill colour: none" };
-        let mut h = egui_kittest::Harness::new_ui_state(
-            |ui, prefs: &mut CommentPrefs| {
-                let _ = quick_bar_controls(ui, CommentTool::Rectangle, prefs);
-            },
-            prefs,
-        );
-        h.ctx.set_fonts(theme::font_definitions());
-        h.run();
-        h.get_by_label(fill_label).click();
-        h.run();
-        h.get_by_label("Other colour…").click();
-        h.run();
-        assert!(h.query_by_label("Apply").is_some(), "the popup stays open with the picker showing");
-        h.get_by_label("Apply").click();
-        h.run();
-        assert!(h.query_by_label("No fill").is_none(), "applying a colour closes the popup");
-        assert!(h.state().style(CommentTool::Rectangle).fill.is_some());
-    }
-
-    #[test]
-    fn context_menu_colour_submenu_keeps_its_picker_open_and_a_swatch_closes_the_menu() {
-        use egui_kittest::kittest::Queryable;
-        let info = DocInfo {
-            pages: vec![PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 }],
-            annotations: vec![Annotation {
-                page: 0,
-                subtype: "Square".into(),
-                author: None,
-                contents: None,
-                modified: None,
-                name: None,
-                in_reply_to: None,
-                rect: [10.0, 10.0, 50.0, 50.0],
-                color: None,
-                index: 0,
-                state: None,
-                quads: Vec::new(),
-                locked: false,
-                intent: None,
-                fill_sign: false,
-                points: Vec::new(),
-                no_rotate: false,
-            }],
-            ..Default::default()
-        };
-        let mut view = DocView::new(pdfcraft_engine::DocId(1), &info, crate::canvas::ViewDefaults::default());
-        view.comments.selected = Some((0, 0));
-        let prefs = CommentPrefs::default();
-        let mut h = egui_kittest::Harness::new_ui_state(
-            |ui, (view, actions): &mut (DocView, Vec<CanvasAction>)| {
-                ui.button("Page").context_menu(|ui| {
-                    if let Some(a) = context_menu(ui, view, &info, &prefs, true, true) {
-                        actions.push(a);
-                    }
-                });
-            },
-            (view, Vec::new()),
-        );
-        h.run();
-        h.get_by_label("Page").click_secondary();
-        h.run();
-        h.get_by_label("Colour ⏵").click();
-        h.run();
-        h.get_by_label("Other colour…").click();
-        h.run();
-        assert!(h.query_by_label("Apply").is_some(), "the submenu stays open with the picker showing");
-        h.get_by_label("Red").click();
-        h.run();
-        assert!(h.query_by_label("Edit text…").is_none(), "picking a swatch closes the whole menu");
-        let actions = &h.state().1;
-        assert!(
-            matches!(actions.as_slice(), [CanvasAction::Edit(e)] if matches!(**e, Edit::StyleAnnotation { page: 0, index: 0, color: Some(_), .. })),
-            "{actions:?}"
-        );
-    }
-
-    #[test]
-    fn shift_keeps_the_current_proportions_unless_the_box_has_its_own() {
-        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
-        assert_eq!(corner_ratio(r, None, false), None);
-        assert_eq!(corner_ratio(r, None, true), Some(3.0));
-        assert_eq!(corner_ratio(r, Some(2.0), false), Some(2.0));
-        assert_eq!(corner_ratio(r, Some(2.0), true), Some(2.0));
-        // A degenerate box has no proportions to keep (no division by zero).
-        let flat = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 100.0));
-        assert_eq!(corner_ratio(flat, None, true), None);
-        // Dragging a corner with Shift held scales the box instead of stretching it.
-        let out = resized(r, (1, 1), vec2(48.0, 0.0), corner_ratio(r, None, true));
-        assert_eq!(out.min, r.min);
-        assert!((out.width() / out.height() - 3.0).abs() < 0.001);
-    }
-
-    #[test]
-    fn proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis() {
-        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
-        for (hx, hy) in [(-1, -1), (1, -1), (-1, 1), (1, 1)] {
-            for (dx, dy) in [(24.0, 0.0), (0.0, 16.0), (-48.0, -20.0), (-200.0, -200.0)] {
-                let out = resized(r, (hx, hy), vec2(f32::from(hx) * dx, f32::from(hy) * dy), Some(3.0));
-                assert_eq!(handle_pos(out, (-hx, -hy)), handle_pos(r, (-hx, -hy)));
-                assert!((out.width() / out.height() - 3.0).abs() < 0.001);
-                assert!(out.width() >= 4.0 && out.height() >= 4.0);
-            }
-        }
-        for handle in [(0, -1), (1, 0), (0, 1), (-1, 0)] {
-            let out = resized(r, handle, vec2(24.0, 16.0), Some(3.0));
-            assert_eq!(out, resized(r, handle, vec2(24.0, 16.0), None));
-            assert_eq!(if handle.0 == 0 { out.width() } else { out.height() }, if handle.0 == 0 { r.width() } else { r.height() });
-        }
-        // Ordinary comment corners keep their existing independent width/height behavior.
-        let free = resized(r, (1, 1), vec2(24.0, 0.0), None);
-        assert_eq!(free.size(), vec2(120.0, 32.0));
-    }
-
-    #[test]
-    fn tools_round_trip_through_their_commands() {
-        for t in ALL {
-            assert_eq!(CommentTool::from_command(t.command()), Some(t));
-            assert!(pdfcraft_engine::commands::command(t.command()).is_some(), "{} is registered", t.command());
-            assert!(icons::exists(t.icon()), "icon {}", t.icon());
-            assert!(GROUPS[t.group()].contains(&t));
-        }
-    }
-
-    #[test]
-    fn drawn_shapes_ignore_slips() {
-        assert_eq!(drawn_shape(CommentTool::Rectangle, &[[0.0, 0.0], [1.0, 1.0]]), None);
-        assert_eq!(drawn_shape(CommentTool::Rectangle, &[[10.0, 0.0], [0.0, 10.0]]), Some(Shape::Rectangle { rect: [0.0, 0.0, 10.0, 10.0] }));
-        assert_eq!(drawn_shape(CommentTool::Ink, &[[0.0, 0.0]]), Some(Shape::Ink { strokes: vec![vec![[0.0, 0.0]]] }));
-        assert!(matches!(
-            drawn_shape(CommentTool::Arrow, &[[0.0, 0.0], [5.0, 0.0]]),
-            Some(Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. })
-        ));
-    }
-
-    #[test]
-    fn text_boxes_fit_their_text() {
-        let r = text_box_rect([100.0, 500.0], "Hi", 12.0, 0);
-        assert_eq!((r[0], r[3]), (100.0, 500.0));
-        assert!(r[2] - r[0] < 60.0);
-        let long = text_box_rect([0.0, 500.0], &"word ".repeat(80), 12.0, 0);
-        assert_eq!(long[2], 300.0);
-        assert!(long[3] - long[1] > 50.0);
-    }
-}
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 1550d446cc..43c41889e5 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -36,6 +36,8 @@
 //!   for this session without changing the saved preference. `ui.state.default_mode` reports it.
 //!   `theme=light|dark|system` changes the saved theme preference; `ui.state.theme_preference`
 //!   reports the choice and `ui.state.theme` reports the resolved light/dark colours.
+//!   `comment-tool-pinned=true|false` remembers the annotation quick bar's pin across restarts;
+//!   `ui.state.comment_tool_pinned` reports the same preference.
 //! - `ui.open {path}`: open a file. A file whose tab is already open focuses it
 //!   (`"focused": true`) instead of adding a tab; native opens report `pending: true` until
 //!   they complete and are listed in `ui.state.pending_opens`; only a failed open replies `Err`.
@@ -48,24 +50,34 @@ use std::sync::{Arc, Mutex};
 use egui::accesskit::{self, Action, NodeId};
 use serde_json::{Value, json};
 
+mod host;
+mod pending;
+mod plugin;
+mod requests;
+mod screenshot;
+#[cfg(not(target_arch = "wasm32"))]
+mod transport;
+
+pub use plugin::ControlPlugin;
+use plugin::expire_input;
+use requests::Handled;
+#[cfg(test)]
+use requests::key_batches;
+use screenshot::{Geometry, MAX_IMAGE_BYTES, retried_reservation};
+#[cfg(not(target_arch = "wasm32"))]
+pub use transport::{Endpoint, serve};
+
 pub type Reply = Result<Value, String>;
 
 /// Seconds to wait for frames (input to be handled, a screenshot to be taken) before reporting
-/// that the window is not being drawn. While a window is hidden, minimized or fully covered,
-/// eframe keeps calling `logic` but runs no egui pass, so input and screenshots wait.
+/// that the window is not being drawn. `App::logic` also runs while a window is hidden,
+/// minimized or fully covered, where egui's own input clock does not advance; every deadline
+/// here uses a monotonic `web_time::Instant` so hidden logic cannot stall or restart it.
 const NOT_DRAWN_TIMEOUT: f64 = 5.0;
 
-/// Wall-clock seconds (egui's own clock stops while the window is not drawn).
-fn now_secs() -> f64 {
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        static START: std::sync::OnceLock<std::time::Instant> = std::sync::OnceLock::new();
-        START.get_or_init(std::time::Instant::now).elapsed().as_secs_f64()
-    }
-    #[cfg(target_arch = "wasm32")]
-    {
-        js_sys::Date::now() / 1000.0
-    }
+/// Return the deadline used to reject control requests that wait for a drawn window.
+fn timeout() -> std::time::Duration {
+    std::time::Duration::from_secs_f64(NOT_DRAWN_TIMEOUT)
 }
 
 fn not_drawn(what: &str) -> String {
@@ -74,8 +86,23 @@ fn not_drawn(what: &str) -> String {
     )
 }
 
+/// Return the actionable error text for a control request whose window was not drawn in time.
+fn still_starting() -> String {
+    format!("the app was still starting after {NOT_DRAWN_TIMEOUT:.0} s; the control request was not applied, retry when the window is drawn")
+}
+
+/// The app finished starting, but only after this request's one admission deadline had already
+/// passed. Report that instead of claiming the app is still starting.
+fn startup_deadline_expired() -> String {
+    format!(
+        "the app finished starting after this control request's {NOT_DRAWN_TIMEOUT:.0} s deadline; the request was not applied, retry now that the window is drawn"
+    )
+}
+
 /// One request from a client, answered on `reply`.
 pub struct ControlRequest {
+    /// Admission time on the sending thread, including time waiting for the next app tick.
+    pub since: web_time::Instant,
     pub method: String,
     pub params: Value,
     pub reply: Sender<Reply>,
@@ -92,7 +119,7 @@ impl ControlClient {
     /// Queue a request; the reply arrives on the returned receiver once the app has handled it.
     pub fn send(&self, method: &str, params: Value) -> Receiver<Reply> {
         let (reply, rx) = channel();
-        let req = ControlRequest { method: method.into(), params, reply };
+        let req = ControlRequest { since: web_time::Instant::now(), method: method.into(), params, reply };
         if let Err(e) = self.tx.send(req) {
             let _ = e.0.reply.send(Err("the app has closed".into()));
         }
@@ -107,66 +134,81 @@ struct Shared {
     nodes: HashMap<NodeId, accesskit::Node>,
     root: Option<NodeId>,
     focus: Option<NodeId>,
-    /// Event batches to inject, one batch per frame.
-    inject: VecDeque<Vec<egui::Event>>,
-    /// Real egui passes so far (counted in `output_hook`, which `logic`-only calls never reach).
+    /// Queued synthetic-input requests, each with one event batch per UI pass.
+    inject: VecDeque<RequestBatches>,
+    /// Accepted (not discarded) egui passes, counted in `output_hook`.
     passes: u64,
+    /// The document/focus generation the app last admitted input for.
+    epoch: u64,
+    /// Input requests whose queued events became stale before a UI pass consumed them.
+    dropped: Vec<u64>,
+    next_batch: u64,
+    /// A batch admitted before its deadline may finish this pass. Expiry runs before the next
+    /// input hook (or in hidden logic), never after egui has already calculated its interaction.
+    in_pass: bool,
+    expired: Vec<u64>,
+    cleanup: Vec<egui::Event>,
+    cancel_pointer: bool,
+    cancel_gestures: bool,
 }
 
-/// The egui plugin half of the control channel.
-pub struct ControlPlugin {
-    shared: Arc<Mutex<Shared>>,
-}
-
-impl egui::Plugin for ControlPlugin {
-    fn debug_name(&self) -> &'static str {
-        "pdfcraft-control"
-    }
-
-    fn input_hook(&mut self, ctx: &egui::Context, input: &mut egui::RawInput) {
-        let Ok(mut s) = self.shared.lock() else { return };
-        if let Some(batch) = s.inject.pop_front() {
-            input.events.extend(batch);
-        }
-        if !s.inject.is_empty() {
-            ctx.request_repaint();
-        }
-    }
-
-    fn output_hook(&mut self, _ctx: &egui::Context, output: &mut egui::FullOutput) {
-        let Ok(mut s) = self.shared.lock() else { return };
-        s.passes += 1;
-        let Some(update) = &output.platform_output.accesskit_update else { return };
-        s.nodes = update.nodes.iter().cloned().collect();
-        s.root = update.tree.as_ref().map(|t| t.root);
-        s.focus = Some(update.focus);
-    }
+/// One queued synthetic-input request: its batches are injected one per UI pass.
+struct RequestBatches {
+    request: u64,
+    /// The document/dialog/focus generation the request was admitted for.
+    epoch: u64,
+    /// The first batch was injected, so a focus/dialog change does not reject its own remaining
+    /// batches. The admission deadline still cancels a partially delivered gesture.
+    started: bool,
+    since: web_time::Instant,
+    /// Inverse presses still held by this request. Pointer entries are ownership markers for
+    /// cancellation only: replaying one on timeout would click or drop the abandoned gesture.
+    release: Vec<egui::Event>,
+    batches: VecDeque<Vec<egui::Event>>,
 }
 
 enum Pending {
-    /// Answer after `frames` more frames (the injected input has been handled by then).
+    /// Answer after `frames` more accepted frames (the injected input has been handled by then).
     Frames {
-        /// Answer once this many egui passes have run (the injected input has been handled).
+        /// Answer once this many accepted UI passes have run.
         until_pass: u64,
-        since: f64,
+        /// The queued batches this request depends on; a stale one fails the request.
+        batches: Vec<u64>,
+        since: web_time::Instant,
         reply: Sender<Reply>,
         value: Value,
     },
     Screenshot {
-        tag: u64,
+        slot: craft_ui::capture::CaptureSlot,
+        /// The one-shot callback, kept until the settled pass that issues it.
+        callback: Option<egui::ScreenshotCallback>,
         region: Option<egui::Rect>,
         reply: Sender<Reply>,
-        /// When it was requested (egui time, seconds).
-        since: f64,
+        since: web_time::Instant,
+        geometry: Geometry,
+        /// Bytes reserved in the aggregate budget for this request.
+        reserved: usize,
+        attempts: u8,
     },
 }
 
+/// A request that arrived while the app could not yet run a real UI pass (fonts not ready).
+struct DeferredRequest {
+    request: ControlRequest,
+    /// When this request reached the control queue. One admission deadline runs from here through
+    /// startup, input injection, pending frames and screenshot issuance: dispatching it later must
+    /// not start a fresh 5 s in each phase, and a request that used up the deadline while the app
+    /// was starting is never applied against a later UI state.
+    since: web_time::Instant,
+}
+
 /// The app half: the request queue and requests waiting for later frames.
 pub struct Control {
     rx: Receiver<ControlRequest>,
     shared: Arc<Mutex<Shared>>,
     pending: Vec<Pending>,
-    next_tag: u64,
+    /// Requests admitted while the app cannot yet run a real UI pass (fonts not ready).
+    deferred: VecDeque<DeferredRequest>,
 }
 
 /// Install the control channel on `ctx`: returns the app half and a client.
@@ -175,1228 +217,246 @@ pub fn attach(ctx: &egui::Context) -> (Control, ControlClient) {
     ctx.add_plugin(ControlPlugin { shared: shared.clone() });
     ctx.enable_accesskit();
     let (tx, rx) = channel();
-    (Control { rx, shared, pending: Vec::new(), next_tag: 1 }, ControlClient { tx, ctx: ctx.clone() })
+    (Control { rx, shared, pending: Vec::new(), deferred: VecDeque::new() }, ControlClient { tx, ctx: ctx.clone() })
 }
 
 /// What a request needs from the app (implemented by `PdfCraftApp`).
 pub(crate) trait Host {
+    /// Return the UI-state snapshot reported by `ui.state`.
     fn state(&self) -> Value;
+    /// Run one registered command by id and return its reply.
     fn command(&mut self, id: &str) -> Reply;
-    fn dock(&mut self, reset: bool, params: &Value) -> Reply;
+    /// Apply or reset the side panel layout from a control request.
+    fn panel(&mut self, reset: bool, params: &Value) -> Reply;
+    /// List the commands available to the control channel.
     fn commands(&self) -> Value;
+    /// Set one application option from a control request.
     fn set(&mut self, key: &str, value: &str) -> Reply;
+    /// Open a document path requested through the control channel.
     fn open(&mut self, path: &str) -> Reply;
+    /// Request application exit; returns whether it closed without asking for confirmation.
     fn quit(&mut self, ctx: &egui::Context) -> bool;
+
+    /// A generation that changes when the input target (document, dialog, focus) does.
+    ///
+    /// Synthetic input admitted for one generation must not be replayed into another.
+    fn input_epoch(&self) -> u64 {
+        0
+    }
+
+    /// A generation for the captured content (document and dialog identity only).
+    ///
+    /// Screenshots do not depend on keyboard focus, so a field gaining focus must not discard a
+    /// pending capture. Hosts that do not distinguish the two reuse the input generation.
+    fn capture_epoch(&self) -> u64 {
+        self.input_epoch()
+    }
+
+    /// Whether the app can apply a real UI pass yet (fonts installed, no early return).
+    fn accepts_input(&self) -> bool {
+        true
+    }
+
+    /// Drop transient app-owned grabs before widgets observe the canceled pointer as up.
+    fn cancel_pointer_gestures(&mut self) {}
 }
 
 impl Control {
-    /// Handle new requests and finish waiting ones. Call at the start of every frame.
+    /// Handle new requests and finish waiting ones. Call at the start of every frame (`logic`).
     pub(crate) fn tick(&mut self, ctx: &egui::Context, host: &mut impl Host) {
-        self.finish_pending(ctx);
-        while let Ok(req) = self.rx.try_recv() {
-            match self.handle(ctx, host, &req.method, &req.params) {
-                Handled::Now(r) => {
-                    let _ = req.reply.send(r);
+        self.set_epoch(host.input_epoch());
+        self.finish_pending(ctx, host);
+        let ready = host.accepts_input();
+        if !ready {
+            // Expiry applies while the app is still starting too: a request that waited through
+            // the startup gate must fail at the same deadline instead of running whenever fonts
+            // arrive.
+            let now = web_time::Instant::now();
+            while self.deferred.front().is_some_and(|deferred| now.duration_since(deferred.since) > timeout()) {
+                if let Some(deferred) = self.deferred.pop_front() {
+                    let _ = deferred.request.reply.send(Err(still_starting()));
                 }
-                Handled::AfterFrames(frames, value) => {
-                    let until_pass = self.passes() + u64::from(frames);
-                    self.pending.push(Pending::Frames { until_pass, since: now_secs(), reply: req.reply, value });
-                }
-                Handled::Screenshot(region) => {
-                    let tag = self.next_tag;
-                    self.next_tag += 1;
-                    ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(egui::UserData::new(tag)));
-                    self.pending.push(Pending::Screenshot { tag, region, reply: req.reply, since: now_secs() });
+            }
+        } else {
+            // Deferred requests reached the queue before anything still in the channel, so they
+            // are dispatched first: one client's requests keep their arrival order. Each carries
+            // its own admission timestamp, so startup time counts against its deadline.
+            while let Some(deferred) = self.deferred.pop_front() {
+                if web_time::Instant::now().duration_since(deferred.since) > timeout() {
+                    let _ = deferred.request.reply.send(Err(startup_deadline_expired()));
+                } else {
+                    self.dispatch(ctx, host, deferred.request, deferred.since);
                 }
             }
         }
-        if !self.pending.is_empty() {
+        while let Ok(req) = self.rx.try_recv() {
+            // One admission timestamp per request: queued input, pending frames and an admitted
+            // screenshot all measure their deadline from the sending thread, including time
+            // waiting in this channel, never from a later phase.
+            let since = req.since;
+            if web_time::Instant::now().duration_since(since) > timeout() {
+                let _ = req.reply.send(Err(if ready { startup_deadline_expired() } else { still_starting() }));
+                continue;
+            }
+            if !ready {
+                if self.deferred.len() < 32 {
+                    self.deferred.push_back(DeferredRequest { request: req, since });
+                } else {
+                    let _ = req.reply.send(Err("the app is still starting; too many control requests queued".into()));
+                }
+                continue;
+            }
+            self.dispatch(ctx, host, req, since);
+        }
+        if !self.pending.is_empty() || !self.deferred.is_empty() {
             ctx.request_repaint();
+            // A hidden or occluded window runs `logic` without a UI pass. Ask for one so queued
+            // input and screenshots can be applied; the screenshot command itself also paints.
+            //
+            // The shared fork's web host does not implement `RequestPaintWhileHidden` yet: a
+            // hidden browser tab still times out rather than falsely succeeding. Recorded as a
+            // pending fork prerequisite, not qualified here.
+            #[cfg(not(target_arch = "wasm32"))]
+            if ctx.input(|i| i.viewport().visible()) != Some(true) {
+                ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaintWhileHidden);
+            }
         }
     }
 
-    fn finish_pending(&mut self, ctx: &egui::Context) {
-        let shots: Vec<(u64, Arc<egui::ColorImage>)> = ctx.input(|i| {
-            i.raw
-                .events
-                .iter()
-                .filter_map(|e| match e {
-                    egui::Event::Screenshot { user_data, image, .. } => {
-                        user_data.data.as_ref().and_then(|d| d.downcast_ref::<u64>()).map(|tag| (*tag, image.clone()))
-                    }
-                    _ => None,
-                })
-                .collect()
-        });
-        let ppp = ctx.pixels_per_point();
-        let now = now_secs();
-        let passes = self.passes();
-        let mut keep = Vec::new();
-        for p in self.pending.drain(..) {
-            match p {
-                Pending::Frames { until_pass, reply, value, .. } if passes >= until_pass => {
-                    let _ = reply.send(Ok(value));
+    /// Refresh the input-target generation before a pass consumes queued synthetic input.
+    ///
+    /// `raw_input_hook` runs before the plugin's `input_hook`, so a dialog opened by the
+    /// previous pass already invalidates a request that has not started yet, instead of a pass
+    /// later. Only that request is rejected; requests already started finish their batches.
+    pub(crate) fn set_epoch(&self, epoch: u64) {
+        if let Ok(mut s) = self.shared.lock() {
+            s.epoch = epoch;
+        }
+    }
+
+    /// Issue admitted captures after a settled UI pass. Call at the end of `App::ui`.
+    pub(crate) fn finish_frame(&mut self, ctx: &egui::Context, host: &mut impl Host) {
+        if !host.accepts_input() || ctx.will_discard() {
+            return;
+        }
+        let current = Geometry::current(ctx, host.capture_epoch());
+        let mut reserved_total = self.reserved_bytes();
+        let mut kept = Vec::new();
+        for pending in self.pending.drain(..) {
+            let mut entry = pending;
+            if let Pending::Screenshot { slot, callback, reply, region, geometry, reserved, attempts, since } = &mut entry
+                && callback.is_some()
+            {
+                if web_time::Instant::now().duration_since(*since) > timeout() {
+                    slot.cancel();
+                    reserved_total = reserved_total.saturating_sub(*reserved);
+                    let _ = reply.send(Err(not_drawn("the screenshot")));
+                    continue;
                 }
-                Pending::Frames { since, reply, .. } if now - since > NOT_DRAWN_TIMEOUT => {
-                    // The agent is told it failed, so it must not happen later either.
-                    if let Ok(mut sh) = self.shared.lock() {
-                        sh.inject.clear();
-                    }
-                    let _ = reply.send(Err(not_drawn("handling the input")));
+                if geometry.epoch != current.epoch {
+                    slot.cancel();
+                    reserved_total = reserved_total.saturating_sub(*reserved);
+                    let _ = reply.send(Err("the document or dialog changed before the screenshot could be issued; it was not saved".into()));
+                    continue;
                 }
-                p @ Pending::Frames { .. } => keep.push(p),
-                Pending::Screenshot { tag, region, reply, since } => match shots.iter().find(|(t, _)| *t == tag) {
-                    Some((_, image)) => {
-                        let _ = reply.send(screenshot_png(image, region, ppp));
+                if *geometry != current {
+                    // Resize, DPI or zoom between admission and issuance: retry once with the
+                    // real geometry rather than cropping with stale numbers.
+                    if *attempts >= 1 {
+                        slot.cancel();
+                        reserved_total = reserved_total.saturating_sub(*reserved);
+                        let _ = reply.send(Err("the window geometry changed while the screenshot was being prepared; it was not saved".into()));
+                        continue;
                     }
-                    // The platform skips painting windows that are hidden, minimized or fully
-                    // covered, so no screenshot ever arrives: say so instead of hanging.
-                    None if now - since > NOT_DRAWN_TIMEOUT => {
-                        let _ = reply.send(Err(not_drawn("the screenshot")));
+                    if region.as_ref().is_some_and(|region| !current.contains_region(*region)) {
+                        slot.cancel();
+                        reserved_total = reserved_total.saturating_sub(*reserved);
+                        let _ = reply.send(Err("the region must lie inside the window".into()));
+                        continue;
                     }
-                    None => keep.push(Pending::Screenshot { tag, region, reply, since }),
-                },
+                    let Some(bytes) = current.image_bytes() else {
+                        slot.cancel();
+                        reserved_total = reserved_total.saturating_sub(*reserved);
+                        let _ = reply.send(Err("the window has no capturable size".into()));
+                        continue;
+                    };
+                    let Some(new_total) = retried_reservation(reserved_total, *reserved, bytes) else {
+                        slot.cancel();
+                        reserved_total = reserved_total.saturating_sub(*reserved);
+                        let _ = reply.send(Err("the screenshot no longer fits the screenshot budget".into()));
+                        continue;
+                    };
+                    reserved_total = new_total;
+                    slot.cancel();
+                    let (new_slot, new_callback) = craft_ui::capture::CaptureSlot::new(ctx, egui::ViewportId::ROOT, MAX_IMAGE_BYTES);
+                    *slot = new_slot;
+                    *callback = Some(new_callback);
+                    *geometry = current;
+                    *reserved = bytes;
+                    *attempts += 1;
+                }
+                if let Some(callback) = callback.take() {
+                    // The screenshot command itself requests a paint, including while hidden.
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(callback));
+                }
+            }
+            kept.push(entry);
+        }
+        self.pending = kept;
+        if !self.pending.is_empty() {
+            #[cfg(not(target_arch = "wasm32"))]
+            if ctx.input(|i| i.viewport().visible()) != Some(true) {
+                ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaintWhileHidden);
             }
         }
-        self.pending = keep;
+    }
+
+    /// `since` is the request's arrival time: the one admission deadline it was admitted under.
+    fn dispatch(&mut self, ctx: &egui::Context, host: &mut impl Host, req: ControlRequest, since: web_time::Instant) {
+        match self.handle(ctx, host, &req.method, &req.params, since) {
+            Handled::Now(r) => {
+                let _ = req.reply.send(r);
+            }
+            Handled::AfterFrames(frames, value) => {
+                let until_pass = self.passes() + u64::from(frames);
+                self.pending.push(Pending::Frames { until_pass, batches: Vec::new(), since, reply: req.reply, value });
+            }
+            Handled::AfterInput { batches, frames, value } => {
+                let until_pass = self.passes() + u64::from(frames) + 1;
+                self.pending.push(Pending::Frames { until_pass, batches, since, reply: req.reply, value });
+            }
+            Handled::Screenshot(region) => self.admit_screenshot(ctx, host, region, req.reply, since),
+        }
+    }
+
+    /// Expire queued input and collect the batches a pending reply must react to.
+    fn take_finished_shared(&self, ctx: &egui::Context, host: &mut impl Host, now: web_time::Instant) -> (Vec<u64>, Vec<u64>, bool) {
+        let (dropped, expired, in_pass) = self
+            .shared
+            .lock()
+            .map(|mut s| {
+                if !s.in_pass {
+                    expire_input(&mut s, now);
+                }
+                if std::mem::take(&mut s.cancel_gestures) {
+                    host.cancel_pointer_gestures();
+                }
+                (std::mem::take(&mut s.dropped), std::mem::take(&mut s.expired), s.in_pass)
+            })
+            .unwrap_or_default();
+        if !expired.is_empty() {
+            ctx.request_repaint(); // Run the queued key/modifier cleanup and pointer cancellation.
+        }
+        (dropped, expired, in_pass)
     }
 
     fn passes(&self) -> u64 {
         self.shared.lock().map(|s| s.passes).unwrap_or(0)
     }
-
-    fn inject(&self, batches: Vec<Vec<egui::Event>>) -> u32 {
-        let n = batches.len() as u32;
-        if let Ok(mut s) = self.shared.lock() {
-            s.inject.extend(batches);
-        }
-        // The last batch is handled during the frame it is injected into; answer one frame later.
-        n + 1
-    }
-
-    fn handle(&mut self, ctx: &egui::Context, host: &mut impl Host, method: &str, p: &Value) -> Handled {
-        let str_param = |k: &str| p.get(k).and_then(Value::as_str).ok_or_else(|| format!("{method}: missing string parameter {k}"));
-        let r: Result<Handled, String> = (|| match method {
-            "ui.state" => {
-                let mut state = host.state();
-                let size = ctx.input(|i| i.viewport_rect().size());
-                state["window"] = json!({ "width": size.x, "height": size.y, "pixels_per_point": ctx.pixels_per_point() });
-                Ok(Handled::Now(Ok(state)))
-            }
-            "ui.commands" => Ok(Handled::Now(Ok(host.commands()))),
-            "ui.dock" | "ui.dock.reset" => Ok(Handled::Now(host.dock(method == "ui.dock.reset", p))),
-            "ui.command" if str_param("id")? == "ui.dock" => Ok(Handled::Now(host.dock(false, p.get("params").unwrap_or(p)))),
-            "ui.command" => Ok(Handled::Now(host.command(str_param("id")?))),
-            "ui.set" => {
-                let value = match p.get("value") {
-                    Some(Value::String(s)) => s.clone(),
-                    Some(v) => v.to_string(),
-                    None => return Err("ui.set: missing parameter value".into()),
-                };
-                Ok(Handled::Now(host.set(str_param("key")?, &value)))
-            }
-            "ui.open" => Ok(Handled::Now(host.open(str_param("path")?))),
-            "ui.inspect" => Ok(Handled::Now(Ok(self.inspect(p)))),
-            "ui.click" => self.click(p),
-            "ui.focus" => self.focus(p),
-            "ui.resize" => {
-                only_params(p, method, &["width", "height"])?;
-                let dimension = |key: &str| -> Result<f32, String> {
-                    p.get(key)
-                        .and_then(Value::as_f64)
-                        .filter(|n| n.is_finite() && (320.0..=8192.0).contains(n))
-                        .map(|n| n as f32)
-                        .ok_or_else(|| format!("ui.resize: {key} must be between 320 and 8192 logical points"))
-                };
-                let size = egui::vec2(dimension("width")?, dimension("height")?);
-                if cfg!(target_arch = "wasm32") {
-                    return Err("ui.resize needs a native window".into());
-                }
-                ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(size));
-                ctx.request_repaint();
-                Ok(Handled::AfterFrames(2, json!({ "requested": [size.x, size.y] })))
-            }
-            "ui.quit" => {
-                only_params(p, method, &[])?;
-                if cfg!(target_arch = "wasm32") {
-                    return Err("ui.quit needs a native window".into());
-                }
-                let quitting = host.quit(ctx);
-                Ok(Handled::Now(Ok(json!({ "quitting": quitting, "needs_confirmation": !quitting }))))
-            }
-            "ui.drag" => self.drag(p),
-            "ui.move" => {
-                let point = |key: &str| -> Result<f32, String> {
-                    p.get(key)
-                        .and_then(Value::as_f64)
-                        .map(|n| n as f32)
-                        .filter(|n| n.is_finite())
-                        .ok_or_else(|| format!("ui.move: {key} must be a finite coordinate in points"))
-                };
-                let pos = egui::pos2(point("x")?, point("y")?);
-                Ok(Handled::AfterFrames(self.inject(vec![vec![egui::Event::PointerMoved(pos)]]), json!({ "moved": [pos.x, pos.y] })))
-            }
-            "ui.type" => {
-                let text = str_param("text")?.to_string();
-                Ok(Handled::AfterFrames(self.inject(vec![vec![egui::Event::Text(text)]]), json!({ "typed": true })))
-            }
-            "ui.key" => {
-                let name = str_param("key")?;
-                let key = egui::Key::from_name(name)
-                    .ok_or_else(|| format!("ui.key: unknown key {name:?} (egui key names: A, Enter, Escape, ArrowDown, F5, …)"))?;
-                let modifiers = modifiers(p.get("modifiers"))?;
-                let ev = |pressed| egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers };
-                Ok(Handled::AfterFrames(self.inject(vec![vec![ev(true)], vec![ev(false)]]), json!({ "key": name })))
-            }
-            "ui.screenshot" => {
-                let region = match p.get("region") {
-                    None | Some(Value::Null) => None,
-                    Some(r) => Some(rect_param(r)?),
-                };
-                ctx.request_repaint();
-                Ok(Handled::Screenshot(region))
-            }
-            other => Err(format!(
-                "unknown method {other:?} (ui.state, ui.inspect, ui.click, ui.focus, ui.resize, ui.quit, ui.move, ui.drag, ui.type, ui.key, ui.command, ui.commands, ui.set, ui.open, ui.screenshot)"
-            )),
-        })();
-        r.unwrap_or_else(|e| Handled::Now(Err(e)))
-    }
-
-    fn inspect(&self, p: &Value) -> Value {
-        let query = p.get("query").and_then(Value::as_str).map(str::to_lowercase);
-        let role = p.get("role").and_then(Value::as_str).map(str::to_lowercase);
-        let focused = p.get("focused").and_then(Value::as_bool);
-        let limit = p.get("limit").and_then(Value::as_u64).unwrap_or(500) as usize;
-        let Ok(s) = self.shared.lock() else { return json!({ "widgets": [] }) };
-        let mut out = Vec::new();
-        let mut total = 0usize;
-        let mut stack: Vec<(NodeId, usize)> = s.root.map(|r| vec![(r, 0)]).unwrap_or_default();
-        while let Some((id, depth)) = stack.pop() {
-            let Some(node) = s.nodes.get(&id) else { continue };
-            for c in node.children().iter().rev() {
-                stack.push((*c, depth + 1));
-            }
-            let w = widget(id, node, depth, s.focus == Some(id));
-            let text =
-                format!("{} {} {}", w["label"].as_str().unwrap_or(""), w["value"].as_str().unwrap_or(""), w["description"].as_str().unwrap_or(""))
-                    .to_lowercase();
-            let role_ok = role.as_ref().is_none_or(|r| w["role"].as_str().is_some_and(|x| x.to_lowercase() == *r));
-            let query_ok = query.as_ref().is_none_or(|q| text.contains(q.as_str()));
-            let focus_ok = focused.is_none_or(|want| (s.focus == Some(id)) == want);
-            if role_ok && query_ok && focus_ok && id != s.root.unwrap_or(id) {
-                total += 1;
-                if out.len() < limit {
-                    out.push(w);
-                }
-            }
-        }
-        json!({ "widgets": out, "count": total, "truncated": total > out.len() })
-    }
-
-    /// Press at `from`, move to `to` in `steps` frames, release (drawing, selecting text, moving).
-    fn drag(&mut self, p: &Value) -> Result<Handled, String> {
-        let point = |k: &str| -> Result<egui::Pos2, String> {
-            match p.get(k).and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_f64).collect::<Vec<_>>()).as_deref() {
-                Some([x, y]) => Some(egui::pos2(*x as f32, *y as f32))
-                    .filter(|pos| pos.is_finite())
-                    .ok_or_else(|| format!("ui.drag: {k} must be [x, y], finite coordinates in points")),
-                _ => Err(format!("ui.drag: {k} must be [x, y] in points")),
-            }
-        };
-        let (from, to) = (point("from")?, point("to")?);
-        if !(to - from).is_finite() {
-            return Err("ui.drag: from and to must be a finite distance apart, in points".into());
-        }
-        let steps = p.get("steps").and_then(Value::as_u64).unwrap_or(8).clamp(1, 200) as usize;
-        let modifiers = modifiers(p.get("modifiers"))?;
-        let which = pointer_button(p, "ui.drag")?;
-        // The events carry the modifiers and so does the input state: gestures that read
-        // `ui.input(|i| i.modifiers)` (a Ctrl-drag copy, an Alt-drag column select) see them.
-        let held = |mut events: Vec<egui::Event>| {
-            if modifiers != egui::Modifiers::NONE {
-                events.insert(0, egui::Event::ModifiersChanged(modifiers));
-            }
-            events
-        };
-        let button = |pos, pressed| egui::Event::PointerButton { pos, button: which, pressed, modifiers };
-        let mut frames = vec![held(vec![egui::Event::PointerMoved(from)]), held(vec![button(from, true)])];
-        for k in 1..=steps {
-            frames.push(held(vec![egui::Event::PointerMoved(from + (to - from) * (k as f32 / steps as f32))]));
-        }
-        frames.push(held(vec![button(to, false)]));
-        if modifiers != egui::Modifiers::NONE {
-            frames.push(vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE)]);
-        }
-        let n = self.inject(frames);
-        Ok(Handled::AfterFrames(n, json!({ "dragged": [[from.x, from.y], [to.x, to.y]] })))
-    }
-
-    fn click(&mut self, p: &Value) -> Result<Handled, String> {
-        if let (Some(x), Some(y)) = (p.get("x").and_then(Value::as_f64), p.get("y").and_then(Value::as_f64)) {
-            let point = |key: &str, n: f64| {
-                Some(n as f32).filter(|n| n.is_finite()).ok_or_else(|| format!("ui.click: {key} must be a finite coordinate in points"))
-            };
-            let pos = egui::pos2(point("x", x)?, point("y", y)?);
-            let which = pointer_button(p, "ui.click")?;
-            let button = |pressed| egui::Event::PointerButton { pos, button: which, pressed, modifiers: egui::Modifiers::NONE };
-            // Keep hover/layout warmup, then make an instantaneous click even on slow frames.
-            let frames = self.inject(vec![vec![egui::Event::PointerMoved(pos)], vec![button(true), button(false)]]);
-            return Ok(Handled::AfterFrames(frames, json!({ "clicked": [x, y] })));
-        }
-        let s = self.shared.lock().map_err(|_| "control state poisoned")?;
-        let id = match (p.get("id"), p.get("label").and_then(Value::as_str)) {
-            (Some(id), _) => {
-                let id: u64 =
-                    id.as_u64().or_else(|| id.as_str().and_then(|s| s.parse().ok())).ok_or("ui.click: id must be a widget id from ui.inspect")?;
-                let id = NodeId(id);
-                if !s.nodes.contains_key(&id) {
-                    return Err(format!("ui.click: no widget with id {} on screen (run ui.inspect again)", id.0));
-                }
-                id
-            }
-            (None, Some(label)) => {
-                let want = label.to_lowercase();
-                let matches: Vec<NodeId> = s
-                    .nodes
-                    .iter()
-                    .filter(|(_, n)| n.supports_action(Action::Click) && !n.is_disabled() && n.label().is_some_and(|l| l.to_lowercase() == want))
-                    .map(|(id, _)| *id)
-                    .collect();
-                match matches.as_slice() {
-                    [one] => *one,
-                    [] => return Err(format!("ui.click: no enabled clickable widget labelled {label:?} (try ui.inspect with query)")),
-                    many => return Err(format!("ui.click: {} widgets are labelled {label:?}; click one by id", many.len())),
-                }
-            }
-            (None, None) => return Err("ui.click: pass id, label, or x and y".into()),
-        };
-        let node = &s.nodes[&id];
-        if node.is_disabled() {
-            return Err(format!("ui.click: widget {} ({}) is disabled", id.0, node.label().unwrap_or("unlabelled")));
-        }
-        let label = node.label().map(str::to_owned);
-        let action = accesskit::ActionRequest { action: Action::Click, target_tree: accesskit::TreeId::ROOT, target_node: id, data: None };
-        drop(s);
-        let frames = self.inject(vec![vec![egui::Event::AccessKitActionRequest(action)]]);
-        Ok(Handled::AfterFrames(frames, json!({ "clicked": id.0.to_string(), "label": label })))
-    }
-
-    fn focus(&mut self, p: &Value) -> Result<Handled, String> {
-        only_params(p, "ui.focus", &["id", "label"])?;
-        let s = self.shared.lock().map_err(|_| "control state poisoned")?;
-        let id = match (p.get("id"), p.get("label")) {
-            (Some(id), None) => {
-                NodeId(id.as_u64().or_else(|| id.as_str().and_then(|s| s.parse().ok())).ok_or("ui.focus: id must be a widget id from ui.inspect")?)
-            }
-            (None, Some(Value::String(label))) => {
-                let matches: Vec<NodeId> = s
-                    .nodes
-                    .iter()
-                    .filter(|(_, n)| n.supports_action(Action::Focus) && !n.is_disabled() && n.label().is_some_and(|l| l.eq_ignore_ascii_case(label)))
-                    .map(|(id, _)| *id)
-                    .collect();
-                match matches.as_slice() {
-                    [one] => *one,
-                    [] => return Err(format!("ui.focus: no enabled focusable widget labelled {label:?}")),
-                    many => return Err(format!("ui.focus: {} widgets are labelled {label:?}; use a widget id", many.len())),
-                }
-            }
-            _ => return Err("ui.focus: pass exactly one widget id or label".into()),
-        };
-        let node = s.nodes.get(&id).ok_or_else(|| format!("ui.focus: no widget with id {} on screen (run ui.inspect again)", id.0))?;
-        if node.is_disabled() || !node.supports_action(Action::Focus) {
-            return Err(format!("ui.focus: widget {} is disabled or not focusable", id.0));
-        }
-        let action = accesskit::ActionRequest { action: Action::Focus, target_tree: accesskit::TreeId::ROOT, target_node: id, data: None };
-        drop(s);
-        let frames = self.inject(vec![vec![egui::Event::AccessKitActionRequest(action)]]);
-        Ok(Handled::AfterFrames(frames, json!({ "focus_requested": id.0.to_string() })))
-    }
-}
-
-enum Handled {
-    Now(Reply),
-    AfterFrames(u32, Value),
-    Screenshot(Option<egui::Rect>),
-}
-
-fn widget(id: NodeId, n: &accesskit::Node, depth: usize, focused: bool) -> Value {
-    let rect = n.bounds().map(|b| [b.x0, b.y0, b.x1, b.y1]);
-    let mut w = json!({
-        // A string: 64-bit ids don't survive JSON parsers that use doubles.
-        "id": id.0.to_string(),
-        "role": format!("{:?}", n.role()),
-        "depth": depth,
-        "enabled": !n.is_disabled(),
-        "clickable": n.supports_action(Action::Click),
-        "focusable": n.supports_action(Action::Focus),
-    });
-    let mut more = serde_json::Map::new();
-    let obj = &mut more;
-    if let Some(l) = n.label() {
-        obj.insert("label".into(), json!(l));
-    }
-    if let Some(v) = n.value() {
-        obj.insert("value".into(), json!(v));
-    }
-    if let Some(d) = n.description() {
-        obj.insert("description".into(), json!(d));
-    }
-    if let Some(r) = rect {
-        obj.insert("rect".into(), json!(r));
-    }
-    if let Some(t) = n.toggled() {
-        obj.insert("toggled".into(), json!(format!("{t:?}").to_lowercase()));
-    }
-    if let Some(s) = n.is_selected() {
-        obj.insert("selected".into(), json!(s));
-    }
-    if focused {
-        obj.insert("focused".into(), json!(true));
-    }
-    if let Value::Object(m) = &mut w {
-        m.extend(more);
-    }
-    w
-}
-
-fn only_params(p: &Value, method: &str, allowed: &[&str]) -> Result<(), String> {
-    // The JSON-RPC transport represents omitted params as null.
-    if p.is_null() && allowed.is_empty() {
-        return Ok(());
-    }
-    let object = p.as_object().ok_or_else(|| format!("{method}: params must be an object"))?;
-    if let Some(key) = object.keys().find(|key| !allowed.contains(&key.as_str())) {
-        return Err(format!("{method}: unknown parameter {key:?}"));
-    }
-    Ok(())
-}
-
-fn pointer_button(p: &Value, method: &str) -> Result<egui::PointerButton, String> {
-    match p.get("button").and_then(Value::as_str).unwrap_or("primary") {
-        "primary" | "left" => Ok(egui::PointerButton::Primary),
-        "secondary" | "right" => Ok(egui::PointerButton::Secondary),
-        "middle" => Ok(egui::PointerButton::Middle),
-        other => Err(format!("{method}: unknown button {other:?} (primary, secondary, middle)")),
-    }
-}
-
-fn modifiers(v: Option<&Value>) -> Result<egui::Modifiers, String> {
-    let mut m = egui::Modifiers::NONE;
-    for name in v.and_then(Value::as_array).into_iter().flatten() {
-        match name.as_str().unwrap_or("") {
-            "command" | "cmd" => m.command = true,
-            "shift" => m.shift = true,
-            "alt" | "option" => m.alt = true,
-            "ctrl" | "control" => m.ctrl = true,
-            "mac_cmd" => m.mac_cmd = true,
-            other => return Err(format!("ui.key: unknown modifier {other:?} (command, shift, alt, ctrl)")),
-        }
-    }
-    // "command" is ⌘ on macOS and Ctrl elsewhere, as egui expects.
-    if m.command {
-        if cfg!(target_os = "macos") {
-            m.mac_cmd = true;
-        } else {
-            m.ctrl = true;
-        }
-    }
-    Ok(m)
-}
-
-fn rect_param(v: &Value) -> Result<egui::Rect, String> {
-    let a: Vec<f32> = v.as_array().map(|a| a.iter().filter_map(Value::as_f64).map(|f| f as f32).collect()).unwrap_or_default();
-    match a.as_slice() {
-        [x0, y0, x1, y1] if x1 > x0 && y1 > y0 => Ok(egui::Rect::from_min_max(egui::pos2(*x0, *y0), egui::pos2(*x1, *y1))),
-        _ => Err("region must be [x0, y0, x1, y1] in points".into()),
-    }
-}
-
-/// Encode (a region of) a screenshot as PNG; the reply carries base64 data and the size.
-fn screenshot_png(image: &egui::ColorImage, region: Option<egui::Rect>, ppp: f32) -> Reply {
-    let [w, h] = image.size;
-    let (x0, y0, x1, y1) = match region {
-        Some(r) => {
-            let px = |v: f32, max: usize| ((v * ppp).round().max(0.0) as usize).min(max);
-            (px(r.min.x, w), px(r.min.y, h), px(r.max.x, w), px(r.max.y, h))
-        }
-        None => (0, 0, w, h),
-    };
-    if x1 <= x0 || y1 <= y0 {
-        return Err("the region is outside the window".into());
-    }
-    let mut rgba = Vec::with_capacity((x1 - x0) * (y1 - y0) * 4);
-    for y in y0..y1 {
-        for px in &image.pixels[y * w + x0..y * w + x1] {
-            rgba.extend_from_slice(&px.to_srgba_unmultiplied());
-        }
-    }
-    let (cw, ch) = ((x1 - x0) as u32, (y1 - y0) as u32);
-    let mut out = Vec::new();
-    let mut enc = png::Encoder::new(&mut out, cw, ch);
-    enc.set_color(png::ColorType::Rgba);
-    enc.set_depth(png::BitDepth::Eight);
-    let mut writer = enc.write_header().map_err(|e| e.to_string())?;
-    writer.write_image_data(&rgba).map_err(|e| e.to_string())?;
-    writer.finish().map_err(|e| e.to_string())?;
-    use base64::Engine as _;
-    Ok(json!({ "png_base64": base64::engine::general_purpose::STANDARD.encode(out), "width": cw, "height": ch, "pixels_per_point": ppp }))
-}
-
-impl Host for crate::PdfCraftApp {
-    fn dock(&mut self, reset: bool, params: &Value) -> Reply {
-        crate::docking::command(self, reset, params)
-    }
-
-    fn quit(&mut self, ctx: &egui::Context) -> bool {
-        self.request_quit(ctx)
-    }
-
-    fn state(&self) -> Value {
-        let active = self.active.and_then(|i| self.views.get(i));
-        let docs: Vec<Value> = self
-            .views
-            .iter()
-            .enumerate()
-            .filter_map(|(i, v)| {
-                let d = self.session.get(v.id)?;
-                Some(json!({ "tab": i, "doc": v.id.0, "name": d.name, "path": d.path, "pages": d.info.pages.len(), "dirty": d.dirty, "active": self.active == Some(i) }))
-            })
-            .collect();
-        #[cfg(not(target_arch = "wasm32"))]
-        let pending_opens: Vec<Value> =
-            self.pending_opens.iter().map(|pending| json!({ "token": pending.token, "name": pending.name, "path": pending.path })).collect();
-        #[cfg(target_arch = "wasm32")]
-        let pending_opens: Vec<Value> = Vec::new();
-        json!({
-            "docking": self.docking,
-            "documents": docs,
-            "pending_opens": pending_opens,
-            "active": active.map(|v| json!({
-                "doc": v.id.0,
-                "page": v.current + 1,
-                "zoom_percent": (v.zoom * 100.0).round(),
-                "fit": format!("{:?}", v.fit),
-                "layout": format!("{:?}", v.layout),
-                "continuous": v.continuous(),
-                "page_gaps": v.show_page_gaps,
-                "organize": v.organize,
-                "grid_zoom": v.grid_zoom(),
-                "thumbnail_zoom": v.thumbnail_zoom(),
-                // Pages picked in the organize grid or the Pages panel (empty: the current page).
-                "selected_pages": v.selected.iter().map(|p| p + 1).collect::<Vec<_>>(),
-                "auto_scrolling": v.auto_scrolling(),
-                "raster_memory": v.raster_memory(),
-                "viewport": [v.viewport_rect().min.x, v.viewport_rect().min.y, v.viewport_rect().max.x, v.viewport_rect().max.y],
-                "find_open": v.find.is_some(),
-                "page_errors": v.page_errors().iter().map(|(p, e)| json!({ "page": p + 1, "error": e })).collect::<Vec<_>>(),
-                // Where pages are on screen (points), to aim ui.click / ui.drag at page content.
-                "pages_on_screen": v.visible_page_rects().iter().map(|(p, r)| json!({ "page": p + 1, "rect": [r.min.x, r.min.y, r.max.x, r.max.y] })).collect::<Vec<_>>(),
-                "selected_comment": v.comments.selected.map(|(p, i)| json!({ "page": p + 1, "index": i + 1 })),
-                "comment_composer_open": v.comments.composer.is_some(),
-            })),
-            // The Combine files tab: how its files show, and each grid thumbnail's state.
-            "combine": {
-                "showing": self.combine_showing(),
-                "view": self.combine_view.as_str(),
-                "zoom": self.combine_zoom,
-                "files": self.combine_draft.iter().map(|f| f.name.clone()).collect::<Vec<_>>(),
-                "selected": self.combine_selection(),
-                "thumbnails": self.combine_thumbnails().iter().map(|t| format!("{t:?}")).collect::<Vec<_>>(),
-                "expanded": self.combine_expanded().iter().filter_map(|i| self.combine_draft.get(*i).map(|f| f.name.clone())).collect::<Vec<_>>(),
-                "preview": self.combine_preview().map(|(file, page, render)| json!({ "file": file, "page": page + 1, "render": format!("{render:?}") })),
-            },
-            "quick_tool": match self.quick_tool {
-                crate::QuickTool::Measure(t) => format!("measure-{}", t.name()),
-                crate::QuickTool::Select => "select".to_string(),
-                crate::QuickTool::Hand => "hand".to_string(),
-                crate::QuickTool::Crop => "crop".to_string(),
-                crate::QuickTool::EnhanceCamera => "enhance-camera".to_string(),
-                crate::QuickTool::Redact => "redact".to_string(),
-                crate::QuickTool::AddText => "add-text".to_string(),
-                crate::QuickTool::EditText => "edit-text".to_string(),
-                crate::QuickTool::Link => "link".to_string(),
-                crate::QuickTool::SignArea { certify: false } => "sign".to_string(),
-                crate::QuickTool::SignArea { certify: true } => "certify".to_string(),
-                crate::QuickTool::MarqueeZoom => "marquee-zoom".to_string(),
-                crate::QuickTool::Snapshot => "snapshot".to_string(),
-                crate::QuickTool::ColumnSelect => "column-select".to_string(),
-                crate::QuickTool::Stamp(k) => format!("stamp-{}", k.name().trim_start_matches("PC").to_ascii_lowercase()),
-                crate::QuickTool::CustomStamp(i) => format!("custom-stamp-{i}"),
-                crate::QuickTool::Fill(f) => format!("fill-{}", f.command().trim_start_matches("sign.fill.")),
-                crate::QuickTool::Field(f) => format!("field-{}", f.command().trim_start_matches("form.add.")),
-                crate::QuickTool::Comment(t) => t.command().trim_start_matches("comment.").to_string(),
-            },
-            "home": self.active.is_none(),
-            "mode": format!("{:?}", self.mode),
-            "default_mode": self.default_mode,
-            "left_panel": if self.left_open { json!(format!("{:?}", self.left)) } else { Value::Null },
-            "tools_side": if self.docking.tools_on_right() { "right" } else { "left" },
-            "right_panel": self.right.map(|r| format!("{r:?}")),
-            "dialog": self.dialog.map(|d| format!("{d:?}")),
-            "palette_open": self.palette_open,
-            "theme": format!("{:?}", self.theme),
-            "theme_preference": self.theme_preference,
-            "language": self.language,
-            "notice": self.toast.as_ref().map(|t| t.0.clone()),
-            "progress": self.progress_notice.as_ref().map(|p| json!({ "label": p.label, "fraction": p.fraction })),
-            "password_prompt": self.password_prompt.is_some(),
-            "close_prompt": self.close_request.is_some(),
-        })
-    }
-
-    fn command(&mut self, id: &str) -> Reply {
-        let spec = pdfcraft_engine::commands::command(id).ok_or_else(|| format!("unknown command {id:?} (see ui.commands)"))?;
-        if !self.command_enabled(spec) {
-            return Err(format!("{id} is disabled right now"));
-        }
-        self.execute(id);
-        Ok(json!({ "ran": id }))
-    }
-
-    fn commands(&self) -> Value {
-        let mut list: Vec<Value> = pdfcraft_engine::commands::COMMANDS
-            .iter()
-            .map(|c| json!({ "id": c.id, "label": c.label, "menu": c.menu, "enabled": self.command_enabled(c), "shortcut": c.shortcut.map(|s| s.label(cfg!(target_os = "macos"))) }))
-            .collect();
-        list.push(json!({"id": "ui.dock", "label": "Arrange Panel", "enabled": true, "params": "action, or operation/panel; move: target/zone/before; float/moveFloating: rect; resizeSplit: path/size; setStackOpen: open; resizeStack: height"}));
-        json!({ "commands": list })
-    }
-
-    fn set(&mut self, key: &str, value: &str) -> Reply {
-        self.set_option(key, value).map(|()| json!({ "set": key, "value": value }))
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn open(&mut self, path: &str) -> Reply {
-        match self.open_path(path) {
-            crate::OpenOutcome::Opened => Ok(json!({ "opened": path, "password_prompt": self.password_prompt.is_some() })),
-            crate::OpenOutcome::Focused => Ok(json!({ "opened": path, "focused": true })),
-            crate::OpenOutcome::Pending => Ok(json!({ "accepted": path, "pending": true })),
-            crate::OpenOutcome::Failed => Err(self.toast.as_ref().map(|t| t.0.clone()).unwrap_or_else(|| format!("couldn't open {path}"))),
-        }
-    }
-
-    #[cfg(target_arch = "wasm32")]
-    fn open(&mut self, _path: &str) -> Reply {
-        Err("ui.open needs a file system; on the web, drop the file on the page".into())
-    }
-}
-
-// ---- transport (native only) -----------------------------------------------------------------
-
-/// Where a running app's control channel can be reached (written to the `--control` file).
-#[cfg(not(target_arch = "wasm32"))]
-pub struct Endpoint {
-    pub port: u16,
-    pub token: String,
-}
-
-/// What a connection may do before it authenticates, so an unauthenticated local client cannot
-/// hold a thread for ever or exhaust them (#1806).
-#[cfg(not(target_arch = "wasm32"))]
-#[derive(Clone, Copy)]
-struct Limits {
-    /// How long a connection has to authenticate, counted from its acceptance: an absolute
-    /// deadline, so a client feeding one byte at a time cannot extend it.
-    auth_deadline: std::time::Duration,
-    /// How many connections may wait for authentication at once; further ones are refused.
-    max_unauthenticated: usize,
-    /// How long a write may block on a client that never reads its replies.
-    write_timeout: std::time::Duration,
-    /// How long a connection refused after a reply is kept half-open, discarding input, so the
-    /// reply is not lost to a reset (see [`close_after_reply`]).
-    linger: std::time::Duration,
-    /// How many refused connections may linger at once. A lingering connection has given back
-    /// its place among [`Self::max_unauthenticated`], so this is what bounds their threads;
-    /// beyond it a refused connection is closed at once.
-    max_lingering: usize,
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-const LIMITS: Limits = Limits {
-    auth_deadline: std::time::Duration::from_secs(10),
-    max_unauthenticated: 8,
-    write_timeout: std::time::Duration::from_secs(30),
-    linger: std::time::Duration::from_secs(1),
-    max_lingering: 8,
-};
-
-/// One of a limited number of places, given back when dropped: a place among
-/// [`Limits::max_unauthenticated`] (given back when the connection authenticates or is refused,
-/// and on every way its thread can end), or among [`Limits::max_lingering`].
-#[cfg(not(target_arch = "wasm32"))]
-struct Slot(std::sync::Arc<std::sync::atomic::AtomicUsize>);
-
-#[cfg(not(target_arch = "wasm32"))]
-impl Slot {
-    fn take(waiting: &std::sync::Arc<std::sync::atomic::AtomicUsize>, max: usize) -> Option<Self> {
-        use std::sync::atomic::Ordering;
-        let mut n = waiting.load(Ordering::Acquire);
-        loop {
-            if n >= max {
-                return None;
-            }
-            match waiting.compare_exchange_weak(n, n.saturating_add(1), Ordering::AcqRel, Ordering::Acquire) {
-                Ok(_) => return Some(Slot(waiting.clone())),
-                Err(now) => n = now,
-            }
-        }
-    }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-impl Drop for Slot {
-    fn drop(&mut self) {
-        self.0.fetch_sub(1, std::sync::atomic::Ordering::AcqRel);
-    }
-}
-
-/// The reading half of a connection, with the authentication deadline: every read before it
-/// gets the time left as its timeout, and none at all once it has passed.
-#[cfg(not(target_arch = "wasm32"))]
-struct Reading {
-    stream: std::net::TcpStream,
-    until: Option<std::time::Instant>,
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-impl std::io::Read for Reading {
-    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
-        if let Some(until) = self.until {
-            let left = until.saturating_duration_since(std::time::Instant::now());
-            if left.is_zero() {
-                return Err(std::io::Error::new(std::io::ErrorKind::TimedOut, "the authentication deadline passed"));
-            }
-            self.stream.set_read_timeout(Some(left))?;
-        }
-        self.stream.read(buf)
-    }
-}
-
-/// Close a connection whose last reply has just been written without losing that reply.
-///
-/// Closing a socket with input still unread makes the kernel send a reset instead of a FIN, and
-/// the reset can discard the reply before the client reads it (Linux does): a client still
-/// sending when it is refused would never learn why. So send FIN first, then read and discard
-/// whatever arrives until the client closes its side or `linger` passes, and only then close.
-///
-/// Only [`Limits::max_lingering`] connections linger at once: `place` is one of those places,
-/// taken by [`refuse`] before the reply was written, and held for the drain only. Without one
-/// the connection is closed at once after the FIN, accepting the risk of a reset rather than
-/// holding another thread.
-#[cfg(not(target_arch = "wasm32"))]
-fn close_after_reply(reading: &mut Reading, place: Option<Slot>, linger: std::time::Duration) {
-    use std::io::Read;
-    let _ = reading.stream.shutdown(std::net::Shutdown::Write);
-    let Some(_place) = place else { return };
-    reading.until = Some(std::time::Instant::now() + linger);
-    let mut sink = [0u8; 1024];
-    // Each read is bounded by the time left, and none is made once `linger` has passed.
-    while matches!(reading.read(&mut sink), Ok(n) if n > 0) {}
-}
-
-/// A connection is being refused before `auth`: give back its place among those waiting to
-/// authenticate, so it does not keep a real client out while it lingers, and take a place to
-/// linger in if one is free. Done before the reply is written, so a client that has read the
-/// reply sees the places as they will be.
-#[cfg(not(target_arch = "wasm32"))]
-fn refuse(slot: &mut Option<Slot>, lingering: &std::sync::Arc<std::sync::atomic::AtomicUsize>, limits: Limits) -> Option<Slot> {
-    drop(slot.take());
-    Slot::take(lingering, limits.max_lingering)
-}
-
-/// Listen on `127.0.0.1` (random port) and forward authenticated requests to `client`.
-///
-/// Protocol: newline-delimited JSON-RPC 2.0. The first request on a connection must be
-/// `{"method": "auth", "params": {"token": …}}`; anything else closes the connection, and so does
-/// a line longer than [`MAX_AUTH_LINE`] before that, or [`LIMITS`] passing without it.
-#[cfg(not(target_arch = "wasm32"))]
-pub fn serve(client: ControlClient) -> std::io::Result<Endpoint> {
-    serve_with(client, LIMITS)
-}
-
-/// How long the accepting thread waits after a failed accept. Accepting can keep failing, for
-/// example while the process has no file descriptors left, and retrying at once would keep a
-/// core busy until it recovers. The single-instance listener waits the same way.
-#[cfg(not(target_arch = "wasm32"))]
-const ACCEPT_RETRY: std::time::Duration = std::time::Duration::from_millis(100);
-
-/// The connections `incoming` accepts, calling `wait` after each failed accept.
-#[cfg(not(target_arch = "wasm32"))]
-fn accepted<T>(incoming: impl Iterator<Item = std::io::Result<T>>, mut wait: impl FnMut()) -> impl Iterator<Item = T> {
-    incoming.filter_map(move |stream| stream.map_err(|_| wait()).ok())
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-fn serve_with(client: ControlClient, limits: Limits) -> std::io::Result<Endpoint> {
-    use std::io::{BufReader, Write};
-    let listener = std::net::TcpListener::bind(("127.0.0.1", 0))?;
-    let port = listener.local_addr()?.port();
-    let token = random_token()?;
-    let expected = token.clone();
-    let waiting = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-    let lingering = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-    std::thread::Builder::new().name("pdfcraft-control".into()).spawn(move || {
-        for stream in accepted(listener.incoming(), || std::thread::sleep(ACCEPT_RETRY)) {
-            let _ = stream.set_write_timeout(Some(limits.write_timeout));
-            // Admitted only while fewer than the limit wait to authenticate: refused on the
-            // accepting thread, so a refused connection costs no thread at all.
-            let Some(slot) = Slot::take(&waiting, limits.max_unauthenticated) else {
-                let mut write = stream;
-                let e = rpc_error(Value::Null, -32003, "too many connections waiting to authenticate; try again later");
-                let _ = writeln!(write, "{e}").and_then(|_| write.flush());
-                continue;
-            };
-            let client = client.clone();
-            let expected = expected.clone();
-            let lingering = lingering.clone();
-            let _ = std::thread::Builder::new().name("pdfcraft-control-conn".into()).spawn(move || {
-                // Held until `auth` succeeds; given back however this thread ends.
-                let mut slot = Some(slot);
-                let Ok(read) = stream.try_clone() else { return };
-                let mut write = stream;
-                let mut authed = false;
-                let mut reader = BufReader::new(Reading { stream: read, until: Some(std::time::Instant::now() + limits.auth_deadline) });
-                let mut buf = Vec::new();
-                loop {
-                    // Until `auth` succeeds, lines are capped at MAX_AUTH_LINE; afterwards they
-                    // are read whole, as before.
-                    let max = if authed { usize::MAX } else { MAX_AUTH_LINE };
-                    match read_line_limited(&mut reader, &mut buf, max) {
-                        Ok(LineRead::Line) => {}
-                        // The deadline passed before `auth`: say so and close.
-                        Err(e) if !authed && matches!(e.kind(), std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock) => {
-                            let secs = limits.auth_deadline.as_secs_f64();
-                            let e = rpc_error(Value::Null, -32004, &format!("not authenticated within {secs} s"));
-                            let place = refuse(&mut slot, &lingering, limits);
-                            if writeln!(write, "{e}").and_then(|_| write.flush()).is_ok() {
-                                close_after_reply(reader.get_mut(), place, limits.linger);
-                            }
-                            break;
-                        }
-                        // End of stream or a failed read ends the connection, as before.
-                        Ok(LineRead::End) | Err(_) => break,
-                        Ok(LineRead::TooLong) => {
-                            let e = rpc_error(Value::Null, -32600, &format!("request line longer than {max} bytes before auth"));
-                            let place = refuse(&mut slot, &lingering, limits);
-                            if writeln!(write, "{e}").and_then(|_| write.flush()).is_ok() {
-                                close_after_reply(reader.get_mut(), place, limits.linger);
-                            }
-                            break;
-                        }
-                    }
-                    // Bytes that aren't UTF-8 end the connection, as `BufRead::lines` did.
-                    let Ok(line) = std::str::from_utf8(&buf) else { break };
-                    if line.trim().is_empty() {
-                        continue;
-                    }
-                    let (reply, close) = match serde_json::from_str::<Value>(line) {
-                        // Before `auth`, like any other first request, this closes the connection.
-                        Err(e) => (rpc_error(Value::Null, -32700, &format!("parse error: {e}")), !authed),
-                        Ok(msg) => {
-                            let id = msg.get("id").cloned().unwrap_or(Value::Null);
-                            let method = msg.get("method").and_then(Value::as_str).unwrap_or("");
-                            let params = msg.get("params").cloned().unwrap_or(Value::Null);
-                            if !authed {
-                                let ok =
-                                    method == "auth" && params.get("token").and_then(Value::as_str).is_some_and(|t| constant_time_eq(t, &expected));
-                                authed = ok;
-                                if ok {
-                                    // Authenticated: no deadline from here on, and its place is free.
-                                    reader.get_mut().until = None;
-                                    let _ = reader.get_mut().stream.set_read_timeout(None);
-                                    drop(slot.take());
-                                    (json!({ "jsonrpc": "2.0", "id": id, "result": { "ok": true } }), false)
-                                } else {
-                                    (rpc_error(id, -32001, "authenticate first: auth {token}"), true)
-                                }
-                            } else {
-                                let rx = client.send(method, params);
-                                match rx.recv_timeout(std::time::Duration::from_secs(30)) {
-                                    Ok(Ok(v)) => (json!({ "jsonrpc": "2.0", "id": id, "result": v }), false),
-                                    Ok(Err(e)) => (rpc_error(id, -32000, &e), false),
-                                    Err(_) => (rpc_error(id, -32002, "the app did not answer within 30 s"), false),
-                                }
-                            }
-                        }
-                    };
-                    // `close` is only ever set before `auth`.
-                    let place = if close { refuse(&mut slot, &lingering, limits) } else { None };
-                    if writeln!(write, "{reply}").and_then(|_| write.flush()).is_err() {
-                        break;
-                    }
-                    if close {
-                        close_after_reply(reader.get_mut(), place, limits.linger);
-                        break;
-                    }
-                }
-            });
-        }
-    })?;
-    Ok(Endpoint { port, token })
-}
-
-/// Longest line read before a connection has authenticated. The only acceptable request then is
-/// `auth`, about a hundred bytes; a longer line is refused without buffering the rest of it.
-#[cfg(not(target_arch = "wasm32"))]
-const MAX_AUTH_LINE: usize = 4 * 1024;
-
-/// What [`read_line_limited`] found.
-#[cfg(not(target_arch = "wasm32"))]
-#[derive(Debug, PartialEq, Eq)]
-enum LineRead {
-    /// A line, now in the buffer (newline and a trailing `\r` stripped).
-    Line,
-    /// End of stream.
-    End,
-    /// The line is longer than the limit; at most limit + 1 bytes of it were read.
-    TooLong,
-}
-
-/// Read one `\n`-terminated line of at most `max` bytes into `buf`.
-#[cfg(not(target_arch = "wasm32"))]
-fn read_line_limited(reader: &mut impl std::io::BufRead, buf: &mut Vec<u8>, max: usize) -> std::io::Result<LineRead> {
-    use std::io::{BufRead, Read};
-    buf.clear();
-    // `take` bounds what is buffered for one line: never more than `max` + 1 bytes.
-    let limit = u64::try_from(max).unwrap_or(u64::MAX).saturating_add(1);
-    if reader.take(limit).read_until(b'\n', buf)? == 0 {
-        return Ok(LineRead::End);
-    }
-    if buf.last() == Some(&b'\n') {
-        buf.pop();
-        if buf.last() == Some(&b'\r') {
-            buf.pop();
-        }
-        return Ok(LineRead::Line);
-    }
-    // No newline: either the limit was passed, or this is a last line before end of stream.
-    Ok(if buf.len() > max { LineRead::TooLong } else { LineRead::Line })
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-fn rpc_error(id: Value, code: i64, message: &str) -> Value {
-    json!({ "jsonrpc": "2.0", "id": id, "error": { "code": code, "message": message } })
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-fn constant_time_eq(a: &str, b: &str) -> bool {
-    a.len() == b.len() && a.bytes().zip(b.bytes()).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
-}
-
-/// 128 random bits from the OS, hex-encoded.
-#[cfg(not(target_arch = "wasm32"))]
-fn random_token() -> std::io::Result<String> {
-    let mut bytes = [0u8; 16];
-    getrandom::fill(&mut bytes).map_err(|e| std::io::Error::other(e.to_string()))?;
-    Ok(bytes.iter().map(|b| format!("{b:02x}")).collect())
 }
 
 #[cfg(test)]
-mod transport_tests {
-    /// A failed accept is followed by a wait before the next one, so a listener that keeps
-    /// failing does not spin, and the connections around the failures still come through.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn a_failed_accept_waits_before_the_next() {
-        let failed = || Err(std::io::Error::other("no file descriptors left"));
-        let incoming = vec![failed(), Ok(1), failed(), failed(), Ok(2)];
-        let mut waits = 0;
-        let connections: Vec<i32> = super::accepted(incoming.into_iter(), || waits += 1).collect();
-        assert_eq!(connections, [1, 2]);
-        assert_eq!(waits, 3, "one wait per failed accept");
-    }
-
-    /// Before authenticating, a line that isn't JSON gets a parse error and closes the
-    /// connection, as [`super::serve`] documents for any first request other than `auth`.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn malformed_input_before_auth_closes_the_connection() {
-        use std::io::{BufRead, BufReader, ErrorKind, Write};
-        let (_control, client) = super::attach(&egui::Context::default());
-        let ep = super::serve(client).unwrap();
-        let s = std::net::TcpStream::connect(("127.0.0.1", ep.port)).unwrap();
-        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
-        writeln!(s.try_clone().unwrap(), "not json").unwrap();
-        let mut r = BufReader::new(s);
-        let mut first = String::new();
-        r.read_line(&mut first).unwrap();
-        let reply: serde_json::Value = serde_json::from_str(&first).unwrap();
-        assert_eq!(reply["error"]["code"], -32700, "{first}");
-        // Closed: end of stream (or a reset), not a connection left waiting for more input.
-        let mut next = String::new();
-        let closed = match r.read_line(&mut next) {
-            Ok(n) => n == 0,
-            Err(e) => matches!(e.kind(), ErrorKind::ConnectionReset | ErrorKind::ConnectionAborted),
-        };
-        assert!(closed, "the connection stayed open: {next:?}");
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn lines_are_read_up_to_the_limit() {
-        use super::{LineRead, read_line_limited};
-        let mut buf = Vec::new();
-        let mut input: &[u8] = b"aaaaaaaaaa\nbb\r\ncc";
-        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::Line);
-        assert_eq!(buf, b"aaaaaaaaaa", "a line exactly at the limit is accepted");
-        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::Line);
-        assert_eq!(buf, b"bb", "CRLF is stripped");
-        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::Line);
-        assert_eq!(buf, b"cc", "a last line without a newline is still read");
-        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::End, "then end of stream");
-        let long = [b'x'; 100];
-        let mut input: &[u8] = &long;
-        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::TooLong);
-        assert_eq!(input.len(), 100 - 11, "at most limit + 1 bytes are read; the rest is left");
-    }
-
-    /// Before authenticating, a line longer than [`super::MAX_AUTH_LINE`] is refused as soon as
-    /// the limit is passed (no newline needed) and the connection is closed.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn an_overlong_line_before_auth_is_refused() {
-        use std::io::{BufRead, BufReader, ErrorKind, Write};
-        let (_control, client) = super::attach(&egui::Context::default());
-        let ep = super::serve(client).unwrap();
-        let s = std::net::TcpStream::connect(("127.0.0.1", ep.port)).unwrap();
-        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
-        // Exactly one byte over the limit, without a newline: the server reads it all, so the
-        // close below is a clean end of stream.
-        s.try_clone().unwrap().write_all(&vec![b'x'; super::MAX_AUTH_LINE + 1]).unwrap();
-        let mut r = BufReader::new(s);
-        let mut first = String::new();
-        r.read_line(&mut first).unwrap();
-        let reply: serde_json::Value = serde_json::from_str(&first).unwrap();
-        assert_eq!(reply["error"]["code"], -32600, "{first}");
-        let mut next = String::new();
-        let closed = match r.read_line(&mut next) {
-            Ok(n) => n == 0,
-            Err(e) => matches!(e.kind(), ErrorKind::ConnectionReset | ErrorKind::ConnectionAborted),
-        };
-        assert!(closed, "the connection stayed open: {next:?}");
-    }
-
-    /// Small limits for the tests below: a 300 ms deadline, two places to wait in.
-    #[cfg(not(target_arch = "wasm32"))]
-    const TEST_LIMITS: super::Limits = super::Limits {
-        auth_deadline: std::time::Duration::from_millis(300),
-        max_unauthenticated: 2,
-        write_timeout: std::time::Duration::from_secs(5),
-        linger: std::time::Duration::from_secs(1),
-        max_lingering: 2,
-    };
-
-    /// The next line the server sends, as JSON, or `None` when it closed the connection instead.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn next_line(r: &mut std::io::BufReader<std::net::TcpStream>) -> Option<serde_json::Value> {
-        use std::io::BufRead;
-        let mut line = String::new();
-        match r.read_line(&mut line) {
-            Ok(0) | Err(_) => None,
-            Ok(_) => Some(serde_json::from_str(&line).unwrap()),
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn connect(port: u16) -> std::net::TcpStream {
-        let s = std::net::TcpStream::connect(("127.0.0.1", port)).unwrap();
-        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
-        s
-    }
-
-    /// #1806: a connection that never authenticates is closed at the deadline, counted from its
-    /// acceptance, and a client feeding a byte at a time cannot push that deadline back.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn an_unauthenticated_connection_is_closed_at_the_deadline() {
-        use std::io::{BufReader, Write};
-        let (_control, client) = super::attach(&egui::Context::default());
-        let ep = super::serve_with(client, TEST_LIMITS).unwrap();
-        // Idle.
-        let started = std::time::Instant::now();
-        let mut r = BufReader::new(connect(ep.port));
-        let reply = next_line(&mut r).expect("the server says why before closing");
-        assert_eq!(reply["error"]["code"], -32004, "{reply}");
-        let took = started.elapsed();
-        assert!(took >= std::time::Duration::from_millis(250) && took < std::time::Duration::from_secs(3), "{took:?}");
-        assert!(next_line(&mut r).is_none(), "then the connection is closed");
-        // Dripping: a byte every 50 ms for as long as the server keeps the connection.
-        let started = std::time::Instant::now();
-        let s = connect(ep.port);
-        let mut w = s.try_clone().unwrap();
-        let drip = std::thread::spawn(move || {
-            while w.write_all(b"x").is_ok() {
-                std::thread::sleep(std::time::Duration::from_millis(50));
-                if started.elapsed() > std::time::Duration::from_secs(3) {
-                    break;
-                }
-            }
-        });
-        let mut r = BufReader::new(s);
-        let reply = next_line(&mut r).expect("the server says why before closing");
-        assert_eq!(reply["error"]["code"], -32004, "{reply}");
-        let took = started.elapsed();
-        assert!(took < std::time::Duration::from_secs(2), "the deadline is absolute: {took:?}");
-        drop(r);
-        drip.join().unwrap();
-    }
-
-    /// A client refused while the server still has its input unread gets the reason, not a
-    /// reset: closing on top of unread input sends a reset, which can discard the reply before
-    /// the client reads it (Linux does). Here a line far over the limit leaves most of itself
-    /// unread when the server refuses it.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn a_client_refused_with_input_unread_gets_the_reason() {
-        use std::io::{BufReader, Write};
-        let (_control, client) = super::attach(&egui::Context::default());
-        let ep = super::serve_with(client, TEST_LIMITS).unwrap();
-        let s = connect(ep.port);
-        let mut w = s.try_clone().unwrap();
-        w.write_all(&vec![b'x'; 16 * super::MAX_AUTH_LINE]).unwrap();
-        // Let the server refuse it (and, before the fix, close) before reading the reply.
-        std::thread::sleep(std::time::Duration::from_millis(200));
-        let mut r = BufReader::new(s);
-        let reply = next_line(&mut r).expect("the server says why before closing");
-        assert_eq!(reply["error"]["code"], -32600, "{reply}");
-    }
-
-    /// A refused connection gives back its place among those waiting to authenticate before it
-    /// lingers, so lingering does not keep real clients out.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn a_lingering_connection_holds_no_place_to_authenticate() {
-        use std::io::{BufReader, Write};
-        // A linger far longer than the checks below take, even on a loaded machine.
-        let limits = super::Limits { linger: std::time::Duration::from_secs(5), ..TEST_LIMITS };
-        let (_control, client) = super::attach(&egui::Context::default());
-        let ep = super::serve_with(client, limits).unwrap();
-        let auth = serde_json::json!({ "jsonrpc": "2.0", "id": 1, "method": "auth", "params": { "token": ep.token } });
-        // Refused with most of its line unread, and left open: it lingers for `linger`.
-        let refused = connect(ep.port);
-        refused.try_clone().unwrap().write_all(&vec![b'x'; 16 * super::MAX_AUTH_LINE]).unwrap();
-        let mut r = BufReader::new(refused.try_clone().unwrap());
-        assert_eq!(next_line(&mut r).expect("refused with a reason")["error"]["code"], -32600);
-        // Well within the linger, both places are free for new connections.
-        let started = std::time::Instant::now();
-        let others: Vec<_> = (0..limits.max_unauthenticated).map(|_| connect(ep.port)).collect();
-        for s in &others {
-            // A refused one has already been closed, so its write may fail; its reply says why.
-            let _ = writeln!(s.try_clone().unwrap(), "{auth}");
-            let reply = next_line(&mut BufReader::new(s.try_clone().unwrap())).expect("a reply");
-            assert_eq!(reply["result"]["ok"], true, "admitted while the refused one lingers: {reply}");
-        }
-        assert!(started.elapsed() < limits.linger, "checked while it lingered: {:?}", started.elapsed());
-        drop(refused);
-    }
-
-    /// Only [`super::Limits::max_lingering`] refused connections linger at once: one more still
-    /// gets its reply, and is then closed at once instead of lingering.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn only_so_many_refused_connections_linger() {
-        use std::io::{BufReader, Write};
-        // A linger far longer than the checks below take, even on a loaded machine.
-        let limits = super::Limits { linger: std::time::Duration::from_secs(5), max_lingering: 1, ..TEST_LIMITS };
-        let (_control, client) = super::attach(&egui::Context::default());
-        let ep = super::serve_with(client, limits).unwrap();
-        let bad = r#"{"jsonrpc": "2.0", "id": 1, "method": "page_count"}"#;
-        // The first refused connection takes the only lingering place and keeps it.
-        let first = connect(ep.port);
-        writeln!(first.try_clone().unwrap(), "{bad}").unwrap();
-        let mut r1 = BufReader::new(first.try_clone().unwrap());
-        assert_eq!(next_line(&mut r1).expect("refused with a reason")["error"]["code"], -32001);
-        // The second still gets its reason (it has nothing unread, so no reset)...
-        let second = connect(ep.port);
-        let mut w2 = second.try_clone().unwrap();
-        writeln!(w2, "{bad}").unwrap();
-        let mut r2 = BufReader::new(second.try_clone().unwrap());
-        assert_eq!(next_line(&mut r2).expect("refused with a reason")["error"]["code"], -32001);
-        // ...and is closed outright, not lingering: writing to it soon fails, where a lingering
-        // connection would read and discard for the whole of `linger`.
-        let started = std::time::Instant::now();
-        let closed = loop {
-            if w2.write_all(b"x").is_err() {
-                break true;
-            }
-            if started.elapsed() > limits.linger {
-                break false;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(20));
-        };
-        assert!(closed && started.elapsed() < limits.linger / 2, "it lingered: {:?}", started.elapsed());
-        drop(first);
-    }
-
-    /// #1806: only so many connections may wait to authenticate at once. One more is refused
-    /// on the spot; once a waiting one authenticates or times out, its place is free again.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn only_so_many_connections_may_wait_to_authenticate() {
-        use std::io::{BufReader, Write};
-        let (_control, client) = super::attach(&egui::Context::default());
-        let ep = super::serve_with(client, TEST_LIMITS).unwrap();
-        let auth = serde_json::json!({ "jsonrpc": "2.0", "id": 1, "method": "auth", "params": { "token": ep.token } });
-        let first = connect(ep.port);
-        let second = connect(ep.port);
-        // The kernel accepts a connection before the listener admits it: give the listener a
-        // moment to admit both, well within their deadline.
-        std::thread::sleep(std::time::Duration::from_millis(100));
-        // The third finds both places taken.
-        let mut r3 = BufReader::new(connect(ep.port));
-        let reply = next_line(&mut r3).expect("refused with a reason");
-        assert_eq!(reply["error"]["code"], -32003, "{reply}");
-        assert!(next_line(&mut r3).is_none(), "and closed");
-        // The second authenticates: its place is free, so a new connection is admitted.
-        let mut r2 = BufReader::new(second.try_clone().unwrap());
-        let mut w2 = second.try_clone().unwrap();
-        writeln!(w2, "{auth}").unwrap();
-        assert_eq!(next_line(&mut r2).unwrap()["result"]["ok"], true);
-        let fourth = connect(ep.port);
-        let mut r4 = BufReader::new(fourth.try_clone().unwrap());
-        let mut w4 = fourth.try_clone().unwrap();
-        writeln!(w4, "{auth}").unwrap();
-        assert_eq!(next_line(&mut r4).unwrap()["result"]["ok"], true, "admitted and authenticated");
-        // The first was closed at the deadline (its place freed on that way out too): after it,
-        // another connection is admitted even though the first never authenticated.
-        drop(first);
-        std::thread::sleep(TEST_LIMITS.auth_deadline + std::time::Duration::from_millis(100));
-        let fifth = connect(ep.port);
-        let mut r5 = BufReader::new(fifth.try_clone().unwrap());
-        let mut w5 = fifth.try_clone().unwrap();
-        writeln!(w5, "{auth}").unwrap();
-        assert_eq!(next_line(&mut r5).unwrap()["result"]["ok"], true);
-    }
-
-    /// After `auth` the limit no longer applies: a long line is read as before (here it isn't
-    /// JSON, so it gets a parse error and the connection stays open).
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn long_lines_after_auth_are_still_read() {
-        use std::io::{BufRead, BufReader, Write};
-        let (_control, client) = super::attach(&egui::Context::default());
-        let ep = super::serve(client).unwrap();
-        let s = std::net::TcpStream::connect(("127.0.0.1", ep.port)).unwrap();
-        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
-        let mut w = s.try_clone().unwrap();
-        let mut r = BufReader::new(s);
-        let reply = |r: &mut BufReader<std::net::TcpStream>| {
-            let mut line = String::new();
-            r.read_line(&mut line).unwrap();
-            serde_json::from_str::<serde_json::Value>(&line).unwrap()
-        };
-        let auth = serde_json::json!({ "jsonrpc": "2.0", "id": 1, "method": "auth", "params": { "token": ep.token } });
-        writeln!(w, "{auth}").unwrap();
-        assert_eq!(reply(&mut r)["result"]["ok"], true);
-        writeln!(w, "{}", "x".repeat(4 * super::MAX_AUTH_LINE)).unwrap();
-        assert_eq!(reply(&mut r)["error"]["code"], -32700, "a long line after auth is parsed, not refused");
-        writeln!(w, "y").unwrap();
-        assert_eq!(reply(&mut r)["error"]["code"], -32700, "and the connection is still open");
-    }
-}
+mod lifecycle_tests;
 
 #[cfg(test)]
 mod pointer_tests {
@@ -1433,6 +493,8 @@ mod pointer_tests {
         let slow_dt = (max_duration + 0.25) as f32;
         assert!(f64::from(slow_dt) > max_duration);
         for discard in [false, true] {
+            // This probe draws its own UI with the harness's fonts, not PdfCraftApp::ui.
+            // Exercise the readiness gate explicitly before allowing this host's input.
             let state = Probe {
                 control: None,
                 client: None,
@@ -1481,6 +543,26 @@ mod pointer_tests {
             );
             h.run_steps(3);
             let c = h.state().client.as_ref().unwrap().clone();
+            let probe_pos = h.get_by_label("Click probe").rect().center();
+            let waiting = c.send("ui.click", json!({"x":probe_pos.x,"y":probe_pos.y}));
+            h.run_steps(3);
+            assert!(waiting.try_recv().is_err(), "unready host must defer control input");
+            assert_eq!(h.state().primary, 0);
+            assert!(h.state().events.is_empty());
+            h.state_mut().host.fonts_ready = true;
+            let mut ready_reply = None;
+            for _ in 0..8 {
+                h.step();
+                if let Ok(reply) = waiting.try_recv() {
+                    ready_reply = Some(reply);
+                    break;
+                }
+            }
+            assert!(ready_reply.expect("ready host completes deferred click").is_ok());
+            assert_eq!(h.state().primary, 1);
+            h.state_mut().primary = 0;
+            h.state_mut().events.clear();
+            h.state_mut().discarded = false;
             assert_eq!(h.ctx.options(|o| o.input_options.max_click_duration), max_duration);
             let pos = h.get_by_label("Click probe").rect().center();
             assert_eq!((h.state().primary, h.state().secondary, h.state().disabled), (0, 0, 0));
diff --git a/crates/ui-egui/src/control/host.rs b/crates/ui-egui/src/control/host.rs
new file mode 100644
index 0000000000..62693cda2e
--- /dev/null
+++ b/crates/ui-egui/src/control/host.rs
@@ -0,0 +1,188 @@
+use super::*;
+
+impl Host for crate::PdfCraftApp {
+    /// Cancel any in-progress pointer gesture in every open view.
+    fn cancel_pointer_gestures(&mut self) {
+        for view in &mut self.views {
+            view.cancel_pointer_gestures();
+        }
+    }
+
+    /// The input target: active document, open dialog/prompt, palette and find state.
+    ///
+    /// Synthetic input admitted for one generation is never replayed into another document or
+    /// dialog. Only these identities are hashed, never text or document content.
+    fn input_epoch(&self) -> u64 {
+        use std::hash::{Hash as _, Hasher as _};
+        let mut hasher = std::collections::hash_map::DefaultHasher::new();
+        self.capture_epoch().hash(&mut hasher);
+        // The focused widget is part of the input target: keys typed for one field must not land
+        // in another after focus moves. Only the id value is hashed, never text.
+        let focused = self.ctx.as_ref().and_then(|ctx| ctx.memory(|m| m.focused())).map(|id| id.value());
+        focused.hash(&mut hasher);
+        hasher.finish()
+    }
+
+    /// The captured content: active document and open dialog/prompt, never keyboard focus.
+    fn capture_epoch(&self) -> u64 {
+        use std::hash::{Hash as _, Hasher as _};
+        let mut hasher = std::collections::hash_map::DefaultHasher::new();
+        let doc = self.active.and_then(|i| self.views.get(i)).map(|v| v.id.0);
+        doc.hash(&mut hasher);
+        format!(
+            "{:?}/{:?}/{:?}/{:?}/{:?}",
+            self.dialog,
+            self.password_prompt.is_some(),
+            self.palette_open,
+            self.close_request.is_some(),
+            self.active.and_then(|i| self.views.get(i)).and_then(|v| v.find.as_ref().map(|_| true)),
+        )
+        .hash(&mut hasher);
+        hasher.finish()
+    }
+
+    /// Control requests wait for the first UI pass that installs fonts; a font-gated early
+    /// return cannot consume injected input or issue a screenshot.
+    fn accepts_input(&self) -> bool {
+        self.fonts_ready
+    }
+
+    fn panel(&mut self, reset: bool, params: &Value) -> Reply {
+        crate::side_panels::command(self, reset, params)
+    }
+
+    fn quit(&mut self, ctx: &egui::Context) -> bool {
+        self.request_quit(ctx)
+    }
+
+    fn state(&self) -> Value {
+        let active = self.active.and_then(|i| self.views.get(i));
+        let docs: Vec<Value> = self
+            .views
+            .iter()
+            .enumerate()
+            .filter_map(|(i, v)| {
+                let d = self.session.get(v.id)?;
+                Some(json!({ "tab": i, "doc": v.id.0, "name": d.name, "path": d.path, "pages": d.info.pages.len(), "dirty": d.dirty, "active": self.active == Some(i) }))
+            })
+            .collect();
+        #[cfg(not(target_arch = "wasm32"))]
+        let pending_opens: Vec<Value> =
+            self.pending_opens.iter().map(|pending| json!({ "token": pending.token, "name": pending.name, "path": pending.path })).collect();
+        #[cfg(target_arch = "wasm32")]
+        let pending_opens: Vec<Value> = Vec::new();
+        json!({
+            "side_panels": crate::side_panels::state(self),
+            "documents": docs,
+            "pending_opens": pending_opens,
+            "active": active.map(|v| json!({
+                "doc": v.id.0,
+                "page": v.current + 1,
+                "zoom_percent": (v.zoom * 100.0).round(),
+                "fit": format!("{:?}", v.fit),
+                "layout": format!("{:?}", v.layout),
+                "continuous": v.continuous(),
+                "page_gaps": v.show_page_gaps,
+                "organize": v.organize,
+                "grid_zoom": v.grid_zoom(),
+                "thumbnail_zoom": v.thumbnail_zoom(),
+                // Pages picked in the organize grid or the Pages panel (empty: the current page).
+                "selected_pages": v.selected.iter().map(|p| p + 1).collect::<Vec<_>>(),
+                "auto_scrolling": v.auto_scrolling(),
+                "raster_memory": v.raster_memory(),
+                "viewport": [v.viewport_rect().min.x, v.viewport_rect().min.y, v.viewport_rect().max.x, v.viewport_rect().max.y],
+                "find_open": v.find.is_some(),
+                "page_errors": v.page_errors().iter().map(|(p, e)| json!({ "page": p + 1, "error": e })).collect::<Vec<_>>(),
+                // Where pages are on screen (points), to aim ui.click / ui.drag at page content.
+                "pages_on_screen": v.visible_page_rects().iter().map(|(p, r)| json!({ "page": p + 1, "rect": [r.min.x, r.min.y, r.max.x, r.max.y] })).collect::<Vec<_>>(),
+                "selected_comment": v.comments.selected.map(|(p, i)| json!({ "page": p + 1, "index": i + 1 })),
+                "comment_composer_open": v.comments.composer.is_some(),
+            })),
+            // The Combine files tab: how its files show, and each grid thumbnail's state.
+            "combine": {
+                "showing": self.combine_showing(),
+                "view": self.combine_view.as_str(),
+                "zoom": self.combine_zoom,
+                "files": self.combine_draft.iter().map(|f| f.name.clone()).collect::<Vec<_>>(),
+                "selected": self.combine_selection(),
+                "thumbnails": self.combine_thumbnails().iter().map(|t| format!("{t:?}")).collect::<Vec<_>>(),
+                "expanded": self.combine_expanded().iter().filter_map(|i| self.combine_draft.get(*i).map(|f| f.name.clone())).collect::<Vec<_>>(),
+                "preview": self.combine_preview().map(|(file, page, render)| json!({ "file": file, "page": page + 1, "render": format!("{render:?}") })),
+            },
+            "quick_tool": match self.quick_tool {
+                crate::QuickTool::Measure(t) => format!("measure-{}", t.name()),
+                crate::QuickTool::Select => "select".to_string(),
+                crate::QuickTool::Hand => "hand".to_string(),
+                crate::QuickTool::Crop => "crop".to_string(),
+                crate::QuickTool::EnhanceCamera => "enhance-camera".to_string(),
+                crate::QuickTool::Redact => "redact".to_string(),
+                crate::QuickTool::AddText => "add-text".to_string(),
+                crate::QuickTool::EditText => "edit-text".to_string(),
+                crate::QuickTool::Link => "link".to_string(),
+                crate::QuickTool::SignArea { certify: false } => "sign".to_string(),
+                crate::QuickTool::SignArea { certify: true } => "certify".to_string(),
+                crate::QuickTool::MarqueeZoom => "marquee-zoom".to_string(),
+                crate::QuickTool::Snapshot => "snapshot".to_string(),
+                crate::QuickTool::ColumnSelect => "column-select".to_string(),
+                crate::QuickTool::Stamp(k) => format!("stamp-{}", k.name().trim_start_matches("PC").to_ascii_lowercase()),
+                crate::QuickTool::CustomStamp(i) => format!("custom-stamp-{i}"),
+                crate::QuickTool::Fill(f) => format!("fill-{}", f.command().trim_start_matches("sign.fill.")),
+                crate::QuickTool::Field(f) => format!("field-{}", f.command().trim_start_matches("form.add.")),
+                crate::QuickTool::Comment(t) => t.command().trim_start_matches("comment.").to_string(),
+            },
+            "home": self.active.is_none(),
+            "mode": format!("{:?}", self.mode),
+            "default_mode": self.default_mode,
+            "comment_tool_pinned": self.comment_prefs.pinned,
+            "left_panel": if self.left_open { json!(format!("{:?}", self.left)) } else { Value::Null },
+            "tools_side": if self.side_panels.tools_on_right() { "right" } else { "left" },
+            "right_panel": self.right.map(|r| format!("{r:?}")),
+            "dialog": self.dialog.map(|d| format!("{d:?}")),
+            "palette_open": self.palette_open,
+            "theme": format!("{:?}", self.theme),
+            "theme_preference": self.theme_preference,
+            "language": self.language,
+            "notice": self.toast.as_ref().map(|t| t.0.clone()),
+            "progress": self.progress_notice.as_ref().map(|p| json!({ "label": p.label, "fraction": p.fraction })),
+            "password_prompt": self.password_prompt.is_some(),
+            "close_prompt": self.close_request.is_some(),
+        })
+    }
+
+    fn command(&mut self, id: &str) -> Reply {
+        let spec = pdfcraft_engine::commands::command(id).ok_or_else(|| format!("unknown command {id:?} (see ui.commands)"))?;
+        if !self.command_enabled(spec) {
+            return Err(format!("{id} is disabled right now"));
+        }
+        self.execute(id);
+        Ok(json!({ "ran": id }))
+    }
+
+    fn commands(&self) -> Value {
+        let mut list: Vec<Value> = pdfcraft_engine::commands::COMMANDS
+            .iter()
+            .map(|c| json!({ "id": c.id, "label": c.label, "menu": c.menu, "enabled": self.command_enabled(c), "shortcut": c.shortcut.map(|s| s.label(cfg!(target_os = "macos"))) }))
+            .collect();
+        list.push(json!({"id": "ui.panel", "label": "Side panel", "enabled": true, "params": "panel: tools or side; open: boolean; width: number (clamped to the panel's limits)"}));
+        json!({ "commands": list })
+    }
+
+    fn set(&mut self, key: &str, value: &str) -> Reply {
+        self.set_option(key, value).map(|()| json!({ "set": key, "value": value }))
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open(&mut self, path: &str) -> Reply {
+        match self.open_path(path) {
+            crate::OpenOutcome::Opened => Ok(json!({ "opened": path, "password_prompt": self.password_prompt.is_some() })),
+            crate::OpenOutcome::Focused => Ok(json!({ "opened": path, "focused": true })),
+            crate::OpenOutcome::Pending => Ok(json!({ "accepted": path, "pending": true })),
+            crate::OpenOutcome::Failed => Err(self.toast.as_ref().map(|t| t.0.clone()).unwrap_or_else(|| format!("couldn't open {path}"))),
+        }
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    fn open(&mut self, _path: &str) -> Reply {
+        Err("ui.open needs a file system; on the web, drop the file on the page".into())
+    }
+}
diff --git a/crates/ui-egui/src/control/lifecycle_tests.rs b/crates/ui-egui/src/control/lifecycle_tests.rs
new file mode 100644
index 0000000000..5289a78a86
--- /dev/null
+++ b/crates/ui-egui/src/control/lifecycle_tests.rs
@@ -0,0 +1,906 @@
+use super::*;
+use egui::Plugin as _;
+use egui_kittest::Harness;
+
+/// A request is answered after accepted frames only: a discarded layout pass is not a frame
+/// the agent can see, so it must not advance the count.
+#[test]
+fn discarded_passes_are_not_counted_as_accepted_frames() {
+    let shared = Arc::new(Mutex::new(Shared::default()));
+    let mut plugin = ControlPlugin { shared: shared.clone() };
+    let ctx = egui::Context::default();
+    let mut accepted = egui::FullOutput::default();
+    plugin.output_hook(&ctx, &mut accepted);
+    let mut discarded = egui::FullOutput::default();
+    discarded.platform_output.request_discard_reasons.push(egui::RepaintCause::new_reason("control test discard"));
+    plugin.output_hook(&ctx, &mut discarded);
+    assert_eq!(shared.lock().unwrap().passes, 1, "only the presented pass counts");
+}
+
+/// A frame that requests discard on every pass and hits `max_passes` still presents its
+/// last pass: that presented pass must count, or `Pending::Frames` waits for a frame that
+/// never arrives. This runs the real multi-pass loop rather than a hand-built FullOutput.
+#[test]
+fn a_final_capped_pass_is_counted_as_presented() {
+    let shared = Arc::new(Mutex::new(Shared::default()));
+    let ctx = egui::Context::default();
+    ctx.add_plugin(ControlPlugin { shared: shared.clone() });
+    ctx.options_mut(|o| o.max_passes = 2.try_into().expect("two is non-zero"));
+    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| ui.ctx().request_discard("control test must discard"));
+    output.textures_delta.clear();
+    assert_eq!(output.platform_output.num_completed_passes, 2, "the cap was reached");
+    assert!(!output.platform_output.request_discard_reasons.is_empty(), "the last pass still requested a discard");
+    assert_eq!(shared.lock().unwrap().passes, 1, "the presented final pass counts once");
+}
+
+/// `max_passes` above two still counts a frame that settles after earlier discarded passes:
+/// egui clears the previous pass's discard reasons at the start of each pass, so the merged
+/// output of a presented final pass is not mistaken for a discarded one.
+#[test]
+fn a_frame_that_settles_before_a_higher_pass_cap_is_counted_once() {
+    let shared = Arc::new(Mutex::new(Shared::default()));
+    let ctx = egui::Context::default();
+    ctx.add_plugin(ControlPlugin { shared: shared.clone() });
+    ctx.options_mut(|o| o.max_passes = 3.try_into().expect("three is non-zero"));
+    let mut pass = 0;
+    let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+        pass += 1;
+        if pass < 3 {
+            ui.ctx().request_discard("control test must discard the first two passes");
+        }
+    });
+    output.textures_delta.clear();
+    assert_eq!(output.platform_output.num_completed_passes, 3, "the third pass settled at the higher cap");
+    assert!(output.platform_output.request_discard_reasons.is_empty(), "earlier discard reasons do not survive the settling pass");
+    assert_eq!(shared.lock().unwrap().passes, 1, "the one presented frame counts once");
+}
+
+/// `ui.key` delivers held modifiers through `ModifiersChanged`, because egui does not derive
+/// `InputState.modifiers` from a key event's own field. Shift+Tab and ⌘Enter handlers read it.
+#[test]
+fn key_commands_deliver_modifier_state() {
+    let held = egui::Modifiers { command: true, ctrl: true, ..egui::Modifiers::NONE };
+    let batches = key_batches(egui::Key::Enter, held);
+    let key = |pressed| egui::Event::Key { key: egui::Key::Enter, physical_key: None, pressed, repeat: false, modifiers: held };
+    assert_eq!(
+        batches,
+        vec![vec![egui::Event::ModifiersChanged(held), key(true)], vec![key(false), egui::Event::ModifiersChanged(egui::Modifiers::NONE)]]
+    );
+    let ctx = egui::Context::default();
+    let mut press_seen = None;
+    ctx.run_ui(egui::RawInput { events: batches[0].clone(), ..Default::default() }, |ui| press_seen = Some(ui.input(|i| i.modifiers)))
+        .textures_delta
+        .clear();
+    let mut release_seen = None;
+    ctx.run_ui(egui::RawInput { events: batches[1].clone(), ..Default::default() }, |ui| release_seen = Some(ui.input(|i| i.modifiers)))
+        .textures_delta
+        .clear();
+    assert_eq!(press_seen, Some(held), "the press sees the modifiers it was sent with");
+    assert_eq!(release_seen, Some(egui::Modifiers::NONE), "the modifier release follows the key-up");
+}
+
+/// A batch admitted for one document/focus generation must not apply after that generation
+/// changes; the request is reported as stale instead of replaying the input.
+#[test]
+fn a_stale_synthetic_batch_is_dropped_and_reported() {
+    let shared = Arc::new(Mutex::new(Shared::default()));
+    let mut plugin = ControlPlugin { shared: shared.clone() };
+    {
+        let mut s = shared.lock().unwrap();
+        s.epoch = 2;
+        s.inject.push_back(RequestBatches {
+            request: 41,
+            epoch: 1,
+            started: false,
+            since: web_time::Instant::now(),
+            release: Vec::new(),
+            batches: VecDeque::from([vec![egui::Event::PointerMoved(egui::pos2(1.0, 1.0))]]),
+        });
+    }
+    let mut raw = egui::RawInput::default();
+    plugin.input_hook(&egui::Context::default(), &mut raw);
+    assert!(raw.events.is_empty(), "stale input must not reach the new document");
+    let s = shared.lock().unwrap();
+    assert_eq!(s.dropped, vec![41]);
+    assert!(s.inject.is_empty());
+}
+
+/// A stale request is dropped alone. A request admitted later for the current generation
+/// behind it still runs: one agent's outdated input must not fail another's.
+#[test]
+fn a_stale_request_does_not_drop_a_later_current_one() {
+    let shared = Arc::new(Mutex::new(Shared::default()));
+    let mut plugin = ControlPlugin { shared: shared.clone() };
+    {
+        let mut s = shared.lock().unwrap();
+        s.epoch = 2;
+        s.inject.push_back(RequestBatches {
+            request: 41,
+            epoch: 1,
+            started: false,
+            since: web_time::Instant::now(),
+            release: Vec::new(),
+            batches: VecDeque::from([vec![egui::Event::PointerMoved(egui::pos2(1.0, 1.0))]]),
+        });
+        s.inject.push_back(RequestBatches {
+            request: 42,
+            epoch: 2,
+            started: false,
+            since: web_time::Instant::now(),
+            release: Vec::new(),
+            batches: VecDeque::from([vec![egui::Event::PointerMoved(egui::pos2(2.0, 2.0))]]),
+        });
+    }
+    let ctx = egui::Context::default();
+    let mut first = egui::RawInput::default();
+    plugin.input_hook(&ctx, &mut first);
+    assert!(first.events.is_empty(), "the stale request is not replayed");
+    let mut second = egui::RawInput::default();
+    plugin.input_hook(&ctx, &mut second);
+    assert_eq!(second.events, [egui::Event::PointerMoved(egui::pos2(2.0, 2.0))], "the current request still applies");
+    let s = shared.lock().unwrap();
+    assert_eq!(s.dropped, vec![41]);
+    assert!(s.inject.is_empty());
+}
+
+/// Once a request has started, the focus/dialog change caused by its own first batch must not
+/// drop its release: a key press without its release leaves `keys_down` stuck.
+#[test]
+fn a_started_request_finishes_its_batches_after_focus_moves() {
+    let shared = Arc::new(Mutex::new(Shared::default()));
+    let mut plugin = ControlPlugin { shared: shared.clone() };
+    {
+        let mut s = shared.lock().unwrap();
+        s.epoch = 7;
+        s.inject.push_back(RequestBatches {
+            request: 9,
+            epoch: 7,
+            started: false,
+            since: web_time::Instant::now(),
+            release: Vec::new(),
+            batches: VecDeque::from([
+                vec![egui::Event::Key { key: egui::Key::Tab, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE }],
+                vec![egui::Event::Key { key: egui::Key::Tab, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::NONE }],
+            ]),
+        });
+    }
+    let ctx = egui::Context::default();
+    let mut press = egui::RawInput::default();
+    plugin.input_hook(&ctx, &mut press);
+    assert!(matches!(press.events.as_slice(), [egui::Event::Key { pressed: true, .. }]));
+    // The press moved focus: the next pass sees another input-target generation.
+    shared.lock().unwrap().epoch = 8;
+    let mut release = egui::RawInput::default();
+    plugin.input_hook(&ctx, &mut release);
+    assert!(matches!(release.events.as_slice(), [egui::Event::Key { pressed: false, .. }]), "the release still arrives");
+    let s = shared.lock().unwrap();
+    assert!(s.dropped.is_empty(), "a started request is not reported as stale");
+    assert!(s.inject.is_empty());
+}
+
+/// A host for timeout tests: the control layer must not need a real app.
+struct NoopHost;
+
+impl Host for NoopHost {
+    fn state(&self) -> Value {
+        json!({})
+    }
+    fn command(&mut self, _id: &str) -> Reply {
+        Err("no commands in this test".into())
+    }
+    fn panel(&mut self, _reset: bool, _params: &Value) -> Reply {
+        Err("no side panels in this test".into())
+    }
+    fn commands(&self) -> Value {
+        json!([])
+    }
+    fn set(&mut self, _key: &str, _value: &str) -> Reply {
+        Err("no settings in this test".into())
+    }
+    fn open(&mut self, _path: &str) -> Reply {
+        Err("no files in this test".into())
+    }
+    fn quit(&mut self, _ctx: &egui::Context) -> bool {
+        false
+    }
+}
+
+/// A host that starts unready (fonts not installed) and counts dispatched state reads.
+/// `state` takes `&self`, so the count sits in a `Cell`.
+struct ReadinessHost {
+    ready: bool,
+    states: std::cell::Cell<usize>,
+    /// Methods the host was asked to run, in dispatch order.
+    calls: std::cell::RefCell<Vec<&'static str>>,
+}
+
+impl ReadinessHost {
+    fn new(ready: bool) -> Self {
+        Self { ready, states: std::cell::Cell::new(0), calls: std::cell::RefCell::new(Vec::new()) }
+    }
+}
+
+impl Host for ReadinessHost {
+    fn state(&self) -> Value {
+        self.states.set(self.states.get() + 1);
+        self.calls.borrow_mut().push("ui.state");
+        json!({ "ready": self.ready })
+    }
+    fn command(&mut self, _id: &str) -> Reply {
+        Err("no commands in this test".into())
+    }
+    fn panel(&mut self, _reset: bool, _params: &Value) -> Reply {
+        Err("no side panels in this test".into())
+    }
+    fn commands(&self) -> Value {
+        self.calls.borrow_mut().push("ui.commands");
+        json!([])
+    }
+    fn set(&mut self, _key: &str, _value: &str) -> Reply {
+        Err("no settings in this test".into())
+    }
+    fn open(&mut self, _path: &str) -> Reply {
+        Err("no files in this test".into())
+    }
+    fn quit(&mut self, _ctx: &egui::Context) -> bool {
+        false
+    }
+    fn accepts_input(&self) -> bool {
+        self.ready
+    }
+}
+
+/// The admission timestamp of the one pending request, whichever kind it is.
+fn pending_since(control: &Control) -> Option<web_time::Instant> {
+    let first = control.pending.first()?;
+    match first {
+        Pending::Frames { since, .. } | Pending::Screenshot { since, .. } => Some(*since),
+    }
+}
+
+#[test]
+fn a_request_expired_in_the_channel_is_never_dispatched_or_deferred() {
+    for ready in [false, true] {
+        let ctx = egui::Context::default();
+        let (mut control, client) = attach(&ctx);
+        let mut host = ReadinessHost::new(ready);
+        let (reply, waiting) = channel();
+        let since = web_time::Instant::now().checked_sub(std::time::Duration::from_secs(10)).unwrap();
+        client.tx.send(ControlRequest { since, method: "ui.state".into(), params: json!({}), reply }).unwrap();
+        control.tick(&ctx, &mut host);
+        let error = waiting.try_recv().expect("expired channel request replies on the first tick").expect_err("expired request cannot dispatch");
+        assert!(error.contains(if ready { "finished starting" } else { "still starting" }), "{error}");
+        assert_eq!(host.states.get(), 0);
+        assert!(control.deferred.is_empty() && control.pending.is_empty());
+    }
+}
+
+/// A request held during startup keeps its arrival time. Once the app accepts input, one
+/// older than the control deadline fails instead of being dispatched into a later UI.
+#[test]
+fn a_deferred_request_expires_instead_of_dispatching_after_the_deadline() {
+    let ctx = egui::Context::default();
+    let (mut control, client) = attach(&ctx);
+    let mut host = ReadinessHost::new(false);
+    let waiting = client.send("ui.state", json!({}));
+    control.tick(&ctx, &mut host);
+    assert_eq!(control.deferred.len(), 1, "unready host defers the request");
+    assert!(waiting.try_recv().is_err(), "it is not answered while starting");
+    let past = web_time::Instant::now().checked_sub(std::time::Duration::from_secs(10)).unwrap();
+    for deferred in &mut control.deferred {
+        deferred.since = past;
+    }
+    // It expires even while the app is still not ready, so the client is not left waiting.
+    control.tick(&ctx, &mut host);
+    let error = waiting.try_recv().expect("expired deferred request receives a reply").expect_err("it must not dispatch");
+    assert!(error.contains("still starting"), "{error}");
+    assert!(control.deferred.is_empty());
+    // And readiness arriving later cannot revive it.
+    host.ready = true;
+    control.tick(&ctx, &mut host);
+    assert_eq!(host.states.get(), 0, "an expired request is never dispatched");
+}
+
+/// A request deferred only briefly still runs once fonts are ready.
+#[test]
+fn a_fresh_deferred_request_still_dispatches_when_the_app_becomes_ready() {
+    let ctx = egui::Context::default();
+    let (mut control, client) = attach(&ctx);
+    let mut host = ReadinessHost::new(false);
+    let waiting = client.send("ui.state", json!({}));
+    control.tick(&ctx, &mut host);
+    assert!(waiting.try_recv().is_err());
+    host.ready = true;
+    control.tick(&ctx, &mut host);
+    let reply = waiting.try_recv().expect("fresh deferred request replies").expect("it dispatches");
+    assert_eq!(reply["ready"], true);
+    assert_eq!(host.states.get(), 1, "the fresh deferred request is dispatched once");
+}
+
+/// A request deferred during startup keeps its one arrival timestamp. Dispatching it into
+/// synthetic input, a deferred frame reply or a screenshot reservation must not start a fresh
+/// 5 s in that phase: every later phase measures the same deadline from arrival.
+#[test]
+fn a_startup_wait_counts_against_one_admission_deadline_in_every_phase() {
+    let params = [("ui.type", json!({ "text": "x" })), ("ui.resize", json!({ "width": 800, "height": 600 })), ("ui.screenshot", json!({}))];
+    for (method, params) in params {
+        // `ui.resize` needs a native window; the other phases are checked on every target.
+        if method == "ui.resize" && cfg!(target_arch = "wasm32") {
+            continue;
+        }
+        let ctx = egui::Context::default();
+        // A real window size, so an admitted screenshot has capturable geometry.
+        ctx.run_ui(
+            egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(640.0, 480.0))), ..Default::default() },
+            |_| {},
+        )
+        .drop_without_applying_deltas();
+        let (mut control, client) = attach(&ctx);
+        let mut host = ReadinessHost::new(false);
+        let waiting = client.send(method, params);
+        control.tick(&ctx, &mut host);
+        assert_eq!(control.deferred.len(), 1, "{method}: deferred while starting");
+        // Three of the five seconds were spent starting: the request is still inside its
+        // deadline, but only just.
+        let arrived = web_time::Instant::now().checked_sub(std::time::Duration::from_secs(3)).unwrap();
+        for deferred in &mut control.deferred {
+            deferred.since = arrived;
+        }
+        host.ready = true;
+        control.tick(&ctx, &mut host);
+        assert!(control.deferred.is_empty(), "{method}: dispatched once the app accepts input");
+        assert!(waiting.try_recv().is_err(), "{method}: a preserved deadline does not answer early");
+        assert_eq!(pending_since(&control), Some(arrived), "{method}: the pending reply keeps the arrival deadline");
+        if method == "ui.type" {
+            let shared = control.shared.lock().unwrap();
+            assert_eq!(shared.inject.front().map(|request| request.since), Some(arrived), "{method}: queued input keeps the arrival deadline");
+        }
+        // Move that same shared timestamp past its own deadline (five seconds after arrival).
+        // Expiry measures the one admission instant, so nothing waits for a fresh five.
+        let past = arrived.checked_sub(timeout()).expect("a representable instant");
+        for pending in &mut control.pending {
+            match pending {
+                Pending::Frames { since, .. } | Pending::Screenshot { since, .. } => *since = past,
+            }
+        }
+        if let Ok(mut shared) = control.shared.lock() {
+            for request in &mut shared.inject {
+                request.since = past;
+            }
+        }
+        control.finish_pending(&ctx, &mut host);
+        let error = waiting.try_recv().expect("the expired request replies").expect_err("it must not succeed");
+        assert!(error.contains("not being drawn"), "{method}: {error}");
+        assert!(control.pending.is_empty(), "{method}: the expired request is not retried");
+        assert_eq!(control.reserved_bytes(), 0, "{method}: any reservation is released");
+    }
+}
+
+/// One client's requests keep their arrival order: a request deferred during startup runs
+/// before a newer request that was still waiting in the channel when the app became ready.
+#[test]
+fn a_deferred_request_runs_before_a_newer_queued_one() {
+    let ctx = egui::Context::default();
+    let (mut control, client) = attach(&ctx);
+    let mut host = ReadinessHost::new(false);
+    let older = client.send("ui.state", json!({}));
+    control.tick(&ctx, &mut host);
+    assert_eq!(control.deferred.len(), 1, "the older request is deferred while starting");
+    let newer = client.send("ui.commands", json!({}));
+    host.ready = true;
+    control.tick(&ctx, &mut host);
+    assert_eq!(*host.calls.borrow(), ["ui.state", "ui.commands"], "the older deferred request is dispatched first");
+    assert_eq!(older.try_recv().expect("the older request replies").expect("it dispatches")["ready"], true);
+    assert_eq!(newer.try_recv().expect("the newer request replies").expect("it dispatches"), json!([]));
+}
+
+/// A request whose startup wait used up the deadline is refused once the app is ready, and the
+/// message says the app finished starting instead of claiming it is still starting.
+#[test]
+fn a_request_that_outlasted_startup_reports_that_the_app_finished_starting() {
+    let ctx = egui::Context::default();
+    let (mut control, client) = attach(&ctx);
+    let mut host = ReadinessHost::new(false);
+    let waiting = client.send("ui.state", json!({}));
+    control.tick(&ctx, &mut host);
+    assert_eq!(control.deferred.len(), 1);
+    let past = web_time::Instant::now().checked_sub(std::time::Duration::from_secs(10)).unwrap();
+    for deferred in &mut control.deferred {
+        deferred.since = past;
+    }
+    host.ready = true;
+    control.tick(&ctx, &mut host);
+    let error = waiting.try_recv().expect("the expired request replies").expect_err("it is never dispatched");
+    assert!(error.contains("finished starting"), "{error}");
+    assert!(!error.contains("was still starting"), "the app is ready now: {error}");
+    assert_eq!(host.states.get(), 0, "an expired request is never dispatched");
+    assert!(control.deferred.is_empty() && control.pending.is_empty());
+}
+
+/// Keep key/modifier cleanup, but a canceled pointer must never produce a release event.
+#[test]
+fn a_timed_out_started_request_cancels_pointer_and_releases_keys() {
+    let ctx = egui::Context::default();
+    let (mut control, _client) = attach(&ctx);
+    let held = egui::Modifiers { command: true, ctrl: true, ..egui::Modifiers::NONE };
+    let pos = egui::pos2(24.0, 32.0);
+    let key = |pressed| egui::Event::Key { key: egui::Key::Enter, physical_key: None, pressed, repeat: false, modifiers: held };
+    let ids = control
+        .inject(
+            vec![
+                vec![
+                    egui::Event::ModifiersChanged(held),
+                    key(true),
+                    egui::Event::PointerMoved(pos),
+                    egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, modifiers: held },
+                ],
+                vec![egui::Event::PointerMoved(egui::pos2(40.0, 48.0))],
+                vec![key(false), egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: false, modifiers: held }],
+            ],
+            web_time::Instant::now(),
+        )
+        .unwrap();
+    let (reply, rx) = channel();
+    control.pending.push(Pending::Frames { until_pass: u64::MAX, batches: ids, since: web_time::Instant::now(), reply, value: json!({}) });
+    ctx.run_ui(egui::RawInput::default(), |_| {}).drop_without_applying_deltas();
+    assert!(ctx.input(|i| i.keys_down.contains(&egui::Key::Enter) && i.pointer.primary_down()));
+    assert_eq!(ctx.input(|i| i.modifiers), held);
+    age_input(&mut control);
+    let next = egui::pos2(80.0, 90.0);
+    control.inject(vec![vec![egui::Event::PointerMoved(next)]], web_time::Instant::now()).unwrap();
+    control.finish_pending(&ctx, &mut NoopHost);
+    assert!(rx.try_recv().unwrap().unwrap_err().contains("not being drawn"));
+    assert!(control.pending.is_empty());
+    ctx.run_ui(egui::RawInput::default(), |ui| {
+        assert!(!ui.input(|i| i.keys_down.contains(&egui::Key::Enter)));
+        assert_eq!(ui.input(|i| i.modifiers), egui::Modifiers::NONE);
+        assert_eq!(ui.input(|i| i.pointer.hover_pos()), Some(next), "another live request survives");
+        assert!(!ui.input(|i| i.pointer.any_down() || i.pointer.any_released()));
+        assert!(ui.ctx().dragged_id().is_none() && ui.ctx().drag_stopped_id().is_none());
+    })
+    .drop_without_applying_deltas();
+    assert!(control.shared.lock().unwrap().inject.is_empty());
+    assert!(rx.try_recv().is_err(), "only one timeout reply");
+}
+
+#[test]
+fn a_deadline_crossing_inside_an_admitted_pass_cancels_before_the_next_interaction() {
+    let ctx = egui::Context::default();
+    let (mut control, _client) = attach(&ctx);
+    let pos = egui::pos2(24.0, 32.0);
+    let ids = control
+        .inject(
+            vec![
+                vec![
+                    egui::Event::PointerMoved(pos),
+                    egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE },
+                ],
+                vec![egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE }],
+            ],
+            web_time::Instant::now(),
+        )
+        .unwrap();
+    let (reply, rx) = channel();
+    control.pending.push(Pending::Frames { until_pass: u64::MAX, batches: ids, since: web_time::Instant::now(), reply, value: json!({}) });
+    ctx.run_ui(egui::RawInput::default(), |ui| {
+        assert!(ui.input(|i| i.pointer.primary_down()), "the press was admitted before expiry");
+        age_input(&mut control);
+        control.finish_pending(ui.ctx(), &mut NoopHost);
+        assert!(rx.try_recv().is_err(), "do not cancel an already-calculated interaction mid-pass");
+    })
+    .drop_without_applying_deltas();
+    ctx.run_ui(egui::RawInput::default(), |ui| {
+        control.finish_pending(ui.ctx(), &mut NoopHost);
+        assert!(!ui.input(|i| i.pointer.any_down() || i.pointer.any_released()));
+        assert!(ui.ctx().drag_stopped_id().is_none());
+    })
+    .drop_without_applying_deltas();
+    assert!(rx.try_recv().unwrap().unwrap_err().contains("not being drawn"));
+    assert!(control.shared.lock().unwrap().inject.is_empty());
+}
+
+/// Deterministic elapsed-time input: age the same admission in both halves, without sleeping
+/// or fabricating any egui pointer/widget state.
+fn age_input(control: &mut Control) {
+    let past = web_time::Instant::now().checked_sub(std::time::Duration::from_secs(10)).unwrap();
+    for request in &mut control.shared.lock().unwrap().inject {
+        request.since = past;
+    }
+    for pending in &mut control.pending {
+        if let Pending::Frames { since, .. } = pending {
+            *since = past;
+        }
+    }
+}
+
+/// The public gestures this test drives through real UI passes.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Gesture {
+    AtomicClick,
+    HeldClick,
+    Marquee,
+}
+
+fn gesture_request(gesture: Gesture, from: egui::Pos2, to: egui::Pos2) -> (&'static str, Value) {
+    match gesture {
+        Gesture::AtomicClick => ("ui.click", json!({"x": from.x, "y": from.y})),
+        Gesture::HeldClick => ("ui.drag", json!({"from": [from.x, from.y], "to": [from.x, from.y], "steps": 6})),
+        Gesture::Marquee => ("ui.drag", json!({"from": [from.x, from.y], "to": [to.x, to.y], "steps": 6})),
+    }
+}
+
+fn marquee_harness() -> (Harness<'static, crate::PdfCraftApp>, ControlClient) {
+    let client_slot: Arc<Mutex<Option<ControlClient>>> = Arc::new(Mutex::new(None));
+    let slot = client_slot.clone();
+    let h = Harness::builder().with_size(egui::vec2(1200.0, 900.0)).with_step_dt(0.01).build_eframe(move |cc| {
+        let mut app = crate::PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("synthetic-form.pdf", None, include_bytes!("../../tests/data/form.pdf").to_vec()).unwrap();
+        app.set_option("quick", "marquee-zoom").unwrap();
+        *slot.lock().unwrap() = Some(app.attach_control(&cc.egui_ctx));
+        app
+    });
+    let client = client_slot.lock().unwrap().take().unwrap();
+    (h, client)
+}
+
+fn marquee_step(h: &mut Harness<'static, crate::PdfCraftApp>) {
+    let ctx = h.ctx.clone();
+    let mut raw = std::mem::take(h.input_mut());
+    h.state_mut().prepare_raw_input(&ctx, &mut raw);
+    *h.input_mut() = raw;
+    h.step();
+}
+
+/// The actual laid-out page rect and a short point gesture inside it.
+fn gesture_target(h: &Harness<'static, crate::PdfCraftApp>) -> (egui::Pos2, egui::Pos2) {
+    let page = h.state().views[0].page_screen_rect(0).expect("the actual PDF page was laid out").intersect(h.state().views[0].viewport_rect());
+    assert!(page.width() > 100.0 && page.height() > 100.0, "a visible hit target: {page:?}");
+    let from = page.center();
+    let to = from + egui::vec2(40.0, 50.0);
+    assert!(page.contains(to));
+    (from, to)
+}
+
+/// Step until the public request has really reached egui and can still be interrupted.
+fn await_gesture_admission(h: &mut Harness<'static, crate::PdfCraftApp>, gesture: Gesture) -> bool {
+    let mut admitted = false;
+    for _ in 0..8 {
+        marquee_step(h);
+        admitted = if gesture == Gesture::AtomicClick {
+            let shared = h.state().control.as_ref().unwrap().shared.lock().unwrap();
+            shared.inject.front().is_some_and(|request| request.started && request.batches.len() == 1)
+        } else {
+            h.ctx.input(|i| i.pointer.primary_down()) && (gesture != Gesture::Marquee || h.state().views[0].marquee.is_some())
+        };
+        if admitted {
+            break;
+        }
+    }
+    admitted
+}
+
+/// The request is queued exactly once, with the expected terminal batch not yet applied.
+fn assert_interruptible_admission(h: &Harness<'static, crate::PdfCraftApp>, gesture: Gesture, from: egui::Pos2) {
+    {
+        let shared = h.state().control.as_ref().unwrap().shared.lock().unwrap();
+        assert_eq!(shared.inject.len(), 1, "only the actual public request is queued");
+        let pending = shared.inject.front().unwrap();
+        assert!(pending.started);
+        let terminal = pending.batches.back().expect("the terminal batch is still pending");
+        if gesture == Gesture::AtomicClick {
+            assert_eq!(pending.batches.len(), 1);
+            assert_eq!(terminal.len(), 2);
+            assert!(
+                matches!(terminal[0], egui::Event::PointerButton { pressed: true, button: egui::PointerButton::Primary, pos, .. } if pos == from)
+            );
+            assert!(
+                matches!(terminal[1], egui::Event::PointerButton { pressed: false, button: egui::PointerButton::Primary, pos, .. } if pos == from)
+            );
+            assert!(!h.ctx.input(|i| i.pointer.primary_down()), "atomic click has only hovered so far");
+        } else {
+            assert!(h.ctx.input(|i| i.pointer.primary_down()), "a real pass consumed the press");
+            assert_eq!(terminal.len(), 1);
+            assert!(matches!(terminal[0], egui::Event::PointerButton { pressed: false, button: egui::PointerButton::Primary, .. }));
+        }
+    }
+    assert!(!h.ctx.input(|i| i.pointer.any_released()), "the terminal release has not run");
+    assert!(h.ctx.drag_stopped_id().is_none());
+    if gesture == Gesture::Marquee {
+        assert!(h.ctx.dragged_id().is_some() && h.state().views[0].marquee.is_some(), "the app has a real drag preview");
+    } else {
+        assert!(h.state().views[0].marquee.is_none() && h.state().views[0].marquee_done.is_none());
+    }
+}
+
+/// Expire the admission both through hidden logic and through the next input hook, then
+/// assert that cancellation left no gesture, zoom or edit behind.
+fn assert_timed_out_gesture(h: &mut Harness<'static, crate::PdfCraftApp>, reply: &Receiver<Reply>, hidden_logic: bool, zoom: f32, bytes: &[u8]) {
+    age_input(h.state_mut().control.as_mut().unwrap());
+    if hidden_logic {
+        let ctx = h.ctx.clone();
+        let app = h.state_mut();
+        let mut control = app.control.take().unwrap();
+        control.tick(&ctx, app);
+        app.control = Some(control);
+        assert!(reply.try_recv().unwrap().unwrap_err().contains("not being drawn"));
+    }
+    marquee_step(h);
+    if !hidden_logic {
+        assert!(reply.try_recv().unwrap().unwrap_err().contains("not being drawn"));
+    }
+    for _ in 0..2 {
+        marquee_step(h);
+    }
+    assert!(!h.ctx.input(|i| i.pointer.any_down() || i.pointer.any_released()));
+    assert!(h.ctx.dragged_id().is_none() && h.ctx.drag_stopped_id().is_none());
+    assert!(h.state().views[0].marquee.is_none() && h.state().views[0].marquee_done.is_none());
+    assert_eq!(h.state().views[0].zoom, zoom, "canceling must not turn a drag into a zoom click");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().bytes.as_slice(), bytes, "no abandoned edit");
+    assert!(h.state().control.as_ref().unwrap().shared.lock().unwrap().inject.is_empty());
+    assert!(h.state().control.as_ref().unwrap().pending.is_empty());
+    assert!(reply.try_recv().is_err(), "the cancellation replies once");
+}
+
+/// Complete one public gesture and check its real event trace and one-step zoom.
+fn complete_positive_gesture(
+    h: &mut Harness<'static, crate::PdfCraftApp>,
+    client: &ControlClient,
+    gesture: Gesture,
+    positive: Gesture,
+    bytes: &[u8],
+) {
+    let (from, to) = gesture_target(h);
+    let zoom = h.state().views[0].zoom;
+    let (method, params) = gesture_request(positive, from, to);
+    let reply = client.send(method, params);
+    let mut value = None;
+    let mut buttons = Vec::new();
+    let mut positions = Vec::new();
+    for _ in 0..20 {
+        marquee_step(h);
+        h.ctx.input(|i| {
+            for event in &i.events {
+                match event {
+                    egui::Event::PointerButton { button: egui::PointerButton::Primary, pressed, pos, .. } => {
+                        buttons.push((*pressed, i.time));
+                        positions.push(*pos);
+                    }
+                    egui::Event::PointerMoved(pos) => positions.push(*pos),
+                    _ => {}
+                }
+            }
+        });
+        if let Ok(result) = reply.try_recv() {
+            value = Some(result.unwrap());
+            break;
+        }
+    }
+    assert!(value.is_some(), "a fresh completed request succeeds: {positive:?}, after {gesture:?}");
+    assert_eq!(buttons.iter().map(|(pressed, _)| *pressed).collect::<Vec<_>>(), [true, false]);
+    assert!(!h.ctx.input(|i| i.pointer.any_down()));
+    assert!(h.ctx.dragged_id().is_none());
+    if positive == Gesture::Marquee {
+        assert!(h.state().views[0].zoom > zoom, "the normal marquee rectangle zooms");
+    } else {
+        let options = h.ctx.options(|o| o.input_options);
+        assert!(buttons[1].1 - buttons[0].1 < options.max_click_duration, "real press/release remain a short click");
+        assert!(positions.iter().all(|pos| pos.distance(from) < options.max_click_dist), "real input remains stationary");
+        assert!((h.state().views[0].zoom - zoom * 1.5).abs() < 0.001, "a normal click zooms one step");
+    }
+    assert!(h.state().views[0].marquee.is_none() && h.state().views[0].marquee_done.is_none());
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().bytes.as_slice(), bytes, "completed zooms do not edit the document");
+    assert!(reply.try_recv().is_err(), "successful request replies once");
+}
+
+/// Real page hit-testing, real control batches and the production marquee completion path.
+/// Exercise both hidden-logic expiry and expiry first observed by the next input hook.
+#[test]
+fn a_timed_out_marquee_never_zooms_and_completed_clicks_and_drags_still_work() {
+    for hidden_logic in [false, true] {
+        for gesture in [Gesture::AtomicClick, Gesture::HeldClick, Gesture::Marquee] {
+            let (mut h, client) = marquee_harness();
+            for _ in 0..5 {
+                marquee_step(&mut h);
+            }
+            let (from, to) = gesture_target(&h);
+            let zoom = h.state().views[0].zoom;
+            let bytes = h.state().session.get(h.state().views[0].id).unwrap().bytes.clone();
+            let (method, params) = gesture_request(gesture, from, to);
+            let reply = client.send(method, params);
+            assert!(await_gesture_admission(&mut h, gesture), "a real interruptible admission: {gesture:?}, hidden={hidden_logic}");
+            assert_interruptible_admission(&h, gesture, from);
+            assert!(reply.try_recv().is_err(), "the terminal batch has not run");
+            assert_eq!(h.state().views[0].zoom, zoom);
+            assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().bytes, bytes);
+            assert_timed_out_gesture(&mut h, &reply, hidden_logic, zoom, &bytes);
+
+            // Complete the same public gesture, then an atomic click after held input.
+            // Real event traces prove the stationary drag is a valid short point click.
+            let positives = [gesture, Gesture::AtomicClick];
+            let count = if gesture == Gesture::AtomicClick { 1 } else { 2 };
+            for positive in positives.into_iter().take(count) {
+                complete_positive_gesture(&mut h, &client, gesture, positive, &bytes);
+            }
+        }
+    }
+}
+
+/// A screenshot that times out cancels its slot and gives its reservation back, with a
+/// defined error instead of a silent success.
+#[test]
+fn a_timed_out_screenshot_releases_its_slot_and_budget() {
+    struct FakeHost;
+    impl Host for FakeHost {
+        fn state(&self) -> Value {
+            json!({})
+        }
+        fn command(&mut self, _id: &str) -> Reply {
+            Err("no commands in this test".into())
+        }
+        fn panel(&mut self, _reset: bool, _params: &Value) -> Reply {
+            Err("no side panels in this test".into())
+        }
+        fn commands(&self) -> Value {
+            json!([])
+        }
+        fn set(&mut self, _key: &str, _value: &str) -> Reply {
+            Err("no settings in this test".into())
+        }
+        fn open(&mut self, _path: &str) -> Reply {
+            Err("no files in this test".into())
+        }
+        fn quit(&mut self, _ctx: &egui::Context) -> bool {
+            false
+        }
+    }
+    let ctx = egui::Context::default();
+    let (mut control, _client) = attach(&ctx);
+    let (slot, callback) = craft_ui::capture::CaptureSlot::new(&ctx, egui::ViewportId::ROOT, MAX_IMAGE_BYTES);
+    let (reply, rx) = channel();
+    control.pending.push(Pending::Screenshot {
+        slot,
+        callback: Some(callback),
+        region: None,
+        reply,
+        since: web_time::Instant::now().checked_sub(std::time::Duration::from_secs(10)).unwrap_or_else(web_time::Instant::now),
+        geometry: Geometry { size: egui::vec2(800.0, 600.0), pixels_per_point: 1.0, epoch: 0 },
+        reserved: 800 * 600 * 4,
+        attempts: 0,
+    });
+    control.finish_pending(&ctx, &mut FakeHost);
+    let error = rx.try_recv().expect("the request is answered").expect_err("a timeout is an error");
+    assert!(error.contains("not being drawn"), "{error}");
+    assert_eq!(control.reserved_bytes(), 0, "the reservation is released");
+    assert!(control.pending.is_empty(), "the cancelled capture is not retried");
+}
+
+/// A real successful callback must not bypass expiry, including when resize would otherwise
+/// retry it. A non-expired completion still produces a real encoded PNG reply.
+#[test]
+fn completed_screenshots_obey_the_admission_deadline_before_success_or_retry() {
+    for (expired, resized) in [(false, false), (true, false), (true, true)] {
+        let ctx = egui::Context::default();
+        ctx.run_ui(
+            egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(64.0, 32.0))), ..Default::default() },
+            |_| {},
+        )
+        .drop_without_applying_deltas();
+        let (mut control, _client) = attach(&ctx);
+        let geometry = Geometry::current(&ctx, 0);
+        let (slot, callback) = craft_ui::capture::CaptureSlot::new(&ctx, egui::ViewportId::ROOT, MAX_IMAGE_BYTES);
+        let image = Arc::new(egui::ColorImage::filled([64, 32], egui::Color32::RED));
+        let weak_image = Arc::downgrade(&image);
+        callback.complete(image);
+        assert!(weak_image.upgrade().is_some(), "the completed slot really retains pixels");
+        let (reply, rx) = channel();
+        control.pending.push(Pending::Screenshot {
+            slot,
+            callback: None,
+            region: None,
+            reply,
+            since: if expired { web_time::Instant::now().checked_sub(std::time::Duration::from_secs(10)).unwrap() } else { web_time::Instant::now() },
+            geometry,
+            reserved: geometry.image_bytes().unwrap(),
+            attempts: 0,
+        });
+        if resized {
+            ctx.run_ui(
+                egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(80.0, 40.0))), ..Default::default() },
+                |_| {},
+            )
+            .drop_without_applying_deltas();
+            assert_ne!(Geometry::current(&ctx, 0).size, geometry.size);
+        }
+        control.finish_pending(&ctx, &mut NoopHost);
+        let result = rx.try_recv().expect("one settled reply");
+        if expired {
+            assert!(result.unwrap_err().contains("not being drawn"), "expiry takes priority over success or resize");
+        } else {
+            let image = result.expect("the live completed capture still succeeds");
+            assert_eq!(image["width"], 64);
+            assert_eq!(image["height"], 32);
+            use base64::Engine as _;
+            let png = base64::engine::general_purpose::STANDARD.decode(image["png_base64"].as_str().expect("actual PNG reply")).unwrap();
+            assert!(png.starts_with(b"\x89PNG\r\n\x1a\n"));
+        }
+        assert!(control.pending.is_empty(), "an expired capture is never retried");
+        assert_eq!(control.reserved_bytes(), 0);
+        assert!(weak_image.upgrade().is_none(), "the slot releases its pixels");
+        assert!(rx.try_recv().is_err(), "exactly one reply");
+    }
+}
+
+#[test]
+fn expired_unissued_screenshots_are_not_issued_and_late_callbacks_are_harmless() {
+    let ctx = egui::Context::default();
+    let (mut control, _client) = attach(&ctx);
+    let (slot, callback) = craft_ui::capture::CaptureSlot::new(&ctx, egui::ViewportId::ROOT, MAX_IMAGE_BYTES);
+    let late_callback = callback.clone();
+    let geometry = Geometry { size: egui::vec2(64.0, 32.0), pixels_per_point: 1.0, epoch: 0 };
+    let (reply, rx) = channel();
+    control.pending.push(Pending::Screenshot {
+        slot,
+        callback: Some(callback),
+        region: None,
+        reply,
+        since: web_time::Instant::now().checked_sub(std::time::Duration::from_secs(10)).unwrap(),
+        geometry,
+        reserved: 64 * 32 * 4,
+        attempts: 0,
+    });
+    let output = ctx.run_ui(egui::RawInput::default(), |ui| control.finish_frame(ui.ctx(), &mut NoopHost));
+    assert!(
+        output
+            .viewport_output
+            .values()
+            .all(|viewport| !viewport.commands.iter().any(|command| matches!(command, egui::ViewportCommand::Screenshot(_))))
+    );
+    output.drop_without_applying_deltas();
+    assert!(rx.try_recv().unwrap().unwrap_err().contains("not being drawn"));
+    assert!(control.pending.is_empty());
+    assert_eq!(control.reserved_bytes(), 0);
+    let image = Arc::new(egui::ColorImage::filled([64, 32], egui::Color32::RED));
+    let weak_image = Arc::downgrade(&image);
+    late_callback.complete(image);
+    assert!(weak_image.upgrade().is_none(), "a late completion cannot resurrect a canceled request");
+    control.finish_pending(&ctx, &mut NoopHost);
+    assert!(rx.try_recv().is_err(), "no second reply");
+}
+
+/// One queued batch is consumed by exactly one UI pass.
+#[test]
+fn one_batch_is_consumed_by_one_pass() {
+    let shared = Arc::new(Mutex::new(Shared::default()));
+    let mut plugin = ControlPlugin { shared: shared.clone() };
+    {
+        let mut s = shared.lock().unwrap();
+        s.epoch = 3;
+        s.inject.push_back(RequestBatches {
+            request: 1,
+            epoch: 3,
+            started: false,
+            since: web_time::Instant::now(),
+            release: Vec::new(),
+            batches: VecDeque::from([vec![egui::Event::PointerMoved(egui::pos2(2.0, 3.0))]]),
+        });
+        s.inject.push_back(RequestBatches {
+            request: 2,
+            epoch: 3,
+            started: false,
+            since: web_time::Instant::now(),
+            release: Vec::new(),
+            batches: VecDeque::from([vec![egui::Event::PointerMoved(egui::pos2(4.0, 5.0))]]),
+        });
+    }
+    let mut first = egui::RawInput::default();
+    plugin.input_hook(&egui::Context::default(), &mut first);
+    assert_eq!(first.events.len(), 1);
+    let mut second = egui::RawInput::default();
+    plugin.input_hook(&egui::Context::default(), &mut second);
+    assert_eq!(second.events.len(), 1);
+    assert_eq!(second.events[0], egui::Event::PointerMoved(egui::pos2(4.0, 5.0)));
+    let mut third = egui::RawInput::default();
+    plugin.input_hook(&egui::Context::default(), &mut third);
+    assert!(third.events.is_empty(), "a consumed batch is never repeated");
+}
diff --git a/crates/ui-egui/src/control/pending.rs b/crates/ui-egui/src/control/pending.rs
new file mode 100644
index 0000000000..9e63849cf0
--- /dev/null
+++ b/crates/ui-egui/src/control/pending.rs
@@ -0,0 +1,176 @@
+use super::screenshot::{Geometry, MAX_IMAGE_BYTES, retried_reservation, screenshot_png};
+use super::*;
+
+/// A screenshot pending in the `finish_pending` pass, with ownership of its reply.
+struct PendingCapture {
+    slot: craft_ui::capture::CaptureSlot,
+    callback: Option<egui::ScreenshotCallback>,
+    region: Option<egui::Rect>,
+    reply: Sender<Reply>,
+    since: web_time::Instant,
+    geometry: Geometry,
+    reserved: usize,
+    attempts: u8,
+}
+
+impl PendingCapture {
+    /// Convert a screenshot request into the pending form that later frames finish.
+    fn into_pending(self) -> Pending {
+        Pending::Screenshot {
+            slot: self.slot,
+            callback: self.callback,
+            region: self.region,
+            reply: self.reply,
+            since: self.since,
+            geometry: self.geometry,
+            reserved: self.reserved,
+            attempts: self.attempts,
+        }
+    }
+}
+
+/// The state one `finish_pending` pass needs while resolving pending replies.
+struct PendingFinisher {
+    now: web_time::Instant,
+    passes: u64,
+    current: Geometry,
+    in_pass: bool,
+    dropped: Vec<u64>,
+    expired: Vec<u64>,
+    reserved_total: usize,
+}
+
+impl PendingFinisher {
+    /// Answer or keep one queued-input request, preserving its one arrival deadline.
+    fn resolve_frames(&self, until_pass: u64, batches: Vec<u64>, since: web_time::Instant, reply: Sender<Reply>, value: Value) -> Option<Pending> {
+        if batches.iter().any(|id| self.expired.contains(id)) {
+            let _ = reply.send(Err(not_drawn("handling the input")));
+            return None;
+        }
+        if batches.iter().any(|id| self.dropped.contains(id)) {
+            let _ = reply.send(Err("the document, dialog or focus changed before the input could be applied; nothing was done".into()));
+            return None;
+        }
+        if self.passes >= until_pass {
+            let _ = reply.send(Ok(value));
+            return None;
+        }
+        if !self.in_pass && self.now.duration_since(since) > timeout() {
+            let _ = reply.send(Err(not_drawn("handling the input")));
+            return None;
+        }
+        Some(Pending::Frames { until_pass, batches, since, reply, value })
+    }
+
+    /// Give one reservation back to the running aggregate budget.
+    fn release_reservation(&mut self, reserved: usize) {
+        self.reserved_total = self.reserved_total.saturating_sub(reserved);
+    }
+
+    /// Resolve one screenshot request, keeping it only while its capture is still pending.
+    fn finish_capture(&mut self, ctx: &egui::Context, capture: PendingCapture) -> Option<Pending> {
+        // Completion cannot restart or bypass the admission deadline, even when the callback
+        // arrived before this delayed tick or a resize would retry it.
+        if self.now.duration_since(capture.since) > timeout() {
+            capture.slot.cancel();
+            self.release_reservation(capture.reserved);
+            let _ = capture.reply.send(Err(not_drawn("the screenshot")));
+            return None;
+        }
+        match capture.slot.take() {
+            Some(Ok(image)) => self.finish_captured_image(ctx, capture, image),
+            Some(Err(error)) => {
+                self.release_reservation(capture.reserved);
+                let _ = capture.reply.send(Err(format!("the screenshot could not be captured: {error}")));
+                None
+            }
+            None => Some(capture.into_pending()),
+        }
+    }
+
+    /// Finish a screenshot whose callback produced an image.
+    fn finish_captured_image(&mut self, ctx: &egui::Context, capture: PendingCapture, image: Arc<egui::ColorImage>) -> Option<Pending> {
+        if self.current.epoch != capture.geometry.epoch {
+            // The document/dialog changed: never save a capture of the previous context, and do
+            // not retry it into the new one.
+            self.release_reservation(capture.reserved);
+            let _ = capture.reply.send(Err("the document or dialog changed while the screenshot was being captured; it was not saved".into()));
+            return None;
+        }
+        if self.current.size != capture.geometry.size || self.current.pixels_per_point != capture.geometry.pixels_per_point {
+            // A late completion after a resize/DPI change is never encoded: retry once with a
+            // fresh slot, else report a defined error.
+            return self.retry_captured_image(ctx, capture);
+        }
+        self.release_reservation(capture.reserved);
+        let _ = capture.reply.send(screenshot_png(&image, capture.region, capture.geometry));
+        None
+    }
+
+    /// Retry one resize/DPI-stale capture with the current geometry.
+    fn retry_captured_image(&mut self, ctx: &egui::Context, capture: PendingCapture) -> Option<Pending> {
+        if capture.attempts >= 1 {
+            self.release_reservation(capture.reserved);
+            let _ = capture.reply.send(Err("the window geometry changed while the screenshot was being captured; it was not saved".into()));
+            return None;
+        }
+        if capture.region.as_ref().is_some_and(|region| !self.current.contains_region(*region)) {
+            self.release_reservation(capture.reserved);
+            let _ = capture.reply.send(Err("the region must lie inside the window".into()));
+            return None;
+        }
+        let Some(bytes) = self.current.image_bytes() else {
+            self.release_reservation(capture.reserved);
+            let _ = capture.reply.send(Err("the window has no capturable size".into()));
+            return None;
+        };
+        let Some(new_total) = retried_reservation(self.reserved_total, capture.reserved, bytes) else {
+            self.release_reservation(capture.reserved);
+            let _ = capture.reply.send(Err("the screenshot no longer fits the screenshot budget".into()));
+            return None;
+        };
+        self.reserved_total = new_total;
+        let (slot, callback) = craft_ui::capture::CaptureSlot::new(ctx, egui::ViewportId::ROOT, MAX_IMAGE_BYTES);
+        Some(Pending::Screenshot {
+            slot,
+            callback: Some(callback),
+            region: capture.region,
+            reply: capture.reply,
+            since: capture.since,
+            geometry: self.current,
+            reserved: bytes,
+            attempts: capture.attempts + 1,
+        })
+    }
+}
+
+impl Control {
+    /// Resolve completed frame and screenshot requests while retaining those that still need a pass or a
+    /// retry.
+    pub(super) fn finish_pending(&mut self, ctx: &egui::Context, host: &mut impl Host) {
+        let now = web_time::Instant::now();
+        let (dropped, expired, in_pass) = self.take_finished_shared(ctx, host, now);
+        let mut finisher = PendingFinisher {
+            now,
+            passes: self.passes(),
+            current: Geometry::current(ctx, host.capture_epoch()),
+            in_pass,
+            dropped,
+            expired,
+            reserved_total: self.reserved_bytes(),
+        };
+        let mut keep = Vec::new();
+        for pending in std::mem::take(&mut self.pending) {
+            let kept = match pending {
+                Pending::Frames { until_pass, batches, since, reply, value } => finisher.resolve_frames(until_pass, batches, since, reply, value),
+                Pending::Screenshot { slot, callback, region, reply, since, geometry, reserved, attempts } => {
+                    finisher.finish_capture(ctx, PendingCapture { slot, callback, region, reply, since, geometry, reserved, attempts })
+                }
+            };
+            if let Some(pending) = kept {
+                keep.push(pending);
+            }
+        }
+        self.pending = keep;
+    }
+}
diff --git a/crates/ui-egui/src/control/plugin.rs b/crates/ui-egui/src/control/plugin.rs
new file mode 100644
index 0000000000..be0dff826e
--- /dev/null
+++ b/crates/ui-egui/src/control/plugin.rs
@@ -0,0 +1,172 @@
+use super::requests::Handled;
+use super::*;
+
+/// Track only presses that reached egui and have not yet been released. A pointer release is
+/// retained as an ownership marker, never as a timeout event.
+fn note_pressed(release: &mut Vec<egui::Event>, events: &[egui::Event]) {
+    for event in events {
+        match event {
+            egui::Event::Key { key, pressed: true, .. }
+                if !release.iter().any(|event| matches!(event, egui::Event::Key { key: seen, pressed: false, .. } if seen == key)) =>
+            {
+                release.push(egui::Event::Key { key: *key, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::NONE });
+            }
+            egui::Event::PointerButton { pos, button, pressed: true, .. }
+                if !release
+                    .iter()
+                    .any(|event| matches!(event, egui::Event::PointerButton { button: seen, pressed: false, .. } if seen == button)) =>
+            {
+                release.push(egui::Event::PointerButton { pos: *pos, button: *button, pressed: false, modifiers: egui::Modifiers::NONE });
+            }
+            egui::Event::ModifiersChanged(modifiers)
+                if *modifiers != egui::Modifiers::NONE && !release.contains(&egui::Event::ModifiersChanged(egui::Modifiers::NONE)) =>
+            {
+                release.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+            }
+            egui::Event::Key { key, pressed: false, .. } => {
+                release.retain(|event| !matches!(event, egui::Event::Key { key: seen, .. } if seen == key));
+            }
+            egui::Event::PointerButton { button, pressed: false, .. } => {
+                release.retain(|event| !matches!(event, egui::Event::PointerButton { button: seen, .. } if seen == button));
+            }
+            egui::Event::ModifiersChanged(modifiers) if *modifiers == egui::Modifiers::NONE => {
+                release.retain(|event| !matches!(event, egui::Event::ModifiersChanged(_)));
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Cancel expired requests before egui computes interaction. Hidden logic calls this too, so
+/// replies do not wait for a visible frame. Never complete an abandoned pointer gesture.
+pub(super) fn expire_input(shared: &mut Shared, now: web_time::Instant) {
+    shared.inject.retain_mut(|request| {
+        if now.duration_since(request.since) <= timeout() {
+            return true;
+        }
+        shared.expired.push(request.request);
+        for event in request.release.drain(..) {
+            if matches!(event, egui::Event::PointerButton { .. }) {
+                shared.cancel_pointer = true;
+                shared.cancel_gestures = true;
+            } else {
+                shared.cleanup.push(event);
+            }
+        }
+        false
+    });
+}
+
+/// Synthetic input is bounded like screenshots: a local authenticated client must not be able to
+/// queue unbounded batches (one frame each) and hold the control channel's memory for ever.
+const MAX_QUEUED_BATCHES: usize = 512;
+
+/// The egui plugin half of the control channel.
+pub struct ControlPlugin {
+    pub(super) shared: Arc<Mutex<Shared>>,
+}
+
+impl egui::Plugin for ControlPlugin {
+    fn debug_name(&self) -> &'static str {
+        "pdfcraft-control"
+    }
+
+    /// Inject admitted control batches into the current pass, dropping stale requests, applying cancellations
+    /// and scheduling repaints.
+    fn input_hook(&mut self, ctx: &egui::Context, input: &mut egui::RawInput) {
+        let Ok(mut s) = self.shared.lock() else { return };
+        expire_input(&mut s, web_time::Instant::now());
+        if std::mem::take(&mut s.cancel_pointer) {
+            // input_hook precedes Context::begin_pass. stop_dragging sets the OLD snapshot's
+            // drag_stopped; begin_pass replaces that snapshot without a release/click/drop.
+            ctx.input_mut(|i| i.pointer = Default::default());
+            ctx.stop_dragging();
+            egui::DragAndDrop::clear_payload(ctx);
+        }
+        input.events.append(&mut s.cleanup);
+        s.in_pass = true;
+        let epoch = s.epoch;
+        let Some(front) = s.inject.front_mut() else { return };
+        if !front.started {
+            if front.epoch != epoch {
+                // The document, dialog or focus changed after this request was admitted, before
+                // any of its input landed. Drop only this request; later requests are unrelated.
+                let request = front.request;
+                s.inject.pop_front();
+                s.dropped.push(request);
+                if !s.inject.is_empty() {
+                    ctx.request_repaint();
+                }
+                return;
+            }
+            front.started = true;
+        }
+        // A non-expired request's own earlier batch may have changed focus or opened a dialog.
+        // Let it finish normally; expiry above cancels held pointer state instead of completing
+        // an abandoned click/drop.
+        let events = front.batches.pop_front();
+        if let Some(events) = &events {
+            // Remember the inverse of what this request presses as it is applied, so a timeout
+            // after this batch can still release exactly those inputs.
+            note_pressed(&mut front.release, events);
+        }
+        let done = front.batches.is_empty();
+        if done {
+            s.inject.pop_front();
+        }
+        if let Some(events) = events {
+            input.events.extend(events);
+        }
+        if !s.inject.is_empty() {
+            ctx.request_repaint();
+        }
+    }
+
+    /// Record presented passes and the accesskit tree and focus after a pass, so control replies observe only
+    /// drawn frames.
+    fn output_hook(&mut self, ctx: &egui::Context, output: &mut egui::FullOutput) {
+        let Ok(mut s) = self.shared.lock() else { return };
+        s.in_pass = false;
+        // A discarded pass is layout work, not a frame the agent can observe. Only count passes
+        // whose output is actually presented, so a request cannot be answered early. The last
+        // pass of a frame is presented even when its own discard request was refused because
+        // `max_passes` is reached; egui still reports that request in the output.
+        let max_passes = ctx.options(|o| o.max_passes.get());
+        let final_pass = output.platform_output.num_completed_passes >= max_passes;
+        if output.platform_output.request_discard_reasons.is_empty() || final_pass {
+            s.passes += 1;
+        }
+        let Some(update) = &output.platform_output.accesskit_update else { return };
+        s.nodes = update.nodes.iter().cloned().collect();
+        s.root = update.tree.as_ref().map(|t| t.root);
+        s.focus = Some(update.focus);
+    }
+}
+
+impl Control {
+    /// Queue one request's event batches (one per UI pass) and return its request id.
+    ///
+    /// The request is stamped once, at admission: all of its batches share the input-target
+    /// generation and the caller's single arrival deadline (`since`), so a deferred startup wait
+    /// is not restarted here. A poisoned mutex or a full queue is an error, never a silently empty
+    /// queue that would let the caller answer `Ok` for input that never happened.
+    pub(super) fn inject(&self, batches: Vec<Vec<egui::Event>>, since: web_time::Instant) -> Result<Vec<u64>, String> {
+        let mut s = self.shared.lock().map_err(|_| "control state poisoned".to_string())?;
+        let queued: usize = s.inject.iter().map(|request| request.batches.len()).sum();
+        if queued.saturating_add(batches.len()) > MAX_QUEUED_BATCHES {
+            return Err(format!("too many synthetic input batches are already queued (limit {MAX_QUEUED_BATCHES})"));
+        }
+        s.next_batch += 1;
+        let id = s.next_batch;
+        let epoch = s.epoch;
+        s.inject.push_back(RequestBatches { request: id, epoch, started: false, since, release: Vec::new(), batches: batches.into() });
+        Ok(vec![id])
+    }
+
+    /// Queue synthetic input batches and reply only after the requested number of frames has been presented.
+    pub(super) fn after_input(&self, batches: Vec<Vec<egui::Event>>, value: Value, since: web_time::Instant) -> Result<Handled, String> {
+        let frames = batches.len() as u32;
+        let batches = self.inject(batches, since)?;
+        Ok(Handled::AfterInput { batches, frames, value })
+    }
+}
diff --git a/crates/ui-egui/src/control/requests.rs b/crates/ui-egui/src/control/requests.rs
new file mode 100644
index 0000000000..1e2a24b979
--- /dev/null
+++ b/crates/ui-egui/src/control/requests.rs
@@ -0,0 +1,369 @@
+use super::screenshot::Geometry;
+use super::*;
+
+impl Control {
+    /// Validate and dispatch one control method, rejecting unknown methods and malformed parameters with
+    /// actionable errors.
+    pub(super) fn handle(&mut self, ctx: &egui::Context, host: &mut impl Host, method: &str, p: &Value, since: web_time::Instant) -> Handled {
+        let str_param = |k: &str| p.get(k).and_then(Value::as_str).ok_or_else(|| format!("{method}: missing string parameter {k}"));
+        let r: Result<Handled, String> = (|| match method {
+            "ui.state" => {
+                let mut state = host.state();
+                // Viewport info is fresh in `logic`; the last UI pass's rectangle can be stale.
+                let geometry = Geometry::current(ctx, host.capture_epoch());
+                let size = geometry.size;
+                state["window"] = json!({ "width": size.x, "height": size.y, "pixels_per_point": geometry.pixels_per_point });
+                Ok(Handled::Now(Ok(state)))
+            }
+            "ui.commands" => Ok(Handled::Now(Ok(host.commands()))),
+            "ui.panel" | "ui.dock.reset" => Ok(Handled::Now(host.panel(method == "ui.dock.reset", p))),
+            "ui.command" if str_param("id")? == "ui.panel" => Ok(Handled::Now(host.panel(false, p.get("params").unwrap_or(p)))),
+            "ui.command" => Ok(Handled::Now(host.command(str_param("id")?))),
+            "ui.set" => {
+                let value = match p.get("value") {
+                    Some(Value::String(s)) => s.clone(),
+                    Some(v) => v.to_string(),
+                    None => return Err("ui.set: missing parameter value".into()),
+                };
+                Ok(Handled::Now(host.set(str_param("key")?, &value)))
+            }
+            "ui.open" => Ok(Handled::Now(host.open(str_param("path")?))),
+            "ui.inspect" => Ok(Handled::Now(Ok(self.inspect(p)))),
+            "ui.click" => self.click(p, since),
+            "ui.focus" => self.focus(p, since),
+            "ui.resize" => {
+                only_params(p, method, &["width", "height"])?;
+                let dimension = |key: &str| -> Result<f32, String> {
+                    p.get(key)
+                        .and_then(Value::as_f64)
+                        .filter(|n| n.is_finite() && (320.0..=8192.0).contains(n))
+                        .map(|n| n as f32)
+                        .ok_or_else(|| format!("ui.resize: {key} must be between 320 and 8192 logical points"))
+                };
+                let size = egui::vec2(dimension("width")?, dimension("height")?);
+                if cfg!(target_arch = "wasm32") {
+                    return Err("ui.resize needs a native window".into());
+                }
+                ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(size));
+                ctx.request_repaint();
+                Ok(Handled::AfterFrames(2, json!({ "requested": [size.x, size.y] })))
+            }
+            "ui.quit" => {
+                only_params(p, method, &[])?;
+                if cfg!(target_arch = "wasm32") {
+                    return Err("ui.quit needs a native window".into());
+                }
+                let quitting = host.quit(ctx);
+                Ok(Handled::Now(Ok(json!({ "quitting": quitting, "needs_confirmation": !quitting }))))
+            }
+            "ui.drag" => self.drag(p, since),
+            "ui.move" => {
+                let point = |key: &str| -> Result<f32, String> {
+                    p.get(key)
+                        .and_then(Value::as_f64)
+                        .map(|n| n as f32)
+                        .filter(|n| n.is_finite())
+                        .ok_or_else(|| format!("ui.move: {key} must be a finite coordinate in points"))
+                };
+                let pos = egui::pos2(point("x")?, point("y")?);
+                self.after_input(vec![vec![egui::Event::PointerMoved(pos)]], json!({ "moved": [pos.x, pos.y] }), since)
+            }
+            "ui.type" => {
+                let text = str_param("text")?.to_string();
+                self.after_input(vec![vec![egui::Event::Text(text)]], json!({ "typed": true }), since)
+            }
+            "ui.key" => {
+                let name = str_param("key")?;
+                let key = egui::Key::from_name(name)
+                    .ok_or_else(|| format!("ui.key: unknown key {name:?} (egui key names: A, Enter, Escape, ArrowDown, F5, …)"))?;
+                let modifiers = modifiers(p.get("modifiers"))?;
+                self.after_input(key_batches(key, modifiers), json!({ "key": name }), since)
+            }
+            "ui.screenshot" => {
+                let region = match p.get("region") {
+                    None | Some(Value::Null) => None,
+                    Some(r) => Some(rect_param(r)?),
+                };
+                ctx.request_repaint();
+                Ok(Handled::Screenshot(region))
+            }
+            other => Err(format!(
+                "unknown method {other:?} (ui.state, ui.inspect, ui.click, ui.focus, ui.resize, ui.quit, ui.move, ui.drag, ui.type, ui.key, ui.command, ui.commands, ui.set, ui.open, ui.screenshot)"
+            )),
+        })();
+        r.unwrap_or_else(|e| Handled::Now(Err(e)))
+    }
+
+    fn inspect(&self, p: &Value) -> Value {
+        let query = p.get("query").and_then(Value::as_str).map(str::to_lowercase);
+        let role = p.get("role").and_then(Value::as_str).map(str::to_lowercase);
+        let focused = p.get("focused").and_then(Value::as_bool);
+        let limit = p.get("limit").and_then(Value::as_u64).unwrap_or(500) as usize;
+        let Ok(s) = self.shared.lock() else { return json!({ "widgets": [] }) };
+        let mut out = Vec::new();
+        let mut total = 0usize;
+        let mut stack: Vec<(NodeId, usize)> = s.root.map(|r| vec![(r, 0)]).unwrap_or_default();
+        while let Some((id, depth)) = stack.pop() {
+            let Some(node) = s.nodes.get(&id) else { continue };
+            for c in node.children().iter().rev() {
+                stack.push((*c, depth + 1));
+            }
+            let w = widget(id, node, depth, s.focus == Some(id));
+            let text =
+                format!("{} {} {}", w["label"].as_str().unwrap_or(""), w["value"].as_str().unwrap_or(""), w["description"].as_str().unwrap_or(""))
+                    .to_lowercase();
+            let role_ok = role.as_ref().is_none_or(|r| w["role"].as_str().is_some_and(|x| x.to_lowercase() == *r));
+            let query_ok = query.as_ref().is_none_or(|q| text.contains(q.as_str()));
+            let focus_ok = focused.is_none_or(|want| (s.focus == Some(id)) == want);
+            if role_ok && query_ok && focus_ok && id != s.root.unwrap_or(id) {
+                total += 1;
+                if out.len() < limit {
+                    out.push(w);
+                }
+            }
+        }
+        json!({ "widgets": out, "count": total, "truncated": total > out.len() })
+    }
+
+    /// Press at `from`, move to `to` in `steps` frames, release (drawing, selecting text, moving).
+    fn drag(&mut self, p: &Value, since: web_time::Instant) -> Result<Handled, String> {
+        let point = |k: &str| -> Result<egui::Pos2, String> {
+            match p.get(k).and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_f64).collect::<Vec<_>>()).as_deref() {
+                Some([x, y]) => Some(egui::pos2(*x as f32, *y as f32))
+                    .filter(|pos| pos.is_finite())
+                    .ok_or_else(|| format!("ui.drag: {k} must be [x, y], finite coordinates in points")),
+                _ => Err(format!("ui.drag: {k} must be [x, y] in points")),
+            }
+        };
+        let (from, to) = (point("from")?, point("to")?);
+        if !(to - from).is_finite() {
+            return Err("ui.drag: from and to must be a finite distance apart, in points".into());
+        }
+        let steps = p.get("steps").and_then(Value::as_u64).unwrap_or(8).clamp(1, 200) as usize;
+        let modifiers = modifiers(p.get("modifiers"))?;
+        let which = pointer_button(p, "ui.drag")?;
+        // The events carry the modifiers and so does the input state: gestures that read
+        // `ui.input(|i| i.modifiers)` (a Ctrl-drag copy, an Alt-drag column select) see them.
+        let held = |mut events: Vec<egui::Event>| {
+            if modifiers != egui::Modifiers::NONE {
+                events.insert(0, egui::Event::ModifiersChanged(modifiers));
+            }
+            events
+        };
+        let button = |pos, pressed| egui::Event::PointerButton { pos, button: which, pressed, modifiers };
+        let mut frames = vec![held(vec![egui::Event::PointerMoved(from)]), held(vec![button(from, true)])];
+        for k in 1..=steps {
+            frames.push(held(vec![egui::Event::PointerMoved(from + (to - from) * (k as f32 / steps as f32))]));
+        }
+        frames.push(held(vec![button(to, false)]));
+        if modifiers != egui::Modifiers::NONE {
+            frames.push(vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE)]);
+        }
+        self.after_input(frames, json!({ "dragged": [[from.x, from.y], [to.x, to.y]] }), since)
+    }
+
+    /// Click at a point, or on an accesskit widget by id or unique enabled label.
+    fn click(&mut self, p: &Value, since: web_time::Instant) -> Result<Handled, String> {
+        if let (Some(x), Some(y)) = (p.get("x").and_then(Value::as_f64), p.get("y").and_then(Value::as_f64)) {
+            let point = |key: &str, n: f64| {
+                Some(n as f32).filter(|n| n.is_finite()).ok_or_else(|| format!("ui.click: {key} must be a finite coordinate in points"))
+            };
+            let pos = egui::pos2(point("x", x)?, point("y", y)?);
+            let which = pointer_button(p, "ui.click")?;
+            let button = |pressed| egui::Event::PointerButton { pos, button: which, pressed, modifiers: egui::Modifiers::NONE };
+            // Keep hover/layout warmup, then make an instantaneous click even on slow frames.
+            let frames = vec![vec![egui::Event::PointerMoved(pos)], vec![button(true), button(false)]];
+            return self.after_input(frames, json!({ "clicked": [x, y] }), since);
+        }
+        let s = self.shared.lock().map_err(|_| "control state poisoned")?;
+        let id = match (p.get("id"), p.get("label").and_then(Value::as_str)) {
+            (Some(id), _) => {
+                let id: u64 =
+                    id.as_u64().or_else(|| id.as_str().and_then(|s| s.parse().ok())).ok_or("ui.click: id must be a widget id from ui.inspect")?;
+                let id = NodeId(id);
+                if !s.nodes.contains_key(&id) {
+                    return Err(format!("ui.click: no widget with id {} on screen (run ui.inspect again)", id.0));
+                }
+                id
+            }
+            (None, Some(label)) => {
+                let want = label.to_lowercase();
+                let matches: Vec<NodeId> = s
+                    .nodes
+                    .iter()
+                    .filter(|(_, n)| n.supports_action(Action::Click) && !n.is_disabled() && n.label().is_some_and(|l| l.to_lowercase() == want))
+                    .map(|(id, _)| *id)
+                    .collect();
+                match matches.as_slice() {
+                    [one] => *one,
+                    [] => return Err(format!("ui.click: no enabled clickable widget labelled {label:?} (try ui.inspect with query)")),
+                    many => return Err(format!("ui.click: {} widgets are labelled {label:?}; click one by id", many.len())),
+                }
+            }
+            (None, None) => return Err("ui.click: pass id, label, or x and y".into()),
+        };
+        let node = &s.nodes[&id];
+        if node.is_disabled() {
+            return Err(format!("ui.click: widget {} ({}) is disabled", id.0, node.label().unwrap_or("unlabelled")));
+        }
+        let label = node.label().map(str::to_owned);
+        let action = accesskit::ActionRequest { action: Action::Click, target_tree: accesskit::TreeId::ROOT, target_node: id, data: None };
+        drop(s);
+        let frames = vec![vec![egui::Event::AccessKitActionRequest(action)]];
+        self.after_input(frames, json!({ "clicked": id.0.to_string(), "label": label }), since)
+    }
+
+    /// Focus an accesskit widget by id or unique enabled label.
+    fn focus(&mut self, p: &Value, since: web_time::Instant) -> Result<Handled, String> {
+        only_params(p, "ui.focus", &["id", "label"])?;
+        let s = self.shared.lock().map_err(|_| "control state poisoned")?;
+        let id = match (p.get("id"), p.get("label")) {
+            (Some(id), None) => {
+                NodeId(id.as_u64().or_else(|| id.as_str().and_then(|s| s.parse().ok())).ok_or("ui.focus: id must be a widget id from ui.inspect")?)
+            }
+            (None, Some(Value::String(label))) => {
+                let matches: Vec<NodeId> = s
+                    .nodes
+                    .iter()
+                    .filter(|(_, n)| n.supports_action(Action::Focus) && !n.is_disabled() && n.label().is_some_and(|l| l.eq_ignore_ascii_case(label)))
+                    .map(|(id, _)| *id)
+                    .collect();
+                match matches.as_slice() {
+                    [one] => *one,
+                    [] => return Err(format!("ui.focus: no enabled focusable widget labelled {label:?}")),
+                    many => return Err(format!("ui.focus: {} widgets are labelled {label:?}; use a widget id", many.len())),
+                }
+            }
+            _ => return Err("ui.focus: pass exactly one widget id or label".into()),
+        };
+        let node = s.nodes.get(&id).ok_or_else(|| format!("ui.focus: no widget with id {} on screen (run ui.inspect again)", id.0))?;
+        if node.is_disabled() || !node.supports_action(Action::Focus) {
+            return Err(format!("ui.focus: widget {} is disabled or not focusable", id.0));
+        }
+        let action = accesskit::ActionRequest { action: Action::Focus, target_tree: accesskit::TreeId::ROOT, target_node: id, data: None };
+        drop(s);
+        let frames = vec![vec![egui::Event::AccessKitActionRequest(action)]];
+        self.after_input(frames, json!({ "focus_requested": id.0.to_string() }), since)
+    }
+}
+
+pub(super) enum Handled {
+    Now(Reply),
+    /// Answer after this many accepted UI passes, without injecting input.
+    AfterFrames(u32, Value),
+    AfterInput {
+        batches: Vec<u64>,
+        frames: u32,
+        value: Value,
+    },
+    Screenshot(Option<egui::Rect>),
+}
+
+fn widget(id: NodeId, n: &accesskit::Node, depth: usize, focused: bool) -> Value {
+    let rect = n.bounds().map(|b| [b.x0, b.y0, b.x1, b.y1]);
+    let mut w = json!({
+        // A string: 64-bit ids don't survive JSON parsers that use doubles.
+        "id": id.0.to_string(),
+        "role": format!("{:?}", n.role()),
+        "depth": depth,
+        "enabled": !n.is_disabled(),
+        "clickable": n.supports_action(Action::Click),
+        "focusable": n.supports_action(Action::Focus),
+    });
+    let mut more = serde_json::Map::new();
+    let obj = &mut more;
+    if let Some(l) = n.label() {
+        obj.insert("label".into(), json!(l));
+    }
+    if let Some(v) = n.value() {
+        obj.insert("value".into(), json!(v));
+    }
+    if let Some(d) = n.description() {
+        obj.insert("description".into(), json!(d));
+    }
+    if let Some(r) = rect {
+        obj.insert("rect".into(), json!(r));
+    }
+    if let Some(t) = n.toggled() {
+        obj.insert("toggled".into(), json!(format!("{t:?}").to_lowercase()));
+    }
+    if let Some(s) = n.is_selected() {
+        obj.insert("selected".into(), json!(s));
+    }
+    if focused {
+        obj.insert("focused".into(), json!(true));
+    }
+    if let Value::Object(m) = &mut w {
+        m.extend(more);
+    }
+    w
+}
+
+fn only_params(p: &Value, method: &str, allowed: &[&str]) -> Result<(), String> {
+    // The JSON-RPC transport represents omitted params as null.
+    if p.is_null() && allowed.is_empty() {
+        return Ok(());
+    }
+    let object = p.as_object().ok_or_else(|| format!("{method}: params must be an object"))?;
+    if let Some(key) = object.keys().find(|key| !allowed.contains(&key.as_str())) {
+        return Err(format!("{method}: unknown parameter {key:?}"));
+    }
+    Ok(())
+}
+
+fn pointer_button(p: &Value, method: &str) -> Result<egui::PointerButton, String> {
+    match p.get("button").and_then(Value::as_str).unwrap_or("primary") {
+        "primary" | "left" => Ok(egui::PointerButton::Primary),
+        "secondary" | "right" => Ok(egui::PointerButton::Secondary),
+        "middle" => Ok(egui::PointerButton::Middle),
+        other => Err(format!("{method}: unknown button {other:?} (primary, secondary, middle)")),
+    }
+}
+
+/// The events for one synthetic key press. egui updates `InputState.modifiers` only from
+/// `ModifiersChanged`, not from the `modifiers` field on a key event, so the held set goes in
+/// before the press and is released after the key-up. Without this, handlers that read
+/// `i.modifiers` (Shift+Tab, ⌘Enter) would see stale state.
+pub(super) fn key_batches(key: egui::Key, modifiers: egui::Modifiers) -> Vec<Vec<egui::Event>> {
+    let key_event = |pressed| egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers };
+    let mut press = vec![key_event(true)];
+    if modifiers != egui::Modifiers::NONE {
+        press.insert(0, egui::Event::ModifiersChanged(modifiers));
+    }
+    let mut release = vec![key_event(false)];
+    if modifiers != egui::Modifiers::NONE {
+        release.push(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+    }
+    vec![press, release]
+}
+
+fn modifiers(v: Option<&Value>) -> Result<egui::Modifiers, String> {
+    let mut m = egui::Modifiers::NONE;
+    for name in v.and_then(Value::as_array).into_iter().flatten() {
+        match name.as_str().unwrap_or("") {
+            "command" | "cmd" => m.command = true,
+            "shift" => m.shift = true,
+            "alt" | "option" => m.alt = true,
+            "ctrl" | "control" => m.ctrl = true,
+            "mac_cmd" => m.mac_cmd = true,
+            other => return Err(format!("ui.key: unknown modifier {other:?} (command, shift, alt, ctrl)")),
+        }
+    }
+    // "command" is ⌘ on macOS and Ctrl elsewhere, as egui expects.
+    if m.command {
+        if cfg!(target_os = "macos") {
+            m.mac_cmd = true;
+        } else {
+            m.ctrl = true;
+        }
+    }
+    Ok(m)
+}
+
+fn rect_param(v: &Value) -> Result<egui::Rect, String> {
+    let a: Vec<f32> = v.as_array().map(|a| a.iter().filter_map(Value::as_f64).map(|f| f as f32).collect()).unwrap_or_default();
+    match a.as_slice() {
+        [x0, y0, x1, y1] if x1 > x0 && y1 > y0 => Ok(egui::Rect::from_min_max(egui::pos2(*x0, *y0), egui::pos2(*x1, *y1))),
+        _ => Err("region must be [x0, y0, x1, y1] in points".into()),
+    }
+}
diff --git a/crates/ui-egui/src/control/screenshot.rs b/crates/ui-egui/src/control/screenshot.rs
new file mode 100644
index 0000000000..9eb3e50bbd
--- /dev/null
+++ b/crates/ui-egui/src/control/screenshot.rs
@@ -0,0 +1,284 @@
+use super::*;
+
+/// Screenshot admission limits: bounded requests, per-image bytes and aggregate retained bytes.
+const MAX_PENDING_SCREENSHOTS: usize = 4;
+
+pub(super) const MAX_IMAGE_BYTES: usize = 128 * 1024 * 1024;
+
+const MAX_TOTAL_BYTES: usize = 256 * 1024 * 1024;
+
+/// One image's encode working copies are bounded too: the RGBA buffer fed to the PNG encoder,
+/// the encoded PNG, and the base64 string in the reply. They are made one capture at a time,
+/// after the retained image budget above has been checked. Peak encoding memory is therefore at
+/// most the retained aggregate plus one crop, one PNG and one base64 string; it is not hidden
+/// behind the retained-image limit.
+const MAX_ENCODED_BYTES: usize = MAX_IMAGE_BYTES;
+
+const MAX_BASE64_BYTES: usize = 192 * 1024 * 1024;
+
+/// Replace one pending capture's reservation with `bytes`, keeping the other reservations.
+///
+/// The drain retries captures one at a time: using a single total taken before the loop would
+/// let several retries each see room that no longer exists together, and the aggregate would
+/// grow past [`MAX_TOTAL_BYTES`].
+pub(super) fn retried_reservation(total: usize, old: usize, bytes: usize) -> Option<usize> {
+    let without_this = total.saturating_sub(old);
+    let new_total = without_this.saturating_add(bytes);
+    (bytes <= MAX_IMAGE_BYTES && new_total <= MAX_TOTAL_BYTES).then_some(new_total)
+}
+
+/// The window content a screenshot request was admitted and issued for.
+///
+/// Only the viewport's local size and scale matter: the window's position on the monitor does not
+/// change a single captured pixel, and keyboard focus is not part of the captured content.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) struct Geometry {
+    pub(super) size: egui::Vec2,
+    pub(super) pixels_per_point: f32,
+    /// Active document and open dialog/prompt identity, never the focused widget.
+    pub(super) epoch: u64,
+}
+
+impl Geometry {
+    /// Capture the current viewport size and effective pixels-per-point for the request epoch.
+    pub(super) fn current(ctx: &egui::Context, epoch: u64) -> Self {
+        // Viewport info is refreshed by `run_logic`; the last UI pass's `viewport_rect` can be
+        // stale while the window is hidden. Fall back to it only when the host cannot say. Only
+        // its size is kept: `inner_rect` is in monitor space and its origin may move.
+        let (rect, native) = ctx.input(|i| {
+            let viewport = i.viewport();
+            (viewport.inner_rect.unwrap_or_else(|| i.viewport_rect()), viewport.native_pixels_per_point)
+        });
+        let native = native.or_else(|| ctx.native_pixels_per_point()).unwrap_or(1.0);
+        Self { size: rect.size(), pixels_per_point: native * ctx.zoom_factor(), epoch }
+    }
+
+    /// Checked bytes an image of this geometry needs, before the capture is issued.
+    pub(super) fn image_bytes(self) -> Option<usize> {
+        let width = (self.size.x * self.pixels_per_point).ceil();
+        let height = (self.size.y * self.pixels_per_point).ceil();
+        if !(width.is_finite() && height.is_finite()) || width <= 0.0 || height <= 0.0 {
+            return None;
+        }
+        checked_image_bytes(width as usize, height as usize)
+    }
+
+    /// Whether `region` is a non-empty rectangle inside this viewport, in logical points.
+    pub(super) fn contains_region(self, region: egui::Rect) -> bool {
+        region.min.x.is_finite()
+            && region.min.y.is_finite()
+            && region.max.x.is_finite()
+            && region.max.y.is_finite()
+            && region.min.x >= 0.0
+            && region.min.y >= 0.0
+            && region.max.x > region.min.x
+            && region.max.y > region.min.y
+            && region.max.x <= self.size.x
+            && region.max.y <= self.size.y
+    }
+}
+
+/// Return the byte size of an RGBA image of the given dimensions, or `None` when the multiplication
+/// overflows.
+fn checked_image_bytes(width: usize, height: usize) -> Option<usize> {
+    width.checked_mul(height)?.checked_mul(core::mem::size_of::<egui::Color32>())
+}
+
+impl Control {
+    /// Return the total screenshot bytes reserved by pending captures without overflowing.
+    pub(super) fn reserved_bytes(&self) -> usize {
+        self.pending
+            .iter()
+            .filter_map(|p| if let Pending::Screenshot { reserved, .. } = p { Some(*reserved) } else { None })
+            .fold(0usize, usize::saturating_add)
+    }
+
+    /// Count the screenshot requests still waiting for a capture.
+    fn pending_screenshots(&self) -> usize {
+        self.pending.iter().filter(|p| matches!(p, Pending::Screenshot { .. })).count()
+    }
+
+    /// Admit one screenshot request within the count, per-image and aggregate limits.
+    pub(super) fn admit_screenshot(
+        &mut self,
+        ctx: &egui::Context,
+        host: &mut impl Host,
+        region: Option<egui::Rect>,
+        reply: Sender<Reply>,
+        since: web_time::Instant,
+    ) {
+        if self.pending_screenshots() >= MAX_PENDING_SCREENSHOTS {
+            let _ = reply.send(Err(format!("too many screenshots are already pending (limit {MAX_PENDING_SCREENSHOTS})")));
+            return;
+        }
+        let geometry = Geometry::current(ctx, host.capture_epoch());
+        let Some(bytes) = geometry.image_bytes() else {
+            let _ = reply.send(Err("the window has no capturable size".into()));
+            return;
+        };
+        if let Some(region) = region
+            && !geometry.contains_region(region)
+        {
+            let _ = reply.send(Err("the region must lie inside the window".into()));
+            return;
+        }
+        if bytes > MAX_IMAGE_BYTES {
+            let _ = reply.send(Err(format!("the screenshot would use {bytes} bytes, over the {MAX_IMAGE_BYTES}-byte image limit")));
+            return;
+        }
+        if self.reserved_bytes().saturating_add(bytes) > MAX_TOTAL_BYTES {
+            let _ = reply.send(Err(format!("the screenshot would exceed the {MAX_TOTAL_BYTES}-byte aggregate screenshot budget")));
+            return;
+        }
+        let (slot, callback) = craft_ui::capture::CaptureSlot::new(ctx, egui::ViewportId::ROOT, MAX_IMAGE_BYTES);
+        self.pending.push(Pending::Screenshot { slot, callback: Some(callback), region, reply, since, geometry, reserved: bytes, attempts: 0 });
+    }
+}
+
+/// Encode (a region of) a screenshot as PNG; the reply carries base64 data and the size.
+///
+/// The image scale is derived from the returned pixels and the logical viewport the capture was
+/// admitted for, never from the current `Context`: egui-wgpu's surface fit may have shrunk the
+/// surface (and a resize/DPI change has already been rejected before this call).
+pub(super) fn screenshot_png(image: &egui::ColorImage, region: Option<egui::Rect>, geometry: Geometry) -> Reply {
+    let [w, h] = image.size;
+    let view = geometry.size;
+    if w == 0 || h == 0 {
+        return Err("the screenshot has no pixels".into());
+    }
+    if !(view.x.is_finite() && view.y.is_finite()) || view.x <= 0.0 || view.y <= 0.0 {
+        return Err("the window has no capturable size".into());
+    }
+    if region.is_some_and(|region| !geometry.contains_region(region)) {
+        return Err("the region must lie inside the window".into());
+    }
+    let scale_x = w as f32 / view.x;
+    let scale_y = h as f32 / view.y;
+    // A fitted surface shrinks both sides by one factor; a different x/y scale means the window
+    // changed shape and this image cannot be cropped honestly.
+    if (scale_x - scale_y).abs() > 0.01 * scale_x.max(1.0) {
+        return Err("the screenshot's aspect ratio does not match the window".into());
+    }
+    let (x0, y0, x1, y1) = match region {
+        Some(r) => {
+            let px = |v: f32, scale: f32, max: usize| ((v * scale).round().max(0.0) as usize).min(max);
+            (px(r.min.x, scale_x, w), px(r.min.y, scale_y, h), px(r.max.x, scale_x, w), px(r.max.y, scale_y, h))
+        }
+        None => (0, 0, w, h),
+    };
+    if x1 <= x0 || y1 <= y0 {
+        return Err("the region is outside the window".into());
+    }
+    let crop_bytes = (x1 - x0)
+        .checked_mul(y1 - y0)
+        .and_then(|pixels| pixels.checked_mul(core::mem::size_of::<egui::Color32>()))
+        .ok_or_else(|| "the screenshot region is too large".to_string())?;
+    if crop_bytes > MAX_ENCODED_BYTES {
+        return Err(format!("the screenshot region would need {crop_bytes} bytes to encode, over the {MAX_ENCODED_BYTES}-byte encode limit"));
+    }
+    let mut rgba = Vec::with_capacity(crop_bytes);
+    for y in y0..y1 {
+        for px in &image.pixels[y * w + x0..y * w + x1] {
+            rgba.extend_from_slice(&px.to_srgba_unmultiplied());
+        }
+    }
+    let (cw, ch) = ((x1 - x0) as u32, (y1 - y0) as u32);
+    let mut out = Vec::new();
+    let mut enc = png::Encoder::new(&mut out, cw, ch);
+    enc.set_color(png::ColorType::Rgba);
+    enc.set_depth(png::BitDepth::Eight);
+    let mut writer = enc.write_header().map_err(|e| e.to_string())?;
+    writer.write_image_data(&rgba).map_err(|e| e.to_string())?;
+    writer.finish().map_err(|e| e.to_string())?;
+    if out.len() > MAX_ENCODED_BYTES {
+        return Err(format!("the encoded screenshot is {} bytes, over the {MAX_ENCODED_BYTES}-byte encode limit", out.len()));
+    }
+    let encoded = out.len().div_ceil(3).checked_mul(4).ok_or_else(|| "the encoded screenshot is too large".to_string())?;
+    if encoded > MAX_BASE64_BYTES {
+        return Err(format!("the screenshot's base64 reply would be {encoded} bytes, over the {MAX_BASE64_BYTES}-byte limit"));
+    }
+    use base64::Engine as _;
+    Ok(json!({
+        "png_base64": base64::engine::general_purpose::STANDARD.encode(out),
+        "width": cw,
+        "height": ch,
+        "pixels_per_point": scale_x,
+    }))
+}
+
+#[cfg(test)]
+mod screenshot_geometry_tests {
+    use super::*;
+
+    #[test]
+    fn image_bytes_are_checked_against_overflow_and_limits() {
+        assert_eq!(checked_image_bytes(2, 3), Some(24));
+        assert_eq!(checked_image_bytes(usize::MAX, 2), None);
+        let big = Geometry { size: egui::vec2(10_000.0, 10_000.0), pixels_per_point: 8.0, epoch: 0 };
+        assert!(big.image_bytes().is_some_and(|bytes| bytes > MAX_IMAGE_BYTES));
+    }
+
+    /// The crop is derived from the returned pixels and the admitted logical rect, not from a
+    /// current `pixels_per_point`: a fitted surface may return a smaller image.
+    #[test]
+    fn region_crop_uses_the_capture_geometry() {
+        let image = egui::ColorImage::filled([200, 100], egui::Color32::RED);
+        let geometry = Geometry { size: egui::vec2(100.0, 50.0), pixels_per_point: 2.0, epoch: 7 };
+        let reply =
+            screenshot_png(&image, Some(egui::Rect::from_min_max(egui::pos2(10.0, 5.0), egui::pos2(60.0, 30.0))), geometry).expect("a valid crop");
+        assert_eq!(reply["width"], 100);
+        assert_eq!(reply["height"], 50);
+        assert_eq!(reply["pixels_per_point"], 2.0);
+    }
+
+    /// A retry replaces one reservation in a running aggregate. Three 50 MiB captures that each
+    /// retry to 100 MiB must not all be admitted against a stale 150 MiB snapshot.
+    #[test]
+    fn retries_keep_one_running_aggregate_budget() {
+        const MIB: usize = 1024 * 1024;
+        let first = retried_reservation(3 * 50 * MIB, 50 * MIB, 100 * MIB).expect("the first retry fits");
+        let second = retried_reservation(first, 50 * MIB, 100 * MIB).expect("the second retry fits");
+        assert_eq!(second, 250 * MIB);
+        assert_eq!(retried_reservation(second, 50 * MIB, 100 * MIB), None, "the third would pass 256 MiB");
+        assert_eq!(retried_reservation(0, 0, MAX_IMAGE_BYTES + 1), None, "a single image over the per-image limit never fits");
+    }
+
+    #[test]
+    fn an_image_with_another_aspect_ratio_is_rejected() {
+        let image = egui::ColorImage::filled([200, 100], egui::Color32::RED);
+        let geometry = Geometry { size: egui::vec2(100.0, 60.0), pixels_per_point: 2.0, epoch: 0 };
+        assert!(screenshot_png(&image, None, geometry).is_err());
+    }
+
+    #[test]
+    fn an_outside_region_is_rejected_not_panicking() {
+        let image = egui::ColorImage::filled([20, 10], egui::Color32::RED);
+        let geometry = Geometry { size: egui::vec2(10.0, 5.0), pixels_per_point: 2.0, epoch: 0 };
+        assert!(screenshot_png(&image, Some(egui::Rect::from_min_max(egui::pos2(11.0, 6.0), egui::pos2(15.0, 9.0))), geometry).is_err());
+    }
+
+    /// A region that a shrink now cuts off is refused, not silently clamped to a smaller crop.
+    #[test]
+    fn a_region_cut_by_a_shrink_is_rejected_instead_of_cropped() {
+        let image = egui::ColorImage::filled([20, 10], egui::Color32::RED);
+        let shrunk = Geometry { size: egui::vec2(10.0, 5.0), pixels_per_point: 2.0, epoch: 0 };
+        let region = egui::Rect::from_min_max(egui::pos2(8.0, 4.0), egui::pos2(15.0, 9.0));
+        assert!(!shrunk.contains_region(region));
+        let error = screenshot_png(&image, Some(region), shrunk).expect_err("a cut region must not become a smaller image");
+        assert!(error.contains("inside the window"), "{error}");
+    }
+
+    /// Screenshot identity is the captured content, not the window's monitor-space origin or the
+    /// focused widget: only the capture epoch and the viewport-local size/scale matter.
+    #[test]
+    fn capture_geometry_compares_size_scale_and_capture_epoch_only() {
+        let admitted = Geometry { size: egui::vec2(800.0, 600.0), pixels_per_point: 2.0, epoch: 5 };
+        assert_eq!(admitted, Geometry { size: egui::vec2(800.0, 600.0), pixels_per_point: 2.0, epoch: 5 });
+        assert_ne!(admitted, Geometry { size: egui::vec2(801.0, 600.0), pixels_per_point: 2.0, epoch: 5 });
+        assert_ne!(admitted, Geometry { size: egui::vec2(800.0, 600.0), pixels_per_point: 1.5, epoch: 5 });
+        assert_ne!(admitted, Geometry { size: egui::vec2(800.0, 600.0), pixels_per_point: 2.0, epoch: 6 });
+        assert!(admitted.contains_region(egui::Rect::from_min_max(egui::pos2(0.0, 0.0), egui::pos2(800.0, 600.0))));
+        assert!(!admitted.contains_region(egui::Rect::from_min_max(egui::pos2(0.0, 0.0), egui::pos2(801.0, 600.0))));
+        assert!(!admitted.contains_region(egui::Rect::from_min_max(egui::pos2(-1.0, 0.0), egui::pos2(10.0, 10.0))));
+    }
+}
diff --git a/crates/ui-egui/src/control/transport.rs b/crates/ui-egui/src/control/transport.rs
new file mode 100644
index 0000000000..81e30ff108
--- /dev/null
+++ b/crates/ui-egui/src/control/transport.rs
@@ -0,0 +1,615 @@
+use super::*;
+
+// ---- transport (native only) -----------------------------------------------------------------
+
+/// Where a running app's control channel can be reached (written to the `--control` file).
+#[cfg(not(target_arch = "wasm32"))]
+pub struct Endpoint {
+    pub port: u16,
+    pub token: String,
+}
+
+/// What a connection may do before it authenticates, so an unauthenticated local client cannot
+/// hold a thread for ever or exhaust them (#1806).
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Clone, Copy)]
+struct Limits {
+    /// How long a connection has to authenticate, counted from its acceptance: an absolute
+    /// deadline, so a client feeding one byte at a time cannot extend it.
+    auth_deadline: std::time::Duration,
+    /// How many connections may wait for authentication at once; further ones are refused.
+    max_unauthenticated: usize,
+    /// How long a write may block on a client that never reads its replies.
+    write_timeout: std::time::Duration,
+    /// How long a connection refused after a reply is kept half-open, discarding input, so the
+    /// reply is not lost to a reset (see [`close_after_reply`]).
+    linger: std::time::Duration,
+    /// How many refused connections may linger at once. A lingering connection has given back
+    /// its place among [`Self::max_unauthenticated`], so this is what bounds their threads;
+    /// beyond it a refused connection is closed at once.
+    max_lingering: usize,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+const LIMITS: Limits = Limits {
+    auth_deadline: std::time::Duration::from_secs(10),
+    max_unauthenticated: 8,
+    write_timeout: std::time::Duration::from_secs(30),
+    linger: std::time::Duration::from_secs(1),
+    max_lingering: 8,
+};
+
+/// One of a limited number of places, given back when dropped: a place among
+/// [`Limits::max_unauthenticated`] (given back when the connection authenticates or is refused,
+/// and on every way its thread can end), or among [`Limits::max_lingering`].
+#[cfg(not(target_arch = "wasm32"))]
+struct Slot(std::sync::Arc<std::sync::atomic::AtomicUsize>);
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Slot {
+    fn take(waiting: &std::sync::Arc<std::sync::atomic::AtomicUsize>, max: usize) -> Option<Self> {
+        use std::sync::atomic::Ordering;
+        let mut n = waiting.load(Ordering::Acquire);
+        loop {
+            if n >= max {
+                return None;
+            }
+            match waiting.compare_exchange_weak(n, n.saturating_add(1), Ordering::AcqRel, Ordering::Acquire) {
+                Ok(_) => return Some(Slot(waiting.clone())),
+                Err(now) => n = now,
+            }
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Drop for Slot {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, std::sync::atomic::Ordering::AcqRel);
+    }
+}
+
+/// The reading half of a connection, with the authentication deadline: every read before it
+/// gets the time left as its timeout, and none at all once it has passed.
+#[cfg(not(target_arch = "wasm32"))]
+struct Reading {
+    stream: std::net::TcpStream,
+    until: Option<std::time::Instant>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl std::io::Read for Reading {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        if let Some(until) = self.until {
+            let left = until.saturating_duration_since(std::time::Instant::now());
+            if left.is_zero() {
+                return Err(std::io::Error::new(std::io::ErrorKind::TimedOut, "the authentication deadline passed"));
+            }
+            self.stream.set_read_timeout(Some(left))?;
+        }
+        self.stream.read(buf)
+    }
+}
+
+/// Close a connection whose last reply has just been written without losing that reply.
+///
+/// Closing a socket with input still unread makes the kernel send a reset instead of a FIN, and
+/// the reset can discard the reply before the client reads it (Linux does): a client still
+/// sending when it is refused would never learn why. So send FIN first, then read and discard
+/// whatever arrives until the client closes its side or `linger` passes, and only then close.
+///
+/// Only [`Limits::max_lingering`] connections linger at once: `place` is one of those places,
+/// taken by [`refuse`] before the reply was written, and held for the drain only. Without one
+/// the connection is closed at once after the FIN, accepting the risk of a reset rather than
+/// holding another thread.
+#[cfg(not(target_arch = "wasm32"))]
+fn close_after_reply(reading: &mut Reading, place: Option<Slot>, linger: std::time::Duration) {
+    use std::io::Read;
+    let _ = reading.stream.shutdown(std::net::Shutdown::Write);
+    let Some(_place) = place else { return };
+    reading.until = Some(std::time::Instant::now() + linger);
+    let mut sink = [0u8; 1024];
+    // Each read is bounded by the time left, and none is made once `linger` has passed.
+    while matches!(reading.read(&mut sink), Ok(n) if n > 0) {}
+}
+
+/// A connection is being refused before `auth`: give back its place among those waiting to
+/// authenticate, so it does not keep a real client out while it lingers, and take a place to
+/// linger in if one is free. Done before the reply is written, so a client that has read the
+/// reply sees the places as they will be.
+#[cfg(not(target_arch = "wasm32"))]
+fn refuse(slot: &mut Option<Slot>, lingering: &std::sync::Arc<std::sync::atomic::AtomicUsize>, limits: Limits) -> Option<Slot> {
+    drop(slot.take());
+    Slot::take(lingering, limits.max_lingering)
+}
+
+/// Listen on `127.0.0.1` (random port) and forward authenticated requests to `client`.
+///
+/// Protocol: newline-delimited JSON-RPC 2.0. The first request on a connection must be
+/// `{"method": "auth", "params": {"token": …}}`; anything else closes the connection, and so does
+/// a line longer than [`MAX_AUTH_LINE`] before that, or [`LIMITS`] passing without it.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn serve(client: ControlClient) -> std::io::Result<Endpoint> {
+    serve_with(client, LIMITS)
+}
+
+/// How long the accepting thread waits after a failed accept. Accepting can keep failing, for
+/// example while the process has no file descriptors left, and retrying at once would keep a
+/// core busy until it recovers. The single-instance listener waits the same way.
+#[cfg(not(target_arch = "wasm32"))]
+const ACCEPT_RETRY: std::time::Duration = std::time::Duration::from_millis(100);
+
+/// The connections `incoming` accepts, calling `wait` after each failed accept.
+#[cfg(not(target_arch = "wasm32"))]
+fn accepted<T>(incoming: impl Iterator<Item = std::io::Result<T>>, mut wait: impl FnMut()) -> impl Iterator<Item = T> {
+    incoming.filter_map(move |stream| stream.map_err(|_| wait()).ok())
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn serve_with(client: ControlClient, limits: Limits) -> std::io::Result<Endpoint> {
+    use std::io::{BufReader, Write};
+    let listener = std::net::TcpListener::bind(("127.0.0.1", 0))?;
+    let port = listener.local_addr()?.port();
+    let token = random_token()?;
+    let expected = token.clone();
+    let waiting = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
+    let lingering = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
+    std::thread::Builder::new().name("pdfcraft-control".into()).spawn(move || {
+        for stream in accepted(listener.incoming(), || std::thread::sleep(ACCEPT_RETRY)) {
+            let _ = stream.set_write_timeout(Some(limits.write_timeout));
+            // Admitted only while fewer than the limit wait to authenticate: refused on the
+            // accepting thread, so a refused connection costs no thread at all.
+            let Some(slot) = Slot::take(&waiting, limits.max_unauthenticated) else {
+                let mut write = stream;
+                let e = rpc_error(Value::Null, -32003, "too many connections waiting to authenticate; try again later");
+                let _ = writeln!(write, "{e}").and_then(|_| write.flush());
+                continue;
+            };
+            let client = client.clone();
+            let expected = expected.clone();
+            let lingering = lingering.clone();
+            let _ = std::thread::Builder::new().name("pdfcraft-control-conn".into()).spawn(move || {
+                // Held until `auth` succeeds; given back however this thread ends.
+                let mut slot = Some(slot);
+                let Ok(read) = stream.try_clone() else { return };
+                let mut write = stream;
+                let mut authed = false;
+                let mut reader = BufReader::new(Reading { stream: read, until: Some(std::time::Instant::now() + limits.auth_deadline) });
+                let mut buf = Vec::new();
+                loop {
+                    // Until `auth` succeeds, lines are capped at MAX_AUTH_LINE; afterwards they
+                    // are read whole, as before.
+                    let max = if authed { usize::MAX } else { MAX_AUTH_LINE };
+                    match read_line_limited(&mut reader, &mut buf, max) {
+                        Ok(LineRead::Line) => {}
+                        // The deadline passed before `auth`: say so and close.
+                        Err(e) if !authed && matches!(e.kind(), std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock) => {
+                            let secs = limits.auth_deadline.as_secs_f64();
+                            let e = rpc_error(Value::Null, -32004, &format!("not authenticated within {secs} s"));
+                            let place = refuse(&mut slot, &lingering, limits);
+                            if writeln!(write, "{e}").and_then(|_| write.flush()).is_ok() {
+                                close_after_reply(reader.get_mut(), place, limits.linger);
+                            }
+                            break;
+                        }
+                        // End of stream or a failed read ends the connection, as before.
+                        Ok(LineRead::End) | Err(_) => break,
+                        Ok(LineRead::TooLong) => {
+                            let e = rpc_error(Value::Null, -32600, &format!("request line longer than {max} bytes before auth"));
+                            let place = refuse(&mut slot, &lingering, limits);
+                            if writeln!(write, "{e}").and_then(|_| write.flush()).is_ok() {
+                                close_after_reply(reader.get_mut(), place, limits.linger);
+                            }
+                            break;
+                        }
+                    }
+                    // Bytes that aren't UTF-8 end the connection, as `BufRead::lines` did.
+                    let Ok(line) = std::str::from_utf8(&buf) else { break };
+                    if line.trim().is_empty() {
+                        continue;
+                    }
+                    let (reply, close) = match serde_json::from_str::<Value>(line) {
+                        // Before `auth`, like any other first request, this closes the connection.
+                        Err(e) => (rpc_error(Value::Null, -32700, &format!("parse error: {e}")), !authed),
+                        Ok(msg) => {
+                            let id = msg.get("id").cloned().unwrap_or(Value::Null);
+                            let method = msg.get("method").and_then(Value::as_str).unwrap_or("");
+                            let params = msg.get("params").cloned().unwrap_or(Value::Null);
+                            if !authed {
+                                let ok =
+                                    method == "auth" && params.get("token").and_then(Value::as_str).is_some_and(|t| constant_time_eq(t, &expected));
+                                authed = ok;
+                                if ok {
+                                    // Authenticated: no deadline from here on, and its place is free.
+                                    reader.get_mut().until = None;
+                                    let _ = reader.get_mut().stream.set_read_timeout(None);
+                                    drop(slot.take());
+                                    (json!({ "jsonrpc": "2.0", "id": id, "result": { "ok": true } }), false)
+                                } else {
+                                    (rpc_error(id, -32001, "authenticate first: auth {token}"), true)
+                                }
+                            } else {
+                                let rx = client.send(method, params);
+                                match rx.recv_timeout(std::time::Duration::from_secs(30)) {
+                                    Ok(Ok(v)) => (json!({ "jsonrpc": "2.0", "id": id, "result": v }), false),
+                                    Ok(Err(e)) => (rpc_error(id, -32000, &e), false),
+                                    Err(_) => (rpc_error(id, -32002, "the app did not answer within 30 s"), false),
+                                }
+                            }
+                        }
+                    };
+                    // `close` is only ever set before `auth`.
+                    let place = if close { refuse(&mut slot, &lingering, limits) } else { None };
+                    if writeln!(write, "{reply}").and_then(|_| write.flush()).is_err() {
+                        break;
+                    }
+                    if close {
+                        close_after_reply(reader.get_mut(), place, limits.linger);
+                        break;
+                    }
+                }
+            });
+        }
+    })?;
+    Ok(Endpoint { port, token })
+}
+
+/// Longest line read before a connection has authenticated. The only acceptable request then is
+/// `auth`, about a hundred bytes; a longer line is refused without buffering the rest of it.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_AUTH_LINE: usize = 4 * 1024;
+
+/// What [`read_line_limited`] found.
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Debug, PartialEq, Eq)]
+enum LineRead {
+    /// A line, now in the buffer (newline and a trailing `\r` stripped).
+    Line,
+    /// End of stream.
+    End,
+    /// The line is longer than the limit; at most limit + 1 bytes of it were read.
+    TooLong,
+}
+
+/// Read one `\n`-terminated line of at most `max` bytes into `buf`.
+#[cfg(not(target_arch = "wasm32"))]
+fn read_line_limited(reader: &mut impl std::io::BufRead, buf: &mut Vec<u8>, max: usize) -> std::io::Result<LineRead> {
+    use std::io::{BufRead, Read};
+    buf.clear();
+    // `take` bounds what is buffered for one line: never more than `max` + 1 bytes.
+    let limit = u64::try_from(max).unwrap_or(u64::MAX).saturating_add(1);
+    if reader.take(limit).read_until(b'\n', buf)? == 0 {
+        return Ok(LineRead::End);
+    }
+    if buf.last() == Some(&b'\n') {
+        buf.pop();
+        if buf.last() == Some(&b'\r') {
+            buf.pop();
+        }
+        return Ok(LineRead::Line);
+    }
+    // No newline: either the limit was passed, or this is a last line before end of stream.
+    Ok(if buf.len() > max { LineRead::TooLong } else { LineRead::Line })
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn rpc_error(id: Value, code: i64, message: &str) -> Value {
+    json!({ "jsonrpc": "2.0", "id": id, "error": { "code": code, "message": message } })
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn constant_time_eq(a: &str, b: &str) -> bool {
+    a.len() == b.len() && a.bytes().zip(b.bytes()).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
+}
+
+/// 128 random bits from the OS, hex-encoded.
+#[cfg(not(target_arch = "wasm32"))]
+fn random_token() -> std::io::Result<String> {
+    let mut bytes = [0u8; 16];
+    getrandom::fill(&mut bytes).map_err(|e| std::io::Error::other(e.to_string()))?;
+    Ok(bytes.iter().map(|b| format!("{b:02x}")).collect())
+}
+
+#[cfg(test)]
+mod transport_tests {
+    /// A failed accept is followed by a wait before the next one, so a listener that keeps
+    /// failing does not spin, and the connections around the failures still come through.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_failed_accept_waits_before_the_next() {
+        let failed = || Err(std::io::Error::other("no file descriptors left"));
+        let incoming = vec![failed(), Ok(1), failed(), failed(), Ok(2)];
+        let mut waits = 0;
+        let connections: Vec<i32> = super::accepted(incoming.into_iter(), || waits += 1).collect();
+        assert_eq!(connections, [1, 2]);
+        assert_eq!(waits, 3, "one wait per failed accept");
+    }
+
+    /// Before authenticating, a line that isn't JSON gets a parse error and closes the
+    /// connection, as [`super::serve`] documents for any first request other than `auth`.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn malformed_input_before_auth_closes_the_connection() {
+        use std::io::{BufRead, BufReader, ErrorKind, Write};
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve(client).unwrap();
+        let s = std::net::TcpStream::connect(("127.0.0.1", ep.port)).unwrap();
+        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
+        writeln!(s.try_clone().unwrap(), "not json").unwrap();
+        let mut r = BufReader::new(s);
+        let mut first = String::new();
+        r.read_line(&mut first).unwrap();
+        let reply: serde_json::Value = serde_json::from_str(&first).unwrap();
+        assert_eq!(reply["error"]["code"], -32700, "{first}");
+        // Closed: end of stream (or a reset), not a connection left waiting for more input.
+        let mut next = String::new();
+        let closed = match r.read_line(&mut next) {
+            Ok(n) => n == 0,
+            Err(e) => matches!(e.kind(), ErrorKind::ConnectionReset | ErrorKind::ConnectionAborted),
+        };
+        assert!(closed, "the connection stayed open: {next:?}");
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn lines_are_read_up_to_the_limit() {
+        use super::{LineRead, read_line_limited};
+        let mut buf = Vec::new();
+        let mut input: &[u8] = b"aaaaaaaaaa\nbb\r\ncc";
+        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::Line);
+        assert_eq!(buf, b"aaaaaaaaaa", "a line exactly at the limit is accepted");
+        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::Line);
+        assert_eq!(buf, b"bb", "CRLF is stripped");
+        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::Line);
+        assert_eq!(buf, b"cc", "a last line without a newline is still read");
+        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::End, "then end of stream");
+        let long = [b'x'; 100];
+        let mut input: &[u8] = &long;
+        assert_eq!(read_line_limited(&mut input, &mut buf, 10).unwrap(), LineRead::TooLong);
+        assert_eq!(input.len(), 100 - 11, "at most limit + 1 bytes are read; the rest is left");
+    }
+
+    /// Before authenticating, a line longer than [`super::MAX_AUTH_LINE`] is refused as soon as
+    /// the limit is passed (no newline needed) and the connection is closed.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn an_overlong_line_before_auth_is_refused() {
+        use std::io::{BufRead, BufReader, ErrorKind, Write};
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve(client).unwrap();
+        let s = std::net::TcpStream::connect(("127.0.0.1", ep.port)).unwrap();
+        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
+        // Exactly one byte over the limit, without a newline: the server reads it all, so the
+        // close below is a clean end of stream.
+        s.try_clone().unwrap().write_all(&vec![b'x'; super::MAX_AUTH_LINE + 1]).unwrap();
+        let mut r = BufReader::new(s);
+        let mut first = String::new();
+        r.read_line(&mut first).unwrap();
+        let reply: serde_json::Value = serde_json::from_str(&first).unwrap();
+        assert_eq!(reply["error"]["code"], -32600, "{first}");
+        let mut next = String::new();
+        let closed = match r.read_line(&mut next) {
+            Ok(n) => n == 0,
+            Err(e) => matches!(e.kind(), ErrorKind::ConnectionReset | ErrorKind::ConnectionAborted),
+        };
+        assert!(closed, "the connection stayed open: {next:?}");
+    }
+
+    /// Small limits for the tests below: a 300 ms deadline, two places to wait in.
+    #[cfg(not(target_arch = "wasm32"))]
+    const TEST_LIMITS: super::Limits = super::Limits {
+        auth_deadline: std::time::Duration::from_millis(300),
+        max_unauthenticated: 2,
+        write_timeout: std::time::Duration::from_secs(5),
+        linger: std::time::Duration::from_secs(1),
+        max_lingering: 2,
+    };
+
+    /// The next line the server sends, as JSON, or `None` when it closed the connection instead.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn next_line(r: &mut std::io::BufReader<std::net::TcpStream>) -> Option<serde_json::Value> {
+        use std::io::BufRead;
+        let mut line = String::new();
+        match r.read_line(&mut line) {
+            Ok(0) | Err(_) => None,
+            Ok(_) => Some(serde_json::from_str(&line).unwrap()),
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn connect(port: u16) -> std::net::TcpStream {
+        let s = std::net::TcpStream::connect(("127.0.0.1", port)).unwrap();
+        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
+        s
+    }
+
+    /// #1806: a connection that never authenticates is closed at the deadline, counted from its
+    /// acceptance, and a client feeding a byte at a time cannot push that deadline back.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn an_unauthenticated_connection_is_closed_at_the_deadline() {
+        use std::io::{BufReader, Write};
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve_with(client, TEST_LIMITS).unwrap();
+        // Idle.
+        let started = std::time::Instant::now();
+        let mut r = BufReader::new(connect(ep.port));
+        let reply = next_line(&mut r).expect("the server says why before closing");
+        assert_eq!(reply["error"]["code"], -32004, "{reply}");
+        let took = started.elapsed();
+        assert!(took >= std::time::Duration::from_millis(250) && took < std::time::Duration::from_secs(3), "{took:?}");
+        assert!(next_line(&mut r).is_none(), "then the connection is closed");
+        // Dripping: a byte every 50 ms for as long as the server keeps the connection.
+        let started = std::time::Instant::now();
+        let s = connect(ep.port);
+        let mut w = s.try_clone().unwrap();
+        let drip = std::thread::spawn(move || {
+            while w.write_all(b"x").is_ok() {
+                std::thread::sleep(std::time::Duration::from_millis(50));
+                if started.elapsed() > std::time::Duration::from_secs(3) {
+                    break;
+                }
+            }
+        });
+        let mut r = BufReader::new(s);
+        let reply = next_line(&mut r).expect("the server says why before closing");
+        assert_eq!(reply["error"]["code"], -32004, "{reply}");
+        let took = started.elapsed();
+        assert!(took < std::time::Duration::from_secs(2), "the deadline is absolute: {took:?}");
+        drop(r);
+        drip.join().unwrap();
+    }
+
+    /// A client refused while the server still has its input unread gets the reason, not a
+    /// reset: closing on top of unread input sends a reset, which can discard the reply before
+    /// the client reads it (Linux does). Here a line far over the limit leaves most of itself
+    /// unread when the server refuses it.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_client_refused_with_input_unread_gets_the_reason() {
+        use std::io::{BufReader, Write};
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve_with(client, TEST_LIMITS).unwrap();
+        let s = connect(ep.port);
+        let mut w = s.try_clone().unwrap();
+        w.write_all(&vec![b'x'; 16 * super::MAX_AUTH_LINE]).unwrap();
+        // Let the server refuse it (and, before the fix, close) before reading the reply.
+        std::thread::sleep(std::time::Duration::from_millis(200));
+        let mut r = BufReader::new(s);
+        let reply = next_line(&mut r).expect("the server says why before closing");
+        assert_eq!(reply["error"]["code"], -32600, "{reply}");
+    }
+
+    /// A refused connection gives back its place among those waiting to authenticate before it
+    /// lingers, so lingering does not keep real clients out.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_lingering_connection_holds_no_place_to_authenticate() {
+        use std::io::{BufReader, Write};
+        // A linger far longer than the checks below take, even on a loaded machine.
+        let limits = super::Limits { linger: std::time::Duration::from_secs(5), ..TEST_LIMITS };
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve_with(client, limits).unwrap();
+        let auth = serde_json::json!({ "jsonrpc": "2.0", "id": 1, "method": "auth", "params": { "token": ep.token } });
+        // Refused with most of its line unread, and left open: it lingers for `linger`.
+        let refused = connect(ep.port);
+        refused.try_clone().unwrap().write_all(&vec![b'x'; 16 * super::MAX_AUTH_LINE]).unwrap();
+        let mut r = BufReader::new(refused.try_clone().unwrap());
+        assert_eq!(next_line(&mut r).expect("refused with a reason")["error"]["code"], -32600);
+        // Well within the linger, both places are free for new connections.
+        let started = std::time::Instant::now();
+        let others: Vec<_> = (0..limits.max_unauthenticated).map(|_| connect(ep.port)).collect();
+        for s in &others {
+            // A refused one has already been closed, so its write may fail; its reply says why.
+            let _ = writeln!(s.try_clone().unwrap(), "{auth}");
+            let reply = next_line(&mut BufReader::new(s.try_clone().unwrap())).expect("a reply");
+            assert_eq!(reply["result"]["ok"], true, "admitted while the refused one lingers: {reply}");
+        }
+        assert!(started.elapsed() < limits.linger, "checked while it lingered: {:?}", started.elapsed());
+        drop(refused);
+    }
+
+    /// Only [`super::Limits::max_lingering`] refused connections linger at once: one more still
+    /// gets its reply, and is then closed at once instead of lingering.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn only_so_many_refused_connections_linger() {
+        use std::io::{BufReader, Write};
+        // A linger far longer than the checks below take, even on a loaded machine.
+        let limits = super::Limits { linger: std::time::Duration::from_secs(5), max_lingering: 1, ..TEST_LIMITS };
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve_with(client, limits).unwrap();
+        let bad = r#"{"jsonrpc": "2.0", "id": 1, "method": "page_count"}"#;
+        // The first refused connection takes the only lingering place and keeps it.
+        let first = connect(ep.port);
+        writeln!(first.try_clone().unwrap(), "{bad}").unwrap();
+        let mut r1 = BufReader::new(first.try_clone().unwrap());
+        assert_eq!(next_line(&mut r1).expect("refused with a reason")["error"]["code"], -32001);
+        // The second still gets its reason (it has nothing unread, so no reset)...
+        let second = connect(ep.port);
+        let mut w2 = second.try_clone().unwrap();
+        writeln!(w2, "{bad}").unwrap();
+        let mut r2 = BufReader::new(second.try_clone().unwrap());
+        assert_eq!(next_line(&mut r2).expect("refused with a reason")["error"]["code"], -32001);
+        // ...and is closed outright, not lingering: writing to it soon fails, where a lingering
+        // connection would read and discard for the whole of `linger`.
+        let started = std::time::Instant::now();
+        let closed = loop {
+            if w2.write_all(b"x").is_err() {
+                break true;
+            }
+            if started.elapsed() > limits.linger {
+                break false;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(20));
+        };
+        assert!(closed && started.elapsed() < limits.linger / 2, "it lingered: {:?}", started.elapsed());
+        drop(first);
+    }
+
+    /// #1806: only so many connections may wait to authenticate at once. One more is refused
+    /// on the spot; once a waiting one authenticates or times out, its place is free again.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn only_so_many_connections_may_wait_to_authenticate() {
+        use std::io::{BufReader, Write};
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve_with(client, TEST_LIMITS).unwrap();
+        let auth = serde_json::json!({ "jsonrpc": "2.0", "id": 1, "method": "auth", "params": { "token": ep.token } });
+        let first = connect(ep.port);
+        let second = connect(ep.port);
+        // The kernel accepts a connection before the listener admits it: give the listener a
+        // moment to admit both, well within their deadline.
+        std::thread::sleep(std::time::Duration::from_millis(100));
+        // The third finds both places taken.
+        let mut r3 = BufReader::new(connect(ep.port));
+        let reply = next_line(&mut r3).expect("refused with a reason");
+        assert_eq!(reply["error"]["code"], -32003, "{reply}");
+        assert!(next_line(&mut r3).is_none(), "and closed");
+        // The second authenticates: its place is free, so a new connection is admitted.
+        let mut r2 = BufReader::new(second.try_clone().unwrap());
+        let mut w2 = second.try_clone().unwrap();
+        writeln!(w2, "{auth}").unwrap();
+        assert_eq!(next_line(&mut r2).unwrap()["result"]["ok"], true);
+        let fourth = connect(ep.port);
+        let mut r4 = BufReader::new(fourth.try_clone().unwrap());
+        let mut w4 = fourth.try_clone().unwrap();
+        writeln!(w4, "{auth}").unwrap();
+        assert_eq!(next_line(&mut r4).unwrap()["result"]["ok"], true, "admitted and authenticated");
+        // The first was closed at the deadline (its place freed on that way out too): after it,
+        // another connection is admitted even though the first never authenticated.
+        drop(first);
+        std::thread::sleep(TEST_LIMITS.auth_deadline + std::time::Duration::from_millis(100));
+        let fifth = connect(ep.port);
+        let mut r5 = BufReader::new(fifth.try_clone().unwrap());
+        let mut w5 = fifth.try_clone().unwrap();
+        writeln!(w5, "{auth}").unwrap();
+        assert_eq!(next_line(&mut r5).unwrap()["result"]["ok"], true);
+    }
+
+    /// After `auth` the limit no longer applies: a long line is read as before (here it isn't
+    /// JSON, so it gets a parse error and the connection stays open).
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn long_lines_after_auth_are_still_read() {
+        use std::io::{BufRead, BufReader, Write};
+        let (_control, client) = super::attach(&egui::Context::default());
+        let ep = super::serve(client).unwrap();
+        let s = std::net::TcpStream::connect(("127.0.0.1", ep.port)).unwrap();
+        s.set_read_timeout(Some(std::time::Duration::from_secs(5))).unwrap();
+        let mut w = s.try_clone().unwrap();
+        let mut r = BufReader::new(s);
+        let reply = |r: &mut BufReader<std::net::TcpStream>| {
+            let mut line = String::new();
+            r.read_line(&mut line).unwrap();
+            serde_json::from_str::<serde_json::Value>(&line).unwrap()
+        };
+        let auth = serde_json::json!({ "jsonrpc": "2.0", "id": 1, "method": "auth", "params": { "token": ep.token } });
+        writeln!(w, "{auth}").unwrap();
+        assert_eq!(reply(&mut r)["result"]["ok"], true);
+        writeln!(w, "{}", "x".repeat(4 * super::MAX_AUTH_LINE)).unwrap();
+        assert_eq!(reply(&mut r)["error"]["code"], -32700, "a long line after auth is parsed, not refused");
+        writeln!(w, "y").unwrap();
+        assert_eq!(reply(&mut r)["error"]["code"], -32700, "and the connection is still open");
+    }
+}
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 1099030ea7..a0c1ca880e 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -7,14 +7,35 @@ use pdfcraft_engine::Edit;
 
 use crate::{CloseRequest, Dialog, PdfCraftApp, PropsTab, panels::human_size, widgets};
 
+pub(super) mod appearance;
+pub(super) mod comment_props;
+pub(super) mod credits;
+pub(super) mod marks_ui;
+pub(super) mod pageboxes;
+pub(super) mod palette;
+mod prompts;
+pub(super) mod protect;
+pub(super) mod standards_ui;
+pub(super) mod word_count_ui;
+
+pub(crate) use prompts::{PromptButton, save_prompt_key};
+use prompts::{full_screen_prompt, link_prompt, password, remote_link_prompt, save_prompt, unlock};
+
 const INFO_KEYS: [&str; 4] = ["Title", "Author", "Subject", "Keywords"];
 
 pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    // The page sets hover cursors from the raw pointer position (form fields, links, comments)
+    // before any dialog is drawn, and nothing under a modal's backdrop takes clicks. Start from
+    // the arrow; the modal's own widgets set theirs as they are drawn.
+    if app.modal_open() || ctx.memory(|m| m.top_modal_layer().is_some()) {
+        ctx.set_cursor_icon(egui::CursorIcon::Default);
+    }
     dialogs(app, ctx);
     // Last, so it sits above Document Properties when Security's Unlock… asked for it.
     unlock(app, ctx);
 }
 
+/// Draw the active modal dialog and apply the action the user chose.
 fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
     password(app, ctx);
     save_prompt(app, ctx);
@@ -36,12 +57,17 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let Some(dialog) = app.dialog else {
         app.props_draft = None;
         app.view_draft = None;
+        app.custom_draft = None;
         return;
     };
     // Properties ▸ Fonts shows the fonts as they are now, after any content edits.
     if let (Dialog::Properties(PropsTab::Fonts), Some((_, id))) = (dialog, app.active_ids()) {
         app.session.refresh_fonts(id);
     }
+    // Properties ▸ Space Audit walks the whole file, so it is measured once per edit, not per frame.
+    if dialog == Dialog::Properties(PropsTab::SpaceAudit) {
+        app.refresh_space_audit();
+    }
     // Seed the editable Description fields from the document when the dialog opens.
     if let (Dialog::Properties(_), Some((_, id))) = (dialog, app.active_ids())
         && app.props_draft.as_ref().is_none_or(|(d, _)| *d != id)
@@ -49,6 +75,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
     {
         app.props_draft = Some((id, INFO_KEYS.map(|k| doc.info_value(k).unwrap_or_default())));
         app.view_draft = Some((id, doc.initial_view()));
+        app.custom_draft = Some((id, crate::CustomDraft { props: doc.custom_info(), ..Default::default() }));
     }
     let mut apply = false;
     let mut split_now: Option<crate::SplitPlan> = None;
@@ -114,7 +141,9 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                         (PropsTab::InitialView, tl!("Initial View")),
                         (PropsTab::Security, tl!("Security")),
                         (PropsTab::Fonts, tl!("Fonts")),
+                        (PropsTab::Custom, tl!("Custom")),
                         (PropsTab::Advanced, tl!("Advanced")),
+                        (PropsTab::SpaceAudit, tl!("Space Audit")),
                     ] {
                         if widgets::mode_tab(ui, label, tab == tb).clicked() {
                             next = Dialog::Properties(tb);
@@ -126,27 +155,54 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 let Some((_, id)) = app.active_ids() else { return };
                 let Some(doc) = app.session.get(id) else { return };
                 let i = &doc.info;
+                // Description shows plain values among text fields; they start where the fields' text does.
+                let editable_info = tab == PropsTab::Description && doc.allows_modification() && app.props_draft.is_some();
+                let inset = if editable_info { widgets::FIELD_TEXT_INSET } else { 0.0 };
                 let row = |ui: &mut egui::Ui, k: &str, v: String| {
                     // Row labels are UI chrome; values are document data and stay as they are.
                     ui.label(egui::RichText::new(tl!(k)).color(t.text_muted));
-                    ui.scope(|ui| {
-                        ui.set_max_width(420.0);
+                    ui.horizontal(|ui| {
+                        ui.add_space(inset);
                         ui.add(
                             egui::Label::new(if v.is_empty() { egui::RichText::new("—").color(t.text_faint) } else { egui::RichText::new(v) }).wrap(),
                         );
                     });
                     ui.end_row();
                 };
+                // A file name or path is read left to right even in an RTL UI: the extension
+                // stays at its visual end, as in the tab strip.
+                let path_row = |ui: &mut egui::Ui, k: &str, v: String| {
+                    ui.label(egui::RichText::new(tl!(k)).color(t.text_muted));
+                    ui.scope(|ui| {
+                        ui.set_max_width(420.0);
+                        // Align path text with editable fields while keeping its LTR text order.
+                        ui.add_space(inset);
+                        if v.is_empty() {
+                            ui.label(egui::RichText::new("—").color(t.text_faint));
+                        } else {
+                            crate::widgets::label_ltr(ui, v, crate::theme::regular(13.0), t.text);
+                        }
+                    });
+                    ui.end_row();
+                };
                 egui::ScrollArea::vertical().max_height(460.0).auto_shrink([false, true]).show(ui, |ui| {
+                    if tab == PropsTab::SpaceAudit {
+                        ui.add_space(4.0);
+                        crate::optimize_ui::audit_table(ui, &app.space_audit, &t);
+                        return;
+                    }
                     egui::Grid::new("props").num_columns(2).spacing([18.0, 8.0]).min_col_width(140.0).show(ui, |ui| match tab {
                         PropsTab::Description => {
-                            row(ui, "File", crate::bidi::visual(&doc.name).into_owned());
+                            path_row(ui, "File", doc.name.clone());
                             match app.props_draft.as_mut() {
-                                Some((_, draft)) if doc.allows_modification() => {
+                                Some((_, draft)) if editable_info => {
                                     for (k, v) in INFO_KEYS.iter().zip(draft.iter_mut()) {
                                         let l = ui.label(egui::RichText::new(tl!(k)).color(t.text_muted));
-                                        ui.add(widgets::line(v).desired_width(420.0).background_color(t.field).id_salt(("info", *k)))
-                                            .labelled_by(l.id);
+                                        // Subject and Keywords are often a sentence or a list: they wrap and grow
+                                        // instead of hiding most of the value past the field's edge.
+                                        let field =
+                                            if matches!(*k, "Subject" | "Keywords") { widgets::block(v).desired_rows(1) } else { widgets::line(v) };
+                                        ui.add(field.desired_width(f32::INFINITY).background_color(t.field).id_salt(("info", *k))).labelled_by(l.id);
                                         ui.end_row();
                                     }
                                 }
@@ -167,9 +223,9 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                             let Some((_, v)) = app.view_draft.as_mut() else { return };
                             ui.label(egui::RichText::new(tl!("Layout and Magnification")).font(theme::semibold(12.5)));
                             ui.end_row();
-                            ui.label(tl!("Navigation tab"));
+                            let label = ui.label(tl!("Navigation tab"));
                             ui.add_enabled_ui(editable, |ui| {
-                                egui::ComboBox::from_id_salt("iv-nav")
+                                craft_ui::ComboBox::from_id_salt("iv-nav")
                                     .selected_text(tl!(format!("{:?}", v.navigation)
                                         .replace("PageOnly", "Page Only")
                                         .replace("Pages", "Pages Panel and Page")
@@ -184,10 +240,12 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                                         ] {
                                             ui.selectable_value(&mut v.navigation, n, l);
                                         }
-                                    });
+                                    })
+                                    .response
+                                    .labelled_by(label.id);
                             });
                             ui.end_row();
-                            ui.label(tl!("Page layout"));
+                            let label = ui.label(tl!("Page layout"));
                             ui.add_enabled_ui(editable, |ui| {
                                 let names = [
                                     (L::Default, tl!("Default")),
@@ -199,14 +257,18 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                                     (L::TwoUpContinuousCoverPage, tl!("Two-Up Continuous (Cover Page)")),
                                 ];
                                 let shown = names.iter().find(|(l, _)| *l == v.layout).map_or(tl!("Default"), |(_, n)| n);
-                                egui::ComboBox::from_id_salt("iv-layout").selected_text(shown).show_ui(ui, |ui| {
-                                    for (l, n) in names {
-                                        ui.selectable_value(&mut v.layout, l, n);
-                                    }
-                                });
+                                craft_ui::ComboBox::from_id_salt("iv-layout")
+                                    .selected_text(shown)
+                                    .show_ui(ui, |ui| {
+                                        for (l, n) in names {
+                                            ui.selectable_value(&mut v.layout, l, n);
+                                        }
+                                    })
+                                    .response
+                                    .labelled_by(label.id);
                             });
                             ui.end_row();
-                            ui.label(tl!("Magnification"));
+                            let label = ui.label(tl!("Magnification"));
                             ui.add_enabled_ui(editable, |ui| {
                                 ui.horizontal(|ui| {
                                     let names = [
@@ -221,21 +283,25 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                                         M::Percent(p) => format!("{p:.0}%"),
                                         m => names.iter().find(|(x, _)| *x == m).map_or(tl!("Default").to_string(), |(_, n)| n.to_string()),
                                     };
-                                    egui::ComboBox::from_id_salt("iv-mag").selected_text(shown).show_ui(ui, |ui| {
-                                        for (m, n) in names {
-                                            ui.selectable_value(&mut v.magnification, m, n);
-                                        }
-                                        for p in [50.0, 75.0, 125.0, 150.0, 200.0] {
-                                            ui.selectable_value(&mut v.magnification, M::Percent(p), format!("{p:.0}%"));
-                                        }
-                                    });
+                                    craft_ui::ComboBox::from_id_salt("iv-mag")
+                                        .selected_text(shown)
+                                        .show_ui(ui, |ui| {
+                                            for (m, n) in names {
+                                                ui.selectable_value(&mut v.magnification, m, n);
+                                            }
+                                            for p in [50.0, 75.0, 125.0, 150.0, 200.0] {
+                                                ui.selectable_value(&mut v.magnification, M::Percent(p), format!("{p:.0}%"));
+                                            }
+                                        })
+                                        .response
+                                        .labelled_by(label.id);
                                 });
                             });
                             ui.end_row();
-                            ui.label(tl!("Open to page"));
+                            let label = ui.label(tl!("Open to page"));
                             ui.add_enabled_ui(editable, |ui| {
                                 let mut p = v.page + 1;
-                                if ui.add(egui::DragValue::new(&mut p).range(1..=pages.max(1))).changed() {
+                                if ui.add(egui::DragValue::new(&mut p).range(1..=pages.max(1))).labelled_by(label.id).changed() {
                                     v.page = p - 1;
                                 }
                                 ui.label(crate::i18n::fmt(tl!("of {pages}"), &[("pages", &pages.to_string())]));
@@ -345,9 +411,92 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                                 row(ui, &f.name, detail);
                             }
                         }
+                        PropsTab::Custom => {
+                            // Add takes a new name, Update changes the value of the listed property the
+                            // Name field names, Delete removes it; OK writes the changes as one step.
+                            let editable = doc.allows_modification();
+                            let Some((_, d)) = app.custom_draft.as_mut() else { return };
+                            let l = ui.label(egui::RichText::new(tl!("Name:")).color(t.text_muted));
+                            ui.add_enabled(
+                                editable,
+                                widgets::line(&mut d.name).desired_width(420.0).background_color(t.field).id_salt("custom-name"),
+                            )
+                            .labelled_by(l.id);
+                            ui.end_row();
+                            let l = ui.label(egui::RichText::new(tl!("Value:")).color(t.text_muted));
+                            ui.add_enabled(
+                                editable,
+                                widgets::line(&mut d.value).desired_width(420.0).background_color(t.field).id_salt("custom-value"),
+                            )
+                            .labelled_by(l.id);
+                            ui.end_row();
+                            // Untrimmed: a file's `/Project#20` is not `/Project`, and a typed space is refused.
+                            let name = d.name.clone();
+                            let value = d.value.trim().to_owned();
+                            let listed = d.props.iter().position(|(k, _)| *k == name);
+                            // An entry the list leaves out (not text, only padding, or past its 256) keeps its value.
+                            let file_props = doc.custom_info();
+                            let unlisted = doc.has_info(&name) && !file_props.iter().any(|(k, _)| *k == name);
+                            let refused = pdfcraft_engine::check_custom_key(&name).err().filter(|_| !name.is_empty()).map(|e| e.to_string());
+                            ui.label("");
+                            // A file can hold a custom name that `check_custom_key` refuses, such as one
+                            // with a space: the tab lists it, and Add, Update and Delete stay off for it.
+                            let why = |b: egui::Response| match &refused {
+                                Some(why) => b.on_disabled_hover_text(crate::i18n::words(why)),
+                                None => b,
+                            };
+                            // A name that isn't UTF-8 is listed with U+FFFD and can't be written back as it is.
+                            let editable = editable && refused.is_none() && !name.contains(char::REPLACEMENT_CHARACTER);
+                            // `custom_info` lists at most 256 properties, and a new name goes after the file's
+                            // entries, so Add is off once the draft or the file's own list holds 256.
+                            let room = d.props.len() < 256 && file_props.len() < 256;
+                            ui.horizontal(|ui| {
+                                let add = editable && room && listed.is_none() && !unlisted && !name.is_empty() && !value.is_empty();
+                                if why(ui.add_enabled(add, egui::Button::new(tl!("Add")))).clicked() {
+                                    d.props.push((name.clone(), value.clone()));
+                                    d.name.clear();
+                                    d.value.clear();
+                                }
+                                let update = editable && !value.is_empty() && listed.and_then(|n| d.props.get(n)).is_some_and(|(_, v)| *v != value);
+                                if why(ui.add_enabled(update, egui::Button::new(tl!("Update")))).clicked()
+                                    && let Some(p) = listed.and_then(|n| d.props.get_mut(n))
+                                {
+                                    p.1 = value.clone();
+                                }
+                                if why(ui.add_enabled(editable && listed.is_some(), egui::Button::new(tl!("Delete")))).clicked()
+                                    && let Some(n) = listed.filter(|n| *n < d.props.len())
+                                {
+                                    d.props.remove(n);
+                                    d.name.clear();
+                                    d.value.clear();
+                                }
+                            });
+                            ui.end_row();
+                            if d.props.is_empty() {
+                                ui.label("");
+                                ui.label(egui::RichText::new(tl!("None")).color(t.text_faint));
+                                ui.end_row();
+                            }
+                            // A click on a property fills the fields with it; values are document data.
+                            let mut picked = None;
+                            for (k, v) in &d.props {
+                                if ui.selectable_label(*k == name, k.as_str()).clicked() {
+                                    picked = Some((k.clone(), v.clone()));
+                                }
+                                ui.scope(|ui| {
+                                    ui.set_max_width(420.0);
+                                    ui.add(egui::Label::new(v.as_str()).wrap());
+                                });
+                                ui.end_row();
+                            }
+                            if let Some((k, v)) = picked {
+                                d.name = k;
+                                d.value = v;
+                            }
+                        }
                         PropsTab::Advanced => {
                             row(ui, "PDF version", i.pdf_version.clone());
-                            row(ui, "Location", crate::bidi::visual(doc.path.as_deref().unwrap_or_default()).into_owned());
+                            path_row(ui, "Location", doc.path.clone().unwrap_or_default());
                             row(ui, "File size", format!("{} ({})", human_size(i.file_size), crate::panels::byte_count(i.file_size)));
                             let p = &i.pages[0];
                             row(ui, "Page size", units.size(f64::from(p.width), f64::from(p.height)));
@@ -414,7 +563,9 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                                 ui.end_row();
                             }
                         }
-                    })
+                        // Laid out above, outside the two-column grid.
+                        PropsTab::SpaceAudit => {}
+                    });
                 });
             }
             Dialog::Split => {
@@ -496,10 +647,10 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 d.to = d.to.clamp(1, count);
                 d.from = d.from.clamp(1, d.to);
                 ui.horizontal(|ui| {
-                    ui.label(tl!("Original: replace pages"));
-                    let from = ui.add(egui::DragValue::new(&mut d.from).range(1..=count));
-                    ui.label(tl!("to"));
-                    let to = ui.add(egui::DragValue::new(&mut d.to).range(1..=count));
+                    let from_label = ui.label(tl!("Original: replace pages"));
+                    let from = ui.add(egui::DragValue::new(&mut d.from).range(1..=count)).labelled_by(from_label.id);
+                    let to_label = ui.label(tl!("to"));
+                    let to = ui.add(egui::DragValue::new(&mut d.to).range(1..=count)).labelled_by(to_label.id);
                     if from.changed() || to.changed() {
                         d.range_edited = true;
                     }
@@ -509,8 +660,8 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 let max_start = d.src_pages.saturating_sub(n) + 1;
                 d.src_from = d.src_from.clamp(1, max_start.max(1));
                 ui.horizontal(|ui| {
-                    ui.label(crate::i18n::fmt(tl!("Replacement: pages of {name}"), &[("name", &d.name)]));
-                    ui.add(egui::DragValue::new(&mut d.src_from).range(1..=max_start.max(1)));
+                    let replacement_label = ui.label(crate::i18n::fmt(tl!("Replacement: pages of {name}"), &[("name", &d.name)]));
+                    ui.add(egui::DragValue::new(&mut d.src_from).range(1..=max_start.max(1))).labelled_by(replacement_label.id);
                     ui.label(crate::i18n::fmt(tl!("to {n}"), &[("n", &(d.src_from + n - 1).to_string())]));
                     ui.label(egui::RichText::new(crate::i18n::fmt(tl!("of {name}"), &[("name", &d.src_pages.to_string())])).color(t.text_muted));
                 });
@@ -647,7 +798,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 ui.add_space(8.0);
                 egui::Grid::new("rotate-pages").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
                     ui.label(tl!("Direction:"));
-                    egui::ComboBox::from_id_salt("rotate-dir")
+                    craft_ui::ComboBox::from_id_salt("rotate-dir")
                         .selected_text(match d.degrees {
                             270 => tl!("Counterclockwise 90 degrees"),
                             180 => tl!("180 degrees"),
@@ -673,7 +824,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                     });
                     ui.end_row();
                     ui.label(tl!("Rotate:"));
-                    egui::ComboBox::from_id_salt("rotate-parity")
+                    craft_ui::ComboBox::from_id_salt("rotate-parity")
                         .selected_text(match d.parity {
                             P::Both => tl!("Even and Odd Pages"),
                             P::Even => tl!("Even Pages Only"),
@@ -686,7 +837,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                         });
                     ui.end_row();
                     ui.label("");
-                    egui::ComboBox::from_id_salt("rotate-orient")
+                    craft_ui::ComboBox::from_id_salt("rotate-orient")
                         .selected_text(match d.orientation {
                             O::Both => tl!("Landscape and Portrait Pages"),
                             O::Landscape => tl!("Landscape Pages"),
@@ -751,7 +902,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 optimize_now = ok;
                 close = ok || cancel;
                 if std::mem::take(&mut app.optimize_draft.audit) {
-                    app.space_audit = app.active_ids().and_then(|(_, id)| app.session.get(id)).map(|d| d.audit_space()).unwrap_or_default();
+                    app.refresh_space_audit();
                     next = Dialog::AuditSpace;
                 }
                 return;
@@ -795,7 +946,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 ui.add_space(6.0);
                 ui.horizontal(|ui| {
                     ui.label(tl!("Sort comments by:"));
-                    egui::ComboBox::from_id_salt("summary-sort").selected_text(tl!(app.summary_sort.name())).show_ui(ui, |ui| {
+                    craft_ui::ComboBox::from_id_salt("summary-sort").selected_text(tl!(app.summary_sort.name())).show_ui(ui, |ui| {
                         for s in pdfcraft_engine::SummarySort::ALL {
                             ui.selectable_value(&mut app.summary_sort, s, tl!(s.name()));
                         }
@@ -1071,7 +1222,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
                         (L::None, tl!("None (prefix only)")),
                     ];
                     let current = styles.iter().find(|(s, _)| *s == d.style).map_or("1, 2, 3", |(_, l)| *l);
-                    egui::ComboBox::from_id_salt("label_style").selected_text(current).show_ui(ui, |ui| {
+                    craft_ui::ComboBox::from_id_salt("label_style").selected_text(current).show_ui(ui, |ui| {
                         for (s, l) in styles {
                             ui.selectable_value(&mut d.style, s, l);
                         }
@@ -1176,7 +1327,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
             }
             Dialog::About => {
                 // Tabs About · Contributors · Models (craftrules standards/contributors.md).
-                let tab_id = egui::Id::new("about_tab");
+                let tab_id = egui::Id::unique("about_tab");
                 let mut tab = ui.data_mut(|d| d.get_temp::<u8>(tab_id)).unwrap_or(0);
                 ui.horizontal_wrapped(|ui| {
                     for (i, label) in ["About", "Contributors", "Models"].into_iter().enumerate() {
@@ -1223,43 +1374,47 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
         }
         ui.add_space(16.0);
         let changed = draft_changes(app).is_some_and(|c| !c.is_empty());
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if dialog == Dialog::Recovery {
-                if widgets::pill_button(ui, tl!("Recover"), true).clicked() {
-                    recover = Some(true);
+        // One row high: on its own, a right-to-left layout centres the buttons in all the height
+        // left, which after a taller Properties tab is the room that tab left behind.
+        ui.horizontal(|ui| {
+            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                if dialog == Dialog::Recovery {
+                    if widgets::pill_button(ui, tl!("Recover"), true).clicked() {
+                        recover = Some(true);
+                        close = true;
+                    }
+                    if widgets::pill_button(ui, tl!("Discard"), false).clicked() {
+                        recover = Some(false);
+                        close = true;
+                    }
+                } else if dialog == Dialog::NumberPages {
+                    if widgets::pill_button(ui, tl!("OK"), true).clicked() {
+                        apply_number = true;
+                        close = true;
+                    }
+                    if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                        close = true;
+                    }
+                } else if dialog == Dialog::Split {
+                    if ui.add_enabled_ui(split_ready.is_some(), |ui| widgets::pill_button(ui, tl!("Split"), true)).inner.clicked() {
+                        split_now = split_ready.clone();
+                        close = true;
+                    }
+                    if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                        close = true;
+                    }
+                } else if changed {
+                    if widgets::pill_button(ui, tl!("OK"), true).clicked() {
+                        apply = true;
+                        close = true;
+                    }
+                    if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                        close = true;
+                    }
+                } else if widgets::pill_button(ui, tl!("Close"), true).clicked() {
                     close = true;
                 }
-                if widgets::pill_button(ui, tl!("Discard"), false).clicked() {
-                    recover = Some(false);
-                    close = true;
-                }
-            } else if dialog == Dialog::NumberPages {
-                if widgets::pill_button(ui, tl!("OK"), true).clicked() {
-                    apply_number = true;
-                    close = true;
-                }
-                if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                    close = true;
-                }
-            } else if dialog == Dialog::Split {
-                if ui.add_enabled_ui(split_ready.is_some(), |ui| widgets::pill_button(ui, tl!("Split"), true)).inner.clicked() {
-                    split_now = split_ready.clone();
-                    close = true;
-                }
-                if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                    close = true;
-                }
-            } else if changed {
-                if widgets::pill_button(ui, tl!("OK"), true).clicked() {
-                    apply = true;
-                    close = true;
-                }
-                if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                    close = true;
-                }
-            } else if widgets::pill_button(ui, tl!("Close"), true).clicked() {
-                close = true;
-            }
+            })
         });
     });
     if let Some(yes) = recover {
@@ -1443,6 +1598,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
         app.dialog = None;
         app.props_draft = None;
         app.view_draft = None;
+        app.custom_draft = None;
         app.bulk_field_props = None;
     } else {
         app.dialog = Some(next);
@@ -1494,405 +1650,21 @@ fn draft_changes(app: &PdfCraftApp) -> Option<Vec<Edit>> {
     {
         edits.push(Edit::SetInitialView(Box::new(v.clone())));
     }
+    // Custom: deleted properties are cleared, then added and changed ones are set.
+    if let Some((cid, d)) = &app.custom_draft
+        && cid == id
+    {
+        let before = doc.custom_info();
+        for (k, _) in before.iter().filter(|(k, _)| !d.props.iter().any(|(n, _)| n == k)) {
+            edits.push(Edit::SetInfo { key: k.clone(), value: String::new() });
+        }
+        for (k, v) in d.props.iter().filter(|(k, v)| !before.iter().any(|(n, w)| n == k && w == v)) {
+            edits.push(Edit::SetInfo { key: k.clone(), value: v.clone() });
+        }
+    }
     Some(edits)
 }
 
-/// The buttons of the "Save changes?" prompt, in the order they sit on screen, left to right.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub(crate) enum PromptButton {
-    DontSave,
-    Cancel,
-    #[default]
-    Save,
-}
-
-impl PromptButton {
-    const ORDER: [PromptButton; 3] = [PromptButton::DontSave, PromptButton::Cancel, PromptButton::Save];
-
-    fn position(self) -> usize {
-        Self::ORDER.iter().position(|b| *b == self).unwrap_or(2)
-    }
-
-    /// The button `by` places to the right (negative: left). Arrow keys stop at the ends.
-    fn step(self, by: isize) -> PromptButton {
-        let to = self.position().saturating_add_signed(by).min(Self::ORDER.len() - 1);
-        Self::ORDER.get(to).copied().unwrap_or(self)
-    }
-
-    /// The button after (or, with `back`, before) this one, wrapping round: Tab and Shift+Tab.
-    fn cycle(self, back: bool) -> PromptButton {
-        let n = Self::ORDER.len();
-        let to = if back { self.position().checked_sub(1).unwrap_or(n - 1) } else { (self.position() + 1) % n };
-        Self::ORDER.get(to).copied().unwrap_or(self)
-    }
-
-    /// What pressing the button answers.
-    fn answer(self) -> Option<bool> {
-        match self {
-            PromptButton::Save => Some(true),
-            PromptButton::DontSave => Some(false),
-            PromptButton::Cancel => None,
-        }
-    }
-}
-
-/// The "Save changes?" prompt's keys (issue #8), read before anything else can take them. Save is
-/// the button chosen when the prompt opens, so Enter saves; the arrow keys and Tab / Shift+Tab move
-/// the choice, and Enter or Space press the chosen button. Escape cancels. Don't save also has
-/// ⌘D / Ctrl+D, the macOS convention, and Alt+D / Alt+N, the mnemonics Windows and Linux desktops
-/// use for it. Returns the answer once one is given.
-pub(crate) fn save_prompt_key(ctx: &egui::Context, chosen: &mut PromptButton) -> Option<Option<bool>> {
-    use egui::{Key, Modifiers};
-    ctx.input_mut(|i| {
-        if i.consume_key(Modifiers::NONE, Key::Enter) || i.consume_key(Modifiers::NONE, Key::Space) {
-            return Some(chosen.answer());
-        }
-        if i.consume_key(Modifiers::NONE, Key::Escape) {
-            return Some(None);
-        }
-        if [(Modifiers::COMMAND, Key::D), (Modifiers::ALT, Key::D), (Modifiers::ALT, Key::N)].into_iter().any(|(m, k)| i.consume_key(m, k)) {
-            return Some(Some(false));
-        }
-        // Shift+Tab before Tab: a key press matches a pattern that asks for fewer modifiers.
-        if i.consume_key(Modifiers::SHIFT, Key::Tab) {
-            *chosen = chosen.cycle(true);
-        } else if i.consume_key(Modifiers::NONE, Key::Tab) {
-            *chosen = chosen.cycle(false);
-        }
-        for (key, by) in [(Key::ArrowLeft, -1), (Key::ArrowUp, -1), (Key::ArrowRight, 1), (Key::ArrowDown, 1)] {
-            if i.consume_key(Modifiers::NONE, key) {
-                *chosen = chosen.step(by);
-            }
-        }
-        None
-    })
-}
-
-/// "Save changes?" when closing a tab or quitting with unsaved edits.
-fn save_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let Some(req) = app.close_request else { return };
-    let index = match req {
-        CloseRequest::Tab(id) => app.views.iter().position(|v| v.id == id),
-        CloseRequest::Quit | CloseRequest::All => app.first_dirty(),
-    };
-    let Some(name) = index.and_then(|i| app.views.get(i)).and_then(|v| app.session.get(v.id)).map(|d| d.name.clone()) else {
-        // Nothing left to ask about (tab already gone or no dirty documents).
-        app.resolve_close(ctx, Some(false));
-        return;
-    };
-    let t = Tokens::get(ctx);
-    // Wrapping alone (#161) still let a long enough name (a web `?file=` URL has no limit) grow
-    // the prompt taller than the window (#236); 80 characters wrap to a few lines.
-    let shown = shorten_middle(&name, 80);
-    let mut choice: Option<Option<bool>> = None;
-    let modal = widgets::show_modal(ctx, "save_prompt", |ui| {
-        ui.set_width(420.0);
-        ui.horizontal(|ui| {
-            ui.add(crate::icons::image("save", 22.0, t.accent));
-            let title = ui.add(
-                egui::Label::new(
-                    egui::RichText::new(crate::i18n::fmt(tl!("Save changes to “{name}” before closing?"), &[("name", &shown)]))
-                        .font(theme::semibold(16.0)),
-                )
-                .wrap(),
-            );
-            if shown != name {
-                title.on_hover_text(&name);
-            }
-        });
-        ui.add_space(6.0);
-        ui.label(egui::RichText::new(tl!("Your changes will be lost if you don't save them.")).color(t.text_muted));
-        ui.add_space(14.0);
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            let chosen = app.save_prompt_button;
-            if widgets::pill_button_marked(ui, tl!("Save"), true, chosen == PromptButton::Save).clicked() {
-                choice = Some(Some(true));
-            }
-            if widgets::pill_button_marked(ui, tl!("Cancel"), false, chosen == PromptButton::Cancel).clicked() {
-                choice = Some(None);
-            }
-            ui.add_space(24.0);
-            if widgets::pill_button_marked(ui, tl!("Don't save"), false, chosen == PromptButton::DontSave).clicked() {
-                choice = Some(Some(false));
-            }
-        });
-    });
-    if choice.is_none() && modal.should_close() {
-        choice = Some(None);
-    }
-    if let Some(c) = choice {
-        app.resolve_close(ctx, c);
-    }
-}
-
-/// `name` cut to at most `max` characters by replacing its middle with "…", keeping the start and
-/// the end, where the extension and version suffixes sit. Counts `char`s, so it never splits one.
-fn shorten_middle(name: &str, max: usize) -> String {
-    let count = name.chars().count();
-    if count <= max {
-        return name.to_string();
-    }
-    let tail = max / 4;
-    let head: String = name.chars().take(max.saturating_sub(tail + 1)).collect();
-    let end: String = name.chars().skip(count.saturating_sub(tail)).collect();
-    format!("{head}…{end}")
-}
-
-/// "Open this web page?" when a document's link, button or script asks to open an address
-/// (#90, #91). Shows where the address really goes and the whole address; Cancel is the default,
-/// and Escape or clicking outside cancels.
-fn link_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let Some(pending) = app.pending_link.clone() else { return };
-    let t = Tokens::get(ctx);
-    let email = pending.url.get(..7).is_some_and(|s| s.eq_ignore_ascii_case("mailto:"));
-    let (title, open) = if email { (tl!("Write this email?"), tl!("Open email app")) } else { (tl!("Open this web page?"), tl!("Open link")) };
-    let mut choice: Option<bool> = None;
-    let modal = widgets::show_modal(ctx, "link_prompt", |ui| {
-        ui.set_width(460.0);
-        ui.horizontal(|ui| {
-            ui.add(crate::icons::image("external-link", 22.0, t.accent));
-            ui.label(egui::RichText::new(title).font(theme::semibold(16.0)));
-        });
-        ui.add_space(6.0);
-        let template = if email {
-            tl!("{who} in this document wants to open your email app with this address:")
-        } else {
-            tl!("{who} in this document wants to open this address in your browser:")
-        };
-        ui.label(crate::i18n::fmt(template, &[("who", tl!(pending.origin.noun()))]));
-        ui.add_space(6.0);
-        // The host as the browser will connect to it, in punycode when it is international, so a
-        // lookalike such as `pаypal.com` (Cyrillic `а`) reads as `xn--pypal-4ve.com`. Its Unicode
-        // form isn't repeated here: a whole-script lookalike would read as the real site.
-        if let Some(host) = pdfcraft_engine::links::display_host(&pending.url) {
-            ui.label(egui::RichText::new(&host.ascii).font(theme::semibold(14.0)));
-            if host.mixed_scripts {
-                let warning = tl!("This web address mixes letters from different alphabets, a common way to imitate another site's name.");
-                ui.add(egui::Label::new(egui::RichText::new(warning).color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B))).wrap());
-            } else if host.international {
-                let note = tl!("This web address uses letters from another alphabet, which can look like familiar ones.");
-                ui.add(egui::Label::new(egui::RichText::new(note).color(t.text)).wrap());
-            }
-        }
-        egui::ScrollArea::vertical().max_height(120.0).show(ui, |ui| {
-            ui.add(egui::Label::new(egui::RichText::new(&pending.url).monospace().small()).wrap().selectable(true));
-        });
-        ui.add_space(8.0);
-        ui.label(
-            egui::RichText::new(tl!(
-                "Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form."
-            ))
-            .color(t.text_muted)
-            .small(),
-        );
-        ui.add_space(14.0);
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, tl!("Cancel"), true).clicked() {
-                choice = Some(false);
-            }
-            if widgets::pill_button(ui, open, false).clicked() {
-                choice = Some(true);
-            }
-        });
-    });
-    if choice.is_none() && modal.should_close() {
-        choice = Some(false);
-    }
-    if let Some(open) = choice {
-        app.resolve_pending_link(open);
-    }
-}
-
-/// A document that asks to open in Full Screen mode (`/PageMode /FullScreen`) is asked about
-/// first, as Acrobat does: full screen hides every control, so it is the person's choice.
-fn full_screen_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let Some(id) = app.pending_full_screen else { return };
-    // The document was closed before an answer: nothing to ask any more.
-    if app.session.get(id).is_none() {
-        app.pending_full_screen = None;
-        return;
-    }
-    let t = Tokens::get(ctx);
-    let mut choice = None;
-    let modal = widgets::show_modal(ctx, "full_screen_prompt", |ui| {
-        ui.set_width(460.0);
-        ui.horizontal(|ui| {
-            ui.add(crate::icons::image("maximize", 22.0, t.accent));
-            ui.label(egui::RichText::new(tl!("Open in Full Screen mode?")).font(theme::semibold(16.0)));
-        });
-        ui.add_space(6.0);
-        ui.add(
-            egui::Label::new(tl!(
-                "This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it."
-            ))
-            .wrap(),
-        );
-        ui.add_space(14.0);
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, tl!("Not now"), true).clicked() {
-                choice = Some(false);
-            }
-            if widgets::pill_button(ui, tl!("Full Screen"), false).clicked() {
-                choice = Some(true);
-            }
-        });
-    });
-    if choice.is_none() && modal.should_close() {
-        choice = Some(false);
-    }
-    if let Some(allow) = choice {
-        app.resolve_full_screen_prompt(ctx, allow);
-    }
-}
-
-/// Absolute document-controlled local paths require consent before any filesystem access.
-fn remote_link_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let Some(pending) = app.pending_remote_link.clone() else { return };
-    let mut choice = None;
-    let modal = widgets::show_modal(ctx, "remote_link_prompt", |ui| {
-        ui.set_width(460.0);
-        ui.label(egui::RichText::new(tl!("Open this local PDF?")).font(theme::semibold(16.0)));
-        ui.add_space(6.0);
-        ui.label(tl!("This document is trying to open a local file:"));
-        egui::ScrollArea::vertical().max_height(160.0).show(ui, |ui| {
-            ui.add(egui::Label::new(egui::RichText::new(pending.path.to_string_lossy()).monospace()).wrap().selectable(true));
-        });
-        ui.add_space(8.0);
-        ui.label(tl!("Only allow this if you trust the source document."));
-        ui.add_space(14.0);
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, tl!("Cancel"), true).clicked() {
-                choice = Some(false);
-            }
-            if widgets::pill_button(ui, tl!("Allow"), false).clicked() {
-                choice = Some(true);
-            }
-        });
-    });
-    if choice.is_none() && modal.should_close() {
-        choice = Some(false);
-    }
-    if let Some(open) = choice {
-        app.resolve_pending_remote_link(open);
-    }
-}
-
 fn yes(b: bool) -> String {
     tl!(if b { "Yes" } else { "No" }).to_string()
 }
-
-/// What a password box was answered with.
-enum PasswordAnswer {
-    Submit,
-    Cancel,
-}
-
-/// A password box: a lock, a title, a message, the masked field, an error and two buttons.
-fn password_modal(
-    ctx: &egui::Context,
-    id: &str,
-    title: &str,
-    message: String,
-    input: &mut String,
-    error: Option<&str>,
-    ok: &str,
-) -> Option<PasswordAnswer> {
-    let t = Tokens::get(ctx);
-    let mut answer = None;
-    let modal = widgets::show_modal(ctx, id, |ui| {
-        ui.set_width(400.0);
-        ui.horizontal(|ui| {
-            ui.add(crate::icons::image("lock", 22.0, t.accent));
-            ui.label(egui::RichText::new(title).font(theme::semibold(17.0)));
-        });
-        ui.add_space(6.0);
-        ui.add(egui::Label::new(message).wrap());
-        ui.add_space(8.0);
-        let r = ui.add(widgets::line(input).password(true).hint_text(tl!("Password")).desired_width(f32::INFINITY));
-        // Enter submits. The field keeps focus, so check the key while it is focused as well as
-        // on the frame focus is lost.
-        if (r.has_focus() || r.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
-            answer = Some(PasswordAnswer::Submit);
-        }
-        // Only when it lost focus: each request interrupts the input method, and on Linux typed
-        // keys go through it, so asking on every frame lost everything typed (#2818).
-        if !r.has_focus() {
-            r.request_focus();
-        }
-        if let Some(e) = error {
-            ui.add_space(4.0);
-            // Known error text is translated; anything else passes through.
-            ui.label(egui::RichText::new(tl!(e)).color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B)));
-        }
-        ui.add_space(12.0);
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, ok, true).clicked() {
-                answer = Some(PasswordAnswer::Submit);
-            }
-            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                answer = Some(PasswordAnswer::Cancel);
-            }
-        });
-    });
-    answer.or(modal.should_close().then_some(PasswordAnswer::Cancel))
-}
-
-/// Password prompt for encrypted documents (Acrobat: "Password" dialog on open).
-fn password(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let Some(prompt) = app.password_prompt.as_mut() else { return };
-    let message = crate::i18n::fmt(tl!("“{name}” is protected. Enter a password to open it."), &[("name", &prompt.name)]);
-    match password_modal(ctx, "password", tl!("Password required"), message, &mut prompt.input, prompt.error.as_deref(), tl!("Open")) {
-        Some(PasswordAnswer::Submit) => {
-            let pw = prompt.input.clone();
-            app.submit_password(Some(pw));
-        }
-        Some(PasswordAnswer::Cancel) => app.submit_password(None),
-        None => {}
-    }
-}
-
-/// Permissions password prompt: lifts the restrictions of an open document (#995).
-fn unlock(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let Some(prompt) = app.unlock_prompt.as_mut() else { return };
-    let message =
-        crate::i18n::fmt(tl!("“{name}” has security restrictions. Enter its permissions password to lift them."), &[("name", &prompt.name)]);
-    match password_modal(ctx, "unlock", tl!("Permissions password"), message, &mut prompt.input, prompt.error.as_deref(), tl!("Unlock")) {
-        Some(PasswordAnswer::Submit) => {
-            let pw = prompt.input.clone();
-            app.submit_unlock(Some(pw));
-        }
-        Some(PasswordAnswer::Cancel) => app.submit_unlock(None),
-        None => {}
-    }
-}
-
-#[cfg(test)]
-mod prompt_button_tests {
-    use super::PromptButton::{self, Cancel, DontSave, Save};
-
-    #[test]
-    fn opens_on_save_and_arrows_stop_at_the_ends() {
-        assert_eq!(PromptButton::default(), Save);
-        assert_eq!(Save.step(1), Save);
-        assert_eq!(Save.step(-1), Cancel);
-        assert_eq!(Cancel.step(-1), DontSave);
-        assert_eq!(DontSave.step(-1), DontSave);
-        assert_eq!(DontSave.step(1000), Save, "a long step clamps");
-        assert_eq!(Save.step(isize::MIN), DontSave, "and so does a huge negative one");
-    }
-
-    #[test]
-    fn tab_wraps_both_ways() {
-        assert_eq!(Save.cycle(false), DontSave);
-        assert_eq!(DontSave.cycle(true), Save);
-        assert_eq!(Cancel.cycle(false), Save);
-        assert_eq!(Cancel.cycle(true), DontSave);
-    }
-
-    #[test]
-    fn each_button_answers_as_labelled() {
-        assert_eq!(Save.answer(), Some(true));
-        assert_eq!(DontSave.answer(), Some(false));
-        assert_eq!(Cancel.answer(), None);
-    }
-}
diff --git a/crates/ui-egui/src/appearance.rs b/crates/ui-egui/src/dialogs/appearance.rs
similarity index 97%
rename from crates/ui-egui/src/appearance.rs
rename to crates/ui-egui/src/dialogs/appearance.rs
index 536d8e4d97..48ad0cb31c 100644
--- a/crates/ui-egui/src/appearance.rs
+++ b/crates/ui-egui/src/dialogs/appearance.rs
@@ -118,8 +118,8 @@ fn card(ui: &mut egui::Ui, t: &Tokens, title: &str, active: bool, themes: &[(The
 pub fn preferences_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
     ui.label(RichText::new(tl_ctx!("theme", "Appearance")).font(theme::semibold(13.0)));
     ui.horizontal(|ui| {
-        ui.label(tl!("Appearance mode"));
-        egui::ComboBox::from_id_salt("appearance-mode").selected_text(tl!(mode_label(app.theme_preference))).show_ui(ui, |ui| {
+        let label = ui.label(tl!("Appearance mode"));
+        let combo = craft_ui::ComboBox::from_id_salt("appearance-mode").selected_text(tl!(mode_label(app.theme_preference))).show_ui(ui, |ui| {
             for preference in [ThemePreference::System, ThemePreference::Light, ThemePreference::Dark] {
                 if ui.selectable_label(app.theme_preference == preference, tl!(mode_label(preference))).clicked() {
                     app.execute(mode_command(preference));
@@ -127,6 +127,8 @@ pub fn preferences_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens)
                 }
             }
         });
+        // The visible label names the combo box for assistive technology and tests.
+        combo.response.labelled_by(label.id);
     });
     ui.add_space(4.0);
     let light_active = app.theme == ThemeKind::Light;
diff --git a/crates/ui-egui/src/comment_props.rs b/crates/ui-egui/src/dialogs/comment_props.rs
similarity index 95%
rename from crates/ui-egui/src/comment_props.rs
rename to crates/ui-egui/src/dialogs/comment_props.rs
index f66885d361..4702e63f9e 100644
--- a/crates/ui-egui/src/comment_props.rs
+++ b/crates/ui-egui/src/dialogs/comment_props.rs
@@ -98,7 +98,7 @@ impl PdfCraftApp {
     pub fn make_props_default(&mut self, page: usize, index: usize, p: &CommentProps) {
         let Some((_, id)) = self.active_ids() else { return };
         let Some(doc) = self.session.get(id) else { return };
-        let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && a.in_reply_to.is_none()) else { return };
+        let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && !a.is_reply()) else { return };
         let Some(tool) = crate::comments::tool_for_default(a, p.endings.as_deref()) else { return };
         let mut style = self.comment_prefs.style(tool);
         if let Some(c) = p.color {
@@ -167,12 +167,11 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
         .and_then(|(_, id)| app.session.get(id))
         .zip(app.comment_props.as_ref())
         .map(|(doc, d)| {
-            let me = doc.info.annotations.iter().find(|a| a.page == d.page && a.index == d.index && a.in_reply_to.is_none());
-            let nm = me.and_then(|a| a.name.clone());
+            let me = doc.info.annotations.iter().find(|a| a.page == d.page && a.index == d.index && !a.is_reply());
             doc.info
                 .annotations
                 .iter()
-                .filter(|r| r.state.is_some() && nm.is_some() && r.in_reply_to == nm)
+                .filter(|r| r.state.is_some() && me.is_some_and(|a| r.replies_to(a)))
                 .map(|r| (r.state.clone().unwrap_or_default(), r.author.clone().unwrap_or_default(), r.modified.clone().unwrap_or_default()))
                 .collect()
         })
@@ -180,7 +179,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
     let default_tool = app.comment_props.as_ref().and_then(|d| {
         let (_, id) = app.active_ids()?;
         let doc = app.session.get(id)?;
-        let a = doc.info.annotations.iter().find(|a| a.page == d.page && a.index == d.index && a.in_reply_to.is_none())?;
+        let a = doc.info.annotations.iter().find(|a| a.page == d.page && a.index == d.index && !a.is_reply())?;
         crate::comments::tool_for_default(a, d.edited.endings.as_deref())
     });
     let Some(d) = app.comment_props.as_mut() else { return (false, true) };
@@ -208,7 +207,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                 egui::Grid::new("comment-props").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
                     if let Some(icon) = e.icon.as_mut() {
                         ui.label(tl!("Icon"));
-                        egui::ComboBox::from_id_salt("note-icon").selected_text(icon.name()).show_ui(ui, |ui| {
+                        craft_ui::ComboBox::from_id_salt("note-icon").selected_text(icon.name()).show_ui(ui, |ui| {
                             for i in ICONS {
                                 ui.selectable_value(icon, i, i.name());
                             }
@@ -248,7 +247,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                         ui.label(tl!("Line ending"));
                         ui.horizontal(|ui| {
                             for (i, ending) in ends.iter_mut().enumerate() {
-                                egui::ComboBox::from_id_salt(("line-ending", i)).selected_text(ending_label(*ending)).width(188.0).show_ui(
+                                craft_ui::ComboBox::from_id_salt(("line-ending", i)).selected_text(ending_label(*ending)).width(188.0).show_ui(
                                     ui,
                                     |ui| {
                                         for style in LineEnding::ALL {
diff --git a/crates/ui-egui/src/credits.rs b/crates/ui-egui/src/dialogs/credits.rs
similarity index 98%
rename from crates/ui-egui/src/credits.rs
rename to crates/ui-egui/src/dialogs/credits.rs
index 59535f35e6..d509a3b0eb 100644
--- a/crates/ui-egui/src/credits.rs
+++ b/crates/ui-egui/src/dialogs/credits.rs
@@ -232,7 +232,7 @@ impl Default for View {
 /// About ▸ Contributors: a name toggle, a sort, and the list as a grab bag or a table.
 pub fn contributors_ui(ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
-    let id = egui::Id::new("credits_view");
+    let id = egui::Id::unique("credits_view");
     let mut v = ui.data_mut(|d| d.get_temp::<View>(id)).unwrap_or_default();
     ui.horizontal_wrapped(|ui| {
         ui.label(crate::i18n::t("Show"));
@@ -243,7 +243,7 @@ pub fn contributors_ui(ui: &mut egui::Ui) {
         }
         ui.separator();
         ui.label(crate::i18n::t("Sort"));
-        egui::ComboBox::from_id_salt("credits_sort").selected_text(crate::i18n::t(v.key.label().0)).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("credits_sort").selected_text(crate::i18n::t(v.key.label().0)).show_ui(ui, |ui| {
             for k in SortKey::ALL {
                 if ui.selectable_label(v.key == k, crate::i18n::t(k.label().0)).clicked() {
                     v.key = k;
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/dialogs/marks_ui.rs
similarity index 84%
rename from crates/ui-egui/src/marks_ui.rs
rename to crates/ui-egui/src/dialogs/marks_ui.rs
index 8bf2e4dfe3..437d45e9fe 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/dialogs/marks_ui.rs
@@ -7,7 +7,7 @@ use egui::{Align, Color32, CornerRadius, Layout, Rect, Stroke, pos2, vec2};
 use pdfcraft_engine::{Background, Edit, FontFamily, HeaderFooter, MarkKind, Watermark};
 
 use crate::theme::{self, Tokens};
-use crate::{PdfCraftApp, widgets};
+use crate::{PdfCraftApp, icons, widgets};
 
 /// How far a watermark may be moved from the page centre, in points.
 const MAX_OFFSET: f64 = 20_000.0;
@@ -63,7 +63,7 @@ impl PageRange {
                 Subset::Even => tl!("Even pages only"),
                 Subset::Odd => tl!("Odd pages only"),
             };
-            egui::ComboBox::from_id_salt("mark-subset").selected_text(label).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("mark-subset").selected_text(label).show_ui(ui, |ui| {
                 ui.selectable_value(&mut self.subset, Subset::All, tl!("All pages in range"));
                 ui.selectable_value(&mut self.subset, Subset::Even, tl!("Even pages only"));
                 ui.selectable_value(&mut self.subset, Subset::Odd, tl!("Odd pages only"));
@@ -90,6 +90,9 @@ pub struct MarksDraft {
     pub use_file: bool,
     pub file: Option<(String, std::sync::Arc<Vec<u8>>)>,
     pub file_page: usize,
+    /// The page (0-based) the preview was stepped to; `None` previews the current page. Reset
+    /// each time the dialog opens.
+    pub preview: Option<usize>,
 }
 
 impl Default for MarksDraft {
@@ -107,14 +110,26 @@ impl Default for MarksDraft {
             use_file: false,
             file: None,
             file_page: 1,
+            preview: None,
         }
     }
 }
 
 const PAGE_FORMATS: [&str; 5] = ["<<1>>", "<<1 of n>>", "<<1/n>>", "<<Page 1>>", "<<Page 1 of n>>"];
 // New formats go last: `date_format` is an index into this list.
-const DATE_FORMATS: [&str; 8] =
-    ["<<m/d/yyyy>>", "<<mm/dd/yyyy>>", "<<d/m/yyyy>>", "<<yyyy-mm-dd>>", "<<m/d/yy>>", "<<mmmm d, yyyy>>", "<<yyyy/mm/dd>>", "<<yyyy/m/d>>"];
+const DATE_FORMATS: [&str; 11] = [
+    "<<m/d/yyyy>>",
+    "<<mm/dd/yyyy>>",
+    "<<d/m/yyyy>>",
+    "<<yyyy-mm-dd>>",
+    "<<m/d/yy>>",
+    "<<mmmm d, yyyy>>",
+    "<<yyyy/mm/dd>>",
+    "<<yyyy/m/d>>",
+    "<<dd.mm.yyyy>>",
+    "<<d.m.yyyy>>",
+    "<<dd.mm.yy>>",
+];
 const BOX_NAMES: [&str; 6] =
     ["Left Header Text", "Center Header Text", "Right Header Text", "Left Footer Text", "Center Footer Text", "Right Footer Text"];
 
@@ -172,6 +187,24 @@ fn preview_page(range: &PageRange, current: usize, count: usize) -> usize {
     if pages.contains(&current) { current } else { pages.first().copied().unwrap_or(current) }
 }
 
+/// [`preview_page`] for the page stepped to (`stepped`), or the current page if none. A page
+/// stepped to that the range leaves out is replaced by the page shown, so widening the range again
+/// keeps that page rather than jumping back.
+fn shown_preview(range: &PageRange, stepped: &mut Option<usize>, current: usize, count: usize) -> usize {
+    let shown = preview_page(range, stepped.unwrap_or(current), count);
+    if stepped.is_some() {
+        *stepped = Some(shown);
+    }
+    shown
+}
+
+/// The page the preview steps to from `shown`: the range's next page after it (`forward`) or the
+/// last one before it, or `None` at either end.
+fn step_preview(range: &PageRange, shown: usize, count: usize, forward: bool) -> Option<usize> {
+    let pages = range.pages(count);
+    if forward { pages.into_iter().find(|&p| p > shown) } else { pages.into_iter().rev().find(|&p| p < shown) }
+}
+
 /// The dialog for `kind`; returns (apply, cancel).
 pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: MarkKind) -> (bool, bool) {
     let Some((i, id)) = app.active_ids() else { return (false, true) };
@@ -194,7 +227,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
             ui.horizontal(|ui| {
                 // The standard faces a header can be drawn in (#3754).
                 ui.label(tl!("Font:"));
-                egui::ComboBox::from_id_salt("hf-font").selected_text(d.hf.font.label()).width(100.0).show_ui(ui, |ui| {
+                craft_ui::ComboBox::from_id_salt("hf-font").selected_text(d.hf.font.label()).width(100.0).show_ui(ui, |ui| {
                     for f in [FontFamily::Helvetica, FontFamily::Times, FontFamily::Courier] {
                         ui.selectable_value(&mut d.hf.font, f, f.label());
                     }
@@ -234,7 +267,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                 }
             });
             ui.horizontal(|ui| {
-                egui::ComboBox::from_id_salt("hf-page-format").selected_text(PAGE_FORMATS[d.page_format].trim_matches(['<', '>'])).show_ui(
+                craft_ui::ComboBox::from_id_salt("hf-page-format").selected_text(PAGE_FORMATS[d.page_format].trim_matches(['<', '>'])).show_ui(
                     ui,
                     |ui| {
                         for (k, f) in PAGE_FORMATS.iter().enumerate() {
@@ -246,7 +279,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                     d.hf.text[d.focused_box].push_str(PAGE_FORMATS[d.page_format]);
                 }
                 ui.add_space(12.0);
-                egui::ComboBox::from_id_salt("hf-date-format").selected_text(DATE_FORMATS[d.date_format].trim_matches(['<', '>'])).show_ui(
+                craft_ui::ComboBox::from_id_salt("hf-date-format").selected_text(DATE_FORMATS[d.date_format].trim_matches(['<', '>'])).show_ui(
                     ui,
                     |ui| {
                         for (k, f) in DATE_FORMATS.iter().enumerate() {
@@ -343,10 +376,10 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
     ui.label(egui::RichText::new(tl!("Page Range Options")).font(theme::semibold(12.5)));
     d.range.ui(ui, count);
     ui.add_space(8.0);
-    // The preview: the current page, or the first one the range selects if it leaves that out,
-    // drawn from its thumbnail at its displayed size (after /Rotate), the frame the engine lays
-    // the marks out in.
-    let target = preview_page(&d.range, current, count);
+    // The preview: the current page (or the page stepped to), or the first one the range selects
+    // if it leaves that out, drawn from its thumbnail at its displayed size (after /Rotate), the
+    // frame the engine lays the marks out in.
+    let target = shown_preview(&d.range, &mut d.preview, current, count);
     let page = doc.info.pages.get(target).map(|p| (p.width as f64, p.height as f64)).unwrap_or((612.0, 792.0));
     let picture = app.views.get_mut(i).and_then(|view| {
         view.need_thumbnail(target, true);
@@ -425,14 +458,24 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
             MarkKind::Background => {}
         });
         ui.vertical(|ui| {
-            ui.label(
-                egui::RichText::new(crate::i18n::fmt(
-                    tl!("Preview: page {p} of {n}"),
-                    &[("p", &(target + 1).to_string()), ("n", &count.to_string())],
-                ))
-                .small()
-                .color(t.text_faint),
-            );
+            ui.horizontal(|ui| {
+                // Steps through the pages the range selects.
+                let (back, next) = (step_preview(&d.range, target, count, false), step_preview(&d.range, target, count, true));
+                if ui.add_enabled_ui(back.is_some(), |ui| icons::button(ui, "chevron-left", 22.0, false, tl!("Previous page"))).inner.clicked() {
+                    d.preview = back.or(d.preview);
+                }
+                ui.label(
+                    egui::RichText::new(crate::i18n::fmt(
+                        tl!("Preview: page {p} of {n}"),
+                        &[("p", &(target + 1).to_string()), ("n", &count.to_string())],
+                    ))
+                    .small()
+                    .color(t.text_faint),
+                );
+                if ui.add_enabled_ui(next.is_some(), |ui| icons::button(ui, "chevron-right", 22.0, false, tl!("Next page"))).inner.clicked() {
+                    d.preview = next.or(d.preview);
+                }
+            });
             let n = d.range.pages(count).len();
             let applies =
                 if n == 1 { tl!("Applies to 1 page").to_string() } else { crate::i18n::fmt(tl!("Applies to {n} pages"), &[("n", &n.to_string())]) };
@@ -597,6 +640,40 @@ mod tests {
         assert_eq!(preview_page(&all, 0, 0), 0, "no pages at all");
     }
 
+    #[test]
+    fn the_preview_steps_through_the_pages_the_range_selects() {
+        let odd = PageRange { all: true, subset: Subset::Odd, ..PageRange::default() };
+        // Pages 1, 3 and 5 (0-based 0, 2, 4) of 5.
+        assert_eq!(step_preview(&odd, 0, 5, true), Some(2));
+        assert_eq!(step_preview(&odd, 2, 5, true), Some(4));
+        assert_eq!(step_preview(&odd, 4, 5, true), None, "the last page has no next");
+        assert_eq!(step_preview(&odd, 4, 5, false), Some(2));
+        assert_eq!(step_preview(&odd, 0, 5, false), None, "the first page has no previous");
+        // From a page the range leaves out, to the nearest one it selects on that side.
+        assert_eq!(step_preview(&odd, 1, 5, true), Some(2));
+        assert_eq!(step_preview(&odd, 1, 5, false), Some(0));
+        assert_eq!(step_preview(&odd, 0, 0, true), None, "no pages at all");
+        // A page stepped to is previewed while the range selects it, and the range's first page
+        // once a new range leaves it out.
+        assert_eq!(preview_page(&odd, 2, 5), 2);
+        let later = PageRange { all: false, from: 4, to: 5, subset: Subset::All };
+        assert_eq!(preview_page(&later, 2, 5), 3);
+        // Narrowing the range past the page stepped to keeps the page shown instead, also once
+        // the range is widened again.
+        let mut stepped = Some(4);
+        let first_two = PageRange { all: false, from: 1, to: 2, subset: Subset::All };
+        assert_eq!(shown_preview(&first_two, &mut stepped, 1, 5), 0);
+        assert_eq!(stepped, Some(0));
+        assert_eq!(shown_preview(&PageRange::default(), &mut stepped, 1, 5), 0);
+        // A page stepped to inside the range stays; with none stepped to, the current page shows.
+        let mut stepped = Some(2);
+        assert_eq!(shown_preview(&odd, &mut stepped, 0, 5), 2);
+        assert_eq!(stepped, Some(2));
+        let mut stepped = None;
+        assert_eq!(shown_preview(&odd, &mut stepped, 4, 5), 4);
+        assert_eq!(stepped, None);
+    }
+
     #[test]
     fn a_background_tints_the_page_it_is_behind() {
         assert_eq!(behind([1.0, 0.0, 0.0], 1.0), Color32::from_rgb(255, 0, 0));
diff --git a/crates/ui-egui/src/pageboxes.rs b/crates/ui-egui/src/dialogs/pageboxes.rs
similarity index 97%
rename from crates/ui-egui/src/pageboxes.rs
rename to crates/ui-egui/src/dialogs/pageboxes.rs
index 1522d00034..57b5edc911 100644
--- a/crates/ui-egui/src/pageboxes.rs
+++ b/crates/ui-egui/src/dialogs/pageboxes.rs
@@ -102,14 +102,14 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                     (PageBox::Media, "MediaBox"),
                 ];
                 let cur = names.iter().find(|(b, _)| *b == d.which).map_or("CropBox", |(_, l)| *l);
-                egui::ComboBox::from_id_salt("boxes-which").selected_text(cur).show_ui(ui, |ui| {
+                craft_ui::ComboBox::from_id_salt("boxes-which").selected_text(cur).show_ui(ui, |ui| {
                     for (b, l) in names {
                         ui.selectable_value(&mut d.which, b, l);
                     }
                 });
                 ui.end_row();
                 ui.label(tl!("Units"));
-                egui::ComboBox::from_id_salt("boxes-unit").selected_text(d.unit.label()).show_ui(ui, |ui| {
+                craft_ui::ComboBox::from_id_salt("boxes-unit").selected_text(d.unit.label()).show_ui(ui, |ui| {
                     for u in Unit::ALL {
                         ui.selectable_value(&mut d.unit, u, u.label());
                     }
diff --git a/crates/ui-egui/src/palette.rs b/crates/ui-egui/src/dialogs/palette.rs
similarity index 81%
rename from crates/ui-egui/src/palette.rs
rename to crates/ui-egui/src/dialogs/palette.rs
index 4f4197927a..99174a4eba 100644
--- a/crates/ui-egui/src/palette.rs
+++ b/crates/ui-egui/src/dialogs/palette.rs
@@ -19,6 +19,11 @@ struct Hit {
 
 /// Where `needle` (folded with [`pdfcraft_render::text::fold_case`]) matches `hay`, for ranking.
 fn score(hay: &str, needle: &str) -> Option<usize> {
+    score_for_direction(hay, needle, crate::i18n::current().rtl())
+}
+
+/// Rank logical text, accepting reordered query words for right-to-left locales.
+fn score_for_direction(hay: &str, needle: &str, rtl: bool) -> Option<usize> {
     if needle.is_empty() {
         return Some(0);
     }
@@ -26,10 +31,9 @@ fn score(hay: &str, needle: &str) -> Option<usize> {
     if let Some(p) = h.find(needle) {
         return Some(p);
     }
-    // A right-to-left language's labels are in display order (their words run the other way)
-    // while the query is in typing order, so several words match one by one.
-    if crate::i18n::current().rtl() && needle.contains(char::is_whitespace) {
-        let first = needle.split_whitespace().map(|word| h.find(word)).try_fold(usize::MAX, |first, p| p.map(|p| first.min(p)));
+    // Match the all-tools search: RTL queries may name the same words in another order.
+    if rtl && needle.contains(char::is_whitespace) {
+        let first = needle.split_whitespace().try_fold(usize::MAX, |first, word| h.find(word).map(|at| first.min(at)));
         if let Some(first) = first {
             return Some(first);
         }
@@ -39,8 +43,9 @@ fn score(hay: &str, needle: &str) -> Option<usize> {
     needle.chars().all(|c| it.any(|x| x == c)).then_some(100)
 }
 
+/// Draw the command palette and dispatch the chosen command or tool group.
 pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let palette_rect_id = egui::Id::new("palette_rect");
+    let palette_rect_id = egui::Id::unique("palette_rect");
     if !app.palette_open {
         return;
     }
@@ -111,8 +116,8 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
     hits.truncate(12);
     let (down, up) = ctx.input(|i| (i.key_pressed(egui::Key::ArrowDown), i.key_pressed(egui::Key::ArrowUp)));
     let selected = ctx.data_mut(|data| {
-        let id = egui::Id::new("palette_selected");
-        let query_id = egui::Id::new("palette_selected_query");
+        let id = egui::Id::unique("palette_selected");
+        let query_id = egui::Id::unique("palette_selected_query");
         let previous_query = data.get_temp::<String>(query_id);
         let selected =
             if previous_query.as_deref() == Some(&q) { data.get_temp::<usize>(id).unwrap_or(0) } else { 0 }.min(hits.len().saturating_sub(1));
@@ -143,7 +148,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
         return;
     }
     let mut chosen: Option<(Option<&'static str>, Option<&'static str>)> = None;
-    let area_response = egui::Area::new(egui::Id::new("palette"))
+    let area_response = egui::Area::new(egui::Id::unique("palette"))
         .order(egui::Order::Foreground)
         .pivot(Align2::CENTER_TOP)
         .fixed_pos(egui::pos2(screen.center().x, screen.top() + 96.0))
@@ -152,13 +157,15 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 ui.set_width(560.0);
                 ui.horizontal(|ui| {
                     ui.add(icons::image("search", 18.0, t.text_muted));
-                    let r = ui.add(
-                        egui::TextEdit::singleline(&mut app.palette_query)
-                            .hint_text(tl!("Search tools and commands…"))
-                            .frame(egui::Frame::NONE)
-                            .font(theme::regular(15.0))
-                            .desired_width(f32::INFINITY),
-                    );
+                    let r = ui
+                        .add(
+                            egui::TextEdit::singleline(&mut app.palette_query)
+                                .hint_text(tl!("Search tools and commands…"))
+                                .frame(egui::Frame::NONE)
+                                .font(theme::regular(15.0))
+                                .desired_width(f32::INFINITY),
+                        )
+                        .accessible_name(tl!("Search tools and commands"));
                     // Enter runs the selected hit while the field is focused or relinquishing focus.
                     if (r.has_focus() || r.lost_focus())
                         && ui.input(|i| i.key_pressed(egui::Key::Enter))
@@ -181,7 +188,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                     // Display is translated; matching above already considered both languages.
                     let shown = crate::i18n::command_label(&h.label);
                     let shown_detail = tl!(&h.detail).to_string();
-                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, h.ready, &shown));
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, h.ready, &shown));
                     let fg = if h.ready { t.text } else { t.text_faint };
                     let detail_font = theme::regular(12.0);
                     let detail_max = (rect.width() * 0.42).clamp(0.0, 220.0);
@@ -226,9 +233,20 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
 
 #[cfg(test)]
 mod search {
-    use super::score;
+    use super::{score, score_for_direction};
     use pdfcraft_render::text::fold_case;
 
+    /// Word-order tolerance is RTL-only and still requires every requested word.
+    #[test]
+    fn rtl_palette_queries_accept_reordered_words_without_reversing_text() {
+        let label = "تنظيم الصفحات";
+        assert_eq!(score_for_direction(label, &fold_case("الصفحات تنظيم"), true), Some(0));
+        assert_eq!(score_for_direction(label, &fold_case("تنظيم الصفحات"), true), Some(0));
+        assert_eq!(score_for_direction(label, &fold_case("الصفحات مفقود"), true), None);
+        assert_eq!(score_for_direction(label, &fold_case("الصفحات تنظيم"), false), None);
+        assert_eq!(score_for_direction("Organize Pages", &fold_case("Pages Organize"), false), None);
+    }
+
     #[test]
     fn commands_match_in_any_case_with_turkish_i() {
         assert_eq!(score("İçe aktar", &fold_case("içe")), Some(0));
diff --git a/crates/ui-egui/src/dialogs/prompts.rs b/crates/ui-egui/src/dialogs/prompts.rs
new file mode 100644
index 0000000000..557ddd3b8f
--- /dev/null
+++ b/crates/ui-egui/src/dialogs/prompts.rs
@@ -0,0 +1,406 @@
+use super::*;
+
+/// The buttons of the "Save changes?" prompt, in the order they sit on screen, left to right.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(crate) enum PromptButton {
+    DontSave,
+    Cancel,
+    #[default]
+    Save,
+}
+
+impl PromptButton {
+    const ORDER: [PromptButton; 3] = [PromptButton::DontSave, PromptButton::Cancel, PromptButton::Save];
+
+    fn position(self) -> usize {
+        Self::ORDER.iter().position(|b| *b == self).unwrap_or(2)
+    }
+
+    /// The button `by` places to the right (negative: left). Arrow keys stop at the ends.
+    fn step(self, by: isize) -> PromptButton {
+        let to = self.position().saturating_add_signed(by).min(Self::ORDER.len() - 1);
+        Self::ORDER.get(to).copied().unwrap_or(self)
+    }
+
+    /// The button after (or, with `back`, before) this one, wrapping round: Tab and Shift+Tab.
+    fn cycle(self, back: bool) -> PromptButton {
+        let n = Self::ORDER.len();
+        let to = if back { self.position().checked_sub(1).unwrap_or(n - 1) } else { (self.position() + 1) % n };
+        Self::ORDER.get(to).copied().unwrap_or(self)
+    }
+
+    /// What pressing the button answers.
+    fn answer(self) -> Option<bool> {
+        match self {
+            PromptButton::Save => Some(true),
+            PromptButton::DontSave => Some(false),
+            PromptButton::Cancel => None,
+        }
+    }
+}
+
+/// The "Save changes?" prompt's keys (issue #8), read before anything else can take them. Save is
+/// the button chosen when the prompt opens, so Enter saves; the arrow keys and Tab / Shift+Tab move
+/// the choice, and Enter or Space press the chosen button. Escape cancels. Don't save also has
+/// ⌘D / Ctrl+D, the macOS convention, and Alt+D / Alt+N, the mnemonics Windows and Linux desktops
+/// use for it. Returns the answer once one is given.
+pub(crate) fn save_prompt_key(ctx: &egui::Context, chosen: &mut PromptButton) -> Option<Option<bool>> {
+    use egui::{Key, Modifiers};
+    ctx.input_mut(|i| {
+        if i.consume_key(Modifiers::NONE, Key::Enter) || i.consume_key(Modifiers::NONE, Key::Space) {
+            return Some(chosen.answer());
+        }
+        if i.consume_key(Modifiers::NONE, Key::Escape) {
+            return Some(None);
+        }
+        if [(Modifiers::COMMAND, Key::D), (Modifiers::ALT, Key::D), (Modifiers::ALT, Key::N)].into_iter().any(|(m, k)| i.consume_key(m, k)) {
+            return Some(Some(false));
+        }
+        // Shift+Tab before Tab: a key press matches a pattern that asks for fewer modifiers.
+        if i.consume_key(Modifiers::SHIFT, Key::Tab) {
+            *chosen = chosen.cycle(true);
+        } else if i.consume_key(Modifiers::NONE, Key::Tab) {
+            *chosen = chosen.cycle(false);
+        }
+        for (key, by) in [(Key::ArrowLeft, -1), (Key::ArrowUp, -1), (Key::ArrowRight, 1), (Key::ArrowDown, 1)] {
+            if i.consume_key(Modifiers::NONE, key) {
+                *chosen = chosen.step(by);
+            }
+        }
+        None
+    })
+}
+
+/// "Save changes?" when closing a tab or quitting with unsaved edits.
+pub(super) fn save_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(req) = app.close_request else { return };
+    let index = match req {
+        CloseRequest::Tab(id) => app.views.iter().position(|v| v.id == id),
+        CloseRequest::Quit | CloseRequest::All => app.first_dirty(),
+    };
+    let Some(name) = index.and_then(|i| app.views.get(i)).and_then(|v| app.session.get(v.id)).map(|d| d.name.clone()) else {
+        // Nothing left to ask about (tab already gone or no dirty documents).
+        app.resolve_close(ctx, Some(false));
+        return;
+    };
+    let t = Tokens::get(ctx);
+    // Wrapping alone (#161) still let a long enough name (a web `?file=` URL has no limit) grow
+    // the prompt taller than the window (#236); 80 characters wrap to a few lines.
+    let shown = shorten_middle(&name, 80);
+    let mut choice: Option<Option<bool>> = None;
+    let modal = widgets::show_modal(ctx, "save_prompt", |ui| {
+        ui.set_width(420.0);
+        ui.horizontal(|ui| {
+            ui.add(crate::icons::image("save", 22.0, t.accent));
+            let title = ui.add(
+                egui::Label::new(
+                    egui::RichText::new(crate::i18n::fmt(tl!("Save changes to “{name}” before closing?"), &[("name", &shown)]))
+                        .font(theme::semibold(16.0)),
+                )
+                .wrap(),
+            );
+            if shown != name {
+                title.on_hover_text(&name);
+            }
+        });
+        ui.add_space(6.0);
+        ui.label(egui::RichText::new(tl!("Your changes will be lost if you don't save them.")).color(t.text_muted));
+        ui.add_space(14.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            let chosen = app.save_prompt_button;
+            if widgets::pill_button_marked(ui, tl!("Save"), true, chosen == PromptButton::Save).clicked() {
+                choice = Some(Some(true));
+            }
+            if widgets::pill_button_marked(ui, tl!("Cancel"), false, chosen == PromptButton::Cancel).clicked() {
+                choice = Some(None);
+            }
+            ui.add_space(24.0);
+            if widgets::pill_button_marked(ui, tl!("Don't save"), false, chosen == PromptButton::DontSave).clicked() {
+                choice = Some(Some(false));
+            }
+        });
+    });
+    if choice.is_none() && modal.should_close() {
+        choice = Some(None);
+    }
+    if let Some(c) = choice {
+        app.resolve_close(ctx, c);
+    }
+}
+
+/// `name` cut to at most `max` characters by replacing its middle with "…", keeping the start and
+/// the end, where the extension and version suffixes sit. Counts `char`s, so it never splits one.
+fn shorten_middle(name: &str, max: usize) -> String {
+    let count = name.chars().count();
+    if count <= max {
+        return name.to_string();
+    }
+    let tail = max / 4;
+    let head: String = name.chars().take(max.saturating_sub(tail + 1)).collect();
+    let end: String = name.chars().skip(count.saturating_sub(tail)).collect();
+    format!("{head}…{end}")
+}
+
+/// "Open this web page?" when a document's link, button or script asks to open an address
+/// (#90, #91). Shows where the address really goes and the whole address; Cancel is the default,
+/// and Escape or clicking outside cancels.
+pub(super) fn link_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(pending) = app.pending_link.clone() else { return };
+    let t = Tokens::get(ctx);
+    let email = pending.url.get(..7).is_some_and(|s| s.eq_ignore_ascii_case("mailto:"));
+    let (title, open) = if email { (tl!("Write this email?"), tl!("Open email app")) } else { (tl!("Open this web page?"), tl!("Open link")) };
+    let mut choice: Option<bool> = None;
+    let modal = widgets::show_modal(ctx, "link_prompt", |ui| {
+        ui.set_width(460.0);
+        ui.horizontal(|ui| {
+            ui.add(crate::icons::image("external-link", 22.0, t.accent));
+            ui.label(egui::RichText::new(title).font(theme::semibold(16.0)));
+        });
+        ui.add_space(6.0);
+        let template = if email {
+            tl!("{who} in this document wants to open your email app with this address:")
+        } else {
+            tl!("{who} in this document wants to open this address in your browser:")
+        };
+        ui.label(crate::i18n::fmt(template, &[("who", tl!(pending.origin.noun()))]));
+        ui.add_space(6.0);
+        // The host as the browser will connect to it, in punycode when it is international, so a
+        // lookalike such as `pаypal.com` (Cyrillic `а`) reads as `xn--pypal-4ve.com`. Its Unicode
+        // form isn't repeated here: a whole-script lookalike would read as the real site.
+        if let Some(host) = pdfcraft_engine::links::display_host(&pending.url) {
+            ui.label(egui::RichText::new(&host.ascii).font(theme::semibold(14.0)));
+            if host.mixed_scripts {
+                let warning = tl!("This web address mixes letters from different alphabets, a common way to imitate another site's name.");
+                ui.add(egui::Label::new(egui::RichText::new(warning).color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B))).wrap());
+            } else if host.international {
+                let note = tl!("This web address uses letters from another alphabet, which can look like familiar ones.");
+                ui.add(egui::Label::new(egui::RichText::new(note).color(t.text)).wrap());
+            }
+        }
+        egui::ScrollArea::vertical().max_height(120.0).show(ui, |ui| {
+            ui.add(egui::Label::new(egui::RichText::new(&pending.url).monospace().small()).wrap().selectable(true));
+        });
+        ui.add_space(8.0);
+        ui.label(
+            egui::RichText::new(tl!(
+                "Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form."
+            ))
+            .color(t.text_muted)
+            .small(),
+        );
+        ui.add_space(14.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("Cancel"), true).clicked() {
+                choice = Some(false);
+            }
+            if widgets::pill_button(ui, open, false).clicked() {
+                choice = Some(true);
+            }
+        });
+    });
+    if choice.is_none() && modal.should_close() {
+        choice = Some(false);
+    }
+    if let Some(open) = choice {
+        app.resolve_pending_link(open);
+    }
+}
+
+/// A document that asks to open in Full Screen mode (`/PageMode /FullScreen`) is asked about
+/// first, as Acrobat does: full screen hides every control, so it is the person's choice.
+pub(super) fn full_screen_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(id) = app.pending_full_screen else { return };
+    // The document was closed before an answer: nothing to ask any more.
+    if app.session.get(id).is_none() {
+        app.pending_full_screen = None;
+        return;
+    }
+    let t = Tokens::get(ctx);
+    let mut choice = None;
+    let modal = widgets::show_modal(ctx, "full_screen_prompt", |ui| {
+        ui.set_width(460.0);
+        ui.horizontal(|ui| {
+            ui.add(crate::icons::image("maximize", 22.0, t.accent));
+            ui.label(egui::RichText::new(tl!("Open in Full Screen mode?")).font(theme::semibold(16.0)));
+        });
+        ui.add_space(6.0);
+        ui.add(
+            egui::Label::new(tl!(
+                "This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it."
+            ))
+            .wrap(),
+        );
+        ui.add_space(14.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("Not now"), true).clicked() {
+                choice = Some(false);
+            }
+            if widgets::pill_button(ui, tl!("Full Screen"), false).clicked() {
+                choice = Some(true);
+            }
+        });
+    });
+    if choice.is_none() && modal.should_close() {
+        choice = Some(false);
+    }
+    if let Some(allow) = choice {
+        app.resolve_full_screen_prompt(ctx, allow);
+    }
+}
+
+/// Absolute document-controlled local paths require consent before any filesystem access.
+pub(super) fn remote_link_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(pending) = app.pending_remote_link.clone() else { return };
+    let mut choice = None;
+    let modal = widgets::show_modal(ctx, "remote_link_prompt", |ui| {
+        ui.set_width(460.0);
+        ui.label(egui::RichText::new(tl!("Open this local PDF?")).font(theme::semibold(16.0)));
+        ui.add_space(6.0);
+        ui.label(tl!("This document is trying to open a local file:"));
+        egui::ScrollArea::vertical().max_height(160.0).show(ui, |ui| {
+            // A local path is file/path chrome: left to right, so its final component stays last.
+            let mut job = egui::text::LayoutJob::simple(
+                pending.path.to_string_lossy().into_owned(),
+                egui::FontId::monospace(13.0),
+                crate::theme::Tokens::get(ui.ctx()).text,
+                ui.available_width().max(0.0),
+            );
+            job.direction = egui::epaint::text::TextDirection::LeftToRight;
+            let galley = ui.painter().layout_job(job);
+            ui.add(egui::Label::new(egui::WidgetText::Galley(galley)).selectable(true));
+        });
+        ui.add_space(8.0);
+        ui.label(tl!("Only allow this if you trust the source document."));
+        ui.add_space(14.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("Cancel"), true).clicked() {
+                choice = Some(false);
+            }
+            if widgets::pill_button(ui, tl!("Allow"), false).clicked() {
+                choice = Some(true);
+            }
+        });
+    });
+    if choice.is_none() && modal.should_close() {
+        choice = Some(false);
+    }
+    if let Some(open) = choice {
+        app.resolve_pending_remote_link(open);
+    }
+}
+
+/// What a password box was answered with.
+enum PasswordAnswer {
+    Submit,
+    Cancel,
+}
+
+/// A password box: a lock, a title, a message, the masked field, an error and two buttons.
+fn password_modal(
+    ctx: &egui::Context,
+    id: &str,
+    title: &str,
+    message: String,
+    input: &mut String,
+    error: Option<&str>,
+    ok: &str,
+) -> Option<PasswordAnswer> {
+    let t = Tokens::get(ctx);
+    let mut answer = None;
+    let modal = widgets::show_modal(ctx, id, |ui| {
+        ui.set_width(400.0);
+        ui.horizontal(|ui| {
+            ui.add(crate::icons::image("lock", 22.0, t.accent));
+            ui.label(egui::RichText::new(title).font(theme::semibold(17.0)));
+        });
+        ui.add_space(6.0);
+        ui.add(egui::Label::new(message).wrap());
+        ui.add_space(8.0);
+        let r = ui.add(widgets::line(input).password(true).hint_text(tl!("Password")).desired_width(f32::INFINITY));
+        // Enter submits. The field keeps focus, so check the key while it is focused as well as
+        // on the frame focus is lost.
+        if (r.has_focus() || r.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+            answer = Some(PasswordAnswer::Submit);
+        }
+        // Only when it lost focus: each request interrupts the input method, and on Linux typed
+        // keys go through it, so asking on every frame lost everything typed (#2818).
+        if !r.has_focus() {
+            r.request_focus();
+        }
+        if let Some(e) = error {
+            ui.add_space(4.0);
+            // Known error text is translated; anything else passes through.
+            ui.label(egui::RichText::new(tl!(e)).color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B)));
+        }
+        ui.add_space(12.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, ok, true).clicked() {
+                answer = Some(PasswordAnswer::Submit);
+            }
+            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                answer = Some(PasswordAnswer::Cancel);
+            }
+        });
+    });
+    answer.or(modal.should_close().then_some(PasswordAnswer::Cancel))
+}
+
+/// Password prompt for encrypted documents (Acrobat: "Password" dialog on open).
+pub(super) fn password(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(prompt) = app.password_prompt.as_mut() else { return };
+    let message = crate::i18n::fmt(tl!("“{name}” is protected. Enter a password to open it."), &[("name", &prompt.name)]);
+    match password_modal(ctx, "password", tl!("Password required"), message, &mut prompt.input, prompt.error.as_deref(), tl!("Open")) {
+        Some(PasswordAnswer::Submit) => {
+            let pw = prompt.input.clone();
+            app.submit_password(Some(pw));
+        }
+        Some(PasswordAnswer::Cancel) => app.submit_password(None),
+        None => {}
+    }
+}
+
+/// Permissions password prompt: lifts the restrictions of an open document (#995).
+pub(super) fn unlock(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(prompt) = app.unlock_prompt.as_mut() else { return };
+    let message =
+        crate::i18n::fmt(tl!("“{name}” has security restrictions. Enter its permissions password to lift them."), &[("name", &prompt.name)]);
+    match password_modal(ctx, "unlock", tl!("Permissions password"), message, &mut prompt.input, prompt.error.as_deref(), tl!("Unlock")) {
+        Some(PasswordAnswer::Submit) => {
+            let pw = prompt.input.clone();
+            app.submit_unlock(Some(pw));
+        }
+        Some(PasswordAnswer::Cancel) => app.submit_unlock(None),
+        None => {}
+    }
+}
+
+#[cfg(test)]
+mod prompt_button_tests {
+    use super::PromptButton::{self, Cancel, DontSave, Save};
+
+    #[test]
+    fn opens_on_save_and_arrows_stop_at_the_ends() {
+        assert_eq!(PromptButton::default(), Save);
+        assert_eq!(Save.step(1), Save);
+        assert_eq!(Save.step(-1), Cancel);
+        assert_eq!(Cancel.step(-1), DontSave);
+        assert_eq!(DontSave.step(-1), DontSave);
+        assert_eq!(DontSave.step(1000), Save, "a long step clamps");
+        assert_eq!(Save.step(isize::MIN), DontSave, "and so does a huge negative one");
+    }
+
+    #[test]
+    fn tab_wraps_both_ways() {
+        assert_eq!(Save.cycle(false), DontSave);
+        assert_eq!(DontSave.cycle(true), Save);
+        assert_eq!(Cancel.cycle(false), Save);
+        assert_eq!(Cancel.cycle(true), DontSave);
+    }
+
+    #[test]
+    fn each_button_answers_as_labelled() {
+        assert_eq!(Save.answer(), Some(true));
+        assert_eq!(DontSave.answer(), Some(false));
+        assert_eq!(Cancel.answer(), None);
+    }
+}
diff --git a/crates/ui-egui/src/protect.rs b/crates/ui-egui/src/dialogs/protect.rs
similarity index 95%
rename from crates/ui-egui/src/protect.rs
rename to crates/ui-egui/src/dialogs/protect.rs
index fb48c369de..ffc8b53f8e 100644
--- a/crates/ui-egui/src/protect.rs
+++ b/crates/ui-egui/src/dialogs/protect.rs
@@ -86,7 +86,7 @@ fn radio(ui: &mut egui::Ui, t: &Tokens, on: bool, label: &str) -> egui::Response
     }
     ui.painter().text(egui::pos2(rect.left() + 26.0, rect.center().y), egui::Align2::LEFT_CENTER, tl!(label), theme::regular(14.0), t.text);
     let info = tl!(label).to_string();
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::RadioButton, true, on, info.clone()));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::RadioButton, true, on, info.clone()));
     resp.on_hover_cursor(egui::CursorIcon::PointingHand)
 }
 
@@ -144,7 +144,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                 (A::Rc4_40, tl!("Acrobat 3.0 and later (40-bit RC4)")),
             ];
             let cur = algos.iter().find(|(a, _)| *a == p.algorithm).map_or(algos[0].1, |(_, l)| *l);
-            egui::ComboBox::from_id_salt("protect-algo").width(300.0).selected_text(cur).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("protect-algo").width(300.0).selected_text(cur).show_ui(ui, |ui| {
                 for (a, l) in algos {
                     ui.selectable_value(&mut p.algorithm, a, l);
                 }
@@ -164,7 +164,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                 let opts =
                     [(Printing::None, tl!("None")), (Printing::Low, tl!("Low Resolution (150 dpi)")), (Printing::High, tl!("High Resolution"))];
                 let cur = opts.iter().find(|(o, _)| *o == p.printing).map_or(tl!("High Resolution"), |(_, l)| *l);
-                egui::ComboBox::from_id_salt("protect-print").width(300.0).selected_text(cur).show_ui(ui, |ui| {
+                craft_ui::ComboBox::from_id_salt("protect-print").width(300.0).selected_text(cur).show_ui(ui, |ui| {
                     for (o, l) in opts {
                         ui.selectable_value(&mut p.printing, o, l);
                     }
@@ -179,7 +179,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                     (Changes::AnyExceptExtract, tl!("Any except extracting pages")),
                 ];
                 let cur = opts.iter().find(|(o, _)| *o == p.changes).map_or(tl!("None"), |(_, l)| *l);
-                egui::ComboBox::from_id_salt("protect-changes").width(300.0).selected_text(cur).show_ui(ui, |ui| {
+                craft_ui::ComboBox::from_id_salt("protect-changes").width(300.0).selected_text(cur).show_ui(ui, |ui| {
                     for (o, l) in opts {
                         ui.selectable_value(&mut p.changes, o, l);
                     }
diff --git a/crates/ui-egui/src/standards_ui.rs b/crates/ui-egui/src/dialogs/standards_ui.rs
similarity index 98%
rename from crates/ui-egui/src/standards_ui.rs
rename to crates/ui-egui/src/dialogs/standards_ui.rs
index 5fc4b3d355..11c0d1fd50 100644
--- a/crates/ui-egui/src/standards_ui.rs
+++ b/crates/ui-egui/src/dialogs/standards_ui.rs
@@ -72,7 +72,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool
     let before = app.pdfa.level;
     ui.horizontal(|ui| {
         ui.label(tl!("Conformance level:"));
-        egui::ComboBox::from_id_salt("pdfa-level").selected_text(app.pdfa.level.label()).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("pdfa-level").selected_text(app.pdfa.level.label()).show_ui(ui, |ui| {
             for l in [Level::A2b, Level::A3b] {
                 ui.selectable_value(&mut app.pdfa.level, l, l.label());
             }
diff --git a/crates/ui-egui/src/word_count_ui.rs b/crates/ui-egui/src/dialogs/word_count_ui.rs
similarity index 100%
rename from crates/ui-egui/src/word_count_ui.rs
rename to crates/ui-egui/src/dialogs/word_count_ui.rs
diff --git a/crates/ui-egui/src/docking.rs b/crates/ui-egui/src/docking.rs
deleted file mode 100644
index 11eb732be3..0000000000
--- a/crates/ui-egui/src/docking.rs
+++ /dev/null
@@ -1,547 +0,0 @@
-//! Application panel identities and persistence around the shared docking renderer.
-//! Document contents remain owned by their existing view implementations.
-
-use craft_ui::docking::{Action, DockArea, DockStyle, Layout, Location, Node, PanelLimits, Permissions, Placement, Zone};
-use craft_ui::layout::{SplitAxis, SplitSize};
-use serde::{Deserialize, Serialize};
-use serde_json::{Value, json};
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum Panel {
-    Canvas,
-    Tools,
-    Inspector,
-}
-
-impl Panel {
-    pub const ALL: &[Self] = &[Self::Canvas, Self::Tools, Self::Inspector];
-    pub fn id(self) -> &'static str {
-        match self {
-            Self::Canvas => "canvas",
-            Self::Tools => "tools",
-            Self::Inspector => "inspector",
-        }
-    }
-    fn label(self) -> &'static str {
-        match self {
-            Self::Canvas => "Document",
-            Self::Tools => "Tools",
-            Self::Inspector => "Inspector",
-        }
-    }
-    fn default_side(self) -> Zone {
-        match self {
-            Self::Canvas => Zone::Right,
-            Self::Tools => Zone::Left,
-            Self::Inspector => Zone::Right,
-        }
-    }
-    fn parse(id: &str) -> Result<Self, String> {
-        Self::ALL.iter().copied().find(|panel| panel.id() == id).ok_or_else(|| format!("Unknown panel: {id}"))
-    }
-}
-
-fn permissions(panel: &Panel) -> Permissions {
-    if *panel == Panel::Canvas { Permissions::PROTECTED } else { Permissions::default() }
-}
-
-fn tabs(panel: Panel) -> Node<Panel> {
-    Node::Tabs { panels: vec![panel], active: 0 }
-}
-
-fn split(axis: SplitAxis, size: SplitSize, first: Node<Panel>, second: Node<Panel>) -> Node<Panel> {
-    Node::Split { axis, size, first: Box::new(first), second: Box::new(second) }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-#[serde(default)]
-pub struct Workspace {
-    pub layout: Layout<Panel>,
-    /// Closed panels retain their most recent group, side, size or floating rectangle.
-    pub hidden: Vec<(Panel, Location<Panel>)>,
-}
-
-impl Default for Workspace {
-    fn default() -> Self {
-        Self {
-            layout: Layout {
-                root: Some(split(
-                    SplitAxis::Horizontal,
-                    SplitSize::FixedFirst(272.0),
-                    tabs(Panel::Tools),
-                    split(SplitAxis::Horizontal, SplitSize::FixedSecond(330.0), tabs(Panel::Canvas), tabs(Panel::Inspector)),
-                )),
-                floating: Vec::new(),
-            },
-            hidden: Vec::new(),
-        }
-    }
-}
-
-impl Workspace {
-    /// Side of the Tools panel, including its saved position while closed.
-    pub fn tools_on_right(&self) -> bool {
-        let location = self
-            .layout
-            .location(&Panel::Tools)
-            .ok()
-            .or_else(|| self.hidden.iter().find(|(panel, _)| *panel == Panel::Tools).map(|(_, location)| location.clone()));
-        location.is_some_and(|location| matches!(location.placement, Placement::Split(Zone::Right)))
-    }
-
-    /// Place Tools at the outer left or right edge while preserving its open state.
-    pub fn set_tools_on_right(&mut self, right: bool) -> Result<(), String> {
-        let was_open = self.layout.contains(&Panel::Tools);
-        self.set_visible(Panel::Tools, true)?;
-        let anchor = if right && self.layout.contains(&Panel::Inspector) { Panel::Inspector } else { Panel::Canvas };
-        self.apply(Action::Move { panel: Panel::Tools, anchor, placement: Placement::Split(if right { Zone::Right } else { Zone::Left }) })?;
-        if !was_open {
-            self.set_visible(Panel::Tools, false)?;
-        }
-        Ok(())
-    }
-
-    pub fn validate(&self) -> Result<(), String> {
-        self.layout.validate().map_err(|error| error.to_string())?;
-        if !self.layout.contains(&Panel::Canvas) || self.hidden.len() > Panel::ALL.len() {
-            return Err("The panel layout must contain its document view and bounded hidden panels".into());
-        }
-        // Saved settings cannot turn the protected document view into a floating or closable tab.
-        if self.layout.floating.iter().any(|group| group.panels.contains(&Panel::Canvas)) {
-            return Err("The document view cannot float".into());
-        }
-        let mut nodes: Vec<_> = self.layout.root.iter().collect();
-        while let Some(node) = nodes.pop() {
-            match node {
-                Node::Split { first, second, .. } => {
-                    nodes.push(first);
-                    nodes.push(second);
-                }
-                Node::Tabs { panels, .. } if panels.contains(&Panel::Canvas) && panels.len() != 1 => {
-                    return Err("The document view cannot share a tab group".into());
-                }
-                Node::Stack { entries } if entries.iter().any(|entry| entry.panel == Panel::Canvas) => {
-                    return Err("The document view cannot be collapsed".into());
-                }
-                _ => {}
-            }
-        }
-        let mut seen = std::collections::HashSet::new();
-        for (panel, location) in &self.hidden {
-            if *panel == Panel::Canvas || self.layout.contains(panel) || !seen.insert(*panel) {
-                return Err("A hidden panel has an invalid or duplicate identity".into());
-            }
-            if location.anchor == Some(Panel::Canvas) && matches!(location.placement, Placement::Tab { .. } | Placement::Split(Zone::Center)) {
-                return Err("A hidden panel cannot restore over the document view".into());
-            }
-            let mut probe = self.layout.clone();
-            if let Err(error) = probe.restore(*panel, location)
-                && error != craft_ui::docking::DockError::MissingTarget
-            {
-                return Err(error.to_string());
-            }
-        }
-        Ok(())
-    }
-
-    pub fn apply(&mut self, action: Action<Panel>) -> Result<(), String> {
-        self.validate()?;
-        let mut next = self.clone();
-        if let Action::Close { panel } = &action {
-            let location = next.layout.location(panel).map_err(|error| error.to_string())?;
-            next.hidden.retain(|(id, _)| id != panel);
-            next.hidden.push((*panel, location));
-        } else if let Action::Open { panel, .. } | Action::OpenAt { panel, .. } = &action {
-            next.hidden.retain(|(id, _)| id != panel);
-        }
-        next.layout.apply_with_permissions(action, permissions).map_err(|error| error.to_string())?;
-        next.validate()?;
-        *self = next;
-        Ok(())
-    }
-
-    /// Whether a panel's body is exposed by its selected tab or open stack entry.
-    pub(crate) fn exposed(&self, panel: Panel) -> bool {
-        if self.layout.floating.iter().any(|group| group.panels.get(group.active) == Some(&panel)) {
-            return true;
-        }
-        let mut pending: Vec<_> = self.layout.root.iter().collect();
-        while let Some(node) = pending.pop() {
-            match node {
-                Node::Split { first, second, .. } => {
-                    pending.push(first);
-                    pending.push(second);
-                }
-                Node::Tabs { panels, active } if panels.get(*active) == Some(&panel) => return true,
-                Node::Stack { entries } if entries.iter().any(|entry| entry.panel == panel && entry.open) => return true,
-                _ => {}
-            }
-        }
-        false
-    }
-
-    pub fn set_visible(&mut self, panel: Panel, visible: bool) -> Result<(), String> {
-        if self.layout.contains(&panel) == visible {
-            return Ok(());
-        }
-        if !visible {
-            return self.apply(Action::Close { panel });
-        }
-        self.validate()?;
-        let mut next = self.clone();
-        let mut location = next.hidden.iter().find(|(id, _)| *id == panel).map(|(_, location)| location.clone());
-        next.hidden.retain(|(id, _)| *id != panel);
-        if let Some(saved) = &mut location
-            && saved.floating.is_some()
-            && saved.anchor.as_ref().is_some_and(|anchor| !next.layout.floating.iter().any(|group| group.panels.contains(anchor)))
-        {
-            // The other members of a floating group may have been closed too.
-            saved.anchor = None;
-            saved.placement = Placement::Tab { before: None };
-        }
-        let restored = location.as_ref().is_some_and(|location| next.layout.restore(panel, location).is_ok());
-        if !restored {
-            next.layout
-                .apply_with_permissions(
-                    Action::OpenAt { panel, anchor: Panel::Canvas, placement: Placement::Split(panel.default_side()) },
-                    permissions,
-                )
-                .map_err(|error| error.to_string())?;
-        }
-        next.validate()?;
-        *self = next;
-        Ok(())
-    }
-
-    fn command(&mut self, params: &Value) -> Result<(), String> {
-        self.validate()?;
-        if let Some(action) = params.get("action") {
-            let action: Action<Panel> = serde_json::from_value(action.clone()).map_err(|error| error.to_string())?;
-            return self.apply(action);
-        }
-        let operation = params.get("operation").and_then(Value::as_str).ok_or("operation is required")?;
-        if operation == "resizeSplit" {
-            let path: Vec<bool> =
-                serde_json::from_value(params.get("path").cloned().ok_or("path is required")?).map_err(|error| error.to_string())?;
-            let size: SplitSize =
-                serde_json::from_value(params.get("size").cloned().ok_or("size is required")?).map_err(|error| error.to_string())?;
-            return self.apply(Action::ResizeSplit { path, size });
-        }
-        let panel = Panel::parse(params.get("panel").and_then(Value::as_str).ok_or("panel is required")?)?;
-        let action = match operation {
-            "open" => {
-                self.set_visible(panel, true)?;
-                return self.apply(Action::Activate { panel });
-            }
-            "close" => Action::Close { panel },
-            "activate" => Action::Activate { panel },
-            "setStackOpen" => Action::SetStackOpen { panel, open: params.get("open").and_then(Value::as_bool).ok_or("open must be a boolean")? },
-            "resizeStack" => {
-                let value = params.get("height").ok_or("height is required")?;
-                let height = if value.is_null() {
-                    None
-                } else {
-                    Some(
-                        value
-                            .as_f64()
-                            .filter(|height| height.is_finite() && (0.0..=1_000_000.0).contains(height))
-                            .ok_or("height must be finite and bounded")? as f32,
-                    )
-                };
-                Action::ResizeStack { panel, height }
-            }
-            "float" | "moveFloating" => {
-                let rect = params.get("rect").and_then(Value::as_array).filter(|rect| rect.len() == 4).ok_or("rect must be [x,y,width,height]")?;
-                let mut values = [0.0f32; 4];
-                for (output, value) in values.iter_mut().zip(rect) {
-                    *output = value
-                        .as_f64()
-                        .filter(|number| number.is_finite() && number.abs() <= 1_000_000.0)
-                        .ok_or("rect values must be finite and bounded")? as f32;
-                }
-                if operation == "float" { Action::Float { panel, rect: values } } else { Action::MoveFloating { panel, rect: values } }
-            }
-            "move" => {
-                let anchor = Panel::parse(params.get("target").and_then(Value::as_str).ok_or("target is required")?)?;
-                let placement = match params.get("zone").and_then(Value::as_str).unwrap_or("center") {
-                    "center" => Placement::Split(Zone::Center),
-                    "left" => Placement::Split(Zone::Left),
-                    "right" => Placement::Split(Zone::Right),
-                    "top" => Placement::Split(Zone::Top),
-                    "bottom" => Placement::Split(Zone::Bottom),
-                    _ => return Err("zone must be center, left, right, top or bottom".into()),
-                };
-                let placement = if let Some(before) = params.get("before") {
-                    if !matches!(placement, Placement::Split(Zone::Center)) {
-                        return Err("before only applies to a center move".into());
-                    }
-                    Placement::Tab {
-                        before: if before.is_null() {
-                            None
-                        } else {
-                            Some(Panel::parse(before.as_str().ok_or("before must be a panel ID or null")?)?)
-                        },
-                    }
-                } else {
-                    placement
-                };
-                Action::Move { panel, anchor, placement }
-            }
-            _ => return Err("operation must be open, close, activate, float, move, moveFloating, resizeSplit, setStackOpen or resizeStack".into()),
-        };
-        self.apply(action)
-    }
-}
-
-fn sync(workspace: &mut Workspace, app: &crate::PdfCraftApp) -> Result<(), String> {
-    workspace.set_visible(Panel::Tools, app.left_open)?;
-    workspace.set_visible(Panel::Inspector, app.right.is_some())
-}
-
-fn drain_reveals(workspace: &mut Workspace, app: &mut crate::PdfCraftApp) {
-    for panel in std::mem::take(&mut app.pending_panel_reveals) {
-        if workspace.layout.contains(&panel) {
-            let _ = workspace.apply(Action::Activate { panel });
-        }
-    }
-}
-
-fn publish_visibility(app: &mut crate::PdfCraftApp, workspace: &Workspace) {
-    app.left_open = workspace.layout.contains(&Panel::Tools);
-    if !workspace.layout.contains(&Panel::Inspector) {
-        if app.right.is_some() {
-            app.choose_right_panel(None);
-        }
-    } else if app.right.is_none() {
-        app.choose_right_panel(Some(crate::RightPanel::Comments));
-    }
-}
-
-pub fn command(app: &mut crate::PdfCraftApp, reset: bool, params: &Value) -> Result<Value, String> {
-    let mut workspace = app.docking.clone();
-    if reset {
-        workspace = Workspace::default();
-        workspace.set_visible(Panel::Inspector, app.right.is_some())?;
-    } else {
-        sync(&mut workspace, app)?;
-        workspace.command(params)?;
-    }
-    publish_visibility(app, &workspace);
-    app.docking = workspace;
-    Ok(json!({"docking": app.docking}))
-}
-
-// Split paths change when a temporarily unavailable pane is pruned. Translate renderer
-// paths back to the saved tree before applying geometry changes.
-fn saved_split_path(saved: &Layout<Panel>, rendered: &Layout<Panel>, path: &[bool]) -> Option<Vec<bool>> {
-    let mut target = rendered.root.as_ref()?;
-    for second in path {
-        let Node::Split { first, second: other, .. } = target else { return None };
-        target = if *second { other } else { first };
-    }
-    let mut pending = vec![(saved.root.as_ref()?, Vec::new())];
-    while let Some((node, original_path)) = pending.pop() {
-        if let Node::Split { first, second, .. } = node {
-            let mut projection = Layout { root: Some(node.clone()), floating: Vec::new() };
-            if projection.contains(&Panel::Inspector) {
-                let _ = projection.apply(Action::Close { panel: Panel::Inspector });
-            }
-            let has_available_panel = |child: &Node<Panel>| {
-                Layout { root: Some(child.clone()), floating: Vec::new() }.panels().into_iter().any(|panel| *panel != Panel::Inspector)
-            };
-            // An ancestor whose Inspector-only side disappeared projects to its surviving
-            // child. Its divider is absent, so only the child's split may own this resize.
-            if has_available_panel(first) && has_available_panel(second) && projection.root.as_ref() == Some(target) {
-                return Some(original_path);
-            }
-            let mut second_path = original_path.clone();
-            second_path.push(true);
-            pending.push((second, second_path));
-            let mut first_path = original_path;
-            first_path.push(false);
-            pending.push((first, first_path));
-        }
-    }
-    None
-}
-
-pub fn show(app: &mut crate::PdfCraftApp, ui: &mut egui::Ui) {
-    let t = crate::theme::Tokens::get(ui.ctx());
-    let mut workspace = std::mem::take(&mut app.docking);
-    if let Err(error) = workspace.validate().and_then(|()| sync(&mut workspace, app)) {
-        app.notify_fmt("Panel layout could not be restored: {error}", &[("error", &error)]);
-        workspace = Workspace::default();
-        let _ = sync(&mut workspace, app);
-    }
-    let mut style = DockStyle::from_ui(ui);
-    style.min_pane = 96.0;
-    style.float_label = crate::i18n::t("Float panel").into();
-    style.close_label = crate::i18n::t("Close panel").into();
-    style.move_label = crate::i18n::t("Move to group").into();
-    style.panels_label = crate::i18n::t("Panels").into();
-    style.resize_label = crate::i18n::t("Resize panels").into();
-    style.resize_window_label = crate::i18n::t("Resize panel window").into();
-    style.background = t.panel;
-    style.tab_background = t.chrome;
-    style.active_background = t.selected;
-    style.text = t.text;
-    style.inactive_text = t.text_muted;
-    style.border = egui::Stroke::new(1.0, t.divider);
-    style.accent = t.accent;
-    style.font = crate::theme::medium(12.0);
-    drain_reveals(&mut workspace, app);
-    let mut rendered = workspace.layout.clone();
-    if app.active.is_none() && rendered.contains(&Panel::Inspector) {
-        // Availability is a render projection: the saved group, selection and width survive Home.
-        let _ = rendered.apply(Action::Close { panel: Panel::Inspector });
-    }
-    // Tools docked on its own is drawn bare, without a tab strip, like Acrobat's tool pane. Grouped
-    // with another panel, or floating, it keeps its tab so it can be dragged away again; moving it
-    // to the other side stays a preference and a command.
-    let bare_tools = rendered.location(&Panel::Tools).is_ok_and(|l| l.floating.is_none() && matches!(l.placement, Placement::Split(_)));
-    let render_permissions = move |panel: &Panel| if bare_tools && *panel == Panel::Tools { Permissions::PROTECTED } else { permissions(panel) };
-    let output = DockArea::new(egui::Id::new("pdfcraft-docking")).show_with_limits(
-        ui,
-        &rendered,
-        &style,
-        |panel| crate::i18n::t(panel.label()).into(),
-        render_permissions,
-        panel_limits,
-        |ui, panel| match panel {
-            Panel::Canvas => {
-                ui.painter().rect_filled(ui.max_rect(), 0.0, t.pasteboard);
-                match app.active {
-                    None if app.combine_showing() => crate::combine_ui::page(app, ui),
-                    None => crate::home::show(app, ui),
-                    Some(index) => match crate::compare_ui::side_by_side(app, index) {
-                        Some((old, new)) => crate::compare_ui::compare_area(app, old, new, ui),
-                        None => crate::canvas::document_area(app, index, ui),
-                    },
-                }
-            }
-            Panel::Tools => crate::panels::left_panel(app, ui),
-            Panel::Inspector => {
-                ui.data_mut(|data| data.insert_temp(egui::Id::new("pdfcraft-inspector-body"), ui.max_rect()));
-                crate::panels::right_panel(app, ui);
-            }
-        },
-    );
-    let _ = sync(&mut workspace, app);
-    drain_reveals(&mut workspace, app);
-    publish_visibility(app, &workspace);
-    app.docking = workspace;
-    for mut action in output.actions {
-        if app.active.is_none()
-            && let Action::ResizeSplit { path, .. } = &mut action
-        {
-            let Some(saved_path) = saved_split_path(&app.docking.layout, &rendered, path) else { continue };
-            *path = saved_path;
-        }
-        if let Err(error) =
-            serde_json::to_value(action).map_err(|error| error.to_string()).and_then(|action| command(app, false, &json!({"action": action})))
-        {
-            app.notify_fmt("Panel move was not applied: {error}", &[("error", &error)]);
-        }
-    }
-}
-
-fn panel_limits(panel: &Panel) -> PanelLimits {
-    let (min, max_width) = match panel {
-        Panel::Canvas => (egui::vec2(160.0, 160.0), 1_000_000.0),
-        Panel::Tools => (egui::vec2(240.0, 120.0), 520.0),
-        Panel::Inspector => (egui::vec2(260.0, 120.0), 520.0),
-    };
-    PanelLimits { min, max: egui::vec2(max_width, 1_000_000.0) }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn tools_side_moves_to_both_edges_and_survives_closed_restore() {
-        let mut workspace = Workspace::default();
-        assert!(!workspace.tools_on_right());
-        workspace.set_tools_on_right(true).unwrap();
-        assert!(workspace.tools_on_right());
-        workspace.set_visible(Panel::Tools, false).unwrap();
-        assert!(workspace.tools_on_right());
-        workspace.set_tools_on_right(false).unwrap();
-        assert!(!workspace.tools_on_right());
-        assert!(!workspace.layout.contains(&Panel::Tools));
-        workspace.set_visible(Panel::Tools, true).unwrap();
-        assert!(!workspace.tools_on_right());
-        workspace.validate().unwrap();
-    }
-
-    #[test]
-    fn exposed_respects_collapsed_stack_and_inactive_floating_tabs() {
-        let mut workspace = Workspace {
-            layout: Layout {
-                root: Some(split(
-                    SplitAxis::Horizontal,
-                    SplitSize::FixedFirst(272.0),
-                    Node::Stack {
-                        entries: vec![
-                            craft_ui::docking::StackEntry { panel: Panel::Tools, open: true, height: None },
-                            craft_ui::docking::StackEntry { panel: Panel::Inspector, open: false, height: None },
-                        ],
-                    },
-                    tabs(Panel::Canvas),
-                )),
-                floating: Vec::new(),
-            },
-            hidden: Vec::new(),
-        };
-        workspace.validate().unwrap();
-        assert!(workspace.exposed(Panel::Tools));
-        assert!(!workspace.exposed(Panel::Inspector));
-        workspace.apply(Action::Activate { panel: Panel::Inspector }).unwrap();
-        assert!(workspace.exposed(Panel::Inspector));
-        workspace.apply(Action::Float { panel: Panel::Tools, rect: [10.0, 20.0, 300.0, 400.0] }).unwrap();
-        workspace.apply(Action::Move { panel: Panel::Inspector, anchor: Panel::Tools, placement: Placement::Split(Zone::Center) }).unwrap();
-        assert!(!workspace.exposed(Panel::Tools));
-        assert!(workspace.exposed(Panel::Inspector));
-    }
-
-    #[test]
-    fn unavailable_inspector_split_resize_targets_saved_tools_split() {
-        let mut workspace = Workspace::default();
-        // Inspector at the outer edge makes the visible Tools split move to the root.
-        workspace.apply(Action::Move { panel: Panel::Inspector, anchor: Panel::Tools, placement: Placement::Split(Zone::Left) }).unwrap();
-        let mut rendered = workspace.layout.clone();
-        rendered.apply(Action::Close { panel: Panel::Inspector }).unwrap();
-        let path = saved_split_path(&workspace.layout, &rendered, &[]).unwrap();
-        workspace.apply(Action::ResizeSplit { path, size: SplitSize::FixedFirst(290.0) }).unwrap();
-        let mut resized = workspace.layout.clone();
-        resized.apply(Action::Close { panel: Panel::Inspector }).unwrap();
-        assert!(matches!(resized.root, Some(Node::Split { size: SplitSize::FixedFirst(290.0), .. })));
-    }
-
-    #[test]
-    fn unavailable_outer_inspector_does_not_capture_its_childs_resize() {
-        let mut workspace = Workspace {
-            layout: Layout {
-                root: Some(split(
-                    SplitAxis::Horizontal,
-                    SplitSize::FixedSecond(330.0),
-                    split(SplitAxis::Horizontal, SplitSize::FixedFirst(272.0), tabs(Panel::Tools), tabs(Panel::Canvas)),
-                    tabs(Panel::Inspector),
-                )),
-                floating: Vec::new(),
-            },
-            hidden: Vec::new(),
-        };
-        workspace.validate().unwrap();
-        let mut rendered = workspace.layout.clone();
-        rendered.apply(Action::Close { panel: Panel::Inspector }).unwrap();
-        let path = saved_split_path(&workspace.layout, &rendered, &[]).unwrap();
-        assert_eq!(path, vec![false]);
-        workspace.apply(Action::ResizeSplit { path, size: SplitSize::FixedFirst(290.0) }).unwrap();
-        assert!(matches!(workspace.layout.root, Some(Node::Split { size: SplitSize::FixedSecond(330.0), .. })));
-        let mut resized = workspace.layout.clone();
-        resized.apply(Action::Close { panel: Panel::Inspector }).unwrap();
-        assert!(matches!(resized.root, Some(Node::Split { size: SplitSize::FixedFirst(290.0), .. })));
-    }
-}
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
deleted file mode 100644
index 65c7bd780a..0000000000
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ /dev/null
@@ -1,1963 +0,0 @@
-//! Edit a PDF ▸ Edit text & images: boxes around the paragraphs and images already on the page.
-//! Click a paragraph to edit it in place (⌘Enter or clicking away applies and rewraps it to the
-//! box, Esc cancels); drag it to move it, or drag the handle on its left or right edge to rewrap
-//! it to a new width. Click an image to select it: drag to move, drag a corner to resize (keeping
-//! its proportions), right-click for rotate, flip, replace, save and delete; Delete removes it.
-
-use std::collections::BTreeMap;
-use std::sync::Arc;
-
-use egui::{Color32, CornerRadius, FontFamily, FontId, Pos2, Rect, Stroke};
-use pdfcraft_engine::{Edit, ObjectKind, ObjectTarget};
-use pdfcraft_render::DocInfo;
-
-use crate::canvas::{DocView, PageXform};
-
-const ACCENT: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
-
-#[derive(Clone, Copy, PartialEq)]
-enum TextTarget {
-    Block(usize),
-    Added(usize),
-}
-
-/// A cached, read-only page background. The source glyphs are removed before rasterization;
-/// colour, pictures and unselected text beneath the editor remain visible.
-#[derive(Default)]
-pub(crate) struct TextBackground {
-    key: Option<(u64, usize, TextTarget)>,
-    renderer: Option<pdfcraft_render::RenderPool>,
-    texture: Option<egui::TextureHandle>,
-    tag: Option<u64>,
-    received: Option<u64>,
-    draft_key: Option<(String, pdfcraft_engine::BlockStyle)>,
-    draft_rect: Option<[f64; 4]>,
-    /// This frame's place for the textless page under the open paragraph's editor. It stays
-    /// empty, so the page shows its own text, until the paragraph is changed ([`Self::reveal`]).
-    slot: Option<(egui::Painter, egui::layers::ShapeIdx, egui::Shape)>,
-    /// How the open paragraph looked in its editor last frame.
-    look: Option<EditorLook>,
-    /// An applied paragraph's last look. The page raster still has the old text until the page
-    /// is rendered again, so the textless page and this look stay up until then.
-    settling: Option<EditorLook>,
-}
-
-/// A paragraph editor's text as last drawn: its laid-out rows, where they were on the page (in
-/// the page's 0..1 coordinates), and the page's width and turn on screen then.
-struct EditorLook {
-    page: usize,
-    block: usize,
-    galley: Arc<egui::Galley>,
-    at: (f32, f32),
-    color: Color32,
-    page_width: f32,
-    rot: u16,
-}
-
-impl TextBackground {
-    pub fn pending(&self) -> bool {
-        self.renderer.is_some() && self.received != self.tag
-    }
-
-    /// The open paragraph's editor drew `galley` at `pos` this frame.
-    pub fn remember(&mut self, xf: &PageXform, page: usize, block: usize, galley: Arc<egui::Galley>, pos: Pos2, color: Color32) {
-        self.look = Some(EditorLook { page, block, galley, at: xf.screen_to_norm(pos), color, page_width: xf.rect.width(), rot: xf.rot });
-    }
-
-    /// An edit was applied. When it is the open paragraph's, its last look stays up over the
-    /// textless page until the page is rendered again; any other edit ends both.
-    pub fn committed(&mut self, edit: &Edit) {
-        let look = self.look.take().filter(|look| {
-            matches!(edit, Edit::EditTextBlock { page, block, .. } if (look.page, look.block) == (*page, *block))
-                && self.key.is_some_and(|(_, page, target)| (page, target) == (look.page, TextTarget::Block(look.block)))
-                && self.texture.is_some()
-        });
-        match look {
-            Some(look) => {
-                self.renderer = None;
-                self.settling = Some(look);
-            }
-            None => *self = Self::default(),
-        }
-    }
-
-    pub fn page_received(&mut self, page: usize) {
-        if self.settling.as_ref().is_some_and(|look| look.page == page) {
-            *self = Self::default();
-        }
-    }
-
-    pub fn prepare(
-        &mut self,
-        ctx: &egui::Context,
-        doc: &pdfcraft_engine::Document,
-        editor: Option<&LineEditor>,
-        draft: Option<&crate::content_ui::TextDraft>,
-        scale: f32,
-    ) {
-        let key = editor
-            .map(|ed| (doc.edit_generation(), ed.page, TextTarget::Block(ed.block)))
-            .or_else(|| draft.and_then(|d| d.index.map(|index| (doc.edit_generation(), d.page, TextTarget::Added(index)))));
-        self.slot = None;
-        if key.is_none() && self.settling.is_some() {
-            return;
-        }
-        if self.key != key {
-            *self = Self { key, ..Default::default() };
-            if let Some((_, page, target)) = key {
-                self.renderer = match target {
-                    TextTarget::Block(block) => doc.text_edit_preview(page, block),
-                    TextTarget::Added(index) => doc.added_text_preview(page, index),
-                }
-                .ok()
-                .map(|p| p.renderer());
-            }
-        }
-        if let Some(ed) = editor {
-            let draft_key = (ed.text.clone(), ed.style());
-            if self.draft_key.as_ref() != Some(&draft_key) {
-                self.draft_rect = doc.text_edit_layout(ed.page, ed.block, &ed.text, &draft_key.1).ok().and_then(|layout| layout.draft_rect);
-                self.draft_key = Some(draft_key);
-            }
-        }
-        let (Some((_, page, _)), Some(renderer)) = (self.key, self.renderer.as_ref()) else { return };
-        let Some(p) = doc.info.pages.get(page) else { return };
-        // One raster stands in for the page's tiles while a paragraph is open, so everything
-        // around the editor is drawn from it: at the tiling threshold it stays sharp on a Retina
-        // display up to about 2.5x on a Letter or A4 page, where the backdrop side (2048) went
-        // soft past 1.2x.
-        let max_side = ctx.input(|i| i.max_texture_side) as f32;
-        let scale = scale.min(crate::canvas::TILE_THRESHOLD.min(max_side) / p.width.max(p.height).max(1.0));
-        let tag = (scale * 1000.0) as u64;
-        if self.tag != Some(tag) {
-            renderer.set_queue(vec![pdfcraft_render::RenderRequest { page, scale, tag, ..Default::default() }]);
-            self.tag = Some(tag);
-        }
-        if let Some(out) = renderer.try_recv() {
-            if out.error.is_some() {
-                self.renderer = None;
-                self.texture = None;
-                return;
-            }
-            if out.request.tag == tag {
-                self.texture = Some(ctx.load_texture(
-                    "text-editor-background",
-                    crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba),
-                    egui::TextureOptions::LINEAR,
-                ));
-                self.received = Some(tag);
-            }
-        }
-        if self.received != Some(tag) {
-            ctx.request_repaint_after(std::time::Duration::from_millis(16));
-        }
-    }
-
-    /// The draft's measured extent, when it was measured for paragraph `block` on `page`.
-    pub fn draft_rect_for(&self, page: usize, block: usize) -> Option<[f64; 4]> {
-        self.draft_rect.filter(|_| self.key.is_some_and(|(_, p, target)| (p, target) == (page, TextTarget::Block(block))))
-    }
-
-    pub fn ready(&self, page: usize, block: usize) -> bool {
-        self.key.is_some_and(|(_, p, target)| (p, target) == (page, TextTarget::Block(block))) && self.texture.is_some()
-    }
-
-    pub fn ready_added(&self, page: usize, index: usize) -> bool {
-        self.key.is_some_and(|(_, p, target)| (p, target) == (page, TextTarget::Added(index))) && self.texture.is_some()
-    }
-
-    pub fn paint(
-        &mut self,
-        painter: &egui::Painter,
-        xf: &PageXform,
-        page: usize,
-        editor: Option<&LineEditor>,
-        draft: Option<&crate::content_ui::TextDraft>,
-    ) {
-        let for_editor = editor.is_some_and(|ed| ed.page == page && self.ready(page, ed.block));
-        // A zoom or a turn of the view since the paragraph was applied would misplace its rows:
-        // the page raster (with the old text) shows until the new one arrives instead.
-        let settled =
-            self.settling.as_ref().filter(|look| look.page == page && look.rot == xf.rot && (look.page_width - xf.rect.width()).abs() < 0.5);
-        let ready =
-            for_editor || draft.is_some_and(|d| d.page == page && d.index.is_some_and(|index| self.ready_added(page, index))) || settled.is_some();
-        if !ready {
-            return;
-        }
-        let Some(tex) = &self.texture else { return };
-        // Font metrics can underestimate the actual glyph ink. Paint the complete textless
-        // page so overhanging glyphs cannot remain outside the estimated source rectangle.
-        let painter = painter.with_clip_rect(painter.clip_rect().intersect(xf.rect));
-        if for_editor {
-            // Its place under everything drawn on the page later; the editor fills it once the
-            // paragraph changes (an unchanged paragraph looks as the page draws it).
-            let mut mesh = egui::Mesh::with_texture(tex.id());
-            for (u, v) in [(0.0, 0.0), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
-                mesh.vertices.push(egui::epaint::Vertex { pos: xf.norm_to_screen(u, v), uv: Pos2::new(u, v), color: Color32::WHITE });
-            }
-            mesh.add_triangle(0, 1, 2);
-            mesh.add_triangle(0, 2, 3);
-            let idx = painter.add(egui::Shape::Noop);
-            self.slot = Some((painter, idx, egui::Shape::mesh(mesh)));
-        } else {
-            xf.paint_image(&painter, tex.id(), 0.0, 0.0, 1.0, 1.0);
-            if let Some(look) = settled {
-                painter.galley(xf.norm_to_screen(look.at.0, look.at.1), Arc::clone(&look.galley), look.color);
-            }
-        }
-    }
-
-    /// The open paragraph has changed: show the textless page under its editor this frame.
-    pub fn reveal(&mut self) {
-        if let Some((painter, idx, shape)) = self.slot.take() {
-            painter.set(idx, shape);
-        }
-    }
-}
-
-/// How many faint Edit-text outlines are drawn per page per frame. CAD plots can draw
-/// ~1000 tiny images on one page; stroking all of them every frame (plus a hover query
-/// per box) stalls the UI. Past this, only the selected and hovered boxes are outlined:
-/// hit-testing still covers every image, so nothing becomes unselectable.
-const MAX_OUTLINES: usize = 250;
-
-/// A paragraph being edited.
-#[derive(Clone, Debug, PartialEq)]
-pub struct LineEditor {
-    pub selection: Option<std::ops::Range<usize>>,
-    pub font_resource: Option<String>,
-    pub page: usize,
-    pub block: usize,
-    pub text: String,
-    original: String,
-    rect: Rect,
-    /// The original PDF rectangle, in user space. It is converted again each frame so the editor
-    /// stays attached while the page is zoomed, scrolled, or rotated.
-    source_rect: [f32; 4],
-    multiline: bool,
-    source: Option<(pdfcraft_engine::TextBlock, Vec<pdfcraft_engine::TextLine>)>,
-    pub(crate) fonts: BTreeMap<String, String>,
-    /// The draft extends outside the source container; its frame follows the live draft bounds.
-    pub overflow: bool,
-    /// The initial source container width in screen pixels.
-    max_width: f32,
-    /// Current screen-space size. Recomputed from the current page transform before painting.
-    size: f32,
-    /// Take the keyboard focus on the next frame.
-    pub(crate) focus: bool,
-    /// The Format text panel's values, and what the paragraph had (to send only changes).
-    pub look: pdfcraft_engine::AddedText,
-    look0: pdfcraft_engine::AddedText,
-    /// A standard family was picked from the font list. The family guessed from a PDF font name
-    /// (Calibri reads as Helvetica) can be the one picked, so comparing `look` with `look0` alone
-    /// would miss the choice.
-    family_chosen: bool,
-    /// Underline, line spacing (× size; 0 = the paragraph's own), character spacing (pt) and
-    /// horizontal scale (%), and what they were.
-    pub extras: Extras,
-    extras0: Extras,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct Extras {
-    pub underline: bool,
-    pub line_spacing: f64,
-    pub char_spacing: f64,
-    pub scale: f64,
-}
-
-impl Default for Extras {
-    fn default() -> Self {
-        Extras { underline: false, line_spacing: 0.0, char_spacing: 0.0, scale: 100.0 }
-    }
-}
-
-impl LineEditor {
-    /// What Format text's font list shows: the chosen page font, a standard family picked
-    /// instead, or the paragraph's own font (its `/BaseFont` without the subset tag).
-    pub(crate) fn font_shown(&self, sources: &[(String, String)]) -> String {
-        if let Some(face) = self.font_resource.as_ref().and_then(|r| sources.iter().find(|(res, _)| res == r)).map(|(_, face)| face) {
-            return face.clone();
-        }
-        if self.look.family != self.look0.family || self.family_chosen {
-            return self.look.family.label().to_string();
-        }
-        let base = self.source.as_ref().map(|(block, _)| block.base_font.as_str()).unwrap_or_default();
-        // "ABCDEF+Calibri" is a subset of Calibri.
-        let name = match base.split_once('+') {
-            Some((tag, rest)) if tag.len() == 6 && tag.bytes().all(|b| b.is_ascii_uppercase()) => rest,
-            _ => base,
-        };
-        if name.is_empty() { tl!("Keep source fonts").to_string() } else { name.to_string() }
-    }
-
-    /// Back to the paragraph's own font: no page font chosen and the family it started with.
-    pub(crate) fn keep_source_font(&mut self) {
-        self.font_resource = None;
-        self.look.family = self.look0.family;
-        self.family_chosen = false;
-    }
-
-    /// A standard family picked from the font list, replacing the paragraph's font even when it
-    /// is the family the paragraph's font name reads as.
-    pub(crate) fn choose_family(&mut self, family: pdfcraft_engine::FontFamily) {
-        self.font_resource = None;
-        self.look.family = family;
-        self.family_chosen = true;
-    }
-
-    pub(crate) fn has_changes(&self) -> bool {
-        self.changes_with(&self.text)
-    }
-
-    /// Whether the paragraph with `text` in it differs from what was opened.
-    fn changes_with(&self, text: &str) -> bool {
-        text != self.original || self.look != self.look0 || self.extras != self.extras0 || self.family_chosen
-    }
-
-    /// Extra width permitted by the editor. Source containers now remain fixed.
-    pub fn growth(&self) -> Option<f32> {
-        (self.max_width > self.rect.width()).then_some(self.max_width)
-    }
-
-    /// Whether the edited text differs from the original (unsaved changes).
-    pub fn has_unsaved_text(&self) -> bool {
-        self.text != self.original
-    }
-
-    /// The formatting the panel changed.
-    pub fn style(&self) -> pdfcraft_engine::BlockStyle {
-        let (l, o) = (&self.look, &self.look0);
-        let mut style = pdfcraft_engine::BlockStyle {
-            resource: self.font_resource.clone(),
-            family: (l.family != o.family || self.family_chosen || l.bold != o.bold || l.italic != o.italic).then_some((l.family, l.bold, l.italic)),
-            size: (l.size != o.size).then_some(l.size),
-            color: (l.color != o.color).then_some(l.color),
-            align: (l.align != o.align).then_some(l.align),
-            underline: (self.extras.underline != self.extras0.underline).then_some(self.extras.underline),
-            line_spacing: (self.extras.line_spacing != self.extras0.line_spacing && self.extras.line_spacing > 0.0)
-                .then_some(self.extras.line_spacing),
-            char_spacing: (self.extras.char_spacing != self.extras0.char_spacing).then_some(self.extras.char_spacing),
-            scale: (self.extras.scale != self.extras0.scale).then_some(self.extras.scale),
-            ..Default::default()
-        };
-        if let Some(range) = &self.selection
-            && (style.family.is_some()
-                || style.resource.is_some()
-                || style.size.is_some()
-                || style.color.is_some()
-                || style.underline.is_some()
-                || style.char_spacing.is_some()
-                || style.scale.is_some())
-        {
-            style.ranges.push(pdfcraft_engine::RangeStyle {
-                range: range.clone(),
-                family: style.family.take(),
-                resource: style.resource.take(),
-                size: style.size.take(),
-                color: style.color.take(),
-                underline: style.underline.take(),
-                char_spacing: style.char_spacing.take(),
-                scale: style.scale.take(),
-            });
-        }
-        style
-    }
-
-    /// After applying formatting: the paragraph now has it.
-    pub fn applied(&mut self) {
-        self.selection = None;
-        self.font_resource = None;
-        self.family_chosen = false;
-        self.look0 = self.look.clone();
-        self.extras0 = self.extras;
-        self.original = self.text.clone();
-        self.focus = true;
-    }
-
-    /// Adopt the rewritten paragraph's current geometry before the next overlay frame.
-    pub(crate) fn refresh_source(&mut self, block: &pdfcraft_engine::TextBlock, lines: Vec<pdfcraft_engine::TextLine>) {
-        self.source_rect = block.rect.map(|v| v as f32);
-        self.multiline = block.rows.len() > 1;
-        self.source = Some((block.clone(), lines));
-        self.text = block.editor_text.clone();
-        self.original = self.text.clone();
-    }
-}
-
-/// The look shown for a paragraph: the family and weight guessed from its PDF font name.
-fn source_look(base_font: &str, size: f64, color: [f64; 3], detected_bold: bool, detected_italic: bool) -> pdfcraft_engine::AddedText {
-    use pdfcraft_engine::FontFamily as F;
-    let name = base_font.to_ascii_lowercase();
-    let family = if ["courier", "mono", "consolas", "menlo", "monaco", "lucida console"].iter().any(|s| name.contains(s)) {
-        F::Courier
-    } else if !name.contains("sans") && ["times", "serif", "roman", "cambria", "georgia", "palatino", "garamond"].iter().any(|s| name.contains(s)) {
-        F::Times
-    } else {
-        F::Helvetica
-    };
-    pdfcraft_engine::AddedText {
-        family,
-        bold: detected_bold || ["bold", "black", "heavy", "semibold", "demi"].iter().any(|s| name.contains(s)),
-        italic: detected_italic || ["italic", "oblique", "slanted"].iter().any(|s| name.contains(s)),
-        size: (size * 10.0).round() / 10.0,
-        color,
-        ..Default::default()
-    }
-}
-
-fn look_of(b: &pdfcraft_engine::TextBlock) -> pdfcraft_engine::AddedText {
-    source_look(&b.base_font, b.size, b.color, b.bold, b.italic)
-}
-
-pub(crate) fn editor_font(look: &pdfcraft_engine::AddedText, size: f32) -> FontId {
-    let family = match (look.family, look.bold) {
-        (pdfcraft_engine::FontFamily::Courier, _) => FontFamily::Monospace,
-        (_, true) => FontFamily::Name("semibold".into()),
-        (_, false) => FontFamily::Proportional,
-    };
-    FontId::new(size, family)
-}
-
-fn color32(color: [f64; 3]) -> Color32 {
-    Color32::from_rgb(
-        (color[0].clamp(0.0, 1.0) * 255.0).round() as u8,
-        (color[1].clamp(0.0, 1.0) * 255.0).round() as u8,
-        (color[2].clamp(0.0, 1.0) * 255.0).round() as u8,
-    )
-}
-
-/// The dark box behind text too pale to read on white.
-const DARK_EDITOR_FILL: Color32 = Color32::from_gray(0x26);
-
-/// WCAG relative luminance of an sRGB colour.
-fn luminance(c: Color32) -> f32 {
-    let channel = |v: u8| {
-        let v = f32::from(v) / 255.0;
-        if v <= 0.040_45 { v / 12.92 } else { ((v + 0.055) / 1.055).powf(2.4) }
-    };
-    0.2126 * channel(c.r()) + 0.7152 * channel(c.g()) + 0.0722 * channel(c.b())
-}
-
-/// WCAG contrast ratio between two colours (1 to 21).
-fn contrast(a: Color32, b: Color32) -> f32 {
-    let (la, lb) = (luminance(a), luminance(b));
-    (la.max(lb) + 0.05) / (la.min(lb) + 0.05)
-}
-
-/// The inline editor's background for text drawn in `text`: white, or a dark box when the text
-/// reads better on that (white or pale text, which would vanish on white).
-pub(crate) fn editor_fill(text: Color32) -> Color32 {
-    if contrast(text, Color32::WHITE) >= contrast(text, DARK_EDITOR_FILL) { Color32::WHITE } else { DARK_EDITOR_FILL }
-}
-
-/// A selected page image, and what the pointer is doing to it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct ImageSelection {
-    pub page: usize,
-    pub index: usize,
-    /// Dragging: the start point and, for a corner, the opposite corner (screen).
-    drag: Option<(Pos2, Option<Pos2>)>,
-    /// Crop mode (Acrobat's crop handles): the box kept so far.
-    pub crop: Option<CropMode>,
-    /// The drag is turning the picture by its rotate handle (the `drag` start is then unused).
-    turning: bool,
-    /// A move or resize applied on release: the frame it had and the one it got, in the page's
-    /// 0..1 coordinates, while the page raster still has the picture where it was.
-    settled: Option<(Rect, Rect)>,
-}
-
-/// Cropping a page image: the handles trim instead of resizing, the part that will go is
-/// dimmed, Enter or Done applies and Esc or Cancel leaves it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct CropMode {
-    /// The box to keep (user space).
-    pub keep: [f64; 4],
-    /// A drag in progress: the grip (0–3 corners, 4–7 edges, 8 the inside), where it started
-    /// and the box then.
-    drag: Option<(usize, Pos2, [f64; 4])>,
-}
-
-impl CropMode {
-    pub fn new(keep: [f64; 4]) -> Self {
-        Self { keep, drag: None }
-    }
-}
-
-/// The screen boxes of the crop's eight handles: corners, then the top, right, bottom and left
-/// edge midpoints.
-fn crop_handles(k: Rect) -> [Pos2; 8] {
-    [k.left_top(), k.right_top(), k.left_bottom(), k.right_bottom(), k.center_top(), k.right_center(), k.center_bottom(), k.left_center()]
-}
-
-/// Crop mode for the selected image `i` whose visible frame is `b` (screen). Returns `true`
-/// (the pointer and keys are the crop's while it lasts).
-#[allow(clippy::too_many_arguments)]
-fn crop_input(
-    ui: &egui::Ui,
-    resp: &egui::Response,
-    xf: &PageXform,
-    page: usize,
-    info: &DocInfo,
-    view: &mut DocView,
-    i: usize,
-    b: Rect,
-    allow_interaction: bool,
-) -> bool {
-    let painter = ui.painter();
-    let Some(mode) = view.image_selection.as_mut().and_then(|s| s.crop.as_mut()) else { return false };
-    let hover_pos = ui.input(|inp| inp.pointer.hover_pos());
-    let keep_screen = |keep: [f64; 4]| xf.user_rect(info, page, keep.map(|v| v as f32)).intersect(b);
-    // A drag in progress moves a grip; the box stays inside the picture and at least 6 px.
-    if allow_interaction
-        && resp.drag_started()
-        && let Some(o) = ui.input(|inp| inp.pointer.press_origin())
-    {
-        let k = keep_screen(mode.keep);
-        let grip = crop_handles(k).iter().position(|h| h.distance(o) < 8.0).or_else(|| k.contains(o).then_some(8));
-        if let Some(g) = grip {
-            mode.drag = Some((g, o, mode.keep));
-        }
-    }
-    if let Some((grip, start, at_start)) = mode.drag
-        && let Some(p) = hover_pos
-    {
-        let d = p - start;
-        let k0 = keep_screen(at_start);
-        let (mut min, mut max) = (k0.min, k0.max);
-        match grip {
-            0 => {
-                min.x += d.x;
-                min.y += d.y;
-            }
-            1 => {
-                max.x += d.x;
-                min.y += d.y;
-            }
-            2 => {
-                min.x += d.x;
-                max.y += d.y;
-            }
-            3 => {
-                max.x += d.x;
-                max.y += d.y;
-            }
-            4 => min.y += d.y,
-            5 => max.x += d.x,
-            6 => max.y += d.y,
-            7 => min.x += d.x,
-            _ => {
-                let shift = egui::vec2(d.x.clamp(b.min.x - k0.min.x, b.max.x - k0.max.x), d.y.clamp(b.min.y - k0.min.y, b.max.y - k0.max.y));
-                min += shift;
-                max += shift;
-            }
-        }
-        let (min_w, min_h) = (6.0_f32.min(b.width()), 6.0_f32.min(b.height()));
-        min.x = min.x.clamp(b.min.x, b.max.x - min_w);
-        min.y = min.y.clamp(b.min.y, b.max.y - min_h);
-        max.x = max.x.clamp(min.x + min_w, b.max.x);
-        max.y = max.y.clamp(min.y + min_h, b.max.y);
-        mode.keep = user_box(xf, info, page, Rect::from_min_max(min, max));
-        if resp.drag_stopped() || !ui.input(|inp| inp.pointer.primary_down()) {
-            mode.drag = None;
-        }
-    }
-    let k = keep_screen(mode.keep);
-    // What goes is dimmed; what stays keeps its frame and handles.
-    let dim = Color32::from_black_alpha(96);
-    for r in [
-        Rect::from_min_max(b.min, Pos2::new(b.max.x, k.min.y)),
-        Rect::from_min_max(Pos2::new(b.min.x, k.max.y), b.max),
-        Rect::from_min_max(Pos2::new(b.min.x, k.min.y), Pos2::new(k.min.x, k.max.y)),
-        Rect::from_min_max(Pos2::new(k.max.x, k.min.y), Pos2::new(b.max.x, k.max.y)),
-    ] {
-        if r.is_positive() {
-            painter.rect_filled(r.intersect(xf.rect), CornerRadius::ZERO, dim);
-        }
-    }
-    painter.rect_stroke(k, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-    for h in crop_handles(k) {
-        painter.rect(
-            Rect::from_center_size(h, egui::vec2(8.0, 8.0)),
-            CornerRadius::ZERO,
-            Color32::WHITE,
-            Stroke::new(1.0, ACCENT),
-            egui::StrokeKind::Middle,
-        );
-    }
-    // Done and Cancel, painted under the box (above it near the bottom of the view).
-    let font = egui::FontId::proportional(12.5);
-    let pill = |label: &str, right: f32, y: f32| -> Rect {
-        let w = painter.layout_no_wrap(label.to_string(), font.clone(), Color32::WHITE).size().x + 20.0;
-        Rect::from_min_size(Pos2::new(right - w, y), egui::vec2(w, 22.0))
-    };
-    let y = if k.max.y + 30.0 < xf.rect.max.y { k.max.y + 6.0 } else { k.min.y - 28.0 };
-    let done = pill(tl!("Done"), k.max.x, y);
-    let cancel = pill(tl!("Cancel"), done.min.x - 6.0, y);
-    let t = crate::theme::Tokens::get(ui.ctx());
-    painter.rect_filled(done, CornerRadius::same(11), ACCENT);
-    painter.text(done.center(), egui::Align2::CENTER_CENTER, tl!("Done"), font.clone(), Color32::WHITE);
-    painter.rect(cancel, CornerRadius::same(11), t.panel, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-    painter.text(cancel.center(), egui::Align2::CENTER_CENTER, tl!("Cancel"), font, t.text);
-    if let Some(p) = hover_pos {
-        let icon = if let Some(g) = crop_handles(k).iter().position(|h| h.distance(p) < 8.0) {
-            match g {
-                0 | 3 => egui::CursorIcon::ResizeNwSe,
-                1 | 2 => egui::CursorIcon::ResizeNeSw,
-                4 | 6 => egui::CursorIcon::ResizeVertical,
-                _ => egui::CursorIcon::ResizeHorizontal,
-            }
-        } else if done.contains(p) || cancel.contains(p) {
-            egui::CursorIcon::PointingHand
-        } else if k.contains(p) {
-            egui::CursorIcon::Move
-        } else {
-            egui::CursorIcon::Default
-        };
-        ui.ctx().set_cursor_icon(icon);
-    }
-    let clicked = |r: Rect| allow_interaction && resp.clicked() && hover_pos.is_some_and(|p| r.contains(p));
-    let keys = |key: egui::Key| allow_interaction && ui.input(|inp| inp.key_pressed(key)) && !ui.ctx().egui_wants_keyboard_input();
-    if clicked(done) || keys(egui::Key::Enter) {
-        let keep = mode.keep;
-        if let Some(s) = view.image_selection.as_mut() {
-            s.crop = None;
-        }
-        if keep_screen(keep) != b {
-            view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Crop(keep) });
-        }
-    } else if (clicked(cancel) || keys(egui::Key::Escape))
-        && let Some(s) = view.image_selection.as_mut()
-    {
-        s.crop = None;
-    }
-    true
-}
-
-impl ImageSelection {
-    pub(crate) fn dragging(&self) -> bool {
-        self.drag.is_some()
-    }
-}
-
-/// The page raster's picture of the box `from`, stretched into `to`, over blanks at `blank` (where
-/// the screen may still show the picture).
-fn stretched_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::TextureId, blank: &[Rect], from: Rect, to: Rect) {
-    let clipped = painter.with_clip_rect(painter.clip_rect().intersect(xf.rect));
-    for r in blank {
-        clipped.rect_filled(*r, CornerRadius::ZERO, Color32::WHITE);
-    }
-    let mut mesh = egui::Mesh::with_texture(tex);
-    for (a, b) in [
-        (from.left_top(), to.left_top()),
-        (from.right_top(), to.right_top()),
-        (from.right_bottom(), to.right_bottom()),
-        (from.left_bottom(), to.left_bottom()),
-    ] {
-        let (u, v) = xf.screen_to_norm(a);
-        mesh.vertices.push(egui::epaint::Vertex { pos: b, uv: Pos2::new(u, v), color: Color32::WHITE });
-    }
-    mesh.add_triangle(0, 1, 2);
-    mesh.add_triangle(0, 2, 3);
-    clipped.add(egui::Shape::mesh(mesh));
-}
-
-/// Once a selected corner or the rotate knob is grabbed, text under it cannot take over the gesture. The same
-/// applies after the pointer leaves the image/page while dragging.
-pub(crate) fn image_owns_pointer(ui: &egui::Ui, xf: &PageXform, page: usize, info: &DocInfo, view: &DocView) -> bool {
-    let Some(selection) = view.image_selection.as_ref().filter(|s| s.page == page) else { return false };
-    if selection.drag.is_some() {
-        return true;
-    }
-    let Some(image) = view.edit_images.get(&page).and_then(|(_, images)| images.get(selection.index)) else { return false };
-    let Some(rect) = image.visible_rect else { return false };
-    let b = xf.user_rect(info, page, rect.map(|v| v as f32));
-    let p = ui.input(|i| if i.pointer.primary_down() { i.pointer.press_origin() } else { i.pointer.hover_pos() });
-    let knob = rotate_knob(b, ui.clip_rect()).0;
-    p.is_some_and(|p| [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom(), knob].iter().any(|c| c.distance(p) < 8.0))
-}
-
-/// What a drag on a paragraph box takes hold of.
-#[derive(Clone, Copy, Debug, PartialEq)]
-enum Grip {
-    Move,
-    /// An edge (screen left or right), dragged to rewrap the paragraph.
-    Left,
-    Right,
-}
-
-/// A paragraph box being dragged: moved, or (from a handle on its left or right edge) resized.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct BlockDrag {
-    page: usize,
-    block: usize,
-    /// A paragraph index belongs to the document generation where the press was resolved.
-    generation: u64,
-    /// Where the drag started (screen).
-    start: Pos2,
-    grip: Grip,
-}
-
-/// How far an edge grip reaches either side of a box's edge (screen pixels).
-const EDGE_REACH: f32 = 6.0;
-/// How far outside an open paragraph's frame the pointer still means the frame (screen pixels).
-const FRAME_REACH: f32 = 4.0;
-
-/// The rewrap handles drawn on a paragraph box's left and right edges (screen).
-fn width_handles(b: Rect) -> [Rect; 2] {
-    let h = (b.height() * 0.5).clamp(14.0, 28.0);
-    [b.left(), b.right()].map(|x| Rect::from_center_size(Pos2::new(x, b.center().y), egui::vec2(7.0, h)))
-}
-
-/// The edge of `b` that `p` grabs: anywhere along its height, within reach of the line. A narrow
-/// box keeps its middle for moving.
-fn edge_at(b: Rect, p: Pos2) -> Option<Grip> {
-    if p.y < b.top() - EDGE_REACH || p.y > b.bottom() + EDGE_REACH {
-        return None;
-    }
-    let inside = EDGE_REACH.min(b.width() / 4.0);
-    let (dl, dr) = (p.x - b.left(), b.right() - p.x);
-    match (dl >= -EDGE_REACH && dl <= inside, dr >= -EDGE_REACH && dr <= inside) {
-        (true, true) if dl <= dr => Some(Grip::Left),
-        (_, true) => Some(Grip::Right),
-        (true, false) => Some(Grip::Left),
-        _ => None,
-    }
-}
-
-/// The topmost box under `p` and what it grabs there; edges only on an upright page.
-fn grab_at(boxes: &[Rect], p: Pos2, upright: bool) -> Option<(usize, Grip)> {
-    boxes.iter().enumerate().rev().find_map(|(i, b)| match upright.then(|| edge_at(*b, p)).flatten() {
-        Some(g) => Some((i, g)),
-        None => b.contains(p).then_some((i, Grip::Move)),
-    })
-}
-
-/// A paragraph's box on screen: its text rect (user space), with a little room around it.
-fn paragraph_box(xf: &PageXform, info: &DocInfo, page: usize, rect: [f64; 4]) -> Rect {
-    xf.user_rect(info, page, rect.map(|v| v as f32)).expand(2.0)
-}
-
-/// The width handles need the page upright (or upside down): on a quarter-turned page the
-/// screen's horizontal is the paragraph's vertical.
-fn has_edges(info: &DocInfo, page: usize) -> bool {
-    info.pages.get(page).is_some_and(|p| p.rotation % 180 == 0)
-}
-
-/// Whether a press at `p` takes hold of the width handle of one of the paragraphs `rects` (user
-/// space). The handle is drawn half outside the box and grabs from a little further out still,
-/// where a press is not on the box itself, so area selection must leave it to [`page_input`].
-pub(crate) fn grabs_edge(xf: &PageXform, info: &DocInfo, page: usize, mut rects: impl Iterator<Item = [f64; 4]>, p: Pos2) -> bool {
-    has_edges(info, page) && rects.any(|r| edge_at(paragraph_box(xf, info, page, r), p).is_some())
-}
-
-/// What a right-click on a selected image asks for.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub(crate) enum ImageAction {
-    Replace(usize, usize),
-    Save(usize, usize),
-    Copy(usize, usize),
-    CopyFile(usize, usize),
-    /// Copy the picture, then remove it from the page.
-    Cut(usize, usize),
-    /// Mark the picture for redaction (applied later from Redact a PDF).
-    Redact(usize, usize),
-    /// Create a link over the picture.
-    Link(usize, usize),
-    /// Open Recognize Text for the picture's page.
-    Recognize(usize),
-}
-
-/// Where the rotate knob sits, and the edge point its stem starts from: above the middle of the
-/// top edge, or below the bottom edge when the area on screen (`view`) has no room above.
-fn rotate_knob(b: Rect, view: Rect) -> (Pos2, Pos2) {
-    let above = b.center_top() - egui::vec2(0.0, 22.0);
-    if above.y - 6.0 >= view.top() { (above, b.center_top()) } else { (b.center_bottom() + egui::vec2(0.0, 22.0), b.center_bottom()) }
-}
-
-/// Degrees clockwise (-180..=180) that turn "straight up" from `centre` onto the pointer; `snap`
-/// rounds to steps of 15 degrees (Shift). A pointer on the centre turns nothing.
-fn turn_degrees(centre: Pos2, pointer: Pos2, snap: bool) -> f32 {
-    let v = pointer - centre;
-    if !(v.x.is_finite() && v.y.is_finite()) || v.length() < 4.0 {
-        return 0.0;
-    }
-    // Screen y points down: up is (0, -1); clockwise is atan2(x, -y).
-    let d = v.x.atan2(-v.y).to_degrees();
-    if snap { (d / 15.0).round() * 15.0 } else { d }
-}
-
-fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
-    let p = &info.pages[page];
-    let (a, b) = (xf.screen_to_view(r.min), xf.screen_to_view(r.max));
-    let (u, v) = (p.view_to_user(a.0, a.1), p.view_to_user(b.0, b.1));
-    [u[0].min(v[0]) as f64, u[1].min(v[1]) as f64, u[0].max(v[0]) as f64, u[1].max(v[1]) as f64]
-}
-
-/// Images on a page: select, move, resize, right-click. Returns `true` when the pointer was used.
-#[allow(clippy::too_many_arguments)]
-pub(crate) fn image_input(
-    ui: &egui::Ui,
-    resp: &egui::Response,
-    xf: &PageXform,
-    page: usize,
-    info: &DocInfo,
-    images: &[pdfcraft_engine::PageImage],
-    view: &mut DocView,
-    action: &mut Option<ImageAction>,
-    allow_interaction: bool,
-) -> bool {
-    let boxes: Vec<Rect> = images.iter().map(|im| im.visible_rect.map_or(Rect::NOTHING, |r| xf.user_rect(info, page, r.map(|v| v as f32)))).collect();
-    let painter = ui.painter();
-    let hover_pos = ui.input(|i| i.pointer.hover_pos());
-    let image_contains = |index: usize, point: Pos2| {
-        let (x, y) = xf.screen_to_view(point);
-        let Some(p) = info.pages.get(page) else { return false };
-        let user = p.view_to_user(x, y);
-        images.get(index).is_some_and(|im| im.contains(user.map(f64::from)))
-    };
-    let selected = view.image_selection.as_ref().filter(|s| s.page == page).map(|s| s.index).filter(|i| *i < boxes.len());
-    let dragging = view.image_selection.as_ref().is_some_and(|s| s.drag.is_some());
-    // Few images: faint outlines for all of them, as before. Many: only the selected and
-    // hovered boxes, so a ~1000-image CAD page stays interactive in Edit text & images.
-    // Fully clipped placements (empty visible frames) get no outline.
-    let faint_all = boxes.len() <= MAX_OUTLINES;
-    // The picture being dragged has its frame at the pointer; its outline where it was would
-    // trail behind until the release.
-    let moving = selected.filter(|_| dragging);
-    if faint_all {
-        for (_, b) in boxes.iter().enumerate().filter(|(i, b)| b.is_positive() && moving != Some(*i)) {
-            painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
-        }
-    }
-    let hovered_box = hover_pos.and_then(|p| boxes.iter().enumerate().rposition(|(i, b)| b.is_positive() && b.contains(p) && image_contains(i, p)));
-    if !faint_all {
-        for i in selected.filter(|_| moving.is_none()).into_iter().chain(hovered_box.filter(|h| Some(*h) != selected)) {
-            if let Some(b) = boxes.get(i).filter(|b| b.is_positive()) {
-                painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
-            }
-        }
-    }
-    for i in selected.into_iter().chain(hovered_box).collect::<Vec<_>>() {
-        let Some(b) = boxes.get(i).copied().filter(|b| b.is_positive()) else { continue };
-        if selected == Some(i) {
-            // The selected frame and handles are drawn below (or the drag preview instead).
-            if !dragging {
-                painter.rect_filled(b, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
-            }
-        } else {
-            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
-        }
-    }
-    // The selected image: frame, corner handles, dragging.
-    if let Some(i) = selected.filter(|i| boxes.get(*i).is_some_and(|b| b.is_positive())) {
-        let b = boxes[i];
-        if view.image_selection.as_ref().is_some_and(|s| s.crop.is_some()) {
-            return crop_input(ui, resp, xf, page, info, view, i, b, allow_interaction);
-        }
-        let corners = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()];
-        let handles = |rect: Rect| {
-            for c in [rect.left_top(), rect.right_top(), rect.left_bottom(), rect.right_bottom()] {
-                painter.rect(
-                    Rect::from_center_size(c, egui::vec2(8.0, 8.0)),
-                    CornerRadius::ZERO,
-                    Color32::WHITE,
-                    Stroke::new(1.0, ACCENT),
-                    egui::StrokeKind::Middle,
-                );
-            }
-        };
-        // Until the page is rendered again its raster has an applied move or resize's picture
-        // where it was: it stays blanked there and drawn where it went.
-        // The whole-page raster and its tiles are replaced separately: the old frame stays blanked
-        // while anything still shows the picture there, but its pixels come from the old frame
-        // only while the whole-page raster itself is the old one. Once that is fresh it has the
-        // picture where it went, and that is where they come from.
-        let (out_of_date, raster_old, raster) = (view.page_out_of_date(page), view.page_raster_out_of_date(page), view.page_raster(page));
-        let screen = |r: Rect| Rect::from_two_pos(xf.norm_to_screen(r.min.x, r.min.y), xf.norm_to_screen(r.max.x, r.max.y));
-        // Where the screen may still show the picture from before an applied move, while the page
-        // isn't drawn again yet. Another drag keeps it blanked too.
-        let left_at = view.image_selection.as_ref().and_then(|s| s.settled).filter(|_| out_of_date).map(|(from, _)| from);
-        if let Some(s) = view.image_selection.as_mut().filter(|s| s.drag.is_none()) {
-            match (s.settled, raster) {
-                (Some((from, to)), Some(tex)) if out_of_date => {
-                    let source = if raster_old { from } else { to };
-                    stretched_picture(painter, xf, tex, &[screen(from)], screen(source), screen(to));
-                }
-                _ => s.settled = None,
-            }
-        }
-        if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
-            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-            handles(b);
-        }
-        if allow_interaction && let Some(corner) = hover_pos.and_then(|p| corners.iter().position(|c| c.distance(p) < 8.0)) {
-            ui.ctx().set_cursor_icon(if matches!(corner, 0 | 3) { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
-        }
-        // The rotate handle: a knob above the top edge, joined to it by a short stem.
-        let (knob, stem) = rotate_knob(b, ui.clip_rect());
-        if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
-            painter.line_segment([stem, knob], Stroke::new(1.0, ACCENT));
-            painter.circle(knob, 5.0, Color32::WHITE, Stroke::new(1.0, ACCENT));
-            if allow_interaction && hover_pos.is_some_and(|p| p.distance(knob) < 8.0) {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Grab);
-            }
-        }
-        let origin = ui.input(|i| i.pointer.press_origin());
-        if allow_interaction
-            && resp.drag_started()
-            && let Some(o) = origin
-            && o.distance(knob) < 8.0
-        {
-            if let Some(s) = view.image_selection.as_mut() {
-                s.drag = Some((o, None));
-                s.turning = true;
-            }
-        } else if allow_interaction
-            && resp.drag_started()
-            && let Some(o) = origin
-        {
-            let corner = corners.iter().position(|c| c.distance(o) < 8.0);
-            if corner.is_some() || image_contains(i, o) {
-                let opposite = corner.map(|k| corners[3 - k]);
-                if let Some(s) = view.image_selection.as_mut() {
-                    s.drag = Some((o, opposite));
-                }
-            }
-        }
-        if view.image_selection.as_ref().is_some_and(|s| s.turning) {
-            let shift = ui.input(|i| i.modifiers.shift);
-            let degrees = hover_pos.map_or(0.0, |p| turn_degrees(b.center(), p, shift));
-            // The turned outline as a preview; the engine redraws the pixels on release.
-            let centre = b.center();
-            let (sin, cos) = degrees.to_radians().sin_cos();
-            let turn = |c: Pos2| {
-                let v = c - centre;
-                centre + egui::vec2(v.x * cos - v.y * sin, v.x * sin + v.y * cos)
-            };
-            let outline = [b.left_top(), b.right_top(), b.right_bottom(), b.left_bottom()].map(turn).to_vec();
-            painter.add(egui::Shape::closed_line(outline, Stroke::new(1.5, ACCENT)));
-            let galley = painter.layout_no_wrap(format!("{degrees:.0}\u{b0}"), egui::FontId::proportional(12.0), ACCENT);
-            let label = Rect::from_center_size(turn(knob) - egui::vec2(0.0, 14.0), galley.size() + egui::vec2(8.0, 4.0));
-            painter.rect(label, CornerRadius::same(3), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
-            painter.galley(label.center() - galley.size() / 2.0, galley, ACCENT);
-            ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
-            if resp.drag_stopped() || !ui.input(|i| i.pointer.primary_down()) {
-                if let Some(s) = view.image_selection.as_mut() {
-                    s.drag = None;
-                    s.turning = false;
-                }
-                if degrees.abs() >= 0.05 {
-                    view.pending_edit =
-                        Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::RotateBy(f64::from(degrees)) });
-                }
-            }
-            return true;
-        }
-        if let Some((start, opposite)) = view.image_selection.as_ref().and_then(|s| s.drag)
-            && let Some(p) = hover_pos
-        {
-            let preview = match opposite {
-                // Resize from the opposite corner, keeping the aspect ratio.
-                Some(fixed) => {
-                    let (w0, h0) = (b.width().max(1.0), b.height().max(1.0));
-                    // Use the axis with the larger relative pointer change. Taking the maximum
-                    // absolute size freezes shrinking when the other axis hasn't moved. Measure
-                    // from the press point so grabbing a handle off-centre cannot cause a jump.
-                    let horizontal = (p.x - start.x) * (start.x - fixed.x).signum() / w0;
-                    let vertical = (p.y - start.y) * (start.y - fixed.y).signum() / h0;
-                    let delta = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
-                    let k = (1.0 + delta).max(0.05);
-                    let (w, h) = (w0 * k, h0 * k);
-                    let x = if start.x < fixed.x { fixed.x - w } else { fixed.x };
-                    let y = if start.y < fixed.y { fixed.y - h } else { fixed.y };
-                    Rect::from_min_size(Pos2::new(x, y), egui::vec2(w, h))
-                }
-                None => b.translate(p - start),
-            };
-            // Move/resize the full placement by the visible frame's change. The engine
-            // transforms an isolated crop together with its image, preserving its contents.
-            let raw = images.get(i).map_or(b, |im| xf.user_rect(info, page, im.rect.map(|v| v as f32)));
-            // A zero-width or zero-height visible frame (or a degenerate ratio) keeps the
-            // placement's scale instead of producing inf/NaN.
-            let ratio = |new: f32, old: f32| if old.abs() > 1e-3 && (new / old).is_finite() { new / old } else { 1.0 };
-            let factor = egui::vec2(ratio(preview.width(), b.width()), ratio(preview.height(), b.height()));
-            let target = Rect::from_min_max(preview.min + (raw.min - b.min) * factor, preview.min + (raw.max - b.min) * factor);
-            let visible = preview.intersect(xf.rect);
-            if visible.is_positive() {
-                // The pixels follow the frame: the page raster's picture of the image, stretched
-                // into the preview over a blank where it was. Re-rendering every frame of a drag
-                // would lag; the edit renders it properly on release.
-                if preview != b
-                    && let Some(tex) = view.page_raster(page)
-                {
-                    // Its pixels: where the whole-page raster has it.
-                    let source = left_at.filter(|_| raster_old).map_or(b, screen);
-                    let blank: Vec<Rect> = left_at.map(screen).into_iter().chain(std::iter::once(b)).collect();
-                    stretched_picture(painter, xf, tex, &blank, source, preview);
-                }
-                painter.rect_filled(visible, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
-                painter.rect_stroke(visible, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-                handles(preview);
-            }
-            if resp.drag_stopped() || !ui.input(|i| i.pointer.primary_down()) {
-                if let Some(s) = view.image_selection.as_mut() {
-                    s.drag = None;
-                    let norm = |r: Rect| {
-                        let ((u0, v0), (u1, v1)) = (xf.screen_to_norm(r.min), xf.screen_to_norm(r.max));
-                        Rect::from_two_pos(Pos2::new(u0, v0), Pos2::new(u1, v1))
-                    };
-                    s.settled = (preview != b).then(|| (left_at.unwrap_or_else(|| norm(b)), norm(preview)));
-                }
-                if preview != b {
-                    view.pending_edit =
-                        Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Move(user_box(xf, info, page, target)) });
-                }
-            }
-            ui.ctx().set_cursor_icon(match opposite {
-                Some(fixed) if (start.x - fixed.x) * (start.y - fixed.y) < 0.0 => egui::CursorIcon::ResizeNeSw,
-                Some(_) => egui::CursorIcon::ResizeNwSe,
-                None => egui::CursorIcon::Move,
-            });
-            return true;
-        }
-        if allow_interaction
-            && ui.input(|inp| inp.key_pressed(egui::Key::Delete) || inp.key_pressed(egui::Key::Backspace))
-            && !ui.ctx().egui_wants_keyboard_input()
-        {
-            view.image_selection = None;
-            view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Delete });
-            return true;
-        }
-    }
-    if !allow_interaction {
-        return false;
-    }
-    // An open menu stays drawn wherever the pointer is: most of its items lie outside the picture
-    // (a logo is smaller than its menu), and a menu that is not drawn for a frame cannot be clicked.
-    // Only a menu opened by a right-click on the picture: one opened over text or empty page while
-    // a picture stays selected is the page's own menu.
-    let menu_key = resp.id.with("image-menu");
-    if resp.secondary_clicked() {
-        ui.ctx().data_mut(|d| d.insert_temp(menu_key, false));
-    }
-    let mut menu_drawn = false;
-    if let Some(sel) = selected
-        && resp.context_menu_opened()
-        && ui.ctx().data(|d| d.get_temp::<bool>(menu_key)).unwrap_or(false)
-    {
-        resp.context_menu(|ui| image_menu(ui, page, sel, images, view, action));
-        menu_drawn = true;
-    }
-    let Some(p) = hover_pos.filter(|p| xf.rect.contains(*p)) else { return false };
-    let Some(hit) = boxes.iter().enumerate().rposition(|(i, b)| b.contains(p) && image_contains(i, p)) else { return false };
-    if selected != Some(hit) {
-        painter.rect_stroke(boxes[hit], CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
-    }
-    let Some(b) = boxes.get(hit).copied() else { return false };
-    let corner = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()].iter().position(|c| c.distance(p) < 8.0);
-    ui.ctx().set_cursor_icon(match (selected == Some(hit), corner) {
-        (true, Some(0 | 3)) => egui::CursorIcon::ResizeNwSe,
-        (true, Some(_)) => egui::CursorIcon::ResizeNeSw,
-        (true, None) => egui::CursorIcon::Move,
-        _ => egui::CursorIcon::PointingHand,
-    });
-    if resp.clicked() || resp.secondary_clicked() {
-        view.image_selection = Some(ImageSelection { page, index: hit, drag: None, crop: None, turning: false, settled: None });
-    }
-    if resp.secondary_clicked() {
-        ui.ctx().data_mut(|d| d.insert_temp(menu_key, true));
-    }
-    if selected == Some(hit) && !menu_drawn {
-        resp.context_menu(|ui| image_menu(ui, page, hit, images, view, action));
-    }
-    true
-}
-
-/// The right-click menu of the picture `hit` (its rotate, flip, replace, copy, cut, redact, link,
-/// recognize and delete items).
-fn image_menu(
-    ui: &mut egui::Ui,
-    page: usize,
-    hit: usize,
-    images: &[pdfcraft_engine::PageImage],
-    view: &mut DocView,
-    action: &mut Option<ImageAction>,
-) {
-    use pdfcraft_engine::ImageEdit as E;
-    let items: [(&str, Option<E>); 4] = [
-        (tl!("Rotate Clockwise"), Some(E::Rotate(1))),
-        (tl!("Rotate Counterclockwise"), Some(E::Rotate(3))),
-        (tl!("Flip Horizontal"), Some(E::Flip { horizontal: true })),
-        (tl!("Flip Vertical"), Some(E::Flip { horizontal: false })),
-    ];
-    for (label, change) in items {
-        if ui.button(label).clicked() {
-            view.pending_edit = change.map(|c| Edit::EditPageImage { page, index: hit, change: c });
-            ui.close();
-        }
-    }
-    // Crop: the handles trim instead of resizing until Done.
-    if ui.button(tl!("Crop Image")).clicked() {
-        if let (Some(s), Some(im)) = (view.image_selection.as_mut(), images.get(hit)) {
-            s.crop = Some(CropMode::new(im.visible_rect.unwrap_or(im.rect)));
-        }
-        ui.close();
-    }
-    let cropped = images.get(hit).is_some_and(|im| im.visible_rect.is_some_and(|v| v.iter().zip(im.rect.iter()).any(|(a, b)| (a - b).abs() > 0.01)));
-    if ui.add_enabled(cropped, egui::Button::new(tl!("Remove Crop"))).clicked() {
-        if let Some(im) = images.get(hit) {
-            view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Crop(im.rect) });
-        }
-        ui.close();
-    }
-    let raster = images.get(hit).is_some_and(|image| !image.is_form);
-    if ui.add_enabled(raster, egui::Button::new(tl!("Replace Image…"))).clicked() {
-        *action = Some(ImageAction::Replace(page, hit));
-        ui.close();
-    }
-    if ui.add_enabled(raster, egui::Button::new(tl!("Save Image As…"))).clicked() {
-        *action = Some(ImageAction::Save(page, hit));
-        ui.close();
-    }
-    // Cutting and copying also find the picture inside grouped Form artwork.
-    if ui.button(tl!("Cut Image")).clicked() {
-        *action = Some(ImageAction::Cut(page, hit));
-        ui.close();
-    }
-    if ui.button(tl!("Copy Image")).clicked() {
-        *action = Some(ImageAction::Copy(page, hit));
-        ui.close();
-    }
-    if ui.button(tl!("Copy Image in Original Format")).clicked() {
-        *action = Some(ImageAction::CopyFile(page, hit));
-        ui.close();
-    }
-    ui.separator();
-    if ui.button(tl!("Redact Image")).clicked() {
-        *action = Some(ImageAction::Redact(page, hit));
-        ui.close();
-    }
-    if ui.button(tl!("Create Link…")).clicked() {
-        *action = Some(ImageAction::Link(page, hit));
-        ui.close();
-    }
-    if ui.button(tl!("Recognize Text…")).clicked() {
-        *action = Some(ImageAction::Recognize(page));
-        ui.close();
-    }
-    ui.separator();
-    if ui.button(tl!("Delete")).clicked() {
-        view.image_selection = None;
-        view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Delete });
-        ui.close();
-    }
-}
-
-/// Open `block` on `page` in the inline editor. The box's geometry and source are read from the
-/// `lines` handed in, so callers pass the document's current inventory.
-#[allow(clippy::too_many_arguments)]
-fn open_editor(
-    ui: &egui::Ui,
-    xf: &PageXform,
-    doc: &pdfcraft_engine::Document,
-    lines: &[pdfcraft_engine::TextBlock],
-    boxes: &[Rect],
-    page: usize,
-    block: usize,
-    view: &mut DocView,
-) {
-    view.pending_text_open = None;
-    let (Some(l), Some(b)) = (lines.get(block), boxes.get(block)) else { return };
-    view.image_selection = None;
-    let source_lines = doc.text_lines(page);
-    let text = l.editor_text.clone();
-    // Screen pixels per point, from the box's width.
-    let scale = (b.width() - 4.0) / ((l.rect[2] - l.rect[0]).max(1.0) as f32);
-    // How far the editor box may grow: a single-line paragraph's rewrite grows to the
-    // page's right edge, a multi-line paragraph rewraps to its own width.
-    let right = xf.rect.right().min(view.viewport_rect().right()) - 6.0;
-    let max_width = if l.rows.len() == 1 { (right - b.left()).max(b.width()) } else { b.width() };
-    view.line_editor = Some(LineEditor {
-        selection: None,
-        font_resource: None,
-        page,
-        block,
-        text: text.clone(),
-        original: text,
-        rect: *b,
-        source_rect: l.rect.map(|v| v as f32),
-        multiline: l.rows.len() > 1,
-        source: Some((l.clone(), source_lines)),
-        fonts: install_source_fonts(ui.ctx(), doc, page),
-        overflow: false,
-        max_width,
-        size: (l.size as f32 * scale).clamp(8.0, 72.0),
-        focus: true,
-        look: look_of(l),
-        look0: look_of(l),
-        family_chosen: false,
-        extras: Extras::default(),
-        extras0: Extras::default(),
-    });
-}
-
-/// Lines and their screen boxes for a page; hover outlines, click opens the editor. Returns
-/// `true` when the pointer was used.
-#[allow(clippy::too_many_arguments)]
-pub(crate) fn page_input(
-    ui: &egui::Ui,
-    resp: &egui::Response,
-    xf: &PageXform,
-    page: usize,
-    doc: &pdfcraft_engine::Document,
-    lines: &[pdfcraft_engine::TextBlock],
-    view: &mut DocView,
-    allow_interaction: bool,
-) -> bool {
-    let info = &doc.info;
-    if view.block_drag.is_some_and(|d| d.generation != doc.edit_generation()) {
-        view.block_drag = None;
-        return true;
-    }
-    let boxes: Vec<Rect> = lines.iter().map(|l| paragraph_box(xf, info, page, l.rect)).collect();
-    // Outlines stay on their page, like its text (#3061).
-    let painter = ui.painter().with_clip_rect(ui.clip_rect().intersect(xf.rect.expand(1.0)));
-    let active = view.line_editor.as_ref().filter(|e| e.page == page).map(|e| e.block);
-    for (i, b) in boxes.iter().enumerate() {
-        if active != Some(i) {
-            painter.rect_stroke(*b, CornerRadius::same(2), Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
-        }
-    }
-    // A box a switching click asked for opens now, once the edit queued with that click has
-    // applied and `lines`/`boxes` are the document's new inventory (#2022).
-    if allow_interaction
-        && active.is_none()
-        && let Some((open_page, key)) = view.pending_text_open.clone()
-        && open_page == page
-    {
-        // The edit may have regrouped the page: open the paragraph that was clicked, wherever it
-        // is now, and none if it was merged into another (#2516).
-        match key.find(lines, 0) {
-            Some(block) => open_editor(ui, xf, doc, lines, &boxes, page, block, view),
-            None => view.pending_text_open = None,
-        }
-    }
-    if !allow_interaction {
-        return false;
-    }
-    let upright = has_edges(info, page);
-    let draw_handles = |b: Rect| {
-        for h in width_handles(b) {
-            painter.rect(h, CornerRadius::same(2), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
-        }
-    };
-    // A drag in progress: the box follows the pointer (or the grabbed edge does); releasing applies it.
-    if let Some(d) = view.block_drag.filter(|d| d.page == page)
-        && let (Some(b), Some(l)) = (boxes.get(d.block).copied(), lines.get(d.block))
-    {
-        let p = ui.input(|i| i.pointer.interact_pos()).unwrap_or(d.start);
-        let dx = p.x - d.start.x;
-        let preview = match d.grip {
-            Grip::Move => b.translate(p - d.start),
-            Grip::Left => Rect::from_min_max(Pos2::new((b.left() + dx).min(b.right() - 12.0), b.min.y), b.max),
-            Grip::Right => Rect::from_min_max(b.min, Pos2::new((b.right() + dx).max(b.left() + 12.0), b.max.y)),
-        };
-        painter.rect_stroke(preview, CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-        let resizing = d.grip != Grip::Move;
-        if resizing {
-            draw_handles(preview);
-        }
-        ui.ctx().set_cursor_icon(if resizing { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Move });
-        if resp.drag_stopped() || !ui.input(|i| i.pointer.any_down()) {
-            view.block_drag = None;
-            let (from, to) = (user_box(xf, info, page, b), user_box(xf, info, page, preview));
-            let edit = if resizing {
-                // The new width in user space: the box's change, added to the paragraph's own. A
-                // moved left side (in user space; on an upside-down page that's the screen's right
-                // edge) moves the paragraph with it.
-                let width = (l.rect[2] - l.rect[0]) + (to[2] - to[0]) - (from[2] - from[0]);
-                let shift = to[0] - from[0];
-                let style = pdfcraft_engine::BlockStyle { width: Some(width), offset: (shift != 0.0).then_some([shift, 0.0]), ..Default::default() };
-                Edit::EditTextBlock { page, block: d.block, text: l.text.clone(), style }
-            } else {
-                // Translation must keep the selected source operators. Rewriting unchanged text
-                // would also remove unrelated paragraphs that now overlap this one (#594).
-                Edit::MoveObjects {
-                    page,
-                    objects: vec![ObjectTarget { kind: ObjectKind::Text, index: d.block }],
-                    offset: [to[0] - from[0], to[1] - from[1]],
-                }
-            };
-            if preview != b {
-                view.pending_edit = Some(edit);
-            }
-        }
-        return true;
-    }
-    // Dragging a box (not while a paragraph is open for typing) moves it; from an edge, resizes it.
-    // What it grabs comes from where the button went down, not where the pointer is now: egui
-    // only calls it a drag once the pointer has moved a few pixels (or been held a moment), and a
-    // quick flick has left the edge by then.
-    if resp.drag_started()
-        && active.is_none()
-        && let Some(o) = ui.input(|i| i.pointer.press_origin())
-        && let Some((block, grip)) = grab_at(&boxes, o, upright)
-    {
-        view.block_drag = Some(BlockDrag { page, block, generation: doc.edit_generation(), start: o, grip });
-        return true;
-    }
-    let Some(p) = ui.input(|i| i.pointer.hover_pos()).filter(|p| xf.rect.contains(*p)) else { return false };
-    let Some((hit, grip)) = grab_at(&boxes, p, upright) else { return false };
-    if active != Some(hit) {
-        painter.rect_stroke(boxes[hit], CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-    }
-    let on_edge = active.is_none() && grip != Grip::Move;
-    if upright && active.is_none() {
-        draw_handles(boxes[hit]);
-    }
-    // A closed paragraph moves when dragged (the four-way arrow says so; a click still opens it
-    // for typing); an edge rewraps it. The open one takes the text cursor. Only where the page
-    // shows, so the mode bar and side panels over a paragraph scrolled under them keep their own
-    // cursor (#2755).
-    if resp.contains_pointer() {
-        ui.ctx().set_cursor_icon(if on_edge {
-            egui::CursorIcon::ResizeHorizontal
-        } else if active.is_none() {
-            egui::CursorIcon::Move
-        } else {
-            egui::CursorIcon::Text
-        });
-    }
-    if resp.clicked() {
-        view.image_selection = None;
-        // A click that moves the editor to another paragraph applies the open one first, so its
-        // typed text is not dropped with the switched-away editor (#2022). A click on the open
-        // box's own frame, which the editor's overlay does not cover, keeps it open instead.
-        if let Some(open) = view.line_editor.as_ref().filter(|e| e.has_changes()) {
-            if open.page == page && open.block == hit {
-                return true;
-            }
-            if let Some(old) = view.line_editor.take() {
-                let style = old.style();
-                if old.text != old.original || style != pdfcraft_engine::BlockStyle::default() {
-                    view.applied_editor = Some(old.clone());
-                    view.pending_edit = Some(Edit::EditTextBlock { page: old.page, block: old.block, text: old.text, style });
-                }
-            }
-            // The clicked box opens next frame, from the document with that edit applied.
-            view.pending_text_open = lines.get(hit).map(|l| (page, pdfcraft_engine::BlockKey::of(l)));
-            return true;
-        }
-        open_editor(ui, xf, doc, lines, &boxes, page, hit, view);
-    }
-    true
-}
-
-/// One TextEdit lays out all source runs; its caret and selection span the whole region.
-pub(crate) fn install_source_fonts(ctx: &egui::Context, doc: &pdfcraft_engine::Document, page: usize) -> BTreeMap<String, String> {
-    let programs = doc.text_editor_fonts(page);
-    let mut definitions = ctx.fonts(|f| f.definitions().clone());
-    // Only the current editor's document fonts live in the atlas. Never accumulate the
-    // programs of previously opened files or add them to the interface's default families.
-    definitions.font_data.retain(|name, _| !name.starts_with("pdf-source-"));
-    definitions.families.retain(|family, _| !matches!(family, FontFamily::Name(name) if name.starts_with("pdf-source-")));
-    let mut families = BTreeMap::new();
-    for (index, program) in programs.iter().enumerate() {
-        let name = format!("pdf-source-{index}");
-        definitions.font_data.insert(name.clone(), Arc::new(egui::FontData::from_owned(program.bytes.clone())));
-        families.insert(program.resource.clone(), name);
-    }
-    for program in &programs {
-        let Some(name) = families.get(&program.resource) else { continue };
-        // Word-created PDFs often split one face into several subsets. Use all of the
-        // document's matching subsets before falling back for newly inserted characters.
-        let mut stack = vec![name.clone()];
-        stack.extend(
-            programs
-                .iter()
-                .filter(|p| {
-                    pdfcraft_fonts::embedding::face_key(&p.face) == pdfcraft_fonts::embedding::face_key(&program.face)
-                        && p.resource != program.resource
-                })
-                .filter_map(|p| families.get(&p.resource).cloned()),
-        );
-        if let Some(fallback) = definitions.families.get(&FontFamily::Proportional) {
-            stack.extend(fallback.iter().cloned());
-        }
-        definitions.families.insert(FontFamily::Name(name.clone().into()), stack);
-    }
-    if !families.is_empty() {
-        ctx.set_fonts(definitions);
-    }
-    families
-}
-
-fn editor_job(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width: f32) -> egui::text::LayoutJob {
-    let mut job = egui::text::LayoutJob::default();
-    // An unchanged PDF row already has an authoritative line break. Do not rewrap it
-    // because font rounding or a fallback face measures a fraction of a pixel wider.
-    job.wrap.max_width = if text == ed.original && ed.look == ed.look0 && ed.extras == ed.extras0 { f32::INFINITY } else { width };
-    if let Some((block, lines)) = &ed.source {
-        let lefts: Vec<_> = block.rows.iter().filter_map(|r| r.first().and_then(|i| lines.get(*i)).map(|l| l.rect[0])).collect();
-        let left_span = lefts.iter().copied().fold(f64::NEG_INFINITY, f64::max) - lefts.iter().copied().fold(f64::INFINITY, f64::min);
-        let centered = block.rows.len() > 1
-            && left_span > block.size * 0.5
-            && block.rows.iter().all(|row| {
-                let rect = row
-                    .iter()
-                    .filter_map(|i| lines.get(*i))
-                    .map(|l| l.rect)
-                    .reduce(|a, b| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]);
-                rect.is_some_and(|r| ((r[0] + r[2] - block.rect[0] - block.rect[2]) / 2.0).abs() < block.size)
-            });
-        if centered {
-            job.halign = egui::Align::Center;
-        }
-        for (range, index) in block.edited_spans(text) {
-            let Some(line) = lines.get(index) else { continue };
-            let mut look = source_look(&line.base_font, line.size, line.color, line.bold, line.italic);
-            look.size = line.size;
-            if ed.look.family != ed.look0.family || ed.family_chosen {
-                look.family = ed.look.family;
-            }
-            if ed.look.bold != ed.look0.bold {
-                look.bold = ed.look.bold;
-            }
-            if ed.look.italic != ed.look0.italic {
-                look.italic = ed.look.italic;
-            }
-            if ed.look.color != ed.look0.color {
-                look.color = ed.look.color;
-            }
-            if ed.look.size != ed.look0.size {
-                look.size = ed.look.size;
-            }
-            let mut font = editor_font(&look, (look.size as f32 * scale).clamp(1.0, 300.0));
-            let original_face =
-                ed.look.family == ed.look0.family && !ed.family_chosen && ed.look.bold == ed.look0.bold && ed.look.italic == ed.look0.italic;
-            let embedded = original_face && ed.fonts.contains_key(&line.font);
-            if embedded && let Some(name) = ed.fonts.get(&line.font) {
-                font.family = FontFamily::Name(name.clone().into());
-            }
-            let native_width = ui.fonts_mut(|f| f.layout_no_wrap(line.text.clone(), font.clone(), Color32::BLACK).size().x);
-            let target_width = ((line.rect[2] - line.rect[0]) * look.size / line.size.max(0.01)) as f32 * scale;
-            let spacing = if original_face { (target_width - native_width) / line.text.chars().count().saturating_sub(1).max(1) as f32 } else { 0.0 };
-            job.append(
-                text.get(range).unwrap_or_default(),
-                0.0,
-                egui::TextFormat {
-                    font_id: font,
-                    extra_letter_spacing: spacing + ed.extras.char_spacing as f32 * scale,
-                    color: color32(look.color),
-                    italics: look.italic && !embedded,
-                    ..Default::default()
-                },
-            );
-        }
-    } else {
-        job.append(
-            text,
-            0.0,
-            egui::TextFormat {
-                font_id: editor_font(&ed.look, ed.size),
-                color: color32(ed.look.color),
-                italics: ed.look.italic,
-                ..Default::default()
-            },
-        );
-    }
-    job
-}
-
-/// `galley` drawn in no colour: its rows still place the caret and the selection.
-fn unseen(mut galley: Arc<egui::Galley>) -> Arc<egui::Galley> {
-    for placed in &mut Arc::make_mut(&mut galley).rows {
-        for vertex in &mut Arc::make_mut(&mut placed.row).visuals.mesh.vertices {
-            vertex.color = Color32::TRANSPARENT;
-        }
-    }
-    galley
-}
-
-/// Align the editable galley's baselines to the source rows instead of egui's interface
-/// leading. Glyphs, meshes, caret and selection receive the same transform.
-fn editor_galley(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width: f32) -> Arc<egui::Galley> {
-    let mut job = editor_job(ui, ed, text, scale, width);
-    let centered = job.halign == egui::Align::Center;
-    job.halign = egui::Align::LEFT;
-    let mut galley = ui.fonts_mut(|fonts| fonts.layout_job(job));
-    let Some((block, lines)) = &ed.source else { return galley };
-    let sources: Vec<_> = block
-        .rows
-        .iter()
-        .filter_map(|row| {
-            let first = row.first().and_then(|i| lines.get(*i))?;
-            let rect = row
-                .iter()
-                .filter_map(|i| lines.get(*i))
-                .map(|l| l.rect)
-                .reduce(|a, b| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])])?;
-            Some((first.baseline()[1], rect))
-        })
-        .collect();
-    let Some((first_baseline, first_rect)) = sources.first().copied() else { return galley };
-    let leading = if ed.extras.line_spacing > 0.0 {
-        ed.extras.line_spacing * ed.look.size
-    } else {
-        let fallback = if block.lines.len() == 1 && !text.contains('\n') {
-            block.lines.first().and_then(|i| lines.get(*i)).map_or(block.size * 1.2, |line| line.wrap_leading())
-        } else {
-            block.size * 1.5
-        };
-        sources.windows(2).map(|r| (r[0].0 - r[1].0).abs()).rfind(|v| *v > 0.0).unwrap_or(fallback)
-    };
-    let g = Arc::make_mut(&mut galley);
-    let mut bounds = Rect::NOTHING;
-    let mut meshes = Rect::NOTHING;
-    for (index, placed) in g.rows.iter_mut().enumerate() {
-        let (last_baseline, last_rect) = sources.last().copied().unwrap_or((first_baseline, first_rect));
-        let (baseline, source_rect) = sources
-            .get(index)
-            .copied()
-            .unwrap_or((last_baseline - index.saturating_add(1).saturating_sub(sources.len()) as f64 * leading, last_rect));
-        let changed_size = ed.look.size != ed.look0.size;
-        let ratio = if changed_size { ed.look.size / ed.look0.size.max(0.01) } else { 1.0 };
-        let ascent = (source_rect[3] - sources.get(index).map_or(last_baseline, |s| s.0)) as f32 * scale * ratio as f32;
-        let descent = (sources.get(index).map_or(last_baseline, |s| s.0) - source_rect[1]) as f32 * scale * ratio as f32;
-        let base_y = (block.rect[3] - baseline) as f32 * scale;
-        let row = Arc::make_mut(&mut placed.row);
-        placed.pos.y = base_y - ascent;
-        placed.pos.x = if centered { (width - row.size.x) / 2.0 } else { (source_rect[0] - block.rect[0]) as f32 * scale };
-        for glyph in &mut row.glyphs {
-            let dy = ascent - glyph.pos.y;
-            glyph.pos.y = ascent;
-            glyph.font_ascent = ascent;
-            glyph.font_height = ascent + descent;
-            glyph.line_height = ascent + descent;
-            if !glyph.uv_rect.is_nothing() {
-                for vertex in row.visuals.mesh.vertices.iter_mut().skip(glyph.first_vertex as usize).take(4) {
-                    vertex.pos.y += dy;
-                }
-            }
-        }
-        row.size.y = (ascent + descent).max(1.0);
-        row.visuals.mesh_bounds = row.visuals.mesh.vertices.iter().fold(Rect::NOTHING, |r, v| r.union(Rect::from_min_max(v.pos, v.pos)));
-        bounds = bounds.union(Rect::from_min_size(placed.pos, row.size));
-        meshes = meshes.union(row.visuals.mesh_bounds.translate(placed.pos.to_vec2()));
-    }
-    g.rect = Rect::from_min_max(egui::Pos2::ZERO, egui::pos2(bounds.right().max(0.0), bounds.bottom().max(0.0)));
-    g.mesh_bounds = meshes;
-    galley
-}
-
-/// The inline editor; returns the edit once the text is applied.
-pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -> Option<Edit> {
-    // Clicks outside the document (the Format text panel) keep the paragraph open.
-    let outside = ctx.input(|i| i.pointer.latest_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
-    let page = view.line_editor.as_ref()?.page;
-    let xf = view.page_xform(page)?;
-    let hold = view.objects.hold_editor;
-    // An OCR word is invisible text over a scan: the textless background still shows the scanned
-    // word, so the editor covers it, as the applied edit will.
-    let background_ready = view
-        .line_editor
-        .as_ref()
-        .is_some_and(|ed| view.text_background.ready(ed.page, ed.block) && !ed.source.as_ref().is_some_and(|(b, _)| b.invisible));
-    // The measured extent of this paragraph's draft: a click straight from another paragraph
-    // opens this one after the frame's measuring, which was the other one's.
-    let draft_rect = view
-        .line_editor
-        .as_ref()
-        .and_then(|ed| view.text_background.draft_rect_for(ed.page, ed.block))
-        .map(|r| xf.user_rect(info, page, r.map(|v| v as f32)));
-    // The editor draws on its page only, as the page itself does: a paragraph running past the
-    // page's edge (a converter relying on the page clip) must not cover the next page or the
-    // tool bars (#3061).
-    let viewport = view.viewport_rect();
-    let page_clip = xf.rect.intersect(viewport);
-    let ed = view.line_editor.as_mut()?;
-    if hold {
-        ed.focus = true;
-    }
-    // Reproject the source box every frame. The page may have been zoomed, scrolled or rotated
-    // while the format panel was open.
-    // A font definition becomes active at the start of the next egui pass. Keep the source
-    // raster visible until then instead of flashing an unrelated interface face.
-    if !ctx.fonts(|f| ed.fonts.values().all(|name| f.definitions().families.contains_key(&FontFamily::Name(name.clone().into())))) {
-        ctx.request_repaint();
-        return None;
-    }
-    ed.rect = xf.user_rect(info, ed.page, ed.source_rect);
-    ed.max_width = ed.rect.width();
-    let scale = (ed.rect.width() / (ed.source_rect[2] - ed.source_rect[0]).abs().max(0.01)).max(0.01);
-    ed.size = (ed.look.size as f32 * scale).clamp(1.0, 300.0);
-    // egui draws the caret at least one row of this font tall. Each row already has its source
-    // row's height, so the font stays below every row (half the region's smallest size): on a
-    // 12 pt row under a 24 pt title the caret is as tall as the row, not the title.
-    let smallest =
-        ed.source.as_ref().and_then(|(block, lines)| block.lines.iter().filter_map(|i| lines.get(*i)).map(|l| l.size as f32).reduce(f32::min));
-    let font = editor_font(&ed.look, smallest.map_or(ed.size, |s| (s * scale * 0.5).clamp(1.0, 300.0).min(ed.size)));
-    let text_color = color32(ed.look.color);
-    let block = ed.block;
-    let mut done = None;
-    let mut reveal = false;
-    let mut look = None;
-    // No fade-in: while it faded, the page's own copy of the text showed through the cover.
-    // Over the page, so only where the document shows: a paragraph scrolled under the mode bar or
-    // a side panel must leave them their pointer (#2755). It stays at its paragraph, cut off as
-    // the page is, rather than pushed back into the window.
-    egui::Area::new(egui::Id::new("edit-text-line"))
-        .order(egui::Order::Foreground)
-        .fade_in(false)
-        .fixed_pos(Pos2::new(ed.rect.left(), ed.rect.top()))
-        .constrain_to(viewport)
-        .constrain(false)
-        .show(ctx, |ui| {
-            ui.set_clip_rect(ui.clip_rect().intersect(page_clip));
-            // The editor opens at the source size. Once text changes, show the real draft
-            // extent: single rows grow toward the page edge, paragraphs rewrap at their
-            // source width, and the visible frame grows/shrinks vertically with their rows.
-            // An OCR phrase (several stretched words on one scanned line) also grows rightwards.
-            let single_run = ed.source.as_ref().is_some_and(|(block, _)| block.rows.len() == 1 || block.invisible);
-            let width = if !ed.multiline && single_run && !ed.text.contains('\n') && ed.has_changes() {
-                let job = editor_job(ui, ed, &ed.text, scale, f32::INFINITY);
-                let natural = ui.fonts_mut(|f| f.layout_job(job)).size().x;
-                natural.max(ed.size * 0.4).min((xf.rect.right() - ed.rect.left() - 36.0 * scale).max(ed.rect.width()))
-            } else {
-                ed.rect.width().max(1.0)
-            };
-            ui.set_width(width);
-            let measured = editor_galley(ui, ed, &ed.text, scale, width);
-            ed.overflow = ed.has_changes() && (measured.rect.width() > ed.rect.width() + 1.5 || measured.rect.height() > ed.rect.height() + 1.5);
-            let visible = Rect::from_min_size(ed.rect.min, measured.rect.size().max(egui::vec2(1.0, 1.0)));
-            // Unsupported source programs use an interface fallback whose glyph advances
-            // can differ from the PDF's. Keep every visible row inside the growing frame.
-            let live = draft_rect.map_or(visible, |bounds| bounds.union(visible));
-            ui.painter().rect_stroke(live.expand(2.0), CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-            // On the frame, a press takes hold of the box (a click selects it, a drag moves it):
-            // the pointer says so there, and reads as text inside.
-            if let Some(p) = ui.input(|i| i.pointer.hover_pos())
-                && ui.clip_rect().contains(p)
-                && live.expand(2.0 + FRAME_REACH).contains(p)
-                && !live.expand(2.0).contains(p)
-            {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Move);
-            }
-            // White, unless the text is too pale to read on white (white text from a coloured
-            // banner, #913): then a dark box, with a caret that shows on it.
-            let fill = if background_ready { Color32::TRANSPARENT } else { editor_fill(text_color) };
-            // An unchanged paragraph is the page's own text: the editor draws only its frame and
-            // caret over it. Once it changes, the textless page goes under the editor's text or,
-            // until that background is ready, a cover over the entire source box, including lines
-            // the draft no longer occupies. Shrinking the text must never expose a copy. Both are
-            // decided after this frame's typing, in places kept under the editor's text.
-            let cover = ui.painter().add(egui::Shape::Noop);
-            let unchanged = !ed.has_changes();
-            egui::Frame::NONE.show(ui, |ui| {
-                // A textless PDF preview, or the page itself, keeps its real background through
-                // the transparent editor. The temporary opaque cover uses the shared caret-contrast rule.
-                ui.visuals_mut().text_cursor.stroke.color = if background_ready || unchanged {
-                    if luminance(text_color) < 0.5 { Color32::BLACK } else { Color32::WHITE }
-                } else {
-                    caret_color_on(fill)
-                };
-                let rows = 1;
-                let snapshot = ed.clone();
-                let mut layouter = |ui: &egui::Ui, text: &dyn egui::TextBuffer, wrap_width: f32| {
-                    let galley = editor_galley(ui, &snapshot, text.as_str(), scale, wrap_width);
-                    if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
-                };
-                let output = egui::TextEdit::multiline(&mut ed.text)
-                    .id(egui::Id::new("edit-text-line-input"))
-                    .font(font.clone())
-                    .margin(egui::Margin::ZERO)
-                    .layouter(&mut layouter)
-                    .text_color(text_color)
-                    .frame(egui::Frame::NONE)
-                    .desired_width(width)
-                    .desired_rows(rows)
-                    .show(ui);
-                if ed.has_changes() {
-                    if background_ready {
-                        reveal = true;
-                    } else {
-                        ui.painter().set(cover, egui::Shape::rect_filled(ed.rect.expand(1.0).union(output.response.rect), CornerRadius::ZERO, fill));
-                    }
-                }
-                look = Some((Arc::clone(&output.galley), output.galley_pos));
-                if let Some(cursor) = output.cursor_range {
-                    let selected = cursor.as_sorted_char_range();
-                    let byte = |index| ed.text.char_indices().nth(index).map_or(ed.text.len(), |(at, _)| at);
-                    ed.selection = (!selected.is_empty()).then(|| byte(selected.start.into())..byte(selected.end.into()));
-                }
-                let r = output.response;
-                if r.changed() {
-                    // The next pass measures the updated draft with the Apply/Save rewrite.
-                    ctx.request_repaint();
-                }
-                if ed.focus {
-                    r.request_focus();
-                    ed.focus = false;
-                }
-                let esc = ui.input(|i| i.key_pressed(egui::Key::Escape));
-                let apply = ui.input(|i| i.key_pressed(egui::Key::Enter) && i.modifiers.command);
-                if esc {
-                    done = Some(false);
-                } else if apply || (r.lost_focus() && !outside && !hold) {
-                    done = Some(true);
-                }
-            });
-        });
-    if reveal {
-        view.text_background.reveal();
-    }
-    if let Some((galley, pos)) = look {
-        view.text_background.remember(&xf, page, block, galley, pos, text_color);
-    }
-    match done {
-        Some(apply) => {
-            let ed = view.line_editor.take()?;
-            if !apply {
-                return None;
-            }
-            view.applied_editor = Some(ed.clone());
-            finished_edit(ed)
-        }
-        None => None,
-    }
-}
-
-/// The edit a closed paragraph editor applies, or `None` when nothing in it changed.
-pub(crate) fn finished_edit(ed: LineEditor) -> Option<Edit> {
-    let style = ed.style();
-    (ed.text != ed.original || style != pdfcraft_engine::BlockStyle::default()).then_some(Edit::EditTextBlock {
-        page: ed.page,
-        block: ed.block,
-        text: ed.text,
-        style,
-    })
-}
-
-/// Caret colour that stays visible on a field filled with `fill`: black on light fills, white on dark ones.
-pub(crate) fn caret_color_on(fill: Color32) -> Color32 {
-    let luma = 299 * u32::from(fill.r()) + 587 * u32::from(fill.g()) + 114 * u32::from(fill.b());
-    if luma > 127_500 { Color32::BLACK } else { Color32::WHITE }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_rotate_knob_moves_below_when_there_is_no_room_above() {
-        let view = Rect::from_min_max(Pos2::new(0.0, 100.0), Pos2::new(500.0, 500.0));
-        let roomy = Rect::from_min_max(Pos2::new(100.0, 200.0), Pos2::new(200.0, 250.0));
-        assert_eq!(rotate_knob(roomy, view).0, Pos2::new(150.0, 178.0));
-        let at_top = Rect::from_min_max(Pos2::new(100.0, 100.0), Pos2::new(200.0, 150.0));
-        let (knob, stem) = rotate_knob(at_top, view);
-        assert_eq!((knob, stem), (Pos2::new(150.0, 172.0), Pos2::new(150.0, 150.0)));
-    }
-
-    #[test]
-    fn the_rotate_knob_measures_clockwise_degrees_from_straight_up() {
-        let c = Pos2::new(100.0, 100.0);
-        let at = |x: f32, y: f32| turn_degrees(c, Pos2::new(x, y), false);
-        assert!(at(100.0, 0.0).abs() < 1e-3);
-        assert!((at(200.0, 100.0) - 90.0).abs() < 1e-3, "right is a clockwise quarter");
-        assert!((at(0.0, 100.0) + 90.0).abs() < 1e-3);
-        assert!((at(100.0, 200.0).abs() - 180.0).abs() < 1e-3);
-        // Shift rounds to 15 degrees; the centre and non-finite points turn nothing.
-        assert_eq!(turn_degrees(c, Pos2::new(180.0, 50.0), true) % 15.0, 0.0);
-        assert_eq!(at(101.0, 101.0), 0.0);
-        assert_eq!(at(f32::NAN, 5.0), 0.0);
-    }
-
-    /// An app with one text document open, and an editor on its first paragraph.
-    fn preview_app() -> (crate::PdfCraftApp, LineEditor) {
-        let mut app = crate::PdfCraftApp::new();
-        let bytes = app.session.create_from_text("Preview", "Preview text").unwrap();
-        app.open_bytes("preview.pdf", None, bytes.as_ref().clone()).unwrap();
-        let doc = app.session.get(app.views[0].id).unwrap();
-        let block = doc.text_blocks(0).remove(0);
-        let ed = LineEditor {
-            selection: None,
-            font_resource: None,
-            page: 0,
-            block: 0,
-            text: block.text.clone(),
-            original: block.text.clone(),
-            rect: Rect::NOTHING,
-            source_rect: block.rect.map(|v| v as f32),
-            multiline: block.rows.len() > 1,
-            source: None,
-            fonts: BTreeMap::new(),
-            overflow: false,
-            max_width: 400.0,
-            size: block.size as f32,
-            focus: true,
-            look: look_of(&block),
-            look0: look_of(&block),
-            family_chosen: false,
-            extras: Extras::default(),
-            extras0: Extras::default(),
-        };
-        (app, ed)
-    }
-
-    #[test]
-    fn picking_the_family_the_font_name_reads_as_still_changes_the_font() {
-        // A Calibri paragraph reads as Helvetica; picking Helvetica from the list used to leave
-        // `look` equal to what the paragraph had, so no family change was sent and Calibri stayed.
-        let (_app, mut ed) = preview_app();
-        let family = ed.look0.family;
-        assert_eq!(ed.style().family, None, "nothing chosen yet");
-        ed.choose_family(family);
-        assert_eq!(ed.style().family, Some((family, ed.look.bold, ed.look.italic)));
-        assert!(ed.has_changes());
-        assert_eq!(ed.font_shown(&[]), family.label());
-        ed.keep_source_font();
-        assert_eq!(ed.style().family, None, "Keep source fonts withdraws the choice");
-        ed.choose_family(family);
-        ed.applied();
-        assert_eq!(ed.style().family, None, "an applied choice is the paragraph's font now");
-    }
-
-    #[test]
-    fn a_loaded_font_is_applied_to_the_paragraph_being_edited() {
-        // Loading a font used to only register it on the page: the paragraph kept its source
-        // face until the font was found again in the document-font menu (#2591).
-        let (mut app, ed) = preview_app();
-        app.views[0].line_editor = Some(ed);
-        let inter = include_bytes!("../../../assets/fonts/Inter-Regular.ttf").to_vec();
-        app.use_files(crate::files::FilePurpose::TextFont { page: 0 }, vec![("Inter-Regular.ttf".into(), inter)]);
-        let doc = app.session.get(app.views[0].id).unwrap();
-        let lines = doc.text_lines(0);
-        assert_eq!(lines.iter().map(|l| l.text.as_str()).collect::<String>(), "Preview text");
-        assert!(lines.iter().all(|l| l.base_font == "Inter-Regular"), "{:?}", lines.iter().map(|l| &l.base_font).collect::<Vec<_>>());
-        assert!(app.views[0].line_editor.is_some(), "the paragraph stays open for editing");
-    }
-
-    #[test]
-    fn save_applies_the_paragraph_open_in_the_editor() {
-        // Save wrote the file without the paragraph still open in the editor (#3496).
-        let (mut app, mut ed) = preview_app();
-        ed.text = "Text preview".into();
-        app.views[0].line_editor = Some(ed);
-        let dir = std::env::temp_dir().join(format!("pdfcraft-ui-open-paragraph-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        app.save_override = Some(dir.join("out.pdf").to_string_lossy().into_owned());
-
-        assert!(app.save_active(crate::SaveTarget::InPlace));
-        assert!(app.views[0].line_editor.is_none());
-        let doc = app.session.get(app.views[0].id).unwrap();
-        assert_eq!(doc.text_lines(0).iter().map(|l| l.text.as_str()).collect::<String>(), "Text preview");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn a_refused_text_box_does_not_lose_the_open_paragraph() {
-        let (mut app, mut ed) = preview_app();
-        ed.text = "Text preview".into();
-        app.views[0].line_editor = Some(ed);
-        let draft = crate::content_ui::TextDraft {
-            page: 9,
-            index: None,
-            rect: [20.0, 20.0, 120.0, 40.0],
-            text: "Typed text".into(),
-            style: crate::content_ui::default_style(),
-            focus: true,
-        };
-        app.views[0].content.draft = Some(draft.clone());
-
-        assert!(!app.commit_typing_in(app.views[0].id));
-        assert_eq!(app.views[0].content.draft, Some(draft), "the refused text box stays open");
-        assert!(app.views[0].line_editor.is_none(), "the paragraph was applied");
-        let doc = app.session.get(app.views[0].id).unwrap();
-        assert_eq!(doc.text_lines(0).iter().map(|l| l.text.as_str()).collect::<String>(), "Text preview");
-    }
-
-    #[test]
-    fn a_refused_paragraph_stays_open_with_its_text() {
-        let (mut app, mut ed) = preview_app();
-        ed.text = "Text preview".into();
-        ed.page = 9;
-        app.views[0].line_editor = Some(ed.clone());
-
-        assert!(!app.commit_typing_in(app.views[0].id));
-        assert_eq!(app.views[0].line_editor, Some(ed), "the paragraph keeps its unsaved text");
-    }
-
-    #[test]
-    fn text_background_is_cached_without_editing_and_released_on_cancel() {
-        let (app, ed) = preview_app();
-        let doc = app.session.get(app.views[0].id).unwrap();
-        let source = doc.bytes.clone();
-        let generation = doc.edit_generation();
-        let ctx = egui::Context::default();
-        let mut background = TextBackground::default();
-        for _ in 0..100 {
-            background.prepare(&ctx, doc, Some(&ed), None, 1.0);
-            if background.ready(0, 0) {
-                break;
-            }
-            std::thread::sleep(std::time::Duration::from_millis(5));
-        }
-        assert!(background.ready(0, 0));
-        assert!(!background.pending());
-        let texture = background.texture.as_ref().unwrap().id();
-        background.prepare(&ctx, doc, Some(&ed), None, 1.0);
-        assert_eq!(background.texture.as_ref().unwrap().id(), texture);
-        assert_eq!(doc.bytes, source);
-        assert_eq!(doc.edit_generation(), generation);
-        assert!(!doc.dirty && doc.can_undo().is_none());
-        background.prepare(&ctx, doc, None, None, 1.0);
-        assert!(background.texture.is_none() && background.renderer.is_none());
-    }
-
-    #[test]
-    fn the_editing_background_stays_sharp_on_a_zoomed_page() {
-        // While a paragraph is open, the page around it is drawn from this one raster: it is
-        // asked for at the tiling threshold, not the 2048-pixel backdrop side, which went soft
-        // beyond about 1.2x on a Retina display.
-        let (app, ed) = preview_app();
-        let doc = app.session.get(app.views[0].id).unwrap();
-        let page = &doc.info.pages[0];
-        let ctx = egui::Context::default();
-        ctx.begin_pass(egui::RawInput { max_texture_side: Some(16384), ..Default::default() });
-        let mut background = TextBackground::default();
-        background.prepare(&ctx, doc, Some(&ed), None, 8.0);
-        let expected = 8.0f32.min(crate::canvas::TILE_THRESHOLD / page.width.max(page.height));
-        assert!(expected > crate::canvas::BASE_SIDE / page.width.max(page.height), "the test page needs the larger side");
-        assert_eq!(background.tag, Some((expected * 1000.0) as u64));
-        // A GPU that can't hold such a texture caps it.
-        ctx.end_pass().textures_delta.clear();
-        ctx.begin_pass(egui::RawInput { max_texture_side: Some(2048), ..Default::default() });
-        let mut small = TextBackground::default();
-        small.prepare(&ctx, doc, Some(&ed), None, 8.0);
-        assert_eq!(small.tag, Some(((2048.0 / page.width.max(page.height)) * 1000.0) as u64));
-        ctx.end_pass().textures_delta.clear();
-    }
-
-    #[test]
-    fn pale_text_is_edited_on_a_dark_box() {
-        // #913: white text from a coloured banner was typed onto a white box and vanished.
-        for pale in [Color32::WHITE, Color32::from_rgb(0xFF, 0xFF, 0x00), Color32::from_gray(0xE0), Color32::from_rgb(0xFF, 0xA5, 0x00)] {
-            assert_eq!(editor_fill(pale), DARK_EDITOR_FILL, "{pale:?}");
-            assert!(contrast(pale, editor_fill(pale)) >= 4.5, "{pale:?} is readable");
-        }
-        // Ordinary dark or saturated text keeps the white box.
-        for dark in [Color32::BLACK, Color32::from_rgb(0x1F, 0x2A, 0x6B), Color32::from_rgb(0xC0, 0x00, 0x00), Color32::from_gray(0x60)] {
-            assert_eq!(editor_fill(dark), Color32::WHITE, "{dark:?}");
-        }
-    }
-
-    #[test]
-    fn caret_contrasts_with_its_fill() {
-        assert_eq!(caret_color_on(Color32::WHITE), Color32::BLACK);
-        assert_eq!(caret_color_on(Color32::from_rgb(0xFF, 0xFF, 0xF4)), Color32::BLACK);
-        assert_eq!(caret_color_on(Color32::BLACK), Color32::WHITE);
-        assert_eq!(caret_color_on(DARK_EDITOR_FILL), Color32::WHITE);
-    }
-}
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 7ed6e07959..ba2d3cbf96 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -6,36 +6,25 @@ use pdfcraft_platform::staging::{StagingName, staging_suffixes};
 
 use crate::PdfCraftApp;
 
-/// What the user was doing when we asked whether to save.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum CloseRequest {
-    /// Close this document's tab. By id, not tab index: tabs can close and shift while a save
-    /// panel is open.
-    Tab(pdfcraft_engine::DocId),
-    /// Quit the application once every dirty document is resolved.
-    Quit,
-    /// File ▸ Close all: like Quit, but the application stays open.
-    All,
-}
+mod close;
+mod save;
 
-/// A save held back by [`Dialog::OverwriteChanged`](crate::Dialog::OverwriteChanged): the file
-/// on disk is another version than the document came from (#2166).
+pub use close::CloseRequest;
 #[cfg(not(target_arch = "wasm32"))]
-pub struct PendingOverwrite {
-    pub id: pdfcraft_engine::DocId,
-    pub dest: String,
-    target: SaveTarget,
-    /// What was to run once the document is written (close its tab, quit).
-    after: Box<dyn FnOnce(&mut PdfCraftApp) + Send>,
-}
+pub use save::PendingOverwrite;
+#[cfg(target_arch = "wasm32")]
+pub(crate) use save::download;
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) use save::in_document_folder;
+pub use save::{SaveTarget, write_atomically};
+#[cfg(test)]
+pub(crate) use save::{is_mail_temp_copy, save_dialog_folder};
+#[cfg(test)]
+use save::{write_atomically_syncing, write_atomically_with};
 
-/// Where Save writes.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum SaveTarget {
-    /// The file's own path; asks for one if the document has none (e.g. opened from bytes).
-    InPlace,
-    /// Always ask for a new location.
-    As,
+/// Text typed into a new text box that isn't added to the page yet.
+fn new_text_typed(v: &crate::DocView) -> bool {
+    v.content.draft.as_ref().is_some_and(|d| d.index.is_none() && !d.text.trim().is_empty())
 }
 
 impl PdfCraftApp {
@@ -155,7 +144,7 @@ impl PdfCraftApp {
                     }
                     Edit::AddAnnotation(a) => {
                         // Select the new comment (appended last among the page's comments).
-                        let newest = info.annotations.iter().filter(|x| x.page == a.page && x.in_reply_to.is_none()).map(|x| x.index).max();
+                        let newest = info.annotations.iter().filter(|x| x.page == a.page && !x.is_reply()).map(|x| x.index).max();
                         view.comments.selected = newest.map(|n| (a.page, n));
                         view.comments.reveal = true;
                         // A new highlight opens its note for typing straight away, as in Acrobat,
@@ -493,7 +482,7 @@ impl PdfCraftApp {
                 && committed.as_ref().is_some_and(|draft| draft.name == focus.name)
                 && let Some(field) = self.session.get(view.id).and_then(|doc| doc.form.iter().find(|field| field.name == focus.name))
             {
-                focus.text = field.value.first().cloned().unwrap_or_default();
+                focus.text = crate::forms_ui::draft_text(field);
                 focus.picked = field.value.clone();
             }
             if let Some(page) = signature_page
@@ -504,7 +493,7 @@ impl PdfCraftApp {
                 let newest = self
                     .session
                     .get(view.id)
-                    .and_then(|d| d.info.annotations.iter().filter(|a| a.page == page && a.in_reply_to.is_none()).map(|a| a.index).max());
+                    .and_then(|d| d.info.annotations.iter().filter(|a| a.page == page && !a.is_reply()).map(|a| a.index).max());
                 view.comments.selected = newest.map(|index| (page, index));
                 view.comments.reveal = true;
                 self.quick_tool = crate::QuickTool::Select;
@@ -636,394 +625,9 @@ impl PdfCraftApp {
             || v.content.blocked().is_some()
             || v.forms.focus.as_ref().is_some_and(|f| crate::forms_ui::draft_edit(f, &doc.form).is_some())
             || v.fill_text.as_ref().is_some_and(|t| !t.text.trim().is_empty())
+            || new_text_typed(v)
             || v.line_editor.as_ref().map_or_else(|| false, |ed| ed.has_unsaved_text())
     }
-
-    /// Save the active document. Returns `true` if it was written.
-    pub fn save_active(&mut self, target: SaveTarget) -> bool {
-        match self.active {
-            Some(i) => self.save_view(i, target),
-            None => false,
-        }
-    }
-
-    /// Save the document shown in tab `index`. Returns `true` if it was written now. When it has
-    /// to ask where (a new document, or Save As) it returns `false` and saves on a later frame,
-    /// once the user has chosen.
-    pub fn save_view(&mut self, index: usize, target: SaveTarget) -> bool {
-        self.save_then(index, target, |_| {})
-    }
-
-    /// [`Self::save_view`], then `after` once the document is written: now, or on a later frame
-    /// when the user had to choose where. `after` never runs when the save fails or is cancelled.
-    pub(crate) fn save_then(&mut self, index: usize, target: SaveTarget, after: impl FnOnce(&mut Self) + Send + 'static) -> bool {
-        // What's typed in a field is part of what's saved (#166).
-        if let Some(id) = self.views.get(index).map(|v| v.id)
-            && !self.commit_typing_in(id)
-        {
-            return false;
-        }
-        let Some(id) = self.views.get(index).map(|v| v.id) else { return false };
-        let Some(doc) = self.session.get(id) else { return false };
-        let (name, path) = (doc.name.clone(), doc.path.clone());
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            let doc_path = path.clone();
-            let destination = match (target, path, &self.save_override) {
-                (_, _, Some(p)) => p.clone(),
-                // An email attachment's temporary copy is no place to keep work: ask, as for a new
-                // document (`is_mail_temp_copy`).
-                (SaveTarget::InPlace, Some(p), _) if !is_mail_temp_copy(&p) => p,
-                _ => {
-                    let name = if name.to_ascii_lowercase().ends_with(".pdf") { name } else { format!("{name}.pdf") };
-                    let dialog = rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).set_file_name(name);
-                    let dialog = in_document_folder(dialog, doc_path.as_deref());
-                    // The bytes are taken once the user has chosen, so edits made meanwhile are saved too.
-                    self.ask_one(crate::pickers::Ask::Save(dialog), None, move |app, dest| {
-                        app.save_doc_to_then(id, &dest.to_string_lossy(), target, Box::new(after));
-                    });
-                    return false;
-                }
-            };
-            self.save_doc_to_then(id, &destination, target, Box::new(after))
-        }
-        #[cfg(target_arch = "wasm32")]
-        {
-            let _ = path;
-            if !self.flatten_fill_sign_for_save(id) {
-                return false;
-            }
-            let bytes = match self.session.save_bytes(id) {
-                Ok(b) => b,
-                Err(e) => {
-                    self.notify_fmt("Couldn't save {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
-                    return false;
-                }
-            };
-            // An embedding page that asked for saves (`?host=parent`) gets the bytes; otherwise
-            // the browser downloads them.
-            let to_host = self.host_save.is_some();
-            let delivered = match &self.host_save {
-                Some(save) => save(&name, &bytes, matches!(target, SaveTarget::As)),
-                None => download(&name, &bytes),
-            };
-            match delivered {
-                Ok(()) => {
-                    let _ = self.session.mark_saved(id, bytes, None);
-                    if let Some(doc) = self.session.get(id)
-                        && let Some(view) = self.views.get_mut(index)
-                    {
-                        view.document_changed(&doc.info);
-                    }
-                    // The host reports where the file went (and any failure) itself.
-                    if !to_host {
-                        self.notify_fmt("Downloaded {name}", &[("name", &name)]);
-                    }
-                    after(self);
-                    true
-                }
-                Err(e) if to_host => {
-                    self.notify_fmt("Couldn't save {name}: {e}", &[("name", &name), ("e", &e)]);
-                    false
-                }
-                Err(e) => {
-                    self.notify_fmt("Couldn't download {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
-                    false
-                }
-            }
-        }
-    }
-
-    /// [`Self::save_doc_to`], then `after`. When `dest` is the document's own file and it is
-    /// another version on disk than the one the document came from (something else wrote it
-    /// since the open or the last save, #2166), it asks first: the save waits in
-    /// `pending_overwrite` behind [`Dialog::OverwriteChanged`](crate::Dialog::OverwriteChanged).
-    /// Returns `true` if written now.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn save_doc_to_then(&mut self, id: pdfcraft_engine::DocId, dest: &str, target: SaveTarget, after: Box<dyn FnOnce(&mut Self) + Send>) -> bool {
-        let own = self.session.get(id).and_then(|d| d.path.as_deref()).is_some_and(|p| crate::same_file(p, dest));
-        if own && self.watch.disk_differs(id, dest, self.session.get(id).map(|d| d.saved_bytes())) {
-            self.pending_overwrite = Some(PendingOverwrite { id, dest: dest.to_string(), target, after });
-            self.dialog = Some(crate::Dialog::OverwriteChanged);
-            return false;
-        }
-        let saved = self.save_doc_to(id, dest, target);
-        if saved {
-            after(self);
-        }
-        saved
-    }
-
-    /// The dialog's Save anyway: write over the changed file.
-    #[cfg(not(target_arch = "wasm32"))]
-    pub(crate) fn overwrite_changed_file(&mut self) {
-        let Some(p) = self.pending_overwrite.take() else { return };
-        if self.save_doc_to(p.id, &p.dest, p.target) {
-            (p.after)(self);
-        }
-    }
-
-    /// The dialog's Save as…: leave the file on disk as it is and ask where to put this version.
-    #[cfg(not(target_arch = "wasm32"))]
-    pub(crate) fn save_changed_file_elsewhere(&mut self) {
-        let Some(p) = self.pending_overwrite.take() else { return };
-        if let Some(index) = self.views.iter().position(|v| v.id == p.id) {
-            self.save_then(index, SaveTarget::As, p.after);
-        }
-    }
-
-    /// Write document `id` to `dest` and make it the document's file. Returns `true` if written.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn save_doc_to(&mut self, id: pdfcraft_engine::DocId, dest: &str, target: SaveTarget) -> bool {
-        // Save As answers on a later frame: commit what was typed meanwhile, too (#166), even
-        // if another tab is active by then.
-        if !self.commit_typing_in(id) || !self.flatten_fill_sign_for_save(id) {
-            return false;
-        }
-        let Some((name, full)) = self.session.get(id).map(|d| {
-            // Save As to another file is a clean copy, without the earlier revisions that still
-            // hold deleted pages or replaced text (#2165). A signed document stays incremental so
-            // its signatures keep covering the file.
-            let full = target == SaveTarget::As
-                && !d.path.as_deref().is_some_and(|p| crate::same_file(p, dest))
-                && d.read_only_reason.is_none()
-                && !d.is_signed();
-            (d.name.clone(), full)
-        }) else {
-            self.notify_tr("The document was closed before it could be saved.");
-            return false;
-        };
-        let bytes = if full { self.session.save_full_bytes(id) } else { self.session.save_bytes(id) };
-        let bytes = match bytes.and_then(|b| self.session.check_save(id, &b).map(|()| b)) {
-            Ok(b) => b,
-            Err(e) => {
-                self.notify_fmt("Couldn't save {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
-                return false;
-            }
-        };
-        if let Err(e) = write_atomically(dest, &bytes) {
-            self.notify_fmt("Couldn't save {name}: {e}", &[("name", dest), ("e", &e.to_string())]);
-            return false;
-        }
-        // Our own write is not a change on disk to reload (#431).
-        self.watch.known_now(id, dest);
-        match self.session.mark_saved(id, bytes, Some(dest.to_string())) {
-            Ok(()) => {
-                self.forget_recovery(id);
-                if let Some(doc) = self.session.get(id)
-                    && let Some(view) = self.views.iter_mut().find(|v| v.id == id)
-                {
-                    view.document_changed(&doc.info);
-                    // Saving over a version that changed on disk keeps this one: nothing to ask.
-                    view.disk_changed = false;
-                }
-                self.notify_fmt("Saved {name}", &[("name", &short_name(dest))]);
-                #[cfg(target_os = "macos")]
-                crate::macos_association::repair(std::path::Path::new(dest));
-                true
-            }
-            Err(e) => {
-                self.notify_fmt("Saved, but reopening failed: {e}", &[("e", &e.to_string())]);
-                false
-            }
-        }
-    }
-
-    /// Close a tab, asking first if it has unsaved changes.
-    pub fn request_close_tab(&mut self, index: usize) {
-        // Text typed into a field counts as an unsaved change.
-        if self.has_unsaved_work(index)
-            && let Some(id) = self.views.get(index).map(|v| v.id)
-        {
-            self.close_request = Some(CloseRequest::Tab(id));
-        } else {
-            self.close_tab(index);
-        }
-    }
-
-    /// File ▸ Close all: clean documents close at once; each one with unsaved changes asks.
-    pub fn close_all(&mut self) {
-        for i in (0..self.views.len()).rev() {
-            if !self.has_unsaved_work(i) {
-                self.close_tab(i);
-            }
-        }
-        if self.first_dirty().is_some() {
-            self.close_request = Some(CloseRequest::All);
-        }
-    }
-
-    /// File ▸ Revert (after the confirmation).
-    pub fn revert_active(&mut self) {
-        let Some((_, id)) = self.active_ids() else { return };
-        match self.session.revert(id) {
-            Ok(()) => {
-                if let Some(i) = self.active
-                    && let Some(d) = self.session.get(id)
-                {
-                    let view = &mut self.views[i];
-                    view.document_changed(&d.info);
-                    // Revert discards this source's uncommitted typing as well as model edits.
-                    // Otherwise a later Save could write a rejected draft back into the file.
-                    view.forms.focus = None;
-                    view.forms.committed = None;
-                    view.forms.unbaked.clear();
-                    view.pending_edit = None;
-                }
-                self.notify_tr("Reverted to the last saved version");
-            }
-            Err(e) => self.notify_error(e),
-        }
-    }
-
-    /// The first tab with unsaved changes.
-    pub fn first_dirty(&self) -> Option<usize> {
-        (0..self.views.len()).find(|&i| self.has_unsaved_work(i))
-    }
-
-    /// Answer the save prompt: `Some(true)` save, `Some(false)` discard, `None` cancel.
-    pub fn resolve_close(&mut self, ctx: &egui::Context, choice: Option<bool>) {
-        let Some(req) = self.close_request.take() else { return };
-        // The next question (another dirty document) starts on Save again.
-        self.save_prompt_button = Default::default();
-        let index = match req {
-            CloseRequest::Tab(id) => match self.views.iter().position(|v| v.id == id) {
-                Some(i) => i,
-                None => return, // already closed
-            },
-            CloseRequest::Quit | CloseRequest::All => match self.first_dirty() {
-                Some(i) => i,
-                None => {
-                    if req == CloseRequest::Quit {
-                        self.quit(ctx);
-                    }
-                    return;
-                }
-            },
-        };
-        // Quitting closes the unsaved tabs one by one (and brings each forward to save it):
-        // remember what was open, and which tab was active, before the first one goes (#442).
-        if req == CloseRequest::Quit {
-            match choice {
-                Some(_) => self.note_quit_session(),
-                None => self.forget_quit_session(),
-            }
-        }
-        match choice {
-            None => {} // cancelled: nothing closes
-            Some(false) => self.close_and_continue(ctx, index, req),
-            Some(true) => {
-                let Some(id) = self.views.get(index).map(|v| v.id) else { return };
-                // Bring the document forward: what's typed in its form is committed and saved
-                // with it, and a field that rejects the value is shown where the user can fix it.
-                self.active = Some(index);
-                // Close only once the save has actually been written, which may be on a later
-                // frame when the user has to choose where. A failed or cancelled save keeps the
-                // document open.
-                let ctx = ctx.clone();
-                self.save_then(index, SaveTarget::InPlace, move |app| {
-                    if let Some(i) = app.views.iter().position(|v| v.id == id) {
-                        app.close_and_continue(&ctx, i, req);
-                    }
-                });
-            }
-        }
-    }
-
-    /// Close tab `index` for a close request, then ask about the next dirty document, or quit.
-    fn close_and_continue(&mut self, ctx: &egui::Context, index: usize, req: CloseRequest) {
-        self.close_tab(index);
-        // A newer prompt wins: the user may have started another close while a save was pending,
-        // and seen its question, which keeps counting as seen.
-        if (req == CloseRequest::Quit || req == CloseRequest::All) && self.close_request.is_none() {
-            match self.first_dirty() {
-                Some(_) => {
-                    // A question about the next document is a new one.
-                    self.save_prompt_seen = false;
-                    self.close_request = Some(req);
-                }
-                None if req == CloseRequest::Quit => self.quit(ctx),
-                None => {}
-            }
-        }
-    }
-
-    /// Request a normal application exit, preserving every unsaved document until answered.
-    /// Returns false while the existing save/discard/cancel prompt needs a decision.
-    pub(crate) fn request_quit(&mut self, ctx: &egui::Context) -> bool {
-        if self.first_dirty().is_some() {
-            self.close_request = Some(CloseRequest::Quit);
-            ctx.request_repaint();
-            false
-        } else {
-            self.shutdown_recovery();
-            self.quit(ctx);
-            true
-        }
-    }
-
-    fn quit(&mut self, ctx: &egui::Context) {
-        self.allow_quit = true;
-        ctx.send_viewport_cmd(egui::ViewportCommand::Close);
-    }
-
-    /// Publish whether any document has unsaved work, for the browser's reload warning (#812).
-    pub(crate) fn sync_unsaved_flag(&self) {
-        self.unsaved_flag.store(self.first_dirty().is_some(), std::sync::atomic::Ordering::Relaxed);
-    }
-
-    /// Intercept window close while documents have unsaved changes.
-    pub(crate) fn guard_quit(&mut self, ctx: &egui::Context) {
-        // egui's default quit shortcut ignores extra Alt/Shift, including Ctrl+Alt+Q for '@'.
-        ctx.options_mut(|o| o.quit_shortcuts.clear());
-        let shortcut = ctx.input(|i| {
-            i.events.iter().any(|e| {
-                matches!(e, egui::Event::Key { key: egui::Key::Q, pressed: true, modifiers, .. }
-                    if modifiers.matches_exact(egui::Modifiers::COMMAND))
-            })
-        });
-        if shortcut {
-            self.request_quit(ctx);
-        }
-        self.sync_unsaved_flag();
-        if !ctx.input(|i| i.viewport().close_requested()) {
-            return;
-        }
-        // `first_dirty` counts text typed into a field as an unsaved change.
-        if !self.allow_quit && self.first_dirty().is_some() {
-            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
-            self.close_request = Some(CloseRequest::Quit);
-        } else {
-            // A clean quit: nothing is left to recover.
-            self.shutdown_recovery();
-        }
-    }
-
-    /// Ask for the user's attention when the "save changes?" question opens while PdfCraft is in
-    /// the background (Quit in the Dock menu, logging out, or an agent quitting), and withdraw the
-    /// request once the user comes back or the question is answered.
-    ///
-    /// The question holds up the quit the user asked for, so the request is critical, as AppKit
-    /// makes it for a modal panel that an inactive app presents: the Dock icon bounces until
-    /// PdfCraft is active, Windows flashes the taskbar button until the window is in front, and
-    /// X11 sets the urgency hint, which stays until it is reset. A question that opens in front
-    /// asks nothing, and neither does leaving it open: the user has seen it. Each document asked
-    /// about when quitting is a new question, so one that opens in the background asks even after
-    /// a question the user saw; a request that still stands carries over to it.
-    pub(crate) fn attend_save_prompt(&mut self, ctx: &egui::Context) {
-        let open = self.close_request.is_some();
-        let focused = ctx.input(|i| i.focused);
-        if self.save_prompt_attention {
-            if focused || !open {
-                ctx.send_viewport_cmd(egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Reset));
-                self.save_prompt_attention = false;
-            }
-        } else if open && !self.save_prompt_seen && !focused {
-            ctx.send_viewport_cmd(egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Critical));
-            self.save_prompt_attention = true;
-        }
-        self.save_prompt_seen = open;
-    }
 }
 
 /// The single page a content edit changes (`None` for other edits). Like comment edits,
@@ -1078,97 +682,6 @@ fn is_form_edit(edit: &Edit) -> bool {
     )
 }
 
-/// Whether `path` is the temporary copy an email client opened an attachment from, so that Save
-/// asks where to keep the document instead of writing to it.
-///
-/// Outlook opens an attachment from its own cache: `INetCache\Content.Outlook\<random>\` for
-/// classic Outlook (`Temporary Internet Files\Content.Outlook\` on older Windows), and the
-/// `Packages\Microsoft.OutlookForWindows_<id>` package folder for the new Outlook. The patterns
-/// follow those layouts, so an ordinary folder that merely shares a name doesn't match. Saving there either fails,
-/// because Outlook can still hold the file, or appears to work while the edits stay out of the
-/// email and are deleted with the cache. Apple Mail opens one from `Mail Downloads/<UUID>/` in
-/// its sandbox container, where other apps can't write, so saving there fails (#2751). Matched on
-/// either separator and in any case, so it can be tested on every platform.
-pub(crate) fn is_mail_temp_copy(path: &str) -> bool {
-    let p = path.replace('\\', "/").to_ascii_lowercase();
-    // Outlook's cache holds `<marker><random folder>/<file>`: exactly one folder, then the file.
-    let in_outlook_cache = |marker: &str| {
-        p.split_once(marker)
-            .is_some_and(|(_, rest)| matches!(rest.split('/').collect::<Vec<_>>()[..], [dir, file] if !dir.is_empty() && !file.is_empty()))
-    };
-    in_outlook_cache("/inetcache/content.outlook/")
-        || in_outlook_cache("/temporary internet files/content.outlook/")
-        || p.contains("/packages/microsoft.outlookforwindows_")
-        || p.contains("/library/containers/com.apple.mail/data/library/mail downloads/")
-}
-
-/// The folder a Save As style dialog should open in for a document stored at `path`: the
-/// document's own folder, as Acrobat and Foxit do, instead of whichever folder the system picks.
-/// `None` (keep the system's choice) for a new document, a path with no parent, or an email
-/// attachment's temporary copy (`is_mail_temp_copy`), which is no place to keep work. Also right
-/// for UNC paths on Windows (`\\server\share\dir\f.pdf` gives `\\server\share\dir`).
-pub(crate) fn save_dialog_folder(path: Option<&str>) -> Option<std::path::PathBuf> {
-    let path = path.filter(|p| !is_mail_temp_copy(p))?;
-    let parent = std::path::Path::new(path).parent()?;
-    (!parent.as_os_str().is_empty()).then(|| parent.to_path_buf())
-}
-
-/// `dialog` opened in the folder of the document stored at `path` ([`save_dialog_folder`]).
-pub(crate) fn in_document_folder(dialog: rfd::AsyncFileDialog, path: Option<&str>) -> rfd::AsyncFileDialog {
-    match save_dialog_folder(path) {
-        Some(dir) => dialog.set_directory(dir),
-        None => dialog,
-    }
-}
-
-/// Write via a temporary file in the same directory and rename over the target, so a crash or
-/// full disk never leaves a half-written PDF where the original was.
-pub fn write_atomically(path: &str, bytes: &[u8]) -> std::io::Result<()> {
-    write_atomically_with(path, bytes, staging_suffixes())
-}
-
-/// [`write_atomically`], trying the staging names that `suffixes` give.
-fn write_atomically_with(path: &str, bytes: &[u8], suffixes: impl IntoIterator<Item = u64>) -> std::io::Result<()> {
-    write_atomically_syncing(path, bytes, suffixes, std::fs::File::sync_all)
-}
-
-/// [`write_atomically_with`], flushing the staging file with `sync_all` (the standard library's
-/// in the app, a failing one in tests). The writer itself is the platform crate's, shared with
-/// the tools and the CLI (#2166); the desktop app keeps its staging-name form.
-fn write_atomically_syncing(
-    path: &str,
-    bytes: &[u8],
-    suffixes: impl IntoIterator<Item = u64>,
-    sync_all: impl FnOnce(&std::fs::File) -> std::io::Result<()>,
-) -> std::io::Result<()> {
-    pdfcraft_platform::staging::write_atomically_with(std::path::Path::new(path), bytes, StagingName::TagThenSuffix, suffixes, sync_all)
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-fn short_name(path: &str) -> String {
-    std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string())
-}
-
-/// Offer bytes as a browser download.
-#[cfg(target_arch = "wasm32")]
-pub(crate) fn download(name: &str, bytes: &[u8]) -> Result<(), String> {
-    use wasm_bindgen::JsCast;
-    let err = |e: wasm_bindgen::JsValue| format!("{e:?}");
-    let array = js_sys::Uint8Array::from(bytes);
-    let parts = js_sys::Array::of1(&array);
-    let opts = web_sys::BlobPropertyBag::new();
-    opts.set_type("application/pdf");
-    let blob = web_sys::Blob::new_with_u8_array_sequence_and_options(&parts, &opts).map_err(err)?;
-    let url = web_sys::Url::create_object_url_with_blob(&blob).map_err(err)?;
-    let document = web_sys::window().and_then(|w| w.document()).ok_or("no document")?;
-    let a: web_sys::HtmlAnchorElement = document.create_element("a").map_err(err)?.dyn_into().map_err(|_| "anchor")?;
-    a.set_href(&url);
-    a.set_download(name);
-    a.click();
-    let _ = web_sys::Url::revoke_object_url(&url);
-    Ok(())
-}
-
 impl PdfCraftApp {
     /// Carry out a Bookmarks-panel action as an undoable edit.
     pub fn bookmark_action(&mut self, action: crate::panels::BmAction) {
@@ -1234,362 +747,7 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
 }
 
 #[cfg(test)]
-mod tests {
-    use super::{SaveTarget, is_mail_temp_copy, save_dialog_folder, write_atomically, write_atomically_syncing, write_atomically_with};
-
-    #[test]
-    fn save_dialogs_open_in_the_documents_folder() {
-        use std::path::PathBuf;
-        assert_eq!(save_dialog_folder(Some("/home/a/plans/f.pdf")), Some(PathBuf::from("/home/a/plans")));
-        // A new document has no folder yet; a bare name has an empty parent; the root has none.
-        assert_eq!(save_dialog_folder(None), None);
-        assert_eq!(save_dialog_folder(Some("f.pdf")), None);
-        assert_eq!(save_dialog_folder(Some("/")), None);
-        // An email attachment's temporary copy is not offered.
-        assert_eq!(save_dialog_folder(Some("C:\\Users\\a\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\AB12\\f.pdf")), None);
-        assert_eq!(save_dialog_folder(Some("/Users/a/Library/Containers/com.apple.mail/Data/Library/Mail Downloads/UUID/f.pdf")), None);
-    }
-
-    /// The Windows rules for `Path::parent` (UNC share roots included) only apply on Windows.
-    #[cfg(windows)]
-    #[test]
-    fn save_dialog_folder_handles_unc_paths() {
-        use std::path::PathBuf;
-        assert_eq!(save_dialog_folder(Some(r"\\nas\projets\2026\f.pdf")), Some(PathBuf::from(r"\\nas\projets\2026")));
-        assert_eq!(save_dialog_folder(Some(r"\\nas\projets\f.pdf")), Some(PathBuf::from(r"\\nas\projets\")));
-        assert_eq!(save_dialog_folder(Some(r"\\nas\projets")), None);
-        assert_eq!(save_dialog_folder(Some(r"C:\Users\a\f.pdf")), Some(PathBuf::from(r"C:\Users\a")));
-    }
-    use pdfcraft_platform::staging::{STAGING_ATTEMPTS, staging_suffixes};
-    use std::path::{Path, PathBuf};
-
-    /// A fresh, empty folder for one staging test.
-    fn staging_dir(test: &str) -> PathBuf {
-        let dir = std::env::temp_dir().join(format!("pdfcraft-ui-staging-{}-{test}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        dir
-    }
-
-    fn staged(dir: &Path, suffix: u64) -> PathBuf {
-        dir.join(format!(".out.pdf.pdfcraft-{suffix:016x}.tmp"))
-    }
-
-    fn read(p: &Path) -> String {
-        std::fs::read_to_string(p).unwrap()
-    }
-
-    /// A symbolic link to a file, where the system allows one (Windows needs Developer Mode or an
-    /// administrator for it).
-    fn file_symlink(target: &Path, link: &Path) -> std::io::Result<()> {
-        #[cfg(unix)]
-        {
-            std::os::unix::fs::symlink(target, link)
-        }
-        #[cfg(windows)]
-        {
-            std::os::windows::fs::symlink_file(target, link)
-        }
-        #[cfg(not(any(unix, windows)))]
-        {
-            Err(std::io::Error::other(format!("no symbolic links here: {} {}", target.display(), link.display())))
-        }
-    }
-
-    #[test]
-    fn saving_never_writes_through_a_file_planted_at_the_staging_name() {
-        let dir = staging_dir("planted");
-        let outside = dir.join("outside.txt");
-        std::fs::write(&outside, "PRECIOUS").unwrap();
-        let target = dir.join("out.pdf");
-        let path = target.to_string_lossy().into_owned();
-        // A hard link needs no privileges on any system, and writing to it writes to `outside`.
-        std::fs::hard_link(&outside, staged(&dir, 1)).unwrap();
-        std::fs::write(staged(&dir, 2), "PLANTED").unwrap();
-        write_atomically_with(&path, b"NEW", [1, 2, 3]).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert_eq!(read(&outside), "PRECIOUS");
-        assert_eq!(read(&staged(&dir, 1)), "PRECIOUS");
-        assert_eq!(read(&staged(&dir, 2)), "PLANTED");
-        assert!(!staged(&dir, 3).exists(), "the staging file was renamed into place");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn saving_never_writes_through_a_symbolic_link_at_the_staging_name() {
-        let dir = staging_dir("symlink");
-        let outside = dir.join("outside.txt");
-        std::fs::write(&outside, "PRECIOUS").unwrap();
-        let target = dir.join("out.pdf");
-        if let Err(e) = file_symlink(&outside, &staged(&dir, 1)) {
-            eprintln!("symbolic links not checked: {e}");
-            return;
-        }
-        write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert_eq!(read(&outside), "PRECIOUS");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn saving_never_creates_a_file_through_a_dangling_link_at_the_staging_name() {
-        let dir = staging_dir("dangling");
-        let unborn = dir.join("created-through-a-link.txt");
-        let target = dir.join("out.pdf");
-        if let Err(e) = file_symlink(&unborn, &staged(&dir, 1)) {
-            eprintln!("symbolic links not checked: {e}");
-            return;
-        }
-        write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert!(!unborn.exists(), "nothing was created through the dangling link");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn a_folder_at_the_staging_name_is_left_alone() {
-        let dir = staging_dir("folder");
-        std::fs::create_dir(staged(&dir, 1)).unwrap();
-        std::fs::write(staged(&dir, 1).join("inside.txt"), "PLANTED").unwrap();
-        let target = dir.join("out.pdf");
-        write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert_eq!(read(&staged(&dir, 1).join("inside.txt")), "PLANTED");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn saving_gives_up_rather_than_reuse_a_taken_name() {
-        let dir = staging_dir("taken");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, "OLD").unwrap();
-        for s in 1..=STAGING_ATTEMPTS as u64 {
-            std::fs::write(staged(&dir, s), "PLANTED").unwrap();
-        }
-        assert!(write_atomically_with(&target.to_string_lossy(), b"NEW", 1..).is_err());
-        assert_eq!(read(&target), "OLD");
-        for s in 1..=STAGING_ATTEMPTS as u64 {
-            assert_eq!(read(&staged(&dir, s)), "PLANTED");
-        }
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// The names in a folder: what a test can see was left behind.
-    fn listing(dir: &Path) -> Vec<String> {
-        let mut names: Vec<_> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
-        names.sort();
-        names
-    }
-
-    #[test]
-    fn saving_a_long_name_leaves_only_the_saved_file() {
-        assert_ne!(staging_suffixes().next(), staging_suffixes().next(), "each save draws new names");
-        // 60 four-byte characters: a 244-byte name, within every system's limit. Its staging name
-        // must be too (on Linux the whole name in it would be 275 bytes).
-        let dir = staging_dir("clean");
-        let name = format!("{}.pdf", "\u{1F600}".repeat(60));
-        let path = dir.join(&name).to_string_lossy().into_owned();
-        write_atomically(&path, b"NEW").unwrap();
-        write_atomically(&path, b"NEWER").unwrap();
-        assert_eq!(read(&dir.join(&name)), "NEWER");
-        assert_eq!(listing(&dir), [name], "no staging file is left behind");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// A read-only target is refused before anything is staged, so no staging file is left
-    /// behind.
-    #[cfg(windows)]
-    #[test]
-    fn a_failed_save_removes_the_staging_file() {
-        let dir = staging_dir("readonly");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, "OLD").unwrap();
-        let mut perms = std::fs::metadata(&target).unwrap().permissions();
-        perms.set_readonly(true);
-        std::fs::set_permissions(&target, perms.clone()).unwrap();
-        let e = write_atomically_with(&target.to_string_lossy(), b"NEW", [7]).unwrap_err();
-        assert_eq!(e.kind(), std::io::ErrorKind::PermissionDenied, "a read-only target is refused: {e}");
-        assert_eq!(read(&target), "OLD");
-        assert_eq!(listing(&dir), ["out.pdf"], "the staging file was removed");
-        #[allow(clippy::permissions_set_readonly_false)]
-        perms.set_readonly(false);
-        std::fs::set_permissions(&target, perms).unwrap();
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// On macOS `sync_all` asks for a full flush, which SMB and FUSE volumes (a Cryptomator vault,
-    /// #981) refuse as unsupported: ENOTSUP (45) or ENOTTY (25). The save still goes through.
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn a_volume_without_full_flush_still_saves() {
-        for errno in [45, 25] {
-            let dir = staging_dir(&format!("nofullsync-{errno}"));
-            let target = dir.join("out.pdf");
-            std::fs::write(&target, "OLD").unwrap();
-            let asked = std::cell::Cell::new(false);
-            let refuse = |_: &std::fs::File| {
-                asked.set(true);
-                Err(std::io::Error::from_raw_os_error(errno))
-            };
-            write_atomically_syncing(&target.to_string_lossy(), b"NEW", [7], refuse).unwrap();
-            assert!(asked.get(), "the full flush was tried");
-            assert_eq!(read(&target), "NEW");
-            assert_eq!(listing(&dir), ["out.pdf"], "no staging file is left behind");
-            let _ = std::fs::remove_dir_all(&dir);
-        }
-    }
-
-    /// Only "not supported" is let through: any other flush failure fails the save and keeps the
-    /// original.
-    #[test]
-    fn a_failed_flush_keeps_the_original() {
-        let dir = staging_dir("syncfails");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, "OLD").unwrap();
-        let e = write_atomically_syncing(&target.to_string_lossy(), b"NEW", [7], |_| Err(std::io::Error::other("disk gone"))).unwrap_err();
-        assert_eq!(e.to_string(), "disk gone");
-        assert_eq!(read(&target), "OLD");
-        assert_eq!(listing(&dir), ["out.pdf"], "the staging file was removed");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[cfg(target_os = "macos")]
-    #[test]
-    fn a_save_preserves_opening_settings_changed_while_staging() {
-        let dir = staging_dir("opening-metadata-changed");
-        let target = dir.join("out.pdf");
-        std::fs::write(&target, b"OLD").unwrap();
-        xattr::set(&target, "com.apple.LaunchServices.OpenWith", b"old handler").unwrap();
-        xattr::set(&target, "com.apple.quarantine", b"0082;1234;Preview;").unwrap();
-        let suffixes = std::iter::once_with(|| {
-            xattr::set(&target, "com.apple.LaunchServices.OpenWith", b"new handler").unwrap();
-            xattr::set(&target, "com.apple.quarantine", b"0082;5678;another app;").unwrap();
-            7
-        });
-        write_atomically_with(&target.to_string_lossy(), b"NEW", suffixes).unwrap();
-        assert_eq!(read(&target), "NEW");
-        assert_eq!(xattr::get(&target, "com.apple.LaunchServices.OpenWith").unwrap(), Some(b"new handler".to_vec()));
-        assert_eq!(xattr::get(&target, "com.apple.quarantine").unwrap(), Some(b"0082;5678;another app;".to_vec()));
-        let _ = std::fs::remove_dir_all(dir);
-    }
-
-    #[test]
-    fn outlook_attachment_copies_are_recognised_on_either_separator_and_in_any_case() {
-        for p in [
-            r"C:\Users\me\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AB12CD34\Quote.pdf",
-            r"c:\users\me\appdata\local\microsoft\windows\inetcache\content.outlook\ab12cd34\quote (2).pdf",
-            r"C:\Users\me\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\AB12CD34\Quote.pdf",
-            r"C:\Users\me\AppData\Local\Packages\Microsoft.OutlookForWindows_8wekyb3d8bbwe\LocalCache\Quote.pdf",
-            "C:/Users/me/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/AB12CD34/Quote.pdf",
-        ] {
-            assert!(is_mail_temp_copy(p), "{p}");
-        }
-    }
-
-    #[test]
-    fn apple_mail_attachment_copies_are_recognised() {
-        for p in [
-            "/Users/me/Library/Containers/com.apple.mail/Data/Library/Mail Downloads/6F1C2A9E-3B4D-4E5F-8A7B-9C0D1E2F3A4B/booking.pdf",
-            "/Users/me/library/containers/COM.APPLE.MAIL/data/library/mail downloads/6F1C2A9E/Booking (2).pdf",
-        ] {
-            assert!(is_mail_temp_copy(p), "{p}");
-        }
-    }
-
-    #[test]
-    fn ordinary_paths_are_not_mail_copies() {
-        for p in [
-            r"C:\Users\me\Documents\Quote.pdf",
-            r"C:\Users\me\OneDrive - Contoso\Content.Outlook notes\Quote.pdf",
-            r"C:\Users\me\AppData\Local\Microsoft\Windows\INetCache\IE\Quote.pdf",
-            "/home/microsoft.outlookforwindows/report.pdf",
-            "/x/inetcache/content.outlook/y.pdf",
-            "/x/temporary internet files/content.outlook/y.pdf",
-            "/home/me/Documents/Quote.pdf",
-            "/Users/me/Downloads/Mail Downloads/booking.pdf",
-            "/Users/me/Library/Containers/com.apple.Notes/Data/Library/Mail Downloads/booking.pdf",
-            "Quote.pdf",
-        ] {
-            assert!(!is_mail_temp_copy(p), "{p}");
-        }
-    }
-
-    /// A one-page document with a proper xref table.
-    fn one_page_pdf() -> Vec<u8> {
-        let objs = [
-            "<< /Type /Catalog /Pages 2 0 R >>",
-            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
-            "<< /Type /Page /Parent 2 0 R >>",
-        ];
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, o) in objs.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
-        }
-        let xref = out.len();
-        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
-        for o in offsets {
-            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
-        }
-        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
-        out
-    }
-
-    #[test]
-    fn save_commits_the_open_text_box() {
-        let dir = staging_dir("open-text-box");
-        let dest = dir.join("out.pdf");
-        let mut app = crate::PdfCraftApp::new();
-        app.set_option("language", "en").unwrap();
-        app.open_bytes("a.pdf", None, one_page_pdf()).unwrap();
-        app.save_override = Some(dest.to_string_lossy().into_owned());
-        let style = crate::content_ui::default_style();
-        app.views[0].content.draft = Some(crate::content_ui::TextDraft {
-            page: 0,
-            index: None,
-            rect: [20.0, 20.0, 120.0, 40.0],
-            text: "Typed text".into(),
-            style,
-            focus: true,
-        });
-
-        assert!(app.save_active(SaveTarget::InPlace));
-        let id = app.views[0].id;
-        let added = app.session.get(id).unwrap().added();
-        assert_eq!(added.len(), 1, "the open text box was committed before the save");
-        assert!(app.views[0].content.draft.is_none());
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn save_asks_where_to_keep_an_email_attachment_and_leaves_the_temporary_copy_alone() {
-        let dir = staging_dir("mail-temp");
-        let cache = dir.join("INetCache").join("Content.Outlook").join("AB12CD34");
-        std::fs::create_dir_all(&cache).unwrap();
-        let attachment = cache.join("Quote.pdf");
-        let original = one_page_pdf();
-        std::fs::write(&attachment, &original).unwrap();
-        let kept = dir.join("Quote.pdf");
-
-        let mut app = crate::PdfCraftApp::new();
-        app.set_option("language", "en").unwrap();
-        app.open_bytes("Quote.pdf", Some(attachment.to_string_lossy().into_owned()), original.clone()).unwrap();
-        assert!(app.apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 }));
-        app.pick_override = Some(vec![kept.to_string_lossy().into_owned()]);
-
-        assert!(!app.save_active(SaveTarget::InPlace), "Save asks instead of writing the temporary copy");
-        app.process_picked();
-        assert_eq!(std::fs::read(&attachment).unwrap(), original, "the attachment's copy is untouched");
-        assert!(std::fs::read(&kept).unwrap().starts_with(b"%PDF"), "the document went where the user chose");
-
-        // The chosen file is the document's file now: the next Save writes it without asking.
-        app.pick_override = None;
-        assert!(app.apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 }));
-        assert!(app.save_active(SaveTarget::InPlace));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}
+mod tests;
 
 #[cfg(test)]
 mod revert_draft_tests {
@@ -1609,6 +767,7 @@ mod revert_draft_tests {
             calendar: None,
             calendar_rect: None,
             calendar_text: None,
+            had_focus: false,
         }
     }
 
@@ -1694,6 +853,56 @@ mod revert_draft_tests {
         assert!(app.unsaved_flag.load(Ordering::Relaxed));
     }
 
+    /// Text typed into a new text box is lost on close unless the save prompt appears; an empty
+    /// box has nothing to lose.
+    #[test]
+    fn text_typed_into_a_new_text_box_counts_as_unsaved_work() {
+        use crate::content_ui::{TextDraft, default_style};
+        let mut app = app();
+        let draft = |text: &str| TextDraft { page: 0, index: None, rect: [0.0; 4], text: text.into(), style: default_style(), focus: true };
+        assert!(!app.has_unsaved_work(0));
+        app.views[0].content.draft = Some(draft("  \n"));
+        assert!(!app.has_unsaved_work(0));
+        app.views[0].content.draft = Some(draft("Typed"));
+        assert!(!app.session.get(app.views[0].id).unwrap().dirty);
+        assert!(app.has_unsaved_work(0));
+    }
+
+    /// Close ▸ Save, and Quit ▸ Save, write the text typed into a new text box before the tab
+    /// closes.
+    #[test]
+    fn saving_on_close_keeps_text_typed_into_a_new_text_box() {
+        use crate::content_ui::{TextDraft, default_style};
+        use pdfcraft_engine::AddedContent;
+        for quit in [false, true] {
+            let dir = std::env::temp_dir().join(format!("pdfcraft-ui-new-text-{}-{quit}", std::process::id()));
+            let _ = std::fs::remove_dir_all(&dir);
+            std::fs::create_dir_all(&dir).unwrap();
+            let path = dir.join("source.pdf").to_string_lossy().into_owned();
+            let bytes = include_bytes!("../tests/data/form.pdf").to_vec();
+            std::fs::write(&path, &bytes).unwrap();
+            let mut app = PdfCraftApp::new();
+            app.open_bytes("source.pdf", Some(path.clone()), bytes).unwrap();
+            let rect = [72.0, 72.0, 272.0, 92.0];
+            app.views[0].content.draft = Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true });
+            let ctx = egui::Context::default();
+            if quit {
+                assert!(!app.request_quit(&ctx));
+            } else {
+                app.request_close_tab(0);
+            }
+            assert!(app.close_request.is_some());
+            app.resolve_close(&ctx, Some(true));
+            assert!(app.views.is_empty(), "the tab closes once saved");
+
+            let mut reopened = PdfCraftApp::new();
+            reopened.open_bytes("source.pdf", Some(path.clone()), std::fs::read(&path).unwrap()).unwrap();
+            let doc = reopened.session.get(reopened.views[0].id).unwrap();
+            assert!(doc.added().iter().any(|a| matches!(&a.content, AddedContent::Text(t) if t.text == "Typed")), "quit: {quit}");
+            let _ = std::fs::remove_dir_all(&dir);
+        }
+    }
+
     #[test]
     fn successful_revert_clears_focused_or_queued_drafts_only_on_its_document() {
         for queued in [false, true] {
diff --git a/crates/ui-egui/src/editing/close.rs b/crates/ui-egui/src/editing/close.rs
new file mode 100644
index 0000000000..5317c0ccd0
--- /dev/null
+++ b/crates/ui-egui/src/editing/close.rs
@@ -0,0 +1,212 @@
+use super::save::SaveTarget;
+use super::*;
+
+/// What the user was doing when we asked whether to save.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CloseRequest {
+    /// Close this document's tab. By id, not tab index: tabs can close and shift while a save
+    /// panel is open.
+    Tab(pdfcraft_engine::DocId),
+    /// Quit the application once every dirty document is resolved.
+    Quit,
+    /// File ▸ Close all: like Quit, but the application stays open.
+    All,
+}
+
+impl PdfCraftApp {
+    /// Close a tab, asking first if it has unsaved changes.
+    pub fn request_close_tab(&mut self, index: usize) {
+        // Text typed into a field counts as an unsaved change.
+        if self.has_unsaved_work(index)
+            && let Some(id) = self.views.get(index).map(|v| v.id)
+        {
+            self.close_request = Some(CloseRequest::Tab(id));
+        } else {
+            self.close_tab(index);
+        }
+    }
+
+    /// File ▸ Close all: clean documents close at once; each one with unsaved changes asks.
+    pub fn close_all(&mut self) {
+        for i in (0..self.views.len()).rev() {
+            if !self.has_unsaved_work(i) {
+                self.close_tab(i);
+            }
+        }
+        if self.first_dirty().is_some() {
+            self.close_request = Some(CloseRequest::All);
+        }
+    }
+
+    /// File ▸ Revert (after the confirmation).
+    pub fn revert_active(&mut self) {
+        let Some((_, id)) = self.active_ids() else { return };
+        match self.session.revert(id) {
+            Ok(()) => {
+                if let Some(i) = self.active
+                    && let Some(d) = self.session.get(id)
+                {
+                    let view = &mut self.views[i];
+                    view.document_changed(&d.info);
+                    // Revert discards this source's uncommitted typing as well as model edits.
+                    // Otherwise a later Save could write a rejected draft back into the file.
+                    view.forms.focus = None;
+                    view.forms.committed = None;
+                    view.forms.unbaked.clear();
+                    view.pending_edit = None;
+                }
+                self.notify_tr("Reverted to the last saved version");
+            }
+            Err(e) => self.notify_error(e),
+        }
+    }
+
+    /// The first tab with unsaved changes.
+    pub fn first_dirty(&self) -> Option<usize> {
+        (0..self.views.len()).find(|&i| self.has_unsaved_work(i))
+    }
+
+    /// Answer the save prompt: `Some(true)` save, `Some(false)` discard, `None` cancel.
+    pub fn resolve_close(&mut self, ctx: &egui::Context, choice: Option<bool>) {
+        let Some(req) = self.close_request.take() else { return };
+        // The next question (another dirty document) starts on Save again.
+        self.save_prompt_button = Default::default();
+        let index = match req {
+            CloseRequest::Tab(id) => match self.views.iter().position(|v| v.id == id) {
+                Some(i) => i,
+                None => return, // already closed
+            },
+            CloseRequest::Quit | CloseRequest::All => match self.first_dirty() {
+                Some(i) => i,
+                None => {
+                    if req == CloseRequest::Quit {
+                        self.quit(ctx);
+                    }
+                    return;
+                }
+            },
+        };
+        // Quitting closes the unsaved tabs one by one (and brings each forward to save it):
+        // remember what was open, and which tab was active, before the first one goes (#442).
+        if req == CloseRequest::Quit {
+            match choice {
+                Some(_) => self.note_quit_session(),
+                None => self.forget_quit_session(),
+            }
+        }
+        match choice {
+            None => {} // cancelled: nothing closes
+            Some(false) => self.close_and_continue(ctx, index, req),
+            Some(true) => {
+                let Some(id) = self.views.get(index).map(|v| v.id) else { return };
+                // Bring the document forward: what's typed in its form is committed and saved
+                // with it, and a field that rejects the value is shown where the user can fix it.
+                self.active = Some(index);
+                // Close only once the save has actually been written, which may be on a later
+                // frame when the user has to choose where. A failed or cancelled save keeps the
+                // document open.
+                let ctx = ctx.clone();
+                self.save_then(index, SaveTarget::InPlace, move |app| {
+                    if let Some(i) = app.views.iter().position(|v| v.id == id) {
+                        app.close_and_continue(&ctx, i, req);
+                    }
+                });
+            }
+        }
+    }
+
+    /// Close tab `index` for a close request, then ask about the next dirty document, or quit.
+    pub(super) fn close_and_continue(&mut self, ctx: &egui::Context, index: usize, req: CloseRequest) {
+        self.close_tab(index);
+        // A newer prompt wins: the user may have started another close while a save was pending,
+        // and seen its question, which keeps counting as seen.
+        if (req == CloseRequest::Quit || req == CloseRequest::All) && self.close_request.is_none() {
+            match self.first_dirty() {
+                Some(_) => {
+                    // A question about the next document is a new one.
+                    self.save_prompt_seen = false;
+                    self.close_request = Some(req);
+                }
+                None if req == CloseRequest::Quit => self.quit(ctx),
+                None => {}
+            }
+        }
+    }
+
+    /// Request a normal application exit, preserving every unsaved document until answered.
+    /// Returns false while the existing save/discard/cancel prompt needs a decision.
+    pub(crate) fn request_quit(&mut self, ctx: &egui::Context) -> bool {
+        if self.first_dirty().is_some() {
+            self.close_request = Some(CloseRequest::Quit);
+            ctx.request_repaint();
+            false
+        } else {
+            self.shutdown_recovery();
+            self.quit(ctx);
+            true
+        }
+    }
+
+    fn quit(&mut self, ctx: &egui::Context) {
+        self.allow_quit = true;
+        ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+    }
+
+    /// Publish whether any document has unsaved work, for the browser's reload warning (#812).
+    pub(crate) fn sync_unsaved_flag(&self) {
+        self.unsaved_flag.store(self.first_dirty().is_some(), std::sync::atomic::Ordering::Relaxed);
+    }
+
+    /// Intercept window close while documents have unsaved changes.
+    pub(crate) fn guard_quit(&mut self, ctx: &egui::Context) {
+        // egui's default quit shortcut ignores extra Alt/Shift, including Ctrl+Alt+Q for '@'.
+        ctx.options_mut(|o| o.quit_shortcuts.clear());
+        let shortcut = ctx.input(|i| {
+            i.events.iter().any(|e| {
+                matches!(e, egui::Event::Key { key: egui::Key::Q, pressed: true, modifiers, .. }
+                    if modifiers.matches_exact(egui::Modifiers::COMMAND))
+            })
+        });
+        if shortcut {
+            self.request_quit(ctx);
+        }
+        self.sync_unsaved_flag();
+        if !ctx.input(|i| i.viewport().close_requested()) {
+            return;
+        }
+        // `first_dirty` counts text typed into a field as an unsaved change.
+        if !self.allow_quit && self.first_dirty().is_some() {
+            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
+            self.close_request = Some(CloseRequest::Quit);
+        } else {
+            // A clean quit: nothing is left to recover.
+            self.shutdown_recovery();
+        }
+    }
+
+    /// Ask for the user's attention when the "save changes?" question opens while PdfCraft is in
+    /// the background (Quit in the Dock menu, logging out, or an agent quitting), and withdraw the
+    /// request once the user comes back or the question is answered.
+    ///
+    /// The question holds up the quit the user asked for, so the request is critical, as AppKit
+    /// makes it for a modal panel that an inactive app presents: the Dock icon bounces until
+    /// PdfCraft is active, Windows flashes the taskbar button until the window is in front, and
+    /// X11 sets the urgency hint, which stays until it is reset. A question that opens in front
+    /// asks nothing, and neither does leaving it open: the user has seen it. Each document asked
+    /// about when quitting is a new question, so one that opens in the background asks even after
+    /// a question the user saw; a request that still stands carries over to it.
+    pub(crate) fn attend_save_prompt(&mut self, ctx: &egui::Context) {
+        let open = self.close_request.is_some();
+        let focused = ctx.input(|i| i.focused);
+        if self.save_prompt_attention {
+            if focused || !open {
+                ctx.send_viewport_cmd(egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Reset));
+                self.save_prompt_attention = false;
+            }
+        } else if open && !self.save_prompt_seen && !focused {
+            ctx.send_viewport_cmd(egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Critical));
+            self.save_prompt_attention = true;
+        }
+        self.save_prompt_seen = open;
+    }
+}
diff --git a/crates/ui-egui/src/editing/save.rs b/crates/ui-egui/src/editing/save.rs
new file mode 100644
index 0000000000..59eba1fbc6
--- /dev/null
+++ b/crates/ui-egui/src/editing/save.rs
@@ -0,0 +1,304 @@
+use super::*;
+
+/// A save held back by [`Dialog::OverwriteChanged`](crate::Dialog::OverwriteChanged): the file
+/// on disk is another version than the document came from (#2166).
+#[cfg(not(target_arch = "wasm32"))]
+pub struct PendingOverwrite {
+    pub id: pdfcraft_engine::DocId,
+    pub dest: String,
+    target: SaveTarget,
+    /// What was to run once the document is written (close its tab, quit).
+    after: Box<dyn FnOnce(&mut PdfCraftApp) + Send>,
+}
+
+/// Where Save writes.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SaveTarget {
+    /// The file's own path; asks for one if the document has none (e.g. opened from bytes).
+    InPlace,
+    /// Always ask for a new location.
+    As,
+}
+
+impl PdfCraftApp {
+    /// Save the active document. Returns `true` if it was written.
+    pub fn save_active(&mut self, target: SaveTarget) -> bool {
+        match self.active {
+            Some(i) => self.save_view(i, target),
+            None => false,
+        }
+    }
+
+    /// Save the document shown in tab `index`. Returns `true` if it was written now. When it has
+    /// to ask where (a new document, or Save As) it returns `false` and saves on a later frame,
+    /// once the user has chosen.
+    pub fn save_view(&mut self, index: usize, target: SaveTarget) -> bool {
+        self.save_then(index, target, |_| {})
+    }
+
+    /// [`Self::save_view`], then `after` once the document is written: now, or on a later frame
+    /// when the user had to choose where. `after` never runs when the save fails or is cancelled.
+    pub(crate) fn save_then(&mut self, index: usize, target: SaveTarget, after: impl FnOnce(&mut Self) + Send + 'static) -> bool {
+        // What's typed in a field is part of what's saved (#166).
+        if let Some(id) = self.views.get(index).map(|v| v.id)
+            && !self.commit_typing_in(id)
+        {
+            return false;
+        }
+        let Some(id) = self.views.get(index).map(|v| v.id) else { return false };
+        let Some(doc) = self.session.get(id) else { return false };
+        let (name, path) = (doc.name.clone(), doc.path.clone());
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let doc_path = path.clone();
+            let destination = match (target, path, &self.save_override) {
+                (_, _, Some(p)) => p.clone(),
+                // An email attachment's temporary copy is no place to keep work: ask, as for a new
+                // document (`is_mail_temp_copy`).
+                (SaveTarget::InPlace, Some(p), _) if !is_mail_temp_copy(&p) => p,
+                _ => {
+                    let name = if name.to_ascii_lowercase().ends_with(".pdf") { name } else { format!("{name}.pdf") };
+                    let dialog = rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).set_file_name(name);
+                    let dialog = in_document_folder(dialog, doc_path.as_deref());
+                    // The bytes are taken once the user has chosen, so edits made meanwhile are saved too.
+                    self.ask_one(crate::pickers::Ask::Save(dialog), None, move |app, dest| {
+                        app.save_doc_to_then(id, &dest.to_string_lossy(), target, Box::new(after));
+                    });
+                    return false;
+                }
+            };
+            self.save_doc_to_then(id, &destination, target, Box::new(after))
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            let _ = path;
+            if !self.flatten_fill_sign_for_save(id) {
+                return false;
+            }
+            let bytes = match self.session.save_bytes(id) {
+                Ok(b) => b,
+                Err(e) => {
+                    self.notify_fmt("Couldn't save {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
+                    return false;
+                }
+            };
+            // An embedding page that asked for saves (`?host=parent`) gets the bytes; otherwise
+            // the browser downloads them.
+            let to_host = self.host_save.is_some();
+            let delivered = match &self.host_save {
+                Some(save) => save(&name, &bytes, matches!(target, SaveTarget::As)),
+                None => download(&name, &bytes),
+            };
+            match delivered {
+                Ok(()) => {
+                    let _ = self.session.mark_saved(id, bytes, None);
+                    if let Some(doc) = self.session.get(id)
+                        && let Some(view) = self.views.get_mut(index)
+                    {
+                        view.document_changed(&doc.info);
+                    }
+                    // The host reports where the file went (and any failure) itself.
+                    if !to_host {
+                        self.notify_fmt("Downloaded {name}", &[("name", &name)]);
+                    }
+                    after(self);
+                    true
+                }
+                Err(e) if to_host => {
+                    self.notify_fmt("Couldn't save {name}: {e}", &[("name", &name), ("e", &e)]);
+                    false
+                }
+                Err(e) => {
+                    self.notify_fmt("Couldn't download {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
+                    false
+                }
+            }
+        }
+    }
+
+    /// [`Self::save_doc_to`], then `after`. When `dest` is the document's own file and it is
+    /// another version on disk than the one the document came from (something else wrote it
+    /// since the open or the last save, #2166), it asks first: the save waits in
+    /// `pending_overwrite` behind [`Dialog::OverwriteChanged`](crate::Dialog::OverwriteChanged).
+    /// Returns `true` if written now.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn save_doc_to_then(&mut self, id: pdfcraft_engine::DocId, dest: &str, target: SaveTarget, after: Box<dyn FnOnce(&mut Self) + Send>) -> bool {
+        let own = self.session.get(id).and_then(|d| d.path.as_deref()).is_some_and(|p| crate::same_file(p, dest));
+        if own && self.watch.disk_differs(id, dest, self.session.get(id).map(|d| d.saved_bytes())) {
+            self.pending_overwrite = Some(PendingOverwrite { id, dest: dest.to_string(), target, after });
+            self.dialog = Some(crate::Dialog::OverwriteChanged);
+            return false;
+        }
+        let saved = self.save_doc_to(id, dest, target);
+        if saved {
+            after(self);
+        }
+        saved
+    }
+
+    /// The dialog's Save anyway: write over the changed file.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn overwrite_changed_file(&mut self) {
+        let Some(p) = self.pending_overwrite.take() else { return };
+        if self.save_doc_to(p.id, &p.dest, p.target) {
+            (p.after)(self);
+        }
+    }
+
+    /// The dialog's Save as…: leave the file on disk as it is and ask where to put this version.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn save_changed_file_elsewhere(&mut self) {
+        let Some(p) = self.pending_overwrite.take() else { return };
+        if let Some(index) = self.views.iter().position(|v| v.id == p.id) {
+            self.save_then(index, SaveTarget::As, p.after);
+        }
+    }
+
+    /// Write document `id` to `dest` and make it the document's file. Returns `true` if written.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn save_doc_to(&mut self, id: pdfcraft_engine::DocId, dest: &str, target: SaveTarget) -> bool {
+        // Save As answers on a later frame: commit what was typed meanwhile, too (#166), even
+        // if another tab is active by then.
+        if !self.commit_typing_in(id) || !self.flatten_fill_sign_for_save(id) {
+            return false;
+        }
+        let Some((name, full)) = self.session.get(id).map(|d| {
+            // Save As to another file is a clean copy, without the earlier revisions that still
+            // hold deleted pages or replaced text (#2165). A signed document stays incremental so
+            // its signatures keep covering the file.
+            let full = target == SaveTarget::As
+                && !d.path.as_deref().is_some_and(|p| crate::same_file(p, dest))
+                && d.read_only_reason.is_none()
+                && !d.is_signed();
+            (d.name.clone(), full)
+        }) else {
+            self.notify_tr("The document was closed before it could be saved.");
+            return false;
+        };
+        let bytes = if full { self.session.save_full_bytes(id) } else { self.session.save_bytes(id) };
+        let bytes = match bytes.and_then(|b| self.session.check_save(id, &b).map(|()| b)) {
+            Ok(b) => b,
+            Err(e) => {
+                self.notify_fmt("Couldn't save {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
+                return false;
+            }
+        };
+        if let Err(e) = write_atomically(dest, &bytes) {
+            self.notify_fmt("Couldn't save {name}: {e}", &[("name", dest), ("e", &e.to_string())]);
+            return false;
+        }
+        // Our own write is not a change on disk to reload (#431).
+        self.watch.known_now(id, dest);
+        match self.session.mark_saved(id, bytes, Some(dest.to_string())) {
+            Ok(()) => {
+                self.forget_recovery(id);
+                if let Some(doc) = self.session.get(id)
+                    && let Some(view) = self.views.iter_mut().find(|v| v.id == id)
+                {
+                    view.document_changed(&doc.info);
+                    // Saving over a version that changed on disk keeps this one: nothing to ask.
+                    view.disk_changed = false;
+                }
+                self.notify_fmt("Saved {name}", &[("name", &short_name(dest))]);
+                #[cfg(target_os = "macos")]
+                crate::macos_association::repair(std::path::Path::new(dest));
+                true
+            }
+            Err(e) => {
+                self.notify_fmt("Saved, but reopening failed: {e}", &[("e", &e.to_string())]);
+                false
+            }
+        }
+    }
+}
+
+/// Whether `path` is the temporary copy an email client opened an attachment from, so that Save
+/// asks where to keep the document instead of writing to it.
+///
+/// Outlook opens an attachment from its own cache: `INetCache\Content.Outlook\<random>\` for
+/// classic Outlook (`Temporary Internet Files\Content.Outlook\` on older Windows), and the
+/// `Packages\Microsoft.OutlookForWindows_<id>` package folder for the new Outlook. The patterns
+/// follow those layouts, so an ordinary folder that merely shares a name doesn't match. Saving there either fails,
+/// because Outlook can still hold the file, or appears to work while the edits stay out of the
+/// email and are deleted with the cache. Apple Mail opens one from `Mail Downloads/<UUID>/` in
+/// its sandbox container, where other apps can't write, so saving there fails (#2751). Matched on
+/// either separator and in any case, so it can be tested on every platform.
+pub(crate) fn is_mail_temp_copy(path: &str) -> bool {
+    let p = path.replace('\\', "/").to_ascii_lowercase();
+    // Outlook's cache holds `<marker><random folder>/<file>`: exactly one folder, then the file.
+    let in_outlook_cache = |marker: &str| {
+        p.split_once(marker)
+            .is_some_and(|(_, rest)| matches!(rest.split('/').collect::<Vec<_>>()[..], [dir, file] if !dir.is_empty() && !file.is_empty()))
+    };
+    in_outlook_cache("/inetcache/content.outlook/")
+        || in_outlook_cache("/temporary internet files/content.outlook/")
+        || p.contains("/packages/microsoft.outlookforwindows_")
+        || p.contains("/library/containers/com.apple.mail/data/library/mail downloads/")
+}
+
+/// The folder a Save As style dialog should open in for a document stored at `path`: the
+/// document's own folder, as Acrobat and Foxit do, instead of whichever folder the system picks.
+/// `None` (keep the system's choice) for a new document, a path with no parent, or an email
+/// attachment's temporary copy (`is_mail_temp_copy`), which is no place to keep work. Also right
+/// for UNC paths on Windows (`\\server\share\dir\f.pdf` gives `\\server\share\dir`).
+pub(crate) fn save_dialog_folder(path: Option<&str>) -> Option<std::path::PathBuf> {
+    let path = path.filter(|p| !is_mail_temp_copy(p))?;
+    let parent = std::path::Path::new(path).parent()?;
+    (!parent.as_os_str().is_empty()).then(|| parent.to_path_buf())
+}
+
+/// `dialog` opened in the folder of the document stored at `path` ([`save_dialog_folder`]).
+pub(crate) fn in_document_folder(dialog: rfd::AsyncFileDialog, path: Option<&str>) -> rfd::AsyncFileDialog {
+    match save_dialog_folder(path) {
+        Some(dir) => dialog.set_directory(dir),
+        None => dialog,
+    }
+}
+
+/// Write via a temporary file in the same directory and rename over the target, so a crash or
+/// full disk never leaves a half-written PDF where the original was.
+pub fn write_atomically(path: &str, bytes: &[u8]) -> std::io::Result<()> {
+    write_atomically_with(path, bytes, staging_suffixes())
+}
+
+/// [`write_atomically`], trying the staging names that `suffixes` give.
+pub(super) fn write_atomically_with(path: &str, bytes: &[u8], suffixes: impl IntoIterator<Item = u64>) -> std::io::Result<()> {
+    write_atomically_syncing(path, bytes, suffixes, std::fs::File::sync_all)
+}
+
+/// [`write_atomically_with`], flushing the staging file with `sync_all` (the standard library's
+/// in the app, a failing one in tests). The writer itself is the platform crate's, shared with
+/// the tools and the CLI (#2166); the desktop app keeps its staging-name form.
+pub(super) fn write_atomically_syncing(
+    path: &str,
+    bytes: &[u8],
+    suffixes: impl IntoIterator<Item = u64>,
+    sync_all: impl FnOnce(&std::fs::File) -> std::io::Result<()>,
+) -> std::io::Result<()> {
+    pdfcraft_platform::staging::write_atomically_with(std::path::Path::new(path), bytes, StagingName::TagThenSuffix, suffixes, sync_all)
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn short_name(path: &str) -> String {
+    std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string())
+}
+
+/// Offer bytes as a browser download.
+#[cfg(target_arch = "wasm32")]
+pub(crate) fn download(name: &str, bytes: &[u8]) -> Result<(), String> {
+    use wasm_bindgen::JsCast;
+    let err = |e: wasm_bindgen::JsValue| format!("{e:?}");
+    let array = js_sys::Uint8Array::from(bytes);
+    let parts = js_sys::Array::of1(&array);
+    let opts = web_sys::BlobPropertyBag::new();
+    opts.set_type("application/pdf");
+    let blob = web_sys::Blob::new_with_u8_array_sequence_and_options(&parts, &opts).map_err(err)?;
+    let url = web_sys::Url::create_object_url_with_blob(&blob).map_err(err)?;
+    let document = web_sys::window().and_then(|w| w.document()).ok_or("no document")?;
+    let a: web_sys::HtmlAnchorElement = document.create_element("a").map_err(err)?.dyn_into().map_err(|_| "anchor")?;
+    a.set_href(&url);
+    a.set_download(name);
+    a.click();
+    let _ = web_sys::Url::revoke_object_url(&url);
+    Ok(())
+}
diff --git a/crates/ui-egui/src/editing/tests.rs b/crates/ui-egui/src/editing/tests.rs
new file mode 100644
index 0000000000..87de7e8b87
--- /dev/null
+++ b/crates/ui-egui/src/editing/tests.rs
@@ -0,0 +1,345 @@
+use super::{SaveTarget, is_mail_temp_copy, save_dialog_folder, write_atomically, write_atomically_syncing, write_atomically_with};
+
+#[test]
+fn save_dialogs_open_in_the_documents_folder() {
+    use std::path::PathBuf;
+    assert_eq!(save_dialog_folder(Some("/home/a/plans/f.pdf")), Some(PathBuf::from("/home/a/plans")));
+    // A new document has no folder yet; a bare name has an empty parent; the root has none.
+    assert_eq!(save_dialog_folder(None), None);
+    assert_eq!(save_dialog_folder(Some("f.pdf")), None);
+    assert_eq!(save_dialog_folder(Some("/")), None);
+    // An email attachment's temporary copy is not offered.
+    assert_eq!(save_dialog_folder(Some("C:\\Users\\a\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\AB12\\f.pdf")), None);
+    assert_eq!(save_dialog_folder(Some("/Users/a/Library/Containers/com.apple.mail/Data/Library/Mail Downloads/UUID/f.pdf")), None);
+}
+
+/// The Windows rules for `Path::parent` (UNC share roots included) only apply on Windows.
+#[cfg(windows)]
+#[test]
+fn save_dialog_folder_handles_unc_paths() {
+    use std::path::PathBuf;
+    assert_eq!(save_dialog_folder(Some(r"\\nas\projets\2026\f.pdf")), Some(PathBuf::from(r"\\nas\projets\2026")));
+    assert_eq!(save_dialog_folder(Some(r"\\nas\projets\f.pdf")), Some(PathBuf::from(r"\\nas\projets\")));
+    assert_eq!(save_dialog_folder(Some(r"\\nas\projets")), None);
+    assert_eq!(save_dialog_folder(Some(r"C:\Users\a\f.pdf")), Some(PathBuf::from(r"C:\Users\a")));
+}
+use pdfcraft_platform::staging::{STAGING_ATTEMPTS, staging_suffixes};
+use std::path::{Path, PathBuf};
+
+/// A fresh, empty folder for one staging test.
+fn staging_dir(test: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-ui-staging-{}-{test}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+fn staged(dir: &Path, suffix: u64) -> PathBuf {
+    dir.join(format!(".out.pdf.pdfcraft-{suffix:016x}.tmp"))
+}
+
+fn read(p: &Path) -> String {
+    std::fs::read_to_string(p).unwrap()
+}
+
+/// A symbolic link to a file, where the system allows one (Windows needs Developer Mode or an
+/// administrator for it).
+fn file_symlink(target: &Path, link: &Path) -> std::io::Result<()> {
+    #[cfg(unix)]
+    {
+        std::os::unix::fs::symlink(target, link)
+    }
+    #[cfg(windows)]
+    {
+        std::os::windows::fs::symlink_file(target, link)
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        Err(std::io::Error::other(format!("no symbolic links here: {} {}", target.display(), link.display())))
+    }
+}
+
+#[test]
+fn saving_never_writes_through_a_file_planted_at_the_staging_name() {
+    let dir = staging_dir("planted");
+    let outside = dir.join("outside.txt");
+    std::fs::write(&outside, "PRECIOUS").unwrap();
+    let target = dir.join("out.pdf");
+    let path = target.to_string_lossy().into_owned();
+    // A hard link needs no privileges on any system, and writing to it writes to `outside`.
+    std::fs::hard_link(&outside, staged(&dir, 1)).unwrap();
+    std::fs::write(staged(&dir, 2), "PLANTED").unwrap();
+    write_atomically_with(&path, b"NEW", [1, 2, 3]).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert_eq!(read(&outside), "PRECIOUS");
+    assert_eq!(read(&staged(&dir, 1)), "PRECIOUS");
+    assert_eq!(read(&staged(&dir, 2)), "PLANTED");
+    assert!(!staged(&dir, 3).exists(), "the staging file was renamed into place");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn saving_never_writes_through_a_symbolic_link_at_the_staging_name() {
+    let dir = staging_dir("symlink");
+    let outside = dir.join("outside.txt");
+    std::fs::write(&outside, "PRECIOUS").unwrap();
+    let target = dir.join("out.pdf");
+    if let Err(e) = file_symlink(&outside, &staged(&dir, 1)) {
+        eprintln!("symbolic links not checked: {e}");
+        return;
+    }
+    write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert_eq!(read(&outside), "PRECIOUS");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn saving_never_creates_a_file_through_a_dangling_link_at_the_staging_name() {
+    let dir = staging_dir("dangling");
+    let unborn = dir.join("created-through-a-link.txt");
+    let target = dir.join("out.pdf");
+    if let Err(e) = file_symlink(&unborn, &staged(&dir, 1)) {
+        eprintln!("symbolic links not checked: {e}");
+        return;
+    }
+    write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert!(!unborn.exists(), "nothing was created through the dangling link");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_folder_at_the_staging_name_is_left_alone() {
+    let dir = staging_dir("folder");
+    std::fs::create_dir(staged(&dir, 1)).unwrap();
+    std::fs::write(staged(&dir, 1).join("inside.txt"), "PLANTED").unwrap();
+    let target = dir.join("out.pdf");
+    write_atomically_with(&target.to_string_lossy(), b"NEW", [1, 2]).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert_eq!(read(&staged(&dir, 1).join("inside.txt")), "PLANTED");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn saving_gives_up_rather_than_reuse_a_taken_name() {
+    let dir = staging_dir("taken");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, "OLD").unwrap();
+    for s in 1..=STAGING_ATTEMPTS as u64 {
+        std::fs::write(staged(&dir, s), "PLANTED").unwrap();
+    }
+    assert!(write_atomically_with(&target.to_string_lossy(), b"NEW", 1..).is_err());
+    assert_eq!(read(&target), "OLD");
+    for s in 1..=STAGING_ATTEMPTS as u64 {
+        assert_eq!(read(&staged(&dir, s)), "PLANTED");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// The names in a folder: what a test can see was left behind.
+fn listing(dir: &Path) -> Vec<String> {
+    let mut names: Vec<_> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    names.sort();
+    names
+}
+
+#[test]
+fn saving_a_long_name_leaves_only_the_saved_file() {
+    assert_ne!(staging_suffixes().next(), staging_suffixes().next(), "each save draws new names");
+    // 60 four-byte characters: a 244-byte name, within every system's limit. Its staging name
+    // must be too (on Linux the whole name in it would be 275 bytes).
+    let dir = staging_dir("clean");
+    let name = format!("{}.pdf", "\u{1F600}".repeat(60));
+    let path = dir.join(&name).to_string_lossy().into_owned();
+    write_atomically(&path, b"NEW").unwrap();
+    write_atomically(&path, b"NEWER").unwrap();
+    assert_eq!(read(&dir.join(&name)), "NEWER");
+    assert_eq!(listing(&dir), [name], "no staging file is left behind");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A read-only target is refused before anything is staged, so no staging file is left
+/// behind.
+#[cfg(windows)]
+#[test]
+fn a_failed_save_removes_the_staging_file() {
+    let dir = staging_dir("readonly");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, "OLD").unwrap();
+    let mut perms = std::fs::metadata(&target).unwrap().permissions();
+    perms.set_readonly(true);
+    std::fs::set_permissions(&target, perms.clone()).unwrap();
+    let e = write_atomically_with(&target.to_string_lossy(), b"NEW", [7]).unwrap_err();
+    assert_eq!(e.kind(), std::io::ErrorKind::PermissionDenied, "a read-only target is refused: {e}");
+    assert_eq!(read(&target), "OLD");
+    assert_eq!(listing(&dir), ["out.pdf"], "the staging file was removed");
+    #[allow(clippy::permissions_set_readonly_false)]
+    perms.set_readonly(false);
+    std::fs::set_permissions(&target, perms).unwrap();
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// On macOS `sync_all` asks for a full flush, which SMB and FUSE volumes (a Cryptomator vault,
+/// #981) refuse as unsupported: ENOTSUP (45) or ENOTTY (25). The save still goes through.
+#[cfg(target_os = "macos")]
+#[test]
+fn a_volume_without_full_flush_still_saves() {
+    for errno in [45, 25] {
+        let dir = staging_dir(&format!("nofullsync-{errno}"));
+        let target = dir.join("out.pdf");
+        std::fs::write(&target, "OLD").unwrap();
+        let asked = std::cell::Cell::new(false);
+        let refuse = |_: &std::fs::File| {
+            asked.set(true);
+            Err(std::io::Error::from_raw_os_error(errno))
+        };
+        write_atomically_syncing(&target.to_string_lossy(), b"NEW", [7], refuse).unwrap();
+        assert!(asked.get(), "the full flush was tried");
+        assert_eq!(read(&target), "NEW");
+        assert_eq!(listing(&dir), ["out.pdf"], "no staging file is left behind");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
+
+/// Only "not supported" is let through: any other flush failure fails the save and keeps the
+/// original.
+#[test]
+fn a_failed_flush_keeps_the_original() {
+    let dir = staging_dir("syncfails");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, "OLD").unwrap();
+    let e = write_atomically_syncing(&target.to_string_lossy(), b"NEW", [7], |_| Err(std::io::Error::other("disk gone"))).unwrap_err();
+    assert_eq!(e.to_string(), "disk gone");
+    assert_eq!(read(&target), "OLD");
+    assert_eq!(listing(&dir), ["out.pdf"], "the staging file was removed");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn a_save_preserves_opening_settings_changed_while_staging() {
+    let dir = staging_dir("opening-metadata-changed");
+    let target = dir.join("out.pdf");
+    std::fs::write(&target, b"OLD").unwrap();
+    xattr::set(&target, "com.apple.LaunchServices.OpenWith", b"old handler").unwrap();
+    xattr::set(&target, "com.apple.quarantine", b"0082;1234;Preview;").unwrap();
+    let suffixes = std::iter::once_with(|| {
+        xattr::set(&target, "com.apple.LaunchServices.OpenWith", b"new handler").unwrap();
+        xattr::set(&target, "com.apple.quarantine", b"0082;5678;another app;").unwrap();
+        7
+    });
+    write_atomically_with(&target.to_string_lossy(), b"NEW", suffixes).unwrap();
+    assert_eq!(read(&target), "NEW");
+    assert_eq!(xattr::get(&target, "com.apple.LaunchServices.OpenWith").unwrap(), Some(b"new handler".to_vec()));
+    assert_eq!(xattr::get(&target, "com.apple.quarantine").unwrap(), Some(b"0082;5678;another app;".to_vec()));
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+#[test]
+fn outlook_attachment_copies_are_recognised_on_either_separator_and_in_any_case() {
+    for p in [
+        r"C:\Users\me\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AB12CD34\Quote.pdf",
+        r"c:\users\me\appdata\local\microsoft\windows\inetcache\content.outlook\ab12cd34\quote (2).pdf",
+        r"C:\Users\me\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\AB12CD34\Quote.pdf",
+        r"C:\Users\me\AppData\Local\Packages\Microsoft.OutlookForWindows_8wekyb3d8bbwe\LocalCache\Quote.pdf",
+        "C:/Users/me/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/AB12CD34/Quote.pdf",
+    ] {
+        assert!(is_mail_temp_copy(p), "{p}");
+    }
+}
+
+#[test]
+fn apple_mail_attachment_copies_are_recognised() {
+    for p in [
+        "/Users/me/Library/Containers/com.apple.mail/Data/Library/Mail Downloads/6F1C2A9E-3B4D-4E5F-8A7B-9C0D1E2F3A4B/booking.pdf",
+        "/Users/me/library/containers/COM.APPLE.MAIL/data/library/mail downloads/6F1C2A9E/Booking (2).pdf",
+    ] {
+        assert!(is_mail_temp_copy(p), "{p}");
+    }
+}
+
+#[test]
+fn ordinary_paths_are_not_mail_copies() {
+    for p in [
+        r"C:\Users\me\Documents\Quote.pdf",
+        r"C:\Users\me\OneDrive - Contoso\Content.Outlook notes\Quote.pdf",
+        r"C:\Users\me\AppData\Local\Microsoft\Windows\INetCache\IE\Quote.pdf",
+        "/home/microsoft.outlookforwindows/report.pdf",
+        "/x/inetcache/content.outlook/y.pdf",
+        "/x/temporary internet files/content.outlook/y.pdf",
+        "/home/me/Documents/Quote.pdf",
+        "/Users/me/Downloads/Mail Downloads/booking.pdf",
+        "/Users/me/Library/Containers/com.apple.Notes/Data/Library/Mail Downloads/booking.pdf",
+        "Quote.pdf",
+    ] {
+        assert!(!is_mail_temp_copy(p), "{p}");
+    }
+}
+
+/// A one-page document with a proper xref table.
+fn one_page_pdf() -> Vec<u8> {
+    let objs =
+        ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>", "<< /Type /Page /Parent 2 0 R >>"];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn save_commits_the_open_text_box() {
+    let dir = staging_dir("open-text-box");
+    let dest = dir.join("out.pdf");
+    let mut app = crate::PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
+    app.open_bytes("a.pdf", None, one_page_pdf()).unwrap();
+    app.save_override = Some(dest.to_string_lossy().into_owned());
+    let style = crate::content_ui::default_style();
+    app.views[0].content.draft =
+        Some(crate::content_ui::TextDraft { page: 0, index: None, rect: [20.0, 20.0, 120.0, 40.0], text: "Typed text".into(), style, focus: true });
+
+    assert!(app.save_active(SaveTarget::InPlace));
+    let id = app.views[0].id;
+    let added = app.session.get(id).unwrap().added();
+    assert_eq!(added.len(), 1, "the open text box was committed before the save");
+    assert!(app.views[0].content.draft.is_none());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn save_asks_where_to_keep_an_email_attachment_and_leaves_the_temporary_copy_alone() {
+    let dir = staging_dir("mail-temp");
+    let cache = dir.join("INetCache").join("Content.Outlook").join("AB12CD34");
+    std::fs::create_dir_all(&cache).unwrap();
+    let attachment = cache.join("Quote.pdf");
+    let original = one_page_pdf();
+    std::fs::write(&attachment, &original).unwrap();
+    let kept = dir.join("Quote.pdf");
+
+    let mut app = crate::PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
+    app.open_bytes("Quote.pdf", Some(attachment.to_string_lossy().into_owned()), original.clone()).unwrap();
+    assert!(app.apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 }));
+    app.pick_override = Some(vec![kept.to_string_lossy().into_owned()]);
+
+    assert!(!app.save_active(SaveTarget::InPlace), "Save asks instead of writing the temporary copy");
+    app.process_picked();
+    assert_eq!(std::fs::read(&attachment).unwrap(), original, "the attachment's copy is untouched");
+    assert!(std::fs::read(&kept).unwrap().starts_with(b"%PDF"), "the document went where the user chose");
+
+    // The chosen file is the document's file now: the next Save writes it without asking.
+    app.pick_override = None;
+    assert!(app.apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 }));
+    assert!(app.save_active(SaveTarget::InPlace));
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index 3e70f34e42..390b059228 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -7,10 +7,12 @@ use pdfcraft_engine::catalog;
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, icons, panels::human_size, widgets};
 
+pub mod folders_ui;
+
 const RECOMMENDED: [&str; 5] = ["organize", "comment", "form", "edit", "protect"];
 
 /// A soft shadow that rises on hover and settles when the card is pressed.
-fn card_lift(ui: &egui::Ui, t: &Tokens, rect: Rect, press: theme::Press) {
+pub(crate) fn card_lift(ui: &egui::Ui, t: &Tokens, rect: Rect, press: theme::Press) {
     let lift = press.hover * (1.0 - press.down);
     if lift > 0.04 {
         let shadow = egui::Shadow { offset: [0, 3], blur: (14.0 * lift) as u8, spread: 0, color: t.page_shadow.gamma_multiply(0.85 * lift) };
@@ -18,6 +20,7 @@ fn card_lift(ui: &egui::Ui, t: &Tokens, rect: Rect, press: theme::Press) {
     }
 }
 
+/// Draw the Home page with the welcome text, community card and recent documents.
 pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
@@ -29,26 +32,34 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     .font(theme::regular(14.0)),
             );
             ui.add_space(14.0);
-            egui::Frame::NONE
-                .fill(t.card)
-                .stroke(Stroke::new(1.0, t.border))
-                .corner_radius(CornerRadius::same(12))
-                .inner_margin(egui::Margin::same(14))
-                .show(ui, |ui| {
-                    ui.set_width(ui.available_width());
-                    ui.horizontal(|ui| {
-                        widgets::artcraft_mark(ui, 28.0);
-                        ui.vertical(|ui| {
-                            ui.label(egui::RichText::new(tl!("Join the ArtCraft community")).font(theme::semibold(15.0)));
-                            ui.label(egui::RichText::new(tl!("Get help, share feedback and follow development on Discord.")).color(t.text_muted));
+            if !app.community_card_closed {
+                egui::Frame::NONE
+                    .fill(t.card)
+                    .stroke(Stroke::new(1.0, t.border))
+                    .corner_radius(CornerRadius::same(12))
+                    .inner_margin(egui::Margin::same(14))
+                    .show(ui, |ui| {
+                        ui.set_width(ui.available_width());
+                        ui.horizontal(|ui| {
+                            widgets::artcraft_mark(ui, 28.0);
+                            ui.vertical(|ui| {
+                                ui.label(egui::RichText::new(tl!("Join the ArtCraft community")).font(theme::semibold(15.0)));
+                                ui.label(egui::RichText::new(tl!("Get help, share feedback and follow development on Discord.")).color(t.text_muted));
+                            });
+                            // Closed for this run only: the card is back on the next launch.
+                            ui.with_layout(egui::Layout::right_to_left(egui::Align::Min), |ui| {
+                                if icons::button(ui, "x", 24.0, false, tl!("Close")).clicked() {
+                                    app.community_card_closed = true;
+                                }
+                            });
                         });
+                        ui.add_space(8.0);
+                        if let Some(cmd) = widgets::community_links(ui) {
+                            app.execute(cmd);
+                        }
                     });
-                    ui.add_space(8.0);
-                    if let Some(cmd) = widgets::community_links(ui) {
-                        app.execute(cmd);
-                    }
-                });
-            ui.add_space(22.0);
+                ui.add_space(22.0);
+            }
 
             egui::Frame::NONE
                 .fill(t.card)
@@ -64,7 +75,7 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                         for id in RECOMMENDED {
                             let Some(g) = catalog::group(id) else { continue };
                             let (rect, resp) = ui.allocate_exact_size(vec2(190.0, 104.0), Sense::click());
-                            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!(g.label)));
+                            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
                             let press = theme::Press::track(ui, &resp);
                             card_lift(ui, &t, rect, press);
                             let fill = press.fill(t.card, t.hover, t.pressed);
@@ -102,7 +113,7 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                             }
                         }
                         let (rect, resp) = ui.allocate_exact_size(vec2(170.0, 104.0), Sense::click());
-                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Open file")));
+                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Open file")));
                         let press = theme::Press::track(ui, &resp);
                         card_lift(ui, &t, rect, press);
                         ui.painter().rect(
@@ -134,7 +145,7 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 if !app.recent.is_empty() {
                     ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                         let resp = widgets::ghost_button(ui, "trash-2", tl!("Clear"));
-                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Clear Recent Files")));
+                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Clear Recent Files")));
                         clear = resp.on_hover_text(tl!("Clear Recent Files")).clicked();
                     });
                 }
@@ -147,7 +158,7 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             let mut remove = None;
             for r in &app.recent {
                 let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 46.0), Sense::click());
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &r.name));
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &r.name));
                 let press = theme::Press::track(ui, &resp);
                 // The row, not its response: the pointer stays "in" the row over its remove button.
                 let hovered = ui.rect_contains_pointer(rect);
@@ -160,9 +171,9 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 if hovered {
                     // Remove just this file from the list (#430); the file itself is untouched.
                     let x_rect = Rect::from_center_size(rect.right_center() - vec2(26.0, 0.0), vec2(28.0, 28.0));
-                    let x = ui.interact(x_rect, ui.id().with(("remove-recent", &r.path)), Sense::click());
+                    let x = ui.interact(x_rect, ui.scope_id().with(("remove-recent", &r.path)), Sense::click());
                     let label = crate::i18n::fmt(tl!("Remove {name} from Recent"), &[("name", &r.name)]);
-                    x.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &label));
+                    x.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &label));
                     if x.hovered() {
                         ui.painter().rect_filled(x_rect, CornerRadius::same(6), t.pressed);
                     }
@@ -189,8 +200,8 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 );
                 // The name and path stop short of the page count; hovering shows the whole path.
                 let width = detail.left() - 16.0 - (body.left() + 46.0);
-                widgets::row_text(ui, body.min + vec2(46.0, 15.0), crate::bidi::visual(&r.name), theme::medium(13.5), t.text, width);
-                widgets::row_text(ui, body.min + vec2(46.0, 32.0), crate::bidi::visual(&r.path), theme::regular(11.0), t.text_faint, width);
+                widgets::row_text(ui, body.min + vec2(46.0, 15.0), r.name.as_str(), theme::medium(13.5), t.text, width);
+                widgets::row_text(ui, body.min + vec2(46.0, 32.0), r.path.as_str(), theme::regular(11.0), t.text_faint, width);
                 if theme::hand(resp).on_hover_text(&r.path).clicked() {
                     open = Some(r.path.clone());
                 }
diff --git a/crates/ui-egui/src/folders_ui.rs b/crates/ui-egui/src/home/folders_ui.rs
similarity index 97%
rename from crates/ui-egui/src/folders_ui.rs
rename to crates/ui-egui/src/home/folders_ui.rs
index 727417e2fc..fe9b2c3706 100644
--- a/crates/ui-egui/src/folders_ui.rs
+++ b/crates/ui-egui/src/home/folders_ui.rs
@@ -314,20 +314,21 @@ pub(crate) fn section(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         ui.horizontal(|ui| {
             let (icon, _) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::hover());
             icons::paint(ui, icon, "folder", 20.0, t.icon);
-            ui.label(egui::RichText::new(crate::bidi::visual(&name)).font(theme::semibold(14.0))).on_hover_text(folder);
+            // Folder names and paths are file/path chrome: explicitly left to right, so an
+            // Arabic location keeps its `.pdf`/extension at the visual end.
+            widgets::label_ltr(ui, name.clone(), theme::semibold(14.0), t.text).on_hover_text(folder);
             ui.add_space(4.0);
             // Leave room for Unpin: a long location is cut short, never the button.
             let room = (ui.available_width() - 110.0).max(0.0);
             ui.scope(|ui| {
                 ui.set_max_width(room);
-                let place = egui::RichText::new(crate::bidi::visual(&location(folder))).font(theme::regular(12.0)).color(t.text_faint);
-                ui.add(egui::Label::new(place).truncate()).on_hover_text(folder);
+                widgets::label_ltr(ui, location(folder), theme::regular(12.0), t.text_faint).on_hover_text(folder);
             });
             ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                 let resp = widgets::ghost_button(ui, "x", tl!("Unpin"));
                 // Every folder has an Unpin button: say which one it is.
                 let label = crate::i18n::fmt(tl!("Unpin {folder}"), &[("folder", &name)]);
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &label));
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &label));
                 if resp.clicked() {
                     unpin = Some(folder.clone());
                 }
@@ -353,7 +354,7 @@ pub(crate) fn section(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         let shown = if expanded { listing.files.len() } else { listing.files.len().min(SHOWN) };
         for f in listing.files.iter().take(shown) {
             let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 38.0), Sense::click());
-            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &f.name));
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &f.name));
             if resp.hovered() {
                 ui.painter().rect_filled(rect, CornerRadius::same(8), t.hover);
             }
@@ -369,7 +370,7 @@ pub(crate) fn section(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             let detail = if when.is_empty() { size } else { format!("{when}  ·  {size}") };
             let detail = ui.painter().text(rect.right_center() - vec2(12.0, 0.0), Align2::RIGHT_CENTER, detail, theme::regular(12.0), t.text_muted);
             let width = detail.left() - 16.0 - (rect.left() + 62.0);
-            widgets::row_text(ui, rect.min + vec2(62.0, 19.0), crate::bidi::visual(&f.name), theme::medium(13.0), t.text, width);
+            widgets::row_text(ui, rect.min + vec2(62.0, 19.0), f.name.as_str(), theme::medium(13.0), t.text, width);
             if resp.on_hover_text(&f.path).clicked() {
                 open = Some(f.path.clone());
             }
diff --git a/crates/ui-egui/src/hooks.rs b/crates/ui-egui/src/hooks.rs
new file mode 100644
index 0000000000..9c6b543831
--- /dev/null
+++ b/crates/ui-egui/src/hooks.rs
@@ -0,0 +1,27 @@
+/// Files delivered asynchronously: (name, bytes).
+pub type Inbox = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<u8>)>>>;
+
+/// Files that failed to arrive asynchronously (a browser `?file=` URL that couldn't be fetched):
+/// `(name, error)`, reported to the user on the next frame (#173).
+pub type FailedInbox = std::sync::Arc<std::sync::Mutex<Vec<(String, String)>>>;
+
+/// A request the operating system sends the running app, outside its window: on macOS, Finder
+/// double-clicks, Open With and drops on the Dock icon arrive as Apple events, not arguments.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum OsEvent {
+    /// Open these files.
+    Open(Vec<String>),
+    /// Quit (the Dock's Quit, logging out), asking about unsaved changes first.
+    Quit,
+}
+
+/// Returns the [`OsEvent`]s that arrived since it was last called (set by the desktop app).
+pub type OsEventsFn = Box<dyn FnMut() -> Vec<OsEvent>>;
+
+/// Hands a saved PDF to the page embedding PdfCraft (web): `(name, bytes, save_as)`. `save_as`
+/// is `true` for Save As. Set by the web app when a host page (such as a Nextcloud app) asked
+/// for saves; without it the browser downloads the file.
+pub type HostSaveFn = Box<dyn Fn(&str, &[u8], bool) -> Result<(), String>>;
+
+/// Told every frame whether any tab has unsaved work, so a host page can warn before leaving.
+pub type HostDirtyFn = Box<dyn FnMut(bool)>;
diff --git a/crates/ui-egui/src/i18n.rs b/crates/ui-egui/src/i18n.rs
new file mode 100644
index 0000000000..3f478b637f
--- /dev/null
+++ b/crates/ui-egui/src/i18n.rs
@@ -0,0 +1,799 @@
+//! UI localisation. Strings in code stay English and are the default lookup keys; a per-language
+//! catalog (`*.tsv`, see `ja.tsv` for the format) maps them to display text at render time. Command
+//! ids, document text, file names, the control channel, the CLI and MCP never see translated text,
+//! so agents and scripts are unaffected. A string without a translation is shown in English, so
+//! coverage can grow incrementally.
+//!
+//! The system is the one PhotoCraft uses (`photocraft/crates/ui-egui/src/i18n`), so catalogs and
+//! habits carry over between the two apps.
+//!
+//! # Adding a language
+//! 1. Add `xx.tsv` next to `ja.tsv` (copy its header; translate from the *meaning* of the English
+//!    text, clean-room, see `ja.tsv`).
+//! 2. Add one row to [`LANGUAGES`] (code, native name, catalog, plural rule).
+//!
+//! That is all: the Preferences dropdown, the system-locale match and the catalog tests (parse,
+//! placeholders, plural forms) pick it up from the registry.
+//!
+//! # Looking strings up
+//! - [`tl!`](crate::tl) / [`t`]: a plain string in the current language. [`tr`]: in a given one.
+//! - [`tr_ctx`] (`tl_ctx!` in UI code): when one English word needs different translations.
+//! - [`tr_id`]: a command-id keyed string with the English label as fallback (menu items), so a
+//!   translation survives rewording of the English text and can differ per command.
+//! - [`trn`]: plural-aware (`{n}` is filled in). [`fmt`]: fill `{name}` placeholders after [`tr`];
+//!   translators may reorder placeholders freely.
+
+mod catalog;
+
+use std::cell::Cell;
+use std::sync::OnceLock;
+
+use catalog::Catalog;
+
+/// The `language` preference value that follows the system locale.
+pub const AUTO: &str = "auto";
+
+/// One supported UI language.
+pub struct LangInfo {
+    /// BCP 47 code, lowercase (`ja`, `zh-hans`, `pt-br`). Also the `language` preference value.
+    pub code: &'static str,
+    /// The language's name in itself, shown in the Preferences dropdown.
+    pub name: &'static str,
+    /// Catalog file contents (empty for the built-in English).
+    pub source: &'static str,
+    /// Plural form index for a count (English: 0 = one, 1 = other; Japanese: always 0). A catalog's
+    /// `@plural` entries list one form per index.
+    pub plural: fn(u64) -> usize,
+    /// The language is written right to left. Catalogs stay in logical order: the egui 0.37 fork
+    /// owns bidi shaping/reordering (E5/E12), so preordering here would reverse Arabic twice.
+    pub rtl: bool,
+    catalog: OnceLock<Catalog>,
+}
+
+fn plural_one_other(n: u64) -> usize {
+    usize::from(n != 1)
+}
+
+fn plural_none(_: u64) -> usize {
+    0
+}
+
+/// Romanian (CLDR `ro`): 1 is `one`; 0 and numbers whose last two digits are 1–19 (2, 19, 101,
+/// 119) are `few`; everything else (20, 100, 120) is `other`, the form with "de" ("20 de pagini").
+fn plural_ro(n: u64) -> usize {
+    if n == 1 {
+        0
+    } else if n == 0 || (1..=19).contains(&(n % 100)) {
+        1
+    } else {
+        2
+    }
+}
+
+/// Lithuanian: one (ending in 1 except 11), few (ending in 2–9 except 12–19), other otherwise.
+fn plural_lithuanian(n: u64) -> usize {
+    match (n % 10, n % 100) {
+        (1, 11) => 2,
+        (1, _) => 0,
+        (2..=9, 12..=19) => 2,
+        (2..=9, _) => 1,
+        _ => 2,
+    }
+}
+
+/// Czech: 1 → one, 2–4 → few, everything else (0, 5+) → other.
+fn plural_cs(n: u64) -> usize {
+    match n {
+        1 => 0,
+        2..=4 => 1,
+        _ => 2,
+    }
+}
+
+/// Portuguese: 0 and 1 take the singular, everything else the plural.
+fn plural_pt(n: u64) -> usize {
+    usize::from(n > 1)
+}
+
+/// French (CLDR `fr`): 0 and 1 take the singular, everything else the plural.
+fn plural_fr(n: u64) -> usize {
+    usize::from(n > 1)
+}
+
+/// Russian: 1 (but not 11) is `one`, 2–4 (but not 12–14) `few`, everything else `many`.
+fn plural_russian(n: u64) -> usize {
+    match n % 100 {
+        11..=14 => 2,
+        _ => match n % 10 {
+            1 => 0,
+            2..=4 => 1,
+            _ => 2,
+        },
+    }
+}
+
+/// Ukrainian (CLDR `uk`, integer counts): one (1, 21), few (2–4, 22–24), many (0, 5–19).
+/// Counts ending in 11–14 always take many, regardless of the last digit.
+fn plural_ukrainian(n: u64) -> usize {
+    match n % 100 {
+        11..=14 => 2,
+        _ => match n % 10 {
+            1 => 0,
+            2..=4 => 1,
+            _ => 2,
+        },
+    }
+}
+
+/// Arabic (CLDR `ar`, integer counts): zero (0), one (1), two (2), few (3–10, 103–110),
+/// many (11–99, 111–199), other (100–102, 200–202).
+fn plural_arabic(n: u64) -> usize {
+    match (n, n % 100) {
+        (0, _) => 0,
+        (1, _) => 1,
+        (2, _) => 2,
+        (_, 3..=10) => 3,
+        (_, 11..=99) => 4,
+        _ => 5,
+    }
+}
+
+/// Polish integer counts: 1 is one; endings 2–4 except 12–14 are few; the rest are many.
+fn plural_polish(n: u64) -> usize {
+    match (n, n % 100, n % 10) {
+        (1, _, _) => 0,
+        (_, 12..=14, _) => 2,
+        (_, _, 2..=4) => 1,
+        _ => 2,
+    }
+}
+
+/// Slovene (CLDR `sl`): one (1, 101, 201 ...) | two (2, 102 ...) | few (3, 4, 103 ...) | other.
+fn plural_sl(n: u64) -> usize {
+    match n % 100 {
+        1 => 0,
+        2 => 1,
+        3 | 4 => 2,
+        _ => 3,
+    }
+}
+
+/// The registry. English first: it is the fallback and the source language.
+pub static LANGUAGES: [LangInfo; 35] = [
+    LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
+    LangInfo { code: "ja", name: "日本語", source: include_str!("i18n/ja.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
+    // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
+    LangInfo {
+        code: "zh-hans",
+        name: "简体中文",
+        source: include_str!("i18n/zh-hans.tsv"),
+        plural: plural_none,
+        rtl: false,
+        catalog: OnceLock::new(),
+    },
+    // Traditional Chinese in the vocabulary used in Taiwan; `zh-TW`, `zh-HK`, `zh-MO` and `zh-Hant-*`
+    // locales all resolve here (see `candidates`).
+    LangInfo {
+        code: "zh-hant",
+        name: "繁體中文",
+        source: include_str!("i18n/zh-hant.tsv"),
+        plural: plural_none,
+        rtl: false,
+        catalog: OnceLock::new(),
+    },
+    LangInfo { code: "cs", name: "Čeština", source: include_str!("i18n/cs.tsv"), plural: plural_cs, rtl: false, catalog: OnceLock::new() },
+    // Brazilian Portuguese; `pt`, `pt-BR` and `pt-PT` locales all resolve here (see `candidates`).
+    LangInfo {
+        code: "pt-br",
+        name: "Português (Brasil)",
+        source: include_str!("i18n/pt-br.tsv"),
+        plural: plural_pt,
+        rtl: false,
+        catalog: OnceLock::new(),
+    },
+    // German (informal "du"); every `de-*` locale (`de-DE`, `de-AT`, `de-CH` ...) resolves here.
+    LangInfo { code: "de", name: "Deutsch", source: include_str!("i18n/de.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
+    // Spanish (European vocabulary); every `es-*` locale (`es-ES`, `es-MX`, `es-419` ...) resolves here.
+    LangInfo { code: "es", name: "Español", source: include_str!("i18n/es.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
+    // French; every `fr-*` locale (`fr-FR`, `fr-CA`, `fr-BE` ...) resolves here.
+    LangInfo { code: "fr", name: "Français", source: include_str!("i18n/fr.tsv"), plural: plural_fr, rtl: false, catalog: OnceLock::new() },
+    // Russian; every `ru-*` locale (`ru-RU`, `ru-BY`, `ru-KZ` ...) resolves here.
+    LangInfo {
+        code: "ru", name: "Русский", source: include_str!("i18n/ru.tsv"), plural: plural_russian, rtl: false, catalog: OnceLock::new()
+    },
+    // Kazakh; every `kk-*` locale (`kk-KZ`, `kk-KZ.UTF-8`) resolves here.
+    LangInfo {
+        code: "kk", name: "Қазақша", source: include_str!("i18n/kk.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new()
+    },
+    // Bulgarian; every `bg-*` locale (`bg-BG`) resolves here.
+    LangInfo {
+        code: "bg", name: "Български", source: include_str!("i18n/bg.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new()
+    },
+    // Telugu; every `te-*` locale (`te-IN`) resolves here.
+    LangInfo {
+        code: "te", name: "తెలుగు", source: include_str!("i18n/te.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new()
+    },
+    // Hungarian; every `hu-*` locale (`hu-HU`) resolves here.
+    LangInfo { code: "hu", name: "Magyar", source: include_str!("i18n/hu.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
+    // Ukrainian; every `uk-*` locale (`uk-UA`, `uk_UA.UTF-8`) resolves here.
+    LangInfo {
+        code: "uk", name: "Українська", source: include_str!("i18n/uk.tsv"), plural: plural_ukrainian, rtl: false, catalog: OnceLock::new()
+    },
+    // Italian; every `it-*` locale (`it-IT`) resolves here.
+    LangInfo { code: "it", name: "Italiano", source: include_str!("i18n/it.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
+    // Arabic (Modern Standard, Western digits); every `ar-*` locale (`ar-MA`, `ar-EG`, `ar-SA` ...)
+    // resolves here. Right to left: see `LangInfo::rtl`.
+    LangInfo { code: "ar", name: "العربية", source: include_str!("i18n/ar.tsv"), plural: plural_arabic, rtl: true, catalog: OnceLock::new() },
+    // Central Kurdish (Sorani); every `ckb-*` locale (`ckb-IQ`, `ckb-IR`) resolves here. Right to
+    // left like Arabic: see `LangInfo::rtl`. CLDR `ckb` counts have two forms (one, other).
+    LangInfo {
+        code: "ckb",
+        name: "کوردیی ناوەندی",
+        source: include_str!("i18n/ckb.tsv"),
+        plural: plural_one_other,
+        rtl: true,
+        catalog: OnceLock::new(),
+    },
+    // Persian (Farsi); every `fa-*` locale (`fa-IR`, `fa_IR.UTF-8`, `fa-AF` ...) resolves here. Right
+    // to left like Arabic: see `LangInfo::rtl`. CLDR `fa` counts have two forms (one: i = 0 or n = 1,
+    // other), which for whole counts is the French rule, so `@plural` entries list two forms.
+    LangInfo { code: "fa", name: "فارسی", source: include_str!("i18n/fa.tsv"), plural: plural_fr, rtl: true, catalog: OnceLock::new() },
+    // Polish; every `pl-*` locale (`pl-pl`, `pl_pl.UTF-8`) resolves here.
+    LangInfo { code: "pl", name: "Polski", source: include_str!("i18n/pl.tsv"), plural: plural_polish, rtl: false, catalog: OnceLock::new() },
+    // Slovene; every `sl-*` locale (`sl-SI`) resolves here. Four plural forms (one, two, few, other).
+    LangInfo { code: "sl", name: "Slovenščina", source: include_str!("i18n/sl.tsv"), plural: plural_sl, rtl: false, catalog: OnceLock::new() },
+    LangInfo {
+        code: "el", name: "Ελληνικά", source: include_str!("i18n/el.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new()
+    },
+    // Turkish; every `tr-*` locale (`tr-TR`, `tr_TR.UTF-8`) resolves here.
+    LangInfo { code: "tr", name: "Türkçe", source: include_str!("i18n/tr.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
+    // Lithuanian; every `lt-*` locale (`lt-LT`, `lt_LT.UTF-8`) resolves here. Three plural forms (one, few, other).
+    LangInfo { code: "lt", name: "Lietuvių", source: include_str!("i18n/lt.tsv"), plural: plural_lithuanian, rtl: false, catalog: OnceLock::new() },
+    // Indonesian; every `id-*` locale (`id-ID`, `id_ID.UTF-8`) resolves here. CLDR `id` counts have
+    // one form ("other"), so `@plural` entries list a single form.
+    LangInfo { code: "id", name: "Bahasa Indonesia", source: include_str!("i18n/id.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
+    // Vietnamese; every `vi-*` locale (`vi-VN`, `vi_VN.UTF-8`) resolves here. CLDR `vi` counts have
+    // one form ("other"), so `@plural` entries list a single form.
+    LangInfo { code: "vi", name: "Tiếng Việt", source: include_str!("i18n/vi.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
+    // Finnish; every `fi-*` locale (`fi-FI`, `fi_FI.UTF-8`) resolves here. Two plural forms (one, other):
+    // the partitive singular follows any number but 1 (`1 sivu`, `2 sivua`).
+    LangInfo { code: "fi", name: "Suomi", source: include_str!("i18n/fi.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
+    // Albanian; every `sq-*` locale (`sq-AL`, `sq_AL.UTF-8`, `sq-XK`) resolves here. One/other plural, like English.
+    LangInfo { code: "sq", name: "Shqip", source: include_str!("i18n/sq.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
+    // Thai; every `th-*` locale (`th-TH`, `th_TH.UTF-8`) resolves here. No grammatical plural.
+    LangInfo { code: "th", name: "ไทย", source: include_str!("i18n/th.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
+    // Catalan; every `ca-*` locale (`ca-ES`, `ca_ES.UTF-8`, `ca_ES@valencia`) resolves here.
+    LangInfo { code: "ca", name: "Català", source: include_str!("i18n/ca.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
+    // Romanian; every `ro-*` locale (`ro-RO`, `ro_RO.UTF-8`, `ro-MD`) resolves here. Three plural forms (one, few, other).
+    LangInfo { code: "ro", name: "Română", source: include_str!("i18n/ro.tsv"), plural: plural_ro, rtl: false, catalog: OnceLock::new() },
+    // Lao; every `lo-*` locale (`lo-LA`, `lo_LA.UTF-8` ...) resolves here.
+    LangInfo {
+        code: "lo", name: "ພາສາລາວ", source: include_str!("i18n/lo.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new()
+    },
+    // Hindi; every `hi-*` locale (`hi-IN`, `hi_IN.UTF-8`) resolves here. CLDR `hi` has "one"
+    // (0 and 1) and "other", but the catalog's nouns are the same in both ("{n} पृष्ठ"), so
+    // `@plural` entries list a single form.
+    LangInfo {
+        code: "hi", name: "हिन्दी", source: include_str!("i18n/hi.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new()
+    },
+    // Korean; every `ko-*` locale (`ko-KR`, `ko_KR.UTF-8`) resolves here. CLDR `ko` counts have
+    // one form ("other"), so `@plural` entries list a single form.
+    LangInfo { code: "ko", name: "한국어", source: include_str!("i18n/ko.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
+    // Norwegian Bokmål; every `nb-*` locale resolves here, and so do general Norwegian (`no-*`) and
+    // Nynorsk (`nn-*`), which have no catalog of their own (see `candidates`).
+    LangInfo {
+        code: "nb",
+        name: "Norsk bokmål",
+        source: include_str!("i18n/nb.tsv"),
+        plural: plural_one_other,
+        rtl: false,
+        catalog: OnceLock::new(),
+    },
+];
+
+impl LangInfo {
+    /// How many plural forms the language's `@plural` entries list.
+    fn plural_forms(&self) -> usize {
+        (0..=1000).map(self.plural).max().unwrap_or(0).saturating_add(1)
+    }
+
+    /// Return the parsed catalogue, building it on first use and warning about entries that fall back to
+    /// English.
+    fn catalog(&self) -> &Catalog {
+        self.catalog.get_or_init(|| {
+            let (catalog, errors) = Catalog::parse(self.source, self.plural_forms());
+            for error in errors {
+                log::warn!("{} interface catalog: {error}; that entry shows in English", self.code);
+            }
+            // Catalogs keep logical text: the fork shapes and reorders each run once. Accessibility
+            // names, copied text and search therefore see the same logical string as the source.
+            catalog
+        })
+    }
+}
+
+/// A language the UI can be shown in (a handle into [`LANGUAGES`]).
+#[derive(Clone, Copy)]
+pub struct Lang(&'static LangInfo);
+
+impl std::fmt::Debug for Lang {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "Lang({})", self.0.code)
+    }
+}
+
+impl PartialEq for Lang {
+    fn eq(&self, other: &Self) -> bool {
+        self.0.code == other.0.code
+    }
+}
+
+impl Eq for Lang {}
+
+impl Lang {
+    pub const EN: Lang = Lang(&LANGUAGES[0]);
+
+    pub fn code(self) -> &'static str {
+        self.0.code
+    }
+
+    /// A language by its exact code.
+    pub fn from_code(code: &str) -> Option<Lang> {
+        LANGUAGES.iter().find(|l| l.code.eq_ignore_ascii_case(code)).map(Lang)
+    }
+
+    /// Resolve the `language` preference: a language code, or [`AUTO`] (and anything unknown,
+    /// e.g. a code from a newer version) to follow the system locale.
+    pub fn from_pref(pref: &str) -> Lang {
+        Lang::from_code(pref).unwrap_or_else(system_lang)
+    }
+
+    /// Every registered language.
+    pub fn all() -> impl Iterator<Item = Lang> {
+        LANGUAGES.iter().map(Lang)
+    }
+
+    /// Every registered language in the order a picker lists them: English first (the source
+    /// language and the fallback), then the rest by their own name with accents folded, so
+    /// Čeština sits under C rather than after Z. Names in other scripts follow the Latin ones in
+    /// code point order: Greek, Cyrillic, Arabic, then the CJK languages.
+    pub fn for_picker() -> Vec<Lang> {
+        Self::for_picker_by(Lang::name)
+    }
+
+    /// [`for_picker`](Self::for_picker), ordered by the names the picker actually shows.
+    ///
+    /// `shown` must return each language's displayed name. Pass [`Lang::picker_name`] to keep a
+    /// Latin-script fallback with the other Latin names when a script's face is missing, rather
+    /// than sorting it into a block of unrenderable labels.
+    pub fn for_picker_by(mut shown: impl FnMut(Lang) -> &'static str) -> Vec<Lang> {
+        let mut rest: Vec<Lang> = Lang::all().filter(|l| l.code() != Lang::EN.code()).collect();
+        rest.sort_by_cached_key(|l| name_sort_key(shown(*l)));
+        std::iter::once(Lang::EN).chain(rest).collect()
+    }
+
+    pub fn name(self) -> &'static str {
+        self.0.name
+    }
+
+    /// The language's name in English, used by [`picker_name`](Self::picker_name) when this
+    /// build's fonts cannot draw [`name`](Self::name).
+    pub fn english_name(self) -> &'static str {
+        match self.code() {
+            "en" => "English",
+            "ja" => "Japanese",
+            "zh-hans" => "Simplified Chinese",
+            "zh-hant" => "Traditional Chinese",
+            "cs" => "Czech",
+            "pt-br" => "Portuguese (Brazil)",
+            "de" => "German",
+            "es" => "Spanish",
+            "fr" => "French",
+            "ru" => "Russian",
+            "kk" => "Kazakh",
+            "bg" => "Bulgarian",
+            "te" => "Telugu",
+            "hu" => "Hungarian",
+            "uk" => "Ukrainian",
+            "it" => "Italian",
+            "ar" => "Arabic",
+            "ckb" => "Central Kurdish",
+            "fa" => "Persian",
+            "pl" => "Polish",
+            "sl" => "Slovenian",
+            "el" => "Greek",
+            "tr" => "Turkish",
+            "lt" => "Lithuanian",
+            "id" => "Indonesian",
+            "vi" => "Vietnamese",
+            "fi" => "Finnish",
+            "nb" => "Norwegian Bokmål",
+            "sq" => "Albanian",
+            "th" => "Thai",
+            "ca" => "Catalan",
+            "ro" => "Romanian",
+            "lo" => "Lao",
+            "hi" => "Hindi",
+            "ko" => "Korean",
+            // Only reached if a language is added to `LANGUAGES` without an English name; the
+            // code still tells the reader which entry it is.
+            _ => self.0.code,
+        }
+    }
+
+    /// The name to show in the language picker: the native name when the current fonts can draw
+    /// it, otherwise the English name. With egui 0.37's default `MissingGlyphPolicy::Panic`, a
+    /// native name whose script has no face (for example Hindi in a build without a Devanagari
+    /// face and with installed fonts turned off) would otherwise abort while the list opens.
+    pub fn picker_name(self, drawable: impl FnOnce(&str) -> bool) -> &'static str {
+        if drawable(self.name()) { self.name() } else { self.english_name() }
+    }
+
+    /// Whether the language is written right to left. Lookups stay logical; the egui fork
+    /// shapes and reorders each run for display (see [`LangInfo::rtl`]).
+    pub fn rtl(self) -> bool {
+        self.0.rtl
+    }
+
+    fn catalog(self) -> &'static Catalog {
+        self.0.catalog()
+    }
+}
+
+/// The canonical `language` preference for user input: [`AUTO`] or a registered code (any case).
+/// `None` for anything else, so callers can keep the current setting.
+pub fn normalize_pref(pref: &str) -> Option<&'static str> {
+    if pref.eq_ignore_ascii_case(AUTO) {
+        return Some(AUTO);
+    }
+    Lang::from_code(pref).map(Lang::code)
+}
+
+/// Candidate language codes for a locale tag, most specific first: `zh_TW.UTF-8` →
+/// `zh-tw`, `zh-hant`, `zh`.
+fn candidates(tag: &str) -> Vec<String> {
+    let base = tag.split(['.', '@']).next().unwrap_or("").replace('_', "-").to_ascii_lowercase();
+    let parts: Vec<&str> = base.split('-').filter(|p| !p.is_empty()).collect();
+    let Some(&primary) = parts.first() else { return Vec::new() };
+    let mut out = Vec::new();
+    for n in (1..=parts.len()).rev() {
+        out.push(parts.get(..n).unwrap_or_default().join("-"));
+    }
+    if primary == "zh" && !parts.iter().any(|p| matches!(*p, "hans" | "hant")) {
+        // Chinese by region when no script is given.
+        let script = if parts.iter().any(|p| matches!(*p, "tw" | "hk" | "mo")) { "zh-hant" } else { "zh-hans" };
+        out.insert(out.len().saturating_sub(1), script.to_string());
+    }
+    if primary == "pt" && !out.iter().any(|c| c == "pt-br") {
+        // The only Portuguese catalog is Brazilian; other regions use it rather than English.
+        out.insert(out.len().saturating_sub(1), "pt-br".to_string());
+    }
+    if matches!(primary, "no" | "nn") {
+        // The only Norwegian catalog is Bokmål. `no` (Norwegian in general) and Nynorsk readers use
+        // it rather than English; last, so a catalog of their own would win.
+        out.push("nb".to_string());
+    }
+    out
+}
+
+/// The registered language for a locale tag such as `ja_JP.UTF-8`, `ja-JP`; `None` if the
+/// language isn't supported. `C`/`POSIX` mean English.
+pub fn lang_from_tag(tag: &str) -> Option<Lang> {
+    let cands = candidates(tag);
+    if matches!(cands.first().map(String::as_str), Some("c" | "posix")) {
+        return Some(Lang::EN);
+    }
+    cands.iter().find_map(|c| Lang::from_code(c))
+}
+
+/// The system language (cached). English when it can't be determined.
+pub fn system_lang() -> Lang {
+    // Tests drive the UI by its English labels whatever the developer's locale is. This covers
+    // the unit tests; the integration tests link the library as it ships, where `cfg!(test)` is
+    // off, so each of their harnesses pins the `language` option to `en` instead.
+    if cfg!(test) {
+        return Lang::EN;
+    }
+    static SYSTEM: OnceLock<Lang> = OnceLock::new();
+    *SYSTEM.get_or_init(detect_system_lang)
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn detect_system_lang() -> Lang {
+    for var in ["LC_ALL", "LC_MESSAGES", "LANG"] {
+        if let Some(l) = std::env::var(var).ok().and_then(|v| language_override(&v)) {
+            return l;
+        }
+    }
+    // Apps started from the Finder don't inherit LANG: use the macOS preferred-languages list.
+    // The absolute path keeps a `defaults` earlier on PATH from running; any failure means English.
+    #[cfg(target_os = "macos")]
+    if let Ok(out) = std::process::Command::new("/usr/bin/defaults").args(["read", "-g", "AppleLanguages"]).output()
+        && out.status.success()
+        && let Some(l) = first_supported(&String::from_utf8_lossy(&out.stdout))
+    {
+        return l;
+    }
+    #[cfg(target_os = "windows")]
+    if let Some(l) = windows_ui_language().as_deref().and_then(first_supported) {
+        return l;
+    }
+    Lang::EN
+}
+
+/// A named locale can override the display language. On Windows, the neutral
+/// C/POSIX locale inherited from a launcher says nothing about the user's UI language.
+#[cfg(not(target_arch = "wasm32"))]
+fn language_override(tag: &str) -> Option<Lang> {
+    let tag = tag.trim();
+    if cfg!(target_os = "windows") && matches!(candidates(tag).first().map(String::as_str), Some("c" | "posix")) {
+        return None;
+    }
+    lang_from_tag(tag)
+}
+
+/// The Windows display languages in preference order, one tag per line, queried once when Auto
+/// first resolves. `sys-locale` asks Windows directly (`GetUserPreferredUILanguages`), so no
+/// process is started.
+#[cfg(target_os = "windows")]
+fn windows_ui_language() -> Option<String> {
+    let tags: Vec<String> = sys_locale::get_locales().collect();
+    (!tags.is_empty()).then(|| tags.join("\n"))
+}
+
+/// The first supported language in a macOS `defaults read` list or Windows UI-culture output.
+#[cfg_attr(not(any(target_os = "macos", target_os = "windows")), allow(dead_code))]
+fn first_supported(list: &str) -> Option<Lang> {
+    list.split(['(', ')', ',', '"', '\n']).map(str::trim).filter(|s| !s.is_empty()).find_map(lang_from_tag)
+}
+
+/// The first supported language among BCP 47 tags in preference order, as the browser lists them
+/// in `navigator.languages` (#2954). Only the first few tags are looked at: the list is short in
+/// practice, and a page can't make Auto walk an unbounded one.
+#[cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
+fn first_supported_tag<S: AsRef<str>>(tags: impl IntoIterator<Item = S>) -> Option<Lang> {
+    tags.into_iter().take(32).find_map(|tag| lang_from_tag(tag.as_ref().trim()))
+}
+
+/// The browser's preferred languages, as the desktop builds use the system's: `navigator.languages`
+/// in order, then `navigator.language` (kept within the 32 tags `first_supported_tag` reads).
+/// English when the browser offers none we have a catalog for.
+#[cfg(target_arch = "wasm32")]
+fn detect_system_lang() -> Lang {
+    let Some(navigator) = web_sys::window().map(|w| w.navigator()) else { return Lang::EN };
+    let mut tags: Vec<String> = navigator.languages().iter().take(31).filter_map(|v| v.as_string()).collect();
+    tags.extend(navigator.language());
+    first_supported_tag(&tags).unwrap_or(Lang::EN)
+}
+
+thread_local! {
+    // Per thread, as in PhotoCraft: independent app and test threads (kittest harnesses run in
+    // parallel) must not change each other's drawing language.
+    static CURRENT: Cell<Lang> = const { Cell::new(Lang::EN) };
+}
+
+/// Set the UI language for drawing (the shell calls this once per frame from the preference), so
+/// widgets can translate without every call site carrying a language around.
+pub fn set_current(lang: Lang) {
+    CURRENT.set(lang);
+}
+
+/// The language the UI is drawn in.
+/// `label` as it reads inside a sentence ("add a text box"): lowercased, except in languages
+/// that capitalise nouns (German), where lowercasing would misspell it.
+pub fn in_sentence(label: &str) -> std::borrow::Cow<'_, str> {
+    match current().code() {
+        "de" => std::borrow::Cow::Borrowed(label),
+        "tr" => std::borrow::Cow::Owned(label.chars().flat_map(lower_turkish).collect()),
+        _ => std::borrow::Cow::Owned(label.to_lowercase()),
+    }
+}
+
+/// The translation of `english` in upper case, for section titles. Rust's case mapping knows no
+/// language, and Turkish has a dotted and a dotless i (`i` ↔ `İ`, `ı` ↔ `I`): "Gelişmiş" must
+/// become "GELİŞMİŞ", not "GELIŞMIŞ". A label without a Turkish row is still English and keeps
+/// the English rule.
+pub fn upper_label(english: &str) -> String {
+    let lang = current();
+    let shown = tr(lang, english);
+    if lang.code() == "tr" && has(lang, english) { shown.chars().flat_map(upper_turkish).collect() } else { shown.to_uppercase() }
+}
+
+fn upper_turkish(c: char) -> std::char::ToUppercase {
+    match c {
+        'i' => 'İ'.to_uppercase(),
+        'ı' => 'I'.to_uppercase(),
+        c => c.to_uppercase(),
+    }
+}
+
+fn lower_turkish(c: char) -> std::char::ToLowercase {
+    match c {
+        // `İ`.to_lowercase() is "i" plus a combining dot above.
+        'İ' => 'i'.to_lowercase(),
+        'I' => 'ı'.to_lowercase(),
+        c => c.to_lowercase(),
+    }
+}
+
+pub fn current() -> Lang {
+    CURRENT.get()
+}
+
+/// Does `lang` have a catalog entry for this plain string? (English never does: it is the source.)
+pub fn has(lang: Lang, s: &str) -> bool {
+    lang.catalog().plain(s).is_some()
+}
+
+/// Translate an English UI string into the current language ([`tr`] with [`current`]).
+pub fn t(s: &str) -> &str {
+    tr(current(), s)
+}
+
+/// The name of a keyboard key, distinct from a command such as Delete. Missing key-name
+/// translations use the English key name, never a plain command translation.
+pub fn key_name(s: &str) -> &str {
+    current().catalog().contextual("key", s).unwrap_or(s)
+}
+
+/// Translate an English UI string; unknown strings come back unchanged.
+pub fn tr(lang: Lang, s: &str) -> &str {
+    lang.catalog().plain(s).unwrap_or(s)
+}
+
+/// How the layers below say their own sentences in the current language.
+///
+/// The checker, the preflight profiles and the signature panel hand over a whole English wording
+/// — holes and all — and the document's own words apart from it, so this is all they need of us:
+/// `f.said(&i18n::words)` says the sentence here, and `in_english` says it in English. An unknown
+/// wording comes back as it stands, which is the English, so a catalog that is missing one is a
+/// sentence in English rather than a gap.
+pub fn words(wording: &str) -> String {
+    t(wording).to_owned()
+}
+
+/// Like [`tr`], for an English string that needs a disambiguating `context`.
+pub fn tr_ctx<'a>(lang: Lang, context: &str, s: &'a str) -> &'a str {
+    lang.catalog().contextual(context, s).unwrap_or_else(|| tr(lang, s))
+}
+
+/// A string keyed by its command id, falling back to the translation of the English `label`.
+pub fn tr_id<'a>(lang: Lang, id: &str, label: &'a str) -> &'a str {
+    lang.catalog().id(id).unwrap_or_else(|| tr(lang, label))
+}
+
+/// Fill `{name}` placeholders in one pass. Unknown placeholders are left as written, and inserted
+/// values are never read as templates again, so a file name containing `{n}` stays intact.
+pub fn fmt(template: &str, args: &[(&str, &str)]) -> String {
+    let mut out = String::with_capacity(template.len());
+    let mut rest = template;
+    while let Some((before, after_open)) = rest.split_once('{') {
+        out.push_str(before);
+        let Some((name, after_close)) = after_open.split_once('}') else {
+            out.push('{');
+            out.push_str(after_open);
+            return out;
+        };
+        match args.iter().find(|(key, _)| *key == name) {
+            Some((_, value)) => out.push_str(value),
+            None => {
+                out.push('{');
+                out.push_str(name);
+                out.push('}');
+            }
+        }
+        rest = after_close;
+    }
+    out.push_str(rest);
+    out
+}
+
+/// A generated history label (the action part of "Undo …") in the current language. Captured
+/// values (file and field names) are inserted as they are; unknown labels are looked up whole.
+pub fn action_label(text: &str) -> String {
+    for (prefix, template) in [
+        ("Insert pages from ", "Insert pages from {name}"),
+        ("Fill in ", "Fill in {name}"),
+        ("Set the image of ", "Set the image of {name}"),
+        ("Edit script of ", "Edit script of {name}"),
+        ("Import ", "Import {name}"),
+    ] {
+        if let Some(value) = text.strip_prefix(prefix) {
+            return fmt(t(template), &[("name", value)]);
+        }
+    }
+    if let Some(key) = text.strip_prefix("Change ")
+        && ["Title", "Author", "Subject", "Keywords", "Creator", "Producer"].contains(&key)
+    {
+        return fmt(t("Change {key}"), &[("key", t(key))]);
+    }
+    if let Some(n) = text.strip_prefix("Delete ").and_then(|rest| rest.strip_suffix(" fields")).and_then(|n| n.parse::<u64>().ok()) {
+        return trn(current(), n, "Delete {n} field", "Delete {n} fields");
+    }
+    t(text).to_owned()
+}
+
+/// A history label in the current language, out of the engine's own two parts: the wording is
+/// looked up whole and the document's own word goes into its `{}` afterwards, so a file or field
+/// name is never read as part of the wording. This is exact where [`action_label`] has to guess
+/// from the English text, and is what the engine's own labels go through.
+pub fn edit_label(label: &pdfcraft_engine::Label) -> String {
+    // A batch's wording is only the hole: it carries its name as text, which from below L7 is one
+    // of `BATCH_LABELS` and so is looked up too.
+    if let Some(name) = label.value.as_deref().filter(|_| label.wording == "{batch}") {
+        return t(name).to_owned();
+    }
+    label.said(t(label.wording))
+}
+
+/// A command label such as "Undo Insert pages from a.pdf" in the current language. A catalog
+/// whose word order doesn't put the verb first translates "Undo {action}" and "Redo {action}"
+/// as whole phrases; otherwise the translated verb goes before the action.
+pub fn command_label(text: &str) -> String {
+    for (prefix, template) in [("Undo", "Undo {action}"), ("Redo", "Redo {action}")] {
+        if let Some(action) = text.strip_prefix(prefix).and_then(|tail| tail.strip_prefix(' ')) {
+            let action = action_label(action);
+            if has(current(), template) {
+                return fmt(t(template), &[("action", &action)]);
+            }
+            return format!("{} {action}", t(prefix));
+        }
+    }
+    t(text).to_owned()
+}
+
+/// A registered command's menu label: its `@id` catalog entry if there is one, otherwise
+/// [`command_label`] of the current English label.
+pub fn menu_label(id: &str, label: &str) -> String {
+    match current().catalog().id(id) {
+        Some(translated) => translated.to_owned(),
+        None => command_label(label),
+    }
+}
+
+/// A plural-aware message: `one`/`other` are the English forms (with `{n}` where the count goes).
+pub fn trn(lang: Lang, n: u64, one: &str, other: &str) -> String {
+    let idx = (lang.0.plural)(n);
+    let text = lang.catalog().plural(one, other, idx).unwrap_or(if n == 1 { one } else { other });
+    fmt(text, &[("n", &n.to_string())])
+}
+
+/// `name` lowercased with the Latin accents that occur in language names folded away, so a
+/// byte-wise sort reads alphabetically. Other scripts are left as they are.
+fn name_sort_key(name: &str) -> String {
+    name.chars()
+        .flat_map(char::to_lowercase)
+        .map(|c| match c {
+            'à'..='å' | 'ā' | 'ă' | 'ą' => 'a',
+            'ç' | 'ć' | 'č' => 'c',
+            'è'..='ë' | 'ē' | 'ě' | 'ę' | 'ế' | 'ệ' => 'e',
+            'ì'..='ï' | 'ī' => 'i',
+            'ñ' | 'ń' | 'ň' => 'n',
+            'ò'..='ö' | 'ø' | 'ő' => 'o',
+            'ś' | 'š' => 's',
+            'ù'..='ü' | 'ū' | 'ů' | 'ű' => 'u',
+            'ý' | 'ÿ' => 'y',
+            'ź' | 'ż' | 'ž' => 'z',
+            c => c,
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+mod picker_order_tests {
+    use super::*;
+
+    #[test]
+    fn picker_lists_english_first_then_names_alphabetically() {
+        let order = Lang::for_picker();
+        assert_eq!(order.first().map(|l| l.code()), Some(Lang::EN.code()));
+        assert_eq!(order.len(), Lang::all().count());
+        let keys: Vec<String> = order[1..].iter().map(|l| name_sort_key(l.name())).collect();
+        assert!(keys.windows(2).all(|w| w[0] <= w[1]), "{keys:?}");
+        assert_eq!(name_sort_key("Čeština"), "cestina");
+        assert_eq!(name_sort_key("Türkçe"), "turkce");
+    }
+}
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 35a301d6db..3e6d735523 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -16,9 +16,9 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept. Digits are Western (0-9).
 #
-# Write every entry in logical (typing) order. The interface draws text left to right, so
-# i18n/mod.rs puts each entry into display order when it loads the catalog (bidi::display_rtl);
-# spaces and a colon at either end of an entry stay at that end, next to what the code appends.
+# Write every entry in logical (typing) order. Catalogs stay logical: epaint shapes and
+# reorders each line with UAX #9, so preordering here would reverse right-to-left text twice.
+# Spaces and a colon at either end of an entry stay at that end, next to what the code appends.
 
 	Menu	القائمة
 	File	ملف
@@ -184,6 +184,15 @@
 	Available	متاح
 	Ready	جاهز
 	Search tools and commands…	البحث في الأدوات والأوامر…
+
+# Accessible names for inputs that have no visible label.
+	Added text	النص المضاف
+	Link URL	عنوان URL للرابط
+	Search tools and commands	البحث في الأدوات والأوامر
+	Text editing line	سطر تحرير النص
+	Text to place	النص المراد وضعه
+	Tooltip	تلميح
+	Words or phrases to redact	الكلمات أو العبارات المراد حجبها
 	No matching tools	لا توجد أدوات مطابقة
 	Tool	أداة
 	Command	أمر
@@ -2766,6 +2775,14 @@ certificate	Version	الإصدار
 	Make properties default	جعل الخصائص افتراضية
 	Pages selected	الصفحات المحددة
 	Page properties	خصائص الصفحة
+	Create & Edit	الإنشاء والتحرير
+	Review & Compare	المراجعة والمقارنة
+	Forms & Signatures	النماذج والتوقيعات
+	Protect & Standardize	الحماية والتوحيد القياسي
+	Customize & Automate	التخصيص والأتمتة
+	No tools match your search.	لا توجد أدوات تطابق بحثك.
+	Expand all tools	توسيع كل الأدوات
+	Collapse all tools	طي كل الأدوات
 	Attach a file…	إرفاق ملف…
 	Delete attachment	حذف المرفق
 	Attaching files is not available on the web yet	إرفاق الملفات غير متاح على الويب بعد
@@ -2807,3 +2824,12 @@ certificate	Version	الإصدار
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	اليوم
+@plural	{n} reply|{n} replies	{n} رد|{n} رد|{n} ردّان|{n} ردود|{n} ردًا|{n} رد
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	أدوات الصفحات
+	Insert pages from a file after the selection…	إدراج صفحات من ملف بعد التحديد…
+	Rotate the selected pages counterclockwise	تدوير الصفحات المحددة عكس اتجاه عقارب الساعة
+	Rotate the selected pages clockwise	تدوير الصفحات المحددة باتجاه عقارب الساعة
+	Extract the selected pages…	استخراج الصفحات المحددة…
+	Delete the selected pages	حذف الصفحات المحددة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 91b0b32527..ec0339f18a 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -1832,6 +1832,15 @@
 	Tool	Инструмент
 	Command	Команда
 	Search tools and commands…	Търсене на инструменти и команди…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Добавен текст
+	Link URL	URL на връзката
+	Search tools and commands	Търсене на инструменти и команди
+	Text editing line	Ред за редактиране на текст
+	Text to place	Текст за поставяне
+	Tooltip	Подсказка
+	Words or phrases to redact	Думи или фрази за заличаване
 	No matching tools	Няма съответстващи инструменти
 	All tools	Всички инструменти
 	Read	Четене
@@ -2452,6 +2461,14 @@ animation effects	Off	Изключени
 	Make properties default	Задаване като свойства по подразбиране
 	Pages selected	Избрани страници
 	Page properties	Свойства на страницата
+	Create & Edit	Създаване и редактиране
+	Review & Compare	Преглед и сравнение
+	Forms & Signatures	Формуляри и подписи
+	Protect & Standardize	Защита и стандартизация
+	Customize & Automate	Персонализиране и автоматизация
+	No tools match your search.	Няма инструменти, отговарящи на търсенето.
+	Expand all tools	Разгъване на всички инструменти
+	Collapse all tools	Свиване на всички инструменти
 	Attach a file…	Прикачване на файл…
 	Delete attachment	Изтриване на прикачения файл
 	Attaching files is not available on the web yet	Прикачването на файлове още не е налично в уеб версията
@@ -2494,3 +2511,12 @@ animation effects	Off	Изключени
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Днес
+@plural	{n} reply|{n} replies	{n} отговор|{n} отговора
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Инструменти за страници
+	Insert pages from a file after the selection…	Вмъкване на страници от файл след избраното…
+	Rotate the selected pages counterclockwise	Завъртане на избраните страници обратно на часовниковата стрелка
+	Rotate the selected pages clockwise	Завъртане на избраните страници по часовниковата стрелка
+	Extract the selected pages…	Извличане на избраните страници…
+	Delete the selected pages	Изтриване на избраните страници
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 2778dd3818..0cacae3c2c 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -178,6 +178,15 @@
 	Available	Disponible
 	Ready	Llest
 	Search tools and commands…	Cerca eines i ordres…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Text afegit
+	Link URL	URL de l'enllaç
+	Search tools and commands	Cerca eines i ordres
+	Text editing line	Línia d'edició de text
+	Text to place	Text que cal col·locar
+	Tooltip	Suggeriment
+	Words or phrases to redact	Paraules o frases per censurar
 	No matching tools	Cap eina coincident
 	Tool	Eina
 	Command	Ordre
@@ -2654,6 +2663,14 @@ certificate	SHA-256 digest	Resum SHA-256
 	Optimizing… merging image fragments	S'està optimitzant… fusionant fragments d'imatge
 	Outline colour:	Color del contorn:
 	Page properties	Propietats de la pàgina
+	Create & Edit	Crea i edita
+	Review & Compare	Revisa i compara
+	Forms & Signatures	Formularis i signatures
+	Protect & Standardize	Protegeix i estandarditza
+	Customize & Automate	Personalitza i automatitza
+	No tools match your search.	Cap eina coincideix amb la cerca.
+	Expand all tools	Desplega totes les eines
+	Collapse all tools	Replega totes les eines
 	Pages counted	Pàgines comptades
 	Pages selected	Pàgines seleccionades
 	Print as image	Imprimeix com a imatge
@@ -2792,3 +2809,12 @@ theme	Appearance	Aspecte
 	Attaching files is not available on the web yet	Encara no es poden adjuntar fitxers al web
 	Delete attachment	Elimina l'adjunt
 	Delete attachment {key}	Elimina l'adjunt {key}
+@plural	{n} reply|{n} replies	{n} resposta|{n} respostes
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Eines de pàgina
+	Insert pages from a file after the selection…	Insereix pàgines d'un fitxer després de la selecció…
+	Rotate the selected pages counterclockwise	Gira les pàgines seleccionades en sentit antihorari
+	Rotate the selected pages clockwise	Gira les pàgines seleccionades en sentit horari
+	Extract the selected pages…	Extreu les pàgines seleccionades…
+	Delete the selected pages	Suprimeix les pàgines seleccionades
diff --git a/crates/ui-egui/src/i18n/catalog.rs b/crates/ui-egui/src/i18n/catalog.rs
index 864cdb434f..7bf4296662 100644
--- a/crates/ui-egui/src/i18n/catalog.rs
+++ b/crates/ui-egui/src/i18n/catalog.rs
@@ -155,15 +155,6 @@ impl Catalog {
         (c, errors)
     }
 
-    /// Rewrite every translation (each plural form on its own), e.g. into display order for a
-    /// right-to-left language. Keys are untouched.
-    pub fn map_translations(&mut self, f: impl Fn(&str) -> String) {
-        let tables = std::iter::once(&mut self.plain).chain(self.contextual.values_mut()).chain(std::iter::once(&mut self.ids));
-        for translation in tables.flat_map(HashMap::values_mut).chain(self.plurals.values_mut().flatten()) {
-            *translation = f(translation);
-        }
-    }
-
     pub fn plain(&self, s: &str) -> Option<&str> {
         self.plain.get(s).map(String::as_str)
     }
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index b851185cca..71c0c62869 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -16,9 +16,9 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept. Digits are Western (0-9).
 #
-# Write every entry in logical (typing) order. The interface draws text left to right, so
-# i18n/mod.rs puts each entry into display order when it loads the catalog (bidi::display_rtl);
-# spaces and a colon at either end of an entry stay at that end, next to what the code appends.
+# Write every entry in logical (typing) order. Catalogs stay logical: epaint shapes and
+# reorders each line with UAX #9, so preordering here would reverse right-to-left text twice.
+# Spaces and a colon at either end of an entry stay at that end, next to what the code appends.
 
 	Menu	پێڕست
 	File	فایل
@@ -184,6 +184,15 @@
 	Available	بەردەست
 	Ready	ئامادە
 	Search tools and commands…	گەڕان لە ئامرازەکان و فەرمانەکان…
+
+# Accessible names for inputs that have no visible label.
+	Added text	دەقی زیادکراو
+	Link URL	ناونیشانی URLی بەستەر
+	Search tools and commands	گەڕان لە ئامرازەکان و فەرمانەکان
+	Text editing line	هێڵی دەستکاریکردنی دەق
+	Text to place	دەقی دانان
+	Tooltip	ڕێنمایی
+	Words or phrases to redact	وشە یان دەستەواژەکان بۆ شاردنەوە
 	No matching tools	هیچ ئامرازێکی گونجاو نییە
 	Tool	ئامراز
 	Command	فەرمان
@@ -2720,6 +2729,23 @@ certificate	Version	وەشان
 	Make properties default	کردنی تایبەتمەندییەکان بە بنەڕەتی
 	Pages selected	پەڕە هەڵبژێردراوەکان
 	Page properties	تایبەتمەندییەکانی پەڕە
+	Create & Edit	دروستکردن و دەستکاریکردن
+	Review & Compare	پێداچوونەوە و بەراوردکردن
+	Forms & Signatures	فۆڕمەکان و واژووەکان
+	Protect & Standardize	پاراستن و ستانداردکردن
+	Customize & Automate	تایبەتکردن و خۆکارکردن
+	No tools match your search.	هیچ ئامرازێک لەگەڵ گەڕانەکەت ناگونجێت.
+	Expand all tools	فراوانکردنی هەموو ئامرازەکان
+	Collapse all tools	کۆکردنەوەی هەموو ئامرازەکان
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	ئەمڕۆ
+@plural	{n} reply|{n} replies	{n} وەڵام|{n} وەڵام
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	ئامرازەکانی پەڕە
+	Insert pages from a file after the selection…	پەڕەکان لە فایلێکەوە لە دوای هەڵبژاردەکە دابنێ…
+	Rotate the selected pages counterclockwise	پەڕە هەڵبژێردراوەکان پێچەوانەی میلی کاتژمێر بسوڕێنە
+	Rotate the selected pages clockwise	پەڕە هەڵبژێردراوەکان بە ئاڕاستەی میلی کاتژمێر بسوڕێنە
+	Extract the selected pages…	پەڕە هەڵبژێردراوەکان دەربهێنە…
+	Delete the selected pages	پەڕە هەڵبژێردراوەکان بسڕەوە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 42b92f4df0..ed6d051b57 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -305,6 +305,15 @@ key	Space	Mezerník
 	Available	Dostupné
 	Ready	Připraveno
 	Search tools and commands…	Hledat nástroje a příkazy…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Přidaný text
+	Link URL	Adresa URL odkazu
+	Search tools and commands	Hledat nástroje a příkazy
+	Text editing line	Řádek pro úpravu textu
+	Text to place	Text k umístění
+	Tooltip	Popisek
+	Words or phrases to redact	Slova nebo fráze k začernění
 	No matching tools	Žádné odpovídající nástroje
 	Tool	Nástroj
 	Command	Příkaz
@@ -2563,6 +2572,14 @@ animation effects	Off	Vypnuto
 	Make properties default	Nastavit vlastnosti jako výchozí
 	Pages selected	Vybrané stránky
 	Page properties	Vlastnosti stránky
+	Create & Edit	Vytváření a úpravy
+	Review & Compare	Revize a porovnání
+	Forms & Signatures	Formuláře a podpisy
+	Protect & Standardize	Ochrana a standardizace
+	Customize & Automate	Přizpůsobení a automatizace
+	No tools match your search.	Hledání neodpovídá žádný nástroj.
+	Expand all tools	Rozbalit všechny nástroje
+	Collapse all tools	Sbalit všechny nástroje
 	Attach a file…	Připojit soubor…
 	Delete attachment	Odstranit přílohu
 	Attaching files is not available on the web yet	Připojování souborů zatím na webu není k dispozici
@@ -2838,3 +2855,12 @@ certificate	Version	Verze
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Dnes
+@plural	{n} reply|{n} replies	{n} odpověď|{n} odpovědi|{n} odpovědí
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Nástroje stránek
+	Insert pages from a file after the selection…	Vložit stránky ze souboru za výběr…
+	Rotate the selected pages counterclockwise	Otočit vybrané stránky proti směru hodinových ručiček
+	Rotate the selected pages clockwise	Otočit vybrané stránky po směru hodinových ručiček
+	Extract the selected pages…	Extrahovat vybrané stránky…
+	Delete the selected pages	Odstranit vybrané stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index ae3980ecfb..8586a21d43 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -157,6 +157,15 @@
 	Available	Verfügbar
 	Ready	Bereit
 	Search tools and commands…	Tools und Befehle suchen…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Hinzugefügter Text
+	Link URL	URL des Links
+	Search tools and commands	Tools und Befehle suchen
+	Text editing line	Textbearbeitungszeile
+	Text to place	Einzufügender Text
+	Tooltip	Tooltip
+	Words or phrases to redact	Zu schwärzende Wörter oder Ausdrücke
 	No matching tools	Keine passenden Werkzeuge
 	Tool	Werkzeug
 	Command	Befehl
@@ -2490,6 +2499,14 @@ animation effects	Off	Aus
 	Make properties default	Eigenschaften als Standard festlegen
 	Pages selected	Ausgewählte Seiten
 	Page properties	Seiteneigenschaften
+	Create & Edit	Erstellen & Bearbeiten
+	Review & Compare	Prüfen & Vergleichen
+	Forms & Signatures	Formulare & Signaturen
+	Protect & Standardize	Schützen & Standardisieren
+	Customize & Automate	Anpassen & Automatisieren
+	No tools match your search.	Keine Werkzeuge entsprechen Ihrer Suche.
+	Expand all tools	Alle Werkzeuge ausklappen
+	Collapse all tools	Alle Werkzeuge einklappen
 	Attach a file…	Datei anhängen…
 	Delete attachment	Anhang löschen
 	Attaching files is not available on the web yet	Dateien anhängen ist im Web noch nicht verfügbar
@@ -2532,3 +2549,12 @@ animation effects	Off	Aus
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Heute
+@plural	{n} reply|{n} replies	{n} Antwort|{n} Antworten
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Seitenwerkzeuge
+	Insert pages from a file after the selection…	Seiten aus einer Datei nach der Auswahl einfügen…
+	Rotate the selected pages counterclockwise	Ausgewählte Seiten gegen den Uhrzeigersinn drehen
+	Rotate the selected pages clockwise	Ausgewählte Seiten im Uhrzeigersinn drehen
+	Extract the selected pages…	Ausgewählte Seiten extrahieren…
+	Delete the selected pages	Ausgewählte Seiten löschen
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index b3a694471b..e3eac77caa 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -2167,6 +2167,15 @@
 	View more	Περισσότερα
 	Available	Διαθέσιμο
 	Search tools and commands…	Αναζήτηση εργαλείων και εντολών…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Προστιθέμενο κείμενο
+	Link URL	Διεύθυνση URL συνδέσμου
+	Search tools and commands	Αναζήτηση εργαλείων και εντολών
+	Text editing line	Γραμμή επεξεργασίας κειμένου
+	Text to place	Κείμενο προς τοποθέτηση
+	Tooltip	Συμβουλή εργαλείου
+	Words or phrases to redact	Λέξεις ή φράσεις για απόκρυψη
 	No matching tools	Δεν βρέθηκαν εργαλεία
 	Tool	Εργαλείο
 	Command	Εντολή
@@ -2495,6 +2504,14 @@ animation effects	Off	Ανενεργά
 	Make properties default	Ορισμός ιδιοτήτων ως προεπιλογή
 	Pages selected	Επιλεγμένες σελίδες
 	Page properties	Ιδιότητες σελίδας
+	Create & Edit	Δημιουργία και επεξεργασία
+	Review & Compare	Αναθεώρηση και σύγκριση
+	Forms & Signatures	Φόρμες και υπογραφές
+	Protect & Standardize	Προστασία και τυποποίηση
+	Customize & Automate	Προσαρμογή και αυτοματοποίηση
+	No tools match your search.	Κανένα εργαλείο δεν ταιριάζει με την αναζήτησή σας.
+	Expand all tools	Ανάπτυξη όλων των εργαλείων
+	Collapse all tools	Σύμπτυξη όλων των εργαλείων
 	Attach a file…	Επισύναψη αρχείου…
 	Delete attachment	Διαγραφή συνημμένου
 	Attaching files is not available on the web yet	Η επισύναψη αρχείων δεν είναι ακόμη διαθέσιμη στον ιστό
@@ -2537,3 +2554,12 @@ animation effects	Off	Ανενεργά
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Σήμερα
+@plural	{n} reply|{n} replies	{n} απάντηση|{n} απαντήσεις
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Εργαλεία σελίδων
+	Insert pages from a file after the selection…	Εισαγωγή σελίδων από αρχείο μετά την επιλογή…
+	Rotate the selected pages counterclockwise	Περιστροφή των επιλεγμένων σελίδων αριστερόστροφα
+	Rotate the selected pages clockwise	Περιστροφή των επιλεγμένων σελίδων δεξιόστροφα
+	Extract the selected pages…	Εξαγωγή των επιλεγμένων σελίδων…
+	Delete the selected pages	Διαγραφή των επιλεγμένων σελίδων
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 507148a02d..0d4e505a70 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -180,6 +180,15 @@
 	Available	Disponible
 	Ready	Listo
 	Search tools and commands…	Buscar herramientas y comandos…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Texto añadido
+	Link URL	URL del enlace
+	Search tools and commands	Buscar herramientas y comandos
+	Text editing line	Línea de edición de texto
+	Text to place	Texto que colocar
+	Tooltip	Información sobre herramientas
+	Words or phrases to redact	Palabras o frases que censurar
 	No matching tools	Ninguna herramienta coincide
 	Tool	Herramienta
 	Command	Comando
@@ -2632,6 +2641,14 @@ animation effects	Off	Desactivados
 	Make properties default	Usar como propiedades predeterminadas
 	Pages selected	Páginas seleccionadas
 	Page properties	Propiedades de página
+	Create & Edit	Crear y editar
+	Review & Compare	Revisar y comparar
+	Forms & Signatures	Formularios y firmas
+	Protect & Standardize	Proteger y estandarizar
+	Customize & Automate	Personalizar y automatizar
+	No tools match your search.	Ninguna herramienta coincide con la búsqueda.
+	Expand all tools	Expandir todas las herramientas
+	Collapse all tools	Contraer todas las herramientas
 	Font	Fuente
 	Bulleted list	Lista con viñetas
 	Numbered list	Lista numerada
@@ -2854,3 +2871,12 @@ theme	Appearance	Aspecto
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hoy
+@plural	{n} reply|{n} replies	{n} respuesta|{n} respuestas
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Herramientas de página
+	Insert pages from a file after the selection…	Insertar páginas de un archivo después de la selección…
+	Rotate the selected pages counterclockwise	Girar las páginas seleccionadas en sentido antihorario
+	Rotate the selected pages clockwise	Girar las páginas seleccionadas en sentido horario
+	Extract the selected pages…	Extraer las páginas seleccionadas…
+	Delete the selected pages	Eliminar las páginas seleccionadas
diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
new file mode 100644
index 0000000000..5cfc217533
--- /dev/null
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -0,0 +1,2806 @@
+# Persian (fa) catalog. Columns, separated by a TAB:  context <TAB> source <TAB> translation
+#
+#   context  empty                a plain UI string; `source` is the English text in the code
+#            @id                  a command id (e.g. file.saveAs): wins over the English text for
+#                                 that menu item, so one id can read differently from its twin
+#            @plural              `source` is "one|other" (English forms); the translation lists the
+#                                 language's forms separated by "|" (see `plural` in i18n/mod.rs)
+#            anything else        a disambiguating context passed to `tr_ctx`
+#   escapes  \n  \t  \\  inside a column. `{name}` placeholders must appear in both columns.
+#   lines starting with # and blank lines are ignored.
+#
+# Clean-room: every entry was written from the plain meaning of the English label using ordinary
+# Persian computing vocabulary. No proprietary localisation resource, string table or product UI
+# (Acrobat's included) was consulted or copied; add entries the same way.
+# Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters.
+#
+# Right to left: like Arabic and Kurdish, entries stay in logical (typing) order.
+# `rtl: true` in i18n/mod.rs selects explicit right-to-left text direction; epaint reorders
+# each rendered line. The Persian comma \u060c and question mark \u061f are used, and \u200c (ZWNJ) joins
+# compound words.
+
+	Menu	منو
+	File	فایل
+	Edit	ویرایش
+	Pages	صفحه‌ها
+	View	نمایش
+	Help	راهنما
+	Preferences	ترجیحات
+	Preferences…	ترجیحات…
+	Interface language	زبان رابط کاربری
+	Interface size	اندازه رابط کاربری
+	Auto ({percent}%)	خودکار ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	حالت خودکار از اندازه متن سیستم پیروی می‌کند. صفحه‌ها همیشه با وضوح کامل نمایشگر رندر می‌شوند.
+	Identity	هویت
+	Name on new comments	نام روی یادداشت‌های جدید
+	Hide hover previews for highlights without comment text	پنهان کردن پیش‌نمایش شناور برای برجسته‌سازی‌های بدون متن یادداشت
+	Open…	باز کردن…
+	Open Recent	باز کردن موارد اخیر
+	Clear Recent Files	پاک کردن فایل‌های اخیر
+	Remove from Recent	حذف از موارد اخیر
+	Remove {name} from Recent	حذف {name} از موارد اخیر
+	Pin folder to Home…	سنجاق کردن پوشه به خانه…
+	Folders	پوشه‌ها
+	Pin a folder…	سنجاق کردن پوشه…
+	Pin a folder to Home	سنجاق کردن پوشه به خانه
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	یک پوشه را سنجاق کنید تا جدید‌ترین PDFهای آن اینجا فهرست شوند، مثلاً جایی که اسکنر یا درایو ابری هم‌گام‌شده آن‌ها را ذخیره می‌کند.
+	Unpin	برداشتن سنجاق
+	Unpin {folder}	برداشتن سنجاق {folder}
+	Looking for PDFs…	جستوجوی PDFها…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	این پوشه هم اکنون در دسترس نیست. ممکن است جابه جا شده باشد یا درایو یا هم‌گام‌سازی ابری آن آفلاین باشد.
+	No PDFs in this folder yet	هنوز PDFی در این پوشه نیست
+	Show less	نمایش کمتر
+	Show {n} more	نمایش {n} مورد بیشتر
+	The newest {n} of {total} PDFs	{n} PDF جدید‌تر از {total} PDF
+	Pinned folders need the desktop app	پوشه‌های سنجاق‌شده به برنامه دسکتاپ نیاز دارند
+	Choose a folder on this computer to pin	یک پوشه روی این رایانه برای سنجاق کردن انتخاب کنید
+	{folder} is already pinned to Home	{folder} از قبل به خانه سنجاق شده است
+	You can pin up to {n} folders. Unpin one first.	می‌توانید تا {n} پوشه را سنجاق کنید. ابتدا یکی را بردارید.
+	Pinned {folder} to Home	{folder} به خانه سنجاق شد
+	No recent files	فایل اخیری وجود ندارد
+	New blank PDF	PDF خالی جدید
+	Create PDF from file…	ایجاد PDF از فایل…
+	Create PDF from images…	ایجاد PDF از تصاویر…
+	Create PDF from multiple files…	ایجاد PDF از چند فایل…
+	Create separate PDFs…	ایجاد PDFهای جداگانه…
+	Create PDF from clipboard	ایجاد PDF از بریده دان
+	Combine files…	ترکیب فایل‌ها…
+	Save	ذخیره
+	Save as…	ذخیره به‌عنوان…
+	Close file	بستن فایل
+	Close all	بستن همه
+	Revert	باز‌گرداندن
+	Print…	چاپ…
+	Document properties…	ویژگی‌های سند…
+	Undo	واگرد
+	Redo	ازنو
+	Find…	یافتن…
+	Advanced search…	جستوجوی پیشرفته…
+	Copy pages	رونوشت صفحه‌ها
+	Cut pages	برش صفحه‌ها
+	Paste pages	چسباندن صفحه‌ها
+	Fit visible	تناسب با بخش قابل مشاهده
+	Marquee zoom	بزرگنمایی ناحی‌های
+	Take a snapshot	گرفتن تصویر لحظه ای
+	Column select	انتخاب ستونی
+	Full screen mode	حالت تمامصفحه
+	Read mode	حالت مطالعه
+	Next tab	زبانه بعدی
+	Previous tab	زبانه قبلی
+	Switch light / dark theme	تغییر بین پوسته روشن / تیره
+	Comments panel	پنل یادداشت‌ها
+	Form fields panel	پنل فیلد‌های فرم
+	Clear form	پاک کردن فرم
+	Find tools and commands…	یافتن ابزار‌ها و فرمان‌ها…
+	Zoom	بزرگنمایی
+	Actual size	اندازه واقعی
+	Zoom to page level	بزرگنمایی تا سطح صفحه
+	Fit to width	تناسب با عرض
+	Display theme	پوسته نمایش
+	Side panels	پنل‌های کناری
+	Enable Acrobat JavaScript	فعال کردن Acrobat JavaScript
+	Flatten Fill & Sign when saving	ادغام کردن پر کردن و امضا هنگام ذخیره
+	Text, marks and signatures become part of the page. Other comments stay editable.	متن، نشانه‌ها و امضا‌ها بخشی از صفحه می‌شوند. سایر یادداشت‌ها قابل‌ویرایش می‌مانند.
+	OK	تأیید
+	Join our Discord	به دیسکورد ما بپیوندید
+	Close	بستن
+	Next / previous match	تطابق بعدی / قبلی
+	Copy selected text	رونوشت متن انتخاب‌شده
+	Double-click	دوبار کلیک
+	Select a word	انتخاب یک واژه
+	Clear selection / close find	پاک کردن انتخاب / بستن جستوجو
+	Zoom in / out (also pinch or {key}-scroll)	بزرگنمایی / کوچکنمایی (همچنین با دو انگشت یا {key} + پیمایش)
+	Rotate view	چرخش نما
+	First / last page	صفحه اول / آخر
+	Previous / next page	صفحه قبلی / بعدی
+	Delete selected pages (Organize)	حذف صفحه‌های انتخاب‌شده (سازمان‌دهی)
+	Select all pages (Organize)	انتخاب همه صفحه‌ها (سازمان‌دهی)
+	Home	خانه
+	Open	باز کردن
+	Open a PDF ({key})	باز کردن یک PDF ({key})
+	Dark gray theme	پوسته خاکستری تیره
+	Light theme	پوسته روشن
+	Appearance mode	حالت ظاهر
+	Light	روشن
+	Dark	تیره
+	Active	فعال
+	Dark theme	پوسته تیره
+	Appearance settings…	تنظیمات ظاهر…
+	All tools	همه ابزار‌ها
+	Read	خواندن
+	Convert	تبدیل
+	E-Sign	امضای الکترونیکی
+	Print ({key})	چاپ ({key})
+	Save ({key})	ذخیره ({key})
+	Document properties ({key})	ویژگی‌های سند ({key})
+	Find tools and commands	یافتن ابزار‌ها و فرمان‌ها
+	Fit to height	تناسب با ارتفاع
+	Zoom in	بزرگنمایی
+	Zoom out	کوچکنمایی
+	Rotate view clockwise	چرخش نما در جهت ساعتگرد
+	Rotate view counterclockwise	چرخش نما در جهت پادساعتگرد
+	Page navigation	پیمایش صفحه
+	Previous view	نمای قبلی
+	Next view	نمای بعدی
+	Page display	نمایش صفحه
+	Continuous scrolling	پیمایش پیوسته
+	Show gaps between pages	نمایش فاصله بین صفحه‌ها
+	Hide gaps to join page edges. Margins inside the PDF remain unchanged.	فاصله‌ها را برای اتصال لبه‌های صفحه پنهان کنید. حاشیه‌های داخل PDF تغییر نمی‌کنند.
+	Two-page view	نمای دو صفح‌های
+	Single page	صفحه تکی
+	Show cover page in two-page view	نمایش صفحه جلد در نمای دو صفح‌های
+	Use system setting	استفاده از تنظیمات سیستم
+	Light gray	خاکستری روشن
+	Dark gray	خاکستری تیره
+	Comments	یادداشت‌ها
+	Bookmarks	نشانک‌ها
+	Fields	فیلد‌ها
+	Layers	لایه‌ها
+	Attachments	پیوست‌ها
+	Signatures	امضا‌ها
+	Accessibility Checker	بررسی‌کننده دسترس‌پذیری
+	Search	جستوجو
+	Compare	مقایسه
+	Page thumbnails	بندانگشتی صفحه‌ها
+	Form fields	فیلد‌های فرم
+	Zoom out ({key})	کوچکنمایی ({key})
+	Zoom in ({key})	بزرگنمایی ({key})
+	Rotate view clockwise ({key})	چرخش نما در جهت ساعتگرد ({key})
+	Toggle fit page / fit width	تغییر بین تناسب با صفحه / تناسب با عرض
+	Next page	صفحه بعدی
+	Previous page	صفحه قبلی
+	Current page — type a page number or label (such as iv) and press Enter	صفحه فعلی — یک شماره یا برچسب صفحه (مانند iv) وارد کنید و Enter را فشار دهید
+	Zoom — type a percentage and press Enter	بزرگنمایی — یک درصد وارد کنید و Enter را فشار دهید
+	Welcome to PdfCraft	به PdfCraft خوش آمدید
+	An open-source PDF workbench — local, private, and scriptable.	یک میزکار PDF متن باز — محلی، خصوصی و قابل اسکریپت‌نویسی.
+	Join the ArtCraft community	به جامعه ArtCraft بپیوندید
+	Get help, share feedback and follow development on Discord.	کمک بگیرید، بازخورد بدهید و توسعه را در دیسکورد دنبال کنید.
+	Recommended tools	ابزار‌های پیشنهادی
+	Use now	همین حالا استفاده کنید
+	Open file	باز کردن فایل
+	Recent	اخیر
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	فایل‌هایی که در PdfCraft باز می‌کنید اینجا نمایش داده می‌شوند. برای باز کردن، یک PDF را هرجایی رها کنید.
+	Privacy	حریم خصوصی
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft آفلاین کار می‌کند. بدون تله سنجی، بدون حساب کاربری و بدون پردازش ابری، مگر اینکه ارائه دهند‌ه ای اضافه کنید.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	اسکریپت‌ها در یک محیط ایزوله بدون دسترسی به فایل یا شبکه اجرا می‌شوند. با خاموش بودن JavaScript، توابع استاندارد قالب‌بندی، اعتبارسنجی و محاسبه Acrobat همچنان کار می‌کنند.
+	Back to all tools	بازگشت به همه ابزار‌ها
+	Close panel	بستن پنل
+	View less	نمایش کمتر
+	View more	نمایش بیشتر
+	Available	در دسترس
+	Ready	آماده
+	Search tools and commands…	جستوجوی ابزار‌ها و فرمان‌ها…
+	No matching tools	ابزار منطبقی نیست
+	Tool	ابزار
+	Command	فرمان
+	Add a sticky note	افزودن یادداشت چسبان
+	Add a text box	افزودن کادر متن
+	Highlight text	برجسته‌سازی متن
+	Underline text	زیرخط متن
+	Strikethrough text	خط خوردگی متن
+	Squiggly underline text	زیرخط موجدار متن
+	Draw freehand	ترسیم آزاد
+	Draw a line	ترسیم خط
+	Draw an arrow	ترسیم پیکان
+	Draw a rectangle	ترسیم مستطیل
+	Draw an oval	ترسیم بیضی
+	Draw a polygon	ترسیم چند‌ضلعی
+	Draw connected lines	ترسیم خطوط متصل
+	Draw a cloud	ترسیم ابر
+	Add a callout	افزودن فراخوان
+	Insert text	درج متن
+	Replace text	جای‌گزینی متن
+	Attach a file	پیوست کردن فایل
+	Erase drawings	پاک کردن ترسیم‌ها
+	Flatten comments	ادغام یادداشت‌ها
+	Import comments…	درونبرد یادداشت‌ها…
+	Add a stamp	افزودن مهر
+	Export all comments to data file…	برونبرد همه یادداشت‌ها به فایل داده…
+	Hide all comments	پنهان کردن همه یادداشت‌ها
+	Summarize comments	خلاصه‌سازی یادداشت‌ها
+	Import form data…	درونبرد داده‌های فرم…
+	Export form data…	برونبرد داده‌های فرم…
+	PDF/A…	PDF/A…
+	Action Wizard…	جادوگر اقدام…
+	Prepare for distribution…	آماده‌سازی برای توزیع…
+	Optimize scanned documents…	بهینه‌سازی اسناد اسکن شده…
+	Compare files…	مقایسه فایل‌ها…
+	Detect form fields	تشخیص فیلد‌های فرم
+	Merge data files into spreadsheet…	ادغام فایل‌های داده در صفحهگسترده…
+	Flatten form fields	ادغام فیلد‌های فرم
+	Prepare a form	آماده‌سازی فرم
+	Tab order: by rows	ترتیب زبانه: بر اساس ردیف‌ها
+	Tab order: by columns	ترتیب زبانه: بر اساس ستون‌ها
+	Tab order: by document structure	ترتیب زبانه: بر اساس ساختار سند
+	Add text	افزودن متن
+	Edit text & images	ویرایش متن و تصاویر
+	Add or edit links	افزودن یا ویرایش پیوند‌ها
+	Create links from URLs	ایجاد پیوند از URLها
+	Remove all links	حذف همه پیوند‌ها
+	No links to remove	پیوندی برای حذف وجود ندارد
+	Removed 1 link	۱ پیوند حذف شد
+	Removed {n} links	{n} پیوند حذف شد
+	Add Bates numbering…	افزودن شماره‌گذاری Bates…
+	Add image…	افزودن تصویر…
+	Redact text and images	سیاه‌کردن متن و تصاویر
+	Redact pages…	سیاه‌کردن صفحه‌ها…
+	Find text and redact…	یافتن متن و سیاه‌کردن…
+	Redaction properties…	ویژگی‌های سیاه‌کردن…
+	Apply redactions…	اعمال سیاه‌کردن‌ها…
+	Clear redaction marks	پاک کردن نشانه‌های سیاه‌کردن
+	Remove hidden information…	حذف اطلاعات پنهان…
+	Sanitize document…	پاک‌سازی سند…
+	Field properties…	ویژگی‌های فیلد…
+	Add a text field	افزودن فیلد متن
+	Add a checkbox	افزودن جعبه انتخاب
+	Add a radio button	افزودن دکمه رادیویی
+	Add a drop-down list	افزودن فهرست کشویی
+	Add a list box	افزودن کادر فهرست
+	Add a button	افزودن دکمه
+	Add an image field	افزودن فیلد تصویر
+	Add a date field	افزودن فیلد تاریخ
+	Add a digital signature field	افزودن فیلد امضای دیجیتال
+	Digitally sign	امضای دیجیتال
+	Certify (visible signature)	گواهی (امضای قابل مشاهده)
+	Certify (invisible signature)	گواهی (امضای نامرئی)
+	Validate all signatures	اعتبارسنجی همه امضا‌ها
+	Signatures panel	پنل امضا‌ها
+	Fill & Sign: add text	پر کردن و امضا: افزودن متن
+	Fill & Sign: checkmark	پر کردن و امضا: علامت تیک
+	Fill & Sign: cross	پر کردن و امضا: ضربدر
+	Fill & Sign: dot	پر کردن و امضا: نقطه
+	Fill & Sign: line	پر کردن و امضا: خط
+	Fill & Sign: date	پر کردن و امضا: تاریخ
+	Fill & Sign: sign	پر کردن و امضا: امضا
+	Fill & Sign: initials	پر کردن و امضا: حروف اول
+	Export to image…	برونبرد به تصویر…
+	Reduce file size…	کاهش اندازه فایل…
+	Optimize PDF…	بهینه‌سازی PDF…
+	Export to text…	برونبرد به متن…
+	Export to Word…	برونبرد به Word…
+	Export to PowerPoint…	برونبرد به PowerPoint…
+	Export to HTML…	برونبرد به HTML…
+	Export to RTF…	برونبرد به RTF…
+	JavaScript console…	کنسول JavaScript…
+	Document JavaScripts…	JavaScriptهای سند…
+	Recognize text…	تشخیص متن…
+	Recognize text in multiple files…	تشخیص متن در چند فایل…
+	Check for accessibility…	بررسی دسترس‌پذیری…
+	Open accessibility report	باز کردن گزارش دسترس‌پذیری
+	Change reading options…	تغییر گزینه‌های خواندن…
+	Add alternate text…	افزودن متن جانشین…
+	Export all images…	برونبرد همه تصاویر…
+	Add header & footer…	افزودن سرصفحه و پاصفحه…
+	Update header & footer…	به‌روز‌رسانی سرصفحه و پاصفحه…
+	Remove header & footer	حذف سرصفحه و پاصفحه
+	Add watermark…	افزودن چاپ سایه…
+	Update watermark…	به‌روز‌رسانی چاپ سایه…
+	Remove watermark	حذف چاپسایه
+	Add background…	افزودن پس‌زمینه…
+	Update background…	به‌روز‌رسانی پس‌زمینه…
+	Remove background	حذف پس‌زمینه
+	Protect using password…	محافظت با گذرواژه…
+	Remove security	حذف امنیت
+	Security properties…	ویژگی‌های امنیت…
+	Organize pages	سازمان‌دهی صفحه‌ها
+	New bookmark	نشانک جدید
+	New bookmarks from structure	نشانک‌های جدید از ساختار
+	Rotate pages clockwise	چرخش صفحه‌ها در جهت ساعتگرد
+	Rotate pages counterclockwise	چرخش صفحه‌ها در جهت پادساعتگرد
+	Delete pages	حذف صفحه‌ها
+	Insert blank page	درج صفحه خالی
+	Rotate pages…	چرخش صفحه‌ها…
+	Duplicate pages	تکثیر صفحه‌ها
+	Crop pages	برش صفحه‌ها
+	Set page boxes…	تنظیم کادر‌های صفحه…
+	Insert pages from file…	درج صفحه‌ها از فایل…
+	Replace pages…	جای‌گزینی صفحه‌ها…
+	Extract pages…	استخراج صفحه‌ها…
+	Split document…	تقسیم سند…
+	Number pages…	شماره‌گذاری صفحه‌ها…
+	Keyboard shortcuts	میانبر‌های صفحه کلید
+	Join the ArtCraft Discord	به دیسکورد ArtCraft بپیوندید
+	PdfCraft web page	صفحه وب PdfCraft
+	PdfCraft on GitHub	PdfCraft در GitHub
+	ArtCraft website	وبسایت ArtCraft
+	Check for updates…	بررسی به‌روز‌رسانی‌ها…
+	About PdfCraft	درباره PdfCraft
+	Export a PDF	برونبرد یک PDF
+	Export to	برونبرد به
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Spreadsheet (.xlsx)	صفحه گسترده (.xlsx)
+	Presentation (.pptx)	ارائه (.pptx)
+	Image (PNG)	تصویر (PNG)
+	Export all images	برونبرد همه تصاویر
+	HTML web page	صفحه وب HTML
+	Rich Text Format (.rtf)	قالب متن غنی (.rtf)
+	Text (plain)	متن (ساده)
+	PostScript / EPS	PostScript / EPS
+	Fill & Sign	پر کردن و امضا
+	Fill	پر کردن
+	Checkmark	علامت تیک
+	Cross	ضرب در
+	Dot	نقطه
+	Line	خط
+	Date	تاریخ
+	Signature	امضا
+	Initials	حروف اول
+	Edit a PDF	ویرایش یک PDF
+	Modify page	تغییر صفحه
+	Rotate pages	چرخش صفحه‌ها
+	Insert pages	درج صفحه‌ها
+	Extract pages	استخراج صفحه‌ها
+	Add content	افزودن محتوا
+	Text	متن
+	Image	تصویر
+	Header and footer	سرصفحه و پاصفحه
+	Watermark	چاپ سایه
+	Link	پیوند
+	Bates numbering	شماره‌گذاری Bates
+	Background	پس‌زمینه
+	Attach file	پیوست کردن فایل
+	Create a PDF	ایجاد یک PDF
+	Create from	ایجاد از
+	Single file	فایل تکی
+	Multiple files	چند فایل
+	Separate PDFs	PDFهای جداگانه
+	Images	تصاویر
+	Clipboard	بریده دان
+	Blank page	صفحه خالی
+	Combine files	ترکیب فایل‌ها
+	Combine	ترکیب
+	Add files to combine	افزودن فایل‌ها برای ترکیب
+	Page options	گزینه‌های صفحه
+	Page grid	شبکه صفحه
+	Rotate	چرخش
+	Delete	حذف
+	Extract	استخراج
+	Insert	درج
+	Replace	جای‌گزینی
+	Split	تفکیک
+	More	بیشتر
+	Set page boxes	تعیین جعبه‌های صفحه
+	Set page transitions	تعیین انتقال‌های صفحه
+	Page labels	برچسب‌های صفحه
+	Page transitions	انتقال‌های صفحه
+	Add comments	افزودن یادداشت‌ها
+	Markup	نشانه‌گذاری
+	Sticky note	یادداشت چسبان
+	Underline	زیرخط
+	Strikethrough	خط خوردگی
+	Squiggly underline	زیرخط موجدار
+	Text box	جعبه متن
+	Drawing	ترسیم
+	Rectangle	مستطیل
+	Oval	بیضی
+	Arrow	پیکان
+	Cloud	ابر
+	Stamp	مهر
+	Review	باز‌بینی
+	Comment list	فهرست یادداشت‌ها
+	Scan & OCR	پویش و OCR
+	Recognize text	شناسایی متن
+	In this file	در این فایل
+	In multiple files	در چندین فایل
+	Enhance scanned file	بهبود فایل پویش‌شده
+	Correct recognized text	تصحیح متن شناسایی‌شده
+	Protect a PDF	محافظت از یک PDF
+	Protect	محافظت
+	Protect with password	محافظت با گذرواژه
+	Remove hidden information	حذف اطلاعات پنهان
+	Advanced options	گزینه‌های پیشرفته
+	Encrypt with certificate	رمز‌گذاری با گواهی
+	Security properties	ویژگی‌های امنیت
+	Redact a PDF	سیاه‌کردن یک PDF
+	Redact	سیاه‌کردن
+	Redact pages	سیاه‌کردن صفحه‌ها
+	Find text and redact	یافتن متن و سیاه‌کردن
+	Set properties	تعیین ویژگی‌ها
+	Sanitize document	پاک‌سازی سند
+	Compress a PDF	فشرده‌سازی یک PDF
+	Optimize	بهینه‌سازی
+	Reduce file size	کاهش اندازه فایل
+	Advanced optimization	بهینه‌سازی پیشرفته
+	Audit space usage	بررسی میزان فضای مصرفی
+	Field list	فهرست فیلد‌ها
+	Field properties	ویژگی‌های فیلد
+	Tab order by rows	ترتیب زبانه بر اساس سطر‌ها
+	Tab order by columns	ترتیب زبانه بر اساس ستون‌ها
+	Import data	درون‌ریزی داده‌ها
+	Export data	برونبری داده‌ها
+	Add form components	افزودن اجزای فرم
+	Text field	فیلد متن
+	Checkbox	کادر انتخاب
+	Radio button	دکمه رادیویی
+	Drop-down list	فهرست کشویی
+	List box	جعبه فهرست
+	Button	دکمه
+	Image field	فیلد تصویر
+	Date field	فیلد تاریخ
+	Digital signature	امضای دیجیتال
+	Stamps	مهر‌ها
+	Stamp palette	پالت مهر‌ها
+	Use a certificate	استفاده از یک گواهی
+	Certificates	گواهی‌ها
+	Timestamp	مهر زمانی
+	Use print production	استفاده از تولید چاپ
+	Print production	تولید چاپ
+	Output preview	پیش‌نمایش خروجی
+	Preflight	پیش‌بررسی
+	Convert colors	تبدیل رنگ‌ها
+	Add printer marks	افزودن نشانه‌های چاپگر
+	Fix hairlines	اصلاح خطوط مویی
+	Measure objects	اندازه‌گیری اشیا
+	Measure	اندازه‌گیری
+	Measuring tool	ابزار اندازه‌گیری
+	Geospatial location	موقعیت مکانی جغرافیایی
+	Compare files	مقایسه فایل‌ها
+	Select files to compare	انتخاب فایل‌ها برای مقایسه
+	Use guided actions	استفاده از کنش‌های هدایت‌شده
+	Actions list	فهرست کنش‌ها
+	Action Wizard	جادوگر کنش
+	Make accessible	دسترس‌پذیر کردن
+	Prepare for distribution	آماده‌سازی برای توزیع
+	Optimize scanned documents	بهینه‌سازی اسناد پویش‌شده
+	Archive documents	بایگانی اسناد
+	Prepare for accessibility	آماده‌سازی برای دسترس‌پذیری
+	Accessibility	دسترس‌پذیری
+	Automatically tag PDF	برچسب‌گذاری خودکار PDF
+	Change reading options	تغییر گزینه‌های خواندن
+	Check for accessibility	بررسی دسترس‌پذیری
+	Add alternate text	افزودن متن جانشین
+	Fix reading order	اصلاح ترتیب خواندن
+	Apply PDF standards	اعمال استاندارد‌های PDF
+	Standards	استاندارد‌ها
+	Save as PDF/A	ذخیره به‌صورت PDF/A
+	Save as PDF/X	ذخیره به‌صورت PDF/X
+	Save as PDF/UA	ذخیره به‌صورت PDF/UA
+	Add search index	افزودن نمایه جستوجو
+	Index	نمایه
+	Manage embedded index	مدیریت نمایه جا‌سازی‌شده
+	Use JavaScript	استفاده از JavaScript
+	JavaScript	JavaScript
+	Console	کنسول
+	Document JavaScripts	JavaScriptهای سند
+	Document actions	کنش‌های سند
+	AI assistant	دستیار هوش مصنوعی
+	Bring your own model (off by default)	مدل خودتان را بی‌آورید (به‌طور پیش‌فرض خاموش)
+	Summarize	خلاصه‌سازی
+	Ask about this document	پرسش درباره این سند
+	Translate	ترجمه
+	pages	صفحه‌ها
+	Planned	برنامه‌ریزی‌شده
+	Planned for milestone	برنامه‌ریزی‌شده برای نقطه عطف
+	open to see what it will include	باز کنید تا ببینید چه چیزی را در بر می‌گیرد
+	Optional: needs an AI provider you configure	اختیاری: به یک ارائه دهنده هوش مصنوعی که خودتان پیکر‌بندی می‌کنید نیاز دارد
+	Coming in milestone	در راه در نقطه عطف
+	Items marked Ready work today.	مواردی که با برچسب آماده مشخص شدهاند امروز کار می‌کنند.
+	Preview	پیش‌نمایش
+	Edit fields	ویرایش فیلد‌ها
+	Try the form as people filling it in will see it	فرم را همان‌گونه که افرادی که آن را پر می‌کنند می‌بینند امتحان کنید
+	Redact all	سیاه‌کردن همه
+	Clear all	پاک کردن همه
+	Rotate page	چرخش صفحه
+	Delete page	حذف صفحه
+	Move page	جابه‌جایی صفحه
+	Move pages	جابه‌جایی صفحه‌ها
+	Duplicate page	تکثیر صفحه
+	Replace page	جای‌گزینی صفحه
+	Replace pages	جای‌گزینی صفحه‌ها
+	Crop page	برش صفحه
+	Cancel	لغو
+	Don't save	ذخیره نکن
+	Apply	اعمال
+	Run	اجرا
+	Clear	پاک کردن
+	Sanitize	پاک‌سازی
+	Mark all	علامت‌گذاری همه
+	Save changes to “{name}” before closing?	تغییرات «{name}» پیش از بستن ذخیره شود؟
+	Your changes will be lost if you don't save them.	اگر آن‌ها را ذخیره نکنید، تغییراتتان از دست می‌رود.
+	Password required	گذرواژه لازم است
+	“{name}” is protected. Enter a password to open it.	«{name}» محافظت‌شده است. برای باز کردن آن گذرواژ‌های وارد کنید.
+	Password	گذرواژه
+	Incorrect password. Try again.	گذرواژه نادرست است. دوباره تلاش کنید.
+	Recognize Text	شناسایی متن
+	Password protection will be applied when you save	محافظت با گذرواژه هنگام ذخیره اعمال می‌شود
+	Saved the print-ready PDF to {path}	PDF آماده چاپ در {path} ذخیره شد
+	Could not save: {e}	ذخیره نشد: {e}
+	Earlier in tab order	پیش‌تر در ترتیب زبانه
+	Later in tab order	بعد‌تر در ترتیب زبانه
+	Calculation order	ترتیب محاسبه
+	Fix order	اصلاح ترتیب
+	Move only what must move, so every field calculates after the fields it reads.	فقط آنچه باید جابه جا شود را جابه جا کنید تا هر فیلد پس از فیلد‌هایی که می‌خواند محاسبه شود.
+	Earlier in calculation order	پیش‌تر در ترتیب محاسبه
+	Later in calculation order	بعد‌تر در ترتیب محاسبه
+	Too early	خیلی زود
+	Reads {name}, which calculates later, so it shows an old value.	{name} را می‌خواند که بعد‌تر محاسبه می‌شود، پس مقدار قدیمی را نشان می‌دهد.
+	Loop	حلقه
+	Reads {names}, which read it back. No order can fix a loop: change one of the formulas.	{names} را می‌خواند که به نوبه خود آن را می‌خوانند. هیچ ترتیبی حلقه را اصلاح نمی‌کند: یکی از فرمول‌ها را تغییر دهید.
+	Not in order	نامرتب
+	Missing from the calculation order saved in the PDF: other PDF viewers may not calculate it.	در ترتیب محاسب‌های که در PDF ذخیره شده وجود ندارد: سایر نمایشگر‌های PDF ممکن است آن را محاسبه نکنند.
+	Back to Prepare a form	بازگشت به آماده‌سازی فرم
+	No field in this form calculates its value yet. Give a field a calculation on the Calculate tab of its properties, and it shows here.	هنوز هیچ فیلدی در این فرم مقدارش را محاسبه نمی‌کند. به یک فیلد در برگه محاسبه از ویژگی‌هایش یک محاسبه بدهید تا اینجا نمایش داده شود.
+	{names} and {last}	{names} و {last}
+	{field} reads no other field	{field} هیچ فیلد دی‌گری را نمی‌خواند
+	{field} reads {fields}	{field} {fields} را می‌خواند
+	No field reads it	هیچ فیلدی آن را نمی‌خواند
+	The order saved in the PDF needs tidying	ترتیب ذخیره‌شده در PDF نیاز به مرتب‌سازی دارد
+	Moves only what must move	فقط آنچه باید جابه جا شود را جابه جا می‌کند
+	Every field calculates after the fields it reads.	هر فیلد پس از فیلد‌هایی که می‌خواند محاسبه می‌شود.
+	Every field outside a loop calculates after the fields it reads.	هر فیلد بیرون از یک حلقه پس از فیلد‌هایی که می‌خواند محاسبه می‌شود.
+	{field} reads its own value	{field} مقدار خودش را می‌خواند
+	{fields} read each other	{fields} یکدیگر را می‌خوانند
+	No order can fix a loop. Change one of the formulas.	هیچ ترتیبی حلقه را اصلاح نمی‌کند. یکی از فرمول‌ها را تغییر دهید.
+	Edit {field}'s formula	ویرایش فرمول {field}
+	Order · top calculates first	ترتیب · بالا اول محاسبه می‌شود
+	Script	اسکریپت
+	Links on page	پیوند‌های روی صفحه
+	Show on the page which fields each field reads	روی صفحه نشان بده که هر فیلد کدام فیلد‌ها را می‌خواند
+	Drag a field to move it, or select it and press {up} or {down}.	یک فیلد را برای جابه‌جایی بکشید، یا آن را انتخاب کنید و {up} یا {down} را فشار دهید.
+	From:	از:
+	To:	تا:
+	High Resolution	تفکیک‌پذیری بالا
+	Print	چاپ
+	Verify to see what the document needs.	برای دیدن نیاز‌های سند، بررسی کنید.
+	Set Page Boxes	تعیین جعبه‌های صفحه
+	Signature panel	پنل امضا
+	{month} {day}, {y}	{day} {month} {y}
+	The document's security settings don't allow filling in form fields	تنظیمات امنیتی سند اجازه پر کردن فیلد‌های فرم را نمی‌دهد
+	{name} is read-only	{name} فقط خواندنی است
+	{name} has no action	{name} هیچ کنشی ندارد
+	Previous month	ماه پیش
+	Next month	ماه بعد
+	January	ژانویه
+	February	فوریه
+	March	مارس
+	April	آوریل
+	May	مه
+	June	ژوئن
+	July	ژوئیه
+	August	اوت
+	September	سپتامبر
+	October	اکتبر
+	November	نوامبر
+	December	دسامبر
+	Done	انجام شد
+	This certificate is in your list of trusted certificates.	این گواهی در فهرست گواهی‌های مورد اعتماد شماست.
+	This certificate is trusted through a certificate above it in the chain.	این گواهی از طریق گواهی بالا‌تر از آن در زنجیره مورد اعتماد است.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	این گواهی مورد اعتماد نیست. امضا‌های ساخته‌شده با آن هویتی ناشناخته نشان می‌دهند.
+	Add to Trusted Certificates	افزودن به گواهی‌های مورد اعتماد
+	Export…	برونبری…
+	PDF Optimizer	بهینه‌ساز PDF
+	Discard Objects	دور انداختن اشیا
+	Discard User Data	دور انداختن داده‌های کاربر
+	Clean Up	پاک‌سازی
+	Color Images	تصاویر رنگی
+	Grayscale Images	تصاویر خاکستری
+	Bicubic downsampling to	نمونه برداری کاهشی دو مکعبی به
+	for images above	برای تصاویر بالا‌تر از
+	Compression	فشرده‌سازی
+	ZIP	ZIP
+	Retain existing	نگهداشتن موجود
+	Minimum	کمینه
+	Low	پایین
+	High	بالا
+	Maximum	بیشینه
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	هر تصویر همان‌جا که صفحه‌ها آن را ترسیم می‌کنند اندازه‌گیری می‌شود؛ تصویر تن‌ها در صورتی جایگزین می‌شود که نتیجه کوچک‌تر باشد.
+	Discard all links, actions and JavaScript	دور انداختن همه پیوند‌ها، کنش‌ها و JavaScript
+	Discard alternate images	دور انداختن تصاویر جانشین
+	Discard embedded page thumbnails	دور انداختن تصاویر بندانگشتی جا‌سازی‌شده صفحه
+	Discard document tags	دور انداختن برچسب‌های سند
+	Discard embedded print settings	دور انداختن تنظیمات چاپ جا‌سازی‌شده
+	Discard bookmarks	دور انداختن نشانک‌ها
+	Discard hidden layer content	دور انداختن محتوای لایه پنهان
+	Discard all comments, forms and multimedia	دور انداختن همه یادداشت‌ها، فرم‌ها و چند‌رسان‌های
+	Discard document information and metadata	دور انداختن اطلاعات و فراداده‌های سند
+	Discard all object data (file attachments)	دور انداختن همه داده‌های شیء (پیوست‌های فایل)
+	Discard private data of other applications	دور انداختن داده‌های خصوصی سایر برنامه‌ها
+	Discard hidden text	دور انداختن متن پنهان
+	Use Flate to encode streams that are not encoded	استفاده از Flate برای کد‌گذاری جریان‌هایی که کد‌گذاری نشدهاند
+	In streams that use LZW encoding, use Flate instead	در جریان‌هایی که از کد‌گذاری LZW استفاده می‌کنند، به‌جای آن از Flate استفاده کنید
+	Remove invalid links and bookmarks	حذف پیوند‌ها و نشانک‌های نامعتبر
+	Remove unreferenced named destinations	حذف مقصد‌های نامدار بدون ارجاع
+	Compress document structure (object streams)	فشرده‌سازی ساختار سند (جریان‌های شیء)
+	Remove unused objects and merge identical ones	حذف اشیای بدون استفاده و ادغام اشیای یکسان
+	Audit space usage…	بررسی میزان فضای مصرفی…
+	Space Audit	بررسی فضا
+	What takes up the space in this file, by kind of content.	چه چیزی فضای این فایل را اشغال می‌کند، بر حسب نوع محتوا.
+	Bytes	بایت
+	Content Streams	جریان‌های محتوا
+	X Object Forms	فرم‌های XObject
+	Structure Info	اطلاعات ساختار
+	Thumbnails	تصاویر بندانگشتی
+	Named Destinations	مقصد‌های نامدار
+	Color Spaces	فضا‌های رنگ
+	Shadings	سایه زنی‌ها
+	Patterns (graphics objects)	الگو‌ها (اشیای گرافیکی)
+	Extended Graphics States	حالت‌های گرافیکی توسعه یافته
+	Embedded Files	فایل‌های جا‌سازی‌شده
+	Document Overhead	سربار سند
+	Total	مجموع
+	Text Field Properties	ویژگی‌های فیلد متن
+	Check Box Properties	ویژگی‌های کادر انتخاب
+	Radio Button Properties	ویژگی‌های دکمه رادیویی
+	Dropdown Properties	ویژگی‌های فهرست کشویی
+	List Box Properties	ویژگی‌های جعبه فهرست
+	Button Properties	ویژگی‌های دکمه
+	Digital Signature Properties	ویژگی‌های امضای دیجیتال
+	Position	موقعیت
+	Options	گزینه‌ها
+	Validate	اعتبارسنجی
+	Calculate	محاسبه
+	Actions	کنش‌ها
+	This field is locked. Unlock it to change its properties.	این فیلد قفل است. برای تغییر ویژگی‌هایش آن را باز کنید.
+	Tooltip:	راهنمای ابزار:
+	Common Properties	ویژگی‌های مشترک
+	Read Only	فقط خواندنی
+	Required	الزامی
+	Font Size:	اندازه قلم:
+	Auto	خودکار
+	Text Color:	رنگ متن:
+	Borders and Colors	حاشیه‌ها و رنگ‌ها
+	Border Color:	رنگ حاشیه:
+	Fill Color:	رنگ پرشدگی:
+	No color	بدون رنگ
+	Beveled	پخدار
+	Left:	چپ:
+	Bottom:	پایین:
+	Width:	عرض:
+	Height:	ارتفاع:
+	Rotation:	چرخش:
+	Points from the page's bottom-left corner.	نقاط از گوشه پایین چپ صفحه.
+	Alignment:	تراز‌بندی:
+	Default Value:	مقدار پیش‌فرض:
+	Multi-line	چند‌خطی
+	Scroll long text	پیمایش متن طولانی
+	Allow Rich Text Formatting	اجازه قالب‌بندی متن غنی
+	Limit of	محدودیت
+	characters	نویسه
+	Field is used for file selection	فیلد برای انتخاب فایل استفاده می‌شود
+	Check spelling	بررسی املا
+	Comb of	شان‌های
+	Export Value: {on}	مقدار برونبری: {on}
+	Check box is checked by default	کادر به‌طور پیش‌فرض علامت خورده است
+	Button is checked by default	دکمه به‌طور پیش‌فرض علامت خورده است
+	Buttons with the same name and value are selected in unison	دکمه‌هایی با نام و مقدار یکسان هم‌زمان انتخاب می‌شوند
+	Item:	مورد:
+	Item List	فهرست موارد
+	Up	بالا
+	Delete {o}	حذف {o}
+	Add the choices people pick from.	گزینه‌هایی که افراد از میانشان انتخاب می‌کنند را بی‌فزایید.
+	Default:	پیش‌فرض:
+	(none)	(هیچکدام)
+	Sort items	مرتب‌سازی موارد
+	Allow user to enter custom text	اجازه دادن به کاربر برای وارد کردن متن سفارشی
+	Multiple selection	انتخاب چند‌گانه
+	Commit selected value immediately	ثبت فوری مقدار انتخاب‌شده
+	Number	عدد
+	Percentage	درصد
+	Time	زمان
+	Special	ویژه
+	Select format category:	دسته قالب را انتخاب کنید:
+	The value is shown as typed.	مقدار همان‌گونه که تایپ شده نشان داده می‌شود.
+	Decimal places:	ارقام اعشار:
+	Separator style:	سبک جدا‌کننده:
+	Currency symbol:	نماد واحد پول:
+	Before the number	پیش از عدد
+	Negative number style:	سبک اعداد منفی:
+	Format:	قالب:
+	Custom:	سفارشی:
+	Zip Code	کد پستی
+	Zip Code + 4	کد پستی + ۴
+	Phone Number	شماره تلفن
+	Social Security Number	شماره امنیت اجتماعی
+	Arbitrary Mask	ماسک دلبخواه
+	Mask:	ماسک:
+	9 digit, A letter, O letter or digit, X any character	۹: رقم؛ A: حرف؛ O: حرف یا رقم؛ X: هر نویسه
+	Example: {sample}	نمونه: {sample}
+	Field value is not validated	مقدار فیلد اعتبارسنجی نمی‌شود
+	Field value is in range:	مقدار فیلد در بازه است:
+	Add an Action	افزودن یک کنش
+	Select Trigger:	انتخاب محرک:
+	Mouse Up	رها کردن دکمه ماوس
+	Mouse Down	فشار دادن دکمه ماوس
+	Mouse Enter	ورود ماوس
+	Mouse Exit	خروج ماوس
+	On Focus	هنگام دریافت فوکوس
+	On Blur	هنگام از دست دادن فوکوس
+	Select Action:	انتخاب کنش:
+	Open a web link	باز کردن یک پیوند وب
+	Reset a form	باز‌نشانی یک فرم
+	Execute a menu item	اجرای یک مورد منو
+	Show a field	نمایش یک فیلد
+	Hide a field	پنهان کردن یک فیلد
+	Submit a form	ارسال یک فرم
+	Fields to reset (comma-separated; empty: all)	فیلد‌های باز‌نشانی (جدا شده با کاما؛ خالی: همه)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print، NextPage، PrevPage، FirstPage یا LastPage
+	Field names (comma-separated)	نام‌های فیلد (جدا شده با کاما)
+	URL to submit to	URL برای ارسال به آن
+	Script:	اسکریپت:
+	Value:	مقدار:
+	No actions	بدون کنش
+	Value is not calculated	مقدار محاسبه نمی‌شود
+	Value is the	مقدار برابر است با
+	sum (+)	مجموع (+)
+	product (x)	حاصلضرب (x)
+	average	میانگین
+	minimum	کمینه
+	maximum	بیشینه
+	of the following fields:	از فیلد‌های زیر:
+	Simplified field notation:	نشانه‌گذاری ساده‌شده فیلد:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	نام فیلد‌ها با + - * / و پرانتز‌ها؛ قبل از فاصله‌ها در نام‌ها \\ بگذارید.
+	Finding document fonts…	یافتن قلم‌های سند…
+	Installed fonts…	قلم‌های نصب‌شده…
+	Keep source fonts	حفظ قلم‌های منبع
+	Load font…	بار‌گذاری قلم…
+	No openly licensed document fonts found. Load a font file.	هیچ قلم سند با مجوز باز یافت نشد. یک فایل قلم بار‌گذاری کنید.
+	Format text	قالب‌بندی متن
+	Bold	پررنگ
+	Italic	کج
+	Align left	تراز‌بندی چپ
+	Centre	وسطچین
+	Align right	تراز‌بندی راست
+	Justify	هم‌تراز
+	Thai and Arabic use regular fallback fonts when available.	تایلندی و عربی در صورت موجود بودن از قلم‌های جانشین عادی استفاده می‌کنند.
+	Edit image	ویرایش تصویر
+	Rotate counterclockwise	چرخش پادساعتگرد
+	Rotate clockwise	چرخش ساعتگرد
+	Flip horizontal	وارونگی افقی
+	Flip vertical	وارونگی عمودی
+	Replace image	جای‌گزینی تصویر
+	Crop (% trimmed from each side)	برش (درصد کاسته‌شده از هر طرف)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	روی صفحه کلیک کنید تا متن اضافه شود؛ هر کلیک یک کادر جدید آغاز می‌کند و ✓ پایان می‌دهد. برای جابه‌جایی موارد را بکشید، برای تغییر اندازه گوش‌های را بکشید و برای ویرایش متن دوبار کلیک کنید.
+	Choose an image	انتخاب یک تصویر
+	Export to Image	صدور به تصویر
+	Export to Text	صدور به متن
+	Export All Images	صدور همه تصاویر
+	Resolution	تفکیک‌پذیری
+	Format	قالب
+	Quality	کیفیت
+	One {f} file per page, named after the document.	یک فایل {f} در هر صفحه، نام‌گذاری‌شده بر اساس سند.
+	Exclude images smaller than	کنار گذاشتن تصاویر کوچک‌تر از
+	No limit	بدون محدودیت
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	هر تصویر یک بار، نام‌گذاری‌شده بر اساس سند و صفحه. تصاویر JPEG بدون تغییر ذخیره می‌شوند؛ بقیه به‌صورت PNG.
+	Plain text in reading order; pages are separated by form feeds.	متن ساده به ترتیب خواندن؛ صفحه‌ها با نویسه‌های فرمفید از هم جدا می‌شوند.
+	Create {what}	ایجاد {what}
+	initials	حروف اول
+	signature	امضا
+	Create Custom Stamp	ایجاد مهر سفارشی
+	From {file}	از {file}
+	Category:	دسته:
+	e.g. My stamps	مثلاً مهر‌های من
+	Name:	نام:
+	Custom	سفارشی
+	Delete stamp	حذف مهر
+	Create custom stamp…	ایجاد مهر سفارشی…
+	From a PDF page or an image	از یک صفحه PDF یا یک تصویر
+	Line spacing	فاصله خطوط
+	Character spacing	فاصله نویسه‌ها
+	Horizontal scale	مقیاس افقی
+	Rotate Clockwise	چرخش ساعتگرد
+	Rotate Counterclockwise	چرخش پادساعتگرد
+	Flip Horizontal	وارونگی افقی
+	Flip Vertical	وارونگی عمودی
+	Replace Image…	جای‌گزینی تصویر…
+	Save Image As…	ذخیره تصویر به‌عنوان…
+	Copy Image	کپی تصویر
+	The image has been copied ({w} × {h} pixels)	تصویر کپی شد ({w} × {h} پیکسل)
+	Couldn't copy the image: {e}	کپی تصویر انجام نشد: {e}
+	Copy Image in Original Format	کپی تصویر در قالب اصلی
+	The image has been copied as a {ext} file	تصویر به‌صورت یک فایل {ext} کپی شد
+	The page has changed; select the image again	صفحه تغییر کرده است؛ تصویر را دوباره انتخاب کنید
+	Check for updates	بررسی به‌روز‌رسانی‌ها
+	No check has run yet.	هنوز هیچ بررسیای انجام نشده است.
+	Checking for a newer version…	بررسی برای نگارش تازه‌تر…
+	PdfCraft {v} is available.	PdfCraft {v} در دسترس است.
+	You have version {c}. Download the new version from its release page.	شما نگارش {c} را دارید. نگارش جدید را از صفحه انتشار آن دانلود کنید.
+	PdfCraft {c} is up to date.	PdfCraft {c} به‌روز است.
+	Couldn't check for updates: {e}	بررسی به‌روز‌رسانی‌ها انجام نشد: {e}
+	You have version {c}. All releases are listed at {page}.	شما نگارش {c} را دارید. همه انتشار‌ها در {page} فهرست شدهاند.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	آخرین انتشار را از GitHub می‌پرسد. هیچ چیزی به‌طور خودکار دانلود یا نصب نمی‌شود.
+	Download	دانلود
+	Later	بعداً
+	none	هیچکدام
+	Declared conformance: {shown}	انطباق اعلام‌شده: {shown}
+	Output intent: {list}	قصد خروجی: {list}
+	Conformance level:	سطح انطباق:
+	No problems found: the document conforms to {level}.	مشکلی یافت نشد: سند با {level} منطبق است.
+	 (page {p})	 (صفحه {p})
+	  · not fixable here	  · اینجا قابل رفع نیست
+	Verify	تأیید
+	Box	کادر
+	Units	واحد‌ها
+	Set to zero	تنظیم به صفر
+	Current page ({n})	صفحه کنونی ({n})
+	Subset	زیرمجموعه
+	Update	به‌روز‌رسانی
+	Add	افزودن
+	{verb} Header and Footer	{verb} سرصفحه و پاصفحه
+	{verb} Watermark	{verb} واترمارک
+	{verb} Background	{verb} پس‌زمینه
+	Margins	حاشیه‌ها
+	Left Header Text	متن سرصفحه چپ
+	Center Header Text	متن سرصفحه وسط
+	Right Header Text	متن سرصفحه راست
+	Left Footer Text	متن پاصفحه چپ
+	Center Footer Text	متن پاصفحه وسط
+	Right Footer Text	متن پاصفحه راست
+	Insert Page Number	درج شماره صفحه
+	Insert Date	درج تاریخ
+	Start page number	شماره صفحه شروع
+	Shrink the page content to make room for the header and footer	کوچک کردن محتوای صفحه برای ایجاد جا برای سرصفحه و پاصفحه
+	Source	منبع
+	Fit to page	اندازه با صفحه
+	Rotation	چرخش
+	Appear behind page	نمایش پشت صفحه
+	Appear on top of page	نمایش روی صفحه
+	Offset from centre	فاصله از مرکز
+	From colour	از رنگ
+	Page Range Options	گزینه‌های بازه صفحه
+	Preview: page {p} of {n}	پیش‌نمایش: صفحه {p} از {n}
+	Applies to 1 page	روی ۱ صفحه اعمال می‌شود
+	Applies to {n} pages	روی {n} صفحه اعمال می‌شود
+	Replaces the existing one on those pages.	مورد موجود در آن صفحه‌ها را جایگزین می‌کند.
+	PDF or image	PDF یا تصویر
+	No file chosen	هیچ فایلی انتخاب نشده
+	Page number	شماره صفحه
+	Scale relative to target page	مقیاس نسبت به صفحه هدف
+	Link Properties	ویژگی‌های پیوند
+	Create Link	ایجاد پیوند
+	Link Appearance	ظاهر پیوند
+	Link Type:	نوع پیوند:
+	Visible Rectangle	مستطیل قابل مشاهده
+	Invisible Rectangle	مستطیل نامرئی
+	Highlight Style:	سبک برجسته‌سازی:
+	Invert	وارون
+	Outline	خط دور
+	Inset	فرورفته
+	Line Thickness:	ضخامت خط:
+	Thin	نازک
+	Thick	ضخیم
+	Line Style:	سبک خط:
+	Solid	پیوسته
+	Dashed	خطچین
+	Color:	رنگ:
+	Link Action	کنش پیوند
+	Open a web page	باز کردن یک صفحه وب
+	Go to a page view	رفتن به نمایش صفحه
+	Type the web address.	نشانی وب را تایپ کنید.
+	This document has no signatures.	این سند هیچ امضایی ندارد.
+	The Keychain's digital IDs couldn't be listed: {e}	شناسه‌های دیجیتال Keychain فهرست نشدند: {e}
+	Signed and saved to {path}	امضا و در {path} ذخیره شد
+	Couldn't open revision {n}: {e}	باز کردن باز‌نگری {n} انجام نشد: {e}
+	Couldn't open the signed version: {e}	باز کردن نگارش امضا‌شده انجام نشد: {e}
+	Sign with a Digital ID	امضا با شناسه دیجیتال
+	Choose the digital ID that you want to use for signing:	شناسه دیجیتالی را که می‌خواهید برای امضا استفاده کنید انتخاب کنید:
+	Keychain  ·  	Keychain  ·  
+	Windows store  ·  	فروشگاه Windows  ·  
+	Issued by: 	صادر‌شده توسط: 
+	, Expires: 	، انقضا: 
+	Digitally signed by	امضا‌شده دیجیتالی توسط
+	DN: 	DN: 
+	Reason: 	دلیل: 
+	Location: 	مکان: 
+	Date: 	تاریخ: 
+	The labels are in English: the signature's font can't draw them in this language.	برچسب‌ها به انگلیسی هستند: قلم امضا نمی‌تواند آن‌ها را به این زبان بکشد.
+	No digital IDs yet.	هنوز هیچ شناسه دیجیتالی وجود ندارد.
+	Configure New Digital ID	پیکر‌بندی شناسه دیجیتال جدید
+	Remove "{name}" from this list? The file itself is not deleted.	«{name}» از این فهرست حذف شود؟ خود فایل حذف نمی‌شود.
+	Continue	ادامه
+	Configure a Digital ID for Signing	پیکر‌بندی یک شناسه دیجیتال برای امضا
+	Use a Digital ID from a file	استفاده از یک شناسه دیجیتال از یک فایل
+	Create a new Digital ID (self-signed, saved to a password-protected file)	ایجاد یک شناسه دیجیتال جدید (خودامضا، ذخیره‌شده در فایلی محافظت‌شده با گذرواژه)
+	Name	نام
+	Organizational Unit	واحد سازمانی
+	Organization Name	نام سازمان
+	Email Address	نشانی ایمیل
+	Country/Region	کشور/منطقه
+	Key Algorithm	الگوریتم کلید
+	Confirm Password	تأیید گذرواژه
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	برای امضا‌های دیجیتال، به مدت ۵ سال معتبر است. شناسه‌های خودامضا معمولاً مورد اعتماد دیگران نیستند.
+	File (.p12, .pfx)	فایل (.p12، .pfx)
+	Digital ID	شناسه دیجیتال
+	Browse…	مرور…
+	{verb} as "{name}"	{verb} به‌عنوان «{name}»
+	Certify	گواهی کردن
+	The signature will be invisible.	امضا نامرئی خواهد بود.
+	Distinguished name	نام ممتاز
+	Labels	برچسب‌ها
+	Graphic	نگاره
+	Signer's name	نام امضا‌کننده
+	Fill & Sign signature	امضای پُرکردن و امضا
+	Choose image…	انتخاب تصویر…
+	Permitted actions after certifying	کنش‌های مجاز پس از گواهی کردن
+	No changes allowed	هیچ تغییری مجاز نیست
+	Annotations, form fill-in, and digital signatures	حاشیه‌نویسی‌ها، پُرکردن فرم و امضا‌های دیجیتال
+	Form fill-in and digital signatures	پُرکردن فرم و امضا‌های دیجیتال
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	کلید در Keychain macOS است، که ممکن است برای اجازه دادن به PdfCraft برای استفاده از آن درخواست کند.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	کلید در مخزن گواهی Windows است، که ممکن است برای اجازه دادن به PdfCraft برای استفاده از آن درخواست کند.
+	Digital ID password	گذرواژه شناسه دیجیتال
+	Back	بازگشت
+	Validate all	اعتبارسنجی همه
+	Sign this field…	امضای این فیلد…
+	Signature is valid:	امضا معتبر است:
+	Signature validity is UNKNOWN:	اعتبار امضا ناشناخته است:
+	Signature is INVALID:	امضا نامعتبر است:
+	Signature Details	جزئیات امضا
+	Reason	دلیل
+	Signing time	زمان امضا
+	Algorithm	الگوریتم
+	Signer	امضا‌کننده
+	Issued by	صادر‌شده توسط
+	Valid	معتبر
+	Field	فیلد
+	Field: {field} on page {p}	فیلد: {field} در صفحه {p}
+	Add to trusted certificates	افزودن به گواهی‌های مورد اعتماد
+	View signed version	نمایش نگارش امضا‌شده
+	Show certificate…	نمایش گواهی…
+	Export certificate…	صدور گواهی…
+	Certificate Viewer	نمایشگر گواهی
+	This dialog shows the details of a certificate and its chain.	این گفتوگو جزئیات یک گواهی و زنجیره آن را نشان می‌دهد.
+	Trust	اعتماد
+	Issued to	صادر‌شده برای
+	Valid from	معتبر از
+	Valid to	معتبر تا
+	Intended usage	کاربرد موردنظر
+	Any	هر
+	Version	نگارش
+	Serial number	شماره سریال
+	Issuer	صادر‌کننده
+	Validity starts	آغاز اعتبار
+	Validity ends	پایان اعتبار
+	Public key	کلید عمومی
+	Key usage	کاربرد کلید
+	Not present	موجود نیست
+	Self-signed	خودامضا
+	Edit Action	ویرایش کنش
+	New Action	کنش جدید
+	Action name:	نام کنش:
+	Description:	توضیح:
+	Steps	گام‌ها
+	Add the steps this action runs, in order.	گام‌هایی را که این کنش به ترتیب اجرا می‌کند اضافه کنید.
+	Add Step	افزودن گام
+	An action with this name already exists.	کنشی با این نام از قبل وجود دارد.
+	New Action…	کنش جدید…
+	Edit…	ویرایش…
+	Add watermark	افزودن واترمارک
+	Add header	افزودن سرصفحه
+	Add footer	افزودن پاصفحه
+	Set document title	تعیین عنوان سند
+	Run a JavaScript	اجرای یک JavaScript
+	Prepare for Distribution	آماده‌سازی برای توزیع
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	حذف اطلاعات پنهان و تخت‌کردن یادداشت‌ها و فیلد‌های فرم، تا گیرندگان فقط صفحه‌ها را ببینند.
+	Optimize Scanned Documents	بهینه‌سازی اسناد اسک‌نشده
+	Make scans searchable, then make them smaller.	اسکن‌ها را قابل جستوجو کنید، سپس حجمشان را کاهش دهید.
+	Add Page Numbers	افزودن شماره‌های صفحه
+	Number every page in the footer.	هر صفحه را در پاصفحه شماره‌گذاری کنید.
+	Mark as Confidential	علامت‌گذاری به‌عنوان محرمانه
+	A diagonal CONFIDENTIAL watermark on every page.	یک واترمارک مورب CONFIDENTIAL روی هر صفحه.
+	Sanitize Documents	پاک‌سازی اسناد
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	حذف اطلاعات پنهان، فراداده، اسکریپت‌ها و محتوای جا‌سازی‌شده، و باز‌نویسی فایل‌ها.
+	Type text	تایپ متن
+	Text to insert	متن برای درج
+	Inserted text	متن درج‌شده
+	Replacement text	متن جایگزین
+	Edit text…	ویرایش متن…
+	Add a sticky note here	افزودن یک یادداشت چسبان در اینجا
+	{kind} Properties	ویژگی‌های {kind}
+	Appearance	ظاهر
+	General	عمومی
+	Review History	تاریخچه باز‌بینی
+	This comment's appearance can't be changed yet.	ظاهر این یادداشت هنوز قابل تغییر نیست.
+	Icon	نماد
+	Thickness	ضخامت
+	Line ending	پایان خط
+	Modified	تغییریافته
+	No status has been set.	هیچ وضعیتی تعیین نشده است.
+	Compare Files	مقایسه فایل‌ها
+	Old file:	فایل قدیمی:
+	Open the older version first	ابتدا نگارش قدیمی‌تر را باز کنید
+	New file:	فایل جدید:
+	Text is compared word by word; the differences are shown on the new file.	متن واژهبهواژه مقایسه می‌شود؛ تفاوت‌ها روی فایل جدید نشان داده می‌شوند.
+	Compare this file with an older version: Compare files… in All tools.	این فایل را با یک نگارش قدیمی‌تر مقایسه کنید: مقایسه فایل‌ها… در همه ابزار‌ها.
+	No differences in the text.	هیچ تفاوتی در متن نیست.
+	{n} {kind}	{n} {kind}
+	Inserted	درج‌شده
+	Deleted	حذف‌شده
+	Replaced	جایگزی‌نشده
+	Visual	بصری
+	Mark as comments	علامت‌گذاری به‌عنوان یادداشت
+	Report…	گزارش…
+	{kind} · page {p}	{kind} · صفحه {p}
+	Set Alternate Text	تعیین متن جانشین
+	This document has no tagged figures.	این سند هیچ شکل برچسب گذاری شد‌ه ای ندارد.
+	 on page {p}	 در صفحه {p}
+	Figure {i} of {n}{page}	شکل {i} از {n}{page}
+	No preview	بدون پیش‌نمایش
+	Alternate text	متن جانشین
+	Describe the figure	توصیف شکل
+	Decorative figure	شکل تزئینی
+	Previous figure	شکل قبلی
+	Next figure	شکل بعدی
+	Save & Close	ذخیره و بستن
+	Accessibility Checker Options	گزینه‌های بررسی‌کننده دسترس‌پذیری
+	Report Options	گزینه‌های گزارش
+	Create accessibility report	ایجاد گزارش دسترس‌پذیری
+	Page Range	بازه صفحه
+	All pages in document	همه صفحه‌های سند
+	Checking Options ({on} of 32 in all categories)	گزینه‌های بررسی ({on} از ۳۲ در همه دسته‌ها)
+	Show this dialog when the Checker starts	نمایش این گفتوگو هنگام شروع بررسی‌کننده
+	Select All	انتخاب همه
+	Clear All	پاک کردن همه
+	Start Checking	شروع بررسی
+	This document hasn't been checked yet.	این سند هنوز بررسی نشده است.
+	No issues found	مشکلی یافت نشد
+	1 issue	۱ مشکل
+	{n} issues	{n} مشکل
+	{label} (1 issue)	{label} (۱ مشکل)
+	{label} ({n} issues)	{label} ({n} مشکل)
+	Check again	بررسی دوباره
+	Report	گزارش
+	Show the accessibility report	نمایش گزارش دسترس‌پذیری
+	Collapse	جمع کردن
+	Expand	باز کردن
+	{rule} - {status}	{rule} - {status}
+	Passed	موفق
+	Failed	ناموفق
+	Needs manual check	نیاز‌مند بررسی دستی
+	Skipped	نادیده‌گرفته‌شده
+	Fix	اصلاح
+	Skip Rule	نادیده‌گرفتن قانون
+	Explain	توضیح
+	Check Again	بررسی مجدد
+	Show Report	نمایش گزارش
+	Options…	گزینه‌ها…
+	Go to the page	رفتن به صفحه
+	Page Content	محتوای صفحه
+	Forms	فرم‌ها
+	Alternate Text	متن جایگزین
+	Tables	جدول‌ها
+	Lists	فهرست‌ها
+	Headings	سرتیتر‌ها
+	Accessibility permission flag	پرچم مجوز دسترس‌پذیری
+	Accessibility permission flag is set	پرچم مجوز دسترس‌پذیری تنظیم شده است
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	تنظیمات امنیت باید به فناوری کمکی اجازه دهد محتوا را بخواند («فعال‌کردن دسترسی متنی برای دستگاه‌های صفحه خوان»). امنیت سند را تغییر دهید تا اجازه داده شود.
+	Image-only PDF	PDF فقطتصویری
+	Document is not image-only PDF	سند PDF فقطتصویری نیست
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	صفحه‌هایی که تن‌ها تصویر متن هستند را نمی‌توان با صدای بلند خواند یا جستوجو کرد. متن را تشخیص دهید (OCR) تا لایه متنی افزوده شود.
+	Document is tagged PDF	سند PDF برچسبدار است
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	برچسب‌ها به سند ساختاری منطقی می‌دهند که فناوری کمکی از آن پیروی می‌کند. سند را برچسب بزنید (برچسبزدن خودکار PDF).
+	Logical Reading Order	ترتیب خواندن منطقی
+	Document structure provides a logical reading order	ساختار سند ترتیب خواندن منطقی را فراهم می‌کند
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	بررسی کنید که برچسب‌ها به همان ترتیبی خوانده شوند که یک خواننده بینا می‌خواند. از ابزار ترتیب خواندن یا پنل برچسب‌ها برای اصلاح آن استفاده کنید.
+	Primary language	زبان اصلی
+	Text language is specified	زبان متن مشخص شده است
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	صفحهخوان‌ها صدا را بر پایه زبان سند انتخاب می‌کنند. آن را در ویژگی‌های سند > پیشرفته > زبان تنظیم کنید.
+	Document title is showing in title bar	عنوان سند در نوار عنوان نمایش داده می‌شود
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	پنجره باید به‌جای نام فایل عنوانی معنادار نشان دهد. عنوانی تنظیم کنید و نمایش اولیه > نمایش: عنوان سند.
+	Bookmarks are present in large documents	نشانک‌ها در اسناد بزرگ وجود دارند
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	اسناد بیش از ۲۰ صفحه برای پیمایش به نشانک نیاز دارند. برای بخش‌های اصلی نشانک بی‌فزایید.
+	Color contrast	کنتراست رنگ
+	Document has appropriate color contrast	سند کنتراست رنگ مناسب دارد
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	متن باید برای افراد کمبینا بهاندازه کافی با پس‌زمینه کنتراست داشته باشد. رنگ‌ها را چشمی یا با ابزار کنتراست بررسی کنید.
+	Tagged content	محتوای برچسبدار
+	All page content is tagged	تمام محتوای صفحه برچسبدار است
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	هر چیزی در صفحه باید برچسب بخورد یا به‌عنوان مصنوع (تزئین، سرصفحه، پاصفحه) علامت‌گذاری شود. محتوای بدون برچسب را برچسب بزنید.
+	Tagged annotations	یادداشت‌های برچسبدار
+	All annotations are tagged	تمام یادداشت‌ها برچسبدار هستند
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	یادداشت‌ها، پیوند‌ها و فیلد‌ها باید در درخت برچسب باشند تا اعلام شوند. یادداشت‌ها را برچسب بزنید.
+	Tab order	ترتیب تب
+	Tab order is consistent with structure order	ترتیب تب با ترتیب ساختار سازگار است
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	صفحه‌های دارای پیوند، یادداشت یا فیلد باید به ترتیب ساختار تب شوند. اصلاح، ترتیب تب هر صفحه را روی استفاده از ساختار سند تنظیم می‌کند.
+	Character encoding	رمز‌گذاری نویسه
+	Reliable character encoding is provided	رمز‌گذاری نویسه قابل‌اطمینان فراهم شده است
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	قلم‌ها باید نویسه‌های خود را به یونیکد نگاشت کنند تا متن خوانده و رو‌نویسی شود. قلم‌ها را اصلاح کنید یا PDF را دوباره بسازید.
+	Tagged multimedia	چند‌رسان‌های برچسبدار
+	All multimedia objects are tagged	تمام اشیای چند‌رسان‌های برچسبدار هستند
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	ویدئو، صدا و چند‌رسان‌های غنی باید برچسب بخورند تا اعلام شوند. یادداشت‌های چند‌رسانه ای را برچسب بزنید.
+	Screen flicker	سوسوی صفحه
+	Page will not cause screen flicker	صفحه باعث سوسوی صفحه نمی‌شود
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	پویانمایی چشمکزن می‌تواند باعث تشنج شود. اسکریپت‌ها و رسانه‌ها را از نظر سوسو بررسی کنید.
+	Scripts	اسکریپت‌ها
+	No inaccessible scripts	بدون اسکریپت غیر‌قابلدسترس
+	Timed responses	پاسخ‌های زماندار
+	Page does not require timed responses	صفحه به پاسخ‌های زماندار نیاز ندارد
+	People may need more time to respond. Check that nothing has a time limit.	ممکن است افراد به زمان بیشتری برای پاسخ نیاز داشته باشند. بررسی کنید که چیزی محدودیت زمانی نداشته باشد.
+	Navigation links	پیوند‌های پیمایش
+	Navigation links are not repetitive	پیوند‌های پیمایش تکراری نیستند
+	Repeated navigation links should be skippable. Check links that appear on every page.	پیوند‌های پیمایش تکراری باید قابل‌نادیدهگرفتن باشند. پیوند‌هایی را که در هر صفحه ظاهر می‌شوند بررسی کنید.
+	Tagged form fields	فیلد‌های فرم برچسبدار
+	All form fields are tagged	تمام فیلد‌های فرم برچسبدار هستند
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	فیلد‌های فرم باید در درخت برچسب (برچسب‌های Form) باشند تا اعلام شوند. فیلد‌های فرم را برچسب بزنید.
+	Field descriptions	توضیحات فیلد
+	All form fields have description	تمام فیلد‌های فرم توضیح دارند
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	هر فیلد به راهنمای ابزار نیاز دارد که بگوید چه چیزی وارد شود. یکی در ویژگی‌های فیلد > عمومی > راهنمای ابزار بی‌فزایید.
+	Figures alternate text	متن جایگزین شکل‌ها
+	Figures require alternate text	شکل‌ها به متن جایگزین نیاز دارند
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	تصویر‌ها به متن جای‌گزینی نیاز دارند که آن‌ها را توصیف کند، یا باید تزئینی علامت‌گذاری شوند. به هر شکل متن جایگزین بی‌فزایید.
+	Nested alternate text	متن جایگزین تودرتو
+	Alternate text that will never be read	متن جای‌گزینی که هرگز خوانده نمی‌شود
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	متن جایگزین درون عنصری که از قبل متن جایگزین دارد هرگز خوانده نمی‌شود. متن جایگزین درونی را حذف کنید.
+	Associated with content	مرتبط با محتوا
+	Alternate text must be associated with some content	متن جایگزین باید با محتوایی مرتبط باشد
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	متن جایگزین روی عنصری بدون محتوای صفحه هرگز در دسترس قرار نمی‌گیرد. آن را حذف کنید یا عنصر را به محتوا پیوند دهید.
+	Hides annotation	یادداشت را پنهان می‌کند
+	Alternate text should not hide annotation	متن جایگزین نباید یادداشت را پنهان کند
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	متن جایگزین روی عنصری که شامل پیوند یا فیلد است، آن یادداشت را از فناوری کمکی پنهان می‌کند. متن جایگزین را جابهجا کنید.
+	Other elements alternate text	متن جایگزین سایر عناصر
+	Other elements that require alternate text	سایر عناصری که به متن جایگزین نیاز دارند
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	فرمول‌ها و عناصر غیر‌متنی مشابه به متن جایگزین نیاز دارند. به آن‌ها متن جایگزین بی‌فزایید.
+	Rows	سطر‌ها
+	TR must be a child of Table, THead, TBody, or TFoot	TR باید فرزند Table، THead، TBody یا TFoot باشد
+	Table cells belong in a row. Fix the table's tags.	خانه‌های جدول درون سطر قرار می‌گیرند. برچسب‌های جدول را اصلاح کنید.
+	Headers	سرصفحه‌ها
+	Tables should have headers	جدول‌ها باید سرصفحه داشته باشند
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	خانه‌های سرصفحه (TH) به شنوندگان می‌گویند هر ستون یا سطر چه دارد. خانه‌های سرصفحه را علامت‌گذاری کنید.
+	Regularity	نظم
+	Tables must contain the same number of columns in each row and rows in each column	جدول‌ها باید در هر سطر تعداد ستون یکسان و در هر ستون تعداد سطر یکسان داشته باشند
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	جدول‌های نامنظم پیمایش خانه‌ها را گیج‌کننده می‌کنند. به هر سطر تعداد یکسان خانه بدهید (با احتساب ادغام‌ها).
+	Summary	خلاصه
+	Tables must have a summary	جدول‌ها باید خلاصه داشته باشند
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	خلاصه هدف و چیدمان جدول را توصیف می‌کند. به هر جدول ویژگی Summary بی‌فزایید.
+	List items	عناصر فهرست
+	LI must be a child of L	LI باید فرزند L باشد
+	List items belong in a list. Fix the list's tags.	عناصر فهرست درون فهرست قرار می‌گیرند. برچسب‌های فهرست را اصلاح کنید.
+	Lbl and LBody	Lbl و LBody
+	Lbl and LBody must be children of LI	Lbl و LBody باید فرزند LI باشند
+	List labels and bodies belong in a list item. Fix the list's tags.	برچسب‌ها و بدنه‌های فهرست درون عنصر فهرست قرار می‌گیرند. برچسب‌های فهرست را اصلاح کنید.
+	Appropriate nesting	تودرتویی مناسب
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	سطوح سرتیتر نباید پرش کنند (یک H1 و سپس H3). سرتیتر‌ها را دوباره برچسب بزنید.
+	TH and TD	TH و TD
+	TH and TD must be children of TR	TH و TD باید فرزند TR باشند
+	Mark Page Range	علامت‌گذاری بازه صفحه
+	Pages from	صفحه‌ها از
+	Single word or phrase	واژه یا عبارت تکی
+	Text to find	متن برای یافتن
+	Patterns	الگو‌ها
+	Phone Numbers	شماره‌های تلفن
+	Email Addresses	نشانی‌های رایانامه
+	Credit Cards	کارت‌های اعتباری
+	Social Security Numbers	شماره‌های امنیت اجتماعی
+	Dates	تاریخ‌ها
+	Text in images isn't found; recognise text (OCR) first.	متن درون تصویر‌ها یافت نمی‌شود؛ نخست متن را تشخیص دهید (OCR).
+	No matches.	بدون تطابق.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	برخی نشانک‌ها اینجا نمایش داده نمی‌شوند: پنل تعداد محدودی را فهرست می‌کند، با عمق تودرتویی محدود.
+	{n} match(es) marked for redaction.	{n} تطابق برای سیاه‌کردن علامت‌گذاری شد.
+	Multiple words or phrases	چندین واژه یا عبارت
+	One word or phrase per line	یک واژه یا عبارت در هر خط
+	Import list…	درون‌ریزی فهرست…
+	{n} word(s) or phrase(s)	{n} واژه یا عبارت
+	{name} is too large for a word list (at most 1 MB).	{name} برای فهرست واژه‌ها بیش‌از‌حد بزرگ است (حداکثر ۱ مگابایت).
+	Redaction Tool Properties	ویژگی‌های ابزار سیاه‌کردن
+	Redacted area fill colour:	رنگ پر‌کردن ناحیه سیاه‌شده:
+	Use overlay text	استفاده از متن روکش
+	Custom text:	متن سفارشی:
+	Redaction code:	کد سیاه‌کردن:
+	Font:	قلم:
+	Font size:	اندازه قلم:
+	Font size	اندازه قلم
+	Auto-size text to fit redaction region	تغییر خودکار اندازه متن برای جا شدن در ناحیه سیاه‌کردن
+	Font colour:	رنگ قلم:
+	Repeat overlay text	تکرار متن روکش
+	Text alignment:	تراز‌بندی متن:
+	Center	وسط
+	Apply redactions	اعمال سیاه‌کردن‌ها
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	در آستانه اعمال ۱ نشانه سیاه‌کردن هستید. متن، تصویر‌ها و ترسیم‌های زیر نشانه‌ها، و یادداشت‌ها و فیلد‌های فرمی که با آن‌ها هم‌پوشانی دارند، برای همیشه حذف می‌شوند.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	در آستانه اعمال {n} نشانه سیاه‌کردن هستید. متن، تصویر‌ها و ترسیم‌های زیر نشانه‌ها، و یادداشت‌ها و فیلد‌های فرمی که با آن‌ها هم‌پوشانی دارند، برای همیشه حذف می‌شوند.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	سند را پس از آن ذخیره کنید: ذخیره‌سازی کل فایل را باز‌نویسی می‌کند تا هیچ اثری از محتوای حذف‌شده در آن نماند.
+	Select the items to remove from this document.	مواردی را برای حذف از این سند انتخاب کنید.
+	Metadata	فراداده
+	File attachments	پیوست‌های فایل
+	Comments and markups	یادداشت‌ها و علامت‌گذاری‌ها
+	Hidden text	متن پنهان
+	Hidden layers	لایه‌های پنهان
+	Links, actions and JavaScripts	پیوند‌ها، کنش‌ها و JavaScriptها
+	Private data of other applications	داده‌های خصوصی سایر برنامه‌ها
+	None found	چیزی یافت نشد
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	فیلد‌های فرم تخت می‌شوند: مقادیرشان نمایان می‌مانند. ذخیره‌سازی کل فایل را باز‌نویسی می‌کند.
+	Remove	حذف
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	پاک‌سازی اطلاعات پنهان را از سند حذف می‌کند: فراداده، پیوست‌های فایل، یادداشت‌ها، فیلد‌های فرم (تخت‌شده)، متن و لایه‌های پنهان، نشانک‌ها، پیوند‌ها، کنش‌ها و اسکریپت‌ها، و داده‌های خصوصی برنامه‌ها.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	سند را پس از آن ذخیره کنید؛ ذخیره‌سازی کل فایل را باز‌نویسی می‌کند تا هیچ چیز حذف‌شده در آن نماند.
+	Printer:	چاپگر:
+	Save as PDF	ذخیره به‌صورت PDF
+	{name} (default)	{name} (پیش‌فرض)
+	Copies:	نسخه‌ها:
+	Collate	مرتب‌سازی
+	Print in grayscale	چاپ در مقیاس خاکستری
+	Two-sided:	دورو:
+	Off	خاموش
+	Flip on long edge	چرخش روی لبه بلند
+	Flip on short edge	چرخش روی لبه کوتاه
+	Printer default	پیش‌فرض چاپگر
+	Paper:	کاغذ:
+	Pages to Print	صفحه‌ها برای چاپ
+	More options:	گزینه‌های بیشتر:
+	All pages in range	تمام صفحه‌ها در بازه
+	Odd pages only	فقط صفحه‌های فرد
+	Even pages only	فقط صفحه‌های زوج
+	Reverse pages	معکوس‌کردن صفحه‌ها
+	Page Sizing & Handling	اندازه و مدیریت صفحه
+	Size	اندازه
+	Poster	پوستر
+	Multiple	چند‌گانه
+	Booklet	دفترچه
+	Fit	جا دادن
+	Shrink oversized pages	کوچک‌کردن صفحه‌های بزرگ‌تر از حد
+	Custom scale:	مقیاس سفارشی:
+	Tile scale:	مقیاس کاشی:
+	Overlap:	هم‌پوشانی:
+	Cut marks	نشانه‌های برش
+	Pages per sheet:	صفحه در هر برگ:
+	Page order:	ترتیب صفحه‌ها:
+	Horizontal	افقی
+	Horizontal reversed	افقی معکوس
+	Vertical	عمودی
+	Vertical reversed	عمودی معکوس
+	Print page border	چاپ حاشیه صفحه
+	Auto-rotate pages	چرخش خودکار صفحه‌ها
+	Booklet subset:	زیرمجموعه دفترچه:
+	Both sides	دو طرف
+	Front side only	فقط روی
+	Back side only	فقط پشت
+	Binding:	صحافی:
+	Left	چپ
+	Right	راست
+	Orientation:	جهت:
+	Auto portrait/landscape	خودکار عمودی/افقی
+	Portrait	عمودی
+	Landscape	افقی
+	Comments & Forms	یادداشت‌ها و فرم‌ها
+	Document	سند
+	Document and markups	سند و علامت‌گذاری‌ها
+	Document and stamps	سند و مهر‌ها
+	Form fields only	فقط فیلد‌های فرم
+	Previous sheet	برگ قبلی
+	Next sheet	برگ بعدی
+	No sheets	بدون برگ
+	Sheet {s} of {n}	برگ {s} از {n}
+	Removed 1 hidden item. Save to remove them from the file.	۱ مورد پنهان حذف شد. برای حذف آن‌ها از فایل ذخیره کنید.
+	Removed {n} hidden items. Save to remove them from the file.	{n} مورد پنهان حذف شد. برای حذف آن‌ها از فایل ذخیره کنید.
+	Document sanitized. Save to finish: saving rewrites the whole file.	سند پاک‌سازی شد. برای پایان ذخیره کنید: ذخیره‌سازی کل فایل را باز‌نویسی می‌کند.
+	Applied 1 redaction mark. Save to remove the content from the file.	۱ نشانه سیاه‌کردن اعمال شد. برای حذف محتوا از فایل ذخیره کنید.
+	Applied {n} redaction marks. Save to remove the content from the file.	{n} نشانه سیاه‌کردن اعمال شد. برای حذف محتوا از فایل ذخیره کنید.
+	JavaScript Console	کنسول JavaScript
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript خاموش است (ترجیحات ▸ JavaScript).
+	Output appears here.	خروجی اینجا نمایش داده می‌شود.
+	Script Name:	نام اسکریپت:
+	This document has no document-level scripts.	این سند اسکریپت سطح سند ندارد.
+	No form fields were detected	هیچ فیلد فرمی شناسایی نشد
+	Detected 1 form field	۱ فیلد فرم شناسایی شد
+	Detected {n} form fields	{n} فیلد فرم شناسایی شد
+	{field}: {e}	{field}: {e}
+	Current page	صفحه جاری
+	Selected pages	صفحه‌های انتخاب‌شده
+	Document language	زبان سند
+	Output	خروجی
+	Searchable Image (Exact)	تصویر قابل‌جستوجو (دقیق)
+	Adds invisible text over each word; the page image is not changed	متن نامرئی روی هر واژه می‌افزاید؛ تصویر صفحه تغییر نمی‌کند
+	Downsample to	کاهش نمونهبرداری به
+	Also recognize pages that already have text	همچنین صفحه‌هایی که از قبل متن دارند را تشخیص بده
+	Pictures on those pages are recognized too; words already in the page's text are not added again	تصویر‌های آن صفحه‌ها نیز تشخیص داده می‌شوند؛ واژه‌هایی که از قبل در متن صفحه هستند دوباره افزوده نمی‌شوند
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	تشخیص متن نصب نیست: فایل‌های مدل آن وجود ندارند. PdfCraft را دوباره نصب کنید، یا PDFCRAFT_MODELS را به پوشه ای که آن‌ها را دارد تنظیم کنید.
+	Settings	تنظیمات
+	Optional	اختیاری
+	Planned · {m}	برنامه‌ریزی‌شده · {m}
+	Planned for milestone {m} — open to see what it will include	برنامه‌ریزی‌شده برای نقطهعطف {m} — باز کنید تا ببینید چه چیزی را شامل می‌شود
+	Coming in milestone {m}. Items marked Ready work today.	در نقطهعطف {m} می‌آید. موارد علامتخورده به‌عنوان آماده امروز کار می‌کنند.
+	1 mark	۱ نشانه
+	{n} marks	{n} نشانه
+	Dynamic	پویا
+	Sign Here	امضا اینجا
+	Standard Business	تجاری استاندارد
+	Choose a stamp, then click on the page to place it.	مهری انتخاب کنید، سپس برای قرار دادن آن روی صفحه کلیک کنید.
+	Note	یادداشت
+	Polyline	چند‌خطی
+	Attachment	پیوست
+	Callout	فراخوان
+	Typewriter	ماشین تحریر
+	Checked	علامتخورده
+	Unchecked	بدون علامت
+	Marked	علامت‌گذاری‌شده
+	Locked	قفل‌شده
+	Search comments	جستوجوی یادداشت‌ها
+	Add a comment	افزودن یادداشت
+	No comments yet.	هنوز یادداشتی نیست.
+	Pick a tool in the quick bar, or type above.	ابزاری در نوار سریع انتخاب کنید، یا در بالا تایپ کنید.
+	No comments match.	هیچ یادداشتی تطابق ندارد.
+	Unknown author	نویسنده ناشناس
+	No colour	بدون رنگ
+	Remove checkmark	حذف علامت تیک
+	Mark with checkmark	علامت‌گذاری با تیک
+	Reply	پاسخ
+	Add a reply	افزودن پاسخ
+	Post	ارسال
+	Page {label}	صفحه {label}
+	{kind} — click to show it on the page	{kind} — برای نمایش آن روی صفحه کلیک کنید
+	Set status	تعیین وضعیت
+	Copy text	رو‌نویسی متن
+	Properties…	ویژگی‌ها…
+	Make Current Properties Default	پیش‌فرض‌کردن ویژگی‌های جاری
+	Make Properties Default	پیش‌فرض‌کردن ویژگی‌ها
+	More options	گزینه‌های بیشتر
+	Sort by	مرتب‌سازی بر اساس
+	Author	نویسنده
+	Type	نوع
+	Colour	رنگ
+	Show all comments	نمایش همه یادداشت‌ها
+	Create PDF comment summary…	ساخت خلاصه یادداشت‌های PDF…
+	Export all to data file…	برونبری همه به فایل داده…
+	Filter comments	پالایش یادداشت‌ها
+	Status	وضعیت
+	Accepted	پذیرفته‌شده
+	Rejected	رد‌شده
+	Cancelled	لغو‌شده
+	Completed	تکمیل‌شده
+	Show all	نمایش همه
+	Yellow	زرد
+	Orange	نارنجی
+	Red	قرمز
+	Pink	صورتی
+	Purple	بنفش
+	Blue	آبی
+	Light blue	آبی روشن
+	Green	سبز
+	Gray	خاکستری
+	Black	سیاه
+	Bookmark options	گزینه‌های نشانک
+	Expand all bookmarks	گشادن همه نشانک‌ها
+	Expand top-level bookmarks	گشادن نشانک‌های سطح اول
+	Collapse all bookmarks	بستن همه نشانک‌ها
+	New bookmark ({key})	نشانک جدید ({key})
+	This document has no bookmarks.	این سند نشانک ندارد.
+	This document has no layers.	این سند لایه ندارد.
+	This document has no attachments.	این سند پیوست ندارد.
+	Hide layer	پنهان‌کردن لایه
+	Layer options	گزینه‌های لایه
+	Reset to Initial Visibility	باز‌نشانی به نمایانبودن اولیه
+	Show layer	نمایش لایه
+	Set layer visibility	تعیین نمایانبودن لایه
+	on page {label}	در صفحه {label}
+	Save attachment…	ذخیره پیوست…
+	Open in a new tab	باز کردن در برگه جدید
+	This document has no pages.	این سند صفحه ندارد.
+	Find text	یافتن متن
+	No matches	بدون تطابق
+	Searching… {s}/{p}	جستوجو… {s}/{p}
+	{c} of {n}{more}	{c} از {n}{more}
+	Previous ({key})	قبلی ({key})
+	Next ({key})	بعدی ({key})
+	Find options	گزینه‌های یافتن
+	Whole words only	فقط واژه‌های کامل
+	Case-sensitive	حساس به بزرگی و کوچکی حروف
+	Close (Esc)	بستن (Esc)
+	Align	تراز‌بندی
+	Top	بالا
+	Bottom	پایین
+	Center horizontally	تراز افقی در وسط
+	Center vertically	تراز عمودی در وسط
+	Distribute	توزیع
+	Horizontally	افقی
+	Vertically	عمودی
+	Set Fields to Same Size	هم‌اندازه‌کردن فیلد‌ها
+	Height	ارتفاع
+	Width	پهنا
+	Both	هر دو
+	Duplicate…	تکثیر…
+	All pages	همه صفحه‌ها
+	Odd pages	صفحه‌های فرد
+	Even pages	صفحه‌های زوج
+	Landscape pages	صفحه‌های افقی
+	Portrait pages	صفحه‌های عمودی
+	Move earlier	جابه‌جایی به قبل
+	Move later	جابه‌جایی به بعد
+	Back to the document	بازگشت به سند
+	Protect Using Password	محافظت با گذرواژه
+	Requires user to enter a password for:	نیاز‌مند وارد کردن گذرواژه توسط کاربر برای:
+	Viewing	نمایش
+	Editing	ویرایش
+	Type Password	گذرواژه را تایپ کنید
+	Re-type Password	گذرواژه را دوباره تایپ کنید
+	Strength: {s}	قدرت: {s}
+	Strong	قوی
+	Medium	متوسط
+	Weak	ضعیف
+	Advanced Options {chevron}	گزینه‌های پیشرفته {chevron}
+	Compatibility	سازگاری
+	Acrobat X and later (256-bit AES)	Acrobat X و بعد از آن (AES ۲۵۶-بیتی)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 و بعد از آن (AES ۱۲۸-بیتی)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 و بعد از آن (RC4 ۱۲۸-بیتی)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 و بعد از آن (RC4 ۴۰-بیتی)
+	Encrypt	رمز‌گذاری
+	All document contents	همه محتوای سند
+	All document contents except metadata	همه محتوای سند بهجز فراداده
+	Printing allowed	چاپ مجاز
+	Low Resolution (150 dpi)	تفکیک‌پذیری پایین (۱۵۰ dpi)
+	Changes allowed	تغییرات مجاز
+	Inserting, deleting, and rotating pages	افزودن، حذف و چرخش صفحه‌ها
+	Filling in form fields and signing existing signature fields	پر کردن فیلد‌های فرم و امضای فیلد‌های امضای موجود
+	Commenting, filling in form fields, and signing existing signature fields	یادداشت‌گذاری، پر کردن فیلد‌های فرم و امضای فیلد‌های امضای موجود
+	Any except extracting pages	هر چیزی بهجز استخراج صفحه‌ها
+	Enable copying of text, images, and other content	امکان کپی متن، تصویر‌ها و سایر محتوا
+	Enable text access for screen reader devices for the visually impaired	امکان دسترسی متنی برای دستگاه‌های صفحهخوان برای افراد کمبینا
+	Type a password.	گذرواژ‌های تایپ کنید.
+	The passwords don't match.	گذرواژه‌ها مطابقت ندارند.
+	This compatibility level supports only plain ASCII passwords.	این سطح سازگاری فقط از گذرواژه‌های ASCII ساده پشتیبانی می‌کند.
+	Anyone opening the document will need this password. It's applied when you save.	هر کسی که سند را باز کند به این گذرواژه نیاز دارد. هنگام ذخیره اعمال می‌شود.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	سند بدون گذرواژه باز می‌شود؛ این گذرواژه برای تغییر محدودیت‌ها لازم است. هنگام ذخیره اعمال می‌شود.
+	Recover unsaved documents?	باز‌یابی سند‌های ذخیره‌نشده؟
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft به درستی بسته نشد. این سند‌ها تغییراتی داشتند که ذخیره خودکار شدهاند:
+	just now	همین حالا
+	{n} min ago	{n} دقیقه پیش
+	{n} h ago	{n} ساعت پیش
+	 · password-protected	 · محافظت‌شده با گذرواژه
+	Recover	باز‌یابی
+	Discard	دور انداختن
+	Version {v}	نگارش {v}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	یک برنامه PDF متن باز و clean-room نوشته‌شده با Rust. MIT OR Apache-2.0.
+	Part of	بخشی از
+	Summarize Options	گزینه‌های خلاصه‌سازی
+	Choose a layout:	یک چیدمان انتخاب کنید:
+	Comments only	فقط یادداشت‌ها
+	Sort comments by:	مرتب‌سازی یادداشت‌ها بر اساس:
+	Create PDF Comment Summary	ایجاد خلاصه یادداشت‌های PDF
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	باز‌گرداندن به نگارش ذخیره‌شده پیشین «{name}»؟ تغییرات پس از آن دیگر قابل واگردانی نیست.
+	Save over the changed file?	روی فایل تغییریافته ذخیره شود؟
+	“{name}” changed on disk after it was opened or last saved. Saving now replaces that newer version with this one.	«{name}» پس از باز شدن یا آخرین ذخیره، روی دیسک تغییر کرده است. ذخیره کردن اکنون آن نگارش جدید‌تر را با این یکی جایگزین می‌کند.
+	Save anyway	به هرحال ذخیره کن
+	Number pages	شماره‌گذاری صفحه‌ها
+	Style	سبک
+	None (prefix only)	هیچکدام (فقط پیشوند)
+	Prefix	پیشوند
+	Start	شروع
+	Labels: {preview}. Later pages keep their labels.	برچسب‌ها: {preview}. صفحه‌های بعدی برچسب‌های خود را حفظ می‌کنند.
+	Even and Odd Pages	صفحه‌های زوج و فرد
+	Even Pages Only	فقط صفحه‌های زوج
+	Odd Pages Only	فقط صفحه‌های فرد
+	Landscape and Portrait Pages	صفحه‌های افقی و عمودی
+	Landscape Pages	صفحه‌های افقی
+	Portrait Pages	صفحه‌های عمودی
+	Duplicate Field	تکثیر فیلد
+	Duplicate "{name}" onto:	تکثیر «{name}» روی:
+	1 page selected.	۱ صفحه انتخاب شده است.
+	{n} pages selected.	{n} صفحه انتخاب شده است.
+	Delete pages after extracting	حذف صفحه‌ها پس از استخراج
+	Extract pages as separate files	استخراج صفحه‌ها به‌عنوان فایل‌های جداگانه
+	Rotate Pages	چرخش صفحه‌ها
+	Direction:	جهت:
+	Clockwise 90 degrees	۹۰ درجه در جهت عقربه‌های ساعت
+	Counterclockwise 90 degrees	۹۰ درجه در خلاف جهت عقربه‌های ساعت
+	180 degrees	۱۸۰ درجه
+	Pages:	صفحه‌ها:
+	All	همه
+	Selection	انتخاب
+	From	از
+	Rotate:	چرخش:
+	Repairs	تعمیرات
+	Repair log	گزارش تعمیرات
+	Split document	تقسیم سند
+	Number of pages	تعداد صفحه‌ها
+	Pages per file	صفحه‌ها در هر فایل
+	File size	اندازه فایل
+	At most	حداکثر
+	Top-level bookmarks ({n})	نشانک‌های سطح بالا ({n})
+	Before each selected page (select pages in Organize)	پیش از هر صفحه انتخاب‌شده (صفحه‌ها را در سازمان‌دهی انتخاب کنید)
+	Creates 1 file from {n} pages.	۱ فایل از {n} صفحه می‌سازد.
+	Creates {f} files from {n} pages.	{f} فایل از {n} صفحه می‌سازد.
+	Each file holds as many of the {n} pages as fit.	هر فایل تا جایی که جا شود از {n} صفحه را در خود می‌گنجاند.
+	Replace Pages	جای‌گزینی صفحه‌ها
+	Original: replace pages	اصلی: جای‌گزینی صفحه‌ها
+	to	تا
+	to {n}	تا {n}
+	Replacement: pages of {name}	جایگزین: صفحه‌های {name}
+	of {name}	از {name}
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	فقط محتوای صفحه تغییر می‌کند: پیوند‌ها، یادداشت‌ها، فیلد‌های فرم و نشانک‌های صفحه‌های اصلی باقی می‌مانند.
+	The replacement file doesn't have that many pages.	فایل جایگزین آن تعداد صفحه را ندارد.
+	Tagged PDF	PDF برچسبدار
+	Document Properties	ویژگی‌های سند
+	Description	توضیحات
+	Initial View	نمای اولیه
+	Security	امنیت
+	Fonts	قلم‌ها
+	Advanced	پیشرفته
+	Title	عنوان
+	Subject	موضوع
+	Keywords	کلیدواژه‌ها
+	Application	برنامه
+	PDF producer	تولید‌کننده PDF
+	Layout and Magnification	چیدمان و بزرگنمایی
+	Navigation tab	زبانه پیمایش
+	Page Only	فقط صفحه
+	Bookmarks Panel and Page	پنل نشانک‌ها و صفحه
+	Pages Panel and Page	پنل صفحه‌ها و صفحه
+	Attachments Panel and Page	پنل پیوست‌ها و صفحه
+	Layers Panel and Page	پنل لایه‌ها و صفحه
+	Page layout	چیدمان صفحه
+	Default	پیش‌فرض
+	Single Page	تک‌صفحه
+	Single Page Continuous	تک‌صفحه پیوسته
+	Two-Up (Facing)	دوصفحه (روبهرو)
+	Two-Up Continuous (Facing)	دوصفحه پیوسته (روبهرو)
+	Two-Up (Cover Page)	دوصفحه (صفحه جلد)
+	Two-Up Continuous (Cover Page)	دوصفحه پیوسته (صفحه جلد)
+	Magnification	بزرگنمایی
+	Actual Size	اندازه واقعی
+	Fit Page	تناسب با صفحه
+	Fit Width	تناسب با عرض
+	Fit Height	تناسب با ارتفاع
+	Fit Visible	تناسب با محتوای قابل مشاهده
+	Open to page	باز شدن روی صفحه
+	of {pages}	از {pages}
+	Window Options	گزینه‌های پنجره
+	Resize window to initial page	تغییر اندازه پنجره به صفحه اولیه
+	Center window on screen	وسط چین کردن پنجره روی صفحه نمایش
+	Open in Full Screen mode	باز شدن در حالت تمام صفحه
+	Show:	نمایش:
+	File Name	نام فایل
+	Document Title	عنوان سند
+	User Interface Options	گزینه‌های رابط کاربری
+	Hide menu bar	پنهان کردن نوار منو
+	Hide toolbars	پنهان کردن نوار‌های ابزار
+	Hide window controls	پنهان کردن کنترل‌های پنجره
+	Security method	روش امنیت
+	No security	بدون امنیت
+	Restrictions	محدودیت‌ها
+	None — everything is allowed	هیچکدام — همه‌چیز مجاز است
+	Password security	امنیت گذرواژه
+	Encryption	رمز‌گذاری
+	Opened with	باز‌شده با
+	— (protection is applied when you save)	— (محافظت هنگام ذخیره اعمال می‌شود)
+	Owner password (no restrictions apply)	گذرواژه مالک (هیچ محدودیتی اعمال نمی‌شود)
+	User password	گذرواژه کاربر
+	Change settings…	تغییر تنظیمات…
+	Printing	چاپ
+	Not allowed	مجاز نیست
+	Allowed	مجاز
+	High resolution	تفکیک‌پذیری بالا
+	Low resolution	تفکیک‌پذیری پایین
+	Changing the document	تغییر سند
+	Document assembly	مونتاژ سند
+	Content copying	کپی محتوا
+	Content copying for accessibility	کپی محتوا برای دسترس‌پذیری
+	Commenting	یادداشت‌گذاری
+	Filling of form fields	پر کردن فیلد‌های فرم
+	No fonts are referenced by the pages.	هیچ قلمی توسط صفحه‌ها ارجاع داده نشده است.
+	PDF version	نگارش PDF
+	Location	مکان
+	Page size	اندازه صفحه
+	Yes	بله
+	No	خیر
+	Revisions	باز‌بینی‌ها
+	View revision {n}	نمایش باز‌بینی {n}
+	Open the file as it was saved then	باز کردن فایل همان‌گونه که آن زمان ذخیره شده بود
+	Binding	صحافی
+	Left Edge	لبه چپ
+	Right Edge	لبه راست
+	Language	زبان
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	ذخیره‌شده {place}: {before} → {after} ({pct}% کوچک‌تر){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	این فایل از قبل تا حد امکان کوچک است ({size}). هیچ نسخ‌های ذخیره نشد.
+	Saved {place}: {before} → {after} (not smaller){detail}	ذخیره‌شده {place}: {before} → {after} (کوچک‌تر نشد){detail}
+	Couldn't save the image: {e}	ذخیره تصویر ممکن نشد: {e}
+	Adding images arrives on the web with file pickers for images	افزودن تصویر‌ها در نسخه وب با انتخابگر فایل برای تصویر‌ها ارائه می‌شود
+	Replacing images on page {p} arrives on the web with image pickers ({i})	جای‌گزینی تصویر‌ها در صفحه {p} در نسخه وب با انتخابگر تصویر ارائه می‌شود ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: انتخاب تصویر‌ها در نسخه وب با انتخابگر فایل برای تصویر‌ها ارائه می‌شود
+	Replacing images arrives on the web with image file pickers	جای‌گزینی تصویر‌ها در نسخه وب با انتخابگر فایل تصویر ارائه می‌شود
+	Couldn't create a PDF: {e}	ایجاد PDF ممکن نشد: {e}
+	The clipboard has no image or text	بریدهدان هیچ تصویر یا متنی ندارد
+	On the web, open or drop an image to convert it	در نسخه وب، تصویری را باز کنید یا رها کنید تا تبدیل شود
+	Couldn't optimize the file: {e}	بهینه‌سازی فایل ممکن نشد: {e}
+	Couldn't write {path}: {e}	نوشتن {path} ممکن نشد: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	فرم درخواست ارسال به {u} را دارد؛ PdfCraft داده‌های فرم را ارسال نمی‌کند. سند را ذخیره کنید تا ورودی‌هایتان حفظ شوند.
+	This PDF uses the unsupported {s} action.	این PDF از کنش {s} پشتیبانی‌نشده استفاده می‌کند.
+	{name}: the {other} action isn't supported yet	{name}: کنش {other} هنوز پشتیبانی نمی‌شود
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} فرم را به {url} ارسال می‌کند؛ PdfCraft داده‌های فرم را ارسال نمی‌کند. سند را ذخیره کنید تا ورودی‌هایتان حفظ شوند.
+	Export stopped: {e}	برونبری متوقف شد: {e}
+	Exported 1 image	۱ تصویر برونبری شد
+	Exported {n} images	{n} تصویر برونبری شد
+	 ({s} not exported: {first})	 ({s} برونبری نشد: {first})
+	Exported the text of 1 page	متن ۱ صفحه برونبری شد
+	Exported the text of {n} pages	متن {n} صفحه برونبری شد
+	{msg} to {dir}	{msg} به {dir}
+	Exporting… {d} of {t}	در حال برونبری… {d} از {t}
+	Choose a folder for the exported files	یک پوشه برای فایل‌های برونبری‌شده انتخاب کنید
+	New {tool} comments will look like this one	یادداشت‌های جدید {tool} به این شکل خواهند بود
+	This document can't be checked: it couldn't be read for editing	این سند بررسی نمی‌شود: برای ویرایش خوانده نشد
+	The checker found no problems in this document.	بررسی‌کننده هیچ مشکلی در این سند پیدا نکرد.
+	The checker found 1 problem which may prevent the document from being fully accessible.	بررسی‌کننده ۱ مشکل پیدا کرد که ممکن است مانع دسترس‌پذیری کامل سند شود.
+	The checker found {n} problems which may prevent the document from being fully accessible.	بررسی‌کننده {n} مشکل پیدا کرد که ممکن است مانع دسترس‌پذیری کامل سند شوند.
+	The text is the same	متن یکسان است
+	1 difference found	۱ تفاوت پیدا شد
+	{n} differences found	{n} تفاوت پیدا شد
+	Added 1 comment	۱ یادداشت افزوده شد
+	Added {n} comments	{n} یادداشت افزوده شد
+	Choose a folder for the results	یک پوشه برای نتایج انتخاب کنید
+	Files for {name}	فایل‌های {name}
+	An action is already running	یک کنش از قبل در حال اجراست
+	Running action… file {d} of {t}	در حال اجرای کنش… فایل {d} از {t}
+	No unlinked web addresses were found in the text	هیچ نشانی وب پیوندنشد‌های در متن پیدا نشد
+	Created 1 link	۱ پیوند ایجاد شد
+	Created {n} links	{n} پیوند ایجاد شد
+	Text recognition is already running	باز‌شناسی متن از قبل در حال اجراست
+	Optimizing… removing user data	در حال بهینه‌سازی… حذف داده‌های کاربر
+	Optimizing… image {d} of {t}	در حال بهینه‌سازی… تصویر {d} از {t}
+	Optimizing… cleaning up	در حال بهینه‌سازی… پاک‌سازی
+	Optimizing… merging identical objects	در حال بهینه‌سازی… ادغام اشیای یکسان
+	Optimizing… writing the copy	در حال بهینه‌سازی… نوشتن نسخه
+	Cancelling…	در حال لغو…
+	Optimization is already running	بهینه‌سازی از قبل در حال اجراست
+	Optimization cancelled	بهینه‌سازی لغو شد
+	Couldn't optimize the file	بهینه‌سازی فایل ممکن نشد
+	Recognizing text… file {d} of {t}	در حال باز‌شناسی متن… فایل {d} از {t}
+	Recognizing text… page {d} of {t}	در حال باز‌شناسی متن… صفحه {d} از {t}
+	Recognized 1 word	۱ واژه باز‌شناسی شد
+	Recognized {n} words	{n} واژه باز‌شناسی شد
+	{words} on {pages}	{words} در {pages}
+	; 1 page already had text	؛ ۱ صفحه از قبل متن داشت
+	; {n} pages already had text	؛ {n} صفحه از قبل متن داشتند
+	Recognized {w} words in 1 file	{w} واژه در ۱ فایل باز‌شناسی شد
+	Recognized {w} words in {n} files	{w} واژه در {n} فایل باز‌شناسی شد
+	; failed: {list}	؛ ناموفق: {list}
+	1 file done	۱ فایل انجام شد
+	{n} files done	{n} فایل انجام شد
+	The selected area has been copied ({w} × {h} pixels)	ناحیه انتخاب‌شده کپی شد ({w} × {h} پیکسل)
+	Couldn't take the snapshot: {e}	گرفتن تصویر لحظ‌های ممکن نشد: {e}
+	Couldn't recover {name}: {e}	باز‌یابی {name} ممکن نشد: {e}
+	The document now conforms to {level}; save it to keep the changes	سند اکنون با {level} منطبق است؛ برای حفظ تغییرات آن را ذخیره کنید
+	Fixed what could be fixed; 1 problem remains	آنچه قابل رفع بود رفع شد؛ ۱ مشکل باقی مانده است
+	Fixed what could be fixed; {n} problems remain	آنچه قابل رفع بود رفع شد؛ {n} مشکل باقی مانده است
+	Custom stamps arrive on the web with file pickers for images	مهر‌های سفارشی در نسخه وب با انتخابگر فایل برای تصویر‌ها ارائه می‌شوند
+	{file} is too large for a stamp (at most {n} MB)	{file} برای یک مهر بیش از حد بزرگ است (حداکثر {n} MB)
+	Sent to {printer}	به {printer} فرستاده شد
+	Sent to {printer}: {msg}	به {printer} فرستاده شد: {msg}
+	Looking for printers…	در حال جستوجوی چاپگر‌ها…
+	Sending sheet {s} of {n} to {printer}…	در حال فرستادن برگ {s} از {n} به {printer}…
+	No printers were found. Check that the printer is installed and the print spooler is running, then open Print again.	هیچ چاپ‌گری پیدا نشد. بررسی کنید که چاپگر نصب شده و صف چاپ در حال اجراست، سپس دوباره چاپ را باز کنید.
+	Reading the printer's settings…	در حال خواندن تنظیمات چاپگر…
+	Sending to {printer}…	در حال فرستادن به {printer}…
+	Choose a folder for the searchable files	یک پوشه برای فایل‌های قابل جستوجو انتخاب کنید
+	Files are combined in this order. Leave Pages empty to take every page.	فایل‌ها به این ترتیب ترکیب می‌شوند. صفحه‌ها را خالی بگذارید تا همه صفحه‌ها گرفته شوند.
+	Files are combined from top to bottom. Leave Pages empty to take every page.	فایل‌ها از بالا به پایین ترکیب می‌شوند. صفحه‌ها را خالی بگذارید تا همه صفحه‌ها گرفته شوند.
+	Unlock…	باز کردن قفل…
+	Select a password-protected file first	نخست یک فایل محافظت‌شده با گذرواژه انتخاب کنید
+	Enter the permissions password to allow combining	گذرواژه مجوز‌ها را وارد کنید تا ترکیب مجاز شود
+	Enter the password that opens it	گذرواژ‌های را وارد کنید که آن را باز می‌کند
+	Unlock {name}	باز کردن قفل {name}
+	Unlock {n} files	باز کردن قفل {n} فایل
+	The same password is tried on each file.	گذرواژه یکسان روی هر فایل آزموده می‌شود.
+	Hide password	پنهان کردن گذرواژه
+	Show password	نمایش گذرواژه
+	Wrong password	گذرواژه نادرست
+	The password is only used to read the file; it isn't saved.	گذرواژه فقط برای خواندن فایل استفاده می‌شود؛ ذخیره نمی‌شود.
+	Unlock	باز کردن قفل
+	Opened, but its security settings don't allow combining. Enter the permissions password.	باز شد، اما تنظیمات امنیتی آن ترکیب را مجاز نمی‌کند. گذرواژه مجوز‌ها را وارد کنید.
+	Unlocked: the combined file won't be password-protected	قفل باز شد: فایل ترکیب‌شده محافظت‌شده با گذرواژه نخواهد بود
+	Unlocked {n} of {m} files	قفل {n} از {m} فایل باز شد
+	Drop PDFs, images, text files or folders here, or choose them.	فایل‌های PDF، تصویر‌ها، فایل‌های متنی یا پوشه‌ها را اینجا رها کنید، یا آن‌ها را انتخاب کنید.
+	Add folder…	افزودن پوشه…
+	Add folder and subfolders…	افزودن پوشه و زیرپوشه‌ها…
+	More ways to add files	راه‌های بیشتر برای افزودن فایل
+	Every PDF, image and text file in the folder	همه فایل‌های PDF، تصویر و متنی در پوشه
+	Every PDF, image and text file in the folder and the folders inside it	همه فایل‌های PDF، تصویر و متنی در پوشه و پوشه‌های داخل آن
+	Add folder	افزودن پوشه
+	Add folder and subfolders	افزودن پوشه و زیرپوشه‌ها
+	No PDFs, images or text files found in {folder}	هیچ فایل PDF، تصویر یا متنی در {folder} پیدا نشد
+	Added the first {n} files in {folder}	نخستین {n} فایل در {folder} افزوده شد
+comment menu	Edit	ویرایش
+	Undo {action}	واگردانی {action}
+	Redo {action}	ازنو انجام دادن {action}
+signature pad	Type	تایپ
+certificate	Subject	دارنده
+action wizard	Start	شروع
+	Click to sort, drag to move the column. Drag its edge to resize it.	برای مرتب‌سازی کلیک کنید، برای جابه‌جایی ستون آن را بکشید. برای تغییر انداز‌هاش لبه آن را بکشید.
+	Reset columns	باز‌نشانی ستون‌ها
+	Remove {n} files	حذف {n} فایل
+	{n} selected	{n} انتخاب‌شده
+	sorted ascending	مرتب‌شده صعودی
+	sorted descending	مرتب‌شده نزولی
+	Protected: the combined file won't keep its security settings	محافظت‌شده: فایل ترکیب‌شده تنظیمات امنیتی خود را حفظ نخواهد کرد
+	Add open documents	افزودن سند‌های باز
+	All open documents	همه سند‌های باز
+	No documents are open	هیچ سندی باز نیست
+	Select a file first	نخست یک فایل انتخاب کنید
+	1 file	۱ فایل
+	{n} files	{n} فایل
+	1 file needs attention	۱ فایل نیاز به توجه دارد
+	{n} files need attention	{n} فایل نیاز به توجه دارند
+	{name} can't be combined: {why}	{name} ترکیب نمی‌شود: {why}
+	Check the pages of {name}: {why}	صفحه‌های {name} را بررسی کنید: {why}
+	Add the files to combine	فایل‌هایی را که می‌خواهید ترکیب کنید بی‌فزایید
+	File name	نام فایل
+	Warnings	هشدار‌ها
+	Drag to reorder	برای مرتب‌سازی مجدد بکشید
+	{k} of {n}	{k} از {n}
+	? of {n}	؟ از {n}
+	Added more than once	بیش از یک بار افزوده شده
+	yesterday	دیروز
+	{n} days ago	{n} روز پیش
+	No pages selected	هیچ صفح‌های انتخاب نشده
+	Password-protected	محافظت‌شده با گذرواژه
+	Its security settings don't allow copying pages	تنظیمات امنیتی آن کپی صفحه‌ها را مجاز نمی‌کند
+	Can't be read: {e}	خوانده نمی‌شود: {e}
+	Leave out files that can't be read?	فایل‌هایی که خوانده نمی‌شوند کنار گذاشته شوند؟
+	These files can't be read, so they won't be in the combined PDF:	این فایل‌ها خوانده نمی‌شوند، بنابراین در PDF ترکیب‌شده نخواهند بود:
+	Combine the rest	ترکیب بقیه
+	and {n} more	و {n} مورد دیگر
+	Includes unsaved changes	شامل تغییرات ذخیره‌نشده
+	Pages of {name} to combine, e.g. 1-3, 6	صفحه‌های {name} برای ترکیب، مثلاً ۱-۳، ۶
+	Remove {name}	حذف {name}
+	Add files…	افزودن فایل‌ها…
+	Add at least two files	دستکم دو فایل بی‌فزایید
+	Couldn't add {name}: {e}	افزودن {name} ممکن نشد: {e}
+	Couldn't combine files: {e}	ترکیب فایل‌ها ممکن نشد: {e}
+	Export comments	برونبری یادداشت‌ها
+	Export form data	برونبری داده‌های فرم
+	Comment and form data	داده‌های یادداشت و فرم
+	Export	برونبری
+	Select data files to merge	فایل‌های داده برای ادغام را انتخاب کنید
+	Form data and PDF forms	داده‌های فرم و فرم‌های PDF
+	Save the spreadsheet	ذخیره صفحهگسترده
+	Save the accessibility report	ذخیره گزارش دسترس‌پذیری
+	Save image	ذخیره تصویر
+	Export certificate	برونبری گواهی
+	Choose a folder for the extracted pages	یک پوشه برای صفحه‌های استخراج‌شده انتخاب کنید
+	Choose a folder for the split files	پوشه ای برای فایل‌های تقسیم‌شده انتخاب کنید
+	Couldn't use {name}: {e}	استفاده از {name} ممکن نشد: {e}
+	Couldn't extract pages: {e}	استخراج صفحه‌ها ممکن نشد: {e}
+	Couldn't write {name}: {e}	نوشتن {name} ممکن نشد: {e}
+	the name is not a plain file name	نام یک نام فایل ساده نیست
+	Wrote 1 file to {dir}	۱ فایل در {dir} نوشته شد
+	Wrote {n} files to {dir}	{n} فایل در {dir} نوشته شد
+	No pages match those choices	هیچ صفحه ای با آن گزینه‌ها مطابقت ندارد
+	Couldn't split: {e}	تقسیم ممکن نشد: {e}
+	Couldn't summarize comments: {e}	خلاصه‌کردن یادداشت‌ها ممکن نشد: {e}
+	Couldn't open the result: {e}	باز کردن نتیجه ممکن نشد: {e}
+	Importing data arrives on the web with file pickers for data files	ورود داده در نسخه وب با انتخابگر فایل برای فایل‌های داده ارائه می‌شود
+	Exported to {path}	به {path} خروجی گرفته شد
+	Merging data files needs the desktop app	ادغام فایل‌های داده نیاز‌مند برنامه رومیزی است
+	Merged 1 file into {path}	۱ فایل در {path} ادغام شد
+	Merged {n} files into {path}	{n} فایل در {path} ادغام شد
+	Combined {n} files	{n} فایل ترکیب شد
+	Extracted 1 page	۱ صفحه استخراج شد
+	Extracted {n} pages	{n} صفحه استخراج شد
+	Created a comment summary	خلاصه یادداشت‌ها ساخته شد
+	Couldn't open {name}: {e}	باز کردن {name} ممکن نشد: {e}
+	Couldn't read {name}: {e}	خواندن {name} ممکن نشد: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	حالت قابل حمل خاموش است: نوشتن در {folder} ممکن نیست ({error}). در عوض تنظیمات در پوشه کاربر شما نگهداری می‌شود.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft بدون پردازنده گرافیکی رسم می‌کند، بنابراین ممکن است کند باشد. به‌روز‌رسانی درایور گرافیکی می‌تواند کمک کند.
+	Couldn't save: {e}	ذخیره ممکن نشد: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	دانلود پیوست‌ها در نسخه وب با M3.10 ارائه می‌شود ({n} بایت آماده)
+	`{command}` {when}	`{command}` {when}
+	ships in milestone {m}	در نقطهعطف {m} ارائه می‌شود
+	needs an AI provider (off by default)	نیاز‌مند یک ارائهدهنده هوش مصنوعی است (به‌طور پیش‌فرض خاموش)
+	is available	در دسترس است
+	is not available yet	هنوز در دسترس نیست
+	{label} failed: {e}	{label} ناموفق بود: {e}
+	Undid {label}	{label} واگردانی شد
+	Redid {label}	{label} ازنو انجام شد
+	A document needs at least one page: copy instead	یک سند به حداقل یک صفحه نیاز دارد: در عوض رونوشت بگیرید
+	Cut {what}	{what} بریده شد
+	Copied {what}	{what} رونوشت شد
+	1 page	۱ صفحه
+	{n} pages	{n} صفحه
+	Copy or cut pages first	ابتدا صفحه‌ها را رونوشت یا ببرید
+	Couldn't save {name}: {e}	ذخیره {name} ممکن نشد: {e}
+	Saved {name}	{name} ذخیره شد
+	Saved, but reopening failed: {e}	ذخیره شد، اما باز‌گشایی مجدد ناموفق بود: {e}
+	Downloaded {name}	{name} دانلود شد
+	Couldn't download {name}: {e}	دانلود {name} ممکن نشد: {e}
+	Reverted to the last saved version	به آخرین نسخه ذخیره‌شده باز‌گردانده شد
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	این کار نشد: یک خطای داخلی آن را متوقف کرد ({m}). اسناد شما تغییری نکرده اند.
+	Nothing to undo	چیزی برای واگردانی نیست
+	Nothing to redo	چیزی برای ازنو انجام دادن نیست
+	This document has no form fields you can fill in	این سند هیچ فیلد فرمی ندارد که بتوانید پر کنید
+	This document has no comments to flatten	این سند هیچ یادداشتی برای مسطح‌کردن ندارد
+	This document has no form fields to flatten	این سند هیچ فیلد فرمی برای مسطح‌کردن ندارد
+	There are no redaction marks (mark text, areas or pages first)	هیچ علامت سیاهکردنی وجود ندارد (ابتدا متن، ناحیه یا صفحه‌ها را علامت بزنید)
+	This document has no {kind} to change	این سند هیچ {kind} برای تغییر ندارد
+	header or footer	سرصفحه یا پاصفحه
+	watermark	واترمارک
+	background	پس‌زمینه
+	This document isn't password-protected	این سند با گذرواژه محافظت نشده است
+	Enter permissions password…	گذرواژه مجوز‌ها را وارد کنید…
+	Permissions password	گذرواژه مجوز‌ها
+	“{name}” has security restrictions. Enter its permissions password to lift them.	«{name}» محدودیت‌های امنیتی دارد. برای برداشتن آن‌ها گذرواژه مجوز‌هایش را وارد کنید.
+	Restrictions lifted	محدودیت‌ها برداشته شد
+	Couldn't unlock {name}: {e}	باز کردن قفل {name} ممکن نشد: {e}
+	This document has no restrictions to lift	این سند هیچ محدودیتی برای برداشتن ندارد
+	The document's security settings don't allow this change	تنظیمات امنیتی سند این تغییر را مجاز نمی‌داند
+	The document's security settings don't allow copying text and images	تنظیمات امنیتی سند رونوشت متن و تصویر را مجاز نمی‌داند
+	The document's security settings don't allow printing	تنظیمات امنیتی سند چاپ را مجاز نمی‌داند
+	Open a document first	ابتدا یک سند باز کنید
+	Security will be removed when you save	با ذخیره کردن، امنیت برداشته می‌شود
+	Click text or an image to edit it	روی یک متن یا تصویر کلیک کنید تا ویرایشش کنید
+	Drag a rectangle to create a link; double-click a link to edit it	برای ساختن پیوند یک مستطیل بکشید؛ برای ویرایش پیوند روی آن دوبار کلیک کنید
+	There are no redaction marks to apply	هیچ علامت سیاه کردنی برای اعمال وجود ندارد
+	Drag to draw the area where the signature should appear.	بکشید تا ناحیه ای که امضا باید در آن ظاهر شود رسم کنید.
+	Couldn't fit the visible content: {e}	جا دادن محتوای قابل مشاهده ممکن نشد: {e}
+	Drag a rectangle around the area to copy	دور ناحی‌های که می‌خواهید رونوشت بگیرید یک مستطیل بکشید
+	Click on the page to add a {tool}, or drag to set its size	برای افزودن {tool} روی صفحه کلیک کنید، یا برای تعیین انداز‌هاش بکشید
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	برای برش صفحه، روی آن یک مستطیل بکشید؛ برای «تعیین کادر‌های صفحه» روی یک صفحه دوبار کلیک کنید
+	Keep tool selected: on	نگه داشتن ابزار انتخاب‌شده: روشن
+	Keep tool selected	نگه داشتن ابزار انتخاب‌شده
+	Opacity	کدری
+	Line thickness	ضخامت خط
+	What word or phrase would you like to search for?	چه واژه یا عبارتی را می‌خواهید جستوجو کنید؟
+	Searching… {s} of {p} pages	در حال جستوجو… {s} از {p} صفحه
+	 (searching… {s} of {p} pages)	 (در حال جستوجو… {s} از {p} صفحه)
+	1 instance	۱ مورد
+	{n} instances	{n} مورد
+	Go to this result	رفتن به این نتیجه
+	Highlight	برجسته‌سازی
+	Draw	رسم
+	Polygon	چند‌ضلعی
+	Connected lines	خطوط متصل
+	Eraser	پاککن
+	Sign	امضا کردن
+	Certified by {by}	گواهی‌شده توسط {by}
+	At least one signature is invalid.	حداقل یک امضا نامعتبر است.
+	Signed and all signatures are valid.	امضا شده و همه امضا‌ها معتبرند.
+	At least one signature has problems.	حداقل یک امضا مشکل دارد.
+	This document is secured. Some changes are restricted by its security settings.	این سند محافظت شده است. برخی تغییر‌ها توسط تنظیمات امنیتی آن محدود شدهاند.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	این یک فرم XFA پویاست که PdfCraft هنوز نمی‌تواند نمایش دهد. آنچه می‌بینید صفحه جانگهدار فایل است.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	این فرم همچنین داده XFA دارد که PdfCraft هنوز نمی‌خواند. می‌توانید فیلد‌هایش را پر کنید، اما Acrobat ممکن است به‌جای آن مقادیر XFA را نشان دهد.
+	This document contains {n} interactive form fields.	این سند {n} فیلد فرم تعاملی دارد.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	این فایل آسیب دیده بود و ترمیم شده است. ذخیره کردن نسخه ترمیم‌شده را حفظ می‌کند.
+	Dismiss	بستن
+	Hide field highlights	پنهان‌کردن برجسته‌سازی فیلد‌ها
+	Highlight fields	برجسته‌سازی فیلد‌ها
+	Security settings	تنظیمات امنیت
+	Details	جزئیات
+	Select (V)	انتخاب (V)
+	Hand (H)	دست (H)
+	Delete pages (Delete)	حذف صفحه‌ها (Delete)
+	Insert a blank page after the selection	درج یک صفحه خالی پس از انتخاب
+	Insert pages from a file…	درج صفحه‌ها از یک فایل…
+	Extract pages to a new document	استخراج صفحه‌ها به یک سند جدید
+	Split into files…	تقسیم به فایل‌ها…
+	Select pages	انتخاب صفحه‌ها
+	Cut	برش
+	Copy	رونوشت
+	Paste after	چسباندن پس از
+	Rename	تغییر نام
+	Set to current page ({n})	تعیین به‌عنوان صفحه فعلی ({n})
+	Move up	بالا بردن
+	Move down	پایین بردن
+	Indent	افزایش تورفتگی
+	Outdent	کاهش تورفتگی
+	This document has no form fields.	این سند هیچ فیلد فرمی ندارد.
+	Tab order: move a field with its arrows.	ترتیب تب: یک فیلد را با فلش‌هایش جابهجا کنید.
+	Unplaced	جاینگرفته
+	Has JavaScript actions (run in M6)	دارای کنش‌های JavaScript است (در M6 اجرا می‌شوند)
+	Page	صفحه
+	None	هیچکدام
+	Delete selected fields	حذف فیلد‌های انتخاب‌شده
+	Diagnostic details	جزئیات تشخیصی
+	The operation failed.	عملیات ناموفق بود.
+	no such document	چنین سندی وجود ندارد
+	nothing to undo	چیزی برای واگردانی نیست
+	nothing to redo	چیزی برای ازنو انجام دادن نیست
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	این سند امضا شده است: باز‌نویسی آن امضا‌هایش را بی‌اعتبار می‌کند (در عوض آن را به‌صورت افزایشی ذخیره کنید)
+	the document is protected by a password	سند با گذرواژه محافظت شده است
+	the password is incorrect	گذرواژه نادرست است
+	the document has no page tree	سند هیچ درخت صفح‌های ندارد
+	a document must keep at least one page	یک سند باید حداقل یک صفحه را حفظ کند
+	a bookmark cannot be moved inside itself	نشانک را نمی‌توان داخل خودش جابهجا کرد
+	the title must not be empty	عنوان نباید خالی باشد
+	the document has no form fields	سند هیچ فیلد فرمی ندارد
+	there are no redaction marks to apply	هیچ علامت سیاهکردنی برای اعمال وجود ندارد
+	there are no pages to print	هیچ صفح‌های برای چاپ وجود ندارد
+	the document has no tags	سند هیچ برچسبی ندارد
+	{0}: {1}	{0}: {1}
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	مدل‌های تشخیص متن نصب نشدهاند (PdfCraft را دوباره نصب کنید، یا PDFCRAFT_MODELS را روی پوش‌های که آن‌ها را نگه می‌دارد تنظیم کنید)
+	the image is empty	تصویر خالی است
+	this file isn't XFDF, FDF, XML or text form data	این فایل داده فرم XFDF، FDF، XML یا متنی نیست
+	nothing in the file matches this document	هیچچیز در فایل با این سند مطابقت ندارد
+	This page couldn't be displayed.\n{e}	نمایش این صفحه ممکن نشد.\n{e}
+	Go to page {p}	رفتن به صفحه {p}
+	{s} action	کنش {s}
+	Page {p} of {n}	صفحه {p} از {n}
+	1 page selected	۱ صفحه انتخاب شد
+	{n} pages selected	{n} صفحه انتخاب شد
+	{name} — unsaved changes	{name} — تغییر‌های ذخیره‌نشده
+	{kind} field	فیلد {kind}
+	Select a file for the stamp	یک فایل برای مهر انتخاب کنید
+	JavaScript, e.g. getField("total").value	JavaScript، مثلاً getField("total").value
+	Font: Helvetica	قلم: Helvetica
+	e.g. en-US	مثلاً fa-IR
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	رندر: hayro (bootstrap) · رابط کاربری: egui · آیکون‌ها: Lucide (ISC) · قلم‌ها: Inter, JetBrains Mono, Dancing Script (OFL)
+	CheckBox	کادر انتخاب
+	Radio	دکمه رادیویی
+	PushButton	دکمه فشاری
+	Combo	فهرست باز‌شو
+	List	فهرست
+	Unknown	ناشناخته
+	The document has no XMP metadata	سند هیچ فراداده XMP ندارد
+	The title in the metadata and the document information differ	عنوان در فراداده و اطلاعات سند متفاوتاند
+	The document is encrypted	سند رمز‌گذاری شده است
+	Device colour is used, but there is no PDF/A output intent	از رنگ دستگاه استفاده می‌شود، اما هیچ هدف خروجی PDF/A وجود ندارد
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	از DeviceCMYK استفاده می‌شود: به یک هدف خروجی CMYK نیاز دارد (به‌طور خودکار افزوده نمی‌شود)
+	DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile	از DeviceCMYK استفاده می‌شود، اما هدف خروجی PDF/A یک نمایه CMYK نیست
+	DeviceRGB is used, but the PDF/A output intent isn't an RGB profile	از DeviceRGB استفاده می‌شود، اما هدف خروجی PDF/A یک نمایه RGB نیست
+	The document has additional actions (/AA)	سند کنش‌های افزودنی دارد (/AA)
+	The document has document-level JavaScript	سند JavaScript در سطح سند دارد
+	The form asks viewers to make appearances (NeedAppearances)	فرم از نمایشگر‌ها می‌خواهد ظاهر‌ها را بسازند (NeedAppearances)
+	A form field has additional actions	یک فیلد فرم کنش‌های افزودنی دارد
+	A stream uses LZW compression	یک جریان از فشرده‌سازی LZW استفاده می‌کند
+	A stream refers to an external file	یک جریان به یک فایل خارجی ارجاع می‌دهد
+	An image asks to be interpolated	یک تصویر درخواست درون‌یابی دارد
+	An image has alternates or OPI information	یک تصویر جانشین‌ها یا اطلاعات OPI دارد
+	PostScript XObjects aren't allowed	XObjectهای PostScript مجاز نیستند
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	فایل‌های جا‌سازی‌شده خودشان باید فایل PDF/A باشند (برای سایرین از PDF/A-3 استفاده کنید)
+	An embedded file has no AFRelationship	یک فایل جا‌سازی‌شده AFRelationship ندارد
+	Select Icon	انتخاب آیکون
+	Choose images	انتخاب تصویر‌ها
+	{dpi} pixels/inch	{dpi} پیکسل بر اینچ
+	Type your {what}.	{what} خود را تایپ کنید.
+	Draw your {what} below.	{what} خود را در پایین رسم کنید.
+	Your name	نام شما
+	Images and text (converted to PDF)	تصویر‌ها و متن (تبدیل‌شده به PDF)
+	Images and text	تصویر‌ها و متن
+	Check Box Style:	سبک کادر انتخاب:
+	Button Style:	سبک دکمه:
+	Check	تیک
+	Circle	دایره
+	Diamond	لوزی
+	Square	مربع
+	Star	ستاره
+	{month} {y}	{month} {y}
+	Change {key}	تغییر {key}
+	Insert pages from {name}	درج صفحه‌ها از {name}
+	Insert pages from {name} — 1 field renamed	درج صفحه‌ها از {name} — ۱ فیلد تغییر نام یافت
+	Insert pages from {name} — fields renamed	درج صفحه‌ها از {name} — فیلد‌ها تغییر نام یافتند
+	Fill in {name}	پر کردن {name}
+	Set the image of {name}	تعیین تصویر {name}
+	Edit script of {name}	ویرایش اسکریپت {name}
+	Import {name}	درون‌ریزی {name}
+	Add bookmark	افزودن نشانک
+	Rename bookmark	تغییر نام نشانک
+	Delete bookmark	حذف نشانک
+	Move bookmark	جابه‌جایی نشانک
+	Set bookmark destination	تعیین مقصد نشانک
+	Add stamp	افزودن مهر
+	Delete comment	حذف یادداشت
+	Edit comment	ویرایش یادداشت
+	Erase	پاک کردن
+	Lock comment	قفل کردن یادداشت
+	Unlock comment	باز کردن قفل یادداشت
+	Move comment	جابه‌جایی یادداشت
+	Resize comment	تغییر اندازه یادداشت
+	Change comment properties	تغییر ویژگی‌های یادداشت
+	Add field	افزودن فیلد
+	Change field properties	تغییر ویژگی‌های فیلد
+	Delete field	حذف فیلد
+	Duplicate field	تکثیر فیلد
+	Set tab order	تعیین ترتیب تب
+	Set calculation order	تعیین ترتیب محاسبه
+	Change initial view	تغییر نمای اولیه
+	Set alternate text	تعیین متن جانشین
+	Mark figure as decorative	علامت‌گذاری تصویر به‌عنوان تزئینی
+	Run JavaScript	اجرای JavaScript
+	Delete document JavaScript	حذف JavaScript سند
+	Edit document JavaScript	ویرایش JavaScript سند
+	Edit text	ویرایش متن
+	Load document font	بار‌گذاری قلم سند
+	Move image	جابه‌جایی تصویر
+	Rotate image	چرخاندن تصویر
+	Flip image	وارونه کردن تصویر
+	Delete image	حذف تصویر
+	Add header & footer	افزودن سرصفحه و پاصفحه
+	Update header & footer	به‌روز‌رسانی سرصفحه و پاصفحه
+	Update watermark	به‌روز‌رسانی واترمارک
+	Add background	افزودن پس‌زمینه
+	Update background	به‌روز‌رسانی پس‌زمینه
+	Add image	افزودن تصویر
+	Edit content	ویرایش محتوا
+	Delete content	حذف محتوا
+	Remove redaction marks	برداشتن علامت‌های سیاه‌کردن
+	Add link	افزودن پیوند
+	Change link properties	تغییر ویژگی‌های پیوند
+	Delete link	حذف پیوند
+	Create link	ساختن پیوند
+	Flatten	مسطح‌سازی
+	Flatten Fill & Sign	مسطح‌سازی پر کردن و امضا
+	Add sticky note	افزودن یادداشت چسبان
+	Add highlight	افزودن برجسته‌سازی
+	Add underline	افزودن زیرخط
+	Add strikethrough	افزودن خط خوردگی
+	Add squiggly underline	افزودن زیرخط موجدار
+	Add rectangle	افزودن مستطیل
+	Add oval	افزودن بیضی
+	Add arrow	افزودن پیکان
+	Add line	افزودن خط
+	Add drawing	افزودن ترسیم
+	Add text box	افزودن جعبه متن
+	Add checkmark	افزودن تیک
+	Add cross	افزودن ضربدر
+	Add dot	افزودن نقطه
+	Add signature	افزودن امضا
+	Add redaction mark	افزودن علامت سیاه‌کردن
+	Add cloud	افزودن ابر
+	Add polygon	افزودن چند‌ضلعی
+	Add connected lines	افزودن خطوط متصل
+	Add callout	افزودن فراخوان
+	Add inserted text	افزودن متن درج‌شده
+	Add file attachment	افزودن پیوست فایل
+	Set status Accepted	تعیین وضعیت پذیرفته‌شده
+	Set status Rejected	تعیین وضعیت رد‌شده
+	Set status Cancelled	تعیین وضعیت لغو‌شده
+	Set status Completed	تعیین وضعیت تکمیل‌شده
+	Set status None	تعیین وضعیت هیچکدام
+	Set status Unmarked	تعیین وضعیت علامتنخورده
+	Save as PDF/A-1b	ذخیره به‌عنوان PDF/A-1b
+	Save as PDF/A-2b	ذخیره به‌عنوان PDF/A-2b
+	Save as PDF/A-3b	ذخیره به‌عنوان PDF/A-3b
+	Fill & Sign: change signature	پر کردن و امضا: تغییر امضا
+	Fill & Sign: change initials	پر کردن و امضا: تغییر حروف اول
+	Fill & Sign: remove saved signature	پر کردن و امضا: برداشتن امضای ذخیره‌شده
+	Fill & Sign: remove saved initials	پر کردن و امضا: برداشتن حروف اول ذخیره‌شده
+	Change signature	تغییر امضا
+	Change initials	تغییر حروف اول
+	Measure distance	اندازه‌گیری فاصله
+	Measure perimeter	اندازه‌گیری محیط
+	Measure area	اندازه‌گیری مساحت
+	Set measurement scale	تعیین مقیاس اندازه‌گیری
+	Measurement information	اطلاعات اندازه‌گیری
+	Measurement snapping	چسبیدن اندازه‌گیری
+	Export measurements as CSV	خروجی اندازه‌گیری‌ها به‌صورت CSV
+	Distance	فاصله
+	Perimeter	محیط
+	Area	مساحت
+	Drawing scale	مقیاس ترسیم
+	Scale	مقیاس
+	Common scales	مقیاس‌های رایج
+	Enter a scale such as 1:50.	مقیاسی مانند ۱:۵۰ وارد کنید.
+	Applying a scale switches units to m / mm.	اعمال مقیاس، واحد‌ها را به m / mm تغییر می‌دهد.
+	Snapping	چسبیدن
+	Export measurements	خروجی اندازه‌گیری‌ها
+	Open a PDF to measure it.	برای اندازه‌گیری آن یک PDF باز کنید.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	روی رأس‌ها کلیک کنید. Enter یا دوبار کلیک یک محیط یا مساحت را تمام می‌کند. برای بستن یک مساحت روی نقطه اول کلیک کنید.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift به ۴۵ درجه محدود می‌کند. Backspace یک رأس را برمی‌دارد. Escape لغو می‌کند.
+	Angle	زاویه
+	Click the first point to begin.	برای شروع روی نقطه اول کلیک کنید.
+	Snap to drawing	چسبیدن به ترسیم
+	Endpoints	نقاط انت‌هایی
+	Midpoints	نقاط میانی
+	Intersections	تقاطع‌ها
+	Paths	مسیر‌ها
+	Sensitivity	حساسیت
+	Unit	واحد
+	Decimals	اعشار
+	Calibrate from two points	کالیبره کردن از دو نقطه
+	Entire page	تمام صفحه
+	Viewport rectangle in page points (x, y, width, height)	مستطیل نمایشگر در نقاط صفحه (x، y، عرض، ارتفاع)
+	Viewport	نمایشگر
+	Apply scale	اعمال مقیاس
+	Saved measurements	اندازه‌گیری‌های ذخیره‌شده
+	Saved measurements.	اندازه‌گیری‌های ذخیره‌شده.
+	Endpoint	نقطه انت‌هایی
+	Midpoint	نقطه میانی
+	Intersection	تقاطع
+	Path	مسیر
+	This drawing exceeds the snapping limit; only the first paths are used.	این ترسیم از حد چسبیدن فرا‌تر می‌رود؛ فقط مسیر‌های اول استفاده می‌شوند.
+	Some page content couldn't be read; snapping uses the rest.	بخشی از محتوای صفحه خوانده نشد؛ چسبیدن از بقیه استفاده می‌کند.
+	Unsupported measurements	اندازه‌گیری‌های پشتیبانی‌نشده
+	Label	برچسب
+	{n} measurements use an unsupported format and are left out.	{n} اندازه‌گیری از یک قالب پشتیبانی‌نشده استفاده می‌کنند و کنار گذاشته می‌شوند.
+	This area has too many overlapping paths; intersection snapping is limited.	این ناحیه مسیر‌های هم‌پوشان بیش از حد دارد؛ چسبیدن به تقاطع‌ها محدود است.
+	This measurement needs at least {n} points.	این اندازه‌گیری به حداقل {n} نقطه نیاز دارد.
+	Change {what}	تغییر {what}
+	Cut and stack	برش و رویهمچینی
+	Default workspace mode	حالت پیش‌فرض فضای کاری
+	Documents and view	سند‌ها و نمایش
+	Open email app	باز کردن برنامهٔ ایمیل
+	Open link	باز کردن پیوند
+	Open this web page?	این صفحهٔ وب باز شود؟
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	اسکریپت‌ها در محیطی ایزوله و بدون دسترسی به فایل یا شبکه اجرا می‌شوند. اسکریپتی که درخواست باز کردن یک صفحهٔ وب را دارد، ابتدا به اجازهٔ شما نیاز دارد. با خاموش بودن JavaScript، توابع استاندارد قالب‌بندی، اعتبارسنجی و محاسبهٔ Acrobat همچنان کار می‌کنند.
+	Sign yourself	خودتان امضا کنید
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	هنگام باز کردن PDFها استفاده می‌شود. حالت اجرا یا کنترل صریح برای آن نشست اولویت دارد.
+	Write this email?	این ایمیل نوشته شود؟
+	{who} in this document wants to open this address in your browser:	{who} در این سند می‌خواهد این نشانی را در مرورگر شما باز کند:
+	{who} in this document wants to open your email app with this address:	{who} در این سند می‌خواهد برنامهٔ ایمیل شما را با این نشانی باز کند:
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	این نشانی وب حروفی از الفبا‌های مختلف را با هم می‌آمیزد؛ روشی رایج برای جعل نام سایت دیگر.
+	This web address uses letters from another alphabet, which can look like familiar ones.	این نشانی وب از حروف الفبای دی‌گری استفاده می‌کند که می‌توانند شبیه حروف آشنا به نظر برسند.
+	Create PDF from images	ساخت PDF از تصاویر
+	Selected image files: {count}	فایل‌های تصویری انتخاب‌شده: {count}
+	Use image resolution	استفاده از وضوح تصویر
+	Use each image's embedded DPI; use 72 DPI when it is absent.	از DPI جا‌سازی‌شدهٔ هر تصویر استفاده کن؛ اگر نبود، ۷۲ DPI به‌کار ببر.
+	Use 72 DPI (one point per pixel)	استفاده از ۷۲ DPI (یک نقطه بر هر پیکسل)
+	Use custom DPI	استفاده از DPI سفارشی
+	DPI sets the printed page size without resampling the image.	DPI اندازهٔ صفحهٔ چاپی را بدون نمونهبرداری مجدد تصویر تعیین می‌کند.
+	Create	ساخت
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	فرم XFA پویا که از قالب آن چیده شده است: {pages}، {fields}.
+	This form's scripts are turned off because one ran too long. Reopen the document to run them again.	اسکریپت‌های این فرم خاموش شدهاند چون یکی از آن‌ها بیش از حد طول کشید. سند را دوباره باز کنید تا دوباره اجرا شوند.
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	فرم XFA: فیلد‌ها و داده‌های XFA آن هم‌گام نگه داشته می‌شوند، تا سایر نمایشگر‌ها آنچه را پر می‌کنید نشان دهند.
+@plural	{n} page|{n} pages	{n} صفحه|{n} صفحه
+@plural	{n} field|{n} fields	{n} فیلد|{n} فیلد
+@plural	{n} field name collides with earlier files and will be renamed: {list}|{n} field names collide with earlier files and will be renamed: {list}	{n} نام فیلد با فایل‌های قبلی تداخل دارد و تغییر نام داده می‌شود: {list}|{n} نام فیلد با فایل‌های قبلی تداخل دارند و تغییر نام داده می‌شوند: {list}
+	Switch to two-page view first to show the cover page	برای نمایش صفحهٔ جلد، ابتدا به نمایش دوصفح‌های بروید
+	Page display: {layout}	نمایش صفحه: {layout}
+	Fit to width scrolling	پیمایش متناسب با عرض
+	Fit one full page	تناسب یک صفحهٔ کامل
+	Default page display	نمایش صفحهٔ پیش‌فرض
+	Default zoom	بزرگنمایی پیش‌فرض
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	وقتی PDF طرح‌بندی یا بزرگنمایی خاصی درخواست نمی‌کند استفاده می‌شود. پیمایش پیوسته هرگز بین صفحه‌ها نمی‌پرد.
+	Show	نمایش
+	Sort	مرتب‌سازی
+	Reverse the order	معکوس کردن ترتیب
+	Grab bag	متفرقه
+	Table	جدول
+	Username	نام کاربری
+	Display name	نام نمایشی
+	Real name	نام واقعی
+	Name (A–Z)	نام (A–Z)
+	Merged PRs	PRهای ادغام‌شده
+	PRs	PRها
+	Commits	کامیت‌ها
+	Lines added	خطوط افزوده‌شده
+	+LOC	+LOC
+	Lines deleted	خطوط حذف‌شده
+	−LOC	−LOC
+	Line delta	دلتای خطوط
+	ΔLOC	ΔLOC
+	Binary assets added	دارایی‌های دودویی افزوده‌شده
+	+Bin	+Bin
+	Binary assets removed	دارایی‌های دودویی حذف‌شده
+	−Bin	−Bin
+	First commit	نخستین کامیت
+	First	نخستین
+	Last commit	آخرین کامیت
+	Last	آخرین
+	No contributor data was built into this copy.	هیچ داد‌های از هم‌کاران در این نسخه گنجانده نشده است.
+	No model credits were built into this copy.	هیچ اعتبار مدلی در این نسخه گنجانده نشده است.
+	{n} contributors · {c} commits	{n} هم‌کار · {c} کامیت
+	Company	شرکت
+	Model	مدل
+	% of all commits	٪ از همهٔ کامیت‌ها
+	Lines +/−	خطوط +/−
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: {prs} PR، {commits} کامیت، +{added} / −{deleted} خط (Δ {delta})، +{bin_added} / −{bin_deleted} دارایی دودویی، {first} – {last}
+	Reopen the files that were open when PdfCraft last closed	باز‌گشایی فایل‌هایی که هنگام آخرین بسته شدن PdfCraft باز بودند
+	Restore the last view (page, zoom and page display) when a document is opened again	باز‌یابی آخرین نما (صفحه، بزرگنمایی و نمایش صفحه) هنگام باز شدن دوبارهٔ سند
+	Add {what}	افزودن {what}
+	Use {what}	استفاده از {what}
+	Place saved {what}	قرار دادن {what} ذخیره‌شده
+	Remove saved {what}	حذف {what} ذخیره‌شده
+	A link	یک پیوند
+	A button	یک دکمه
+	A script	یک اسکریپت
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	{who} در این سند تلاش کرد نشانیای را باز کند که PdfCraft باز نمی‌کند: {e}.
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	{who} در این سند تلاش کرد نشانیای را باز کند که PdfCraft باز نمی‌کند: {e}. از میان سند‌ها فقط پیوند‌های وب (http، https) و ایمیل (mailto) باز می‌شوند.
+	Another file dialog is still open. Finish with it first.	یک پنجرهٔ گفتوگوی فایل دیگر هنوز باز است. ابتدا آن را تمام کنید.
+	Couldn't show the file picker. Please try again.	انتخابگر فایل نمایش داده نشد. لطفاً دوباره تلاش کنید.
+	The document changed while you were choosing a file, so nothing was changed.	سند در حین انتخاب فایل تغییر کرد، بنابراین چیزی تغییر نکرد.
+	The document was closed before it could be saved.	سند پیش از آنکه ذخیره شود بسته شد.
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	صفحه‌ها استخراج شدند اما حذف نشدند، زیرا سند در حین انتخاب پوشه تغییر کرد.
+	That didn't work: an internal error stopped it ({m}).	انجام نشد: یک خطای داخلی آن را متوقف کرد ({m}).
+	The Windows store's digital IDs couldn't be listed: {e}	شناسه‌های دیجیتال مخزن Windows فهرست نشدند: {e}
+	Align fields	هم‌ترازی فیلد‌ها
+	Distribute fields	توزیع فیلد‌ها
+	Match field sizes	یکسان‌سازی اندازهٔ فیلد‌ها
+	Mark for redaction	علامت‌گذاری برای سیاه‌کردن
+	Mark pages for redaction	علامت‌گذاری صفحه‌ها برای سیاه‌کردن
+	Change document properties	تغییر ویژگی‌های سند
+	Mark differences	علامت‌گذاری تفاوت‌ها
+	Run form script	اجرای اسکریپت فرم
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	محتوای اسکریپتی باید با صفحه کلید و فناوری‌های کمکی قابل استفاده باشد. اسکریپت‌های سند را بررسی کنید.
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	سطر‌های جدول مستقیماً به جدول یا سر، بدنه یا پای آن تعلق دارند. برچسب‌های جدول را اصلاح کنید.
+	Basic constraints	محدودیت‌های پایه
+	SHA-1 digest	چکیده SHA-1
+	SHA-256 digest	چکیده SHA-256
+	Squiggly	موجدار
+	Home / End	Home / End
+	H / Space (hold)	H / فاصله (نگهداشتن)
+	Reload documents when their files change on disk	بار‌گذاری مجدد سند‌ها وقتی فایل‌هایشان روی دیسک تغییر می‌کنند
+	Don't show again	دیگر نشان نده
+	Show a notice when a document is secured	نمایش اعلان وقتی سند محافظت شده است
+	Always use my default zoom and page layout	همیشه از بزرگنمایی و طرح‌بندی صفحهٔ پیش‌فرض من استفاده کن
+	This file changed on disk. Reload shows the new version and drops your unsaved changes; Save replaces it with this version.	این فایل روی دیسک تغییر کرد. «بار‌گذاری مجدد» نسخهٔ جدید را نشان می‌دهد و تغییرات ذخیره‌نشدهٔ شما را از دست می‌دهد؛ «ذخیره» آن را با این نسخه جایگزین می‌کند.
+	Reload	بار‌گذاری مجدد
+	Couldn't reload {name}: {e}	بار‌گذاری مجدد {name} ممکن نشد: {e}
+	Created a PDF from {n} files	یک PDF از {n} فایل ساخته شد
+	PDF, images and text	PDF، تصاویر و متن
+	Insert a file before page {label}	درج یک فایل پیش از صفحهٔ {label}
+	Insert a file at the end	درج یک فایل در پایان
+	Save pages	ذخیرهٔ صفحه‌ها
+	Save these pages as one PDF	ذخیرهٔ این صفحه‌ها به‌صورت یک PDF
+	No changes to save	تغییری برای ذخیره نیست
+	Created a PDF from {n} files; left out: {names}	یک PDF از {n} فایل ساخته شد؛ کنار گذاشته شد: {names}
+	Created a PDF from the first {n} files	یک PDF از {n} فایل نخست ساخته شد
+	None of those files can be made into a PDF; use PDFs, images or .txt files	هیچ یک از آن فایل‌ها را نمی‌توان به PDF تبدیل کرد؛ از فایل‌های PDF، تصویر یا .txt استفاده کنید
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	یک تصویر PNG یا JPEG انتخاب کنید (حداکثر ۴ MiB). شفافیت حفظ می‌شود.
+	Couldn't import the signature image: {e}	تصویر امضا وارد نشد: {e}
+	Go to page…	رفتن به صفحه…
+	About	درباره
+	Contributors	هم‌کاران
+	Models	مدل‌ها
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	فقط اگر به این سند اعتماد دارید ادامه دهید. یک نشانی می‌تواند اطلاعاتی از سند را با خود حمل کند، مانند آنچه در فرم آن تایپ کردهاید.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	یکرو چاپ کنید. برگه‌ها را به ترتیب نگه دارید، روی علامت‌ها ببرید، سپس دسته‌ها را از چپ به راست و از بالا به پایین روی هم بگذارید.
+	For page sizes and margins.	برای اندازه‌های صفحه و حاشیه‌ها.
+	The PDF text fonts can't draw “{c}” ({code}). Choose supported text.	قلم‌های متن PDF نمی‌توانند «{c}» را بکشند ({code}). متن پشتیبانی‌شده انتخاب کنید.
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	قلم‌های استاندارد نمی‌توانند «{c}» را بکشند ({code}). فعلاً فقط نویسه‌های اروپای غربی می‌توانند به‌عنوان متن افزوده شوند.
+	This field's font can't draw “{c}” ({code}), so PdfCraft shows ? in its place. The value is saved, and other PDF viewers redraw the field from it.	قلم این فیلد نمی‌تواند «{c}» را بکشد ({code})، بنابراین PdfCraft به‌جای آن ? نشان می‌دهد. مقدار ذخیره می‌شود و سایر نمایشگر‌های PDF فیلد را از آن باز‌ترسیم می‌کنند.
+	The fonts PdfCraft writes with can't draw “{c}” ({code}), so it shows as ? in every PDF viewer. The text is saved.	قلم‌هایی که PdfCraft با آن‌ها می‌نویسد نمی‌توانند «{c}» را بکشند ({code})، بنابراین در همهٔ نمایشگر‌های PDF به‌صورت ? نمایش داده می‌شود. متن ذخیره می‌شود.
+	Open arrow	پیکان باز
+	Closed arrow	پیکان بسته
+	Butt	انت‌های صاف
+	Reverse open arrow	پیکان باز معکوس
+	Reverse closed arrow	پیکان بستهٔ معکوس
+	Slash	اسلش
+	Larger pages	صفحه‌های بزرگ‌تر
+	Smaller pages	صفحه‌های کوچک‌تر
+	Reset page size	باز‌نشانی اندازهٔ صفحه
+	Date format	قالب تاریخ
+	Fill & Sign dates	تاریخ‌های Fill & Sign
+	Pattern	الگو
+	Today: {date}	امروز: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy یا yy سال · m یا mm ماه · mmm یا mmmm نام ماه · d یا dd روز · ddd یا dddd روز هفته. H، h، M، s و t حروف زمان هستند و نمی‌توانند بهتن‌هایی استفاده شوند: برای نمایش حرف به همان صورت، {escape} را پیش از آن بگذارید.
+	Same as interface ({language})	یکسان با رابط کاربری ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} هنوز نمی‌تواند در PDF نوشته شود: متن Fill & Sign فقط اروپای غربی است. قالبی عددی مانند dd.mm.yyyy انتخاب کنید.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	ترجیحات درایور چاپگر را باز می‌کند. آن‌ها برای هر چاپ از این رایانه ذخیره می‌شوند؛ تعداد نسخه، دورو، مقیاس خاکستری و کاغذ انتخاب‌شده در اینجا همچنان اعمال می‌شوند.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	تنظیمات خود درایور چاپگر برای این چاپ: سینی کاغذ، نوع کاغذ، تکمیل و موارد دیگر.
+	Couldn't open the printer's preferences: {e}	ترجیحات چاپگر باز نشد: {e}
+	Printer properties	ویژگی‌های چاپگر
+	Reset to printer defaults	باز‌نشانی به پیش‌فرض‌های چاپگر
+	This printer offers no settings of its own.	این چاپگر تنظیمات اختصاصی خود را ارائه نمی‌دهد.
+	Scroll tabs left	پیمایش زبانه‌ها به چپ
+	Scroll tabs right	پیمایش زبانه‌ها به راست
+	Shared Field Properties	ویژگی‌های مشترک فیلد‌ها
+	{n} fields selected	{n} فیلد انتخاب‌شده
+	Mixed	متفاوت
+	Custom font	قلم سفارشی
+	Only checked properties will change. Mixed means the selected fields have different values.	فقط ویژگی‌های علامتخورده تغییر می‌کنند. «متفاوت» یعنی فیلد‌های انتخاب‌شده مقادیر متفاوتی دارند.
+	Shift- or Ctrl/Command-click to select several fields.	برای انتخاب چند فیلد، با Shift یا Ctrl/Command کلیک کنید.
+	Font size 0 uses automatic sizing.	اندازهٔ قلم ۰ از اندازه‌گذاری خودکار استفاده می‌کند.
+	Character limit:	محدودیت نویسه:
+	Character limit 0 means no limit. A comb of characters needs a limit.	محدودیت نویسهٔ ۰ یعنی بدون محدودیت. شانهٔ نویسه‌ها به محدودیت نیاز دارد.
+	To change locked fields, also set Locked to No.	برای تغییر فیلد‌های قفل‌شده، «قفل‌شده» را هم روی «خیر» بگذارید.
+	Comb of characters	شانهٔ نویسه‌ها
+	The document changed while you were editing field properties.	سند در حین ویرایش ویژگی‌های فیلد تغییر کرد.
+	The document is no longer open.	سند دیگر باز نیست.
+	The field properties dialog is no longer open.	پنجرهٔ ویژگی‌های فیلد دیگر باز نیست.
+	The field properties could not be changed.	ویژگی‌های فیلد تغییر نکردند.
+	The selected fields could not be found. Select them again.	فیلد‌های انتخاب‌شده یافت نشدند. دوباره آن‌ها را انتخاب کنید.
+	The field {name} no longer exists.	فیلد {name} دیگر وجود ندارد.
+	A selected field has no widget on any page, so the fields can't be edited together.	یک فیلد انتخاب‌شده در هیچ صفحه ای ویجت ندارد، بنابراین فیلد‌ها را نمی‌توان با هم ویرایش کرد.
+	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} در {dpi} dpi، بزرگ‌ترین انداز‌های که می‌توانند در آن کشیده شوند)
+	The security settings don't allow screen readers to read the text	تنظیمات امنیتی اجازه نمی‌دهند صفحه خوان‌ها متن را بخوانند
+	No page has text: the document appears to be images of pages	هیچ صفحه ای متن ندارد: به نظر می‌رسد سند تصویر‌هایی از صفحه‌ها باشد
+	The document has no tags (structure tree)	سند برچسبی ندارد (درخت ساختار)
+	The document isn't marked as tagged (MarkInfo Marked)	سند به‌عنوان برچسبدار علامت‌گذاری نشده است (MarkInfo Marked)
+	No document language is set	زبان سند تعیین نشده است
+	The document has no title	سند عنوانی ندارد
+	The window shows the file name, not the title (Initial View > Show)	پنجره نام فایل را نشان می‌دهد، نه عنوان را (نمای اولیه > نمایش)
+	{n} pages and no bookmarks	{n} صفحه و بدون نشانک
+	The document isn't tagged, so none of its content is	سند برچسبدار نیست، بنابراین هیچ یک از محتوای آن نیز برچسب ندارد
+	Page {p}: {n} untagged content item	صفحهٔ {p}: {n} مورد محتوای بدون برچسب
+	Page {p}: {n} untagged content items	صفحهٔ {p}: {n} مورد محتوای بدون برچسب
+	Form field on page {p} isn't tagged	فیلد فرم در صفحهٔ {p} برچسبدار نیست
+	{} annotation on page {p} isn't tagged	یادداشت {} در صفحهٔ {p} برچسبدار نیست
+	Page {p} doesn't tab in structure order	صفحهٔ {p} به ترتیب ساختار پیمایش زبانه نمی‌شود
+	Font {} on page {p} doesn't map its characters to Unicode	قلم {} در صفحهٔ {p} نویسه‌هایش را به Unicode نگاشت نمی‌کند
+	Font (unnamed) on page {p} doesn't map its characters to Unicode	قلم (بینام) در صفحهٔ {p} نویسه‌هایش را به Unicode نگاشت نمی‌کند
+	Field "{}" on page {p} has no description (tooltip)	فیلد «{}» در صفحهٔ {p} توضیحی ندارد (راهنمای ابزار)
+	{ty} element: {what}	عنصر {ty}: {what}
+	{ty} element on page {p}: {what}	عنصر {ty} در صفحهٔ {p}: {what}
+	no alternate text	بدون متن جایگزین
+	its alternate text is inside another element's and will never be read	متن جایگزین آن داخل متن عنصری دیگر است و هرگز خوانده نمی‌شود
+	alternate text on an element with no page content	متن جایگزین روی عنصری بدون محتوای صفحه
+	alternate text hides an annotation inside it	متن جایگزین یادداشتی را در داخل خود پنهان می‌کند
+	not in a Table, THead, TBody or TFoot	داخل Table، THead، TBody یا TFoot نیست
+	not in a TR	داخل TR نیست
+	no header cells (TH)	بدون سلول‌های سرصفحه (TH)
+	rows have between {min} and {max} columns	سطر‌ها بین {min} و {max} ستون دارند
+	no summary	بدون خلاصه
+	not in an L (list)	داخل L (فهرست) نیست
+	not in an LI (list item)	داخل LI (مورد فهرست) نیست
+	the first heading is an H{n}; headings should not skip levels	نخستین سرفصل یک H{n} است؛ سرفصل‌ها نباید سطوح را جا بی‌ندازند
+	H{n} follows an H{d}; headings should not skip levels	H{n} بعد از H{d} می‌آید؛ سرفصل‌ها نباید سطوح را جا بی‌ندازند
+	… and {n} more	… و {n} مورد دیگر
+	Accessibility Report	گزارش دسترس‌پذیری
+	Filename	نام فایل
+	Report created	گزارش ایجاد شد
+	The checker found problems which may prevent the document from being fully accessible.	بررسی‌کننده مشکلاتی یافت که ممکن است مانع دسترس‌پذیری کامل سند شوند.
+	Detailed Report	گزارش تفصیلی
+	Rule Name	نام قاعده
+	The metadata doesn't identify the file as {}	فراداده فایل را به‌عنوان {} شناسایی نمی‌کند
+	Page {} has additional actions	صفحهٔ {} اقدام‌های اضافی دارد
+	A {} action isn't allowed	اقدام {} مجاز نیست
+	{} annotations aren't allowed	یادداشت‌های {} مجاز نیستند
+	A {} annotation isn't set to print, or is hidden	یادداشت {} برای چاپ تنظیم نشده، یا پنهان است
+	A {} annotation has no appearance stream	یادداشت {} جریان ظاهری ندارد
+	A {} annotation has additional actions	یادداشت {} اقدام‌های اضافی دارد
+	The font {} isn't embedded	قلم {} جا‌سازی نشده است
+	A font isn't embedded	قلمی جا‌سازی نشده است
+	The signature has no valid byte range.	امضا باز‌های از بایت‌های معتبر ندارد.
+	The signature's byte range does not match the file.	بازهٔ بایت‌های امضا با فایل مطابقت ندارد.
+	The signature's byte range does not exclude exactly its contents.	بازهٔ بایت‌های امضا دقیقاً محتوای آن را مستثنا نمی‌کند.
+	The signature contents are not hexadecimal.	محتوای امضا هگزادسیمال نیست.
+	The signature could not be read ({}).	امضا خوانده نشد ({}).
+	PdfCraft can't check this signature yet: {}.	PdfCraft هنوز نمی‌تواند این امضا را بررسی کند: {}.
+	The signature uses the legacy adbe.x509.rsa_sha1 format.	امضا از قالب قدیمی adbe.x509.rsa_sha1 استفاده می‌کند.
+	The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.	امضا به‌صورت BER رمز‌گذاری شده است (طول‌های نامعین) نه DER؛ با اغماض خوانده شد.
+	The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.	محتوای امضا‌شده یک OCTET STRING ساخته‌شده (بخشبخش) است، همان‌طور که BER اجازه می‌دهد؛ به هرحال خوانده شد.
+	The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.	مقدار امضای RSA طول پیمان‌های کلید را ندارد (بایت‌های صفر ابتدایی حذف یا افزوده شدهاند)؛ به هرحال خوانده شد.
+	The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.	DigestInfo امضای RSA پارامتر NULL ندارد (امضاکنندگان قدیمی‌تر آن را چنین می‌نویسند)؛ به هرحال خوانده شد.
+	The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.	امضای ECDSA در DER متعارف نیست (بایت‌های انت‌هایی، پرشدگی یا نبود بایت علامت)؛ بههرحال خوانده شد.
+	The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.	امضای ECDSA مقادیر خام r و s است نه یک دنبالهٔ DER؛ بههرحال خوانده شد.
+	The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.	الگوریتم امضا و الگوریتم چکیدهٔ SignerInfo هش‌های متفاوتی را نام می‌برند؛ امضا با هش SignerInfo ساخته شده است.
+	The signature's signed attributes have no content type, which CMS requires; it was read anyway.	ویژگی‌های امضا‌شدهٔ امضا نوع محتوا ندارند، که CMS آن را الزامی می‌داند؛ بههرحال خوانده شد.
+	This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.	این امضا از SHA-1 استفاده می‌کند، یک الگوریتم هش ضعیف: برخورد‌ها در آن به اثبات رسیده است. همچنان معتبر است چون بسیاری از اسناد امضا‌شده سال‌ها پیش از آن استفاده می‌کنند، اما نباید به آن اعتماد کرد.
+	This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.	این امضا از RIPEMD-160 استفاده می‌کند، یک الگوریتم هش قدیمی ۱۶۰ بیتی که دیگر برای امضا توصیه نمی‌شود. همچنان معتبر است، اما نباید به آن اعتماد کرد.
+	This signature uses an RSA key shorter than 2048 bits, which is no longer considered strong enough for signatures. It still validates, but it should not be relied on.	این امضا از یک کلید RSA کوتاه‌تر از ۲۰۴۸ بیت استفاده می‌کند که دیگر برای امضا‌ها بهاندازهٔ کافی قوی در نظر گرفته نمی‌شود. همچنان معتبر است، اما نباید به آن اعتماد کرد.
+	The signature's signed attributes have no message digest, so the signature does not cover the document.	ویژگی‌های امضا‌شدهٔ امضا چکیدهٔ پیام ندارند، بنابراین امضا سند را پوشش نمی‌دهد.
+	The signature's signed attributes name a content type other than data, so it is not a signature of the document.	ویژگی‌های امضا‌شدهٔ امضا نوع محتوایی غیر از داده را نام می‌برند، بنابراین امضای سند نیست.
+	The document has been altered or corrupted since the signature was applied.	سند از زمان اعمال امضا تغییر کرده یا خراب شده است.
+	The signer's certificate is not in the signature.	گواهی امضا‌کننده در امضا نیست.
+	The signature value does not match the signer's certificate: the signature is corrupt.	مقدار امضا با گواهی امضا‌کننده مطابقت ندارد: امضا خراب است.
+	The signature could not be checked ({}).	امضا بررسی نشد ({}).
+	The signature could not be verified ({}).	امضا تأیید نشد ({}).
+	This document has not been modified since this signature was applied.	این سند از زمان اعمال این امضا تغییر نکرده است.
+	The document has been modified since this signature was applied, but the changes are permitted ({}).	سند از زمان اعمال این امضا تغییر کرده است، اما تغییرات مجاز هستند ({}).
+	The document has been altered since this signature was applied in ways it does not permit ({}).	سند از زمان اعمال این امضا به روش‌هایی تغییر کرده که مجاز نمی‌داند ({}).
+	The signer's certificate was not valid at the time of signing.	گواهی امضا‌کننده در زمان امضا معتبر نبود.
+	The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).	گواهی امضا‌کننده امضا‌های دیجیتال را مجاز نمی‌داند (کاربرد کلید آن نه امضای دیجیتال دارد و نه انکارنا‌پذیری).
+	The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).	گواهی امضا‌کننده برای امضای اسناد صادر نشده است (کاربرد کلید گستردهٔ آن هیچ هدف امضای سند ندارد).
+	The signer's certificate has critical extensions PdfCraft does not recognize ({}).	گواهی امضا‌کننده افزونه‌های حیاتی دارد که PdfCraft آن‌ها را نمی‌شناسد ({}).
+	The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.	گواهی {} یک گواهی CA که بتواند گواهی صادر کند نیست، بنابراین برای تأیید {} استفاده نمی‌شود.
+	The certificate of {} has critical extensions PdfCraft does not recognize, so it is not used to vouch for {}.	گواهی {} افزونه‌های حیاتی دارد که PdfCraft آن‌ها را نمی‌شناسد، بنابراین برای تأیید {} استفاده نمی‌شود.
+	The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.	گواهی {} این تعداد گواهی CA در زیر خود را مجاز نمی‌داند (طول مسیر)، بنابراین برای تأیید {} استفاده نمی‌شود.
+	The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.	گواهی {} در زمان امضا معتبر نبود، بنابراین برای تأیید {} استفاده نمی‌شود.
+	The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.	هویت امضا‌کننده ناشناخته است زیرا در فهرست گواهی‌های مورد اعتماد شما گنجانده نشده و هیچیک از گواهی‌های والد آن گواهی مورد اعتماد نیستند.
+	The signer's identity is valid.	هویت امضا‌کننده معتبر است.
+	The signature includes an embedded timestamp.	امضا شامل یک مهر زمانی جا‌سازی‌شده است.
+	Signing time is from the clock on the signer's computer.	زمان امضا از ساعت رایانهٔ امضا‌کننده گرفته شده است.
+	The signature's timestamp token does not cover the signature value.	نشانهٔ مهر زمانی امضا مقدار امضا را پوشش نمی‌دهد.
+	The signature's timestamp token could not be verified ({}).	نشانهٔ مهر زمانی امضا تأیید نشد ({}).
+	The embedded timestamp token is valid and its authority is trusted; trusted time is {}.	نشانهٔ مهر زمانی جا‌سازی‌شده معتبر است و مرجع آن مورد اعتماد است؛ زمان مورد اعتماد {} است.
+	The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.	امضا یک مهر زمانی تأیید‌نشده حمل می‌کند ({}): مرجع مهر زمانی در فهرست گواهی‌های مورد اعتماد شما نیست، بنابراین در عوض از زمان امضایی که امضا‌کننده ادعا می‌کند استفاده می‌شود.
+	The signer's certificate has been revoked ({}).	گواهی امضا‌کننده باطل شده است ({}).
+	The document's embedded revocation information shows that the signer's certificate has not been revoked.	اطلاعات ابطال جا‌سازی‌شده در سند نشان می‌دهد که گواهی امضا‌کننده باطل نشده است.
+	The timestamp has no valid byte range.	مهر زمانی بازهٔ بایت‌های معتبر ندارد.
+	The timestamp's byte range does not match the file.	بازهٔ بایت‌های مهر زمانی با فایل مطابقت ندارد.
+	The timestamp's byte range does not exclude exactly its contents.	بازهٔ بایت‌های مهر زمانی دقیقاً محتوای آن را مستثنا نمی‌کند.
+	The timestamp contents are not hexadecimal.	محتوای مهر زمانی هگزادسیمال نیست.
+	The timestamp token could not be read ({}).	نشانهٔ مهر زمانی خوانده نشد ({}).
+	The document has been altered or corrupted since the timestamp was applied.	سند از زمان اعمال مهر زمانی تغییر کرده یا خراب شده است.
+	The timestamp authority's certificate was not valid at the time of timestamping.	گواهی مرجع مهر زمانی در زمان مهر زدن معتبر نبود.
+	The timestamp authority's certificate is not issued for time stamping.	گواهی مرجع مهر زمانی برای مهر زدن زمان صادر نشده است.
+	This document has not been modified since this timestamp was applied.	این سند از زمان اعمال این مهر زمانی تغییر نکرده است.
+	The document has been modified since this timestamp was applied, but the changes are permitted ({}).	سند از زمان اعمال این مهر زمانی تغییر کرده است، اما تغییرات مجاز هستند ({}).
+	The document has been altered since this timestamp was applied in ways it does not permit ({}).	سند از زمان اعمال این مهر زمانی به روش‌هایی تغییر کرده که مجاز نمی‌داند ({}).
+	The timestamp token is valid and its authority is trusted.	نشانهٔ مهر زمانی معتبر است و مرجع آن مورد اعتماد است.
+	The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.	نشانهٔ مهر زمانی معتبر است، اما مرجع مهر زمانی در فهرست گواهی‌های مورد اعتماد شما نیست.
+	Unsigned signature field	فیلد امضای امضا‌نشده
+	Signature is valid	امضا معتبر است
+	Signature validity is unknown	اعتبار امضا ناشناخته است
+	Signature is invalid	امضا نامعتبر است
+	page content	محتوای صفحه
+	form fill	پرشدن فرم
+	comments	یادداشت‌ها
+	document security store	مخزن امنیت سند
+	metadata	فراداده
+	links	پیوند‌ها
+	document structure	ساختار سند
+	pages added or removed	صفحه‌های افزوده یا حذف‌شده
+	other changes	تغییرات دیگر
+	the signed version could not be read	نسخهٔ امضا‌شده خوانده نشد
+	page {n} is out of range (1–{count})	صفحهٔ {n} خارج از محدوده است (۱–{count})
+	{page} is not a page number or label	{page} یک شماره یا برچسب صفحه نیست
+	Change Title	تغییر عنوان
+	Change Author	تغییر نویسنده
+	Change Subject	تغییر موضوع
+	Change Keywords	تغییر کلیدواژه‌ها
+	Save as {level}	ذخیره به‌صورت {level}
+	Remove {standard} identification	حذف شناسهٔ {standard}
+	Create links	ایجاد پیوند‌ها
+@plural	{n} object selected|{n} objects selected	{n} شیء انتخاب‌شده|{n} شیء انتخاب‌شده
+	Drag the selection to move it. Esc clears the selection.	برای جابه‌جایی، انتخاب را بکشید. Esc انتخاب را پاک می‌کند.
+	Shift-click to select several objects. Drag empty space to select an area.	برای انتخاب چند شیء، با Shift کلیک کنید. برای انتخاب یک ناحیه، فضای خالی را بکشید.
+	Select at most 1000 objects at a time.	حداکثر ۱۰۰۰ شیء را در یک زمان انتخاب کنید.
+	Finish or discard the text being edited before selecting several objects.	پیش از انتخاب چند شیء، ویرایش متن را تمام کنید یا رهایش کنید.
+	Move object	جابه‌جایی شیء
+	Move objects	جابه‌جایی اشیا
+	Vertical text cannot be moved with this selection.	متن عمودی را نمی‌توان با این انتخاب جابهجا کرد.
+	Text used as a clipping path cannot be moved with this selection.	متنی که به‌عنوان مسیر برش استفاده شده را نمی‌توان با این انتخاب جابهجا کرد.
+	These objects could not be moved. Select them again and try a smaller move.	این اشیا جابه جا نشدند. دوباره آن‌ها را انتخاب کنید و جابه‌جایی کوچکتری را امتحان کنید.
+	This page contains objects that cannot be selected together.	این صفحه شامل اشیایی است که نمی‌توان آن‌ها را با هم انتخاب کرد.
+	Fill colour	رنگ پر‌کردن
+	No fill	بدون پرشدگی
+	Fill colour: none	رنگ پر‌کردن: هیچ
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	فاصله
+	Grid view	نمای شبکه ای
+	List view	نمای فهرستی
+	Files are combined in the order shown. Drag them to change it.	فایل‌ها به ترتیب نمایش‌داده‌شده ترکیب می‌شوند. برای تغییر آن، آن‌ها را بکشید.
+	Preview unavailable: {e}	پیش‌نمایش در دسترس نیست: {e}
+	Pages: {k} of {n}	صفحه‌ها: {k} از {n}
+	Check the pages	صفحه‌ها را بررسی کنید
+	Switch to List view to change the pages it takes.	برای تغییر صفحه‌هایی که برمی‌دارد، به نمای فهرستی بروید.
+	Expand all	گسترش همه
+	Collapse all	جمع کردن همه
+	Collapse all pages	جمع کردن همهٔ صفحه‌ها
+	Expand all pages	گسترش همهٔ صفحه‌ها
+	Remove page	حذف صفحه
+	Remove {n} pages	حذف {n} صفحه
+	Reset panel layout	باز‌نشانی چیدمان پنل‌ها
+	Float panel	شناور کردن پنل
+	Move to group	انتقال به گروه
+	Panels	پنل‌ها
+	Resize panels	تغییر اندازهٔ پنل‌ها
+	Resize panel window	تغییر اندازهٔ پنجرهٔ پنل
+	Tools	ابزار‌ها
+	Inspector	بازرس
+	PDF page: {size}	صفحهٔ PDF: {size}
+	Match page at 100%	تناسب کاغذ با صفحه در ۱۰۰٪
+	PDF scale: {scale}%	مقیاس PDF: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	کاغذ و مقیاس چاپگر ممکن است متفاوت باشد. تنظیمات درایور را بررسی کنید.
+	Drawing scale changes. Use Actual size for full-scale plans.	مقیاس نقشه تغییر می‌کند. برای نقشه‌های با اندازه کامل از «اندازه واقعی» استفاده کنید.
+	Select page {label}	انتخاب صفحه {label}
+	Rotate page {label} counterclockwise	چرخش صفحه {label} در خلاف جهت عقربه‌های ساعت
+	Rotate page {label} clockwise	چرخش صفحه {label} در جهت عقربه‌های ساعت
+	Delete page {label}	حذف صفحه {label}
+	Scroll speed (mouse wheel and arrow keys)	سرعت پیمایش (چرخ ماوس و کلید‌های جهت)
+scroll speed	Slow	کند
+scroll speed	Normal	عادی
+scroll speed	Fast	تند
+	Animation effects	جلوه‌های پویانمایی
+animation effects	On	روشن
+animation effects	Off	خاموش
+	Enhance camera image	بهبود تصویر دوربین
+	Drag the corners onto the document's edges, then choose Enhance page.	گوشه‌ها را روی لبه‌های سند بکشید، سپس «بهبود صفحه» را انتخاب کنید.
+	Enhance page	بهبود صفحه
+	Done adding text	پایان افزودن متن
+	Discard this text (Esc)	کنار گذاشتن این متن (Esc)
+	Certificate authority	مرجع گواهی
+	End entity	موجودیت نهایی
+	Clean-up	پاک‌سازی
+	Original	اصلی
+	Greyscale	خاکستری
+	Black and white	سیاه و سفید
+	This printer's driver doesn't take two-sided settings from other programs, so its own setting applies. Change it in Properties…	درایور این چاپگر تنظیمات دوطرفه را از برنامه‌های دیگر نمی‌پذیرد، بنابراین تنظیم خودش اعمال می‌شود. آن را در «ویژگی‌ها…» تغییر دهید…
+	Browser's print dialog	پنجره چاپ مرورگر
+	Copies, two-sided printing and colour are chosen in the browser's print dialog.	تعداد نسخه‌ها، چاپ دوطرفه و رنگ در پنجره چاپ مرورگر انتخاب می‌شوند.
+	Preparing {n} sheets for printing…	آماده‌سازی {n} برگ برای چاپ…
+	Preparing sheet {done} of {total} for printing…	آماده‌سازی برگ {done} از {total} برای چاپ…
+	Opening the browser's print dialog…	باز کردن پنجره چاپ مرورگر…
+	Couldn't print from the browser ({e}); downloaded {name} to print instead	چاپ از مرورگر ممکن نشد ({e})؛ در عوض {name} برای چاپ بار‌گیری شد
+	Tools panel side	سمت پنل ابزار‌ها
+	Add comment	افزودن یادداشت
+	Change tag properties	تغییر ویژگی‌های برچسب
+	Tags panel	پنل برچسب‌ها
+	Tags	برچسب‌ها
+	Tag type	نوع برچسب
+	Actual text	متن واقعی
+	Find a tag	یافتن برچسب
+	Collapse tag	جمع‌کردن برچسب
+	Expand tag	گستردن برچسب
+	Revert changes	باز‌گرداندن تغییرات
+	Save tag properties	ذخیره ویژگی‌های برچسب
+	This document has no editable structure tags.	این سند هیچ برچسب ساختاری قابل ویرایشی ندارد.
+	{n} tags	{n} برچسب
+	Save or revert changes before selecting another tag.	پیش از انتخاب برچسبی دیگر، تغییرات را ذخیره یا باز‌گردانید.
+	Left out: {names}	کنار گذاشته‌شده: {names}
+	already a PDF	از قبل PDF است
+	no unused output name	نام خروجی بدون استفاده موجود نیست
+	no output folder was chosen	هیچ پوشه خروجی انتخاب نشد
+@plural	Downloaded {n} PDF|Downloaded {n} PDFs	{n} PDF بار‌گیری شد|{n} PDF بار‌گیری شد
+@plural	{n} calculation now uses the new name.|{n} calculations now use the new name.	{n} محاسبه اکنون از نام جدید استفاده می‌کند.|{n} محاسبه اکنون از نام جدید استفاده می‌کنند.
+@plural	The calculation order has {n} entry that calculates nothing. Fix order removes it.|The calculation order has {n} entries that calculate nothing. Fix order removes them.	ترتیب محاسبه {n} مورد دارد که چیزی محاسبه نمی‌کند. «اصلاح ترتیب» آن را حذف می‌کند.|ترتیب محاسبه {n} مورد دارد که چیزی محاسبه نمی‌کنند. «اصلاح ترتیب» آن‌ها را حذف می‌کند.
+@plural	{fields} reads it|{fields} read it	{fields} آن را می‌خواند|{fields} آن را می‌خوانند
+@plural	{n} field shows an old value|{n} fields show old values	{n} فیلد مقدار قدیمی نشان می‌دهد|{n} فیلد مقدار‌های قدیمی نشان می‌دهند
+@plural	{field} calculates before {fields}, which it reads.|{field} calculates before {fields}, which it reads.	{field} پیش از {fields} محاسبه می‌شود، در حالی که آن را می‌خواند.|{field} پیش از {fields} محاسبه می‌شود، در حالی که آن‌ها را می‌خواند.
+@plural	{n} more field calculates too early.|{n} more fields calculate too early.	{n} فیلد دیگر زود‌تر از موعد محاسبه می‌شود.|{n} فیلد دیگر زود‌تر از موعد محاسبه می‌شوند.
+@plural	{fields} is missing from the order saved in the PDF, so other PDF viewers may not calculate it.|{fields} are missing from the order saved in the PDF, so other PDF viewers may not calculate them.	{fields} در ترتیب ذخیره‌شده در PDF وجود ندارد، بنابراین سایر نمایشگر‌های PDF ممکن است آن را محاسبه نکنند.|{fields} در ترتیب ذخیره‌شده در PDF وجود ندارند، بنابراین سایر نمایشگر‌های PDF ممکن است آن‌ها را محاسبه نکنند.
+	Scan	اسکن
+	Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper.	روی یک برگ کاغذ سفید امضا کنید و از آن در نور روشن و یکنواخت عکس بگیرید (از فلاش استفاده کنید). عکس را انتخاب کنید یا آن را اینجا رها کنید: PdfCraft امضا را پیدا می‌کند و کاغذ را حذف می‌کند.
+	Choose photo…	انتخاب عکس…
+	No photo chosen	هیچ عکسی انتخاب نشده
+	Photo	عکس
+	Ink sensitivity	حساسیت جوهر
+	No signature was found in the frame. Move the frame over the signature or raise the ink sensitivity.	هیچ امضایی در کادر یافت نشد. کادر را روی امضا ببرید یا حساسیت جوهر را بالا ببرید.
+	Couldn't use the photo: {e}	استفاده از عکس ممکن نشد: {e}
+	Close Tab	بستن زبانه
+	Reopen Closed Tab	باز‌گشایی زبانه بسته‌شده
+	Reveal in Finder	نمایش در Finder
+	Reveal in File Explorer	نمایش در File Explorer
+	Other colour…	رنگ دیگر…
+	Recent colours	رنگ‌های اخیر
+	Reading colours	رنگ‌های خواندن
+	Replace document colours	جای‌گزینی رنگ‌های سند
+	Page background	پس‌زمینه صفحه
+	Only change the colour of black text or line art	فقط رنگ متن سیاه یا طرح‌های خطی را تغییر دهید
+	Change the colour of line art as well as text	رنگ طرح‌های خطی و همچنین متن را تغییر دهید
+	Colours are remapped while rendering; the document itself never changes.	رنگ‌ها هنگام نمایش باز‌تصویر می‌شوند؛ خود سند هرگز تغییر نمی‌کند.
+	Black on white	سیاه روی سفید
+	White on black	سفید روی سیاه
+	Yellow on black	زرد روی سیاه
+	Green on black	سبز روی سیاه
+	Couldn't follow linked PDF: {reason}	پی‌گیری PDF پیوند‌شده ممکن نشد: {reason}
+	The linked PDF opened, but its named destination was not applied.	PDF پیوند‌شده باز شد، اما مقصد نامدار آن اعمال نشد.
+	The linked PDF opened, but its page destination was out of range.	PDF پیوند‌شده باز شد، اما مقصد صفحه آن خارج از محدوده بود.
+	Local cross-PDF links require the desktop app	پیوند‌های محلی میان PDF به کاربردسطح رومیزی نیاز دارند
+	The existing action will be preserved.	کنش موجود حفظ خواهد شد.
+	Cut Image	برش تصویر
+	Redact Image	سیاه‌کردن تصویر
+	Create Link…	ایجاد پیوند…
+	Recognize Text…	تشخیص متن…
+	Minimize	کوچک‌کردن
+	Maximize	بزرگ‌کردن
+	Restore	باز‌گرداندن
+	Use system title bar	استفاده از نوار عنوان سیستم
+	Show a basic title bar for the window buttons instead of the tab strip. GNOME doesn't draw title bars for apps, so this one doesn't follow its theme.	به‌جای نوار زبانه‌ها، یک نوار عنوان ساده برای دکمه‌های پنجره نمایش دهید. GNOME برای برنامه‌ها نوار عنوان نمی‌کشد، بنابراین این یکی از پوسته آن پیروی نمی‌کند.
+	Allow	اجازه دادن
+	Only allow this if you trust the source document.	فقط اگر به سند منبع اعتماد دارید این را اجازه دهید.
+	Open in Full Screen mode?	در حالت تمامصفحه باز شود؟
+	This document asks to open in Full Screen mode: the page fills the screen and nothing else shows. Press Esc at any time to leave it.	این سند درخواست باز شدن در حالت تمام صفحه را دارد: صفحه تمام نمایشگر را پر می‌کند و چیز دی‌گری نمایش داده نمی‌شود. هر زمان برای خروج Esc را فشار دهید.
+	Full Screen	تمامصفحه
+	Not now	اکنون نه
+	Open this local PDF?	این PDF محلی باز شود؟
+	This document is trying to open a local file:	این سند تلاش می‌کند یک فایل محلی را باز کند:
+	Move tag earlier	انتقال برچسب به قبل
+	Move tag later	انتقال برچسب به بعد
+	Turn upside down (180°)	چرخش وارونه (۱۸۰°)
+	4 x 6 in label (101.6 x 152.4 mm)	برچسب 4 x 6 in (101.6 x 152.4 mm)
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	هر صفحه را به ناحیه چاپ شد‌ه اش می‌برد، آن را مستقیم می‌کند و بدون کشیدگی روی برگ جا می‌دهد. یک برچسب در هر برگ.
+	Find untagged content	یافتن محتوای بدون برچسب
+	No untagged content was found.	هیچ محتوای بدون برچسبی یافت نشد.
+	Found {n} untagged content problems.	{n} مشکل محتوای بدون برچسب یافت شد.
+	Tag form fields	برچسب‌گذاری فیلد‌های فرم
+	Mark as artifact	علامت‌گذاری به‌عنوان قطعه
+	Remove this leaf tag from reading order and mark its direct content as an artifact	این برچسب برگ را از ترتیب خواندن حذف کنید و محتوای مستقیم آن را به‌عنوان قطعه علامت‌گذاری کنید
+	Mark content as artifact	علامت‌گذاری محتوا به‌عنوان قطعه
+	Word count	شمارش واژه‌ها
+	Current page only	فقط صفحه کنونی
+	Exclude tagged tables	کنار گذاشتن جدول‌های برچسبدار
+	Exclude tagged code blocks	کنار گذاشتن بلوک‌های کد برچسبدار
+	Exclude image/OCR text	کنار گذاشتن متن تصویر/OCR
+	Exclusions use PDF tags. Untagged tables and code remain included. Image exclusion also removes invisible text.	کنارگذاشتن‌ها از برچسب‌های PDF استفاده می‌کنند. جدول‌ها و کد‌های بدون برچسب همچنان شامل می‌شوند. کنار گذاشتن تصویر متن نامرئی را نیز حذف می‌کند.
+	Words	واژه‌ها
+	Characters	نویسه‌ها
+	Characters without spaces	نویسه‌ها بدون فاصله
+	Pages counted	صفحه‌های شمرده‌شده
+	Some pages contain no countable text. Scanned images need OCR first.	برخی صفحه‌ها هیچ متن قابل شمارشی ندارند. تصویر‌های اسک‌ن شده نخست به OCR نیاز دارند.
+	Some content could not be classified safely and was kept in the count.	برخی محتوا به‌طور ایمن طبقه‌بندی نشد و در شمارش نگه داشته شد.
+	Counting words… {n} pages read	شمارش واژه‌ها… {n} صفحه خوانده شد
+	Word counting stopped unexpectedly.	شمارش واژه‌ها به‌طور غیر‌منتظره متوقف شد.
+	Word count…	شمارش واژه‌ها…
+	Collapse all tools	جمع‌کردن همه ابزارها
+	Expand all tools	گسترش همه ابزارها
+	Create & Edit	ایجاد و ویرایش
+	Customize & Automate	شخصی‌سازی و خودکارسازی
+	Forms & Signatures	فرم‌ها و امضاها
+	Protect & Standardize	محافظت و استانداردسازی
+	Review & Compare	بازبینی و مقایسه
+	No tools match your search.	هیچ ابزاری با جست‌وجوی شما مطابقت ندارد.
+@plural	{n} reply|{n} replies	{n} پاسخ|{n} پاسخ
+@id	file.word_count	شمارش واژه‌ها…
+	Standard	استاندارد
+	Mobile	موبایل
+	Merge image fragments	ادغام قطعه‌های تصویر
+	Optimizing… merging image fragments	بهینه‌سازی… ادغام قطعه‌های تصویر
+	Side by side	کنار هم
+	New file only	فقط فایل جدید
+	Old file: {name}	فایل قدیمی: {name}
+	New file: {name}	فایل جدید: {name}
+	Print as image	چاپ به‌صورت تصویر
+	Resolution:	تفکیک‌پذیری:
+	Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey.	زمانی از آن استفاده کنید که چاپگر متن، سایه یا شفافیت را نادیده می‌گیرد. چاپ دیگر متن قابل جستوجو نیست؛ با «چاپ در مقیاس خاکستری»، تصاویر خاکستری می‌شوند.
+	Crop Image	برش تصویر
+	Remove Crop	حذف برش
+	Trim the picture with its handles; Enter or Done applies	تصویر را با دستگیره‌هایش برش دهید؛ Enter یا «انجام شد» آن را اعمال می‌کند
+	Redaction mark appearance	ظاهر نشانه سیاه‌کردن
+	Outline colour:	رنگ خط دور:
+	Fill colour:	رنگ پر‌کردن:
+	Shown while the pointer is over a mark.	زمانی که اشاره گر روی یک نشانه است نمایش داده می‌شود.
+	Opacity:	کدری:
+	Make properties default	ویژگی‌ها را پیش‌فرض کن
+	Pages selected	صفحه‌های انتخاب‌شده
+	Page properties	ویژگی‌های صفحه
+	Font	قلم
+	Bulleted list	فهرست نشانهدار
+	Numbered list	فهرست شمارهدار
+	Alignment	هم‌ترازی
+	Superscript	بالانویس
+	Subscript	زیرنویس
+	Paragraph spacing	فاصله بند‌ها
+	Less	کمتر
+	Other options	گزینه‌های دیگر
+	You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original.	شما در حال مشاهده نسخه امضا‌شده «{from}» (باز‌نگری {rev}) هستید. این یک تصویر لحظ‌های است: تغییرات اینجا بر نسخه اصلی اثر نمی‌گذارد.
+	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.	شما در حال مشاهده باز‌نگری {rev} از «{from}» هستید. این یک تصویر لحظ‌های است: تغییرات اینجا بر نسخه اصلی اثر نمی‌گذارد.
+	Attach a file…	پیوست یک فایل…
+	Delete attachment	حذف پیوست
+	Attaching files is not available on the web yet	پیوست‌کردن فایل‌ها هنوز در وب در دسترس نیست
+	Attach {name}	پیوست {name}
+	Delete attachment {key}	حذف پیوست {key}
+	Thumbnail size	اندازه بندانگشتی‌ها
+	Smaller thumbnails	بندانگشتی‌های کوچک‌تر
+	Larger thumbnails	بندانگشتی‌های بزرگ‌تر
+	Reshape comment	تغییر شکل یادداشت
+calendar date	January	ژانویه
+calendar date	February	فوریه
+calendar date	March	مارس
+calendar date	April	آوریل
+calendar date	May	مه
+calendar date	June	ژوئن
+calendar date	July	ژوئیه
+calendar date	August	اوت
+calendar date	September	سپتامبر
+calendar date	October	اکتبر
+calendar date	November	نوامبر
+calendar date	December	دسامبر
+calendar weekday	Mo	دو
+calendar weekday	Tu	سه
+calendar weekday	We	چه
+calendar weekday	Th	پن
+calendar weekday	Fr	جم
+calendar weekday	Sa	شن
+calendar weekday	Su	یک
+certificate	Issued to	صادر‌شده برای
+certificate	Issued by	صادر‌شده توسط
+certificate	Issuer	صادر‌کننده
+certificate	Serial number	شماره سریال
+certificate	Version	نگارش
+certificate	Public key	کلید عمومی
+certificate	Key usage	کاربرد کلید
+certificate	Intended usage	کاربرد موردنظر
+certificate	Basic constraints	محدودیت‌های پایه
+certificate	Self-signed	خودامضا
+certificate	Valid from	معتبر از
+certificate	Valid to	معتبر تا
+certificate	Validity starts	آغاز اعتبار
+certificate	Validity ends	پایان اعتبار
+certificate	SHA-1 digest	چکیده SHA-1
+certificate	SHA-256 digest	چکیده SHA-256
+	Digital Signature	امضای دیجیتال
+	Non-Repudiation	انکارنا‌پذیری
+	Key Encipherment	رمز‌گذاری کلید
+	Data Encipherment	رمز‌گذاری داده
+	Key Agreement	توافق کلید
+	Certificate Signing	امضای گواهی
+	CRL Signing	امضای CRL
+	Encipher Only	فقط رمز‌گذاری
+	Decipher Only	فقط رمزگشایی
+	{who}, certificate issued by {issuer}.	{who}، گواهی صادر‌شده توسط {issuer}.
+	{who}, certificate issued by an unknown issuer.	{who}، گواهی صادر‌شده توسط صادرکنند‌های ناشناخته.
+	Rev. {rev}: Signed by {name}	باز‌نگری {rev}: امضا‌شده توسط {name}
+	Rev. {rev}: Signed by an unknown signer	باز‌نگری {rev}: امضا‌شده توسط امضاکنند‌های ناشناخته
+	Rev. {rev}: Certified by {name}	باز‌نگری {rev}: گواهی‌شده توسط {name}
+	Rev. {rev}: Certified by an unknown signer	باز‌نگری {rev}: گواهی‌شده توسط امضاکنند‌های ناشناخته
+	Unsigned signature field: {name}	فیلد امضای بدون امضا: {name}
+	Choose a digital ID.	یک شناسه دیجیتال انتخاب کنید.
+	There is no folder to save the digital ID in.	هیچ پوش‌های برای ذخیره شناسه دیجیتال وجود ندارد.
+	The password is incorrect.	گذرواژه نادرست است.
+	The password must have at least 6 characters.	گذرواژه باید دستکم ۶ نویسه داشته باشد.
+	The password must have at least 8 characters.	گذرواژه باید دستکم ۸ نویسه داشته باشد.
+	The passwords do not match.	گذرواژه‌ها یکسان نیستند.
+	Only the document's owner can change its security (open it with the permissions password)	فقط مالک سند می‌تواند امنیت آن را تغییر دهد (آن را با گذرواژه مجوز‌ها باز کنید)
+@plural	{n} byte|{n} bytes	{n} بایت|{n} بایت
+@plural	{n} pixel|{n} pixels	{n} پیکسل|{n} پیکسل
+@plural	{n} file|{n} files	{n} فایل|{n} فایل
+@plural	{n} comment|{n} comments	{n} یادداشت|{n} یادداشت
+@plural	{n} result|{n} results	{n} نتیجه|{n} نتیجه
+@plural	{n} image optimized|{n} images optimized	{n} تصویر بهینه شد|{n} تصویر بهینه شد
+@plural	{n} item discarded|{n} items discarded	{n} مورد کنار گذاشته شد|{n} مورد کنار گذاشته شد
+@plural	Delete {n} field|Delete {n} fields	حذف {n} فیلد|حذف {n} فیلد
+	Add the PDFs to combine	PDFهایی را که می‌خواهید ادغام کنید اضافه کنید
+	Drop PDFs or folders here, or choose them.	PDFها یا پوشه‌ها را اینجا رها کنید، یا آن‌ها را انتخاب کنید.
+	Every PDF in the folder	هر PDF درون پوشه
+	Every PDF in the folder and the folders inside it	هر PDF درون پوشه و پوشه‌های داخل آن
+	Added the first {n} PDFs in {folder}	نخستین {n} PDF در {folder} افزوده شد
+	No PDFs found in {folder}	هیچ PDFی در {folder} یافت نشد
+	Panel layout could not be restored: {error}	چیدمان پنل باز‌گردانده نشد: {error}
+	Panel move was not applied: {error}	جابه‌جایی پنل اعمال نشد: {error}
+	Rendering…	در حال نمایش…
+	Still rendering — this page is unusually complex…	هنوز در حال نمایش — این صفحه به‌طور غیر‌معمول پیچیده است…
+	Loading…	در حال بار‌گذاری…
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	این فایل روی دیسک تغییر کرده است. برای دیدن نسخه جدید آن را دوباره بار‌گذاری کنید؛ تغییرات ذخیره‌نشده شما از دست خواهد رفت.
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	تشخیص متن نصب نشده است: مدل‌های آن وجود ندارند (`cargo xtask models` را اجرا کنید یا PDFCRAFT_MODELS را تنظیم کنید).
+	Cut and stack needs Two-sided: Off. Print single-sided sheets.	برش و چیدن به «دوطرفه: خاموش» نیاز دارد. برگ‌ها را یکرو چاپ کنید.
+	Error	خطا
+	Warning	هشدار
+	Information	اطلاعات
+	Success	موفق
+	Enter a name.	نامی وارد کنید.
+	Enter a page number	شماره صفحه وارد کنید
+	Enter a URL	نشانی URL وارد کنید
+	Enter the field names	نام فیلد‌ها را وارد کنید
+	Choose…	انتخاب…
+	Choose a file…	انتخاب یک فایل…
+	Choose a folder…	انتخاب یک پوشه…
+	Create folder	ایجاد پوشه
+	Open folder	باز کردن پوشه
+	Save file	ذخیره فایل
+	Save changes?	تغییرات ذخیره شود؟
+	Theme	پوسته
+theme	Appearance	ظاهر
+	System	سیستم
+	English	انگلیسی
+	Always	همیشه
+	Never	هرگز
+	Automatically	به‌طور خودکار
+	On	روشن
+	Enabled	فعال
+	Disabled	غیر‌فعال
+	Mouse wheel scroll speed	سرعت پیمایش چرخ ماوس
+	Margins (in)	حاشیه‌ها (in)
+	Color	رنگ
+	Folder	پوشه
+	Comment	یادداشت
+	Comment and review	یادداشت و باز‌بینی
+	Creator	سازنده
+	Producer	تولید‌کننده
+	Organize	سازمان‌دهی
+	Import	درون‌ریزی
+	Move	جابه‌جایی
+	Duplicate	تکثیر
+	Paste	جای‌گذاری
+	Select all	انتخاب همه
+	Refresh	تازه‌سازی
+	Next	بعدی
+	Previous	قبلی
+	of	از
+	No results	بدون نتیجه
+	Search results	نتایج جستوجو
+	Copy to clipboard	رونوشت در بریدهدان
+	Copied to clipboard	در بریده دان رونوشت شد
+	Help…	راهنما…
+	 on page {label}	 در صفحه {label}
+	Page {n}	صفحه {n}
+	Page {n} of {total}	صفحه {n} از {total}
+	Open a PDF (⌘O)	باز کردن یک PDF (⌘O)
+	Print (⌘P)	چاپ (⌘P)
+	Document properties (⌘D)	ویژگی‌های سند (⌘D)
+	New bookmark (⌘B)	نشانک جدید (⌘B)
+	Next (⌘G)	بعدی (⌘G)
+	Previous (⇧⌘G)	قبلی (⇧⌘G)
+	Zoom in (⌘+)	بزرگنمایی (⌘+)
+	Zoom out (⌘−)	کوچکنمایی (⌘−)
+	Zoom in / out (also pinch or ⌘-scroll)	بزرگنمایی / کوچکنمایی (همچنین با دو انگشت یا ⌘ + پیمایش)
+	Rotate view clockwise (⇧⌘+)	چرخش نما در جهت عقربه‌های ساعت (⇧⌘+)
+	Save (M4)	ذخیره (M4)
+	Add text field table	افزودن جدول فیلد‌های متنی
+	Text field table	جدول فیلد‌های متنی
+	Text Field Table	جدول فیلد‌های متنی
+	Columns	ستون‌ها
+	Row spacing	فاصله سطر‌ها
+	Column spacing	فاصله ستون‌ها
+	First row number	شماره نخستین سطر
+	Column widths	پهنای ستون‌ها
+	Distribute evenly	تقسیم یکنواخت
+	Field names	نام فیلد‌ها
+	N or {row} is the row number, {col} the column number, {seq} the cell number. With none of them, the row number goes last.	N یا {row} شماره سطر است، {col} شماره ستون و {seq} شماره خانه. اگر هیچکدام نباشد، شماره سطر در آخر می‌آید.
+	Column {n}	ستون {n}
+	Add fields	افزودن فیلد‌ها
+	a table has 1 to {max} rows	یک جدول از ۱ تا {max} سطر دارد
+	a table has 1 to {max} columns	یک جدول از ۱ تا {max} ستون دارد
+	the first row number can be at most {max}	شماره نخستین سطر حداکثر می‌تواند {max} باشد
+	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	ناحیه، فاصله و پهنای ستون‌ها باید عدد باشند، فاصله ۰ یا بیشتر و هر پهنا بیشتر از ۰
+	the rows are too short: make the area taller, or use fewer rows or less row spacing	سطر‌ها بیش از حد کوتاه اند: ناحیه را بلند‌تر کنید، یا سطر‌های کمتر یا فاصله سطر کمتری به کار ببرید
+	a column is too narrow: make the area wider, give the column more of it, or use fewer columns or less column spacing	یک ستون بیش از حد باریک است: ناحیه را پهن‌تر کنید، سهم بیشتری به ستون بدهید، یا ستون‌های کمتر یا فاصله ستون کمتری به کار ببرید
+	field names can't contain a period: {name}	نام فیلد‌ها نمی‌تواند شامل نقطه باشد: {name}
+	two cells would both be named {name}	دو خانه هر دو با نام {name} نام‌گذاری می‌شوند
+	a field named {name} already exists	فیلدی با نام {name} از قبل وجود دارد
+	Today	امروز
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index cdda3c89f3..a542ee9b91 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -178,6 +178,15 @@
 	Available	Käytettävissä
 	Ready	Valmis
 	Search tools and commands…	Hae työkaluja ja komentoja…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Lisätty teksti
+	Link URL	Linkin URL-osoite
+	Search tools and commands	Hae työkaluja ja komentoja
+	Text editing line	Tekstin muokkausrivi
+	Text to place	Sijoitettava teksti
+	Tooltip	Työkaluvihje
+	Words or phrases to redact	Peitettävät sanat tai lauseet
 	No matching tools	Ei vastaavia työkaluja
 	Tool	Työkalu
 	Command	Komento
@@ -2698,6 +2707,14 @@ certificate	SHA-256 digest	SHA-256-tiiviste
 	Make properties default	Aseta ominaisuudet oletuksiksi
 	Pages selected	Valitut sivut
 	Page properties	Sivun ominaisuudet
+	Create & Edit	Luo ja muokkaa
+	Review & Compare	Tarkasta ja vertaa
+	Forms & Signatures	Lomakkeet ja allekirjoitukset
+	Protect & Standardize	Suojaa ja standardoi
+	Customize & Automate	Mukauta ja automatisoi
+	No tools match your search.	Hakuasi vastaavia työkaluja ei löytynyt.
+	Expand all tools	Laajenna kaikki työkalut
+	Collapse all tools	Kutista kaikki työkalut
 	The password must have at least 8 characters.	Salasanassa on oltava vähintään 8 merkkiä.
 theme	Appearance	Teema
 # Labels added upstream 2026-10-16…18.
@@ -2801,3 +2818,12 @@ theme	Appearance	Teema
 	Attaching files is not available on the web yet	Tiedostojen liittäminen ei ole vielä käytettävissä verkossa
 	Delete attachment	Poista liite
 	Delete attachment {key}	Poista liite {key}
+@plural	{n} reply|{n} replies	{n} vastaus|{n} vastausta
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Sivutyökalut
+	Insert pages from a file after the selection…	Lisää sivuja tiedostosta valinnan jälkeen…
+	Rotate the selected pages counterclockwise	Kierrä valittuja sivuja vastapäivään
+	Rotate the selected pages clockwise	Kierrä valittuja sivuja myötäpäivään
+	Extract the selected pages…	Pura valitut sivut…
+	Delete the selected pages	Poista valitut sivut
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 5e885dbbcd..61c8b5171d 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -157,6 +157,15 @@
 	Available	Disponible
 	Ready	Prêt
 	Search tools and commands…	Rechercher des outils et des commandes…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Texte ajouté
+	Link URL	URL du lien
+	Search tools and commands	Rechercher des outils et des commandes
+	Text editing line	Ligne de modification du texte
+	Text to place	Texte à placer
+	Tooltip	Info-bulle
+	Words or phrases to redact	Mots ou expressions à biffer
 	No matching tools	Aucun outil correspondant
 	Tool	Outil
 	Command	Commande
@@ -2489,6 +2498,14 @@ animation effects	Off	Désactivés
 	Make properties default	Définir comme propriétés par défaut
 	Pages selected	Pages sélectionnées
 	Page properties	Propriétés de la page
+	Create & Edit	Créer et modifier
+	Review & Compare	Réviser et comparer
+	Forms & Signatures	Formulaires et signatures
+	Protect & Standardize	Protéger et normaliser
+	Customize & Automate	Personnaliser et automatiser
+	No tools match your search.	Aucun outil ne correspond à votre recherche.
+	Expand all tools	Développer tous les outils
+	Collapse all tools	Réduire tous les outils
 	Attach a file…	Joindre un fichier…
 	Delete attachment	Supprimer la pièce jointe
 	Attaching files is not available on the web yet	Joindre des fichiers n'est pas encore disponible sur le web
@@ -2797,3 +2814,12 @@ certificate	Version	Version
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Aujourd'hui
+@plural	{n} reply|{n} replies	{n} réponse|{n} réponses
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Outils de page
+	Insert pages from a file after the selection…	Insérer des pages d'un fichier après la sélection…
+	Rotate the selected pages counterclockwise	Faire pivoter les pages sélectionnées dans le sens antihoraire
+	Rotate the selected pages clockwise	Faire pivoter les pages sélectionnées dans le sens horaire
+	Extract the selected pages…	Extraire les pages sélectionnées…
+	Delete the selected pages	Supprimer les pages sélectionnées
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index d33655bcd3..e9d627aca9 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -162,6 +162,15 @@
 	Available	उपलब्ध
 	Ready	तैयार
 	Search tools and commands…	टूल और कमांड खोजें…
+
+# Accessible names for inputs that have no visible label.
+	Added text	जोड़ा गया टेक्स्ट
+	Link URL	लिंक का URL
+	Search tools and commands	टूल और कमांड खोजें
+	Text editing line	टेक्स्ट संपादन पंक्ति
+	Text to place	रखने के लिए टेक्स्ट
+	Tooltip	टूलटिप
+	Words or phrases to redact	रेडैक्ट करने के लिए शब्द या वाक्यांश
 	No matching tools	कोई मेल खाता टूल नहीं
 	Tool	टूल
 	Command	कमांड
@@ -2682,6 +2691,14 @@ certificate	SHA-256 digest	SHA-256 डाइजेस्ट
 	Make properties default	गुण डिफ़ॉल्ट बनाएँ
 	Pages selected	चयनित पृष्ठ
 	Page properties	पृष्ठ गुण
+	Create & Edit	बनाएँ और संपादित करें
+	Review & Compare	समीक्षा और तुलना करें
+	Forms & Signatures	फ़ॉर्म और हस्ताक्षर
+	Protect & Standardize	सुरक्षित और मानकीकृत करें
+	Customize & Automate	अनुकूलित और स्वचालित करें
+	No tools match your search.	आपकी खोज से कोई टूल मेल नहीं खाता।
+	Expand all tools	सभी टूल विस्तृत करें
+	Collapse all tools	सभी टूल समेटें
 	The password must have at least 8 characters.	पासवर्ड में कम से कम 8 वर्ण होने चाहिए।
 theme	Appearance	स्वरूप
 	Zoom — type a percentage and press Enter	ज़ूम — प्रतिशत टाइप करें और Enter दबाएँ
@@ -2768,3 +2785,12 @@ theme	Appearance	स्वरूप
 	Attaching files is not available on the web yet	वेब पर अभी फ़ाइलें संलग्न करना उपलब्ध नहीं है
 	Delete attachment	अनुलग्नक हटाएँ
 	Delete attachment {key}	अनुलग्नक {key} हटाएँ
+@plural	{n} reply|{n} replies	{n} जवाब
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	पृष्ठ उपकरण
+	Insert pages from a file after the selection…	चयन के बाद किसी फ़ाइल से पृष्ठ डालें…
+	Rotate the selected pages counterclockwise	चयनित पृष्ठों को वामावर्त घुमाएँ
+	Rotate the selected pages clockwise	चयनित पृष्ठों को दक्षिणावर्त घुमाएँ
+	Extract the selected pages…	चयनित पृष्ठ निकालें…
+	Delete the selected pages	चयनित पृष्ठ हटाएँ
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 07c0ee69cc..6b37b9169b 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -155,6 +155,15 @@
 	Available	Elérhető
 	Ready	Kész
 	Search tools and commands…	Eszközök és parancsok keresése…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Hozzáadott szöveg
+	Link URL	Hivatkozás URL-je
+	Search tools and commands	Eszközök és parancsok keresése
+	Text editing line	Szövegszerkesztő sor
+	Text to place	Elhelyezendő szöveg
+	Tooltip	Elemleírás
+	Words or phrases to redact	Kitakarni kívánt szavak vagy kifejezések
 	No matching tools	Nincs illeszkedő eszköz
 	Tool	Eszköz
 	Command	Parancs
@@ -2488,6 +2497,14 @@ animation effects	Off	Ki
 	Make properties default	Tulajdonságok beállítása alapértelmezettként
 	Pages selected	Kijelölt oldalak
 	Page properties	Oldaltulajdonságok
+	Create & Edit	Létrehozás és szerkesztés
+	Review & Compare	Áttekintés és összehasonlítás
+	Forms & Signatures	Űrlapok és aláírások
+	Protect & Standardize	Védelem és szabványosítás
+	Customize & Automate	Testreszabás és automatizálás
+	No tools match your search.	Egy eszköz sem felel meg a keresésnek.
+	Expand all tools	Az összes eszköz kibontása
+	Collapse all tools	Az összes eszköz összecsukása
 	Attach a file…	Fájl csatolása…
 	Delete attachment	Melléklet törlése
 	Attaching files is not available on the web yet	Fájlok csatolása a weben még nem érhető el
@@ -2530,3 +2547,12 @@ animation effects	Off	Ki
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Ma
+@plural	{n} reply|{n} replies	{n} válasz|{n} válasz
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Oldaleszközök
+	Insert pages from a file after the selection…	Oldalak beszúrása fájlból a kijelölés után…
+	Rotate the selected pages counterclockwise	A kijelölt oldalak forgatása az óramutató járásával ellentétesen
+	Rotate the selected pages clockwise	A kijelölt oldalak forgatása az óramutató járásával megegyezően
+	Extract the selected pages…	A kijelölt oldalak kibontása…
+	Delete the selected pages	A kijelölt oldalak törlése
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index e6542e4ca4..292b336e10 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -1011,6 +1011,15 @@
 	Scroll tabs right	Gulir tab ke kanan
 	Search comments	Cari komentar
 	Search tools and commands…	Cari alat dan perintah…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Teks yang ditambahkan
+	Link URL	URL tautan
+	Search tools and commands	Cari alat dan perintah
+	Text editing line	Baris penyuntingan teks
+	Text to place	Teks yang akan ditempatkan
+	Tooltip	Tooltip
+	Words or phrases to redact	Kata atau frasa untuk disensor
 	Searchable Image (Exact)	Gambar yang Dapat Dicari (Tepat)
 	Searching… {s} of {p} pages	Mencari… {s} dari {p} halaman
 	Searching… {s}/{p}	Mencari… {s}/{p}
@@ -2683,6 +2692,14 @@ key	Space	Space
 	Make properties default	Jadikan properti default
 	Pages selected	Halaman yang dipilih
 	Page properties	Properti halaman
+	Create & Edit	Buat & Edit
+	Review & Compare	Tinjau & Bandingkan
+	Forms & Signatures	Formulir & Tanda Tangan
+	Protect & Standardize	Lindungi & Standarkan
+	Customize & Automate	Sesuaikan & Otomatiskan
+	No tools match your search.	Tidak ada alat yang cocok dengan pencarian Anda.
+	Expand all tools	Perluas semua alat
+	Collapse all tools	Ciutkan semua alat
 	The password must have at least 8 characters.	Kata sandi harus memiliki minimal 8 karakter.
 theme	Appearance	Tampilan
 	Zoom — type a percentage and press Enter	Zoom — ketik persentase dan tekan Enter
@@ -2769,3 +2786,12 @@ theme	Appearance	Tampilan
 	Attaching files is not available on the web yet	Melampirkan file belum tersedia di web
 	Delete attachment	Hapus lampiran
 	Delete attachment {key}	Hapus lampiran {key}
+@plural	{n} reply|{n} replies	{n} balasan
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Alat halaman
+	Insert pages from a file after the selection…	Sisipkan halaman dari file setelah pilihan…
+	Rotate the selected pages counterclockwise	Putar halaman yang dipilih berlawanan arah jarum jam
+	Rotate the selected pages clockwise	Putar halaman yang dipilih searah jarum jam
+	Extract the selected pages…	Ekstrak halaman yang dipilih…
+	Delete the selected pages	Hapus halaman yang dipilih
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 726407ccf6..20729bae6a 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -181,6 +181,15 @@
 	Available	Disponibile
 	Ready	Pronto
 	Search tools and commands…	Cerca strumenti e comandi…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Testo aggiunto
+	Link URL	URL del collegamento
+	Search tools and commands	Cerca strumenti e comandi
+	Text editing line	Riga di modifica del testo
+	Text to place	Testo da posizionare
+	Tooltip	Descrizione comando
+	Words or phrases to redact	Parole o frasi da oscurare
 	No matching tools	Nessuno strumento corrispondente
 	Tool	Strumento
 	Command	Comando
@@ -2701,6 +2710,14 @@ certificate	Key usage	Utilizzo chiave
 certificate	Self-signed	Autofirmato
 certificate	SHA-1 digest	Impronta SHA-1
 certificate	SHA-256 digest	Impronta SHA-256
+	Create & Edit	Crea e modifica
+	Review & Compare	Revisione e confronto
+	Forms & Signatures	Moduli e firme
+	Protect & Standardize	Proteggi e standardizza
+	Customize & Automate	Personalizza e automatizza
+	No tools match your search.	Nessuno strumento corrisponde alla ricerca.
+	Expand all tools	Espandi tutti gli strumenti
+	Collapse all tools	Comprimi tutti gli strumenti
 	Attach a file…	Allega un file…
 	Delete attachment	Elimina allegato
 	Attaching files is not available on the web yet	Allegare file non è ancora disponibile sul web
@@ -2763,3 +2780,12 @@ certificate	SHA-256 digest	Impronta SHA-256
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Oggi
+@plural	{n} reply|{n} replies	{n} risposta|{n} risposte
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Strumenti pagina
+	Insert pages from a file after the selection…	Inserisci pagine da un file dopo la selezione…
+	Rotate the selected pages counterclockwise	Ruota le pagine selezionate in senso antiorario
+	Rotate the selected pages clockwise	Ruota le pagine selezionate in senso orario
+	Extract the selected pages…	Estrai le pagine selezionate…
+	Delete the selected pages	Elimina le pagine selezionate
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index dd6dcf0d92..1ed4d43b6c 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -184,6 +184,15 @@
 	Available	使用可能
 	Ready	使用可能
 	Search tools and commands…	ツールとコマンドを検索…
+
+# Accessible names for inputs that have no visible label.
+	Added text	追加したテキスト
+	Link URL	リンクの URL
+	Search tools and commands	ツールとコマンドを検索
+	Text editing line	テキスト編集行
+	Text to place	配置するテキスト
+	Tooltip	ツールチップ
+	Words or phrases to redact	墨消しする単語または語句
 	No matching tools	該当するツールがありません
 	Tool	ツール
 	Command	コマンド
@@ -2489,6 +2498,14 @@ animation effects	Off	オフ
 	Make properties default	プロパティをデフォルトに設定
 	Pages selected	選択したページ
 	Page properties	ページのプロパティ
+	Create & Edit	作成と編集
+	Review & Compare	レビューと比較
+	Forms & Signatures	フォームと署名
+	Protect & Standardize	保護と標準化
+	Customize & Automate	カスタマイズと自動化
+	No tools match your search.	検索に一致するツールはありません。
+	Expand all tools	すべてのツールを展開
+	Collapse all tools	すべてのツールを折りたたむ
 	Attach a file…	ファイルを添付…
 	Delete attachment	添付ファイルを削除
 	Attaching files is not available on the web yet	Web 版ではまだファイルを添付できません
@@ -2531,3 +2548,12 @@ animation effects	Off	オフ
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今日
+@plural	{n} reply|{n} replies	{n} 件の返信
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	ページツール
+	Insert pages from a file after the selection…	選択範囲の後にファイルからページを挿入…
+	Rotate the selected pages counterclockwise	選択したページを反時計回りに回転
+	Rotate the selected pages clockwise	選択したページを時計回りに回転
+	Extract the selected pages…	選択したページを抽出…
+	Delete the selected pages	選択したページを削除
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 53ba3699e2..9022c3591c 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -145,6 +145,15 @@
 	Available	Қолжетімді
 	Ready	Дайын
 	Search tools and commands…	Құралдар мен командаларды іздеу…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Қосылған мәтін
+	Link URL	Сілтеменің URL мекенжайы
+	Search tools and commands	Құралдар мен командаларды іздеу
+	Text editing line	Мәтінді өңдеу жолы
+	Text to place	Орналастырылатын мәтін
+	Tooltip	Қалтқы
+	Words or phrases to redact	Жасырылатын сөздер немесе сөз тіркестері
 	No matching tools	Сәйкес құралдар жоқ
 	Tool	Құрал
 	Command	Команда
@@ -2487,6 +2496,14 @@ animation effects	Off	Өшірулі
 	Make properties default	Қасиеттерді әдепкі ету
 	Pages selected	Таңдалған беттер
 	Page properties	Бет қасиеттері
+	Create & Edit	Жасау және өңдеу
+	Review & Compare	Шолу және салыстыру
+	Forms & Signatures	Пішіндер және қолтаңбалар
+	Protect & Standardize	Қорғау және стандарттау
+	Customize & Automate	Баптау және автоматтандыру
+	No tools match your search.	Іздеуге сәйкес құралдар жоқ.
+	Expand all tools	Барлық құралдарды жаю
+	Collapse all tools	Барлық құралдарды жию
 	Attach a file…	Файл тіркеу…
 	Delete attachment	Тіркемені жою
 	Attaching files is not available on the web yet	Вебте файл тіркеу әзірге қолжетімсіз
@@ -2529,3 +2546,12 @@ animation effects	Off	Өшірулі
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Бүгін
+@plural	{n} reply|{n} replies	{n} жауап|{n} жауап
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Бет құралдары
+	Insert pages from a file after the selection…	Таңдаудан кейін файлдан беттер кірістіру…
+	Rotate the selected pages counterclockwise	Таңдалған беттерді сағат тіліне қарсы бұру
+	Rotate the selected pages clockwise	Таңдалған беттерді сағат тілімен бұру
+	Extract the selected pages…	Таңдалған беттерді шығарып алу…
+	Delete the selected pages	Таңдалған беттерді жою
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index ba4821101a..09b9cad9fa 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -162,6 +162,15 @@
 	Available	사용 가능
 	Ready	준비됨
 	Search tools and commands…	도구 및 명령 검색…
+
+# Accessible names for inputs that have no visible label.
+	Added text	추가한 텍스트
+	Link URL	링크 URL
+	Search tools and commands	도구 및 명령 검색
+	Text editing line	텍스트 편집 줄
+	Text to place	배치할 텍스트
+	Tooltip	도구 설명
+	Words or phrases to redact	민감 정보를 제거할 단어 또는 구문
 	No matching tools	일치하는 도구가 없습니다
 	Tool	도구
 	Command	명령
@@ -2682,6 +2691,14 @@ certificate	SHA-256 digest	SHA-256 다이제스트
 	Make properties default	속성을 기본값으로 설정
 	Pages selected	선택한 페이지
 	Page properties	페이지 속성
+	Create & Edit	만들기 및 편집
+	Review & Compare	검토 및 비교
+	Forms & Signatures	양식 및 서명
+	Protect & Standardize	보호 및 표준화
+	Customize & Automate	사용자 지정 및 자동화
+	No tools match your search.	검색과 일치하는 도구가 없습니다.
+	Expand all tools	모든 도구 펼치기
+	Collapse all tools	모든 도구 접기
 	The password must have at least 8 characters.	암호는 8자 이상이어야 합니다.
 theme	Appearance	모양
 	Zoom — type a percentage and press Enter	줌 — 백분율을 입력하고 Enter를 누르세요
@@ -2768,3 +2785,12 @@ theme	Appearance	모양
 	Attaching files is not available on the web yet	웹에서는 아직 파일을 첨부할 수 없습니다
 	Delete attachment	첨부 파일 삭제
 	Delete attachment {key}	첨부 파일 {key} 삭제
+@plural	{n} reply|{n} replies	답글 {n}개
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	페이지 도구
+	Insert pages from a file after the selection…	선택 영역 뒤에 파일에서 페이지 삽입…
+	Rotate the selected pages counterclockwise	선택한 페이지를 시계 반대 방향으로 회전
+	Rotate the selected pages clockwise	선택한 페이지를 시계 방향으로 회전
+	Extract the selected pages…	선택한 페이지 추출…
+	Delete the selected pages	선택한 페이지 삭제
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 0084cdc2fe..964467d823 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -182,6 +182,15 @@
 	Available	ພ້ອມໃຊ້ງານ
 	Ready	ພ້ອມແລ້ວ
 	Search tools and commands…	ຄົ້ນຫາເຄື່ອງມື ແລະ ຄຳສັ່ງ…
+
+# Accessible names for inputs that have no visible label.
+	Added text	ຂໍ້ຄວາມທີ່ເພີ່ມ
+	Link URL	URL ຂອງລິ້ງຄ໌
+	Search tools and commands	ຄົ້ນຫາເຄື່ອງມື ແລະ ຄຳສັ່ງ
+	Text editing line	ແຖວແກ້ໄຂຂໍ້ຄວາມ
+	Text to place	ຂໍ້ຄວາມທີ່ຈະວາງ
+	Tooltip	ຄຳແນະນຳເຄື່ອງມື
+	Words or phrases to redact	ຄຳ ຫຼື ວະລີທີ່ຈະປິດບັງ
 	No matching tools	ບໍ່ພົບເຄື່ອງມືທີ່ກົງກັນ
 	Tool	ເຄື່ອງມື
 	Command	ຄຳສັ່ງ
@@ -2436,6 +2445,23 @@ animation effects	Off	ປິດ
 	Make properties default	ກຳນົດຄຸນສົມບັດເປັນຄ່າເລີ່ມຕົ້ນ
 	Pages selected	ໜ້າທີ່ເລືອກ
 	Page properties	ຄຸນສົມບັດໜ້າ
+	Create & Edit	ສ້າງ & ແກ້ໄຂ
+	Review & Compare	ກວດກາຄືນ & ປຽບທຽບ
+	Forms & Signatures	ຟອມ & ລາຍເຊັນ
+	Protect & Standardize	ປ້ອງກັນ & ມາດຕະຖານ
+	Customize & Automate	ປັບແຕ່ງ & ອັດຕະໂນມັດ
+	No tools match your search.	ບໍ່ມີເຄື່ອງມືທີ່ກົງກັບການຄົ້ນຫາຂອງທ່ານ.
+	Expand all tools	ຂະຫຍາຍເຄື່ອງມືທັງໝົດ
+	Collapse all tools	ຫຍໍ້ເຄື່ອງມືທັງໝົດເຂົ້າ
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	ມື້ນີ້
+@plural	{n} reply|{n} replies	ການຕອບກັບ {n} ລາຍການ
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	ເຄື່ອງມືໜ້າ
+	Insert pages from a file after the selection…	ແຊກໜ້າຈາກໄຟລ໌ຫຼັງການເລືອກ…
+	Rotate the selected pages counterclockwise	ໝູນໜ້າທີ່ເລືອກທວນເຂັມໂມງ
+	Rotate the selected pages clockwise	ໝູນໜ້າທີ່ເລືອກຕາມເຂັມໂມງ
+	Extract the selected pages…	ແຍກໜ້າທີ່ເລືອກອອກ…
+	Delete the selected pages	ລຶບໜ້າທີ່ເລືອກ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 4c4201b5c9..43749f4ec8 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -1067,6 +1067,15 @@
 	Scroll tabs right	Slinkti korteles dešinėn
 	Search comments	Ieškoti komentaruose
 	Search tools and commands…	Ieškoti įrankių ir komandų…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Pridėtas tekstas
+	Link URL	Saito URL
+	Search tools and commands	Ieškoti įrankių ir komandų
+	Text editing line	Teksto redagavimo eilutė
+	Text to place	Tekstas, kurį reikia įdėti
+	Tooltip	Patarimas
+	Words or phrases to redact	Šalinami žodžiai ar frazės
 	Searchable Image (Exact)	Paveikslėlis su tiksliu atpažinimu
 	Searching… {s} of {p} pages	Ieškoma… {s} iš {p} puslapių
 	Searching… {s}/{p}	Ieškoma… {s}/{p}
@@ -2739,6 +2748,14 @@ key	Space	Tarpas
 	Make properties default	Nustatyti ypatybes kaip numatytąsias
 	Pages selected	Pasirinkti puslapiai
 	Page properties	Puslapio ypatybės
+	Create & Edit	Kūrimas ir redagavimas
+	Review & Compare	Peržiūra ir palyginimas
+	Forms & Signatures	Formos ir parašai
+	Protect & Standardize	Apsauga ir standartizavimas
+	Customize & Automate	Pritaikymas ir automatizavimas
+	No tools match your search.	Paieškos neatitinka joks įrankis.
+	Expand all tools	Išskleisti visus įrankius
+	Collapse all tools	Suskleisti visus įrankius
 
 # AI-assisted additions for concurrently merged UI features (2026-10-15).
 # These additions have not had separate native-speaker review.
@@ -2792,3 +2809,12 @@ theme	Appearance	Išvaizda
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Šiandien
+@plural	{n} reply|{n} replies	{n} atsakymas|{n} atsakymai|{n} atsakymų
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Puslapių įrankiai
+	Insert pages from a file after the selection…	Įterpti puslapius iš failo po pasirinkimo…
+	Rotate the selected pages counterclockwise	Pasukti pasirinktus puslapius prieš laikrodžio rodyklę
+	Rotate the selected pages clockwise	Pasukti pasirinktus puslapius pagal laikrodžio rodyklę
+	Extract the selected pages…	Išskleisti pasirinktus puslapius…
+	Delete the selected pages	Ištrinti pasirinktus puslapius
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
deleted file mode 100644
index 8f17a8acaf..0000000000
--- a/crates/ui-egui/src/i18n/mod.rs
+++ /dev/null
@@ -1,1881 +0,0 @@
-//! UI localisation. Strings in code stay English and are the default lookup keys; a per-language
-//! catalog (`*.tsv`, see `ja.tsv` for the format) maps them to display text at render time. Command
-//! ids, document text, file names, the control channel, the CLI and MCP never see translated text,
-//! so agents and scripts are unaffected. A string without a translation is shown in English, so
-//! coverage can grow incrementally.
-//!
-//! The system is the one PhotoCraft uses (`photocraft/crates/ui-egui/src/i18n`), so catalogs and
-//! habits carry over between the two apps.
-//!
-//! # Adding a language
-//! 1. Add `xx.tsv` next to `ja.tsv` (copy its header; translate from the *meaning* of the English
-//!    text, clean-room, see `ja.tsv`).
-//! 2. Add one row to [`LANGUAGES`] (code, native name, catalog, plural rule).
-//!
-//! That is all: the Preferences dropdown, the system-locale match and the catalog tests (parse,
-//! placeholders, plural forms) pick it up from the registry.
-//!
-//! # Looking strings up
-//! - [`tl!`](crate::tl) / [`t`]: a plain string in the current language. [`tr`]: in a given one.
-//! - [`tr_ctx`] (`tl_ctx!` in UI code): when one English word needs different translations.
-//! - [`tr_id`]: a command-id keyed string with the English label as fallback (menu items), so a
-//!   translation survives rewording of the English text and can differ per command.
-//! - [`trn`]: plural-aware (`{n}` is filled in). [`fmt`]: fill `{name}` placeholders after [`tr`];
-//!   translators may reorder placeholders freely.
-
-mod catalog;
-
-use std::cell::Cell;
-use std::sync::OnceLock;
-
-use catalog::Catalog;
-
-/// The `language` preference value that follows the system locale.
-pub const AUTO: &str = "auto";
-
-/// One supported UI language.
-pub struct LangInfo {
-    /// BCP 47 code, lowercase (`ja`, `zh-hans`, `pt-br`). Also the `language` preference value.
-    pub code: &'static str,
-    /// The language's name in itself, shown in the Preferences dropdown.
-    pub name: &'static str,
-    /// Catalog file contents (empty for the built-in English).
-    pub source: &'static str,
-    /// Plural form index for a count (English: 0 = one, 1 = other; Japanese: always 0). A catalog's
-    /// `@plural` entries list one form per index.
-    pub plural: fn(u64) -> usize,
-    /// The language is written right to left. egui lays text out left to right, so the catalog's
-    /// translations are put into display order when it loads ([`crate::bidi::display_rtl`]).
-    pub rtl: bool,
-    catalog: OnceLock<Catalog>,
-}
-
-fn plural_one_other(n: u64) -> usize {
-    usize::from(n != 1)
-}
-
-fn plural_none(_: u64) -> usize {
-    0
-}
-
-/// Romanian (CLDR `ro`): 1 is `one`; 0 and numbers whose last two digits are 1–19 (2, 19, 101,
-/// 119) are `few`; everything else (20, 100, 120) is `other`, the form with "de" ("20 de pagini").
-fn plural_ro(n: u64) -> usize {
-    if n == 1 {
-        0
-    } else if n == 0 || (1..=19).contains(&(n % 100)) {
-        1
-    } else {
-        2
-    }
-}
-
-/// Lithuanian: one (ending in 1 except 11), few (ending in 2–9 except 12–19), other otherwise.
-fn plural_lithuanian(n: u64) -> usize {
-    match (n % 10, n % 100) {
-        (1, 11) => 2,
-        (1, _) => 0,
-        (2..=9, 12..=19) => 2,
-        (2..=9, _) => 1,
-        _ => 2,
-    }
-}
-
-/// Czech: 1 → one, 2–4 → few, everything else (0, 5+) → other.
-fn plural_cs(n: u64) -> usize {
-    match n {
-        1 => 0,
-        2..=4 => 1,
-        _ => 2,
-    }
-}
-
-/// Portuguese: 0 and 1 take the singular, everything else the plural.
-fn plural_pt(n: u64) -> usize {
-    usize::from(n > 1)
-}
-
-/// French (CLDR `fr`): 0 and 1 take the singular, everything else the plural.
-fn plural_fr(n: u64) -> usize {
-    usize::from(n > 1)
-}
-
-/// Russian: 1 (but not 11) is `one`, 2–4 (but not 12–14) `few`, everything else `many`.
-fn plural_russian(n: u64) -> usize {
-    match n % 100 {
-        11..=14 => 2,
-        _ => match n % 10 {
-            1 => 0,
-            2..=4 => 1,
-            _ => 2,
-        },
-    }
-}
-
-/// Ukrainian (CLDR `uk`, integer counts): one (1, 21), few (2–4, 22–24), many (0, 5–19).
-/// Counts ending in 11–14 always take many, regardless of the last digit.
-fn plural_ukrainian(n: u64) -> usize {
-    match n % 100 {
-        11..=14 => 2,
-        _ => match n % 10 {
-            1 => 0,
-            2..=4 => 1,
-            _ => 2,
-        },
-    }
-}
-
-/// Arabic (CLDR `ar`, integer counts): zero (0), one (1), two (2), few (3–10, 103–110),
-/// many (11–99, 111–199), other (100–102, 200–202).
-fn plural_arabic(n: u64) -> usize {
-    match (n, n % 100) {
-        (0, _) => 0,
-        (1, _) => 1,
-        (2, _) => 2,
-        (_, 3..=10) => 3,
-        (_, 11..=99) => 4,
-        _ => 5,
-    }
-}
-
-/// Polish integer counts: 1 is one; endings 2–4 except 12–14 are few; the rest are many.
-fn plural_polish(n: u64) -> usize {
-    match (n, n % 100, n % 10) {
-        (1, _, _) => 0,
-        (_, 12..=14, _) => 2,
-        (_, _, 2..=4) => 1,
-        _ => 2,
-    }
-}
-
-/// Slovene (CLDR `sl`): one (1, 101, 201 ...) | two (2, 102 ...) | few (3, 4, 103 ...) | other.
-fn plural_sl(n: u64) -> usize {
-    match n % 100 {
-        1 => 0,
-        2 => 1,
-        3 | 4 => 2,
-        _ => 3,
-    }
-}
-
-/// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 34] = [
-    LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
-    // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
-    LangInfo {
-        code: "zh-hans", name: "简体中文", source: include_str!("zh-hans.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new()
-    },
-    // Traditional Chinese in the vocabulary used in Taiwan; `zh-TW`, `zh-HK`, `zh-MO` and `zh-Hant-*`
-    // locales all resolve here (see `candidates`).
-    LangInfo {
-        code: "zh-hant", name: "繁體中文", source: include_str!("zh-hant.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new()
-    },
-    LangInfo { code: "cs", name: "Čeština", source: include_str!("cs.tsv"), plural: plural_cs, rtl: false, catalog: OnceLock::new() },
-    // Brazilian Portuguese; `pt`, `pt-BR` and `pt-PT` locales all resolve here (see `candidates`).
-    LangInfo {
-        code: "pt-br",
-        name: "Português (Brasil)",
-        source: include_str!("pt-br.tsv"),
-        plural: plural_pt,
-        rtl: false,
-        catalog: OnceLock::new(),
-    },
-    // German (informal "du"); every `de-*` locale (`de-DE`, `de-AT`, `de-CH` ...) resolves here.
-    LangInfo { code: "de", name: "Deutsch", source: include_str!("de.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // Spanish (European vocabulary); every `es-*` locale (`es-ES`, `es-MX`, `es-419` ...) resolves here.
-    LangInfo { code: "es", name: "Español", source: include_str!("es.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // French; every `fr-*` locale (`fr-FR`, `fr-CA`, `fr-BE` ...) resolves here.
-    LangInfo { code: "fr", name: "Français", source: include_str!("fr.tsv"), plural: plural_fr, rtl: false, catalog: OnceLock::new() },
-    // Russian; every `ru-*` locale (`ru-RU`, `ru-BY`, `ru-KZ` ...) resolves here.
-    LangInfo { code: "ru", name: "Русский", source: include_str!("ru.tsv"), plural: plural_russian, rtl: false, catalog: OnceLock::new() },
-    // Kazakh; every `kk-*` locale (`kk-KZ`, `kk-KZ.UTF-8`) resolves here.
-    LangInfo { code: "kk", name: "Қазақша", source: include_str!("kk.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // Bulgarian; every `bg-*` locale (`bg-BG`) resolves here.
-    LangInfo {
-        code: "bg", name: "Български", source: include_str!("bg.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new()
-    },
-    // Telugu; every `te-*` locale (`te-IN`) resolves here.
-    LangInfo {
-        code: "te", name: "తెలుగు", source: include_str!("te.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new()
-    },
-    // Hungarian; every `hu-*` locale (`hu-HU`) resolves here.
-    LangInfo { code: "hu", name: "Magyar", source: include_str!("hu.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // Ukrainian; every `uk-*` locale (`uk-UA`, `uk_UA.UTF-8`) resolves here.
-    LangInfo {
-        code: "uk", name: "Українська", source: include_str!("uk.tsv"), plural: plural_ukrainian, rtl: false, catalog: OnceLock::new()
-    },
-    // Italian; every `it-*` locale (`it-IT`) resolves here.
-    LangInfo { code: "it", name: "Italiano", source: include_str!("it.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // Arabic (Modern Standard, Western digits); every `ar-*` locale (`ar-MA`, `ar-EG`, `ar-SA` ...)
-    // resolves here. Right to left: see `LangInfo::rtl`.
-    LangInfo { code: "ar", name: "العربية", source: include_str!("ar.tsv"), plural: plural_arabic, rtl: true, catalog: OnceLock::new() },
-    // Central Kurdish (Sorani); every `ckb-*` locale (`ckb-IQ`, `ckb-IR`) resolves here. Right to
-    // left like Arabic: see `LangInfo::rtl`. CLDR `ckb` counts have two forms (one, other).
-    LangInfo {
-        code: "ckb", name: "کوردیی ناوەندی", source: include_str!("ckb.tsv"), plural: plural_one_other, rtl: true, catalog: OnceLock::new()
-    },
-    // Polish; every `pl-*` locale (`pl-pl`, `pl_pl.UTF-8`) resolves here.
-    LangInfo { code: "pl", name: "Polski", source: include_str!("pl.tsv"), plural: plural_polish, rtl: false, catalog: OnceLock::new() },
-    // Slovene; every `sl-*` locale (`sl-SI`) resolves here. Four plural forms (one, two, few, other).
-    LangInfo { code: "sl", name: "Slovenščina", source: include_str!("sl.tsv"), plural: plural_sl, rtl: false, catalog: OnceLock::new() },
-    LangInfo { code: "el", name: "Ελληνικά", source: include_str!("el.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // Turkish; every `tr-*` locale (`tr-TR`, `tr_TR.UTF-8`) resolves here.
-    LangInfo { code: "tr", name: "Türkçe", source: include_str!("tr.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
-    // Lithuanian; every `lt-*` locale (`lt-LT`, `lt_LT.UTF-8`) resolves here. Three plural forms (one, few, other).
-    LangInfo { code: "lt", name: "Lietuvių", source: include_str!("lt.tsv"), plural: plural_lithuanian, rtl: false, catalog: OnceLock::new() },
-    // Indonesian; every `id-*` locale (`id-ID`, `id_ID.UTF-8`) resolves here. CLDR `id` counts have
-    // one form ("other"), so `@plural` entries list a single form.
-    LangInfo { code: "id", name: "Bahasa Indonesia", source: include_str!("id.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
-    // Vietnamese; every `vi-*` locale (`vi-VN`, `vi_VN.UTF-8`) resolves here. CLDR `vi` counts have
-    // one form ("other"), so `@plural` entries list a single form.
-    LangInfo { code: "vi", name: "Tiếng Việt", source: include_str!("vi.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
-    // Finnish; every `fi-*` locale (`fi-FI`, `fi_FI.UTF-8`) resolves here. Two plural forms (one, other):
-    // the partitive singular follows any number but 1 (`1 sivu`, `2 sivua`).
-    LangInfo { code: "fi", name: "Suomi", source: include_str!("fi.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // Albanian; every `sq-*` locale (`sq-AL`, `sq_AL.UTF-8`, `sq-XK`) resolves here. One/other plural, like English.
-    LangInfo { code: "sq", name: "Shqip", source: include_str!("sq.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // Thai; every `th-*` locale (`th-TH`, `th_TH.UTF-8`) resolves here. No grammatical plural.
-    LangInfo { code: "th", name: "ไทย", source: include_str!("th.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
-    // Catalan; every `ca-*` locale (`ca-ES`, `ca_ES.UTF-8`, `ca_ES@valencia`) resolves here.
-    LangInfo { code: "ca", name: "Català", source: include_str!("ca.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-    // Romanian; every `ro-*` locale (`ro-RO`, `ro_RO.UTF-8`, `ro-MD`) resolves here. Three plural forms (one, few, other).
-    LangInfo { code: "ro", name: "Română", source: include_str!("ro.tsv"), plural: plural_ro, rtl: false, catalog: OnceLock::new() },
-    // Lao; every `lo-*` locale (`lo-LA`, `lo_LA.UTF-8` ...) resolves here.
-    LangInfo { code: "lo", name: "ພາສາລາວ", source: include_str!("lo.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
-    // Hindi; every `hi-*` locale (`hi-IN`, `hi_IN.UTF-8`) resolves here. CLDR `hi` has "one"
-    // (0 and 1) and "other", but the catalog's nouns are the same in both ("{n} पृष्ठ"), so
-    // `@plural` entries list a single form.
-    LangInfo { code: "hi", name: "हिन्दी", source: include_str!("hi.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
-    // Korean; every `ko-*` locale (`ko-KR`, `ko_KR.UTF-8`) resolves here. CLDR `ko` counts have
-    // one form ("other"), so `@plural` entries list a single form.
-    LangInfo { code: "ko", name: "한국어", source: include_str!("ko.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
-    // Norwegian Bokmål; every `nb-*` locale resolves here, and so do general Norwegian (`no-*`) and
-    // Nynorsk (`nn-*`), which have no catalog of their own (see `candidates`).
-    LangInfo { code: "nb", name: "Norsk bokmål", source: include_str!("nb.tsv"), plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
-];
-
-impl LangInfo {
-    /// How many plural forms the language's `@plural` entries list.
-    fn plural_forms(&self) -> usize {
-        (0..=1000).map(self.plural).max().unwrap_or(0).saturating_add(1)
-    }
-
-    fn catalog(&self) -> &Catalog {
-        self.catalog.get_or_init(|| {
-            let (mut catalog, errors) = Catalog::parse(self.source, self.plural_forms());
-            for error in errors {
-                log::warn!("{} interface catalog: {error}; that entry shows in English", self.code);
-            }
-            if self.rtl {
-                catalog.map_translations(crate::bidi::display_rtl);
-            }
-            catalog
-        })
-    }
-}
-
-/// A language the UI can be shown in (a handle into [`LANGUAGES`]).
-#[derive(Clone, Copy)]
-pub struct Lang(&'static LangInfo);
-
-impl std::fmt::Debug for Lang {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "Lang({})", self.0.code)
-    }
-}
-
-impl PartialEq for Lang {
-    fn eq(&self, other: &Self) -> bool {
-        self.0.code == other.0.code
-    }
-}
-
-impl Eq for Lang {}
-
-impl Lang {
-    pub const EN: Lang = Lang(&LANGUAGES[0]);
-
-    pub fn code(self) -> &'static str {
-        self.0.code
-    }
-
-    /// A language by its exact code.
-    pub fn from_code(code: &str) -> Option<Lang> {
-        LANGUAGES.iter().find(|l| l.code.eq_ignore_ascii_case(code)).map(Lang)
-    }
-
-    /// Resolve the `language` preference: a language code, or [`AUTO`] (and anything unknown,
-    /// e.g. a code from a newer version) to follow the system locale.
-    pub fn from_pref(pref: &str) -> Lang {
-        Lang::from_code(pref).unwrap_or_else(system_lang)
-    }
-
-    /// Every registered language.
-    pub fn all() -> impl Iterator<Item = Lang> {
-        LANGUAGES.iter().map(Lang)
-    }
-
-    /// Every registered language in the order a picker lists them: English first (the source
-    /// language and the fallback), then the rest by their own name with accents folded, so
-    /// Čeština sits under C rather than after Z. Names in other scripts follow the Latin ones in
-    /// code point order: Greek, Cyrillic, Arabic, then the CJK languages.
-    pub fn for_picker() -> Vec<Lang> {
-        let mut rest: Vec<Lang> = Lang::all().filter(|l| l.code() != Lang::EN.code()).collect();
-        rest.sort_by_cached_key(|l| name_sort_key(l.name()));
-        std::iter::once(Lang::EN).chain(rest).collect()
-    }
-
-    pub fn name(self) -> &'static str {
-        self.0.name
-    }
-
-    /// Whether the language is written right to left. Its translations come back from the
-    /// lookups in display order (see [`LangInfo::rtl`]).
-    pub fn rtl(self) -> bool {
-        self.0.rtl
-    }
-
-    fn catalog(self) -> &'static Catalog {
-        self.0.catalog()
-    }
-}
-
-/// The canonical `language` preference for user input: [`AUTO`] or a registered code (any case).
-/// `None` for anything else, so callers can keep the current setting.
-pub fn normalize_pref(pref: &str) -> Option<&'static str> {
-    if pref.eq_ignore_ascii_case(AUTO) {
-        return Some(AUTO);
-    }
-    Lang::from_code(pref).map(Lang::code)
-}
-
-/// Candidate language codes for a locale tag, most specific first: `zh_TW.UTF-8` →
-/// `zh-tw`, `zh-hant`, `zh`.
-fn candidates(tag: &str) -> Vec<String> {
-    let base = tag.split(['.', '@']).next().unwrap_or("").replace('_', "-").to_ascii_lowercase();
-    let parts: Vec<&str> = base.split('-').filter(|p| !p.is_empty()).collect();
-    let Some(&primary) = parts.first() else { return Vec::new() };
-    let mut out = Vec::new();
-    for n in (1..=parts.len()).rev() {
-        out.push(parts.get(..n).unwrap_or_default().join("-"));
-    }
-    if primary == "zh" && !parts.iter().any(|p| matches!(*p, "hans" | "hant")) {
-        // Chinese by region when no script is given.
-        let script = if parts.iter().any(|p| matches!(*p, "tw" | "hk" | "mo")) { "zh-hant" } else { "zh-hans" };
-        out.insert(out.len().saturating_sub(1), script.to_string());
-    }
-    if primary == "pt" && !out.iter().any(|c| c == "pt-br") {
-        // The only Portuguese catalog is Brazilian; other regions use it rather than English.
-        out.insert(out.len().saturating_sub(1), "pt-br".to_string());
-    }
-    if matches!(primary, "no" | "nn") {
-        // The only Norwegian catalog is Bokmål. `no` (Norwegian in general) and Nynorsk readers use
-        // it rather than English; last, so a catalog of their own would win.
-        out.push("nb".to_string());
-    }
-    out
-}
-
-/// The registered language for a locale tag such as `ja_JP.UTF-8`, `ja-JP`; `None` if the
-/// language isn't supported. `C`/`POSIX` mean English.
-pub fn lang_from_tag(tag: &str) -> Option<Lang> {
-    let cands = candidates(tag);
-    if matches!(cands.first().map(String::as_str), Some("c" | "posix")) {
-        return Some(Lang::EN);
-    }
-    cands.iter().find_map(|c| Lang::from_code(c))
-}
-
-/// The system language (cached). English when it can't be determined.
-pub fn system_lang() -> Lang {
-    // Tests drive the UI by its English labels whatever the developer's locale is. This covers
-    // the unit tests; the integration tests link the library as it ships, where `cfg!(test)` is
-    // off, so each of their harnesses pins the `language` option to `en` instead.
-    if cfg!(test) {
-        return Lang::EN;
-    }
-    static SYSTEM: OnceLock<Lang> = OnceLock::new();
-    *SYSTEM.get_or_init(detect_system_lang)
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-fn detect_system_lang() -> Lang {
-    for var in ["LC_ALL", "LC_MESSAGES", "LANG"] {
-        if let Some(l) = std::env::var(var).ok().and_then(|v| language_override(&v)) {
-            return l;
-        }
-    }
-    // Apps started from the Finder don't inherit LANG: use the macOS preferred-languages list.
-    // The absolute path keeps a `defaults` earlier on PATH from running; any failure means English.
-    #[cfg(target_os = "macos")]
-    if let Ok(out) = std::process::Command::new("/usr/bin/defaults").args(["read", "-g", "AppleLanguages"]).output()
-        && out.status.success()
-        && let Some(l) = first_supported(&String::from_utf8_lossy(&out.stdout))
-    {
-        return l;
-    }
-    #[cfg(target_os = "windows")]
-    if let Some(l) = windows_ui_language().as_deref().and_then(first_supported) {
-        return l;
-    }
-    Lang::EN
-}
-
-/// A named locale can override the display language. On Windows, the neutral
-/// C/POSIX locale inherited from a launcher says nothing about the user's UI language.
-#[cfg(not(target_arch = "wasm32"))]
-fn language_override(tag: &str) -> Option<Lang> {
-    let tag = tag.trim();
-    if cfg!(target_os = "windows") && matches!(candidates(tag).first().map(String::as_str), Some("c" | "posix")) {
-        return None;
-    }
-    lang_from_tag(tag)
-}
-
-/// The Windows display languages in preference order, one tag per line, queried once when Auto
-/// first resolves. `sys-locale` asks Windows directly (`GetUserPreferredUILanguages`), so no
-/// process is started.
-#[cfg(target_os = "windows")]
-fn windows_ui_language() -> Option<String> {
-    let tags: Vec<String> = sys_locale::get_locales().collect();
-    (!tags.is_empty()).then(|| tags.join("\n"))
-}
-
-/// The first supported language in a macOS `defaults read` list or Windows UI-culture output.
-#[cfg_attr(not(any(target_os = "macos", target_os = "windows")), allow(dead_code))]
-fn first_supported(list: &str) -> Option<Lang> {
-    list.split(['(', ')', ',', '"', '\n']).map(str::trim).filter(|s| !s.is_empty()).find_map(lang_from_tag)
-}
-
-/// The first supported language among BCP 47 tags in preference order, as the browser lists them
-/// in `navigator.languages` (#2954). Only the first few tags are looked at: the list is short in
-/// practice, and a page can't make Auto walk an unbounded one.
-#[cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
-fn first_supported_tag<S: AsRef<str>>(tags: impl IntoIterator<Item = S>) -> Option<Lang> {
-    tags.into_iter().take(32).find_map(|tag| lang_from_tag(tag.as_ref().trim()))
-}
-
-/// The browser's preferred languages, as the desktop builds use the system's: `navigator.languages`
-/// in order, then `navigator.language` (kept within the 32 tags `first_supported_tag` reads).
-/// English when the browser offers none we have a catalog for.
-#[cfg(target_arch = "wasm32")]
-fn detect_system_lang() -> Lang {
-    let Some(navigator) = web_sys::window().map(|w| w.navigator()) else { return Lang::EN };
-    let mut tags: Vec<String> = navigator.languages().iter().take(31).filter_map(|v| v.as_string()).collect();
-    tags.extend(navigator.language());
-    first_supported_tag(&tags).unwrap_or(Lang::EN)
-}
-
-thread_local! {
-    // Per thread, as in PhotoCraft: independent app and test threads (kittest harnesses run in
-    // parallel) must not change each other's drawing language.
-    static CURRENT: Cell<Lang> = const { Cell::new(Lang::EN) };
-}
-
-/// Set the UI language for drawing (the shell calls this once per frame from the preference), so
-/// widgets can translate without every call site carrying a language around.
-pub fn set_current(lang: Lang) {
-    CURRENT.set(lang);
-}
-
-/// The language the UI is drawn in.
-/// `label` as it reads inside a sentence ("add a text box"): lowercased, except in languages
-/// that capitalise nouns (German), where lowercasing would misspell it.
-pub fn in_sentence(label: &str) -> std::borrow::Cow<'_, str> {
-    match current().code() {
-        "de" => std::borrow::Cow::Borrowed(label),
-        "tr" => std::borrow::Cow::Owned(label.chars().flat_map(lower_turkish).collect()),
-        _ => std::borrow::Cow::Owned(label.to_lowercase()),
-    }
-}
-
-/// The translation of `english` in upper case, for section titles. Rust's case mapping knows no
-/// language, and Turkish has a dotted and a dotless i (`i` ↔ `İ`, `ı` ↔ `I`): "Gelişmiş" must
-/// become "GELİŞMİŞ", not "GELIŞMIŞ". A label without a Turkish row is still English and keeps
-/// the English rule.
-pub fn upper_label(english: &str) -> String {
-    let lang = current();
-    let shown = tr(lang, english);
-    if lang.code() == "tr" && has(lang, english) { shown.chars().flat_map(upper_turkish).collect() } else { shown.to_uppercase() }
-}
-
-fn upper_turkish(c: char) -> std::char::ToUppercase {
-    match c {
-        'i' => 'İ'.to_uppercase(),
-        'ı' => 'I'.to_uppercase(),
-        c => c.to_uppercase(),
-    }
-}
-
-fn lower_turkish(c: char) -> std::char::ToLowercase {
-    match c {
-        // `İ`.to_lowercase() is "i" plus a combining dot above.
-        'İ' => 'i'.to_lowercase(),
-        'I' => 'ı'.to_lowercase(),
-        c => c.to_lowercase(),
-    }
-}
-
-pub fn current() -> Lang {
-    CURRENT.get()
-}
-
-/// Does `lang` have a catalog entry for this plain string? (English never does: it is the source.)
-pub fn has(lang: Lang, s: &str) -> bool {
-    lang.catalog().plain(s).is_some()
-}
-
-/// Translate an English UI string into the current language ([`tr`] with [`current`]).
-pub fn t(s: &str) -> &str {
-    tr(current(), s)
-}
-
-/// The name of a keyboard key, distinct from a command such as Delete. Missing key-name
-/// translations use the English key name, never a plain command translation.
-pub fn key_name(s: &str) -> &str {
-    current().catalog().contextual("key", s).unwrap_or(s)
-}
-
-/// Translate an English UI string; unknown strings come back unchanged.
-pub fn tr(lang: Lang, s: &str) -> &str {
-    lang.catalog().plain(s).unwrap_or(s)
-}
-
-/// How the layers below say their own sentences in the current language.
-///
-/// The checker, the preflight profiles and the signature panel hand over a whole English wording
-/// — holes and all — and the document's own words apart from it, so this is all they need of us:
-/// `f.said(&i18n::words)` says the sentence here, and `in_english` says it in English. An unknown
-/// wording comes back as it stands, which is the English, so a catalog that is missing one is a
-/// sentence in English rather than a gap.
-pub fn words(wording: &str) -> String {
-    t(wording).to_owned()
-}
-
-/// Like [`tr`], for an English string that needs a disambiguating `context`.
-pub fn tr_ctx<'a>(lang: Lang, context: &str, s: &'a str) -> &'a str {
-    lang.catalog().contextual(context, s).unwrap_or_else(|| tr(lang, s))
-}
-
-/// A string keyed by its command id, falling back to the translation of the English `label`.
-pub fn tr_id<'a>(lang: Lang, id: &str, label: &'a str) -> &'a str {
-    lang.catalog().id(id).unwrap_or_else(|| tr(lang, label))
-}
-
-/// Fill `{name}` placeholders in one pass. Unknown placeholders are left as written, and inserted
-/// values are never read as templates again, so a file name containing `{n}` stays intact.
-pub fn fmt(template: &str, args: &[(&str, &str)]) -> String {
-    let mut out = String::with_capacity(template.len());
-    let mut rest = template;
-    while let Some((before, after_open)) = rest.split_once('{') {
-        out.push_str(before);
-        let Some((name, after_close)) = after_open.split_once('}') else {
-            out.push('{');
-            out.push_str(after_open);
-            return out;
-        };
-        match args.iter().find(|(key, _)| *key == name) {
-            Some((_, value)) => out.push_str(value),
-            None => {
-                out.push('{');
-                out.push_str(name);
-                out.push('}');
-            }
-        }
-        rest = after_close;
-    }
-    out.push_str(rest);
-    out
-}
-
-/// A generated history label (the action part of "Undo …") in the current language. Captured
-/// values (file and field names) are inserted as they are; unknown labels are looked up whole.
-pub fn action_label(text: &str) -> String {
-    for (prefix, template) in [
-        ("Insert pages from ", "Insert pages from {name}"),
-        ("Fill in ", "Fill in {name}"),
-        ("Set the image of ", "Set the image of {name}"),
-        ("Edit script of ", "Edit script of {name}"),
-        ("Import ", "Import {name}"),
-    ] {
-        if let Some(value) = text.strip_prefix(prefix) {
-            return fmt(t(template), &[("name", value)]);
-        }
-    }
-    if let Some(key) = text.strip_prefix("Change ")
-        && ["Title", "Author", "Subject", "Keywords", "Creator", "Producer"].contains(&key)
-    {
-        return fmt(t("Change {key}"), &[("key", t(key))]);
-    }
-    if let Some(n) = text.strip_prefix("Delete ").and_then(|rest| rest.strip_suffix(" fields")).and_then(|n| n.parse::<u64>().ok()) {
-        return trn(current(), n, "Delete {n} field", "Delete {n} fields");
-    }
-    t(text).to_owned()
-}
-
-/// A history label in the current language, out of the engine's own two parts: the wording is
-/// looked up whole and the document's own word goes into its `{}` afterwards, so a file or field
-/// name is never read as part of the wording. This is exact where [`action_label`] has to guess
-/// from the English text, and is what the engine's own labels go through.
-pub fn edit_label(label: &pdfcraft_engine::Label) -> String {
-    // A batch's wording is only the hole: it carries its name as text, which from below L7 is one
-    // of `BATCH_LABELS` and so is looked up too.
-    if let Some(name) = label.value.as_deref().filter(|_| label.wording == "{batch}") {
-        return t(name).to_owned();
-    }
-    label.said(t(label.wording))
-}
-
-/// A command label such as "Undo Insert pages from a.pdf" in the current language. A catalog
-/// whose word order doesn't put the verb first translates "Undo {action}" and "Redo {action}"
-/// as whole phrases; otherwise the translated verb goes before the action.
-pub fn command_label(text: &str) -> String {
-    for (prefix, template) in [("Undo", "Undo {action}"), ("Redo", "Redo {action}")] {
-        if let Some(action) = text.strip_prefix(prefix).and_then(|tail| tail.strip_prefix(' ')) {
-            let action = action_label(action);
-            if has(current(), template) {
-                return fmt(t(template), &[("action", &action)]);
-            }
-            return format!("{} {action}", t(prefix));
-        }
-    }
-    t(text).to_owned()
-}
-
-/// A registered command's menu label: its `@id` catalog entry if there is one, otherwise
-/// [`command_label`] of the current English label.
-pub fn menu_label(id: &str, label: &str) -> String {
-    match current().catalog().id(id) {
-        Some(translated) => translated.to_owned(),
-        None => command_label(label),
-    }
-}
-
-/// A plural-aware message: `one`/`other` are the English forms (with `{n}` where the count goes).
-pub fn trn(lang: Lang, n: u64, one: &str, other: &str) -> String {
-    let idx = (lang.0.plural)(n);
-    let text = lang.catalog().plural(one, other, idx).unwrap_or(if n == 1 { one } else { other });
-    fmt(text, &[("n", &n.to_string())])
-}
-
-/// `name` lowercased with the Latin accents that occur in language names folded away, so a
-/// byte-wise sort reads alphabetically. Other scripts are left as they are.
-fn name_sort_key(name: &str) -> String {
-    name.chars()
-        .flat_map(char::to_lowercase)
-        .map(|c| match c {
-            'à'..='å' | 'ā' | 'ă' | 'ą' => 'a',
-            'ç' | 'ć' | 'č' => 'c',
-            'è'..='ë' | 'ē' | 'ě' | 'ę' | 'ế' | 'ệ' => 'e',
-            'ì'..='ï' | 'ī' => 'i',
-            'ñ' | 'ń' | 'ň' => 'n',
-            'ò'..='ö' | 'ø' | 'ő' => 'o',
-            'ś' | 'š' => 's',
-            'ù'..='ü' | 'ū' | 'ů' | 'ű' => 'u',
-            'ý' | 'ÿ' => 'y',
-            'ź' | 'ż' | 'ž' => 'z',
-            c => c,
-        })
-        .collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::catalog::{Entry, parse_entries, placeholders};
-    use super::*;
-
-    const JA: fn() -> Lang = || Lang::from_code("ja").expect("ja registered");
-
-    #[test]
-    fn keyboard_key_names_have_a_separate_context_and_english_fallback() {
-        static KEYS: LangInfo = LangInfo {
-            code: "keys",
-            name: "Key name test catalog",
-            source: "key\tDelete\tEntf\n\tDelete\tLöschen\n\tOpen\tÖffnen\n",
-            plural: plural_one_other,
-            rtl: false,
-            catalog: OnceLock::new(),
-        };
-        let previous = current();
-        set_current(Lang(&KEYS));
-        assert_eq!(key_name("Delete"), "Entf");
-        assert_eq!(t("Delete"), "Löschen");
-        assert_eq!(key_name("Open"), "Open", "a missing key name must not borrow a command translation");
-        set_current(Lang::EN);
-        assert_eq!(key_name("Delete"), "Delete");
-        set_current(previous);
-    }
-
-    #[test]
-    fn tags_map_to_languages() {
-        assert_eq!(lang_from_tag("ja_JP.UTF-8"), Some(JA()));
-        assert_eq!(lang_from_tag("ja-JP"), Some(JA()));
-        assert_eq!(lang_from_tag("en_US.UTF-8"), Some(Lang::EN));
-        assert_eq!(lang_from_tag("C"), Some(Lang::EN));
-        assert_eq!(lang_from_tag("POSIX"), Some(Lang::EN));
-        assert_eq!(lang_from_tag("fr_FR"), Lang::from_code("fr"));
-        assert_eq!(lang_from_tag("fr_CA.UTF-8"), Lang::from_code("fr"));
-        assert_eq!(lang_from_tag("fr-BE"), Lang::from_code("fr"));
-        assert_eq!(lang_from_tag("zh-TW"), Lang::from_code("zh-hant"));
-        assert_eq!(lang_from_tag("zh_CN.UTF-8"), Lang::from_code("zh-hans"));
-        assert_eq!(lang_from_tag("zh"), Lang::from_code("zh-hans"));
-        assert_eq!(lang_from_tag("zh_HK.UTF-8"), Lang::from_code("zh-hant"));
-        assert_eq!(lang_from_tag("zh-Hant-MO"), Lang::from_code("zh-hant"));
-        assert_eq!(lang_from_tag("lo_LA.UTF-8"), Lang::from_code("lo"));
-        assert_eq!(lang_from_tag("lo-LA"), Lang::from_code("lo"));
-        assert_eq!(lang_from_tag("lo"), Lang::from_code("lo"));
-        assert_eq!(lang_from_tag(""), None);
-        assert_eq!(lang_from_tag("_"), None);
-    }
-
-    #[test]
-    fn candidates_walk_from_specific_to_general() {
-        assert_eq!(candidates("pt_BR.UTF-8"), ["pt-br", "pt"]);
-        assert_eq!(candidates("pt_PT.UTF-8"), ["pt-pt", "pt-br", "pt"]);
-        assert_eq!(candidates("pt"), ["pt-br", "pt"]);
-        assert_eq!(candidates("zh_TW"), ["zh-tw", "zh-hant", "zh"]);
-        assert_eq!(candidates("zh-CN"), ["zh-cn", "zh-hans", "zh"]);
-        assert_eq!(candidates("zh-Hant-HK"), ["zh-hant-hk", "zh-hant", "zh"]);
-        assert_eq!(candidates("lo_LA.UTF-8"), ["lo-la", "lo"]);
-        assert_eq!(candidates("nb_NO.UTF-8"), ["nb-no", "nb"]);
-        assert_eq!(candidates("no_NO.UTF-8"), ["no-no", "no", "nb"]);
-        assert_eq!(candidates("nn-NO"), ["nn-no", "nn", "nb"]);
-    }
-
-    #[test]
-    fn macos_language_list_is_parsed() {
-        assert_eq!(first_supported("(\n    \"ja-JP\",\n    \"en-US\"\n)\n"), Some(JA()));
-        assert_eq!(first_supported("(\n    \"fr-FR\",\n    \"en-US\"\n)\n"), Lang::from_code("fr"));
-        assert_eq!(first_supported("("), None);
-    }
-
-    /// #2954: the web build's Auto language follows the browser's preferred languages in order,
-    /// skipping ones without a catalog, and is English only when none is supported.
-    #[test]
-    fn browser_language_list_is_followed_in_order() {
-        assert_eq!(first_supported_tag(["it-IT", "en-US"]), Lang::from_code("it"));
-        assert_eq!(first_supported_tag(["xx-YY", "ja", "fr-FR"]), Some(JA()));
-        assert_eq!(first_supported_tag(["zh-TW"]), Lang::from_code("zh-hant"));
-        assert_eq!(first_supported_tag(["en-GB", "fr-FR"]), Some(Lang::EN));
-        assert_eq!(first_supported_tag([" pt-PT "]), Lang::from_code("pt-br"));
-        assert_eq!(first_supported_tag(["", "xx"]), None);
-        assert_eq!(first_supported_tag(Vec::<String>::new()), None);
-        let long = std::iter::repeat_n("xx", 10_000).chain(["fr"]);
-        assert_eq!(first_supported_tag(long), None, "only the first tags are read");
-    }
-
-    #[test]
-    fn windows_display_language_resolves_chinese_scripts() {
-        for tag in ["zh-CN", "zh-SG", "zh-Hans", "zh-Hans-CN"] {
-            assert_eq!(first_supported(&format!("{tag}\r\n")), Lang::from_code("zh-hans"));
-        }
-        for tag in ["zh-TW", "zh-HK", "zh-MO", "zh-Hant", "zh-Hant-HK"] {
-            assert_eq!(first_supported(&format!("{tag}\r\n")), Lang::from_code("zh-hant"));
-        }
-        assert_eq!(first_supported("en-US\r\n"), Some(Lang::EN));
-        assert_eq!(first_supported("fr-FR\r\n"), Lang::from_code("fr"));
-        assert_eq!(first_supported("lo-LA\r\n"), Lang::from_code("lo"));
-        assert_eq!(first_supported("\r\n"), None);
-    }
-
-    #[cfg(target_os = "windows")]
-    #[test]
-    fn neutral_locale_does_not_override_display_language() {
-        let fr = Lang::from_code("fr").unwrap();
-        for tag in ["C", "C.UTF-8", "POSIX", "posix.UTF-8", "", "  C.UTF-8  ", "unsupported"] {
-            assert_eq!(language_override(tag), None, "{tag}");
-            assert_eq!(language_override(tag).or_else(|| first_supported("unsupported-XY\nfr-FR\nen-US")), Some(fr));
-        }
-        assert_eq!(["C.UTF-8", "POSIX", "fr_FR.UTF-8"].into_iter().find_map(language_override), Some(fr));
-        assert_eq!(language_override("fr_FR.UTF-8"), Some(fr));
-        assert_eq!(language_override("en_US.UTF-8"), Some(Lang::EN));
-        assert_eq!(language_override("ja_JP.UTF-8"), Some(JA()));
-    }
-
-    #[cfg(target_os = "windows")]
-    #[test]
-    fn windows_display_language_query_returns_a_locale_tag() {
-        // One tag per line, as `first_supported` reads them: a machine with several display
-        // languages reports them all, so each line is checked rather than the list as a whole.
-        let list = windows_ui_language().expect("Windows should report a display language");
-        let tags: Vec<&str> = list.lines().map(str::trim).filter(|t| !t.is_empty()).collect();
-        assert!(!tags.is_empty(), "no display language in {list:?}");
-        for tag in tags {
-            assert!(tag.split('-').all(|part| !part.is_empty() && part.bytes().all(|b| b.is_ascii_alphanumeric())), "not a locale tag: {tag:?}");
-        }
-    }
-
-    #[test]
-    fn preferences_resolve_with_fallback() {
-        assert_eq!(Lang::from_pref("ja"), JA());
-        assert_eq!(Lang::from_pref("JA"), JA());
-        assert_eq!(Lang::from_pref("en"), Lang::EN);
-        // `auto` and unknown codes follow the system (English under test).
-        assert_eq!(Lang::from_pref(AUTO), Lang::EN);
-        assert_eq!(Lang::from_pref("xx-unknown"), Lang::EN);
-        assert_eq!(normalize_pref("JA"), Some("ja"));
-        assert_eq!(normalize_pref("Auto"), Some(AUTO));
-        assert_eq!(normalize_pref("xx"), None);
-    }
-
-    #[test]
-    fn lookups_fall_back_to_english() {
-        assert_eq!(tr(JA(), "no such label"), "no such label");
-        assert_eq!(tr(Lang::EN, "File"), "File");
-        assert_eq!(tr(JA(), "File"), "ファイル");
-        assert_eq!(tr(JA(), "日本語の文書.pdf"), "日本語の文書.pdf");
-        assert_eq!(tr_id(JA(), "no.such.id", "File"), "ファイル");
-        assert_eq!(tr_ctx(JA(), "no such context", "File"), "ファイル");
-        assert!(has(JA(), "Save") && !has(Lang::EN, "Save"));
-    }
-
-    #[test]
-    fn catalog_kinds_are_parsed_and_looked_up() {
-        let (c, errors) = Catalog::parse(
-            "# c\n\tHello\tこんにちは\n@id\tfile.save\t保存する\nmenu\tWindows\tウィンドウ群\n@plural\t{n} file|{n} files\t{n} 個\n\n",
-            1,
-        );
-        assert!(errors.is_empty(), "{errors:?}");
-        assert_eq!(c.plain("Hello"), Some("こんにちは"));
-        assert_eq!(c.id("file.save"), Some("保存する"));
-        assert_eq!(c.contextual("menu", "Windows"), Some("ウィンドウ群"));
-        assert_eq!(c.contextual("other", "Windows"), None);
-        assert_eq!(c.plural("{n} file", "{n} files", 0), Some("{n} 個"));
-        assert_eq!(c.plural("{n} file", "{n} files", 5), Some("{n} 個"), "an index past the forms clamps");
-    }
-
-    #[test]
-    fn malformed_lines_are_reported_not_fatal() {
-        let (entries, errors) = parse_entries("\tok\tはい\nno tabs here\n\tonly\n\ta\tb\tc\textra\n\t\tempty source\n", 1);
-        assert_eq!(entries.len(), 1);
-        assert_eq!(errors.len(), 4, "{errors:?}");
-        let (entries, errors) = parse_entries("\ta\\tb\tx\\ny\\\\z\n", 1);
-        assert!(errors.is_empty(), "{errors:?}");
-        assert_eq!(entries, [Entry { context: String::new(), source: "a\tb".into(), translation: "x\ny\\z".into() }]);
-    }
-
-    #[test]
-    fn strict_validation_skips_only_the_bad_line() {
-        for (text, forms, error) in [
-            ("\tFile", 1, "context<TAB>"),
-            ("\tFile\t", 1, "nonempty"),
-            ("\tFile\\q\tFiles", 1, "unknown escape"),
-            ("\tFile\tFiles\\", 1, "trailing backslash"),
-            ("\tOpen…\tOpen", 1, "ellipsis"),
-            ("\tOpen {file}\tOpen {name}", 1, "placeholders"),
-            ("@plural\tpage\tPages", 1, "one|other"),
-            ("@plural\t{n} page|{n} pages\t{n} pages", 2, "2 nonempty"),
-            ("@plural\t{n} page|{n} pages\tPages", 1, "placeholders"),
-            ("@unknown\tFile\tFiles", 1, "reserved context"),
-        ] {
-            // The bad line comes first; the good line after it still loads.
-            let (catalog, errors) = Catalog::parse(&format!("{text}\n\tSave\t保存\n"), forms);
-            assert_eq!(errors.len(), 1, "{text:?}: {errors:?}");
-            assert!(errors[0].starts_with("line 1: ") && errors[0].contains(error), "{errors:?}");
-            assert_eq!(catalog.plain("Save"), Some("保存"), "{text:?}");
-        }
-        let (catalog, errors) = Catalog::parse("\tFile\tファイル\n\tFile\t別\n", 1);
-        assert!(errors.len() == 1 && errors[0].contains("line 2: duplicate"), "{errors:?}");
-        assert_eq!(catalog.plain("File"), Some("ファイル"), "the first entry wins");
-    }
-
-    #[test]
-    fn catalogs_handle_escapes_crlf_and_distinct_contexts() {
-        let (catalog, errors) =
-            Catalog::parse("# comment\r\n\r\n\tLine\\nTab\\tPath\\\\\tOther\\nTab\\tPath\\\\\r\nweight\tLight\tThin\r\ntheme\tLight\tPale\r\n", 1);
-        assert!(errors.is_empty(), "{errors:?}");
-        assert_eq!(catalog.plain("Line\nTab\tPath\\"), Some("Other\nTab\tPath\\"));
-        assert_eq!(catalog.contextual("weight", "Light"), Some("Thin"));
-        assert_eq!(catalog.contextual("theme", "Light"), Some("Pale"));
-    }
-
-    #[test]
-    fn broken_catalog_falls_back_to_english() {
-        static BROKEN: LangInfo = LangInfo {
-            code: "broken",
-            name: "Broken test catalog",
-            source: "malformed\n\\",
-            plural: plural_none,
-            rtl: false,
-            catalog: OnceLock::new(),
-        };
-        assert_eq!(tr(Lang(&BROKEN), "File"), "File");
-        assert_eq!(trn(Lang(&BROKEN), 2, "{n} page", "{n} pages"), "2 pages");
-    }
-
-    #[test]
-    fn contextual_id_and_plural_lookups_have_english_fallbacks() {
-        static TEST: LangInfo = LangInfo {
-            code: "test",
-            name: "Test catalog",
-            source: "\tLight\tPlain light\nweight\tLight\tThin\n@id\tfile.open\tOpen dialog…\n@plural\t{n} page|{n} pages\tOne page: {n}|Many pages: {n}\n",
-            plural: plural_one_other,
-            rtl: false,
-            catalog: OnceLock::new(),
-        };
-        let l = Lang(&TEST);
-        assert_eq!(tr_ctx(l, "weight", "Light"), "Thin");
-        assert_eq!(tr_ctx(l, "theme", "Light"), "Plain light");
-        assert_eq!(tr_ctx(l, "theme", "Unknown"), "Unknown");
-        assert_eq!(tr_id(l, "file.open", "Reworded English…"), "Open dialog…");
-        assert_eq!(tr_id(l, "unknown", "Light"), "Plain light");
-        assert_eq!(tr_id(l, "unknown", "Unknown"), "Unknown");
-        assert_eq!(trn(l, 1, "{n} page", "{n} pages"), "One page: 1");
-        assert_eq!(trn(l, 0, "{n} page", "{n} pages"), "Many pages: 0");
-        assert_eq!(trn(l, u64::MAX, "{n} page", "{n} pages"), format!("Many pages: {}", u64::MAX));
-    }
-
-    #[test]
-    fn formatting_reorders_parameters_without_reinterpreting_user_text() {
-        let args = [("file", "日本語-{n}.pdf"), ("n", "2")];
-        assert_eq!(fmt("{n}: {file}; {unknown}", &args), "2: 日本語-{n}.pdf; {unknown}");
-        assert_eq!(fmt("{file} / {file}", &args), "日本語-{n}.pdf / 日本語-{n}.pdf");
-        assert_eq!(fmt("text {unfinished", &args), "text {unfinished");
-        assert_eq!(fmt("}{n}{", &args), "}2{");
-        assert_eq!(fmt("unchanged", &[]), "unchanged");
-    }
-
-    /// Every literal passed to `tl!(…)` or `crate::i18n::t(…)` in the UI source (test modules
-    /// aside), unescaped, including literals on a line of their own.
-    fn ui_literals() -> std::collections::BTreeSet<String> {
-        let mut stack = vec![std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
-        let mut literals = std::collections::BTreeSet::new();
-        while let Some(dir) = stack.pop() {
-            for entry in std::fs::read_dir(dir).expect("UI source directory") {
-                let path = entry.expect("UI source entry").path();
-                if path.is_dir() {
-                    if path.file_name().is_some_and(|name| name != "i18n") {
-                        stack.push(path);
-                    }
-                } else if path.extension().is_some_and(|ext| ext == "rs") {
-                    let source = std::fs::read_to_string(path).expect("UI source file").replace("\r\n", "\n");
-                    let source = source.replace("crate::i18n::t(", "tl!(");
-                    let mut rest = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
-                    while let Some((_, after)) = rest.split_once("tl!(") {
-                        let after = after.trim_start();
-                        let Some(after) = after.strip_prefix('"') else {
-                            rest = after;
-                            continue;
-                        };
-                        let mut escaped = false;
-                        let end = after
-                            .char_indices()
-                            .find_map(|(i, c)| {
-                                if c == '"' && !escaped {
-                                    return Some(i);
-                                }
-                                escaped = c == '\\' && !escaped;
-                                None
-                            })
-                            .expect("closed tl! literal");
-                        let (raw, tail) = after.split_at(end);
-                        let argument_end = tail.strip_prefix('"').expect("closing quote").trim_start();
-                        let literal_call =
-                            argument_end.starts_with(')') || argument_end.strip_prefix(',').is_some_and(|rest| rest.trim_start().starts_with(')'));
-                        if literal_call {
-                            let label: String = serde_json::from_str(&format!("\"{raw}\"")).expect("UI literal escapes");
-                            literals.insert(label);
-                        }
-                        rest = tail.strip_prefix('"').expect("closing quote");
-                    }
-                }
-            }
-        }
-        literals
-    }
-
-    /// Each translated label of a visible signature that runs into its value keeps a separator
-    /// at its end.
-    #[test]
-    fn signature_appearance_labels_keep_their_separator() {
-        let english = pdfcraft_engine::sign::AppearanceLabels::default();
-        for language in LANGUAGES.iter().filter(|language| !language.source.is_empty()) {
-            let lang = Lang::from_code(language.code).expect("registered language");
-            for (field, label) in english.fields() {
-                let said = tr(lang, label);
-                if field != "signed_by" && !lang.rtl() {
-                    assert!(said.ends_with(' ') || said.ends_with('：'), "{}: the {field} label runs into its value: {said:?}", language.code);
-                }
-            }
-        }
-    }
-
-    /// With craft-fonts, every Japanese translation has glyphs: with all interface faces (desktop)
-    /// and with BIZ UDPGothic Regular alone (the web build's only Japanese face).
-    #[test]
-    fn japanese_labels_have_glyphs() {
-        let craft = pdfcraft_fonts::ui_japanese_fonts();
-        let Some(web) = craft.iter().find(|f| f.family == "BIZ UDPGothic" && f.style == "Regular") else {
-            eprintln!("skipping Japanese glyph checks: build with CRAFT_FONTS_DIR to run them");
-            return;
-        };
-        let (entries, _) = parse_entries(JA().0.source, 1);
-        let labels: String = entries.iter().flat_map(|e| e.translation.chars()).chain(JA().name().chars()).filter(|c| !c.is_control()).collect();
-        let web_name = web.name();
-        let mut web_only = crate::theme::font_definitions();
-        for family in web_only.families.values_mut() {
-            family.retain(|name| !pdfcraft_fonts::CRAFT_FONTS.iter().any(|face| face.name() == *name) || *name == web_name);
-        }
-        use egui::epaint::text::{Fonts, TextOptions};
-        for (build, defs) in [("desktop", crate::theme::font_definitions()), ("web", web_only)] {
-            let mut fonts = Fonts::new(TextOptions::default(), defs);
-            for id in [egui::FontId::proportional(13.0), egui::FontId::monospace(13.0), crate::theme::medium(13.0), crate::theme::semibold(17.0)] {
-                assert!(fonts.has_glyphs(&id, &labels), "{build}: {id:?} lacks a Japanese label glyph");
-            }
-        }
-    }
-
-    #[test]
-    fn history_labels_keep_captured_names() {
-        set_current(JA());
-        assert_eq!(action_label("Insert pages from Save {e}.pdf"), "Save {e}.pdf からページを挿入");
-        assert_eq!(command_label("Undo Insert pages from Save {e}.pdf"), "取り消し Save {e}.pdf からページを挿入");
-        assert_eq!(action_label("Untranslated custom action"), "Untranslated custom action");
-        assert_eq!(menu_label("file.open", "Open…"), "開く…");
-        set_current(Lang::EN);
-        assert_eq!(command_label("Undo Fill in Save {e}"), "Undo Fill in Save {e}");
-    }
-
-    #[test]
-    fn current_language_is_per_thread() {
-        set_current(JA());
-        assert_eq!(t("File"), "ファイル");
-        std::thread::spawn(|| assert_eq!(current(), Lang::EN)).join().unwrap();
-        set_current(Lang::EN);
-        assert_eq!(t("File"), "File");
-    }
-
-    #[test]
-    fn plurals_and_placeholders() {
-        assert_eq!(trn(Lang::EN, 1, "{n} item", "{n} items"), "1 item");
-        assert_eq!(trn(Lang::EN, 0, "{n} item", "{n} items"), "0 items");
-        assert_eq!(trn(Lang::EN, 7, "{n} item", "{n} items"), "7 items");
-        // No catalog has this `@plural` entry: Japanese falls back to the English forms.
-        assert_eq!(trn(JA(), 7, "{n} test item", "{n} test items"), "7 test items");
-        assert_eq!(fmt("{b} before {a}", &[("a", "x"), ("b", "y"), ("c", "z")]), "y before x");
-        assert_eq!(fmt("{missing}", &[]), "{missing}");
-        assert_eq!(placeholders("a {x} b {y} {"), ["x", "y"]);
-    }
-
-    #[test]
-    fn language_persists_and_invalid_input_keeps_current_language() {
-        let mut app = crate::PdfCraftApp::default();
-        assert_eq!(app.language, AUTO);
-        app.set_option("language", "JA").unwrap();
-        assert_eq!(app.language, "ja");
-        assert!(app.set_option("language", "xx").is_err());
-        assert_eq!(app.language, "ja");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "ja");
-        restored.restore(r#"{"language":"xx"}"#);
-        assert_eq!(restored.language, "ja");
-        app.set_option("language", AUTO).unwrap();
-        assert_eq!(app.language, AUTO);
-        // Settings written before the system-locale default (no key) follow the system.
-        let mut legacy = crate::PdfCraftApp::default();
-        legacy.restore("{}");
-        assert_eq!(legacy.language, AUTO);
-    }
-
-    #[test]
-    fn brazilian_portuguese_is_registered() {
-        let pt = Lang::from_code("pt-br").expect("pt-br registered");
-        assert_eq!(pt.name(), "Português (Brasil)");
-        assert_eq!(Lang::from_code("PT-BR"), Some(pt));
-        assert_eq!(normalize_pref("pt-BR"), Some("pt-br"));
-        assert_eq!(normalize_pref("pt"), None, "only exact codes are preferences");
-        assert_eq!(lang_from_tag("pt_BR.UTF-8"), Some(pt));
-        assert_eq!(lang_from_tag("pt_PT"), Some(pt));
-        assert_eq!(tr(pt, "Arquivo do usuário.pdf"), "Arquivo do usuário.pdf");
-        assert_eq!((0..=3).map(|n| (pt.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "pt-br").unwrap();
-        assert_eq!(app.language, "pt-br");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "pt-br");
-    }
-
-    #[test]
-    fn spanish_is_registered() {
-        let es = Lang::from_code("es").expect("es registered");
-        assert_eq!(es.name(), "Español");
-        assert_eq!(normalize_pref("ES"), Some("es"));
-        assert_eq!(lang_from_tag("es_ES.UTF-8"), Some(es));
-        assert_eq!(lang_from_tag("es-MX"), Some(es));
-        assert_eq!(first_supported("es-ES\r\nen-US"), Some(es));
-        assert_eq!(tr(es, "Informe del usuario.pdf"), "Informe del usuario.pdf");
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "es").unwrap();
-        assert_eq!(app.language, "es");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "es");
-    }
-
-    /// Each sentence the engine words for itself keeps its holes when it is said in Spanish, so
-    /// the document's own words still have somewhere to go: a translation that drops `{p}` or
-    /// `{}` would read as a sentence about nothing in particular.
-    #[test]
-    fn spanish_keeps_the_holes_in_what_the_engine_says() {
-        let es = Lang::from_code("es").expect("es registered");
-        let lists: [&[&str]; 5] = [
-            pdfcraft_engine::a11y::WORDINGS,
-            pdfcraft_engine::pdfa::WORDINGS,
-            pdfcraft_engine::sign::pdf::WORDINGS,
-            pdfcraft_engine::print::WORDINGS,
-            pdfcraft_engine::field_table::WORDINGS,
-        ];
-        for wording in lists.into_iter().flatten() {
-            let said = tr(es, wording);
-            // `{}` is one hole; `{name}` holes are named, and each name must survive by itself.
-            assert_eq!(wording.matches("{}").count(), said.matches("{}").count(), "the Spanish of {wording:?} loses a hole: {said:?}");
-            for hole in wording.split('{').skip(1).filter_map(|rest| rest.split_once('}')).map(|(name, _)| name).filter(|n| !n.is_empty()) {
-                assert!(said.contains(&format!("{{{hole}}}")), "the Spanish of {wording:?} loses {{{hole}}}: {said:?}");
-            }
-        }
-    }
-
-    #[test]
-    fn telugu_is_registered() {
-        let te = Lang::from_code("te").expect("te registered");
-        assert_eq!(te.name(), "తెలుగు");
-        assert_eq!(normalize_pref("TE"), Some("te"));
-        assert_eq!(lang_from_tag("te_IN.UTF-8"), Some(te));
-        assert_eq!(first_supported("te-IN\r\nen-US"), Some(te));
-        assert_eq!(tr(te, "నివేదిక.pdf"), "నివేదిక.pdf");
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "te").unwrap();
-        assert_eq!(app.language, "te");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "te");
-    }
-
-    /// Telugu puts the verb last, so it translates "Undo {action}" as a whole phrase; a catalog
-    /// without that entry (Spanish) keeps the verb in front of the action.
-    #[test]
-    fn undo_and_redo_labels_use_the_catalog_phrase_when_there_is_one() {
-        let te = Lang::from_code("te").expect("te registered");
-        set_current(te);
-        assert_eq!(command_label("Undo"), "రద్దు చేయి");
-        assert_eq!(command_label("Undo Untranslated custom action"), "రద్దు చేయి: Untranslated custom action");
-        assert_eq!(command_label("Redo Untranslated custom action"), "మళ్లీ చేయి: Untranslated custom action");
-        let es = Lang::from_code("es").expect("es registered");
-        set_current(es);
-        assert_eq!(command_label("Undo Untranslated custom action"), format!("{} Untranslated custom action", tr(es, "Undo")));
-        set_current(Lang::EN);
-        assert_eq!(command_label("Undo Untranslated custom action"), "Undo Untranslated custom action");
-    }
-
-    /// A label that reads differently by use has its own contextual entry where a language needs
-    /// one; a language without it falls back to the plain translation.
-    #[test]
-    fn contextual_labels_fall_back_to_the_plain_translation() {
-        let te = Lang::from_code("te").expect("te registered");
-        assert_eq!(tr_ctx(te, "signature pad", "Type"), "టైప్ చేయి");
-        assert_eq!(tr(te, "Type"), "రకం");
-        // A context no catalog defines, so the fallback stays tested as catalogs fill their gaps.
-        let es = Lang::from_code("es").expect("es registered");
-        assert_eq!(tr_ctx(es, "no such context", "Type"), tr(es, "Type"));
-    }
-
-    /// With a craft-fonts Telugu face, every Telugu translation has glyphs: with all interface
-    /// faces (desktop) and with the Telugu face as the only craft-fonts face (the web build keeps
-    /// it; Telugu labels must not need a Japanese or Arabic face).
-    #[test]
-    fn telugu_labels_have_glyphs() {
-        let telugu: Vec<String> = pdfcraft_fonts::ui_telugu_fonts().iter().map(|f| f.name()).collect();
-        if telugu.is_empty() {
-            eprintln!("skipping Telugu glyph checks: build with CRAFT_FONTS_DIR and a Telugu face to run them");
-            return;
-        }
-        let te = Lang::from_code("te").expect("te registered");
-        let (entries, _) = parse_entries(te.0.source, te.0.plural_forms());
-        let labels: String = entries.iter().flat_map(|e| e.translation.chars()).chain(te.name().chars()).filter(|c| !c.is_control()).collect();
-        let mut telugu_only = crate::theme::font_definitions();
-        for family in telugu_only.families.values_mut() {
-            family.retain(|name| !pdfcraft_fonts::CRAFT_FONTS.iter().any(|face| face.name() == *name) || telugu.contains(name));
-        }
-        use egui::epaint::text::{Fonts, TextOptions};
-        for (build, defs) in [("all faces", crate::theme::font_definitions()), ("Telugu face only", telugu_only)] {
-            let mut fonts = Fonts::new(TextOptions::default(), defs);
-            for id in [egui::FontId::proportional(13.0), egui::FontId::monospace(13.0), crate::theme::medium(13.0), crate::theme::semibold(17.0)] {
-                assert!(fonts.has_glyphs(&id, &labels), "{build}: {id:?} lacks a Telugu label glyph");
-            }
-        }
-    }
-
-    #[test]
-    fn czech_is_registered_and_persists() {
-        let cs = Lang::from_code("cs").expect("cs registered");
-        assert_eq!(cs.name(), "Čeština");
-        assert_eq!(tr(cs, "Žluťoučký kůň.pdf"), "Žluťoučký kůň.pdf");
-        assert_eq!((0..=6).map(|n| (cs.0.plural)(n)).collect::<Vec<_>>(), [2, 0, 1, 1, 1, 2, 2]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "cs").unwrap();
-        assert!(app.set_option("language", "cz").is_err());
-        assert_eq!(app.language, "cs");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "cs");
-    }
-
-    #[test]
-    fn turkish_is_registered_and_persists() {
-        let tr_lang = Lang::from_code("tr").expect("tr registered");
-        assert_eq!(tr_lang.name(), "Türkçe");
-        assert_eq!(tr(tr_lang, "Türkçe Belge.pdf"), "Türkçe Belge.pdf");
-        assert_eq!((0..=6).map(|n| (tr_lang.0.plural)(n)).collect::<Vec<_>>(), [0; 7]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "tr").unwrap();
-        assert!(app.set_option("language", "tu").is_err());
-        assert_eq!(app.language, "tr");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "tr");
-    }
-
-    /// The code joins some labels with a space at either end, so these catalogs keep exactly the
-    /// source's, and write … rather than three dots.
-    #[test]
-    fn catalog_rows_keep_the_source_spacing_and_ellipsis() {
-        let edges = |s: &str| (s.len() - s.trim_start().len(), s.len() - s.trim_end().len());
-        for code in ["cs", "tr", "vi"] {
-            let lang = Lang::from_code(code).expect("registered");
-            let (entries, errors) = parse_entries(lang.0.source, lang.0.plural_forms());
-            assert!(errors.is_empty(), "{code}: {errors:?}");
-            for e in &entries {
-                assert!(!e.translation.contains("..."), "{code}: use … rather than three dots: {:?}", e.translation);
-                assert_eq!(edges(&e.translation), edges(&e.source), "{code}: stray whitespace: {:?}", e.translation);
-            }
-        }
-    }
-
-    #[test]
-    fn simplified_chinese_is_registered() {
-        let zh = Lang::from_code("zh-hans").expect("zh-hans registered");
-        assert_eq!(zh.name(), "简体中文");
-        assert_eq!(normalize_pref("zh-Hans"), Some("zh-hans"));
-        assert_eq!(normalize_pref("zh"), None, "only exact codes are preferences");
-        assert_eq!(tr(zh, "报告.pdf"), "报告.pdf");
-    }
-
-    #[test]
-    fn traditional_chinese_is_registered() {
-        let zh = Lang::from_code("zh-hant").expect("zh-hant registered");
-        assert_eq!(zh.name(), "繁體中文");
-        assert_eq!(normalize_pref("zh-Hant"), Some("zh-hant"));
-        assert_eq!(tr(zh, "報告.pdf"), "報告.pdf");
-    }
-
-    #[test]
-    fn french_is_registered() {
-        let fr = Lang::from_code("fr").expect("fr registered");
-        assert_eq!(fr.name(), "Français");
-        assert_eq!(normalize_pref("FR"), Some("fr"));
-        assert_eq!(lang_from_tag("fr_FR.UTF-8"), Some(fr));
-        assert_eq!(lang_from_tag("fr-CA"), Some(fr));
-        assert_eq!(first_supported("fr-FR\r\nen-US"), Some(fr));
-        assert_eq!(tr(fr, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
-        assert_eq!((0..=3).map(|n| (fr.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "fr").unwrap();
-        assert_eq!(app.language, "fr");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "fr");
-    }
-
-    #[test]
-    fn german_is_registered() {
-        let de = Lang::from_code("de").expect("de registered");
-        assert_eq!(de.name(), "Deutsch");
-        assert_eq!(normalize_pref("DE"), Some("de"));
-        assert_eq!(lang_from_tag("de_DE.UTF-8"), Some(de));
-        assert_eq!(lang_from_tag("de-AT"), Some(de));
-        assert_eq!(lang_from_tag("de_CH"), Some(de));
-        assert_eq!(first_supported("de-DE\r\nen-US"), Some(de));
-        assert_eq!(tr(de, "Bericht des Nutzers.pdf"), "Bericht des Nutzers.pdf");
-        assert_eq!((0..=3).map(|n| (de.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "de").unwrap();
-        assert_eq!(app.language, "de");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "de");
-    }
-
-    #[test]
-    fn tool_names_inside_sentences_are_lowercased_except_in_german() {
-        set_current(Lang::EN);
-        assert_eq!(in_sentence("Text Box"), "text box");
-        set_current(Lang::from_code("de").expect("de registered"));
-        assert_eq!(in_sentence("Textfeld"), "Textfeld");
-        set_current(Lang::EN);
-    }
-
-    #[test]
-    fn turkish_keeps_its_dotted_and_dotless_i_when_changing_case() {
-        set_current(Lang::from_code("tr").expect("tr registered"));
-        assert_eq!(upper_label("Advanced"), "GELİŞMİŞ");
-        assert_eq!(upper_label("Signatures"), "İMZALAR");
-        // A label with no Turkish row is still English and keeps the English rule.
-        assert_eq!(upper_label("Untranslated title"), "UNTRANSLATED TITLE");
-        assert_eq!(in_sentence("İmza Alanı"), "imza alanı");
-        assert_eq!(in_sentence("Işık"), "ışık");
-        set_current(Lang::EN);
-        assert_eq!(upper_label("Advanced"), "ADVANCED");
-        assert_eq!(in_sentence("Image"), "image");
-    }
-
-    #[test]
-    fn russian_is_registered() {
-        let ru = Lang::from_code("ru").expect("ru registered");
-        assert_eq!(ru.name(), "Русский");
-        assert_eq!(normalize_pref("RU"), Some("ru"));
-        assert_eq!(lang_from_tag("ru_RU.UTF-8"), Some(ru));
-        assert_eq!(lang_from_tag("ru-BY"), Some(ru));
-        assert_eq!(first_supported("ru-RU\r\nen-US"), Some(ru));
-        assert_eq!(tr(ru, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
-        // one (1), few (2-4), many (0, 5+), with 11-14 exception
-        assert_eq!((0..=3).map(|n| (ru.0.plural)(n)).collect::<Vec<_>>(), [2, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "ru").unwrap();
-        assert_eq!(app.language, "ru");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "ru");
-    }
-
-    #[test]
-    fn finnish_is_registered_and_persists() {
-        let fi = Lang::from_code("fi").expect("fi registered");
-        assert_eq!(fi.name(), "Suomi");
-        assert_eq!(normalize_pref("FI"), Some("fi"));
-        for tag in ["fi", "fi-FI", "fi_FI.UTF-8", "FI-fi"] {
-            assert_eq!(lang_from_tag(tag), Some(fi), "{tag}");
-        }
-        // Filipino (`fil`) and Swedish in Finland (`sv-FI`) don't pick Finnish.
-        assert_ne!(lang_from_tag("fil"), Some(fi));
-        assert_ne!(lang_from_tag("sv-FI"), Some(fi));
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "FI").unwrap();
-        assert_eq!(app.language, "fi");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "fi");
-    }
-
-    #[test]
-    fn lithuanian_is_registered_and_persists() {
-        let lt = Lang::from_code("lt").expect("lt registered");
-        assert_eq!(lt.name(), "Lietuvių");
-        assert_eq!(normalize_pref("LT"), Some("lt"));
-        for tag in ["lt", "lt-LT", "lt_LT.UTF-8", "LT-lt"] {
-            assert_eq!(lang_from_tag(tag), Some(lt), "{tag}");
-        }
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "LT").unwrap();
-        assert_eq!(app.language, "lt");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "lt");
-        assert!(restored.set_option("language", "xx").is_err());
-    }
-
-    #[test]
-    fn norwegian_bokmal_is_registered_and_persists() {
-        let nb = Lang::from_code("nb").expect("nb registered");
-        assert_eq!(nb.name(), "Norsk bokmål");
-        assert_eq!(normalize_pref("NB"), Some("nb"));
-        assert_eq!(normalize_pref("no"), None, "only exact codes are preferences");
-        // Current systems say `nb`; older ones and some Linux setups say `no`. Nynorsk is `nn`.
-        for tag in ["nb", "nb-NO", "nb_NO.UTF-8", "no", "no_NO.UTF-8", "NO-no", "nn", "nn_NO.UTF-8"] {
-            assert_eq!(lang_from_tag(tag), Some(nb), "{tag}");
-        }
-        assert_eq!(first_supported("(\n    \"nb-NO\",\n    \"en-US\"\n)\n"), Some(nb));
-        assert_eq!(first_supported("nn-NO\r\nen-US\r\n"), Some(nb));
-        assert_eq!((0..=3).map(|n| (nb.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "NB").unwrap();
-        assert_eq!(app.language, "nb");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "nb");
-    }
-
-    #[test]
-    fn vietnamese_is_registered_and_persists() {
-        let vi = Lang::from_code("vi").expect("vi registered");
-        assert_eq!(vi.name(), "Tiếng Việt");
-        assert_eq!(normalize_pref("Vi"), Some("vi"));
-        for tag in ["vi", "vi-VN", "vi_VN.UTF-8", "VI-vn"] {
-            assert_eq!(lang_from_tag(tag), Some(vi), "{tag}");
-        }
-        assert_eq!(first_supported("vi-VN\r\nen-US"), Some(vi));
-        assert_eq!((0..=3).map(|n| (vi.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "vi").unwrap();
-        assert_eq!(app.language, "vi");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "vi");
-        assert!(restored.set_option("language", "xx").is_err());
-        assert_eq!(restored.language, "vi");
-    }
-
-    #[test]
-    fn romanian_is_registered_with_three_plural_forms() {
-        let ro = Lang::from_code("ro").expect("ro registered");
-        for tag in ["ro", "ro-RO", "ro_RO.UTF-8", "RO-ro", "ro-MD"] {
-            assert_eq!(lang_from_tag(tag), Some(ro), "{tag}");
-        }
-        assert_eq!(normalize_pref("Ro"), Some("ro"));
-        let info = LANGUAGES.iter().find(|language| language.code == "ro").expect("ro row");
-        assert_eq!(info.plural_forms(), 3);
-        // one: 1; few: 0 and n % 100 in 1..=19 ("2 pagini", "101 pagini"); other: the "de" form ("20 de pagini").
-        for (n, form) in [(1, 0), (0, 1), (2, 1), (19, 1), (101, 1), (119, 1), (20, 2), (100, 2), (120, 2), (1000, 2)] {
-            assert_eq!(plural_ro(n), form, "{n}");
-        }
-    }
-
-    #[test]
-    fn catalan_is_registered_and_persists() {
-        let ca = Lang::from_code("ca").expect("ca registered");
-        assert_eq!(ca.name(), "Català");
-        assert_eq!(normalize_pref("CA"), Some("ca"));
-        for tag in ["ca", "ca-ES", "ca_ES.UTF-8", "CA-es", "ca_ES@valencia"] {
-            assert_eq!(lang_from_tag(tag), Some(ca), "{tag}");
-        }
-        assert_eq!(first_supported("ca-ES\r\nen-US"), Some(ca));
-        // one (1), other (0, 2+), as in English
-        assert_eq!((0..=3).map(|n| (ca.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "CA").unwrap();
-        assert_eq!(app.language, "ca");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "ca");
-        assert!(restored.set_option("language", "xx").is_err());
-        assert_eq!(restored.language, "ca");
-    }
-
-    #[test]
-    fn slovene_is_registered_and_persists() {
-        let sl = Lang::from_code("sl").expect("sl registered");
-        assert_eq!(sl.name(), "Slovenščina");
-        assert_eq!(normalize_pref("SL"), Some("sl"));
-        for tag in ["sl", "sl-SI", "sl_SI.UTF-8", "SL-si", "sl_SI@variant"] {
-            assert_eq!(lang_from_tag(tag), Some(sl), "{tag}");
-        }
-        assert_eq!(first_supported("sl-SI\r\nen-US"), Some(sl));
-        assert_eq!(tr(sl, "Poročilo {n}.pdf"), "Poročilo {n}.pdf");
-        // one (1), two (2), few (3, 4), other (0, 5+)
-        assert_eq!((0..=5).map(|n| (sl.0.plural)(n)).collect::<Vec<_>>(), [3, 0, 1, 2, 2, 3]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "SL").unwrap();
-        assert_eq!(app.language, "sl");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "sl");
-        assert!(restored.set_option("language", "xx").is_err());
-        assert_eq!(restored.language, "sl");
-    }
-
-    #[test]
-    fn albanian_is_registered_and_persists() {
-        let sq = Lang::from_code("sq").expect("sq registered");
-        assert_eq!(sq.name(), "Shqip");
-        assert_eq!(normalize_pref("SQ"), Some("sq"));
-        for tag in ["sq", "sq-AL", "sq_AL.UTF-8", "SQ-xk", "sq_XK@variant"] {
-            assert_eq!(lang_from_tag(tag), Some(sq), "{tag}");
-        }
-        assert_eq!(first_supported("sq-AL\r\nen-US"), Some(sq));
-        // one (1), other (0, 2+)
-        assert_eq!((0..=3).map(|n| (sq.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "SQ").unwrap();
-        assert_eq!(app.language, "sq");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "sq");
-        assert!(restored.set_option("language", "xx").is_err());
-        assert_eq!(restored.language, "sq");
-    }
-
-    #[test]
-    fn slovene_plurals_cover_dual_few_teens_and_large_counts() {
-        let sl = Lang::from_code("sl").expect("sl registered");
-        assert_eq!(sl.0.plural_forms(), 4);
-        for (counts, form) in [
-            (vec![1, 101, 201, 1001, 1101], 0),
-            (vec![2, 102, 202, 1002], 1),
-            (vec![3, 4, 103, 104, 1003], 2),
-            (vec![0, 5, 10, 11, 12, 13, 14, 15, 20, 21, 22, 23, 24, 25, 31, 100, 111, 112, 121, 122, 1000, u64::MAX], 3),
-        ] {
-            for n in counts {
-                assert_eq!((sl.0.plural)(n), form, "{n}");
-            }
-        }
-    }
-
-    #[test]
-    fn indonesian_and_vietnamese_are_registered_and_persist() {
-        let id = Lang::from_code("id").expect("id registered");
-        let vi = Lang::from_code("vi").expect("vi registered");
-        assert_eq!(id.name(), "Bahasa Indonesia");
-        assert_eq!(vi.name(), "Tiếng Việt");
-        assert_eq!(normalize_pref("ID"), Some("id"));
-        assert_eq!(normalize_pref("Vi"), Some("vi"));
-        for tag in ["id", "id-ID", "id_ID.UTF-8", "ID-id"] {
-            assert_eq!(lang_from_tag(tag), Some(id), "{tag}");
-        }
-        for tag in ["vi", "vi-VN", "vi_VN.UTF-8", "VI-vn"] {
-            assert_eq!(lang_from_tag(tag), Some(vi), "{tag}");
-        }
-        assert_eq!(first_supported("id-ID\r\nen-US"), Some(id));
-        assert_eq!(first_supported("vi-VN\r\nen-US"), Some(vi));
-        // One CLDR plural form (CLDR `id`, `vi`): the message reads the same for every count.
-        assert_eq!((0..=3).map(|n| (id.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
-        assert_eq!((0..=3).map(|n| (vi.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "ID").unwrap();
-        assert_eq!(app.language, "id");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "id");
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "vi").unwrap();
-        assert_eq!(app.language, "vi");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "vi");
-        assert!(restored.set_option("language", "xx").is_err());
-        assert_eq!(restored.language, "vi");
-    }
-
-    #[test]
-    fn hindi_and_korean_are_registered_and_persist() {
-        let hi = Lang::from_code("hi").expect("hi registered");
-        let ko = Lang::from_code("ko").expect("ko registered");
-        assert_eq!(hi.name(), "हिन्दी");
-        assert_eq!(ko.name(), "한국어");
-        assert_eq!(normalize_pref("HI"), Some("hi"));
-        assert_eq!(normalize_pref("Ko"), Some("ko"));
-        for tag in ["hi", "hi-IN", "hi_IN.UTF-8", "HI-in"] {
-            assert_eq!(lang_from_tag(tag), Some(hi), "{tag}");
-        }
-        for tag in ["ko", "ko-KR", "ko_KR.UTF-8", "KO-kr"] {
-            assert_eq!(lang_from_tag(tag), Some(ko), "{tag}");
-        }
-        assert_eq!(first_supported("hi-IN\r\nen-US"), Some(hi));
-        assert_eq!(first_supported("ko-KR\r\nen-US"), Some(ko));
-        // One plural form per catalog: the message reads the same for every count.
-        assert_eq!((0..=3).map(|n| (hi.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
-        assert_eq!((0..=3).map(|n| (ko.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
-        for code in ["hi", "ko"] {
-            let mut app = crate::PdfCraftApp::default();
-            app.set_option("language", &code.to_uppercase()).unwrap();
-            assert_eq!(app.language, code);
-            let mut restored = crate::PdfCraftApp::default();
-            restored.restore(&app.persist());
-            assert_eq!(restored.language, code);
-            assert!(restored.set_option("language", "xx").is_err());
-            assert_eq!(restored.language, code);
-        }
-    }
-
-    #[test]
-    fn bulgarian_is_registered() {
-        let bg = Lang::from_code("bg").expect("bg registered");
-        assert_eq!(bg.name(), "Български");
-        assert_eq!(normalize_pref("BG"), Some("bg"));
-        assert_eq!(lang_from_tag("bg_BG.UTF-8"), Some(bg));
-        assert_eq!(lang_from_tag("bg-BG"), Some(bg));
-        assert_eq!(first_supported("bg-BG\r\nen-US"), Some(bg));
-        assert_eq!(tr(bg, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
-        // one (1), other (0, 2+)
-        assert_eq!((0..=3).map(|n| (bg.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "bg").unwrap();
-        assert_eq!(app.language, "bg");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "bg");
-    }
-
-    #[test]
-    fn hungarian_is_registered() {
-        let hu = Lang::from_code("hu").expect("hu registered");
-        assert_eq!(hu.name(), "Magyar");
-        assert_eq!(normalize_pref("HU"), Some("hu"));
-        assert_eq!(lang_from_tag("hu_HU.UTF-8"), Some(hu));
-        assert_eq!(lang_from_tag("hu-HU"), Some(hu));
-        assert_eq!(first_supported("hu-HU\r\nen-US"), Some(hu));
-        assert_eq!(tr(hu, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
-        // one (1), other (0, 2+)
-        assert_eq!((0..=3).map(|n| (hu.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "hu").unwrap();
-        assert_eq!(app.language, "hu");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "hu");
-    }
-
-    #[test]
-    fn ukrainian_is_registered_and_persists() {
-        let uk = Lang::from_code("uk").expect("uk registered");
-        assert_eq!(uk.name(), "Українська");
-        assert_eq!(normalize_pref("UK"), Some("uk"));
-        for tag in ["uk", "uk-UA", "uk_UA.UTF-8", "UK-ua", "uk_UA@variant"] {
-            assert_eq!(lang_from_tag(tag), Some(uk), "{tag}");
-        }
-        assert_eq!(first_supported("uk-UA\r\nen-US"), Some(uk));
-        assert_eq!(first_supported("(\n    \"uk-UA\",\n    \"en-US\"\n)\n"), Some(uk));
-        assert_eq!(tr(uk, "Звіт {n}.pdf"), "Звіт {n}.pdf");
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "UK").unwrap();
-        assert_eq!(app.language, "uk");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "uk");
-        assert!(restored.set_option("language", "xx").is_err());
-        assert_eq!(restored.language, "uk");
-    }
-
-    #[test]
-    fn ukrainian_integer_plurals_cover_teens_and_large_counts() {
-        let uk = Lang::from_code("uk").expect("uk registered");
-        assert_eq!(uk.0.plural_forms(), 3);
-        for (counts, form) in [
-            (vec![1, 21, 31, 101, 121, 1001], 0),
-            (vec![2, 3, 4, 22, 23, 24, 102, 104, 122, 1002], 1),
-            (vec![0, 5, 10, 11, 12, 13, 14, 19, 20, 25, 100, 110, 111, 112, 114, 1000, u64::MAX], 2),
-        ] {
-            for n in counts {
-                assert_eq!((uk.0.plural)(n), form, "{n}");
-            }
-        }
-    }
-
-    fn arabic() -> Lang {
-        Lang::from_code("ar").expect("ar registered")
-    }
-
-    #[test]
-    fn arabic_is_registered_and_persists() {
-        let ar = arabic();
-        assert_eq!(ar.name(), "العربية");
-        assert!(ar.rtl());
-        let rtl: Vec<&str> = Lang::all().filter(|l| l.rtl()).map(|l| l.code()).collect();
-        assert_eq!(rtl, ["ar", "ckb"], "Arabic and Kurdish are the right-to-left languages");
-        assert_eq!(normalize_pref("AR"), Some("ar"));
-        for tag in ["ar", "ar-MA", "ar_EG.UTF-8", "AR-sa", "ar_DZ@variant"] {
-            assert_eq!(lang_from_tag(tag), Some(ar), "{tag}");
-        }
-        assert_eq!(first_supported("ar-MA\r\nen-US"), Some(ar));
-        // Unknown strings and user text are never reordered by a lookup.
-        assert_eq!(tr(ar, "تقرير نهائي {n}.pdf"), "تقرير نهائي {n}.pdf");
-        let mut app = crate::PdfCraftApp::default();
-        app.set_option("language", "AR").unwrap();
-        assert_eq!(app.language, "ar");
-        let mut restored = crate::PdfCraftApp::default();
-        restored.restore(&app.persist());
-        assert_eq!(restored.language, "ar");
-        assert!(restored.set_option("language", "xx").is_err());
-        assert_eq!(restored.language, "ar");
-    }
-
-    /// Lookups return Arabic in display order: egui draws the words left to right as given, and
-    /// joins the letters of each word itself.
-    #[test]
-    fn arabic_lookups_are_in_display_order() {
-        let ar = arabic();
-        // "حفظ باسم…" as typed; the ellipsis ends the phrase on the left.
-        assert_eq!(tr(ar, "Save as…"), "…باسم حفظ");
-        // Latin names keep their own direction inside the phrase.
-        assert_eq!(tr(ar, "About PdfCraft"), "PdfCraft حول");
-        // A caption's colon stays beside the widget on its right.
-        assert_eq!(tr(ar, "Name:"), "الاسم:");
-        assert_eq!(tr(ar, "Issued by: "), "عن صادرة: ");
-        // Placeholders survive and are filled in place.
-        assert_eq!(tr(ar, "Couldn't open {name}: {e}"), "{name}: {e} فتح تعذّر");
-        assert_eq!(fmt(tr(ar, "Couldn't open {name}: {e}"), &[("name", "a {e}.pdf"), ("e", "x")]), "a {e}.pdf: x فتح تعذّر");
-        assert_eq!(fmt(tr(ar, "Page {p} of {n}"), &[("p", "3"), ("n", "12")]), "12 من 3 الصفحة");
-        set_current(ar);
-        assert_eq!(command_label("Undo Insert pages from a.pdf"), "a.pdf من صفحات إدراج عن التراجع");
-        assert_eq!(menu_label("file.saveAs", "Save as…"), "…باسم حفظ");
-        set_current(Lang::EN);
-    }
-
-    #[test]
-    fn arabic_plurals_follow_the_six_cldr_forms() {
-        let ar = arabic();
-        assert_eq!(ar.0.plural_forms(), 6);
-        let form = |n| (ar.0.plural)(n);
-        assert_eq!([0, 1, 2].map(form), [0, 1, 2]);
-        assert_eq!([3, 10, 103, 110, 1003].map(form), [3; 5]);
-        assert_eq!([11, 99, 111, 199, 1011].map(form), [4; 5]);
-        assert_eq!([100, 101, 102, 200, 1000, u64::MAX - 13].map(form), [5; 6]);
-    }
-
-    /// With a craft-fonts Arabic face, every Arabic translation has glyphs: with all interface
-    /// faces (desktop) and with the Arabic face as the only craft-fonts face (the web build keeps
-    /// it; Arabic labels must not need a Japanese face).
-    #[test]
-    fn arabic_labels_have_glyphs() {
-        let faces: Vec<String> = pdfcraft_fonts::ui_arabic_fonts().iter().map(|f| f.name()).collect();
-        if faces.is_empty() {
-            eprintln!("skipping Arabic glyph checks: build with CRAFT_FONTS_DIR and an Arabic face to run them");
-            return;
-        }
-        let ar = arabic();
-        let (entries, _) = parse_entries(ar.0.source, ar.0.plural_forms());
-        let labels: String = entries.iter().flat_map(|e| e.translation.chars()).chain(ar.name().chars()).filter(|c| !c.is_control()).collect();
-        let mut arabic_only = crate::theme::font_definitions();
-        for family in arabic_only.families.values_mut() {
-            family.retain(|name| !pdfcraft_fonts::CRAFT_FONTS.iter().any(|face| face.name() == *name) || faces.contains(name));
-        }
-        use egui::epaint::text::{Fonts, TextOptions};
-        for (build, defs) in [("all faces", crate::theme::font_definitions()), ("Arabic face only", arabic_only)] {
-            let mut fonts = Fonts::new(TextOptions::default(), defs);
-            for id in [egui::FontId::proportional(13.0), egui::FontId::monospace(13.0), crate::theme::medium(13.0), crate::theme::semibold(17.0)] {
-                let missing: std::collections::BTreeSet<char> = labels.chars().filter(|c| !fonts.has_glyphs(&id, &c.to_string())).collect();
-                assert!(missing.is_empty(), "{build}: {id:?} lacks Arabic label glyphs {missing:?}");
-            }
-        }
-    }
-
-    /// Every bundled catalog is well-formed and consistent with its sources.
-    #[test]
-    fn bundled_catalogs_are_consistent() {
-        let mut codes = std::collections::HashSet::new();
-        for l in &LANGUAGES {
-            assert!(codes.insert(l.code), "duplicate code {}", l.code);
-            assert!(l.code == l.code.to_ascii_lowercase() && !l.name.is_empty(), "{}", l.code);
-            let (entries, errors) = parse_entries(l.source, l.plural_forms());
-            assert!(errors.is_empty(), "{}: {errors:?}", l.code);
-            for e in entries.iter().filter(|e| e.context == "@id") {
-                let command = pdfcraft_engine::commands::command(&e.source);
-                let Some(command) = command else { panic!("{}: unknown command id {:?}", l.code, e.source) };
-                assert_eq!(placeholders(&e.translation), placeholders(command.label), "{}: {}", l.code, e.source);
-                assert_eq!(e.translation.ends_with('…'), command.label.ends_with('…'), "{}: ellipsis mismatch: {}", l.code, e.source);
-            }
-        }
-    }
-
-    /// The translation gaps report (`cargo xtask i18n-report`, a step of `cargo xtask ci`): for
-    /// each language, how many English strings it has no translation for, and the first few.
-    /// It never fails: a missing string shows in English.
-    ///
-    /// The English strings are the UI source's literals, the commands, All tools, the engine's
-    /// own wordings, and every key of every bundled catalog (which covers contextual, plural and
-    /// dynamically looked-up strings the scan can't see).
-    #[test]
-    fn translation_gaps_report() {
-        use std::collections::BTreeSet;
-        const SHOWN: usize = 3;
-        let mut plain: BTreeSet<String> = ui_literals();
-        let mut add = |s: &str| {
-            plain.insert(s.to_string());
-        };
-        for command in pdfcraft_engine::commands::COMMANDS {
-            add(command.label);
-            command.menu.into_iter().for_each(&mut add);
-        }
-        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
-            add(group.label);
-            for section in group.sections {
-                add(section.title);
-                section.items.iter().for_each(|item| add(item.label));
-            }
-        }
-        let engine: [&[&str]; 9] = [
-            pdfcraft_engine::a11y::WORDINGS,
-            pdfcraft_engine::a11y::REPORT_WORDS,
-            pdfcraft_engine::pdfa::WORDINGS,
-            pdfcraft_engine::sign::pdf::WORDINGS,
-            pdfcraft_engine::sign::pdf::kind::ALL,
-            pdfcraft_engine::print::WORDINGS,
-            pdfcraft_engine::EDIT_LABELS,
-            pdfcraft_engine::BATCH_LABELS,
-            pdfcraft_engine::field_table::WORDINGS,
-        ];
-        engine.into_iter().flatten().for_each(|s| add(s));
-        pdfcraft_engine::sign::AppearanceLabels::default().fields().into_iter().for_each(|(_, label)| add(label));
-        crate::credits::NameMode::ALL.iter().for_each(|mode| add(mode.label()));
-        for key in crate::credits::SortKey::ALL {
-            let (label, header) = key.label();
-            add(label);
-            add(header);
-        }
-        crate::credits::MODEL_COLUMNS.iter().for_each(|s| add(s));
-        // (context, source) keys; `@id` rows only reword a command label, which is in `plain`.
-        let mut keys: BTreeSet<(String, String)> = plain.into_iter().map(|s| (String::new(), s)).collect();
-        for language in &LANGUAGES {
-            let (entries, _) = parse_entries(language.source, language.plural_forms());
-            keys.extend(entries.into_iter().filter(|e| e.context != "@id").map(|e| (e.context, e.source)));
-        }
-        let mut report = format!("Translation gaps: {} English strings\n", keys.len());
-        for lang in Lang::all().filter(|l| *l != Lang::EN) {
-            let catalog = lang.catalog();
-            let missing: Vec<&(String, String)> = keys
-                .iter()
-                .filter(|(context, source)| match context.as_str() {
-                    "" => catalog.plain(source).is_none(),
-                    "@plural" => source.split_once('|').is_none_or(|(one, other)| catalog.plural(one, other, 0).is_none()),
-                    // A contextual lookup falls back to the plain translation.
-                    context => catalog.contextual(context, source).is_none() && catalog.plain(source).is_none(),
-                })
-                .collect();
-            let mut line = format!("  {:<8} {:>5} missing", lang.code(), missing.len());
-            for (i, (context, source)) in missing.iter().take(SHOWN).enumerate() {
-                let mut shown: String = source.chars().take(48).collect();
-                if shown.len() < source.len() {
-                    shown.push('…');
-                }
-                let key = if context.is_empty() { format!("{shown:?}") } else { format!("{context} / {shown:?}") };
-                line.push_str(if i == 0 { ": " } else { ", " });
-                line.push_str(&key);
-            }
-            if missing.len() > SHOWN {
-                line.push_str(", …");
-            }
-            report.push_str(&line);
-            report.push('\n');
-        }
-        println!("{REPORT_START}\n{report}{REPORT_END}");
-    }
-
-    /// The lines `cargo xtask i18n-report` prints from the test output lie between these.
-    const REPORT_START: &str = "=== translation gaps ===";
-    const REPORT_END: &str = "=== end of translation gaps ===";
-
-    /// Preferences ▸ Date format ▸ Language offers exactly the interface languages, in order.
-    #[test]
-    fn date_languages_are_the_interface_languages() {
-        let interface: Vec<(&str, &str)> = Lang::all().map(|l| (l.code(), l.name())).collect();
-        let dates: Vec<(&str, &str)> = pdfcraft_engine::dates::DATE_LANGUAGES.iter().map(|l| (l.code, l.name)).collect();
-        assert_eq!(dates, interface);
-    }
-}
-
-#[cfg(test)]
-mod picker_order_tests {
-    use super::*;
-
-    #[test]
-    fn picker_lists_english_first_then_names_alphabetically() {
-        let order = Lang::for_picker();
-        assert_eq!(order.first().map(|l| l.code()), Some(Lang::EN.code()));
-        assert_eq!(order.len(), Lang::all().count());
-        let keys: Vec<String> = order[1..].iter().map(|l| name_sort_key(l.name())).collect();
-        assert!(keys.windows(2).all(|w| w[0] <= w[1]), "{keys:?}");
-        assert_eq!(name_sort_key("Čeština"), "cestina");
-        assert_eq!(name_sort_key("Türkçe"), "turkce");
-    }
-}
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 5930aff85a..6f1739974a 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -1020,6 +1020,15 @@
 	Scroll tabs right	Rull faner til høyre
 	Search comments	Søk i kommentarer
 	Search tools and commands…	Søk etter verktøy og kommandoer…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Lagt til tekst
+	Link URL	URL for lenken
+	Search tools and commands	Søk etter verktøy og kommandoer
+	Text editing line	Tekstredigeringslinje
+	Text to place	Tekst som skal plasseres
+	Tooltip	Verktøytips
+	Words or phrases to redact	Ord eller fraser som skal sladdes
 	Searchable Image (Exact)	Søkbart bilde (eksakt)
 	Searching… {s} of {p} pages	Søker… {s} av {p} sider
 	Searching… {s}/{p}	Søker… {s}/{p}
@@ -2614,6 +2623,14 @@
 	Make properties default	Bruk egenskapene som standard
 	Pages selected	Valgte sider
 	Page properties	Sideegenskaper
+	Create & Edit	Opprett og rediger
+	Review & Compare	Gjennomgå og sammenlign
+	Forms & Signatures	Skjemaer og signaturer
+	Protect & Standardize	Beskytt og standardiser
+	Customize & Automate	Tilpass og automatiser
+	No tools match your search.	Ingen verktøy samsvarer med søket.
+	Expand all tools	Utvid alle verktøy
+	Collapse all tools	Fold sammen alle verktøy
 	Cut Image	Klipp ut bilde
 	Redact Image	Sladd bilde
 	Create Link…	Opprett lenke…
@@ -2707,3 +2724,12 @@ key	Space	Mellomrom
 
 # AI-assisted additions for restoring the last view (#1767) (2026-10-22); not reviewed by a native speaker.
 	Restore the last view (page, zoom and page display) when a document is opened again	Gjenopprett den siste visningen (side, zoom og sidevisning) når et dokument åpnes igjen
+@plural	{n} reply|{n} replies	{n} svar|{n} svar
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Sideverktøy
+	Insert pages from a file after the selection…	Sett inn sider fra en fil etter utvalget…
+	Rotate the selected pages counterclockwise	Roter de valgte sidene mot klokken
+	Rotate the selected pages clockwise	Roter de valgte sidene med klokken
+	Extract the selected pages…	Trekk ut de valgte sidene…
+	Delete the selected pages	Slett de valgte sidene
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 0461ad8148..963d717584 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -180,6 +180,15 @@
 	Available	Dostępne
 	Ready	Gotowe
 	Search tools and commands…	Szukaj narzędzi i poleceń…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Dodany tekst
+	Link URL	Adres URL łącza
+	Search tools and commands	Szukaj narzędzi i poleceń
+	Text editing line	Wiersz edycji tekstu
+	Text to place	Tekst do umieszczenia
+	Tooltip	Podpowiedź
+	Words or phrases to redact	Słowa lub frazy do utajenia
 	No matching tools	Brak pasujących narzędzi
 	Tool	Narzędzie
 	Command	Polecenie
@@ -2465,6 +2474,14 @@ animation effects	Off	Wyłączone
 	Make properties default	Ustaw właściwości jako domyślne
 	Pages selected	Zaznaczone strony
 	Page properties	Właściwości strony
+	Create & Edit	Tworzenie i edycja
+	Review & Compare	Recenzja i porównanie
+	Forms & Signatures	Formularze i podpisy
+	Protect & Standardize	Ochrona i standaryzacja
+	Customize & Automate	Dostosowanie i automatyzacja
+	No tools match your search.	Żadne narzędzie nie pasuje do wyszukiwania.
+	Expand all tools	Rozwiń wszystkie narzędzia
+	Collapse all tools	Zwiń wszystkie narzędzia
 	Attach a file…	Dołącz plik…
 	Delete attachment	Usuń załącznik
 	Attaching files is not available on the web yet	Dołączanie plików nie jest jeszcze dostępne w wersji webowej
@@ -2627,3 +2644,12 @@ animation effects	Off	Wyłączone
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Dzisiaj
+@plural	{n} reply|{n} replies	{n} odpowiedź|{n} odpowiedzi|{n} odpowiedzi
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Narzędzia stron
+	Insert pages from a file after the selection…	Wstaw strony z pliku po zaznaczeniu…
+	Rotate the selected pages counterclockwise	Obróć zaznaczone strony w lewo
+	Rotate the selected pages clockwise	Obróć zaznaczone strony w prawo
+	Extract the selected pages…	Wyodrębnij zaznaczone strony…
+	Delete the selected pages	Usuń zaznaczone strony
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 310e051e2d..c34ae83bc5 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -1705,6 +1705,15 @@
 	Tool	Ferramenta
 	Command	Comando
 	Search tools and commands…	Pesquisar ferramentas e comandos…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Texto adicionado
+	Link URL	URL do link
+	Search tools and commands	Pesquisar ferramentas e comandos
+	Text editing line	Linha de edição de texto
+	Text to place	Texto a colocar
+	Tooltip	Dica de ferramenta
+	Words or phrases to redact	Palavras ou frases para ocultar
 	No matching tools	Nenhuma ferramenta correspondente
 	All tools	Todas as ferramentas
 	Read	Ler
@@ -2503,6 +2512,14 @@ animation effects	Off	Desativados
 	Make properties default	Tornar propriedades padrão
 	Pages selected	Páginas selecionadas
 	Page properties	Propriedades da página
+	Create & Edit	Criar e editar
+	Review & Compare	Revisar e comparar
+	Forms & Signatures	Formulários e assinaturas
+	Protect & Standardize	Proteger e padronizar
+	Customize & Automate	Personalizar e automatizar
+	No tools match your search.	Nenhuma ferramenta corresponde à pesquisa.
+	Expand all tools	Expandir todas as ferramentas
+	Collapse all tools	Recolher todas as ferramentas
 	Attach a file…	Anexar um arquivo…
 	Delete attachment	Excluir anexo
 	Attaching files is not available on the web yet	Anexar arquivos ainda não está disponível na web
@@ -2816,3 +2833,12 @@ theme	Appearance	Aparência
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hoje
+@plural	{n} reply|{n} replies	{n} resposta|{n} respostas
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Ferramentas de página
+	Insert pages from a file after the selection…	Inserir páginas de um arquivo após a seleção…
+	Rotate the selected pages counterclockwise	Girar as páginas selecionadas no sentido anti-horário
+	Rotate the selected pages clockwise	Girar as páginas selecionadas no sentido horário
+	Extract the selected pages…	Extrair as páginas selecionadas…
+	Delete the selected pages	Excluir as páginas selecionadas
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 85ac9e8617..78d2298b93 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -1020,6 +1020,15 @@
 	Scroll tabs right	Derulare file la dreapta
 	Search comments	Căutare în comentarii
 	Search tools and commands…	Căutare instrumente și comenzi…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Text adăugat
+	Link URL	URL-ul linkului
+	Search tools and commands	Căutare instrumente și comenzi
+	Text editing line	Linie de editare a textului
+	Text to place	Text de plasat
+	Tooltip	Sfat ecran
+	Words or phrases to redact	Cuvinte sau expresii de anonimizat
 	Searchable Image (Exact)	Imagine în care se poate căuta (exactă)
 	Searching… {s} of {p} pages	Se caută… {s} din {p} pagini
 	Searching… {s}/{p}	Se caută… {s}/{p}
@@ -2654,6 +2663,14 @@ key	Space	Spațiu
 	Optimizing… merging image fragments	Se optimizează… unificare fragmente de imagine
 	Outline colour:	Culoare contur:
 	Page properties	Proprietăți pagină
+	Create & Edit	Creare și editare
+	Review & Compare	Revizuire și comparare
+	Forms & Signatures	Formulare și semnături
+	Protect & Standardize	Protejare și standardizare
+	Customize & Automate	Personalizare și automatizare
+	No tools match your search.	Niciun instrument nu corespunde căutării.
+	Expand all tools	Extinderea tuturor instrumentelor
+	Collapse all tools	Restrângerea tuturor instrumentelor
 	Pages counted	Pagini numărate
 	Pages selected	Pagini selectate
 	Print as image	Imprimare ca imagine
@@ -2792,3 +2809,12 @@ theme	Appearance	Aspect
 	Attaching files is not available on the web yet	Atașarea fișierelor nu este încă disponibilă pe web
 	Delete attachment	Ștergere atașament
 	Delete attachment {key}	Ștergere atașament {key}
+@plural	{n} reply|{n} replies	{n} răspuns|{n} răspunsuri|{n} de răspunsuri
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Instrumente pentru pagini
+	Insert pages from a file after the selection…	Inserează pagini dintr-un fișier după selecție…
+	Rotate the selected pages counterclockwise	Rotește paginile selectate în sens antiorar
+	Rotate the selected pages clockwise	Rotește paginile selectate în sens orar
+	Extract the selected pages…	Extrage paginile selectate…
+	Delete the selected pages	Șterge paginile selectate
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 4860d88780..274232d586 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -177,6 +177,15 @@
 	Available	Доступно
 	Ready	Готово
 	Search tools and commands…	Поиск инструментов и команд…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Добавленный текст
+	Link URL	URL-адрес ссылки
+	Search tools and commands	Поиск инструментов и команд
+	Text editing line	Строка редактирования текста
+	Text to place	Текст для размещения
+	Tooltip	Подсказка
+	Words or phrases to redact	Слова или фразы для скрытия
 	No matching tools	Нет подходящих инструментов
 	Tool	Инструмент
 	Command	Команда
@@ -2402,6 +2411,14 @@ animation effects	Off	Выкл
 	Make properties default	Сделать свойства стандартными
 	Pages selected	Выделенные страницы
 	Page properties	Свойства страницы
+	Create & Edit	Создание и редактирование
+	Review & Compare	Рецензирование и сравнение
+	Forms & Signatures	Формы и подписи
+	Protect & Standardize	Защита и стандартизация
+	Customize & Automate	Настройка и автоматизация
+	No tools match your search.	Нет инструментов, соответствующих запросу.
+	Expand all tools	Развернуть все инструменты
+	Collapse all tools	Свернуть все инструменты
 	Attach a file…	Прикрепить файл…
 	Delete attachment	Удалить вложение
 	Attaching files is not available on the web yet	Прикрепление файлов в веб-версии пока недоступно
@@ -2444,3 +2461,12 @@ animation effects	Off	Выкл
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Сегодня
+@plural	{n} reply|{n} replies	{n} ответ|{n} ответа|{n} ответов
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Инструменты страниц
+	Insert pages from a file after the selection…	Вставить страницы из файла после выделения…
+	Rotate the selected pages counterclockwise	Повернуть выбранные страницы против часовой стрелки
+	Rotate the selected pages clockwise	Повернуть выбранные страницы по часовой стрелке
+	Extract the selected pages…	Извлечь выбранные страницы…
+	Delete the selected pages	Удалить выбранные страницы
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index d3afeccbd1..420e6a5996 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1636,6 +1636,15 @@
 	Search	Iskanje
 	Search comments	Išči po komentarjih
 	Search tools and commands…	Poišči orodja in ukaze…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Dodano besedilo
+	Link URL	URL povezave
+	Search tools and commands	Poišči orodja in ukaze
+	Text editing line	Vrstica za urejanje besedila
+	Text to place	Besedilo za postavitev
+	Tooltip	Namig
+	Words or phrases to redact	Besede ali fraze za počrnitev
 	Searchable Image (Exact)	Iskalna slika (natančna)
 	Searching… {s} of {p} pages	Iskanje… {s} od {p} strani
 	Searching… {s}/{p}	Iskanje… {s}/{p}
@@ -2494,6 +2503,14 @@ animation effects	Off	Izklopljeni
 	Make properties default	Nastavi lastnosti kot privzete
 	Pages selected	Izbrane strani
 	Page properties	Lastnosti strani
+	Create & Edit	Ustvarjanje in urejanje
+	Review & Compare	Pregled in primerjava
+	Forms & Signatures	Obrazci in podpisi
+	Protect & Standardize	Zaščita in standardizacija
+	Customize & Automate	Prilagajanje in avtomatizacija
+	No tools match your search.	Iskanju ne ustreza nobeno orodje.
+	Expand all tools	Razširi vsa orodja
+	Collapse all tools	Strni vsa orodja
 	Attach a file…	Priloži datoteko…
 	Delete attachment	Izbriši prilogo
 	Attaching files is not available on the web yet	Prilaganje datotek na spletu še ni na voljo
@@ -2536,3 +2553,12 @@ animation effects	Off	Izklopljeni
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Danes
+@plural	{n} reply|{n} replies	{n} odgovor|{n} odgovora|{n} odgovori|{n} odgovorov
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Orodja za strani
+	Insert pages from a file after the selection…	Vstavi strani iz datoteke za izborom…
+	Rotate the selected pages counterclockwise	Zavrti izbrane strani v nasprotni smeri urnega kazalca
+	Rotate the selected pages clockwise	Zavrti izbrane strani v smeri urnega kazalca
+	Extract the selected pages…	Izvleci izbrane strani…
+	Delete the selected pages	Izbriši izbrane strani
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index 6e8de9f682..ba7c9dc5b3 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -1585,6 +1585,15 @@
 	Search	Kërko
 	Search comments	Kërko te komentet
 	Search tools and commands…	Kërko mjete dhe komanda…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Tekst i shtuar
+	Link URL	URL e lidhjes
+	Search tools and commands	Kërko mjete dhe komanda
+	Text editing line	Rreshti i redaktimit të tekstit
+	Text to place	Teksti për t'u vendosur
+	Tooltip	Këshilla e mjetit
+	Words or phrases to redact	Fjalë ose fraza për redaktim
 	Searchable Image (Exact)	Imazh i kërkueshëm (i saktë)
 	Searching… {s} of {p} pages	Po kërkohet… {s} nga {p} faqe
 	Searching… {s}/{p}	Po kërkohet… {s}/{p}
@@ -2420,6 +2429,14 @@ animation effects	Off	Joaktiv
 	Other options	Other options
 	Outline colour:	Outline colour:
 	Page properties	Page properties
+	Create & Edit	Krijo dhe redakto
+	Review & Compare	Rishiko dhe krahaso
+	Forms & Signatures	Formularë dhe nënshkrime
+	Protect & Standardize	Mbro dhe standardizo
+	Customize & Automate	Personalizo dhe automatizo
+	No tools match your search.	Asnjë mjet nuk përputhet me kërkimin tuaj.
+	Expand all tools	Zgjero të gjitha mjetet
+	Collapse all tools	Palos të gjitha mjetet
 	Pages counted	Pages counted
 	Pages selected	Pages selected
 	Paragraph spacing	Paragraph spacing
@@ -2518,3 +2535,12 @@ animation effects	Off	Joaktiv
 	Attaching files is not available on the web yet	Bashkëngjitja e skedarëve nuk është ende e disponueshme në ueb
 	Delete attachment	Fshi bashkëngjitjen
 	Delete attachment {key}	Fshi bashkëngjitjen {key}
+@plural	{n} reply|{n} replies	{n} përgjigje|{n} përgjigje
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Mjetet e faqes
+	Insert pages from a file after the selection…	Fut faqe nga një skedar pas përzgjedhjes…
+	Rotate the selected pages counterclockwise	Rrotullo faqet e përzgjedhura në drejtim të kundërt me orën
+	Rotate the selected pages clockwise	Rrotullo faqet e përzgjedhura në drejtim të orës
+	Extract the selected pages…	Nxirr faqet e përzgjedhura…
+	Delete the selected pages	Fshi faqet e përzgjedhura
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 7506bb725c..7f339989ee 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -161,6 +161,15 @@ comment menu	Edit	సవరించు
 	Available	అందుబాటులో ఉంది
 	Ready	సిద్ధం
 	Search tools and commands…	సాధనాలు, కమాండ్‌లలో వెతుకు…
+
+# Accessible names for inputs that have no visible label.
+	Added text	జోడించిన టెక్స్ట్
+	Link URL	లింక్ URL
+	Search tools and commands	సాధనాలు, కమాండ్‌లలో వెతుకు
+	Text editing line	టెక్స్ట్ సవరణ పంక్తి
+	Text to place	ఉంచాల్సిన టెక్స్ట్
+	Tooltip	టూల్‌టిప్
+	Words or phrases to redact	రెడాక్ట్ చేయాల్సిన పదాలు లేదా పదబంధాలు
 	No matching tools	సరిపోలే సాధనాలు లేవు
 	Tool	సాధనం
 	Command	కమాండ్
@@ -2398,6 +2407,14 @@ animation effects	Off	ఆఫ్
 	Make properties default	లక్షణాలను డిఫాల్ట్‌గా చేయి
 	Pages selected	ఎంచుకున్న పేజీలు
 	Page properties	పేజీ లక్షణాలు
+	Create & Edit	సృష్టించు & సవరించు
+	Review & Compare	సమీక్షించు & పోల్చు
+	Forms & Signatures	ఫారమ్‌లు & సంతకాలు
+	Protect & Standardize	రక్షించు & ప్రామాణీకరించు
+	Customize & Automate	అనుకూలీకరించు & ఆటోమేట్ చేయి
+	No tools match your search.	మీ శోధనకు సరిపోలే సాధనాలు లేవు.
+	Expand all tools	అన్ని సాధనాలను విస్తరించు
+	Collapse all tools	అన్ని సాధనాలను కుదించు
 	Attach a file…	ఫైల్‌ను జోడించు…
 	Delete attachment	జోడింపును తొలగించు
 	Attaching files is not available on the web yet	వెబ్‌లో ఫైల్‌లను జోడించడం ఇంకా అందుబాటులో లేదు
@@ -2440,3 +2457,12 @@ animation effects	Off	ఆఫ్
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	ఈరోజు
+@plural	{n} reply|{n} replies	{n} ప్రత్యుత్తరం|{n} ప్రత్యుత్తరాలు
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	పేజీ సాధనాలు
+	Insert pages from a file after the selection…	ఎంపిక తర్వాత ఫైల్ నుండి పేజీలను చొప్పించు…
+	Rotate the selected pages counterclockwise	ఎంచుకున్న పేజీలను అపసవ్య దిశలో తిప్పు
+	Rotate the selected pages clockwise	ఎంచుకున్న పేజీలను సవ్య దిశలో తిప్పు
+	Extract the selected pages…	ఎంచుకున్న పేజీలను సంగ్రహించు…
+	Delete the selected pages	ఎంచుకున్న పేజీలను తొలగించు
diff --git a/crates/ui-egui/src/i18n/tests.rs b/crates/ui-egui/src/i18n/tests.rs
new file mode 100644
index 0000000000..41a4578cf0
--- /dev/null
+++ b/crates/ui-egui/src/i18n/tests.rs
@@ -0,0 +1,1219 @@
+use super::catalog::{Entry, parse_entries, placeholders};
+use super::*;
+
+const JA: fn() -> Lang = || Lang::from_code("ja").expect("ja registered");
+
+#[test]
+fn keyboard_key_names_have_a_separate_context_and_english_fallback() {
+    static KEYS: LangInfo = LangInfo {
+        code: "keys",
+        name: "Key name test catalog",
+        source: "key\tDelete\tEntf\n\tDelete\tLöschen\n\tOpen\tÖffnen\n",
+        plural: plural_one_other,
+        rtl: false,
+        catalog: OnceLock::new(),
+    };
+    let previous = current();
+    set_current(Lang(&KEYS));
+    assert_eq!(key_name("Delete"), "Entf");
+    assert_eq!(t("Delete"), "Löschen");
+    assert_eq!(key_name("Open"), "Open", "a missing key name must not borrow a command translation");
+    set_current(Lang::EN);
+    assert_eq!(key_name("Delete"), "Delete");
+    set_current(previous);
+}
+
+/// Regression test: a language picker uses its native name only when a face can draw it, otherwise its
+/// English name.
+#[test]
+fn picker_names_fall_back_to_english_when_their_script_has_no_face() {
+    let hi = Lang::from_code("hi").expect("hi registered");
+    assert_eq!(hi.picker_name(|_| true), "हिन्दी", "the native name is kept when it can be drawn");
+    assert_eq!(hi.picker_name(|_| false), "Hindi", "no Devanagari face: an English name, not an unrenderable label");
+    assert_eq!(Lang::EN.picker_name(|_| false), "English");
+    for language in Lang::all() {
+        assert!(!language.english_name().is_empty(), "{}", language.code());
+        assert_ne!(language.english_name(), language.code(), "{} needs an English picker fallback", language.code());
+    }
+}
+
+#[test]
+fn tags_map_to_languages() {
+    assert_eq!(lang_from_tag("ja_JP.UTF-8"), Some(JA()));
+    assert_eq!(lang_from_tag("ja-JP"), Some(JA()));
+    assert_eq!(lang_from_tag("en_US.UTF-8"), Some(Lang::EN));
+    assert_eq!(lang_from_tag("C"), Some(Lang::EN));
+    assert_eq!(lang_from_tag("POSIX"), Some(Lang::EN));
+    assert_eq!(lang_from_tag("fr_FR"), Lang::from_code("fr"));
+    assert_eq!(lang_from_tag("fr_CA.UTF-8"), Lang::from_code("fr"));
+    assert_eq!(lang_from_tag("fr-BE"), Lang::from_code("fr"));
+    assert_eq!(lang_from_tag("zh-TW"), Lang::from_code("zh-hant"));
+    assert_eq!(lang_from_tag("zh_CN.UTF-8"), Lang::from_code("zh-hans"));
+    assert_eq!(lang_from_tag("zh"), Lang::from_code("zh-hans"));
+    assert_eq!(lang_from_tag("zh_HK.UTF-8"), Lang::from_code("zh-hant"));
+    assert_eq!(lang_from_tag("zh-Hant-MO"), Lang::from_code("zh-hant"));
+    assert_eq!(lang_from_tag("lo_LA.UTF-8"), Lang::from_code("lo"));
+    assert_eq!(lang_from_tag("lo-LA"), Lang::from_code("lo"));
+    assert_eq!(lang_from_tag("lo"), Lang::from_code("lo"));
+    assert_eq!(lang_from_tag(""), None);
+    assert_eq!(lang_from_tag("_"), None);
+}
+
+#[test]
+fn candidates_walk_from_specific_to_general() {
+    assert_eq!(candidates("pt_BR.UTF-8"), ["pt-br", "pt"]);
+    assert_eq!(candidates("pt_PT.UTF-8"), ["pt-pt", "pt-br", "pt"]);
+    assert_eq!(candidates("pt"), ["pt-br", "pt"]);
+    assert_eq!(candidates("zh_TW"), ["zh-tw", "zh-hant", "zh"]);
+    assert_eq!(candidates("zh-CN"), ["zh-cn", "zh-hans", "zh"]);
+    assert_eq!(candidates("zh-Hant-HK"), ["zh-hant-hk", "zh-hant", "zh"]);
+    assert_eq!(candidates("lo_LA.UTF-8"), ["lo-la", "lo"]);
+    assert_eq!(candidates("nb_NO.UTF-8"), ["nb-no", "nb"]);
+    assert_eq!(candidates("no_NO.UTF-8"), ["no-no", "no", "nb"]);
+    assert_eq!(candidates("nn-NO"), ["nn-no", "nn", "nb"]);
+}
+
+#[test]
+fn macos_language_list_is_parsed() {
+    assert_eq!(first_supported("(\n    \"ja-JP\",\n    \"en-US\"\n)\n"), Some(JA()));
+    assert_eq!(first_supported("(\n    \"fr-FR\",\n    \"en-US\"\n)\n"), Lang::from_code("fr"));
+    assert_eq!(first_supported("("), None);
+}
+
+/// #2954: the web build's Auto language follows the browser's preferred languages in order,
+/// skipping ones without a catalog, and is English only when none is supported.
+#[test]
+fn browser_language_list_is_followed_in_order() {
+    assert_eq!(first_supported_tag(["it-IT", "en-US"]), Lang::from_code("it"));
+    assert_eq!(first_supported_tag(["xx-YY", "ja", "fr-FR"]), Some(JA()));
+    assert_eq!(first_supported_tag(["zh-TW"]), Lang::from_code("zh-hant"));
+    assert_eq!(first_supported_tag(["en-GB", "fr-FR"]), Some(Lang::EN));
+    assert_eq!(first_supported_tag([" pt-PT "]), Lang::from_code("pt-br"));
+    assert_eq!(first_supported_tag(["", "xx"]), None);
+    assert_eq!(first_supported_tag(Vec::<String>::new()), None);
+    let long = std::iter::repeat_n("xx", 10_000).chain(["fr"]);
+    assert_eq!(first_supported_tag(long), None, "only the first tags are read");
+}
+
+#[test]
+fn windows_display_language_resolves_chinese_scripts() {
+    for tag in ["zh-CN", "zh-SG", "zh-Hans", "zh-Hans-CN"] {
+        assert_eq!(first_supported(&format!("{tag}\r\n")), Lang::from_code("zh-hans"));
+    }
+    for tag in ["zh-TW", "zh-HK", "zh-MO", "zh-Hant", "zh-Hant-HK"] {
+        assert_eq!(first_supported(&format!("{tag}\r\n")), Lang::from_code("zh-hant"));
+    }
+    assert_eq!(first_supported("en-US\r\n"), Some(Lang::EN));
+    assert_eq!(first_supported("fr-FR\r\n"), Lang::from_code("fr"));
+    assert_eq!(first_supported("lo-LA\r\n"), Lang::from_code("lo"));
+    assert_eq!(first_supported("\r\n"), None);
+}
+
+#[cfg(target_os = "windows")]
+#[test]
+fn neutral_locale_does_not_override_display_language() {
+    let fr = Lang::from_code("fr").unwrap();
+    for tag in ["C", "C.UTF-8", "POSIX", "posix.UTF-8", "", "  C.UTF-8  ", "unsupported"] {
+        assert_eq!(language_override(tag), None, "{tag}");
+        assert_eq!(language_override(tag).or_else(|| first_supported("unsupported-XY\nfr-FR\nen-US")), Some(fr));
+    }
+    assert_eq!(["C.UTF-8", "POSIX", "fr_FR.UTF-8"].into_iter().find_map(language_override), Some(fr));
+    assert_eq!(language_override("fr_FR.UTF-8"), Some(fr));
+    assert_eq!(language_override("en_US.UTF-8"), Some(Lang::EN));
+    assert_eq!(language_override("ja_JP.UTF-8"), Some(JA()));
+}
+
+#[cfg(target_os = "windows")]
+#[test]
+fn windows_display_language_query_returns_a_locale_tag() {
+    // One tag per line, as `first_supported` reads them: a machine with several display
+    // languages reports them all, so each line is checked rather than the list as a whole.
+    let list = windows_ui_language().expect("Windows should report a display language");
+    let tags: Vec<&str> = list.lines().map(str::trim).filter(|t| !t.is_empty()).collect();
+    assert!(!tags.is_empty(), "no display language in {list:?}");
+    for tag in tags {
+        assert!(tag.split('-').all(|part| !part.is_empty() && part.bytes().all(|b| b.is_ascii_alphanumeric())), "not a locale tag: {tag:?}");
+    }
+}
+
+#[test]
+fn preferences_resolve_with_fallback() {
+    assert_eq!(Lang::from_pref("ja"), JA());
+    assert_eq!(Lang::from_pref("JA"), JA());
+    assert_eq!(Lang::from_pref("en"), Lang::EN);
+    // `auto` and unknown codes follow the system (English under test).
+    assert_eq!(Lang::from_pref(AUTO), Lang::EN);
+    assert_eq!(Lang::from_pref("xx-unknown"), Lang::EN);
+    assert_eq!(normalize_pref("JA"), Some("ja"));
+    assert_eq!(normalize_pref("Auto"), Some(AUTO));
+    assert_eq!(normalize_pref("xx"), None);
+}
+
+#[test]
+fn lookups_fall_back_to_english() {
+    assert_eq!(tr(JA(), "no such label"), "no such label");
+    assert_eq!(tr(Lang::EN, "File"), "File");
+    assert_eq!(tr(JA(), "File"), "ファイル");
+    assert_eq!(tr(JA(), "日本語の文書.pdf"), "日本語の文書.pdf");
+    assert_eq!(tr_id(JA(), "no.such.id", "File"), "ファイル");
+    assert_eq!(tr_ctx(JA(), "no such context", "File"), "ファイル");
+    assert!(has(JA(), "Save") && !has(Lang::EN, "Save"));
+}
+
+#[test]
+fn catalog_kinds_are_parsed_and_looked_up() {
+    let (c, errors) =
+        Catalog::parse("# c\n\tHello\tこんにちは\n@id\tfile.save\t保存する\nmenu\tWindows\tウィンドウ群\n@plural\t{n} file|{n} files\t{n} 個\n\n", 1);
+    assert!(errors.is_empty(), "{errors:?}");
+    assert_eq!(c.plain("Hello"), Some("こんにちは"));
+    assert_eq!(c.id("file.save"), Some("保存する"));
+    assert_eq!(c.contextual("menu", "Windows"), Some("ウィンドウ群"));
+    assert_eq!(c.contextual("other", "Windows"), None);
+    assert_eq!(c.plural("{n} file", "{n} files", 0), Some("{n} 個"));
+    assert_eq!(c.plural("{n} file", "{n} files", 5), Some("{n} 個"), "an index past the forms clamps");
+}
+
+#[test]
+fn malformed_lines_are_reported_not_fatal() {
+    let (entries, errors) = parse_entries("\tok\tはい\nno tabs here\n\tonly\n\ta\tb\tc\textra\n\t\tempty source\n", 1);
+    assert_eq!(entries.len(), 1);
+    assert_eq!(errors.len(), 4, "{errors:?}");
+    let (entries, errors) = parse_entries("\ta\\tb\tx\\ny\\\\z\n", 1);
+    assert!(errors.is_empty(), "{errors:?}");
+    assert_eq!(entries, [Entry { context: String::new(), source: "a\tb".into(), translation: "x\ny\\z".into() }]);
+}
+
+#[test]
+fn strict_validation_skips_only_the_bad_line() {
+    for (text, forms, error) in [
+        ("\tFile", 1, "context<TAB>"),
+        ("\tFile\t", 1, "nonempty"),
+        ("\tFile\\q\tFiles", 1, "unknown escape"),
+        ("\tFile\tFiles\\", 1, "trailing backslash"),
+        ("\tOpen…\tOpen", 1, "ellipsis"),
+        ("\tOpen {file}\tOpen {name}", 1, "placeholders"),
+        ("@plural\tpage\tPages", 1, "one|other"),
+        ("@plural\t{n} page|{n} pages\t{n} pages", 2, "2 nonempty"),
+        ("@plural\t{n} page|{n} pages\tPages", 1, "placeholders"),
+        ("@unknown\tFile\tFiles", 1, "reserved context"),
+    ] {
+        // The bad line comes first; the good line after it still loads.
+        let (catalog, errors) = Catalog::parse(&format!("{text}\n\tSave\t保存\n"), forms);
+        assert_eq!(errors.len(), 1, "{text:?}: {errors:?}");
+        assert!(errors[0].starts_with("line 1: ") && errors[0].contains(error), "{errors:?}");
+        assert_eq!(catalog.plain("Save"), Some("保存"), "{text:?}");
+    }
+    let (catalog, errors) = Catalog::parse("\tFile\tファイル\n\tFile\t別\n", 1);
+    assert!(errors.len() == 1 && errors[0].contains("line 2: duplicate"), "{errors:?}");
+    assert_eq!(catalog.plain("File"), Some("ファイル"), "the first entry wins");
+}
+
+#[test]
+fn catalogs_handle_escapes_crlf_and_distinct_contexts() {
+    let (catalog, errors) =
+        Catalog::parse("# comment\r\n\r\n\tLine\\nTab\\tPath\\\\\tOther\\nTab\\tPath\\\\\r\nweight\tLight\tThin\r\ntheme\tLight\tPale\r\n", 1);
+    assert!(errors.is_empty(), "{errors:?}");
+    assert_eq!(catalog.plain("Line\nTab\tPath\\"), Some("Other\nTab\tPath\\"));
+    assert_eq!(catalog.contextual("weight", "Light"), Some("Thin"));
+    assert_eq!(catalog.contextual("theme", "Light"), Some("Pale"));
+}
+
+#[test]
+fn broken_catalog_falls_back_to_english() {
+    static BROKEN: LangInfo =
+        LangInfo { code: "broken", name: "Broken test catalog", source: "malformed\n\\", plural: plural_none, rtl: false, catalog: OnceLock::new() };
+    assert_eq!(tr(Lang(&BROKEN), "File"), "File");
+    assert_eq!(trn(Lang(&BROKEN), 2, "{n} page", "{n} pages"), "2 pages");
+}
+
+#[test]
+fn contextual_id_and_plural_lookups_have_english_fallbacks() {
+    static TEST: LangInfo = LangInfo {
+        code: "test",
+        name: "Test catalog",
+        source: "\tLight\tPlain light\nweight\tLight\tThin\n@id\tfile.open\tOpen dialog…\n@plural\t{n} page|{n} pages\tOne page: {n}|Many pages: {n}\n",
+        plural: plural_one_other,
+        rtl: false,
+        catalog: OnceLock::new(),
+    };
+    let l = Lang(&TEST);
+    assert_eq!(tr_ctx(l, "weight", "Light"), "Thin");
+    assert_eq!(tr_ctx(l, "theme", "Light"), "Plain light");
+    assert_eq!(tr_ctx(l, "theme", "Unknown"), "Unknown");
+    assert_eq!(tr_id(l, "file.open", "Reworded English…"), "Open dialog…");
+    assert_eq!(tr_id(l, "unknown", "Light"), "Plain light");
+    assert_eq!(tr_id(l, "unknown", "Unknown"), "Unknown");
+    assert_eq!(trn(l, 1, "{n} page", "{n} pages"), "One page: 1");
+    assert_eq!(trn(l, 0, "{n} page", "{n} pages"), "Many pages: 0");
+    assert_eq!(trn(l, u64::MAX, "{n} page", "{n} pages"), format!("Many pages: {}", u64::MAX));
+}
+
+#[test]
+fn formatting_reorders_parameters_without_reinterpreting_user_text() {
+    let args = [("file", "日本語-{n}.pdf"), ("n", "2")];
+    assert_eq!(fmt("{n}: {file}; {unknown}", &args), "2: 日本語-{n}.pdf; {unknown}");
+    assert_eq!(fmt("{file} / {file}", &args), "日本語-{n}.pdf / 日本語-{n}.pdf");
+    assert_eq!(fmt("text {unfinished", &args), "text {unfinished");
+    assert_eq!(fmt("}{n}{", &args), "}2{");
+    assert_eq!(fmt("unchanged", &[]), "unchanged");
+}
+
+/// Every literal passed to `tl!(…)` or `crate::i18n::t(…)` in the UI source (test modules
+/// aside), unescaped, including literals on a line of their own.
+fn ui_literals() -> std::collections::BTreeSet<String> {
+    let mut stack = vec![std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src")];
+    let mut literals = std::collections::BTreeSet::new();
+    while let Some(dir) = stack.pop() {
+        for entry in std::fs::read_dir(dir).expect("UI source directory") {
+            let path = entry.expect("UI source entry").path();
+            if path.is_dir() {
+                if path.file_name().is_some_and(|name| name != "i18n") {
+                    stack.push(path);
+                }
+            } else if path.extension().is_some_and(|ext| ext == "rs") {
+                let source = std::fs::read_to_string(path).expect("UI source file").replace("\r\n", "\n");
+                let source = source.replace("crate::i18n::t(", "tl!(");
+                let mut rest = source.split("#[cfg(test)]\nmod ").next().unwrap_or_default();
+                while let Some((_, after)) = rest.split_once("tl!(") {
+                    let after = after.trim_start();
+                    let Some(after) = after.strip_prefix('"') else {
+                        rest = after;
+                        continue;
+                    };
+                    let mut escaped = false;
+                    let end = after
+                        .char_indices()
+                        .find_map(|(i, c)| {
+                            if c == '"' && !escaped {
+                                return Some(i);
+                            }
+                            escaped = c == '\\' && !escaped;
+                            None
+                        })
+                        .expect("closed tl! literal");
+                    let (raw, tail) = after.split_at(end);
+                    let argument_end = tail.strip_prefix('"').expect("closing quote").trim_start();
+                    let literal_call =
+                        argument_end.starts_with(')') || argument_end.strip_prefix(',').is_some_and(|rest| rest.trim_start().starts_with(')'));
+                    if literal_call {
+                        let label: String = serde_json::from_str(&format!("\"{raw}\"")).expect("UI literal escapes");
+                        literals.insert(label);
+                    }
+                    rest = tail.strip_prefix('"').expect("closing quote");
+                }
+            }
+        }
+    }
+    literals
+}
+
+/// Each translated label of a visible signature that runs into its value keeps a separator
+/// at its end.
+#[test]
+fn signature_appearance_labels_keep_their_separator() {
+    let english = pdfcraft_engine::sign::AppearanceLabels::default();
+    for language in LANGUAGES.iter().filter(|language| !language.source.is_empty()) {
+        let lang = Lang::from_code(language.code).expect("registered language");
+        for (field, label) in english.fields() {
+            let said = tr(lang, label);
+            if field != "signed_by" && !lang.rtl() {
+                assert!(said.ends_with(' ') || said.ends_with('：'), "{}: the {field} label runs into its value: {said:?}", language.code);
+            }
+        }
+    }
+}
+
+/// With craft-fonts, every Japanese translation has glyphs: with all interface faces (desktop)
+/// and with BIZ UDPGothic Regular alone (the web build's only Japanese face).
+#[test]
+fn japanese_labels_have_glyphs() {
+    let craft = pdfcraft_fonts::ui_japanese_fonts();
+    let Some(web) = craft.iter().find(|f| f.family == "BIZ UDPGothic" && f.style == "Regular") else {
+        eprintln!("skipping Japanese glyph checks: build with CRAFT_FONTS_DIR to run them");
+        return;
+    };
+    let (entries, _) = parse_entries(JA().0.source, 1);
+    let labels: String = entries.iter().flat_map(|e| e.translation.chars()).chain(JA().name().chars()).filter(|c| !c.is_control()).collect();
+    let web_name = web.name();
+    let mut web_only = crate::theme::font_definitions();
+    for family in web_only.families.values_mut() {
+        family.retain(|name| !pdfcraft_fonts::CRAFT_FONTS.iter().any(|face| face.name() == *name) || *name == web_name);
+    }
+    use egui::epaint::text::{Fonts, TextOptions};
+    for (build, defs) in [("desktop", crate::theme::font_definitions()), ("web", web_only)] {
+        let mut fonts = Fonts::new(TextOptions::default(), defs);
+        for id in [egui::FontId::proportional(13.0), egui::FontId::monospace(13.0), crate::theme::medium(13.0), crate::theme::semibold(17.0)] {
+            assert!(fonts.has_glyphs(&id, &labels), "{build}: {id:?} lacks a Japanese label glyph");
+        }
+    }
+}
+
+#[test]
+fn history_labels_keep_captured_names() {
+    set_current(JA());
+    assert_eq!(action_label("Insert pages from Save {e}.pdf"), "Save {e}.pdf からページを挿入");
+    assert_eq!(command_label("Undo Insert pages from Save {e}.pdf"), "取り消し Save {e}.pdf からページを挿入");
+    assert_eq!(action_label("Untranslated custom action"), "Untranslated custom action");
+    assert_eq!(menu_label("file.open", "Open…"), "開く…");
+    set_current(Lang::EN);
+    assert_eq!(command_label("Undo Fill in Save {e}"), "Undo Fill in Save {e}");
+}
+
+#[test]
+fn current_language_is_per_thread() {
+    set_current(JA());
+    assert_eq!(t("File"), "ファイル");
+    std::thread::spawn(|| assert_eq!(current(), Lang::EN)).join().unwrap();
+    set_current(Lang::EN);
+    assert_eq!(t("File"), "File");
+}
+
+#[test]
+fn plurals_and_placeholders() {
+    assert_eq!(trn(Lang::EN, 1, "{n} item", "{n} items"), "1 item");
+    assert_eq!(trn(Lang::EN, 0, "{n} item", "{n} items"), "0 items");
+    assert_eq!(trn(Lang::EN, 7, "{n} item", "{n} items"), "7 items");
+    // No catalog has this `@plural` entry: Japanese falls back to the English forms.
+    assert_eq!(trn(JA(), 7, "{n} test item", "{n} test items"), "7 test items");
+    assert_eq!(fmt("{b} before {a}", &[("a", "x"), ("b", "y"), ("c", "z")]), "y before x");
+    assert_eq!(fmt("{missing}", &[]), "{missing}");
+    assert_eq!(placeholders("a {x} b {y} {"), ["x", "y"]);
+}
+
+#[test]
+fn language_persists_and_invalid_input_keeps_current_language() {
+    let mut app = crate::PdfCraftApp::default();
+    assert_eq!(app.language, AUTO);
+    app.set_option("language", "JA").unwrap();
+    assert_eq!(app.language, "ja");
+    assert!(app.set_option("language", "xx").is_err());
+    assert_eq!(app.language, "ja");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "ja");
+    restored.restore(r#"{"language":"xx"}"#);
+    assert_eq!(restored.language, "ja");
+    app.set_option("language", AUTO).unwrap();
+    assert_eq!(app.language, AUTO);
+    // Settings written before the system-locale default (no key) follow the system.
+    let mut legacy = crate::PdfCraftApp::default();
+    legacy.restore("{}");
+    assert_eq!(legacy.language, AUTO);
+}
+
+#[test]
+fn brazilian_portuguese_is_registered() {
+    let pt = Lang::from_code("pt-br").expect("pt-br registered");
+    assert_eq!(pt.name(), "Português (Brasil)");
+    assert_eq!(Lang::from_code("PT-BR"), Some(pt));
+    assert_eq!(normalize_pref("pt-BR"), Some("pt-br"));
+    assert_eq!(normalize_pref("pt"), None, "only exact codes are preferences");
+    assert_eq!(lang_from_tag("pt_BR.UTF-8"), Some(pt));
+    assert_eq!(lang_from_tag("pt_PT"), Some(pt));
+    assert_eq!(tr(pt, "Arquivo do usuário.pdf"), "Arquivo do usuário.pdf");
+    assert_eq!((0..=3).map(|n| (pt.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "pt-br").unwrap();
+    assert_eq!(app.language, "pt-br");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "pt-br");
+}
+
+#[test]
+fn spanish_is_registered() {
+    let es = Lang::from_code("es").expect("es registered");
+    assert_eq!(es.name(), "Español");
+    assert_eq!(normalize_pref("ES"), Some("es"));
+    assert_eq!(lang_from_tag("es_ES.UTF-8"), Some(es));
+    assert_eq!(lang_from_tag("es-MX"), Some(es));
+    assert_eq!(first_supported("es-ES\r\nen-US"), Some(es));
+    assert_eq!(tr(es, "Informe del usuario.pdf"), "Informe del usuario.pdf");
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "es").unwrap();
+    assert_eq!(app.language, "es");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "es");
+}
+
+/// Each sentence the engine words for itself keeps its holes when it is said in Spanish, so
+/// the document's own words still have somewhere to go: a translation that drops `{p}` or
+/// `{}` would read as a sentence about nothing in particular.
+#[test]
+fn spanish_keeps_the_holes_in_what_the_engine_says() {
+    let es = Lang::from_code("es").expect("es registered");
+    let lists: [&[&str]; 5] = [
+        pdfcraft_engine::a11y::WORDINGS,
+        pdfcraft_engine::pdfa::WORDINGS,
+        pdfcraft_engine::sign::pdf::WORDINGS,
+        pdfcraft_engine::print::WORDINGS,
+        pdfcraft_engine::field_table::WORDINGS,
+    ];
+    for wording in lists.into_iter().flatten() {
+        let said = tr(es, wording);
+        // `{}` is one hole; `{name}` holes are named, and each name must survive by itself.
+        assert_eq!(wording.matches("{}").count(), said.matches("{}").count(), "the Spanish of {wording:?} loses a hole: {said:?}");
+        for hole in wording.split('{').skip(1).filter_map(|rest| rest.split_once('}')).map(|(name, _)| name).filter(|n| !n.is_empty()) {
+            assert!(said.contains(&format!("{{{hole}}}")), "the Spanish of {wording:?} loses {{{hole}}}: {said:?}");
+        }
+    }
+}
+
+#[test]
+fn telugu_is_registered() {
+    let te = Lang::from_code("te").expect("te registered");
+    assert_eq!(te.name(), "తెలుగు");
+    assert_eq!(normalize_pref("TE"), Some("te"));
+    assert_eq!(lang_from_tag("te_IN.UTF-8"), Some(te));
+    assert_eq!(first_supported("te-IN\r\nen-US"), Some(te));
+    assert_eq!(tr(te, "నివేదిక.pdf"), "నివేదిక.pdf");
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "te").unwrap();
+    assert_eq!(app.language, "te");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "te");
+}
+
+/// Telugu puts the verb last, so it translates "Undo {action}" as a whole phrase; a catalog
+/// without that entry (Spanish) keeps the verb in front of the action.
+#[test]
+fn undo_and_redo_labels_use_the_catalog_phrase_when_there_is_one() {
+    let te = Lang::from_code("te").expect("te registered");
+    set_current(te);
+    assert_eq!(command_label("Undo"), "రద్దు చేయి");
+    assert_eq!(command_label("Undo Untranslated custom action"), "రద్దు చేయి: Untranslated custom action");
+    assert_eq!(command_label("Redo Untranslated custom action"), "మళ్లీ చేయి: Untranslated custom action");
+    let es = Lang::from_code("es").expect("es registered");
+    set_current(es);
+    assert_eq!(command_label("Undo Untranslated custom action"), format!("{} Untranslated custom action", tr(es, "Undo")));
+    set_current(Lang::EN);
+    assert_eq!(command_label("Undo Untranslated custom action"), "Undo Untranslated custom action");
+}
+
+/// A label that reads differently by use has its own contextual entry where a language needs
+/// one; a language without it falls back to the plain translation.
+#[test]
+fn contextual_labels_fall_back_to_the_plain_translation() {
+    let te = Lang::from_code("te").expect("te registered");
+    assert_eq!(tr_ctx(te, "signature pad", "Type"), "టైప్ చేయి");
+    assert_eq!(tr(te, "Type"), "రకం");
+    // A context no catalog defines, so the fallback stays tested as catalogs fill their gaps.
+    let es = Lang::from_code("es").expect("es registered");
+    assert_eq!(tr_ctx(es, "no such context", "Type"), tr(es, "Type"));
+}
+
+/// With a craft-fonts Telugu face, every Telugu translation has glyphs: with all interface
+/// faces (desktop) and with the Telugu face as the only craft-fonts face (the web build keeps
+/// it; Telugu labels must not need a Japanese or Arabic face).
+#[test]
+fn telugu_labels_have_glyphs() {
+    let telugu: Vec<String> = pdfcraft_fonts::ui_telugu_fonts().iter().map(|f| f.name()).collect();
+    if telugu.is_empty() {
+        eprintln!("skipping Telugu glyph checks: build with CRAFT_FONTS_DIR and a Telugu face to run them");
+        return;
+    }
+    let te = Lang::from_code("te").expect("te registered");
+    let (entries, _) = parse_entries(te.0.source, te.0.plural_forms());
+    let labels: String = entries.iter().flat_map(|e| e.translation.chars()).chain(te.name().chars()).filter(|c| !c.is_control()).collect();
+    let mut telugu_only = crate::theme::font_definitions();
+    for family in telugu_only.families.values_mut() {
+        family.retain(|name| !pdfcraft_fonts::CRAFT_FONTS.iter().any(|face| face.name() == *name) || telugu.contains(name));
+    }
+    use egui::epaint::text::{Fonts, TextOptions};
+    for (build, defs) in [("all faces", crate::theme::font_definitions()), ("Telugu face only", telugu_only)] {
+        let mut fonts = Fonts::new(TextOptions::default(), defs);
+        for id in [egui::FontId::proportional(13.0), egui::FontId::monospace(13.0), crate::theme::medium(13.0), crate::theme::semibold(17.0)] {
+            assert!(fonts.has_glyphs(&id, &labels), "{build}: {id:?} lacks a Telugu label glyph");
+        }
+    }
+}
+
+#[test]
+fn czech_is_registered_and_persists() {
+    let cs = Lang::from_code("cs").expect("cs registered");
+    assert_eq!(cs.name(), "Čeština");
+    assert_eq!(tr(cs, "Žluťoučký kůň.pdf"), "Žluťoučký kůň.pdf");
+    assert_eq!((0..=6).map(|n| (cs.0.plural)(n)).collect::<Vec<_>>(), [2, 0, 1, 1, 1, 2, 2]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "cs").unwrap();
+    assert!(app.set_option("language", "cz").is_err());
+    assert_eq!(app.language, "cs");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "cs");
+}
+
+#[test]
+fn turkish_is_registered_and_persists() {
+    let tr_lang = Lang::from_code("tr").expect("tr registered");
+    assert_eq!(tr_lang.name(), "Türkçe");
+    assert_eq!(tr(tr_lang, "Türkçe Belge.pdf"), "Türkçe Belge.pdf");
+    assert_eq!((0..=6).map(|n| (tr_lang.0.plural)(n)).collect::<Vec<_>>(), [0; 7]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "tr").unwrap();
+    assert!(app.set_option("language", "tu").is_err());
+    assert_eq!(app.language, "tr");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "tr");
+}
+
+/// The code joins some labels with a space at either end, so these catalogs keep exactly the
+/// source's, and write … rather than three dots.
+#[test]
+fn catalog_rows_keep_the_source_spacing_and_ellipsis() {
+    let edges = |s: &str| (s.len() - s.trim_start().len(), s.len() - s.trim_end().len());
+    for code in ["cs", "tr", "vi"] {
+        let lang = Lang::from_code(code).expect("registered");
+        let (entries, errors) = parse_entries(lang.0.source, lang.0.plural_forms());
+        assert!(errors.is_empty(), "{code}: {errors:?}");
+        for e in &entries {
+            assert!(!e.translation.contains("..."), "{code}: use … rather than three dots: {:?}", e.translation);
+            assert_eq!(edges(&e.translation), edges(&e.source), "{code}: stray whitespace: {:?}", e.translation);
+        }
+    }
+}
+
+#[test]
+fn simplified_chinese_is_registered() {
+    let zh = Lang::from_code("zh-hans").expect("zh-hans registered");
+    assert_eq!(zh.name(), "简体中文");
+    assert_eq!(normalize_pref("zh-Hans"), Some("zh-hans"));
+    assert_eq!(normalize_pref("zh"), None, "only exact codes are preferences");
+    assert_eq!(tr(zh, "报告.pdf"), "报告.pdf");
+}
+
+#[test]
+fn traditional_chinese_is_registered() {
+    let zh = Lang::from_code("zh-hant").expect("zh-hant registered");
+    assert_eq!(zh.name(), "繁體中文");
+    assert_eq!(normalize_pref("zh-Hant"), Some("zh-hant"));
+    assert_eq!(tr(zh, "報告.pdf"), "報告.pdf");
+}
+
+#[test]
+fn french_is_registered() {
+    let fr = Lang::from_code("fr").expect("fr registered");
+    assert_eq!(fr.name(), "Français");
+    assert_eq!(normalize_pref("FR"), Some("fr"));
+    assert_eq!(lang_from_tag("fr_FR.UTF-8"), Some(fr));
+    assert_eq!(lang_from_tag("fr-CA"), Some(fr));
+    assert_eq!(first_supported("fr-FR\r\nen-US"), Some(fr));
+    assert_eq!(tr(fr, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
+    assert_eq!((0..=3).map(|n| (fr.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "fr").unwrap();
+    assert_eq!(app.language, "fr");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "fr");
+}
+
+#[test]
+fn german_is_registered() {
+    let de = Lang::from_code("de").expect("de registered");
+    assert_eq!(de.name(), "Deutsch");
+    assert_eq!(normalize_pref("DE"), Some("de"));
+    assert_eq!(lang_from_tag("de_DE.UTF-8"), Some(de));
+    assert_eq!(lang_from_tag("de-AT"), Some(de));
+    assert_eq!(lang_from_tag("de_CH"), Some(de));
+    assert_eq!(first_supported("de-DE\r\nen-US"), Some(de));
+    assert_eq!(tr(de, "Bericht des Nutzers.pdf"), "Bericht des Nutzers.pdf");
+    assert_eq!((0..=3).map(|n| (de.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "de").unwrap();
+    assert_eq!(app.language, "de");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "de");
+}
+
+#[test]
+fn tool_names_inside_sentences_are_lowercased_except_in_german() {
+    set_current(Lang::EN);
+    assert_eq!(in_sentence("Text Box"), "text box");
+    set_current(Lang::from_code("de").expect("de registered"));
+    assert_eq!(in_sentence("Textfeld"), "Textfeld");
+    set_current(Lang::EN);
+}
+
+#[test]
+fn turkish_keeps_its_dotted_and_dotless_i_when_changing_case() {
+    set_current(Lang::from_code("tr").expect("tr registered"));
+    assert_eq!(upper_label("Advanced"), "GELİŞMİŞ");
+    assert_eq!(upper_label("Signatures"), "İMZALAR");
+    // A label with no Turkish row is still English and keeps the English rule.
+    assert_eq!(upper_label("Untranslated title"), "UNTRANSLATED TITLE");
+    assert_eq!(in_sentence("İmza Alanı"), "imza alanı");
+    assert_eq!(in_sentence("Işık"), "ışık");
+    set_current(Lang::EN);
+    assert_eq!(upper_label("Advanced"), "ADVANCED");
+    assert_eq!(in_sentence("Image"), "image");
+}
+
+#[test]
+fn russian_is_registered() {
+    let ru = Lang::from_code("ru").expect("ru registered");
+    assert_eq!(ru.name(), "Русский");
+    assert_eq!(normalize_pref("RU"), Some("ru"));
+    assert_eq!(lang_from_tag("ru_RU.UTF-8"), Some(ru));
+    assert_eq!(lang_from_tag("ru-BY"), Some(ru));
+    assert_eq!(first_supported("ru-RU\r\nen-US"), Some(ru));
+    assert_eq!(tr(ru, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
+    // one (1), few (2-4), many (0, 5+), with 11-14 exception
+    assert_eq!((0..=3).map(|n| (ru.0.plural)(n)).collect::<Vec<_>>(), [2, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "ru").unwrap();
+    assert_eq!(app.language, "ru");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "ru");
+}
+
+#[test]
+fn finnish_is_registered_and_persists() {
+    let fi = Lang::from_code("fi").expect("fi registered");
+    assert_eq!(fi.name(), "Suomi");
+    assert_eq!(normalize_pref("FI"), Some("fi"));
+    for tag in ["fi", "fi-FI", "fi_FI.UTF-8", "FI-fi"] {
+        assert_eq!(lang_from_tag(tag), Some(fi), "{tag}");
+    }
+    // Filipino (`fil`) and Swedish in Finland (`sv-FI`) don't pick Finnish.
+    assert_ne!(lang_from_tag("fil"), Some(fi));
+    assert_ne!(lang_from_tag("sv-FI"), Some(fi));
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "FI").unwrap();
+    assert_eq!(app.language, "fi");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "fi");
+}
+
+#[test]
+fn lithuanian_is_registered_and_persists() {
+    let lt = Lang::from_code("lt").expect("lt registered");
+    assert_eq!(lt.name(), "Lietuvių");
+    assert_eq!(normalize_pref("LT"), Some("lt"));
+    for tag in ["lt", "lt-LT", "lt_LT.UTF-8", "LT-lt"] {
+        assert_eq!(lang_from_tag(tag), Some(lt), "{tag}");
+    }
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "LT").unwrap();
+    assert_eq!(app.language, "lt");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "lt");
+    assert!(restored.set_option("language", "xx").is_err());
+}
+
+#[test]
+fn norwegian_bokmal_is_registered_and_persists() {
+    let nb = Lang::from_code("nb").expect("nb registered");
+    assert_eq!(nb.name(), "Norsk bokmål");
+    assert_eq!(normalize_pref("NB"), Some("nb"));
+    assert_eq!(normalize_pref("no"), None, "only exact codes are preferences");
+    // Current systems say `nb`; older ones and some Linux setups say `no`. Nynorsk is `nn`.
+    for tag in ["nb", "nb-NO", "nb_NO.UTF-8", "no", "no_NO.UTF-8", "NO-no", "nn", "nn_NO.UTF-8"] {
+        assert_eq!(lang_from_tag(tag), Some(nb), "{tag}");
+    }
+    assert_eq!(first_supported("(\n    \"nb-NO\",\n    \"en-US\"\n)\n"), Some(nb));
+    assert_eq!(first_supported("nn-NO\r\nen-US\r\n"), Some(nb));
+    assert_eq!((0..=3).map(|n| (nb.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "NB").unwrap();
+    assert_eq!(app.language, "nb");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "nb");
+}
+
+#[test]
+fn vietnamese_is_registered_and_persists() {
+    let vi = Lang::from_code("vi").expect("vi registered");
+    assert_eq!(vi.name(), "Tiếng Việt");
+    assert_eq!(normalize_pref("Vi"), Some("vi"));
+    for tag in ["vi", "vi-VN", "vi_VN.UTF-8", "VI-vn"] {
+        assert_eq!(lang_from_tag(tag), Some(vi), "{tag}");
+    }
+    assert_eq!(first_supported("vi-VN\r\nen-US"), Some(vi));
+    assert_eq!((0..=3).map(|n| (vi.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "vi").unwrap();
+    assert_eq!(app.language, "vi");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "vi");
+    assert!(restored.set_option("language", "xx").is_err());
+    assert_eq!(restored.language, "vi");
+}
+
+#[test]
+fn romanian_is_registered_with_three_plural_forms() {
+    let ro = Lang::from_code("ro").expect("ro registered");
+    for tag in ["ro", "ro-RO", "ro_RO.UTF-8", "RO-ro", "ro-MD"] {
+        assert_eq!(lang_from_tag(tag), Some(ro), "{tag}");
+    }
+    assert_eq!(normalize_pref("Ro"), Some("ro"));
+    let info = LANGUAGES.iter().find(|language| language.code == "ro").expect("ro row");
+    assert_eq!(info.plural_forms(), 3);
+    // one: 1; few: 0 and n % 100 in 1..=19 ("2 pagini", "101 pagini"); other: the "de" form ("20 de pagini").
+    for (n, form) in [(1, 0), (0, 1), (2, 1), (19, 1), (101, 1), (119, 1), (20, 2), (100, 2), (120, 2), (1000, 2)] {
+        assert_eq!(plural_ro(n), form, "{n}");
+    }
+}
+
+#[test]
+fn catalan_is_registered_and_persists() {
+    let ca = Lang::from_code("ca").expect("ca registered");
+    assert_eq!(ca.name(), "Català");
+    assert_eq!(normalize_pref("CA"), Some("ca"));
+    for tag in ["ca", "ca-ES", "ca_ES.UTF-8", "CA-es", "ca_ES@valencia"] {
+        assert_eq!(lang_from_tag(tag), Some(ca), "{tag}");
+    }
+    assert_eq!(first_supported("ca-ES\r\nen-US"), Some(ca));
+    // one (1), other (0, 2+), as in English
+    assert_eq!((0..=3).map(|n| (ca.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "CA").unwrap();
+    assert_eq!(app.language, "ca");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "ca");
+    assert!(restored.set_option("language", "xx").is_err());
+    assert_eq!(restored.language, "ca");
+}
+
+#[test]
+fn slovene_is_registered_and_persists() {
+    let sl = Lang::from_code("sl").expect("sl registered");
+    assert_eq!(sl.name(), "Slovenščina");
+    assert_eq!(normalize_pref("SL"), Some("sl"));
+    for tag in ["sl", "sl-SI", "sl_SI.UTF-8", "SL-si", "sl_SI@variant"] {
+        assert_eq!(lang_from_tag(tag), Some(sl), "{tag}");
+    }
+    assert_eq!(first_supported("sl-SI\r\nen-US"), Some(sl));
+    assert_eq!(tr(sl, "Poročilo {n}.pdf"), "Poročilo {n}.pdf");
+    // one (1), two (2), few (3, 4), other (0, 5+)
+    assert_eq!((0..=5).map(|n| (sl.0.plural)(n)).collect::<Vec<_>>(), [3, 0, 1, 2, 2, 3]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "SL").unwrap();
+    assert_eq!(app.language, "sl");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "sl");
+    assert!(restored.set_option("language", "xx").is_err());
+    assert_eq!(restored.language, "sl");
+}
+
+#[test]
+fn albanian_is_registered_and_persists() {
+    let sq = Lang::from_code("sq").expect("sq registered");
+    assert_eq!(sq.name(), "Shqip");
+    assert_eq!(normalize_pref("SQ"), Some("sq"));
+    for tag in ["sq", "sq-AL", "sq_AL.UTF-8", "SQ-xk", "sq_XK@variant"] {
+        assert_eq!(lang_from_tag(tag), Some(sq), "{tag}");
+    }
+    assert_eq!(first_supported("sq-AL\r\nen-US"), Some(sq));
+    // one (1), other (0, 2+)
+    assert_eq!((0..=3).map(|n| (sq.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "SQ").unwrap();
+    assert_eq!(app.language, "sq");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "sq");
+    assert!(restored.set_option("language", "xx").is_err());
+    assert_eq!(restored.language, "sq");
+}
+
+#[test]
+fn slovene_plurals_cover_dual_few_teens_and_large_counts() {
+    let sl = Lang::from_code("sl").expect("sl registered");
+    assert_eq!(sl.0.plural_forms(), 4);
+    for (counts, form) in [
+        (vec![1, 101, 201, 1001, 1101], 0),
+        (vec![2, 102, 202, 1002], 1),
+        (vec![3, 4, 103, 104, 1003], 2),
+        (vec![0, 5, 10, 11, 12, 13, 14, 15, 20, 21, 22, 23, 24, 25, 31, 100, 111, 112, 121, 122, 1000, u64::MAX], 3),
+    ] {
+        for n in counts {
+            assert_eq!((sl.0.plural)(n), form, "{n}");
+        }
+    }
+}
+
+#[test]
+fn indonesian_and_vietnamese_are_registered_and_persist() {
+    let id = Lang::from_code("id").expect("id registered");
+    let vi = Lang::from_code("vi").expect("vi registered");
+    assert_eq!(id.name(), "Bahasa Indonesia");
+    assert_eq!(vi.name(), "Tiếng Việt");
+    assert_eq!(normalize_pref("ID"), Some("id"));
+    assert_eq!(normalize_pref("Vi"), Some("vi"));
+    for tag in ["id", "id-ID", "id_ID.UTF-8", "ID-id"] {
+        assert_eq!(lang_from_tag(tag), Some(id), "{tag}");
+    }
+    for tag in ["vi", "vi-VN", "vi_VN.UTF-8", "VI-vn"] {
+        assert_eq!(lang_from_tag(tag), Some(vi), "{tag}");
+    }
+    assert_eq!(first_supported("id-ID\r\nen-US"), Some(id));
+    assert_eq!(first_supported("vi-VN\r\nen-US"), Some(vi));
+    // One CLDR plural form (CLDR `id`, `vi`): the message reads the same for every count.
+    assert_eq!((0..=3).map(|n| (id.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
+    assert_eq!((0..=3).map(|n| (vi.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "ID").unwrap();
+    assert_eq!(app.language, "id");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "id");
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "vi").unwrap();
+    assert_eq!(app.language, "vi");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "vi");
+    assert!(restored.set_option("language", "xx").is_err());
+    assert_eq!(restored.language, "vi");
+}
+
+#[test]
+fn hindi_and_korean_are_registered_and_persist() {
+    let hi = Lang::from_code("hi").expect("hi registered");
+    let ko = Lang::from_code("ko").expect("ko registered");
+    assert_eq!(hi.name(), "हिन्दी");
+    assert_eq!(ko.name(), "한국어");
+    assert_eq!(normalize_pref("HI"), Some("hi"));
+    assert_eq!(normalize_pref("Ko"), Some("ko"));
+    for tag in ["hi", "hi-IN", "hi_IN.UTF-8", "HI-in"] {
+        assert_eq!(lang_from_tag(tag), Some(hi), "{tag}");
+    }
+    for tag in ["ko", "ko-KR", "ko_KR.UTF-8", "KO-kr"] {
+        assert_eq!(lang_from_tag(tag), Some(ko), "{tag}");
+    }
+    assert_eq!(first_supported("hi-IN\r\nen-US"), Some(hi));
+    assert_eq!(first_supported("ko-KR\r\nen-US"), Some(ko));
+    // One plural form per catalog: the message reads the same for every count.
+    assert_eq!((0..=3).map(|n| (hi.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
+    assert_eq!((0..=3).map(|n| (ko.0.plural)(n)).collect::<Vec<_>>(), [0, 0, 0, 0]);
+    for code in ["hi", "ko"] {
+        let mut app = crate::PdfCraftApp::default();
+        app.set_option("language", &code.to_uppercase()).unwrap();
+        assert_eq!(app.language, code);
+        let mut restored = crate::PdfCraftApp::default();
+        restored.restore(&app.persist());
+        assert_eq!(restored.language, code);
+        assert!(restored.set_option("language", "xx").is_err());
+        assert_eq!(restored.language, code);
+    }
+}
+
+#[test]
+fn bulgarian_is_registered() {
+    let bg = Lang::from_code("bg").expect("bg registered");
+    assert_eq!(bg.name(), "Български");
+    assert_eq!(normalize_pref("BG"), Some("bg"));
+    assert_eq!(lang_from_tag("bg_BG.UTF-8"), Some(bg));
+    assert_eq!(lang_from_tag("bg-BG"), Some(bg));
+    assert_eq!(first_supported("bg-BG\r\nen-US"), Some(bg));
+    assert_eq!(tr(bg, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
+    // one (1), other (0, 2+)
+    assert_eq!((0..=3).map(|n| (bg.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "bg").unwrap();
+    assert_eq!(app.language, "bg");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "bg");
+}
+
+#[test]
+fn hungarian_is_registered() {
+    let hu = Lang::from_code("hu").expect("hu registered");
+    assert_eq!(hu.name(), "Magyar");
+    assert_eq!(normalize_pref("HU"), Some("hu"));
+    assert_eq!(lang_from_tag("hu_HU.UTF-8"), Some(hu));
+    assert_eq!(lang_from_tag("hu-HU"), Some(hu));
+    assert_eq!(first_supported("hu-HU\r\nen-US"), Some(hu));
+    assert_eq!(tr(hu, "Rapport de l'utilisateur.pdf"), "Rapport de l'utilisateur.pdf");
+    // one (1), other (0, 2+)
+    assert_eq!((0..=3).map(|n| (hu.0.plural)(n)).collect::<Vec<_>>(), [1, 0, 1, 1]);
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "hu").unwrap();
+    assert_eq!(app.language, "hu");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "hu");
+}
+
+#[test]
+fn ukrainian_is_registered_and_persists() {
+    let uk = Lang::from_code("uk").expect("uk registered");
+    assert_eq!(uk.name(), "Українська");
+    assert_eq!(normalize_pref("UK"), Some("uk"));
+    for tag in ["uk", "uk-UA", "uk_UA.UTF-8", "UK-ua", "uk_UA@variant"] {
+        assert_eq!(lang_from_tag(tag), Some(uk), "{tag}");
+    }
+    assert_eq!(first_supported("uk-UA\r\nen-US"), Some(uk));
+    assert_eq!(first_supported("(\n    \"uk-UA\",\n    \"en-US\"\n)\n"), Some(uk));
+    assert_eq!(tr(uk, "Звіт {n}.pdf"), "Звіт {n}.pdf");
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "UK").unwrap();
+    assert_eq!(app.language, "uk");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "uk");
+    assert!(restored.set_option("language", "xx").is_err());
+    assert_eq!(restored.language, "uk");
+}
+
+#[test]
+fn ukrainian_integer_plurals_cover_teens_and_large_counts() {
+    let uk = Lang::from_code("uk").expect("uk registered");
+    assert_eq!(uk.0.plural_forms(), 3);
+    for (counts, form) in [
+        (vec![1, 21, 31, 101, 121, 1001], 0),
+        (vec![2, 3, 4, 22, 23, 24, 102, 104, 122, 1002], 1),
+        (vec![0, 5, 10, 11, 12, 13, 14, 19, 20, 25, 100, 110, 111, 112, 114, 1000, u64::MAX], 2),
+    ] {
+        for n in counts {
+            assert_eq!((uk.0.plural)(n), form, "{n}");
+        }
+    }
+}
+
+fn arabic() -> Lang {
+    Lang::from_code("ar").expect("ar registered")
+}
+
+#[test]
+fn arabic_is_registered_and_persists() {
+    let ar = arabic();
+    assert_eq!(ar.name(), "العربية");
+    assert!(ar.rtl());
+    let rtl: Vec<&str> = Lang::all().filter(|l| l.rtl()).map(|l| l.code()).collect();
+    assert_eq!(rtl, ["ar", "ckb", "fa"], "Arabic, Kurdish and Persian are the right-to-left languages");
+    assert_eq!(normalize_pref("AR"), Some("ar"));
+    for tag in ["ar", "ar-MA", "ar_EG.UTF-8", "AR-sa", "ar_DZ@variant"] {
+        assert_eq!(lang_from_tag(tag), Some(ar), "{tag}");
+    }
+    assert_eq!(first_supported("ar-MA\r\nen-US"), Some(ar));
+    // Unknown strings and user text are never reordered by a lookup.
+    assert_eq!(tr(ar, "تقرير نهائي {n}.pdf"), "تقرير نهائي {n}.pdf");
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "AR").unwrap();
+    assert_eq!(app.language, "ar");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "ar");
+    assert!(restored.set_option("language", "xx").is_err());
+    assert_eq!(restored.language, "ar");
+}
+
+/// Catalog lookups stay in logical order; the egui 0.37 fork owns bidi shaping and display
+/// reordering (E5/E12), so preordering here would reverse Arabic twice. Accessibility names,
+/// copied labels and search therefore see the source string.
+#[test]
+fn arabic_catalog_stays_logical() {
+    let ar = arabic();
+    assert_eq!(tr(ar, "Save as…"), "حفظ باسم…");
+    assert_eq!(tr(ar, "About PdfCraft"), "حول PdfCraft");
+    assert_eq!(tr(ar, "Name:"), "الاسم:");
+    assert_eq!(tr(ar, "Issued by: "), "صادرة عن: ");
+    // Placeholders survive in their logical positions.
+    assert_eq!(tr(ar, "Couldn't open {name}: {e}"), "تعذّر فتح {name}: {e}");
+    assert_eq!(fmt(tr(ar, "Couldn't open {name}: {e}"), &[("name", "a {e}.pdf"), ("e", "x")]), "تعذّر فتح a {e}.pdf: x");
+    assert_eq!(fmt(tr(ar, "Page {p} of {n}"), &[("p", "3"), ("n", "12")]), "الصفحة 3 من 12");
+    set_current(ar);
+    let command = command_label("Undo Insert pages from a.pdf");
+    assert!(command.contains("a.pdf") && command.contains("إدراج صفحات"), "logical command label: {command:?}");
+    assert_eq!(menu_label("file.saveAs", "Save as…"), "حفظ باسم…");
+    set_current(Lang::EN);
+}
+
+#[test]
+fn arabic_plurals_follow_the_six_cldr_forms() {
+    let ar = arabic();
+    assert_eq!(ar.0.plural_forms(), 6);
+    let form = |n| (ar.0.plural)(n);
+    assert_eq!([0, 1, 2].map(form), [0, 1, 2]);
+    assert_eq!([3, 10, 103, 110, 1003].map(form), [3; 5]);
+    assert_eq!([11, 99, 111, 199, 1011].map(form), [4; 5]);
+    assert_eq!([100, 101, 102, 200, 1000, u64::MAX - 13].map(form), [5; 6]);
+}
+
+fn persian() -> Lang {
+    Lang::from_code("fa").expect("fa registered")
+}
+
+#[test]
+fn persian_is_registered_and_persists() {
+    let fa = persian();
+    assert_eq!(fa.name(), "فارسی");
+    assert!(fa.rtl());
+    // CLDR `fa` (one: i = 0 or n = 1): 0 and 1 are singular, every other count the plural.
+    assert_eq!(fa.0.plural_forms(), 2);
+    assert_eq!([0, 1, 2, 11].map(|n| (fa.0.plural)(n)), [0, 0, 1, 1]);
+    assert_eq!(normalize_pref("FA"), Some("fa"));
+    for tag in ["fa", "fa-IR", "fa_IR.UTF-8", "FA-af", "fa_IR@calendar=persian"] {
+        assert_eq!(lang_from_tag(tag), Some(fa), "{tag}");
+    }
+    assert_eq!(first_supported("fa-IR\r\nen-US"), Some(fa));
+    // Lookups return Persian in logical order; epaint handles visual ordering.
+    assert_eq!(tr(fa, "Save"), "ذخیره");
+    assert_eq!(tr(fa, "Cancel"), "لغو");
+    assert_eq!(tr(fa, "File"), "فایل");
+    // Unknown strings and user text are never reordered by a lookup.
+    assert_eq!(tr(fa, "گزارش نهایی {n}.pdf"), "گزارش نهایی {n}.pdf");
+    let mut app = crate::PdfCraftApp::default();
+    app.set_option("language", "FA").unwrap();
+    assert_eq!(app.language, "fa");
+    let mut restored = crate::PdfCraftApp::default();
+    restored.restore(&app.persist());
+    assert_eq!(restored.language, "fa");
+    assert!(restored.set_option("language", "xx").is_err());
+    assert_eq!(restored.language, "fa");
+}
+
+/// With a craft-fonts Arabic face, every Arabic translation has glyphs: with all interface
+/// faces (desktop) and with the Arabic face as the only craft-fonts face (the web build keeps
+/// it; Arabic labels must not need a Japanese face).
+#[test]
+fn arabic_labels_have_glyphs() {
+    let faces: Vec<String> = pdfcraft_fonts::ui_arabic_fonts().iter().map(|f| f.name()).collect();
+    if faces.is_empty() {
+        eprintln!("skipping Arabic glyph checks: build with CRAFT_FONTS_DIR and an Arabic face to run them");
+        return;
+    }
+    let ar = arabic();
+    let (entries, _) = parse_entries(ar.0.source, ar.0.plural_forms());
+    let labels: String = entries.iter().flat_map(|e| e.translation.chars()).chain(ar.name().chars()).filter(|c| !c.is_control()).collect();
+    let mut arabic_only = crate::theme::font_definitions();
+    for family in arabic_only.families.values_mut() {
+        family.retain(|name| !pdfcraft_fonts::CRAFT_FONTS.iter().any(|face| face.name() == *name) || faces.contains(name));
+    }
+    use egui::epaint::text::{Fonts, TextOptions};
+    for (build, defs) in [("all faces", crate::theme::font_definitions()), ("Arabic face only", arabic_only)] {
+        let mut fonts = Fonts::new(TextOptions::default(), defs);
+        for id in [egui::FontId::proportional(13.0), egui::FontId::monospace(13.0), crate::theme::medium(13.0), crate::theme::semibold(17.0)] {
+            let missing: std::collections::BTreeSet<char> = labels.chars().filter(|c| !fonts.has_glyphs(&id, &c.to_string())).collect();
+            assert!(missing.is_empty(), "{build}: {id:?} lacks Arabic label glyphs {missing:?}");
+        }
+    }
+}
+
+/// Every bundled catalog is well-formed and consistent with its sources.
+#[test]
+fn bundled_catalogs_are_consistent() {
+    let mut codes = std::collections::HashSet::new();
+    for l in &LANGUAGES {
+        assert!(codes.insert(l.code), "duplicate code {}", l.code);
+        assert!(l.code == l.code.to_ascii_lowercase() && !l.name.is_empty(), "{}", l.code);
+        let (entries, errors) = parse_entries(l.source, l.plural_forms());
+        assert!(errors.is_empty(), "{}: {errors:?}", l.code);
+        for e in entries.iter().filter(|e| e.context == "@id") {
+            let command = pdfcraft_engine::commands::command(&e.source);
+            let Some(command) = command else { panic!("{}: unknown command id {:?}", l.code, e.source) };
+            assert_eq!(placeholders(&e.translation), placeholders(command.label), "{}: {}", l.code, e.source);
+            assert_eq!(e.translation.ends_with('…'), command.label.ends_with('…'), "{}: ellipsis mismatch: {}", l.code, e.source);
+        }
+    }
+}
+
+/// The translation gaps report (`cargo xtask i18n-report`, a step of `cargo xtask ci`): for
+/// each language, how many English strings it has no translation for, and the first few.
+/// It never fails: a missing string shows in English.
+///
+/// The English strings are the UI source's literals, the commands, All tools, the engine's
+/// own wordings, and every key of every bundled catalog (which covers contextual, plural and
+/// dynamically looked-up strings the scan can't see).
+#[test]
+fn translation_gaps_report() {
+    use std::collections::BTreeSet;
+    const SHOWN: usize = 3;
+    let mut plain: BTreeSet<String> = ui_literals();
+    let mut add = |s: &str| {
+        plain.insert(s.to_string());
+    };
+    for command in pdfcraft_engine::commands::COMMANDS {
+        add(command.label);
+        command.menu.into_iter().for_each(&mut add);
+    }
+    for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+        add(group.label);
+        for section in group.sections {
+            add(section.title);
+            section.items.iter().for_each(|item| add(item.label));
+        }
+    }
+    pdfcraft_engine::catalog::TOOL_CATEGORIES.iter().for_each(|category| add(category.label));
+    let engine: [&[&str]; 9] = [
+        pdfcraft_engine::a11y::WORDINGS,
+        pdfcraft_engine::a11y::REPORT_WORDS,
+        pdfcraft_engine::pdfa::WORDINGS,
+        pdfcraft_engine::sign::pdf::WORDINGS,
+        pdfcraft_engine::sign::pdf::kind::ALL,
+        pdfcraft_engine::print::WORDINGS,
+        pdfcraft_engine::EDIT_LABELS,
+        pdfcraft_engine::BATCH_LABELS,
+        pdfcraft_engine::field_table::WORDINGS,
+    ];
+    engine.into_iter().flatten().for_each(|s| add(s));
+    pdfcraft_engine::sign::AppearanceLabels::default().fields().into_iter().for_each(|(_, label)| add(label));
+    crate::credits::NameMode::ALL.iter().for_each(|mode| add(mode.label()));
+    for key in crate::credits::SortKey::ALL {
+        let (label, header) = key.label();
+        add(label);
+        add(header);
+    }
+    crate::credits::MODEL_COLUMNS.iter().for_each(|s| add(s));
+    // (context, source) keys; `@id` rows only reword a command label, which is in `plain`.
+    let mut keys: BTreeSet<(String, String)> = plain.into_iter().map(|s| (String::new(), s)).collect();
+    for language in &LANGUAGES {
+        let (entries, _) = parse_entries(language.source, language.plural_forms());
+        keys.extend(entries.into_iter().filter(|e| e.context != "@id").map(|e| (e.context, e.source)));
+    }
+    let mut report = format!("Translation gaps: {} English strings\n", keys.len());
+    for lang in Lang::all().filter(|l| *l != Lang::EN) {
+        let catalog = lang.catalog();
+        let missing: Vec<&(String, String)> = keys
+            .iter()
+            .filter(|(context, source)| match context.as_str() {
+                "" => catalog.plain(source).is_none(),
+                "@plural" => source.split_once('|').is_none_or(|(one, other)| catalog.plural(one, other, 0).is_none()),
+                // A contextual lookup falls back to the plain translation.
+                context => catalog.contextual(context, source).is_none() && catalog.plain(source).is_none(),
+            })
+            .collect();
+        let mut line = format!("  {:<8} {:>5} missing", lang.code(), missing.len());
+        for (i, (context, source)) in missing.iter().take(SHOWN).enumerate() {
+            let mut shown: String = source.chars().take(48).collect();
+            if shown.len() < source.len() {
+                shown.push('…');
+            }
+            let key = if context.is_empty() { format!("{shown:?}") } else { format!("{context} / {shown:?}") };
+            line.push_str(if i == 0 { ": " } else { ", " });
+            line.push_str(&key);
+        }
+        if missing.len() > SHOWN {
+            line.push_str(", …");
+        }
+        report.push_str(&line);
+        report.push('\n');
+    }
+    println!("{REPORT_START}\n{report}{REPORT_END}");
+}
+
+/// The lines `cargo xtask i18n-report` prints from the test output lie between these.
+const REPORT_START: &str = "=== translation gaps ===";
+const REPORT_END: &str = "=== end of translation gaps ===";
+
+/// Preferences ▸ Date format ▸ Language offers exactly the interface languages, in order.
+#[test]
+fn date_languages_are_the_interface_languages() {
+    let interface: Vec<(&str, &str)> = Lang::all().map(|l| (l.code(), l.name())).collect();
+    let dates: Vec<(&str, &str)> = pdfcraft_engine::dates::DATE_LANGUAGES.iter().map(|l| (l.code, l.name)).collect();
+    assert_eq!(dates, interface);
+}
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 9aa0375d2d..2c9b892ed7 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -172,6 +172,15 @@
 	Available	พร้อมใช้งาน
 	Ready	พร้อมใช้
 	Search tools and commands…	ค้นหาเครื่องมือและคำสั่ง…
+
+# Accessible names for inputs that have no visible label.
+	Added text	ข้อความที่เพิ่ม
+	Link URL	URL ของลิงก์
+	Search tools and commands	ค้นหาเครื่องมือและคำสั่ง
+	Text editing line	บรรทัดแก้ไขข้อความ
+	Text to place	ข้อความที่จะวาง
+	Tooltip	คำแนะนำเครื่องมือ
+	Words or phrases to redact	คำหรือวลีที่จะปิดทับ
 	No matching tools	ไม่มีเครื่องมือที่ตรงกัน
 	Tool	เครื่องมือ
 	Command	คำสั่ง
@@ -2686,6 +2695,14 @@ key	Space	Space
 	Make properties default	ตั้งคุณสมบัติเป็นค่าเริ่มต้น
 	Pages selected	หน้าที่เลือก
 	Page properties	คุณสมบัติหน้า
+	Create & Edit	สร้างและแก้ไข
+	Review & Compare	ตรวจทานและเปรียบเทียบ
+	Forms & Signatures	แบบฟอร์มและลายเซ็น
+	Protect & Standardize	ป้องกันและกำหนดมาตรฐาน
+	Customize & Automate	ปรับแต่งและทำงานอัตโนมัติ
+	No tools match your search.	ไม่มีเครื่องมือที่ตรงกับการค้นหาของคุณ
+	Expand all tools	ขยายเครื่องมือทั้งหมด
+	Collapse all tools	ยุบเครื่องมือทั้งหมด
 	The password must have at least 8 characters.	รหัสผ่านต้องมีอย่างน้อย 8 ตัวอักษร
 theme	Appearance	ลักษณะที่ปรากฏ
 
@@ -2694,3 +2711,12 @@ theme	Appearance	ลักษณะที่ปรากฏ
 
 # AI-assisted additions for restoring the last view (#1767) (2026-10-22); not reviewed by a native speaker.
 	Restore the last view (page, zoom and page display) when a document is opened again	คืนค่ามุมมองล่าสุด (หน้า การซูม และการแสดงหน้า) เมื่อเปิดเอกสารอีกครั้ง
+@plural	{n} reply|{n} replies	การตอบกลับ {n} รายการ
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	เครื่องมือหน้า
+	Insert pages from a file after the selection…	แทรกหน้าจากไฟล์หลังส่วนที่เลือก…
+	Rotate the selected pages counterclockwise	หมุนหน้าที่เลือกทวนเข็มนาฬิกา
+	Rotate the selected pages clockwise	หมุนหน้าที่เลือกตามเข็มนาฬิกา
+	Extract the selected pages…	แยกหน้าที่เลือกออก…
+	Delete the selected pages	ลบหน้าที่เลือก
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index a640e501a0..a2ecaea179 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -142,6 +142,15 @@
 	Available	Kullanılabilir
 	Ready	Hazır
 	Search tools and commands…	Araçları ve komutları ara…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Eklenen metin
+	Link URL	Bağlantı URL'si
+	Search tools and commands	Araçları ve komutları ara
+	Text editing line	Metin düzenleme satırı
+	Text to place	Yerleştirilecek metin
+	Tooltip	İpucu
+	Words or phrases to redact	Karartılacak sözcükler veya ifadeler
 	No matching tools	Eşleşen araç yok
 	Tool	Araç
 	Command	Komut
@@ -2485,6 +2494,14 @@ animation effects	Off	Kapalı
 	Make properties default	Özellikleri varsayılan yap
 	Pages selected	Seçilen sayfalar
 	Page properties	Sayfa özellikleri
+	Create & Edit	Oluştur ve Düzenle
+	Review & Compare	İncele ve Karşılaştır
+	Forms & Signatures	Formlar ve İmzalar
+	Protect & Standardize	Koru ve Standartlaştır
+	Customize & Automate	Özelleştir ve Otomatikleştir
+	No tools match your search.	Aramanızla eşleşen araç yok.
+	Expand all tools	Tüm araçları genişlet
+	Collapse all tools	Tüm araçları daralt
 	Attach a file…	Dosya ekle…
 	Delete attachment	Eki sil
 	Attaching files is not available on the web yet	Dosya eklemek web'de henüz kullanılamıyor
@@ -2527,3 +2544,12 @@ animation effects	Off	Kapalı
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Bugün
+@plural	{n} reply|{n} replies	{n} yanıt
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Sayfa araçları
+	Insert pages from a file after the selection…	Seçimin ardından dosyadan sayfa ekle…
+	Rotate the selected pages counterclockwise	Seçili sayfaları saat yönünün tersine döndür
+	Rotate the selected pages clockwise	Seçili sayfaları saat yönünde döndür
+	Extract the selected pages…	Seçili sayfaları ayıkla…
+	Delete the selected pages	Seçili sayfaları sil
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index f519504109..9c76868839 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -182,6 +182,15 @@
 	Available	Доступно
 	Ready	Готово
 	Search tools and commands…	Пошук інструментів і команд…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Доданий текст
+	Link URL	URL-адреса посилання
+	Search tools and commands	Пошук інструментів і команд
+	Text editing line	Рядок редагування тексту
+	Text to place	Текст для розміщення
+	Tooltip	Підказка
+	Words or phrases to redact	Слова або фрази для вилучення
 	No matching tools	Відповідних інструментів немає
 	Tool	Інструмент
 	Command	Команда
@@ -2511,6 +2520,14 @@ animation effects	Off	Вимкнено
 	Make properties default	Зробити властивості типовими
 	Pages selected	Вибрані сторінки
 	Page properties	Властивості сторінки
+	Create & Edit	Створення й редагування
+	Review & Compare	Рецензування й порівняння
+	Forms & Signatures	Форми й підписи
+	Protect & Standardize	Захист і стандартизація
+	Customize & Automate	Налаштування й автоматизація
+	No tools match your search.	Немає інструментів, що відповідають пошуку.
+	Expand all tools	Розгорнути всі інструменти
+	Collapse all tools	Згорнути всі інструменти
 	Attach a file…	Прикріпити файл…
 	Delete attachment	Видалити вкладення
 	Attaching files is not available on the web yet	Прикріплення файлів у веб-версії поки недоступне
@@ -2553,3 +2570,12 @@ animation effects	Off	Вимкнено
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Сьогодні
+@plural	{n} reply|{n} replies	{n} відповідь|{n} відповіді|{n} відповідей
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Інструменти сторінок
+	Insert pages from a file after the selection…	Вставити сторінки з файлу після виділення…
+	Rotate the selected pages counterclockwise	Повернути вибрані сторінки проти годинникової стрілки
+	Rotate the selected pages clockwise	Повернути вибрані сторінки за годинниковою стрілкою
+	Extract the selected pages…	Витягнути вибрані сторінки…
+	Delete the selected pages	Видалити вибрані сторінки
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index c5757a3e84..973ba870ea 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -1057,6 +1057,15 @@ theme	Appearance	Giao diện
 	Scroll tabs right	Cuộn các thẻ sang phải
 	Search comments	Tìm bình luận
 	Search tools and commands…	Tìm công cụ và lệnh…
+
+# Accessible names for inputs that have no visible label.
+	Added text	Văn bản đã thêm
+	Link URL	URL của liên kết
+	Search tools and commands	Tìm công cụ và lệnh
+	Text editing line	Dòng chỉnh sửa văn bản
+	Text to place	Văn bản cần đặt
+	Tooltip	Chú giải công cụ
+	Words or phrases to redact	Từ hoặc cụm từ cần xóa
 	Searchable Image (Exact)	Ảnh có thể tìm kiếm (Chính xác)
 	Searching… {s} of {p} pages	Đang tìm… {s} trên {p} trang
 	Searching… {s}/{p}	Đang tìm… {s}/{p}
@@ -2676,6 +2685,14 @@ key	Space	Space
 	Redact Image	Xóa nội dung nhạy cảm của hình ảnh
 	Create Link…	Tạo liên kết…
 	Recognize Text…	Nhận dạng văn bản…
+	Create & Edit	Tạo và chỉnh sửa
+	Review & Compare	Xem xét và so sánh
+	Forms & Signatures	Biểu mẫu và chữ ký
+	Protect & Standardize	Bảo vệ và chuẩn hóa
+	Customize & Automate	Tùy chỉnh và tự động hóa
+	No tools match your search.	Không có công cụ nào khớp với tìm kiếm.
+	Expand all tools	Mở rộng tất cả công cụ
+	Collapse all tools	Thu gọn tất cả công cụ
 
 # AI-assisted additions for concurrently merged UI features (2026-10-15).
 # These additions have not had separate native-speaker review.
@@ -2798,3 +2815,12 @@ key	Space	Space
 
 # AI-assisted additions for restoring the last view (#1767) (2026-10-16); not reviewed by a native speaker.
 	Restore the last view (page, zoom and page display) when a document is opened again	Khôi phục chế độ xem gần nhất (trang, thu phóng và hiển thị trang) khi mở lại tài liệu
+@plural	{n} reply|{n} replies	{n} câu trả lời
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	Công cụ trang
+	Insert pages from a file after the selection…	Chèn trang từ tệp sau vùng chọn…
+	Rotate the selected pages counterclockwise	Xoay các trang đã chọn ngược chiều kim đồng hồ
+	Rotate the selected pages clockwise	Xoay các trang đã chọn theo chiều kim đồng hồ
+	Extract the selected pages…	Trích xuất các trang đã chọn…
+	Delete the selected pages	Xóa các trang đã chọn
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 4c33d8603e..d77c8f6425 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -1839,6 +1839,15 @@
 	Tool	工具
 	Command	命令
 	Search tools and commands…	搜索工具和命令…
+
+# Accessible names for inputs that have no visible label.
+	Added text	已添加的文本
+	Link URL	链接 URL
+	Search tools and commands	搜索工具和命令
+	Text editing line	文本编辑行
+	Text to place	要放置的文本
+	Tooltip	提示
+	Words or phrases to redact	要密文的单词或短语
 	No matching tools	没有匹配的工具
 	All tools	所有工具
 	Read	阅读
@@ -2453,6 +2462,14 @@ animation effects	Off	关
 	Make properties default	将属性设为默认
 	Pages selected	选定的页面
 	Page properties	页面属性
+	Create & Edit	创建和编辑
+	Review & Compare	审阅和比较
+	Forms & Signatures	表单和签名
+	Protect & Standardize	保护和标准化
+	Customize & Automate	自定义和自动化
+	No tools match your search.	没有与搜索匹配的工具。
+	Expand all tools	展开所有工具
+	Collapse all tools	折叠所有工具
 	Attach a file…	附加文件…
 	Delete attachment	删除附件
 	Attaching files is not available on the web yet	网页版尚不支持附加文件
@@ -2495,3 +2512,12 @@ animation effects	Off	关
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今天
+@plural	{n} reply|{n} replies	{n} 条回复
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	页面工具
+	Insert pages from a file after the selection…	在所选内容后插入文件中的页面…
+	Rotate the selected pages counterclockwise	逆时针旋转所选页面
+	Rotate the selected pages clockwise	顺时针旋转所选页面
+	Extract the selected pages…	提取所选页面…
+	Delete the selected pages	删除所选页面
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index df79eae04f..ce3b939f1d 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1783,6 +1783,15 @@
 	Tool	工具
 	Command	指令
 	Search tools and commands…	搜尋工具與指令…
+
+# Accessible names for inputs that have no visible label.
+	Added text	已新增的文字
+	Link URL	連結 URL
+	Search tools and commands	搜尋工具與指令
+	Text editing line	文字編輯行
+	Text to place	要放置的文字
+	Tooltip	提示
+	Words or phrases to redact	要遮蔽的字詞或片語
 	No matching tools	找不到相符的工具
 	All tools	所有工具
 	Read	閱讀
@@ -2439,6 +2448,14 @@ animation effects	Off	關
 	Make properties default	將內容設為預設
 	Pages selected	選取的頁面
 	Page properties	頁面屬性
+	Create & Edit	建立與編輯
+	Review & Compare	審閱與比較
+	Forms & Signatures	表單與簽名
+	Protect & Standardize	保護與標準化
+	Customize & Automate	自訂與自動化
+	No tools match your search.	沒有符合搜尋的工具。
+	Expand all tools	展開所有工具
+	Collapse all tools	摺疊所有工具
 	Attach a file…	附加檔案…
 	Delete attachment	刪除附件
 	Attaching files is not available on the web yet	網頁版尚不支援附加檔案
@@ -2481,3 +2498,12 @@ animation effects	Off	關
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今天
+@plural	{n} reply|{n} replies	{n} 則回覆
+
+# Pages panel: the Page tools menu (#4415) (AI-assisted, not separately native-reviewed)
+	Page tools	頁面工具
+	Insert pages from a file after the selection…	在所選內容後插入檔案中的頁面…
+	Rotate the selected pages counterclockwise	逆時針旋轉所選頁面
+	Rotate the selected pages clockwise	順時針旋轉所選頁面
+	Extract the selected pages…	擷取所選頁面…
+	Delete the selected pages	刪除所選頁面
diff --git a/crates/ui-egui/src/icon_data.rs b/crates/ui-egui/src/icon_data.rs
deleted file mode 100644
index f986cd6bf4..0000000000
--- a/crates/ui-egui/src/icon_data.rs
+++ /dev/null
@@ -1,195 +0,0 @@
-//! Lucide icons (ISC licence, see assets/icons/LICENSE-lucide.txt), embedded and tinted at runtime.
-//! Generated from the contents of assets/icons/.
-
-pub static ICONS: &[(&str, &[u8])] = &[
-    ("accessibility", include_bytes!("../../../assets/icons/accessibility.svg")),
-    ("align-center", include_bytes!("../../../assets/icons/align-center.svg")),
-    ("align-justify", include_bytes!("../../../assets/icons/align-justify.svg")),
-    ("file-spreadsheet", include_bytes!("../../../assets/icons/file-spreadsheet.svg")),
-    ("file-code", include_bytes!("../../../assets/icons/file-code.svg")),
-    ("square-terminal", include_bytes!("../../../assets/icons/square-terminal.svg")),
-    ("align-left", include_bytes!("../../../assets/icons/align-left.svg")),
-    ("align-right", include_bytes!("../../../assets/icons/align-right.svg")),
-    ("app-window", include_bytes!("../../../assets/icons/app-window.svg")),
-    ("arrow-left-right", include_bytes!("../../../assets/icons/arrow-left-right.svg")),
-    ("arrow-up-down", include_bytes!("../../../assets/icons/arrow-up-down.svg")),
-    ("arrow-up-right", include_bytes!("../../../assets/icons/arrow-up-right.svg")),
-    ("badge-check", include_bytes!("../../../assets/icons/badge-check.svg")),
-    ("bandage", include_bytes!("../../../assets/icons/bandage.svg")),
-    ("bell", include_bytes!("../../../assets/icons/bell.svg")),
-    ("blend", include_bytes!("../../../assets/icons/blend.svg")),
-    ("bold", include_bytes!("../../../assets/icons/bold.svg")),
-    ("book-open", include_bytes!("../../../assets/icons/book-open.svg")),
-    ("bookmark", include_bytes!("../../../assets/icons/bookmark.svg")),
-    ("bookmark-plus", include_bytes!("../../../assets/icons/bookmark-plus.svg")),
-    ("braces", include_bytes!("../../../assets/icons/braces.svg")),
-    ("brush", include_bytes!("../../../assets/icons/brush.svg")),
-    ("brush-cleaning", include_bytes!("../../../assets/icons/brush-cleaning.svg")),
-    ("camera", include_bytes!("../../../assets/icons/camera.svg")),
-    ("check", include_bytes!("../../../assets/icons/check.svg")),
-    ("check-circle-2", include_bytes!("../../../assets/icons/check-circle-2.svg")),
-    ("chevron-down", include_bytes!("../../../assets/icons/chevron-down.svg")),
-    ("chevron-left", include_bytes!("../../../assets/icons/chevron-left.svg")),
-    ("chevron-right", include_bytes!("../../../assets/icons/chevron-right.svg")),
-    ("chevron-up", include_bytes!("../../../assets/icons/chevron-up.svg")),
-    ("chevrons-left", include_bytes!("../../../assets/icons/chevrons-left.svg")),
-    ("chevrons-right", include_bytes!("../../../assets/icons/chevrons-right.svg")),
-    ("circle", include_bytes!("../../../assets/icons/circle.svg")),
-    ("circle-check", include_bytes!("../../../assets/icons/circle-check.svg")),
-    ("circle-dashed", include_bytes!("../../../assets/icons/circle-dashed.svg")),
-    ("circle-dot", include_bytes!("../../../assets/icons/circle-dot.svg")),
-    ("circle-help", include_bytes!("../../../assets/icons/circle-help.svg")),
-    ("circle-x", include_bytes!("../../../assets/icons/circle-x.svg")),
-    ("clipboard-paste", include_bytes!("../../../assets/icons/clipboard-paste.svg")),
-    ("clock", include_bytes!("../../../assets/icons/clock.svg")),
-    ("clock-3", include_bytes!("../../../assets/icons/clock-3.svg")),
-    ("cloud", include_bytes!("../../../assets/icons/cloud.svg")),
-    ("cloud-upload", include_bytes!("../../../assets/icons/cloud-upload.svg")),
-    ("code-xml", include_bytes!("../../../assets/icons/code-xml.svg")),
-    ("columns-2", include_bytes!("../../../assets/icons/columns-2.svg")),
-    ("columns-3", include_bytes!("../../../assets/icons/columns-3.svg")),
-    ("compass", include_bytes!("../../../assets/icons/compass.svg")),
-    ("contrast", include_bytes!("../../../assets/icons/contrast.svg")),
-    ("copy", include_bytes!("../../../assets/icons/copy.svg")),
-    ("copy-plus", include_bytes!("../../../assets/icons/copy-plus.svg")),
-    ("crop", include_bytes!("../../../assets/icons/crop.svg")),
-    ("droplet", include_bytes!("../../../assets/icons/droplet.svg")),
-    ("ellipsis", include_bytes!("../../../assets/icons/ellipsis.svg")),
-    ("ellipsis-vertical", include_bytes!("../../../assets/icons/ellipsis-vertical.svg")),
-    ("eraser", include_bytes!("../../../assets/icons/eraser.svg")),
-    ("external-link", include_bytes!("../../../assets/icons/external-link.svg")),
-    ("eye", include_bytes!("../../../assets/icons/eye.svg")),
-    ("eye-off", include_bytes!("../../../assets/icons/eye-off.svg")),
-    ("file-check", include_bytes!("../../../assets/icons/file-check.svg")),
-    ("file-down", include_bytes!("../../../assets/icons/file-down.svg")),
-    ("file-input", include_bytes!("../../../assets/icons/file-input.svg")),
-    ("file-lock-2", include_bytes!("../../../assets/icons/file-lock-2.svg")),
-    ("file-minus", include_bytes!("../../../assets/icons/file-minus.svg")),
-    ("file-output", include_bytes!("../../../assets/icons/file-output.svg")),
-    ("file-pen-line", include_bytes!("../../../assets/icons/file-pen-line.svg")),
-    ("file-plus", include_bytes!("../../../assets/icons/file-plus.svg")),
-    ("file-plus-2", include_bytes!("../../../assets/icons/file-plus-2.svg")),
-    ("file-scan", include_bytes!("../../../assets/icons/file-scan.svg")),
-    ("file-search", include_bytes!("../../../assets/icons/file-search.svg")),
-    ("file-symlink", include_bytes!("../../../assets/icons/file-symlink.svg")),
-    ("file-text", include_bytes!("../../../assets/icons/file-text.svg")),
-    ("file-x", include_bytes!("../../../assets/icons/file-x.svg")),
-    ("files", include_bytes!("../../../assets/icons/files.svg")),
-    ("film", include_bytes!("../../../assets/icons/film.svg")),
-    ("filter", include_bytes!("../../../assets/icons/filter.svg")),
-    ("flip-horizontal-2", include_bytes!("../../../assets/icons/flip-horizontal-2.svg")),
-    ("flip-vertical-2", include_bytes!("../../../assets/icons/flip-vertical-2.svg")),
-    ("folder", include_bytes!("../../../assets/icons/folder.svg")),
-    ("folder-open", include_bytes!("../../../assets/icons/folder-open.svg")),
-    ("folder-plus", include_bytes!("../../../assets/icons/folder-plus.svg")),
-    ("gauge", include_bytes!("../../../assets/icons/gauge.svg")),
-    ("git-compare", include_bytes!("../../../assets/icons/git-compare.svg")),
-    ("globe", include_bytes!("../../../assets/icons/globe.svg")),
-    ("grid-3x3", include_bytes!("../../../assets/icons/grid-3x3.svg")),
-    ("hand", include_bytes!("../../../assets/icons/hand.svg")),
-    ("hash", include_bytes!("../../../assets/icons/hash.svg")),
-    ("heading", include_bytes!("../../../assets/icons/heading.svg")),
-    ("highlighter", include_bytes!("../../../assets/icons/highlighter.svg")),
-    ("house", include_bytes!("../../../assets/icons/house.svg")),
-    ("image", include_bytes!("../../../assets/icons/image.svg")),
-    ("image-plus", include_bytes!("../../../assets/icons/image-plus.svg")),
-    ("info", include_bytes!("../../../assets/icons/info.svg")),
-    ("italic", include_bytes!("../../../assets/icons/italic.svg")),
-    ("languages", include_bytes!("../../../assets/icons/languages.svg")),
-    ("lasso", include_bytes!("../../../assets/icons/lasso.svg")),
-    ("layers", include_bytes!("../../../assets/icons/layers.svg")),
-    ("layout-grid", include_bytes!("../../../assets/icons/layout-grid.svg")),
-    ("link", include_bytes!("../../../assets/icons/link.svg")),
-    ("link-2", include_bytes!("../../../assets/icons/link-2.svg")),
-    ("list", include_bytes!("../../../assets/icons/list.svg")),
-    ("list-checks", include_bytes!("../../../assets/icons/list-checks.svg")),
-    ("list-ordered", include_bytes!("../../../assets/icons/list-ordered.svg")),
-    ("lock", include_bytes!("../../../assets/icons/lock.svg")),
-    ("lock-open", include_bytes!("../../../assets/icons/lock-open.svg")),
-    ("maximize", include_bytes!("../../../assets/icons/maximize.svg")),
-    ("maximize-2", include_bytes!("../../../assets/icons/maximize-2.svg")),
-    ("message-circle-reply", include_bytes!("../../../assets/icons/message-circle-reply.svg")),
-    ("message-square", include_bytes!("../../../assets/icons/message-square.svg")),
-    ("message-square-plus", include_bytes!("../../../assets/icons/message-square-plus.svg")),
-    ("message-square-quote", include_bytes!("../../../assets/icons/message-square-quote.svg")),
-    ("message-square-text", include_bytes!("../../../assets/icons/message-square-text.svg")),
-    ("messages-square", include_bytes!("../../../assets/icons/messages-square.svg")),
-    ("mic", include_bytes!("../../../assets/icons/mic.svg")),
-    ("minimize", include_bytes!("../../../assets/icons/minimize.svg")),
-    ("minimize-2", include_bytes!("../../../assets/icons/minimize-2.svg")),
-    ("minus", include_bytes!("../../../assets/icons/minus.svg")),
-    ("monitor", include_bytes!("../../../assets/icons/monitor.svg")),
-    ("moon", include_bytes!("../../../assets/icons/moon.svg")),
-    ("mouse-pointer-2", include_bytes!("../../../assets/icons/mouse-pointer-2.svg")),
-    ("move", include_bytes!("../../../assets/icons/move.svg")),
-    ("move-right", include_bytes!("../../../assets/icons/move-right.svg")),
-    ("navigation", include_bytes!("../../../assets/icons/navigation.svg")),
-    ("paint-bucket", include_bytes!("../../../assets/icons/paint-bucket.svg")),
-    ("palette", include_bytes!("../../../assets/icons/palette.svg")),
-    ("panel-left", include_bytes!("../../../assets/icons/panel-left.svg")),
-    ("panel-right", include_bytes!("../../../assets/icons/panel-right.svg")),
-    ("panels-top-left", include_bytes!("../../../assets/icons/panels-top-left.svg")),
-    ("paperclip", include_bytes!("../../../assets/icons/paperclip.svg")),
-    ("pen-line", include_bytes!("../../../assets/icons/pen-line.svg")),
-    ("pen-tool", include_bytes!("../../../assets/icons/pen-tool.svg")),
-    ("pencil", include_bytes!("../../../assets/icons/pencil.svg")),
-    ("pentagon", include_bytes!("../../../assets/icons/pentagon.svg")),
-    ("pin", include_bytes!("../../../assets/icons/pin.svg")),
-    ("pipette", include_bytes!("../../../assets/icons/pipette.svg")),
-    ("plus", include_bytes!("../../../assets/icons/plus.svg")),
-    ("presentation", include_bytes!("../../../assets/icons/presentation.svg")),
-    ("printer", include_bytes!("../../../assets/icons/printer.svg")),
-    ("rectangle-horizontal", include_bytes!("../../../assets/icons/rectangle-horizontal.svg")),
-    ("redo-2", include_bytes!("../../../assets/icons/redo-2.svg")),
-    ("replace", include_bytes!("../../../assets/icons/replace.svg")),
-    ("reply", include_bytes!("../../../assets/icons/reply.svg")),
-    ("rotate-ccw", include_bytes!("../../../assets/icons/rotate-ccw.svg")),
-    ("rotate-cw", include_bytes!("../../../assets/icons/rotate-cw.svg")),
-    ("rows-3", include_bytes!("../../../assets/icons/rows-3.svg")),
-    ("ruler", include_bytes!("../../../assets/icons/ruler.svg")),
-    ("save", include_bytes!("../../../assets/icons/save.svg")),
-    ("scan", include_bytes!("../../../assets/icons/scan.svg")),
-    ("scan-text", include_bytes!("../../../assets/icons/scan-text.svg")),
-    ("scissors", include_bytes!("../../../assets/icons/scissors.svg")),
-    ("search", include_bytes!("../../../assets/icons/search.svg")),
-    ("send", include_bytes!("../../../assets/icons/send.svg")),
-    ("settings", include_bytes!("../../../assets/icons/settings.svg")),
-    ("settings-2", include_bytes!("../../../assets/icons/settings-2.svg")),
-    ("share-2", include_bytes!("../../../assets/icons/share-2.svg")),
-    ("shield-check", include_bytes!("../../../assets/icons/shield-check.svg")),
-    ("signature", include_bytes!("../../../assets/icons/signature.svg")),
-    ("sliders-horizontal", include_bytes!("../../../assets/icons/sliders-horizontal.svg")),
-    ("sparkles", include_bytes!("../../../assets/icons/sparkles.svg")),
-    ("spline", include_bytes!("../../../assets/icons/spline.svg")),
-    ("square", include_bytes!("../../../assets/icons/square.svg")),
-    ("square-dashed", include_bytes!("../../../assets/icons/square-dashed.svg")),
-    ("square-dashed-mouse-pointer", include_bytes!("../../../assets/icons/square-dashed-mouse-pointer.svg")),
-    ("squares-subtract", include_bytes!("../../../assets/icons/squares-subtract.svg")),
-    ("stamp", include_bytes!("../../../assets/icons/stamp.svg")),
-    ("star", include_bytes!("../../../assets/icons/star.svg")),
-    ("sticky-note", include_bytes!("../../../assets/icons/sticky-note.svg")),
-    ("strikethrough", include_bytes!("../../../assets/icons/strikethrough.svg")),
-    ("sun", include_bytes!("../../../assets/icons/sun.svg")),
-    ("swatch-book", include_bytes!("../../../assets/icons/swatch-book.svg")),
-    ("tag", include_bytes!("../../../assets/icons/tag.svg")),
-    ("text-cursor-input", include_bytes!("../../../assets/icons/text-cursor-input.svg")),
-    ("text-select", include_bytes!("../../../assets/icons/text-select.svg")),
-    ("thumbs-down", include_bytes!("../../../assets/icons/thumbs-down.svg")),
-    ("thumbs-up", include_bytes!("../../../assets/icons/thumbs-up.svg")),
-    ("trash", include_bytes!("../../../assets/icons/trash.svg")),
-    ("trash-2", include_bytes!("../../../assets/icons/trash-2.svg")),
-    ("triangle-alert", include_bytes!("../../../assets/icons/triangle-alert.svg")),
-    ("type", include_bytes!("../../../assets/icons/type.svg")),
-    ("underline", include_bytes!("../../../assets/icons/underline.svg")),
-    ("undo-2", include_bytes!("../../../assets/icons/undo-2.svg")),
-    ("user-round", include_bytes!("../../../assets/icons/user-round.svg")),
-    ("wand-sparkles", include_bytes!("../../../assets/icons/wand-sparkles.svg")),
-    ("wrench", include_bytes!("../../../assets/icons/wrench.svg")),
-    ("move-horizontal", include_bytes!("../../../assets/icons/move-horizontal.svg")),
-    ("pilcrow", include_bytes!("../../../assets/icons/pilcrow.svg")),
-    ("subscript", include_bytes!("../../../assets/icons/subscript.svg")),
-    ("superscript", include_bytes!("../../../assets/icons/superscript.svg")),
-    ("x", include_bytes!("../../../assets/icons/x.svg")),
-    ("zoom-in", include_bytes!("../../../assets/icons/zoom-in.svg")),
-    ("zoom-out", include_bytes!("../../../assets/icons/zoom-out.svg")),
-];
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index c778bd1be1..65bc7e4b1b 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -9,11 +9,7 @@
 // The settings object in `persist` is one `json!` literal past the default limit of 128.
 #![recursion_limit = "256"]
 
-/// Whether `a` and `b` name the same file: equal, or equal once made absolute against the
-/// current directory (links are not resolved, as in `last_session`).
-pub(crate) fn same_file(a: &str, b: &str) -> bool {
-    a == b || matches!((std::path::absolute(a), std::path::absolute(b)), (Ok(x), Ok(y)) if x == y)
-}
+use crate::control::Host as _;
 
 /// Translate an English UI string into the current language (see [`i18n`]).
 macro_rules! tl {
@@ -29,133 +25,32 @@ macro_rules! tl_ctx {
         $crate::i18n::tr_ctx($crate::i18n::current(), $context, $s)
     };
 }
-
-mod a11y_ui;
-mod actions_ui;
-mod appearance;
-mod calc_order_ui;
 pub mod canvas;
 mod chrome;
-mod combine_grid;
-mod image_pick;
-mod tags_ui;
 pub use combine_grid::ThumbState as CombineThumb;
-mod combine_ui;
-pub mod docking;
 pub use combine_ui::{Columns as CombineColumns, CombineView, Lock as CombineLock, SortKey};
-mod camera_ui;
 mod commands;
-mod comment_props;
-pub mod comments;
-mod comments_panel;
-mod compare_ui;
 pub mod control;
-mod create_multiple_ui;
-mod create_ui;
-mod credits;
-mod crop;
-mod drag_pointer;
-mod export_ui;
-mod js_ui;
-#[cfg(target_os = "macos")]
-mod macos_association;
-mod marks_ui;
-mod measure_ui;
-mod ocr_ui;
-mod optimize_ui;
-mod search_ui;
-mod sign_ui;
-mod stamps_ui;
-mod standards_ui;
-mod zoom_snap;
+mod menus;
 /// Header & footer / watermark / background dialog types (tests and automation).
 pub mod marks {
     pub use crate::marks_ui::{MarksDraft, PageRange, Subset};
 }
-mod content_ui;
-mod link_ui;
-mod object_ui;
 pub use create_ui::Clip;
 pub use link_ui::LinkDraft;
 pub use optimize_ui::{OptimizeDraft, OptimizeTab};
 pub use sign_ui::{DigitalIdEntry, SignDraft, SignGraphic, SignStep};
-mod autoscroll;
 mod bidi;
-pub mod bulk_fields;
 mod dialogs;
-mod edit_text_ui;
-pub mod field_table_ui;
 pub use edit_text_ui::CropMode;
 mod editing;
-#[cfg(not(target_arch = "wasm32"))]
-pub mod file_watch;
-mod files;
-pub mod fill_sign;
-mod fling;
-pub mod folders_ui;
-mod format_text_ui;
-pub mod forms_ui;
 mod home;
-mod icon_data;
-pub mod icons;
-pub mod last_session;
-pub mod last_view;
-pub mod motion;
-mod page_selection_ui;
-mod pageboxes;
-mod palette;
 mod panels;
-#[cfg(not(target_arch = "wasm32"))]
-mod pickers;
-pub mod prepare;
-mod print_ui;
-mod signature_drag;
-pub mod units;
-mod web_print;
-mod word_count_ui;
 pub use print_ui::{Handling as PrintHandling, OptionsSource, PrintDraft, PrinterSource, Which as PrintWhich, system_printers};
-mod redact_ui;
 pub use redact_ui::{HiddenDraft, PagesDraft as RedactPagesDraft, RedactPrefs, SearchDraft as RedactSearchDraft, SearchMode as RedactSearchMode};
 pub mod i18n;
-
-/// [`PdfCraftApp::date_text`] for callers that already borrow other parts of the app.
-pub(crate) fn date_text(session: &Session, fmt: Option<&str>) -> Result<String, String> {
-    let lang = session.date_language().unwrap_or(i18n::current().code());
-    session.today_text(fmt, Some(lang))
-}
-
-/// Today in Preferences ▸ Date format for stamping into a PDF; refused when it has characters
-/// Fill & Sign can't write yet (see [`pdfcraft_engine::dates::unwritable`]).
-pub(crate) fn date_text_for_pdf(session: &Session) -> Result<String, String> {
-    let lang = session.date_language().unwrap_or(i18n::current().code());
-    session.today_text_for_pdf(None, Some(lang))
-}
-
-/// The longest author name kept (Preferences ▸ Identity, restored settings).
-pub(crate) const MAX_AUTHOR_CHARS: usize = 200;
-
-#[cfg(not(target_arch = "wasm32"))]
-mod open_worker;
-mod organize_panel;
-pub mod portable;
-mod protect;
-mod recovery;
-pub mod scroll_speed;
-#[cfg(not(target_arch = "wasm32"))]
-mod system_fonts;
-mod tab_context;
 pub mod theme;
-pub mod ui_scale;
-pub mod updates;
-mod wheel_boost;
-mod wheel_pager;
 mod widgets;
-pub mod window_controls;
-#[cfg(not(target_arch = "wasm32"))]
-pub mod window_state;
-
-#[cfg(all(test, not(target_arch = "wasm32")))]
-mod open_worker_tests;
 
 use pdfcraft_engine::{DocId, Session};
 
@@ -165,113 +60,109 @@ pub use files::{ExtractDraft, FilePurpose, FileRequest, RotateDraft, SplitDraft,
 pub use recovery::{AUTOSAVE_SECS, RecoveryMeta, RecoveryStore};
 use theme::{ThemeKind, ThemePreference};
 
-/// Top-level workspace modes (Acrobat's mode bar).
-#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum Mode {
-    #[serde(rename = "all")]
-    AllTools,
-    Read,
-    Edit,
-    Convert,
-    Sign,
-}
+mod app;
+mod hooks;
+mod persist;
+mod platform;
+mod state;
+mod tools;
+mod workflows;
 
-impl Mode {
-    fn parse(value: &str) -> Option<Self> {
-        match value {
-            "all" => Some(Self::AllTools),
-            "read" => Some(Self::Read),
-            "edit" => Some(Self::Edit),
-            "convert" => Some(Self::Convert),
-            "sign" => Some(Self::Sign),
-            _ => None,
-        }
-    }
-}
-
-/// What the left panel shows.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum LeftPanel {
-    AllTools,
-    Tool(&'static str),
-    /// Prepare a form ▸ Calculation order, a page of its own; Back returns to Prepare a form.
-    CalculationOrder,
-}
-
-/// Right-hand panels, opened from the rail.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-pub enum RightPanel {
-    Comments,
-    Bookmarks,
-    Pages,
-    Fields,
-    Layers,
-    Attachments,
-    Signatures,
-    /// Accessibility Checker results.
-    Accessibility,
-    /// Reachable PDF structure tags and their properties.
-    Tags,
-    /// Advanced Search results.
-    Search,
-    /// Compare files: the differences.
-    Compare,
-}
-
-/// Quick-action bar tools (the vertical floating strip).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum QuickTool {
-    Select,
-    Hand,
-    /// A commenting tool (Add comments).
-    Comment(comments::CommentTool),
-    Measure(measure_ui::Tool),
-    /// Crop pages by dragging a rectangle.
-    Crop,
-    /// Scan & OCR ▸ Enhance ▸ Camera image: drag four corners, then Enhance page.
-    EnhanceCamera,
-    /// A Fill & Sign tool.
-    Fill(fill_sign::FillTool),
-    /// A Prepare a form field tool.
-    Field(prepare::FieldTool),
-    /// Redact text and images (drag across text or draw a box).
-    Redact,
-    /// Edit a PDF ▸ Add content ▸ Text.
-    AddText,
-    /// Edit a PDF ▸ Edit text: click a line of existing text to edit it.
-    EditText,
-    /// Add a stamp: click to place this stamp.
-    Stamp(pdfcraft_engine::StampKind),
-    /// A custom stamp from the library (its index).
-    CustomStamp(usize),
-    /// Edit a PDF ▸ Link: draw link areas, select and edit links.
-    Link,
-    /// Use a certificate ▸ Digitally sign / Certify (visible): drag the signature's rectangle.
-    SignArea {
-        certify: bool,
-    },
-    /// View ▸ Zoom ▸ Marquee Zoom.
-    MarqueeZoom,
-    /// Edit ▸ Take a Snapshot.
-    Snapshot,
-    /// Edit ▸ Column Select: drag a rectangle to select only the text inside it (#740). The
-    /// Select tool does the same while Alt/Option is held at the start of a drag.
-    ColumnSelect,
-}
-
-/// A file dropped on a page grid: its name, and its bytes or, for a file on disk, the path they are
-/// read from when the file's turn to be inserted comes (so a long drop holds one file at a time).
-type GridFile = (String, Result<Vec<u8>, std::path::PathBuf>);
-
-/// Read a file dropped on a page grid (see [`GridFile`]).
-fn read_grid_file((name, source): GridFile) -> Result<(String, Vec<u8>), (String, String)> {
-    let bytes = match source {
-        Ok(bytes) => bytes,
-        Err(path) => std::fs::read(&path).map_err(|e| (name.clone(), e.to_string()))?,
-    };
-    Ok((name, bytes))
-}
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) use app::same_file;
+pub(crate) use app::{MAX_AUTHOR_CHARS, copy_refused, date_text_for_pdf, print_refused};
+use canvas::autoscroll;
+use canvas::crop;
+use canvas::fling;
+use canvas::image_pick;
+use canvas::page_pointer;
+pub use canvas::scroll_speed;
+use canvas::signature_drag;
+use canvas::wheel_boost;
+use canvas::wheel_pager;
+use canvas::zoom_snap;
+use dialogs::appearance;
+use dialogs::comment_props;
+use dialogs::credits;
+use dialogs::marks_ui;
+use dialogs::pageboxes;
+use dialogs::palette;
+use dialogs::protect;
+use dialogs::standards_ui;
+use dialogs::word_count_ui;
+pub use home::folders_ui;
+pub use hooks::{FailedInbox, HostDirtyFn, HostSaveFn, Inbox, OsEvent, OsEventsFn};
+use menus::tab_context;
+use panels::all_tools_ui;
+use panels::comments_panel;
+use panels::format_text_ui;
+use panels::organize_panel;
+use panels::page_selection_ui;
+use panels::search_ui;
+pub use panels::side_panels;
+pub use persist::last_session;
+pub use persist::last_view;
+use persist::recovery;
+pub use persist::units;
+#[cfg(not(target_arch = "wasm32"))]
+pub use persist::window_state;
+use platform::drag_pointer;
+#[cfg(not(target_arch = "wasm32"))]
+pub use platform::file_watch;
+#[cfg(target_os = "macos")]
+use platform::macos_association;
+pub use platform::motion;
+#[cfg(not(target_arch = "wasm32"))]
+use platform::open_worker;
+#[cfg(not(target_arch = "wasm32"))]
+use platform::pickers;
+pub use platform::portable;
+#[cfg(not(target_arch = "wasm32"))]
+use platform::system_fonts;
+pub use platform::ui_scale;
+pub use platform::updates;
+pub use platform::window_controls;
+#[cfg(test)]
+use state::CopyPage;
+#[cfg(not(target_arch = "wasm32"))]
+use state::OpenRequest;
+pub use state::{
+    CustomDraft, Dialog, DuplicateDraft, LeftPanel, LinkOrigin, Mode, NumberDraft, OpenOutcome, PageClip, PasswordPrompt, PendingLink,
+    PendingRemoteLink, PropsTab, QuickTool, RecentFile, RightPanel, UnlockPrompt,
+};
+use state::{DocumentCopyJob, GridFile};
+pub use tools::bulk_fields;
+use tools::calc_order_ui;
+use tools::camera_ui;
+pub use tools::comments;
+use tools::content_ui;
+use tools::edit_text_ui;
+pub use tools::field_table_ui;
+pub use tools::fill_sign;
+pub use tools::forms_ui;
+use tools::link_ui;
+use tools::measure_ui;
+use tools::object_ui;
+pub use tools::prepare;
+use tools::redact_ui;
+use tools::sign_ui;
+use tools::stamps_ui;
+use tools::tags_ui;
+use widgets::icon_data;
+pub use widgets::icons;
+use workflows::a11y_ui;
+use workflows::actions_ui;
+use workflows::combine_grid;
+use workflows::combine_ui;
+use workflows::compare_ui;
+use workflows::create_ui;
+use workflows::export_ui;
+use workflows::files;
+use workflows::js_ui;
+use workflows::ocr_ui;
+use workflows::optimize_ui;
+use workflows::print_ui;
+use workflows::web_print;
 
 /// Files dropped on a document's page grid or its Pages panel.
 struct GridDrop {
@@ -279,193 +170,8 @@ struct GridDrop {
     /// Dropped on the Pages panel (its gap decides where they go), not the page grid.
     panel: bool,
     files: Vec<GridFile>,
-    /// When to stop waiting for the pointer (egui time, seconds).
-    deadline: f64,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Dialog {
-    WordCount,
-    CreateImages,
-    Properties(PropsTab),
-    About,
-    Shortcuts,
-    Split,
-    /// Pages ▸ Number pages… (page labels).
-    NumberPages,
-    /// Protect Using Password.
-    Protect,
-    /// Set Page Boxes (crop, trim, bleed, art, media).
-    PageBoxes,
-    /// Add / Update Header and Footer, Watermark, Background.
-    Marks(pdfcraft_engine::MarkKind),
-    /// Export a PDF ▸ Image / Text.
-    Export(export_ui::ExportKind),
-    /// Fill & Sign ▸ Create signature (the drawing pad).
-    Signature,
-    /// Comment Properties.
-    CommentProps,
-    /// Replace Pages (after choosing the file).
-    ReplacePages,
-    /// Prepare a form ▸ Field Properties.
-    FieldProps,
-    /// Shared properties of several selected form fields.
-    BulkFieldProps,
-    /// Redact a PDF ▸ Redact pages, Find text and redact, Set properties, apply confirmation.
-    RedactPages,
-    RedactSearch,
-    RedactProps,
-    RedactApply,
-    /// File ▸ Print.
-    Print,
-    /// File ▸ Revert confirmation.
-    Revert,
-    /// Save over a file that changed on disk since the document came from it (#2166).
-    OverwriteChanged,
-    /// Link Properties.
-    LinkProps,
-    /// Organize ▸ Extract (options), Rotate Pages.
-    Extract,
-    RotatePages,
-    /// Remove Hidden Information and Sanitize Document.
-    RemoveHidden,
-    Sanitize,
-    /// Documents from a session that ended unexpectedly.
-    Recovery,
-    /// Comments ▸ Summarize comments (options).
-    SummarizeComments,
-    /// Sign with a Digital ID ▸ Configure ▸ Sign as.
-    Sign,
-    /// Optimize PDF ▸ Advanced optimization.
-    Optimize,
-    /// Prepare a form ▸ right-click a field ▸ Duplicate.
-    DuplicateField,
-    /// Prepare a form ▸ Text field table: a movable window rather than a modal (`field_table_ui`).
-    FieldTable,
-    /// Check for accessibility ▸ Accessibility Checker Options.
-    AccessibilityOptions,
-    /// Scan & OCR ▸ Recognize text.
-    RecognizeText,
-    /// The JavaScript console (⌘J).
-    JsConsole,
-    /// Document JavaScripts.
-    DocumentJs,
-    /// Preferences.
-    Preferences,
-    /// Compare files: choose the older version.
-    CompareFiles,
-    /// Action Wizard.
-    ActionWizard,
-    /// Standards ▸ PDF/A.
-    PdfA,
-    /// Custom stamps ▸ Create.
-    CreateStamp,
-    /// Prepare for accessibility ▸ Add alternate text.
-    AltText,
-    /// PDF Optimizer ▸ Audit space usage (then back to the optimizer).
-    AuditSpace,
-    /// Signatures ▸ Show certificate.
-    CertificateViewer,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum PropsTab {
-    Description,
-    InitialView,
-    Security,
-    Fonts,
-    Advanced,
-}
-
-/// Duplicate Field: the field and the pages (all, or a range, 1-based).
-#[derive(Clone, Debug, PartialEq)]
-pub struct DuplicateDraft {
-    pub name: String,
-    pub all: bool,
-    pub from: usize,
-    pub to: usize,
-}
-
-/// Copied pages: their document's name and bytes (as it was when copied) and the pages.
-#[derive(Clone, Debug)]
-pub struct PageClip {
-    /// The document the pages were copied from: pasting back into it keeps field names.
-    pub from: DocId,
-    pub name: String,
-    pub bytes: std::sync::Arc<Vec<u8>>,
-    pub pages: Vec<usize>,
-}
-
-/// One page of a whole-document copy: its text as read for display, to read, or not to try
-/// (reading it failed before).
-enum CopyPage {
-    Read(std::sync::Arc<pdfcraft_render::PageText>),
-    ToRead,
-    Skip,
-}
-
-/// What a whole-document copy needs, taken from the view on the UI thread: each page's text
-/// layer as far as it was read, and the document to read the others from.
-struct DocumentCopyJob {
-    pages: Vec<CopyPage>,
-    bytes: std::sync::Arc<Vec<u8>>,
-    password: Option<std::sync::Arc<str>>,
-}
-
-impl DocumentCopyJob {
-    fn of(v: &DocView, doc: &pdfcraft_engine::Document) -> DocumentCopyJob {
-        let pages = (0..v.page_count())
-            .map(|p| match v.texts.get(&p) {
-                Some(t) => CopyPage::Read(t.clone()),
-                None if v.text_failed.contains(&p) => CopyPage::Skip,
-                None => CopyPage::ToRead,
-            })
-            .collect();
-        DocumentCopyJob { pages, bytes: doc.bytes.clone(), password: doc.password.as_deref().map(std::sync::Arc::from) }
-    }
-
-    /// The document's text in page order, a page per line run. Each page read here is let go
-    /// once its text is taken, so a large document never holds every page's text layer at once.
-    /// `None` when `cancel` was set.
-    fn text(self, cancel: &std::sync::atomic::AtomicBool) -> Option<String> {
-        let mut renderer: Option<pdfcraft_render::PageRenderer> = None;
-        let mut out = String::new();
-        let mut push = |text: String| {
-            if !text.is_empty() {
-                if !out.is_empty() {
-                    out.push('\n');
-                }
-                out.push_str(&text);
-            }
-        };
-        for (page, p) in self.pages.into_iter().enumerate() {
-            if cancel.load(std::sync::atomic::Ordering::Relaxed) {
-                return None;
-            }
-            match p {
-                CopyPage::Read(t) => push(t.text_of(0..t.glyphs.len())),
-                CopyPage::ToRead => {
-                    let r = renderer.get_or_insert_with(|| {
-                        let config = pdfcraft_render::RenderConfig { password: self.password.clone(), ..Default::default() };
-                        pdfcraft_render::PageRenderer::new(self.bytes.clone(), config)
-                    });
-                    let req = pdfcraft_render::RenderRequest {
-                        page,
-                        kind: pdfcraft_render::RequestKind::Text,
-                        tile: None,
-                        scale: 1.0,
-                        tag: 0,
-                        preview: false,
-                    };
-                    if let Some(t) = r.render(req).text {
-                        push(t.text_of(0..t.glyphs.len()));
-                    }
-                }
-                CopyPage::Skip => {}
-            }
-        }
-        Some(out)
-    }
+    /// When to stop waiting for the pointer (monotonic: `logic` may run without a UI pass).
+    deadline: web_time::Instant,
 }
 
 /// A whole-document copy reading its pages off the UI thread (in place on the web, which has no
@@ -510,54 +216,6 @@ impl Drop for DocumentCopy {
     }
 }
 
-/// Files delivered asynchronously: (name, bytes).
-pub type Inbox = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<u8>)>>>;
-
-/// Files that failed to arrive asynchronously (a browser `?file=` URL that couldn't be fetched):
-/// `(name, error)`, reported to the user on the next frame (#173).
-pub type FailedInbox = std::sync::Arc<std::sync::Mutex<Vec<(String, String)>>>;
-
-/// A request the operating system sends the running app, outside its window: on macOS, Finder
-/// double-clicks, Open With and drops on the Dock icon arrive as Apple events, not arguments.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum OsEvent {
-    /// Open these files.
-    Open(Vec<String>),
-    /// Quit (the Dock's Quit, logging out), asking about unsaved changes first.
-    Quit,
-}
-
-/// Returns the [`OsEvent`]s that arrived since it was last called (set by the desktop app).
-pub type OsEventsFn = Box<dyn FnMut() -> Vec<OsEvent>>;
-
-/// Hands a saved PDF to the page embedding PdfCraft (web): `(name, bytes, save_as)`. `save_as`
-/// is `true` for Save As. Set by the web app when a host page (such as a Nextcloud app) asked
-/// for saves; without it the browser downloads the file.
-pub type HostSaveFn = Box<dyn Fn(&str, &[u8], bool) -> Result<(), String>>;
-
-/// Told every frame whether any tab has unsaved work, so a host page can warn before leaving.
-pub type HostDirtyFn = Box<dyn FnMut(bool)>;
-
-pub struct PasswordPrompt {
-    pub name: String,
-    pub path: Option<String>,
-    pub bytes: std::sync::Arc<Vec<u8>>,
-    #[cfg(not(target_arch = "wasm32"))]
-    stamp: Option<file_watch::Stamp>,
-    pub input: String,
-    pub error: Option<String>,
-    /// A late startup file must stay in the background even after it is unlocked.
-    activate: bool,
-    /// The bytes are a recovery snapshot: once the document is open it takes the snapshot's
-    /// path and recovery entry. Cancelling the prompt drops the association with it (#813).
-    recovered: Option<RecoveryMeta>,
-    /// The tool that asked for this file (a tool chosen with no document open): it runs once
-    /// the document is unlocked.
-    then: Option<&'static str>,
-    /// A link destination to apply after the linked PDF is unlocked.
-    after_open: Option<pdfcraft_render::RemoteDestination>,
-}
-
 #[cfg(not(target_arch = "wasm32"))]
 struct PendingOpen {
     token: u64,
@@ -571,47 +229,9 @@ struct PendingOpen {
     then: Option<&'static str>,
 }
 
-#[cfg(not(target_arch = "wasm32"))]
-struct OpenRequest {
-    name: String,
-    path: Option<String>,
-    stamp: Option<file_watch::Stamp>,
-    input: open_worker::Input,
-    password: Option<String>,
-    activate: bool,
-    after_open: Option<pdfcraft_render::RemoteDestination>,
-    recovered: Option<RecoveryMeta>,
-    then: Option<&'static str>,
-}
-
-/// Asks for the permissions password of an open document whose security restricts it, which
-/// lifts the restrictions (#995). Acrobat asks for it when such a document's security is changed.
-pub struct UnlockPrompt {
-    pub doc: DocId,
-    pub name: String,
-    pub input: String,
-    pub error: Option<String>,
-    /// The command to run once unlocked (Protect using password, Remove security), if any.
-    pub then: Option<&'static str>,
-}
-
-impl UnlockPrompt {
-    pub(crate) fn new(doc: &pdfcraft_engine::Document, then: Option<&'static str>) -> Self {
-        Self { doc: doc.id, name: doc.name.clone(), input: String::new(), error: None, then }
-    }
-}
-
-#[derive(serde::Serialize, serde::Deserialize)]
-pub struct RecentFile {
-    pub name: String,
-    pub path: String,
-    pub pages: usize,
-    pub size: usize,
-}
-
 pub struct PdfCraftApp {
-    pub docking: docking::Workspace,
-    pub(crate) pending_panel_reveals: Vec<docking::Panel>,
+    /// Tools side and pane widths; which panes are open is `left_open` and `right`.
+    pub side_panels: side_panels::SidePanels,
     pub session: Session,
     pub views: Vec<DocView>,
     pub(crate) closed_tabs: Vec<String>,
@@ -634,6 +254,8 @@ pub struct PdfCraftApp {
     pub left: LeftPanel,
     pub left_open: bool,
     pub right: Option<RightPanel>,
+    /// The side panel F4 reopens: the one open last.
+    pub(crate) last_right: RightPanel,
     /// The right panel that was open when the user switched to Read mode, which starts with the
     /// panes closed; leaving Read mode brings it back unless the user opened or closed a pane in
     /// Read mode meanwhile.
@@ -683,7 +305,6 @@ pub struct PdfCraftApp {
     pub fill_text_size: f64,
     pub dialog: Option<Dialog>,
     /// How to ask for the latest release (the desktop app sets it; see `updates`).
-    pub update_source: Option<updates::UpdateSource>,
     pub(crate) updates: updates::Updates,
     /// Lists the Print dialog's printers in the background (the desktop app sets it; see
     /// [`PrinterSource`]).
@@ -696,6 +317,12 @@ pub struct PdfCraftApp {
     pub palette_open: bool,
     pub palette_query: String,
     pub all_tools_expanded: bool,
+    /// The All tools view fills the workspace (its sidebar's expand button).
+    pub all_tools_full: bool,
+    pub all_tools_query: String,
+    /// The tab that showed when the expanded All tools view opened ([`Self::shown_tab`]). Another
+    /// tab coming to the front (Home, a document, Combine files) puts the view away.
+    all_tools_tab: (Option<DocId>, bool),
     pub recent: Vec<RecentFile>,
     /// Preferences: reopen the files that were open when PdfCraft last closed (#442).
     pub reopen_last_session: bool,
@@ -782,6 +409,8 @@ pub struct PdfCraftApp {
     pub props_draft: Option<(DocId, [String; 4])>,
     /// Document Properties ▸ Initial View (and reading options) being edited.
     pub view_draft: Option<(DocId, pdfcraft_engine::InitialView)>,
+    /// Document Properties ▸ Custom being edited.
+    pub custom_draft: Option<(DocId, CustomDraft)>,
     /// Files picked asynchronously for combine / insert (web).
     pub requests: files::Requests,
     /// Native file pickers in flight (they never block the frame; see `pickers`).
@@ -836,6 +465,8 @@ pub struct PdfCraftApp {
     pub cert_viewer: Option<sign_ui::CertViewer>,
     /// The last space audit.
     pub space_audit: Vec<pdfcraft_engine::optimize::SpaceUse>,
+    /// The document and edit generation `space_audit` was measured from.
+    pub(crate) space_audit_of: Option<(DocId, u64)>,
     /// Combine files: the files staged so far.
     pub combine_draft: Vec<combine_ui::CombineFile>,
     /// The combine list's field-name conflict preview (computed once per list, never saved).
@@ -896,11 +527,15 @@ pub struct PdfCraftApp {
     /// Entries left by a previous session, offered in the Recovery dialog.
     pub recoverable: Vec<RecoveryMeta>,
     recovery_keys: std::collections::HashMap<DocId, String>,
-    last_autosave: f64,
+    last_autosave: Option<web_time::Instant>,
     allow_quit: bool,
     /// Shortcuts pressed while a text field had the keyboard, run on the next frame (see
     /// `registry_shortcuts`).
     deferred_commands: Vec<(&'static str, Option<DocId>)>,
+    /// The native menu bar (macOS), while it is installed; the in-window bar shows otherwise.
+    pub(crate) native_menu: Option<craft_menu::NativeMenu>,
+    /// Input a menu click stands for (⌘C, Delete…), added to the next frame's input in `logic`.
+    pub(crate) menu_input: Vec<egui::Event>,
     /// The dialog seen at the last check, and a counter bumped whenever it changes (see
     /// [`Self::dialog_epoch`]).
     dialog_seen: Option<Dialog>,
@@ -967,6 +602,8 @@ pub struct PdfCraftApp {
     pub replace_draft: Option<files::ReplaceDraft>,
     /// The last web link the app asked the system to open (tests and automation).
     pub last_opened_url: Option<String>,
+    /// The home screen's community card was closed; it comes back next launch (not remembered).
+    pub community_card_closed: bool,
     /// A document asked to open this address; the user hasn't answered yet (#90, #91).
     pub pending_link: Option<PendingLink>,
     /// A document just opened asks to be shown in Full Screen mode (`/PageMode /FullScreen`):
@@ -975,2688 +612,3 @@ pub struct PdfCraftApp {
     /// An absolute GoToR target waiting for approval, before any target-file I/O (#1364).
     pub pending_remote_link: Option<PendingRemoteLink>,
 }
-
-/// Where in a document a request to open an address came from.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum LinkOrigin {
-    /// A link on the page.
-    Link,
-    /// A push button's URI action.
-    Button,
-    /// A script (`app.launchURL`).
-    Script,
-}
-
-impl LinkOrigin {
-    fn noun(self) -> &'static str {
-        match self {
-            Self::Link => "A link",
-            Self::Button => "A button",
-            Self::Script => "A script",
-        }
-    }
-}
-
-/// An address a document asked to open, waiting for the user to allow or cancel it.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PendingLink {
-    pub url: String,
-    pub origin: LinkOrigin,
-}
-
-/// A resolved local target and its original source/destination, independent of the active tab.
-#[derive(Clone, Debug)]
-pub struct PendingRemoteLink {
-    pub source: DocId,
-    pub path: std::path::PathBuf,
-    pub destination: pdfcraft_render::RemoteDestination,
-}
-
-/// Settings for the Number pages dialog.
-#[derive(Clone, Debug, PartialEq)]
-pub struct NumberDraft {
-    pub from: usize,
-    pub to: usize,
-    pub style: pdfcraft_engine::LabelStyle,
-    pub prefix: String,
-    pub start: u32,
-}
-
-impl Default for PdfCraftApp {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-/// A restored colour: an `[r, g, b]` array of finite numbers, each clamped to 0–1 (restored
-/// settings are untrusted). Anything else (a string, a wrong length, a null or a non-finite
-/// number) is refused whole, so the caller keeps its default.
-fn rgb_triple(v: &serde_json::Value) -> Option<[f64; 3]> {
-    let a = v.as_array()?;
-    if a.len() != 3 {
-        return None;
-    }
-    let mut out = [0.0f64; 3];
-    for (slot, x) in out.iter_mut().zip(a.iter()) {
-        let n = x.as_f64()?;
-        if !n.is_finite() {
-            return None;
-        }
-        *slot = n.clamp(0.0, 1.0);
-    }
-    Some(out)
-}
-
-/// What [`PdfCraftApp::open_path`] did: opened the file in a new tab, focused the tab already
-/// showing it, handed it to the background open worker, or failed. Failures tell the user
-/// through a toast; this is the programmatic contract for callers that must know (the control
-/// channel, tools that wait for a file) (#1620).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum OpenOutcome {
-    /// The file opened in a new tab (or raised its password prompt).
-    Opened,
-    /// A tab already showed the file; it was focused and no tab was added.
-    Focused,
-    /// The file was accepted for opening in the background; its tab appears when the open
-    /// completes (`ui.state.pending_opens` lists the files on the way).
-    Pending,
-    /// The file could not be read or opened; the user was told.
-    Failed,
-}
-
-impl PdfCraftApp {
-    pub fn new() -> Self {
-        Self {
-            session: Session::new(),
-            views: Vec::new(),
-            closed_tabs: Vec::new(),
-            active: None,
-            mode: Mode::AllTools,
-            default_mode: Mode::AllTools,
-            view_defaults: Default::default(),
-            units: Default::default(),
-            date_format_draft: None,
-            mode_override: None,
-            left: LeftPanel::AllTools,
-            docking: docking::Workspace::default(),
-            pending_panel_reveals: Vec::new(),
-            left_open: true,
-            right: None,
-            right_before_read: None,
-            comments_panel_closed: false,
-            right_panel_closed: false,
-            quick_tool: QuickTool::Select,
-            space_hand: None,
-            full_screen_tool: None,
-            comment_prefs: Default::default(),
-            theme: ThemeKind::Light,
-            // A fresh install follows the desktop's appearance (#1248); saved settings override.
-            theme_preference: ThemePreference::System,
-            reading_colors: Default::default(),
-            #[cfg(target_os = "linux")]
-            desktop_theme: None,
-            #[cfg(target_os = "linux")]
-            desktop_theme_enabled: false,
-            scroll_speed: scroll_speed::ScrollSpeed::default(),
-            animation_effects: motion::AnimationEffects::default(),
-            motion: motion::Motion::default(),
-            language: i18n::AUTO.to_string(),
-            ui_scale: None,
-            system_text_scale: 1.0,
-            ui_scale_applied: None,
-            flatten_fill_sign_on_save: false,
-            fill_text_size: fill_sign::TEXT_SIZE,
-            dialog: None,
-            update_source: None,
-            updates: updates::Updates::default(),
-            printer_source: None,
-            options_source: None,
-            print_tasks: print_ui::PrintTasks::default(),
-            palette_open: false,
-            palette_query: String::new(),
-            all_tools_expanded: false,
-            recent: Vec::new(),
-            reopen_last_session: false,
-            restore_last_view: true,
-            last_views: Vec::new(),
-            last_session: Default::default(),
-            quit_session: None,
-            reload_changed_files: true,
-            show_secured_notice: true,
-            always_default_view: false,
-            #[cfg(not(target_arch = "wasm32"))]
-            watch: Default::default(),
-            #[cfg(not(target_arch = "wasm32"))]
-            open_worker: None,
-            #[cfg(not(target_arch = "wasm32"))]
-            pending_opens: Vec::new(),
-            #[cfg(not(target_arch = "wasm32"))]
-            next_open_token: 0,
-            #[cfg(all(test, not(target_arch = "wasm32")))]
-            open_prepare_gate: None,
-            pinned: Default::default(),
-            toast: None,
-            integrated_titlebar: false,
-            window_controls: None,
-            system_title_bar: false,
-            app_frame_shown: None,
-            password_prompt: None,
-            document_copy: None,
-            unlock_prompt: None,
-            full_screen: false,
-            inbox: Default::default(),
-            startup_inbox: Default::default(),
-            startup_superseded: false,
-            failed_inbox: Default::default(),
-            unsaved_flag: Default::default(),
-            os_events: None,
-            host_save: None,
-            host_dirty: None,
-            close_request: None,
-            save_prompt_button: Default::default(),
-            save_prompt_seen: false,
-            save_prompt_attention: false,
-            #[cfg(not(target_arch = "wasm32"))]
-            pending_overwrite: None,
-            save_override: None,
-            props_draft: None,
-            view_draft: None,
-            requests: Default::default(),
-            #[cfg(not(target_arch = "wasm32"))]
-            pickers: Default::default(),
-            #[cfg(not(target_arch = "wasm32"))]
-            pick_override: None,
-            export_dir_override: None,
-            split_draft: SplitDraft::default(),
-            extract_draft: ExtractDraft::default(),
-            rotate_draft: RotateDraft::default(),
-            summary_sort: Default::default(),
-            sign_draft: None,
-            digital_ids: Vec::new(),
-            sig_expanded: Vec::new(),
-            a11y_options: a11y_ui::A11yOptions::default(),
-            ocr_draft: ocr_ui::OcrDraft::default(),
-            ocr_run: None,
-            ocr_batch: None,
-            run_inline: false,
-            custom_actions: Vec::new(),
-            wizard: Default::default(),
-            action_run: None,
-            action_files_override: None,
-            pdfa: Default::default(),
-            compare_old: None,
-            compare: None,
-            js_console: Default::default(),
-            doc_js: Default::default(),
-            a11y: a11y_ui::A11yState::default(),
-            tags_state: Default::default(),
-            a11y_skipped: Default::default(),
-            alt_draft: Default::default(),
-            os_key_store_ids: false,
-            cert_viewer: None,
-            space_audit: Vec::new(),
-            combine_draft: Vec::new(),
-            combine_conflicts: Default::default(),
-            combine_tab: Default::default(),
-            combine_columns: Default::default(),
-            combine_view: Default::default(),
-            combine_zoom: 1.0,
-            organize_zoom: 1.0,
-            combine_thumbs: Default::default(),
-            image_import: None,
-            custom_stamps: Vec::new(),
-            stamp_draft: Default::default(),
-            optimize_draft: OptimizeDraft::default(),
-            optimize_run: None,
-            progress_notice: None,
-            page_clipboard: None,
-            grid_drop: None,
-            last_snapshot: None,
-            last_copied_image: None,
-            last_copied_file: None,
-            system_clipboard: true,
-            clipboard_override: None,
-            v_pressed: false,
-            attach_override: None,
-            duplicate_draft: None,
-            field_table_draft: None,
-            form_preview: false,
-            window_title: String::new(),
-            recovery: None,
-            recoverable: Vec::new(),
-            recovery_keys: Default::default(),
-            last_autosave: 0.0,
-            allow_quit: false,
-            deferred_commands: Vec::new(),
-            dialog_seen: None,
-            dialog_epoch: 0,
-            ctx: None,
-            #[cfg(not(target_arch = "wasm32"))]
-            window_state: Default::default(),
-            styled: false,
-            fonts_ready: false,
-            fonts_cjk: theme::CjkPreference::Default,
-            control: None,
-            bookmark_rename: None,
-            last_opened_url: None,
-            pending_link: None,
-            pending_full_screen: None,
-            pending_remote_link: None,
-            protect_draft: Default::default(),
-            boxes_draft: Default::default(),
-            marks_draft: Default::default(),
-            export_draft: Default::default(),
-            export_status: None,
-            signature: None,
-            initials: None,
-            signature_draft: Default::default(),
-            signature_preview: None,
-            signature_photo: None,
-            saved_signature_previews: [None, None],
-            sign_graphic: sign_ui::SignGraphic::Name,
-            sign_graphic_preview: None,
-            #[cfg(target_arch = "wasm32")]
-            signature_images: Default::default(),
-            comment_props: None,
-            field_props: None,
-            bulk_field_props: None,
-            redact_prefs: RedactPrefs::default(),
-            redact_defaults: RedactPrefs::default(),
-            redact_before: None,
-            redact_pages_draft: RedactPagesDraft::default(),
-            redact_search: RedactSearchDraft::default(),
-            hidden_draft: HiddenDraft::default(),
-            print_draft: PrintDraft::default(),
-            link_draft: None,
-            text_style: content_ui::default_style(),
-            replace_draft: None,
-            number_draft: NumberDraft { from: 1, to: 1, style: pdfcraft_engine::LabelStyle::Decimal, prefix: String::new(), start: 1 },
-            word_count_draft: word_count_ui::Draft::default(),
-        }
-    }
-
-    /// Fields are being edited (Prepare a form or its Calculation order is open, or a field tool
-    /// is picked), unless the form is being previewed.
-    pub fn is_preparing(&self) -> bool {
-        ((self.left_open && matches!(self.left, LeftPanel::Tool("form") | LeftPanel::CalculationOrder))
-            || matches!(self.quick_tool, QuickTool::Field(_)))
-            && !self.form_preview
-    }
-
-    /// Open a document the way it asks to be opened: navigation panel, layout, magnification,
-    /// page (Document Properties ▸ Initial View). With Always use my default zoom and page
-    /// layout on, the layout and magnification stay at the defaults the view opened with.
-    fn apply_initial_view(&mut self, index: usize, v: &pdfcraft_engine::InitialView) {
-        use pdfcraft_engine::{InitialLayout as L, Magnification as M, Navigation as N};
-        let pages = self.session.get(self.views[index].id).map_or(0, |d| d.info.pages.len());
-        // A right panel the user closed stays closed, whatever the document asks for (#2884).
-        if self.active == Some(index) && !self.right_panel_closed {
-            match v.navigation {
-                N::PageOnly => {}
-                N::Bookmarks => self.right = Some(RightPanel::Bookmarks),
-                N::Pages => self.right = Some(RightPanel::Pages),
-                N::Attachments => self.right = Some(RightPanel::Attachments),
-                N::Layers => self.right = Some(RightPanel::Layers),
-            }
-        }
-        let view = &mut self.views[index];
-        if !self.always_default_view {
-            match v.layout {
-                // The view opened in Default page display already.
-                L::Default => {}
-                L::SinglePage => (view.layout, view.continuous) = (canvas::PageLayout::Single, false),
-                L::SinglePageContinuous => (view.layout, view.continuous) = (canvas::PageLayout::Single, true),
-                L::TwoUp => (view.layout, view.continuous) = (canvas::PageLayout::TwoUp, false),
-                L::TwoUpContinuous => (view.layout, view.continuous) = (canvas::PageLayout::TwoUp, true),
-                L::TwoUpCoverPage => {
-                    (view.layout, view.continuous, view.cover) = (canvas::PageLayout::TwoUp, false, true);
-                }
-                L::TwoUpContinuousCoverPage => {
-                    (view.layout, view.continuous, view.cover) = (canvas::PageLayout::TwoUp, true, true);
-                }
-            }
-            match v.magnification {
-                // The view opened at the default zoom already.
-                M::Default => {}
-                M::ActualSize => view.set_zoom(1.0),
-                M::Percent(p) => view.set_zoom((p / 100.0) as f32),
-                M::FitPage | M::FitVisible => view.fit = canvas::Fit::Page,
-                M::FitWidth => view.fit = canvas::Fit::Width,
-                M::FitHeight => view.fit = canvas::Fit::Height,
-            }
-        }
-        if v.page > 0 && v.page < pages {
-            view.go_to_page(v.page);
-        }
-    }
-
-    /// Open a document and make it the active tab. Encrypted files raise the password prompt.
-    pub fn open_bytes(&mut self, name: &str, path: Option<String>, bytes: Vec<u8>) -> Result<(), String> {
-        self.startup_superseded = true;
-        self.open_bytes_with_focus(name, path, bytes, true)
-    }
-
-    fn open_bytes_with_focus(&mut self, name: &str, path: Option<String>, bytes: Vec<u8>, activate: bool) -> Result<(), String> {
-        // Images and text files become new, unsaved PDFs (Create a PDF).
-        let active = self.active;
-        if let Some(r) = self.open_converted(name, &bytes) {
-            if !activate {
-                self.active = active;
-            }
-            return r;
-        }
-        self.try_open(name, path, std::sync::Arc::new(bytes), None, activate)
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn schedule_open(&mut self, request: OpenRequest) -> Result<u64, String> {
-        if self.open_worker.is_none() {
-            self.open_worker = Some(
-                open_worker::OpenWorker::new(
-                    #[cfg(test)]
-                    self.open_prepare_gate.clone(),
-                )
-                .map_err(|e| format!("couldn't start the document-open worker: {e}"))?,
-            );
-        }
-        let token = self.next_open_token.wrapping_add(1);
-        let worker = self.open_worker.as_ref().ok_or("the document-open worker is unavailable")?;
-        if let Some(ctx) = &self.ctx {
-            worker.set_context(ctx);
-        }
-        let receiver =
-            worker.submit(token, self.session.open_context(), request.name.clone(), request.path.clone(), request.password, request.input)?;
-        self.next_open_token = token;
-        self.pending_opens.push(PendingOpen {
-            token,
-            receiver,
-            name: request.name,
-            path: request.path,
-            stamp: request.stamp,
-            activate: request.activate,
-            after_open: request.after_open,
-            recovered: request.recovered,
-            then: request.then,
-        });
-        Ok(token)
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn poll_pending_opens(&mut self) {
-        let pending_opens = std::mem::take(&mut self.pending_opens);
-        let mut remaining = pending_opens.into_iter();
-        let mut waiting = Vec::new();
-        while let Some(pending) = remaining.next() {
-            // A tool, password prompt or file picker belongs to the document just admitted.
-            // Keep later replies queued so another open cannot change its recipient.
-            if self.modal_open() || self.pickers.pending() {
-                waiting.push(pending);
-                waiting.extend(remaining);
-                break;
-            }
-            match pending.receiver.try_recv() {
-                Ok(result) if result.token == pending.token => self.finish_pending_open(pending, result.kind),
-                Ok(_) => waiting.push(pending),
-                Err(std::sync::mpsc::TryRecvError::Empty) => waiting.push(pending),
-                Err(std::sync::mpsc::TryRecvError::Disconnected) => {
-                    self.notify_fmt("Couldn't open {name}: the background worker stopped", &[("name", &pending.name)]);
-                }
-            }
-        }
-        // A completion may schedule another open; preserve those requests as well as the
-        // earlier waiting replies, without consuming a blocked receiver's result.
-        waiting.append(&mut self.pending_opens);
-        self.pending_opens = waiting;
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn finish_pending_open(&mut self, pending: PendingOpen, kind: open_worker::ResultKind) {
-        match kind {
-            open_worker::ResultKind::ReadFailed(reason) => {
-                self.notify_fmt("Couldn't read {name}: {e}", &[("name", &pending.name), ("e", &reason)]);
-            }
-            open_worker::ResultKind::RemoteFailed(reason) => {
-                self.notify_fmt("Couldn't follow linked PDF: {reason}", &[("reason", &reason)]);
-            }
-            open_worker::ResultKind::RecoveryFailed(reason) => {
-                self.notify_fmt("Couldn't recover {name}: {e}", &[("name", &pending.name), ("e", &reason)]);
-            }
-            open_worker::ResultKind::Failed(reason) => {
-                self.notify_fmt("Couldn't open {name}: {reason}", &[("name", &pending.name), ("reason", &reason)]);
-            }
-            open_worker::ResultKind::Conversion(bytes) => match self.open_converted(&pending.name, &bytes) {
-                Some(Ok(())) => {
-                    if let Some(command) = pending.then {
-                        self.execute(command);
-                    }
-                }
-                Some(Err(error)) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error)]),
-                None => {}
-            },
-            open_worker::ResultKind::Prepared { bytes, result } => match *result {
-                Ok(prepared) => match self.finish_open(&pending.name, pending.path.clone(), bytes.len(), prepared, pending.activate) {
-                    Ok(id) => {
-                        if pending.path.is_some() {
-                            self.watch.known_as(id, pending.stamp);
-                        }
-                        if let Some(destination) = pending.after_open {
-                            self.apply_remote_destination(destination);
-                        }
-                        if let Some(meta) = &pending.recovered {
-                            self.finish_recovery(meta);
-                        }
-                        if let Some(command) = pending.then {
-                            self.execute(command);
-                        }
-                    }
-                    Err(error) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error)]),
-                },
-                Err(error @ (pdfcraft_render::OpenError::NeedsPassword | pdfcraft_render::OpenError::WrongPassword)) => {
-                    let password_error =
-                        matches!(error, pdfcraft_render::OpenError::WrongPassword).then(|| "Incorrect password. Try again.".to_string());
-                    self.password_prompt = Some(PasswordPrompt {
-                        name: pending.name,
-                        path: pending.path,
-                        bytes,
-                        stamp: pending.stamp,
-                        input: String::new(),
-                        error: password_error,
-                        activate: pending.activate,
-                        recovered: pending.recovered,
-                        then: pending.then,
-                        after_open: pending.after_open,
-                    });
-                }
-                Err(error) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error.to_string())]),
-            },
-        }
-    }
-
-    fn try_open(
-        &mut self,
-        name: &str,
-        path: Option<String>,
-        bytes: std::sync::Arc<Vec<u8>>,
-        password: Option<&str>,
-        activate: bool,
-    ) -> Result<(), String> {
-        use pdfcraft_render::OpenError;
-        let prepared = match self.session.prepare_open(name, path.clone(), bytes.clone(), password) {
-            Ok(prepared) => prepared,
-            Err(e @ (OpenError::NeedsPassword | OpenError::WrongPassword)) => {
-                let error = matches!(e, OpenError::WrongPassword).then(|| "Incorrect password. Try again.".to_string());
-                #[cfg(not(target_arch = "wasm32"))]
-                let stamp = path.as_deref().and_then(file_watch::Stamp::at);
-                self.password_prompt = Some(PasswordPrompt {
-                    name: name.to_string(),
-                    path,
-                    bytes,
-                    #[cfg(not(target_arch = "wasm32"))]
-                    stamp,
-                    input: String::new(),
-                    error,
-                    activate,
-                    recovered: None,
-                    then: None,
-                    after_open: None,
-                });
-                return Ok(());
-            }
-            Err(e) => return Err(e.to_string()),
-        };
-        self.finish_open(name, path, bytes.len(), prepared, activate).map(|_| ())
-    }
-
-    fn finish_open(
-        &mut self,
-        name: &str,
-        path: Option<String>,
-        size: usize,
-        prepared: pdfcraft_engine::PreparedDocument,
-        activate: bool,
-    ) -> Result<DocId, String> {
-        let id = self.session.commit_open(prepared);
-        self.password_prompt = None;
-        // The reading-colours preference is app-wide: a newly opened document starts with it.
-        // Idempotent: the engine returns `false` when the document has the setting already.
-        self.session.set_reading_colors(id, self.reading_colors);
-        let doc = self.session.get(id).ok_or("the document could not be opened")?;
-        let pages = doc.info.pages.len();
-        // Acrobat opens straight to the Comments panel when a document has comments.
-        // Read mode opens with the panes closed; the rail still opens them (#932). A right panel
-        // the user closed stays closed (#1590).
-        let opening_mode = self.mode_override.unwrap_or(self.default_mode);
-        if activate && self.right.is_none() && !self.right_panel_closed && opening_mode != Mode::Read {
-            self.right = if !doc.info.annotations.is_empty() {
-                Some(RightPanel::Comments)
-            } else if !doc.info.outline.is_empty() {
-                Some(RightPanel::Bookmarks)
-            } else {
-                None
-            };
-        }
-        let initial = doc.initial_view();
-        let view = DocView::new(id, &doc.info, self.view_defaults);
-        self.views.push(view);
-        if activate {
-            self.active = Some(self.views.len() - 1);
-        }
-        self.apply_initial_view(self.views.len() - 1, &initial);
-        // Where the reader left off wins over the file's own initial view (#1767).
-        self.apply_last_view(self.views.len() - 1);
-        // After both, so full screen shows one fitted page and leaving it comes back to them.
-        if self.full_screen
-            && let Some(view) = self.views.last_mut()
-        {
-            view.enter_presentation();
-        }
-        // Full screen is asked for, never taken: a document can't put the app in full screen on
-        // its own (the prompt is `dialogs::full_screen_prompt`).
-        if activate && initial.full_screen {
-            self.pending_full_screen = Some(id);
-        }
-        if activate
-            && self.left_open
-            && self.left == LeftPanel::Tool("organize")
-            && let Some(view) = self.views.last_mut()
-        {
-            view.open_organize();
-        }
-        if activate && let Some(mode) = self.mode_override {
-            // Explicit mode options do not reset independent --tool / --left choices.
-            self.mode = mode;
-        } else if activate && self.mode != self.default_mode {
-            // Switch workspace like the mode bar, but a left panel the user (or `--left closed`)
-            // closed stays closed, and an unchanged mode keeps the tool panel the user chose.
-            let left_open = self.left_open;
-            self.select_mode(self.default_mode);
-            self.left_open = left_open;
-        }
-        if let Some(p) = path {
-            #[cfg(target_os = "macos")]
-            macos_association::repair(std::path::Path::new(&p));
-            self.recent.retain(|r| r.path != p);
-            self.recent.insert(0, RecentFile { name: name.to_string(), path: p, pages, size });
-            self.recent.truncate(12);
-        }
-        // What the form's scripts said while it opened (messages, errors) shows now, not with
-        // the next edit.
-        // Background documents keep their script output until their tab is selected: a print
-        // or save request must never act on the current document instead.
-        if activate {
-            let out = self.session.take_js_output(id);
-            self.handle_js(id, out);
-        }
-        Ok(id)
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn open_dropped(&mut self, f: egui::DroppedFileHandle, _ctx: &egui::Context) {
-        let p = f.path().to_string_lossy().into_owned();
-        if !p.is_empty() && f.path().is_absolute() {
-            self.open_path(&p);
-            return;
-        }
-        let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
-        match f.bytes() {
-            Ok(bytes) => {
-                if self.ctx.is_some() && !self.run_inline {
-                    let result = self.schedule_open(OpenRequest {
-                        name: name.clone(),
-                        path: None,
-                        stamp: None,
-                        input: open_worker::Input::Bytes(std::sync::Arc::new(bytes)),
-                        password: None,
-                        activate: true,
-                        after_open: None,
-                        recovered: None,
-                        then: None,
-                    });
-                    if let Err(error) = result {
-                        self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
-                    }
-                } else if let Err(error) = self.open_bytes(&name, None, bytes) {
-                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
-                }
-            }
-            Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e.to_string())]),
-        }
-    }
-
-    /// The document whose page grid is showing and may take pages, if any.
-    fn grid_target(&self) -> Option<pdfcraft_engine::DocId> {
-        let view = self.active.and_then(|i| self.views.get(i)).filter(|v| v.organize)?;
-        (self.dialog.is_none() && self.session.get(view.id)?.allows_assembly()).then_some(view.id)
-    }
-
-    /// The document whose Pages panel is under the pointer and may take pages, if any.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn panel_target(&self, ctx: &egui::Context) -> Option<pdfcraft_engine::DocId> {
-        let view = self.active.and_then(|i| self.views.get(i))?;
-        let pointer = ctx.input(|i| i.pointer.hover_pos())?;
-        let over = view.pages_panel.is_some_and(|panel| panel.contains(pointer));
-        (over && self.dialog.is_none() && self.session.get(view.id)?.allows_assembly()).then_some(view.id)
-    }
-
-    /// Files dropped on the Pages panel, or while the page grid shows, are inserted into the
-    /// document rather than opened: they are kept until [`Self::finish_grid_drop`] knows the
-    /// gap. Returns the files not taken.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn drop_on_grid(&mut self, dropped: Vec<egui::DroppedFileHandle>, ctx: &egui::Context) -> Vec<egui::DroppedFileHandle> {
-        if dropped.is_empty() {
-            return dropped;
-        }
-        // The panel first: the grid takes files dropped anywhere in the window.
-        let (id, panel) = match (self.panel_target(ctx), self.grid_target()) {
-            (Some(id), _) => (id, true),
-            (None, Some(id)) => (id, false),
-            (None, None) => return dropped,
-        };
-        let mut files = Vec::new();
-        for f in &dropped {
-            let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
-            if f.path().is_absolute() {
-                files.push((name, Err(f.path().to_path_buf())));
-                continue;
-            }
-            match f.bytes() {
-                Ok(b) => files.push((name, Ok(b))),
-                Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e)]),
-            }
-        }
-        if !files.is_empty() {
-            // Where there is no telling where the pointer is during the drag, its place arrives
-            // with the first move after the drop.
-            ctx.request_repaint();
-            self.grid_drop = Some(GridDrop { doc: id, panel, files, deadline: ctx.input(|i| i.time) + 1.0 });
-        }
-        Vec::new()
-    }
-
-    /// Insert files dropped on the page grid or the Pages panel at the gap under the pointer,
-    /// or at the end when the pointer hasn't shown up in time.
-    fn finish_grid_drop(&mut self, ctx: &egui::Context) {
-        let Some(GridDrop { doc: id, panel, deadline, .. }) = &self.grid_drop else { return };
-        let (id, panel, deadline) = (*id, *panel, *deadline);
-        let still = if panel {
-            self.dialog.is_none()
-                && self.active_ids().map(|(_, active)| active) == Some(id)
-                && self.session.get(id).is_some_and(|d| d.allows_assembly())
-        } else {
-            self.grid_target() == Some(id)
-        };
-        if !still {
-            self.grid_drop = None;
-            return self.notify_tr("The document changed while you were choosing a file, so nothing was changed.");
-        }
-        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return };
-        let gap = match if panel { view.panel_gap } else { view.grid_gap } {
-            Some(gap) => gap,
-            None if ctx.input(|i| i.time) >= deadline => usize::MAX,
-            None => return ctx.request_repaint(),
-        };
-        view.insert_at = Some(gap);
-        if let Some(drop) = self.grid_drop.take() {
-            self.insert_each(drop.files.into_iter().map(read_grid_file));
-        }
-    }
-
-    /// Browsers read dropped files asynchronously; the bytes land in `inbox` and open next frame.
-    #[cfg(target_arch = "wasm32")]
-    fn open_dropped(&mut self, f: egui::DroppedFileHandle, ctx: &egui::Context) {
-        self.startup_superseded = true;
-        let inbox = self.inbox.clone();
-        let ctx = ctx.clone();
-        wasm_bindgen_futures::spawn_local(async move {
-            let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
-            if let Ok(bytes) = f.bytes_async().await
-                && let Ok(mut q) = inbox.lock()
-            {
-                q.push((name, bytes));
-                ctx.request_repaint();
-            }
-        });
-    }
-
-    /// A number that changes whenever the open dialog changes (opened, closed or replaced by
-    /// another), checked every frame. A picker started from a dialog's Browse… button answers
-    /// only into the same showing of that dialog.
-    pub(crate) fn dialog_epoch(&mut self) -> u64 {
-        if self.dialog != self.dialog_seen {
-            self.dialog_seen = self.dialog;
-            self.dialog_epoch = self.dialog_epoch.wrapping_add(1);
-        }
-        self.dialog_epoch
-    }
-
-    /// Edit ▸ Attach a file…: choose a file, then attach it to the active document and show
-    /// the Attachments panel with it.
-    pub fn attach_file_dialog(&mut self) {
-        if self.active_ids().is_none() {
-            return;
-        }
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            let dialog = rfd::AsyncFileDialog::new().set_title(tl!("Attach a file").to_string());
-            let target = self.active_ids().map(|(_, id)| id);
-            self.ask_one(pickers::Ask::File(dialog), target, |app, path| app.attach_file(&path));
-        }
-        #[cfg(target_arch = "wasm32")]
-        self.notify_tr("Attaching files is not available on the web yet");
-    }
-
-    /// Attach the file at `path` to the active document (document level: the Attachments
-    /// panel, not a paper-clip comment on a page).
-    pub fn attach_file(&mut self, path: &std::path::Path) {
-        let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-        let bytes = match std::fs::read(path) {
-            Ok(b) => b,
-            Err(e) => {
-                self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
-                return;
-            }
-        };
-        let mime = pdfcraft_engine::mime_for_name(&name).map(str::to_string);
-        if self.apply_edit(pdfcraft_engine::Edit::AddAttachment { name, bytes, description: None, mime }) {
-            self.choose_right_panel(Some(RightPanel::Attachments));
-        }
-    }
-
-    /// Save an attachment to disk, or open a PDF attachment in a new tab.
-    pub fn attachment_action(&mut self, doc: DocId, index: usize, open: bool) {
-        let Some(d) = self.session.get(doc) else { return };
-        let Some(att) = d.info.attachments.get(index).cloned() else { return };
-        let data = pdfcraft_render::attachment_data(&d.bytes, d.password.as_deref(), &att);
-        match (data, open) {
-            (Err(e), _) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &att.name), ("e", &e.to_string())]),
-            (Ok(bytes), true) => {
-                // The tab name later names files written from the tab (Split, Extract pages).
-                if let Err(e) = self.open_bytes(&crate::files::attachment_file_name(&att.name), None, bytes) {
-                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &att.name), ("e", &e.to_string())]);
-                }
-            }
-            (Ok(bytes), false) => {
-                #[cfg(not(target_arch = "wasm32"))]
-                self.ask_one(
-                    pickers::Ask::Save(rfd::AsyncFileDialog::new().set_file_name(crate::files::attachment_file_name(&att.name))),
-                    None,
-                    move |app, path| match crate::editing::write_atomically(&path.to_string_lossy(), &bytes) {
-                        Ok(()) => app.notify_fmt("Saved {name}", &[("name", &path.display().to_string())]),
-                        Err(e) => app.notify_fmt("Couldn't save: {e}", &[("e", &e.to_string())]),
-                    },
-                );
-                #[cfg(target_arch = "wasm32")]
-                self.notify_fmt("Downloading attachments on the web arrives with M3.10 ({n} bytes ready)", &[("n", &bytes.len().to_string())]);
-            }
-        }
-    }
-
-    /// [`Self::attachment_action`] for the file of the attachment comment at (page, index).
-    pub fn comment_attachment_action(&mut self, doc: DocId, page: usize, index: usize, open: bool) {
-        let source = pdfcraft_render::AttachmentSource::Annotation { page, index };
-        // The menus offer the items only for a listed file, so a miss is a comment gone since.
-        if let Some(i) = self.session.get(doc).and_then(|d| d.info.attachments.iter().position(|a| a.source == source)) {
-            self.attachment_action(doc, i, open);
-        }
-    }
-
-    /// Whether the app draws the window's title bar, buttons and resize edges: the desktop leaves
-    /// the frame to the app and Use system title bar is off.
-    pub fn draws_window_frame(&self) -> bool {
-        self.window_controls.is_some() && !self.system_title_bar
-    }
-
-    /// Follow Use system title bar at once: the window starts without winit's frame wherever the
-    /// app may draw its own, and gets it back (or loses it again) when the preference changes.
-    fn sync_window_frame(&mut self, ctx: &egui::Context) {
-        if self.window_controls.is_none() {
-            return;
-        }
-        let app_frame = self.draws_window_frame();
-        if self.app_frame_shown != Some(app_frame) {
-            // The window opens undecorated, so only a change from that needs a command.
-            if self.app_frame_shown.is_some() || !app_frame {
-                ctx.send_viewport_cmd(egui::ViewportCommand::Decorations(!app_frame));
-            }
-            self.app_frame_shown = Some(app_frame);
-        }
-    }
-
-    /// Enter or leave full-screen reading (Acrobat: View ▸ Full Screen Mode, ⌘L).
-    pub fn set_full_screen(&mut self, ctx: &egui::Context, on: bool) {
-        self.apply_full_screen(on);
-        ctx.send_viewport_cmd(egui::ViewportCommand::Fullscreen(on));
-    }
-
-    /// The full-screen state without the window: every document shows one page (or spread) at a
-    /// time fitted to the screen while it is on (Acrobat's Full Screen Mode, #379, #1459), and
-    /// gets its display back when it is off.
-    pub fn apply_full_screen(&mut self, on: bool) {
-        // A click turns the page only with the Select tool, and full screen hides the tools:
-        // select it there, and give the tool back on leaving (review on #2070).
-        if on && !self.full_screen {
-            self.full_screen_tool = Some(self.quick_tool);
-            self.quick_tool = QuickTool::Select;
-        } else if !on && let Some(tool) = self.full_screen_tool.take() {
-            self.quick_tool = tool;
-        }
-        self.full_screen = on;
-        for view in &mut self.views {
-            if on {
-                view.enter_presentation();
-            } else {
-                view.leave_presentation();
-            }
-        }
-    }
-
-    /// Answer the Full Screen mode prompt a document raised on opening: enter it, or leave the
-    /// window as it is.
-    pub fn resolve_full_screen_prompt(&mut self, ctx: &egui::Context, allow: bool) {
-        let Some(id) = self.pending_full_screen.take() else { return };
-        if allow && self.session.get(id).is_some() {
-            self.set_full_screen(ctx, true);
-        }
-    }
-
-    /// Answer the password prompt (`None` cancels).
-    pub fn submit_password(&mut self, password: Option<String>) {
-        let Some(p) = self.password_prompt.take() else { return };
-        let Some(pw) = password else {
-            // A cancelled recovery goes back on offer; its snapshot stays in the store and must
-            // not attach itself to whatever document is unlocked next (#813).
-            if let Some(meta) = p.recovered {
-                self.recoverable.push(meta);
-            }
-            return;
-        };
-        #[cfg(not(target_arch = "wasm32"))]
-        if self.ctx.is_some() && !self.run_inline {
-            let result = self.schedule_open(OpenRequest {
-                name: p.name.clone(),
-                path: p.path.clone(),
-                stamp: p.stamp,
-                input: open_worker::Input::Bytes(p.bytes.clone()),
-                password: Some(pw),
-                activate: p.activate,
-                after_open: p.after_open.clone(),
-                recovered: p.recovered.clone(),
-                then: p.then,
-            });
-            if let Err(error) = result {
-                let mut prompt = p;
-                prompt.error = Some(error);
-                self.password_prompt = Some(prompt);
-            }
-            return;
-        }
-        #[cfg(not(target_arch = "wasm32"))]
-        let (path_for_watch, stamp_for_watch) = (p.path.clone(), p.stamp);
-        let after_open = p.after_open.clone();
-        match self.try_open(&p.name, p.path, p.bytes, Some(&pw), p.activate) {
-            Err(e) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &p.name), ("e", &e.to_string())]),
-            // A recovered encrypted document is open once its prompt is gone.
-            Ok(()) if self.password_prompt.is_none() => {
-                #[cfg(not(target_arch = "wasm32"))]
-                if let Some(path) = path_for_watch.as_deref()
-                    && let Some(id) = self
-                        .views
-                        .iter()
-                        .rev()
-                        .find_map(|view| self.session.get(view.id).and_then(|doc| (doc.path.as_deref() == Some(path)).then_some(view.id)))
-                {
-                    self.watch.known_as(id, stamp_for_watch);
-                }
-                if let Some(destination) = after_open {
-                    self.apply_remote_destination(destination);
-                }
-                if let Some(meta) = &p.recovered {
-                    self.finish_recovery(meta);
-                }
-                if let Some(command) = p.then {
-                    self.execute(command);
-                }
-            }
-            // Wrong password: the new prompt is for the same bytes, so it keeps the snapshot
-            // and the tool waiting for it.
-            Ok(()) => {
-                if let Some(prompt) = self.password_prompt.as_mut() {
-                    prompt.recovered = p.recovered;
-                    prompt.then = p.then;
-                    prompt.after_open = after_open;
-                }
-            }
-        }
-    }
-
-    /// Ask for the active document's permissions password, then run `then` (if any).
-    pub(crate) fn request_unlock(&mut self, then: Option<&'static str>) {
-        let Some(doc) = self.active_ids().and_then(|(_, id)| self.session.get(id)) else { return };
-        self.unlock_prompt = Some(UnlockPrompt::new(doc, then));
-    }
-
-    /// Answer the permissions password prompt (`None` cancels).
-    pub fn submit_unlock(&mut self, password: Option<String>) {
-        let Some(mut p) = self.unlock_prompt.take() else { return };
-        let Some(pw) = password else { return };
-        match self.session.unlock(p.doc, &pw) {
-            // Carry on with what asked for the password, if its document is still the one shown.
-            Ok(()) => match p.then {
-                Some(command) if self.active_ids().is_some_and(|(_, id)| id == p.doc) => {
-                    self.execute(command);
-                }
-                _ => self.notify_tr("Restrictions lifted"),
-            },
-            Err(pdfcraft_engine::EditError::WrongPassword) => {
-                p.input.clear();
-                p.error = Some("Incorrect password. Try again.".to_string());
-                self.unlock_prompt = Some(p);
-            }
-            Err(e) => self.notify_fmt("Couldn't unlock {name}: {e}", &[("name", &p.name), ("e", &e.to_string())]),
-        }
-    }
-
-    /// The tab already showing the file at `path` (the same path, or one that names the same
-    /// file once made absolute).
-    pub(crate) fn tab_showing(&self, path: &str) -> Option<usize> {
-        self.views.iter().position(|v| self.session.get(v.id).and_then(|d| d.path.as_deref()).is_some_and(|p| same_file(p, path)))
-    }
-
-    /// Open a file from a recent list: focus the tab already showing it, else open it (File ▸
-    /// Open Recent and the Home view's list share this).
-    pub fn open_recent(&mut self, path: &str) {
-        if let Some(i) = self.tab_showing(path) {
-            self.active = Some(i);
-        } else {
-            #[cfg(not(target_arch = "wasm32"))]
-            self.open_path(path);
-        }
-        #[cfg(target_arch = "wasm32")]
-        let _ = path;
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    pub(crate) fn open_remote_link(&mut self, source: DocId, file: String, destination: pdfcraft_render::RemoteDestination) {
-        if self.pending_remote_link.is_some() || self.pending_link.is_some() {
-            return;
-        }
-        let Some(source_doc) = self.session.get(source) else { return };
-        let source_path = source_doc.path.clone();
-        let path = match pdfcraft_engine::resolve_remote_document_path(source_path.as_deref().map(std::path::Path::new), &file) {
-            Ok(path) => path,
-            Err(e) => {
-                self.notify_fmt("Couldn't follow linked PDF: {reason}", &[("reason", &e.to_string())]);
-                return;
-            }
-        };
-        if pdfcraft_engine::remote_document_path_is_absolute(&file) {
-            self.pending_remote_link = Some(PendingRemoteLink { source, path, destination });
-            return;
-        }
-        self.open_resolved_remote_link(path, destination);
-    }
-
-    /// Take a pending request exactly once. Closing its source invalidates the request.
-    #[cfg(not(target_arch = "wasm32"))]
-    pub fn resolve_pending_remote_link(&mut self, open: bool) {
-        if let Some(pending) = self.pending_remote_link.take()
-            && open
-            && self.session.get(pending.source).is_some()
-        {
-            self.open_resolved_remote_link(pending.path, pending.destination);
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn open_resolved_remote_link(&mut self, path: std::path::PathBuf, destination: pdfcraft_render::RemoteDestination) {
-        let path = path.to_string_lossy().into_owned();
-        let name = std::path::Path::new(&path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.clone());
-        let stamp = file_watch::Stamp::at(&path);
-        self.startup_superseded = true;
-        let result = self.schedule_open(OpenRequest {
-            name: name.clone(),
-            path: Some(path.clone()),
-            stamp,
-            input: open_worker::Input::RemotePath(std::path::PathBuf::from(path)),
-            password: None,
-            activate: true,
-            after_open: Some(destination),
-            recovered: None,
-            then: None,
-        });
-        if let Err(error) = result {
-            self.notify_fmt("Couldn't follow linked PDF: {reason}", &[("reason", &error)]);
-        }
-    }
-
-    #[cfg(target_arch = "wasm32")]
-    pub(crate) fn open_remote_link(&mut self, _source: DocId, _file: String, _destination: pdfcraft_render::RemoteDestination) {
-        self.notify_tr("Local cross-PDF links require the desktop app");
-    }
-
-    #[cfg(target_arch = "wasm32")]
-    pub fn resolve_pending_remote_link(&mut self, _open: bool) {
-        self.pending_remote_link = None;
-    }
-
-    fn apply_remote_destination(&mut self, destination: pdfcraft_render::RemoteDestination) {
-        let Some(index) = self.views.len().checked_sub(1) else { return };
-        let Some(doc) = self.session.get(self.views[index].id) else { return };
-        let warning = match destination {
-            pdfcraft_render::RemoteDestination::Default => None,
-            pdfcraft_render::RemoteDestination::Named(_) => Some("The linked PDF opened, but its named destination was not applied."),
-            pdfcraft_render::RemoteDestination::Page { page, view } if page < doc.info.pages.len() => {
-                self.views[index].go_to_dest(page, view, &doc.info);
-                None
-            }
-            pdfcraft_render::RemoteDestination::Page { .. } => Some("The linked PDF opened, but its page destination was out of range."),
-        };
-        if let Some(warning) = warning {
-            self.notify_tr(warning);
-        }
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    pub fn open_path(&mut self, path: &str) -> OpenOutcome {
-        self.open_path_then(path, None)
-    }
-
-    /// Keep a chosen tool with its file until preparation and any password entry finish. The
-    /// return value is the programmatic open contract (#1620): callers that must know whether
-    /// the file opened, focused its tab, was handed to the background worker, or failed.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn open_path_then(&mut self, path: &str, then: Option<&'static str>) -> OpenOutcome {
-        // One file, one tab (#2166): a file that is open already comes to the front instead,
-        // and the tool it was opened for runs on it. One still being opened is left to that.
-        if let Some(i) = self.tab_showing(path) {
-            self.startup_superseded = true;
-            self.active = Some(i);
-            if let Some(command) = then {
-                self.execute(command);
-            }
-            return OpenOutcome::Focused;
-        }
-        if self.pending_opens.iter().any(|p| p.path.as_deref().is_some_and(|p| same_file(p, path))) {
-            return OpenOutcome::Pending;
-        }
-        let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
-        // Taken before reading: a build that rewrites the file meanwhile still counts as a change.
-        let stamp = file_watch::Stamp::at(path);
-        // Before the first frame there is no interaction to keep responsive; this also preserves
-        // deterministic inline startup and test flows. Once live, reading and preparation use
-        // the bounded worker and commit on the UI thread.
-        if self.ctx.is_none() || self.run_inline {
-            match std::fs::read(path) {
-                Ok(bytes) => {
-                    let before = self.views.len();
-                    if let Err(error) = self.open_bytes(&name, Some(path.to_string()), bytes) {
-                        self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
-                        return OpenOutcome::Failed;
-                    }
-                    if let Some(prompt) = self.password_prompt.as_mut().filter(|p| p.path.as_deref() == Some(path)) {
-                        // Encrypted: the tool runs once the password is in.
-                        prompt.then = then;
-                    } else if self.views.len() > before {
-                        if let Some(doc) = self.views.last().map(|view| view.id) {
-                            self.watch.known_as(doc, stamp);
-                        }
-                        if let Some(command) = then {
-                            self.execute(command);
-                        }
-                    } else {
-                        // Open reported success but added no tab and raised no prompt; the
-                        // control channel answers this as a failure to open.
-                        return OpenOutcome::Failed;
-                    }
-                    OpenOutcome::Opened
-                }
-                Err(error) => {
-                    self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &error.to_string())]);
-                    OpenOutcome::Failed
-                }
-            }
-        } else {
-            self.startup_superseded = true;
-            match self.schedule_open(OpenRequest {
-                name: name.clone(),
-                path: Some(path.to_string()),
-                stamp,
-                input: open_worker::Input::Path(std::path::PathBuf::from(path)),
-                password: None,
-                activate: true,
-                after_open: None,
-                recovered: None,
-                then,
-            }) {
-                Ok(_) => OpenOutcome::Pending,
-                Err(error) => {
-                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
-                    OpenOutcome::Failed
-                }
-            }
-        }
-    }
-
-    /// The File ▸ Open picker: PDFs, and images and text that become PDFs.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn open_picker() -> rfd::AsyncFileDialog {
-        rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).add_filter(tl!("Images and text (converted to PDF)"), &create_ui::CONVERTIBLE)
-    }
-
-    pub fn open_dialog(&mut self) {
-        self.startup_superseded = true;
-        #[cfg(not(target_arch = "wasm32"))]
-        self.pick(
-            pickers::PickFor::Open,
-            rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).add_filter(tl!("Images and text (converted to PDF)"), &create_ui::CONVERTIBLE),
-            true,
-        );
-        // Browsers pick files asynchronously; the bytes arrive through `inbox`.
-        #[cfg(target_arch = "wasm32")]
-        {
-            let inbox = self.inbox.clone();
-            let ctx = self.ctx.clone();
-            wasm_bindgen_futures::spawn_local(async move {
-                if let Some(h) = rfd::AsyncFileDialog::new()
-                    .add_filter("PDF", &["pdf"])
-                    .add_filter(tl!("Images and text"), &create_ui::CONVERTIBLE)
-                    .pick_file()
-                    .await
-                {
-                    let bytes = h.read().await;
-                    if let Ok(mut q) = inbox.lock() {
-                        q.push((h.file_name(), bytes));
-                    }
-                    // The read may finish while the app is idle: wake it to open the file.
-                    if let Some(ctx) = ctx {
-                        ctx.request_repaint();
-                    }
-                }
-            });
-        }
-    }
-
-    pub fn close_tab(&mut self, index: usize) {
-        if index >= self.views.len() {
-            return;
-        }
-        self.remember_view(index);
-        let id = self.views.remove(index).id;
-        #[cfg(not(target_arch = "wasm32"))]
-        if let Some(path) = self.session.get(id).and_then(|d| d.path.clone()) {
-            if self.closed_tabs.len() == 10 {
-                self.closed_tabs.remove(0);
-            }
-            self.closed_tabs.push(path);
-        }
-        self.forget_recovery(id);
-        self.session.close(id);
-        self.active = match self.active {
-            _ if self.views.is_empty() => None,
-            Some(a) if a > index => Some(a - 1),
-            Some(a) if a >= self.views.len() => Some(self.views.len() - 1),
-            other => other,
-        };
-    }
-
-    /// Moves the tab at `from` so it sits at `to` (#1537). The same document stays active
-    /// wherever it lands; an index out of range changes nothing.
-    pub fn move_tab(&mut self, from: usize, to: usize) {
-        if from >= self.views.len() || to >= self.views.len() || from == to {
-            return;
-        }
-        let active = self.active_ids().map(|(_, id)| id);
-        let view = self.views.remove(from);
-        self.views.insert(to, view);
-        if let Some(id) = active {
-            self.active = self.views.iter().position(|v| v.id == id);
-        }
-    }
-
-    pub fn active_ids(&self) -> Option<(usize, DocId)> {
-        self.active.and_then(|i| self.views.get(i).map(|v| (i, v.id)))
-    }
-
-    /// A dialog or prompt is open over the window: the keyboard is its own, and nothing may act
-    /// on the document underneath it.
-    pub(crate) fn modal_open(&self) -> bool {
-        self.dialog.is_some()
-            || self.close_request.is_some()
-            || self.password_prompt.is_some()
-            || self.unlock_prompt.is_some()
-            || self.pending_link.is_some()
-            || self.pending_remote_link.is_some()
-            || self.updates.open
-    }
-
-    /// Enable the UI control channel on `ctx` (opt-in; see [`control`]). Returns a client that
-    /// sends requests to this app; [`control::serve`] exposes it on loopback.
-    pub fn attach_control(&mut self, ctx: &egui::Context) -> control::ControlClient {
-        let (control, client) = control::attach(ctx);
-        self.control = Some(control);
-        client
-    }
-
-    /// Open a web link in the system browser (a new tab on the web). Only for PdfCraft's own
-    /// links; an address that came from a document goes through [`Self::request_document_url`].
-    pub fn open_url(&mut self, url: &str) {
-        if let Some(ctx) = &self.ctx {
-            ctx.open_url(egui::OpenUrl::new_tab(url));
-        }
-        self.last_opened_url = Some(url.to_string());
-    }
-
-    /// A document asks to open `url` (a link, a button's URI action or `app.launchURL`). Web and
-    /// email addresses wait for the user to allow them; anything else is refused with a notice
-    /// (#90, #91). While one request is waiting, further ones are dropped, so a script can't
-    /// queue up a stream of dialogs.
-    pub fn request_document_url(&mut self, url: &str, origin: LinkOrigin) {
-        match pdfcraft_engine::links::document_url(url) {
-            Ok(url) => {
-                if self.pending_link.is_none() && self.pending_remote_link.is_none() {
-                    self.pending_link = Some(PendingLink { url, origin });
-                }
-            }
-            Err(e) => {
-                use pdfcraft_engine::links::BlockedLink;
-                let template = if matches!(e, BlockedLink::MailFile | BlockedLink::MailEncodedWord) {
-                    "{who} in this document tried to open an address PdfCraft won't open: {e}."
-                } else {
-                    "{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents."
-                };
-                self.notify_fmt(template, &[("who", tl!(origin.noun())), ("e", &e.to_string())]);
-            }
-        }
-    }
-
-    /// The user's answer to [`Self::pending_link`]: open it, or drop it.
-    pub fn resolve_pending_link(&mut self, open: bool) {
-        if let Some(p) = self.pending_link.take()
-            && open
-        {
-            self.open_url(&p.url);
-        }
-    }
-
-    pub fn notify(&mut self, msg: impl Into<String>) {
-        self.toast = Some((msg.into(), 0.0));
-    }
-
-    /// Notify with a static message in the UI language.
-    pub fn notify_tr(&mut self, text: &str) {
-        self.notify(tl!(text).to_string());
-    }
-
-    /// Notify with an error's own text. Engine and OS messages are not translated: matching their
-    /// English wording would break silently whenever it changes.
-    pub fn notify_error(&mut self, error: impl std::fmt::Display) {
-        self.notify(error.to_string());
-    }
-
-    /// Notify with a `{name}`-style template in the UI language (placeholders filled once).
-    pub fn notify_fmt(&mut self, template: &str, args: &[(&str, &str)]) {
-        self.notify(i18n::fmt(tl!(template), args));
-    }
-
-    pub fn set_theme_preference(&mut self, preference: ThemePreference) {
-        self.theme_preference = preference;
-        if let Some(ctx) = self.ctx.clone() {
-            self.sync_theme(&ctx);
-            theme::apply(&ctx, self.theme);
-        } else {
-            self.theme = preference.resolve(None, ThemeKind::Light);
-        }
-    }
-
-    /// The app-wide reading-colours preference: sets it and applies it to every open document,
-    /// not just the active one (Preferences ▸ Reading colours, Acrobat's Replace Document
-    /// Colors). A document the change actually touches re-renders.
-    pub fn set_reading_colors(&mut self, colors: pdfcraft_render::ReadingColors) {
-        self.reading_colors = colors;
-        for i in 0..self.views.len() {
-            // Idempotent per document: the engine says whether anything changed.
-            if self.session.set_reading_colors(self.views[i].id, colors) {
-                self.views[i].invalidate_content();
-            }
-        }
-    }
-
-    /// Enable the Linux desktop portal in a native window. Headless contexts keep
-    /// their supplied input and never connect to the user's session bus.
-    #[cfg(target_os = "linux")]
-    pub fn enable_desktop_theme(&mut self) {
-        self.desktop_theme_enabled = true;
-    }
-
-    /// Draw the running job's progress card and pass a Cancel click on to the job.
-    fn show_progress(&mut self, ctx: &egui::Context) {
-        if widgets::progress_notice(self, ctx) {
-            self.cancel_optimize();
-        }
-    }
-
-    fn sync_theme(&mut self, ctx: &egui::Context) {
-        #[cfg_attr(not(target_os = "linux"), expect(unused_mut))]
-        let mut system = ctx.system_theme().map(|theme| theme == egui::Theme::Dark);
-        #[cfg(target_os = "linux")]
-        {
-            let active = self.theme_preference == ThemePreference::System;
-            if self.desktop_theme_enabled && active && self.desktop_theme.is_none() {
-                let ctx = ctx.clone();
-                self.desktop_theme = Some(pdfcraft_platform::desktop_theme::DesktopTheme::start(move || ctx.request_repaint()));
-            }
-            if let Some(desktop) = &self.desktop_theme {
-                desktop.set_active(active);
-                // The standard portal supplies Linux desktop appearance. No preference
-                // must clear an earlier answer rather than retaining stale dark chrome.
-                system = desktop.get().map(|appearance| appearance == pdfcraft_platform::desktop_theme::DesktopAppearance::Dark);
-            }
-        }
-        let kind = self.theme_preference.resolve(system, ThemeKind::Light);
-        if kind != self.theme {
-            self.theme = kind;
-            theme::apply(ctx, kind);
-        }
-    }
-
-    /// Run a catalogue command. Commands that aren't implemented yet say which milestone ships them.
-    pub fn run_command(&mut self, command: &str) {
-        if let Some(spec) = pdfcraft_engine::commands::command(command) {
-            use pdfcraft_engine::commands::Needs;
-            // A tool that needs a document, chosen with none open, asks for the file and then
-            // runs on it, instead of only saying to open one first.
-            let needs_document = !matches!(spec.needs, Needs::Nothing | Needs::Undo | Needs::Redo);
-            let is_tool = pdfcraft_engine::catalog::TOOL_GROUPS
-                .iter()
-                .flat_map(|g| g.sections.iter().flat_map(|s| s.items.iter()))
-                .any(|i| i.command == spec.id);
-            if self.active.is_none() && needs_document && is_tool && !self.command_enabled(spec) {
-                self.open_then_run(spec);
-                return;
-            }
-            self.execute(command);
-            return;
-        }
-        // Not implemented yet: say which milestone ships it.
-        let when = pdfcraft_engine::catalog::TOOL_GROUPS
-            .iter()
-            .flat_map(|g| g.sections.iter().flat_map(|s| s.items.iter()))
-            .find(|i| i.command == command)
-            .map(|i| match i.availability {
-                pdfcraft_engine::catalog::Availability::Planned(m) => crate::i18n::fmt(tl!("ships in milestone {m}"), &[("m", m)]),
-                pdfcraft_engine::catalog::Availability::Provider => tl!("needs an AI provider (off by default)").to_string(),
-                pdfcraft_engine::catalog::Availability::Ready => tl!("is available").to_string(),
-            })
-            .unwrap_or_else(|| tl!("is not available yet").to_string());
-        self.notify_fmt("`{command}` {when}", &[("command", command), ("when", &when)]);
-    }
-
-    /// Ask for a file to open, then run `spec` on it once it is open (or unlocked). Nothing runs
-    /// when the picker is cancelled or the file doesn't open.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn open_then_run(&mut self, spec: &'static pdfcraft_engine::commands::CommandSpec) {
-        self.startup_superseded = true;
-        let dialog = Self::open_picker().set_title(tl!(spec.label).trim_end_matches('…'));
-        let command = spec.id;
-        self.ask_one(pickers::Ask::File(dialog), None, move |app, path| {
-            let path = path.to_string_lossy().into_owned();
-            app.open_path_then(&path, Some(command));
-        });
-    }
-
-    /// Browsers read the picked file asynchronously; it opens, and the tool can be chosen again.
-    #[cfg(target_arch = "wasm32")]
-    fn open_then_run(&mut self, _spec: &'static pdfcraft_engine::commands::CommandSpec) {
-        self.open_dialog();
-    }
-
-    /// Today in `fmt` (or Preferences ▸ Date format), with month and weekday names in the date
-    /// language, or the interface language when it follows that.
-    pub fn date_text(&self, fmt: Option<&str>) -> Result<String, String> {
-        date_text(&self.session, fmt)
-    }
-
-    pub(crate) fn reveal_tools(&mut self) {
-        self.left_open = true;
-        self.pending_panel_reveals.push(docking::Panel::Tools);
-    }
-
-    /// Enter a tool from the catalogue, Home, palette or control channel. Organize is a
-    /// workspace, so opening its panel also opens the page grid (without toggling it off).
-    pub(crate) fn select_tool(&mut self, id: &'static str) {
-        self.left = LeftPanel::Tool(id);
-        self.reveal_tools();
-        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) {
-            if id == "organize" {
-                view.open_organize();
-            } else {
-                view.organize = false;
-            }
-        }
-    }
-
-    /// Select the workspace and its matching tool panel, just like the mode bar. The tool goes
-    /// with the workspace as [`Self::enter_mode`] sets it.
-    pub(crate) fn select_mode(&mut self, mode: Mode) {
-        self.enter_mode(mode);
-        self.reveal_tools();
-        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) {
-            view.organize = false;
-        }
-        self.left = match mode {
-            Mode::Edit => LeftPanel::Tool("edit"),
-            Mode::Convert => LeftPanel::Tool("export"),
-            Mode::Sign => LeftPanel::Tool("fill_sign"),
-            _ => LeftPanel::AllTools,
-        };
-    }
-
-    /// Changes the workspace and the tool that goes with it. The mode bar (through
-    /// [`Self::select_mode`]), the Read mode command and the tool panels' back arrows all come
-    /// here, so they leave Edit alike. Edit turns on Edit text & images at once, as Acrobat does:
-    /// every paragraph and image on the page gets its box and is editable with one click. Leaving
-    /// Edit puts the editing tools down again and applies a paragraph still open in the editor.
-    pub(crate) fn enter_mode(&mut self, mode: Mode) {
-        self.mode = mode;
-        if mode == Mode::Edit {
-            self.quick_tool = QuickTool::EditText;
-        } else if matches!(self.quick_tool, QuickTool::EditText | QuickTool::AddText) {
-            self.put_down_edit_text();
-        }
-        // Read mode hides the quick toolbar, so no other tool may stay active there. Opening a
-        // document with Read as the default mode comes here without `switch_mode`.
-        if mode == Mode::Read {
-            self.quick_tool = QuickTool::Select;
-        }
-    }
-
-    /// Back to the Select tool from an editing tool. A paragraph still open in the editor is
-    /// applied, as clicking away from it does; left open, its page would keep showing the
-    /// paragraph's text removed with no editor over it.
-    pub(crate) fn put_down_edit_text(&mut self) {
-        self.quick_tool = QuickTool::Select;
-        if let Some(ed) = self.active.and_then(|i| self.views.get_mut(i)).and_then(|v| v.line_editor.take())
-            && let Some(edit) = edit_text_ui::finished_edit(ed)
-        {
-            self.apply_edit(edit);
-        }
-    }
-
-    /// Switches workspace because the user chose to (mode bar, Read mode command). Entering Read
-    /// mode closes the right panel, as Acrobat's Read mode hides its panes, and leaving it reopens
-    /// that panel. The rail stays in Read mode, and its buttons open panels there too (#932).
-    /// Read mode hides the quick toolbar, so entering it also puts the current tool down.
-    pub(crate) fn switch_mode(&mut self, mode: Mode, select_tools: bool) {
-        let was_read = self.mode == Mode::Read;
-        if select_tools {
-            self.select_mode(mode);
-        } else {
-            self.enter_mode(mode);
-        }
-        if mode == Mode::Read && !was_read {
-            self.right_before_read = self.right.take();
-            // An editing tool is put down so its open paragraph is applied, as `select_mode` does.
-            if matches!(self.quick_tool, QuickTool::EditText | QuickTool::AddText) {
-                self.put_down_edit_text();
-            } else {
-                self.quick_tool = QuickTool::Select;
-            }
-        } else if mode != Mode::Read && was_read {
-            let before = self.right_before_read.take();
-            if self.right.is_none() {
-                self.right = before;
-            }
-            if self.right.is_some() {
-                self.pending_panel_reveals.push(docking::Panel::Inspector);
-            }
-        }
-    }
-
-    /// Opens a right panel, or closes it with `None`, because the user chose to. Closing Comments
-    /// keeps comment tools from reopening it; opening it again lets them (#225). A choice made in
-    /// Read mode replaces the pane saved on the way in, so leaving Read mode doesn't undo it.
-    pub fn choose_right_panel(&mut self, panel: Option<RightPanel>) {
-        if self.mode == Mode::Read {
-            self.right_before_read = None;
-        }
-        if panel == Some(RightPanel::Comments) {
-            self.comments_panel_closed = false;
-        } else if panel.is_none() && self.right == Some(RightPanel::Comments) {
-            self.comments_panel_closed = true;
-        }
-        if panel.is_some() {
-            self.right_panel_closed = false;
-        } else if self.right.is_some() {
-            self.right_panel_closed = true;
-        }
-        self.right = panel;
-        if panel.is_some() {
-            self.pending_panel_reveals.push(docking::Panel::Inspector);
-        }
-    }
-
-    /// Serialize the user's persistent state (recent files, theme). Local only.
-    pub fn persist(&self) -> String {
-        let trusted: Vec<String> = self.session.trusted_certificates().iter().map(pdfcraft_engine::sign::x509::to_pem).collect();
-        let mut v = serde_json::json!({
-            "docking": self.docking,
-            "docking_left_open": self.left_open,
-            "docking_right": self.right,
-            "recent": self.recent,
-            "reopen_last_session": self.reopen_last_session,
-            "restore_last_view": self.restore_last_view,
-            "last_views": self.last_views_to_save(),
-            // Kept only while the preference is on.
-            "last_session": self.reopen_last_session.then(|| self.session_to_save()),
-            "reload_changed_files": self.reload_changed_files,
-            "system_title_bar": self.system_title_bar,
-            "pinned_folders": self.pinned.folders,
-            "theme": self.theme_preference,
-            "scroll_speed": self.scroll_speed,
-            "animation_effects": self.animation_effects,
-            "default_mode": self.default_mode,
-            "default_layout": canvas::display_token(self.view_defaults.layout, self.view_defaults.continuous),
-            "default_zoom": self.view_defaults.zoom_name(),
-            "always_default_view": self.always_default_view,
-            "highlight_fields": self.view_defaults.highlight_fields,
-            "units": self.units,
-            "language": self.language,
-            "reading_colors": self.reading_colors,
-            // Null follows the system's text scaling.
-            "ui_scale": self.ui_scale,
-            "flatten_fill_sign": self.flatten_fill_sign_on_save,
-            "fill_text_size": self.fill_text_size,
-            "date_format": self.session.date_format(),
-            // Null follows the interface language.
-            "date_language": self.session.date_language(),
-            "author": self.comment_prefs.author,
-            // Per-tool comment defaults (colours, opacity, widths), so Make Current
-            // Properties Default survives a restart (#340).
-            "comment_styles": self
-                .comment_prefs
-                .styles()
-                .map(|(t, s)| serde_json::json!({
-                    "tool": t.command(),
-                    "color": s.color,
-                    "opacity": s.opacity,
-                    "width": s.width,
-                    "fill": s.fill,
-                }))
-                .collect::<Vec<_>>(),
-            // Drawn signatures keep their original form (older settings read the same).
-            "signature": match &self.signature { Some(fill_sign::SavedSig::Drawn(s)) => Some(s), _ => None },
-            "signature_text": match &self.signature { Some(fill_sign::SavedSig::Typed(t)) => Some(t), _ => None },
-            "signature_image": match &self.signature { Some(s @ fill_sign::SavedSig::Image(_)) => Some(s), _ => None },
-            "initials": self.initials,
-            "sign_graphic": self.sign_graphic,
-            // macOS Keychain and Windows store identities are read from their OS key stores each time.
-            "digital_ids": self.digital_ids.iter().filter(|e| !e.path.starts_with("keychain:") && !e.path.starts_with("windows:")).collect::<Vec<_>>(),
-            "trusted": trusted,
-            "custom_stamps": stamps_ui::encode(&self.custom_stamps),
-            "javascript": self.session.javascript(),
-            "actions": actions_ui::encode(&self.custom_actions),
-            "combine_columns": self.combine_columns.to_json(),
-            "combine_view": self.combine_view.as_str(),
-            "combine_zoom": self.combine_zoom,
-            "comments_panel_closed": self.comments_panel_closed,
-            "right_panel_closed": self.right_panel_closed,
-        });
-        // Set apart: one more key inside the macro above passes serde_json's recursion limit.
-        v["default_page_gaps"] = serde_json::Value::Bool(self.view_defaults.show_page_gaps);
-        v["redact_prefs"] = self.redact_defaults.to_json();
-        // Set outside json! above, which is at serde_json's macro recursion limit.
-        v["hide_empty_highlight_hover"] = serde_json::Value::Bool(self.comment_prefs.hide_empty_highlight_hover);
-        v["show_secured_notice"] = serde_json::Value::Bool(self.show_secured_notice);
-        v["organize_zoom"] = serde_json::json!(self.organize_zoom);
-        // Canonical names survive changes to the order of PAPERS and do not depend on UI language.
-        v["print_paper"] = serde_json::json!(pdfcraft_engine::print::PAPERS.get(self.print_draft.paper).map(|(name, _)| *name));
-        v.to_string()
-    }
-
-    /// Restore state written by `persist`. Unknown or malformed data is ignored.
-    pub fn restore(&mut self, json: &str) {
-        let Ok(v) = serde_json::from_str::<serde_json::Value>(json) else { return };
-        if let Some(saved) = v.get("docking")
-            && let Ok(workspace) = serde_json::from_value::<docking::Workspace>(saved.clone())
-            && workspace.validate().is_ok()
-        {
-            self.docking = workspace;
-            self.left_open =
-                v.get("docking_left_open").and_then(serde_json::Value::as_bool).unwrap_or(self.docking.layout.contains(&docking::Panel::Tools));
-            self.right = v.get("docking_right").and_then(|value| serde_json::from_value(value.clone()).ok()).flatten();
-        }
-        self.combine_columns = combine_ui::Columns::from_json(&v["combine_columns"]);
-        if let Some(view) = v["combine_view"].as_str().and_then(combine_ui::CombineView::parse) {
-            self.combine_view = view;
-        }
-        if let Some(zoom) = v["combine_zoom"].as_f64() {
-            self.set_combine_zoom(zoom as f32);
-        }
-        // Clamped like any grid zoom when the grid next shows; nonsense keeps the usual size.
-        if let Some(zoom) = v["organize_zoom"].as_f64().map(|z| z as f32).filter(|z| z.is_finite()) {
-            self.organize_zoom = zoom.clamp(*canvas::GRID_ZOOM_RANGE.start(), *canvas::GRID_ZOOM_RANGE.end());
-        }
-        if let Ok(r) = serde_json::from_value::<Vec<RecentFile>>(v["recent"].clone()) {
-            // Only keep entries whose files still exist.
-            #[cfg(not(target_arch = "wasm32"))]
-            let r: Vec<RecentFile> = r.into_iter().filter(|f| std::path::Path::new(&f.path).exists()).collect();
-            self.recent = r;
-        }
-        if let Some(on) = v["reopen_last_session"].as_bool() {
-            self.reopen_last_session = on;
-        }
-        if let Some(on) = v["restore_last_view"].as_bool() {
-            self.restore_last_view = on;
-        }
-        self.restore_last_views(&v["last_views"]);
-        self.last_session = last_session::LastSession::from_json(&v["last_session"]);
-        if let Some(on) = v["system_title_bar"].as_bool() {
-            self.system_title_bar = on;
-        }
-        if let Some(on) = v["reload_changed_files"].as_bool() {
-            self.reload_changed_files = on;
-        }
-        if let Some(on) = v["show_secured_notice"].as_bool() {
-            self.show_secured_notice = on;
-        }
-        self.pinned.restore(&v["pinned_folders"]);
-        if let Ok(preference) = serde_json::from_value::<ThemePreference>(v["theme"].clone()) {
-            self.set_theme_preference(preference);
-        }
-        if let Ok(speed) = serde_json::from_value::<scroll_speed::ScrollSpeed>(v["scroll_speed"].clone()) {
-            self.scroll_speed = speed;
-        }
-        if let Ok(effects) = serde_json::from_value::<motion::AnimationEffects>(v["animation_effects"].clone()) {
-            self.animation_effects = effects;
-        }
-        if let Ok(mode) = serde_json::from_value::<Mode>(v["default_mode"].clone()) {
-            self.default_mode = mode;
-        }
-        if let Some((layout, continuous)) = v["default_layout"].as_str().and_then(canvas::parse_display_token) {
-            (self.view_defaults.layout, self.view_defaults.continuous) = (layout, continuous);
-        }
-        if let Some(show) = v["default_page_gaps"].as_bool() {
-            self.view_defaults.show_page_gaps = show;
-        }
-        if let Ok(units) = serde_json::from_value::<units::Unit>(v["units"].clone()) {
-            self.units = units;
-        }
-        if let Some(on) = v["always_default_view"].as_bool() {
-            self.always_default_view = on;
-        }
-        if let Some(paper) = v
-            .get("print_paper")
-            .and_then(serde_json::Value::as_str)
-            .and_then(|name| pdfcraft_engine::print::PAPERS.iter().position(|(canonical, _)| *canonical == name))
-        {
-            self.print_draft.paper = paper;
-        }
-        if let Some(on) = v["highlight_fields"].as_bool() {
-            self.view_defaults.highlight_fields = on;
-        }
-        if let Some(closed) = v["comments_panel_closed"].as_bool() {
-            self.comments_panel_closed = closed;
-        }
-        if let Some(closed) = v["right_panel_closed"].as_bool() {
-            self.right_panel_closed = closed;
-        }
-        if let Some(defaults) = v["default_zoom"].as_str().and_then(|zoom| self.view_defaults.with_zoom(zoom)) {
-            self.view_defaults = defaults;
-        }
-        if let Some(language) = v["language"].as_str().and_then(i18n::normalize_pref) {
-            self.language = language.to_string();
-        }
-        if let Some(on) = v["flatten_fill_sign"].as_bool() {
-            self.flatten_fill_sign_on_save = on;
-        }
-        if let Some(size) = v["fill_text_size"].as_f64().and_then(fill_sign::valid_text_size) {
-            self.fill_text_size = size;
-        }
-        if let Some(prefs) = RedactPrefs::from_json(&v["redact_prefs"]) {
-            self.redact_prefs = prefs.clone();
-            self.redact_defaults = prefs;
-        }
-        // Settings are untrusted: an unreadable value (a colour that isn't three bytes, say)
-        // fails to deserialize and keeps Off.
-        if let Ok(colors) = serde_json::from_value::<pdfcraft_render::ReadingColors>(v["reading_colors"].clone()) {
-            self.reading_colors = colors;
-        }
-        // Settings are untrusted: a size out of range follows the system instead.
-        self.ui_scale = v["ui_scale"].as_f64().and_then(ui_scale::valid);
-        // Settings are untrusted: an unusable pattern keeps the default.
-        if let Some(f) = v["date_format"].as_str() {
-            let _ = self.session.set_date_format(f);
-        }
-        if let Some(l) = v["date_language"].as_str() {
-            let _ = self.session.set_date_language(Some(l));
-        }
-        // An empty or missing name keeps the login-name default; settings are untrusted, so the
-        // name is cut to a sane length.
-        if let Some(author) = v["author"].as_str().map(str::trim).filter(|a| !a.is_empty()) {
-            self.comment_prefs.author = author.chars().take(MAX_AUTHOR_CHARS).collect();
-        }
-        if let Some(hide) = v["hide_empty_highlight_hover"].as_bool() {
-            self.comment_prefs.hide_empty_highlight_hover = hide;
-        }
-        // Per-tool comment styles (#340): each field goes through its clamping setter, so a
-        // malformed or hostile entry is clamped or ignored rather than trusted.
-        if let Some(styles) = v["comment_styles"].as_array() {
-            for e in styles {
-                let Some(tool) = e["tool"].as_str().and_then(crate::comments::CommentTool::from_command) else { continue };
-                if let Some(c) = rgb_triple(&e["color"]) {
-                    self.comment_prefs.set_color(tool, c);
-                }
-                if let Some(o) = e["opacity"].as_f64() {
-                    self.comment_prefs.set_opacity(tool, o);
-                }
-                if let Some(w) = e["width"].as_f64() {
-                    self.comment_prefs.set_width(tool, w);
-                }
-                // `"fill": null` is a saved "no fill", which clears a tool's default fill; a
-                // missing or malformed fill keeps it.
-                let fill = match e.get("fill") {
-                    Some(serde_json::Value::Null) => Some(None),
-                    Some(v) => rgb_triple(v).map(Some),
-                    None => None,
-                };
-                if let Some(fill) = fill {
-                    let mut s = self.comment_prefs.style(tool);
-                    s.fill = fill;
-                    self.comment_prefs.set_style(tool, s);
-                }
-            }
-        }
-        if let Ok(s) = serde_json::from_value::<Vec<Vec<[f32; 2]>>>(v["signature"].clone())
-            && s.iter().all(|st| st.iter().all(|p| p.iter().all(|x| x.is_finite())))
-        {
-            self.signature = Some(fill_sign::SavedSig::Drawn(s));
-        }
-        if let Some(t) = v["signature_text"].as_str().filter(|t| !t.trim().is_empty()) {
-            self.signature = Some(fill_sign::SavedSig::Typed(t.to_string()));
-        }
-        if let Ok(s @ fill_sign::SavedSig::Image(_)) = serde_json::from_value::<fill_sign::SavedSig>(v["signature_image"].clone()) {
-            self.signature = Some(s);
-        }
-        if let Ok(i) = serde_json::from_value::<fill_sign::SavedSig>(v["initials"].clone()) {
-            self.initials = Some(i);
-        }
-        // An unreadable choice (a damaged image) falls back to the name.
-        self.sign_graphic = serde_json::from_value(v["sign_graphic"].clone()).unwrap_or_default();
-        if let Ok(ids) = serde_json::from_value::<Vec<DigitalIdEntry>>(v["digital_ids"].clone()) {
-            self.digital_ids = ids;
-        }
-        self.custom_stamps = stamps_ui::decode(&v["custom_stamps"]);
-        self.custom_actions = actions_ui::decode(&v["actions"]);
-        if let Some(on) = v["javascript"].as_bool() {
-            self.session.set_javascript(on);
-        }
-        if let Ok(pems) = serde_json::from_value::<Vec<String>>(v["trusted"].clone()) {
-            let certs = pems.iter().filter_map(|p| pdfcraft_engine::sign::x509::load_certificates(p.as_bytes()).ok()).flatten().collect();
-            self.apply_trusted_certificates(certs);
-        }
-    }
-
-    /// `true` while any open document still waits for page renders (used by headless capture).
-    pub fn render_pending(&self) -> bool {
-        self.views.iter().any(|v| v.render_pending())
-    }
-
-    /// Apply a named view option (`--page 3`, `--panel bookmarks`, `--theme dark`, …).
-    ///
-    /// This is the seed of the UI control channel (M3.9): the same verbs become `ui.set` calls.
-    pub fn set_option(&mut self, key: &str, value: &str) -> Result<(), String> {
-        let view = self.active.and_then(|i| self.views.get_mut(i));
-        match (key, view) {
-            ("language", _) => {
-                let language = i18n::normalize_pref(value).ok_or_else(|| {
-                    let codes: Vec<&str> = std::iter::once(i18n::AUTO).chain(i18n::Lang::all().map(i18n::Lang::code)).collect();
-                    format!("language must be one of {}", codes.join(", "))
-                })?;
-                self.language = language.to_string();
-            }
-            ("theme", _) => {
-                let preference = match value {
-                    "system" => ThemePreference::System,
-                    "light" => ThemePreference::Light,
-                    "dark" => ThemePreference::Dark,
-                    _ => return Err("theme must be light, dark, or system".into()),
-                };
-                self.set_theme_preference(preference);
-            }
-            ("scroll_speed", _) => {
-                self.scroll_speed = scroll_speed::ScrollSpeed::parse(value).ok_or("scroll_speed must be slow, normal, or fast")?;
-            }
-            ("animation_effects", _) => {
-                self.animation_effects = motion::AnimationEffects::parse(value).ok_or("animation_effects must be system, on, or off")?;
-            }
-            ("panel", _) => {
-                self.right = match value {
-                    "comments" => Some(RightPanel::Comments),
-                    "bookmarks" => Some(RightPanel::Bookmarks),
-                    "pages" => Some(RightPanel::Pages),
-                    "fields" => Some(RightPanel::Fields),
-                    "layers" => Some(RightPanel::Layers),
-                    "attachments" => Some(RightPanel::Attachments),
-                    "signatures" => Some(RightPanel::Signatures),
-                    "accessibility" => Some(RightPanel::Accessibility),
-                    "tags" => Some(RightPanel::Tags),
-                    "search" => Some(RightPanel::Search),
-                    "compare" => Some(RightPanel::Compare),
-                    "none" => None,
-                    other => return Err(format!("unknown panel {other}")),
-                }
-            }
-            ("mode", _) => {
-                let mode = Mode::parse(value).unwrap_or(Mode::AllTools);
-                self.mode_override = Some(mode);
-                self.mode = mode;
-            }
-            ("default-mode", _) => {
-                self.default_mode = Mode::parse(value).ok_or("default-mode must be all, read, edit, convert or sign")?;
-            }
-            ("date-format", _) => self.session.set_date_format(value)?,
-            ("date-language", _) => self.session.set_date_language(Some(value).filter(|v| *v != "auto"))?,
-            ("tool", _) => {
-                let g = pdfcraft_engine::catalog::group(value).ok_or_else(|| format!("unknown tool {value}"))?;
-                self.select_tool(g.id);
-            }
-            ("left", _) => self.left_open = value != "closed",
-            ("home", _) => self.active = None,
-            ("dialog", _) => {
-                self.dialog = match value {
-                    "properties" => Some(Dialog::Properties(PropsTab::Description)),
-                    "security" => Some(Dialog::Properties(PropsTab::Security)),
-                    "fonts" => Some(Dialog::Properties(PropsTab::Fonts)),
-                    "advanced" => Some(Dialog::Properties(PropsTab::Advanced)),
-                    "shortcuts" => Some(Dialog::Shortcuts),
-                    "split" => Some(Dialog::Split),
-                    "protect" => Some(Dialog::Protect),
-                    "page-boxes" => Some(Dialog::PageBoxes),
-                    "header-footer" => Some(Dialog::Marks(pdfcraft_engine::MarkKind::HeaderFooter)),
-                    "watermark" => Some(Dialog::Marks(pdfcraft_engine::MarkKind::Watermark)),
-                    "background" => Some(Dialog::Marks(pdfcraft_engine::MarkKind::Background)),
-                    "export-image" => Some(Dialog::Export(export_ui::ExportKind::Image)),
-                    "word-count" => Some(Dialog::WordCount),
-                    "export-text" => Some(Dialog::Export(export_ui::ExportKind::Text)),
-                    "export-all-images" => Some(Dialog::Export(export_ui::ExportKind::AllImages)),
-                    "accessibility-options" => Some(Dialog::AccessibilityOptions),
-                    "recognize-text" => Some(Dialog::RecognizeText),
-                    "js-console" => Some(Dialog::JsConsole),
-                    "document-js" => Some(Dialog::DocumentJs),
-                    "preferences" => Some(Dialog::Preferences),
-                    "compare-files" => Some(Dialog::CompareFiles),
-                    "action-wizard" => Some(Dialog::ActionWizard),
-                    "pdfa" => Some(Dialog::PdfA),
-                    "signature" => Some(Dialog::Signature),
-                    "optimize" => Some(Dialog::Optimize),
-                    "sign" | "certify" => {
-                        // Sign with a Digital ID for an invisible signature on the current page.
-                        let page = self.active.map_or(0, |i| self.views[i].current);
-                        self.start_signing(page, None, None, (value == "certify").then_some(2));
-                        Some(Dialog::Sign)
-                    }
-                    "number-pages" => {
-                        // Same path as the menu, so the page range is seeded.
-                        self.execute("page.number");
-                        Some(Dialog::NumberPages)
-                    }
-                    "none" => None,
-                    _ => Some(Dialog::About),
-                }
-            }
-            ("tools", _) => self.all_tools_expanded = value != "collapsed",
-            ("palette", _) => {
-                self.palette_open = true;
-                self.palette_query = value.to_string();
-            }
-            ("page", Some(v)) => v.go_to_page(value.parse::<usize>().map_err(|e| e.to_string())?.saturating_sub(1)),
-            ("zoom", Some(v)) => v.set_zoom(DocView::parse_zoom_percent(value).ok_or("zoom must be a percentage above 0")?),
-            ("layout", Some(v)) => {
-                let (layout, continuous) = canvas::parse_display_token(value).ok_or("layout must be single, continuous, two-up or two-page")?;
-                v.set_display(layout, continuous);
-            }
-            ("continuous", Some(v)) => match value {
-                "on" => v.set_continuous(true),
-                "off" => v.set_continuous(false),
-                _ => return Err("continuous must be on or off".into()),
-            },
-            ("page-gaps", Some(_)) => {
-                let show = match value {
-                    "on" => true,
-                    "off" => false,
-                    _ => return Err("page-gaps must be on or off".into()),
-                };
-                self.set_active_page_gaps(show);
-            }
-            ("default-page-gaps", _) => {
-                self.view_defaults.show_page_gaps = match value {
-                    "on" => true,
-                    "off" => false,
-                    _ => return Err("default-page-gaps must be on or off".into()),
-                };
-            }
-            ("cover", Some(v)) => {
-                let on = match value {
-                    "on" => true,
-                    "off" => false,
-                    _ => return Err("cover must be on or off".into()),
-                };
-                if on && !v.cover_applies() {
-                    return Err("switch to two-page view first to show the cover page".into());
-                }
-                v.set_cover(on);
-            }
-            ("default-layout", _) => {
-                let (layout, continuous) =
-                    canvas::parse_display_token(value).ok_or("default-layout must be single, continuous, two-up or two-page")?;
-                (self.view_defaults.layout, self.view_defaults.continuous) = (layout, continuous);
-            }
-            ("default-continuous", _) => {
-                self.view_defaults.continuous = match value {
-                    "on" => true,
-                    "off" => false,
-                    _ => return Err("default-continuous must be on or off".into()),
-                };
-            }
-            ("default-zoom", _) => {
-                self.view_defaults =
-                    self.view_defaults.with_zoom(value).ok_or("default-zoom must be fit-width, fit-page or a percentage from 8 to 6400")?;
-            }
-            ("always-default-view", _) => {
-                self.always_default_view = match value {
-                    "on" => true,
-                    "off" => false,
-                    _ => return Err("always-default-view must be on or off".into()),
-                };
-            }
-            ("tools-side", _) => self.docking.set_tools_on_right(match value {
-                "left" => false,
-                "right" => true,
-                _ => return Err("tools-side must be left or right".into()),
-            })?,
-            ("organize", Some(v)) => {
-                if value == "off" {
-                    v.organize = false;
-                } else {
-                    v.open_organize();
-                }
-            }
-            // Inspector thumbnail size, in percent, independent of document and grid zoom.
-            ("thumbnail-zoom", Some(v)) => {
-                let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
-                if !percent.is_finite() || !canvas::THUMBNAIL_ZOOM_RANGE.contains(&(percent / 100.0)) {
-                    return Err("thumbnail-zoom must be between 50 and 150".into());
-                }
-                v.set_thumbnail_zoom(percent / 100.0);
-            }
-            // `--grid-zoom 150`: the size of the pages in the organize grid, in percent.
-            ("grid-zoom", Some(v)) => {
-                let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
-                if !percent.is_finite() || !canvas::GRID_ZOOM_RANGE.contains(&(percent / 100.0)) {
-                    return Err("grid-zoom must be between 50 and 300".into());
-                }
-                v.set_grid_zoom(percent / 100.0);
-                // The grid's size is one for every document, as it is remembered.
-                self.organize_zoom = v.grid_zoom();
-            }
-            ("rotate", Some(v)) => {
-                let deg: u16 = value.parse().map_err(|_| "rotate: 0, 90, 180 or 270")?;
-                if !deg.is_multiple_of(90) {
-                    return Err("rotate: 0, 90, 180 or 270".into());
-                }
-                v.rotation = deg % 360;
-            }
-            ("layer", _) => {
-                // `--layer "Name=off"` / `"Name=on"`
-                let (name, state) = value.rsplit_once('=').ok_or("expected NAME=on|off")?;
-                let (i, id) = self.active_ids().ok_or("`layer` needs an open document")?;
-                let idx = self
-                    .session
-                    .get(id)
-                    .and_then(|d| d.info.layers.iter().position(|l| l.name == name))
-                    .ok_or_else(|| format!("no layer named {name}"))?;
-                if self.session.set_layer_visible(id, idx, state != "off") {
-                    self.views[i].invalidate_content();
-                }
-            }
-            ("find", Some(v)) => {
-                v.open_find();
-                if let Some(f) = v.find.as_mut() {
-                    f.query = value.to_string();
-                }
-                v.rerun_find();
-            }
-            ("fields", Some(v)) => v.highlight_fields = value != "off",
-            ("select", Some(v)) => {
-                // The same physical page ranges as the Organize Pages selection field.
-                let pages = crate::page_selection_ui::parse(value, v.page_count()).map_err(|e| e.to_string())?;
-                v.select_pages(&pages);
-            }
-            ("notice", Some(v)) => v.notice_dismissed = value == "off",
-            ("quick", _) => {
-                // `--quick select|hand|note|freetext|highlight|underline|strikeout|ink|line|arrow|square|circle`
-                self.quick_tool = match value {
-                    "select" => QuickTool::Select,
-                    measure if measure.starts_with("measure-") => QuickTool::Measure(
-                        measure_ui::Tool::from_name(measure.trim_start_matches("measure-")).ok_or_else(|| format!("unknown tool {measure}"))?,
-                    ),
-                    "hand" => QuickTool::Hand,
-                    "crop" => QuickTool::Crop,
-                    "enhance-camera" => QuickTool::EnhanceCamera,
-                    "redact" => QuickTool::Redact,
-                    "add-text" => QuickTool::AddText,
-                    "edit-text" => QuickTool::EditText,
-                    "link" => QuickTool::Link,
-                    "sign" => QuickTool::SignArea { certify: false },
-                    "marquee-zoom" => QuickTool::MarqueeZoom,
-                    "snapshot" => QuickTool::Snapshot,
-                    "column-select" => QuickTool::ColumnSelect,
-                    "certify" => QuickTool::SignArea { certify: true },
-                    custom if custom.starts_with("custom-stamp-") => {
-                        let i: usize = custom[13..].parse().map_err(|_| format!("bad stamp {custom}"))?;
-                        if i >= self.custom_stamps.len() {
-                            return Err(format!("there are {} custom stamps", self.custom_stamps.len()));
-                        }
-                        QuickTool::CustomStamp(i)
-                    }
-                    stamp if stamp.starts_with("stamp-") => QuickTool::Stamp(
-                        pdfcraft_engine::StampKind::ALL
-                            .into_iter()
-                            .find(|k| k.name().trim_start_matches("PC").eq_ignore_ascii_case(&stamp[6..]))
-                            .ok_or_else(|| format!("unknown stamp {stamp}"))?,
-                    ),
-                    field if field.starts_with("field-") => QuickTool::Field(
-                        prepare::FieldTool::from_command(&format!("form.add.{}", &field[6..])).ok_or_else(|| format!("unknown tool {field}"))?,
-                    ),
-                    fill if fill.starts_with("fill-") => QuickTool::Fill(
-                        fill_sign::FillTool::from_command(&format!("sign.fill.{}", &fill[5..])).ok_or_else(|| format!("unknown tool {fill}"))?,
-                    ),
-                    other => {
-                        let t = comments::CommentTool::from_command(&format!("comment.{other}")).ok_or_else(|| format!("unknown tool {other}"))?;
-                        self.comment_prefs.group_tool[t.group()] = t;
-                        QuickTool::Comment(t)
-                    }
-                };
-            }
-            ("author", _) => self.comment_prefs.author = value.to_string(),
-            ("hide-empty-highlight-hover", _) => {
-                self.comment_prefs.hide_empty_highlight_hover = match value {
-                    "true" => true,
-                    "false" => false,
-                    _ => return Err("hide-empty-highlight-hover must be true or false".into()),
-                };
-            }
-            ("ui-scale", _) => self.ui_scale = ui_scale::parse(value)?,
-            // `--secured-notice false`: no notice above the pages that a document is secured.
-            ("secured-notice", _) => {
-                self.show_secured_notice = match value {
-                    "true" => true,
-                    "false" => false,
-                    _ => return Err("secured-notice must be true or false".into()),
-                };
-            }
-            ("system-title-bar", _) => {
-                self.system_title_bar = match value {
-                    "true" => true,
-                    "false" => false,
-                    _ => return Err("system-title-bar must be true or false".into()),
-                };
-            }
-            ("flatten-fill-sign", _) => {
-                self.flatten_fill_sign_on_save = match value {
-                    "true" => true,
-                    "false" => false,
-                    _ => return Err("flatten-fill-sign must be true or false".into()),
-                };
-            }
-            ("comment", Some(v)) => {
-                // `--comment 2:4` selects the 4th annotation of page 2 (1-based, as comment_list reports).
-                let (p, i) = value.split_once(':').ok_or("comment: PAGE:INDEX")?;
-                let (p, i): (usize, usize) =
-                    (p.trim().parse().map_err(|_| "comment: PAGE:INDEX")?, i.trim().parse().map_err(|_| "comment: PAGE:INDEX")?);
-                v.comments.selected = Some((p.saturating_sub(1), i.saturating_sub(1)));
-                v.comments.reveal = true;
-            }
-            // `--combine-view list`: Combine files as thumbnails (grid) or as the table (list).
-            ("combine-view", _) => {
-                self.combine_view = combine_ui::CombineView::parse(value).ok_or("combine-view must be grid or list")?;
-            }
-            // `--combine-zoom 150`: the size of the cards in the Combine grid, in percent.
-            ("combine-zoom", _) => {
-                let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
-                if !percent.is_finite() || !combine_grid::ZOOM_RANGE.contains(&(percent / 100.0)) {
-                    let (lo, hi) = (combine_grid::ZOOM_RANGE.start(), combine_grid::ZOOM_RANGE.end());
-                    return Err(format!("combine-zoom must be between {} and {}", lo * 100.0, hi * 100.0));
-                }
-                self.set_combine_zoom(percent / 100.0);
-            }
-            (k, None)
-                if [
-                    "page",
-                    "zoom",
-                    "layout",
-                    "continuous",
-                    "page-gaps",
-                    "cover",
-                    "organize",
-                    "grid-zoom",
-                    "thumbnail-zoom",
-                    "fields",
-                    "find",
-                    "rotate",
-                    "select",
-                    "notice",
-                    "comment",
-                ]
-                .contains(&k) =>
-            {
-                return Err(format!("`{k}` needs an open document"));
-            }
-            (other, _) => return Err(format!("unknown option {other}")),
-        }
-        if key == "panel" && self.right.is_some() {
-            self.pending_panel_reveals.push(docking::Panel::Inspector);
-        }
-        if key == "left" && self.left_open {
-            self.pending_panel_reveals.push(docking::Panel::Tools);
-        }
-        Ok(())
-    }
-
-    fn shortcuts(&mut self, ctx: &egui::Context) {
-        use egui::Key;
-        let pasted = self.paste_key_released(ctx);
-        // "Save changes?" is modal: its keys are its own (⌘D is Don't save there, not Document
-        // properties; Escape cancels it rather than clearing a selection), and nothing may run
-        // underneath it. They are read here, before the canvas can consume them.
-        if self.close_request.is_some() {
-            // These dialogs are drawn after the save prompt and own the keyboard while open.
-            // Don't let Escape or Return resolve unsaved work underneath one.
-            let covered = self.pending_link.is_some()
-                || self.pending_remote_link.is_some()
-                || self.pending_full_screen.is_some()
-                || self.updates.open
-                || self.dialog.is_some()
-                || self.unlock_prompt.is_some();
-            if !covered && let Some(choice) = dialogs::save_prompt_key(ctx, &mut self.save_prompt_button) {
-                self.resolve_close(ctx, choice);
-            }
-            return;
-        }
-        // The other dialogs and prompts are modal too (⌘W closed the file behind Preferences,
-        // #870).
-        if self.modal_open() {
-            return;
-        }
-        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i))
-            && view.auto_scroll.escape(ctx)
-        {
-            return;
-        }
-        self.registry_shortcuts(ctx);
-        // (Esc closes a Combine file shown large first.)
-        if self.full_screen && self.combine_tab.preview.is_none() && ctx.input(|i| i.key_pressed(Key::Escape)) {
-            self.set_full_screen(ctx, false);
-        }
-        if let Some(i) = self.active {
-            // Select all belongs to the document or page grid, unless a text field or
-            // overlay owns the keyboard. Other canvas shortcuts keep their own handling.
-            if self.dialog.is_none()
-                && !self.palette_open
-                && !ctx.egui_wants_keyboard_input()
-                && ctx.input_mut(|input| input.consume_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, Key::A)))
-            {
-                if self.is_preparing() {
-                    if let Some(doc) = self.session.get(self.views[i].id) {
-                        prepare::select_all(&mut self.views[i], &doc.form);
-                    }
-                } else {
-                    self.views[i].select_all();
-                }
-            }
-            self.tool_keys(i, ctx);
-            if self.quick_tool == QuickTool::EditText
-                && let Some(doc) = self.session.get(self.views[i].id).filter(|d| d.allows_modification())
-            {
-                object_ui::nudge_keys(ctx, &mut self.views[i], doc);
-                object_ui::delete_keys(ctx, &mut self.views[i]);
-            } else if let Some(doc) = self.session.get(self.views[i].id).filter(|d| d.allows_annotation()) {
-                comments::nudge_keys(ctx, &mut self.views[i], &doc.info);
-            }
-            // A selected field moves with the arrows too (Prepare a form, #2608), before the view
-            // turns the page with them.
-            if self.is_preparing()
-                && let Some(doc) = self.session.get(self.views[i].id).filter(|d| d.allows_modification())
-            {
-                prepare::nudge_keys(ctx, &mut self.views[i], doc);
-            }
-            canvas::shortcuts(&mut self.views[i], ctx, self.scroll_speed);
-            self.copy_key(i, ctx);
-            self.paste_image_key(i, ctx, pasted);
-            self.image_pick_keys(i, ctx);
-        }
-    }
-}
-
-/// Why nothing can be copied out of the document: its security doesn't allow it (Table 22,
-/// bit 5; #568).
-pub(crate) fn copy_refused() -> &'static str {
-    tl!("The document's security settings don't allow copying text and images")
-}
-
-pub(crate) fn print_refused() -> &'static str {
-    tl!("The document's security settings don't allow printing")
-}
-
-impl PdfCraftApp {
-    /// Whether text and images may be copied out of document `id`; says why not when they may
-    /// not. Reading aloud and accessibility tools don't ask (assistive technology may read
-    /// anything, §7.6.4.2).
-    pub(crate) fn may_copy(&mut self, id: DocId) -> bool {
-        if self.session.get(id).is_none_or(pdfcraft_engine::Document::allows_copying) {
-            return true;
-        }
-        self.notify(copy_refused().to_string());
-        false
-    }
-
-    /// ⌘C copies the selected text, unless a text field has the keyboard (it copies its own).
-    fn copy_key(&mut self, i: usize, ctx: &egui::Context) {
-        // ⌘C arrives as a Copy event on most platforms.
-        let copy = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Copy)));
-        if !copy || ctx.egui_wants_keyboard_input() {
-            return;
-        }
-        self.copy_selected_text(i, ctx);
-    }
-
-    /// Shared permission gate for copying selected page text from menus and keyboard events.
-    /// After Select All of the document (#2639), pages whose text wasn't read for display are read
-    /// off the UI thread ([`DocumentCopy`]), and the clipboard gets the text when they're done.
-    pub(crate) fn copy_selected_text(&mut self, i: usize, ctx: &egui::Context) -> bool {
-        // A newer copy wins: a whole-document copy still reading must not replace it later.
-        self.document_copy = None;
-        let Some(v) = self.views.get(i) else { return false };
-        let id = v.id;
-        if v.all_text && !v.pages_without_text().is_empty() {
-            // Checked before any page is read: a document that refuses copying reads nothing.
-            if !self.may_copy(id) {
-                return false;
-            }
-            let Some(job) = self.views.get(i).and_then(|v| Some(DocumentCopyJob::of(v, self.session.get(id)?))) else { return false };
-            self.document_copy = Some(DocumentCopy::start(id, job, ctx));
-            return true;
-        }
-        let Some(text) = v.selected_text().filter(|text| !text.is_empty()) else { return false };
-        if !self.may_copy(id) {
-            return false;
-        }
-        ctx.copy_text(text);
-        true
-    }
-
-    /// The clipboard text of a whole-document copy, once its pages are read; dropped with the
-    /// document it was copied from, and by any later copy (a text field's, a comment's), which
-    /// it must not replace. Run at the end of the frame, so it sees this frame's copies.
-    fn finish_document_copy(&mut self, ctx: &egui::Context) {
-        let Some(c) = &self.document_copy else { return };
-        let copied = ctx.output(|o| o.commands.iter().any(|c| matches!(c, egui::OutputCommand::CopyText(_) | egui::OutputCommand::CopyImage(_))));
-        if copied || !self.views.iter().any(|v| v.id == c.doc) {
-            self.document_copy = None;
-            return;
-        }
-        match c.rx.try_recv() {
-            Ok(text) => {
-                self.document_copy = None;
-                if !text.is_empty() {
-                    ctx.copy_text(text);
-                }
-            }
-            Err(std::sync::mpsc::TryRecvError::Empty) => ctx.request_repaint_after(std::time::Duration::from_millis(50)),
-            Err(std::sync::mpsc::TryRecvError::Disconnected) => self.document_copy = None,
-        }
-    }
-
-    /// The quick tools' keys, as in Acrobat: V selects, H pans, and holding Space pans until it
-    /// is released. Plain letters, so not while a text field, a form field, a dialog or the
-    /// palette has the keyboard.
-    fn tool_keys(&mut self, i: usize, ctx: &egui::Context) {
-        use egui::Key;
-        let free = self.dialog.is_none() && !self.palette_open && !ctx.egui_wants_keyboard_input() && self.views[i].forms.focus.is_none();
-        let (plain, space) = ctx.input(|input| (input.modifiers.is_none(), input.key_down(Key::Space)));
-        if let Some(previous) = self.space_hand
-            && !space
-        {
-            self.space_hand = None;
-            if self.quick_tool == QuickTool::Hand {
-                self.quick_tool = previous;
-            }
-        }
-        if !free || !plain {
-            return;
-        }
-        if ctx.input(|input| input.key_pressed(Key::V)) {
-            self.quick_tool = QuickTool::Select;
-            self.space_hand = None;
-        }
-        if ctx.input(|input| input.key_pressed(Key::H)) {
-            self.quick_tool = QuickTool::Hand;
-            self.space_hand = None;
-        }
-        if space && self.space_hand.is_none() && self.quick_tool != QuickTool::Hand {
-            self.space_hand = Some(self.quick_tool);
-            self.quick_tool = QuickTool::Hand;
-        }
-    }
-}
-
-impl eframe::App for PdfCraftApp {
-    /// While files are dragged over the window the system sends no pointer moves, so egui
-    /// would keep the place the pointer entered at: tell it where the pointer really is, so the
-    /// page grid can show (and use) the gap under it.
-    fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
-        // The button's release a window move or resize kept from egui.
-        window_controls::release_after_desktop_grab(ctx, raw);
-        // Before egui reads this frame's wheel input.
-        self.scroll_speed.apply(ctx, raw);
-        if raw.hovered_files.is_empty() && raw.dropped_files.is_empty() {
-            return;
-        }
-        if let Some(pos) = drag_pointer::in_window(ctx) {
-            raw.events.push(egui::Event::PointerMoved(pos));
-        }
-        ctx.request_repaint();
-    }
-
-    fn save(&mut self, storage: &mut dyn eframe::Storage) {
-        // eframe has just stored the window as it is now: not while it is minimized.
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            let minimized = self.ctx.as_ref().is_some_and(|c| c.input(|i| i.viewport().minimized == Some(true)));
-            self.window_state.keep(storage, minimized);
-        }
-        storage.set_string("pdfcraft", self.persist());
-    }
-
-    /// Each frame's work before drawing: opens, operating-system and control-channel requests,
-    /// the quit guard, shortcuts, and the background jobs' results.
-    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        self.ctx = Some(ctx.clone());
-        #[cfg(not(target_arch = "wasm32"))]
-        self.window_state.repair(ctx);
-        self.dialog_epoch();
-        // Notices raised outside `ui` (opened files, OS events, the control channel) translate too.
-        let lang = i18n::Lang::from_pref(&self.language);
-        i18n::set_current(lang);
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            if let Some(worker) = &self.open_worker {
-                worker.set_context(ctx);
-            }
-            self.poll_pending_opens();
-        }
-        // Chinese wants its own faces before the Japanese ones (one baseline per line).
-        let cjk = theme::CjkPreference::for_language(lang.code());
-        if !self.styled {
-            egui_extras::install_image_loaders(ctx);
-            theme::install_fonts_for(ctx, cjk);
-            self.fonts_cjk = cjk;
-            theme::apply(ctx, self.theme);
-            self.styled = true;
-        } else {
-            self.fonts_ready = true;
-            if cjk != self.fonts_cjk {
-                // Same family names as before, so named fonts stay valid while the new set loads.
-                theme::install_fonts_for(ctx, cjk);
-                self.fonts_cjk = cjk;
-            }
-        }
-        self.sync_theme(ctx);
-        let native = ctx.native_pixels_per_point().unwrap_or(1.0);
-        ui_scale::sync(ctx, ui_scale::zoom(self.ui_scale, self.system_text_scale, native), &mut self.ui_scale_applied);
-        // Remember user work even if its tab is subsequently closed or Home is selected.
-        self.startup_superseded |= !self.views.is_empty() || self.combine_showing() || self.dialog.is_some() || self.password_prompt.is_some();
-        // Also done in `raw_input_hook`, before input; here for hosts that don't call the hook.
-        self.scroll_speed.set_line_speed(ctx);
-        // Before anything reads this frame's wheel input or draws, and with the line speed just set.
-        self.motion.begin_pass(ctx, self.animation_effects);
-        // Before taking this frame's drop: the grid must be drawn once with the pointer where
-        // the files were let go before the gap is read.
-        self.finish_grid_drop(ctx);
-        // Showing a document hides the Combine files tab.
-        if self.active.is_some() {
-            self.combine_tab.focused = false;
-        }
-        #[cfg(target_arch = "wasm32")]
-        self.process_signature_images();
-        let dropped = ctx.input(|i| i.raw.dropped_files.clone());
-        #[cfg(not(target_arch = "wasm32"))]
-        let dropped = self.drop_on_signature_pad(dropped);
-        #[cfg(not(target_arch = "wasm32"))]
-        let dropped = self.drop_on_grid(dropped, ctx);
-        for f in dropped {
-            // Files dropped on the Combine files tab join its list instead of opening.
-            if self.combine_showing() {
-                self.drop_into_combine(f, ctx);
-            } else {
-                self.open_dropped(f, ctx);
-            }
-        }
-        let arrived: Vec<(String, Vec<u8>)> = self.inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
-        for (name, bytes) in arrived {
-            if let Err(e) = self.open_bytes(&name, None, bytes) {
-                self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
-            }
-        }
-        // Don't replace a pending prompt or import. A startup file may need its own password
-        // prompt, so its bytes stay queued until the current interaction finishes.
-        #[cfg(not(target_arch = "wasm32"))]
-        let opening = !self.pending_opens.is_empty();
-        #[cfg(target_arch = "wasm32")]
-        let opening = false;
-        if !opening
-            && self.password_prompt.is_none()
-            && self.image_import.is_none()
-            && self.dialog.is_none()
-            && self.close_request.is_none()
-            && self.pending_link.is_none()
-            && self.pending_remote_link.is_none()
-        {
-            let startup = self.startup_inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
-            for (name, bytes) in startup {
-                let activate = !self.startup_superseded;
-                if let Err(e) = self.open_bytes_with_focus(&name, None, bytes, activate) {
-                    self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e)]);
-                }
-            }
-        }
-        let failed: Vec<(String, String)> = self.failed_inbox.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
-        for (name, e) in failed {
-            self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e)]);
-        }
-        let os_events = self.os_events.as_mut().map(|poll| poll()).unwrap_or_default();
-        for e in os_events {
-            match e {
-                #[cfg(not(target_arch = "wasm32"))]
-                OsEvent::Open(paths) => {
-                    paths.iter().for_each(|p| {
-                        self.open_path(p);
-                    });
-                    // Files handed to the running app (Finder, or another launch): bring its
-                    // window to the front, also when minimized or full screen on another Space.
-                    ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(false));
-                    ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
-                }
-                #[cfg(target_arch = "wasm32")]
-                OsEvent::Open(_) => {}
-                // Like closing the window: `guard_quit` asks about unsaved changes.
-                OsEvent::Quit => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
-            }
-        }
-        if let Some((_, id)) = self.active_ids() {
-            let out = self.session.take_js_output(id);
-            self.handle_js(id, out);
-        }
-        if let Some(mut control) = self.control.take() {
-            control.tick(ctx, self);
-            self.control = Some(control);
-        }
-        self.guard_quit(ctx);
-        // macOS: quit through `terminate:` instead of dropping the window (Touch Bar crash, #1136).
-        craft_quit::on_close_request(ctx);
-        let now = ctx.input(|i| i.time);
-        self.autosave_tick(ctx, now);
-        // Reload documents whose files a build rewrote (#431).
-        #[cfg(not(target_arch = "wasm32"))]
-        self.watch_files();
-        if self.host_dirty.is_some() {
-            let dirty = self.first_dirty().is_some();
-            if let Some(report) = self.host_dirty.as_mut() {
-                report(dirty);
-            }
-        }
-        self.poll_updates();
-        self.poll_print();
-        // Shortcuts deferred last frame: the text field has taken that frame's typing since.
-        let deferred = std::mem::take(&mut self.deferred_commands);
-        self.shortcuts(ctx);
-        // Scrolling and group-drag previews are transient: never resume after changing tabs,
-        // opening a modal/palette, or returning to a window that lost focus.
-        let blocked = self.modal_open() || self.palette_open || !ctx.input(|i| i.focused);
-        for (index, view) in self.views.iter_mut().enumerate() {
-            view.objects.set_input_blocked(blocked || self.active != Some(index));
-            if blocked || self.active != Some(index) {
-                view.auto_scroll.cancel();
-            }
-        }
-        // A field that refused its value this frame keeps the shortcut from saving or printing
-        // behind the user's back; so does a save prompt opened since.
-        if self.process_pending_edits() && self.close_request.is_none() {
-            for (id, doc) in deferred {
-                // Only in the document the shortcut was pressed in.
-                if self.active_ids().map(|(_, active)| active) == doc {
-                    self.execute(id);
-                }
-            }
-        }
-        self.poll_export();
-        self.auto_ocr_scanned_page();
-        self.poll_ocr();
-        self.poll_optimize();
-        self.poll_action();
-        self.process_file_requests();
-        #[cfg(not(target_arch = "wasm32"))]
-        self.process_picked();
-        // Last, after everything that can open or answer the "save changes?" question.
-        self.attend_save_prompt(ctx);
-    }
-
-    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        let ctx = ui.ctx().clone();
-        i18n::set_current(i18n::Lang::from_pref(&self.language));
-        // Fonts registered via set_fonts only take effect next frame; named families would panic now.
-        if !self.fonts_ready {
-            ctx.request_repaint();
-            return;
-        }
-        for view in &mut self.views {
-            view.begin_render_frame();
-        }
-        // The window shows the active document's name (or title, if it asks for that).
-        let title = self
-            .active
-            .and_then(|i| crate::canvas::tab_label(self, i))
-            .or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
-            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name} — PdfCraft"));
-        if title != self.window_title {
-            ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
-            self.window_title = title;
-        }
-        if self.full_screen && self.active.is_some() {
-            // Full screen: the page on black, nothing else, as Acrobat's Full Screen Mode (Esc
-            // or ⌘L to leave).
-            egui::CentralPanel::default().frame(egui::Frame::NONE.fill(egui::Color32::BLACK)).show(ui, |ui| {
-                if let Some(i) = self.active {
-                    match compare_ui::side_by_side(self, i) {
-                        Some((old, new)) => compare_ui::compare_area(self, old, new, ui),
-                        None => canvas::document_area(self, i, ui),
-                    }
-                }
-            });
-            dialogs::show(self, &ctx);
-            // Notices too: a refused field value or a failed save must be seen in full screen.
-            self.show_progress(&ctx);
-            widgets::toast(self, &ctx);
-            self.finish_render_frame(&ctx);
-            return;
-        }
-        self.sync_window_frame(&ctx);
-        if self.draws_window_frame() {
-            window_controls::resize_edges(&ctx);
-        }
-        chrome::tab_strip(self, ui);
-        chrome::mode_bar(self, ui);
-        if self.active.is_some() {
-            chrome::right_rail(self, ui);
-            // Read mode hides the tools, not the navigation panes: the rail stays visible
-            // there, so its buttons (Bookmarks, Page thumbnails, ...) must open their panels.
-            // Outside Read mode the docking workspace draws the inspector.
-            if self.mode == Mode::Read && self.right.is_some() {
-                egui::Panel::right("read_right_panel")
-                    .resizable(true)
-                    .default_size(330.0)
-                    .size_range(260.0..=520.0)
-                    .frame(egui::Frame::NONE)
-                    .show(ui, |ui| panels::right_panel(self, ui));
-            }
-        }
-        let t = theme::Tokens::get(&ctx);
-        egui::CentralPanel::default().frame(egui::Frame::NONE.fill(t.pasteboard)).show(ui, |ui| {
-            if self.mode == Mode::Read {
-                match self.active {
-                    None if self.combine_showing() => combine_ui::page(self, ui),
-                    None => home::show(self, ui),
-                    Some(index) => match compare_ui::side_by_side(self, index) {
-                        Some((old, new)) => compare_ui::compare_area(self, old, new, ui),
-                        None => canvas::document_area(self, index, ui),
-                    },
-                }
-            } else {
-                docking::show(self, ui);
-            }
-        });
-        self.process_pending_edits();
-        palette::show(self, &ctx);
-        dialogs::show(self, &ctx);
-        self.show_progress(&ctx);
-        widgets::toast(self, &ctx);
-        self.finish_render_frame(&ctx);
-    }
-}
-
-impl PdfCraftApp {
-    fn finish_render_frame(&mut self, ctx: &egui::Context) {
-        self.finish_document_copy(ctx);
-        // The Combine grid's thumbnails, whichever tab shows (renders under way still finish).
-        self.combine_thumbs_frame(ctx);
-        // Retire hidden documents before admitting the visible document's textures, so the
-        // three cache limits apply to the application, regardless of how many tabs are open.
-        // Side by side: the comparison's old file renders alongside the active one.
-        let partner = self.active.and_then(|i| compare_ui::side_by_side(self, i)).map(|(old, _)| old);
-        for (i, view) in self.views.iter_mut().enumerate() {
-            if Some(i) != self.active
-                && Some(i) != partner
-                && let Some(doc) = self.session.get(view.id)
-            {
-                view.suspend_rendering(&doc.renderer);
-            }
-        }
-        for i in self.active.into_iter().chain(partner) {
-            if let Some(view) = self.views.get_mut(i)
-                && let Some(doc) = self.session.get(view.id)
-            {
-                view.finish_render_frame(ctx, &doc.info, &doc.renderer);
-            }
-        }
-    }
-}
diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
new file mode 100644
index 0000000000..d7c8bef1cd
--- /dev/null
+++ b/crates/ui-egui/src/menus.rs
@@ -0,0 +1,793 @@
+//! The menus: one definition ([`PdfCraftApp::menu_bar`]) for the native macOS menu bar and the
+//! in-window bar on Windows, Linux and the web, laid out for each platform by craft-menu.
+//!
+//! Items run registry commands (`pdfcraft_engine::commands`) by id, with the registry's label and
+//! shortcut, so a menu click and its shortcut run the same command. A few items have menu-only
+//! ids: the zoom keys the document view handles itself, the side panel choices, the clipboard
+//! keys, the recent files and the open documents. [`PdfCraftApp::run_menu_command`] runs every
+//! one of them, once per click, whichever bar it came from.
+
+use craft_keymap::{Key, Mods};
+use craft_menu::{
+    Builtin, Chord, CommandRef, Document, Gate, Item, ItemRole, ItemState, Labeled, LayoutOptions, Menu, MenuBar, MenuRole, Node, Target,
+};
+use pdfcraft_engine::catalog::{Availability, TOOL_GROUPS};
+use pdfcraft_engine::commands::{self, Shortcut};
+
+use crate::canvas::{Fit, PageLayout};
+use crate::theme::ThemePreference;
+use crate::{PdfCraftApp, RightPanel};
+
+pub(super) mod tab_context;
+
+/// The app's name in the menus the layouts write (About, Hide, Quit).
+pub(crate) const APP_NAME: &str = "PdfCraft";
+
+/// The top bar's width after the menus: the mode tabs, the search box and the buttons.
+const ROW_AFTER_MENUS: f32 = 720.0;
+/// The narrowest the menu bar gets: one "Menu" title.
+const MIN_MENUS_WIDTH: f32 = 80.0;
+
+/// Menu-only commands. The registry's commands keep their own ids.
+pub(crate) const CUT: &str = "edit.cut";
+pub(crate) const PASTE: &str = "edit.paste";
+pub(crate) const DELETE: &str = "edit.delete";
+pub(crate) const SELECT_ALL: &str = "edit.select_all";
+pub(crate) const NO_RECENT: &str = "file.no_recent";
+/// An open document in the Window menu, `{"index": n}` in the tab strip.
+pub(crate) const DOCUMENT: &str = "window.document";
+/// A side panel, `{"panel": name}` ([`PANELS`]).
+pub(crate) const PANEL: &str = "view.panel";
+const ACTUAL_SIZE: &str = "view.zoom.actual_size";
+const PAGE_LEVEL: &str = "view.zoom.page_level";
+const FIT_WIDTH: &str = "view.zoom.fit_width";
+const FIT_HEIGHT: &str = "view.zoom.fit_height";
+const ZOOM_IN: &str = "view.zoom.in";
+const ZOOM_OUT: &str = "view.zoom.out";
+const ROTATE_CW: &str = "view.rotate.cw";
+const ROTATE_CCW: &str = "view.rotate.ccw";
+
+/// The menu-only items: id, English label and the shortcut shown (the keys stay with the view).
+const EXTRA: &[(&str, &str, Option<Shortcut>)] = &[
+    (CUT, "Cut", Some(Shortcut::cmd("X"))),
+    (PASTE, "Paste", Some(Shortcut::cmd("V"))),
+    (DELETE, "Delete", Some(Shortcut { command: false, shift: false, mac_ctrl: false, key: "Delete" })),
+    (SELECT_ALL, "Select all", Some(crate::commands::SELECT_ALL)),
+    (NO_RECENT, "No recent files", None),
+    (ACTUAL_SIZE, "Actual size", Some(crate::commands::ACTUAL_SIZE)),
+    (PAGE_LEVEL, "Zoom to page level", Some(crate::commands::PAGE_LEVEL)),
+    (FIT_WIDTH, "Fit to width", Some(crate::commands::FIT_WIDTH)),
+    (FIT_HEIGHT, "Fit to height", None),
+    (ZOOM_IN, "Zoom in", Some(crate::commands::ZOOM_IN)),
+    (ZOOM_OUT, "Zoom out", Some(crate::commands::ZOOM_OUT)),
+    (ROTATE_CW, "Rotate view clockwise", Some(crate::commands::ROTATE_CW)),
+    (ROTATE_CCW, "Rotate view counterclockwise", Some(crate::commands::ROTATE_CCW)),
+];
+
+/// View ▸ Side panels: the panel, its id in [`PANEL`] commands and its English label.
+const PANELS: &[(RightPanel, &str, &str)] = &[
+    (RightPanel::Comments, "comments", "Comments"),
+    (RightPanel::Bookmarks, "bookmarks", "Bookmarks"),
+    (RightPanel::Pages, "pages", "Pages"),
+    (RightPanel::Fields, "fields", "Fields"),
+    (RightPanel::Layers, "layers", "Layers"),
+    (RightPanel::Attachments, "attachments", "Attachments"),
+    (RightPanel::Signatures, "signatures", "Signatures"),
+    (RightPanel::Accessibility, "accessibility", "Accessibility Checker"),
+    (RightPanel::Tags, "tags", "Tags"),
+    (RightPanel::Search, "search", "Search"),
+    (RightPanel::Compare, "compare", "Compare"),
+];
+
+/// The English titles of the menus and submenus, for the bar's mnemonics in languages whose
+/// labels have no ASCII letter.
+const TITLES: &[&str] = &[
+    "File",
+    "Edit",
+    "View",
+    "Pages",
+    "Sign",
+    "Window",
+    "Help",
+    "Open Recent",
+    "Create",
+    "Export",
+    "Protect",
+    "Zoom",
+    "Rotate view",
+    "Page navigation",
+    "Page display",
+    "Side panels",
+    "Display theme",
+    "Tools",
+    "Fill & Sign",
+];
+
+/// Separator.
+const SEP: &str = "---";
+
+const FILE: &[&str] = &[
+    "create.blank",
+    "file.open",
+    "file.open_recent",
+    "file.pin_folder",
+    SEP,
+    "page.combine",
+    SEP,
+    "file.save",
+    "file.save_as",
+    "file.revert",
+    SEP,
+    "file.close",
+    "file.close_all",
+    SEP,
+    "optimize.reduce",
+    "optimize.advanced",
+    SEP,
+    "file.properties",
+    "file.word_count",
+    SEP,
+    "print.dialog",
+];
+const CREATE: &[&str] = &["create.file", "create.multiple", "create.multiple_separate", "create.images", "create.clipboard"];
+const EXPORT: &[&str] = &["export.docx", "export.pptx", "export.rtf", "export.html", "export.text", SEP, "export.image", "export.all_images"];
+const PROTECT: &[&str] = &["protect.password", "protect.remove", "protect.unlock", SEP, "protect.properties"];
+const EDIT: &[&str] = &[
+    "edit.undo",
+    "edit.redo",
+    SEP,
+    CUT,
+    "edit.copy",
+    PASTE,
+    DELETE,
+    SEP,
+    SELECT_ALL,
+    SEP,
+    "edit.find",
+    "edit.advanced_search",
+    SEP,
+    "edit.column_select",
+    "edit.snapshot",
+    SEP,
+    "edit.attach",
+    "form.clear",
+    SEP,
+    "app.preferences",
+];
+const ZOOM: &[&str] = &[ACTUAL_SIZE, PAGE_LEVEL, FIT_WIDTH, FIT_HEIGHT, "view.fit_visible", SEP, ZOOM_IN, ZOOM_OUT, SEP, "view.marquee_zoom"];
+const NAVIGATION: &[&str] = &["view.focus_page_input", SEP, "view.previous_view", "view.next_view"];
+const DISPLAY: &[&str] = &[
+    "view.layout.single",
+    "view.layout.two_up",
+    SEP,
+    "view.continuous",
+    "view.page_gaps",
+    "view.layout.cover",
+    SEP,
+    "view.fit_width_scrolling",
+    "view.fit_one_page",
+];
+const THEMES: &[&str] = &["view.theme.system", "view.theme.light", "view.theme.dark"];
+const PANES: &[&str] = &["view.side_panel", "view.tools_pane"];
+const PANE_COMMANDS: &[&str] = &["comment.list", "form.fields", "ui.dock.reset"];
+const MODES: &[&str] = &["view.full_screen", "view.read_mode"];
+const PAGES: &[&str] = &[
+    "page.organize",
+    SEP,
+    "page.insert_blank",
+    "page.insert",
+    "page.replace",
+    "page.extract",
+    "page.split",
+    "page.duplicate",
+    "page.delete",
+    SEP,
+    "page.rotate",
+    "page.rotate_ccw",
+    "page.rotate_dialog",
+    "page.reverse",
+    SEP,
+    "page.crop",
+    "page.boxes",
+    "page.number",
+    SEP,
+    "bookmark.add",
+    "bookmark.from_structure",
+];
+/// Sign ▸ Fill & Sign, with the short labels of the Fill & Sign toolbar.
+const FILL: &[(&str, &str)] = &[
+    ("sign.fill.text", "Add text"),
+    ("sign.fill.check", "Checkmark"),
+    ("sign.fill.cross", "Cross"),
+    ("sign.fill.dot", "Dot"),
+    ("sign.fill.line", "Line"),
+    ("sign.fill.date", "Date"),
+    ("sign.fill.signature", "Signature"),
+    ("sign.fill.initials", "Initials"),
+];
+const SIGN: &[&str] = &[
+    SEP,
+    "sign.fill.signature.change",
+    "sign.fill.initials.change",
+    "sign.fill.signature.remove",
+    "sign.fill.initials.remove",
+    SEP,
+    "sign.digital",
+    "sign.certify",
+    "sign.certify_invisible",
+    "form.add.signature",
+    SEP,
+    "sign.validate",
+    "sign.panel",
+];
+const WINDOW: &[&str] = &["view.next_tab", "view.previous_tab"];
+const HELP: &[&str] =
+    &["help.shortcuts", SEP, "help.app_page", "help.github", "help.website", "help.discord", SEP, "help.check_updates", SEP, "help.about"];
+
+/// A registry shortcut as a craft-keymap chord: `command` is ⌘ (Ctrl elsewhere) and `mac_ctrl`
+/// the Control key on macOS. `None` for a key craft-keymap doesn't name.
+pub(crate) fn chord(s: Shortcut) -> Option<Chord> {
+    let key = Key::parse(s.key)?;
+    Some(Chord::new(Mods { cmd: s.command, ctrl: s.mac_ctrl, alt: false, shift: s.shift }, key))
+}
+
+fn extra(id: &str) -> Option<&'static (&'static str, &'static str, Option<Shortcut>)> {
+    EXTRA.iter().find(|(e, ..)| *e == id)
+}
+
+/// The English label of an item's command, for the bar's mnemonics.
+fn english_label(command: &CommandRef) -> Option<String> {
+    if let Some(spec) = commands::command(&command.id) {
+        return Some(spec.label.to_owned());
+    }
+    if let Some((_, label, _)) = extra(&command.id) {
+        return Some((*label).to_owned());
+    }
+    FILL.iter().find(|(id, _)| *id == command.id).map(|(_, label)| (*label).to_owned())
+}
+
+fn english(labeled: Labeled<'_>) -> Option<String> {
+    match labeled {
+        Labeled::Command(command) => english_label(command),
+        Labeled::Title(shown) => TITLES.iter().find(|t| tl!(t) == shown).map(|t| (*t).to_owned()),
+    }
+}
+
+fn translate(english: &'static str) -> String {
+    tl!(english).to_owned()
+}
+
+/// The layouts' own labels (About, Quit, Window…) through the app's translations.
+pub(crate) fn layout_options() -> LayoutOptions<'static> {
+    LayoutOptions { label: &translate, ..LayoutOptions::new(APP_NAME) }
+}
+
+impl PdfCraftApp {
+    /// The app's menus for this frame, before the platform layout: every item's label, shortcut,
+    /// enabled and checked state as the app is now. A modal dialog doesn't grey anything here;
+    /// that is the [`Gate`]'s job ([`PdfCraftApp::menu_gate`]).
+    pub fn menu_bar(&self, ctx: &egui::Context) -> MenuBar {
+        let mut used: Vec<&str> = Vec::new();
+        let list = |ids: &[&'static str], used: &mut Vec<&'static str>| -> Vec<Node> {
+            ids.iter()
+                .map(|&id| {
+                    if id == SEP {
+                        return Node::Separator;
+                    }
+                    used.push(id);
+                    self.menu_item(id, None)
+                })
+                .collect()
+        };
+        let file = {
+            let mut nodes = Vec::new();
+            for node in list(FILE, &mut used) {
+                // Open Recent is the live recent list; Create, Export and Protect follow Combine,
+                // Optimize and Close.
+                let recent = matches!(&node, Node::Item(it) if it.command.id == "file.open_recent");
+                if recent {
+                    nodes.push(self.recent_menu());
+                    continue;
+                }
+                let after = match &node {
+                    Node::Item(it) => it.command.id.clone(),
+                    _ => String::new(),
+                };
+                nodes.push(node);
+                match after.as_str() {
+                    "page.combine" => nodes.push(Node::submenu(tl!("Create"), list(CREATE, &mut used))),
+                    "optimize.advanced" => {
+                        nodes.push(Node::submenu(tl!("Export"), list(EXPORT, &mut used)));
+                        nodes.push(Node::Separator);
+                        nodes.push(Node::submenu(tl!("Protect"), list(PROTECT, &mut used)));
+                    }
+                    _ => {}
+                }
+            }
+            nodes
+        };
+        // Edit ▸ Pages follows Select All.
+        let mut edit = Vec::new();
+        for node in list(EDIT, &mut used) {
+            let select_all = matches!(&node, Node::Item(it) if it.command.id == SELECT_ALL);
+            edit.push(node);
+            if select_all {
+                edit.push(Node::submenu(tl!("Pages"), list(PAGES, &mut used)));
+            }
+        }
+        let mut sign = vec![Node::submenu(
+            tl!("Fill & Sign"),
+            FILL.iter()
+                .map(|&(id, label)| {
+                    used.push(id);
+                    self.menu_item(id, Some(tl!(label)))
+                })
+                .collect(),
+        )];
+        sign.extend(list(SIGN, &mut used));
+        let window = list(WINDOW, &mut used);
+        let help = list(HELP, &mut used);
+        let mut view = vec![
+            Node::submenu(tl!("Zoom"), list(ZOOM, &mut used)),
+            Node::submenu(tl!("Rotate view"), list(&[ROTATE_CW, ROTATE_CCW], &mut used)),
+            Node::submenu(tl!("Page navigation"), list(NAVIGATION, &mut used)),
+            Node::submenu(tl!("Page display"), list(DISPLAY, &mut used)),
+            Node::Separator,
+        ];
+        view.extend(list(PANES, &mut used));
+        view.push(Node::submenu(
+            tl!("Side panels"),
+            PANELS
+                .iter()
+                .map(|(_, name, label)| {
+                    Item::new(CommandRef::with_params(PANEL, serde_json::json!({ "panel": name })), tl!(label)).radio(false).into()
+                })
+                .collect(),
+        ));
+        view.extend(list(PANE_COMMANDS, &mut used));
+        view.push(Node::Separator);
+        view.extend(list(MODES, &mut used));
+        view.push(Node::submenu(tl!("Display theme"), list(THEMES, &mut used)));
+        view.push(Node::Separator);
+        view.push(Node::submenu(tl!("Tools"), self.tools_menu(&used)));
+        view.extend(list(&["view.palette"], &mut used));
+        let mut bar = MenuBar {
+            menus: vec![
+                Menu::new(tl!("File"), craft_menu::tidy(file)).role(MenuRole::File),
+                Menu::new(tl!("Edit"), craft_menu::tidy(edit)).role(MenuRole::Edit),
+                Menu::new(tl!("View"), craft_menu::tidy(view)).role(MenuRole::View),
+                Menu::new(tl!("Sign"), craft_menu::tidy(sign)),
+                Menu::new(tl!("Window"), window).role(MenuRole::Window),
+                Menu::new(tl!("Help"), craft_menu::tidy(help)).role(MenuRole::Help),
+            ],
+            documents: self.menu_documents(),
+        };
+        bar.tag_item(&CommandRef::new("help.about"), ItemRole::About);
+        bar.tag_item(&CommandRef::new("app.preferences"), ItemRole::Settings);
+        craft_menu::apply_state(&mut bar, |command| self.menu_state(ctx, command));
+        bar
+    }
+
+    /// One item: a registry command with its live label (Undo names the edit) and shortcut, or a
+    /// menu-only one. Radio and check items get their kind here, their state from
+    /// [`PdfCraftApp::menu_state`].
+    fn menu_item(&self, id: &'static str, label: Option<&str>) -> Node {
+        let (english, shortcut) = match commands::command(id) {
+            Some(spec) => {
+                let current = commands::current_label(spec, &self.session, self.active_ids().map(|(_, doc)| doc));
+                (crate::i18n::menu_label(id, &current), spec.shortcut.or((id == "edit.copy").then_some(crate::commands::COPY)))
+            }
+            None => match extra(id) {
+                Some((_, label, shortcut)) => (tl!(label).to_owned(), *shortcut),
+                None => (id.to_owned(), None),
+            },
+        };
+        let mut item = Item::new(id, label.map_or(english, str::to_owned));
+        if let Some(c) = shortcut.and_then(chord) {
+            item = item.shortcut(c);
+        }
+        if matches!(id, "view.layout.single" | "view.layout.two_up") || THEMES.contains(&id) {
+            item = item.radio(false);
+        }
+        item.into()
+    }
+
+    /// File ▸ Open Recent: the recent files, newest first, then Clear Recent Files.
+    fn recent_menu(&self) -> Node {
+        let mut items: Vec<Node> = self
+            .recent
+            .iter()
+            .enumerate()
+            .map(|(index, r)| Item::new(CommandRef::with_params("file.open_recent", serde_json::json!({ "index": index })), r.name.clone()).into())
+            .collect();
+        if items.is_empty() {
+            items.push(self.menu_item(NO_RECENT, None));
+        } else {
+            items.push(Node::Separator);
+            items.push(self.menu_item("file.clear_recent", Some(tl!("Clear Recent Files"))));
+        }
+        let label = commands::command("file.open_recent").map_or("Open Recent", |c| c.label);
+        Node::submenu(crate::i18n::menu_label("file.open_recent", label), items)
+    }
+
+    /// View ▸ Tools: the All tools groups, each a submenu of its ready tools that no other menu
+    /// lists, sections apart.
+    fn tools_menu(&self, used: &[&str]) -> Vec<Node> {
+        TOOL_GROUPS
+            .iter()
+            .filter(|g| g.availability == Availability::Ready)
+            .map(|group| {
+                let mut nodes = Vec::new();
+                let mut seen: Vec<&str> = Vec::new();
+                for section in group.sections {
+                    nodes.push(Node::Separator);
+                    for tool in section.items.iter().filter(|t| t.availability == Availability::Ready) {
+                        let actions: &[&'static str] = if tool.actions.is_empty() { std::slice::from_ref(&tool.command) } else { tool.actions };
+                        for &id in actions {
+                            if commands::command(id).is_none() || used.contains(&id) || seen.contains(&id) {
+                                continue;
+                            }
+                            seen.push(id);
+                            let label = if tool.actions.is_empty() { Some(tl!(tool.label)) } else { None };
+                            nodes.push(self.menu_item(id, label));
+                        }
+                    }
+                }
+                Node::submenu(tl!(group.label), nodes)
+            })
+            .collect()
+    }
+
+    /// The open documents, in tab order, for the Window menu.
+    fn menu_documents(&self) -> Vec<Document> {
+        (0..self.views.len())
+            .filter_map(|index| {
+                let name = crate::canvas::tab_label(self, index)?;
+                Some(Document::new(CommandRef::with_params(DOCUMENT, serde_json::json!({ "index": index })), name).active(self.active == Some(index)))
+            })
+            .collect()
+    }
+
+    /// What may run from the menus now: a dialog, a prompt or the command palette holds the
+    /// window. Edit's text items stay with a focused text field (craft-menu's gate).
+    pub fn menu_gate(&self, ctx: &egui::Context) -> Gate {
+        Gate { modal: self.modal_open() || self.palette_open, recording_shortcut: false, text_editing: ctx.text_edit_focused() }
+    }
+
+    /// Whether a menu item's command can run now, and its checked or selected state.
+    pub fn menu_state(&self, ctx: &egui::Context, command: &CommandRef) -> ItemState {
+        let view = self.active.and_then(|i| self.views.get(i));
+        let organize = view.is_some_and(|v| v.organize);
+        let has_doc = view.is_some();
+        let enabled_id = |id: &str| commands::command(id).is_some_and(|s| self.command_enabled(s));
+        let index = param_index(command);
+        let text = ctx.text_edit_focused() && matches!(command.id.as_str(), "edit.undo" | "edit.redo" | "edit.copy" | CUT | PASTE | SELECT_ALL);
+        let enabled = text
+            || match command.id.as_str() {
+                NO_RECENT => false,
+                "file.open_recent" => index.is_none_or(|i| i < self.recent.len()),
+                "file.clear_recent" => !self.recent.is_empty(),
+                DOCUMENT => index.is_some_and(|i| i < self.views.len()),
+                // macOS ⌘W closes the window when no document is open (#869).
+                "file.close" if !has_doc && crate::commands::mac_shortcuts(ctx) && !cfg!(target_arch = "wasm32") => true,
+                "edit.copy" if organize => enabled_id("page.copy"),
+                "edit.copy" if view.is_some_and(|v| v.picked_image.is_some()) => {
+                    self.active_ids().and_then(|(_, id)| self.session.get(id)).is_some_and(|d| d.allows_copying())
+                }
+                CUT => organize && enabled_id("page.cut"),
+                PASTE => organize && self.page_clipboard.is_some() && enabled_id("page.paste"),
+                SELECT_ALL | DELETE => has_doc,
+                ACTUAL_SIZE | PAGE_LEVEL | FIT_WIDTH | FIT_HEIGHT | ZOOM_IN | ZOOM_OUT | ROTATE_CW | ROTATE_CCW => has_doc,
+                PANEL => panel(command).is_some(),
+                id => enabled_id(id),
+            };
+        let checked = match command.id.as_str() {
+            "view.layout.single" => Some(view.is_some_and(|v| v.layout == PageLayout::Single)),
+            "view.layout.two_up" => Some(view.is_some_and(|v| v.layout == PageLayout::TwoUp)),
+            "view.continuous" => Some(view.is_some_and(|v| v.continuous())),
+            "view.page_gaps" => Some(view.is_some_and(|v| v.show_page_gaps)),
+            "view.layout.cover" => Some(view.is_some_and(|v| v.cover)),
+            "view.full_screen" => Some(self.full_screen),
+            "view.read_mode" => Some(self.mode == crate::Mode::Read),
+            "view.side_panel" => Some(self.right.is_some()),
+            "view.tools_pane" => Some(self.left_open),
+            "view.theme.system" => Some(self.theme_preference == ThemePreference::System),
+            "view.theme.light" => Some(self.theme_preference == ThemePreference::Light),
+            "view.theme.dark" => Some(self.theme_preference == ThemePreference::Dark),
+            PANEL => Some(panel(command).is_some_and(|p| self.right == Some(p))),
+            _ => None,
+        };
+        ItemState { enabled, checked }
+    }
+
+    /// Run a command chosen in either menu bar. Registry commands go through
+    /// [`PdfCraftApp::dispatch_command`], as their shortcuts do; the clipboard items act as
+    /// their keys would (⌘C is a Copy event, Delete a key press), so every place that handles the
+    /// key handles the click. A command that can't run now (a dialog opened since the menu was
+    /// drawn) does nothing.
+    pub fn run_menu_command(&mut self, ctx: &egui::Context, command: &CommandRef) {
+        // Both menu bars run Quit and Minimize themselves; Hide and Hide Others are AppKit's.
+        if Builtin::of(command).is_some() {
+            return;
+        }
+        if !self.menu_gate(ctx).allows_command(command) || !self.menu_state(ctx, command).enabled {
+            return;
+        }
+        let index = param_index(command);
+        let key = |key: egui::Key, modifiers: egui::Modifiers| {
+            [true, false].map(|pressed| egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers })
+        };
+        match command.id.as_str() {
+            "file.open_recent" if index.is_some() => {
+                if let Some(path) = index.and_then(|i| self.recent.get(i)).map(|r| r.path.clone()) {
+                    self.open_recent(&path);
+                }
+            }
+            DOCUMENT => {
+                if let Some(i) = index.filter(|&i| i < self.views.len()) {
+                    self.active = Some(i);
+                }
+            }
+            "edit.copy" => self.menu_input.push(egui::Event::Copy),
+            CUT => self.menu_input.push(egui::Event::Cut),
+            PASTE => ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaste),
+            SELECT_ALL => self.menu_input.extend(key(egui::Key::A, egui::Modifiers::COMMAND)),
+            DELETE => self.menu_input.extend(key(egui::Key::Delete, egui::Modifiers::NONE)),
+            PANEL => self.choose_right_panel(panel(command)),
+            ACTUAL_SIZE | PAGE_LEVEL | FIT_WIDTH | FIT_HEIGHT | ZOOM_IN | ZOOM_OUT | ROTATE_CW | ROTATE_CCW => {
+                let Some(v) = self.active.and_then(|i| self.views.get_mut(i)) else { return };
+                match command.id.as_str() {
+                    ACTUAL_SIZE => v.set_zoom(1.0),
+                    PAGE_LEVEL => v.fit = Fit::Page,
+                    FIT_WIDTH => v.fit = Fit::Width,
+                    FIT_HEIGHT => {
+                        v.fit = Fit::Height;
+                        v.goto = Some((v.current, 0.0));
+                    }
+                    ZOOM_IN => v.zoom_step(true),
+                    ZOOM_OUT => v.zoom_step(false),
+                    ROTATE_CW => v.rotate_view(true),
+                    _ => v.rotate_view(false),
+                }
+            }
+            id => {
+                if let Some(spec) = commands::command(id) {
+                    self.dispatch_command(ctx, spec.id);
+                }
+            }
+        }
+        ctx.request_repaint();
+    }
+
+    /// The menu bar drawn in the window (Windows, Linux, the web, and macOS when the native one
+    /// couldn't be installed), where the top bar starts. Runs the commands chosen.
+    pub(crate) fn menu_bar_ui(&mut self, ui: &mut egui::Ui) {
+        let ctx = ui.ctx().clone();
+        let bar = craft_menu::layout(&self.menu_bar(&ctx), Target::current(), &layout_options()).bar;
+        let gate = self.menu_gate(&ctx);
+        // The mode tabs, search and buttons follow the bar in the same row: it takes its titles'
+        // width, less when the row is short, where the menus that don't fit move into its "⋯".
+        let fit = (ui.available_width() - ROW_AFTER_MENUS).max(MIN_MENUS_WIDTH);
+        let chosen = craft_menu::MenuBarUi::new(&bar)
+            .gate(gate)
+            .label(&translate)
+            .english(&english)
+            .id(egui::Id::unique("pdfcraft-menu-bar"))
+            .shrink_to_fit(fit)
+            .show(ui);
+        for command in chosen {
+            self.run_menu_command(&ctx, &command);
+        }
+    }
+
+    /// Install the native menu bar (macOS), once, from the eframe app creator. `false` when
+    /// AppKit refused it: the in-window bar stays.
+    #[cfg(target_os = "macos")]
+    pub fn install_native_menu(&mut self, ctx: &egui::Context) -> bool {
+        crate::i18n::set_current(crate::i18n::Lang::from_pref(&self.language));
+        let bar = craft_menu::mac_layout(&self.menu_bar(ctx), &layout_options()).bar;
+        // The Window menu lists the open documents itself, so AppKit's window list stays off.
+        self.native_menu = craft_menu::mac::install_with(ctx, &bar, craft_menu::mac::MacOptions::default().window_list(false));
+        self.native_menu.is_some()
+    }
+
+    /// The native menu's clicks since the last frame, run like in-window ones.
+    pub(crate) fn native_menu_clicks(&mut self, ctx: &egui::Context) {
+        let gate = self.menu_gate(ctx);
+        let Some(native) = self.native_menu.as_mut() else { return };
+        native.set_gate(gate);
+        for command in native.take_clicks(ctx) {
+            self.run_menu_command(ctx, &command);
+        }
+    }
+
+    /// Bring the native menu in step with the app, after this frame's changes.
+    pub(crate) fn sync_native_menu(&mut self, ctx: &egui::Context) {
+        if self.native_menu.is_none() {
+            return;
+        }
+        let layout = craft_menu::mac_layout(&self.menu_bar(ctx), &layout_options());
+        let gate = self.menu_gate(ctx);
+        if let Some(native) = self.native_menu.as_mut() {
+            native.set_gate(gate);
+            for clash in native.sync(layout) {
+                log::info!("menu shortcut {:?} kept by {} over {} ({})", clash.shortcut, clash.command.id, clash.system, clash.resolution);
+            }
+        }
+    }
+}
+
+/// A command's `{"index": n}` parameter.
+fn param_index(command: &CommandRef) -> Option<usize> {
+    command.params.get("index").and_then(serde_json::Value::as_u64).and_then(|i| usize::try_from(i).ok())
+}
+
+/// The side panel a [`PANEL`] command names.
+fn panel(command: &CommandRef) -> Option<RightPanel> {
+    let name = command.params.get("panel").and_then(serde_json::Value::as_str)?;
+    PANELS.iter().find(|(_, n, _)| *n == name).map(|(p, ..)| *p)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+
+    use craft_menu::{Backend, Dispatch, Event, ItemKind, NativeMenu};
+
+    use super::*;
+
+    const PDF: &[u8] = include_bytes!("../tests/data/form.pdf");
+
+    fn app(docs: &[&str]) -> (PdfCraftApp, egui::Context) {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        for name in docs {
+            app.open_bytes(name, None, PDF.to_vec()).unwrap();
+        }
+        (app, egui::Context::default())
+    }
+
+    fn linux(app: &PdfCraftApp, ctx: &egui::Context) -> MenuBar {
+        craft_menu::layout(&app.menu_bar(ctx), Target::Linux, &layout_options()).bar
+    }
+
+    fn item<'b>(bar: &'b MenuBar, command: &CommandRef) -> &'b Item {
+        bar.find(command).unwrap_or_else(|| panic!("{} is in the menus", command.key()))
+    }
+
+    #[test]
+    fn every_menu_command_is_listed_once_with_its_shortcut() {
+        let (app, ctx) = app(&["a.pdf"]);
+        let bar = linux(&app, &ctx);
+        let items = bar.items();
+        let mut keys: Vec<String> = items.iter().map(|it| it.command.key()).collect();
+        keys.sort();
+        let count = keys.len();
+        keys.dedup();
+        assert_eq!(keys.len(), count, "no command is listed twice");
+        for spec in commands::COMMANDS.iter().filter(|s| s.menu.is_some()) {
+            if spec.id == "file.open_recent" {
+                continue; // A submenu of the recent files.
+            }
+            let it = item(&bar, &CommandRef::new(spec.id));
+            let shortcut = spec.shortcut.or((spec.id == "edit.copy").then_some(crate::commands::COPY));
+            assert_eq!(it.shortcut, shortcut.and_then(chord), "{} has its registry shortcut", spec.id);
+        }
+        // Every item runs a registry command or one of the menu's own.
+        for it in items {
+            let id = it.command.id.as_str();
+            assert!(
+                commands::command(id).is_some() || extra(id).is_some() || [PANEL, DOCUMENT].contains(&id) || Builtin::of(&it.command).is_some(),
+                "{id} runs something"
+            );
+        }
+    }
+
+    #[test]
+    fn check_and_radio_items_follow_the_app() {
+        let (mut app, ctx) = app(&["a.pdf"]);
+        let kind = |app: &PdfCraftApp, id: &str| item(&linux(app, &ctx), &CommandRef::new(id)).kind;
+        assert_eq!(kind(&app, "view.layout.single"), ItemKind::Radio(true));
+        assert_eq!(kind(&app, "view.layout.two_up"), ItemKind::Radio(false));
+        let continuous = app.views[0].continuous();
+        assert_eq!(kind(&app, "view.continuous"), ItemKind::Check(continuous));
+        app.run_menu_command(&ctx, &CommandRef::new("view.layout.two_up"));
+        app.run_menu_command(&ctx, &CommandRef::new("view.continuous"));
+        assert_eq!(kind(&app, "view.layout.single"), ItemKind::Radio(false));
+        assert_eq!(kind(&app, "view.layout.two_up"), ItemKind::Radio(true));
+        assert_eq!(kind(&app, "view.continuous"), ItemKind::Check(!continuous));
+        let left = app.left_open;
+        assert_eq!(kind(&app, "view.tools_pane"), ItemKind::Check(left));
+        app.run_menu_command(&ctx, &CommandRef::new("view.tools_pane"));
+        assert_eq!(kind(&app, "view.tools_pane"), ItemKind::Check(!left));
+        let bookmarks = CommandRef::with_params(PANEL, serde_json::json!({ "panel": "bookmarks" }));
+        app.run_menu_command(&ctx, &bookmarks);
+        assert_eq!(app.right, Some(RightPanel::Bookmarks));
+        assert_eq!(item(&linux(&app, &ctx), &bookmarks).kind, ItemKind::Radio(true));
+        assert_eq!(kind(&app, "view.side_panel"), ItemKind::Check(true));
+    }
+
+    #[test]
+    fn a_dialog_greys_document_commands_and_drops_their_clicks() {
+        let (mut app, ctx) = app(&["a.pdf"]);
+        let rotate = CommandRef::new("page.rotate");
+        assert!(app.menu_gate(&ctx).allows_command(&rotate));
+        app.dialog = Some(crate::Dialog::About);
+        assert!(!app.menu_gate(&ctx).allows_command(&rotate), "the gate greys the menus under a dialog");
+        let doc = app.views[0].id;
+        let before = app.session.get(doc).unwrap().info.pages[0].rotation;
+        app.run_menu_command(&ctx, &rotate);
+        assert_eq!(app.session.get(doc).unwrap().info.pages[0].rotation, before, "a click that arrives anyway does nothing");
+        // Quit still asks the window to close, which asks about unsaved changes.
+        assert!(app.menu_gate(&ctx).allows_command(&Builtin::Quit.command()));
+    }
+
+    #[test]
+    fn recent_files_and_open_documents_are_listed_once_each() {
+        let (mut app, ctx) = app(&["a.pdf", "b.pdf"]);
+        app.recent = ["one.pdf", "two.pdf"].map(|n| crate::RecentFile { name: n.into(), path: format!("/nowhere/{n}"), pages: 1, size: 0 }).into();
+        let bar = linux(&app, &ctx);
+        for (i, name) in ["one.pdf", "two.pdf"].into_iter().enumerate() {
+            assert_eq!(item(&bar, &CommandRef::with_params("file.open_recent", serde_json::json!({ "index": i }))).label, name);
+        }
+        let window = bar.menu(MenuRole::Window).unwrap();
+        let documents: Vec<&str> = window
+            .children
+            .iter()
+            .filter_map(|n| match n {
+                Node::Item(it) if it.command.id == DOCUMENT => Some(it.label.as_str()),
+                _ => None,
+            })
+            .collect();
+        assert_eq!(documents, ["a.pdf", "b.pdf"], "each open document once, in tab order");
+        app.run_menu_command(&ctx, &CommandRef::with_params(DOCUMENT, serde_json::json!({ "index": 0 })));
+        assert_eq!(app.active, Some(0));
+        // The macOS layout lists them once too.
+        let mac = craft_menu::mac_layout(&app.menu_bar(&ctx), &layout_options()).bar;
+        let listed = mac.items().iter().filter(|it| it.command.id == DOCUMENT).count();
+        assert_eq!(listed, 2);
+        app.recent.clear();
+        let bar = linux(&app, &ctx);
+        assert!(!item(&bar, &CommandRef::new(NO_RECENT)).enabled, "an empty list shows a greyed placeholder");
+        assert!(bar.find(&CommandRef::new("file.clear_recent")).is_none());
+    }
+
+    /// A native backend that reports what the test queues, through the driver's dispatch as the
+    /// macOS backend does.
+    #[derive(Clone, Default)]
+    struct FakeMenu(Rc<RefCell<(Option<Dispatch>, Vec<Event>)>>);
+
+    impl FakeMenu {
+        fn click(&self, command: &CommandRef) {
+            let mut state = self.0.borrow_mut();
+            let event = state.0.as_ref().map(|d| d.chosen(command, None, false, None));
+            state.1.extend(event);
+        }
+    }
+
+    impl Backend for FakeMenu {
+        fn sync(&mut self, _bar: &MenuBar) {}
+        fn drain(&mut self) -> Vec<Event> {
+            std::mem::take(&mut self.0.borrow_mut().1)
+        }
+        fn attach(&mut self, dispatch: Dispatch) {
+            self.0.borrow_mut().0 = Some(dispatch);
+        }
+    }
+
+    #[test]
+    fn a_native_menu_click_runs_its_command_once() {
+        let (mut app, ctx) = app(&["a.pdf"]);
+        let fake = FakeMenu::default();
+        app.native_menu = Some(NativeMenu::new(Box::new(fake.clone())));
+        let doc = app.views[0].id;
+        let before = app.session.get(doc).unwrap().info.pages[0].rotation;
+        fake.click(&CommandRef::new("page.rotate"));
+        let mut raw = egui::RawInput::default();
+        app.prepare_raw_input(&ctx, &mut raw);
+        app.native_menu_clicks(&ctx);
+        app.native_menu_clicks(&ctx);
+        assert_eq!(app.session.get(doc).unwrap().info.pages[0].rotation, (before + 90) % 360, "rotated once");
+    }
+}
diff --git a/crates/ui-egui/src/tab_context.rs b/crates/ui-egui/src/menus/tab_context.rs
similarity index 98%
rename from crates/ui-egui/src/tab_context.rs
rename to crates/ui-egui/src/menus/tab_context.rs
index 7cc502722b..9590969baf 100644
--- a/crates/ui-egui/src/tab_context.rs
+++ b/crates/ui-egui/src/menus/tab_context.rs
@@ -156,7 +156,7 @@ fn reveal_command(platform: &str, path: &std::path::Path) -> Result<(&'static st
 #[cfg(all(test, not(target_arch = "wasm32")))]
 mod tests {
     use super::*;
-    const PDF: &[u8] = include_bytes!("../tests/data/form.pdf");
+    const PDF: &[u8] = include_bytes!("../../tests/data/form.pdf");
 
     #[test]
     fn confirmed_close_uses_id_and_cancel_keeps_history_empty() {
@@ -297,7 +297,7 @@ mod ui_tests {
             let mut app = PdfCraftApp::new();
             app.set_option("language", "en").unwrap();
             for name in ["first.pdf", "second.pdf"] {
-                app.open_bytes(name, None, include_bytes!("../tests/data/form.pdf").to_vec()).unwrap();
+                app.open_bytes(name, None, include_bytes!("../../tests/data/form.pdf").to_vec()).unwrap();
             }
             app
         });
diff --git a/crates/ui-egui/src/motion.rs b/crates/ui-egui/src/motion.rs
deleted file mode 100644
index 934fc06188..0000000000
--- a/crates/ui-egui/src/motion.rs
+++ /dev/null
@@ -1,541 +0,0 @@
-//! Animation effects, and the system's request to do without them.
-//!
-//! Windows' Settings ▸ Accessibility ▸ Visual effects ▸ Animation effects, turned off, asks
-//! apps not to animate (other systems have a Reduce motion switch for it). The desktop app
-//! reads the setting ([`MotionSource`]), and Preferences ▸ Animation effects
-//! ([`AnimationEffects`]) follows it unless the user chose On or Off there. With animation
-//! effects off, nothing in the window eases:
-//!
-//! - A wheel notch scrolls its whole distance in the frame it arrives. egui spreads a notch
-//!   over about a quarter of a second and has no switch for that, so each frame's wheel input
-//!   is read again here, the way egui reads it but for the easing ([`WheelReader`]), and handed
-//!   to egui's scroll areas in place of its own.
-//! - ⌘/Ctrl-wheel zooms by a notch's whole step at once: egui makes its zoom factor from the
-//!   same eased wheel motion. Views read [`zoom_delta`] instead of egui's.
-//! - Scrolling to a place (a row revealed by the keys, the Hand tool's drag) takes no time.
-//! - egui's other animations (menus fading in, sections opening) take no time: its style's
-//!   animation time is zero, which the app's own fades and sweeps ask about too ([`animated`]).
-//!
-//! How far anything scrolls or zooms doesn't change, only how long it takes.
-
-use egui::style::ScrollAnimation;
-use egui::{Event, Modifiers, MouseWheelUnit, TouchPhase, Vec2, vec2};
-
-/// Preferences ▸ Animation effects: whether anything in the window is animated, the wheel's
-/// scrolling and zooming included.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum AnimationEffects {
-    /// Animated unless the system asks for no animations ([`Motion::reduced`]).
-    #[default]
-    System,
-    On,
-    Off,
-}
-
-impl AnimationEffects {
-    pub const ALL: [Self; 3] = [Self::System, Self::On, Self::Off];
-
-    pub fn label(self) -> &'static str {
-        match self {
-            Self::System => "Use system setting",
-            Self::On => "On",
-            Self::Off => "Off",
-        }
-    }
-
-    /// The name in saved settings and on the control channel.
-    pub fn name(self) -> &'static str {
-        match self {
-            Self::System => "system",
-            Self::On => "on",
-            Self::Off => "off",
-        }
-    }
-
-    pub fn parse(value: &str) -> Option<Self> {
-        Self::ALL.into_iter().find(|choice| choice.name().eq_ignore_ascii_case(value))
-    }
-
-    /// Whether the window animates, given whether the system asks for no animations.
-    pub fn animates(self, system_reduced: bool) -> bool {
-        match self {
-            Self::System => !system_reduced,
-            Self::On => true,
-            Self::Off => false,
-        }
-    }
-}
-
-/// Asks the system whether it wants no animations; `None` when it can't say, which leaves the
-/// last answer standing. Asked from the UI thread every [`ASK_EVERY`] seconds while the window
-/// is in use, so it must answer at once.
-pub type MotionSource = Box<dyn Fn() -> Option<bool>>;
-
-/// Seconds between two questions to [`MotionSource`]. Changing the setting takes longer than
-/// this away from the window, so the first frame back already follows it.
-const ASK_EVERY: f64 = 2.0;
-
-/// What the system says about animations, and what it takes to stop egui's.
-pub struct Motion {
-    /// The system asks for no animations. The desktop app's [`Self::source`] sets it; false
-    /// elsewhere, so tests and screenshots don't depend on the machine.
-    pub reduced: bool,
-    /// How to ask the system (the desktop app sets it).
-    pub source: Option<MotionSource>,
-    /// egui time of the last question.
-    asked_at: f64,
-    /// egui's own animation time and scroll animation, kept while they are changed here.
-    egui_times: Option<(f32, ScrollAnimation)>,
-    wheel: WheelReader,
-}
-
-impl Default for Motion {
-    fn default() -> Self {
-        Self { reduced: false, source: None, asked_at: f64::NEG_INFINITY, egui_times: None, wheel: WheelReader::default() }
-    }
-}
-
-impl Motion {
-    /// Call once at the start of every pass, before any ui reads the wheel or draws.
-    pub(crate) fn begin_pass(&mut self, ctx: &egui::Context, effects: AnimationEffects) {
-        let now = ctx.input(|i| i.time);
-        // `>=` is false for a NaN time, which then never asks.
-        if now - self.asked_at >= ASK_EVERY
-            && let Some(source) = &self.source
-        {
-            self.asked_at = now;
-            if let Some(reduced) = source() {
-                self.reduced = reduced;
-            }
-        }
-        let animate = effects.animates(self.reduced);
-        self.sync_style(ctx, animate);
-        if animate {
-            // A gesture begun while easing is egui's to finish.
-            self.wheel = WheelReader::default();
-            return;
-        }
-        let options = ctx.options(|o| o.input_options);
-        let motion = ctx.input(|i| self.wheel.read(&i.events, i.viewport_rect().height(), &options));
-        ctx.input_mut(|i| i.smooth_scroll_delta = motion.scroll);
-        let pass = ctx.cumulative_pass_nr();
-        ctx.data_mut(|d| d.insert_temp(zoom_id(), (pass, motion.zoom)));
-    }
-
-    /// egui's animations, and its scrolling to a place, take no time unless the window is to
-    /// `animate`; then both get back the times egui had.
-    fn sync_style(&mut self, ctx: &egui::Context, animate: bool) {
-        if animate && self.egui_times.is_none() {
-            return;
-        }
-        // Checked every pass, so a style replaced since can't bring the animations back.
-        let style = ctx.global_style();
-        let egui_times = *self.egui_times.get_or_insert((style.animation_time, style.scroll_animation));
-        let wanted = if animate { egui_times } else { (0.0, ScrollAnimation::none()) };
-        if (style.animation_time, style.scroll_animation) != wanted {
-            ctx.all_styles_mut(|s| (s.animation_time, s.scroll_animation) = wanted);
-        }
-        if animate {
-            self.egui_times = None;
-        }
-    }
-}
-
-/// Whether the window animates this pass. The app's own fades and sweeps, which have their own
-/// durations, ask this; egui's animations stop by themselves ([`Motion::begin_pass`]).
-pub(crate) fn animated(ctx: &egui::Context) -> bool {
-    ctx.global_style().animation_time > 0.0
-}
-
-fn zoom_id() -> egui::Id {
-    egui::Id::new("pdfcraft-motion-wheel-zoom")
-}
-
-/// This pass's zoom factor from a pinch or ⌘/Ctrl with the wheel (1.0 for none): egui's
-/// `zoom_delta`, without the easing while animation effects are off.
-pub(crate) fn zoom_delta(ctx: &egui::Context) -> f32 {
-    let read: Option<(u64, f32)> = ctx.data(|d| d.get_temp(zoom_id()));
-    let pass = ctx.cumulative_pass_nr();
-    ctx.input(|i| match read {
-        // Only what [`Motion::begin_pass`] read in this very pass: a factor left from an earlier
-        // one would zoom again every frame. Fingers on a touch screen are measured, never eased.
-        Some((at, zoom)) if at == pass && i.multi_touch().is_none() => zoom,
-        _ => i.zoom_delta(),
-    })
-}
-
-/// One pass's wheel input.
-#[derive(Clone, Copy, Debug, PartialEq)]
-struct WheelMotion {
-    /// Points to scroll by, as `InputState::smooth_scroll_delta` gives them (positive moves the
-    /// content right and down).
-    scroll: Vec2,
-    /// The zoom factor from pinch events and ⌘/Ctrl with the wheel.
-    zoom: f32,
-}
-
-/// Reads wheel events as egui's `WheelState` does (egui 0.36, `input_state/wheel_state.rs`):
-/// the same units, modifiers and touch phases, but every step lands whole in its own pass,
-/// where egui keeps part of a coarse one for later passes. Compare the two when updating egui;
-/// `tests::reading_at_once_goes_as_far_as_egui_eases` fails if they come apart.
-#[derive(Default)]
-struct WheelReader {
-    /// The modifiers of the touch gesture in progress (`TouchPhase::Start` to `End`). They hold
-    /// for the whole gesture, as in egui: its momentum arrives after the keys are let go.
-    touch: Option<Modifiers>,
-}
-
-impl WheelReader {
-    /// `page_height` is what one `MouseWheelUnit::Page` scrolls: the window's height in points.
-    fn read(&mut self, events: &[Event], page_height: f32, options: &egui::InputOptions) -> WheelMotion {
-        let mut delta = Vec2::ZERO;
-        let mut zoom = 1.0_f32;
-        let mut modifiers = self.touch.unwrap_or_default();
-        for event in events {
-            match event {
-                Event::MouseWheel { unit, delta: step, phase, modifiers: latest } => match phase {
-                    TouchPhase::Start => {
-                        self.touch = Some(*latest);
-                        modifiers = *latest;
-                    }
-                    TouchPhase::Move => {
-                        modifiers = match &mut self.touch {
-                            Some(held) => {
-                                *held |= *latest;
-                                *held
-                            }
-                            None => *latest,
-                        };
-                        let mut step = match unit {
-                            MouseWheelUnit::Point => *step,
-                            MouseWheelUnit::Line => options.line_scroll_speed * *step,
-                            MouseWheelUnit::Page => page_height * *step,
-                        };
-                        let horizontal = modifiers.matches_any(options.horizontal_scroll_modifier);
-                        let vertical = modifiers.matches_any(options.vertical_scroll_modifier);
-                        if horizontal && !vertical {
-                            step = vec2(step.x + step.y, 0.0);
-                        }
-                        if !horizontal && vertical {
-                            step = vec2(0.0, step.x + step.y);
-                        }
-                        // The system's numbers: one that isn't finite would end up in a scroll offset.
-                        if step.x.is_finite() && step.y.is_finite() {
-                            delta += step;
-                        }
-                    }
-                    // egui drops what the gesture moved earlier in the pass it ends in.
-                    TouchPhase::End | TouchPhase::Cancel => {
-                        self.touch = None;
-                        modifiers = Modifiers::NONE;
-                        delta = Vec2::ZERO;
-                    }
-                },
-                Event::Zoom(factor) => zoom *= *factor,
-                _ => {}
-            }
-        }
-        // A pass is all zoom or all scroll, by the modifiers it ends with, as in egui.
-        let mut scroll = delta;
-        if modifiers.matches_any(options.zoom_modifier) {
-            zoom *= (options.scroll_zoom_speed * (delta.x + delta.y)).exp();
-            scroll = Vec2::ZERO;
-        }
-        if !(zoom.is_finite() && zoom > 0.0) {
-            zoom = 1.0;
-        }
-        WheelMotion { scroll, zoom }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::cell::Cell;
-    use std::rc::Rc;
-
-    fn wheel(unit: MouseWheelUnit, delta: Vec2, phase: TouchPhase, modifiers: Modifiers) -> Event {
-        Event::MouseWheel { unit, delta, phase, modifiers }
-    }
-
-    fn notch(dy: f32, modifiers: Modifiers) -> Event {
-        wheel(MouseWheelUnit::Line, vec2(0.0, dy), TouchPhase::Move, modifiers)
-    }
-
-    fn read(events: &[Event]) -> WheelMotion {
-        WheelReader::default().read(events, 600.0, &egui::InputOptions::default())
-    }
-
-    #[test]
-    fn a_step_is_read_whole_in_its_units() {
-        let line = egui::InputOptions::default().line_scroll_speed;
-        assert_eq!(read(&[notch(-1.0, Modifiers::NONE)]), WheelMotion { scroll: vec2(0.0, -line), zoom: 1.0 });
-        assert_eq!(read(&[notch(-1.0, Modifiers::NONE), notch(-2.0, Modifiers::NONE)]).scroll, vec2(0.0, -3.0 * line), "steps of one pass add up");
-        let points = wheel(MouseWheelUnit::Point, vec2(3.0, -250.0), TouchPhase::Move, Modifiers::NONE);
-        assert_eq!(read(&[points]).scroll, vec2(3.0, -250.0));
-        let page = wheel(MouseWheelUnit::Page, vec2(0.0, -1.0), TouchPhase::Move, Modifiers::NONE);
-        assert_eq!(read(&[page]).scroll, vec2(0.0, -600.0));
-        assert_eq!(read(&[]), WheelMotion { scroll: Vec2::ZERO, zoom: 1.0 }, "and nothing is left for a later pass");
-    }
-
-    #[test]
-    fn modifiers_turn_the_wheel_sideways_or_into_zoom() {
-        let line = egui::InputOptions::default().line_scroll_speed;
-        assert_eq!(read(&[notch(-1.0, Modifiers::SHIFT)]).scroll, vec2(-line, 0.0));
-        let sideways = wheel(MouseWheelUnit::Point, vec2(-30.0, 0.0), TouchPhase::Move, Modifiers::ALT);
-        assert_eq!(read(&[sideways]).scroll, vec2(0.0, -30.0));
-        let zoomed = read(&[notch(1.0, Modifiers::COMMAND)]);
-        assert_eq!(zoomed.scroll, Vec2::ZERO, "a zooming wheel doesn't scroll");
-        let step = (egui::InputOptions::default().scroll_zoom_speed * line).exp();
-        assert!((zoomed.zoom - step).abs() < 1e-6, "{zoomed:?}");
-        assert!((read(&[notch(-1.0, Modifiers::COMMAND)]).zoom - 1.0 / step).abs() < 1e-6);
-        assert!((read(&[Event::Zoom(1.5), Event::Zoom(2.0)]).zoom - 3.0).abs() < 1e-6, "pinch events multiply");
-    }
-
-    #[test]
-    fn a_touch_gesture_keeps_its_modifiers_and_ends_clean() {
-        let mut reader = WheelReader::default();
-        let options = egui::InputOptions::default();
-        let point = |dy: f32, phase, modifiers| wheel(MouseWheelUnit::Point, vec2(0.0, dy), phase, modifiers);
-        // ⌘ held as the fingers land, let go before the momentum: still zooming.
-        let began =
-            reader.read(&[point(0.0, TouchPhase::Start, Modifiers::COMMAND), point(20.0, TouchPhase::Move, Modifiers::COMMAND)], 600.0, &options);
-        assert!(began.zoom > 1.0 && began.scroll == Vec2::ZERO, "{began:?}");
-        let momentum = reader.read(&[point(20.0, TouchPhase::Move, Modifiers::NONE)], 600.0, &options);
-        assert!(momentum.zoom > 1.0 && momentum.scroll == Vec2::ZERO, "{momentum:?}");
-        // The pass it ends in moves nothing, and the next gesture starts without the modifier.
-        let ended = reader.read(&[point(20.0, TouchPhase::Move, Modifiers::NONE), point(0.0, TouchPhase::End, Modifiers::NONE)], 600.0, &options);
-        assert_eq!(ended, WheelMotion { scroll: Vec2::ZERO, zoom: 1.0 });
-        assert_eq!(reader.read(&[point(-20.0, TouchPhase::Move, Modifiers::NONE)], 600.0, &options).scroll, vec2(0.0, -20.0));
-    }
-
-    #[test]
-    fn numbers_that_are_not_finite_move_nothing() {
-        for bad in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
-            let scrolled = read(&[notch(bad, Modifiers::NONE), notch(-1.0, Modifiers::NONE)]);
-            assert!(scrolled.scroll.x.is_finite() && scrolled.scroll.y.is_finite(), "{bad}: {scrolled:?}");
-            assert_eq!(read(&[notch(bad, Modifiers::COMMAND)]).zoom, 1.0, "{bad}");
-            assert_eq!(read(&[Event::Zoom(bad)]).zoom, 1.0, "{bad}");
-        }
-        assert_eq!(read(&[Event::Zoom(0.0)]).zoom, 1.0);
-        assert_eq!(read(&[Event::Zoom(-2.0)]).zoom, 1.0);
-        // Too far to be a factor at all.
-        assert_eq!(read(&[notch(1.0e9, Modifiers::COMMAND)]).zoom, 1.0);
-    }
-
-    /// One pass of a bare egui context, a sixtieth of a second after the last.
-    fn pass(ctx: &egui::Context, time: &mut f64, events: Vec<Event>, mut seen: impl FnMut(&egui::Context)) {
-        *time += 1.0 / 60.0;
-        let raw = egui::RawInput { time: Some(*time), events, ..Default::default() };
-        // A bare context's first frame uploads the font atlas; nothing paints it here.
-        ctx.run_ui(raw, |ui| seen(ui.ctx())).textures_delta.clear();
-    }
-
-    /// The reader must stay egui's own reading minus the easing: over the passes egui takes to
-    /// ease a step, it hands out as much scroll (and as much zoom) as the reader does at once.
-    #[test]
-    fn reading_at_once_goes_as_far_as_egui_eases() {
-        let options = egui::InputOptions::default();
-        for (modifiers, unit, step) in [
-            (Modifiers::NONE, MouseWheelUnit::Line, vec2(0.0, -3.0)),
-            (Modifiers::NONE, MouseWheelUnit::Point, vec2(40.0, -250.0)),
-            (Modifiers::SHIFT, MouseWheelUnit::Line, vec2(0.0, 2.0)),
-            (Modifiers::COMMAND, MouseWheelUnit::Line, vec2(0.0, 1.0)),
-            (Modifiers::COMMAND, MouseWheelUnit::Point, vec2(0.0, -90.0)),
-        ] {
-            let event = wheel(unit, step, TouchPhase::Move, modifiers);
-            let ctx = egui::Context::default();
-            let (mut time, mut scrolled, mut zoomed, mut first) = (0.0, Vec2::ZERO, 1.0_f32, None);
-            let mut events = vec![event.clone()];
-            for _ in 0..120 {
-                pass(&ctx, &mut time, std::mem::take(&mut events), |ctx| {
-                    let (scroll, zoom) = ctx.input(|i| (i.smooth_scroll_delta, i.zoom_delta()));
-                    first.get_or_insert((scroll, zoom));
-                    scrolled += scroll;
-                    zoomed *= zoom;
-                });
-            }
-            let page_height = ctx.input(|i| i.viewport_rect().height());
-            let at_once = WheelReader::default().read(&[event], page_height, &options);
-            assert!((scrolled - at_once.scroll).length() < 0.01, "{modifiers:?} {unit:?}: egui scrolled {scrolled:?}, read {:?}", at_once.scroll);
-            assert!((zoomed / at_once.zoom - 1.0).abs() < 1e-3, "{modifiers:?} {unit:?}: egui zoomed {zoomed}, read {}", at_once.zoom);
-            // What makes the reader necessary: egui's first pass holds part of the step back.
-            let first = first.expect("passes ran");
-            assert!(
-                first != (at_once.scroll, at_once.zoom),
-                "{modifiers:?} {unit:?}: egui no longer eases this step ({first:?}); the reader may not be needed"
-            );
-        }
-    }
-
-    #[test]
-    fn reduced_motion_hands_egui_the_whole_step_and_stops_its_animations() {
-        let ctx = egui::Context::default();
-        let mut motion = Motion { reduced: true, ..Default::default() };
-        let line = egui::InputOptions::default().line_scroll_speed;
-        let mut time = 0.0;
-        let mut seen = Vec::new();
-        let mut events = vec![notch(-1.0, Modifiers::NONE)];
-        for _ in 0..30 {
-            pass(&ctx, &mut time, std::mem::take(&mut events), |ctx| {
-                motion.begin_pass(ctx, AnimationEffects::System);
-                seen.push(ctx.input(|i| i.smooth_scroll_delta));
-            });
-        }
-        assert_eq!(seen.first(), Some(&vec2(0.0, -line)), "the whole notch in the pass it arrives");
-        assert!(seen.iter().skip(1).all(|d| *d == Vec2::ZERO), "and none of egui's easing after it: {seen:?}");
-        let style = ctx.global_style();
-        assert_eq!((style.animation_time, style.scroll_animation), (0.0, egui::style::ScrollAnimation::none()));
-        for theme in [egui::Theme::Light, egui::Theme::Dark] {
-            assert_eq!(ctx.style_of(theme).animation_time, 0.0, "{theme:?}");
-        }
-
-        // ⌘/Ctrl with the wheel: the whole zoom step at once, then nothing.
-        let step = (egui::InputOptions::default().scroll_zoom_speed * line).exp();
-        let mut zooms = Vec::new();
-        let mut events = vec![notch(1.0, Modifiers::COMMAND)];
-        for _ in 0..30 {
-            pass(&ctx, &mut time, std::mem::take(&mut events), |ctx| {
-                motion.begin_pass(ctx, AnimationEffects::System);
-                zooms.push(zoom_delta(ctx));
-            });
-        }
-        assert!((zooms[0] - step).abs() < 1e-6, "{zooms:?}");
-        assert!(zooms.iter().skip(1).all(|z| *z == 1.0), "{zooms:?}");
-
-        // Animations allowed again: egui's own values and its own times.
-        motion.reduced = false;
-        let mut eased = Vec::new();
-        let mut events = vec![notch(1.0, Modifiers::COMMAND)];
-        for _ in 0..3 {
-            pass(&ctx, &mut time, std::mem::take(&mut events), |ctx| {
-                motion.begin_pass(ctx, AnimationEffects::System);
-                eased.push((zoom_delta(ctx), ctx.input(|i| i.zoom_delta())));
-            });
-        }
-        assert!(eased.iter().all(|(ours, eguis)| ours == eguis), "{eased:?}");
-        assert!(eased[0].0 > 1.0 && eased[0].0 < step, "egui eases the step: {eased:?}");
-        let (style, default) = (ctx.global_style(), egui::Style::default());
-        assert_eq!((style.animation_time, style.scroll_animation), (default.animation_time, default.scroll_animation));
-    }
-
-    #[test]
-    fn the_preference_overrides_the_system_for_every_animation() {
-        use AnimationEffects::{Off, On, System};
-        assert_eq!(AnimationEffects::default(), System, "the system's setting is followed unless the user chooses");
-        for choice in AnimationEffects::ALL {
-            assert_eq!(AnimationEffects::parse(choice.name()), Some(choice));
-        }
-        assert_eq!((AnimationEffects::parse("OFF"), AnimationEffects::parse("smooth")), (Some(Off), None));
-        let (line, egui_default) = (egui::InputOptions::default().line_scroll_speed, egui::Style::default());
-        let egui_times = (egui_default.animation_time, egui_default.scroll_animation);
-        // The system's answer, the choice, and whether the window then animates.
-        for (reduced, effects, animates) in
-            [(false, System, true), (true, System, false), (false, On, true), (true, On, true), (false, Off, false), (true, Off, false)]
-        {
-            assert_eq!(effects.animates(reduced), animates, "{effects:?}, system reduced: {reduced}");
-            let ctx = egui::Context::default();
-            let mut motion = Motion { reduced, ..Default::default() };
-            let (mut time, mut first) = (0.0, None);
-            pass(&ctx, &mut time, vec![notch(-1.0, Modifiers::NONE)], |ctx| {
-                motion.begin_pass(ctx, effects);
-                first = Some((ctx.input(|i| i.smooth_scroll_delta), animated(ctx)));
-            });
-            // The wheel, egui's animations and the app's own fades all go the same way.
-            let whole_notch = first.map(|(scroll, _)| scroll) == Some(vec2(0.0, -line));
-            assert_eq!(
-                (whole_notch, first.map(|(_, animated)| animated)),
-                (!animates, Some(animates)),
-                "{effects:?}, system reduced: {reduced}: {first:?}"
-            );
-            let style = ctx.global_style();
-            let times = if animates { egui_times } else { (0.0, ScrollAnimation::none()) };
-            assert_eq!((style.animation_time, style.scroll_animation), times, "{effects:?}, system reduced: {reduced}");
-        }
-        // A choice made while running applies from the next pass, and choosing back undoes it.
-        let ctx = egui::Context::default();
-        let mut motion = Motion::default();
-        let mut time = 0.0;
-        for (effects, times) in [(Off, (0.0, ScrollAnimation::none())), (System, egui_times), (Off, (0.0, ScrollAnimation::none())), (On, egui_times)]
-        {
-            pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, effects));
-            let style = ctx.global_style();
-            assert_eq!((style.animation_time, style.scroll_animation), times, "{effects:?}");
-        }
-    }
-
-    /// The chrome's hover wash has a duration of its own (`theme::Press`): it eases in with
-    /// animation effects on and is simply there with them off.
-    #[test]
-    fn the_hover_wash_eases_only_with_animation_effects_on() {
-        for (effects, eased) in [(AnimationEffects::On, true), (AnimationEffects::Off, false)] {
-            let ctx = egui::Context::default();
-            let mut motion = Motion::default();
-            let (mut time, mut hover) = (0.0, Vec::new());
-            for _ in 0..12 {
-                time += 1.0 / 60.0;
-                let raw = egui::RawInput { time: Some(time), events: vec![Event::PointerMoved(egui::pos2(20.0, 20.0))], ..Default::default() };
-                ctx.run_ui(raw, |ui| {
-                    motion.begin_pass(ui.ctx(), effects);
-                    let (_, response) = ui.allocate_exact_size(vec2(100.0, 40.0), egui::Sense::click());
-                    hover.push(crate::theme::Press::track(ui, &response).hover);
-                })
-                .textures_delta
-                .clear();
-            }
-            // The first frame the pointer is found over the control.
-            let first = hover.iter().copied().find(|amount| *amount > 0.0).expect("the pointer is over the control");
-            assert_eq!(first < 1.0, eased, "{effects:?}: {hover:?}");
-            assert_eq!(hover.last(), Some(&1.0), "{effects:?}: the wash is whole in the end either way: {hover:?}");
-        }
-    }
-
-    #[test]
-    fn a_zoom_read_in_an_earlier_pass_is_never_used_again() {
-        let ctx = egui::Context::default();
-        let mut motion = Motion { reduced: true, ..Default::default() };
-        let mut time = 0.0;
-        pass(&ctx, &mut time, vec![notch(1.0, Modifiers::COMMAND)], |ctx| {
-            motion.begin_pass(ctx, AnimationEffects::System);
-            assert!(zoom_delta(ctx) > 1.0);
-        });
-        // A pass that didn't begin here (a host that draws without `logic`): egui's own answer.
-        pass(&ctx, &mut time, Vec::new(), |ctx| {
-            let eguis = ctx.input(|i| i.zoom_delta());
-            assert_eq!(zoom_delta(ctx), eguis);
-        });
-    }
-
-    #[test]
-    fn the_system_is_asked_now_and_then_and_no_answer_changes_nothing() {
-        let ctx = egui::Context::default();
-        let answer = Rc::new(Cell::new(Some(true)));
-        let asked = Rc::new(Cell::new(0_u32));
-        let (source_answer, source_asked) = (Rc::clone(&answer), Rc::clone(&asked));
-        let mut motion = Motion {
-            source: Some(Box::new(move || {
-                source_asked.set(source_asked.get() + 1);
-                source_answer.get()
-            })),
-            ..Default::default()
-        };
-        let mut time = 0.0;
-        pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, AnimationEffects::System));
-        assert!(motion.reduced, "asked in the first pass");
-        answer.set(Some(false));
-        for _ in 0..30 {
-            pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, AnimationEffects::System));
-        }
-        assert!(motion.reduced && asked.get() == 1, "not asked again within half a second ({} times)", asked.get());
-        // Back at the window later: the first pass asks.
-        time += ASK_EVERY;
-        pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, AnimationEffects::System));
-        assert!(!motion.reduced);
-        answer.set(None);
-        motion.reduced = true;
-        time += ASK_EVERY;
-        pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, AnimationEffects::System));
-        assert!(motion.reduced && asked.get() == 3, "no answer leaves the last one standing");
-    }
-}
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 44f132ac93..e5c45549ab 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -8,636 +8,24 @@ use pdfcraft_render::{DocInfo, FieldKind, OutlineItem};
 use crate::theme::{self, Tokens};
 use crate::{LeftPanel, PdfCraftApp, RightPanel, icons, widgets};
 
-const COLLAPSED_TOOLS: usize = 14;
+pub(super) mod all_tools_ui;
+mod bookmarks;
+pub(super) mod comments_panel;
+mod edit;
+pub(super) mod format_text_ui;
+pub(super) mod organize_panel;
+pub(super) mod page_selection_ui;
+mod pages;
+mod right;
+pub(super) mod search_ui;
+pub mod side_panels;
+mod tools;
 
-fn hue(g: &ToolGroup) -> Color32 {
-    Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2])
-}
-
-pub fn left_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
-    let t = Tokens::get(ui.ctx());
-    // Organize closed another way (the grid's Close, or a page opened from it) closes the tool too,
-    // as its panel's Close does, back to the workspace's own panel.
-    if app.left == LeftPanel::Tool("organize") && app.active.and_then(|i| app.views.get(i)).is_some_and(|v| !v.organize) {
-        app.left = crate::organize_panel::workspace_panel(app.mode);
-    }
-    egui::Frame::NONE.fill(t.panel).inner_margin(egui::Margin { left: 14, right: 10, top: 12, bottom: 10 }).stroke(Stroke::new(1.0, t.divider)).show(
-        ui,
-        |ui| match app.left {
-            // Organize pages has its own panel whenever the grid shows (with a document open).
-            _ if app.active.is_some() && crate::organize_panel::showing(app) => crate::organize_panel::panel(app, ui, &t),
-            LeftPanel::AllTools => all_tools(app, ui, &t),
-            LeftPanel::Tool(id) => match catalog::group(id) {
-                Some(g) => tool_detail(app, ui, &t, g),
-                None => app.left = LeftPanel::AllTools,
-            },
-            LeftPanel::CalculationOrder => crate::calc_order_ui::panel(app, ui, &t),
-        },
-    );
-}
-
-/// A panel's title row: Back (with `back` as its tooltip) when given, the title and Close.
-/// Returns whether Back and Close were clicked.
-pub(crate) fn panel_header(ui: &mut egui::Ui, t: &Tokens, title: &str, back: Option<&str>) -> (bool, bool) {
-    let mut go_back = false;
-    let mut close = false;
-    ui.horizontal(|ui| {
-        if let Some(tip) = back
-            && icons::button(ui, "chevron-left", 26.0, false, tip).clicked()
-        {
-            go_back = true;
-        }
-        // Reserve space for Close before laying out the translated title. Long tool names
-        // must never expand the fixed-width sidebar or push the Close control off-screen.
-        let title_width = (ui.available_width() - 26.0 - ui.spacing().item_spacing.x).max(1.0);
-        ui.add_sized([title_width, 26.0], egui::Label::new(egui::RichText::new(tl!(title)).font(theme::semibold(15.5)).color(t.text)).truncate())
-            .on_hover_text(tl!(title));
-        if icons::button(ui, "x", 26.0, false, tl!("Close panel")).clicked() {
-            close = true;
-        }
-    });
-    ui.add_space(4.0);
-    ui.separator();
-    ui.add_space(6.0);
-    (go_back, close)
-}
-
-fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
-    let (_, close) = panel_header(ui, t, "All tools", None);
-    if close {
-        app.left_open = false;
-    }
-    egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
-        ui.add_space(2.0);
-        let shown = if app.all_tools_expanded { TOOL_GROUPS.len() } else { COLLAPSED_TOOLS.min(TOOL_GROUPS.len()) };
-        for g in &TOOL_GROUPS[..shown] {
-            if tool_row(ui, t, g).clicked() {
-                app.select_tool(g.id);
-            }
-        }
-        ui.add_space(4.0);
-        let more = if app.all_tools_expanded { "View less" } else { "View more" };
-        if ui
-            .add(
-                egui::Label::new(egui::RichText::new(tl!(more)).color(t.accent_text).font(theme::medium(13.0)))
-                    .selectable(false)
-                    .sense(Sense::click()),
-            )
-            .on_hover_cursor(egui::CursorIcon::PointingHand)
-            .clicked()
-        {
-            app.all_tools_expanded = !app.all_tools_expanded;
-        }
-    });
-}
-
-/// Draw a one-line row label without painting into the status chip or beyond the sidebar.
-/// Accessibility retains the complete name through the row's WidgetInfo.
-fn row_label(ui: &mut egui::Ui, text: &str, font: egui::FontId, color: Color32, left_center: egui::Pos2, max_width: f32) -> bool {
-    let mut job = egui::text::LayoutJob::simple_singleline(text.to_owned(), font, color);
-    job.wrap = egui::text::TextWrapping { max_width: max_width.max(1.0), max_rows: 1, break_anywhere: true, ..Default::default() };
-    let galley = ui.fonts_mut(|f| f.layout_job(job));
-    let elided = galley.elided;
-    ui.painter().galley(left_center - vec2(0.0, galley.size().y / 2.0), galley, color);
-    elided
-}
-
-fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
-    let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!(g.label)));
-    let press = theme::Press::track(ui, &resp);
-    press.wash(ui, rect, 6, false);
-    let body = rect.translate(press.offset());
-    icons::paint(ui, Rect::from_min_size(body.min + vec2(6.0, 7.0), vec2(20.0, 20.0)), g.icon, 19.0, hue(g));
-    let right_reserved = match (g.badge, g.availability) {
-        (Some(b), _) => ui.fonts_mut(|f| f.layout_no_wrap(tl!(b).to_owned(), theme::semibold(9.5), Color32::WHITE).size().x) + 26.0,
-        (None, Availability::Planned(m)) if resp.hovered() => {
-            let hint = format!("{} · {m}", tl!("Planned"));
-            ui.fonts_mut(|f| f.layout_no_wrap(hint, theme::medium(10.5), t.text_faint).size().x) + 18.0
-        }
-        _ => 8.0,
-    };
-    let clipped =
-        row_label(ui, tl!(g.label), theme::regular(13.5), t.text, body.left_center() + vec2(36.0, 0.0), rect.width() - 36.0 - right_reserved);
-    match (g.badge, g.availability) {
-        (Some(b), _) => {
-            let font = theme::semibold(9.5);
-            let badge = tl!(b);
-            let w = ui.fonts_mut(|f| f.layout_no_wrap(badge.to_string(), font.clone(), Color32::WHITE).size().x);
-            let r = Rect::from_center_size(body.right_center() - vec2(w / 2.0 + 10.0, 0.0), vec2(w + 10.0, 16.0));
-            ui.painter().rect_filled(r, CornerRadius::same(4), t.badge_new);
-            ui.painter().text(r.center(), Align2::CENTER_CENTER, badge, font, Color32::WHITE);
-        }
-        // Planned tools: a quiet milestone hint instead of a chip, so the list stays calm.
-        (None, Availability::Planned(m)) if resp.hovered() => {
-            ui.painter().text(
-                body.right_center() - vec2(10.0, 0.0),
-                Align2::RIGHT_CENTER,
-                format!("{} · {m}", tl!("Planned")),
-                theme::medium(10.5),
-                t.text_faint,
-            );
-        }
-        _ => {}
-    }
-    let tip = match g.availability {
-        Availability::Ready => tl!("Available").to_string(),
-        Availability::Planned(m) => format!("{} {m} — {}", tl!("Planned for milestone"), tl!("open to see what it will include")),
-        Availability::Provider => tl!("Optional: needs an AI provider you configure").into(),
-    };
-    let tip = if clipped { format!("{} — {tip}", tl!(g.label)) } else { tip };
-    theme::hand(resp).on_hover_text(tip)
-}
-
-fn tool_detail(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static ToolGroup) {
-    if g.id == "edit" {
-        edit_panel(app, ui, t, g);
-        return;
-    }
-    let (back, close) = panel_header(ui, t, g.label, Some(tl!("Back to all tools")));
-    if back {
-        app.left = LeftPanel::AllTools;
-        app.enter_mode(crate::Mode::AllTools);
-    }
-    if close {
-        app.left_open = false;
-    }
-    if let Availability::Planned(m) = g.availability {
-        egui::Frame::NONE.fill(t.accent_soft).corner_radius(CornerRadius::same(8)).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
-            ui.set_width(ui.available_width());
-            ui.label(
-                egui::RichText::new(format!("{} {m}. {}", tl!("Coming in milestone"), tl!("Items marked Ready work today.")))
-                    .color(t.text)
-                    .font(theme::regular(12.0)),
-            );
-        });
-    }
-    if g.id == "measure" {
-        crate::measure_ui::panel(app, ui, t);
-        return;
-    }
-    // Add a stamp: the palette.
-    if g.id == "stamp" {
-        stamp_palette(app, ui, t);
-        return;
-    }
-    // Prepare a form: Preview fills the form as a reader would; Edit goes back.
-    if g.id == "form" {
-        ui.horizontal(|ui| {
-            let label = if app.form_preview { "Edit fields" } else { "Preview" };
-            if widgets::pill_button(ui, tl!(label), app.form_preview).on_hover_text(tl!("Try the form as people filling it in will see it")).clicked()
-            {
-                app.form_preview = !app.form_preview;
-                if app.form_preview {
-                    app.quick_tool = crate::QuickTool::Select;
-                }
-            }
-        });
-        ui.add_space(6.0);
-    }
-    let mut run = None;
-    // Redact a PDF has Acrobat's footer: Clear all / Redact all.
-    let footer = g.id == "redact";
-    let marks = if footer { app.active_ids().and_then(|(_, id)| app.session.get(id)).map_or(0, |d| d.redaction_marks()) } else { 0 };
-    let list_h = if footer { (ui.available_height() - 52.0).max(80.0) } else { ui.available_height() };
-    egui::ScrollArea::vertical().auto_shrink([false, false]).max_height(list_h).show(ui, |ui| {
-        ui.add_space(2.0);
-        for s in g.sections {
-            widgets::section_title(ui, tl!(s.title));
-            for item in s.items {
-                if g.id == "fill_sign" && (item.command.starts_with("sign.fill.signature") || item.command.starts_with("sign.fill.initials")) {
-                    continue;
-                }
-                let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!(item.label)));
-                let ready = item.availability == Availability::Ready;
-                let press = theme::Press::track(ui, &resp);
-                press.wash(ui, rect, 6, false);
-                let body = rect.translate(press.offset());
-                let fg = if ready { t.text } else { t.text_muted };
-                icons::paint(
-                    ui,
-                    Rect::from_min_size(body.min + vec2(6.0, 8.0), vec2(18.0, 18.0)),
-                    item.icon,
-                    17.0,
-                    if ready { hue(g) } else { t.text_faint },
-                );
-                let (chip, fill, cfg) = match item.availability {
-                    Availability::Ready => (tl!("Ready"), Color32::from_rgb(0xDD, 0xF3, 0xE4), Color32::from_rgb(0x1E, 0x7B, 0x43)),
-                    Availability::Planned(m) => (m, t.pressed, t.text_muted),
-                    Availability::Provider => ("AI", t.pressed, t.text_muted),
-                };
-                let font = theme::semibold(9.5);
-                let chip_label = tl!(chip).to_string();
-                let w = crate::widgets::text_width(ui, &chip_label, &font);
-                let r = Rect::from_center_size(body.right_center() - vec2(w / 2.0 + 10.0, 0.0), vec2(w + 10.0, 16.0));
-                row_label(ui, tl!(item.label), theme::regular(13.0), fg, body.left_center() + vec2(34.0, 0.0), r.left() - body.left() - 42.0);
-                ui.painter().rect_filled(r, CornerRadius::same(4), fill);
-                ui.painter().text(r.center(), Align2::CENTER_CENTER, chip_label, font, cfg);
-                let resp = theme::hand(resp).on_hover_text(format!("{} — {}", tl!(item.label), item.command));
-                // An entry with further commands opens a menu; its caret goes before the chip.
-                if item.actions.is_empty() {
-                    if resp.clicked() {
-                        run = Some(item.command);
-                    }
-                } else if let Some(cmd) = actions_menu(app, ui, &resp, item, r.left_center() - vec2(10.0, 0.0), fg) {
-                    run = Some(cmd);
-                }
-            }
-        }
-        if g.id == "fill_sign" {
-            widgets::section_title(ui, tl!("Sign yourself"));
-            if let Some(cmd) = crate::fill_sign::signature_entries(ui, app, t) {
-                run = Some(cmd);
-            }
-        }
-    });
-    if footer {
-        ui.add_space(8.0);
-        ui.horizontal(|ui| {
-            if marks > 0 {
-                ui.label(
-                    egui::RichText::new(if marks == 1 {
-                        crate::i18n::fmt(tl!("1 mark"), &[])
-                    } else {
-                        crate::i18n::fmt(tl!("{n} marks"), &[("n", &marks.to_string())])
-                    })
-                    .color(t.text_muted),
-                );
-            }
-            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                if ui.add_enabled_ui(marks > 0, |ui| widgets::pill_button(ui, tl!("Redact all"), true)).inner.clicked() {
-                    run = Some("redact.apply");
-                }
-                if ui.add_enabled_ui(marks > 0, |ui| widgets::pill_button(ui, tl!("Clear all"), false)).inner.clicked() {
-                    run = Some("redact.clear");
-                }
-            });
-        });
-    }
-    if let Some(cmd) = run {
-        app.run_command(cmd);
-    }
-}
-
-/// The page operations Edit shows as a row of icon buttons, as Acrobat's Edit panel does.
-const EDIT_PAGE_BUTTONS: [&str; 4] = ["page.rotate", "page.insert", "page.delete", "page.extract"];
-/// Add content items shown before More.
-const EDIT_CONTENT_SHOWN: usize = 5;
-/// Other options: the tools Acrobat's Edit panel links to.
-const EDIT_OTHER_TOOLS: [&str; 3] = ["combine", "redact", "form"];
-
-/// Edit a PDF, laid out as Acrobat's Edit panel: the title with Preferences and Close; Format text
-/// while text is being edited or added; Modify page as a row of icon buttons and Organize pages;
-/// Add content with the rarer items under More; and Other options, the neighbouring tools.
-/// Edit text & images itself is on the floating toolbar, and on from the moment Edit opens.
-/// Every item comes from the catalogue, so its label, icon and availability have one source.
-fn edit_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static ToolGroup) {
-    let items = || g.sections.iter().flat_map(|s| s.items.iter());
-    let item = |command: &str| items().find(|i| i.command == command);
-    let mut run = None;
-    let mut tool = None;
-    // Back to All tools only when Edit was opened from there; the Edit tab is its own way back.
-    let from_all_tools = app.mode != crate::Mode::Edit;
-    ui.horizontal(|ui| {
-        if from_all_tools && icons::button(ui, "chevron-left", 26.0, false, tl!("Back to all tools")).clicked() {
-            app.left = LeftPanel::AllTools;
-            app.enter_mode(crate::Mode::AllTools);
-        }
-        // "Edit" under the Edit tab, as Acrobat titles it; the tool's own name from All tools.
-        let title = if from_all_tools { tl!(g.label) } else { tl!("Edit") };
-        let title_width = (ui.available_width() - 2.0 * (26.0 + ui.spacing().item_spacing.x)).max(1.0);
-        ui.add_sized([title_width, 26.0], egui::Label::new(egui::RichText::new(title).font(theme::semibold(15.5)).color(t.text)).truncate())
-            .on_hover_text(title);
-        if icons::button(ui, "settings", 26.0, false, tl!("Preferences")).clicked() {
-            run = Some("app.preferences");
-        }
-        if icons::button(ui, "x", 26.0, false, tl!("Close panel")).clicked() {
-            app.left_open = false;
-        }
-    });
-    ui.add_space(4.0);
-    ui.separator();
-    ui.add_space(6.0);
-    // Several objects selected: how many, and how to move them. Acrobat's panel has no idle hint.
-    let count = app.active_ids().filter(|_| app.quick_tool == crate::QuickTool::EditText).map_or(0, |(i, _)| app.views[i].objects.count());
-    if count > 0 {
-        ui.label(crate::i18n::trn(crate::i18n::current(), count as u64, "{n} object selected", "{n} objects selected"));
-        ui.label(tl!("Drag the selection to move it. Esc clears the selection."));
-        ui.add_space(6.0);
-    }
-    // Format text at the top while text is selected or being added.
-    format_section(app, ui, t);
-    egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
-        widgets::section_title(ui, tl!("Modify page"));
-        ui.horizontal(|ui| {
-            ui.spacing_mut().item_spacing.x = 6.0;
-            for i in EDIT_PAGE_BUTTONS.iter().filter_map(|c| item(c)) {
-                // Enabled as the command itself is: a document that forbids page assembly refuses these.
-                let enabled = pdfcraft_engine::commands::command(i.command).is_some_and(|spec| app.command_enabled(spec));
-                let resp = ui.add_enabled_ui(enabled, |ui| icons::button(ui, i.icon, 34.0, false, tl!(i.label))).inner;
-                if resp.clicked() {
-                    run = Some(i.command);
-                }
-            }
-        });
-        ui.add_space(2.0);
-        // Organize pages is a workspace of its own: its panel replaces this one, with the grid.
-        if let Some(i) = item("page.organize")
-            && edit_row(ui, t, i.icon, tl!(i.label), i.availability).clicked()
-        {
-            // With no document there is no grid to open: the command asks for a file first.
-            if app.active.is_some() {
-                tool = Some("organize");
-            } else {
-                run = Some("page.organize");
-            }
-        }
-
-        widgets::section_title(ui, tl!("Add content"));
-        let content: Vec<_> =
-            g.sections.iter().filter(|s| s.title == "Add content").flat_map(|s| s.items.iter()).filter(|i| i.command != "edit.edit_text").collect();
-        let more_id = egui::Id::new("edit_panel_more");
-        let more = ui.data(|d| d.get_temp::<bool>(more_id)).unwrap_or(false);
-        let shown = if more { content.len() } else { EDIT_CONTENT_SHOWN.min(content.len()) };
-        for i in content.iter().take(shown) {
-            let resp = edit_row(ui, t, i.icon, tl!(i.label), i.availability);
-            // Header and footer, Watermark and Background open their Add / Update / Remove menu.
-            if i.actions.is_empty() {
-                if resp.clicked() {
-                    run = Some(i.command);
-                }
-            } else if let Some(cmd) = actions_menu(app, ui, &resp, i, resp.rect.right_center() - vec2(14.0, 0.0), t.text) {
-                run = Some(cmd);
-            }
-        }
-        if content.len() > EDIT_CONTENT_SHOWN {
-            ui.add_space(4.0);
-            let label = if more { tl!("Less") } else { tl!("More") };
-            let resp = ui
-                .add(
-                    egui::Label::new(egui::RichText::new(label).color(t.accent_text).font(theme::medium(13.0)))
-                        .selectable(false)
-                        .sense(Sense::click()),
-                )
-                .on_hover_cursor(egui::CursorIcon::PointingHand);
-            if resp.clicked() {
-                ui.data_mut(|d| d.insert_temp(more_id, !more));
-            }
-        }
-
-        widgets::section_title(ui, tl!("Other options"));
-        for other in EDIT_OTHER_TOOLS.iter().filter_map(|id| catalog::group(id)) {
-            if edit_row(ui, t, other.icon, tl!(other.label), other.availability).clicked() {
-                tool = Some(other.id);
-            }
-        }
-    });
-    if let Some(id) = tool {
-        app.select_tool(id);
-    }
-    if let Some(cmd) = run {
-        app.run_command(cmd);
-    }
-}
-
-/// A tool entry with further commands (Add / Update / Remove): a caret at `caret` says it opens a
-/// menu, and each command is enabled by its own needs. Returns the command chosen.
-fn actions_menu(app: &PdfCraftApp, ui: &egui::Ui, resp: &egui::Response, item: &ToolItem, caret: egui::Pos2, color: Color32) -> Option<&'static str> {
-    ui.painter().add(egui::Shape::convex_polygon(
-        vec![caret + vec2(-3.5, -2.0), caret + vec2(3.5, -2.0), caret + vec2(0.0, 2.5)],
-        color,
-        egui::Stroke::NONE,
-    ));
-    let mut run = None;
-    egui::Popup::menu(resp).show(|ui| {
-        ui.set_min_width(180.0);
-        for (n, id) in item.actions.iter().enumerate() {
-            let Some(spec) = pdfcraft_engine::commands::command(id) else { continue };
-            // Add stays usable with no document open: it asks for a file first.
-            let enabled = (n == 0 && app.active.is_none()) || app.command_enabled(spec);
-            let label = crate::i18n::menu_label(spec.id, spec.label);
-            if ui.add_enabled(enabled, egui::Button::new(label)).clicked() {
-                run = Some(spec.id);
-                ui.close();
-            }
-        }
-    });
-    run
-}
-
-/// One row of the Edit panel: a monochrome icon and the label, as Acrobat draws them. A planned
-/// item is muted and says when it ships when hovered.
-fn edit_row(ui: &mut egui::Ui, t: &Tokens, icon: &str, label: &str, availability: Availability) -> egui::Response {
-    let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label));
-    let press = theme::Press::track(ui, &resp);
-    press.wash(ui, rect, 6, false);
-    let body = rect.translate(press.offset());
-    let ready = availability == Availability::Ready;
-    let fg = if ready { t.text } else { t.text_muted };
-    icons::paint(ui, Rect::from_min_size(body.min + vec2(6.0, 8.0), vec2(18.0, 18.0)), icon, 17.0, if ready { t.text } else { t.text_faint });
-    row_label(ui, label, theme::regular(13.5), fg, body.left_center() + vec2(34.0, 0.0), rect.width() - 42.0);
-    let resp = theme::hand(resp);
-    match availability {
-        Availability::Ready => resp,
-        Availability::Planned(m) => resp.on_hover_text(format!("{} {m}", tl!("Planned for milestone"))),
-        Availability::Provider => resp.on_hover_text(tl!("Optional: needs an AI provider you configure")),
-    }
-}
-
-/// Add a stamp: Dynamic, Sign Here and Standard Business stamps; click one, then click on the
-/// page to place it.
-fn stamp_palette(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
-    use pdfcraft_engine::{StampGroup, StampKind};
-    ui.label(egui::RichText::new(tl!("Choose a stamp, then click on the page to place it.")).small().color(t.text_faint));
-    egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
-        for (group, title) in [
-            (StampGroup::Dynamic, tl!("Dynamic")),
-            (StampGroup::SignHere, tl!("Sign Here")),
-            (StampGroup::StandardBusiness, tl!("Standard Business")),
-        ] {
-            widgets::section_title(ui, title);
-            for kind in StampKind::ALL.into_iter().filter(|k| k.group() == group) {
-                let active = app.quick_tool == crate::QuickTool::Stamp(kind);
-                let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 38.0), Sense::click());
-                resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, active, kind.label()));
-                let press = theme::Press::track(ui, &resp);
-                press.wash(ui, rect, 6, active);
-                let body = rect.translate(press.offset());
-                let [r, g, b] = kind.color().map(|v| (v * 255.0) as u8);
-                let col = Color32::from_rgb(r, g, b);
-                let chip = Rect::from_min_size(body.min + vec2(8.0, 5.0), vec2((rect.width() - 16.0).min(200.0), 28.0));
-                if group == StampGroup::SignHere {
-                    let tip = chip.height() * 0.45;
-                    let pts = vec![
-                        chip.left_center(),
-                        chip.left_top() + vec2(tip, 0.0),
-                        chip.right_top(),
-                        chip.right_bottom(),
-                        chip.left_bottom() + vec2(tip, 0.0),
-                    ];
-                    ui.painter().add(egui::Shape::convex_polygon(pts, col, Stroke::NONE));
-                    let label = kind.label();
-                    let font = theme::semibold(11.0);
-                    let shown = crate::widgets::fit_line(label, (chip.width() - 10.0).max(0.0), |s| crate::widgets::text_width(ui, s, &font));
-                    ui.painter().with_clip_rect(chip.shrink(3.0)).text(
-                        chip.center() + vec2(tip / 2.0, 0.0),
-                        Align2::CENTER_CENTER,
-                        shown,
-                        font,
-                        Color32::WHITE,
-                    );
-                } else {
-                    ui.painter().rect(chip, CornerRadius::same(5), col.gamma_multiply(0.1), Stroke::new(1.5, col), egui::StrokeKind::Inside);
-                    let y = if group == StampGroup::Dynamic { chip.center().y - 4.0 } else { chip.center().y };
-                    let font = theme::semibold(11.0);
-                    let shown = crate::widgets::fit_line(kind.label(), (chip.width() - 10.0).max(0.0), |s| crate::widgets::text_width(ui, s, &font));
-                    ui.painter().with_clip_rect(chip.shrink(3.0)).text(egui::pos2(chip.center().x, y), Align2::CENTER_CENTER, shown, font, col);
-                    if group == StampGroup::Dynamic {
-                        let by = "By name at time, date";
-                        let by_font = theme::regular(7.5);
-                        let by_shown = crate::widgets::fit_line(by, (chip.width() - 8.0).max(0.0), |s| crate::widgets::text_width(ui, s, &by_font));
-                        ui.painter().with_clip_rect(chip.shrink(2.0)).text(
-                            egui::pos2(chip.center().x, chip.bottom() - 6.0),
-                            Align2::CENTER_CENTER,
-                            by_shown,
-                            by_font,
-                            col,
-                        );
-                    }
-                }
-                if theme::hand(resp).clicked() {
-                    app.quick_tool = crate::QuickTool::Stamp(kind);
-                }
-            }
-        }
-        crate::stamps_ui::palette_section(app, ui, t);
-    });
-}
-
-/// Edit a PDF ▸ Format text: for the selected added text (one undoable change), or the style
-/// new text gets.
-fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
-    // Editing a paragraph of existing text: its formatting, applied as it changes.
-    if let Some((i, _)) = app.active_ids()
-        && let Some(ed) = app.views[i].line_editor.clone()
-    {
-        use crate::format_text_ui::{FontChoice, Fonts};
-        let mut ed = ed;
-        let sources: Vec<(String, String)> = app
-            .session
-            .get(app.views[i].id)
-            .map(|d| d.text_editor_fonts(ed.page))
-            .unwrap_or_default()
-            .into_iter()
-            .map(|f| (f.resource, f.face))
-            .collect();
-        let shown = ed.font_shown(&sources);
-        let out = crate::format_text_ui::panel(ui, t, &mut ed.look, Some(&mut ed.extras), Fonts { sources: Some(&sources), shown });
-        let mut changed = out.changed;
-        match out.font {
-            Some(FontChoice::KeepSource) => {
-                ed.keep_source_font();
-                changed = true;
-            }
-            Some(FontChoice::Resource(resource)) => {
-                ed.font_resource = Some(resource);
-                changed = true;
-            }
-            Some(FontChoice::Family(family)) => {
-                ed.choose_family(family);
-                changed = true;
-            }
-            Some(FontChoice::Load) => app.pick_files(crate::files::FilePurpose::TextFont { page: ed.page }, false),
-            #[cfg(not(target_arch = "wasm32"))]
-            Some(FontChoice::Installed(path)) => app.use_paths(crate::files::FilePurpose::TextFont { page: ed.page }, &[path]),
-            #[cfg(target_arch = "wasm32")]
-            Some(FontChoice::Installed(_)) => {}
-            None => {}
-        }
-        if changed {
-            app.apply_line_format(i, ed, Some(ui.ctx()));
-        }
-        return;
-    }
-    let image = app.active_ids().and_then(|(i, id)| {
-        let (page, index) = app.views[i].content.selected?;
-        let doc = app.session.get(id)?;
-        match &doc.added().iter().filter(|a| a.page == page).nth(index)?.content {
-            pdfcraft_engine::AddedContent::Image(img) => Some((page, index, img.clone())),
-            _ => None,
-        }
-    });
-    if let Some((page, index, img)) = image {
-        match crate::content_ui::image_panel(ui, t, &img) {
-            Some(crate::content_ui::ImageAction::Update(content)) => {
-                app.apply_edit(pdfcraft_engine::Edit::UpdateContent { page, index, content });
-            }
-            Some(crate::content_ui::ImageAction::Replace) => app.replace_image_dialog(page, index),
-            None => {}
-        }
-        ui.add_space(6.0);
-        ui.separator();
-        return;
-    }
-    let selected = app.active_ids().and_then(|(i, id)| {
-        let (page, index) = app.views[i].content.selected?;
-        let doc = app.session.get(id)?;
-        let a = doc.added().iter().filter(|a| a.page == page).nth(index)?;
-        match &a.content {
-            pdfcraft_engine::AddedContent::Text(text) => Some((page, index, text.clone())),
-            _ => None,
-        }
-    });
-    match selected {
-        Some((page, index, text)) => {
-            let mut style = text.clone();
-            added_text_format(ui, t, &mut style);
-            if style != text {
-                // The reusable style follows the selection only when the edit took, so a refused one adds nothing odd later.
-                if app.apply_edit(pdfcraft_engine::Edit::UpdateContent { page, index, content: pdfcraft_engine::AddedContent::Text(style.clone()) }) {
-                    app.text_style = pdfcraft_engine::AddedText { text: String::new(), rect: [0.0; 4], ..style };
-                }
-            }
-        }
-        None if app.quick_tool == crate::QuickTool::AddText => {
-            crate::content_ui::hint(ui, t);
-            let mut style = app.text_style.clone();
-            added_text_format(ui, t, &mut style);
-            app.text_style = style;
-        }
-        None => {}
-    }
-}
-
-/// Format text for added text: the standard families, size, colour, style and alignment.
-fn added_text_format(ui: &mut egui::Ui, t: &Tokens, style: &mut pdfcraft_engine::AddedText) {
-    let shown = style.family.label().to_string();
-    let out = crate::format_text_ui::panel(ui, t, style, None, crate::format_text_ui::Fonts { sources: None, shown });
-    if let Some(crate::format_text_ui::FontChoice::Family(family)) = out.font {
-        style.family = family;
-    }
-}
-
-impl PdfCraftApp {
-    /// Apply the open paragraph's formatting as one change; the paragraph stays open.
-    pub(crate) fn apply_line_format(&mut self, index: usize, mut ed: crate::edit_text_ui::LineEditor, ctx: Option<&egui::Context>) {
-        let edit = pdfcraft_engine::Edit::EditTextBlock { page: ed.page, block: ed.block, text: ed.text.clone(), style: ed.style() };
-        if self.apply_edit(edit) {
-            ed.applied();
-            if let Some(doc) = self.session.get(self.views[index].id)
-                && let Some(block) = doc.text_blocks(ed.page).get(ed.block)
-            {
-                ed.refresh_source(block, doc.text_lines(ed.page));
-                if let Some(ctx) = ctx {
-                    ed.fonts = crate::edit_text_ui::install_source_fonts(ctx, doc, ed.page);
-                }
-            }
-        }
-        self.views[index].line_editor = Some(ed);
-    }
-}
+pub use bookmarks::BmAction;
+pub(crate) use bookmarks::ellipsized_prefix;
+pub use right::right_panel;
+pub use tools::left_panel;
+pub(crate) use tools::panel_header;
 
 // ───────────────────────────────────────────────────────────────────────────── right panels
 
@@ -648,1083 +36,6 @@ pub(crate) enum Nav {
     Flash(usize, [f32; 4]),
 }
 
-pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
-    let t = Tokens::get(ui.ctx());
-    let Some((index, id)) = app.active_ids() else { return };
-    let Some(panel) = app.right else { return };
-    let mut nav: Option<Nav> = None;
-    let mut close = false;
-    let mut toggle_layer: Option<(usize, bool)> = None;
-    let mut reset_layers = false;
-    let mut attachment_action: Option<(usize, bool)> = None; // (index, open instead of save)
-    let mut bm_action: Option<BmAction> = None;
-    let mut bm_expand: Option<usize> = None;
-    let mut panel_edit: Option<pdfcraft_engine::Edit> = None;
-    let mut field_properties = None;
-    let mut panel_command: Option<&'static str> = None;
-    let mut sig_action: Option<crate::sign_ui::PanelAction> = None;
-    let mut a11y_action: Option<crate::a11y_ui::PanelAction> = None;
-    let mut compare_action: Option<crate::compare_ui::PanelAction> = None;
-    let mut bm_rename = app.bookmark_rename.clone();
-    let bm_editable = app.session.get(id).is_some_and(|d| d.allows_assembly() && d.read_only_reason.is_none());
-    // Prepare a form is open: the Fields panel orders tabs.
-    let preparing = app.is_preparing();
-    {
-        let Some(doc) = app.session.get(id) else { return };
-        let info = &doc.info;
-        let view = &mut app.views[index];
-        let prefs = &app.comment_prefs;
-        let sig_expanded = &mut app.sig_expanded;
-        let a11y = &mut app.a11y;
-        let tags_state = &mut app.tags_state;
-        let compare = &app.compare;
-        let comment_allowed = doc.allows_annotation();
-        // A dialog or the palette owns the keyboard: the panel leaves Escape to it.
-        let modal = app.dialog.is_some() || app.palette_open;
-        egui::Frame::NONE
-            .fill(t.panel)
-            .inner_margin(egui::Margin { left: 14, right: 12, top: 12, bottom: 8 })
-            .stroke(Stroke::new(1.0, t.divider))
-            .show(ui, |ui| {
-                let (title, count) = match panel {
-                    RightPanel::Comments => ("Comments", Some(crate::comments_panel::count(info))),
-                    RightPanel::Bookmarks => ("Bookmarks", None),
-                    RightPanel::Pages => ("Pages", Some(info.pages.len())),
-                    RightPanel::Fields => ("Fields", Some(info.fields.len())),
-                    RightPanel::Layers => ("Layers", Some(info.layers.len())),
-                    RightPanel::Attachments => ("Attachments", Some(info.attachments.len())),
-                    RightPanel::Signatures => ("Signatures", Some(doc.signatures.iter().filter(|s| s.signed).count())),
-                    RightPanel::Accessibility => ("Accessibility Checker", None),
-                    RightPanel::Tags => ("Tags", None),
-                    RightPanel::Search => ("Search", None),
-                    RightPanel::Compare => ("Compare", compare.as_ref().filter(|c| c.new == id).map(|c| c.result.changes.len())),
-                };
-                ui.horizontal(|ui| {
-                    ui.label(egui::RichText::new(tl!(title)).font(theme::semibold(15.5)));
-                    if let Some(c) = count {
-                        ui.label(egui::RichText::new(c.to_string()).font(theme::medium(13.0)).color(t.text_faint));
-                    }
-                    if panel == RightPanel::Pages && view.selected.len() > 1 {
-                        let n = view.selected.len().to_string();
-                        let picked = crate::i18n::fmt(tl!("{n} pages selected"), &[("n", &n)]);
-                        ui.label(egui::RichText::new(picked).font(theme::medium(12.0)).color(t.accent_text));
-                    }
-                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-                        if icons::button(ui, "x", 26.0, false, tl!("Close")).clicked() {
-                            close = true;
-                        }
-                        // Right to left: close, "…", filter, search (Acrobat's order left to right).
-                        if panel == RightPanel::Comments {
-                            panel_command = crate::comments_panel::header_controls(ui, info, view, doc.comments_hidden());
-                        }
-                        if panel == RightPanel::Comments
-                            && icons::button(ui, "search", 26.0, view.comments.search.is_some(), tl!("Search comments")).clicked()
-                        {
-                            view.comments.search = match view.comments.search {
-                                Some(_) => None,
-                                None => Some(String::new()),
-                            };
-                            view.comments.search_focus = true;
-                        }
-                        if panel == RightPanel::Bookmarks && (bm_editable || !info.outline.is_empty()) {
-                            let more = icons::button(ui, "ellipsis", 26.0, false, tl!("Bookmark options"));
-                            egui::Popup::menu(&more).show(|ui| {
-                                ui.set_min_width(200.0);
-                                if bm_editable && ui.button(tl!("New bookmarks from structure")).clicked() {
-                                    bm_action = Some(BmAction::FromStructure);
-                                    ui.close();
-                                }
-                                if !info.outline.is_empty() {
-                                    for (levels, label) in [
-                                        (usize::MAX, tl!("Expand all bookmarks")),
-                                        (1, tl!("Expand top-level bookmarks")),
-                                        (0, tl!("Collapse all bookmarks")),
-                                    ] {
-                                        if ui.button(label).clicked() {
-                                            bm_expand = Some(levels);
-                                            ui.close();
-                                        }
-                                    }
-                                }
-                            });
-                        }
-                        if panel == RightPanel::Layers && !info.layers.is_empty() {
-                            let more = icons::button(ui, "ellipsis", 26.0, false, tl!("Layer options"));
-                            egui::Popup::menu(&more).show(|ui| {
-                                ui.set_min_width(200.0);
-                                if ui.button(tl!("Reset to Initial Visibility")).clicked() {
-                                    reset_layers = true;
-                                    ui.close();
-                                }
-                            });
-                        }
-                        let new_tip = crate::commands::command_tip(ui.ctx(), tl!("New bookmark ({key})"), "bookmark.add");
-                        if panel == RightPanel::Bookmarks && bm_editable && icons::button(ui, "bookmark-plus", 26.0, false, &new_tip).clicked() {
-                            bm_action = Some(BmAction::New);
-                        }
-                    });
-                });
-                ui.add_space(6.0);
-                let search_id = egui::Id::new(("bookmark_search", id.0));
-                let mut bookmark_query = ui.data(|d| d.get_temp::<String>(search_id)).unwrap_or_default();
-                if panel == RightPanel::Bookmarks && !info.outline.is_empty() {
-                    ui.horizontal(|ui| {
-                        const CLEAR: f32 = 26.0;
-                        let label = ui.label(tl!("Search"));
-                        let previous = bookmark_query.clone();
-                        // The panel keeps whatever width its content used, so this row must fit
-                        // exactly: any overflow would widen the panel again on every repaint.
-                        let width = ui.available_width() - CLEAR - ui.spacing().item_spacing.x;
-                        let response = ui.add(egui::TextEdit::singleline(&mut bookmark_query).desired_width(width)).labelled_by(label.id);
-                        response.widget_info(|| {
-                            let mut info = egui::WidgetInfo::text_edit(ui.is_enabled(), &previous, &bookmark_query, "");
-                            info.label = Some(tl!("Search").to_string());
-                            info
-                        });
-                        if icons::button(ui, "x", CLEAR, false, tl!("Clear")).clicked() {
-                            bookmark_query.clear();
-                        }
-                    });
-                    ui.data_mut(|d| d.insert_temp(search_id, bookmark_query.clone()));
-                    ui.add_space(6.0);
-                }
-                let bookmark_query = pdfcraft_render::text::fold_case(bookmark_query.trim());
-                let mut bookmark_matches =
-                    if panel == RightPanel::Bookmarks { outline_matches(&info.outline, &bookmark_query) } else { std::collections::HashSet::new() };
-                // A new bookmark must stay nameable even when its initial title doesn't match.
-                if let Some((path, _)) = &bm_rename {
-                    let mut ancestor = path.clone();
-                    while !ancestor.is_empty() {
-                        bookmark_matches.insert(ancestor.clone());
-                        ancestor.pop();
-                    }
-                }
-                if panel == RightPanel::Pages {
-                    let enabled = !modal && view.panel_drag.is_none();
-                    thumbnail_size(ui, &t, view, enabled);
-                }
-                egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| match panel {
-                    RightPanel::Comments => {
-                        if let Some(e) = crate::comments_panel::show(ui, &t, info, view, prefs, comment_allowed, &mut nav) {
-                            panel_edit = Some(e);
-                        }
-                    }
-                    RightPanel::Bookmarks => {
-                        if info.outline.is_empty() {
-                            empty(ui, &t, "bookmark", "This document has no bookmarks.");
-                        }
-                        let mut ctx = OutlineCtx {
-                            nav: &mut nav,
-                            action: &mut bm_action,
-                            rename: &mut bm_rename,
-                            editable: bm_editable,
-                            current: view.current,
-                            expand: bm_expand,
-                            matches: &bookmark_matches,
-                            searching: !bookmark_query.is_empty(),
-                        };
-                        if ctx.searching && bookmark_matches.is_empty() && !info.outline.is_empty() {
-                            ui.label(tl!("No matches."));
-                        }
-                        for (i, item) in info.outline.iter().enumerate() {
-                            outline_item(ui, &t, info, item, &[i], info.outline.len(), &mut ctx);
-                        }
-                        if info.outline_more {
-                            ui.label(tl!("Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth."));
-                        }
-                    }
-                    RightPanel::Pages => pages(ui, &t, info, view, modal, bm_editable, &mut nav),
-                    RightPanel::Fields => field_properties = fields(ui, &t, info, &doc.form, preparing, &mut view.prepare, &mut nav, &mut panel_edit),
-                    RightPanel::Layers => {
-                        if info.layers.is_empty() {
-                            empty(ui, &t, "layers", "This document has no layers.");
-                        }
-                        for (li, l) in info.layers.iter().enumerate() {
-                            let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 32.0), Sense::click());
-                            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, l.visible, &l.name));
-                            let press = theme::Press::track(ui, &resp);
-                            press.wash(ui, rect, 6, false);
-                            let body = rect.translate(press.offset());
-                            icons::paint(
-                                ui,
-                                Rect::from_min_size(body.min + vec2(4.0, 7.0), vec2(18.0, 18.0)),
-                                if l.visible { "eye" } else { "eye-off" },
-                                16.0,
-                                t.icon,
-                            );
-                            let fg = if l.visible { t.text } else { t.text_faint };
-                            crate::widgets::paint_left(
-                                ui,
-                                body.left_center() + vec2(32.0, 0.0),
-                                &l.name,
-                                theme::regular(13.0),
-                                fg,
-                                (rect.width() - 40.0).max(0.0),
-                            );
-                            if theme::hand(resp).on_hover_text(if l.visible { tl!("Hide layer") } else { tl!("Show layer") }).clicked() {
-                                toggle_layer = Some((li, !l.visible));
-                            }
-                        }
-                    }
-                    RightPanel::Signatures => {
-                        sig_action = crate::sign_ui::panel(ui, &t, &doc.signatures, sig_expanded);
-                    }
-                    RightPanel::Accessibility => {
-                        a11y_action = crate::a11y_ui::panel(ui, &t, a11y, id);
-                    }
-                    RightPanel::Tags => {
-                        let tags = tags_state.tags(doc);
-                        let content = tags_state.content(doc);
-                        let (page, edit) = crate::tags_ui::panel(ui, &t, id, &tags, &content, tags_state, doc.allows_modification());
-                        if let Some(page) = page {
-                            nav = Some(Nav::Page(page));
-                        }
-                        panel_edit = edit;
-                    }
-                    RightPanel::Search => crate::search_ui::panel(ui, &t, view, info.pages.len()),
-                    RightPanel::Compare => compare_action = crate::compare_ui::panel(ui, &t, compare, id),
-                    RightPanel::Attachments => {
-                        let attachable = doc.allows_modification() && doc.read_only_reason.is_none();
-                        if attachable {
-                            egui::Frame::NONE.inner_margin(egui::Margin::symmetric(4, 6)).show(ui, |ui| {
-                                if ui.add(egui::Button::new(tl!("Attach a file…"))).clicked() {
-                                    panel_command = Some("edit.attach");
-                                }
-                            });
-                        }
-                        if info.attachments.is_empty() {
-                            empty(ui, &t, "paperclip", "This document has no attachments.");
-                        }
-                        for (ai, a) in info.attachments.iter().enumerate() {
-                            egui::Frame::NONE.inner_margin(egui::Margin::symmetric(4, 6)).show(ui, |ui| {
-                                ui.horizontal(|ui| {
-                                    ui.add(icons::image("paperclip", 16.0, t.icon));
-                                    ui.vertical(|ui| {
-                                        ui.set_width(ui.available_width() - 70.0);
-                                        ui.add(egui::Label::new(egui::RichText::new(&a.name).font(theme::medium(13.0))).truncate());
-                                        let mut meta = a.size.map(human_size).unwrap_or_default();
-                                        if let pdfcraft_render::AttachmentSource::Annotation { page, .. } = a.source {
-                                            let on_page = crate::i18n::fmt(
-                                                tl!("on page {label}"),
-                                                &[("label", info.pages.get(page).map(|p| p.label.as_str()).unwrap_or("?"))],
-                                            );
-                                            meta = format!("{meta}  ·  {on_page}");
-                                        }
-                                        if let Some(d) = &a.description {
-                                            meta = format!("{meta}  ·  {d}");
-                                        }
-                                        ui.add(egui::Label::new(egui::RichText::new(meta).color(t.text_faint).small()).truncate());
-                                    });
-                                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-                                        if icons::button(ui, "file-down", 28.0, false, tl!("Save attachment…")).clicked() {
-                                            attachment_action = Some((ai, false));
-                                        }
-                                        if a.name.to_lowercase().ends_with(".pdf")
-                                            && icons::button(ui, "file-input", 28.0, false, tl!("Open in a new tab")).clicked()
-                                        {
-                                            attachment_action = Some((ai, true));
-                                        }
-                                        if let pdfcraft_render::AttachmentSource::Document { key } = &a.source
-                                            && attachable
-                                            && icons::button(ui, "trash-2", 28.0, false, tl!("Delete attachment")).clicked()
-                                        {
-                                            panel_edit = Some(pdfcraft_engine::Edit::DeleteAttachment { key: key.clone() });
-                                        }
-                                    });
-                                });
-                            });
-                        }
-                    }
-                });
-            });
-    }
-    if close {
-        app.choose_right_panel(None);
-    }
-    if let Some(e) = panel_edit {
-        app.apply_edit(e);
-    }
-    if let Some((name, widget)) = field_properties {
-        app.open_field_props(&name, widget);
-    }
-    if let Some(c) = panel_command {
-        app.run_command(c);
-    }
-    if let Some(a) = a11y_action {
-        app.a11y_action(index, a);
-    }
-    if let Some(a) = compare_action {
-        app.compare_action(index, a);
-    }
-    match sig_action {
-        Some(crate::sign_ui::PanelAction::Validate) => app.run_command("sign.validate"),
-        Some(crate::sign_ui::PanelAction::GoTo(p)) => app.views[index].go_to_page(p),
-        Some(crate::sign_ui::PanelAction::Trust(c)) => app.trust_certificate(*c),
-        Some(crate::sign_ui::PanelAction::ViewCertificate(chain)) => {
-            app.cert_viewer = Some(crate::sign_ui::CertViewer { chain, selected: 0, tab: crate::sign_ui::CertTab::Summary });
-            app.dialog = Some(crate::Dialog::CertificateViewer);
-        }
-        Some(crate::sign_ui::PanelAction::ViewSigned { len, revision }) => app.view_signed_version(len, revision),
-        Some(crate::sign_ui::PanelAction::Sign(field)) => {
-            let page = app.views[index].current;
-            app.start_signing(page, None, Some(field), None);
-        }
-        Some(crate::sign_ui::PanelAction::ExportCertificate(c)) => {
-            app.export_certificate(&c);
-        }
-        None => {}
-    }
-    if let Some((p, i)) = app.views.get_mut(index).and_then(|v| v.comments.default_request.take()) {
-        app.make_comment_default(p, i);
-    }
-    if let Some((p, i, open)) = app.views.get_mut(index).and_then(|v| v.comments.attachment_request.take()) {
-        app.comment_attachment_action(id, p, i, open);
-    }
-    if let Some((p, i)) = app.views.get_mut(index).and_then(|v| v.comments.props_request.take()) {
-        app.open_comment_props(p, i);
-    }
-    app.bookmark_rename = bm_rename;
-    if let Some(a) = bm_action {
-        app.bookmark_action(a);
-    }
-    if let Some((ai, open)) = attachment_action {
-        app.attachment_action(id, ai, open);
-    }
-    if let Some((layer, visible)) = toggle_layer
-        && app.session.set_layer_visible(id, layer, visible)
-    {
-        app.views[index].invalidate_content();
-    }
-    if reset_layers && app.session.reset_layers(id) {
-        app.views[index].invalidate_content();
-    }
-    match nav {
-        Some(Nav::Page(p)) => app.views[index].go_to_page(p),
-        Some(Nav::Dest(p, dest)) => match app.session.get(id) {
-            Some(doc) => app.views[index].go_to_dest(p, dest, &doc.info),
-            None => app.views[index].go_to_page(p),
-        },
-        Some(Nav::Flash(p, r)) => {
-            let v = &mut app.views[index];
-            if let Some(doc) = app.session.get(id) {
-                v.reveal_rect(p, r, &doc.info);
-            } else {
-                v.go_to_page(p);
-            }
-            v.flash = Some((p, r, 0.0));
-        }
-        None => {}
-    }
-}
-
-fn empty(ui: &mut egui::Ui, t: &Tokens, icon: &str, text: &str) {
-    ui.add_space(40.0);
-    ui.vertical_centered(|ui| {
-        ui.add(icons::image(icon, 36.0, t.text_faint));
-        ui.add_space(8.0);
-        // Every empty-panel message goes through here.
-        ui.label(egui::RichText::new(tl!(text)).color(t.text_muted));
-    });
-}
-
-/// What the user asked to do with a bookmark (applied after the panel is drawn).
-#[derive(Clone, Debug, PartialEq)]
-pub enum BmAction {
-    /// New "Untitled" bookmark for the current page, after the selected one (⌘B).
-    New,
-    StartRename(Vec<usize>),
-    Rename(Vec<usize>, String),
-    SetToCurrentPage(Vec<usize>),
-    /// Make the title bold or italic or not (`None` keeps that one).
-    SetStyle(Vec<usize>, Option<bool>, Option<bool>),
-    /// Colour the title; black is the default.
-    SetColor(Vec<usize>, [f64; 3]),
-    Delete(Vec<usize>),
-    MoveUp(Vec<usize>),
-    MoveDown(Vec<usize>),
-    /// Make it the last child of the bookmark above it.
-    Indent(Vec<usize>),
-    /// Move it out to follow its parent.
-    Outdent(Vec<usize>),
-    /// Bookmarks from the tagged headings, under a new first "Untitled" bookmark.
-    FromStructure,
-}
-
-/// Matching titles plus their ancestors, keeping document paths rather than filtered indexes.
-/// `query` is folded with [`pdfcraft_render::text::fold_case`], as titles are here.
-fn outline_matches(items: &[OutlineItem], query: &str) -> std::collections::HashSet<Vec<usize>> {
-    let mut matches = std::collections::HashSet::new();
-    if query.is_empty() {
-        return matches;
-    }
-    let mut pending: Vec<_> = items.iter().enumerate().map(|(i, item)| (vec![i], item)).collect();
-    while let Some((path, item)) = pending.pop() {
-        if pdfcraft_render::text::fold_case(&item.title).contains(query) {
-            let mut ancestor = path.clone();
-            while !ancestor.is_empty() {
-                matches.insert(ancestor.clone());
-                ancestor.pop();
-            }
-        }
-        for (i, child) in item.children.iter().enumerate() {
-            let mut child_path = path.clone();
-            child_path.push(i);
-            pending.push((child_path, child));
-        }
-    }
-    matches
-}
-
-struct OutlineCtx<'a> {
-    nav: &'a mut Option<Nav>,
-    action: &'a mut Option<BmAction>,
-    rename: &'a mut Option<(Vec<usize>, String)>,
-    editable: bool,
-    current: usize,
-    /// Expand all (`Some(usize::MAX)`), collapse all (`Some(0)`) or expand to a depth, this frame.
-    expand: Option<usize>,
-    matches: &'a std::collections::HashSet<Vec<usize>>,
-    searching: bool,
-}
-
-/// The destination page label gets its own right-aligned column in a bookmark row; drawing
-/// tools put whole section titles in /PageLabels, so the column is bounded (#124).
-const LABEL_COLUMN_MAX: f32 = 72.0;
-/// More characters than ever fit [`LABEL_COLUMN_MAX`] at the label size.
-const LABEL_MEASURE_CHARS: usize = 64;
-
-/// The longest head of `text` that `fits`, plus an ellipsis when the whole string doesn't.
-/// Whole characters are dropped from the end, so the string is only ever cut at a char
-/// boundary, and the loop always ends (at the ellipsis alone). A label is document text: only
-/// its first [`LABEL_MEASURE_CHARS`] characters are measured, so a huge one can't make each
-/// frame lay out thousands of candidates.
-pub(crate) fn ellipsized_prefix(text: &str, mut fits: impl FnMut(&str) -> bool) -> String {
-    let mut s: String = text.chars().take(LABEL_MEASURE_CHARS).collect();
-    if s.len() == text.len() && fits(text) {
-        return text.to_owned();
-    }
-    loop {
-        s.pop();
-        let candidate = format!("{s}\u{2026}");
-        if s.is_empty() || fits(&candidate) {
-            return candidate;
-        }
-    }
-}
-
-/// How a bookmark's title is drawn: in its own style and colour (ISO 32000-2 §12.3.3, Tables 151
-/// and 152), bold in the heavier face and italic slanted, its colour kept readable on the panel.
-/// Top-level bookmarks without a style keep the medium face.
-fn title_format(item: &OutlineItem, depth: usize, t: &Tokens) -> egui::TextFormat {
-    let font_id = match (item.bold, depth) {
-        (true, _) => theme::semibold(13.0),
-        (false, 0) => theme::medium(13.0),
-        (false, _) => theme::regular(13.0),
-    };
-    let color = item.color.map_or(t.text, |rgb| {
-        // Each component is within 0–1, so the rounded value fits a byte.
-        let [r, g, b] = rgb.map(|c| (c * 255.0).round() as u8);
-        theme::readable(egui::Color32::from_rgb(r, g, b), t.panel, t.text)
-    });
-    egui::TextFormat { font_id, color, italics: item.italic, ..Default::default() }
-}
-
-fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineItem, path: &[usize], siblings: usize, cx: &mut OutlineCtx<'_>) {
-    if cx.searching && !cx.matches.contains(path) {
-        return;
-    }
-    let depth = path.len() - 1;
-    let indent = depth as f32 * 16.0;
-    let id = ui.id().with(("outline", path));
-    if let Some(levels) = cx.expand {
-        ui.data_mut(|d| d.insert_temp(id, depth < levels));
-    }
-    let mut open = cx.searching || ui.data(|d| d.get_temp::<bool>(id)).unwrap_or(item.open || depth == 0);
-    let x_text = indent + 20.0;
-    if let Some((rpath, text)) = cx.rename.as_mut()
-        && rpath.as_slice() == path
-    {
-        // Inline rename: Enter commits, Escape cancels.
-        let mut commit = None;
-        let mut cancel = false;
-        ui.horizontal(|ui| {
-            ui.add_space(x_text);
-            crate::widgets::begin_dialog(ui);
-            let edit = crate::widgets::line(text).desired_width(ui.available_width() - 8.0).id(id.with("rename"));
-            let resp = ui.add(edit);
-            if !resp.has_focus() && !resp.lost_focus() {
-                resp.request_focus();
-            }
-            if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                cancel = true;
-            } else if resp.lost_focus() {
-                commit = Some(text.trim().to_string());
-            }
-        });
-        if cancel {
-            *cx.rename = None;
-        } else if let Some(title) = commit {
-            *cx.rename = None;
-            if !title.is_empty() && title != item.title {
-                *cx.action = Some(BmAction::Rename(path.to_vec(), title));
-            }
-        }
-    } else {
-        // The page label sits right-aligned in its own bounded column, and the title wraps to
-        // what is really left of it — a long label painted over a long title was the overlap
-        // of #124.
-        let label_font = theme::regular(11.0);
-        let label_galley = item.page.and_then(|p| info.pages.get(p)).map(|page| {
-            ui.fonts_mut(|f| {
-                let text =
-                    ellipsized_prefix(&page.label, |s| f.layout_no_wrap(s.to_owned(), label_font.clone(), t.text_faint).size().x <= LABEL_COLUMN_MAX);
-                f.layout_no_wrap(text, label_font, t.text_faint)
-            })
-        });
-        let label_w = label_galley.as_ref().map_or(0.0, |g| g.size().x);
-        let wrap_w = (ui.available_width() - indent - 20.0 - label_w - 12.0).max(60.0);
-        let mut job = egui::text::LayoutJob::single_section(item.title.clone(), title_format(item, depth, t));
-        job.wrap.max_width = wrap_w;
-        let galley = ui.fonts_mut(|f| f.layout_job(job));
-        let h = (galley.size().y + 12.0).max(28.0);
-        let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), h), Sense::click());
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &item.title));
-        theme::Press::track(ui, &resp).wash(ui, rect, 6, false);
-        let x0 = rect.left() + indent;
-        if !item.children.is_empty() {
-            let tri = Rect::from_min_size(pos2(x0, rect.top() + 6.0), vec2(16.0, 16.0));
-            icons::paint(ui, tri, if open { "chevron-down" } else { "chevron-right" }, 14.0, t.text_muted);
-            if !cx.searching && ui.interact(tri, id.with("tri"), Sense::click()).clicked() {
-                open = !open;
-                ui.data_mut(|d| d.insert_temp(id, open));
-            }
-        }
-        ui.painter().galley(pos2(x0 + 20.0, rect.top() + 6.0), galley, t.text);
-        if let Some(g) = label_galley {
-            // Right-aligned, vertically centred at the first line, inside the column the title
-            // wrapped around.
-            let pos = pos2(rect.right() - 6.0 - g.size().x, rect.top() + 14.0 - g.size().y / 2.0);
-            ui.painter().galley(pos, g, t.text_faint);
-        }
-        if theme::hand(resp.clone()).clicked()
-            && let Some(p) = item.page
-        {
-            *cx.nav = Some(Nav::Dest(p, item.view));
-        }
-        if resp.double_clicked() && cx.editable {
-            *cx.action = Some(BmAction::StartRename(path.to_vec()));
-        }
-        if cx.editable
-            && let Some(&i) = path.last()
-        {
-            let current = cx.current;
-            resp.context_menu(|ui| {
-                let mut pick = |ui: &mut egui::Ui, label: &str, enabled: bool, a: BmAction| {
-                    if ui.add_enabled(enabled, egui::Button::new(tl!(label))).clicked() {
-                        *cx.action = Some(a);
-                        ui.close();
-                    }
-                };
-                pick(ui, tl!("Rename"), true, BmAction::StartRename(path.to_vec()));
-                let set_page = crate::i18n::fmt(tl!("Set to current page ({n})"), &[("n", &(current + 1).to_string())]);
-                pick(ui, &set_page, true, BmAction::SetToCurrentPage(path.to_vec()));
-                // The title's style and colour (ISO 32000-2 §12.3.3, Tables 151 and 152).
-                let mut styled = None;
-                ui.menu_button(tl!("Style"), |ui| {
-                    let (mut bold, mut italic) = (item.bold, item.italic);
-                    if ui.add(crate::widgets::checkbox(&mut bold, tl!("Bold"))).clicked() {
-                        styled = Some(BmAction::SetStyle(path.to_vec(), Some(bold), None));
-                    }
-                    if ui.add(crate::widgets::checkbox(&mut italic, tl!("Italic"))).clicked() {
-                        styled = Some(BmAction::SetStyle(path.to_vec(), None, Some(italic)));
-                    }
-                });
-                ui.menu_button(tl!("Colour"), |ui| {
-                    let current = item.color.map_or([0.0; 3], |c| c.map(f64::from));
-                    if let Some(c) = crate::comments::swatch_grid(ui, Some(current)) {
-                        styled = Some(BmAction::SetColor(path.to_vec(), c));
-                    }
-                });
-                if styled.is_some() {
-                    ui.close();
-                }
-                ui.separator();
-                pick(ui, tl!("Move up"), i > 0, BmAction::MoveUp(path.to_vec()));
-                pick(ui, tl!("Move down"), i + 1 < siblings, BmAction::MoveDown(path.to_vec()));
-                pick(ui, tl!("Indent"), i > 0, BmAction::Indent(path.to_vec()));
-                pick(ui, tl!("Outdent"), depth > 0, BmAction::Outdent(path.to_vec()));
-                ui.separator();
-                pick(ui, tl!("Delete"), true, BmAction::Delete(path.to_vec()));
-                if let Some(a) = styled {
-                    *cx.action = Some(a);
-                }
-            });
-        }
-    }
-    if open {
-        for (ci, c) in item.children.iter().enumerate() {
-            let mut p = path.to_vec();
-            p.push(ci);
-            outline_item(ui, t, info, c, &p, item.children.len(), cx);
-        }
-    }
-}
-
-/// Size controls stay above the scroll area, so they remain reachable on long documents.
-fn thumbnail_size(ui: &mut egui::Ui, t: &Tokens, view: &mut crate::DocView, enabled: bool) {
-    let before = view.thumbnail_zoom();
-    let mut zoom = before;
-    let label = ui
-        .horizontal(|ui| {
-            let label = ui.label(egui::RichText::new(tl!("Thumbnail size")).small().color(t.text_muted));
-            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-                ui.label(egui::RichText::new(format!("{:.0}%", before * 100.0)).small().color(t.text_muted));
-            });
-            label
-        })
-        .inner;
-    ui.add_enabled_ui(enabled, |ui| {
-        ui.spacing_mut().slider_width = (ui.available_width() - 52.0 - 2.0 * ui.spacing().item_spacing.x).max(1.0);
-        ui.horizontal(|ui| {
-            if ui
-                .add_enabled_ui(zoom > *crate::canvas::THUMBNAIL_ZOOM_RANGE.start(), |ui| {
-                    icons::button(ui, "zoom-out", 26.0, false, tl!("Smaller thumbnails"))
-                })
-                .inner
-                .clicked()
-            {
-                zoom -= 0.25;
-            }
-            let mut percent = zoom * 100.0;
-            let range = (*crate::canvas::THUMBNAIL_ZOOM_RANGE.start() * 100.0)..=(*crate::canvas::THUMBNAIL_ZOOM_RANGE.end() * 100.0);
-            ui.scope(|ui| {
-                // The regular field fill blends into this panel; keep the slider's full rail visible.
-                ui.visuals_mut().widgets.inactive.bg_fill = t.border;
-                let slider = ui.add(egui::Slider::new(&mut percent, range).step_by(1.0).show_value(false).trailing_fill(true)).labelled_by(label.id);
-                slider.widget_info(|| egui::WidgetInfo::slider(ui.is_enabled(), f64::from(percent), tl!("Thumbnail size")));
-            });
-            zoom = percent / 100.0;
-            if ui
-                .add_enabled_ui(zoom < *crate::canvas::THUMBNAIL_ZOOM_RANGE.end(), |ui| {
-                    icons::button(ui, "zoom-in", 26.0, false, tl!("Larger thumbnails"))
-                })
-                .inner
-                .clicked()
-            {
-                zoom += 0.25;
-            }
-        });
-    });
-    if zoom != before {
-        view.set_thumbnail_zoom(zoom);
-    }
-    ui.add_space(6.0);
-}
-
-/// The page thumbnails. A click goes to the page; ⌘/Ctrl-click and ⇧-click pick several pages
-/// (the selection page commands and Print act on) without moving the document. Right-click
-/// offers Extract, Cut, Copy and Paste on the selection, or on the page clicked; dragging
-/// moves the selection, or the page grabbed, to the gap it is dropped on.
-fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocView, modal: bool, editable: bool, nav: &mut Option<Nav>) {
-    // Escape drops the selection while the pointer is over the panel and nothing else wants the key.
-    if !modal
-        && !view.selected.is_empty()
-        && !ui.ctx().egui_wants_keyboard_input()
-        && ui.rect_contains_pointer(ui.clip_rect())
-        && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape))
-    {
-        view.clear_page_selection(Some(view.current));
-    }
-    // Delete (or Backspace) deletes the selection, or the current page, likewise.
-    if !modal
-        && editable
-        && !ui.ctx().egui_wants_keyboard_input()
-        && ui.rect_contains_pointer(ui.clip_rect())
-        && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Delete) || i.consume_key(egui::Modifiers::NONE, egui::Key::Backspace))
-    {
-        delete_pages(view, info.pages.len());
-    }
-    // A new current page scrolls its thumbnail into view, as little as it takes (Acrobat), but
-    // not while thumbnails are dragged: then the change counts as seen. A wheel turned or a
-    // scroll bar dragged by the user already wins over a scroll to a place in egui.
-    let follow = view.panel_followed != Some(view.current) && view.panel_drag.is_none();
-    view.panel_followed = Some(view.current);
-    let available = (ui.available_width() - 16.0).max(1.0);
-    let usual = (ui.available_width() - 40.0).clamp(1.0, 150.0);
-    let w = (usual * view.thumbnail_zoom()).min(available);
-    let count = info.pages.len();
-    let mut rows: Vec<Rect> = Vec::with_capacity(info.pages.len());
-    let mut dropped = false;
-    for (i, p) in info.pages.iter().enumerate() {
-        ui.vertical_centered(|ui| {
-            let h = w * p.height / p.width.max(1.0);
-            let sense = if editable { Sense::click_and_drag() } else { Sense::click() };
-            let (rect, resp) = ui.allocate_exact_size(vec2(w + 16.0, h + 16.0), sense);
-            rows.push(rect);
-            if rect.intersects(ui.clip_rect().expand(200.0)) {
-                view.need_thumbnail(i, rect.intersects(ui.clip_rect()));
-            }
-            // Only the primary button drags pages (the middle button scrolls, the secondary one opens the menu).
-            if resp.drag_started_by(egui::PointerButton::Primary) {
-                if !view.target_pages().contains(&i) {
-                    view.click_page(i, egui::Modifiers::NONE, true);
-                }
-                view.panel_drag = Some(view.target_pages());
-            }
-            if resp.drag_stopped() {
-                dropped = true;
-            }
-            let info = crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.label)]);
-            let picked = view.selected.contains(&i);
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, picked, info.clone()));
-            // The current page keeps its heavier border; picked pages share its fill.
-            let selected = i == view.current;
-            let press = theme::Press::track(ui, &resp);
-            press.wash(ui, rect, 8, selected || picked);
-            if picked {
-                ui.painter().rect_stroke(rect, CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
-            }
-            let pr = rect.translate(press.offset()).shrink(8.0);
-            ui.painter().rect_filled(pr, CornerRadius::ZERO, Color32::WHITE);
-            if let Some(tex) = view.thumb(i) {
-                ui.painter().image(tex.id(), pr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
-            }
-            ui.painter().rect_stroke(
-                pr,
-                CornerRadius::ZERO,
-                Stroke::new(if selected { 2.0 } else { 1.0 }, if selected { t.accent } else { t.border }),
-                egui::StrokeKind::Outside,
-            );
-            let label = ui.label(egui::RichText::new(&p.label).font(theme::medium(12.0)).color(if selected || picked {
-                t.accent_text
-            } else {
-                t.text_muted
-            }));
-            if follow && selected {
-                ui.scroll_to_rect(rect.union(label.rect), None);
-            }
-            let resp = theme::hand(resp);
-            if resp.clicked() {
-                let m = ui.input(|i| i.modifiers);
-                if m.shift || m.command {
-                    view.click_page(i, m, true);
-                } else {
-                    view.clear_page_selection(Some(i));
-                    // A page clicked here is in view already: the panel stays put.
-                    view.panel_followed = Some(i);
-                    *nav = Some(Nav::Page(i));
-                }
-            }
-            resp.context_menu(|ui| {
-                // A page outside the selection becomes the selection, as in the organize grid.
-                if !view.target_pages().contains(&i) {
-                    view.click_page(i, egui::Modifiers::NONE, true);
-                }
-                if ui.button(tl!("Extract pages")).clicked() {
-                    view.pending_action = Some(crate::canvas::ViewAction::Extract);
-                    ui.close();
-                }
-                if ui.button(tl!("Split document…")).clicked() {
-                    if view.selected.is_empty() {
-                        view.select_pages(&[i]);
-                    }
-                    view.pending_action = Some(crate::canvas::ViewAction::SplitBeforeSelected);
-                    ui.close();
-                }
-                if ui.add_enabled(editable, egui::Button::new(tl!("Replace pages…"))).clicked() {
-                    view.pending_action = Some(crate::canvas::ViewAction::ReplacePages);
-                    ui.close();
-                }
-                ui.separator();
-                if ui.add_enabled(editable, egui::Button::new(tl!("Cut"))).clicked() {
-                    view.pending_action = Some(crate::canvas::ViewAction::CopyPages { cut: true });
-                    ui.close();
-                }
-                if ui.button(tl!("Copy")).clicked() {
-                    view.pending_action = Some(crate::canvas::ViewAction::CopyPages { cut: false });
-                    ui.close();
-                }
-                if ui.add_enabled(editable, egui::Button::new(tl!("Paste after"))).clicked() {
-                    view.pending_action = Some(crate::canvas::ViewAction::PastePages);
-                    ui.close();
-                }
-                ui.separator();
-                let some_left = view.target_pages().len() < count;
-                // Never every page: a document keeps at least one.
-                if ui.add_enabled(editable && some_left, egui::Button::new(tl!("Delete pages"))).clicked() {
-                    delete_pages(view, count);
-                    ui.close();
-                }
-            });
-        });
-        ui.add_space(4.0);
-    }
-    page_drag(ui, t, view, &rows, dropped);
-    file_drop(ui, t, view, &rows, editable && !modal);
-}
-
-/// Files dragged in from outside go to the gap under the pointer: remember where the panel is
-/// and that gap, for the app to take the drop, and show where the pages would go.
-fn file_drop(ui: &mut egui::Ui, t: &Tokens, view: &mut crate::DocView, rows: &[Rect], editable: bool) {
-    if !editable {
-        return;
-    }
-    let clip = ui.clip_rect();
-    view.pages_panel = Some(clip);
-    let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| clip.contains(*p));
-    view.panel_gap = pointer.filter(|_| view.panel_drag.is_none()).and_then(|p| panel_gap(rows, p.y));
-    if pointer.is_none() || ui.input(|i| i.raw.hovered_files.is_empty()) {
-        return;
-    }
-    let painter = ui.painter().with_clip_rect(clip);
-    painter.rect_stroke(clip.shrink(2.0), CornerRadius::same(6), Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
-    if let (Some(gap), Some(first), Some(last)) = (view.panel_gap, rows.first(), rows.last()) {
-        let y = rows.get(gap).map_or(last.bottom() + 2.0, |r| r.top() - 3.0);
-        painter.line_segment([pos2(first.left(), y), pos2(first.right(), y)], Stroke::new(3.0, t.accent));
-    }
-}
-
-/// Queue deleting the selection (or the current page) of a document of `n` pages, unless that
-/// would leave no page. The selection goes; the current page stays on the page it showed, or on
-/// the page that follows the deleted ones.
-fn delete_pages(view: &mut crate::DocView, n: usize) {
-    let mut pages = view.target_pages();
-    pages.sort_unstable();
-    pages.dedup();
-    if pages.is_empty() || pages.len() >= n {
-        return;
-    }
-    // Deleted pages before it shift it up; if it was deleted itself, the page after the deleted
-    // run lands where it was (or the last page, when the deletion ran to the end).
-    let before = pages.iter().filter(|p| **p < view.current).count();
-    view.current = view.current.saturating_sub(before).min(n.saturating_sub(pages.len() + 1));
-    view.clear_page_selection(None);
-    view.pending_edit = Some(pdfcraft_engine::Edit::DeletePages { pages });
-}
-
-/// The gap (0 = before the first page, n = after the last) the pointer points at in the Pages
-/// panel, whose thumbnails are `rows`, top to bottom.
-fn panel_gap(rows: &[Rect], y: f32) -> Option<usize> {
-    let (i, r) = rows.iter().enumerate().min_by(|(_, a), (_, b)| (a.center().y - y).abs().total_cmp(&(b.center().y - y).abs()))?;
-    Some(if y < r.center().y { i } else { i + 1 })
-}
-
-/// Where page `p` goes when `moving` (sorted) move to `to` (counted without them).
-fn moved_index(p: usize, moving: &[usize], to: usize) -> usize {
-    match moving.iter().position(|m| *m == p) {
-        Some(k) => to + k,
-        None => {
-            let rest = p.saturating_sub(moving.iter().filter(|m| **m < p).count());
-            if rest >= to { rest + moving.len() } else { rest }
-        }
-    }
-}
-
-/// While thumbnails are dragged: a bar on the gap they would go to, the page count by the
-/// pointer, and scrolling near the panel's edges. On release, queue the move.
-fn page_drag(ui: &mut egui::Ui, t: &Tokens, view: &mut crate::DocView, rows: &[Rect], dropped: bool) {
-    let Some(mut moving) = view.panel_drag.clone() else { return };
-    // A drag that ended while the panel was closed (or elsewhere) leaves nothing to drop.
-    if !dropped && !ui.input(|i| i.pointer.primary_down()) {
-        view.panel_drag = None;
-        return;
-    }
-    let pointer = ui.input(|i| i.pointer.interact_pos());
-    let gap = pointer.and_then(|p| panel_gap(rows, p.y));
-    if let (Some(gap), Some(first), Some(last)) = (gap, rows.first(), rows.last()) {
-        let y = rows.get(gap).map_or(last.bottom() + 20.0, |r| r.top() - 3.0);
-        ui.painter().line_segment([pos2(first.left(), y), pos2(first.right(), y)], Stroke::new(3.0, t.accent));
-    }
-    if let Some(p) = pointer {
-        let n = moving.len();
-        let what = if n == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &n.to_string())]) };
-        ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, what, theme::medium(12.0), t.accent_text);
-        let clip = ui.clip_rect();
-        let edge = 40.0;
-        if p.y < clip.top() + edge {
-            ui.scroll_with_delta(vec2(0.0, 10.0));
-        } else if p.y > clip.bottom() - edge {
-            ui.scroll_with_delta(vec2(0.0, -10.0));
-        }
-        ui.ctx().request_repaint();
-    }
-    if !dropped {
-        return;
-    }
-    view.panel_drag = None;
-    let Some(gap) = gap else { return };
-    moving.sort_unstable();
-    moving.dedup();
-    let Some(&first) = moving.first() else { return };
-    // `to` counts positions without the moving pages.
-    let to = gap.saturating_sub(moving.iter().filter(|x| **x < gap).count());
-    let contiguous = moving.windows(2).all(|w| w[1] == w[0] + 1);
-    if contiguous && to == first {
-        return;
-    }
-    view.current = moved_index(view.current, &moving, to);
-    view.selected = (to..to + moving.len()).collect();
-    view.pending_edit = Some(pdfcraft_engine::Edit::MovePages { pages: moving, to });
-}
-
-/// The Fields panel: fields by page, in tab order. While preparing a form, each field can move
-/// earlier or later in its page's tab order (Acrobat: Order Tabs Manually).
-#[allow(clippy::too_many_arguments)]
-fn fields(
-    ui: &mut egui::Ui,
-    t: &Tokens,
-    info: &DocInfo,
-    form: &[pdfcraft_engine::FormField],
-    preparing: bool,
-    selection: &mut crate::prepare::PrepareView,
-    nav: &mut Option<Nav>,
-    edit: &mut Option<pdfcraft_engine::Edit>,
-) -> Option<(String, usize)> {
-    let mut properties = None;
-    if info.fields.is_empty() {
-        empty(ui, t, "text-cursor-input", "This document has no form fields.");
-        return None;
-    }
-    let rows = field_rows(&info.fields, form);
-    if preparing {
-        ui.label(egui::RichText::new(tl!("Tab order: move a field with its arrows.")).small().color(t.text_muted));
-        ui.label(egui::RichText::new(tl!("Shift- or Ctrl/Command-click to select several fields.")).small().color(t.text_muted));
-        let names = selection.names();
-        // Keep the field rows in place when the first click selects a field, so the
-        // second click of a double-click still lands on the same row.
-        ui.horizontal(|ui| {
-            ui.label(crate::i18n::fmt(tl!("{n} selected"), &[("n", &names.len().to_string())]));
-            if ui.add_enabled(!names.is_empty(), egui::Button::new(tl!("Properties…"))).clicked() {
-                properties = selection.selected.clone();
-            }
-        });
-    }
-    for (p, page_rows) in rows {
-        // A field's /P can name a page the document doesn't have (#1307); it reads as unplaced.
-        let label = p
-            .and_then(|p| info.pages.get(p))
-            .map(|page| crate::i18n::fmt(tl!("Page {label}"), &[("label", &page.label)]))
-            .unwrap_or_else(|| tl!("Unplaced").to_string());
-        ui.add_space(4.0);
-        ui.label(egui::RichText::new(label).font(theme::semibold(12.5)).color(t.text_muted));
-        for (f, key) in page_rows {
-            let selected = key.as_ref().is_some_and(|key| selection.selected.as_ref() == Some(key) || selection.also.contains(key));
-            let icon = match f.kind {
-                FieldKind::Text => "text-cursor-input",
-                FieldKind::CheckBox => "check-circle-2",
-                FieldKind::Radio => "circle",
-                FieldKind::PushButton => "square",
-                FieldKind::Combo => "chevron-down",
-                FieldKind::List => "list",
-                FieldKind::Signature => "signature",
-                FieldKind::Unknown => "square",
-            };
-            let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 30.0), Sense::click());
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, selected, &f.name));
-            // A row scrolled out of view still takes clicks and keyboard focus, but isn't drawn:
-            // laying out every row of a large form each frame took a tenth of a second a frame.
-            let visible = ui.is_rect_visible(rect);
-            if visible {
-                let press = theme::Press::track(ui, &resp);
-                press.wash(ui, rect, 6, selected);
-                let body = rect.translate(press.offset());
-                icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 7.0), vec2(16.0, 16.0)), icon, 15.0, Color32::from_rgb(0x8E, 0x4E, 0xE6));
-                let value =
-                    f.value.as_ref().map(|v| if v.chars().count() > 18 { format!("{}…", v.chars().take(17).collect::<String>()) } else { v.clone() });
-                let value_font = theme::regular(11.5);
-                let value_w = value.as_ref().map(|v| crate::widgets::text_width(ui, v, &value_font)).unwrap_or(0.0);
-                let arrows = if preparing && f.page.is_some() { 56.0 } else { 0.0 };
-                let max_w = (rect.width() - 32.0 - value_w - arrows - 16.0).max(0.0);
-                crate::widgets::paint_left(ui, body.left_center() + vec2(32.0, 0.0), &f.name, theme::regular(13.0), t.text, max_w);
-                if let Some(v) = value {
-                    let x = if arrows > 0.0 { 64.0 } else { 8.0 };
-                    ui.painter().text(body.right_center() - vec2(x, 0.0), Align2::RIGHT_CENTER, v, value_font, t.text_faint);
-                }
-            }
-            if preparing && f.page.is_some() {
-                let up = Rect::from_center_size(rect.right_center() - vec2(44.0, 0.0), vec2(22.0, 22.0));
-                let down = Rect::from_center_size(rect.right_center() - vec2(20.0, 0.0), vec2(22.0, 22.0));
-                for (r, icon, earlier, tip) in
-                    [(up, "chevron-up", true, tl!("Earlier in tab order")), (down, "chevron-down", false, tl!("Later in tab order"))]
-                {
-                    let b = ui.interact(r, ui.id().with((&f.name, earlier)), Sense::click());
-                    b.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, format!("{tip}: {}", f.name)));
-                    if visible {
-                        let bpress = theme::Press::track(ui, &b);
-                        bpress.wash(ui, r, 4, false);
-                        icons::paint(ui, r.shrink(3.0).translate(bpress.offset()), icon, 15.0, t.icon);
-                    }
-                    if theme::hand(b).on_hover_text(tip).clicked() {
-                        *edit = Some(pdfcraft_engine::Edit::MoveInTabOrder { name: f.name.clone(), earlier });
-                    }
-                }
-            }
-            if preparing && resp.double_clicked() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
-                if let Some(key) = key {
-                    if !selected {
-                        selection.select(key.clone(), false);
-                    }
-                    properties = Some(key);
-                }
-            } else if preparing
-                && resp.clicked()
-                && let Some(key) = key
-            {
-                selection.select(key, ui.input(|i| i.modifiers.shift || i.modifiers.command));
-            }
-            let resp = theme::hand(resp);
-            // Only a row in view can be hovered: its tip isn't built for the others.
-            let resp = if visible { resp.on_hover_text(field_tip(f)) } else { resp };
-            if resp.clicked()
-                && let (Some(p), Some(r)) = (f.page, f.rect)
-            {
-                *nav = Some(Nav::Flash(p, r));
-            }
-        }
-    }
-    properties
-}
-
-/// A Fields panel row's tooltip: the field's kind, its own tooltip and whether it has scripts.
-fn field_tip(f: &pdfcraft_render::Field) -> String {
-    let kind = format!("{:?}", f.kind);
-    let mut tip = crate::i18n::fmt(tl!("{kind} field"), &[("kind", tl!(&kind))]);
-    if let Some(tt) = &f.tooltip {
-        tip.push_str(&format!(" — {tt}"));
-    }
-    if f.has_actions {
-        tip.push_str(&format!("\n{}", tl!("Has JavaScript actions (run in M6)")));
-    }
-    tip
-}
-
-/// One page's rows of the Fields panel: each field, with the form field and widget a click on
-/// it selects (`None` when the form has no widget of it on that page).
-type FieldRows<'a> = Vec<(&'a pdfcraft_render::Field, Option<(String, usize)>)>;
-
-/// The Fields panel's rows: by page ("Unplaced" first), each page's in tab order. A row is paired
-/// with the first form field of its name, as the engine pairs them: one map, built once a frame.
-/// Searching the form for each row, and again inside the sort, was O(fields²) every frame.
-fn field_rows<'a>(fields: &'a [pdfcraft_render::Field], form: &[pdfcraft_engine::FormField]) -> Vec<(Option<usize>, FieldRows<'a>)> {
-    let mut by_name: std::collections::HashMap<&str, &pdfcraft_engine::FormField> = std::collections::HashMap::with_capacity(form.len());
-    for field in form {
-        by_name.entry(field.name.as_str()).or_insert(field);
-    }
-    let rank = |name: &str| by_name.get(name).and_then(|f| f.widgets.iter().map(|w| w.tab).min()).unwrap_or(usize::MAX);
-    let mut ordered: Vec<&pdfcraft_render::Field> = fields.iter().collect();
-    ordered.sort_by_cached_key(|f| (f.page, rank(&f.name)));
-    let mut rows: Vec<(Option<usize>, FieldRows<'a>)> = Vec::new();
-    for f in ordered {
-        let key =
-            by_name.get(f.name.as_str()).and_then(|field| field.widgets.iter().position(|w| w.page == f.page).map(|wi| (field.name.clone(), wi)));
-        match rows.last_mut() {
-            Some((page, page_rows)) if *page == f.page => page_rows.push((f, key)),
-            _ => rows.push((f.page, vec![(f, key)])),
-        }
-    }
-    rows
-}
-
 pub fn human_size(n: usize) -> String {
     match n {
         n if n >= 1 << 20 => format!("{:.1} MB", n as f64 / (1u64 << 20) as f64),
@@ -1737,244 +48,3 @@ pub fn human_size(n: usize) -> String {
 pub fn byte_count(n: usize) -> String {
     crate::i18n::trn(crate::i18n::current(), n as u64, "{n} byte", "{n} bytes")
 }
-
-#[cfg(test)]
-mod page_moves {
-    use super::{moved_index, panel_gap};
-    use egui::{Rect, pos2};
-
-    /// Above a thumbnail's middle is the gap before it; below is the gap after it.
-    #[test]
-    fn the_gap_follows_the_nearest_thumbnail() {
-        let rows: Vec<Rect> = (0..3).map(|i| Rect::from_min_max(pos2(0.0, i as f32 * 100.0), pos2(50.0, i as f32 * 100.0 + 90.0))).collect();
-        assert_eq!(panel_gap(&rows, -20.0), Some(0));
-        assert_eq!(panel_gap(&rows, 30.0), Some(0));
-        assert_eq!(panel_gap(&rows, 60.0), Some(1));
-        assert_eq!(panel_gap(&rows, 260.0), Some(3));
-        assert_eq!(panel_gap(&rows, 900.0), Some(3));
-        assert_eq!(panel_gap(&[], 10.0), None);
-    }
-
-    /// The current page follows a move, whether it moved or others moved around it.
-    #[test]
-    fn pages_keep_their_identity_across_a_move() {
-        // [0 1 2 3 4], move [1 2] to the end: [0 3 4 1 2].
-        let order: Vec<usize> = (0..5).map(|p| moved_index(p, &[1, 2], 3)).collect();
-        assert_eq!(order, [0, 3, 4, 1, 2]);
-        // Move [3] to the front: [3 0 1 2 4].
-        let order: Vec<usize> = (0..5).map(|p| moved_index(p, &[3], 0)).collect();
-        assert_eq!(order, [1, 2, 3, 0, 4]);
-    }
-}
-
-#[cfg(test)]
-mod field_rows {
-    use super::field_rows;
-    use std::sync::Arc;
-
-    /// A PDF of `objects` (numbered from 1; object 1 the catalog) with a valid xref table.
-    fn pdf(objects: &[String]) -> Vec<u8> {
-        let mut out = b"%PDF-1.7\n".to_vec();
-        let mut offsets = Vec::new();
-        for (i, o) in objects.iter().enumerate() {
-            offsets.push(out.len());
-            out.extend(format!("{} 0 obj\n{o}\nendobj\n", i + 1).bytes());
-        }
-        let xref = out.len();
-        out.extend(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).bytes());
-        for o in offsets {
-            out.extend(format!("{o:010} 00000 n \n").bytes());
-        }
-        out.extend(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).bytes());
-        out
-    }
-
-    /// The fields the engine reads from `bytes`: the inspector's list and the form.
-    fn open(bytes: Vec<u8>) -> (Vec<pdfcraft_render::Field>, Arc<Vec<pdfcraft_engine::FormField>>) {
-        let mut session = pdfcraft_engine::Session::new();
-        let id = session.open("form.pdf", None, Arc::new(bytes), None).expect("opens");
-        let doc = session.get(id).expect("open");
-        (doc.info.fields.clone(), doc.form.clone())
-    }
-
-    /// Rows go by page, the unplaced first, each page's in tab order (here its annotation order,
-    /// not the `/Fields` order), and a row selects the first form field of its name.
-    #[test]
-    fn rows_follow_pages_and_tab_order() {
-        let widget = |name: &str, page: Option<usize>| match page {
-            Some(p) => format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [10 10 90 30] /P {} 0 R >>", 3 + p),
-            None => format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [10 10 90 30] >>"),
-        };
-        let bytes = pdf(&[
-            "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [5 0 R 7 0 R 8 0 R 9 0 R 10 0 R 6 0 R] >> >>".into(),
-            "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >>".into(),
-            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [6 0 R 5 0 R] >>".into(),
-            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [7 0 R 8 0 R 9 0 R] >>".into(),
-            widget("a1", Some(0)),
-            widget("a2", Some(0)),
-            widget("b", Some(1)),
-            widget("twin", Some(1)),
-            widget("twin", Some(1)),
-            widget("loose", None),
-        ]);
-        let (fields, form) = open(bytes);
-        // A page's rows as (field name, the form field and widget a click selects).
-        type Named<'a> = Vec<(&'a str, Option<(String, usize)>)>;
-        let rows: Vec<(Option<usize>, Named)> = field_rows(&fields, &form)
-            .into_iter()
-            .map(|(page, rows)| (page, rows.into_iter().map(|(f, key)| (f.name.as_str(), key)).collect()))
-            .collect();
-        let key = |name: &str| Some((name.to_string(), 0));
-        assert_eq!(
-            rows,
-            [
-                (None, vec![("loose", key("loose"))]),
-                (Some(0), vec![("a2", key("a2")), ("a1", key("a1"))]),
-                (Some(1), vec![("b", key("b")), ("twin", key("twin")), ("twin", key("twin"))]),
-            ]
-        );
-    }
-
-    /// The panel's rows for a large form take milliseconds: looking each row's field up in the
-    /// form, there and inside the sort, was O(fields²) every frame.
-    #[test]
-    fn rows_for_a_large_form_are_quick() {
-        const PAGES: usize = 150;
-        const PER_PAGE: usize = 100;
-        let mut objects = vec![String::new(), String::new()];
-        let page = |p: usize| 3 + p;
-        let field = |p: usize, k: usize| 3 + PAGES + p * PER_PAGE + k;
-        let mut all = Vec::new();
-        for p in 0..PAGES {
-            let annots: Vec<String> = (0..PER_PAGE).map(|k| format!("{} 0 R", field(p, k))).collect();
-            all.extend(annots.iter().cloned());
-            objects.push(format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{}] >>", annots.join(" ")));
-        }
-        for p in 0..PAGES {
-            for k in 0..PER_PAGE {
-                objects.push(format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (field{p}_{k}) /Rect [10 10 90 30] /P {} 0 R >>", page(p)));
-            }
-        }
-        // `/Fields` in no particular order, so the rows must be sorted.
-        let mut seed = 12345u64;
-        for i in (1..all.len()).rev() {
-            seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
-            all.swap(i, (seed >> 33) as usize % (i + 1));
-        }
-        objects[0] = format!("<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [{}] >> >>", all.join(" "));
-        let kids: Vec<String> = (0..PAGES).map(|p| format!("{} 0 R", page(p))).collect();
-        objects[1] = format!("<< /Type /Pages /Kids [{}] /Count {PAGES} >>", kids.join(" "));
-        let (fields, form) = open(pdf(&objects));
-        assert_eq!(fields.len(), PAGES * PER_PAGE);
-        let (tx, rx) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            let rows = field_rows(&fields, &form);
-            let _ = tx.send((rows.len(), rows.iter().map(|(_, r)| r.len()).sum::<usize>()));
-        });
-        let counted = rx.recv_timeout(std::time::Duration::from_secs(3)).expect("the Fields panel's rows must not take seconds a frame");
-        assert_eq!(counted, (PAGES, PAGES * PER_PAGE));
-    }
-}
-
-#[cfg(test)]
-mod label_column {
-    use super::ellipsized_prefix;
-
-    /// A short page label (the usual "3", "iv", "1-1") is shown unchanged.
-    #[test]
-    fn short_labels_are_not_touched() {
-        for label in ["3", "iv", "1-1", "A-201"] {
-            assert_eq!(ellipsized_prefix(label, |s| s.len() <= 10), label);
-        }
-    }
-
-    /// A label wider than its column (#124: whole section titles in /PageLabels) keeps only
-    /// the head that fits, with an ellipsis, and that head is a prefix of the real label.
-    #[test]
-    fn long_labels_are_cut_to_their_column_with_an_ellipsis() {
-        let label = "Floor Plans (001 Floor Plans): GROUND FLOOR PLAN";
-        let shown = ellipsized_prefix(label, |s| s.len() <= 20);
-        assert!(shown.ends_with('\u{2026}'), "{shown:?}");
-        assert!(shown.len() <= 20, "{shown:?}");
-        assert!(label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
-    }
-
-    /// CJK labels (three bytes per character) are cut on character boundaries too.
-    #[test]
-    fn multibyte_labels_are_cut_on_char_boundaries() {
-        let label = "図面（一階平面図）：配置図";
-        let shown = ellipsized_prefix(label, |s| s.len() <= 12);
-        assert!(shown.ends_with('\u{2026}'), "{shown:?}");
-        assert!(shown.len() <= 12, "{shown:?}");
-        assert!(label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
-    }
-
-    /// The pathological floor: nothing fits, the loop still ends with the lone ellipsis.
-    #[test]
-    fn the_loop_ends_when_nothing_fits() {
-        assert_eq!(ellipsized_prefix("Floor Plans", |_| false), "\u{2026}");
-    }
-
-    /// A huge label from a hostile file is measured a bounded number of times per frame.
-    #[test]
-    fn a_huge_label_is_measured_a_bounded_number_of_times() {
-        let label = "x".repeat(1_000_000);
-        let mut calls = 0;
-        let shown = ellipsized_prefix(&label, |s| {
-            calls += 1;
-            s.len() <= 12
-        });
-        assert!(calls <= super::LABEL_MEASURE_CHARS + 1, "{calls} measurements");
-        assert!(shown.ends_with('\u{2026}') && label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
-    }
-}
-
-#[cfg(test)]
-mod bookmark_filter {
-    use super::{outline_matches, title_format};
-    use crate::theme::{self, Tokens};
-    use pdfcraft_render::OutlineItem;
-
-    /// #3193: a bookmark's title is drawn in its own style and colour.
-    #[test]
-    fn bookmark_titles_take_their_style_and_colour() {
-        let t = Tokens::for_kind(crate::theme::ThemeKind::Light);
-        let plain = item("Plain", Vec::new());
-        assert_eq!(title_format(&plain, 0, &t).font_id, theme::medium(13.0));
-        assert_eq!(title_format(&plain, 1, &t).font_id, theme::regular(13.0));
-        assert_eq!(title_format(&plain, 1, &t).color, t.text);
-        assert!(!title_format(&plain, 1, &t).italics);
-        let styled = OutlineItem { color: Some([1.0, 0.0, 0.0]), italic: true, bold: true, ..item("Styled", Vec::new()) };
-        let f = title_format(&styled, 1, &t);
-        assert_eq!(f.font_id, theme::semibold(13.0));
-        assert!(f.italics);
-        assert_eq!(f.color, egui::Color32::from_rgb(255, 0, 0));
-        let half = OutlineItem { color: Some([0.0, 0.5, 0.0]), ..item("Green", Vec::new()) };
-        assert_eq!(title_format(&half, 1, &t).color, egui::Color32::from_rgb(0, 128, 0));
-    }
-
-    fn item(title: &str, children: Vec<OutlineItem>) -> OutlineItem {
-        OutlineItem {
-            title: title.into(),
-            page: Some(0),
-            view: pdfcraft_render::DestView::Top,
-            children,
-            open: true,
-            color: None,
-            italic: false,
-            bold: false,
-        }
-    }
-
-    /// Turkish dotted and dotless i match in any case, as in Find (#892).
-    #[test]
-    fn titles_match_in_any_case_with_turkish_i() {
-        let outline = [item("İSTANBUL ŞUBESİ", vec![item("Kış dönemi", vec![])]), item("Ankara", vec![])];
-        let fold = pdfcraft_render::text::fold_case;
-        assert_eq!(outline_matches(&outline, &fold("istanbul")).len(), 1);
-        assert_eq!(outline_matches(&outline, &fold("şubesi")).len(), 1);
-        // A child match keeps its parent: [0] and [0, 0].
-        assert_eq!(outline_matches(&outline, &fold("KIŞ")).len(), 2);
-        assert!(outline_matches(&outline, &fold("izmir")).is_empty());
-    }
-}
diff --git a/crates/ui-egui/src/panels/all_tools_ui.rs b/crates/ui-egui/src/panels/all_tools_ui.rs
new file mode 100644
index 0000000000..9b09c887d1
--- /dev/null
+++ b/crates/ui-egui/src/panels/all_tools_ui.rs
@@ -0,0 +1,197 @@
+//! The expanded All tools view: every tool, filed under Acrobat-style categories, with a search
+//! field, filling the workspace instead of the sidebar. The sidebar's expand button opens it;
+//! its collapse button, Esc or choosing a tool closes it again.
+
+use egui::{Align2, Color32, CornerRadius, Rect, Sense, Stroke, vec2};
+use pdfcraft_engine::catalog::{self, Availability, TOOL_CATEGORIES, ToolGroup};
+
+use crate::theme::{self, Tokens};
+use crate::{PdfCraftApp, icons, widgets};
+
+const TILE: egui::Vec2 = vec2(148.0, 118.0);
+/// Item names a tile lists when the search found the tool by them.
+const MATCHES_SHOWN: usize = 2;
+
+/// Whether `query` (already trimmed and lower-cased) is in `label` or its translation.
+/// Translations and queries stay in logical order. For right-to-left labels, also accept
+/// multiword queries in a different word order, as in the command palette.
+fn label_hit(label: &str, translated: &str, query: &str, rtl: bool) -> bool {
+    let translated = translated.to_lowercase();
+    label.to_lowercase().contains(query)
+        || translated.contains(query)
+        || (rtl && query.contains(char::is_whitespace) && query.split_whitespace().all(|word| translated.contains(word)))
+}
+
+/// Whether `group` matches `query` (already trimmed and lower-cased), in English or the UI
+/// language. `None` is no match; otherwise the items that matched, empty when the tool's own
+/// name did. An entry with a menu (Watermark: Add, Update, Remove) also matches by its commands'
+/// names, so "remove watermark" finds it.
+fn matches(query: &str, group: &ToolGroup) -> Option<Vec<&'static str>> {
+    let rtl = crate::i18n::current().rtl();
+    let hit = |label: &str| label_hit(label, tl!(label), query, rtl);
+    if query.is_empty() || hit(group.label) {
+        return Some(Vec::new());
+    }
+    let action_hit = |id: &&str| {
+        pdfcraft_engine::commands::command(id).is_some_and(|spec| label_hit(spec.label, &crate::i18n::menu_label(spec.id, spec.label), query, rtl))
+    };
+    let items: Vec<_> =
+        group.sections.iter().flat_map(|s| s.items.iter()).filter(|i| hit(i.label) || i.actions.iter().any(action_hit)).map(|i| i.label).collect();
+    (!items.is_empty()).then_some(items)
+}
+
+/// Draw the view over the workspace: the title with Collapse, the search field, and each
+/// category's tiles that match the search. Choosing a tile opens that tool's panel.
+pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    // A dialog, prompt or the command palette over the view owns Escape.
+    if !app.modal_open() && !app.palette_open && ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+        app.all_tools_full = false;
+        return;
+    }
+    let mut chosen = None;
+    egui::Frame::NONE.fill(t.panel).show(ui, |ui| {
+        ui.set_min_size(ui.available_size());
+        egui::Frame::NONE.inner_margin(egui::Margin { left: 36, right: 28, top: 20, bottom: 12 }).show(ui, |ui| {
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(tl!("All tools")).font(theme::semibold(22.0)).color(t.text));
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if icons::button(ui, "minimize-2", 28.0, false, tl!("Collapse all tools")).clicked() {
+                        app.all_tools_full = false;
+                    }
+                });
+            });
+            ui.add_space(10.0);
+            let field = ui.add(
+                widgets::line(&mut app.all_tools_query).hint_text(tl!("Search tools and commands…")).desired_width(ui.available_width().min(520.0)),
+            );
+            // Typing goes straight to the search, as in Acrobat's tools view.
+            if !ui.memory(|m| m.focused().is_some()) {
+                field.request_focus();
+            }
+        });
+        ui.separator();
+        let query = app.all_tools_query.trim().to_lowercase();
+        egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+            egui::Frame::NONE.inner_margin(egui::Margin { left: 36, right: 28, top: 8, bottom: 28 }).show(ui, |ui| {
+                ui.set_width(ui.available_width());
+                let mut any = false;
+                for category in TOOL_CATEGORIES {
+                    let found: Vec<_> =
+                        category.groups.iter().filter_map(|id| catalog::group(id)).filter_map(|g| matches(&query, g).map(|m| (g, m))).collect();
+                    if found.is_empty() {
+                        continue;
+                    }
+                    any = true;
+                    ui.add_space(12.0);
+                    ui.label(egui::RichText::new(tl!(category.label)).font(theme::semibold(16.0)).color(t.text));
+                    ui.add_space(10.0);
+                    ui.horizontal_wrapped(|ui| {
+                        ui.spacing_mut().item_spacing = vec2(14.0, 14.0);
+                        for (g, items) in found {
+                            if tile(ui, &t, g, &items).clicked() {
+                                chosen = Some(g.id);
+                            }
+                        }
+                    });
+                    ui.add_space(8.0);
+                }
+                if !any {
+                    ui.add_space(24.0);
+                    ui.label(egui::RichText::new(tl!("No tools match your search.")).color(t.text_muted));
+                }
+            });
+        });
+    });
+    if let Some(id) = chosen {
+        app.left_open = true;
+        app.select_tool(id);
+    }
+}
+
+/// One tool's tile: its icon and name, then the `items` the search found it by or, when there are
+/// none, its availability (a planned tool is greyed out with its milestone). A name or note cut
+/// short shows in full on hover.
+fn tile(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup, items: &[&'static str]) -> egui::Response {
+    let (rect, resp) = ui.allocate_exact_size(TILE, Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
+    let press = theme::Press::track(ui, &resp);
+    crate::home::card_lift(ui, t, rect, press);
+    ui.painter().rect(rect, CornerRadius::same(10), press.fill(t.card, t.hover, t.pressed), Stroke::new(1.0, t.divider), egui::StrokeKind::Inside);
+    let body = rect.translate(press.offset());
+    let ready = g.availability == Availability::Ready;
+    let hue = Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2]);
+    icons::paint(ui, Rect::from_center_size(body.center_top() + vec2(0.0, 34.0), vec2(32.0, 32.0)), g.icon, 30.0, hue);
+    let mut job =
+        egui::text::LayoutJob::simple(tl!(g.label).to_owned(), theme::medium(13.0), if ready { t.text } else { t.text_muted }, body.width() - 16.0);
+    job.halign = egui::Align::Center;
+    job.wrap.max_rows = 2;
+    let title = ui.fonts_mut(|f| f.layout_job(job));
+    let mut elided = title.elided;
+    let title_h = title.size().y;
+    ui.painter().galley(body.center_top() + vec2(0.0, 60.0), title, t.text);
+    // What found the tool, or else whether it works today.
+    let note = if items.is_empty() {
+        match g.availability {
+            Availability::Ready => String::new(),
+            Availability::Planned(m) => format!("{} · {m}", tl!("Planned")),
+            Availability::Provider => g.badge.map(|b| tl!(b).to_owned()).unwrap_or_default(),
+        }
+    } else {
+        items.iter().take(MATCHES_SHOWN).map(|l| tl!(l)).collect::<Vec<_>>().join(" · ")
+    };
+    if !note.is_empty() {
+        let color = if items.is_empty() { t.text_faint } else { t.accent_text };
+        let mut job = egui::text::LayoutJob::simple_singleline(note.clone(), theme::regular(11.0), color);
+        job.halign = egui::Align::Center;
+        job.wrap = egui::text::TextWrapping { max_width: body.width() - 16.0, max_rows: 1, break_anywhere: true, ..Default::default() };
+        let galley = ui.fonts_mut(|f| f.layout_job(job));
+        elided |= galley.elided;
+        ui.painter().galley(body.center_top() + vec2(0.0, 64.0 + title_h), galley, color);
+    }
+    if let Some(b) = g.badge.filter(|_| g.availability == Availability::Ready) {
+        let font = theme::semibold(9.5);
+        let w = widgets::text_width(ui, tl!(b), &font);
+        let r = Rect::from_min_size(body.right_top() + vec2(-w - 18.0, 8.0), vec2(w + 10.0, 16.0));
+        ui.painter().rect_filled(r, CornerRadius::same(4), t.badge_new);
+        ui.painter().text(r.center(), Align2::CENTER_CENTER, tl!(b), font, Color32::WHITE);
+    }
+    let resp = if elided { resp.on_hover_text(format!("{}\n{note}", tl!(g.label))) } else { resp };
+    theme::hand(resp)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn group(id: &str) -> &'static ToolGroup {
+        catalog::group(id).expect("catalogue group")
+    }
+
+    #[test]
+    fn search_matches_tool_names_and_their_items() {
+        assert_eq!(matches("", group("organize")), Some(Vec::new()), "an empty query shows everything");
+        assert_eq!(matches("organize", group("organize")), Some(Vec::new()), "the tool's own name");
+        let rotate = matches("rotate", group("organize")).expect("Organize pages lists Rotate");
+        assert!(!rotate.is_empty() && rotate.iter().all(|l| l.to_lowercase().contains("rotate")), "{rotate:?}");
+        assert_eq!(matches("no such tool anywhere", group("organize")), None);
+    }
+
+    #[test]
+    fn search_finds_an_entry_by_its_menus_commands() {
+        let found = matches("remove watermark", group("edit")).expect("Watermark's menu has Remove watermark");
+        assert!(found.contains(&"Watermark"), "{found:?}");
+    }
+
+    #[test]
+    fn right_to_left_labels_match_a_query_typed_in_logical_order() {
+        let arabic = crate::i18n::Lang::from_code("ar").expect("Arabic is registered");
+        let translated = crate::i18n::tr(arabic, "Organize pages");
+        assert_eq!(translated, "تنظيم الصفحات", "the catalogue keeps logical text");
+        assert!(label_hit("Organize pages", translated, "تنظيم الصفحات", true));
+        assert!(label_hit("Organize pages", translated, "الصفحات", true), "one word");
+        assert!(label_hit("Organize pages", translated, "الصفحات تنظيم", true), "RTL word-order fallback");
+        assert!(!label_hit("Organize pages", translated, "تنظيم الملفات", true), "every word must be there");
+        assert!(!label_hit("Organize pages", translated, "الصفحات تنظيم", false), "left-to-right labels stay exact");
+    }
+}
diff --git a/crates/ui-egui/src/panels/bookmarks.rs b/crates/ui-egui/src/panels/bookmarks.rs
new file mode 100644
index 0000000000..3753c84940
--- /dev/null
+++ b/crates/ui-egui/src/panels/bookmarks.rs
@@ -0,0 +1,360 @@
+use super::*;
+
+/// What the user asked to do with a bookmark (applied after the panel is drawn).
+#[derive(Clone, Debug, PartialEq)]
+pub enum BmAction {
+    /// New "Untitled" bookmark for the current page, after the selected one (⌘B).
+    New,
+    StartRename(Vec<usize>),
+    Rename(Vec<usize>, String),
+    SetToCurrentPage(Vec<usize>),
+    /// Make the title bold or italic or not (`None` keeps that one).
+    SetStyle(Vec<usize>, Option<bool>, Option<bool>),
+    /// Colour the title; black is the default.
+    SetColor(Vec<usize>, [f64; 3]),
+    Delete(Vec<usize>),
+    MoveUp(Vec<usize>),
+    MoveDown(Vec<usize>),
+    /// Make it the last child of the bookmark above it.
+    Indent(Vec<usize>),
+    /// Move it out to follow its parent.
+    Outdent(Vec<usize>),
+    /// Bookmarks from the tagged headings, under a new first "Untitled" bookmark.
+    FromStructure,
+}
+
+/// Matching titles plus their ancestors, keeping document paths rather than filtered indexes.
+/// `query` is folded with [`pdfcraft_render::text::fold_case`], as titles are here.
+pub(super) fn outline_matches(items: &[OutlineItem], query: &str) -> std::collections::HashSet<Vec<usize>> {
+    let mut matches = std::collections::HashSet::new();
+    if query.is_empty() {
+        return matches;
+    }
+    let mut pending: Vec<_> = items.iter().enumerate().map(|(i, item)| (vec![i], item)).collect();
+    while let Some((path, item)) = pending.pop() {
+        if pdfcraft_render::text::fold_case(&item.title).contains(query) {
+            let mut ancestor = path.clone();
+            while !ancestor.is_empty() {
+                matches.insert(ancestor.clone());
+                ancestor.pop();
+            }
+        }
+        for (i, child) in item.children.iter().enumerate() {
+            let mut child_path = path.clone();
+            child_path.push(i);
+            pending.push((child_path, child));
+        }
+    }
+    matches
+}
+
+pub(super) struct OutlineCtx<'a> {
+    pub(super) nav: &'a mut Option<Nav>,
+    pub(super) action: &'a mut Option<BmAction>,
+    pub(super) rename: &'a mut Option<(Vec<usize>, String)>,
+    pub(super) editable: bool,
+    pub(super) current: usize,
+    /// Expand all (`Some(usize::MAX)`), collapse all (`Some(0)`) or expand to a depth, this frame.
+    pub(super) expand: Option<usize>,
+    pub(super) matches: &'a std::collections::HashSet<Vec<usize>>,
+    pub(super) searching: bool,
+}
+
+/// The destination page label gets its own right-aligned column in a bookmark row; drawing
+/// tools put whole section titles in /PageLabels, so the column is bounded (#124).
+const LABEL_COLUMN_MAX: f32 = 72.0;
+
+/// More characters than ever fit [`LABEL_COLUMN_MAX`] at the label size.
+const LABEL_MEASURE_CHARS: usize = 64;
+
+/// The longest head of `text` that `fits`, plus an ellipsis when the whole string doesn't.
+/// Whole characters are dropped from the end, so the string is only ever cut at a char
+/// boundary, and the loop always ends (at the ellipsis alone). A label is document text: only
+/// its first [`LABEL_MEASURE_CHARS`] characters are measured, so a huge one can't make each
+/// frame lay out thousands of candidates.
+pub(crate) fn ellipsized_prefix(text: &str, mut fits: impl FnMut(&str) -> bool) -> String {
+    let mut s: String = text.chars().take(LABEL_MEASURE_CHARS).collect();
+    if s.len() == text.len() && fits(text) {
+        return text.to_owned();
+    }
+    loop {
+        s.pop();
+        let candidate = format!("{s}\u{2026}");
+        if s.is_empty() || fits(&candidate) {
+            return candidate;
+        }
+    }
+}
+
+/// How a bookmark's title is drawn: in its own style and colour (ISO 32000-2 §12.3.3, Tables 151
+/// and 152), bold in the heavier face and italic slanted, its colour kept readable on the panel.
+/// Top-level bookmarks without a style keep the medium face.
+fn title_format(item: &OutlineItem, depth: usize, t: &Tokens) -> egui::TextFormat {
+    let font_id = match (item.bold, depth) {
+        (true, _) => theme::semibold(13.0),
+        (false, 0) => theme::medium(13.0),
+        (false, _) => theme::regular(13.0),
+    };
+    let color = item.color.map_or(t.text, |rgb| {
+        // Each component is within 0–1, so the rounded value fits a byte.
+        let [r, g, b] = rgb.map(|c| (c * 255.0).round() as u8);
+        theme::readable(egui::Color32::from_rgb(r, g, b), t.panel, t.text)
+    });
+    egui::TextFormat { font_id, color, italics: item.italic, ..Default::default() }
+}
+
+/// Draw one bookmark row with expansion, inline rename and the editable context menu.
+pub(super) fn outline_item(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    info: &DocInfo,
+    item: &OutlineItem,
+    path: &[usize],
+    siblings: usize,
+    cx: &mut OutlineCtx<'_>,
+) {
+    if cx.searching && !cx.matches.contains(path) {
+        return;
+    }
+    let depth = path.len() - 1;
+    let indent = depth as f32 * 16.0;
+    let id = ui.scope_id().with(("outline", path));
+    if let Some(levels) = cx.expand {
+        ui.data_mut(|d| d.insert_temp(id, depth < levels));
+    }
+    // A bookmark opens as the file says at every level: a positive /Count is open, a negative
+    // one (or none) closed (ISO 32000-2 §12.3.3, Table 151). The reader's own toggles and a
+    // search override it.
+    let mut open = cx.searching || ui.data(|d| d.get_temp::<bool>(id)).unwrap_or(item.open);
+    let x_text = indent + 20.0;
+    if let Some((rpath, text)) = cx.rename.as_mut()
+        && rpath.as_slice() == path
+    {
+        // Inline rename: Enter commits, Escape cancels.
+        let mut commit = None;
+        let mut cancel = false;
+        ui.horizontal(|ui| {
+            ui.add_space(x_text);
+            crate::widgets::begin_dialog(ui);
+            let edit = crate::widgets::line(text).desired_width(ui.available_width() - 8.0).id(id.with("rename"));
+            let resp = ui.add(edit);
+            if !resp.has_focus() && !resp.lost_focus() {
+                resp.request_focus();
+            }
+            if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+                cancel = true;
+            } else if resp.lost_focus() {
+                commit = Some(text.trim().to_string());
+            }
+        });
+        if cancel {
+            *cx.rename = None;
+        } else if let Some(title) = commit {
+            *cx.rename = None;
+            if !title.is_empty() && title != item.title {
+                *cx.action = Some(BmAction::Rename(path.to_vec(), title));
+            }
+        }
+    } else {
+        // The page label sits right-aligned in its own bounded column, and the title wraps to
+        // what is really left of it — a long label painted over a long title was the overlap
+        // of #124.
+        let label_font = theme::regular(11.0);
+        let label_galley = item.page.and_then(|p| info.pages.get(p)).map(|page| {
+            ui.fonts_mut(|f| {
+                let text =
+                    ellipsized_prefix(&page.label, |s| f.layout_no_wrap(s.to_owned(), label_font.clone(), t.text_faint).size().x <= LABEL_COLUMN_MAX);
+                f.layout_no_wrap(text, label_font, t.text_faint)
+            })
+        });
+        let label_w = label_galley.as_ref().map_or(0.0, |g| g.size().x);
+        let wrap_w = (ui.available_width() - indent - 20.0 - label_w - 12.0).max(60.0);
+        let mut job = egui::text::LayoutJob::single_section(item.title.clone(), title_format(item, depth, t));
+        job.wrap.max_width = wrap_w;
+        let galley = ui.fonts_mut(|f| f.layout_job(job));
+        let h = (galley.size().y + 12.0).max(28.0);
+        let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), h), Sense::click());
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &item.title));
+        theme::Press::track(ui, &resp).wash(ui, rect, 6, false);
+        let x0 = rect.left() + indent;
+        if !item.children.is_empty() {
+            let tri = Rect::from_min_size(pos2(x0, rect.top() + 6.0), vec2(16.0, 16.0));
+            icons::paint(ui, tri, if open { "chevron-down" } else { "chevron-right" }, 14.0, t.text_muted);
+            if !cx.searching && ui.interact(tri, id.with("tri"), Sense::click()).clicked() {
+                open = !open;
+                ui.data_mut(|d| d.insert_temp(id, open));
+            }
+        }
+        ui.painter().galley(pos2(x0 + 20.0, rect.top() + 6.0), galley, t.text);
+        if let Some(g) = label_galley {
+            // Right-aligned, vertically centred at the first line, inside the column the title
+            // wrapped around.
+            let pos = pos2(rect.right() - 6.0 - g.size().x, rect.top() + 14.0 - g.size().y / 2.0);
+            ui.painter().galley(pos, g, t.text_faint);
+        }
+        if theme::hand(resp.clone()).clicked()
+            && let Some(p) = item.page
+        {
+            *cx.nav = Some(Nav::Dest(p, item.view));
+        }
+        if resp.double_clicked() && cx.editable {
+            *cx.action = Some(BmAction::StartRename(path.to_vec()));
+        }
+        if cx.editable
+            && let Some(&i) = path.last()
+        {
+            let current = cx.current;
+            resp.context_menu(|ui| {
+                let mut pick = |ui: &mut egui::Ui, label: &str, enabled: bool, a: BmAction| {
+                    if ui.add_enabled(enabled, egui::Button::new(tl!(label))).clicked() {
+                        *cx.action = Some(a);
+                        ui.close();
+                    }
+                };
+                pick(ui, tl!("Rename"), true, BmAction::StartRename(path.to_vec()));
+                let set_page = crate::i18n::fmt(tl!("Set to current page ({n})"), &[("n", &(current + 1).to_string())]);
+                pick(ui, &set_page, true, BmAction::SetToCurrentPage(path.to_vec()));
+                // The title's style and colour (ISO 32000-2 §12.3.3, Tables 151 and 152).
+                let mut styled = None;
+                ui.menu_button(tl!("Style"), |ui| {
+                    let (mut bold, mut italic) = (item.bold, item.italic);
+                    if ui.add(crate::widgets::checkbox(&mut bold, tl!("Bold"))).clicked() {
+                        styled = Some(BmAction::SetStyle(path.to_vec(), Some(bold), None));
+                    }
+                    if ui.add(crate::widgets::checkbox(&mut italic, tl!("Italic"))).clicked() {
+                        styled = Some(BmAction::SetStyle(path.to_vec(), None, Some(italic)));
+                    }
+                });
+                ui.menu_button(tl!("Colour"), |ui| {
+                    let current = item.color.map_or([0.0; 3], |c| c.map(f64::from));
+                    if let Some(c) = crate::comments::swatch_grid(ui, Some(current)) {
+                        styled = Some(BmAction::SetColor(path.to_vec(), c));
+                    }
+                });
+                if styled.is_some() {
+                    ui.close();
+                }
+                ui.separator();
+                pick(ui, tl!("Move up"), i > 0, BmAction::MoveUp(path.to_vec()));
+                pick(ui, tl!("Move down"), i + 1 < siblings, BmAction::MoveDown(path.to_vec()));
+                pick(ui, tl!("Indent"), i > 0, BmAction::Indent(path.to_vec()));
+                pick(ui, tl!("Outdent"), depth > 0, BmAction::Outdent(path.to_vec()));
+                ui.separator();
+                pick(ui, tl!("Delete"), true, BmAction::Delete(path.to_vec()));
+                if let Some(a) = styled {
+                    *cx.action = Some(a);
+                }
+            });
+        }
+    }
+    if open {
+        for (ci, c) in item.children.iter().enumerate() {
+            let mut p = path.to_vec();
+            p.push(ci);
+            outline_item(ui, t, info, c, &p, item.children.len(), cx);
+        }
+    }
+}
+
+#[cfg(test)]
+mod label_column {
+    use super::ellipsized_prefix;
+
+    /// A short page label (the usual "3", "iv", "1-1") is shown unchanged.
+    #[test]
+    fn short_labels_are_not_touched() {
+        for label in ["3", "iv", "1-1", "A-201"] {
+            assert_eq!(ellipsized_prefix(label, |s| s.len() <= 10), label);
+        }
+    }
+
+    /// A label wider than its column (#124: whole section titles in /PageLabels) keeps only
+    /// the head that fits, with an ellipsis, and that head is a prefix of the real label.
+    #[test]
+    fn long_labels_are_cut_to_their_column_with_an_ellipsis() {
+        let label = "Floor Plans (001 Floor Plans): GROUND FLOOR PLAN";
+        let shown = ellipsized_prefix(label, |s| s.len() <= 20);
+        assert!(shown.ends_with('\u{2026}'), "{shown:?}");
+        assert!(shown.len() <= 20, "{shown:?}");
+        assert!(label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
+    }
+
+    /// CJK labels (three bytes per character) are cut on character boundaries too.
+    #[test]
+    fn multibyte_labels_are_cut_on_char_boundaries() {
+        let label = "図面（一階平面図）：配置図";
+        let shown = ellipsized_prefix(label, |s| s.len() <= 12);
+        assert!(shown.ends_with('\u{2026}'), "{shown:?}");
+        assert!(shown.len() <= 12, "{shown:?}");
+        assert!(label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
+    }
+
+    /// The pathological floor: nothing fits, the loop still ends with the lone ellipsis.
+    #[test]
+    fn the_loop_ends_when_nothing_fits() {
+        assert_eq!(ellipsized_prefix("Floor Plans", |_| false), "\u{2026}");
+    }
+
+    /// A huge label from a hostile file is measured a bounded number of times per frame.
+    #[test]
+    fn a_huge_label_is_measured_a_bounded_number_of_times() {
+        let label = "x".repeat(1_000_000);
+        let mut calls = 0;
+        let shown = ellipsized_prefix(&label, |s| {
+            calls += 1;
+            s.len() <= 12
+        });
+        assert!(calls <= super::LABEL_MEASURE_CHARS + 1, "{calls} measurements");
+        assert!(shown.ends_with('\u{2026}') && label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
+    }
+}
+
+#[cfg(test)]
+mod bookmark_filter {
+    use super::{outline_matches, title_format};
+    use crate::theme::{self, Tokens};
+    use pdfcraft_render::OutlineItem;
+
+    /// #3193: a bookmark's title is drawn in its own style and colour.
+    #[test]
+    fn bookmark_titles_take_their_style_and_colour() {
+        let t = Tokens::for_kind(crate::theme::ThemeKind::Light);
+        let plain = item("Plain", Vec::new());
+        assert_eq!(title_format(&plain, 0, &t).font_id, theme::medium(13.0));
+        assert_eq!(title_format(&plain, 1, &t).font_id, theme::regular(13.0));
+        assert_eq!(title_format(&plain, 1, &t).color, t.text);
+        assert!(!title_format(&plain, 1, &t).italics);
+        let styled = OutlineItem { color: Some([1.0, 0.0, 0.0]), italic: true, bold: true, ..item("Styled", Vec::new()) };
+        let f = title_format(&styled, 1, &t);
+        assert_eq!(f.font_id, theme::semibold(13.0));
+        assert!(f.italics);
+        assert_eq!(f.color, egui::Color32::from_rgb(255, 0, 0));
+        let half = OutlineItem { color: Some([0.0, 0.5, 0.0]), ..item("Green", Vec::new()) };
+        assert_eq!(title_format(&half, 1, &t).color, egui::Color32::from_rgb(0, 128, 0));
+    }
+
+    fn item(title: &str, children: Vec<OutlineItem>) -> OutlineItem {
+        OutlineItem {
+            title: title.into(),
+            page: Some(0),
+            view: pdfcraft_render::DestView::Top,
+            children,
+            open: true,
+            color: None,
+            italic: false,
+            bold: false,
+        }
+    }
+
+    /// Turkish dotted and dotless i match in any case, as in Find (#892).
+    #[test]
+    fn titles_match_in_any_case_with_turkish_i() {
+        let outline = [item("İSTANBUL ŞUBESİ", vec![item("Kış dönemi", vec![])]), item("Ankara", vec![])];
+        let fold = pdfcraft_render::text::fold_case;
+        assert_eq!(outline_matches(&outline, &fold("istanbul")).len(), 1);
+        assert_eq!(outline_matches(&outline, &fold("şubesi")).len(), 1);
+        // A child match keeps its parent: [0] and [0, 0].
+        assert_eq!(outline_matches(&outline, &fold("KIŞ")).len(), 2);
+        assert!(outline_matches(&outline, &fold("izmir")).is_empty());
+    }
+}
diff --git a/crates/ui-egui/src/comments_panel.rs b/crates/ui-egui/src/panels/comments_panel.rs
similarity index 86%
rename from crates/ui-egui/src/comments_panel.rs
rename to crates/ui-egui/src/panels/comments_panel.rs
index 6c13d78d33..54ca9e5152 100644
--- a/crates/ui-egui/src/comments_panel.rs
+++ b/crates/ui-egui/src/panels/comments_panel.rs
@@ -1,8 +1,9 @@
 //! The Comments panel (Acrobat's right-hand comment list; 11-visual-spec §3, audit `a15-*`).
 //!
-//! Header "Comments N" with search; an "Add a comment" box that posts a sticky note on the
-//! current page; cards grouped by page. Selecting a card selects the comment on the page and
-//! opens its reply box and "…" menu (Edit, Set status, Delete). Status replies show as a badge.
+//! Header "Comments N" (comments, as Acrobat counts them) with "N replies" under it and search;
+//! an "Add a comment" box that posts a sticky note on the current page; cards grouped by page.
+//! Selecting a card selects the comment on the page and opens its reply box and "…" menu (Edit,
+//! Set status, Delete). Status replies show as a badge.
 
 use std::collections::HashMap;
 
@@ -87,9 +88,16 @@ pub fn is_marked(thread: &[&Annotation]) -> bool {
     thread.iter().rev().find(|r| r.is_mark()).is_some_and(|r| r.state.as_deref() == Some("Marked"))
 }
 
-/// The number shown in the header: comments and their replies (not status changes).
+/// The number shown in the header: comments, not their replies or status changes (as Acrobat
+/// counts them).
 pub fn count(info: &DocInfo) -> usize {
-    info.annotations.iter().filter(|a| a.state.is_none()).count()
+    info.annotations.iter().filter(|a| a.is_comment()).count()
+}
+
+/// The replies under the header's count, at any depth: not status changes, checkmarks or a
+/// Replace Text caret (grouped with its strikeout, not a reply to it).
+pub fn reply_count(info: &DocInfo) -> usize {
+    info.annotations.iter().filter(|a| a.is_reply() && a.state.is_none() && !a.grouped).count()
 }
 
 fn matches(a: &Annotation, q: &str) -> bool {
@@ -116,7 +124,9 @@ pub(crate) fn show(
     let mut edit = None;
     // Search (the header's magnifier toggles it).
     if let Some(q) = view.comments.search.as_mut() {
-        let r = ui.add(crate::widgets::line(q).hint_text(tl!("Search comments")).desired_width(f32::INFINITY).id_salt("comment-search"));
+        let r = ui
+            .add(crate::widgets::line(q).hint_text(tl!("Search comments")).desired_width(f32::INFINITY).id_salt("comment-search"))
+            .accessible_name(tl!("Search comments"));
         if view.comments.search_focus {
             r.request_focus();
             view.comments.search_focus = false;
@@ -125,9 +135,14 @@ pub(crate) fn show(
     }
     // "Add a comment": a sticky note on the current page, near its top-right corner.
     if allowed {
-        let r = ui.add(
-            crate::widgets::line(&mut view.comments.add_box).hint_text(tl!("Add a comment")).desired_width(f32::INFINITY).id_salt("comment-add-box"),
-        );
+        let r = ui
+            .add(
+                crate::widgets::line(&mut view.comments.add_box)
+                    .hint_text(tl!("Add a comment"))
+                    .desired_width(f32::INFINITY)
+                    .id_salt("comment-add-box"),
+            )
+            .accessible_name(tl!("Add a comment"));
         if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) && !view.comments.add_box.trim().is_empty() {
             let page = view.current.min(info.pages.len().saturating_sub(1));
             if let Some(p) = info.pages.get(page) {
@@ -157,25 +172,32 @@ pub(crate) fn show(
         return edit;
     }
     let query = view.comments.search.clone().filter(|q| !q.trim().is_empty());
-    let mut replies: HashMap<&str, Vec<&Annotation>> = HashMap::new();
+    let mut replies: HashMap<(usize, usize), Vec<&Annotation>> = HashMap::new();
     let mut page_counts: HashMap<usize, usize> = HashMap::new();
-    // Keep global name matching and source reply order. Page badges count roots before filtering.
+    // Replies find their parent by reference (`/NM` need not be unique) and keep source order.
+    // A reply at any depth joins the thread of the comment it starts from, as comment_list lists
+    // it. A status or checkmark stays with the annotation it was set on (its `/IRT` names it,
+    // ISO 32000-2 §12.5.6.2): one set on a reply, at any depth, is that reply's and not the
+    // comment's, so the card's badge and checkmark leave it out (comment_list reports it on the
+    // reply). Page badges count roots before filtering.
+    let tops = pdfcraft_render::thread_tops(&info.annotations);
     for a in &info.annotations {
-        if let Some(parent) = a.in_reply_to.as_deref() {
-            replies.entry(parent).or_default().push(a);
-        } else {
+        if let Some(parent) = a.parent {
+            let key = if a.state.is_none() { tops.get(&(a.page, a.index)).copied().unwrap_or(parent) } else { parent };
+            replies.entry(key).or_default().push(a);
+        } else if a.is_comment() {
             let count = page_counts.entry(a.page).or_default();
             *count = count.saturating_add(1);
         }
     }
-    let replies_of = |a: &Annotation| -> &[&Annotation] { a.name.as_deref().and_then(|name| replies.get(name)).map(Vec::as_slice).unwrap_or(&[]) };
+    let replies_of = |a: &Annotation| -> &[&Annotation] { replies.get(&(a.page, a.index)).map(Vec::as_slice).unwrap_or(&[]) };
     let cv = &view.comments;
     let status_of =
         |a: &Annotation| replies_of(a).iter().rev().filter(|r| !r.is_mark()).find_map(|r| r.state.clone()).unwrap_or_else(|| "None".into());
     let mut roots: Vec<&Annotation> = info
         .annotations
         .iter()
-        .filter(|a| a.in_reply_to.is_none())
+        .filter(|a| a.is_comment())
         .filter(|a| query.as_deref().is_none_or(|q| matches(a, q) || replies_of(a).iter().any(|r| matches(r, q))))
         .filter(|a| !cv.hidden_types.iter().any(|t| t == kind_label(a)))
         .filter(|a| !cv.hidden_authors.contains(&a.author.clone().unwrap_or_default()))
@@ -223,9 +245,7 @@ pub(crate) fn show(
             if g.is_some() && g != group {
                 ui.add_space(6.0);
                 let title = g.clone().unwrap_or_default();
-                // Catalog labels are already in display order; an author's name is put in it here.
-                let shown = if sort == SortBy::Author && a.author.is_some() { crate::bidi::visual_auto(&title) } else { tl!(&title).into() };
-                ui.label(egui::RichText::new(shown).font(theme::semibold(12.5)).color(t.text_muted));
+                ui.label(egui::RichText::new(tl!(&title)).font(theme::semibold(12.5)).color(t.text_muted));
                 group = g;
             }
         } else if a.page != page {
@@ -272,6 +292,8 @@ pub(crate) fn show(
     edit
 }
 
+/// Draw one comment thread card, including author, body or inline editor, replies, status and per-comment
+/// actions; returns an edit to apply.
 #[allow(clippy::too_many_arguments)]
 fn card(
     ui: &mut egui::Ui,
@@ -304,9 +326,11 @@ fn card(
         .show(ui, |ui| {
             ui.set_width(ui.available_width());
             let mut buttons_left = f32::INFINITY;
+            let mut above = egui::Rect::NOTHING;
             let head = ui.horizontal(|ui| {
-                avatar(ui, t, Some(subtype_icon(&a.subtype)), None, color);
-                let author = a.author.as_deref().map_or_else(|| tl!("Unknown author").into(), crate::bidi::visual_auto);
+                above = avatar(ui, t, Some(subtype_icon(&a.subtype)), None, color);
+                // The catalogue and author names stay logical: egui lays out RTL text itself.
+                let author = a.author.as_deref().map_or_else(|| tl!("Unknown author"), |name| name);
                 ui.label(egui::RichText::new(author).font(theme::semibold(12.5)).color(t.text));
                 if let Some(m) = &a.modified {
                     ui.add(egui::Label::new(egui::RichText::new(m).font(theme::regular(11.0)).color(t.text_faint)).truncate());
@@ -376,15 +400,17 @@ fn card(
                     });
                 }
             });
-            // Replies, joined to the parent by a thread line.
+            // Replies, each joined to the avatar above it (the comment's or the previous reply's)
+            // by a thread line that runs the whole gap.
             for r in &replies {
                 ui.add_space(8.0);
-                let resp = ui.horizontal(|ui| {
-                    avatar(ui, t, None, Some(&initials(r.author.as_deref().unwrap_or("?"))), t.text_faint);
+                let mut me = egui::Rect::NOTHING;
+                ui.horizontal(|ui| {
+                    me = avatar(ui, t, None, Some(&initials(r.author.as_deref().unwrap_or("?"))), t.text_faint);
                     ui.vertical(|ui| {
                         ui.spacing_mut().item_spacing.y = 2.0;
                         ui.horizontal(|ui| {
-                            let author = r.author.as_deref().map_or_else(|| tl!("Reply").into(), crate::bidi::visual_auto);
+                            let author = r.author.as_deref().map_or_else(|| tl!("Reply"), |name| name);
                             ui.label(egui::RichText::new(author).font(theme::semibold(12.0)));
                             if let Some(m) = &r.modified {
                                 ui.add(egui::Label::new(egui::RichText::new(m).font(theme::regular(11.0)).color(t.text_faint)).truncate());
@@ -393,8 +419,12 @@ fn card(
                         widgets::wrapped_text(ui, r.contents.as_deref().unwrap_or(""), theme::regular(12.5), t.text, false);
                     });
                 });
-                let x = resp.response.rect.left() + 12.0;
-                ui.painter().vline(x, (resp.response.rect.top() - 14.0)..=(resp.response.rect.top() - 2.0), Stroke::new(1.5, t.border));
+                // The circles are 12 px in radius; leave a 1 px gap at each end.
+                let (top, bottom) = (above.center().y + 13.0, me.center().y - 13.0);
+                if above.is_positive() && top < bottom {
+                    ui.painter().vline(me.center().x, top..=bottom, Stroke::new(1.5, t.border));
+                }
+                above = me;
             }
             if selected && allowed {
                 ui.add_space(8.0);
@@ -439,7 +469,7 @@ fn card(
     // clickable everywhere.
     let hit = if selected { frame.inner } else { rect };
     let click = ui
-        .interact(hit, ui.id().with(("card", key)), Sense::click())
+        .interact(hit, ui.scope_id().with(("card", key)), Sense::click())
         .on_hover_cursor(egui::CursorIcon::PointingHand)
         .on_hover_text(crate::i18n::fmt(tl!("{kind} — click to show it on the page"), &[("kind", tl!(kind_label(a)))]));
     if click.clicked() {
@@ -450,7 +480,7 @@ fn card(
     if click.double_clicked() && allowed {
         view.comments.open_editor(a.page, a.index, a.contents.clone().unwrap_or_default());
     }
-    let menu_id = ui.id().with(("card-menu", key));
+    let menu_id = ui.scope_id().with(("card-menu", key));
     if open_menu {
         egui::Popup::open_id(ui.ctx(), menu_id);
     }
@@ -501,8 +531,8 @@ fn card(
     edit
 }
 
-/// A 26 pt round badge: a type glyph (comments) or initials (replies).
-fn avatar(ui: &mut egui::Ui, t: &Tokens, icon: Option<&str>, text: Option<&str>, color: Color32) {
+/// A 26 pt round badge: a type glyph (comments) or initials (replies). Returns where it was drawn.
+fn avatar(ui: &mut egui::Ui, t: &Tokens, icon: Option<&str>, text: Option<&str>, color: Color32) -> egui::Rect {
     let (r, _) = ui.allocate_exact_size(vec2(26.0, 26.0), Sense::hover());
     let bg = if t.dark() { Color32::from_gray(0x55) } else { Color32::from_gray(0xD8) };
     ui.painter().circle_filled(r.center(), 12.0, bg);
@@ -512,6 +542,7 @@ fn avatar(ui: &mut egui::Ui, t: &Tokens, icon: Option<&str>, text: Option<&str>,
     if let Some(s) = text {
         ui.painter().text(r.center(), egui::Align2::CENTER_CENTER, s, theme::semibold(10.5), t.text);
     }
+    r
 }
 
 /// Darken very light annotation colours (e.g. note yellow) so their glyph stays legible.
@@ -530,15 +561,13 @@ fn legible(c: Color32, t: &Tokens) -> Color32 {
 pub(crate) fn header_controls(ui: &mut egui::Ui, info: &DocInfo, view: &mut DocView, hidden: bool) -> Option<&'static str> {
     let mut command = None;
     let cv = &mut view.comments;
-    let mut types: Vec<String> = info.annotations.iter().filter(|a| a.in_reply_to.is_none()).map(|a| kind_label(a).to_string()).collect();
+    let mut types: Vec<String> = info.annotations.iter().filter(|a| a.is_comment()).map(|a| kind_label(a).to_string()).collect();
     types.sort();
     types.dedup();
-    let mut authors: Vec<String> =
-        info.annotations.iter().filter(|a| a.in_reply_to.is_none()).map(|a| a.author.clone().unwrap_or_default()).collect();
+    let mut authors: Vec<String> = info.annotations.iter().filter(|a| a.is_comment()).map(|a| a.author.clone().unwrap_or_default()).collect();
     authors.sort();
     authors.dedup();
-    let mut colors: Vec<(String, Option<[f32; 3]>)> =
-        info.annotations.iter().filter(|a| a.in_reply_to.is_none()).map(|a| (color_key(a), a.color)).collect();
+    let mut colors: Vec<(String, Option<[f32; 3]>)> = info.annotations.iter().filter(|a| a.is_comment()).map(|a| (color_key(a), a.color)).collect();
     colors.sort_by(|a, b| a.0.cmp(&b.0));
     colors.dedup_by(|a, b| a.0 == b.0);
     let active = !(cv.hidden_types.is_empty()
@@ -615,8 +644,7 @@ pub(crate) fn header_controls(ui: &mut egui::Ui, info: &DocInfo, view: &mut DocV
         ui.separator();
         ui.label(egui::RichText::new(tl!("Author")).small());
         for a in &authors {
-            let name = crate::bidi::visual_auto(a);
-            toggle(ui, &mut cv.hidden_authors, a, if a.is_empty() { tl!("Unknown author") } else { &name });
+            toggle(ui, &mut cv.hidden_authors, a, if a.is_empty() { tl!("Unknown author") } else { a.as_str() });
         }
         ui.separator();
         ui.label(egui::RichText::new(tl!("Status")).small());
diff --git a/crates/ui-egui/src/panels/edit.rs b/crates/ui-egui/src/panels/edit.rs
new file mode 100644
index 0000000000..e10d0d01ee
--- /dev/null
+++ b/crates/ui-egui/src/panels/edit.rs
@@ -0,0 +1,370 @@
+use super::tools::row_label;
+use super::*;
+
+/// The page operations Edit shows as a row of icon buttons, as Acrobat's Edit panel does.
+const EDIT_PAGE_BUTTONS: [&str; 4] = ["page.rotate", "page.insert", "page.delete", "page.extract"];
+
+/// Add content items shown before More.
+const EDIT_CONTENT_SHOWN: usize = 5;
+
+/// Other options: the tools Acrobat's Edit panel links to.
+const EDIT_OTHER_TOOLS: [&str; 3] = ["combine", "redact", "form"];
+
+/// Edit a PDF, laid out as Acrobat's Edit panel: the title with Preferences and Close; Format text
+/// while text is being edited or added; Modify page as a row of icon buttons and Organize pages;
+/// Add content with the rarer items under More; and Other options, the neighbouring tools.
+/// Edit text & images itself is on the floating toolbar, and on from the moment Edit opens.
+/// Every item comes from the catalogue, so its label, icon and availability have one source.
+pub(super) fn edit_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static ToolGroup) {
+    let items = || g.sections.iter().flat_map(|s| s.items.iter());
+    let item = |command: &str| items().find(|i| i.command == command);
+    let mut run = None;
+    let mut tool = None;
+    // Back to All tools only when Edit was opened from there; the Edit tab is its own way back.
+    let from_all_tools = app.mode != crate::Mode::Edit;
+    ui.horizontal(|ui| {
+        if from_all_tools && icons::button(ui, "chevron-left", 26.0, false, tl!("Back to all tools")).clicked() {
+            app.left = LeftPanel::AllTools;
+            app.enter_mode(crate::Mode::AllTools);
+        }
+        // "Edit" under the Edit tab, as Acrobat titles it; the tool's own name from All tools.
+        let title = if from_all_tools { tl!(g.label) } else { tl!("Edit") };
+        let title_width = (ui.available_width() - 2.0 * (26.0 + ui.spacing().item_spacing.x)).max(1.0);
+        ui.add_sized([title_width, 26.0], egui::Label::new(egui::RichText::new(title).font(theme::semibold(15.5)).color(t.text)).truncate())
+            .on_hover_text(title);
+        if icons::button(ui, "settings", 26.0, false, tl!("Preferences")).clicked() {
+            run = Some("app.preferences");
+        }
+        if icons::button(ui, "x", 26.0, false, tl!("Close panel")).clicked() {
+            app.left_open = false;
+        }
+    });
+    ui.add_space(4.0);
+    ui.separator();
+    ui.add_space(6.0);
+    // Several objects selected: how many, and how to move them. Acrobat's panel has no idle hint.
+    let count = app.active_ids().filter(|_| app.quick_tool == crate::QuickTool::EditText).map_or(0, |(i, _)| app.views[i].objects.count());
+    if count > 0 {
+        ui.label(crate::i18n::trn(crate::i18n::current(), count as u64, "{n} object selected", "{n} objects selected"));
+        ui.label(tl!("Drag the selection to move it. Esc clears the selection."));
+        ui.add_space(6.0);
+    }
+    // Format text at the top while text is selected or being added.
+    format_section(app, ui, t);
+    egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+        widgets::section_title(ui, tl!("Modify page"));
+        ui.horizontal(|ui| {
+            ui.spacing_mut().item_spacing.x = 6.0;
+            for i in EDIT_PAGE_BUTTONS.iter().filter_map(|c| item(c)) {
+                // Enabled as the command itself is: a document that forbids page assembly refuses these.
+                let enabled = pdfcraft_engine::commands::command(i.command).is_some_and(|spec| app.command_enabled(spec));
+                let resp = ui.add_enabled_ui(enabled, |ui| icons::button(ui, i.icon, 34.0, false, tl!(i.label))).inner;
+                if resp.clicked() {
+                    run = Some(i.command);
+                }
+            }
+        });
+        ui.add_space(2.0);
+        // Organize pages is a workspace of its own: its panel replaces this one, with the grid.
+        if let Some(i) = item("page.organize")
+            && edit_row(ui, t, i.icon, tl!(i.label), i.availability).clicked()
+        {
+            // With no document there is no grid to open: the command asks for a file first.
+            if app.active.is_some() {
+                tool = Some("organize");
+            } else {
+                run = Some("page.organize");
+            }
+        }
+
+        widgets::section_title(ui, tl!("Add content"));
+        let content: Vec<_> =
+            g.sections.iter().filter(|s| s.title == "Add content").flat_map(|s| s.items.iter()).filter(|i| i.command != "edit.edit_text").collect();
+        let more_id = egui::Id::unique("edit_panel_more");
+        let more = ui.data(|d| d.get_temp::<bool>(more_id)).unwrap_or(false);
+        let shown = if more { content.len() } else { EDIT_CONTENT_SHOWN.min(content.len()) };
+        for i in content.iter().take(shown) {
+            let resp = edit_row(ui, t, i.icon, tl!(i.label), i.availability);
+            // Header and footer, Watermark and Background open their Add / Update / Remove menu.
+            if i.actions.is_empty() {
+                if resp.clicked() {
+                    run = Some(i.command);
+                }
+            } else if let Some(cmd) = actions_menu(app, ui, &resp, i, resp.rect.right_center() - vec2(14.0, 0.0), t.text) {
+                run = Some(cmd);
+            }
+        }
+        if content.len() > EDIT_CONTENT_SHOWN {
+            ui.add_space(4.0);
+            let label = if more { tl!("Less") } else { tl!("More") };
+            let resp = ui
+                .add(
+                    egui::Label::new(egui::RichText::new(label).color(t.accent_text).font(theme::medium(13.0)))
+                        .selectable(false)
+                        .sense(Sense::click()),
+                )
+                .on_hover_cursor(egui::CursorIcon::PointingHand);
+            if resp.clicked() {
+                ui.data_mut(|d| d.insert_temp(more_id, !more));
+            }
+        }
+
+        widgets::section_title(ui, tl!("Other options"));
+        for other in EDIT_OTHER_TOOLS.iter().filter_map(|id| catalog::group(id)) {
+            if edit_row(ui, t, other.icon, tl!(other.label), other.availability).clicked() {
+                tool = Some(other.id);
+            }
+        }
+    });
+    if let Some(id) = tool {
+        app.select_tool(id);
+    }
+    if let Some(cmd) = run {
+        app.run_command(cmd);
+    }
+}
+
+/// A tool entry with further commands (Add / Update / Remove): a caret at `caret` says it opens a
+/// menu, and each command is enabled by its own needs. Returns the command chosen.
+pub(super) fn actions_menu(
+    app: &PdfCraftApp,
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    item: &ToolItem,
+    caret: egui::Pos2,
+    color: Color32,
+) -> Option<&'static str> {
+    ui.painter().add(egui::Shape::convex_polygon(
+        vec![caret + vec2(-3.5, -2.0), caret + vec2(3.5, -2.0), caret + vec2(0.0, 2.5)],
+        color,
+        egui::Stroke::NONE,
+    ));
+    let mut run = None;
+    egui::Popup::menu(resp).show(|ui| {
+        ui.set_min_width(180.0);
+        for (n, id) in item.actions.iter().enumerate() {
+            let Some(spec) = pdfcraft_engine::commands::command(id) else { continue };
+            // Add stays usable with no document open: it asks for a file first.
+            let enabled = (n == 0 && app.active.is_none()) || app.command_enabled(spec);
+            let label = crate::i18n::menu_label(spec.id, spec.label);
+            if ui.add_enabled(enabled, egui::Button::new(label)).clicked() {
+                run = Some(spec.id);
+                ui.close();
+            }
+        }
+    });
+    run
+}
+
+/// One row of the Edit panel: a monochrome icon and the label, as Acrobat draws them. A planned
+/// item is muted and says when it ships when hovered.
+fn edit_row(ui: &mut egui::Ui, t: &Tokens, icon: &str, label: &str, availability: Availability) -> egui::Response {
+    let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label));
+    let press = theme::Press::track(ui, &resp);
+    press.wash(ui, rect, 6, false);
+    let body = rect.translate(press.offset());
+    let ready = availability == Availability::Ready;
+    let fg = if ready { t.text } else { t.text_muted };
+    icons::paint(ui, Rect::from_min_size(body.min + vec2(6.0, 8.0), vec2(18.0, 18.0)), icon, 17.0, if ready { t.text } else { t.text_faint });
+    row_label(ui, label, theme::regular(13.5), fg, body.left_center() + vec2(34.0, 0.0), rect.width() - 42.0);
+    let resp = theme::hand(resp);
+    match availability {
+        Availability::Ready => resp,
+        Availability::Planned(m) => resp.on_hover_text(format!("{} {m}", tl!("Planned for milestone"))),
+        Availability::Provider => resp.on_hover_text(tl!("Optional: needs an AI provider you configure")),
+    }
+}
+
+/// Add a stamp: Dynamic, Sign Here and Standard Business stamps; click one, then click on the
+/// page to place it.
+pub(super) fn stamp_palette(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
+    use pdfcraft_engine::{StampGroup, StampKind};
+    ui.label(egui::RichText::new(tl!("Choose a stamp, then click on the page to place it.")).small().color(t.text_faint));
+    egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+        for (group, title) in [
+            (StampGroup::Dynamic, tl!("Dynamic")),
+            (StampGroup::SignHere, tl!("Sign Here")),
+            (StampGroup::StandardBusiness, tl!("Standard Business")),
+        ] {
+            widgets::section_title(ui, title);
+            for kind in StampKind::ALL.into_iter().filter(|k| k.group() == group) {
+                let active = app.quick_tool == crate::QuickTool::Stamp(kind);
+                let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 38.0), Sense::click());
+                resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, active, kind.label()));
+                let press = theme::Press::track(ui, &resp);
+                press.wash(ui, rect, 6, active);
+                let body = rect.translate(press.offset());
+                let [r, g, b] = kind.color().map(|v| (v * 255.0) as u8);
+                let col = Color32::from_rgb(r, g, b);
+                let chip = Rect::from_min_size(body.min + vec2(8.0, 5.0), vec2((rect.width() - 16.0).min(200.0), 28.0));
+                if group == StampGroup::SignHere {
+                    let tip = chip.height() * 0.45;
+                    let pts = vec![
+                        chip.left_center(),
+                        chip.left_top() + vec2(tip, 0.0),
+                        chip.right_top(),
+                        chip.right_bottom(),
+                        chip.left_bottom() + vec2(tip, 0.0),
+                    ];
+                    ui.painter().add(egui::Shape::convex_polygon(pts, col, Stroke::NONE));
+                    let label = kind.label();
+                    let font = theme::semibold(11.0);
+                    let shown = crate::widgets::fit_line(label, (chip.width() - 10.0).max(0.0), |s| crate::widgets::text_width(ui, s, &font));
+                    ui.painter().with_clip_rect(chip.shrink(3.0)).text(
+                        chip.center() + vec2(tip / 2.0, 0.0),
+                        Align2::CENTER_CENTER,
+                        shown,
+                        font,
+                        Color32::WHITE,
+                    );
+                } else {
+                    ui.painter().rect(chip, CornerRadius::same(5), col.gamma_multiply(0.1), Stroke::new(1.5, col), egui::StrokeKind::Inside);
+                    let y = if group == StampGroup::Dynamic { chip.center().y - 4.0 } else { chip.center().y };
+                    let font = theme::semibold(11.0);
+                    let shown = crate::widgets::fit_line(kind.label(), (chip.width() - 10.0).max(0.0), |s| crate::widgets::text_width(ui, s, &font));
+                    ui.painter().with_clip_rect(chip.shrink(3.0)).text(egui::pos2(chip.center().x, y), Align2::CENTER_CENTER, shown, font, col);
+                    if group == StampGroup::Dynamic {
+                        let by = "By name at time, date";
+                        let by_font = theme::regular(7.5);
+                        let by_shown = crate::widgets::fit_line(by, (chip.width() - 8.0).max(0.0), |s| crate::widgets::text_width(ui, s, &by_font));
+                        ui.painter().with_clip_rect(chip.shrink(2.0)).text(
+                            egui::pos2(chip.center().x, chip.bottom() - 6.0),
+                            Align2::CENTER_CENTER,
+                            by_shown,
+                            by_font,
+                            col,
+                        );
+                    }
+                }
+                if theme::hand(resp).clicked() {
+                    app.quick_tool = crate::QuickTool::Stamp(kind);
+                }
+            }
+        }
+        crate::stamps_ui::palette_section(app, ui, t);
+    });
+}
+
+/// Edit a PDF ▸ Format text: for the selected added text (one undoable change), or the style
+/// new text gets.
+fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
+    // Editing a paragraph of existing text: its formatting, applied as it changes.
+    if let Some((i, _)) = app.active_ids()
+        && let Some(ed) = app.views[i].line_editor.clone()
+    {
+        use crate::format_text_ui::{FontChoice, Fonts};
+        let mut ed = ed;
+        let sources: Vec<(String, String)> = app
+            .session
+            .get(app.views[i].id)
+            .map(|d| d.text_editor_fonts(ed.page))
+            .unwrap_or_default()
+            .into_iter()
+            .map(|f| (f.resource, f.face))
+            .collect();
+        let shown = ed.font_shown(&sources);
+        let out = crate::format_text_ui::panel(ui, t, &mut ed.look, Some(&mut ed.extras), Fonts { sources: Some(&sources), shown });
+        let mut changed = out.changed;
+        match out.font {
+            Some(FontChoice::KeepSource) => {
+                ed.keep_source_font();
+                changed = true;
+            }
+            Some(FontChoice::Resource(resource)) => {
+                ed.font_resource = Some(resource);
+                changed = true;
+            }
+            Some(FontChoice::Family(family)) => {
+                ed.choose_family(family);
+                changed = true;
+            }
+            Some(FontChoice::Load) => app.pick_files(crate::files::FilePurpose::TextFont { page: ed.page }, false),
+            #[cfg(not(target_arch = "wasm32"))]
+            Some(FontChoice::Installed(path)) => app.use_paths(crate::files::FilePurpose::TextFont { page: ed.page }, &[path]),
+            #[cfg(target_arch = "wasm32")]
+            Some(FontChoice::Installed(_)) => {}
+            None => {}
+        }
+        if changed {
+            app.apply_line_format(i, ed, Some(ui.ctx()));
+        }
+        return;
+    }
+    let image = app.active_ids().and_then(|(i, id)| {
+        let (page, index) = app.views[i].content.selected?;
+        let doc = app.session.get(id)?;
+        match &doc.added().iter().filter(|a| a.page == page).nth(index)?.content {
+            pdfcraft_engine::AddedContent::Image(img) => Some((page, index, img.clone())),
+            _ => None,
+        }
+    });
+    if let Some((page, index, img)) = image {
+        match crate::content_ui::image_panel(ui, t, &img) {
+            Some(crate::content_ui::ImageAction::Update(content)) => {
+                app.apply_edit(pdfcraft_engine::Edit::UpdateContent { page, index, content });
+            }
+            Some(crate::content_ui::ImageAction::Replace) => app.replace_image_dialog(page, index),
+            None => {}
+        }
+        ui.add_space(6.0);
+        ui.separator();
+        return;
+    }
+    let selected = app.active_ids().and_then(|(i, id)| {
+        let (page, index) = app.views[i].content.selected?;
+        let doc = app.session.get(id)?;
+        let a = doc.added().iter().filter(|a| a.page == page).nth(index)?;
+        match &a.content {
+            pdfcraft_engine::AddedContent::Text(text) => Some((page, index, text.clone())),
+            _ => None,
+        }
+    });
+    match selected {
+        Some((page, index, text)) => {
+            let mut style = text.clone();
+            added_text_format(ui, t, &mut style);
+            if style != text {
+                // The reusable style follows the selection only when the edit took, so a refused one adds nothing odd later.
+                if app.apply_edit(pdfcraft_engine::Edit::UpdateContent { page, index, content: pdfcraft_engine::AddedContent::Text(style.clone()) }) {
+                    app.text_style = pdfcraft_engine::AddedText { text: String::new(), rect: [0.0; 4], ..style };
+                }
+            }
+        }
+        None if app.quick_tool == crate::QuickTool::AddText => {
+            crate::content_ui::hint(ui, t);
+            let mut style = app.text_style.clone();
+            added_text_format(ui, t, &mut style);
+            app.text_style = style;
+        }
+        None => {}
+    }
+}
+
+/// Format text for added text: the standard families, size, colour, style and alignment.
+fn added_text_format(ui: &mut egui::Ui, t: &Tokens, style: &mut pdfcraft_engine::AddedText) {
+    let shown = style.family.label().to_string();
+    let out = crate::format_text_ui::panel(ui, t, style, None, crate::format_text_ui::Fonts { sources: None, shown });
+    if let Some(crate::format_text_ui::FontChoice::Family(family)) = out.font {
+        style.family = family;
+    }
+}
+
+impl PdfCraftApp {
+    /// Apply the open paragraph's formatting as one change; the paragraph stays open.
+    pub(crate) fn apply_line_format(&mut self, index: usize, mut ed: crate::edit_text_ui::LineEditor, ctx: Option<&egui::Context>) {
+        let edit = pdfcraft_engine::Edit::EditTextBlock { page: ed.page, block: ed.block, text: ed.text.clone(), style: ed.style() };
+        if self.apply_edit(edit) {
+            ed.applied();
+            if let Some(doc) = self.session.get(self.views[index].id)
+                && let Some(block) = doc.text_blocks(ed.page).get(ed.block)
+            {
+                ed.refresh_source(block, doc.text_lines(ed.page));
+                if let Some(ctx) = ctx {
+                    ed.fonts = crate::edit_text_ui::install_source_fonts(ctx, doc, ed.page);
+                }
+            }
+        }
+        self.views[index].line_editor = Some(ed);
+    }
+}
diff --git a/crates/ui-egui/src/format_text_ui.rs b/crates/ui-egui/src/panels/format_text_ui.rs
similarity index 96%
rename from crates/ui-egui/src/format_text_ui.rs
rename to crates/ui-egui/src/panels/format_text_ui.rs
index 9849920ac6..6cf07ce05d 100644
--- a/crates/ui-egui/src/format_text_ui.rs
+++ b/crates/ui-egui/src/panels/format_text_ui.rs
@@ -78,7 +78,7 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, look: &mut AddedText, extras:
 
     // The font, across the panel.
     let width = ui.available_width();
-    egui::ComboBox::from_id_salt("format-font")
+    craft_ui::ComboBox::from_id_salt("format-font")
         .selected_text(fonts.shown.as_str())
         .width(width)
         .show_ui(ui, |ui| {
@@ -128,7 +128,7 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, look: &mut AddedText, extras:
 
     // Size and colour | bullets, numbering and alignment.
     row(ui, |ui| {
-        let _ = egui::ComboBox::from_id_salt("format-size")
+        let _ = craft_ui::ComboBox::from_id_salt("format-size")
             .selected_text(number(look.size))
             .width(64.0)
             .show_ui(ui, |ui| {
@@ -206,7 +206,7 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, look: &mut AddedText, extras:
             labelled_icon(ui, t, "arrow-up-down", tl!("Line spacing"));
             let own = tl!("Auto").to_string();
             let shown = if e.line_spacing == 0.0 { own.clone() } else { number(e.line_spacing) };
-            egui::ComboBox::from_id_salt("format-line-spacing").selected_text(shown).width(half).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("format-line-spacing").selected_text(shown).width(half).show_ui(ui, |ui| {
                 ui.selectable_value(&mut e.line_spacing, 0.0, own.as_str());
                 for v in LINE_SPACINGS {
                     ui.selectable_value(&mut e.line_spacing, v, number(v));
@@ -216,7 +216,7 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, look: &mut AddedText, extras:
             ui.add_enabled_ui(false, |ui| {
                 labelled_icon(ui, t, "pilcrow", tl!("Paragraph spacing"));
                 let tip = format!("{} — {}", tl!("Paragraph spacing"), tl!("Planned"));
-                let _ = egui::ComboBox::from_id_salt("format-paragraph-spacing")
+                let _ = craft_ui::ComboBox::from_id_salt("format-paragraph-spacing")
                     .selected_text("0")
                     .width(half)
                     .show_ui(ui, |_| {})
@@ -280,7 +280,7 @@ fn flyout(ui: &egui::Ui, t: &Tokens, resp: egui::Response) -> egui::Response {
 /// labels.
 fn labelled_icon(ui: &mut egui::Ui, t: &Tokens, icon: &str, label: &str) -> egui::Response {
     let (rect, resp) = ui.allocate_exact_size(vec2(LABEL_ICON, 26.0), Sense::hover());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Label, ui.is_enabled(), label));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Label, ui.is_enabled(), label));
     let tint = if ui.is_enabled() { t.icon } else { t.text_faint };
     icons::paint(ui, Rect::from_center_size(rect.center(), vec2(18.0, 18.0)), icon, 17.0, tint);
     resp.on_hover_text(label)
@@ -317,7 +317,7 @@ fn number_with_presets(ui: &mut egui::Ui, n: Number<'_>, presets: &[f64], width:
 /// The text colour as a square swatch that opens the palette.
 fn colour_button(ui: &mut egui::Ui, t: &Tokens, color: [f64; 3]) -> egui::Response {
     let (rect, resp) = ui.allocate_exact_size(vec2(28.0, 28.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Colour")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Colour")));
     let [r, g, b] = color.map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8);
     let fill = rect.shrink(4.0);
     ui.painter().rect_filled(fill, CornerRadius::same(2), Color32::from_rgb(r, g, b));
diff --git a/crates/ui-egui/src/organize_panel.rs b/crates/ui-egui/src/panels/organize_panel.rs
similarity index 99%
rename from crates/ui-egui/src/organize_panel.rs
rename to crates/ui-egui/src/panels/organize_panel.rs
index b02d118012..338f64bc14 100644
--- a/crates/ui-egui/src/organize_panel.rs
+++ b/crates/ui-egui/src/panels/organize_panel.rs
@@ -195,7 +195,7 @@ enum Availability {
 fn row(ui: &mut egui::Ui, t: &Tokens, icon: &str, label: &str, availability: Availability, menu: bool) -> egui::Response {
     let ready = availability == Availability::Ready && ui.is_enabled();
     let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), if ready { Sense::click() } else { Sense::hover() });
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ready, label));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ready, label));
     let press = theme::Press::track(ui, &resp);
     if ready {
         press.wash(ui, rect, 6, false);
diff --git a/crates/ui-egui/src/page_selection_ui.rs b/crates/ui-egui/src/panels/page_selection_ui.rs
similarity index 99%
rename from crates/ui-egui/src/page_selection_ui.rs
rename to crates/ui-egui/src/panels/page_selection_ui.rs
index 0907232f7a..eb97b16b09 100644
--- a/crates/ui-egui/src/page_selection_ui.rs
+++ b/crates/ui-egui/src/panels/page_selection_ui.rs
@@ -96,7 +96,7 @@ impl PageSelectionInput {
                     .char_limit(16_384)
                     .hint_text(current.saturating_add(1).to_string()),
             );
-            field.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::TextEdit, ui.is_enabled(), label));
+            field.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TextInput, ui.is_enabled(), label));
             commit = ui.is_enabled() && !cancel && field.lost_focus();
             let pick = crate::icons::button(ui, "chevron-down", 26.0, false, tl!("Select pages"));
             chosen = egui::Popup::menu(&pick).show(menu).and_then(|r| r.inner);
diff --git a/crates/ui-egui/src/panels/pages.rs b/crates/ui-egui/src/panels/pages.rs
new file mode 100644
index 0000000000..e7afe45e85
--- /dev/null
+++ b/crates/ui-egui/src/panels/pages.rs
@@ -0,0 +1,359 @@
+use super::*;
+
+/// Page tools in the Pages panel's header (#4415): a menu, as Bookmark options is in its panel,
+/// to insert a blank page or pages from a file, rotate, extract and delete. Each runs its
+/// command on the selected pages (the current page when none is), so it does what Pages ▸ …
+/// does; the items say so, apart from the thumbnails' own menu. `enabled` is false while the
+/// document may not be assembled or a dialog is open. Returns the command a click asks for.
+pub(super) fn page_tools(ui: &mut egui::Ui, enabled: bool) -> Option<&'static str> {
+    let tools: [(&'static str, &str); 6] = [
+        ("page.insert_blank", tl!("Insert a blank page after the selection")),
+        ("page.insert", tl!("Insert pages from a file after the selection…")),
+        ("page.rotate_ccw", tl!("Rotate the selected pages counterclockwise")),
+        ("page.rotate", tl!("Rotate the selected pages clockwise")),
+        ("page.extract", tl!("Extract the selected pages…")),
+        ("page.delete", tl!("Delete the selected pages")),
+    ];
+    let mut picked = None;
+    ui.add_enabled_ui(enabled, |ui| {
+        let more = icons::button(ui, "ellipsis", 26.0, false, tl!("Page tools"));
+        egui::Popup::menu(&more).show(|ui| {
+            ui.set_min_width(260.0);
+            for (id, label) in tools {
+                let Some(spec) = pdfcraft_engine::commands::command(id) else { continue };
+                let item = egui::Button::image_and_text(icons::image(spec.icon, 16.0, ui.visuals().text_color()), label);
+                if ui.add(item).clicked() {
+                    picked = Some(id);
+                    ui.close();
+                }
+            }
+        });
+    });
+    picked
+}
+
+/// Size controls stay above the scroll area, so they remain reachable on long documents.
+pub(super) fn thumbnail_size(ui: &mut egui::Ui, t: &Tokens, view: &mut crate::DocView, enabled: bool) {
+    let before = view.thumbnail_zoom();
+    let mut zoom = before;
+    let label = ui
+        .horizontal(|ui| {
+            let label = ui.label(egui::RichText::new(tl!("Thumbnail size")).small().color(t.text_muted));
+            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                ui.label(egui::RichText::new(format!("{:.0}%", before * 100.0)).small().color(t.text_muted));
+            });
+            label
+        })
+        .inner;
+    ui.add_enabled_ui(enabled, |ui| {
+        ui.spacing_mut().slider_width = (ui.available_width() - 52.0 - 2.0 * ui.spacing().item_spacing.x).max(1.0);
+        ui.horizontal(|ui| {
+            if ui
+                .add_enabled_ui(zoom > *crate::canvas::THUMBNAIL_ZOOM_RANGE.start(), |ui| {
+                    icons::button(ui, "zoom-out", 26.0, false, tl!("Smaller thumbnails"))
+                })
+                .inner
+                .clicked()
+            {
+                zoom -= 0.25;
+            }
+            let mut percent = zoom * 100.0;
+            let range = (*crate::canvas::THUMBNAIL_ZOOM_RANGE.start() * 100.0)..=(*crate::canvas::THUMBNAIL_ZOOM_RANGE.end() * 100.0);
+            ui.scope(|ui| {
+                // The regular field fill blends into this panel; keep the slider's full rail visible.
+                ui.visuals_mut().widgets.inactive.bg_fill = t.border;
+                let slider = ui.add(egui::Slider::new(&mut percent, range).step_by(1.0).show_value(false).trailing_fill(true)).labelled_by(label.id);
+                slider.widget_info(|| egui::WidgetInfo::slider(ui.is_enabled(), f64::from(percent), tl!("Thumbnail size")));
+            });
+            zoom = percent / 100.0;
+            if ui
+                .add_enabled_ui(zoom < *crate::canvas::THUMBNAIL_ZOOM_RANGE.end(), |ui| {
+                    icons::button(ui, "zoom-in", 26.0, false, tl!("Larger thumbnails"))
+                })
+                .inner
+                .clicked()
+            {
+                zoom += 0.25;
+            }
+        });
+    });
+    if zoom != before {
+        view.set_thumbnail_zoom(zoom);
+    }
+    ui.add_space(6.0);
+}
+
+/// The page thumbnails. A click goes to the page; ⌘/Ctrl-click and ⇧-click pick several pages
+/// (the selection page commands and Print act on) without moving the document. Right-click
+/// offers Extract, Cut, Copy and Paste on the selection, or on the page clicked; dragging
+/// moves the selection, or the page grabbed, to the gap it is dropped on.
+pub(super) fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocView, modal: bool, editable: bool, nav: &mut Option<Nav>) {
+    // Escape drops the selection while the pointer is over the panel and nothing else wants the key.
+    if !modal
+        && !view.selected.is_empty()
+        && !ui.ctx().egui_wants_keyboard_input()
+        && ui.rect_contains_pointer(ui.clip_rect())
+        && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape))
+    {
+        view.clear_page_selection(Some(view.current));
+    }
+    // Delete (or Backspace) deletes the selection, or the current page, likewise.
+    if !modal
+        && editable
+        && !ui.ctx().egui_wants_keyboard_input()
+        && ui.rect_contains_pointer(ui.clip_rect())
+        && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Delete) || i.consume_key(egui::Modifiers::NONE, egui::Key::Backspace))
+    {
+        delete_pages(view, info.pages.len());
+    }
+    // A new current page scrolls its thumbnail into view, as little as it takes (Acrobat), but
+    // not while thumbnails are dragged: then the change counts as seen. A wheel turned or a
+    // scroll bar dragged by the user already wins over a scroll to a place in egui.
+    let follow = view.panel_followed != Some(view.current) && view.panel_drag.is_none();
+    view.panel_followed = Some(view.current);
+    let available = (ui.available_width() - 16.0).max(1.0);
+    let usual = (ui.available_width() - 40.0).clamp(1.0, 150.0);
+    let w = (usual * view.thumbnail_zoom()).min(available);
+    let count = info.pages.len();
+    let mut rows: Vec<Rect> = Vec::with_capacity(info.pages.len());
+    let mut dropped = false;
+    for (i, p) in info.pages.iter().enumerate() {
+        ui.vertical_centered(|ui| {
+            let h = w * p.height / p.width.max(1.0);
+            let sense = if editable { Sense::click_and_drag() } else { Sense::click() };
+            let (rect, resp) = ui.allocate_exact_size(vec2(w + 16.0, h + 16.0), sense);
+            rows.push(rect);
+            if rect.intersects(ui.clip_rect().expand(200.0)) {
+                view.need_thumbnail(i, rect.intersects(ui.clip_rect()));
+            }
+            // Only the primary button drags pages (the middle button scrolls, the secondary one opens the menu).
+            if resp.drag_started_by(egui::PointerButton::Primary) {
+                if !view.target_pages().contains(&i) {
+                    view.click_page(i, egui::Modifiers::NONE, true);
+                }
+                view.panel_drag = Some(view.target_pages());
+            }
+            if resp.drag_stopped() {
+                dropped = true;
+            }
+            let info = crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.label)]);
+            let picked = view.selected.contains(&i);
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, picked, info.clone()));
+            // The current page keeps its heavier border; picked pages share its fill.
+            let selected = i == view.current;
+            let press = theme::Press::track(ui, &resp);
+            press.wash(ui, rect, 8, selected || picked);
+            if picked {
+                ui.painter().rect_stroke(rect, CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
+            }
+            let pr = rect.translate(press.offset()).shrink(8.0);
+            ui.painter().rect_filled(pr, CornerRadius::ZERO, Color32::WHITE);
+            if let Some(tex) = view.thumb(i) {
+                ui.painter().image(tex.id(), pr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+            }
+            ui.painter().rect_stroke(
+                pr,
+                CornerRadius::ZERO,
+                Stroke::new(if selected { 2.0 } else { 1.0 }, if selected { t.accent } else { t.border }),
+                egui::StrokeKind::Outside,
+            );
+            let label = ui.label(egui::RichText::new(&p.label).font(theme::medium(12.0)).color(if selected || picked {
+                t.accent_text
+            } else {
+                t.text_muted
+            }));
+            if follow && selected {
+                ui.scroll_to_rect(rect.union(label.rect), None);
+            }
+            let resp = theme::hand(resp);
+            if resp.clicked() {
+                let m = ui.input(|i| i.modifiers);
+                if m.shift || m.command {
+                    view.click_page(i, m, true);
+                } else {
+                    view.clear_page_selection(Some(i));
+                    // A page clicked here is in view already: the panel stays put.
+                    view.panel_followed = Some(i);
+                    *nav = Some(Nav::Page(i));
+                }
+            }
+            resp.context_menu(|ui| {
+                // A page outside the selection becomes the selection, as in the organize grid.
+                if !view.target_pages().contains(&i) {
+                    view.click_page(i, egui::Modifiers::NONE, true);
+                }
+                if ui.button(tl!("Extract pages")).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::Extract);
+                    ui.close();
+                }
+                if ui.button(tl!("Split document…")).clicked() {
+                    if view.selected.is_empty() {
+                        view.select_pages(&[i]);
+                    }
+                    view.pending_action = Some(crate::canvas::ViewAction::SplitBeforeSelected);
+                    ui.close();
+                }
+                if ui.add_enabled(editable, egui::Button::new(tl!("Replace pages…"))).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::ReplacePages);
+                    ui.close();
+                }
+                ui.separator();
+                if ui.add_enabled(editable, egui::Button::new(tl!("Cut"))).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::CopyPages { cut: true });
+                    ui.close();
+                }
+                if ui.button(tl!("Copy")).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::CopyPages { cut: false });
+                    ui.close();
+                }
+                if ui.add_enabled(editable, egui::Button::new(tl!("Paste after"))).clicked() {
+                    view.pending_action = Some(crate::canvas::ViewAction::PastePages);
+                    ui.close();
+                }
+                ui.separator();
+                let some_left = view.target_pages().len() < count;
+                // Never every page: a document keeps at least one.
+                if ui.add_enabled(editable && some_left, egui::Button::new(tl!("Delete pages"))).clicked() {
+                    delete_pages(view, count);
+                    ui.close();
+                }
+            });
+        });
+        ui.add_space(4.0);
+    }
+    page_drag(ui, t, view, &rows, dropped);
+    file_drop(ui, t, view, &rows, editable && !modal);
+}
+
+/// Files dragged in from outside go to the gap under the pointer: remember where the panel is
+/// and that gap, for the app to take the drop, and show where the pages would go.
+fn file_drop(ui: &mut egui::Ui, t: &Tokens, view: &mut crate::DocView, rows: &[Rect], editable: bool) {
+    if !editable {
+        return;
+    }
+    let clip = ui.clip_rect();
+    view.pages_panel = Some(clip);
+    let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| clip.contains(*p));
+    view.panel_gap = pointer.filter(|_| view.panel_drag.is_none()).and_then(|p| panel_gap(rows, p.y));
+    if pointer.is_none() || ui.input(|i| i.raw.hovered_files.is_empty()) {
+        return;
+    }
+    let painter = ui.painter().with_clip_rect(clip);
+    painter.rect_stroke(clip.shrink(2.0), CornerRadius::same(6), Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
+    if let (Some(gap), Some(first), Some(last)) = (view.panel_gap, rows.first(), rows.last()) {
+        let y = rows.get(gap).map_or(last.bottom() + 2.0, |r| r.top() - 3.0);
+        painter.line_segment([pos2(first.left(), y), pos2(first.right(), y)], Stroke::new(3.0, t.accent));
+    }
+}
+
+/// Queue deleting the selection (or the current page) of a document of `n` pages, unless that
+/// would leave no page. The selection goes; the current page stays on the page it showed, or on
+/// the page that follows the deleted ones.
+fn delete_pages(view: &mut crate::DocView, n: usize) {
+    let mut pages = view.target_pages();
+    pages.sort_unstable();
+    pages.dedup();
+    if pages.is_empty() || pages.len() >= n {
+        return;
+    }
+    // Deleted pages before it shift it up; if it was deleted itself, the page after the deleted
+    // run lands where it was (or the last page, when the deletion ran to the end).
+    let before = pages.iter().filter(|p| **p < view.current).count();
+    view.current = view.current.saturating_sub(before).min(n.saturating_sub(pages.len() + 1));
+    view.clear_page_selection(None);
+    view.pending_edit = Some(pdfcraft_engine::Edit::DeletePages { pages });
+}
+
+/// The gap (0 = before the first page, n = after the last) the pointer points at in the Pages
+/// panel, whose thumbnails are `rows`, top to bottom.
+fn panel_gap(rows: &[Rect], y: f32) -> Option<usize> {
+    let (i, r) = rows.iter().enumerate().min_by(|(_, a), (_, b)| (a.center().y - y).abs().total_cmp(&(b.center().y - y).abs()))?;
+    Some(if y < r.center().y { i } else { i + 1 })
+}
+
+/// Where page `p` goes when `moving` (sorted) move to `to` (counted without them).
+fn moved_index(p: usize, moving: &[usize], to: usize) -> usize {
+    match moving.iter().position(|m| *m == p) {
+        Some(k) => to + k,
+        None => {
+            let rest = p.saturating_sub(moving.iter().filter(|m| **m < p).count());
+            if rest >= to { rest + moving.len() } else { rest }
+        }
+    }
+}
+
+/// While thumbnails are dragged: a bar on the gap they would go to, the page count by the
+/// pointer, and scrolling near the panel's edges. On release, queue the move.
+fn page_drag(ui: &mut egui::Ui, t: &Tokens, view: &mut crate::DocView, rows: &[Rect], dropped: bool) {
+    let Some(mut moving) = view.panel_drag.clone() else { return };
+    // A drag that ended while the panel was closed (or elsewhere) leaves nothing to drop.
+    if !dropped && !ui.input(|i| i.pointer.primary_down()) {
+        view.panel_drag = None;
+        return;
+    }
+    let pointer = ui.input(|i| i.pointer.interact_pos());
+    let gap = pointer.and_then(|p| panel_gap(rows, p.y));
+    if let (Some(gap), Some(first), Some(last)) = (gap, rows.first(), rows.last()) {
+        let y = rows.get(gap).map_or(last.bottom() + 20.0, |r| r.top() - 3.0);
+        ui.painter().line_segment([pos2(first.left(), y), pos2(first.right(), y)], Stroke::new(3.0, t.accent));
+    }
+    if let Some(p) = pointer {
+        let n = moving.len();
+        let what = if n == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &n.to_string())]) };
+        ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, what, theme::medium(12.0), t.accent_text);
+        let clip = ui.clip_rect();
+        let edge = 40.0;
+        if p.y < clip.top() + edge {
+            ui.scroll_with_delta(vec2(0.0, 10.0));
+        } else if p.y > clip.bottom() - edge {
+            ui.scroll_with_delta(vec2(0.0, -10.0));
+        }
+        ui.ctx().request_repaint();
+    }
+    if !dropped {
+        return;
+    }
+    view.panel_drag = None;
+    let Some(gap) = gap else { return };
+    moving.sort_unstable();
+    moving.dedup();
+    let Some(&first) = moving.first() else { return };
+    // `to` counts positions without the moving pages.
+    let to = gap.saturating_sub(moving.iter().filter(|x| **x < gap).count());
+    let contiguous = moving.windows(2).all(|w| w[1] == w[0] + 1);
+    if contiguous && to == first {
+        return;
+    }
+    view.current = moved_index(view.current, &moving, to);
+    view.selected = (to..to + moving.len()).collect();
+    view.pending_edit = Some(pdfcraft_engine::Edit::MovePages { pages: moving, to });
+}
+
+#[cfg(test)]
+mod page_moves {
+    use super::{moved_index, panel_gap};
+    use egui::{Rect, pos2};
+
+    /// Above a thumbnail's middle is the gap before it; below is the gap after it.
+    #[test]
+    fn the_gap_follows_the_nearest_thumbnail() {
+        let rows: Vec<Rect> = (0..3).map(|i| Rect::from_min_max(pos2(0.0, i as f32 * 100.0), pos2(50.0, i as f32 * 100.0 + 90.0))).collect();
+        assert_eq!(panel_gap(&rows, -20.0), Some(0));
+        assert_eq!(panel_gap(&rows, 30.0), Some(0));
+        assert_eq!(panel_gap(&rows, 60.0), Some(1));
+        assert_eq!(panel_gap(&rows, 260.0), Some(3));
+        assert_eq!(panel_gap(&rows, 900.0), Some(3));
+        assert_eq!(panel_gap(&[], 10.0), None);
+    }
+
+    /// The current page follows a move, whether it moved or others moved around it.
+    #[test]
+    fn pages_keep_their_identity_across_a_move() {
+        // [0 1 2 3 4], move [1 2] to the end: [0 3 4 1 2].
+        let order: Vec<usize> = (0..5).map(|p| moved_index(p, &[1, 2], 3)).collect();
+        assert_eq!(order, [0, 3, 4, 1, 2]);
+        // Move [3] to the front: [3 0 1 2 4].
+        let order: Vec<usize> = (0..5).map(|p| moved_index(p, &[3], 0)).collect();
+        assert_eq!(order, [1, 2, 3, 0, 4]);
+    }
+}
diff --git a/crates/ui-egui/src/panels/right.rs b/crates/ui-egui/src/panels/right.rs
new file mode 100644
index 0000000000..4f6c150c46
--- /dev/null
+++ b/crates/ui-egui/src/panels/right.rs
@@ -0,0 +1,711 @@
+use super::bookmarks::{BmAction, OutlineCtx, outline_item, outline_matches};
+use super::pages::{page_tools, pages, thumbnail_size};
+use super::*;
+
+/// Draw the selected right-hand panel and apply its navigation, layer, bookmark or edit actions.
+pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    let Some((index, id)) = app.active_ids() else { return };
+    let Some(panel) = app.right else { return };
+    let mut nav: Option<Nav> = None;
+    let mut close = false;
+    let mut toggle_layer: Option<(usize, bool)> = None;
+    let mut reset_layers = false;
+    let mut attachment_action: Option<(usize, bool)> = None; // (index, open instead of save)
+    let mut bm_action: Option<BmAction> = None;
+    let mut bm_expand: Option<usize> = None;
+    let mut panel_edit: Option<pdfcraft_engine::Edit> = None;
+    let mut field_properties = None;
+    let mut panel_command: Option<&'static str> = None;
+    let mut sig_action: Option<crate::sign_ui::PanelAction> = None;
+    let mut a11y_action: Option<crate::a11y_ui::PanelAction> = None;
+    let mut compare_action: Option<crate::compare_ui::PanelAction> = None;
+    let mut bm_rename = app.bookmark_rename.clone();
+    let bm_editable = app.session.get(id).is_some_and(|d| d.allows_assembly() && d.read_only_reason.is_none());
+    // Prepare a form is open: the Fields panel orders tabs.
+    let preparing = app.is_preparing();
+    {
+        let Some(doc) = app.session.get(id) else { return };
+        let info = &doc.info;
+        let view = &mut app.views[index];
+        let prefs = &app.comment_prefs;
+        let sig_expanded = &mut app.sig_expanded;
+        let a11y = &mut app.a11y;
+        let tags_state = &mut app.tags_state;
+        let compare = &app.compare;
+        let comment_allowed = doc.allows_annotation();
+        // A dialog or the palette owns the keyboard: the panel leaves Escape to it.
+        let modal = app.dialog.is_some() || app.palette_open;
+        egui::Frame::NONE
+            .fill(t.panel)
+            .inner_margin(egui::Margin { left: 14, right: 12, top: 12, bottom: 8 })
+            .stroke(Stroke::new(1.0, t.divider))
+            .show(ui, |ui| {
+                let (title, count) = match panel {
+                    RightPanel::Comments => ("Comments", Some(crate::comments_panel::count(info))),
+                    RightPanel::Bookmarks => ("Bookmarks", None),
+                    RightPanel::Pages => ("Pages", Some(info.pages.len())),
+                    RightPanel::Fields => ("Fields", Some(info.fields.len())),
+                    RightPanel::Layers => ("Layers", Some(info.layers.len())),
+                    RightPanel::Attachments => ("Attachments", Some(info.attachments.len())),
+                    RightPanel::Signatures => ("Signatures", Some(doc.signatures.iter().filter(|s| s.signed).count())),
+                    RightPanel::Accessibility => ("Accessibility Checker", None),
+                    RightPanel::Tags => ("Tags", None),
+                    RightPanel::Search => ("Search", None),
+                    RightPanel::Compare => ("Compare", compare.as_ref().filter(|c| c.new == id).map(|c| c.result.changes.len())),
+                };
+                // Comments count like Acrobat (no replies); the replies go in small text below.
+                let replies = if panel == RightPanel::Comments { crate::comments_panel::reply_count(info) } else { 0 };
+                ui.horizontal(|ui| {
+                    ui.vertical(|ui| {
+                        ui.spacing_mut().item_spacing.y = 0.0;
+                        ui.horizontal(|ui| {
+                            ui.label(egui::RichText::new(tl!(title)).font(theme::semibold(15.5)));
+                            if let Some(c) = count {
+                                ui.label(egui::RichText::new(c.to_string()).font(theme::medium(13.0)).color(t.text_faint));
+                            }
+                        });
+                        if replies > 0 {
+                            let text = crate::i18n::trn(crate::i18n::current(), replies as u64, "{n} reply", "{n} replies");
+                            ui.label(egui::RichText::new(text).font(theme::regular(11.0)).color(t.text_faint));
+                        }
+                    });
+                    if panel == RightPanel::Pages && view.selected.len() > 1 {
+                        let n = view.selected.len().to_string();
+                        let picked = crate::i18n::fmt(tl!("{n} pages selected"), &[("n", &n)]);
+                        ui.label(egui::RichText::new(picked).font(theme::medium(12.0)).color(t.accent_text));
+                    }
+                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                        if icons::button(ui, "x", 26.0, false, tl!("Close")).clicked() {
+                            close = true;
+                        }
+                        if panel == RightPanel::Pages
+                            && let Some(c) = page_tools(ui, !modal && view.panel_drag.is_none() && bm_editable)
+                        {
+                            panel_command = Some(c);
+                        }
+                        // Right to left: close, "…", filter, search (Acrobat's order left to right).
+                        if panel == RightPanel::Comments {
+                            panel_command = crate::comments_panel::header_controls(ui, info, view, doc.comments_hidden());
+                        }
+                        if panel == RightPanel::Comments
+                            && icons::button(ui, "search", 26.0, view.comments.search.is_some(), tl!("Search comments")).clicked()
+                        {
+                            view.comments.search = match view.comments.search {
+                                Some(_) => None,
+                                None => Some(String::new()),
+                            };
+                            view.comments.search_focus = true;
+                        }
+                        if panel == RightPanel::Bookmarks && (bm_editable || !info.outline.is_empty()) {
+                            let more = icons::button(ui, "ellipsis", 26.0, false, tl!("Bookmark options"));
+                            egui::Popup::menu(&more).show(|ui| {
+                                ui.set_min_width(200.0);
+                                if bm_editable && ui.button(tl!("New bookmarks from structure")).clicked() {
+                                    bm_action = Some(BmAction::FromStructure);
+                                    ui.close();
+                                }
+                                if !info.outline.is_empty() {
+                                    for (levels, label) in [
+                                        (usize::MAX, tl!("Expand all bookmarks")),
+                                        (1, tl!("Expand top-level bookmarks")),
+                                        (0, tl!("Collapse all bookmarks")),
+                                    ] {
+                                        if ui.button(label).clicked() {
+                                            bm_expand = Some(levels);
+                                            ui.close();
+                                        }
+                                    }
+                                }
+                            });
+                        }
+                        if panel == RightPanel::Layers && !info.layers.is_empty() {
+                            let more = icons::button(ui, "ellipsis", 26.0, false, tl!("Layer options"));
+                            egui::Popup::menu(&more).show(|ui| {
+                                ui.set_min_width(200.0);
+                                if ui.button(tl!("Reset to Initial Visibility")).clicked() {
+                                    reset_layers = true;
+                                    ui.close();
+                                }
+                            });
+                        }
+                        let new_tip = crate::commands::command_tip(ui.ctx(), tl!("New bookmark ({key})"), "bookmark.add");
+                        if panel == RightPanel::Bookmarks && bm_editable && icons::button(ui, "bookmark-plus", 26.0, false, &new_tip).clicked() {
+                            bm_action = Some(BmAction::New);
+                        }
+                    });
+                });
+                ui.add_space(6.0);
+                let search_id = egui::Id::unique(("bookmark_search", id.0));
+                let mut bookmark_query = ui.data(|d| d.get_temp::<String>(search_id)).unwrap_or_default();
+                if panel == RightPanel::Bookmarks && !info.outline.is_empty() {
+                    ui.horizontal(|ui| {
+                        const CLEAR: f32 = 26.0;
+                        let label = ui.label(tl!("Search"));
+                        let previous = bookmark_query.clone();
+                        // The panel keeps whatever width its content used, so this row must fit
+                        // exactly: any overflow would widen the panel again on every repaint.
+                        let width = ui.available_width() - CLEAR - ui.spacing().item_spacing.x;
+                        let response = ui.add(egui::TextEdit::singleline(&mut bookmark_query).desired_width(width)).labelled_by(label.id);
+                        response.widget_info(|| {
+                            let mut info = egui::WidgetInfo::text_edit(ui.is_enabled(), &previous, &bookmark_query, "");
+                            info.label = Some(tl!("Search").to_string());
+                            info
+                        });
+                        if icons::button(ui, "x", CLEAR, false, tl!("Clear")).clicked() {
+                            bookmark_query.clear();
+                        }
+                    });
+                    ui.data_mut(|d| d.insert_temp(search_id, bookmark_query.clone()));
+                    ui.add_space(6.0);
+                }
+                let bookmark_query = pdfcraft_render::text::fold_case(bookmark_query.trim());
+                let mut bookmark_matches =
+                    if panel == RightPanel::Bookmarks { outline_matches(&info.outline, &bookmark_query) } else { std::collections::HashSet::new() };
+                // A new bookmark must stay nameable even when its initial title doesn't match.
+                if let Some((path, _)) = &bm_rename {
+                    let mut ancestor = path.clone();
+                    while !ancestor.is_empty() {
+                        bookmark_matches.insert(ancestor.clone());
+                        ancestor.pop();
+                    }
+                }
+                if panel == RightPanel::Pages {
+                    let enabled = !modal && view.panel_drag.is_none();
+                    thumbnail_size(ui, &t, view, enabled);
+                }
+                egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| match panel {
+                    RightPanel::Comments => {
+                        if let Some(e) = crate::comments_panel::show(ui, &t, info, view, prefs, comment_allowed, &mut nav) {
+                            panel_edit = Some(e);
+                        }
+                    }
+                    RightPanel::Bookmarks => {
+                        if info.outline.is_empty() {
+                            empty(ui, &t, "bookmark", "This document has no bookmarks.");
+                        }
+                        let mut ctx = OutlineCtx {
+                            nav: &mut nav,
+                            action: &mut bm_action,
+                            rename: &mut bm_rename,
+                            editable: bm_editable,
+                            current: view.current,
+                            expand: bm_expand,
+                            matches: &bookmark_matches,
+                            searching: !bookmark_query.is_empty(),
+                        };
+                        if ctx.searching && bookmark_matches.is_empty() && !info.outline.is_empty() {
+                            ui.label(tl!("No matches."));
+                        }
+                        for (i, item) in info.outline.iter().enumerate() {
+                            outline_item(ui, &t, info, item, &[i], info.outline.len(), &mut ctx);
+                        }
+                        if info.outline_more {
+                            ui.label(tl!("Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth."));
+                        }
+                    }
+                    RightPanel::Pages => pages(ui, &t, info, view, modal, bm_editable, &mut nav),
+                    RightPanel::Fields => field_properties = fields(ui, &t, info, &doc.form, preparing, &mut view.prepare, &mut nav, &mut panel_edit),
+                    RightPanel::Layers => {
+                        if info.layers.is_empty() {
+                            empty(ui, &t, "layers", "This document has no layers.");
+                        }
+                        for (li, l) in info.layers.iter().enumerate() {
+                            let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 32.0), Sense::click());
+                            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, l.visible, &l.name));
+                            let press = theme::Press::track(ui, &resp);
+                            press.wash(ui, rect, 6, false);
+                            let body = rect.translate(press.offset());
+                            icons::paint(
+                                ui,
+                                Rect::from_min_size(body.min + vec2(4.0, 7.0), vec2(18.0, 18.0)),
+                                if l.visible { "eye" } else { "eye-off" },
+                                16.0,
+                                t.icon,
+                            );
+                            let fg = if l.visible { t.text } else { t.text_faint };
+                            crate::widgets::paint_left(
+                                ui,
+                                body.left_center() + vec2(32.0, 0.0),
+                                &l.name,
+                                theme::regular(13.0),
+                                fg,
+                                (rect.width() - 40.0).max(0.0),
+                            );
+                            if theme::hand(resp).on_hover_text(if l.visible { tl!("Hide layer") } else { tl!("Show layer") }).clicked() {
+                                toggle_layer = Some((li, !l.visible));
+                            }
+                        }
+                    }
+                    RightPanel::Signatures => {
+                        sig_action = crate::sign_ui::panel(ui, &t, &doc.signatures, sig_expanded);
+                    }
+                    RightPanel::Accessibility => {
+                        a11y_action = crate::a11y_ui::panel(ui, &t, a11y, id);
+                    }
+                    RightPanel::Tags => {
+                        let tags = tags_state.tags(doc);
+                        let content = tags_state.content(doc);
+                        let (page, edit) = crate::tags_ui::panel(ui, &t, id, &tags, &content, tags_state, doc.allows_modification());
+                        if let Some(page) = page {
+                            nav = Some(Nav::Page(page));
+                        }
+                        panel_edit = edit;
+                    }
+                    RightPanel::Search => crate::search_ui::panel(ui, &t, view, info.pages.len()),
+                    RightPanel::Compare => compare_action = crate::compare_ui::panel(ui, &t, compare, id),
+                    RightPanel::Attachments => {
+                        let attachable = doc.allows_modification() && doc.read_only_reason.is_none();
+                        if attachable {
+                            egui::Frame::NONE.inner_margin(egui::Margin::symmetric(4, 6)).show(ui, |ui| {
+                                if ui.add(egui::Button::new(tl!("Attach a file…"))).clicked() {
+                                    panel_command = Some("edit.attach");
+                                }
+                            });
+                        }
+                        if info.attachments.is_empty() {
+                            empty(ui, &t, "paperclip", "This document has no attachments.");
+                        }
+                        for (ai, a) in info.attachments.iter().enumerate() {
+                            let is_pdf = a.name.to_lowercase().ends_with(".pdf");
+                            // Only an attachment of the document itself can be deleted here.
+                            let deletable = match &a.source {
+                                pdfcraft_render::AttachmentSource::Document { key } if attachable => Some(key),
+                                _ => None,
+                            };
+                            // The whole row answers a double-click and a right-click (#3466), below
+                            // its buttons, which still take their own clicks.
+                            let mut buttons: Vec<egui::Response> = Vec::new();
+                            let row = ui.scope_builder(egui::UiBuilder::new().sense(Sense::click()), |ui| {
+                                egui::Frame::NONE.inner_margin(egui::Margin::symmetric(4, 6)).show(ui, |ui| {
+                                    ui.horizontal(|ui| {
+                                        ui.add(icons::image("paperclip", 16.0, t.icon));
+                                        ui.vertical(|ui| {
+                                            ui.set_width(ui.available_width() - 70.0);
+                                            // Not selectable, so a click on the name or the details reaches the row.
+                                            ui.add(
+                                                egui::Label::new(egui::RichText::new(&a.name).font(theme::medium(13.0))).truncate().selectable(false),
+                                            );
+                                            let mut meta = a.size.map(human_size).unwrap_or_default();
+                                            if let pdfcraft_render::AttachmentSource::Annotation { page, .. } = a.source {
+                                                let on_page = crate::i18n::fmt(
+                                                    tl!("on page {label}"),
+                                                    &[("label", info.pages.get(page).map(|p| p.label.as_str()).unwrap_or("?"))],
+                                                );
+                                                meta = format!("{meta}  ·  {on_page}");
+                                            }
+                                            if let Some(d) = &a.description {
+                                                meta = format!("{meta}  ·  {d}");
+                                            }
+                                            ui.add(
+                                                egui::Label::new(egui::RichText::new(meta).color(t.text_faint).small()).truncate().selectable(false),
+                                            );
+                                        });
+                                        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                                            let save = icons::button(ui, "file-down", 28.0, false, tl!("Save attachment…"));
+                                            if save.clicked() {
+                                                attachment_action = Some((ai, false));
+                                            }
+                                            buttons.push(save);
+                                            if is_pdf {
+                                                let open = icons::button(ui, "file-input", 28.0, false, tl!("Open in a new tab"));
+                                                if open.clicked() {
+                                                    attachment_action = Some((ai, true));
+                                                }
+                                                buttons.push(open);
+                                            }
+                                            if let Some(key) = deletable {
+                                                let delete = icons::button(ui, "trash-2", 28.0, false, tl!("Delete attachment"));
+                                                if delete.clicked() {
+                                                    panel_edit = Some(pdfcraft_engine::Edit::DeleteAttachment { key: key.clone() });
+                                                }
+                                                buttons.push(delete);
+                                            }
+                                        });
+                                    });
+                                })
+                            });
+                            // A double-click opens a PDF in a new tab, as Acrobat opens an attachment;
+                            // any other file is saved, since PdfCraft opens only PDFs.
+                            if row.response.double_clicked() {
+                                attachment_action = Some((ai, is_pdf));
+                            }
+                            // A right-click on one of the row's buttons is a right-click on the row:
+                            // the union keeps the row's id, so it is one menu either way.
+                            let menu = buttons.into_iter().fold(row.response.clone(), |row, button| row | button);
+                            menu.context_menu(|ui| {
+                                if is_pdf && ui.button(tl!("Open in a new tab")).clicked() {
+                                    attachment_action = Some((ai, true));
+                                    ui.close();
+                                }
+                                if ui.button(tl!("Save attachment…")).clicked() {
+                                    attachment_action = Some((ai, false));
+                                    ui.close();
+                                }
+                                if let Some(key) = deletable
+                                    && ui.button(tl!("Delete attachment")).clicked()
+                                {
+                                    panel_edit = Some(pdfcraft_engine::Edit::DeleteAttachment { key: key.clone() });
+                                    ui.close();
+                                }
+                            });
+                        }
+                    }
+                });
+            });
+    }
+    if close {
+        app.choose_right_panel(None);
+    }
+    if let Some(e) = panel_edit {
+        app.apply_edit(e);
+    }
+    if let Some((name, widget)) = field_properties {
+        app.open_field_props(&name, widget);
+    }
+    if let Some(c) = panel_command {
+        app.run_command(c);
+    }
+    if let Some(a) = a11y_action {
+        app.a11y_action(index, a);
+    }
+    if let Some(a) = compare_action {
+        app.compare_action(index, a);
+    }
+    match sig_action {
+        Some(crate::sign_ui::PanelAction::Validate) => app.run_command("sign.validate"),
+        Some(crate::sign_ui::PanelAction::GoTo(p)) => app.views[index].go_to_page(p),
+        Some(crate::sign_ui::PanelAction::Trust(c)) => app.trust_certificate(*c),
+        Some(crate::sign_ui::PanelAction::ViewCertificate(chain)) => {
+            app.cert_viewer = Some(crate::sign_ui::CertViewer { chain, selected: 0, tab: crate::sign_ui::CertTab::Summary });
+            app.dialog = Some(crate::Dialog::CertificateViewer);
+        }
+        Some(crate::sign_ui::PanelAction::ViewSigned { len, revision }) => app.view_signed_version(len, revision),
+        Some(crate::sign_ui::PanelAction::Sign(field)) => {
+            let page = app.views[index].current;
+            app.start_signing(page, None, Some(field), None);
+        }
+        Some(crate::sign_ui::PanelAction::ExportCertificate(c)) => {
+            app.export_certificate(&c);
+        }
+        None => {}
+    }
+    if let Some((p, i)) = app.views.get_mut(index).and_then(|v| v.comments.default_request.take()) {
+        app.make_comment_default(p, i);
+    }
+    if let Some((p, i, open)) = app.views.get_mut(index).and_then(|v| v.comments.attachment_request.take()) {
+        app.comment_attachment_action(id, p, i, open);
+    }
+    if let Some((p, i)) = app.views.get_mut(index).and_then(|v| v.comments.props_request.take()) {
+        app.open_comment_props(p, i);
+    }
+    app.bookmark_rename = bm_rename;
+    if let Some(a) = bm_action {
+        app.bookmark_action(a);
+    }
+    if let Some((ai, open)) = attachment_action {
+        app.attachment_action(id, ai, open);
+    }
+    if let Some((layer, visible)) = toggle_layer
+        && app.session.set_layer_visible(id, layer, visible)
+    {
+        app.views[index].invalidate_content();
+    }
+    if reset_layers && app.session.reset_layers(id) {
+        app.views[index].invalidate_content();
+    }
+    match nav {
+        Some(Nav::Page(p)) => app.views[index].go_to_page(p),
+        Some(Nav::Dest(p, dest)) => match app.session.get(id) {
+            Some(doc) => app.views[index].go_to_dest(p, dest, &doc.info),
+            None => app.views[index].go_to_page(p),
+        },
+        Some(Nav::Flash(p, r)) => {
+            let v = &mut app.views[index];
+            if let Some(doc) = app.session.get(id) {
+                v.reveal_rect(p, r, &doc.info);
+            } else {
+                v.go_to_page(p);
+            }
+            v.flash = Some((p, r, 0.0));
+        }
+        None => {}
+    }
+}
+
+fn empty(ui: &mut egui::Ui, t: &Tokens, icon: &str, text: &str) {
+    ui.add_space(40.0);
+    ui.vertical_centered(|ui| {
+        ui.add(icons::image(icon, 36.0, t.text_faint));
+        ui.add_space(8.0);
+        // Every empty-panel message goes through here.
+        ui.label(egui::RichText::new(tl!(text)).color(t.text_muted));
+    });
+}
+
+/// The Fields panel: fields by page, in tab order. While preparing a form, each field can move
+/// earlier or later in its page's tab order (Acrobat: Order Tabs Manually).
+#[allow(clippy::too_many_arguments)]
+fn fields(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    info: &DocInfo,
+    form: &[pdfcraft_engine::FormField],
+    preparing: bool,
+    selection: &mut crate::prepare::PrepareView,
+    nav: &mut Option<Nav>,
+    edit: &mut Option<pdfcraft_engine::Edit>,
+) -> Option<(String, usize)> {
+    let mut properties = None;
+    if info.fields.is_empty() {
+        empty(ui, t, "text-cursor-input", "This document has no form fields.");
+        return None;
+    }
+    let rows = field_rows(&info.fields, form);
+    if preparing {
+        ui.label(egui::RichText::new(tl!("Tab order: move a field with its arrows.")).small().color(t.text_muted));
+        ui.label(egui::RichText::new(tl!("Shift- or Ctrl/Command-click to select several fields.")).small().color(t.text_muted));
+        let names = selection.names();
+        // Keep the field rows in place when the first click selects a field, so the
+        // second click of a double-click still lands on the same row.
+        ui.horizontal(|ui| {
+            ui.label(crate::i18n::fmt(tl!("{n} selected"), &[("n", &names.len().to_string())]));
+            if ui.add_enabled(!names.is_empty(), egui::Button::new(tl!("Properties…"))).clicked() {
+                properties = selection.selected.clone();
+            }
+        });
+    }
+    for (p, page_rows) in rows {
+        // A field's /P can name a page the document doesn't have (#1307); it reads as unplaced.
+        let label = p
+            .and_then(|p| info.pages.get(p))
+            .map(|page| crate::i18n::fmt(tl!("Page {label}"), &[("label", &page.label)]))
+            .unwrap_or_else(|| tl!("Unplaced").to_string());
+        ui.add_space(4.0);
+        ui.label(egui::RichText::new(label).font(theme::semibold(12.5)).color(t.text_muted));
+        for (f, key) in page_rows {
+            let selected = key.as_ref().is_some_and(|key| selection.selected.as_ref() == Some(key) || selection.also.contains(key));
+            let icon = match f.kind {
+                FieldKind::Text => "text-cursor-input",
+                FieldKind::CheckBox => "check-circle-2",
+                FieldKind::Radio => "circle",
+                FieldKind::PushButton => "square",
+                FieldKind::Combo => "chevron-down",
+                FieldKind::List => "list",
+                FieldKind::Signature => "signature",
+                FieldKind::Unknown => "square",
+            };
+            let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 30.0), Sense::click());
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &f.name));
+            // A row scrolled out of view still takes clicks and keyboard focus, but isn't drawn:
+            // laying out every row of a large form each frame took a tenth of a second a frame.
+            let visible = ui.is_rect_visible(rect);
+            if visible {
+                let press = theme::Press::track(ui, &resp);
+                press.wash(ui, rect, 6, selected);
+                let body = rect.translate(press.offset());
+                icons::paint(ui, Rect::from_min_size(body.min + vec2(8.0, 7.0), vec2(16.0, 16.0)), icon, 15.0, Color32::from_rgb(0x8E, 0x4E, 0xE6));
+                let value =
+                    f.value.as_ref().map(|v| if v.chars().count() > 18 { format!("{}…", v.chars().take(17).collect::<String>()) } else { v.clone() });
+                let value_font = theme::regular(11.5);
+                let value_w = value.as_ref().map(|v| crate::widgets::text_width(ui, v, &value_font)).unwrap_or(0.0);
+                let arrows = if preparing && f.page.is_some() { 56.0 } else { 0.0 };
+                let max_w = (rect.width() - 32.0 - value_w - arrows - 16.0).max(0.0);
+                crate::widgets::paint_left(ui, body.left_center() + vec2(32.0, 0.0), &f.name, theme::regular(13.0), t.text, max_w);
+                if let Some(v) = value {
+                    let x = if arrows > 0.0 { 64.0 } else { 8.0 };
+                    ui.painter().text(body.right_center() - vec2(x, 0.0), Align2::RIGHT_CENTER, v, value_font, t.text_faint);
+                }
+            }
+            if preparing && f.page.is_some() {
+                let up = Rect::from_center_size(rect.right_center() - vec2(44.0, 0.0), vec2(22.0, 22.0));
+                let down = Rect::from_center_size(rect.right_center() - vec2(20.0, 0.0), vec2(22.0, 22.0));
+                for (r, icon, earlier, tip) in
+                    [(up, "chevron-up", true, tl!("Earlier in tab order")), (down, "chevron-down", false, tl!("Later in tab order"))]
+                {
+                    let b = ui.interact(r, ui.scope_id().with((&f.name, earlier)), Sense::click());
+                    b.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, format!("{tip}: {}", f.name)));
+                    if visible {
+                        let bpress = theme::Press::track(ui, &b);
+                        bpress.wash(ui, r, 4, false);
+                        icons::paint(ui, r.shrink(3.0).translate(bpress.offset()), icon, 15.0, t.icon);
+                    }
+                    if theme::hand(b).on_hover_text(tip).clicked() {
+                        *edit = Some(pdfcraft_engine::Edit::MoveInTabOrder { name: f.name.clone(), earlier });
+                    }
+                }
+            }
+            if preparing && resp.double_clicked() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
+                if let Some(key) = key {
+                    if !selected {
+                        selection.select(key.clone(), false);
+                    }
+                    properties = Some(key);
+                }
+            } else if preparing
+                && resp.clicked()
+                && let Some(key) = key
+            {
+                selection.select(key, ui.input(|i| i.modifiers.shift || i.modifiers.command));
+            }
+            let resp = theme::hand(resp);
+            // Only a row in view can be hovered: its tip isn't built for the others.
+            let resp = if visible { resp.on_hover_text(field_tip(f)) } else { resp };
+            if resp.clicked()
+                && let (Some(p), Some(r)) = (f.page, f.rect)
+            {
+                *nav = Some(Nav::Flash(p, r));
+            }
+        }
+    }
+    properties
+}
+
+/// A Fields panel row's tooltip: the field's kind, its own tooltip and whether it has scripts.
+fn field_tip(f: &pdfcraft_render::Field) -> String {
+    let kind = format!("{:?}", f.kind);
+    let mut tip = crate::i18n::fmt(tl!("{kind} field"), &[("kind", tl!(&kind))]);
+    if let Some(tt) = &f.tooltip {
+        tip.push_str(&format!(" — {tt}"));
+    }
+    if f.has_actions {
+        tip.push_str(&format!("\n{}", tl!("Has JavaScript actions (run in M6)")));
+    }
+    tip
+}
+
+/// One page's rows of the Fields panel: each field, with the form field and widget a click on
+/// it selects (`None` when the form has no widget of it on that page).
+type FieldRows<'a> = Vec<(&'a pdfcraft_render::Field, Option<(String, usize)>)>;
+
+/// The Fields panel's rows: by page ("Unplaced" first), each page's in tab order. A row is paired
+/// with the first form field of its name, as the engine pairs them: one map, built once a frame.
+/// Searching the form for each row, and again inside the sort, was O(fields²) every frame.
+fn field_rows<'a>(fields: &'a [pdfcraft_render::Field], form: &[pdfcraft_engine::FormField]) -> Vec<(Option<usize>, FieldRows<'a>)> {
+    let mut by_name: std::collections::HashMap<&str, &pdfcraft_engine::FormField> = std::collections::HashMap::with_capacity(form.len());
+    for field in form {
+        by_name.entry(field.name.as_str()).or_insert(field);
+    }
+    let rank = |name: &str| by_name.get(name).and_then(|f| f.widgets.iter().map(|w| w.tab).min()).unwrap_or(usize::MAX);
+    let mut ordered: Vec<&pdfcraft_render::Field> = fields.iter().collect();
+    ordered.sort_by_cached_key(|f| (f.page, rank(&f.name)));
+    let mut rows: Vec<(Option<usize>, FieldRows<'a>)> = Vec::new();
+    for f in ordered {
+        let key =
+            by_name.get(f.name.as_str()).and_then(|field| field.widgets.iter().position(|w| w.page == f.page).map(|wi| (field.name.clone(), wi)));
+        match rows.last_mut() {
+            Some((page, page_rows)) if *page == f.page => page_rows.push((f, key)),
+            _ => rows.push((f.page, vec![(f, key)])),
+        }
+    }
+    rows
+}
+
+#[cfg(test)]
+mod field_rows {
+    use super::field_rows;
+    use std::sync::Arc;
+
+    /// A PDF of `objects` (numbered from 1; object 1 the catalog) with a valid xref table.
+    fn pdf(objects: &[String]) -> Vec<u8> {
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objects.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend(format!("{} 0 obj\n{o}\nendobj\n", i + 1).bytes());
+        }
+        let xref = out.len();
+        out.extend(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).bytes());
+        for o in offsets {
+            out.extend(format!("{o:010} 00000 n \n").bytes());
+        }
+        out.extend(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).bytes());
+        out
+    }
+
+    /// The fields the engine reads from `bytes`: the inspector's list and the form.
+    fn open(bytes: Vec<u8>) -> (Vec<pdfcraft_render::Field>, Arc<Vec<pdfcraft_engine::FormField>>) {
+        let mut session = pdfcraft_engine::Session::new();
+        let id = session.open("form.pdf", None, Arc::new(bytes), None).expect("opens");
+        let doc = session.get(id).expect("open");
+        (doc.info.fields.clone(), doc.form.clone())
+    }
+
+    /// Rows go by page, the unplaced first, each page's in tab order (here its annotation order,
+    /// not the `/Fields` order), and a row selects the first form field of its name.
+    #[test]
+    fn rows_follow_pages_and_tab_order() {
+        let widget = |name: &str, page: Option<usize>| match page {
+            Some(p) => format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [10 10 90 30] /P {} 0 R >>", 3 + p),
+            None => format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T ({name}) /Rect [10 10 90 30] >>"),
+        };
+        let bytes = pdf(&[
+            "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [5 0 R 7 0 R 8 0 R 9 0 R 10 0 R 6 0 R] >> >>".into(),
+            "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [6 0 R 5 0 R] >>".into(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [7 0 R 8 0 R 9 0 R] >>".into(),
+            widget("a1", Some(0)),
+            widget("a2", Some(0)),
+            widget("b", Some(1)),
+            widget("twin", Some(1)),
+            widget("twin", Some(1)),
+            widget("loose", None),
+        ]);
+        let (fields, form) = open(bytes);
+        // A page's rows as (field name, the form field and widget a click selects).
+        type Named<'a> = Vec<(&'a str, Option<(String, usize)>)>;
+        let rows: Vec<(Option<usize>, Named)> = field_rows(&fields, &form)
+            .into_iter()
+            .map(|(page, rows)| (page, rows.into_iter().map(|(f, key)| (f.name.as_str(), key)).collect()))
+            .collect();
+        let key = |name: &str| Some((name.to_string(), 0));
+        assert_eq!(
+            rows,
+            [
+                (None, vec![("loose", key("loose"))]),
+                (Some(0), vec![("a2", key("a2")), ("a1", key("a1"))]),
+                (Some(1), vec![("b", key("b")), ("twin", key("twin")), ("twin", key("twin"))]),
+            ]
+        );
+    }
+
+    /// The panel's rows for a large form take milliseconds: looking each row's field up in the
+    /// form, there and inside the sort, was O(fields²) every frame.
+    #[test]
+    fn rows_for_a_large_form_are_quick() {
+        const PAGES: usize = 150;
+        const PER_PAGE: usize = 100;
+        let mut objects = vec![String::new(), String::new()];
+        let page = |p: usize| 3 + p;
+        let field = |p: usize, k: usize| 3 + PAGES + p * PER_PAGE + k;
+        let mut all = Vec::new();
+        for p in 0..PAGES {
+            let annots: Vec<String> = (0..PER_PAGE).map(|k| format!("{} 0 R", field(p, k))).collect();
+            all.extend(annots.iter().cloned());
+            objects.push(format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [{}] >>", annots.join(" ")));
+        }
+        for p in 0..PAGES {
+            for k in 0..PER_PAGE {
+                objects.push(format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (field{p}_{k}) /Rect [10 10 90 30] /P {} 0 R >>", page(p)));
+            }
+        }
+        // `/Fields` in no particular order, so the rows must be sorted.
+        let mut seed = 12345u64;
+        for i in (1..all.len()).rev() {
+            seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+            all.swap(i, (seed >> 33) as usize % (i + 1));
+        }
+        objects[0] = format!("<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [{}] >> >>", all.join(" "));
+        let kids: Vec<String> = (0..PAGES).map(|p| format!("{} 0 R", page(p))).collect();
+        objects[1] = format!("<< /Type /Pages /Kids [{}] /Count {PAGES} >>", kids.join(" "));
+        let (fields, form) = open(pdf(&objects));
+        assert_eq!(fields.len(), PAGES * PER_PAGE);
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let rows = field_rows(&fields, &form);
+            let _ = tx.send((rows.len(), rows.iter().map(|(_, r)| r.len()).sum::<usize>()));
+        });
+        let counted = rx.recv_timeout(std::time::Duration::from_secs(3)).expect("the Fields panel's rows must not take seconds a frame");
+        assert_eq!(counted, (PAGES, PAGES * PER_PAGE));
+    }
+}
diff --git a/crates/ui-egui/src/search_ui.rs b/crates/ui-egui/src/panels/search_ui.rs
similarity index 95%
rename from crates/ui-egui/src/search_ui.rs
rename to crates/ui-egui/src/panels/search_ui.rs
index 630ca898dc..85a9b46052 100644
--- a/crates/ui-egui/src/search_ui.rs
+++ b/crates/ui-egui/src/panels/search_ui.rs
@@ -11,6 +11,7 @@ use crate::widgets;
 /// Glyphs of context shown on each side of a match.
 const CONTEXT: usize = 36;
 
+/// Draw the Search panel with its query, options, progress and clickable result excerpts.
 pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, pages: usize) {
     crate::widgets::begin_dialog(ui);
     let searched = view.texts.len() + view.text_failed.len();
@@ -18,7 +19,8 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, pages: us
     find.in_panel = true;
     let l = ui.label(egui::RichText::new(tl!("What word or phrase would you like to search for?")).color(t.text_muted));
     let r = ui
-        .add(crate::widgets::line(&mut find.query).id(egui::Id::new("search-panel-input")).hint_text(tl!("Search")).desired_width(f32::INFINITY))
+        .add(crate::widgets::line(&mut find.query).id(egui::Id::unique("search-panel-input")).hint_text(tl!("Search")).desired_width(f32::INFINITY))
+        .accessible_name(tl!("Search"))
         .labelled_by(l.id);
     if find.focus {
         r.request_focus();
diff --git a/crates/ui-egui/src/panels/side_panels.rs b/crates/ui-egui/src/panels/side_panels.rs
new file mode 100644
index 0000000000..71c3baa648
--- /dev/null
+++ b/crates/ui-egui/src/panels/side_panels.rs
@@ -0,0 +1,522 @@
+//! The side panels around the page: the Tools pane, the rail and the open side panel
+//! ([`crate::RightPanel`]), drawn with craft-ui task panes ([`craft_ui::panes`]).
+//!
+//! On the right, outermost first: the rail, the Tools pane when Preferences ▸ Tools panel side is
+//! Right, then the side panel, then the page. Panes are docked only; their widths are resizable
+//! and saved with the preferences.
+
+use std::ops::RangeInclusive;
+
+use craft_ui::panes::{Edge, PaneContent, PaneHost, PaneLabels, PaneRequest, PaneState, SidePolicy};
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+
+use crate::{Mode, PdfCraftApp};
+
+/// Default width of the Tools pane.
+pub const TOOLS_WIDTH: f32 = 272.0;
+/// Default width of the side panel.
+pub const SIDE_WIDTH: f32 = 330.0;
+const TOOLS_RANGE: RangeInclusive<f32> = 240.0..=520.0;
+const SIDE_RANGE: RangeInclusive<f32> = 260.0..=520.0;
+/// Version of the saved `side_panels` value.
+const VERSION: u64 = 1;
+/// Deepest split tree the old layout migration walks; the old renderer allowed far fewer.
+const MAX_DEPTH: usize = 32;
+
+/// The two panes [`PaneHost`] draws.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Pane {
+    Tools,
+    /// The open [`crate::RightPanel`].
+    Side,
+}
+
+impl Pane {
+    pub fn parse(id: &str) -> Option<Self> {
+        match id {
+            "tools" => Some(Self::Tools),
+            "side" => Some(Self::Side),
+            _ => None,
+        }
+    }
+
+    fn range(self) -> RangeInclusive<f32> {
+        match self {
+            Self::Tools => TOOLS_RANGE,
+            Self::Side => SIDE_RANGE,
+        }
+    }
+}
+
+/// Preferences ▸ Tools panel side.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ToolsSide {
+    #[default]
+    Left,
+    Right,
+}
+
+/// The saved side panel layout. Which side panel is open stays in `PdfCraftApp::right` and the
+/// Tools pane's open state in `PdfCraftApp::left_open`.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct SidePanels {
+    /// The one setting that places the Tools pane; [`SidePanels::tools_edge`] is its only reader
+    /// in the layout.
+    pub tools_side: ToolsSide,
+    pub tools_width: f32,
+    pub side_width: f32,
+}
+
+impl Default for SidePanels {
+    fn default() -> Self {
+        Self { tools_side: ToolsSide::Left, tools_width: TOOLS_WIDTH, side_width: SIDE_WIDTH }
+    }
+}
+
+/// A width from settings or automation: finite, within the pane's limits.
+fn clamp_width(pane: Pane, width: f64) -> Option<f32> {
+    let range = pane.range();
+    width.is_finite().then(|| (width as f32).clamp(*range.start(), *range.end()))
+}
+
+/// What [`restore`] read from the saved preferences.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Restored {
+    pub panels: SidePanels,
+    /// `None`: not saved; keep the default.
+    pub tools_open: Option<bool>,
+    /// An old layout had the side panel closed.
+    pub side_closed: bool,
+}
+
+impl SidePanels {
+    pub fn tools_on_right(&self) -> bool {
+        self.tools_side == ToolsSide::Right
+    }
+
+    fn tools_edge(&self) -> Edge {
+        match self.tools_side {
+            ToolsSide::Left => Edge::Start,
+            ToolsSide::Right => Edge::End,
+        }
+    }
+
+    pub fn width(&self, pane: Pane) -> f32 {
+        match pane {
+            Pane::Tools => self.tools_width,
+            Pane::Side => self.side_width,
+        }
+    }
+
+    fn set_width(&mut self, pane: Pane, width: f32) {
+        let Some(width) = clamp_width(pane, f64::from(width)) else { return };
+        match pane {
+            Pane::Tools => self.tools_width = width,
+            Pane::Side => self.side_width = width,
+        }
+    }
+
+    /// The saved value (`side_panels` in the preferences).
+    pub fn to_json(&self, tools_open: bool) -> Value {
+        json!({
+            "version": VERSION,
+            "tools_side": self.tools_side,
+            "tools_open": tools_open,
+            "tools_width": self.tools_width,
+            "side_width": self.side_width,
+        })
+    }
+}
+
+/// Reads the side panel layout from saved preferences: `side_panels`, else the old `docking`
+/// value, else the defaults. Nothing in it is an error: a malformed or unknown value gives the
+/// defaults.
+pub fn restore(saved: &Value) -> Restored {
+    let defaults = Restored { panels: SidePanels::default(), tools_open: None, side_closed: false };
+    if let Some(value) = saved.get("side_panels") {
+        if value.get("version").and_then(Value::as_u64) != Some(VERSION) {
+            return defaults;
+        }
+        let mut panels = SidePanels::default();
+        if let Some(side) = value.get("tools_side").and_then(|v| serde_json::from_value::<ToolsSide>(v.clone()).ok()) {
+            panels.tools_side = side;
+        }
+        if let Some(width) = value.get("tools_width").and_then(Value::as_f64).and_then(|w| clamp_width(Pane::Tools, w)) {
+            panels.tools_width = width;
+        }
+        if let Some(width) = value.get("side_width").and_then(Value::as_f64).and_then(|w| clamp_width(Pane::Side, w)) {
+            panels.side_width = width;
+        }
+        return Restored { panels, tools_open: value.get("tools_open").and_then(Value::as_bool), side_closed: false };
+    }
+    let Some(mut restored) = saved.get("docking").and_then(migrate) else { return defaults };
+    if let Some(open) = saved.get("docking_left_open").and_then(Value::as_bool) {
+        restored.tools_open = Some(open);
+    }
+    restored
+}
+
+/// Where the old docking tree held a panel.
+struct Found {
+    /// The panel's group held only it: a tab group or stack of its own.
+    alone: bool,
+    /// The innermost split around the panel's own group.
+    split: Option<Split>,
+}
+
+struct Split {
+    horizontal: bool,
+    /// The panel is in the split's second (right or bottom) child.
+    second: bool,
+    /// The split's fixed size, when it is the panel's side.
+    size: Option<f64>,
+}
+
+/// The pixel size of `size` (`{"FixedFirst": w}` or `{"FixedSecond": w}`) when it fixes the side
+/// the panel is on.
+fn fixed_size(size: Option<&Value>, second: bool) -> Option<f64> {
+    let key = if second { "FixedSecond" } else { "FixedFirst" };
+    size?.get(key)?.as_f64()
+}
+
+fn group_ids(node: &Value) -> Option<Vec<&str>> {
+    if let Some(tabs) = node.get("Tabs") {
+        return Some(tabs.get("panels")?.as_array()?.iter().filter_map(Value::as_str).collect());
+    }
+    let entries = node.get("Stack")?.get("entries")?.as_array()?;
+    Some(entries.iter().filter_map(|entry| entry.get("panel")?.as_str()).collect())
+}
+
+fn find(node: &Value, panel: &str, depth: usize) -> Option<Found> {
+    if depth > MAX_DEPTH {
+        return None;
+    }
+    if let Some(ids) = group_ids(node) {
+        return ids.contains(&panel).then(|| Found { alone: ids.iter().all(|id| *id == panel), split: None });
+    }
+    let split = node.get("Split")?;
+    for (key, second) in [("first", false), ("second", true)] {
+        if let Some(mut found) = split.get(key).and_then(|child| find(child, panel, depth + 1)) {
+            // A panel sharing its group was placed by its group, not by a split.
+            if found.alone && found.split.is_none() {
+                let horizontal = split.get("axis").and_then(Value::as_str) == Some("Horizontal");
+                found.split = Some(Split { horizontal, second, size: fixed_size(split.get("size"), second) });
+            }
+            return Some(found);
+        }
+    }
+    None
+}
+
+/// The old layout's saved place of a closed panel: whether it was on the right and its width.
+fn hidden_place<'a>(old: &'a Value, panel: &str) -> Option<&'a Value> {
+    old.get("hidden")?.as_array()?.iter().find_map(|entry| {
+        let pair = entry.as_array()?;
+        (pair.first()?.as_str()? == panel).then(|| pair.get(1)).flatten()
+    })
+}
+
+fn floating_contains(old: &Value, panel: &str) -> bool {
+    old.get("layout").and_then(|l| l.get("floating")).and_then(Value::as_array).is_some_and(|groups| {
+        groups.iter().any(|group| group.get("panels").and_then(Value::as_array).is_some_and(|ids| ids.iter().any(|id| id.as_str() == Some(panel))))
+    })
+}
+
+/// A panel of the old layout: on the right edge, open, and its width where the layout stated it
+/// in points. A floating or tabbed panel counts as on the left, as the old Tools side reading did.
+fn old_panel(old: &Value, panel: &str) -> (bool, bool, Option<f64>) {
+    let root = old.get("layout").and_then(|l| l.get("root"));
+    if let Some(found) = root.and_then(|root| find(root, panel, 0)) {
+        return match found.split {
+            Some(split) if split.horizontal => (split.second, true, split.size),
+            _ => (false, true, None),
+        };
+    }
+    if floating_contains(old, panel) {
+        return (false, true, None);
+    }
+    let Some(place) = hidden_place(old, panel) else { return (false, false, None) };
+    let right = place.get("placement").and_then(|p| p.get("Split")).and_then(Value::as_str) == Some("Right");
+    let left = place.get("placement").and_then(|p| p.get("Split")).and_then(Value::as_str) == Some("Left");
+    let size = if right || left { fixed_size(place.get("size"), right) } else { None };
+    (right, false, size)
+}
+
+/// Reads the old docking layout (craft-ui's `Workspace`) as plain JSON. `None` when it has no
+/// document view, which the old layout always held.
+fn migrate(old: &Value) -> Option<Restored> {
+    find(old.get("layout")?.get("root")?, "canvas", 0)?;
+    let mut panels = SidePanels::default();
+    let (tools_right, tools_open, tools_width) = old_panel(old, "tools");
+    let (_, side_open, side_width) = old_panel(old, "inspector");
+    if tools_right {
+        panels.tools_side = ToolsSide::Right;
+    }
+    if let Some(width) = tools_width.and_then(|w| clamp_width(Pane::Tools, w)) {
+        panels.tools_width = width;
+    }
+    if let Some(width) = side_width.and_then(|w| clamp_width(Pane::Side, w)) {
+        panels.side_width = width;
+    }
+    Some(Restored { panels, tools_open: Some(tools_open), side_closed: !side_open })
+}
+
+/// What `ui.panel` and `ui.state` report.
+pub fn state(app: &PdfCraftApp) -> Value {
+    let panels = &app.side_panels;
+    json!({
+        "tools_side": panels.tools_side,
+        "tools_open": app.left_open,
+        "tools_width": panels.tools_width,
+        "side_open": app.right.is_some(),
+        "side_panel": app.right.map(|r| format!("{r:?}")),
+        "side_width": panels.side_width,
+    })
+}
+
+/// `ui.panel {panel, open?, width?}` and `ui.dock.reset` (`reset`).
+pub fn command(app: &mut PdfCraftApp, reset: bool, params: &Value) -> Result<Value, String> {
+    if reset {
+        app.side_panels = SidePanels::default();
+        app.left_open = true;
+        return Ok(json!({ "side_panels": state(app) }));
+    }
+    let pane = Pane::parse(params.get("panel").and_then(Value::as_str).ok_or("panel must be \"tools\" or \"side\"")?)
+        .ok_or("panel must be \"tools\" or \"side\"")?;
+    let open = match params.get("open") {
+        None | Some(Value::Null) => None,
+        Some(value) => Some(value.as_bool().ok_or("open must be a boolean")?),
+    };
+    let width = match params.get("width") {
+        None | Some(Value::Null) => None,
+        Some(value) => Some(value.as_f64().and_then(|w| clamp_width(pane, w)).ok_or("width must be a finite number")?),
+    };
+    if let Some(width) = width {
+        app.side_panels.set_width(pane, width);
+    }
+    match (pane, open) {
+        (Pane::Tools, Some(open)) => app.left_open = open,
+        (Pane::Side, Some(true)) if app.right.is_none() => app.toggle_side_panel(),
+        (Pane::Side, Some(false)) if app.right.is_some() => app.choose_right_panel(None),
+        _ => {}
+    }
+    Ok(json!({ "side_panels": state(app) }))
+}
+
+struct Content<'a> {
+    app: &'a mut PdfCraftApp,
+}
+
+impl PaneContent<Pane> for Content<'_> {
+    fn title(&self, pane: &Pane) -> String {
+        crate::i18n::t(match pane {
+            Pane::Tools => "Tools",
+            Pane::Side => "Inspector",
+        })
+        .to_owned()
+    }
+
+    fn body(&mut self, ui: &mut egui::Ui, pane: &Pane) {
+        match pane {
+            Pane::Tools => crate::panels::left_panel(self.app, ui),
+            Pane::Side => {
+                ui.data_mut(|data| data.insert_temp(egui::Id::unique("pdfcraft-inspector-body"), ui.max_rect()));
+                crate::panels::right_panel(self.app, ui);
+            }
+        }
+    }
+
+    fn default_state(&self, pane: &Pane) -> PaneState {
+        state_of(&self.app.side_panels, *pane)
+    }
+
+    fn size_range(&self, pane: &Pane) -> RangeInclusive<f32> {
+        pane.range()
+    }
+
+    fn movable(&self, _pane: &Pane) -> bool {
+        false
+    }
+
+    fn title_bar(&self, _pane: &Pane) -> bool {
+        // Both panels draw their own header and Close.
+        false
+    }
+}
+
+fn state_of(panels: &SidePanels, pane: Pane) -> PaneState {
+    let edge = match pane {
+        Pane::Tools => panels.tools_edge(),
+        Pane::Side => Edge::End,
+    };
+    PaneState::docked(edge, panels.width(pane))
+}
+
+/// The panes that show this frame, outermost first on a shared edge.
+fn open_panes(app: &PdfCraftApp) -> Vec<Pane> {
+    let mut open = Vec::new();
+    // Read mode hides the tools, not the navigation panes.
+    if app.left_open && app.mode != Mode::Read {
+        open.push(Pane::Tools);
+    }
+    // Home and Combine files have no side panel; the choice is kept for the next document.
+    if app.active.is_some() && app.right.is_some() {
+        open.push(Pane::Side);
+    }
+    open
+}
+
+/// Draws the rail and the open panes. Call after the top bars and before the central panel.
+pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    if let Some(panel) = app.right {
+        app.last_right = panel;
+    }
+    // The rail first: it is the outermost panel on the right.
+    if app.active.is_some() {
+        crate::chrome::right_rail(app, ui);
+    }
+    // The expanded All tools view covers the panes.
+    if app.mode == Mode::AllTools && app.all_tools_full {
+        return;
+    }
+    let open = open_panes(app);
+    if open.is_empty() {
+        return;
+    }
+    let t = crate::theme::Tokens::get(ui.ctx());
+    let labels = PaneLabels { resize: crate::i18n::t("Resize panels").to_owned(), ..PaneLabels::default() };
+    let panels = app.side_panels;
+    // Columns: both panes may share the right edge, Tools outermost, as `open` lists them.
+    let output = PaneHost::new(egui::Id::unique("pdfcraft-side-panels"))
+        .policy(SidePolicy::Columns)
+        .f6(false)
+        .labels(labels)
+        .frame(egui::Frame::NONE.fill(t.panel))
+        .body_margin(egui::Margin::ZERO)
+        .show(ui, &open, |pane| Some(state_of(&panels, *pane)), &mut Content { app });
+    for request in output.requests {
+        match request {
+            PaneRequest::Resize(pane, width) => app.side_panels.set_width(pane, width),
+            PaneRequest::Close(Pane::Tools) => app.left_open = false,
+            PaneRequest::Close(Pane::Side) => app.choose_right_panel(None),
+            _ => {}
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tabs(panels: &[&str]) -> Value {
+        json!({"Tabs": {"panels": panels, "active": 0}})
+    }
+
+    fn split(size: Value, first: Value, second: Value) -> Value {
+        json!({"Split": {"axis": "Horizontal", "size": size, "first": first, "second": second}})
+    }
+
+    fn workspace(root: Value, floating: Value, hidden: Value) -> Value {
+        json!({"docking": {"layout": {"root": root, "floating": floating}, "hidden": hidden}})
+    }
+
+    /// The old default layout, as craft-ui 5c874d5 serialized it.
+    fn docked(tools: f64, inspector: f64) -> Value {
+        workspace(
+            split(json!({"FixedFirst": tools}), tabs(&["tools"]), split(json!({"FixedSecond": inspector}), tabs(&["canvas"]), tabs(&["inspector"]))),
+            json!([]),
+            json!([]),
+        )
+    }
+
+    #[test]
+    fn docked_default_keeps_widths() {
+        let restored = restore(&docked(300.0, 400.0));
+        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Left, tools_width: 300.0, side_width: 400.0 });
+        assert_eq!((restored.tools_open, restored.side_closed), (Some(true), false));
+    }
+
+    #[test]
+    fn tools_on_the_right_moves_right() {
+        // `set_tools_on_right` put Tools to the right of the Inspector.
+        let old = workspace(
+            split(json!({"FixedSecond": 330.0}), tabs(&["canvas"]), split(json!({"FixedSecond": 290.0}), tabs(&["inspector"]), tabs(&["tools"]))),
+            json!([]),
+            json!([]),
+        );
+        let restored = restore(&old);
+        assert_eq!(restored.panels.tools_side, ToolsSide::Right);
+        assert_eq!(restored.panels.tools_width, 290.0);
+        // The Inspector's own split fixes Tools' width, not its.
+        assert_eq!(restored.panels.side_width, SIDE_WIDTH);
+    }
+
+    #[test]
+    fn floated_tools_docks_left_and_stays_open() {
+        let old = workspace(
+            split(json!({"FixedSecond": 360.0}), tabs(&["canvas"]), tabs(&["inspector"])),
+            json!([{"panels": ["tools"], "active": 0, "rect": [10.0, 20.0, 300.0, 400.0]}]),
+            json!([]),
+        );
+        let restored = restore(&old);
+        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Left, tools_width: TOOLS_WIDTH, side_width: 360.0 });
+        assert_eq!((restored.tools_open, restored.side_closed), (Some(true), false));
+    }
+
+    #[test]
+    fn tools_tabbed_with_the_inspector_docks_both() {
+        let old = workspace(split(json!({"FixedSecond": 350.0}), tabs(&["canvas"]), tabs(&["inspector", "tools"])), json!([]), json!([]));
+        let restored = restore(&old);
+        assert_eq!(restored.panels.tools_side, ToolsSide::Left);
+        assert_eq!((restored.panels.tools_width, restored.panels.side_width), (TOOLS_WIDTH, SIDE_WIDTH));
+        assert_eq!((restored.tools_open, restored.side_closed), (Some(true), false));
+    }
+
+    #[test]
+    fn a_hidden_inspector_stays_closed_and_hidden_tools_keeps_its_side() {
+        let old = workspace(
+            tabs(&["canvas"]),
+            json!([]),
+            json!([
+                ["inspector", {"floating": null, "anchor": "canvas", "placement": {"Split": "Right"}, "size": {"FixedSecond": 380.0}, "stack": null, "sibling": ["canvas"]}],
+                ["tools", {"floating": null, "anchor": "canvas", "placement": {"Split": "Right"}, "size": {"FixedSecond": 250.0}, "stack": null, "sibling": ["canvas"]}]
+            ]),
+        );
+        let restored = restore(&old);
+        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Right, tools_width: 250.0, side_width: 380.0 });
+        assert_eq!((restored.tools_open, restored.side_closed), (Some(false), true));
+    }
+
+    #[test]
+    fn malformed_values_give_the_defaults() {
+        let defaults = Restored { panels: SidePanels::default(), tools_open: None, side_closed: false };
+        for saved in [
+            json!({"docking": "not a layout"}),
+            json!({"docking": {"layout": [1, 2]}}),
+            json!({"docking": {"layout": {"root": {"Split": {"axis": 3, "size": {"FixedFirst": "wide"}, "first": null}}}}}),
+            json!({"side_panels": {"version": 2, "tools_side": "right"}}),
+            json!({"side_panels": "right"}),
+        ] {
+            let restored = restore(&saved);
+            assert_eq!(restored, defaults, "{saved}");
+        }
+        // Non-finite and out-of-range widths fall back or clamp; an unknown side keeps Left.
+        let restored = restore(&json!({"side_panels": {"version": 1, "tools_side": "up", "tools_width": 9000.0, "side_width": "x"}}));
+        assert_eq!(restored.panels, SidePanels { tools_side: ToolsSide::Left, tools_width: 520.0, side_width: SIDE_WIDTH });
+        // Deep trees are cut off rather than walked.
+        let mut deep = tabs(&["tools"]);
+        for _ in 0..200 {
+            deep = split(json!({"Ratio": 0.5}), tabs(&["canvas"]), deep);
+        }
+        assert_eq!(restore(&workspace(deep, json!([]), json!([]))).panels.tools_side, ToolsSide::Left);
+    }
+
+    #[test]
+    fn saved_value_round_trips() {
+        let panels = SidePanels { tools_side: ToolsSide::Right, tools_width: 300.0, side_width: 410.0 };
+        let restored = restore(&json!({ "side_panels": panels.to_json(false) }));
+        assert_eq!(restored, Restored { panels, tools_open: Some(false), side_closed: false });
+    }
+}
diff --git a/crates/ui-egui/src/panels/tools.rs b/crates/ui-egui/src/panels/tools.rs
new file mode 100644
index 0000000000..3a1cccd713
--- /dev/null
+++ b/crates/ui-egui/src/panels/tools.rs
@@ -0,0 +1,282 @@
+use super::edit::{actions_menu, edit_panel, stamp_palette};
+use super::*;
+
+const COLLAPSED_TOOLS: usize = 14;
+
+fn hue(g: &ToolGroup) -> Color32 {
+    Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2])
+}
+
+pub fn left_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    // Organize closed another way (the grid's Close, or a page opened from it) closes the tool too,
+    // as its panel's Close does, back to the workspace's own panel.
+    if app.left == LeftPanel::Tool("organize") && app.active.and_then(|i| app.views.get(i)).is_some_and(|v| !v.organize) {
+        app.left = crate::organize_panel::workspace_panel(app.mode);
+    }
+    egui::Frame::NONE.fill(t.panel).inner_margin(egui::Margin { left: 14, right: 10, top: 12, bottom: 10 }).stroke(Stroke::new(1.0, t.divider)).show(
+        ui,
+        |ui| match app.left {
+            // Organize pages has its own panel whenever the grid shows (with a document open).
+            _ if app.active.is_some() && crate::organize_panel::showing(app) => crate::organize_panel::panel(app, ui, &t),
+            LeftPanel::AllTools => all_tools(app, ui, &t),
+            LeftPanel::Tool(id) => match catalog::group(id) {
+                Some(g) => tool_detail(app, ui, &t, g),
+                None => app.left = LeftPanel::AllTools,
+            },
+            LeftPanel::CalculationOrder => crate::calc_order_ui::panel(app, ui, &t),
+        },
+    );
+}
+
+/// A panel's title row: a leading button (`lead`: its icon and tooltip) when given, the title
+/// and Close. Returns whether the leading button and Close were clicked.
+pub(crate) fn panel_header(ui: &mut egui::Ui, t: &Tokens, title: &str, lead: Option<(&str, &str)>) -> (bool, bool) {
+    let mut go_back = false;
+    let mut close = false;
+    ui.horizontal(|ui| {
+        if let Some((icon, tip)) = lead
+            && icons::button(ui, icon, 26.0, false, tip).clicked()
+        {
+            go_back = true;
+        }
+        // Reserve space for Close before laying out the translated title. Long tool names
+        // must never expand the fixed-width sidebar or push the Close control off-screen.
+        let title_width = (ui.available_width() - 26.0 - ui.spacing().item_spacing.x).max(1.0);
+        ui.add_sized([title_width, 26.0], egui::Label::new(egui::RichText::new(tl!(title)).font(theme::semibold(15.5)).color(t.text)).truncate())
+            .on_hover_text(tl!(title));
+        if icons::button(ui, "x", 26.0, false, tl!("Close panel")).clicked() {
+            close = true;
+        }
+    });
+    ui.add_space(4.0);
+    ui.separator();
+    ui.add_space(6.0);
+    (go_back, close)
+}
+
+/// The All tools sidebar: Expand (the full view) and Close, then the tool list, the first few
+/// tools until View more shows them all.
+fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
+    // Labels distinct from the Combine grid's Expand and Collapse, which can show beside them.
+    let (expand, close) = panel_header(ui, t, "All tools", Some(("maximize-2", tl!("Expand all tools"))));
+    if expand {
+        app.expand_all_tools();
+    }
+    if close {
+        app.left_open = false;
+    }
+    egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+        ui.add_space(2.0);
+        let shown = if app.all_tools_expanded { TOOL_GROUPS.len() } else { COLLAPSED_TOOLS.min(TOOL_GROUPS.len()) };
+        for g in &TOOL_GROUPS[..shown] {
+            if tool_row(ui, t, g).clicked() {
+                app.select_tool(g.id);
+            }
+        }
+        ui.add_space(4.0);
+        let more = if app.all_tools_expanded { "View less" } else { "View more" };
+        if ui
+            .add(
+                egui::Label::new(egui::RichText::new(tl!(more)).color(t.accent_text).font(theme::medium(13.0)))
+                    .selectable(false)
+                    .sense(Sense::click()),
+            )
+            .on_hover_cursor(egui::CursorIcon::PointingHand)
+            .clicked()
+        {
+            app.all_tools_expanded = !app.all_tools_expanded;
+        }
+    });
+}
+
+/// Draw a one-line row label without painting into the status chip or beyond the sidebar.
+/// Accessibility retains the complete name through the row's WidgetInfo.
+pub(super) fn row_label(ui: &mut egui::Ui, text: &str, font: egui::FontId, color: Color32, left_center: egui::Pos2, max_width: f32) -> bool {
+    let mut job = egui::text::LayoutJob::simple_singleline(text.to_owned(), font, color);
+    job.wrap = egui::text::TextWrapping { max_width: max_width.max(1.0), max_rows: 1, break_anywhere: true, ..Default::default() };
+    let galley = ui.fonts_mut(|f| f.layout_job(job));
+    let elided = galley.elided;
+    ui.painter().galley(left_center - vec2(0.0, galley.size().y / 2.0), galley, color);
+    elided
+}
+
+/// Draw one tool-group row with its icon, label, badge and availability hint.
+fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
+    let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
+    let press = theme::Press::track(ui, &resp);
+    press.wash(ui, rect, 6, false);
+    let body = rect.translate(press.offset());
+    icons::paint(ui, Rect::from_min_size(body.min + vec2(6.0, 7.0), vec2(20.0, 20.0)), g.icon, 19.0, hue(g));
+    let right_reserved = match (g.badge, g.availability) {
+        (Some(b), _) => ui.fonts_mut(|f| f.layout_no_wrap(tl!(b).to_owned(), theme::semibold(9.5), Color32::WHITE).size().x) + 26.0,
+        (None, Availability::Planned(m)) if resp.hovered() => {
+            let hint = format!("{} · {m}", tl!("Planned"));
+            ui.fonts_mut(|f| f.layout_no_wrap(hint, theme::medium(10.5), t.text_faint).size().x) + 18.0
+        }
+        _ => 8.0,
+    };
+    let clipped =
+        row_label(ui, tl!(g.label), theme::regular(13.5), t.text, body.left_center() + vec2(36.0, 0.0), rect.width() - 36.0 - right_reserved);
+    match (g.badge, g.availability) {
+        (Some(b), _) => {
+            let font = theme::semibold(9.5);
+            let badge = tl!(b);
+            let w = ui.fonts_mut(|f| f.layout_no_wrap(badge.to_string(), font.clone(), Color32::WHITE).size().x);
+            let r = Rect::from_center_size(body.right_center() - vec2(w / 2.0 + 10.0, 0.0), vec2(w + 10.0, 16.0));
+            ui.painter().rect_filled(r, CornerRadius::same(4), t.badge_new);
+            ui.painter().text(r.center(), Align2::CENTER_CENTER, badge, font, Color32::WHITE);
+        }
+        // Planned tools: a quiet milestone hint instead of a chip, so the list stays calm.
+        (None, Availability::Planned(m)) if resp.hovered() => {
+            ui.painter().text(
+                body.right_center() - vec2(10.0, 0.0),
+                Align2::RIGHT_CENTER,
+                format!("{} · {m}", tl!("Planned")),
+                theme::medium(10.5),
+                t.text_faint,
+            );
+        }
+        _ => {}
+    }
+    let tip = match g.availability {
+        Availability::Ready => tl!("Available").to_string(),
+        Availability::Planned(m) => format!("{} {m} — {}", tl!("Planned for milestone"), tl!("open to see what it will include")),
+        Availability::Provider => tl!("Optional: needs an AI provider you configure").into(),
+    };
+    let tip = if clipped { format!("{} — {tip}", tl!(g.label)) } else { tip };
+    theme::hand(resp).on_hover_text(tip)
+}
+
+/// Draw the detail view for one tool group, dispatching its commands and tool-specific panels.
+fn tool_detail(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static ToolGroup) {
+    if g.id == "edit" {
+        edit_panel(app, ui, t, g);
+        return;
+    }
+    let (back, close) = panel_header(ui, t, g.label, Some(("chevron-left", tl!("Back to all tools"))));
+    if back {
+        app.left = LeftPanel::AllTools;
+        app.enter_mode(crate::Mode::AllTools);
+    }
+    if close {
+        app.left_open = false;
+    }
+    if let Availability::Planned(m) = g.availability {
+        egui::Frame::NONE.fill(t.accent_soft).corner_radius(CornerRadius::same(8)).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
+            ui.set_width(ui.available_width());
+            ui.label(
+                egui::RichText::new(format!("{} {m}. {}", tl!("Coming in milestone"), tl!("Items marked Ready work today.")))
+                    .color(t.text)
+                    .font(theme::regular(12.0)),
+            );
+        });
+    }
+    if g.id == "measure" {
+        crate::measure_ui::panel(app, ui, t);
+        return;
+    }
+    // Add a stamp: the palette.
+    if g.id == "stamp" {
+        stamp_palette(app, ui, t);
+        return;
+    }
+    // Prepare a form: Preview fills the form as a reader would; Edit goes back.
+    if g.id == "form" {
+        ui.horizontal(|ui| {
+            let label = if app.form_preview { "Edit fields" } else { "Preview" };
+            if widgets::pill_button(ui, tl!(label), app.form_preview).on_hover_text(tl!("Try the form as people filling it in will see it")).clicked()
+            {
+                app.form_preview = !app.form_preview;
+                if app.form_preview {
+                    app.quick_tool = crate::QuickTool::Select;
+                }
+            }
+        });
+        ui.add_space(6.0);
+    }
+    let mut run = None;
+    // Redact a PDF has Acrobat's footer: Clear all / Redact all.
+    let footer = g.id == "redact";
+    let marks = if footer { app.active_ids().and_then(|(_, id)| app.session.get(id)).map_or(0, |d| d.redaction_marks()) } else { 0 };
+    let list_h = if footer { (ui.available_height() - 52.0).max(80.0) } else { ui.available_height() };
+    egui::ScrollArea::vertical().auto_shrink([false, false]).max_height(list_h).show(ui, |ui| {
+        ui.add_space(2.0);
+        for s in g.sections {
+            widgets::section_title(ui, tl!(s.title));
+            for item in s.items {
+                if g.id == "fill_sign" && (item.command.starts_with("sign.fill.signature") || item.command.starts_with("sign.fill.initials")) {
+                    continue;
+                }
+                let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(item.label)));
+                let ready = item.availability == Availability::Ready;
+                let press = theme::Press::track(ui, &resp);
+                press.wash(ui, rect, 6, false);
+                let body = rect.translate(press.offset());
+                let fg = if ready { t.text } else { t.text_muted };
+                icons::paint(
+                    ui,
+                    Rect::from_min_size(body.min + vec2(6.0, 8.0), vec2(18.0, 18.0)),
+                    item.icon,
+                    17.0,
+                    if ready { hue(g) } else { t.text_faint },
+                );
+                let (chip, fill, cfg) = match item.availability {
+                    Availability::Ready => (tl!("Ready"), Color32::from_rgb(0xDD, 0xF3, 0xE4), Color32::from_rgb(0x1E, 0x7B, 0x43)),
+                    Availability::Planned(m) => (m, t.pressed, t.text_muted),
+                    Availability::Provider => ("AI", t.pressed, t.text_muted),
+                };
+                let font = theme::semibold(9.5);
+                let chip_label = tl!(chip).to_string();
+                let w = crate::widgets::text_width(ui, &chip_label, &font);
+                let r = Rect::from_center_size(body.right_center() - vec2(w / 2.0 + 10.0, 0.0), vec2(w + 10.0, 16.0));
+                row_label(ui, tl!(item.label), theme::regular(13.0), fg, body.left_center() + vec2(34.0, 0.0), r.left() - body.left() - 42.0);
+                ui.painter().rect_filled(r, CornerRadius::same(4), fill);
+                ui.painter().text(r.center(), Align2::CENTER_CENTER, chip_label, font, cfg);
+                let resp = theme::hand(resp).on_hover_text(format!("{} — {}", tl!(item.label), item.command));
+                // An entry with further commands opens a menu; its caret goes before the chip.
+                if item.actions.is_empty() {
+                    if resp.clicked() {
+                        run = Some(item.command);
+                    }
+                } else if let Some(cmd) = actions_menu(app, ui, &resp, item, r.left_center() - vec2(10.0, 0.0), fg) {
+                    run = Some(cmd);
+                }
+            }
+        }
+        if g.id == "fill_sign" {
+            widgets::section_title(ui, tl!("Sign yourself"));
+            if let Some(cmd) = crate::fill_sign::signature_entries(ui, app, t) {
+                run = Some(cmd);
+            }
+        }
+    });
+    if footer {
+        ui.add_space(8.0);
+        ui.horizontal(|ui| {
+            if marks > 0 {
+                ui.label(
+                    egui::RichText::new(if marks == 1 {
+                        crate::i18n::fmt(tl!("1 mark"), &[])
+                    } else {
+                        crate::i18n::fmt(tl!("{n} marks"), &[("n", &marks.to_string())])
+                    })
+                    .color(t.text_muted),
+                );
+            }
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if ui.add_enabled_ui(marks > 0, |ui| widgets::pill_button(ui, tl!("Redact all"), true)).inner.clicked() {
+                    run = Some("redact.apply");
+                }
+                if ui.add_enabled_ui(marks > 0, |ui| widgets::pill_button(ui, tl!("Clear all"), false)).inner.clicked() {
+                    run = Some("redact.clear");
+                }
+            });
+        });
+    }
+    if let Some(cmd) = run {
+        app.run_command(cmd);
+    }
+}
diff --git a/crates/ui-egui/src/persist.rs b/crates/ui-egui/src/persist.rs
new file mode 100644
index 0000000000..bb29efeff2
--- /dev/null
+++ b/crates/ui-egui/src/persist.rs
@@ -0,0 +1,6 @@
+pub mod last_session;
+pub mod last_view;
+pub(super) mod recovery;
+pub mod units;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod window_state;
diff --git a/crates/ui-egui/src/last_session.rs b/crates/ui-egui/src/persist/last_session.rs
similarity index 100%
rename from crates/ui-egui/src/last_session.rs
rename to crates/ui-egui/src/persist/last_session.rs
diff --git a/crates/ui-egui/src/last_view.rs b/crates/ui-egui/src/persist/last_view.rs
similarity index 100%
rename from crates/ui-egui/src/last_view.rs
rename to crates/ui-egui/src/persist/last_view.rs
diff --git a/crates/ui-egui/src/recovery.rs b/crates/ui-egui/src/persist/recovery.rs
similarity index 90%
rename from crates/ui-egui/src/recovery.rs
rename to crates/ui-egui/src/persist/recovery.rs
index 128e576043..71759c4599 100644
--- a/crates/ui-egui/src/recovery.rs
+++ b/crates/ui-egui/src/persist/recovery.rs
@@ -311,22 +311,32 @@ impl PdfCraftApp {
         }
     }
 
-    /// Autosave when the interval has passed (called every frame).
-    pub(crate) fn autosave_tick(&mut self, ctx: &egui::Context, now: f64) {
+    /// Autosave when the interval has passed (called by `logic`, which also runs while hidden).
+    ///
+    /// The deadline is monotonic (`web_time::Instant`): egui's input clock does not advance
+    /// during a hidden `run_logic`, so using it would stall autosave or restart its interval.
+    pub(crate) fn autosave_tick(&mut self, ctx: &egui::Context, now: web_time::Instant) {
         if self.recovery.is_none() {
             return;
         }
-        if now - self.last_autosave >= AUTOSAVE_SECS {
-            self.last_autosave = now;
+        // The first tick starts the interval, as the old zero clock did: it does not snapshot
+        // immediately just because no deadline had been recorded yet.
+        let Some(last) = self.last_autosave else {
+            self.last_autosave = Some(now);
+            if self.session.has_pending_autosave() {
+                ctx.request_repaint_after(std::time::Duration::from_secs_f64(AUTOSAVE_SECS));
+            }
+            return;
+        };
+        if now.duration_since(last).as_secs_f64() >= AUTOSAVE_SECS {
+            self.last_autosave = Some(now);
             self.autosave_now();
         }
         // An idle native window has no input-driven frames. Wake it at the existing
         // autosave deadline, without keeping clean or already-snapshotted documents awake.
         if self.session.has_pending_autosave() {
-            let remaining = (self.last_autosave + AUTOSAVE_SECS - now).clamp(0.0, AUTOSAVE_SECS);
-            if let Ok(delay) = std::time::Duration::try_from_secs_f64(remaining) {
-                ctx.request_repaint_after(delay);
-            }
+            let next = self.last_autosave.unwrap_or(now) + std::time::Duration::from_secs_f64(AUTOSAVE_SECS);
+            ctx.request_repaint_after(next.saturating_duration_since(now));
         }
     }
 
@@ -469,8 +479,8 @@ mod idle_tests {
         assert_eq!(distinct.len(), 200);
     }
 
-    fn frame(app: &mut PdfCraftApp, ctx: &egui::Context, now: f64) -> Duration {
-        let mut out = ctx.run_ui(egui::RawInput { time: Some(now), ..Default::default() }, |ui| {
+    fn frame(app: &mut PdfCraftApp, ctx: &egui::Context, now: web_time::Instant) -> Duration {
+        let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
             app.autosave_tick(ui.ctx(), now);
         });
         // Headless timer test: acknowledge texture uploads without a GPU backend.
@@ -478,6 +488,8 @@ mod idle_tests {
         out.viewport_output[&egui::ViewportId::ROOT].repaint_delay
     }
 
+    /// Check that an idle dirty document schedules a bounded write and autosaves without input, then stops
+    /// waking the window.
     #[test]
     fn idle_dirty_document_requests_its_deadline_and_writes_without_input() {
         let dir = TestDir::new();
@@ -487,22 +499,26 @@ mod idle_tests {
         let bytes = app.session.create_blank(200.0, 300.0, 1).unwrap();
         let id = app.session.open_new("Untitled.pdf", bytes).unwrap();
         let ctx = egui::Context::default();
+        let base = web_time::Instant::now();
+        frame(&mut app, &ctx, base);
         let mut delay = Duration::ZERO;
         for _ in 0..4 {
-            delay = frame(&mut app, &ctx, 15.0);
+            delay = frame(&mut app, &ctx, base + Duration::from_secs(15));
         }
         assert!(delay > Duration::ZERO && delay <= Duration::from_secs(45), "idle deadline: {delay:?}");
         assert!(store.list().is_empty());
-        frame(&mut app, &ctx, 60.0);
+        frame(&mut app, &ctx, base + Duration::from_secs(60));
         assert_eq!(store.list().len(), 1, "timer frame writes the snapshot without input");
         assert!(app.session.get(id).unwrap().dirty, "autosave does not mark the document saved");
         assert!(!app.session.has_pending_autosave());
         for _ in 0..4 {
-            delay = frame(&mut app, &ctx, 61.0);
+            delay = frame(&mut app, &ctx, base + Duration::from_secs(61));
         }
         assert_eq!(delay, Duration::MAX, "unchanged snapshot needs no periodic wake");
     }
 
+    /// Check that an edit after autosave schedules the next deadline, keeps the old snapshot until then, and
+    /// replaces it on time.
     #[test]
     fn second_edit_after_autosave_schedules_next_deadline_and_updates_snapshot() {
         let dir = TestDir::new();
@@ -512,7 +528,9 @@ mod idle_tests {
         let bytes = app.session.create_blank(200.0, 300.0, 1).unwrap();
         let id = app.session.open_new("Untitled.pdf", bytes).unwrap();
         let ctx = egui::Context::default();
-        frame(&mut app, &ctx, 60.0);
+        let base = web_time::Instant::now();
+        frame(&mut app, &ctx, base);
+        frame(&mut app, &ctx, base + Duration::from_secs(60));
         let entries = store.list();
         assert_eq!(entries.len(), 1);
         let key = entries[0].key.clone();
@@ -520,20 +538,20 @@ mod idle_tests {
         assert!(!app.session.has_pending_autosave());
         let mut delay = Duration::ZERO;
         for _ in 0..4 {
-            delay = frame(&mut app, &ctx, 61.0);
+            delay = frame(&mut app, &ctx, base + Duration::from_secs(61));
         }
         assert_eq!(delay, Duration::MAX);
 
         app.session.apply(id, pdfcraft_engine::Edit::SetInfo { key: "Title".into(), value: "Second edit".into() }).unwrap();
         assert!(app.session.has_pending_autosave());
         for _ in 0..4 {
-            delay = frame(&mut app, &ctx, 75.0);
+            delay = frame(&mut app, &ctx, base + Duration::from_secs(75));
         }
         assert!(delay > Duration::ZERO && delay <= Duration::from_secs(45), "second edit wakes by 120 seconds: {delay:?}");
         assert_eq!(store.read(&key).unwrap(), first, "editing does not overwrite the snapshot before its deadline");
-        frame(&mut app, &ctx, 119.0);
+        frame(&mut app, &ctx, base + Duration::from_secs(119));
         assert_eq!(store.read(&key).unwrap(), first);
-        frame(&mut app, &ctx, 120.0);
+        frame(&mut app, &ctx, base + Duration::from_secs(120));
         let entries = store.list();
         assert_eq!(entries.len(), 1, "the same document replaces its existing snapshot");
         assert_eq!(entries[0].key, key);
@@ -545,11 +563,12 @@ mod idle_tests {
         assert!(app.session.get(id).unwrap().dirty);
         assert!(!app.session.has_pending_autosave());
         for _ in 0..4 {
-            delay = frame(&mut app, &ctx, 121.0);
+            delay = frame(&mut app, &ctx, base + Duration::from_secs(121));
         }
         assert_eq!(delay, Duration::MAX, "the second snapshot also lets the window sleep");
     }
 
+    /// Check that a clean document and a document with recovery disabled never schedule an autosave.
     #[test]
     fn clean_documents_and_disabled_recovery_do_not_schedule_autosave() {
         for recovery_enabled in [false, true] {
@@ -565,9 +584,10 @@ mod idle_tests {
                 app.session.open_new("Unsaved.pdf", bytes).unwrap();
             }
             let ctx = egui::Context::default();
+            let base = web_time::Instant::now();
             let mut delay = Duration::ZERO;
             for _ in 0..4 {
-                delay = frame(&mut app, &ctx, 15.0);
+                delay = frame(&mut app, &ctx, base + Duration::from_secs(15));
             }
             assert_eq!(delay, Duration::MAX);
         }
diff --git a/crates/ui-egui/src/units.rs b/crates/ui-egui/src/persist/units.rs
similarity index 100%
rename from crates/ui-egui/src/units.rs
rename to crates/ui-egui/src/persist/units.rs
diff --git a/crates/ui-egui/src/window_state.rs b/crates/ui-egui/src/persist/window_state.rs
similarity index 100%
rename from crates/ui-egui/src/window_state.rs
rename to crates/ui-egui/src/persist/window_state.rs
diff --git a/crates/ui-egui/src/platform.rs b/crates/ui-egui/src/platform.rs
new file mode 100644
index 0000000000..129f622f52
--- /dev/null
+++ b/crates/ui-egui/src/platform.rs
@@ -0,0 +1,16 @@
+pub(super) mod drag_pointer;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod file_watch;
+#[cfg(target_os = "macos")]
+pub(super) mod macos_association;
+pub mod motion;
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) mod open_worker;
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) mod pickers;
+pub mod portable;
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) mod system_fonts;
+pub mod ui_scale;
+pub mod updates;
+pub mod window_controls;
diff --git a/crates/ui-egui/src/drag_pointer.rs b/crates/ui-egui/src/platform/drag_pointer.rs
similarity index 100%
rename from crates/ui-egui/src/drag_pointer.rs
rename to crates/ui-egui/src/platform/drag_pointer.rs
diff --git a/crates/ui-egui/src/file_watch.rs b/crates/ui-egui/src/platform/file_watch.rs
similarity index 100%
rename from crates/ui-egui/src/file_watch.rs
rename to crates/ui-egui/src/platform/file_watch.rs
diff --git a/crates/ui-egui/src/macos_association.rs b/crates/ui-egui/src/platform/macos_association.rs
similarity index 99%
rename from crates/ui-egui/src/macos_association.rs
rename to crates/ui-egui/src/platform/macos_association.rs
index e07d6496aa..2116481bd5 100644
--- a/crates/ui-egui/src/macos_association.rs
+++ b/crates/ui-egui/src/platform/macos_association.rs
@@ -354,7 +354,7 @@ mod tests {
         let captured: Vec<u8> =
             hex.as_bytes().as_chunks::<2>().0.iter().map(|pair| u8::from_str_radix(std::str::from_utf8(pair).unwrap(), 16).unwrap()).collect();
         assert!(points_to_this_app(&captured, Path::new("/Applications/PdfCraft.app")));
-        let package = plist::from_bytes::<plist::Value>(include_bytes!("../../../packaging/macos/Info.plist.in")).unwrap();
+        let package = plist::from_bytes::<plist::Value>(include_bytes!("../../../../packaging/macos/Info.plist.in")).unwrap();
         assert_eq!(package.as_dictionary().unwrap().get("CFBundleIdentifier").unwrap().as_string(), Some(BUNDLE_ID));
     }
 
diff --git a/crates/ui-egui/src/platform/motion.rs b/crates/ui-egui/src/platform/motion.rs
new file mode 100644
index 0000000000..92ca469da3
--- /dev/null
+++ b/crates/ui-egui/src/platform/motion.rs
@@ -0,0 +1,285 @@
+//! Animation effects, and the system's request to do without them.
+//!
+//! Windows' Settings ▸ Accessibility ▸ Visual effects ▸ Animation effects, turned off, asks
+//! apps not to animate (other systems have a Reduce motion switch for it). The desktop app
+//! reads the setting ([`MotionSource`]), and Preferences ▸ Animation effects
+//! ([`AnimationEffects`]) follows it unless the user chose On or Off there. With animation
+//! effects off, nothing in the window eases:
+//!
+//! - A wheel notch scrolls its whole distance in the frame it arrives. egui spreads a notch
+//!   over about a quarter of a second and has no switch for that, so each frame's wheel input
+//!   is read again here, the way egui reads it but for the easing ([`WheelReader`]), and handed
+//!   to egui's scroll areas in place of its own.
+//! - ⌘/Ctrl-wheel zooms by a notch's whole step at once: egui makes its zoom factor from the
+//!   same eased wheel motion. Views read [`zoom_delta`] instead of egui's.
+//! - Scrolling to a place (a row revealed by the keys, the Hand tool's drag) takes no time.
+//! - egui's other animations (menus fading in, sections opening) take no time: its style's
+//!   animation time is zero, which the app's own fades and sweeps ask about too ([`animated`]).
+//!
+//! How far anything scrolls or zooms doesn't change, only how long it takes.
+
+use egui::style::ScrollAnimation;
+use egui::{Event, Modifiers, MouseWheelUnit, TouchPhase, Vec2, vec2};
+
+/// Preferences ▸ Animation effects: whether anything in the window is animated, the wheel's
+/// scrolling and zooming included.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum AnimationEffects {
+    /// Animated unless the system asks for no animations ([`Motion::reduced`]).
+    #[default]
+    System,
+    On,
+    Off,
+}
+
+impl AnimationEffects {
+    pub const ALL: [Self; 3] = [Self::System, Self::On, Self::Off];
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::System => "Use system setting",
+            Self::On => "On",
+            Self::Off => "Off",
+        }
+    }
+
+    /// The name in saved settings and on the control channel.
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::System => "system",
+            Self::On => "on",
+            Self::Off => "off",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|choice| choice.name().eq_ignore_ascii_case(value))
+    }
+
+    /// Whether the window animates, given whether the system asks for no animations.
+    pub fn animates(self, system_reduced: bool) -> bool {
+        match self {
+            Self::System => !system_reduced,
+            Self::On => true,
+            Self::Off => false,
+        }
+    }
+}
+
+/// Asks the system whether it wants no animations; `None` when it can't say, which leaves the
+/// last answer standing. Asked from the UI thread every [`ASK_EVERY`] seconds while the window
+/// is in use, so it must answer at once.
+pub type MotionSource = Box<dyn Fn() -> Option<bool>>;
+
+/// Seconds between two questions to [`MotionSource`]. Changing the setting takes longer than
+/// this away from the window, so the first frame back already follows it.
+const ASK_EVERY: f64 = 2.0;
+
+/// What the system says about animations, and what it takes to stop egui's.
+pub struct Motion {
+    /// The system asks for no animations. The desktop app's [`Self::source`] sets it; false
+    /// elsewhere, so tests and screenshots don't depend on the machine.
+    pub reduced: bool,
+    /// How to ask the system (the desktop app sets it).
+    pub source: Option<MotionSource>,
+    /// egui time of the last question.
+    asked_at: f64,
+    /// egui's own animation time and scroll animation, kept while they are changed here.
+    egui_times: Option<(f32, ScrollAnimation)>,
+    wheel: WheelReader,
+    /// This frame's wheel motion, read on its first pass and reused on later passes.
+    ///
+    /// egui empties `RawInput` between the passes of a multi-pass frame, so reading the wheel
+    /// again in a later pass sees nothing. Only the first pass is handed the motion (a scroll
+    /// area keeps the offset it moved to, a view keeps the zoom it set); later passes are handed
+    /// no scroll and a unit zoom, explicitly.
+    frame: Option<(u64, WheelMotion)>,
+}
+
+impl Default for Motion {
+    /// Start motion handling with animations enabled and no desktop preference sampled yet.
+    fn default() -> Self {
+        Self { reduced: false, source: None, asked_at: f64::NEG_INFINITY, egui_times: None, wheel: WheelReader::default(), frame: None }
+    }
+}
+
+impl Motion {
+    /// Call once at the start of every pass, before any ui reads the wheel or draws.
+    pub(crate) fn begin_pass(&mut self, ctx: &egui::Context, effects: AnimationEffects) {
+        let now = ctx.input(|i| i.time);
+        // `>=` is false for a NaN time, which then never asks.
+        if now - self.asked_at >= ASK_EVERY
+            && let Some(source) = &self.source
+        {
+            self.asked_at = now;
+            if let Some(reduced) = source() {
+                self.reduced = reduced;
+            }
+        }
+        let animate = effects.animates(self.reduced);
+        self.sync_style(ctx, animate);
+        if animate {
+            // A gesture begun while easing is egui's to finish.
+            self.wheel = WheelReader::default();
+            self.frame = None;
+            return;
+        }
+        let options = ctx.options(|o| o.input_options);
+        // One frame may run several passes (`request_discard`). Only the first pass has this
+        // frame's events, and only it may hand the wheel on: a scroll area applies the delta to
+        // its persisted offset, and a view multiplies the zoom into its persisted zoom, so
+        // replaying either would apply it twice. egui also rebuilds `smooth_scroll_delta` and
+        // its zoom factor from its retained wheel state every pass, so later passes must be
+        // given zero scroll and a unit zoom explicitly. A missing zoom entry would not do: it
+        // would fall back to egui's rebuilt factor.
+        let frame = ctx.cumulative_frame_nr();
+        let first_pass = match self.frame {
+            Some((read_in, _)) => read_in != frame,
+            None => true,
+        };
+        let motion = match self.frame {
+            Some((read_in, motion)) if read_in == frame => motion,
+            _ => {
+                let motion = ctx.input(|i| self.wheel.read(&i.events, i.viewport_rect().height(), &options));
+                self.frame = Some((frame, motion));
+                motion
+            }
+        };
+        let (scroll, zoom) = if first_pass { (motion.scroll, motion.zoom) } else { (Vec2::ZERO, 1.0) };
+        ctx.input_mut(|i| i.smooth_scroll_delta = scroll);
+        let pass = ctx.cumulative_pass_nr();
+        ctx.data_mut(|d| d.insert_temp(zoom_id(), (pass, zoom)));
+        // Existing kinetic scrolling remains owned by egui; gating wheel input does not
+        // suppress a scroll area's per-pass advancement of retained velocity.
+    }
+
+    /// egui's animations, and its scrolling to a place, take no time unless the window is to
+    /// `animate`; then both get back the times egui had.
+    fn sync_style(&mut self, ctx: &egui::Context, animate: bool) {
+        if animate && self.egui_times.is_none() {
+            return;
+        }
+        // Checked every pass, so a style replaced since can't bring the animations back.
+        let style = ctx.global_style();
+        let egui_times = *self.egui_times.get_or_insert((style.animation_time, style.scroll_animation));
+        let wanted = if animate { egui_times } else { (0.0, ScrollAnimation::none()) };
+        if (style.animation_time, style.scroll_animation) != wanted {
+            ctx.all_styles_mut(|s| (s.animation_time, s.scroll_animation) = wanted);
+        }
+        if animate {
+            self.egui_times = None;
+        }
+    }
+}
+
+/// Whether the window animates this pass. The app's own fades and sweeps, which have their own
+/// durations, ask this; egui's animations stop by themselves ([`Motion::begin_pass`]).
+pub(crate) fn animated(ctx: &egui::Context) -> bool {
+    ctx.global_style().animation_time > 0.0
+}
+
+/// Return the stable egui id holding the last wheel-zoom input state.
+fn zoom_id() -> egui::Id {
+    egui::Id::unique("pdfcraft-motion-wheel-zoom")
+}
+
+/// This pass's zoom factor from a pinch or ⌘/Ctrl with the wheel (1.0 for none): egui's
+/// `zoom_delta`, without the easing while animation effects are off.
+pub(crate) fn zoom_delta(ctx: &egui::Context) -> f32 {
+    let read: Option<(u64, f32)> = ctx.data(|d| d.get_temp(zoom_id()));
+    let pass = ctx.cumulative_pass_nr();
+    ctx.input(|i| match read {
+        // Only what [`Motion::begin_pass`] read in this very pass: a factor left from an earlier
+        // one would zoom again every frame. Fingers on a touch screen are measured, never eased.
+        Some((at, zoom)) if at == pass && i.multi_touch().is_none() => zoom,
+        _ => i.zoom_delta(),
+    })
+}
+
+/// One pass's wheel input.
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct WheelMotion {
+    /// Points to scroll by, as `InputState::smooth_scroll_delta` gives them (positive moves the
+    /// content right and down).
+    scroll: Vec2,
+    /// The zoom factor from pinch events and ⌘/Ctrl with the wheel.
+    zoom: f32,
+}
+
+/// Reads wheel events as egui's `WheelState` does (egui 0.36, `input_state/wheel_state.rs`):
+/// the same units, modifiers and touch phases, but every step lands whole in its own pass,
+/// where egui keeps part of a coarse one for later passes. Compare the two when updating egui;
+/// `tests::reading_at_once_goes_as_far_as_egui_eases` fails if they come apart.
+#[derive(Default)]
+struct WheelReader {
+    /// The modifiers of the touch gesture in progress (`TouchPhase::Start` to `End`). They hold
+    /// for the whole gesture, as in egui: its momentum arrives after the keys are let go.
+    touch: Option<Modifiers>,
+}
+
+impl WheelReader {
+    /// `page_height` is what one `MouseWheelUnit::Page` scrolls: the window's height in points.
+    fn read(&mut self, events: &[Event], page_height: f32, options: &egui::InputOptions) -> WheelMotion {
+        let mut delta = Vec2::ZERO;
+        let mut zoom = 1.0_f32;
+        let mut modifiers = self.touch.unwrap_or_default();
+        for event in events {
+            match event {
+                Event::MouseWheel { unit, delta: step, phase, modifiers: latest, .. } => match phase {
+                    TouchPhase::Start => {
+                        self.touch = Some(*latest);
+                        modifiers = *latest;
+                    }
+                    TouchPhase::Move => {
+                        modifiers = match &mut self.touch {
+                            Some(held) => {
+                                *held |= *latest;
+                                *held
+                            }
+                            None => *latest,
+                        };
+                        let mut step = match unit {
+                            MouseWheelUnit::Point => *step,
+                            MouseWheelUnit::Line => options.line_scroll_speed * *step,
+                            MouseWheelUnit::Page => page_height * *step,
+                        };
+                        let horizontal = modifiers.matches_any(options.horizontal_scroll_modifier);
+                        let vertical = modifiers.matches_any(options.vertical_scroll_modifier);
+                        if horizontal && !vertical {
+                            step = vec2(step.x + step.y, 0.0);
+                        }
+                        if !horizontal && vertical {
+                            step = vec2(0.0, step.x + step.y);
+                        }
+                        // The system's numbers: one that isn't finite would end up in a scroll offset.
+                        if step.x.is_finite() && step.y.is_finite() {
+                            delta += step;
+                        }
+                    }
+                    // egui drops what the gesture moved earlier in the pass it ends in.
+                    TouchPhase::End | TouchPhase::Cancel => {
+                        self.touch = None;
+                        modifiers = Modifiers::NONE;
+                        delta = Vec2::ZERO;
+                    }
+                },
+                Event::Zoom(factor) => zoom *= *factor,
+                _ => {}
+            }
+        }
+        // A pass is all zoom or all scroll, by the modifiers it ends with, as in egui.
+        let mut scroll = delta;
+        if modifiers.matches_any(options.zoom_modifier) {
+            zoom *= (options.scroll_zoom_speed * (delta.x + delta.y)).exp();
+            scroll = Vec2::ZERO;
+        }
+        if !(zoom.is_finite() && zoom > 0.0) {
+            zoom = 1.0;
+        }
+        WheelMotion { scroll, zoom }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/platform/motion/tests.rs b/crates/ui-egui/src/platform/motion/tests.rs
new file mode 100644
index 0000000000..e2d44f2438
--- /dev/null
+++ b/crates/ui-egui/src/platform/motion/tests.rs
@@ -0,0 +1,383 @@
+use super::*;
+use std::cell::Cell;
+use std::rc::Rc;
+
+fn wheel(unit: MouseWheelUnit, delta: Vec2, phase: TouchPhase, modifiers: Modifiers) -> Event {
+    Event::MouseWheel { unit, delta, phase, modifiers, source: egui::MouseWheelSource::Unknown }
+}
+
+fn notch(dy: f32, modifiers: Modifiers) -> Event {
+    wheel(MouseWheelUnit::Line, vec2(0.0, dy), TouchPhase::Move, modifiers)
+}
+
+fn read(events: &[Event]) -> WheelMotion {
+    WheelReader::default().read(events, 600.0, &egui::InputOptions::default())
+}
+
+#[test]
+fn a_step_is_read_whole_in_its_units() {
+    let line = egui::InputOptions::default().line_scroll_speed;
+    assert_eq!(read(&[notch(-1.0, Modifiers::NONE)]), WheelMotion { scroll: vec2(0.0, -line), zoom: 1.0 });
+    assert_eq!(read(&[notch(-1.0, Modifiers::NONE), notch(-2.0, Modifiers::NONE)]).scroll, vec2(0.0, -3.0 * line), "steps of one pass add up");
+    let points = wheel(MouseWheelUnit::Point, vec2(3.0, -250.0), TouchPhase::Move, Modifiers::NONE);
+    assert_eq!(read(&[points]).scroll, vec2(3.0, -250.0));
+    let page = wheel(MouseWheelUnit::Page, vec2(0.0, -1.0), TouchPhase::Move, Modifiers::NONE);
+    assert_eq!(read(&[page]).scroll, vec2(0.0, -600.0));
+    assert_eq!(read(&[]), WheelMotion { scroll: Vec2::ZERO, zoom: 1.0 }, "and nothing is left for a later pass");
+}
+
+#[test]
+fn modifiers_turn_the_wheel_sideways_or_into_zoom() {
+    let line = egui::InputOptions::default().line_scroll_speed;
+    assert_eq!(read(&[notch(-1.0, Modifiers::SHIFT)]).scroll, vec2(-line, 0.0));
+    let sideways = wheel(MouseWheelUnit::Point, vec2(-30.0, 0.0), TouchPhase::Move, Modifiers::ALT);
+    assert_eq!(read(&[sideways]).scroll, vec2(0.0, -30.0));
+    let zoomed = read(&[notch(1.0, Modifiers::COMMAND)]);
+    assert_eq!(zoomed.scroll, Vec2::ZERO, "a zooming wheel doesn't scroll");
+    let step = (egui::InputOptions::default().scroll_zoom_speed * line).exp();
+    assert!((zoomed.zoom - step).abs() < 1e-6, "{zoomed:?}");
+    assert!((read(&[notch(-1.0, Modifiers::COMMAND)]).zoom - 1.0 / step).abs() < 1e-6);
+    assert!((read(&[Event::Zoom(1.5), Event::Zoom(2.0)]).zoom - 3.0).abs() < 1e-6, "pinch events multiply");
+}
+
+#[test]
+fn a_touch_gesture_keeps_its_modifiers_and_ends_clean() {
+    let mut reader = WheelReader::default();
+    let options = egui::InputOptions::default();
+    let point = |dy: f32, phase, modifiers| wheel(MouseWheelUnit::Point, vec2(0.0, dy), phase, modifiers);
+    // ⌘ held as the fingers land, let go before the momentum: still zooming.
+    let began = reader.read(&[point(0.0, TouchPhase::Start, Modifiers::COMMAND), point(20.0, TouchPhase::Move, Modifiers::COMMAND)], 600.0, &options);
+    assert!(began.zoom > 1.0 && began.scroll == Vec2::ZERO, "{began:?}");
+    let momentum = reader.read(&[point(20.0, TouchPhase::Move, Modifiers::NONE)], 600.0, &options);
+    assert!(momentum.zoom > 1.0 && momentum.scroll == Vec2::ZERO, "{momentum:?}");
+    // The pass it ends in moves nothing, and the next gesture starts without the modifier.
+    let ended = reader.read(&[point(20.0, TouchPhase::Move, Modifiers::NONE), point(0.0, TouchPhase::End, Modifiers::NONE)], 600.0, &options);
+    assert_eq!(ended, WheelMotion { scroll: Vec2::ZERO, zoom: 1.0 });
+    assert_eq!(reader.read(&[point(-20.0, TouchPhase::Move, Modifiers::NONE)], 600.0, &options).scroll, vec2(0.0, -20.0));
+}
+
+#[test]
+fn numbers_that_are_not_finite_move_nothing() {
+    for bad in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+        let scrolled = read(&[notch(bad, Modifiers::NONE), notch(-1.0, Modifiers::NONE)]);
+        assert!(scrolled.scroll.x.is_finite() && scrolled.scroll.y.is_finite(), "{bad}: {scrolled:?}");
+        assert_eq!(read(&[notch(bad, Modifiers::COMMAND)]).zoom, 1.0, "{bad}");
+        assert_eq!(read(&[Event::Zoom(bad)]).zoom, 1.0, "{bad}");
+    }
+    assert_eq!(read(&[Event::Zoom(0.0)]).zoom, 1.0);
+    assert_eq!(read(&[Event::Zoom(-2.0)]).zoom, 1.0);
+    // Too far to be a factor at all.
+    assert_eq!(read(&[notch(1.0e9, Modifiers::COMMAND)]).zoom, 1.0);
+}
+
+/// One pass of a bare egui context, a sixtieth of a second after the last.
+fn pass(ctx: &egui::Context, time: &mut f64, events: Vec<Event>, mut seen: impl FnMut(&egui::Context)) {
+    *time += 1.0 / 60.0;
+    let raw = egui::RawInput { time: Some(*time), events, ..Default::default() };
+    // A bare context's first frame uploads the font atlas; nothing paints it here.
+    ctx.run_ui(raw, |ui| seen(ui.ctx())).textures_delta.clear();
+}
+
+/// The reader must stay egui's own reading minus the easing: over the passes egui takes to
+/// ease a step, it hands out as much scroll (and as much zoom) as the reader does at once.
+#[test]
+fn reading_at_once_goes_as_far_as_egui_eases() {
+    let options = egui::InputOptions::default();
+    for (modifiers, unit, step) in [
+        (Modifiers::NONE, MouseWheelUnit::Line, vec2(0.0, -3.0)),
+        (Modifiers::NONE, MouseWheelUnit::Point, vec2(40.0, -250.0)),
+        (Modifiers::SHIFT, MouseWheelUnit::Line, vec2(0.0, 2.0)),
+        (Modifiers::COMMAND, MouseWheelUnit::Line, vec2(0.0, 1.0)),
+        (Modifiers::COMMAND, MouseWheelUnit::Point, vec2(0.0, -90.0)),
+    ] {
+        let event = wheel(unit, step, TouchPhase::Move, modifiers);
+        let ctx = egui::Context::default();
+        let (mut time, mut scrolled, mut zoomed, mut first) = (0.0, Vec2::ZERO, 1.0_f32, None);
+        let mut events = vec![event.clone()];
+        for _ in 0..120 {
+            pass(&ctx, &mut time, std::mem::take(&mut events), |ctx| {
+                let (scroll, zoom) = ctx.input(|i| (i.smooth_scroll_delta, i.zoom_delta()));
+                first.get_or_insert((scroll, zoom));
+                scrolled += scroll;
+                zoomed *= zoom;
+            });
+        }
+        let page_height = ctx.input(|i| i.viewport_rect().height());
+        let at_once = WheelReader::default().read(&[event], page_height, &options);
+        assert!((scrolled - at_once.scroll).length() < 0.01, "{modifiers:?} {unit:?}: egui scrolled {scrolled:?}, read {:?}", at_once.scroll);
+        assert!((zoomed / at_once.zoom - 1.0).abs() < 1e-3, "{modifiers:?} {unit:?}: egui zoomed {zoomed}, read {}", at_once.zoom);
+        // What makes the reader necessary: egui's first pass holds part of the step back.
+        let first = first.expect("passes ran");
+        assert!(
+            first != (at_once.scroll, at_once.zoom),
+            "{modifiers:?} {unit:?}: egui no longer eases this step ({first:?}); the reader may not be needed"
+        );
+    }
+}
+
+#[test]
+fn reduced_motion_hands_egui_the_whole_step_and_stops_its_animations() {
+    let ctx = egui::Context::default();
+    let mut motion = Motion { reduced: true, ..Default::default() };
+    let line = egui::InputOptions::default().line_scroll_speed;
+    let mut time = 0.0;
+    let mut seen = Vec::new();
+    let mut events = vec![notch(-1.0, Modifiers::NONE)];
+    for _ in 0..30 {
+        pass(&ctx, &mut time, std::mem::take(&mut events), |ctx| {
+            motion.begin_pass(ctx, AnimationEffects::System);
+            seen.push(ctx.input(|i| i.smooth_scroll_delta));
+        });
+    }
+    assert_eq!(seen.first(), Some(&vec2(0.0, -line)), "the whole notch in the pass it arrives");
+    assert!(seen.iter().skip(1).all(|d| *d == Vec2::ZERO), "and none of egui's easing after it: {seen:?}");
+    let style = ctx.global_style();
+    assert_eq!((style.animation_time, style.scroll_animation), (0.0, egui::style::ScrollAnimation::none()));
+    for theme in [egui::Theme::Light, egui::Theme::Dark] {
+        assert_eq!(ctx.style_of(theme).animation_time, 0.0, "{theme:?}");
+    }
+
+    // ⌘/Ctrl with the wheel: the whole zoom step at once, then nothing.
+    let step = (egui::InputOptions::default().scroll_zoom_speed * line).exp();
+    let mut zooms = Vec::new();
+    let mut events = vec![notch(1.0, Modifiers::COMMAND)];
+    for _ in 0..30 {
+        pass(&ctx, &mut time, std::mem::take(&mut events), |ctx| {
+            motion.begin_pass(ctx, AnimationEffects::System);
+            zooms.push(zoom_delta(ctx));
+        });
+    }
+    assert!((zooms[0] - step).abs() < 1e-6, "{zooms:?}");
+    assert!(zooms.iter().skip(1).all(|z| *z == 1.0), "{zooms:?}");
+
+    // Animations allowed again: egui's own values and its own times.
+    motion.reduced = false;
+    let mut eased = Vec::new();
+    let mut events = vec![notch(1.0, Modifiers::COMMAND)];
+    for _ in 0..3 {
+        pass(&ctx, &mut time, std::mem::take(&mut events), |ctx| {
+            motion.begin_pass(ctx, AnimationEffects::System);
+            eased.push((zoom_delta(ctx), ctx.input(|i| i.zoom_delta())));
+        });
+    }
+    assert!(eased.iter().all(|(ours, eguis)| ours == eguis), "{eased:?}");
+    assert!(eased[0].0 > 1.0 && eased[0].0 < step, "egui eases the step: {eased:?}");
+    let (style, default) = (ctx.global_style(), egui::Style::default());
+    assert_eq!((style.animation_time, style.scroll_animation), (default.animation_time, default.scroll_animation));
+}
+
+#[test]
+fn the_preference_overrides_the_system_for_every_animation() {
+    use AnimationEffects::{Off, On, System};
+    assert_eq!(AnimationEffects::default(), System, "the system's setting is followed unless the user chooses");
+    for choice in AnimationEffects::ALL {
+        assert_eq!(AnimationEffects::parse(choice.name()), Some(choice));
+    }
+    assert_eq!((AnimationEffects::parse("OFF"), AnimationEffects::parse("smooth")), (Some(Off), None));
+    let (line, egui_default) = (egui::InputOptions::default().line_scroll_speed, egui::Style::default());
+    let egui_times = (egui_default.animation_time, egui_default.scroll_animation);
+    // The system's answer, the choice, and whether the window then animates.
+    for (reduced, effects, animates) in
+        [(false, System, true), (true, System, false), (false, On, true), (true, On, true), (false, Off, false), (true, Off, false)]
+    {
+        assert_eq!(effects.animates(reduced), animates, "{effects:?}, system reduced: {reduced}");
+        let ctx = egui::Context::default();
+        let mut motion = Motion { reduced, ..Default::default() };
+        let (mut time, mut first) = (0.0, None);
+        pass(&ctx, &mut time, vec![notch(-1.0, Modifiers::NONE)], |ctx| {
+            motion.begin_pass(ctx, effects);
+            first = Some((ctx.input(|i| i.smooth_scroll_delta), animated(ctx)));
+        });
+        // The wheel, egui's animations and the app's own fades all go the same way.
+        let whole_notch = first.map(|(scroll, _)| scroll) == Some(vec2(0.0, -line));
+        assert_eq!(
+            (whole_notch, first.map(|(_, animated)| animated)),
+            (!animates, Some(animates)),
+            "{effects:?}, system reduced: {reduced}: {first:?}"
+        );
+        let style = ctx.global_style();
+        let times = if animates { egui_times } else { (0.0, ScrollAnimation::none()) };
+        assert_eq!((style.animation_time, style.scroll_animation), times, "{effects:?}, system reduced: {reduced}");
+    }
+    // A choice made while running applies from the next pass, and choosing back undoes it.
+    let ctx = egui::Context::default();
+    let mut motion = Motion::default();
+    let mut time = 0.0;
+    for (effects, times) in [(Off, (0.0, ScrollAnimation::none())), (System, egui_times), (Off, (0.0, ScrollAnimation::none())), (On, egui_times)] {
+        pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, effects));
+        let style = ctx.global_style();
+        assert_eq!((style.animation_time, style.scroll_animation), times, "{effects:?}");
+    }
+}
+
+/// The chrome's hover wash has a duration of its own (`theme::Press`): it eases in with
+/// animation effects on and is simply there with them off.
+#[test]
+fn the_hover_wash_eases_only_with_animation_effects_on() {
+    for (effects, eased) in [(AnimationEffects::On, true), (AnimationEffects::Off, false)] {
+        let ctx = egui::Context::default();
+        let mut motion = Motion::default();
+        let (mut time, mut hover) = (0.0, Vec::new());
+        for _ in 0..12 {
+            time += 1.0 / 60.0;
+            let raw = egui::RawInput { time: Some(time), events: vec![Event::PointerMoved(egui::pos2(20.0, 20.0))], ..Default::default() };
+            ctx.run_ui(raw, |ui| {
+                motion.begin_pass(ui.ctx(), effects);
+                let (_, response) = ui.allocate_exact_size(vec2(100.0, 40.0), egui::Sense::click());
+                hover.push(crate::theme::Press::track(ui, &response).hover);
+            })
+            .textures_delta
+            .clear();
+        }
+        // The first frame the pointer is found over the control.
+        let first = hover.iter().copied().find(|amount| *amount > 0.0).expect("the pointer is over the control");
+        assert_eq!(first < 1.0, eased, "{effects:?}: {hover:?}");
+        assert_eq!(hover.last(), Some(&1.0), "{effects:?}: the wash is whole in the end either way: {hover:?}");
+    }
+}
+
+#[test]
+fn a_zoom_read_in_an_earlier_pass_is_never_used_again() {
+    let ctx = egui::Context::default();
+    let mut motion = Motion { reduced: true, ..Default::default() };
+    let mut time = 0.0;
+    pass(&ctx, &mut time, vec![notch(1.0, Modifiers::COMMAND)], |ctx| {
+        motion.begin_pass(ctx, AnimationEffects::System);
+        assert!(zoom_delta(ctx) > 1.0);
+    });
+    // A pass that didn't begin here (a host that draws without `logic`): egui's own answer.
+    pass(&ctx, &mut time, Vec::new(), |ctx| {
+        let eguis = ctx.input(|i| i.zoom_delta());
+        assert_eq!(zoom_delta(ctx), eguis);
+    });
+}
+
+/// With animation effects off, a real scroll area moves by one wheel step whether the frame
+/// runs one pass or two (a `request_discard` from a sizing pass): the scroll area already
+/// applied and stored the step in the first pass, so a later pass must not apply it again,
+/// and must not replay the frame's raw wheel events either.
+#[test]
+fn two_pass_scroll_area_applies_one_wheel_step_like_a_single_pass() {
+    fn run(two_passes: bool) -> (Vec<Vec2>, Vec<usize>) {
+        let ctx = egui::Context::default();
+        let mut motion = Motion { reduced: true, ..Default::default() };
+        let mut offsets = Vec::new();
+        let mut wheel_events = Vec::new();
+        let raw = egui::RawInput {
+            time: Some(0.1),
+            screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(300.0, 300.0))),
+            events: vec![egui::Event::PointerMoved(egui::pos2(50.0, 50.0)), notch(-1.0, Modifiers::NONE)],
+            ..Default::default()
+        };
+        let output = ctx.run_ui(raw, |ui| {
+            motion.begin_pass(ui.ctx(), AnimationEffects::System);
+            wheel_events.push(ui.input(|i| i.events.iter().filter(|e| matches!(e, egui::Event::MouseWheel { .. })).count()));
+            // Taller than the 300-point viewport, so one step stays far from the scroll
+            // limit and a doubled step could not be hidden by clamping.
+            let out = egui::ScrollArea::vertical().id_salt("motion-two-pass-scroll").auto_shrink([false, false]).show(ui, |ui| {
+                ui.set_min_size(egui::vec2(100.0, 3000.0));
+            });
+            offsets.push(out.state.unclamped_offset());
+            if two_passes && ui.ctx().current_pass_index() == 0 {
+                ui.ctx().request_discard("motion two-pass scroll regression");
+            }
+        });
+        output.drop_without_applying_deltas();
+        (offsets, wheel_events)
+    }
+
+    let (single, single_events) = run(false);
+    let (two, two_events) = run(true);
+
+    assert_eq!(single.len(), 1, "one frame, one pass");
+    assert_eq!(two.len(), 2, "the frame really ran two passes");
+    assert_eq!(single_events, vec![1], "one wheel event reaches the first pass");
+    assert_eq!(two_events, vec![1, 0], "raw wheel events are not replayed in the later pass");
+
+    let step = single[0].y;
+    assert!(step > 0.0, "the wheel step scrolled: {single:?}");
+    assert!((two[0].y - step).abs() < 0.01, "the first pass applies the whole step: single={step}, two-pass={two:?}");
+    assert!((two[1].y - step).abs() < 0.01, "the presented pass must not apply the same step again: single={step}, two-pass={two:?}");
+}
+
+/// With animation effects off, ctrl/⌘-wheel and pinch zoom reach a view's persisted zoom
+/// once, whether the frame runs one pass or two (a `request_discard` from a sizing pass):
+/// multiplying an accumulator by each pass's factor gives the single step either way. A
+/// later pass gets a unit factor explicitly, and a frame with no wheel input resets to it.
+#[test]
+fn two_pass_zoom_applies_one_step_like_a_single_pass() {
+    /// One frame's `zoom_delta` readings, one per pass.
+    fn frame(ctx: &egui::Context, motion: &mut Motion, time: f64, events: Vec<Event>, two_passes: bool) -> Vec<f32> {
+        let raw = egui::RawInput {
+            time: Some(time),
+            screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(300.0, 300.0))),
+            events,
+            ..Default::default()
+        };
+        let mut zooms = Vec::new();
+        let output = ctx.run_ui(raw, |ui| {
+            motion.begin_pass(ui.ctx(), AnimationEffects::System);
+            zooms.push(zoom_delta(ui.ctx()));
+            if two_passes && ui.ctx().current_pass_index() == 0 {
+                ui.ctx().request_discard("motion two-pass zoom regression");
+            }
+        });
+        output.drop_without_applying_deltas();
+        zooms
+    }
+
+    let line = egui::InputOptions::default().line_scroll_speed;
+    let ctrl_step = (egui::InputOptions::default().scroll_zoom_speed * line).exp();
+    for (name, events, step) in [("ctrl-wheel", vec![notch(1.0, Modifiers::COMMAND)], ctrl_step), ("pinch", vec![Event::Zoom(1.5)], 1.5)] {
+        assert!((step - 1.0).abs() > 0.01, "{name}: the factor is nontrivial: {step}");
+        let single = {
+            let ctx = egui::Context::default();
+            let mut motion = Motion { reduced: true, ..Default::default() };
+            frame(&ctx, &mut motion, 0.1, events.clone(), false)
+        };
+        let ctx = egui::Context::default();
+        let mut motion = Motion { reduced: true, ..Default::default() };
+        let two = frame(&ctx, &mut motion, 0.1, events, true);
+        assert_eq!(single.len(), 1, "{name}: one frame, one pass: {single:?}");
+        assert_eq!(two.len(), 2, "{name}: the frame really ran two passes: {two:?}");
+        let product = |zooms: &[f32]| zooms.iter().product::<f32>();
+        assert!((product(&single) - step).abs() < 1e-5, "{name}: one pass applies the step: {single:?}");
+        assert!((product(&two) - step).abs() < 1e-5, "{name}: two passes apply it once: {two:?}");
+        assert!((two[1] - 1.0).abs() < 1e-6, "{name}: a later pass zooms by nothing: {two:?}");
+        // The next frame's wheel reading starts over; the two-pass frame's factor is gone.
+        let after = frame(&ctx, &mut motion, 0.1 + 1.0 / 60.0, Vec::new(), false);
+        assert_eq!(after, vec![1.0], "{name}: the cached factor does not survive the frame");
+    }
+}
+
+#[test]
+fn the_system_is_asked_now_and_then_and_no_answer_changes_nothing() {
+    let ctx = egui::Context::default();
+    let answer = Rc::new(Cell::new(Some(true)));
+    let asked = Rc::new(Cell::new(0_u32));
+    let (source_answer, source_asked) = (Rc::clone(&answer), Rc::clone(&asked));
+    let mut motion = Motion {
+        source: Some(Box::new(move || {
+            source_asked.set(source_asked.get() + 1);
+            source_answer.get()
+        })),
+        ..Default::default()
+    };
+    let mut time = 0.0;
+    pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, AnimationEffects::System));
+    assert!(motion.reduced, "asked in the first pass");
+    answer.set(Some(false));
+    for _ in 0..30 {
+        pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, AnimationEffects::System));
+    }
+    assert!(motion.reduced && asked.get() == 1, "not asked again within half a second ({} times)", asked.get());
+    // Back at the window later: the first pass asks.
+    time += ASK_EVERY;
+    pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, AnimationEffects::System));
+    assert!(!motion.reduced);
+    answer.set(None);
+    motion.reduced = true;
+    time += ASK_EVERY;
+    pass(&ctx, &mut time, Vec::new(), |ctx| motion.begin_pass(ctx, AnimationEffects::System));
+    assert!(motion.reduced && asked.get() == 3, "no answer leaves the last one standing");
+}
diff --git a/crates/ui-egui/src/open_worker.rs b/crates/ui-egui/src/platform/open_worker.rs
similarity index 99%
rename from crates/ui-egui/src/open_worker.rs
rename to crates/ui-egui/src/platform/open_worker.rs
index 04bd1fefe5..fe564db398 100644
--- a/crates/ui-egui/src/open_worker.rs
+++ b/crates/ui-egui/src/platform/open_worker.rs
@@ -206,3 +206,6 @@ pub(crate) fn prepare_gate() -> (Arc<PrepareGate>, Receiver<()>, Sender<()>, Rec
     let (finished, finished_rx) = mpsc::channel();
     (Arc::new(PrepareGate { started, release: Mutex::new(release), finished }), started_rx, release_tx, finished_rx)
 }
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod tests;
diff --git a/crates/ui-egui/src/open_worker_tests.rs b/crates/ui-egui/src/platform/open_worker/tests.rs
similarity index 100%
rename from crates/ui-egui/src/open_worker_tests.rs
rename to crates/ui-egui/src/platform/open_worker/tests.rs
diff --git a/crates/ui-egui/src/pickers.rs b/crates/ui-egui/src/platform/pickers.rs
similarity index 100%
rename from crates/ui-egui/src/pickers.rs
rename to crates/ui-egui/src/platform/pickers.rs
diff --git a/crates/ui-egui/src/portable.rs b/crates/ui-egui/src/platform/portable.rs
similarity index 100%
rename from crates/ui-egui/src/portable.rs
rename to crates/ui-egui/src/platform/portable.rs
diff --git a/crates/ui-egui/src/system_fonts.rs b/crates/ui-egui/src/platform/system_fonts.rs
similarity index 97%
rename from crates/ui-egui/src/system_fonts.rs
rename to crates/ui-egui/src/platform/system_fonts.rs
index 383dc1e7a9..4b5e1eca7a 100644
--- a/crates/ui-egui/src/system_fonts.rs
+++ b/crates/ui-egui/src/platform/system_fonts.rs
@@ -472,7 +472,7 @@ mod tests {
     #[test]
     fn a_face_without_the_probe_is_rejected() {
         // Inter is Latin, Greek and Cyrillic only.
-        let inter = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
+        let inter = include_bytes!("../../../../assets/fonts/Inter-Regular.ttf");
         assert_eq!(face_with(inter, PROBE), None);
         assert_eq!(face_with(inter, HANS_PROBE), None);
         assert_eq!(face_with(inter, HANT_PROBE), None);
@@ -503,6 +503,8 @@ mod tests {
         std::env::var_os("PDFCRAFT_SYSTEM_FONTS").is_some_and(|v| v == "0")
     }
 
+    /// Check that the first readable fallback candidate wins, so reversing the preference list reverses the
+    /// chosen face.
     #[test]
     fn the_first_readable_candidate_wins_not_the_last() {
         // List order *is* the preference, so a loader that scanned back-to-front would pick a
@@ -517,9 +519,9 @@ mod tests {
         let size = |p: &Path| std::fs::metadata(p).expect("bundled face").len();
         assert_ne!(size(&inter), size(&mono), "the two fixtures must be tellable apart");
         let first = script_fallback(&[inter.clone(), mono.clone()], 'A').expect("Inter covers 'A'");
-        assert_eq!(first.font.len() as u64, size(&inter), "the first readable candidate must win");
+        assert_eq!(first.bytes().len() as u64, size(&inter), "the first readable candidate must win");
         let reversed = script_fallback(&[mono.clone(), inter], 'A').expect("JetBrains Mono covers 'A'");
-        assert_eq!(reversed.font.len() as u64, size(&mono), "reversing the list must reverse the pick");
+        assert_eq!(reversed.bytes().len() as u64, size(&mono), "reversing the list must reverse the pick");
     }
 
     #[test]
@@ -559,7 +561,7 @@ mod tests {
             assert!(path.extension().is_some_and(|e| e == "ttf" || e == "ttc"), "{path:?}");
         }
         // Inter has no Hangul.
-        let inter = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
+        let inter = include_bytes!("../../../../assets/fonts/Inter-Regular.ttf");
         assert_eq!(face_with(inter, HANGUL_PROBE), None);
     }
 
@@ -610,7 +612,7 @@ mod tests {
         std::fs::create_dir_all(&supplemental).expect("build a temp macOS-shaped font tree");
         let dirs = [root.to_string_lossy().to_string(), supplemental.to_string_lossy().to_string()];
         let names: Vec<&str> = dirs.iter().map(|d| d.as_str()).collect();
-        let inter: &[u8] = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
+        let inter: &[u8] = include_bytes!("../../../../assets/fonts/Inter-Regular.ttf");
         let spaced = "Devanagari Sangam MN.ttc";
         std::fs::write(supplemental.join(spaced), inter).expect("place a face at the spaced path");
         let found = macos_families_in(&names, &[spaced]).iter().any(|p| read(p, 'A', MAX_BYTES).is_some());
@@ -663,7 +665,7 @@ mod tests {
         // them, as this list produces.
         let direct = script_fallback(&devanagari_candidates(), DEVANAGARI_PROBE).expect("the list above resolves");
         let cached = devanagari_fallback().expect("devanagari_fallback() resolves where these faces are installed");
-        assert_eq!(cached.font.len(), direct.font.len(), "devanagari_fallback() must load the face this list points at, not another script's");
+        assert_eq!(cached.bytes().len(), direct.bytes().len(), "devanagari_fallback() must load the face this list points at, not another script's");
         assert_eq!(cached.index, direct.index, "and the same face within that file");
         // The advertised last resort is the biggest file on the list and reaches its target through
         // a compatibility symlink in `/Library/Fonts`, a folder installers and users may modify — so
diff --git a/crates/ui-egui/src/system_fonts/fontconfig.rs b/crates/ui-egui/src/platform/system_fonts/fontconfig.rs
similarity index 99%
rename from crates/ui-egui/src/system_fonts/fontconfig.rs
rename to crates/ui-egui/src/platform/system_fonts/fontconfig.rs
index dbec74eaea..243fec68da 100644
--- a/crates/ui-egui/src/system_fonts/fontconfig.rs
+++ b/crates/ui-egui/src/platform/system_fonts/fontconfig.rs
@@ -160,7 +160,7 @@ mod tests {
         fn isolated(&self, test: &str) {
             // Environment selection is process-global: never mutate it in a parallel harness.
             let output = std::process::Command::new(std::env::current_exe().unwrap())
-                .args(["--exact", &format!("system_fonts::fontconfig::tests::{test}"), "--nocapture"])
+                .args(["--exact", &format!("platform::system_fonts::fontconfig::tests::{test}"), "--nocapture"])
                 .env("FONTCONFIG_PATH", &self.0)
                 .env("FONTCONFIG_FILE", "fonts.conf")
                 .env("PDFCRAFT_FONTCONFIG_TEST_ROOT", &self.0)
diff --git a/crates/ui-egui/src/ui_scale.rs b/crates/ui-egui/src/platform/ui_scale.rs
similarity index 100%
rename from crates/ui-egui/src/ui_scale.rs
rename to crates/ui-egui/src/platform/ui_scale.rs
diff --git a/crates/ui-egui/src/platform/updates.rs b/crates/ui-egui/src/platform/updates.rs
new file mode 100644
index 0000000000..fa59f9a89f
--- /dev/null
+++ b/crates/ui-egui/src/platform/updates.rs
@@ -0,0 +1,161 @@
+//! Help ▸ Check for updates and the check at start, through `craft_update`: the flow itself is its
+//! `Updater`; this module supplies the suite, the quit path and the status dialog.
+
+#[cfg(not(target_arch = "wasm32"))]
+use craft_update::updater::{Action, CheckSource, Status, Updater};
+use egui::{Align, Layout};
+
+use crate::{PdfCraftApp, theme, widgets};
+
+/// Where every PdfCraft release is listed.
+pub const RELEASES_PAGE: &str = "https://github.com/storytold/pdfcraft/releases";
+
+/// Stands in for the network in tests.
+#[cfg(not(target_arch = "wasm32"))]
+pub type UpdateSource = CheckSource;
+
+pub(crate) struct Updates {
+    #[cfg(not(target_arch = "wasm32"))]
+    updater: Updater,
+    /// The Updates dialog is showing.
+    pub(crate) open: bool,
+    /// Ask for a newer release at start; the desktop app turns it on, so tests never reach the network.
+    #[cfg(not(target_arch = "wasm32"))]
+    startup_check: bool,
+    #[cfg(not(target_arch = "wasm32"))]
+    check_requested: bool,
+}
+
+impl Default for Updates {
+    fn default() -> Self {
+        Self {
+            #[cfg(not(target_arch = "wasm32"))]
+            updater: Updater::new(&craft_update::suite::PDFCRAFT, env!("CARGO_PKG_VERSION")),
+            open: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            startup_check: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            check_requested: false,
+        }
+    }
+}
+
+impl PdfCraftApp {
+    /// Whether the app asks for a newer release on its first frame (off until the desktop app turns it on).
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn set_startup_update_check(&mut self, on: bool) {
+        self.updates.startup_check = on;
+    }
+
+    /// Replaces the network with `source` (tests).
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn set_update_source(&mut self, source: UpdateSource) {
+        self.updates.updater = Updater::new(&craft_update::suite::PDFCRAFT, env!("CARGO_PKG_VERSION")).with_source(source);
+    }
+
+    /// Help ▸ Check for updates: ask for the latest release and show the outcome.
+    pub fn check_for_updates(&mut self) {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            self.updates.open = true;
+            self.updates.check_requested = true;
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            self.open_url(RELEASES_PAGE);
+        }
+    }
+
+    /// Starts the checks and picks up their answers (each frame).
+    pub(crate) fn poll_updates(&mut self) {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let Some(ctx) = self.ctx.clone() else { return };
+            let updates = &mut self.updates;
+            if std::mem::take(&mut updates.check_requested) {
+                updates.updater.check_now(&ctx);
+            } else if updates.startup_check {
+                updates.updater.check_at_start(&ctx);
+            }
+            updates.updater.tick(&ctx);
+        }
+    }
+}
+
+/// The startup prompt, and the Updates dialog that answers Help ▸ Check for updates.
+pub(crate) fn dialog(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        // The restart helper is scheduled before the app closes, so no update starts over unsaved work.
+        let clean = app.first_dirty().is_none();
+        match app.updates.updater.show_if(ctx, clean) {
+            Action::None => {}
+            Action::OpenUrl(url) => app.open_url(&url),
+            Action::Close => {
+                app.request_quit(ctx);
+            }
+        }
+        // A requested check that found a release is answered by the prompt, not by this dialog.
+        if app.updates.open && !app.updates.check_requested && matches!(app.updates.updater.status(), Status::Idle) {
+            app.updates.open = false;
+        }
+    }
+    if !app.updates.open {
+        return;
+    }
+    let t = theme::Tokens::get(ctx);
+    let current = env!("CARGO_PKG_VERSION");
+    let mut close = false;
+    let modal = crate::widgets::show_modal(ctx, "updates", |ui| {
+        ui.set_width(420.0);
+        ui.horizontal(|ui| {
+            ui.add(crate::icons::image("cloud", 22.0, t.accent));
+            ui.label(egui::RichText::new(tl!("Check for updates")).font(theme::semibold(16.0)));
+        });
+        ui.add_space(8.0);
+        #[cfg(not(target_arch = "wasm32"))]
+        match app.updates.updater.status() {
+            Status::Idle => {
+                ui.horizontal(|ui| {
+                    ui.spinner();
+                    ui.label(tl!("Checking for a newer version…"));
+                });
+            }
+            Status::Checking => {
+                ui.horizontal(|ui| {
+                    ui.spinner();
+                    ui.label(tl!("Checking for a newer version…"));
+                });
+            }
+            Status::UpToDate => {
+                ui.label(crate::i18n::fmt(tl!("PdfCraft {c} is up to date."), &[("c", current)]));
+            }
+            Status::Failed(e) => {
+                ui.label(crate::i18n::fmt(tl!("Couldn't check for updates: {e}"), &[("e", e)]));
+                ui.label(
+                    egui::RichText::new(crate::i18n::fmt(
+                        tl!("You have version {c}. All releases are listed at {page}."),
+                        &[("c", current), ("page", RELEASES_PAGE)],
+                    ))
+                    .color(t.text_muted),
+                );
+            }
+        }
+        #[cfg(target_arch = "wasm32")]
+        let _ = (&t, current);
+        ui.add_space(10.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("Close"), true).clicked() {
+                close = true;
+            }
+        });
+    });
+    if modal.should_close() {
+        close = true;
+    }
+    if close {
+        app.updates.open = false;
+        #[cfg(not(target_arch = "wasm32"))]
+        app.updates.updater.dismiss_status();
+    }
+}
diff --git a/crates/ui-egui/src/window_controls.rs b/crates/ui-egui/src/platform/window_controls.rs
similarity index 82%
rename from crates/ui-egui/src/window_controls.rs
rename to crates/ui-egui/src/platform/window_controls.rs
index d02ea5dc8c..9965d46ec1 100644
--- a/crates/ui-egui/src/window_controls.rs
+++ b/crates/ui-egui/src/platform/window_controls.rs
@@ -96,7 +96,7 @@ pub fn buttons(ui: &mut egui::Ui, buttons: &[Button]) {
             Button::Close => tl!("Close"),
         };
         let (rect, response) = ui.allocate_exact_size(Vec2::splat(BUTTON), Sense::click());
-        response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label));
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label));
         let response = response.on_hover_text(label);
         if ui.is_rect_visible(rect) {
             paint(ui.painter(), rect, button, maximized, &t, &response);
@@ -203,7 +203,7 @@ pub fn resize_edges(ctx: &egui::Context) {
     }
     let screen = ctx.content_rect();
     let t = Tokens::get(ctx);
-    egui::Area::new(egui::Id::new("window_resize_edges"))
+    egui::Area::new(egui::Id::unique("window_resize_edges"))
         .order(egui::Order::Foreground)
         .fixed_pos(screen.min)
         .pivot(Align2::LEFT_TOP)
@@ -214,7 +214,7 @@ pub fn resize_edges(ctx: &egui::Context) {
                 if rect.width() <= 0.0 || rect.height() <= 0.0 {
                     continue;
                 }
-                let response = ui.interact(rect, ui.id().with(("edge", n)), Sense::drag()).on_hover_cursor(cursor(direction));
+                let response = ui.interact(rect, ui.scope_id().with(("edge", n)), Sense::drag()).on_hover_cursor(cursor(direction));
                 // Sensing only drags, a drag starts on the press itself.
                 if response.drag_started() {
                     desktop_grab(ui.ctx(), egui::ViewportCommand::BeginResize(direction));
@@ -231,8 +231,9 @@ pub fn resize_edges(ctx: &egui::Context) {
         });
 }
 
+/// Return the stable egui id for desktop window-grab state.
 fn grab_id() -> egui::Id {
-    egui::Id::new("window_controls_desktop_grab")
+    egui::Id::unique("window_controls_desktop_grab")
 }
 
 /// Hand the pointer to the desktop to move or resize the window. On Wayland the compositor keeps
@@ -248,20 +249,41 @@ pub fn desktop_grab(ctx: &egui::Context, command: egui::ViewportCommand) {
 
 /// After `desktop_grab`, add the primary button's release to the next input, unless it brings one.
 /// The release goes before the input's first press (the next resize or move, or a click), which
-/// egui would otherwise end straight away; a release after that press is the press's own.
+/// egui would otherwise end straight away; a release after that press is the press's own. It also
+/// goes before the pointer leaving, as a button event would bring the gone pointer back; a release
+/// the input brings after the pointer left is the grab's own, and moves there instead.
 pub fn release_after_desktop_grab(ctx: &egui::Context, raw: &mut egui::RawInput) {
     if ctx.data_mut(|d| d.remove_temp::<()>(grab_id())).is_none() {
         return;
     }
-    let first = raw.events.iter().enumerate().find_map(|(n, e)| match e {
-        egui::Event::PointerButton { button: egui::PointerButton::Primary, pressed, .. } => Some((n, *pressed)),
-        _ => None,
-    });
-    let at = match first {
-        Some((_, false)) => return,
-        Some((n, true)) => n,
-        None => raw.events.len(),
-    };
+    let mut at = raw.events.len();
+    let mut gone = None;
+    let mut brought = None;
+    for (n, e) in raw.events.iter().enumerate() {
+        match e {
+            egui::Event::PointerButton { button: egui::PointerButton::Primary, pressed: false, .. } => {
+                brought = Some(n);
+                break;
+            }
+            egui::Event::PointerButton { button: egui::PointerButton::Primary, pressed: true, .. } => {
+                at = n;
+                break;
+            }
+            egui::Event::PointerGone => {
+                gone.get_or_insert(n);
+            }
+            _ => {}
+        }
+    }
+    if let Some(n) = brought {
+        // `gone` was found before `n`, so both are in range.
+        if let Some(g) = gone {
+            let release = raw.events.remove(n);
+            raw.events.insert(g, release);
+        }
+        return;
+    }
+    let at = gone.unwrap_or(at);
     let (pos, modifiers) = ctx.input(|i| (i.pointer.interact_pos().unwrap_or_default(), i.modifiers));
     raw.events.insert(at, egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: false, modifiers });
 }
@@ -389,4 +411,52 @@ mod tests {
         frame(vec![], Some(egui::ViewportCommand::StartDrag));
         assert_eq!(frame(vec![button(true), button(false)], None), [false, true, false]);
     }
+
+    #[test]
+    fn the_release_goes_before_the_pointer_leaving() {
+        let ctx = egui::Context::default();
+        let frame = |events: Vec<egui::Event>, grab: bool| {
+            let mut raw = egui::RawInput { events, ..Default::default() };
+            super::release_after_desktop_grab(&ctx, &mut raw);
+            let order = raw.events.clone();
+            ctx.run_ui(raw, |ui| {
+                if grab {
+                    super::desktop_grab(ui.ctx(), egui::ViewportCommand::StartDrag);
+                }
+            })
+            .textures_delta
+            .clear();
+            order
+        };
+        let release = |e: &egui::Event| matches!(e, egui::Event::PointerButton { button: egui::PointerButton::Primary, pressed: false, .. });
+        let press = egui::Event::PointerButton {
+            pos: Pos2::new(5.0, 5.0),
+            button: egui::PointerButton::Primary,
+            pressed: true,
+            modifiers: egui::Modifiers::NONE,
+        };
+        // On Wayland the input after a move brings only that the pointer left.
+        frame(vec![egui::Event::PointerMoved(Pos2::new(5.0, 5.0)), press], true);
+        let order = frame(vec![egui::Event::PointerGone], false);
+        assert!(matches!(order.as_slice(), [r, egui::Event::PointerGone] if release(r)), "{order:?}");
+        assert_eq!(ctx.input(|i| i.pointer.latest_pos()), None, "the pointer stays gone");
+        assert!(!ctx.input(|i| i.pointer.primary_down()));
+
+        // A release after the pointer left is the one the desktop kept, not to be doubled.
+        frame(vec![], true);
+        let order = frame(
+            vec![
+                egui::Event::PointerGone,
+                egui::Event::PointerButton {
+                    pos: Pos2::new(5.0, 5.0),
+                    button: egui::PointerButton::Primary,
+                    pressed: false,
+                    modifiers: egui::Modifiers::NONE,
+                },
+            ],
+            false,
+        );
+        assert!(matches!(order.as_slice(), [r, egui::Event::PointerGone] if release(r)), "moved, not doubled: {order:?}");
+        assert_eq!(ctx.input(|i| i.pointer.latest_pos()), None, "the pointer stays gone");
+    }
 }
diff --git a/crates/ui-egui/src/prepare.rs b/crates/ui-egui/src/prepare.rs
deleted file mode 100644
index f3913401a5..0000000000
--- a/crates/ui-egui/src/prepare.rs
+++ /dev/null
@@ -1,1739 +0,0 @@
-//! Prepare a form (Acrobat's Prepare Form, execution plan M6.6): add fields with the field
-//! tools (click for the default size, or drag a rectangle), select, move and resize them, see
-//! their name tags, delete them, and edit them in Field Properties.
-//!
-//! While the Prepare a form panel is open the page shows every field with a light-blue fill and
-//! its name; clicks select fields instead of filling them in, as in Acrobat.
-
-use egui::{Color32, CornerRadius, Pos2, Rect, Stroke, vec2};
-use pdfcraft_engine::form_scripts::{CalcOp, Calculate, DATE_PRESETS, Format, TIME_PRESETS, Validate, format_value};
-use pdfcraft_engine::{BorderStyle, Document, Edit, FieldFont, FieldLook, FieldProps, FormField, FormFieldKind, NewField};
-use pdfcraft_render::DocInfo;
-
-use crate::canvas::{DocView, PageXform};
-use crate::comments;
-use crate::theme;
-use crate::widgets;
-
-const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
-/// Acrobat's field fill in Prepare Form (light blue).
-pub(crate) const FIELD_FILL: Color32 = Color32::from_rgba_premultiplied(0x1B, 0x34, 0x54, 0x59);
-
-/// The Add form components tools.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub enum FieldTool {
-    Text,
-    /// Rows and columns of text fields in the area drawn, set up in a window first.
-    TextTable,
-    CheckBox,
-    Radio,
-    Combo,
-    List,
-    Button,
-    Image,
-    Date,
-    Signature,
-}
-
-pub const FIELD_TOOLS: [FieldTool; 10] = [
-    FieldTool::Text,
-    FieldTool::TextTable,
-    FieldTool::CheckBox,
-    FieldTool::Radio,
-    FieldTool::Combo,
-    FieldTool::List,
-    FieldTool::Button,
-    FieldTool::Image,
-    FieldTool::Date,
-    FieldTool::Signature,
-];
-
-impl FieldTool {
-    pub fn command(self) -> &'static str {
-        match self {
-            FieldTool::Text => "form.add.text",
-            FieldTool::TextTable => "form.add.text_table",
-            FieldTool::CheckBox => "form.add.checkbox",
-            FieldTool::Radio => "form.add.radio",
-            FieldTool::Combo => "form.add.combo",
-            FieldTool::List => "form.add.list",
-            FieldTool::Button => "form.add.button",
-            FieldTool::Image => "form.add.image",
-            FieldTool::Date => "form.add.date",
-            FieldTool::Signature => "form.add.signature",
-        }
-    }
-
-    pub fn from_command(id: &str) -> Option<Self> {
-        FIELD_TOOLS.into_iter().find(|t| t.command() == id)
-    }
-
-    pub fn label(self) -> &'static str {
-        match self {
-            FieldTool::Text => "Text field",
-            FieldTool::TextTable => "Text field table",
-            FieldTool::CheckBox => "Checkbox",
-            FieldTool::Radio => "Radio button",
-            FieldTool::Combo => "Drop-down list",
-            FieldTool::List => "List box",
-            FieldTool::Button => "Button",
-            FieldTool::Image => "Image field",
-            FieldTool::Date => "Date field",
-            FieldTool::Signature => "Digital signature",
-        }
-    }
-
-    /// The field a click or drag creates. Radio buttons dropped next to a selected radio group
-    /// join it with the next free choice.
-    pub fn new_field(self, join: Option<&FormField>) -> NewField {
-        match self {
-            // A table's cells are text fields.
-            FieldTool::Text | FieldTool::TextTable => NewField::Text { multiline: false },
-            FieldTool::CheckBox => NewField::CheckBox,
-            FieldTool::Radio => match join.filter(|f| f.kind == FormFieldKind::Radio) {
-                Some(g) => {
-                    let taken: Vec<&str> = g.widgets.iter().filter_map(|w| w.on_state.as_deref()).collect();
-                    let export =
-                        (1..=u64::MAX).map(|i| format!("Choice{i}")).find(|c| !taken.contains(&c.as_str())).unwrap_or_else(|| "Choice".into());
-                    NewField::Radio { group: Some(g.name.clone()), export }
-                }
-                None => NewField::Radio { group: None, export: "Choice1".into() },
-            },
-            FieldTool::Combo => NewField::Combo { options: Vec::new(), editable: false },
-            FieldTool::List => NewField::List { options: Vec::new(), multi: false },
-            FieldTool::Button => NewField::Button { caption: String::new() },
-            FieldTool::Image => NewField::Image,
-            FieldTool::Date => NewField::Date,
-            FieldTool::Signature => NewField::Signature,
-        }
-    }
-
-    /// Width and height in points of a field placed with a single click.
-    pub fn default_size(self) -> (f64, f64) {
-        match self {
-            FieldTool::TextTable => (180.0, 110.0),
-            FieldTool::CheckBox | FieldTool::Radio => (14.0, 14.0),
-            FieldTool::List => (144.0, 54.0),
-            FieldTool::Button => (72.0, 22.0),
-            FieldTool::Image => (144.0, 108.0),
-            FieldTool::Signature => (180.0, 36.0),
-            FieldTool::Date => (108.0, 22.0),
-            FieldTool::Text | FieldTool::Combo => (144.0, 22.0),
-        }
-    }
-}
-
-/// What the pointer is doing to a field.
-#[derive(Clone, Copy, Debug, PartialEq)]
-enum Grab {
-    /// Drawing a new field from this screen point.
-    Draw(Pos2),
-    /// Selecting fields inside a dragged rectangle.
-    Select(Pos2),
-    Move,
-    /// Resizing by a corner: (moves left edge, moves top edge) in screen terms.
-    Corner(bool, bool),
-}
-
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct PrepareView {
-    /// The selected field and which of its widgets (the anchor of Align and Match Size).
-    pub selected: Option<(String, usize)>,
-    /// More fields selected with Shift- or ⌘-click.
-    pub also: Vec<(String, usize)>,
-    /// Select the field an Add field edit creates (the form's length before it).
-    pub select_added: Option<usize>,
-    grab: Option<(usize, Grab, Pos2)>,
-    marquee_before: Option<Vec<(String, usize)>>,
-    /// Escape ends egui's drag too; ignore its release until the mouse is up.
-    ignore_release: bool,
-}
-
-impl PrepareView {
-    /// Unique field names: selecting several widgets of one radio group still edits one field.
-    pub fn names(&self) -> Vec<String> {
-        let mut names = Vec::new();
-        for (name, _) in self.selected.iter().chain(self.also.iter()) {
-            if !names.contains(name) {
-                names.push(name.clone());
-            }
-        }
-        names
-    }
-
-    pub(crate) fn select(&mut self, key: (String, usize), extend: bool) {
-        if !extend || self.selected.is_none() {
-            self.selected = Some(key);
-            self.also.clear();
-        } else if self.selected.as_ref() == Some(&key) {
-            self.selected = if self.also.is_empty() { None } else { Some(self.also.remove(0)) };
-        } else if let Some(index) = self.also.iter().position(|k| *k == key) {
-            self.also.remove(index);
-        } else {
-            self.also.push(key);
-        }
-    }
-}
-
-fn screen_rect(xf: &PageXform, info: &DocInfo, page: usize, r: [f64; 4]) -> Rect {
-    xf.user_rect(info, page, [r[0] as f32, r[1] as f32, r[2] as f32, r[3] as f32])
-}
-
-fn to_user(xf: &PageXform, info: &DocInfo, page: usize, p: Pos2) -> [f64; 2] {
-    let (vx, vy) = xf.screen_to_view(p);
-    let u = info.pages[page].view_to_user(vx, vy);
-    [u[0] as f64, u[1] as f64]
-}
-
-/// Where a table goes, in view space, for a screen rect drawn with the table tool: a click (a rect
-/// under 4 pixels either way) puts the default size's top-left corner at the pointer, moved in from
-/// the page's edges as far as it takes to stay on the page.
-fn table_rect(xf: &PageXform, r: Rect) -> [f64; 4] {
-    let (x0, y0) = xf.screen_to_view(r.min);
-    if r.width() < 4.0 || r.height() < 4.0 {
-        let (pw, ph) = (f64::from(xf.pw), f64::from(xf.ph));
-        let (dw, dh) = FieldTool::TextTable.default_size();
-        // Smaller than the default only on a page smaller than it.
-        let (w, h) = (dw.min(pw), dh.min(ph));
-        let (x, y) = (f64::from(x0).min(pw - w).max(0.0), f64::from(y0).min(ph - h).max(0.0));
-        return [x, y, x + w, y + h];
-    }
-    let (x1, y1) = xf.screen_to_view(r.max);
-    [x0, y0, x1, y1].map(f64::from)
-}
-
-/// A screen rect → a normalised user-space rect.
-fn user_rect(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
-    let (a, b) = (to_user(xf, info, page, r.min), to_user(xf, info, page, r.max));
-    [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
-}
-
-fn handles(r: Rect) -> [(Pos2, bool, bool); 4] {
-    [(r.left_top(), true, true), (r.right_top(), false, true), (r.left_bottom(), true, false), (r.right_bottom(), false, false)]
-}
-
-/// The rect while a move or resize is in progress. With `shift` held a corner keeps the field's
-/// proportions, as it does for comments and stamps.
-fn dragged(r: Rect, grab: Grab, delta: egui::Vec2, shift: bool) -> Rect {
-    match grab {
-        Grab::Move => r.translate(delta),
-        Grab::Corner(left, top) => {
-            let handle = (if left { -1 } else { 1 }, if top { -1 } else { 1 });
-            comments::resized(r, handle, delta, comments::corner_ratio(r, None, shift))
-        }
-        Grab::Draw(_) | Grab::Select(_) => r,
-    }
-}
-
-pub(crate) struct Outcome {
-    /// The click or drag belonged to Prepare a form.
-    pub consumed: bool,
-    /// Open Field Properties for the selected field.
-    pub properties: bool,
-    /// A field was placed: go back to the Select tool.
-    pub placed: bool,
-    /// A table of text fields was drawn: open its window for this page and area (view space).
-    pub table: Option<(usize, [f64; 4])>,
-}
-
-/// Pointer input on one page while preparing a form.
-#[allow(clippy::too_many_arguments)]
-pub(crate) fn page_input(
-    ui: &egui::Ui,
-    resp: &egui::Response,
-    xf: &PageXform,
-    page: usize,
-    info: &DocInfo,
-    form: &[FormField],
-    tool: Option<FieldTool>,
-    allowed: bool,
-    view: &mut DocView,
-) -> Outcome {
-    let mut out = Outcome { consumed: false, properties: false, placed: false, table: None };
-    let pointer = ui.input(|i| i.pointer.hover_pos().or(i.pointer.interact_pos()));
-    let prep = &mut view.prepare;
-
-    if prep.marquee_before.is_some() && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
-        cancel_marquee(prep);
-        out.consumed = true;
-        return out;
-    }
-    if prep.ignore_release {
-        if !ui.input(|i| i.pointer.primary_down()) {
-            prep.ignore_release = false;
-        }
-        out.consumed = true;
-        return out;
-    }
-
-    // A grab in progress on this page.
-    if let Some((gp, grab, start)) = prep.grab
-        && gp == page
-    {
-        out.consumed = true;
-        if resp.drag_stopped() || !ui.input(|i| i.pointer.primary_down()) {
-            prep.grab = None;
-            let end = pointer.unwrap_or(start);
-            match grab {
-                Grab::Select(from) => {
-                    prep.marquee_before = None;
-                    let rect = Rect::from_two_pos(from, end).intersect(xf.rect);
-                    for f in form {
-                        for (wi, w) in f.widgets.iter().enumerate().filter(|(_, w)| w.page == Some(page)) {
-                            if screen_rect(xf, info, page, w.rect).intersects(rect) {
-                                let key = (f.name.clone(), wi);
-                                if prep.selected.is_none() {
-                                    prep.selected = Some(key);
-                                } else if prep.selected.as_ref() != Some(&key) && !prep.also.contains(&key) {
-                                    prep.also.push(key);
-                                }
-                            }
-                        }
-                    }
-                }
-                Grab::Draw(from) => {
-                    let Some(tool) = tool else { return out };
-                    if tool == FieldTool::TextTable {
-                        out.table = Some((page, table_rect(xf, Rect::from_two_pos(from, end).intersect(xf.rect))));
-                        out.placed = true;
-                        return out;
-                    }
-                    let r = Rect::from_two_pos(from, end).intersect(xf.rect);
-                    let rect = user_rect(xf, info, page, r);
-                    let rect = if r.width() < 4.0 || r.height() < 4.0 {
-                        // A click: the default size, top-left at the pointer.
-                        let at = to_user(xf, info, page, from);
-                        let (w, h) = tool.default_size();
-                        [at[0], at[1] - h, at[0] + w, at[1]]
-                    } else {
-                        rect
-                    };
-                    let join = prep.selected.as_ref().and_then(|(n, _)| form.iter().find(|f| &f.name == n));
-                    prep.select_added = Some(form.len());
-                    view.pending_edit = Some(Edit::AddField { page, rect, kind: tool.new_field(join), name: None });
-                    out.placed = true;
-                }
-                Grab::Move | Grab::Corner(..) => {
-                    let Some((name, wi)) = prep.selected.clone() else { return out };
-                    let Some(w) = form.iter().find(|f| f.name == name).and_then(|f| f.widgets.get(wi)) else { return out };
-                    let delta = end - start;
-                    if delta.length() >= 1.0 {
-                        let shift = ui.input(|i| i.modifiers.shift);
-                        let r = dragged(screen_rect(xf, info, page, w.rect), grab, delta, shift);
-                        let rect = user_rect(xf, info, page, r);
-                        view.pending_edit =
-                            Some(Edit::SetFieldProps { name, props: Box::new(FieldProps { rect: Some((wi, rect)), ..Default::default() }) });
-                    }
-                }
-            }
-        }
-        return out;
-    }
-
-    let Some(p) = pointer.filter(|p| xf.rect.contains(*p)) else { return out };
-    if !allowed {
-        return out;
-    }
-    if let Some(tool) = tool {
-        ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
-        if resp.drag_started() || resp.clicked() {
-            let origin = ui.input(|i| i.pointer.press_origin()).filter(|o| xf.rect.contains(*o)).unwrap_or(p);
-            prep.grab = Some((page, Grab::Draw(origin), origin));
-            out.consumed = true;
-            if resp.clicked() {
-                // A click without a drag: finish at once.
-                prep.grab = None;
-                if tool == FieldTool::TextTable {
-                    out.table = Some((page, table_rect(xf, Rect::from_min_size(p, egui::Vec2::ZERO))));
-                    out.placed = true;
-                    return out;
-                }
-                let at = to_user(xf, info, page, p);
-                let (w, h) = tool.default_size();
-                let join = prep.selected.as_ref().and_then(|(n, _)| form.iter().find(|f| &f.name == n));
-                prep.select_added = Some(form.len());
-                view.pending_edit = Some(Edit::AddField { page, rect: [at[0], at[1] - h, at[0] + w, at[1]], kind: tool.new_field(join), name: None });
-                out.placed = true;
-            }
-        }
-        return out;
-    }
-
-    // Right-click a field: select it (the context menu acts on it).
-    if resp.secondary_clicked()
-        && let Some((f, wi)) = form.iter().find_map(|f| {
-            f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(p)).map(|(i, _)| (f, i))
-        })
-    {
-        let key = (f.name.clone(), wi);
-        if let Some(i) = prep.also.iter().position(|k| *k == key) {
-            // Part of the selection: it becomes the anchor the others line up with.
-            prep.also.remove(i);
-            if let Some(old) = prep.selected.replace(key) {
-                prep.also.push(old);
-            }
-        } else if prep.selected.as_ref() != Some(&key) {
-            prep.selected = Some(key);
-            prep.also.clear();
-        }
-    }
-    // The Select tool: corner handles of the selection, then fields.
-    let selected_rect = prep
-        .selected
-        .as_ref()
-        .and_then(|(n, wi)| form.iter().find(|f| &f.name == n)?.widgets.get(*wi).filter(|w| w.page == Some(page)))
-        .map(|w| screen_rect(xf, info, page, w.rect));
-    let corner = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(p) <= 6.0));
-    let hit = form.iter().find_map(|f| {
-        f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(p)).map(|(i, _)| (f, i))
-    });
-    if let Some((_, left, top)) = corner {
-        ui.ctx().set_cursor_icon(if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
-    } else if hit.is_some() {
-        ui.ctx().set_cursor_icon(egui::CursorIcon::Move);
-    }
-    if resp.drag_started() {
-        let origin = ui.input(|i| i.pointer.press_origin()).unwrap_or(p);
-        if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(origin) <= 6.0)) {
-            prep.grab = Some((page, Grab::Corner(left, top), origin));
-            out.consumed = true;
-        } else if let Some((f, wi)) = form.iter().find_map(|f| {
-            f.widgets
-                .iter()
-                .enumerate()
-                .find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(origin))
-                .map(|(i, _)| (f, i))
-        }) {
-            prep.selected = Some((f.name.clone(), wi));
-            prep.grab = Some((page, Grab::Move, origin));
-            out.consumed = true;
-        } else {
-            prep.marquee_before = Some(prep.selected.iter().chain(prep.also.iter()).cloned().collect());
-            if !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
-                prep.selected = None;
-                prep.also.clear();
-            }
-            prep.grab = Some((page, Grab::Select(origin), origin));
-            out.consumed = true;
-        }
-        return out;
-    }
-    if resp.double_clicked() && hit.is_some() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
-        out.consumed = true;
-        out.properties = true;
-        return out;
-    }
-    if resp.clicked() {
-        let extend = ui.input(|i| i.modifiers.shift || i.modifiers.command);
-        match hit {
-            // Shift/⌘-click adds or removes a field from the selection.
-            Some((f, wi)) => {
-                prep.select((f.name.clone(), wi), extend);
-                out.consumed = true;
-            }
-            None if corner.is_none() => {
-                prep.selected = None;
-                prep.also.clear();
-            }
-            None => out.consumed = true,
-        }
-    }
-    out.consumed |= hit.is_some() && resp.is_pointer_button_down_on();
-    out
-}
-
-/// Align, Center, Distribute and Set Fields to Same Size (Prepare a form, several fields
-/// selected).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Arrange {
-    AlignLeft,
-    AlignRight,
-    AlignTop,
-    AlignBottom,
-    /// Centres on one vertical line (the anchor's).
-    AlignCenterH,
-    /// Centres on one horizontal line.
-    AlignCenterV,
-    DistributeH,
-    DistributeV,
-    SameWidth,
-    SameHeight,
-    SameSize,
-}
-
-impl Arrange {
-    pub fn label(self) -> &'static str {
-        match self {
-            Arrange::AlignLeft | Arrange::AlignRight | Arrange::AlignTop | Arrange::AlignBottom | Arrange::AlignCenterH | Arrange::AlignCenterV => {
-                "Align fields"
-            }
-            Arrange::DistributeH | Arrange::DistributeV => "Distribute fields",
-            Arrange::SameWidth | Arrange::SameHeight | Arrange::SameSize => "Match field sizes",
-        }
-    }
-}
-
-/// The edits that arrange the selected widgets (user space; the anchor stays put).
-pub fn arrange(form: &[FormField], anchor: &(String, usize), others: &[(String, usize)], op: Arrange) -> Option<Edit> {
-    let rect_of = |k: &(String, usize)| form.iter().find(|f| f.name == k.0).and_then(|f| f.widgets.get(k.1)).map(|w| w.rect);
-    let a = rect_of(anchor)?;
-    let mut items: Vec<((String, usize), [f64; 4])> = others.iter().filter_map(|k| rect_of(k).map(|r| (k.clone(), r))).collect();
-    if items.is_empty() {
-        return None;
-    }
-    let (aw, ah) = (a[2] - a[0], a[3] - a[1]);
-    let mut moved: Vec<((String, usize), [f64; 4])> = Vec::new();
-    match op {
-        Arrange::DistributeH | Arrange::DistributeV => {
-            // Even gaps between all selected fields (the outermost stay).
-            items.push((anchor.clone(), a));
-            if items.len() < 3 {
-                return None;
-            }
-            let horiz = op == Arrange::DistributeH;
-            items.sort_by(|x, y| if horiz { x.1[0].total_cmp(&y.1[0]) } else { y.1[3].total_cmp(&x.1[3]) });
-            let size = |r: &[f64; 4]| if horiz { r[2] - r[0] } else { r[3] - r[1] };
-            let (first, last) = (items[0].1, items[items.len() - 1].1);
-            let span = if horiz { last[2] - first[0] } else { first[3] - last[1] };
-            let total: f64 = items.iter().map(|(_, r)| size(r)).sum();
-            let gap = (span - total) / (items.len() - 1) as f64;
-            let mut at = if horiz { first[0] } else { first[3] };
-            for (k, r) in &items {
-                let s = size(r);
-                let nr = if horiz { [at, r[1], at + s, r[3]] } else { [r[0], at - s, r[2], at] };
-                at = if horiz { at + s + gap } else { at - s - gap };
-                moved.push((k.clone(), nr));
-            }
-        }
-        _ => {
-            for (k, r) in items {
-                let (w, h) = (r[2] - r[0], r[3] - r[1]);
-                let nr = match op {
-                    Arrange::AlignLeft => [a[0], r[1], a[0] + w, r[3]],
-                    Arrange::AlignRight => [a[2] - w, r[1], a[2], r[3]],
-                    Arrange::AlignTop => [r[0], a[3] - h, r[2], a[3]],
-                    Arrange::AlignBottom => [r[0], a[1], r[2], a[1] + h],
-                    Arrange::AlignCenterH => {
-                        let cx = (a[0] + a[2]) / 2.0;
-                        [cx - w / 2.0, r[1], cx + w / 2.0, r[3]]
-                    }
-                    Arrange::AlignCenterV => {
-                        let cy = (a[1] + a[3]) / 2.0;
-                        [r[0], cy - h / 2.0, r[2], cy + h / 2.0]
-                    }
-                    Arrange::SameWidth => [r[0], r[1], r[0] + aw, r[3]],
-                    Arrange::SameHeight => [r[0], r[3] - ah, r[2], r[3]],
-                    _ => [r[0], r[3] - ah, r[0] + aw, r[3]],
-                };
-                moved.push((k, nr));
-            }
-        }
-    }
-    let edits: Vec<Edit> = moved
-        .into_iter()
-        .filter(|(k, nr)| rect_of(k).is_some_and(|r| r.iter().zip(nr).any(|(x, y)| (x - y).abs() > 1e-6)))
-        .map(|((name, wi), rect)| Edit::SetFieldProps { name, props: Box::new(FieldProps { rect: Some((wi, rect)), ..Default::default() }) })
-        .collect();
-    (!edits.is_empty()).then(|| Edit::Batch { label: op.label().into(), edits })
-}
-
-/// Fields with their light-blue fill and name tags, the selection with its handles, and the
-/// rectangle being drawn or dragged.
-pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, xf: &PageXform, page: usize, info: &DocInfo, form: &[FormField], view: &DocView) {
-    let prep = &view.prepare;
-    let pointer = ui.input(|i| i.pointer.hover_pos());
-    let grab = prep.grab.filter(|(gp, ..)| *gp == page);
-    let zoom = (xf.rect.width() / xf.pw.max(1.0)).clamp(0.5, 3.0);
-    for f in form {
-        for (wi, w) in f.widgets.iter().enumerate().filter(|(_, w)| w.page == Some(page)) {
-            let mut r = screen_rect(xf, info, page, w.rect);
-            let selected = prep.selected.as_ref().is_some_and(|(n, i)| n == &f.name && *i == wi);
-            let also = prep.also.iter().any(|(n, i)| n == &f.name && *i == wi);
-            if selected && let (Some((_, g, start)), Some(p)) = (grab, pointer) {
-                r = dragged(r, g, p - start, ui.input(|i| i.modifiers.shift));
-            }
-            painter.rect_filled(r, CornerRadius::ZERO, FIELD_FILL);
-            painter.rect_stroke(
-                r,
-                CornerRadius::ZERO,
-                Stroke::new(if also { 2.0 } else { 1.0 }, if selected || also { SELECT_BLUE } else { Color32::from_gray(90) }),
-                egui::StrokeKind::Inside,
-            );
-            // The name tag: white text on black, clipped to the field.
-            // The full name, as Acrobat shows it: MASTER.first, not first (#2696).
-            let label = f.name.as_str();
-            let font = theme::regular((9.0 * zoom).clamp(7.0, 13.0));
-            let galley = painter.layout_no_wrap(label.to_string(), font, Color32::WHITE);
-            let size = galley.size() + vec2(6.0, 2.0);
-            let tag = Rect::from_center_size(r.center(), size);
-            let clip = painter.clip_rect().intersect(r);
-            let p2 = painter.with_clip_rect(clip);
-            p2.rect_filled(tag, CornerRadius::same(1), if selected { SELECT_BLUE } else { Color32::BLACK });
-            p2.galley(tag.min + vec2(3.0, 1.0), galley, Color32::WHITE);
-            if selected {
-                painter.rect_stroke(r.expand(1.0), CornerRadius::ZERO, Stroke::new(2.0, SELECT_BLUE), egui::StrokeKind::Outside);
-                for (c, ..) in handles(r) {
-                    painter.circle(c, 3.5, Color32::WHITE, Stroke::new(1.5, SELECT_BLUE));
-                }
-            }
-        }
-    }
-    if let (Some((_, Grab::Draw(from) | Grab::Select(from), _)), Some(p)) = (grab, pointer) {
-        let r = Rect::from_two_pos(from, p).intersect(xf.rect);
-        painter.rect_filled(r, CornerRadius::ZERO, FIELD_FILL);
-        painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Inside);
-    }
-}
-
-/// Delete the selected field and every field selected with it (#95), as one undoable step, and
-/// clear the selection.
-pub(crate) fn delete_selected(view: &mut DocView) -> Option<Edit> {
-    let (first, _) = view.prepare.selected.take()?;
-    let mut names = vec![first];
-    for (name, _) in std::mem::take(&mut view.prepare.also) {
-        if !names.contains(&name) {
-            names.push(name);
-        }
-    }
-    if names.len() == 1 {
-        return names.pop().map(|name| Edit::DeleteField { name });
-    }
-    let label = format!("Delete {} fields", names.len());
-    Some(Edit::Batch { label, edits: names.into_iter().map(|name| Edit::DeleteField { name }).collect() })
-}
-
-/// The arrow keys move the selected field a point, Shift and an arrow ten points, as in Acrobat,
-/// as the object nudge does (`object_ui::nudge_keys`) and as dragging it does (#2608). The keys
-/// are consumed before the view turns the page with them; one press is one undo step.
-pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, doc: &Document) {
-    // `consume_key` lets an extra Alt through, and Alt+↑/↓ belongs to Calculation order's move.
-    if ctx.egui_wants_keyboard_input() || view.prepare.grab.is_some() || ctx.input(|i| i.modifiers.alt) {
-        return;
-    }
-    let Some((name, wi)) = view.prepare.selected.clone() else { return };
-    let Some(w) = doc.form.iter().find(|f| f.name == name).and_then(|f| f.widgets.get(wi)) else { return };
-    let Some(page) = w.page else { return };
-    let Some(xf) = view.page_xform(page) else { return };
-    use egui::{Key, Modifiers};
-    let mut step = egui::Vec2::ZERO;
-    ctx.input_mut(|i| {
-        for (key, direction) in [
-            (Key::ArrowLeft, egui::vec2(-1.0, 0.0)),
-            (Key::ArrowRight, egui::vec2(1.0, 0.0)),
-            (Key::ArrowUp, egui::vec2(0.0, -1.0)),
-            (Key::ArrowDown, egui::vec2(0.0, 1.0)),
-        ] {
-            // Shift first: a plain key pattern also matches a Shift press.
-            if i.consume_key(Modifiers::SHIFT, key) {
-                step += direction * 10.0;
-            } else if i.consume_key(Modifiers::NONE, key) {
-                step += direction;
-            }
-        }
-    });
-    if step == egui::Vec2::ZERO {
-        return;
-    }
-    // A point in view space whatever the zoom and whatever way the view is turned; the page's own
-    // rotation turns it into the user-space move the widget's rect is stored in.
-    let c = xf.rect.center();
-    let unit = |d: egui::Vec2| {
-        let (a, b) = (xf.screen_to_view(c), xf.screen_to_view(c + d));
-        let v = egui::vec2(b.0 - a.0, b.1 - a.1);
-        if v.length() > 0.0 { v / v.length() } else { egui::Vec2::ZERO }
-    };
-    let delta = unit(egui::vec2(1.0, 0.0)) * step.x + unit(egui::vec2(0.0, 1.0)) * step.y;
-    let Ok(offset) = doc.object_move_offset(page, [f64::from(delta.x), f64::from(delta.y)]) else { return };
-    let r = w.rect;
-    let rect = [r[0] + offset[0], r[1] + offset[1], r[2] + offset[0], r[3] + offset[1]];
-    view.pending_edit = Some(Edit::SetFieldProps { name, props: Box::new(FieldProps { rect: Some((wi, rect)), ..Default::default() }) });
-}
-
-/// Delete removes the selected fields; Escape clears the selection.
-pub(crate) fn select_all(view: &mut DocView, form: &[FormField]) {
-    let mut selected =
-        form.iter().flat_map(|f| f.widgets.iter().enumerate().filter(|(_, w)| w.page == Some(view.current)).map(|(wi, _)| (f.name.clone(), wi)));
-    view.prepare.selected = selected.next();
-    view.prepare.also = selected.collect();
-}
-
-fn cancel_marquee(prep: &mut PrepareView) {
-    prep.grab = None;
-    prep.ignore_release = true;
-    if let Some(before) = prep.marquee_before.take() {
-        let mut before = before.into_iter();
-        prep.selected = before.next();
-        prep.also = before.collect();
-    }
-}
-
-pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView) {
-    if ctx.egui_wants_keyboard_input() {
-        return;
-    }
-    if view.prepare.marquee_before.is_some() && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
-        cancel_marquee(&mut view.prepare);
-        return;
-    }
-    if view.prepare.selected.is_none() {
-        return;
-    }
-    let (del, esc) = ctx.input(|i| (i.key_pressed(egui::Key::Delete) || i.key_pressed(egui::Key::Backspace), i.key_pressed(egui::Key::Escape)));
-    if del {
-        view.pending_edit = delete_selected(view);
-    } else if esc {
-        view.prepare.selected = None;
-        view.prepare.also.clear();
-    }
-}
-
-/// After an Add field edit: select the new field (the form's last).
-pub(crate) fn after_refresh(view: &mut DocView, form: &[FormField]) {
-    view.prepare.also.retain(|(name, wi)| form.iter().any(|f| &f.name == name && *wi < f.widgets.len()));
-    if let Some(n) = view.prepare.select_added.take() {
-        if form.len() > n
-            && let Some(f) = form.last()
-        {
-            view.prepare.selected = Some((f.name.clone(), 0));
-        } else if let Some((name, _)) = &view.prepare.selected
-            && let Some(f) = form.iter().find(|f| &f.name == name)
-        {
-            // A radio button joined the selected group: select the new button.
-            view.prepare.selected = Some((f.name.clone(), f.widgets.len().saturating_sub(1)));
-        }
-    }
-    if let Some((name, wi)) = &view.prepare.selected
-        && !form.iter().any(|f| &f.name == name && *wi < f.widgets.len())
-    {
-        view.prepare.selected = None;
-    }
-}
-
-// ───────────────────────────────────────────────────────────────────────── Field Properties
-
-impl crate::PdfCraftApp {
-    /// Open Field Properties for a field of the active document.
-    pub fn open_field_props(&mut self, name: &str, widget: usize) {
-        let Some((index, id)) = self.active_ids() else { return };
-        let names = self.views[index].prepare.names();
-        if names.len() > 1 && names.iter().any(|n| n == name) {
-            let draft = self.session.get(id).map_or(Err("The document is no longer open."), |doc| crate::bulk_fields::Draft::new(doc, names));
-            match draft {
-                Ok(draft) => {
-                    self.field_props = None;
-                    self.bulk_field_props = Some(draft);
-                    self.dialog = Some(crate::Dialog::BulkFieldProps);
-                }
-                Err(why) => self.notify_tr(why),
-            }
-            return;
-        }
-        self.bulk_field_props = None;
-        let Some(f) = self.session.get(id).and_then(|d| d.form.iter().find(|f| f.name == name).cloned()) else { return };
-        let mut d = FieldDraft::new(&f, widget);
-        d.look = self.session.get(id).and_then(|doc| doc.field_look(name));
-        d.check_style = self.session.get(id).and_then(|doc| doc.field_check_style(name));
-        if let Some(o) = d.original.as_mut() {
-            o.look = d.look;
-            o.check_style = d.check_style;
-        }
-        let others: Vec<String> =
-            self.session.get(id).map(|doc| doc.form.iter().filter(|x| x.name != name).map(|x| x.name.clone()).collect()).unwrap_or_default();
-        d.others = others.clone();
-        d.actions = self.session.get(id).map(|doc| doc.field_actions(name)).unwrap_or_default();
-        d.chained = self.session.get(id).map(|doc| doc.field_action_chains(name)).unwrap_or_default();
-        if let Some(o) = d.original.as_mut() {
-            o.others = others;
-            o.actions = d.actions.clone();
-        }
-        self.field_props = Some(d);
-        self.dialog = Some(crate::Dialog::FieldProps);
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum FieldTab {
-    General,
-    Appearance,
-    Position,
-    Options,
-    Format,
-    Validate,
-    Calculate,
-    Actions,
-}
-
-/// Actions tab: the "Select Action" choices.
-pub const ACTION_KINDS: [&str; 8] = [
-    "Run a JavaScript",
-    "Open a web link",
-    "Reset a form",
-    "Execute a menu item",
-    "Go to a page view",
-    "Show a field",
-    "Hide a field",
-    "Submit a form",
-];
-
-/// Actions tab: the action being added.
-#[derive(Clone, Debug, PartialEq)]
-pub struct ActionDraft {
-    pub trigger: pdfcraft_engine::FieldTrigger,
-    pub kind: usize,
-    /// The script, URL, field names (comma-separated), menu item or page number.
-    pub text: String,
-}
-
-impl Default for ActionDraft {
-    fn default() -> Self {
-        ActionDraft { trigger: pdfcraft_engine::FieldTrigger::MouseUp, kind: 0, text: String::new() }
-    }
-}
-
-impl ActionDraft {
-    pub fn action(&self) -> Result<pdfcraft_engine::FieldAction, String> {
-        use pdfcraft_engine::FieldAction as A;
-        let t = self.text.trim();
-        let names = || t.split(',').map(str::trim).filter(|s| !s.is_empty()).map(str::to_string).collect::<Vec<_>>();
-        Ok(match self.kind {
-            0 => A::JavaScript(self.text.clone()),
-            1 if !t.is_empty() => A::Uri(t.to_string()),
-            2 => A::Reset(names()),
-            3 => A::Named(if t.is_empty() { "Print".into() } else { t.to_string() }),
-            4 => A::GoTo(t.parse::<usize>().ok().filter(|p| *p >= 1).ok_or("Enter a page number")? - 1),
-            5 if !t.is_empty() => A::ShowHide { fields: names(), hide: false },
-            6 if !t.is_empty() => A::ShowHide { fields: names(), hide: true },
-            7 if !t.is_empty() => A::Submit(t.to_string()),
-            1 | 7 => return Err("Enter a URL".into()),
-            _ => return Err("Enter the field names".into()),
-        })
-    }
-}
-
-/// The Field Properties dialog's working copy.
-#[derive(Clone, Debug, PartialEq)]
-pub struct FieldDraft {
-    pub field: String,
-    pub kind: FormFieldKind,
-    pub widget: usize,
-    pub tab: FieldTab,
-    pub name: String,
-    pub tooltip: String,
-    pub caption: String,
-    pub read_only: bool,
-    pub required: bool,
-    pub multiline: bool,
-    pub limit: bool,
-    pub max_len: usize,
-    pub options: Vec<String>,
-    pub new_option: String,
-    /// `/Ff` as edited on the Options tab.
-    pub flags: u32,
-    /// Field Properties ▸ General ▸ Locked.
-    pub locked: bool,
-    /// `/Q`: 0 left, 1 centre, 2 right.
-    pub quadding: i64,
-    /// `/DV` (text and choices), or the default state (buttons: empty = off).
-    pub default: String,
-    /// Check boxes and radio buttons: this widget's "on" state (export value).
-    pub on_state: String,
-    /// 0 = auto.
-    pub font_size: f64,
-    /// Left, bottom, width, height in points.
-    pub position: [f64; 4],
-    /// `/MK /R`: 0, 90, 180 or 270 degrees counterclockwise.
-    pub rotation: i64,
-    pub look: Option<FieldLook>,
-    /// Check boxes and radio buttons: the mark when on (Options tab).
-    pub check_style: Option<pdfcraft_engine::CheckStyle>,
-    pub format: Format,
-    pub validate: Validate,
-    pub calculate: Calculate,
-    /// Every other field's name (the Calculate tab picks from them).
-    pub others: Vec<String>,
-    /// Actions tab: each trigger's action, and the one being added.
-    pub actions: Vec<(pdfcraft_engine::FieldTrigger, pdfcraft_engine::FieldAction)>,
-    pub new_action: ActionDraft,
-    /// Actions tab: the trigger whose script `new_action` is editing (Edit), if any.
-    pub editing: Option<pdfcraft_engine::FieldTrigger>,
-    /// Actions tab: how many actions the document chains after each trigger's first one. They are
-    /// kept when that first action is replaced.
-    pub chained: Vec<(pdfcraft_engine::FieldTrigger, usize)>,
-    original: Box<Option<FieldDraft>>,
-}
-
-pub(crate) fn da_size(da: &str) -> f64 {
-    let mut previous = "";
-    let mut size = 0.0;
-    for token in da.split_whitespace() {
-        if token == "Tf" {
-            size = previous.parse::<f64>().ok().filter(|v| v.is_finite() && *v >= 0.0).unwrap_or(0.0);
-        }
-        previous = token;
-    }
-    size
-}
-
-pub(crate) fn da_font(da: &str) -> &str {
-    let (mut two_back, mut previous, mut font) = ("", "", "Helv");
-    for token in da.split_whitespace() {
-        if token == "Tf" {
-            font = two_back.trim_start_matches('/');
-        }
-        two_back = previous;
-        previous = token;
-    }
-    font
-}
-
-impl FieldDraft {
-    pub fn new(f: &FormField, widget: usize) -> Self {
-        let r = f.widgets.get(widget).map(|w| w.rect).unwrap_or_default();
-        let mut d = FieldDraft {
-            field: f.name.clone(),
-            kind: f.kind,
-            widget,
-            tab: FieldTab::General,
-            // The full name: a dotted name moves the field under those parent fields (#2696).
-            name: f.name.clone(),
-            tooltip: f.tooltip.clone().unwrap_or_default(),
-            caption: f.widgets.get(widget).and_then(|w| w.caption.clone()).unwrap_or_default(),
-            read_only: f.read_only(),
-            required: f.has(pdfcraft_engine::field_flags::REQUIRED),
-            multiline: f.has(pdfcraft_engine::field_flags::MULTILINE),
-            limit: f.max_len.is_some(),
-            max_len: f.max_len.unwrap_or(0),
-            options: f.options.iter().map(|(_, d)| d.clone()).collect(),
-            new_option: String::new(),
-            flags: f.flags,
-            locked: f.locked(),
-            quadding: f.quadding,
-            default: f.default.first().cloned().unwrap_or_default(),
-            on_state: f.widgets.get(widget).and_then(|w| w.on_state.clone()).unwrap_or_default(),
-            font_size: da_size(&f.da),
-            position: [r[0], r[1], r[2] - r[0], r[3] - r[1]],
-            rotation: f.widgets.get(widget).map(|w| w.rotation).unwrap_or(0),
-            look: None,
-            check_style: None,
-            format: f.actions.format.clone(),
-            validate: f.actions.validate.clone(),
-            calculate: f.actions.calculate.clone(),
-            others: Vec::new(),
-            actions: Vec::new(),
-            new_action: ActionDraft::default(),
-            editing: None,
-            chained: Vec::new(),
-            original: Box::new(None),
-        };
-        d.original = Box::new(Some(d.clone()));
-        d
-    }
-
-    pub fn title(&self) -> &'static str {
-        match self.kind {
-            FormFieldKind::Text => "Text Field Properties",
-            FormFieldKind::CheckBox => "Check Box Properties",
-            FormFieldKind::Radio => "Radio Button Properties",
-            FormFieldKind::Combo => "Dropdown Properties",
-            FormFieldKind::List => "List Box Properties",
-            FormFieldKind::PushButton => "Button Properties",
-            FormFieldKind::Signature => "Digital Signature Properties",
-        }
-    }
-
-    fn tabs(&self) -> Vec<(FieldTab, &'static str)> {
-        let mut t = vec![(FieldTab::General, "General"), (FieldTab::Appearance, "Appearance"), (FieldTab::Position, "Position")];
-        if self.kind != FormFieldKind::Signature {
-            t.push((FieldTab::Options, "Options"));
-        }
-        if matches!(self.kind, FormFieldKind::Text | FormFieldKind::Combo) {
-            t.extend([(FieldTab::Format, "Format"), (FieldTab::Validate, "Validate"), (FieldTab::Calculate, "Calculate")]);
-        }
-        t.push((FieldTab::Actions, "Actions"));
-        t
-    }
-
-    /// The properties that changed (`None` when nothing did).
-    pub fn props(&self) -> Option<FieldProps> {
-        let o = self.original.as_ref().as_ref()?;
-        let ch = |a: bool, b: bool| (a != b).then_some(a);
-        let p = FieldProps {
-            name: (self.name.trim() != o.name).then(|| self.name.trim().to_string()),
-            tooltip: (self.tooltip != o.tooltip).then(|| self.tooltip.clone()),
-            caption: (self.caption != o.caption).then(|| (self.widget, self.caption.clone())),
-            read_only: ch(self.read_only, o.read_only),
-            required: ch(self.required, o.required),
-            multiline: ch(self.multiline, o.multiline),
-            max_len: ((self.limit, self.max_len) != (o.limit, o.max_len)).then_some((self.limit && self.max_len > 0).then_some(self.max_len)),
-            options: (self.options != o.options).then(|| self.options.clone()),
-            font_size: ((self.font_size - o.font_size).abs() > 1e-6).then_some(self.font_size),
-            rect: (self.position != o.position).then(|| {
-                let [x, y, w, h] = self.position;
-                (self.widget, [x, y, x + w.max(4.0), y + h.max(4.0)])
-            }),
-            rotation: (self.rotation != o.rotation).then_some((self.widget, self.rotation)),
-            look: (self.look != o.look).then_some(self.look).flatten(),
-            appearance: None,
-            check_style: (self.check_style != o.check_style).then_some(self.check_style).flatten(),
-            format: (self.format != o.format).then(|| self.format.clone()),
-            validate: (self.validate != o.validate).then(|| self.validate.clone()),
-            calculate: (self.calculate != o.calculate).then(|| self.calculate.clone()),
-            flags: OPTION_FLAGS.iter().filter(|b| (self.flags ^ o.flags) & **b != 0).map(|b| (*b, self.flags & b != 0)).collect(),
-            quadding: (self.quadding != o.quadding).then_some(self.quadding),
-            locked: ch(self.locked, o.locked),
-            actions: (self.actions != o.actions).then(|| self.actions.clone()),
-            default_value: (self.default != o.default).then(|| (!self.default.is_empty()).then(|| self.default.clone())),
-        };
-        (p != FieldProps::default()).then_some(p)
-    }
-}
-
-/// The `/Ff` bits the Options tab edits.
-const OPTION_FLAGS: [u32; 10] = {
-    use pdfcraft_engine::field_flags as ff;
-    [
-        ff::DO_NOT_SCROLL,
-        ff::RICH_TEXT,
-        ff::PASSWORD,
-        ff::FILE_SELECT,
-        ff::DO_NOT_SPELL_CHECK,
-        ff::COMB,
-        ff::SORT,
-        ff::EDIT,
-        ff::MULTI_SELECT,
-        ff::COMMIT_ON_SEL_CHANGE,
-    ]
-};
-
-/// A check box for a `/Ff` bit (`inverted`: checked when the bit is clear).
-fn flag_box(ui: &mut egui::Ui, flags: &mut u32, bit: u32, inverted: bool, label: &str) {
-    let mut on = (*flags & bit != 0) != inverted;
-    if ui.add(widgets::checkbox(&mut on, label)).changed() {
-        if on != inverted {
-            *flags |= bit;
-        } else {
-            *flags &= !bit;
-        }
-    }
-}
-
-/// Shared PDF `/Q` picker for text and choice-field Options.
-fn alignment(ui: &mut egui::Ui, quadding: &mut i64) {
-    ui.label(tl!("Alignment:"));
-    egui::ComboBox::from_id_salt("quadding")
-        .selected_text(tl!(match (*quadding).clamp(0, 2) {
-            1 => "Center",
-            2 => "Right",
-            _ => "Left",
-        }))
-        .show_ui(ui, |ui| {
-            for (q, label) in [(0, tl!("Left")), (1, tl!("Center")), (2, tl!("Right"))] {
-                ui.selectable_value(quadding, q, label);
-            }
-        });
-}
-
-/// Draw Field Properties; returns (apply, cancel).
-pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) -> (bool, bool) {
-    use crate::widgets;
-    ui.set_width(600.0);
-    ui.label(egui::RichText::new(tl!(d.title())).font(theme::semibold(18.0)));
-    ui.add_space(6.0);
-    ui.horizontal_wrapped(|ui| {
-        for (tab, label) in d.tabs() {
-            if widgets::mode_tab(ui, tl!(label), d.tab == tab).clicked() {
-                d.tab = tab;
-            }
-        }
-    });
-    ui.separator();
-    ui.add_space(6.0);
-    let mut enter = false;
-    // A locked field keeps its properties until it is unlocked (Acrobat greys them out).
-    let was_locked = d.original.as_ref().as_ref().is_some_and(|o| o.locked) && d.locked;
-    if was_locked {
-        ui.label(egui::RichText::new(tl!("This field is locked. Unlock it to change its properties.")).small().color(t.text_muted));
-    }
-    ui.scope(|ui| {
-        if was_locked {
-            ui.disable();
-        }
-        match d.tab {
-            FieldTab::General => {
-                egui::Grid::new("field-general").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
-                    let l = ui.label(tl!("Name:"));
-                    let r = ui.add(crate::widgets::line(&mut d.name).desired_width(340.0)).labelled_by(l.id);
-                    enter |= r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
-                    ui.end_row();
-                    let l = ui.label(tl!("Tooltip:"));
-                    ui.add(crate::widgets::line(&mut d.tooltip).desired_width(340.0)).labelled_by(l.id);
-                    ui.end_row();
-                });
-                ui.add_space(12.0);
-                widgets::section_title(ui, tl!("Common Properties"));
-                ui.add(widgets::checkbox(&mut d.read_only, tl!("Read Only")));
-                ui.add(widgets::checkbox(&mut d.required, tl!("Required")));
-            }
-            FieldTab::Appearance => {
-                egui::Grid::new("field-appearance").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
-                    ui.label(tl!("Font Size:"));
-                    let mut auto = d.font_size == 0.0;
-                    ui.horizontal(|ui| {
-                        if ui.add(widgets::checkbox(&mut auto, tl!("Auto"))).changed() {
-                            d.font_size = if auto { 0.0 } else { 12.0 };
-                        }
-                        ui.add_enabled(
-                            !auto,
-                            egui::DragValue::new(&mut d.font_size).range(2.0..=100.0).clamp_existing_to_range(false).speed(0.25).suffix(" pt"),
-                        );
-                    });
-                    ui.end_row();
-                    if let Some(l) = d.look.as_mut() {
-                        ui.label(tl!("Font:"));
-                        egui::ComboBox::from_id_salt("field-font").selected_text(l.font.label()).show_ui(ui, |ui| {
-                            for f in FieldFont::ALL {
-                                ui.selectable_value(&mut l.font, f, f.label());
-                            }
-                        });
-                        ui.end_row();
-                        ui.label(tl!("Text Color:"));
-                        if let Some(c) = crate::comments::swatch_grid(ui, Some(l.text)) {
-                            l.text = c;
-                        }
-                        ui.end_row();
-                    }
-                });
-                if let Some(l) = d.look.as_mut() {
-                    widgets::section_title(ui, tl!("Borders and Colors"));
-                    egui::Grid::new("field-borders").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-                        for (index, (label, slot)) in
-                            [(tl!("Border Color:"), &mut l.border), (tl!("Fill Color:"), &mut l.fill)].into_iter().enumerate()
-                        {
-                            ui.label(label);
-                            ui.push_id(("field-color", index), |ui| {
-                                ui.horizontal(|ui| {
-                                    let mut none = slot.is_none();
-                                    if ui.add(widgets::checkbox(&mut none, tl!("No color"))).changed() {
-                                        *slot = if none { None } else { Some([0.0; 3]) };
-                                    }
-                                    if let Some(c) = crate::comments::swatch_grid(ui, *slot) {
-                                        *slot = Some(c);
-                                    }
-                                });
-                            });
-                            ui.end_row();
-                        }
-                        ui.label(tl!("Line Thickness:"));
-                        let thick = |w: f64| {
-                            if w <= 1.0 {
-                                tl!("Thin")
-                            } else if w <= 2.0 {
-                                tl!("Medium")
-                            } else {
-                                tl!("Thick")
-                            }
-                        };
-                        egui::ComboBox::from_id_salt("field-width").selected_text(thick(l.width)).show_ui(ui, |ui| {
-                            for (w, label) in [(1.0, tl!("Thin")), (2.0, tl!("Medium")), (3.0, tl!("Thick"))] {
-                                ui.selectable_value(&mut l.width, w, label);
-                            }
-                        });
-                        ui.end_row();
-                        ui.label(tl!("Line Style:"));
-                        egui::ComboBox::from_id_salt("field-style").selected_text(tl!(l.style.label())).show_ui(ui, |ui| {
-                            for s in BorderStyle::ALL {
-                                ui.selectable_value(&mut l.style, s, tl!(s.label()));
-                            }
-                        });
-                        ui.end_row();
-                    });
-                }
-            }
-            FieldTab::Position => {
-                egui::Grid::new("field-position").num_columns(4).spacing([12.0, 10.0]).show(ui, |ui| {
-                    for (i, label) in [tl!("Left:"), tl!("Bottom:"), tl!("Width:"), tl!("Height:")].into_iter().enumerate() {
-                        ui.label(label);
-                        let range = if i < 2 { -14_400.0..=14_400.0 } else { 4.0..=14_400.0 };
-                        ui.add(egui::DragValue::new(&mut d.position[i]).range(range).speed(0.5).suffix(" pt"));
-                        if i % 2 == 1 {
-                            ui.end_row();
-                        }
-                    }
-                });
-                ui.label(egui::RichText::new(tl!("Points from the page's bottom-left corner.")).small().color(t.text_faint));
-                ui.add_space(8.0);
-                ui.horizontal(|ui| {
-                    let l = ui.label(tl!("Rotation:"));
-                    let before = d.rotation;
-                    egui::ComboBox::from_id_salt("field-rotation")
-                        .selected_text(format!("{}°", d.rotation))
-                        .show_ui(ui, |ui| {
-                            for r in [0, 90, 180, 270] {
-                                if ui.selectable_value(&mut d.rotation, r, format!("{r}°")).changed() && (before % 180 == 0) != (r % 180 == 0) {
-                                    // Keep the same center. set_props skips its own swap when the rect changed too.
-                                    let [x, y, w, h] = d.position;
-                                    let (cx, cy) = (x + w / 2.0, y + h / 2.0);
-                                    d.position = [cx - h / 2.0, cy - w / 2.0, h, w];
-                                }
-                            }
-                        })
-                        .response
-                        .labelled_by(l.id);
-                });
-            }
-            FieldTab::Format => format_tab(ui, d, t),
-            FieldTab::Validate => validate_tab(ui, d),
-            FieldTab::Calculate => calculate_tab(ui, d, t),
-            FieldTab::Actions => actions_tab(ui, d, t),
-            FieldTab::Options => match d.kind {
-                FormFieldKind::PushButton => {
-                    ui.horizontal(|ui| {
-                        let l = ui.label(tl!("Label"));
-                        ui.add(crate::widgets::line(&mut d.caption).desired_width(340.0)).labelled_by(l.id);
-                    });
-                }
-                FormFieldKind::Text => {
-                    use pdfcraft_engine::field_flags as ff;
-                    egui::Grid::new("text-options").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-                        alignment(ui, &mut d.quadding);
-                        ui.end_row();
-                        let l = ui.label(tl!("Default Value:"));
-                        ui.add(crate::widgets::line(&mut d.default).desired_width(260.0)).labelled_by(l.id);
-                        ui.end_row();
-                    });
-                    ui.add_space(6.0);
-                    ui.add(widgets::checkbox(&mut d.multiline, tl!("Multi-line")));
-                    flag_box(ui, &mut d.flags, ff::DO_NOT_SCROLL, true, tl!("Scroll long text"));
-                    flag_box(ui, &mut d.flags, ff::RICH_TEXT, false, tl!("Allow Rich Text Formatting"));
-                    ui.horizontal(|ui| {
-                        ui.add(widgets::checkbox(&mut d.limit, tl!("Limit of")));
-                        ui.add_enabled(d.limit, egui::DragValue::new(&mut d.max_len).range(0..=10_000));
-                        ui.label(tl!("characters"));
-                    });
-                    flag_box(ui, &mut d.flags, ff::PASSWORD, false, tl!("Password"));
-                    flag_box(ui, &mut d.flags, ff::FILE_SELECT, false, tl!("Field is used for file selection"));
-                    flag_box(ui, &mut d.flags, ff::DO_NOT_SPELL_CHECK, true, tl!("Check spelling"));
-                    ui.horizontal(|ui| {
-                        flag_box(ui, &mut d.flags, ff::COMB, false, tl!("Comb of"));
-                        if d.flags & ff::COMB != 0 {
-                            d.limit = true;
-                            d.multiline = false;
-                            d.flags &= !(ff::PASSWORD | ff::FILE_SELECT);
-                            if d.max_len == 0 {
-                                d.max_len = 10;
-                            }
-                        }
-                        ui.add_enabled(d.flags & ff::COMB != 0, egui::DragValue::new(&mut d.max_len).range(1..=500));
-                        ui.label(tl!("characters"));
-                    });
-                }
-                FormFieldKind::CheckBox | FormFieldKind::Radio => {
-                    use pdfcraft_engine::field_flags as ff;
-                    let on = d.on_state.clone();
-                    ui.label(crate::i18n::fmt(tl!("Export Value: {on}"), &[("on", &on)]));
-                    let mut checked = !d.default.is_empty() && d.default == on;
-                    let label =
-                        if d.kind == FormFieldKind::CheckBox { tl!("Check box is checked by default") } else { tl!("Button is checked by default") };
-                    if ui.add(widgets::checkbox(&mut checked, label)).changed() {
-                        d.default = if checked { on } else { String::new() };
-                    }
-                    if let Some(style) = d.check_style.as_mut() {
-                        ui.horizontal(|ui| {
-                            let l = ui.label(tl!(if d.kind == FormFieldKind::CheckBox { "Check Box Style:" } else { "Button Style:" }));
-                            egui::ComboBox::from_id_salt("check-style")
-                                .selected_text(tl!(style.label()))
-                                .show_ui(ui, |ui| {
-                                    for s in pdfcraft_engine::CheckStyle::ALL {
-                                        ui.selectable_value(style, s, tl!(s.label()));
-                                    }
-                                })
-                                .response
-                                .labelled_by(l.id);
-                        });
-                    }
-                    if d.kind == FormFieldKind::Radio {
-                        flag_box(ui, &mut d.flags, ff::RADIOS_IN_UNISON, false, tl!("Buttons with the same name and value are selected in unison"));
-                    }
-                }
-                _ => {
-                    ui.horizontal(|ui| alignment(ui, &mut d.quadding));
-                    ui.add_space(6.0);
-                    ui.horizontal(|ui| {
-                        let l = ui.label(tl!("Item:"));
-                        let r = ui.add(crate::widgets::line(&mut d.new_option).desired_width(240.0)).labelled_by(l.id);
-                        let typed = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
-                        if (widgets::pill_button(ui, tl!("Add"), false).clicked() || typed) && !d.new_option.trim().is_empty() {
-                            d.options.push(d.new_option.trim().to_string());
-                            d.new_option.clear();
-                        }
-                    });
-                    ui.add_space(6.0);
-                    widgets::section_title(ui, tl!("Item List"));
-                    let mut remove = None;
-                    let mut up = None;
-                    egui::ScrollArea::vertical().max_height(140.0).show(ui, |ui| {
-                        for (i, o) in d.options.iter().enumerate() {
-                            ui.horizontal(|ui| {
-                                ui.label(o);
-                                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                                    if ui.small_button(tl!("Delete")).on_hover_text(crate::i18n::fmt(tl!("Delete {o}"), &[("o", o)])).clicked() {
-                                        remove = Some(i);
-                                    }
-                                    if i > 0 && ui.small_button(tl!("Up")).clicked() {
-                                        up = Some(i);
-                                    }
-                                });
-                            });
-                        }
-                    });
-                    if let Some(i) = remove {
-                        d.options.remove(i);
-                    }
-                    if let Some(i) = up {
-                        d.options.swap(i - 1, i);
-                    }
-                    if d.options.is_empty() {
-                        ui.label(egui::RichText::new(tl!("Add the choices people pick from.")).color(t.text_muted));
-                    }
-                    use pdfcraft_engine::field_flags as ff;
-                    ui.add_space(6.0);
-                    ui.horizontal(|ui| {
-                        ui.label(tl!("Default:"));
-                        let shown = if d.default.is_empty() { tl!("(none)").to_string() } else { d.default.clone() };
-                        egui::ComboBox::from_id_salt("choice-default").selected_text(shown).show_ui(ui, |ui| {
-                            ui.selectable_value(&mut d.default, String::new(), tl!("(none)"));
-                            for o in d.options.clone() {
-                                ui.selectable_value(&mut d.default, o.clone(), o);
-                            }
-                        });
-                    });
-                    flag_box(ui, &mut d.flags, ff::SORT, false, tl!("Sort items"));
-                    if d.kind == FormFieldKind::Combo {
-                        flag_box(ui, &mut d.flags, ff::EDIT, false, tl!("Allow user to enter custom text"));
-                        flag_box(ui, &mut d.flags, ff::DO_NOT_SPELL_CHECK, true, tl!("Check spelling"));
-                    } else {
-                        flag_box(ui, &mut d.flags, ff::MULTI_SELECT, false, tl!("Multiple selection"));
-                    }
-                    flag_box(ui, &mut d.flags, ff::COMMIT_ON_SEL_CHANGE, false, tl!("Commit selected value immediately"));
-                }
-            },
-        }
-    });
-    ui.add_space(8.0);
-    ui.add(widgets::checkbox(&mut d.locked, tl!("Locked")));
-    ui.add_space(6.0);
-    let (mut apply, mut cancel) = (enter, false);
-    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-        if widgets::pill_button(ui, tl!("OK"), true).clicked() {
-            apply = true;
-        }
-        if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-            cancel = true;
-        }
-    });
-    (apply, cancel)
-}
-
-/// The categories of the Format tab.
-#[derive(Clone, Copy, PartialEq)]
-enum Category {
-    None,
-    Number,
-    Percent,
-    Date,
-    Time,
-    Special,
-}
-
-fn category(f: &Format) -> Category {
-    match f {
-        Format::None => Category::None,
-        Format::Number { .. } => Category::Number,
-        Format::Percent { .. } => Category::Percent,
-        Format::Date(_) => Category::Date,
-        Format::Time(_) => Category::Time,
-        Format::Special(_) | Format::Mask(_) => Category::Special,
-    }
-}
-
-const SEPARATORS: [&str; 5] = ["1,234.56", "1234.56", "1.234,56", "1234,56", "1'234.56"];
-const NEGATIVES: [&str; 4] = ["-1,234.01", "1,234.01 (red)", "(1,234.01)", "(1,234.01) (red)"];
-const SPECIALS: [&str; 5] = ["Zip Code", "Zip Code + 4", "Phone Number", "Social Security Number", "Arbitrary Mask"];
-
-fn format_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) {
-    let cat = category(&d.format);
-    let mut picked = cat;
-    ui.horizontal(|ui| {
-        ui.label(tl!("Select format category:"));
-        egui::ComboBox::from_id_salt("format-cat")
-            .selected_text(tl!(match cat {
-                Category::None => "None",
-                Category::Number => "Number",
-                Category::Percent => "Percentage",
-                Category::Date => "Date",
-                Category::Time => "Time",
-                Category::Special => "Special",
-            }))
-            .show_ui(ui, |ui| {
-                for (c, l) in [
-                    (Category::None, tl!("None")),
-                    (Category::Number, tl!("Number")),
-                    (Category::Percent, tl!("Percentage")),
-                    (Category::Date, tl!("Date")),
-                    (Category::Time, tl!("Time")),
-                    (Category::Special, tl!("Special")),
-                ] {
-                    ui.selectable_value(&mut picked, c, l);
-                }
-            });
-    });
-    if picked != cat {
-        d.format = match picked {
-            Category::None => Format::None,
-            Category::Number => Format::Number { decimals: 2, sep: 0, neg: 0, currency: String::new(), prepend: true },
-            Category::Percent => Format::Percent { decimals: 2, sep: 0 },
-            Category::Date => Format::Date("mm/dd/yyyy".into()),
-            Category::Time => Format::Time("HH:MM".into()),
-            Category::Special => Format::Special(0),
-        };
-    }
-    ui.add_space(8.0);
-    let sample = match &d.format {
-        Format::Number { .. } | Format::Percent { .. } => "-1234.5",
-        Format::Date(_) => "10/1/2026",
-        Format::Time(_) => "14:05",
-        Format::Special(2) => "5551234567",
-        Format::Special(3) => "123456789",
-        Format::Special(_) => "123456789",
-        _ => "",
-    };
-    match &mut d.format {
-        Format::None => {
-            ui.label(egui::RichText::new(tl!("The value is shown as typed.")).color(t.text_muted));
-        }
-        Format::Number { decimals, sep, neg, currency, prepend } => {
-            egui::Grid::new("fmt-number").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-                ui.label(tl!("Decimal places:"));
-                ui.add(egui::DragValue::new(decimals).range(0..=10));
-                ui.end_row();
-                ui.label(tl!("Separator style:"));
-                egui::ComboBox::from_id_salt("fmt-sep").selected_text(SEPARATORS[(*sep).min(4) as usize]).show_ui(ui, |ui| {
-                    for (i, s) in SEPARATORS.iter().enumerate() {
-                        ui.selectable_value(sep, i as u8, *s);
-                    }
-                });
-                ui.end_row();
-                ui.label(tl!("Currency symbol:"));
-                ui.horizontal(|ui| {
-                    egui::ComboBox::from_id_salt("fmt-cur")
-                        .selected_text(if currency.is_empty() { tl!("None") } else { currency.as_str() })
-                        .width(70.0)
-                        .show_ui(ui, |ui| {
-                            for c in ["", "$", "€", "£", "¥", "CHF "] {
-                                ui.selectable_value(currency, c.to_string(), if c.is_empty() { tl!("None") } else { c });
-                            }
-                        });
-                    ui.add(widgets::checkbox(prepend, tl!("Before the number")));
-                });
-                ui.end_row();
-                ui.label(tl!("Negative number style:"));
-                egui::ComboBox::from_id_salt("fmt-neg").selected_text(NEGATIVES[(*neg).min(3) as usize]).show_ui(ui, |ui| {
-                    for (i, s) in NEGATIVES.iter().enumerate() {
-                        ui.selectable_value(neg, i as u8, *s);
-                    }
-                });
-                ui.end_row();
-            });
-        }
-        Format::Percent { decimals, sep } => {
-            egui::Grid::new("fmt-pct").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-                ui.label(tl!("Decimal places:"));
-                ui.add(egui::DragValue::new(decimals).range(0..=10));
-                ui.end_row();
-                ui.label(tl!("Separator style:"));
-                egui::ComboBox::from_id_salt("fmt-psep").selected_text(SEPARATORS[(*sep).min(4) as usize]).show_ui(ui, |ui| {
-                    for (i, s) in SEPARATORS.iter().enumerate() {
-                        ui.selectable_value(sep, i as u8, *s);
-                    }
-                });
-                ui.end_row();
-            });
-        }
-        Format::Date(p) | Format::Time(p) => {
-            let presets: Vec<&str> = if matches!(cat, Category::Time) || picked == Category::Time {
-                TIME_PRESETS.to_vec()
-            } else {
-                DATE_PRESETS.iter().copied().chain(["m/d/yyyy", "mm/dd/yyyy", "yyyy-mm-dd", "dd/mm/yyyy"]).collect()
-            };
-            ui.horizontal(|ui| {
-                ui.label(tl!("Format:"));
-                egui::ComboBox::from_id_salt("fmt-date").selected_text(p.as_str()).width(170.0).show_ui(ui, |ui| {
-                    for pr in presets {
-                        ui.selectable_value(p, pr.to_string(), pr);
-                    }
-                });
-                ui.label(tl!("Custom:"));
-                ui.add(crate::widgets::line(p).desired_width(120.0));
-            });
-        }
-        Format::Special(n) => {
-            let mut idx = *n as usize;
-            egui::ComboBox::from_id_salt("fmt-special").selected_text(tl!(SPECIALS[idx.min(4)])).show_ui(ui, |ui| {
-                for (i, s) in SPECIALS.iter().enumerate() {
-                    ui.selectable_value(&mut idx, i, tl!(s));
-                }
-            });
-            if idx == 4 {
-                d.format = Format::Mask("999-999".into());
-            } else {
-                *n = idx as u8;
-            }
-        }
-        Format::Mask(m) => {
-            let mut idx = 4usize;
-            egui::ComboBox::from_id_salt("fmt-special").selected_text(tl!(SPECIALS[4])).show_ui(ui, |ui| {
-                for (i, s) in SPECIALS.iter().enumerate() {
-                    ui.selectable_value(&mut idx, i, tl!(s));
-                }
-            });
-            ui.horizontal(|ui| {
-                ui.label(tl!("Mask:"));
-                ui.add(crate::widgets::line(m).desired_width(160.0));
-            });
-            ui.label(egui::RichText::new(tl!("9 digit, A letter, O letter or digit, X any character")).small().color(t.text_faint));
-            if idx < 4 {
-                d.format = Format::Special(idx as u8);
-            }
-        }
-    }
-    if !sample.is_empty() && d.format != Format::None {
-        ui.add_space(6.0);
-        ui.label(
-            egui::RichText::new(crate::i18n::fmt(tl!("Example: {sample}"), &[("sample", &format_value(&d.format, sample))])).color(t.text_muted),
-        );
-    }
-}
-
-fn validate_tab(ui: &mut egui::Ui, d: &mut FieldDraft) {
-    let mut ranged = matches!(d.validate, Validate::Range { .. });
-    widgets::radio_value(ui, &mut ranged, false, tl!("Field value is not validated"));
-    widgets::radio_value(ui, &mut ranged, true, tl!("Field value is in range:"));
-    if !ranged {
-        d.validate = Validate::None;
-        return;
-    }
-    if d.validate == Validate::None {
-        d.validate = Validate::Range { min: Some(0.0), max: Some(100.0) };
-    }
-    if let Validate::Range { min, max } = &mut d.validate {
-        ui.horizontal(|ui| {
-            let mut has = min.is_some();
-            ui.add(widgets::checkbox(&mut has, tl!("From:")));
-            let mut v = min.unwrap_or(0.0);
-            ui.add_enabled(has, egui::DragValue::new(&mut v).speed(1.0));
-            *min = has.then_some(v);
-            let mut has = max.is_some();
-            ui.add(widgets::checkbox(&mut has, tl!("To:")));
-            let mut v = max.unwrap_or(100.0);
-            ui.add_enabled(has, egui::DragValue::new(&mut v).speed(1.0));
-            *max = has.then_some(v);
-        });
-    }
-}
-
-fn actions_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) {
-    use pdfcraft_engine::FieldTrigger as T;
-    let editing = d.editing.is_some();
-    ui.label(egui::RichText::new(if editing { tl!("Edit Action") } else { tl!("Add an Action") }).font(theme::semibold(13.0)));
-    let a = &mut d.new_action;
-    egui::Grid::new("field-actions-add").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-        ui.label(tl!("Select Trigger:"));
-        // Editing changes the script of one trigger's action: its trigger and kind stay.
-        ui.add_enabled_ui(!editing, |ui| {
-            egui::ComboBox::from_id_salt("action-trigger").selected_text(tl!(a.trigger.label())).width(220.0).show_ui(ui, |ui| {
-                for tr in T::ALL {
-                    ui.selectable_value(&mut a.trigger, tr, tl!(tr.label()));
-                }
-            });
-        });
-        ui.end_row();
-        ui.label(tl!("Select Action:"));
-        ui.add_enabled_ui(!editing, |ui| {
-            egui::ComboBox::from_id_salt("action-kind").selected_text(tl!(ACTION_KINDS[a.kind])).width(220.0).show_ui(ui, |ui| {
-                for (i, k) in ACTION_KINDS.iter().enumerate() {
-                    ui.selectable_value(&mut a.kind, i, tl!(k));
-                }
-            });
-        });
-        ui.end_row();
-        let hint = match a.kind {
-            0 => "JavaScript",
-            1 => "https://…",
-            2 => tl!("Fields to reset (comma-separated; empty: all)"),
-            3 => tl!("Print, NextPage, PrevPage, FirstPage or LastPage"),
-            4 => tl!("Page number"),
-            5 | 6 => tl!("Field names (comma-separated)"),
-            _ => tl!("URL to submit to"),
-        };
-        ui.label(if a.kind == 0 { tl!("Script:") } else { tl!("Value:") });
-        if a.kind == 0 {
-            ui.add(crate::widgets::block(&mut a.text).code_editor().desired_rows(3).desired_width(340.0).hint_text(hint).id_salt("action-text"));
-        } else {
-            ui.add(crate::widgets::line(&mut a.text).desired_width(340.0).hint_text(hint).id_salt("action-text"));
-        }
-        ui.end_row();
-    });
-    let mut error = None;
-    let (mut commit, mut discard) = (false, false);
-    ui.horizontal(|ui| {
-        commit = ui.button(if editing { tl!("Update") } else { tl!("Add") }).clicked();
-        discard = editing && ui.button(tl!("Discard")).clicked();
-    });
-    if commit {
-        match d.new_action.action() {
-            Ok(act) => {
-                let tr = d.new_action.trigger;
-                d.actions.retain(|(x, _)| *x != tr);
-                d.actions.push((tr, act));
-                d.actions.sort_by_key(|(x, _)| T::ALL.iter().position(|y| y == x));
-                d.new_action.text.clear();
-                d.editing = None;
-            }
-            Err(e) => error = Some(e),
-        }
-    }
-    if discard {
-        d.new_action = ActionDraft::default();
-        d.editing = None;
-    }
-    if let Some(e) = error {
-        ui.label(egui::RichText::new(tl!(&e)).small().color(t.text_muted));
-    }
-    ui.add_space(8.0);
-    ui.label(egui::RichText::new(tl!("Actions")).font(theme::semibold(13.0)));
-    egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(8)).show(ui, |ui| {
-        ui.set_width(ui.available_width());
-        if d.actions.is_empty() {
-            ui.label(egui::RichText::new(tl!("No actions")).color(t.text_muted));
-        }
-        let (mut remove, mut edit) = (None, None);
-        for (i, (tr, act)) in d.actions.iter().enumerate() {
-            ui.horizontal(|ui| {
-                ui.label(egui::RichText::new(tl!(tr.label())).strong());
-                let more = d.chained.iter().find(|(x, _)| x == tr).map_or(0, |(_, n)| *n);
-                if more == 0 {
-                    ui.label(act.describe());
-                } else {
-                    let then = crate::i18n::trn(crate::i18n::current(), more as u64, "then {n} more action", "then {n} more actions");
-                    ui.label(format!("{}, {then}", act.describe()));
-                }
-                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                    ui.push_id(i, |ui| {
-                        if ui.button(tl!("Delete")).clicked() {
-                            remove = Some(i);
-                        }
-                        if let pdfcraft_engine::FieldAction::JavaScript(js) = act
-                            && ui.add_enabled(d.editing.is_none(), egui::Button::new(tl!("Edit"))).clicked()
-                        {
-                            edit = Some((*tr, js.clone()));
-                        }
-                    });
-                });
-            });
-        }
-        if let Some((trigger, text)) = edit {
-            d.new_action = ActionDraft { trigger, kind: 0, text };
-            d.editing = Some(trigger);
-        }
-        if let Some(i) = remove {
-            if d.actions.get(i).map(|(x, _)| Some(*x)) == Some(d.editing) {
-                d.new_action = ActionDraft::default();
-                d.editing = None;
-            }
-            d.actions.remove(i);
-        }
-    });
-}
-
-fn calculate_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) {
-    #[derive(PartialEq, Clone, Copy)]
-    enum Mode {
-        None,
-        Simple,
-        Notation,
-    }
-    let mode = match d.calculate {
-        Calculate::None => Mode::None,
-        Calculate::Simple { .. } => Mode::Simple,
-        Calculate::Notation(_) => Mode::Notation,
-    };
-    let mut m = mode;
-    widgets::radio_value(ui, &mut m, Mode::None, tl!("Value is not calculated"));
-    widgets::radio_value(ui, &mut m, Mode::Simple, tl!("Value is the"));
-    if m != mode {
-        d.calculate = match m {
-            Mode::None => Calculate::None,
-            Mode::Simple => Calculate::Simple { op: CalcOp::Sum, fields: Vec::new() },
-            Mode::Notation => Calculate::Notation(String::new()),
-        };
-    }
-    if let Calculate::Simple { op, fields } = &mut d.calculate {
-        ui.horizontal(|ui| {
-            ui.add_space(24.0);
-            egui::ComboBox::from_id_salt("calc-op").selected_text(tl!(op.label())).show_ui(ui, |ui| {
-                for o in CalcOp::ALL {
-                    ui.selectable_value(op, o, tl!(o.label()));
-                }
-            });
-            ui.label(tl!("of the following fields:"));
-        });
-        egui::ScrollArea::vertical().max_height(110.0).show(ui, |ui| {
-            for name in &d.others {
-                let mut on = fields.contains(name);
-                if ui.add(widgets::checkbox(&mut on, name)).changed() {
-                    if on {
-                        fields.push(name.clone());
-                    } else {
-                        fields.retain(|f| f != name);
-                    }
-                }
-            }
-        });
-    }
-    let mut m2 = match d.calculate {
-        Calculate::Notation(_) => Mode::Notation,
-        _ => m,
-    };
-    if widgets::radio_value(ui, &mut m2, Mode::Notation, tl!("Simplified field notation:")).clicked()
-        && !matches!(d.calculate, Calculate::Notation(_))
-    {
-        d.calculate = Calculate::Notation(String::new());
-    }
-    if let Calculate::Notation(expr) = &mut d.calculate {
-        ui.add(crate::widgets::block(expr).hint_text("Price * Quantity").desired_rows(2).desired_width(420.0));
-        ui.label(egui::RichText::new(tl!("Field names with + - * / and parentheses; put \\ before spaces in names.")).small().color(t.text_faint));
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use egui::pos2;
-
-    use super::*;
-
-    #[test]
-    fn corner_drags_stretch_freely_and_keep_proportions_with_shift() {
-        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
-        let free = dragged(r, Grab::Corner(false, false), vec2(24.0, 0.0), false);
-        assert_eq!(free, Rect::from_min_max(pos2(100.0, 100.0), pos2(220.0, 132.0)));
-        for (left, top) in [(true, true), (false, true), (true, false), (false, false)] {
-            let d = vec2(if left { -48.0 } else { 48.0 }, 0.0);
-            let out = dragged(r, Grab::Corner(left, top), d, true);
-            assert!((out.width() / out.height() - 3.0).abs() < 0.001, "{left} {top}: {out:?}");
-            // The opposite corner stays put.
-            assert_eq!(if left { out.max.x } else { out.min.x }, if left { r.max.x } else { r.min.x });
-            assert_eq!(if top { out.max.y } else { out.min.y }, if top { r.max.y } else { r.min.y });
-        }
-        assert_eq!(dragged(r, Grab::Move, vec2(5.0, 6.0), true), r.translate(vec2(5.0, 6.0)));
-    }
-}
diff --git a/crates/ui-egui/src/print_ui.rs b/crates/ui-egui/src/print_ui.rs
deleted file mode 100644
index fcc8d89d97..0000000000
--- a/crates/ui-egui/src/print_ui.rs
+++ /dev/null
@@ -1,1539 +0,0 @@
-//! The Print dialog (Acrobat's File ▸ Print, execution plan M10.5): printer, copies, grayscale;
-//! pages to print (all, current, range with labels, the selected pages; odd/even, reverse); page sizing & handling
-//! (Size, Poster, Multiple, Booklet); orientation; comments & forms; and a live preview of the
-//! sheets. Printing sends the print-ready PDF to the system spooler; "Save as PDF" writes it.
-
-use egui::{Color32, Pos2, Rect, Stroke, pos2, vec2};
-use pdfcraft_engine::print::{self, Binding, BookletSubset, Content, Layout, Orientation, PAPERS, PageOrder, SizeMode, Subset, spool};
-
-use crate::theme::{self, Tokens};
-use crate::{PdfCraftApp, widgets};
-
-/// The preview pane, and the paper inside it (12 pt inset on each side).
-const PREVIEW_W: f32 = 320.0;
-const PREVIEW_H: f32 = 380.0;
-const PREVIEW_INSET: f32 = 12.0;
-pub(crate) const PREVIEW_BOX: (f32, f32) = (PREVIEW_W - 2.0 * PREVIEW_INSET, PREVIEW_H - 2.0 * PREVIEW_INSET);
-/// Label printing reads the printed area of at most this many pages (each is a quick render on
-/// the UI thread); further pages print whole.
-pub(crate) const LABEL_CROP_PAGES: usize = 50;
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Which {
-    All,
-    Current,
-    Range,
-    /// The pages picked in the Pages panel or the organize grid when the dialog opened.
-    Selected,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Handling {
-    Size,
-    Poster,
-    Multiple,
-    Booklet,
-    /// Shipping label: cut to the printed area, turned upright, one per sheet.
-    Label,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct PrintDraft {
-    pub printers: Vec<spool::Printer>,
-    /// The unit the sheet size is shown in (Preferences).
-    pub units: crate::units::Unit,
-    /// The printers are still being listed in the background (see [`PrinterSource`]).
-    pub printers_loading: bool,
-    /// The user chose the printer, so a list arriving late doesn't move it to the default.
-    pub printer_picked: bool,
-    /// `None` = Save as PDF.
-    pub printer: Option<String>,
-    pub copies: u32,
-    pub collate: bool,
-    pub grayscale: bool,
-    /// `None` = the printer's own default (its Properties), as Acrobat does.
-    pub duplex: Option<spool::Duplex>,
-    pub which: Which,
-    pub range: String,
-    /// The pages `Which::Selected` prints (0-based, in page order); empty when none were picked.
-    pub selected: Vec<usize>,
-    pub subset: Subset,
-    pub reverse: bool,
-    pub handling: Handling,
-    pub size: SizeMode,
-    pub custom_scale: f64,
-    pub per_sheet: usize,
-    pub order: PageOrder,
-    pub border: bool,
-    pub auto_rotate: bool,
-    pub booklet_subset: BookletSubset,
-    pub binding: Binding,
-    pub poster_scale: f64,
-    pub overlap: f64,
-    pub cut_marks: bool,
-    pub orientation: Orientation,
-    pub content: Content,
-    /// Print as image (Acrobat's Advanced Print Setup) at `dpi`.
-    pub as_image: bool,
-    pub dpi: f64,
-    pub paper: usize,
-    /// The paper chosen before Label put label stock in, so leaving Label gives it back (#3564).
-    pub paper_before_label: Option<usize>,
-    /// The sheet shown in the preview (0-based).
-    pub sheet: usize,
-    pub current_page: usize,
-    /// The printer driver's own options and the printer they were read for (Properties…, CUPS).
-    pub driver_options: Option<(String, Vec<spool::PrinterOption>)>,
-    /// Driver options set away from the printer's defaults, for `driver_options`' printer.
-    pub driver_choices: std::collections::BTreeMap<String, String>,
-    pub show_driver_options: bool,
-    /// Why the printer's preferences window didn't open (Windows).
-    pub driver_error: Option<String>,
-    /// Label: turn a further 180°.
-    pub label_flip: bool,
-    /// Label: each page's printed area and text direction, read when Label is chosen
-    /// ([`PdfCraftApp::read_label_crops`]); empty until then.
-    pub crops: Vec<Option<print::Crop>>,
-    /// The pages `crops` were read for, so a changed page selection reads them again.
-    pub crop_pages: Option<Vec<usize>>,
-    /// The printer whose options are being read in the background (CUPS runs `lpoptions`,
-    /// which a stuck CUPS can hold up; #1818). The panel says so meanwhile.
-    pub driver_options_loading: Option<String>,
-    /// Properties… asked for this printer's options; the app starts the read on the next frame.
-    pub read_options_for: Option<String>,
-}
-
-impl Default for PrintDraft {
-    fn default() -> Self {
-        PrintDraft {
-            printers: Vec::new(),
-            units: Default::default(),
-            printers_loading: false,
-            printer_picked: false,
-            printer: None,
-            copies: 1,
-            collate: true,
-            grayscale: false,
-            duplex: None,
-            which: Which::All,
-            range: String::new(),
-            selected: Vec::new(),
-            subset: Subset::All,
-            reverse: false,
-            handling: Handling::Size,
-            size: SizeMode::Fit,
-            custom_scale: 100.0,
-            per_sheet: 2,
-            order: PageOrder::Horizontal,
-            border: false,
-            auto_rotate: true,
-            booklet_subset: BookletSubset::BothSides,
-            binding: Binding::Left,
-            poster_scale: 200.0,
-            overlap: 18.0,
-            cut_marks: true,
-            orientation: Orientation::Auto,
-            content: Content::DocumentAndMarkups,
-            as_image: false,
-            dpi: 300.0,
-            paper: 0,
-            paper_before_label: None,
-            sheet: 0,
-            current_page: 0,
-            driver_options: None,
-            driver_choices: Default::default(),
-            show_driver_options: false,
-            driver_error: None,
-            label_flip: false,
-            crops: Vec::new(),
-            crop_pages: None,
-            driver_options_loading: None,
-            read_options_for: None,
-        }
-    }
-}
-
-impl PrintDraft {
-    /// Choose Page Sizing & Handling. Label loads label stock and remembers the paper it
-    /// replaced; leaving Label gives that paper back, unless another one was picked meanwhile.
-    pub fn set_handling(&mut self, handling: Handling) {
-        let leaving_label = self.handling == Handling::Label && handling != Handling::Label;
-        self.handling = handling;
-        self.sheet = 0;
-        if handling == Handling::Label {
-            // A label goes on label stock.
-            if self.paper != print::LABEL_PAPER {
-                self.paper_before_label = Some(self.paper);
-                self.paper = print::LABEL_PAPER;
-            }
-        } else if leaving_label
-            && let Some(paper) = self.paper_before_label.take()
-            && self.paper == print::LABEL_PAPER
-        {
-            self.paper = paper;
-        }
-    }
-
-    /// The engine settings for this draft (page count and labels from the document).
-    pub fn settings(&self, count: usize, labels: &[String]) -> Result<print::Settings, String> {
-        if self.cut_and_stack() && matches!(self.duplex, Some(spool::Duplex::LongEdge | spool::Duplex::ShortEdge)) {
-            return Err("Cut and stack needs Two-sided: Off. Print single-sided sheets.".into());
-        }
-        let range = match self.which {
-            Which::All | Which::Selected | Which::Current => None,
-            Which::Range => Some(self.range.clone()),
-        };
-        // Selected and Current are positions, not a typed range: a range would read numbers as
-        // page labels first.
-        let pages = match self.which {
-            Which::Selected => print::select_listed(count, &self.selected, self.subset, self.reverse),
-            Which::Current => print::select_listed(count, &[self.current_page], self.subset, self.reverse),
-            Which::All | Which::Range => print::select_pages(count, range.as_deref(), labels, self.subset, self.reverse),
-        }
-        // What the person got wrong about what to print is said in their language: the engine hands
-        // the wording over whole and the page numbers apart from it.
-        .map_err(|e| e.said(&crate::i18n::words))?;
-        let layout = match self.handling {
-            Handling::Size => Layout::Size(match self.size {
-                SizeMode::Custom(_) => SizeMode::Custom(self.custom_scale),
-                m => m,
-            }),
-            Handling::Multiple => match Layout::multiple(self.per_sheet) {
-                Layout::Multiple { cols, rows, per_sheet, .. } => {
-                    Layout::Multiple { cols, rows, per_sheet, order: self.order, border: self.border, auto_rotate: self.auto_rotate }
-                }
-                other => other,
-            },
-            Handling::Booklet => Layout::Booklet { subset: self.booklet_subset, binding: self.binding },
-            Handling::Poster => Layout::Poster { scale: self.poster_scale, overlap: self.overlap, cut_marks: self.cut_marks },
-            Handling::Label => Layout::Label { flip: self.label_flip },
-        };
-        Ok(print::Settings {
-            pages,
-            paper: PAPERS[self.paper.min(PAPERS.len() - 1)].1,
-            orientation: self.orientation,
-            layout,
-            content: self.content,
-            raster: self.as_image.then_some(print::Raster { dpi: self.dpi, grayscale: self.grayscale }),
-            crops: self.crops.clone(),
-        })
-    }
-
-    fn cut_and_stack(&self) -> bool {
-        self.handling == Handling::Multiple && self.order == PageOrder::CutStack
-    }
-
-    /// The spooler job for this print: the dialog's copies, two-sided and colour settings, the
-    /// driver options changed from the printer's defaults, and the chosen paper.
-    pub fn job(&self, title: &str) -> spool::Job {
-        spool::Job {
-            printer: self.printer.clone(),
-            copies: self.copies.max(1),
-            collate: self.collate,
-            // Cut and stack needs single-sided sheets, whatever the printer's default; a booklet
-            // decides two-sided itself (#2707), leaving the Two-sided choice as it was.
-            duplex: if self.cut_and_stack() {
-                Some(spool::Duplex::Off)
-            } else if self.handling == Handling::Booklet {
-                Some(print::booklet_duplex(self.booklet_subset))
-            } else {
-                self.duplex
-            },
-            scaling: spool::Scaling::Exact,
-            grayscale: self.grayscale,
-            title: title.to_string(),
-            // Only for the printer the options were read from.
-            options: match (&self.printer, &self.driver_options) {
-                (Some(p), Some((read_for, _))) if p == read_for => self.driver_choices.iter().map(|(k, v)| (k.clone(), v.clone())).collect(),
-                _ => Vec::new(),
-            }
-            .into_iter()
-            // The sheet the PDF was laid out on, not the queue's default paper.
-            .chain(print::media_option(self.paper))
-            .collect(),
-        }
-    }
-}
-
-/// Lists the printers off the UI thread (the desktop app sets [`PdfCraftApp::printer_source`]):
-/// on Windows each driver's capabilities are read for its two-sided support, and CUPS' driverless discovery can wait on
-/// the network. Without a source the dialog reads them as it opens, so tests stay deterministic.
-pub type PrinterSource = std::sync::Arc<dyn Fn() -> Vec<spool::Printer> + Send + Sync>;
-
-/// Where a printer's driver options come from: the spooler's (`spool::printer_options_in`, in the
-/// UI language) unless a test stands in. Called off the GUI thread.
-pub type OptionsSource = std::sync::Arc<dyn Fn(&str) -> Vec<spool::PrinterOption> + Send + Sync>;
-
-/// The system spooler's printers, as the desktop app's [`PrinterSource`].
-pub fn system_printers() -> PrinterSource {
-    std::sync::Arc::new(spool::printers)
-}
-
-/// The Print dialog's work in the background: the printer list being read, and the jobs being
-/// spooled, oldest first.
-#[derive(Default)]
-pub(crate) struct PrintTasks {
-    #[cfg(not(target_arch = "wasm32"))]
-    printers: Option<std::sync::mpsc::Receiver<Vec<spool::Printer>>>,
-    #[cfg(not(target_arch = "wasm32"))]
-    jobs: Vec<PrintJob>,
-    /// The progress card is showing a print job (it is shared with other long jobs).
-    #[cfg(not(target_arch = "wasm32"))]
-    showing_progress: bool,
-    /// The driver options being read, per printer (`read_options_in_background`).
-    #[cfg(not(target_arch = "wasm32"))]
-    options: Vec<(String, std::sync::mpsc::Receiver<Vec<spool::PrinterOption>>)>,
-    /// The browser print being drawn, a sheet a frame (`web_print`).
-    #[cfg(target_arch = "wasm32")]
-    web_job: Option<crate::web_print::WebPrintJob>,
-    /// What went wrong after the browser print page was handed over, with the print-ready PDF
-    /// to download instead.
-    #[cfg(target_arch = "wasm32")]
-    web_failed: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
-    /// The last browser print's PDF and name, for that fallback.
-    #[cfg(target_arch = "wasm32")]
-    web_last: Option<(String, std::sync::Arc<Vec<u8>>)>,
-}
-
-/// The printers to offer when no [`PrinterSource`] is set: the spooler's, or in a browser its
-/// print dialog.
-fn listed_printers() -> Vec<spool::Printer> {
-    #[cfg(target_arch = "wasm32")]
-    {
-        vec![spool::Printer { name: crate::web_print::BROWSER_PRINTER.to_string(), default: true, two_sided: None }]
-    }
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        spool::printers()
-    }
-}
-
-/// The first list is still being read and the user hasn't chosen yet (#160): no printer is
-/// selected only because none is known yet, so the dialog says it is looking rather than
-/// offering Save as PDF, and its button waits. Printing then would have saved a PDF.
-fn still_looking(d: &PrintDraft) -> bool {
-    d.printers_loading && d.printer.is_none() && !d.printer_picked
-}
-
-/// A printer's name as the dialog shows it.
-fn printer_label(name: &str) -> String {
-    if name == crate::web_print::BROWSER_PRINTER { crate::web_print::browser_printer_label().to_string() } else { name.to_string() }
-}
-
-/// A job being spooled: its printer, the sheets sent so far of how many, and its worker's news.
-#[cfg(not(target_arch = "wasm32"))]
-struct PrintJob {
-    printer: String,
-    sheets: Option<(usize, usize)>,
-    news: std::sync::mpsc::Receiver<JobNews>,
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-enum JobNews {
-    /// `(sent, sheets)`: the spooler has this many of the job's sheets.
-    Sent(usize, usize),
-    /// The spooler's answer.
-    Done(Result<String, String>),
-}
-
-/// The printer the dialog preselects: the system default, else the first.
-fn default_printer(printers: &[spool::Printer]) -> Option<String> {
-    printers.iter().find(|p| p.default).or(printers.first()).map(|p| p.name.clone())
-}
-
-/// Whether `printer` can still be chosen from `printers`: Save as PDF (`None`) always can.
-fn offered(printer: Option<&str>, printers: &[spool::Printer]) -> bool {
-    printer.is_none_or(|name| printers.iter().any(|p| p.name == name))
-}
-
-/// Asks for a frame when a worker thread ends, also when it panics: [`PdfCraftApp::poll_print`]
-/// then sees the answer, or the disconnected channel of a worker that died, without waiting
-/// for some other event to draw (#2108 review). Declared before the worker's sender, so the
-/// sender is dropped first and the frame finds the channel closed.
-#[cfg(not(target_arch = "wasm32"))]
-struct WakeOnExit(Option<egui::Context>);
-
-#[cfg(not(target_arch = "wasm32"))]
-impl Drop for WakeOnExit {
-    fn drop(&mut self) {
-        if let Some(ctx) = &self.0 {
-            ctx.request_repaint();
-        }
-    }
-}
-
-impl PdfCraftApp {
-    pub fn open_print(&mut self) {
-        let Some((i, _)) = self.active_ids() else { return };
-        let (printers, printers_loading) = match self.printer_source.clone() {
-            // The list from the last time the dialog opened, until the fresh one arrives.
-            #[cfg(not(target_arch = "wasm32"))]
-            Some(source) => {
-                self.list_printers_in_background(source);
-                (self.print_draft.printers.clone(), true)
-            }
-            _ => (listed_printers(), false),
-        };
-        let default = default_printer(&printers);
-        let current = self.views[i].current;
-        let selected: Vec<usize> = self.views[i].selected.iter().copied().collect();
-        let keep = std::mem::take(&mut self.print_draft);
-        // The printer picked last time, Save as PDF included, while it is still listed (#3537).
-        let picked = keep.printer_picked && offered(keep.printer.as_deref(), &printers);
-        let printer = if picked { keep.printer.clone() } else { default };
-        // Picked pages are what Print is for (Acrobat's "Selected pages"); without any, a choice
-        // left over from another document falls back to the whole document.
-        let which = match (selected.is_empty(), keep.which) {
-            (false, _) => Which::Selected,
-            (true, Which::Selected) => Which::All,
-            (true, other) => other,
-        };
-        self.print_draft = PrintDraft {
-            crops: Vec::new(),
-            crop_pages: None,
-            printers,
-            printers_loading,
-            printer_picked: picked,
-            units: self.units,
-            printer,
-            current_page: current,
-            sheet: 0,
-            selected,
-            which,
-            ..keep
-        };
-        self.dialog = Some(crate::Dialog::Print);
-    }
-
-    /// Label printing: find each printed page's printed area (a quick low-resolution render, as
-    /// Fit Visible does) and which way its text runs. Only the pages being printed are read, at
-    /// most [`LABEL_CROP_PAGES`] of them (the rest print whole); read again when they change.
-    pub(crate) fn read_label_crops(&mut self, id: pdfcraft_engine::DocId) {
-        let Some(doc) = self.session.get(id) else { return };
-        let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
-        let mut pages = self.print_draft.settings(doc.info.pages.len(), &labels).map(|s| s.pages).unwrap_or_default();
-        pages.sort_unstable();
-        pages.dedup();
-        pages.truncate(LABEL_CROP_PAGES);
-        if self.print_draft.crop_pages.as_ref() == Some(&pages) {
-            return;
-        }
-        let up = self.session.print_text_up(id, &pages);
-        let config = pdfcraft_render::RenderConfig { password: doc.password.as_deref().map(std::sync::Arc::from), ..Default::default() };
-        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), config);
-        self.print_draft.crops = doc
-            .info
-            .pages
-            .iter()
-            .enumerate()
-            .map(|(page, p)| {
-                let (w, h) = (f64::from(p.width), f64::from(p.height));
-                if pages.binary_search(&page).is_err() || w <= 0.0 || h <= 0.0 {
-                    return None;
-                }
-                let out = r.render(pdfcraft_render::RenderRequest {
-                    page,
-                    kind: pdfcraft_render::RequestKind::Pixels,
-                    tile: None,
-                    scale: (1000.0 / w.max(h) as f32).clamp(0.1, 4.0),
-                    tag: 0,
-                    preview: false,
-                });
-                let [u0, v0, u1, v1] = crate::zoom_snap::ink_bounds(out.width as usize, out.height as usize, &out.rgba)?;
-                // Image rows run down from the top; display space runs up. Half a millimetre of slack.
-                let pad = 1.5;
-                let rect = [f64::from(u0) * w - pad, (1.0 - f64::from(v1)) * h - pad, f64::from(u1) * w + pad, (1.0 - f64::from(v0)) * h + pad];
-                Some(print::Crop { rect, text_up: up.get(page).copied().unwrap_or(false) })
-            })
-            .collect();
-        self.print_draft.crop_pages = Some(pages);
-    }
-
-    #[cfg(not(target_arch = "wasm32"))]
-    fn list_printers_in_background(&mut self, source: PrinterSource) {
-        // A list already being read is as fresh as a new one would be.
-        if self.print_tasks.printers.is_some() {
-            return;
-        }
-        let (tx, rx) = std::sync::mpsc::channel();
-        let wake = WakeOnExit(self.ctx.clone());
-        std::thread::spawn(move || {
-            let _wake = wake;
-            let tx = tx;
-            // The receiver may be gone (the app quit): nothing to report to then.
-            let _ = tx.send(source());
-        });
-        self.print_tasks.printers = Some(rx);
-    }
-
-    /// Read `printer`'s driver options off the GUI thread (#1818); `poll_print` picks them up.
-    /// A read already under way for the same printer is left to finish.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn read_options_in_background(&mut self, printer: String) {
-        if self.print_tasks.options.iter().any(|(p, _)| *p == printer) {
-            return;
-        }
-        let source: OptionsSource = self.options_source.clone().unwrap_or_else(|| {
-            // The driver's own names in the UI language, as it is when Properties… is clicked.
-            let lang = crate::i18n::current().code();
-            std::sync::Arc::new(move |p: &str| spool::printer_options_in(p, lang))
-        });
-        let (tx, rx) = std::sync::mpsc::channel();
-        let wake = WakeOnExit(self.ctx.clone());
-        let name = printer.clone();
-        let spawned = std::thread::Builder::new().name("printer options".into()).spawn(move || {
-            let _wake = wake;
-            let tx = tx;
-            // The receiver may be gone (the app quit): nothing to report to then.
-            let _ = tx.send(source(&name));
-        });
-        match spawned {
-            Ok(_) => self.print_tasks.options.push((printer, rx)),
-            // No thread to read them on: the printer offers nothing this time.
-            Err(_) => self.receive_options(printer, Vec::new()),
-        }
-    }
-
-    /// The options read for `printer` arrived, or the read died. A read that a later click
-    /// superseded (another printer's is awaited) is dropped.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn receive_options(&mut self, printer: String, options: Vec<spool::PrinterOption>) {
-        let d = &mut self.print_draft;
-        if d.driver_options_loading.as_deref() == Some(printer.as_str()) {
-            d.driver_options_loading = None;
-            d.driver_options = Some((printer, options));
-        }
-    }
-
-    /// Pick up a printer list, driver options or a spooled job that finished (each frame).
-    pub(crate) fn poll_print(&mut self) {
-        #[cfg(target_arch = "wasm32")]
-        self.poll_web_print();
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            if let Some(printer) = self.print_draft.read_options_for.take() {
-                self.read_options_in_background(printer);
-            }
-            let mut arrived = Vec::new();
-            self.print_tasks.options.retain(|(printer, rx)| match rx.try_recv() {
-                Ok(options) => {
-                    arrived.push((printer.clone(), options));
-                    false
-                }
-                Err(std::sync::mpsc::TryRecvError::Empty) => true,
-                // A read that died offers nothing; the panel says so rather than wait.
-                Err(std::sync::mpsc::TryRecvError::Disconnected) => {
-                    arrived.push((printer.clone(), Vec::new()));
-                    false
-                }
-            });
-            for (printer, options) in arrived {
-                self.receive_options(printer, options);
-            }
-            if let Some(rx) = &self.print_tasks.printers {
-                let printers = match rx.try_recv() {
-                    Ok(p) => Some(p),
-                    Err(std::sync::mpsc::TryRecvError::Empty) => None,
-                    // A source that died lists nothing new; the dialog keeps what it has.
-                    Err(std::sync::mpsc::TryRecvError::Disconnected) => Some(self.print_draft.printers.clone()),
-                };
-                if let Some(printers) = printers {
-                    self.print_tasks.printers = None;
-                    let d = &mut self.print_draft;
-                    // A picked printer that is no longer listed falls back to the default too.
-                    if !d.printer_picked || !offered(d.printer.as_deref(), &printers) {
-                        d.printer_picked = false;
-                        d.printer = default_printer(&printers);
-                    }
-                    d.printers = printers;
-                    d.printers_loading = false;
-                }
-            }
-            let mut finished = Vec::new();
-            self.print_tasks.jobs.retain_mut(|job| {
-                loop {
-                    match job.news.try_recv() {
-                        Ok(JobNews::Sent(sent, sheets)) => job.sheets = Some((sent, sheets)),
-                        Ok(JobNews::Done(r)) => {
-                            finished.push((job.printer.clone(), r));
-                            break false;
-                        }
-                        Err(std::sync::mpsc::TryRecvError::Empty) => break true,
-                        Err(std::sync::mpsc::TryRecvError::Disconnected) => {
-                            finished.push((job.printer.clone(), Err("the print job stopped unexpectedly".into())));
-                            break false;
-                        }
-                    }
-                }
-            });
-            self.show_print_progress();
-            for (printer, result) in finished {
-                self.report_print_job(&printer, result);
-            }
-        }
-    }
-
-    /// The oldest job being spooled on the progress card, counting its sheets as they reach the
-    /// spooler, while no other long job holds the card.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn show_print_progress(&mut self) {
-        let Some(job) = self.print_tasks.jobs.first() else {
-            if std::mem::take(&mut self.print_tasks.showing_progress) {
-                self.progress_notice = None;
-            }
-            return;
-        };
-        if self.progress_notice.is_some() && !self.print_tasks.showing_progress {
-            return;
-        }
-        let printer = job.printer.as_str();
-        let (label, fraction) = match job.sheets {
-            Some((sent, sheets)) if sheets > 0 => {
-                // The sheet on its way: one past those sent, until the last is.
-                let sheet = sent.saturating_add(1).min(sheets).to_string();
-                let label = crate::i18n::fmt(
-                    tl!("Sending sheet {s} of {n} to {printer}…"),
-                    &[("s", &sheet), ("n", &sheets.to_string()), ("printer", printer)],
-                );
-                (label, sent as f32 / sheets as f32)
-            }
-            _ => (crate::i18n::fmt(tl!("Sending to {printer}…"), &[("printer", printer)]), 0.0),
-        };
-        self.progress_notice = Some(crate::widgets::ProgressNotice { label, fraction, cancellable: false });
-        self.print_tasks.showing_progress = true;
-        // The bar's sweep keeps moving between sheets.
-        if let Some(ctx) = &self.ctx {
-            ctx.request_repaint_after(std::time::Duration::from_millis(100));
-        }
-    }
-
-    fn report_print_job(&mut self, printer: &str, result: Result<String, String>) {
-        match result {
-            Ok(msg) if msg.is_empty() => self.notify(crate::i18n::fmt(tl!("Sent to {printer}"), &[("printer", printer)])),
-            Ok(msg) => self.notify(crate::i18n::fmt(tl!("Sent to {printer}: {msg}"), &[("printer", printer), ("msg", &msg)])),
-            Err(e) => self.notify_error(e),
-        }
-    }
-
-    /// Print (or save) with the dialog's settings. Returns `true` on success. Save as PDF without
-    /// a preset path returns `true` once the save picker is showing; the file is written on a
-    /// later frame, when the user has chosen where.
-    pub fn print_now(&mut self) -> bool {
-        // What's typed in a form field is part of what's printed (#166).
-        if !self.commit_form_typing() {
-            return false;
-        }
-        let Some((_, id)) = self.active_ids() else { return false };
-        let Some(doc) = self.session.get(id) else { return false };
-        let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
-        let settings = match self.print_draft.settings(doc.info.pages.len(), &labels) {
-            Ok(s) => s,
-            Err(e) => {
-                self.notify_tr(&e);
-                return false;
-            }
-        };
-        let name = doc.name.clone();
-        let bytes = match self.session.print_pdf(id, &settings) {
-            Ok(b) => b,
-            Err(e) => {
-                self.notify_error(e);
-                return false;
-            }
-        };
-        match self.print_draft.printer.clone() {
-            #[cfg(target_arch = "wasm32")]
-            Some(printer) if printer == crate::web_print::BROWSER_PRINTER => {
-                let sizes: Vec<(f64, f64)> = doc.info.pages.iter().map(|p| (f64::from(p.width), f64::from(p.height))).collect();
-                match print::layout(&sizes, &settings) {
-                    Ok(sheets) => self.print_in_browser(name, bytes, sheets.iter().map(|s| s.size).collect()),
-                    Err(e) => {
-                        self.notify_error(e);
-                        false
-                    }
-                }
-            }
-            Some(printer) => self.send_to_printer(printer, bytes, self.print_draft.job(&name)),
-            None => self.save_print_pdf(&name, bytes),
-        }
-    }
-
-    /// Spool a job off the UI thread: on Windows every sheet is rendered at the printer's
-    /// resolution first, which can take minutes for a long document. The dialog closes at once,
-    /// the progress card counts the sheets as they reach the spooler, and the spooler's answer
-    /// arrives as a notice.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn send_to_printer(&mut self, printer: String, bytes: Vec<u8>, job: spool::Job) -> bool {
-        let (tx, rx) = std::sync::mpsc::channel();
-        let ctx = self.ctx.clone();
-        std::thread::spawn(move || {
-            let repaint = || {
-                if let Some(ctx) = &ctx {
-                    ctx.request_repaint();
-                }
-            };
-            // The receiver may be gone (the app quit): nothing to report to then.
-            let result = spool::submit_with_progress(&bytes, &job, &mut |sent, sheets| {
-                let _ = tx.send(JobNews::Sent(sent, sheets));
-                repaint();
-            });
-            let _ = tx.send(JobNews::Done(result.map_err(|e| e.to_string())));
-            repaint();
-        });
-        self.print_tasks.jobs.push(PrintJob { printer, sheets: None, news: rx });
-        self.show_print_progress();
-        true
-    }
-
-    /// A browser has no spooler: `submit` answers at once.
-    #[cfg(target_arch = "wasm32")]
-    fn send_to_printer(&mut self, printer: String, bytes: Vec<u8>, job: spool::Job) -> bool {
-        let result = spool::submit(&bytes, &job).map_err(|e| e.to_string());
-        let ok = result.is_ok();
-        self.report_print_job(&printer, result);
-        ok
-    }
-
-    /// Print through the browser's print dialog: start drawing `sheets` (the pages of the
-    /// print-ready `bytes`), a sheet a frame in [`PdfCraftApp::poll_print`]. A print still being
-    /// prepared is replaced. The dialog closes at once.
-    #[cfg(target_arch = "wasm32")]
-    fn print_in_browser(&mut self, name: String, bytes: Vec<u8>, sheets: Vec<(f64, f64)>) -> bool {
-        match crate::web_print::WebPrintJob::new(bytes, sheets, name) {
-            Ok(job) => {
-                let n = job.total().to_string();
-                self.print_tasks.web_job = Some(job);
-                self.notify_fmt("Preparing {n} sheets for printing…", &[("n", &n)]);
-                if let Some(ctx) = &self.ctx {
-                    ctx.request_repaint();
-                }
-                true
-            }
-            Err(e) => {
-                self.notify_error(e);
-                false
-            }
-        }
-    }
-
-    /// Draw the next sheet of the browser print, and hand the finished page to the browser.
-    #[cfg(target_arch = "wasm32")]
-    fn poll_web_print(&mut self) {
-        let failed: Vec<String> = self.print_tasks.web_failed.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
-        if let Some(e) = failed.into_iter().next() {
-            self.web_print_failed(&e);
-        }
-        let Some(job) = self.print_tasks.web_job.as_mut() else { return };
-        if !job.finished() {
-            if let Err(e) = job.step(&mut crate::web_print::blob_url) {
-                self.print_tasks.web_job = None;
-                self.notify_error(e);
-                return;
-            }
-            let (done, total) = (job.done().to_string(), job.total().to_string());
-            self.notify_fmt("Preparing sheet {done} of {total} for printing…", &[("done", &done), ("total", &total)]);
-            if let Some(ctx) = &self.ctx {
-                ctx.request_repaint();
-            }
-            return;
-        }
-        let Some(mut job) = self.print_tasks.web_job.take() else { return };
-        let html = job.html();
-        let urls = job.take_urls();
-        self.print_tasks.web_last = Some((job.name.clone(), job.pdf.clone()));
-        match crate::web_print::print_in_iframe(&html, urls, self.print_tasks.web_failed.clone(), self.ctx.clone()) {
-            Ok(()) => self.notify_tr("Opening the browser's print dialog…"),
-            Err(e) => self.web_print_failed(&e),
-        }
-    }
-
-    /// The browser wouldn't print (a sandboxed frame, a picture it couldn't decode): offer the
-    /// print-ready PDF as a download instead, so the work isn't lost.
-    #[cfg(target_arch = "wasm32")]
-    fn web_print_failed(&mut self, error: &str) {
-        let Some((name, pdf)) = self.print_tasks.web_last.take() else {
-            self.notify_error(error);
-            return;
-        };
-        let stem = name.trim_end_matches(".pdf").trim_end_matches(".PDF");
-        let file = format!("{stem} (print).pdf");
-        match crate::editing::download(&file, &pdf) {
-            Ok(()) => self.notify_fmt("Couldn't print from the browser ({e}); downloaded {name} to print instead", &[("e", error), ("name", &file)]),
-            Err(_) => self.notify_error(error),
-        }
-    }
-
-    /// Print ▸ Save as PDF on the desktop: write to `save_override` (tests and automation), or
-    /// ask where and write on a later frame. Returns `true` once written, or once the save picker
-    /// is showing.
-    #[cfg(not(target_arch = "wasm32"))]
-    fn save_print_pdf(&mut self, name: &str, bytes: Vec<u8>) -> bool {
-        let write = move |app: &mut Self, path: std::path::PathBuf| match crate::editing::write_atomically(&path.to_string_lossy(), &bytes) {
-            Ok(()) => {
-                app.notify_fmt("Saved the print-ready PDF to {path}", &[("path", &path.display().to_string())]);
-                true
-            }
-            Err(e) => {
-                app.notify_fmt("Could not save: {e}", &[("e", &e.to_string())]);
-                false
-            }
-        };
-        match self.save_override.clone() {
-            Some(p) => write(self, p.into()),
-            None => {
-                let stem = name.trim_end_matches(".pdf").trim_end_matches(".PDF");
-                let dialog = rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).set_file_name(format!("{stem} (print).pdf"));
-                self.ask_one(crate::pickers::Ask::Save(dialog), None, move |app, path| {
-                    write(app, path);
-                })
-            }
-        }
-    }
-
-    /// Print ▸ Save as PDF in a browser: download it, as Save does (#170). There is no folder to
-    /// choose and no file system to write to, so `save_override` doesn't apply.
-    #[cfg(target_arch = "wasm32")]
-    fn save_print_pdf(&mut self, name: &str, bytes: Vec<u8>) -> bool {
-        let stem = name.trim_end_matches(".pdf").trim_end_matches(".PDF");
-        let file = format!("{stem} (print).pdf");
-        match crate::editing::download(&file, &bytes) {
-            Ok(()) => {
-                self.notify_fmt("Downloaded {name}", &[("name", &file)]);
-                true
-            }
-            Err(e) => {
-                self.notify_fmt("Couldn't download {name}: {e}", &[("name", &file), ("e", &e)]);
-                false
-            }
-        }
-    }
-}
-
-/// The longest side, in pixels, of one page's print-preview raster (also kept within the GPU's
-/// `max_texture_side`): an Actual-size print of a large page would otherwise ask for a raster
-/// bigger than a texture can be.
-pub(crate) const PREVIEW_MAX_SIDE: f32 = 4096.0;
-/// The most bytes of print-preview rasters kept at once. The current sheet comes first, then the
-/// next and the previous one; a neighbour that doesn't fit isn't rendered ahead.
-pub(crate) const PREVIEW_BYTES: f64 = 128.0 * 1024.0 * 1024.0;
-
-/// Pages on the current sheet and its neighbours, each with the device pixels per point that
-/// fill the preview pane (so the picture is not a stretched thumbnail), nearest sheet first and
-/// within [`PREVIEW_MAX_SIDE`] (and `max_side`, the GPU's texture limit) and [`PREVIEW_BYTES`].
-pub(crate) fn preview_rasters(d: &PrintDraft, sizes: &[(f64, f64)], labels: &[String], ppp: f32, max_side: f32) -> Vec<(usize, f32)> {
-    let Ok(settings) = d.settings(sizes.len(), labels) else { return Vec::new() };
-    let Ok(sheets) = print::layout(sizes, &settings) else { return Vec::new() };
-    if sheets.is_empty() {
-        return Vec::new();
-    }
-    let ppp = if ppp.is_finite() { ppp.max(1.0) } else { 1.0 };
-    let side = if max_side.is_finite() && max_side >= 1.0 { max_side.min(PREVIEW_MAX_SIDE) } else { PREVIEW_MAX_SIDE };
-    let i = d.sheet.min(sheets.len() - 1);
-    // Nearest first: the sheet on screen, then the next one, then the previous one.
-    let order = [Some(i), i.checked_add(1).filter(|n| *n < sheets.len()), i.checked_sub(1)];
-    let mut out: Vec<(usize, f32, f64)> = Vec::new();
-    let mut bytes = 0.0f64;
-    for sheet in order.into_iter().flatten().filter_map(|s| sheets.get(s)) {
-        let (sw, sh) = (sheet.size.0 as f32, sheet.size.1 as f32);
-        if !(sw.is_finite() && sh.is_finite()) || sw < 1.0 || sh < 1.0 {
-            continue;
-        }
-        let k = (PREVIEW_BOX.0 / sw).min(PREVIEW_BOX.1 / sh);
-        for pl in &sheet.placed {
-            let [a, b, _, _, _, _] = pl.matrix.0;
-            let placed = (a.hypot(b) as f32) * k * ppp;
-            let Some(&(pw, ph)) = sizes.get(pl.page) else { continue };
-            let long_pt = pw.max(ph) as f32;
-            if !placed.is_finite() || placed < 0.05 || !long_pt.is_finite() || long_pt < 1.0 {
-                continue;
-            }
-            let scale = placed.min(64.0).min(side / long_pt);
-            let cost = (pw * f64::from(scale)).ceil() * (ph * f64::from(scale)).ceil() * 4.0;
-            if let Some(slot) = out.iter_mut().find(|(page, _, _)| *page == pl.page) {
-                if scale > slot.1 && bytes - slot.2 + cost <= PREVIEW_BYTES {
-                    bytes += cost - slot.2;
-                    (slot.1, slot.2) = (scale, cost);
-                }
-            } else if out.len() < 48 && (out.is_empty() || bytes + cost <= PREVIEW_BYTES) {
-                bytes += cost;
-                out.push((pl.page, scale, cost));
-            }
-        }
-    }
-    out.into_iter().map(|(page, scale, _)| (page, scale)).collect()
-}
-
-/// Properties… on CUPS: the driver's options for this print, grouped as the driver groups them.
-/// Only choices away from the printer's defaults are kept, and sent with the job.
-fn driver_options_panel(ui: &mut egui::Ui, d: &mut PrintDraft, t: &Tokens) {
-    let PrintDraft { driver_options: Some((_, options)), driver_choices: choices, show_driver_options: show, .. } = d else { return };
-    egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
-        ui.set_width(ui.available_width());
-        ui.horizontal(|ui| {
-            ui.label(egui::RichText::new(tl!("Printer properties")).font(theme::semibold(13.0)));
-            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                if ui.button(tl!("Done")).clicked() {
-                    *show = false;
-                }
-                if ui.add_enabled(!choices.is_empty(), egui::Button::new(tl!("Reset to printer defaults"))).clicked() {
-                    choices.clear();
-                }
-            });
-        });
-        if options.is_empty() {
-            ui.label(egui::RichText::new(tl!("This printer offers no settings of its own.")).small().color(t.text_muted));
-            return;
-        }
-        egui::ScrollArea::vertical().id_salt("driver-options").max_height(240.0).show(ui, |ui| {
-            for (n, chunk) in options.chunk_by(|a, b| a.group == b.group).enumerate() {
-                let group = chunk.first().map_or("", |o| o.group.as_str());
-                if !group.is_empty() {
-                    ui.add_space(4.0);
-                    // Option and group names are the driver's own text.
-                    ui.label(egui::RichText::new(group).small().color(t.text_muted));
-                }
-                egui::Grid::new(("driver-group", n)).num_columns(2).spacing([10.0, 4.0]).show(ui, |ui| {
-                    for o in chunk {
-                        ui.label(&o.label);
-                        let current = choices.get(&o.key).cloned().unwrap_or_else(|| o.default.clone());
-                        let label_of = |c: &str| o.choices.iter().find(|(k, _)| k == c).map_or_else(|| c.to_string(), |(_, l)| l.clone());
-                        let mut pick = current.clone();
-                        egui::ComboBox::from_id_salt(("driver-option", &o.key)).selected_text(label_of(&current)).width(200.0).show_ui(ui, |ui| {
-                            for (k, l) in &o.choices {
-                                ui.selectable_value(&mut pick, k.clone(), l.as_str());
-                            }
-                        });
-                        if pick != current {
-                            if pick == o.default {
-                                choices.remove(&o.key);
-                            } else {
-                                choices.insert(o.key.clone(), pick);
-                            }
-                        }
-                        ui.end_row();
-                    }
-                });
-            }
-        });
-    });
-}
-
-fn combo<T: PartialEq + Copy>(ui: &mut egui::Ui, id: &str, value: &mut T, choices: &[(T, &str)], width: f32) {
-    let shown = choices.iter().find(|c| c.0 == *value).map_or("", |c| c.1);
-    egui::ComboBox::from_id_salt(id).selected_text(shown).width(width).show_ui(ui, |ui| {
-        for (v, label) in choices {
-            ui.selectable_value(value, *v, *label);
-        }
-    });
-}
-
-/// Draw the dialog. `thumb` gives a page's thumbnail texture when there is one. Returns
-/// (print, cancel).
-pub(crate) fn body(
-    ui: &mut egui::Ui,
-    d: &mut PrintDraft,
-    t: &Tokens,
-    sizes: &[(f64, f64)],
-    labels: &[String],
-    thumb: &mut dyn FnMut(usize) -> Option<egui::TextureId>,
-) -> (bool, bool) {
-    ui.set_width(820.0);
-    ui.label(egui::RichText::new(tl!("Print")).font(theme::semibold(18.0)));
-    ui.add_space(8.0);
-    let settings = d.settings(sizes.len(), labels);
-    let sheets = settings.as_ref().ok().and_then(|s| print::layout(sizes, s).ok()).unwrap_or_default();
-    d.sheet = d.sheet.min(sheets.len().saturating_sub(1));
-    ui.horizontal_top(|ui| {
-        // Settings.
-        ui.vertical(|ui| {
-            ui.set_width(470.0);
-            egui::Grid::new("print-top").num_columns(2).spacing([10.0, 8.0]).show(ui, |ui| {
-                ui.label(tl!("Printer:"));
-                let before = d.printer.clone();
-                // The browser's print dialog sets copies, two-sided printing and colour itself.
-                let browser = d.printer.as_deref() == Some(crate::web_print::BROWSER_PRINTER);
-                ui.horizontal(|ui| {
-                    let shown = match d.printer.as_deref() {
-                        Some(p) => printer_label(p),
-                        None if still_looking(d) => tl!("Looking for printers…").to_string(),
-                        None => tl!("Save as PDF").to_string(),
-                    };
-                    egui::ComboBox::from_id_salt("printer").selected_text(shown).width(260.0).show_ui(ui, |ui| {
-                        if d.printers_loading {
-                            ui.add_enabled(false, egui::Label::new(tl!("Looking for printers…")));
-                        }
-                        for p in &d.printers {
-                            let name = printer_label(&p.name);
-                            let label = if p.default && p.name != crate::web_print::BROWSER_PRINTER {
-                                crate::i18n::fmt(tl!("{name} (default)"), &[("name", &name)])
-                            } else {
-                                name
-                            };
-                            ui.selectable_value(&mut d.printer, Some(p.name.clone()), label);
-                        }
-                        // Chosen even when it was already the selection, so the list arriving
-                        // later doesn't replace it with the default printer.
-                        if ui.selectable_value(&mut d.printer, None, tl!("Save as PDF")).clicked() {
-                            d.printer_picked = true;
-                        }
-                    });
-                    let tip = if spool::HAS_PRINTER_PREFERENCES {
-                        tl!("Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.")
-                    } else {
-                        tl!("The printer driver's own settings for this print: paper tray, paper type, finishing and more.")
-                    };
-                    let properties = ui.add_enabled(d.printer.is_some() && !browser, egui::Button::new(tl!("Properties…"))).on_hover_text(tip);
-                    if properties.clicked()
-                        && let Some(p) = d.printer.clone()
-                    {
-                        if spool::HAS_PRINTER_PREFERENCES {
-                            d.driver_error = spool::open_printer_preferences(&p).err().map(|e| e.to_string());
-                        } else {
-                            if d.driver_options.as_ref().is_none_or(|(read_for, _)| *read_for != p) && d.driver_options_loading.as_deref() != Some(p.as_str()) {
-                                // Read off the GUI thread (#1818): `poll_print` starts it next frame.
-                                d.driver_options = None;
-                                d.driver_choices.clear();
-                                d.driver_options_loading = Some(p.clone());
-                                d.read_options_for = Some(p);
-                            }
-                            d.show_driver_options = !d.show_driver_options;
-                        }
-                    }
-                });
-                if d.printer != before {
-                    d.printer_picked = true;
-                    d.show_driver_options = false;
-                    d.driver_error = None;
-                }
-                ui.end_row();
-                // The spooler answered with no printer at all (#160): say so, rather than
-                // leaving Save as PDF looking like the only thing PdfCraft can do.
-                if !d.printers_loading && d.printers.is_empty() {
-                    ui.label("");
-                    ui.label(
-                        egui::RichText::new(tl!("No printers were found. Check that the printer is installed and the print spooler is running, then open Print again."))
-                            .small()
-                            .color(t.text_muted),
-                    );
-                    ui.end_row();
-                }
-                ui.label(tl!("Copies:"));
-                ui.add_enabled_ui(!browser, |ui| {
-                    ui.horizontal(|ui| {
-                        ui.add(egui::DragValue::new(&mut d.copies).range(1..=999));
-                        ui.add(widgets::checkbox(&mut d.collate, tl!("Collate")));
-                        ui.add(widgets::checkbox(&mut d.grayscale, tl!("Print in grayscale")));
-                    });
-                });
-                ui.end_row();
-                // A booklet decides two-sided itself (#2707), so the choice is hidden meanwhile, as
-                // in Acrobat's Print dialog; it is kept for the other layouts.
-                if d.handling != Handling::Booklet {
-                    ui.label(tl!("Two-sided:"));
-                    ui.add_enabled_ui(!browser, |ui| {
-                        combo(
-                            ui,
-                            "duplex",
-                            &mut d.duplex,
-                            &[
-                                (None, tl!("Printer default")),
-                                (Some(spool::Duplex::Off), tl!("Off")),
-                                (Some(spool::Duplex::LongEdge), tl!("Flip on long edge")),
-                                (Some(spool::Duplex::ShortEdge), tl!("Flip on short edge")),
-                            ],
-                            160.0,
-                        );
-                    });
-                    ui.end_row();
-                }
-                ui.label(tl!("Paper:"));
-                let paper_name = PAPERS.get(d.paper).map_or("US Letter", |p| p.0);
-                let before = d.paper;
-                egui::ComboBox::from_id_salt("paper").selected_text(tl!(paper_name)).width(260.0).show_ui(ui, |ui| {
-                    for (i, (name, _)) in PAPERS.iter().enumerate() {
-                        ui.selectable_value(&mut d.paper, i, tl!(name));
-                    }
-                });
-                // Label stock gets the label layout (cut, turned upright, fitted).
-                if d.paper != before && d.paper == print::LABEL_PAPER {
-                    d.paper_before_label = Some(before);
-                    d.handling = Handling::Label;
-                    d.sheet = 0;
-                }
-                ui.end_row();
-            });
-            // Windows says which drivers can't print two-sided as they're asked; they keep their
-            // own setting, even when Two-sided is Off.
-            if let Some(p) = d.printers.iter().find(|p| d.printer.as_ref() == Some(&p.name))
-                && p.two_sided == Some(false)
-            {
-                ui.label(egui::RichText::new(tl!("This printer's driver doesn't take two-sided settings from other programs, so its own setting applies. Change it in Properties…")).small().color(t.text_muted));
-            }
-            if d.printer.as_deref() == Some(crate::web_print::BROWSER_PRINTER) {
-                ui.label(egui::RichText::new(tl!("Copies, two-sided printing and colour are chosen in the browser's print dialog.")).small().color(t.text_muted));
-            }
-            if let Some(e) = &d.driver_error {
-                ui.label(egui::RichText::new(crate::i18n::fmt(tl!("Couldn't open the printer's preferences: {e}"), &[("e", e)])).small().color(t.text_muted));
-            }
-            if d.show_driver_options {
-                if d.driver_options.is_none() && d.driver_options_loading.is_some() {
-                    ui.label(egui::RichText::new(tl!("Reading the printer's settings…")).small().color(t.text_muted));
-                } else {
-                    driver_options_panel(ui, d, t);
-                }
-            }
-            if let Some(&source) = sizes.get(d.current_page) {
-                ui.horizontal_wrapped(|ui| {
-                    ui.label(crate::i18n::fmt(tl!("PDF page: {size}"), &[("size", &d.units.size(source.0, source.1))]));
-                    let matched = print::matching_paper(source);
-                    if ui.add_enabled(matched.is_some(), egui::Button::new(tl!("Match page at 100%"))).clicked()
-                        && let Some(paper) = matched
-                    {
-                        d.paper = paper;
-                        // A paper picked outright: nothing for leaving Label to give back.
-                        d.paper_before_label = None;
-                        d.handling = Handling::Size;
-                        d.size = SizeMode::Actual;
-                        d.orientation = Orientation::Auto;
-                        d.sheet = 0;
-                    }
-                });
-            }
-            ui.add_space(6.0);
-            widgets::section_title(ui, tl!("Pages to Print"));
-            ui.horizontal(|ui| {
-                widgets::radio_value(ui, &mut d.which, Which::All, tl!("All"));
-                widgets::radio_value(ui, &mut d.which, Which::Current, tl!("Current page"));
-                widgets::radio_value(ui, &mut d.which, Which::Range, tl!("Pages"));
-                let r = ui.add_enabled(
-                    d.which == Which::Range,
-                    crate::widgets::line(&mut d.range).hint_text(format!("1-{}", sizes.len())).desired_width(110.0),
-                );
-                if r.gained_focus() {
-                    d.which = Which::Range;
-                }
-            });
-            // Offered only when pages were picked before the dialog opened.
-            if !d.selected.is_empty() {
-                let label = format!("{} ({})", tl!("Selected pages"), d.selected.len());
-                widgets::radio_value(ui, &mut d.which, Which::Selected, label);
-            }
-            ui.horizontal(|ui| {
-                ui.label(tl!("More options:"));
-                combo(
-                    ui,
-                    "subset",
-                    &mut d.subset,
-                    &[(Subset::All, tl!("All pages in range")), (Subset::Odd, tl!("Odd pages only")), (Subset::Even, tl!("Even pages only"))],
-                    150.0,
-                );
-                ui.add(widgets::checkbox(&mut d.reverse, tl!("Reverse pages")));
-            });
-            ui.add_space(6.0);
-            widgets::section_title(ui, tl!("Page Sizing & Handling"));
-            ui.horizontal_wrapped(|ui| {
-                for (h, label) in [
-                    (Handling::Size, tl!("Size")),
-                    (Handling::Poster, tl!("Poster")),
-                    (Handling::Multiple, tl!("Multiple")),
-                    (Handling::Booklet, tl!("Booklet")),
-                    (Handling::Label, tl!("Label")),
-                ] {
-                    if widgets::mode_tab(ui, label, d.handling == h).clicked() {
-                        d.set_handling(h);
-                    }
-                }
-            });
-            ui.add_space(4.0);
-            match d.handling {
-                Handling::Size => {
-                    ui.horizontal(|ui| {
-                        widgets::radio_value(ui, &mut d.size, SizeMode::Fit, tl!("Fit"));
-                        widgets::radio_value(ui, &mut d.size, SizeMode::Actual, tl!("Actual size"));
-                        widgets::radio_value(ui, &mut d.size, SizeMode::Shrink, tl!("Shrink oversized pages"));
-                    });
-                    ui.horizontal(|ui| {
-                        let custom = matches!(d.size, SizeMode::Custom(_));
-                        if ui.add(widgets::radio(custom, tl!("Custom scale:"))).clicked() {
-                            d.size = SizeMode::Custom(d.custom_scale);
-                        }
-                        ui.add_enabled(custom, egui::DragValue::new(&mut d.custom_scale).range(1.0..=1000.0).suffix(" %"));
-                    });
-                }
-                Handling::Label => {
-                    ui.add(widgets::checkbox(&mut d.label_flip, tl!("Turn upside down (180°)")));
-                    ui.label(
-                        egui::RichText::new(tl!("Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet."))
-                            .small()
-                            .color(t.text_muted),
-                    );
-                }
-                Handling::Poster => {
-                    ui.horizontal(|ui| {
-                        ui.label(tl!("Tile scale:"));
-                        ui.add(egui::DragValue::new(&mut d.poster_scale).range(10.0..=1000.0).suffix(" %"));
-                        ui.label(tl!("Overlap:"));
-                        ui.add(egui::DragValue::new(&mut d.overlap).range(0.0..=144.0).suffix(" pt"));
-                        ui.add(widgets::checkbox(&mut d.cut_marks, tl!("Cut marks")));
-                    });
-                }
-                Handling::Multiple => {
-                    ui.horizontal(|ui| {
-                        ui.label(tl!("Pages per sheet:"));
-                        combo(ui, "per-sheet", &mut d.per_sheet, &[(2, "2"), (4, "4"), (6, "6"), (9, "9"), (16, "16")], 60.0);
-                        ui.label(tl!("Page order:"));
-                        combo(
-                            ui,
-                            "order",
-                            &mut d.order,
-                            &[
-                                (PageOrder::Horizontal, tl!("Horizontal")),
-                                (PageOrder::HorizontalReversed, tl!("Horizontal reversed")),
-                                (PageOrder::Vertical, tl!("Vertical")),
-                                (PageOrder::VerticalReversed, tl!("Vertical reversed")),
-                                (PageOrder::CutStack, tl!("Cut and stack")),
-                            ],
-                            150.0,
-                        );
-                    });
-                    ui.horizontal(|ui| {
-                        ui.add(widgets::checkbox(&mut d.border, tl!("Print page border")));
-                        ui.add(widgets::checkbox(&mut d.auto_rotate, tl!("Auto-rotate pages")));
-                    });
-                    if d.order == PageOrder::CutStack {
-                        ui.label(tl!(
-                            "Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom."
-                        ));
-                    }
-                }
-                Handling::Booklet => {
-                    ui.horizontal(|ui| {
-                        ui.label(tl!("Booklet subset:"));
-                        combo(
-                            ui,
-                            "booklet",
-                            &mut d.booklet_subset,
-                            &[
-                                (BookletSubset::BothSides, tl!("Both sides")),
-                                (BookletSubset::FrontOnly, tl!("Front side only")),
-                                (BookletSubset::BackOnly, tl!("Back side only")),
-                            ],
-                            130.0,
-                        );
-                        ui.label(tl!("Binding:"));
-                        combo(ui, "binding", &mut d.binding, &[(Binding::Left, tl!("Left")), (Binding::Right, tl!("Right"))], 80.0);
-                    });
-                }
-            }
-            ui.add_space(6.0);
-            ui.horizontal(|ui| {
-                ui.label(tl!("Orientation:"));
-                widgets::radio_value(ui, &mut d.orientation, Orientation::Auto, tl!("Auto portrait/landscape"));
-                widgets::radio_value(ui, &mut d.orientation, Orientation::Portrait, tl!("Portrait"));
-                widgets::radio_value(ui, &mut d.orientation, Orientation::Landscape, tl!("Landscape"));
-            });
-            ui.add_space(6.0);
-            widgets::section_title(ui, tl!("Comments & Forms"));
-            combo(
-                ui,
-                "content",
-                &mut d.content,
-                &[
-                    (Content::Document, tl!("Document")),
-                    (Content::DocumentAndMarkups, tl!("Document and markups")),
-                    (Content::DocumentAndStamps, tl!("Document and stamps")),
-                    (Content::FormFieldsOnly, tl!("Form fields only")),
-                ],
-                220.0,
-            );
-            // Advanced (Acrobat's Advanced Print Setup): print as image. Folded unless it is on.
-            ui.add_space(6.0);
-            egui::CollapsingHeader::new(egui::RichText::new(crate::i18n::upper_label("Advanced")).font(theme::semibold(10.5)).color(t.text_faint))
-                .id_salt("print-advanced")
-                .default_open(d.as_image)
-                .show(ui, |ui| {
-                    ui.horizontal(|ui| {
-                        ui.add(widgets::checkbox(&mut d.as_image, tl!("Print as image")));
-                        ui.add_enabled_ui(d.as_image, |ui| {
-                            ui.label(tl!("Resolution:"));
-                            let mut dpi = d.dpi.round() as u32;
-                            combo(ui, "print-dpi", &mut dpi, &[(150, "150 dpi"), (300, "300 dpi"), (600, "600 dpi")], 100.0);
-                            d.dpi = f64::from(dpi);
-                        });
-                    });
-                    ui.label(
-                        egui::RichText::new(tl!(
-                            "Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey."
-                        ))
-                        .small()
-                        .color(t.text_muted),
-                    );
-                });
-        });
-        ui.add_space(12.0);
-        // Preview.
-        ui.vertical(|ui| {
-            ui.set_width(PREVIEW_W);
-            let (area, _) = ui.allocate_exact_size(vec2(PREVIEW_W, PREVIEW_H), egui::Sense::hover());
-            ui.painter().rect_filled(area, 6.0, t.hover);
-            match (&settings, sheets.get(d.sheet)) {
-                (Err(e), _) => {
-                    ui.put(area.shrink(16.0), egui::Label::new(egui::RichText::new(tl!(e)).color(t.text_muted)).wrap());
-                }
-                (Ok(_), Some(sheet)) => {
-                    let k = (PREVIEW_BOX.0 / sheet.size.0 as f32).min(PREVIEW_BOX.1 / sheet.size.1 as f32);
-                    let paper = Rect::from_center_size(area.center(), vec2(sheet.size.0 as f32 * k, sheet.size.1 as f32 * k));
-                    ui.painter().rect_filled(paper, 0.0, Color32::WHITE);
-                    ui.painter().rect_stroke(paper, 0.0, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
-                    let to_screen = |x: f64, y: f64| -> Pos2 { pos2(paper.left() + x as f32 * k, paper.bottom() - y as f32 * k) };
-                    let painter = ui.painter().with_clip_rect(paper);
-                    for pl in &sheet.placed {
-                        let (dw, dh) = sizes[pl.page];
-                        let [x0, y0, x1, y1] = pl.clip;
-                        let corners = [(x0, y0), (x1, y0), (x1, y1), (x0, y1)].map(|(x, y)| {
-                            let (sx, sy) = pl.matrix.apply(x, y);
-                            to_screen(sx, sy)
-                        });
-                        // UVs of the visible part (texture y runs down from the page top).
-                        let uv = |x: f64, y: f64| pos2((x / dw) as f32, (1.0 - y / dh) as f32);
-                        let uvs = [uv(x0, y0), uv(x1, y0), uv(x1, y1), uv(x0, y1)];
-                        match thumb(pl.page) {
-                            Some(tex) => {
-                                let mut mesh = egui::Mesh::with_texture(tex);
-                                for (p, u) in corners.iter().zip(uvs) {
-                                    mesh.vertices.push(egui::epaint::Vertex {
-                                        pos: *p,
-                                        uv: u,
-                                        color: if d.grayscale { Color32::from_gray(235) } else { Color32::WHITE },
-                                    });
-                                }
-                                mesh.indices.extend_from_slice(&[0, 1, 2, 0, 2, 3]);
-                                painter.add(egui::Shape::mesh(mesh));
-                            }
-                            None => {
-                                painter.add(egui::Shape::convex_polygon(
-                                    corners.to_vec(),
-                                    Color32::from_gray(245),
-                                    Stroke::new(0.5, Color32::from_gray(180)),
-                                ));
-                                let c = corners.iter().fold(vec2(0.0, 0.0), |a, p| a + p.to_vec2()) / 4.0;
-                                painter.text(
-                                    c.to_pos2(),
-                                    egui::Align2::CENTER_CENTER,
-                                    (pl.page + 1).to_string(),
-                                    theme::regular(11.0),
-                                    Color32::from_gray(120),
-                                );
-                            }
-                        }
-                    }
-                    for b in &sheet.borders {
-                        painter.rect_stroke(
-                            Rect::from_two_pos(to_screen(b[0], b[1]), to_screen(b[2], b[3])),
-                            0.0,
-                            Stroke::new(0.6, Color32::BLACK),
-                            egui::StrokeKind::Middle,
-                        );
-                    }
-                    for l in &sheet.lines {
-                        painter.line_segment([to_screen(l[0], l[1]), to_screen(l[2], l[3])], Stroke::new(0.6, Color32::BLACK));
-                    }
-                }
-                _ => {}
-            }
-            ui.horizontal(|ui| {
-                let n = sheets.len();
-                if ui.add_enabled(d.sheet > 0, egui::Button::new("‹")).on_hover_text(tl!("Previous sheet")).clicked() {
-                    d.sheet -= 1;
-                }
-                ui.label(if n == 0 {
-                    tl!("No sheets").to_string()
-                } else {
-                    crate::i18n::fmt(tl!("Sheet {s} of {n}"), &[("s", &(d.sheet + 1).to_string()), ("n", &n.to_string())])
-                });
-                if ui.add_enabled(d.sheet + 1 < n, egui::Button::new("›")).on_hover_text(tl!("Next sheet")).clicked() {
-                    d.sheet += 1;
-                }
-            });
-            if let Some(s) = sheets.get(d.sheet) {
-                ui.label(egui::RichText::new(d.units.size(s.size.0, s.size.1)).small().color(t.text_muted));
-                if d.handling == Handling::Size
-                    && let Some(p) = s.placed.first()
-                {
-                    let scale = p.matrix.0[0].hypot(p.matrix.0[1]) * 100.0;
-                    ui.label(crate::i18n::fmt(tl!("PDF scale: {scale}%"), &[("scale", &format!("{scale:.2}"))]));
-                    ui.label(egui::RichText::new(tl!("Printer paper and scaling may differ. Check driver settings.")).small().color(t.text_muted));
-                    if (scale - 100.0).abs() > 0.01 {
-                        ui.label(egui::RichText::new(tl!("Drawing scale changes. Use Actual size for full-scale plans.")).small().color(t.text_muted));
-                    }
-                }
-            }
-        });
-    });
-    ui.add_space(12.0);
-    let (mut go, mut cancel) = (false, false);
-    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-        let looking = still_looking(d);
-        let label = if d.printer.is_some() || looking { tl!("Print") } else { tl!("Save as PDF") };
-        if ui.add_enabled_ui(settings.is_ok() && !sheets.is_empty() && !looking, |ui| widgets::pill_button(ui, label, true)).inner.clicked() {
-            go = true;
-        }
-        if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-            cancel = true;
-        }
-    });
-    (go, cancel)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn current_page_preview_uses_positions_and_selection_guards() {
-        for labels in [["i", "ii", "iii", "1", "2"], ["1", "1", "1", "1", "1"], ["1", "2", "3", "4", "5"]] {
-            let labels: Vec<String> = labels.into_iter().map(str::to_owned).collect();
-            for current_page in 0..5 {
-                let draft = PrintDraft { which: Which::Current, current_page, ..Default::default() };
-                let rasters = preview_rasters(&draft, &[(200.0, 300.0); 5], &labels, 1.0, 8192.0);
-                assert_eq!(rasters.iter().map(|(page, _)| *page).collect::<Vec<_>>(), vec![current_page]);
-            }
-        }
-        let labels: Vec<String> = ["i", "ii", "iii", "1", "2"].into_iter().map(str::to_owned).collect();
-        let mut draft = PrintDraft { which: Which::Selected, selected: vec![0, 3], ..Default::default() };
-        assert_eq!(draft.settings(5, &labels).unwrap().pages, vec![0, 3]);
-        draft.which = Which::All;
-        assert_eq!(draft.settings(5, &labels).unwrap().pages, vec![0, 1, 2, 3, 4]);
-        draft.which = Which::Current;
-        draft.reverse = true;
-        draft.subset = Subset::Odd;
-        assert_eq!(draft.settings(5, &labels).unwrap().pages, vec![0]);
-        draft.subset = Subset::Even;
-        assert!(draft.settings(5, &labels).is_err());
-        draft.subset = Subset::All;
-        for (count, current) in [(0, 0), (5, 5), (5, usize::MAX)] {
-            draft.current_page = current;
-            assert!(draft.settings(count, &labels).is_err());
-        }
-    }
-
-    #[test]
-    fn composed_sheets_keep_exact_scaling_and_the_dialogs_duplex_choice() {
-        let draft = PrintDraft { duplex: Some(spool::Duplex::LongEdge), ..PrintDraft::default() };
-        let job = draft.job("report.pdf");
-        assert_eq!(job.scaling, spool::Scaling::Exact);
-        assert_eq!(job.duplex, Some(spool::Duplex::LongEdge));
-        let off = PrintDraft { duplex: Some(spool::Duplex::Off), ..PrintDraft::default() };
-        assert_eq!(off.job("report.pdf").duplex, Some(spool::Duplex::Off));
-    }
-
-    /// Untouched, Two-sided sends nothing, so the duplex set in the printer's Properties applies
-    /// (#2422); cut and stack still asks for single-sided sheets.
-    #[test]
-    fn two_sided_follows_the_printer_until_chosen() {
-        assert_eq!(PrintDraft::default().duplex, None);
-        assert_eq!(PrintDraft::default().job("report.pdf").duplex, None);
-        let mut cut = PrintDraft { handling: Handling::Multiple, order: PageOrder::CutStack, ..PrintDraft::default() };
-        assert_eq!(cut.job("report.pdf").duplex, Some(spool::Duplex::Off));
-        assert!(cut.settings(4, &[]).is_ok(), "the printer's default doesn't block cut and stack");
-        cut.duplex = Some(spool::Duplex::ShortEdge);
-        assert!(cut.settings(4, &[]).is_err());
-    }
-
-    /// A job being spooled holds the progress card, counting its sheets as the spooler reports
-    /// them; the card goes when the job ends and its answer arrives as a notice. A card another
-    /// long job is showing is left alone.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn the_progress_card_counts_the_sheets_of_a_print_job() {
-        let mut app = PdfCraftApp::new();
-        app.set_option("language", "en").unwrap();
-        let (tx, rx) = std::sync::mpsc::channel();
-        app.print_tasks.jobs.push(PrintJob { printer: "Office".into(), sheets: None, news: rx });
-        app.poll_print();
-        assert_eq!(app.progress_notice.as_ref().map(|p| p.label.as_str()), Some("Sending to Office…"));
-
-        tx.send(JobNews::Sent(0, 3)).unwrap();
-        tx.send(JobNews::Sent(1, 3)).unwrap();
-        app.poll_print();
-        let shown = app.progress_notice.clone().unwrap();
-        assert_eq!(shown.label, "Sending sheet 2 of 3 to Office…");
-        assert!((shown.fraction - 1.0 / 3.0).abs() < 1e-4 && !shown.cancellable, "{shown:?}");
-
-        tx.send(JobNews::Sent(3, 3)).unwrap();
-        tx.send(JobNews::Done(Ok(String::new()))).unwrap();
-        app.poll_print();
-        assert!(app.progress_notice.is_none() && app.print_tasks.jobs.is_empty());
-        assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("Sent to Office"));
-
-        // Another job's card stays; a worker that vanished is reported, not left spinning.
-        let other = crate::widgets::ProgressNotice { label: "Optimizing…".into(), fraction: 0.5, cancellable: true };
-        app.progress_notice = Some(other.clone());
-        let (tx, rx) = std::sync::mpsc::channel();
-        app.print_tasks.jobs.push(PrintJob { printer: "Office".into(), sheets: None, news: rx });
-        tx.send(JobNews::Sent(1, 2)).unwrap();
-        app.poll_print();
-        assert_eq!(app.progress_notice, Some(other));
-        drop(tx);
-        app.poll_print();
-        assert!(app.print_tasks.jobs.is_empty() && app.progress_notice.is_some());
-        assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("the print job stopped unexpectedly"));
-    }
-
-    /// Issue #1308: Current page is the page on screen, even when a later page is labelled with
-    /// its number. A typed range still reads labels first.
-    #[test]
-    fn current_page_is_the_viewed_page_not_a_label() {
-        let labels: Vec<String> = ["i", "ii", "iii", "1", "2"].map(String::from).to_vec();
-        for (current, want) in [(0, vec![0]), (1, vec![1]), (3, vec![3])] {
-            let d = PrintDraft { which: Which::Current, current_page: current, ..PrintDraft::default() };
-            assert_eq!(d.settings(5, &labels).map(|s| s.pages), Ok(want), "viewing page {}", current + 1);
-        }
-        let typed = PrintDraft { which: Which::Range, range: "1".into(), ..PrintDraft::default() };
-        assert_eq!(typed.settings(5, &labels).map(|s| s.pages), Ok(vec![3]));
-    }
-
-    #[test]
-    fn print_preview_rasters_stay_within_the_texture_limit() {
-        // Actual size on a 14,400 pt (200 in) page would ask for a raster far past any texture.
-        let d = PrintDraft { size: SizeMode::Actual, ..PrintDraft::default() };
-        let sizes = vec![(14_400.0, 14_400.0); 2];
-        let labels = vec!["1".into(), "2".into()];
-        for max_side in [2048.0, 8192.0, 16384.0, f32::NAN, 0.0] {
-            for (page, scale) in preview_rasters(&d, &sizes, &labels, 4.0, max_side) {
-                let long = 14_400.0 * scale;
-                let cap = if max_side.is_finite() && max_side >= 1.0 { max_side.min(PREVIEW_MAX_SIDE) } else { PREVIEW_MAX_SIDE };
-                assert!(long <= cap + 1.0, "page {page} at {max_side}: {long} px");
-            }
-        }
-    }
-
-    #[test]
-    fn print_preview_rasters_keep_the_current_sheet_within_the_byte_budget() {
-        // Many large pages: the current sheet always gets its raster; neighbours only while the
-        // budget lasts, and the total stays within it.
-        let d = PrintDraft { sheet: 5, ..PrintDraft::default() };
-        let sizes = vec![(2_000.0, 2_000.0); 12];
-        let labels: Vec<String> = (1..=12).map(|n| n.to_string()).collect();
-        let rasters = preview_rasters(&d, &sizes, &labels, 4.0, 16384.0);
-        assert_eq!(rasters.first().map(|r| r.0), Some(5), "the sheet on screen comes first: {rasters:?}");
-        let total: f64 = rasters.iter().map(|(_, s)| (2_000.0 * f64::from(*s)).ceil().powi(2) * 4.0).sum();
-        assert!(total <= PREVIEW_BYTES || rasters.len() == 1, "{total} bytes for {rasters:?}");
-    }
-
-    #[test]
-    fn print_preview_is_sharper_than_a_thumbnail_on_a_high_dpi_screen() {
-        let d = PrintDraft::default();
-        let sizes = vec![(612.0, 792.0); 3];
-        let labels = vec!["1".into(), "2".into(), "3".into()];
-        let rasters = preview_rasters(&d, &sizes, &labels, 2.0, 8192.0);
-        let scale = rasters.iter().find(|(page, _)| *page == 0).map(|(_, s)| *s).unwrap();
-        // A 132 pt thumbnail at 2× is about 0.43 px/pt. The preview pane needs roughly twice that.
-        assert!(scale > 0.7, "letter page in the preview at 2 px/pt: {scale}");
-        assert!(rasters.iter().any(|(page, _)| *page == 1), "the next sheet is ready");
-        let mut later = d.clone();
-        later.sheet = 2;
-        let rasters = preview_rasters(&later, &sizes, &labels, 2.0, 8192.0);
-        assert!(rasters.iter().any(|(page, _)| *page == 2));
-    }
-}
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
new file mode 100644
index 0000000000..dd3b3e90aa
--- /dev/null
+++ b/crates/ui-egui/src/state.rs
@@ -0,0 +1,417 @@
+use super::*;
+
+/// Top-level workspace modes (Acrobat's mode bar).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Mode {
+    #[serde(rename = "all")]
+    AllTools,
+    Read,
+    Edit,
+    Convert,
+    Sign,
+}
+
+impl Mode {
+    pub(crate) fn parse(value: &str) -> Option<Self> {
+        match value {
+            "all" => Some(Self::AllTools),
+            "read" => Some(Self::Read),
+            "edit" => Some(Self::Edit),
+            "convert" => Some(Self::Convert),
+            "sign" => Some(Self::Sign),
+            _ => None,
+        }
+    }
+}
+
+/// What the left panel shows.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LeftPanel {
+    AllTools,
+    Tool(&'static str),
+    /// Prepare a form ▸ Calculation order, a page of its own; Back returns to Prepare a form.
+    CalculationOrder,
+}
+
+/// Right-hand panels, opened from the rail.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, serde::Serialize, serde::Deserialize)]
+pub enum RightPanel {
+    Comments,
+    Bookmarks,
+    Pages,
+    Fields,
+    Layers,
+    Attachments,
+    Signatures,
+    /// Accessibility Checker results.
+    Accessibility,
+    /// Reachable PDF structure tags and their properties.
+    Tags,
+    /// Advanced Search results.
+    Search,
+    /// Compare files: the differences.
+    Compare,
+}
+
+/// Quick-action bar tools (the vertical floating strip).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum QuickTool {
+    Select,
+    Hand,
+    /// A commenting tool (Add comments).
+    Comment(comments::CommentTool),
+    Measure(measure_ui::Tool),
+    /// Crop pages by dragging a rectangle.
+    Crop,
+    /// Scan & OCR ▸ Enhance ▸ Camera image: drag four corners, then Enhance page.
+    EnhanceCamera,
+    /// A Fill & Sign tool.
+    Fill(fill_sign::FillTool),
+    /// A Prepare a form field tool.
+    Field(prepare::FieldTool),
+    /// Redact text and images (drag across text or draw a box).
+    Redact,
+    /// Edit a PDF ▸ Add content ▸ Text.
+    AddText,
+    /// Edit a PDF ▸ Edit text: click a line of existing text to edit it.
+    EditText,
+    /// Add a stamp: click to place this stamp.
+    Stamp(pdfcraft_engine::StampKind),
+    /// A custom stamp from the library (its index).
+    CustomStamp(usize),
+    /// Edit a PDF ▸ Link: draw link areas, select and edit links.
+    Link,
+    /// Use a certificate ▸ Digitally sign / Certify (visible): drag the signature's rectangle.
+    SignArea {
+        certify: bool,
+    },
+    /// View ▸ Zoom ▸ Marquee Zoom.
+    MarqueeZoom,
+    /// Edit ▸ Take a Snapshot.
+    Snapshot,
+    /// Edit ▸ Column Select: drag a rectangle to select only the text inside it (#740). The
+    /// Select tool does the same while Alt/Option is held at the start of a drag.
+    ColumnSelect,
+}
+
+/// A file dropped on a page grid: its name, and its bytes or, for a file on disk, the path they are
+/// read from when the file's turn to be inserted comes (so a long drop holds one file at a time).
+pub(crate) type GridFile = (String, Result<Vec<u8>, std::path::PathBuf>);
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Dialog {
+    WordCount,
+    CreateImages,
+    Properties(PropsTab),
+    About,
+    Shortcuts,
+    Split,
+    /// Pages ▸ Number pages… (page labels).
+    NumberPages,
+    /// Protect Using Password.
+    Protect,
+    /// Set Page Boxes (crop, trim, bleed, art, media).
+    PageBoxes,
+    /// Add / Update Header and Footer, Watermark, Background.
+    Marks(pdfcraft_engine::MarkKind),
+    /// Export a PDF ▸ Image / Text.
+    Export(export_ui::ExportKind),
+    /// Fill & Sign ▸ Create signature (the drawing pad).
+    Signature,
+    /// Comment Properties.
+    CommentProps,
+    /// Replace Pages (after choosing the file).
+    ReplacePages,
+    /// Prepare a form ▸ Field Properties.
+    FieldProps,
+    /// Shared properties of several selected form fields.
+    BulkFieldProps,
+    /// Redact a PDF ▸ Redact pages, Find text and redact, Set properties, apply confirmation.
+    RedactPages,
+    RedactSearch,
+    RedactProps,
+    RedactApply,
+    /// File ▸ Print.
+    Print,
+    /// File ▸ Revert confirmation.
+    Revert,
+    /// Save over a file that changed on disk since the document came from it (#2166).
+    OverwriteChanged,
+    /// Link Properties.
+    LinkProps,
+    /// Organize ▸ Extract (options), Rotate Pages.
+    Extract,
+    RotatePages,
+    /// Remove Hidden Information and Sanitize Document.
+    RemoveHidden,
+    Sanitize,
+    /// Documents from a session that ended unexpectedly.
+    Recovery,
+    /// Comments ▸ Summarize comments (options).
+    SummarizeComments,
+    /// Sign with a Digital ID ▸ Configure ▸ Sign as.
+    Sign,
+    /// Optimize PDF ▸ Advanced optimization.
+    Optimize,
+    /// Prepare a form ▸ right-click a field ▸ Duplicate.
+    DuplicateField,
+    /// Prepare a form ▸ Text field table: a movable window rather than a modal (`field_table_ui`).
+    FieldTable,
+    /// Check for accessibility ▸ Accessibility Checker Options.
+    AccessibilityOptions,
+    /// Scan & OCR ▸ Recognize text.
+    RecognizeText,
+    /// The JavaScript console (⌘J).
+    JsConsole,
+    /// Document JavaScripts.
+    DocumentJs,
+    /// Preferences.
+    Preferences,
+    /// Compare files: choose the older version.
+    CompareFiles,
+    /// Action Wizard.
+    ActionWizard,
+    /// Standards ▸ PDF/A.
+    PdfA,
+    /// Custom stamps ▸ Create.
+    CreateStamp,
+    /// Prepare for accessibility ▸ Add alternate text.
+    AltText,
+    /// PDF Optimizer ▸ Audit space usage (then back to the optimizer).
+    AuditSpace,
+    /// Signatures ▸ Show certificate.
+    CertificateViewer,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PropsTab {
+    Description,
+    InitialView,
+    Security,
+    Fonts,
+    Custom,
+    Advanced,
+    SpaceAudit,
+}
+
+/// Document Properties ▸ Custom being edited: the properties as they will be after OK, in order,
+/// and the Name and Value fields.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct CustomDraft {
+    pub props: Vec<(String, String)>,
+    pub name: String,
+    pub value: String,
+}
+
+/// Duplicate Field: the field and the pages (all, or a range, 1-based).
+#[derive(Clone, Debug, PartialEq)]
+pub struct DuplicateDraft {
+    pub name: String,
+    pub all: bool,
+    pub from: usize,
+    pub to: usize,
+}
+
+/// Copied pages: their document's name and bytes (as it was when copied) and the pages.
+#[derive(Clone, Debug)]
+pub struct PageClip {
+    /// The document the pages were copied from: pasting back into it keeps field names.
+    pub from: DocId,
+    pub name: String,
+    pub bytes: std::sync::Arc<Vec<u8>>,
+    pub pages: Vec<usize>,
+}
+
+/// One page of a whole-document copy: its text as read for display, to read, or not to try
+/// (reading it failed before).
+pub(crate) enum CopyPage {
+    Read(std::sync::Arc<pdfcraft_render::PageText>),
+    ToRead,
+    Skip,
+}
+
+/// What a whole-document copy needs, taken from the view on the UI thread: each page's text
+/// layer as far as it was read, and the document to read the others from.
+pub(crate) struct DocumentCopyJob {
+    pub(crate) pages: Vec<CopyPage>,
+    bytes: std::sync::Arc<Vec<u8>>,
+    password: Option<std::sync::Arc<str>>,
+}
+
+impl DocumentCopyJob {
+    pub(crate) fn of(v: &DocView, doc: &pdfcraft_engine::Document) -> DocumentCopyJob {
+        let pages = (0..v.page_count())
+            .map(|p| match v.texts.get(&p) {
+                Some(t) => CopyPage::Read(t.clone()),
+                None if v.text_failed.contains(&p) => CopyPage::Skip,
+                None => CopyPage::ToRead,
+            })
+            .collect();
+        DocumentCopyJob { pages, bytes: doc.bytes.clone(), password: doc.password.as_deref().map(std::sync::Arc::from) }
+    }
+
+    /// The document's text in page order, a page per line run. Each page read here is let go
+    /// once its text is taken, so a large document never holds every page's text layer at once.
+    /// `None` when `cancel` was set.
+    pub(crate) fn text(self, cancel: &std::sync::atomic::AtomicBool) -> Option<String> {
+        let mut renderer: Option<pdfcraft_render::PageRenderer> = None;
+        let mut out = String::new();
+        let mut push = |text: String| {
+            if !text.is_empty() {
+                if !out.is_empty() {
+                    out.push('\n');
+                }
+                out.push_str(&text);
+            }
+        };
+        for (page, p) in self.pages.into_iter().enumerate() {
+            if cancel.load(std::sync::atomic::Ordering::Relaxed) {
+                return None;
+            }
+            match p {
+                CopyPage::Read(t) => push(t.text_of(0..t.glyphs.len())),
+                CopyPage::ToRead => {
+                    let r = renderer.get_or_insert_with(|| {
+                        let config = pdfcraft_render::RenderConfig { password: self.password.clone(), ..Default::default() };
+                        pdfcraft_render::PageRenderer::new(self.bytes.clone(), config)
+                    });
+                    let req = pdfcraft_render::RenderRequest {
+                        page,
+                        kind: pdfcraft_render::RequestKind::Text,
+                        tile: None,
+                        scale: 1.0,
+                        tag: 0,
+                        preview: false,
+                    };
+                    if let Some(t) = r.render(req).text {
+                        push(t.text_of(0..t.glyphs.len()));
+                    }
+                }
+                CopyPage::Skip => {}
+            }
+        }
+        Some(out)
+    }
+}
+
+pub struct PasswordPrompt {
+    pub name: String,
+    pub path: Option<String>,
+    pub bytes: std::sync::Arc<Vec<u8>>,
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) stamp: Option<file_watch::Stamp>,
+    pub input: String,
+    pub error: Option<String>,
+    /// A late startup file must stay in the background even after it is unlocked.
+    pub(crate) activate: bool,
+    /// The bytes are a recovery snapshot: once the document is open it takes the snapshot's
+    /// path and recovery entry. Cancelling the prompt drops the association with it (#813).
+    pub(crate) recovered: Option<RecoveryMeta>,
+    /// The tool that asked for this file (a tool chosen with no document open): it runs once
+    /// the document is unlocked.
+    pub(crate) then: Option<&'static str>,
+    /// A link destination to apply after the linked PDF is unlocked.
+    pub(crate) after_open: Option<pdfcraft_render::RemoteDestination>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) struct OpenRequest {
+    pub(crate) name: String,
+    pub(crate) path: Option<String>,
+    pub(crate) stamp: Option<file_watch::Stamp>,
+    pub(crate) input: open_worker::Input,
+    pub(crate) password: Option<String>,
+    pub(crate) activate: bool,
+    pub(crate) after_open: Option<pdfcraft_render::RemoteDestination>,
+    pub(crate) recovered: Option<RecoveryMeta>,
+    pub(crate) then: Option<&'static str>,
+}
+
+/// Asks for the permissions password of an open document whose security restricts it, which
+/// lifts the restrictions (#995). Acrobat asks for it when such a document's security is changed.
+pub struct UnlockPrompt {
+    pub doc: DocId,
+    pub name: String,
+    pub input: String,
+    pub error: Option<String>,
+    /// The command to run once unlocked (Protect using password, Remove security), if any.
+    pub then: Option<&'static str>,
+}
+
+impl UnlockPrompt {
+    pub(crate) fn new(doc: &pdfcraft_engine::Document, then: Option<&'static str>) -> Self {
+        Self { doc: doc.id, name: doc.name.clone(), input: String::new(), error: None, then }
+    }
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct RecentFile {
+    pub name: String,
+    pub path: String,
+    pub pages: usize,
+    pub size: usize,
+}
+
+/// Where in a document a request to open an address came from.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LinkOrigin {
+    /// A link on the page.
+    Link,
+    /// A push button's URI action.
+    Button,
+    /// A script (`app.launchURL`).
+    Script,
+}
+
+impl LinkOrigin {
+    pub(crate) fn noun(self) -> &'static str {
+        match self {
+            Self::Link => "A link",
+            Self::Button => "A button",
+            Self::Script => "A script",
+        }
+    }
+}
+
+/// An address a document asked to open, waiting for the user to allow or cancel it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PendingLink {
+    pub url: String,
+    pub origin: LinkOrigin,
+}
+
+/// A resolved local target and its original source/destination, independent of the active tab.
+#[derive(Clone, Debug)]
+pub struct PendingRemoteLink {
+    pub source: DocId,
+    pub path: std::path::PathBuf,
+    pub destination: pdfcraft_render::RemoteDestination,
+}
+
+/// Settings for the Number pages dialog.
+#[derive(Clone, Debug, PartialEq)]
+pub struct NumberDraft {
+    pub from: usize,
+    pub to: usize,
+    pub style: pdfcraft_engine::LabelStyle,
+    pub prefix: String,
+    pub start: u32,
+}
+
+/// What [`PdfCraftApp::open_path`] did: opened the file in a new tab, focused the tab already
+/// showing it, handed it to the background open worker, or failed. Failures tell the user
+/// through a toast; this is the programmatic contract for callers that must know (the control
+/// channel, tools that wait for a file) (#1620).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum OpenOutcome {
+    /// The file opened in a new tab (or raised its password prompt).
+    Opened,
+    /// A tab already showed the file; it was focused and no tab was added.
+    Focused,
+    /// The file was accepted for opening in the background; its tab appears when the open
+    /// completes (`ui.state.pending_opens` lists the files on the way).
+    Pending,
+    /// The file could not be read or opened; the user was told.
+    Failed,
+}
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 442cd6d8e1..c3ce3e0e59 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -3,7 +3,7 @@
 
 use std::sync::Arc;
 
-use egui::epaint::text::{FontTweak, HintingTarget, SmoothHinting};
+use egui::epaint::text::{FallbackAlign, FontTweak, HintingTarget, SmoothHinting};
 use egui::{Color32, CornerRadius, FontData, FontDefinitions, FontFamily, FontId, Rect, Response, Stroke, Vec2, Visuals};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Default, serde::Serialize, serde::Deserialize)]
@@ -122,8 +122,9 @@ impl Tokens {
         }
     }
 
+    /// Return the cached theme tokens, falling back to the light palette before the first apply.
     pub fn get(ctx: &egui::Context) -> Self {
-        ctx.data(|d| d.get_temp::<Tokens>(egui::Id::new("pdfcraft-theme"))).unwrap_or_else(|| Self::for_kind(ThemeKind::Light))
+        ctx.data(|d| d.get_temp::<Tokens>(egui::Id::unique("pdfcraft-theme"))).unwrap_or_else(|| Self::for_kind(ThemeKind::Light))
     }
 
     pub fn dark(&self) -> bool {
@@ -230,14 +231,34 @@ pub const SYSTEM_HEBREW_FALLBACK: &str = "system-hebrew-fallback";
 /// The name of the installed Hangul (Korean) face [`installed_font_definitions`] may add.
 pub const SYSTEM_HANGUL_FALLBACK: &str = "system-hangul-fallback";
 
+/// Which installed face an interface language needs, given whether the build embeds a `Hans`
+/// face.
+///
+/// A bundled `Hans` face serves Simplified Chinese, so the installed face stays last there. It
+/// cannot serve Traditional Chinese: a Traditional interface keeps an installed `Hant` face
+/// before the Japanese faces even when a Simplified-only face is embedded, or Traditional-only
+/// characters would fall through to a Japanese face first.
+#[cfg(not(target_arch = "wasm32"))]
+fn installed_fallback_need(cjk: CjkPreference, has_embedded_hans: bool) -> crate::system_fonts::Need {
+    use crate::system_fonts::Need;
+    match cjk {
+        CjkPreference::SimplifiedChinese if has_embedded_hans => Need::Other,
+        CjkPreference::SimplifiedChinese => Need::Hans,
+        CjkPreference::TraditionalChinese => Need::Hant,
+        CjkPreference::Default => Need::Other,
+    }
+}
+
 /// What [`install_fonts_for`] installs: [`font_definitions_for`], then, on desktop, one face
 /// already installed on this machine. It only draws characters no embedded face has.
 ///
-/// - In a Chinese interface built without a `Hans` craft-fonts face (every release so far,
-///   #826), it is a Chinese system face (Microsoft YaHei, PingFang, …), placed before the
-///   Japanese craft-fonts faces: they lack hundreds of the catalog's characters (欢, 导, 签, …),
-///   and one line drawn from two faces with different vertical metrics would not sit on one
-///   baseline.
+/// - In a Simplified Chinese interface built without an embedded `Hans` face (#826), it is a
+///   Simplified Chinese system face (Microsoft YaHei, PingFang SC, …), placed before the Japanese
+///   craft-fonts faces: they lack hundreds of the catalog's characters (欢, 导, 签, …), and one
+///   line drawn from two faces with different vertical metrics would not sit on one baseline.
+/// - A Traditional Chinese interface always uses an installed `Hant` face before the Japanese
+///   faces, even when a Simplified-only `Hans` face is embedded: that face cannot supply
+///   Traditional-only characters (說, 體, …).
 /// - Otherwise it is the last fallback of every family (an Arabic file name in a build without
 ///   craft-fonts).
 ///
@@ -268,12 +289,7 @@ pub fn installed_font_definitions(cjk: CjkPreference) -> FontDefinitions {
                 stack.push(name.to_owned());
             }
         }
-        let need = match cjk {
-            _ if !pdfcraft_fonts::ui_chinese_fonts().is_empty() => Need::Other,
-            CjkPreference::SimplifiedChinese => Need::Hans,
-            CjkPreference::TraditionalChinese => Need::Hant,
-            CjkPreference::Default => Need::Other,
-        };
+        let need = installed_fallback_need(cjk, !pdfcraft_fonts::ui_chinese_fonts().is_empty());
         if let Some(data) = fallback(need) {
             fonts.font_data.insert(SYSTEM_FALLBACK.to_owned(), data);
             let japanese: Vec<String> = pdfcraft_fonts::ui_japanese_fonts().iter().map(|f| f.name()).collect();
@@ -323,37 +339,14 @@ fn primary_font_tweak(platform: FontPolicyPlatform, name: &str) -> FontTweak {
     tweak
 }
 
-/// A face's vertical metrics in em, as egui reads them: skrifa's ascent, descent (negative) and
-/// line gap at the default location. `None` when the face doesn't parse.
-fn vertical_metrics(bytes: &[u8], index: u32) -> Option<[f32; 3]> {
-    use skrifa::MetadataProvider as _;
-    let font = skrifa::FontRef::from_index(bytes, index).ok()?;
-    let m = font.metrics(skrifa::instance::Size::unscaled(), skrifa::instance::LocationRef::default());
-    let em = f32::from(m.units_per_em);
-    let metrics = [m.ascent / em, m.descent / em, m.leading / em];
-    (em > 0.0 && metrics.iter().all(|v| v.is_finite())).then_some(metrics)
-}
-
-/// How far below the primary face's baseline egui draws a fallback face's, in em of the font size
-/// (negative: above). egui centres the fallback's line box (ascent − descent + gap) on the
-/// primary's rather than lining up their baselines, so the baseline moves by half the difference
-/// of ascent + descent, less half the difference of the line gaps (epaint `text_layout`).
-fn baseline_drop(primary: [f32; 3], fallback: [f32; 3]) -> f32 {
-    let [pa, pd, pg] = primary;
-    let [a, d, g] = fallback;
-    ((a + d) - (pa + pd) + pg - g) / 2.0
-}
-
-/// `data` with its glyphs moved onto Inter's baseline (#1676). Without this, Chinese next to Latin
-/// in one label sits higher or lower than the Latin by a few percent of the font size, depending on
-/// the installed Chinese face (PingFang, Microsoft JhengHei, SimSun…). Inter is the first face of
-/// every proportional family; the monospace family's JetBrains Mono differs from it by 0.004 em,
-/// well under a pixel. A face that doesn't parse is left as it is (egui will skip it anyway).
+/// `data` with its glyphs placed on the row's baseline (#1676). epaint 0.37 otherwise centres a
+/// fallback face's line box on the primary's, so Chinese next to Latin in one label sits higher or
+/// lower than the Latin by a few percent of the font size, depending on the installed or embedded
+/// face (PingFang, Microsoft JhengHei, LXGW WenKai Lite…). `FallbackAlign::Baseline` makes epaint
+/// position every face's glyphs from the primary face's ascent, which is exactly the existing
+/// baseline-alignment intent without metric-derived offsets that go stale across egui versions.
 pub(crate) fn on_interface_baseline(mut data: FontData) -> FontData {
-    let primary = vertical_metrics(pdfcraft_fonts::INTER_REGULAR, 0);
-    if let (Some(primary), Some(fallback)) = (primary, vertical_metrics(&data.font, data.index)) {
-        data.tweak.y_offset_factor = -baseline_drop(primary, fallback);
-    }
+    data.tweak.fallback_align = FallbackAlign::Baseline;
     data
 }
 
@@ -429,13 +422,15 @@ pub fn semibold(size: f32) -> FontId {
     FontId::new(size, FontFamily::Name("semibold".into()))
 }
 
+/// Install the palette, widget styling, text sizes and right-to-left flag for the chosen theme.
 pub fn apply(ctx: &egui::Context, kind: ThemeKind) {
     // Keep the native window inherited. A concrete egui theme pins macOS's
     // NSWindow appearance and prevents winit from delivering ThemeChanged.
     // Our saved choice owns the palette; both egui branches receive it below.
     ctx.set_theme(egui::ThemePreference::System);
+    let rtl = crate::i18n::current().rtl();
     let t = Tokens::for_kind(kind);
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new("pdfcraft-theme"), t));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique("pdfcraft-theme"), t));
     let mut v = if t.dark() { Visuals::dark() } else { Visuals::light() };
     v.panel_fill = t.panel;
     v.window_fill = t.card;
@@ -477,6 +472,9 @@ pub fn apply(ctx: &egui::Context, kind: ThemeKind) {
     }
     ctx.set_visuals(v);
     ctx.global_style_mut(|s| {
+        // RTL languages mirror stock chrome (menus, combo boxes, scroll bars, headers).
+        // Labels still get their paragraph direction explicitly from `bidi::ui_direction`.
+        s.right_to_left = rtl;
         s.spacing.item_spacing = egui::vec2(8.0, 6.0);
         s.spacing.button_padding = egui::vec2(10.0, 5.0);
         s.spacing.menu_margin = egui::Margin::same(6);
@@ -493,6 +491,30 @@ pub fn apply(ctx: &egui::Context, kind: ThemeKind) {
     let style = ctx.global_style();
     ctx.set_style_of(egui::Theme::Light, style.clone());
     ctx.set_style_of(egui::Theme::Dark, style);
+    ctx.data_mut(|d| d.insert_temp(direction_key(), rtl));
+}
+
+/// Return the stable egui id holding the current right-to-left style flag.
+fn direction_key() -> egui::Id {
+    egui::Id::unique("pdfcraft-style-right-to-left")
+}
+
+/// Keep stock egui chrome's direction in step with the drawing language, after a language
+/// change as well as at startup. Setting a flag on both concrete themes is cheap; this avoids
+/// rebuilding the whole visuals and font state every frame.
+pub fn sync_direction(ctx: &egui::Context) {
+    let rtl = crate::i18n::current().rtl();
+    let changed = ctx.data_mut(|d| {
+        if d.get_temp::<bool>(direction_key()) == Some(rtl) {
+            false
+        } else {
+            d.insert_temp(direction_key(), rtl);
+            true
+        }
+    });
+    if changed {
+        ctx.all_styles_mut(|s| s.right_to_left = rtl);
+    }
 }
 
 /// WCAG 2 contrast ratio between two opaque colours.
@@ -517,283 +539,4 @@ pub fn readable(color: Color32, background: Color32, text: Color32) -> Color32 {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// #3193: a bookmark's own colour is kept where it reads on the panel, and moved towards the
-    /// theme's text colour where it doesn't (dark blue on the dark panel), never past it.
-    #[test]
-    fn a_document_colour_is_kept_where_it_reads() {
-        let (light, dark) = (Tokens::for_kind(ThemeKind::Light), Tokens::for_kind(ThemeKind::Dark));
-        let red = Color32::from_rgb(255, 0, 0);
-        assert_eq!(readable(red, light.panel, light.text), red, "red reads on white");
-        let navy = Color32::from_rgb(0, 0, 128);
-        assert_eq!(readable(navy, light.panel, light.text), navy);
-        let lifted = readable(navy, dark.panel, dark.text);
-        assert_ne!(lifted, navy, "navy is lost on the dark panel");
-        assert!(contrast(lifted, dark.panel) >= 3.0, "{lifted:?}");
-        assert_ne!(lifted, dark.text, "only as far as it needs");
-        // Even the panel's own colour comes out readable.
-        assert!(contrast(readable(dark.panel, dark.panel, dark.text), dark.panel) >= 3.0);
-        assert!(contrast(readable(light.panel, light.panel, light.text), light.panel) >= 3.0);
-    }
-    use egui::epaint::text::{Fonts, TextOptions};
-
-    const HINTING_CORPUS: [&str; 4] = ["Il1MWmw", "Hamburgefonts", "0123456789 .,;:!?()[]{}+-=/\\", "Café Ångström déjà-vu Ωμέγα Ελληνικά Журнал"];
-    const HINTING_SIZES: [f32; 6] = [10.0, 11.0, 12.0, 13.0, 14.0, 16.0];
-    const HINTING_PPPS: [f32; 4] = [1.0, 1.25, 1.5, 2.0];
-
-    fn primary_families() -> [(FontFamily, &'static str); 4] {
-        [
-            (FontFamily::Proportional, "Inter"),
-            (FontFamily::Name("medium".into()), "Inter-Medium"),
-            (FontFamily::Name("semibold".into()), "Inter-SemiBold"),
-            (FontFamily::Monospace, "JetBrainsMono"),
-        ]
-    }
-
-    fn raster_edge_and_ink(fonts: &mut Fonts, id: FontId, text: &str, ppp: f32) -> (u64, u64) {
-        let galley = {
-            let mut view = fonts.with_pixels_per_point(ppp);
-            view.layout_no_wrap(text.to_owned(), id, Color32::BLACK).as_ref().clone()
-        };
-        let image = fonts.image();
-        let mut edge = 0u64;
-        let mut ink = 0u64;
-        for glyph in galley.rows.iter().flat_map(|row| &row.glyphs) {
-            let [x0, y0] = glyph.uv_rect.min.map(usize::from);
-            let [x1, y1] = glyph.uv_rect.max.map(usize::from);
-            for y in y0..y1 {
-                for x in x0..x1 {
-                    let alpha = image.pixels[y * image.size[0] + x].a();
-                    ink += u64::from(alpha);
-                    if x > x0 {
-                        let left = image.pixels[y * image.size[0] + x - 1].a();
-                        edge += u64::from(alpha.abs_diff(left));
-                    }
-                }
-            }
-        }
-        (edge, ink)
-    }
-
-    fn mono_raster_measure(fonts: &mut Fonts, ppp: f32) -> (u64, u64) {
-        let mut edge = 0;
-        let mut ink = 0;
-        for size in HINTING_SIZES {
-            for text in HINTING_CORPUS {
-                let (glyph_edge, glyph_ink) = raster_edge_and_ink(fonts, FontId::monospace(size), text, ppp);
-                edge += glyph_edge;
-                ink += glyph_ink;
-            }
-        }
-        (edge, ink)
-    }
-
-    fn layout_signature(galley: &egui::Galley) -> Vec<u32> {
-        let mut signature = vec![
-            galley.rect.min.x.to_bits(),
-            galley.rect.min.y.to_bits(),
-            galley.rect.max.x.to_bits(),
-            galley.rect.max.y.to_bits(),
-            u32::from(galley.elided),
-            galley.rows.len() as u32,
-        ];
-        for row in &galley.rows {
-            signature.extend([
-                u32::from(row.ends_with_newline),
-                row.pos.x.to_bits(),
-                row.pos.y.to_bits(),
-                row.size.x.to_bits(),
-                row.size.y.to_bits(),
-                row.glyphs.len() as u32,
-            ]);
-            for glyph in &row.glyphs {
-                signature.extend([
-                    glyph.chr as u32,
-                    glyph.pos.x.to_bits(),
-                    glyph.pos.y.to_bits(),
-                    glyph.advance_width.to_bits(),
-                    glyph.line_height.to_bits(),
-                    glyph.font_ascent.to_bits(),
-                    glyph.font_height.to_bits(),
-                    glyph.font_face_ascent.to_bits(),
-                    glyph.font_face_height.to_bits(),
-                ]);
-            }
-        }
-        signature
-    }
-
-    fn galley(fonts: &mut Fonts, family: FontFamily, size: f32, ppp: f32, text: &str) -> egui::Galley {
-        let mut view = fonts.with_pixels_per_point(ppp);
-        view.layout_no_wrap(text.to_owned(), FontId::new(size, family), Color32::BLACK).as_ref().clone()
-    }
-
-    fn hinting_test_fonts(platform: FontPolicyPlatform) -> Fonts {
-        Fonts::new(
-            TextOptions {
-                subpixel_binning: false,
-                color_transfer_function: egui::epaint::FontColorTransferFunction::Gamma(0.75),
-                ..TextOptions::default()
-            },
-            font_definitions_for_platform(false, platform),
-        )
-    }
-
-    /// The baseline of each glyph of `text` laid out by egui at `size` points, in points from the
-    /// top of the row: its position plus its face's `y_offset_factor`, as epaint draws it.
-    fn baselines(fallback: FontData, size: f32, text: &str) -> Vec<f32> {
-        let factor = fallback.tweak.y_offset_factor;
-        let mut defs = FontDefinitions::empty();
-        defs.font_data.insert("Inter".into(), Arc::new(FontData::from_static(pdfcraft_fonts::INTER_REGULAR)));
-        defs.font_data.insert("fallback".into(), Arc::new(fallback));
-        defs.families.insert(FontFamily::Proportional, vec!["Inter".into(), "fallback".into()]);
-        let mut fonts = Fonts::new(TextOptions::default(), defs);
-        let g = galley(&mut fonts, FontFamily::Proportional, size, 1.0, text);
-        let inter_has = |c: char| c.is_ascii();
-        g.rows[0].glyphs.iter().map(|gl| gl.pos.y + if inter_has(gl.chr) { 0.0 } else { size * factor }).collect()
-    }
-
-    #[test]
-    fn fallback_faces_share_the_interface_baseline() {
-        // Dancing Script's metrics differ from Inter's the way a Chinese face's do (by 0.044 em),
-        // and it has letters Inter doesn't (DŽ), which egui then takes from it.
-        let dancing: &'static [u8] = include_bytes!("../../../assets/fonts/DancingScript.ttf");
-        let size = 100.0;
-        // As egui lays it out by itself, DŽ sits ~4 pt off H's baseline: the bug (#1676).
-        let raw = baselines(FontData::from_static(dancing), size, "HDŽ");
-        assert!((raw[1] - raw[0]).abs() > 3.0, "the test fonts must differ: {raw:?}");
-        let drop = baseline_drop(vertical_metrics(pdfcraft_fonts::INTER_REGULAR, 0).unwrap(), vertical_metrics(dancing, 0).unwrap());
-        assert!((raw[1] - raw[0] - size * drop).abs() <= 1.0, "baseline_drop predicts egui: {raw:?} vs {drop}");
-        // On the interface baseline, to the pixel.
-        let aligned = baselines(on_interface_baseline(FontData::from_static(dancing)), size, "HDŽ");
-        assert!((aligned[1] - aligned[0]).abs() <= 1.0, "{aligned:?}");
-        // A face that doesn't parse is left alone rather than guessed at.
-        assert_eq!(on_interface_baseline(FontData::from_static(b"not a font")).tweak, FontTweak::default());
-        assert_eq!(vertical_metrics(b"", 0), None);
-    }
-
-    #[test]
-    fn windows_hinting_changes_only_the_jetbrains_symmetric_rendering_field() {
-        let baseline = font_definitions_for_platform(false, FontPolicyPlatform::Other);
-        let windows = font_definitions_for_platform(false, FontPolicyPlatform::Windows);
-
-        assert_eq!(baseline.families, windows.families);
-        assert_eq!(baseline.font_data.keys().collect::<Vec<_>>(), windows.font_data.keys().collect::<Vec<_>>());
-        for (family, name) in primary_families() {
-            let baseline_data = &baseline.font_data[name];
-            let windows_data = &windows.font_data[name];
-            assert_eq!(baseline_data.tweak, FontTweak::default(), "baseline {name}");
-            if name == "JetBrainsMono" {
-                assert_eq!(
-                    windows_data.tweak,
-                    FontTweak {
-                        hinting_target: HintingTarget::Smooth(SmoothHinting { symmetric_rendering: false, ..SmoothHinting::default() }),
-                        ..FontTweak::default()
-                    },
-                    "Windows {name}"
-                );
-            } else {
-                assert_eq!(windows_data.tweak, baseline_data.tweak, "Windows {name}");
-            }
-            assert_eq!(primary_font_tweak(FontPolicyPlatform::Other, name), baseline_data.tweak, "non-Windows policy for {family:?}");
-        }
-        for (name, data) in &baseline.font_data {
-            if !["Inter", "Inter-Medium", "Inter-SemiBold", "JetBrainsMono"].contains(&name.as_str()) {
-                assert_eq!(windows.font_data[name].tweak, data.tweak, "Windows fallback {name}");
-            }
-        }
-        assert_eq!(
-            font_definitions_for(false).font_data["JetBrainsMono"].tweak,
-            font_definitions_for_platform(false, current_font_policy_platform()).font_data["JetBrainsMono"].tweak
-        );
-    }
-
-    #[test]
-    #[ignore = "measurement probe: asserts exact egui rasterisation deltas, which change with egui upgrades; run with --ignored when retuning the hinting"]
-    fn windows_hinting_improves_low_dpi_mono_raster_without_changing_layout_or_coverage() {
-        let mut baseline = hinting_test_fonts(FontPolicyPlatform::Other);
-        let mut windows = hinting_test_fonts(FontPolicyPlatform::Windows);
-
-        for ppp in HINTING_PPPS {
-            let (baseline_edge, baseline_ink) = mono_raster_measure(&mut baseline, ppp);
-            let (windows_edge, windows_ink) = mono_raster_measure(&mut windows, ppp);
-            // Compare horizontal alpha-edge energy per ink alpha; this is a deterministic
-            // vertical-stem sharpness proxy, not an absolute typography quality score.
-            let baseline_sharpness = baseline_edge as f64 / baseline_ink as f64;
-            let windows_sharpness = windows_edge as f64 / windows_ink as f64;
-            let sharpness_change = windows_sharpness / baseline_sharpness - 1.0;
-            let weight_change = windows_ink as f64 / baseline_ink as f64 - 1.0;
-            if ppp < 2.0 {
-                assert!(sharpness_change > 0.002, "{ppp} ppp sharpness change: {sharpness_change:.2}%", sharpness_change = sharpness_change * 100.0);
-            } else {
-                assert!(sharpness_change >= -0.01, "{ppp} ppp sharpness change: {sharpness_change:.2}%", sharpness_change = sharpness_change * 100.0);
-            }
-            assert!(weight_change.abs() < 0.05, "{ppp} ppp ink change: {weight_change:.2}%", weight_change = weight_change * 100.0);
-        }
-
-        for ppp in HINTING_PPPS {
-            for size in HINTING_SIZES {
-                for (family, _) in primary_families() {
-                    for text in HINTING_CORPUS {
-                        assert_eq!(
-                            baseline.has_glyphs(&FontId::new(size, family.clone()), text),
-                            windows.has_glyphs(&FontId::new(size, family.clone()), text),
-                            "{family:?} {text:?}"
-                        );
-                        assert_eq!(
-                            layout_signature(&galley(&mut baseline, family.clone(), size, ppp, text)),
-                            layout_signature(&galley(&mut windows, family.clone(), size, ppp, text)),
-                            "{family:?}, {size} pt, {ppp} ppp, {text:?}"
-                        );
-                    }
-                }
-            }
-        }
-    }
-
-    /// "Use system setting" draws what the operating system says, dark or light.
-    #[test]
-    fn following_the_system_draws_what_the_system_says() {
-        assert_eq!(ThemePreference::System.resolve(Some(true), ThemeKind::Light), ThemeKind::Dark);
-        assert_eq!(ThemePreference::System.resolve(Some(false), ThemeKind::Dark), ThemeKind::Light);
-    }
-
-    /// An operating system that says nothing leaves the last choice standing, and an explicit
-    /// Light or Dark is never overridden by what the system says.
-    #[test]
-    fn an_answerless_system_leaves_the_choice_and_an_explicit_one_stands() {
-        assert_eq!(ThemePreference::System.resolve(None, ThemeKind::Light), ThemeKind::Light);
-        assert_eq!(ThemePreference::System.resolve(None, ThemeKind::Dark), ThemeKind::Dark);
-        assert_eq!(ThemePreference::Light.resolve(Some(true), ThemeKind::Dark), ThemeKind::Light);
-        assert_eq!(ThemePreference::Dark.resolve(Some(false), ThemeKind::Light), ThemeKind::Dark);
-    }
-
-    #[test]
-    fn press_darkens_then_sinks() {
-        let rest = Color32::from_rgb(0xFF, 0xFF, 0xFF);
-        let hover = Color32::from_rgb(0xF0, 0xF0, 0xF3);
-        let pressed = Color32::from_rgb(0xE4, 0xE4, 0xE9);
-        let idle = Press { hover: 0.0, down: 0.0 };
-        assert_eq!(idle.fill(rest, hover, pressed), rest);
-        assert_eq!(idle.offset(), Vec2::ZERO);
-        let held = Press { hover: 1.0, down: 1.0 };
-        assert_eq!(held.fill(rest, hover, pressed), pressed);
-        assert_eq!(held.offset(), Vec2::new(0.0, 1.0));
-    }
-
-    #[test]
-    fn text_is_readable_on_every_surface() {
-        // #76: the faintest text (hints, zoom level, captions) was 3.3:1 in the light theme.
-        for kind in [ThemeKind::Light, ThemeKind::Dark] {
-            let t = Tokens::for_kind(kind);
-            for (name, fg) in [("text", t.text), ("text_muted", t.text_muted), ("text_faint", t.text_faint)] {
-                for bg in [t.chrome, t.panel, t.card, t.pasteboard] {
-                    let r = contrast(fg, bg);
-                    assert!(r >= 4.5, "{kind:?} {name} on {bg:?}: {r:.2}:1, WCAG AA needs 4.5:1");
-                }
-            }
-        }
-    }
-}
+mod tests;
diff --git a/crates/ui-egui/src/theme/tests.rs b/crates/ui-egui/src/theme/tests.rs
new file mode 100644
index 0000000000..d2e49ae806
--- /dev/null
+++ b/crates/ui-egui/src/theme/tests.rs
@@ -0,0 +1,300 @@
+use super::*;
+
+/// Arabic and Kurdish switch stock chrome to mirror from the right; English switches it
+/// back. This is the `Style::right_to_left` half of the explicit RTL policy.
+#[test]
+fn arabic_chrome_is_right_to_left_after_the_language_changes() {
+    let previous = crate::i18n::current();
+    let ctx = egui::Context::default();
+    crate::i18n::set_current(crate::i18n::Lang::from_code("ar").expect("registered language"));
+    apply(&ctx, ThemeKind::Light);
+    assert!(ctx.global_style().right_to_left);
+    crate::i18n::set_current(crate::i18n::Lang::EN);
+    sync_direction(&ctx);
+    assert!(!ctx.global_style().right_to_left);
+    crate::i18n::set_current(previous);
+}
+
+/// #3193: a bookmark's own colour is kept where it reads on the panel, and moved towards the
+/// theme's text colour where it doesn't (dark blue on the dark panel), never past it.
+#[test]
+fn a_document_colour_is_kept_where_it_reads() {
+    let (light, dark) = (Tokens::for_kind(ThemeKind::Light), Tokens::for_kind(ThemeKind::Dark));
+    let red = Color32::from_rgb(255, 0, 0);
+    assert_eq!(readable(red, light.panel, light.text), red, "red reads on white");
+    let navy = Color32::from_rgb(0, 0, 128);
+    assert_eq!(readable(navy, light.panel, light.text), navy);
+    let lifted = readable(navy, dark.panel, dark.text);
+    assert_ne!(lifted, navy, "navy is lost on the dark panel");
+    assert!(contrast(lifted, dark.panel) >= 3.0, "{lifted:?}");
+    assert_ne!(lifted, dark.text, "only as far as it needs");
+    // Even the panel's own colour comes out readable.
+    assert!(contrast(readable(dark.panel, dark.panel, dark.text), dark.panel) >= 3.0);
+    assert!(contrast(readable(light.panel, light.panel, light.text), light.panel) >= 3.0);
+}
+use egui::epaint::text::{Fonts, TextOptions};
+
+const HINTING_CORPUS: [&str; 4] = ["Il1MWmw", "Hamburgefonts", "0123456789 .,;:!?()[]{}+-=/\\", "Café Ångström déjà-vu Ωμέγα Ελληνικά Журнал"];
+const HINTING_SIZES: [f32; 6] = [10.0, 11.0, 12.0, 13.0, 14.0, 16.0];
+const HINTING_PPPS: [f32; 4] = [1.0, 1.25, 1.5, 2.0];
+
+fn primary_families() -> [(FontFamily, &'static str); 4] {
+    [
+        (FontFamily::Proportional, "Inter"),
+        (FontFamily::Name("medium".into()), "Inter-Medium"),
+        (FontFamily::Name("semibold".into()), "Inter-SemiBold"),
+        (FontFamily::Monospace, "JetBrainsMono"),
+    ]
+}
+
+fn raster_edge_and_ink(fonts: &mut Fonts, id: FontId, text: &str, ppp: f32) -> (u64, u64) {
+    let galley = {
+        let mut view = fonts.with_pixels_per_point(ppp);
+        view.layout_no_wrap(text.to_owned(), id, Color32::BLACK).as_ref().clone()
+    };
+    let image = fonts.image();
+    let mut edge = 0u64;
+    let mut ink = 0u64;
+    for glyph in galley.rows.iter().flat_map(|row| &row.glyphs) {
+        let [x0, y0] = glyph.uv_rect.min.map(usize::from);
+        let [x1, y1] = glyph.uv_rect.max.map(usize::from);
+        for y in y0..y1 {
+            for x in x0..x1 {
+                let alpha = image.pixels[y * image.size[0] + x].a();
+                ink += u64::from(alpha);
+                if x > x0 {
+                    let left = image.pixels[y * image.size[0] + x - 1].a();
+                    edge += u64::from(alpha.abs_diff(left));
+                }
+            }
+        }
+    }
+    (edge, ink)
+}
+
+fn mono_raster_measure(fonts: &mut Fonts, ppp: f32) -> (u64, u64) {
+    let mut edge = 0;
+    let mut ink = 0;
+    for size in HINTING_SIZES {
+        for text in HINTING_CORPUS {
+            let (glyph_edge, glyph_ink) = raster_edge_and_ink(fonts, FontId::monospace(size), text, ppp);
+            edge += glyph_edge;
+            ink += glyph_ink;
+        }
+    }
+    (edge, ink)
+}
+
+fn layout_signature(galley: &egui::Galley) -> Vec<u32> {
+    let mut signature = vec![
+        galley.rect.min.x.to_bits(),
+        galley.rect.min.y.to_bits(),
+        galley.rect.max.x.to_bits(),
+        galley.rect.max.y.to_bits(),
+        u32::from(galley.elided),
+        galley.rows.len() as u32,
+    ];
+    for row in &galley.rows {
+        signature.extend([
+            u32::from(row.ends_with_newline),
+            row.pos.x.to_bits(),
+            row.pos.y.to_bits(),
+            row.size.x.to_bits(),
+            row.size.y.to_bits(),
+            row.glyphs.len() as u32,
+        ]);
+        for glyph in &row.glyphs {
+            signature.extend([
+                glyph.chr as u32,
+                glyph.pos.x.to_bits(),
+                glyph.pos.y.to_bits(),
+                glyph.advance_width.to_bits(),
+                glyph.line_height.to_bits(),
+                glyph.font_ascent.to_bits(),
+                glyph.font_height.to_bits(),
+                glyph.font_face_ascent.to_bits(),
+                glyph.font_face_height.to_bits(),
+            ]);
+        }
+    }
+    signature
+}
+
+fn galley(fonts: &mut Fonts, family: FontFamily, size: f32, ppp: f32, text: &str) -> egui::Galley {
+    let mut view = fonts.with_pixels_per_point(ppp);
+    view.layout_no_wrap(text.to_owned(), FontId::new(size, family), Color32::BLACK).as_ref().clone()
+}
+
+fn hinting_test_fonts(platform: FontPolicyPlatform) -> Fonts {
+    Fonts::new(
+        TextOptions {
+            subpixel_binning: false,
+            color_transfer_function: egui::epaint::FontColorTransferFunction::Gamma(0.75),
+            ..TextOptions::default()
+        },
+        font_definitions_for_platform(false, platform),
+    )
+}
+
+/// The y position of each glyph of `text` laid out by egui at `size` points, in points from
+/// the top of the row.
+fn baselines(fallback: FontData, size: f32, text: &str) -> Vec<f32> {
+    let mut defs = FontDefinitions::empty();
+    defs.font_data.insert("Inter".into(), Arc::new(FontData::from_static(pdfcraft_fonts::INTER_REGULAR)));
+    defs.font_data.insert("fallback".into(), Arc::new(fallback));
+    defs.families.insert(FontFamily::Proportional, vec!["Inter".into(), "fallback".into()]);
+    let mut fonts = Fonts::new(TextOptions::default(), defs);
+    let g = galley(&mut fonts, FontFamily::Proportional, size, 1.0, text);
+    g.rows[0].glyphs.iter().map(|gl| gl.pos.y).collect()
+}
+
+#[test]
+fn fallback_faces_share_the_interface_baseline() {
+    // Dancing Script's metrics differ from Inter's the way a Chinese face's do (by 0.044 em),
+    // and it has letters Inter doesn't (DŽ), which egui then takes from it.
+    let dancing: &'static [u8] = include_bytes!("../../../../assets/fonts/DancingScript.ttf");
+    let size = 100.0;
+    // As egui lays it out by itself, DŽ sits ~4 pt off H's baseline: the bug (#1676).
+    let raw = baselines(FontData::from_static(dancing), size, "HDŽ");
+    assert!((raw[1] - raw[0]).abs() > 3.0, "the test fonts must differ: {raw:?}");
+    // `FallbackAlign::Baseline` puts every face on the same baseline, to the pixel.
+    let aligned = baselines(on_interface_baseline(FontData::from_static(dancing)), size, "HDŽ");
+    assert!((aligned[1] - aligned[0]).abs() <= 1.0, "{aligned:?}");
+    assert_eq!(on_interface_baseline(FontData::from_static(dancing)).tweak.fallback_align, FallbackAlign::Baseline);
+}
+
+/// The policy only exists on native platforms (`installed_font_definitions` has no installed
+/// faces on wasm), so the test must not use it in a wasm test build.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn traditional_chinese_keeps_an_installed_face_when_hans_is_embedded() {
+    use crate::system_fonts::Need;
+    assert_eq!(installed_fallback_need(CjkPreference::SimplifiedChinese, true), Need::Other);
+    assert_eq!(installed_fallback_need(CjkPreference::SimplifiedChinese, false), Need::Hans);
+    assert_eq!(installed_fallback_need(CjkPreference::TraditionalChinese, true), Need::Hant);
+    assert_eq!(installed_fallback_need(CjkPreference::TraditionalChinese, false), Need::Hant);
+    assert_eq!(installed_fallback_need(CjkPreference::Default, true), Need::Other);
+}
+
+#[test]
+fn windows_hinting_changes_only_the_jetbrains_symmetric_rendering_field() {
+    let baseline = font_definitions_for_platform(false, FontPolicyPlatform::Other);
+    let windows = font_definitions_for_platform(false, FontPolicyPlatform::Windows);
+
+    assert_eq!(baseline.families, windows.families);
+    assert_eq!(baseline.font_data.keys().collect::<Vec<_>>(), windows.font_data.keys().collect::<Vec<_>>());
+    for (family, name) in primary_families() {
+        let baseline_data = &baseline.font_data[name];
+        let windows_data = &windows.font_data[name];
+        assert_eq!(baseline_data.tweak, FontTweak::default(), "baseline {name}");
+        if name == "JetBrainsMono" {
+            assert_eq!(
+                windows_data.tweak,
+                FontTweak {
+                    hinting_target: HintingTarget::Smooth(SmoothHinting { symmetric_rendering: false, ..SmoothHinting::default() }),
+                    ..FontTweak::default()
+                },
+                "Windows {name}"
+            );
+        } else {
+            assert_eq!(windows_data.tweak, baseline_data.tweak, "Windows {name}");
+        }
+        assert_eq!(primary_font_tweak(FontPolicyPlatform::Other, name), baseline_data.tweak, "non-Windows policy for {family:?}");
+    }
+    for (name, data) in &baseline.font_data {
+        if !["Inter", "Inter-Medium", "Inter-SemiBold", "JetBrainsMono"].contains(&name.as_str()) {
+            assert_eq!(windows.font_data[name].tweak, data.tweak, "Windows fallback {name}");
+        }
+    }
+    assert_eq!(
+        font_definitions_for(false).font_data["JetBrainsMono"].tweak,
+        font_definitions_for_platform(false, current_font_policy_platform()).font_data["JetBrainsMono"].tweak
+    );
+}
+
+#[test]
+#[ignore = "measurement probe: asserts exact egui rasterisation deltas, which change with egui upgrades; run with --ignored when retuning the hinting"]
+fn windows_hinting_improves_low_dpi_mono_raster_without_changing_layout_or_coverage() {
+    let mut baseline = hinting_test_fonts(FontPolicyPlatform::Other);
+    let mut windows = hinting_test_fonts(FontPolicyPlatform::Windows);
+
+    for ppp in HINTING_PPPS {
+        let (baseline_edge, baseline_ink) = mono_raster_measure(&mut baseline, ppp);
+        let (windows_edge, windows_ink) = mono_raster_measure(&mut windows, ppp);
+        // Compare horizontal alpha-edge energy per ink alpha; this is a deterministic
+        // vertical-stem sharpness proxy, not an absolute typography quality score.
+        let baseline_sharpness = baseline_edge as f64 / baseline_ink as f64;
+        let windows_sharpness = windows_edge as f64 / windows_ink as f64;
+        let sharpness_change = windows_sharpness / baseline_sharpness - 1.0;
+        let weight_change = windows_ink as f64 / baseline_ink as f64 - 1.0;
+        if ppp < 2.0 {
+            assert!(sharpness_change > 0.002, "{ppp} ppp sharpness change: {sharpness_change:.2}%", sharpness_change = sharpness_change * 100.0);
+        } else {
+            assert!(sharpness_change >= -0.01, "{ppp} ppp sharpness change: {sharpness_change:.2}%", sharpness_change = sharpness_change * 100.0);
+        }
+        assert!(weight_change.abs() < 0.05, "{ppp} ppp ink change: {weight_change:.2}%", weight_change = weight_change * 100.0);
+    }
+
+    for ppp in HINTING_PPPS {
+        for size in HINTING_SIZES {
+            for (family, _) in primary_families() {
+                for text in HINTING_CORPUS {
+                    assert_eq!(
+                        baseline.has_glyphs(&FontId::new(size, family.clone()), text),
+                        windows.has_glyphs(&FontId::new(size, family.clone()), text),
+                        "{family:?} {text:?}"
+                    );
+                    assert_eq!(
+                        layout_signature(&galley(&mut baseline, family.clone(), size, ppp, text)),
+                        layout_signature(&galley(&mut windows, family.clone(), size, ppp, text)),
+                        "{family:?}, {size} pt, {ppp} ppp, {text:?}"
+                    );
+                }
+            }
+        }
+    }
+}
+
+/// "Use system setting" draws what the operating system says, dark or light.
+#[test]
+fn following_the_system_draws_what_the_system_says() {
+    assert_eq!(ThemePreference::System.resolve(Some(true), ThemeKind::Light), ThemeKind::Dark);
+    assert_eq!(ThemePreference::System.resolve(Some(false), ThemeKind::Dark), ThemeKind::Light);
+}
+
+/// An operating system that says nothing leaves the last choice standing, and an explicit
+/// Light or Dark is never overridden by what the system says.
+#[test]
+fn an_answerless_system_leaves_the_choice_and_an_explicit_one_stands() {
+    assert_eq!(ThemePreference::System.resolve(None, ThemeKind::Light), ThemeKind::Light);
+    assert_eq!(ThemePreference::System.resolve(None, ThemeKind::Dark), ThemeKind::Dark);
+    assert_eq!(ThemePreference::Light.resolve(Some(true), ThemeKind::Dark), ThemeKind::Light);
+    assert_eq!(ThemePreference::Dark.resolve(Some(false), ThemeKind::Light), ThemeKind::Dark);
+}
+
+#[test]
+fn press_darkens_then_sinks() {
+    let rest = Color32::from_rgb(0xFF, 0xFF, 0xFF);
+    let hover = Color32::from_rgb(0xF0, 0xF0, 0xF3);
+    let pressed = Color32::from_rgb(0xE4, 0xE4, 0xE9);
+    let idle = Press { hover: 0.0, down: 0.0 };
+    assert_eq!(idle.fill(rest, hover, pressed), rest);
+    assert_eq!(idle.offset(), Vec2::ZERO);
+    let held = Press { hover: 1.0, down: 1.0 };
+    assert_eq!(held.fill(rest, hover, pressed), pressed);
+    assert_eq!(held.offset(), Vec2::new(0.0, 1.0));
+}
+
+#[test]
+fn text_is_readable_on_every_surface() {
+    // #76: the faintest text (hints, zoom level, captions) was 3.3:1 in the light theme.
+    for kind in [ThemeKind::Light, ThemeKind::Dark] {
+        let t = Tokens::for_kind(kind);
+        for (name, fg) in [("text", t.text), ("text_muted", t.text_muted), ("text_faint", t.text_faint)] {
+            for bg in [t.chrome, t.panel, t.card, t.pasteboard] {
+                let r = contrast(fg, bg);
+                assert!(r >= 4.5, "{kind:?} {name} on {bg:?}: {r:.2}:1, WCAG AA needs 4.5:1");
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/src/tools.rs b/crates/ui-egui/src/tools.rs
new file mode 100644
index 0000000000..165651e60d
--- /dev/null
+++ b/crates/ui-egui/src/tools.rs
@@ -0,0 +1,17 @@
+pub mod bulk_fields;
+pub(super) mod calc_order_ui;
+pub(super) mod camera_ui;
+pub mod comments;
+pub(super) mod content_ui;
+pub(super) mod edit_text_ui;
+pub mod field_table_ui;
+pub mod fill_sign;
+pub mod forms_ui;
+pub(super) mod link_ui;
+pub(super) mod measure_ui;
+pub(super) mod object_ui;
+pub mod prepare;
+pub(super) mod redact_ui;
+pub(super) mod sign_ui;
+pub(super) mod stamps_ui;
+pub(super) mod tags_ui;
diff --git a/crates/ui-egui/src/bulk_fields.rs b/crates/ui-egui/src/tools/bulk_fields.rs
similarity index 96%
rename from crates/ui-egui/src/bulk_fields.rs
rename to crates/ui-egui/src/tools/bulk_fields.rs
index 3101724cff..7acb2ff75b 100644
--- a/crates/ui-egui/src/bulk_fields.rs
+++ b/crates/ui-egui/src/tools/bulk_fields.rs
@@ -238,7 +238,7 @@ impl crate::PdfCraftApp {
 
 fn bool_row(ui: &mut egui::Ui, label: &str, c: &mut Change<bool>) {
     row(ui, label, c, |ui, value| {
-        egui::ComboBox::from_id_salt(label).selected_text(tl!(if *value { "Yes" } else { "No" })).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt(label).selected_text(tl!(if *value { "Yes" } else { "No" })).show_ui(ui, |ui| {
             ui.selectable_value(value, true, tl!("Yes"));
             ui.selectable_value(value, false, tl!("No"));
         });
@@ -283,7 +283,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut Draft, t: &theme::Tokens) -> (bool
         egui::Grid::new("bulk-field-properties").num_columns(3).spacing([16.0, 10.0]).show(ui, |ui| match d.tab {
             Tab::General => {
                 row(ui, "Tooltip:", &mut d.tooltip, |ui, v| {
-                    ui.add(egui::TextEdit::singleline(v).desired_width(280.0));
+                    ui.add(egui::TextEdit::singleline(v).desired_width(280.0)).accessible_name(tl!("Tooltip"));
                 });
                 bool_row(ui, "Read Only", &mut d.read_only);
                 bool_row(ui, "Required", &mut d.required);
@@ -296,7 +296,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut Draft, t: &theme::Tokens) -> (bool
                     });
                     let font_label = if d.font.apply { d.font.value.label().to_string() } else { d.font_label.clone() };
                     row(ui, "Font:", &mut d.font, |ui, v| {
-                        egui::ComboBox::from_id_salt("bulk-font").selected_text(tl!(&font_label)).show_ui(ui, |ui| {
+                        craft_ui::ComboBox::from_id_salt("bulk-font").selected_text(tl!(&font_label)).show_ui(ui, |ui| {
                             for font in FieldFont::ALL {
                                 ui.selectable_value(v, font, font.label());
                             }
@@ -314,7 +314,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut Draft, t: &theme::Tokens) -> (bool
                     ui.add(egui::DragValue::new(v).range(0.0..=12.0).speed(0.25).suffix(" pt"));
                 });
                 row(ui, "Line Style:", &mut d.style, |ui, v| {
-                    egui::ComboBox::from_id_salt("bulk-style").selected_text(tl!(v.label())).show_ui(ui, |ui| {
+                    craft_ui::ComboBox::from_id_salt("bulk-style").selected_text(tl!(v.label())).show_ui(ui, |ui| {
                         for style in BorderStyle::ALL {
                             ui.selectable_value(v, style, tl!(style.label()));
                         }
@@ -329,7 +329,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut Draft, t: &theme::Tokens) -> (bool
                             2 => "Right",
                             _ => "Left",
                         };
-                        egui::ComboBox::from_id_salt("bulk-align").selected_text(tl!(label)).show_ui(ui, |ui| {
+                        craft_ui::ComboBox::from_id_salt("bulk-align").selected_text(tl!(label)).show_ui(ui, |ui| {
                             for (value, label) in [(0, "Left"), (1, "Center"), (2, "Right")] {
                                 ui.selectable_value(v, value, tl!(label));
                             }
@@ -344,7 +344,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut Draft, t: &theme::Tokens) -> (bool
                 }
                 if d.check_fields {
                     row(ui, "Button Style:", &mut d.check_style, |ui, v| {
-                        egui::ComboBox::from_id_salt("bulk-check-style").selected_text(tl!(v.label())).show_ui(ui, |ui| {
+                        craft_ui::ComboBox::from_id_salt("bulk-check-style").selected_text(tl!(v.label())).show_ui(ui, |ui| {
                             for style in CheckStyle::ALL {
                                 ui.selectable_value(v, style, tl!(style.label()));
                             }
diff --git a/crates/ui-egui/src/calc_order_ui.rs b/crates/ui-egui/src/tools/calc_order_ui.rs
similarity index 98%
rename from crates/ui-egui/src/calc_order_ui.rs
rename to crates/ui-egui/src/tools/calc_order_ui.rs
index a9a726d241..4cbfa28177 100644
--- a/crates/ui-egui/src/calc_order_ui.rs
+++ b/crates/ui-egui/src/tools/calc_order_ui.rs
@@ -494,7 +494,7 @@ fn explained(issues: &[CalculationIssue]) -> String {
 
 /// The Calculation order page; Back returns to Prepare a form.
 pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
-    let (back, close) = crate::panels::panel_header(ui, t, "Calculation order", Some(tl!("Back to Prepare a form")));
+    let (back, close) = crate::panels::panel_header(ui, t, "Calculation order", Some(("chevron-left", tl!("Back to Prepare a form"))));
     if back {
         app.left = LeftPanel::Tool("form");
     }
@@ -566,7 +566,7 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
             let is_selected = selected.as_deref() == Some(f.name.as_str());
             resp.widget_info(|| {
                 let label = if row.value.is_empty() { format!("{}. {}", k + 1, f.name) } else { format!("{}. {}: {}", k + 1, f.name, row.value) };
-                egui::WidgetInfo::selected(egui::WidgetType::Button, true, is_selected, label)
+                egui::WidgetInfo::selected(egui::Role::Button, true, is_selected, label)
             });
             if reveal.as_deref() == Some(f.name.as_str()) {
                 resp.scroll_to_me(Some(egui::Align::Center));
@@ -631,8 +631,9 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
                     [(up, "chevron-up", true, tl!("Earlier in calculation order")), (down, "chevron-down", false, tl!("Later in calculation order"))]
                 {
                     let to = if earlier { k.checked_sub(1) } else { Some(k + 1).filter(|&to| to < count) };
-                    let b = ui.interact(r, ui.id().with(("calc-order", k, earlier)), if to.is_some() { Sense::click() } else { Sense::hover() });
-                    b.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, to.is_some(), format!("{tip}: {}", f.name)));
+                    let b =
+                        ui.interact(r, ui.scope_id().with(("calc-order", k, earlier)), if to.is_some() { Sense::click() } else { Sense::hover() });
+                    b.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, to.is_some(), format!("{tip}: {}", f.name)));
                     if visible {
                         let bpress = theme::Press::track(ui, &b);
                         bpress.wash(ui, r, 4, false);
@@ -724,10 +725,9 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
 /// The calculation order on page `page`: the links of the field in focus, with the fields it has
 /// nothing to do with faded, and the steps of the focus and its linked fields; with nothing in
 /// focus, the steps of the fields whose place is wrong. A form with many calculations stays
-/// readable either way. Returns the field under the pointer.
+/// readable either way. Returns the field under the pages' `pointer`.
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn paint_page(
-    ui: &egui::Ui,
     painter: &egui::Painter,
     xf: &PageXform,
     page: usize,
@@ -736,6 +736,7 @@ pub(crate) fn paint_page(
     view: &CalcOrderView,
     generation: u64,
     selected: Option<&str>,
+    pointer: Option<Pos2>,
 ) -> Option<String> {
     let listed = view.current(generation)?;
     // Each field's first widget on this page.
@@ -749,10 +750,9 @@ pub(crate) fn paint_page(
     if on_page.is_empty() {
         return None;
     }
-    let pointer = ui.input(|i| i.pointer.hover_pos());
     let hovered = pointer.and_then(|p| on_page.iter().rev().find(|(_, r)| r.contains(p))).map(|(n, _)| (*n).to_owned());
     let at: HashMap<&str, Rect> = on_page.iter().copied().collect();
-    let zoom = (xf.rect.width() / xf.pw.max(1.0)).clamp(0.5, 3.0);
+    let zoom = xf.zoom().clamp(0.5, 3.0);
     let focus = if view.hide_links { None } else { view.focus(selected) };
     // The focus's links, and the fields at either end of them (with the focus itself).
     let shown: Vec<&Link> = focus.as_deref().map(|f| listed.links.iter().filter(|l| l.from == f || l.to == f).collect()).unwrap_or_default();
diff --git a/crates/ui-egui/src/camera_ui.rs b/crates/ui-egui/src/tools/camera_ui.rs
similarity index 97%
rename from crates/ui-egui/src/camera_ui.rs
rename to crates/ui-egui/src/tools/camera_ui.rs
index 720ac7c6a7..d470378070 100644
--- a/crates/ui-egui/src/camera_ui.rs
+++ b/crates/ui-egui/src/tools/camera_ui.rs
@@ -5,6 +5,7 @@
 use egui::{Align2, Color32, CornerRadius, Pos2, Rect, Shape, Stroke, vec2};
 
 use crate::canvas::{DocView, PageXform, ViewAction};
+use crate::page_pointer::PagePointer;
 use crate::theme::Tokens;
 pub use pdfcraft_engine::camera_clean::Look;
 
@@ -58,9 +59,8 @@ fn screen(xf: &PageXform, c: [f32; 2]) -> Pos2 {
 }
 
 /// Corner dragging on one page. A press on a page without the quadrilateral moves it there.
-pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, page: usize, view: &mut DocView, allowed: bool) {
-    let pointer = ui.input(|i| i.pointer.hover_pos());
-    let origin = ui.input(|i| i.pointer.press_origin());
+pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, ptr: &PagePointer, page: usize, view: &mut DocView, allowed: bool) {
+    let (pointer, origin) = (ptr.pos, ptr.origin);
     if !allowed {
         if pointer.is_some_and(|p| xf.rect.contains(p)) {
             ui.ctx().set_cursor_icon(egui::CursorIcon::NotAllowed);
@@ -141,7 +141,7 @@ pub(crate) fn paint(painter: &egui::Painter, xf: &PageXform, page: usize, view:
 /// way, choose its look (original, colour, greyscale, black and white) and clean-up level,
 /// Crop pages, Organize pages, or Done. The instructions are a notice (`ocr.enhance_camera`).
 pub(crate) fn bar(ctx: &egui::Context, view: &mut DocView, area: Rect, t: &Tokens, allowed: bool) {
-    egui::Area::new(egui::Id::new("camera-bar"))
+    egui::Area::new(egui::Id::unique("camera-bar"))
         .order(egui::Order::Middle)
         .pivot(Align2::RIGHT_TOP)
         .fixed_pos(area.right_top() + vec2(-18.0, 12.0))
@@ -183,7 +183,7 @@ pub(crate) fn bar(ctx: &egui::Context, view: &mut DocView, area: Rect, t: &Token
                             let icon = |ui: &mut egui::Ui, name: &str, tip: &str| {
                                 let r = ui.add_enabled(allowed, egui::Button::image(crate::icons::image(name, 18.0, t.text)).frame(false));
                                 // Named for screen readers (and tests), not only on hover.
-                                r.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, allowed, tip));
+                                r.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, allowed, tip));
                                 r.on_hover_text(tip).clicked()
                             };
                             if icon(ui, "rotate-ccw", tl!("Rotate counterclockwise")) {
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
new file mode 100644
index 0000000000..674a3b4eac
--- /dev/null
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -0,0 +1,394 @@
+//! Commenting in the document view (execution plan M5.3–M5.4; Acrobat's "Add comments").
+//!
+//! - **Tools** ([`CommentTool`]): sticky note, text box, highlight / underline / strikethrough
+//!   (driven by text selection), freehand, line, arrow, rectangle, oval. They live in the quick
+//!   bar in three flyout groups, as in Acrobat's comment toolbar (audit `a14-*`).
+//! - **On the page:** drawing gestures with live previews; with the Select tool, comments can be
+//!   hovered, selected (blue frame with 8 round handles), moved, resized (rectangles, ovals and
+//!   text boxes), edited (double-click) and deleted (⌫ / Delete); a context menu offers Edit,
+//!   Reply, Set status, Colour and Delete.
+//! - **Composer:** the floating "Add a comment" card used for new notes, text boxes and edits.
+//!
+//! Everything is turned into `pdfcraft_engine::Edit`s, queued on the view as `pending_edit` and
+//! applied by the app, so each change is one undo step.
+
+use egui::{Color32, CornerRadius, Pos2, Rect, Sense, Stroke, pos2, vec2};
+use pdfcraft_engine::{Edit, LineEnding, Markup, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, Style};
+use pdfcraft_render::{Annotation, DocInfo, PageInfo, PageText};
+
+use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
+use crate::theme::{self, Tokens};
+use crate::{QuickTool, icons};
+
+mod composer;
+mod geometry;
+mod input;
+mod menu;
+mod paint;
+mod state;
+
+pub(crate) use composer::{composer, submit_key};
+#[cfg(test)]
+use geometry::handle_pos;
+#[cfg(test)]
+pub(crate) use geometry::{caret_snap, snapped_caret};
+pub(crate) use geometry::{corner_ratio, page_rotation, resized};
+pub use geometry::{drawn_text_box_rect, text_box_rect};
+pub(crate) use input::{fill_grabs, keys, nudge_keys, page_after_text, page_input, select_grabs};
+pub use menu::{CanvasAction, fill_picker, recent_custom_colours, remember_custom_colour, status_badge, swatch_grid};
+#[cfg(test)]
+use menu::{RECENT_CUSTOM, same_colour};
+pub(crate) use menu::{attachment_items, context_menu, quick_bar_controls};
+pub(crate) use paint::paint_page;
+#[cfg(test)]
+use paint::{changing_points, drawn_shape, edited_in_view};
+use state::login_name;
+pub use state::{CommentView, Composer, ComposerKind, Gesture, SortBy};
+pub(crate) use state::{EditorFocus, PageCx};
+
+/// Acrobat's selection blue for annotation frames and handles (11-visual-spec §5).
+const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum CommentTool {
+    Note,
+    TextBox,
+    Highlight,
+    Underline,
+    StrikeOut,
+    Squiggly,
+    Ink,
+    Line,
+    Arrow,
+    Rectangle,
+    Oval,
+    Polygon,
+    PolyLine,
+    Cloud,
+    Callout,
+    Caret,
+    ReplaceText,
+    Attach,
+    Eraser,
+}
+
+/// The quick-bar flyout groups, in Acrobat's order: Comment ▸, Highlight ▸, Draw ▸.
+pub const GROUPS: [&[CommentTool]; 3] = [
+    &[CommentTool::Note, CommentTool::TextBox, CommentTool::Callout, CommentTool::Attach],
+    &[CommentTool::Highlight, CommentTool::Underline, CommentTool::StrikeOut, CommentTool::Squiggly, CommentTool::Caret, CommentTool::ReplaceText],
+    &[
+        CommentTool::Ink,
+        CommentTool::Line,
+        CommentTool::Arrow,
+        CommentTool::Rectangle,
+        CommentTool::Oval,
+        CommentTool::PolyLine,
+        CommentTool::Polygon,
+        CommentTool::Cloud,
+        CommentTool::Eraser,
+    ],
+];
+
+pub const ALL: [CommentTool; 19] = [
+    CommentTool::Eraser,
+    CommentTool::ReplaceText,
+    CommentTool::Attach,
+    CommentTool::Polygon,
+    CommentTool::PolyLine,
+    CommentTool::Cloud,
+    CommentTool::Callout,
+    CommentTool::Caret,
+    CommentTool::Note,
+    CommentTool::TextBox,
+    CommentTool::Highlight,
+    CommentTool::Underline,
+    CommentTool::StrikeOut,
+    CommentTool::Squiggly,
+    CommentTool::Ink,
+    CommentTool::Line,
+    CommentTool::Arrow,
+    CommentTool::Rectangle,
+    CommentTool::Oval,
+];
+
+impl CommentTool {
+    pub fn command(self) -> &'static str {
+        match self {
+            Self::Note => "comment.note",
+            Self::TextBox => "comment.freetext",
+            Self::Highlight => "comment.highlight",
+            Self::Underline => "comment.underline",
+            Self::StrikeOut => "comment.strikeout",
+            Self::Squiggly => "comment.squiggly",
+            Self::Ink => "comment.ink",
+            Self::Line => "comment.line",
+            Self::Arrow => "comment.arrow",
+            Self::Rectangle => "comment.square",
+            Self::Oval => "comment.circle",
+            Self::Polygon => "comment.polygon",
+            Self::PolyLine => "comment.polyline",
+            Self::Cloud => "comment.cloud",
+            Self::Callout => "comment.callout",
+            Self::Caret => "comment.caret",
+            Self::ReplaceText => "comment.replace",
+            Self::Attach => "comment.attach",
+            Self::Eraser => "comment.eraser",
+        }
+    }
+
+    pub fn from_command(id: &str) -> Option<Self> {
+        ALL.into_iter().find(|t| t.command() == id)
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Note => "Add a sticky note",
+            Self::TextBox => "Add a text box",
+            Self::Highlight => "Highlight",
+            Self::Underline => "Underline",
+            Self::StrikeOut => "Strikethrough",
+            Self::Squiggly => "Squiggly underline",
+            Self::Ink => "Draw",
+            Self::Line => "Line",
+            Self::Arrow => "Arrow",
+            Self::Rectangle => "Rectangle",
+            Self::Oval => "Oval",
+            Self::Polygon => "Polygon",
+            Self::PolyLine => "Connected lines",
+            Self::Cloud => "Cloud",
+            Self::Callout => "Add a callout",
+            Self::Caret => "Insert text",
+            Self::ReplaceText => "Replace text",
+            Self::Attach => "Attach file",
+            Self::Eraser => "Eraser",
+        }
+    }
+
+    pub fn icon(self) -> &'static str {
+        match self {
+            Self::Note => "message-square-plus",
+            Self::TextBox => "type",
+            Self::Highlight => "highlighter",
+            Self::Underline => "underline",
+            Self::StrikeOut => "strikethrough",
+            Self::Squiggly => "spline",
+            Self::Ink => "pencil",
+            Self::Line => "minus",
+            Self::Arrow => "move-right",
+            Self::Rectangle => "square",
+            Self::Oval => "circle",
+            Self::Polygon => "pentagon",
+            Self::PolyLine => "spline",
+            Self::Cloud => "cloud",
+            Self::Callout => "message-square-quote",
+            Self::Caret => "text-cursor-input",
+            Self::ReplaceText => "replace",
+            Self::Attach => "paperclip",
+            Self::Eraser => "eraser",
+        }
+    }
+
+    pub fn group(self) -> usize {
+        GROUPS.iter().position(|g| g.contains(&self)).unwrap_or(0)
+    }
+
+    pub fn markup(self) -> Option<Markup> {
+        match self {
+            Self::Highlight => Some(Markup::Highlight),
+            Self::Underline => Some(Markup::Underline),
+            Self::StrikeOut => Some(Markup::StrikeOut),
+            Self::Squiggly => Some(Markup::Squiggly),
+            _ => None,
+        }
+    }
+
+    /// Tools that draw with a drag gesture.
+    pub fn draws(self) -> bool {
+        matches!(self, Self::Ink | Self::Line | Self::Arrow | Self::Rectangle | Self::Oval | Self::Eraser)
+    }
+
+    /// Tools that place points one click at a time (double-click or Enter finishes).
+    pub fn clicks_points(self) -> bool {
+        matches!(self, Self::Polygon | Self::PolyLine | Self::Cloud)
+    }
+
+    /// Whether the line-thickness control applies.
+    pub fn has_width(self) -> bool {
+        self.draws() || self.clicks_points() || matches!(self, Self::TextBox | Self::Callout)
+    }
+
+    /// Text comments may have no border while retaining visible text or fill.
+    fn min_width(self) -> f64 {
+        if matches!(self, Self::TextBox | Self::Callout) { 0.0 } else { 0.5 }
+    }
+
+    /// Whether the fill-colour control applies to this tool.
+    pub fn has_fill(self) -> bool {
+        matches!(self, Self::Rectangle | Self::Oval | Self::Polygon | Self::Cloud | Self::TextBox | Self::Callout)
+    }
+
+    /// A placeholder shape of this kind (for per-tool default styles).
+    fn sample(self) -> Shape {
+        match self {
+            Self::Note => Shape::Note { at: [0.0; 2], icon: NoteIcon::Comment },
+            Self::TextBox => Shape::TextBox { rect: [0.0; 4], font_size: 12.0 },
+            Self::Highlight | Self::Underline | Self::StrikeOut | Self::Squiggly => {
+                Shape::TextMarkup { kind: self.markup().unwrap_or(Markup::Highlight), quads: Vec::new() }
+            }
+            Self::Ink => Shape::Ink { strokes: Vec::new() },
+            Self::Line => Shape::Line { from: [0.0; 2], to: [0.0; 2], start: LineEnding::None, end: LineEnding::None },
+            Self::Arrow => Shape::Line { from: [0.0; 2], to: [0.0; 2], start: LineEnding::None, end: LineEnding::OpenArrow },
+            Self::Rectangle => Shape::Rectangle { rect: [0.0; 4] },
+            Self::Oval => Shape::Oval { rect: [0.0; 4] },
+            Self::Polygon => Shape::Polygon { vertices: Vec::new(), cloud: false },
+            Self::Cloud => Shape::Polygon { vertices: Vec::new(), cloud: true },
+            Self::PolyLine => Shape::PolyLine { vertices: Vec::new(), start: LineEnding::None, end: LineEnding::None },
+            Self::Callout => Shape::Callout { rect: [0.0; 4], knee: [0.0; 2], point: [0.0; 2], font_size: 10.0, ending: LineEnding::OpenArrow },
+            Self::Caret => Shape::Caret { rect: [0.0; 4] },
+            Self::ReplaceText => Shape::TextMarkup { kind: Markup::StrikeOut, quads: Vec::new() },
+            Self::Eraser => Shape::Ink { strokes: Vec::new() },
+            Self::Attach => Shape::Attachment { at: [0.0; 2], icon: pdfcraft_engine::AttachIcon::PushPin, file: String::new(), data: Vec::new() },
+        }
+    }
+}
+
+/// The comment swatches (our palette, close to Acrobat's quick colours).
+pub const SWATCHES: [(&str, Rgb); 10] = [
+    ("Yellow", [1.0, 0.94, 0.0]),
+    ("Orange", [1.0, 0.54, 0.0]),
+    ("Red", [0.89, 0.13, 0.13]),
+    ("Pink", [1.0, 0.37, 0.64]),
+    ("Purple", [0.54, 0.25, 0.82]),
+    ("Blue", [0.0, 0.47, 0.84]),
+    ("Light blue", [0.36, 0.75, 0.98]),
+    ("Green", [0.18, 0.62, 0.36]),
+    ("Gray", [0.5, 0.5, 0.5]),
+    ("Black", [0.0, 0.0, 0.0]),
+];
+
+pub fn color32(c: Rgb) -> Color32 {
+    let b = |v: f64| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
+    Color32::from_rgb(b(c[0]), b(c[1]), b(c[2]))
+}
+
+/// Commenting preferences shared by every document (author, per-tool styles, pin).
+#[derive(Clone, Debug)]
+pub struct CommentPrefs {
+    /// `/T` of new comments (Acrobat: Preferences ▸ Identity, default the login name).
+    pub author: String,
+    styles: Vec<(CommentTool, Style)>,
+    /// Keep the tool selected after use (the pin).
+    pub pinned: bool,
+    /// The tool each flyout group shows (the last one used).
+    pub group_tool: [CommentTool; 3],
+    /// Hide hover previews on highlight annotations when they contain no comment text beyond the author.
+    pub hide_empty_highlight_hover: bool,
+}
+
+impl Default for CommentPrefs {
+    fn default() -> Self {
+        Self {
+            author: login_name(),
+            styles: ALL.iter().map(|t| (*t, Style::default_for(&t.sample()))).collect(),
+            pinned: false,
+            group_tool: [CommentTool::Note, CommentTool::Highlight, CommentTool::Ink],
+            hide_empty_highlight_hover: false,
+        }
+    }
+}
+
+impl CommentPrefs {
+    pub fn style(&self, tool: CommentTool) -> Style {
+        self.styles.iter().find(|(t, _)| *t == tool).map(|(_, s)| s.clone()).unwrap_or_default()
+    }
+
+    /// Every tool with its current default style (the persisted settings read this).
+    pub fn styles(&self) -> impl Iterator<Item = (CommentTool, &Style)> {
+        self.styles.iter().map(|(t, s)| (*t, s))
+    }
+
+    pub fn set_color(&mut self, tool: CommentTool, c: Rgb) {
+        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
+            s.color = c;
+        }
+    }
+
+    pub fn set_width(&mut self, tool: CommentTool, w: f64) {
+        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
+            s.width = w.clamp(tool.min_width(), 12.0);
+        }
+    }
+
+    /// The tool's opacity, 10–100 % (an invisible comment can't be found again).
+    pub fn set_opacity(&mut self, tool: CommentTool, o: f64) {
+        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
+            s.opacity = if o.is_finite() { o.clamp(0.1, 1.0) } else { 1.0 };
+        }
+    }
+
+    /// The tool's fill (`None`: no fill).
+    pub fn set_fill(&mut self, tool: CommentTool, fill: Option<Rgb>) {
+        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
+            s.fill = if tool.has_fill() { fill.filter(|c| c.iter().all(|x| x.is_finite())).map(|c| c.map(|x| x.clamp(0.0, 1.0))) } else { None };
+        }
+    }
+
+    pub fn set_style(&mut self, tool: CommentTool, style: Style) {
+        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
+            *s = style;
+        }
+    }
+}
+
+/// Whether `tool` makes comments like `a`. Arrows are saved as plain Line annotations with an
+/// ending, so the Line and Arrow tools both match a line.
+pub(crate) fn made_by(a: &Annotation, tool: CommentTool) -> bool {
+    match tool_for(a) {
+        Some(CommentTool::Line) => matches!(tool, CommentTool::Line | CommentTool::Arrow),
+        made => made == Some(tool),
+    }
+}
+
+/// The tool whose defaults "Make Current Properties Default" should update.
+///
+/// Arrows are stored as Line annotations. An arrow ending belongs to the Arrow tool, so its
+/// defaults stay separate from a plain line.
+pub(crate) fn tool_for_default(a: &Annotation, endings: Option<&[LineEnding]>) -> Option<CommentTool> {
+    match tool_for(a) {
+        Some(CommentTool::Line) if endings.is_some_and(|ends| ends.iter().copied().any(arrow_ending)) => Some(CommentTool::Arrow),
+        other => other,
+    }
+}
+
+fn arrow_ending(ending: LineEnding) -> bool {
+    matches!(ending, LineEnding::OpenArrow | LineEnding::ClosedArrow | LineEnding::ROpenArrow | LineEnding::RClosedArrow)
+}
+
+/// The tool that makes comments like `a` (for Make Current Properties Default).
+pub fn tool_for(a: &Annotation) -> Option<CommentTool> {
+    Some(match (a.subtype.as_str(), a.intent.as_deref()) {
+        ("Text", _) => CommentTool::Note,
+        ("FreeText", Some("FreeTextCallout")) => CommentTool::Callout,
+        ("FreeText", Some("FreeTextTypeWriter")) => return None,
+        ("FreeText", _) => CommentTool::TextBox,
+        ("Highlight", _) => CommentTool::Highlight,
+        ("Underline", _) => CommentTool::Underline,
+        ("StrikeOut", Some("StrikeOutTextEdit")) => CommentTool::ReplaceText,
+        ("StrikeOut", _) => CommentTool::StrikeOut,
+        ("Squiggly", _) => CommentTool::Squiggly,
+        ("Ink", _) => CommentTool::Ink,
+        ("Line", _) => CommentTool::Line,
+        ("Square", _) => CommentTool::Rectangle,
+        ("Circle", _) => CommentTool::Oval,
+        ("Polygon", Some("PolygonCloud")) => CommentTool::Cloud,
+        ("Polygon", _) => CommentTool::Polygon,
+        ("PolyLine", _) => CommentTool::PolyLine,
+        ("Caret", _) => CommentTool::Caret,
+        ("FileAttachment", _) => CommentTool::Attach,
+        _ => return None,
+    })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/tools/comments/composer.rs b/crates/ui-egui/src/tools/comments/composer.rs
new file mode 100644
index 0000000000..8c83c3ba15
--- /dev/null
+++ b/crates/ui-egui/src/tools/comments/composer.rs
@@ -0,0 +1,182 @@
+use super::geometry::{drawn_text_box_rect, page_rotation, text_box_rect};
+use super::paint::{edited_in_view, new_comment};
+use super::state::{ComposerKind, PageCx};
+use super::*;
+
+/// The floating composer card (new note, new text box, edit). Returns the edit to apply.
+pub(crate) fn composer(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, prefs: &CommentPrefs) -> Option<Edit> {
+    let c = view.comments.composer.as_ref()?;
+    let page = c.page;
+    let Some(xf) = view.page_xform(page) else {
+        // Scrolled away: keep the draft until the page is back, and give it the keyboard then.
+        if let Some(c) = view.comments.composer.as_mut() {
+            c.focus = true;
+        }
+        return None;
+    };
+    let cx = PageCx {
+        page,
+        xf: &xf,
+        ptr: &PagePointer::default(),
+        info,
+        tool: QuickTool::Select,
+        prefs,
+        allowed: true,
+        hidden: false,
+        redact_mark: ([0.89, 0.13, 0.13], 1.0),
+    };
+    let anchor = cx.to_screen(c.at);
+    let viewport = view.viewport_rect();
+    let t = Tokens::get(ctx);
+    let mut post = false;
+    let mut cancel = false;
+    let c = view.comments.composer.as_mut()?;
+    let title = match c.kind {
+        ComposerKind::Note => "Sticky note",
+        ComposerKind::TextBox { .. } => "Text box",
+        ComposerKind::Callout { .. } => "Callout",
+        ComposerKind::Caret { .. } => "Inserted text",
+        ComposerKind::Replace => "Replacement text",
+        ComposerKind::Edit(_) => "Edit comment",
+    };
+    // Its comment scrolled out of the document: keep the draft until it is back, rather than
+    // pushing the card into the window over the mode bar and toolbar (#4021). An edited comment
+    // that is only partly scrolled away keeps its card, at the nearest point inside the document.
+    let mut anchor = anchor;
+    if !viewport.contains(anchor) {
+        let part_visible = matches!(c.kind, ComposerKind::Edit(index) if edited_in_view(&cx, index, viewport));
+        if !part_visible {
+            c.focus = true;
+            return None;
+        }
+        anchor = anchor.clamp(viewport.min, viewport.max);
+    }
+    let pos = pos2(anchor.x + 12.0, anchor.y);
+    let area = egui::Area::new(egui::Id::unique(("comment-composer", view.id.0))).order(egui::Order::Foreground).constrain_to(viewport);
+    area.fixed_pos(pos).show(ctx, |ui| {
+        egui::Frame::popup(ui.style()).inner_margin(egui::Margin::same(12)).corner_radius(CornerRadius::same(8)).show(ui, |ui| {
+            ui.set_width(260.0);
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(prefs.author.clone()).font(theme::semibold(13.0)));
+                ui.label(egui::RichText::new(tl!(title)).font(theme::regular(11.5)).color(t.text_faint));
+            });
+            ui.add_space(6.0);
+            let hint = match c.kind {
+                ComposerKind::TextBox { .. } | ComposerKind::Callout { .. } => tl!("Type text"),
+                ComposerKind::Caret { .. } => tl!("Text to insert"),
+                ComposerKind::Replace => tl!("Replacement text"),
+                _ => tl!("Add a comment"),
+            };
+            let edit = ui
+                .add(egui::TextEdit::multiline(&mut c.text).hint_text(hint).desired_rows(3).desired_width(f32::INFINITY).id_salt("composer-text"))
+                // 0.37 kittest rejects an unnamed text input; the hint is its logical name.
+                .accessible_name(hint);
+            if c.focus {
+                edit.request_focus();
+                c.focus = false;
+            }
+            let enter = submit_key(ui, &edit, false);
+            if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+                cancel = true;
+            }
+            ui.add_space(8.0);
+            ui.horizontal(|ui| {
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    let can_post = !c.text.trim().is_empty() || matches!(c.kind, ComposerKind::Edit(_));
+                    if ui
+                        .add_enabled(
+                            can_post,
+                            egui::Button::new(egui::RichText::new(tl!("Post")).color(Color32::WHITE)).fill(t.accent).corner_radius(14),
+                        )
+                        .clicked()
+                        || (enter && can_post)
+                    {
+                        post = true;
+                    }
+                    if ui.add(egui::Button::new(tl!("Cancel")).corner_radius(14)).clicked() {
+                        cancel = true;
+                    }
+                });
+            });
+        });
+    });
+    if cancel {
+        view.comments.composer = None;
+        return None;
+    }
+    if !post {
+        return None;
+    }
+    let c = view.comments.composer.take()?;
+    let text = c.text.trim_end().to_string();
+    match c.kind {
+        ComposerKind::Edit(index) => Some(Edit::SetAnnotationContents { page, index, text }),
+        ComposerKind::Note => {
+            view.comments.tool_done = true;
+            Some(new_comment(&cx, CommentTool::Note, Shape::Note { at: c.at, icon: NoteIcon::Comment }, text))
+        }
+        ComposerKind::TextBox { size } => {
+            view.comments.tool_done = true;
+            let rotation = page_rotation(info, page);
+            let border = prefs.style(CommentTool::TextBox).width;
+            let rect = match (size, info.pages.get(page)) {
+                (Some(size), Some(p)) => drawn_text_box_rect(p, c.at, size, &text, 12.0, border),
+                _ => text_box_rect(c.at, &text, 12.0, rotation),
+            };
+            Some(new_comment(&cx, CommentTool::TextBox, Shape::TextBox { rect, font_size: 12.0 }, text))
+        }
+        ComposerKind::Callout { point } => {
+            view.comments.tool_done = true;
+            // A callout's leader and box stay in user-space axes (its appearance isn't turned).
+            let rect = text_box_rect(c.at, &text, 10.0, 0);
+            let side = if point[0] < rect[0] {
+                rect[0]
+            } else if point[0] > rect[2] {
+                rect[2]
+            } else {
+                (rect[0] + rect[2]) / 2.0
+            };
+            let knee = [(point[0] + side) / 2.0, (rect[1] + rect[3]) / 2.0];
+            Some(new_comment(&cx, CommentTool::Callout, Shape::Callout { rect, knee, point, font_size: 10.0, ending: LineEnding::OpenArrow }, text))
+        }
+        ComposerKind::Replace => {
+            view.comments.tool_done = true;
+            let quads = view.comments.replace.take()?;
+            Some(Edit::ReplaceText {
+                page,
+                quads,
+                text,
+                author: prefs.author.clone(),
+                strike: prefs.style(CommentTool::ReplaceText),
+                caret: prefs.style(CommentTool::Caret),
+            })
+        }
+        ComposerKind::Caret { size } => {
+            view.comments.tool_done = true;
+            let [x, y] = c.at;
+            let half = size / 2.0;
+            Some(new_comment(&cx, CommentTool::Caret, Shape::Caret { rect: [x - half, y - size, x + half, y] }, text))
+        }
+    }
+}
+
+/// Submit only from the focused comment editor. Match each key event's modifiers exactly,
+/// so Shift+Enter stays a newline and another editor cannot submit this draft. Replies also
+/// keep their existing unmodified Enter-to-post behavior.
+pub(crate) fn submit_key(ui: &mut egui::Ui, field: &egui::Response, plain_enter: bool) -> bool {
+    field.has_focus()
+        && ui.input_mut(|input| {
+            let mut submit = false;
+            input.events.retain(|event| {
+                let matched = matches!(event,
+                    egui::Event::Key { key: egui::Key::Enter, pressed: true, modifiers, .. }
+                        if modifiers.matches_exact(egui::Modifiers::CTRL)
+                            || modifiers.matches_exact(egui::Modifiers::COMMAND)
+                            || plain_enter && modifiers.matches_exact(egui::Modifiers::NONE)
+                );
+                submit |= matched;
+                !matched
+            });
+            submit
+        })
+}
diff --git a/crates/ui-egui/src/tools/comments/geometry.rs b/crates/ui-egui/src/tools/comments/geometry.rs
new file mode 100644
index 0000000000..75d56c2258
--- /dev/null
+++ b/crates/ui-egui/src/tools/comments/geometry.rs
@@ -0,0 +1,194 @@
+use super::state::PageCx;
+use super::*;
+
+pub(super) fn is_markup(subtype: &str) -> bool {
+    matches!(subtype, "Highlight" | "Underline" | "StrikeOut" | "Squiggly")
+}
+
+/// Rectangles, ovals, text boxes, stamps and drawings (drawn signatures among them). A callout's
+/// `/Rect` also holds its leader line, so it only moves.
+pub(super) fn resizable(a: &Annotation) -> bool {
+    matches!(a.subtype.as_str(), "Square" | "Circle" | "FreeText" | "Stamp" | "Ink") && a.intent.as_deref() != Some("FreeTextCallout")
+}
+
+/// Lines, connected lines, polygons and clouds: their ends and corners have handles of their own
+/// (measurements keep the points they measured, and a locked comment its shape).
+pub(super) fn reshapable(a: &Annotation) -> bool {
+    matches!(a.subtype.as_str(), "Line" | "PolyLine" | "Polygon")
+        && !a.points.is_empty()
+        && !a.locked
+        && !a.intent.as_deref().is_some_and(|i| i.ends_with("Dimension"))
+}
+
+/// Whether `tool` picks up a line's end and corner handles: the Select and Fill & Sign tools.
+/// The drawing tools draw from where they are pressed, so a new line starts at the end of the
+/// one just drawn rather than dragging it.
+pub(super) fn grabs_points(tool: QuickTool) -> bool {
+    !matches!(tool, QuickTool::Comment(t) if t.draws() || t.clicks_points())
+}
+
+/// The point of `a` (an end or a corner) whose handle is at `p` on screen.
+pub(super) fn point_handle(cx: &PageCx<'_>, a: &Annotation, p: Pos2) -> Option<usize> {
+    a.points.iter().position(|q| cx.to_screen([f64::from(q[0]), f64::from(q[1])]).distance(p) <= 7.0)
+}
+
+/// `points` with point `i` moved to `to`; with Shift, held to the nearest 45° from the point
+/// before it (a line's other end; the first corner turns about the second).
+pub(crate) fn reshaped(points: &[[f64; 2]], i: usize, to: [f64; 2], shift: bool) -> Vec<[f64; 2]> {
+    let mut out = points.to_vec();
+    let anchor = if i == 0 { points.get(1) } else { points.get(i - 1) };
+    let to = match anchor {
+        Some(a) if shift => pdfcraft_engine::measure::snap::constrain(*a, to),
+        _ => to,
+    };
+    if let Some(p) = out.get_mut(i) {
+        *p = to;
+    }
+    out
+}
+
+pub(super) const HANDLES: [(i8, i8); 8] = [(-1, -1), (0, -1), (1, -1), (1, 0), (1, 1), (0, 1), (-1, 1), (-1, 0)];
+
+pub(super) fn handle_pos(r: Rect, (hx, hy): (i8, i8)) -> Pos2 {
+    let x = match hx {
+        -1 => r.left(),
+        0 => r.center().x,
+        _ => r.right(),
+    };
+    let y = match hy {
+        -1 => r.top(),
+        0 => r.center().y,
+        _ => r.bottom(),
+    };
+    pos2(x, y)
+}
+
+/// The proportions a corner drag of `r` keeps: the box's own fixed ratio (an image signature's),
+/// else `r`'s current one while Shift is held, else none.
+pub(crate) fn corner_ratio(r: Rect, fixed: Option<f32>, shift: bool) -> Option<f32> {
+    fixed.or_else(|| (shift && r.width() > 0.0 && r.height() > 0.0).then(|| r.width() / r.height()))
+}
+
+pub(crate) fn resized(r: Rect, (hx, hy): (i8, i8), d: egui::Vec2, aspect_ratio: Option<f32>) -> Rect {
+    if hx != 0
+        && hy != 0
+        && let Some(ratio) = aspect_ratio.filter(|v| v.is_finite() && *v > 0.0)
+    {
+        // As in content_ui, the larger requested dimension drives proportional corner resizing.
+        // Keep the opposite corner fixed and prevent crossing it from flipping the image.
+        let width = (r.width() + f32::from(hx) * d.x).max((r.height() + f32::from(hy) * d.y) * ratio).max(4.0).max(4.0 * ratio);
+        let anchor = handle_pos(r, (-hx, -hy));
+        return Rect::from_two_pos(anchor, anchor + vec2(f32::from(hx) * width, f32::from(hy) * width / ratio));
+    }
+    let mut r = r;
+    match hx {
+        -1 => r.min.x += d.x,
+        1 => r.max.x += d.x,
+        _ => {}
+    }
+    match hy {
+        -1 => r.min.y += d.y,
+        1 => r.max.y += d.y,
+        _ => {}
+    }
+    Rect::from_two_pos(r.min, r.max)
+}
+
+pub(super) fn clamp_to(r: Rect, p: Pos2) -> Pos2 {
+    pos2(p.x.clamp(r.left(), r.right()), p.y.clamp(r.top(), r.bottom()))
+}
+
+/// The side of the caret's box, in user space units, away from text.
+pub(super) const CARET_SIZE: f64 = 8.0;
+
+/// [`caret_snap`] in the page's user space: the caret's tip and the side of its box.
+///
+/// The caret is drawn upright in user space, so it only snaps on an unrotated page, where up on
+/// the page is up on screen; its size goes through the same mapping as the tip, so a page with
+/// `/UserUnit` gets a caret of the same size relative to its text.
+pub(crate) fn snapped_caret(page: &PageInfo, text: &PageText, vx: f32, vy: f32) -> Option<([f64; 2], f64)> {
+    if !page.rotation.is_multiple_of(360) {
+        return None;
+    }
+    let ([x, y], size) = caret_snap(text, vx, vy)?;
+    let tip = page.view_to_user(x, y);
+    let foot = page.view_to_user(x, y + size);
+    let side = f64::from(tip[1] - foot[1]);
+    (side.is_finite() && side > 0.0).then(|| ([f64::from(tip[0]), f64::from(tip[1])], side))
+}
+
+/// Insert text: where a click puts the caret's tip (view space) and how tall the caret is.
+///
+/// On upright, horizontal text the tip snaps to the nearer edge of the character under (or
+/// next to) the click, on the line's baseline, and the caret's side is half the text's em size
+/// (clamped to 4–36 view-space points; [`snapped_caret`] maps it to user space): the
+/// proposal marks an insertion point in the text, as a proofreader's caret does. Elsewhere
+/// (away from text, or on turned, sloped or vertical text) it returns `None` and the caret stays
+/// at the click. A ligature is one glyph, so the caret goes before or after it, never inside.
+pub(crate) fn caret_snap(text: &PageText, vx: f32, vy: f32) -> Option<([f32; 2], f32)> {
+    let g = text.glyphs.get(text.nearest(vx, vy)?)?;
+    if !(g.direction[0] > 0.0 && g.direction[1].abs() <= 0.02) {
+        return None;
+    }
+    // Close enough to belong to this glyph: within half an em of its box.
+    let [x0, y0, x1, y1] = g.rect;
+    let slack = (y1 - y0) / 2.0;
+    if !(slack.is_finite() && slack > 0.0) || vx < x0 - slack || vx > x1 + slack || vy < y0 - slack || vy > y1 + slack {
+        return None;
+    }
+    // The em box runs from 0.2 em below the baseline to 0.8 em above it (`pdfcraft_render`'s
+    // text extraction); `quad` is its bottom edge in the writing direction, then its top edge
+    // backwards. Take the side of the box the click is nearer to: its foot and head.
+    let [q0, q1, q2, q3] = g.quad;
+    let (foot, head) = if vx < (q0[0] + q1[0]) / 2.0 { (q0, q3) } else { (q1, q2) };
+    let em = (head[0] - foot[0]).hypot(head[1] - foot[1]);
+    if !(em.is_finite() && em > 0.0) {
+        return None;
+    }
+    let baseline = [foot[0] + 0.2 * (head[0] - foot[0]), foot[1] + 0.2 * (head[1] - foot[1])];
+    Some((baseline, (em / 2.0).clamp(4.0, 36.0)))
+}
+
+/// A text box sized to its text (at most 300 pt wide), hanging from its top-left corner.
+/// The box for `text` at `size` with its displayed top-left corner at `at`, on a page turned by
+/// `rotation` (its `/Rotate`): on a quarter-turned page it is taller than wide in user space.
+pub fn text_box_rect(at: [f64; 2], text: &str, size: f64, rotation: i64) -> [f64; 4] {
+    use pdfcraft_engine::annot_text::{text_width, wrap};
+    let pad = 2.0;
+    let longest = text.lines().map(|l| text_width(l, size)).fold(0.0, f64::max);
+    let w = (longest + 2.0 * pad + 4.0).clamp(40.0, 300.0);
+    let lines = wrap(text, size, w - 2.0 * pad).len().max(1);
+    let h = lines as f64 * size * 1.2 + 2.0 * pad + 2.0;
+    pdfcraft_engine::text_box_at(rotation, at, w, h).unwrap_or([at[0], at[1] - h, at[0] + w, at[1]])
+}
+
+/// The box dragged between user-space points `a` and `b`: its displayed top-left corner (user
+/// space) and its displayed width and height. Measured in the page's view space, so the view's
+/// own rotation and zoom (View > Rotate View) do not turn or scale it.
+pub(super) fn drawn_box(page: &PageInfo, a: [f64; 2], b: [f64; 2]) -> ([f64; 2], [f64; 2]) {
+    let (a, b) = (page.user_to_view(a[0] as f32, a[1] as f32), page.user_to_view(b[0] as f32, b[1] as f32));
+    let at = page.view_to_user(a[0].min(b[0]), a[1].min(b[1]));
+    ([f64::from(at[0]), f64::from(at[1])], [f64::from((a[0] - b[0]).abs()), f64::from((a[1] - b[1]).abs())])
+}
+
+/// A text box dragged out `size` (displayed width and height) from its displayed top-left corner
+/// `at`, with a border `border` wide: the text wraps to its width inside the border, as its
+/// appearance lays it out. When the text needs more lines the box grows down, and moves up to stay
+/// on the page; text that cannot fit even so keeps the drawn height and is clipped.
+pub fn drawn_text_box_rect(page: &PageInfo, at: [f64; 2], size: [f64; 2], text: &str, font_size: f64, border: f64) -> [f64; 4] {
+    use pdfcraft_engine::annot_text::wrap;
+    let pad = 2.0 + border.max(0.0);
+    let [w, drawn] = size;
+    let lines = wrap(text, font_size, (w - 2.0 * pad).max(1.0)).len().max(1);
+    let needed = lines as f64 * font_size * 1.2 + 2.0 * pad + 2.0;
+    let [vx, vy] = page.user_to_view(at[0] as f32, at[1] as f32).map(f64::from);
+    let bottom = f64::from(page.height);
+    let (top, h) = if needed <= drawn || needed > bottom { (vy, drawn) } else { (vy.min(bottom - needed).max(0.0), needed) };
+    let at = page.view_to_user(vx as f32, top as f32).map(f64::from);
+    pdfcraft_engine::text_box_at(i64::from(page.rotation), at, w, h).unwrap_or([at[0], at[1] - h, at[0] + w, at[1]])
+}
+
+/// The `/Rotate` of `page` (0 when it is unknown).
+pub(crate) fn page_rotation(info: &DocInfo, page: usize) -> i64 {
+    info.pages.get(page).map_or(0, |p| i64::from(p.rotation))
+}
diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
new file mode 100644
index 0000000000..d8cc33400b
--- /dev/null
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -0,0 +1,586 @@
+use super::geometry::{
+    CARET_SIZE, HANDLES, clamp_to, corner_ratio, drawn_box, grabs_points, handle_pos, is_markup, point_handle, reshapable, reshaped, resizable,
+    resized, snapped_caret,
+};
+use super::paint::{drawn_shape, edit_anchor, erase, new_comment};
+use super::state::{Composer, ComposerKind, Gesture, PageCx};
+use super::*;
+
+/// Comment input on one page, before text selection runs. Returns `true` when the pointer
+/// gesture belongs to commenting (text selection must ignore it).
+pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>, view: &mut DocView) -> bool {
+    let (pointer, origin) = (cx.ptr.pos, cx.ptr.origin);
+    let page_rect = cx.xf.rect;
+    let pressed_here = origin.is_some_and(|o| page_rect.contains(o));
+    let over_page = pointer.is_some_and(|p| page_rect.contains(p));
+    let fill_grab = fill_grabs(cx, view);
+    let draw_grab = draw_grabs(cx, view);
+    let caret_text = if cx.tool == QuickTool::Comment(CommentTool::Caret) { view.page_text(cx.page) } else { None };
+    let cv = &mut view.comments;
+    if cv.gesture.is_some() && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
+        cv.gesture = None;
+        cv.cancelled_drag = true;
+        return true;
+    }
+    if cv.cancelled_drag {
+        return true;
+    }
+    if resp.secondary_clicked()
+        && let Some(p) = pointer.filter(|p| page_rect.contains(*p))
+    {
+        cv.context_at = Some((cx.page, cx.to_user(p)));
+        cv.selected = cx.hit(p).map(|a| (cx.page, a.index));
+    }
+    match cx.tool {
+        // The shape just drawn is selected with its handles showing: they resize it without a
+        // trip to the Select tool (#2338). Anywhere else the tool keeps drawing.
+        QuickTool::Comment(_) if draw_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
+        QuickTool::Comment(tool) if tool.draws() => {
+            if !cx.allowed {
+                return false;
+            }
+            if over_page {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
+            }
+            if resp.drag_started()
+                && pressed_here
+                && let Some(o) = origin
+            {
+                cv.gesture = Some(Gesture::Draw { page: cx.page, tool, points: vec![cx.to_user(o)] });
+                cv.selected = None;
+            }
+            if let Some(Gesture::Draw { page, tool, points }) = cv.gesture.as_mut()
+                && *page == cx.page
+                && let Some(p) = pointer
+            {
+                let p = clamp_to(page_rect, p);
+                let u = cx.to_user(p);
+                if matches!(*tool, CommentTool::Ink | CommentTool::Eraser) {
+                    let last = points.last().map(|l| cx.to_screen(*l)).unwrap_or(p);
+                    if last.distance(p) >= 1.5 {
+                        points.push(u);
+                    }
+                } else {
+                    points.truncate(1);
+                    points.push(u);
+                }
+            }
+            if resp.drag_stopped()
+                && let Some(Gesture::Draw { page, tool, points }) = cv.gesture.clone()
+                && page == cx.page
+            {
+                cv.gesture = None;
+                if tool == CommentTool::Eraser {
+                    view.pending_edit = erase(cx, &points);
+                } else if let Some(shape) = drawn_shape(tool, &points) {
+                    let now = ui.input(|i| i.time);
+                    cv.settle(now, page, tool, &points);
+                    view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
+                }
+            }
+            // A quick press/release does not start an egui drag, but Acrobat's Draw tool treats
+            // it as a one-point ink stroke (a dot). The appearance uses round line caps, so a
+            // single PDF point is visible and remains editable like any other drawing.
+            if tool == CommentTool::Ink
+                && resp.clicked()
+                && over_page
+                && let Some(p) = pointer
+                && let Some(shape) = drawn_shape(tool, &[cx.to_user(p)])
+            {
+                cv.selected = None;
+                let now = ui.input(|i| i.time);
+                cv.settle(now, cx.page, tool, &[cx.to_user(p)]);
+                view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
+            }
+            true
+        }
+        QuickTool::Comment(tool) if tool.clicks_points() => {
+            if !cx.allowed {
+                return false;
+            }
+            if over_page {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
+            }
+            let finish = resp.double_clicked() || ui.input(|i| i.key_pressed(egui::Key::Enter));
+            // Backspace (or Delete) takes back the last point, e.g. after a wrong click; Undo does too.
+            // Only while a drawing is in progress: otherwise Delete belongs to the selected comment.
+            if matches!(cv.gesture, Some(Gesture::Draw { page, .. }) if page == cx.page)
+                && !ui.ctx().egui_wants_keyboard_input()
+                && ui.input_mut(|i| {
+                    i.consume_key(egui::Modifiers::NONE, egui::Key::Backspace) || i.consume_key(egui::Modifiers::NONE, egui::Key::Delete)
+                })
+            {
+                cv.undo_point();
+                return true;
+            }
+            if resp.clicked()
+                && over_page
+                && let Some(p) = pointer
+            {
+                let u = cx.to_user(p);
+                match cv.gesture.as_mut() {
+                    Some(Gesture::Draw { page, tool: t, points }) if *page == cx.page && *t == tool => {
+                        // Clicking the first point again closes a polygon.
+                        let closes = points.len() >= 3 && tool != CommentTool::PolyLine && cx.to_screen(points[0]).distance(p) <= 6.0;
+                        let repeat = points.last().is_some_and(|l| cx.to_screen(*l).distance(p) < 2.0);
+                        if closes {
+                            let pts = std::mem::take(points);
+                            cv.gesture = None;
+                            if let Some(shape) = drawn_shape(tool, &pts) {
+                                view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
+                            }
+                            return true;
+                        }
+                        if !repeat {
+                            points.push(u);
+                        }
+                    }
+                    _ => {
+                        cv.gesture = Some(Gesture::Draw { page: cx.page, tool, points: vec![u] });
+                        cv.selected = None;
+                    }
+                }
+            }
+            if finish
+                && let Some(Gesture::Draw { page, tool: t, points }) = cv.gesture.clone()
+                && page == cx.page
+                && t == tool
+            {
+                cv.gesture = None;
+                if let Some(shape) = drawn_shape(tool, &points) {
+                    view.pending_edit = Some(new_comment(cx, tool, shape, String::new()));
+                }
+            }
+            true
+        }
+        QuickTool::Comment(CommentTool::Callout) => {
+            // Drag from what the callout points at to where its text box goes.
+            if !cx.allowed {
+                return false;
+            }
+            if over_page {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
+            }
+            if resp.drag_started()
+                && pressed_here
+                && let Some(o) = origin
+            {
+                cv.gesture = Some(Gesture::Draw { page: cx.page, tool: CommentTool::Callout, points: vec![cx.to_user(o)] });
+                cv.selected = None;
+            }
+            if let Some(Gesture::Draw { page, points, .. }) = cv.gesture.as_mut()
+                && *page == cx.page
+                && let Some(p) = pointer
+            {
+                points.truncate(1);
+                points.push(cx.to_user(clamp_to(page_rect, p)));
+            }
+            if resp.drag_stopped()
+                && let Some(Gesture::Draw { page, points, .. }) = cv.gesture.clone()
+                && page == cx.page
+            {
+                cv.gesture = None;
+                if let [point, at] = points[..]
+                    && (point[0] - at[0]).hypot(point[1] - at[1]) >= 8.0
+                {
+                    cv.composer = Some(Composer { page, at, kind: ComposerKind::Callout { point }, text: String::new(), focus: true });
+                }
+            }
+            true
+        }
+        QuickTool::Comment(CommentTool::Attach) => {
+            if !cx.allowed {
+                return false;
+            }
+            if over_page {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
+            }
+            if resp.clicked()
+                && over_page
+                && let Some(p) = pointer
+            {
+                cv.attach_at = Some((cx.page, cx.to_user(p)));
+                cv.selected = None;
+            }
+            true
+        }
+        QuickTool::Comment(CommentTool::Caret) => {
+            if !cx.allowed {
+                return false;
+            }
+            if over_page {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Text);
+            }
+            if resp.clicked()
+                && over_page
+                && let Some(p) = pointer
+            {
+                let (vx, vy) = cx.xf.screen_to_view(p);
+                let snapped = cx.info.pages.get(cx.page).zip(caret_text.as_deref()).and_then(|(page, t)| snapped_caret(page, t, vx, vy));
+                let (at, size) = snapped.unwrap_or_else(|| (cx.to_user(p), CARET_SIZE));
+                cv.composer = Some(Composer { page: cx.page, at, kind: ComposerKind::Caret { size }, text: String::new(), focus: true });
+                cv.selected = None;
+            }
+            true
+        }
+        QuickTool::Comment(tool @ (CommentTool::Note | CommentTool::TextBox)) => {
+            if !cx.allowed {
+                return false;
+            }
+            if over_page {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
+            }
+            // A text box also takes a drag, as in Acrobat: the box is drawn at that size and its
+            // text wraps inside it (#2669).
+            if tool == CommentTool::TextBox {
+                if resp.drag_started()
+                    && pressed_here
+                    && let Some(o) = origin
+                {
+                    cv.gesture = Some(Gesture::Draw { page: cx.page, tool, points: vec![cx.to_user(o)] });
+                    cv.selected = None;
+                }
+                if let Some(Gesture::Draw { page, points, .. }) = cv.gesture.as_mut()
+                    && *page == cx.page
+                    && let Some(p) = pointer
+                {
+                    points.truncate(1);
+                    points.push(cx.to_user(clamp_to(page_rect, p)));
+                }
+                if resp.drag_stopped()
+                    && let Some(Gesture::Draw { page, points, .. }) = cv.gesture.clone()
+                    && page == cx.page
+                {
+                    cv.gesture = None;
+                    if let (Some(first), Some(last)) = (points.first(), points.last()) {
+                        let r = Rect::from_two_pos(cx.to_screen(*first), cx.to_screen(*last));
+                        // A drag of a few pixels is a click: the box fits its text.
+                        let drawn =
+                            (r.width() >= 6.0 && r.height() >= 6.0).then(|| cx.info.pages.get(page)).flatten().map(|p| drawn_box(p, *first, *last));
+                        let (at, size) = drawn.map_or((*first, None), |(at, size)| (at, Some(size)));
+                        cv.composer = Some(Composer { page, at, kind: ComposerKind::TextBox { size }, text: String::new(), focus: true });
+                    }
+                }
+            }
+            if resp.clicked()
+                && over_page
+                && let Some(p) = pointer
+            {
+                let kind = if tool == CommentTool::Note { ComposerKind::Note } else { ComposerKind::TextBox { size: None } };
+                cv.composer = Some(Composer { page: cx.page, at: cx.to_user(p), kind, text: String::new(), focus: true });
+                cv.selected = None;
+            }
+            true
+        }
+        QuickTool::Select => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
+        QuickTool::Fill(_) if fill_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
+        _ => false,
+    }
+}
+
+/// With a Fill & Sign tool, the Fill & Sign marks already on the page are picked up as with the
+/// Select tool, as in Acrobat: hovering one shows the move cursor, a click selects it, a drag
+/// moves it and the selected one's handles resize it. Elsewhere the tool places its mark. While
+/// the button is down the press decides; otherwise the pointer (egui clears the press origin on
+/// release, so a click is located by the pointer).
+pub(crate) fn fill_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
+    matches!(cx.tool, QuickTool::Fill(_)) && grabs(cx, view, |a| a.fill_sign)
+}
+
+/// With the Select tool, a comment that would move (not text markup) is picked up before a form
+/// field under it, so a signature placed over a field can still be dragged off it.
+pub(crate) fn select_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
+    cx.tool == QuickTool::Select && grabs(cx, view, |a| !is_markup(&a.subtype))
+}
+
+/// With a shape tool (rectangle, oval, line, polygon…), the selected comment's resize handles
+/// are picked up as with the Select tool, so the shape just drawn can be resized straight away
+/// (#2338). Only the handles: a press anywhere else, the shape itself included, still draws.
+pub(crate) fn draw_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
+    let QuickTool::Comment(tool) = cx.tool else { return false };
+    if !(tool.draws() || tool.clicks_points()) || tool == CommentTool::Eraser || cx.hidden {
+        return false;
+    }
+    let cv = &view.comments;
+    if matches!(cv.gesture, Some(Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page) {
+        return true;
+    }
+    // A polygon being clicked out keeps its clicks, even near an old shape's handle.
+    if cv.gesture.is_some() {
+        return false;
+    }
+    press_point(cx).is_some_and(|p| on_handle(cx, view, p, |_| true))
+}
+
+/// Whether the press (or, with no button down, the pointer) is on a `pick` comment or on the
+/// selected one's resize handles.
+fn grabs(cx: &PageCx<'_>, view: &DocView, pick: impl Fn(&Annotation) -> bool) -> bool {
+    if cx.hidden {
+        return false;
+    }
+    if matches!(view.comments.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page)
+    {
+        return true;
+    }
+    let Some(p) = press_point(cx) else { return false };
+    on_handle(cx, view, p, &pick) || cx.hit(p).is_some_and(pick)
+}
+
+/// Where a gesture on this page is decided: the press while the button is down, otherwise the
+/// pointer (egui clears the press origin on release). `None` off the page.
+fn press_point(cx: &PageCx<'_>) -> Option<Pos2> {
+    (if cx.ptr.any_down { cx.ptr.origin } else { cx.ptr.pos }).filter(|p| cx.xf.rect.contains(*p))
+}
+
+/// Whether `p` is on a resize handle of the selected comment, when it is a resizable `pick`.
+fn on_handle(cx: &PageCx<'_>, view: &DocView, p: Pos2, pick: impl Fn(&Annotation) -> bool) -> bool {
+    view.comments.selected.filter(|(page, _)| *page == cx.page).and_then(|(_, i)| cx.get(i)).filter(|a| pick(a) && cx.allowed).is_some_and(|a| {
+        (resizable(a) && HANDLES.into_iter().any(|h| handle_pos(cx.screen_rect(a), h).distance(p) <= 7.0))
+            || (grabs_points(cx.tool) && reshapable(a) && point_handle(cx, a, p).is_some())
+    })
+}
+
+/// The Select tool: hover, select, move, resize, edit, delete.
+fn select_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    cx: &PageCx<'_>,
+    view: &mut DocView,
+    pointer: Option<Pos2>,
+    origin: Option<Pos2>,
+    pressed_here: bool,
+) -> bool {
+    let cv = &mut view.comments;
+    let selected = cv.selected.filter(|(p, _)| *p == cx.page).and_then(|(_, i)| cx.get(i));
+    // Handles of a selected, resizable comment.
+    let handle_at = |p: Pos2| -> Option<(i8, i8)> {
+        let a = selected.filter(|a| cx.allowed && resizable(a))?;
+        let r = cx.screen_rect(a);
+        HANDLES.into_iter().find(|h| handle_pos(r, *h).distance(p) <= 7.0)
+    };
+    // Ends and corners of a selected line, connected lines, polygon or cloud.
+    let point_at =
+        |p: Pos2| -> Option<usize> { selected.filter(|a| cx.allowed && grabs_points(cx.tool) && reshapable(a)).and_then(|a| point_handle(cx, a, p)) };
+    let mut consumed = false;
+    if let Some(p) = pointer {
+        if point_at(p).is_some() {
+            ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
+        } else if let Some(h) = handle_at(p) {
+            ui.ctx().set_cursor_icon(match h {
+                (0, _) => egui::CursorIcon::ResizeVertical,
+                (_, 0) => egui::CursorIcon::ResizeHorizontal,
+                (-1, -1) | (1, 1) => egui::CursorIcon::ResizeNwSe,
+                _ => egui::CursorIcon::ResizeNeSw,
+            });
+        } else if let Some(a) = cx.hit(p) {
+            let movable = cx.allowed && !is_markup(&a.subtype);
+            ui.ctx().set_cursor_icon(if movable { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand });
+        }
+    }
+    if resp.drag_started()
+        && pressed_here
+        && let Some(o) = origin
+    {
+        if let (Some(point), Some(a)) = (point_at(o), selected) {
+            let points = a.points.iter().map(|q| [f64::from(q[0]), f64::from(q[1])]).collect();
+            cv.gesture = Some(Gesture::Reshape { page: cx.page, index: a.index, point, points });
+            consumed = true;
+        } else if let (Some(h), Some(a)) = (handle_at(o), selected) {
+            // On screen, the image is also turned by the view's rotation.
+            let turned = !cx.xf.rot.is_multiple_of(180);
+            let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).map(|ratio| if turned { ratio.recip() } else { ratio });
+            // A drawn signature keeps its shape from the corners, as image signatures do.
+            let aspect_ratio = aspect_ratio.or_else(|| {
+                let r = cx.screen_rect(a);
+                (a.fill_sign && a.subtype == "Ink" && r.height() > 0.0).then(|| r.width() / r.height())
+            });
+            cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: h, from: o, aspect_ratio });
+            consumed = true;
+        } else if let Some(a) = cx.hit(o)
+            && !is_markup(&a.subtype)
+        {
+            cv.selected = Some((cx.page, a.index));
+            cv.reveal = true;
+            if cx.allowed {
+                cv.gesture = Some(Gesture::Move { page: cx.page, index: a.index, from: o });
+            }
+            consumed = true;
+        }
+    }
+    if matches!(cv.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page) {
+        consumed = true;
+    }
+    if resp.drag_stopped()
+        && let Some(p) = pointer
+    {
+        match cv.gesture.clone() {
+            Some(Gesture::Move { page, index, from }) if page == cx.page => {
+                cv.gesture = None;
+                let (a, b) = (cx.to_user(from), cx.to_user(p));
+                let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
+                if from.distance(p) >= 2.0 {
+                    view.pending_edit = Some(Edit::MoveAnnotation { page, index, dx, dy });
+                }
+            }
+            Some(Gesture::Resize { page, index, handle, from, aspect_ratio }) if page == cx.page => {
+                cv.gesture = None;
+                if let Some(a) = cx.get(index) {
+                    let from_rect = cx.screen_rect(a);
+                    let shift = ui.input(|i| i.modifiers.shift);
+                    let r = resized(from_rect, handle, p - from, corner_ratio(from_rect, aspect_ratio, shift));
+                    let rect = a.rect_for_shown(cx.rect_to_user(r), cx.rotation());
+                    if r.width() >= 4.0 && r.height() >= 4.0 {
+                        view.pending_edit = Some(Edit::ResizeAnnotation { page, index, rect });
+                    }
+                }
+            }
+            Some(Gesture::Reshape { page, index, point, points }) if page == cx.page => {
+                cv.gesture = None;
+                let shift = ui.input(|i| i.modifiers.shift);
+                let moved = points.get(point).is_some_and(|q| cx.to_screen(*q).distance(p) >= 2.0);
+                if moved {
+                    view.pending_edit = Some(Edit::ReshapeAnnotation { page, index, points: reshaped(&points, point, cx.to_user(p), shift) });
+                }
+            }
+            _ => {}
+        }
+    }
+    // (egui clears the press origin on release, so clicks are located by the pointer.)
+    let on_page = pointer.is_some_and(|p| cx.xf.rect.contains(p));
+    if resp.clicked() && on_page {
+        let follow_link = cx.tool == QuickTool::Select
+            && !consumed
+            && cv.gesture.is_none()
+            && !resp.double_clicked()
+            && pointer
+                .is_some_and(|p| cx.info.links.iter().any(|link| link.page == cx.page && cx.xf.user_rect(cx.info, cx.page, link.rect).contains(p)));
+        match pointer.and_then(|p| cx.hit(p)) {
+            Some(a) if a.subtype == "Highlight" && follow_link => {
+                // A plain click follows the link beneath text highlighting. Keep other
+                // annotations and active gestures in control of their own input.
+                cv.selected = None;
+            }
+            Some(a) => {
+                cv.selected = Some((cx.page, a.index));
+                cv.reveal = true;
+                consumed = true;
+            }
+            None => cv.selected = None,
+        }
+    }
+    if resp.double_clicked()
+        && on_page
+        && cx.allowed
+        && let Some(a) = pointer.and_then(|p| cx.hit(p))
+    {
+        cv.selected = Some((cx.page, a.index));
+        cv.composer = Some(Composer {
+            page: cx.page,
+            at: edit_anchor(cx.info, a),
+            kind: ComposerKind::Edit(a.index),
+            text: a.contents.clone().unwrap_or_default(),
+            focus: true,
+        });
+        consumed = true;
+    }
+    consumed
+}
+
+/// After text selection ran: a markup tool turns a finished selection into a comment; Replace
+/// Text asks for the replacement.
+pub(crate) fn page_after_text(resp: &egui::Response, cx: &PageCx<'_>, view: &mut DocView) {
+    let QuickTool::Comment(tool) = cx.tool else { return };
+    if tool == CommentTool::ReplaceText && cx.allowed && (resp.drag_stopped() || resp.double_clicked()) {
+        if let Some((page, quads)) = view.selection_quads(cx.info).filter(|(p, _)| *p == cx.page) {
+            view.clear_selection();
+            let last = quads.last().copied().unwrap_or_default();
+            let at = [last[2].max(last[6]), last[1].max(last[3])];
+            view.comments.replace = Some(quads);
+            view.comments.composer = Some(Composer { page, at, kind: ComposerKind::Replace, text: String::new(), focus: true });
+        }
+        return;
+    }
+    if tool.markup().is_none() || !cx.allowed || !(resp.drag_stopped() || resp.double_clicked()) {
+        return;
+    }
+    if let Some(kind) = tool.markup()
+        && let Some((page, quads)) = view.selection_quads(cx.info).filter(|(p, _)| *p == cx.page)
+    {
+        view.clear_selection();
+        view.pending_edit = Some(new_comment(cx, tool, Shape::TextMarkup { kind, quads }, String::new()));
+        let _ = page;
+    }
+}
+
+/// Delete / Escape handling for comments (only while no text field has focus).
+pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView, tool: &mut QuickTool, allowed: bool) {
+    if !ctx.input(|i| i.pointer.any_down()) {
+        view.comments.cancelled_drag = false;
+    }
+    if ctx.egui_wants_keyboard_input() {
+        return;
+    }
+    let cv = &mut view.comments;
+    if ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
+        // One step back per press: cancel the gesture, then deselect, then drop the tool.
+        let cancelled = cv.gesture.take().is_some() || cv.selected.take().is_some();
+        if !cancelled && matches!(tool, QuickTool::Comment(_)) {
+            *tool = QuickTool::Select;
+        }
+    }
+    if allowed
+        && let Some((page, index)) = cv.selected
+        && ctx.input(|i| i.key_pressed(egui::Key::Delete) || i.key_pressed(egui::Key::Backspace))
+    {
+        cv.selected = None;
+        view.pending_edit = Some(Edit::DeleteAnnotation { page, index });
+    }
+}
+
+/// The arrow keys move the selected comment a screen pixel; with ⌘/Ctrl or Shift, ten. Up is up
+/// on screen whatever the zoom, the page's rotation and the view's; the keys are taken before
+/// the view scrolls or turns the page with them. Each press is one undo step. Text markup stays
+/// with its text, and a locked comment where it is.
+pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) {
+    if ctx.egui_wants_keyboard_input() || view.pending_edit.is_some() {
+        return;
+    }
+    let cv = &view.comments;
+    if cv.gesture.is_some() || cv.composer.is_some() {
+        return;
+    }
+    let Some((page, index)) = cv.selected else { return };
+    let movable = info.annotations.iter().any(|a| a.page == page && a.index == index && !a.is_reply() && !is_markup(&a.subtype) && !a.locked);
+    let (Some(xf), Some(p)) = (view.page_xform(page), info.pages.get(page)) else { return };
+    if !movable {
+        return;
+    }
+    use egui::{Key, Modifiers};
+    let mut step = egui::Vec2::ZERO;
+    ctx.input_mut(|i| {
+        for (key, direction) in
+            [(Key::ArrowLeft, vec2(-1.0, 0.0)), (Key::ArrowRight, vec2(1.0, 0.0)), (Key::ArrowUp, vec2(0.0, -1.0)), (Key::ArrowDown, vec2(0.0, 1.0))]
+        {
+            // The modified patterns first: a plain one also matches a Shift press.
+            if i.consume_key(Modifiers::COMMAND, key) || i.consume_key(Modifiers::SHIFT, key) {
+                step += direction * 10.0;
+            } else if i.consume_key(Modifiers::NONE, key) {
+                step += direction;
+            }
+        }
+    });
+    if step == egui::Vec2::ZERO {
+        return;
+    }
+    // The step on screen, in user space: from the page's centre to `step` pixels away.
+    let user = |s: Pos2| {
+        let (vx, vy) = xf.screen_to_view(s);
+        let u = p.view_to_user(vx, vy);
+        [f64::from(u[0]), f64::from(u[1])]
+    };
+    let (a, b) = (user(xf.rect.center()), user(xf.rect.center() + step));
+    let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
+    if dx.is_finite() && dy.is_finite() && (dx != 0.0 || dy != 0.0) {
+        view.pending_edit = Some(Edit::MoveAnnotation { page, index, dx, dy });
+    }
+}
diff --git a/crates/ui-egui/src/tools/comments/menu.rs b/crates/ui-egui/src/tools/comments/menu.rs
new file mode 100644
index 0000000000..3d9a793111
--- /dev/null
+++ b/crates/ui-egui/src/tools/comments/menu.rs
@@ -0,0 +1,369 @@
+use super::paint::edit_anchor;
+use super::state::{Composer, ComposerKind};
+use super::*;
+
+/// Save attachment… and, for a PDF, Open in a new tab, first in a file attachment comment's
+/// menus as in the Attachments panel: the comment is where the reader finds its file. Reading
+/// the file changes nothing, so a read-only document offers them too.
+pub(crate) fn attachment_items(ui: &mut egui::Ui, view: &mut DocView, info: &DocInfo, a: &Annotation) {
+    let source = pdfcraft_render::AttachmentSource::Annotation { page: a.page, index: a.index };
+    let Some(file) = info.attachments.iter().find(|f| f.source == source) else { return };
+    if ui.button(tl!("Save attachment…")).clicked() {
+        view.comments.attachment_request = Some((a.page, a.index, false));
+        ui.close();
+    }
+    if file.name.to_lowercase().ends_with(".pdf") && ui.button(tl!("Open in a new tab")).clicked() {
+        view.comments.attachment_request = Some((a.page, a.index, true));
+        ui.close();
+    }
+    ui.separator();
+}
+
+/// Items of the canvas context menu for the selected comment (or the page).
+/// `can_modify`: the document's pages may change (Flatten comments draws into them).
+pub(crate) fn context_menu(
+    ui: &mut egui::Ui,
+    view: &mut DocView,
+    info: &DocInfo,
+    prefs: &CommentPrefs,
+    allowed: bool,
+    can_modify: bool,
+) -> Option<CanvasAction> {
+    let mut action = None;
+    let selected = view.comments.selected.and_then(|(p, i)| info.annotations.iter().find(|a| a.page == p && a.index == i && !a.is_reply()));
+    match selected {
+        Some(a) => {
+            let (page, index) = (a.page, a.index);
+            attachment_items(ui, view, info, a);
+            if ui.add_enabled(allowed, egui::Button::new(tl!("Edit text…"))).clicked() {
+                view.comments.composer = Some(Composer {
+                    page,
+                    at: edit_anchor(info, a),
+                    kind: ComposerKind::Edit(index),
+                    text: a.contents.clone().unwrap_or_default(),
+                    focus: true,
+                });
+                ui.close();
+            }
+            if ui.add_enabled(allowed, egui::Button::new(tl!("Reply"))).clicked() {
+                view.comments.reveal = true;
+                action = Some(CanvasAction::OpenComments);
+                ui.close();
+            }
+            ui.add_enabled_ui(allowed, |ui| {
+                ui.menu_button(tl!("Set status"), |ui| {
+                    for s in [ReviewState::None, ReviewState::Accepted, ReviewState::Cancelled, ReviewState::Completed, ReviewState::Rejected] {
+                        if ui.button(tl!(s.name())).clicked() {
+                            action =
+                                Some(CanvasAction::Edit(Box::new(Edit::SetAnnotationStatus { page, index, state: s, author: prefs.author.clone() })));
+                            ui.close();
+                        }
+                    }
+                });
+                let keep_open = egui::containers::menu::MenuConfig::new().close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside);
+                let _ = egui::containers::menu::SubMenuButton::new(tl!("Colour")).config(keep_open).ui(ui, |ui| {
+                    if let Some(c) = swatch_grid(ui, a.color.map(|c| c.map(f64::from))) {
+                        action = Some(CanvasAction::Edit(Box::new(Edit::StyleAnnotation {
+                            page,
+                            index,
+                            color: Some(c),
+                            opacity: None,
+                            width: None,
+                            endings: None,
+                        })));
+                        ui.close();
+                    }
+                });
+            });
+            let thread: Vec<&pdfcraft_render::Annotation> = info.annotations.iter().filter(|r| r.replies_to(a)).collect();
+            let marked = crate::comments_panel::is_marked(&thread);
+            if ui.add_enabled(allowed, egui::Button::new(tl!(if marked { "Remove checkmark" } else { "Mark with checkmark" }))).clicked() {
+                action = Some(CanvasAction::Edit(Box::new(Edit::MarkAnnotation { page, index, marked: !marked, author: prefs.author.clone() })));
+                ui.close();
+            }
+            if ui.button(tl!("Copy text")).clicked() {
+                ui.ctx().copy_text(a.contents.clone().unwrap_or_default());
+                ui.close();
+            }
+            ui.separator();
+            if ui.add_enabled(allowed && !a.locked, egui::Button::new(tl!("Delete"))).clicked() {
+                view.comments.selected = None;
+                action = Some(CanvasAction::Edit(Box::new(Edit::DeleteAnnotation { page, index })));
+                ui.close();
+            }
+            if ui.add_enabled(allowed, egui::Button::new(tl!("Properties…"))).clicked() {
+                action = Some(CanvasAction::Properties(page, index));
+                ui.close();
+            }
+            if ui.add_enabled(tool_for(a).is_some(), egui::Button::new(tl!("Make Current Properties Default"))).clicked() {
+                view.comments.default_request = Some((page, index));
+                ui.close();
+            }
+        }
+        None => {
+            if let Some((page, at)) = view.comments.context_at
+                && ui.add_enabled(allowed, egui::Button::new(tl!("Add a sticky note here"))).clicked()
+            {
+                view.comments.composer = Some(Composer { page, at, kind: ComposerKind::Note, text: String::new(), focus: true });
+                ui.close();
+            }
+            if ui.button(tl!("Comments panel")).clicked() {
+                action = Some(CanvasAction::OpenComments);
+                ui.close();
+            }
+        }
+    }
+    // Every comment of the document into its pages, as Comment ▸ Flatten comments does: signed
+    // or reviewed pages whose comments should no longer move.
+    if !info.annotations.is_empty() {
+        ui.separator();
+        if ui.add_enabled(can_modify, egui::Button::new(tl!("Flatten comments"))).clicked() {
+            view.comments.selected = None;
+            action = Some(CanvasAction::Edit(Box::new(Edit::Flatten { comments: true, fields: false })));
+            ui.close();
+        }
+    }
+    action
+}
+
+/// What the canvas asks the app to do.
+#[derive(Clone, Debug, PartialEq)]
+pub enum CanvasAction {
+    Edit(Box<Edit>),
+    OpenComments,
+    /// Comment Properties for (page, index).
+    Properties(usize, usize),
+    /// Copy Image: image (page, index in `page_images`) to the clipboard.
+    CopyImage(usize, usize),
+    /// Copy Image in Original Format: the same image as a file (JPEG as stored, else PNG).
+    CopyImageFile(usize, usize),
+}
+
+/// How many custom colours the "Recent colours" row keeps.
+pub(super) const RECENT_CUSTOM: usize = 5;
+
+/// Return the stable egui id for the recent custom-colour palette.
+fn recent_custom_id() -> egui::Id {
+    egui::Id::unique("pdfcraft-recent-custom-colours")
+}
+
+/// Custom colours picked with "Other colour…" this session, newest first (#1193).
+pub fn recent_custom_colours(ctx: &egui::Context) -> Vec<Rgb> {
+    ctx.data(|d| d.get_temp::<Vec<Rgb>>(recent_custom_id())).unwrap_or_default()
+}
+
+/// Put `c` first in the recent custom colours (once, at most [`RECENT_CUSTOM`]). Colours that are
+/// already swatches are not repeated there.
+pub fn remember_custom_colour(ctx: &egui::Context, c: Rgb) {
+    if !c.iter().all(|v| v.is_finite()) || SWATCHES.iter().any(|(_, s)| same_colour(s, &c)) {
+        return;
+    }
+    let c = c.map(|v| v.clamp(0.0, 1.0));
+    ctx.data_mut(|d| {
+        let recent = d.get_temp_mut_or_default::<Vec<Rgb>>(recent_custom_id());
+        recent.retain(|r| !same_colour(r, &c));
+        recent.insert(0, c);
+        recent.truncate(RECENT_CUSTOM);
+    });
+}
+
+pub(super) fn same_colour(a: &Rgb, b: &Rgb) -> bool {
+    a.iter().zip(b).all(|(x, y)| (x - y).abs() < 0.02)
+}
+
+fn rgb_of(c: Color32) -> Rgb {
+    [c.r(), c.g(), c.b()].map(|v| f64::from(v) / 255.0)
+}
+
+/// One round swatch; `on` rings it as the current colour.
+fn swatch(ui: &mut egui::Ui, c: Rgb, on: bool, tooltip: &str) -> egui::Response {
+    let (r, resp) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tooltip));
+    ui.painter().circle_filled(r.center(), 9.0, color32(c));
+    ui.painter().circle_stroke(r.center(), 9.0, Stroke::new(1.0, Color32::from_black_alpha(40)));
+    if on || resp.hovered() {
+        ui.painter().circle_stroke(r.center(), 11.0, Stroke::new(1.5, SELECT_BLUE));
+    }
+    resp.on_hover_text(tooltip)
+}
+
+/// The "+" swatch that opens "Other colour…": a ring with a plus, the size of a swatch.
+fn other_colour_swatch(ui: &mut egui::Ui, open: bool) -> egui::Response {
+    let (r, resp) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::click());
+    let ink = ui.visuals().widgets.inactive.fg_stroke.color;
+    ui.painter().circle_stroke(r.center(), 9.0, Stroke::new(1.0, ink.gamma_multiply(0.6)));
+    let c = r.center();
+    for d in [vec2(4.5, 0.0), vec2(0.0, 4.5)] {
+        ui.painter().line_segment([c - d, c + d], Stroke::new(1.5, ink));
+    }
+    if open || resp.hovered() {
+        ui.painter().circle_stroke(c, 11.0, Stroke::new(1.5, SELECT_BLUE));
+    }
+    let label = tl!("Other colour…");
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, open, label));
+    resp.on_hover_text(label)
+}
+
+/// A grid of colour swatches with a "+" swatch for "Other colour…" (a full picker, as Acrobat's
+/// quick colours offer) and, once used, the recent custom colours; returns the colour chosen.
+/// The "+" sits in the first row, so the grid is no taller than before until the picker opens.
+pub fn swatch_grid(ui: &mut egui::Ui, current: Option<Rgb>) -> Option<Rgb> {
+    let mut picked = None;
+    let on = |c: &Rgb| current.is_some_and(|cur| same_colour(&cur, c));
+    // Keyed on this grid's own place in the parent, so two grids in one dialog open their
+    // pickers separately.
+    let base = ui.next_auto_id();
+    ui.skip_ahead_auto_ids(1);
+    let open_id = base.with("other-colour");
+    let value_id = open_id.with("value");
+    let mut open = ui.data(|d| d.get_temp::<bool>(open_id)).unwrap_or(false);
+    egui::Grid::new(base.with("swatches")).spacing(vec2(6.0, 6.0)).show(ui, |ui| {
+        for (i, (name, c)) in SWATCHES.iter().enumerate() {
+            if swatch(ui, *c, on(c), tl!(name)).clicked() {
+                picked = Some(*c);
+            }
+            if i == 4 && other_colour_swatch(ui, open).clicked() {
+                open = !open;
+                // Start from the current colour each time the picker opens.
+                ui.data_mut(|d| d.insert_temp(value_id, current.map_or(Color32::BLACK, color32)));
+            }
+            if i % 5 == 4 {
+                ui.end_row();
+            }
+        }
+    });
+    let recent = recent_custom_colours(ui.ctx());
+    if !recent.is_empty() {
+        ui.label(egui::RichText::new(tl!("Recent colours")).small());
+        ui.horizontal(|ui| {
+            ui.spacing_mut().item_spacing.x = 6.0;
+            for c in &recent {
+                let [r, g, b, _] = color32(*c).to_array();
+                if swatch(ui, *c, on(c), &format!("#{r:02X}{g:02X}{b:02X}")).clicked() {
+                    picked = Some(*c);
+                }
+            }
+        });
+    }
+    if open && picked.is_none() {
+        let mut value = ui.data(|d| d.get_temp::<Color32>(value_id)).unwrap_or_else(|| current.map_or(Color32::BLACK, color32));
+        egui::widgets::color_picker::color_picker_color32(ui, &mut value, egui::widgets::color_picker::Alpha::Opaque);
+        ui.data_mut(|d| d.insert_temp(value_id, value));
+        // Dragging in the picker previews nothing; Apply commits once (one undo step).
+        if ui.button(tl!("Apply")).clicked() {
+            let c = rgb_of(value);
+            remember_custom_colour(ui.ctx(), c);
+            picked = Some(c);
+        }
+    }
+    if picked.is_some() {
+        open = false;
+    }
+    ui.data_mut(|d| d.insert_temp(open_id, open));
+    picked
+}
+
+/// "No fill" and the colour swatches; returns the choice clicked (`Some(None)`: no fill).
+pub fn fill_picker(ui: &mut egui::Ui, current: Option<Rgb>) -> Option<Option<Rgb>> {
+    let mut picked = None;
+    ui.push_id("fill-picker", |ui| {
+        ui.vertical(|ui| {
+            if ui.selectable_label(current.is_none(), tl!("No fill")).clicked() {
+                picked = Some(None);
+            }
+            if let Some(c) = swatch_grid(ui, current) {
+                picked = Some(Some(c));
+            }
+        });
+    });
+    picked
+}
+
+/// The comment tools' extra quick-bar controls: pin, colour, fill, opacity and thickness.
+pub(crate) fn quick_bar_controls(ui: &mut egui::Ui, tool: CommentTool, prefs: &mut CommentPrefs) -> Option<Rgb> {
+    let style = prefs.style(tool);
+    let mut selected_color = None;
+    if icons::button(ui, "pin", 32.0, prefs.pinned, if prefs.pinned { tl!("Keep tool selected: on") } else { tl!("Keep tool selected") }).clicked() {
+        prefs.pinned = !prefs.pinned;
+    }
+    let (r, resp) = ui.allocate_exact_size(vec2(32.0, 32.0), Sense::click());
+    ui.painter().circle_filled(r.center(), 9.0, color32(style.color));
+    ui.painter().circle_stroke(r.center(), 9.0, Stroke::new(1.0, Color32::from_black_alpha(50)));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Colour")));
+    let resp = resp.on_hover_text(tl!("Colour"));
+    egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
+        if let Some(c) = swatch_grid(ui, Some(style.color)) {
+            prefs.set_color(tool, c);
+            selected_color = Some(c);
+            ui.close();
+        }
+    });
+    if tool.has_fill() {
+        let resp = fill_button(ui, style.fill);
+        egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
+            ui.label(egui::RichText::new(tl!("Fill colour")).font(theme::semibold(12.0)));
+            if let Some(f) = fill_picker(ui, style.fill) {
+                prefs.set_fill(tool, f);
+                ui.close();
+            }
+        });
+    }
+    let resp = icons::button(ui, "blend", 32.0, false, tl!("Opacity"));
+    egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
+        ui.set_min_width(180.0);
+        let mut percent = (style.opacity * 100.0).round();
+        ui.label(egui::RichText::new(tl!("Opacity")).font(theme::semibold(12.0)));
+        if ui.add(egui::Slider::new(&mut percent, 10.0..=100.0).step_by(5.0).suffix(" %")).changed() {
+            prefs.set_opacity(tool, percent / 100.0);
+        }
+    });
+    if tool.has_width() {
+        let resp = icons::button(ui, "sliders-horizontal", 32.0, false, tl!("Line thickness"));
+        egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
+            ui.set_min_width(180.0);
+            let mut w = style.width;
+            ui.label(egui::RichText::new(tl!("Line thickness")).font(theme::semibold(12.0)));
+            if ui.add(egui::Slider::new(&mut w, tool.min_width()..=12.0).step_by(0.5).suffix(" pt")).changed() {
+                prefs.set_width(tool, w);
+            }
+        });
+    }
+    selected_color
+}
+
+/// The quick bar's fill button: a filled square in the fill colour, or a crossed-out outline
+/// for no fill.
+fn fill_button(ui: &mut egui::Ui, fill: Option<Rgb>) -> egui::Response {
+    let (r, resp) = ui.allocate_exact_size(vec2(32.0, 32.0), Sense::click());
+    let sq = Rect::from_center_size(r.center(), vec2(16.0, 16.0));
+    let edge = Stroke::new(1.0, Color32::from_black_alpha(90));
+    match fill {
+        Some(c) => {
+            ui.painter().rect_filled(sq, 2.0, color32(c));
+        }
+        None => {
+            ui.painter().line_segment([sq.left_bottom(), sq.right_top()], Stroke::new(1.5, Color32::from_rgb(0xD3, 0x2F, 0x2F)));
+        }
+    }
+    ui.painter().rect_stroke(sq, 2.0, edge, egui::StrokeKind::Inside);
+    if resp.hovered() {
+        ui.painter().rect_stroke(r.shrink(2.0), 6.0, Stroke::new(1.0, Color32::from_black_alpha(40)), egui::StrokeKind::Inside);
+    }
+    let label = match fill {
+        Some(_) => tl!("Fill colour"),
+        None => tl!("Fill colour: none"),
+    };
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label));
+    resp.on_hover_text(label)
+}
+
+/// Status badge icon and label for a review state name.
+pub fn status_badge(state: &str) -> Option<(&'static str, &'static str, Color32)> {
+    match state {
+        "Accepted" => Some(("thumbs-up", "Accepted", Color32::from_rgb(0x2D, 0x9D, 0x5B))),
+        "Rejected" => Some(("thumbs-down", "Rejected", Color32::from_rgb(0xD3, 0x2F, 0x2F))),
+        "Cancelled" => Some(("circle-x", "Cancelled", Color32::from_rgb(0x8E, 0x8E, 0x8E))),
+        "Completed" => Some(("check", "Completed", Color32::from_rgb(0x2D, 0x9D, 0x5B))),
+        _ => None,
+    }
+}
diff --git a/crates/ui-egui/src/tools/comments/paint.rs b/crates/ui-egui/src/tools/comments/paint.rs
new file mode 100644
index 0000000000..55e99d79ac
--- /dev/null
+++ b/crates/ui-egui/src/tools/comments/paint.rs
@@ -0,0 +1,257 @@
+use super::geometry::{HANDLES, grabs_points, handle_pos, is_markup, reshapable, reshaped, resizable};
+use super::state::{Gesture, PageCx, SETTLE_SECS};
+use super::*;
+
+/// Paint comment selection, hover and gesture previews on a page.
+pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView) {
+    let cv = &view.comments;
+    let pointer = cx.ptr.pos;
+    // A redaction mark shows its fill while the pointer is over it, as Acrobat's does, so the
+    // marked area reads before anything is applied.
+    if cv.gesture.is_none()
+        && let Some(a) = pointer.and_then(|p| cx.hit(p))
+        && a.subtype == "Redact"
+    {
+        let ([r, g, b], opacity) = cx.redact_mark;
+        let fill = Color32::from_rgba_unmultiplied((r * 255.0) as u8, (g * 255.0) as u8, (b * 255.0) as u8, (opacity.clamp(0.0, 1.0) * 255.0) as u8);
+        for rect in cx.redact_rects(a) {
+            painter.rect_filled(rect, CornerRadius::ZERO, fill);
+        }
+    }
+    if cv.gesture.is_none()
+        && let Some(a) = pointer.and_then(|p| cx.hit(p))
+        && (cx.tool == QuickTool::Select || matches!(cx.tool, QuickTool::Fill(_)) && a.fill_sign)
+        && cv.selected != Some((cx.page, a.index))
+    {
+        for r in cx.screen_rects(a) {
+            painter.rect_stroke(r.expand(2.0), CornerRadius::same(2), Stroke::new(1.0, SELECT_BLUE.gamma_multiply(0.7)), egui::StrokeKind::Outside);
+        }
+    }
+    if let Some((page, index)) = cv.selected
+        && page == cx.page
+        && let Some(a) = cx.get(index)
+    {
+        if is_markup(&a.subtype) && !a.quads.is_empty() {
+            for r in cx.screen_rects(a) {
+                painter.rect_stroke(r.expand(2.0), CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Middle);
+            }
+            return paint_gesture(painter, cx, view);
+        }
+        if view.signature_drag.contains(page, index) && matches!(cv.gesture, Some(Gesture::Move { page: p, index: i, .. }) if (p, i) == (page, index))
+        {
+            return paint_gesture(painter, cx, view);
+        }
+        let shift = ui.input(|i| i.modifiers.shift);
+        if cx.allowed && grabs_points(cx.tool) && reshapable(a) {
+            return paint_points(painter, cx, view, a, pointer, shift);
+        }
+        let r = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, view.pending_edit.as_ref()).expand(2.0);
+        painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Middle);
+        if cx.allowed && resizable(a) {
+            for h in HANDLES {
+                let c = handle_pos(r, h);
+                painter.circle(c, 4.5, Color32::WHITE, Stroke::new(1.0, SELECT_BLUE));
+            }
+        }
+    }
+    paint_gesture(painter, cx, view);
+}
+
+/// A selected line, connected lines, polygon or cloud: a handle on each end or corner and, while
+/// one is dragged (or its edit is on its way), the new shape over the old.
+/// The points a selected line, polygon or cloud is drawn with while it changes: an end or corner
+/// being dragged, the whole comment being moved by its body, or the edit just released (until the
+/// page is drawn again). `None` while it isn't changing.
+pub(super) fn changing_points(
+    gesture: Option<&Gesture>,
+    pending: Option<&Edit>,
+    (page, index): (usize, usize),
+    points: &[[f64; 2]],
+    to_user: impl Fn(Pos2) -> [f64; 2],
+    pointer: Option<Pos2>,
+    shift: bool,
+) -> Option<Vec<[f64; 2]>> {
+    let shifted = |dx: f64, dy: f64| points.iter().map(|q| [q[0] + dx, q[1] + dy]).collect();
+    match (gesture, pending) {
+        (Some(Gesture::Reshape { page: p, index: i, point, points: from }), _) if (*p, *i) == (page, index) => {
+            pointer.map(|at| reshaped(from, *point, to_user(at), shift))
+        }
+        (Some(Gesture::Move { page: p, index: i, from }), _) if (*p, *i) == (page, index) => pointer.map(|at| {
+            let (a, b) = (to_user(*from), to_user(at));
+            shifted(b[0] - a[0], b[1] - a[1])
+        }),
+        (_, Some(Edit::ReshapeAnnotation { page: p, index: i, points: to })) if (*p, *i) == (page, index) => Some(to.clone()),
+        (_, Some(Edit::MoveAnnotation { page: p, index: i, dx, dy })) if (*p, *i) == (page, index) => Some(shifted(*dx, *dy)),
+        _ => None,
+    }
+}
+
+fn paint_points(painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView, a: &Annotation, pointer: Option<Pos2>, shift: bool) {
+    let cv = &view.comments;
+    let points: Vec<[f64; 2]> = a.points.iter().map(|q| [f64::from(q[0]), f64::from(q[1])]).collect();
+    let changing = changing_points(cv.gesture.as_ref(), view.pending_edit.as_ref(), (cx.page, a.index), &points, |p| cx.to_user(p), pointer, shift);
+    let changed = changing.is_some();
+    let points = changing.unwrap_or(points);
+    let screen: Vec<Pos2> = points.iter().map(|q| cx.to_screen(*q)).collect();
+    if changed {
+        let stroke = Stroke::new(1.5, SELECT_BLUE);
+        painter.add(if a.subtype == "Polygon" {
+            egui::Shape::closed_line(screen.clone(), stroke)
+        } else {
+            egui::Shape::line(screen.clone(), stroke)
+        });
+    }
+    for c in screen {
+        painter.circle(c, 4.5, Color32::WHITE, Stroke::new(1.0, SELECT_BLUE));
+    }
+    paint_gesture(painter, cx, view);
+}
+
+fn paint_gesture(painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView) {
+    let now = painter.ctx().input(|i| i.time);
+    for s in view.comments.settling.iter().filter(|s| s.page == cx.page && now - s.since < SETTLE_SECS) {
+        paint_draw(painter, cx, &s.tool, &s.points);
+    }
+    if let Some(Gesture::Draw { page, tool, points }) = &view.comments.gesture
+        && *page == cx.page
+    {
+        paint_draw(painter, cx, tool, points);
+    }
+}
+
+/// A drawing tool's shape from its points (a live drag, or a released one still settling).
+fn paint_draw(painter: &egui::Painter, cx: &PageCx<'_>, tool: &CommentTool, points: &[[f64; 2]]) {
+    {
+        let style = cx.prefs.style(*tool);
+        let zoom = cx.xf.zoom();
+        let stroke = Stroke::new((style.width as f32 * zoom).max(1.0), color32(style.color));
+        let pts: Vec<Pos2> = points.iter().map(|p| cx.to_screen(*p)).collect();
+        match tool {
+            CommentTool::Ink => {
+                painter.add(egui::Shape::line(pts, stroke));
+            }
+            CommentTool::Eraser => {
+                // As wide as what it rubs out (see `erase`).
+                let width = (2.0 * eraser_radius_px(style.width)) as f32;
+                painter.add(egui::Shape::line(pts, Stroke::new(width, Color32::from_gray(128).gamma_multiply(0.35))));
+            }
+            CommentTool::Line | CommentTool::Arrow if pts.len() == 2 => {
+                painter.line_segment([pts[0], pts[1]], stroke);
+                if *tool == CommentTool::Arrow {
+                    let d = (pts[0] - pts[1]).normalized();
+                    let s = (6.0 + 3.0 * style.width as f32) * zoom;
+                    let rot = |v: egui::Vec2, a: f32| vec2(v.x * a.cos() - v.y * a.sin(), v.x * a.sin() + v.y * a.cos());
+                    for a in [0.52f32, -0.52] {
+                        painter.line_segment([pts[1], pts[1] + rot(d, a) * s], stroke);
+                    }
+                }
+            }
+            CommentTool::Rectangle if pts.len() == 2 => {
+                painter.rect_stroke(Rect::from_two_pos(pts[0], pts[1]), CornerRadius::ZERO, stroke, egui::StrokeKind::Inside);
+            }
+            CommentTool::Oval if pts.len() == 2 => {
+                let r = Rect::from_two_pos(pts[0], pts[1]);
+                painter.add(egui::Shape::ellipse_stroke(r.center(), r.size() / 2.0, stroke));
+            }
+            CommentTool::Polygon | CommentTool::PolyLine | CommentTool::Cloud => {
+                // The vertices so far, and a rubber band to the pointer.
+                let mut line = pts.clone();
+                if let Some(p) = cx.ptr.pos {
+                    line.push(p);
+                }
+                painter.add(egui::Shape::line(line, stroke));
+                if let Some(first) = pts.first().filter(|_| *tool != CommentTool::PolyLine && pts.len() >= 3) {
+                    painter.circle_stroke(*first, 5.0, Stroke::new(1.0, SELECT_BLUE));
+                }
+            }
+            CommentTool::TextBox if pts.len() == 2 => {
+                painter.rect_stroke(Rect::from_two_pos(pts[0], pts[1]), CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Inside);
+            }
+            CommentTool::Callout if pts.len() == 2 => {
+                painter.line_segment([pts[0], pts[1]], stroke);
+                painter.rect_stroke(Rect::from_min_size(pts[1], vec2(160.0, 40.0) * zoom), CornerRadius::ZERO, stroke, egui::StrokeKind::Inside);
+            }
+            _ => {}
+        }
+    }
+}
+
+/// The shape a finished drawing gesture makes (`None` if it is too small to mean anything).
+pub(super) fn drawn_shape(tool: CommentTool, points: &[[f64; 2]]) -> Option<Shape> {
+    let (first, last) = (*points.first()?, *points.last()?);
+    let far = (first[0] - last[0]).hypot(first[1] - last[1]) >= 2.0;
+    let rect = [first[0].min(last[0]), first[1].min(last[1]), first[0].max(last[0]), first[1].max(last[1])];
+    let big = rect[2] - rect[0] >= 2.0 && rect[3] - rect[1] >= 2.0;
+    match tool {
+        CommentTool::Ink if !points.is_empty() => Some(Shape::Ink { strokes: vec![points.to_vec()] }),
+        CommentTool::Line | CommentTool::Arrow if far => Some(Shape::Line {
+            from: first,
+            to: last,
+            start: LineEnding::None,
+            end: if tool == CommentTool::Arrow { LineEnding::OpenArrow } else { LineEnding::None },
+        }),
+        CommentTool::Rectangle if big => Some(Shape::Rectangle { rect }),
+        CommentTool::Oval if big => Some(Shape::Oval { rect }),
+        CommentTool::Polygon | CommentTool::Cloud if points.len() >= 3 => {
+            Some(Shape::Polygon { vertices: points.to_vec(), cloud: tool == CommentTool::Cloud })
+        }
+        CommentTool::PolyLine if points.len() >= 2 => {
+            Some(Shape::PolyLine { vertices: points.to_vec(), start: LineEnding::None, end: LineEnding::None })
+        }
+        _ => None,
+    }
+}
+
+/// The eraser's radius on screen, in pixels, from its thickness setting (#3747): three pixels
+/// per point, so the default 2 pt keeps the 12-pixel eraser it always had, and the thickness
+/// slider's 0.5–12 pt gives 3 to 72 pixels across. A setting that isn't a number is the default.
+fn eraser_radius_px(width: f64) -> f64 {
+    3.0 * if width.is_finite() { width.clamp(0.5, 12.0) } else { 2.0 }
+}
+
+/// Eraser: rub out drawings along `path` (user space); one undo step for all of them. It rubs
+/// as wide on screen as its preview, whatever the zoom.
+pub(super) fn erase(cx: &PageCx<'_>, path: &[[f64; 2]]) -> Option<Edit> {
+    let zoom = f64::from(cx.xf.zoom());
+    // A page with no size on screen has nothing to rub out (and no finite radius).
+    if !(zoom.is_finite() && zoom > 0.0) {
+        return None;
+    }
+    // Exactly the preview's width: no floor, which at a high zoom rubbed past it.
+    let radius = eraser_radius_px(cx.prefs.style(CommentTool::Eraser).width) / zoom;
+    let b = path.iter().fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |r, p| [r[0].min(p[0]), r[1].min(p[1]), r[2].max(p[0]), r[3].max(p[1])]);
+    let mut hits: Vec<usize> = cx
+        .comments()
+        .filter(|a| a.subtype == "Ink" && !a.locked)
+        .filter(|a| {
+            let r = a.rect;
+            (r[0] as f64) <= b[2] + radius && (r[2] as f64) >= b[0] - radius && (r[1] as f64) <= b[3] + radius && (r[3] as f64) >= b[1] - radius
+        })
+        .map(|a| a.index)
+        .collect();
+    if hits.is_empty() {
+        return None;
+    }
+    // Later indices first: deleting an emptied drawing shifts the ones after it.
+    hits.sort_unstable_by(|a, b| b.cmp(a));
+    let edits = hits.into_iter().map(|index| Edit::EraseInk { page: cx.page, index, path: path.to_vec(), radius }).collect();
+    Some(Edit::Batch { label: "Erase".into(), edits })
+}
+
+/// Where the composer for editing `a` opens: the top-right corner of the comment as drawn on the
+/// displayed page.
+pub(super) fn edit_anchor(info: &DocInfo, a: &Annotation) -> [f64; 2] {
+    let Some(p) = info.pages.get(a.page) else { return [f64::from(a.rect[2]), f64::from(a.rect[3])] };
+    let r = a.shown_rect(p.rotation);
+    let (u, v) = (p.user_to_view(r[0], r[1]), p.user_to_view(r[2], r[3]));
+    p.view_to_user(u[0].max(v[0]), u[1].min(v[1])).map(f64::from)
+}
+
+/// Whether comment `index` on the composer's page is at least partly inside `viewport`, as drawn.
+pub(super) fn edited_in_view(cx: &PageCx<'_>, index: usize, viewport: Rect) -> bool {
+    cx.info.annotations.iter().any(|a| a.page == cx.page && a.index == index && viewport.intersects(cx.screen_rect(a)))
+}
+
+pub(super) fn new_comment(cx: &PageCx<'_>, tool: CommentTool, shape: Shape, contents: String) -> Edit {
+    Edit::AddAnnotation(NewAnnotation { page: cx.page, shape, style: cx.prefs.style(tool), contents, author: cx.prefs.author.clone() })
+}
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
new file mode 100644
index 0000000000..97ccb365a2
--- /dev/null
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -0,0 +1,354 @@
+use super::geometry::{corner_ratio, is_markup, resized};
+use super::*;
+
+/// The user's login name, which Acrobat uses as the default comment author.
+pub(super) fn login_name() -> String {
+    #[cfg(not(target_arch = "wasm32"))]
+    for var in ["USER", "USERNAME", "LOGNAME"] {
+        if let Ok(v) = std::env::var(var)
+            && !v.trim().is_empty()
+        {
+            return v;
+        }
+    }
+    "Guest".into()
+}
+
+/// A drag in progress on a page.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Gesture {
+    /// Drawing with a tool: points in user space (ink: the stroke; polygons: the vertices
+    /// clicked so far; others: start and end).
+    Draw { page: usize, tool: CommentTool, points: Vec<[f64; 2]> },
+    /// Moving a comment, from the press position on screen.
+    Move { page: usize, index: usize, from: Pos2 },
+    /// Resizing a comment by one of its handles: (dx, dy) ∈ {-1, 0, 1}² says which sides move.
+    Resize { page: usize, index: usize, handle: (i8, i8), from: Pos2, aspect_ratio: Option<f32> },
+    /// Dragging point `point` of a line, connected lines, a polygon or a cloud (its `points`
+    /// before the drag, in user space) to where the pointer is.
+    Reshape { page: usize, index: usize, point: usize, points: Vec<[f64; 2]> },
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum ComposerKind {
+    Note,
+    /// A text box; `size` is the box dragged out (displayed width and height, in user space
+    /// units), `None` after a click: then the box fits its text.
+    TextBox {
+        size: Option<[f64; 2]>,
+    },
+    /// A callout whose arrow touches `point`; the composer's anchor is the text box's top-left.
+    Callout {
+        point: [f64; 2],
+    },
+    /// Insert text at the anchor (the caret's tip); `size` is the side of the caret's square box,
+    /// in user space units.
+    Caret {
+        size: f64,
+    },
+    /// Replace the selected text (`CommentView::replace` holds the quads).
+    Replace,
+    /// Edit the text of the comment at this index on the composer's page.
+    Edit(usize),
+}
+
+/// The floating "Add a comment" card.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Composer {
+    pub page: usize,
+    /// Anchor in user space (the note's top-left, the text box's top-left, the comment's corner).
+    pub at: [f64; 2],
+    pub kind: ComposerKind,
+    pub text: String,
+    pub focus: bool,
+}
+
+/// A released drawing gesture waiting for the page raster to show its annotation.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Settling {
+    pub page: usize,
+    pub tool: CommentTool,
+    pub points: Vec<[f64; 2]>,
+    /// Frame time (seconds) at release; a raster that never arrives must not leave a ghost.
+    pub since: f64,
+    /// Its annotation is in the document, so a raster of the page from now on draws it. Until
+    /// then a raster is of the document without it (in full screen the edit is applied the frame
+    /// after the release, and a raster already on its way can arrive in between).
+    pub committed: bool,
+}
+
+/// Longest a released drawing stays painted without its page raster, and how many are kept.
+pub(super) const SETTLE_SECS: f64 = 20.0;
+
+const SETTLE_MAX: usize = 16;
+
+impl CommentView {
+    /// Remember a released drag drawing so it stays on screen until its page is re-rendered.
+    pub(crate) fn settle(&mut self, now: f64, page: usize, tool: CommentTool, points: &[[f64; 2]]) {
+        if !matches!(tool, CommentTool::Ink | CommentTool::Line | CommentTool::Arrow | CommentTool::Rectangle | CommentTool::Oval) {
+            return;
+        }
+        self.settling.retain(|s| now - s.since < SETTLE_SECS);
+        if self.settling.len() >= SETTLE_MAX {
+            self.settling.remove(0);
+        }
+        self.settling.push(Settling { page, tool, points: points.to_vec(), since: now, committed: false });
+    }
+
+    /// How many released drawings are still painted from their points (waiting for a raster).
+    pub fn settling_len(&self) -> usize {
+        self.settling.len()
+    }
+
+    /// A fresh raster of `page` is on screen: it draws the committed annotations itself. One
+    /// still waiting for its edit isn't in that raster, and stays drawn from its points.
+    pub(crate) fn page_rendered(&mut self, page: usize) {
+        self.settling.retain(|s| s.page != page || !s.committed);
+    }
+
+    /// The edit adding the released drawings was applied: rasters from now on draw them.
+    pub(crate) fn drawings_committed(&mut self) {
+        for s in &mut self.settling {
+            s.committed = true;
+        }
+    }
+
+    /// The edit adding the released drawings failed: nothing will draw them.
+    pub(crate) fn drawings_refused(&mut self) {
+        self.settling.retain(|s| s.committed);
+    }
+}
+
+/// Per-document commenting state.
+#[derive(Clone, Debug, Default)]
+pub struct CommentView {
+    /// The selected comment: (page, index in `/Annots`).
+    pub selected: Option<(usize, usize)>,
+    pub gesture: Option<Gesture>,
+    /// Drawings just released: shown from their points until the page raster that includes the
+    /// committed annotation arrives, so the stroke never vanishes in between (#1858).
+    pub(crate) settling: Vec<Settling>,
+    /// Escape ends egui's drag too; ignore its synthetic release until the mouse is up.
+    pub(super) cancelled_drag: bool,
+    pub composer: Option<Composer>,
+    /// Reply being typed under the selected card.
+    pub reply: String,
+    /// Inline edit of a card's text in the Comments panel: (page, index, text).
+    pub editing: Option<(usize, usize, String)>,
+    /// The panel should scroll the selected card into view.
+    pub reveal: bool,
+    /// The "Add a comment" box at the top of the Comments panel.
+    pub add_box: String,
+    /// The Comments panel's search query (`None`: search closed).
+    pub search: Option<String>,
+    /// Comment types, authors and statuses hidden by the panel's filter.
+    pub hidden_types: Vec<String>,
+    pub hidden_authors: Vec<String>,
+    pub hidden_statuses: Vec<String>,
+    /// Colours (`RRGGBB`, empty for none) and checkmark states ("Checked", "Unchecked") hidden.
+    pub hidden_colors: Vec<String>,
+    pub hidden_checks: Vec<String>,
+    /// How the panel orders comments.
+    pub sort: SortBy,
+    /// Pages whose group is folded in the panel (when sorted by page).
+    pub collapsed_pages: Vec<usize>,
+    /// Comment Properties was asked for from the panel: (page, index).
+    pub props_request: Option<(usize, usize)>,
+    /// Make Current Properties Default was asked for: (page, index).
+    pub default_request: Option<(usize, usize)>,
+    /// A file attachment comment's file was asked for: (page, index, open it in a new tab
+    /// rather than save it).
+    pub attachment_request: Option<(usize, usize, bool)>,
+    /// Replace Text: the struck-out text's quads while the replacement is typed.
+    pub replace: Option<Vec<[f64; 8]>>,
+    /// Attach file: where the icon goes (page, top-left in user space), for the app to pick a file.
+    pub attach_at: Option<(usize, [f64; 2])>,
+    pub search_focus: bool,
+    /// Where the canvas context menu was opened: (page, user-space point).
+    pub context_at: Option<(usize, [f64; 2])>,
+    /// A one-shot tool just finished; the app returns to the Select tool unless pinned.
+    pub tool_done: bool,
+    /// What the inline editor (`editing`) does with the keyboard the next time it is drawn.
+    pub(crate) editor_focus: Option<EditorFocus>,
+}
+
+/// A one-off change to the keyboard focus of the Comments panel's inline editor. The editor
+/// never asks for the keyboard on its own: when it did so on every frame, it took the keyboard
+/// back after every click elsewhere, and the tool keys (V, H) were typed into it (#2669).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum EditorFocus {
+    /// The editor just opened: it takes the keyboard, once.
+    Take,
+    /// Another comment was added: the editor keeps its text but gives the keyboard back.
+    Release,
+}
+
+impl CommentView {
+    /// Takes back the last point of a polygon, cloud or connected lines being drawn; the first
+    /// point's removal cancels the drawing. Returns whether there was such a drawing.
+    pub fn undo_point(&mut self) -> bool {
+        let Some(Gesture::Draw { tool, points, .. }) = self.gesture.as_mut() else { return false };
+        if !tool.clicks_points() {
+            return false;
+        }
+        points.pop();
+        if points.is_empty() {
+            self.gesture = None;
+        }
+        true
+    }
+
+    /// Open the inline editor on comment (page, index) with `text`. It takes the keyboard once,
+    /// as it opens; after that the keyboard goes wherever the user clicks.
+    pub(crate) fn open_editor(&mut self, page: usize, index: usize, text: String) {
+        self.editing = Some((page, index, text));
+        self.editor_focus = Some(EditorFocus::Take);
+    }
+
+    /// A comment was just added. The editor open on another one must not keep the keyboard, or
+    /// the tool keys pressed next are typed into it (#2669): an empty editor closes, and one
+    /// holding text stays open with it, without the keyboard.
+    pub(crate) fn comment_added(&mut self) {
+        if self.editing.as_ref().is_some_and(|(_, _, text)| !text.is_empty()) {
+            self.editor_focus = Some(EditorFocus::Release);
+        } else {
+            self.editing = None;
+            self.editor_focus = None;
+        }
+    }
+}
+
+/// Comments panel order (Acrobat: Sort by page, author, date, type, colour).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum SortBy {
+    #[default]
+    Page,
+    Author,
+    Date,
+    Type,
+    Color,
+}
+
+/// What a page needs to know to handle comment input.
+pub(crate) struct PageCx<'a> {
+    pub page: usize,
+    pub xf: &'a PageXform,
+    /// The pointer as the pages see it this frame.
+    pub ptr: &'a PagePointer,
+    pub info: &'a DocInfo,
+    pub tool: QuickTool,
+    pub prefs: &'a CommentPrefs,
+    /// A redaction mark's fill while the pointer is over it, and its opacity (Redaction Tool
+    /// Properties).
+    pub redact_mark: ([f64; 3], f64),
+    /// The document allows commenting.
+    pub allowed: bool,
+    /// Comments are hidden (Hide all comments): nothing to select.
+    pub hidden: bool,
+}
+
+impl PageCx<'_> {
+    pub(super) fn to_user(&self, p: Pos2) -> [f64; 2] {
+        let (vx, vy) = self.xf.screen_to_view(p);
+        let u = self.info.pages[self.page].view_to_user(vx, vy);
+        [u[0] as f64, u[1] as f64]
+    }
+
+    pub(super) fn to_screen(&self, p: [f64; 2]) -> Pos2 {
+        let v = self.info.pages[self.page].user_to_view(p[0] as f32, p[1] as f32);
+        self.xf.norm_to_screen(v[0] / self.xf.pw, v[1] / self.xf.ph)
+    }
+
+    /// The page's clockwise `/Rotate`.
+    pub(super) fn rotation(&self) -> u16 {
+        self.info.pages.get(self.page).map_or(0, |p| p.rotation)
+    }
+
+    /// Where a comment is drawn on screen (a sticky note stays upright on a turned page).
+    pub(super) fn screen_rect(&self, a: &Annotation) -> Rect {
+        self.xf.user_rect(self.info, self.page, a.shown_rect(self.rotation()))
+    }
+
+    /// Top-level comments on this page, in paint order.
+    pub(super) fn comments(&self) -> impl Iterator<Item = &Annotation> {
+        self.info.annotations.iter().filter(move |a| !self.hidden && a.page == self.page && a.is_comment() && a.subtype != "Popup")
+    }
+
+    /// Where a comment is on screen: one rectangle, or one per marked line for text markup.
+    pub(crate) fn screen_rects<'b>(&'b self, a: &'b Annotation) -> impl Iterator<Item = Rect> + 'b {
+        let quads = if is_markup(&a.subtype) { a.quads.as_slice() } else { &[] };
+        let fallback = quads.is_empty().then(|| self.screen_rect(a));
+        quads
+            .iter()
+            .map(|q| {
+                let xs = [q[0], q[2], q[4], q[6]];
+                let ys = [q[1], q[3], q[5], q[7]];
+                let (x0, x1) = (xs.iter().copied().fold(f32::MAX, f32::min), xs.iter().copied().fold(f32::MIN, f32::max));
+                let (y0, y1) = (ys.iter().copied().fold(f32::MAX, f32::min), ys.iter().copied().fold(f32::MIN, f32::max));
+                self.xf.user_rect(self.info, self.page, [x0, y0, x1, y1])
+            })
+            .chain(fallback)
+    }
+
+    /// A redaction mark's areas: one per marked quad, or its rectangle.
+    pub(super) fn redact_rects(&self, a: &Annotation) -> Vec<Rect> {
+        if a.quads.is_empty() {
+            return vec![self.screen_rect(a)];
+        }
+        a.quads
+            .iter()
+            .map(|q| {
+                let xs = [q[0], q[2], q[4], q[6]];
+                let ys = [q[1], q[3], q[5], q[7]];
+                let (x0, x1) = (xs.iter().copied().fold(f32::MAX, f32::min), xs.iter().copied().fold(f32::MIN, f32::max));
+                let (y0, y1) = (ys.iter().copied().fold(f32::MAX, f32::min), ys.iter().copied().fold(f32::MIN, f32::max));
+                self.xf.user_rect(self.info, self.page, [x0, y0, x1, y1])
+            })
+            .collect()
+    }
+
+    /// The topmost comment under `p`.
+    pub(super) fn hit(&self, p: Pos2) -> Option<&Annotation> {
+        self.comments().filter(|a| self.screen_rects(a).any(|r| r.expand(3.0).contains(p))).last()
+    }
+
+    pub(crate) fn get(&self, index: usize) -> Option<&Annotation> {
+        self.comments().find(|a| a.index == index)
+    }
+
+    pub(crate) fn rect_to_user(&self, r: Rect) -> [f64; 4] {
+        let (a, b) = (self.to_user(r.left_top()), self.to_user(r.right_bottom()));
+        [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
+    }
+
+    /// The same geometry drives the live image, its handles, and the edit on release.
+    /// `shift` is whether Shift is held now: it keeps the box's proportions from a corner.
+    pub(crate) fn adjusted_rect(
+        &self,
+        a: &Annotation,
+        gesture: Option<&Gesture>,
+        pointer: Option<Pos2>,
+        shift: bool,
+        pending: Option<&Edit>,
+    ) -> Rect {
+        let r = self.screen_rect(a);
+        if let Some(Edit::ResizeAnnotation { page, index, rect }) = pending
+            && (*page, *index) == (self.page, a.index)
+        {
+            return self.xf.user_rect(self.info, self.page, a.shown(*rect, self.rotation()).map(|v| v as f32));
+        }
+        if let Some(Edit::MoveAnnotation { page, index, dx, dy }) = pending
+            && (*page, *index) == (self.page, a.index)
+        {
+            let r = a.shown_rect(self.rotation());
+            return self.xf.user_rect(self.info, self.page, [r[0] + *dx as f32, r[1] + *dy as f32, r[2] + *dx as f32, r[3] + *dy as f32]);
+        }
+        match (gesture, pointer) {
+            (Some(Gesture::Move { page, index, from }), Some(p)) if (*page, *index) == (self.page, a.index) => r.translate(p - *from),
+            (Some(Gesture::Resize { page, index, handle, from, aspect_ratio }), Some(p)) if (*page, *index) == (self.page, a.index) => {
+                resized(r, *handle, p - *from, corner_ratio(r, *aspect_ratio, shift))
+            }
+            _ => r,
+        }
+    }
+}
diff --git a/crates/ui-egui/src/tools/comments/tests.rs b/crates/ui-egui/src/tools/comments/tests.rs
new file mode 100644
index 0000000000..fff7f01368
--- /dev/null
+++ b/crates/ui-egui/src/tools/comments/tests.rs
@@ -0,0 +1,386 @@
+use super::*;
+
+/// A selected line is drawn where it is going: moved by its body (both ends follow the
+/// pointer), with an end dragged (that end alone), and as released until the page is drawn.
+#[test]
+fn a_moved_or_reshaped_line_is_drawn_at_its_new_points() {
+    let line = [[10.0, 10.0], [50.0, 10.0]];
+    let to_user = |p: Pos2| [f64::from(p.x), f64::from(p.y)];
+    let moving = Gesture::Move { page: 0, index: 3, from: pos2(20.0, 10.0) };
+    let at = Some(pos2(25.0, 30.0));
+    assert_eq!(changing_points(Some(&moving), None, (0, 3), &line, to_user, at, false), Some(vec![[15.0, 30.0], [55.0, 30.0]]));
+    assert_eq!(changing_points(Some(&moving), None, (0, 4), &line, to_user, at, false), None, "another comment's move");
+    let released = Edit::MoveAnnotation { page: 0, index: 3, dx: 5.0, dy: 20.0 };
+    assert_eq!(changing_points(None, Some(&released), (0, 3), &line, to_user, None, false), Some(vec![[15.0, 30.0], [55.0, 30.0]]));
+    let dragging = Gesture::Reshape { page: 0, index: 3, point: 1, points: line.to_vec() };
+    let to = Some(pos2(60.0, 10.0));
+    assert_eq!(changing_points(Some(&dragging), None, (0, 3), &line, to_user, to, false), Some(vec![[10.0, 10.0], [60.0, 10.0]]));
+    assert_eq!(changing_points(None, None, (0, 3), &line, to_user, to, false), None, "not changing");
+}
+
+/// A sticky note on a page turned a quarter is drawn upright beside its `/Rect`: an edit
+/// composer stays open while the drawn note is partly in view, even with `/Rect` out of it.
+#[test]
+fn an_upright_note_on_a_turned_page_is_in_view_where_it_is_drawn() {
+    let note = |no_rotate| Annotation {
+        page: 0,
+        subtype: "Text".into(),
+        author: None,
+        contents: None,
+        modified: None,
+        name: None,
+        in_reply_to: None,
+        parent: None,
+        grouped: false,
+        rect: [40.0, 20.0, 70.0, 40.0],
+        color: None,
+        index: 0,
+        state: None,
+        quads: Vec::new(),
+        locked: false,
+        intent: None,
+        fill_sign: false,
+        no_rotate,
+        points: Vec::new(),
+    };
+    let page = PageInfo { width: 140.0, height: 200.0, label: String::new(), crop: [0.0, 0.0, 200.0, 140.0], rotation: 90 };
+    let xf = PageXform { rect: Rect::from_min_size(Pos2::ZERO, vec2(140.0, 200.0)), rot: 0, pw: 140.0, ph: 200.0 };
+    let prefs = CommentPrefs::default();
+    // Screen x is user y here: `/Rect` spans x 20..40, the upright note x 40..70.
+    let viewport = Rect::from_min_max(pos2(50.0, 0.0), pos2(140.0, 200.0));
+    for (no_rotate, in_view) in [(true, true), (false, false)] {
+        let info = DocInfo { pages: vec![page.clone()], annotations: vec![note(no_rotate)], ..Default::default() };
+        let cx = PageCx {
+            page: 0,
+            xf: &xf,
+            ptr: &PagePointer::default(),
+            info: &info,
+            tool: QuickTool::Select,
+            prefs: &prefs,
+            allowed: true,
+            hidden: false,
+            redact_mark: ([0.0; 3], 1.0),
+        };
+        assert_eq!(edited_in_view(&cx, 0, viewport), in_view, "no_rotate: {no_rotate}");
+    }
+}
+
+use pdfcraft_render::TextGlyph;
+
+/// One glyph per character, `w` points wide, on a line of `em`-point text whose baseline is at `y`, drawn
+/// along `direction` (a unit vector in view space, y down).
+fn line(chars: &str, x: f32, y: f32, w: f32, em: f32, direction: [f32; 2]) -> PageText {
+    let [dx, dy] = direction;
+    // "Up" for the glyph: its writing direction turned a quarter counterclockwise (y down).
+    let [ux, uy] = [dy, -dx];
+    let glyphs = chars
+        .chars()
+        .enumerate()
+        .map(|(i, c)| {
+            let start = [x + dx * w * i as f32, y + dy * w * i as f32];
+            let at = |along: f32, up: f32| [start[0] + dx * along + ux * up, start[1] + dy * along + uy * up];
+            let quad = [at(0.0, -0.2 * em), at(w, -0.2 * em), at(w, 0.8 * em), at(0.0, 0.8 * em)];
+            let xs = quad.map(|p| p[0]);
+            let ys = quad.map(|p| p[1]);
+            let rect = [
+                xs.into_iter().fold(f32::INFINITY, f32::min),
+                ys.into_iter().fold(f32::INFINITY, f32::min),
+                xs.into_iter().fold(f32::NEG_INFINITY, f32::max),
+                ys.into_iter().fold(f32::NEG_INFINITY, f32::max),
+            ];
+            TextGlyph { text: c.to_string(), rect, quad, direction }
+        })
+        .collect::<Vec<_>>();
+    let n = glyphs.len();
+    PageText { glyphs, line_of: vec![0; n], space_before: vec![false; n] }
+}
+
+fn near(a: Option<([f32; 2], f32)>, b: ([f32; 2], f32)) -> bool {
+    a.is_some_and(|([x, y], s)| (x - b.0[0]).abs() < 1e-3 && (y - b.0[1]).abs() < 1e-3 && (s - b.1).abs() < 1e-3)
+}
+
+#[test]
+fn the_caret_snaps_to_the_nearer_edge_on_the_baseline() {
+    let text = line("abcd", 20.0, 100.0, 10.0, 14.0, [1.0, 0.0]);
+    // "c" spans 40..50: its left half snaps before it, its right half after it.
+    assert!(near(caret_snap(&text, 43.0, 95.0), ([40.0, 100.0], 7.0)));
+    assert!(near(caret_snap(&text, 47.0, 92.0), ([50.0, 100.0], 7.0)));
+    // Just past the last character, on the line: after it.
+    assert!(near(caret_snap(&text, 63.0, 99.0), ([60.0, 100.0], 7.0)));
+}
+
+#[test]
+fn the_snapped_caret_follows_the_page_into_user_space() {
+    let text = line("abcd", 20.0, 100.0, 10.0, 14.0, [1.0, 0.0]);
+    let page = |rotation, user_unit: f32| PageInfo {
+        width: 300.0 * user_unit,
+        height: 200.0 * user_unit,
+        label: "1".into(),
+        crop: [0.0, 0.0, 300.0, 200.0],
+        rotation,
+    };
+    // An unrotated page: view y = 100 is user y = 100 (y up from the bottom of a 200 pt page).
+    let (tip, side) = snapped_caret(&page(0, 1.0), &text, 43.0, 95.0).expect("snaps");
+    assert!((tip[0] - 40.0).abs() < 1e-3 && (tip[1] - 100.0).abs() < 1e-3 && (side - 7.0).abs() < 1e-3);
+    // /UserUnit 2: the view is twice as large, so the same text is half as many user units.
+    let doubled = line("abcd", 40.0, 200.0, 20.0, 28.0, [1.0, 0.0]);
+    let (tip, side) = snapped_caret(&page(0, 2.0), &doubled, 86.0, 190.0).expect("snaps");
+    assert!((tip[0] - 40.0).abs() < 1e-3 && (tip[1] - 100.0).abs() < 1e-3 && (side - 7.0).abs() < 1e-3, "{tip:?} {side}");
+    // A rotated page: the caret would lie on its side, so it stays at the click.
+    for rotation in [90, 180, 270] {
+        assert_eq!(snapped_caret(&page(rotation, 1.0), &text, 43.0, 95.0), None, "/Rotate {rotation}");
+    }
+}
+
+#[test]
+fn away_from_upright_horizontal_text_the_caret_stays_at_the_click() {
+    let text = line("abcd", 20.0, 100.0, 10.0, 14.0, [1.0, 0.0]);
+    assert_eq!(caret_snap(&text, 200.0, 100.0), None, "far to the right");
+    assert_eq!(caret_snap(&text, 40.0, 40.0), None, "far above the line");
+    assert_eq!(caret_snap(&PageText::default(), 40.0, 100.0), None, "no text");
+    for (direction, what) in [([0.0, 1.0], "vertical"), ([-1.0, 0.0], "upside down"), ([0.995, 0.0998], "sloped")] {
+        let turned = line("abcd", 20.0, 100.0, 10.0, 14.0, direction);
+        let [x0, y0, x1, y1] = turned.glyphs[2].rect;
+        assert_eq!(caret_snap(&turned, (x0 + x1) / 2.0, (y0 + y1) / 2.0), None, "{what}");
+    }
+}
+
+#[test]
+fn recent_custom_colours_dedupe_cap_and_skip_swatches() {
+    // #1193: "Other colour…" remembers what it applied, newest first.
+    let ctx = egui::Context::default();
+    assert!(recent_custom_colours(&ctx).is_empty());
+    for i in 0..7 {
+        remember_custom_colour(&ctx, [0.1 * f64::from(i), 0.3, 0.7]);
+    }
+    let recent = recent_custom_colours(&ctx);
+    assert_eq!(recent.len(), RECENT_CUSTOM, "capped");
+    assert!(same_colour(&recent[0], &[0.6, 0.3, 0.7]), "newest first: {recent:?}");
+    remember_custom_colour(&ctx, [0.2, 0.3, 0.7]);
+    let again = recent_custom_colours(&ctx);
+    assert_eq!(again.len(), RECENT_CUSTOM);
+    assert!(
+        same_colour(&again[0], &[0.2, 0.3, 0.7]) && again.iter().filter(|c| same_colour(c, &[0.2, 0.3, 0.7])).count() == 1,
+        "moved, not repeated"
+    );
+    // Swatches and unusable values are not remembered; out-of-range ones are clamped.
+    remember_custom_colour(&ctx, SWATCHES[0].1);
+    remember_custom_colour(&ctx, [f64::NAN, 0.0, 0.0]);
+    assert!(same_colour(&recent_custom_colours(&ctx)[0], &[0.2, 0.3, 0.7]));
+    remember_custom_colour(&ctx, [1.7, -0.5, 0.25]);
+    assert!(same_colour(&recent_custom_colours(&ctx)[0], &[1.0, 0.0, 0.25]));
+}
+
+#[test]
+fn other_colour_applies_the_picked_colour_once() {
+    // #1193: the swatch grid has a full picker; Apply returns its colour and remembers it.
+    use egui_kittest::kittest::Queryable;
+    let current = [0.2, 0.4, 0.6];
+    let mut h = egui_kittest::Harness::new_ui_state(
+        |ui, picked: &mut Vec<Rgb>| {
+            if let Some(c) = swatch_grid(ui, Some(current)) {
+                picked.push(c);
+            }
+        },
+        Vec::new(),
+    );
+    h.run();
+    assert!(h.query_by_label("Apply").is_none(), "the picker starts closed");
+    assert!(h.query_by_label("Recent colours").is_none());
+    h.get_by_label("Other colour…").click();
+    h.run();
+    h.get_by_label("Apply").click();
+    h.run();
+    let picked = h.state().clone();
+    assert_eq!(picked.len(), 1, "one choice: {picked:?}");
+    assert!(same_colour(&picked[0], &current), "the picker opens on the current colour: {picked:?}");
+    assert!(h.query_by_label("Apply").is_none(), "applying closes the picker");
+    assert!(h.query_by_label("Recent colours").is_some(), "the colour is offered again");
+}
+
+#[test]
+fn two_grids_in_one_parent_open_their_pickers_separately() {
+    // Redaction properties and Prepare a form draw two grids in one parent ui.
+    use egui_kittest::kittest::Queryable;
+    let mut h = egui_kittest::Harness::new_ui(|ui| {
+        let _ = swatch_grid(ui, Some([0.2, 0.4, 0.6]));
+        let _ = swatch_grid(ui, Some([0.6, 0.4, 0.2]));
+    });
+    h.run();
+    let plus = h.query_all_by_label("Other colour…").collect::<Vec<_>>();
+    assert_eq!(plus.len(), 2);
+    plus[0].click();
+    h.run();
+    assert_eq!(h.query_all_by_label("Apply").count(), 1, "only the first grid's picker opens");
+}
+
+#[test]
+fn other_colour_opens_the_picker_inside_the_quick_bar_popup() {
+    use egui_kittest::kittest::Queryable;
+    let mut h = egui_kittest::Harness::new_ui_state(
+        |ui, prefs: &mut CommentPrefs| {
+            let _ = quick_bar_controls(ui, CommentTool::Highlight, prefs);
+        },
+        CommentPrefs::default(),
+    );
+    h.run();
+    h.get_by_label("Colour").click();
+    h.run();
+    h.get_by_label("Other colour…").click();
+    h.run();
+    assert!(h.query_by_label("Apply").is_some(), "the popup stays open with the picker showing");
+    h.get_by_label("Apply").click();
+    h.run();
+    assert!(h.query_by_label("Other colour…").is_none(), "applying a colour closes the popup");
+}
+
+#[test]
+fn other_colour_opens_the_picker_inside_the_quick_bar_fill_popup() {
+    use egui_kittest::kittest::Queryable;
+    let prefs = CommentPrefs::default();
+    let fill_label = if prefs.style(CommentTool::Rectangle).fill.is_some() { "Fill colour" } else { "Fill colour: none" };
+    let mut h = egui_kittest::Harness::new_ui_state(
+        |ui, prefs: &mut CommentPrefs| {
+            let _ = quick_bar_controls(ui, CommentTool::Rectangle, prefs);
+        },
+        prefs,
+    );
+    h.ctx.set_fonts(theme::font_definitions());
+    h.run();
+    h.get_by_label(fill_label).click();
+    h.run();
+    h.get_by_label("Other colour…").click();
+    h.run();
+    assert!(h.query_by_label("Apply").is_some(), "the popup stays open with the picker showing");
+    h.get_by_label("Apply").click();
+    h.run();
+    assert!(h.query_by_label("No fill").is_none(), "applying a colour closes the popup");
+    assert!(h.state().style(CommentTool::Rectangle).fill.is_some());
+}
+
+#[test]
+fn context_menu_colour_submenu_keeps_its_picker_open_and_a_swatch_closes_the_menu() {
+    use egui_kittest::kittest::Queryable;
+    let info = DocInfo {
+        pages: vec![PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 }],
+        annotations: vec![Annotation {
+            page: 0,
+            subtype: "Square".into(),
+            author: None,
+            contents: None,
+            modified: None,
+            name: None,
+            in_reply_to: None,
+            parent: None,
+            grouped: false,
+            rect: [10.0, 10.0, 50.0, 50.0],
+            color: None,
+            index: 0,
+            state: None,
+            quads: Vec::new(),
+            locked: false,
+            intent: None,
+            fill_sign: false,
+            points: Vec::new(),
+            no_rotate: false,
+        }],
+        ..Default::default()
+    };
+    let mut view = DocView::new(pdfcraft_engine::DocId(1), &info, crate::canvas::ViewDefaults::default());
+    view.comments.selected = Some((0, 0));
+    let prefs = CommentPrefs::default();
+    let mut h = egui_kittest::Harness::new_ui_state(
+        |ui, (view, actions): &mut (DocView, Vec<CanvasAction>)| {
+            ui.button("Page").context_menu(|ui| {
+                if let Some(a) = context_menu(ui, view, &info, &prefs, true, true) {
+                    actions.push(a);
+                }
+            });
+        },
+        (view, Vec::new()),
+    );
+    h.run();
+    h.get_by_label("Page").click_secondary();
+    h.run();
+    h.get_by_label("Colour").click();
+    h.run();
+    h.get_by_label("Other colour…").click();
+    h.run();
+    assert!(h.query_by_label("Apply").is_some(), "the submenu stays open with the picker showing");
+    h.get_by_label("Red").click();
+    h.run();
+    assert!(h.query_by_label("Edit text…").is_none(), "picking a swatch closes the whole menu");
+    let actions = &h.state().1;
+    assert!(
+        matches!(actions.as_slice(), [CanvasAction::Edit(e)] if matches!(**e, Edit::StyleAnnotation { page: 0, index: 0, color: Some(_), .. })),
+        "{actions:?}"
+    );
+}
+
+#[test]
+fn shift_keeps_the_current_proportions_unless_the_box_has_its_own() {
+    let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
+    assert_eq!(corner_ratio(r, None, false), None);
+    assert_eq!(corner_ratio(r, None, true), Some(3.0));
+    assert_eq!(corner_ratio(r, Some(2.0), false), Some(2.0));
+    assert_eq!(corner_ratio(r, Some(2.0), true), Some(2.0));
+    // A degenerate box has no proportions to keep (no division by zero).
+    let flat = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 100.0));
+    assert_eq!(corner_ratio(flat, None, true), None);
+    // Dragging a corner with Shift held scales the box instead of stretching it.
+    let out = resized(r, (1, 1), vec2(48.0, 0.0), corner_ratio(r, None, true));
+    assert_eq!(out.min, r.min);
+    assert!((out.width() / out.height() - 3.0).abs() < 0.001);
+}
+
+#[test]
+fn proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis() {
+    let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
+    for (hx, hy) in [(-1, -1), (1, -1), (-1, 1), (1, 1)] {
+        for (dx, dy) in [(24.0, 0.0), (0.0, 16.0), (-48.0, -20.0), (-200.0, -200.0)] {
+            let out = resized(r, (hx, hy), vec2(f32::from(hx) * dx, f32::from(hy) * dy), Some(3.0));
+            assert_eq!(handle_pos(out, (-hx, -hy)), handle_pos(r, (-hx, -hy)));
+            assert!((out.width() / out.height() - 3.0).abs() < 0.001);
+            assert!(out.width() >= 4.0 && out.height() >= 4.0);
+        }
+    }
+    for handle in [(0, -1), (1, 0), (0, 1), (-1, 0)] {
+        let out = resized(r, handle, vec2(24.0, 16.0), Some(3.0));
+        assert_eq!(out, resized(r, handle, vec2(24.0, 16.0), None));
+        assert_eq!(if handle.0 == 0 { out.width() } else { out.height() }, if handle.0 == 0 { r.width() } else { r.height() });
+    }
+    // Ordinary comment corners keep their existing independent width/height behavior.
+    let free = resized(r, (1, 1), vec2(24.0, 0.0), None);
+    assert_eq!(free.size(), vec2(120.0, 32.0));
+}
+
+#[test]
+fn tools_round_trip_through_their_commands() {
+    for t in ALL {
+        assert_eq!(CommentTool::from_command(t.command()), Some(t));
+        assert!(pdfcraft_engine::commands::command(t.command()).is_some(), "{} is registered", t.command());
+        assert!(icons::exists(t.icon()), "icon {}", t.icon());
+        assert!(GROUPS[t.group()].contains(&t));
+    }
+}
+
+#[test]
+fn drawn_shapes_ignore_slips() {
+    assert_eq!(drawn_shape(CommentTool::Rectangle, &[[0.0, 0.0], [1.0, 1.0]]), None);
+    assert_eq!(drawn_shape(CommentTool::Rectangle, &[[10.0, 0.0], [0.0, 10.0]]), Some(Shape::Rectangle { rect: [0.0, 0.0, 10.0, 10.0] }));
+    assert_eq!(drawn_shape(CommentTool::Ink, &[[0.0, 0.0]]), Some(Shape::Ink { strokes: vec![vec![[0.0, 0.0]]] }));
+    assert!(matches!(
+        drawn_shape(CommentTool::Arrow, &[[0.0, 0.0], [5.0, 0.0]]),
+        Some(Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. })
+    ));
+}
+
+#[test]
+fn text_boxes_fit_their_text() {
+    let r = text_box_rect([100.0, 500.0], "Hi", 12.0, 0);
+    assert_eq!((r[0], r[3]), (100.0, 500.0));
+    assert!(r[2] - r[0] < 60.0);
+    let long = text_box_rect([0.0, 500.0], &"word ".repeat(80), 12.0, 0);
+    assert_eq!(long[2], 300.0);
+    assert!(long[3] - long[1] > 50.0);
+}
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/tools/content_ui.rs
similarity index 88%
rename from crates/ui-egui/src/content_ui.rs
rename to crates/ui-egui/src/tools/content_ui.rs
index d966b04a58..0da3b235c8 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/tools/content_ui.rs
@@ -8,6 +8,7 @@ use pdfcraft_engine::{Added, AddedContent, AddedText, Edit};
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
 use crate::theme::Tokens;
 use crate::widgets;
 
@@ -90,6 +91,11 @@ pub struct ContentView {
 }
 
 impl ContentView {
+    /// Forget an in-progress pointer grab for content editing.
+    pub(crate) fn cancel_pointer_gesture(&mut self) {
+        self.grab = None;
+    }
+
     pub(crate) fn finish_draft(&mut self, added: &[Added]) -> Option<Edit> {
         self.draft.take().and_then(|d| finish(self, d, added))
     }
@@ -117,6 +123,10 @@ pub(crate) struct MoveBackground {
     key: Option<(u64, usize, usize)>,
     renderer: Option<pdfcraft_render::RenderPool>,
     texture: Option<egui::TextureHandle>,
+    /// The item alone on a transparent page: the pixels that follow the pointer. The page's own
+    /// raster has whatever the item covers in its box too, which must stay where it is (#4464).
+    item_renderer: Option<pdfcraft_render::RenderPool>,
+    item: Option<egui::TextureHandle>,
     tag: Option<u64>,
     /// The item's display-space box when the gesture started.
     from: Option<[f64; 4]>,
@@ -129,7 +139,12 @@ pub(crate) struct MoveBackground {
 
 impl MoveBackground {
     pub fn pending(&self) -> bool {
-        self.renderer.is_some() && self.texture.is_none()
+        self.renderer.is_some() && self.item_renderer.is_some() && (self.texture.is_none() || self.item.is_none())
+    }
+
+    /// Both rasters are in: the page without the item, and the item alone.
+    fn ready(&self) -> bool {
+        self.texture.is_some() && self.item.is_some()
     }
 
     pub fn prepare(&mut self, ctx: &egui::Context, doc: &pdfcraft_engine::Document, cv: &ContentView, scale: f32) {
@@ -144,6 +159,7 @@ impl MoveBackground {
             *self = Self { key, ..Default::default() };
             if let Some((_, page, index)) = key {
                 self.renderer = doc.added_content_preview(page, index).ok().map(|p| p.renderer());
+                self.item_renderer = doc.added_content_alone(page, index).ok().map(|p| p.renderer());
                 self.from = on_page(doc.added(), page).into_iter().find(|(i, _)| *i == index).map(|(_, a)| a.content.rect());
                 self.picture = picture(page, index);
             }
@@ -151,39 +167,60 @@ impl MoveBackground {
         if self.settling.is_some() {
             return;
         }
-        let (Some((_, page, _)), Some(renderer)) = (self.key, self.renderer.as_ref()) else { return };
+        let (Some((_, page, _)), Some(renderer), Some(item_renderer)) = (self.key, self.renderer.as_ref(), self.item_renderer.as_ref()) else {
+            return;
+        };
         let Some(p) = doc.info.pages.get(page) else { return };
         let max_side = ctx.input(|i| i.max_texture_side) as f32;
         let scale = scale.min(crate::canvas::BASE_SIDE.min(max_side) / p.width.max(p.height).max(1.0));
         let tag = (scale * 1000.0) as u64;
         if self.tag != Some(tag) {
-            renderer.set_queue(vec![pdfcraft_render::RenderRequest { page, scale, tag, ..Default::default() }]);
+            for r in [renderer, item_renderer] {
+                r.set_queue(vec![pdfcraft_render::RenderRequest { page, scale, tag, ..Default::default() }]);
+            }
             self.tag = Some(tag);
         }
-        if let Some(out) = renderer.try_recv() {
+        if self.receive(ctx, tag) && self.pending() {
+            ctx.request_repaint_after(std::time::Duration::from_millis(16));
+        }
+    }
+
+    /// Takes in the rasters rendered at `tag`. `false` when either failed: the preview is then
+    /// dropped whole, including rasters in from an earlier scale.
+    fn receive(&mut self, ctx: &egui::Context, tag: u64) -> bool {
+        let (Some(renderer), Some(item_renderer)) = (self.renderer.as_ref(), self.item_renderer.as_ref()) else {
+            return false;
+        };
+        let mut failed = false;
+        for (r, slot, name) in
+            [(renderer, &mut self.texture, "added-content-move-background"), (item_renderer, &mut self.item, "added-content-move-item")]
+        {
+            let Some(out) = r.try_recv() else { continue };
             if out.error.is_some() {
-                // Without a background the item stays put while dragged, as before.
-                self.renderer = None;
-                return;
-            }
-            if out.request.tag == tag {
-                self.texture = Some(ctx.load_texture(
-                    "added-content-move-background",
+                failed = true;
+            } else if out.request.tag == tag {
+                *slot = Some(ctx.load_texture(
+                    name,
                     crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba),
                     egui::TextureOptions::LINEAR,
                 ));
             }
         }
-        if self.pending() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(16));
+        if failed {
+            // Without both rasters the item stays put while dragged, as before.
+            self.renderer = None;
+            self.item_renderer = None;
+            self.texture = None;
+            self.item = None;
         }
+        !failed
     }
 
     /// The move was applied: keep the preview, now at the new generation, until the page is
     /// rendered again. Any other edit ends it.
     pub fn committed(&mut self, edit: &Edit, generation: u64) {
         match edit {
-            Edit::UpdateContent { page, index, content } if self.texture.is_some() && self.key.is_some_and(|(_, p, i)| (p, i) == (*page, *index)) => {
+            Edit::UpdateContent { page, index, content } if self.ready() && self.key.is_some_and(|(_, p, i)| (p, i) == (*page, *index)) => {
                 self.key = Some((generation, *page, *index));
                 self.settling = Some(content.rect());
             }
@@ -197,26 +234,17 @@ impl MoveBackground {
         }
     }
 
-    /// The page without the moving item, then the item's pixels taken from `page_tex` (the page
-    /// as rendered, item included where it was) at the dragged or applied position.
-    #[allow(clippy::too_many_arguments)]
-    pub fn paint(
-        &self,
-        ui: &egui::Ui,
-        painter: &egui::Painter,
-        xf: &PageXform,
-        page: usize,
-        info: &DocInfo,
-        cv: &ContentView,
-        page_tex: Option<egui::TextureId>,
-    ) {
-        let (Some((_, kp, _)), Some(background), Some(page_tex), Some(from)) = (self.key, &self.texture, page_tex, self.from) else { return };
+    /// The page without the moving item, then the item's own pixels (from its raster alone, so
+    /// nothing it covered comes along) at the dragged (to the pages' `pointer`) or applied
+    /// position.
+    pub fn paint(&self, painter: &egui::Painter, xf: &PageXform, page: usize, info: &DocInfo, cv: &ContentView, pointer: Option<Pos2>) {
+        let (Some((_, kp, _)), Some(background), Some(item), Some(from)) = (self.key, &self.texture, &self.item, self.from) else { return };
         if kp != page {
             return;
         }
         let r = screen_rect(xf, info, page, from);
         let to = if let Some((_, grab, start)) = cv.grab {
-            let Some(p) = ui.input(|i| i.pointer.hover_pos()) else { return };
+            let Some(p) = pointer else { return };
             dragged(r, grab, p - start, self.picture)
         } else if let Some(to) = self.settling {
             let to = screen_rect(xf, info, page, to);
@@ -229,7 +257,7 @@ impl MoveBackground {
         xf.paint_image(&painter, background.id(), 0.0, 0.0, 1.0, 1.0);
         // A pixel around the box, so its edges come along.
         let (r, to) = (r.expand(1.0), to.expand(1.0));
-        let mut mesh = egui::Mesh::with_texture(page_tex);
+        let mut mesh = egui::Mesh::with_texture(item.id());
         for (a, b) in [
             (r.left_top(), to.left_top()),
             (r.right_top(), to.right_top()),
@@ -302,14 +330,12 @@ fn dragged(r: Rect, grab: Grab, d: egui::Vec2, keep_aspect: bool) -> Rect {
 }
 
 /// Added text and images keep pointer ownership over a form field while editing content.
-pub(crate) fn select_grabs(ui: &egui::Ui, xf: &PageXform, page: usize, info: &DocInfo, added: &[Added], view: &DocView) -> bool {
+pub(crate) fn select_grabs(xf: &PageXform, ptr: &PagePointer, page: usize, info: &DocInfo, added: &[Added], view: &DocView) -> bool {
     let cv = &view.content;
     if cv.grab.is_some_and(|(grab_page, _, _)| grab_page == page) {
         return true;
     }
-    let Some(p) = ui.input(|i| i.pointer.hover_pos().or(i.pointer.interact_pos())).filter(|p| xf.rect.contains(*p)) else {
-        return false;
-    };
+    let Some(p) = ptr.within(xf.rect) else { return false };
     on_page(added, page).into_iter().any(|(index, item)| {
         let rect = screen_rect(xf, info, page, item.content.rect());
         rect.expand(2.0).contains(p)
@@ -324,6 +350,7 @@ pub(crate) fn page_input(
     ui: &egui::Ui,
     resp: &egui::Response,
     xf: &PageXform,
+    ptr: &PagePointer,
     page: usize,
     info: &DocInfo,
     added: &[Added],
@@ -333,13 +360,13 @@ pub(crate) fn page_input(
     view: &mut DocView,
 ) -> bool {
     let mut consumed = false;
-    let pointer = ui.input(|i| i.pointer.hover_pos().or(i.pointer.interact_pos()));
+    let pointer = ptr.pos;
     let cv = &mut view.content;
     if let Some((gp, grab, start)) = cv.grab
         && gp == page
     {
         consumed = true;
-        if resp.drag_stopped() || !ui.input(|i| i.pointer.primary_down()) {
+        if resp.drag_stopped() || !ptr.primary_down {
             cv.grab = None;
             let end = pointer.unwrap_or(start);
             if let Some((sp, si)) = cv.selected
@@ -408,7 +435,7 @@ pub(crate) fn page_input(
         ui.ctx().set_cursor_icon(egui::CursorIcon::Move);
     }
     if resp.drag_started() {
-        let origin = ui.input(|i| i.pointer.press_origin()).unwrap_or(p);
+        let origin = ptr.origin.unwrap_or(p);
         if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(origin) <= 6.0)) {
             cv.grab = Some((page, Grab::Corner(left, top), origin));
             consumed = true;
@@ -450,10 +477,18 @@ pub(crate) fn page_input(
     consumed || hit.is_some() && resp.is_pointer_button_down_on()
 }
 
-/// Outlines of added items (hover and selection with handles) and the box being dragged.
-pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, xf: &PageXform, page: usize, info: &DocInfo, added: &[Added], view: &DocView) {
+/// Outlines of added items (hover and selection with handles) and the box being dragged, the
+/// pages' `pointer` over them.
+pub(crate) fn paint_page(
+    painter: &egui::Painter,
+    xf: &PageXform,
+    page: usize,
+    info: &DocInfo,
+    added: &[Added],
+    view: &DocView,
+    pointer: Option<Pos2>,
+) {
     let cv = &view.content;
-    let pointer = ui.input(|i| i.pointer.hover_pos());
     for (i, a) in on_page(added, page) {
         if cv.draft.as_ref().is_some_and(|d| d.page == page && d.index == Some(i)) {
             continue;
@@ -510,7 +545,7 @@ pub(crate) fn after_refresh(view: &mut DocView, added: &[Added]) {
 pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, added: &[Added]) -> (Option<Edit>, bool) {
     let Some(page) = view.content.draft.as_ref().map(|d| d.page) else { return (None, false) };
     let Some(xf) = view.page_xform(page) else { return (None, false) };
-    let zoom = xf.rect.width() / xf.pw.max(1.0);
+    let zoom = xf.zoom();
     let Some(draft) = view.content.draft.as_mut() else { return (None, false) };
     let font = crate::edit_text_ui::editor_font(&draft.style, (draft.style.size as f32 * zoom).clamp(1.0, 300.0));
     let text = AddedText { text: draft.text.clone(), ..draft.style.clone() };
@@ -555,7 +590,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
     // Shown at once, like the paragraph editor: a fade-in shows the page's copy through it. Over
     // the page, so only where the document shows: text scrolled under the mode bar or a side
     // panel must leave them their pointer (#2755).
-    egui::Area::new(egui::Id::new(("added-text", view.id.0)))
+    egui::Area::new(egui::Id::unique(("added-text", view.id.0)))
         .fade_in(false)
         .order(egui::Order::Foreground)
         .fixed_pos(at)
@@ -589,7 +624,10 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                     .font(font.clone())
                     .desired_width(width)
                     .desired_rows(1)
-                    .horizontal_align(halign)
+                    .align(egui::Align2::new(halign, egui::Align::TOP))
+                    // Keep the page editor's original inset; the theme's larger button padding
+                    // otherwise shifts narrow right-aligned boxes away from their text edge.
+                    .margin(egui::Margin::symmetric(4, 2))
                     .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
                     .text_color(Color32::from_rgb(cr, cg, cb))
                     .hint_text(tl!("Type text"))
@@ -597,7 +635,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 if letter_spacing != 0.0 {
                     edit = edit.layouter(&mut spaced);
                 }
-                let resp = ui.add(edit);
+                let resp = ui.add(edit).accessible_name(tl!("Added text"));
                 if t.focus {
                     resp.request_focus();
                     t.focus = false;
@@ -935,19 +973,28 @@ pub(crate) fn image_panel(ui: &mut egui::Ui, t: &Tokens, img: &pdfcraft_engine::
         }
     });
     ui.label(egui::RichText::new(tl!("Crop (% trimmed from each side)")).small().color(t.text_muted));
-    let mut crop = img.crop.map(|v| (v * 100.0).round());
+    let most = (1.0 - pdfcraft_engine::AddedImage::MIN_CROP_KEEP) * 100.0;
+    // Unrounded: a side the user doesn't touch keeps its stored value, also one read from a file.
+    let shown = img.crop.map(|v| v * 100.0);
+    let mut crop = shown;
     let mut changed = false;
     ui.horizontal(|ui| {
         for (k, label) in ["L", "B", "R", "T"].into_iter().enumerate() {
             ui.label(label);
-            // Applied when the drag ends, so a drag is one undo step.
-            let r = ui.add(egui::DragValue::new(&mut crop[k]).range(0.0..=45.0).speed(0.5).suffix("%"));
+            // Up to what the opposite side leaves. Applied when the drag ends: one undo step.
+            let room = (most - crop.get((k + 2) % 4).copied().unwrap_or(0.0)).max(0.0);
+            let Some(side) = crop.get_mut(k) else { continue };
+            let r = ui.add(egui::DragValue::new(side).range(0.0..=room).clamp_existing_to_range(false).speed(0.5).suffix("%"));
             changed |= r.drag_stopped() || (r.changed() && !r.dragged());
         }
     });
     if changed {
         let mut i = img.clone();
-        i.crop = crop.map(|v| v / 100.0);
+        for (stored, (now, was)) in i.crop.iter_mut().zip(crop.iter().zip(&shown)) {
+            if now != was {
+                *stored = now / 100.0;
+            }
+        }
         if i.crop != img.crop {
             out = Some(ImageAction::Update(AddedContent::Image(i)));
         }
@@ -1015,6 +1062,35 @@ mod tests {
         assert!(i.flip_v && !i.flip_h, "Flip vertical mirrors top and bottom");
     }
 
+    /// #4464: both rasters were in at one scale and a render at a new scale failed. The rasters
+    /// from the old scale must go too, or the item keeps following the pointer although the
+    /// preview gave up.
+    #[test]
+    fn failed_rerender_drops_the_rasters_from_the_earlier_scale() {
+        let ctx = egui::Context::default();
+        let texture = |name| Some(ctx.load_texture(name, egui::ColorImage::filled([1, 1], Color32::WHITE), egui::TextureOptions::LINEAR));
+        // Bytes no parser accepts: every render answers with an error.
+        let pool = || {
+            let pool = pdfcraft_render::RenderPool::new_inline(std::sync::Arc::new(b"not a pdf".to_vec()), Default::default());
+            pool.set_queue(vec![pdfcraft_render::RenderRequest { page: 0, scale: 2.0, tag: 2000, ..Default::default() }]);
+            pool
+        };
+        let mut mb = MoveBackground {
+            key: Some((0, 0, 0)),
+            renderer: Some(pool()),
+            texture: texture("background"),
+            item_renderer: Some(pool()),
+            item: texture("item"),
+            tag: Some(2000),
+            from: Some([0.0, 0.0, 10.0, 10.0]),
+            ..Default::default()
+        };
+        assert!(mb.ready(), "both rasters from the earlier scale are in");
+        assert!(!mb.receive(&ctx, 2000), "the new scale's renders fail");
+        assert!(mb.texture.is_none() && mb.item.is_none(), "no raster is left to draw the moving item from");
+        assert!(!mb.ready() && !mb.pending());
+    }
+
     /// #4245: the page counts the spacing after a line's last character too, so a line that fits
     /// only without it wraps in the saved text and must wrap in the editor.
     #[test]
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
new file mode 100644
index 0000000000..66daa6edb8
--- /dev/null
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -0,0 +1,913 @@
+//! Edit a PDF ▸ Edit text & images: boxes around the paragraphs and images already on the page.
+//! Click a paragraph to edit it in place (⌘Enter or clicking away applies and rewraps it to the
+//! box, Esc cancels); drag it to move it, or drag the handle on its left or right edge to rewrap
+//! it to a new width. Click an image to select it: drag to move, drag a corner to resize (keeping
+//! its proportions), right-click for rotate, flip, replace, save and delete; Delete removes it.
+
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
+use egui::{Color32, CornerRadius, FontFamily, FontId, Pos2, Rect, Stroke};
+use pdfcraft_engine::{Edit, ObjectKind, ObjectTarget};
+use pdfcraft_render::DocInfo;
+
+use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
+
+mod background;
+mod image;
+mod layout;
+
+pub(crate) use background::TextBackground;
+pub use image::{CropMode, ImageSelection};
+pub(crate) use image::{ImageAction, image_input, image_owns_pointer};
+#[cfg(test)]
+use image::{rotate_knob, turn_degrees};
+#[cfg(test)]
+use layout::{DARK_EDITOR_FILL, contrast};
+pub(crate) use layout::{caret_color_on, editor_fill, editor_font, install_source_fonts};
+use layout::{color32, editor_galley, editor_job, look_of, luminance, unseen};
+
+const ACCENT: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
+
+#[derive(Clone, Copy, PartialEq)]
+enum TextTarget {
+    Block(usize),
+    Added(usize),
+}
+
+/// How many faint Edit-text outlines are drawn per page per frame. CAD plots can draw
+/// ~1000 tiny images on one page; stroking all of them every frame (plus a hover query
+/// per box) stalls the UI. Past this, only the selected and hovered boxes are outlined:
+/// hit-testing still covers every image, so nothing becomes unselectable.
+const MAX_OUTLINES: usize = 250;
+
+/// A paragraph being edited.
+#[derive(Clone, Debug, PartialEq)]
+pub struct LineEditor {
+    pub selection: Option<std::ops::Range<usize>>,
+    pub font_resource: Option<String>,
+    pub page: usize,
+    pub block: usize,
+    pub text: String,
+    original: String,
+    rect: Rect,
+    /// The original PDF rectangle, in user space. It is converted again each frame so the editor
+    /// stays attached while the page is zoomed, scrolled, or rotated.
+    source_rect: [f32; 4],
+    multiline: bool,
+    source: Option<(pdfcraft_engine::TextBlock, Vec<pdfcraft_engine::TextLine>)>,
+    pub(crate) fonts: BTreeMap<String, String>,
+    /// The draft extends outside the source container; its frame follows the live draft bounds.
+    pub overflow: bool,
+    /// The initial source container width in screen pixels.
+    max_width: f32,
+    /// Current screen-space size. Recomputed from the current page transform before painting.
+    size: f32,
+    /// Take the keyboard focus on the next frame.
+    pub(crate) focus: bool,
+    /// Whether the text box had the keyboard at the end of the editor's last frame
+    /// ([`lost_focus_once`]).
+    had_focus: bool,
+    /// The Format text panel's values, and what the paragraph had (to send only changes).
+    pub look: pdfcraft_engine::AddedText,
+    look0: pdfcraft_engine::AddedText,
+    /// A standard family was picked from the font list. The family guessed from a PDF font name
+    /// (Calibri reads as Helvetica) can be the one picked, so comparing `look` with `look0` alone
+    /// would miss the choice.
+    family_chosen: bool,
+    /// Underline, line spacing (× size; 0 = the paragraph's own), character spacing (pt) and
+    /// horizontal scale (%), and what they were.
+    pub extras: Extras,
+    extras0: Extras,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Extras {
+    pub underline: bool,
+    pub line_spacing: f64,
+    pub char_spacing: f64,
+    pub scale: f64,
+}
+
+impl Default for Extras {
+    fn default() -> Self {
+        Extras { underline: false, line_spacing: 0.0, char_spacing: 0.0, scale: 100.0 }
+    }
+}
+
+impl LineEditor {
+    /// What Format text's font list shows: the chosen page font, a standard family picked
+    /// instead, or the paragraph's own font (its `/BaseFont` without the subset tag).
+    pub(crate) fn font_shown(&self, sources: &[(String, String)]) -> String {
+        if let Some(face) = self.font_resource.as_ref().and_then(|r| sources.iter().find(|(res, _)| res == r)).map(|(_, face)| face) {
+            return face.clone();
+        }
+        if self.look.family != self.look0.family || self.family_chosen {
+            return self.look.family.label().to_string();
+        }
+        let base = self.source.as_ref().map(|(block, _)| block.base_font.as_str()).unwrap_or_default();
+        // "ABCDEF+Calibri" is a subset of Calibri.
+        let name = match base.split_once('+') {
+            Some((tag, rest)) if tag.len() == 6 && tag.bytes().all(|b| b.is_ascii_uppercase()) => rest,
+            _ => base,
+        };
+        if name.is_empty() { tl!("Keep source fonts").to_string() } else { name.to_string() }
+    }
+
+    /// Back to the paragraph's own font: no page font chosen and the family it started with.
+    pub(crate) fn keep_source_font(&mut self) {
+        self.font_resource = None;
+        self.look.family = self.look0.family;
+        self.family_chosen = false;
+    }
+
+    /// A standard family picked from the font list, replacing the paragraph's font even when it
+    /// is the family the paragraph's font name reads as.
+    pub(crate) fn choose_family(&mut self, family: pdfcraft_engine::FontFamily) {
+        self.font_resource = None;
+        self.look.family = family;
+        self.family_chosen = true;
+    }
+
+    pub(crate) fn has_changes(&self) -> bool {
+        self.changes_with(&self.text)
+    }
+
+    /// Whether the paragraph with `text` in it differs from what was opened.
+    fn changes_with(&self, text: &str) -> bool {
+        text != self.original || self.look != self.look0 || self.extras != self.extras0 || self.family_chosen
+    }
+
+    /// Extra width permitted by the editor. Source containers now remain fixed.
+    pub fn growth(&self) -> Option<f32> {
+        (self.max_width > self.rect.width()).then_some(self.max_width)
+    }
+
+    /// Whether the edited text differs from the original (unsaved changes).
+    pub fn has_unsaved_text(&self) -> bool {
+        self.text != self.original
+    }
+
+    /// The formatting the panel changed.
+    pub fn style(&self) -> pdfcraft_engine::BlockStyle {
+        let (l, o) = (&self.look, &self.look0);
+        let mut style = pdfcraft_engine::BlockStyle {
+            resource: self.font_resource.clone(),
+            family: (l.family != o.family || self.family_chosen || l.bold != o.bold || l.italic != o.italic).then_some((l.family, l.bold, l.italic)),
+            size: (l.size != o.size).then_some(l.size),
+            color: (l.color != o.color).then_some(l.color),
+            align: (l.align != o.align).then_some(l.align),
+            underline: (self.extras.underline != self.extras0.underline).then_some(self.extras.underline),
+            line_spacing: (self.extras.line_spacing != self.extras0.line_spacing && self.extras.line_spacing > 0.0)
+                .then_some(self.extras.line_spacing),
+            char_spacing: (self.extras.char_spacing != self.extras0.char_spacing).then_some(self.extras.char_spacing),
+            scale: (self.extras.scale != self.extras0.scale).then_some(self.extras.scale),
+            ..Default::default()
+        };
+        if let Some(range) = &self.selection
+            && (style.family.is_some()
+                || style.resource.is_some()
+                || style.size.is_some()
+                || style.color.is_some()
+                || style.underline.is_some()
+                || style.char_spacing.is_some()
+                || style.scale.is_some())
+        {
+            style.ranges.push(pdfcraft_engine::RangeStyle {
+                range: range.clone(),
+                family: style.family.take(),
+                resource: style.resource.take(),
+                size: style.size.take(),
+                color: style.color.take(),
+                underline: style.underline.take(),
+                char_spacing: style.char_spacing.take(),
+                scale: style.scale.take(),
+            });
+        }
+        style
+    }
+
+    /// After applying formatting: the paragraph now has it.
+    pub fn applied(&mut self) {
+        self.selection = None;
+        self.font_resource = None;
+        self.family_chosen = false;
+        self.look0 = self.look.clone();
+        self.extras0 = self.extras;
+        self.original = self.text.clone();
+        self.focus = true;
+    }
+
+    /// Adopt the rewritten paragraph's current geometry before the next overlay frame.
+    pub(crate) fn refresh_source(&mut self, block: &pdfcraft_engine::TextBlock, lines: Vec<pdfcraft_engine::TextLine>) {
+        self.source_rect = block.rect.map(|v| v as f32);
+        self.multiline = block.rows.len() > 1;
+        self.source = Some((block.clone(), lines));
+        self.text = block.editor_text.clone();
+        self.original = self.text.clone();
+    }
+}
+
+/// What a drag on a paragraph box takes hold of.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Grip {
+    Move,
+    /// An edge (screen left or right), dragged to rewrap the paragraph.
+    Left,
+    Right,
+}
+
+/// A paragraph box being dragged: moved, or (from a handle on its left or right edge) resized.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct BlockDrag {
+    page: usize,
+    block: usize,
+    /// A paragraph index belongs to the document generation where the press was resolved.
+    generation: u64,
+    /// Where the drag started (screen).
+    start: Pos2,
+    grip: Grip,
+}
+
+/// How far an edge grip reaches either side of a box's edge (screen pixels).
+const EDGE_REACH: f32 = 6.0;
+/// How far outside an open paragraph's frame the pointer still means the frame (screen pixels).
+const FRAME_REACH: f32 = 4.0;
+
+/// The rewrap handles drawn on a paragraph box's left and right edges (screen).
+fn width_handles(b: Rect) -> [Rect; 2] {
+    let h = (b.height() * 0.5).clamp(14.0, 28.0);
+    [b.left(), b.right()].map(|x| Rect::from_center_size(Pos2::new(x, b.center().y), egui::vec2(7.0, h)))
+}
+
+/// The edge of `b` that `p` grabs: anywhere along its height, within reach of the line. A narrow
+/// box keeps its middle for moving.
+fn edge_at(b: Rect, p: Pos2) -> Option<Grip> {
+    if p.y < b.top() - EDGE_REACH || p.y > b.bottom() + EDGE_REACH {
+        return None;
+    }
+    let inside = EDGE_REACH.min(b.width() / 4.0);
+    let (dl, dr) = (p.x - b.left(), b.right() - p.x);
+    match (dl >= -EDGE_REACH && dl <= inside, dr >= -EDGE_REACH && dr <= inside) {
+        (true, true) if dl <= dr => Some(Grip::Left),
+        (_, true) => Some(Grip::Right),
+        (true, false) => Some(Grip::Left),
+        _ => None,
+    }
+}
+
+/// The topmost box under `p` and what it grabs there; edges only on an upright page.
+fn grab_at(boxes: &[Rect], p: Pos2, upright: bool) -> Option<(usize, Grip)> {
+    boxes.iter().enumerate().rev().find_map(|(i, b)| match upright.then(|| edge_at(*b, p)).flatten() {
+        Some(g) => Some((i, g)),
+        None => b.contains(p).then_some((i, Grip::Move)),
+    })
+}
+
+/// A paragraph's box on screen: its text rect (user space), with a little room around it.
+fn paragraph_box(xf: &PageXform, info: &DocInfo, page: usize, rect: [f64; 4]) -> Rect {
+    xf.user_rect(info, page, rect.map(|v| v as f32)).expand(2.0)
+}
+
+/// The width handles need the page upright (or upside down): on a quarter-turned page the
+/// screen's horizontal is the paragraph's vertical.
+fn has_edges(info: &DocInfo, page: usize) -> bool {
+    info.pages.get(page).is_some_and(|p| p.rotation % 180 == 0)
+}
+
+/// Whether a press at `p` takes hold of the width handle of one of the paragraphs `rects` (user
+/// space). The handle is drawn half outside the box and grabs from a little further out still,
+/// where a press is not on the box itself, so area selection must leave it to [`page_input`].
+pub(crate) fn grabs_edge(xf: &PageXform, info: &DocInfo, page: usize, mut rects: impl Iterator<Item = [f64; 4]>, p: Pos2) -> bool {
+    has_edges(info, page) && rects.any(|r| edge_at(paragraph_box(xf, info, page, r), p).is_some())
+}
+
+fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
+    let p = &info.pages[page];
+    let (a, b) = (xf.screen_to_view(r.min), xf.screen_to_view(r.max));
+    let (u, v) = (p.view_to_user(a.0, a.1), p.view_to_user(b.0, b.1));
+    [u[0].min(v[0]) as f64, u[1].min(v[1]) as f64, u[0].max(v[0]) as f64, u[1].max(v[1]) as f64]
+}
+
+/// Open `block` on `page` in the inline editor. The box's geometry and source are read from the
+/// `lines` handed in, so callers pass the document's current inventory.
+#[allow(clippy::too_many_arguments)]
+fn open_editor(
+    ui: &egui::Ui,
+    xf: &PageXform,
+    doc: &pdfcraft_engine::Document,
+    lines: &[pdfcraft_engine::TextBlock],
+    boxes: &[Rect],
+    page: usize,
+    block: usize,
+    view: &mut DocView,
+) {
+    view.pending_text_open = None;
+    let (Some(l), Some(b)) = (lines.get(block), boxes.get(block)) else { return };
+    view.image_selection = None;
+    let source_lines = doc.text_lines(page);
+    let text = l.editor_text.clone();
+    // Screen pixels per point, from the box's width.
+    let scale = (b.width() - 4.0) / ((l.rect[2] - l.rect[0]).max(1.0) as f32);
+    // How far the editor box may grow: a single-line paragraph's rewrite grows to the
+    // page's right edge, a multi-line paragraph rewraps to its own width.
+    let right = xf.rect.right().min(view.viewport_rect().right()) - 6.0;
+    let max_width = if l.rows.len() == 1 { (right - b.left()).max(b.width()) } else { b.width() };
+    view.line_editor = Some(LineEditor {
+        selection: None,
+        font_resource: None,
+        page,
+        block,
+        text: text.clone(),
+        original: text,
+        rect: *b,
+        source_rect: l.rect.map(|v| v as f32),
+        multiline: l.rows.len() > 1,
+        source: Some((l.clone(), source_lines)),
+        fonts: install_source_fonts(ui.ctx(), doc, page),
+        overflow: false,
+        max_width,
+        size: (l.size as f32 * scale).clamp(8.0, 72.0),
+        focus: true,
+        had_focus: false,
+        look: look_of(l),
+        look0: look_of(l),
+        family_chosen: false,
+        extras: Extras::default(),
+        extras0: Extras::default(),
+    });
+}
+
+/// Lines and their screen boxes for a page; hover outlines, click opens the editor. Returns
+/// `true` when the pointer was used.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn page_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    xf: &PageXform,
+    ptr: &PagePointer,
+    page: usize,
+    doc: &pdfcraft_engine::Document,
+    lines: &[pdfcraft_engine::TextBlock],
+    view: &mut DocView,
+    allow_interaction: bool,
+) -> bool {
+    let info = &doc.info;
+    if view.block_drag.is_some_and(|d| d.generation != doc.edit_generation()) {
+        view.block_drag = None;
+        return true;
+    }
+    let boxes: Vec<Rect> = lines.iter().map(|l| paragraph_box(xf, info, page, l.rect)).collect();
+    // Outlines stay on their page, like its text (#3061).
+    let painter = ui.painter().with_clip_rect(ui.clip_rect().intersect(xf.rect.expand(1.0)));
+    let active = view.line_editor.as_ref().filter(|e| e.page == page).map(|e| e.block);
+    for (i, b) in boxes.iter().enumerate() {
+        if active != Some(i) {
+            painter.rect_stroke(*b, CornerRadius::same(2), Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
+        }
+    }
+    // A box a switching click asked for opens now, once the edit queued with that click has
+    // applied and `lines`/`boxes` are the document's new inventory (#2022).
+    if allow_interaction
+        && active.is_none()
+        && let Some((open_page, key)) = view.pending_text_open.clone()
+        && open_page == page
+    {
+        // The edit may have regrouped the page: open the paragraph that was clicked, wherever it
+        // is now, and none if it was merged into another (#2516).
+        match key.find(lines, 0) {
+            Some(block) => open_editor(ui, xf, doc, lines, &boxes, page, block, view),
+            None => view.pending_text_open = None,
+        }
+    }
+    if !allow_interaction {
+        return false;
+    }
+    let upright = has_edges(info, page);
+    let draw_handles = |b: Rect| {
+        for h in width_handles(b) {
+            painter.rect(h, CornerRadius::same(2), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
+        }
+    };
+    // A drag in progress: the box follows the pointer (or the grabbed edge does); releasing applies it.
+    if let Some(d) = view.block_drag.filter(|d| d.page == page)
+        && let (Some(b), Some(l)) = (boxes.get(d.block).copied(), lines.get(d.block))
+    {
+        let p = ptr.pos.unwrap_or(d.start);
+        let dx = p.x - d.start.x;
+        let preview = match d.grip {
+            Grip::Move => b.translate(p - d.start),
+            Grip::Left => Rect::from_min_max(Pos2::new((b.left() + dx).min(b.right() - 12.0), b.min.y), b.max),
+            Grip::Right => Rect::from_min_max(b.min, Pos2::new((b.right() + dx).max(b.left() + 12.0), b.max.y)),
+        };
+        painter.rect_stroke(preview, CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+        let resizing = d.grip != Grip::Move;
+        if resizing {
+            draw_handles(preview);
+        }
+        ui.ctx().set_cursor_icon(if resizing { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::Move });
+        if resp.drag_stopped() || !ptr.any_down {
+            view.block_drag = None;
+            let (from, to) = (user_box(xf, info, page, b), user_box(xf, info, page, preview));
+            let edit = if resizing {
+                // The new width in user space: the box's change, added to the paragraph's own. A
+                // moved left side (in user space; on an upside-down page that's the screen's right
+                // edge) moves the paragraph with it.
+                let width = (l.rect[2] - l.rect[0]) + (to[2] - to[0]) - (from[2] - from[0]);
+                let shift = to[0] - from[0];
+                let style = pdfcraft_engine::BlockStyle { width: Some(width), offset: (shift != 0.0).then_some([shift, 0.0]), ..Default::default() };
+                Edit::EditTextBlock { page, block: d.block, text: l.text.clone(), style }
+            } else {
+                // Translation must keep the selected source operators. Rewriting unchanged text
+                // would also remove unrelated paragraphs that now overlap this one (#594).
+                Edit::MoveObjects {
+                    page,
+                    objects: vec![ObjectTarget { kind: ObjectKind::Text, index: d.block }],
+                    offset: [to[0] - from[0], to[1] - from[1]],
+                }
+            };
+            if preview != b {
+                view.pending_edit = Some(edit);
+            }
+        }
+        return true;
+    }
+    // Dragging a box (not while a paragraph is open for typing) moves it; from an edge, resizes it.
+    // What it grabs comes from where the button went down, not where the pointer is now: egui
+    // only calls it a drag once the pointer has moved a few pixels (or been held a moment), and a
+    // quick flick has left the edge by then.
+    if resp.drag_started()
+        && active.is_none()
+        && let Some(o) = ptr.origin
+        && let Some((block, grip)) = grab_at(&boxes, o, upright)
+    {
+        view.block_drag = Some(BlockDrag { page, block, generation: doc.edit_generation(), start: o, grip });
+        return true;
+    }
+    let Some(p) = ptr.within(xf.rect) else { return false };
+    let Some((hit, grip)) = grab_at(&boxes, p, upright) else { return false };
+    if active != Some(hit) {
+        painter.rect_stroke(boxes[hit], CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+    }
+    let on_edge = active.is_none() && grip != Grip::Move;
+    if upright && active.is_none() {
+        draw_handles(boxes[hit]);
+    }
+    // A closed paragraph moves when dragged (the four-way arrow says so; a click still opens it
+    // for typing); an edge rewraps it. The open one takes the text cursor. Only where the page
+    // shows, so the mode bar and side panels over a paragraph scrolled under them keep their own
+    // cursor (#2755).
+    if resp.contains_pointer() {
+        ui.ctx().set_cursor_icon(if on_edge {
+            egui::CursorIcon::ResizeHorizontal
+        } else if active.is_none() {
+            egui::CursorIcon::Move
+        } else {
+            egui::CursorIcon::Text
+        });
+    }
+    if resp.clicked() {
+        view.image_selection = None;
+        // A click that moves the editor to another paragraph applies the open one first, so its
+        // typed text is not dropped with the switched-away editor (#2022). A click on the open
+        // box's own frame, which the editor's overlay does not cover, keeps it open instead.
+        if let Some(open) = view.line_editor.as_ref().filter(|e| e.has_changes()) {
+            if open.page == page && open.block == hit {
+                return true;
+            }
+            if let Some(old) = view.line_editor.take() {
+                let style = old.style();
+                if old.text != old.original || style != pdfcraft_engine::BlockStyle::default() {
+                    view.applied_editor = Some(old.clone());
+                    view.pending_edit = Some(Edit::EditTextBlock { page: old.page, block: old.block, text: old.text, style });
+                }
+            }
+            // The clicked box opens next frame, from the document with that edit applied.
+            view.pending_text_open = lines.get(hit).map(|l| (page, pdfcraft_engine::BlockKey::of(l)));
+            return true;
+        }
+        open_editor(ui, xf, doc, lines, &boxes, page, hit, view);
+    }
+    true
+}
+
+/// The inline editor; returns the edit once the text is applied.
+pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -> Option<Edit> {
+    // Clicks outside the document (the Format text panel) keep the paragraph open. Where the
+    // click landed is `interact_pos`: `latest_pos` is gone on the frame a tap lifts.
+    let outside = ctx.input(|i| i.pointer.interact_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
+    let page = view.line_editor.as_ref()?.page;
+    let xf = view.page_xform(page)?;
+    let hold = view.objects.hold_editor;
+    // An OCR word is invisible text over a scan: the textless background still shows the scanned
+    // word, so the editor covers it, as the applied edit will.
+    let background_ready = view
+        .line_editor
+        .as_ref()
+        .is_some_and(|ed| view.text_background.ready(ed.page, ed.block) && !ed.source.as_ref().is_some_and(|(b, _)| b.invisible));
+    // The measured extent of this paragraph's draft: a click straight from another paragraph
+    // opens this one after the frame's measuring, which was the other one's.
+    let draft_rect = view
+        .line_editor
+        .as_ref()
+        .and_then(|ed| view.text_background.draft_rect_for(ed.page, ed.block))
+        .map(|r| xf.user_rect(info, page, r.map(|v| v as f32)));
+    // The editor draws on its page only, as the page itself does: a paragraph running past the
+    // page's edge (a converter relying on the page clip) must not cover the next page or the
+    // tool bars (#3061).
+    let viewport = view.viewport_rect();
+    let page_clip = xf.rect.intersect(viewport);
+    let ed = view.line_editor.as_mut()?;
+    if hold {
+        ed.focus = true;
+    }
+    // Reproject the source box every frame. The page may have been zoomed, scrolled or rotated
+    // while the format panel was open.
+    // A font definition becomes active at the start of the next egui pass. Keep the source
+    // raster visible until then instead of flashing an unrelated interface face.
+    if !ctx.fonts(|f| ed.fonts.values().all(|name| f.definitions().families.contains_key(&FontFamily::Name(name.clone().into())))) {
+        ctx.request_repaint();
+        return None;
+    }
+    ed.rect = xf.user_rect(info, ed.page, ed.source_rect);
+    ed.max_width = ed.rect.width();
+    let scale = (ed.rect.width() / (ed.source_rect[2] - ed.source_rect[0]).abs().max(0.01)).max(0.01);
+    ed.size = (ed.look.size as f32 * scale).clamp(1.0, 300.0);
+    // egui draws the caret at least one row of this font tall. Each row already has its source
+    // row's height, so the font stays below every row (half the region's smallest size): on a
+    // 12 pt row under a 24 pt title the caret is as tall as the row, not the title.
+    let smallest =
+        ed.source.as_ref().and_then(|(block, lines)| block.lines.iter().filter_map(|i| lines.get(*i)).map(|l| l.size as f32).reduce(f32::min));
+    let font = editor_font(&ed.look, smallest.map_or(ed.size, |s| (s * scale * 0.5).clamp(1.0, 300.0).min(ed.size)));
+    let text_color = color32(ed.look.color);
+    let block = ed.block;
+    let mut done = None;
+    let mut reveal = false;
+    let mut look = None;
+    // No fade-in: while it faded, the page's own copy of the text showed through the cover.
+    // Over the page, so only where the document shows: a paragraph scrolled under the mode bar or
+    // a side panel must leave them their pointer (#2755). It stays at its paragraph, cut off as
+    // the page is, rather than pushed back into the window.
+    egui::Area::new(egui::Id::unique("edit-text-line"))
+        .order(egui::Order::Foreground)
+        .fade_in(false)
+        .fixed_pos(Pos2::new(ed.rect.left(), ed.rect.top()))
+        .constrain_to(viewport)
+        .constrain(false)
+        .show(ctx, |ui| {
+            ui.set_clip_rect(ui.clip_rect().intersect(page_clip));
+            // The editor opens at the source size. Once text changes, show the real draft
+            // extent: single rows grow toward the page edge, paragraphs rewrap at their
+            // source width, and the visible frame grows/shrinks vertically with their rows.
+            // An OCR phrase (several stretched words on one scanned line) also grows rightwards.
+            let single_run = ed.source.as_ref().is_some_and(|(block, _)| block.rows.len() == 1 || block.invisible);
+            let width = if !ed.multiline && single_run && !ed.text.contains('\n') && ed.has_changes() {
+                let job = editor_job(ui, ed, &ed.text, scale, f32::INFINITY);
+                let natural = ui.fonts_mut(|f| f.layout_job(job)).size().x;
+                natural.max(ed.size * 0.4).min((xf.rect.right() - ed.rect.left() - 36.0 * scale).max(ed.rect.width()))
+            } else {
+                ed.rect.width().max(1.0)
+            };
+            ui.set_width(width);
+            let measured = editor_galley(ui, ed, &ed.text, scale, width);
+            ed.overflow = ed.has_changes() && (measured.rect.width() > ed.rect.width() + 1.5 || measured.rect.height() > ed.rect.height() + 1.5);
+            let visible = Rect::from_min_size(ed.rect.min, measured.rect.size().max(egui::vec2(1.0, 1.0)));
+            // Unsupported source programs use an interface fallback whose glyph advances
+            // can differ from the PDF's. Keep every visible row inside the growing frame.
+            let live = draft_rect.map_or(visible, |bounds| bounds.union(visible));
+            ui.painter().rect_stroke(live.expand(2.0), CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+            // On the frame, a press takes hold of the box (a click selects it, a drag moves it):
+            // the pointer says so there, and reads as text inside.
+            if let Some(p) = ui.input(|i| i.pointer.hover_pos())
+                && ui.clip_rect().contains(p)
+                && live.expand(2.0 + FRAME_REACH).contains(p)
+                && !live.expand(2.0).contains(p)
+            {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Move);
+            }
+            // White, unless the text is too pale to read on white (white text from a coloured
+            // banner, #913): then a dark box, with a caret that shows on it.
+            let fill = if background_ready { Color32::TRANSPARENT } else { editor_fill(text_color) };
+            // An unchanged paragraph is the page's own text: the editor draws only its frame and
+            // caret over it. Once it changes, the textless page goes under the editor's text or,
+            // until that background is ready, a cover over the entire source box, including lines
+            // the draft no longer occupies. Shrinking the text must never expose a copy. Both are
+            // decided after this frame's typing, in places kept under the editor's text.
+            let cover = ui.painter().add(egui::Shape::Noop);
+            let unchanged = !ed.has_changes();
+            egui::Frame::NONE.show(ui, |ui| {
+                // A textless PDF preview, or the page itself, keeps its real background through
+                // the transparent editor. The temporary opaque cover uses the shared caret-contrast rule.
+                ui.visuals_mut().text_cursor.stroke.color = if background_ready || unchanged {
+                    if luminance(text_color) < 0.5 { Color32::BLACK } else { Color32::WHITE }
+                } else {
+                    caret_color_on(fill)
+                };
+                let rows = 1;
+                let snapshot = ed.clone();
+                let mut layouter = |ui: &egui::Ui, text: &dyn egui::TextBuffer, wrap_width: f32| {
+                    let galley = editor_galley(ui, &snapshot, text.as_str(), scale, wrap_width);
+                    if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
+                };
+                let output = egui::TextEdit::multiline(&mut ed.text)
+                    .id(egui::Id::unique("edit-text-line-input"))
+                    .font(font.clone())
+                    .margin(egui::Margin::ZERO)
+                    .layouter(&mut layouter)
+                    .text_color(text_color)
+                    .frame(egui::Frame::NONE)
+                    .desired_width(width)
+                    .desired_rows(rows)
+                    .show(ui);
+                // The editor paints over the page with no visible label; name it for assistive tech.
+                output.response.response.clone().accessible_name(tl!("Text editing line"));
+                if ed.has_changes() {
+                    if background_ready {
+                        reveal = true;
+                    } else {
+                        ui.painter().set(cover, egui::Shape::rect_filled(ed.rect.expand(1.0).union(output.response.rect), CornerRadius::ZERO, fill));
+                    }
+                }
+                look = Some((Arc::clone(&output.galley), output.galley_pos));
+                if let Some(cursor) = output.cursor_range {
+                    let selected = cursor.as_sorted_char_range();
+                    let byte = |index| ed.text.char_indices().nth(index).map_or(ed.text.len(), |(at, _)| at);
+                    ed.selection = (!selected.is_empty()).then(|| byte(selected.start.into())..byte(selected.end.into()));
+                }
+                let r = output.response;
+                if r.changed() {
+                    // The next pass measures the updated draft with the Apply/Save rewrite.
+                    ctx.request_repaint();
+                }
+                if ed.focus {
+                    r.request_focus();
+                    ed.focus = false;
+                }
+                let lost = lost_focus_once(&r, &mut ed.had_focus);
+                let esc = ui.input(|i| i.key_pressed(egui::Key::Escape));
+                let apply = ui.input(|i| i.key_pressed(egui::Key::Enter) && i.modifiers.command);
+                if esc {
+                    done = Some(false);
+                } else if apply || (lost && !outside && !hold) {
+                    done = Some(true);
+                }
+            });
+        });
+    if reveal {
+        view.text_background.reveal();
+    }
+    if let Some((galley, pos)) = look {
+        view.text_background.remember(&xf, page, block, galley, pos, text_color);
+    }
+    match done {
+        Some(apply) => {
+            let ed = view.line_editor.take()?;
+            if !apply {
+                return None;
+            }
+            view.applied_editor = Some(ed.clone());
+            finished_edit(ed)
+        }
+        None => None,
+    }
+}
+
+/// The edit a closed paragraph editor applies, or `None` when nothing in it changed.
+pub(crate) fn finished_edit(ed: LineEditor) -> Option<Edit> {
+    let style = ed.style();
+    (ed.text != ed.original || style != pdfcraft_engine::BlockStyle::default()).then_some(Edit::EditTextBlock {
+        page: ed.page,
+        block: ed.block,
+        text: ed.text,
+        style,
+    })
+}
+
+/// Whether an editor's text box `r` lost the keyboard this frame, given whether it `had` it at
+/// the end of the editor's last frame (updated here). egui's `lost_focus` holds for a second
+/// frame as well, and an editor that judges a click away by where the click landed must judge it
+/// once, on the click's frame: on the next, a tap's position is gone (egui-winit sends
+/// `PointerGone` with every touch release) and a mouse may have moved on.
+pub(crate) fn lost_focus_once(r: &egui::Response, had: &mut bool) -> bool {
+    let has = r.has_focus();
+    std::mem::replace(had, has) && !has
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_rotate_knob_moves_below_when_there_is_no_room_above() {
+        let view = Rect::from_min_max(Pos2::new(0.0, 100.0), Pos2::new(500.0, 500.0));
+        let roomy = Rect::from_min_max(Pos2::new(100.0, 200.0), Pos2::new(200.0, 250.0));
+        assert_eq!(rotate_knob(roomy, view).0, Pos2::new(150.0, 178.0));
+        let at_top = Rect::from_min_max(Pos2::new(100.0, 100.0), Pos2::new(200.0, 150.0));
+        let (knob, stem) = rotate_knob(at_top, view);
+        assert_eq!((knob, stem), (Pos2::new(150.0, 172.0), Pos2::new(150.0, 150.0)));
+    }
+
+    #[test]
+    fn the_rotate_knob_measures_clockwise_degrees_from_straight_up() {
+        let c = Pos2::new(100.0, 100.0);
+        let at = |x: f32, y: f32| turn_degrees(c, Pos2::new(x, y), false);
+        assert!(at(100.0, 0.0).abs() < 1e-3);
+        assert!((at(200.0, 100.0) - 90.0).abs() < 1e-3, "right is a clockwise quarter");
+        assert!((at(0.0, 100.0) + 90.0).abs() < 1e-3);
+        assert!((at(100.0, 200.0).abs() - 180.0).abs() < 1e-3);
+        // Shift rounds to 15 degrees; the centre and non-finite points turn nothing.
+        assert_eq!(turn_degrees(c, Pos2::new(180.0, 50.0), true) % 15.0, 0.0);
+        assert_eq!(at(101.0, 101.0), 0.0);
+        assert_eq!(at(f32::NAN, 5.0), 0.0);
+    }
+
+    /// An app with one text document open, and an editor on its first paragraph.
+    fn preview_app() -> (crate::PdfCraftApp, LineEditor) {
+        let mut app = crate::PdfCraftApp::new();
+        let bytes = app.session.create_from_text("Preview", "Preview text").unwrap();
+        app.open_bytes("preview.pdf", None, bytes.as_ref().clone()).unwrap();
+        let doc = app.session.get(app.views[0].id).unwrap();
+        let block = doc.text_blocks(0).remove(0);
+        let ed = LineEditor {
+            selection: None,
+            font_resource: None,
+            page: 0,
+            block: 0,
+            text: block.text.clone(),
+            original: block.text.clone(),
+            rect: Rect::NOTHING,
+            source_rect: block.rect.map(|v| v as f32),
+            multiline: block.rows.len() > 1,
+            source: None,
+            fonts: BTreeMap::new(),
+            overflow: false,
+            max_width: 400.0,
+            size: block.size as f32,
+            focus: true,
+            had_focus: false,
+            look: look_of(&block),
+            look0: look_of(&block),
+            family_chosen: false,
+            extras: Extras::default(),
+            extras0: Extras::default(),
+        };
+        (app, ed)
+    }
+
+    #[test]
+    fn picking_the_family_the_font_name_reads_as_still_changes_the_font() {
+        // A Calibri paragraph reads as Helvetica; picking Helvetica from the list used to leave
+        // `look` equal to what the paragraph had, so no family change was sent and Calibri stayed.
+        let (_app, mut ed) = preview_app();
+        let family = ed.look0.family;
+        assert_eq!(ed.style().family, None, "nothing chosen yet");
+        ed.choose_family(family);
+        assert_eq!(ed.style().family, Some((family, ed.look.bold, ed.look.italic)));
+        assert!(ed.has_changes());
+        assert_eq!(ed.font_shown(&[]), family.label());
+        ed.keep_source_font();
+        assert_eq!(ed.style().family, None, "Keep source fonts withdraws the choice");
+        ed.choose_family(family);
+        ed.applied();
+        assert_eq!(ed.style().family, None, "an applied choice is the paragraph's font now");
+    }
+
+    #[test]
+    fn a_loaded_font_is_applied_to_the_paragraph_being_edited() {
+        // Loading a font used to only register it on the page: the paragraph kept its source
+        // face until the font was found again in the document-font menu (#2591).
+        let (mut app, ed) = preview_app();
+        app.views[0].line_editor = Some(ed);
+        let inter = include_bytes!("../../../../assets/fonts/Inter-Regular.ttf").to_vec();
+        app.use_files(crate::files::FilePurpose::TextFont { page: 0 }, vec![("Inter-Regular.ttf".into(), inter)]);
+        let doc = app.session.get(app.views[0].id).unwrap();
+        let lines = doc.text_lines(0);
+        assert_eq!(lines.iter().map(|l| l.text.as_str()).collect::<String>(), "Preview text");
+        assert!(lines.iter().all(|l| l.base_font == "Inter-Regular"), "{:?}", lines.iter().map(|l| &l.base_font).collect::<Vec<_>>());
+        assert!(app.views[0].line_editor.is_some(), "the paragraph stays open for editing");
+    }
+
+    #[test]
+    fn save_applies_the_paragraph_open_in_the_editor() {
+        // Save wrote the file without the paragraph still open in the editor (#3496).
+        let (mut app, mut ed) = preview_app();
+        ed.text = "Text preview".into();
+        app.views[0].line_editor = Some(ed);
+        let dir = std::env::temp_dir().join(format!("pdfcraft-ui-open-paragraph-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        app.save_override = Some(dir.join("out.pdf").to_string_lossy().into_owned());
+
+        assert!(app.save_active(crate::SaveTarget::InPlace));
+        assert!(app.views[0].line_editor.is_none());
+        let doc = app.session.get(app.views[0].id).unwrap();
+        assert_eq!(doc.text_lines(0).iter().map(|l| l.text.as_str()).collect::<String>(), "Text preview");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_refused_text_box_does_not_lose_the_open_paragraph() {
+        let (mut app, mut ed) = preview_app();
+        ed.text = "Text preview".into();
+        app.views[0].line_editor = Some(ed);
+        let draft = crate::content_ui::TextDraft {
+            page: 9,
+            index: None,
+            rect: [20.0, 20.0, 120.0, 40.0],
+            text: "Typed text".into(),
+            style: crate::content_ui::default_style(),
+            focus: true,
+        };
+        app.views[0].content.draft = Some(draft.clone());
+
+        assert!(!app.commit_typing_in(app.views[0].id));
+        assert_eq!(app.views[0].content.draft, Some(draft), "the refused text box stays open");
+        assert!(app.views[0].line_editor.is_none(), "the paragraph was applied");
+        let doc = app.session.get(app.views[0].id).unwrap();
+        assert_eq!(doc.text_lines(0).iter().map(|l| l.text.as_str()).collect::<String>(), "Text preview");
+    }
+
+    #[test]
+    fn a_refused_paragraph_stays_open_with_its_text() {
+        let (mut app, mut ed) = preview_app();
+        ed.text = "Text preview".into();
+        ed.page = 9;
+        app.views[0].line_editor = Some(ed.clone());
+
+        assert!(!app.commit_typing_in(app.views[0].id));
+        assert_eq!(app.views[0].line_editor, Some(ed), "the paragraph keeps its unsaved text");
+    }
+
+    #[test]
+    fn text_background_is_cached_without_editing_and_released_on_cancel() {
+        let (app, ed) = preview_app();
+        let doc = app.session.get(app.views[0].id).unwrap();
+        let source = doc.bytes.clone();
+        let generation = doc.edit_generation();
+        let ctx = egui::Context::default();
+        let mut background = TextBackground::default();
+        for _ in 0..100 {
+            background.prepare(&ctx, doc, Some(&ed), None, 1.0);
+            if background.ready(0, 0) {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert!(background.ready(0, 0));
+        assert!(!background.pending());
+        let texture = background.texture.as_ref().unwrap().id();
+        background.prepare(&ctx, doc, Some(&ed), None, 1.0);
+        assert_eq!(background.texture.as_ref().unwrap().id(), texture);
+        assert_eq!(doc.bytes, source);
+        assert_eq!(doc.edit_generation(), generation);
+        assert!(!doc.dirty && doc.can_undo().is_none());
+        background.prepare(&ctx, doc, None, None, 1.0);
+        assert!(background.texture.is_none() && background.renderer.is_none());
+    }
+
+    #[test]
+    fn the_editing_background_stays_sharp_on_a_zoomed_page() {
+        // While a paragraph is open, the page around it is drawn from this one raster: it is
+        // asked for at the tiling threshold, not the 2048-pixel backdrop side, which went soft
+        // beyond about 1.2x on a Retina display.
+        let (app, ed) = preview_app();
+        let doc = app.session.get(app.views[0].id).unwrap();
+        let page = &doc.info.pages[0];
+        let ctx = egui::Context::default();
+        ctx.begin_pass(egui::RawInput { max_texture_side: Some(16384), ..Default::default() });
+        let mut background = TextBackground::default();
+        background.prepare(&ctx, doc, Some(&ed), None, 8.0);
+        let expected = 8.0f32.min(crate::canvas::TILE_THRESHOLD / page.width.max(page.height));
+        assert!(expected > crate::canvas::BASE_SIDE / page.width.max(page.height), "the test page needs the larger side");
+        assert_eq!(background.tag, Some((expected * 1000.0) as u64));
+        // A GPU that can't hold such a texture caps it.
+        ctx.end_pass().textures_delta.clear();
+        ctx.begin_pass(egui::RawInput { max_texture_side: Some(2048), ..Default::default() });
+        let mut small = TextBackground::default();
+        small.prepare(&ctx, doc, Some(&ed), None, 8.0);
+        assert_eq!(small.tag, Some(((2048.0 / page.width.max(page.height)) * 1000.0) as u64));
+        ctx.end_pass().textures_delta.clear();
+    }
+
+    #[test]
+    fn pale_text_is_edited_on_a_dark_box() {
+        // #913: white text from a coloured banner was typed onto a white box and vanished.
+        for pale in [Color32::WHITE, Color32::from_rgb(0xFF, 0xFF, 0x00), Color32::from_gray(0xE0), Color32::from_rgb(0xFF, 0xA5, 0x00)] {
+            assert_eq!(editor_fill(pale), DARK_EDITOR_FILL, "{pale:?}");
+            assert!(contrast(pale, editor_fill(pale)) >= 4.5, "{pale:?} is readable");
+        }
+        // Ordinary dark or saturated text keeps the white box.
+        for dark in [Color32::BLACK, Color32::from_rgb(0x1F, 0x2A, 0x6B), Color32::from_rgb(0xC0, 0x00, 0x00), Color32::from_gray(0x60)] {
+            assert_eq!(editor_fill(dark), Color32::WHITE, "{dark:?}");
+        }
+    }
+
+    #[test]
+    fn caret_contrasts_with_its_fill() {
+        assert_eq!(caret_color_on(Color32::WHITE), Color32::BLACK);
+        assert_eq!(caret_color_on(Color32::from_rgb(0xFF, 0xFF, 0xF4)), Color32::BLACK);
+        assert_eq!(caret_color_on(Color32::BLACK), Color32::WHITE);
+        assert_eq!(caret_color_on(DARK_EDITOR_FILL), Color32::WHITE);
+    }
+}
diff --git a/crates/ui-egui/src/tools/edit_text_ui/background.rs b/crates/ui-egui/src/tools/edit_text_ui/background.rs
new file mode 100644
index 0000000000..71b2bffd31
--- /dev/null
+++ b/crates/ui-egui/src/tools/edit_text_ui/background.rs
@@ -0,0 +1,195 @@
+use super::*;
+
+/// A cached, read-only page background. The source glyphs are removed before rasterization;
+/// colour, pictures and unselected text beneath the editor remain visible.
+#[derive(Default)]
+pub(crate) struct TextBackground {
+    key: Option<(u64, usize, TextTarget)>,
+    pub(super) renderer: Option<pdfcraft_render::RenderPool>,
+    pub(super) texture: Option<egui::TextureHandle>,
+    pub(super) tag: Option<u64>,
+    received: Option<u64>,
+    draft_key: Option<(String, pdfcraft_engine::BlockStyle)>,
+    draft_rect: Option<[f64; 4]>,
+    /// This frame's place for the textless page under the open paragraph's editor. It stays
+    /// empty, so the page shows its own text, until the paragraph is changed ([`Self::reveal`]).
+    slot: Option<(egui::Painter, egui::layers::ShapeIdx, egui::Shape)>,
+    /// How the open paragraph looked in its editor last frame.
+    look: Option<EditorLook>,
+    /// An applied paragraph's last look. The page raster still has the old text until the page
+    /// is rendered again, so the textless page and this look stay up until then.
+    settling: Option<EditorLook>,
+}
+
+/// A paragraph editor's text as last drawn: its laid-out rows, where they were on the page (in
+/// the page's 0..1 coordinates), and the page's width and turn on screen then.
+struct EditorLook {
+    page: usize,
+    block: usize,
+    galley: Arc<egui::Galley>,
+    at: (f32, f32),
+    color: Color32,
+    page_width: f32,
+    rot: u16,
+}
+
+impl TextBackground {
+    pub fn pending(&self) -> bool {
+        self.renderer.is_some() && self.received != self.tag
+    }
+
+    /// The open paragraph's editor drew `galley` at `pos` this frame.
+    pub fn remember(&mut self, xf: &PageXform, page: usize, block: usize, galley: Arc<egui::Galley>, pos: Pos2, color: Color32) {
+        self.look = Some(EditorLook { page, block, galley, at: xf.screen_to_norm(pos), color, page_width: xf.rect.width(), rot: xf.rot });
+    }
+
+    /// An edit was applied. When it is the open paragraph's, its last look stays up over the
+    /// textless page until the page is rendered again; any other edit ends both.
+    pub fn committed(&mut self, edit: &Edit) {
+        let look = self.look.take().filter(|look| {
+            matches!(edit, Edit::EditTextBlock { page, block, .. } if (look.page, look.block) == (*page, *block))
+                && self.key.is_some_and(|(_, page, target)| (page, target) == (look.page, TextTarget::Block(look.block)))
+                && self.texture.is_some()
+        });
+        match look {
+            Some(look) => {
+                self.renderer = None;
+                self.settling = Some(look);
+            }
+            None => *self = Self::default(),
+        }
+    }
+
+    pub fn page_received(&mut self, page: usize) {
+        if self.settling.as_ref().is_some_and(|look| look.page == page) {
+            *self = Self::default();
+        }
+    }
+
+    pub fn prepare(
+        &mut self,
+        ctx: &egui::Context,
+        doc: &pdfcraft_engine::Document,
+        editor: Option<&LineEditor>,
+        draft: Option<&crate::content_ui::TextDraft>,
+        scale: f32,
+    ) {
+        let key = editor
+            .map(|ed| (doc.edit_generation(), ed.page, TextTarget::Block(ed.block)))
+            .or_else(|| draft.and_then(|d| d.index.map(|index| (doc.edit_generation(), d.page, TextTarget::Added(index)))));
+        self.slot = None;
+        if key.is_none() && self.settling.is_some() {
+            return;
+        }
+        if self.key != key {
+            *self = Self { key, ..Default::default() };
+            if let Some((_, page, target)) = key {
+                self.renderer = match target {
+                    TextTarget::Block(block) => doc.text_edit_preview(page, block),
+                    TextTarget::Added(index) => doc.added_text_preview(page, index),
+                }
+                .ok()
+                .map(|p| p.renderer());
+            }
+        }
+        if let Some(ed) = editor {
+            let draft_key = (ed.text.clone(), ed.style());
+            if self.draft_key.as_ref() != Some(&draft_key) {
+                self.draft_rect = doc.text_edit_layout(ed.page, ed.block, &ed.text, &draft_key.1).ok().and_then(|layout| layout.draft_rect);
+                self.draft_key = Some(draft_key);
+            }
+        }
+        let (Some((_, page, _)), Some(renderer)) = (self.key, self.renderer.as_ref()) else { return };
+        let Some(p) = doc.info.pages.get(page) else { return };
+        // One raster stands in for the page's tiles while a paragraph is open, so everything
+        // around the editor is drawn from it: at the tiling threshold it stays sharp on a Retina
+        // display up to about 2.5x on a Letter or A4 page, where the backdrop side (2048) went
+        // soft past 1.2x.
+        let max_side = ctx.input(|i| i.max_texture_side) as f32;
+        let scale = scale.min(crate::canvas::TILE_THRESHOLD.min(max_side) / p.width.max(p.height).max(1.0));
+        let tag = (scale * 1000.0) as u64;
+        if self.tag != Some(tag) {
+            renderer.set_queue(vec![pdfcraft_render::RenderRequest { page, scale, tag, ..Default::default() }]);
+            self.tag = Some(tag);
+        }
+        if let Some(out) = renderer.try_recv() {
+            if out.error.is_some() {
+                self.renderer = None;
+                self.texture = None;
+                return;
+            }
+            if out.request.tag == tag {
+                self.texture = Some(ctx.load_texture(
+                    "text-editor-background",
+                    crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba),
+                    egui::TextureOptions::LINEAR,
+                ));
+                self.received = Some(tag);
+            }
+        }
+        if self.received != Some(tag) {
+            ctx.request_repaint_after(std::time::Duration::from_millis(16));
+        }
+    }
+
+    /// The draft's measured extent, when it was measured for paragraph `block` on `page`.
+    pub fn draft_rect_for(&self, page: usize, block: usize) -> Option<[f64; 4]> {
+        self.draft_rect.filter(|_| self.key.is_some_and(|(_, p, target)| (p, target) == (page, TextTarget::Block(block))))
+    }
+
+    pub fn ready(&self, page: usize, block: usize) -> bool {
+        self.key.is_some_and(|(_, p, target)| (p, target) == (page, TextTarget::Block(block))) && self.texture.is_some()
+    }
+
+    pub fn ready_added(&self, page: usize, index: usize) -> bool {
+        self.key.is_some_and(|(_, p, target)| (p, target) == (page, TextTarget::Added(index))) && self.texture.is_some()
+    }
+
+    pub fn paint(
+        &mut self,
+        painter: &egui::Painter,
+        xf: &PageXform,
+        page: usize,
+        editor: Option<&LineEditor>,
+        draft: Option<&crate::content_ui::TextDraft>,
+    ) {
+        let for_editor = editor.is_some_and(|ed| ed.page == page && self.ready(page, ed.block));
+        // A zoom or a turn of the view since the paragraph was applied would misplace its rows:
+        // the page raster (with the old text) shows until the new one arrives instead.
+        let settled =
+            self.settling.as_ref().filter(|look| look.page == page && look.rot == xf.rot && (look.page_width - xf.rect.width()).abs() < 0.5);
+        let ready =
+            for_editor || draft.is_some_and(|d| d.page == page && d.index.is_some_and(|index| self.ready_added(page, index))) || settled.is_some();
+        if !ready {
+            return;
+        }
+        let Some(tex) = &self.texture else { return };
+        // Font metrics can underestimate the actual glyph ink. Paint the complete textless
+        // page so overhanging glyphs cannot remain outside the estimated source rectangle.
+        let painter = painter.with_clip_rect(painter.clip_rect().intersect(xf.rect));
+        if for_editor {
+            // Its place under everything drawn on the page later; the editor fills it once the
+            // paragraph changes (an unchanged paragraph looks as the page draws it).
+            let mut mesh = egui::Mesh::with_texture(tex.id());
+            for (u, v) in [(0.0, 0.0), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
+                mesh.vertices.push(egui::epaint::Vertex { pos: xf.norm_to_screen(u, v), uv: Pos2::new(u, v), color: Color32::WHITE });
+            }
+            mesh.add_triangle(0, 1, 2);
+            mesh.add_triangle(0, 2, 3);
+            let idx = painter.add(egui::Shape::Noop);
+            self.slot = Some((painter, idx, egui::Shape::mesh(mesh)));
+        } else {
+            xf.paint_image(&painter, tex.id(), 0.0, 0.0, 1.0, 1.0);
+            if let Some(look) = settled {
+                painter.galley(xf.norm_to_screen(look.at.0, look.at.1), Arc::clone(&look.galley), look.color);
+            }
+        }
+    }
+
+    /// The open paragraph has changed: show the textless page under its editor this frame.
+    pub fn reveal(&mut self) {
+        if let Some((painter, idx, shape)) = self.slot.take() {
+            painter.set(idx, shape);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/tools/edit_text_ui/image.rs b/crates/ui-egui/src/tools/edit_text_ui/image.rs
new file mode 100644
index 0000000000..9f55a7d5ed
--- /dev/null
+++ b/crates/ui-egui/src/tools/edit_text_ui/image.rs
@@ -0,0 +1,637 @@
+use super::*;
+
+/// A selected page image, and what the pointer is doing to it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ImageSelection {
+    pub page: usize,
+    pub index: usize,
+    /// Dragging: the start point and, for a corner, the opposite corner (screen).
+    drag: Option<(Pos2, Option<Pos2>)>,
+    /// Crop mode (Acrobat's crop handles): the box kept so far.
+    pub crop: Option<CropMode>,
+    /// The drag is turning the picture by its rotate handle (the `drag` start is then unused).
+    turning: bool,
+    /// A move or resize applied on release: the frame it had and the one it got, in the page's
+    /// 0..1 coordinates, while the page raster still has the picture where it was.
+    settled: Option<(Rect, Rect)>,
+}
+
+impl ImageSelection {
+    /// Cancel an in-progress text, rotation or crop drag and restore the crop it was previewing.
+    pub(crate) fn cancel_pointer_gesture(&mut self) {
+        self.drag = None;
+        self.turning = false;
+        if let Some(crop) = &mut self.crop
+            && let Some((_, _, before)) = crop.drag.take()
+        {
+            crop.keep = before;
+        }
+    }
+}
+
+/// Cropping a page image: the handles trim instead of resizing, the part that will go is
+/// dimmed, Enter or Done applies and Esc or Cancel leaves it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct CropMode {
+    /// The box to keep (user space).
+    pub keep: [f64; 4],
+    /// A drag in progress: the grip (0–3 corners, 4–7 edges, 8 the inside), where it started
+    /// and the box then.
+    drag: Option<(usize, Pos2, [f64; 4])>,
+}
+
+impl CropMode {
+    pub fn new(keep: [f64; 4]) -> Self {
+        Self { keep, drag: None }
+    }
+}
+
+/// The screen boxes of the crop's eight handles: corners, then the top, right, bottom and left
+/// edge midpoints.
+fn crop_handles(k: Rect) -> [Pos2; 8] {
+    [k.left_top(), k.right_top(), k.left_bottom(), k.right_bottom(), k.center_top(), k.right_center(), k.center_bottom(), k.left_center()]
+}
+
+/// Crop mode for the selected image `i` whose visible frame is `b` (screen). Returns `true`
+/// (the pointer and keys are the crop's while it lasts).
+#[allow(clippy::too_many_arguments)]
+fn crop_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    xf: &PageXform,
+    ptr: &PagePointer,
+    page: usize,
+    info: &DocInfo,
+    view: &mut DocView,
+    i: usize,
+    b: Rect,
+    allow_interaction: bool,
+) -> bool {
+    let painter = ui.painter();
+    let Some(mode) = view.image_selection.as_mut().and_then(|s| s.crop.as_mut()) else { return false };
+    let hover_pos = ptr.pos;
+    let keep_screen = |keep: [f64; 4]| xf.user_rect(info, page, keep.map(|v| v as f32)).intersect(b);
+    // A drag in progress moves a grip; the box stays inside the picture and at least 6 px.
+    if allow_interaction
+        && resp.drag_started()
+        && let Some(o) = ptr.origin
+    {
+        let k = keep_screen(mode.keep);
+        let grip = crop_handles(k).iter().position(|h| h.distance(o) < 8.0).or_else(|| k.contains(o).then_some(8));
+        if let Some(g) = grip {
+            mode.drag = Some((g, o, mode.keep));
+        }
+    }
+    if let Some((grip, start, at_start)) = mode.drag
+        && let Some(p) = hover_pos
+    {
+        let d = p - start;
+        let k0 = keep_screen(at_start);
+        let (mut min, mut max) = (k0.min, k0.max);
+        match grip {
+            0 => {
+                min.x += d.x;
+                min.y += d.y;
+            }
+            1 => {
+                max.x += d.x;
+                min.y += d.y;
+            }
+            2 => {
+                min.x += d.x;
+                max.y += d.y;
+            }
+            3 => {
+                max.x += d.x;
+                max.y += d.y;
+            }
+            4 => min.y += d.y,
+            5 => max.x += d.x,
+            6 => max.y += d.y,
+            7 => min.x += d.x,
+            _ => {
+                let shift = egui::vec2(d.x.clamp(b.min.x - k0.min.x, b.max.x - k0.max.x), d.y.clamp(b.min.y - k0.min.y, b.max.y - k0.max.y));
+                min += shift;
+                max += shift;
+            }
+        }
+        let (min_w, min_h) = (6.0_f32.min(b.width()), 6.0_f32.min(b.height()));
+        min.x = min.x.clamp(b.min.x, b.max.x - min_w);
+        min.y = min.y.clamp(b.min.y, b.max.y - min_h);
+        max.x = max.x.clamp(min.x + min_w, b.max.x);
+        max.y = max.y.clamp(min.y + min_h, b.max.y);
+        mode.keep = user_box(xf, info, page, Rect::from_min_max(min, max));
+        if resp.drag_stopped() || !ptr.primary_down {
+            mode.drag = None;
+        }
+    }
+    let k = keep_screen(mode.keep);
+    // What goes is dimmed; what stays keeps its frame and handles.
+    let dim = Color32::from_black_alpha(96);
+    for r in [
+        Rect::from_min_max(b.min, Pos2::new(b.max.x, k.min.y)),
+        Rect::from_min_max(Pos2::new(b.min.x, k.max.y), b.max),
+        Rect::from_min_max(Pos2::new(b.min.x, k.min.y), Pos2::new(k.min.x, k.max.y)),
+        Rect::from_min_max(Pos2::new(k.max.x, k.min.y), Pos2::new(b.max.x, k.max.y)),
+    ] {
+        if r.is_positive() {
+            painter.rect_filled(r.intersect(xf.rect), CornerRadius::ZERO, dim);
+        }
+    }
+    painter.rect_stroke(k, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+    for h in crop_handles(k) {
+        painter.rect(
+            Rect::from_center_size(h, egui::vec2(8.0, 8.0)),
+            CornerRadius::ZERO,
+            Color32::WHITE,
+            Stroke::new(1.0, ACCENT),
+            egui::StrokeKind::Middle,
+        );
+    }
+    // Done and Cancel, painted under the box (above it near the bottom of the view).
+    let font = egui::FontId::proportional(12.5);
+    let pill = |label: &str, right: f32, y: f32| -> Rect {
+        let w = painter.layout_no_wrap(label.to_string(), font.clone(), Color32::WHITE).size().x + 20.0;
+        Rect::from_min_size(Pos2::new(right - w, y), egui::vec2(w, 22.0))
+    };
+    let y = if k.max.y + 30.0 < xf.rect.max.y { k.max.y + 6.0 } else { k.min.y - 28.0 };
+    let done = pill(tl!("Done"), k.max.x, y);
+    let cancel = pill(tl!("Cancel"), done.min.x - 6.0, y);
+    let t = crate::theme::Tokens::get(ui.ctx());
+    painter.rect_filled(done, CornerRadius::same(11), ACCENT);
+    painter.text(done.center(), egui::Align2::CENTER_CENTER, tl!("Done"), font.clone(), Color32::WHITE);
+    painter.rect(cancel, CornerRadius::same(11), t.panel, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+    painter.text(cancel.center(), egui::Align2::CENTER_CENTER, tl!("Cancel"), font, t.text);
+    if let Some(p) = hover_pos {
+        let icon = if let Some(g) = crop_handles(k).iter().position(|h| h.distance(p) < 8.0) {
+            match g {
+                0 | 3 => egui::CursorIcon::ResizeNwSe,
+                1 | 2 => egui::CursorIcon::ResizeNeSw,
+                4 | 6 => egui::CursorIcon::ResizeVertical,
+                _ => egui::CursorIcon::ResizeHorizontal,
+            }
+        } else if done.contains(p) || cancel.contains(p) {
+            egui::CursorIcon::PointingHand
+        } else if k.contains(p) {
+            egui::CursorIcon::Move
+        } else {
+            egui::CursorIcon::Default
+        };
+        ui.ctx().set_cursor_icon(icon);
+    }
+    let clicked = |r: Rect| allow_interaction && resp.clicked() && hover_pos.is_some_and(|p| r.contains(p));
+    let keys = |key: egui::Key| allow_interaction && ui.input(|inp| inp.key_pressed(key)) && !ui.ctx().egui_wants_keyboard_input();
+    if clicked(done) || keys(egui::Key::Enter) {
+        let keep = mode.keep;
+        if let Some(s) = view.image_selection.as_mut() {
+            s.crop = None;
+        }
+        if keep_screen(keep) != b {
+            view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Crop(keep) });
+        }
+    } else if (clicked(cancel) || keys(egui::Key::Escape))
+        && let Some(s) = view.image_selection.as_mut()
+    {
+        s.crop = None;
+    }
+    true
+}
+
+impl ImageSelection {
+    pub(crate) fn dragging(&self) -> bool {
+        self.drag.is_some()
+    }
+}
+
+/// The page raster's picture of the box `from`, stretched into `to`, over blanks at `blank` (where
+/// the screen may still show the picture).
+fn stretched_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::TextureId, blank: &[Rect], from: Rect, to: Rect) {
+    let clipped = painter.with_clip_rect(painter.clip_rect().intersect(xf.rect));
+    for r in blank {
+        clipped.rect_filled(*r, CornerRadius::ZERO, Color32::WHITE);
+    }
+    let mut mesh = egui::Mesh::with_texture(tex);
+    for (a, b) in [
+        (from.left_top(), to.left_top()),
+        (from.right_top(), to.right_top()),
+        (from.right_bottom(), to.right_bottom()),
+        (from.left_bottom(), to.left_bottom()),
+    ] {
+        let (u, v) = xf.screen_to_norm(a);
+        mesh.vertices.push(egui::epaint::Vertex { pos: b, uv: Pos2::new(u, v), color: Color32::WHITE });
+    }
+    mesh.add_triangle(0, 1, 2);
+    mesh.add_triangle(0, 2, 3);
+    clipped.add(egui::Shape::mesh(mesh));
+}
+
+/// Once a selected corner or the rotate knob is grabbed, text under it cannot take over the gesture. The same
+/// applies after the pointer leaves the image/page while dragging.
+pub(crate) fn image_owns_pointer(ui: &egui::Ui, xf: &PageXform, ptr: &PagePointer, page: usize, info: &DocInfo, view: &DocView) -> bool {
+    let Some(selection) = view.image_selection.as_ref().filter(|s| s.page == page) else { return false };
+    if selection.drag.is_some() {
+        return true;
+    }
+    let Some(image) = view.edit_images.get(&page).and_then(|(_, images)| images.get(selection.index)) else { return false };
+    let Some(rect) = image.visible_rect else { return false };
+    let b = xf.user_rect(info, page, rect.map(|v| v as f32));
+    let p = if ptr.primary_down { ptr.origin } else { ptr.pos };
+    let knob = rotate_knob(b, ui.clip_rect()).0;
+    p.is_some_and(|p| [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom(), knob].iter().any(|c| c.distance(p) < 8.0))
+}
+
+/// What a right-click on a selected image asks for.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum ImageAction {
+    Replace(usize, usize),
+    Save(usize, usize),
+    Copy(usize, usize),
+    CopyFile(usize, usize),
+    /// Copy the picture, then remove it from the page.
+    Cut(usize, usize),
+    /// Mark the picture for redaction (applied later from Redact a PDF).
+    Redact(usize, usize),
+    /// Create a link over the picture.
+    Link(usize, usize),
+    /// Open Recognize Text for the picture's page.
+    Recognize(usize),
+}
+
+/// Where the rotate knob sits, and the edge point its stem starts from: above the middle of the
+/// top edge, or below the bottom edge when the area on screen (`view`) has no room above.
+pub(super) fn rotate_knob(b: Rect, view: Rect) -> (Pos2, Pos2) {
+    let above = b.center_top() - egui::vec2(0.0, 22.0);
+    if above.y - 6.0 >= view.top() { (above, b.center_top()) } else { (b.center_bottom() + egui::vec2(0.0, 22.0), b.center_bottom()) }
+}
+
+/// Degrees clockwise (-180..=180) that turn "straight up" from `centre` onto the pointer; `snap`
+/// rounds to steps of 15 degrees (Shift). A pointer on the centre turns nothing.
+pub(super) fn turn_degrees(centre: Pos2, pointer: Pos2, snap: bool) -> f32 {
+    let v = pointer - centre;
+    if !(v.x.is_finite() && v.y.is_finite()) || v.length() < 4.0 {
+        return 0.0;
+    }
+    // Screen y points down: up is (0, -1); clockwise is atan2(x, -y).
+    let d = v.x.atan2(-v.y).to_degrees();
+    if snap { (d / 15.0).round() * 15.0 } else { d }
+}
+
+/// Images on a page: select, move, resize, right-click. Returns `true` when the pointer was used.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn image_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    xf: &PageXform,
+    ptr: &PagePointer,
+    page: usize,
+    info: &DocInfo,
+    images: &[pdfcraft_engine::PageImage],
+    view: &mut DocView,
+    action: &mut Option<ImageAction>,
+    allow_interaction: bool,
+) -> bool {
+    let boxes: Vec<Rect> = images.iter().map(|im| im.visible_rect.map_or(Rect::NOTHING, |r| xf.user_rect(info, page, r.map(|v| v as f32)))).collect();
+    let painter = ui.painter();
+    let hover_pos = ptr.pos;
+    let image_contains = |index: usize, point: Pos2| {
+        let (x, y) = xf.screen_to_view(point);
+        let Some(p) = info.pages.get(page) else { return false };
+        let user = p.view_to_user(x, y);
+        images.get(index).is_some_and(|im| im.contains(user.map(f64::from)))
+    };
+    let selected = view.image_selection.as_ref().filter(|s| s.page == page).map(|s| s.index).filter(|i| *i < boxes.len());
+    let dragging = view.image_selection.as_ref().is_some_and(|s| s.drag.is_some());
+    // Few images: faint outlines for all of them, as before. Many: only the selected and
+    // hovered boxes, so a ~1000-image CAD page stays interactive in Edit text & images.
+    // Fully clipped placements (empty visible frames) get no outline.
+    let faint_all = boxes.len() <= MAX_OUTLINES;
+    // The picture being dragged has its frame at the pointer; its outline where it was would
+    // trail behind until the release.
+    let moving = selected.filter(|_| dragging);
+    if faint_all {
+        for (_, b) in boxes.iter().enumerate().filter(|(i, b)| b.is_positive() && moving != Some(*i)) {
+            painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
+        }
+    }
+    let hovered_box = hover_pos.and_then(|p| boxes.iter().enumerate().rposition(|(i, b)| b.is_positive() && b.contains(p) && image_contains(i, p)));
+    if !faint_all {
+        for i in selected.filter(|_| moving.is_none()).into_iter().chain(hovered_box.filter(|h| Some(*h) != selected)) {
+            if let Some(b) = boxes.get(i).filter(|b| b.is_positive()) {
+                painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
+            }
+        }
+    }
+    for i in selected.into_iter().chain(hovered_box).collect::<Vec<_>>() {
+        let Some(b) = boxes.get(i).copied().filter(|b| b.is_positive()) else { continue };
+        if selected == Some(i) {
+            // The selected frame and handles are drawn below (or the drag preview instead).
+            if !dragging {
+                painter.rect_filled(b, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
+            }
+        } else {
+            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
+        }
+    }
+    // The selected image: frame, corner handles, dragging.
+    if let Some(i) = selected.filter(|i| boxes.get(*i).is_some_and(|b| b.is_positive())) {
+        let b = boxes[i];
+        if view.image_selection.as_ref().is_some_and(|s| s.crop.is_some()) {
+            return crop_input(ui, resp, xf, ptr, page, info, view, i, b, allow_interaction);
+        }
+        let corners = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()];
+        let handles = |rect: Rect| {
+            for c in [rect.left_top(), rect.right_top(), rect.left_bottom(), rect.right_bottom()] {
+                painter.rect(
+                    Rect::from_center_size(c, egui::vec2(8.0, 8.0)),
+                    CornerRadius::ZERO,
+                    Color32::WHITE,
+                    Stroke::new(1.0, ACCENT),
+                    egui::StrokeKind::Middle,
+                );
+            }
+        };
+        // Until the page is rendered again its raster has an applied move or resize's picture
+        // where it was: it stays blanked there and drawn where it went.
+        // The whole-page raster and its tiles are replaced separately: the old frame stays blanked
+        // while anything still shows the picture there, but its pixels come from the old frame
+        // only while the whole-page raster itself is the old one. Once that is fresh it has the
+        // picture where it went, and that is where they come from.
+        let (out_of_date, raster_old, raster) = (view.page_out_of_date(page), view.page_raster_out_of_date(page), view.page_raster(page));
+        let screen = |r: Rect| Rect::from_two_pos(xf.norm_to_screen(r.min.x, r.min.y), xf.norm_to_screen(r.max.x, r.max.y));
+        // Where the screen may still show the picture from before an applied move, while the page
+        // isn't drawn again yet. Another drag keeps it blanked too.
+        let left_at = view.image_selection.as_ref().and_then(|s| s.settled).filter(|_| out_of_date).map(|(from, _)| from);
+        if let Some(s) = view.image_selection.as_mut().filter(|s| s.drag.is_none()) {
+            match (s.settled, raster) {
+                (Some((from, to)), Some(tex)) if out_of_date => {
+                    let source = if raster_old { from } else { to };
+                    stretched_picture(painter, xf, tex, &[screen(from)], screen(source), screen(to));
+                }
+                _ => s.settled = None,
+            }
+        }
+        if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
+            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+            handles(b);
+        }
+        if allow_interaction && let Some(corner) = hover_pos.and_then(|p| corners.iter().position(|c| c.distance(p) < 8.0)) {
+            ui.ctx().set_cursor_icon(if matches!(corner, 0 | 3) { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
+        }
+        // The rotate handle: a knob above the top edge, joined to it by a short stem.
+        let (knob, stem) = rotate_knob(b, ui.clip_rect());
+        if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
+            painter.line_segment([stem, knob], Stroke::new(1.0, ACCENT));
+            painter.circle(knob, 5.0, Color32::WHITE, Stroke::new(1.0, ACCENT));
+            if allow_interaction && hover_pos.is_some_and(|p| p.distance(knob) < 8.0) {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Grab);
+            }
+        }
+        if allow_interaction
+            && resp.drag_started()
+            && let Some(o) = ptr.origin
+            && o.distance(knob) < 8.0
+        {
+            if let Some(s) = view.image_selection.as_mut() {
+                s.drag = Some((o, None));
+                s.turning = true;
+            }
+        } else if allow_interaction
+            && resp.drag_started()
+            && let Some(o) = ptr.origin
+        {
+            let corner = corners.iter().position(|c| c.distance(o) < 8.0);
+            if corner.is_some() || image_contains(i, o) {
+                let opposite = corner.map(|k| corners[3 - k]);
+                if let Some(s) = view.image_selection.as_mut() {
+                    s.drag = Some((o, opposite));
+                }
+            }
+        }
+        if view.image_selection.as_ref().is_some_and(|s| s.turning) {
+            let shift = ui.input(|i| i.modifiers.shift);
+            let degrees = hover_pos.map_or(0.0, |p| turn_degrees(b.center(), p, shift));
+            // The turned outline as a preview; the engine redraws the pixels on release.
+            let centre = b.center();
+            let (sin, cos) = degrees.to_radians().sin_cos();
+            let turn = |c: Pos2| {
+                let v = c - centre;
+                centre + egui::vec2(v.x * cos - v.y * sin, v.x * sin + v.y * cos)
+            };
+            let outline = [b.left_top(), b.right_top(), b.right_bottom(), b.left_bottom()].map(turn).to_vec();
+            painter.add(egui::Shape::closed_line(outline, Stroke::new(1.5, ACCENT)));
+            let galley = painter.layout_no_wrap(format!("{degrees:.0}\u{b0}"), egui::FontId::proportional(12.0), ACCENT);
+            let label = Rect::from_center_size(turn(knob) - egui::vec2(0.0, 14.0), galley.size() + egui::vec2(8.0, 4.0));
+            painter.rect(label, CornerRadius::same(3), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
+            painter.galley(label.center() - galley.size() / 2.0, galley, ACCENT);
+            ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
+            if resp.drag_stopped() || !ptr.primary_down {
+                if let Some(s) = view.image_selection.as_mut() {
+                    s.drag = None;
+                    s.turning = false;
+                }
+                if degrees.abs() >= 0.05 {
+                    view.pending_edit =
+                        Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::RotateBy(f64::from(degrees)) });
+                }
+            }
+            return true;
+        }
+        if let Some((start, opposite)) = view.image_selection.as_ref().and_then(|s| s.drag)
+            && let Some(p) = hover_pos
+        {
+            let preview = match opposite {
+                // Resize from the opposite corner, keeping the aspect ratio.
+                Some(fixed) => {
+                    let (w0, h0) = (b.width().max(1.0), b.height().max(1.0));
+                    // Use the axis with the larger relative pointer change. Taking the maximum
+                    // absolute size freezes shrinking when the other axis hasn't moved. Measure
+                    // from the press point so grabbing a handle off-centre cannot cause a jump.
+                    let horizontal = (p.x - start.x) * (start.x - fixed.x).signum() / w0;
+                    let vertical = (p.y - start.y) * (start.y - fixed.y).signum() / h0;
+                    let delta = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+                    let k = (1.0 + delta).max(0.05);
+                    let (w, h) = (w0 * k, h0 * k);
+                    let x = if start.x < fixed.x { fixed.x - w } else { fixed.x };
+                    let y = if start.y < fixed.y { fixed.y - h } else { fixed.y };
+                    Rect::from_min_size(Pos2::new(x, y), egui::vec2(w, h))
+                }
+                None => b.translate(p - start),
+            };
+            // Move/resize the full placement by the visible frame's change. The engine
+            // transforms an isolated crop together with its image, preserving its contents.
+            let raw = images.get(i).map_or(b, |im| xf.user_rect(info, page, im.rect.map(|v| v as f32)));
+            // A zero-width or zero-height visible frame (or a degenerate ratio) keeps the
+            // placement's scale instead of producing inf/NaN.
+            let ratio = |new: f32, old: f32| if old.abs() > 1e-3 && (new / old).is_finite() { new / old } else { 1.0 };
+            let factor = egui::vec2(ratio(preview.width(), b.width()), ratio(preview.height(), b.height()));
+            let target = Rect::from_min_max(preview.min + (raw.min - b.min) * factor, preview.min + (raw.max - b.min) * factor);
+            let visible = preview.intersect(xf.rect);
+            if visible.is_positive() {
+                // The pixels follow the frame: the page raster's picture of the image, stretched
+                // into the preview over a blank where it was. Re-rendering every frame of a drag
+                // would lag; the edit renders it properly on release.
+                if preview != b
+                    && let Some(tex) = view.page_raster(page)
+                {
+                    // Its pixels: where the whole-page raster has it.
+                    let source = left_at.filter(|_| raster_old).map_or(b, screen);
+                    let blank: Vec<Rect> = left_at.map(screen).into_iter().chain(std::iter::once(b)).collect();
+                    stretched_picture(painter, xf, tex, &blank, source, preview);
+                }
+                painter.rect_filled(visible, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
+                painter.rect_stroke(visible, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+                handles(preview);
+            }
+            if resp.drag_stopped() || !ptr.primary_down {
+                if let Some(s) = view.image_selection.as_mut() {
+                    s.drag = None;
+                    let norm = |r: Rect| {
+                        let ((u0, v0), (u1, v1)) = (xf.screen_to_norm(r.min), xf.screen_to_norm(r.max));
+                        Rect::from_two_pos(Pos2::new(u0, v0), Pos2::new(u1, v1))
+                    };
+                    s.settled = (preview != b).then(|| (left_at.unwrap_or_else(|| norm(b)), norm(preview)));
+                }
+                if preview != b {
+                    view.pending_edit =
+                        Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Move(user_box(xf, info, page, target)) });
+                }
+            }
+            ui.ctx().set_cursor_icon(match opposite {
+                Some(fixed) if (start.x - fixed.x) * (start.y - fixed.y) < 0.0 => egui::CursorIcon::ResizeNeSw,
+                Some(_) => egui::CursorIcon::ResizeNwSe,
+                None => egui::CursorIcon::Move,
+            });
+            return true;
+        }
+        if allow_interaction
+            && ui.input(|inp| inp.key_pressed(egui::Key::Delete) || inp.key_pressed(egui::Key::Backspace))
+            && !ui.ctx().egui_wants_keyboard_input()
+        {
+            view.image_selection = None;
+            view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Delete });
+            return true;
+        }
+    }
+    if !allow_interaction {
+        return false;
+    }
+    // An open menu stays drawn wherever the pointer is: most of its items lie outside the picture
+    // (a logo is smaller than its menu), and a menu that is not drawn for a frame cannot be clicked.
+    // Only a menu opened by a right-click on the picture: one opened over text or empty page while
+    // a picture stays selected is the page's own menu.
+    let menu_key = resp.id.with("image-menu");
+    if resp.secondary_clicked() {
+        ui.ctx().data_mut(|d| d.insert_temp(menu_key, false));
+    }
+    let mut menu_drawn = false;
+    if let Some(sel) = selected
+        && resp.context_menu_opened()
+        && ui.ctx().data(|d| d.get_temp::<bool>(menu_key)).unwrap_or(false)
+    {
+        resp.context_menu(|ui| image_menu(ui, page, sel, images, view, action));
+        menu_drawn = true;
+    }
+    let Some(p) = hover_pos.filter(|p| xf.rect.contains(*p)) else { return false };
+    let Some(hit) = boxes.iter().enumerate().rposition(|(i, b)| b.contains(p) && image_contains(i, p)) else { return false };
+    if selected != Some(hit) {
+        painter.rect_stroke(boxes[hit], CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
+    }
+    let Some(b) = boxes.get(hit).copied() else { return false };
+    let corner = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()].iter().position(|c| c.distance(p) < 8.0);
+    ui.ctx().set_cursor_icon(match (selected == Some(hit), corner) {
+        (true, Some(0 | 3)) => egui::CursorIcon::ResizeNwSe,
+        (true, Some(_)) => egui::CursorIcon::ResizeNeSw,
+        (true, None) => egui::CursorIcon::Move,
+        _ => egui::CursorIcon::PointingHand,
+    });
+    if resp.clicked() || resp.secondary_clicked() {
+        view.image_selection = Some(ImageSelection { page, index: hit, drag: None, crop: None, turning: false, settled: None });
+    }
+    if resp.secondary_clicked() {
+        ui.ctx().data_mut(|d| d.insert_temp(menu_key, true));
+    }
+    if selected == Some(hit) && !menu_drawn {
+        resp.context_menu(|ui| image_menu(ui, page, hit, images, view, action));
+    }
+    true
+}
+
+/// The right-click menu of the picture `hit` (its rotate, flip, replace, copy, cut, redact, link,
+/// recognize and delete items).
+fn image_menu(
+    ui: &mut egui::Ui,
+    page: usize,
+    hit: usize,
+    images: &[pdfcraft_engine::PageImage],
+    view: &mut DocView,
+    action: &mut Option<ImageAction>,
+) {
+    use pdfcraft_engine::ImageEdit as E;
+    let items: [(&str, Option<E>); 4] = [
+        (tl!("Rotate Clockwise"), Some(E::Rotate(1))),
+        (tl!("Rotate Counterclockwise"), Some(E::Rotate(3))),
+        (tl!("Flip Horizontal"), Some(E::Flip { horizontal: true })),
+        (tl!("Flip Vertical"), Some(E::Flip { horizontal: false })),
+    ];
+    for (label, change) in items {
+        if ui.button(label).clicked() {
+            view.pending_edit = change.map(|c| Edit::EditPageImage { page, index: hit, change: c });
+            ui.close();
+        }
+    }
+    // Crop: the handles trim instead of resizing until Done.
+    if ui.button(tl!("Crop Image")).clicked() {
+        if let (Some(s), Some(im)) = (view.image_selection.as_mut(), images.get(hit)) {
+            s.crop = Some(CropMode::new(im.visible_rect.unwrap_or(im.rect)));
+        }
+        ui.close();
+    }
+    let cropped = images.get(hit).is_some_and(|im| im.visible_rect.is_some_and(|v| v.iter().zip(im.rect.iter()).any(|(a, b)| (a - b).abs() > 0.01)));
+    if ui.add_enabled(cropped, egui::Button::new(tl!("Remove Crop"))).clicked() {
+        if let Some(im) = images.get(hit) {
+            view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Crop(im.rect) });
+        }
+        ui.close();
+    }
+    let raster = images.get(hit).is_some_and(|image| !image.is_form);
+    if ui.add_enabled(raster, egui::Button::new(tl!("Replace Image…"))).clicked() {
+        *action = Some(ImageAction::Replace(page, hit));
+        ui.close();
+    }
+    if ui.add_enabled(raster, egui::Button::new(tl!("Save Image As…"))).clicked() {
+        *action = Some(ImageAction::Save(page, hit));
+        ui.close();
+    }
+    // Cutting and copying also find the picture inside grouped Form artwork.
+    if ui.button(tl!("Cut Image")).clicked() {
+        *action = Some(ImageAction::Cut(page, hit));
+        ui.close();
+    }
+    if ui.button(tl!("Copy Image")).clicked() {
+        *action = Some(ImageAction::Copy(page, hit));
+        ui.close();
+    }
+    if ui.button(tl!("Copy Image in Original Format")).clicked() {
+        *action = Some(ImageAction::CopyFile(page, hit));
+        ui.close();
+    }
+    ui.separator();
+    if ui.button(tl!("Redact Image")).clicked() {
+        *action = Some(ImageAction::Redact(page, hit));
+        ui.close();
+    }
+    if ui.button(tl!("Create Link…")).clicked() {
+        *action = Some(ImageAction::Link(page, hit));
+        ui.close();
+    }
+    if ui.button(tl!("Recognize Text…")).clicked() {
+        *action = Some(ImageAction::Recognize(page));
+        ui.close();
+    }
+    ui.separator();
+    if ui.button(tl!("Delete")).clicked() {
+        view.image_selection = None;
+        view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Delete });
+        ui.close();
+    }
+}
diff --git a/crates/ui-egui/src/tools/edit_text_ui/layout.rs b/crates/ui-egui/src/tools/edit_text_ui/layout.rs
new file mode 100644
index 0000000000..a59c10899c
--- /dev/null
+++ b/crates/ui-egui/src/tools/edit_text_ui/layout.rs
@@ -0,0 +1,270 @@
+use super::*;
+
+/// The look shown for a paragraph: the family and weight guessed from its PDF font name.
+fn source_look(base_font: &str, size: f64, color: [f64; 3], detected_bold: bool, detected_italic: bool) -> pdfcraft_engine::AddedText {
+    use pdfcraft_engine::FontFamily as F;
+    let name = base_font.to_ascii_lowercase();
+    let family = if ["courier", "mono", "consolas", "menlo", "monaco", "lucida console"].iter().any(|s| name.contains(s)) {
+        F::Courier
+    } else if !name.contains("sans") && ["times", "serif", "roman", "cambria", "georgia", "palatino", "garamond"].iter().any(|s| name.contains(s)) {
+        F::Times
+    } else {
+        F::Helvetica
+    };
+    pdfcraft_engine::AddedText {
+        family,
+        bold: detected_bold || ["bold", "black", "heavy", "semibold", "demi"].iter().any(|s| name.contains(s)),
+        italic: detected_italic || ["italic", "oblique", "slanted"].iter().any(|s| name.contains(s)),
+        size: (size * 10.0).round() / 10.0,
+        color,
+        ..Default::default()
+    }
+}
+
+pub(super) fn look_of(b: &pdfcraft_engine::TextBlock) -> pdfcraft_engine::AddedText {
+    source_look(&b.base_font, b.size, b.color, b.bold, b.italic)
+}
+
+pub(crate) fn editor_font(look: &pdfcraft_engine::AddedText, size: f32) -> FontId {
+    let family = match (look.family, look.bold) {
+        (pdfcraft_engine::FontFamily::Courier, _) => FontFamily::Monospace,
+        (_, true) => FontFamily::Name("semibold".into()),
+        (_, false) => FontFamily::Proportional,
+    };
+    FontId::new(size, family)
+}
+
+pub(super) fn color32(color: [f64; 3]) -> Color32 {
+    Color32::from_rgb(
+        (color[0].clamp(0.0, 1.0) * 255.0).round() as u8,
+        (color[1].clamp(0.0, 1.0) * 255.0).round() as u8,
+        (color[2].clamp(0.0, 1.0) * 255.0).round() as u8,
+    )
+}
+
+/// The dark box behind text too pale to read on white.
+pub(super) const DARK_EDITOR_FILL: Color32 = Color32::from_gray(0x26);
+
+/// WCAG relative luminance of an sRGB colour.
+pub(super) fn luminance(c: Color32) -> f32 {
+    let channel = |v: u8| {
+        let v = f32::from(v) / 255.0;
+        if v <= 0.040_45 { v / 12.92 } else { ((v + 0.055) / 1.055).powf(2.4) }
+    };
+    0.2126 * channel(c.r()) + 0.7152 * channel(c.g()) + 0.0722 * channel(c.b())
+}
+
+/// WCAG contrast ratio between two colours (1 to 21).
+pub(super) fn contrast(a: Color32, b: Color32) -> f32 {
+    let (la, lb) = (luminance(a), luminance(b));
+    (la.max(lb) + 0.05) / (la.min(lb) + 0.05)
+}
+
+/// The inline editor's background for text drawn in `text`: white, or a dark box when the text
+/// reads better on that (white or pale text, which would vanish on white).
+pub(crate) fn editor_fill(text: Color32) -> Color32 {
+    if contrast(text, Color32::WHITE) >= contrast(text, DARK_EDITOR_FILL) { Color32::WHITE } else { DARK_EDITOR_FILL }
+}
+
+/// One TextEdit lays out all source runs; its caret and selection span the whole region.
+pub(crate) fn install_source_fonts(ctx: &egui::Context, doc: &pdfcraft_engine::Document, page: usize) -> BTreeMap<String, String> {
+    let programs = doc.text_editor_fonts(page);
+    let mut definitions = ctx.fonts(|f| f.definitions().clone());
+    // Only the current editor's document fonts live in the atlas. Never accumulate the
+    // programs of previously opened files or add them to the interface's default families.
+    definitions.font_data.retain(|name, _| !name.starts_with("pdf-source-"));
+    definitions.families.retain(|family, _| !matches!(family, FontFamily::Name(name) if name.starts_with("pdf-source-")));
+    let mut families = BTreeMap::new();
+    for (index, program) in programs.iter().enumerate() {
+        let name = format!("pdf-source-{index}");
+        definitions.font_data.insert(name.clone(), Arc::new(egui::FontData::from_owned(program.bytes.clone())));
+        families.insert(program.resource.clone(), name);
+    }
+    for program in &programs {
+        let Some(name) = families.get(&program.resource) else { continue };
+        // Word-created PDFs often split one face into several subsets. Use all of the
+        // document's matching subsets before falling back for newly inserted characters.
+        let mut stack = vec![name.clone()];
+        stack.extend(
+            programs
+                .iter()
+                .filter(|p| {
+                    pdfcraft_fonts::embedding::face_key(&p.face) == pdfcraft_fonts::embedding::face_key(&program.face)
+                        && p.resource != program.resource
+                })
+                .filter_map(|p| families.get(&p.resource).cloned()),
+        );
+        if let Some(fallback) = definitions.families.get(&FontFamily::Proportional) {
+            stack.extend(fallback.iter().cloned());
+        }
+        definitions.families.insert(FontFamily::Name(name.clone().into()), stack);
+    }
+    if !families.is_empty() {
+        ctx.set_fonts(definitions);
+    }
+    families
+}
+
+pub(super) fn editor_job(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width: f32) -> egui::text::LayoutJob {
+    let mut job = egui::text::LayoutJob::default();
+    // An unchanged PDF row already has an authoritative line break. Do not rewrap it
+    // because font rounding or a fallback face measures a fraction of a pixel wider.
+    job.wrap.max_width = if text == ed.original && ed.look == ed.look0 && ed.extras == ed.extras0 { f32::INFINITY } else { width };
+    if let Some((block, lines)) = &ed.source {
+        let lefts: Vec<_> = block.rows.iter().filter_map(|r| r.first().and_then(|i| lines.get(*i)).map(|l| l.rect[0])).collect();
+        let left_span = lefts.iter().copied().fold(f64::NEG_INFINITY, f64::max) - lefts.iter().copied().fold(f64::INFINITY, f64::min);
+        let centered = block.rows.len() > 1
+            && left_span > block.size * 0.5
+            && block.rows.iter().all(|row| {
+                let rect = row
+                    .iter()
+                    .filter_map(|i| lines.get(*i))
+                    .map(|l| l.rect)
+                    .reduce(|a, b| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])]);
+                rect.is_some_and(|r| ((r[0] + r[2] - block.rect[0] - block.rect[2]) / 2.0).abs() < block.size)
+            });
+        if centered {
+            job.halign = egui::Align::Center;
+        }
+        for (range, index) in block.edited_spans(text) {
+            let Some(line) = lines.get(index) else { continue };
+            let mut look = source_look(&line.base_font, line.size, line.color, line.bold, line.italic);
+            look.size = line.size;
+            if ed.look.family != ed.look0.family || ed.family_chosen {
+                look.family = ed.look.family;
+            }
+            if ed.look.bold != ed.look0.bold {
+                look.bold = ed.look.bold;
+            }
+            if ed.look.italic != ed.look0.italic {
+                look.italic = ed.look.italic;
+            }
+            if ed.look.color != ed.look0.color {
+                look.color = ed.look.color;
+            }
+            if ed.look.size != ed.look0.size {
+                look.size = ed.look.size;
+            }
+            let mut font = editor_font(&look, (look.size as f32 * scale).clamp(1.0, 300.0));
+            let original_face =
+                ed.look.family == ed.look0.family && !ed.family_chosen && ed.look.bold == ed.look0.bold && ed.look.italic == ed.look0.italic;
+            let embedded = original_face && ed.fonts.contains_key(&line.font);
+            if embedded && let Some(name) = ed.fonts.get(&line.font) {
+                font.family = FontFamily::Name(name.clone().into());
+            }
+            let native_width = ui.fonts_mut(|f| f.layout_no_wrap(line.text.clone(), font.clone(), Color32::BLACK).size().x);
+            let target_width = ((line.rect[2] - line.rect[0]) * look.size / line.size.max(0.01)) as f32 * scale;
+            let spacing = if original_face { (target_width - native_width) / line.text.chars().count().saturating_sub(1).max(1) as f32 } else { 0.0 };
+            job.append(
+                text.get(range).unwrap_or_default(),
+                0.0,
+                egui::TextFormat {
+                    font_id: font,
+                    extra_letter_spacing: spacing + ed.extras.char_spacing as f32 * scale,
+                    color: color32(look.color),
+                    italics: look.italic && !embedded,
+                    ..Default::default()
+                },
+            );
+        }
+    } else {
+        job.append(
+            text,
+            0.0,
+            egui::TextFormat {
+                font_id: editor_font(&ed.look, ed.size),
+                color: color32(ed.look.color),
+                italics: ed.look.italic,
+                ..Default::default()
+            },
+        );
+    }
+    job
+}
+
+/// `galley` drawn in no colour: its rows still place the caret and the selection.
+pub(super) fn unseen(mut galley: Arc<egui::Galley>) -> Arc<egui::Galley> {
+    for placed in &mut Arc::make_mut(&mut galley).rows {
+        for vertex in &mut Arc::make_mut(&mut placed.row).visuals.mesh.vertices {
+            vertex.color = Color32::TRANSPARENT;
+        }
+    }
+    galley
+}
+
+/// Align the editable galley's baselines to the source rows instead of egui's interface
+/// leading. Glyphs, meshes, caret and selection receive the same transform.
+pub(super) fn editor_galley(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width: f32) -> Arc<egui::Galley> {
+    let mut job = editor_job(ui, ed, text, scale, width);
+    let centered = job.halign == egui::Align::Center;
+    job.halign = egui::Align::LEFT;
+    let mut galley = ui.fonts_mut(|fonts| fonts.layout_job(job));
+    let Some((block, lines)) = &ed.source else { return galley };
+    let sources: Vec<_> = block
+        .rows
+        .iter()
+        .filter_map(|row| {
+            let first = row.first().and_then(|i| lines.get(*i))?;
+            let rect = row
+                .iter()
+                .filter_map(|i| lines.get(*i))
+                .map(|l| l.rect)
+                .reduce(|a, b| [a[0].min(b[0]), a[1].min(b[1]), a[2].max(b[2]), a[3].max(b[3])])?;
+            Some((first.baseline()[1], rect))
+        })
+        .collect();
+    let Some((first_baseline, first_rect)) = sources.first().copied() else { return galley };
+    let leading = if ed.extras.line_spacing > 0.0 {
+        ed.extras.line_spacing * ed.look.size
+    } else {
+        let fallback = if block.lines.len() == 1 && !text.contains('\n') {
+            block.lines.first().and_then(|i| lines.get(*i)).map_or(block.size * 1.2, |line| line.wrap_leading())
+        } else {
+            block.size * 1.5
+        };
+        sources.windows(2).map(|r| (r[0].0 - r[1].0).abs()).rfind(|v| *v > 0.0).unwrap_or(fallback)
+    };
+    let g = Arc::make_mut(&mut galley);
+    let mut bounds = Rect::NOTHING;
+    let mut meshes = Rect::NOTHING;
+    for (index, placed) in g.rows.iter_mut().enumerate() {
+        let (last_baseline, last_rect) = sources.last().copied().unwrap_or((first_baseline, first_rect));
+        let (baseline, source_rect) = sources
+            .get(index)
+            .copied()
+            .unwrap_or((last_baseline - index.saturating_add(1).saturating_sub(sources.len()) as f64 * leading, last_rect));
+        let changed_size = ed.look.size != ed.look0.size;
+        let ratio = if changed_size { ed.look.size / ed.look0.size.max(0.01) } else { 1.0 };
+        let ascent = (source_rect[3] - sources.get(index).map_or(last_baseline, |s| s.0)) as f32 * scale * ratio as f32;
+        let descent = (sources.get(index).map_or(last_baseline, |s| s.0) - source_rect[1]) as f32 * scale * ratio as f32;
+        let base_y = (block.rect[3] - baseline) as f32 * scale;
+        let row = Arc::make_mut(&mut placed.row);
+        placed.pos.y = base_y - ascent;
+        placed.pos.x = if centered { (width - row.size.x) / 2.0 } else { (source_rect[0] - block.rect[0]) as f32 * scale };
+        for glyph in &mut row.glyphs {
+            let dy = ascent - glyph.pos.y;
+            glyph.pos.y = ascent;
+            glyph.font_ascent = ascent;
+            glyph.font_height = ascent + descent;
+            glyph.line_height = ascent + descent;
+            if !glyph.uv_rect.is_nothing() {
+                for vertex in row.visuals.mesh.vertices.iter_mut().skip(glyph.first_vertex as usize).take(4) {
+                    vertex.pos.y += dy;
+                }
+            }
+        }
+        row.size.y = (ascent + descent).max(1.0);
+        row.visuals.mesh_bounds = row.visuals.mesh.vertices.iter().fold(Rect::NOTHING, |r, v| r.union(Rect::from_min_max(v.pos, v.pos)));
+        bounds = bounds.union(Rect::from_min_size(placed.pos, row.size));
+        meshes = meshes.union(row.visuals.mesh_bounds.translate(placed.pos.to_vec2()));
+    }
+    g.rect = Rect::from_min_max(egui::Pos2::ZERO, egui::pos2(bounds.right().max(0.0), bounds.bottom().max(0.0)));
+    g.mesh_bounds = meshes;
+    galley
+}
+
+/// Caret colour that stays visible on a field filled with `fill`: black on light fills, white on dark ones.
+pub(crate) fn caret_color_on(fill: Color32) -> Color32 {
+    let luma = 299 * u32::from(fill.r()) + 587 * u32::from(fill.g()) + 114 * u32::from(fill.b());
+    if luma > 127_500 { Color32::BLACK } else { Color32::WHITE }
+}
diff --git a/crates/ui-egui/src/field_table_ui.rs b/crates/ui-egui/src/tools/field_table_ui.rs
similarity index 84%
rename from crates/ui-egui/src/field_table_ui.rs
rename to crates/ui-egui/src/tools/field_table_ui.rs
index 9314dc927d..6dacf67a65 100644
--- a/crates/ui-egui/src/field_table_ui.rs
+++ b/crates/ui-egui/src/tools/field_table_ui.rs
@@ -159,7 +159,7 @@ pub(crate) fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let mut choice = None;
     let mut laid = None;
     egui::Window::new(tl!("Text Field Table"))
-        .id(egui::Id::new("field_table_window"))
+        .id(egui::Id::unique("field_table_window"))
         .open(&mut open)
         .collapsible(false)
         .resizable(false)
@@ -255,15 +255,20 @@ fn body(ui: &mut egui::Ui, d: &mut FieldTableDraft, info: &PageInfo, form: &[For
         for (c, column) in d.table.columns.iter_mut().enumerate() {
             let width = layout.cells.as_ref().ok().and_then(|cells| cells.get(c)).map(|cell| cell.rect[2] - cell.rect[0]);
             let share = shares.get(c).copied().unwrap_or_default();
+            let mut column_label_response = None;
             ui.horizontal(|ui| {
-                ui.label(RichText::new(column_label(c)).strong());
+                let label = ui.label(RichText::new(column_label(c)).strong());
+                column_label_response = Some(label.id);
                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                     let size = width.map_or_else(|| "—".to_owned(), |w| format!("{w:.1} pt · {:.0}%", share * 100.0));
                     ui.label(RichText::new(size).color(t.text_muted).size(11.0));
                 });
             });
             let full = ui.available_width();
-            ui.add(widgets::line(&mut column.pattern).desired_width(full).id_salt(("field table column", c)));
+            let pattern = ui.add(widgets::line(&mut column.pattern).desired_width(full).id_salt(("field table column", c)));
+            if let Some(label) = column_label_response {
+                pattern.labelled_by(label);
+            }
             ui.add_space(4.0);
         }
     };
@@ -342,14 +347,40 @@ fn column_bar(ui: &mut egui::Ui, d: &mut FieldTableDraft, t: &theme::Tokens) {
             })
             .collect()
     };
+    let n = d.table.columns.len();
+    let ends = edges(&d.shares());
+    let active = column_dividers(ui, d, bar, &ends);
+
+    let painter = ui.painter_at(bar);
+    // Input may have resized a pair; paint the shares after handling it.
+    let shares = d.shares();
+    let mut left = bar.left();
+    for (c, (&right, share)) in edges(&shares).iter().zip(&shares).enumerate() {
+        // The last column ends at the bar's edge, whatever rounding says.
+        let right = if c + 1 == n { bar.right() } else { right.min(bar.right()) };
+        let column = Rect::from_min_max(pos2(left, bar.top()), pos2(right, bar.bottom()));
+        painter.rect_filled(column, CornerRadius::ZERO, SELECT_BLUE.gamma_multiply(if c % 2 == 0 { 0.11 } else { 0.055 }));
+        if column.width() > 32.0 {
+            painter.text(column.center(), egui::Align2::CENTER_CENTER, format!("{:.0}%", share * 100.0), theme::medium(11.0), t.text);
+        }
+        left = right;
+    }
+    painter.rect_stroke(bar, CornerRadius::same(3), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+    for (i, &x) in edges(&shares).iter().enumerate().take(n.saturating_sub(1)) {
+        let stroke = if active == Some(i) { Stroke::new(3.0, SELECT_BLUE) } else { Stroke::new(1.5, t.border) };
+        painter.line_segment([pos2(x, bar.top() + 1.0), pos2(x, bar.bottom() - 1.0)], stroke);
+    }
+}
+
+/// Handle input at the pre-interaction edges and return the hovered, dragged or focused divider.
+fn column_dividers(ui: &mut egui::Ui, d: &mut FieldTableDraft, bar: Rect, ends: &[f32]) -> Option<usize> {
     let n = d.table.columns.len();
     // Wide enough to grab, never reaching past the middle of a column.
     let reach = (bar.width() / n.max(1) as f32 / 2.0).clamp(2.0, 8.0);
     let mut active = None;
-    let ends = edges(&d.shares());
     for (i, &x) in ends.iter().enumerate().take(n.saturating_sub(1)) {
         let hit = Rect::from_min_max(pos2(x - reach, bar.top()), pos2(x + reach, bar.bottom()));
-        let resp = ui.interact(hit, ui.id().with(("field table divider", i)), Sense::click_and_drag());
+        let resp = ui.interact(hit, ui.scope_id().with(("field table divider", i)), Sense::click_and_drag());
         let share = d.shares().get(i).copied().unwrap_or_default();
         resp.widget_info(|| egui::WidgetInfo::slider(true, (share * 100.0).round(), column_label(i)));
         let mut delta = f64::from(resp.drag_delta().x) / f64::from(bar.width());
@@ -374,24 +405,7 @@ fn column_bar(ui: &mut egui::Ui, d: &mut FieldTableDraft, t: &theme::Tokens) {
         }
     }
 
-    let painter = ui.painter_at(bar);
-    let shares = d.shares();
-    let mut left = bar.left();
-    for (c, (&right, share)) in edges(&shares).iter().zip(&shares).enumerate() {
-        // The last column ends at the bar's edge, whatever rounding says.
-        let right = if c + 1 == n { bar.right() } else { right.min(bar.right()) };
-        let column = Rect::from_min_max(pos2(left, bar.top()), pos2(right, bar.bottom()));
-        painter.rect_filled(column, CornerRadius::ZERO, SELECT_BLUE.gamma_multiply(if c % 2 == 0 { 0.11 } else { 0.055 }));
-        if column.width() > 32.0 {
-            painter.text(column.center(), egui::Align2::CENTER_CENTER, format!("{:.0}%", share * 100.0), theme::medium(11.0), t.text);
-        }
-        left = right;
-    }
-    painter.rect_stroke(bar, CornerRadius::same(3), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-    for (i, &x) in edges(&shares).iter().enumerate().take(n.saturating_sub(1)) {
-        let stroke = if active == Some(i) { Stroke::new(3.0, SELECT_BLUE) } else { Stroke::new(1.5, t.border) };
-        painter.line_segment([pos2(x, bar.top() + 1.0), pos2(x, bar.bottom() - 1.0)], stroke);
-    }
+    active
 }
 
 /// The table being set up, on its page: each cell with its name, or the table's outline in red
@@ -401,7 +415,7 @@ pub(crate) fn paint_preview(painter: &egui::Painter, xf: &PageXform, page: usize
     if preview.page != page {
         return;
     }
-    let zoom = (xf.rect.width() / xf.pw.max(1.0)).clamp(0.5, 3.0);
+    let zoom = xf.zoom().clamp(0.5, 3.0);
     let font = theme::regular((9.0 * zoom).clamp(7.0, 13.0));
     let on_screen = |r: [f64; 4]| xf.view_rect([r[0] as f32, r[1] as f32, r[2] as f32, r[3] as f32]);
     let outline = on_screen(preview.laid.table.rect);
@@ -448,6 +462,62 @@ mod tests {
         d
     }
 
+    fn bar_frame(ctx: &egui::Context, d: &mut FieldTableDraft, key: Option<egui::Key>, focus: Option<usize>) -> egui::FullOutput {
+        let events = key
+            .into_iter()
+            .flat_map(|key| {
+                [true, false].map(|pressed| egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: egui::Modifiers::NONE })
+            })
+            .collect();
+        ctx.run_ui(
+            egui::RawInput { screen_rect: Some(Rect::from_min_size(egui::Pos2::ZERO, vec2(400.0, 160.0))), events, ..Default::default() },
+            |ui| {
+                let other = ui.button("Other control");
+                if let Some(i) = focus {
+                    ui.memory_mut(|memory| memory.request_focus(ui.scope_id().with(("field table divider", i))));
+                } else {
+                    other.request_focus();
+                }
+                column_bar(ui, d, &theme::Tokens::get(ctx));
+            },
+        )
+    }
+
+    #[test]
+    fn arrow_keys_resize_only_the_focused_pair_and_paint_its_new_widths() {
+        for columns in [3, 30] {
+            let ctx = egui::Context::default();
+            ctx.set_fonts(theme::font_definitions());
+            let mut d = draft(columns);
+            let before: Vec<f64> = d.table.columns.iter().map(|c| c.width).collect();
+            let total: f64 = before.iter().sum();
+            bar_frame(&ctx, &mut d, None, Some(0)).drop_without_applying_deltas();
+            let output = bar_frame(&ctx, &mut d, Some(egui::Key::ArrowRight), Some(0));
+            assert!((d.table.columns[0].width - before[0] - total * 0.01).abs() < 1e-9);
+            assert!((d.table.columns[1].width - before[1] + total * 0.01).abs() < 1e-9);
+            assert_eq!(d.table.columns.iter().skip(2).map(|c| c.width).collect::<Vec<_>>(), before[2..]);
+            let painted: Vec<Rect> = output
+                .shapes
+                .iter()
+                .filter_map(|shape| match &shape.shape {
+                    egui::Shape::Rect(r) if r.fill == SELECT_BLUE.gamma_multiply(0.11) || r.fill == SELECT_BLUE.gamma_multiply(0.055) => Some(r.rect),
+                    _ => None,
+                })
+                .collect();
+            assert_eq!(painted.len(), columns);
+            let width: f32 = painted.iter().map(Rect::width).sum();
+            assert!((f64::from(painted[0].width() / width) - d.shares()[0]).abs() < 1e-6, "paint the changed shares in the same frame");
+            output.drop_without_applying_deltas();
+            bar_frame(&ctx, &mut d, Some(egui::Key::ArrowLeft), Some(0)).drop_without_applying_deltas();
+            assert!(d.table.columns.iter().zip(&before).all(|(c, w)| (c.width - w).abs() < 1e-9), "left reverses right on the focused divider");
+            bar_frame(&ctx, &mut d, Some(egui::Key::ArrowRight), None).drop_without_applying_deltas();
+            assert!(
+                d.table.columns.iter().zip(&before).all(|(c, w)| (c.width - w).abs() < 1e-9),
+                "arrows on another control leave the columns alone"
+            );
+        }
+    }
+
     /// Thirty even columns leave each pair less than twice the least share a divider keeps: the
     /// two bounds crossed, and `f64::clamp` panicked on the first drag.
     #[test]
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/tools/fill_sign.rs
similarity index 71%
rename from crates/ui-egui/src/fill_sign.rs
rename to crates/ui-egui/src/tools/fill_sign.rs
index 64c8ee0d40..3bf9b3326a 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/tools/fill_sign.rs
@@ -9,8 +9,14 @@ use pdfcraft_engine::{Edit, FillMark, NewAnnotation, PhotoRect, Shape, Signature
 use pdfcraft_render::{DocInfo, PageInfo};
 
 use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
 use crate::theme::Tokens;
 
+mod scan;
+
+pub use scan::ScanDraft;
+use scan::scan_tab;
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum FillTool {
     Text,
@@ -146,203 +152,6 @@ impl SigDraft {
     }
 }
 
-/// The Scan tab's photo, the frame around the signature and how strongly faint ink is picked up.
-#[derive(Clone, Debug, PartialEq)]
-pub struct ScanDraft {
-    pub photo: SignaturePhoto,
-    pub frame: PhotoRect,
-    pub sensitivity: u8,
-    /// Changes whenever the photo's pixels do (a new photo or a turn), to refresh its texture.
-    version: u64,
-    drag: Option<FrameDrag>,
-    /// The draft's image is the full-resolution result, not a quick preview.
-    full: bool,
-    /// Why the frame gives no signature, shown in place of the preview.
-    pub problem: Option<String>,
-    /// Scans run here while the frame or slider moves, so a frame never waits for one.
-    worker: ScanWorker,
-}
-
-/// What one scan cleans: the frame and sensitivity at the time it was asked for.
-#[derive(Clone, Copy, Debug, PartialEq)]
-struct ScanRequest {
-    frame: PhotoRect,
-    sensitivity: u8,
-    full: bool,
-}
-
-type ScanAnswer = Result<Result<SignatureImage, ScanError>, String>;
-
-/// The scan running on a worker thread (desktop) and the newest request made meanwhile, which
-/// starts when it answers; requests in between are skipped. It is not part of the draft's value:
-/// a clone has nothing running and comparisons ignore it.
-#[derive(Default)]
-struct ScanWorker {
-    running: Option<(ScanRequest, std::sync::mpsc::Receiver<ScanAnswer>)>,
-    queued: Option<ScanRequest>,
-}
-
-impl Clone for ScanWorker {
-    fn clone(&self) -> Self {
-        Self::default()
-    }
-}
-
-impl PartialEq for ScanWorker {
-    fn eq(&self, _: &Self) -> bool {
-        true
-    }
-}
-
-impl std::fmt::Debug for ScanWorker {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ScanWorker").field("running", &self.running.as_ref().map(|(r, _)| r)).field("queued", &self.queued).finish()
-    }
-}
-
-/// A drag on the photo, in photo pixels.
-#[derive(Clone, Copy, Debug, PartialEq)]
-enum FrameDrag {
-    /// Moving the frame, grabbed at this offset from its top-left corner.
-    Move([f32; 2]),
-    /// Drawing a new frame or resizing from a corner, with the opposite corner fixed here.
-    Span([f32; 2]),
-}
-
-fn next_photo_version() -> u64 {
-    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
-    NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
-}
-
-impl ScanDraft {
-    /// Frame the signature (turning a sideways one upright) with the default sensitivity.
-    pub fn new(mut photo: SignaturePhoto) -> Self {
-        let frame = photo.auto_frame();
-        Self {
-            photo,
-            frame,
-            sensitivity: DEFAULT_SENSITIVITY,
-            version: next_photo_version(),
-            drag: None,
-            full: false,
-            problem: None,
-            worker: ScanWorker::default(),
-        }
-    }
-
-    fn request(&self, full: bool) -> ScanRequest {
-        ScanRequest { frame: self.frame, sensitivity: self.sensitivity, full }
-    }
-
-    fn run(photo: &SignaturePhoto, req: ScanRequest) -> ScanAnswer {
-        let max_side = if req.full { SCAN_MAX_SIDE } else { PREVIEW_MAX_SIDE };
-        pdfcraft_engine::guard(|| photo.scan(req.frame, req.sensitivity, max_side))
-    }
-
-    /// Clean the framed area into `image` now: quickly (`full` false) while something is being
-    /// dragged, at full resolution otherwise. A scan still running in the background is dropped.
-    pub fn rescan(&mut self, image: &mut Option<SignatureImage>, full: bool) {
-        self.worker = ScanWorker::default();
-        let req = self.request(full);
-        let answer = Self::run(&self.photo, req);
-        self.apply(image, req, answer);
-    }
-
-    /// Like [`Self::rescan`], but on a worker thread on desktop, so the frame that asked doesn't
-    /// wait (a scan of a large frame takes a noticeable fraction of a second). The draft isn't
-    /// ready until the answer for the current frame and sensitivity arrives; [`Self::poll`]
-    /// picks it up. Where threads are unavailable (the web) it scans at once.
-    pub fn rescan_in_background(&mut self, image: &mut Option<SignatureImage>, full: bool, ctx: Option<&egui::Context>) {
-        if cfg!(target_arch = "wasm32") {
-            return self.rescan(image, full);
-        }
-        let req = self.request(full);
-        self.full = false;
-        if self.worker.running.is_some() {
-            self.worker.queued = Some(req);
-        } else if !self.start(req, ctx) {
-            self.rescan(image, full);
-        }
-    }
-
-    /// Start `req` on a worker thread; false if no thread could be started.
-    fn start(&mut self, req: ScanRequest, ctx: Option<&egui::Context>) -> bool {
-        let photo = self.photo.clone();
-        let ctx = ctx.cloned();
-        let (tx, rx) = std::sync::mpsc::channel();
-        let spawned = std::thread::Builder::new().name("signature-scan".into()).spawn(move || {
-            // The receiver may be gone (the dialog closed or a newer photo): nothing to report.
-            let _ = tx.send(Self::run(&photo, req));
-            if let Some(ctx) = ctx {
-                ctx.request_repaint();
-            }
-        });
-        if spawned.is_err() {
-            return false;
-        }
-        self.worker.running = Some((req, rx));
-        true
-    }
-
-    /// Whether a background scan is running or waiting to run.
-    pub fn scanning(&self) -> bool {
-        self.worker.running.is_some() || self.worker.queued.is_some()
-    }
-
-    /// Pick up a finished background scan (each frame), and start the newest waiting request.
-    pub fn poll(&mut self, image: &mut Option<SignatureImage>, ctx: Option<&egui::Context>) {
-        let Some((req, rx)) = &self.worker.running else { return };
-        let answer = match rx.try_recv() {
-            Ok(answer) => answer,
-            Err(std::sync::mpsc::TryRecvError::Empty) => return,
-            Err(std::sync::mpsc::TryRecvError::Disconnected) => Err("the scan stopped unexpectedly".into()),
-        };
-        let req = *req;
-        self.worker.running = None;
-        match self.worker.queued.take() {
-            Some(next) => {
-                // Shown as a preview while the newer request runs.
-                self.apply(image, ScanRequest { full: false, ..req }, answer);
-                if !self.start(next, ctx) {
-                    self.rescan(image, next.full);
-                }
-            }
-            None => self.apply(image, req, answer),
-        }
-    }
-
-    /// Show a scan's answer. It is the result only if it was full and for the current frame and
-    /// sensitivity.
-    fn apply(&mut self, image: &mut Option<SignatureImage>, req: ScanRequest, result: ScanAnswer) {
-        self.full = req.full && req.frame == self.frame && req.sensitivity == self.sensitivity;
-        match result {
-            Ok(Ok(scanned)) => {
-                *image = Some(scanned);
-                self.problem = None;
-            }
-            Ok(Err(ScanError::NoInk)) => {
-                *image = None;
-                self.problem =
-                    Some(tl!("No signature was found in the frame. Move the frame over the signature or raise the ink sensitivity.").to_string());
-            }
-            Ok(Err(e)) => {
-                *image = None;
-                self.problem = Some(e.to_string());
-            }
-            Err(e) => {
-                *image = None;
-                self.problem = Some(e);
-            }
-        }
-    }
-
-    pub fn turn(&mut self, turn: Turn, image: &mut Option<SignatureImage>, ctx: Option<&egui::Context>) {
-        self.frame = self.photo.turn(turn, self.frame);
-        self.version = next_photo_version();
-        self.rescan_in_background(image, true, ctx);
-    }
-}
-
 impl FillTool {
     pub fn command(self) -> &'static str {
         match self {
@@ -554,7 +363,7 @@ pub(crate) fn signature_entries(ui: &mut egui::Ui, app: &mut crate::PdfCraftApp,
         ui.horizontal(|ui| {
             let (rect, response) = ui.allocate_exact_size(vec2((ui.available_width() - 68.0).max(140.0), 52.0), Sense::click());
             let use_label = label("Use {what}");
-            response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, use_label.clone()));
+            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, use_label.clone()));
             let painter = ui.painter_at(rect);
             painter.rect_filled(rect, CornerRadius::same(4), Color32::WHITE);
             painter.rect_stroke(
@@ -626,6 +435,7 @@ pub(crate) fn page_input(
     ui: &egui::Ui,
     resp: &egui::Response,
     xf: &PageXform,
+    ptr: &PagePointer,
     page: usize,
     info: &DocInfo,
     tool: FillTool,
@@ -637,10 +447,7 @@ pub(crate) fn page_input(
     author: &str,
     date_text: &Result<String, String>,
 ) -> Option<FillAction> {
-    let pointer = ui.input(|i| i.pointer.hover_pos())?;
-    if !resp.contains_pointer() || !xf.rect.contains(pointer) {
-        return None;
-    }
+    let pointer = ptr.within(xf.rect)?;
     let p = info.pages.get(page)?;
     let at = to_user(xf, info, page, pointer);
     let saved = match tool {
@@ -712,14 +519,14 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
     let xf = view.page_xform(tb.page)?;
     let v = info.pages.get(tb.page)?.user_to_view(tb.at[0] as f32, tb.at[1] as f32);
     let pos = xf.norm_to_screen(v[0] / xf.pw, v[1] / xf.ph);
-    let zoom = xf.rect.width() / xf.pw.max(1.0);
+    let zoom = xf.zoom();
     let mut commit = false;
     let mut cancel = false;
     // Shown at once, like the paragraph editor: a fade-in shows the page's copy through it.
     // Over the page, so only where the document shows: a box scrolled under the mode bar or a
     // side panel must leave them their pointer (#2755). It stays where it was placed, cut off as
     // the page is, rather than pushed back into the window.
-    egui::Area::new(egui::Id::new(("fill-text", view.id.0)))
+    egui::Area::new(egui::Id::unique(("fill-text", view.id.0)))
         .fade_in(false)
         .order(egui::Order::Foreground)
         .fixed_pos(pos)
@@ -733,15 +540,17 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
             // The area's max rect is last frame's size, which caps the edit's width; widen it so the
             // box grows as text is typed.
             ui.set_min_width(width);
-            let r = ui.add(
-                egui::TextEdit::singleline(&mut t.text)
-                    .font(egui::FontId::proportional((t.size as f32 * zoom).max(8.0)))
-                    .desired_width(width)
-                    .background_color(Color32::from_rgba_unmultiplied(255, 255, 255, 230))
-                    .text_color(Color32::BLACK)
-                    .hint_text(tl!("Type text"))
-                    .id_salt("fill-text-edit"),
-            );
+            let r = ui
+                .add(
+                    egui::TextEdit::singleline(&mut t.text)
+                        .font(egui::FontId::proportional((t.size as f32 * zoom).max(8.0)))
+                        .desired_width(width)
+                        .background_color(Color32::from_rgba_unmultiplied(255, 255, 255, 230))
+                        .text_color(Color32::BLACK)
+                        .hint_text(tl!("Type text"))
+                        .id_salt("fill-text-edit"),
+                )
+                .accessible_name(tl!("Text to place"));
             if t.focus {
                 r.request_focus();
                 t.focus = false;
@@ -876,173 +685,6 @@ pub(crate) fn signature_pad(
     (apply, cancel, false)
 }
 
-/// The Scan tab above the pad buttons. Returns whether a photo should be chosen.
-fn scan_tab(
-    ui: &mut egui::Ui,
-    t: &Tokens,
-    d: &mut SigDraft,
-    preview: &mut Option<(SavedSig, egui::TextureHandle)>,
-    photo_texture: &mut Option<(u64, egui::TextureHandle)>,
-) -> bool {
-    ui.label(
-        egui::RichText::new(tl!(
-            "Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper."
-        ))
-        .color(t.text_muted),
-    );
-    let mut browse = false;
-    ui.horizontal(|ui| {
-        browse = crate::widgets::ghost_button(ui, "camera", tl!("Choose photo…")).clicked();
-        if let Some(scan) = d.scan.as_mut() {
-            ui.add_space(8.0);
-            if crate::icons::button(ui, "rotate-ccw", 28.0, false, tl!("Rotate counterclockwise")).clicked() {
-                scan.turn(Turn::CounterClockwise, &mut d.image, Some(ui.ctx()));
-            }
-            if crate::icons::button(ui, "rotate-cw", 28.0, false, tl!("Rotate clockwise")).clicked() {
-                scan.turn(Turn::Clockwise, &mut d.image, Some(ui.ctx()));
-            }
-        }
-    });
-    let (area, resp) = ui.allocate_exact_size(vec2(460.0, 230.0), Sense::drag());
-    let painter = ui.painter_at(area);
-    painter.rect_filled(area, CornerRadius::same(6), t.pasteboard);
-    painter.rect_stroke(area, CornerRadius::same(6), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-    if let Some(scan) = d.scan.as_mut() {
-        scan.poll(&mut d.image, Some(ui.ctx()));
-    }
-    let Some(scan) = d.scan.as_mut() else {
-        painter.text(area.center(), egui::Align2::CENTER_CENTER, tl!("No photo chosen"), egui::FontId::proportional(13.0), t.text_muted);
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Other, true, tl!("Photo")));
-        return browse;
-    };
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Other, true, tl!("Photo")));
-    // The photo, fitted into the area; `to_screen`/`to_photo` map between its pixels and points.
-    let [pw, ph] = scan.photo.size();
-    let (pw, ph) = (pw.max(1) as f32, ph.max(1) as f32);
-    let fit = area.shrink(8.0);
-    let scale = (fit.width() / pw).min(fit.height() / ph);
-    let shown = egui::Rect::from_center_size(fit.center(), vec2(pw * scale, ph * scale));
-    if photo_texture.as_ref().is_none_or(|(v, _)| *v != scan.version) {
-        let thumb = scan.photo.thumbnail(1024);
-        let size = [thumb.width() as usize, thumb.height() as usize];
-        let pixels = egui::ColorImage::from_rgba_unmultiplied(size, thumb.as_raw());
-        *photo_texture = Some((scan.version, ui.ctx().load_texture("signature-photo", pixels, egui::TextureOptions::LINEAR)));
-    }
-    if let Some((_, tex)) = photo_texture {
-        painter.image(tex.id(), shown, egui::Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
-    }
-    let to_screen = |x: f32, y: f32| pos2(shown.left() + x * scale, shown.top() + y * scale);
-    let to_photo = |p: Pos2| [((p.x - shown.left()) / scale).clamp(0.0, pw), ((p.y - shown.top()) / scale).clamp(0.0, ph)];
-    let frame_screen = |f: PhotoRect| {
-        egui::Rect::from_min_max(
-            to_screen(f.x as f32, f.y as f32),
-            to_screen(f.x.saturating_add(f.width) as f32, f.y.saturating_add(f.height) as f32),
-        )
-    };
-
-    // Move the frame from inside, resize it from a corner, or draw a new one elsewhere.
-    let handle = 10.0;
-    if resp.drag_started()
-        && let Some(p) = resp.interact_pointer_pos()
-    {
-        let fr = frame_screen(scan.frame);
-        let corners = [fr.left_top(), fr.right_top(), fr.left_bottom(), fr.right_bottom()];
-        let opposite = [fr.right_bottom(), fr.left_bottom(), fr.right_top(), fr.left_top()];
-        let at = to_photo(p);
-        scan.drag = Some(if let Some(i) = corners.iter().position(|c| c.distance(p) <= handle) {
-            FrameDrag::Span(opposite.get(i).map_or(at, |o| to_photo(*o)))
-        } else if fr.contains(p) {
-            FrameDrag::Move([at[0] - scan.frame.x as f32, at[1] - scan.frame.y as f32])
-        } else {
-            FrameDrag::Span(at)
-        });
-    }
-    if resp.dragged()
-        && let (Some(drag), Some(p)) = (scan.drag, resp.interact_pointer_pos())
-    {
-        let at = to_photo(p);
-        let (x0, y0, x1, y1) = match drag {
-            FrameDrag::Move(grab) => {
-                let (w, h) = (scan.frame.width as f32, scan.frame.height as f32);
-                let x = (at[0] - grab[0]).clamp(0.0, (pw - w).max(0.0));
-                let y = (at[1] - grab[1]).clamp(0.0, (ph - h).max(0.0));
-                (x, y, x + w, y + h)
-            }
-            FrameDrag::Span(anchor) => (anchor[0].min(at[0]), anchor[1].min(at[1]), anchor[0].max(at[0]), anchor[1].max(at[1])),
-        };
-        // At least a few screen points, so a frame can always be grabbed again.
-        let min = (12.0 / scale).max(1.0);
-        let frame = PhotoRect {
-            x: x0.round() as u32,
-            y: y0.round() as u32,
-            width: (x1 - x0).max(min).round() as u32,
-            height: (y1 - y0).max(min).round() as u32,
-        }
-        .clamped(pw as u32, ph as u32);
-        if frame != scan.frame {
-            scan.frame = frame;
-            scan.rescan_in_background(&mut d.image, false, Some(ui.ctx()));
-        }
-    }
-    if resp.drag_stopped() && scan.drag.take().is_some() {
-        scan.rescan_in_background(&mut d.image, true, Some(ui.ctx()));
-    }
-
-    // Dim the photo outside the frame, then outline it with corner handles.
-    let fr = frame_screen(scan.frame).intersect(shown);
-    let dim = Color32::from_black_alpha(120);
-    for r in [
-        egui::Rect::from_min_max(shown.left_top(), pos2(shown.right(), fr.top())),
-        egui::Rect::from_min_max(pos2(shown.left(), fr.bottom()), shown.right_bottom()),
-        egui::Rect::from_min_max(pos2(shown.left(), fr.top()), pos2(fr.left(), fr.bottom())),
-        egui::Rect::from_min_max(pos2(fr.right(), fr.top()), pos2(shown.right(), fr.bottom())),
-    ] {
-        if r.is_positive() {
-            painter.rect_filled(r, CornerRadius::ZERO, dim);
-        }
-    }
-    painter.rect_stroke(fr, CornerRadius::ZERO, Stroke::new(2.0, t.accent), egui::StrokeKind::Middle);
-    for c in [fr.left_top(), fr.right_top(), fr.left_bottom(), fr.right_bottom()] {
-        let r = egui::Rect::from_center_size(c, vec2(9.0, 9.0));
-        painter.rect_filled(r, CornerRadius::same(2), Color32::WHITE);
-        painter.rect_stroke(r, CornerRadius::same(2), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
-    }
-    if resp.hovered() && scan.drag.is_none() {
-        let hover = ui.input(|i| i.pointer.hover_pos());
-        let fr = frame_screen(scan.frame);
-        let icon = match hover {
-            Some(p) if [fr.left_top(), fr.right_bottom()].iter().any(|c| c.distance(p) <= handle) => egui::CursorIcon::ResizeNwSe,
-            Some(p) if [fr.right_top(), fr.left_bottom()].iter().any(|c| c.distance(p) <= handle) => egui::CursorIcon::ResizeNeSw,
-            Some(p) if fr.contains(p) => egui::CursorIcon::Grab,
-            _ => egui::CursorIcon::Crosshair,
-        };
-        ui.ctx().set_cursor_icon(icon);
-    }
-
-    ui.add_space(6.0);
-    ui.horizontal(|ui| {
-        let l = ui.label(tl!("Ink sensitivity"));
-        let slider = ui.add(egui::Slider::new(&mut scan.sensitivity, 0..=100)).labelled_by(l.id);
-        if slider.changed() {
-            // Quick previews while dragging; keyboard steps get the full result at once.
-            scan.rescan_in_background(&mut d.image, !slider.dragged(), Some(ui.ctx()));
-        }
-        if slider.drag_stopped() {
-            scan.rescan_in_background(&mut d.image, true, Some(ui.ctx()));
-        }
-    });
-    ui.add_space(4.0);
-    let (rect, _) = ui.allocate_exact_size(vec2(460.0, 110.0), Sense::hover());
-    ui.painter().rect_filled(rect, CornerRadius::same(6), Color32::WHITE);
-    ui.painter().rect_stroke(rect, CornerRadius::same(6), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-    if let Some(image) = &d.image {
-        image_preview(ui, rect.shrink(8.0), image, preview);
-    } else if let Some(problem) = &scan.problem {
-        ui.put(rect.shrink(12.0), egui::Label::new(egui::RichText::new(problem.as_str()).color(Color32::from_rgb(0x8A, 0x5A, 0x00))).wrap());
-    }
-    browse
-}
-
 fn image_texture(ui: &egui::Ui, image: &SignatureImage, cache: &mut Option<(SavedSig, egui::TextureHandle)>) -> egui::TextureId {
     let key = SavedSig::Image(image.clone());
     if cache.as_ref().is_some_and(|(s, _)| *s != key) {
diff --git a/crates/ui-egui/src/tools/fill_sign/scan.rs b/crates/ui-egui/src/tools/fill_sign/scan.rs
new file mode 100644
index 0000000000..2b247f53a8
--- /dev/null
+++ b/crates/ui-egui/src/tools/fill_sign/scan.rs
@@ -0,0 +1,365 @@
+use super::*;
+
+/// The Scan tab's photo, the frame around the signature and how strongly faint ink is picked up.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ScanDraft {
+    pub photo: SignaturePhoto,
+    pub frame: PhotoRect,
+    pub sensitivity: u8,
+    /// Changes whenever the photo's pixels do (a new photo or a turn), to refresh its texture.
+    version: u64,
+    pub(super) drag: Option<FrameDrag>,
+    /// The draft's image is the full-resolution result, not a quick preview.
+    pub(super) full: bool,
+    /// Why the frame gives no signature, shown in place of the preview.
+    pub problem: Option<String>,
+    /// Scans run here while the frame or slider moves, so a frame never waits for one.
+    worker: ScanWorker,
+}
+
+/// What one scan cleans: the frame and sensitivity at the time it was asked for.
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct ScanRequest {
+    frame: PhotoRect,
+    sensitivity: u8,
+    full: bool,
+}
+
+type ScanAnswer = Result<Result<SignatureImage, ScanError>, String>;
+
+/// The scan running on a worker thread (desktop) and the newest request made meanwhile, which
+/// starts when it answers; requests in between are skipped. It is not part of the draft's value:
+/// a clone has nothing running and comparisons ignore it.
+#[derive(Default)]
+struct ScanWorker {
+    running: Option<(ScanRequest, std::sync::mpsc::Receiver<ScanAnswer>)>,
+    queued: Option<ScanRequest>,
+}
+
+impl Clone for ScanWorker {
+    fn clone(&self) -> Self {
+        Self::default()
+    }
+}
+
+impl PartialEq for ScanWorker {
+    fn eq(&self, _: &Self) -> bool {
+        true
+    }
+}
+
+impl std::fmt::Debug for ScanWorker {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ScanWorker").field("running", &self.running.as_ref().map(|(r, _)| r)).field("queued", &self.queued).finish()
+    }
+}
+
+/// A drag on the photo, in photo pixels.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) enum FrameDrag {
+    /// Moving the frame, grabbed at this offset from its top-left corner.
+    Move([f32; 2]),
+    /// Drawing a new frame or resizing from a corner, with the opposite corner fixed here.
+    Span([f32; 2]),
+}
+
+fn next_photo_version() -> u64 {
+    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+    NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
+}
+
+impl ScanDraft {
+    /// Frame the signature (turning a sideways one upright) with the default sensitivity.
+    pub fn new(mut photo: SignaturePhoto) -> Self {
+        let frame = photo.auto_frame();
+        Self {
+            photo,
+            frame,
+            sensitivity: DEFAULT_SENSITIVITY,
+            version: next_photo_version(),
+            drag: None,
+            full: false,
+            problem: None,
+            worker: ScanWorker::default(),
+        }
+    }
+
+    fn request(&self, full: bool) -> ScanRequest {
+        ScanRequest { frame: self.frame, sensitivity: self.sensitivity, full }
+    }
+
+    fn run(photo: &SignaturePhoto, req: ScanRequest) -> ScanAnswer {
+        let max_side = if req.full { SCAN_MAX_SIDE } else { PREVIEW_MAX_SIDE };
+        pdfcraft_engine::guard(|| photo.scan(req.frame, req.sensitivity, max_side))
+    }
+
+    /// Clean the framed area into `image` now: quickly (`full` false) while something is being
+    /// dragged, at full resolution otherwise. A scan still running in the background is dropped.
+    pub fn rescan(&mut self, image: &mut Option<SignatureImage>, full: bool) {
+        self.worker = ScanWorker::default();
+        let req = self.request(full);
+        let answer = Self::run(&self.photo, req);
+        self.apply(image, req, answer);
+    }
+
+    /// Like [`Self::rescan`], but on a worker thread on desktop, so the frame that asked doesn't
+    /// wait (a scan of a large frame takes a noticeable fraction of a second). The draft isn't
+    /// ready until the answer for the current frame and sensitivity arrives; [`Self::poll`]
+    /// picks it up. Where threads are unavailable (the web) it scans at once.
+    pub fn rescan_in_background(&mut self, image: &mut Option<SignatureImage>, full: bool, ctx: Option<&egui::Context>) {
+        if cfg!(target_arch = "wasm32") {
+            return self.rescan(image, full);
+        }
+        let req = self.request(full);
+        self.full = false;
+        if self.worker.running.is_some() {
+            self.worker.queued = Some(req);
+        } else if !self.start(req, ctx) {
+            self.rescan(image, full);
+        }
+    }
+
+    /// Start `req` on a worker thread; false if no thread could be started.
+    fn start(&mut self, req: ScanRequest, ctx: Option<&egui::Context>) -> bool {
+        let photo = self.photo.clone();
+        let ctx = ctx.cloned();
+        let (tx, rx) = std::sync::mpsc::channel();
+        let spawned = std::thread::Builder::new().name("signature-scan".into()).spawn(move || {
+            // The receiver may be gone (the dialog closed or a newer photo): nothing to report.
+            let _ = tx.send(Self::run(&photo, req));
+            if let Some(ctx) = ctx {
+                ctx.request_repaint();
+            }
+        });
+        if spawned.is_err() {
+            return false;
+        }
+        self.worker.running = Some((req, rx));
+        true
+    }
+
+    /// Whether a background scan is running or waiting to run.
+    pub fn scanning(&self) -> bool {
+        self.worker.running.is_some() || self.worker.queued.is_some()
+    }
+
+    /// Pick up a finished background scan (each frame), and start the newest waiting request.
+    pub fn poll(&mut self, image: &mut Option<SignatureImage>, ctx: Option<&egui::Context>) {
+        let Some((req, rx)) = &self.worker.running else { return };
+        let answer = match rx.try_recv() {
+            Ok(answer) => answer,
+            Err(std::sync::mpsc::TryRecvError::Empty) => return,
+            Err(std::sync::mpsc::TryRecvError::Disconnected) => Err("the scan stopped unexpectedly".into()),
+        };
+        let req = *req;
+        self.worker.running = None;
+        match self.worker.queued.take() {
+            Some(next) => {
+                // Shown as a preview while the newer request runs.
+                self.apply(image, ScanRequest { full: false, ..req }, answer);
+                if !self.start(next, ctx) {
+                    self.rescan(image, next.full);
+                }
+            }
+            None => self.apply(image, req, answer),
+        }
+    }
+
+    /// Show a scan's answer. It is the result only if it was full and for the current frame and
+    /// sensitivity.
+    fn apply(&mut self, image: &mut Option<SignatureImage>, req: ScanRequest, result: ScanAnswer) {
+        self.full = req.full && req.frame == self.frame && req.sensitivity == self.sensitivity;
+        match result {
+            Ok(Ok(scanned)) => {
+                *image = Some(scanned);
+                self.problem = None;
+            }
+            Ok(Err(ScanError::NoInk)) => {
+                *image = None;
+                self.problem =
+                    Some(tl!("No signature was found in the frame. Move the frame over the signature or raise the ink sensitivity.").to_string());
+            }
+            Ok(Err(e)) => {
+                *image = None;
+                self.problem = Some(e.to_string());
+            }
+            Err(e) => {
+                *image = None;
+                self.problem = Some(e);
+            }
+        }
+    }
+
+    pub fn turn(&mut self, turn: Turn, image: &mut Option<SignatureImage>, ctx: Option<&egui::Context>) {
+        self.frame = self.photo.turn(turn, self.frame);
+        self.version = next_photo_version();
+        self.rescan_in_background(image, true, ctx);
+    }
+}
+
+/// The Scan tab above the pad buttons. Returns whether a photo should be chosen.
+pub(super) fn scan_tab(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    d: &mut SigDraft,
+    preview: &mut Option<(SavedSig, egui::TextureHandle)>,
+    photo_texture: &mut Option<(u64, egui::TextureHandle)>,
+) -> bool {
+    ui.label(
+        egui::RichText::new(tl!(
+            "Sign a sheet of white paper and take a photo of it in bright, even light (use the flash). Choose the photo or drop it here: PdfCraft finds the signature and removes the paper."
+        ))
+        .color(t.text_muted),
+    );
+    let mut browse = false;
+    ui.horizontal(|ui| {
+        browse = crate::widgets::ghost_button(ui, "camera", tl!("Choose photo…")).clicked();
+        if let Some(scan) = d.scan.as_mut() {
+            ui.add_space(8.0);
+            if crate::icons::button(ui, "rotate-ccw", 28.0, false, tl!("Rotate counterclockwise")).clicked() {
+                scan.turn(Turn::CounterClockwise, &mut d.image, Some(ui.ctx()));
+            }
+            if crate::icons::button(ui, "rotate-cw", 28.0, false, tl!("Rotate clockwise")).clicked() {
+                scan.turn(Turn::Clockwise, &mut d.image, Some(ui.ctx()));
+            }
+        }
+    });
+    let (area, resp) = ui.allocate_exact_size(vec2(460.0, 230.0), Sense::drag());
+    let painter = ui.painter_at(area);
+    painter.rect_filled(area, CornerRadius::same(6), t.pasteboard);
+    painter.rect_stroke(area, CornerRadius::same(6), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+    if let Some(scan) = d.scan.as_mut() {
+        scan.poll(&mut d.image, Some(ui.ctx()));
+    }
+    let Some(scan) = d.scan.as_mut() else {
+        painter.text(area.center(), egui::Align2::CENTER_CENTER, tl!("No photo chosen"), egui::FontId::proportional(13.0), t.text_muted);
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Image, true, tl!("Photo")));
+        return browse;
+    };
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Image, true, tl!("Photo")));
+    // The photo, fitted into the area; `to_screen`/`to_photo` map between its pixels and points.
+    let [pw, ph] = scan.photo.size();
+    let (pw, ph) = (pw.max(1) as f32, ph.max(1) as f32);
+    let fit = area.shrink(8.0);
+    let scale = (fit.width() / pw).min(fit.height() / ph);
+    let shown = egui::Rect::from_center_size(fit.center(), vec2(pw * scale, ph * scale));
+    if photo_texture.as_ref().is_none_or(|(v, _)| *v != scan.version) {
+        let thumb = scan.photo.thumbnail(1024);
+        let size = [thumb.width() as usize, thumb.height() as usize];
+        let pixels = egui::ColorImage::from_rgba_unmultiplied(size, thumb.as_raw());
+        *photo_texture = Some((scan.version, ui.ctx().load_texture("signature-photo", pixels, egui::TextureOptions::LINEAR)));
+    }
+    if let Some((_, tex)) = photo_texture {
+        painter.image(tex.id(), shown, egui::Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+    }
+    let to_screen = |x: f32, y: f32| pos2(shown.left() + x * scale, shown.top() + y * scale);
+    let to_photo = |p: Pos2| [((p.x - shown.left()) / scale).clamp(0.0, pw), ((p.y - shown.top()) / scale).clamp(0.0, ph)];
+    let frame_screen = |f: PhotoRect| {
+        egui::Rect::from_min_max(
+            to_screen(f.x as f32, f.y as f32),
+            to_screen(f.x.saturating_add(f.width) as f32, f.y.saturating_add(f.height) as f32),
+        )
+    };
+
+    // Move the frame from inside, resize it from a corner, or draw a new one elsewhere.
+    let handle = 10.0;
+    if resp.drag_started()
+        && let Some(p) = resp.interact_pointer_pos()
+    {
+        let fr = frame_screen(scan.frame);
+        let corners = [fr.left_top(), fr.right_top(), fr.left_bottom(), fr.right_bottom()];
+        let opposite = [fr.right_bottom(), fr.left_bottom(), fr.right_top(), fr.left_top()];
+        let at = to_photo(p);
+        scan.drag = Some(if let Some(i) = corners.iter().position(|c| c.distance(p) <= handle) {
+            FrameDrag::Span(opposite.get(i).map_or(at, |o| to_photo(*o)))
+        } else if fr.contains(p) {
+            FrameDrag::Move([at[0] - scan.frame.x as f32, at[1] - scan.frame.y as f32])
+        } else {
+            FrameDrag::Span(at)
+        });
+    }
+    if resp.dragged()
+        && let (Some(drag), Some(p)) = (scan.drag, resp.interact_pointer_pos())
+    {
+        let at = to_photo(p);
+        let (x0, y0, x1, y1) = match drag {
+            FrameDrag::Move(grab) => {
+                let (w, h) = (scan.frame.width as f32, scan.frame.height as f32);
+                let x = (at[0] - grab[0]).clamp(0.0, (pw - w).max(0.0));
+                let y = (at[1] - grab[1]).clamp(0.0, (ph - h).max(0.0));
+                (x, y, x + w, y + h)
+            }
+            FrameDrag::Span(anchor) => (anchor[0].min(at[0]), anchor[1].min(at[1]), anchor[0].max(at[0]), anchor[1].max(at[1])),
+        };
+        // At least a few screen points, so a frame can always be grabbed again.
+        let min = (12.0 / scale).max(1.0);
+        let frame = PhotoRect {
+            x: x0.round() as u32,
+            y: y0.round() as u32,
+            width: (x1 - x0).max(min).round() as u32,
+            height: (y1 - y0).max(min).round() as u32,
+        }
+        .clamped(pw as u32, ph as u32);
+        if frame != scan.frame {
+            scan.frame = frame;
+            scan.rescan_in_background(&mut d.image, false, Some(ui.ctx()));
+        }
+    }
+    if resp.drag_stopped() && scan.drag.take().is_some() {
+        scan.rescan_in_background(&mut d.image, true, Some(ui.ctx()));
+    }
+
+    // Dim the photo outside the frame, then outline it with corner handles.
+    let fr = frame_screen(scan.frame).intersect(shown);
+    let dim = Color32::from_black_alpha(120);
+    for r in [
+        egui::Rect::from_min_max(shown.left_top(), pos2(shown.right(), fr.top())),
+        egui::Rect::from_min_max(pos2(shown.left(), fr.bottom()), shown.right_bottom()),
+        egui::Rect::from_min_max(pos2(shown.left(), fr.top()), pos2(fr.left(), fr.bottom())),
+        egui::Rect::from_min_max(pos2(fr.right(), fr.top()), pos2(shown.right(), fr.bottom())),
+    ] {
+        if r.is_positive() {
+            painter.rect_filled(r, CornerRadius::ZERO, dim);
+        }
+    }
+    painter.rect_stroke(fr, CornerRadius::ZERO, Stroke::new(2.0, t.accent), egui::StrokeKind::Middle);
+    for c in [fr.left_top(), fr.right_top(), fr.left_bottom(), fr.right_bottom()] {
+        let r = egui::Rect::from_center_size(c, vec2(9.0, 9.0));
+        painter.rect_filled(r, CornerRadius::same(2), Color32::WHITE);
+        painter.rect_stroke(r, CornerRadius::same(2), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
+    }
+    if resp.hovered() && scan.drag.is_none() {
+        let hover = ui.input(|i| i.pointer.hover_pos());
+        let fr = frame_screen(scan.frame);
+        let icon = match hover {
+            Some(p) if [fr.left_top(), fr.right_bottom()].iter().any(|c| c.distance(p) <= handle) => egui::CursorIcon::ResizeNwSe,
+            Some(p) if [fr.right_top(), fr.left_bottom()].iter().any(|c| c.distance(p) <= handle) => egui::CursorIcon::ResizeNeSw,
+            Some(p) if fr.contains(p) => egui::CursorIcon::Grab,
+            _ => egui::CursorIcon::Crosshair,
+        };
+        ui.ctx().set_cursor_icon(icon);
+    }
+
+    ui.add_space(6.0);
+    ui.horizontal(|ui| {
+        let l = ui.label(tl!("Ink sensitivity"));
+        let slider = ui.add(egui::Slider::new(&mut scan.sensitivity, 0..=100)).labelled_by(l.id);
+        if slider.changed() {
+            // Quick previews while dragging; keyboard steps get the full result at once.
+            scan.rescan_in_background(&mut d.image, !slider.dragged(), Some(ui.ctx()));
+        }
+        if slider.drag_stopped() {
+            scan.rescan_in_background(&mut d.image, true, Some(ui.ctx()));
+        }
+    });
+    ui.add_space(4.0);
+    let (rect, _) = ui.allocate_exact_size(vec2(460.0, 110.0), Sense::hover());
+    ui.painter().rect_filled(rect, CornerRadius::same(6), Color32::WHITE);
+    ui.painter().rect_stroke(rect, CornerRadius::same(6), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+    if let Some(image) = &d.image {
+        image_preview(ui, rect.shrink(8.0), image, preview);
+    } else if let Some(problem) = &scan.problem {
+        ui.put(rect.shrink(12.0), egui::Label::new(egui::RichText::new(problem.as_str()).color(Color32::from_rgb(0x8A, 0x5A, 0x00))).wrap());
+    }
+    browse
+}
diff --git a/crates/ui-egui/src/forms_ui.rs b/crates/ui-egui/src/tools/forms_ui.rs
similarity index 87%
rename from crates/ui-egui/src/forms_ui.rs
rename to crates/ui-egui/src/tools/forms_ui.rs
index 5c3b91a393..28494160c5 100644
--- a/crates/ui-egui/src/forms_ui.rs
+++ b/crates/ui-egui/src/tools/forms_ui.rs
@@ -4,15 +4,17 @@
 //! cancels, Tab moves to the next field). Check boxes and radio buttons toggle on click, or on
 //! Space once Tab or a click has focused them. List boxes are directly selectable in-place on the
 //! page (clicking picks an option; Ctrl-click toggles on multi-select lists). Combo boxes open a
-//! list of their options. Every change is one undoable engine edit.
+//! list of their options; an editable one (Edit flag) also takes typed text in a box over the
+//! field. Every change is one undoable engine edit.
 
 use std::collections::HashSet;
 
-use egui::{Color32, CornerRadius, Rect, Stroke, vec2};
+use egui::{Color32, CornerRadius, Pos2, Rect, Stroke, vec2};
 use pdfcraft_engine::{Edit, FieldValue, FormField, FormFieldKind, FormWidget, field_flags, form_appearance};
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
 use crate::theme::Tokens;
 
 const FOCUS_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
@@ -41,6 +43,9 @@ pub struct Focus {
     /// The text the calendar last saw, so it moves to a typed date once, when the typing becomes
     /// a whole date, and otherwise keeps the month its arrows turned to.
     pub calendar_text: Option<String>,
+    /// Whether the text box had the keyboard at the end of the editor's last frame
+    /// ([`crate::edit_text_ui::lost_focus_once`]).
+    pub(crate) had_focus: bool,
 }
 
 #[derive(Clone, Debug, Default)]
@@ -89,11 +94,29 @@ fn fillable(f: &FormField) -> bool {
     !f.read_only() && !matches!(f.kind, FormFieldKind::PushButton | FormFieldKind::Signature)
 }
 
+/// Whether a combo box takes typed text as well as a choice from its list: the Edit flag
+/// (ISO 32000-2 Table 233), which only means something with Combo set.
+fn editable_combo(f: &FormField) -> bool {
+    f.kind == FormFieldKind::Combo && f.has(field_flags::EDIT)
+}
+
+/// The text a field's editor starts with: its value, or for a combo box the shown text of the
+/// option it picks (a free value typed into an editable one has no option, and shows as is).
+pub(crate) fn draft_text(f: &FormField) -> String {
+    let value = f.value.first().cloned().unwrap_or_default();
+    if f.kind == FormFieldKind::Combo
+        && let Some((_, shown)) = f.options.iter().find(|(export, _)| *export == value)
+    {
+        return shown.clone();
+    }
+    value
+}
+
 fn open_focus(f: &FormField, widget: usize) -> Focus {
     Focus {
         name: f.name.clone(),
         widget,
-        text: f.value.first().cloned().unwrap_or_default(),
+        text: draft_text(f),
         picked: f.value.clone(),
         request_focus: true,
         select_all: false,
@@ -101,6 +124,7 @@ fn open_focus(f: &FormField, widget: usize) -> Focus {
         calendar: None,
         calendar_rect: None,
         calendar_text: None,
+        had_focus: false,
     }
 }
 
@@ -146,14 +170,14 @@ pub(crate) fn page_input(
     ui: &egui::Ui,
     resp: &egui::Response,
     xf: &PageXform,
+    ptr: &PagePointer,
     page: usize,
     info: &DocInfo,
     form: &[FormField],
     allowed: bool,
     view: &mut DocView,
 ) -> FieldPointer {
-    let pointer = ui.input(|i| i.pointer.hover_pos());
-    let Some(p) = pointer.filter(|p| xf.rect.contains(*p)) else { return FieldPointer::Away };
+    let Some(p) = ptr.within(xf.rect) else { return FieldPointer::Away };
     let hit = form.iter().find_map(|f| {
         f.widgets
             .iter()
@@ -183,7 +207,7 @@ pub(crate) fn page_input(
     }
     // A text field opens on the press rather than the click, so a drag that starts on it
     // selects its text (#2213).
-    let pressed = f.kind == FormFieldKind::Text && usable && resp.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_pressed());
+    let pressed = f.kind == FormFieldKind::Text && usable && resp.is_pointer_button_down_on() && ptr.pressed().is_some();
     if pressed && view.forms.focus.as_ref().is_none_or(|x| x.name != f.name || x.widget != wi) {
         commit(view, form);
         view.forms.focus = Some(Focus { press: Some(p), ..open_focus(f, wi) });
@@ -215,7 +239,7 @@ pub(crate) fn page_input(
         // The press already committed the previous field and opened this one (above), unless
         // press and release came in one frame. Committing again would re-run a validation that
         // refused the value on the press.
-        FormFieldKind::Text if !ui.input(|i| i.pointer.primary_pressed()) => {
+        FormFieldKind::Text if ptr.pressed().is_none() => {
             // An editor opened by the press cannot be hit until a frame has laid it out: the
             // release lands on the page and would take its focus away.
             if let Some(x) = view.forms.focus.as_mut().filter(|x| x.name == f.name && x.widget == wi) {
@@ -273,6 +297,11 @@ pub(crate) fn draft_edit(focus: &Focus, form: &[FormField]) -> Option<Edit> {
     let f = form.iter().find(|f| f.name == focus.name)?;
     let value = match f.kind {
         FormFieldKind::Text if f.value.first().map(String::as_str).unwrap_or("") != focus.text => FieldValue::Text(focus.text.clone()),
+        // Typed into an editable combo box: a shown text picks its option, anything else is the
+        // value itself (the engine maps it, and refuses free text when Edit is clear).
+        FormFieldKind::Combo if editable_combo(f) && focus.text != draft_text(f) && f.value.first() != Some(&focus.text) => {
+            FieldValue::Choice(if focus.text.is_empty() { Vec::new() } else { vec![focus.text.clone()] })
+        }
         _ => return None,
     };
     Some(Edit::SetFieldValue { name: f.name.clone(), value })
@@ -288,6 +317,50 @@ pub(crate) fn commit(view: &mut DocView, form: &[FormField]) {
     }
 }
 
+/// The text box of an editable combo box, over the field. What is typed becomes the value when
+/// Enter, Tab or a click away commits it; a pick from the list still sets an option.
+#[allow(clippy::too_many_arguments)]
+fn combo_editor(ctx: &egui::Context, view: &mut DocView, form: &[FormField], f: &FormField, w: &FormWidget, rect: Rect, zoom: f32, widget: usize) {
+    let mut enter = false;
+    egui::Area::new(egui::Id::unique(("form-editor", view.id.0)))
+        .fade_in(false)
+        .order(egui::Order::Foreground)
+        .fixed_pos(rect.min)
+        .constrain_to(view.viewport_rect())
+        .constrain(false)
+        .show(ctx, |ui| {
+            ui.set_min_size(rect.size());
+            let Some(fx) = view.forms.focus.as_mut() else { return };
+            let font = (field_text_size(ui.painter(), f, w, &fx.text) * zoom).clamp(3.0, 64.0);
+            // The box is pale yellow in every theme, as a text field's is (#655).
+            ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(FIELD_FILL);
+            let te = egui::TextEdit::singleline(&mut fx.text)
+                .desired_width((rect.width() - 6.0 * zoom + 6.0).max(1.0))
+                .font(egui::FontId::proportional(font))
+                .background_color(FIELD_FILL)
+                .text_color(Color32::BLACK)
+                .margin(egui::Margin::symmetric(3, 1))
+                .id(egui::Id::unique(("form-field", view.id.0, &f.name, widget)));
+            // The form field's own logical name; not a visual/preordered label.
+            let r = ui.add_sized(rect.size(), te).accessible_name(f.name.clone());
+            if std::mem::take(&mut fx.request_focus) {
+                r.request_focus();
+                // Entered with Tab: typing replaces the value.
+                if std::mem::take(&mut fx.select_all)
+                    && let Some(mut st) = egui::TextEdit::load_state(ui.ctx(), r.id)
+                {
+                    let n = fx.text.chars().count();
+                    st.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(n))));
+                    st.store(ui.ctx(), r.id);
+                }
+            }
+            enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
+        });
+    if enter {
+        commit(view, form);
+    }
+}
+
 const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
 
 /// The date picker under a focused date field: a month of days, and a Today button under them.
@@ -309,7 +382,7 @@ fn calendar(ctx: &egui::Context, view: &mut DocView, field: egui::Rect, fmt: &st
         fx.calendar_text = Some(fx.text.clone());
     }
     let mut picked = None;
-    let area = egui::Area::new(egui::Id::new(("date-picker", view.id.0)))
+    let area = egui::Area::new(egui::Id::unique(("date-picker", view.id.0)))
         .order(egui::Order::Foreground)
         .fixed_pos(field.left_bottom() + vec2(0.0, 2.0))
         .show(ctx, |ui| {
@@ -408,9 +481,16 @@ fn calendar(ctx: &egui::Context, view: &mut DocView, field: egui::Rect, fmt: &st
     picked
 }
 
-/// Paint focus and hover frames on a page.
-pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, xf: &PageXform, page: usize, info: &DocInfo, form: &[FormField], view: &DocView) {
-    let pointer = ui.input(|i| i.pointer.hover_pos());
+/// Paint focus and hover frames on a page, the pages' `pointer` over it.
+pub(crate) fn paint_page(
+    painter: &egui::Painter,
+    xf: &PageXform,
+    page: usize,
+    info: &DocInfo,
+    form: &[FormField],
+    view: &DocView,
+    pointer: Option<Pos2>,
+) {
     for f in form {
         for (wi, w) in f.widgets.iter().enumerate().filter(|(_, w)| w.page == Some(page) && !w.hidden) {
             let r = widget_rect(xf, info, page, w.rect);
@@ -577,7 +657,11 @@ pub(crate) fn overlay(
         return None;
     };
     let rect = widget_rect(&xf, info, page, w.rect);
-    let zoom = xf.rect.width() / xf.pw.max(1.0);
+    // Whether a click this frame landed outside the field. Where it landed is `interact_pos`: a
+    // tap's release comes with `PointerGone` (egui-winit sends one with every touch release, and
+    // winit reports Windows pen input as touch), which clears `hover_pos`.
+    let clicked_outside = || ctx.input(|i| i.pointer.any_click() && !i.pointer.interact_pos().is_some_and(|p| rect.contains(p)));
+    let zoom = xf.zoom();
     let t = Tokens::get(ctx);
     let mut edit = None;
     let mut close = false;
@@ -589,7 +673,7 @@ pub(crate) fn overlay(
             // Over the page, so only where the document shows: a field scrolled under the mode bar
             // or a side panel must leave them their pointer (#2755). It stays on its field, cut off
             // as the page is, rather than pushed back into the window.
-            egui::Area::new(egui::Id::new(("form-editor", view.id.0)))
+            egui::Area::new(egui::Id::unique(("form-editor", view.id.0)))
                 .fade_in(false)
                 .order(egui::Order::Foreground)
                 .fixed_pos(rect.min)
@@ -614,7 +698,7 @@ pub(crate) fn overlay(
                         .text_color(Color32::BLACK)
                         .margin(egui::Margin::symmetric(3, 1))
                         .password(f.has(field_flags::PASSWORD))
-                        .id(egui::Id::new(("form-field", view.id.0, &f.name, focus.widget)));
+                        .id(egui::Id::unique(("form-field", view.id.0, &f.name, focus.widget)));
                     if let Some(max) = f.max_len {
                         te = te.char_limit(max);
                     }
@@ -622,11 +706,14 @@ pub(crate) fn overlay(
                         te = te.desired_rows(((rect.height() / (font * 1.3)).floor() as usize).max(1));
                     }
                     let mut laid_out = None;
-                    let r = ui.add_sized(rect.size(), |ui: &mut egui::Ui| {
-                        let out = te.show(ui);
-                        laid_out = Some((out.galley, out.galley_pos));
-                        out.response.response
-                    });
+                    let r = ui
+                        .add_sized(rect.size(), |ui: &mut egui::Ui| {
+                            let out = te.show(ui);
+                            laid_out = Some((out.galley, out.galley_pos));
+                            out.response.response
+                        })
+                        // The form field's own logical name; not a visual/preordered label.
+                        .accessible_name(f.name.clone());
                     if let (Some(tb), Some(before)) = (text_box, before)
                         && fx.text != before
                     {
@@ -663,6 +750,7 @@ pub(crate) fn overlay(
                             st.store(ui.ctx(), r.id);
                         }
                     }
+                    let lost = crate::edit_text_ui::lost_focus_once(&r, &mut fx.had_focus);
                     let (enter, esc, tab, shift) = ui.input(|i| {
                         (i.key_pressed(egui::Key::Enter), i.key_pressed(egui::Key::Escape), i.key_pressed(egui::Key::Tab), i.modifiers.shift)
                     });
@@ -670,7 +758,7 @@ pub(crate) fn overlay(
                         close = true;
                     } else if tab {
                         next = Some(!shift);
-                    } else if r.lost_focus()
+                    } else if lost
                         && (!multiline || !enter)
                         && !fx.calendar_rect.is_some_and(|c| ui.input(|i| i.pointer.interact_pos().is_some_and(|p| c.contains(p))))
                     {
@@ -695,7 +783,12 @@ pub(crate) fn overlay(
             }
         }
         FormFieldKind::Combo => {
-            let resp = egui::Area::new(egui::Id::new(("form-choices", view.id.0)))
+            // An editable combo box has a text box over the field as well as its list (ISO
+            // 32000-2 Table 233, Edit).
+            if editable_combo(f) {
+                combo_editor(ctx, view, form, f, w, rect, zoom, focus.widget);
+            }
+            let resp = egui::Area::new(egui::Id::unique(("form-choices", view.id.0)))
                 .order(egui::Order::Foreground)
                 .fixed_pos(rect.left_bottom() + vec2(0.0, 2.0))
                 .show(ctx, |ui| {
@@ -713,9 +806,7 @@ pub(crate) fn overlay(
                         });
                     });
                 });
-            let clicked_away = ctx.input(|i| i.pointer.any_click())
-                && !resp.response.contains_pointer()
-                && !ctx.input(|i| i.pointer.hover_pos()).is_some_and(|p| rect.contains(p));
+            let clicked_away = !resp.response.contains_pointer() && clicked_outside();
             let (tab, shift) = ctx.input(|i| (i.key_pressed(egui::Key::Tab), i.modifiers.shift));
             if ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
                 close = true;
@@ -749,18 +840,17 @@ pub(crate) fn overlay(
                     edit = Some(Edit::SetFieldValue { name: f.name.clone(), value: FieldValue::Choice(vec![export]) });
                 }
             }
-            let clicked_away = ctx.input(|i| i.pointer.any_click()) && !ctx.input(|i| i.pointer.hover_pos()).is_some_and(|p| rect.contains(p));
-            if clicked_away {
+            if clicked_outside() {
                 close = true;
             }
         }
         FormFieldKind::CheckBox | FormFieldKind::Radio => {
             // Nothing is drawn over the box, but a widget there holds egui's keyboard focus, so
             // Space, Tab and the arrows come here instead of turning or scrolling the page.
-            let id = egui::Id::new(("form-field", view.id.0, &f.name, focus.widget));
+            let id = egui::Id::unique(("form-field", view.id.0, &f.name, focus.widget));
             let mut has_focus = false;
             // Not interactable, so clicks still reach the page under it.
-            let area = egui::Area::new(egui::Id::new(("form-toggle", view.id.0))).order(egui::Order::Foreground).interactable(false);
+            let area = egui::Area::new(egui::Id::unique(("form-toggle", view.id.0))).order(egui::Order::Foreground).interactable(false);
             area.fixed_pos(rect.min).show(ctx, |ui| {
                 let r = ui.interact(rect, id, egui::Sense::focusable_noninteractive());
                 if let Some(fx) = view.forms.focus.as_mut()
@@ -787,8 +877,7 @@ pub(crate) fn overlay(
                     None
                 }
             });
-            let clicked_away = ctx.input(|i| i.pointer.any_click() && !i.pointer.hover_pos().is_some_and(|p| rect.contains(p)));
-            if esc || clicked_away {
+            if esc || clicked_outside() {
                 close = true;
             } else if tab {
                 next = Some(!shift);
diff --git a/crates/ui-egui/src/link_ui.rs b/crates/ui-egui/src/tools/link_ui.rs
similarity index 93%
rename from crates/ui-egui/src/link_ui.rs
rename to crates/ui-egui/src/tools/link_ui.rs
index c714870c53..f804f121e9 100644
--- a/crates/ui-egui/src/link_ui.rs
+++ b/crates/ui-egui/src/tools/link_ui.rs
@@ -7,6 +7,7 @@ use pdfcraft_engine::{Edit, LinkAction, LinkHighlight, LinkItem, LinkStyle};
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, widgets};
 
@@ -56,21 +57,23 @@ fn to_user(xf: &PageXform, info: &DocInfo, page: usize, p: Pos2) -> [f64; 2] {
 }
 
 /// Link tool input on one page. Returns `true` when the gesture belongs to the tool.
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn page_input(
     ui: &egui::Ui,
     resp: &egui::Response,
     xf: &PageXform,
+    ptr: &PagePointer,
     page: usize,
     info: &DocInfo,
     links: &[LinkItem],
     view: &mut DocView,
 ) -> bool {
-    let pointer = ui.input(|i| i.pointer.hover_pos().or(i.pointer.interact_pos()));
+    let pointer = ptr.pos;
     let lv = &mut view.links;
     if let Some((dp, start)) = lv.drag
         && dp == page
     {
-        if resp.drag_stopped() || !ui.input(|i| i.pointer.primary_down()) {
+        if resp.drag_stopped() || !ptr.primary_down {
             lv.drag = None;
             let end = pointer.unwrap_or(start);
             let r = Rect::from_two_pos(start, end).intersect(xf.rect);
@@ -104,7 +107,7 @@ pub(crate) fn page_input(
         return true;
     }
     if resp.drag_started() {
-        let origin = ui.input(|i| i.pointer.press_origin()).unwrap_or(p);
+        let origin = ptr.origin.unwrap_or(p);
         lv.drag = Some((page, origin));
         return true;
     }
@@ -112,7 +115,7 @@ pub(crate) fn page_input(
 }
 
 /// Outlines of the page's links (selected one bold) and the rectangle being drawn.
-pub(crate) fn paint(ui: &egui::Ui, painter: &egui::Painter, xf: &PageXform, page: usize, info: &DocInfo, links: &[LinkItem], view: &DocView) {
+pub(crate) fn paint(painter: &egui::Painter, xf: &PageXform, page: usize, info: &DocInfo, links: &[LinkItem], view: &DocView, pointer: Option<Pos2>) {
     for l in links.iter().filter(|l| l.page == page) {
         let r = screen_rect(xf, info, page, l.rect);
         let selected = view.links.selected == Some((page, l.index));
@@ -123,7 +126,7 @@ pub(crate) fn paint(ui: &egui::Ui, painter: &egui::Painter, xf: &PageXform, page
             egui::StrokeKind::Outside,
         );
     }
-    if let (Some((dp, start)), Some(p)) = (view.links.drag, ui.input(|i| i.pointer.hover_pos()))
+    if let (Some((dp, start)), Some(p)) = (view.links.drag, pointer)
         && dp == page
     {
         let r = Rect::from_two_pos(start, p);
@@ -226,7 +229,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut LinkDraft, pages: usize, t: &Token
     widgets::section_title(ui, tl!("Link Appearance"));
     egui::Grid::new("link-appearance").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
         ui.label(tl!("Link Type:"));
-        egui::ComboBox::from_id_salt("link-type")
+        craft_ui::ComboBox::from_id_salt("link-type")
             .selected_text(if d.style.visible { tl!("Visible Rectangle") } else { tl!("Invisible Rectangle") })
             .show_ui(ui, |ui| {
                 ui.selectable_value(&mut d.style.visible, true, tl!("Visible Rectangle"));
@@ -234,7 +237,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut LinkDraft, pages: usize, t: &Token
             });
         ui.end_row();
         ui.label(tl!("Highlight Style:"));
-        egui::ComboBox::from_id_salt("link-hl").selected_text(tl!(d.style.highlight.label())).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("link-hl").selected_text(tl!(d.style.highlight.label())).show_ui(ui, |ui| {
             for h in LinkHighlight::ALL {
                 ui.selectable_value(&mut d.style.highlight, h, tl!(h.label()));
             }
@@ -242,7 +245,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut LinkDraft, pages: usize, t: &Token
         ui.end_row();
         if d.style.visible {
             ui.label(tl!("Line Thickness:"));
-            egui::ComboBox::from_id_salt("link-w")
+            craft_ui::ComboBox::from_id_salt("link-w")
                 .selected_text(if d.style.width <= 1.0 {
                     tl!("Thin")
                 } else if d.style.width <= 2.0 {
@@ -264,7 +267,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut LinkDraft, pages: usize, t: &Token
             } else {
                 0
             };
-            egui::ComboBox::from_id_salt("link-s").selected_text(tl!(["Solid", "Dashed", "Underline"][style])).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("link-s").selected_text(tl!(["Solid", "Dashed", "Underline"][style])).show_ui(ui, |ui| {
                 for (k, l) in ["Solid", "Dashed", "Underline"].iter().enumerate() {
                     ui.selectable_value(&mut style, k, tl!(l));
                 }
@@ -288,7 +291,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut LinkDraft, pages: usize, t: &Token
         ui.add_enabled_ui(d.web, |ui| {
             ui.horizontal(|ui| {
                 ui.add_space(24.0);
-                ui.add(crate::widgets::line(&mut d.url).desired_width(360.0).hint_text("https://example.org"));
+                ui.add(crate::widgets::line(&mut d.url).desired_width(360.0).hint_text("https://example.org")).accessible_name(tl!("Link URL"));
             });
         });
         widgets::radio_value(ui, &mut d.web, false, tl!("Go to a page view"));
diff --git a/crates/ui-egui/src/measure_ui.rs b/crates/ui-egui/src/tools/measure_ui.rs
similarity index 97%
rename from crates/ui-egui/src/measure_ui.rs
rename to crates/ui-egui/src/tools/measure_ui.rs
index 658457499a..2e9e600dfc 100644
--- a/crates/ui-egui/src/measure_ui.rs
+++ b/crates/ui-egui/src/tools/measure_ui.rs
@@ -196,7 +196,7 @@ pub(crate) fn page_input(
         let v = info.user_to_view(p[0] as f32, p[1] as f32);
         xf.norm_to_screen(v[0] / xf.pw, v[1] / xf.ph)
     };
-    let pos = ui.input(|i| i.pointer.hover_pos()).filter(|p| xf.rect.contains(*p));
+    let pos = cx.ptr.within(xf.rect);
     let mut hover = None;
     let mut snap = None;
     if let Some(pos) = pos {
@@ -208,7 +208,7 @@ pub(crate) fn page_input(
             if state.paths.as_ref().is_none_or(|(p, g, _)| *p != page || *g != doc.edit_generation()) {
                 state.paths = Some((page, doc.edit_generation(), doc.measurement_paths(page)));
             }
-            let pixels_per_unit = (xf.rect.width() / xf.pw).max(1e-6);
+            let pixels_per_unit = xf.zoom().max(1e-6);
             if let Some((_, _, Err(e))) = &state.paths {
                 state.error = Some(e.clone());
             }
@@ -353,6 +353,7 @@ fn finish(state: &mut MeasureView, pending: &mut Option<Edit>, doc: &Document, p
 pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
     egui::ScrollArea::vertical().id_salt("measure-panel").show(ui, |ui| panel_body(app, ui, t));
 }
+/// Draw the measurement panel: tool selection, scale calibration, snapping and the current reading.
 fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
     crate::widgets::begin_dialog(ui);
     let Some((index, id)) = app.active_ids() else {
@@ -406,8 +407,8 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
         ui.label(tl!("Click the first point to begin."));
     }
     ui.horizontal(|ui| {
-        ui.label(tl!("Label"));
-        ui.add(crate::widgets::line(&mut state.label).desired_width(130.0).char_limit(128));
+        let label = ui.label(tl!("Label"));
+        ui.add(crate::widgets::line(&mut state.label).desired_width(130.0).char_limit(128)).labelled_by(label.id);
     });
     ui.separator();
     ui.add(widgets::checkbox(&mut state.snap_enabled, tl!("Snap to drawing")));
@@ -429,7 +430,7 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
     ui.horizontal(|ui| {
         ui.label(tl!("Drawing scale")).on_hover_text(tl!("Applying a scale switches units to m / mm."));
         let typed = ui.add(crate::widgets::line(&mut state.ratio_text).hint_text("1:100").desired_width(56.0).char_limit(16));
-        typed.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::TextEdit, true, tl!("Scale")));
+        typed.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TextInput, true, tl!("Scale")));
         state.ratio_dirty |= typed.changed();
         if typed.lost_focus() && std::mem::take(&mut state.ratio_dirty) {
             match parse_ratio(&state.ratio_text) {
@@ -437,7 +438,7 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
                 None => state.error = Some(tl!("Enter a scale such as 1:50.").into()),
             }
         }
-        egui::ComboBox::from_id_salt("measure-common-scales").selected_text(tl!("Common scales")).width(20.0).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("measure-common-scales").selected_text(tl!("Common scales")).width(20.0).show_ui(ui, |ui| {
             for n in RATIOS {
                 if ui.selectable_label(state.ratio_text == format_ratio(n), format_ratio(n)).clicked() {
                     chosen = Some(n);
@@ -448,7 +449,7 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
     ui.horizontal(|ui| {
         ui.add(egui::DragValue::new(&mut state.drawing_points).range(0.000001..=1e9));
         let page_unit = page_unit_of(state.page_unit, &state.unit, units);
-        egui::ComboBox::from_id_salt("measure-page-unit").selected_text(page_unit.label()).width(44.0).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("measure-page-unit").selected_text(page_unit.label()).width(44.0).show_ui(ui, |ui| {
             for u in PageUnit::ALL {
                 if ui.selectable_label(u == page_unit, u.label()).clicked() {
                     state.page_unit = Some(u);
@@ -459,8 +460,8 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
         ui.add(egui::DragValue::new(&mut state.real_distance).range(0.000001..=1e12));
     });
     ui.horizontal(|ui| {
-        ui.label(tl!("Unit"));
-        ui.add(crate::widgets::line(&mut state.unit).desired_width(64.0).char_limit(12));
+        let unit = ui.label(tl!("Unit"));
+        ui.add(crate::widgets::line(&mut state.unit).desired_width(64.0).char_limit(12)).labelled_by(unit.id);
         ui.add(egui::DragValue::new(&mut state.precision).range(0..=6).prefix(format!("{} ", tl!("Decimals"))));
     });
     // A hand edit of the fields leaves the 1:N field showing the old ratio: say the new one.
@@ -480,8 +481,8 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
         }
     }
     ui.horizontal(|ui| {
-        ui.label(tl!("Viewport"));
-        ui.add(crate::widgets::line(&mut state.name).desired_width(130.0).char_limit(128));
+        let viewport = ui.label(tl!("Viewport"));
+        ui.add(crate::widgets::line(&mut state.name).desired_width(130.0).char_limit(128)).labelled_by(viewport.id);
     });
     let apply = ui.add_enabled(doc.allows_annotation(), egui::Button::new(tl!("Apply scale"))).clicked();
     if let Some(error) = &state.error {
diff --git a/crates/ui-egui/src/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
similarity index 95%
rename from crates/ui-egui/src/object_ui.rs
rename to crates/ui-egui/src/tools/object_ui.rs
index b68fe352ae..d495116c6c 100644
--- a/crates/ui-egui/src/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -8,6 +8,7 @@ use pdfcraft_engine::{Document, Edit, EditableObject, MAX_MOVE_OBJECTS, ObjectKi
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
 
 const BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 
@@ -35,6 +36,12 @@ struct Gesture {
 }
 
 impl ObjectSelection {
+    /// Clear any object-selection gesture and the page it was blocking.
+    pub(crate) fn cancel_pointer_gesture(&mut self) {
+        self.gesture = None;
+        self.blocked_page = None;
+    }
+
     pub fn count(&self) -> usize {
         self.selected.len()
     }
@@ -156,18 +163,24 @@ fn leave_single(view: &mut DocView) {
 
 /// Returns true while group selection owns the interaction. Ordinary clicks still reach the
 /// single-object text/resize tools. A text draft is finished or discarded through its editor.
-pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, page: usize, doc: &Document, view: &mut DocView) -> bool {
+pub(crate) fn page_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    xf: &PageXform,
+    ptr: &PagePointer,
+    page: usize,
+    doc: &Document,
+    view: &mut DocView,
+) -> bool {
     if view.objects.input_blocked {
         return true;
     }
     if view.content.draft.is_some() || view.line_editor.as_ref().is_some_and(|e| e.has_changes()) {
         let blocked = view.objects.blocked_page == Some(page);
-        let modifier_press = ui.input(|i| i.pointer.primary_pressed())
-            && modified(ui)
-            && ui.input(|i| i.pointer.interact_pos()).is_some_and(|p| xf.rect.contains(p) && ui.clip_rect().contains(p));
+        let modifier_press = ptr.pressed().is_some() && modified(ui) && ptr.pos.is_some_and(|p| xf.rect.contains(p) && ui.clip_rect().contains(p));
         if blocked || modifier_press {
             view.objects.hold_editor = true;
-            view.objects.blocked_page = ui.input(|i| i.pointer.primary_down()).then_some(page);
+            view.objects.blocked_page = ptr.primary_down.then_some(page);
             if modifier_press {
                 view.objects.notice = Some(tl!("Finish or discard the text being edited before selecting several objects.").into());
             }
@@ -176,14 +189,24 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, p
         return false;
     }
     let mut selection = std::mem::take(&mut view.objects);
-    let result = input(&mut selection, ui, resp, xf, page, doc, view);
+    let result = input(&mut selection, ui, resp, xf, ptr, page, doc, view);
     view.objects = selection;
     result
 }
 
 #[allow(clippy::too_many_arguments)]
-fn input(s: &mut ObjectSelection, ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, page: usize, doc: &Document, view: &mut DocView) -> bool {
-    let (pointer, pressed, down) = ui.input(|i| (i.pointer.interact_pos(), i.pointer.primary_pressed(), i.pointer.primary_down()));
+fn input(
+    s: &mut ObjectSelection,
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    xf: &PageXform,
+    ptr: &PagePointer,
+    page: usize,
+    doc: &Document,
+    view: &mut DocView,
+) -> bool {
+    let pointer = ptr.pos;
+    let (pressed, down) = (ptr.pressed().is_some(), ptr.primary_down);
     let info = &doc.info;
     if s.page == Some(page)
         && let Some(mut gesture) = s.gesture
diff --git a/crates/ui-egui/src/tools/prepare.rs b/crates/ui-egui/src/tools/prepare.rs
new file mode 100644
index 0000000000..9713791e32
--- /dev/null
+++ b/crates/ui-egui/src/tools/prepare.rs
@@ -0,0 +1,759 @@
+//! Prepare a form (Acrobat's Prepare Form, execution plan M6.6): add fields with the field
+//! tools (click for the default size, or drag a rectangle), select, move and resize them, see
+//! their name tags, delete them, and edit them in Field Properties.
+//!
+//! While the Prepare a form panel is open the page shows every field with a light-blue fill and
+//! its name; clicks select fields instead of filling them in, as in Acrobat.
+
+use egui::{Color32, CornerRadius, Pos2, Rect, Stroke, vec2};
+use pdfcraft_engine::form_scripts::{CalcOp, Calculate, DATE_PRESETS, Format, TIME_PRESETS, Validate, format_value};
+use pdfcraft_engine::{BorderStyle, Document, Edit, FieldFont, FieldLook, FieldProps, FormField, FormFieldKind, NewField};
+use pdfcraft_render::DocInfo;
+
+use crate::canvas::{DocView, PageXform};
+use crate::comments;
+use crate::page_pointer::PagePointer;
+use crate::theme;
+use crate::widgets;
+
+mod draft;
+mod properties;
+mod tabs;
+
+pub use draft::{ACTION_KINDS, ActionDraft, FieldDraft, FieldTab};
+pub(crate) use draft::{da_font, da_size};
+pub(crate) use properties::body;
+
+const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
+/// Acrobat's field fill in Prepare Form (light blue).
+pub(crate) const FIELD_FILL: Color32 = Color32::from_rgba_premultiplied(0x1B, 0x34, 0x54, 0x59);
+
+/// The Add form components tools.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum FieldTool {
+    Text,
+    /// Rows and columns of text fields in the area drawn, set up in a window first.
+    TextTable,
+    CheckBox,
+    Radio,
+    Combo,
+    List,
+    Button,
+    Image,
+    Date,
+    Signature,
+}
+
+pub const FIELD_TOOLS: [FieldTool; 10] = [
+    FieldTool::Text,
+    FieldTool::TextTable,
+    FieldTool::CheckBox,
+    FieldTool::Radio,
+    FieldTool::Combo,
+    FieldTool::List,
+    FieldTool::Button,
+    FieldTool::Image,
+    FieldTool::Date,
+    FieldTool::Signature,
+];
+
+impl FieldTool {
+    pub fn command(self) -> &'static str {
+        match self {
+            FieldTool::Text => "form.add.text",
+            FieldTool::TextTable => "form.add.text_table",
+            FieldTool::CheckBox => "form.add.checkbox",
+            FieldTool::Radio => "form.add.radio",
+            FieldTool::Combo => "form.add.combo",
+            FieldTool::List => "form.add.list",
+            FieldTool::Button => "form.add.button",
+            FieldTool::Image => "form.add.image",
+            FieldTool::Date => "form.add.date",
+            FieldTool::Signature => "form.add.signature",
+        }
+    }
+
+    pub fn from_command(id: &str) -> Option<Self> {
+        FIELD_TOOLS.into_iter().find(|t| t.command() == id)
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            FieldTool::Text => "Text field",
+            FieldTool::TextTable => "Text field table",
+            FieldTool::CheckBox => "Checkbox",
+            FieldTool::Radio => "Radio button",
+            FieldTool::Combo => "Drop-down list",
+            FieldTool::List => "List box",
+            FieldTool::Button => "Button",
+            FieldTool::Image => "Image field",
+            FieldTool::Date => "Date field",
+            FieldTool::Signature => "Digital signature",
+        }
+    }
+
+    /// The field a click or drag creates. Radio buttons dropped next to a selected radio group
+    /// join it with the next free choice.
+    pub fn new_field(self, join: Option<&FormField>) -> NewField {
+        match self {
+            // A table's cells are text fields.
+            FieldTool::Text | FieldTool::TextTable => NewField::Text { multiline: false },
+            FieldTool::CheckBox => NewField::CheckBox,
+            FieldTool::Radio => match join.filter(|f| f.kind == FormFieldKind::Radio) {
+                Some(g) => {
+                    let taken: Vec<&str> = g.widgets.iter().filter_map(|w| w.on_state.as_deref()).collect();
+                    let export =
+                        (1..=u64::MAX).map(|i| format!("Choice{i}")).find(|c| !taken.contains(&c.as_str())).unwrap_or_else(|| "Choice".into());
+                    NewField::Radio { group: Some(g.name.clone()), export }
+                }
+                None => NewField::Radio { group: None, export: "Choice1".into() },
+            },
+            FieldTool::Combo => NewField::Combo { options: Vec::new(), editable: false },
+            FieldTool::List => NewField::List { options: Vec::new(), multi: false },
+            FieldTool::Button => NewField::Button { caption: String::new() },
+            FieldTool::Image => NewField::Image,
+            FieldTool::Date => NewField::Date,
+            FieldTool::Signature => NewField::Signature,
+        }
+    }
+
+    /// Width and height in points of a field placed with a single click.
+    pub fn default_size(self) -> (f64, f64) {
+        match self {
+            FieldTool::TextTable => (180.0, 110.0),
+            FieldTool::CheckBox | FieldTool::Radio => (14.0, 14.0),
+            FieldTool::List => (144.0, 54.0),
+            FieldTool::Button => (72.0, 22.0),
+            FieldTool::Image => (144.0, 108.0),
+            FieldTool::Signature => (180.0, 36.0),
+            FieldTool::Date => (108.0, 22.0),
+            FieldTool::Text | FieldTool::Combo => (144.0, 22.0),
+        }
+    }
+}
+
+/// What the pointer is doing to a field.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Grab {
+    /// Drawing a new field from this screen point.
+    Draw(Pos2),
+    /// Selecting fields inside a dragged rectangle.
+    Select(Pos2),
+    Move,
+    /// Resizing by a corner: (moves left edge, moves top edge) in screen terms.
+    Corner(bool, bool),
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct PrepareView {
+    /// The selected field and which of its widgets (the anchor of Align and Match Size).
+    pub selected: Option<(String, usize)>,
+    /// More fields selected with Shift- or ⌘-click.
+    pub also: Vec<(String, usize)>,
+    /// Select the field an Add field edit creates (the form's length before it).
+    pub select_added: Option<usize>,
+    grab: Option<(usize, Grab, Pos2)>,
+    marquee_before: Option<Vec<(String, usize)>>,
+    /// Escape ends egui's drag too; ignore its release until the mouse is up.
+    ignore_release: bool,
+}
+
+impl PrepareView {
+    /// Cancel a preparation marquee without injecting the terminal pointer release that Escape does.
+    pub(crate) fn cancel_pointer_gesture(&mut self) {
+        cancel_marquee(self);
+        // Unlike Escape, control cancellation never injects a terminal pointer release.
+        self.ignore_release = false;
+    }
+
+    /// Unique field names: selecting several widgets of one radio group still edits one field.
+    pub fn names(&self) -> Vec<String> {
+        let mut names = Vec::new();
+        for (name, _) in self.selected.iter().chain(self.also.iter()) {
+            if !names.contains(name) {
+                names.push(name.clone());
+            }
+        }
+        names
+    }
+
+    pub(crate) fn select(&mut self, key: (String, usize), extend: bool) {
+        if !extend || self.selected.is_none() {
+            self.selected = Some(key);
+            self.also.clear();
+        } else if self.selected.as_ref() == Some(&key) {
+            self.selected = if self.also.is_empty() { None } else { Some(self.also.remove(0)) };
+        } else if let Some(index) = self.also.iter().position(|k| *k == key) {
+            self.also.remove(index);
+        } else {
+            self.also.push(key);
+        }
+    }
+}
+
+fn screen_rect(xf: &PageXform, info: &DocInfo, page: usize, r: [f64; 4]) -> Rect {
+    xf.user_rect(info, page, [r[0] as f32, r[1] as f32, r[2] as f32, r[3] as f32])
+}
+
+fn to_user(xf: &PageXform, info: &DocInfo, page: usize, p: Pos2) -> [f64; 2] {
+    let (vx, vy) = xf.screen_to_view(p);
+    let u = info.pages[page].view_to_user(vx, vy);
+    [u[0] as f64, u[1] as f64]
+}
+
+/// Where a table goes, in view space, for a screen rect drawn with the table tool: a click (a rect
+/// under 4 pixels either way) puts the default size's top-left corner at the pointer, moved in from
+/// the page's edges as far as it takes to stay on the page.
+fn table_rect(xf: &PageXform, r: Rect) -> [f64; 4] {
+    let (x0, y0) = xf.screen_to_view(r.min);
+    if r.width() < 4.0 || r.height() < 4.0 {
+        let (pw, ph) = (f64::from(xf.pw), f64::from(xf.ph));
+        let (dw, dh) = FieldTool::TextTable.default_size();
+        // Smaller than the default only on a page smaller than it.
+        let (w, h) = (dw.min(pw), dh.min(ph));
+        let (x, y) = (f64::from(x0).min(pw - w).max(0.0), f64::from(y0).min(ph - h).max(0.0));
+        return [x, y, x + w, y + h];
+    }
+    let (x1, y1) = xf.screen_to_view(r.max);
+    [x0, y0, x1, y1].map(f64::from)
+}
+
+/// A screen rect → a normalised user-space rect.
+fn user_rect(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
+    let (a, b) = (to_user(xf, info, page, r.min), to_user(xf, info, page, r.max));
+    [a[0].min(b[0]), a[1].min(b[1]), a[0].max(b[0]), a[1].max(b[1])]
+}
+
+fn handles(r: Rect) -> [(Pos2, bool, bool); 4] {
+    [(r.left_top(), true, true), (r.right_top(), false, true), (r.left_bottom(), true, false), (r.right_bottom(), false, false)]
+}
+
+/// The rect while a move or resize is in progress. With `shift` held a corner keeps the field's
+/// proportions, as it does for comments and stamps.
+fn dragged(r: Rect, grab: Grab, delta: egui::Vec2, shift: bool) -> Rect {
+    match grab {
+        Grab::Move => r.translate(delta),
+        Grab::Corner(left, top) => {
+            let handle = (if left { -1 } else { 1 }, if top { -1 } else { 1 });
+            comments::resized(r, handle, delta, comments::corner_ratio(r, None, shift))
+        }
+        Grab::Draw(_) | Grab::Select(_) => r,
+    }
+}
+
+pub(crate) struct Outcome {
+    /// The click or drag belonged to Prepare a form.
+    pub consumed: bool,
+    /// Open Field Properties for the selected field.
+    pub properties: bool,
+    /// A field was placed: go back to the Select tool.
+    pub placed: bool,
+    /// A table of text fields was drawn: open its window for this page and area (view space).
+    pub table: Option<(usize, [f64; 4])>,
+}
+
+/// Pointer input on one page while preparing a form.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn page_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    xf: &PageXform,
+    ptr: &PagePointer,
+    page: usize,
+    info: &DocInfo,
+    form: &[FormField],
+    tool: Option<FieldTool>,
+    allowed: bool,
+    view: &mut DocView,
+) -> Outcome {
+    let mut out = Outcome { consumed: false, properties: false, placed: false, table: None };
+    let pointer = ptr.pos;
+    let prep = &mut view.prepare;
+
+    if prep.marquee_before.is_some() && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
+        cancel_marquee(prep);
+        out.consumed = true;
+        return out;
+    }
+    if prep.ignore_release {
+        if !ptr.primary_down {
+            prep.ignore_release = false;
+        }
+        out.consumed = true;
+        return out;
+    }
+
+    // A grab in progress on this page.
+    if let Some((gp, grab, start)) = prep.grab
+        && gp == page
+    {
+        out.consumed = true;
+        if resp.drag_stopped() || !ptr.primary_down {
+            prep.grab = None;
+            let end = pointer.unwrap_or(start);
+            match grab {
+                Grab::Select(from) => {
+                    prep.marquee_before = None;
+                    let rect = Rect::from_two_pos(from, end).intersect(xf.rect);
+                    for f in form {
+                        for (wi, w) in f.widgets.iter().enumerate().filter(|(_, w)| w.page == Some(page)) {
+                            if screen_rect(xf, info, page, w.rect).intersects(rect) {
+                                let key = (f.name.clone(), wi);
+                                if prep.selected.is_none() {
+                                    prep.selected = Some(key);
+                                } else if prep.selected.as_ref() != Some(&key) && !prep.also.contains(&key) {
+                                    prep.also.push(key);
+                                }
+                            }
+                        }
+                    }
+                }
+                Grab::Draw(from) => {
+                    let Some(tool) = tool else { return out };
+                    if tool == FieldTool::TextTable {
+                        out.table = Some((page, table_rect(xf, Rect::from_two_pos(from, end).intersect(xf.rect))));
+                        out.placed = true;
+                        return out;
+                    }
+                    let r = Rect::from_two_pos(from, end).intersect(xf.rect);
+                    let rect = user_rect(xf, info, page, r);
+                    let rect = if r.width() < 4.0 || r.height() < 4.0 {
+                        // A click: the default size, top-left at the pointer.
+                        let at = to_user(xf, info, page, from);
+                        let (w, h) = tool.default_size();
+                        [at[0], at[1] - h, at[0] + w, at[1]]
+                    } else {
+                        rect
+                    };
+                    let join = prep.selected.as_ref().and_then(|(n, _)| form.iter().find(|f| &f.name == n));
+                    prep.select_added = Some(form.len());
+                    view.pending_edit = Some(Edit::AddField { page, rect, kind: tool.new_field(join), name: None });
+                    out.placed = true;
+                }
+                Grab::Move | Grab::Corner(..) => {
+                    let Some((name, wi)) = prep.selected.clone() else { return out };
+                    let Some(w) = form.iter().find(|f| f.name == name).and_then(|f| f.widgets.get(wi)) else { return out };
+                    let delta = end - start;
+                    if delta.length() >= 1.0 {
+                        let shift = ui.input(|i| i.modifiers.shift);
+                        let r = dragged(screen_rect(xf, info, page, w.rect), grab, delta, shift);
+                        let rect = user_rect(xf, info, page, r);
+                        view.pending_edit =
+                            Some(Edit::SetFieldProps { name, props: Box::new(FieldProps { rect: Some((wi, rect)), ..Default::default() }) });
+                    }
+                }
+            }
+        }
+        return out;
+    }
+
+    let Some(p) = pointer.filter(|p| xf.rect.contains(*p)) else { return out };
+    if !allowed {
+        return out;
+    }
+    if let Some(tool) = tool {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
+        if resp.drag_started() || resp.clicked() {
+            let origin = ptr.origin.filter(|o| xf.rect.contains(*o)).unwrap_or(p);
+            prep.grab = Some((page, Grab::Draw(origin), origin));
+            out.consumed = true;
+            if resp.clicked() {
+                // A click without a drag: finish at once.
+                prep.grab = None;
+                if tool == FieldTool::TextTable {
+                    out.table = Some((page, table_rect(xf, Rect::from_min_size(p, egui::Vec2::ZERO))));
+                    out.placed = true;
+                    return out;
+                }
+                let at = to_user(xf, info, page, p);
+                let (w, h) = tool.default_size();
+                let join = prep.selected.as_ref().and_then(|(n, _)| form.iter().find(|f| &f.name == n));
+                prep.select_added = Some(form.len());
+                view.pending_edit = Some(Edit::AddField { page, rect: [at[0], at[1] - h, at[0] + w, at[1]], kind: tool.new_field(join), name: None });
+                out.placed = true;
+            }
+        }
+        return out;
+    }
+
+    // Right-click a field: select it (the context menu acts on it).
+    if resp.secondary_clicked()
+        && let Some((f, wi)) = form.iter().find_map(|f| {
+            f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(p)).map(|(i, _)| (f, i))
+        })
+    {
+        let key = (f.name.clone(), wi);
+        if let Some(i) = prep.also.iter().position(|k| *k == key) {
+            // Part of the selection: it becomes the anchor the others line up with.
+            prep.also.remove(i);
+            if let Some(old) = prep.selected.replace(key) {
+                prep.also.push(old);
+            }
+        } else if prep.selected.as_ref() != Some(&key) {
+            prep.selected = Some(key);
+            prep.also.clear();
+        }
+    }
+    // The Select tool: corner handles of the selection, then fields.
+    let selected_rect = prep
+        .selected
+        .as_ref()
+        .and_then(|(n, wi)| form.iter().find(|f| &f.name == n)?.widgets.get(*wi).filter(|w| w.page == Some(page)))
+        .map(|w| screen_rect(xf, info, page, w.rect));
+    let corner = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(p) <= 6.0));
+    let hit = form.iter().find_map(|f| {
+        f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(p)).map(|(i, _)| (f, i))
+    });
+    if let Some((_, left, top)) = corner {
+        ui.ctx().set_cursor_icon(if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
+    } else if hit.is_some() {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::Move);
+    }
+    if resp.drag_started() {
+        let origin = ptr.origin.unwrap_or(p);
+        if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(origin) <= 6.0)) {
+            prep.grab = Some((page, Grab::Corner(left, top), origin));
+            out.consumed = true;
+        } else if let Some((f, wi)) = form.iter().find_map(|f| {
+            f.widgets
+                .iter()
+                .enumerate()
+                .find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(origin))
+                .map(|(i, _)| (f, i))
+        }) {
+            prep.selected = Some((f.name.clone(), wi));
+            prep.grab = Some((page, Grab::Move, origin));
+            out.consumed = true;
+        } else {
+            prep.marquee_before = Some(prep.selected.iter().chain(prep.also.iter()).cloned().collect());
+            if !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
+                prep.selected = None;
+                prep.also.clear();
+            }
+            prep.grab = Some((page, Grab::Select(origin), origin));
+            out.consumed = true;
+        }
+        return out;
+    }
+    if resp.double_clicked() && hit.is_some() && !ui.input(|i| i.modifiers.shift || i.modifiers.command) {
+        out.consumed = true;
+        out.properties = true;
+        return out;
+    }
+    if resp.clicked() {
+        let extend = ui.input(|i| i.modifiers.shift || i.modifiers.command);
+        match hit {
+            // Shift/⌘-click adds or removes a field from the selection.
+            Some((f, wi)) => {
+                prep.select((f.name.clone(), wi), extend);
+                out.consumed = true;
+            }
+            None if corner.is_none() => {
+                prep.selected = None;
+                prep.also.clear();
+            }
+            None => out.consumed = true,
+        }
+    }
+    out.consumed |= hit.is_some() && resp.is_pointer_button_down_on();
+    out
+}
+
+/// Align, Center, Distribute and Set Fields to Same Size (Prepare a form, several fields
+/// selected).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Arrange {
+    AlignLeft,
+    AlignRight,
+    AlignTop,
+    AlignBottom,
+    /// Centres on one vertical line (the anchor's).
+    AlignCenterH,
+    /// Centres on one horizontal line.
+    AlignCenterV,
+    DistributeH,
+    DistributeV,
+    SameWidth,
+    SameHeight,
+    SameSize,
+}
+
+impl Arrange {
+    pub fn label(self) -> &'static str {
+        match self {
+            Arrange::AlignLeft | Arrange::AlignRight | Arrange::AlignTop | Arrange::AlignBottom | Arrange::AlignCenterH | Arrange::AlignCenterV => {
+                "Align fields"
+            }
+            Arrange::DistributeH | Arrange::DistributeV => "Distribute fields",
+            Arrange::SameWidth | Arrange::SameHeight | Arrange::SameSize => "Match field sizes",
+        }
+    }
+}
+
+/// The edits that arrange the selected widgets (user space; the anchor stays put).
+pub fn arrange(form: &[FormField], anchor: &(String, usize), others: &[(String, usize)], op: Arrange) -> Option<Edit> {
+    let rect_of = |k: &(String, usize)| form.iter().find(|f| f.name == k.0).and_then(|f| f.widgets.get(k.1)).map(|w| w.rect);
+    let a = rect_of(anchor)?;
+    let mut items: Vec<((String, usize), [f64; 4])> = others.iter().filter_map(|k| rect_of(k).map(|r| (k.clone(), r))).collect();
+    if items.is_empty() {
+        return None;
+    }
+    let (aw, ah) = (a[2] - a[0], a[3] - a[1]);
+    let mut moved: Vec<((String, usize), [f64; 4])> = Vec::new();
+    match op {
+        Arrange::DistributeH | Arrange::DistributeV => {
+            // Even gaps between all selected fields (the outermost stay).
+            items.push((anchor.clone(), a));
+            if items.len() < 3 {
+                return None;
+            }
+            let horiz = op == Arrange::DistributeH;
+            items.sort_by(|x, y| if horiz { x.1[0].total_cmp(&y.1[0]) } else { y.1[3].total_cmp(&x.1[3]) });
+            let size = |r: &[f64; 4]| if horiz { r[2] - r[0] } else { r[3] - r[1] };
+            let (first, last) = (items[0].1, items[items.len() - 1].1);
+            let span = if horiz { last[2] - first[0] } else { first[3] - last[1] };
+            let total: f64 = items.iter().map(|(_, r)| size(r)).sum();
+            let gap = (span - total) / (items.len() - 1) as f64;
+            let mut at = if horiz { first[0] } else { first[3] };
+            for (k, r) in &items {
+                let s = size(r);
+                let nr = if horiz { [at, r[1], at + s, r[3]] } else { [r[0], at - s, r[2], at] };
+                at = if horiz { at + s + gap } else { at - s - gap };
+                moved.push((k.clone(), nr));
+            }
+        }
+        _ => {
+            for (k, r) in items {
+                let (w, h) = (r[2] - r[0], r[3] - r[1]);
+                let nr = match op {
+                    Arrange::AlignLeft => [a[0], r[1], a[0] + w, r[3]],
+                    Arrange::AlignRight => [a[2] - w, r[1], a[2], r[3]],
+                    Arrange::AlignTop => [r[0], a[3] - h, r[2], a[3]],
+                    Arrange::AlignBottom => [r[0], a[1], r[2], a[1] + h],
+                    Arrange::AlignCenterH => {
+                        let cx = (a[0] + a[2]) / 2.0;
+                        [cx - w / 2.0, r[1], cx + w / 2.0, r[3]]
+                    }
+                    Arrange::AlignCenterV => {
+                        let cy = (a[1] + a[3]) / 2.0;
+                        [r[0], cy - h / 2.0, r[2], cy + h / 2.0]
+                    }
+                    Arrange::SameWidth => [r[0], r[1], r[0] + aw, r[3]],
+                    Arrange::SameHeight => [r[0], r[3] - ah, r[2], r[3]],
+                    _ => [r[0], r[3] - ah, r[0] + aw, r[3]],
+                };
+                moved.push((k, nr));
+            }
+        }
+    }
+    let edits: Vec<Edit> = moved
+        .into_iter()
+        .filter(|(k, nr)| rect_of(k).is_some_and(|r| r.iter().zip(nr).any(|(x, y)| (x - y).abs() > 1e-6)))
+        .map(|((name, wi), rect)| Edit::SetFieldProps { name, props: Box::new(FieldProps { rect: Some((wi, rect)), ..Default::default() }) })
+        .collect();
+    (!edits.is_empty()).then(|| Edit::Batch { label: op.label().into(), edits })
+}
+
+/// Fields with their light-blue fill and name tags, the selection with its handles, and the
+/// rectangle being drawn or dragged to the pages' `pointer`.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn paint_page(
+    ui: &egui::Ui,
+    painter: &egui::Painter,
+    xf: &PageXform,
+    page: usize,
+    info: &DocInfo,
+    form: &[FormField],
+    view: &DocView,
+    pointer: Option<Pos2>,
+) {
+    let prep = &view.prepare;
+    let grab = prep.grab.filter(|(gp, ..)| *gp == page);
+    let zoom = xf.zoom().clamp(0.5, 3.0);
+    for f in form {
+        for (wi, w) in f.widgets.iter().enumerate().filter(|(_, w)| w.page == Some(page)) {
+            let mut r = screen_rect(xf, info, page, w.rect);
+            let selected = prep.selected.as_ref().is_some_and(|(n, i)| n == &f.name && *i == wi);
+            let also = prep.also.iter().any(|(n, i)| n == &f.name && *i == wi);
+            if selected && let (Some((_, g, start)), Some(p)) = (grab, pointer) {
+                r = dragged(r, g, p - start, ui.input(|i| i.modifiers.shift));
+            }
+            painter.rect_filled(r, CornerRadius::ZERO, FIELD_FILL);
+            painter.rect_stroke(
+                r,
+                CornerRadius::ZERO,
+                Stroke::new(if also { 2.0 } else { 1.0 }, if selected || also { SELECT_BLUE } else { Color32::from_gray(90) }),
+                egui::StrokeKind::Inside,
+            );
+            // The name tag: white text on black, clipped to the field.
+            // The full name, as Acrobat shows it: MASTER.first, not first (#2696).
+            let label = f.name.as_str();
+            let font = theme::regular((9.0 * zoom).clamp(7.0, 13.0));
+            let galley = painter.layout_no_wrap(label.to_string(), font, Color32::WHITE);
+            let size = galley.size() + vec2(6.0, 2.0);
+            let tag = Rect::from_center_size(r.center(), size);
+            let clip = painter.clip_rect().intersect(r);
+            let p2 = painter.with_clip_rect(clip);
+            p2.rect_filled(tag, CornerRadius::same(1), if selected { SELECT_BLUE } else { Color32::BLACK });
+            p2.galley(tag.min + vec2(3.0, 1.0), galley, Color32::WHITE);
+            if selected {
+                painter.rect_stroke(r.expand(1.0), CornerRadius::ZERO, Stroke::new(2.0, SELECT_BLUE), egui::StrokeKind::Outside);
+                for (c, ..) in handles(r) {
+                    painter.circle(c, 3.5, Color32::WHITE, Stroke::new(1.5, SELECT_BLUE));
+                }
+            }
+        }
+    }
+    if let (Some((_, Grab::Draw(from) | Grab::Select(from), _)), Some(p)) = (grab, pointer) {
+        let r = Rect::from_two_pos(from, p).intersect(xf.rect);
+        painter.rect_filled(r, CornerRadius::ZERO, FIELD_FILL);
+        painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, SELECT_BLUE), egui::StrokeKind::Inside);
+    }
+}
+
+/// Delete the selected field and every field selected with it (#95), as one undoable step, and
+/// clear the selection.
+pub(crate) fn delete_selected(view: &mut DocView) -> Option<Edit> {
+    let (first, _) = view.prepare.selected.take()?;
+    let mut names = vec![first];
+    for (name, _) in std::mem::take(&mut view.prepare.also) {
+        if !names.contains(&name) {
+            names.push(name);
+        }
+    }
+    if names.len() == 1 {
+        return names.pop().map(|name| Edit::DeleteField { name });
+    }
+    let label = format!("Delete {} fields", names.len());
+    Some(Edit::Batch { label, edits: names.into_iter().map(|name| Edit::DeleteField { name }).collect() })
+}
+
+/// The arrow keys move the selected field a point, Shift and an arrow ten points, as in Acrobat,
+/// as the object nudge does (`object_ui::nudge_keys`) and as dragging it does (#2608). The keys
+/// are consumed before the view turns the page with them; one press is one undo step.
+pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, doc: &Document) {
+    // `consume_key` lets an extra Alt through, and Alt+↑/↓ belongs to Calculation order's move.
+    if ctx.egui_wants_keyboard_input() || view.prepare.grab.is_some() || ctx.input(|i| i.modifiers.alt) {
+        return;
+    }
+    let Some((name, wi)) = view.prepare.selected.clone() else { return };
+    let Some(w) = doc.form.iter().find(|f| f.name == name).and_then(|f| f.widgets.get(wi)) else { return };
+    let Some(page) = w.page else { return };
+    let Some(xf) = view.page_xform(page) else { return };
+    use egui::{Key, Modifiers};
+    let mut step = egui::Vec2::ZERO;
+    ctx.input_mut(|i| {
+        for (key, direction) in [
+            (Key::ArrowLeft, egui::vec2(-1.0, 0.0)),
+            (Key::ArrowRight, egui::vec2(1.0, 0.0)),
+            (Key::ArrowUp, egui::vec2(0.0, -1.0)),
+            (Key::ArrowDown, egui::vec2(0.0, 1.0)),
+        ] {
+            // Shift first: a plain key pattern also matches a Shift press.
+            if i.consume_key(Modifiers::SHIFT, key) {
+                step += direction * 10.0;
+            } else if i.consume_key(Modifiers::NONE, key) {
+                step += direction;
+            }
+        }
+    });
+    if step == egui::Vec2::ZERO {
+        return;
+    }
+    // A point in view space whatever the zoom and whatever way the view is turned; the page's own
+    // rotation turns it into the user-space move the widget's rect is stored in.
+    let c = xf.rect.center();
+    let unit = |d: egui::Vec2| {
+        let (a, b) = (xf.screen_to_view(c), xf.screen_to_view(c + d));
+        let v = egui::vec2(b.0 - a.0, b.1 - a.1);
+        if v.length() > 0.0 { v / v.length() } else { egui::Vec2::ZERO }
+    };
+    let delta = unit(egui::vec2(1.0, 0.0)) * step.x + unit(egui::vec2(0.0, 1.0)) * step.y;
+    let Ok(offset) = doc.object_move_offset(page, [f64::from(delta.x), f64::from(delta.y)]) else { return };
+    let r = w.rect;
+    let rect = [r[0] + offset[0], r[1] + offset[1], r[2] + offset[0], r[3] + offset[1]];
+    view.pending_edit = Some(Edit::SetFieldProps { name, props: Box::new(FieldProps { rect: Some((wi, rect)), ..Default::default() }) });
+}
+
+/// Delete removes the selected fields; Escape clears the selection.
+pub(crate) fn select_all(view: &mut DocView, form: &[FormField]) {
+    let mut selected =
+        form.iter().flat_map(|f| f.widgets.iter().enumerate().filter(|(_, w)| w.page == Some(view.current)).map(|(wi, _)| (f.name.clone(), wi)));
+    view.prepare.selected = selected.next();
+    view.prepare.also = selected.collect();
+}
+
+fn cancel_marquee(prep: &mut PrepareView) {
+    prep.grab = None;
+    prep.ignore_release = true;
+    if let Some(before) = prep.marquee_before.take() {
+        let mut before = before.into_iter();
+        prep.selected = before.next();
+        prep.also = before.collect();
+    }
+}
+
+pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView) {
+    if ctx.egui_wants_keyboard_input() {
+        return;
+    }
+    if view.prepare.marquee_before.is_some() && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
+        cancel_marquee(&mut view.prepare);
+        return;
+    }
+    if view.prepare.selected.is_none() {
+        return;
+    }
+    let (del, esc) = ctx.input(|i| (i.key_pressed(egui::Key::Delete) || i.key_pressed(egui::Key::Backspace), i.key_pressed(egui::Key::Escape)));
+    if del {
+        view.pending_edit = delete_selected(view);
+    } else if esc {
+        view.prepare.selected = None;
+        view.prepare.also.clear();
+    }
+}
+
+/// After an Add field edit: select the new field (the form's last).
+pub(crate) fn after_refresh(view: &mut DocView, form: &[FormField]) {
+    view.prepare.also.retain(|(name, wi)| form.iter().any(|f| &f.name == name && *wi < f.widgets.len()));
+    if let Some(n) = view.prepare.select_added.take() {
+        if form.len() > n
+            && let Some(f) = form.last()
+        {
+            view.prepare.selected = Some((f.name.clone(), 0));
+        } else if let Some((name, _)) = &view.prepare.selected
+            && let Some(f) = form.iter().find(|f| &f.name == name)
+        {
+            // A radio button joined the selected group: select the new button.
+            view.prepare.selected = Some((f.name.clone(), f.widgets.len().saturating_sub(1)));
+        }
+    }
+    if let Some((name, wi)) = &view.prepare.selected
+        && !form.iter().any(|f| &f.name == name && *wi < f.widgets.len())
+    {
+        view.prepare.selected = None;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use egui::pos2;
+
+    use super::*;
+
+    #[test]
+    fn corner_drags_stretch_freely_and_keep_proportions_with_shift() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(196.0, 132.0));
+        let free = dragged(r, Grab::Corner(false, false), vec2(24.0, 0.0), false);
+        assert_eq!(free, Rect::from_min_max(pos2(100.0, 100.0), pos2(220.0, 132.0)));
+        for (left, top) in [(true, true), (false, true), (true, false), (false, false)] {
+            let d = vec2(if left { -48.0 } else { 48.0 }, 0.0);
+            let out = dragged(r, Grab::Corner(left, top), d, true);
+            assert!((out.width() / out.height() - 3.0).abs() < 0.001, "{left} {top}: {out:?}");
+            // The opposite corner stays put.
+            assert_eq!(if left { out.max.x } else { out.min.x }, if left { r.max.x } else { r.min.x });
+            assert_eq!(if top { out.max.y } else { out.min.y }, if top { r.max.y } else { r.min.y });
+        }
+        assert_eq!(dragged(r, Grab::Move, vec2(5.0, 6.0), true), r.translate(vec2(5.0, 6.0)));
+    }
+}
diff --git a/crates/ui-egui/src/tools/prepare/draft.rs b/crates/ui-egui/src/tools/prepare/draft.rs
new file mode 100644
index 0000000000..5bba8fe185
--- /dev/null
+++ b/crates/ui-egui/src/tools/prepare/draft.rs
@@ -0,0 +1,297 @@
+use super::*;
+
+// ───────────────────────────────────────────────────────────────────────── Field Properties
+
+impl crate::PdfCraftApp {
+    /// Open Field Properties for a field of the active document.
+    pub fn open_field_props(&mut self, name: &str, widget: usize) {
+        let Some((index, id)) = self.active_ids() else { return };
+        let names = self.views[index].prepare.names();
+        if names.len() > 1 && names.iter().any(|n| n == name) {
+            let draft = self.session.get(id).map_or(Err("The document is no longer open."), |doc| crate::bulk_fields::Draft::new(doc, names));
+            match draft {
+                Ok(draft) => {
+                    self.field_props = None;
+                    self.bulk_field_props = Some(draft);
+                    self.dialog = Some(crate::Dialog::BulkFieldProps);
+                }
+                Err(why) => self.notify_tr(why),
+            }
+            return;
+        }
+        self.bulk_field_props = None;
+        let Some(f) = self.session.get(id).and_then(|d| d.form.iter().find(|f| f.name == name).cloned()) else { return };
+        let mut d = FieldDraft::new(&f, widget);
+        d.look = self.session.get(id).and_then(|doc| doc.field_look(name));
+        d.check_style = self.session.get(id).and_then(|doc| doc.field_check_style(name));
+        if let Some(o) = d.original.as_mut() {
+            o.look = d.look;
+            o.check_style = d.check_style;
+        }
+        let others: Vec<String> =
+            self.session.get(id).map(|doc| doc.form.iter().filter(|x| x.name != name).map(|x| x.name.clone()).collect()).unwrap_or_default();
+        d.others = others.clone();
+        d.actions = self.session.get(id).map(|doc| doc.field_actions(name)).unwrap_or_default();
+        d.chained = self.session.get(id).map(|doc| doc.field_action_chains(name)).unwrap_or_default();
+        if let Some(o) = d.original.as_mut() {
+            o.others = others;
+            o.actions = d.actions.clone();
+        }
+        self.field_props = Some(d);
+        self.dialog = Some(crate::Dialog::FieldProps);
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FieldTab {
+    General,
+    Appearance,
+    Position,
+    Options,
+    Format,
+    Validate,
+    Calculate,
+    Actions,
+}
+
+/// Actions tab: the "Select Action" choices.
+pub const ACTION_KINDS: [&str; 8] = [
+    "Run a JavaScript",
+    "Open a web link",
+    "Reset a form",
+    "Execute a menu item",
+    "Go to a page view",
+    "Show a field",
+    "Hide a field",
+    "Submit a form",
+];
+
+/// Actions tab: the action being added.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ActionDraft {
+    pub trigger: pdfcraft_engine::FieldTrigger,
+    pub kind: usize,
+    /// The script, URL, field names (comma-separated), menu item or page number.
+    pub text: String,
+}
+
+impl Default for ActionDraft {
+    fn default() -> Self {
+        ActionDraft { trigger: pdfcraft_engine::FieldTrigger::MouseUp, kind: 0, text: String::new() }
+    }
+}
+
+impl ActionDraft {
+    pub fn action(&self) -> Result<pdfcraft_engine::FieldAction, String> {
+        use pdfcraft_engine::FieldAction as A;
+        let t = self.text.trim();
+        let names = || t.split(',').map(str::trim).filter(|s| !s.is_empty()).map(str::to_string).collect::<Vec<_>>();
+        Ok(match self.kind {
+            0 => A::JavaScript(self.text.clone()),
+            1 if !t.is_empty() => A::Uri(t.to_string()),
+            2 => A::Reset(names()),
+            3 => A::Named(if t.is_empty() { "Print".into() } else { t.to_string() }),
+            4 => A::GoTo(t.parse::<usize>().ok().filter(|p| *p >= 1).ok_or("Enter a page number")? - 1),
+            5 if !t.is_empty() => A::ShowHide { fields: names(), hide: false },
+            6 if !t.is_empty() => A::ShowHide { fields: names(), hide: true },
+            7 if !t.is_empty() => A::Submit(t.to_string()),
+            1 | 7 => return Err("Enter a URL".into()),
+            _ => return Err("Enter the field names".into()),
+        })
+    }
+}
+
+/// The Field Properties dialog's working copy.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FieldDraft {
+    pub field: String,
+    pub kind: FormFieldKind,
+    pub widget: usize,
+    pub tab: FieldTab,
+    pub name: String,
+    pub tooltip: String,
+    pub caption: String,
+    pub read_only: bool,
+    pub required: bool,
+    pub multiline: bool,
+    pub limit: bool,
+    pub max_len: usize,
+    pub options: Vec<String>,
+    pub new_option: String,
+    /// `/Ff` as edited on the Options tab.
+    pub flags: u32,
+    /// Field Properties ▸ General ▸ Locked.
+    pub locked: bool,
+    /// `/Q`: 0 left, 1 centre, 2 right.
+    pub quadding: i64,
+    /// `/DV` (text and choices), or the default state (buttons: empty = off).
+    pub default: String,
+    /// Check boxes and radio buttons: this widget's "on" state (export value).
+    pub on_state: String,
+    /// 0 = auto.
+    pub font_size: f64,
+    /// Left, bottom, width, height in points.
+    pub position: [f64; 4],
+    /// `/MK /R`: 0, 90, 180 or 270 degrees counterclockwise.
+    pub rotation: i64,
+    pub look: Option<FieldLook>,
+    /// Check boxes and radio buttons: the mark when on (Options tab).
+    pub check_style: Option<pdfcraft_engine::CheckStyle>,
+    pub format: Format,
+    pub validate: Validate,
+    pub calculate: Calculate,
+    /// Every other field's name (the Calculate tab picks from them).
+    pub others: Vec<String>,
+    /// Actions tab: each trigger's action, and the one being added.
+    pub actions: Vec<(pdfcraft_engine::FieldTrigger, pdfcraft_engine::FieldAction)>,
+    pub new_action: ActionDraft,
+    /// Actions tab: the trigger whose script `new_action` is editing (Edit), if any.
+    pub editing: Option<pdfcraft_engine::FieldTrigger>,
+    /// Actions tab: how many actions the document chains after each trigger's first one. They are
+    /// kept when that first action is replaced.
+    pub chained: Vec<(pdfcraft_engine::FieldTrigger, usize)>,
+    pub(super) original: Box<Option<FieldDraft>>,
+}
+
+pub(crate) fn da_size(da: &str) -> f64 {
+    let mut previous = "";
+    let mut size = 0.0;
+    for token in da.split_whitespace() {
+        if token == "Tf" {
+            size = previous.parse::<f64>().ok().filter(|v| v.is_finite() && *v >= 0.0).unwrap_or(0.0);
+        }
+        previous = token;
+    }
+    size
+}
+
+pub(crate) fn da_font(da: &str) -> &str {
+    let (mut two_back, mut previous, mut font) = ("", "", "Helv");
+    for token in da.split_whitespace() {
+        if token == "Tf" {
+            font = two_back.trim_start_matches('/');
+        }
+        two_back = previous;
+        previous = token;
+    }
+    font
+}
+
+impl FieldDraft {
+    pub fn new(f: &FormField, widget: usize) -> Self {
+        let r = f.widgets.get(widget).map(|w| w.rect).unwrap_or_default();
+        let mut d = FieldDraft {
+            field: f.name.clone(),
+            kind: f.kind,
+            widget,
+            tab: FieldTab::General,
+            // The full name: a dotted name moves the field under those parent fields (#2696).
+            name: f.name.clone(),
+            tooltip: f.tooltip.clone().unwrap_or_default(),
+            caption: f.widgets.get(widget).and_then(|w| w.caption.clone()).unwrap_or_default(),
+            read_only: f.read_only(),
+            required: f.has(pdfcraft_engine::field_flags::REQUIRED),
+            multiline: f.has(pdfcraft_engine::field_flags::MULTILINE),
+            limit: f.max_len.is_some(),
+            max_len: f.max_len.unwrap_or(0),
+            options: f.options.iter().map(|(_, d)| d.clone()).collect(),
+            new_option: String::new(),
+            flags: f.flags,
+            locked: f.locked(),
+            quadding: f.quadding,
+            default: f.default.first().cloned().unwrap_or_default(),
+            on_state: f.widgets.get(widget).and_then(|w| w.on_state.clone()).unwrap_or_default(),
+            font_size: da_size(&f.da),
+            position: [r[0], r[1], r[2] - r[0], r[3] - r[1]],
+            rotation: f.widgets.get(widget).map(|w| w.rotation).unwrap_or(0),
+            look: None,
+            check_style: None,
+            format: f.actions.format.clone(),
+            validate: f.actions.validate.clone(),
+            calculate: f.actions.calculate.clone(),
+            others: Vec::new(),
+            actions: Vec::new(),
+            new_action: ActionDraft::default(),
+            editing: None,
+            chained: Vec::new(),
+            original: Box::new(None),
+        };
+        d.original = Box::new(Some(d.clone()));
+        d
+    }
+
+    pub fn title(&self) -> &'static str {
+        match self.kind {
+            FormFieldKind::Text => "Text Field Properties",
+            FormFieldKind::CheckBox => "Check Box Properties",
+            FormFieldKind::Radio => "Radio Button Properties",
+            FormFieldKind::Combo => "Dropdown Properties",
+            FormFieldKind::List => "List Box Properties",
+            FormFieldKind::PushButton => "Button Properties",
+            FormFieldKind::Signature => "Digital Signature Properties",
+        }
+    }
+
+    pub(super) fn tabs(&self) -> Vec<(FieldTab, &'static str)> {
+        let mut t = vec![(FieldTab::General, "General"), (FieldTab::Appearance, "Appearance"), (FieldTab::Position, "Position")];
+        if self.kind != FormFieldKind::Signature {
+            t.push((FieldTab::Options, "Options"));
+        }
+        if matches!(self.kind, FormFieldKind::Text | FormFieldKind::Combo) {
+            t.extend([(FieldTab::Format, "Format"), (FieldTab::Validate, "Validate"), (FieldTab::Calculate, "Calculate")]);
+        }
+        t.push((FieldTab::Actions, "Actions"));
+        t
+    }
+
+    /// The properties that changed (`None` when nothing did).
+    pub fn props(&self) -> Option<FieldProps> {
+        let o = self.original.as_ref().as_ref()?;
+        let ch = |a: bool, b: bool| (a != b).then_some(a);
+        let p = FieldProps {
+            name: (self.name.trim() != o.name).then(|| self.name.trim().to_string()),
+            tooltip: (self.tooltip != o.tooltip).then(|| self.tooltip.clone()),
+            caption: (self.caption != o.caption).then(|| (self.widget, self.caption.clone())),
+            read_only: ch(self.read_only, o.read_only),
+            required: ch(self.required, o.required),
+            multiline: ch(self.multiline, o.multiline),
+            max_len: ((self.limit, self.max_len) != (o.limit, o.max_len)).then_some((self.limit && self.max_len > 0).then_some(self.max_len)),
+            options: (self.options != o.options).then(|| self.options.clone()),
+            font_size: ((self.font_size - o.font_size).abs() > 1e-6).then_some(self.font_size),
+            rect: (self.position != o.position).then(|| {
+                let [x, y, w, h] = self.position;
+                (self.widget, [x, y, x + w.max(4.0), y + h.max(4.0)])
+            }),
+            rotation: (self.rotation != o.rotation).then_some((self.widget, self.rotation)),
+            look: (self.look != o.look).then_some(self.look).flatten(),
+            appearance: None,
+            check_style: (self.check_style != o.check_style).then_some(self.check_style).flatten(),
+            format: (self.format != o.format).then(|| self.format.clone()),
+            validate: (self.validate != o.validate).then(|| self.validate.clone()),
+            calculate: (self.calculate != o.calculate).then(|| self.calculate.clone()),
+            flags: OPTION_FLAGS.iter().filter(|b| (self.flags ^ o.flags) & **b != 0).map(|b| (*b, self.flags & b != 0)).collect(),
+            quadding: (self.quadding != o.quadding).then_some(self.quadding),
+            locked: ch(self.locked, o.locked),
+            actions: (self.actions != o.actions).then(|| self.actions.clone()),
+            default_value: (self.default != o.default).then(|| (!self.default.is_empty()).then(|| self.default.clone())),
+        };
+        (p != FieldProps::default()).then_some(p)
+    }
+}
+
+/// The `/Ff` bits the Options tab edits.
+const OPTION_FLAGS: [u32; 10] = {
+    use pdfcraft_engine::field_flags as ff;
+    [
+        ff::DO_NOT_SCROLL,
+        ff::RICH_TEXT,
+        ff::PASSWORD,
+        ff::FILE_SELECT,
+        ff::DO_NOT_SPELL_CHECK,
+        ff::COMB,
+        ff::SORT,
+        ff::EDIT,
+        ff::MULTI_SELECT,
+        ff::COMMIT_ON_SEL_CHANGE,
+    ]
+};
diff --git a/crates/ui-egui/src/tools/prepare/properties.rs b/crates/ui-egui/src/tools/prepare/properties.rs
new file mode 100644
index 0000000000..8099d57489
--- /dev/null
+++ b/crates/ui-egui/src/tools/prepare/properties.rs
@@ -0,0 +1,332 @@
+use super::draft::{FieldDraft, FieldTab};
+use super::tabs::{actions_tab, calculate_tab, format_tab, validate_tab};
+use super::*;
+
+/// A check box for a `/Ff` bit (`inverted`: checked when the bit is clear).
+fn flag_box(ui: &mut egui::Ui, flags: &mut u32, bit: u32, inverted: bool, label: &str) {
+    let mut on = (*flags & bit != 0) != inverted;
+    if ui.add(widgets::checkbox(&mut on, label)).changed() {
+        if on != inverted {
+            *flags |= bit;
+        } else {
+            *flags &= !bit;
+        }
+    }
+}
+
+/// Shared PDF `/Q` picker for text and choice-field Options.
+fn alignment(ui: &mut egui::Ui, quadding: &mut i64) {
+    ui.label(tl!("Alignment:"));
+    craft_ui::ComboBox::from_id_salt("quadding")
+        .selected_text(tl!(match (*quadding).clamp(0, 2) {
+            1 => "Center",
+            2 => "Right",
+            _ => "Left",
+        }))
+        .show_ui(ui, |ui| {
+            for (q, label) in [(0, tl!("Left")), (1, tl!("Center")), (2, tl!("Right"))] {
+                ui.selectable_value(quadding, q, label);
+            }
+        });
+}
+
+/// Draw Field Properties; returns (apply, cancel).
+pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) -> (bool, bool) {
+    use crate::widgets;
+    ui.set_width(600.0);
+    ui.label(egui::RichText::new(tl!(d.title())).font(theme::semibold(18.0)));
+    ui.add_space(6.0);
+    ui.horizontal_wrapped(|ui| {
+        for (tab, label) in d.tabs() {
+            if widgets::mode_tab(ui, tl!(label), d.tab == tab).clicked() {
+                d.tab = tab;
+            }
+        }
+    });
+    ui.separator();
+    ui.add_space(6.0);
+    let mut enter = false;
+    // A locked field keeps its properties until it is unlocked (Acrobat greys them out).
+    let was_locked = d.original.as_ref().as_ref().is_some_and(|o| o.locked) && d.locked;
+    if was_locked {
+        ui.label(egui::RichText::new(tl!("This field is locked. Unlock it to change its properties.")).small().color(t.text_muted));
+    }
+    ui.scope(|ui| {
+        if was_locked {
+            ui.disable();
+        }
+        match d.tab {
+            FieldTab::General => {
+                egui::Grid::new("field-general").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
+                    let l = ui.label(tl!("Name:"));
+                    let r = ui.add(crate::widgets::line(&mut d.name).desired_width(340.0)).labelled_by(l.id);
+                    enter |= r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
+                    ui.end_row();
+                    let l = ui.label(tl!("Tooltip:"));
+                    ui.add(crate::widgets::line(&mut d.tooltip).desired_width(340.0)).labelled_by(l.id);
+                    ui.end_row();
+                });
+                ui.add_space(12.0);
+                widgets::section_title(ui, tl!("Common Properties"));
+                ui.add(widgets::checkbox(&mut d.read_only, tl!("Read Only")));
+                ui.add(widgets::checkbox(&mut d.required, tl!("Required")));
+            }
+            FieldTab::Appearance => {
+                egui::Grid::new("field-appearance").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
+                    ui.label(tl!("Font Size:"));
+                    let mut auto = d.font_size == 0.0;
+                    ui.horizontal(|ui| {
+                        if ui.add(widgets::checkbox(&mut auto, tl!("Auto"))).changed() {
+                            d.font_size = if auto { 0.0 } else { 12.0 };
+                        }
+                        ui.add_enabled(
+                            !auto,
+                            egui::DragValue::new(&mut d.font_size).range(2.0..=100.0).clamp_existing_to_range(false).speed(0.25).suffix(" pt"),
+                        );
+                    });
+                    ui.end_row();
+                    if let Some(l) = d.look.as_mut() {
+                        ui.label(tl!("Font:"));
+                        craft_ui::ComboBox::from_id_salt("field-font").selected_text(l.font.label()).show_ui(ui, |ui| {
+                            for f in FieldFont::ALL {
+                                ui.selectable_value(&mut l.font, f, f.label());
+                            }
+                        });
+                        ui.end_row();
+                        ui.label(tl!("Text Color:"));
+                        if let Some(c) = crate::comments::swatch_grid(ui, Some(l.text)) {
+                            l.text = c;
+                        }
+                        ui.end_row();
+                    }
+                });
+                if let Some(l) = d.look.as_mut() {
+                    widgets::section_title(ui, tl!("Borders and Colors"));
+                    egui::Grid::new("field-borders").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
+                        for (index, (label, slot)) in
+                            [(tl!("Border Color:"), &mut l.border), (tl!("Fill Color:"), &mut l.fill)].into_iter().enumerate()
+                        {
+                            ui.label(label);
+                            ui.push_id(("field-color", index), |ui| {
+                                ui.horizontal(|ui| {
+                                    let mut none = slot.is_none();
+                                    if ui.add(widgets::checkbox(&mut none, tl!("No color"))).changed() {
+                                        *slot = if none { None } else { Some([0.0; 3]) };
+                                    }
+                                    if let Some(c) = crate::comments::swatch_grid(ui, *slot) {
+                                        *slot = Some(c);
+                                    }
+                                });
+                            });
+                            ui.end_row();
+                        }
+                        ui.label(tl!("Line Thickness:"));
+                        let thick = |w: f64| {
+                            if w <= 1.0 {
+                                tl!("Thin")
+                            } else if w <= 2.0 {
+                                tl!("Medium")
+                            } else {
+                                tl!("Thick")
+                            }
+                        };
+                        craft_ui::ComboBox::from_id_salt("field-width").selected_text(thick(l.width)).show_ui(ui, |ui| {
+                            for (w, label) in [(1.0, tl!("Thin")), (2.0, tl!("Medium")), (3.0, tl!("Thick"))] {
+                                ui.selectable_value(&mut l.width, w, label);
+                            }
+                        });
+                        ui.end_row();
+                        ui.label(tl!("Line Style:"));
+                        craft_ui::ComboBox::from_id_salt("field-style").selected_text(tl!(l.style.label())).show_ui(ui, |ui| {
+                            for s in BorderStyle::ALL {
+                                ui.selectable_value(&mut l.style, s, tl!(s.label()));
+                            }
+                        });
+                        ui.end_row();
+                    });
+                }
+            }
+            FieldTab::Position => {
+                egui::Grid::new("field-position").num_columns(4).spacing([12.0, 10.0]).show(ui, |ui| {
+                    for (i, label) in [tl!("Left:"), tl!("Bottom:"), tl!("Width:"), tl!("Height:")].into_iter().enumerate() {
+                        ui.label(label);
+                        let range = if i < 2 { -14_400.0..=14_400.0 } else { 4.0..=14_400.0 };
+                        ui.add(egui::DragValue::new(&mut d.position[i]).range(range).speed(0.5).suffix(" pt"));
+                        if i % 2 == 1 {
+                            ui.end_row();
+                        }
+                    }
+                });
+                ui.label(egui::RichText::new(tl!("Points from the page's bottom-left corner.")).small().color(t.text_faint));
+                ui.add_space(8.0);
+                ui.horizontal(|ui| {
+                    let l = ui.label(tl!("Rotation:"));
+                    let before = d.rotation;
+                    craft_ui::ComboBox::from_id_salt("field-rotation")
+                        .selected_text(format!("{}°", d.rotation))
+                        .show_ui(ui, |ui| {
+                            for r in [0, 90, 180, 270] {
+                                if ui.selectable_value(&mut d.rotation, r, format!("{r}°")).changed() && (before % 180 == 0) != (r % 180 == 0) {
+                                    // Keep the same center. set_props skips its own swap when the rect changed too.
+                                    let [x, y, w, h] = d.position;
+                                    let (cx, cy) = (x + w / 2.0, y + h / 2.0);
+                                    d.position = [cx - h / 2.0, cy - w / 2.0, h, w];
+                                }
+                            }
+                        })
+                        .response
+                        .labelled_by(l.id);
+                });
+            }
+            FieldTab::Format => format_tab(ui, d, t),
+            FieldTab::Validate => validate_tab(ui, d),
+            FieldTab::Calculate => calculate_tab(ui, d, t),
+            FieldTab::Actions => actions_tab(ui, d, t),
+            FieldTab::Options => match d.kind {
+                FormFieldKind::PushButton => {
+                    ui.horizontal(|ui| {
+                        let l = ui.label(tl!("Label"));
+                        ui.add(crate::widgets::line(&mut d.caption).desired_width(340.0)).labelled_by(l.id);
+                    });
+                }
+                FormFieldKind::Text => {
+                    use pdfcraft_engine::field_flags as ff;
+                    egui::Grid::new("text-options").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
+                        alignment(ui, &mut d.quadding);
+                        ui.end_row();
+                        let l = ui.label(tl!("Default Value:"));
+                        ui.add(crate::widgets::line(&mut d.default).desired_width(260.0)).labelled_by(l.id);
+                        ui.end_row();
+                    });
+                    ui.add_space(6.0);
+                    ui.add(widgets::checkbox(&mut d.multiline, tl!("Multi-line")));
+                    flag_box(ui, &mut d.flags, ff::DO_NOT_SCROLL, true, tl!("Scroll long text"));
+                    flag_box(ui, &mut d.flags, ff::RICH_TEXT, false, tl!("Allow Rich Text Formatting"));
+                    ui.horizontal(|ui| {
+                        ui.add(widgets::checkbox(&mut d.limit, tl!("Limit of")));
+                        ui.add_enabled(d.limit, egui::DragValue::new(&mut d.max_len).range(0..=10_000));
+                        ui.label(tl!("characters"));
+                    });
+                    flag_box(ui, &mut d.flags, ff::PASSWORD, false, tl!("Password"));
+                    flag_box(ui, &mut d.flags, ff::FILE_SELECT, false, tl!("Field is used for file selection"));
+                    flag_box(ui, &mut d.flags, ff::DO_NOT_SPELL_CHECK, true, tl!("Check spelling"));
+                    ui.horizontal(|ui| {
+                        flag_box(ui, &mut d.flags, ff::COMB, false, tl!("Comb of"));
+                        if d.flags & ff::COMB != 0 {
+                            d.limit = true;
+                            d.multiline = false;
+                            d.flags &= !(ff::PASSWORD | ff::FILE_SELECT);
+                            if d.max_len == 0 {
+                                d.max_len = 10;
+                            }
+                        }
+                        ui.add_enabled(d.flags & ff::COMB != 0, egui::DragValue::new(&mut d.max_len).range(1..=500));
+                        ui.label(tl!("characters"));
+                    });
+                }
+                FormFieldKind::CheckBox | FormFieldKind::Radio => {
+                    use pdfcraft_engine::field_flags as ff;
+                    let on = d.on_state.clone();
+                    ui.label(crate::i18n::fmt(tl!("Export Value: {on}"), &[("on", &on)]));
+                    let mut checked = !d.default.is_empty() && d.default == on;
+                    let label =
+                        if d.kind == FormFieldKind::CheckBox { tl!("Check box is checked by default") } else { tl!("Button is checked by default") };
+                    if ui.add(widgets::checkbox(&mut checked, label)).changed() {
+                        d.default = if checked { on } else { String::new() };
+                    }
+                    if let Some(style) = d.check_style.as_mut() {
+                        ui.horizontal(|ui| {
+                            let l = ui.label(tl!(if d.kind == FormFieldKind::CheckBox { "Check Box Style:" } else { "Button Style:" }));
+                            craft_ui::ComboBox::from_id_salt("check-style")
+                                .selected_text(tl!(style.label()))
+                                .show_ui(ui, |ui| {
+                                    for s in pdfcraft_engine::CheckStyle::ALL {
+                                        ui.selectable_value(style, s, tl!(s.label()));
+                                    }
+                                })
+                                .response
+                                .labelled_by(l.id);
+                        });
+                    }
+                    if d.kind == FormFieldKind::Radio {
+                        flag_box(ui, &mut d.flags, ff::RADIOS_IN_UNISON, false, tl!("Buttons with the same name and value are selected in unison"));
+                    }
+                }
+                _ => {
+                    ui.horizontal(|ui| alignment(ui, &mut d.quadding));
+                    ui.add_space(6.0);
+                    ui.horizontal(|ui| {
+                        let l = ui.label(tl!("Item:"));
+                        let r = ui.add(crate::widgets::line(&mut d.new_option).desired_width(240.0)).labelled_by(l.id);
+                        let typed = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
+                        if (widgets::pill_button(ui, tl!("Add"), false).clicked() || typed) && !d.new_option.trim().is_empty() {
+                            d.options.push(d.new_option.trim().to_string());
+                            d.new_option.clear();
+                        }
+                    });
+                    ui.add_space(6.0);
+                    widgets::section_title(ui, tl!("Item List"));
+                    let mut remove = None;
+                    let mut up = None;
+                    egui::ScrollArea::vertical().max_height(140.0).show(ui, |ui| {
+                        for (i, o) in d.options.iter().enumerate() {
+                            ui.horizontal(|ui| {
+                                ui.label(o);
+                                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                                    if ui.small_button(tl!("Delete")).on_hover_text(crate::i18n::fmt(tl!("Delete {o}"), &[("o", o)])).clicked() {
+                                        remove = Some(i);
+                                    }
+                                    if i > 0 && ui.small_button(tl!("Up")).clicked() {
+                                        up = Some(i);
+                                    }
+                                });
+                            });
+                        }
+                    });
+                    if let Some(i) = remove {
+                        d.options.remove(i);
+                    }
+                    if let Some(i) = up {
+                        d.options.swap(i - 1, i);
+                    }
+                    if d.options.is_empty() {
+                        ui.label(egui::RichText::new(tl!("Add the choices people pick from.")).color(t.text_muted));
+                    }
+                    use pdfcraft_engine::field_flags as ff;
+                    ui.add_space(6.0);
+                    ui.horizontal(|ui| {
+                        ui.label(tl!("Default:"));
+                        let shown = if d.default.is_empty() { tl!("(none)").to_string() } else { d.default.clone() };
+                        craft_ui::ComboBox::from_id_salt("choice-default").selected_text(shown).show_ui(ui, |ui| {
+                            ui.selectable_value(&mut d.default, String::new(), tl!("(none)"));
+                            for o in d.options.clone() {
+                                ui.selectable_value(&mut d.default, o.clone(), o);
+                            }
+                        });
+                    });
+                    flag_box(ui, &mut d.flags, ff::SORT, false, tl!("Sort items"));
+                    if d.kind == FormFieldKind::Combo {
+                        flag_box(ui, &mut d.flags, ff::EDIT, false, tl!("Allow user to enter custom text"));
+                        flag_box(ui, &mut d.flags, ff::DO_NOT_SPELL_CHECK, true, tl!("Check spelling"));
+                    } else {
+                        flag_box(ui, &mut d.flags, ff::MULTI_SELECT, false, tl!("Multiple selection"));
+                    }
+                    flag_box(ui, &mut d.flags, ff::COMMIT_ON_SEL_CHANGE, false, tl!("Commit selected value immediately"));
+                }
+            },
+        }
+    });
+    ui.add_space(8.0);
+    ui.add(widgets::checkbox(&mut d.locked, tl!("Locked")));
+    ui.add_space(6.0);
+    let (mut apply, mut cancel) = (enter, false);
+    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+        if widgets::pill_button(ui, tl!("OK"), true).clicked() {
+            apply = true;
+        }
+        if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+            cancel = true;
+        }
+    });
+    (apply, cancel)
+}
diff --git a/crates/ui-egui/src/tools/prepare/tabs.rs b/crates/ui-egui/src/tools/prepare/tabs.rs
new file mode 100644
index 0000000000..b74e67dd19
--- /dev/null
+++ b/crates/ui-egui/src/tools/prepare/tabs.rs
@@ -0,0 +1,386 @@
+use super::draft::{ACTION_KINDS, ActionDraft, FieldDraft};
+use super::*;
+
+/// The categories of the Format tab.
+#[derive(Clone, Copy, PartialEq)]
+enum Category {
+    None,
+    Number,
+    Percent,
+    Date,
+    Time,
+    Special,
+}
+
+fn category(f: &Format) -> Category {
+    match f {
+        Format::None => Category::None,
+        Format::Number { .. } => Category::Number,
+        Format::Percent { .. } => Category::Percent,
+        Format::Date(_) => Category::Date,
+        Format::Time(_) => Category::Time,
+        Format::Special(_) | Format::Mask(_) => Category::Special,
+    }
+}
+
+const SEPARATORS: [&str; 5] = ["1,234.56", "1234.56", "1.234,56", "1234,56", "1'234.56"];
+
+const NEGATIVES: [&str; 4] = ["-1,234.01", "1,234.01 (red)", "(1,234.01)", "(1,234.01) (red)"];
+
+const SPECIALS: [&str; 5] = ["Zip Code", "Zip Code + 4", "Phone Number", "Social Security Number", "Arbitrary Mask"];
+
+/// Draw the field-format editor for the selected category and its options.
+pub(super) fn format_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) {
+    let cat = category(&d.format);
+    let mut picked = cat;
+    ui.horizontal(|ui| {
+        ui.label(tl!("Select format category:"));
+        craft_ui::ComboBox::from_id_salt("format-cat")
+            .selected_text(tl!(match cat {
+                Category::None => "None",
+                Category::Number => "Number",
+                Category::Percent => "Percentage",
+                Category::Date => "Date",
+                Category::Time => "Time",
+                Category::Special => "Special",
+            }))
+            .show_ui(ui, |ui| {
+                for (c, l) in [
+                    (Category::None, tl!("None")),
+                    (Category::Number, tl!("Number")),
+                    (Category::Percent, tl!("Percentage")),
+                    (Category::Date, tl!("Date")),
+                    (Category::Time, tl!("Time")),
+                    (Category::Special, tl!("Special")),
+                ] {
+                    ui.selectable_value(&mut picked, c, l);
+                }
+            });
+    });
+    if picked != cat {
+        d.format = match picked {
+            Category::None => Format::None,
+            Category::Number => Format::Number { decimals: 2, sep: 0, neg: 0, currency: String::new(), prepend: true },
+            Category::Percent => Format::Percent { decimals: 2, sep: 0 },
+            Category::Date => Format::Date("mm/dd/yyyy".into()),
+            Category::Time => Format::Time("HH:MM".into()),
+            Category::Special => Format::Special(0),
+        };
+    }
+    ui.add_space(8.0);
+    let sample = match &d.format {
+        Format::Number { .. } | Format::Percent { .. } => "-1234.5",
+        Format::Date(_) => "10/1/2026",
+        Format::Time(_) => "14:05",
+        Format::Special(2) => "5551234567",
+        Format::Special(3) => "123456789",
+        Format::Special(_) => "123456789",
+        _ => "",
+    };
+    match &mut d.format {
+        Format::None => {
+            ui.label(egui::RichText::new(tl!("The value is shown as typed.")).color(t.text_muted));
+        }
+        Format::Number { decimals, sep, neg, currency, prepend } => {
+            egui::Grid::new("fmt-number").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
+                ui.label(tl!("Decimal places:"));
+                ui.add(egui::DragValue::new(decimals).range(0..=10));
+                ui.end_row();
+                ui.label(tl!("Separator style:"));
+                craft_ui::ComboBox::from_id_salt("fmt-sep").selected_text(SEPARATORS[(*sep).min(4) as usize]).show_ui(ui, |ui| {
+                    for (i, s) in SEPARATORS.iter().enumerate() {
+                        ui.selectable_value(sep, i as u8, *s);
+                    }
+                });
+                ui.end_row();
+                ui.label(tl!("Currency symbol:"));
+                ui.horizontal(|ui| {
+                    craft_ui::ComboBox::from_id_salt("fmt-cur")
+                        .selected_text(if currency.is_empty() { tl!("None") } else { currency.as_str() })
+                        .width(70.0)
+                        .show_ui(ui, |ui| {
+                            for c in ["", "$", "€", "£", "¥", "CHF "] {
+                                ui.selectable_value(currency, c.to_string(), if c.is_empty() { tl!("None") } else { c });
+                            }
+                        });
+                    ui.add(widgets::checkbox(prepend, tl!("Before the number")));
+                });
+                ui.end_row();
+                ui.label(tl!("Negative number style:"));
+                craft_ui::ComboBox::from_id_salt("fmt-neg").selected_text(NEGATIVES[(*neg).min(3) as usize]).show_ui(ui, |ui| {
+                    for (i, s) in NEGATIVES.iter().enumerate() {
+                        ui.selectable_value(neg, i as u8, *s);
+                    }
+                });
+                ui.end_row();
+            });
+        }
+        Format::Percent { decimals, sep } => {
+            egui::Grid::new("fmt-pct").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
+                ui.label(tl!("Decimal places:"));
+                ui.add(egui::DragValue::new(decimals).range(0..=10));
+                ui.end_row();
+                ui.label(tl!("Separator style:"));
+                craft_ui::ComboBox::from_id_salt("fmt-psep").selected_text(SEPARATORS[(*sep).min(4) as usize]).show_ui(ui, |ui| {
+                    for (i, s) in SEPARATORS.iter().enumerate() {
+                        ui.selectable_value(sep, i as u8, *s);
+                    }
+                });
+                ui.end_row();
+            });
+        }
+        Format::Date(p) | Format::Time(p) => {
+            let presets: Vec<&str> = if matches!(cat, Category::Time) || picked == Category::Time {
+                TIME_PRESETS.to_vec()
+            } else {
+                DATE_PRESETS.iter().copied().chain(["m/d/yyyy", "mm/dd/yyyy", "yyyy-mm-dd", "dd/mm/yyyy"]).collect()
+            };
+            ui.horizontal(|ui| {
+                ui.label(tl!("Format:"));
+                craft_ui::ComboBox::from_id_salt("fmt-date").selected_text(p.as_str()).width(170.0).show_ui(ui, |ui| {
+                    for pr in presets {
+                        ui.selectable_value(p, pr.to_string(), pr);
+                    }
+                });
+                let custom = ui.label(tl!("Custom:"));
+                ui.add(crate::widgets::line(p).desired_width(120.0)).labelled_by(custom.id);
+            });
+        }
+        Format::Special(n) => {
+            let mut idx = *n as usize;
+            craft_ui::ComboBox::from_id_salt("fmt-special").selected_text(tl!(SPECIALS[idx.min(4)])).show_ui(ui, |ui| {
+                for (i, s) in SPECIALS.iter().enumerate() {
+                    ui.selectable_value(&mut idx, i, tl!(s));
+                }
+            });
+            if idx == 4 {
+                d.format = Format::Mask("999-999".into());
+            } else {
+                *n = idx as u8;
+            }
+        }
+        Format::Mask(m) => {
+            let mut idx = 4usize;
+            craft_ui::ComboBox::from_id_salt("fmt-special").selected_text(tl!(SPECIALS[4])).show_ui(ui, |ui| {
+                for (i, s) in SPECIALS.iter().enumerate() {
+                    ui.selectable_value(&mut idx, i, tl!(s));
+                }
+            });
+            ui.horizontal(|ui| {
+                let mask = ui.label(tl!("Mask:"));
+                ui.add(crate::widgets::line(m).desired_width(160.0)).labelled_by(mask.id);
+            });
+            ui.label(egui::RichText::new(tl!("9 digit, A letter, O letter or digit, X any character")).small().color(t.text_faint));
+            if idx < 4 {
+                d.format = Format::Special(idx as u8);
+            }
+        }
+    }
+    if !sample.is_empty() && d.format != Format::None {
+        ui.add_space(6.0);
+        ui.label(
+            egui::RichText::new(crate::i18n::fmt(tl!("Example: {sample}"), &[("sample", &format_value(&d.format, sample))])).color(t.text_muted),
+        );
+    }
+}
+
+pub(super) fn validate_tab(ui: &mut egui::Ui, d: &mut FieldDraft) {
+    let mut ranged = matches!(d.validate, Validate::Range { .. });
+    widgets::radio_value(ui, &mut ranged, false, tl!("Field value is not validated"));
+    widgets::radio_value(ui, &mut ranged, true, tl!("Field value is in range:"));
+    if !ranged {
+        d.validate = Validate::None;
+        return;
+    }
+    if d.validate == Validate::None {
+        d.validate = Validate::Range { min: Some(0.0), max: Some(100.0) };
+    }
+    if let Validate::Range { min, max } = &mut d.validate {
+        ui.horizontal(|ui| {
+            let mut has = min.is_some();
+            ui.add(widgets::checkbox(&mut has, tl!("From:")));
+            let mut v = min.unwrap_or(0.0);
+            ui.add_enabled(has, egui::DragValue::new(&mut v).speed(1.0));
+            *min = has.then_some(v);
+            let mut has = max.is_some();
+            ui.add(widgets::checkbox(&mut has, tl!("To:")));
+            let mut v = max.unwrap_or(100.0);
+            ui.add_enabled(has, egui::DragValue::new(&mut v).speed(1.0));
+            *max = has.then_some(v);
+        });
+    }
+}
+
+pub(super) fn actions_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) {
+    use pdfcraft_engine::FieldTrigger as T;
+    let editing = d.editing.is_some();
+    ui.label(egui::RichText::new(if editing { tl!("Edit Action") } else { tl!("Add an Action") }).font(theme::semibold(13.0)));
+    let a = &mut d.new_action;
+    egui::Grid::new("field-actions-add").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
+        ui.label(tl!("Select Trigger:"));
+        // Editing changes the script of one trigger's action: its trigger and kind stay.
+        ui.add_enabled_ui(!editing, |ui| {
+            craft_ui::ComboBox::from_id_salt("action-trigger").selected_text(tl!(a.trigger.label())).width(220.0).show_ui(ui, |ui| {
+                for tr in T::ALL {
+                    ui.selectable_value(&mut a.trigger, tr, tl!(tr.label()));
+                }
+            });
+        });
+        ui.end_row();
+        ui.label(tl!("Select Action:"));
+        ui.add_enabled_ui(!editing, |ui| {
+            craft_ui::ComboBox::from_id_salt("action-kind").selected_text(tl!(ACTION_KINDS[a.kind])).width(220.0).show_ui(ui, |ui| {
+                for (i, k) in ACTION_KINDS.iter().enumerate() {
+                    ui.selectable_value(&mut a.kind, i, tl!(k));
+                }
+            });
+        });
+        ui.end_row();
+        let hint = match a.kind {
+            0 => "JavaScript",
+            1 => "https://…",
+            2 => tl!("Fields to reset (comma-separated; empty: all)"),
+            3 => tl!("Print, NextPage, PrevPage, FirstPage or LastPage"),
+            4 => tl!("Page number"),
+            5 | 6 => tl!("Field names (comma-separated)"),
+            _ => tl!("URL to submit to"),
+        };
+        ui.label(if a.kind == 0 { tl!("Script:") } else { tl!("Value:") });
+        if a.kind == 0 {
+            ui.add(crate::widgets::block(&mut a.text).code_editor().desired_rows(3).desired_width(340.0).hint_text(hint).id_salt("action-text"));
+        } else {
+            ui.add(crate::widgets::line(&mut a.text).desired_width(340.0).hint_text(hint).id_salt("action-text"));
+        }
+        ui.end_row();
+    });
+    let mut error = None;
+    let (mut commit, mut discard) = (false, false);
+    ui.horizontal(|ui| {
+        commit = ui.button(if editing { tl!("Update") } else { tl!("Add") }).clicked();
+        discard = editing && ui.button(tl!("Discard")).clicked();
+    });
+    if commit {
+        match d.new_action.action() {
+            Ok(act) => {
+                let tr = d.new_action.trigger;
+                d.actions.retain(|(x, _)| *x != tr);
+                d.actions.push((tr, act));
+                d.actions.sort_by_key(|(x, _)| T::ALL.iter().position(|y| y == x));
+                d.new_action.text.clear();
+                d.editing = None;
+            }
+            Err(e) => error = Some(e),
+        }
+    }
+    if discard {
+        d.new_action = ActionDraft::default();
+        d.editing = None;
+    }
+    if let Some(e) = error {
+        ui.label(egui::RichText::new(tl!(&e)).small().color(t.text_muted));
+    }
+    ui.add_space(8.0);
+    ui.label(egui::RichText::new(tl!("Actions")).font(theme::semibold(13.0)));
+    egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(8)).show(ui, |ui| {
+        ui.set_width(ui.available_width());
+        if d.actions.is_empty() {
+            ui.label(egui::RichText::new(tl!("No actions")).color(t.text_muted));
+        }
+        let (mut remove, mut edit) = (None, None);
+        for (i, (tr, act)) in d.actions.iter().enumerate() {
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(tl!(tr.label())).strong());
+                let more = d.chained.iter().find(|(x, _)| x == tr).map_or(0, |(_, n)| *n);
+                if more == 0 {
+                    ui.label(act.describe());
+                } else {
+                    let then = crate::i18n::trn(crate::i18n::current(), more as u64, "then {n} more action", "then {n} more actions");
+                    ui.label(format!("{}, {then}", act.describe()));
+                }
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    ui.push_id(i, |ui| {
+                        if ui.button(tl!("Delete")).clicked() {
+                            remove = Some(i);
+                        }
+                        if let pdfcraft_engine::FieldAction::JavaScript(js) = act
+                            && ui.add_enabled(d.editing.is_none(), egui::Button::new(tl!("Edit"))).clicked()
+                        {
+                            edit = Some((*tr, js.clone()));
+                        }
+                    });
+                });
+            });
+        }
+        if let Some((trigger, text)) = edit {
+            d.new_action = ActionDraft { trigger, kind: 0, text };
+            d.editing = Some(trigger);
+        }
+        if let Some(i) = remove {
+            if d.actions.get(i).map(|(x, _)| Some(*x)) == Some(d.editing) {
+                d.new_action = ActionDraft::default();
+                d.editing = None;
+            }
+            d.actions.remove(i);
+        }
+    });
+}
+
+pub(super) fn calculate_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) {
+    #[derive(PartialEq, Clone, Copy)]
+    enum Mode {
+        None,
+        Simple,
+        Notation,
+    }
+    let mode = match d.calculate {
+        Calculate::None => Mode::None,
+        Calculate::Simple { .. } => Mode::Simple,
+        Calculate::Notation(_) => Mode::Notation,
+    };
+    let mut m = mode;
+    widgets::radio_value(ui, &mut m, Mode::None, tl!("Value is not calculated"));
+    widgets::radio_value(ui, &mut m, Mode::Simple, tl!("Value is the"));
+    if m != mode {
+        d.calculate = match m {
+            Mode::None => Calculate::None,
+            Mode::Simple => Calculate::Simple { op: CalcOp::Sum, fields: Vec::new() },
+            Mode::Notation => Calculate::Notation(String::new()),
+        };
+    }
+    if let Calculate::Simple { op, fields } = &mut d.calculate {
+        ui.horizontal(|ui| {
+            ui.add_space(24.0);
+            craft_ui::ComboBox::from_id_salt("calc-op").selected_text(tl!(op.label())).show_ui(ui, |ui| {
+                for o in CalcOp::ALL {
+                    ui.selectable_value(op, o, tl!(o.label()));
+                }
+            });
+            ui.label(tl!("of the following fields:"));
+        });
+        egui::ScrollArea::vertical().max_height(110.0).show(ui, |ui| {
+            for name in &d.others {
+                let mut on = fields.contains(name);
+                if ui.add(widgets::checkbox(&mut on, name)).changed() {
+                    if on {
+                        fields.push(name.clone());
+                    } else {
+                        fields.retain(|f| f != name);
+                    }
+                }
+            }
+        });
+    }
+    let mut m2 = match d.calculate {
+        Calculate::Notation(_) => Mode::Notation,
+        _ => m,
+    };
+    if widgets::radio_value(ui, &mut m2, Mode::Notation, tl!("Simplified field notation:")).clicked()
+        && !matches!(d.calculate, Calculate::Notation(_))
+    {
+        d.calculate = Calculate::Notation(String::new());
+    }
+    if let Calculate::Notation(expr) = &mut d.calculate {
+        ui.add(crate::widgets::block(expr).hint_text("Price * Quantity").desired_rows(2).desired_width(420.0));
+        ui.label(egui::RichText::new(tl!("Field names with + - * / and parentheses; put \\ before spaces in names.")).small().color(t.text_faint));
+    }
+}
diff --git a/crates/ui-egui/src/redact_ui.rs b/crates/ui-egui/src/tools/redact_ui.rs
similarity index 96%
rename from crates/ui-egui/src/redact_ui.rs
rename to crates/ui-egui/src/tools/redact_ui.rs
index 412fc95997..8e7ac02eef 100644
--- a/crates/ui-egui/src/redact_ui.rs
+++ b/crates/ui-egui/src/tools/redact_ui.rs
@@ -8,6 +8,7 @@ use pdfcraft_engine::{Edit, NewAnnotation, REDACT_PATTERNS, REDACTION_CODE_SETS,
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
+use crate::page_pointer::PagePointer;
 use crate::theme::Tokens;
 use crate::{PdfCraftApp, widgets};
 
@@ -234,20 +235,22 @@ fn to_user(xf: &PageXform, info: &DocInfo, page: usize, p: Pos2) -> [f64; 2] {
 /// Redact tool input on a page. Presses on text are left to text selection (the selection is
 /// marked when it ends, see [`after_text`]); presses elsewhere draw a box. Returns `true` when
 /// the gesture is a box.
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn page_input(
     ui: &egui::Ui,
     resp: &egui::Response,
     xf: &PageXform,
+    ptr: &PagePointer,
     page: usize,
     info: &DocInfo,
     over_text: impl Fn(Pos2) -> bool,
     view: &mut DocView,
 ) -> bool {
-    let pointer = ui.input(|i| i.pointer.hover_pos().or(i.pointer.interact_pos()));
+    let pointer = ptr.pos;
     if let Some((dp, start)) = view.redact_drag
         && dp == page
     {
-        if resp.drag_stopped() || !ui.input(|i| i.pointer.primary_down()) {
+        if resp.drag_stopped() || !ptr.primary_down {
             view.redact_drag = None;
             let end = pointer.unwrap_or(start);
             let r = Rect::from_two_pos(start, end).intersect(xf.rect);
@@ -263,7 +266,7 @@ pub(crate) fn page_input(
         ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
     }
     if resp.drag_started() {
-        let origin = ui.input(|i| i.pointer.press_origin()).unwrap_or(p);
+        let origin = ptr.origin.unwrap_or(p);
         if !over_text(origin) {
             view.redact_drag = Some((page, origin));
             return true;
@@ -283,9 +286,9 @@ pub(crate) fn after_text(resp: &egui::Response, page: usize, info: &DocInfo, vie
     }
 }
 
-/// The box being drawn.
-pub(crate) fn paint(ui: &egui::Ui, painter: &egui::Painter, page: usize, view: &DocView) {
-    if let (Some((dp, start)), Some(p)) = (view.redact_drag, ui.input(|i| i.pointer.hover_pos()))
+/// The box being drawn, to the pages' `pointer`.
+pub(crate) fn paint(painter: &egui::Painter, page: usize, view: &DocView, pointer: Option<Pos2>) {
+    if let (Some((dp, start)), Some(p)) = (view.redact_drag, pointer)
         && dp == page
     {
         let r = Rect::from_two_pos(start, p);
@@ -385,7 +388,7 @@ pub(crate) fn search_body(ui: &mut egui::Ui, d: &mut SearchDraft, t: &Tokens) ->
     widgets::radio_value(ui, &mut d.mode, SearchMode::Phrase, tl!("Single word or phrase"));
     let mut enter = false;
     ui.add_enabled_ui(d.mode == SearchMode::Phrase, |ui| {
-        let r = ui.add(crate::widgets::line(&mut d.text).hint_text(tl!("Text to find")).desired_width(380.0));
+        let r = ui.add(crate::widgets::line(&mut d.text).hint_text(tl!("Text to find")).desired_width(380.0)).accessible_name(tl!("Text to find"));
         enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
     });
     ui.add_space(6.0);
@@ -393,7 +396,8 @@ pub(crate) fn search_body(ui: &mut egui::Ui, d: &mut SearchDraft, t: &Tokens) ->
     let mut import = false;
     ui.add_enabled_ui(d.mode == SearchMode::Words, |ui| {
         egui::ScrollArea::vertical().id_salt("redact-words").max_height(120.0).show(ui, |ui| {
-            ui.add(egui::TextEdit::multiline(&mut d.words).hint_text(tl!("One word or phrase per line")).desired_width(380.0).desired_rows(4));
+            ui.add(egui::TextEdit::multiline(&mut d.words).hint_text(tl!("One word or phrase per line")).desired_width(380.0).desired_rows(4))
+                .accessible_name(tl!("Words or phrases to redact"));
         });
         ui.horizontal(|ui| {
             import = ui.button(tl!("Import list…")).clicked();
@@ -408,7 +412,7 @@ pub(crate) fn search_body(ui: &mut egui::Ui, d: &mut SearchDraft, t: &Tokens) ->
     ui.add_space(6.0);
     widgets::radio_value(ui, &mut d.mode, SearchMode::Patterns, tl!("Patterns"));
     ui.add_enabled_ui(d.mode == SearchMode::Patterns, |ui| {
-        egui::ComboBox::from_id_salt("redact-pattern").selected_text(tl!(d.pattern.label())).width(240.0).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("redact-pattern").selected_text(tl!(d.pattern.label())).width(240.0).show_ui(ui, |ui| {
             for p in REDACT_PATTERNS {
                 ui.selectable_value(&mut d.pattern, p, tl!(p.label()));
             }
@@ -471,7 +475,7 @@ pub(crate) fn props_body(ui: &mut egui::Ui, d: &mut RedactPrefs, _t: &Tokens) ->
                 }
                 let codes_on = on && d.use_code;
                 ui.add_enabled_ui(codes_on, |ui| {
-                    egui::ComboBox::from_id_salt("redaction-code-set").selected_text(d.code_set.name).show_ui(ui, |ui| {
+                    craft_ui::ComboBox::from_id_salt("redaction-code-set").selected_text(d.code_set.name).show_ui(ui, |ui| {
                         for set in REDACTION_CODE_SETS {
                             if ui.selectable_label(d.code_set == set, set.name).clicked() && d.code_set != set {
                                 d.code_set = set;
@@ -501,7 +505,7 @@ pub(crate) fn props_body(ui: &mut egui::Ui, d: &mut RedactPrefs, _t: &Tokens) ->
                 let look = &mut d.look;
                 ui.label(tl!("Font:"));
                 ui.add_enabled_ui(on, |ui| {
-                    egui::ComboBox::from_id_salt("overlay-font").selected_text(look.font.name()).show_ui(ui, |ui| {
+                    craft_ui::ComboBox::from_id_salt("overlay-font").selected_text(look.font.name()).show_ui(ui, |ui| {
                         for f in pdfcraft_engine::OverlayFont::ALL {
                             ui.selectable_value(&mut look.font, f, f.name());
                         }
diff --git a/crates/ui-egui/src/sign_ui.rs b/crates/ui-egui/src/tools/sign_ui.rs
similarity index 52%
rename from crates/ui-egui/src/sign_ui.rs
rename to crates/ui-egui/src/tools/sign_ui.rs
index 25f92530b2..eaf138b2e1 100644
--- a/crates/ui-egui/src/sign_ui.rs
+++ b/crates/ui-egui/src/tools/sign_ui.rs
@@ -10,9 +10,20 @@ use pdfcraft_engine::{SignOptions, SignatureImage, SignatureInfo, SignatureStatu
 
 use crate::canvas::{DocView, PageXform, Snapshot, SnapshotKind};
 use crate::fill_sign::SavedSig;
+use crate::page_pointer::PagePointer;
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, icons, widgets};
 
+mod dialog;
+mod panel;
+
+#[cfg(test)]
+use dialog::detail_lines;
+use dialog::graphic_of;
+pub(crate) use dialog::{appearance_labels, dialog};
+pub(crate) use panel::{CertAction, banner, cert_viewer, panel, signature_status_style};
+pub use panel::{CertTab, CertViewer, PanelAction, certificate_pem};
+
 /// A digital ID the app knows about (Acrobat: Digital ID files). The file stays where it is;
 /// its password is asked for at each signing.
 #[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
@@ -151,9 +162,16 @@ pub struct SignView {
 }
 
 /// Drag a signature rectangle on one page (Digitally sign, Certify (visible signature)).
-pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, page: usize, info: &pdfcraft_render::DocInfo, view: &mut DocView) {
-    let pointer = ui.input(|i| i.pointer.hover_pos());
-    let origin = ui.input(|i| i.pointer.press_origin());
+pub(crate) fn page_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    xf: &PageXform,
+    ptr: &PagePointer,
+    page: usize,
+    info: &pdfcraft_render::DocInfo,
+    view: &mut DocView,
+) {
+    let (pointer, origin) = (ptr.pos, ptr.origin);
     if pointer.is_some_and(|p| xf.rect.contains(p)) {
         ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
     }
@@ -646,846 +664,6 @@ impl PdfCraftApp {
     }
 }
 
-/// Draw the signing dialogs; returns `true` when the dialog should close.
-pub(crate) fn dialog(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
-    let Some(step) = app.sign_draft.as_ref().map(|d| d.step) else { return true };
-    match step {
-        SignStep::Choose => choose(ui, app, t),
-        SignStep::Configure => configure(ui, app, t),
-        SignStep::SignAs => sign_as(ui, app, t),
-    }
-}
-
-fn title(ui: &mut egui::Ui, text: &str) {
-    ui.label(egui::RichText::new(tl!(text)).font(theme::semibold(18.0)));
-    ui.add_space(4.0);
-    ui.separator();
-    ui.add_space(8.0);
-}
-
-fn error(ui: &mut egui::Ui, err: &Option<String>) {
-    if let Some(e) = err.as_ref().filter(|e| !e.is_empty()) {
-        ui.colored_label(Color32::from_rgb(0xD7, 0x37, 0x3F), tl!(e));
-        ui.add_space(4.0);
-    }
-}
-
-fn choose(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
-    title(ui, "Sign with a Digital ID");
-    ui.label(tl!("Choose the digital ID that you want to use for signing:"));
-    ui.add_space(6.0);
-    let ids = app.digital_ids.clone();
-    let Some(d) = app.sign_draft.as_mut() else { return true };
-    let mut close = false;
-    egui::ScrollArea::vertical().max_height(220.0).show(ui, |ui| {
-        for (i, e) in ids.iter().enumerate() {
-            let selected = d.selected == Some(i);
-            let usable = e.unusable.is_none();
-            let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 52.0), egui::Sense::click());
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::RadioButton, usable, selected, &e.name));
-            let fill = if selected {
-                t.accent_soft
-            } else if resp.hovered() && usable {
-                t.hover
-            } else {
-                Color32::TRANSPARENT
-            };
-            ui.painter().rect_filled(rect, CornerRadius::same(6), fill);
-            // An unusable ID is greyed, with the reason where the issuer would be.
-            let (icon, name_color) = if usable { (t.accent, t.text) } else { (t.text_muted, t.text_muted) };
-            icons::paint(ui, Rect::from_min_size(rect.min + vec2(10.0, 15.0), vec2(20.0, 20.0)), "badge-check", 18.0, icon);
-            // Certificate names can be any length: cut both lines with "…" at the row's edge
-            // and show them whole on hover.
-            let line = |text: &str, font: egui::FontId, color: Color32| {
-                let mut job = egui::text::LayoutJob::simple_singleline(text.to_owned(), font, color);
-                job.wrap = egui::text::TextWrapping::truncate_at_width((rect.width() - 50.0).max(0.0));
-                ui.painter().layout_job(job)
-            };
-            let name = line(&e.name, theme::semibold(13.0), name_color);
-            let store = if e.path.starts_with("keychain:") {
-                tl!("Keychain  ·  ").to_string()
-            } else if e.path.starts_with("windows:") {
-                tl!("Windows store  ·  ").to_string()
-            } else {
-                String::new()
-            };
-            let sub = match &e.unusable {
-                Some(reason) => format!("{store}{reason}"),
-                None => format!(
-                    "{store}{email}{issued}{issuer}{expires}{date}",
-                    email = if e.email.is_empty() { String::new() } else { format!("{}  ·  ", e.email) },
-                    issued = tl!("Issued by: "),
-                    issuer = e.issuer,
-                    expires = tl!(", Expires: "),
-                    date = e.expires,
-                ),
-            };
-            let details = line(&sub, theme::regular(11.5), t.text_muted);
-            let elided = name.elided || details.elided;
-            ui.painter().galley(rect.min + vec2(40.0, 9.0), name, name_color);
-            ui.painter().galley(rect.min + vec2(40.0, 28.0), details, t.text_muted);
-            let resp = if elided { resp.on_hover_text(format!("{}\n{sub}", e.name)) } else { resp };
-            if !usable {
-                continue;
-            }
-            if resp.clicked() {
-                d.selected = Some(i);
-                d.confirm_remove = None;
-            }
-            if resp.double_clicked() {
-                d.step = SignStep::SignAs;
-            }
-        }
-        if ids.is_empty() {
-            ui.label(egui::RichText::new(tl!("No digital IDs yet.")).color(t.text_muted));
-        }
-    });
-    ui.add_space(10.0);
-    // Remove takes a digital ID file off the list after asking (#1396); OS key store IDs stay.
-    let mut remove = None;
-    if let Some(e) = d.confirm_remove.and_then(|i| ids.get(i)) {
-        ui.label(crate::i18n::fmt(tl!("Remove \"{name}\" from this list? The file itself is not deleted."), &[("name", &e.name)]));
-        ui.horizontal(|ui| {
-            if widgets::pill_button(ui, tl!("Remove"), true).clicked() {
-                remove = d.confirm_remove;
-            }
-            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                d.confirm_remove = None;
-            }
-        });
-        ui.add_space(10.0);
-    }
-    let removable = d.selected.filter(|&i| ids.get(i).is_some_and(|e| !e.path.starts_with("keychain:") && !e.path.starts_with("windows:")));
-    ui.horizontal(|ui| {
-        if widgets::pill_button(ui, tl!("Configure New Digital ID"), false).clicked() {
-            d.step = SignStep::Configure;
-            d.error = None;
-        }
-        if d.confirm_remove.is_none() && ui.add_enabled_ui(removable.is_some(), |ui| widgets::pill_button(ui, tl!("Remove"), false)).inner.clicked() {
-            d.confirm_remove = removable;
-        }
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if ui.add_enabled_ui(d.selected.is_some(), |ui| widgets::pill_button(ui, tl!("Continue"), true)).inner.clicked() {
-                d.step = SignStep::SignAs;
-                d.error = None;
-            }
-            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                close = true;
-            }
-        });
-    });
-    if let Some(i) = remove {
-        app.remove_digital_id(i);
-    }
-    close
-}
-
-fn configure(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
-    title(ui, "Configure a Digital ID for Signing");
-    let Some(d) = app.sign_draft.as_mut() else { return true };
-    let mut close = false;
-    let mut go = false;
-    // Browse… is desktop-only.
-    #[cfg_attr(target_arch = "wasm32", allow(unused_mut))]
-    let mut browse = false;
-    widgets::radio_value(ui, &mut d.new_id.create, false, tl!("Use a Digital ID from a file"));
-    widgets::radio_value(ui, &mut d.new_id.create, true, tl!("Create a new Digital ID (self-signed, saved to a password-protected file)"));
-    ui.add_space(8.0);
-    let n = &mut d.new_id;
-    if n.create {
-        egui::Grid::new("new-id").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-            for (label, value) in [
-                (tl!("Name"), &mut n.name),
-                (tl!("Organizational Unit"), &mut n.unit),
-                (tl!("Organization Name"), &mut n.organization),
-                (tl!("Email Address"), &mut n.email),
-            ] {
-                let l = ui.label(label);
-                ui.add(crate::widgets::line(value).desired_width(260.0)).labelled_by(l.id);
-                ui.end_row();
-            }
-            let l = ui.label(tl!("Country/Region"));
-            ui.add(crate::widgets::line(&mut n.country).hint_text("US").char_limit(2).desired_width(60.0)).labelled_by(l.id);
-            ui.end_row();
-            ui.label(tl!("Key Algorithm"));
-            egui::ComboBox::from_id_salt("key-alg").selected_text(KEY_ALGORITHMS[n.key].0).show_ui(ui, |ui| {
-                for (i, (label, _)) in KEY_ALGORITHMS.iter().enumerate() {
-                    ui.selectable_value(&mut n.key, i, *label);
-                }
-            });
-            ui.end_row();
-            let l = ui.label(tl!("Password"));
-            ui.add(crate::widgets::line(&mut n.password).password(true).desired_width(200.0)).labelled_by(l.id);
-            ui.end_row();
-            let l = ui.label(tl!("Confirm Password"));
-            ui.add(crate::widgets::line(&mut n.confirm).password(true).desired_width(200.0)).labelled_by(l.id);
-            ui.end_row();
-        });
-        ui.label(
-            egui::RichText::new(tl!("Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others."))
-                .small()
-                .color(t.text_muted),
-        );
-    } else {
-        egui::Grid::new("id-file").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-            let l = ui.label(tl!("File (.p12, .pfx)"));
-            ui.horizontal(|ui| {
-                ui.add(crate::widgets::line(&mut n.file).desired_width(220.0)).labelled_by(l.id);
-                #[cfg(not(target_arch = "wasm32"))]
-                if ui.button(tl!("Browse…")).clicked() {
-                    browse = true;
-                }
-            });
-            ui.end_row();
-            let l = ui.label(tl!("Password"));
-            ui.add(crate::widgets::line(&mut n.file_password).password(true).desired_width(200.0)).labelled_by(l.id);
-            ui.end_row();
-        });
-    }
-    ui.add_space(6.0);
-    error(ui, &d.error);
-    ui.horizontal(|ui| {
-        if !app.digital_ids.is_empty() && widgets::pill_button(ui, tl!("Back"), false).clicked() {
-            d.step = SignStep::Choose;
-            d.error = None;
-        }
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, if d.new_id.create { tl!("Save") } else { tl!("Continue") }, true).clicked() {
-                go = true;
-            }
-            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                close = true;
-            }
-        });
-    });
-    if go {
-        let create = app.sign_draft.as_ref().is_some_and(|d| d.new_id.create);
-        let result = if create { app.create_digital_id() } else { app.import_digital_id() };
-        let Some(d) = app.sign_draft.as_mut() else { return true };
-        match result {
-            Ok(i) => {
-                d.selected = Some(i);
-                d.step = SignStep::Choose;
-                d.error = None;
-                d.new_id = NewIdDraft::default();
-            }
-            Err(e) => d.error = Some(e),
-        }
-    }
-    // The picker answers on a later frame, into the draft if the same dialog is still open.
-    #[cfg(not(target_arch = "wasm32"))]
-    if browse {
-        let dialog = rfd::AsyncFileDialog::new().add_filter(tl!("Digital ID"), &["p12", "pfx"]);
-        let epoch = app.dialog_epoch();
-        app.ask_one(crate::pickers::Ask::File(dialog), None, move |app, p| {
-            // Not one closed meanwhile, or opened again since.
-            if app.dialog_epoch() == epoch
-                && let Some(d) = app.sign_draft.as_mut()
-            {
-                d.new_id.file = p.to_string_lossy().into_owned();
-            }
-        });
-    }
-    #[cfg(target_arch = "wasm32")]
-    let _ = browse;
-    close
-}
-
-/// The appearance preview: Acrobat's standard layout (name left, details right).
-/// The saved signature or image `g` stands for, given the saved Fill & Sign `signature`.
-fn graphic_of(signature: Option<&SavedSig>, g: &SignGraphic) -> Option<SavedSig> {
-    match g {
-        SignGraphic::Name => None,
-        SignGraphic::FillSign => signature.cloned(),
-        SignGraphic::Image(image) => Some(SavedSig::Image(image.clone())),
-    }
-}
-
-/// The words of a visible signature's labels in `lang`, and whether they fell back to English.
-///
-/// The labels are stamped into the document, so they are all in `lang` or all in English, never a
-/// mix. English when `lang` is English; when it is written right to left (its catalog is kept in
-/// display order, not the order a PDF stores text in); when one label has no translation; or when
-/// the signature's font can't draw one (Chinese, Japanese, Cyrillic, Greek in Helvetica), which
-/// signing would refuse. The English words are the sign crate's own, so they can't drift apart.
-pub(crate) fn appearance_labels(lang: crate::i18n::Lang) -> (AppearanceLabels, bool) {
-    let english = AppearanceLabels::default();
-    if lang == crate::i18n::Lang::EN {
-        return (english, false);
-    }
-    let said = |s: &str| (!lang.rtl() && crate::i18n::has(lang, s)).then(|| crate::i18n::tr(lang, s).to_string());
-    let translated = (|| {
-        Some(AppearanceLabels {
-            signed_by: said(&english.signed_by)?,
-            distinguished_name: said(&english.distinguished_name)?,
-            reason: said(&english.reason)?,
-            location: said(&english.location)?,
-            date: said(&english.date)?,
-        })
-    })();
-    match translated.filter(|l| l.first_undrawable().is_none()) {
-        Some(labels) => (labels, false),
-        None => (english, true),
-    }
-}
-
-/// The detail lines of a visible signature, as `sign::pdf` stamps them (the distinguished name
-/// aside, which the dialog doesn't know before the ID is opened): the label above the name, then
-/// the reason, location and date, each after its label. `reason` and `location` are as typed.
-fn detail_lines(a: &Appearance, labels: &AppearanceLabels, name: &str, reason: &str, location: &str, date: &str) -> Vec<String> {
-    let label = |l: &str, v: &str| if a.labels { format!("{l}{v}") } else { v.to_string() };
-    let mut lines = Vec::new();
-    if a.name {
-        if a.labels {
-            lines.push(labels.signed_by.clone());
-        }
-        lines.push(name.to_string());
-    }
-    if a.reason && !reason.trim().is_empty() {
-        lines.push(label(&labels.reason, reason.trim()));
-    }
-    if a.location && !location.trim().is_empty() {
-        lines.push(label(&labels.location, location.trim()));
-    }
-    if a.date {
-        lines.push(label(&labels.date, date));
-    }
-    lines.retain(|l| !l.is_empty());
-    lines
-}
-
-/// The signature as it will look: the graphic (or the name) on the left, the details beside it
-/// (`lines`, from [`detail_lines`] with the labels signing will stamp).
-fn preview(
-    ui: &mut egui::Ui,
-    t: &Tokens,
-    name: &str,
-    a: &Appearance,
-    lines: &[String],
-    graphic: Option<&SavedSig>,
-    cache: &mut Option<(SavedSig, egui::TextureHandle)>,
-) {
-    let (rect, _) = ui.allocate_exact_size(vec2(ui.available_width(), 96.0), egui::Sense::hover());
-    let bg = if t.dark() { Color32::from_gray(0xF4) } else { Color32::WHITE };
-    ui.painter().rect(rect, CornerRadius::same(4), bg, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-    let inner = rect.shrink(10.0);
-    // As in the signature itself: a graphic with no details beside it fills the box.
-    let alone = graphic.is_some() && lines.is_empty();
-    let half = Rect::from_min_size(inner.min, vec2(inner.width() * 0.5 - 6.0, inner.height()));
-    if let Some(g) = graphic {
-        crate::fill_sign::paint_saved(ui, if alone { inner } else { half }, g, cache, "sign-graphic");
-    } else if a.name {
-        let galley = ui.painter().layout(name.to_string(), theme::regular(22.0), Color32::BLACK, half.width());
-        ui.painter().galley(half.left_center() - vec2(0.0, galley.size().y / 2.0), galley, Color32::BLACK);
-    }
-    let x = if (a.name || graphic.is_some()) && !alone { inner.center().x + 6.0 } else { inner.left() };
-    let galley = ui.painter().layout(lines.join("\n"), theme::regular(11.0), Color32::from_gray(0x20), inner.right() - x);
-    ui.painter().galley(egui::pos2(x, inner.center().y - galley.size().y / 2.0), galley, Color32::BLACK);
-}
-
-fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
-    let ids = app.digital_ids.clone();
-    // The time as the signature will show it (signing takes the session clock then).
-    let date = sign::pdf::display_date(&app.session.signing_date());
-    let Some(d) = app.sign_draft.as_mut() else { return true };
-    let Some(entry) = d.selected.and_then(|i| ids.get(i)).cloned() else {
-        d.step = SignStep::Choose;
-        return false;
-    };
-    title(
-        ui,
-        &crate::i18n::fmt(
-            tl!("{verb} as \"{name}\""),
-            &[("verb", if d.certify.is_some() { tl!("Certify") } else { tl!("Sign") }), ("name", &entry.name)],
-        ),
-    );
-    let in_os_key_store = entry.path.starts_with("keychain:") || entry.path.starts_with("windows:");
-    let mut close = false;
-    let mut go = false;
-    #[cfg(not(target_arch = "wasm32"))]
-    let mut pick = false;
-    if d.rect.is_some() || d.field.is_some() {
-        ui.label(egui::RichText::new(tl!("Appearance")).font(theme::semibold(12.5)));
-        let graphic = graphic_of(app.signature.as_ref(), &d.graphic);
-        let (labels, in_english) = appearance_labels(crate::i18n::current());
-        let lines = detail_lines(&d.appearance, &labels, &entry.name, &d.reason, &d.location, &date);
-        preview(ui, t, &entry.name, &d.appearance, &lines, graphic.as_ref(), &mut app.sign_graphic_preview);
-        if in_english && d.appearance.labels {
-            ui.label(
-                egui::RichText::new(tl!("The labels are in English: the signature's font can't draw them in this language."))
-                    .small()
-                    .color(t.text_muted),
-            );
-        }
-        ui.horizontal_wrapped(|ui| {
-            let a = &mut d.appearance;
-            ui.add(widgets::checkbox(&mut a.name, tl!("Name")));
-            ui.add(widgets::checkbox(&mut a.date, tl!("Date")));
-            ui.add(widgets::checkbox(&mut a.reason, tl!("Reason")));
-            ui.add(widgets::checkbox(&mut a.location, tl!("Location")));
-            ui.add(widgets::checkbox(&mut a.distinguished_name, tl!("Distinguished name")));
-            ui.add(widgets::checkbox(&mut a.labels, tl!("Labels")));
-        });
-        // Acrobat: Configure Signature Appearance, Text, Draw or Image.
-        ui.horizontal_wrapped(|ui| {
-            ui.label(tl!("Graphic"));
-            widgets::radio_value(ui, &mut d.graphic, SignGraphic::Name, tl!("Signer's name"));
-            ui.add_enabled_ui(app.signature.is_some(), |ui| {
-                if ui.add(widgets::radio(d.graphic == SignGraphic::FillSign, tl!("Fill & Sign signature"))).clicked() {
-                    d.graphic = SignGraphic::FillSign;
-                }
-            });
-            ui.add_enabled_ui(d.image.is_some(), |ui| {
-                if ui.add(widgets::radio(matches!(d.graphic, SignGraphic::Image(_)), tl!("Image"))).clicked()
-                    && let Some(image) = &d.image
-                {
-                    d.graphic = SignGraphic::Image(image.clone());
-                }
-            });
-            #[cfg(not(target_arch = "wasm32"))]
-            if widgets::pill_button(ui, tl!("Choose image…"), false).clicked() {
-                pick = true;
-            }
-        });
-        ui.add_space(6.0);
-    } else {
-        ui.label(egui::RichText::new(tl!("The signature will be invisible.")).color(t.text_muted));
-    }
-    egui::Grid::new("sign-as").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-        if d.certify.is_some() {
-            ui.label(tl!("Permitted actions after certifying"));
-            let mut p = d.certify.unwrap_or(2);
-            let label = |p: u8| match p {
-                1 => tl!("No changes allowed"),
-                3 => tl!("Annotations, form fill-in, and digital signatures"),
-                _ => tl!("Form fill-in and digital signatures"),
-            };
-            egui::ComboBox::from_id_salt("certify-p").selected_text(label(p)).width(300.0).show_ui(ui, |ui| {
-                for v in [1u8, 2, 3] {
-                    ui.selectable_value(&mut p, v, label(v));
-                }
-            });
-            d.certify = Some(p);
-            ui.end_row();
-        }
-        let l = ui.label(tl!("Reason"));
-        ui.add(crate::widgets::line(&mut d.reason).hint_text(tl!("Optional")).desired_width(260.0)).labelled_by(l.id);
-        ui.end_row();
-        let l = ui.label(tl!("Location"));
-        ui.add(crate::widgets::line(&mut d.location).hint_text(tl!("Optional")).desired_width(260.0)).labelled_by(l.id);
-        ui.end_row();
-        if in_os_key_store {
-            ui.label("");
-            ui.label(
-                egui::RichText::new(if entry.path.starts_with("windows:") {
-                    tl!("The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.")
-                } else {
-                    tl!("The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.")
-                })
-                .small()
-                .color(t.text_muted),
-            );
-        } else {
-            let l = ui.label(tl!("Digital ID password"));
-            let r = ui.add(crate::widgets::line(&mut d.password).password(true).desired_width(200.0)).labelled_by(l.id);
-            if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
-                go = true;
-            }
-        }
-        ui.end_row();
-    });
-    ui.add_space(6.0);
-    error(ui, &d.error);
-    ui.horizontal(|ui| {
-        if widgets::pill_button(ui, tl!("Back"), false).clicked() {
-            d.step = SignStep::Choose;
-            d.error = None;
-        }
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, tl!("Sign"), true).clicked() {
-                go = true;
-            }
-            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                close = true;
-            }
-        });
-    });
-    #[cfg(not(target_arch = "wasm32"))]
-    if pick {
-        app.pick_sign_graphic_image();
-    }
-    if go {
-        match app.finish_signing() {
-            Ok(()) => {
-                app.sign_draft = None;
-                return true;
-            }
-            Err(e) => {
-                if let Some(d) = app.sign_draft.as_mut() {
-                    d.error = Some(e);
-                }
-            }
-        }
-    }
-    close
-}
-
-/// The message bar for signed documents: (icon, colour, template, argument).
-/// The template renders through [`crate::i18n::tr_fmt`] at the call site, so the bar follows
-/// the UI language; names inside `argument` stay as they are.
-pub(crate) fn banner(sigs: &[SignatureInfo]) -> Option<(&'static str, Color32, &'static str, String)> {
-    let signed: Vec<&SignatureInfo> = sigs.iter().filter(|s| s.signed).collect();
-    if signed.is_empty() {
-        return None;
-    }
-    // A valid certification heads the bar only when every signature is valid: it says nothing
-    // about the signatures added after it, so their problems come first.
-    if let Some(c) = signed.iter().find(|s| s.certify.is_some())
-        && signed.iter().all(|s| s.status == SignatureStatus::Valid)
-    {
-        let by = c.certificate.as_ref().map(|x| {
-            let org = x.subject.organization().map(|o| format!(", {o}")).unwrap_or_default();
-            let who = format!("{}{org}", x.display_name());
-            let (template, issuer) = match x.issuer.common_name() {
-                Some(issuer) => ("{who}, certificate issued by {issuer}.", issuer),
-                None => ("{who}, certificate issued by an unknown issuer.", ""),
-            };
-            crate::i18n::fmt(tl!(template), &[("who", &who), ("issuer", issuer)])
-        });
-        return Some(("badge-check", Color32::from_rgb(0x14, 0x73, 0xE6), "Certified by {by}", by.unwrap_or_default()));
-    }
-    Some(if signed.iter().any(|s| s.status == SignatureStatus::Invalid) {
-        ("circle-x", Color32::from_rgb(0xD7, 0x37, 0x3F), "At least one signature is invalid.", String::new())
-    } else if signed.iter().all(|s| s.status == SignatureStatus::Valid) {
-        ("circle-check", Color32::from_rgb(0x2D, 0x9D, 0x78), "Signed and all signatures are valid.", String::new())
-    } else {
-        ("triangle-alert", Color32::from_rgb(0xE6, 0x86, 0x19), "At least one signature has problems.", String::new())
-    })
-}
-
-fn status_icon(s: &SignatureInfo) -> (&'static str, Color32) {
-    if !s.signed {
-        return ("pen-line", Color32::from_gray(0x80));
-    }
-    signature_status_style(s.status)
-}
-
-/// One look per signature verdict, shared by the Signatures panel and the page badges so
-/// the two can't drift apart.
-pub(crate) fn signature_status_style(status: SignatureStatus) -> (&'static str, Color32) {
-    match status {
-        SignatureStatus::Valid => ("circle-check", Color32::from_rgb(0x2D, 0x9D, 0x78)),
-        SignatureStatus::Unknown => ("triangle-alert", Color32::from_rgb(0xE6, 0x86, 0x19)),
-        SignatureStatus::Invalid => ("circle-x", Color32::from_rgb(0xD7, 0x37, 0x3F)),
-    }
-}
-
-/// What the Signatures panel asks the app to do.
-#[derive(Clone, Debug)]
-pub enum PanelAction {
-    Validate,
-    GoTo(usize),
-    Trust(Box<Certificate>),
-    ViewSigned {
-        len: usize,
-        revision: usize,
-    },
-    Sign(String),
-    ExportCertificate(Box<Certificate>),
-    /// Certificate Viewer for the signer's chain (signer first).
-    ViewCertificate(Vec<Certificate>),
-}
-
-/// The Signatures panel body.
-pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, sigs: &[SignatureInfo], expanded: &mut Vec<String>) -> Option<PanelAction> {
-    let mut action = None;
-    ui.horizontal(|ui| {
-        if widgets::pill_button(ui, tl!("Validate all"), false).clicked() {
-            action = Some(PanelAction::Validate);
-        }
-    });
-    ui.add_space(6.0);
-    if sigs.is_empty() {
-        ui.add_space(24.0);
-        ui.vertical_centered(|ui| {
-            ui.add(icons::image("signature", 32.0, t.text_faint));
-            ui.add_space(6.0);
-            ui.label(egui::RichText::new(tl!("This document has no signatures.")).color(t.text_muted));
-        });
-        return action;
-    }
-    let mut ordered: Vec<&SignatureInfo> = sigs.iter().collect();
-    ordered.sort_by_key(|s| (!s.signed, s.revision));
-    for s in ordered {
-        let open = expanded.contains(&s.field);
-        let (icon, color) = status_icon(s);
-        let (template, name) = match (s.signed, s.certify.is_some(), s.signer.as_deref()) {
-            (false, ..) => ("Unsigned signature field: {name}", s.field.as_str()),
-            (true, true, Some(signer)) => ("Rev. {rev}: Certified by {name}", signer),
-            (true, true, None) => ("Rev. {rev}: Certified by an unknown signer", ""),
-            (true, false, Some(signer)) => ("Rev. {rev}: Signed by {name}", signer),
-            (true, false, None) => ("Rev. {rev}: Signed by an unknown signer", ""),
-        };
-        let head = crate::i18n::fmt(tl!(template), &[("rev", &s.revision.to_string()), ("name", name)]);
-        let resp = ui
-            .horizontal(|ui| {
-                let chevron = if open { "chevron-down" } else { "chevron-right" };
-                let toggle = icons::button(ui, chevron, 20.0, false, if open { "Collapse" } else { "Expand" }).clicked();
-                ui.add(icons::image(icon, 16.0, color));
-                let l = ui.add(egui::Label::new(egui::RichText::new(&head).font(theme::semibold(12.5)).color(t.text)).sense(egui::Sense::click()));
-                toggle || l.clicked()
-            })
-            .inner;
-        if resp {
-            if open {
-                expanded.retain(|f| f != &s.field);
-            } else {
-                expanded.push(s.field.clone());
-            }
-        }
-        if !open {
-            continue;
-        }
-        egui::Frame::NONE.inner_margin(egui::Margin { left: 44, right: 4, top: 2, bottom: 8 }).show(ui, |ui| {
-            ui.spacing_mut().item_spacing.y = 3.0;
-            if !s.signed {
-                if widgets::pill_button(ui, tl!("Sign this field…"), true).clicked() {
-                    action = Some(PanelAction::Sign(s.field.clone()));
-                }
-                return;
-            }
-            ui.label(
-                egui::RichText::new(match s.status {
-                    SignatureStatus::Valid => tl!("Signature is valid:"),
-                    SignatureStatus::Unknown => tl!("Signature validity is UNKNOWN:"),
-                    SignatureStatus::Invalid => tl!("Signature is INVALID:"),
-                })
-                .font(theme::semibold(12.0)),
-            );
-            for detail in &s.details {
-                // Each detail is a whole sentence of ours plus what the signature itself says; said
-                // here in the panel's language, with the signature's own words left as they are.
-                let line = detail.said(&crate::i18n::words);
-                ui.add(egui::Label::new(egui::RichText::new(format!("• {line}")).font(theme::regular(11.5)).color(t.text_muted)).wrap());
-            }
-            ui.add_space(4.0);
-            ui.label(egui::RichText::new(tl!("Signature Details")).font(theme::semibold(12.0)));
-            let row = |ui: &mut egui::Ui, k: &str, v: &str| {
-                ui.add(egui::Label::new(egui::RichText::new(format!("{}: {v}", tl!(k))).font(theme::regular(11.5))).wrap());
-            };
-            if let Some(r) = &s.reason {
-                row(ui, "Reason", r);
-            }
-            if let Some(l) = &s.location {
-                row(ui, "Location", l);
-            }
-            if let Some(d) = &s.date {
-                row(ui, "Signing time", &sign::pdf::display_date(d));
-            }
-            if let Some(a) = &s.algorithm {
-                row(ui, "Algorithm", a);
-            }
-            if let Some(c) = &s.certificate {
-                row(ui, "Signer", &c.subject.display());
-                row(ui, "Issued by", &c.issuer.display());
-                row(ui, "Valid", &format!("{} to {}", c.not_before, c.not_after));
-            }
-            match s.page {
-                Some(p) => {
-                    let link = ui.add(
-                        egui::Label::new(
-                            egui::RichText::new(crate::i18n::fmt(
-                                tl!("Field: {field} on page {p}"),
-                                &[("field", &s.field), ("p", &(p + 1).to_string())],
-                            ))
-                            .font(theme::regular(11.5))
-                            .color(t.accent_text)
-                            .underline(),
-                        )
-                        .sense(egui::Sense::click()),
-                    );
-                    if link.clicked() {
-                        action = Some(PanelAction::GoTo(p));
-                    }
-                }
-                None => row(ui, "Field", &s.field),
-            }
-            ui.add_space(4.0);
-            ui.horizontal_wrapped(|ui| {
-                // Trust exactly the signer shown above (s.certificate), not the chain top the
-                // document embedded: trusting an issuer or root is a separate, explicit step in
-                // the Certificate Viewer's Trust tab, which names that certificate.
-                if let Some(c) = s.certificate.as_ref()
-                    && s.status == SignatureStatus::Unknown
-                    && ui.button(tl!("Add to trusted certificates")).clicked()
-                {
-                    action = Some(PanelAction::Trust(Box::new(c.clone())));
-                }
-                if ui.button(tl!("View signed version")).clicked() {
-                    action = Some(PanelAction::ViewSigned { len: s.signed_len, revision: s.revision });
-                }
-                if let Some(c) = &s.certificate
-                    && ui.button(tl!("Show certificate…")).clicked()
-                {
-                    let mut chain = vec![c.clone()];
-                    chain.extend(s.chain.iter().filter(|x| x.raw != c.raw).cloned());
-                    action = Some(PanelAction::ViewCertificate(chain));
-                }
-                if let Some(c) = &s.certificate
-                    && ui.button(tl!("Export certificate…")).clicked()
-                {
-                    action = Some(PanelAction::ExportCertificate(Box::new(c.clone())));
-                }
-            });
-        });
-    }
-    action
-}
-
-/// Certificate Viewer: a chain (the end certificate first) and the tab shown.
-#[derive(Clone, Debug)]
-pub struct CertViewer {
-    pub chain: Vec<Certificate>,
-    pub selected: usize,
-    pub tab: CertTab,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum CertTab {
-    Summary,
-    Details,
-    Trust,
-}
-
-fn hex(bytes: &[u8]) -> String {
-    bytes.iter().map(|b| format!("{b:02X}")).collect::<Vec<_>>().join(" ")
-}
-
-fn key_usage(bits: u16) -> String {
-    const NAMES: [&str; 9] = [
-        "Digital Signature",
-        "Non-Repudiation",
-        "Key Encipherment",
-        "Data Encipherment",
-        "Key Agreement",
-        "Certificate Signing",
-        "CRL Signing",
-        "Encipher Only",
-        "Decipher Only",
-    ];
-    let used: Vec<&str> = NAMES.iter().enumerate().filter(|(i, _)| bits & (1 << i) != 0).map(|(_, n)| tl!(*n)).collect();
-    if used.is_empty() { tl!("None").into() } else { used.join(", ") }
-}
-
-/// What the viewer asks for.
-pub(crate) enum CertAction {
-    Trust(Box<Certificate>),
-    Export(Box<Certificate>),
-}
-
-/// The Certificate Viewer dialog: the chain on the left, the selected certificate's tabs.
-pub(crate) fn cert_viewer(ui: &mut egui::Ui, v: &mut CertViewer, trusted: &[Certificate], t: &Tokens) -> (bool, Option<CertAction>) {
-    title(ui, "Certificate Viewer");
-    ui.label(egui::RichText::new(tl!("This dialog shows the details of a certificate and its chain.")).color(t.text_muted));
-    ui.add_space(8.0);
-    let mut action = None;
-    v.selected = v.selected.min(v.chain.len().saturating_sub(1));
-    ui.horizontal_top(|ui| {
-        // The chain, root at the top (as Acrobat shows it).
-        ui.vertical(|ui| {
-            ui.set_width(200.0);
-            for (depth, i) in (0..v.chain.len()).rev().enumerate() {
-                let c = &v.chain[i];
-                ui.horizontal(|ui| {
-                    ui.add_space(depth as f32 * 12.0);
-                    if ui.selectable_label(v.selected == i, c.display_name()).clicked() {
-                        v.selected = i;
-                    }
-                });
-            }
-        });
-        ui.add_space(16.0);
-        ui.vertical(|ui| {
-            ui.set_width(440.0);
-            let Some(c) = v.chain.get(v.selected).cloned() else { return };
-            ui.horizontal(|ui| {
-                for (tab, label) in [(CertTab::Summary, tl!("Summary")), (CertTab::Details, tl!("Details")), (CertTab::Trust, tl!("Trust"))] {
-                    if widgets::pill_button(ui, label, v.tab == tab).clicked() {
-                        v.tab = tab;
-                    }
-                }
-            });
-            ui.add_space(8.0);
-            let grid = |ui: &mut egui::Ui, rows: Vec<(&str, String)>| {
-                egui::Grid::new(("cert-rows", v.tab as u8)).num_columns(2).spacing([12.0, 5.0]).show(ui, |ui| {
-                    for (k, val) in rows {
-                        ui.label(egui::RichText::new(tl_ctx!("certificate", k)).color(t.text_muted));
-                        ui.add(egui::Label::new(val).wrap());
-                        ui.end_row();
-                    }
-                });
-            };
-            match v.tab {
-                CertTab::Summary => grid(
-                    ui,
-                    vec![
-                        ("Issued to", c.subject.display()),
-                        ("Issued by", c.issuer.display()),
-                        ("Valid from", c.not_before.to_string()),
-                        ("Valid to", c.not_after.to_string()),
-                        ("Intended usage", c.key_usage.map(key_usage).unwrap_or_else(|| tl!("Any").to_string())),
-                    ],
-                ),
-                CertTab::Details => grid(
-                    ui,
-                    vec![
-                        ("Version", "3".into()),
-                        ("Serial number", c.serial_hex()),
-                        ("Issuer", c.issuer.display()),
-                        ("Subject", c.subject.display()),
-                        ("Validity starts", c.not_before.to_string()),
-                        ("Validity ends", c.not_after.to_string()),
-                        ("Public key", c.public_key.describe()),
-                        ("Basic constraints", tl!(if c.is_ca { "Certificate authority" } else { "End entity" }).to_string()),
-                        ("Key usage", c.key_usage.map(key_usage).unwrap_or_else(|| tl!("Not present").to_string())),
-                        ("Self-signed", if c.is_self_signed() { tl!("Yes").to_string() } else { tl!("No").to_string() }),
-                        ("SHA-1 digest", hex(&sign::keys::DigestAlg::Sha1.digest(&[&c.raw]))),
-                        ("SHA-256 digest", hex(&sign::keys::DigestAlg::Sha256.digest(&[&c.raw]))),
-                    ],
-                ),
-                CertTab::Trust => {
-                    let is_trusted = trusted.iter().any(|x| x.raw == c.raw);
-                    let anchored = v.chain.iter().any(|x| trusted.iter().any(|y| y.raw == x.raw));
-                    ui.label(if is_trusted {
-                        tl!("This certificate is in your list of trusted certificates.")
-                    } else if anchored {
-                        tl!("This certificate is trusted through a certificate above it in the chain.")
-                    } else {
-                        tl!("This certificate is not trusted. Signatures made with it show an unknown identity.")
-                    });
-                    ui.add_space(8.0);
-                    if !is_trusted && widgets::pill_button(ui, tl!("Add to Trusted Certificates"), false).clicked() {
-                        action = Some(CertAction::Trust(Box::new(c.clone())));
-                    }
-                }
-            }
-            ui.add_space(8.0);
-            if widgets::pill_button(ui, tl!("Export…"), false).clicked() {
-                action = Some(CertAction::Export(Box::new(c.clone())));
-            }
-        });
-    });
-    ui.add_space(10.0);
-    let mut close = false;
-    ui.horizontal(|ui| ui.with_layout(Layout::right_to_left(Align::Center), |ui| close = widgets::pill_button(ui, tl!("OK"), true).clicked()));
-    (close, action)
-}
-
-/// The text of an exported certificate (`.cer`, PEM).
-pub fn certificate_pem(c: &Certificate) -> String {
-    sign::x509::to_pem(c)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/ui-egui/src/tools/sign_ui/dialog.rs b/crates/ui-egui/src/tools/sign_ui/dialog.rs
new file mode 100644
index 0000000000..ad5ef4b01d
--- /dev/null
+++ b/crates/ui-egui/src/tools/sign_ui/dialog.rs
@@ -0,0 +1,486 @@
+use super::*;
+
+/// Draw the signing dialogs; returns `true` when the dialog should close.
+pub(crate) fn dialog(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
+    let Some(step) = app.sign_draft.as_ref().map(|d| d.step) else { return true };
+    match step {
+        SignStep::Choose => choose(ui, app, t),
+        SignStep::Configure => configure(ui, app, t),
+        SignStep::SignAs => sign_as(ui, app, t),
+    }
+}
+
+pub(super) fn title(ui: &mut egui::Ui, text: &str) {
+    ui.label(egui::RichText::new(tl!(text)).font(theme::semibold(18.0)));
+    ui.add_space(4.0);
+    ui.separator();
+    ui.add_space(8.0);
+}
+
+fn error(ui: &mut egui::Ui, err: &Option<String>) {
+    if let Some(e) = err.as_ref().filter(|e| !e.is_empty()) {
+        ui.colored_label(Color32::from_rgb(0xD7, 0x37, 0x3F), tl!(e));
+        ui.add_space(4.0);
+    }
+}
+
+/// Draw the digital-ID chooser, including unusable certificates and removal confirmation.
+fn choose(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
+    title(ui, "Sign with a Digital ID");
+    ui.label(tl!("Choose the digital ID that you want to use for signing:"));
+    ui.add_space(6.0);
+    let ids = app.digital_ids.clone();
+    let Some(d) = app.sign_draft.as_mut() else { return true };
+    let mut close = false;
+    egui::ScrollArea::vertical().max_height(220.0).show(ui, |ui| {
+        for (i, e) in ids.iter().enumerate() {
+            let selected = d.selected == Some(i);
+            let usable = e.unusable.is_none();
+            let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 52.0), egui::Sense::click());
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::RadioButton, usable, selected, &e.name));
+            let fill = if selected {
+                t.accent_soft
+            } else if resp.hovered() && usable {
+                t.hover
+            } else {
+                Color32::TRANSPARENT
+            };
+            ui.painter().rect_filled(rect, CornerRadius::same(6), fill);
+            // An unusable ID is greyed, with the reason where the issuer would be.
+            let (icon, name_color) = if usable { (t.accent, t.text) } else { (t.text_muted, t.text_muted) };
+            icons::paint(ui, Rect::from_min_size(rect.min + vec2(10.0, 15.0), vec2(20.0, 20.0)), "badge-check", 18.0, icon);
+            // Certificate names can be any length: cut both lines with "…" at the row's edge
+            // and show them whole on hover.
+            let line = |text: &str, font: egui::FontId, color: Color32| {
+                let mut job = egui::text::LayoutJob::simple_singleline(text.to_owned(), font, color);
+                job.wrap = egui::text::TextWrapping::truncate_at_width((rect.width() - 50.0).max(0.0));
+                ui.painter().layout_job(job)
+            };
+            let name = line(&e.name, theme::semibold(13.0), name_color);
+            let store = if e.path.starts_with("keychain:") {
+                tl!("Keychain  ·  ").to_string()
+            } else if e.path.starts_with("windows:") {
+                tl!("Windows store  ·  ").to_string()
+            } else {
+                String::new()
+            };
+            let sub = match &e.unusable {
+                Some(reason) => format!("{store}{reason}"),
+                None => format!(
+                    "{store}{email}{issued}{issuer}{expires}{date}",
+                    email = if e.email.is_empty() { String::new() } else { format!("{}  ·  ", e.email) },
+                    issued = tl!("Issued by: "),
+                    issuer = e.issuer,
+                    expires = tl!(", Expires: "),
+                    date = e.expires,
+                ),
+            };
+            let details = line(&sub, theme::regular(11.5), t.text_muted);
+            let elided = name.elided || details.elided;
+            ui.painter().galley(rect.min + vec2(40.0, 9.0), name, name_color);
+            ui.painter().galley(rect.min + vec2(40.0, 28.0), details, t.text_muted);
+            let resp = if elided { resp.on_hover_text(format!("{}\n{sub}", e.name)) } else { resp };
+            if !usable {
+                continue;
+            }
+            if resp.clicked() {
+                d.selected = Some(i);
+                d.confirm_remove = None;
+            }
+            if resp.double_clicked() {
+                d.step = SignStep::SignAs;
+            }
+        }
+        if ids.is_empty() {
+            ui.label(egui::RichText::new(tl!("No digital IDs yet.")).color(t.text_muted));
+        }
+    });
+    ui.add_space(10.0);
+    // Remove takes a digital ID file off the list after asking (#1396); OS key store IDs stay.
+    let mut remove = None;
+    if let Some(e) = d.confirm_remove.and_then(|i| ids.get(i)) {
+        ui.label(crate::i18n::fmt(tl!("Remove \"{name}\" from this list? The file itself is not deleted."), &[("name", &e.name)]));
+        ui.horizontal(|ui| {
+            if widgets::pill_button(ui, tl!("Remove"), true).clicked() {
+                remove = d.confirm_remove;
+            }
+            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                d.confirm_remove = None;
+            }
+        });
+        ui.add_space(10.0);
+    }
+    let removable = d.selected.filter(|&i| ids.get(i).is_some_and(|e| !e.path.starts_with("keychain:") && !e.path.starts_with("windows:")));
+    ui.horizontal(|ui| {
+        if widgets::pill_button(ui, tl!("Configure New Digital ID"), false).clicked() {
+            d.step = SignStep::Configure;
+            d.error = None;
+        }
+        if d.confirm_remove.is_none() && ui.add_enabled_ui(removable.is_some(), |ui| widgets::pill_button(ui, tl!("Remove"), false)).inner.clicked() {
+            d.confirm_remove = removable;
+        }
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if ui.add_enabled_ui(d.selected.is_some(), |ui| widgets::pill_button(ui, tl!("Continue"), true)).inner.clicked() {
+                d.step = SignStep::SignAs;
+                d.error = None;
+            }
+            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                close = true;
+            }
+        });
+    });
+    if let Some(i) = remove {
+        app.remove_digital_id(i);
+    }
+    close
+}
+
+fn configure(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
+    title(ui, "Configure a Digital ID for Signing");
+    let Some(d) = app.sign_draft.as_mut() else { return true };
+    let mut close = false;
+    let mut go = false;
+    // Browse… is desktop-only.
+    #[cfg_attr(target_arch = "wasm32", allow(unused_mut))]
+    let mut browse = false;
+    widgets::radio_value(ui, &mut d.new_id.create, false, tl!("Use a Digital ID from a file"));
+    widgets::radio_value(ui, &mut d.new_id.create, true, tl!("Create a new Digital ID (self-signed, saved to a password-protected file)"));
+    ui.add_space(8.0);
+    let n = &mut d.new_id;
+    if n.create {
+        egui::Grid::new("new-id").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
+            for (label, value) in [
+                (tl!("Name"), &mut n.name),
+                (tl!("Organizational Unit"), &mut n.unit),
+                (tl!("Organization Name"), &mut n.organization),
+                (tl!("Email Address"), &mut n.email),
+            ] {
+                let l = ui.label(label);
+                ui.add(crate::widgets::line(value).desired_width(260.0)).labelled_by(l.id);
+                ui.end_row();
+            }
+            let l = ui.label(tl!("Country/Region"));
+            ui.add(crate::widgets::line(&mut n.country).hint_text("US").char_limit(2).desired_width(60.0)).labelled_by(l.id);
+            ui.end_row();
+            ui.label(tl!("Key Algorithm"));
+            craft_ui::ComboBox::from_id_salt("key-alg").selected_text(KEY_ALGORITHMS[n.key].0).show_ui(ui, |ui| {
+                for (i, (label, _)) in KEY_ALGORITHMS.iter().enumerate() {
+                    ui.selectable_value(&mut n.key, i, *label);
+                }
+            });
+            ui.end_row();
+            let l = ui.label(tl!("Password"));
+            ui.add(crate::widgets::line(&mut n.password).password(true).desired_width(200.0)).labelled_by(l.id);
+            ui.end_row();
+            let l = ui.label(tl!("Confirm Password"));
+            ui.add(crate::widgets::line(&mut n.confirm).password(true).desired_width(200.0)).labelled_by(l.id);
+            ui.end_row();
+        });
+        ui.label(
+            egui::RichText::new(tl!("Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others."))
+                .small()
+                .color(t.text_muted),
+        );
+    } else {
+        egui::Grid::new("id-file").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
+            let l = ui.label(tl!("File (.p12, .pfx)"));
+            ui.horizontal(|ui| {
+                ui.add(crate::widgets::line(&mut n.file).desired_width(220.0)).labelled_by(l.id);
+                #[cfg(not(target_arch = "wasm32"))]
+                if ui.button(tl!("Browse…")).clicked() {
+                    browse = true;
+                }
+            });
+            ui.end_row();
+            let l = ui.label(tl!("Password"));
+            ui.add(crate::widgets::line(&mut n.file_password).password(true).desired_width(200.0)).labelled_by(l.id);
+            ui.end_row();
+        });
+    }
+    ui.add_space(6.0);
+    error(ui, &d.error);
+    ui.horizontal(|ui| {
+        if !app.digital_ids.is_empty() && widgets::pill_button(ui, tl!("Back"), false).clicked() {
+            d.step = SignStep::Choose;
+            d.error = None;
+        }
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, if d.new_id.create { tl!("Save") } else { tl!("Continue") }, true).clicked() {
+                go = true;
+            }
+            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                close = true;
+            }
+        });
+    });
+    if go {
+        let create = app.sign_draft.as_ref().is_some_and(|d| d.new_id.create);
+        let result = if create { app.create_digital_id() } else { app.import_digital_id() };
+        let Some(d) = app.sign_draft.as_mut() else { return true };
+        match result {
+            Ok(i) => {
+                d.selected = Some(i);
+                d.step = SignStep::Choose;
+                d.error = None;
+                d.new_id = NewIdDraft::default();
+            }
+            Err(e) => d.error = Some(e),
+        }
+    }
+    // The picker answers on a later frame, into the draft if the same dialog is still open.
+    #[cfg(not(target_arch = "wasm32"))]
+    if browse {
+        let dialog = rfd::AsyncFileDialog::new().add_filter(tl!("Digital ID"), &["p12", "pfx"]);
+        let epoch = app.dialog_epoch();
+        app.ask_one(crate::pickers::Ask::File(dialog), None, move |app, p| {
+            // Not one closed meanwhile, or opened again since.
+            if app.dialog_epoch() == epoch
+                && let Some(d) = app.sign_draft.as_mut()
+            {
+                d.new_id.file = p.to_string_lossy().into_owned();
+            }
+        });
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = browse;
+    close
+}
+
+/// The appearance preview: Acrobat's standard layout (name left, details right).
+/// The saved signature or image `g` stands for, given the saved Fill & Sign `signature`.
+pub(super) fn graphic_of(signature: Option<&SavedSig>, g: &SignGraphic) -> Option<SavedSig> {
+    match g {
+        SignGraphic::Name => None,
+        SignGraphic::FillSign => signature.cloned(),
+        SignGraphic::Image(image) => Some(SavedSig::Image(image.clone())),
+    }
+}
+
+/// The words of a visible signature's labels in `lang`, and whether they fell back to English.
+///
+/// The labels are stamped into the document, so they are all in `lang` or all in English, never a
+/// mix. English when `lang` is English; when it is written right to left (its catalog is kept in
+/// display order, not the order a PDF stores text in); when one label has no translation; or when
+/// the signature's font can't draw one (Chinese, Japanese, Cyrillic, Greek in Helvetica), which
+/// signing would refuse. The English words are the sign crate's own, so they can't drift apart.
+pub(crate) fn appearance_labels(lang: crate::i18n::Lang) -> (AppearanceLabels, bool) {
+    let english = AppearanceLabels::default();
+    if lang == crate::i18n::Lang::EN {
+        return (english, false);
+    }
+    let said = |s: &str| (!lang.rtl() && crate::i18n::has(lang, s)).then(|| crate::i18n::tr(lang, s).to_string());
+    let translated = (|| {
+        Some(AppearanceLabels {
+            signed_by: said(&english.signed_by)?,
+            distinguished_name: said(&english.distinguished_name)?,
+            reason: said(&english.reason)?,
+            location: said(&english.location)?,
+            date: said(&english.date)?,
+        })
+    })();
+    match translated.filter(|l| l.first_undrawable().is_none()) {
+        Some(labels) => (labels, false),
+        None => (english, true),
+    }
+}
+
+/// The detail lines of a visible signature, as `sign::pdf` stamps them (the distinguished name
+/// aside, which the dialog doesn't know before the ID is opened): the label above the name, then
+/// the reason, location and date, each after its label. `reason` and `location` are as typed.
+pub(super) fn detail_lines(a: &Appearance, labels: &AppearanceLabels, name: &str, reason: &str, location: &str, date: &str) -> Vec<String> {
+    let label = |l: &str, v: &str| if a.labels { format!("{l}{v}") } else { v.to_string() };
+    let mut lines = Vec::new();
+    if a.name {
+        if a.labels {
+            lines.push(labels.signed_by.clone());
+        }
+        lines.push(name.to_string());
+    }
+    if a.reason && !reason.trim().is_empty() {
+        lines.push(label(&labels.reason, reason.trim()));
+    }
+    if a.location && !location.trim().is_empty() {
+        lines.push(label(&labels.location, location.trim()));
+    }
+    if a.date {
+        lines.push(label(&labels.date, date));
+    }
+    lines.retain(|l| !l.is_empty());
+    lines
+}
+
+/// The signature as it will look: the graphic (or the name) on the left, the details beside it
+/// (`lines`, from [`detail_lines`] with the labels signing will stamp).
+fn preview(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    name: &str,
+    a: &Appearance,
+    lines: &[String],
+    graphic: Option<&SavedSig>,
+    cache: &mut Option<(SavedSig, egui::TextureHandle)>,
+) {
+    let (rect, _) = ui.allocate_exact_size(vec2(ui.available_width(), 96.0), egui::Sense::hover());
+    let bg = if t.dark() { Color32::from_gray(0xF4) } else { Color32::WHITE };
+    ui.painter().rect(rect, CornerRadius::same(4), bg, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+    let inner = rect.shrink(10.0);
+    // As in the signature itself: a graphic with no details beside it fills the box.
+    let alone = graphic.is_some() && lines.is_empty();
+    let half = Rect::from_min_size(inner.min, vec2(inner.width() * 0.5 - 6.0, inner.height()));
+    if let Some(g) = graphic {
+        crate::fill_sign::paint_saved(ui, if alone { inner } else { half }, g, cache, "sign-graphic");
+    } else if a.name {
+        let galley = ui.painter().layout(name.to_string(), theme::regular(22.0), Color32::BLACK, half.width());
+        ui.painter().galley(half.left_center() - vec2(0.0, galley.size().y / 2.0), galley, Color32::BLACK);
+    }
+    let x = if (a.name || graphic.is_some()) && !alone { inner.center().x + 6.0 } else { inner.left() };
+    let galley = ui.painter().layout(lines.join("\n"), theme::regular(11.0), Color32::from_gray(0x20), inner.right() - x);
+    ui.painter().galley(egui::pos2(x, inner.center().y - galley.size().y / 2.0), galley, Color32::BLACK);
+}
+
+fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
+    let ids = app.digital_ids.clone();
+    // The time as the signature will show it (signing takes the session clock then).
+    let date = sign::pdf::display_date(&app.session.signing_date());
+    let Some(d) = app.sign_draft.as_mut() else { return true };
+    let Some(entry) = d.selected.and_then(|i| ids.get(i)).cloned() else {
+        d.step = SignStep::Choose;
+        return false;
+    };
+    title(
+        ui,
+        &crate::i18n::fmt(
+            tl!("{verb} as \"{name}\""),
+            &[("verb", if d.certify.is_some() { tl!("Certify") } else { tl!("Sign") }), ("name", &entry.name)],
+        ),
+    );
+    let in_os_key_store = entry.path.starts_with("keychain:") || entry.path.starts_with("windows:");
+    let mut close = false;
+    let mut go = false;
+    #[cfg(not(target_arch = "wasm32"))]
+    let mut pick = false;
+    if d.rect.is_some() || d.field.is_some() {
+        ui.label(egui::RichText::new(tl!("Appearance")).font(theme::semibold(12.5)));
+        let graphic = graphic_of(app.signature.as_ref(), &d.graphic);
+        let (labels, in_english) = appearance_labels(crate::i18n::current());
+        let lines = detail_lines(&d.appearance, &labels, &entry.name, &d.reason, &d.location, &date);
+        preview(ui, t, &entry.name, &d.appearance, &lines, graphic.as_ref(), &mut app.sign_graphic_preview);
+        if in_english && d.appearance.labels {
+            ui.label(
+                egui::RichText::new(tl!("The labels are in English: the signature's font can't draw them in this language."))
+                    .small()
+                    .color(t.text_muted),
+            );
+        }
+        ui.horizontal_wrapped(|ui| {
+            let a = &mut d.appearance;
+            ui.add(widgets::checkbox(&mut a.name, tl!("Name")));
+            ui.add(widgets::checkbox(&mut a.date, tl!("Date")));
+            ui.add(widgets::checkbox(&mut a.reason, tl!("Reason")));
+            ui.add(widgets::checkbox(&mut a.location, tl!("Location")));
+            ui.add(widgets::checkbox(&mut a.distinguished_name, tl!("Distinguished name")));
+            ui.add(widgets::checkbox(&mut a.labels, tl!("Labels")));
+        });
+        // Acrobat: Configure Signature Appearance, Text, Draw or Image.
+        ui.horizontal_wrapped(|ui| {
+            ui.label(tl!("Graphic"));
+            widgets::radio_value(ui, &mut d.graphic, SignGraphic::Name, tl!("Signer's name"));
+            ui.add_enabled_ui(app.signature.is_some(), |ui| {
+                if ui.add(widgets::radio(d.graphic == SignGraphic::FillSign, tl!("Fill & Sign signature"))).clicked() {
+                    d.graphic = SignGraphic::FillSign;
+                }
+            });
+            ui.add_enabled_ui(d.image.is_some(), |ui| {
+                if ui.add(widgets::radio(matches!(d.graphic, SignGraphic::Image(_)), tl!("Image"))).clicked()
+                    && let Some(image) = &d.image
+                {
+                    d.graphic = SignGraphic::Image(image.clone());
+                }
+            });
+            #[cfg(not(target_arch = "wasm32"))]
+            if widgets::pill_button(ui, tl!("Choose image…"), false).clicked() {
+                pick = true;
+            }
+        });
+        ui.add_space(6.0);
+    } else {
+        ui.label(egui::RichText::new(tl!("The signature will be invisible.")).color(t.text_muted));
+    }
+    egui::Grid::new("sign-as").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
+        if d.certify.is_some() {
+            ui.label(tl!("Permitted actions after certifying"));
+            let mut p = d.certify.unwrap_or(2);
+            let label = |p: u8| match p {
+                1 => tl!("No changes allowed"),
+                3 => tl!("Annotations, form fill-in, and digital signatures"),
+                _ => tl!("Form fill-in and digital signatures"),
+            };
+            craft_ui::ComboBox::from_id_salt("certify-p").selected_text(label(p)).width(300.0).show_ui(ui, |ui| {
+                for v in [1u8, 2, 3] {
+                    ui.selectable_value(&mut p, v, label(v));
+                }
+            });
+            d.certify = Some(p);
+            ui.end_row();
+        }
+        let l = ui.label(tl!("Reason"));
+        ui.add(crate::widgets::line(&mut d.reason).hint_text(tl!("Optional")).desired_width(260.0)).labelled_by(l.id);
+        ui.end_row();
+        let l = ui.label(tl!("Location"));
+        ui.add(crate::widgets::line(&mut d.location).hint_text(tl!("Optional")).desired_width(260.0)).labelled_by(l.id);
+        ui.end_row();
+        if in_os_key_store {
+            ui.label("");
+            ui.label(
+                egui::RichText::new(if entry.path.starts_with("windows:") {
+                    tl!("The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.")
+                } else {
+                    tl!("The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.")
+                })
+                .small()
+                .color(t.text_muted),
+            );
+        } else {
+            let l = ui.label(tl!("Digital ID password"));
+            let r = ui.add(crate::widgets::line(&mut d.password).password(true).desired_width(200.0)).labelled_by(l.id);
+            if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                go = true;
+            }
+        }
+        ui.end_row();
+    });
+    ui.add_space(6.0);
+    error(ui, &d.error);
+    ui.horizontal(|ui| {
+        if widgets::pill_button(ui, tl!("Back"), false).clicked() {
+            d.step = SignStep::Choose;
+            d.error = None;
+        }
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("Sign"), true).clicked() {
+                go = true;
+            }
+            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                close = true;
+            }
+        });
+    });
+    #[cfg(not(target_arch = "wasm32"))]
+    if pick {
+        app.pick_sign_graphic_image();
+    }
+    if go {
+        match app.finish_signing() {
+            Ok(()) => {
+                app.sign_draft = None;
+                return true;
+            }
+            Err(e) => {
+                if let Some(d) = app.sign_draft.as_mut() {
+                    d.error = Some(e);
+                }
+            }
+        }
+    }
+    close
+}
diff --git a/crates/ui-egui/src/tools/sign_ui/panel.rs b/crates/ui-egui/src/tools/sign_ui/panel.rs
new file mode 100644
index 0000000000..af5bfd77cf
--- /dev/null
+++ b/crates/ui-egui/src/tools/sign_ui/panel.rs
@@ -0,0 +1,358 @@
+use super::dialog::title;
+use super::*;
+
+/// The message bar for signed documents: (icon, colour, template, argument).
+/// The template renders through [`crate::i18n::tr_fmt`] at the call site, so the bar follows
+/// the UI language; names inside `argument` stay as they are.
+pub(crate) fn banner(sigs: &[SignatureInfo]) -> Option<(&'static str, Color32, &'static str, String)> {
+    let signed: Vec<&SignatureInfo> = sigs.iter().filter(|s| s.signed).collect();
+    if signed.is_empty() {
+        return None;
+    }
+    // A valid certification heads the bar only when every signature is valid: it says nothing
+    // about the signatures added after it, so their problems come first.
+    if let Some(c) = signed.iter().find(|s| s.certify.is_some())
+        && signed.iter().all(|s| s.status == SignatureStatus::Valid)
+    {
+        let by = c.certificate.as_ref().map(|x| {
+            let org = x.subject.organization().map(|o| format!(", {o}")).unwrap_or_default();
+            let who = format!("{}{org}", x.display_name());
+            let (template, issuer) = match x.issuer.common_name() {
+                Some(issuer) => ("{who}, certificate issued by {issuer}.", issuer),
+                None => ("{who}, certificate issued by an unknown issuer.", ""),
+            };
+            crate::i18n::fmt(tl!(template), &[("who", &who), ("issuer", issuer)])
+        });
+        return Some(("badge-check", Color32::from_rgb(0x14, 0x73, 0xE6), "Certified by {by}", by.unwrap_or_default()));
+    }
+    Some(if signed.iter().any(|s| s.status == SignatureStatus::Invalid) {
+        ("circle-x", Color32::from_rgb(0xD7, 0x37, 0x3F), "At least one signature is invalid.", String::new())
+    } else if signed.iter().all(|s| s.status == SignatureStatus::Valid) {
+        ("circle-check", Color32::from_rgb(0x2D, 0x9D, 0x78), "Signed and all signatures are valid.", String::new())
+    } else {
+        ("triangle-alert", Color32::from_rgb(0xE6, 0x86, 0x19), "At least one signature has problems.", String::new())
+    })
+}
+
+fn status_icon(s: &SignatureInfo) -> (&'static str, Color32) {
+    if !s.signed {
+        return ("pen-line", Color32::from_gray(0x80));
+    }
+    signature_status_style(s.status)
+}
+
+/// One look per signature verdict, shared by the Signatures panel and the page badges so
+/// the two can't drift apart.
+pub(crate) fn signature_status_style(status: SignatureStatus) -> (&'static str, Color32) {
+    match status {
+        SignatureStatus::Valid => ("circle-check", Color32::from_rgb(0x2D, 0x9D, 0x78)),
+        SignatureStatus::Unknown => ("triangle-alert", Color32::from_rgb(0xE6, 0x86, 0x19)),
+        SignatureStatus::Invalid => ("circle-x", Color32::from_rgb(0xD7, 0x37, 0x3F)),
+    }
+}
+
+/// What the Signatures panel asks the app to do.
+#[derive(Clone, Debug)]
+pub enum PanelAction {
+    Validate,
+    GoTo(usize),
+    Trust(Box<Certificate>),
+    ViewSigned {
+        len: usize,
+        revision: usize,
+    },
+    Sign(String),
+    ExportCertificate(Box<Certificate>),
+    /// Certificate Viewer for the signer's chain (signer first).
+    ViewCertificate(Vec<Certificate>),
+}
+
+/// The Signatures panel body.
+pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, sigs: &[SignatureInfo], expanded: &mut Vec<String>) -> Option<PanelAction> {
+    let mut action = None;
+    ui.horizontal(|ui| {
+        if widgets::pill_button(ui, tl!("Validate all"), false).clicked() {
+            action = Some(PanelAction::Validate);
+        }
+    });
+    ui.add_space(6.0);
+    if sigs.is_empty() {
+        ui.add_space(24.0);
+        ui.vertical_centered(|ui| {
+            ui.add(icons::image("signature", 32.0, t.text_faint));
+            ui.add_space(6.0);
+            ui.label(egui::RichText::new(tl!("This document has no signatures.")).color(t.text_muted));
+        });
+        return action;
+    }
+    let mut ordered: Vec<&SignatureInfo> = sigs.iter().collect();
+    ordered.sort_by_key(|s| (!s.signed, s.revision));
+    for s in ordered {
+        let open = expanded.contains(&s.field);
+        let (icon, color) = status_icon(s);
+        let (template, name) = match (s.signed, s.certify.is_some(), s.signer.as_deref()) {
+            (false, ..) => ("Unsigned signature field: {name}", s.field.as_str()),
+            (true, true, Some(signer)) => ("Rev. {rev}: Certified by {name}", signer),
+            (true, true, None) => ("Rev. {rev}: Certified by an unknown signer", ""),
+            (true, false, Some(signer)) => ("Rev. {rev}: Signed by {name}", signer),
+            (true, false, None) => ("Rev. {rev}: Signed by an unknown signer", ""),
+        };
+        let head = crate::i18n::fmt(tl!(template), &[("rev", &s.revision.to_string()), ("name", name)]);
+        let resp = ui
+            .horizontal(|ui| {
+                let chevron = if open { "chevron-down" } else { "chevron-right" };
+                let toggle = icons::button(ui, chevron, 20.0, false, if open { "Collapse" } else { "Expand" }).clicked();
+                ui.add(icons::image(icon, 16.0, color));
+                let l = ui.add(egui::Label::new(egui::RichText::new(&head).font(theme::semibold(12.5)).color(t.text)).sense(egui::Sense::click()));
+                toggle || l.clicked()
+            })
+            .inner;
+        if resp {
+            if open {
+                expanded.retain(|f| f != &s.field);
+            } else {
+                expanded.push(s.field.clone());
+            }
+        }
+        if !open {
+            continue;
+        }
+        egui::Frame::NONE.inner_margin(egui::Margin { left: 44, right: 4, top: 2, bottom: 8 }).show(ui, |ui| {
+            ui.spacing_mut().item_spacing.y = 3.0;
+            if !s.signed {
+                if widgets::pill_button(ui, tl!("Sign this field…"), true).clicked() {
+                    action = Some(PanelAction::Sign(s.field.clone()));
+                }
+                return;
+            }
+            ui.label(
+                egui::RichText::new(match s.status {
+                    SignatureStatus::Valid => tl!("Signature is valid:"),
+                    SignatureStatus::Unknown => tl!("Signature validity is UNKNOWN:"),
+                    SignatureStatus::Invalid => tl!("Signature is INVALID:"),
+                })
+                .font(theme::semibold(12.0)),
+            );
+            for detail in &s.details {
+                // Each detail is a whole sentence of ours plus what the signature itself says; said
+                // here in the panel's language, with the signature's own words left as they are.
+                let line = detail.said(&crate::i18n::words);
+                ui.add(egui::Label::new(egui::RichText::new(format!("• {line}")).font(theme::regular(11.5)).color(t.text_muted)).wrap());
+            }
+            ui.add_space(4.0);
+            ui.label(egui::RichText::new(tl!("Signature Details")).font(theme::semibold(12.0)));
+            let row = |ui: &mut egui::Ui, k: &str, v: &str| {
+                ui.add(egui::Label::new(egui::RichText::new(format!("{}: {v}", tl!(k))).font(theme::regular(11.5))).wrap());
+            };
+            if let Some(r) = &s.reason {
+                row(ui, "Reason", r);
+            }
+            if let Some(l) = &s.location {
+                row(ui, "Location", l);
+            }
+            if let Some(d) = &s.date {
+                row(ui, "Signing time", &sign::pdf::display_date(d));
+            }
+            if let Some(a) = &s.algorithm {
+                row(ui, "Algorithm", a);
+            }
+            if let Some(c) = &s.certificate {
+                row(ui, "Signer", &c.subject.display());
+                row(ui, "Issued by", &c.issuer.display());
+                row(ui, "Valid", &format!("{} to {}", c.not_before, c.not_after));
+            }
+            match s.page {
+                Some(p) => {
+                    let link = ui.add(
+                        egui::Label::new(
+                            egui::RichText::new(crate::i18n::fmt(
+                                tl!("Field: {field} on page {p}"),
+                                &[("field", &s.field), ("p", &(p + 1).to_string())],
+                            ))
+                            .font(theme::regular(11.5))
+                            .color(t.accent_text)
+                            .underline(),
+                        )
+                        .sense(egui::Sense::click()),
+                    );
+                    if link.clicked() {
+                        action = Some(PanelAction::GoTo(p));
+                    }
+                }
+                None => row(ui, "Field", &s.field),
+            }
+            ui.add_space(4.0);
+            ui.horizontal_wrapped(|ui| {
+                // Trust exactly the signer shown above (s.certificate), not the chain top the
+                // document embedded: trusting an issuer or root is a separate, explicit step in
+                // the Certificate Viewer's Trust tab, which names that certificate.
+                if let Some(c) = s.certificate.as_ref()
+                    && s.status == SignatureStatus::Unknown
+                    && ui.button(tl!("Add to trusted certificates")).clicked()
+                {
+                    action = Some(PanelAction::Trust(Box::new(c.clone())));
+                }
+                if ui.button(tl!("View signed version")).clicked() {
+                    action = Some(PanelAction::ViewSigned { len: s.signed_len, revision: s.revision });
+                }
+                if let Some(c) = &s.certificate
+                    && ui.button(tl!("Show certificate…")).clicked()
+                {
+                    let mut chain = vec![c.clone()];
+                    chain.extend(s.chain.iter().filter(|x| x.raw != c.raw).cloned());
+                    action = Some(PanelAction::ViewCertificate(chain));
+                }
+                if let Some(c) = &s.certificate
+                    && ui.button(tl!("Export certificate…")).clicked()
+                {
+                    action = Some(PanelAction::ExportCertificate(Box::new(c.clone())));
+                }
+            });
+        });
+    }
+    action
+}
+
+/// Certificate Viewer: a chain (the end certificate first) and the tab shown.
+#[derive(Clone, Debug)]
+pub struct CertViewer {
+    pub chain: Vec<Certificate>,
+    pub selected: usize,
+    pub tab: CertTab,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CertTab {
+    Summary,
+    Details,
+    Trust,
+}
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|b| format!("{b:02X}")).collect::<Vec<_>>().join(" ")
+}
+
+fn key_usage(bits: u16) -> String {
+    const NAMES: [&str; 9] = [
+        "Digital Signature",
+        "Non-Repudiation",
+        "Key Encipherment",
+        "Data Encipherment",
+        "Key Agreement",
+        "Certificate Signing",
+        "CRL Signing",
+        "Encipher Only",
+        "Decipher Only",
+    ];
+    let used: Vec<&str> = NAMES.iter().enumerate().filter(|(i, _)| bits & (1 << i) != 0).map(|(_, n)| tl!(*n)).collect();
+    if used.is_empty() { tl!("None").into() } else { used.join(", ") }
+}
+
+/// What the viewer asks for.
+pub(crate) enum CertAction {
+    Trust(Box<Certificate>),
+    Export(Box<Certificate>),
+}
+
+/// The Certificate Viewer dialog: the chain on the left, the selected certificate's tabs.
+pub(crate) fn cert_viewer(ui: &mut egui::Ui, v: &mut CertViewer, trusted: &[Certificate], t: &Tokens) -> (bool, Option<CertAction>) {
+    title(ui, "Certificate Viewer");
+    ui.label(egui::RichText::new(tl!("This dialog shows the details of a certificate and its chain.")).color(t.text_muted));
+    ui.add_space(8.0);
+    let mut action = None;
+    v.selected = v.selected.min(v.chain.len().saturating_sub(1));
+    ui.horizontal_top(|ui| {
+        // The chain, root at the top (as Acrobat shows it).
+        ui.vertical(|ui| {
+            ui.set_width(200.0);
+            for (depth, i) in (0..v.chain.len()).rev().enumerate() {
+                let c = &v.chain[i];
+                ui.horizontal(|ui| {
+                    ui.add_space(depth as f32 * 12.0);
+                    if ui.selectable_label(v.selected == i, c.display_name()).clicked() {
+                        v.selected = i;
+                    }
+                });
+            }
+        });
+        ui.add_space(16.0);
+        ui.vertical(|ui| {
+            ui.set_width(440.0);
+            let Some(c) = v.chain.get(v.selected).cloned() else { return };
+            ui.horizontal(|ui| {
+                for (tab, label) in [(CertTab::Summary, tl!("Summary")), (CertTab::Details, tl!("Details")), (CertTab::Trust, tl!("Trust"))] {
+                    if widgets::pill_button(ui, label, v.tab == tab).clicked() {
+                        v.tab = tab;
+                    }
+                }
+            });
+            ui.add_space(8.0);
+            let grid = |ui: &mut egui::Ui, rows: Vec<(&str, String)>| {
+                egui::Grid::new(("cert-rows", v.tab as u8)).num_columns(2).spacing([12.0, 5.0]).show(ui, |ui| {
+                    for (k, val) in rows {
+                        ui.label(egui::RichText::new(tl_ctx!("certificate", k)).color(t.text_muted));
+                        ui.add(egui::Label::new(val).wrap());
+                        ui.end_row();
+                    }
+                });
+            };
+            match v.tab {
+                CertTab::Summary => grid(
+                    ui,
+                    vec![
+                        ("Issued to", c.subject.display()),
+                        ("Issued by", c.issuer.display()),
+                        ("Valid from", c.not_before.to_string()),
+                        ("Valid to", c.not_after.to_string()),
+                        ("Intended usage", c.key_usage.map(key_usage).unwrap_or_else(|| tl!("Any").to_string())),
+                    ],
+                ),
+                CertTab::Details => grid(
+                    ui,
+                    vec![
+                        ("Version", "3".into()),
+                        ("Serial number", c.serial_hex()),
+                        ("Issuer", c.issuer.display()),
+                        ("Subject", c.subject.display()),
+                        ("Validity starts", c.not_before.to_string()),
+                        ("Validity ends", c.not_after.to_string()),
+                        ("Public key", c.public_key.describe()),
+                        ("Basic constraints", tl!(if c.is_ca { "Certificate authority" } else { "End entity" }).to_string()),
+                        ("Key usage", c.key_usage.map(key_usage).unwrap_or_else(|| tl!("Not present").to_string())),
+                        ("Self-signed", if c.is_self_signed() { tl!("Yes").to_string() } else { tl!("No").to_string() }),
+                        ("SHA-1 digest", hex(&sign::keys::DigestAlg::Sha1.digest(&[&c.raw]))),
+                        ("SHA-256 digest", hex(&sign::keys::DigestAlg::Sha256.digest(&[&c.raw]))),
+                    ],
+                ),
+                CertTab::Trust => {
+                    let is_trusted = trusted.iter().any(|x| x.raw == c.raw);
+                    let anchored = v.chain.iter().any(|x| trusted.iter().any(|y| y.raw == x.raw));
+                    ui.label(if is_trusted {
+                        tl!("This certificate is in your list of trusted certificates.")
+                    } else if anchored {
+                        tl!("This certificate is trusted through a certificate above it in the chain.")
+                    } else {
+                        tl!("This certificate is not trusted. Signatures made with it show an unknown identity.")
+                    });
+                    ui.add_space(8.0);
+                    if !is_trusted && widgets::pill_button(ui, tl!("Add to Trusted Certificates"), false).clicked() {
+                        action = Some(CertAction::Trust(Box::new(c.clone())));
+                    }
+                }
+            }
+            ui.add_space(8.0);
+            if widgets::pill_button(ui, tl!("Export…"), false).clicked() {
+                action = Some(CertAction::Export(Box::new(c.clone())));
+            }
+        });
+    });
+    ui.add_space(10.0);
+    let mut close = false;
+    ui.horizontal(|ui| ui.with_layout(Layout::right_to_left(Align::Center), |ui| close = widgets::pill_button(ui, tl!("OK"), true).clicked()));
+    (close, action)
+}
+
+/// The text of an exported certificate (`.cer`, PEM).
+pub fn certificate_pem(c: &Certificate) -> String {
+    sign::x509::to_pem(c)
+}
diff --git a/crates/ui-egui/src/stamps_ui.rs b/crates/ui-egui/src/tools/stamps_ui.rs
similarity index 98%
rename from crates/ui-egui/src/stamps_ui.rs
rename to crates/ui-egui/src/tools/stamps_ui.rs
index 1da56c28ed..9cddb31d23 100644
--- a/crates/ui-egui/src/stamps_ui.rs
+++ b/crates/ui-egui/src/tools/stamps_ui.rs
@@ -67,7 +67,7 @@ pub(crate) fn create_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens)
         ui.horizontal(|ui| {
             ui.add(crate::widgets::line(&mut d.category).desired_width(200.0).hint_text(tl!("e.g. My stamps"))).labelled_by(l.id);
             if !categories.is_empty() {
-                egui::ComboBox::from_id_salt("stamp-categories").selected_text("").width(24.0).show_ui(ui, |ui| {
+                craft_ui::ComboBox::from_id_salt("stamp-categories").selected_text("").width(24.0).show_ui(ui, |ui| {
                     for c in &categories {
                         if ui.selectable_label(d.category == *c, c).clicked() {
                             d.category = c.clone();
diff --git a/crates/ui-egui/src/tags_ui.rs b/crates/ui-egui/src/tools/tags_ui.rs
similarity index 100%
rename from crates/ui-egui/src/tags_ui.rs
rename to crates/ui-egui/src/tools/tags_ui.rs
diff --git a/crates/ui-egui/src/updates.rs b/crates/ui-egui/src/updates.rs
deleted file mode 100644
index 4e7957e15e..0000000000
--- a/crates/ui-egui/src/updates.rs
+++ /dev/null
@@ -1,191 +0,0 @@
-//! Help ▸ Check for updates (issue #28): ask for the latest release and offer its download page.
-//!
-//! The desktop app supplies how to ask ([`PdfCraftApp::update_source`]), so this crate has no
-//! network code; without a source (the web build, tests) the command opens the releases page.
-//! PdfCraft never downloads or installs anything itself: the user downloads the new version.
-//! It asks only when the user does: there is no check at start (the owner's decision).
-
-use std::sync::Arc;
-
-use egui::{Align, Layout};
-
-use crate::{PdfCraftApp, theme, widgets};
-
-/// Where every PdfCraft release is listed.
-pub const RELEASES_PAGE: &str = "https://github.com/storytold/pdfcraft/releases";
-
-/// The latest published release.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Release {
-    /// Its version tag, such as `v0.2.0`.
-    pub version: String,
-    /// Its page on [`RELEASES_PAGE`], where the downloads are.
-    pub url: String,
-}
-
-/// Asks for the latest release (blocking; it runs on its own thread).
-pub type UpdateSource = Arc<dyn Fn() -> Result<Release, String> + Send + Sync>;
-
-/// Whether release `latest` (a tag such as `v0.2.0`) is newer than version `current` (`0.1.1`).
-/// Pre-release and build suffixes are ignored; a version that doesn't parse is never newer.
-pub fn is_newer(latest: &str, current: &str) -> bool {
-    matches!((parse(latest), parse(current)), (Some(l), Some(c)) if l > c)
-}
-
-fn parse(v: &str) -> Option<(u64, u64, u64)> {
-    let v = v.trim().trim_start_matches(['v', 'V']);
-    let core = v.split(['-', '+']).next()?;
-    let mut parts = core.split('.');
-    let mut next = |required: bool| match parts.next() {
-        Some(p) => p.parse::<u64>().ok(),
-        None if required => None,
-        None => Some(0),
-    };
-    let version = (next(true)?, next(false)?, next(false)?);
-    parts.next().is_none().then_some(version)
-}
-
-/// Where a check is.
-#[derive(Default)]
-pub(crate) enum Check {
-    #[default]
-    Idle,
-    #[cfg(not(target_arch = "wasm32"))]
-    Running(std::sync::mpsc::Receiver<Result<Release, String>>),
-    Done(Result<Release, String>),
-}
-
-#[derive(Default)]
-pub(crate) struct Updates {
-    pub(crate) check: Check,
-    /// The Updates dialog is showing.
-    pub(crate) open: bool,
-}
-
-impl PdfCraftApp {
-    /// Help ▸ Check for updates: ask for the latest release and show the outcome.
-    pub fn check_for_updates(&mut self) {
-        let Some(source) = self.update_source.clone() else {
-            self.open_url(RELEASES_PAGE);
-            return;
-        };
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            self.updates.open = true;
-            if matches!(self.updates.check, Check::Running(_)) {
-                return;
-            }
-            let (tx, rx) = std::sync::mpsc::channel();
-            let ctx = self.ctx.clone();
-            std::thread::spawn(move || {
-                // The receiver may be gone (the app quit): nothing to report to then.
-                let _ = tx.send(source());
-                if let Some(ctx) = ctx {
-                    ctx.request_repaint();
-                }
-            });
-            self.updates.check = Check::Running(rx);
-        }
-        #[cfg(target_arch = "wasm32")]
-        {
-            let _ = source;
-            self.open_url(RELEASES_PAGE);
-        }
-    }
-
-    /// Pick up a finished check (each frame).
-    pub(crate) fn poll_updates(&mut self) {
-        #[cfg(not(target_arch = "wasm32"))]
-        if let Check::Running(rx) = &self.updates.check {
-            let result = match rx.try_recv() {
-                Ok(r) => r,
-                Err(std::sync::mpsc::TryRecvError::Empty) => return,
-                Err(std::sync::mpsc::TryRecvError::Disconnected) => Err("the update check stopped unexpectedly".into()),
-            };
-            self.updates.check = Check::Done(result);
-        }
-    }
-}
-
-/// The Updates dialog.
-pub(crate) fn dialog(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    if !app.updates.open {
-        return;
-    }
-    let t = theme::Tokens::get(ctx);
-    let current = env!("CARGO_PKG_VERSION");
-    let mut close = false;
-    let mut download: Option<String> = None;
-    let modal = crate::widgets::show_modal(ctx, "updates", |ui| {
-        ui.set_width(420.0);
-        ui.horizontal(|ui| {
-            ui.add(crate::icons::image("cloud", 22.0, t.accent));
-            ui.label(egui::RichText::new(tl!("Check for updates")).font(theme::semibold(16.0)));
-        });
-        ui.add_space(8.0);
-        match &app.updates.check {
-            Check::Idle => {
-                ui.label(tl!("No check has run yet."));
-            }
-            #[cfg(not(target_arch = "wasm32"))]
-            Check::Running(_) => {
-                ui.horizontal(|ui| {
-                    ui.spinner();
-                    ui.label(tl!("Checking for a newer version…"));
-                });
-            }
-            Check::Done(Ok(r)) if is_newer(&r.version, current) => {
-                let version = r.version.trim_start_matches(['v', 'V']);
-                ui.label(egui::RichText::new(crate::i18n::fmt(tl!("PdfCraft {v} is available."), &[("v", version)])).strong());
-                ui.label(
-                    egui::RichText::new(crate::i18n::fmt(
-                        tl!("You have version {c}. Download the new version from its release page."),
-                        &[("c", current)],
-                    ))
-                    .color(t.text_muted),
-                );
-                download = Some(r.url.clone());
-            }
-            Check::Done(Ok(_)) => {
-                ui.label(crate::i18n::fmt(tl!("PdfCraft {c} is up to date."), &[("c", current)]));
-            }
-            Check::Done(Err(e)) => {
-                ui.label(crate::i18n::fmt(tl!("Couldn't check for updates: {e}"), &[("e", &e.to_string())]));
-                ui.label(
-                    egui::RichText::new(crate::i18n::fmt(
-                        tl!("You have version {c}. All releases are listed at {page}."),
-                        &[("c", current), ("page", RELEASES_PAGE)],
-                    ))
-                    .color(t.text_muted),
-                );
-            }
-        }
-        ui.add_space(10.0);
-        ui.label(
-            egui::RichText::new(tl!("Asks GitHub for the latest release. Nothing is downloaded or installed automatically."))
-                .color(t.text_muted)
-                .small(),
-        );
-        ui.add_space(12.0);
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if let Some(url) = download.take() {
-                let get = widgets::pill_button(ui, tl!("Download"), true).clicked();
-                let later = widgets::pill_button(ui, tl!("Later"), false).clicked();
-                close = get || later;
-                download = get.then_some(url);
-            } else if widgets::pill_button(ui, tl!("Close"), true).clicked() {
-                close = true;
-            }
-        });
-    });
-    if modal.should_close() {
-        close = true;
-        download = None;
-    }
-    if close {
-        app.updates.open = false;
-        if let Some(url) = download {
-            app.open_url(&url);
-        }
-    }
-}
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 85af966806..cb34b5901b 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -2,11 +2,16 @@
 
 use egui::{Align2, Color32, CornerRadius, Rect, Response, Sense, Stroke, vec2};
 
+use crate::PdfCraftApp;
 use crate::theme::{self, Tokens};
-use crate::{PdfCraftApp, icons};
+
+pub(super) mod icon_data;
+pub mod icons;
 
 /// Horizontal and vertical inset of a single-line field.
 const FIELD_MARGIN: egui::Margin = egui::Margin::symmetric(10, 6);
+/// Where text starts inside a [`line`] or [`block`] field, so plain values beside fields can line up with it.
+pub(crate) const FIELD_TEXT_INSET: f32 = FIELD_MARGIN.left as f32;
 /// Outer height of a single-line field, including its inset.
 const FIELD_MIN_HEIGHT: f32 = 30.0;
 /// Padding inside every modal.
@@ -25,12 +30,12 @@ fn dialog_frame(ctx: &egui::Context) -> egui::Frame {
 
 /// A modal with the card fill, a 10-point corner and room around its contents.
 pub fn modal(ctx: &egui::Context, id: impl std::hash::Hash + std::fmt::Debug) -> egui::Modal {
-    egui::Modal::new(egui::Id::new(id)).frame(dialog_frame(ctx))
+    egui::Modal::new(egui::Id::unique(id)).frame(dialog_frame(ctx))
 }
 
 /// Show [`modal`], outline its controls, and remember the card rect for layout checks.
 pub fn show_modal<R>(ctx: &egui::Context, id: &str, content: impl FnOnce(&mut egui::Ui) -> R) -> egui::ModalResponse<R> {
-    let stored = egui::Id::new(id);
+    let stored = egui::Id::unique(id);
     modal(ctx, id).show(ctx, |ui| {
         begin_dialog(ui);
         let inner = content(ui);
@@ -109,7 +114,7 @@ pub fn mode_tab(ui: &mut egui::Ui, label: &str, active: bool) -> Response {
     let font = if active { theme::semibold(13.5) } else { theme::medium(13.5) };
     let w = ui.fonts_mut(|f| f.layout_no_wrap(label.to_owned(), font.clone(), t.text).size().x);
     let (rect, resp) = ui.allocate_exact_size(vec2(w + 22.0, 48.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, ui.is_enabled(), active, label));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), active, label));
     let press = theme::Press::track(ui, &resp);
     let well = rect.shrink2(vec2(2.0, 9.0));
     if active {
@@ -138,21 +143,26 @@ pub fn pill_button(ui: &mut egui::Ui, label: &str, primary: bool) -> Response {
 pub fn pill_button_marked(ui: &mut egui::Ui, label: &str, primary: bool, marked: bool) -> Response {
     let t = Tokens::get(ui.ctx());
     let font = theme::medium(12.5);
-    let w = ui.fonts_mut(|f| f.layout_no_wrap(label.to_owned(), font.clone(), t.text).size().x);
+    let text_color = if primary { Color32::WHITE } else { t.text };
+    // Dialog buttons are translated UI text: an explicit RTL base keeps an Arabic label right
+    // to left even when its first strong character is Latin or a placeholder.
+    let label_galley = crate::bidi::layout_ui(ui, label.to_owned(), font, text_color);
+    let w = label_galley.size().x;
     let (rect, resp) = ui.allocate_exact_size(vec2(w + 26.0, 28.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), label));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), label));
     let press = theme::Press::track(ui, &resp);
-    let (fill, stroke, text) = if primary {
-        (press.fill(t.accent, t.accent_text, t.accent.lerp_to_gamma(Color32::BLACK, 0.22)), Stroke::NONE, Color32::WHITE)
+    let (fill, stroke) = if primary {
+        (press.fill(t.accent, t.accent_text, t.accent.lerp_to_gamma(Color32::BLACK, 0.22)), Stroke::NONE)
     } else {
-        (press.fill(t.card, t.hover, t.pressed), Stroke::new(1.0, t.border), t.text)
+        (press.fill(t.card, t.hover, t.pressed), Stroke::new(1.0, t.border))
     };
     ui.painter().rect(rect, CornerRadius::same(14), fill, stroke, egui::StrokeKind::Inside);
     if marked {
         resp.request_focus();
         ui.painter().rect_stroke(rect.expand(2.0), CornerRadius::same(16), Stroke::new(2.0, t.accent), egui::StrokeKind::Outside);
     }
-    ui.painter().text(rect.translate(press.offset()).center(), Align2::CENTER_CENTER, label, font, text);
+    let body = rect.translate(press.offset());
+    ui.painter().galley(body.center() - label_galley.size() / 2.0, label_galley, text_color);
     theme::hand(resp)
 }
 
@@ -165,14 +175,15 @@ pub fn ghost_button(ui: &mut egui::Ui, icon: &str, label: &str) -> Response {
 pub fn ghost_button_sized(ui: &mut egui::Ui, icon: &str, label: &str, height: f32) -> Response {
     let t = Tokens::get(ui.ctx());
     let font = theme::medium(13.0);
-    let w = ui.fonts_mut(|f| f.layout_no_wrap(label.to_owned(), font.clone(), t.text).size().x);
+    let label_galley = crate::bidi::layout_ui(ui, label.to_owned(), font, t.text);
+    let w = label_galley.size().x;
     let (rect, resp) = ui.allocate_exact_size(vec2(w + 38.0, height), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), label));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), label));
     let press = theme::Press::track(ui, &resp);
     press.wash(ui, rect, 6, false);
     let body = rect.translate(press.offset());
     icons::paint(ui, Rect::from_min_size(body.min + vec2(6.0, (height - 18.0) / 2.0), vec2(18.0, 18.0)), icon, 17.0, t.icon);
-    ui.painter().text(body.left_center() + vec2(30.0, 0.0), Align2::LEFT_CENTER, label, font, t.text);
+    ui.painter().galley(body.left_center() + vec2(30.0, -label_galley.size().y / 2.0), label_galley, t.text);
     theme::hand(resp)
 }
 
@@ -180,7 +191,7 @@ pub fn ghost_button_sized(ui: &mut egui::Ui, icon: &str, label: &str, height: f3
 pub fn search_box(ui: &mut egui::Ui, placeholder: &str, width: f32) -> Response {
     let t = Tokens::get(ui.ctx());
     let (rect, resp) = ui.allocate_exact_size(vec2(width, 32.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), placeholder));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), placeholder));
     let press = theme::Press::track(ui, &resp);
     let fill = press.fill(t.field, t.hover, t.pressed);
     let edge = t.border.lerp_to_gamma(t.text_muted, press.hover * 0.35);
@@ -195,6 +206,7 @@ pub fn search_box(ui: &mut egui::Ui, placeholder: &str, width: f32) -> Response
     let text_left = (rect.left() + 34.0).min(text_right);
     let text_rect = Rect::from_min_max(egui::pos2(text_left, rect.top()), egui::pos2(text_right, rect.bottom()));
     let mut job = egui::text::LayoutJob::simple_singleline(placeholder.to_owned(), theme::regular(13.0), t.text_faint);
+    job.direction = crate::bidi::ui_direction();
     job.wrap = egui::text::TextWrapping { max_width: text_rect.width(), max_rows: 1, break_anywhere: true, ..Default::default() };
     let text = ui.fonts_mut(|f| f.layout_job(job));
     let elided = text.elided;
@@ -204,10 +216,6 @@ pub fn search_box(ui: &mut egui::Ui, placeholder: &str, width: f32) -> Response
     if elided { resp.on_hover_text(placeholder) } else { resp }
 }
 
-pub fn menu_item(ui: &mut egui::Ui, label: &str, shortcut: &str) -> Response {
-    ui.add(egui::Button::new(label).shortcut_text(shortcut))
-}
-
 /// Corner radius of a checkbox's box. With the widgets' radius (`Tokens::radius`, 6) egui's 14 px
 /// box is a circle, the shape of a radio button, and View ▸ Page display has both.
 const CHECKBOX_RADIUS: u8 = 3;
@@ -278,11 +286,20 @@ fn toggle<'a>(widget: impl egui::Widget + 'a, radius: Option<u8>) -> impl egui::
     }
 }
 
+/// Draw a panel section heading with explicit paragraph direction and letter spacing.
 pub fn section_title(ui: &mut egui::Ui, text: &str) {
     let t = Tokens::get(ui.ctx());
     ui.add_space(10.0);
     // Section titles across every panel go through here, so one translation point covers them.
-    ui.label(egui::RichText::new(crate::i18n::upper_label(text)).font(theme::semibold(10.5)).color(t.text_faint).extra_letter_spacing(0.6));
+    // The paragraph direction is explicit: an Arabic title beginning with Latin or a placeholder
+    // must not inherit a left-to-right base from its first strong character.
+    let mut job = egui::text::LayoutJob::simple(crate::i18n::upper_label(text), theme::semibold(10.5), t.text_faint, ui.available_width().max(0.0));
+    job.direction = crate::bidi::ui_direction();
+    if let Some(section) = job.sections.first_mut() {
+        section.format.extra_letter_spacing = 0.6;
+    }
+    let galley = ui.painter().layout_job(job);
+    ui.add(egui::Label::new(egui::WidgetText::Galley(galley)).selectable(false));
     ui.add_space(2.0);
 }
 
@@ -290,12 +307,35 @@ pub fn section_title(ui: &mut egui::Ui, text: &str) {
 /// at most `max_width` wide: a long file name or path stays inside its row (#425).
 pub fn row_text(ui: &egui::Ui, pos: egui::Pos2, text: impl Into<String>, font: egui::FontId, color: Color32, max_width: f32) {
     let mut job = egui::text::LayoutJob::simple_singleline(text.into(), font, color);
+    // A file name or path: an Arabic name keeps its extension at the visual end, as in the tab.
+    job.direction = egui::epaint::text::TextDirection::LeftToRight;
     job.wrap = egui::text::TextWrapping::truncate_at_width(max_width.max(0.0));
     let galley = ui.painter().layout_job(job);
     let rect = Align2::LEFT_CENTER.anchor_size(pos, galley.size());
     ui.painter().galley(rect.min, galley, color);
 }
 
+/// A wrapping label for a file name or folder path, laid out explicitly left to right so an
+/// Arabic name keeps `.pdf` at the end. The accessibility name is the logical text.
+pub fn label_ltr(ui: &mut egui::Ui, text: impl Into<String>, font: egui::FontId, color: Color32) -> Response {
+    let mut job = egui::text::LayoutJob::simple(text.into(), font, color, ui.available_width().max(0.0));
+    job.direction = egui::epaint::text::TextDirection::LeftToRight;
+    let galley = ui.painter().layout_job(job);
+    ui.add(egui::Label::new(egui::WidgetText::Galley(galley)).selectable(false))
+}
+
+/// [`label_ltr`] for one table row: the name is cut with an ellipsis instead of wrapping onto a
+/// second row. The logical text remains the accessibility name.
+pub fn label_ltr_truncated(ui: &mut egui::Ui, text: impl Into<String>, font: egui::FontId, color: Color32) -> Response {
+    let text = text.into();
+    let width = ui.available_width().max(0.0);
+    let mut job = egui::text::LayoutJob::simple_singleline(text, font, color);
+    job.direction = egui::epaint::text::TextDirection::LeftToRight;
+    job.wrap = egui::text::TextWrapping::truncate_at_width(width);
+    let galley = ui.painter().layout_job(job);
+    ui.add(egui::Label::new(egui::WidgetText::Galley(galley)).selectable(false))
+}
+
 /// Text wrapped to the available width, for text people write (comments, replies). A paragraph
 /// in a right-to-left script (Persian, Arabic, Hebrew) reads right to left and sits against the
 /// right edge ([`crate::bidi::wrap`]); text without one is an ordinary wrapping label.
@@ -310,11 +350,11 @@ pub fn wrapped_text(ui: &mut egui::Ui, text: &str, font: egui::FontId, color: Co
     }
     let width = ui.available_width().max(1.0);
     let lines = wrapped_lines(ui, text, &font, width, truncate);
-    let galleys: Vec<_> = lines.iter().map(|line| (line.rtl, ui.painter().layout_no_wrap(line.text.clone(), font.clone(), color))).collect();
+    let galleys: Vec<_> = lines.iter().map(|line| (line.rtl, wrapped_line_galley(ui, line, &font, color))).collect();
     let height = galleys.iter().map(|(_, g)| g.size().y).sum();
     let (rect, resp) = ui.allocate_exact_size(vec2(width, height), Sense::hover());
     // Painted text only: the accessibility name keeps the logical order.
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Label, true, text));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Label, true, text));
     let mut y = rect.top();
     for (rtl, galley) in galleys {
         let x = if rtl { rect.right() - galley.size().x } else { rect.left() };
@@ -325,6 +365,15 @@ pub fn wrapped_text(ui: &mut egui::Ui, text: &str, font: egui::FontId, color: Co
     resp
 }
 
+/// One wrapped line laid out with its own paragraph direction. A line beginning with a Latin
+/// word inside a right-to-left comment is still part of that paragraph, so its base direction
+/// must stay right to left; `Auto` would follow the Latin word instead.
+fn wrapped_line_galley(ui: &egui::Ui, line: &crate::bidi::Line, font: &egui::FontId, color: Color32) -> std::sync::Arc<egui::Galley> {
+    let mut job = egui::text::LayoutJob::simple_singleline(line.text.clone(), font.clone(), color);
+    job.direction = if line.rtl { egui::epaint::text::TextDirection::RightToLeft } else { egui::epaint::text::TextDirection::LeftToRight };
+    ui.painter().layout_job(job)
+}
+
 const ELLIPSIS: &str = "\u{2026}";
 
 /// Wrapped right-to-left text kept between frames. Wrapping measures many candidate lines, so
@@ -349,7 +398,7 @@ fn wrapped_lines(ui: &egui::Ui, text: &str, font: &egui::FontId, width: f32, tru
     let mut hasher = std::collections::hash_map::DefaultHasher::new();
     (text, font, width.to_bits(), ui.ctx().pixels_per_point().to_bits(), truncate).hash(&mut hasher);
     let key = hasher.finish();
-    let cache_id = egui::Id::new("pdfcraft-rtl-wrap-cache");
+    let cache_id = egui::Id::unique("pdfcraft-rtl-wrap-cache");
     if let Some(hit) = ui.ctx().data_mut(|d| d.get_temp_mut_or_default::<WrapCache>(cache_id).lines.get(&key).cloned()) {
         return hit;
     }
@@ -366,12 +415,9 @@ fn wrapped_lines(ui: &egui::Ui, text: &str, font: &egui::FontId, width: f32, tru
     if truncate && (lines.len() > 1 || cut) {
         lines.truncate(1);
         if let Some(line) = lines.first_mut() {
-            // The ellipsis goes where the line's reading ends: the left of a right-to-left line.
-            if line.rtl {
-                line.text.insert_str(0, ELLIPSIS);
-            } else {
-                line.text.push_str(ELLIPSIS);
-            }
+            // The ellipsis goes where the line's reading ends, in logical text: epaint places it
+            // on the left for a right-to-left line and on the right for a left-to-right one.
+            line.text.push_str(ELLIPSIS);
         }
     }
     let lines: std::sync::Arc<[crate::bidi::Line]> = lines.into();
@@ -398,9 +444,9 @@ pub fn toast(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let t = Tokens::get(ctx);
     let screen = ctx.content_rect();
     // Above the progress notice while a job runs.
-    let card = if app.progress_notice.is_some() { ctx.data(|d| d.get_temp::<f32>(egui::Id::new(PROGRESS_HEIGHT))).unwrap_or(0.0) } else { 0.0 };
+    let card = if app.progress_notice.is_some() { ctx.data(|d| d.get_temp::<f32>(egui::Id::unique(PROGRESS_HEIGHT))).unwrap_or(0.0) } else { 0.0 };
     let lift = if card > 0.0 { 28.0 + card + 10.0 } else { 28.0 };
-    egui::Area::new(egui::Id::new("toast"))
+    egui::Area::new(egui::Id::unique("toast"))
         .order(egui::Order::Tooltip)
         .pivot(Align2::CENTER_BOTTOM)
         .fixed_pos(screen.center_bottom() - vec2(0.0, lift))
@@ -453,10 +499,10 @@ pub fn progress_notice(app: &PdfCraftApp, ctx: &egui::Context) -> bool {
     };
     let fraction = if p.fraction.is_finite() { p.fraction.clamp(0.0, 1.0) } else { 0.0 };
     let animated = crate::motion::animated(ctx);
-    let shown = ctx.animate_value_with_time(egui::Id::new("progress-notice-bar"), fraction, if animated { 0.3 } else { 0.0 });
+    let shown = ctx.animate_value_with_time(egui::Id::unique("progress-notice-bar"), fraction, if animated { 0.3 } else { 0.0 });
     let now = ctx.input(|i| i.time);
     let mut cancel = false;
-    let area = egui::Area::new(egui::Id::new("progress-notice"))
+    let area = egui::Area::new(egui::Id::unique("progress-notice"))
         .order(egui::Order::Tooltip)
         .pivot(Align2::CENTER_BOTTOM)
         .fixed_pos(screen.center_bottom() - vec2(0.0, 28.0))
@@ -474,7 +520,7 @@ pub fn progress_notice(app: &PdfCraftApp, ctx: &egui::Context) -> bool {
                 let (track, resp) = ui.allocate_exact_size(vec2(width, 6.0), Sense::hover());
                 // The label above names the job; the bar carries the percentage.
                 resp.widget_info(|| {
-                    let mut info = egui::WidgetInfo::new(egui::WidgetType::ProgressIndicator);
+                    let mut info = egui::WidgetInfo::new(egui::Role::ProgressIndicator);
                     info.value = Some(f64::from(fraction) * 100.0);
                     info
                 });
@@ -504,7 +550,7 @@ pub fn progress_notice(app: &PdfCraftApp, ctx: &egui::Context) -> bool {
                 }
             });
         });
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new(PROGRESS_HEIGHT), area.response.rect.height()));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique(PROGRESS_HEIGHT), area.response.rect.height()));
     ctx.request_repaint_after(std::time::Duration::from_millis(33));
     cancel
 }
@@ -553,10 +599,10 @@ pub fn split_pill(ui: &mut egui::Ui, icon: &str, label: &str, more: &str) -> (Re
     let w = ui.fonts_mut(|f| f.layout_no_wrap(label.to_owned(), font.clone(), t.text).size().x);
     let (rect, _) = ui.allocate_exact_size(vec2(w + 46.0 + 28.0, 30.0), Sense::hover());
     let (main_rect, more_rect) = rect.split_left_right_at_x(rect.right() - 28.0);
-    let main = ui.interact(main_rect, ui.id().with(("split-pill", label)), Sense::click());
-    let arrow = ui.interact(more_rect, ui.id().with(("split-pill-more", label)), Sense::click());
-    main.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), label));
-    arrow.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), more));
+    let main = ui.interact(main_rect, ui.scope_id().with(("split-pill", label)), Sense::click());
+    let arrow = ui.interact(more_rect, ui.scope_id().with(("split-pill-more", label)), Sense::click());
+    main.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), label));
+    arrow.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), more));
     let radius = CornerRadius::same(15);
     ui.painter().rect(rect, radius, t.card, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     let left = CornerRadius { nw: 15, sw: 15, ne: 0, se: 0 };
@@ -584,7 +630,7 @@ pub fn icon_pill(ui: &mut egui::Ui, icon: &str, label: &str, primary: bool) -> R
     let font = theme::medium(12.5);
     let w = ui.fonts_mut(|f| f.layout_no_wrap(label.to_owned(), font.clone(), t.text).size().x);
     let (rect, resp) = ui.allocate_exact_size(vec2(w + 46.0, 30.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), label));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), label));
     let press = theme::Press::track(ui, &resp);
     let (fill, stroke, text) = if primary {
         (press.fill(t.accent, t.accent_text, t.accent.lerp_to_gamma(Color32::BLACK, 0.22)), Stroke::NONE, Color32::WHITE)
@@ -708,7 +754,7 @@ mod tests {
             );
             output.drop_without_applying_deltas();
         }
-        ctx.memory(|memory| memory.area_rect(egui::Id::new("toast")).unwrap())
+        ctx.memory(|memory| memory.area_rect(egui::Id::unique("toast")).unwrap())
     }
 
     #[test]
@@ -759,7 +805,7 @@ mod tests {
         let ctx = egui::Context::default();
         ctx.set_fonts(theme::font_definitions());
         let cache_len =
-            |ctx: &egui::Context| ctx.data_mut(|d| d.get_temp_mut_or_default::<WrapCache>(egui::Id::new("pdfcraft-rtl-wrap-cache")).lines.len());
+            |ctx: &egui::Context| ctx.data_mut(|d| d.get_temp_mut_or_default::<WrapCache>(egui::Id::unique("pdfcraft-rtl-wrap-cache")).lines.len());
         let persian = "این یک نظر طولانی به زبان فارسی است که باید در چند خط شکسته شود";
         let long = persian.repeat(2_000);
         let mut first = None;
@@ -773,7 +819,7 @@ mod tests {
                 first = Some(lines);
                 let collapsed = wrapped_lines(ui, &long, &theme::regular(13.0), 120.0, true);
                 assert_eq!(collapsed.len(), 1);
-                assert!(collapsed[0].text.starts_with(ELLIPSIS), "{:?}", collapsed[0].text);
+                assert!(collapsed[0].text.ends_with(ELLIPSIS), "{:?}", collapsed[0].text);
             })
             .drop_without_applying_deltas();
         }
@@ -787,6 +833,61 @@ mod tests {
         assert!(cache_len(&ctx) <= WRAP_CACHE_MAX, "bounded: {}", cache_len(&ctx));
     }
 
+    /// Comment lines reach epaint in logical order. A mixed Persian/Latin comment preordered by
+    /// `bidi::wrap` would be reordered a second time by egui 0.37; the old display-order text is
+    /// distinctly different, so this fails if the preordering comes back.
+    #[test]
+    fn rtl_comment_lines_stay_logical_for_epaint() {
+        let mixed = "این نظر PDF درباره فایل است";
+        let ctx = egui::Context::default();
+        ctx.set_fonts(theme::font_definitions());
+        ctx.run_ui(egui::RawInput::default(), |ui| {
+            let lines = wrapped_lines(ui, mixed, &theme::regular(13.0), 1000.0, false);
+            assert_eq!(lines.len(), 1);
+            assert_eq!(lines[0].text, mixed, "epaint needs reading order, not display order");
+            assert!(lines[0].rtl);
+            // Truncation appends the ellipsis logically; the line still starts with its first word.
+            let cut = wrapped_lines(ui, mixed, &theme::regular(13.0), 60.0, true);
+            assert_eq!(cut.len(), 1);
+            assert!(cut[0].text.starts_with("این"), "{:?}", cut[0].text);
+            assert!(cut[0].text.ends_with(ELLIPSIS), "{:?}", cut[0].text);
+            // The galley keeps logical text, so inspect positioned glyphs to prove that the
+            // visible ellipsis is at the left-hand reading end after epaint's bidi layout.
+            let galley = ui.painter().layout_no_wrap(cut[0].text.clone(), theme::regular(13.0), Color32::WHITE);
+            let row = &galley.rows[0];
+            let ellipsis_x = row.glyphs.iter().find(|glyph| glyph.chr == '\u{2026}').expect("ellipsis glyph").pos.x;
+            assert!(
+                row.glyphs.iter().filter(|glyph| glyph.chr != '\u{2026}' && !glyph.chr.is_whitespace()).all(|glyph| glyph.pos.x > ellipsis_x),
+                "RTL truncation must place the ellipsis to the left: {:?}",
+                row.glyphs
+            );
+        })
+        .drop_without_applying_deltas();
+    }
+
+    /// A wrapped line keeps its paragraph's direction. The second line here starts with a
+    /// Latin word, but belongs to a right-to-left comment: `Auto` would shape it left to right
+    /// and put `PDF` at the visual left. Assert the actual painted positions instead.
+    #[test]
+    fn wrapped_rtl_line_starting_with_latin_keeps_its_rtl_base() {
+        if pdfcraft_fonts::ui_arabic_fonts().is_empty() {
+            return;
+        }
+        let ctx = egui::Context::default();
+        ctx.set_fonts(theme::font_definitions());
+        ctx.run_ui(egui::RawInput::default(), |ui| {
+            let line = crate::bidi::Line { text: "PDF درباره فایل است".to_owned(), rtl: true };
+            let galley = wrapped_line_galley(ui, &line, &theme::regular(13.0), Color32::WHITE);
+            assert_eq!(galley.job.direction, egui::epaint::text::TextDirection::RightToLeft);
+            let positions: Vec<_> = galley.rows.iter().flat_map(|row| row.glyphs.iter().map(|g| (g.chr, g.pos.x))).collect();
+            let p = positions.iter().find(|(c, _)| *c == 'P').map(|(_, x)| *x).expect("a Latin P");
+            let rightmost_arabic = positions.iter().filter(|(c, _)| crate::bidi::has_rtl(&c.to_string())).map(|(_, x)| *x).fold(f32::MIN, f32::max);
+            assert!(p > rightmost_arabic, "the line stays right to left: {positions:?}");
+        })
+        .drop_without_applying_deltas();
+    }
+
+    /// Check right-aligned wrapping and a single collapsed line whose logical text ends with an ellipsis.
     #[test]
     fn rtl_comment_wraps_against_the_right_edge() {
         let persian = "این یک نظر طولانی به زبان فارسی است که باید در چند خط شکسته شود";
@@ -803,7 +904,7 @@ mod tests {
         // Collapsed: one line, its ellipsis on the left where right-to-left reading ends.
         let collapsed = wrapped_shapes(persian, true);
         assert_eq!(collapsed.len(), 1);
-        assert!(collapsed[0].2.starts_with('\u{2026}'), "{collapsed:?}");
+        assert!(collapsed[0].2.ends_with('\u{2026}'), "the galley retains logical text: {collapsed:?}");
         // Text without right-to-left script is a plain label, as before.
         let latin = wrapped_shapes("A short note", false);
         assert_eq!(latin.len(), 1);
diff --git a/crates/ui-egui/src/widgets/icon_data.rs b/crates/ui-egui/src/widgets/icon_data.rs
new file mode 100644
index 0000000000..72829fe4b8
--- /dev/null
+++ b/crates/ui-egui/src/widgets/icon_data.rs
@@ -0,0 +1,195 @@
+//! Lucide icons (ISC licence, see assets/icons/LICENSE-lucide.txt), embedded and tinted at runtime.
+//! Generated from the contents of assets/icons/.
+
+pub static ICONS: &[(&str, &[u8])] = &[
+    ("accessibility", include_bytes!("../../../../assets/icons/accessibility.svg")),
+    ("align-center", include_bytes!("../../../../assets/icons/align-center.svg")),
+    ("align-justify", include_bytes!("../../../../assets/icons/align-justify.svg")),
+    ("file-spreadsheet", include_bytes!("../../../../assets/icons/file-spreadsheet.svg")),
+    ("file-code", include_bytes!("../../../../assets/icons/file-code.svg")),
+    ("square-terminal", include_bytes!("../../../../assets/icons/square-terminal.svg")),
+    ("align-left", include_bytes!("../../../../assets/icons/align-left.svg")),
+    ("align-right", include_bytes!("../../../../assets/icons/align-right.svg")),
+    ("app-window", include_bytes!("../../../../assets/icons/app-window.svg")),
+    ("arrow-left-right", include_bytes!("../../../../assets/icons/arrow-left-right.svg")),
+    ("arrow-up-down", include_bytes!("../../../../assets/icons/arrow-up-down.svg")),
+    ("arrow-up-right", include_bytes!("../../../../assets/icons/arrow-up-right.svg")),
+    ("badge-check", include_bytes!("../../../../assets/icons/badge-check.svg")),
+    ("bandage", include_bytes!("../../../../assets/icons/bandage.svg")),
+    ("bell", include_bytes!("../../../../assets/icons/bell.svg")),
+    ("blend", include_bytes!("../../../../assets/icons/blend.svg")),
+    ("bold", include_bytes!("../../../../assets/icons/bold.svg")),
+    ("book-open", include_bytes!("../../../../assets/icons/book-open.svg")),
+    ("bookmark", include_bytes!("../../../../assets/icons/bookmark.svg")),
+    ("bookmark-plus", include_bytes!("../../../../assets/icons/bookmark-plus.svg")),
+    ("braces", include_bytes!("../../../../assets/icons/braces.svg")),
+    ("brush", include_bytes!("../../../../assets/icons/brush.svg")),
+    ("brush-cleaning", include_bytes!("../../../../assets/icons/brush-cleaning.svg")),
+    ("camera", include_bytes!("../../../../assets/icons/camera.svg")),
+    ("check", include_bytes!("../../../../assets/icons/check.svg")),
+    ("check-circle-2", include_bytes!("../../../../assets/icons/check-circle-2.svg")),
+    ("chevron-down", include_bytes!("../../../../assets/icons/chevron-down.svg")),
+    ("chevron-left", include_bytes!("../../../../assets/icons/chevron-left.svg")),
+    ("chevron-right", include_bytes!("../../../../assets/icons/chevron-right.svg")),
+    ("chevron-up", include_bytes!("../../../../assets/icons/chevron-up.svg")),
+    ("chevrons-left", include_bytes!("../../../../assets/icons/chevrons-left.svg")),
+    ("chevrons-right", include_bytes!("../../../../assets/icons/chevrons-right.svg")),
+    ("circle", include_bytes!("../../../../assets/icons/circle.svg")),
+    ("circle-check", include_bytes!("../../../../assets/icons/circle-check.svg")),
+    ("circle-dashed", include_bytes!("../../../../assets/icons/circle-dashed.svg")),
+    ("circle-dot", include_bytes!("../../../../assets/icons/circle-dot.svg")),
+    ("circle-help", include_bytes!("../../../../assets/icons/circle-help.svg")),
+    ("circle-x", include_bytes!("../../../../assets/icons/circle-x.svg")),
+    ("clipboard-paste", include_bytes!("../../../../assets/icons/clipboard-paste.svg")),
+    ("clock", include_bytes!("../../../../assets/icons/clock.svg")),
+    ("clock-3", include_bytes!("../../../../assets/icons/clock-3.svg")),
+    ("cloud", include_bytes!("../../../../assets/icons/cloud.svg")),
+    ("cloud-upload", include_bytes!("../../../../assets/icons/cloud-upload.svg")),
+    ("code-xml", include_bytes!("../../../../assets/icons/code-xml.svg")),
+    ("columns-2", include_bytes!("../../../../assets/icons/columns-2.svg")),
+    ("columns-3", include_bytes!("../../../../assets/icons/columns-3.svg")),
+    ("compass", include_bytes!("../../../../assets/icons/compass.svg")),
+    ("contrast", include_bytes!("../../../../assets/icons/contrast.svg")),
+    ("copy", include_bytes!("../../../../assets/icons/copy.svg")),
+    ("copy-plus", include_bytes!("../../../../assets/icons/copy-plus.svg")),
+    ("crop", include_bytes!("../../../../assets/icons/crop.svg")),
+    ("droplet", include_bytes!("../../../../assets/icons/droplet.svg")),
+    ("ellipsis", include_bytes!("../../../../assets/icons/ellipsis.svg")),
+    ("ellipsis-vertical", include_bytes!("../../../../assets/icons/ellipsis-vertical.svg")),
+    ("eraser", include_bytes!("../../../../assets/icons/eraser.svg")),
+    ("external-link", include_bytes!("../../../../assets/icons/external-link.svg")),
+    ("eye", include_bytes!("../../../../assets/icons/eye.svg")),
+    ("eye-off", include_bytes!("../../../../assets/icons/eye-off.svg")),
+    ("file-check", include_bytes!("../../../../assets/icons/file-check.svg")),
+    ("file-down", include_bytes!("../../../../assets/icons/file-down.svg")),
+    ("file-input", include_bytes!("../../../../assets/icons/file-input.svg")),
+    ("file-lock-2", include_bytes!("../../../../assets/icons/file-lock-2.svg")),
+    ("file-minus", include_bytes!("../../../../assets/icons/file-minus.svg")),
+    ("file-output", include_bytes!("../../../../assets/icons/file-output.svg")),
+    ("file-pen-line", include_bytes!("../../../../assets/icons/file-pen-line.svg")),
+    ("file-plus", include_bytes!("../../../../assets/icons/file-plus.svg")),
+    ("file-plus-2", include_bytes!("../../../../assets/icons/file-plus-2.svg")),
+    ("file-scan", include_bytes!("../../../../assets/icons/file-scan.svg")),
+    ("file-search", include_bytes!("../../../../assets/icons/file-search.svg")),
+    ("file-symlink", include_bytes!("../../../../assets/icons/file-symlink.svg")),
+    ("file-text", include_bytes!("../../../../assets/icons/file-text.svg")),
+    ("file-x", include_bytes!("../../../../assets/icons/file-x.svg")),
+    ("files", include_bytes!("../../../../assets/icons/files.svg")),
+    ("film", include_bytes!("../../../../assets/icons/film.svg")),
+    ("filter", include_bytes!("../../../../assets/icons/filter.svg")),
+    ("flip-horizontal-2", include_bytes!("../../../../assets/icons/flip-horizontal-2.svg")),
+    ("flip-vertical-2", include_bytes!("../../../../assets/icons/flip-vertical-2.svg")),
+    ("folder", include_bytes!("../../../../assets/icons/folder.svg")),
+    ("folder-open", include_bytes!("../../../../assets/icons/folder-open.svg")),
+    ("folder-plus", include_bytes!("../../../../assets/icons/folder-plus.svg")),
+    ("gauge", include_bytes!("../../../../assets/icons/gauge.svg")),
+    ("git-compare", include_bytes!("../../../../assets/icons/git-compare.svg")),
+    ("globe", include_bytes!("../../../../assets/icons/globe.svg")),
+    ("grid-3x3", include_bytes!("../../../../assets/icons/grid-3x3.svg")),
+    ("hand", include_bytes!("../../../../assets/icons/hand.svg")),
+    ("hash", include_bytes!("../../../../assets/icons/hash.svg")),
+    ("heading", include_bytes!("../../../../assets/icons/heading.svg")),
+    ("highlighter", include_bytes!("../../../../assets/icons/highlighter.svg")),
+    ("house", include_bytes!("../../../../assets/icons/house.svg")),
+    ("image", include_bytes!("../../../../assets/icons/image.svg")),
+    ("image-plus", include_bytes!("../../../../assets/icons/image-plus.svg")),
+    ("info", include_bytes!("../../../../assets/icons/info.svg")),
+    ("italic", include_bytes!("../../../../assets/icons/italic.svg")),
+    ("languages", include_bytes!("../../../../assets/icons/languages.svg")),
+    ("lasso", include_bytes!("../../../../assets/icons/lasso.svg")),
+    ("layers", include_bytes!("../../../../assets/icons/layers.svg")),
+    ("layout-grid", include_bytes!("../../../../assets/icons/layout-grid.svg")),
+    ("link", include_bytes!("../../../../assets/icons/link.svg")),
+    ("link-2", include_bytes!("../../../../assets/icons/link-2.svg")),
+    ("list", include_bytes!("../../../../assets/icons/list.svg")),
+    ("list-checks", include_bytes!("../../../../assets/icons/list-checks.svg")),
+    ("list-ordered", include_bytes!("../../../../assets/icons/list-ordered.svg")),
+    ("lock", include_bytes!("../../../../assets/icons/lock.svg")),
+    ("lock-open", include_bytes!("../../../../assets/icons/lock-open.svg")),
+    ("maximize", include_bytes!("../../../../assets/icons/maximize.svg")),
+    ("maximize-2", include_bytes!("../../../../assets/icons/maximize-2.svg")),
+    ("message-circle-reply", include_bytes!("../../../../assets/icons/message-circle-reply.svg")),
+    ("message-square", include_bytes!("../../../../assets/icons/message-square.svg")),
+    ("message-square-plus", include_bytes!("../../../../assets/icons/message-square-plus.svg")),
+    ("message-square-quote", include_bytes!("../../../../assets/icons/message-square-quote.svg")),
+    ("message-square-text", include_bytes!("../../../../assets/icons/message-square-text.svg")),
+    ("messages-square", include_bytes!("../../../../assets/icons/messages-square.svg")),
+    ("mic", include_bytes!("../../../../assets/icons/mic.svg")),
+    ("minimize", include_bytes!("../../../../assets/icons/minimize.svg")),
+    ("minimize-2", include_bytes!("../../../../assets/icons/minimize-2.svg")),
+    ("minus", include_bytes!("../../../../assets/icons/minus.svg")),
+    ("monitor", include_bytes!("../../../../assets/icons/monitor.svg")),
+    ("moon", include_bytes!("../../../../assets/icons/moon.svg")),
+    ("mouse-pointer-2", include_bytes!("../../../../assets/icons/mouse-pointer-2.svg")),
+    ("move", include_bytes!("../../../../assets/icons/move.svg")),
+    ("move-right", include_bytes!("../../../../assets/icons/move-right.svg")),
+    ("navigation", include_bytes!("../../../../assets/icons/navigation.svg")),
+    ("paint-bucket", include_bytes!("../../../../assets/icons/paint-bucket.svg")),
+    ("palette", include_bytes!("../../../../assets/icons/palette.svg")),
+    ("panel-left", include_bytes!("../../../../assets/icons/panel-left.svg")),
+    ("panel-right", include_bytes!("../../../../assets/icons/panel-right.svg")),
+    ("panels-top-left", include_bytes!("../../../../assets/icons/panels-top-left.svg")),
+    ("paperclip", include_bytes!("../../../../assets/icons/paperclip.svg")),
+    ("pen-line", include_bytes!("../../../../assets/icons/pen-line.svg")),
+    ("pen-tool", include_bytes!("../../../../assets/icons/pen-tool.svg")),
+    ("pencil", include_bytes!("../../../../assets/icons/pencil.svg")),
+    ("pentagon", include_bytes!("../../../../assets/icons/pentagon.svg")),
+    ("pin", include_bytes!("../../../../assets/icons/pin.svg")),
+    ("pipette", include_bytes!("../../../../assets/icons/pipette.svg")),
+    ("plus", include_bytes!("../../../../assets/icons/plus.svg")),
+    ("presentation", include_bytes!("../../../../assets/icons/presentation.svg")),
+    ("printer", include_bytes!("../../../../assets/icons/printer.svg")),
+    ("rectangle-horizontal", include_bytes!("../../../../assets/icons/rectangle-horizontal.svg")),
+    ("redo-2", include_bytes!("../../../../assets/icons/redo-2.svg")),
+    ("replace", include_bytes!("../../../../assets/icons/replace.svg")),
+    ("reply", include_bytes!("../../../../assets/icons/reply.svg")),
+    ("rotate-ccw", include_bytes!("../../../../assets/icons/rotate-ccw.svg")),
+    ("rotate-cw", include_bytes!("../../../../assets/icons/rotate-cw.svg")),
+    ("rows-3", include_bytes!("../../../../assets/icons/rows-3.svg")),
+    ("ruler", include_bytes!("../../../../assets/icons/ruler.svg")),
+    ("save", include_bytes!("../../../../assets/icons/save.svg")),
+    ("scan", include_bytes!("../../../../assets/icons/scan.svg")),
+    ("scan-text", include_bytes!("../../../../assets/icons/scan-text.svg")),
+    ("scissors", include_bytes!("../../../../assets/icons/scissors.svg")),
+    ("search", include_bytes!("../../../../assets/icons/search.svg")),
+    ("send", include_bytes!("../../../../assets/icons/send.svg")),
+    ("settings", include_bytes!("../../../../assets/icons/settings.svg")),
+    ("settings-2", include_bytes!("../../../../assets/icons/settings-2.svg")),
+    ("share-2", include_bytes!("../../../../assets/icons/share-2.svg")),
+    ("shield-check", include_bytes!("../../../../assets/icons/shield-check.svg")),
+    ("signature", include_bytes!("../../../../assets/icons/signature.svg")),
+    ("sliders-horizontal", include_bytes!("../../../../assets/icons/sliders-horizontal.svg")),
+    ("sparkles", include_bytes!("../../../../assets/icons/sparkles.svg")),
+    ("spline", include_bytes!("../../../../assets/icons/spline.svg")),
+    ("square", include_bytes!("../../../../assets/icons/square.svg")),
+    ("square-dashed", include_bytes!("../../../../assets/icons/square-dashed.svg")),
+    ("square-dashed-mouse-pointer", include_bytes!("../../../../assets/icons/square-dashed-mouse-pointer.svg")),
+    ("squares-subtract", include_bytes!("../../../../assets/icons/squares-subtract.svg")),
+    ("stamp", include_bytes!("../../../../assets/icons/stamp.svg")),
+    ("star", include_bytes!("../../../../assets/icons/star.svg")),
+    ("sticky-note", include_bytes!("../../../../assets/icons/sticky-note.svg")),
+    ("strikethrough", include_bytes!("../../../../assets/icons/strikethrough.svg")),
+    ("sun", include_bytes!("../../../../assets/icons/sun.svg")),
+    ("swatch-book", include_bytes!("../../../../assets/icons/swatch-book.svg")),
+    ("tag", include_bytes!("../../../../assets/icons/tag.svg")),
+    ("text-cursor-input", include_bytes!("../../../../assets/icons/text-cursor-input.svg")),
+    ("text-select", include_bytes!("../../../../assets/icons/text-select.svg")),
+    ("thumbs-down", include_bytes!("../../../../assets/icons/thumbs-down.svg")),
+    ("thumbs-up", include_bytes!("../../../../assets/icons/thumbs-up.svg")),
+    ("trash", include_bytes!("../../../../assets/icons/trash.svg")),
+    ("trash-2", include_bytes!("../../../../assets/icons/trash-2.svg")),
+    ("triangle-alert", include_bytes!("../../../../assets/icons/triangle-alert.svg")),
+    ("type", include_bytes!("../../../../assets/icons/type.svg")),
+    ("underline", include_bytes!("../../../../assets/icons/underline.svg")),
+    ("undo-2", include_bytes!("../../../../assets/icons/undo-2.svg")),
+    ("user-round", include_bytes!("../../../../assets/icons/user-round.svg")),
+    ("wand-sparkles", include_bytes!("../../../../assets/icons/wand-sparkles.svg")),
+    ("wrench", include_bytes!("../../../../assets/icons/wrench.svg")),
+    ("move-horizontal", include_bytes!("../../../../assets/icons/move-horizontal.svg")),
+    ("pilcrow", include_bytes!("../../../../assets/icons/pilcrow.svg")),
+    ("subscript", include_bytes!("../../../../assets/icons/subscript.svg")),
+    ("superscript", include_bytes!("../../../../assets/icons/superscript.svg")),
+    ("x", include_bytes!("../../../../assets/icons/x.svg")),
+    ("zoom-in", include_bytes!("../../../../assets/icons/zoom-in.svg")),
+    ("zoom-out", include_bytes!("../../../../assets/icons/zoom-out.svg")),
+];
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/widgets/icons.rs
similarity index 99%
rename from crates/ui-egui/src/icons.rs
rename to crates/ui-egui/src/widgets/icons.rs
index 79254afa2f..5ad5425e8d 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/widgets/icons.rs
@@ -20,7 +20,7 @@ pub fn exists(name: &str) -> bool {
     white_icons().contains(name)
 }
 
-fn source(name: &str) -> egui::ImageSource<'static> {
+pub(crate) fn source(name: &str) -> egui::ImageSource<'static> {
     // PdfCraft caches an unknown name under the resolved fallback name.
     white_icons().source(white_icons().canonical_name(name).unwrap_or("square"))
 }
diff --git a/crates/ui-egui/src/workflows.rs b/crates/ui-egui/src/workflows.rs
new file mode 100644
index 0000000000..63686a70cc
--- /dev/null
+++ b/crates/ui-egui/src/workflows.rs
@@ -0,0 +1,14 @@
+pub(super) mod a11y_ui;
+pub(super) mod actions_ui;
+pub(super) mod combine_grid;
+pub(super) mod combine_ui;
+pub(super) mod compare_ui;
+pub(super) mod create_multiple_ui;
+pub(super) mod create_ui;
+pub(super) mod export_ui;
+pub(super) mod files;
+pub(super) mod js_ui;
+pub(super) mod ocr_ui;
+pub(super) mod optimize_ui;
+pub(super) mod print_ui;
+pub(super) mod web_print;
diff --git a/crates/ui-egui/src/a11y_ui.rs b/crates/ui-egui/src/workflows/a11y_ui.rs
similarity index 99%
rename from crates/ui-egui/src/a11y_ui.rs
rename to crates/ui-egui/src/workflows/a11y_ui.rs
index 2130c927a0..9081e5cb32 100644
--- a/crates/ui-egui/src/a11y_ui.rs
+++ b/crates/ui-egui/src/workflows/a11y_ui.rs
@@ -103,7 +103,7 @@ pub(crate) fn options_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens)
     group(ui, &crate::i18n::fmt(tl!("Checking Options ({on} of 32 in all categories)"), &[("on", &on.to_string())]), &mut |ui| {
         ui.horizontal(|ui| {
             ui.label(tl!("Category:"));
-            egui::ComboBox::from_id_salt("a11y-category").selected_text(tl!(o.category.label())).width(260.0).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("a11y-category").selected_text(tl!(o.category.label())).width(260.0).show_ui(ui, |ui| {
                 for c in Category::ALL {
                     ui.selectable_value(&mut o.category, c, tl!(c.label()));
                 }
diff --git a/crates/ui-egui/src/actions_ui.rs b/crates/ui-egui/src/workflows/actions_ui.rs
similarity index 94%
rename from crates/ui-egui/src/actions_ui.rs
rename to crates/ui-egui/src/workflows/actions_ui.rs
index 89cf2569e8..5ef299102f 100644
--- a/crates/ui-egui/src/actions_ui.rs
+++ b/crates/ui-egui/src/workflows/actions_ui.rs
@@ -301,16 +301,18 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool
     close
 }
 
+/// Draw the custom-action editor: name, description and ordered steps; Save stays disabled until the name is
+/// unique and non-empty and at least one step exists.
 fn edit_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     let Some((original, a)) = app.wizard.editing.as_mut() else { return false };
     ui.label(egui::RichText::new(if original.is_some() { tl!("Edit Action") } else { tl!("New Action") }).font(theme::semibold(18.0)));
     ui.add_space(8.0);
     egui::Grid::new("action-edit").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-        ui.label(tl!("Action name:"));
-        ui.add(crate::widgets::line(&mut a.name).desired_width(320.0).id_salt("action-name"));
+        let name_label = ui.label(tl!("Action name:"));
+        ui.add(crate::widgets::line(&mut a.name).desired_width(320.0).id_salt("action-name")).labelled_by(name_label.id);
         ui.end_row();
-        ui.label(tl!("Description:"));
-        ui.add(crate::widgets::line(&mut a.description).desired_width(320.0).id_salt("action-description"));
+        let description_label = ui.label(tl!("Description:"));
+        ui.add(crate::widgets::line(&mut a.description).desired_width(320.0).id_salt("action-description")).labelled_by(description_label.id);
         ui.end_row();
     });
     ui.add_space(6.0);
@@ -324,9 +326,9 @@ fn edit_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
         for (i, s) in a.steps.iter_mut().enumerate() {
             ui.push_id(i, |ui| {
                 ui.horizontal(|ui| {
-                    ui.label(format!("{}. {}", i + 1, tl!(s.label())));
+                    let step_label = ui.label(format!("{}. {}", i + 1, tl!(s.label())));
                     if let Some(arg) = s.arg_mut() {
-                        ui.add(crate::widgets::line(arg).desired_width(220.0));
+                        ui.add(crate::widgets::line(arg).desired_width(220.0)).labelled_by(step_label.id);
                     }
                     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                         if ui.button(tl!("Remove")).clicked() {
@@ -343,11 +345,14 @@ fn edit_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     let all = Step::all();
     let add = &mut app.wizard.add;
     ui.horizontal(|ui| {
-        egui::ComboBox::from_id_salt("action-add-step").selected_text(tl!(all[(*add).min(all.len() - 1)].label())).width(240.0).show_ui(ui, |ui| {
-            for (i, s) in all.iter().enumerate() {
-                ui.selectable_value(add, i, tl!(s.label()));
-            }
-        });
+        craft_ui::ComboBox::from_id_salt("action-add-step").selected_text(tl!(all[(*add).min(all.len() - 1)].label())).width(240.0).show_ui(
+            ui,
+            |ui| {
+                for (i, s) in all.iter().enumerate() {
+                    ui.selectable_value(add, i, tl!(s.label()));
+                }
+            },
+        );
         if ui.button(tl!("Add Step")).clicked() {
             a.steps.push(all[(*add).min(all.len() - 1)].clone());
         }
diff --git a/crates/ui-egui/src/workflows/combine_grid.rs b/crates/ui-egui/src/workflows/combine_grid.rs
new file mode 100644
index 0000000000..fab14b8ddc
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_grid.rs
@@ -0,0 +1,575 @@
+//! Combine files as a grid: a thumbnail of the first page each file contributes, drawn as a
+//! stack when it contributes more than one, with its name below. Cards are selected and moved
+//! with the same [`RowAction`]s as the table's rows, so both views share the selection, the
+//! order and the undo history.
+//!
+//! Thumbnails render off the UI thread through [`RenderPool`] (its panic guard, size caps and
+//! watchdog), one small pool per thumbnail. Only missing ones are asked for, those in view first.
+//! At most [`MAX_THREADS`] render threads exist at once, counted as threads, not pools: the pools
+//! start no watchdog replacements ([`RenderPool::without_replacements`]), and a pool's threads
+//! count until they have actually exited ([`RenderPool::retire`]), so a render the watchdog gave
+//! up on, or one whose file left the list, holds its place until its thread is gone. A thread
+//! stuck for good in one step that can't be interrupted keeps its place for good: threads can't
+//! be killed safely. On the web the pool renders on the UI thread inside `try_recv`, with no
+//! watchdog: there, at most one thumbnail per frame, only one waits at a time (its pool holds the
+//! parsed document), and a very slow page still stalls that frame (as in the document view).
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use egui::{Align2, Color32, CornerRadius, Rect, Sense, Stroke, TextureHandle, Vec2, pos2, vec2};
+use pdfcraft_render::{RenderConfig, RenderPool, RenderRequest, Retiring};
+
+use crate::PdfCraftApp;
+use crate::combine_ui::{CombineFile, ERROR, Lock, RowAction, WARNING};
+use crate::icons;
+use crate::theme::{self, Tokens};
+
+mod card;
+mod thumbs;
+
+use card::Card;
+pub(crate) use card::preview;
+pub use thumbs::ThumbState;
+pub(crate) use thumbs::Thumbs;
+#[cfg(test)]
+use thumbs::{Entry, Job, Look, MAX_SIDE, MAX_THREADS, Want};
+use thumbs::{Key, PREVIEW, Slot};
+/// The box a page is fitted in at 100%, and the room the card adds around it (for the hover bar
+/// and the stack above it, the name and a note below), which doesn't scale.
+const PAPER: Vec2 = vec2(132.0, 172.0);
+const AROUND: Vec2 = vec2(52.0, 90.0);
+/// From the top of a card to its page box: room for the hover bar, which sits mostly above the
+/// page.
+const ABOVE: f32 = 32.0;
+/// The hover bar's height; a quarter of it overlaps the page.
+const BAR_H: f32 = 34.0;
+/// The grid's zoom range, and the sizes its buttons and keys step through (the slider, the wheel
+/// and a pinch go anywhere between).
+pub(crate) const ZOOM_RANGE: std::ops::RangeInclusive<f32> = 0.6..=5.0;
+const ZOOM_STEPS: [f32; 11] = [0.6, 0.8, 1.0, 1.25, 1.5, 1.75, 2.0, 2.5, 3.0, 4.0, 5.0];
+
+/// The next size up (or down) from `zoom`; the end of the range stays put.
+pub(crate) fn zoom_step(zoom: f32, larger: bool) -> f32 {
+    let next =
+        if larger { ZOOM_STEPS.iter().copied().find(|s| *s > zoom + 0.001) } else { ZOOM_STEPS.iter().rev().copied().find(|s| *s < zoom - 0.001) };
+    next.unwrap_or(if larger { *ZOOM_RANGE.end() } else { *ZOOM_RANGE.start() })
+}
+/// Space above the first row of cards.
+const TOP: f32 = 12.0;
+/// The most pages one file can be spread out into (each is a card, laid out every frame).
+pub(crate) const MAX_EXPAND: usize = 2000;
+/// The shape drawn for a page whose size is unknown (US Letter); nothing is rendered for it.
+const FALLBACK_PAGE: (f32, f32) = (612.0, 792.0);
+/// Icons drawn on the (always white) paper, in either theme: the light theme's muted text, which
+/// keeps its contrast on white where the dark theme's doesn't.
+const ON_PAPER: Color32 = Color32::from_rgb(0x5E, 0x5E, 0x66);
+
+/// A card being dragged: which file, and the list as it was (see [`RowAction::DropAt`]).
+#[derive(Clone, Copy)]
+struct GridDrag {
+    file: u64,
+    revision: u64,
+    /// A page card's page (entry id, place among its pages): that page moves, not its file.
+    page: Option<(u64, usize)>,
+}
+
+/// `name` shortened in the middle to what `fits`, keeping its extension ("Pilot Boat Ad….pdf").
+pub(crate) fn fit_name(name: &str, fits: impl Fn(&str) -> bool) -> String {
+    if fits(name) {
+        return name.to_owned();
+    }
+    // A short extension after the last dot (a dot is one byte, so these are char boundaries).
+    let split = name.rfind('.').filter(|p| *p > 0 && name.len() - p <= 6);
+    let (stem, ext) = match split {
+        Some(p) => (name.get(..p).unwrap_or(name), name.get(p..).unwrap_or("")),
+        None => (name, ""),
+    };
+    let chars: Vec<char> = stem.chars().collect();
+    let with = |n: usize| format!("{}…{ext}", chars.iter().take(n).collect::<String>());
+    // The longest start of the stem that fits, found by halving.
+    let (mut lo, mut hi) = (0usize, chars.len());
+    while lo < hi {
+        let mid = lo + (hi - lo).div_ceil(2);
+        if fits(&with(mid)) { lo = mid } else { hi = mid - 1 }
+    }
+    with(lo)
+}
+
+/// The box a page is fitted in at `zoom` (clamped to [`ZOOM_RANGE`]).
+fn paper_box(zoom: f32) -> Vec2 {
+    let zoom = if zoom.is_finite() { zoom.clamp(*ZOOM_RANGE.start(), *ZOOM_RANGE.end()) } else { 1.0 };
+    PAPER * zoom
+}
+
+/// The size to draw a page of `w` × `h` points in `fit`; `None` for a size that isn't one.
+fn paper_size(w: f32, h: f32, fit: Vec2) -> Option<Vec2> {
+    if !(w.is_finite() && h.is_finite() && w > 0.0 && h > 0.0) {
+        return None;
+    }
+    let s = (fit.x / w).min(fit.y / h);
+    s.is_finite().then(|| vec2(w * s, h * s))
+}
+
+/// How many cards of `cell` fit across `width` (at least one).
+fn columns_in(width: f32, cell: Vec2) -> usize {
+    ((width - 16.0) / cell.x).floor().max(1.0) as usize
+}
+
+/// What one place in the grid shows: a file's card, or (the file expanded) one of the pages it
+/// adds.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Cell {
+    /// The file, by its place in the list.
+    pub(crate) file: usize,
+    /// For a page: its place among the pages the file adds, the page (0-based, in the file) and
+    /// how many it adds.
+    pub(crate) page: Option<(usize, usize, usize)>,
+}
+
+/// The pages an expanded file shows: in its range's order, and sorted (to look one up), for the
+/// range and page count they were worked out for.
+#[derive(Clone, Debug)]
+pub(crate) struct PageList {
+    of: (String, usize),
+    pub(crate) order: Arc<[usize]>,
+    sorted: Arc<[usize]>,
+}
+
+/// The pages an expanded file shows, worked out again only when its range or page count
+/// changes; `None` when it can't be shown as its pages (locked, unreadable, a bad range, no page,
+/// or more than [`MAX_EXPAND`]).
+pub(crate) fn pages_shown(cache: &mut HashMap<u64, PageList>, f: &CombineFile) -> Option<PageList> {
+    if f.lock.is_some() || f.problem.is_some() {
+        return None;
+    }
+    let list = match cache.get(&f.id) {
+        Some(list) if list.of.0 == f.range && list.of.1 == f.pages => list.clone(),
+        _ => {
+            let order = f.pages_taken().ok()?;
+            let mut sorted = order.clone();
+            sorted.sort_unstable();
+            let list = PageList { of: (f.range.clone(), f.pages), order: Arc::from(order), sorted: Arc::from(sorted) };
+            cache.insert(f.id, list.clone());
+            list
+        }
+    };
+    // (One page shows as a page card too: a file split into parts may leave one page in a part.)
+    (!list.order.is_empty() && list.order.len() <= MAX_EXPAND).then_some(list)
+}
+
+/// The grid's places, in order: each file's card, or its pages when it is expanded.
+fn layout(app: &mut PdfCraftApp) -> Vec<Cell> {
+    let tab = &mut app.combine_tab;
+    let mut cells = Vec::with_capacity(app.combine_draft.len());
+    for (file, f) in app.combine_draft.iter().enumerate() {
+        match tab.expanded.contains(&f.id).then(|| pages_shown(&mut tab.page_lists, f)).flatten() {
+            Some(list) => {
+                let of = list.order.len();
+                cells.extend(list.order.iter().enumerate().map(|(nth, &page)| Cell { file, page: Some((nth, page, of)) }));
+            }
+            None => cells.push(Cell { file, page: None }),
+        }
+    }
+    cells
+}
+
+/// The file gap (0 = before the first file, n = after the last) a drop before place `at` means: a
+/// drop inside an expanded file's pages goes to the nearer end of that file.
+fn file_gap(cells: &[Cell], at: usize, files: usize) -> usize {
+    match cells.get(at) {
+        None => files,
+        Some(Cell { file, page: Some((nth, _, of)) }) if *nth > 0 => {
+            if nth.saturating_mul(2) < *of {
+                *file
+            } else {
+                file.saturating_add(1)
+            }
+        }
+        Some(c) => c.file,
+    }
+}
+
+/// The grid of files, in the card that holds the list. Returns what the user did.
+pub(crate) fn grid(
+    app: &mut PdfCraftApp,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    checks: &[Result<usize, String>],
+    selected: &[bool],
+    twice: &[bool],
+) -> Option<RowAction> {
+    let ctx = ui.ctx().clone();
+    let ppp = ctx.pixels_per_point();
+    let mut action = None;
+    let revision = app.combine_tab.revision;
+    let drag = egui::DragAndDrop::payload::<GridDrag>(&ctx).map(|d| *d);
+    // The card dragged may scroll out of the rows drawn, so its release is watched here.
+    let released = drag.is_some() && ctx.input(|i| i.pointer.any_released());
+    let n = app.combine_draft.len();
+    let places = layout(app);
+    // Each file's first place (for the keys and to scroll to it).
+    let mut first_place = vec![0usize; n];
+    for (at, c) in places.iter().enumerate().rev() {
+        if let Some(slot) = first_place.get_mut(c.file) {
+            *slot = at;
+        }
+    }
+    app.combine_tab.grid_places = places.iter().map(|c| c.file).collect();
+    // Pages counted over the list (an entry that can't be split counting as one, see
+    // `moved_pages`): where each place's pages start, for a page dropped before it.
+    let counts: Vec<usize> = app
+        .combine_draft
+        .iter_mut()
+        .map(|f| if f.lock.is_none() && f.problem.is_none() { f.selection().ok().filter(|k| *k > 0).unwrap_or(1) } else { 1 })
+        .collect();
+    let mut page_at = Vec::with_capacity(places.len());
+    let mut total_pages = 0usize;
+    for c in &places {
+        page_at.push(total_pages);
+        total_pages = total_pages.saturating_add(if c.page.is_some() { 1 } else { counts.get(c.file).copied().unwrap_or(1) });
+    }
+    let picked_pages = app.combine_tab.selected_pages.clone();
+    let reveal = app.combine_tab.reveal.take();
+    let fit = paper_box(app.combine_zoom);
+    let cell = fit + AROUND;
+    let mut cells: Vec<(usize, Rect)> = Vec::new();
+    let viewport = ui.available_rect_before_wrap();
+    let pointer = ctx.pointer_latest_pos();
+    let files = &mut app.combine_draft;
+    let thumbs = &mut app.combine_thumbs;
+    let columns = &mut app.combine_tab.grid_columns;
+
+    // Over the grid itself, not over a menu or dialog above it.
+    let over_grid = ui.rect_contains_pointer(viewport);
+    let mut width = viewport.width();
+    let mut focused_card = None;
+    // A zoom in the previous frame asks for a new scroll position. 0.37 keeps `State`'s offset
+    // private, so the request is applied through the builder and consumed here.
+    let pending_offset = ctx.data_mut(|d| d.remove_temp::<Vec2>(pending_offset_id()));
+    let mut grid = egui::ScrollArea::vertical().id_salt("combine-grid").auto_shrink([false, false]);
+    if let Some(offset) = pending_offset {
+        grid = grid.vertical_scroll_offset(offset.y);
+    }
+    grid.show_viewport(ui, |ui, clip| {
+        // Dragging near the top or bottom edge scrolls.
+        if drag.is_some()
+            && let Some(p) = pointer
+            && viewport.contains(p)
+        {
+            let edge = 40.0;
+            let delta = if p.y < viewport.top() + edge {
+                12.0
+            } else if p.y > viewport.bottom() - edge {
+                -12.0
+            } else {
+                0.0
+            };
+            if delta != 0.0 {
+                ui.scroll_with_delta(vec2(0.0, delta));
+                ctx.request_repaint();
+            }
+        }
+        ui.add_space(TOP);
+        width = ui.available_width();
+        let cols = columns_in(width, cell);
+        *columns = cols;
+        let rows = places.len().div_ceil(cols);
+        let left = ((width - cols as f32 * cell.x) / 2.0).max(0.0);
+        let (area, _) = ui.allocate_exact_size(vec2(width, rows as f32 * cell.y), Sense::hover());
+        let cell_rect = |i: usize| {
+            let (row, col) = (i / cols, i % cols);
+            Rect::from_min_size(pos2(area.left() + left + col as f32 * cell.x, area.top() + row as f32 * cell.y), cell)
+        };
+        if let Some(i) = reveal.and_then(|id| files.iter().position(|f| f.id == id)) {
+            ui.scroll_to_rect(cell_rect(first_place.get(i).copied().unwrap_or(0)), None);
+        }
+        for row in crate::canvas::thumbnail_rows(clip.top() - TOP, clip.bottom() - TOP, cell.y, rows) {
+            let first = row.saturating_mul(cols);
+            let in_row = places.get(first..first.saturating_add(cols).min(places.len())).unwrap_or_default();
+            // An expanded file's pages on this row share a tinted band, so they read as one file.
+            let mut run = 0;
+            while run < in_row.len() {
+                let Some(start) = in_row.get(run).copied() else { break };
+                let mut end = run;
+                while in_row.get(end.saturating_add(1)).is_some_and(|c| c.file == start.file && c.page.is_some()) {
+                    end = end.saturating_add(1);
+                }
+                if start.page.is_some() {
+                    let band = cell_rect(first.saturating_add(run)).union(cell_rect(first.saturating_add(end))).shrink2(vec2(2.0, 4.0));
+                    ui.painter().rect_filled(band, CornerRadius::same(10), t.accent_soft.gamma_multiply(0.45));
+                }
+                run = end.saturating_add(1);
+            }
+            for (col, place) in in_row.iter().enumerate() {
+                let i = first.saturating_add(col);
+                let Some(f) = files.get_mut(place.file) else { break };
+                let c = cell_rect(i);
+                cells.push((i, c));
+                let card = Card {
+                    i: place.file,
+                    page: place.page,
+                    rect: c,
+                    check: checks.get(place.file).cloned().unwrap_or(Ok(f.pages)),
+                    selected: selected.get(place.file).copied().unwrap_or(false)
+                        || place.page.is_some_and(|(nth, ..)| picked_pages.contains(&(f.id, nth))),
+                    twice: twice.get(place.file).copied().unwrap_or(false),
+                    revision,
+                    ppp,
+                    fit,
+                };
+                let card_id = card.id(ui, f);
+                if let Some(a) = card.show(ui, t, f, thumbs) {
+                    action = Some(a);
+                }
+                if ui.memory(|m| m.has_focus(card_id)) {
+                    focused_card = Some((card_id, f.id, place.page.map_or(0, |p| p.0)));
+                }
+            }
+        }
+        // While a page card is dragged: the page gap it would go to (any place, between any two
+        // pages), drawn at the nearest card's edge, and how many pages go.
+        if let Some(d) = drag
+            && let Some(page) = d.page
+            && let Some(p) = pointer
+        {
+            let at = crate::canvas::drop_gap(&cells, p);
+            let nearest = cells.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(p).total_cmp(&b.distance_sq_to_pos(p)));
+            if let Some((_, r)) = nearest {
+                let x = if p.x < r.center().x { r.left() + 2.0 } else { r.right() - 2.0 };
+                ui.painter().line_segment([pos2(x, r.top() + 10.0), pos2(x, r.bottom() - 30.0)], Stroke::new(3.0, t.accent));
+            }
+            let moving = if picked_pages.contains(&page) { picked_pages.len() } else { 1 };
+            let label = if moving == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &moving.to_string())]) };
+            ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, label, theme::medium(12.0), t.accent_text);
+            if released
+                && viewport.contains(p)
+                && let Some(at) = at
+            {
+                let gap = page_at.get(at).copied().unwrap_or(total_pages);
+                action = Some(RowAction::MovePages { page, revision: d.revision, gap });
+            }
+        } else if let Some(d) = drag
+            && let Some(p) = pointer
+        {
+            // A file's card: the file gap it would go to, drawn as a bar, and how many files go.
+            let gap = crate::canvas::drop_gap(&cells, p).map(|at| file_gap(&places, at, n));
+            // Drawn at the end of the file before the gap or the start of the one after (an
+            // expanded file's pages are never split), whichever is nearer the pointer.
+            if let Some(gap) = gap {
+                let before = gap
+                    .checked_sub(1)
+                    .and_then(|f| first_place.get(f.saturating_add(1)).map(|next| next.saturating_sub(1)).or(places.len().checked_sub(1)));
+                let after = first_place.get(gap).copied();
+                let ends = [before.map(|at| cell_rect(at).right() - 2.0).zip(before), after.map(|at| cell_rect(at).left() + 2.0).zip(after)];
+                let nearest = ends.into_iter().flatten().min_by(|(xa, a), (xb, b)| {
+                    let da = pos2(*xa, cell_rect(*a).center().y).distance_sq(p);
+                    let db = pos2(*xb, cell_rect(*b).center().y).distance_sq(p);
+                    da.total_cmp(&db)
+                });
+                if let Some((x, at)) = nearest {
+                    let r = cell_rect(at);
+                    ui.painter().line_segment([pos2(x, r.top() + 10.0), pos2(x, r.bottom() - 30.0)], Stroke::new(3.0, t.accent));
+                }
+            }
+            let moving = files
+                .iter()
+                .position(|f| f.id == d.file)
+                .map_or(1, |i| if selected.get(i).copied().unwrap_or(false) { selected.iter().filter(|s| **s).count() } else { 1 });
+            let label = if moving == 1 { tl!("1 file").to_string() } else { crate::i18n::fmt(tl!("{n} files"), &[("n", &moving.to_string())]) };
+            ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, label, theme::medium(12.0), t.accent_text);
+            // Dropped in the grid: there. Anywhere else: nothing moves.
+            if released
+                && viewport.contains(p)
+                && let Some(gap) = gap
+            {
+                action = Some(RowAction::DropAt { file: d.file, revision: d.revision, gap });
+            }
+        }
+    });
+
+    app.combine_tab.card_focus = focused_card.map(|(id, ..)| id);
+    app.combine_tab.card_focus_at = focused_card.map(|(_, file, nth)| (file, nth));
+
+    // Pinch, or Ctrl/⌘ with the wheel, over the grid zooms it.
+    let pinch = crate::motion::zoom_delta(&ctx);
+    if (pinch - 1.0).abs() > 0.001 && over_grid {
+        app.combine_tab.zoom_request = Some(app.combine_zoom * pinch);
+    }
+    // A zoom asked for this frame (toolbar, keys, pinch) applies now the grid has been laid out:
+    // the card under the pointer (or else the first in view) keeps its place on screen. Not while
+    // a card is dragged: the grid under it would change.
+    if let Some(zoom) = app.combine_tab.zoom_request.take()
+        && drag.is_none()
+    {
+        let before = app.combine_zoom;
+        app.set_combine_zoom(zoom);
+        if app.combine_zoom != before {
+            // The same card all through one gesture (a slider drag, a turn of the wheel): the
+            // first in view changes as the cards reflow, and following it would drift. A card is
+            // kept by its file and its place among the file's pages.
+            let now = ctx.input(|i| i.time);
+            let gesture = app.combine_tab.zoom_anchor.filter(|a| now - a.3 < 0.5).and_then(|(id, nth, above, _)| {
+                let file = app.combine_draft.iter().position(|f| f.id == id)?;
+                Some((first_place.get(file)?.saturating_add(nth).min(places.len().saturating_sub(1)), above))
+            });
+            // Cards just outside the view are drawn too (under the toolbar, say): the pointer
+            // counts only over the grid.
+            let under = pointer.filter(|_| over_grid).and_then(|p| cells.iter().find(|(_, r)| r.contains(p)));
+            let anchor = gesture
+                .or_else(|| under.or_else(|| cells.iter().find(|(_, r)| r.bottom() > viewport.top())).map(|(i, r)| (*i, r.top() - viewport.top())));
+            app.combine_tab.zoom_anchor = anchor.and_then(|(i, above)| {
+                let place = places.get(i)?;
+                Some((app.combine_draft.get(place.file)?.id, place.page.map_or(0, |p| p.0), above, now))
+            });
+            if let Some((i, above)) = anchor {
+                // Where it will be: its row at the new size, as far below the top as it is now;
+                // within what can be scrolled to, so zooming out at the bottom shows no gap.
+                let cell = paper_box(app.combine_zoom) + AROUND;
+                let cols = columns_in(width, cell);
+                let content = TOP + places.len().div_ceil(cols) as f32 * cell.y;
+                let y = (TOP + (i / cols) as f32 * cell.y - above).min(content - viewport.height()).max(0.0);
+                // Applied by the next frame's scroll area, before anything is drawn there: no
+                // jump, and no scroll still animating (to a card revealed by the keys, say) can
+                // carry it elsewhere. The request is consumed once.
+                ctx.data_mut(|d| d.insert_temp(pending_offset_id(), vec2(0.0, y)));
+            }
+            ctx.request_repaint();
+        }
+    }
+
+    action
+}
+
+/// The scroll position a zoom asked the next frame's grid to start at.
+fn pending_offset_id() -> egui::Id {
+    egui::Id::unique("pdfcraft-combine-grid-offset")
+}
+
+impl PdfCraftApp {
+    /// The file shown large, the page on screen (0-based, in the file) and its render, while it
+    /// shows (tests and the control channel).
+    pub fn combine_preview(&self) -> Option<(String, usize, ThumbState)> {
+        let p = self.combine_tab.preview.as_ref()?;
+        let f = self.combine_draft.iter().find(|f| f.id == p.file)?;
+        Some((f.name.clone(), p.page?, self.combine_thumbs.state(PREVIEW)))
+    }
+
+    /// Size the Combine grid's cards (1.0 = the usual); out-of-range values are clamped and
+    /// nonsense is ignored.
+    pub fn set_combine_zoom(&mut self, zoom: f32) {
+        if zoom.is_finite() {
+            self.combine_zoom = zoom.clamp(*ZOOM_RANGE.start(), *ZOOM_RANGE.end());
+        }
+    }
+
+    /// Every frame, whatever shows: take finished thumbnails, start those the grid asked for (only
+    /// while it is drawn), and let go of what no longer matches the list, so renders under way
+    /// finish and release their threads in the list view, on Home or in a document tab too.
+    pub(crate) fn combine_thumbs_frame(&mut self, ctx: &egui::Context) {
+        // What each thumbnail must match now (cards out of view included): each file's first page,
+        // and an expanded file's pages (looked up in its sorted list, never listed one by one).
+        // (By file: the parts a file is split into share its thumbnails.)
+        struct Shown {
+            source: usize,
+            auth: u64,
+            pages: Vec<usize>,
+        }
+        let mut shown: HashMap<u64, Shown> = HashMap::with_capacity(self.combine_draft.len());
+        let tab = &mut self.combine_tab;
+        for f in self.combine_draft.iter_mut() {
+            let Ok(first) = f.first_page() else { continue };
+            let sorted = tab.expanded.contains(&f.id).then(|| pages_shown(&mut tab.page_lists, f)).flatten().map(|l| l.sorted);
+            let entry = shown.entry(f.group).or_insert_with(|| Shown { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, pages: Vec::new() });
+            entry.pages.push(first);
+            entry.pages.extend(sorted.iter().flat_map(|s| s.iter().copied()));
+        }
+        for s in shown.values_mut() {
+            s.pages.sort_unstable();
+            s.pages.dedup();
+        }
+        // The page shown large, while it shows: leaving the tab closes it.
+        if !self.combine_showing() {
+            self.combine_tab.preview = None;
+        }
+        let preview = self.combine_tab.preview.as_ref().and_then(|p| {
+            let page = p.page?;
+            let f = self.combine_draft.iter().find(|f| f.id == p.file)?;
+            Some(Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page, px: [0, 0] })
+        });
+        let current = |slot: Slot| -> Option<Key> {
+            if slot == PREVIEW {
+                return preview;
+            }
+            let (id, page) = slot;
+            let s = shown.get(&id)?;
+            s.pages.binary_search(&page).is_ok().then_some(Key { source: s.source, auth: s.auth, page, px: [0, 0] })
+        };
+        self.combine_thumbs.finish(ctx, &current);
+    }
+
+    /// The single pages selected: each one's entry (by place in the list) and page (0-based, in
+    /// the file), in list order (tests and the control channel).
+    pub fn combine_selected_pages(&self) -> Vec<(usize, usize)> {
+        let mut out = Vec::new();
+        for (i, f) in self.combine_draft.iter().enumerate() {
+            let pages = f.pages_taken().unwrap_or_default();
+            for (nth, page) in pages.iter().enumerate() {
+                if self.combine_tab.selected_pages.contains(&(f.id, nth)) {
+                    out.push((i, *page));
+                }
+            }
+        }
+        out
+    }
+
+    /// Each entry's name and the pages it takes (0-based, in order): a file split into parts is
+    /// several entries (tests and the control channel).
+    pub fn combine_parts_shown(&self) -> Vec<(String, Vec<usize>)> {
+        self.combine_draft.iter().map(|f| (f.name.clone(), f.pages_taken().unwrap_or_default())).collect()
+    }
+
+    /// The files shown as their pages in the grid, by place in the list (tests and the control
+    /// channel).
+    pub fn combine_expanded(&self) -> Vec<usize> {
+        self.combine_draft.iter().enumerate().filter(|(_, f)| self.combine_tab.expanded.contains(&f.id)).map(|(i, _)| i).collect()
+    }
+
+    /// An expanded file's page cards: each page (0-based, in the file) and its thumbnail; empty
+    /// for a file shown as its card (tests and the control channel).
+    pub fn combine_page_thumbnails(&self, file: usize) -> Vec<(usize, ThumbState)> {
+        let Some(f) = self.combine_draft.get(file).filter(|f| self.combine_tab.expanded.contains(&f.id)) else { return Vec::new() };
+        let pages = f.pages_taken().unwrap_or_default();
+        pages.into_iter().map(|p| (p, self.combine_thumbs.state((f.group, p)))).collect()
+    }
+
+    /// Each listed file's grid thumbnail, in list order (tests and the control channel).
+    pub fn combine_thumbnails(&self) -> Vec<ThumbState> {
+        self.combine_draft.iter().map(|f| f.first_taken().map_or(ThumbState::None, |p| self.combine_thumbs.state((f.group, p)))).collect()
+    }
+
+    /// Thumbnail renders under way (tests: never more than a few).
+    pub fn combine_thumbnails_rendering(&self) -> usize {
+        self.combine_thumbs.jobs.len()
+    }
+
+    /// Render threads for thumbnails that exist now (counted from the threads themselves),
+    /// including those of finished or abandoned renders that haven't exited yet (tests: never
+    /// more than three).
+    pub fn combine_thumbnail_threads(&mut self) -> usize {
+        self.combine_thumbs.threads()
+    }
+
+    /// Whether no thumbnail render is under way and every render thread has exited (tests).
+    pub fn combine_thumbnail_threads_exited(&self) -> bool {
+        self.combine_thumbs.jobs.is_empty() && self.combine_thumbs.retiring.iter().all(Retiring::exited)
+    }
+
+    /// Thumbnail textures held (tests: none once the tab is closed).
+    pub fn combine_thumbnail_textures(&self) -> usize {
+        self.combine_thumbs.entries.values().filter(|e| e.tex.is_some()).count()
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/workflows/combine_grid/card.rs b/crates/ui-egui/src/workflows/combine_grid/card.rs
new file mode 100644
index 0000000000..63cf14c5ee
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_grid/card.rs
@@ -0,0 +1,421 @@
+use super::thumbs::{Key, Look, MAX_SIDE, PREVIEW, PREVIEW_SIDE, SIZE_STEP, Thumbs, Want};
+use super::*;
+
+/// One card's place and what it shows.
+pub(super) struct Card {
+    /// The file, by its place in the list.
+    pub(super) i: usize,
+    /// A page card (the file expanded): its place among the pages the file adds, the page and how
+    /// many it adds. `None` for the file's own card.
+    pub(super) page: Option<(usize, usize, usize)>,
+    pub(super) rect: Rect,
+    pub(super) check: Result<usize, String>,
+    pub(super) selected: bool,
+    pub(super) twice: bool,
+    pub(super) revision: u64,
+    pub(super) ppp: f32,
+    /// The box the page is fitted in (the zoom).
+    pub(super) fit: Vec2,
+}
+
+impl Card {
+    pub(super) fn id(&self, ui: &egui::Ui, f: &CombineFile) -> egui::Id {
+        match self.page {
+            None => ui.scope_id().with(("combine-card", f.id)),
+            Some((nth, ..)) => ui.scope_id().with(("combine-page", f.id, nth)),
+        }
+    }
+
+    pub(super) fn show(&self, ui: &mut egui::Ui, t: &Tokens, f: &mut CombineFile, thumbs: &mut Thumbs) -> Option<RowAction> {
+        let mut action = None;
+        let c = self.rect;
+        let id = self.id(ui, f);
+        let resp = ui.interact(c.shrink(4.0), id, Sense::click_and_drag());
+        let name = f.name.clone();
+        // A page card: "Page 3", and the file it belongs to.
+        let page_label = self.page.map(|(_, p, _)| crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.saturating_add(1).to_string())]));
+        let label = match &page_label {
+            Some(page) => format!("{page} · {name}"),
+            None => name.clone(),
+        };
+        // As the organize grid's pages: a check box that is on when selected; and, for screen
+        // readers, selected as items in a list are.
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, self.selected, &label));
+        let pages = match self.page {
+            // For screen readers: which page of how many.
+            Some((_, p, _)) => crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &p.saturating_add(1).to_string()), ("n", &f.pages.to_string())]),
+            None if f.pages == 1 => tl!("1 page").to_string(),
+            None => crate::i18n::fmt(tl!("{n} pages"), &[("n", &f.pages.to_string())]),
+        };
+        let painter = ui.painter_at(c);
+
+        // Selected and hovered cards.
+        if self.selected || resp.hovered() {
+            painter.rect_filled(c.shrink(6.0), CornerRadius::same(8), if self.selected { t.accent_soft } else { t.hover });
+        }
+        if self.selected {
+            painter.rect_stroke(c.shrink(6.0), CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
+        }
+
+        // The page, fitted in the paper box (top-aligned, room above for the stack).
+        let page = match self.page {
+            Some((_, p, _)) => Ok(p),
+            None => f.first_page(),
+        };
+        // The page's own size, when it is known and is one.
+        let known = page.as_ref().ok().and_then(|p| f.sizes.get(*p).copied()).filter(|(w, h)| paper_size(*w, *h, self.fit).is_some());
+        let size_pt = known.unwrap_or(FALLBACK_PAGE);
+        let size = paper_size(size_pt.0, size_pt.1, self.fit).unwrap_or(self.fit);
+        let top = c.top() + ABOVE;
+        let paper = Rect::from_min_size(pos2(c.center().x - size.x / 2.0 - 3.0, top + (self.fit.y - size.y)), size);
+        // A file's card that adds more than one page: sheets behind it.
+        let takes = self.check.as_ref().map_or(f.pages, |k| *k);
+        if self.page.is_none() && takes > 1 {
+            for d in [6.0, 3.0] {
+                let sheet = paper.translate(vec2(d, -d));
+                painter.rect_filled(sheet, CornerRadius::ZERO, Color32::WHITE);
+                painter.rect_stroke(sheet, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
+            }
+        }
+        painter.rect_filled(paper.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+        painter.rect_filled(paper, CornerRadius::ZERO, Color32::WHITE);
+
+        // What goes on the paper: the thumbnail, or why there isn't one.
+        let mut why: Option<(&str, Color32, String)> = None;
+        if let Some(lock) = f.lock {
+            let text = match lock {
+                Lock::Open => tl!("Password-protected"),
+                Lock::Permissions => tl!("Its security settings don't allow copying pages"),
+            };
+            why = Some(("lock", ON_PAPER, text.to_owned()));
+        } else if let Some(p) = &f.problem {
+            why = Some(("circle-x", ERROR, p.clone()));
+        } else {
+            match page {
+                Err(e) => why = Some(("circle-x", ERROR, e)),
+                // The pages couldn't be counted, or the page's size is unknown (some passwords
+                // open a file for combining but not for reading it here): nothing is drawn (the
+                // engine decides at Combine), and the card says so rather than look blank.
+                Ok(p) if p >= f.pages || known.is_none() => why = Some(("eye-off", ON_PAPER, tl!("No preview").to_owned())),
+                Ok(p) => {
+                    // Pixels per point: the size the paper is drawn at, on both sides, and never a
+                    // side longer than a thumbnail's (a long, thin page fits by its long side).
+                    let (w, h) = size_pt;
+                    let scale = (size.x * self.ppp / w).min(size.y * self.ppp / h).min(MAX_SIDE / w.max(h));
+                    let px = [w * scale, h * scale].map(|v| (v.max(1.0).ceil() as u32).div_ceil(SIZE_STEP).saturating_mul(SIZE_STEP));
+                    let key = Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page: p, px };
+                    let look = thumbs.look((f.group, p), key);
+                    let mut want = false;
+                    match look {
+                        Look::Ready(tex) => {
+                            painter.image(tex, paper, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+                        }
+                        Look::Failed(e) => why = Some(("triangle-alert", WARNING, crate::i18n::fmt(tl!("Preview unavailable: {e}"), &[("e", &e)]))),
+                        Look::Pending(stand_in) => {
+                            if let Some(tex) = stand_in {
+                                painter.image(tex, paper, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+                            }
+                            want = true;
+                        }
+                    }
+                    if want && scale.is_finite() && scale > 0.0 {
+                        thumbs.wants.push(Want {
+                            slot: (f.group, p),
+                            key,
+                            bytes: f.bytes.clone(),
+                            password: f.password().map(Arc::from),
+                            scale,
+                            visible: ui.is_rect_visible(c),
+                        });
+                    }
+                }
+            }
+        }
+        if let Some((icon, colour, _)) = &why {
+            icons::paint(ui, Rect::from_center_size(paper.center(), Vec2::splat(28.0)), icon, 28.0, *colour);
+        }
+        // For screen readers: the pages, and why no page is shown (otherwise only in the tooltip).
+        let description = match &why {
+            Some((_, _, reason)) => format!("{pages}. {reason}"),
+            None => pages.clone(),
+        };
+        ui.ctx().accesskit_node_builder(id, |node| {
+            node.set_selected(self.selected);
+            node.set_description(description);
+        });
+        painter.rect_stroke(paper, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
+
+        // A warning that doesn't stop it being combined: a badge on the file's card.
+        let warned = self.page.is_none() && (!f.notes.is_empty() || self.twice);
+        if warned && why.as_ref().is_none_or(|(icon, ..)| *icon == "eye-off") {
+            let r = Rect::from_center_size(paper.right_top() + vec2(-2.0, 2.0), Vec2::splat(18.0));
+            painter.circle_filled(r.center(), 10.0, t.card);
+            icons::paint(ui, r, "triangle-alert", 15.0, WARNING);
+        }
+
+        // The name, shortened in the middle to fit, and the pages taken when a range is set; on a
+        // page card, the page first and the file's name below it, smaller.
+        let name_y = top + self.fit.y + 16.0;
+        let max_w = c.width() - 20.0;
+        let (font, colour, y) = match &page_label {
+            Some(page) => {
+                painter.text(pos2(c.center().x, name_y), Align2::CENTER_CENTER, page, theme::semibold(12.5), t.text);
+                (theme::regular(11.5), t.text_muted, name_y + 17.0)
+            }
+            None => (theme::medium(12.5), t.text, name_y),
+        };
+        let fits = |s: &str| crate::bidi::layout_ltr(ui, s.to_owned(), font.clone(), colour).size().x <= max_w;
+        let shown = fit_name(&f.name, fits);
+        // A file name is file/path chrome: always left to right, so an Arabic name ends in `.pdf`.
+        let name_galley = crate::bidi::layout_ltr(ui, shown, font, colour);
+        painter.galley(pos2(c.center().x - name_galley.size().x / 2.0, y - name_galley.size().y / 2.0), name_galley, colour);
+        let note = if self.page.is_none() && !f.range.trim().is_empty() {
+            match &self.check {
+                Ok(k) => Some((crate::i18n::fmt(tl!("Pages: {k} of {n}"), &[("k", &k.to_string()), ("n", &f.pages.to_string())]), t.text_muted)),
+                Err(_) => Some((tl!("Check the pages").to_owned(), ERROR)),
+            }
+        } else {
+            None
+        };
+        if let Some((text, colour)) = note {
+            painter.text(pos2(c.center().x, name_y + 17.0), Align2::CENTER_CENTER, text, theme::regular(11.5), colour);
+        }
+
+        // On hover, the card's own actions along the top of the page (not while a card is
+        // dragged): remove this file only, and show it large when there is a page to show. Drawn
+        // over the card, so a click on one doesn't select or move it.
+        let previewable = why.is_none();
+        // A file that adds more pages than one can be spread out into them.
+        let expandable = self.page.is_none() && takes > 1 && takes <= MAX_EXPAND && f.lock.is_none() && f.problem.is_none() && self.check.is_ok();
+        // Shown large: the file from its first page, or a page card's page.
+        let preview = match self.page {
+            Some((nth, ..)) => RowAction::PreviewAt(f.id, nth),
+            None => RowAction::Preview(f.id),
+        };
+        // The card's own actions, in this order: expand (or, on a page, collapse), remove (the file,
+        // or the page), show large.
+        let mut buttons: Vec<(&str, String, RowAction)> = Vec::new();
+        if expandable {
+            buttons.push(("maximize-2", tl!("Expand").to_owned(), RowAction::Expand(f.id, true)));
+        }
+        if let Some((nth, ..)) = self.page {
+            buttons.push(("minimize-2", tl!("Collapse").to_owned(), RowAction::Expand(f.id, false)));
+            buttons.push(("trash-2", tl!("Remove page").to_owned(), RowAction::RemovePages(Some((f.id, nth)))));
+        } else {
+            buttons.push(("trash-2", crate::i18n::fmt(tl!("Remove {name}"), &[("name", &f.name)]), RowAction::RemoveFile(f.id)));
+        }
+        if previewable {
+            buttons.push(("search", tl!("Preview").to_owned(), preview));
+        }
+        // Nothing of the card shows over a dialog (the preview, the password box).
+        let covered = ui.ctx().memory(|m| m.top_modal_layer().is_some());
+        let mut over_bar = false;
+        if !covered && ui.rect_contains_pointer(c.shrink(4.0)) && !egui::DragAndDrop::has_any_payload(ui.ctx()) {
+            let count = buttons.len() as f32;
+            // Mostly above the page (a quarter over its top edge), so it hides little of it, and
+            // never the name below.
+            let y = paper.top() + BAR_H / 4.0 - BAR_H / 2.0;
+            let bar = Rect::from_center_size(pos2(paper.center().x, y), vec2(count * 26.0 + (count - 1.0).max(0.0) * 2.0 + 8.0, BAR_H));
+            over_bar = ui.rect_contains_pointer(bar);
+            painter.rect(bar, CornerRadius::same(8), t.card, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+            let mut bar_ui = ui.new_child(egui::UiBuilder::new().max_rect(bar.shrink(4.0)).layout(egui::Layout::left_to_right(egui::Align::Center)));
+            bar_ui.spacing_mut().item_spacing.x = 2.0;
+            for (icon, label, act) in &buttons {
+                if icons::button(&mut bar_ui, icon, 26.0, false, label).clicked() {
+                    action = Some(act.clone());
+                }
+            }
+        }
+
+        // The full name and everything known about the file, on hover (on a page card, which page).
+        let mut tip = match &page_label {
+            Some(page) => format!("{}\n{page}", f.name),
+            None => format!("{}\n{pages} · {}", f.name, crate::panels::human_size(f.bytes.len())),
+        };
+        for line in why.iter().map(|(_, _, s)| s).chain(&f.notes) {
+            tip.push('\n');
+            tip.push_str(line);
+        }
+        if self.twice {
+            tip.push('\n');
+            tip.push_str(tl!("Added more than once"));
+        }
+        // Page ranges are typed in the list.
+        if self.page.is_none() && self.check.is_err() {
+            tip.push('\n');
+            tip.push_str(tl!("Switch to List view to change the pages it takes."));
+        }
+        // (Over the bar, its buttons say what they do instead.)
+        let resp = if covered || over_bar { resp } else { resp.on_hover_text(tip) };
+
+        // The same actions on a right click, show large first (and Unlock… for a locked file).
+        let at = resp.rect.left_bottom();
+        let locked = f.lock.is_some();
+        resp.context_menu(|ui| {
+            let item = |ui: &mut egui::Ui, icon: &str, label: &str| {
+                ui.add(egui::Button::image_and_text(icons::image(icon, 15.0, ui.visuals().text_color()), label)).clicked()
+            };
+            for (icon, label, act) in buttons.iter().rev() {
+                // (Remove names its file, as the trash button does.)
+                if item(ui, icon, label) {
+                    action = Some(act.clone());
+                    ui.close();
+                }
+            }
+            if locked && item(ui, "lock-open", tl!("Unlock…")) {
+                action = Some(RowAction::Unlock(Some(self.i), at));
+                ui.close();
+            }
+        });
+        if resp.drag_started() {
+            egui::DragAndDrop::set_payload(ui.ctx(), GridDrag { file: f.id, revision: self.revision, page: self.page.map(|(nth, ..)| (f.id, nth)) });
+        }
+        if resp.clicked() {
+            let mods = resp.ctx.input(|i| i.modifiers);
+            action = Some(match self.page {
+                Some((nth, ..)) => RowAction::ClickPage(f.id, nth, mods),
+                None => RowAction::Click(self.i, mods),
+            });
+        }
+        action
+    }
+}
+
+/// The file a card's magnifier opened, shown large over the page: one of the pages it adds at a
+/// time, flipped with the buttons or the Left and Right keys; Esc, the close button or a click
+/// outside closes it. It closes by itself when the file leaves the list or has nothing to show.
+pub(crate) fn preview(app: &mut PdfCraftApp, ctx: &egui::Context, t: &Tokens) {
+    // The command palette goes over everything: the preview waits under it (drawn again after).
+    if app.palette_open {
+        return;
+    }
+    let Some(p) = app.combine_tab.preview.as_mut() else { return };
+    let Some(f) = app.combine_draft.iter().find(|f| f.id == p.file).filter(|f| f.lock.is_none() && f.problem.is_none()) else {
+        app.combine_tab.preview = None;
+        return;
+    };
+    // The pages it adds, worked out again only when its range changes.
+    let pages = match &p.pages {
+        Some(((range, count), pages)) if *range == f.range && *count == f.pages => pages.clone(),
+        _ => match f.pages_taken() {
+            Ok(pages) => {
+                let pages: Arc<[usize]> = Arc::from(pages);
+                p.pages = Some(((f.range.clone(), f.pages), pages.clone()));
+                pages
+            }
+            Err(_) => {
+                app.combine_tab.preview = None;
+                return;
+            }
+        },
+    };
+    let n = pages.len();
+    p.at = p.at.min(n.saturating_sub(1));
+    let Some(&page) = pages.get(p.at) else {
+        app.combine_tab.preview = None;
+        return;
+    };
+    p.page = Some(page);
+    let at = p.at;
+    // Flipped with the keys (the grid's arrows wait while this shows), unless a text field has
+    // them.
+    let typing = ctx.text_edit_focused();
+    let (back, on) = ctx.input_mut(|i| {
+        for k in [egui::Key::Plus, egui::Key::Equals, egui::Key::Minus, egui::Key::Num0] {
+            i.consume_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, k));
+        }
+        if typing {
+            return (false, false);
+        }
+        (
+            i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowLeft) | i.consume_key(egui::Modifiers::NONE, egui::Key::PageUp),
+            i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowRight) | i.consume_key(egui::Modifiers::NONE, egui::Key::PageDown),
+        )
+    });
+    let (mut step, mut close) = (i64::from(on) - i64::from(back), false);
+    let screen = ctx.content_rect();
+    let width = (screen.width() * 0.86).max(320.0);
+    let body_h = (screen.height() * 0.86 - 110.0).max(200.0);
+    let ppp = ctx.pixels_per_point();
+    // No larger than the GPU takes, or the render would be refused.
+    let longest = ctx.input(|i| i.max_texture_side as f32).min(PREVIEW_SIDE);
+    let thumbs = &mut app.combine_thumbs;
+    let modal = egui::Modal::new(egui::Id::unique("combine-preview")).show(ctx, |ui| {
+        ui.set_width(width);
+        ui.horizontal(|ui| {
+            ui.label(egui::RichText::new(f.name.clone()).font(theme::semibold(15.0)));
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if icons::button(ui, "x", 30.0, false, tl!("Close")).clicked() {
+                    close = true;
+                }
+                let of = crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &(at + 1).to_string()), ("n", &n.to_string())]);
+                ui.label(egui::RichText::new(of).color(t.text_muted));
+            });
+        });
+        ui.add_space(8.0);
+        // The page, as large as fits.
+        let (area, _) = ui.allocate_exact_size(vec2(width, body_h), Sense::hover());
+        let known = f.sizes.get(page).copied().filter(|(w, h)| paper_size(*w, *h, area.size()).is_some());
+        let (w, h) = known.unwrap_or(FALLBACK_PAGE);
+        let size = paper_size(w, h, area.size() - vec2(8.0, 8.0)).unwrap_or(area.size());
+        let paper = Rect::from_center_size(area.center(), size);
+        let painter = ui.painter_at(area);
+        painter.rect_filled(paper.translate(vec2(0.0, 2.0)), CornerRadius::same(1), t.page_shadow);
+        painter.rect_filled(paper, CornerRadius::ZERO, Color32::WHITE);
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+        if known.is_some() {
+            let scale = (size.x * ppp / w).min(size.y * ppp / h).min(longest / w.max(h));
+            let px = [w * scale, h * scale].map(|v| (v.max(1.0).ceil() as u32).div_ceil(SIZE_STEP).saturating_mul(SIZE_STEP));
+            let key = Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page, px };
+            match thumbs.look(PREVIEW, key) {
+                Look::Ready(tex) => {
+                    painter.image(tex, paper, uv, Color32::WHITE);
+                }
+                Look::Failed(e) => {
+                    let text = crate::i18n::fmt(tl!("Preview unavailable: {e}"), &[("e", &e)]);
+                    painter.text(paper.center(), Align2::CENTER_CENTER, text, theme::regular(13.0), ON_PAPER);
+                }
+                Look::Pending(stand_in) => {
+                    // A smaller render of this page stands in: the last size shown, or its card's.
+                    let card = thumbs.entries.get(&(f.group, page)).filter(|e| e.key.auth == f.auth).and_then(|e| e.tex.as_ref());
+                    if let Some(tex) = stand_in.or(card.map(TextureHandle::id)) {
+                        painter.image(tex, paper, uv, Color32::WHITE);
+                    }
+                    if scale.is_finite() && scale > 0.0 {
+                        thumbs.wants.push(Want {
+                            slot: PREVIEW,
+                            key,
+                            bytes: f.bytes.clone(),
+                            password: f.password().map(Arc::from),
+                            scale,
+                            visible: true,
+                        });
+                    }
+                }
+            }
+        } else {
+            icons::paint(ui, Rect::from_center_size(paper.center(), Vec2::splat(36.0)), "eye-off", 36.0, ON_PAPER);
+        }
+        painter.rect_stroke(paper, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
+        ui.add_space(8.0);
+        // Previous and next, centred below.
+        ui.horizontal(|ui| {
+            ui.add_space((width - 2.0 * 30.0 - 6.0) / 2.0);
+            if ui.add_enabled_ui(at > 0, |ui| icons::button(ui, "chevron-left", 30.0, false, tl!("Previous page"))).inner.clicked() {
+                step = -1;
+            }
+            if ui.add_enabled_ui(at + 1 < n, |ui| icons::button(ui, "chevron-right", 30.0, false, tl!("Next page"))).inner.clicked() {
+                step = 1;
+            }
+        });
+    });
+    if close || modal.should_close() {
+        app.combine_tab.preview = None;
+    } else if let Some(p) = app.combine_tab.preview.as_mut() {
+        p.at = match step {
+            s if s < 0 => p.at.saturating_sub(1),
+            s if s > 0 => (p.at + 1).min(n.saturating_sub(1)),
+            _ => p.at,
+        };
+    }
+}
diff --git a/crates/ui-egui/src/workflows/combine_grid/tests.rs b/crates/ui-egui/src/workflows/combine_grid/tests.rs
new file mode 100644
index 0000000000..a40817c044
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_grid/tests.rs
@@ -0,0 +1,345 @@
+use std::collections::BTreeSet;
+
+use super::*;
+use crate::combine_ui::{moved_order, step_to};
+
+#[test]
+fn long_names_keep_their_extension_and_whole_characters() {
+    let fits = |n: usize| move |s: &str| s.chars().count() <= n;
+    assert_eq!(fit_name("short.pdf", fits(20)), "short.pdf");
+    assert_eq!(fit_name("# 227 Pilot Boat Advance.pdf", fits(18)), "# 227 Pilot B….pdf");
+    // Multi-byte characters are never cut in half.
+    assert_eq!(fit_name("Überweisungsbestätigung.pdf", fits(12)), "Überwei….pdf");
+    assert_eq!(fit_name("日本語のファイル名です.pdf", fits(8)), "日本語….pdf");
+    // No extension, or a dot that isn't one.
+    assert_eq!(fit_name("README-without-extension", fits(10)), "README-wi…");
+    assert_eq!(fit_name(".hidden-file-name", fits(8)), ".hidden…");
+    // Nothing fits: the ellipsis and the extension.
+    assert_eq!(fit_name("abcdef.pdf", fits(0)), "….pdf");
+}
+
+#[test]
+fn paper_sizes_fit_the_box_and_bad_sizes_are_refused() {
+    // The box follows the zoom, within its range; nonsense is 100%.
+    assert_eq!(paper_box(1.0), PAPER);
+    assert_eq!(paper_box(2.0), PAPER * 2.0);
+    assert_eq!(paper_box(99.0), PAPER * 5.0);
+    assert_eq!(paper_box(-1.0), PAPER * 0.6);
+    assert_eq!(paper_box(f32::NAN), PAPER);
+    for zoom in [0.6, 1.0, 2.0, 5.0] {
+        let fit = paper_box(zoom);
+        // Letter is a little wider than the box: it fills the width. A tall page fills the height.
+        let letter = paper_size(612.0, 792.0, fit).unwrap();
+        assert!((letter.x - fit.x).abs() < 0.01 && letter.y <= fit.y + 0.01, "{letter:?}");
+        let tall = paper_size(612.0, 1008.0, fit).unwrap();
+        assert!((tall.y - fit.y).abs() < 0.01 && tall.x <= fit.x + 0.01, "{tall:?}");
+        let landscape = paper_size(792.0, 612.0, fit).unwrap();
+        assert!((landscape.x - fit.x).abs() < 0.01 && landscape.y < fit.y, "{landscape:?}");
+        for (w, h) in [(0.0, 792.0), (612.0, -1.0), (f32::NAN, 1.0), (f32::INFINITY, 1.0), (1e-30, 1e30)] {
+            let s = paper_size(w, h, fit);
+            assert!(s.is_none_or(|s| s.x.is_finite() && s.y.is_finite() && s.x <= fit.x + 0.01 && s.y <= fit.y + 0.01), "{w}×{h}: {s:?}");
+        }
+    }
+}
+
+#[test]
+fn zoom_buttons_step_through_round_sizes() {
+    let mut z = 0.6;
+    let mut up = vec![z];
+    while z < 5.0 {
+        z = zoom_step(z, true);
+        up.push(z);
+    }
+    assert_eq!(up, ZOOM_STEPS);
+    assert_eq!(zoom_step(5.0, true), 5.0, "the largest stays put");
+    assert_eq!(zoom_step(0.6, false), 0.6, "the smallest stays put");
+    // From anywhere the slider left it, to the next round size.
+    assert_eq!(zoom_step(1.1, true), 1.25);
+    assert_eq!(zoom_step(1.1, false), 1.0);
+    assert_eq!(zoom_step(1.953, true), 2.0);
+    assert_eq!(zoom_step(1.0000001, true), 1.25, "a hair over a size counts as that size");
+}
+
+#[test]
+fn the_cards_zoom_far_enough_to_read_a_value() {
+    // #2531: the grid stopped at 200%, which was not enough to read invoice values while
+    // reordering the pages of a statement. It has to reach 500%.
+    assert_eq!(*ZOOM_RANGE.end(), 5.0, "the grid stops at {}%, not 500%", ZOOM_RANGE.end() * 100.0);
+    assert_eq!(paper_box(5.0), PAPER * 5.0, "500% is kept, not clamped to the old ceiling");
+    // Every round size above the old 200% ceiling is a step the toolbar can reach.
+    let mut z = *ZOOM_RANGE.start();
+    let mut up = vec![z];
+    while z < *ZOOM_RANGE.end() {
+        z = zoom_step(z, true);
+        up.push(z);
+    }
+    for want in [2.5, 3.0, 4.0, 5.0] {
+        assert!(up.contains(&want), "no step reaches {want}%: {up:?}");
+    }
+    // A card stays sharp at the ceiling instead of upscaled from the old 768px cap. A Letter
+    // page fills the height of the box, so at 500% it needs PAPER.y * 5.0 points of it, which
+    // on a 1.5 pixels-per-point screen is this many pixels.
+    let wanted = PAPER.y * 5.0 * 1.5;
+    assert!(MAX_SIDE >= wanted, "MAX_SIDE {MAX_SIDE} is under the {wanted}px a card needs at 500%");
+}
+
+#[test]
+fn arrow_keys_step_by_file_and_by_row() {
+    // The list: one at a time, staying put at both ends.
+    assert_eq!(step_to(0, 5, 1, false), 0);
+    assert_eq!(step_to(4, 5, 1, true), 4);
+    assert_eq!(step_to(2, 5, 1, true), 3);
+    // A grid of 3 per row and 8 files: rows [0 1 2] [3 4 5] [6 7].
+    assert_eq!(step_to(1, 8, 3, true), 4, "down one row, same column");
+    assert_eq!(step_to(5, 8, 3, true), 7, "a short last row is reached at its last file");
+    assert_eq!(step_to(6, 8, 3, true), 6, "the last row goes no further down");
+    assert_eq!(step_to(2, 8, 3, false), 2, "the first row goes no further up");
+    assert_eq!(step_to(7, 8, 3, false), 4);
+    // Out-of-range starts and empty lists don't panic.
+    assert_eq!(step_to(99, 8, 3, false), 4);
+    assert_eq!(step_to(0, 0, 3, true), 0);
+    assert_eq!(step_to(0, 1, 0, true), 0);
+}
+
+#[test]
+fn moves_to_a_gap_keep_order_and_report_no_ops() {
+    let ids = [10, 11, 12, 13, 14];
+    let set = |v: &[u64]| v.iter().copied().collect::<BTreeSet<u64>>();
+    // One file to the start, to the end, and between others.
+    assert_eq!(moved_order(&ids, &set(&[13]), 0), Some(vec![13, 10, 11, 12, 14]));
+    assert_eq!(moved_order(&ids, &set(&[10]), 5), Some(vec![11, 12, 13, 14, 10]));
+    assert_eq!(moved_order(&ids, &set(&[10]), 3), Some(vec![11, 12, 10, 13, 14]));
+    // A discontiguous selection gathers at the gap, in list order.
+    assert_eq!(moved_order(&ids, &set(&[10, 12, 14]), 2), Some(vec![11, 10, 12, 14, 13]));
+    assert_eq!(moved_order(&ids, &set(&[11, 13]), 5), Some(vec![10, 12, 14, 11, 13]));
+    // Dropping a file next to itself, or a block inside itself, changes nothing.
+    assert_eq!(moved_order(&ids, &set(&[12]), 2), None);
+    assert_eq!(moved_order(&ids, &set(&[12]), 3), None);
+    assert_eq!(moved_order(&ids, &set(&[11, 12, 13]), 2), None);
+    // Nothing to move, unknown files and gaps past the end are harmless.
+    assert_eq!(moved_order(&ids, &set(&[]), 1), None);
+    assert_eq!(moved_order(&ids, &set(&[99]), 1), None);
+    assert_eq!(moved_order(&ids, &set(&[10]), 99), Some(vec![11, 12, 13, 14, 10]));
+}
+
+/// A PDF of `pages` pages of `w` × `h` points.
+fn pdf(pages: usize, w: u32, h: u32) -> Arc<Vec<u8>> {
+    let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
+    let kids: Vec<String> = (0..pages).map(|i| format!("{} 0 R", 3 + 2 * i)).collect();
+    objs.push(format!("<< /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 {w} {h}] >>", kids.join(" ")));
+    for i in 0..pages {
+        objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R >>", 4 + 2 * i));
+        let body = "0.2 0.4 0.8 rg 0 0 10 10 re f";
+        objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Arc::new(out)
+}
+
+fn key_of(bytes: &Arc<Vec<u8>>) -> Key {
+    Key { source: Arc::as_ptr(bytes) as usize, auth: 1, page: 0, px: [32, 48] }
+}
+
+fn want(file: u64, bytes: &Arc<Vec<u8>>) -> Want {
+    Want { slot: (file, 0), key: key_of(bytes), bytes: bytes.clone(), password: None, scale: 0.15, visible: true }
+}
+
+fn listing(files: &[(u64, &Arc<Vec<u8>>)]) -> HashMap<Slot, Key> {
+    files.iter().map(|(f, b)| ((*f, 0), key_of(b))).collect()
+}
+
+/// One frame of `finish`, as the app runs it; how soon it asks to be drawn again.
+fn frame(ctx: &egui::Context, thumbs: &mut Thumbs, current: &HashMap<Slot, Key>) -> std::time::Duration {
+    let mut out = ctx.run_ui(egui::RawInput::default(), |ui| thumbs.finish(ui.ctx(), &|slot| current.get(&slot).copied()));
+    // No GPU here: the texture uploads are taken as done.
+    out.textures_delta.clear();
+    out.viewport_output.get(&egui::ViewportId::ROOT).map_or(std::time::Duration::MAX, |v| v.repaint_delay)
+}
+
+#[test]
+fn a_thumbnail_that_arrives_is_drawn_without_waiting_for_input() {
+    // Regression: the cards are drawn before results are taken; the last result used to
+    // leave its card blank until the next mouse move.
+    let ctx = egui::Context::default();
+    let mut thumbs = Thumbs::default();
+    let bytes = pdf(1, 200, 300);
+    let current = listing(&[(1, &bytes)]);
+    thumbs.wants.push(want(1, &bytes));
+    frame(&ctx, &mut thumbs, &current);
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    loop {
+        let delay = frame(&ctx, &mut thumbs, &current);
+        if thumbs.entries.get(&(1, 0)).is_some_and(|e| e.tex.is_some()) {
+            assert_eq!(delay, std::time::Duration::ZERO, "the frame that took the result asks for another");
+            break;
+        }
+        assert!(std::time::Instant::now() < deadline, "the thumbnail arrives");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+}
+
+#[test]
+fn a_result_for_a_file_that_changed_is_never_shown() {
+    let ctx = egui::Context::default();
+    let mut thumbs = Thumbs::default();
+    let bytes = pdf(1, 200, 300);
+    thumbs.wants.push(want(1, &bytes));
+    frame(&ctx, &mut thumbs, &listing(&[(1, &bytes)]));
+    assert_eq!(thumbs.jobs.len(), 1, "the render started");
+    // The file leaves the list (or is unlocked differently) while it renders.
+    let other = pdf(1, 200, 300);
+    let changed = listing(&[(1, &other)]);
+    frame(&ctx, &mut thumbs, &changed);
+    assert!(thumbs.jobs.is_empty(), "let go of at once");
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    while thumbs.threads() > 0 {
+        assert!(std::time::Instant::now() < deadline, "its thread exits");
+        frame(&ctx, &mut thumbs, &changed);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(thumbs.entries.is_empty(), "its result is never kept");
+}
+
+#[test]
+fn textures_over_budget_go_longest_unseen_first_and_those_in_view_stay() {
+    let ctx = egui::Context::default();
+    let mut thumbs = Thumbs::default();
+    let tex = |n: &str| ctx.load_texture(n, egui::ColorImage::new([1, 1], vec![Color32::WHITE]), egui::TextureOptions::LINEAR);
+    let files: Vec<Arc<Vec<u8>>> = (0..4).map(|_| pdf(1, 200, 300)).collect();
+    thumbs.frame = 10;
+    // Seen at frames 1, 5 and 9 (out of view now), and 10 (in view), 20 MB each as counted.
+    for (i, seen) in [1u64, 5, 9, 10].into_iter().enumerate() {
+        let key = key_of(&files[i]);
+        thumbs.entries.insert((i as u64, 0), Entry { key, tex: Some(tex(&format!("t{i}"))), error: None, seen, bytes: 20 << 20 });
+    }
+    let current: HashMap<Slot, Key> = files.iter().enumerate().map(|(i, b)| ((i as u64, 0), key_of(b))).collect();
+    frame(&ctx, &mut thumbs, &current);
+    let mut kept: Vec<u64> = thumbs.entries.keys().map(|k| k.0).collect();
+    kept.sort_unstable();
+    assert_eq!(kept, [3], "80 MB: the three out of view go, oldest first; the one in view stays even over budget");
+}
+
+#[test]
+fn render_threads_never_exceed_three_while_files_come_and_go() {
+    let ctx = egui::Context::default();
+    let mut thumbs = Thumbs::default();
+    let files: Vec<Arc<Vec<u8>>> = (0..12).map(|i| pdf(1 + i % 3, 200, 300)).collect();
+    let mut most = 0;
+    for round in 0..120u64 {
+        // A different handful of files every few frames: renders are abandoned all the time.
+        let start = (round / 3 % 4 * 3) as usize;
+        let shown: Vec<(u64, &Arc<Vec<u8>>)> = (start..start + 4).map(|i| (i as u64, &files[i % files.len()])).collect();
+        for (file, bytes) in &shown {
+            thumbs.wants.push(want(*file, bytes));
+        }
+        frame(&ctx, &mut thumbs, &listing(&shown));
+        let threads = thumbs.threads();
+        most = most.max(threads);
+        assert!(threads <= MAX_THREADS, "round {round}: {threads} render threads");
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+    assert!(most > 0, "renders did run");
+}
+
+#[test]
+fn on_the_web_one_thumbnail_waits_at_a_time() {
+    // Regression: pools that render on the UI thread have no threads to count, so three
+    // started every frame while one finished, each holding its parsed document.
+    let ctx = egui::Context::default();
+    let mut thumbs = Thumbs { inline: true, ..Default::default() };
+    let files: Vec<Arc<Vec<u8>>> = (0..6).map(|_| pdf(1, 200, 300)).collect();
+    let shown: Vec<(u64, &Arc<Vec<u8>>)> = files.iter().enumerate().map(|(i, b)| (i as u64, b)).collect();
+    // One heavy step a frame on the UI thread: a parse, then the next frame its render.
+    for round in 0..14 {
+        for (file, bytes) in &shown {
+            thumbs.wants.push(want(*file, bytes));
+        }
+        frame(&ctx, &mut thumbs, &listing(&shown));
+        assert!(thumbs.jobs.len() <= 1, "round {round}: {} renders waiting", thumbs.jobs.len());
+        assert!(thumbs.jobs.iter().all(|j| j.pool.is_inline()));
+    }
+    assert!(thumbs.entries.values().filter(|e| e.tex.is_some()).count() == 6, "all six drawn, one heavy step per frame");
+}
+
+#[test]
+fn the_next_page_of_a_file_reuses_its_open_document_until_it_closes() {
+    // Regression: each page of an expanded file read (parsed) the whole file again.
+    let ctx = egui::Context::default();
+    let mut thumbs = Thumbs::default();
+    let bytes = pdf(3, 200, 300);
+    let first = key_of(&bytes);
+    let second = Key { page: 1, ..first };
+    let current: HashMap<Slot, Key> = [((1, 0), first), ((1, 1), second)].into_iter().collect();
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    let drawn = |thumbs: &Thumbs, slot: Slot| thumbs.entries.get(&slot).is_some_and(|e| e.tex.is_some());
+    while !drawn(&thumbs, (1, 0)) {
+        assert!(std::time::Instant::now() < deadline, "page 1 is drawn");
+        thumbs.wants.push(want(1, &bytes));
+        frame(&ctx, &mut thumbs, &current);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(thumbs.open.len(), 1, "its document stays open a moment");
+    // Page 2 of the same file, read the same way: that open document renders it.
+    thumbs.wants.push(Want { slot: (1, 1), key: second, ..want(1, &bytes) });
+    frame(&ctx, &mut thumbs, &current);
+    assert!(thumbs.open.is_empty() && thumbs.jobs.len() == 1, "reused, not a new pool: {} open, {} jobs", thumbs.open.len(), thumbs.jobs.len());
+    while !drawn(&thumbs, (1, 1)) {
+        assert!(std::time::Instant::now() < deadline, "page 2 is drawn");
+        frame(&ctx, &mut thumbs, &current);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(thumbs.threads() <= MAX_THREADS);
+    // Unused, it closes after a while, and its thread goes.
+    while thumbs.threads() > 0 || !thumbs.open.is_empty() {
+        assert!(std::time::Instant::now() < deadline, "the open document closes and its thread exits");
+        frame(&ctx, &mut thumbs, &current);
+    }
+}
+
+#[test]
+fn a_page_that_failed_is_not_tried_again_at_another_size() {
+    // Regression: each zoom step asked for a new render of a page that had failed (or hung
+    // for the watchdog's 20 s), filling the render threads.
+    // (A card asks for a render only when it looks Pending.)
+    let mut thumbs = Thumbs::default();
+    let bytes = pdf(1, 200, 300);
+    let key = key_of(&bytes);
+    thumbs.entries.insert((1, 0), Entry { key, tex: None, error: Some("broken".into()), seen: 0, bytes: 0 });
+    let larger = Key { px: [key.px[0] + 64, key.px[1] + 64], ..key };
+    assert!(matches!(thumbs.look((1, 0), larger), Look::Failed(e) if e == "broken"), "the failure stands at another size");
+    // Another read of the file (a new password) is a new page: tried again.
+    let reread = Key { auth: 2, ..key };
+    assert!(matches!(thumbs.look((1, 0), reread), Look::Pending(None)));
+}
+
+#[test]
+fn on_the_web_a_render_that_never_answers_fails_and_lets_the_rest_through() {
+    // A pool without threads answers on the call that renders: no answer then never comes.
+    // It used to wait for good, so nothing else started and every frame asked for another.
+    let ctx = egui::Context::default();
+    let mut thumbs = Thumbs { inline: true, ..Default::default() };
+    let (silent, next) = (pdf(1, 200, 300), pdf(1, 200, 300));
+    let pool = RenderPool::new_inline(silent.clone(), RenderConfig::default());
+    // Nothing queued: this pool has nothing to answer with.
+    thumbs.jobs.push(Job { slot: (1, 0), key: key_of(&silent), pool, tag: 7 });
+    let current = listing(&[(1, &silent), (2, &next)]);
+    for _ in 0..4 {
+        thumbs.wants.push(want(2, &next));
+        frame(&ctx, &mut thumbs, &current);
+    }
+    assert!(thumbs.entries.get(&(1, 0)).is_some_and(|e| e.tex.is_none() && e.error.is_some()), "the silent one failed");
+    assert!(thumbs.entries.get(&(2, 0)).is_some_and(|e| e.tex.is_some()), "the next one was drawn");
+    assert!(thumbs.jobs.is_empty());
+    assert!(frame(&ctx, &mut thumbs, &current) > std::time::Duration::ZERO, "no more frames asked for at once");
+}
diff --git a/crates/ui-egui/src/workflows/combine_grid/thumbs.rs b/crates/ui-egui/src/workflows/combine_grid/thumbs.rs
new file mode 100644
index 0000000000..5494cdc004
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_grid/thumbs.rs
@@ -0,0 +1,391 @@
+use super::*;
+
+/// Render threads for thumbnails at once, counting those of retired pools until they exit.
+pub(super) const MAX_THREADS: usize = 3;
+
+/// Results taken per frame, and the bytes they may upload.
+const UPLOADS_PER_FRAME: usize = 4;
+
+const UPLOAD_BYTES_PER_FRAME: usize = 8 << 20;
+
+/// Thumbnail textures kept, in bytes. Those out of view go first, longest unseen first; those in
+/// view are kept even over budget (at most a screenful of thumbnails of at most [`MAX_SIDE`]).
+const TEXTURE_BUDGET: usize = 32 << 20;
+
+/// The longest side of a thumbnail, in pixels.
+/// (Room for a Letter page at 500% on a screen of 1.5 pixels per point; sharper screens upscale a
+/// little at the largest sizes.) This only binds near the top of the zoom range: a card below it
+/// asks for less than this and costs no more than it did. Near the top one thumbnail is a few
+/// megabytes, so [`TEXTURE_BUDGET`] and [`UPLOAD_BYTES_PER_FRAME`] keep the cache at a screenful
+/// plus one frame's uploads — and at the top of the range a screenful is a card or two, because a
+/// card is wider than most windows.
+pub(super) const MAX_SIDE: f32 = 1536.0;
+
+/// Thumbnail sizes round up to this many pixels, so a slightly different layout reuses them.
+pub(super) const SIZE_STEP: u32 = 16;
+
+/// A thumbnail's place: the file (by id) and the page (0-based, in the file). A file's card and
+/// the card of its first page when expanded show the same thumbnail.
+pub(super) type Slot = (u64, usize);
+
+/// The page shown large (a card's magnifier) is kept beside the thumbnails under this slot, so it
+/// shares their threads, their limits and their checks.
+pub(super) const PREVIEW: Slot = (u64::MAX, 0);
+
+/// The longest side of the page shown large, in pixels.
+pub(super) const PREVIEW_SIDE: f32 = 2048.0;
+
+/// A file whose render is done keeps its document open this long (seconds), so the next page of
+/// the same file renders without reading the whole file again.
+const KEEP_OPEN: f64 = 2.0;
+
+/// What the grid has for a file (tests and the control channel).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ThumbState {
+    /// Nothing yet: not in view, or nothing to draw (locked, unreadable, a bad page range, a page
+    /// whose size is unknown).
+    None,
+    /// Being rendered.
+    Pending,
+    /// A thumbnail of page `page` (0-based), `width` × `height` pixels.
+    Ready { page: usize, width: u32, height: u32 },
+    /// The page couldn't be drawn.
+    Failed(String),
+}
+
+/// Everything a thumbnail depends on: the file's bytes, how it was read (its password), the page
+/// and the size. A cached thumbnail is used only while all of them still match.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) struct Key {
+    /// The address of the file's shared bytes: the same file, even after undo brings it back.
+    pub(super) source: usize,
+    pub(super) auth: u64,
+    pub(super) page: usize,
+    pub(super) px: [u32; 2],
+}
+
+impl Key {
+    fn same_page(&self, other: &Key) -> bool {
+        (self.source, self.auth, self.page) == (other.source, other.auth, other.page)
+    }
+}
+
+pub(super) struct Entry {
+    pub(super) key: Key,
+    pub(super) tex: Option<TextureHandle>,
+    pub(super) error: Option<String>,
+    /// The frame the card last showed it.
+    pub(super) seen: u64,
+    pub(super) bytes: usize,
+}
+
+pub(super) struct Job {
+    pub(super) slot: Slot,
+    pub(super) key: Key,
+    pub(super) pool: RenderPool,
+    pub(super) tag: u64,
+}
+
+/// A pool whose render is done, with its document still open: kept a moment for the next page of
+/// the same file, read the same way.
+pub(super) struct Open {
+    source: usize,
+    auth: u64,
+    pool: RenderPool,
+    /// When its render finished (seconds).
+    since: f64,
+}
+
+/// A thumbnail a card needs this frame.
+pub(super) struct Want {
+    pub(super) slot: Slot,
+    pub(super) key: Key,
+    pub(super) bytes: Arc<Vec<u8>>,
+    pub(super) password: Option<Arc<str>>,
+    pub(super) scale: f32,
+    pub(super) visible: bool,
+}
+
+/// The grid's thumbnails and the renders under way.
+#[derive(Default)]
+pub(crate) struct Thumbs {
+    pub(super) entries: HashMap<Slot, Entry>,
+    pub(super) jobs: Vec<Job>,
+    /// Pools done rendering, their documents still open (their threads count).
+    pub(super) open: Vec<Open>,
+    /// Threads of pools let go of, until they exit.
+    pub(super) retiring: Vec<Retiring>,
+    pub(super) frame: u64,
+    pub(super) next_tag: u64,
+    pub(super) wants: Vec<Want>,
+    /// Render on the UI thread, as the web build does (tests).
+    #[cfg(test)]
+    pub(super) inline: bool,
+}
+
+/// What a card can draw now.
+pub(super) enum Look {
+    Ready(egui::TextureId),
+    Failed(String),
+    /// Not ready; an older thumbnail of the same page may stand in.
+    Pending(Option<egui::TextureId>),
+}
+
+impl Thumbs {
+    /// Forget every thumbnail (the tab closed). Renders under way are let go of: told to stop at
+    /// their next drawing operator, and counted until their threads exit.
+    pub(crate) fn clear(&mut self) {
+        self.entries.clear();
+        self.wants.clear();
+        for job in self.jobs.drain(..) {
+            self.retiring.push(job.pool.retire());
+        }
+        for open in self.open.drain(..) {
+            self.retiring.push(open.pool.retire());
+        }
+    }
+
+    /// Render threads that exist now (real threads, not pools): those of pools at work, of pools
+    /// keeping a document open, and of pools let go of.
+    pub(super) fn threads(&mut self) -> usize {
+        self.retiring.retain_mut(|r| r.running() > 0);
+        let retiring: usize = self.retiring.iter_mut().map(Retiring::running).sum();
+        let working: usize = self.jobs.iter().map(|j| j.pool.threads()).sum();
+        let open: usize = self.open.iter().map(|o| o.pool.threads()).sum();
+        working.saturating_add(open).saturating_add(retiring)
+    }
+
+    pub(super) fn look(&mut self, slot: Slot, key: Key) -> Look {
+        let frame = self.frame;
+        match self.entries.get_mut(&slot) {
+            Some(e) if e.key == key => {
+                e.seen = frame;
+                match (&e.tex, &e.error) {
+                    (Some(tex), _) => Look::Ready(tex.id()),
+                    (None, Some(err)) => Look::Failed(err.clone()),
+                    (None, None) => Look::Pending(None),
+                }
+            }
+            // Another size of the same page stands in until this one arrives. A page that failed
+            // isn't tried again at another size: it would fail (or hang) the same way, each zoom.
+            Some(e) if e.key.same_page(&key) => {
+                e.seen = frame;
+                match &e.error {
+                    Some(err) if e.tex.is_none() => Look::Failed(err.clone()),
+                    _ => Look::Pending(e.tex.as_ref().map(TextureHandle::id)),
+                }
+            }
+            _ => Look::Pending(None),
+        }
+    }
+
+    pub(super) fn state(&self, slot: Slot) -> ThumbState {
+        if let Some(e) = self.entries.get(&slot) {
+            if let Some(tex) = &e.tex {
+                let [w, h] = tex.size();
+                return ThumbState::Ready {
+                    page: e.key.page,
+                    width: u32::try_from(w).unwrap_or(u32::MAX),
+                    height: u32::try_from(h).unwrap_or(u32::MAX),
+                };
+            }
+            if let Some(err) = &e.error {
+                return ThumbState::Failed(err.clone());
+            }
+        }
+        if self.jobs.iter().any(|j| j.slot == slot) { ThumbState::Pending } else { ThumbState::None }
+    }
+
+    /// Once per frame, whatever shows: drop what no longer matches the list, take finished
+    /// renders, start those the grid asked for and keep the textures within budget. `current`
+    /// says what a thumbnail must match now (looked up, so the cost follows the files and the
+    /// thumbnails kept, not the pages of an expanded file).
+    pub(super) fn finish(&mut self, ctx: &egui::Context, current: &dyn Fn(Slot) -> Option<Key>) {
+        let now = ctx.input(|i| i.time);
+        // Reconcile with the list as it is now (undo, redo, unlock, a new range, removal): a
+        // thumbnail of another page, password or file is never shown again.
+        self.entries.retain(|slot, e| current(*slot).is_some_and(|k| k.same_page(&e.key)));
+        // Renders nobody wants any more are let go of now (on the web, before they would render).
+        let (keep, gone): (Vec<Job>, Vec<Job>) = self.jobs.drain(..).partition(|job| current(job.slot).is_some_and(|k| k.same_page(&job.key)));
+        self.jobs = keep;
+        self.retiring.extend(gone.into_iter().map(|job| job.pool.retire()));
+        // Documents kept open past their time are closed.
+        let (keep, gone): (Vec<Open>, Vec<Open>) = self.open.drain(..).partition(|o| now - o.since < KEEP_OPEN);
+        self.open = keep;
+        self.retiring.extend(gone.into_iter().map(|o| o.pool.retire()));
+
+        // Finished renders, a few per frame. A pool without threads (the web) renders inside
+        // `try_recv`: at most one of those per frame.
+        let gpu_side = ctx.input(|i| i.max_texture_side);
+        let max_side = gpu_side.min(2 * MAX_SIDE as usize);
+        let (mut taken, mut uploaded, mut inline_used) = (0usize, 0usize, false);
+        let mut i = 0;
+        while i < self.jobs.len() {
+            if taken >= UPLOADS_PER_FRAME || uploaded >= UPLOAD_BYTES_PER_FRAME {
+                break;
+            }
+            let Some(job) = self.jobs.get(i) else { break };
+            if job.pool.is_inline() {
+                if inline_used {
+                    i += 1;
+                    continue;
+                }
+                inline_used = true;
+            }
+            // Not done yet, or not this job's answer (cannot happen with one request per pool):
+            // keep waiting. A pool without threads answers on the call that renders, so there no
+            // answer is one that never comes: the thumbnail fails rather than hold up the rest.
+            let answer = job.pool.try_recv().filter(|out| out.request.tag == job.tag);
+            if answer.is_none() && !job.pool.is_inline() {
+                i += 1;
+                continue;
+            }
+            let job = self.jobs.swap_remove(i);
+            taken += 1;
+            // A pool that rendered (rather than failed or hung) can keep its document open.
+            let healthy = answer.as_ref().is_some_and(|out| out.error.is_none());
+            let failed = |e: String| Entry { key: job.key, tex: None, error: Some(e), seen: self.frame, bytes: 0 };
+            let entry = match answer {
+                None => failed("the page wasn't drawn".to_owned()),
+                Some(out) => match out.error {
+                    Some(e) => failed(e),
+                    None => match texture(
+                        ctx,
+                        job.slot,
+                        [out.width, out.height],
+                        out.rgba,
+                        if job.slot == PREVIEW { gpu_side.min(PREVIEW_SIDE as usize) } else { max_side },
+                    ) {
+                        Ok((tex, bytes)) => {
+                            uploaded = uploaded.saturating_add(bytes);
+                            Entry { key: job.key, tex: Some(tex), error: None, seen: self.frame, bytes }
+                        }
+                        Err(e) => failed(e),
+                    },
+                },
+            };
+            self.entries.insert(job.slot, entry);
+            // Its document stays open a moment for the file's next page (its thread, idle, still
+            // counts); otherwise its thread (idle, or finishing a render the watchdog gave up on)
+            // counts until it exits.
+            if healthy && job.pool.threads() <= 1 && self.open.len() < MAX_THREADS {
+                self.open.push(Open { source: job.key.source, auth: job.key.auth, pool: job.pool, since: now });
+            } else {
+                self.retiring.push(job.pool.retire());
+            }
+        }
+
+        // New renders: the cards in view first, in grid order; one per thumbnail at a time.
+        let mut wants = std::mem::take(&mut self.wants);
+        wants.sort_by_key(|w| (w.slot != PREVIEW, !w.visible));
+        // A pool without threads (the web) parses its document when it is made and keeps it until
+        // it renders, one per frame: while one waits, nothing else starts.
+        // (Nor in the frame that rendered one: one heavy step per frame on the UI thread.)
+        let mut threads = if inline_used || self.jobs.iter().any(|j| j.pool.is_inline()) { MAX_THREADS } else { self.threads() };
+        let mut waiting = false;
+        for w in wants {
+            // Wanted for the list as it is now (not changed by this frame's action); one render
+            // per thumbnail at a time; and a want made earlier this frame may have just been
+            // answered.
+            if current(w.slot).is_none_or(|k| !k.same_page(&w.key))
+                || self.jobs.iter().any(|j| j.slot == w.slot)
+                || self.entries.get(&w.slot).is_some_and(|e| e.key == w.key)
+            {
+                continue;
+            }
+            // The same file, read the same way, still open from a render just done: no new read of
+            // the file (and its thread is already counted). On the web, not while another waits.
+            let inline_waiting = self.jobs.iter().any(|j| j.pool.is_inline());
+            if let Some(k) =
+                self.open.iter().position(|o| o.source == w.key.source && o.auth == w.key.auth && !(o.pool.is_inline() && inline_waiting))
+            {
+                let pool = self.open.swap_remove(k).pool;
+                self.next_tag = self.next_tag.wrapping_add(1);
+                let tag = self.next_tag;
+                pool.set_queue(vec![RenderRequest { page: w.key.page, scale: w.scale, tag, ..Default::default() }]);
+                if pool.is_inline() {
+                    threads = MAX_THREADS;
+                }
+                self.jobs.push(Job { slot: w.slot, key: w.key, pool, tag });
+                continue;
+            }
+            if threads >= MAX_THREADS {
+                // A document kept open for another file gives its thread up: it exits, and this
+                // starts then.
+                if let Some(k) = self.open.iter().enumerate().min_by(|(_, a), (_, b)| a.since.total_cmp(&b.since)).map(|(k, _)| k) {
+                    let open = self.open.swap_remove(k);
+                    self.retiring.push(open.pool.retire());
+                }
+                waiting = true;
+                break;
+            }
+            let config = RenderConfig { password: w.password, ..Default::default() };
+            #[cfg(test)]
+            let pool = if self.inline { RenderPool::new_inline(w.bytes, config) } else { RenderPool::new(w.bytes, 1, config).without_replacements() };
+            #[cfg(not(test))]
+            let pool = RenderPool::new(w.bytes, 1, config).without_replacements();
+            self.next_tag = self.next_tag.wrapping_add(1);
+            let tag = self.next_tag;
+            // The request stays in the pool's queue (it is never replaced) until its answer.
+            pool.set_queue(vec![RenderRequest { page: w.key.page, scale: w.scale, tag, ..Default::default() }]);
+            threads = if pool.is_inline() { MAX_THREADS } else { threads.saturating_add(1) };
+            self.jobs.push(Job { slot: w.slot, key: w.key, pool, tag });
+        }
+
+        // Within budget: drop the thumbnails out of view longest unseen first.
+        // (The page shown large has its own: one texture, gone when it closes.)
+        let mut total: usize = self.entries.iter().filter(|(f, _)| **f != PREVIEW).map(|(_, e)| e.bytes).sum();
+        if total > TEXTURE_BUDGET {
+            let mut old: Vec<(u64, Slot, usize)> = self
+                .entries
+                .iter()
+                .filter(|(f, e)| **f != PREVIEW && e.seen != self.frame && e.bytes > 0)
+                .map(|(f, e)| (e.seen, *f, e.bytes))
+                .collect();
+            old.sort_unstable();
+            for (_, slot, bytes) in old {
+                if total <= TEXTURE_BUDGET {
+                    break;
+                }
+                self.entries.remove(&slot);
+                total = total.saturating_sub(bytes);
+            }
+        }
+
+        // The cards were drawn before these results arrived: draw them again. Keep polling while
+        // renders are under way, and while a thumbnail waits for a thread to exit (not when
+        // nothing waits: a thread exiting changes nothing on screen).
+        if taken > 0 || self.jobs.iter().any(|j| j.pool.is_inline()) {
+            ctx.request_repaint();
+        } else if !self.jobs.is_empty() {
+            ctx.request_repaint_after(std::time::Duration::from_millis(16));
+        } else if waiting {
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        } else if !self.open.is_empty() {
+            // To close the documents kept open when their time is up.
+            ctx.request_repaint_after(std::time::Duration::from_secs_f64(KEEP_OPEN));
+        }
+        self.frame = self.frame.wrapping_add(1);
+    }
+}
+
+/// A rendered thumbnail as a texture, and its size in bytes. A raster that doesn't add up, or is
+/// larger than a thumbnail can be (or than the GPU accepts), is refused, never uploaded.
+fn texture(
+    ctx: &egui::Context,
+    slot: Slot,
+    size: [u32; 2],
+    pixels: pdfcraft_render::Pixels,
+    max_side: usize,
+) -> Result<(TextureHandle, usize), String> {
+    let [w, h] = size.map(|v| v as usize);
+    if w == 0 || h == 0 || w > max_side || h > max_side {
+        return Err(format!("the thumbnail came back {w}×{h} pixels"));
+    }
+    let bytes = w.checked_mul(h).and_then(|p| p.checked_mul(4)).ok_or("the thumbnail is too large")?;
+    if pixels.len() != bytes {
+        return Err("the thumbnail came back incomplete".to_owned());
+    }
+    let image = crate::canvas::texture_image([w, h], pixels);
+    Ok((ctx.load_texture(format!("combine-thumb-{}-{}", slot.0, slot.1), image, egui::TextureOptions::LINEAR), bytes))
+}
diff --git a/crates/ui-egui/src/workflows/combine_ui.rs b/crates/ui-egui/src/workflows/combine_ui.rs
new file mode 100644
index 0000000000..c31ede9ca1
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_ui.rs
@@ -0,0 +1,163 @@
+//! Combine files, in its own tab: the files to combine, in order, each with the pages to take
+//! (all, or a range such as "1-3, 6"), its size, when it was modified and anything that stops it
+//! being combined. Rows are selected like files in a file manager (click, Ctrl/⌘+click,
+//! Shift+click), moved with the toolbar, the keyboard or by dragging, and sorted by clicking a
+//! column heading; PDFs dropped on the tab join the list. Every change to the list can be undone.
+
+use std::cmp::Ordering;
+use std::collections::{BTreeSet, HashMap};
+use std::sync::Arc;
+use std::time::SystemTime;
+
+use egui::{Align, Color32, CornerRadius, Layout, Modifiers, Rect, Sense, Stroke, vec2};
+use egui_extras::{Column, TableBuilder};
+use pdfcraft_engine::SourceProblem;
+
+use crate::theme::{self, Tokens};
+use crate::{PdfCraftApp, icons, widgets};
+
+mod actions;
+mod files;
+mod parts;
+mod session;
+mod table;
+mod view;
+
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) use files::Incoming;
+pub use files::{Columns, CombineFile, CombineView, ConflictPreview, Lock, SortKey};
+pub(crate) use files::{Preview, RowAction};
+use files::{Snapshot, UnlockPrompt};
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) use parts::ago;
+pub(crate) use parts::range_of;
+#[cfg(test)]
+pub(crate) use parts::{Part, moved_order, moved_pages, removed_pages, step_to};
+#[cfg(test)]
+use parts::{title_of, utc_stamp};
+pub(crate) use view::page;
+
+/// Same reds and ambers as the signature status (`sign_ui`).
+pub(crate) const ERROR: Color32 = Color32::from_rgb(0xD7, 0x37, 0x3F);
+pub(crate) const WARNING: Color32 = Color32::from_rgb(0xE6, 0x86, 0x19);
+/// Undo steps kept for the list (each holds the list itself; the files' bytes are shared).
+const HISTORY: usize = 100;
+
+/// Files found in a folder are added up to this many at a time.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_FOLDER_FILES: usize = 1000;
+/// How deep "Add folder and subfolders" looks.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_FOLDER_DEPTH: usize = 16;
+
+/// The Combine files tab. It shows in the Home slot (`active == None`) while `focused`.
+#[derive(Clone, Debug, Default)]
+pub struct CombineTab {
+    pub open: bool,
+    pub focused: bool,
+    /// The selected rows, by [`CombineFile::id`], so a selection survives sorting and moving.
+    pub selected: BTreeSet<u64>,
+    /// Where a Shift+click or Shift+arrow range starts, and where it ends.
+    anchor: Option<u64>,
+    cursor: Option<u64>,
+    /// The column the list is sorted by and whether ascending; cleared when rows are moved.
+    pub sort: Option<(SortKey, bool)>,
+    undo: Vec<Snapshot>,
+    redo: Vec<Snapshot>,
+    /// The list as it was when a Pages field took the keyboard, recorded on its first change.
+    range_edit: Option<Snapshot>,
+    next_id: u64,
+    /// Bumped to make the table take its column widths afresh (columns moved or reset, or the
+    /// window resized while the widths follow it).
+    layout: u64,
+    /// The width the columns were last fitted to.
+    fitted: f32,
+    /// The password box of Unlock…, while it shows.
+    unlock: Option<UnlockPrompt>,
+    /// Bumped on every change to the list, so a grid drag that began before one is dropped.
+    pub(crate) revision: u64,
+    /// Exact-content duplicate warnings, shared by both views until the list changes.
+    duplicates: Option<(u64, Arc<[bool]>)>,
+    /// The file the keyboard moved to, for the grid to scroll into view.
+    pub(crate) reveal: Option<u64>,
+    /// Files per grid row as last drawn (Up/Down move a row in the grid).
+    pub(crate) grid_columns: usize,
+    /// A grid zoom asked for this frame (toolbar, keys, pinch); the grid applies it once it has
+    /// laid out, so it can keep the same cards in view.
+    pub(crate) zoom_request: Option<f32>,
+    /// The card size slider, which takes the arrow keys while it has the keyboard.
+    pub(crate) zoom_slider: Option<egui::Id>,
+    /// The card kept in place through a zoom gesture: its file, its place among the file's pages
+    /// (0 for the file's own card), how far below the top of the grid it was, and when the grid
+    /// last zoomed (seconds).
+    pub(crate) zoom_anchor: Option<(u64, usize, f32, f64)>,
+    /// Files shown as their pages in the grid (a view, not an edit: no undo step).
+    pub(crate) expanded: BTreeSet<u64>,
+    /// The pages each expanded file shows, worked out again only when its range changes.
+    pub(crate) page_lists: HashMap<u64, crate::combine_grid::PageList>,
+    /// The file (by place in the list) at each place of the grid as last drawn: Up and Down step
+    /// a row of cards, page cards included.
+    pub(crate) grid_places: Vec<usize>,
+    /// A file shown large (a card's magnifier), while it shows.
+    pub(crate) preview: Option<Preview>,
+    /// The card that had the keyboard last frame: Space shows its file large; on any other focused
+    /// widget Space is that widget's.
+    pub(crate) card_focus: Option<egui::Id>,
+    /// That card's file and its place among the file's pages (0 for the file's own card): Space
+    /// on a page card shows that page.
+    pub(crate) card_focus_at: Option<(u64, usize)>,
+    /// Single pages selected in the grid (an expanded file's page cards), by entry id and place
+    /// among the entry's pages; the files' selection is empty while any is.
+    pub(crate) selected_pages: BTreeSet<(u64, usize)>,
+    /// The page a Shift-click selects from.
+    pub(crate) page_anchor: Option<(u64, usize)>,
+    /// "Leave out files that can't be read?", asked when Combine is clicked with such files in the
+    /// list.
+    pub(crate) confirm_skip: bool,
+}
+
+impl CombineTab {
+    fn duplicate_warnings(&mut self, files: &[CombineFile]) -> Arc<[bool]> {
+        if let Some((revision, flags)) = &self.duplicates
+            && *revision == self.revision
+        {
+            return flags.clone();
+        }
+        // Only same-named, same-sized files can be repeats. Avoid reading the bytes of
+        // unrelated files, and never count a source split into parts as several additions.
+        let mut candidates: HashMap<(&str, usize), Vec<usize>> = HashMap::new();
+        for (i, f) in files.iter().enumerate() {
+            candidates.entry((&f.name, f.source.len())).or_default().push(i);
+        }
+        let mut twice = vec![false; files.len()];
+        for indices in candidates.values() {
+            let Some(first) = indices.first().and_then(|i| files.get(*i)) else { continue };
+            if indices.iter().all(|i| files.get(*i).is_some_and(|f| f.group == first.group)) {
+                continue;
+            }
+            // Slice keys check exact bytes even when their hashes collide.
+            let mut contents: HashMap<&[u8], Vec<usize>> = HashMap::new();
+            for &i in indices {
+                if let Some(f) = files.get(i) {
+                    contents.entry(f.source.as_slice()).or_default().push(i);
+                }
+            }
+            for copies in contents.values() {
+                let Some(first) = copies.first().and_then(|i| files.get(*i)) else { continue };
+                if copies.iter().any(|i| files.get(*i).is_some_and(|f| f.group != first.group)) {
+                    for &i in copies {
+                        if let Some(flag) = twice.get_mut(i) {
+                            *flag = true;
+                        }
+                    }
+                }
+            }
+        }
+        let flags: Arc<[bool]> = twice.into();
+        self.duplicates = Some((self.revision, flags.clone()));
+        flags
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/workflows/combine_ui/actions.rs b/crates/ui-egui/src/workflows/combine_ui/actions.rs
new file mode 100644
index 0000000000..1eee3f8d39
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_ui/actions.rs
@@ -0,0 +1,275 @@
+use super::files::{Preview, RowAction};
+use super::parts::{moved_pages, removed_pages, step_to};
+use super::view::expandable;
+use super::*;
+
+impl PdfCraftApp {
+    pub(crate) fn combine_apply(&mut self, action: RowAction) {
+        let page_edit = matches!(action, RowAction::ClickPage(..) | RowAction::MovePages { .. } | RowAction::RemovePages(_));
+        self.combine_apply_once(action);
+        // One kind of selection at a time: files picked (by a click, the keys, a drop, Unlock…)
+        // let go of the pages picked, so the trash never takes pages the user no longer means.
+        if !self.combine_tab.selected.is_empty() {
+            self.combine_tab.selected_pages.clear();
+            self.combine_tab.page_anchor = None;
+        }
+        // A file's parts brought side by side (the file between them removed or moved away) are
+        // one entry again, as in the same undo step.
+        if !page_edit {
+            self.combine_join_parts();
+        }
+    }
+
+    fn combine_apply_once(&mut self, action: RowAction) {
+        // The trash and Delete act on the selected pages while there are any.
+        let action = match action {
+            // (Files picked come first: the two are never both picked, but if they ever were, the
+            // files the user sees picked are what goes.)
+            RowAction::Remove if self.combine_tab.selected.is_empty() && !self.combine_tab.selected_pages.is_empty() => RowAction::RemovePages(None),
+            a => a,
+        };
+        // Page edits work on the list as parts.
+        match action {
+            RowAction::ClickPage(id, nth, m) => return self.combine_click_page(id, nth, m),
+            RowAction::MovePages { page, revision, gap } => {
+                if revision != self.combine_tab.revision {
+                    return;
+                }
+                let moving =
+                    if self.combine_tab.selected_pages.contains(&page) { self.combine_tab.selected_pages.clone() } else { BTreeSet::from([page]) };
+                let parts = self.combine_parts();
+                let next = &mut self.combine_tab.next_id;
+                let mut new_id = || {
+                    let id = *next;
+                    *next = next.wrapping_add(1);
+                    id
+                };
+                if let Some(moved) = moved_pages(&parts, &moving, gap, &mut new_id) {
+                    self.combine_set_parts(moved);
+                }
+                return;
+            }
+            RowAction::RemovePages(one) => {
+                let removing = match one {
+                    Some(page) => BTreeSet::from([page]),
+                    None => self.combine_tab.selected_pages.clone(),
+                };
+                if removing.is_empty() {
+                    return;
+                }
+                let parts = self.combine_parts();
+                let next = &mut self.combine_tab.next_id;
+                let mut new_id = || {
+                    let id = *next;
+                    *next = next.wrapping_add(1);
+                    id
+                };
+                // (Nothing to take out: no undo step, the redo history kept.)
+                if let Some(left) = removed_pages(&parts, &removing, &mut new_id) {
+                    self.combine_set_parts(left);
+                }
+                return;
+            }
+            _ => {}
+        }
+        // A file's card clicked (or the list's keys): the files are selected, no page.
+        if matches!(action, RowAction::Click(..) | RowAction::SelectAll | RowAction::Step { .. }) {
+            self.combine_tab.selected_pages.clear();
+        }
+        let ids: Vec<u64> = self.combine_draft.iter().map(|f| f.id).collect();
+        let n = ids.len();
+        let index_of = |id: Option<u64>| id.and_then(|id| ids.iter().position(|x| *x == id));
+        let tab = &mut self.combine_tab;
+        match action {
+            RowAction::Click(i, m) => {
+                let Some(&id) = ids.get(i) else { return };
+                if m.shift {
+                    let from = index_of(tab.anchor).unwrap_or(i);
+                    let range = ids.get(from.min(i)..=from.max(i)).unwrap_or_default();
+                    if !m.command {
+                        tab.selected.clear();
+                    }
+                    tab.selected.extend(range.iter().copied());
+                    tab.cursor = Some(id);
+                } else if m.command {
+                    if !tab.selected.remove(&id) {
+                        tab.selected.insert(id);
+                    }
+                    (tab.anchor, tab.cursor) = (Some(id), Some(id));
+                } else {
+                    tab.selected = BTreeSet::from([id]);
+                    (tab.anchor, tab.cursor) = (Some(id), Some(id));
+                }
+            }
+            RowAction::SelectAll => {
+                tab.selected = ids.iter().copied().collect();
+            }
+            RowAction::Step { down, by, extend } => {
+                // With files shown as their pages, Up and Down go a row of cards (from the last
+                // of a file's cards down, from its first up) to the file there.
+                let places = &tab.grid_places;
+                let rows_of_cards = by > 1 && places.len() > n;
+                let next = match index_of(tab.cursor) {
+                    Some(c) if rows_of_cards => {
+                        let from = if down { places.iter().rposition(|f| *f == c) } else { places.iter().position(|f| *f == c) };
+                        from.and_then(|at| places.get(step_to(at, places.len(), by, down)).copied()).unwrap_or(c)
+                    }
+                    Some(c) => step_to(c, n, by, down),
+                    None if down => 0,
+                    None => n.saturating_sub(1),
+                };
+                let Some(&id) = ids.get(next) else { return };
+                if extend {
+                    let from = index_of(tab.anchor).unwrap_or(next);
+                    tab.selected = ids.get(from.min(next)..=from.max(next)).unwrap_or_default().iter().copied().collect();
+                } else {
+                    tab.selected = BTreeSet::from([id]);
+                    tab.anchor = Some(id);
+                }
+                tab.cursor = Some(id);
+                tab.reveal = Some(id);
+            }
+            RowAction::MoveUp | RowAction::MoveDown => {
+                let up = matches!(action, RowAction::MoveUp);
+                let selected: Vec<bool> = ids.iter().map(|id| tab.selected.contains(id)).collect();
+                let movable =
+                    if up { selected.iter().skip_while(|s| **s).any(|s| *s) } else { selected.iter().rev().skip_while(|s| **s).any(|s| *s) };
+                if !movable {
+                    return;
+                }
+                self.combine_record();
+                let list = &mut self.combine_draft;
+                let sel = &self.combine_tab.selected;
+                // Each selected file steps past its unselected neighbour; blocks move together.
+                if up {
+                    for i in 1..list.len() {
+                        if sel.contains(&list[i].id) && !sel.contains(&list[i - 1].id) {
+                            list.swap(i, i - 1);
+                        }
+                    }
+                } else {
+                    for i in (0..list.len().saturating_sub(1)).rev() {
+                        if sel.contains(&list[i].id) && !sel.contains(&list[i + 1].id) {
+                            list.swap(i, i + 1);
+                        }
+                    }
+                }
+                self.combine_tab.sort = None;
+            }
+            RowAction::Remove => {
+                let Some(first) = ids.iter().position(|id| tab.selected.contains(id)) else { return };
+                self.combine_record();
+                let sel = std::mem::take(&mut self.combine_tab.selected);
+                self.combine_draft.retain(|f| !sel.contains(&f.id));
+                // The file that took the first removed one's place is selected next.
+                let next = self.combine_draft.get(first).or(self.combine_draft.last()).map(|f| f.id);
+                self.combine_tab.selected = next.into_iter().collect();
+                (self.combine_tab.anchor, self.combine_tab.cursor) = (next, next);
+            }
+            RowAction::RemoveFile(id) => {
+                if !ids.contains(&id) {
+                    return;
+                }
+                self.combine_record();
+                self.combine_draft.retain(|f| f.id != id);
+                // The rest of the selection stays as it was.
+                self.combine_tab.selected.remove(&id);
+                if self.combine_tab.anchor == Some(id) {
+                    self.combine_tab.anchor = None;
+                }
+                if self.combine_tab.cursor == Some(id) {
+                    self.combine_tab.cursor = None;
+                }
+            }
+            RowAction::Preview(id) => {
+                if ids.contains(&id) {
+                    self.combine_tab.preview = Some(Preview { file: id, at: 0, page: None, pages: None });
+                }
+            }
+            RowAction::PreviewAt(id, at) => {
+                if ids.contains(&id) {
+                    self.combine_tab.preview = Some(Preview { file: id, at, page: None, pages: None });
+                }
+            }
+            RowAction::Expand(id, on) => {
+                if on {
+                    if self.combine_draft.iter_mut().any(|f| f.id == id && expandable(f)) {
+                        self.combine_tab.expanded.insert(id);
+                    }
+                } else {
+                    self.combine_tab.expanded.remove(&id);
+                    // Its card may be far from where its pages were: brought into view.
+                    self.combine_tab.reveal = Some(id);
+                }
+            }
+            RowAction::ExpandAll(on) => {
+                self.combine_tab.expanded =
+                    if on { self.combine_draft.iter_mut().filter_map(|f| expandable(f).then_some(f.id)).collect() } else { BTreeSet::new() };
+                if !on {
+                    self.combine_tab.reveal = self.combine_tab.cursor;
+                }
+            }
+            RowAction::PreviewSelected => {
+                // The file the keyboard is on, or the first selected; with pages selected, the
+                // page card that has the keyboard, or the first selected page.
+                let first_page = tab.selected_pages.iter().min_by_key(|(id, nth)| (ids.iter().position(|x| x == id), *nth)).copied();
+                let page = tab.card_focus_at.filter(|p| tab.selected_pages.contains(p)).or(first_page);
+                let id = tab
+                    .cursor
+                    .filter(|c| tab.selected.contains(c))
+                    .or_else(|| ids.iter().copied().find(|id| tab.selected.contains(id)))
+                    .or(page.map(|(id, _)| id));
+                // Only what its card would offer a magnifier for (unlocked, readable, measured).
+                let shows = |id: u64| self.combine_draft.iter().any(|f| f.id == id && f.lock.is_none() && f.problem.is_none() && !f.sizes.is_empty());
+                if let Some(id) = id.filter(|id| shows(*id)) {
+                    // From the page card that has the keyboard (or the selected page), if it's one
+                    // of this file's.
+                    let at = self.combine_tab.card_focus_at.or(page).filter(|(file, _)| *file == id).map_or(0, |(_, nth)| nth);
+                    self.combine_tab.preview = Some(Preview { file: id, at, page: None, pages: None });
+                }
+            }
+            // (Page edits were done above.)
+            RowAction::ClickPage(..) | RowAction::MovePages { .. } | RowAction::RemovePages(_) => {}
+            RowAction::Drop { from, to } => {
+                let (Some(&dragged), Some(&target)) = (ids.get(from), ids.get(to)) else { return };
+                // Dragging a selected file takes the whole selection along.
+                let moving: BTreeSet<u64> = if tab.selected.contains(&dragged) { tab.selected.clone() } else { BTreeSet::from([dragged]) };
+                // Dropped on the selection itself: nothing to do.
+                if moving.contains(&target) {
+                    return;
+                }
+                // Below the row when dragged down, above it when dragged up.
+                self.combine_move_to_gap(moving, if from < to { to + 1 } else { to });
+            }
+            RowAction::DropAt { file, revision, gap } => {
+                // The list changed under the drag (e.g. undo): the gap no longer means the same.
+                if revision != tab.revision || !ids.contains(&file) {
+                    return;
+                }
+                let moving: BTreeSet<u64> = if tab.selected.contains(&file) { tab.selected.clone() } else { BTreeSet::from([file]) };
+                self.combine_move_to_gap(moving, gap);
+            }
+            RowAction::Unlock(row, at) => {
+                let locked: BTreeSet<u64> = self.combine_draft.iter().filter(|f| f.lock.is_some()).map(|f| f.id).collect();
+                let rows: Vec<u64> = match row.and_then(|i| ids.get(i).copied()) {
+                    // A selected row brings the rest of the selection.
+                    Some(id) if tab.selected.contains(&id) => {
+                        ids.iter().copied().filter(|x| tab.selected.contains(x) && locked.contains(x)).collect()
+                    }
+                    Some(id) => {
+                        tab.selected = BTreeSet::from([id]);
+                        (tab.anchor, tab.cursor) = (Some(id), Some(id));
+                        vec![id]
+                    }
+                    None => ids.iter().copied().filter(|x| tab.selected.contains(x) && locked.contains(x)).collect(),
+                };
+                self.combine_ask_password(rows, at);
+            }
+            RowAction::Sort(key) => {
+                let ascending = !matches!(tab.sort, Some((k, true)) if k == key);
+                self.combine_record();
+                self.combine_sort(key, ascending);
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/src/workflows/combine_ui/files.rs b/crates/ui-egui/src/workflows/combine_ui/files.rs
new file mode 100644
index 0000000000..fdfa41deac
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_ui/files.rs
@@ -0,0 +1,473 @@
+use super::*;
+
+/// A column of the list: what it shows and what it sorts by.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SortKey {
+    Name,
+    Pages,
+    Size,
+    Modified,
+    Warnings,
+}
+
+impl SortKey {
+    pub const ALL: [SortKey; 5] = [SortKey::Name, SortKey::Pages, SortKey::Size, SortKey::Modified, SortKey::Warnings];
+
+    pub(super) fn index(self) -> usize {
+        self as usize
+    }
+
+    pub(super) fn label(self) -> &'static str {
+        match self {
+            SortKey::Name => tl!("File name"),
+            SortKey::Pages => tl!("Pages"),
+            SortKey::Size => tl!("Size"),
+            SortKey::Modified => tl!("Modified"),
+            SortKey::Warnings => tl!("Warnings"),
+        }
+    }
+
+    /// The narrowest the column may be dragged.
+    pub(super) fn min_width(self) -> f32 {
+        match self {
+            SortKey::Name => 120.0,
+            SortKey::Pages => 110.0,
+            SortKey::Size => 60.0,
+            SortKey::Modified => 80.0,
+            SortKey::Warnings => 100.0,
+        }
+    }
+}
+
+/// The columns' order and widths, as the user arranged them (kept in the settings).
+#[derive(Clone, Debug, PartialEq)]
+pub struct Columns {
+    pub order: [SortKey; 5],
+    /// By [`SortKey::index`]; `None` until a column is resized: fitted to the window until then.
+    pub widths: Option<[f32; 5]>,
+}
+
+impl Default for Columns {
+    fn default() -> Self {
+        Columns { order: SortKey::ALL, widths: None }
+    }
+}
+
+impl Columns {
+    pub(crate) fn to_json(&self) -> serde_json::Value {
+        serde_json::json!({ "order": self.order, "widths": self.widths })
+    }
+
+    /// Settings written by [`Self::to_json`]; anything malformed gives the default layout.
+    pub(crate) fn from_json(v: &serde_json::Value) -> Self {
+        let order = serde_json::from_value::<Vec<SortKey>>(v["order"].clone())
+            .ok()
+            .filter(|o| SortKey::ALL.iter().all(|k| o.contains(k)))
+            .and_then(|o| <[SortKey; 5]>::try_from(o).ok())
+            .unwrap_or(SortKey::ALL);
+        let widths = serde_json::from_value::<[f32; 5]>(v["widths"].clone())
+            .ok()
+            .filter(|w| w.iter().all(|x| x.is_finite()))
+            .map(|w| std::array::from_fn(|i| w[i].clamp(SortKey::ALL[i].min_width(), 4000.0)));
+        Columns { order, widths }
+    }
+
+    /// The widths to show: the user's, or the window's width shared out.
+    pub(super) fn resolved(&self, available: f32) -> [f32; 5] {
+        if let Some(w) = self.widths {
+            return w;
+        }
+        let fixed = 170.0 + 84.0 + 110.0;
+        let flexible = (available - fixed).max(260.0);
+        [(flexible * 0.55).max(140.0), 170.0, 84.0, 110.0, (flexible * 0.45).max(120.0)]
+    }
+}
+
+/// How the files are shown: a thumbnail of each (the default, to see what goes where) or the
+/// table (kept in the settings).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum CombineView {
+    #[default]
+    Grid,
+    List,
+}
+
+impl CombineView {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            CombineView::Grid => "grid",
+            CombineView::List => "list",
+        }
+    }
+
+    pub fn parse(s: &str) -> Option<Self> {
+        match s {
+            "grid" => Some(CombineView::Grid),
+            "list" => Some(CombineView::List),
+            _ => None,
+        }
+    }
+}
+
+/// The pages a range takes, and the range and page count they were worked out for.
+pub(crate) type PagesTaken = ((String, usize), Arc<[usize]>);
+
+/// A file shown large: which, the place among the pages it adds, and those pages (worked out
+/// again only when its page range or page count changes).
+#[derive(Clone, Debug)]
+pub(crate) struct Preview {
+    pub(crate) file: u64,
+    pub(crate) at: usize,
+    /// The page (0-based, in the file) on screen, for the thumbnails to render.
+    pub(crate) page: Option<usize>,
+    pub(crate) pages: Option<PagesTaken>,
+}
+
+/// A password: kept in memory only, never printed (debug output ends up in logs).
+#[derive(Clone, Default)]
+pub struct Secret(pub(super) String);
+
+impl std::fmt::Debug for Secret {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(if self.0.is_empty() { "\"\"" } else { "…" })
+    }
+}
+
+/// Which password a protected file still needs before it can be combined.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Lock {
+    /// The password that opens it.
+    Open,
+    /// It opens, but only its permissions (owner) password allows copying its pages.
+    Permissions,
+}
+
+/// The combine list's field-name conflicts, computed once per list (it opens the files):
+/// for each file, the renames combining would make of its form fields. Keyed by the file ids
+/// and their lock state, so unlocking a file refreshes it.
+#[derive(Default, Debug)]
+pub struct ConflictPreview {
+    key: (Vec<u64>, Vec<bool>),
+    pub(super) per_file: Vec<Vec<(String, String)>>,
+}
+
+impl ConflictPreview {
+    /// Bring the preview in step with `files`, opening them through the engine when the list
+    /// changed. A file split into parts is combined as one file, once — each group's first
+    /// entry stands for it, as the combine does — and every part shows the file's preview.
+    /// A file that cannot be opened previews as nothing (its row says why).
+    pub(super) fn refresh(&mut self, session: &pdfcraft_engine::Session, files: &[CombineFile]) {
+        let key = (files.iter().map(|f| f.id).collect(), files.iter().map(|f| f.password.is_some()).collect());
+        if self.key == key && self.per_file.len() == files.len() {
+            return;
+        }
+        let mut groups: Vec<u64> = Vec::new();
+        let mut sources: Vec<pdfcraft_engine::CombineSource> = Vec::new();
+        let mut passwords: Vec<Option<&str>> = Vec::new();
+        for f in files {
+            if groups.contains(&f.group) {
+                continue;
+            }
+            groups.push(f.group);
+            sources.push((f.name.clone(), f.bytes.clone(), None));
+            passwords.push(f.password.as_ref().map(|p| p.0.as_str()));
+        }
+        let per_group = session.combine_field_conflicts(&sources, &passwords);
+        self.per_file =
+            files.iter().map(|f| groups.iter().position(|g| *g == f.group).and_then(|at| per_group.get(at)).cloned().unwrap_or_default()).collect();
+        self.key = key;
+    }
+}
+
+/// Unlock…'s password box: the rows it unlocks and what has been typed.
+#[derive(Clone, Debug)]
+pub(super) struct UnlockPrompt {
+    pub(super) rows: Vec<u64>,
+    pub(super) input: Secret,
+    pub(super) show: bool,
+    pub(super) error: Option<String>,
+    /// Where the box opens (below the link or button that asked for it).
+    pub(super) at: egui::Pos2,
+    pub(super) focused: bool,
+}
+
+/// What can be known about a file up front, opened with a password or not.
+#[derive(Clone)]
+pub(super) struct Assessed {
+    pub(super) pages: usize,
+    /// Each page's displayed size in points (empty when the inspector couldn't read it).
+    pub(super) sizes: Arc<[(f32, f32)]>,
+    pub(super) problem: Option<String>,
+    pub(super) lock: Option<Lock>,
+    pub(super) notes: Vec<String>,
+}
+
+pub(super) enum AssessError {
+    WrongPassword,
+    Unreadable(String),
+}
+
+/// Read `bytes` (with `password`, if given) for the list: pages, what stops it being combined
+/// and which password would help, and warnings.
+pub(super) fn assess(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<Assessed, AssessError> {
+    // The engine that combines decides whether the password works; the inspector (which may
+    // not accept every password the engine does, e.g. an RC4 owner password) adds the details.
+    let check = pdfcraft_engine::combine_source_check(bytes, password);
+    if check == Err(SourceProblem::WrongPassword) {
+        return Err(AssessError::WrongPassword);
+    }
+    let info = pdfcraft_render::inspect(bytes.clone(), password);
+    if let (Err(SourceProblem::Unreadable(e)), Err(_)) = (&check, &info) {
+        return Err(AssessError::Unreadable(e.clone()));
+    }
+    let info = info.ok();
+    let pages = match &info {
+        Some(i) => i.pages.len(),
+        None => pdfcraft_engine::source_page_count(bytes, password).unwrap_or(0),
+    };
+    let sizes: Arc<[(f32, f32)]> = match &info {
+        Some(i) => i.pages.iter().map(|p| (p.width, p.height)).collect(),
+        None => Arc::from(Vec::new()),
+    };
+    let encrypted = password.is_some() || info.as_ref().is_some_and(|i| i.encrypted);
+    let warnings = info.map(|i| i.warnings).unwrap_or_default();
+    let (problem, lock) = match check {
+        Ok(()) => (None, None),
+        Err(SourceProblem::Password) => (Some(tl!("Password-protected").to_string()), Some(Lock::Open)),
+        Err(SourceProblem::WrongPassword) => return Err(AssessError::WrongPassword),
+        Err(SourceProblem::NotPermitted) if password.is_some() => (
+            Some(tl!("Opened, but its security settings don't allow combining. Enter the permissions password.").to_string()),
+            Some(Lock::Permissions),
+        ),
+        Err(SourceProblem::NotPermitted) => (Some(tl!("Its security settings don't allow copying pages").to_string()), Some(Lock::Permissions)),
+        Err(SourceProblem::Unreadable(e)) => (Some(crate::i18n::fmt(tl!("Can't be read: {e}"), &[("e", &e)])), None),
+    };
+    let mut notes = Vec::new();
+    // The combined file is a new, unprotected document: protection doesn't carry over.
+    if encrypted && problem.is_none() {
+        notes.push(if password.is_some() {
+            tl!("Unlocked: the combined file won't be password-protected").to_string()
+        } else {
+            tl!("Protected: the combined file won't keep its security settings").to_string()
+        });
+    }
+    notes.extend(warnings.into_iter().take(5));
+    Ok(Assessed { pages, sizes, problem, lock, notes })
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct Snapshot {
+    pub(super) files: Vec<CombineFile>,
+    pub(super) selected: BTreeSet<u64>,
+    pub(super) sort: Option<(SortKey, bool)>,
+}
+
+/// A file arriving in the list (picked, dropped or already open).
+pub(crate) struct Incoming {
+    pub name: String,
+    pub bytes: Arc<Vec<u8>>,
+    pub modified: Option<SystemTime>,
+    /// Something to tell the user about where it came from.
+    pub note: Option<String>,
+    /// The open document it is, when it came from a tab.
+    pub open_doc: Option<pdfcraft_engine::DocId>,
+}
+
+/// A new value for [`CombineFile::auth`]: counted for the whole run, outside the undo history.
+fn next_auth() -> u64 {
+    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+    NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
+}
+
+/// A page range checked: the pages it takes and the first of them (0-based), or why it's wrong.
+type RangeCheck = Result<(usize, usize), String>;
+
+#[derive(Clone, Debug)]
+pub struct CombineFile {
+    /// Stable while the file is in the list (selection, undo).
+    pub id: u64,
+    /// The file it is (part of): the entries a file is split into (a page moved between another
+    /// file's pages) share it. Combined as one file, unlocked together, counted once.
+    pub(crate) group: u64,
+    pub name: String,
+    pub bytes: Arc<Vec<u8>>,
+    /// The file as it was added: `bytes` itself for a PDF, the image or text it was made from
+    /// otherwise (converted anew, with its own date, each time it is added).
+    pub(super) source: Arc<Vec<u8>>,
+    pub pages: usize,
+    /// Each page's displayed size in points; shared, so undo snapshots don't copy it.
+    pub(crate) sizes: Arc<[(f32, f32)]>,
+    /// How the file was read (with which password): a new value every time it is read, never
+    /// reused, not even after undo, so a thumbnail made another way is never taken for this one.
+    pub(crate) auth: u64,
+    /// The pages to take ("" = all).
+    pub range: String,
+    /// When the file was last modified (desktop picks and drops only).
+    pub modified: Option<SystemTime>,
+    /// Why the file can't be combined (password, security settings), if so.
+    pub problem: Option<String>,
+    /// The password that would let it be combined, while one is needed.
+    pub lock: Option<Lock>,
+    /// The password it was unlocked with.
+    pub(super) password: Option<Secret>,
+    /// Warnings that don't stop it being combined.
+    pub notes: Vec<String>,
+    /// Where it came from, shown among the warnings (e.g. an open document's unsaved changes).
+    pub(super) origin_note: Option<String>,
+    /// The open document it is, when it came from a tab: Add open documents leaves it out.
+    pub(super) open_doc: Option<pdfcraft_engine::DocId>,
+    /// The range last checked and the result: the number of pages it takes and the first of
+    /// them (0-based), or why it is wrong.
+    pub(super) checked: Option<(String, RangeCheck)>,
+}
+
+impl CombineFile {
+    pub(super) fn take(&mut self, a: Assessed, password: Option<Secret>) {
+        self.pages = a.pages;
+        self.sizes = a.sizes;
+        self.problem = a.problem;
+        self.lock = a.lock;
+        self.password = password;
+        self.auth = next_auth();
+        self.notes = self.origin_note.iter().cloned().chain(a.notes).collect();
+        self.checked = None;
+    }
+
+    /// Whether the file can't be read at all (damaged, or a type that can't be made into a PDF):
+    /// it stays in the list, with why, and Combine leaves it out once the user agrees. A
+    /// password-protected file can be unlocked instead, so it isn't one.
+    pub(crate) fn unreadable(&self) -> bool {
+        self.problem.is_some() && self.lock.is_none()
+    }
+
+    /// The password the file was unlocked with, if any.
+    pub(crate) fn password(&self) -> Option<&str> {
+        self.password.as_ref().map(|p| p.0.as_str())
+    }
+
+    /// The number of pages `range` takes, or why it can't be used. Checked again only when the
+    /// range changes.
+    pub fn selection(&mut self) -> Result<usize, String> {
+        self.checked_range().map(|(count, _)| count)
+    }
+
+    /// The first page (0-based) the range takes, in its order ("3, 1" starts with page 3): the
+    /// page the grid shows for the file.
+    pub fn first_page(&mut self) -> Result<usize, String> {
+        self.checked_range().map(|(_, first)| first)
+    }
+
+    /// The first page the range takes, without updating the cache (read-only callers).
+    pub(crate) fn first_taken(&self) -> Option<usize> {
+        match &self.checked {
+            Some((range, result)) if *range == self.range => result.as_ref().ok().map(|(_, first)| *first),
+            _ => self.pages_taken().ok()?.first().copied(),
+        }
+    }
+
+    /// Every page (0-based) the range takes, in its order: what the preview flips through.
+    pub(crate) fn pages_taken(&self) -> Result<Vec<usize>, String> {
+        if self.range.trim().is_empty() {
+            return Ok((0..self.pages).collect());
+        }
+        match pdfcraft_engine::print::select_pages(self.pages, Some(&self.range), &[], pdfcraft_engine::print::Subset::All, false) {
+            Ok(p) if p.is_empty() => Err(tl!("No pages selected").to_string()),
+            Ok(p) => Ok(p),
+            Err(e) => Err(e.to_string()),
+        }
+    }
+
+    fn checked_range(&mut self) -> RangeCheck {
+        if let Some((range, result)) = &self.checked
+            && *range == self.range
+        {
+            return result.clone();
+        }
+        let result = if self.range.trim().is_empty() {
+            // (A file whose pages couldn't be counted is left to the engine, as before; the grid
+            // checks the first page against the page count.)
+            Ok((self.pages, 0))
+        } else {
+            match pdfcraft_engine::print::select_pages(self.pages, Some(&self.range), &[], pdfcraft_engine::print::Subset::All, false) {
+                Ok(p) => match p.first() {
+                    Some(first) => Ok((p.len(), *first)),
+                    None => Err(tl!("No pages selected").to_string()),
+                },
+                Err(e) => Err(e.to_string()),
+            }
+        };
+        self.checked = Some((self.range.clone(), result.clone()));
+        result
+    }
+
+    /// 0 = can't be combined, 1 = has warnings, 2 = fine: the Warnings column's sort order.
+    pub(super) fn severity(&mut self) -> u8 {
+        if self.problem.is_some() || self.selection().is_err() {
+            0
+        } else if !self.notes.is_empty() {
+            1
+        } else {
+            2
+        }
+    }
+}
+
+#[derive(Clone)]
+pub(crate) enum RowAction {
+    /// A click on row `i` (Ctrl/⌘ toggles it, Shift selects up to it).
+    Click(usize, Modifiers),
+    SelectAll,
+    /// An arrow key: `by` files on (1 in the list, or along a grid row; a grid row's length for
+    /// Up/Down in the grid). With Shift the selection grows.
+    Step {
+        down: bool,
+        by: usize,
+        extend: bool,
+    },
+    MoveUp,
+    MoveDown,
+    Remove,
+    /// One file's card trash: that file only, whatever else is selected.
+    RemoveFile(u64),
+    /// One file's magnifier: show it large.
+    Preview(u64),
+    /// Space: show the file the keyboard is on (or the first selected) large.
+    PreviewSelected,
+    /// A page card's magnifier: show its file large, from that page (its place among the pages
+    /// the file adds).
+    PreviewAt(u64, usize),
+    /// Show one file as its pages in the grid (`true`), or as its card again.
+    Expand(u64, bool),
+    /// Every file that adds more than one page, as its pages (`true`), or all as cards again.
+    ExpandAll(bool),
+    /// A click on a page card: that page (by entry id and place among its pages) selected,
+    /// Ctrl/⌘ toggling it, Shift selecting up to it.
+    ClickPage(u64, usize, Modifiers),
+    /// A page card (and the rest of the selected pages, if it is selected) dropped before page
+    /// `gap` of the list (see [`moved_pages`]), if the list hasn't changed since the drag began.
+    MovePages {
+        page: (u64, usize),
+        revision: u64,
+        gap: usize,
+    },
+    /// One page's trash (`Some`), or the selected pages: out of the list.
+    RemovePages(Option<(u64, usize)>),
+    /// Row `from` (and the rest of the selection, if it is selected) dropped on row `to`.
+    Drop {
+        from: usize,
+        to: usize,
+    },
+    /// A grid card (and the rest of the selection, if it is selected) dropped at `gap`
+    /// (0 = before the first file, n = after the last), if the list hasn't changed since the
+    /// drag began.
+    DropAt {
+        file: u64,
+        revision: u64,
+        gap: usize,
+    },
+    Sort(SortKey),
+    /// Unlock… on row `i` (and the rest of the selection, if it is selected), or on the
+    /// selection (`None`); the password box opens at the position.
+    Unlock(Option<usize>, egui::Pos2),
+}
diff --git a/crates/ui-egui/src/workflows/combine_ui/parts.rs b/crates/ui-egui/src/workflows/combine_ui/parts.rs
new file mode 100644
index 0000000000..74c6683825
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_ui/parts.rs
@@ -0,0 +1,288 @@
+use super::*;
+
+/// The PDFs, images and text files in `dir` (and, if `recursive`, the folders inside it, not
+/// following links), in natural order, at most [`MAX_FOLDER_FILES`]; and whether there were more.
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) fn combinable_in(dir: &std::path::Path, recursive: bool) -> (Vec<std::path::PathBuf>, bool) {
+    let mut found = Vec::new();
+    let mut more = false;
+    let mut folders = vec![(dir.to_path_buf(), 0usize)];
+    'walk: while let Some((folder, depth)) = folders.pop() {
+        let Ok(entries) = std::fs::read_dir(&folder) else { continue };
+        for entry in entries.flatten() {
+            let Ok(kind) = entry.file_type() else { continue };
+            let path = entry.path();
+            if kind.is_dir() {
+                let hidden = entry.file_name().to_string_lossy().starts_with('.');
+                if recursive && !hidden && depth < MAX_FOLDER_DEPTH {
+                    folders.push((path, depth + 1));
+                }
+            } else if path.extension().is_some_and(|e| combinable(&e.to_string_lossy())) && path.is_file() {
+                if found.len() >= MAX_FOLDER_FILES {
+                    more = true;
+                    break 'walk;
+                }
+                found.push(path);
+            }
+        }
+    }
+    found.sort_by(|a, b| natural(&a.to_string_lossy(), &b.to_string_lossy()));
+    (found, more)
+}
+
+/// Whether a file with extension `ext` can join the list: a PDF, or an image or text file that
+/// becomes one.
+fn combinable(ext: &str) -> bool {
+    std::iter::once("pdf").chain(pdfcraft_engine::CONVERTIBLE).any(|c| ext.eq_ignore_ascii_case(c))
+}
+
+/// A file's bookmark in the combined PDF: its name without ".pdf", or without the extension of
+/// the image or text file it was made from.
+pub(super) fn title_of(name: &str) -> &str {
+    match name.rsplit_once('.') {
+        Some((stem, ext)) if !stem.is_empty() && combinable(ext) => stem,
+        _ => name,
+    }
+}
+
+/// File names in the order people expect: case-insensitive, with numbers by value
+/// ("scan2" before "scan10").
+pub(super) fn natural(a: &str, b: &str) -> Ordering {
+    let (mut a, mut b) = (a.chars().peekable(), b.chars().peekable());
+    loop {
+        match (a.peek().copied(), b.peek().copied()) {
+            (None, None) => return Ordering::Equal,
+            (None, Some(_)) => return Ordering::Less,
+            (Some(_), None) => return Ordering::Greater,
+            (Some(x), Some(y)) if x.is_ascii_digit() && y.is_ascii_digit() => {
+                let take = |it: &mut std::iter::Peekable<std::str::Chars>| {
+                    let mut digits = String::new();
+                    while let Some(c) = it.peek().copied().filter(char::is_ascii_digit) {
+                        digits.push(c);
+                        it.next();
+                    }
+                    digits.trim_start_matches('0').to_owned()
+                };
+                let (x, y) = (take(&mut a), take(&mut b));
+                // Without leading zeros, a longer run of digits is a larger number.
+                match x.len().cmp(&y.len()).then_with(|| x.cmp(&y)) {
+                    Ordering::Equal => {}
+                    other => return other,
+                }
+            }
+            (Some(x), Some(y)) => {
+                match x.to_lowercase().cmp(y.to_lowercase()) {
+                    Ordering::Equal => {}
+                    other => return other,
+                }
+                a.next();
+                b.next();
+            }
+        }
+    }
+}
+
+/// Where an arrow key goes from `at` among `n` files, `by` at a time (1 in the list; a grid
+/// row's length for Up/Down in the grid). It stays put on the first row going up and on the last
+/// row going down; a short last row is reached from the row above at its last file.
+pub(crate) fn step_to(at: usize, n: usize, by: usize, down: bool) -> usize {
+    let by = by.max(1);
+    let last = n.saturating_sub(1);
+    let at = at.min(last);
+    if down {
+        if at >= last / by * by { at } else { at.saturating_add(by).min(last) }
+    } else if at < by {
+        at
+    } else {
+        at - by
+    }
+}
+
+/// The order after moving the files `moving` (keeping their order) to `gap` in `ids` as it is
+/// (0 = before the first, `ids.len()` = after the last); `None` when nothing would change.
+pub(crate) fn moved_order(ids: &[u64], moving: &BTreeSet<u64>, gap: usize) -> Option<Vec<u64>> {
+    let gap = gap.min(ids.len());
+    // The gap counted among the files that stay.
+    let before = ids.get(..gap).map_or(0, |s| s.iter().filter(|id| moving.contains(id)).count());
+    let (taken, mut rest): (Vec<u64>, Vec<u64>) = ids.iter().partition(|id| moving.contains(id));
+    if taken.is_empty() {
+        return None;
+    }
+    let at = gap.saturating_sub(before).min(rest.len());
+    rest.splice(at..at, taken);
+    (rest != ids).then_some(rest)
+}
+
+/// A page range (1-based: "1-3, 6, 9-7") that takes exactly `pages` (0-based, in that order)
+/// from a file of `count` pages; empty (every page) when that is all of them in order.
+pub(crate) fn range_of(pages: &[usize], count: usize) -> String {
+    if pages.len() == count && pages.iter().enumerate().all(|(i, p)| i == *p) {
+        return String::new();
+    }
+    let mut parts: Vec<String> = Vec::new();
+    let mut i = 0;
+    while let Some(&start) = pages.get(i) {
+        // The longest run going up (or down) one page at a time from here.
+        let step = |a: usize, b: usize| {
+            if b == a.wrapping_add(1) {
+                1
+            } else if a == b.wrapping_add(1) {
+                -1
+            } else {
+                0
+            }
+        };
+        let dir = pages.get(i + 1).map_or(0, |&next| step(start, next));
+        let mut end = i;
+        while dir != 0 && pages.get(end + 1).is_some_and(|&next| pages.get(end).is_some_and(|&cur| step(cur, next) == dir)) {
+            end += 1;
+        }
+        let last = pages.get(end).copied().unwrap_or(start);
+        parts.push(if end == i { format!("{}", start.saturating_add(1)) } else { format!("{}-{}", start.saturating_add(1), last.saturating_add(1)) });
+        i = end + 1;
+    }
+    parts.join(", ")
+}
+
+/// One list entry, for moving and removing single pages: its file (`group`: the parts of one
+/// file split around share it) and the pages it takes, in order; `None` when they can't be
+/// listed (a locked file, a bad range): such an entry only ever moves whole.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct Part {
+    pub(crate) id: u64,
+    pub(crate) group: u64,
+    pub(crate) pages: Option<Vec<usize>>,
+}
+
+/// One page in the list's order, or an entry that moves whole.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum Item {
+    Page { group: u64, from: u64, nth: usize, page: usize },
+    Whole(u64),
+}
+
+/// Every page in the list's order (and the entries that can't be split, whole).
+pub(super) fn items_of(parts: &[Part]) -> Vec<Item> {
+    let mut items = Vec::new();
+    for p in parts {
+        match &p.pages {
+            Some(pages) => items.extend(pages.iter().enumerate().map(|(nth, &page)| Item::Page { group: p.group, from: p.id, nth, page })),
+            None => items.push(Item::Whole(p.id)),
+        }
+    }
+    items
+}
+
+/// Entries again from `items`: a file's pages side by side are one entry (its first unused id
+/// among them, else a new one from `new_id`); entries that move whole keep theirs.
+pub(super) fn parts_of(items: &[Item], parts: &[Part], new_id: &mut dyn FnMut() -> u64) -> Vec<Part> {
+    let mut out: Vec<Part> = Vec::new();
+    let mut used: BTreeSet<u64> = BTreeSet::new();
+    let mut run: Vec<Item> = Vec::new();
+    let mut close = |run: &mut Vec<Item>, out: &mut Vec<Part>, used: &mut BTreeSet<u64>| {
+        let Some(Item::Page { group, .. }) = run.first().copied() else { return };
+        let id = run.iter().find_map(|i| match i {
+            Item::Page { from, .. } if !used.contains(from) => Some(*from),
+            _ => None,
+        });
+        let id = id.unwrap_or_else(&mut *new_id);
+        used.insert(id);
+        let pages = run.iter().filter_map(|i| if let Item::Page { page, .. } = i { Some(*page) } else { None }).collect();
+        out.push(Part { id, group, pages: Some(pages) });
+        run.clear();
+    };
+    for item in items {
+        match item {
+            Item::Whole(id) => {
+                close(&mut run, &mut out, &mut used);
+                if let Some(p) = parts.iter().find(|p| p.id == *id) {
+                    used.insert(*id);
+                    out.push(p.clone());
+                }
+            }
+            Item::Page { group, .. } => {
+                if run.first().is_some_and(|f| !matches!(f, Item::Page { group: g, .. } if g == group)) {
+                    close(&mut run, &mut out, &mut used);
+                }
+                run.push(*item);
+            }
+        }
+    }
+    close(&mut run, &mut out, &mut used);
+    out
+}
+
+/// The entries after moving the pages `moving` (by entry id and place among its pages), in
+/// their order, to before page `gap` of the list (counted over every page, an entry that can't be
+/// split counting as one; 0 = before the first): a page moved between another file's pages
+/// splits its file into parts, and parts of one file brought side by side join. `None` when
+/// nothing would change.
+pub(crate) fn moved_pages(parts: &[Part], moving: &BTreeSet<(u64, usize)>, gap: usize, new_id: &mut dyn FnMut() -> u64) -> Option<Vec<Part>> {
+    let items = items_of(parts);
+    let gap = gap.min(items.len());
+    let picked = |i: &Item| matches!(i, Item::Page { from, nth, .. } if moving.contains(&(*from, *nth)));
+    let before = items.get(..gap).map_or(0, |s| s.iter().filter(|i| picked(i)).count());
+    let (taken, mut rest): (Vec<Item>, Vec<Item>) = items.iter().partition(|i| picked(i));
+    if taken.is_empty() {
+        return None;
+    }
+    let at = gap.saturating_sub(before).min(rest.len());
+    rest.splice(at..at, taken);
+    let out = parts_of(&rest, parts, new_id);
+    (out != parts).then_some(out)
+}
+
+/// The entries after taking out the pages `removing` (by entry id and place among its pages);
+/// an entry left with none goes, and parts of one file left side by side join. `None` when
+/// nothing would change.
+pub(crate) fn removed_pages(parts: &[Part], removing: &BTreeSet<(u64, usize)>, new_id: &mut dyn FnMut() -> u64) -> Option<Vec<Part>> {
+    let items: Vec<Item> =
+        items_of(parts).into_iter().filter(|i| !matches!(i, Item::Page { from, nth, .. } if removing.contains(&(*from, *nth)))).collect();
+    let out = parts_of(&items, parts, new_id);
+    (out != parts).then_some(out)
+}
+
+/// How long ago `time` was ("5 min ago"); a date after a week. Relative times need no time zone.
+pub(crate) fn ago(time: SystemTime) -> String {
+    let secs = SystemTime::now().duration_since(time).map(|d| d.as_secs()).unwrap_or(0);
+    let (mins, hours, days) = (secs / 60, secs / 3600, secs / 86_400);
+    match () {
+        _ if mins == 0 => tl!("just now").to_string(),
+        _ if hours == 0 => crate::i18n::fmt(tl!("{n} min ago"), &[("n", &mins.to_string())]),
+        _ if days == 0 => crate::i18n::fmt(tl!("{n} h ago"), &[("n", &hours.to_string())]),
+        _ if days == 1 => tl!("yesterday").to_string(),
+        _ if days < 7 => crate::i18n::fmt(tl!("{n} days ago"), &[("n", &days.to_string())]),
+        _ => utc_stamp(time).get(..10).unwrap_or_default().to_string(),
+    }
+}
+
+/// `time` as "2026-10-08 14:05 UTC". A clock before 1970 reads as the epoch; past chrono's year
+/// 262143 range the proleptic Gregorian date is kept via the 400-year cycle, not the epoch.
+pub(super) fn utc_stamp(time: SystemTime) -> String {
+    let secs = time.duration_since(SystemTime::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
+    let (days, rem) = (secs / 86_400, secs % 86_400);
+    let (y, m, d) = civil_from_days(days);
+    // `{y:04}` rather than `%Y`, which writes a `+` before years past 9999.
+    format!("{y:04}-{m:02}-{d:02} {:02}:{:02} UTC", rem / 3600, rem % 3600 / 60)
+}
+
+/// Days since 1970-01-01 → proleptic Gregorian (year, month, day).
+///
+/// A pre-1970 time already clamps to the epoch (`unwrap_or(0)`), so `days` is an unsigned count
+/// that can run past `NaiveDate`'s ±262143-year range, where the old hand-rolled converter still
+/// produced a date. The Gregorian calendar repeats every 400 years (146_097 days), so chrono
+/// converts the day within one cycle and whole cycles go back into the year (an `i128`, then
+/// saturated into `i64`), keeping chrono as the only calendar logic and reproducing the old
+/// result exactly. 1970-01-01 is `num_days_from_ce` 719_163.
+fn civil_from_days(days: u64) -> (i64, u32, u32) {
+    use chrono::Datelike;
+    let (cycles, rest) = (days / 146_097, days % 146_097);
+    // `rest + 719_163` is 719_163..865_259, always a valid CE day.
+    match i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt) {
+        Some(d) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.month(), d.day())
+        }
+        None => (1970, 1, 1), // unreachable
+    }
+}
diff --git a/crates/ui-egui/src/workflows/combine_ui/session.rs b/crates/ui-egui/src/workflows/combine_ui/session.rs
new file mode 100644
index 0000000000..c18b64e0eb
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_ui/session.rs
@@ -0,0 +1,449 @@
+use super::files::{AssessError, Assessed, CombineFile, Incoming, Secret, Snapshot, SortKey, UnlockPrompt, assess};
+#[cfg(not(target_arch = "wasm32"))]
+use super::parts::combinable_in;
+use super::parts::{Part, items_of, moved_order, natural, parts_of, range_of, title_of};
+use super::*;
+
+impl PdfCraftApp {
+    /// Show the Combine files tab (File ▸ Combine files…), opening it if needed.
+    pub fn open_combine_tab(&mut self) {
+        self.combine_tab.open = true;
+        self.combine_tab.focused = true;
+        self.active = None;
+    }
+
+    /// Whether the Combine files tab is the one showing.
+    pub fn combine_showing(&self) -> bool {
+        self.active.is_none() && self.combine_tab.open && self.combine_tab.focused
+    }
+
+    /// The selected rows, top to bottom (tests and automation).
+    pub fn combine_selection(&self) -> Vec<usize> {
+        self.combine_draft.iter().enumerate().filter(|(_, f)| self.combine_tab.selected.contains(&f.id)).map(|(i, _)| i).collect()
+    }
+
+    /// Select these rows (tests and automation).
+    pub fn select_combine_rows(&mut self, rows: &[usize]) {
+        // Files picked: no page stays picked (the trash and Delete act on these files).
+        self.combine_tab.selected_pages.clear();
+        self.combine_tab.page_anchor = None;
+        self.combine_tab.selected = rows.iter().filter_map(|i| self.combine_draft.get(*i)).map(|f| f.id).collect();
+        let last = rows.last().and_then(|i| self.combine_draft.get(*i)).map(|f| f.id);
+        (self.combine_tab.anchor, self.combine_tab.cursor) = (last, last);
+    }
+
+    pub(super) fn combine_snapshot(&self) -> Snapshot {
+        Snapshot { files: self.combine_draft.clone(), selected: self.combine_tab.selected.clone(), sort: self.combine_tab.sort }
+    }
+
+    fn combine_restore(&mut self, s: Snapshot) {
+        self.combine_draft = s.files;
+        self.combine_tab.selected = s.selected;
+        self.combine_tab.selected_pages.clear();
+        self.combine_tab.page_anchor = None;
+        self.combine_tab.sort = s.sort;
+        self.combine_tab.range_edit = None;
+        self.combine_tab.revision = self.combine_tab.revision.wrapping_add(1);
+        // A Pages field with the keyboard would otherwise keep typing into the restored list
+        // without an undo step.
+        if let Some(ctx) = &self.ctx {
+            ctx.memory_mut(|m| m.stop_text_input());
+        }
+    }
+
+    pub(super) fn combine_push_undo(&mut self, before: Snapshot) {
+        self.combine_tab.revision = self.combine_tab.revision.wrapping_add(1);
+        let undo = &mut self.combine_tab.undo;
+        undo.push(before);
+        if undo.len() > HISTORY {
+            undo.remove(0);
+        }
+        self.combine_tab.redo.clear();
+    }
+
+    /// Remember the list before a change, for Undo.
+    pub(super) fn combine_record(&mut self) {
+        let now = self.combine_snapshot();
+        self.combine_push_undo(now);
+        self.combine_tab.range_edit = None;
+    }
+
+    pub(crate) fn combine_can_undo(&self, undo: bool) -> bool {
+        if undo { !self.combine_tab.undo.is_empty() } else { !self.combine_tab.redo.is_empty() }
+    }
+
+    /// Edit ▸ Undo / Redo (⌘Z, ⇧⌘Z) while the Combine files tab shows.
+    pub(crate) fn combine_history_step(&mut self, undo: bool) {
+        // ⌘Z in the password box is not about the list.
+        if self.combine_tab.unlock.is_some() {
+            return;
+        }
+        let (from, to) =
+            if undo { (&mut self.combine_tab.undo, &mut self.combine_tab.redo) } else { (&mut self.combine_tab.redo, &mut self.combine_tab.undo) };
+        let Some(state) = from.pop() else { return };
+        let now = Snapshot { files: self.combine_draft.clone(), selected: self.combine_tab.selected.clone(), sort: self.combine_tab.sort };
+        to.push(now);
+        self.combine_restore(state);
+    }
+
+    pub(super) fn combine_sort(&mut self, key: SortKey, ascending: bool) {
+        let list = &mut self.combine_draft;
+        let mut keyed: Vec<(u8, CombineFile)> = list.drain(..).map(|mut f| (f.severity(), f)).collect();
+        keyed.sort_by(|(sa, a), (sb, b)| {
+            let order = match key {
+                SortKey::Name => natural(&a.name, &b.name),
+                SortKey::Pages => a.pages.cmp(&b.pages),
+                SortKey::Size => a.bytes.len().cmp(&b.bytes.len()),
+                SortKey::Modified => match (a.modified, b.modified) {
+                    (Some(x), Some(y)) => x.cmp(&y),
+                    // Unknown times last, whichever the direction.
+                    (x, y) => return x.is_none().cmp(&y.is_none()).then_with(|| natural(&a.name, &b.name)),
+                },
+                SortKey::Warnings => sa.cmp(sb),
+            };
+            let order = if ascending { order } else { order.reverse() };
+            order.then_with(|| natural(&a.name, &b.name))
+        });
+        *list = keyed.into_iter().map(|(_, f)| f).collect();
+        self.combine_tab.sort = Some((key, ascending));
+    }
+
+    /// The list as parts, for page edits: each entry's pages, or `None` for one that can't be
+    /// split (locked, unreadable, a bad range).
+    pub(super) fn combine_parts(&self) -> Vec<Part> {
+        self.combine_draft
+            .iter()
+            .map(|f| Part {
+                id: f.id,
+                group: f.group,
+                // (No page listed, e.g. its pages couldn't be counted: it moves whole, never lost.)
+                pages: (f.lock.is_none() && f.problem.is_none()).then(|| f.pages_taken().ok()).flatten().filter(|p| !p.is_empty()),
+            })
+            .collect()
+    }
+
+    /// Make the list `parts`, as one undo step: entries kept by id, new parts made from their
+    /// file's other entries, each taking exactly its pages (its range rewritten). The parts of a
+    /// file shown as its pages stay shown so; the page selection is let go of.
+    pub(super) fn combine_set_parts(&mut self, parts: Vec<Part>) {
+        self.combine_record();
+        self.combine_put_parts(parts);
+        let tab = &mut self.combine_tab;
+        tab.selected_pages.clear();
+        tab.page_anchor = None;
+        // An order made by hand isn't sorted any more.
+        tab.sort = None;
+    }
+
+    /// Join the parts of a file that have come to be side by side (no undo step of its own: it
+    /// belongs to the change that brought them together).
+    pub(super) fn combine_join_parts(&mut self) {
+        let parts = self.combine_parts();
+        // Nothing to join unless some file is in more than one part.
+        let groups: BTreeSet<u64> = parts.iter().map(|p| p.group).collect();
+        if groups.len() == parts.len() {
+            return;
+        }
+        let next = &mut self.combine_tab.next_id;
+        let mut new_id = || {
+            let id = *next;
+            *next = next.wrapping_add(1);
+            id
+        };
+        let joined = parts_of(&items_of(&parts), &parts, &mut new_id);
+        if joined != parts {
+            self.combine_put_parts(joined);
+        }
+    }
+
+    /// Make the list `parts`: entries kept by id, new parts made from their file's other entries,
+    /// each taking exactly its pages (its range rewritten only when they differ).
+    fn combine_put_parts(&mut self, parts: Vec<Part>) {
+        let old = std::mem::take(&mut self.combine_draft);
+        let expanded: BTreeSet<u64> = old.iter().filter(|f| self.combine_tab.expanded.contains(&f.id)).map(|f| f.group).collect();
+        for p in parts {
+            let Some(base) = old.iter().find(|f| f.id == p.id).or_else(|| old.iter().find(|f| f.group == p.group)) else { continue };
+            let mut f = base.clone();
+            f.id = p.id;
+            // (A range that already takes these pages stays as the user typed it.)
+            if let Some(pages) = &p.pages
+                && f.pages_taken().ok().as_ref() != Some(pages)
+            {
+                f.range = range_of(pages, f.pages);
+                f.checked = None;
+            }
+            if expanded.contains(&f.group) {
+                self.combine_tab.expanded.insert(f.id);
+            }
+            self.combine_draft.push(f);
+        }
+        let ids: BTreeSet<u64> = self.combine_draft.iter().map(|f| f.id).collect();
+        self.combine_tab.selected.retain(|id| ids.contains(id));
+    }
+
+    /// A page card clicked: that page selected (Ctrl/⌘ toggles it, Shift selects every page from
+    /// the last one clicked, in the list's order); the files' selection is let go of.
+    pub(super) fn combine_click_page(&mut self, id: u64, nth: usize, m: Modifiers) {
+        let page = (id, nth);
+        let tab = &mut self.combine_tab;
+        tab.selected.clear();
+        tab.cursor = Some(id);
+        if m.shift
+            && let Some(from) = tab.page_anchor
+        {
+            // Every page between the two, as the grid shows them.
+            let order: Vec<(u64, usize)> = self
+                .combine_draft
+                .iter()
+                .filter(|f| tab.expanded.contains(&f.id))
+                .flat_map(|f| (0..f.pages_taken().map_or(0, |p| p.len())).map(move |n| (f.id, n)))
+                .collect();
+            let (a, b) = (order.iter().position(|p| *p == from), order.iter().position(|p| *p == page));
+            if let (Some(a), Some(b)) = (a, b) {
+                if !m.command {
+                    tab.selected_pages.clear();
+                }
+                tab.selected_pages.extend(order.get(a.min(b)..=a.max(b)).unwrap_or_default().iter().copied());
+                return;
+            }
+        }
+        if m.command {
+            if !tab.selected_pages.remove(&page) {
+                tab.selected_pages.insert(page);
+            }
+        } else {
+            tab.selected_pages = BTreeSet::from([page]);
+        }
+        tab.page_anchor = Some(page);
+    }
+
+    /// Move `moving` to `gap`, as one undo step; a move that changes nothing leaves the list,
+    /// its sort and the history alone.
+    pub(super) fn combine_move_to_gap(&mut self, moving: BTreeSet<u64>, gap: usize) {
+        let ids: Vec<u64> = self.combine_draft.iter().map(|f| f.id).collect();
+        let Some(order) = moved_order(&ids, &moving, gap) else { return };
+        self.combine_record();
+        let rank: std::collections::HashMap<u64, usize> = order.iter().enumerate().map(|(i, id)| (*id, i)).collect();
+        self.combine_draft.sort_by_key(|f| rank.get(&f.id).copied().unwrap_or(usize::MAX));
+        self.combine_tab.selected = moving.into_iter().filter(|id| rank.contains_key(id)).collect();
+        self.combine_tab.sort = None;
+    }
+
+    /// Close the Combine files tab and forget its list; the last document shows, if any.
+    pub fn close_combine_tab(&mut self) {
+        let showing = self.combine_showing();
+        // (Revisions keep counting: a drag begun before can never match a list made after.)
+        let revision = self.combine_tab.revision.wrapping_add(1);
+        self.combine_tab = CombineTab { revision, ..CombineTab::default() };
+        self.combine_draft.clear();
+        self.combine_thumbs.clear();
+        if showing {
+            self.active = self.views.len().checked_sub(1);
+        }
+    }
+
+    /// Add picked files to the Combine files list (and show it).
+    pub(crate) fn stage_combine(&mut self, files: Vec<(String, Vec<u8>)>) {
+        let incoming =
+            files.into_iter().map(|(name, bytes)| Incoming { name, bytes: Arc::new(bytes), modified: None, note: None, open_doc: None }).collect();
+        self.stage_combine_with(incoming);
+    }
+
+    /// Add files to the Combine files list, with what can be known about them up front.
+    pub(crate) fn stage_combine_with(&mut self, files: Vec<Incoming>) {
+        let mut added = Vec::new();
+        for Incoming { name, bytes, modified, note, open_doc } in files {
+            // Images and text files become PDFs as they join the list (#569): from then on they
+            // are ordinary files, with pages, thumbnails and page ranges.
+            // A file that can't be read joins the list all the same, with why (the Warnings
+            // column, its card); Combine asks before leaving it out.
+            let unreadable = |e: &str| Assessed {
+                pages: 0,
+                sizes: Arc::from(Vec::new()),
+                problem: Some(crate::i18n::fmt(tl!("Can't be read: {e}"), &[("e", e)])),
+                lock: None,
+                notes: Vec::new(),
+            };
+            let source = bytes.clone();
+            let (bytes, assessed) = match self.session.as_pdf(&name, &bytes) {
+                Ok(pdf) => {
+                    let assessed = assess(&pdf, None);
+                    (pdf, assessed)
+                }
+                Err(e) => {
+                    // (The engine's message names the file, which the row already shows.)
+                    let e = match e {
+                        pdfcraft_engine::EditError::Source(m) => m,
+                        other => other.to_string(),
+                    };
+                    let why = e.strip_prefix(&format!("{name}: ")).unwrap_or(&e).to_string();
+                    (bytes, Ok(unreadable(&why)))
+                }
+            };
+            let assessed = match assessed {
+                Ok(a) => a,
+                Err(AssessError::Unreadable(e)) => unreadable(&e),
+                Err(AssessError::WrongPassword) => {
+                    self.notify_fmt("Couldn't add {name}: {e}", &[("name", &name), ("e", "the password is wrong")]);
+                    continue;
+                }
+            };
+            let mut f = CombineFile {
+                id: 0,
+                group: 0,
+                name,
+                bytes,
+                source,
+                pages: 0,
+                range: String::new(),
+                modified,
+                problem: None,
+                lock: None,
+                password: None,
+                sizes: Arc::from(Vec::new()),
+                auth: 0,
+                notes: Vec::new(),
+                origin_note: note,
+                open_doc,
+                checked: None,
+            };
+            f.take(assessed, None);
+            added.push(f);
+        }
+        if !added.is_empty() {
+            self.combine_record();
+            for mut f in added {
+                f.id = self.combine_tab.next_id;
+                f.group = f.id;
+                self.combine_tab.next_id = self.combine_tab.next_id.wrapping_add(1);
+                self.combine_draft.push(f);
+            }
+            // A sorted list stays sorted; new files simply join the end otherwise.
+            if let Some((key, ascending)) = self.combine_tab.sort {
+                self.combine_sort(key, ascending);
+            }
+        }
+        self.open_combine_tab();
+    }
+
+    /// Open Unlock…'s password box for `rows`, at `at`.
+    pub(super) fn combine_ask_password(&mut self, rows: Vec<u64>, at: egui::Pos2) {
+        if rows.is_empty() {
+            return;
+        }
+        self.combine_tab.unlock = Some(UnlockPrompt { rows, input: Secret::default(), show: false, error: None, at, focused: false });
+    }
+
+    /// Try `password` on the protected files `rows` (as one undo step). Returns false when it
+    /// opened none of them.
+    pub fn combine_unlock(&mut self, rows: &[u64], password: &str) -> bool {
+        // A file split into parts is unlocked as one: each file once, all its parts alike.
+        let groups: BTreeSet<u64> =
+            rows.iter().filter_map(|id| self.combine_draft.iter().find(|f| f.id == *id && f.lock.is_some())).map(|f| f.group).collect();
+        let mut accepted = Vec::new();
+        for group in &groups {
+            let Some(f) = self.combine_draft.iter().find(|f| f.group == *group) else { continue };
+            if let Ok(a) = assess(&f.bytes, Some(password)) {
+                accepted.push((*group, a));
+            }
+        }
+        if accepted.is_empty() {
+            return false;
+        }
+        self.combine_record();
+        let tried = groups.len();
+        let mut unlocked = 0;
+        for (group, a) in accepted {
+            let mut auth = None;
+            for f in self.combine_draft.iter_mut().filter(|f| f.group == group) {
+                f.take(a.clone(), Some(Secret(password.to_owned())));
+                // Read once: one way of reading for all its parts (their thumbnails are shared).
+                f.auth = *auth.get_or_insert(f.auth);
+            }
+            unlocked += usize::from(self.combine_draft.iter().any(|f| f.group == group && f.lock.is_none()));
+        }
+        if tried > 1 {
+            self.notify_fmt("Unlocked {n} of {m} files", &[("n", &unlocked.to_string()), ("m", &tried.to_string())]);
+        }
+        true
+    }
+
+    /// Unlock… for the files the user named in tests and automation (by row).
+    pub fn combine_unlock_rows(&mut self, rows: &[usize], password: &str) -> bool {
+        let ids: Vec<u64> = rows.iter().filter_map(|i| self.combine_draft.get(*i)).map(|f| f.id).collect();
+        self.combine_unlock(&ids, password)
+    }
+
+    /// Add every PDF, image and text file in a folder the user picks (and its subfolders, if
+    /// `recursive`).
+    pub fn combine_add_folder(&mut self, recursive: bool) {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let title = if recursive { tl!("Add folder and subfolders") } else { tl!("Add folder") };
+            let dialog = rfd::AsyncFileDialog::new().set_title(title);
+            self.ask_one(crate::pickers::Ask::Folder(dialog), None, move |app, dir| app.add_folder_to_combine(&dir, recursive));
+        }
+        #[cfg(target_arch = "wasm32")]
+        let _ = recursive;
+    }
+
+    /// Add the PDFs, images and text files in `dir` to the Combine files list, as one undo step.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn add_folder_to_combine(&mut self, dir: &std::path::Path, recursive: bool) {
+        let (paths, more) = combinable_in(dir, recursive);
+        let folder = dir.file_name().map_or_else(|| dir.to_string_lossy().into_owned(), |n| n.to_string_lossy().into_owned());
+        if paths.is_empty() {
+            self.notify_fmt("No PDFs, images or text files found in {folder}", &[("folder", &folder)]);
+            self.open_combine_tab();
+            return;
+        }
+        self.use_paths(crate::files::FilePurpose::Combine, &paths);
+        if more {
+            self.notify_fmt("Added the first {n} files in {folder}", &[("n", &MAX_FOLDER_FILES.to_string()), ("folder", &folder)]);
+        }
+    }
+
+    /// Add documents open in tabs (by tab index), as they are now; those already in the list
+    /// stay out (#1356). The same document, not the same name: two files called alike are two.
+    pub(crate) fn add_open_documents(&mut self, tabs: &[usize]) {
+        let mut incoming = Vec::new();
+        for &i in tabs {
+            let Some(doc) = self.views.get(i).and_then(|v| self.session.get(v.id)) else { continue };
+            if self.combine_draft.iter().any(|f| f.open_doc == Some(doc.id)) {
+                continue;
+            }
+            #[cfg(not(target_arch = "wasm32"))]
+            let modified = if doc.dirty { None } else { doc.path.as_ref().and_then(|p| std::fs::metadata(p).and_then(|m| m.modified()).ok()) };
+            #[cfg(target_arch = "wasm32")]
+            let modified = None;
+            let note = doc.dirty.then(|| tl!("Includes unsaved changes").to_string());
+            let name = if doc.name.to_ascii_lowercase().ends_with(".pdf") { doc.name.clone() } else { format!("{}.pdf", doc.name) };
+            incoming.push(Incoming { name, bytes: doc.bytes.clone(), modified, note, open_doc: Some(doc.id) });
+        }
+        self.stage_combine_with(incoming);
+    }
+
+    /// Combine the listed files into a new, unsaved document; the tab makes way for it.
+    /// Files that can't be read are left out (the user was asked).
+    pub fn combine_staged(&mut self) {
+        let files: Vec<&CombineFile> = self.combine_draft.iter().filter(|f| !f.unreadable()).collect();
+        if files.is_empty() {
+            return;
+        }
+        // Each file once, however many parts it is in.
+        let count = files.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len();
+        let groups: Vec<u64> = files.iter().map(|f| f.group).collect();
+        let sources: Vec<(String, Arc<Vec<u8>>, Option<String>)> =
+            files.iter().map(|f| (title_of(&f.name).to_string(), f.bytes.clone(), Some(f.range.clone()).filter(|r| !r.trim().is_empty()))).collect();
+        let passwords: Vec<Option<&str>> = files.iter().map(|f| f.password.as_ref().map(|p| p.0.as_str())).collect();
+        match self.session.combine_grouped(&sources, &groups, &passwords) {
+            Ok(bytes) => {
+                self.close_combine_tab();
+                let message = crate::i18n::fmt(tl!("Combined {n} files"), &[("n", &count.to_string())]);
+                self.open_created("Combined.pdf", bytes, &message)
+            }
+            // The list stays, so the user can fix it.
+            Err(e) => self.notify_fmt("Couldn't combine files: {e}", &[("e", &e.to_string())]),
+        }
+    }
+}
diff --git a/crates/ui-egui/src/workflows/combine_ui/table.rs b/crates/ui-egui/src/workflows/combine_ui/table.rs
new file mode 100644
index 0000000000..3a95e87068
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_ui/table.rs
@@ -0,0 +1,363 @@
+use super::files::{Columns, Lock, RowAction, SortKey};
+use super::parts::{ago, utc_stamp};
+use super::*;
+
+/// A column heading being dragged to a new place.
+#[derive(Clone, Copy)]
+struct HeadingDrag(SortKey);
+
+enum HeadingEvent {
+    Sort(SortKey),
+    /// Put column `kind` before (or after) column `to`.
+    Move {
+        kind: SortKey,
+        to: SortKey,
+        after: bool,
+    },
+    Reset,
+}
+
+/// What the table reports besides row actions.
+#[derive(Default)]
+pub(super) struct TableEvents {
+    pub(super) action: Option<RowAction>,
+    pub(super) range_focused: bool,
+    pub(super) range_changed: bool,
+}
+
+/// The file table.
+pub(super) fn table(
+    app: &mut PdfCraftApp,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    checks: &[Result<usize, String>],
+    selected: &[bool],
+    conflicts: &[Vec<(String, String)>],
+    twice: &[bool],
+) -> TableEvents {
+    let mut events = TableEvents::default();
+    let dragging = egui::DragAndDrop::has_payload_of_type::<usize>(ui.ctx());
+    // Until the user resizes a column, the widths follow the window.
+    let gap = ui.spacing().item_spacing.x;
+    let available = ui.available_width() - 18.0 - gap * 6.0;
+    if app.combine_columns.widths.is_none() && (available - app.combine_tab.fitted).abs() > 1.0 {
+        app.combine_tab.fitted = available;
+        app.combine_tab.layout = app.combine_tab.layout.wrapping_add(1);
+    }
+    let widths = app.combine_columns.resolved(available);
+    let rows = Rows { checks, selected, twice, conflicts, dragging, sort: app.combine_tab.sort };
+    let mut heading_event = None;
+    let mut shown = None;
+    egui::ScrollArea::horizontal()
+        .id_salt("combine-files-h")
+        .show(ui, |ui| table_body(app, ui, t, &rows, widths, &mut events, &mut heading_event, &mut shown));
+    // A column resized by hand keeps its width from now on.
+    if let Some(shown) = shown
+        && shown.iter().zip(&widths).any(|(a, b)| (a - b).abs() > 0.5)
+    {
+        app.combine_columns.widths = Some(shown);
+    }
+    match heading_event {
+        Some(HeadingEvent::Sort(key)) => events.action = Some(RowAction::Sort(key)),
+        Some(HeadingEvent::Move { kind, to, after }) => {
+            let mut order: Vec<SortKey> = app.combine_columns.order.iter().copied().filter(|k| *k != kind).collect();
+            let at = order.iter().position(|k| *k == to).map_or(order.len(), |p| if after { p + 1 } else { p });
+            order.insert(at, kind);
+            if let Ok(order) = <[SortKey; 5]>::try_from(order) {
+                app.combine_columns.order = order;
+                app.combine_tab.layout = app.combine_tab.layout.wrapping_add(1);
+            }
+        }
+        Some(HeadingEvent::Reset) => {
+            app.combine_columns = Columns::default();
+            app.combine_tab.fitted = 0.0;
+        }
+        None => {}
+    }
+    events
+}
+
+/// What every row needs to know.
+struct Rows<'a> {
+    checks: &'a [Result<usize, String>],
+    selected: &'a [bool],
+    twice: &'a [bool],
+    /// What combining would rename of this file's form fields (the field-name conflict preview).
+    conflicts: &'a [Vec<(String, String)>],
+    dragging: bool,
+    sort: Option<(SortKey, bool)>,
+}
+
+/// A column heading: the whole cell sorts by its column when clicked, moves the column when
+/// dragged, and offers Reset columns on a right-click.
+fn heading(ui: &mut egui::Ui, t: &Tokens, key: SortKey, sort: Option<(SortKey, bool)>) -> Option<HeadingEvent> {
+    let text = key.label();
+    let rect = ui.max_rect();
+    let response = ui.allocate_rect(rect, Sense::click_and_drag());
+    let arrow = sort.filter(|(k, _)| *k == key).map(|(_, ascending)| ascending);
+    let state = match arrow {
+        Some(true) => tl!("sorted ascending"),
+        Some(false) => tl!("sorted descending"),
+        None => "",
+    };
+    let a11y = if state.is_empty() { text.to_owned() } else { format!("{text}, {state}") };
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &a11y));
+    let being_dragged = egui::DragAndDrop::payload::<HeadingDrag>(ui.ctx()).is_some_and(|p| p.0 == key);
+    if being_dragged || response.is_pointer_button_down_on() {
+        ui.painter().rect_filled(rect, CornerRadius::same(4), t.pressed);
+    } else if response.hovered() {
+        ui.painter().rect_filled(rect, CornerRadius::same(4), t.hover);
+    }
+    let colour = if arrow.is_some() { t.text } else { t.text_muted };
+    let galley = ui.painter().layout_no_wrap(text.to_owned(), theme::medium(12.5), colour);
+    let text_pos = egui::pos2(rect.left() + 4.0, rect.center().y - galley.size().y / 2.0);
+    let text_w = galley.size().x;
+    ui.painter().with_clip_rect(rect).galley(text_pos, galley, colour);
+    if let Some(ascending) = arrow {
+        let r = Rect::from_center_size(egui::pos2(rect.left() + text_w + 14.0, rect.center().y), vec2(12.0, 12.0));
+        icons::paint(ui, r, if ascending { "chevron-up" } else { "chevron-down" }, 12.0, t.text);
+    }
+    if response.drag_started() {
+        egui::DragAndDrop::set_payload(ui.ctx(), HeadingDrag(key));
+    }
+    // Another heading dragged over this one: a line where it would go.
+    let after = |r: &egui::Response| r.ctx.pointer_latest_pos().is_some_and(|p| p.x > rect.center().x);
+    if let Some(dragged) = response.dnd_hover_payload::<HeadingDrag>()
+        && dragged.0 != key
+    {
+        let x = if after(&response) { rect.right() } else { rect.left() };
+        ui.painter().with_clip_rect(rect.expand(3.0)).vline(x, rect.y_range(), Stroke::new(2.5, t.accent));
+    }
+    let mut event = None;
+    if let Some(dragged) = response.dnd_release_payload::<HeadingDrag>()
+        && dragged.0 != key
+    {
+        event = Some(HeadingEvent::Move { kind: dragged.0, to: key, after: after(&response) });
+    }
+    let response = response
+        .on_hover_cursor(if being_dragged { egui::CursorIcon::Grabbing } else { egui::CursorIcon::PointingHand })
+        .on_hover_text(tl!("Click to sort, drag to move the column. Drag its edge to resize it."));
+    response.context_menu(|ui| {
+        if ui.button(tl!("Reset columns")).clicked() {
+            event = Some(HeadingEvent::Reset);
+            ui.close();
+        }
+    });
+    if response.clicked() {
+        event = Some(HeadingEvent::Sort(key));
+    }
+    event
+}
+
+/// Draw the Combine files table body: reorder handles, editable page ranges with validation, file metadata
+/// and per-row warnings.
+#[allow(clippy::too_many_arguments)]
+fn table_body(
+    app: &mut PdfCraftApp,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    rows: &Rows,
+    widths: [f32; 5],
+    events: &mut TableEvents,
+    heading_event: &mut Option<HeadingEvent>,
+    shown: &mut Option<[f32; 5]>,
+) {
+    let n = app.combine_draft.len();
+    let order = app.combine_columns.order;
+    // The heading being dragged follows the pointer.
+    if let (Some(dragged), Some(pos)) = (egui::DragAndDrop::payload::<HeadingDrag>(ui.ctx()), ui.ctx().pointer_latest_pos()) {
+        let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("combine-heading-drag")));
+        let galley = painter.layout_no_wrap(dragged.0.label().to_owned(), theme::medium(12.5), t.text);
+        let r = Rect::from_min_size(pos + vec2(10.0, 8.0), galley.size() + vec2(16.0, 8.0));
+        painter.rect(r, CornerRadius::same(4), t.card, Stroke::new(1.0, t.accent), egui::StrokeKind::Inside);
+        painter.galley(r.min + vec2(8.0, 4.0), galley, t.text);
+    }
+    let mut builder = TableBuilder::new(ui)
+        // Columns moved, reset or refitted: a new table state, built from `widths`.
+        .id_salt(("combine-files", app.combine_tab.layout))
+        .striped(true)
+        .sense(Sense::click())
+        .auto_shrink([false, true])
+        .cell_layout(Layout::left_to_right(Align::Center))
+        .column(Column::exact(18.0));
+    for kind in order {
+        builder = builder.column(Column::initial(widths[kind.index()]).at_least(kind.min_width()).resizable(true).clip(true));
+    }
+    builder
+        .header(26.0, |mut row| {
+            row.col(|_| {});
+            for kind in order {
+                row.col(|ui| {
+                    if let Some(e) = heading(ui, t, kind, rows.sort) {
+                        *heading_event = Some(e);
+                    }
+                });
+            }
+        })
+        .body(|mut body| {
+            if !body.ui_mut().is_sizing_pass() {
+                let w = body.widths();
+                let mut out = widths;
+                for (kind, width) in order.iter().zip(w.iter().skip(1)) {
+                    out[kind.index()] = *width;
+                }
+                *shown = Some(out);
+            }
+            for i in 0..n {
+                let Some(f) = app.combine_draft.get_mut(i) else { break };
+                let check = rows.checks.get(i).cloned().unwrap_or(Ok(f.pages));
+                body.row(32.0, |mut row| {
+                    row.set_selected(rows.selected.get(i).copied().unwrap_or(false));
+                    // Drag handle.
+                    row.col(|ui| {
+                        let id = ui.scope_id().with(("combine-drag", f.id));
+                        ui.dnd_drag_source(id, i, |ui| {
+                            let (rect, resp) = ui.allocate_exact_size(vec2(12.0, 18.0), Sense::hover());
+                            grip(ui, rect, if resp.hovered() || rows.dragging { t.text_muted } else { t.text_faint });
+                        })
+                        .response
+                        .on_hover_cursor(egui::CursorIcon::Grab)
+                        .on_hover_text(tl!("Drag to reorder"));
+                    });
+                    for kind in order {
+                        row.col(|ui| match kind {
+                            SortKey::Name => {
+                                ui.add(icons::image("file-text", 16.0, t.icon));
+                                // A file name is file/path chrome: explicitly LTR, extension last.
+                                crate::widgets::label_ltr_truncated(ui, f.name.clone(), theme::regular(13.0), t.text);
+                            }
+                            // The range field and how many pages it takes.
+                            SortKey::Pages => {
+                                crate::widgets::begin_dialog(ui);
+                                let edit = ui.add_enabled(
+                                    f.problem.is_none(),
+                                    crate::widgets::line(&mut f.range).frame(egui::Frame::NONE).hint_text(tl!("All pages")).desired_width(88.0),
+                                );
+                                // A visible field on plain and striped rows alike; red when the range is wrong.
+                                let border = if check.is_err() { Stroke::new(1.5, ERROR) } else { Stroke::new(1.0, t.border) };
+                                ui.painter().rect_stroke(edit.rect, CornerRadius::same(4), border, egui::StrokeKind::Inside);
+                                if let Err(e) = &check {
+                                    edit.clone().on_hover_text(e);
+                                } else {
+                                    edit.clone()
+                                        .on_hover_text(crate::i18n::fmt(tl!("Pages of {name} to combine, e.g. 1-3, 6"), &[("name", &f.name)]));
+                                }
+                                if edit.gained_focus() {
+                                    events.range_focused = true;
+                                    events.action = Some(RowAction::Click(i, Modifiers::NONE));
+                                }
+                                if edit.changed() {
+                                    events.range_changed = true;
+                                }
+                                let count = match (&check, f.problem.is_some()) {
+                                    (_, true) => "—".to_string(),
+                                    (Ok(k), _) => crate::i18n::fmt(tl!("{k} of {n}"), &[("k", &k.to_string()), ("n", &f.pages.to_string())]),
+                                    (Err(_), _) => crate::i18n::fmt(tl!("? of {n}"), &[("n", &f.pages.to_string())]),
+                                };
+                                ui.label(egui::RichText::new(count).small().color(if check.is_err() { ERROR } else { t.text_faint }));
+                            }
+                            SortKey::Size => {
+                                ui.label(egui::RichText::new(crate::panels::human_size(f.bytes.len())).color(t.text_muted));
+                            }
+                            SortKey::Modified => match f.modified {
+                                Some(m) => {
+                                    ui.label(egui::RichText::new(ago(m)).color(t.text_muted)).on_hover_text(utc_stamp(m));
+                                }
+                                None => {
+                                    ui.label(egui::RichText::new("—").color(t.text_faint));
+                                }
+                            },
+                            // Blocking problems first, in red.
+                            SortKey::Warnings => {
+                                let mut errors: Vec<String> = f.problem.iter().cloned().collect();
+                                if let Err(e) = &check {
+                                    errors.push(e.clone());
+                                }
+                                let mut warnings = f.notes.clone();
+                                if rows.twice.get(i).copied().unwrap_or(false) {
+                                    warnings.push(tl!("Added more than once").to_string());
+                                }
+                                if let Some(renames) = rows.conflicts.get(i).filter(|r| !r.is_empty()) {
+                                    let shown: Vec<String> = renames.iter().take(3).map(|(old, new)| format!("{old} → {new}")).collect();
+                                    let list = shown.join(", ");
+                                    warnings.push(crate::i18n::fmt(
+                                        &crate::i18n::trn(
+                                            crate::i18n::current(),
+                                            renames.len() as u64,
+                                            "{n} field name collides with earlier files and will be renamed: {list}",
+                                            "{n} field names collide with earlier files and will be renamed: {list}",
+                                        ),
+                                        &[("list", &list)],
+                                    ));
+                                }
+                                let (icon, colour, first) = match (errors.first(), warnings.first()) {
+                                    (Some(e), _) => ("circle-x", ERROR, e.clone()),
+                                    (None, Some(w)) => ("triangle-alert", WARNING, w.clone()),
+                                    (None, None) => return,
+                                };
+                                let all = errors.iter().chain(&warnings).cloned().collect::<Vec<_>>().join("\n");
+                                ui.add(icons::image(icon, 15.0, colour));
+                                if f.lock.is_some() {
+                                    let link =
+                                        ui.add(egui::Link::new(egui::RichText::new(tl!("Unlock…")).color(t.accent))).on_hover_text(match f.lock {
+                                            Some(Lock::Permissions) => tl!("Enter the permissions password to allow combining"),
+                                            _ => tl!("Enter the password that opens it"),
+                                        });
+                                    if link.clicked() {
+                                        events.action = Some(RowAction::Unlock(Some(i), link.rect.left_bottom() + vec2(0.0, 6.0)));
+                                    }
+                                }
+                                ui.add(
+                                    egui::Label::new(egui::RichText::new(first).color(if colour == ERROR { ERROR } else { t.text }))
+                                        .truncate()
+                                        .selectable(false),
+                                )
+                                .on_hover_text(all);
+                            }
+                        });
+                    }
+                    let response = row.response();
+                    if f.lock.is_some() {
+                        let at = response.rect.left_bottom();
+                        response.context_menu(|ui| {
+                            if ui
+                                .add(egui::Button::image_and_text(icons::image("lock-open", 15.0, ui.visuals().text_color()), tl!("Unlock…")))
+                                .clicked()
+                            {
+                                events.action = Some(RowAction::Unlock(Some(i), at));
+                                ui.close();
+                            }
+                        });
+                    }
+                    if response.clicked() {
+                        let modifiers = response.ctx.input(|i| i.modifiers);
+                        events.action = Some(RowAction::Click(i, modifiers));
+                    }
+                    // A row dragged over this one goes where the line is drawn.
+                    if let Some(from) = response.dnd_hover_payload::<usize>().map(|p| *p) {
+                        let r = response.rect;
+                        let y = if from > i { r.top() } else { r.bottom() };
+                        if from != i {
+                            response.ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("combine-drop-line"))).hline(
+                                r.x_range(),
+                                y,
+                                Stroke::new(2.0, t.accent),
+                            );
+                        }
+                    }
+                    if let Some(from) = response.dnd_release_payload::<usize>().map(|p| *p) {
+                        events.action = Some(RowAction::Drop { from, to: i });
+                    }
+                });
+            }
+        });
+}
+
+/// Six dots: the drag handle.
+fn grip(ui: &egui::Ui, rect: Rect, colour: Color32) {
+    for dx in [-2.5, 2.5] {
+        for dy in [-5.0, 0.0, 5.0] {
+            ui.painter().circle_filled(rect.center() + vec2(dx, dy), 1.4, colour);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/workflows/combine_ui/tests.rs b/crates/ui-egui/src/workflows/combine_ui/tests.rs
new file mode 100644
index 0000000000..b882dcf52d
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_ui/tests.rs
@@ -0,0 +1,212 @@
+use super::*;
+
+#[test]
+fn utc_stamp_is_utc_minutes_and_clamps_pre_epoch() {
+    use std::time::Duration;
+    let at = |s: u64| utc_stamp(SystemTime::UNIX_EPOCH + Duration::from_secs(s));
+    assert_eq!(at(0), "1970-01-01 00:00 UTC");
+    assert_eq!(at(1_791_446_357), "2026-10-08 07:59 UTC");
+    // The 400-year leap rule.
+    assert_eq!(at(951_782_400), "2000-02-29 00:00 UTC");
+    // A clock before 1970 reads as the epoch, as the old `unwrap_or(0)` did.
+    assert_eq!(utc_stamp(SystemTime::UNIX_EPOCH - Duration::from_secs(5)), "1970-01-01 00:00 UTC");
+    // Past chrono's range keeps the proleptic Gregorian date the old code gave, not the epoch.
+    // Windows' SystemTime holds only up to about year 30828, so this is checked where it fits.
+    if let Some(far) = SystemTime::UNIX_EPOCH.checked_add(Duration::from_secs(10_000_000_000_000)) {
+        assert_eq!(utc_stamp(far), "318857-05-20 17:46 UTC");
+    }
+    // Windows' SystemTime can't hold u64::MAX / 2 seconds, so it is only checked where it exists.
+    if let Some(far) = SystemTime::UNIX_EPOCH.checked_add(Duration::from_secs(u64::MAX / 2)) {
+        assert_eq!(utc_stamp(far), "292277026596-12-04 15:30 UTC");
+    }
+    // Years past 9999 keep the plain zero-padded year (no `+`).
+    assert_eq!(at(253_402_300_800), "10000-01-01 00:00 UTC");
+}
+
+/// A one-page PDF that opens with "pw".
+fn locked() -> Vec<u8> {
+    let objs =
+        ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>", "<< /Type /Page /Parent 2 0 R >>"];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut doc = pdfcraft_cos::Document::open(Arc::new(out)).unwrap();
+    doc.set_encryption(&pdfcraft_cos::NewEncryption {
+        algorithm: pdfcraft_cos::Algorithm::Aes256,
+        user_password: "pw",
+        owner_password: "owner",
+        permissions: -1,
+        encrypt_metadata: true,
+        seed: [4; 32],
+    })
+    .unwrap();
+    pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+}
+
+#[test]
+fn duplicate_warnings_reuse_results_and_track_removal_and_parts() {
+    let bytes = locked();
+    let mut app = PdfCraftApp::new();
+    app.stage_combine(vec![("same.pdf".into(), bytes.clone())]);
+    let mut part = app.combine_draft[0].clone();
+    part.id = 99;
+    app.combine_draft.push(part);
+    let first = app.combine_tab.duplicate_warnings(&app.combine_draft);
+    assert_eq!(&*first, &[false, false], "parts of one source are not duplicate additions");
+    let again = app.combine_tab.duplicate_warnings(&app.combine_draft);
+    assert!(Arc::ptr_eq(&first, &again), "unchanged frames reuse the result without scanning files");
+    app.stage_combine(vec![("same.pdf".into(), bytes)]);
+    assert_eq!(&*app.combine_tab.duplicate_warnings(&app.combine_draft), &[true, true, true]);
+    let duplicate = app.combine_draft.last().unwrap().id;
+    app.combine_apply(RowAction::RemoveFile(duplicate));
+    assert_eq!(&*app.combine_tab.duplicate_warnings(&app.combine_draft), &[false, false]);
+    app.combine_history_step(true);
+    assert_eq!(&*app.combine_tab.duplicate_warnings(&app.combine_draft), &[true, true, true]);
+    app.close_combine_tab();
+    assert!(app.combine_tab.duplicate_warnings(&app.combine_draft).is_empty());
+}
+
+/// #1303: an image or text file is converted anew, with its own date, each time it is added,
+/// so it is the file as added that is compared, not the PDF made from it.
+#[test]
+fn the_same_image_or_text_file_added_twice_is_a_duplicate() {
+    static NOW: std::sync::atomic::AtomicI64 = std::sync::atomic::AtomicI64::new(1_700_000_000);
+    let mut png = std::io::Cursor::new(Vec::new());
+    image::RgbaImage::from_pixel(12, 4, image::Rgba([20, 30, 40, 255])).write_to(&mut png, image::ImageFormat::Png).unwrap();
+    let png = png.into_inner();
+    let warnings = |first: (&str, &[u8]), second: (&str, &[u8])| {
+        let mut app = PdfCraftApp::new();
+        app.session = std::mem::take(&mut app.session).with_clock(|| NOW.fetch_add(1, std::sync::atomic::Ordering::Relaxed));
+        for (name, bytes) in [first, second] {
+            app.stage_combine(vec![(name.into(), bytes.to_vec())]);
+        }
+        assert_ne!(app.combine_draft[0].bytes, app.combine_draft[1].bytes, "each addition is converted with its own date");
+        app.combine_tab.duplicate_warnings(&app.combine_draft).to_vec()
+    };
+    assert_eq!(warnings(("notes.txt", b"Hello"), ("notes.txt", b"Hello")), [true, true], "the same text file");
+    assert_eq!(warnings(("photo.png", &png), ("photo.png", &png)), [true, true], "the same image");
+    assert_eq!(warnings(("notes.txt", b"Hello"), ("notes.txt", b"World")), [false, false], "different text, same name and size");
+}
+
+#[test]
+fn every_read_of_a_file_is_new_even_after_undo() {
+    // Regression: the read counter lived in the undo history, so unlock → undo → unlock (with
+    // another password) could repeat a value and keep a thumbnail of the other read.
+    let mut app = PdfCraftApp::new();
+    app.stage_combine(vec![("secret.pdf".into(), locked())]);
+    let added = app.combine_draft[0].auth;
+    assert!(app.combine_unlock_rows(&[0], "pw"));
+    let first = app.combine_draft[0].auth;
+    app.combine_history_step(true);
+    assert_eq!(app.combine_draft[0].auth, added, "undo brings back the file as it was read");
+    assert!(app.combine_unlock_rows(&[0], "owner"));
+    let second = app.combine_draft[0].auth;
+    assert!(second != first && second != added, "added {added}, unlocked {first}, unlocked again {second}");
+}
+
+#[test]
+fn moves_by_rank_never_lose_or_repeat_a_file() {
+    let mut app = PdfCraftApp::new();
+    app.stage_combine((0..6).map(|i| (format!("f{i}.pdf"), locked())).collect());
+    let mut ids: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
+    for (moving, gap) in [(vec![0usize, 2, 4], 6), (vec![5], 0), (vec![1, 3], 3)] {
+        let set: BTreeSet<u64> = moving.iter().filter_map(|i| ids.get(*i).copied()).collect();
+        app.combine_move_to_gap(set, gap);
+        let mut now: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
+        ids = now.clone();
+        now.sort_unstable();
+        assert_eq!(now, (0..6).collect::<Vec<u64>>(), "every file once");
+    }
+}
+
+#[test]
+fn bookmarks_are_named_without_the_extension_of_a_converted_file() {
+    assert_eq!(title_of("report.pdf"), "report");
+    assert_eq!(title_of("REPORT.PDF"), "REPORT");
+    assert_eq!(title_of("scan.2024.JPG"), "scan.2024");
+    assert_eq!(title_of("notes.txt"), "notes");
+    assert_eq!(title_of("v1.2"), "v1.2", "not a known extension");
+    assert_eq!(title_of(".png"), ".png", "nothing would be left");
+}
+
+#[test]
+fn page_lists_become_the_shortest_range() {
+    assert_eq!(range_of(&[0, 1, 2], 3), "", "every page in order: no range");
+    assert_eq!(range_of(&[0, 1, 2], 5), "1-3");
+    assert_eq!(range_of(&[2, 0, 3], 5), "3, 1, 4");
+    assert_eq!(range_of(&[8, 7, 6, 0], 9), "9-7, 1");
+    assert_eq!(range_of(&[0, 0, 1], 2), "1, 1-2");
+    assert_eq!(range_of(&[4], 9), "5");
+    assert_eq!(range_of(&[], 3), "");
+    // Whatever comes out reads back as the same pages.
+    for pages in [vec![0, 1, 2, 5, 4, 3, 3, 7], vec![9, 0, 9, 1], vec![2, 1, 0, 1, 2]] {
+        let range = range_of(&pages, 10);
+        let back = pdfcraft_engine::print::select_pages(10, Some(&range), &[], pdfcraft_engine::print::Subset::All, false).unwrap();
+        assert_eq!(back, pages, "{range}");
+    }
+}
+
+fn part(id: u64, group: u64, pages: &[usize]) -> Part {
+    Part { id, group, pages: Some(pages.to_vec()) }
+}
+
+#[test]
+fn a_page_moved_between_another_files_pages_splits_its_file_and_parts_rejoin() {
+    let mut next = 100;
+    let mut new_id = || {
+        next += 1;
+        next
+    };
+    // A: pages 1-3, B: pages 1-2.
+    let list = [part(1, 1, &[0, 1, 2]), part(2, 2, &[0, 1])];
+    // A's page 3 between B's pages: A splits around B's first page.
+    let moved = moved_pages(&list, &BTreeSet::from([(1, 2)]), 4, &mut new_id).unwrap();
+    assert_eq!(moved, [part(1, 1, &[0, 1]), part(2, 2, &[0]), part(101, 1, &[2]), part(102, 2, &[1])]);
+    // Back where it was: the parts join again, under their first ids.
+    let back = moved_pages(&moved, &BTreeSet::from([(101, 0)]), 2, &mut new_id).unwrap();
+    assert_eq!(back, [part(1, 1, &[0, 1, 2]), part(2, 2, &[0, 1])]);
+    // Within a file: only its order changes.
+    let within = moved_pages(&list, &BTreeSet::from([(1, 0)]), 3, &mut new_id).unwrap();
+    assert_eq!(within, [part(1, 1, &[1, 2, 0]), part(2, 2, &[0, 1])]);
+    // Several pages carried together keep their order.
+    let both = moved_pages(&list, &BTreeSet::from([(1, 0), (1, 2)]), 5, &mut new_id).unwrap();
+    assert_eq!(both, [part(1, 1, &[1]), part(2, 2, &[0, 1]), part(103, 1, &[0, 2])]);
+    // Dropped where it is, or nothing picked: no change.
+    assert_eq!(moved_pages(&list, &BTreeSet::from([(1, 1)]), 1, &mut new_id), None);
+    assert_eq!(moved_pages(&list, &BTreeSet::from([(9, 9)]), 0, &mut new_id), None);
+    // A file that can't be split moves whole, and pages move around it.
+    let locked = [part(1, 1, &[0, 1]), Part { id: 3, group: 3, pages: None }];
+    let around = moved_pages(&locked, &BTreeSet::from([(1, 0)]), 3, &mut new_id).unwrap();
+    assert_eq!(around, [part(1, 1, &[1]), Part { id: 3, group: 3, pages: None }, part(104, 1, &[0])]);
+}
+
+#[test]
+fn removing_pages_drops_emptied_parts_and_joins_what_meets() {
+    let mut next = 200;
+    let mut new_id = || {
+        next += 1;
+        next
+    };
+    // A split around B: A[1], B[1], A[2].
+    let list = [part(1, 1, &[0]), part(2, 2, &[0]), part(3, 1, &[1])];
+    // B goes: A's two parts meet and join.
+    assert_eq!(removed_pages(&list, &BTreeSet::from([(2, 0)]), &mut new_id), Some(vec![part(1, 1, &[0, 1])]));
+    // One page of a part.
+    let two = [part(1, 1, &[0, 1, 2])];
+    assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 1)]), &mut new_id), Some(vec![part(1, 1, &[0, 2])]));
+    // Every page: nothing left. Repeated pages are told apart by their place.
+    assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 0), (1, 1), (1, 2)]), &mut new_id), Some(Vec::new()));
+    let repeats = [part(1, 1, &[0, 0])];
+    assert_eq!(removed_pages(&repeats, &BTreeSet::from([(1, 1)]), &mut new_id), Some(vec![part(1, 1, &[0])]));
+    // A page that isn't there: nothing changes, and it says so.
+    assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 9)]), &mut new_id), None);
+}
diff --git a/crates/ui-egui/src/workflows/combine_ui/view.rs b/crates/ui-egui/src/workflows/combine_ui/view.rs
new file mode 100644
index 0000000000..1e20332307
--- /dev/null
+++ b/crates/ui-egui/src/workflows/combine_ui/view.rs
@@ -0,0 +1,641 @@
+use super::files::{CombineFile, CombineView, Lock, RowAction};
+use super::table::{TableEvents, table};
+use super::*;
+
+/// The Combine files page.
+pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    let files_hovering = ui.ctx().input(|i| !i.raw.hovered_files.is_empty());
+    // Ranges are checked before anything below reads them.
+    let checks: Vec<Result<usize, String>> = app.combine_draft.iter_mut().map(CombineFile::selection).collect();
+    // Same-named form fields across the files are renamed when combining: preview it once per
+    // list, so the Warnings column can say so before anything is combined.
+    app.combine_conflicts.refresh(&app.session, &app.combine_draft);
+    let conflicts = app.combine_conflicts.per_file.clone();
+    let twice = app.combine_tab.duplicate_warnings(&app.combine_draft);
+    let n = app.combine_draft.len();
+    let ids: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
+    app.combine_tab.selected.retain(|id| ids.contains(id));
+    // Pages stay picked only while they show (a grid card of an expanded file), so the trash or
+    // Delete never takes a page the user can't see.
+    {
+        let tab = &mut app.combine_tab;
+        if app.combine_view == CombineView::Grid {
+            let shown: BTreeSet<(u64, usize)> = app
+                .combine_draft
+                .iter_mut()
+                .filter(|f| tab.expanded.contains(&f.id))
+                .flat_map(|f| {
+                    let id = f.id;
+                    (0..f.selection().unwrap_or(0)).map(move |nth| (id, nth))
+                })
+                .collect();
+            tab.selected_pages.retain(|p| shown.contains(p));
+        } else {
+            tab.selected_pages.clear();
+        }
+        if tab.selected_pages.is_empty() {
+            tab.page_anchor = None;
+        }
+    }
+    // A file stays expanded only while it can show as its pages (not locked again by undo, nor
+    // edited down to one page or a bad range): it doesn't come back expanded by itself.
+    {
+        let tab = &mut app.combine_tab;
+        let draft = &app.combine_draft;
+        let lists = &mut tab.page_lists;
+        tab.expanded.retain(|id| draft.iter().find(|f| f.id == *id).is_some_and(|f| crate::combine_grid::pages_shown(lists, f).is_some()));
+        let expanded = &tab.expanded;
+        tab.page_lists.retain(|id, _| expanded.contains(id));
+    }
+    let selected: Vec<bool> = ids.iter().map(|id| app.combine_tab.selected.contains(id)).collect();
+    let count = selected.iter().filter(|s| **s).count();
+    let blocker = blocker(&app.combine_draft, &checks);
+    let grid = app.combine_view == CombineView::Grid;
+    let columns = grid.then_some(app.combine_tab.grid_columns);
+    // The keyboard is the list's unless a text field, the password box or the size slider has it.
+    let slider_focused = grid && app.combine_tab.zoom_slider.is_some_and(|id| ui.memory(|m| m.has_focus(id)));
+    // (Nor while a file is shown large: its window may only open or close this frame.)
+    let covered = app.combine_tab.unlock.is_some() || app.combine_tab.preview.is_some() || app.combine_tab.confirm_skip;
+    let focus = ui.memory(|m| m.focused());
+    let space = focus.is_none() || focus == app.combine_tab.card_focus;
+    let any_picked = count > 0 || !app.combine_tab.selected_pages.is_empty();
+    let keys = if covered || slider_focused { None } else { keyboard(ui, n, any_picked, columns, space) };
+    let mut events = TableEvents { action: keys, ..Default::default() };
+    // ⌘+ / ⌘− / ⌘0 size the grid's cards (instead of the whole window's text).
+    if grid && n > 0 && !covered {
+        app.combine_tab.zoom_request = zoom_keys(ui, app.combine_zoom).or(app.combine_tab.zoom_request);
+    }
+    // An arrow pressed or a zoom asked for in the list has nothing for the grid to do later.
+    if !grid {
+        app.combine_tab.reveal = None;
+        app.combine_tab.zoom_request = None;
+    }
+    let mut combine = false;
+
+    egui::Frame::NONE.inner_margin(egui::Margin::symmetric(28, 20)).show(ui, |ui| {
+        // Title and Combine.
+        ui.horizontal(|ui| {
+            ui.label(egui::RichText::new(tl!("Combine files")).font(theme::semibold(20.0)));
+            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                let response = ui.add_enabled_ui(blocker.is_none(), |ui| widgets::icon_pill(ui, "files", tl!("Combine"), true)).inner;
+                if let Some(why) = &blocker {
+                    response.clone().on_disabled_hover_text(why);
+                }
+                if response.clicked() {
+                    combine = true;
+                }
+            });
+        });
+        let hint = if grid {
+            tl!("Files are combined in the order shown. Drag them to change it.")
+        } else {
+            tl!("Files are combined from top to bottom. Leave Pages empty to take every page.")
+        };
+        ui.label(egui::RichText::new(hint).color(t.text_faint));
+        ui.add_space(12.0);
+
+        // Toolbar: on two lines when the window is narrow.
+        ui.horizontal_wrapped(|ui| {
+            ui.spacing_mut().item_spacing.x = 6.0;
+            // Where the line ends (an overflowing line would move it).
+            let edge = ui.max_rect().right();
+            add_menu(app, ui);
+            let open_docs: Vec<(usize, String)> =
+                app.views.iter().enumerate().filter_map(|(i, _)| crate::canvas::tab_label(app, i).map(|name| (i, name))).collect();
+            let response = ui.add_enabled_ui(!open_docs.is_empty(), |ui| widgets::icon_pill(ui, "file-plus", tl!("Add open documents"), false)).inner;
+            response.clone().on_disabled_hover_text(tl!("No documents are open"));
+            egui::Popup::menu(&response).show(|ui| {
+                if open_docs.len() > 1 && ui.button(tl!("All open documents")).clicked() {
+                    app.add_open_documents(&open_docs.iter().map(|(i, _)| *i).collect::<Vec<_>>());
+                    ui.close();
+                }
+                for (i, name) in &open_docs {
+                    if ui.button(name.as_str()).clicked() {
+                        app.add_open_documents(&[*i]);
+                        ui.close();
+                    }
+                }
+            });
+            group(ui, &t, edge, 4.0 * 30.0 + 3.0 * 6.0);
+            // Moves need a selected row with room to move; the buttons stay put either way.
+            let can_up = selected.iter().skip_while(|s| **s).any(|s| *s);
+            let can_down = selected.iter().rev().skip_while(|s| **s).any(|s| *s);
+            let why = tl!("Select a file first");
+            let pages_picked = app.combine_tab.selected_pages.len();
+            let remove = match (pages_picked, count) {
+                (1, _) => tl!("Remove page").to_string(),
+                (k, _) if k > 1 => crate::i18n::fmt(tl!("Remove {n} pages"), &[("n", &k.to_string())]),
+                (_, 1) => {
+                    let name = app.combine_draft.iter().find(|f| app.combine_tab.selected.contains(&f.id)).map_or("", |f| f.name.as_str());
+                    crate::i18n::fmt(tl!("Remove {name}"), &[("name", name)])
+                }
+                (_, 0) => tl!("Remove").to_string(),
+                (_, k) => crate::i18n::fmt(tl!("Remove {n} files"), &[("n", &k.to_string())]),
+            };
+            if tool(ui, can_up, "chevron-up", tl!("Move up"), why).clicked() {
+                events.action = Some(RowAction::MoveUp);
+            }
+            if tool(ui, can_down, "chevron-down", tl!("Move down"), why).clicked() {
+                events.action = Some(RowAction::MoveDown);
+            }
+            if tool(ui, count > 0 || pages_picked > 0, "trash-2", &remove, why).clicked() {
+                events.action = Some(RowAction::Remove);
+            }
+            let locked = app.combine_draft.iter().any(|f| f.lock.is_some() && app.combine_tab.selected.contains(&f.id));
+            let unlock = tool(ui, locked, "lock-open", tl!("Unlock…"), tl!("Select a password-protected file first"));
+            if unlock.clicked() {
+                events.action = Some(RowAction::Unlock(None, unlock.rect.left_bottom() + vec2(0.0, 6.0)));
+            }
+            group(ui, &t, edge, 2.0 * 30.0 + 6.0);
+            let (undo, redo) = (!app.combine_tab.undo.is_empty(), !app.combine_tab.redo.is_empty());
+            if tool(ui, undo, "undo-2", tl!("Undo"), tl!("Nothing to undo")).clicked() {
+                app.execute("edit.undo");
+            }
+            if tool(ui, redo, "redo-2", tl!("Redo"), tl!("Nothing to redo")).clicked() {
+                app.execute("edit.redo");
+            }
+            group(ui, &t, edge, 2.0 * 30.0 + 6.0);
+            // Thumbnails or the table; the choice is kept in the settings.
+            for (view, icon, label) in [(CombineView::Grid, "layout-grid", tl!("Grid view")), (CombineView::List, "list", tl!("List view"))] {
+                if icons::button(ui, icon, 30.0, app.combine_view == view, label).clicked() {
+                    app.combine_view = view;
+                }
+            }
+            if count > 1 {
+                ui.add_space(6.0);
+                ui.label(egui::RichText::new(crate::i18n::fmt(tl!("{n} selected"), &[("n", &count.to_string())])).color(t.text_muted));
+            }
+            if grid && n > 0 {
+                // Every file as its pages, or all as cards again.
+                group(ui, &t, edge, 2.0 * 30.0 + 6.0);
+                let can_expand = app.combine_draft.iter_mut().any(|f| !app.combine_tab.expanded.contains(&f.id) && expandable(f));
+                if ui.add_enabled_ui(can_expand, |ui| icons::button(ui, "maximize-2", 30.0, false, tl!("Expand all"))).inner.clicked() {
+                    events.action = Some(RowAction::ExpandAll(true));
+                }
+                let can_collapse = !app.combine_tab.expanded.is_empty();
+                if ui.add_enabled_ui(can_collapse, |ui| icons::button(ui, "minimize-2", 30.0, false, tl!("Collapse all"))).inner.clicked() {
+                    events.action = Some(RowAction::ExpandAll(false));
+                }
+                zoom_controls(app, ui, &t, edge);
+            }
+        });
+        ui.add_space(10.0);
+
+        // The list, in a card that highlights while files are dragged over the window.
+        let footer_h = 34.0;
+        let card_h = (ui.available_height() - footer_h).max(120.0);
+        let stroke = if files_hovering { Stroke::new(2.0, t.accent) } else { Stroke::new(1.0, t.border) };
+        egui::Frame::NONE.fill(t.card).stroke(stroke).corner_radius(CornerRadius::same(t.radius)).inner_margin(egui::Margin::symmetric(8, 6)).show(
+            ui,
+            |ui| {
+                ui.set_min_height(card_h - 12.0);
+                // The grid scrolls inside the card, leaving room for the totals below it.
+                if grid {
+                    ui.set_max_height(card_h - 12.0);
+                }
+                ui.set_width(ui.available_width());
+                if n == 0 {
+                    empty_state(app, ui, &t, files_hovering);
+                // The view as the toolbar left it: a click on List view this frame starts no
+                // thumbnail renders.
+                } else if app.combine_view == CombineView::Grid {
+                    if let Some(action) = crate::combine_grid::grid(app, ui, &t, &checks, &selected, &twice) {
+                        events.action = Some(action);
+                    }
+                } else {
+                    let table_events = table(app, ui, &t, &checks, &selected, &conflicts, &twice);
+                    events.range_focused |= table_events.range_focused;
+                    events.range_changed |= table_events.range_changed;
+                    if table_events.action.is_some() {
+                        events.action = table_events.action;
+                    }
+                }
+            },
+        );
+
+        // A file shown large, over everything.
+        crate::combine_grid::preview(app, ui.ctx(), &t);
+
+        // Totals.
+        ui.add_space(8.0);
+        if n > 0 {
+            ui.horizontal(|ui| {
+                let pages: usize = checks.iter().filter_map(|c| c.as_ref().ok()).sum();
+                // Each file's size once, however many parts it is in.
+                let mut counted = BTreeSet::new();
+                let size: usize = app.combine_draft.iter().filter(|f| counted.insert(f.group)).map(|f| f.bytes.len()).sum();
+                // A file split into parts counts once.
+                let n = app.combine_draft.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len();
+                let files = if n == 1 { tl!("1 file").to_string() } else { crate::i18n::fmt(tl!("{n} files"), &[("n", &n.to_string())]) };
+                let pages = if pages == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &pages.to_string())]) };
+                ui.label(egui::RichText::new(format!("{files} · {pages} · {}", crate::panels::human_size(size))).color(t.text_muted));
+                let bad = app
+                    .combine_draft
+                    .iter()
+                    .zip(&checks)
+                    .filter(|(f, c)| f.problem.is_some() || c.is_err())
+                    .map(|(f, _)| f.group)
+                    .collect::<BTreeSet<u64>>()
+                    .len();
+                if bad > 0 {
+                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                        let text = if bad == 1 {
+                            tl!("1 file needs attention").to_string()
+                        } else {
+                            crate::i18n::fmt(tl!("{n} files need attention"), &[("n", &bad.to_string())])
+                        };
+                        ui.label(egui::RichText::new(text).color(ERROR));
+                    });
+                }
+            });
+        }
+    });
+
+    // A Pages field taking the keyboard remembers the list; its first change makes the undo step.
+    if events.range_focused {
+        app.combine_tab.range_edit = Some(app.combine_snapshot());
+    }
+    if events.range_changed
+        && let Some(before) = app.combine_tab.range_edit.take()
+    {
+        app.combine_push_undo(before);
+    }
+    unlock_prompt(app, ui.ctx());
+    if let Some(action) = events.action {
+        app.combine_apply(action);
+    }
+    if combine && blocker.is_none() {
+        if app.combine_draft.iter().any(CombineFile::unreadable) {
+            app.combine_tab.confirm_skip = true;
+        } else {
+            app.combine_staged();
+        }
+    }
+    skip_prompt(app, ui.ctx());
+}
+
+/// Most files the prompt names; the rest are counted.
+const SKIP_PROMPT_NAMES: usize = 8;
+
+/// "Leave out files that can't be read?": names them and why, then combines the others, or not.
+fn skip_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    if !app.combine_tab.confirm_skip {
+        return;
+    }
+    let t = Tokens::get(ctx);
+    let mut left_out: Vec<(&str, &str)> = Vec::new();
+    let mut seen = BTreeSet::new();
+    for f in app.combine_draft.iter().filter(|f| f.unreadable() && seen.insert(f.group)) {
+        left_out.push((f.name.as_str(), f.problem.as_deref().unwrap_or_default()));
+    }
+    let mut choice: Option<bool> = None;
+    let modal = egui::Modal::new(egui::Id::unique("combine-skip")).show(ctx, |ui| {
+        ui.set_width(460.0);
+        ui.horizontal(|ui| {
+            ui.add(icons::image("triangle-alert", 22.0, ERROR));
+            ui.add(egui::Label::new(egui::RichText::new(tl!("Leave out files that can't be read?")).font(theme::semibold(16.0))).wrap());
+        });
+        ui.add_space(6.0);
+        ui.label(egui::RichText::new(tl!("These files can't be read, so they won't be in the combined PDF:")).color(t.text_muted));
+        ui.add_space(6.0);
+        for (name, why) in left_out.iter().take(SKIP_PROMPT_NAMES) {
+            ui.horizontal_wrapped(|ui| {
+                ui.label(egui::RichText::new(format!("• {name}")).strong());
+                ui.label(egui::RichText::new(*why).color(t.text_muted));
+            });
+        }
+        if left_out.len() > SKIP_PROMPT_NAMES {
+            let more = (left_out.len() - SKIP_PROMPT_NAMES).to_string();
+            ui.label(egui::RichText::new(crate::i18n::fmt(tl!("and {n} more"), &[("n", &more)])).color(t.text_muted));
+        }
+        ui.add_space(14.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("Combine the rest"), true).clicked() {
+                choice = Some(true);
+            }
+            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                choice = Some(false);
+            }
+        });
+    });
+    if choice.is_none() && modal.should_close() {
+        choice = Some(false);
+    }
+    if let Some(go) = choice {
+        app.combine_tab.confirm_skip = false;
+        if go {
+            app.combine_staged();
+        }
+    }
+}
+
+/// Unlock…'s password box, floating below what opened it. Enter unlocks, Escape or a click
+/// elsewhere closes it.
+fn unlock_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(mut prompt) = app.combine_tab.unlock.take() else { return };
+    let t = Tokens::get(ctx);
+    let files: Vec<&CombineFile> = app.combine_draft.iter().filter(|f| prompt.rows.contains(&f.id)).collect();
+    let title = match files.as_slice() {
+        [one] => crate::i18n::fmt(tl!("Unlock {name}"), &[("name", &one.name)]),
+        many => crate::i18n::fmt(tl!("Unlock {n} files"), &[("n", &many.len().to_string())]),
+    };
+    let explain = if files.iter().all(|f| f.lock == Some(Lock::Permissions)) {
+        tl!("Enter the permissions password to allow combining")
+    } else {
+        tl!("Enter the password that opens it")
+    };
+    let batch = files.len() > 1;
+    let (mut submit, mut cancel) = (false, false);
+    let area = egui::Area::new(egui::Id::unique("combine-unlock")).order(egui::Order::Foreground).fixed_pos(prompt.at).show(ctx, |ui| {
+        egui::Frame::popup(ui.style()).inner_margin(egui::Margin::same(14)).show(ui, |ui| {
+            ui.set_width(340.0);
+            ui.horizontal(|ui| {
+                ui.add(icons::image("lock", 16.0, t.icon));
+                ui.add(egui::Label::new(egui::RichText::new(&title).font(theme::semibold(14.0))).truncate());
+            });
+            ui.add_space(4.0);
+            ui.label(egui::RichText::new(explain).color(t.text_muted));
+            if batch {
+                ui.label(egui::RichText::new(tl!("The same password is tried on each file.")).small().color(t.text_faint));
+            }
+            ui.add_space(8.0);
+            ui.horizontal(|ui| {
+                crate::widgets::begin_dialog(ui);
+                let field = ui.add(crate::widgets::line(&mut prompt.input.0).password(!prompt.show).hint_text(tl!("Password")).desired_width(290.0));
+                if !prompt.focused {
+                    field.request_focus();
+                    prompt.focused = true;
+                }
+                if field.changed() {
+                    prompt.error = None;
+                }
+                if field.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                    submit = true;
+                }
+                let (icon, tip) = if prompt.show { ("eye-off", tl!("Hide password")) } else { ("eye", tl!("Show password")) };
+                if icons::button(ui, icon, 26.0, false, tip).clicked() {
+                    prompt.show = !prompt.show;
+                }
+            });
+            if let Some(e) = &prompt.error {
+                ui.label(egui::RichText::new(e).color(ERROR));
+            }
+            ui.add_space(6.0);
+            ui.label(egui::RichText::new(tl!("The password is only used to read the file; it isn't saved.")).small().color(t.text_faint));
+            ui.add_space(8.0);
+            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                if ui.add_enabled_ui(!prompt.input.0.is_empty(), |ui| widgets::pill_button(ui, tl!("Unlock"), true)).inner.clicked() {
+                    submit = true;
+                }
+                if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                    cancel = true;
+                }
+            });
+        });
+    });
+    if ctx.input(|i| i.key_pressed(egui::Key::Escape)) || area.response.clicked_elsewhere() {
+        cancel = true;
+    }
+    if submit && !prompt.input.0.is_empty() {
+        let rows = prompt.rows.clone();
+        if app.combine_unlock(&rows, &prompt.input.0) {
+            return;
+        }
+        prompt.error = Some(tl!("Wrong password").to_string());
+        prompt.focused = false;
+    }
+    if !cancel {
+        app.combine_tab.unlock = Some(prompt);
+    }
+}
+
+fn separator(ui: &mut egui::Ui, t: &Tokens) {
+    ui.add_space(4.0);
+    // As tall as the buttons on this line (the toolbar can take two).
+    let top = ui.cursor().top();
+    ui.painter().vline(ui.cursor().left(), (top + 4.0)..=(top + 26.0), Stroke::new(1.0, t.divider));
+    ui.add_space(6.0);
+}
+
+/// Before a group of toolbar buttons `width` wide: a divider, or a new line when the group
+/// doesn't fit before `edge` (the toolbar wraps between groups, never inside one).
+fn group(ui: &mut egui::Ui, t: &Tokens, edge: f32, width: f32) {
+    if edge - ui.cursor().min.x < width + 10.0 {
+        ui.end_row();
+    } else {
+        separator(ui, t);
+    }
+}
+
+/// A toolbar icon button, disabled with a reason.
+fn tool(ui: &mut egui::Ui, enabled: bool, icon: &str, label: &str, disabled_why: &str) -> egui::Response {
+    ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, 30.0, false, label)).inner.on_disabled_hover_text(disabled_why)
+}
+
+/// Whether a file can be shown as its pages: readable, unlocked, and adding more than one.
+pub(super) fn expandable(f: &mut CombineFile) -> bool {
+    f.lock.is_none() && f.problem.is_none() && f.selection().is_ok_and(|k| k > 1 && k <= crate::combine_grid::MAX_EXPAND)
+}
+
+/// Why Combine can't run yet, if so.
+fn blocker(files: &[CombineFile], checks: &[Result<usize, String>]) -> Option<String> {
+    // (A file split into parts is still one file.) Files that can't be read are left out, so
+    // they don't count.
+    if files.iter().filter(|f| !f.unreadable()).map(|f| f.group).collect::<BTreeSet<u64>>().len() < 2 {
+        return Some(match files.iter().find(|f| f.unreadable()) {
+            Some(f) => {
+                crate::i18n::fmt(tl!("{name} can't be combined: {why}"), &[("name", &f.name), ("why", f.problem.as_deref().unwrap_or_default())])
+            }
+            None => tl!("Add at least two files").to_string(),
+        });
+    }
+    for (f, check) in files.iter().zip(checks) {
+        if f.unreadable() {
+            continue;
+        }
+        if let Some(p) = &f.problem {
+            return Some(crate::i18n::fmt(tl!("{name} can't be combined: {why}"), &[("name", &f.name), ("why", p)]));
+        }
+        if let Err(e) = check {
+            return Some(crate::i18n::fmt(tl!("Check the pages of {name}: {why}"), &[("name", &f.name), ("why", e)]));
+        }
+    }
+    None
+}
+
+/// While no text field has the keyboard: Up/Down select (Shift extends), Alt+Up/Down move the
+/// selection, Delete removes it, Ctrl/⌘+A selects every file. In the grid (`columns` per row)
+/// Left/Right step one file and Up/Down one row.
+pub(crate) fn keyboard(ui: &egui::Ui, n: usize, any_selected: bool, grid_columns: Option<usize>, space: bool) -> Option<RowAction> {
+    // A focused card or button still leaves the arrows to the list; a text field, an open menu
+    // or a dialog doesn't.
+    let ctx = ui.ctx();
+    if n == 0 || ctx.text_edit_focused() || egui::Popup::is_any_open(ctx) || ctx.memory(|m| m.top_modal_layer().is_some()) {
+        return None;
+    }
+    use egui::Key;
+    ui.ctx().input_mut(|i| {
+        if i.consume_key(Modifiers::COMMAND, Key::A) {
+            return Some(RowAction::SelectAll);
+        }
+        // As Quick Look: the file the keyboard is on, large (the way there without a pointer). A
+        // focused button keeps its Space.
+        if any_selected && space && i.consume_key(Modifiers::NONE, Key::Space) {
+            return Some(RowAction::PreviewSelected);
+        }
+        if any_selected {
+            if i.consume_key(Modifiers::ALT, Key::ArrowUp) {
+                return Some(RowAction::MoveUp);
+            }
+            if i.consume_key(Modifiers::ALT, Key::ArrowDown) {
+                return Some(RowAction::MoveDown);
+            }
+            if i.consume_key(Modifiers::NONE, Key::Delete) || i.consume_key(Modifiers::NONE, Key::Backspace) {
+                return Some(RowAction::Remove);
+            }
+        }
+        let row = grid_columns.unwrap_or(1).max(1);
+        let mut keys = vec![(false, row, Key::ArrowUp), (true, row, Key::ArrowDown)];
+        if grid_columns.is_some() {
+            keys.extend([(false, 1, Key::ArrowLeft), (true, 1, Key::ArrowRight)]);
+        }
+        for (down, by, key) in keys {
+            // Shift first: a plain arrow also matches with Shift held (egui ignores an extra
+            // Shift), which would step instead of extending.
+            if i.consume_key(Modifiers::SHIFT, key) {
+                return Some(RowAction::Step { down, by, extend: true });
+            }
+            if i.consume_key(Modifiers::NONE, key) {
+                return Some(RowAction::Step { down, by, extend: false });
+            }
+        }
+        None
+    })
+}
+
+/// ⌘+ (or ⌘=), ⌘− and ⌘0, while no text field, menu or dialog has the keyboard: the grid zoom
+/// they ask for, from `zoom`.
+fn zoom_keys(ui: &egui::Ui, zoom: f32) -> Option<f32> {
+    use crate::combine_grid::zoom_step;
+    use egui::{Key, KeyboardShortcut};
+    let ctx = ui.ctx();
+    if ctx.text_edit_focused() || egui::Popup::is_any_open(ctx) || ctx.memory(|m| m.top_modal_layer().is_some()) {
+        return None;
+    }
+    // All of them are taken (several can arrive in one slow frame), so none is left for egui to
+    // zoom the whole window with.
+    let (larger, smaller, reset) = ctx.input_mut(|i| {
+        let mut pressed = |k| i.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, k));
+        (pressed(Key::Plus) | pressed(Key::Equals), pressed(Key::Minus), pressed(Key::Num0))
+    });
+    match (larger, smaller, reset) {
+        (_, _, true) => Some(1.0),
+        (true, false, _) => Some(zoom_step(zoom, true)),
+        (false, true, _) => Some(zoom_step(zoom, false)),
+        _ => None,
+    }
+}
+
+/// The grid's card size, at the right of the toolbar (right to left: larger, the percentage, the
+/// slider, smaller), as the page grid's.
+fn zoom_controls(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, edge: f32) {
+    use crate::combine_grid::{ZOOM_RANGE, zoom_step};
+    let zoom = app.combine_zoom;
+    // Two buttons, the percentage, the slider and the spaces between: on a line of their own when
+    // they don't fit beside the rest.
+    let needed = 30.0 + 44.0 + 96.0 + 30.0 + 4.0 * ui.spacing().item_spacing.x + 8.0;
+    if edge - ui.cursor().min.x < needed {
+        ui.end_row();
+    }
+    // Right-aligned on the line, up to its end.
+    let line = Rect::from_min_max(ui.cursor().min, egui::pos2(edge, ui.cursor().min.y + 30.0));
+    ui.scope_builder(egui::UiBuilder::new().max_rect(line).layout(Layout::right_to_left(Align::Center)), |ui| {
+        let larger = ui.add_enabled_ui(zoom < *ZOOM_RANGE.end(), |ui| icons::button(ui, "zoom-in", 30.0, false, tl!("Larger pages"))).inner;
+        if larger.clicked() {
+            app.combine_tab.zoom_request = Some(zoom_step(zoom, true));
+        }
+        let percent =
+            egui::Button::new(egui::RichText::new(format!("{:.0}%", zoom * 100.0)).font(theme::medium(12.0)).color(t.text_muted)).frame(false);
+        let percent = ui.add_sized([44.0, 30.0], percent);
+        percent.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Reset page size")));
+        if percent.on_hover_text(tl!("Reset page size")).clicked() {
+            app.combine_tab.zoom_request = Some(1.0);
+        }
+        let mut value = zoom;
+        ui.spacing_mut().slider_width = 96.0;
+        let slider = ui.add(egui::Slider::new(&mut value, ZOOM_RANGE).show_value(false));
+        // Read out as a percentage, as shown beside it.
+        slider.widget_info(|| egui::WidgetInfo::slider(true, f64::from(value * 100.0).round(), tl!("Page size")));
+        app.combine_tab.zoom_slider = Some(slider.id);
+        if slider.on_hover_text(tl!("Page size")).changed() {
+            app.combine_tab.zoom_request = Some(value);
+        }
+        let smaller = ui.add_enabled_ui(zoom > *ZOOM_RANGE.start(), |ui| icons::button(ui, "zoom-out", 30.0, false, tl!("Smaller pages"))).inner;
+        if smaller.clicked() {
+            app.combine_tab.zoom_request = Some(zoom_step(zoom, false));
+        }
+    });
+}
+
+fn empty_state(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, files_hovering: bool) {
+    ui.vertical_centered(|ui| {
+        ui.add_space((ui.available_height() / 2.0 - 70.0).max(16.0));
+        ui.add(icons::image("files", 40.0, if files_hovering { t.accent } else { t.text_faint }));
+        ui.add_space(10.0);
+        ui.label(egui::RichText::new(tl!("Add the files to combine")).font(theme::medium(15.0)));
+        ui.add_space(4.0);
+        ui.label(egui::RichText::new(tl!("Drop PDFs, images, text files or folders here, or choose them.")).color(t.text_faint));
+        ui.add_space(12.0);
+        let folders = cfg!(not(target_arch = "wasm32"));
+        // Centre the buttons: measure them first.
+        let font = theme::medium(12.5);
+        let width = |s: &str| ui.fonts_mut(|f| f.layout_no_wrap(s.to_owned(), font.clone(), t.text).size().x);
+        let total = width(tl!("Add files…")) + 26.0 + if folders { width(tl!("Add folder…")) + 46.0 + 8.0 } else { 0.0 };
+        ui.horizontal(|ui| {
+            ui.add_space(((ui.available_width() - total) / 2.0).max(0.0));
+            ui.spacing_mut().item_spacing.x = 8.0;
+            if widgets::pill_button(ui, tl!("Add files…"), true).clicked() {
+                app.combine_dialog();
+            }
+            if folders && widgets::icon_pill(ui, "folder", tl!("Add folder…"), false).clicked() {
+                app.combine_add_folder(false);
+            }
+        });
+    });
+}
+
+/// "Add files…" with a menu of the other ways to add: folders (desktop).
+fn add_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    if !cfg!(not(target_arch = "wasm32")) {
+        if widgets::icon_pill(ui, "plus", tl!("Add files…"), false).clicked() {
+            app.combine_dialog();
+        }
+        return;
+    }
+    let (main, more) = widgets::split_pill(ui, "plus", tl!("Add files…"), tl!("More ways to add files"));
+    if main.clicked() {
+        app.combine_dialog();
+    }
+    egui::Popup::menu(&more).show(|ui| {
+        ui.set_min_width(220.0);
+        let item = |ui: &mut egui::Ui, icon: &str, label: &str| {
+            ui.add(egui::Button::image_and_text(icons::image(icon, 15.0, ui.visuals().text_color()), label))
+        };
+        if item(ui, "file-plus", tl!("Add files…")).clicked() {
+            app.combine_dialog();
+            ui.close();
+        }
+        if item(ui, "folder", tl!("Add folder…")).on_hover_text(tl!("Every PDF, image and text file in the folder")).clicked() {
+            app.combine_add_folder(false);
+            ui.close();
+        }
+        if item(ui, "folder-open", tl!("Add folder and subfolders…"))
+            .on_hover_text(tl!("Every PDF, image and text file in the folder and the folders inside it"))
+            .clicked()
+        {
+            app.combine_add_folder(true);
+            ui.close();
+        }
+    });
+}
diff --git a/crates/ui-egui/src/compare_ui.rs b/crates/ui-egui/src/workflows/compare_ui.rs
similarity index 99%
rename from crates/ui-egui/src/compare_ui.rs
rename to crates/ui-egui/src/workflows/compare_ui.rs
index fcaa963278..939d5fed3e 100644
--- a/crates/ui-egui/src/compare_ui.rs
+++ b/crates/ui-egui/src/workflows/compare_ui.rs
@@ -63,7 +63,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
         ui.label(tl!("Old file:"));
         let shown =
             others.iter().find(|(id, _)| Some(*id) == app.compare_old).map_or(tl!("Open the older version first").to_string(), |(_, n)| n.clone());
-        egui::ComboBox::from_id_salt("compare-old").selected_text(shown).width(320.0).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("compare-old").selected_text(shown).width(320.0).show_ui(ui, |ui| {
             for (id, n) in &others {
                 ui.selectable_value(&mut app.compare_old, Some(*id), n);
             }
diff --git a/crates/ui-egui/src/create_multiple_ui.rs b/crates/ui-egui/src/workflows/create_multiple_ui.rs
similarity index 100%
rename from crates/ui-egui/src/create_multiple_ui.rs
rename to crates/ui-egui/src/workflows/create_multiple_ui.rs
diff --git a/crates/ui-egui/src/create_ui.rs b/crates/ui-egui/src/workflows/create_ui.rs
similarity index 100%
rename from crates/ui-egui/src/create_ui.rs
rename to crates/ui-egui/src/workflows/create_ui.rs
diff --git a/crates/ui-egui/src/export_ui.rs b/crates/ui-egui/src/workflows/export_ui.rs
similarity index 93%
rename from crates/ui-egui/src/export_ui.rs
rename to crates/ui-egui/src/workflows/export_ui.rs
index fae075e30b..0af69f1823 100644
--- a/crates/ui-egui/src/export_ui.rs
+++ b/crates/ui-egui/src/workflows/export_ui.rs
@@ -53,7 +53,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: E
     if kind == ExportKind::Image {
         ui.horizontal(|ui| {
             ui.label(tl!("Resolution"));
-            egui::ComboBox::from_id_salt("export-dpi")
+            craft_ui::ComboBox::from_id_salt("export-dpi")
                 .selected_text(crate::i18n::fmt(tl!("{dpi} pixels/inch"), &[("dpi", &d.dpi.to_string())]))
                 .show_ui(ui, |ui| {
                     for dpi in [72.0, 96.0, 150.0, 300.0, 600.0] {
@@ -67,7 +67,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: E
                 ImageFormat::Jpeg { quality } => quality,
                 _ => 85,
             };
-            egui::ComboBox::from_id_salt("export-format").selected_text(d.format.label()).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("export-format").selected_text(d.format.label()).show_ui(ui, |ui| {
                 for f in [ImageFormat::Png, ImageFormat::Jpeg { quality }, ImageFormat::Tiff] {
                     let on = std::mem::discriminant(&d.format) == std::mem::discriminant(&f);
                     if ui.selectable_label(on, f.label()).clicked() {
@@ -93,7 +93,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: E
             let label = move |n: u32| {
                 if n == 0 { tl!("No limit").to_string() } else { crate::i18n::trn(crate::i18n::current(), u64::from(n), "{n} pixel", "{n} pixels") }
             };
-            egui::ComboBox::from_id_salt("export-min").selected_text(label(d.min_side)).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("export-min").selected_text(label(d.min_side)).show_ui(ui, |ui| {
                 for n in [0, 16, 32, 64, 128, 256] {
                     ui.selectable_value(&mut d.min_side, n, label(n));
                 }
@@ -176,12 +176,18 @@ fn run(
         // Handled above.
         ExportKind::AllImages => String::new(),
         ExportKind::Image => {
-            for (k, p) in pages.iter().enumerate() {
-                set(k, None);
-                let result = ex.image(*p, dpi, format).and_then(|img| sink(&format!("{stem}_page_{}.{}", p + 1, format.extension()), img));
-                if let Err(e) = result {
-                    return crate::i18n::fmt(tl!("Export stopped: {e}"), &[("e", &e.to_string())]);
-                }
+            set(0, None);
+            // Pages are drawn several at once and handed over in order: the progress counts the
+            // pages written so far.
+            let mut done = 0;
+            let result = ex.images(&pages, dpi, format, |p, img| {
+                sink(&format!("{stem}_page_{}.{}", p + 1, format.extension()), img)?;
+                done += 1;
+                set(done, None);
+                Ok(())
+            });
+            if let Err(e) = result {
+                return crate::i18n::fmt(tl!("Export stopped: {e}"), &[("e", &e.to_string())]);
             }
             let mut msg = if total == 1 {
                 crate::i18n::fmt(tl!("Exported 1 image"), &[])
diff --git a/crates/ui-egui/src/files.rs b/crates/ui-egui/src/workflows/files.rs
similarity index 100%
rename from crates/ui-egui/src/files.rs
rename to crates/ui-egui/src/workflows/files.rs
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/workflows/js_ui.rs
similarity index 78%
rename from crates/ui-egui/src/js_ui.rs
rename to crates/ui-egui/src/workflows/js_ui.rs
index 49611293ac..0ebdbb07a6 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/workflows/js_ui.rs
@@ -77,9 +77,6 @@ impl PdfCraftApp {
                     };
                     // Show/Hide: a panel already showing closes.
                     self.right = (self.right != Some(panel)).then_some(panel);
-                    if self.right.is_some() {
-                        self.pending_panel_reveals.push(crate::docking::Panel::Inspector);
-                    }
                 }
                 Request::Focus(_) | Request::Beep | Request::Reset(_) => {}
             }
@@ -289,24 +286,66 @@ pub(crate) const PREFERENCES_BUTTON_ROW: f32 = 52.0;
 /// leaves 173 pt): a taller floor would push OK off the screen again.
 pub(crate) const PREFERENCES_MIN_SCROLL: f32 = 60.0;
 
+/// Whether the interface can draw a language picker's native name. On the web the browser's glyph
+/// rasterizer draws scripts no embedded face has, so the native names stay; on native, ask the
+/// fonts this build installed (including an installed fallback face, unless system fonts are off).
+fn picker_text_is_drawable(ui: &egui::Ui, text: &str) -> bool {
+    #[cfg(target_arch = "wasm32")]
+    {
+        let _ = (ui, text);
+        true
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        ui.fonts_mut(|fonts| fonts.has_glyphs(&egui::FontId::proportional(13.0), text))
+    }
+}
+
+/// The date picker's displayed name. Its languages are the interface languages, so it uses the
+/// same drawable-name fallback: a native name whose script this build has no face for would
+/// otherwise abort under egui 0.37's `MissingGlyphPolicy::Panic` (for example Hindi without a
+/// Devanagari face and installed system fonts turned off).
+fn date_language_picker_name(l: &pdfcraft_engine::dates::DateLanguage, drawable: impl FnOnce(&str) -> bool) -> &'static str {
+    match crate::i18n::Lang::from_code(l.code) {
+        Some(language) => language.picker_name(drawable),
+        None => l.name,
+    }
+}
+
 /// Preferences: interface language and size, appearance, identity and JavaScript. Drawn in a scroll
 /// area; [`preferences_buttons`] goes below it, outside the scroll, so OK is always in reach.
 pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
     ui.label(egui::RichText::new(tl!("Preferences")).font(theme::semibold(18.0)));
     ui.horizontal(|ui| {
-        ui.label(tl!("Interface language"));
-        let selected = crate::i18n::Lang::from_code(&app.language).map_or(tl!("Auto"), crate::i18n::Lang::name);
+        let label = ui.label(tl!("Interface language"));
+        // A native name is only drawn when these fonts can draw it; otherwise the English name
+        // keeps the list readable instead of aborting on a missing glyph (for example Hindi
+        // without a Devanagari face, and installed system fonts turned off).
+        let (selected, picker) = {
+            let drawable = |text: &str| picker_text_is_drawable(ui, text);
+            let selected = crate::i18n::Lang::from_code(&app.language)
+                .map_or_else(|| tl!("Auto").to_owned(), |language| language.picker_name(drawable).to_owned());
+            let picker = crate::i18n::Lang::for_picker_by(|language| language.picker_name(drawable))
+                .into_iter()
+                .map(|language| (language, language.picker_name(drawable)))
+                .collect::<Vec<_>>();
+            (selected, picker)
+        };
         let before = app.language.clone();
-        egui::ComboBox::from_id_salt("interface-language").selected_text(selected).show_ui(ui, |ui| {
-            if ui.selectable_value(&mut app.language, crate::i18n::AUTO.to_string(), tl!("Auto")).clicked() {
-                ui.close();
-            }
-            for language in crate::i18n::Lang::for_picker() {
-                if ui.selectable_value(&mut app.language, language.code().to_string(), language.name()).clicked() {
+        craft_ui::ComboBox::from_id_salt("interface-language")
+            .selected_text(selected)
+            .show_ui(ui, |ui| {
+                if ui.selectable_value(&mut app.language, crate::i18n::AUTO.to_string(), tl!("Auto")).clicked() {
                     ui.close();
                 }
-            }
-        });
+                for (language, name) in &picker {
+                    if ui.selectable_value(&mut app.language, language.code().to_string(), *name).clicked() {
+                        ui.close();
+                    }
+                }
+            })
+            .response
+            .labelled_by(label.id);
         // Relabel the rest of this dialog in the new language right away, not next frame.
         if app.language != before {
             crate::i18n::set_current(crate::i18n::Lang::from_pref(&app.language));
@@ -314,24 +353,28 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     });
     ui.horizontal(|ui| {
         use crate::ui_scale;
-        ui.label(tl!("Interface size"));
+        let label = ui.label(tl!("Interface size"));
         // Auto shows the size it draws at: the display's scale times the system's text scale.
         let native = ui.ctx().native_pixels_per_point().unwrap_or(1.0);
         let auto_percent = ui_scale::percent(ui_scale::drawn(None, app.system_text_scale, native));
         let auto = crate::i18n::fmt(tl!("Auto ({percent}%)"), &[("percent", &auto_percent.to_string())]);
         let selected = app.ui_scale.map_or_else(|| auto.clone(), |f| format!("{}%", ui_scale::percent(f)));
-        egui::ComboBox::from_id_salt("interface-size").selected_text(selected).show_ui(ui, |ui| {
-            if ui.selectable_value(&mut app.ui_scale, None, auto).clicked() {
-                ui.close();
-            }
-            for p in ui_scale::PRESETS {
-                let factor = f32::from(p) / 100.0;
-                if ui.selectable_label(app.ui_scale.is_some_and(|f| ui_scale::percent(f) == u32::from(p)), format!("{p}%")).clicked() {
-                    app.ui_scale = Some(factor);
+        craft_ui::ComboBox::from_id_salt("interface-size")
+            .selected_text(selected)
+            .show_ui(ui, |ui| {
+                if ui.selectable_value(&mut app.ui_scale, None, auto).clicked() {
                     ui.close();
                 }
-            }
-        });
+                for p in ui_scale::PRESETS {
+                    let factor = f32::from(p) / 100.0;
+                    if ui.selectable_label(app.ui_scale.is_some_and(|f| ui_scale::percent(f) == u32::from(p)), format!("{p}%")).clicked() {
+                        app.ui_scale = Some(factor);
+                        ui.close();
+                    }
+                }
+            })
+            .response
+            .labelled_by(label.id);
     });
     ui.label(
         egui::RichText::new(tl!("Auto follows the system's text size. Pages always render at the display's full resolution."))
@@ -340,16 +383,12 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     );
     ui.horizontal(|ui| {
         ui.label(tl!("Tools panel side"));
-        let right = app.docking.tools_on_right();
-        if ui.selectable_label(!right, tl!("Left")).clicked()
-            && let Err(error) = app.docking.set_tools_on_right(false)
-        {
-            app.notify(error);
+        let right = app.side_panels.tools_on_right();
+        if ui.selectable_label(!right, tl!("Left")).clicked() {
+            app.side_panels.tools_side = crate::side_panels::ToolsSide::Left;
         }
-        if ui.selectable_label(right, tl!("Right")).clicked()
-            && let Err(error) = app.docking.set_tools_on_right(true)
-        {
-            app.notify(error);
+        if ui.selectable_label(right, tl!("Right")).clicked() {
+            app.side_panels.tools_side = crate::side_panels::ToolsSide::Right;
         }
     });
     ui.add_space(8.0);
@@ -444,38 +483,42 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     // is app-wide: every open document follows it, and documents open with it.
     ui.label(egui::RichText::new(tl!("Reading colours")).font(theme::semibold(13.0)));
     ui.horizontal(|ui| {
-        ui.label(tl!("Replace document colours"));
+        let label = ui.label(tl!("Replace document colours"));
         let mode = app.reading_colors.mode_name();
-        egui::ComboBox::from_id_salt("reading-colors").selected_text(tl!(reading_mode_label(mode))).show_ui(ui, |ui| {
-            for (m, label) in [
-                ("off", "Off"),
-                ("black-on-white", "Black on white"),
-                ("white-on-black", "White on black"),
-                ("yellow-on-black", "Yellow on black"),
-                ("green-on-black", "Green on black"),
-                ("custom", "Custom"),
-            ] {
-                if ui.selectable_label(mode == m, tl!(label)).clicked() {
-                    match m {
-                        "off" => app.set_reading_colors(pdfcraft_render::ReadingColors::default()),
-                        "custom" => {
-                            // Custom starts from the colours already chosen, or black on white.
-                            let colors = app.reading_colors.params.map_or(pdfcraft_render::ReadingColors::BLACK_ON_WHITE, |params| {
-                                pdfcraft_render::ReadingColors { params: Some(params) }
-                            });
-                            app.set_reading_colors(colors);
-                        }
-                        // `parse` knows these names; a preset comes with its own flags.
-                        preset => {
-                            if let Ok(colors) = pdfcraft_render::ReadingColors::parse(preset, None, None, None, None) {
+        craft_ui::ComboBox::from_id_salt("reading-colors")
+            .selected_text(tl!(reading_mode_label(mode)))
+            .show_ui(ui, |ui| {
+                for (m, label) in [
+                    ("off", "Off"),
+                    ("black-on-white", "Black on white"),
+                    ("white-on-black", "White on black"),
+                    ("yellow-on-black", "Yellow on black"),
+                    ("green-on-black", "Green on black"),
+                    ("custom", "Custom"),
+                ] {
+                    if ui.selectable_label(mode == m, tl!(label)).clicked() {
+                        match m {
+                            "off" => app.set_reading_colors(pdfcraft_render::ReadingColors::default()),
+                            "custom" => {
+                                // Custom starts from the colours already chosen, or black on white.
+                                let colors = app.reading_colors.params.map_or(pdfcraft_render::ReadingColors::BLACK_ON_WHITE, |params| {
+                                    pdfcraft_render::ReadingColors { params: Some(params) }
+                                });
                                 app.set_reading_colors(colors);
                             }
+                            // `parse` knows these names; a preset comes with its own flags.
+                            preset => {
+                                if let Ok(colors) = pdfcraft_render::ReadingColors::parse(preset, None, None, None, None) {
+                                    app.set_reading_colors(colors);
+                                }
+                            }
                         }
+                        ui.close();
                     }
-                    ui.close();
                 }
-            }
-        });
+            })
+            .response
+            .labelled_by(label.id);
     });
     if app.reading_colors.params.is_some() {
         let mut changed = false;
@@ -547,7 +590,7 @@ fn date_format(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
         let label = ui.label(tl!("Fill & Sign dates"));
         let current = app.session.date_format().to_string();
         let selected = if DATE_FORMATS.contains(&current.as_str()) { sample(app, &current) } else { tl!("Custom").to_string() };
-        egui::ComboBox::from_id_salt("date-format")
+        craft_ui::ComboBox::from_id_salt("date-format")
             .selected_text(selected)
             .width(240.0)
             .show_ui(ui, |ui| {
@@ -595,20 +638,29 @@ fn date_format(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
     }
     ui.horizontal(|ui| {
         let label = ui.label(tl!("Language"));
-        let interface = crate::i18n::current().name();
-        let follow = crate::i18n::fmt(tl!("Same as interface ({language})"), &[("language", interface)]);
-        let current = app.session.date_language().map(str::to_string);
-        let selected = DATE_LANGUAGES.iter().find(|l| current.as_deref() == Some(l.code)).map_or(follow.clone(), |l| l.name.to_string());
-        egui::ComboBox::from_id_salt("date-language")
+        // Build every label before the combo box mutably borrows `ui`, with the same drawable
+        // fallback the interface language picker uses.
+        let (follow, selected, current, names) = {
+            let drawable = |text: &str| picker_text_is_drawable(ui, text);
+            let interface = crate::i18n::current().picker_name(drawable);
+            let follow = crate::i18n::fmt(tl!("Same as interface ({language})"), &[("language", interface)]);
+            let current = app.session.date_language().map(str::to_string);
+            let selected = DATE_LANGUAGES
+                .iter()
+                .find(|l| current.as_deref() == Some(l.code))
+                .map_or_else(|| follow.clone(), |l| date_language_picker_name(l, drawable).to_string());
+            let names = DATE_LANGUAGES.iter().map(|l| (l, date_language_picker_name(l, drawable))).collect::<Vec<_>>();
+            (follow, selected, current, names)
+        };
+        craft_ui::ComboBox::from_id_salt("date-language")
             .selected_text(selected)
             .width(240.0)
             .show_ui(ui, |ui| {
                 if ui.selectable_label(current.is_none(), follow).clicked() && app.session.set_date_language(None).is_ok() {
                     ui.close();
                 }
-                for l in &DATE_LANGUAGES {
-                    if ui.selectable_label(current.as_deref() == Some(l.code), l.name).clicked()
-                        && app.session.set_date_language(Some(l.code)).is_ok()
+                for (l, name) in &names {
+                    if ui.selectable_label(current.as_deref() == Some(l.code), *name).clicked() && app.session.set_date_language(Some(l.code)).is_ok()
                     {
                         ui.close();
                     }
@@ -626,3 +678,21 @@ fn date_format(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
         .color(t.text_muted),
     );
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn date_language_names_fall_back_when_the_native_name_cannot_be_drawn() {
+        let date_language = |code: &str| pdfcraft_engine::dates::DATE_LANGUAGES.iter().find(|l| l.code == code).expect("date language");
+        let hindi = date_language("hi");
+        assert_eq!(date_language_picker_name(hindi, |_| true), hindi.name, "the native name is kept when it can be drawn");
+        assert_eq!(date_language_picker_name(hindi, |_| false), "Hindi", "no Devanagari face: show the English name");
+        let chinese = date_language("zh-hans");
+        assert_eq!(date_language_picker_name(chinese, |_| false), "Simplified Chinese");
+        for language in &pdfcraft_engine::dates::DATE_LANGUAGES {
+            assert!(!date_language_picker_name(language, |_| false).is_empty(), "{}", language.code);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/ocr_ui.rs b/crates/ui-egui/src/workflows/ocr_ui.rs
similarity index 98%
rename from crates/ui-egui/src/ocr_ui.rs
rename to crates/ui-egui/src/workflows/ocr_ui.rs
index 977f90f2f9..04e257d52d 100644
--- a/crates/ui-egui/src/ocr_ui.rs
+++ b/crates/ui-egui/src/workflows/ocr_ui.rs
@@ -121,21 +121,21 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
         egui::Grid::new("ocr-settings").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
             ui.label(tl!("Document language"));
             let name = LANGUAGES.iter().find(|l| l.0 == d.language).map_or("English", |l| l.1);
-            egui::ComboBox::from_id_salt("ocr-language").selected_text(tl!(name)).width(220.0).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("ocr-language").selected_text(tl!(name)).width(220.0).show_ui(ui, |ui| {
                 for (code, name) in LANGUAGES {
                     ui.selectable_value(&mut d.language, (*code).to_string(), tl!(*name));
                 }
             });
             ui.end_row();
             ui.label(tl!("Output"));
-            egui::ComboBox::from_id_salt("ocr-output").selected_text(tl!("Searchable Image (Exact)")).width(220.0).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("ocr-output").selected_text(tl!("Searchable Image (Exact)")).width(220.0).show_ui(ui, |ui| {
                 let _ = ui
                     .selectable_label(true, tl!("Searchable Image (Exact)"))
                     .on_hover_text(tl!("Adds invisible text over each word; the page image is not changed"));
             });
             ui.end_row();
             ui.label(tl!("Downsample to"));
-            egui::ComboBox::from_id_salt("ocr-dpi").selected_text(format!("{} dpi", d.dpi)).width(220.0).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt("ocr-dpi").selected_text(format!("{} dpi", d.dpi)).width(220.0).show_ui(ui, |ui| {
                 for v in [600, 300, 150, 72] {
                     ui.selectable_value(&mut d.dpi, v, format!("{v} dpi"));
                 }
diff --git a/crates/ui-egui/src/optimize_ui.rs b/crates/ui-egui/src/workflows/optimize_ui.rs
similarity index 92%
rename from crates/ui-egui/src/optimize_ui.rs
rename to crates/ui-egui/src/workflows/optimize_ui.rs
index d5db11dd0a..693d8c43d6 100644
--- a/crates/ui-egui/src/optimize_ui.rs
+++ b/crates/ui-egui/src/workflows/optimize_ui.rs
@@ -7,7 +7,7 @@
 
 use std::sync::{Arc, Mutex};
 
-use egui::{Align, Layout};
+use egui::{Align, Layout, RichText};
 use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, Preset, QUALITIES, Settings};
 use pdfcraft_engine::optimizer::{OptimizeStage, Optimized};
 use pdfcraft_engine::{DocId, EditError, Hidden, OptimizeReport};
@@ -121,7 +121,7 @@ fn image_row(ui: &mut egui::Ui, id: &str, title: &str, s: &mut ImageSettings) {
             Compression::Flate => tl!("ZIP"),
             Compression::Retain => tl!("Retain existing"),
         };
-        egui::ComboBox::from_id_salt((id, "compression")).selected_text(label).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt((id, "compression")).selected_text(label).show_ui(ui, |ui| {
             let q = match s.compression {
                 Compression::Jpeg(q) => q,
                 _ => 60,
@@ -133,7 +133,7 @@ fn image_row(ui: &mut egui::Ui, id: &str, title: &str, s: &mut ImageSettings) {
         if let Compression::Jpeg(q) = &mut s.compression {
             ui.label(tl!("Quality"));
             let name = QUALITIES.iter().min_by_key(|(_, v)| (*v as i32 - *q as i32).abs()).map_or(tl!("Medium"), |(n, _)| tl!(n));
-            egui::ComboBox::from_id_salt((id, "quality")).selected_text(name).show_ui(ui, |ui| {
+            craft_ui::ComboBox::from_id_salt((id, "quality")).selected_text(name).show_ui(ui, |ui| {
                 for (n, v) in QUALITIES {
                     ui.selectable_value(q, v, tl!(n));
                 }
@@ -165,7 +165,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (boo
             Preset::Mobile => tl!("Mobile"),
         };
         let current = Preset::of(&d.settings);
-        egui::ComboBox::from_id_salt("optimize-preset").selected_text(current.map_or(tl!("Custom"), name)).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("optimize-preset").selected_text(current.map_or(tl!("Custom"), name)).show_ui(ui, |ui| {
             for p in Preset::ALL {
                 if ui.selectable_label(current == Some(p), name(p)).clicked() {
                     d.settings = p.settings();
@@ -178,7 +178,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (boo
             Compatibility::Retain => tl!("Retain existing").to_string(),
             _ => format!("PDF {}", c.name()),
         };
-        egui::ComboBox::from_id_salt("optimize-compatibility").selected_text(compat_label(d.settings.compatibility)).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("optimize-compatibility").selected_text(compat_label(d.settings.compatibility)).show_ui(ui, |ui| {
             for c in Compatibility::ALL {
                 ui.selectable_value(&mut d.settings.compatibility, c, compat_label(c));
             }
@@ -268,9 +268,19 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (boo
 /// Audit Space Usage: how the file's bytes are spent now, by kind of content (not what
 /// optimizing would save).
 pub(crate) fn audit_body(ui: &mut egui::Ui, rows: &[pdfcraft_engine::optimize::SpaceUse], t: &Tokens) -> bool {
-    use egui::{RichText, TextWrapMode, WidgetText};
     ui.label(RichText::new(tl!("Space Audit")).font(crate::theme::semibold(18.0)));
     ui.add_space(4.0);
+    audit_table(ui, rows, t);
+    ui.add_space(12.0);
+    let mut ok = false;
+    ui.horizontal(|ui| ui.with_layout(Layout::right_to_left(Align::Center), |ui| ok = widgets::pill_button(ui, tl!("OK"), true).clicked()));
+    ok
+}
+
+/// The audit's explanation and its table: bytes and share of the file per kind of content.
+/// Shared by the Optimizer's Audit Space Usage and Properties ▸ Space Audit.
+pub(crate) fn audit_table(ui: &mut egui::Ui, rows: &[pdfcraft_engine::optimize::SpaceUse], t: &Tokens) {
+    use egui::{TextWrapMode, WidgetText};
     ui.label(RichText::new(tl!("What takes up the space in this file, by kind of content.")).color(t.text_muted));
     ui.add_space(8.0);
     // Every cell is laid out first so each column can be exactly as wide as its widest cell. A
@@ -301,7 +311,9 @@ pub(crate) fn audit_body(ui: &mut egui::Ui, rows: &[pdfcraft_engine::optimize::S
     let numbers = width(1) + width(2) + 2.0 * gap;
     let widths = [width(0).max(ui.available_width() - numbers), width(1), width(2)];
     let height = table.iter().flatten().map(|g| g.size().y).fold(ui.spacing().interact_size.y, f32::max);
-    egui::Grid::new("space-audit").num_columns(3).striped(true).spacing([gap, 4.0]).show(ui, |ui| {
+    // No minimum column width: egui's default widened a narrow Bytes column past `widths` and
+    // pushed the table beyond the dialog's padding.
+    egui::Grid::new("space-audit").num_columns(3).striped(true).spacing([gap, 4.0]).min_col_width(0.0).show(ui, |ui| {
         for row in table {
             for (column, (cell, width)) in row.into_iter().zip(widths).enumerate() {
                 // Numbers line up on their last digit.
@@ -312,13 +324,25 @@ pub(crate) fn audit_body(ui: &mut egui::Ui, rows: &[pdfcraft_engine::optimize::S
             ui.end_row();
         }
     });
-    ui.add_space(12.0);
-    let mut ok = false;
-    ui.horizontal(|ui| ui.with_layout(Layout::right_to_left(Align::Center), |ui| ok = widgets::pill_button(ui, tl!("OK"), true).clicked()));
-    ok
 }
 
 impl PdfCraftApp {
+    /// Measure the active document's space use, unless `space_audit` already describes it as
+    /// it is now. With no document the audit is empty.
+    pub(crate) fn refresh_space_audit(&mut self) {
+        let Some((_, id)) = self.active_ids() else {
+            self.space_audit.clear();
+            self.space_audit_of = None;
+            return;
+        };
+        let Some(doc) = self.session.get(id) else { return };
+        let key = (id, doc.edit_generation());
+        if self.space_audit_of != Some(key) {
+            self.space_audit = doc.audit_space();
+            self.space_audit_of = Some(key);
+        }
+    }
+
     /// Optimize PDF with the dialog's choices on a worker thread; the copy is saved when done.
     pub fn optimize_with_draft(&mut self) {
         let (settings, discard) = (self.optimize_draft.settings.clone(), self.optimize_draft.discard.clone());
diff --git a/crates/ui-egui/src/workflows/print_ui.rs b/crates/ui-egui/src/workflows/print_ui.rs
new file mode 100644
index 0000000000..9145256297
--- /dev/null
+++ b/crates/ui-egui/src/workflows/print_ui.rs
@@ -0,0 +1,786 @@
+//! The Print dialog (Acrobat's File ▸ Print, execution plan M10.5): printer, copies, grayscale;
+//! pages to print (all, current, range with labels, the selected pages; odd/even, reverse); page sizing & handling
+//! (Size, Poster, Multiple, Booklet); orientation; comments & forms; and a live preview of the
+//! sheets. Printing sends the print-ready PDF to the system spooler; "Save as PDF" writes it.
+
+use egui::{Color32, Pos2, Rect, Stroke, pos2, vec2};
+use pdfcraft_engine::print::{self, Binding, BookletSubset, Content, Layout, Orientation, PAPERS, PageOrder, SizeMode, Subset, spool};
+
+use crate::theme::{self, Tokens};
+use crate::{PdfCraftApp, widgets};
+
+mod body;
+mod draft;
+
+pub(crate) use body::body;
+pub use draft::{Handling, PrintDraft, Which};
+
+/// The preview pane, and the paper inside it (12 pt inset on each side).
+const PREVIEW_W: f32 = 320.0;
+const PREVIEW_H: f32 = 380.0;
+const PREVIEW_INSET: f32 = 12.0;
+pub(crate) const PREVIEW_BOX: (f32, f32) = (PREVIEW_W - 2.0 * PREVIEW_INSET, PREVIEW_H - 2.0 * PREVIEW_INSET);
+/// Label printing reads the printed area of at most this many pages (each is a quick render on
+/// the UI thread); further pages print whole.
+pub(crate) const LABEL_CROP_PAGES: usize = 50;
+
+/// Lists the printers off the UI thread (the desktop app sets [`PdfCraftApp::printer_source`]):
+/// on Windows each driver's capabilities are read for its two-sided support, and CUPS' driverless discovery can wait on
+/// the network. Without a source the dialog reads them as it opens, so tests stay deterministic.
+pub type PrinterSource = std::sync::Arc<dyn Fn() -> Vec<spool::Printer> + Send + Sync>;
+
+/// Where a printer's driver options come from: the spooler's (`spool::printer_options_in`, in the
+/// UI language) unless a test stands in. Called off the GUI thread.
+pub type OptionsSource = std::sync::Arc<dyn Fn(&str) -> Vec<spool::PrinterOption> + Send + Sync>;
+
+/// The system spooler's printers, as the desktop app's [`PrinterSource`].
+pub fn system_printers() -> PrinterSource {
+    std::sync::Arc::new(spool::printers)
+}
+
+/// The Print dialog's work in the background: the printer list being read, and the jobs being
+/// spooled, oldest first.
+#[derive(Default)]
+pub(crate) struct PrintTasks {
+    #[cfg(not(target_arch = "wasm32"))]
+    printers: Option<std::sync::mpsc::Receiver<Vec<spool::Printer>>>,
+    #[cfg(not(target_arch = "wasm32"))]
+    jobs: Vec<PrintJob>,
+    /// The progress card is showing a print job (it is shared with other long jobs).
+    #[cfg(not(target_arch = "wasm32"))]
+    showing_progress: bool,
+    /// The driver options being read, per printer (`read_options_in_background`).
+    #[cfg(not(target_arch = "wasm32"))]
+    options: Vec<(String, std::sync::mpsc::Receiver<Vec<spool::PrinterOption>>)>,
+    /// The browser print being drawn, a sheet a frame (`web_print`).
+    #[cfg(target_arch = "wasm32")]
+    web_job: Option<crate::web_print::WebPrintJob>,
+    /// What went wrong after the browser print page was handed over, with the print-ready PDF
+    /// to download instead.
+    #[cfg(target_arch = "wasm32")]
+    web_failed: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
+    /// The last browser print's PDF and name, for that fallback.
+    #[cfg(target_arch = "wasm32")]
+    web_last: Option<(String, std::sync::Arc<Vec<u8>>)>,
+}
+
+/// The printers to offer when no [`PrinterSource`] is set: the spooler's, or in a browser its
+/// print dialog.
+fn listed_printers() -> Vec<spool::Printer> {
+    #[cfg(target_arch = "wasm32")]
+    {
+        vec![spool::Printer { name: crate::web_print::BROWSER_PRINTER.to_string(), default: true, two_sided: None, description: String::new() }]
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        spool::printers()
+    }
+}
+
+/// The first list is still being read and the user hasn't chosen yet (#160): no printer is
+/// selected only because none is known yet, so the dialog says it is looking rather than
+/// offering Save as PDF, and its button waits. Printing then would have saved a PDF.
+fn still_looking(d: &PrintDraft) -> bool {
+    d.printers_loading && d.printer.is_none() && !d.printer_picked
+}
+
+/// A printer's name as the dialog shows it.
+fn printer_label(name: &str) -> String {
+    if name == crate::web_print::BROWSER_PRINTER { crate::web_print::browser_printer_label().to_string() } else { name.to_string() }
+}
+
+/// A job being spooled: its printer, the sheets sent so far of how many, and its worker's news.
+#[cfg(not(target_arch = "wasm32"))]
+struct PrintJob {
+    printer: String,
+    sheets: Option<(usize, usize)>,
+    news: std::sync::mpsc::Receiver<JobNews>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+enum JobNews {
+    /// `(sent, sheets)`: the spooler has this many of the job's sheets.
+    Sent(usize, usize),
+    /// The spooler's answer.
+    Done(Result<String, String>),
+}
+
+/// The printer the dialog preselects: the system default, else the first.
+fn default_printer(printers: &[spool::Printer]) -> Option<String> {
+    printers.iter().find(|p| p.default).or(printers.first()).map(|p| p.name.clone())
+}
+
+/// Whether `printer` can still be chosen from `printers`: Save as PDF (`None`) always can.
+fn offered(printer: Option<&str>, printers: &[spool::Printer]) -> bool {
+    printer.is_none_or(|name| printers.iter().any(|p| p.name == name))
+}
+
+/// Asks for a frame when a worker thread ends, also when it panics: [`PdfCraftApp::poll_print`]
+/// then sees the answer, or the disconnected channel of a worker that died, without waiting
+/// for some other event to draw (#2108 review). Declared before the worker's sender, so the
+/// sender is dropped first and the frame finds the channel closed.
+#[cfg(not(target_arch = "wasm32"))]
+struct WakeOnExit(Option<egui::Context>);
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Drop for WakeOnExit {
+    fn drop(&mut self) {
+        if let Some(ctx) = &self.0 {
+            ctx.request_repaint();
+        }
+    }
+}
+
+impl PdfCraftApp {
+    pub fn open_print(&mut self) {
+        let Some((i, _)) = self.active_ids() else { return };
+        let (printers, printers_loading) = match self.printer_source.clone() {
+            // The list from the last time the dialog opened, until the fresh one arrives.
+            #[cfg(not(target_arch = "wasm32"))]
+            Some(source) => {
+                self.list_printers_in_background(source);
+                (self.print_draft.printers.clone(), true)
+            }
+            _ => (listed_printers(), false),
+        };
+        let default = default_printer(&printers);
+        let current = self.views[i].current;
+        let selected: Vec<usize> = self.views[i].selected.iter().copied().collect();
+        let keep = std::mem::take(&mut self.print_draft);
+        // The printer picked last time, Save as PDF included, while it is still listed (#3537).
+        let picked = keep.printer_picked && offered(keep.printer.as_deref(), &printers);
+        let printer = if picked { keep.printer.clone() } else { default };
+        // Picked pages are what Print is for (Acrobat's "Selected pages"); without any, a choice
+        // left over from another document falls back to the whole document.
+        let which = match (selected.is_empty(), keep.which) {
+            (false, _) => Which::Selected,
+            (true, Which::Selected) => Which::All,
+            (true, other) => other,
+        };
+        self.print_draft = PrintDraft {
+            crops: Vec::new(),
+            crop_pages: None,
+            printers,
+            printers_loading,
+            printer_picked: picked,
+            units: self.units,
+            printer,
+            current_page: current,
+            sheet: 0,
+            selected,
+            which,
+            ..keep
+        };
+        self.dialog = Some(crate::Dialog::Print);
+    }
+
+    /// Label printing: find each printed page's printed area (a quick low-resolution render, as
+    /// Fit Visible does) and which way its text runs. Only the pages being printed are read, at
+    /// most [`LABEL_CROP_PAGES`] of them (the rest print whole); read again when they change.
+    pub(crate) fn read_label_crops(&mut self, id: pdfcraft_engine::DocId) {
+        let Some(doc) = self.session.get(id) else { return };
+        let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
+        let mut pages = self.print_draft.settings(doc.info.pages.len(), &labels).map(|s| s.pages).unwrap_or_default();
+        pages.sort_unstable();
+        pages.dedup();
+        pages.truncate(LABEL_CROP_PAGES);
+        if self.print_draft.crop_pages.as_ref() == Some(&pages) {
+            return;
+        }
+        let up = self.session.print_text_up(id, &pages);
+        let config = pdfcraft_render::RenderConfig { password: doc.password.as_deref().map(std::sync::Arc::from), ..Default::default() };
+        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), config);
+        self.print_draft.crops = doc
+            .info
+            .pages
+            .iter()
+            .enumerate()
+            .map(|(page, p)| {
+                let (w, h) = (f64::from(p.width), f64::from(p.height));
+                if pages.binary_search(&page).is_err() || w <= 0.0 || h <= 0.0 {
+                    return None;
+                }
+                let out = r.render(pdfcraft_render::RenderRequest {
+                    page,
+                    kind: pdfcraft_render::RequestKind::Pixels,
+                    tile: None,
+                    scale: (1000.0 / w.max(h) as f32).clamp(0.1, 4.0),
+                    tag: 0,
+                    preview: false,
+                });
+                let [u0, v0, u1, v1] = crate::zoom_snap::ink_bounds(out.width as usize, out.height as usize, &out.rgba)?;
+                // Image rows run down from the top; display space runs up. Half a millimetre of slack.
+                let pad = 1.5;
+                let rect = [f64::from(u0) * w - pad, (1.0 - f64::from(v1)) * h - pad, f64::from(u1) * w + pad, (1.0 - f64::from(v0)) * h + pad];
+                Some(print::Crop { rect, text_up: up.get(page).copied().unwrap_or(false) })
+            })
+            .collect();
+        self.print_draft.crop_pages = Some(pages);
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn list_printers_in_background(&mut self, source: PrinterSource) {
+        // A list already being read is as fresh as a new one would be.
+        if self.print_tasks.printers.is_some() {
+            return;
+        }
+        let (tx, rx) = std::sync::mpsc::channel();
+        let wake = WakeOnExit(self.ctx.clone());
+        std::thread::spawn(move || {
+            let _wake = wake;
+            let tx = tx;
+            // The receiver may be gone (the app quit): nothing to report to then.
+            let _ = tx.send(source());
+        });
+        self.print_tasks.printers = Some(rx);
+    }
+
+    /// Read `printer`'s driver options off the GUI thread (#1818); `poll_print` picks them up.
+    /// A read already under way for the same printer is left to finish.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn read_options_in_background(&mut self, printer: String) {
+        if self.print_tasks.options.iter().any(|(p, _)| *p == printer) {
+            return;
+        }
+        let source: OptionsSource = self.options_source.clone().unwrap_or_else(|| {
+            // The driver's own names in the UI language, as it is when Properties… is clicked.
+            let lang = crate::i18n::current().code();
+            std::sync::Arc::new(move |p: &str| spool::printer_options_in(p, lang))
+        });
+        let (tx, rx) = std::sync::mpsc::channel();
+        let wake = WakeOnExit(self.ctx.clone());
+        let name = printer.clone();
+        let spawned = std::thread::Builder::new().name("printer options".into()).spawn(move || {
+            let _wake = wake;
+            let tx = tx;
+            // The receiver may be gone (the app quit): nothing to report to then.
+            let _ = tx.send(source(&name));
+        });
+        match spawned {
+            Ok(_) => self.print_tasks.options.push((printer, rx)),
+            // No thread to read them on: the printer offers nothing this time.
+            Err(_) => self.receive_options(printer, Vec::new()),
+        }
+    }
+
+    /// The options read for `printer` arrived, or the read died. A read that a later click
+    /// superseded (another printer's is awaited) is dropped.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn receive_options(&mut self, printer: String, options: Vec<spool::PrinterOption>) {
+        let d = &mut self.print_draft;
+        if d.driver_options_loading.as_deref() == Some(printer.as_str()) {
+            d.driver_options_loading = None;
+            d.driver_options = Some((printer, options));
+        }
+    }
+
+    /// Pick up a printer list, driver options or a spooled job that finished (each frame).
+    pub(crate) fn poll_print(&mut self) {
+        #[cfg(target_arch = "wasm32")]
+        self.poll_web_print();
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            if let Some(printer) = self.print_draft.read_options_for.take() {
+                self.read_options_in_background(printer);
+            }
+            let mut arrived = Vec::new();
+            self.print_tasks.options.retain(|(printer, rx)| match rx.try_recv() {
+                Ok(options) => {
+                    arrived.push((printer.clone(), options));
+                    false
+                }
+                Err(std::sync::mpsc::TryRecvError::Empty) => true,
+                // A read that died offers nothing; the panel says so rather than wait.
+                Err(std::sync::mpsc::TryRecvError::Disconnected) => {
+                    arrived.push((printer.clone(), Vec::new()));
+                    false
+                }
+            });
+            for (printer, options) in arrived {
+                self.receive_options(printer, options);
+            }
+            if let Some(rx) = &self.print_tasks.printers {
+                let printers = match rx.try_recv() {
+                    Ok(p) => Some(p),
+                    Err(std::sync::mpsc::TryRecvError::Empty) => None,
+                    // A source that died lists nothing new; the dialog keeps what it has.
+                    Err(std::sync::mpsc::TryRecvError::Disconnected) => Some(self.print_draft.printers.clone()),
+                };
+                if let Some(printers) = printers {
+                    self.print_tasks.printers = None;
+                    let d = &mut self.print_draft;
+                    // A picked printer that is no longer listed falls back to the default too.
+                    if !d.printer_picked || !offered(d.printer.as_deref(), &printers) {
+                        d.printer_picked = false;
+                        d.printer = default_printer(&printers);
+                    }
+                    d.printers = printers;
+                    d.printers_loading = false;
+                }
+            }
+            let mut finished = Vec::new();
+            self.print_tasks.jobs.retain_mut(|job| {
+                loop {
+                    match job.news.try_recv() {
+                        Ok(JobNews::Sent(sent, sheets)) => job.sheets = Some((sent, sheets)),
+                        Ok(JobNews::Done(r)) => {
+                            finished.push((job.printer.clone(), r));
+                            break false;
+                        }
+                        Err(std::sync::mpsc::TryRecvError::Empty) => break true,
+                        Err(std::sync::mpsc::TryRecvError::Disconnected) => {
+                            finished.push((job.printer.clone(), Err("the print job stopped unexpectedly".into())));
+                            break false;
+                        }
+                    }
+                }
+            });
+            self.show_print_progress();
+            for (printer, result) in finished {
+                self.report_print_job(&printer, result);
+            }
+        }
+    }
+
+    /// The oldest job being spooled on the progress card, counting its sheets as they reach the
+    /// spooler, while no other long job holds the card.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn show_print_progress(&mut self) {
+        let Some(job) = self.print_tasks.jobs.first() else {
+            if std::mem::take(&mut self.print_tasks.showing_progress) {
+                self.progress_notice = None;
+            }
+            return;
+        };
+        if self.progress_notice.is_some() && !self.print_tasks.showing_progress {
+            return;
+        }
+        let printer = job.printer.as_str();
+        let (label, fraction) = match job.sheets {
+            Some((sent, sheets)) if sheets > 0 => {
+                // The sheet on its way: one past those sent, until the last is.
+                let sheet = sent.saturating_add(1).min(sheets).to_string();
+                let label = crate::i18n::fmt(
+                    tl!("Sending sheet {s} of {n} to {printer}…"),
+                    &[("s", &sheet), ("n", &sheets.to_string()), ("printer", printer)],
+                );
+                (label, sent as f32 / sheets as f32)
+            }
+            _ => (crate::i18n::fmt(tl!("Sending to {printer}…"), &[("printer", printer)]), 0.0),
+        };
+        self.progress_notice = Some(crate::widgets::ProgressNotice { label, fraction, cancellable: false });
+        self.print_tasks.showing_progress = true;
+        // The bar's sweep keeps moving between sheets.
+        if let Some(ctx) = &self.ctx {
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+    }
+
+    fn report_print_job(&mut self, printer: &str, result: Result<String, String>) {
+        match result {
+            Ok(msg) if msg.is_empty() => self.notify(crate::i18n::fmt(tl!("Sent to {printer}"), &[("printer", printer)])),
+            Ok(msg) => self.notify(crate::i18n::fmt(tl!("Sent to {printer}: {msg}"), &[("printer", printer), ("msg", &msg)])),
+            Err(e) => self.notify_error(e),
+        }
+    }
+
+    /// Print (or save) with the dialog's settings. Returns `true` on success. Save as PDF without
+    /// a preset path returns `true` once the save picker is showing; the file is written on a
+    /// later frame, when the user has chosen where.
+    pub fn print_now(&mut self) -> bool {
+        // What's typed in a form field is part of what's printed (#166).
+        if !self.commit_form_typing() {
+            return false;
+        }
+        let Some((_, id)) = self.active_ids() else { return false };
+        let Some(doc) = self.session.get(id) else { return false };
+        let labels: Vec<String> = doc.info.pages.iter().map(|p| p.label.clone()).collect();
+        let settings = match self.print_draft.settings(doc.info.pages.len(), &labels) {
+            Ok(s) => s,
+            Err(e) => {
+                self.notify_tr(&e);
+                return false;
+            }
+        };
+        let name = doc.name.clone();
+        let bytes = match self.session.print_pdf(id, &settings) {
+            Ok(b) => b,
+            Err(e) => {
+                self.notify_error(e);
+                return false;
+            }
+        };
+        match self.print_draft.printer.clone() {
+            #[cfg(target_arch = "wasm32")]
+            Some(printer) if printer == crate::web_print::BROWSER_PRINTER => {
+                let sizes: Vec<(f64, f64)> = doc.info.pages.iter().map(|p| (f64::from(p.width), f64::from(p.height))).collect();
+                match print::layout(&sizes, &settings) {
+                    Ok(sheets) => self.print_in_browser(name, bytes, sheets.iter().map(|s| s.size).collect()),
+                    Err(e) => {
+                        self.notify_error(e);
+                        false
+                    }
+                }
+            }
+            Some(printer) => self.send_to_printer(printer, bytes, self.print_draft.job(&name)),
+            None => self.save_print_pdf(&name, bytes),
+        }
+    }
+
+    /// Spool a job off the UI thread: on Windows every sheet is rendered at the printer's
+    /// resolution first, which can take minutes for a long document. The dialog closes at once,
+    /// the progress card counts the sheets as they reach the spooler, and the spooler's answer
+    /// arrives as a notice.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn send_to_printer(&mut self, printer: String, bytes: Vec<u8>, job: spool::Job) -> bool {
+        let (tx, rx) = std::sync::mpsc::channel();
+        let ctx = self.ctx.clone();
+        std::thread::spawn(move || {
+            let repaint = || {
+                if let Some(ctx) = &ctx {
+                    ctx.request_repaint();
+                }
+            };
+            // The receiver may be gone (the app quit): nothing to report to then.
+            let result = spool::submit_with_progress(&bytes, &job, &mut |sent, sheets| {
+                let _ = tx.send(JobNews::Sent(sent, sheets));
+                repaint();
+            });
+            let _ = tx.send(JobNews::Done(result.map_err(|e| e.to_string())));
+            repaint();
+        });
+        self.print_tasks.jobs.push(PrintJob { printer, sheets: None, news: rx });
+        self.show_print_progress();
+        true
+    }
+
+    /// A browser has no spooler: `submit` answers at once.
+    #[cfg(target_arch = "wasm32")]
+    fn send_to_printer(&mut self, printer: String, bytes: Vec<u8>, job: spool::Job) -> bool {
+        let result = spool::submit(&bytes, &job).map_err(|e| e.to_string());
+        let ok = result.is_ok();
+        self.report_print_job(&printer, result);
+        ok
+    }
+
+    /// Print through the browser's print dialog: start drawing `sheets` (the pages of the
+    /// print-ready `bytes`), a sheet a frame in [`PdfCraftApp::poll_print`]. A print still being
+    /// prepared is replaced. The dialog closes at once.
+    #[cfg(target_arch = "wasm32")]
+    fn print_in_browser(&mut self, name: String, bytes: Vec<u8>, sheets: Vec<(f64, f64)>) -> bool {
+        match crate::web_print::WebPrintJob::new(bytes, sheets, name) {
+            Ok(job) => {
+                let n = job.total().to_string();
+                self.print_tasks.web_job = Some(job);
+                self.notify_fmt("Preparing {n} sheets for printing…", &[("n", &n)]);
+                if let Some(ctx) = &self.ctx {
+                    ctx.request_repaint();
+                }
+                true
+            }
+            Err(e) => {
+                self.notify_error(e);
+                false
+            }
+        }
+    }
+
+    /// Draw the next sheet of the browser print, and hand the finished page to the browser.
+    #[cfg(target_arch = "wasm32")]
+    fn poll_web_print(&mut self) {
+        let failed: Vec<String> = self.print_tasks.web_failed.lock().map(|mut q| std::mem::take(&mut *q)).unwrap_or_default();
+        if let Some(e) = failed.into_iter().next() {
+            self.web_print_failed(&e);
+        }
+        let Some(job) = self.print_tasks.web_job.as_mut() else { return };
+        if !job.finished() {
+            if let Err(e) = job.step(&mut crate::web_print::blob_url) {
+                self.print_tasks.web_job = None;
+                self.notify_error(e);
+                return;
+            }
+            let (done, total) = (job.done().to_string(), job.total().to_string());
+            self.notify_fmt("Preparing sheet {done} of {total} for printing…", &[("done", &done), ("total", &total)]);
+            if let Some(ctx) = &self.ctx {
+                ctx.request_repaint();
+            }
+            return;
+        }
+        let Some(mut job) = self.print_tasks.web_job.take() else { return };
+        let html = job.html();
+        let urls = job.take_urls();
+        self.print_tasks.web_last = Some((job.name.clone(), job.pdf.clone()));
+        match crate::web_print::print_in_iframe(&html, urls, self.print_tasks.web_failed.clone(), self.ctx.clone()) {
+            Ok(()) => self.notify_tr("Opening the browser's print dialog…"),
+            Err(e) => self.web_print_failed(&e),
+        }
+    }
+
+    /// The browser wouldn't print (a sandboxed frame, a picture it couldn't decode): offer the
+    /// print-ready PDF as a download instead, so the work isn't lost.
+    #[cfg(target_arch = "wasm32")]
+    fn web_print_failed(&mut self, error: &str) {
+        let Some((name, pdf)) = self.print_tasks.web_last.take() else {
+            self.notify_error(error);
+            return;
+        };
+        let stem = name.trim_end_matches(".pdf").trim_end_matches(".PDF");
+        let file = format!("{stem} (print).pdf");
+        match crate::editing::download(&file, &pdf) {
+            Ok(()) => self.notify_fmt("Couldn't print from the browser ({e}); downloaded {name} to print instead", &[("e", error), ("name", &file)]),
+            Err(_) => self.notify_error(error),
+        }
+    }
+
+    /// Print ▸ Save as PDF on the desktop: write to `save_override` (tests and automation), or
+    /// ask where and write on a later frame. Returns `true` once written, or once the save picker
+    /// is showing.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn save_print_pdf(&mut self, name: &str, bytes: Vec<u8>) -> bool {
+        let write = move |app: &mut Self, path: std::path::PathBuf| match crate::editing::write_atomically(&path.to_string_lossy(), &bytes) {
+            Ok(()) => {
+                app.notify_fmt("Saved the print-ready PDF to {path}", &[("path", &path.display().to_string())]);
+                true
+            }
+            Err(e) => {
+                app.notify_fmt("Could not save: {e}", &[("e", &e.to_string())]);
+                false
+            }
+        };
+        match self.save_override.clone() {
+            Some(p) => write(self, p.into()),
+            None => {
+                let stem = name.trim_end_matches(".pdf").trim_end_matches(".PDF");
+                let dialog = rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).set_file_name(format!("{stem} (print).pdf"));
+                self.ask_one(crate::pickers::Ask::Save(dialog), None, move |app, path| {
+                    write(app, path);
+                })
+            }
+        }
+    }
+
+    /// Print ▸ Save as PDF in a browser: download it, as Save does (#170). There is no folder to
+    /// choose and no file system to write to, so `save_override` doesn't apply.
+    #[cfg(target_arch = "wasm32")]
+    fn save_print_pdf(&mut self, name: &str, bytes: Vec<u8>) -> bool {
+        let stem = name.trim_end_matches(".pdf").trim_end_matches(".PDF");
+        let file = format!("{stem} (print).pdf");
+        match crate::editing::download(&file, &bytes) {
+            Ok(()) => {
+                self.notify_fmt("Downloaded {name}", &[("name", &file)]);
+                true
+            }
+            Err(e) => {
+                self.notify_fmt("Couldn't download {name}: {e}", &[("name", &file), ("e", &e)]);
+                false
+            }
+        }
+    }
+}
+
+/// The longest side, in pixels, of one page's print-preview raster (also kept within the GPU's
+/// `max_texture_side`): an Actual-size print of a large page would otherwise ask for a raster
+/// bigger than a texture can be.
+pub(crate) const PREVIEW_MAX_SIDE: f32 = 4096.0;
+/// The most bytes of print-preview rasters kept at once. The current sheet comes first, then the
+/// next and the previous one; a neighbour that doesn't fit isn't rendered ahead.
+pub(crate) const PREVIEW_BYTES: f64 = 128.0 * 1024.0 * 1024.0;
+
+/// Pages on the current sheet and its neighbours, each with the device pixels per point that
+/// fill the preview pane (so the picture is not a stretched thumbnail), nearest sheet first and
+/// within [`PREVIEW_MAX_SIDE`] (and `max_side`, the GPU's texture limit) and [`PREVIEW_BYTES`].
+pub(crate) fn preview_rasters(d: &PrintDraft, sizes: &[(f64, f64)], labels: &[String], ppp: f32, max_side: f32) -> Vec<(usize, f32)> {
+    let Ok(settings) = d.settings(sizes.len(), labels) else { return Vec::new() };
+    let Ok(sheets) = print::layout(sizes, &settings) else { return Vec::new() };
+    if sheets.is_empty() {
+        return Vec::new();
+    }
+    let ppp = if ppp.is_finite() { ppp.max(1.0) } else { 1.0 };
+    let side = if max_side.is_finite() && max_side >= 1.0 { max_side.min(PREVIEW_MAX_SIDE) } else { PREVIEW_MAX_SIDE };
+    let i = d.sheet.min(sheets.len() - 1);
+    // Nearest first: the sheet on screen, then the next one, then the previous one.
+    let order = [Some(i), i.checked_add(1).filter(|n| *n < sheets.len()), i.checked_sub(1)];
+    let mut out: Vec<(usize, f32, f64)> = Vec::new();
+    let mut bytes = 0.0f64;
+    for sheet in order.into_iter().flatten().filter_map(|s| sheets.get(s)) {
+        let (sw, sh) = (sheet.size.0 as f32, sheet.size.1 as f32);
+        if !(sw.is_finite() && sh.is_finite()) || sw < 1.0 || sh < 1.0 {
+            continue;
+        }
+        let k = (PREVIEW_BOX.0 / sw).min(PREVIEW_BOX.1 / sh);
+        for pl in &sheet.placed {
+            let [a, b, _, _, _, _] = pl.matrix.0;
+            let placed = (a.hypot(b) as f32) * k * ppp;
+            let Some(&(pw, ph)) = sizes.get(pl.page) else { continue };
+            let long_pt = pw.max(ph) as f32;
+            if !placed.is_finite() || placed < 0.05 || !long_pt.is_finite() || long_pt < 1.0 {
+                continue;
+            }
+            let scale = placed.min(64.0).min(side / long_pt);
+            let cost = (pw * f64::from(scale)).ceil() * (ph * f64::from(scale)).ceil() * 4.0;
+            if let Some(slot) = out.iter_mut().find(|(page, _, _)| *page == pl.page) {
+                if scale > slot.1 && bytes - slot.2 + cost <= PREVIEW_BYTES {
+                    bytes += cost - slot.2;
+                    (slot.1, slot.2) = (scale, cost);
+                }
+            } else if out.len() < 48 && (out.is_empty() || bytes + cost <= PREVIEW_BYTES) {
+                bytes += cost;
+                out.push((pl.page, scale, cost));
+            }
+        }
+    }
+    out.into_iter().map(|(page, scale, _)| (page, scale)).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn current_page_preview_uses_positions_and_selection_guards() {
+        for labels in [["i", "ii", "iii", "1", "2"], ["1", "1", "1", "1", "1"], ["1", "2", "3", "4", "5"]] {
+            let labels: Vec<String> = labels.into_iter().map(str::to_owned).collect();
+            for current_page in 0..5 {
+                let draft = PrintDraft { which: Which::Current, current_page, ..Default::default() };
+                let rasters = preview_rasters(&draft, &[(200.0, 300.0); 5], &labels, 1.0, 8192.0);
+                assert_eq!(rasters.iter().map(|(page, _)| *page).collect::<Vec<_>>(), vec![current_page]);
+            }
+        }
+        let labels: Vec<String> = ["i", "ii", "iii", "1", "2"].into_iter().map(str::to_owned).collect();
+        let mut draft = PrintDraft { which: Which::Selected, selected: vec![0, 3], ..Default::default() };
+        assert_eq!(draft.settings(5, &labels).unwrap().pages, vec![0, 3]);
+        draft.which = Which::All;
+        assert_eq!(draft.settings(5, &labels).unwrap().pages, vec![0, 1, 2, 3, 4]);
+        draft.which = Which::Current;
+        draft.reverse = true;
+        draft.subset = Subset::Odd;
+        assert_eq!(draft.settings(5, &labels).unwrap().pages, vec![0]);
+        draft.subset = Subset::Even;
+        assert!(draft.settings(5, &labels).is_err());
+        draft.subset = Subset::All;
+        for (count, current) in [(0, 0), (5, 5), (5, usize::MAX)] {
+            draft.current_page = current;
+            assert!(draft.settings(count, &labels).is_err());
+        }
+    }
+
+    #[test]
+    fn composed_sheets_keep_exact_scaling_and_the_dialogs_duplex_choice() {
+        let draft = PrintDraft { duplex: Some(spool::Duplex::LongEdge), ..PrintDraft::default() };
+        let job = draft.job("report.pdf");
+        assert_eq!(job.scaling, spool::Scaling::Exact);
+        assert_eq!(job.duplex, Some(spool::Duplex::LongEdge));
+        let off = PrintDraft { duplex: Some(spool::Duplex::Off), ..PrintDraft::default() };
+        assert_eq!(off.job("report.pdf").duplex, Some(spool::Duplex::Off));
+    }
+
+    /// Untouched, Two-sided sends nothing, so the duplex set in the printer's Properties applies
+    /// (#2422); cut and stack still asks for single-sided sheets.
+    #[test]
+    fn two_sided_follows_the_printer_until_chosen() {
+        assert_eq!(PrintDraft::default().duplex, None);
+        assert_eq!(PrintDraft::default().job("report.pdf").duplex, None);
+        let mut cut = PrintDraft { handling: Handling::Multiple, order: PageOrder::CutStack, ..PrintDraft::default() };
+        assert_eq!(cut.job("report.pdf").duplex, Some(spool::Duplex::Off));
+        assert!(cut.settings(4, &[]).is_ok(), "the printer's default doesn't block cut and stack");
+        cut.duplex = Some(spool::Duplex::ShortEdge);
+        assert!(cut.settings(4, &[]).is_err());
+    }
+
+    /// A job being spooled holds the progress card, counting its sheets as the spooler reports
+    /// them; the card goes when the job ends and its answer arrives as a notice. A card another
+    /// long job is showing is left alone.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn the_progress_card_counts_the_sheets_of_a_print_job() {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        let (tx, rx) = std::sync::mpsc::channel();
+        app.print_tasks.jobs.push(PrintJob { printer: "Office".into(), sheets: None, news: rx });
+        app.poll_print();
+        assert_eq!(app.progress_notice.as_ref().map(|p| p.label.as_str()), Some("Sending to Office…"));
+
+        tx.send(JobNews::Sent(0, 3)).unwrap();
+        tx.send(JobNews::Sent(1, 3)).unwrap();
+        app.poll_print();
+        let shown = app.progress_notice.clone().unwrap();
+        assert_eq!(shown.label, "Sending sheet 2 of 3 to Office…");
+        assert!((shown.fraction - 1.0 / 3.0).abs() < 1e-4 && !shown.cancellable, "{shown:?}");
+
+        tx.send(JobNews::Sent(3, 3)).unwrap();
+        tx.send(JobNews::Done(Ok(String::new()))).unwrap();
+        app.poll_print();
+        assert!(app.progress_notice.is_none() && app.print_tasks.jobs.is_empty());
+        assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("Sent to Office"));
+
+        // Another job's card stays; a worker that vanished is reported, not left spinning.
+        let other = crate::widgets::ProgressNotice { label: "Optimizing…".into(), fraction: 0.5, cancellable: true };
+        app.progress_notice = Some(other.clone());
+        let (tx, rx) = std::sync::mpsc::channel();
+        app.print_tasks.jobs.push(PrintJob { printer: "Office".into(), sheets: None, news: rx });
+        tx.send(JobNews::Sent(1, 2)).unwrap();
+        app.poll_print();
+        assert_eq!(app.progress_notice, Some(other));
+        drop(tx);
+        app.poll_print();
+        assert!(app.print_tasks.jobs.is_empty() && app.progress_notice.is_some());
+        assert_eq!(app.toast.as_ref().map(|t| t.0.as_str()), Some("the print job stopped unexpectedly"));
+    }
+
+    /// Issue #1308: Current page is the page on screen, even when a later page is labelled with
+    /// its number. A typed range still reads labels first.
+    #[test]
+    fn current_page_is_the_viewed_page_not_a_label() {
+        let labels: Vec<String> = ["i", "ii", "iii", "1", "2"].map(String::from).to_vec();
+        for (current, want) in [(0, vec![0]), (1, vec![1]), (3, vec![3])] {
+            let d = PrintDraft { which: Which::Current, current_page: current, ..PrintDraft::default() };
+            assert_eq!(d.settings(5, &labels).map(|s| s.pages), Ok(want), "viewing page {}", current + 1);
+        }
+        let typed = PrintDraft { which: Which::Range, range: "1".into(), ..PrintDraft::default() };
+        assert_eq!(typed.settings(5, &labels).map(|s| s.pages), Ok(vec![3]));
+    }
+
+    #[test]
+    fn print_preview_rasters_stay_within_the_texture_limit() {
+        // Actual size on a 14,400 pt (200 in) page would ask for a raster far past any texture.
+        let d = PrintDraft { size: SizeMode::Actual, ..PrintDraft::default() };
+        let sizes = vec![(14_400.0, 14_400.0); 2];
+        let labels = vec!["1".into(), "2".into()];
+        for max_side in [2048.0, 8192.0, 16384.0, f32::NAN, 0.0] {
+            for (page, scale) in preview_rasters(&d, &sizes, &labels, 4.0, max_side) {
+                let long = 14_400.0 * scale;
+                let cap = if max_side.is_finite() && max_side >= 1.0 { max_side.min(PREVIEW_MAX_SIDE) } else { PREVIEW_MAX_SIDE };
+                assert!(long <= cap + 1.0, "page {page} at {max_side}: {long} px");
+            }
+        }
+    }
+
+    #[test]
+    fn print_preview_rasters_keep_the_current_sheet_within_the_byte_budget() {
+        // Many large pages: the current sheet always gets its raster; neighbours only while the
+        // budget lasts, and the total stays within it.
+        let d = PrintDraft { sheet: 5, ..PrintDraft::default() };
+        let sizes = vec![(2_000.0, 2_000.0); 12];
+        let labels: Vec<String> = (1..=12).map(|n| n.to_string()).collect();
+        let rasters = preview_rasters(&d, &sizes, &labels, 4.0, 16384.0);
+        assert_eq!(rasters.first().map(|r| r.0), Some(5), "the sheet on screen comes first: {rasters:?}");
+        let total: f64 = rasters.iter().map(|(_, s)| (2_000.0 * f64::from(*s)).ceil().powi(2) * 4.0).sum();
+        assert!(total <= PREVIEW_BYTES || rasters.len() == 1, "{total} bytes for {rasters:?}");
+    }
+
+    #[test]
+    fn print_preview_is_sharper_than_a_thumbnail_on_a_high_dpi_screen() {
+        let d = PrintDraft::default();
+        let sizes = vec![(612.0, 792.0); 3];
+        let labels = vec!["1".into(), "2".into(), "3".into()];
+        let rasters = preview_rasters(&d, &sizes, &labels, 2.0, 8192.0);
+        let scale = rasters.iter().find(|(page, _)| *page == 0).map(|(_, s)| *s).unwrap();
+        // A 132 pt thumbnail at 2× is about 0.43 px/pt. The preview pane needs roughly twice that.
+        assert!(scale > 0.7, "letter page in the preview at 2 px/pt: {scale}");
+        assert!(rasters.iter().any(|(page, _)| *page == 1), "the next sheet is ready");
+        let mut later = d.clone();
+        later.sheet = 2;
+        let rasters = preview_rasters(&later, &sizes, &labels, 2.0, 8192.0);
+        assert!(rasters.iter().any(|(page, _)| *page == 2));
+    }
+}
diff --git a/crates/ui-egui/src/workflows/print_ui/body.rs b/crates/ui-egui/src/workflows/print_ui/body.rs
new file mode 100644
index 0000000000..5243820396
--- /dev/null
+++ b/crates/ui-egui/src/workflows/print_ui/body.rs
@@ -0,0 +1,545 @@
+use super::draft::{Handling, PrintDraft, Which};
+use super::*;
+
+/// Properties… on CUPS: the driver's options for this print, grouped as the driver groups them.
+/// Only choices away from the printer's defaults are kept, and sent with the job.
+fn driver_options_panel(ui: &mut egui::Ui, d: &mut PrintDraft, t: &Tokens) {
+    let PrintDraft { driver_options: Some((_, options)), driver_choices: choices, show_driver_options: show, .. } = d else { return };
+    egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(10)).show(ui, |ui| {
+        ui.set_width(ui.available_width());
+        ui.horizontal(|ui| {
+            ui.label(egui::RichText::new(tl!("Printer properties")).font(theme::semibold(13.0)));
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if ui.button(tl!("Done")).clicked() {
+                    *show = false;
+                }
+                if ui.add_enabled(!choices.is_empty(), egui::Button::new(tl!("Reset to printer defaults"))).clicked() {
+                    choices.clear();
+                }
+            });
+        });
+        if options.is_empty() {
+            ui.label(egui::RichText::new(tl!("This printer offers no settings of its own.")).small().color(t.text_muted));
+            return;
+        }
+        egui::ScrollArea::vertical().id_salt("driver-options").max_height(240.0).show(ui, |ui| {
+            for (n, chunk) in options.chunk_by(|a, b| a.group == b.group).enumerate() {
+                let group = chunk.first().map_or("", |o| o.group.as_str());
+                if !group.is_empty() {
+                    ui.add_space(4.0);
+                    // Option and group names are the driver's own text.
+                    ui.label(egui::RichText::new(group).small().color(t.text_muted));
+                }
+                egui::Grid::new(("driver-group", n)).num_columns(2).spacing([10.0, 4.0]).show(ui, |ui| {
+                    for o in chunk {
+                        let current = choices.get(&o.key).cloned().unwrap_or_else(|| o.default.clone());
+                        let label_of = |c: &str| o.choices.iter().find(|(k, _)| k == c).map_or_else(|| c.to_string(), |(_, l)| l.clone());
+                        let mut pick = current.clone();
+                        let option_label = ui.label(&o.label);
+                        craft_ui::ComboBox::from_id_salt(("driver-option", &o.key))
+                            .selected_text(label_of(&current))
+                            .width(200.0)
+                            .show_ui(ui, |ui| {
+                                for (k, l) in &o.choices {
+                                    ui.selectable_value(&mut pick, k.clone(), l.as_str());
+                                }
+                            })
+                            .response
+                            .labelled_by(option_label.id);
+                        if pick != current {
+                            if pick == o.default {
+                                choices.remove(&o.key);
+                            } else {
+                                choices.insert(o.key.clone(), pick);
+                            }
+                        }
+                        ui.end_row();
+                    }
+                });
+            }
+        });
+    });
+}
+
+/// Draw a combo box whose accessible name does not depend on the selected value.
+fn combo<T: PartialEq + Copy>(ui: &mut egui::Ui, id: &str, name: &str, value: &mut T, choices: &[(T, &str)], width: f32) {
+    let shown = choices.iter().find(|c| c.0 == *value).map_or("", |c| c.1);
+    craft_ui::ComboBox::from_id_salt(id)
+        .selected_text(shown)
+        .width(width)
+        .show_ui(ui, |ui| {
+            for (v, label) in choices {
+                ui.selectable_value(value, *v, *label);
+            }
+        })
+        .response
+        .accessible_name(name);
+}
+
+/// Draw the dialog. `thumb` gives a page's thumbnail texture when there is one. Returns
+/// (print, cancel).
+pub(crate) fn body(
+    ui: &mut egui::Ui,
+    d: &mut PrintDraft,
+    t: &Tokens,
+    sizes: &[(f64, f64)],
+    labels: &[String],
+    thumb: &mut dyn FnMut(usize) -> Option<egui::TextureId>,
+) -> (bool, bool) {
+    ui.set_width(820.0);
+    ui.label(egui::RichText::new(tl!("Print")).font(theme::semibold(18.0)));
+    ui.add_space(8.0);
+    let settings = d.settings(sizes.len(), labels);
+    let sheets = settings.as_ref().ok().and_then(|s| print::layout(sizes, s).ok()).unwrap_or_default();
+    d.sheet = d.sheet.min(sheets.len().saturating_sub(1));
+    ui.horizontal_top(|ui| {
+        // Settings.
+        ui.vertical(|ui| {
+            ui.set_width(470.0);
+            egui::Grid::new("print-top").num_columns(2).spacing([10.0, 8.0]).show(ui, |ui| {
+                let printer_caption = ui.label(tl!("Printer:"));
+                let before = d.printer.clone();
+                // The browser's print dialog sets copies, two-sided printing and colour itself.
+                let browser = d.printer.as_deref() == Some(crate::web_print::BROWSER_PRINTER);
+                ui.horizontal(|ui| {
+                    let shown = match d.printer.as_deref() {
+                        Some(p) => printer_label(p),
+                        None if still_looking(d) => tl!("Looking for printers…").to_string(),
+                        None => tl!("Save as PDF").to_string(),
+                    };
+                    craft_ui::ComboBox::from_id_salt("printer").selected_text(shown).width(260.0).show_ui(ui, |ui| {
+                        if d.printers_loading {
+                            ui.add_enabled(false, egui::Label::new(tl!("Looking for printers…")));
+                        }
+                        for p in &d.printers {
+                            let name = printer_label(&p.name);
+                            let label = if p.default && p.name != crate::web_print::BROWSER_PRINTER {
+                                crate::i18n::fmt(tl!("{name} (default)"), &[("name", &name)])
+                            } else {
+                                name
+                            };
+                            ui.selectable_value(&mut d.printer, Some(p.name.clone()), label);
+                        }
+                        // Chosen even when it was already the selection, so the list arriving
+                        // later doesn't replace it with the default printer.
+                        if ui.selectable_value(&mut d.printer, None, tl!("Save as PDF")).clicked() {
+                            d.printer_picked = true;
+                        }
+                    })
+                    .response
+                    .labelled_by(printer_caption.id);
+                    let tip = if spool::HAS_PRINTER_PREFERENCES {
+                        tl!("Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.")
+                    } else {
+                        tl!("The printer driver's own settings for this print: paper tray, paper type, finishing and more.")
+                    };
+                    let properties = ui.add_enabled(d.printer.is_some() && !browser, egui::Button::new(tl!("Properties…"))).on_hover_text(tip);
+                    if properties.clicked()
+                        && let Some(p) = d.printer.clone()
+                    {
+                        if spool::HAS_PRINTER_PREFERENCES {
+                            d.driver_error = spool::open_printer_preferences(&p).err().map(|e| e.to_string());
+                        } else {
+                            if d.driver_options.as_ref().is_none_or(|(read_for, _)| *read_for != p) && d.driver_options_loading.as_deref() != Some(p.as_str()) {
+                                // Read off the GUI thread (#1818): `poll_print` starts it next frame.
+                                d.driver_options = None;
+                                d.driver_choices.clear();
+                                d.driver_options_loading = Some(p.clone());
+                                d.read_options_for = Some(p);
+                            }
+                            d.show_driver_options = !d.show_driver_options;
+                        }
+                    }
+                });
+                if d.printer != before {
+                    d.printer_picked = true;
+                    d.show_driver_options = false;
+                    d.driver_error = None;
+                }
+                ui.end_row();
+                // The spooler answered with no printer at all (#160): say so, rather than
+                // leaving Save as PDF looking like the only thing PdfCraft can do.
+                if !d.printers_loading && d.printers.is_empty() {
+                    ui.label("");
+                    ui.label(
+                        egui::RichText::new(tl!("No printers were found. Check that the printer is installed and the print spooler is running, then open Print again."))
+                            .small()
+                            .color(t.text_muted),
+                    );
+                    ui.end_row();
+                }
+                let copies_label = ui.label(tl!("Copies:"));
+                ui.add_enabled_ui(!browser, |ui| {
+                    ui.horizontal(|ui| {
+                        ui.add(egui::DragValue::new(&mut d.copies).range(1..=999)).labelled_by(copies_label.id);
+                        ui.add(widgets::checkbox(&mut d.collate, tl!("Collate")));
+                        ui.add(widgets::checkbox(&mut d.grayscale, tl!("Print in grayscale")));
+                    });
+                });
+                ui.end_row();
+                // A booklet decides two-sided itself (#2707), so the choice is hidden meanwhile, as
+                // in Acrobat's Print dialog; it is kept for the other layouts.
+                if d.handling != Handling::Booklet {
+                    ui.label(tl!("Two-sided:"));
+                    ui.add_enabled_ui(!browser, |ui| {
+                        combo(
+                            ui,
+                            "duplex",
+                            tl!("Two-sided:"),
+                            &mut d.duplex,
+                            &[
+                                (None, tl!("Printer default")),
+                                (Some(spool::Duplex::Off), tl!("Off")),
+                                (Some(spool::Duplex::LongEdge), tl!("Flip on long edge")),
+                                (Some(spool::Duplex::ShortEdge), tl!("Flip on short edge")),
+                            ],
+                            160.0,
+                        );
+                    });
+                    ui.end_row();
+                }
+                let paper_label = ui.label(tl!("Paper:"));
+                let paper_name = PAPERS.get(d.paper).map_or("US Letter", |p| p.0);
+                let before = d.paper;
+                craft_ui::ComboBox::from_id_salt("paper").selected_text(tl!(paper_name)).width(260.0).show_ui(ui, |ui| {
+                    for (i, (name, _)) in PAPERS.iter().enumerate() {
+                        ui.selectable_value(&mut d.paper, i, tl!(name));
+                    }
+                })
+                .response
+                .labelled_by(paper_label.id);
+                // Label stock gets the label layout (cut, turned upright, fitted).
+                if d.paper != before && d.paper == print::LABEL_PAPER {
+                    d.paper_before_label = Some(before);
+                    d.handling = Handling::Label;
+                    d.sheet = 0;
+                }
+                ui.end_row();
+            });
+            // Windows says which drivers can't print two-sided as they're asked; they keep their
+            // own setting, even when Two-sided is Off.
+            if let Some(p) = d.printers.iter().find(|p| d.printer.as_ref() == Some(&p.name))
+                && p.two_sided == Some(false)
+            {
+                ui.label(egui::RichText::new(tl!("This printer's driver doesn't take two-sided settings from other programs, so its own setting applies. Change it in Properties…")).small().color(t.text_muted));
+            }
+            if d.printer.as_deref() == Some(crate::web_print::BROWSER_PRINTER) {
+                ui.label(egui::RichText::new(tl!("Copies, two-sided printing and colour are chosen in the browser's print dialog.")).small().color(t.text_muted));
+            }
+            if let Some(e) = &d.driver_error {
+                ui.label(egui::RichText::new(crate::i18n::fmt(tl!("Couldn't open the printer's preferences: {e}"), &[("e", e)])).small().color(t.text_muted));
+            }
+            if d.show_driver_options {
+                if d.driver_options.is_none() && d.driver_options_loading.is_some() {
+                    ui.label(egui::RichText::new(tl!("Reading the printer's settings…")).small().color(t.text_muted));
+                } else {
+                    driver_options_panel(ui, d, t);
+                }
+            }
+            if let Some(&source) = sizes.get(d.current_page) {
+                ui.horizontal_wrapped(|ui| {
+                    ui.label(crate::i18n::fmt(tl!("PDF page: {size}"), &[("size", &d.units.size(source.0, source.1))]));
+                    let matched = print::matching_paper(source);
+                    if ui.add_enabled(matched.is_some(), egui::Button::new(tl!("Match page at 100%"))).clicked()
+                        && let Some(paper) = matched
+                    {
+                        d.paper = paper;
+                        // A paper picked outright: nothing for leaving Label to give back.
+                        d.paper_before_label = None;
+                        d.handling = Handling::Size;
+                        d.size = SizeMode::Actual;
+                        d.orientation = Orientation::Auto;
+                        d.sheet = 0;
+                    }
+                });
+            }
+            ui.add_space(6.0);
+            widgets::section_title(ui, tl!("Pages to Print"));
+            ui.horizontal(|ui| {
+                widgets::radio_value(ui, &mut d.which, Which::All, tl!("All"));
+                widgets::radio_value(ui, &mut d.which, Which::Current, tl!("Current page"));
+                let pages = widgets::radio_value(ui, &mut d.which, Which::Range, tl!("Pages"));
+                let r = ui.add_enabled(
+                    d.which == Which::Range,
+                    crate::widgets::line(&mut d.range).hint_text(format!("1-{}", sizes.len())).desired_width(110.0),
+                ).labelled_by(pages.id);
+                if r.gained_focus() {
+                    d.which = Which::Range;
+                }
+            });
+            // Offered only when pages were picked before the dialog opened.
+            if !d.selected.is_empty() {
+                let label = format!("{} ({})", tl!("Selected pages"), d.selected.len());
+                widgets::radio_value(ui, &mut d.which, Which::Selected, label);
+            }
+            ui.horizontal(|ui| {
+                ui.label(tl!("More options:"));
+                combo(
+                    ui,
+                    "subset",
+                    tl!("More options:"),
+                    &mut d.subset,
+                    &[(Subset::All, tl!("All pages in range")), (Subset::Odd, tl!("Odd pages only")), (Subset::Even, tl!("Even pages only"))],
+                    150.0,
+                );
+                ui.add(widgets::checkbox(&mut d.reverse, tl!("Reverse pages")));
+            });
+            ui.add_space(6.0);
+            widgets::section_title(ui, tl!("Page Sizing & Handling"));
+            ui.horizontal_wrapped(|ui| {
+                for (h, label) in [
+                    (Handling::Size, tl!("Size")),
+                    (Handling::Poster, tl!("Poster")),
+                    (Handling::Multiple, tl!("Multiple")),
+                    (Handling::Booklet, tl!("Booklet")),
+                    (Handling::Label, tl!("Label")),
+                ] {
+                    if widgets::mode_tab(ui, label, d.handling == h).clicked() {
+                        d.set_handling(h);
+                    }
+                }
+            });
+            ui.add_space(4.0);
+            match d.handling {
+                Handling::Size => {
+                    ui.horizontal(|ui| {
+                        widgets::radio_value(ui, &mut d.size, SizeMode::Fit, tl!("Fit"));
+                        widgets::radio_value(ui, &mut d.size, SizeMode::Actual, tl!("Actual size"));
+                        widgets::radio_value(ui, &mut d.size, SizeMode::Shrink, tl!("Shrink oversized pages"));
+                    });
+                    ui.horizontal(|ui| {
+                        let custom = matches!(d.size, SizeMode::Custom(_));
+                        if ui.add(widgets::radio(custom, tl!("Custom scale:"))).clicked() {
+                            d.size = SizeMode::Custom(d.custom_scale);
+                        }
+                        ui.add_enabled(custom, egui::DragValue::new(&mut d.custom_scale).range(1.0..=1000.0).suffix(" %"))
+                            .accessible_name(tl!("Custom scale"));
+                    });
+                }
+                Handling::Label => {
+                    ui.add(widgets::checkbox(&mut d.label_flip, tl!("Turn upside down (180°)")));
+                    ui.label(
+                        egui::RichText::new(tl!("Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet."))
+                            .small()
+                            .color(t.text_muted),
+                    );
+                }
+                Handling::Poster => {
+                    ui.horizontal(|ui| {
+                        let scale_label = ui.label(tl!("Tile scale:"));
+                        ui.add(egui::DragValue::new(&mut d.poster_scale).range(10.0..=1000.0).suffix(" %")).labelled_by(scale_label.id);
+                        let overlap_label = ui.label(tl!("Overlap:"));
+                        ui.add(egui::DragValue::new(&mut d.overlap).range(0.0..=144.0).suffix(" pt")).labelled_by(overlap_label.id);
+                        ui.add(widgets::checkbox(&mut d.cut_marks, tl!("Cut marks")));
+                    });
+                }
+                Handling::Multiple => {
+                    ui.horizontal(|ui| {
+                        ui.label(tl!("Pages per sheet:"));
+                        combo(ui, "per-sheet", tl!("Pages per sheet:"), &mut d.per_sheet, &[(2, "2"), (4, "4"), (6, "6"), (9, "9"), (16, "16")], 60.0);
+                        ui.label(tl!("Page order:"));
+                        combo(
+                            ui,
+                            "order",
+                            tl!("Page order:"),
+                            &mut d.order,
+                            &[
+                                (PageOrder::Horizontal, tl!("Horizontal")),
+                                (PageOrder::HorizontalReversed, tl!("Horizontal reversed")),
+                                (PageOrder::Vertical, tl!("Vertical")),
+                                (PageOrder::VerticalReversed, tl!("Vertical reversed")),
+                                (PageOrder::CutStack, tl!("Cut and stack")),
+                            ],
+                            150.0,
+                        );
+                    });
+                    ui.horizontal(|ui| {
+                        ui.add(widgets::checkbox(&mut d.border, tl!("Print page border")));
+                        ui.add(widgets::checkbox(&mut d.auto_rotate, tl!("Auto-rotate pages")));
+                    });
+                    if d.order == PageOrder::CutStack {
+                        ui.label(tl!(
+                            "Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom."
+                        ));
+                    }
+                }
+                Handling::Booklet => {
+                    ui.horizontal(|ui| {
+                        ui.label(tl!("Booklet subset:"));
+                        combo(
+                            ui,
+                            "booklet",
+                            tl!("Booklet subset:"),
+                            &mut d.booklet_subset,
+                            &[
+                                (BookletSubset::BothSides, tl!("Both sides")),
+                                (BookletSubset::FrontOnly, tl!("Front side only")),
+                                (BookletSubset::BackOnly, tl!("Back side only")),
+                            ],
+                            130.0,
+                        );
+                        ui.label(tl!("Binding:"));
+                        combo(ui, "binding", tl!("Binding:"), &mut d.binding, &[(Binding::Left, tl!("Left")), (Binding::Right, tl!("Right"))], 80.0);
+                    });
+                }
+            }
+            ui.add_space(6.0);
+            ui.horizontal(|ui| {
+                ui.label(tl!("Orientation:"));
+                widgets::radio_value(ui, &mut d.orientation, Orientation::Auto, tl!("Auto portrait/landscape"));
+                widgets::radio_value(ui, &mut d.orientation, Orientation::Portrait, tl!("Portrait"));
+                widgets::radio_value(ui, &mut d.orientation, Orientation::Landscape, tl!("Landscape"));
+            });
+            ui.add_space(6.0);
+            widgets::section_title(ui, tl!("Comments & Forms"));
+            combo(
+                ui,
+                "content",
+                tl!("Comments & Forms"),
+                &mut d.content,
+                &[
+                    (Content::Document, tl!("Document")),
+                    (Content::DocumentAndMarkups, tl!("Document and markups")),
+                    (Content::DocumentAndStamps, tl!("Document and stamps")),
+                    (Content::FormFieldsOnly, tl!("Form fields only")),
+                ],
+                220.0,
+            );
+            // Advanced (Acrobat's Advanced Print Setup): print as image. Folded unless it is on.
+            ui.add_space(6.0);
+            egui::CollapsingHeader::new(egui::RichText::new(crate::i18n::upper_label("Advanced")).font(theme::semibold(10.5)).color(t.text_faint))
+                .id_salt("print-advanced")
+                .default_open(d.as_image)
+                .show(ui, |ui| {
+                    ui.horizontal(|ui| {
+                        ui.add(widgets::checkbox(&mut d.as_image, tl!("Print as image")));
+                        ui.add_enabled_ui(d.as_image, |ui| {
+                            ui.label(tl!("Resolution:"));
+                            let mut dpi = d.dpi.round() as u32;
+                            combo(ui, "print-dpi", tl!("Resolution:"), &mut dpi, &[(150, "150 dpi"), (300, "300 dpi"), (600, "600 dpi")], 100.0);
+                            d.dpi = f64::from(dpi);
+                        });
+                    });
+                    ui.label(
+                        egui::RichText::new(tl!(
+                            "Use it when a printer skips text, shading or transparency. The print is no longer searchable text; with Print in grayscale, the pictures are grey."
+                        ))
+                        .small()
+                        .color(t.text_muted),
+                    );
+                });
+        });
+        ui.add_space(12.0);
+        // Preview.
+        ui.vertical(|ui| {
+            ui.set_width(PREVIEW_W);
+            let (area, _) = ui.allocate_exact_size(vec2(PREVIEW_W, PREVIEW_H), egui::Sense::hover());
+            ui.painter().rect_filled(area, 6.0, t.hover);
+            match (&settings, sheets.get(d.sheet)) {
+                (Err(e), _) => {
+                    ui.put(area.shrink(16.0), egui::Label::new(egui::RichText::new(tl!(e)).color(t.text_muted)).wrap());
+                }
+                (Ok(_), Some(sheet)) => {
+                    let k = (PREVIEW_BOX.0 / sheet.size.0 as f32).min(PREVIEW_BOX.1 / sheet.size.1 as f32);
+                    let paper = Rect::from_center_size(area.center(), vec2(sheet.size.0 as f32 * k, sheet.size.1 as f32 * k));
+                    ui.painter().rect_filled(paper, 0.0, Color32::WHITE);
+                    ui.painter().rect_stroke(paper, 0.0, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
+                    let to_screen = |x: f64, y: f64| -> Pos2 { pos2(paper.left() + x as f32 * k, paper.bottom() - y as f32 * k) };
+                    let painter = ui.painter().with_clip_rect(paper);
+                    for pl in &sheet.placed {
+                        let (dw, dh) = sizes[pl.page];
+                        let [x0, y0, x1, y1] = pl.clip;
+                        let corners = [(x0, y0), (x1, y0), (x1, y1), (x0, y1)].map(|(x, y)| {
+                            let (sx, sy) = pl.matrix.apply(x, y);
+                            to_screen(sx, sy)
+                        });
+                        // UVs of the visible part (texture y runs down from the page top).
+                        let uv = |x: f64, y: f64| pos2((x / dw) as f32, (1.0 - y / dh) as f32);
+                        let uvs = [uv(x0, y0), uv(x1, y0), uv(x1, y1), uv(x0, y1)];
+                        match thumb(pl.page) {
+                            Some(tex) => {
+                                let mut mesh = egui::Mesh::with_texture(tex);
+                                for (p, u) in corners.iter().zip(uvs) {
+                                    mesh.vertices.push(egui::epaint::Vertex {
+                                        pos: *p,
+                                        uv: u,
+                                        color: if d.grayscale { Color32::from_gray(235) } else { Color32::WHITE },
+                                    });
+                                }
+                                mesh.indices.extend_from_slice(&[0, 1, 2, 0, 2, 3]);
+                                painter.add(egui::Shape::mesh(mesh));
+                            }
+                            None => {
+                                painter.add(egui::Shape::convex_polygon(
+                                    corners.to_vec(),
+                                    Color32::from_gray(245),
+                                    Stroke::new(0.5, Color32::from_gray(180)),
+                                ));
+                                let c = corners.iter().fold(vec2(0.0, 0.0), |a, p| a + p.to_vec2()) / 4.0;
+                                painter.text(
+                                    c.to_pos2(),
+                                    egui::Align2::CENTER_CENTER,
+                                    (pl.page + 1).to_string(),
+                                    theme::regular(11.0),
+                                    Color32::from_gray(120),
+                                );
+                            }
+                        }
+                    }
+                    for b in &sheet.borders {
+                        painter.rect_stroke(
+                            Rect::from_two_pos(to_screen(b[0], b[1]), to_screen(b[2], b[3])),
+                            0.0,
+                            Stroke::new(0.6, Color32::BLACK),
+                            egui::StrokeKind::Middle,
+                        );
+                    }
+                    for l in &sheet.lines {
+                        painter.line_segment([to_screen(l[0], l[1]), to_screen(l[2], l[3])], Stroke::new(0.6, Color32::BLACK));
+                    }
+                }
+                _ => {}
+            }
+            ui.horizontal(|ui| {
+                let n = sheets.len();
+                if ui.add_enabled(d.sheet > 0, egui::Button::new("‹")).on_hover_text(tl!("Previous sheet")).clicked() {
+                    d.sheet -= 1;
+                }
+                ui.label(if n == 0 {
+                    tl!("No sheets").to_string()
+                } else {
+                    crate::i18n::fmt(tl!("Sheet {s} of {n}"), &[("s", &(d.sheet + 1).to_string()), ("n", &n.to_string())])
+                });
+                if ui.add_enabled(d.sheet + 1 < n, egui::Button::new("›")).on_hover_text(tl!("Next sheet")).clicked() {
+                    d.sheet += 1;
+                }
+            });
+            if let Some(s) = sheets.get(d.sheet) {
+                ui.label(egui::RichText::new(d.units.size(s.size.0, s.size.1)).small().color(t.text_muted));
+                if d.handling == Handling::Size
+                    && let Some(p) = s.placed.first()
+                {
+                    let scale = p.matrix.0[0].hypot(p.matrix.0[1]) * 100.0;
+                    ui.label(crate::i18n::fmt(tl!("PDF scale: {scale}%"), &[("scale", &format!("{scale:.2}"))]));
+                    ui.label(egui::RichText::new(tl!("Printer paper and scaling may differ. Check driver settings.")).small().color(t.text_muted));
+                    if (scale - 100.0).abs() > 0.01 {
+                        ui.label(egui::RichText::new(tl!("Drawing scale changes. Use Actual size for full-scale plans.")).small().color(t.text_muted));
+                    }
+                }
+            }
+        });
+    });
+    ui.add_space(12.0);
+    let (mut go, mut cancel) = (false, false);
+    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+        let looking = still_looking(d);
+        let label = if d.printer.is_some() || looking { tl!("Print") } else { tl!("Save as PDF") };
+        if ui.add_enabled_ui(settings.is_ok() && !sheets.is_empty() && !looking, |ui| widgets::pill_button(ui, label, true)).inner.clicked() {
+            go = true;
+        }
+        if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+            cancel = true;
+        }
+    });
+    (go, cancel)
+}
diff --git a/crates/ui-egui/src/workflows/print_ui/draft.rs b/crates/ui-egui/src/workflows/print_ui/draft.rs
new file mode 100644
index 0000000000..1609262abb
--- /dev/null
+++ b/crates/ui-egui/src/workflows/print_ui/draft.rs
@@ -0,0 +1,238 @@
+use super::*;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Which {
+    All,
+    Current,
+    Range,
+    /// The pages picked in the Pages panel or the organize grid when the dialog opened.
+    Selected,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Handling {
+    Size,
+    Poster,
+    Multiple,
+    Booklet,
+    /// Shipping label: cut to the printed area, turned upright, one per sheet.
+    Label,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct PrintDraft {
+    pub printers: Vec<spool::Printer>,
+    /// The unit the sheet size is shown in (Preferences).
+    pub units: crate::units::Unit,
+    /// The printers are still being listed in the background (see [`PrinterSource`]).
+    pub printers_loading: bool,
+    /// The user chose the printer, so a list arriving late doesn't move it to the default.
+    pub printer_picked: bool,
+    /// `None` = Save as PDF.
+    pub printer: Option<String>,
+    pub copies: u32,
+    pub collate: bool,
+    pub grayscale: bool,
+    /// `None` = the printer's own default (its Properties), as Acrobat does.
+    pub duplex: Option<spool::Duplex>,
+    pub which: Which,
+    pub range: String,
+    /// The pages `Which::Selected` prints (0-based, in page order); empty when none were picked.
+    pub selected: Vec<usize>,
+    pub subset: Subset,
+    pub reverse: bool,
+    pub handling: Handling,
+    pub size: SizeMode,
+    pub custom_scale: f64,
+    pub per_sheet: usize,
+    pub order: PageOrder,
+    pub border: bool,
+    pub auto_rotate: bool,
+    pub booklet_subset: BookletSubset,
+    pub binding: Binding,
+    pub poster_scale: f64,
+    pub overlap: f64,
+    pub cut_marks: bool,
+    pub orientation: Orientation,
+    pub content: Content,
+    /// Print as image (Acrobat's Advanced Print Setup) at `dpi`.
+    pub as_image: bool,
+    pub dpi: f64,
+    pub paper: usize,
+    /// The paper chosen before Label put label stock in, so leaving Label gives it back (#3564).
+    pub paper_before_label: Option<usize>,
+    /// The sheet shown in the preview (0-based).
+    pub sheet: usize,
+    pub current_page: usize,
+    /// The printer driver's own options and the printer they were read for (Properties…, CUPS).
+    pub driver_options: Option<(String, Vec<spool::PrinterOption>)>,
+    /// Driver options set away from the printer's defaults, for `driver_options`' printer.
+    pub driver_choices: std::collections::BTreeMap<String, String>,
+    pub show_driver_options: bool,
+    /// Why the printer's preferences window didn't open (Windows).
+    pub driver_error: Option<String>,
+    /// Label: turn a further 180°.
+    pub label_flip: bool,
+    /// Label: each page's printed area and text direction, read when Label is chosen
+    /// ([`PdfCraftApp::read_label_crops`]); empty until then.
+    pub crops: Vec<Option<print::Crop>>,
+    /// The pages `crops` were read for, so a changed page selection reads them again.
+    pub crop_pages: Option<Vec<usize>>,
+    /// The printer whose options are being read in the background (CUPS runs `lpoptions`,
+    /// which a stuck CUPS can hold up; #1818). The panel says so meanwhile.
+    pub driver_options_loading: Option<String>,
+    /// Properties… asked for this printer's options; the app starts the read on the next frame.
+    pub read_options_for: Option<String>,
+}
+
+impl Default for PrintDraft {
+    fn default() -> Self {
+        PrintDraft {
+            printers: Vec::new(),
+            units: Default::default(),
+            printers_loading: false,
+            printer_picked: false,
+            printer: None,
+            copies: 1,
+            collate: true,
+            grayscale: false,
+            duplex: None,
+            which: Which::All,
+            range: String::new(),
+            selected: Vec::new(),
+            subset: Subset::All,
+            reverse: false,
+            handling: Handling::Size,
+            size: SizeMode::Fit,
+            custom_scale: 100.0,
+            per_sheet: 2,
+            order: PageOrder::Horizontal,
+            border: false,
+            auto_rotate: true,
+            booklet_subset: BookletSubset::BothSides,
+            binding: Binding::Left,
+            poster_scale: 200.0,
+            overlap: 18.0,
+            cut_marks: true,
+            orientation: Orientation::Auto,
+            content: Content::DocumentAndMarkups,
+            as_image: false,
+            dpi: 300.0,
+            paper: 0,
+            paper_before_label: None,
+            sheet: 0,
+            current_page: 0,
+            driver_options: None,
+            driver_choices: Default::default(),
+            show_driver_options: false,
+            driver_error: None,
+            label_flip: false,
+            crops: Vec::new(),
+            crop_pages: None,
+            driver_options_loading: None,
+            read_options_for: None,
+        }
+    }
+}
+
+impl PrintDraft {
+    /// Choose Page Sizing & Handling. Label loads label stock and remembers the paper it
+    /// replaced; leaving Label gives that paper back, unless another one was picked meanwhile.
+    pub fn set_handling(&mut self, handling: Handling) {
+        let leaving_label = self.handling == Handling::Label && handling != Handling::Label;
+        self.handling = handling;
+        self.sheet = 0;
+        if handling == Handling::Label {
+            // A label goes on label stock.
+            if self.paper != print::LABEL_PAPER {
+                self.paper_before_label = Some(self.paper);
+                self.paper = print::LABEL_PAPER;
+            }
+        } else if leaving_label
+            && let Some(paper) = self.paper_before_label.take()
+            && self.paper == print::LABEL_PAPER
+        {
+            self.paper = paper;
+        }
+    }
+
+    /// The engine settings for this draft (page count and labels from the document).
+    pub fn settings(&self, count: usize, labels: &[String]) -> Result<print::Settings, String> {
+        if self.cut_and_stack() && matches!(self.duplex, Some(spool::Duplex::LongEdge | spool::Duplex::ShortEdge)) {
+            return Err("Cut and stack needs Two-sided: Off. Print single-sided sheets.".into());
+        }
+        let range = match self.which {
+            Which::All | Which::Selected | Which::Current => None,
+            Which::Range => Some(self.range.clone()),
+        };
+        // Selected and Current are positions, not a typed range: a range would read numbers as
+        // page labels first.
+        let pages = match self.which {
+            Which::Selected => print::select_listed(count, &self.selected, self.subset, self.reverse),
+            Which::Current => print::select_listed(count, &[self.current_page], self.subset, self.reverse),
+            Which::All | Which::Range => print::select_pages(count, range.as_deref(), labels, self.subset, self.reverse),
+        }
+        // What the person got wrong about what to print is said in their language: the engine hands
+        // the wording over whole and the page numbers apart from it.
+        .map_err(|e| e.said(&crate::i18n::words))?;
+        let layout = match self.handling {
+            Handling::Size => Layout::Size(match self.size {
+                SizeMode::Custom(_) => SizeMode::Custom(self.custom_scale),
+                m => m,
+            }),
+            Handling::Multiple => match Layout::multiple(self.per_sheet) {
+                Layout::Multiple { cols, rows, per_sheet, .. } => {
+                    Layout::Multiple { cols, rows, per_sheet, order: self.order, border: self.border, auto_rotate: self.auto_rotate }
+                }
+                other => other,
+            },
+            Handling::Booklet => Layout::Booklet { subset: self.booklet_subset, binding: self.binding },
+            Handling::Poster => Layout::Poster { scale: self.poster_scale, overlap: self.overlap, cut_marks: self.cut_marks },
+            Handling::Label => Layout::Label { flip: self.label_flip },
+        };
+        Ok(print::Settings {
+            pages,
+            paper: PAPERS[self.paper.min(PAPERS.len() - 1)].1,
+            orientation: self.orientation,
+            layout,
+            content: self.content,
+            raster: self.as_image.then_some(print::Raster { dpi: self.dpi, grayscale: self.grayscale }),
+            crops: self.crops.clone(),
+        })
+    }
+
+    fn cut_and_stack(&self) -> bool {
+        self.handling == Handling::Multiple && self.order == PageOrder::CutStack
+    }
+
+    /// The spooler job for this print: the dialog's copies, two-sided and colour settings, the
+    /// driver options changed from the printer's defaults, and the chosen paper.
+    pub fn job(&self, title: &str) -> spool::Job {
+        spool::Job {
+            printer: self.printer.clone(),
+            copies: self.copies.max(1),
+            collate: self.collate,
+            // Cut and stack needs single-sided sheets, whatever the printer's default; a booklet
+            // decides two-sided itself (#2707), leaving the Two-sided choice as it was.
+            duplex: if self.cut_and_stack() {
+                Some(spool::Duplex::Off)
+            } else if self.handling == Handling::Booklet {
+                Some(print::booklet_duplex(self.booklet_subset))
+            } else {
+                self.duplex
+            },
+            scaling: spool::Scaling::Exact,
+            grayscale: self.grayscale,
+            title: title.to_string(),
+            // Only for the printer the options were read from.
+            options: match (&self.printer, &self.driver_options) {
+                (Some(p), Some((read_for, _))) if p == read_for => self.driver_choices.iter().map(|(k, v)| (k.clone(), v.clone())).collect(),
+                _ => Vec::new(),
+            }
+            .into_iter()
+            // The sheet the PDF was laid out on, not the queue's default paper.
+            .chain(print::media_option(self.paper))
+            .collect(),
+        }
+    }
+}
diff --git a/crates/ui-egui/src/web_print.rs b/crates/ui-egui/src/workflows/web_print.rs
similarity index 100%
rename from crates/ui-egui/src/web_print.rs
rename to crates/ui-egui/src/workflows/web_print.rs
diff --git a/crates/ui-egui/tests/it/actions.rs b/crates/ui-egui/tests/it/actions.rs
index 8e5f37cf08..a78de3481a 100644
--- a/crates/ui-egui/tests/it/actions.rs
+++ b/crates/ui-egui/tests/it/actions.rs
@@ -1,12 +1,30 @@
 //! Action Wizard in the real shell (egui_kittest): run a built-in action on files, create an
 //! action, and remember it.
 
+use egui::accesskit::Role;
 use egui_kittest::Harness;
 use egui_kittest::kittest::Queryable;
 use pdfcraft_engine::Session;
 use pdfcraft_engine::actions::Step;
 use pdfcraft_ui_egui::PdfCraftApp;
 
+/// The Action Wizard's name, description and step-argument boxes are named by their labels.
+#[test]
+fn action_editor_inputs_have_accessible_names() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app
+    });
+    h.run_steps(2);
+    assert!(h.state_mut().execute("actions.wizard"));
+    h.run_steps(2);
+    h.get_by_label("New Action…").click();
+    h.run_steps(2);
+    h.get_by_role_and_label(Role::TextInput, "Action name:");
+    h.get_by_role_and_label(Role::TextInput, "Description:");
+}
+
 #[test]
 fn run_and_create_actions() {
     let dir = std::env::temp_dir().join(format!("pdfcraft-actions-ui-{}", std::process::id()));
diff --git a/crates/ui-egui/tests/it/attachment_row.rs b/crates/ui-egui/tests/it/attachment_row.rs
new file mode 100644
index 0000000000..c52b2892e0
--- /dev/null
+++ b/crates/ui-egui/tests/it/attachment_row.rs
@@ -0,0 +1,190 @@
+//! An attachment's row in the Attachments panel answers a double-click and a right-click, as
+//! in Acrobat (#3466), while its buttons keep taking their own clicks.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+/// A one-page PDF with no embedded files, to attach to.
+const INNER: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// A one-page PDF with two embedded files: `inner.pdf` (a PDF) and `notes.txt`.
+fn attachments_pdf() -> Vec<u8> {
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /Names << /EmbeddedFiles << /Names [(inner.pdf) 5 0 R (notes.txt) 7 0 R] >> >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << >> >>".to_vec(),
+        [format!("<< /Type /EmbeddedFile /Length {} >>\nstream\n", INNER.len()).as_bytes(), INNER, b"\nendstream"].concat(),
+        b"<< /Type /Filespec /F (inner.pdf) /UF (inner.pdf) /EF << /F 4 0 R >> >>".to_vec(),
+        b"<< /Type /EmbeddedFile /Length 11 >>\nstream\nhello notes\nendstream".to_vec(),
+        b"<< /Type /Filespec /F (notes.txt) /UF (notes.txt) /EF << /F 6 0 R >> >>".to_vec(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// The app with [`attachments_pdf`] open and the Attachments panel showing, at 60 frames a
+/// second so two clicks a frame apart make a double-click.
+fn harness() -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 60.0).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, attachments_pdf()).unwrap();
+        app.set_option("panel", "attachments").unwrap();
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+/// A folder of its own for one test's saved file, removed afterwards.
+struct Dir(std::path::PathBuf);
+
+impl Dir {
+    fn new(test: &str) -> Self {
+        let path = std::env::temp_dir().join(format!("pdfcraft-attachment-row-{test}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&path);
+        std::fs::create_dir_all(&path).unwrap();
+        Self(path)
+    }
+}
+
+impl Drop for Dir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// Two pointer clicks a frame apart on `label` (an accessibility click is never a double-click).
+fn double_click(h: &mut Harness<'static, PdfCraftApp>, label: &str) {
+    let at = row_name(h, label);
+    h.hover_at(at);
+    h.run_steps(1);
+    for _ in 0..2 {
+        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+        h.run_steps(1);
+    }
+    h.run_steps(3);
+}
+
+fn right_click(h: &mut Harness<'static, PdfCraftApp>, label: &str) {
+    let at = row_name(h, label);
+    h.hover_at(at);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+}
+
+#[test]
+fn double_clicking_a_pdf_attachment_opens_it_in_a_new_tab() {
+    let mut h = harness();
+    assert_eq!(h.state().views.len(), 1);
+    double_click(&mut h, "inner.pdf");
+    assert_eq!(h.state().views.len(), 2, "the attached PDF opens in a tab of its own");
+}
+
+#[test]
+fn double_clicking_another_attachment_saves_it() {
+    let dir = Dir::new("double");
+    let target = dir.0.join("saved notes.txt");
+    let mut h = harness();
+    h.state_mut().pick_override = Some(vec![target.to_string_lossy().into_owned()]);
+    double_click(&mut h, "notes.txt");
+    assert_eq!(std::fs::read(&target).unwrap(), b"hello notes", "PdfCraft opens only PDFs, so it saves the rest");
+    assert_eq!(h.state().views.len(), 1, "nothing opens");
+}
+
+#[test]
+fn the_right_click_menu_opens_saves_and_deletes() {
+    let dir = Dir::new("menu");
+    let target = dir.0.join("from menu.pdf");
+    let mut h = harness();
+    let count = |h: &Harness<'static, PdfCraftApp>, label: &str| h.query_all_by_label(label).count();
+    // The rows have Save and Delete buttons each, and the PDF's row an Open button.
+    assert_eq!((count(&h, "Save attachment…"), count(&h, "Open in a new tab"), count(&h, "Delete attachment")), (2, 1, 2));
+    // A text file's menu has Save and Delete, no Open.
+    right_click(&mut h, "notes.txt");
+    assert_eq!((count(&h, "Save attachment…"), count(&h, "Open in a new tab"), count(&h, "Delete attachment")), (3, 1, 3));
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    // Scope actions to the menu: egui nests it under its row in the accessibility tree.
+    // Save writes the PDF, not the text file whose row comes last.
+    right_click(&mut h, "inner.pdf");
+    assert_eq!(count(&h, "Open in a new tab"), 2, "the PDF's menu offers Open");
+    h.state_mut().pick_override = Some(vec![target.to_string_lossy().into_owned()]);
+    h.get_by_role(egui::accesskit::Role::Menu).get_by_label("Save attachment…").click();
+    h.run_steps(3);
+    assert_eq!(std::fs::read(&target).unwrap(), INNER, "Save from inner.pdf's menu");
+    right_click(&mut h, "inner.pdf");
+    h.get_by_role(egui::accesskit::Role::Menu).get_by_label("Open in a new tab").click();
+    h.run_steps(3);
+    assert_eq!(h.state().views.len(), 2, "Open from the menu");
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    // Delete from inner.pdf's menu leaves notes.txt, whose row's button would delete itself.
+    right_click(&mut h, "inner.pdf");
+    h.get_by_role(egui::accesskit::Role::Menu).get_by_label("Delete attachment").click();
+    h.run_steps(3);
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.info.attachments.iter().map(|a| a.name.as_str()).collect::<Vec<_>>(), ["notes.txt"], "Delete from the menu");
+    assert!(doc.can_undo().is_some_and(|l| l.starts_with("Delete attachment")), "as one undoable edit");
+}
+
+#[test]
+fn the_row_buttons_still_take_their_own_clicks() {
+    let dir = Dir::new("buttons");
+    let target = dir.0.join("from button.txt");
+    let mut h = harness();
+    h.state_mut().pick_override = Some(vec![target.to_string_lossy().into_owned()]);
+    // The rows list inner.pdf first, then notes.txt: the second Save button is notes.txt's.
+    h.get_all_by_label("Save attachment…").nth(1).unwrap().click();
+    h.run_steps(3);
+    assert_eq!(std::fs::read(&target).unwrap(), b"hello notes", "the Save button under the row's click area");
+    h.get_by_label("Open in a new tab").click();
+    h.run_steps(3);
+    assert_eq!(h.state().views.len(), 2, "the Open button");
+}
+
+/// CodeRabbit on #4513: a right-click on one of a row's buttons opens that row's menu too, as a
+/// right-click anywhere on the row does.
+#[test]
+fn a_right_click_on_a_row_button_opens_the_row_menu() {
+    let mut h = harness();
+    let count = |h: &Harness<'static, PdfCraftApp>, label: &str| h.query_all_by_label(label).count();
+    // inner.pdf's row comes first: its Save button is the first one.
+    let at = h.get_all_by_label("Save attachment…").next().expect("inner.pdf's Save button").rect().center();
+    h.hover_at(at);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    assert_eq!(count(&h, "Open in a new tab"), 2, "inner.pdf's menu, with Open, is open");
+    assert_eq!(count(&h, "Save attachment…"), 3);
+}
+
+/// Where the attachment named `label` shows in the panel: the lowest text with that name, below
+/// a tab of the same name once the attachment is open.
+fn row_name(h: &Harness<'static, PdfCraftApp>, label: &str) -> egui::Pos2 {
+    h.get_all_by_label(label).map(|n| n.rect()).max_by(|a, b| a.top().total_cmp(&b.top())).expect("the attachment is listed").center()
+}
diff --git a/crates/ui-egui/tests/it/bookmarks.rs b/crates/ui-egui/tests/it/bookmarks.rs
index 1cf78958f6..415067ad33 100644
--- a/crates/ui-egui/tests/it/bookmarks.rs
+++ b/crates/ui-egui/tests/it/bookmarks.rs
@@ -77,6 +77,7 @@ fn new_rename_reorder_indent_delete_and_undo() {
 
     menu(&mut h, "Results", "Indent");
     assert_eq!(outline(&h), [("Intro".into(), Some(0), 0), ("Results".into(), Some(2), 1)]);
+    h.get_by_label("Results"); // its new parent opened, so it still shows
     menu(&mut h, "Results", "Outdent");
     menu(&mut h, "Results", "Move up");
     assert_eq!(outline(&h)[0].0, "Results");
@@ -100,7 +101,7 @@ fn new_rename_reorder_indent_delete_and_undo() {
 
 /// The side panel's width as egui keeps it from one frame to the next.
 fn panel_width(h: &Harness<'static, PdfCraftApp>) -> f32 {
-    h.ctx.data(|data| data.get_temp::<egui::Rect>(egui::Id::new("pdfcraft-inspector-body"))).expect("the inspector body is shown").width()
+    h.ctx.data(|data| data.get_temp::<egui::Rect>(egui::Id::unique("pdfcraft-inspector-body"))).expect("the inspector body is shown").width()
 }
 
 #[test]
@@ -289,8 +290,8 @@ fn style_and_colour_from_the_bookmark_menu() {
     let submenu = |h: &mut Harness<'static, PdfCraftApp>, menu: &str, item: &str| {
         h.get_by_label("Intro").click_secondary();
         h.run_steps(2);
-        // A submenu's button carries its arrow.
-        h.get_by_label(&format!("{menu} ⏵")).click();
+        // The submenu arrow is painted as an atom; the accessible name is the menu title.
+        h.get_by_label(menu).click();
         h.run_steps(2);
         h.get_by_label(item).click();
         h.run_steps(3);
@@ -310,3 +311,60 @@ fn style_and_colour_from_the_bookmark_menu() {
     h.run_steps(3);
     assert!(look(&h).0, "undoable");
 }
+
+/// Top-level bookmarks open as the file says, like every other level: a positive /Count shows
+/// the children, a negative one hides them until the reader opens it (ISO 32000-2 §12.3.3,
+/// Table 151). They used to open regardless.
+#[test]
+fn a_closed_top_level_bookmark_opens_closed() {
+    const OUTLINED: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /Outlines 10 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R >> endobj
+10 0 obj << /Type /Outlines /First 11 0 R /Last 13 0 R /Count 5 >> endobj
+11 0 obj << /Title (Closed parent) /Parent 10 0 R /Next 12 0 R /First 21 0 R /Last 22 0 R /Count -2 /Dest [3 0 R /Fit] >> endobj
+12 0 obj << /Title (Open parent) /Parent 10 0 R /Prev 11 0 R /Next 13 0 R /First 23 0 R /Last 24 0 R /Count 2 /Dest [3 0 R /Fit] >> endobj
+13 0 obj << /Title (Uncounted parent) /Parent 10 0 R /Prev 12 0 R /First 25 0 R /Last 25 0 R /Dest [3 0 R /Fit] >> endobj
+21 0 obj << /Title (Closed child A) /Parent 11 0 R /Next 22 0 R /Dest [3 0 R /Fit] >> endobj
+22 0 obj << /Title (Closed child B) /Parent 11 0 R /Prev 21 0 R /Dest [3 0 R /Fit] >> endobj
+23 0 obj << /Title (Open child A) /Parent 12 0 R /Next 24 0 R /Dest [3 0 R /Fit] >> endobj
+24 0 obj << /Title (Open child B) /Parent 12 0 R /Prev 23 0 R /Dest [3 0 R /Fit] >> endobj
+25 0 obj << /Title (Uncounted child) /Parent 13 0 R /Dest [3 0 R /Fit] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut h = harness();
+    h.state_mut().open_bytes("outlined.pdf", None, OUTLINED.to_vec()).unwrap();
+    h.run_steps(4);
+    let shown = |h: &Harness<'static, PdfCraftApp>, t: &str| h.query_by_label(t).is_some();
+    assert!(shown(&h, "Closed parent") && shown(&h, "Open parent") && shown(&h, "Uncounted parent"));
+    assert!(!shown(&h, "Closed child A") && !shown(&h, "Closed child B"), "a negative /Count opens closed");
+    assert!(shown(&h, "Open child A") && shown(&h, "Open child B"), "a positive /Count opens open");
+    assert!(!shown(&h, "Uncounted child"), "only a positive /Count opens a bookmark");
+
+    // The disclosure triangle at the row's left still opens and closes it.
+    let toggle = |h: &mut Harness<'static, PdfCraftApp>, title: &str| {
+        let row = h.get_by_label(title).rect();
+        let at = egui::pos2(row.left() + 8.0, row.top() + 14.0);
+        h.hover_at(at);
+        h.run_steps(1);
+        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(3);
+    };
+    toggle(&mut h, "Closed parent");
+    assert!(shown(&h, "Closed child A") && shown(&h, "Closed child B"), "opened by the reader");
+    toggle(&mut h, "Closed parent");
+    assert!(!shown(&h, "Closed child A"), "closed again");
+    toggle(&mut h, "Open parent");
+    assert!(!shown(&h, "Open child A"), "an open bookmark closes");
+
+    // A search still shows the matches inside a closed bookmark, and clearing it restores it.
+    h.get_by_label("Search").click();
+    h.run_steps(1);
+    h.get_by_label("Search").type_text("child B");
+    h.run_steps(3);
+    assert!(shown(&h, "Closed child B") && shown(&h, "Open child B"));
+    h.get_by_label("Clear").click();
+    h.run_steps(3);
+    assert!(!shown(&h, "Closed child B") && !shown(&h, "Open child B"), "search leaves the open state alone");
+}
diff --git a/crates/ui-egui/tests/it/combine_grid.rs b/crates/ui-egui/tests/it/combine_grid.rs
index 4ed7b5778e..0339e0b6bb 100644
--- a/crates/ui-egui/tests/it/combine_grid.rs
+++ b/crates/ui-egui/tests/it/combine_grid.rs
@@ -180,6 +180,17 @@ fn ready(t: &CombineThumb) -> bool {
     matches!(t, CombineThumb::Ready { .. })
 }
 
+/// Wait for a modal opened by an action to be laid out and present in the accessibility tree.
+/// A newly shown modal needs a pass of its own; the action's frame only sets its state.
+fn wait_for_label(h: &mut Harness<'static, PdfCraftApp>, label: &str) {
+    for _ in 0..30 {
+        if h.query_by_label(label).is_some() {
+            return;
+        }
+        h.run_steps(1);
+    }
+}
+
 /// Press, move in steps and release, as a user drags.
 fn drag(h: &mut Harness<'static, PdfCraftApp>, from: Pos2, to: Pos2) {
     h.hover_at(from);
@@ -519,6 +530,10 @@ fn combine_follows_the_order_shown_in_the_grid() {
 
 #[test]
 fn long_and_unusual_names_are_shortened_on_the_card_but_kept_whole() {
+    if crate::support::skip_without_glyphs("long_and_unusual_names_are_shortened_on_the_card_but_kept_whole", "en", "日本語のファイル名.pdf")
+    {
+        return;
+    }
     let long = "Überweisungsbestätigung für das dritte Quartal 2026 – Endfassung (unterschrieben).pdf";
     let mut h = grid_of(vec![(long, fixture(1)), ("日本語のファイル名.pdf", fixture(1)), ("a&b <c> 'd'.pdf", fixture(1))], vec2(1400.0, 900.0));
     // The card's label is the whole name; only the drawing is shortened.
@@ -691,6 +706,7 @@ fn a_card_dragged_to_the_bottom_edge_scrolls_the_grid_and_still_drops() {
     assert_eq!(order.get(at + 1), Some(&target_name), "dropped before {target_name}: {order:?}");
 }
 
+/// Check that right-clicking a locked card selects that card and offers Unlock for it.
 #[test]
 fn a_locked_card_offers_unlock_on_a_right_click() {
     let mut h = grid_of(vec![("one.pdf", fixture(1)), ("secret.pdf", protected("pw", "owner"))], vec2(1400.0, 900.0));
@@ -699,6 +715,7 @@ fn a_locked_card_offers_unlock_on_a_right_click() {
     // The menu's item comes after the toolbar's button of the same name.
     h.get_all_by_label("Unlock…").last().unwrap().click();
     h.run_steps(2);
+    wait_for_label(&mut h, "Unlock secret.pdf");
     h.get_by_label("Unlock secret.pdf");
     assert_eq!(h.state().combine_selection(), [1], "the card right-clicked is the one unlocked");
 }
@@ -716,6 +733,7 @@ fn ctrl_wheel(h: &mut Harness<'static, PdfCraftApp>, at: Pos2, dy: f32) {
         delta: vec2(0.0, dy),
         phase: egui::TouchPhase::Move,
         modifiers: Modifiers::COMMAND,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(3);
 }
@@ -833,6 +851,8 @@ fn ctrl_keys_and_ctrl_wheel_size_the_cards_and_leave_the_window_alone() {
     assert_eq!(h.state().combine_zoom, now);
 }
 
+/// Check that wheel zoom keeps the card under the pointer fixed and never blanks its thumbnail while a
+/// sharper render arrives.
 #[test]
 fn zooming_keeps_the_card_under_the_pointer_in_place_and_thumbnails_never_go_blank() {
     let files: Vec<(String, Vec<u8>)> = (0..40).map(|i| (format!("f{i:02}.pdf"), fixture(1))).collect();
@@ -845,6 +865,7 @@ fn zooming_keeps_the_card_under_the_pointer_in_place_and_thumbnails_never_go_bla
         delta: vec2(0.0, -300.0),
         phase: egui::TouchPhase::Move,
         modifiers: Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(6);
     // A card fully in view, below the toolbar, with its thumbnail drawn.
@@ -866,6 +887,7 @@ fn zooming_keeps_the_card_under_the_pointer_in_place_and_thumbnails_never_go_bla
         delta: vec2(0.0, 120.0),
         phase: egui::TouchPhase::Move,
         modifiers: Modifiers::COMMAND,
+        source: egui::MouseWheelSource::Unknown,
     });
     // The wheel zooms smoothly over several frames; in every one the card stays put.
     let mut zooms = Vec::new();
@@ -976,6 +998,7 @@ fn scrolled_grid(dy: f32) -> (Harness<'static, PdfCraftApp>, f32) {
         delta: vec2(0.0, -dy),
         phase: egui::TouchPhase::Move,
         modifiers: Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(8);
     (h, top)
@@ -1012,6 +1035,7 @@ fn zooming_from_the_toolbar_while_scrolled_keeps_the_top_cards_in_place() {
     }
 }
 
+/// Check that zooming out at the bottom keeps the last card in place without leaving a gap below it.
 #[test]
 fn zooming_out_at_the_bottom_leaves_no_gap_below_the_last_card() {
     let (mut h, _) = scrolled_grid(20_000.0);
@@ -1024,6 +1048,7 @@ fn zooming_out_at_the_bottom_leaves_no_gap_below_the_last_card() {
         delta: vec2(0.0, -20_000.0),
         phase: egui::TouchPhase::Move,
         modifiers: Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(8);
     let bottom = card(&h, "f39.pdf").bottom();
@@ -1598,13 +1623,16 @@ fn a_page_cards_magnifier_opens_the_preview_on_that_page() {
     h.get_by_label("Preview").click();
     h.run_steps(2);
     assert_eq!(h.state().combine_preview().map(|p| (p.0, p.1)), Some(("b.pdf".to_string(), 3)));
+    wait_for_label(&mut h, "Page 3 of 3");
     h.get_by_label("Page 3 of 3");
-    // A page card's own actions: Collapse, Remove page, Preview (its file can't be removed from
-    // it); nothing is selected yet, so no "Remove b.pdf" anywhere.
-    h.get_by_label("Remove page");
+    // The preview is modal: the card's actions are not drawn behind it.
+    assert!(h.query_by_label("Remove page").is_none(), "the preview covers the page card's actions");
     h.key_press(Key::Escape);
     h.run_steps(2);
+    // A page card's own actions: Collapse, Remove page, Preview (its file can't be removed from
+    // it); nothing is selected yet, so no "Remove b.pdf" anywhere.
     hover_card(&mut h, &page_card(4, "b.pdf"));
+    h.get_by_label("Remove page");
     h.get_by_label("Collapse");
     assert!(h.query_by_label("Remove b.pdf").is_none());
     // Space on a page card that has the keyboard: that page too.
@@ -1615,6 +1643,7 @@ fn a_page_cards_magnifier_opens_the_preview_on_that_page() {
     h.key_press(Key::Space);
     h.run_steps(2);
     assert_eq!(h.state().combine_preview().map(|p| p.1), Some(0), "page 1, the second the file adds");
+    wait_for_label(&mut h, "Page 2 of 3");
     h.get_by_label("Page 2 of 3");
 }
 
@@ -1651,6 +1680,7 @@ fn collapsing_brings_the_files_card_into_view() {
             delta: vec2(0.0, -120.0),
             phase: egui::TouchPhase::Move,
             modifiers: Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
         });
         h.run_steps(3);
     }
diff --git a/crates/ui-egui/tests/it/commands.rs b/crates/ui-egui/tests/it/commands.rs
index 6f10288612..1e3c36216f 100644
--- a/crates/ui-egui/tests/it/commands.rs
+++ b/crates/ui-egui/tests/it/commands.rs
@@ -293,19 +293,21 @@ fn palette_arrow_keys_select_results_and_enter_runs_the_selection() {
     assert_eq!(app.session.get(app.views[0].id).unwrap().info.pages[0].rotation, 270);
 }
 
+/// Check that choosing Edit ▸ Pages ▸ Delete pages in the menu bar reduces the page count once.
 #[test]
 fn the_pages_menu_comes_from_the_registry() {
     let mut h = harness();
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("Pages ⏵").hover();
+    support::open_menu(&mut h, "Edit");
+    support::menu_row(&h, "Pages").hover();
     h.run_steps(3);
-    h.get_by_label_contains("Delete pages").click();
+    support::menu_row(&h, "Delete pages").click();
     h.run_steps(3);
     let app = h.state();
     assert_eq!(app.session.get(app.views[0].id).unwrap().info.pages.len(), 2);
 }
 
+/// Check that Open Recent lists a recorded file and opens it in a new active tab without replacing the
+/// original.
 #[test]
 fn the_open_recent_menu_lists_files_and_opens_one() {
     let dir = std::env::temp_dir().join(format!("pdfcraft-recent-{}", std::process::id()));
@@ -324,14 +326,11 @@ fn the_open_recent_menu_lists_files_and_opens_one() {
         }
     });
     h.run_steps(4);
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("File ⏵").hover();
-    h.run_steps(3);
-    h.get_by_label("Open Recent ⏵").hover();
+    support::open_menu(&mut h, "File");
+    support::menu_row(&h, "Open Recent").hover();
     h.run_steps(3);
     let original = h.state().views[0].id;
-    h.get_by_label_contains("recent.pdf").click();
+    support::menu_row(&h, "recent.pdf").click();
     support::wait_until(&mut h, "recent document", |app| app.views.len() == 2 && app.password_prompt.is_none());
     let app = h.state();
     let active = app.active.unwrap();
@@ -341,13 +340,11 @@ fn the_open_recent_menu_lists_files_and_opens_one() {
     assert_eq!(app.session.get(original).unwrap().bytes.as_slice(), fixture(3).as_slice());
 }
 
+/// Check that Open Recent is disabled while no file has been opened.
 #[test]
 fn the_open_recent_menu_is_disabled_while_the_list_is_empty() {
     let mut h = harness();
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("File ⏵").hover();
-    h.run_steps(3);
+    support::open_menu(&mut h, "File");
     assert!(
         h.query_by(|n| n.label().as_deref() == Some("Open Recent") && n.is_disabled()).is_some(),
         "Open Recent is disabled while no file has been opened"
@@ -358,6 +355,7 @@ fn recent_file(name: &str) -> pdfcraft_ui_egui::RecentFile {
     pdfcraft_ui_egui::RecentFile { name: name.into(), path: format!("/nowhere/{name}"), pages: 1, size: 0 }
 }
 
+/// Check that Clear Recent Files empties the list and disables Open Recent.
 #[test]
 fn clear_recent_files_at_the_foot_of_open_recent_empties_the_list() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
@@ -368,19 +366,13 @@ fn clear_recent_files_at_the_foot_of_open_recent_empties_the_list() {
         app
     });
     h.run_steps(4);
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("File ⏵").hover();
+    support::open_menu(&mut h, "File");
+    support::menu_row(&h, "Open Recent").hover();
     h.run_steps(3);
-    h.get_by_label("Open Recent ⏵").hover();
-    h.run_steps(3);
-    h.get_by_label("Clear Recent Files").click();
+    support::menu_row(&h, "Clear Recent Files").click();
     h.run_steps(3);
     assert!(h.state().recent.is_empty(), "the list is empty");
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("File ⏵").hover();
-    h.run_steps(3);
+    support::open_menu(&mut h, "File");
     assert!(h.query_by(|n| n.label().as_deref() == Some("Open Recent") && n.is_disabled()).is_some(), "and Open Recent is disabled");
 }
 
@@ -453,13 +445,13 @@ fn localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings(
     assert!(!doc.dirty);
 }
 
-/// Menu ▸ View open, with egui told the app runs on `os`.
+/// View ▸ Zoom open in the menu bar, with egui told the app runs on `os`.
 fn view_menu(os: OperatingSystem) -> Harness<'static, PdfCraftApp> {
     let mut h = harness();
     h.ctx.set_os(os);
-    h.get_by_label("Menu").click();
     h.run_steps(2);
-    h.get_by_label("View ⏵").hover();
+    support::open_menu(&mut h, "View");
+    support::menu_row(&h, "Zoom").hover();
     h.run_steps(3);
     h
 }
@@ -468,21 +460,14 @@ fn view_menu(os: OperatingSystem) -> Harness<'static, PdfCraftApp> {
 fn view_menu_and_tooltips_write_shortcuts_for_the_platform() {
     // On Linux, View ▸ Zoom and Page navigation showed ⌘1, ⌘[ … (hard-coded) while the
     // registered items under them showed Ctrl+K; tooltips showed ⌘ too.
+    // The menu bar writes its shortcuts for the build's platform (craft-menu tests that).
     let h = view_menu(OperatingSystem::Nix);
-    h.get_by_label("Actual size Ctrl+1");
-    h.get_by_label("Zoom to page level Ctrl+0");
-    h.get_by_label("Rotate view counterclockwise Ctrl+Shift+−");
-    h.get_by_label("Previous view Ctrl+[");
-    h.get_by_label("Find tools and commands… Ctrl+K");
     h.get_by_label("Zoom in (Ctrl++)");
     h.get_by_label("Print (Ctrl+P)");
     assert_eq!(h.query_all_by_label_contains("⌘").count(), 0, "no ⌘ outside macOS");
     assert_eq!(h.query_all_by_label_contains("Fit visible").count(), 1, "View lists Fit visible once");
-    h.get_by_label("Fit visible Ctrl+3");
 
     let h = view_menu(OperatingSystem::Mac);
-    h.get_by_label("Actual size ⌘1");
-    h.get_by_label("Fit visible ⌘3");
     h.get_by_label("Rotate view clockwise (⇧⌘+)");
     assert_eq!(h.query_all_by_label_contains("Ctrl+").count(), 0, "no Ctrl+ on macOS");
 }
@@ -530,6 +515,8 @@ fn the_about_dialog_shows_the_running_version() {
     h.get_by_label_contains(&format!("Version {}", env!("CARGO_PKG_VERSION")));
 }
 
+/// Check that the quit shortcut needs exact platform modifiers and that unsaved work opens the save prompt
+/// instead of closing.
 #[test]
 fn quit_shortcut_requires_exact_modifiers_and_preserves_unsaved_work() {
     for (os, modifiers) in [
@@ -550,6 +537,9 @@ fn quit_shortcut_requires_exact_modifiers_and_preserves_unsaved_work() {
             let closes = h.output().viewport_output.values().any(|v| v.commands.contains(&egui::ViewportCommand::Close));
             assert_eq!(closes, should_close, "{os:?}, extra={extra:?}, dirty={dirty}");
             if dirty {
+                // The save prompt is a modal laid out after the key pass; let that pass settle
+                // before looking it up.
+                h.run_steps(2);
                 h.get_by_label("Cancel").click();
                 h.run_steps(2);
                 assert_eq!(h.state().views.len(), 1);
@@ -613,6 +603,9 @@ fn palette_ime_idle_frames_and_reopen_do_not_interrupt_composition() {
 
 #[test]
 fn palette_ime_chinese_preedit_commit_and_cancel_remain_uninterrupted() {
+    if crate::support::skip_without_glyphs("palette_ime_chinese_preedit_commit_and_cancel_remain_uninterrupted", "en", "你") {
+        return;
+    }
     let mut h = harness();
     let mut interruptions = Vec::new();
     h.state_mut().run_command("view.palette");
diff --git a/crates/ui-egui/tests/it/comment_pin.rs b/crates/ui-egui/tests/it/comment_pin.rs
new file mode 100644
index 0000000000..af9f802049
--- /dev/null
+++ b/crates/ui-egui/tests/it/comment_pin.rs
@@ -0,0 +1,161 @@
+//! The annotation quick bar's pin is a preference, including across older settings files.
+
+use egui::{Pos2, pos2};
+use egui_kittest::{Harness, kittest::Queryable};
+use pdfcraft_ui_egui::{PdfCraftApp, QuickTool, comments::CommentTool};
+use serde_json::{Value, json};
+
+// Contributor-original blank page: no document assets or fonts are needed.
+const PDF: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] >> endobj
+xref
+0 4
+0000000000 65535 f\r
+0000000009 00000 n\r
+0000000058 00000 n\r
+0000000115 00000 n\r
+trailer << /Size 4 /Root 1 0 R >>
+startxref
+186
+%%EOF";
+
+/// Start a fresh shell with the state a previous process saved.
+fn harness(saved: Option<String>) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        if let Some(saved) = saved {
+            app.restore(&saved);
+        }
+        app.set_option("language", "en").unwrap();
+        app.set_option("author", "Tester").unwrap();
+        app.open_bytes("pin.pdf", None, PDF.to_vec()).unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.set_option("quick", "callout").unwrap();
+        app
+    });
+    crate::support::wait_until(&mut h, "the blank page", |app| app.views[0].page_screen_rect(0).is_some() && !app.render_pending());
+    h
+}
+
+/// Place and post a callout at known PDF coordinates, independently of panel and zoom changes.
+fn callout(h: &mut Harness<'static, PdfCraftApp>, y: f32) {
+    let r = h.state().views[0].page_screen_rect(0).unwrap();
+    let at = |x: f32| -> Pos2 { pos2(r.left() + x / 300.0 * r.width(), r.top() + (200.0 - y) / 200.0 * r.height()) };
+    h.hover_at(at(40.0));
+    h.run_steps(1);
+    h.drag_at(at(40.0));
+    h.run_steps(1);
+    h.hover_at(at(140.0));
+    h.run_steps(1);
+    h.drop_at(at(140.0));
+    h.run_steps(3);
+    h.query_all_by(|node| node.placeholder() == Some("Type text")).next().unwrap().type_text("Remember this");
+    h.run_steps(2);
+    h.get_by_label("Post").click();
+    h.run_steps(3);
+}
+
+/// Optional private visual evidence, kept outside the repository by the test runner.
+fn shot(h: &mut Harness<'static, PdfCraftApp>, name: &str) {
+    if let Ok(dir) = std::env::var("PDFCRAFT_PIN_SHOTS") {
+        h.render().unwrap().save(std::path::Path::new(&dir).join(name)).unwrap();
+    }
+}
+
+#[test]
+fn pin_from_quick_bar_survives_restart_and_unpinning() {
+    let _gpu = crate::gpu();
+    let mut h = harness(None);
+    h.get_by_label("Keep tool selected").click();
+    h.run_steps(3);
+    assert!(h.state().comment_prefs.pinned);
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert!(doc.repair_log().is_empty(), "the synthetic page opens without repair");
+    assert_eq!(doc.bytes.as_slice(), PDF, "changing this preference leaves the PDF unchanged");
+    assert!(!doc.dirty);
+    let saved = h.state().persist();
+    drop(h);
+
+    let mut h = harness(Some(saved));
+    assert!(h.state().comment_prefs.pinned, "the pin survives a fresh shell");
+    h.get_by_label("Keep tool selected: on");
+    shot(&mut h, "pin-restored.png");
+    callout(&mut h, 140.0);
+    crate::support::wait_until(&mut h, "the pinned callout", |app| app.session.get(app.views[0].id).unwrap().info.annotations.len() == 1);
+    assert!(matches!(h.state().quick_tool, QuickTool::Comment(CommentTool::Callout)), "the restored pin keeps the tool selected after use");
+
+    h.get_by_label("Keep tool selected: on").click();
+    h.run_steps(3);
+    assert!(!h.state().comment_prefs.pinned);
+    shot(&mut h, "pin-disabled.png");
+    let saved = h.state().persist();
+    callout(&mut h, 60.0);
+    crate::support::wait_until(&mut h, "the unpinned callout returning to Select", |app| {
+        app.session.get(app.views[0].id).unwrap().info.annotations.len() == 2 && matches!(app.quick_tool, QuickTool::Select)
+    });
+    assert!(!matches!(h.state().quick_tool, QuickTool::Comment(_)), "unpinning restores one-shot use");
+
+    let mut restored = PdfCraftApp::new();
+    restored.comment_prefs.pinned = true;
+    restored.restore(&saved);
+    assert!(!restored.comment_prefs.pinned, "unpinning survives the next restart too");
+}
+
+#[test]
+fn saved_pin_round_trips_both_boolean_values() {
+    for pinned in [true, false] {
+        let mut app = PdfCraftApp::new();
+        app.comment_prefs.pinned = pinned;
+        let saved = app.persist();
+        let value: Value = serde_json::from_str(&saved).unwrap();
+        assert_eq!(value["comment_tool_pinned"], json!(pinned));
+        let mut restored = PdfCraftApp::new();
+        restored.comment_prefs.pinned = !pinned;
+        restored.restore(&saved);
+        assert_eq!(restored.comment_prefs.pinned, pinned);
+        assert!(matches!(restored.quick_tool, QuickTool::Select), "remembering the pin does not select a drawing tool at startup");
+    }
+}
+
+#[test]
+fn restoring_explicit_pin_choice_overrides_current_choice() {
+    for pinned in [true, false] {
+        let mut app = PdfCraftApp::new();
+        app.comment_prefs.pinned = !pinned;
+        app.restore(&json!({"comment_tool_pinned": pinned}).to_string());
+        assert_eq!(app.comment_prefs.pinned, pinned);
+    }
+}
+
+#[test]
+fn legacy_settings_keep_the_default_and_other_preferences() {
+    let mut app = PdfCraftApp::new();
+    assert!(!app.comment_prefs.pinned);
+    let legacy = r#"{"author":"Legacy reviewer","comment_styles":[{"tool":"comment.line","color":[0.25,0.5,1.0]}]}"#;
+    app.restore(legacy);
+    assert!(!app.comment_prefs.pinned, "old settings retain the default one-shot behavior");
+    assert_eq!(app.comment_prefs.author, "Legacy reviewer");
+    assert_eq!(app.comment_prefs.style(CommentTool::Line).color, [0.25, 0.5, 1.0]);
+    app.comment_prefs.pinned = true;
+    app.restore(legacy);
+    assert!(app.comment_prefs.pinned, "a partial restore without this key leaves the current choice alone");
+}
+
+#[test]
+fn malformed_pin_values_preserve_the_current_choice() {
+    for pinned in [false, true] {
+        let mut app = PdfCraftApp::new();
+        app.comment_prefs.pinned = pinned;
+        for value in [json!(null), json!(0), json!(1), json!(-1), json!("true"), json!("false"), json!([]), json!({})] {
+            app.restore(&json!({"comment_tool_pinned": value, "author": "Still restored"}).to_string());
+            assert_eq!(app.comment_prefs.pinned, pinned, "invalid pin value: {value}");
+            assert_eq!(app.comment_prefs.author, "Still restored", "other valid preferences still restore");
+        }
+        for invalid in ["", "{", r#"{"comment_tool_pinned":true"#, "[]", "null", "false", "0"] {
+            app.restore(invalid);
+            assert_eq!(app.comment_prefs.pinned, pinned);
+        }
+    }
+}
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index a273e3cd62..3a3169576c 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -1,6 +1,7 @@
 //! Commenting in the real shell (egui_kittest): tools, gestures, selection, the composer and
 //! the Comments panel.
 
+use egui::accesskit::Role;
 use egui::{Pos2, pos2};
 use egui_kittest::Harness;
 use egui_kittest::kittest::Queryable;
@@ -542,7 +543,7 @@ fn selected_text_replace_action_opens_replacement_composer() {
     h.run_steps(3);
     h.get_by_label("Replace text").click();
     h.run_steps(2);
-    h.get_by_label("Replacement text");
+    h.get_by_role_and_label(Role::MultilineTextInput, "Replacement text");
     assert!(h.state().views[0].selected_text().is_none());
 }
 
@@ -1052,7 +1053,7 @@ fn the_panel_posts_comments_and_replies() {
 
 /// The side panel's width as egui keeps it from one frame to the next.
 fn panel_width(h: &Harness<'static, PdfCraftApp>) -> f32 {
-    h.ctx.data(|data| data.get_temp::<egui::Rect>(egui::Id::new("pdfcraft-inspector-body"))).expect("the inspector body is shown").width()
+    h.ctx.data(|data| data.get_temp::<egui::Rect>(egui::Id::unique("pdfcraft-inspector-body"))).expect("the inspector body is shown").width()
 }
 
 #[test]
@@ -1228,8 +1229,9 @@ fn the_panel_filters_and_sorts() {
     assert_eq!(h.query_all_by_label("Oval").count(), ovals + 1, "a group header was added");
 }
 
-// Contributor-original PDF. Two roots deliberately share /NM. Their replies are on
-// another page, with dates opposite to source order. An unnamed root has no thread.
+// Contributor-original PDF. Two roots deliberately share /NM; the replies (on another page,
+// with dates opposite to source order) point at the first by reference. Nothing replies to the
+// unnamed root.
 const REVIEW_FIXTURE: &[u8] = b"%PDF-1.7
 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
 2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj
@@ -1250,7 +1252,7 @@ trailer << /Root 1 0 R >>
 %%EOF";
 
 #[test]
-fn the_panel_preserves_global_threads_source_order_and_unfiltered_page_counts() {
+fn the_panel_preserves_threads_source_order_and_unfiltered_page_counts() {
     let mut h = harness_with_bytes(REVIEW_FIXTURE.to_vec(), |app| {
         app.set_option("panel", "comments").unwrap();
         app.views[0].comments.search = Some("needle".into());
@@ -1272,14 +1274,16 @@ fn the_panel_preserves_global_threads_source_order_and_unfiltered_page_counts()
 
     h.state_mut().views[0].comments.hidden_authors.clear();
     h.run_steps(2);
-    h.get_by_label("Duplicate root");
-    assert_eq!(h.query_all_by_label("Needle first reply").count(), 2, "duplicate names share the same global thread");
+    // The replies point at the first root: sharing its /NM doesn't give the other its thread
+    // (or a search match on that thread).
+    assert_eq!(h.query_all_by_label("Duplicate root").count(), 0);
+    assert_eq!(h.query_all_by_label("Needle first reply").count(), 1);
     h.state_mut().views[0].comments.search = Some("status-only token".into());
     h.state_mut().views[0].comments.hidden_statuses.push("Rejected".into());
     h.state_mut().views[0].comments.hidden_checks.push("Checked".into());
     h.run_steps(2);
     h.get_by_label("First root");
-    h.get_by_label("Duplicate root");
+    assert_eq!(h.query_all_by_label("Duplicate root").count(), 0);
 
     h.state_mut().views[0].comments.hidden_statuses.push("Accepted".into());
     h.run_steps(2);
@@ -1293,7 +1297,167 @@ fn the_panel_preserves_global_threads_source_order_and_unfiltered_page_counts()
     h.state_mut().views[0].comments.hidden_checks.clear();
     h.run_steps(2);
     h.get_by_label("Unnamed root");
-    assert_eq!(h.query_all_by_label("Needle first reply").count(), 0, "an unnamed root has no replies");
+    assert_eq!(h.query_all_by_label("Needle first reply").count(), 0, "nothing replies to the unnamed root");
+}
+
+// Contributor-original PDF, shaped like PyMuPDF output: every page's first comment is named
+// `fitz-A0`, so only the `/IRT` reference tells which comment a reply belongs to.
+const PER_PAGE_NAMES: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [5 0 R] >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [6 0 R 7 0 R 8 0 R] >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (fitz-A0) /T (Alpha) /Contents (Cover note) >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (fitz-A0) /T (Beta) /Contents (Second page note) >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (fitz-A1) /IRT 6 0 R /T (Gamma) /Contents (Reply on page two) >> endobj
+8 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (fitz-A2) /IRT 6 0 R /T (Beta) /Contents (Answer on page two) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+#[test]
+fn replies_follow_irt_references_when_names_repeat_on_every_page() {
+    let h = harness_with_bytes(PER_PAGE_NAMES.to_vec(), |app| app.set_option("panel", "comments").unwrap());
+    let reply = h.get_by_label("Reply on page two");
+    assert!(reply.rect().top() > h.get_by_label("Second page note").rect().top(), "the reply sits under page 2's comment");
+    assert!(h.get_by_label("Page 2").rect().top() < reply.rect().top(), "not under page 1's comment, which shares the /NM");
+    h.get_by_label("Answer on page two");
+    // The header counts the two comments, not their replies (Acrobat says 2, not 4), and gives
+    // the replies in small text under it.
+    assert_eq!(h.query_all_by_label("4").count(), 0);
+    h.get_by_label("2 replies");
+}
+
+#[test]
+fn the_header_names_no_replies_when_there_are_none() {
+    let h = harness_with_bytes(PER_PAGE_NAMES.to_vec(), |app| {
+        app.set_option("panel", "comments").unwrap();
+        app.views[0].comments.search = Some("cover".into());
+    });
+    h.get_by_label("Cover note");
+    h.get_by_label("2 replies"); // The header counts the document, not the search.
+    let h = harness_with_bytes(SINGLE_COMMENT.to_vec(), |app| app.set_option("panel", "comments").unwrap());
+    h.get_by_label("Only note");
+    assert_eq!(h.query_all_by_label_contains("repl").count(), 0, "no \"0 replies\" line");
+}
+
+// Contributor-original PDF: one comment, no replies.
+const SINGLE_COMMENT: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [4 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (only) /T (Alpha) /Contents (Only note) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+// Contributor-original PDF. Page 1: an unnamed comment with a reply and a reply to that reply,
+// a Replace Text strikeout with its grouped caret, and a hidden status whose comment no page
+// lists. Page 2: an `/IRT` to the annotation itself, to an annotation no page lists (object 11),
+// to a pop-up, to a link and to a form field, and two annotations whose `/IRT`s point at each other.
+const THREAD_EDGES: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 19 0 R] >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [10 0 R 12 0 R 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 20 0 R 21 0 R] >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [20 160 40 180] /T (Alpha) /Contents (Unnamed parent) >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 160 40 180] /IRT 5 0 R /T (Beta) /Contents (Direct reply) >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 160 40 180] /IRT 6 0 R /T (Gamma) /Contents (Reply to the reply) >> endobj
+8 0 obj << /Type /Annot /Subtype /StrikeOut /Rect [60 100 160 112] /IT /StrikeOutTextEdit /T (Alpha) /Contents (Struck words) >> endobj
+9 0 obj << /Type /Annot /Subtype /Caret /Rect [158 96 166 104] /IRT 8 0 R /RT /Group /T (Alpha) /Contents (Replacement words) >> endobj
+10 0 obj << /Type /Annot /Subtype /Text /Rect [20 160 40 180] /IRT 10 0 R /T (Delta) /Contents (Points at itself) >> endobj
+11 0 obj << /Type /Annot /Subtype /Text /Rect [20 120 40 140] /T (Nobody) /Contents (Listed on no page) >> endobj
+12 0 obj << /Type /Annot /Subtype /Text /Rect [20 120 40 140] /IRT 11 0 R /T (Delta) /Contents (Points at an unlisted note) >> endobj
+13 0 obj << /Type /Annot /Subtype /Popup /Rect [120 100 280 180] >> endobj
+14 0 obj << /Type /Annot /Subtype /Text /Rect [20 80 40 100] /IRT 13 0 R /T (Delta) /Contents (Points at a pop-up) >> endobj
+15 0 obj << /Type /Annot /Subtype /Link /Rect [200 20 260 40] /Border [0 0 0] /Dest [3 0 R /Fit] >> endobj
+16 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (field) /Rect [200 60 260 80] >> endobj
+17 0 obj << /Type /Annot /Subtype /Text /Rect [20 50 40 70] /IRT 15 0 R /T (Delta) /Contents (Points at a link) >> endobj
+18 0 obj << /Type /Annot /Subtype /Text /Rect [20 20 40 40] /IRT 16 0 R /T (Delta) /Contents (Points at a form field) >> endobj
+19 0 obj << /Type /Annot /Subtype /Text /Rect [240 20 260 40] /F 30 /IRT 11 0 R /T (Delta) /StateModel /Review /State /Accepted /Contents (Stray status) >> endobj
+20 0 obj << /Type /Annot /Subtype /Text /Rect [60 20 80 40] /IRT 21 0 R /T (Delta) /Contents (Loop one) >> endobj
+21 0 obj << /Type /Annot /Subtype /Text /Rect [90 20 110 40] /IRT 20 0 R /T (Delta) /Contents (Loop two) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+#[test]
+fn replies_that_lead_nowhere_stay_comments_and_deeper_replies_join_their_thread() {
+    let mut h = harness_with_bytes(THREAD_EDGES.to_vec(), |app| {
+        app.set_option("panel", "comments").unwrap();
+        app.set_option("quick", "select").unwrap();
+    });
+    // An `/IRT` that reaches no listed comment leaves its annotation a comment of its own,
+    // rather than a reply shown nowhere.
+    // Links, form widgets and pop-ups are never parents: neither reader lists them as comments.
+    for orphan in
+        ["Points at itself", "Points at an unlisted note", "Points at a pop-up", "Points at a link", "Points at a form field", "Loop one", "Loop two"]
+    {
+        assert!(h.get_by_label(orphan).rect().top() > h.get_by_label("Page 2").rect().top(), "{orphan}");
+    }
+    // A reply to a reply joins the thread of the comment it starts from, also when that comment
+    // has no /NM.
+    let (parent, direct, deeper) = (h.get_by_label("Unnamed parent"), h.get_by_label("Direct reply"), h.get_by_label("Reply to the reply"));
+    assert!(parent.rect().top() < direct.rect().top() && direct.rect().top() < deeper.rect().top());
+    assert!(deeper.rect().top() < h.get_by_label("Struck words").rect().top(), "under its own thread");
+    // Comments: the unnamed parent, the strikeout and the seven on page 2. Replies: the two
+    // replies, not the Replace Text caret grouped with its strikeout.
+    h.get_by_label("9");
+    h.get_by_label("2 replies");
+    // A status whose comment no page lists is not a comment: no card, and nothing to pick on the
+    // page where it sits.
+    assert_eq!(h.query_all_by_label("Stray status").count(), 0);
+    click_pt(&mut h, (250.0, 30.0));
+    assert_eq!(h.state().views[0].comments.selected, None);
+}
+
+/// The arrow keys move a comment, not a reply: also not a reply to a comment with no `/NM`.
+#[test]
+fn arrow_keys_leave_a_reply_to_an_unnamed_comment_where_it_is() {
+    let mut h = harness_with_bytes(THREAD_EDGES.to_vec(), |app| app.set_option("quick", "select").unwrap());
+    let rect = |h: &Harness<'static, PdfCraftApp>, text: &str| comments(h).into_iter().find(|a| a.contents.as_deref() == Some(text)).unwrap().rect;
+    let (reply, parent) = (rect(&h, "Direct reply"), rect(&h, "Unnamed parent"));
+    h.state_mut().views[0].comments.selected = Some((0, 1));
+    h.key_press(egui::Key::ArrowRight);
+    h.run_steps(3);
+    assert_eq!(rect(&h, "Direct reply"), reply, "the reply stays");
+    h.state_mut().views[0].comments.selected = Some((0, 0));
+    h.key_press(egui::Key::ArrowRight);
+    h.run_steps(3);
+    assert_ne!(rect(&h, "Unnamed parent"), parent, "its comment moves");
+}
+
+// Contributor-original PDF: a comment, a reply, and a checkmark and a status set on the reply.
+const CHECKED_REPLY: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [4 0 R 5 0 R 6 0 R 7 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Text /Rect [100 100 120 120] /T (Alpha) /Contents (Unchecked comment) >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [100 60 120 80] /IRT 4 0 R /T (Beta) /Contents (Checked reply) >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [100 60 120 80] /IRT 5 0 R /T (Beta) /StateModel /Marked /State /Marked >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [100 60 120 80] /IRT 5 0 R /T (Beta) /StateModel /Review /State /Accepted >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// A checkmark or status belongs to the annotation its `/IRT` names (ISO 32000-2 §12.5.6.2): one
+/// set on a reply doesn't mark the comment, on its card or in the page's menu.
+#[test]
+fn a_checkmark_on_a_reply_does_not_mark_its_comment() {
+    let mut h = harness_with_bytes(CHECKED_REPLY.to_vec(), |app| {
+        app.set_option("panel", "comments").unwrap();
+        app.set_option("quick", "select").unwrap();
+    });
+    click_pt(&mut h, (110.0, 110.0));
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "the comment is selected");
+    h.get_by_label("Checked reply");
+    h.get_by_label("Mark with checkmark"); // The card's checkmark.
+    assert_eq!(h.query_all_by_label("Accepted").count(), 0, "no status badge");
+    let p = at(&h, 110.0, 110.0);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(3);
+    h.get_by_label("Copy text"); // The page's menu is open.
+    assert_eq!(h.query_all_by_label("Remove checkmark").count(), 0);
+    assert_eq!(h.query_all_by_label("Mark with checkmark").count(), 2, "the card and the page's menu");
 }
 
 #[test]
@@ -2172,6 +2336,9 @@ fn markup_hover_harness(pdf: Vec<u8>, view_rotation: u16) -> Harness<'static, Pd
         app.open_bytes("markup.pdf", None, pdf).expect("opens synthetic markup");
         app.set_option("left", "closed").unwrap();
         app.set_option("panel", "none").unwrap();
+        // Small enough to show the whole page in every rotation: a point hovered below the window
+        // is not over the page.
+        app.set_option("zoom", "100").unwrap();
         app.views[0].rotation = view_rotation;
         app
     });
@@ -2193,7 +2360,9 @@ fn hover_markup_at(h: &mut Harness<'static, PdfCraftApp>, x: f32, y: f32) {
             pw: page.width,
             ph: page.height,
         };
-        xf.user_rect(info, 0, [x, y, x, y]).center()
+        let p = xf.user_rect(info, 0, [x, y, x, y]).center();
+        assert!(v.viewport_rect().contains(p), "user point ({x}, {y}) is on screen, at {p:?}");
+        p
     };
     h.hover_at(p);
     h.run_steps(3);
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 0d7253707e..4a7927f692 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -335,6 +335,9 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
 /// written to the page as `?` (or lost).
 #[test]
 fn text_the_standard_fonts_cant_draw_stays_in_the_editor() {
+    if crate::support::skip_without_glyphs("text_the_standard_fonts_cant_draw_stays_in_the_editor", "en", "Hello 世界") {
+        return;
+    }
     let _gpu = gpu();
     let mut h = harness();
     assert!(h.state_mut().execute("edit.text"));
@@ -372,6 +375,9 @@ fn text_the_standard_fonts_cant_draw_stays_in_the_editor() {
 /// is left blocking Save out of sight.
 #[test]
 fn a_kept_draft_goes_with_its_deleted_page() {
+    if crate::support::skip_without_glyphs("a_kept_draft_goes_with_its_deleted_page", "en", "日本語") {
+        return;
+    }
     let mut h = harness();
     assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::InsertBlankPage { at: 1, width: 612.0, height: 792.0 }));
     h.run_steps(2);
@@ -609,6 +615,39 @@ fn dragged_text_follows_the_pointer_before_release() {
     assert_ne!(added(&h)[0].content.rect(), rect, "releasing moves it");
 }
 
+/// #4464: what a dragged text box covered in its first place stays there; only the text follows
+/// the pointer. The page has a red square under the text's first place and nothing elsewhere.
+#[test]
+fn dragged_text_leaves_what_it_covered_behind() {
+    let _gpu = gpu();
+    let content = "1 0 0 rg 20 60 240 70 re f";
+    let pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R >> endobj\n4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+        content.len()
+    );
+    let mut h = harness_bytes(pdf.into_bytes());
+    let (rect, from, to, end) = drag_added_text(&mut h);
+    assert!(rect[0] > 20.0 && rect[2] < 260.0 && rect[1] > 60.0 && rect[3] < 130.0, "the text starts on the red square: {rect:?}");
+    if let Ok(dir) = std::env::var("PDFCRAFT_SHOTS") {
+        h.render().unwrap().save(format!("{dir}/added-text-drag-over-red.png")).unwrap();
+    }
+    let pixels = h.render().unwrap();
+    let red = |r: egui::Rect| {
+        let (x0, y0, x1, y1) = (r.left().max(0.0) as u32, r.top().max(0.0) as u32, r.right() as u32, r.bottom() as u32);
+        (y0..y1.min(pixels.height()))
+            .flat_map(|y| (x0..x1.min(pixels.width())).map(move |x| (x, y)))
+            .filter(|(x, y)| matches!(pixels.get_pixel(*x, *y).0, [r, g, b, _] if r > 200 && g < 80 && b < 80))
+            .count()
+    };
+    let (old, new) = ink_at(&mut h, from, to);
+    assert!(new > 20 && old == 0, "the text follows the pointer ({old} old, {new} new)");
+    assert!(red(from) > 100, "the red square stays where the text was ({} red pixels)", red(from));
+    assert_eq!(red(to), 0, "and doesn't come along with the text");
+    h.drop_at(end);
+    h.run_steps(3);
+    assert_ne!(added(&h)[0].content.rect(), rect, "releasing moves it");
+}
+
 /// After release the text stays in its new place while the page is re-rendered with the move,
 /// instead of jumping back to where it was for those frames.
 #[test]
diff --git a/crates/ui-egui/tests/it/control.rs b/crates/ui-egui/tests/it/control.rs
index 1ffd9a4432..e2b09931ea 100644
--- a/crates/ui-egui/tests/it/control.rs
+++ b/crates/ui-egui/tests/it/control.rs
@@ -4,7 +4,7 @@
 use std::sync::{Arc, Mutex};
 
 use egui_kittest::Harness;
-use egui_kittest::kittest::{NodeT, Queryable};
+use egui_kittest::kittest::Queryable;
 use pdfcraft_render::{PageRenderer, RenderRequest, RequestKind};
 use pdfcraft_ui_egui::PdfCraftApp;
 use pdfcraft_ui_egui::control::{ControlClient, Reply};
@@ -88,6 +88,33 @@ fn ok(h: &mut Harness<'static, PdfCraftApp>, c: &ControlClient, method: &str, pa
     call(h, c, method, params).unwrap_or_else(|e| panic!("{method}: {e}"))
 }
 
+/// Let the next real frames run after a control setting that changes the interface fonts or
+/// opens a modal. `ui.set` answers in the input pass, and a font change discards the pass that
+/// applies it, so the modal's labels are not in the accessibility tree until those frames have
+/// been laid out.
+fn settle(h: &mut Harness<'static, PdfCraftApp>) {
+    h.run_steps(3);
+}
+
+#[test]
+fn comment_pin_is_reported_and_persistent() {
+    let (mut h, c) = harness();
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["comment_tool_pinned"], false);
+    for pinned in [true, false] {
+        ok(&mut h, &c, "ui.set", json!({"key":"comment-tool-pinned","value":pinned}));
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["comment_tool_pinned"], pinned);
+        let mut restored = PdfCraftApp::new();
+        restored.comment_prefs.pinned = !pinned;
+        restored.restore(&h.state().persist());
+        assert_eq!(restored.comment_prefs.pinned, pinned);
+        for invalid in [json!("yes"), json!(1), json!(null), json!([]), json!({})] {
+            assert!(call(&mut h, &c, "ui.set", json!({"key":"comment-tool-pinned","value":invalid})).is_err());
+            assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["comment_tool_pinned"], pinned);
+        }
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["documents"][0]["dirty"], false);
+    }
+}
+
 #[test]
 fn thumbnail_size_is_settable_and_inspectable_through_the_control_channel() {
     let (mut h, c) = harness();
@@ -143,6 +170,9 @@ fn control_resize_reports_observed_dimensions_and_rejects_invalid_sizes() {
     assert_eq!(state["documents"][0]["dirty"], false);
 }
 
+/// Kittest calls only `App::logic` and `App::ui`, not eframe's `raw_input_hook`, so this checks
+/// the widget tree and key handling but not the production focus-generation ordering. The
+/// `production_*` tests above drive `prepare_raw_input` first and cover that ordering.
 #[test]
 fn control_focus_traverses_real_widgets_and_keyboard_activates() {
     let (mut h, c) = harness();
@@ -164,6 +194,55 @@ fn control_focus_traverses_real_widgets_and_keyboard_activates() {
     assert_eq!(state["documents"][0]["dirty"], false);
 }
 
+/// A frame driven in production order: eframe's raw input hook runs before egui's input hooks, so
+/// the control plugin sees the focus/dialog generation produced by the previous UI pass. The
+/// kittest harness does not call `raw_input_hook`, which otherwise hides focus-change bugs.
+fn production_step(h: &mut Harness<'static, PdfCraftApp>) {
+    let ctx = h.ctx.clone();
+    let mut raw = std::mem::take(h.input_mut());
+    h.state_mut().prepare_raw_input(&ctx, &mut raw);
+    *h.input_mut() = raw;
+    h.step();
+}
+
+fn call_production(h: &mut Harness<'static, PdfCraftApp>, c: &ControlClient, method: &str, params: Value) -> Reply {
+    let rx = c.send(method, params);
+    for _ in 0..30 {
+        production_step(h);
+        if let Ok(r) = rx.try_recv() {
+            return r;
+        }
+    }
+    panic!("{method}: no reply after 30 production-ordered frames");
+}
+
+#[test]
+fn production_key_release_survives_the_focus_change_its_press_causes() {
+    let (mut h, c) = harness();
+    ok(&mut h, &c, "ui.focus", json!({"label": "Convert"}));
+    let reply = call_production(&mut h, &c, "ui.key", json!({"key": "Tab"}));
+    reply.unwrap_or_else(|e| panic!("a Tab press that moves focus must not leave its release unapplied: {e}"));
+    let sign = ok(&mut h, &c, "ui.inspect", json!({"query": "E-Sign", "role": "Button"}));
+    assert!(sign["widgets"].as_array().unwrap().iter().any(|w| w["label"] == "E-Sign" && w["focused"] == true), "focus moved on the press: {sign}");
+    assert!(!h.ctx.input(|i| i.keys_down.contains(&egui::Key::Tab)), "the release reached egui: no stuck Tab");
+}
+
+#[test]
+fn production_drag_releases_the_button_after_the_press_moves_focus() {
+    let (mut h, c) = harness_pages(2);
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::AddBookmark { parent: vec![], index: 0, title: "Target".into(), page: 0, left: None, top: None });
+    ok(&mut h, &c, "ui.set", json!({"key": "panel", "value": "bookmarks"}));
+    let field = ok(&mut h, &c, "ui.inspect", json!({"query": "Search", "role": "TextInput"}));
+    let rect = field["widgets"][0]["rect"].as_array().expect("the search field has a rect");
+    let (x0, y0, x1, y1) = (rect[0].as_f64().unwrap(), rect[1].as_f64().unwrap(), rect[2].as_f64().unwrap(), rect[3].as_f64().unwrap());
+    let start = json!([x0 + 8.0, (y0 + y1) / 2.0]);
+    let end = json!([x1 - 8.0, (y0 + y1) / 2.0]);
+    call_production(&mut h, &c, "ui.drag", json!({"from": start, "to": end, "steps": 3}))
+        .unwrap_or_else(|e| panic!("the press's focus change must not cancel its moves and release: {e}"));
+    assert!(!h.ctx.input(|i| i.pointer.button_down(egui::PointerButton::Primary)), "the pointer button was released");
+    assert_eq!(h.ctx.input(|i| i.modifiers), egui::Modifiers::NONE, "no modifier is left held");
+}
+
 #[test]
 fn control_button_focus_preserves_document_undo_redo_shortcuts() {
     let (mut h, c) = harness_pages(2);
@@ -190,7 +269,7 @@ fn control_text_focus_retains_text_undo_ownership() {
     ok(&mut h, &c, "ui.focus", json!({"id": widgets["widgets"][0]["id"]}));
     assert!(h.ctx.text_edit_focused());
     ok(&mut h, &c, "ui.type", json!({"text": "target"}));
-    let search_id = egui::Id::new(("bookmark_search", h.state().views[0].id.0));
+    let search_id = egui::Id::unique(("bookmark_search", h.state().views[0].id.0));
     assert_eq!(h.ctx.data(|d| d.get_temp::<String>(search_id)).as_deref(), Some("target"));
     ok(&mut h, &c, "ui.key", json!({"key": "Z", "modifiers": ["command"]}));
     assert_eq!(h.ctx.data(|d| d.get_temp::<String>(search_id)).as_deref(), Some(""));
@@ -401,16 +480,16 @@ fn lithuanian_inspector_title_updates_through_the_control_channel() {
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.set", json!({ "key": "panel", "value": "comments" }));
     h.run_steps(2);
-    h.get_by_role_and_label(egui::accesskit::Role::Tab, "Inspector");
+    h.get_by_label("Inspector");
     let documents = ok(&mut h, &c, "ui.state", json!({}))["documents"].clone();
     ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": "lt" }));
     h.run_steps(2);
-    h.get_by_role_and_label(egui::accesskit::Role::Tab, "Inspektorius");
-    assert!(h.query_by_role_and_label(egui::accesskit::Role::Tab, "Inspector").is_none());
+    h.get_by_label("Inspektorius");
+    assert!(h.query_by_label("Inspector").is_none());
     assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["documents"], documents);
     ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": "en" }));
     h.run_steps(2);
-    h.get_by_role_and_label(egui::accesskit::Role::Tab, "Inspector");
+    h.get_by_label("Inspector");
 }
 
 /// Switching the interface language changes labels only: documents, their dirty state and the
@@ -425,6 +504,9 @@ fn language_switch_preserves_document_and_command_ids() {
     assert_eq!(documents[0]["dirty"], true);
     let commands = ok(&mut h, &c, "ui.commands", json!({}));
     for code in ["ja", "zh-hans", "fr", "de", "uk", "lt", "en"] {
+        if crate::support::skip_without_glyphs(&format!("language_switch_preserves_document_and_command_ids ({code})"), code, "") {
+            continue;
+        }
         ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": code }));
         h.run_steps(2);
         let state = ok(&mut h, &c, "ui.state", json!({}));
@@ -433,12 +515,16 @@ fn language_switch_preserves_document_and_command_ids() {
         assert_eq!(ok(&mut h, &c, "ui.commands", json!({})), commands);
 
         let lang = i18n::Lang::from_code(code).unwrap();
-        h.get_by_label(i18n::tr(lang, "Menu")).click();
+        // A title without an ASCII letter shows its mnemonic after it ("ファイル(F)").
+        let file = i18n::tr(lang, "File");
+        h.get_by(|n| n.role() == egui::accesskit::Role::MenuItem && n.label().is_some_and(|l| l.starts_with(file))).click();
         h.run_steps(2);
-        h.get_by_label(&format!("{} ⏵", i18n::tr(lang, "File"))).hover();
-        h.run_steps(3);
-        h.get_by_label_contains(i18n::tr(lang, "Open…"));
-        ok(&mut h, &c, "ui.key", json!({ "key": "Escape" }));
+        // The mnemonic goes before an ellipsis: "開く(O)…".
+        let open = i18n::tr(lang, "Open…").trim_end_matches('…');
+        let open_row = |n: &egui_kittest::kittest::AccessKitNode<'_>| {
+            n.role() == egui::accesskit::Role::MenuItem && n.label().is_some_and(|l| l.starts_with(open))
+        };
+        assert!(h.query_all_by(open_row).next().is_some(), "File lists Open… in {code}");
         ok(&mut h, &c, "ui.key", json!({ "key": "Escape" }));
         h.run_steps(2);
     }
@@ -697,6 +783,7 @@ fn autoscroll_cancels_on_click_wheel_focus_loss_and_pointer_exit() {
         delta: egui::vec2(0.0, -20.0),
         phase: egui::TouchPhase::Move,
         modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(2);
     assert!(!h.state().views[0].auto_scrolling());
@@ -828,6 +915,9 @@ fn state_and_view_options() {
 
 #[test]
 fn japanese_controls_and_search_keep_command_ids() {
+    if crate::support::skip_without_glyphs("japanese_controls_and_search_keep_command_ids", "ja", "") {
+        return;
+    }
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": "ja" }));
     assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["language"], "ja");
@@ -835,6 +925,8 @@ fn japanese_controls_and_search_keep_command_ids() {
     assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["mode"], "Convert");
 
     ok(&mut h, &c, "ui.command", json!({ "id": "app.preferences" }));
+    // The command sets the dialog; its content reaches the accessibility tree in the next pass.
+    h.run_steps(2);
     let prefs = ok(&mut h, &c, "ui.inspect", json!({ "query": "表示言語" }));
     assert!(prefs["count"].as_u64().unwrap() > 0, "{prefs}");
     ok(&mut h, &c, "ui.click", json!({ "label": "OK" }));
@@ -860,6 +952,7 @@ fn german_preferences_and_search_keep_command_ids() {
     ok(&mut h, &c, "ui.click", json!({ "label": "Konvertieren" }));
     assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["mode"], "Convert");
     ok(&mut h, &c, "ui.command", json!({ "id": "app.preferences" }));
+    h.run_steps(2);
     let prefs = ok(&mut h, &c, "ui.inspect", json!({ "query": "Sprache der Oberfläche" }));
     assert!(prefs["count"].as_u64().unwrap() > 0, "{prefs}");
     let selector = ok(&mut h, &c, "ui.inspect", json!({ "query": "Deutsch" }));
@@ -889,6 +982,7 @@ fn ukrainian_preferences_and_search_keep_command_ids() {
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": "uk" }));
     ok(&mut h, &c, "ui.command", json!({ "id": "app.preferences" }));
+    h.run_steps(2);
     for label in ["Мова інтерфейсу", "Українська"] {
         let found = ok(&mut h, &c, "ui.inspect", json!({ "query": label }));
         assert!(found["count"].as_u64().unwrap() > 0, "{label}: {found}");
@@ -918,13 +1012,22 @@ fn ukrainian_preferences_and_search_keep_command_ids() {
 
 #[test]
 fn preferences_menu_and_shortcut_allow_switching_interface_languages() {
+    if crate::support::skip_without_glyphs("preferences_menu_and_shortcut_allow_switching_interface_languages", "ja", "") {
+        return;
+    }
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.set", json!({ "key": "language", "value": "ja" }));
-    ok(&mut h, &c, "ui.click", json!({ "label": "メニュー" }));
-    ok(&mut h, &c, "ui.click", json!({ "label": "編集 ⏵" }));
-    let menu = ok(&mut h, &c, "ui.inspect", json!({ "query": "環境設定…" }));
-    let prefs = menu["widgets"].as_array().unwrap().iter().find(|w| w["clickable"] == true).expect("Preferences menu item");
-    ok(&mut h, &c, "ui.click", json!({ "id": prefs["id"] }));
+    // The menu bar's Edit menu holds Preferences. Titles and rows carry their mnemonic
+    // ("編集(E)", "環境設定(P)…"), so match by the start of the label.
+    let menu_row = |text: &'static str| {
+        move |n: &egui_kittest::kittest::AccessKitNode<'_>| {
+            n.role() == egui::accesskit::Role::MenuItem && n.label().is_some_and(|l| l.starts_with(text))
+        }
+    };
+    h.get_by(menu_row("編集")).click();
+    h.run_steps(2);
+    h.get_by(menu_row("環境設定")).click();
+    h.run_steps(2);
     for (current, next, code) in [("日本語", "English", "en"), ("English", "Українська", "uk"), ("Українська", "日本語", "ja")]
     {
         let selector = ok(&mut h, &c, "ui.inspect", json!({ "query": current }));
@@ -953,6 +1056,9 @@ fn preferences_menu_and_shortcut_allow_switching_interface_languages() {
 
 #[test]
 fn japanese_dialogs_errors_and_custom_action_names() {
+    if crate::support::skip_without_glyphs("japanese_dialogs_errors_and_custom_action_names", "ja", "") {
+        return;
+    }
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.set", json!({"key": "language", "value": "ja"}));
     for (dialog, label) in [
@@ -993,10 +1099,15 @@ fn japanese_dialogs_errors_and_custom_action_names() {
 
 #[test]
 fn simplified_chinese_about_tabs_and_credit_controls() {
+    if crate::support::skip_without_glyphs("simplified_chinese_about_tabs_and_credit_controls", "zh-hans", "") {
+        return;
+    }
     let (mut h, c) = harness();
     let documents = ok(&mut h, &c, "ui.state", json!({}))["documents"].clone();
     ok(&mut h, &c, "ui.set", json!({"key": "language", "value": "zh-hans"}));
+    settle(&mut h);
     ok(&mut h, &c, "ui.set", json!({"key": "dialog", "value": "about"}));
+    settle(&mut h);
     for label in ["关于", "贡献者", "模型"] {
         let found = ok(&mut h, &c, "ui.inspect", json!({"query": label}));
         assert!(found["widgets"].as_array().unwrap().iter().any(|w| w["label"] == label), "{found}");
@@ -1020,10 +1131,15 @@ fn simplified_chinese_about_tabs_and_credit_controls() {
 
 #[test]
 fn simplified_chinese_signature_prompts_and_errors_keep_document_state() {
+    if crate::support::skip_without_glyphs("simplified_chinese_signature_prompts_and_errors_keep_document_state", "zh-hans", "") {
+        return;
+    }
     let (mut h, c) = harness();
     let documents = ok(&mut h, &c, "ui.state", json!({}))["documents"].clone();
     ok(&mut h, &c, "ui.set", json!({"key": "language", "value": "zh-hans"}));
+    settle(&mut h);
     ok(&mut h, &c, "ui.set", json!({"key": "dialog", "value": "signature"}));
+    settle(&mut h);
     let typed = ok(&mut h, &c, "ui.inspect", json!({"query": "请输入您的签名。"}));
     assert!(typed["count"].as_u64().unwrap() > 0, "{typed}");
     // The shell also has a Draw control; the modal's button is registered after the shell.
@@ -1251,6 +1367,10 @@ fn screenshots_of_window_and_region() {
     let region = ok(&mut h, &c, "ui.screenshot", json!({ "region": [10, 20, 110, 70] }));
     assert_eq!((region["width"].as_f64().unwrap(), region["height"].as_f64().unwrap()), ((100.0 * ppp).round(), (50.0 * ppp).round()));
     assert!(call(&mut h, &c, "ui.screenshot", json!({ "region": [5, 5, 1, 1] })).is_err());
+    // A region that cannot be inside the window is refused at admission, before a frame or slot
+    // is used, with an actionable message.
+    let outside = call(&mut h, &c, "ui.screenshot", json!({ "region": [1300, 0, 1500, 10] })).unwrap_err();
+    assert!(outside.contains("inside the window"), "{outside}");
 }
 
 #[test]
@@ -1478,135 +1598,72 @@ fn a_plan_scale_picked_or_typed_applies_at_once() {
 }
 
 #[test]
-fn docking_pointer_group_float_close_restore_and_document_commands() {
-    use pdfcraft_ui_egui::docking::Panel;
+fn ui_panel_opens_closes_and_sizes_panes_and_survives_restore() {
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.set", json!({"key":"panel", "value":"bookmarks"}));
-    h.run_steps(4);
-    // Tools docked alone has no tab strip (as Acrobat's tool pane), so it is grouped by command.
-    assert!(h.query_by_role_and_label(egui::accesskit::Role::Tab, "Tools").is_none());
-    ok(&mut h, &c, "ui.dock", json!({"operation":"move", "panel":"inspector", "target":"tools", "zone":"center"}));
-    h.run_steps(4);
-    assert_eq!(h.state().docking.layout.location(&Panel::Inspector).unwrap().anchor, Some(Panel::Tools));
-    // Grouped, Tools has its tab again.
-    h.get_by_role_and_label(egui::accesskit::Role::Tab, "Tools");
-    h.get_by_role_and_label(egui::accesskit::Role::Tab, "Inspector").click_button(egui::PointerButton::Secondary);
     h.run_steps(3);
-    h.get_by_label("Float panel").click();
-    h.run_steps(5);
-    let rect = h.state().docking.layout.floating.iter().find(|g| g.panels.contains(&Panel::Inspector)).unwrap().rect;
-    h.get_by_role_and_label(egui::accesskit::Role::Tab, "Inspector").click_button(egui::PointerButton::Secondary);
+    let state = ok(&mut h, &c, "ui.panel", json!({"panel":"side", "width": 401.6}));
+    assert_eq!(state["side_panels"]["side_width"], 401.6f32 as f64);
+    // Widths are clamped to the panel's limits.
+    let state = ok(&mut h, &c, "ui.panel", json!({"panel":"tools", "width": 9000}));
+    assert_eq!(state["side_panels"]["tools_width"], 520.0);
+    ok(&mut h, &c, "ui.panel", json!({"panel":"tools", "width": 300, "open": false}));
     h.run_steps(3);
-    // Scope to the open context menu; the Tools body also has a close icon.
-    h.get_by_label("Float panel").parent().unwrap().get_by_label("Close panel").click();
-    h.run_steps(4);
-    assert!(!h.state().docking.layout.contains(&Panel::Inspector));
-    ok(&mut h, &c, "ui.set", json!({"key":"panel", "value":"bookmarks"}));
-    h.run_steps(4);
-    assert_eq!(h.state().docking.layout.floating.iter().find(|g| g.panels.contains(&Panel::Inspector)).unwrap().rect, rect);
+    assert!(!h.state().left_open);
+    ok(&mut h, &c, "ui.panel", json!({"panel":"side", "open": false}));
+    h.run_steps(3);
+    assert_eq!(h.state().right, None);
+    assert!(h.query_by_label("This document has no bookmarks.").is_none());
+    // Reopening the side panel brings back the one open last.
+    ok(&mut h, &c, "ui.panel", json!({"panel":"side", "open": true}));
+    h.run_steps(3);
+    h.get_by_label("This document has no bookmarks.");
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["side_panels"]["side_panel"], "Bookmarks");
     let saved = h.state().persist();
-    let expected = serde_json::to_value(&h.state().docking).unwrap();
     let (mut reloaded, client) = harness();
     reloaded.state_mut().restore(&saved);
-    reloaded.run_steps(5);
-    assert_eq!(serde_json::to_value(&reloaded.state().docking).unwrap(), expected);
-    ok(&mut reloaded, &client, "ui.dock", json!({"operation":"move", "panel":"inspector", "target":"tools", "zone":"center"}));
     reloaded.run_steps(4);
-    ok(&mut reloaded, &client, "ui.command", json!({"id":"page.insert_blank"}));
-    assert_eq!(ok(&mut reloaded, &client, "ui.state", json!({}))["documents"][0]["pages"], 6);
-    ok(&mut reloaded, &client, "ui.command", json!({"id":"edit.undo"}));
+    let state = ok(&mut reloaded, &client, "ui.state", json!({}))["side_panels"].clone();
+    assert_eq!(
+        state,
+        json!({"tools_side":"left", "tools_open":false, "tools_width":300.0, "side_open":true, "side_panel":"Bookmarks", "side_width":401.6f32 as f64})
+    );
+    // The ui.command form and the reset command.
+    ok(&mut reloaded, &client, "ui.command", json!({"id":"ui.panel", "params":{"panel":"tools", "open":true}}));
+    assert!(reloaded.state().left_open);
+    ok(&mut reloaded, &client, "ui.panel", json!({"panel":"tools", "width": 300}));
+    ok(&mut reloaded, &client, "ui.set", json!({"key":"tools-side", "value":"right"}));
+    ok(&mut reloaded, &client, "ui.command", json!({"id":"ui.dock.reset"}));
+    let state = ok(&mut reloaded, &client, "ui.state", json!({}))["side_panels"].clone();
+    assert_eq!((state["tools_side"].clone(), state["tools_width"].clone(), state["side_width"].clone()), (json!("left"), json!(272.0), json!(330.0)));
     assert_eq!(ok(&mut reloaded, &client, "ui.state", json!({}))["documents"][0]["pages"], 5);
 }
 
 #[test]
-fn invalid_docking_requests_are_atomic_and_do_not_change_documents() {
+fn invalid_panel_requests_change_nothing() {
     let (mut h, c) = harness();
-    let before = serde_json::to_value(&h.state().docking).unwrap();
+    let before = ok(&mut h, &c, "ui.state", json!({}))["side_panels"].clone();
     for params in [
-        json!({"operation":"close", "panel":"canvas"}),
-        json!({"operation":"move", "panel":"tools", "target":"canvas", "zone":"center"}),
-        json!({"operation":"float", "panel":"tools", "rect":[0,0,-1,100]}),
-        json!({"operation":"move", "panel":"unknown", "target":"tools", "zone":"center"}),
+        json!({"panel":"canvas"}),
+        json!({"panel":"inspector", "open": true}),
+        json!({}),
+        json!({"panel":"tools", "open":"yes"}),
+        json!({"panel":"tools", "width":"wide"}),
+        json!({"panel":"side", "width": 300, "open": 1}),
     ] {
-        assert!(call(&mut h, &c, "ui.dock", params).is_err());
-        assert_eq!(serde_json::to_value(&h.state().docking).unwrap(), before);
+        assert!(call(&mut h, &c, "ui.panel", params).is_err());
         let state = ok(&mut h, &c, "ui.state", json!({}));
+        assert_eq!(state["side_panels"], before);
         assert_eq!(state["documents"][0]["pages"], 5);
         assert_eq!(state["documents"][0]["dirty"], false);
     }
 }
 
+/// #3580 review: a panel a script opens (`app.execMenuItem("ShowHideBookmarks")`) is shown.
 #[test]
-fn docking_renders_real_pdf_default_floating_and_redocked() {
-    for width in [900.0, 1400.0] {
-        for scale in [1.0, 2.0] {
-            let (mut h, c) = harness_pages_at(5, width, scale);
-            ok(&mut h, &c, "ui.resize", json!({"width":width,"height":900}));
-            ok(&mut h, &c, "ui.set", json!({"key":"panel","value":"bookmarks"}));
-            h.state_mut().apply_edit(pdfcraft_engine::Edit::AddBookmark {
-                parent: vec![],
-                index: 0,
-                title: "Overview".into(),
-                page: 0,
-                left: None,
-                top: None,
-            });
-            h.state_mut().apply_edit(pdfcraft_engine::Edit::AddBookmark {
-                parent: vec![],
-                index: 1,
-                title: "Details".into(),
-                page: 2,
-                left: None,
-                top: None,
-            });
-            for state in ["default", "floating", "redocked"] {
-                if state == "floating" {
-                    ok(&mut h, &c, "ui.dock", json!({"operation":"float", "panel":"inspector", "rect":[160,100,330,480]}));
-                } else if state == "redocked" {
-                    ok(&mut h, &c, "ui.dock", json!({"operation":"move", "panel":"inspector", "target":"tools", "zone":"center"}));
-                }
-                h.run_steps(5);
-                h.state().docking.validate().unwrap();
-                if let Ok(directory) = std::env::var("CRAFT_UI_DOCKING_DIR") {
-                    let _gpu = crate::gpu();
-                    std::fs::create_dir_all(&directory).unwrap();
-                    h.render().unwrap().save(format!("{directory}/pdf-{width}-{scale}-{state}.png")).unwrap();
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn explicit_panel_requests_reveal_inactive_group_members() {
-    let (mut h, c) = harness();
-    ok(&mut h, &c, "ui.set", json!({"key":"panel", "value":"bookmarks"}));
-    ok(&mut h, &c, "ui.dock", json!({"operation":"move", "panel":"inspector", "target":"tools", "zone":"center"}));
-    ok(&mut h, &c, "ui.dock", json!({"operation":"activate", "panel":"tools"}));
-    ok(&mut h, &c, "ui.command", json!({"id":"form.fields"}));
-    h.run_steps(4);
-    h.get_by_label("Fields");
-    h.get_by_role_and_label(egui::accesskit::Role::Tab, "Tools").click();
-    h.run_steps(4);
-    // Ordinary frames must preserve the user's selected tab.
-    h.get_by_label("View more");
-    ok(&mut h, &c, "ui.set", json!({"key":"panel", "value":"bookmarks"}));
-    h.run_steps(4);
-    h.get_by_label("This document has no bookmarks.");
-    ok(&mut h, &c, "ui.command", json!({"id":"edit.edit_text"}));
-    h.run_steps(4);
-    // The Edit panel's own row: the tool's name is on the floating toolbar too while it is on.
-    h.get_by_label("Header and footer");
-}
-
-/// #3580 review: a panel a script opens (`app.execMenuItem("ShowHideBookmarks")`) is shown even
-/// when the inspector is a background tab of a custom docking layout.
-#[test]
-fn a_script_opened_panel_reveals_an_inactive_inspector() {
+fn a_script_opened_panel_shows() {
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.set", json!({"key":"panel", "value":"pages"}));
-    ok(&mut h, &c, "ui.dock", json!({"operation":"move", "panel":"inspector", "target":"tools", "zone":"center"}));
-    ok(&mut h, &c, "ui.dock", json!({"operation":"activate", "panel":"tools"}));
     h.run_steps(3);
     assert!(h.query_by_label("This document has no bookmarks.").is_none());
     let id = h.state().active_ids().unwrap().1;
@@ -1616,12 +1673,11 @@ fn a_script_opened_panel_reveals_an_inactive_inspector() {
 }
 
 #[test]
-fn home_and_combine_suppress_inspector_without_forgetting_layout_or_choice() {
-    use pdfcraft_ui_egui::docking::Panel;
+fn home_and_combine_hide_the_side_panel_without_forgetting_it() {
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.set", json!({"key":"panel", "value":"bookmarks"}));
-    ok(&mut h, &c, "ui.dock", json!({"operation":"float", "panel":"inspector", "rect":[170,120,330,470]}));
-    let before = serde_json::to_value(&h.state().docking).unwrap();
+    ok(&mut h, &c, "ui.panel", json!({"panel":"side", "width": 380}));
+    let before = ok(&mut h, &c, "ui.state", json!({}))["side_panels"].clone();
     for combine in [false, true] {
         if combine {
             h.state_mut().open_combine_tab();
@@ -1629,62 +1685,41 @@ fn home_and_combine_suppress_inspector_without_forgetting_layout_or_choice() {
             h.state_mut().active = None;
         }
         h.run_steps(4);
-        assert!(h.query_by_role_and_label(egui::accesskit::Role::Tab, "Inspector").is_none());
-        if let Ok(directory) = std::env::var("CRAFT_UI_DOCKING_DIR") {
-            let _gpu = crate::gpu();
-            std::fs::create_dir_all(&directory).unwrap();
-            let state = if combine { "combine" } else { "home" };
-            h.render().unwrap().save(format!("{directory}/availability-{state}.png")).unwrap();
-        }
-        assert!(h.state().docking.layout.contains(&Panel::Inspector));
+        assert!(h.query_by_label("This document has no bookmarks.").is_none());
         assert_eq!(h.state().right, Some(pdfcraft_ui_egui::RightPanel::Bookmarks));
-        assert_eq!(serde_json::to_value(&h.state().docking).unwrap(), before);
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["side_panels"], before);
         h.state_mut().active = Some(0);
         h.state_mut().combine_tab.focused = false;
         h.run_steps(4);
         h.get_by_label("This document has no bookmarks.");
-        if let Ok(directory) = std::env::var("CRAFT_UI_DOCKING_DIR") {
-            let _gpu = crate::gpu();
-            h.render().unwrap().save(format!("{directory}/availability-return.png")).unwrap();
-        }
-        assert_eq!(serde_json::to_value(&h.state().docking).unwrap(), before);
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["side_panels"], before);
     }
 }
 
 #[test]
-fn malformed_docking_settings_preserve_other_preferences() {
+fn malformed_panel_settings_preserve_other_preferences() {
     let mut app = PdfCraftApp::new();
     app.restore(r#"{"docking":{"layout":{"root":null,"floating":[]},"hidden":[]},"default_mode":"edit","flatten_fill_sign":true}"#);
     assert_eq!(app.default_mode, pdfcraft_ui_egui::Mode::Edit);
-    app.docking.validate().unwrap();
+    assert_eq!(app.side_panels, pdfcraft_ui_egui::side_panels::SidePanels::default());
     let saved: Value = serde_json::from_str(&app.persist()).unwrap();
     assert_eq!(saved["default_mode"], "edit");
     assert_eq!(saved["flatten_fill_sign"], true);
+    // The old value is dropped on the next save.
+    assert!(saved.get("docking").is_none());
+    assert_eq!(saved["side_panels"]["version"], 1);
 }
 
 #[test]
-fn rail_reveals_its_remembered_inactive_inspector_then_closes_the_visible_panel() {
-    use pdfcraft_ui_egui::docking::Panel;
+fn rail_opens_a_panel_then_closes_the_open_one() {
     let (mut h, c) = harness();
-    ok(&mut h, &c, "ui.set", json!({"key":"panel", "value":"bookmarks"}));
-    ok(&mut h, &c, "ui.dock", json!({"operation":"move", "panel":"inspector", "target":"tools", "zone":"center"}));
-    ok(&mut h, &c, "ui.dock", json!({"operation":"activate", "panel":"tools"}));
-    h.run_steps(3);
     let document = ok(&mut h, &c, "ui.state", json!({}))["documents"].clone();
-    let mut preferences: Value = serde_json::from_str(&h.state().persist()).unwrap();
-    preferences.as_object_mut().unwrap().remove("docking");
-    assert!(h.query_by_label("This document has no bookmarks.").is_none());
     h.get_by_role_and_label(egui::accesskit::Role::Button, "Bookmarks").click();
     h.run_steps(4);
     h.get_by_label("This document has no bookmarks.");
-    let mut after: Value = serde_json::from_str(&h.state().persist()).unwrap();
-    after.as_object_mut().unwrap().remove("docking");
-    assert_eq!(after, preferences, "revealing a group member only changes layout activation");
-    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["documents"], document);
     h.get_by_role_and_label(egui::accesskit::Role::Button, "Bookmarks").click();
     h.run_steps(4);
     assert_eq!(h.state().right, None);
-    assert!(!h.state().docking.layout.contains(&Panel::Inspector));
     assert!(h.query_by_label("This document has no bookmarks.").is_none());
     assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["documents"], document);
 }
@@ -1707,6 +1742,9 @@ fn control_quit_retains_inactive_fill_sign_typing_after_cancel() {
 
 #[test]
 fn control_quit_retains_blocked_content_typing_after_cancel() {
+    if crate::support::skip_without_glyphs("control_quit_retains_blocked_content_typing_after_cancel", "en", "Keep 世界") {
+        return;
+    }
     let (mut h, c) = harness();
     ok(&mut h, &c, "ui.command", json!({"id":"edit.text"}));
     h.run_steps(3);
@@ -1832,7 +1870,13 @@ fn navigation_wheel(h: &mut Harness<'static, PdfCraftApp>, pos: egui::Pos2, delt
         vec![
             egui::Event::ModifiersChanged(modifiers),
             egui::Event::PointerMoved(pos),
-            egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta: egui::vec2(0.0, delta), modifiers, phase: egui::TouchPhase::Move },
+            egui::Event::MouseWheel {
+                unit: egui::MouseWheelUnit::Point,
+                delta: egui::vec2(0.0, delta),
+                modifiers,
+                phase: egui::TouchPhase::Move,
+                source: egui::MouseWheelSource::Unknown,
+            },
         ],
     );
     h.run_steps(20);
@@ -1932,7 +1976,7 @@ fn page_size_shows_while_the_pointer_is_in_the_bottom_left_quadrant() {
     let (mut h, _c) = harness();
     let area = h.state().views[0].viewport_rect();
     let shown = |h: &Harness<'static, PdfCraftApp>| {
-        let layer = egui::LayerId::new(egui::Order::Foreground, egui::Id::new("page-size-hint"));
+        let layer = egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("page-size-hint"));
         h.ctx.memory(|m| m.areas().visible_last_frame(&layer))
     };
     let away = area.center() + egui::vec2(300.0, -200.0);
@@ -2013,6 +2057,7 @@ fn routine_continuous_scrolling_does_not_add_navigation_history() {
         delta: egui::vec2(0.0, -1200.0),
         modifiers: egui::Modifiers::NONE,
         phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(8);
     assert!(h.state().views[0].current > 0, "the wheel really moved to a later page");
diff --git a/crates/ui-egui/tests/it/date_format.rs b/crates/ui-egui/tests/it/date_format.rs
index 0606e021de..c2dadb28d3 100644
--- a/crates/ui-egui/tests/it/date_format.rs
+++ b/crates/ui-egui/tests/it/date_format.rs
@@ -133,6 +133,13 @@ fn month_names_follow_the_date_language_or_else_the_interface_language() {
 
 #[test]
 fn a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first() {
+    if crate::support::skip_without_glyphs(
+        "a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first",
+        "en",
+        "日曜日月曜日火曜日水曜日木曜日金曜日土曜日",
+    ) {
+        return;
+    }
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
diff --git a/crates/ui-egui/tests/it/dialog_chrome.rs b/crates/ui-egui/tests/it/dialog_chrome.rs
index 57f549305d..47462fcf2b 100644
--- a/crates/ui-egui/tests/it/dialog_chrome.rs
+++ b/crates/ui-egui/tests/it/dialog_chrome.rs
@@ -6,11 +6,17 @@ use egui_kittest::kittest::Queryable;
 use pdfcraft_ui_egui::PdfCraftApp;
 
 fn fixture() -> Vec<u8> {
-    let objs = [
+    fixture_with_info(None)
+}
+
+/// A one-page file, with `info` as its document information dictionary when given.
+fn fixture_with_info(info: Option<&str>) -> Vec<u8> {
+    let mut objs = vec![
         "<< /Type /Catalog /Pages 2 0 R >>",
         "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
         "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 300] >>",
     ];
+    objs.extend(info);
     let mut out = b"%PDF-1.7\n".to_vec();
     let mut offsets = Vec::new();
     for (i, o) in objs.iter().enumerate() {
@@ -22,12 +28,14 @@ fn fixture() -> Vec<u8> {
     for o in offsets {
         out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
     }
-    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let info = if info.is_some() { " /Info 4 0 R" } else { "" };
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R{info} >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
     out
 }
 
+/// Return the rectangle recorded for a dialog card, failing the test when the card is missing.
 fn card(h: &Harness<'_, PdfCraftApp>, id: &str) -> egui::Rect {
-    h.ctx.data(|d| d.get_temp(egui::Id::new(id).with("card"))).unwrap_or_else(|| panic!("missing dialog card {id}"))
+    h.ctx.data(|d| d.get_temp(egui::Id::unique(id).with("card"))).unwrap_or_else(|| panic!("missing dialog card {id}"))
 }
 
 fn protected() -> Vec<u8> {
@@ -96,3 +104,157 @@ fn document_properties_long_filename_does_not_overflow_card() {
     let card = card(&h, "dialog");
     assert!(card.width() <= 700.0, "dialog card should not blow out horizontally on long filename, width was: {}", card.width());
 }
+
+#[test]
+fn document_properties_values_line_up_and_long_fields_wrap() {
+    let info = "<< /Title (Showcase) /Subject (A specimen document exercising typography, world scripts, vector art, forms and annotations) /Creator (demo-pdf) >>";
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, fixture_with_info(Some(info))).unwrap();
+        app.set_option("dialog", "properties").unwrap();
+        app
+    });
+    h.run_steps(4);
+    let card = card(&h, "dialog");
+    let title = h.get_by_role_and_label(Role::TextInput, "Title").rect();
+    // The fields reach the card's padding instead of stopping short of it.
+    assert!(card.right() - title.right() <= 24.0, "title field {title:?} in {card:?}");
+    // Plain values start where the fields' text does.
+    for value in ["doc.pdf", "demo-pdf"] {
+        // The file name is also the document tab's label.
+        let v = h.query_all_by_label(value).map(|n| n.rect()).find(|r| card.contains_rect(*r)).unwrap_or_else(|| panic!("{value} in the dialog"));
+        assert!((v.left() - (title.left() + 10.0)).abs() <= 1.0, "{value} at {v:?}, title field {title:?}");
+    }
+    // A long subject wraps onto a second line rather than running past the field's edge.
+    let subject = h.get_by_role_and_label(Role::MultilineTextInput, "Subject").rect();
+    assert!(subject.height() > title.height() + 8.0, "subject field {subject:?}, title field {title:?}");
+}
+
+#[test]
+fn space_audit_tab_measures_the_file_and_stays_in_the_card() {
+    use pdfcraft_ui_egui::{Dialog, PropsTab};
+    let open = |dialog: Dialog| {
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("doc.pdf", None, fixture()).unwrap();
+            app.dialog = Some(dialog);
+            app
+        });
+        h.run_steps(4);
+        h
+    };
+    let fonts = card(&open(Dialog::Properties(PropsTab::Fonts)), "dialog");
+    // The tab is reachable by name, like the other Properties tabs.
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, fixture()).unwrap();
+        app.set_option("dialog", "space-audit").unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert_eq!(h.state().dialog, Some(Dialog::Properties(PropsTab::SpaceAudit)));
+    assert!(!h.state().space_audit.is_empty(), "the tab measures the file when it opens");
+    h.get_by_label("Total");
+    // Switching tabs keeps the dialog the same size, and the table stays inside its padding,
+    // in the tab and in the Optimizer's own Audit Space Usage dialog.
+    let tab = card(&h, "dialog");
+    assert!((tab.width() - fonts.width()).abs() < 0.5, "space audit card {tab:?}, fonts card {fonts:?}");
+    for h in [h, open(Dialog::AuditSpace)] {
+        let card = card(&h, "dialog");
+        let pct = h.get_by_label("Percentage").rect();
+        assert!(pct.right() <= card.right() - 16.0, "Percentage {pct:?} in {card:?}");
+    }
+}
+
+#[test]
+fn space_audit_tab_measures_again_after_an_edit() {
+    use pdfcraft_engine::optimize::SpaceCategory;
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, fixture()).unwrap();
+        app.set_option("dialog", "space-audit").unwrap();
+        app
+    });
+    h.run_steps(4);
+    let bookmarks =
+        |h: &Harness<'_, PdfCraftApp>| h.state().space_audit.iter().filter(|r| r.category == SpaceCategory::Bookmarks).map(|r| r.bytes).sum::<u64>();
+    let before = h.state().space_audit.clone();
+    assert_eq!(bookmarks(&h), 0, "the fixture has no outline: {before:?}");
+    // Further frames with the file unchanged keep the same measurement.
+    h.run_steps(2);
+    assert_eq!(h.state().space_audit, before);
+    // An edit while the tab is open is measured on the next frame.
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::AddBookmark {
+        parent: vec![],
+        index: 0,
+        title: "Chapter".into(),
+        page: 0,
+        left: None,
+        top: None,
+    });
+    h.run_steps(2);
+    assert!(bookmarks(&h) > 0, "the new outline is counted: {:?}", h.state().space_audit);
+    // The table shows the new row (the rail's Bookmarks button has the same label).
+    let card = card(&h, "dialog");
+    assert!(h.query_all_by_label("Bookmarks").any(|n| card.contains_rect(n.rect())), "a Bookmarks row in {card:?}");
+}
+
+/// Check that a dialog's Close button follows the content when switching from a taller tab to a shorter one.
+#[test]
+fn dialog_buttons_follow_the_content_after_a_taller_tab() {
+    use pdfcraft_ui_egui::{Dialog, PropsTab};
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, fixture()).unwrap();
+        app.dialog = Some(Dialog::Properties(PropsTab::InitialView));
+        app
+    });
+    h.run_steps(4);
+    for name in ["Navigation tab", "Page layout", "Magnification"] {
+        h.get_by_role_and_label(Role::ComboBox, name);
+    }
+    h.get_by_role_and_label(Role::SpinButton, "Open to page");
+    h.state_mut().dialog = Some(Dialog::Properties(PropsTab::Description));
+    h.run_steps(4);
+    // The card shrinks back to the shorter tab: Close sits under the last row, not halfway
+    // down the room the taller tab left behind.
+    let last = h.get_by_label("PDF producer").rect();
+    let close = h.get_by_role_and_label(Role::Button, "Close").rect();
+    assert!(close.top() - last.bottom() <= 40.0, "Close {close:?} under the last row {last:?}");
+    let card = card(&h, "dialog");
+    assert!(card.bottom() - close.bottom() <= 24.0, "Close {close:?} at the foot of {card:?}");
+}
+
+#[test]
+fn page_hover_cursors_stay_off_while_a_dialog_is_open() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("form.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+        // Small enough that the check box sits above the dialog card.
+        app.set_option("zoom", "100").unwrap();
+        app
+    });
+    for _ in 0..30 {
+        h.run_steps(2);
+    }
+    // The middle of the "agree" check box (/Rect [20 310 36 326] on a 300 × 400 page).
+    let page = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = page.width() / 300.0;
+    let check = page.min + egui::vec2(28.0 * k, (400.0 - 318.0) * k);
+    h.hover_at(check);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand, "the check box takes clicks");
+    h.state_mut().set_option("dialog", "security").unwrap();
+    h.run_steps(4);
+    let card = card(&h, "dialog");
+    assert!(!card.contains(check), "the check box {check:?} is beside the dialog {card:?}, under its backdrop");
+    h.hover_at(check + egui::vec2(1.0, 0.0));
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Default, "nothing under the dialog's backdrop can be clicked");
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 75afd2a017..e5e104d674 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -1087,6 +1087,9 @@ fn save_prompt_fits_the_smallest_window_whatever_the_name() {
     let size = egui::vec2(820.0, 520.0);
     for name in names {
         let start: String = name.chars().take(10).collect();
+        if support::skip_without_glyphs(&format!("save_prompt_fits_the_smallest_window_whatever_the_name ({start}…)"), "en", &name) {
+            continue;
+        }
         let mut h = Harness::builder().with_size(size).build_eframe(move |_cc| {
             let mut app = PdfCraftApp::new();
             app.set_option("language", "en").unwrap();
@@ -1153,16 +1156,223 @@ fn cancelling_properties_discards_the_draft() {
     assert!(h.state().props_draft.is_none());
 }
 
+fn custom_properties(h: &Harness<'static, PdfCraftApp>) -> Vec<(String, String)> {
+    let app = h.state();
+    app.session.get(app.views[0].id).unwrap().custom_info()
+}
+
+fn type_into(h: &mut Harness<'static, PdfCraftApp>, label: &str, text: &str) {
+    let field = h.get_by_role_and_label(Role::TextInput, label);
+    field.focus();
+    field.type_text(text);
+    h.run_steps(2);
+}
+
+fn clear(h: &mut Harness<'static, PdfCraftApp>, label: &str) {
+    h.get_by_role_and_label(Role::TextInput, label).focus();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.key_press(Key::Backspace);
+    h.run_steps(2);
+}
+
+#[test]
+fn custom_properties_are_added_in_the_custom_tab_as_one_undoable_step() {
+    let mut h = harness(1, |app| app.set_option("dialog", "custom").unwrap());
+    h.get_by_label("None");
+    type_into(&mut h, "Name:", "Project");
+    type_into(&mut h, "Value:", "Apollo");
+    h.get_by_role_and_label(Role::Button, "Add").click();
+    h.run_steps(3);
+    assert!(custom_properties(&h).is_empty(), "nothing is written before OK");
+    h.get_by_label("Project");
+    type_into(&mut h, "Name:", "Revision");
+    type_into(&mut h, "Value:", "4");
+    h.get_by_role_and_label(Role::Button, "Add").click();
+    h.run_steps(3);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(custom_properties(&h), [("Project".to_string(), "Apollo".to_string()), ("Revision".to_string(), "4".to_string())]);
+    let app = h.state();
+    assert_eq!(app.session.get(app.views[0].id).unwrap().can_undo(), Some("Change document properties"));
+    assert!(app.dialog.is_none() && app.custom_draft.is_none());
+
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert!(custom_properties(&h).is_empty());
+}
+
+#[test]
+fn custom_properties_are_changed_and_deleted_in_the_custom_tab() {
+    let mut h = harness(1, |app| {
+        for (key, value) in [("Project", "Apollo"), ("Revision", "4")] {
+            assert!(app.apply_edit(pdfcraft_engine::Edit::SetInfo { key: key.into(), value: value.into() }));
+        }
+        app.set_option("dialog", "custom").unwrap();
+    });
+    h.get_by_label("Revision").click();
+    h.run_steps(3);
+    h.get_by_role_and_label(Role::Button, "Delete").click();
+    h.run_steps(3);
+    h.get_by_label("Project").click();
+    h.run_steps(3);
+    assert!(h.get_by_role_and_label(Role::Button, "Update").accesskit_node().is_disabled(), "the value is unchanged");
+    clear(&mut h, "Value:");
+    type_into(&mut h, "Value:", "Apollo 2");
+    h.get_by_role_and_label(Role::Button, "Update").click();
+    h.run_steps(3);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(custom_properties(&h), [("Project".to_string(), "Apollo 2".to_string())]);
+    let app = h.state();
+    let doc = app.session.get(app.views[0].id).unwrap();
+    assert_eq!(doc.info_value("Revision"), None);
+    assert_eq!(doc.can_undo(), Some("Change document properties"));
+}
+
+#[test]
+fn the_custom_tab_refuses_names_a_custom_property_cannot_have() {
+    let mut h = harness(1, |app| {
+        assert!(app.apply_edit(pdfcraft_engine::Edit::SetInfo { key: "Project".into(), value: "Apollo".into() }));
+        app.set_option("dialog", "custom").unwrap();
+    });
+    type_into(&mut h, "Value:", "x");
+    let add_disabled = |h: &Harness<'static, PdfCraftApp>| h.get_by_role_and_label(Role::Button, "Add").accesskit_node().is_disabled();
+    assert!(add_disabled(&h), "no name");
+    // A standard name, a name with a space, a delimiter, and a name already listed.
+    for name in ["Title", "Client name", "R&D/2", "Project"] {
+        type_into(&mut h, "Name:", name);
+        assert!(add_disabled(&h), "{name} is refused");
+        clear(&mut h, "Name:");
+    }
+    type_into(&mut h, "Name:", "Client");
+    assert!(!add_disabled(&h));
+    assert!(h.get_by_role_and_label(Role::Button, "Delete").accesskit_node().is_disabled(), "Client is not listed");
+}
+
+#[test]
+fn a_custom_property_whose_name_the_tools_refuse_is_listed_and_left_alone() {
+    // `/Client#20name` and `/Project#20` are valid PDF names with a space in them, which a new custom
+    // property can't have; `/Project#20` is not `/Project`. `/Dept#E9` is not UTF-8 and is listed as
+    // "Dept\u{FFFD}". `/Revision` is a number, so it isn't listed.
+    let pdf = String::from_utf8(fixture(1)).unwrap().replace(
+        "/Root 1 0 R >>\nstartxref",
+        "/Root 1 0 R /Info << /Client#20name (Acme) /Project#20 (Padded) /Dept#E9 (Sales) /Project (Apollo) /Revision 4 >> >>\nstartxref",
+    );
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, pdf.into_bytes()).expect("fixture opens");
+        app.set_option("dialog", "custom").unwrap();
+        app
+    });
+    h.run_steps(4);
+    for name in ["Client name", "Project ", "Dept\u{FFFD}"] {
+        h.get_by_label(name).click();
+        h.run_steps(3);
+        for button in ["Update", "Delete"] {
+            assert!(h.get_by_role_and_label(Role::Button, button).accesskit_node().is_disabled(), "{button} is off for {name:?}");
+        }
+    }
+    clear(&mut h, "Name:");
+    type_into(&mut h, "Name:", "Revision");
+    assert!(h.get_by_role_and_label(Role::Button, "Add").accesskit_node().is_disabled(), "Add would overwrite the number");
+    assert_eq!(h.state().custom_draft.as_ref().map(|(_, d)| d.value.as_str()), Some("Sales"));
+    h.get_by_label("Project").click();
+    h.run_steps(3);
+    clear(&mut h, "Value:");
+    type_into(&mut h, "Value:", "Gemini");
+    h.get_by_role_and_label(Role::Button, "Update").click();
+    h.run_steps(3);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(
+        custom_properties(&h),
+        [
+            ("Client name".to_string(), "Acme".to_string()),
+            ("Project ".to_string(), "Padded".to_string()),
+            ("Dept\u{FFFD}".to_string(), "Sales".to_string()),
+            ("Project".to_string(), "Gemini".to_string())
+        ]
+    );
+    let app = h.state();
+    let doc = app.session.get(app.views[0].id).unwrap();
+    assert!(doc.has_info("Revision") && doc.info_value("Revision").is_none(), "the number is kept");
+    assert!(app.dialog.is_none());
+}
+
+#[test]
+fn a_custom_property_is_deleted_from_an_info_dictionary_in_the_trailer() {
+    let pdf = String::from_utf8(fixture(1))
+        .unwrap()
+        .replace("/Root 1 0 R >>\nstartxref", "/Root 1 0 R /Info << /Project (Apollo) /Revision (4) >> >>\nstartxref");
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, pdf.into_bytes()).expect("fixture opens");
+        app.set_option("dialog", "custom").unwrap();
+        app
+    });
+    h.run_steps(4);
+    h.get_by_label("Project").click();
+    h.run_steps(3);
+    h.get_by_role_and_label(Role::Button, "Delete").click();
+    h.run_steps(3);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(custom_properties(&h), [("Revision".to_string(), "4".to_string())]);
+    let app = h.state();
+    assert_eq!(app.session.get(app.views[0].id).unwrap().can_undo(), Some("Change document properties"));
+}
+
+#[test]
+fn add_stops_at_the_256_custom_properties_the_tab_lists() {
+    let with_props = |count: usize| {
+        let entries: String = (0..count).map(|n| format!("/P{n:03} (v) ")).collect();
+        let pdf =
+            String::from_utf8(fixture(1)).unwrap().replace("/Root 1 0 R >>\nstartxref", &format!("/Root 1 0 R /Info << {entries}>> >>\nstartxref"));
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("doc.pdf", None, pdf.into_bytes()).expect("fixture opens");
+            app.set_option("dialog", "custom").unwrap();
+            app
+        });
+        h.run_steps(4);
+        h
+    };
+    let add_disabled = |h: &Harness<'static, PdfCraftApp>| h.get_by_role_and_label(Role::Button, "Add").accesskit_node().is_disabled();
+
+    // 255 in the file: one more fits, a second does not.
+    let mut h = with_props(255);
+    type_into(&mut h, "Name:", "Client");
+    type_into(&mut h, "Value:", "Acme");
+    assert!(!add_disabled(&h));
+    h.get_by_role_and_label(Role::Button, "Add").click();
+    h.run_steps(3);
+    type_into(&mut h, "Name:", "Other");
+    type_into(&mut h, "Value:", "x");
+    assert!(add_disabled(&h), "the draft holds 256");
+    assert_eq!(h.state().custom_draft.as_ref().map(|(_, d)| d.props.len()), Some(256));
+
+    // 257 in the file: after a Delete a new name would still be past the 256 listed.
+    let mut h = with_props(257);
+    h.get_by_label("P000").click();
+    h.run_steps(3);
+    h.get_by_role_and_label(Role::Button, "Delete").click();
+    h.run_steps(3);
+    type_into(&mut h, "Name:", "Client");
+    type_into(&mut h, "Value:", "Acme");
+    assert!(add_disabled(&h), "the file lists 256");
+}
+
 #[test]
 fn edit_menu_names_the_step_to_undo() {
     let mut h = harness(2, |app| {
         app.apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 });
     });
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("Edit ⏵").hover(); // submenus open on hover; their labels carry the arrow
-    h.run_steps(3);
-    h.get_by_label_contains("Undo Rotate page").click(); // the label includes the shortcut
+    support::open_menu(&mut h, "Edit");
+    support::menu_row(&h, "Undo Rotate page").click();
     h.run_steps(3);
     let app = h.state();
     let doc = app.session.get(app.views[0].id).unwrap();
@@ -3363,6 +3573,9 @@ fn an_applied_paragraph_keeps_its_edited_look_until_the_page_is_redrawn() {
 /// as a form field does; the editor used to close with the error and the typing was lost.
 #[test]
 fn a_paragraph_whose_edit_fails_stays_open_with_its_typing() {
+    if crate::support::skip_without_glyphs("a_paragraph_whose_edit_fails_stays_open_with_its_typing", "en", "Top ก") {
+        return;
+    }
     let bytes = source_font_fixture_with_text("BT /F1 24 Tf 20 220 Td (Top) Tj ET BT /F2 24 Tf 20 120 Td (Bottom) Tj ET");
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
@@ -3488,7 +3701,7 @@ fn editing_existing_text_in_place() {
 /// paragraph editor and retypes it as "Chapter One", leaving the editor open.
 fn edit_tab_with_an_open_paragraph(h: &mut Harness<'static, PdfCraftApp>) {
     use pdfcraft_ui_egui::{Mode, QuickTool};
-    h.get_by_label("Edit").click();
+    support::outside_menus(h, "Edit").click();
     h.run_steps(3);
     assert_eq!((h.state().mode, h.state().quick_tool), (Mode::Edit, QuickTool::EditText));
     open_the_first_line(h);
@@ -6136,6 +6349,7 @@ fn a_paragraph_running_off_its_page_edits_without_covering_the_next_page() {
         delta: egui::vec2(0.0, -300.0),
         phase: egui::TouchPhase::Move,
         modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(4);
     let scrolled = h.state().views[0].page_screen_rect(0).unwrap();
diff --git a/crates/ui-egui/tests/it/editor_taps.rs b/crates/ui-egui/tests/it/editor_taps.rs
new file mode 100644
index 0000000000..26a6f1f3d3
--- /dev/null
+++ b/crates/ui-egui/tests/it/editor_taps.rs
@@ -0,0 +1,347 @@
+//! A finger tap, or a pen tap on Windows, on an editor open over the page acts as a mouse click
+//! there. The field editors and the Edit text paragraph editor are drawn over the pages, outside
+//! the page pointer, and close on a click away. On the frame egui reports a tap there is no
+//! hover position (egui-winit sends `PointerGone` with every touch release), so they must judge
+//! where the click landed by the click's own position.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+use crate::support::input::touch_tap;
+
+/// A PDF of `objects`, numbered from 1 with the catalog first.
+fn pdf(objects: &[&str]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    out
+}
+
+const PAGES: &str = "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>";
+const HELVETICA: &str = "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>";
+
+/// A 300×400 page with a text field `name`, a combo box `country` and a list box `colour`
+/// (Red, Green, Blue) 70 pt tall.
+fn form_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R] /DA (/Helv 10 Tf 0 g) /DR << /Font << /Helv 7 0 R >> >> >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R 6 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (name) /Rect [40 340 260 360] /P 3 0 R /F 4 >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /Ff 131072 /T (country) /Opt [[(ca) (Canada)] [(fr) (France)] [(no) (Norway)]] /Rect [40 290 260 310] /P 3 0 R /F 4 >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /T (colour) /Opt [(Red) (Green) (Blue)] /Rect [40 150 200 220] /P 3 0 R /F 4 >>",
+        HELVETICA,
+    ])
+}
+
+/// A 300×400 page with one line of 12 pt text at x 40, y 300.
+fn text_pdf() -> Vec<u8> {
+    let line = "BT /F1 12 Tf 40 300 Td (Signed and approved by the committee.) Tj ET";
+    let content = format!("<< /Length {} >>\nstream\n{line}\nendstream", line.len() + 1);
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>",
+        content.as_str(),
+        HELVETICA,
+    ])
+}
+
+/// The app with `pdf` open at 150 % and its first frames run.
+fn open(pdf: Vec<u8>) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("test.pdf", None, pdf).unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.set_option("zoom", "150").unwrap();
+        app
+    });
+    for _ in 0..30 {
+        h.run_steps(2);
+    }
+    h
+}
+
+/// A mouse click: move, press and release in frames of their own, and the pointer stays there.
+/// (`drop_at` also sends `PointerGone` a frame later, as if the mouse left the window.)
+fn mouse_click(h: &mut Harness<'_, PdfCraftApp>, p: egui::Pos2) {
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(4);
+}
+
+/// Where field `name`'s widget is on screen.
+fn field(h: &Harness<'_, PdfCraftApp>, name: &str) -> egui::Rect {
+    widget(h, name, 0)
+}
+
+/// Where widget `w` of field `name` is on screen.
+fn widget(h: &Harness<'_, PdfCraftApp>, name: &str, w: usize) -> egui::Rect {
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    let f = doc.form.iter().find(|f| f.name == name).unwrap();
+    pdfcraft_ui_egui::forms_ui::field_screen_rect(&s.views[0], &doc.info, f, w).expect("on screen")
+}
+
+fn value(h: &Harness<'_, PdfCraftApp>, name: &str) -> Vec<String> {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone()
+}
+
+/// The field whose editor or list is open.
+fn focus(h: &Harness<'_, PdfCraftApp>) -> Option<String> {
+    h.state().views[0].forms.focus.as_ref().map(|f| f.name.clone())
+}
+
+/// The Green row of the list box: the second, rows being 11.5 pt under a 2 pt inset.
+fn green(h: &Harness<'_, PdfCraftApp>) -> egui::Pos2 {
+    let r = field(h, "colour");
+    egui::pos2(r.center().x, r.min.y + 19.0 * r.height() / 70.0)
+}
+
+// ---------------------------------------------------------------------------------------------
+// Form fields.
+
+#[test]
+fn mouse_click_opens_a_combo_box() {
+    // Control for the tap below.
+    let mut h = open(form_pdf());
+    let p = field(&h, "country").center();
+    mouse_click(&mut h, p);
+    assert_eq!(focus(&h).as_deref(), Some("country"), "a click opens the list of choices");
+}
+
+#[test]
+fn touch_tap_opens_a_combo_box_and_picks_a_choice() {
+    let mut h = open(form_pdf());
+    let p = field(&h, "country").center();
+    touch_tap(&mut h, p);
+    assert_eq!(focus(&h).as_deref(), Some("country"), "a tap opens the list of choices, as a click does");
+    let france = h.get_by_label("France").rect().center();
+    touch_tap(&mut h, france);
+    assert_eq!(value(&h, "country"), ["fr"], "and a tap on a choice picks it");
+}
+
+#[test]
+fn mouse_click_in_a_list_box_keeps_it_focused() {
+    // Control for the tap below.
+    let mut h = open(form_pdf());
+    let p = green(&h);
+    mouse_click(&mut h, p);
+    assert_eq!((value(&h, "colour"), focus(&h).as_deref()), (vec!["Green".to_string()], Some("colour")), "a click picks the row");
+    h.key_press(egui::Key::ArrowDown);
+    h.run_steps(3);
+    assert_eq!(value(&h, "colour"), ["Blue"], "and the list keeps the keyboard");
+}
+
+#[test]
+fn touch_tap_in_a_list_box_keeps_it_focused() {
+    let mut h = open(form_pdf());
+    let p = green(&h);
+    touch_tap(&mut h, p);
+    assert_eq!(
+        (value(&h, "colour"), focus(&h).as_deref()),
+        (vec!["Green".to_string()], Some("colour")),
+        "a tap picks the row and keeps the list focused, as a click does"
+    );
+    h.key_press(egui::Key::ArrowDown);
+    h.run_steps(3);
+    assert_eq!(value(&h, "colour"), ["Blue"], "so the arrow keys go on from it");
+}
+
+#[test]
+fn touch_tap_inside_an_open_text_field_keeps_typing_there() {
+    // A guard more than a probe: the text editor closes when egui takes its focus away, and
+    // egui judges that from the tap's own position.
+    let mut h = open(form_pdf());
+    let r = field(&h, "name");
+    touch_tap(&mut h, r.center());
+    assert_eq!(focus(&h).as_deref(), Some("name"), "a tap opens the field for typing");
+    touch_tap(&mut h, r.left_center() + egui::vec2(6.0, 0.0));
+    assert_eq!(focus(&h).as_deref(), Some("name"), "a tap inside the open field keeps it open");
+    h.event(egui::Event::Text("Ada".into()));
+    h.run_steps(1);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    assert_eq!(value(&h, "name"), ["Ada"], "and the typing lands in it");
+}
+
+const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+
+/// Adds a date field `due` at x 40..160, y 240..260, its calendar under it.
+fn add_date_field(h: &mut Harness<'_, PdfCraftApp>) {
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::AddField {
+        page: 0,
+        rect: [40.0, 240.0, 160.0, 260.0],
+        kind: pdfcraft_engine::NewField::Date,
+        name: Some("due".into()),
+    });
+    h.run_steps(4);
+}
+
+/// Next month's calendar heading, and its 15th as the date field writes it.
+fn next_month(h: &Harness<'_, PdfCraftApp>) -> (String, String) {
+    let (y, m, _) = h.state().session.today();
+    let (ny, nm) = if m == 12 { (y + 1, 1) } else { (y, m + 1) };
+    (format!("{} {ny}", MONTHS[(nm - 1) as usize]), format!("{nm:02}/15/{ny}"))
+}
+
+#[test]
+fn mouse_click_on_a_date_fields_calendar_keeps_it_open() {
+    // Control for the tap below.
+    let mut h = open(form_pdf());
+    add_date_field(&mut h);
+    let (heading, picked) = next_month(&h);
+    let p = field(&h, "due").center();
+    mouse_click(&mut h, p);
+    let next = h.get_by_label("›").rect().center();
+    mouse_click(&mut h, next);
+    assert_eq!(focus(&h).as_deref(), Some("due"), "a click on the calendar's next month leaves the field open");
+    h.get_by_label(&heading);
+    let day = h.get_by_label("15").rect().center();
+    mouse_click(&mut h, day);
+    assert_eq!(value(&h, "due"), [picked], "and a click on a day picks it");
+}
+
+#[test]
+fn touch_tap_on_a_date_fields_calendar_keeps_it_open() {
+    let mut h = open(form_pdf());
+    add_date_field(&mut h);
+    let (heading, picked) = next_month(&h);
+    let p = field(&h, "due").center();
+    touch_tap(&mut h, p);
+    let next = h.get_by_label("›").rect().center();
+    touch_tap(&mut h, next);
+    assert_eq!(focus(&h).as_deref(), Some("due"), "a tap on the calendar's next month leaves the field open, as a click does");
+    h.get_by_label(&heading);
+    let day = h.get_by_label("15").rect().center();
+    touch_tap(&mut h, day);
+    assert_eq!(value(&h, "due"), [picked], "and a tap on a day picks it");
+}
+
+/// A 300×400 page with a check box `agree` and a pair of radio buttons `pick`, A and then B to
+/// its right, each 20 pt square. A click focuses them, so the keys reach them (#2223).
+fn toggles_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R 7 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Off /AS /Off /Rect [40 300 60 320] /P 3 0 R /F 4 /AP << /N << /Yes 8 0 R /Off 8 0 R >> >> >>",
+        "<< /FT /Btn /T (pick) /Ff 32768 /V /Off /Kids [6 0 R 7 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /Parent 5 0 R /AS /Off /Rect [40 240 60 260] /P 3 0 R /F 4 /AP << /N << /A 8 0 R /Off 8 0 R >> >> >>",
+        "<< /Type /Annot /Subtype /Widget /Parent 5 0 R /AS /Off /Rect [100 240 120 260] /P 3 0 R /F 4 /AP << /N << /B 8 0 R /Off 8 0 R >> >> >>",
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 20 20] /Length 0 >>\nstream\n\nendstream",
+    ])
+}
+
+#[test]
+fn mouse_click_on_a_focused_check_box_keeps_its_focus() {
+    // Control for the tap below.
+    let mut h = open(toggles_pdf());
+    let p = field(&h, "agree").center();
+    mouse_click(&mut h, p);
+    assert_eq!((value(&h, "agree"), focus(&h).as_deref()), (vec!["Yes".to_string()], Some("agree")), "a click ticks and focuses the box");
+    mouse_click(&mut h, p);
+    assert_eq!(focus(&h).as_deref(), Some("agree"), "a click on the focused box keeps its focus");
+    assert!(value(&h, "agree").is_empty(), "and clears it");
+}
+
+#[test]
+fn touch_tap_on_a_focused_check_box_keeps_its_focus() {
+    let mut h = open(toggles_pdf());
+    let p = field(&h, "agree").center();
+    mouse_click(&mut h, p);
+    assert_eq!(focus(&h).as_deref(), Some("agree"), "a click focuses the box");
+    touch_tap(&mut h, p);
+    assert_eq!(focus(&h).as_deref(), Some("agree"), "a tap on the focused box keeps its focus, as a click does");
+    assert!(value(&h, "agree").is_empty(), "and clears it");
+}
+
+#[test]
+fn mouse_click_on_a_radio_button_keeps_the_group_focused() {
+    // Control for the tap below.
+    let mut h = open(toggles_pdf());
+    let (a, b) = (widget(&h, "pick", 0).center(), widget(&h, "pick", 1).center());
+    mouse_click(&mut h, a);
+    assert_eq!((value(&h, "pick"), focus(&h).as_deref()), (vec!["A".to_string()], Some("pick")), "a click selects A and focuses the group");
+    mouse_click(&mut h, b);
+    assert_eq!((value(&h, "pick"), focus(&h).as_deref()), (vec!["B".to_string()], Some("pick")), "a click on B selects it in the focused group");
+    h.key_press(egui::Key::ArrowLeft);
+    h.run_steps(3);
+    assert_eq!(value(&h, "pick"), ["A"], "so the arrows move within the group");
+}
+
+#[test]
+fn touch_tap_on_a_radio_button_keeps_the_group_focused() {
+    let mut h = open(toggles_pdf());
+    let (a, b) = (widget(&h, "pick", 0).center(), widget(&h, "pick", 1).center());
+    mouse_click(&mut h, a);
+    assert_eq!(focus(&h).as_deref(), Some("pick"), "a click focuses the group");
+    touch_tap(&mut h, b);
+    assert_eq!(focus(&h).as_deref(), Some("pick"), "a tap on B keeps the group focused, as a click does");
+    assert_eq!(value(&h, "pick"), ["B"], "and selects B");
+    h.key_press(egui::Key::ArrowLeft);
+    h.run_steps(3);
+    assert_eq!(value(&h, "pick"), ["A"], "so the arrows move within the group");
+}
+
+// ---------------------------------------------------------------------------------------------
+// Edit text: a click on the Format text panel keeps the paragraph open. These open the Line
+// spacing list: a control that changes the paragraph on the click gives it the keyboard back in
+// that same frame, which hides a click away.
+
+/// Opens the line of `text_pdf` for typing with Edit text.
+fn edit_paragraph(h: &mut Harness<'_, PdfCraftApp>) {
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("page on screen");
+    let k = r.width() / 300.0;
+    let p = r.min + egui::vec2(60.0 * k, (400.0 - 304.0) * k);
+    mouse_click(h, p);
+    assert!(h.state().views[0].line_editor.is_some(), "the paragraph opens for typing");
+    assert!(h.ctx.memory(|m| m.has_focus(egui::Id::unique("edit-text-line-input"))), "with the keyboard");
+}
+
+/// The open paragraph's line spacing, if a paragraph is open.
+fn line_spacing(h: &Harness<'_, PdfCraftApp>) -> Option<f64> {
+    h.state().views[0].line_editor.as_ref().map(|e| e.extras.line_spacing)
+}
+
+#[test]
+fn mouse_click_on_format_text_keeps_the_paragraph_open() {
+    // Control for the tap below.
+    let mut h = open(text_pdf());
+    edit_paragraph(&mut h);
+    let spacing = h.get_by_value("Auto").rect().center();
+    mouse_click(&mut h, spacing);
+    assert_eq!(line_spacing(&h), Some(0.0), "a click opens the Line spacing list and leaves the paragraph open");
+    let double = h.get_by_label("2").rect().center();
+    mouse_click(&mut h, double);
+    assert_eq!(line_spacing(&h), Some(2.0), "to take the spacing picked");
+}
+
+#[test]
+fn touch_tap_on_format_text_keeps_the_paragraph_open() {
+    let mut h = open(text_pdf());
+    edit_paragraph(&mut h);
+    let spacing = h.get_by_value("Auto").rect().center();
+    touch_tap(&mut h, spacing);
+    assert_eq!(line_spacing(&h), Some(0.0), "a tap opens the Line spacing list and leaves the paragraph open, as a click does");
+    let double = h.get_by_label("2").rect().center();
+    touch_tap(&mut h, double);
+    assert_eq!(line_spacing(&h), Some(2.0), "to take the spacing picked");
+}
diff --git a/crates/ui-egui/tests/it/fill_sign.rs b/crates/ui-egui/tests/it/fill_sign.rs
index 88051a9e58..566a14f186 100644
--- a/crates/ui-egui/tests/it/fill_sign.rs
+++ b/crates/ui-egui/tests/it/fill_sign.rs
@@ -237,6 +237,51 @@ fn fill_text_size_resizes_the_selected_text() {
     assert!(after > before * 2.0, "36 pt text has a taller box than 10 pt text: {before} -> {after}");
 }
 
+/// The font sizes of the texts `text` drawn in the last frame.
+fn drawn_sizes(h: &Harness<'static, PdfCraftApp>, text: &str) -> Vec<f32> {
+    fn walk(shape: &egui::Shape, text: &str, out: &mut Vec<f32>) {
+        match shape {
+            egui::Shape::Vec(shapes) => shapes.iter().for_each(|s| walk(s, text, out)),
+            egui::Shape::Text(t) if t.galley.text() == text => {
+                out.extend(t.galley.job.sections.first().map(|s| s.format.font_id.size));
+            }
+            _ => {}
+        }
+    }
+    let mut out = Vec::new();
+    for clipped in &h.output().shapes {
+        walk(&clipped.shape, text, &mut out);
+    }
+    out
+}
+
+/// The type box draws its text at the page's zoom whichever way the view is turned. With the
+/// view turned a quarter, the page's width runs down the screen: reading the zoom off the screen
+/// rectangle's width instead made the typed text a height-over-width too large (here 4/3).
+#[test]
+fn the_type_box_text_matches_the_page_zoom_in_a_turned_view() {
+    for rotate in ["0", "90"] {
+        let mut h = harness();
+        h.state_mut().set_option("rotate", rotate).unwrap();
+        h.run_steps(3);
+        h.state_mut().execute("sign.fill.text");
+        click(&mut h, 50.0, 250.0);
+        h.event(egui::Event::Text("Ada".into()));
+        h.run_steps(2);
+        let s = h.state();
+        let page = &s.session.get(s.views[0].id).unwrap().info.pages[0];
+        let rect = s.views[0].page_screen_rect(0).expect("on screen");
+        // Screen pixels per page point: the page's width lies across, or down when turned.
+        let zoom = if rotate == "90" { rect.height() } else { rect.width() } / page.width;
+        let size = s.views[0].fill_text.as_ref().expect("an open type box").size as f32;
+        let drawn = drawn_sizes(&h, "Ada");
+        assert!(!drawn.is_empty(), "{rotate}°: the typed text is drawn");
+        for d in drawn {
+            assert!((d - size * zoom).abs() < 0.5, "{rotate}°: drawn at {d}, the page shows it at {}", size * zoom);
+        }
+    }
+}
+
 #[test]
 fn the_type_box_grows_as_text_is_typed() {
     let mut h = harness();
diff --git a/crates/ui-egui/tests/it/fonts.rs b/crates/ui-egui/tests/it/fonts.rs
index 1e569230d8..d897f509bc 100644
--- a/crates/ui-egui/tests/it/fonts.rs
+++ b/crates/ui-egui/tests/it/fonts.rs
@@ -15,6 +15,19 @@ fn families() -> Vec<FontId> {
     vec![FontId::proportional(13.0), FontId::monospace(13.0), theme::medium(13.0), theme::semibold(17.0)]
 }
 
+/// The bundled faces, with no craft-fonts and no installed system face: 0.37 gates its emoji
+/// fonts behind `monochrome_emoji_fonts`, which the app and this test crate explicitly enable.
+/// Text symbols must keep working with `PDFCRAFT_SYSTEM_FONTS=0`.
+#[test]
+fn bundled_monochrome_symbols_have_glyphs() {
+    let mut fonts = Fonts::new(TextOptions::default(), theme::font_definitions());
+    for id in families() {
+        for text in ["✔", "▲", "▼"] {
+            assert!(fonts.has_glyphs(&id, text), "{id:?} lacks {text} with default_fonts + monochrome_emoji_fonts");
+        }
+    }
+}
+
 /// Lays `text` out in every interface family and returns each galley's width.
 fn layout_widths(fonts: &mut Fonts, text: &str) -> Vec<f32> {
     let mut view = fonts.with_pixels_per_point(2.0);
@@ -280,42 +293,60 @@ fn catalog_han(catalog: &str) -> String {
     han.into_iter().collect()
 }
 
-/// In a Chinese interface built without a `Hans` face (every release so far, #826), a Chinese
-/// face installed on this machine goes before the Japanese faces, which lack hundreds of the
-/// catalog's characters, and draws every Han character of both Chinese catalogs.
+/// One Chinese preference against its catalog: the installed face must be in every family,
+/// before the Japanese faces, and cover every Han character the catalog uses.
+///
+/// Returns false when this machine has no installed face for the preference (or system fonts
+/// are off); the caller reports that as a skip. A bundled `Hans` face is never allowed to
+/// stand in for Traditional Chinese.
+fn installed_chinese_face_covers(cjk: theme::CjkPreference, catalog: &str, name: &str) -> bool {
+    let defs = theme::installed_font_definitions(cjk);
+    if !defs.font_data.contains_key(theme::SYSTEM_FALLBACK) {
+        eprintln!("skipping {name}: no installed Chinese face for {cjk:?} (or PDFCRAFT_SYSTEM_FONTS=0)");
+        return false;
+    }
+    for (family, stack) in &defs.families {
+        let system = stack.iter().position(|n| n == theme::SYSTEM_FALLBACK).expect("in every family");
+        assert_eq!(stack.iter().filter(|n| *n == theme::SYSTEM_FALLBACK).count(), 1, "{family:?}");
+        let own = stack.iter().position(|n| n.starts_with("Inter") || n == "JetBrainsMono").expect("the app's own font");
+        assert!(own < system, "{family:?}: {stack:?}");
+        if let Some(first_ja) = stack.iter().position(|n| n.starts_with("BIZ UDPGothic")) {
+            assert!(system < first_ja, "{family:?}: {stack:?}");
+        }
+    }
+    let han = catalog_han(catalog);
+    assert!(han.contains('欢') || han.contains('說'), "{cjk:?}");
+    let mut fonts = Fonts::new(TextOptions::default(), defs);
+    for id in families() {
+        let missing: String = han.chars().filter(|c| !fonts.has_glyphs(&id, &c.to_string())).collect();
+        assert!(missing.is_empty(), "{cjk:?} {id:?} lacks {missing}");
+    }
+    true
+}
+
+/// In a Simplified Chinese interface built without a `Hans` face, a Simplified Chinese face
+/// installed on this machine goes before the Japanese faces, which lack hundreds of the
+/// catalog's characters.
 #[test]
-fn chinese_ui_uses_an_installed_chinese_face() {
+fn simplified_chinese_ui_uses_an_installed_hans_face_without_an_embedded_one() {
     if !pdfcraft_fonts::ui_chinese_fonts().is_empty() {
-        eprintln!("skipping chinese_ui_uses_an_installed_chinese_face: a Hans face is bundled");
+        eprintln!("skipping simplified_chinese_ui_uses_an_installed_hans_face_without_an_embedded_one: a Hans face is bundled");
         return;
     }
-    for (cjk, catalog) in [
-        (theme::CjkPreference::SimplifiedChinese, include_str!("../../src/i18n/zh-hans.tsv")),
-        (theme::CjkPreference::TraditionalChinese, include_str!("../../src/i18n/zh-hant.tsv")),
-    ] {
-        let defs = theme::installed_font_definitions(cjk);
-        if !defs.font_data.contains_key(theme::SYSTEM_FALLBACK) {
-            eprintln!("skipping chinese_ui_uses_an_installed_chinese_face: no installed Chinese face (or PDFCRAFT_SYSTEM_FONTS=0)");
-            return;
-        }
-        for (family, stack) in &defs.families {
-            let system = stack.iter().position(|n| n == theme::SYSTEM_FALLBACK).expect("in every family");
-            assert_eq!(stack.iter().filter(|n| *n == theme::SYSTEM_FALLBACK).count(), 1, "{family:?}");
-            let own = stack.iter().position(|n| n.starts_with("Inter") || n == "JetBrainsMono").expect("the app's own font");
-            assert!(own < system, "{family:?}: {stack:?}");
-            if let Some(first_ja) = stack.iter().position(|n| n.starts_with("BIZ UDPGothic")) {
-                assert!(system < first_ja, "{family:?}: {stack:?}");
-            }
-        }
-        let han = catalog_han(catalog);
-        assert!(han.contains('欢') || han.contains('說'), "{cjk:?}");
-        let mut fonts = Fonts::new(TextOptions::default(), defs);
-        for id in families() {
-            let missing: String = han.chars().filter(|c| !fonts.has_glyphs(&id, &c.to_string())).collect();
-            assert!(missing.is_empty(), "{cjk:?} {id:?} lacks {missing}");
-        }
-    }
-    // Other languages keep the installed face last, as before.
+    installed_chinese_face_covers(theme::CjkPreference::SimplifiedChinese, include_str!("../../src/i18n/zh-hans.tsv"), "Simplified");
+}
+
+/// A Traditional Chinese interface keeps its installed Traditional face before the Japanese
+/// faces even when the build embeds a Simplified-only `Hans` face: that face cannot supply
+/// Traditional-only characters, and Japanese-first fallback would otherwise win.
+#[test]
+fn traditional_chinese_ui_keeps_an_installed_hant_face_before_japanese() {
+    installed_chinese_face_covers(theme::CjkPreference::TraditionalChinese, include_str!("../../src/i18n/zh-hant.tsv"), "Traditional");
+}
+
+/// Other languages keep the installed face last.
+#[test]
+fn non_chinese_ui_keeps_the_installed_face_last() {
     let defs = theme::installed_font_definitions(theme::CjkPreference::Default);
     for stack in defs.families.values() {
         assert!(stack.iter().position(|n| n == theme::SYSTEM_FALLBACK).is_none_or(|i| i + 1 == stack.len()), "{stack:?}");
@@ -346,7 +377,7 @@ fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
     let defs = theme::font_definitions();
     assert_eq!(&defs.families[&FontFamily::Monospace][..2], ["JetBrainsMono", "Inter"]);
     let fallback = &defs.font_data["Inter"];
-    let fallback_font = skrifa::FontRef::from_index(&fallback.font, fallback.index).unwrap();
+    let fallback_font = skrifa::FontRef::from_index(fallback.font.as_ref().as_ref(), fallback.index).unwrap();
     let fallback_charmap = fallback_font.charmap();
     for (code, catalog) in [
         ("cs", include_str!("../../src/i18n/cs.tsv")),
@@ -384,7 +415,7 @@ fn primary_ui_fonts_cover_latin_and_cyrillic_catalogs() {
         }
         for name in ["Inter", "Inter-Medium", "Inter-SemiBold", "JetBrainsMono"] {
             let data = &defs.font_data[name];
-            let font = skrifa::FontRef::from_index(&data.font, data.index).unwrap();
+            let font = skrifa::FontRef::from_index(data.font.as_ref().as_ref(), data.index).unwrap();
             let charmap = font.charmap();
             let mut missing: Vec<char> =
                 text.chars().filter(|c| charmap.map(*c).is_none() && (name != "JetBrainsMono" || fallback_charmap.map(*c).is_none())).collect();
diff --git a/crates/ui-egui/tests/it/forms.rs b/crates/ui-egui/tests/it/forms.rs
index a06d474e83..dcaa7510b5 100644
--- a/crates/ui-egui/tests/it/forms.rs
+++ b/crates/ui-egui/tests/it/forms.rs
@@ -64,7 +64,7 @@ fn hovering_a_field_shows_its_tooltip() {
     let mut h = harness();
     assert!(h.query_by_label("Your name").is_none(), "no tooltip before the hover");
     rest_on_field(&mut h, "name");
-    assert!(h.query_by_label("Your name").is_some(), "the name field's /TU shows on hover");
+    assert!(h.query_all_by_label("Your name").next().is_some(), "the name field's /TU shows on hover");
     rest_on_field(&mut h, "city");
     assert!(h.query_by_label("Your name").is_none(), "another field doesn't keep the tooltip");
     // Nor shows one of its own: none has been shown since the pointer left `name` (well past the
@@ -84,7 +84,7 @@ fn a_read_only_fields_tooltip_shows_on_hover() {
     let mut h = harness();
     set_city(&mut h, pdfcraft_engine::FieldProps { tooltip: Some("Where you live".into()), read_only: Some(true), ..Default::default() });
     rest_on_field(&mut h, "city");
-    assert!(h.query_by_label("Where you live").is_some());
+    assert!(h.query_all_by_label("Where you live").next().is_some());
 }
 
 /// A `/TU` of only spaces shows no tooltip (no empty box under the pointer).
@@ -404,7 +404,7 @@ fn dragging_over_another_fields_text_focuses_it_and_selects_from_the_press() {
         let doc = s.session.get(s.views[0].id).unwrap();
         let f = doc.form.iter().find(|f| f.name == "name").unwrap();
         let rect = pdfcraft_ui_egui::forms_ui::field_screen_rect(&s.views[0], &doc.info, f, 0).expect("on screen");
-        (rect, egui::Id::new(("form-field", s.views[0].id.0, "name", 0usize)))
+        (rect, egui::Id::unique(("form-field", s.views[0].id.0, "name", 0usize)))
     };
     // From inside the first word to past the end of the text.
     let (from, to) = (egui::pos2(rect.left() + 30.0, rect.center().y), egui::pos2(rect.right() - 8.0, rect.center().y));
@@ -1423,6 +1423,95 @@ fn mode_tabs_keep_the_hand_over_a_text_field_scrolled_under_them() {
     assert_eq!(h.state().mode, pdfcraft_ui_egui::Mode::Convert, "the tab takes the click, not the field's editor");
 }
 
+/// Two combo boxes of Apple and Banana: `fruit` editable (Combo and Edit, ISO 32000-2 Table 233),
+/// `veg` a drop-down list only.
+fn combo_form() -> Vec<u8> {
+    pdf_from_objects(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /T (fruit) /Ff 393216 /Opt [(Apple) (Banana)] /Rect [20 350 280 372] /P 3 0 R /F 4 >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Ch /T (veg) /Ff 131072 /Opt [(Apple) (Banana)] /Rect [20 300 280 322] /P 3 0 R /F 4 >>",
+    ])
+}
+
+fn combo_harness() -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("combo.pdf", None, combo_form()).unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.set_option("zoom", "150").unwrap();
+        app
+    });
+    crate::support::settle(&mut h);
+    h
+}
+
+/// An editable combo box takes a typed value that isn't among its options, and still takes a
+/// pick from its list; the typed value is what Save writes.
+#[test]
+fn an_editable_combo_box_takes_a_typed_value() {
+    let dir = scratch("editable-combo");
+    let out = dir.join("saved.pdf");
+    let mut h = combo_harness();
+    click_field(&mut h, "fruit", 0);
+    assert_eq!(focused(&h), Some(("fruit".into(), 0)));
+    h.event(egui::Event::Text("Cherry".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(4);
+    assert_eq!(value(&h, "fruit"), ["Cherry"], "Enter commits the typed value");
+    assert!(h.state().views[0].forms.focus.is_none(), "and closes the field");
+    // Reopened, it shows the typed value, and the list still picks an option.
+    click_field(&mut h, "fruit", 0);
+    assert_eq!(h.state().views[0].forms.focus.as_ref().map(|f| f.text.as_str()), Some("Cherry"));
+    h.get_by_label("Banana").click();
+    h.run_steps(4);
+    assert_eq!(value(&h, "fruit"), ["Banana"], "a pick from the list");
+    // Typed again, Tab commits it, and Save writes it.
+    click_field(&mut h, "fruit", 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.event(egui::Event::Text("Damson".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Tab);
+    h.run_steps(4);
+    assert_eq!(value(&h, "fruit"), ["Damson"], "Tab commits the typed value");
+    h.state_mut().save_override = Some(out.to_string_lossy().into_owned());
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::S);
+    wait_for_file(&mut h, &out);
+    assert_eq!(saved_value(&out, "fruit"), ["Damson"]);
+    // Undo takes the typing back as one step.
+    h.state_mut().undo();
+    h.run_steps(2);
+    assert_eq!(value(&h, "fruit"), ["Banana"]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A combo box without the Edit flag is a drop-down list only: typing changes nothing.
+#[test]
+fn a_combo_box_without_edit_takes_no_typing() {
+    let mut h = combo_harness();
+    click_field(&mut h, "veg", 0);
+    assert_eq!(focused(&h), Some(("veg".into(), 0)));
+    h.event(egui::Event::Text("Cherry".into()));
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].forms.focus.as_ref().map(|f| f.text.as_str()), Some(""), "no text box took the typing");
+    h.key_press(egui::Key::Enter);
+    h.run_steps(2);
+    h.key_press(egui::Key::Tab);
+    h.run_steps(4);
+    assert!(value(&h, "veg").is_empty(), "nothing typed reaches the field");
+    // Tab went on to `fruit`, whose open list covers `veg`: close it first.
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    click_field(&mut h, "veg", 0);
+    h.get_by_label("Apple").click();
+    h.run_steps(4);
+    assert_eq!(value(&h, "veg"), ["Apple"], "its list still picks");
+}
+
 /// A button script's `ShowHideFileAttachment` opens the attachments panel, and running it again
 /// closes it.
 #[test]
diff --git a/crates/ui-egui/tests/it/links.rs b/crates/ui-egui/tests/it/links.rs
index b08036b11d..f08e9d4356 100644
--- a/crates/ui-egui/tests/it/links.rs
+++ b/crates/ui-egui/tests/it/links.rs
@@ -42,6 +42,19 @@ fn home_screen_links() {
     }
 }
 
+#[test]
+fn home_community_card_closes_for_this_run() {
+    let mut h = harness(|_| {});
+    h.get_by_label("Join the ArtCraft community");
+    h.get_by_label("Close").click();
+    h.run_steps(2);
+    assert!(h.state().community_card_closed);
+    assert!(h.query_by_label("Join the ArtCraft community").is_none());
+    assert!(h.query_by_label("Join our Discord").is_none());
+    // Not remembered: a fresh app shows the card again.
+    assert!(!PdfCraftApp::new().community_card_closed);
+}
+
 #[test]
 fn about_dialog_shows_the_brand_and_links() {
     let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF";
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
index 3a534850f0..a5c3192358 100644
--- a/crates/ui-egui/tests/it/main.rs
+++ b/crates/ui-egui/tests/it/main.rs
@@ -21,6 +21,7 @@ mod accessibility;
 mod actions;
 mod animate;
 mod attach_picker_target;
+mod attachment_row;
 mod bookmark_position;
 mod bookmarks;
 mod bulk_fields;
@@ -29,6 +30,7 @@ mod camera;
 mod column_select;
 mod combine_grid;
 mod commands;
+mod comment_pin;
 mod comments;
 mod compare;
 mod content;
@@ -38,6 +40,7 @@ mod date_format;
 mod dialog_chrome;
 mod document_links;
 mod editing;
+mod editor_taps;
 mod export;
 mod fill_sign;
 mod folders;
@@ -50,11 +53,13 @@ mod links;
 mod marks;
 mod object_selection;
 mod ocr;
+mod open_action;
 mod organize_drag;
 mod pageboxes;
 mod panel_snapshots;
 mod pdf_links;
 mod pickers;
+mod pointer;
 mod preferences_layout;
 mod prepare;
 mod print;
@@ -63,6 +68,7 @@ mod reading_colors;
 mod recovery;
 mod redact;
 mod reload;
+mod side_panels;
 mod signing;
 mod stamps;
 mod text_select;
diff --git a/crates/ui-egui/tests/it/marks.rs b/crates/ui-egui/tests/it/marks.rs
index 0ec7a99e1c..38ffdffd39 100644
--- a/crates/ui-egui/tests/it/marks.rs
+++ b/crates/ui-egui/tests/it/marks.rs
@@ -1,5 +1,6 @@
 //! Header & footer, watermark and background dialogs in the real shell (egui_kittest).
 
+use crate::support;
 use egui_kittest::Harness;
 use egui_kittest::kittest::Queryable;
 use pdfcraft_engine::MarkKind;
@@ -127,7 +128,7 @@ fn backgrounds_and_watermarks_from_a_file() {
     let mut h = harness();
     h.state_mut().execute("edit.background");
     h.run_steps(2);
-    h.get_by_label("File").click();
+    support::outside_menus(&h, "File").click();
     h.run_steps(2);
     h.get_by_label("No file chosen");
     assert!(h.query_by(|n| n.label().as_deref() == Some("OK") && n.is_disabled()).is_some(), "OK waits for a file");
@@ -265,6 +266,35 @@ fn the_preview_shows_the_page_the_range_selects_under_the_marks() {
     assert_eq!(tint, egui::Color32::from_rgb(255, 255, 217), "the default pale yellow, opaque");
 }
 
+/// The preview's page stepper, beside its "page N of M" label: the dialog's own button, not the
+/// page navigation's of the same name.
+fn preview_step(h: &mut Harness<'static, PdfCraftApp>, label: &str, now: &str) {
+    let row = h.get_by_label(now).rect().center().y;
+    h.query_all_by_label(label).find(|n| (n.rect().center().y - row).abs() < 15.0).unwrap_or_else(|| panic!("{label} beside {now:?}")).click();
+    h.run_steps(2);
+}
+
+#[test]
+fn the_preview_steps_through_the_pages_and_starts_at_the_current_one() {
+    let mut h = harness();
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.watermark"));
+    h.run_steps(2);
+    h.get_by_label("Preview: page 2 of 3");
+    preview_step(&mut h, "Next page", "Preview: page 2 of 3");
+    h.get_by_label("Preview: page 3 of 3");
+    preview_step(&mut h, "Previous page", "Preview: page 3 of 3");
+    preview_step(&mut h, "Previous page", "Preview: page 2 of 3");
+    h.get_by_label("Preview: page 1 of 3");
+    // Opened again, the preview is back at the current page.
+    h.get_by_label("Cancel").click();
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.watermark"));
+    h.run_steps(2);
+    h.get_by_label("Preview: page 2 of 3");
+}
+
 /// Pages from 1 to 1 stays one page: the dialog used to turn "to" back into the last page on
 /// every frame while both were 1, so only page 1 could not be chosen alone. The field starts on
 /// the last page.
diff --git a/crates/ui-egui/tests/it/open_action.rs b/crates/ui-egui/tests/it/open_action.rs
new file mode 100644
index 0000000000..a6593af707
--- /dev/null
+++ b/crates/ui-egui/tests/it/open_action.rs
@@ -0,0 +1,191 @@
+//! A document opens where its `/OpenAction` says (ISO 32000-2 §12.3.2.2 Table 149, §12.3.2.4):
+//! the page, and the place on it, of an explicit destination, a go-to action's or a named one;
+//! and a full-screen document's `/NonFullScreenPageMode` panel (Table 147).
+
+use egui::{Key, Modifiers};
+use egui_kittest::Harness;
+use pdfcraft_render::DestView;
+use pdfcraft_ui_egui::canvas::Fit;
+use pdfcraft_ui_egui::{PdfCraftApp, RightPanel};
+
+/// Six Letter (612×792) pages, objects 3 to 8; `catalog` is added to the catalog dictionary.
+/// Object 9 is an outline (one bookmark, object 10) that `/Outlines 9 0 R` can use.
+fn fixture(catalog: &str) -> Vec<u8> {
+    let n = 6;
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 3 + i)).collect();
+    let mut objs = vec![format!("<< /Type /Catalog /Pages 2 0 R {catalog} >>"), format!("<< /Type /Pages /Kids [{}] /Count {n} >>", kids.join(" "))];
+    for _ in 0..n {
+        objs.push("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >>".to_string());
+    }
+    objs.push("<< /Type /Outlines /First 10 0 R /Last 10 0 R /Count 1 >>".to_string());
+    objs.push("<< /Title (Chapter) /Parent 9 0 R /Dest [6 0 R /Fit] >>".to_string());
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn harness(catalog: &str) -> Harness<'static, PdfCraftApp> {
+    let bytes = fixture(catalog);
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.open_bytes("open.pdf", None, bytes).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    settle(&mut h);
+    h
+}
+
+/// Run frames until rendering has finished and the layout holds still.
+fn settle(h: &mut Harness<'static, PdfCraftApp>) {
+    for _ in 0..200 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+}
+
+/// The page at the top of the window and the user-space height there: where a bookmark made now
+/// (⌘B) goes.
+fn window_top(h: &mut Harness<'static, PdfCraftApp>) -> (usize, f32) {
+    h.key_press_modifiers(Modifiers::COMMAND, Key::B);
+    h.run_steps(3);
+    let id = h.state().views[0].id;
+    let outline = &h.state().session.get(id).unwrap().info.outline;
+    let made = outline.iter().find(|b| b.title == "Untitled").expect("the new bookmark");
+    match made.view {
+        DestView::Xyz { top: Some(top), .. } => (made.page.expect("a page"), top),
+        other => panic!("expected /XYZ with a top, got {other:?}"),
+    }
+}
+
+/// The left edge of `page` on screen and its scale (screen points per user-space point).
+fn page_left(h: &Harness<'static, PdfCraftApp>, page: usize) -> (f32, f32) {
+    let rects = h.state().views[0].visible_page_rects();
+    let (_, r) = rects.iter().find(|(p, _)| *p == page).expect("the page is shown");
+    (r.left(), r.width() / 612.0)
+}
+
+fn near(got: f32, want: f32, what: &str) {
+    assert!((got - want).abs() < 2.0, "{what}: {got} vs {want}");
+}
+
+#[test]
+fn an_xyz_open_action_puts_its_point_at_the_window_top_left() {
+    let mut h = harness("/OpenAction [5 0 R /XYZ 100 500 2]");
+    assert_eq!(h.state().views[0].current, 2);
+    assert_eq!((h.state().views[0].fit, h.state().views[0].zoom), (Fit::None, 2.0));
+    // `left`: the page sits 100 user points further left than one opened at left 0.
+    let (left, scale) = page_left(&h, 2);
+    let (left0, _) = page_left(&harness("/OpenAction [5 0 R /XYZ 0 500 2]"), 2);
+    near(left0 - left, 100.0 * scale, "the page moved left by `left`");
+    let (page, top) = window_top(&mut h);
+    assert_eq!(page, 2);
+    near(top, 500.0, "y 500 is at the window's top edge");
+}
+
+#[test]
+fn a_fith_open_action_puts_its_top_at_the_window_top() {
+    let mut h = harness("/OpenAction [4 0 R /FitH 400]");
+    assert_eq!(h.state().views[0].current, 1);
+    assert_eq!(h.state().views[0].fit, Fit::Width);
+    let (page, top) = window_top(&mut h);
+    assert_eq!(page, 1);
+    near(top, 400.0, "y 400 is at the window's top edge");
+}
+
+#[test]
+fn a_named_open_destination_opens_its_page() {
+    for catalog in [
+        // PDF 1.1: a name, through the catalog's /Dests.
+        "/OpenAction << /S /GoTo /D /there >> /Dests << /there [7 0 R /XYZ 0 792 0] >>",
+        // A string, through the /Names /Dests name tree.
+        "/OpenAction << /S /GoTo /D (there) >> /Names << /Dests << /Names [(there) [7 0 R /XYZ 0 792 0]] >> >>",
+        // The destination given as a name, without an action.
+        "/OpenAction /there /Dests << /there [7 0 R /XYZ 0 792 0] >>",
+    ] {
+        let mut h = harness(catalog);
+        assert_eq!(h.state().views[0].current, 4, "{catalog}");
+        // A zoom of 0 keeps the default zoom.
+        assert_eq!(h.state().views[0].fit, Fit::Width, "{catalog}");
+        let (page, top) = window_top(&mut h);
+        assert_eq!(page, 4, "{catalog}");
+        near(top, 792.0, "the page's top is at the window's top edge");
+    }
+    // A name nothing defines opens on the first page.
+    let h = harness("/OpenAction << /S /GoTo /D /missing >> /Dests << /there [7 0 R /Fit] >>");
+    assert_eq!(h.state().views[0].current, 0);
+}
+
+#[test]
+fn always_my_default_view_keeps_the_zoom_and_goes_to_the_page_top() {
+    let bytes = fixture("/OpenAction [5 0 R /XYZ 100 500 2]");
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.always_default_view = true;
+        app.open_bytes("open.pdf", None, bytes).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    settle(&mut h);
+    assert_eq!(h.state().views[0].current, 2);
+    assert_eq!(h.state().views[0].fit, Fit::Width);
+    let (page, top) = window_top(&mut h);
+    assert_eq!(page, 2);
+    near(top, 792.0, "the page's top");
+}
+
+#[test]
+fn a_full_screen_document_shows_its_non_full_screen_panel_outside_full_screen() {
+    for (mode, want) in [("UseThumbs", Some(RightPanel::Pages)), ("UseOC", Some(RightPanel::Layers)), ("UseNone", None)] {
+        let mut h = harness(&format!("/PageMode /FullScreen /ViewerPreferences << /NonFullScreenPageMode /{mode} >>"));
+        assert!(h.state().pending_full_screen.is_some(), "{mode}: full screen is asked for");
+        assert_eq!(h.state().right, want, "{mode}: the panel behind the prompt");
+        // Declining it leaves that panel.
+        let ctx = h.ctx.clone();
+        h.state_mut().resolve_full_screen_prompt(&ctx, false);
+        h.run_steps(2);
+        assert_eq!((h.state().full_screen, h.state().right), (false, want), "{mode}: declined");
+        // Entering and leaving full screen comes back to it.
+        h.state_mut().apply_full_screen(true);
+        h.run_steps(2);
+        h.state_mut().apply_full_screen(false);
+        h.run_steps(2);
+        assert_eq!(h.state().right, want, "{mode}: after full screen");
+    }
+    // Without /PageMode /FullScreen the entry means nothing.
+    let h = harness("/ViewerPreferences << /NonFullScreenPageMode /UseThumbs >>");
+    assert_eq!(h.state().right, None);
+}
+
+#[test]
+fn a_full_screen_document_with_an_outline_shows_it_only_when_it_asks_to() {
+    // UseNone (and its absence, the default) shows no outline outside full screen; UseOutlines does.
+    for (prefs, want) in [
+        ("", None),
+        ("/ViewerPreferences << /NonFullScreenPageMode /UseNone >>", None),
+        ("/ViewerPreferences << /NonFullScreenPageMode /UseOutlines >>", Some(RightPanel::Bookmarks)),
+    ] {
+        let h = harness(&format!("/Outlines 9 0 R /PageMode /FullScreen {prefs}"));
+        assert_eq!(h.state().right, want, "{prefs}");
+    }
+    // Not in full screen, a document with an outline still opens on it.
+    let h = harness("/Outlines 9 0 R");
+    assert_eq!(h.state().right, Some(RightPanel::Bookmarks));
+}
diff --git a/crates/ui-egui/tests/it/panel_snapshots.rs b/crates/ui-egui/tests/it/panel_snapshots.rs
index c9cc1d5901..97fba87777 100644
--- a/crates/ui-egui/tests/it/panel_snapshots.rs
+++ b/crates/ui-egui/tests/it/panel_snapshots.rs
@@ -87,12 +87,12 @@ fn harness(panel: &'static str) -> Harness<'static, PdfCraftApp> {
     h
 }
 
-/// The side panel's contents: the dock node after the Inspector tab.
+/// The side panel's contents: the node after the pane's own focus stop, named "Inspector".
 fn panel<'h>(h: &'h Harness<'static, PdfCraftApp>) -> Node<'h> {
-    let tab = h.get_by(|n| n.role() == Role::Tab && n.label().as_deref() == Some("Inspector"));
-    let dock = tab.parent().expect("the Inspector tab sits in a dock node");
-    let mut after = dock.children().skip_while(|n| n.accesskit_node().id() != tab.accesskit_node().id()).skip(1);
-    after.next().expect("the panel follows its tab")
+    let stop = h.get_by(|n| n.role() != Role::Label && n.label().as_deref() == Some("Inspector"));
+    let pane = stop.parent().expect("the side panel's focus stop sits in its pane");
+    let mut after = pane.children().skip_while(|n| n.accesskit_node().id() != stop.accesskit_node().id()).skip(1);
+    after.next().expect("the panel follows its focus stop")
 }
 
 /// One line per node that says something: layout containers are skipped (their children move up a
diff --git a/crates/ui-egui/tests/it/pickers.rs b/crates/ui-egui/tests/it/pickers.rs
index 6aa5515527..f9e46c5f2f 100644
--- a/crates/ui-egui/tests/it/pickers.rs
+++ b/crates/ui-egui/tests/it/pickers.rs
@@ -963,6 +963,9 @@ impl Drop for AttachmentDir {
 
 #[test]
 fn attachment_save_preserves_bytes_metadata_and_selected_destination() {
+    if crate::support::skip_without_glyphs("attachment_save_preserves_bytes_metadata_and_selected_destination", "en", "user chosen 資料.bin") {
+        return;
+    }
     let dir = AttachmentDir::new();
     let chosen = dir.0.join("user chosen 資料.bin");
     let original = attachment_fixture();
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
new file mode 100644
index 0000000000..f2b6c0e907
--- /dev/null
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -0,0 +1,653 @@
+//! What the page's tools see of the pointer. A finger tap, a touch drag and a click whose press
+//! and release share a frame act as a mouse click and drag do, and nothing drawn over the page (a
+//! dialog, the palette, the quick bar, the chrome over a page scrolled under it) lets the page's
+//! cursor, tips or presses through.
+//!
+//! The ignored tests pin live bugs that later steps of the page pointer router fix: one cursor
+//! writer (step 2), one hit test (step 3), and press-time capture with cancel (step 4).
+
+use egui_kittest::Harness;
+use pdfcraft_engine::StampKind;
+use pdfcraft_ui_egui::comments::CommentTool;
+use pdfcraft_ui_egui::{PdfCraftApp, QuickTool, UnlockPrompt};
+
+use crate::support::input::{coalesced_click, double_click, one_frame, touch_drag, touch_tap};
+
+/// A PDF of `objects`, numbered from 1 with the catalog first.
+fn pdf(objects: &[&str]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    out
+}
+
+fn stream(content: &str) -> String {
+    format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len() + 1)
+}
+
+const CATALOG: &str = "<< /Type /Catalog /Pages 2 0 R >>";
+const PAGES: &str = "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>";
+const HELVETICA: &str = "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>";
+/// One line of 12 pt Helvetica at x 40, y 300.
+const LINE: &str = "BT /F1 12 Tf 40 300 Td (Signed and approved by the committee.) Tj ET";
+
+/// One 300×400 page with a web link at x 50..250, y 300..350.
+fn link_pdf() -> Vec<u8> {
+    pdf(&[
+        CATALOG,
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>",
+        "<< /Type /Annot /Subtype /Link /Rect [50 300 250 350] /Border [0 0 0] /A << /S /URI /URI (https://example.org/) >> >>",
+    ])
+}
+
+/// A 300×400 page with a paragraph at y≈300 and a link over its first words.
+fn linked_text_pdf() -> Vec<u8> {
+    let text = stream("BT /F1 12 Tf 40 300 Td (Read the guide at example.org before you start.) Tj ET");
+    pdf(&[
+        CATALOG,
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Resources << /Font << /F1 6 0 R >> >> /Annots [4 0 R] >>",
+        "<< /Type /Annot /Subtype /Link /Rect [40 295 160 312] /Border [0 0 0] /A << /S /URI /URI (https://example.org/) >> >>",
+        text.as_str(),
+        HELVETICA,
+    ])
+}
+
+/// A 300×400 page with a line of text at y≈300 and a rectangle comment over it.
+fn comment_on_text_pdf() -> Vec<u8> {
+    let text = stream(LINE);
+    pdf(&[
+        CATALOG,
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Resources << /Font << /F1 6 0 R >> >> /Annots [4 0 R] >>",
+        "<< /Type /Annot /Subtype /Square /Rect [30 290 200 320] /C [1 0 0] /Border [0 0 2] /F 4 /T (Reviewer) >>",
+        text.as_str(),
+        HELVETICA,
+    ])
+}
+
+/// A 300×400 page with one line of text at x 40, y 300.
+fn text_pdf() -> Vec<u8> {
+    let text = stream(LINE);
+    pdf(&[CATALOG, PAGES, "<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>", text.as_str(), HELVETICA])
+}
+
+/// A 300×400 page with an unchecked check box `agree` at x 100..120, y 200..220.
+fn checkbox_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/ZaDb 0 Tf 0 g) /DR << /Font << /ZaDb 5 0 R >> >> >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Off /AS /Off /Rect [100 200 120 220] /P 3 0 R /F 4 /MK << /CA (4) >> /DA (/ZaDb 11 Tf 0 g) >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /ZapfDingbats >>",
+    ])
+}
+
+/// The app with `pdf` open at `zoom` percent and its first frames run. The left panel stays
+/// open only where a test places the page relative to the window's chrome.
+fn open(pdf: Vec<u8>, zoom: &'static str, left_open: bool) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("test.pdf", None, pdf).unwrap();
+        if !left_open {
+            app.set_option("left", "closed").unwrap();
+        }
+        app.set_option("zoom", zoom).unwrap();
+        app
+    });
+    for _ in 0..30 {
+        h.run_steps(2);
+    }
+    h
+}
+
+fn stamp_tool(h: &mut Harness<'_, PdfCraftApp>) {
+    h.state_mut().quick_tool = QuickTool::Stamp(StampKind::DynApproved);
+    h.run_steps(4);
+}
+
+fn page(h: &Harness<'_, PdfCraftApp>) -> egui::Rect {
+    h.state().views[0].page_screen_rect(0).expect("page on screen")
+}
+
+/// The screen point at PDF (x, y) on the 300×400 page.
+fn at(h: &Harness<'_, PdfCraftApp>, x: f32, y: f32) -> egui::Pos2 {
+    let r = page(h);
+    let k = r.width() / 300.0;
+    r.min + egui::vec2(x * k, (400.0 - y) * k)
+}
+
+fn cursor_at(h: &mut Harness<'_, PdfCraftApp>, p: egui::Pos2) -> egui::CursorIcon {
+    h.hover_at(p);
+    h.run_steps(2);
+    h.output().platform_output.cursor_icon
+}
+
+/// A mouse click: press and release in frames of their own, as `drag_at` and `drop_at` send them.
+fn mouse_click(h: &mut Harness<'_, PdfCraftApp>, p: egui::Pos2) {
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(4);
+}
+
+/// A mouse drag from `from` by `by`, held over two frames on the way.
+fn mouse_drag(h: &mut Harness<'_, PdfCraftApp>, from: egui::Pos2, by: egui::Vec2) {
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    h.hover_at(from + by);
+    h.run_steps(2);
+    h.drop_at(from + by);
+    for _ in 0..10 {
+        h.run_steps(2);
+    }
+}
+
+fn stamps(h: &Harness<'_, PdfCraftApp>) -> usize {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().info.annotations.iter().filter(|a| a.subtype == "Stamp").count()
+}
+
+fn square(h: &Harness<'_, PdfCraftApp>) -> Option<[f32; 4]> {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().info.annotations.iter().find(|a| a.subtype == "Square").map(|a| a.rect)
+}
+
+fn agree(h: &Harness<'_, PdfCraftApp>) -> Vec<String> {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == "agree").unwrap().value.clone()
+}
+
+/// Hovers `p` until `want` accepts the cursor there (text layers and paragraph boxes arrive from
+/// worker threads), and returns the last cursor seen.
+fn wait_for_cursor(h: &mut Harness<'_, PdfCraftApp>, p: egui::Pos2, want: impl Fn(egui::CursorIcon) -> bool) -> egui::CursorIcon {
+    let mut cursor = egui::CursorIcon::Default;
+    for _ in 0..50 {
+        cursor = cursor_at(h, p);
+        if want(cursor) {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    cursor
+}
+
+// ---------------------------------------------------------------------------------------------
+// The cursor promises one thing and a press does another.
+
+#[test]
+#[ignore = "step 2 of the page pointer router: one cursor writer"]
+fn stamp_tool_over_a_link_shows_its_crosshair() {
+    let mut h = open(link_pdf(), "150", false);
+    stamp_tool(&mut h);
+    let on_link = at(&h, 150.0, 325.0);
+    let off_link = at(&h, 150.0, 150.0);
+    assert_eq!(cursor_at(&mut h, off_link), egui::CursorIcon::Crosshair, "the tool's cursor off the link");
+    let cursor = cursor_at(&mut h, on_link);
+    mouse_click(&mut h, on_link);
+    assert_eq!((stamps(&h), h.state().pending_link.is_some()), (1, false), "a click places a stamp and does not follow the link");
+    assert_eq!(cursor, egui::CursorIcon::Crosshair, "so the cursor is the stamp tool's, not the link hand");
+}
+
+#[test]
+#[ignore = "step 2 of the page pointer router: one cursor writer"]
+fn rectangle_tool_over_a_link_shows_its_crosshair() {
+    let mut h = open(link_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::Comment(CommentTool::Rectangle);
+    h.run_steps(4);
+    let off_link = at(&h, 150.0, 150.0);
+    let off = cursor_at(&mut h, off_link);
+    let on_link = at(&h, 150.0, 325.0);
+    let on = cursor_at(&mut h, on_link);
+    assert_eq!(on, off, "a drag over the link draws a rectangle, as it does off the link");
+}
+
+#[test]
+#[ignore = "step 2 of the page pointer router: one cursor writer"]
+fn edit_text_over_a_linked_word_offers_the_move_arrow() {
+    let mut h = open(linked_text_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::EditText;
+    for _ in 0..30 {
+        h.run_steps(2);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    // One paragraph, one line: a word outside the link, then a word inside it.
+    let plain = at(&h, 230.0, 303.0);
+    let linked = at(&h, 60.0, 303.0);
+    let off = wait_for_cursor(&mut h, plain, |c| c == egui::CursorIcon::Move);
+    let on = cursor_at(&mut h, linked);
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap().text_blocks(0)[0].rect;
+    let k = page(&h).width() / 300.0;
+    mouse_drag(&mut h, linked, egui::vec2(20.0 * k, 0.0));
+    let after = h.state().session.get(id).unwrap().text_blocks(0)[0].rect;
+    assert_eq!(off, egui::CursorIcon::Move, "a closed paragraph offers the four-way arrow (#1717)");
+    assert!((after[0] - before[0] - 20.0).abs() < 1.5, "a drag from the linked word moves the paragraph: {before:?} → {after:?}");
+    assert_eq!(on, off, "the linked words belong to the same paragraph, and a drag there moves it too");
+}
+
+#[test]
+#[ignore = "step 2 of the page pointer router: one cursor writer"]
+fn select_tool_over_a_comment_on_text_offers_the_move_arrow() {
+    let mut h = open(comment_on_text_pdf(), "150", false);
+    // Inside the rectangle where there is no text, and inside it over a word.
+    let blank = at(&h, 120.0, 315.0);
+    let on_text = at(&h, 60.0, 303.0);
+    let over_blank = cursor_at(&mut h, blank);
+    let over_text = wait_for_cursor(&mut h, on_text, |c| c != egui::CursorIcon::Default);
+    let before = square(&h).expect("the rectangle");
+    let k = page(&h).width() / 300.0;
+    mouse_drag(&mut h, on_text, egui::vec2(20.0 * k, 0.0));
+    let after = square(&h).expect("the rectangle");
+    assert_eq!(over_blank, egui::CursorIcon::Move, "a movable comment offers the four-way arrow");
+    assert!((after[0] - before[0] - 20.0).abs() < 1.5, "a drag from the text moves the rectangle: {before:?} → {after:?}");
+    assert_eq!(over_text, egui::CursorIcon::Move, "so it offers the arrow where text lies under it too");
+}
+
+/// Narrows the paragraph by dragging its left edge 100 pt inward, starting `dx` screen points
+/// left of the edge. Returns the cursor shown at the press point and the line count after.
+fn narrow_from_left(dx: f32) -> (egui::CursorIcon, usize) {
+    let mut h = open(text_pdf(), "150", false);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    for _ in 0..20 {
+        h.run_steps(2);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let id = h.state().views[0].id;
+    let b = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let k = page(&h).width() / 300.0;
+    let grip = at(&h, b.rect[0] as f32, (b.rect[1] + b.rect[3]) as f32 / 2.0) - egui::vec2(dx, 0.0);
+    let cursor = cursor_at(&mut h, grip);
+    h.drag_at(grip);
+    h.run_steps(1);
+    for i in 1..=4 {
+        h.hover_at(grip + egui::vec2(25.0 * k * i as f32, 0.0));
+        h.run_steps(1);
+    }
+    h.drop_at(grip + egui::vec2(100.0 * k, 0.0));
+    for _ in 0..10 {
+        h.run_steps(2);
+    }
+    (cursor, h.state().session.get(id).unwrap().text_lines(0).len())
+}
+
+#[test]
+#[ignore = "step 3 of the page pointer router: one hit test"]
+fn a_paragraph_edge_resizes_wherever_it_shows_the_resize_cursor() {
+    let (inside_cursor, inside_lines) = narrow_from_left(1.0);
+    assert_eq!(inside_cursor, egui::CursorIcon::ResizeHorizontal);
+    assert!(inside_lines > 1, "control: a drag from the edge rewraps the paragraph");
+    let (outside_cursor, outside_lines) = narrow_from_left(5.0);
+    assert_eq!(outside_cursor, egui::CursorIcon::ResizeHorizontal, "the resize cursor shows 5 pt out");
+    assert!(outside_lines > 1, "so a drag from there rewraps it too");
+}
+
+// ---------------------------------------------------------------------------------------------
+// Things drawn over the page keep the page's cursor, tips and presses off.
+
+/// Check that the command palette's frame keeps the default cursor over the page while the page beside it
+/// still shows the stamp tool.
+#[test]
+fn stamp_cursor_stays_off_the_command_palette() {
+    let mut h = open(link_pdf(), "300", false);
+    stamp_tool(&mut h);
+    h.state_mut().palette_open = true;
+    h.run_steps(4);
+    let palette = h.ctx.memory(|m| m.area_rect(egui::Id::unique("palette"))).expect("palette shown");
+    // On the palette's frame margin, where none of its widgets sets a cursor, over the page.
+    let p = egui::pos2(palette.left() + 4.0, palette.bottom() - 4.0);
+    assert!(page(&h).contains(p), "the palette must lie over the page here");
+    assert_eq!(cursor_at(&mut h, p), egui::CursorIcon::Default);
+    // The page beside the palette still shows the tool.
+    let beside = egui::pos2(palette.left() + 4.0, palette.bottom() + 40.0);
+    assert!(page(&h).contains(beside));
+    assert_eq!(cursor_at(&mut h, beside), egui::CursorIcon::Crosshair);
+}
+
+/// A link beside the open palette shows no tip: tips draw above the palette.
+#[test]
+fn link_tip_stays_off_while_the_palette_is_open() {
+    use egui_kittest::kittest::Queryable;
+    let mut h = open(link_pdf(), "300", false);
+    h.state_mut().palette_open = true;
+    h.run_steps(4);
+    let palette = h.ctx.memory(|m| m.area_rect(egui::Id::unique("palette"))).expect("palette shown");
+    let beside = [60.0, 100.0, 150.0, 200.0, 240.0]
+        .into_iter()
+        .flat_map(|x| [305.0, 325.0, 345.0].map(|y| at(&h, x, y)))
+        .find(|p| page(&h).contains(*p) && !palette.expand(40.0).contains(*p))
+        .unwrap_or_else(|| panic!("no point of the link beside the palette {palette:?}, page {:?}", page(&h)));
+    h.hover_at(beside);
+    h.run_steps(3);
+    assert!(h.query_by_label("https://example.org/").is_none(), "no tip beside the palette");
+    h.state_mut().palette_open = false;
+    h.hover_at(beside);
+    h.run_steps(3);
+    h.get_by_label("https://example.org/");
+}
+
+/// A panel's resize edge dragged over a link shows neither the link's tip nor its cursor, and the
+/// link answers again once the edge is let go.
+#[test]
+fn a_dragged_panel_edge_passes_over_a_link_without_its_tip() {
+    use egui::accesskit::Role;
+    use egui_kittest::kittest::Queryable;
+    let mut h = open(link_pdf(), "150", false);
+    h.state_mut().set_option("panel", "comments").unwrap();
+    for _ in 0..4 {
+        h.run_steps(2);
+    }
+    let on_link = at(&h, 100.0, 340.0);
+    assert_eq!(cursor_at(&mut h, on_link), egui::CursorIcon::PointingHand);
+    h.run_steps(2);
+    assert!(tip_shown(&h), "the link's tip shows over an uncovered page");
+    // Away from the link, then the side panel's resize edge (the rightmost one) is picked up and
+    // carried over it.
+    h.hover_at(at(&h, 150.0, 100.0));
+    h.run_steps(4);
+    let tab = h
+        .get_all_by(|n| n.role() == Role::Splitter && n.label().as_deref() == Some("Resize panels"))
+        .map(|n| n.rect().center())
+        .max_by(|a, b| a.x.total_cmp(&b.x))
+        .expect("the side panel has a resize edge")
+        // The pane's half of the edge: the page, drawn after the panes, takes the other half.
+        + egui::vec2(2.0, 0.0);
+    h.hover_at(tab);
+    h.run_steps(1);
+    h.drag_at(tab);
+    h.run_steps(1);
+    for i in 1..=8 {
+        h.hover_at(tab + (on_link - tab) * (i as f32 / 8.0));
+        h.run_steps(1);
+    }
+    for _ in 0..4 {
+        h.run_steps(2);
+        assert!(h.ctx.dragged_id().is_some(), "the edge is still being dragged");
+        assert!(!tip_shown(&h), "no link tip under a dragged panel edge");
+        assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand);
+    }
+    // Back to the start and let go there, which leaves the width as it was.
+    for i in 1..=8 {
+        h.hover_at(on_link + (tab - on_link) * (i as f32 / 8.0));
+        h.run_steps(1);
+    }
+    h.drop_at(tab);
+    h.run_steps(2);
+    assert!(h.ctx.dragged_id().is_none());
+    assert_eq!(cursor_at(&mut h, on_link), egui::CursorIcon::PointingHand, "the link answers again");
+    h.run_steps(2);
+    assert!(tip_shown(&h), "and shows its tip");
+}
+
+/// Send one wheel event over the page and let its scrolling settle.
+fn wheel(h: &mut Harness<'_, PdfCraftApp>, delta: egui::Vec2) {
+    h.hover_at(egui::pos2(800.0, 500.0));
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta,
+        modifiers: egui::Modifiers::NONE,
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    for _ in 0..10 {
+        h.run_steps(2);
+    }
+}
+
+/// Check that the quick bar's frame keeps the default cursor over the page while the page below it still
+/// shows the stamp tool.
+#[test]
+fn stamp_cursor_stays_off_the_quick_bar() {
+    let mut h = open(link_pdf(), "400", true);
+    stamp_tool(&mut h);
+    // Bring the page under the quick bar's left end.
+    wheel(&mut h, egui::vec2(-200.0, 0.0));
+    let bar = h.ctx.memory(|m| m.area_rect(egui::Id::unique("quick-bar"))).expect("quick bar shown");
+    // Inside the bar's frame margin: no button there.
+    let p = egui::pos2(bar.left() + 3.0, bar.bottom() - 3.0);
+    assert!(page(&h).contains(p), "the quick bar must lie over the page here");
+    assert_eq!(cursor_at(&mut h, p), egui::CursorIcon::Default);
+    let below = egui::pos2(bar.left() + 3.0, bar.bottom() + 20.0);
+    assert!(page(&h).contains(below));
+    assert_eq!(cursor_at(&mut h, below), egui::CursorIcon::Crosshair);
+}
+
+#[test]
+fn stamp_cursor_stays_off_the_chrome_above_a_page_scrolled_under_it() {
+    let mut h = open(link_pdf(), "400", true);
+    stamp_tool(&mut h);
+    let top = page(&h).top();
+    wheel(&mut h, egui::vec2(0.0, -300.0));
+    let page = page(&h);
+    // Above where the page started (the viewport's top edge, give or take its margin): the
+    // toolbar, with the page scrolled up under it. Left of the link, which shows the hand.
+    let x = page.left() + 20.0;
+    let p = egui::pos2(x, top - 45.0);
+    assert!(page.contains(p), "the page must extend under the chrome here");
+    // The toolbar keeps its own cursor (a button's hand here); the page's is gone.
+    assert_ne!(cursor_at(&mut h, p), egui::CursorIcon::Crosshair);
+    assert_eq!(cursor_at(&mut h, egui::pos2(x, top + 40.0)), egui::CursorIcon::Crosshair);
+}
+
+/// Whether the page's hover tip was drawn in the last frame.
+fn tip_shown(h: &Harness<'_, PdfCraftApp>) -> bool {
+    let tip = egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("canvas-hover"));
+    h.ctx.memory(|m| m.areas().is_visible(&tip))
+}
+
+/// Opens the Unlock prompt, a dialog with a backdrop over the whole window, from the next frame.
+fn open_unlock_prompt(h: &mut Harness<'_, PdfCraftApp>) {
+    let doc = h.state().views[0].id;
+    h.state_mut().unlock_prompt = Some(UnlockPrompt { doc, name: "test.pdf".into(), input: String::new(), error: None, then: None });
+}
+
+/// Check that the link tip and pointing cursor disappear under the Unlock prompt.
+#[test]
+fn link_tip_stays_under_the_unlock_prompt() {
+    let mut h = open(link_pdf(), "300", true);
+    let page = page(&h);
+    let k = page.width() / 300.0;
+    // Near the link's top left corner, clear of the prompt's card in the middle of the window.
+    let on_link = page.min + egui::vec2(55.0 * k, (400.0 - 345.0) * k);
+    assert_eq!(cursor_at(&mut h, on_link), egui::CursorIcon::PointingHand);
+    h.run_steps(2);
+    assert!(tip_shown(&h), "the link's tip shows over an uncovered page");
+
+    open_unlock_prompt(&mut h);
+    h.hover_at(on_link + egui::vec2(1.0, 0.0));
+    for _ in 0..4 {
+        h.run_steps(2);
+    }
+    let card = h.ctx.memory(|m| m.area_rect(egui::Id::unique("unlock")));
+    assert!(card.is_none_or(|c| !c.contains(on_link)), "the point must be on the backdrop, not the card: {card:?}");
+    assert!(!tip_shown(&h), "the link's tip must not float over the Unlock prompt");
+    assert_ne!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand);
+}
+
+/// Check that moving onto a link's floating tip still reports the link's pointing-hand cursor.
+#[test]
+fn the_link_tip_lets_the_pointer_through_to_the_link() {
+    let mut h = open(link_pdf(), "150", false);
+    let p = at(&h, 100.0, 340.0);
+    assert_eq!(cursor_at(&mut h, p), egui::CursorIcon::PointingHand);
+    let tip = h.ctx.memory(|m| m.area_rect(egui::Id::unique("canvas-hover"))).expect("the link's tip");
+    // A quick move lands on the tip, drawn beside where the pointer was, and still on the link.
+    let onto = tip.min + egui::vec2(6.0, 6.0);
+    assert!(egui::Rect::from_two_pos(at(&h, 50.0, 350.0), at(&h, 250.0, 300.0)).contains(onto), "the point must be on the link");
+    h.hover_at(onto);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand, "the tip must not take the pointer from the link");
+}
+
+// Dialogs are drawn after the pages, so on the frame one opens egui does not know its layer yet
+// and still gives the pages the pointer, and a press there.
+
+#[test]
+fn the_link_tip_stays_under_a_dialog_on_the_frame_it_opens() {
+    let mut h = open(link_pdf(), "150", false);
+    let p = at(&h, 100.0, 340.0);
+    assert_eq!(cursor_at(&mut h, p), egui::CursorIcon::PointingHand);
+    h.run_steps(2);
+    assert!(tip_shown(&h), "the link's tip shows over an uncovered page");
+    open_unlock_prompt(&mut h);
+    h.run_steps(1);
+    assert!(!tip_shown(&h), "the link's tip must not show over the Unlock prompt on the frame it opens");
+}
+
+#[test]
+fn a_click_on_the_frame_a_dialog_opens_places_no_stamp() {
+    let mut h = open(link_pdf(), "150", false);
+    stamp_tool(&mut h);
+    let p = at(&h, 150.0, 150.0);
+    assert_eq!(cursor_at(&mut h, p), egui::CursorIcon::Crosshair);
+    open_unlock_prompt(&mut h);
+    let button = |pressed| egui::Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    one_frame(&mut h, [button(true), button(false)]);
+    h.run_steps(4);
+    assert_eq!(stamps(&h), 0, "a click in the frame the Unlock prompt opens places no stamp under it");
+}
+
+#[test]
+fn a_double_click_on_a_dialog_backdrop_leaves_page_text_alone() {
+    let mut h = open(text_pdf(), "150", false);
+    let word = at(&h, 50.0, 303.0);
+    // The I-beam shows the page's text layer has arrived.
+    assert_eq!(wait_for_cursor(&mut h, word, |c| c == egui::CursorIcon::Text), egui::CursorIcon::Text, "the page text is live");
+    // Control: without a dialog, a double-click there selects the word.
+    double_click(&mut h, word);
+    h.run_steps(4);
+    assert!(h.state().views[0].selected_text().is_some_and(|t| !t.is_empty()), "control: a double-click selects the word");
+    // A click on blank page clears it again.
+    h.run_steps(30);
+    let p = at(&h, 150.0, 150.0);
+    mouse_click(&mut h, p);
+    h.run_steps(30);
+    assert!(h.state().views[0].selected_text().is_none_or(|t| t.is_empty()), "cleared before the dialog opens");
+    h.state_mut().set_option("dialog", "shortcuts").unwrap();
+    h.run_steps(6);
+    assert!(h.state().dialog.is_some(), "a modal dialog is open");
+    // On the dialog's backdrop, where the page's first word lies underneath.
+    double_click(&mut h, word);
+    h.run_steps(4);
+    let selected = h.state().views[0].selected_text();
+    assert!(selected.as_deref().is_none_or(str::is_empty), "a double-click on a dialog selects nothing on the page under it: {selected:?}");
+}
+
+// ---------------------------------------------------------------------------------------------
+// Taps, touch drags and clicks within one frame. On the frame a touch (or a Windows pen) lifts,
+// egui-winit has sent `PointerGone`, so there is no hover position; egui still reports the click.
+
+#[test]
+fn mouse_click_follows_a_link() {
+    // Control for the tap below.
+    let mut h = open(link_pdf(), "150", false);
+    let p = at(&h, 150.0, 325.0);
+    mouse_click(&mut h, p);
+    assert!(h.state().pending_link.is_some(), "a click on a link asks to open it");
+}
+
+#[test]
+fn touch_tap_follows_a_link() {
+    let mut h = open(link_pdf(), "150", false);
+    let p = at(&h, 150.0, 325.0);
+    touch_tap(&mut h, p);
+    assert!(h.state().pending_link.is_some(), "a tap on a link asks to open it, as a click does");
+}
+
+#[test]
+fn coalesced_click_follows_a_link() {
+    let mut h = open(link_pdf(), "150", false);
+    let p = at(&h, 150.0, 325.0);
+    coalesced_click(&mut h, p);
+    assert!(h.state().pending_link.is_some(), "a click whose press and release share a frame follows the link");
+}
+
+#[test]
+fn touch_tap_places_a_stamp() {
+    let mut h = open(link_pdf(), "150", false);
+    stamp_tool(&mut h);
+    let p = at(&h, 150.0, 150.0);
+    touch_tap(&mut h, p);
+    assert_eq!(stamps(&h), 1, "a tap with the stamp tool places the stamp");
+}
+
+#[test]
+fn coalesced_click_places_a_stamp() {
+    let mut h = open(link_pdf(), "150", false);
+    stamp_tool(&mut h);
+    let p = at(&h, 150.0, 150.0);
+    coalesced_click(&mut h, p);
+    assert_eq!(stamps(&h), 1, "a click whose press and release share a frame places the stamp");
+}
+
+#[test]
+fn mouse_click_ticks_a_check_box() {
+    // Control for the tap below.
+    let mut h = open(checkbox_pdf(), "150", false);
+    let p = at(&h, 110.0, 210.0);
+    mouse_click(&mut h, p);
+    assert_eq!(agree(&h), ["Yes"], "a click ticks the box");
+}
+
+#[test]
+fn touch_tap_ticks_a_check_box() {
+    let mut h = open(checkbox_pdf(), "150", false);
+    let p = at(&h, 110.0, 210.0);
+    touch_tap(&mut h, p);
+    assert_eq!(agree(&h), ["Yes"], "a tap ticks the box, as a click does");
+}
+
+#[test]
+fn touch_drag_moves_a_comment_and_leaves_no_gesture_behind() {
+    let mut h = open(comment_on_text_pdf(), "150", false);
+    let k = page(&h).width() / 300.0;
+    let before = square(&h);
+    // A finger drags the rectangle 30 pt right, from a blank spot inside it.
+    let from = at(&h, 120.0, 315.0);
+    touch_drag(&mut h, from, from + egui::vec2(30.0 * k, 0.0));
+    let after_touch = square(&h);
+    assert_ne!(after_touch, before, "the touch drag moves the rectangle");
+    // Later, a mouse drag on empty page far below it.
+    let p = at(&h, 150.0, 100.0);
+    mouse_drag(&mut h, p, egui::vec2(10.0 * k, 10.0 * k));
+    assert_eq!(square(&h), after_touch, "an unrelated drag elsewhere leaves the rectangle where the touch put it");
+}
+
+// ---------------------------------------------------------------------------------------------
+// Ending a gesture.
+
+#[test]
+#[ignore = "step 4 of the page pointer router: press-time capture and cancel"]
+fn escape_cancels_a_signature_rectangle() {
+    let mut h = open(link_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::SignArea { certify: false };
+    h.run_steps(4);
+    let (a, b) = (at(&h, 60.0, 200.0), at(&h, 200.0, 120.0));
+    h.hover_at(a);
+    h.run_steps(1);
+    h.drag_at(a);
+    h.run_steps(1);
+    h.hover_at(b);
+    h.run_steps(2);
+    // Escape while the button is still held.
+    h.key_press(egui::Key::Escape);
+    h.run_steps(4);
+    let s = h.state();
+    assert_eq!(s.quick_tool, QuickTool::SignArea { certify: false }, "Escape abandons the rectangle; the tool stays");
+    assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
+}
diff --git a/crates/ui-egui/tests/it/prepare.rs b/crates/ui-egui/tests/it/prepare.rs
index 936b847d82..8d565ab696 100644
--- a/crates/ui-egui/tests/it/prepare.rs
+++ b/crates/ui-egui/tests/it/prepare.rs
@@ -813,16 +813,16 @@ fn actions_tab_shows_a_chain_and_keeps_it_when_the_first_action_is_replaced() {
     };
     open(&mut h);
     h.get_by_label("Run a JavaScript, then 1 more action");
-    // The first Edit is the menu bar's; the rows' follow (Mouse Up, On Blur).
-    assert_eq!(h.get_all_by_label("Edit").count(), 3);
-    h.get_all_by_label("Edit").nth(1).unwrap().click();
+    // The menu bar's Edit menu and the Edit tab come first; the rows' follow (Mouse Up, On Blur).
+    assert_eq!(h.get_all_by_label("Edit").count(), 4);
+    h.get_all_by_label("Edit").nth(2).unwrap().click();
     h.run_steps(2);
     assert_eq!(h.state().field_props.as_ref().unwrap().editing, Some(FieldTrigger::MouseUp));
     // While one script is open, no other Edit can overwrite it.
-    assert!(h.get_all_by_label("Edit").skip(1).all(|n| n.accesskit_node().is_disabled()));
+    assert!(h.get_all_by_label("Edit").skip(2).all(|n| n.accesskit_node().is_disabled()));
     h.get_by_label("Discard").click();
     h.run_steps(2);
-    assert!(h.get_all_by_label("Edit").skip(1).all(|n| !n.accesskit_node().is_disabled()));
+    assert!(h.get_all_by_label("Edit").skip(2).all(|n| !n.accesskit_node().is_disabled()));
     // Replace the Mouse Up script with a link: the chained link stays after it.
     {
         let d = h.state_mut().field_props.as_mut().unwrap();
@@ -1028,9 +1028,7 @@ fn escape_in_a_name_field_leaves_the_field_not_the_table() {
     let mut h = harness();
     draw_table(&mut h);
     // The app's own text boxes (zoom, page number) are inputs too: take the one in the window.
-    let window = h.get_by_label("Text Field Table").rect();
-    let field =
-        h.query_all(by().role(Role::TextInput)).map(|n| n.rect()).find(|r| window.contains(r.center())).expect("the first column's name field");
+    let field = h.get_by_role_and_label(Role::TextInput, "Column 1").rect();
     h.hover_at(field.center());
     h.drag_at(field.center());
     h.run_steps(1);
diff --git a/crates/ui-egui/tests/it/print.rs b/crates/ui-egui/tests/it/print.rs
index 21aeca1286..81025e756f 100644
--- a/crates/ui-egui/tests/it/print.rs
+++ b/crates/ui-egui/tests/it/print.rs
@@ -23,6 +23,15 @@ fn harness_with_settings(settings: Option<String>) -> Harness<'static, PdfCraftA
     h
 }
 
+/// The page-range field is labelled by the Pages radio button rather than floating unnamed.
+#[test]
+fn the_page_range_field_is_named_for_screen_readers() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("print.dialog"));
+    h.run_steps(3);
+    h.get_by_role_and_label(Role::TextInput, "Pages");
+}
+
 #[test]
 fn current_print_page_saves_the_viewed_page_when_labels_restart() {
     // Five distinct painted pages, labelled i, ii, iii, 1, 2.
@@ -62,7 +71,7 @@ fn current_print_page_saves_the_viewed_page_when_labels_restart() {
         h.run_steps(3);
         assert!(h.state_mut().execute("print.dialog"));
         h.run_steps(3);
-        h.get_by_label("Current page").click();
+        h.get_by_role_and_label(Role::RadioButton, "Current page").click();
         h.run_steps(3);
         assert_eq!(h.state().print_draft.current_page, current);
         h.get_by_label("Sheet 1 of 1");
@@ -278,8 +287,8 @@ fn printers_listed_in_the_background_preselect_the_default_unless_one_was_picked
     h.state_mut().printer_source = Some(Arc::new(move || {
         let _open = wait.lock();
         vec![
-            Printer { name: "Office".into(), default: false, two_sided: None },
-            Printer { name: "Front Desk".into(), default: true, two_sided: None },
+            Printer { name: "Office".into(), default: false, two_sided: None, description: String::new() },
+            Printer { name: "Front Desk".into(), default: true, two_sided: None, description: String::new() },
         ]
     }));
     assert!(h.state_mut().execute("print.dialog"));
@@ -335,7 +344,10 @@ fn the_picked_printer_is_kept_for_the_next_print_while_it_is_listed() {
     let source = listed.clone();
     h.state_mut().printer_source = Some(Arc::new(move || {
         let names = source.lock().map(|n| n.clone()).unwrap_or_default();
-        names.into_iter().map(|name| Printer { name: name.into(), default: name == "Front Desk", two_sided: None }).collect()
+        names
+            .into_iter()
+            .map(|name| Printer { name: name.into(), default: name == "Front Desk", two_sided: None, description: String::new() })
+            .collect()
     }));
     let open = |h: &mut Harness<'static, PdfCraftApp>| {
         h.state_mut().dialog = None;
@@ -422,8 +434,8 @@ fn a_printer_without_two_sided_printing_points_to_its_properties() {
     let mut h = harness();
     h.state_mut().printer_source = Some(std::sync::Arc::new(|| {
         vec![
-            Printer { name: "Office PCL".into(), default: true, two_sided: Some(true) },
-            Printer { name: "Office PS".into(), default: false, two_sided: Some(false) },
+            Printer { name: "Office PCL".into(), default: true, two_sided: Some(true), description: String::new() },
+            Printer { name: "Office PS".into(), default: false, two_sided: Some(false), description: String::new() },
         ]
     }));
     assert!(h.state_mut().execute("print.dialog"));
@@ -885,10 +897,10 @@ fn a_booklet_decides_two_sided_itself() {
     h.run_steps(3);
     h.state_mut().print_draft.duplex = Some(Duplex::LongEdge);
     h.run_steps(1);
-    assert!(h.query_by_label("Two-sided:").is_some());
+    assert!(h.query_by_role_and_label(Role::ComboBox, "Two-sided:").is_some());
     h.get_by_label("Booklet").click();
     h.run_steps(2);
-    assert!(h.query_by_label("Two-sided:").is_none(), "hidden while Booklet is chosen");
+    assert!(h.query_by_role_and_label(Role::ComboBox, "Two-sided:").is_none(), "hidden while Booklet is chosen");
     let d = &h.state().print_draft;
     assert_eq!(d.duplex, Some(Duplex::LongEdge), "the Two-sided choice is kept");
     assert_eq!(d.job("x").duplex, Some(Duplex::ShortEdge), "both sides flip on the short edge");
@@ -898,6 +910,6 @@ fn a_booklet_decides_two_sided_itself() {
     }
     h.get_by_label("Size").click();
     h.run_steps(2);
-    assert!(h.query_by_label("Two-sided:").is_some());
+    assert!(h.query_by_role_and_label(Role::ComboBox, "Two-sided:").is_some());
     assert_eq!(h.state().print_draft.job("x").duplex, Some(Duplex::LongEdge), "back to the choice");
 }
diff --git a/crates/ui-egui/tests/it/recovery.rs b/crates/ui-egui/tests/it/recovery.rs
index 3e3f3a593c..2d8258eeda 100644
--- a/crates/ui-egui/tests/it/recovery.rs
+++ b/crates/ui-egui/tests/it/recovery.rs
@@ -173,6 +173,8 @@ fn encrypted(bytes: Vec<u8>, password: &str) -> Vec<u8> {
     pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
 }
 
+/// Check that an encrypted document is autosaved without plaintext and recovered only after the password is
+/// entered.
 #[test]
 fn encrypted_documents_are_autosaved_encrypted_and_recovered_with_the_password() {
     let bytes = encrypted(fixture(2), "pw");
@@ -186,6 +188,13 @@ fn encrypted_documents_are_autosaved_encrypted_and_recovered_with_the_password()
     h.get_by_label_contains("password-protected");
     h.get_by_label("Recover").click();
     support::wait_until(&mut h, "recovery password prompt", |app| app.password_prompt.is_some());
+    // The prompt is laid out in the pass after the one that set it.
+    for _ in 0..10 {
+        if h.query_by_role(Role::PasswordInput).is_some() {
+            break;
+        }
+        h.run_steps(1);
+    }
     let field = h.get_by_role(Role::PasswordInput);
     field.focus();
     field.type_text("pw");
@@ -320,6 +329,8 @@ fn missing_corrupt_or_mismatched_metadata_recovers_the_snapshot_without_an_origi
     }
 }
 
+/// Check that an encrypted snapshot without metadata still asks for its password and is recovered without
+/// rewriting its bytes.
 #[test]
 fn an_encrypted_snapshot_without_metadata_still_requires_its_password() {
     let s = store("encrypted-orphan");
@@ -330,6 +341,12 @@ fn an_encrypted_snapshot_without_metadata_still_requires_its_password() {
     let mut h = harness(s.clone());
     h.get_by_label("Recover").click();
     support::wait_until(&mut h, "orphan recovery password prompt", |app| app.password_prompt.is_some());
+    for _ in 0..10 {
+        if h.query_by_role(Role::PasswordInput).is_some() {
+            break;
+        }
+        h.run_steps(1);
+    }
     assert!(h.state().views.is_empty());
     let field = h.get_by_role(Role::PasswordInput);
     field.focus();
diff --git a/crates/ui-egui/tests/it/side_panels.rs b/crates/ui-egui/tests/it/side_panels.rs
new file mode 100644
index 0000000000..2436d41b61
--- /dev/null
+++ b/crates/ui-egui/tests/it/side_panels.rs
@@ -0,0 +1,133 @@
+//! Side panels: the Tools pane, the rail and the open side panel.
+
+use egui::accesskit::Role;
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+const FIXTURE: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 400] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+const WIDTH: f32 = 1400.0;
+const NO_BOOKMARKS: &str = "This document has no bookmarks.";
+
+fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(WIDTH, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, FIXTURE.to_vec()).unwrap();
+        setup(&mut app);
+        app
+    });
+    h.run_steps(6);
+    h
+}
+
+fn rail(h: &Harness<'static, PdfCraftApp>) -> egui::Rect {
+    h.get_by_role_and_label(Role::Button, "Bookmarks").rect()
+}
+
+fn side(h: &Harness<'static, PdfCraftApp>) -> egui::Rect {
+    h.get_by_label(NO_BOOKMARKS).rect()
+}
+
+/// The Tools pane's All tools header button.
+fn tools(h: &Harness<'static, PdfCraftApp>) -> egui::Rect {
+    h.get_by_label("Expand all tools").rect()
+}
+
+#[test]
+fn rail_is_outermost_then_tools_then_the_side_panel_then_the_page() {
+    // Tools on the left: the page between Tools and the side panel, the rail at the right edge.
+    let h = harness(|app| app.set_option("panel", "bookmarks").unwrap());
+    let (r, s, t) = (rail(&h), side(&h), tools(&h));
+    assert!(r.right() > WIDTH - 12.0, "{r:?}");
+    assert!(s.right() < r.left() && s.left() > WIDTH - 48.0 - 340.0, "{s:?} {r:?}");
+    assert!(t.left() < 48.0, "{t:?}");
+    // Tools on the right: rail, Tools, side panel, page.
+    let h = harness(|app| {
+        app.set_option("tools-side", "right").unwrap();
+        app.set_option("panel", "bookmarks").unwrap();
+    });
+    let (r, s, t) = (rail(&h), side(&h), tools(&h));
+    assert!(r.right() > WIDTH - 12.0, "{r:?}");
+    assert!(t.right() < r.left() && t.left() > WIDTH - 48.0 - 280.0, "{t:?} {r:?}");
+    assert!(s.right() < t.left() && s.left() > WIDTH - 48.0 - 280.0 - 340.0, "{s:?} {t:?}");
+}
+
+#[test]
+fn read_mode_shows_the_side_panel_without_tools() {
+    let mut h = harness(|app| app.set_option("panel", "bookmarks").unwrap());
+    h.state_mut().set_option("mode", "read").unwrap();
+    h.run_steps(4);
+    assert!(h.query_by_label("Expand all tools").is_none());
+    assert!(side(&h).right() < rail(&h).left() && side(&h).left() > WIDTH / 2.0);
+    // The rail closes and opens it there too.
+    h.get_by_role_and_label(Role::Button, "Bookmarks").click();
+    h.run_steps(4);
+    assert!(h.query_by_label(NO_BOOKMARKS).is_none());
+    h.get_by_role_and_label(Role::Button, "Bookmarks").click();
+    h.run_steps(4);
+    assert!(side(&h).right() < rail(&h).left());
+}
+
+#[test]
+fn a_dragged_width_is_remembered_across_restarts() {
+    let mut h = harness(|app| app.set_option("panel", "bookmarks").unwrap());
+    let before = h.state().side_panels.side_width;
+    let side_left = side(&h).left();
+    // The side panel's resize edge: the one right of the page, left of the panel's text.
+    let edge = h
+        .get_all_by_label("Resize panels")
+        .map(|n| n.rect().center())
+        .filter(|c| c.x < side_left && c.x > WIDTH / 2.0)
+        .min_by(|a, b| (side_left - a.x).total_cmp(&(side_left - b.x)))
+        .expect("the side panel has a resize edge")
+        // The pane's half of the edge: the page, drawn after the panes, takes the other half.
+        + egui::vec2(2.0, 0.0);
+    h.hover_at(edge);
+    h.run_steps(1);
+    h.drag_at(edge);
+    h.run_steps(1);
+    for i in 1..=4 {
+        h.hover_at(edge - egui::vec2(10.0 * i as f32, 0.0));
+        h.run_steps(1);
+    }
+    h.drop_at(edge - egui::vec2(40.0, 0.0));
+    h.run_steps(3);
+    let after = h.state().side_panels.side_width;
+    // The pointer was pressed 2 pt inside the panel, and the edge follows the pointer.
+    assert!((after - (before + 40.0 - 2.0)).abs() <= 1.0, "{before} -> {after}");
+    let saved = h.state().persist();
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&saved);
+    assert_eq!(restored.side_panels.side_width, after);
+}
+
+#[test]
+fn f4_toggles_the_side_panel_and_shift_f4_the_tools_panel() {
+    let mut h = harness(|app| app.set_option("panel", "bookmarks").unwrap());
+    h.get_by_label(NO_BOOKMARKS);
+    h.key_press(egui::Key::F4);
+    h.run_steps(3);
+    assert_eq!(h.state().right, None);
+    assert!(h.query_by_label(NO_BOOKMARKS).is_none());
+    // F4 again reopens the panel that was open, not the default.
+    h.key_press(egui::Key::F4);
+    h.run_steps(3);
+    h.get_by_label(NO_BOOKMARKS);
+    assert!(h.state().left_open);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::F4);
+    h.run_steps(3);
+    assert!(!h.state().left_open);
+    assert!(h.query_by_label("Expand all tools").is_none());
+    // Shift+F4 leaves the side panel alone.
+    h.get_by_label(NO_BOOKMARKS);
+    h.key_press_modifiers(egui::Modifiers::SHIFT, egui::Key::F4);
+    h.run_steps(3);
+    h.get_by_label("Expand all tools");
+}
diff --git a/crates/ui-egui/tests/it/signing.rs b/crates/ui-egui/tests/it/signing.rs
index 0050f82b19..62d97d4e58 100644
--- a/crates/ui-egui/tests/it/signing.rs
+++ b/crates/ui-egui/tests/it/signing.rs
@@ -1,5 +1,6 @@
 //! Use a certificate in the real shell: draw a signature, create a digital ID, sign, validate.
 
+use crate::support;
 use egui::{Pos2, pos2};
 use egui_kittest::Harness;
 use egui_kittest::kittest::{NodeT, Queryable};
@@ -128,14 +129,14 @@ fn drawing_a_signature_creating_an_id_signing_and_trusting() {
     field(&h, "Digital ID password").click();
     h.run_steps(1);
     field(&h, "Digital ID password").type_text("nope");
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(3);
     h.get_by_label("The password is incorrect.");
     h.state_mut().sign_draft.as_mut().unwrap().password = "secret12".into();
     field(&h, "Reason").click();
     h.run_steps(1);
     field(&h, "Reason").type_text("I approve");
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(6);
 
     let s = h.state();
@@ -275,7 +276,7 @@ fn certifying_without_a_visible_signature() {
     h.get_by_label("Certify as \"Test Signer EC\"");
     h.get_by_label("Permitted actions after certifying");
     h.state_mut().sign_draft.as_mut().unwrap().password = "test".into();
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(6);
     let s = h.state();
     assert_eq!(s.sign_draft.as_ref().and_then(|d| d.error.clone()), None);
@@ -361,7 +362,7 @@ fn clicking_an_empty_signature_field_signs_it() {
         d.password = "test".into();
     }
     h.run_steps(2);
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(6);
     let s = h.state();
     let sig = s.session.get(s.views[1].id).unwrap().signatures.iter().find(|x| x.field == "Approver").cloned().unwrap();
@@ -398,7 +399,7 @@ fn the_fill_and_sign_signature_or_an_image_shows_in_a_digital_signature() {
     h.get_by_label("Fill & Sign signature").click();
     h.run_steps(2);
     assert_eq!(h.state().sign_draft.as_ref().unwrap().graphic, SignGraphic::FillSign);
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(6);
     let s = h.state();
     assert_eq!(s.sign_draft.as_ref().and_then(|d| d.error.clone()), None);
@@ -418,7 +419,7 @@ fn the_fill_and_sign_signature_or_an_image_shows_in_a_digital_signature() {
     h.state_mut().sign_draft.as_mut().unwrap().graphic = SignGraphic::Image(image.clone());
     h.run_steps(2);
     h.get_by_label("Choose image…");
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(6);
     let s = h.state();
     assert_eq!(s.sign_draft.as_ref().and_then(|d| d.error.clone()), None);
@@ -534,7 +535,7 @@ fn windows_store_identity_does_not_ask_for_a_file_password() {
     h.get_by_label("Sign as \"Store signer\"");
     assert_eq!(h.query_all_by_label("Digital ID password").count(), 0);
     h.get_by_label("The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.");
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(3);
     assert_eq!(h.state().dialog, Some(Dialog::Sign));
     assert!(h.state().sign_draft.as_ref().unwrap().error.as_ref().unwrap().contains("Windows certificate store"));
@@ -679,7 +680,7 @@ fn signing_preserves_destination_opening_attributes() {
     let d = h.state_mut().sign_draft.as_mut().unwrap();
     (d.selected, d.step, d.password) = (Some(entry), SignStep::SignAs, "test".into());
     h.run_steps(2);
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(6);
     assert!(h.state().session.get(h.state().views[0].id).unwrap().signatures.iter().any(|s| s.signed));
     assert_eq!(xattr::get(&dest, "com.apple.LaunchServices.OpenWith").unwrap(), Some(b"existing binding".to_vec()));
diff --git a/crates/ui-egui/tests/it/support/input.rs b/crates/ui-egui/tests/it/support/input.rs
new file mode 100644
index 0000000000..0030c463d4
--- /dev/null
+++ b/crates/ui-egui/tests/it/support/input.rs
@@ -0,0 +1,65 @@
+//! Pointer input in the frames the platform delivers it in.
+//!
+//! `Harness::step` runs one frame for every queued event, each 0.25 s after the last, so input
+//! sent through `Harness::event` (or `drag_at` and `drop_at`) never shares a frame. Real input
+//! does: egui-winit turns each touch (and on Windows each pen stroke, which winit reports as
+//! touch) into a `Touch` event plus pointer events in one frame, and sends `PointerGone` with
+//! every release, so `hover_pos()` is `None` on the frame egui reports the tap. A slow frame
+//! can also hold a whole click. These helpers push each frame's events into
+//! `Harness::input_mut` and step once.
+use egui::{Event, Modifiers, PointerButton, Pos2, TouchDeviceId, TouchId, TouchPhase};
+use egui_kittest::Harness;
+
+/// Runs one frame with all of `events` in it, in order.
+pub fn one_frame<S>(h: &mut Harness<'_, S>, events: impl IntoIterator<Item = Event>) {
+    h.input_mut().events.extend(events);
+    h.step();
+}
+
+fn button(pos: Pos2, pressed: bool) -> Event {
+    Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE }
+}
+
+fn touch(phase: TouchPhase, pos: Pos2) -> Event {
+    Event::Touch { device_id: TouchDeviceId(1), id: TouchId(1), phase, pos, force: None }
+}
+
+/// A finger tap at `p`, or a pen tap on Windows: the touch starts (touch, move, press in one
+/// frame), and a frame later it ends (touch, release, `PointerGone` in one frame).
+pub fn touch_tap<S>(h: &mut Harness<'_, S>, p: Pos2) {
+    one_frame(h, [touch(TouchPhase::Start, p), Event::PointerMoved(p), button(p, true)]);
+    h.run_steps(1);
+    one_frame(h, [touch(TouchPhase::End, p), button(p, false), Event::PointerGone]);
+    h.run_steps(4);
+}
+
+/// A finger drag from `a` to `b` in six moves, one frame each, ending as a touch does: release
+/// and `PointerGone` in one frame.
+pub fn touch_drag<S>(h: &mut Harness<'_, S>, a: Pos2, b: Pos2) {
+    one_frame(h, [touch(TouchPhase::Start, a), Event::PointerMoved(a), button(a, true)]);
+    for i in 1..=6 {
+        let p = a + (b - a) * (i as f32 / 6.0);
+        one_frame(h, [touch(TouchPhase::Move, p), Event::PointerMoved(p)]);
+    }
+    one_frame(h, [touch(TouchPhase::End, b), button(b, false), Event::PointerGone]);
+    h.run_steps(4);
+}
+
+/// A mouse click at `p` whose press and release land in one slow frame (#2100).
+pub fn coalesced_click<S>(h: &mut Harness<'_, S>, p: Pos2) {
+    h.hover_at(p);
+    h.run_steps(2);
+    one_frame(h, [button(p, true), button(p, false)]);
+    h.run_steps(4);
+}
+
+/// A double-click at `p`: two clicks, each a press and release in one frame, in consecutive
+/// frames (0.25 s apart, within egui's 0.3 s double-click delay).
+pub fn double_click<S>(h: &mut Harness<'_, S>, p: Pos2) {
+    h.hover_at(p);
+    h.run_steps(1);
+    for _ in 0..2 {
+        one_frame(h, [button(p, true), button(p, false)]);
+    }
+    h.run_steps(2);
+}
diff --git a/crates/ui-egui/tests/it/support/mod.rs b/crates/ui-egui/tests/it/support/mod.rs
index 2e1e11ffb2..f419bb3296 100644
--- a/crates/ui-egui/tests/it/support/mod.rs
+++ b/crates/ui-egui/tests/it/support/mod.rs
@@ -1,6 +1,14 @@
-//! State-based waits for native preparation, which completes between UI frames.
+//! State-based waits for native preparation, which completes between UI frames, and pointer
+//! input in the frames the platform delivers it in ([`input`]), and the skip for tests whose text
+//! the interface fonts cannot draw ([`skip_without_glyphs`]).
+use std::collections::BTreeSet;
+
+use egui::FontId;
+use egui::epaint::text::{Fonts, TextOptions};
 use egui_kittest::Harness;
-use pdfcraft_ui_egui::PdfCraftApp;
+use pdfcraft_ui_egui::{PdfCraftApp, i18n, theme};
+
+pub mod input;
 
 /// Step frames until `ready` holds or 30 seconds pass, and say whether it held. For background work
 /// (a worker-thread open, page text arriving) that a test then asserts on itself: a frame count is
@@ -42,3 +50,56 @@ pub fn wait_until(h: &mut Harness<'static, PdfCraftApp>, what: &str, ready: impl
         h.state().toast
     );
 }
+
+/// Open the in-window menu bar's `title` menu (File, Edit, View…).
+pub fn open_menu(h: &mut Harness<'static, PdfCraftApp>, title: &str) {
+    use egui_kittest::kittest::Queryable;
+    h.get_by(|n| n.role() == egui::accesskit::Role::MenuItem && n.label().as_deref() == Some(title)).click();
+    h.run_steps(2);
+}
+
+/// The menu row labelled `label` in an open menu.
+pub fn menu_row<'h>(h: &'h Harness<'static, PdfCraftApp>, label: &str) -> egui_kittest::Node<'h> {
+    use egui_kittest::kittest::Queryable;
+    let label = label.to_owned();
+    h.get_by(move |n| n.role() == egui::accesskit::Role::MenuItem && n.label().as_deref() == Some(label.as_str()))
+}
+
+/// The widget labelled `label` outside the menu bar, whose titles (File, Edit, Sign…) may share it.
+pub fn outside_menus<'h>(h: &'h Harness<'static, PdfCraftApp>, label: &str) -> egui_kittest::Node<'h> {
+    use egui_kittest::kittest::Queryable;
+    let label = label.to_owned();
+    h.get_by(move |n| n.role() != egui::accesskit::Role::MenuItem && n.label().as_deref() == Some(label.as_str()))
+}
+
+/// Whether the test `name` must skip because the interface fonts lack a glyph for a character it
+/// draws: one in `text` or in the catalog of the interface `language`. egui 0.37 test harnesses
+/// panic on a missing glyph, and Japanese, Chinese and Thai faces come only from the optional
+/// craft-fonts build input or a face installed on this machine. Prints the skip line.
+///
+/// The fonts are those the app installs for `language` and for the default CJK preference: a
+/// switch to Chinese installs its fonts for the next frame, so the first frame in Chinese draws
+/// with the fonts of the language before it.
+///
+/// A build that requires craft-fonts (`CRAFT_FONTS_REQUIRED=1`, as the CI gate sets) never skips:
+/// a missing glyph there is a failure.
+pub fn skip_without_glyphs(name: &str, language: &str, text: &str) -> bool {
+    if std::env::var("CRAFT_FONTS_REQUIRED").as_deref() == Ok("1") {
+        return false;
+    }
+    let catalog = i18n::LANGUAGES.iter().find(|l| l.code == language).map_or("", |l| l.source);
+    let translations = catalog.lines().filter(|l| !l.starts_with('#')).filter_map(|l| l.split('\t').nth(2));
+    let chars: BTreeSet<char> = std::iter::once(text).chain(translations).flat_map(str::chars).filter(|c| !c.is_control()).collect();
+    let cjk = theme::CjkPreference::for_language(language);
+    let missing = [theme::CjkPreference::Default, cjk].into_iter().find_map(|cjk| {
+        let defs = theme::installed_font_definitions(cjk);
+        let families: Vec<FontId> = defs.families.keys().map(|f| FontId::new(13.0, f.clone())).collect();
+        let mut fonts = Fonts::new(TextOptions::default(), defs);
+        chars.iter().copied().find(|c| families.iter().any(|id| !fonts.has_glyphs(id, &c.to_string())))
+    });
+    let Some(missing) = missing else {
+        return false;
+    };
+    eprintln!("skipping {name}: no interface font draws {missing:?} (set CRAFT_FONTS_DIR to a craft-fonts checkout with a face for it)");
+    true
+}
diff --git a/crates/ui-egui/tests/it/text_select.rs b/crates/ui-egui/tests/it/text_select.rs
index 2b63044160..e480f1c598 100644
--- a/crates/ui-egui/tests/it/text_select.rs
+++ b/crates/ui-egui/tests/it/text_select.rs
@@ -189,6 +189,7 @@ fn copied(h: &Harness<'static, PdfCraftApp>, want: &str) -> bool {
     h.output().platform_output.commands.iter().any(|c| matches!(c, egui::OutputCommand::CopyText(t) if t == want))
 }
 
+/// Check that both the Edit menu and the context menu copy the selected page text.
 #[test]
 fn selected_text_copy_edit_and_context_menus() {
     use egui_kittest::kittest::Queryable;
@@ -197,11 +198,8 @@ fn selected_text_copy_edit_and_context_menus() {
     click(&mut h, at);
     h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Hand;
     h.run_steps(2); // Hide floating Copy so this test can only reach menu entries.
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("Edit ⏵").hover();
-    h.run_steps(3);
-    h.get_by_label_contains("Copy").click();
+    crate::support::open_menu(&mut h, "Edit");
+    crate::support::menu_row(&h, "Copy").click();
     let mut did_copy = false;
     for _ in 0..4 {
         h.step();
@@ -228,15 +226,13 @@ fn selected_text_copy_edit_and_context_menus() {
 
 #[test]
 fn escape_closes_an_open_menu_before_it_clears_the_selection() {
-    // #3535: one Escape closed the main menu and dropped the selection with it.
-    use egui_kittest::kittest::Queryable;
+    // #3535: one Escape closed the menu and dropped the selection with it.
     let (mut h, at) = harness(|_| {});
     click(&mut h, at);
     click(&mut h, at);
     h.run_steps(2);
     assert_eq!(h.state().views[0].selected_text().as_deref(), Some("quick"));
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
+    crate::support::open_menu(&mut h, "View");
     assert!(egui::Popup::is_any_open(&h.ctx), "the menu is open");
     h.key_press(egui::Key::Escape);
     h.run_steps(2);
@@ -336,6 +332,7 @@ fn selected_text_copy_preserves_unicode_and_page_clipboard() {
     assert_eq!(h.state().page_clipboard.as_ref().map(|c| c.pages.clone()), Some(vec![0]));
 }
 
+/// Check that a focused search input owns Copy and the selected page text does not also consume it.
 #[test]
 fn selected_text_copy_keeps_focused_input_clipboard_ownership() {
     let (mut h, at) = harness(|_| {});
@@ -344,7 +341,7 @@ fn selected_text_copy_keeps_focused_input_clipboard_ownership() {
     h.state_mut().views[0].open_find();
     h.state_mut().views[0].find.as_mut().unwrap().query = "widget café".into();
     h.run_steps(3);
-    h.ctx.memory_mut(|m| m.request_focus(egui::Id::new("find-input")));
+    h.ctx.memory_mut(|m| m.request_focus(egui::Id::unique("find-input")));
     h.run_steps(2);
     h.key_press_modifiers(Modifiers::COMMAND, egui::Key::A);
     h.run_steps(2);
@@ -394,7 +391,13 @@ fn press_and_move(h: &mut Harness<'static, PdfCraftApp>, from: Pos2, to: Pos2) {
 
 /// One wheel event, with time to scroll (egui spreads a wheel line over a few frames).
 fn wheel(h: &mut Harness<'static, PdfCraftApp>, unit: MouseWheelUnit, dy: f32) {
-    h.event(Event::MouseWheel { unit, delta: egui::vec2(0.0, dy), phase: TouchPhase::Move, modifiers: Modifiers::NONE });
+    h.event(Event::MouseWheel {
+        unit,
+        delta: egui::vec2(0.0, dy),
+        phase: TouchPhase::Move,
+        modifiers: Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
     h.run_steps(10);
 }
 
diff --git a/crates/ui-egui/tests/it/theme.rs b/crates/ui-egui/tests/it/theme.rs
index 1559838dd0..a02c5c05ca 100644
--- a/crates/ui-egui/tests/it/theme.rs
+++ b/crates/ui-egui/tests/it/theme.rs
@@ -36,12 +36,9 @@ fn click_toolbar(h: &mut Harness<'static, PdfCraftApp>, label: &str) {
 }
 
 fn open_view_menu(h: &mut Harness<'static, PdfCraftApp>) {
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("View ⏵").hover();
-    h.run_steps(3);
+    crate::support::open_menu(h, "View");
     assert!(h.query_by_label("Switch light / dark theme").is_none());
-    h.get_by_label("Display theme ⏵").hover();
+    crate::support::menu_row(h, "Display theme").hover();
     h.run_steps(3);
     for choice in ["Use system setting", "Light gray", "Dark gray"] {
         h.get_by_label(choice);
diff --git a/crates/ui-egui/tests/it/trust_signer.rs b/crates/ui-egui/tests/it/trust_signer.rs
index 27bd2f3c9e..c7a2ad739f 100644
--- a/crates/ui-egui/tests/it/trust_signer.rs
+++ b/crates/ui-egui/tests/it/trust_signer.rs
@@ -3,6 +3,7 @@
 //! certificate whose CMS carries its issuer chain gives a signature whose `chain.last()` (the
 //! self-signed root) differs from its `certificate` (the signer); the click must trust the signer.
 
+use crate::support;
 use egui_kittest::Harness;
 use egui_kittest::kittest::Queryable;
 use pdfcraft_engine::SignatureStatus;
@@ -58,7 +59,7 @@ fn one_click_trust_stores_the_displayed_signer_not_the_embedded_root() {
         d.password = "test".into();
     }
     h.run_steps(2);
-    h.get_by_label("Sign").click();
+    support::outside_menus(&h, "Sign").click();
     h.run_steps(6);
 
     // The signature validates as Unknown and carries a two-certificate chain whose top (the root)
diff --git a/crates/ui-egui/tests/it/ui.rs b/crates/ui-egui/tests/it/ui.rs
index c15a5c869b..cd5ce8dbb1 100644
--- a/crates/ui-egui/tests/it/ui.rs
+++ b/crates/ui-egui/tests/it/ui.rs
@@ -49,14 +49,14 @@ fn tools_panel_side_preference_moves_and_persists() {
     h.get_by_label("Tools panel side");
     h.get_by_label("Right").click();
     h.run_steps(3);
-    assert!(h.state().docking.tools_on_right());
+    assert!(h.state().side_panels.tools_on_right());
     let saved = h.state().persist();
     let mut restored = PdfCraftApp::new();
     restored.restore(&saved);
-    assert!(restored.docking.tools_on_right());
+    assert!(restored.side_panels.tools_on_right());
     h.get_by_label("Left").click();
     h.run_steps(3);
-    assert!(!h.state().docking.tools_on_right());
+    assert!(!h.state().side_panels.tools_on_right());
 }
 
 /// Every piece of text painted on the last frame: its whole text, whether it was cut with "…",
@@ -125,6 +125,170 @@ fn every_catalog_tool_is_listed_after_view_more() {
     }
 }
 
+#[test]
+fn expanded_all_tools_lists_every_tool_by_category_and_searches() {
+    let mut h = harness(|_| {});
+    h.get_by_label("Expand all tools").click();
+    h.run_steps(3);
+    assert!(h.state().all_tools_full);
+    for c in pdfcraft_engine::catalog::TOOL_CATEGORIES {
+        h.get_by_label(c.label);
+    }
+    for g in pdfcraft_engine::catalog::TOOL_GROUPS {
+        assert!(h.query_all_by_label(g.label).count() >= 1, "tool {} missing from the expanded view", g.label);
+    }
+    // An item name finds its tool; the other categories drop out.
+    h.state_mut().all_tools_query = "rotate".into();
+    h.run_steps(3);
+    assert_eq!(h.query_all_by_label("Organize pages").count(), 1, "only the expanded view's tile; the sidebar is gone");
+    assert!(h.query_by_label("Forms & Signatures").is_none());
+    h.state_mut().all_tools_query = "no such tool".into();
+    h.run_steps(3);
+    h.get_by_label("No tools match your search.");
+    // Choosing a tool goes back to the workspace with that tool's panel.
+    h.state_mut().all_tools_query = "organize".into();
+    h.run_steps(3);
+    h.get_by_label("Organize pages").click();
+    h.run_steps(3);
+    assert!(!h.state().all_tools_full);
+    assert_eq!(h.state().left, pdfcraft_ui_egui::LeftPanel::Tool("organize"));
+    h.get_by_label("Back to all tools");
+}
+
+#[test]
+fn collapse_and_escape_close_the_expanded_all_tools() {
+    let mut h = harness(|app| app.set_option("tools", "full").unwrap());
+    h.get_by_label("Collapse all tools").click();
+    h.run_steps(3);
+    assert!(!h.state().all_tools_full);
+    h.get_by_label("View more");
+    h.get_by_label("Expand all tools").click();
+    h.run_steps(3);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    assert!(!h.state().all_tools_full);
+}
+
+#[test]
+fn escape_in_a_dialog_over_the_expanded_all_tools_leaves_the_view_open() {
+    let mut h = harness(|app| app.set_option("tools", "full").unwrap());
+    h.state_mut().dialog = Some(pdfcraft_ui_egui::Dialog::About);
+    h.run_steps(3);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    assert!(h.state().all_tools_full, "Escape belonged to the dialog");
+}
+
+#[test]
+fn escape_in_the_command_palette_over_the_expanded_all_tools_leaves_the_view_open() {
+    let mut h = harness(|app| app.set_option("tools", "full").unwrap());
+    h.state_mut().palette_open = true;
+    h.run_steps(3);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    assert!(!h.state().palette_open, "Escape closed the palette");
+    assert!(h.state().all_tools_full, "and only the palette");
+}
+
+#[test]
+fn another_workspace_from_the_mode_option_puts_the_expanded_all_tools_away() {
+    let mut app = PdfCraftApp::new();
+    app.set_option("tools", "full").unwrap();
+    app.set_option("mode", "all").unwrap();
+    assert!(app.all_tools_full, "All tools itself keeps the view");
+    app.set_option("mode", "read").unwrap();
+    app.set_option("mode", "all").unwrap();
+    assert!(!app.all_tools_full, "coming back shows the sidebar, as the mode bar does");
+}
+
+#[test]
+fn opening_a_document_puts_the_expanded_all_tools_away() {
+    use pdfcraft_ui_egui::Mode;
+    // All tools as the default workspace: no workspace change, but the document must show.
+    let mut app = PdfCraftApp::new();
+    app.set_option("tools", "full").unwrap();
+    app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens");
+    assert!(!app.all_tools_full, "the document shows, not the catalogue over it");
+    // Read as the default workspace: coming back to All tools later shows the sidebar.
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-mode", "read").unwrap();
+    app.set_option("tools", "full").unwrap();
+    app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens");
+    assert_eq!(app.mode, Mode::Read);
+    assert!(!app.all_tools_full);
+}
+
+#[test]
+fn choosing_a_tool_puts_the_expanded_all_tools_away() {
+    use pdfcraft_ui_egui::LeftPanel;
+    let mut h = harness(|app| app.set_option("tools", "full").unwrap());
+    h.state_mut().set_option("tool", "organize").unwrap();
+    h.run_steps(3);
+    assert!(!h.state().all_tools_full, "the tool's panel shows, not the catalogue");
+    assert_eq!(h.state().left, LeftPanel::Tool("organize"));
+}
+
+#[test]
+fn another_tab_coming_forward_puts_the_expanded_all_tools_away() {
+    // Home, through the control option.
+    let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
+    h.state_mut().set_option("tools", "full").unwrap();
+    h.run_steps(3);
+    assert!(h.state().all_tools_full, "the document's own tab keeps it");
+    h.state_mut().set_option("home", "").unwrap();
+    h.run_steps(3);
+    assert!(!h.state().all_tools_full);
+    h.get_by_label_contains("Welcome to PdfCraft");
+    // Another document's tab.
+    let mut h = harness(|app| {
+        app.open_bytes("one.pdf", None, FIXTURE.to_vec()).expect("fixture opens");
+        app.open_bytes("two.pdf", None, FIXTURE.to_vec()).expect("fixture opens");
+    });
+    h.state_mut().set_option("tools", "full").unwrap();
+    h.run_steps(3);
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    assert!(!h.state().all_tools_full, "one.pdf shows, not the catalogue over it");
+}
+
+#[test]
+fn going_home_with_no_document_puts_the_expanded_all_tools_away() {
+    // Home is already the tab in front, so only the option itself can put the view away.
+    let mut h = harness(|app| app.set_option("tools", "full").unwrap());
+    h.state_mut().set_option("home", "").unwrap();
+    h.run_steps(3);
+    assert!(!h.state().all_tools_full);
+    h.get_by_label_contains("Welcome to PdfCraft");
+}
+
+#[test]
+fn expanding_all_tools_from_read_mode_restores_the_right_panel() {
+    use pdfcraft_ui_egui::{Mode, RightPanel};
+    let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
+    h.state_mut().right = Some(RightPanel::Bookmarks);
+    h.state_mut().execute("view.read_mode");
+    h.run_steps(3);
+    assert_eq!((h.state().mode, h.state().right), (Mode::Read, None), "Read mode hides the panel");
+    h.state_mut().set_option("tools", "full").unwrap();
+    h.run_steps(3);
+    assert!(h.state().all_tools_full);
+    assert_eq!((h.state().mode, h.state().right), (Mode::AllTools, Some(RightPanel::Bookmarks)));
+}
+
+#[test]
+fn expanding_all_tools_from_edit_puts_edit_text_down() {
+    use pdfcraft_ui_egui::{LeftPanel, Mode, QuickTool};
+    let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
+    support::outside_menus(&h, "Edit").click();
+    h.run_steps(3);
+    assert_eq!(h.state().quick_tool, QuickTool::EditText);
+    h.state_mut().set_option("tools", "full").unwrap();
+    h.run_steps(3);
+    assert!(h.state().all_tools_full);
+    assert_eq!((h.state().mode, h.state().quick_tool), (Mode::AllTools, QuickTool::Select));
+    assert_eq!(h.state().left, LeftPanel::AllTools, "collapsing goes back to the All tools list");
+}
+
 #[test]
 fn opening_a_pdf_shows_comments_and_bookmarks() {
     let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
@@ -432,6 +596,7 @@ fn overflowing_tabs_can_be_reached_by_scrolling() {
             delta: egui::vec2(-500.0, 0.0),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
         });
         h.run_steps(8);
     }
@@ -554,6 +719,7 @@ fn narrow_tab_strips_accept_vertical_wheel_scrolling() {
                 delta: egui::vec2(0.0, -500.0),
                 phase: egui::TouchPhase::Move,
                 modifiers: egui::Modifiers::NONE,
+                source: egui::MouseWheelSource::Unknown,
             });
             h.run_steps(8);
         }
@@ -1474,7 +1640,7 @@ fn the_edit_tab_turns_on_edit_text_and_images() {
     use pdfcraft_ui_egui::{Mode, QuickTool};
     let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
     assert_eq!(h.state().quick_tool, QuickTool::Select);
-    h.get_by_label("Edit").click();
+    support::outside_menus(&h, "Edit").click();
     h.run_steps(3);
     assert_eq!(h.state().mode, Mode::Edit);
     assert_eq!(h.state().quick_tool, QuickTool::EditText);
@@ -1483,7 +1649,7 @@ fn the_edit_tab_turns_on_edit_text_and_images() {
     assert_eq!(h.state().mode, Mode::AllTools);
     assert_eq!(h.state().quick_tool, QuickTool::Select);
     // Another tool picked inside Edit is not taken away by leaving it.
-    h.get_by_label("Edit").click();
+    support::outside_menus(&h, "Edit").click();
     h.run_steps(3);
     h.state_mut().quick_tool = QuickTool::Hand;
     h.get_by_label("Convert").click();
@@ -1497,7 +1663,7 @@ fn the_edit_tab_turns_on_edit_text_and_images() {
 fn organize_pages_from_the_edit_panel_opens_its_panel() {
     use pdfcraft_ui_egui::LeftPanel;
     let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
-    h.get_by_label("Edit").click();
+    support::outside_menus(&h, "Edit").click();
     h.run_steps(3);
     assert_eq!(h.state().left, LeftPanel::Tool("edit"));
     assert!(
@@ -1515,7 +1681,7 @@ fn organize_pages_from_the_edit_panel_opens_its_panel() {
 #[test]
 fn the_edit_panel_keeps_the_add_update_remove_menu() {
     let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
-    h.get_by_label("Edit").click();
+    support::outside_menus(&h, "Edit").click();
     h.run_steps(3);
     h.get_by_label("Watermark").click();
     h.run_steps(3);
@@ -1553,6 +1719,7 @@ fn short_window_rail_buttons_scroll_clear_of_page_navigation() {
             delta: egui::vec2(0.0, -200.0),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
         });
         h.run_steps(4);
     }
diff --git a/crates/ui-egui/tests/it/updates.rs b/crates/ui-egui/tests/it/updates.rs
index a8ecb31c56..d2eaa7c660 100644
--- a/crates/ui-egui/tests/it/updates.rs
+++ b/crates/ui-egui/tests/it/updates.rs
@@ -5,18 +5,28 @@ use std::sync::Arc;
 use egui_kittest::Harness;
 use egui_kittest::kittest::Queryable;
 use pdfcraft_ui_egui::PdfCraftApp;
-use pdfcraft_ui_egui::updates::{Release, UpdateSource, is_newer};
+use pdfcraft_ui_egui::updates::UpdateSource;
 
-fn source(answer: Result<&str, &str>) -> UpdateSource {
-    let answer = answer.map(str::to_string).map_err(str::to_string);
-    Arc::new(move || answer.clone().map(|v| Release { url: format!("https://github.com/storytold/pdfcraft/releases/tag/{v}"), version: v }))
+fn release(tag: &str) -> craft_update::Release {
+    craft_update::Release {
+        tag: tag.to_string(),
+        version: craft_update::parse_version(tag),
+        html_url: format!("https://github.com/storytold/pdfcraft/releases/tag/{tag}"),
+        ..Default::default()
+    }
 }
 
-fn harness(answer: Result<&str, &str>) -> Harness<'static, PdfCraftApp> {
+/// `Ok(Some(tag))` is a newer release, `Ok(None)` is up to date.
+fn source(answer: Result<Option<&str>, &str>) -> UpdateSource {
+    let answer = answer.map(|tag| tag.map(release)).map_err(str::to_string);
+    Arc::new(move || answer.clone())
+}
+
+fn harness(answer: Result<Option<&str>, &str>) -> Harness<'static, PdfCraftApp> {
     Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
-        app.update_source = Some(source(answer));
+        app.set_update_source(source(answer));
         app
     })
 }
@@ -37,34 +47,21 @@ fn settle(h: &mut Harness<'static, PdfCraftApp>) {
     h.run_steps(2);
 }
 
-#[test]
-fn versions_compare_by_number() {
-    assert!(is_newer("v0.2.0", "0.1.1"));
-    assert!(is_newer("v0.1.10", "0.1.9"));
-    assert!(is_newer("1", "0.9.9"));
-    assert!(!is_newer("v0.1.1", "0.1.1"));
-    assert!(!is_newer("v0.1.0", "0.1.1"));
-    assert!(!is_newer("v0.1.1-beta.2", "0.1.1"), "suffixes are ignored");
-    assert!(!is_newer("nightly", "0.1.1"), "a tag that isn't a version is never newer");
-    assert!(!is_newer("v1.2.3.4", "0.1.1"));
-    assert!(!is_newer("v99999999999999999999.0.0", "0.1.1"), "out of range");
-}
-
 #[test]
 fn a_newer_release_is_offered_for_download() {
-    let mut h = harness(Ok("v99.0.0"));
+    let mut h = harness(Ok(Some("v99.0.0")));
     h.state_mut().execute("help.check_updates");
     settle(&mut h);
     h.get_by_label_contains("PdfCraft 99.0.0 is available");
-    h.get_by_label("Download");
-    h.get_by_label("Later").click();
+    h.get_by_label("DOWNLOAD");
+    h.get_by_label("LATER").click();
     h.run_steps(3);
     assert!(h.query_by_label_contains("is available").is_none(), "Later closes the dialog");
 }
 
 #[test]
 fn an_up_to_date_or_failed_check_says_so() {
-    let mut h = harness(Ok(concat!("v", env!("CARGO_PKG_VERSION"))));
+    let mut h = harness(Ok(None));
     h.state_mut().execute("help.check_updates");
     settle(&mut h);
     h.get_by_label_contains("is up to date");
@@ -78,7 +75,7 @@ fn an_up_to_date_or_failed_check_says_so() {
 
 #[test]
 fn nothing_is_asked_until_the_user_checks() {
-    // No check at start (the owner's decision): the source is only called from the command.
+    // The check at start is opt-in (the desktop app turns it on): the source is only called from the command.
     let calls = Arc::new(std::sync::atomic::AtomicUsize::new(0));
     let counted = calls.clone();
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
@@ -87,9 +84,9 @@ fn nothing_is_asked_until_the_user_checks() {
         // Settings from a build that had the startup option are ignored.
         app.restore(r#"{"check_updates_at_start": true}"#);
         let counted = counted.clone();
-        app.update_source = Some(Arc::new(move || {
+        app.set_update_source(Arc::new(move || {
             counted.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-            Ok(Release { version: "v99.0.0".into(), url: "https://github.com/storytold/pdfcraft/releases/tag/v99.0.0".into() })
+            Ok(Some(release("v99.0.0")))
         }));
         app
     });
@@ -101,3 +98,23 @@ fn nothing_is_asked_until_the_user_checks() {
     assert_eq!(calls.load(std::sync::atomic::Ordering::SeqCst), 1);
     h.get_by_label_contains("PdfCraft 99.0.0 is available");
 }
+
+#[test]
+fn the_check_at_start_offers_the_prompt_and_later_dismisses_it() {
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.set_update_source(source(Ok(Some("v99.0.0"))));
+        app.set_startup_update_check(true);
+        app
+    });
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+    while h.query_by_label_contains("is available").is_none() {
+        h.run_steps(2);
+        assert!(std::time::Instant::now() < deadline, "timed out waiting for the startup prompt");
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    h.get_by_label("LATER").click();
+    h.run_steps(3);
+    assert!(h.query_by_label_contains("is available").is_none(), "Later closes the prompt");
+}
diff --git a/crates/ui-egui/tests/it/view.rs b/crates/ui-egui/tests/it/view.rs
index b825968ff9..a83b4cb756 100644
--- a/crates/ui-egui/tests/it/view.rs
+++ b/crates/ui-egui/tests/it/view.rs
@@ -70,7 +70,7 @@ fn mixed_harness(options: &'static [(&'static str, &'static str)]) -> Harness<'s
 
 /// A vertical wheel event; negative `dy` scrolls down.
 fn wheel(unit: MouseWheelUnit, dy: f32, phase: TouchPhase) -> egui::Event {
-    egui::Event::MouseWheel { unit, delta: egui::vec2(0.0, dy), phase, modifiers: Modifiers::NONE }
+    egui::Event::MouseWheel { unit, delta: egui::vec2(0.0, dy), phase, modifiers: Modifiers::NONE, source: egui::MouseWheelSource::Unknown }
 }
 
 #[cfg(target_os = "linux")]
@@ -710,7 +710,13 @@ fn frames_after_a_notch(system_reduced: bool, animation_effects: &str, zooming:
     h.run_steps(2);
     let before = rect(&h, 0).expect("page 1 on screen").min.y;
     let (delta, modifiers) = if zooming { (egui::vec2(0.0, 1.0), Modifiers::COMMAND) } else { (egui::vec2(0.0, -1.0), Modifiers::NONE) };
-    h.event(egui::Event::MouseWheel { unit: MouseWheelUnit::Line, delta, phase: TouchPhase::Move, modifiers });
+    h.event(egui::Event::MouseWheel {
+        unit: MouseWheelUnit::Line,
+        delta,
+        phase: TouchPhase::Move,
+        modifiers,
+        source: egui::MouseWheelSource::Unknown,
+    });
     (0..40)
         .map(|_| {
             h.step();
@@ -1027,9 +1033,8 @@ fn view_menu_page_display_uses_the_same_commands() {
     use egui_kittest::kittest::Queryable;
     let mut h = harness(&[]);
     h.run_steps(4);
-    h.get_by_label("Menu").click();
-    h.run_steps(2);
-    h.get_by_label("View ⏵").hover();
+    crate::support::open_menu(&mut h, "View");
+    crate::support::menu_row(&h, "Page display").hover();
     h.run_steps(3);
     h.get_by_label("Single page").click();
     h.run_steps(4);
@@ -1468,6 +1473,52 @@ fn required_radio_buttons_get_a_round_red_border() {
     assert!(!stroke(at(50.3, 339.7)), "the widget's corner, outside the circle, is not: {:?}", at(50.3, 339.7));
 }
 
+/// Two required check boxes: the first laid out for a round XFA check button (`/PCXfaRound`), the
+/// second an ordinary square one.
+const ROUND_CHECKS: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] >> >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /Ff 2 /T (round) /V /Off /AS /Off /Rect [50 300 90 340] /PCXfaRound true /P 3 0 R >> endobj
+5 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /Ff 2 /T (square) /V /Off /AS /Off /Rect [150 300 190 340] /P 3 0 R >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// With fields highlighted, a round XFA check box gets a round border, as a radio button does,
+/// while an ordinary check box keeps a square one.
+#[test]
+fn round_check_boxes_get_a_round_highlight() {
+    let _gpu = gpu();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("checks.pdf", None, ROUND_CHECKS.to_vec()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("panel", "none").unwrap();
+        app.set_option("fields", "on").unwrap();
+        app
+    });
+    crate::support::settle(&mut h);
+    let r = rect(&h, 0).expect("page 1");
+    let ppp = h.ctx.pixels_per_point();
+    let img = h.render().expect("renders");
+    let at = |x: f32, y: f32| {
+        let p = egui::pos2(r.min.x + r.width() * (x / 300.0), r.min.y + r.height() * (1.0 - y / 400.0));
+        *img.get_pixel((p.x * ppp) as u32, (p.y * ppp) as u32)
+    };
+    // The red of the required border, or its antialiased edge over the field tint.
+    let stroke = |p: image::Rgba<u8>| p[0] > 180 && p[2] < 140 && i16::from(p[0]) - i16::from(p[2]) > 80;
+    assert!([0.05_f32, 0.2].into_iter().any(|dx| stroke(at(50.0 + dx, 320.0))), "the round box's left edge is red: {:?}", at(50.2, 320.0));
+    // Near the top of the left edge: outside the circle, on a square's border.
+    assert!(!stroke(at(50.25, 339.0)), "the round box's corner, outside the circle, is not: {:?}", at(50.25, 339.0));
+    assert!(
+        [0.1_f32, 0.25, 0.4].into_iter().any(|dx| stroke(at(150.0 + dx, 339.0))),
+        "the square box's is: {:?} {:?}",
+        at(150.1, 339.0),
+        at(150.25, 339.0)
+    );
+}
+
 /// Acrobat's Highlight existing fields is a preference, not a per-document choice: turned off
 /// once, the next document (and the next session) opens with fields plain. New settings start
 /// with it on.
@@ -1959,17 +2010,14 @@ fn long_view_menu_fits_a_short_window() {
         app
     });
     h.run_steps(8);
-    h.get_by_label("Menu").click();
+    crate::support::open_menu(&mut h, "View");
     h.run_steps(2);
-    h.get_by_label("View ⏵").hover();
-    h.run_steps(4);
-    let before = h.get_by_label("Side panels ⏵").rect().bottom();
-    h.get_by_label("Fit to height ").hover();
+    crate::support::menu_row(&h, "Rotate view").hover();
     h.event(wheel(MouseWheelUnit::Point, -1000.0, TouchPhase::Move));
     h.run_steps(6);
-    let after = h.get_by_label("Side panels ⏵").rect().bottom();
-    assert!(after < before && after <= 400.0, "menu did not scroll into view: {before} -> {after}");
-    h.get_by_label("Side panels ⏵").hover();
+    let after = crate::support::menu_row(&h, "Side panels").rect().bottom();
+    assert!(after <= 400.0, "the menu scrolls Side panels into view: {after}");
+    crate::support::menu_row(&h, "Side panels").hover();
     h.run_steps(4);
     h.get_all_by_label("Bookmarks").last().unwrap().click();
     h.run_steps(4);
@@ -2111,3 +2159,101 @@ fn full_screen_clicks_turn_pages_whatever_tool_was_on() {
     assert!(!h.state().full_screen);
     assert_eq!(h.state().quick_tool, QuickTool::Hand, "the tool from before is back");
 }
+
+/// #4415: the Pages panel's Page tools menu. Each tool acts on the selected pages (the current
+/// page when none is): rotate, delete and insert a blank page here, as Pages ▸ … does.
+#[test]
+fn the_pages_panel_tools_act_on_the_selected_pages() {
+    let mut h = harness(&[("panel", "pages")]);
+    let id = h.state().views[0].id;
+    let rotations = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().info.pages.iter().map(|p| p.rotation).collect::<Vec<_>>();
+    // The panel's Page tools menu, on the right-hand side of the window.
+    let tool = |h: &mut Harness<'static, PdfCraftApp>, label: &str| {
+        h.get_all_by_label("Page tools").find(|n| n.rect().left() > 1000.0).expect("Page tools in the Pages panel").click();
+        h.run_steps(2);
+        h.get_by_label(label).click();
+        h.run_steps(3);
+    };
+    h.state_mut().views[0].select_pages(&[1, 2]);
+    h.run_steps(2);
+    tool(&mut h, "Rotate the selected pages clockwise");
+    assert_eq!(rotations(&h), [0, 90, 90], "pages 2 and 3, the selection");
+    tool(&mut h, "Rotate the selected pages counterclockwise");
+    assert_eq!(rotations(&h), [0, 0, 0]);
+    h.state_mut().views[0].select_pages(&[0]);
+    h.run_steps(2);
+    tool(&mut h, "Delete the selected pages");
+    assert_eq!(h.state().session.get(id).unwrap().info.pages.len(), 2, "page 1 deleted");
+    tool(&mut h, "Insert a blank page after the selection");
+    assert_eq!(h.state().session.get(id).unwrap().info.pages.len(), 3);
+    h.state_mut().execute("edit.undo");
+    h.run_steps(2);
+    assert_eq!(h.state().session.get(id).unwrap().info.pages.len(), 2, "each is one undo step");
+}
+
+/// CodeRabbit on #4583: the Page tools menu's file items work from the menu too. Insert pages
+/// from a file puts the picked file's pages after the selection; Extract the selected pages
+/// opens Extract for the selection and writes it.
+#[test]
+fn the_pages_panel_tools_insert_from_a_file_and_extract() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-page-tools-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let more = dir.join("more.pdf");
+    std::fs::write(&more, PAGES).unwrap();
+    let mut h = harness(&[("panel", "pages")]);
+    let id = h.state().views[0].id;
+    let count = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().info.pages.len();
+    let tool = |h: &mut Harness<'static, PdfCraftApp>, label: &str| {
+        h.get_all_by_label("Page tools").find(|n| n.rect().left() > 1000.0).expect("Page tools in the Pages panel").click();
+        h.run_steps(2);
+        h.get_by_label(label).click();
+        h.run_steps(3);
+    };
+    assert_eq!(count(&h), 3);
+    h.state_mut().views[0].select_pages(&[0]);
+    h.state_mut().pick_override = Some(vec![more.to_string_lossy().into_owned()]);
+    tool(&mut h, "Insert pages from a file after the selection…");
+    h.run_steps(3);
+    assert_eq!(count(&h), 6, "the picked file's three pages are inserted");
+
+    let out = dir.join("out");
+    std::fs::create_dir_all(&out).unwrap();
+    h.state_mut().export_dir_override = Some(out.to_string_lossy().into_owned());
+    h.state_mut().views[0].select_pages(&[1, 2]);
+    tool(&mut h, "Extract the selected pages…");
+    assert_eq!(h.state().dialog, Some(pdfcraft_ui_egui::Dialog::Extract), "Extract opens for the selection");
+    h.state_mut().extract_draft = pdfcraft_ui_egui::ExtractDraft { separate: true, ..Default::default() };
+    h.get_all_by_label("Extract").last().unwrap().click();
+    h.run_steps(3);
+    assert_eq!(std::fs::read_dir(&out).unwrap().count(), 2, "the two selected pages, each a file");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// The Pages panel's Page tools are greyed out on a document whose security doesn't allow
+/// page changes: the menu doesn't open, and nothing changes.
+#[test]
+fn the_pages_panel_tools_are_off_without_page_editing_permission() {
+    use egui_kittest::kittest::NodeT;
+    let mut h = harness(&[("panel", "pages")]);
+    {
+        let app = h.state_mut();
+        app.apply_edit(pdfcraft_engine::Edit::Protect(pdfcraft_engine::Protection {
+            permissions_password: Some("owner".into()),
+            changes: pdfcraft_engine::Changes::None,
+            ..Default::default()
+        }));
+        let bytes = app.session.save_bytes(app.views[0].id).unwrap();
+        app.open_bytes("restricted.pdf", None, bytes.as_ref().clone()).unwrap();
+    }
+    h.run_steps(6);
+    let i = h.state().active.unwrap();
+    let id = h.state().views[i].id;
+    assert!(!h.state().session.get(id).unwrap().allows_assembly());
+    let tools = h.get_all_by_label("Page tools").find(|n| n.rect().left() > 1000.0).expect("Page tools");
+    assert!(tools.accesskit_node().is_disabled(), "Page tools is greyed out");
+    tools.click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Delete the selected pages").is_none(), "its menu doesn't open");
+    assert_eq!(h.state().session.get(id).unwrap().info.pages.len(), 3);
+}
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index 7795e05134..f2a12b69aa 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -154,7 +154,7 @@ fn find_shortcuts_advance_and_retreat_matches() {
     assert_eq!(n, 15);
     // Surrender text edit focus so canvas shortcut handler receives key events.
     h.state_mut().views[0].find.as_mut().unwrap().focus = false;
-    h.ctx.memory_mut(|m| m.surrender_focus(egui::Id::new("find-input")));
+    h.ctx.memory_mut(|m| m.surrender_focus(egui::Id::unique("find-input")));
     h.run_steps(2);
     let start = h.state().views[0].find.as_ref().unwrap().current.unwrap();
     // ⌘G advances to next match.
@@ -201,6 +201,141 @@ fn find_shortcuts_work_from_the_find_field() {
     assert!(h.ctx.egui_wants_keyboard_input(), "and keeps it");
 }
 
+/// Open the find bar on the first document, search for the single uppercase "PAGE" on each
+/// page, and wait until every text layer has answered. Returns the document's view index.
+fn find_one_match_per_page(h: &mut Harness<'static, PdfCraftApp>) -> usize {
+    h.state_mut().active = Some(0);
+    h.run_steps(2);
+    let view = h.state().active.expect("a document is shown");
+    {
+        let v = &mut h.state_mut().views[view];
+        v.open_find();
+        let f = v.find.as_mut().expect("the find bar is open");
+        f.query = "PAGE".into();
+        f.case_sensitive = true;
+        v.rerun_find();
+    }
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
+    while std::time::Instant::now() < deadline {
+        h.run_steps(2);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+        if h.state().views[view].find.as_ref().is_some_and(|f| f.matches.len() >= 5) {
+            break;
+        }
+    }
+    assert_eq!(h.state().views[view].find.as_ref().unwrap().matches.len(), 5, "one PAGE on each of five pages");
+    view
+}
+
+/// Automatic following ends when the reader scrolls inside the viewed page, not only when the
+/// page changes. This drives the production document area with a real wheel event.
+#[test]
+fn wheel_scrolling_ends_automatic_search_following_on_the_same_page() {
+    let mut h = harness();
+    let view = find_one_match_per_page(&mut h);
+    h.run_steps(4);
+    {
+        let f = h.state().views[view].find.as_ref().unwrap();
+        assert_eq!((f.auto_page, f.follow_ended), (Some(0), false), "the automatic choice is following page 1");
+    }
+    let center = h.state().views[view].viewport_rect().center();
+    h.event(egui::Event::PointerMoved(center));
+    h.run_steps(1);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::vec2(0.0, -20.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    h.run_steps(12);
+    let v = &h.state().views[view];
+    assert_eq!(v.current, 0, "a small wheel scroll stays within page 1");
+    let f = v.find.as_ref().unwrap();
+    assert!(f.follow_ended, "the reader's wheel ends automatic following");
+    assert_eq!((f.auto_from, f.auto_page), (None, None));
+}
+
+/// A programmatic search flash is not reader scrolling, even while an unrelated drag is held.
+/// Holding a text selection on the page keeps a pointer drag active; the flash still needs to
+/// move the viewport, and automatic following must survive so a late layer can still follow it.
+#[test]
+fn a_search_flash_preserves_following_while_an_unrelated_drag_is_held() {
+    let mut h = harness();
+    let view = find_one_match_per_page(&mut h);
+    h.run_steps(4);
+    let start = h.state().views[view].page_screen_rect(0).expect("page 1 is on screen").center();
+    h.event(egui::Event::PointerMoved(start));
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: start, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+    h.run_steps(1);
+    // Move enough to turn the press into a text-selection drag. That drag owns the pointer but
+    // does not scroll the document; only the document scroll area scrolls it.
+    let held = start + egui::vec2(24.0, 0.0);
+    h.event(egui::Event::PointerMoved(held));
+    h.run_steps(2);
+    assert!(h.ctx.dragged_id().is_some(), "an unrelated page drag is held");
+    assert!(h.state().views[view].page_screen_rect(1).is_none(), "page 2 starts off screen");
+
+    // A flash to page 2 visibly moves the viewport from under the held drag.
+    {
+        let f = h.state_mut().views[view].find.as_mut().unwrap();
+        f.query = "Page 2".into();
+        f.case_sensitive = true;
+    }
+    h.state_mut().views[view].rerun_find();
+    h.run_steps(3);
+    let v = &h.state().views[view];
+    assert_eq!(v.current, 1, "the automatic choice moved to page 2");
+    let f = v.find.as_ref().unwrap();
+    assert!(!f.follow_ended, "a flash's own jump is not the reader scrolling");
+    assert_eq!(f.auto_page, Some(1));
+    assert!(v.page_screen_rect(1).is_some(), "page 2 is visibly on screen after the flash");
+
+    // Releasing the unrelated drag leaves the automatic follow in place.
+    h.event(egui::Event::PointerButton { pos: held, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+    assert!(!h.state().views[view].find.as_ref().unwrap().follow_ended, "the page drag never ended following");
+}
+
+/// The document scroll bar is its own scroll surface: a track click moves the offset with no
+/// pointer motion, and dragging from that press keeps moving it. Both are the reader scrolling,
+/// so automatic following ends. A global "any drag is scrolling" check would miss the click.
+#[test]
+fn scroll_bar_track_click_and_drag_end_automatic_search_following() {
+    let mut h = harness();
+    let view = find_one_match_per_page(&mut h);
+    h.run_steps(4);
+    let vp = h.state().views[view].viewport_rect();
+    // Floating bars sit in the outer few points of the document area (see theme). Aim 75% down
+    // the vertical track: below the handle at this scroll position, and clear of the corner
+    // where the horizontal bar's track overlaps.
+    let track = egui::pos2(vp.right() - 4.0, vp.top() + vp.height() * 0.75);
+    let before = h.state().views[view].page_screen_rect(0).expect("page 1 is on screen").top();
+    h.event(egui::Event::PointerMoved(track));
+    h.run_steps(2);
+    h.event(egui::Event::PointerButton { pos: track, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+    {
+        let v = &h.state().views[view];
+        let f = v.find.as_ref().unwrap();
+        assert!(f.follow_ended, "a track click that jumps the view ends automatic following");
+        assert_eq!((f.auto_from, f.auto_page), (None, None));
+        let after = v.page_screen_rect(0).map(|r| r.top());
+        assert!(after.is_none_or(|top| top < before - 100.0), "the track click moved the viewport ({before} -> {after:?})");
+    }
+
+    // Keep dragging from the press: the scroll bar follows the pointer, still reader scrolling.
+    let dragged = egui::pos2(vp.right() - 4.0, vp.top() + vp.height() * 0.4);
+    h.event(egui::Event::PointerMoved(dragged));
+    h.run_steps(2);
+    let v = &h.state().views[view];
+    assert!(v.find.as_ref().unwrap().follow_ended, "the track drag is the reader scrolling");
+    assert!(v.page_screen_rect(0).is_none_or(|r| r.top() < before - 100.0), "dragging the track kept moving the viewport");
+    h.event(egui::Event::PointerButton { pos: dragged, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+}
+
 #[test]
 fn marking_while_searching_does_not_jitter_or_reset_search_state() {
     let mut h = harness();
@@ -339,7 +474,7 @@ fn page_input_focused(h: &Harness<'static, PdfCraftApp>) -> bool {
     let focused = h.ctx.memory(|m| m.focused());
     let view = &h.state().views[h.state().active.unwrap()];
     // Also identifies the original editor when running this test-only patch on the baseline.
-    focused == Some(egui::Id::new(("page-input", view.id.0))) || focused == Some(egui::Id::new("page-input"))
+    focused == Some(egui::Id::unique(("page-input", view.id.0))) || focused == Some(egui::Id::unique("page-input"))
 }
 
 /// Exercise the real navigation editor, including its focus and Enter handling.
@@ -967,7 +1102,7 @@ fn wrapped_revision_buttons_stay_above_binding_and_open_the_saved_revision() {
         let left = h.get_by_label("Left Edge").rect();
         let right = h.get_by_label("Right Edge").rect();
         // Properties requests a fixed width. Measure its card in each viewport.
-        let card = h.ctx.data(|d| d.get_temp::<egui::Rect>(egui::Id::new("dialog").with("card"))).expect("Properties is shown");
+        let card = h.ctx.data(|d| d.get_temp::<egui::Rect>(egui::Id::unique("dialog").with("card"))).expect("Properties is shown");
         for (n, rect) in &buttons {
             for (label, below) in [("Binding", binding), ("Left Edge", left), ("Right Edge", right)] {
                 assert!(rect.bottom() <= below.top(), "revision {n} overlaps {label} at viewport width {width}: {rect:?}, {below:?}");
@@ -1556,7 +1691,13 @@ fn the_scroll_speed_preference_scales_mouse_wheel_notches() {
         let top = |h: &Harness<'static, PdfCraftApp>| h.state().views[i].page_screen_rect(0).expect("page 1 on screen").min.y;
         let before = top(&h);
         h.event(egui::Event::PointerMoved(h.state().views[i].viewport_rect().center()));
-        h.event(egui::Event::MouseWheel { unit, delta: egui::vec2(0.0, -dy), phase: egui::TouchPhase::Move, modifiers: egui::Modifiers::NONE });
+        h.event(egui::Event::MouseWheel {
+            unit,
+            delta: egui::vec2(0.0, -dy),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        });
         // egui spreads a wheel notch over a few frames.
         h.run_steps(30);
         before - top(&h)
@@ -1857,6 +1998,7 @@ fn mouse_wheel_scrolls_while_selecting_text() {
         delta: egui::vec2(0.0, -3.0),
         phase: egui::TouchPhase::Move,
         modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(20);
     let after = h.state().views[view].page_screen_rect(0).unwrap().top();
@@ -1896,7 +2038,13 @@ fn selection_wheel_delta(unit: egui::MouseWheelUnit, amount: f32, held: bool, an
     }
     h.run_steps(2);
     let before = h.state().views[view].page_screen_rect(0).unwrap().top();
-    h.event(egui::Event::MouseWheel { unit, delta: egui::vec2(0.0, -amount), phase: egui::TouchPhase::Move, modifiers: egui::Modifiers::NONE });
+    h.event(egui::Event::MouseWheel {
+        unit,
+        delta: egui::vec2(0.0, -amount),
+        phase: egui::TouchPhase::Move,
+        modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
     h.run_steps(40);
     before - h.state().views[view].page_screen_rect(0).unwrap().top()
 }
@@ -1930,7 +2078,13 @@ fn selection_control_wheel_still_zooms() {
     for modifiers in [egui::Modifiers::CTRL, egui::Modifiers::COMMAND] {
         let (mut h, view, _) = selection_wheel_harness();
         let before = h.state().views[view].page_screen_rect(0).unwrap().width();
-        h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: egui::vec2(0.0, 1.0), phase: egui::TouchPhase::Move, modifiers });
+        h.event(egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Line,
+            delta: egui::vec2(0.0, 1.0),
+            phase: egui::TouchPhase::Move,
+            modifiers,
+            source: egui::MouseWheelSource::Unknown,
+        });
         h.run_steps(40);
         let after = h.state().views[view].page_screen_rect(0).unwrap().width();
         assert!(after > before + 1.0, "control wheel should zoom: {before} -> {after}");
@@ -1948,6 +2102,7 @@ fn selection_wheel_outside_document_does_not_scroll() {
         delta: egui::vec2(0.0, -1.0),
         phase: egui::TouchPhase::Move,
         modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(40);
     let after = h.state().views[view].page_screen_rect(0).unwrap().top();
@@ -1975,6 +2130,7 @@ fn selection_wheel_does_not_scroll_behind_preferences() {
         delta: egui::vec2(0.0, -1.0),
         phase: egui::TouchPhase::Move,
         modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
     h.run_steps(40);
     let after = h.state().views[view].page_screen_rect(0).unwrap().top();
@@ -1991,6 +2147,7 @@ fn selection_mouse_wheel_resumes_after_point_scrolling() {
             delta: egui::vec2(0.0, -30.0),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
         });
         h.run_steps(delay);
         let before = h.state().views[view].page_screen_rect(0).unwrap().top();
@@ -2002,6 +2159,7 @@ fn selection_mouse_wheel_resumes_after_point_scrolling() {
             delta: egui::vec2(0.0, -1.0),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
         });
         h.run_steps(40);
         let after = h.state().views[view].page_screen_rect(0).unwrap().top();
@@ -2087,3 +2245,26 @@ fn go_to_page_brings_the_page_into_view_horizontally() {
     let (r, vp) = (v.page_screen_rect(2).expect("page 3 on screen"), v.viewport_rect());
     assert!(r.left() >= vp.left() && r.right() <= vp.right(), "page 3 at {r:?}, viewport {vp:?}");
 }
+
+/// #4614: the accessible window is named like the native one, and follows it when the active
+/// document changes, so a screen reader can find the window by its title.
+#[test]
+fn the_accessible_window_has_the_window_title_as_its_name() {
+    use egui_kittest::kittest::NodeT as _;
+    let mut h = harness();
+    h.run_steps(2);
+    let name = |h: &Harness<'static, PdfCraftApp>| h.root().accesskit_node().label().map(|l| l.to_string());
+    assert_eq!(name(&h).as_deref(), Some("b.pdf — PdfCraft"));
+    {
+        use pdfcraft_engine::Edit;
+        let s = h.state_mut();
+        let id = s.views[s.active.unwrap()].id;
+        s.session.apply(id, Edit::SetInfo { key: "Title".into(), value: "Quarterly report".into() }).unwrap();
+        let mut v = s.session.get(id).unwrap().initial_view();
+        v.display_title = true;
+        s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
+    }
+    h.run_steps(2);
+    assert_eq!(name(&h).as_deref(), Some("Quarterly report — PdfCraft"));
+    assert_eq!(name(&h), Some(h.state().window_title.clone()));
+}
diff --git a/crates/ui-egui/tests/perf.rs b/crates/ui-egui/tests/perf.rs
index 61d3965bdc..892f7b766a 100644
--- a/crates/ui-egui/tests/perf.rs
+++ b/crates/ui-egui/tests/perf.rs
@@ -94,7 +94,7 @@ fn pdf(objs: Vec<String>) -> Vec<u8> {
     out
 }
 
-/// Named roots exercise thread lookups even when none of the comments has replies.
+/// Named roots, none with replies: the panel still looks up every root's thread.
 fn named_comments(n: usize) -> Vec<u8> {
     let annots: Vec<String> = (0..n).map(|i| format!("{} 0 R", i + 4)).collect();
     let mut objs = vec![
diff --git a/crates/ui-egui/tests/snapshots/panel_comments.txt b/crates/ui-egui/tests/snapshots/panel_comments.txt
index c5bed58730..ca9e50db8c 100644
--- a/crates/ui-egui/tests/snapshots/panel_comments.txt
+++ b/crates/ui-egui/tests/snapshots/panel_comments.txt
@@ -4,11 +4,11 @@ Button "Close" [off]
 Button "More options" [off]
 Button "Filter comments" [off]
 Button "Search comments" [off]
-TextInput
+TextInput "Add a comment"
 Button "Collapse" [off]
 Label = "Page 1"
 Label = "1"
 Label = "Reviewer"
 Label = "2026-01-01 12:00"
 Label = "Check this heading"
-Unknown
+Unknown "Note — click to show it on the page"
diff --git a/crates/ui-egui/tests/snapshots/panel_pages.txt b/crates/ui-egui/tests/snapshots/panel_pages.txt
index 4e746f1006..7f432057d9 100644
--- a/crates/ui-egui/tests/snapshots/panel_pages.txt
+++ b/crates/ui-egui/tests/snapshots/panel_pages.txt
@@ -1,6 +1,7 @@
 Label = "Pages"
 Label = "2"
 Button "Close" [off]
+Button "Page tools" [off]
 Label = "Thumbnail size"
 Label = "100%"
 Button "Smaller thumbnails" [off]
diff --git a/crates/xfa/Cargo.toml b/crates/xfa/Cargo.toml
index dcec1e75bc..d917018057 100644
--- a/crates/xfa/Cargo.toml
+++ b/crates/xfa/Cargo.toml
@@ -14,7 +14,7 @@ workspace = true
 pdfcraft-cos = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 roxmltree = "0.20"
-base64 = "0.22"
+base64 = "0.23"
 png = "0.18"
 sha2 = "0.11"
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "tiff"] }
diff --git a/crates/xfa/README.md b/crates/xfa/README.md
index 23a6ef0d0e..2d08a74bb2 100644
--- a/crates/xfa/README.md
+++ b/crates/xfa/README.md
@@ -38,8 +38,11 @@ that warning and keeps the existing layout and accepted widget values.
   XObjects, and widgets: text (multi-line, max length, alignment), date (Acrobat's `AFDate`
   format and keystroke actions from the picture clause), check boxes and radio groups (from
   `exclGroup`), push buttons with Reset / Print / Save As / URI actions recognised from their
-  scripts. Appearance streams are left empty for the forms layer to generate. Each field keeps
-  its SOM path in `/PCSom`; the AcroForm gets `/PCXfaLayout` so a saved form is not laid out
+  scripts, and signature fields, each named by its SOM path (`form1[0].page1[0].sign[0]`, as
+  fields under one for each step above it) because other viewers lay a dynamic form out again
+  and find a signature by that name. A box whose path, or a part of it, the file already gives
+  another field keeps its own name, and a new layout keeps a signature a generated box holds. Appearance streams are left empty for the forms layer to
+  generate. Each field keeps its SOM path in `/PCSom`; the AcroForm gets `/PCXfaLayout` so a saved form is not laid out
   twice. The XFA packets stay, so Adobe's viewers keep rendering the form from them.
 
 - **Data** (`data`): the `datasets` packet. On layout, a field takes its value from the data
@@ -82,6 +85,7 @@ be measured exponentially often in their nesting. A measurement budget backs thi
   | `/PCSom` | generated fields | the field's SOM path, so values go back to the data |
   | `/PCXfaLayout` | AcroForm | what laying out produced, so a saved form is not laid out again |
   | `/PCXfaOverrides` | AcroForm | `<< /Presence << /som (hidden) … >> /Access << /som (readOnly) … >> >>`: presence and access scripts set, by SOM path (instance 0 of a repeating subform stands for all); applied to the template before every layout, so undo, save and reopen keep them. Adobe's viewers draw from the XFA packets and don't read it; at most 10 000 entries are read or written |
+  | `/PCXfaNode` | generated fields above a signature field | `true`: the field names a step of the signature field's SOM path; a new layout replaces it with the fields it holds |
   | `/PCXfaClick` | generated push buttons | `true`: the template has a click script for this button. Such buttons carry no `/A`: XFA JavaScript is not Acrobat JavaScript, so it is never written as a `/S /JavaScript` action other viewers would run. PdfCraft finds the script by the field's `/PCSom` |
 
 ## API sketch
diff --git a/crates/xfa/src/data.rs b/crates/xfa/src/data.rs
index 95f59a44b9..7c387c44ef 100644
--- a/crates/xfa/src/data.rs
+++ b/crates/xfa/src/data.rs
@@ -12,9 +12,38 @@ use std::collections::HashMap;
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 
 use crate::XfaError;
-use crate::model::{Field, Node, SomIndices, Template};
+use crate::model::{Field, Node, SomIndices, Template, Ui};
 use crate::packets::{Encoding, encode};
 
+mod build;
+mod dates;
+mod import;
+mod merge;
+mod passwords;
+mod path;
+mod values;
+mod write;
+
+use build::MAX_INDEX;
+pub use build::build_data;
+#[cfg(test)]
+pub(crate) use dates::iso_to_data;
+pub(crate) use dates::{data_date_letters, data_to_iso, date_letters, date_tokens};
+pub use dates::{iso_to_pattern, pattern_to_iso};
+#[cfg(test)]
+pub(crate) use import::MAX_IMPORT_BYTES;
+pub use import::{DataImport, ImportNode, export_data, import_data, parse_data_file, write_data_image};
+pub use passwords::{clear_password_values, has_password_values};
+pub(crate) use path::template_field;
+pub use path::{data_path, parse_datasets, som_to_path};
+pub use values::{FieldData, FieldDatum, is_on, read_values, read_values_with};
+#[cfg(test)]
+pub(crate) use write::ENSURED;
+pub use write::{
+    DatasetsWrite, add_data_instances, remove_data_instance, write_data_ops, write_data_value, write_datasets, write_datasets_reusing,
+    write_datasets_with,
+};
+
 const XFA_DATA_NS: &str = "http://www.xfa.org/schema/xfa-data/1.0/";
 /// Most data nodes read.
 const MAX_NODES: u32 = 1_000_000;
@@ -61,1199 +90,6 @@ impl DataNode {
     }
 }
 
-fn to_node(n: roxmltree::Node, depth: usize) -> DataNode {
-    let name = n.tag_name().name().to_string();
-    let children: Vec<DataNode> =
-        if depth < MAX_DEPTH { n.children().filter(|c| c.is_element()).map(|c| to_node(c, depth + 1)).collect() } else { Vec::new() };
-    // The text of a leaf is its value; a container's own text is whitespace.
-    let text = if children.is_empty() { n.children().filter_map(|c| c.text()).collect::<String>() } else { String::new() };
-    DataNode { name, text, children }
-}
-
-/// The `xfa:data` element of the datasets packet in `xdp` (or a bare datasets document), as a
-/// tree whose root is that element.
-pub fn parse_datasets(xdp: &str) -> Option<DataNode> {
-    if crate::xml_nesting_depth(xdp) > crate::MAX_XML_DEPTH {
-        return None;
-    }
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
-    let doc = roxmltree::Document::parse_with_options(xdp, opts).ok()?;
-    let datasets = doc.descendants().find(|n| n.is_element() && n.tag_name().name() == "datasets")?;
-    let data = datasets.children().find(|n| n.is_element() && n.tag_name().name() == "data")?;
-    Some(to_node(data, 0))
-}
-
-/// The data path a SOM expression names: `form[0].#subform[0].name[1]` → `[(form, 0), (name, 1)]`.
-/// Unnamed containers (`#subform`) have no data node.
-pub fn som_to_path(som: &str) -> DataPath {
-    som.split('.')
-        .filter_map(|seg| {
-            let seg = seg.trim();
-            if seg.is_empty() || seg.starts_with('#') || seg.starts_with('$') {
-                return None;
-            }
-            let (name, idx) = match seg.split_once('[') {
-                Some((n, rest)) => (n, rest.trim_end_matches(']').parse::<usize>().unwrap_or(0)),
-                None => (seg, 0),
-            };
-            Some((name.to_string(), idx.min(100_000)))
-        })
-        .collect()
-}
-
-/// The data path the object at `som` binds to: [`som_to_path`] without the areas on the way.
-/// An area is a named container in the form, so it is part of SOM expressions, but only
-/// subforms, exclusion groups and fields are data scopes: what an area holds binds under the
-/// area's parent, as Adobe's viewers write it. The template tells which segments are areas;
-/// segments it doesn't have (page-set objects, or a SOM from another template) are kept.
-pub fn data_path(tpl: &Template, som: &str) -> DataPath {
-    let mut out = DataPath::new();
-    // The template children the next segment is looked up in; `None` until the root matched,
-    // and again once a segment is not a container the template has.
-    let mut level: Option<&[Node]> = None;
-    for (i, (name, index)) in som_to_path(som).into_iter().enumerate() {
-        let found = match level {
-            None if i == 0 && tpl.root.common.name.as_deref() == Some(name.as_str()) => Some(Container::Children(&tpl.root.children)),
-            None => None,
-            Some(children) => match named(children, &name, 0) {
-                Some(Node::Subform(sf)) => Some(Container::Children(&sf.children)),
-                Some(Node::Area(a)) => Some(Container::Area(&a.children)),
-                _ => None,
-            },
-        };
-        match found {
-            Some(Container::Area(children)) => level = Some(children),
-            Some(Container::Children(children)) => {
-                level = Some(children);
-                out.push((name, index));
-            }
-            None => {
-                level = None;
-                out.push((name, index));
-            }
-        }
-    }
-    out
-}
-
-enum Container<'a> {
-    Children(&'a [Node]),
-    /// Contents bind under the area's parent.
-    Area(&'a [Node]),
-}
-
-/// The child of `nodes` named `name`, looking through unnamed subforms and areas (which have no
-/// SOM segment of their own).
-fn named<'a>(nodes: &'a [Node], name: &str, depth: usize) -> Option<&'a Node> {
-    if depth > MAX_DEPTH {
-        return None;
-    }
-    nodes.iter().find(|n| n.common().name.as_deref() == Some(name)).or_else(|| {
-        nodes.iter().find_map(|n| match n {
-            Node::Subform(sf) if sf.common.name.is_none() => named(&sf.children, name, depth + 1),
-            Node::Area(a) if a.common.name.is_none() => named(&a.children, name, depth + 1),
-            _ => None,
-        })
-    })
-}
-
-/// The date letters (`yyyy-mm-dd`, `yyyymmdd`) of an XFA date picture clause such as
-/// `date{YYYY-MM-DD}`, or `None` when it has none this reads (empty, or with symbols beyond
-/// years, months, days and separators).
-pub(crate) fn date_letters(picture: &str) -> Option<String> {
-    let inner = picture
-        .find('{')
-        .and_then(|a| {
-            let rest = picture.get(a + 1..)?;
-            rest.find('}').and_then(|b| rest.get(..b))
-        })
-        .unwrap_or(picture)
-        .trim();
-    if inner.is_empty() || inner.chars().any(|c| !"YMDEJ-/., :".contains(c)) {
-        return None;
-    }
-    Some(inner.replace('E', "d").to_ascii_lowercase())
-}
-
-/// The date letters of `f`'s data picture, when it holds a whole date. A data picture without a
-/// year, a month or a day can't hold the date the field shows, so such a field's data keeps
-/// ISO dates.
-pub(crate) fn data_date_letters(f: &Field) -> Option<String> {
-    let letters = f.data_picture.as_deref().and_then(date_letters)?;
-    let tokens = date_tokens(&letters);
-    let has = |any: &[&str]| tokens.iter().any(|t| any.contains(&t.as_str()));
-    (has(&["yyyy", "yy"]) && has(&["mm", "m"]) && has(&["dd", "d"])).then_some(letters)
-}
-
-/// A date as the data holds it, written in `data_pattern` (the field's data picture), read as
-/// an ISO date. A value that doesn't match, or a field without a data picture, is taken as it
-/// is: the data holds ISO dates by default.
-pub(crate) fn data_to_iso(value: &str, data_pattern: Option<&str>) -> String {
-    data_pattern.and_then(|p| pattern_to_iso(value, p)).unwrap_or_else(|| value.to_string())
-}
-
-/// An ISO date as the data should hold it: in `data_pattern` when the field has one and the
-/// date reads back from it unchanged (a two-digit year holds only 1950 to 2049), else as ISO.
-pub(crate) fn iso_to_data(iso: String, data_pattern: Option<&str>) -> String {
-    match data_pattern {
-        Some(p) => {
-            let written = iso_to_pattern(&iso, p);
-            if pattern_to_iso(&written, p).as_deref() == Some(iso.as_str()) { written } else { iso }
-        }
-        None => iso,
-    }
-}
-
-/// The child of `nodes` the SOM segment `name[index]` names, numbered as the form numbers its
-/// objects ([`SomIndices`]): same-named siblings count up, and the instances of a repeating
-/// subform take the numbers from its own on. Unnamed subforms and areas are looked through,
-/// as [`named`] does.
-fn named_at<'a>(nodes: &'a [Node], name: &str, index: usize, depth: usize) -> Option<&'a Node> {
-    if depth > MAX_DEPTH {
-        return None;
-    }
-    let sibs = SomIndices::of(nodes);
-    let mut repeating = None;
-    for (i, n) in nodes.iter().enumerate() {
-        if n.common().name.as_deref() != Some(name) {
-            continue;
-        }
-        let sib = sibs.at(i);
-        if sib == index {
-            return Some(n);
-        }
-        if sib < index && matches!(n, Node::Subform(sf) if sf.occur.max != Some(1)) {
-            repeating = Some(n);
-        }
-    }
-    repeating.or_else(|| {
-        nodes.iter().find_map(|n| match n {
-            Node::Subform(sf) if sf.common.name.is_none() => named_at(&sf.children, name, index, depth + 1),
-            Node::Area(a) if a.common.name.is_none() => named_at(&a.children, name, index, depth + 1),
-            _ => None,
-        })
-    })
-}
-
-/// The template field the object at a SOM path is an instance of, each segment's number counted
-/// as the form counts it ([`named_at`]). `None` when the template has no such field, or it is
-/// a button of an exclusion group (whose buttons take their value from the group).
-pub(crate) fn template_field<'a>(tpl: &'a Template, som: &str) -> Option<&'a Field> {
-    let path = som_to_path(som);
-    let ((root, _), rest) = path.split_first()?;
-    if tpl.root.common.name.as_deref() != Some(root.as_str()) {
-        return None;
-    }
-    let ((last, last_index), inner) = rest.split_last()?;
-    let mut children: &[Node] = &tpl.root.children;
-    for (name, index) in inner {
-        children = match named_at(children, name, *index, 0)? {
-            Node::Subform(sf) => &sf.children,
-            Node::Area(a) => &a.children,
-            _ => return None,
-        };
-    }
-    match named_at(children, last, *last_index, 0)? {
-        Node::Field(f) => Some(f),
-        _ => None,
-    }
-}
-
-/// The date letters of the data picture of the field `som` names, when it has one.
-fn data_date_pattern(tpl: Option<&Template>, som: &str) -> Option<String> {
-    tpl.and_then(|t| template_field(t, som)).and_then(data_date_letters)
-}
-
-/// What a field holds, for writing the datasets.
-#[derive(Clone, Debug, PartialEq)]
-pub enum FieldData {
-    Text(String),
-    /// Checked or not.
-    Check(bool),
-    /// The selected button's on value, if any.
-    Radio(Option<String>),
-    /// Nothing to write (buttons, signatures).
-    None,
-}
-
-/// One field of the AcroForm, as the engine sees it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct FieldDatum {
-    /// The terminal field dictionary (where `/PCSom` and `/PCItems` live).
-    pub obj: ObjRef,
-    /// The fully qualified field name (a static form's SOM path).
-    pub name: String,
-    pub data: FieldData,
-}
-
-fn text_of(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
-    d.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_string().map(|s| s.to_text()))
-}
-
-/// The SOM path of a field: its `/PCSom` when PdfCraft generated it, else its name.
-fn som_of(doc: &Document, f: &FieldDatum) -> String {
-    doc.get(f.obj).as_dict().and_then(|d| text_of(doc, d, crate::pdf::SOM_KEY)).unwrap_or_else(|| f.name.clone())
-}
-
-/// The datasets text for a radio group. The AcroForm value is an appearance-state name
-/// (`New York` is stored as `New_York`); `/PCOn` on the selected widget is the original item.
-fn radio_dataset_value(doc: &Document, f: &FieldDatum, sel: &Option<String>) -> String {
-    let Some(selected) = sel.as_deref().filter(|s| !s.is_empty() && *s != "Off") else {
-        return String::new();
-    };
-    let Some(group) = doc.get(f.obj).as_dict().cloned() else { return selected.to_string() };
-    let kids = group.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_else(|| vec![Object::Ref(f.obj)]);
-    for kid in kids {
-        let Some(widget) = doc.resolve(&kid).as_dict().cloned() else { continue };
-        let original = text_of(doc, &widget, b"PCOn");
-        let state = widget
-            .get(b"AP")
-            .map(|ap| doc.resolve(ap))
-            .and_then(|ap| ap.as_dict().and_then(|a| a.get(b"N").cloned()))
-            .and_then(|n| doc.resolve(&n).as_dict().cloned())
-            .and_then(|n| n.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).find(|k| k != "Off"));
-        if state.as_deref() == Some(selected) || original.as_deref() == Some(selected) {
-            return original.unwrap_or_else(|| selected.to_string());
-        }
-    }
-    selected.to_string()
-}
-
-/// The on and off item values of a check box (`/PCItems`), or the widget's on state.
-fn items_of(doc: &Document, f: &FieldDatum) -> (String, String) {
-    let d = doc.get(f.obj);
-    let items: Vec<String> = d
-        .as_dict()
-        .and_then(|d| d.get(b"PCItems").map(|o| doc.resolve(o)))
-        .and_then(|a| a.as_array().map(|a| a.iter().filter_map(|x| x.as_string().map(|s| s.to_text())).collect()))
-        .unwrap_or_default();
-    let on = items.first().cloned().unwrap_or_else(|| "1".into());
-    let off = items.get(1).cloned().unwrap_or_default();
-    (on, off)
-}
-
-/// The Acrobat date pattern a field's format action names (`AFDate_FormatEx("yyyy-mm-dd")`).
-fn date_pattern_of(doc: &Document, f: &FieldDatum) -> Option<String> {
-    let d = doc.get(f.obj);
-    let aa = doc.resolve(d.as_dict()?.get(b"AA")?);
-    let fa = doc.resolve(aa.as_dict()?.get(b"F")?);
-    let js = text_of(doc, fa.as_dict()?, b"JS")?;
-    let i = js.find("AFDate_FormatEx(")?;
-    let rest = &js[i + "AFDate_FormatEx(".len()..];
-    let q = rest.find('"')?;
-    let body = &rest[q + 1..];
-    Some(body[..body.find('"')?].to_string())
-}
-
-const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
-const WEEKDAYS: [&str; 7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
-
-/// The weekday (0 = Sunday) of a proleptic Gregorian date.
-fn weekday(y: u32, m: u32, d: u32) -> usize {
-    const T: [i64; 12] = [0, 3, 2, 5, 0, 3, 5, 1, 4, 6, 2, 4];
-    let y = i64::from(y) - i64::from(m < 3);
-    let t = T.get((m as usize).wrapping_sub(1)).copied().unwrap_or(0);
-    ((y + y / 4 - y / 100 + y / 400 + t + i64::from(d)).rem_euclid(7)) as usize
-}
-
-/// The index and length of the name in `names` that `text` starts with (ignoring case),
-/// cut to `abbr` letters when that is set.
-fn name_at(text: &str, names: &[&str], abbr: bool) -> Option<(usize, usize)> {
-    names.iter().enumerate().find_map(|(i, n)| {
-        let n = if abbr { n.get(..3)? } else { n };
-        text.get(..n.len()).filter(|t| t.eq_ignore_ascii_case(n)).map(|_| (i, n.len()))
-    })
-}
-
-/// Whether `token` is a run of the date letters (`y`, `m`, `d`) rather than a literal.
-fn is_date_run(token: &str) -> bool {
-    token.starts_with(['y', 'm', 'd'])
-}
-
-/// The tokens of a date pattern: runs of `y`, `m` and `d` (`yyyy`, `yy`, `mmmm`, `mmm`, `mm`,
-/// `m`, `dddd`, `ddd`, `dd`, `d` are understood), or a literal character.
-pub(crate) fn date_tokens(pattern: &str) -> Vec<String> {
-    let mut out = Vec::new();
-    let chars: Vec<char> = pattern.chars().collect();
-    let mut i = 0;
-    while i < chars.len() {
-        let c = chars[i].to_ascii_lowercase();
-        if "ymd".contains(c) {
-            let mut j = i;
-            while j < chars.len() && chars[j].to_ascii_lowercase() == c {
-                j += 1;
-            }
-            out.push(std::iter::repeat_n(c, j - i).collect());
-            i = j;
-        } else {
-            out.push(chars[i].to_string());
-            i += 1;
-        }
-    }
-    out
-}
-
-/// `2001-02-03` shown in `pattern` (`mm/dd/yyyy` → `02/03/2001`, `mmm d, yyyy` →
-/// `Feb 3, 2001`). Patterns with a token this doesn't know and non-dates come back as they are.
-pub fn iso_to_pattern(iso: &str, pattern: &str) -> String {
-    let parts: Vec<&str> = iso.trim().splitn(3, '-').collect();
-    let [y, m, d] = parts[..] else { return iso.to_string() };
-    let (Ok(y), Ok(m), Ok(d)) = (y.parse::<u32>(), m.parse::<u32>(), d.parse::<u32>()) else { return iso.to_string() };
-    let mut out = String::new();
-    for t in date_tokens(pattern) {
-        match t.as_str() {
-            "yyyy" => out.push_str(&format!("{y:04}")),
-            "yy" => out.push_str(&format!("{:02}", y % 100)),
-            "mm" => out.push_str(&format!("{m:02}")),
-            "m" => out.push_str(&m.to_string()),
-            "dd" => out.push_str(&format!("{d:02}")),
-            "d" => out.push_str(&d.to_string()),
-            "mmm" | "mmmm" => {
-                let Some(name) = m.checked_sub(1).and_then(|i| MONTHS.get(i as usize)) else { return iso.to_string() };
-                match t.len() {
-                    3 => out.push_str(name.get(..3).unwrap_or(name)),
-                    _ => out.push_str(name),
-                }
-            }
-            "ddd" | "dddd" => {
-                let name = WEEKDAYS.get(weekday(y, m, d)).copied().unwrap_or_default();
-                match t.len() {
-                    3 => out.push_str(name.get(..3).unwrap_or(name)),
-                    _ => out.push_str(name),
-                }
-            }
-            other if is_date_run(other) => return iso.to_string(),
-            other => out.push_str(other),
-        }
-    }
-    out
-}
-
-/// A date typed as `pattern` back to `yyyy-mm-dd`. `None` when it doesn't match.
-pub fn pattern_to_iso(text: &str, pattern: &str) -> Option<String> {
-    let text = text.trim();
-    let (mut y, mut m, mut d) = (None, None, None);
-    let mut day_name = None;
-    let mut rest = text;
-    let tokens = date_tokens(pattern);
-    for (i, t) in tokens.iter().enumerate() {
-        match t.as_str() {
-            "yyyy" | "yy" | "mm" | "m" | "dd" | "d" => {
-                // Digits up to the next literal (or a fixed width).
-                let fixed = matches!(t.as_str(), "yyyy" | "yy" | "mm" | "dd");
-                let width =
-                    if fixed { t.len() } else { rest.chars().take_while(char::is_ascii_digit).count().min(if t == "d" || t == "m" { 2 } else { 4 }) };
-                let digits: String = rest.chars().take(width).collect();
-                if digits.is_empty() || !digits.chars().all(|c| c.is_ascii_digit()) {
-                    return None;
-                }
-                let v: u32 = digits.parse().ok()?;
-                rest = &rest[digits.len()..];
-                match t.as_str() {
-                    "yyyy" => y = Some(v),
-                    "yy" => y = Some(if v < 50 { 2000 + v } else { 1900 + v }),
-                    "mm" | "m" => m = Some(v),
-                    _ => d = Some(v),
-                }
-            }
-            "mmm" | "mmmm" => {
-                let (i, len) = name_at(rest, &MONTHS, t.len() == 3)?;
-                m = Some(i as u32 + 1);
-                rest = rest.get(len..)?;
-            }
-            "ddd" | "dddd" => {
-                let (i, len) = name_at(rest, &WEEKDAYS, t.len() == 3)?;
-                day_name = Some(i);
-                rest = rest.get(len..)?;
-            }
-            run if is_date_run(run) => return None,
-            lit => {
-                rest = rest.strip_prefix(lit)?;
-            }
-        }
-        let _ = i;
-    }
-    if !rest.is_empty() {
-        return None;
-    }
-    let (y, m, d) = (y?, m?, d?);
-    if day_name.is_some_and(|w| w != weekday(y, m, d)) {
-        return None;
-    }
-    (1..=12).contains(&m).then(|| format!("{y:04}-{m:02}-{d:02}")).filter(|_| (1..=31).contains(&d))
-}
-
-fn xml_name(s: &str) -> String {
-    let mut out: String = s.chars().map(|c| if c.is_ascii_alphanumeric() || c == '_' || c == '-' || c == '.' { c } else { '_' }).collect();
-    if out.is_empty() || !(out.starts_with(|c: char| c.is_ascii_alphabetic() || c == '_')) {
-        out.insert(0, '_');
-    }
-    out
-}
-
-/// `s` as XML character data. Characters XML 1.0 cannot hold are left out; the flag says
-/// whether any were.
-fn escape(s: &str) -> (String, bool) {
-    let mut out = String::with_capacity(s.len());
-    let mut dropped = false;
-    for c in s.chars() {
-        match c {
-            '&' => out.push_str("&amp;"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            '"' => out.push_str("&quot;"),
-            // Parsers turn a raw carriage return into a line feed; a reference keeps it.
-            '\r' => out.push_str("&#xD;"),
-            '\u{FFFE}' | '\u{FFFF}' => dropped = true,
-            c if c.is_control() && c != '\n' && c != '\t' => dropped = true,
-            c => out.push(c),
-        }
-    }
-    (out, dropped)
-}
-
-/// Most data nodes one write may create (instances skipped by a SOM index count too).
-const MAX_NEW_NODES: usize = 20_000;
-/// Highest same-name sibling index a write follows.
-const MAX_INDEX: usize = 10_000;
-/// Most bytes of names the nodes one write creates hold together: every sibling an index
-/// skips over gets its own copy of the name.
-const MAX_NEW_NAME_BYTES: usize = 4 << 20;
-
-/// What one write may still create: nodes and bytes of their names.
-struct NewNodes {
-    nodes: usize,
-    name_bytes: usize,
-}
-
-impl NewNodes {
-    fn new() -> NewNodes {
-        NewNodes { nodes: MAX_NEW_NODES, name_bytes: MAX_NEW_NAME_BYTES }
-    }
-}
-
-/// A data tree being built for writing.
-#[derive(Default)]
-struct Build {
-    name: String,
-    text: String,
-    children: Vec<Build>,
-    /// Positions in `children` by name, in order.
-    by_name: HashMap<String, Vec<usize>>,
-}
-
-impl Build {
-    /// The node at `path` below this one, created as needed. `None` when the path is deeper
-    /// than [`MAX_DEPTH`], an index is above [`MAX_INDEX`], or creating it would spend more
-    /// new nodes or name bytes than `budget` holds.
-    fn at(&mut self, path: &[(String, usize)], budget: &mut NewNodes) -> Option<&mut Build> {
-        if path.len() > MAX_DEPTH {
-            return None;
-        }
-        let mut node = self;
-        for (name, idx) in path {
-            if *idx > MAX_INDEX {
-                return None;
-            }
-            let name = xml_name(name);
-            let have = node.by_name.get(&name).map_or(0, Vec::len);
-            if *idx >= have {
-                let need = idx - have + 1;
-                let bytes = need.saturating_mul(name.len());
-                if need > budget.nodes || bytes > budget.name_bytes {
-                    return None;
-                }
-                budget.nodes -= need;
-                budget.name_bytes -= bytes;
-                let start = node.children.len();
-                node.children.extend((0..need).map(|_| Build { name: name.clone(), ..Default::default() }));
-                node.by_name.entry(name.clone()).or_default().extend(start..start + need);
-            }
-            let pos = *node.by_name.get(&name)?.get(*idx)?;
-            node = node.children.get_mut(pos)?;
-        }
-        Some(node)
-    }
-
-    /// The tree as XML. Depth is bounded by [`Build::at`].
-    fn write(&self, out: &mut String) {
-        if self.children.is_empty() {
-            out.push_str(&format!("<{}>{}</{}>", self.name, escape(&self.text).0, self.name));
-            return;
-        }
-        out.push_str(&format!("<{}>", self.name));
-        self.write_children(out);
-        out.push_str(&format!("</{}>", self.name));
-    }
-
-    fn write_children(&self, out: &mut String) {
-        for c in &self.children {
-            c.write(out);
-        }
-    }
-}
-
-/// A value to write: where (the field's SOM path, and the data path it binds to) and what.
-struct Want {
-    som: String,
-    path: DataPath,
-    text: String,
-    /// Create the node even for an empty value (an instance of a repeating subform).
-    ensure: bool,
-}
-
-/// `tpl`, or the document's own template when none is given (parsed once).
-fn with_template<T>(doc: &Document, tpl: Option<&Template>, f: impl FnOnce(Option<&Template>) -> T) -> T {
-    match tpl {
-        Some(t) => f(Some(t)),
-        None => {
-            let parsed = crate::script::template_of(doc).ok();
-            f(parsed.as_ref())
-        }
-    }
-}
-
-/// [`data_path`] when the template is known, else [`som_to_path`].
-fn path_of(tpl: Option<&Template>, som: &str) -> DataPath {
-    match tpl {
-        Some(t) => data_path(t, som),
-        None => som_to_path(som),
-    }
-}
-
-/// The values the datasets should hold for `fields`, by data path: dates in each field's data
-/// picture (or ISO), check and radio states, choice values as saved.
-fn wanted(doc: &Document, fields: &[FieldDatum], tpl: Option<&Template>) -> Vec<Want> {
-    let mut out = Vec::new();
-    for f in fields {
-        let som = som_of(doc, f);
-        let path = path_of(tpl, &som);
-        if path.is_empty() {
-            continue;
-        }
-        let text = match &f.data {
-            FieldData::Text(t) => match date_pattern_of(doc, f) {
-                Some(p) => match pattern_to_iso(t, &p) {
-                    // The date goes into the data in the field's data picture, or as an ISO date.
-                    Some(iso) => iso_to_data(iso, data_date_pattern(tpl, &som).as_deref()),
-                    None => t.clone(),
-                },
-                None => t.clone(),
-            },
-            FieldData::Check(on) => {
-                let (on_item, off_item) = items_of(doc, f);
-                if *on { on_item } else { off_item }
-            }
-            FieldData::Radio(sel) => radio_dataset_value(doc, f, sel),
-            FieldData::None => continue,
-        };
-        out.push(Want { som, path, text, ensure: false });
-    }
-    out
-}
-
-/// What a rewrite of the datasets packet does.
-#[derive(Clone, Copy)]
-enum Op<'a> {
-    /// Put these values in (adding nodes as needed).
-    Values(&'a [Want]),
-    /// Take the node at this path out.
-    Remove(&'a DataPath),
-    /// Make these nodes the whole content of the `xfa:data` element (an import).
-    ReplaceData(&'a [ImportNode]),
-    /// Make the leaf at this path a picture: base64 text with its content type.
-    Picture(&'a DataPath, &'a str, &'a str),
-}
-
-/// Note that a value could not be written (once per kind of reason, naming a few fields).
-fn skipped(warnings: &mut Vec<String>, reason: &str, som: &str) {
-    const MAX_WARNINGS: usize = 20;
-    if let Some(w) = warnings.iter_mut().find(|w| w.starts_with(reason)) {
-        if w.matches(", ").count() < 4 {
-            w.push_str(&format!(", {som}"));
-        } else if !w.ends_with('…') {
-            w.push_str(", …");
-        }
-    } else if warnings.len() < MAX_WARNINGS {
-        warnings.push(format!("{reason}: {som}"));
-    }
-}
-
-const TOO_MANY: &str = "XFA data not written for fields whose data path is too deep or repeats too often";
-const STRUCTURED: &str = "XFA data not written for fields whose data node holds structured content";
-const CONFLICT: &str = "XFA data not written for fields bound to the same data node as another field";
-const CONTROL: &str = "Characters XML can't hold were left out of the XFA data of";
-
-/// Fresh data for `wants`: the children of an `xfa:data` element.
-fn build_children(wants: &[Want], warnings: &mut Vec<String>) -> String {
-    let mut root = Build::default();
-    let mut budget = NewNodes::new();
-    for w in wants {
-        match root.at(&w.path, &mut budget) {
-            Some(node) => node.text = w.text.clone(),
-            None => skipped(warnings, TOO_MANY, &w.som),
-        }
-        if escape(&w.text).1 {
-            skipped(warnings, CONTROL, &w.som);
-        }
-    }
-    let mut out = String::new();
-    root.write_children(&mut out);
-    out
-}
-
-/// The `xfa:data` element for `fields`, built afresh.
-pub fn build_data(doc: &Document, fields: &[FieldDatum]) -> String {
-    let wants = with_template(doc, None, |t| wanted(doc, fields, t));
-    format!("<xfa:data>{}</xfa:data>", build_children(&wants, &mut Vec::new()))
-}
-
-fn fresh_datasets(data_children: &str) -> String {
-    format!("<xfa:datasets xmlns:xfa=\"{XFA_DATA_NS}\"><xfa:data>{data_children}</xfa:data></xfa:datasets>")
-}
-
-/// Where an element's start tag ends (the index of its `>`), skipping quoted attribute values.
-fn start_tag_end(src: &str, range: &std::ops::Range<usize>) -> Option<usize> {
-    let bytes = src.as_bytes();
-    let mut quote = None;
-    for i in range.clone() {
-        let b = *bytes.get(i)?;
-        match (quote, b) {
-            (Some(q), _) if b == q => quote = None,
-            (Some(_), _) => {}
-            (None, b'"' | b'\'') => quote = Some(b),
-            (None, b'>') => return Some(i),
-            _ => {}
-        }
-    }
-    None
-}
-
-/// An element's qualified name as written.
-fn qname<'s>(src: &'s str, range: &std::ops::Range<usize>) -> Option<&'s str> {
-    let rest = src.get(range.start.checked_add(1)?..range.end)?;
-    let end = rest.find(|c: char| c.is_whitespace() || c == '/' || c == '>')?;
-    rest.get(..end).filter(|n| !n.is_empty())
-}
-
-/// One change to the packet text: replace `start..end` with `text`.
-struct Edit {
-    start: usize,
-    end: usize,
-    text: String,
-}
-
-/// The edit that puts `inner` (markup) at the end of `node`'s content.
-fn append_edit(src: &str, node: roxmltree::Node, inner: &str) -> Option<Edit> {
-    let range = node.range();
-    let tag_end = start_tag_end(src, &range)?;
-    if tag_end.checked_add(1)? == range.end && src.get(..tag_end)?.ends_with('/') {
-        // `<a/>` becomes `<a>inner</a>`.
-        let name = qname(src, &range)?;
-        return Some(Edit { start: tag_end.checked_sub(1)?, end: range.end, text: format!(">{inner}</{name}>") });
-    }
-    let close = range.start + src.get(range.clone())?.rfind("</")?;
-    Some(Edit { start: close, end: close, text: inner.to_string() })
-}
-
-/// The edit that makes `text` (escaped) the whole content of the leaf `node`.
-fn replace_edit(src: &str, node: roxmltree::Node, text: &str) -> Option<Edit> {
-    let range = node.range();
-    let tag_end = start_tag_end(src, &range)?;
-    if tag_end.checked_add(1)? == range.end && src.get(..tag_end)?.ends_with('/') {
-        let name = qname(src, &range)?;
-        return Some(Edit { start: tag_end.checked_sub(1)?, end: range.end, text: format!(">{text}</{name}>") });
-    }
-    let close = range.start + src.get(range.clone())?.rfind("</")?;
-    (close > tag_end).then(|| Edit { start: tag_end + 1, end: close, text: text.to_string() })
-}
-
-/// What merging the values into a packet's text came to.
-enum Merged {
-    /// The data already holds every value.
-    Unchanged,
-    Changed(String),
-    /// The text could not be merged into (the reason is in the warnings).
-    Failed,
-}
-
-/// Where a datasets packet sits: one packet of an array (`Packet`), or inside the whole XDP.
-#[derive(Clone, Copy, PartialEq)]
-enum Within {
-    Packet,
-    Xdp,
-}
-
-const WRAP_OPEN: &str = "<pdfcraft-wrap xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\" xmlns:xdp=\"http://ns.adobe.com/xdp/\">";
-const WRAP_CLOSE: &str = "</pdfcraft-wrap>";
-
-/// Write `wants` into the data of the datasets packet in `text`, changing only what has to
-/// change: values go into the data nodes they bind to, missing nodes are added, and everything
-/// else (data no field binds to, other namespaces, attributes, comments, layout) stays as
-/// written.
-/// The prefix bound to the XFA data namespace where `n` is (`None`: unbound or the default
-/// namespace, which attributes can't use).
-fn xfa_prefix(n: roxmltree::Node) -> Option<String> {
-    n.namespaces().find(|ns| ns.uri() == XFA_DATA_NS).and_then(|ns| ns.name()).filter(|p| !p.is_empty()).map(str::to_string)
-}
-
-/// Data read from a file, held as a tree so it can be written into any packet with the
-/// prefix that packet uses, never as the file's own markup.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct ImportNode {
-    pub name: String,
-    /// The element's namespace (`None`: none).
-    pub ns: Option<String>,
-    /// `(namespace, name, value)`.
-    pub attrs: Vec<(Option<String>, String, String)>,
-    pub text: String,
-    pub children: Vec<ImportNode>,
-}
-
-/// Deepest data an import keeps.
-const MAX_IMPORT_DEPTH: usize = MAX_DEPTH;
-
-/// Most bytes of names, namespaces, attributes and text an import copies out of its file: a
-/// namespace declared once is copied into every element and attribute that inherits it.
-pub(crate) const MAX_IMPORT_BYTES: usize = 4 * MAX_IMPORT;
-
-/// What an import may still copy: nodes and bytes.
-struct ImportBudget {
-    nodes: usize,
-    bytes: usize,
-}
-
-impl ImportBudget {
-    fn new() -> ImportBudget {
-        ImportBudget { nodes: MAX_NODES as usize, bytes: MAX_IMPORT_BYTES }
-    }
-
-    fn take_bytes(&mut self, n: usize) -> Result<(), XfaError> {
-        self.bytes = self
-            .bytes
-            .checked_sub(n)
-            .ok_or_else(|| XfaError::TooLarge(format!("the data file expands to more than {} MB", MAX_IMPORT_BYTES >> 20)))?;
-        Ok(())
-    }
-}
-
-/// `n` as an [`ImportNode`], counting nodes and copied bytes against `budget`; `TooLarge` past
-/// the depth or either budget.
-fn import_node(n: roxmltree::Node, depth: usize, budget: &mut ImportBudget) -> Result<ImportNode, XfaError> {
-    if depth > MAX_IMPORT_DEPTH {
-        return Err(XfaError::TooLarge(format!("the data file nests more than {MAX_IMPORT_DEPTH} levels deep")));
-    }
-    budget.nodes = budget.nodes.checked_sub(1).ok_or_else(|| XfaError::TooLarge("the data file holds too many nodes".into()))?;
-    let name = n.tag_name().name();
-    let ns = n.tag_name().namespace();
-    budget.take_bytes(name.len().saturating_add(ns.map_or(0, str::len)))?;
-    let mut attrs = Vec::new();
-    for a in n.attributes().filter(|a| a.name() != "xmlns" && a.namespace() != Some("http://www.w3.org/2000/xmlns/")) {
-        budget.take_bytes(a.namespace().map_or(0, str::len).saturating_add(a.name().len()).saturating_add(a.value().len()))?;
-        attrs.push((a.namespace().map(str::to_string), a.name().to_string(), a.value().to_string()));
-    }
-    let mut children = Vec::new();
-    let mut text = String::new();
-    for c in n.children() {
-        if c.is_element() {
-            children.push(import_node(c, depth + 1, budget)?);
-        } else if let Some(t) = c.text() {
-            budget.take_bytes(t.len())?;
-            text.push_str(t);
-        }
-    }
-    // A group's own text is layout whitespace.
-    if !children.is_empty() && text.trim().is_empty() {
-        text.clear();
-    }
-    Ok(ImportNode { name: name.to_string(), ns: ns.map(str::to_string), attrs, text, children })
-}
-
-/// `nodes` as markup for a packet whose XFA data namespace prefix is `xfa` (declared where
-/// they go); other namespaces are declared on the elements and attributes that use them.
-fn serialize_nodes(nodes: &[ImportNode], xfa: &str) -> String {
-    let mut out = String::new();
-    for n in nodes {
-        serialize_node(n, xfa, &mut out, 0);
-    }
-    out
-}
-
-fn serialize_node(n: &ImportNode, xfa: &str, out: &mut String, depth: usize) {
-    if depth > MAX_IMPORT_DEPTH {
-        return;
-    }
-    let mut decls: Vec<(String, String)> = Vec::new();
-    let mut qualify = |ns: &Option<String>, name: &str, attr: bool| -> String {
-        match ns.as_deref() {
-            None => xml_name(name),
-            Some(uri) if uri == XFA_DATA_NS => format!("{xfa}:{}", xml_name(name)),
-            Some("http://www.w3.org/XML/1998/namespace") => format!("xml:{}", xml_name(name)),
-            Some(uri) => {
-                let p = match decls.iter().position(|(_, u)| u == uri) {
-                    Some(i) => format!("n{i}"),
-                    None => {
-                        decls.push((format!("n{}", decls.len()), uri.to_string()));
-                        format!("n{}", decls.len() - 1)
-                    }
-                };
-                let _ = attr;
-                format!("{p}:{}", xml_name(name))
-            }
-        }
-    };
-    let tag = qualify(&n.ns, &n.name, false);
-    let attrs: Vec<String> = n
-        .attrs
-        .iter()
-        .take(256)
-        .map(|(ns, name, value)| {
-            let q = qualify(ns, name, true);
-            format!(" {q}=\"{}\"", escape(value).0)
-        })
-        .collect();
-    out.push('<');
-    out.push_str(&tag);
-    for (p, uri) in &decls {
-        out.push_str(&format!(" xmlns:{p}=\"{}\"", escape(uri).0));
-    }
-    for a in &attrs {
-        out.push_str(a);
-    }
-    if n.text.is_empty() && n.children.is_empty() {
-        out.push_str("/>");
-        return;
-    }
-    out.push('>');
-    out.push_str(&escape(&n.text).0);
-    for c in &n.children {
-        serialize_node(c, xfa, out, depth + 1);
-    }
-    out.push_str(&format!("</{tag}>"));
-}
-
-fn merge(text: &str, within: Within, op: Op, warnings: &mut Vec<String>) -> Merged {
-    let wants: &[Want] = match op {
-        Op::Values(w) => w,
-        Op::Remove(_) | Op::ReplaceData(_) | Op::Picture(..) => &[],
-    };
-    // Fresh data, where none exists yet (declared with the `xfa` prefix).
-    let fresh_children = |warnings: &mut Vec<String>| match op {
-        Op::ReplaceData(nodes) => serialize_nodes(nodes, "xfa"),
-        _ => build_children(wants, warnings),
-    };
-    if crate::xml_nesting_depth(text) > crate::MAX_XML_DEPTH {
-        warnings.push("The XFA data nests XML elements deeper than the reader accepts; the field values were not written to it".into());
-        return Merged::Failed;
-    }
-    let opts = || roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
-    // A packet of an array may use the prefixes the XDP envelope declares: read it inside
-    // an element declaring the usual ones.
-    let wrapped;
-    let (src, shift, parsed) = match roxmltree::Document::parse_with_options(text, opts()) {
-        Ok(d) => (text, 0, d),
-        Err(first) => {
-            wrapped = format!("{WRAP_OPEN}{text}{WRAP_CLOSE}");
-            match (within, roxmltree::Document::parse_with_options(&wrapped, opts())) {
-                (Within::Packet, Ok(d)) => (wrapped.as_str(), WRAP_OPEN.len(), d),
-                _ => {
-                    warnings.push(format!("The XFA data could not be read ({first}); the field values were not written to it"));
-                    return Merged::Failed;
-                }
-            }
-        }
-    };
-    let is = |n: &roxmltree::Node, name: &str| n.is_element() && n.tag_name().name() == name;
-    let datasets = parsed
-        .descendants()
-        .find(|n| is(n, "datasets") && n.tag_name().namespace() == Some(XFA_DATA_NS))
-        .or_else(|| parsed.descendants().find(|n| is(n, "datasets")));
-    let mut edits = Vec::new();
-    let mut data = None;
-    match datasets {
-        None if matches!(op, Op::Remove(_) | Op::Picture(..)) => return Merged::Unchanged,
-        None if within == Within::Xdp => {
-            let root = parsed.root_element();
-            let children = fresh_children(warnings);
-            match append_edit(src, root, &fresh_datasets(&children)) {
-                Some(e) => edits.push(e),
-                None => {
-                    warnings.push("The XFA packets could not be extended with data; the field values were not written".into());
-                    return Merged::Failed;
-                }
-            }
-        }
-        None => {
-            warnings.push("The XFA datasets packet holds no datasets element; the field values were not written to it".into());
-            return Merged::Failed;
-        }
-        Some(ds) => match ds.children().find(|n| is(n, "data")) {
-            Some(d) => data = Some(d),
-            None if matches!(op, Op::Remove(_) | Op::Picture(..)) => return Merged::Unchanged,
-            None => {
-                let prefix = qname(src, &ds.range()).and_then(|q| q.split_once(':')).map(|(p, _)| format!("{p}:")).unwrap_or_default();
-                let children = fresh_children(warnings);
-                let element = format!("<{prefix}data>{}</{prefix}data>", children);
-                match append_edit(src, ds, &element) {
-                    Some(e) => edits.push(e),
-                    None => {
-                        warnings.push("The XFA datasets could not be extended with data; the field values were not written".into());
-                        return Merged::Failed;
-                    }
-                }
-            }
-        },
-    }
-    if let Some(data) = data {
-        match op {
-            Op::Values(w) => merge_values(src, data, w, &mut edits, warnings),
-            Op::ReplaceData(nodes) => {
-                // Everything between the start and end tags; `<xfa:data/>` opens up. Written
-                // with the prefix the packet binds to the data namespace.
-                let prefix = xfa_prefix(data);
-                let markup = serialize_nodes(nodes, prefix.as_deref().unwrap_or("xfa"));
-                let range = data.range();
-                match (start_tag_end(src, &range), qname(src, &range)) {
-                    (Some(tag_end), Some(name)) if tag_end + 1 == range.end && src.get(..tag_end).is_some_and(|s| s.ends_with('/')) => {
-                        edits.push(Edit { start: range.start, end: range.end, text: format!("<{name}>{markup}</{name}>") });
-                    }
-                    (Some(tag_end), _) => {
-                        let close = src.get(range.clone()).and_then(|s| s.rfind("</")).map(|c| range.start + c);
-                        match close {
-                            Some(close) if tag_end < close => edits.push(Edit { start: tag_end + 1, end: close, text: markup }),
-                            _ => {
-                                warnings.push("The XFA data element could not be rewritten; the data was not imported".into());
-                                return Merged::Failed;
-                            }
-                        }
-                    }
-                    _ => {
-                        warnings.push("The XFA data element could not be rewritten; the data was not imported".into());
-                        return Merged::Failed;
-                    }
-                }
-            }
-            Op::Picture(path, content_type, base64) => {
-                let mut node = Some(data);
-                for (name, idx) in path.iter() {
-                    let want = xml_name(name);
-                    node = node.and_then(|n| n.children().filter(|c| c.is_element() && c.tag_name().name() == want).nth(*idx));
-                }
-                let Some(n) = node else { return Merged::Unchanged };
-                if n.children().any(|c| c.is_element()) {
-                    // A data group, not a leaf: a picture would wipe what's under it.
-                    skipped(warnings, STRUCTURED, &path.iter().map(|(n, i)| format!("{n}[{i}]")).collect::<Vec<_>>().join("."));
-                    return Merged::Failed;
-                }
-                let name = qname(src, &n.range()).unwrap_or("value").to_string();
-                let (ct, _) = escape(content_type);
-                let attr = match xfa_prefix(n) {
-                    Some(p) => format!("{p}:contentType=\"{ct}\""),
-                    None => format!("xmlns:xfa=\"{XFA_DATA_NS}\" xfa:contentType=\"{ct}\""),
-                };
-                edits.push(Edit { start: n.range().start, end: n.range().end, text: format!("<{name} {attr}>{base64}</{name}>") });
-            }
-            Op::Remove(path) => {
-                // The element at `path`, with the whitespace before it.
-                let mut node = Some(data);
-                for (name, idx) in path {
-                    node = node.and_then(|n| n.children().filter(|c| c.is_element() && c.tag_name().name() == name).nth(*idx));
-                }
-                if let Some(n) = node {
-                    let r = n.range();
-                    let start = src.get(..r.start).map_or(r.start, |before| r.start - before.len() + before.trim_end().len());
-                    edits.push(Edit { start, end: r.end, text: String::new() });
-                }
-            }
-        }
-    }
-    if edits.is_empty() {
-        return Merged::Unchanged;
-    }
-    // Apply from the end, so earlier positions stay valid; overlapping edits (two fields bound
-    // to one node) keep the first.
-    edits.sort_by_key(|e| (e.start, e.end));
-    let mut kept: Vec<Edit> = Vec::with_capacity(edits.len());
-    for e in edits {
-        if kept.last().is_some_and(|k| e.start < k.end) {
-            if kept.last().is_some_and(|k| k.text != e.text) && !warnings.iter().any(|w| w == CONFLICT) {
-                warnings.push(CONFLICT.into());
-            }
-            continue;
-        }
-        kept.push(e);
-    }
-    let mut out = src.to_string();
-    for e in kept.iter().rev() {
-        if out.get(e.start..e.end).is_none() {
-            warnings.push("The XFA data could not be updated; the field values were not written to it".into());
-            return Merged::Failed;
-        }
-        out.replace_range(e.start..e.end, &e.text);
-    }
-    if shift > 0 {
-        match out.get(shift..out.len().saturating_sub(WRAP_CLOSE.len())) {
-            Some(inner) => out = inner.to_string(),
-            None => return Merged::Failed,
-        }
-    }
-    Merged::Changed(out)
-}
-
-/// The edits that put `wants` into the `data` element.
-fn merge_values(src: &str, data: roxmltree::Node, wants: &[Want], edits: &mut Vec<Edit>, warnings: &mut Vec<String>) {
-    // Element children by local name, per element visited (built once each).
-    let mut index: HashMap<roxmltree::NodeId, HashMap<String, Vec<roxmltree::NodeId>>> = HashMap::new();
-    let tree = data.document();
-    // Nodes to add, per existing element they go into.
-    let mut added: Vec<(roxmltree::NodeId, Build)> = Vec::new();
-    let mut budget = NewNodes::new();
-    for w in wants {
-        let (escaped, dropped) = escape(&w.text);
-        let mut node = data;
-        let mut depth = 0;
-        let mut have = 0;
-        for (name, idx) in &w.path {
-            let kids = index.entry(node.id()).or_insert_with(|| {
-                let mut by: HashMap<String, Vec<roxmltree::NodeId>> = HashMap::new();
-                for c in node.children().filter(|c| c.is_element()) {
-                    by.entry(c.tag_name().name().to_string()).or_default().push(c.id());
-                }
-                by
-            });
-            let same = kids.get(name.as_str());
-            match same.and_then(|v| v.get(*idx)).and_then(|id| tree.get_node(*id)) {
-                Some(next) => {
-                    node = next;
-                    depth += 1;
-                }
-                None => {
-                    have = same.map_or(0, Vec::len);
-                    break;
-                }
-            }
-        }
-        if depth == w.path.len() {
-            // The data node exists: give it the value, unless it already holds it. A node
-            // only wanted to exist (a row instance) is left as it is.
-            if w.ensure && w.text.is_empty() {
-                continue;
-            }
-            let current: String = node.children().filter(|c| c.is_text()).filter_map(|c| c.text()).collect();
-            if node.children().any(|c| c.is_element()) {
-                let all: String = node.descendants().filter(|c| c.is_text()).filter_map(|c| c.text()).collect();
-                // Ignore existing XML indentation, but not whitespace in the accepted value.
-                // A skipped mismatch must warn: relayout would otherwise use stale data.
-                if all.trim() != w.text {
-                    skipped(warnings, STRUCTURED, &w.som);
-                }
-                continue;
-            }
-            if current == w.text {
-                continue;
-            }
-            match replace_edit(src, node, &escaped) {
-                Some(e) => edits.push(e),
-                None => skipped(warnings, STRUCTURED, &w.som),
-            }
-        } else {
-            // Missing: add the rest of the path below the deepest node that exists. An empty
-            // value needs no node, unless the node itself is wanted (a new instance).
-            if w.text.is_empty() && !w.ensure {
-                continue;
-            }
-            let mut rest: DataPath = w.path.get(depth..).unwrap_or_default().to_vec();
-            if let Some(first) = rest.first_mut() {
-                first.1 = first.1.saturating_sub(have);
-            }
-            let pos = match added.iter().position(|(id, _)| *id == node.id()) {
-                Some(p) => p,
-                None => {
-                    added.push((node.id(), Build::default()));
-                    added.len() - 1
-                }
-            };
-            let built = added.get_mut(pos).and_then(|(_, b)| b.at(&rest, &mut budget));
-            match built {
-                Some(b) => b.text = w.text.clone(),
-                None => {
-                    skipped(warnings, TOO_MANY, &w.som);
-                    continue;
-                }
-            }
-        }
-        if dropped {
-            skipped(warnings, CONTROL, &w.som);
-        }
-    }
-    for (id, build) in added {
-        let Some(node) = tree.get_node(id) else { continue };
-        let mut inner = String::new();
-        build.write_children(&mut inner);
-        match append_edit(src, node, &inner) {
-            Some(e) => edits.push(e),
-            None => warnings.push("Some XFA data nodes could not be added; their field values were not written".into()),
-        }
-    }
-}
-
-/// What [`write_datasets`] did.
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct DatasetsWrite {
-    /// The datasets packet changed (a new revision of it was added to the document).
-    pub written: bool,
-    /// Values that could not be written, and why.
-    pub warnings: Vec<String>,
-    /// The datasets stream written, when one was.
-    pub stream: Option<ObjRef>,
-}
-
-/// A packet stream's text and encoding; `None` (with a warning) when it can't be read exactly.
-fn packet_text(doc: &Document, o: &Object, warnings: &mut Vec<String>) -> Option<(String, Encoding)> {
-    let s = doc.resolve(o);
-    let Object::Stream(s) = &*s else {
-        warnings.push("The XFA data packet is not a stream; the field values were not written to it".into());
-        return None;
-    };
-    let bytes = match s.decoded_within(64 << 20) {
-        Ok(b) => b,
-        Err(e) => {
-            warnings.push(format!("The XFA data could not be decoded ({e}); the field values were not written to it"));
-            return None;
-        }
-    };
-    let decoded = crate::packets::decode(&bytes);
-    if decoded.is_none() {
-        warnings.push("The XFA data is neither UTF-8 nor UTF-16; the field values were not written to it, so it stays as it was".into());
-    }
-    decoded
-}
-
-/// Write the fields' values into the datasets packet, keeping all the data no field binds to.
-/// Nothing is written when the document has no XFA entry or the data already holds the values;
-/// values that can't be written are reported, never silently dropped.
-pub fn write_datasets(doc: &mut Document, fields: &[FieldDatum]) -> Result<DatasetsWrite, XfaError> {
-    write_datasets_reusing(doc, fields, None)
-}
-
-/// [`write_datasets`], replacing the stream `reuse` in place when the packet is that stream
-/// (written earlier in the same edit) rather than adding another.
-pub fn write_datasets_reusing(doc: &mut Document, fields: &[FieldDatum], reuse: Option<ObjRef>) -> Result<DatasetsWrite, XfaError> {
-    write_datasets_with(doc, None, fields, reuse)
-}
-
-/// [`write_datasets_reusing`] with the form's parsed template when the caller has it (it says
-/// which SOM segments are areas, see [`data_path`]); `None` parses the document's.
-pub fn write_datasets_with(
-    doc: &mut Document,
-    tpl: Option<&Template>,
-    fields: &[FieldDatum],
-    reuse: Option<ObjRef>,
-) -> Result<DatasetsWrite, XfaError> {
-    let wants = with_template(doc, tpl, |t| wanted(doc, fields, t));
-    rewrite(doc, &[Op::Values(&wants)], reuse)
-}
-
 /// One change to the data, for [`write_data_ops`].
 #[derive(Clone, Debug, PartialEq)]
 pub enum DataOp {
@@ -1316,481 +152,3 @@ impl DataNode {
         }
     }
 }
-
-fn path_som(path: &DataPath) -> String {
-    path.iter().map(|(n, i)| format!("{n}[{i}]")).collect::<Vec<_>>().join(".")
-}
-
-/// Make sure the data has at least `count` instances of `name` under `parent` (a script added
-/// rows: the layout repeats the subform once per data instance).
-pub fn add_data_instances(doc: &mut Document, parent: &DataPath, name: &str, count: usize) -> Result<DatasetsWrite, XfaError> {
-    write_data_ops(doc, &[DataOp::Instances { parent: parent.clone(), name: name.to_string(), count }], None)
-}
-
-/// Put `text` at the data node `path` (a field with no widget, a hidden one or a draw, that a
-/// script gave a value), adding the node as needed.
-pub fn write_data_value(doc: &mut Document, path: &DataPath, text: &str) -> Result<DatasetsWrite, XfaError> {
-    write_data_ops(doc, &[DataOp::Value { path: path.clone(), text: text.to_string() }], None)
-}
-
-/// Remove the data node at `path` (a script removed a row).
-pub fn remove_data_instance(doc: &mut Document, path: &DataPath) -> Result<DatasetsWrite, XfaError> {
-    write_data_ops(doc, &[DataOp::Remove(path.clone())], None)
-}
-
-/// Largest picture written into the data (its bytes, before base64): with the 64 MB cap on
-/// all packets together, several pictures still fit.
-const MAX_DATA_IMAGE: usize = 8 << 20;
-/// Longest data file imported.
-const MAX_IMPORT: usize = 16 << 20;
-
-/// Put a picture into the data node at `path` as Designer saves one a user chose: base64, with
-/// its content type (`image/png`, …) as `xfa:contentType` (in the packet's own prefix). The
-/// node is made when missing; a data group is refused rather than wiped. `reuse`: the stream
-/// this edit already wrote.
-pub fn write_data_image(
-    doc: &mut Document,
-    path: &DataPath,
-    content_type: &str,
-    bytes: &[u8],
-    reuse: Option<ObjRef>,
-) -> Result<DatasetsWrite, XfaError> {
-    use base64::Engine;
-    if path.is_empty() {
-        return Err(XfaError::Malformed("a picture needs a data path".into()));
-    }
-    if bytes.len() > MAX_DATA_IMAGE {
-        return Err(XfaError::TooLarge(format!("the picture is larger than {} MB", MAX_DATA_IMAGE >> 20)));
-    }
-    let ct: String = content_type.chars().filter(|c| c.is_ascii_alphanumeric() || matches!(c, '/' | '-' | '.' | '+')).take(64).collect();
-    let b64 = base64::engine::general_purpose::STANDARD.encode(bytes);
-    let ensure = [Want { som: String::new(), path: path.clone(), text: String::new(), ensure: true }];
-    rewrite(doc, &[Op::Values(&ensure), Op::Picture(path, &ct, &b64)], reuse)
-}
-
-/// What an import of a data file did.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct DataImport {
-    /// Element nodes the new data holds.
-    pub nodes: usize,
-    pub warnings: Vec<String>,
-    /// The datasets stream written.
-    pub stream: Option<ObjRef>,
-}
-
-/// The data a file holds, as the children of `xfa:data`: an XDP or datasets document (Export
-/// Data's output, Designer's), a bare data element, or a data document whose root is the
-/// form's root data node (named `expect_root`, when the caller knows it). Anything else is
-/// refused: a form's data is never replaced by what is not its data.
-pub fn parse_data_file(text: &str, expect_root: Option<&str>) -> Result<Vec<ImportNode>, XfaError> {
-    if text.len() > MAX_IMPORT {
-        return Err(XfaError::TooLarge(format!("the data file is larger than {} MB", MAX_IMPORT >> 20)));
-    }
-    let text = text.trim_start_matches('\u{feff}');
-    if crate::xml_nesting_depth(text) > MAX_IMPORT_DEPTH {
-        return Err(XfaError::TooLarge(format!("the data file nests more than {MAX_IMPORT_DEPTH} levels deep")));
-    }
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
-    let parsed = roxmltree::Document::parse_with_options(text, opts).map_err(|e| XfaError::Malformed(format!("the data file is not XML: {e}")))?;
-    let root = parsed.root_element();
-    let local = root.tag_name().name();
-    let in_xfa = |n: &roxmltree::Node| n.tag_name().namespace().is_none_or(|ns| ns == XFA_DATA_NS);
-    let is = |n: &roxmltree::Node, name: &str| n.is_element() && n.tag_name().name() == name && in_xfa(n);
-    let data = match local {
-        "xdp" => {
-            let ds = root.children().find(|n| is(n, "datasets")).ok_or_else(|| XfaError::Malformed("the XDP holds no datasets".into()))?;
-            ds.children().find(|n| is(n, "data")).ok_or_else(|| XfaError::Malformed("the datasets hold no data element".into()))?
-        }
-        "datasets" if in_xfa(&root) => {
-            root.children().find(|n| is(n, "data")).ok_or_else(|| XfaError::Malformed("the datasets hold no data element".into()))?
-        }
-        "data" if in_xfa(&root) => root,
-        _ => {
-            if root.tag_name().namespace().is_some() {
-                return Err(XfaError::Malformed(format!("<{local}> is not XFA form data")));
-            }
-            if let Some(want) = expect_root
-                && local != want
-            {
-                return Err(XfaError::Malformed(format!("the data file's root is <{local}>; this form's data root is <{want}>")));
-            }
-            let node = import_node(root, 0, &mut ImportBudget::new())?;
-            return Ok(vec![node]);
-        }
-    };
-    let mut budget = ImportBudget::new();
-    let mut out = Vec::new();
-    for c in data.children().filter(|c| c.is_element()) {
-        out.push(import_node(c, 1, &mut budget)?);
-    }
-    Ok(out)
-}
-
-/// Replace the form's data with what the file `text` holds (see [`parse_data_file`]), keeping
-/// the rest of the datasets (data descriptions, say). `reuse`: the stream this edit already
-/// wrote.
-pub fn import_data(doc: &mut Document, text: &str, expect_root: Option<&str>, reuse: Option<ObjRef>) -> Result<DataImport, XfaError> {
-    let nodes = parse_data_file(text, expect_root)?;
-    fn count(n: &[ImportNode]) -> usize {
-        n.iter().map(|c| 1 + count(&c.children)).sum()
-    }
-    let r = rewrite(doc, &[Op::ReplaceData(&nodes)], reuse)?;
-    if !r.written {
-        return Err(XfaError::Malformed(r.warnings.first().cloned().unwrap_or_else(|| "the data could not be written".into())));
-    }
-    Ok(DataImport { nodes: count(&nodes), warnings: r.warnings, stream: r.stream })
-}
-
-/// The datasets packet's text: from the XFA array's `datasets` item, or the whole XDP.
-fn datasets_packet(doc: &Document) -> Result<Option<String>, XfaError> {
-    let Some(root) = doc.root() else { return Ok(None) };
-    let catalog = doc.get(root);
-    let Some(acro) = catalog.as_dict().and_then(|c| c.get(b"AcroForm")).map(|a| doc.resolve(a)) else { return Ok(None) };
-    let Some(xfa) = acro.as_dict().and_then(|a| a.get(b"XFA")).map(|x| doc.resolve(x)) else { return Ok(None) };
-    let text_of = |o: &Object| -> Result<Option<String>, XfaError> {
-        match &*doc.resolve(o) {
-            Object::Stream(s) => Ok(crate::packets::decode(&s.decoded_within(64 << 20)?).map(|(t, _)| t)),
-            _ => Ok(None),
-        }
-    };
-    match &*xfa {
-        Object::Array(items) => {
-            let at = (0..items.len())
-                .step_by(2)
-                .find(|&i| items.get(i).and_then(|n| n.as_string()).is_some_and(|s| s.to_text() == "datasets") && i + 1 < items.len());
-            match at.and_then(|i| items.get(i + 1)) {
-                Some(o) => text_of(o),
-                None => Ok(None),
-            }
-        }
-        Object::Stream(_) => text_of(&xfa),
-        _ => Ok(None),
-    }
-}
-
-/// The data to export, as Acrobat's Export Data writes it: `xdp` false gives an XML document
-/// holding the data alone (the form's root data node at the root, or the data element when
-/// there are several); true gives an XDP holding the whole datasets and a reference to the
-/// PDF, named `pdf_name`. A document whose packets can't be read is an error, not empty data.
-pub fn export_data(doc: &Document, xdp: bool, pdf_name: &str) -> Result<String, XfaError> {
-    if crate::read_packets(doc)?.is_none() {
-        return Err(XfaError::NotXfa);
-    }
-    let packet = datasets_packet(doc)?;
-    let (datasets, data) = match &packet {
-        Some(text) => match datasets_markup(text) {
-            Ok(Some(m)) => m,
-            Ok(None) => (fresh_datasets(""), String::new()),
-            Err(()) => return Err(XfaError::Malformed("the XFA data could not be read".into())),
-        },
-        None => (fresh_datasets(""), String::new()),
-    };
-    let mut out = String::from("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
-    if xdp {
-        let (name, _) = escape(pdf_name);
-        out.push_str("<xdp:xdp xmlns:xdp=\"http://ns.adobe.com/xdp/\">\n");
-        out.push_str(&datasets);
-        out.push_str(&format!("\n<pdf href=\"{name}\" xmlns=\"http://ns.adobe.com/xdp/pdf/\"/>\n</xdp:xdp>\n"));
-    } else {
-        out.push_str(if data.is_empty() { &datasets } else { &data });
-        out.push('\n');
-    }
-    Ok(out)
-}
-
-/// The `xfa:datasets` element of `text` as written, and the data alone (its one child, or the
-/// data element), each with the namespaces it uses declared on it. `Ok(None)`: no datasets
-/// element; `Err`: the text can't be read.
-fn datasets_markup(text: &str) -> Result<Option<(String, String)>, ()> {
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
-    if crate::xml_nesting_depth(text) > crate::MAX_XML_DEPTH {
-        return Err(());
-    }
-    let wrapped = format!("{WRAP_OPEN}{text}{WRAP_CLOSE}");
-    let (src, parsed) = match roxmltree::Document::parse_with_options(text, opts) {
-        Ok(d) => (text, d),
-        Err(_) => (wrapped.as_str(), roxmltree::Document::parse_with_options(&wrapped, opts).map_err(|_| ())?),
-    };
-    let Some(ds) = parsed.descendants().find(|n| n.is_element() && n.tag_name().name() == "datasets") else { return Ok(None) };
-    let data = ds.children().find(|n| n.is_element() && n.tag_name().name() == "data");
-    let data_alone = match data {
-        Some(d) => {
-            let kids: Vec<roxmltree::Node> = d.children().filter(|c| c.is_element()).collect();
-            match kids.as_slice() {
-                [one] => element_markup(src, *one).ok_or(())?,
-                _ => element_markup(src, d).ok_or(())?,
-            }
-        }
-        None => String::new(),
-    };
-    Ok(Some((element_markup(src, ds).ok_or(())?, data_alone)))
-}
-
-/// `n` as written in `src`, with the namespace declarations in scope that its start tag lacks
-/// added to it, so it stands alone.
-fn element_markup(src: &str, n: roxmltree::Node) -> Option<String> {
-    let range = n.range();
-    let text = src.get(range.clone())?;
-    let tag_end = start_tag_end(src, &range)?;
-    let start_tag = src.get(range.start..tag_end)?;
-    let mut decls = String::new();
-    for ns in n.namespaces() {
-        let attr = match ns.name() {
-            Some(p) => format!("xmlns:{p}="),
-            None => "xmlns=".to_string(),
-        };
-        if !start_tag.contains(&attr) {
-            decls.push_str(&format!(" {attr}\"{}\"", escape(ns.uri()).0));
-        }
-    }
-    if decls.is_empty() {
-        return Some(text.to_string());
-    }
-    let name_end = qname(src, &range)?.len() + 1;
-    Some(format!("{}{decls}{}", text.get(..name_end)?, text.get(name_end..)?))
-}
-
-/// Most instance nodes one [`write_data_ops`] queues over all its passes (a removal starts a new
-/// pass, which asks for the instances again).
-const MAX_ENSURED: usize = 200_000;
-
-// Instance nodes write_data_ops has queued on this thread, for tests that bound its work.
-#[cfg(test)]
-thread_local! {
-    pub(crate) static ENSURED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-/// Apply `ops` to the datasets packet, in order, as one rewrite of it: everything one script
-/// event changed becomes a single new datasets stream. When the packet is already the stream
-/// `reuse` (written earlier for the same event), that stream is replaced in place instead of
-/// a new one being added. The stream written is in the report.
-pub fn write_data_ops(doc: &mut Document, ops: &[DataOp], reuse: Option<ObjRef>) -> Result<DatasetsWrite, XfaError> {
-    // Runs of values (and instances) merge in one pass; a value set twice keeps the last.
-    let mut steps: Vec<Vec<Want>> = Vec::new();
-    let mut removes: Vec<Option<DataPath>> = Vec::new();
-    let mut run: Vec<Want> = Vec::new();
-    // Instances queued in this run, by parent and name: asking for more only queues the rest.
-    let mut queued: HashMap<(&DataPath, &str), usize> = HashMap::new();
-    let (mut ensured, mut capped) = (0usize, false);
-    let flush = |run: &mut Vec<Want>, steps: &mut Vec<Vec<Want>>, removes: &mut Vec<Option<DataPath>>| {
-        if !run.is_empty() {
-            let mut seen = std::collections::HashSet::new();
-            let mut kept: Vec<Want> = std::mem::take(run).into_iter().rev().filter(|w| seen.insert((w.ensure, w.path.clone()))).collect();
-            kept.reverse();
-            steps.push(kept);
-            removes.push(None);
-        }
-    };
-    for op in ops {
-        match op {
-            DataOp::Value { path, text } if !path.is_empty() => {
-                // An empty value clears an existing node and needs no new one.
-                run.push(Want { som: path_som(path), path: path.clone(), text: text.clone(), ensure: false });
-            }
-            DataOp::Instances { parent, name, count } => {
-                let done = queued.entry((parent, name.as_str())).or_insert(0);
-                while *done < (*count).min(MAX_INDEX) {
-                    if ensured >= MAX_ENSURED {
-                        capped = true;
-                        break;
-                    }
-                    ensured += 1;
-                    #[cfg(test)]
-                    ENSURED.with(|n| n.set(n.get() + 1));
-                    let k = *done;
-                    *done += 1;
-                    let mut path = parent.clone();
-                    path.push((name.clone(), k));
-                    run.push(Want { som: format!("{name}[{k}]"), path, text: String::new(), ensure: true });
-                }
-            }
-            DataOp::Remove(path) if !path.is_empty() => {
-                flush(&mut run, &mut steps, &mut removes);
-                queued.clear();
-                steps.push(Vec::new());
-                removes.push(Some(path.clone()));
-            }
-            _ => {}
-        }
-    }
-    flush(&mut run, &mut steps, &mut removes);
-    let plan: Vec<Op> = steps
-        .iter()
-        .zip(&removes)
-        .map(|(w, r)| match r {
-            Some(p) => Op::Remove(p),
-            None => Op::Values(w),
-        })
-        .collect();
-    let mut written = rewrite(doc, &plan, reuse)?;
-    if capped {
-        written.warnings.push(format!("XFA data instances not written past {MAX_ENSURED}: the rows were added and removed too often"));
-    }
-    Ok(written)
-}
-
-/// Put `bytes` in the document as a datasets stream: in place of `old` when that is the stream
-/// `reuse`, else as a new object.
-fn put_stream(doc: &mut Document, old: Option<&Object>, reuse: Option<ObjRef>, bytes: &[u8]) -> ObjRef {
-    let stream = Object::Stream(Stream::flate(Dict::new(), bytes));
-    match (old.and_then(Object::as_ref), reuse) {
-        (Some(r), Some(keep)) if r == keep => {
-            doc.set(r, stream);
-            r
-        }
-        _ => doc.add(stream),
-    }
-}
-
-/// Merge `ops` into `text` in order. `None`: nothing changed (or nothing could be merged).
-fn merge_all(text: &str, within: Within, ops: &[Op], warnings: &mut Vec<String>) -> Option<String> {
-    let mut current: Option<String> = None;
-    for op in ops {
-        match merge(current.as_deref().unwrap_or(text), within, *op, warnings) {
-            Merged::Changed(t) => current = Some(t),
-            Merged::Unchanged => {}
-            // Later steps still apply to what merged so far; the reason is in the warnings.
-            Merged::Failed => {}
-        }
-    }
-    current
-}
-
-/// Longest packet text written (the packets together are read up to 64 MB).
-const MAX_PACKET_WRITE: usize = 48 << 20;
-
-/// Is `text` a packet the reader will take back (well-formed, within size)? A rewrite that
-/// isn't is not written: better the old data than an unreadable packet.
-fn readable(text: &str, within: Within, warnings: &mut Vec<String>) -> bool {
-    if text.len() > MAX_PACKET_WRITE {
-        warnings.push(format!("The XFA data would be larger than {} MB; it was not written", MAX_PACKET_WRITE >> 20));
-        return false;
-    }
-    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
-    let ok = roxmltree::Document::parse_with_options(text, opts).is_ok()
-        || (within == Within::Packet && roxmltree::Document::parse_with_options(&format!("{WRAP_OPEN}{text}{WRAP_CLOSE}"), opts).is_ok());
-    if !ok {
-        warnings.push("The XFA data would not be well-formed XML after this change; it was not written".into());
-    }
-    ok
-}
-
-fn rewrite(doc: &mut Document, ops: &[Op], reuse: Option<ObjRef>) -> Result<DatasetsWrite, XfaError> {
-    let mut report = DatasetsWrite::default();
-    if ops.is_empty() {
-        return Ok(report);
-    }
-    let Some(root) = doc.root() else { return Ok(report) };
-    let catalog = doc.get(root);
-    let Some(acro_obj) = catalog.as_dict().and_then(|c| c.get(b"AcroForm")).cloned() else { return Ok(report) };
-    let acro_ref = acro_obj.as_ref();
-    let Some(mut acro) = doc.resolve(&acro_obj).as_dict().cloned() else { return Ok(report) };
-    let Some(xfa) = acro.get(b"XFA").cloned() else { return Ok(report) };
-    let warnings = &mut report.warnings;
-    match &*doc.resolve(&xfa) {
-        Object::Array(items) => {
-            let mut items = items.clone();
-            let at = (0..items.len())
-                .step_by(2)
-                .find(|&i| items.get(i).and_then(|n| n.as_string()).is_some_and(|s| s.to_text() == "datasets") && i + 1 < items.len());
-            match at {
-                Some(i) => {
-                    let Some(existing) = items.get(i + 1).cloned() else { return Ok(report) };
-                    let Some((text, encoding)) = packet_text(doc, &existing, warnings) else { return Ok(report) };
-                    let Some(t) = merge_all(&text, Within::Packet, ops, warnings) else { return Ok(report) };
-                    if !readable(&t, Within::Packet, warnings) {
-                        return Ok(report);
-                    }
-                    let r = put_stream(doc, Some(&existing), reuse, &encode(&t, encoding));
-                    report.stream = Some(r);
-                    if let Some(slot) = items.get_mut(i + 1) {
-                        *slot = Object::Ref(r);
-                    }
-                }
-                None => {
-                    // No datasets packet yet: made from the first values, then the rest merged
-                    // in; before the postamble, or last.
-                    let Some(first) = ops.iter().position(|op| matches!(op, Op::Values(_))) else { return Ok(report) };
-                    let Some(Op::Values(wants)) = ops.get(first) else { return Ok(report) };
-                    let fresh = fresh_datasets(&build_children(wants, warnings));
-                    let text = merge_all(&fresh, Within::Packet, ops.get(first + 1..).unwrap_or_default(), warnings).unwrap_or(fresh);
-                    if !readable(&text, Within::Packet, warnings) {
-                        return Ok(report);
-                    }
-                    let r = doc.add(Object::Stream(Stream::flate(Dict::new(), text.as_bytes())));
-                    report.stream = Some(r);
-                    let pos = items.iter().position(|n| n.as_string().is_some_and(|s| s.to_text() == "postamble")).unwrap_or(items.len());
-                    items.insert(pos, Object::Ref(r));
-                    items.insert(pos, Object::String(PdfString::text("datasets")));
-                }
-            }
-            acro.set(b"XFA".to_vec(), Object::Array(items));
-        }
-        Object::Stream(_) => {
-            let Some((text, encoding)) = packet_text(doc, &xfa, warnings) else { return Ok(report) };
-            let Some(new) = merge_all(&text, Within::Xdp, ops, warnings) else { return Ok(report) };
-            if !readable(&new, Within::Xdp, warnings) {
-                return Ok(report);
-            }
-            let r = put_stream(doc, Some(&xfa), reuse, &encode(&new, encoding));
-            report.stream = Some(r);
-            acro.set(b"XFA".to_vec(), Object::Ref(r));
-        }
-        _ => return Ok(report),
-    }
-    match acro_ref {
-        Some(ar) => doc.set(ar, Object::Dict(acro)),
-        None => doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(acro)))?,
-    }
-    report.written = true;
-    Ok(report)
-}
-
-/// The values the datasets hold for `fields`: `(field name, what it should hold)`, only for
-/// fields the data mentions.
-pub fn read_values(doc: &Document, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
-    read_values_with(doc, None, fields)
-}
-
-/// [`read_values`] with the form's parsed template when the caller has it; `None` parses the
-/// document's.
-pub fn read_values_with(doc: &Document, tpl: Option<&Template>, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
-    with_template(doc, tpl, |t| values_at(doc, t, fields))
-}
-
-/// The values the document's datasets hold for `fields`, read in each field's data picture and
-/// shown in its own pattern; only fields the data mentions.
-fn values_at(doc: &Document, tpl: Option<&Template>, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
-    let Ok(Some(p)) = crate::read_packets(doc) else { return Vec::new() };
-    let Some(data) = parse_datasets(&p.xdp) else { return Vec::new() };
-    let mut out = Vec::new();
-    for f in fields {
-        let som = som_of(doc, f);
-        let path = path_of(tpl, &som);
-        let Some(text) = data.value_at(&path) else { continue };
-        let text = text.as_str();
-        let value = match &f.data {
-            FieldData::Text(_) => FieldData::Text(match date_pattern_of(doc, f) {
-                Some(pat) => iso_to_pattern(&data_to_iso(text, data_date_pattern(tpl, &som).as_deref()), &pat),
-                None => text.to_string(),
-            }),
-            FieldData::Check(_) => {
-                let (on, _) = items_of(doc, f);
-                FieldData::Check(is_on(text, &on))
-            }
-            FieldData::Radio(_) => FieldData::Radio((!text.trim().is_empty()).then(|| text.trim().to_string())),
-            FieldData::None => continue,
-        };
-        out.push((f.name.clone(), value));
-    }
-    out
-}
-
-/// Does a data value mean "checked" for a button whose on value is `on`?
-pub fn is_on(text: &str, on: &str) -> bool {
-    let t = text.trim();
-    if t == on {
-        return true;
-    }
-    !matches!(t.to_ascii_lowercase().as_str(), "" | "0" | "off" | "false" | "no") && on.trim().is_empty()
-}
diff --git a/crates/xfa/src/data/build.rs b/crates/xfa/src/data/build.rs
new file mode 100644
index 0000000000..68e8a2a364
--- /dev/null
+++ b/crates/xfa/src/data/build.rs
@@ -0,0 +1,164 @@
+use super::values::{FieldDatum, Want, wanted, with_template};
+use super::*;
+
+pub(super) fn xml_name(s: &str) -> String {
+    let mut out: String = s.chars().map(|c| if c.is_ascii_alphanumeric() || c == '_' || c == '-' || c == '.' { c } else { '_' }).collect();
+    if out.is_empty() || !(out.starts_with(|c: char| c.is_ascii_alphabetic() || c == '_')) {
+        out.insert(0, '_');
+    }
+    out
+}
+
+/// `s` as XML character data. Characters XML 1.0 cannot hold are left out; the flag says
+/// whether any were.
+pub(super) fn escape(s: &str) -> (String, bool) {
+    let mut out = String::with_capacity(s.len());
+    let mut dropped = false;
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            // Parsers turn a raw carriage return into a line feed; a reference keeps it.
+            '\r' => out.push_str("&#xD;"),
+            '\u{FFFE}' | '\u{FFFF}' => dropped = true,
+            c if c.is_control() && c != '\n' && c != '\t' => dropped = true,
+            c => out.push(c),
+        }
+    }
+    (out, dropped)
+}
+
+/// Most data nodes one write may create (instances skipped by a SOM index count too).
+const MAX_NEW_NODES: usize = 20_000;
+
+/// Highest same-name sibling index a write follows.
+pub(super) const MAX_INDEX: usize = 10_000;
+
+/// Most bytes of names the nodes one write creates hold together: every sibling an index
+/// skips over gets its own copy of the name.
+const MAX_NEW_NAME_BYTES: usize = 4 << 20;
+
+/// What one write may still create: nodes and bytes of their names.
+pub(super) struct NewNodes {
+    nodes: usize,
+    name_bytes: usize,
+}
+
+impl NewNodes {
+    pub(super) fn new() -> NewNodes {
+        NewNodes { nodes: MAX_NEW_NODES, name_bytes: MAX_NEW_NAME_BYTES }
+    }
+}
+
+/// A data tree being built for writing.
+#[derive(Default)]
+pub(super) struct Build {
+    name: String,
+    pub(super) text: String,
+    children: Vec<Build>,
+    /// Positions in `children` by name, in order.
+    by_name: HashMap<String, Vec<usize>>,
+}
+
+impl Build {
+    /// The node at `path` below this one, created as needed. `None` when the path is deeper
+    /// than [`MAX_DEPTH`], an index is above [`MAX_INDEX`], or creating it would spend more
+    /// new nodes or name bytes than `budget` holds.
+    pub(super) fn at(&mut self, path: &[(String, usize)], budget: &mut NewNodes) -> Option<&mut Build> {
+        if path.len() > MAX_DEPTH {
+            return None;
+        }
+        let mut node = self;
+        for (name, idx) in path {
+            if *idx > MAX_INDEX {
+                return None;
+            }
+            let name = xml_name(name);
+            let have = node.by_name.get(&name).map_or(0, Vec::len);
+            if *idx >= have {
+                let need = idx - have + 1;
+                let bytes = need.saturating_mul(name.len());
+                if need > budget.nodes || bytes > budget.name_bytes {
+                    return None;
+                }
+                budget.nodes -= need;
+                budget.name_bytes -= bytes;
+                let start = node.children.len();
+                node.children.extend((0..need).map(|_| Build { name: name.clone(), ..Default::default() }));
+                node.by_name.entry(name.clone()).or_default().extend(start..start + need);
+            }
+            let pos = *node.by_name.get(&name)?.get(*idx)?;
+            node = node.children.get_mut(pos)?;
+        }
+        Some(node)
+    }
+
+    /// The tree as XML. Depth is bounded by [`Build::at`].
+    fn write(&self, out: &mut String) {
+        if self.children.is_empty() {
+            out.push_str(&format!("<{}>{}</{}>", self.name, escape(&self.text).0, self.name));
+            return;
+        }
+        out.push_str(&format!("<{}>", self.name));
+        self.write_children(out);
+        out.push_str(&format!("</{}>", self.name));
+    }
+
+    pub(super) fn write_children(&self, out: &mut String) {
+        for c in &self.children {
+            c.write(out);
+        }
+    }
+}
+
+/// Note that a value could not be written (once per kind of reason, naming a few fields).
+pub(super) fn skipped(warnings: &mut Vec<String>, reason: &str, som: &str) {
+    const MAX_WARNINGS: usize = 20;
+    if let Some(w) = warnings.iter_mut().find(|w| w.starts_with(reason)) {
+        if w.matches(", ").count() < 4 {
+            w.push_str(&format!(", {som}"));
+        } else if !w.ends_with('…') {
+            w.push_str(", …");
+        }
+    } else if warnings.len() < MAX_WARNINGS {
+        warnings.push(format!("{reason}: {som}"));
+    }
+}
+
+pub(super) const TOO_MANY: &str = "XFA data not written for fields whose data path is too deep or repeats too often";
+
+pub(super) const STRUCTURED: &str = "XFA data not written for fields whose data node holds structured content";
+
+pub(super) const CONFLICT: &str = "XFA data not written for fields bound to the same data node as another field";
+
+pub(super) const CONTROL: &str = "Characters XML can't hold were left out of the XFA data of";
+
+/// Fresh data for `wants`: the children of an `xfa:data` element.
+pub(super) fn build_children(wants: &[Want], warnings: &mut Vec<String>) -> String {
+    let mut root = Build::default();
+    let mut budget = NewNodes::new();
+    for w in wants {
+        match root.at(&w.path, &mut budget) {
+            Some(node) => node.text = w.text.clone(),
+            None => skipped(warnings, TOO_MANY, &w.som),
+        }
+        if escape(&w.text).1 {
+            skipped(warnings, CONTROL, &w.som);
+        }
+    }
+    let mut out = String::new();
+    root.write_children(&mut out);
+    out
+}
+
+/// The `xfa:data` element for `fields`, built afresh.
+pub fn build_data(doc: &Document, fields: &[FieldDatum]) -> String {
+    let wants = with_template(doc, None, |t| wanted(doc, fields, t));
+    format!("<xfa:data>{}</xfa:data>", build_children(&wants, &mut Vec::new()))
+}
+
+pub(super) fn fresh_datasets(data_children: &str) -> String {
+    format!("<xfa:datasets xmlns:xfa=\"{XFA_DATA_NS}\"><xfa:data>{data_children}</xfa:data></xfa:datasets>")
+}
diff --git a/crates/xfa/src/data/dates.rs b/crates/xfa/src/data/dates.rs
new file mode 100644
index 0000000000..029d91b273
--- /dev/null
+++ b/crates/xfa/src/data/dates.rs
@@ -0,0 +1,193 @@
+use super::path::template_field;
+use super::*;
+
+/// The date letters (`yyyy-mm-dd`, `yyyymmdd`) of an XFA date picture clause such as
+/// `date{YYYY-MM-DD}`, or `None` when it has none this reads (empty, or with symbols beyond
+/// years, months, days and separators).
+pub(crate) fn date_letters(picture: &str) -> Option<String> {
+    let inner = picture
+        .find('{')
+        .and_then(|a| {
+            let rest = picture.get(a + 1..)?;
+            rest.find('}').and_then(|b| rest.get(..b))
+        })
+        .unwrap_or(picture)
+        .trim();
+    if inner.is_empty() || inner.chars().any(|c| !"YMDEJ-/., :".contains(c)) {
+        return None;
+    }
+    Some(inner.replace('E', "d").to_ascii_lowercase())
+}
+
+/// The date letters of `f`'s data picture, when it holds a whole date. A data picture without a
+/// year, a month or a day can't hold the date the field shows, so such a field's data keeps
+/// ISO dates.
+pub(crate) fn data_date_letters(f: &Field) -> Option<String> {
+    let letters = f.data_picture.as_deref().and_then(date_letters)?;
+    let tokens = date_tokens(&letters);
+    let has = |any: &[&str]| tokens.iter().any(|t| any.contains(&t.as_str()));
+    (has(&["yyyy", "yy"]) && has(&["mm", "m"]) && has(&["dd", "d"])).then_some(letters)
+}
+
+/// A date as the data holds it, written in `data_pattern` (the field's data picture), read as
+/// an ISO date. A value that doesn't match, or a field without a data picture, is taken as it
+/// is: the data holds ISO dates by default.
+pub(crate) fn data_to_iso(value: &str, data_pattern: Option<&str>) -> String {
+    data_pattern.and_then(|p| pattern_to_iso(value, p)).unwrap_or_else(|| value.to_string())
+}
+
+/// An ISO date as the data should hold it: in `data_pattern` when the field has one and the
+/// date reads back from it unchanged (a two-digit year holds only 1950 to 2049), else as ISO.
+pub(crate) fn iso_to_data(iso: String, data_pattern: Option<&str>) -> String {
+    match data_pattern {
+        Some(p) => {
+            let written = iso_to_pattern(&iso, p);
+            if pattern_to_iso(&written, p).as_deref() == Some(iso.as_str()) { written } else { iso }
+        }
+        None => iso,
+    }
+}
+
+/// The date letters of the data picture of the field `som` names, when it has one.
+pub(super) fn data_date_pattern(tpl: Option<&Template>, som: &str) -> Option<String> {
+    tpl.and_then(|t| template_field(t, som)).and_then(data_date_letters)
+}
+
+const MONTHS: [&str; 12] = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+
+const WEEKDAYS: [&str; 7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+
+/// The weekday (0 = Sunday) of a proleptic Gregorian date.
+fn weekday(y: u32, m: u32, d: u32) -> usize {
+    const T: [i64; 12] = [0, 3, 2, 5, 0, 3, 5, 1, 4, 6, 2, 4];
+    let y = i64::from(y) - i64::from(m < 3);
+    let t = T.get((m as usize).wrapping_sub(1)).copied().unwrap_or(0);
+    ((y + y / 4 - y / 100 + y / 400 + t + i64::from(d)).rem_euclid(7)) as usize
+}
+
+/// The index and length of the name in `names` that `text` starts with (ignoring case),
+/// cut to `abbr` letters when that is set.
+fn name_at(text: &str, names: &[&str], abbr: bool) -> Option<(usize, usize)> {
+    names.iter().enumerate().find_map(|(i, n)| {
+        let n = if abbr { n.get(..3)? } else { n };
+        text.get(..n.len()).filter(|t| t.eq_ignore_ascii_case(n)).map(|_| (i, n.len()))
+    })
+}
+
+/// Whether `token` is a run of the date letters (`y`, `m`, `d`) rather than a literal.
+fn is_date_run(token: &str) -> bool {
+    token.starts_with(['y', 'm', 'd'])
+}
+
+/// The tokens of a date pattern: runs of `y`, `m` and `d` (`yyyy`, `yy`, `mmmm`, `mmm`, `mm`,
+/// `m`, `dddd`, `ddd`, `dd`, `d` are understood), or a literal character.
+pub(crate) fn date_tokens(pattern: &str) -> Vec<String> {
+    let mut out = Vec::new();
+    let chars: Vec<char> = pattern.chars().collect();
+    let mut i = 0;
+    while i < chars.len() {
+        let c = chars[i].to_ascii_lowercase();
+        if "ymd".contains(c) {
+            let mut j = i;
+            while j < chars.len() && chars[j].to_ascii_lowercase() == c {
+                j += 1;
+            }
+            out.push(std::iter::repeat_n(c, j - i).collect());
+            i = j;
+        } else {
+            out.push(chars[i].to_string());
+            i += 1;
+        }
+    }
+    out
+}
+
+/// `2001-02-03` shown in `pattern` (`mm/dd/yyyy` → `02/03/2001`, `mmm d, yyyy` →
+/// `Feb 3, 2001`). Patterns with a token this doesn't know and non-dates come back as they are.
+pub fn iso_to_pattern(iso: &str, pattern: &str) -> String {
+    let parts: Vec<&str> = iso.trim().splitn(3, '-').collect();
+    let [y, m, d] = parts[..] else { return iso.to_string() };
+    let (Ok(y), Ok(m), Ok(d)) = (y.parse::<u32>(), m.parse::<u32>(), d.parse::<u32>()) else { return iso.to_string() };
+    let mut out = String::new();
+    for t in date_tokens(pattern) {
+        match t.as_str() {
+            "yyyy" => out.push_str(&format!("{y:04}")),
+            "yy" => out.push_str(&format!("{:02}", y % 100)),
+            "mm" => out.push_str(&format!("{m:02}")),
+            "m" => out.push_str(&m.to_string()),
+            "dd" => out.push_str(&format!("{d:02}")),
+            "d" => out.push_str(&d.to_string()),
+            "mmm" | "mmmm" => {
+                let Some(name) = m.checked_sub(1).and_then(|i| MONTHS.get(i as usize)) else { return iso.to_string() };
+                match t.len() {
+                    3 => out.push_str(name.get(..3).unwrap_or(name)),
+                    _ => out.push_str(name),
+                }
+            }
+            "ddd" | "dddd" => {
+                let name = WEEKDAYS.get(weekday(y, m, d)).copied().unwrap_or_default();
+                match t.len() {
+                    3 => out.push_str(name.get(..3).unwrap_or(name)),
+                    _ => out.push_str(name),
+                }
+            }
+            other if is_date_run(other) => return iso.to_string(),
+            other => out.push_str(other),
+        }
+    }
+    out
+}
+
+/// A date typed as `pattern` back to `yyyy-mm-dd`. `None` when it doesn't match.
+pub fn pattern_to_iso(text: &str, pattern: &str) -> Option<String> {
+    let text = text.trim();
+    let (mut y, mut m, mut d) = (None, None, None);
+    let mut day_name = None;
+    let mut rest = text;
+    let tokens = date_tokens(pattern);
+    for (i, t) in tokens.iter().enumerate() {
+        match t.as_str() {
+            "yyyy" | "yy" | "mm" | "m" | "dd" | "d" => {
+                // Digits up to the next literal (or a fixed width).
+                let fixed = matches!(t.as_str(), "yyyy" | "yy" | "mm" | "dd");
+                let width =
+                    if fixed { t.len() } else { rest.chars().take_while(char::is_ascii_digit).count().min(if t == "d" || t == "m" { 2 } else { 4 }) };
+                let digits: String = rest.chars().take(width).collect();
+                if digits.is_empty() || !digits.chars().all(|c| c.is_ascii_digit()) {
+                    return None;
+                }
+                let v: u32 = digits.parse().ok()?;
+                rest = &rest[digits.len()..];
+                match t.as_str() {
+                    "yyyy" => y = Some(v),
+                    "yy" => y = Some(if v < 50 { 2000 + v } else { 1900 + v }),
+                    "mm" | "m" => m = Some(v),
+                    _ => d = Some(v),
+                }
+            }
+            "mmm" | "mmmm" => {
+                let (i, len) = name_at(rest, &MONTHS, t.len() == 3)?;
+                m = Some(i as u32 + 1);
+                rest = rest.get(len..)?;
+            }
+            "ddd" | "dddd" => {
+                let (i, len) = name_at(rest, &WEEKDAYS, t.len() == 3)?;
+                day_name = Some(i);
+                rest = rest.get(len..)?;
+            }
+            run if is_date_run(run) => return None,
+            lit => {
+                rest = rest.strip_prefix(lit)?;
+            }
+        }
+        let _ = i;
+    }
+    if !rest.is_empty() {
+        return None;
+    }
+    let (y, m, d) = (y?, m?, d?);
+    if day_name.is_some_and(|w| w != weekday(y, m, d)) {
+        return None;
+    }
+    (1..=12).contains(&m).then(|| format!("{y:04}-{m:02}-{d:02}")).filter(|_| (1..=31).contains(&d))
+}
diff --git a/crates/xfa/src/data/import.rs b/crates/xfa/src/data/import.rs
new file mode 100644
index 0000000000..cec30b11b3
--- /dev/null
+++ b/crates/xfa/src/data/import.rs
@@ -0,0 +1,353 @@
+use super::build::{escape, fresh_datasets, xml_name};
+use super::merge::{Op, WRAP_CLOSE, WRAP_OPEN, qname, start_tag_end};
+use super::values::Want;
+use super::write::{DatasetsWrite, rewrite};
+use super::*;
+
+/// Data read from a file, held as a tree so it can be written into any packet with the
+/// prefix that packet uses, never as the file's own markup.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct ImportNode {
+    pub name: String,
+    /// The element's namespace (`None`: none).
+    pub ns: Option<String>,
+    /// `(namespace, name, value)`.
+    pub attrs: Vec<(Option<String>, String, String)>,
+    pub text: String,
+    pub children: Vec<ImportNode>,
+}
+
+/// Deepest data an import keeps.
+const MAX_IMPORT_DEPTH: usize = MAX_DEPTH;
+
+/// Most bytes of names, namespaces, attributes and text an import copies out of its file: a
+/// namespace declared once is copied into every element and attribute that inherits it.
+pub(crate) const MAX_IMPORT_BYTES: usize = 4 * MAX_IMPORT;
+
+/// What an import may still copy: nodes and bytes.
+struct ImportBudget {
+    nodes: usize,
+    bytes: usize,
+}
+
+impl ImportBudget {
+    fn new() -> ImportBudget {
+        ImportBudget { nodes: MAX_NODES as usize, bytes: MAX_IMPORT_BYTES }
+    }
+
+    fn take_bytes(&mut self, n: usize) -> Result<(), XfaError> {
+        self.bytes = self
+            .bytes
+            .checked_sub(n)
+            .ok_or_else(|| XfaError::TooLarge(format!("the data file expands to more than {} MB", MAX_IMPORT_BYTES >> 20)))?;
+        Ok(())
+    }
+}
+
+/// `n` as an [`ImportNode`], counting nodes and copied bytes against `budget`; `TooLarge` past
+/// the depth or either budget.
+fn import_node(n: roxmltree::Node, depth: usize, budget: &mut ImportBudget) -> Result<ImportNode, XfaError> {
+    if depth > MAX_IMPORT_DEPTH {
+        return Err(XfaError::TooLarge(format!("the data file nests more than {MAX_IMPORT_DEPTH} levels deep")));
+    }
+    budget.nodes = budget.nodes.checked_sub(1).ok_or_else(|| XfaError::TooLarge("the data file holds too many nodes".into()))?;
+    let name = n.tag_name().name();
+    let ns = n.tag_name().namespace();
+    budget.take_bytes(name.len().saturating_add(ns.map_or(0, str::len)))?;
+    let mut attrs = Vec::new();
+    for a in n.attributes().filter(|a| a.name() != "xmlns" && a.namespace() != Some("http://www.w3.org/2000/xmlns/")) {
+        budget.take_bytes(a.namespace().map_or(0, str::len).saturating_add(a.name().len()).saturating_add(a.value().len()))?;
+        attrs.push((a.namespace().map(str::to_string), a.name().to_string(), a.value().to_string()));
+    }
+    let mut children = Vec::new();
+    let mut text = String::new();
+    for c in n.children() {
+        if c.is_element() {
+            children.push(import_node(c, depth + 1, budget)?);
+        } else if let Some(t) = c.text() {
+            budget.take_bytes(t.len())?;
+            text.push_str(t);
+        }
+    }
+    // A group's own text is layout whitespace.
+    if !children.is_empty() && text.trim().is_empty() {
+        text.clear();
+    }
+    Ok(ImportNode { name: name.to_string(), ns: ns.map(str::to_string), attrs, text, children })
+}
+
+/// `nodes` as markup for a packet whose XFA data namespace prefix is `xfa` (declared where
+/// they go); other namespaces are declared on the elements and attributes that use them.
+pub(super) fn serialize_nodes(nodes: &[ImportNode], xfa: &str) -> String {
+    let mut out = String::new();
+    for n in nodes {
+        serialize_node(n, xfa, &mut out, 0);
+    }
+    out
+}
+
+fn serialize_node(n: &ImportNode, xfa: &str, out: &mut String, depth: usize) {
+    if depth > MAX_IMPORT_DEPTH {
+        return;
+    }
+    let mut decls: Vec<(String, String)> = Vec::new();
+    let mut qualify = |ns: &Option<String>, name: &str, attr: bool| -> String {
+        match ns.as_deref() {
+            None => xml_name(name),
+            Some(uri) if uri == XFA_DATA_NS => format!("{xfa}:{}", xml_name(name)),
+            Some("http://www.w3.org/XML/1998/namespace") => format!("xml:{}", xml_name(name)),
+            Some(uri) => {
+                let p = match decls.iter().position(|(_, u)| u == uri) {
+                    Some(i) => format!("n{i}"),
+                    None => {
+                        decls.push((format!("n{}", decls.len()), uri.to_string()));
+                        format!("n{}", decls.len() - 1)
+                    }
+                };
+                let _ = attr;
+                format!("{p}:{}", xml_name(name))
+            }
+        }
+    };
+    let tag = qualify(&n.ns, &n.name, false);
+    let attrs: Vec<String> = n
+        .attrs
+        .iter()
+        .take(256)
+        .map(|(ns, name, value)| {
+            let q = qualify(ns, name, true);
+            format!(" {q}=\"{}\"", escape(value).0)
+        })
+        .collect();
+    out.push('<');
+    out.push_str(&tag);
+    for (p, uri) in &decls {
+        out.push_str(&format!(" xmlns:{p}=\"{}\"", escape(uri).0));
+    }
+    for a in &attrs {
+        out.push_str(a);
+    }
+    if n.text.is_empty() && n.children.is_empty() {
+        out.push_str("/>");
+        return;
+    }
+    out.push('>');
+    out.push_str(&escape(&n.text).0);
+    for c in &n.children {
+        serialize_node(c, xfa, out, depth + 1);
+    }
+    out.push_str(&format!("</{tag}>"));
+}
+
+/// Largest picture written into the data (its bytes, before base64): with the 64 MB cap on
+/// all packets together, several pictures still fit.
+const MAX_DATA_IMAGE: usize = 8 << 20;
+
+/// Longest data file imported.
+const MAX_IMPORT: usize = 16 << 20;
+
+/// Put a picture into the data node at `path` as Designer saves one a user chose: base64, with
+/// its content type (`image/png`, …) as `xfa:contentType` (in the packet's own prefix). The
+/// node is made when missing; a data group is refused rather than wiped. `reuse`: the stream
+/// this edit already wrote.
+pub fn write_data_image(
+    doc: &mut Document,
+    path: &DataPath,
+    content_type: &str,
+    bytes: &[u8],
+    reuse: Option<ObjRef>,
+) -> Result<DatasetsWrite, XfaError> {
+    use base64::Engine;
+    if path.is_empty() {
+        return Err(XfaError::Malformed("a picture needs a data path".into()));
+    }
+    if bytes.len() > MAX_DATA_IMAGE {
+        return Err(XfaError::TooLarge(format!("the picture is larger than {} MB", MAX_DATA_IMAGE >> 20)));
+    }
+    let ct: String = content_type.chars().filter(|c| c.is_ascii_alphanumeric() || matches!(c, '/' | '-' | '.' | '+')).take(64).collect();
+    let b64 = base64::engine::general_purpose::STANDARD.encode(bytes);
+    let ensure = [Want { som: String::new(), path: path.clone(), text: String::new(), ensure: true }];
+    rewrite(doc, &[Op::Values(&ensure), Op::Picture(path, &ct, &b64)], reuse)
+}
+
+/// What an import of a data file did.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct DataImport {
+    /// Element nodes the new data holds.
+    pub nodes: usize,
+    pub warnings: Vec<String>,
+    /// The datasets stream written.
+    pub stream: Option<ObjRef>,
+}
+
+/// The data a file holds, as the children of `xfa:data`: an XDP or datasets document (Export
+/// Data's output, Designer's), a bare data element, or a data document whose root is the
+/// form's root data node (named `expect_root`, when the caller knows it). Anything else is
+/// refused: a form's data is never replaced by what is not its data.
+pub fn parse_data_file(text: &str, expect_root: Option<&str>) -> Result<Vec<ImportNode>, XfaError> {
+    if text.len() > MAX_IMPORT {
+        return Err(XfaError::TooLarge(format!("the data file is larger than {} MB", MAX_IMPORT >> 20)));
+    }
+    let text = text.trim_start_matches('\u{feff}');
+    if crate::xml_nesting_depth(text) > MAX_IMPORT_DEPTH {
+        return Err(XfaError::TooLarge(format!("the data file nests more than {MAX_IMPORT_DEPTH} levels deep")));
+    }
+    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    let parsed = roxmltree::Document::parse_with_options(text, opts).map_err(|e| XfaError::Malformed(format!("the data file is not XML: {e}")))?;
+    let root = parsed.root_element();
+    let local = root.tag_name().name();
+    let in_xfa = |n: &roxmltree::Node| n.tag_name().namespace().is_none_or(|ns| ns == XFA_DATA_NS);
+    let is = |n: &roxmltree::Node, name: &str| n.is_element() && n.tag_name().name() == name && in_xfa(n);
+    let data = match local {
+        "xdp" => {
+            let ds = root.children().find(|n| is(n, "datasets")).ok_or_else(|| XfaError::Malformed("the XDP holds no datasets".into()))?;
+            ds.children().find(|n| is(n, "data")).ok_or_else(|| XfaError::Malformed("the datasets hold no data element".into()))?
+        }
+        "datasets" if in_xfa(&root) => {
+            root.children().find(|n| is(n, "data")).ok_or_else(|| XfaError::Malformed("the datasets hold no data element".into()))?
+        }
+        "data" if in_xfa(&root) => root,
+        _ => {
+            if root.tag_name().namespace().is_some() {
+                return Err(XfaError::Malformed(format!("<{local}> is not XFA form data")));
+            }
+            if let Some(want) = expect_root
+                && local != want
+            {
+                return Err(XfaError::Malformed(format!("the data file's root is <{local}>; this form's data root is <{want}>")));
+            }
+            let node = import_node(root, 0, &mut ImportBudget::new())?;
+            return Ok(vec![node]);
+        }
+    };
+    let mut budget = ImportBudget::new();
+    let mut out = Vec::new();
+    for c in data.children().filter(|c| c.is_element()) {
+        out.push(import_node(c, 1, &mut budget)?);
+    }
+    Ok(out)
+}
+
+/// Replace the form's data with what the file `text` holds (see [`parse_data_file`]), keeping
+/// the rest of the datasets (data descriptions, say). `reuse`: the stream this edit already
+/// wrote.
+pub fn import_data(doc: &mut Document, text: &str, expect_root: Option<&str>, reuse: Option<ObjRef>) -> Result<DataImport, XfaError> {
+    let nodes = parse_data_file(text, expect_root)?;
+    fn count(n: &[ImportNode]) -> usize {
+        n.iter().map(|c| 1 + count(&c.children)).sum()
+    }
+    let r = rewrite(doc, &[Op::ReplaceData(&nodes)], reuse)?;
+    if !r.written {
+        return Err(XfaError::Malformed(r.warnings.first().cloned().unwrap_or_else(|| "the data could not be written".into())));
+    }
+    Ok(DataImport { nodes: count(&nodes), warnings: r.warnings, stream: r.stream })
+}
+
+/// The datasets packet's text: from the XFA array's `datasets` item, or the whole XDP.
+pub(super) fn datasets_packet(doc: &Document) -> Result<Option<String>, XfaError> {
+    let Some(root) = doc.root() else { return Ok(None) };
+    let catalog = doc.get(root);
+    let Some(acro) = catalog.as_dict().and_then(|c| c.get(b"AcroForm")).map(|a| doc.resolve(a)) else { return Ok(None) };
+    let Some(xfa) = acro.as_dict().and_then(|a| a.get(b"XFA")).map(|x| doc.resolve(x)) else { return Ok(None) };
+    let text_of = |o: &Object| -> Result<Option<String>, XfaError> {
+        match &*doc.resolve(o) {
+            Object::Stream(s) => Ok(crate::packets::decode(&s.decoded_within(64 << 20)?).map(|(t, _)| t)),
+            _ => Ok(None),
+        }
+    };
+    match &*xfa {
+        Object::Array(items) => {
+            let at = (0..items.len())
+                .step_by(2)
+                .find(|&i| items.get(i).and_then(|n| n.as_string()).is_some_and(|s| s.to_text() == "datasets") && i + 1 < items.len());
+            match at.and_then(|i| items.get(i + 1)) {
+                Some(o) => text_of(o),
+                None => Ok(None),
+            }
+        }
+        Object::Stream(_) => text_of(&xfa),
+        _ => Ok(None),
+    }
+}
+
+/// The data to export, as Acrobat's Export Data writes it: `xdp` false gives an XML document
+/// holding the data alone (the form's root data node at the root, or the data element when
+/// there are several); true gives an XDP holding the whole datasets and a reference to the
+/// PDF, named `pdf_name`. A document whose packets can't be read is an error, not empty data.
+pub fn export_data(doc: &Document, xdp: bool, pdf_name: &str) -> Result<String, XfaError> {
+    if crate::read_packets(doc)?.is_none() {
+        return Err(XfaError::NotXfa);
+    }
+    let packet = datasets_packet(doc)?;
+    let (datasets, data) = match &packet {
+        Some(text) => match datasets_markup(text) {
+            Ok(Some(m)) => m,
+            Ok(None) => (fresh_datasets(""), String::new()),
+            Err(()) => return Err(XfaError::Malformed("the XFA data could not be read".into())),
+        },
+        None => (fresh_datasets(""), String::new()),
+    };
+    let mut out = String::from("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
+    if xdp {
+        let (name, _) = escape(pdf_name);
+        out.push_str("<xdp:xdp xmlns:xdp=\"http://ns.adobe.com/xdp/\">\n");
+        out.push_str(&datasets);
+        out.push_str(&format!("\n<pdf href=\"{name}\" xmlns=\"http://ns.adobe.com/xdp/pdf/\"/>\n</xdp:xdp>\n"));
+    } else {
+        out.push_str(if data.is_empty() { &datasets } else { &data });
+        out.push('\n');
+    }
+    Ok(out)
+}
+
+/// The `xfa:datasets` element of `text` as written, and the data alone (its one child, or the
+/// data element), each with the namespaces it uses declared on it. `Ok(None)`: no datasets
+/// element; `Err`: the text can't be read.
+fn datasets_markup(text: &str) -> Result<Option<(String, String)>, ()> {
+    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    if crate::xml_nesting_depth(text) > crate::MAX_XML_DEPTH {
+        return Err(());
+    }
+    let wrapped = format!("{WRAP_OPEN}{text}{WRAP_CLOSE}");
+    let (src, parsed) = match roxmltree::Document::parse_with_options(text, opts) {
+        Ok(d) => (text, d),
+        Err(_) => (wrapped.as_str(), roxmltree::Document::parse_with_options(&wrapped, opts).map_err(|_| ())?),
+    };
+    let Some(ds) = parsed.descendants().find(|n| n.is_element() && n.tag_name().name() == "datasets") else { return Ok(None) };
+    let data = ds.children().find(|n| n.is_element() && n.tag_name().name() == "data");
+    let data_alone = match data {
+        Some(d) => {
+            let kids: Vec<roxmltree::Node> = d.children().filter(|c| c.is_element()).collect();
+            match kids.as_slice() {
+                [one] => element_markup(src, *one).ok_or(())?,
+                _ => element_markup(src, d).ok_or(())?,
+            }
+        }
+        None => String::new(),
+    };
+    Ok(Some((element_markup(src, ds).ok_or(())?, data_alone)))
+}
+
+/// `n` as written in `src`, with the namespace declarations in scope that its start tag lacks
+/// added to it, so it stands alone.
+fn element_markup(src: &str, n: roxmltree::Node) -> Option<String> {
+    let range = n.range();
+    let text = src.get(range.clone())?;
+    let tag_end = start_tag_end(src, &range)?;
+    let start_tag = src.get(range.start..tag_end)?;
+    let mut decls = String::new();
+    for ns in n.namespaces() {
+        let attr = match ns.name() {
+            Some(p) => format!("xmlns:{p}="),
+            None => "xmlns=".to_string(),
+        };
+        if !start_tag.contains(&attr) {
+            decls.push_str(&format!(" {attr}\"{}\"", escape(ns.uri()).0));
+        }
+    }
+    if decls.is_empty() {
+        return Some(text.to_string());
+    }
+    let name_end = qname(src, &range)?.len() + 1;
+    Some(format!("{}{decls}{}", text.get(..name_end)?, text.get(name_end..)?))
+}
diff --git a/crates/xfa/src/data/merge.rs b/crates/xfa/src/data/merge.rs
new file mode 100644
index 0000000000..6888b1439a
--- /dev/null
+++ b/crates/xfa/src/data/merge.rs
@@ -0,0 +1,399 @@
+use super::build::{Build, CONFLICT, CONTROL, NewNodes, STRUCTURED, TOO_MANY, build_children, escape, fresh_datasets, skipped, xml_name};
+use super::import::{ImportNode, serialize_nodes};
+use super::values::Want;
+use super::write::MAX_PACKET_WRITE;
+use super::*;
+
+/// What a rewrite of the datasets packet does.
+#[derive(Clone, Copy)]
+pub(super) enum Op<'a> {
+    /// Put these values in (adding nodes as needed).
+    Values(&'a [Want]),
+    /// Take the node at this path out.
+    Remove(&'a DataPath),
+    /// Make these nodes the whole content of the `xfa:data` element (an import).
+    ReplaceData(&'a [ImportNode]),
+    /// Make the leaf at this path a picture: base64 text with its content type.
+    Picture(&'a DataPath, &'a str, &'a str),
+}
+
+/// Where an element's start tag ends (the index of its `>`), skipping quoted attribute values.
+pub(super) fn start_tag_end(src: &str, range: &std::ops::Range<usize>) -> Option<usize> {
+    let bytes = src.as_bytes();
+    let mut quote = None;
+    for i in range.clone() {
+        let b = *bytes.get(i)?;
+        match (quote, b) {
+            (Some(q), _) if b == q => quote = None,
+            (Some(_), _) => {}
+            (None, b'"' | b'\'') => quote = Some(b),
+            (None, b'>') => return Some(i),
+            _ => {}
+        }
+    }
+    None
+}
+
+/// An element's qualified name as written.
+pub(super) fn qname<'s>(src: &'s str, range: &std::ops::Range<usize>) -> Option<&'s str> {
+    let rest = src.get(range.start.checked_add(1)?..range.end)?;
+    let end = rest.find(|c: char| c.is_whitespace() || c == '/' || c == '>')?;
+    rest.get(..end).filter(|n| !n.is_empty())
+}
+
+/// One change to the packet text: replace `start..end` with `text`.
+struct Edit {
+    start: usize,
+    end: usize,
+    text: String,
+}
+
+/// The edit that puts `inner` (markup) at the end of `node`'s content.
+fn append_edit(src: &str, node: roxmltree::Node, inner: &str) -> Option<Edit> {
+    let range = node.range();
+    let tag_end = start_tag_end(src, &range)?;
+    if tag_end.checked_add(1)? == range.end && src.get(..tag_end)?.ends_with('/') {
+        // `<a/>` becomes `<a>inner</a>`.
+        let name = qname(src, &range)?;
+        return Some(Edit { start: tag_end.checked_sub(1)?, end: range.end, text: format!(">{inner}</{name}>") });
+    }
+    let close = range.start + src.get(range.clone())?.rfind("</")?;
+    Some(Edit { start: close, end: close, text: inner.to_string() })
+}
+
+/// The edit that makes `text` (escaped) the whole content of the leaf `node`.
+fn replace_edit(src: &str, node: roxmltree::Node, text: &str) -> Option<Edit> {
+    let range = node.range();
+    let tag_end = start_tag_end(src, &range)?;
+    if tag_end.checked_add(1)? == range.end && src.get(..tag_end)?.ends_with('/') {
+        let name = qname(src, &range)?;
+        return Some(Edit { start: tag_end.checked_sub(1)?, end: range.end, text: format!(">{text}</{name}>") });
+    }
+    let close = range.start + src.get(range.clone())?.rfind("</")?;
+    (close > tag_end).then(|| Edit { start: tag_end + 1, end: close, text: text.to_string() })
+}
+
+/// What merging the values into a packet's text came to.
+enum Merged {
+    /// The data already holds every value.
+    Unchanged,
+    Changed(String),
+    /// The text could not be merged into (the reason is in the warnings).
+    Failed,
+}
+
+/// Where a datasets packet sits: one packet of an array (`Packet`), or inside the whole XDP.
+#[derive(Clone, Copy, PartialEq)]
+pub(super) enum Within {
+    Packet,
+    Xdp,
+}
+
+pub(super) const WRAP_OPEN: &str = "<pdfcraft-wrap xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\" xmlns:xdp=\"http://ns.adobe.com/xdp/\">";
+
+pub(super) const WRAP_CLOSE: &str = "</pdfcraft-wrap>";
+
+/// Write `wants` into the data of the datasets packet in `text`, changing only what has to
+/// change: values go into the data nodes they bind to, missing nodes are added, and everything
+/// else (data no field binds to, other namespaces, attributes, comments, layout) stays as
+/// written.
+/// The prefix bound to the XFA data namespace where `n` is (`None`: unbound or the default
+/// namespace, which attributes can't use).
+fn xfa_prefix(n: roxmltree::Node) -> Option<String> {
+    n.namespaces().find(|ns| ns.uri() == XFA_DATA_NS).and_then(|ns| ns.name()).filter(|p| !p.is_empty()).map(str::to_string)
+}
+
+fn merge(text: &str, within: Within, op: Op, warnings: &mut Vec<String>) -> Merged {
+    let wants: &[Want] = match op {
+        Op::Values(w) => w,
+        Op::Remove(_) | Op::ReplaceData(_) | Op::Picture(..) => &[],
+    };
+    // Fresh data, where none exists yet (declared with the `xfa` prefix).
+    let fresh_children = |warnings: &mut Vec<String>| match op {
+        Op::ReplaceData(nodes) => serialize_nodes(nodes, "xfa"),
+        _ => build_children(wants, warnings),
+    };
+    if crate::xml_nesting_depth(text) > crate::MAX_XML_DEPTH {
+        warnings.push("The XFA data nests XML elements deeper than the reader accepts; the field values were not written to it".into());
+        return Merged::Failed;
+    }
+    let opts = || roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    // A packet of an array may use the prefixes the XDP envelope declares: read it inside
+    // an element declaring the usual ones.
+    let wrapped;
+    let (src, shift, parsed) = match roxmltree::Document::parse_with_options(text, opts()) {
+        Ok(d) => (text, 0, d),
+        Err(first) => {
+            wrapped = format!("{WRAP_OPEN}{text}{WRAP_CLOSE}");
+            match (within, roxmltree::Document::parse_with_options(&wrapped, opts())) {
+                (Within::Packet, Ok(d)) => (wrapped.as_str(), WRAP_OPEN.len(), d),
+                _ => {
+                    warnings.push(format!("The XFA data could not be read ({first}); the field values were not written to it"));
+                    return Merged::Failed;
+                }
+            }
+        }
+    };
+    let is = |n: &roxmltree::Node, name: &str| n.is_element() && n.tag_name().name() == name;
+    let datasets = parsed
+        .descendants()
+        .find(|n| is(n, "datasets") && n.tag_name().namespace() == Some(XFA_DATA_NS))
+        .or_else(|| parsed.descendants().find(|n| is(n, "datasets")));
+    let mut edits = Vec::new();
+    let mut data = None;
+    match datasets {
+        None if matches!(op, Op::Remove(_) | Op::Picture(..)) => return Merged::Unchanged,
+        None if within == Within::Xdp => {
+            let root = parsed.root_element();
+            let children = fresh_children(warnings);
+            match append_edit(src, root, &fresh_datasets(&children)) {
+                Some(e) => edits.push(e),
+                None => {
+                    warnings.push("The XFA packets could not be extended with data; the field values were not written".into());
+                    return Merged::Failed;
+                }
+            }
+        }
+        None => {
+            warnings.push("The XFA datasets packet holds no datasets element; the field values were not written to it".into());
+            return Merged::Failed;
+        }
+        Some(ds) => match ds.children().find(|n| is(n, "data")) {
+            Some(d) => data = Some(d),
+            None if matches!(op, Op::Remove(_) | Op::Picture(..)) => return Merged::Unchanged,
+            None => {
+                let prefix = qname(src, &ds.range()).and_then(|q| q.split_once(':')).map(|(p, _)| format!("{p}:")).unwrap_or_default();
+                let children = fresh_children(warnings);
+                let element = format!("<{prefix}data>{}</{prefix}data>", children);
+                match append_edit(src, ds, &element) {
+                    Some(e) => edits.push(e),
+                    None => {
+                        warnings.push("The XFA datasets could not be extended with data; the field values were not written".into());
+                        return Merged::Failed;
+                    }
+                }
+            }
+        },
+    }
+    if let Some(data) = data {
+        match op {
+            Op::Values(w) => merge_values(src, data, w, &mut edits, warnings),
+            Op::ReplaceData(nodes) => {
+                // Everything between the start and end tags; `<xfa:data/>` opens up. Written
+                // with the prefix the packet binds to the data namespace.
+                let prefix = xfa_prefix(data);
+                let markup = serialize_nodes(nodes, prefix.as_deref().unwrap_or("xfa"));
+                let range = data.range();
+                match (start_tag_end(src, &range), qname(src, &range)) {
+                    (Some(tag_end), Some(name)) if tag_end + 1 == range.end && src.get(..tag_end).is_some_and(|s| s.ends_with('/')) => {
+                        edits.push(Edit { start: range.start, end: range.end, text: format!("<{name}>{markup}</{name}>") });
+                    }
+                    (Some(tag_end), _) => {
+                        let close = src.get(range.clone()).and_then(|s| s.rfind("</")).map(|c| range.start + c);
+                        match close {
+                            Some(close) if tag_end < close => edits.push(Edit { start: tag_end + 1, end: close, text: markup }),
+                            _ => {
+                                warnings.push("The XFA data element could not be rewritten; the data was not imported".into());
+                                return Merged::Failed;
+                            }
+                        }
+                    }
+                    _ => {
+                        warnings.push("The XFA data element could not be rewritten; the data was not imported".into());
+                        return Merged::Failed;
+                    }
+                }
+            }
+            Op::Picture(path, content_type, base64) => {
+                let mut node = Some(data);
+                for (name, idx) in path.iter() {
+                    let want = xml_name(name);
+                    node = node.and_then(|n| n.children().filter(|c| c.is_element() && c.tag_name().name() == want).nth(*idx));
+                }
+                let Some(n) = node else { return Merged::Unchanged };
+                if n.children().any(|c| c.is_element()) {
+                    // A data group, not a leaf: a picture would wipe what's under it.
+                    skipped(warnings, STRUCTURED, &path.iter().map(|(n, i)| format!("{n}[{i}]")).collect::<Vec<_>>().join("."));
+                    return Merged::Failed;
+                }
+                let name = qname(src, &n.range()).unwrap_or("value").to_string();
+                let (ct, _) = escape(content_type);
+                let attr = match xfa_prefix(n) {
+                    Some(p) => format!("{p}:contentType=\"{ct}\""),
+                    None => format!("xmlns:xfa=\"{XFA_DATA_NS}\" xfa:contentType=\"{ct}\""),
+                };
+                edits.push(Edit { start: n.range().start, end: n.range().end, text: format!("<{name} {attr}>{base64}</{name}>") });
+            }
+            Op::Remove(path) => {
+                // The element at `path`, with the whitespace before it.
+                let mut node = Some(data);
+                for (name, idx) in path {
+                    node = node.and_then(|n| n.children().filter(|c| c.is_element() && c.tag_name().name() == name).nth(*idx));
+                }
+                if let Some(n) = node {
+                    let r = n.range();
+                    let start = src.get(..r.start).map_or(r.start, |before| r.start - before.len() + before.trim_end().len());
+                    edits.push(Edit { start, end: r.end, text: String::new() });
+                }
+            }
+        }
+    }
+    if edits.is_empty() {
+        return Merged::Unchanged;
+    }
+    // Apply from the end, so earlier positions stay valid; overlapping edits (two fields bound
+    // to one node) keep the first.
+    edits.sort_by_key(|e| (e.start, e.end));
+    let mut kept: Vec<Edit> = Vec::with_capacity(edits.len());
+    for e in edits {
+        if kept.last().is_some_and(|k| e.start < k.end) {
+            if kept.last().is_some_and(|k| k.text != e.text) && !warnings.iter().any(|w| w == CONFLICT) {
+                warnings.push(CONFLICT.into());
+            }
+            continue;
+        }
+        kept.push(e);
+    }
+    let mut out = src.to_string();
+    for e in kept.iter().rev() {
+        if out.get(e.start..e.end).is_none() {
+            warnings.push("The XFA data could not be updated; the field values were not written to it".into());
+            return Merged::Failed;
+        }
+        out.replace_range(e.start..e.end, &e.text);
+    }
+    if shift > 0 {
+        match out.get(shift..out.len().saturating_sub(WRAP_CLOSE.len())) {
+            Some(inner) => out = inner.to_string(),
+            None => return Merged::Failed,
+        }
+    }
+    Merged::Changed(out)
+}
+
+/// The edits that put `wants` into the `data` element.
+fn merge_values(src: &str, data: roxmltree::Node, wants: &[Want], edits: &mut Vec<Edit>, warnings: &mut Vec<String>) {
+    // Element children by local name, per element visited (built once each).
+    let mut index: HashMap<roxmltree::NodeId, HashMap<String, Vec<roxmltree::NodeId>>> = HashMap::new();
+    let tree = data.document();
+    // Nodes to add, per existing element they go into.
+    let mut added: Vec<(roxmltree::NodeId, Build)> = Vec::new();
+    let mut budget = NewNodes::new();
+    for w in wants {
+        let (escaped, dropped) = escape(&w.text);
+        let mut node = data;
+        let mut depth = 0;
+        let mut have = 0;
+        for (name, idx) in &w.path {
+            let kids = index.entry(node.id()).or_insert_with(|| {
+                let mut by: HashMap<String, Vec<roxmltree::NodeId>> = HashMap::new();
+                for c in node.children().filter(|c| c.is_element()) {
+                    by.entry(c.tag_name().name().to_string()).or_default().push(c.id());
+                }
+                by
+            });
+            let same = kids.get(name.as_str());
+            match same.and_then(|v| v.get(*idx)).and_then(|id| tree.get_node(*id)) {
+                Some(next) => {
+                    node = next;
+                    depth += 1;
+                }
+                None => {
+                    have = same.map_or(0, Vec::len);
+                    break;
+                }
+            }
+        }
+        if depth == w.path.len() {
+            // The data node exists: give it the value, unless it already holds it. A node
+            // only wanted to exist (a row instance) is left as it is.
+            if w.ensure && w.text.is_empty() {
+                continue;
+            }
+            let current: String = node.children().filter(|c| c.is_text()).filter_map(|c| c.text()).collect();
+            if node.children().any(|c| c.is_element()) {
+                let all: String = node.descendants().filter(|c| c.is_text()).filter_map(|c| c.text()).collect();
+                // Ignore existing XML indentation, but not whitespace in the accepted value.
+                // A skipped mismatch must warn: relayout would otherwise use stale data.
+                if all.trim() != w.text {
+                    skipped(warnings, STRUCTURED, &w.som);
+                }
+                continue;
+            }
+            if current == w.text {
+                continue;
+            }
+            match replace_edit(src, node, &escaped) {
+                Some(e) => edits.push(e),
+                None => skipped(warnings, STRUCTURED, &w.som),
+            }
+        } else {
+            // Missing: add the rest of the path below the deepest node that exists. An empty
+            // value needs no node, unless the node itself is wanted (a new instance).
+            if w.text.is_empty() && !w.ensure {
+                continue;
+            }
+            let mut rest: DataPath = w.path.get(depth..).unwrap_or_default().to_vec();
+            if let Some(first) = rest.first_mut() {
+                first.1 = first.1.saturating_sub(have);
+            }
+            let pos = match added.iter().position(|(id, _)| *id == node.id()) {
+                Some(p) => p,
+                None => {
+                    added.push((node.id(), Build::default()));
+                    added.len() - 1
+                }
+            };
+            let built = added.get_mut(pos).and_then(|(_, b)| b.at(&rest, &mut budget));
+            match built {
+                Some(b) => b.text = w.text.clone(),
+                None => {
+                    skipped(warnings, TOO_MANY, &w.som);
+                    continue;
+                }
+            }
+        }
+        if dropped {
+            skipped(warnings, CONTROL, &w.som);
+        }
+    }
+    for (id, build) in added {
+        let Some(node) = tree.get_node(id) else { continue };
+        let mut inner = String::new();
+        build.write_children(&mut inner);
+        match append_edit(src, node, &inner) {
+            Some(e) => edits.push(e),
+            None => warnings.push("Some XFA data nodes could not be added; their field values were not written".into()),
+        }
+    }
+}
+
+/// Merge `ops` into `text` in order. `None`: nothing changed (or nothing could be merged).
+pub(super) fn merge_all(text: &str, within: Within, ops: &[Op], warnings: &mut Vec<String>) -> Option<String> {
+    let mut current: Option<String> = None;
+    for op in ops {
+        match merge(current.as_deref().unwrap_or(text), within, *op, warnings) {
+            Merged::Changed(t) => current = Some(t),
+            Merged::Unchanged => {}
+            // Later steps still apply to what merged so far; the reason is in the warnings.
+            Merged::Failed => {}
+        }
+    }
+    current
+}
+
+/// Is `text` a packet the reader will take back (well-formed, within size)? A rewrite that
+/// isn't is not written: better the old data than an unreadable packet.
+pub(super) fn readable(text: &str, within: Within, warnings: &mut Vec<String>) -> bool {
+    if text.len() > MAX_PACKET_WRITE {
+        warnings.push(format!("The XFA data would be larger than {} MB; it was not written", MAX_PACKET_WRITE >> 20));
+        return false;
+    }
+    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    let ok = roxmltree::Document::parse_with_options(text, opts).is_ok()
+        || (within == Within::Packet && roxmltree::Document::parse_with_options(&format!("{WRAP_OPEN}{text}{WRAP_CLOSE}"), opts).is_ok());
+    if !ok {
+        warnings.push("The XFA data would not be well-formed XML after this change; it was not written".into());
+    }
+    ok
+}
diff --git a/crates/xfa/src/data/passwords.rs b/crates/xfa/src/data/passwords.rs
new file mode 100644
index 0000000000..78503bb53c
--- /dev/null
+++ b/crates/xfa/src/data/passwords.rs
@@ -0,0 +1,194 @@
+use super::import::datasets_packet;
+use super::merge::Op;
+use super::path::{data_path, parse_datasets};
+use super::values::{Want, path_of, text_of, with_template};
+use super::write::{datasets_stream_ref, rewrite};
+use super::*;
+
+/// The SOM path and default value of every AcroForm text field with the Password flag (bit 14,
+/// `1 << 13`) in `doc`, for static XFA forms whose password fields set the flag in the AcroForm
+/// dictionary.
+fn acro_password_fields(doc: &Document) -> Vec<(String, String)> {
+    const PASSWORD_FLAG: i64 = 1 << 13;
+    let Some(root) = doc.root() else { return Vec::new() };
+    let catalog = doc.get(root);
+    let Some(acro) = catalog.as_dict().and_then(|c| c.get(b"AcroForm")).map(|a| doc.resolve(a)) else { return Vec::new() };
+    let Some(top) = acro.as_dict().and_then(|a| a.get(b"Fields")).map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned()) else {
+        return Vec::new();
+    };
+    struct AcroWalk<'a> {
+        doc: &'a Document,
+        seen: std::collections::HashSet<ObjRef>,
+        out: Vec<(String, String)>,
+    }
+    impl AcroWalk<'_> {
+        fn walk(
+            &mut self,
+            items: &[Object],
+            parent_name: &str,
+            inherited_ft: Option<&[u8]>,
+            inherited_ff: i64,
+            inherited_dv: Option<&str>,
+            depth: usize,
+        ) {
+            if depth > 32 {
+                return;
+            }
+            for item in items {
+                let Some(r) = item.as_ref() else { continue };
+                if !self.seen.insert(r) {
+                    continue;
+                }
+                let obj = self.doc.get(r);
+                let Some(d) = obj.as_dict() else { continue };
+                let ft = d.name(b"FT").or(inherited_ft);
+                let ff = d.int(b"Ff").unwrap_or(inherited_ff);
+                let dv_own = text_of(self.doc, d, b"DV");
+                let dv = dv_own.as_deref().or(inherited_dv);
+                let t = text_of(self.doc, d, b"T");
+                let full_name = match (&t, parent_name.is_empty()) {
+                    (Some(seg), true) => seg.clone(),
+                    (Some(seg), false) => format!("{parent_name}.{seg}"),
+                    (None, _) => parent_name.to_string(),
+                };
+                let kids = d.get(b"Kids").map(|k| self.doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+                let has_named_kid = kids.iter().filter_map(Object::as_ref).any(|kr| self.doc.get(kr).as_dict().is_some_and(|kd| kd.contains(b"T")));
+                if !has_named_kid && ft == Some(b"Tx") && (ff & PASSWORD_FLAG) != 0 {
+                    let som = text_of(self.doc, d, crate::pdf::SOM_KEY).unwrap_or_else(|| full_name.clone());
+                    if !som.is_empty() {
+                        self.out.push((som, dv.unwrap_or_default().to_string()));
+                    }
+                }
+                if !kids.is_empty() {
+                    self.walk(&kids, &full_name, ft, ff, dv, depth + 1);
+                }
+            }
+        }
+    }
+    let mut w = AcroWalk { doc, seen: std::collections::HashSet::new(), out: Vec::new() };
+    w.walk(&top, "", None, 0, None, 0);
+    w.out
+}
+
+/// The `Want` entries needed to restore password fields in `doc`'s datasets packet to their
+/// defaults (or empty when they have no default).
+fn password_dataset_wants(doc: &Document) -> Vec<Want> {
+    if datasets_stream_ref(doc).is_none() {
+        return Vec::new();
+    }
+    let Ok(Some(packet)) = datasets_packet(doc) else { return Vec::new() };
+    let Some(data) = parse_datasets(&packet) else { return Vec::new() };
+    with_template(doc, None, |tpl| {
+        let mut candidates: Vec<(String, DataPath, String)> = Vec::new();
+        let mut seen = std::collections::HashSet::new();
+        if let Some(t) = tpl {
+            struct Walk<'a> {
+                tpl: &'a Template,
+                data: &'a DataNode,
+                nodes: usize,
+                seen: &'a mut std::collections::HashSet<DataPath>,
+                out: &'a mut Vec<(String, DataPath, String)>,
+            }
+            impl Walk<'_> {
+                fn child_som(parent: &str, name: Option<&str>, index: usize) -> String {
+                    match name {
+                        Some(n) if !parent.is_empty() => format!("{parent}.{n}[{index}]"),
+                        Some(n) => format!("{n}[{index}]"),
+                        None => parent.to_string(),
+                    }
+                }
+                fn walk(&mut self, children: &[Node], parent_som: &str, depth: usize) {
+                    if depth > MAX_DEPTH || self.nodes >= crate::script::MAX_FORM_NODES {
+                        return;
+                    }
+                    let sibs = SomIndices::of(children);
+                    for (i, n) in children.iter().enumerate() {
+                        if self.nodes >= crate::script::MAX_FORM_NODES {
+                            break;
+                        }
+                        self.nodes += 1;
+                        let sib = sibs.at(i);
+                        match n {
+                            Node::Subform(sf) => {
+                                let from_data = match &sf.common.name {
+                                    Some(name) if sf.occur.max != Some(1) => self.data.count(&data_path(self.tpl, parent_som), name),
+                                    _ => 0,
+                                };
+                                let instances = crate::layout::instance_count(&sf.occur, from_data).max(from_data);
+                                for k in 0..instances {
+                                    if k > 0 {
+                                        if self.nodes >= crate::script::MAX_FORM_NODES {
+                                            break;
+                                        }
+                                        self.nodes += 1;
+                                    }
+                                    let som = Self::child_som(parent_som, sf.common.name.as_deref(), sib + k);
+                                    self.walk(&sf.children, &som, depth + 1);
+                                }
+                            }
+                            Node::Area(a) => {
+                                let som = Self::child_som(parent_som, a.common.name.as_deref(), sib);
+                                self.walk(&a.children, &som, depth + 1);
+                            }
+                            Node::Field(f) if f.ui == Ui::PasswordEdit => {
+                                let som = Self::child_som(parent_som, f.common.name.as_deref().or(Some("field")), sib);
+                                let path = data_path(self.tpl, &som);
+                                if !path.is_empty() && self.seen.insert(path.clone()) {
+                                    let default = f.value.plain().map(|v| f.saved_value(v.trim())).unwrap_or_default();
+                                    self.out.push((som, path, default));
+                                }
+                            }
+                            _ => {}
+                        }
+                    }
+                }
+            }
+            let root = Node::Subform(Box::new(t.root.clone()));
+            let mut w = Walk { tpl: t, data: &data, nodes: 0, seen: &mut seen, out: &mut candidates };
+            w.walk(std::slice::from_ref(&root), "", 0);
+            if let Some(ps) = &t.root.page_set {
+                for (i, area) in ps.areas.iter().enumerate() {
+                    let som = area.name.clone().map(|n| format!("{n}[0]")).unwrap_or_else(|| format!("#pageArea[{i}]"));
+                    w.walk(&area.items, &som, 1);
+                }
+            }
+        }
+        for (som, default) in acro_password_fields(doc) {
+            let path = path_of(tpl, &som);
+            if !path.is_empty() && seen.insert(path.clone()) {
+                candidates.push((som, path, default));
+            }
+        }
+        candidates
+            .into_iter()
+            .filter_map(|(som, path, default)| {
+                let cur = data.value_at(&path)?;
+                (!cur.is_empty() && cur != default).then_some(Want { som, path, text: default, ensure: false })
+            })
+            .collect()
+    })
+}
+
+/// Whether any XFA password field (`<passwordEdit/>` or an AcroForm text field with the Password
+/// flag) holds a value in `doc`'s datasets packet beyond its default (#3944).
+pub fn has_password_values(doc: &Document) -> bool {
+    !password_dataset_wants(doc).is_empty()
+}
+
+/// Clear typed password values from `doc`'s XFA datasets packet (restoring a template default
+/// where the field has one, else emptying the element), replacing the datasets stream in place
+/// (#3944). Returns how many password fields were cleared in the datasets.
+pub fn clear_password_values(doc: &mut Document) -> Result<usize, XfaError> {
+    let wants = password_dataset_wants(doc);
+    if wants.is_empty() {
+        return Ok(0);
+    }
+    let count = wants.len();
+    let reuse = datasets_stream_ref(doc);
+    let report = rewrite(doc, &[Op::Values(&wants)], reuse)?;
+    if !report.written || !password_dataset_wants(doc).is_empty() {
+        let reason = report.warnings.first().map_or("the XFA datasets password values could not be cleared", String::as_str);
+        return Err(XfaError::Malformed(reason.to_string()));
+    }
+    Ok(count)
+}
diff --git a/crates/xfa/src/data/path.rs b/crates/xfa/src/data/path.rs
new file mode 100644
index 0000000000..90cc4346f2
--- /dev/null
+++ b/crates/xfa/src/data/path.rs
@@ -0,0 +1,156 @@
+use super::*;
+
+fn to_node(n: roxmltree::Node, depth: usize) -> DataNode {
+    let name = n.tag_name().name().to_string();
+    let children: Vec<DataNode> =
+        if depth < MAX_DEPTH { n.children().filter(|c| c.is_element()).map(|c| to_node(c, depth + 1)).collect() } else { Vec::new() };
+    // The text of a leaf is its value; a container's own text is whitespace.
+    let text = if children.is_empty() { n.children().filter_map(|c| c.text()).collect::<String>() } else { String::new() };
+    DataNode { name, text, children }
+}
+
+/// The `xfa:data` element of the datasets packet in `xdp` (or a bare datasets document), as a
+/// tree whose root is that element.
+pub fn parse_datasets(xdp: &str) -> Option<DataNode> {
+    if crate::xml_nesting_depth(xdp) > crate::MAX_XML_DEPTH {
+        return None;
+    }
+    let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
+    let doc = roxmltree::Document::parse_with_options(xdp, opts).ok()?;
+    let datasets = doc.descendants().find(|n| n.is_element() && n.tag_name().name() == "datasets")?;
+    let data = datasets.children().find(|n| n.is_element() && n.tag_name().name() == "data")?;
+    Some(to_node(data, 0))
+}
+
+/// The data path a SOM expression names: `form[0].#subform[0].name[1]` → `[(form, 0), (name, 1)]`.
+/// Unnamed containers (`#subform`) have no data node.
+pub fn som_to_path(som: &str) -> DataPath {
+    som.split('.')
+        .filter_map(|seg| {
+            let seg = seg.trim();
+            if seg.is_empty() || seg.starts_with('#') || seg.starts_with('$') {
+                return None;
+            }
+            let (name, idx) = match seg.split_once('[') {
+                Some((n, rest)) => (n, rest.trim_end_matches(']').parse::<usize>().unwrap_or(0)),
+                None => (seg, 0),
+            };
+            Some((name.to_string(), idx.min(100_000)))
+        })
+        .collect()
+}
+
+/// The data path the object at `som` binds to: [`som_to_path`] without the areas on the way.
+/// An area is a named container in the form, so it is part of SOM expressions, but only
+/// subforms, exclusion groups and fields are data scopes: what an area holds binds under the
+/// area's parent, as Adobe's viewers write it. The template tells which segments are areas;
+/// segments it doesn't have (page-set objects, or a SOM from another template) are kept.
+pub fn data_path(tpl: &Template, som: &str) -> DataPath {
+    let mut out = DataPath::new();
+    // The template children the next segment is looked up in; `None` until the root matched,
+    // and again once a segment is not a container the template has.
+    let mut level: Option<&[Node]> = None;
+    for (i, (name, index)) in som_to_path(som).into_iter().enumerate() {
+        let found = match level {
+            None if i == 0 && tpl.root.common.name.as_deref() == Some(name.as_str()) => Some(Container::Children(&tpl.root.children)),
+            None => None,
+            Some(children) => match named(children, &name, 0) {
+                Some(Node::Subform(sf)) => Some(Container::Children(&sf.children)),
+                Some(Node::Area(a)) => Some(Container::Area(&a.children)),
+                _ => None,
+            },
+        };
+        match found {
+            Some(Container::Area(children)) => level = Some(children),
+            Some(Container::Children(children)) => {
+                level = Some(children);
+                out.push((name, index));
+            }
+            None => {
+                level = None;
+                out.push((name, index));
+            }
+        }
+    }
+    out
+}
+
+enum Container<'a> {
+    Children(&'a [Node]),
+    /// Contents bind under the area's parent.
+    Area(&'a [Node]),
+}
+
+/// The child of `nodes` named `name`, looking through unnamed subforms and areas (which have no
+/// SOM segment of their own).
+fn named<'a>(nodes: &'a [Node], name: &str, depth: usize) -> Option<&'a Node> {
+    if depth > MAX_DEPTH {
+        return None;
+    }
+    nodes.iter().find(|n| n.common().name.as_deref() == Some(name)).or_else(|| {
+        nodes.iter().find_map(|n| match n {
+            Node::Subform(sf) if sf.common.name.is_none() => named(&sf.children, name, depth + 1),
+            Node::Area(a) if a.common.name.is_none() => named(&a.children, name, depth + 1),
+            _ => None,
+        })
+    })
+}
+
+/// The child of `nodes` the SOM segment `name[index]` names, numbered as the form numbers its
+/// objects ([`SomIndices`]): same-named siblings count up, and the instances of a repeating
+/// subform take the numbers from its own on. Unnamed subforms and areas are looked through,
+/// as [`named`] does.
+fn named_at<'a>(nodes: &'a [Node], name: &str, index: usize, depth: usize) -> Option<&'a Node> {
+    if depth > MAX_DEPTH {
+        return None;
+    }
+    let sibs = SomIndices::of(nodes);
+    let mut repeating = None;
+    for (i, n) in nodes.iter().enumerate() {
+        if n.common().name.as_deref() != Some(name) {
+            continue;
+        }
+        let sib = sibs.at(i);
+        if sib == index {
+            return Some(n);
+        }
+        if sib < index && matches!(n, Node::Subform(sf) if sf.occur.max != Some(1)) {
+            repeating = Some(n);
+        }
+    }
+    repeating.or_else(|| {
+        nodes.iter().find_map(|n| match n {
+            Node::Subform(sf) if sf.common.name.is_none() => named_at(&sf.children, name, index, depth + 1),
+            Node::Area(a) if a.common.name.is_none() => named_at(&a.children, name, index, depth + 1),
+            _ => None,
+        })
+    })
+}
+
+/// The template field the object at a SOM path is an instance of, each segment's number counted
+/// as the form counts it ([`named_at`]). `None` when the template has no such field, or it is
+/// a button of an exclusion group (whose buttons take their value from the group).
+pub(crate) fn template_field<'a>(tpl: &'a Template, som: &str) -> Option<&'a Field> {
+    let path = som_to_path(som);
+    let ((root, _), rest) = path.split_first()?;
+    if tpl.root.common.name.as_deref() != Some(root.as_str()) {
+        return None;
+    }
+    let ((last, last_index), inner) = rest.split_last()?;
+    let mut children: &[Node] = &tpl.root.children;
+    for (name, index) in inner {
+        children = match named_at(children, name, *index, 0)? {
+            Node::Subform(sf) => &sf.children,
+            Node::Area(a) => &a.children,
+            _ => return None,
+        };
+    }
+    match named_at(children, last, *last_index, 0)? {
+        Node::Field(f) => Some(f),
+        _ => None,
+    }
+}
+
+pub(super) fn path_som(path: &DataPath) -> String {
+    path.iter().map(|(n, i)| format!("{n}[{i}]")).collect::<Vec<_>>().join(".")
+}
diff --git a/crates/xfa/src/data/values.rs b/crates/xfa/src/data/values.rs
new file mode 100644
index 0000000000..41fb6644e9
--- /dev/null
+++ b/crates/xfa/src/data/values.rs
@@ -0,0 +1,192 @@
+use super::dates::{data_date_pattern, data_to_iso, iso_to_data, iso_to_pattern, pattern_to_iso};
+use super::path::{data_path, parse_datasets, som_to_path};
+use super::*;
+
+/// What a field holds, for writing the datasets.
+#[derive(Clone, Debug, PartialEq)]
+pub enum FieldData {
+    Text(String),
+    /// Checked or not.
+    Check(bool),
+    /// The selected button's on value, if any.
+    Radio(Option<String>),
+    /// Nothing to write (buttons, signatures).
+    None,
+}
+
+/// One field of the AcroForm, as the engine sees it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FieldDatum {
+    /// The terminal field dictionary (where `/PCSom` and `/PCItems` live).
+    pub obj: ObjRef,
+    /// The fully qualified field name (a static form's SOM path).
+    pub name: String,
+    pub data: FieldData,
+}
+
+pub(super) fn text_of(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
+    d.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_string().map(|s| s.to_text()))
+}
+
+/// The SOM path of a field: its `/PCSom` when PdfCraft generated it, else its name.
+fn som_of(doc: &Document, f: &FieldDatum) -> String {
+    doc.get(f.obj).as_dict().and_then(|d| text_of(doc, d, crate::pdf::SOM_KEY)).unwrap_or_else(|| f.name.clone())
+}
+
+/// The datasets text for a radio group. The AcroForm value is an appearance-state name
+/// (`New York` is stored as `New_York`); `/PCOn` on the selected widget is the original item.
+fn radio_dataset_value(doc: &Document, f: &FieldDatum, sel: &Option<String>) -> String {
+    let Some(selected) = sel.as_deref().filter(|s| !s.is_empty() && *s != "Off") else {
+        return String::new();
+    };
+    let Some(group) = doc.get(f.obj).as_dict().cloned() else { return selected.to_string() };
+    let kids = group.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_else(|| vec![Object::Ref(f.obj)]);
+    for kid in kids {
+        let Some(widget) = doc.resolve(&kid).as_dict().cloned() else { continue };
+        let original = text_of(doc, &widget, b"PCOn");
+        let state = widget
+            .get(b"AP")
+            .map(|ap| doc.resolve(ap))
+            .and_then(|ap| ap.as_dict().and_then(|a| a.get(b"N").cloned()))
+            .and_then(|n| doc.resolve(&n).as_dict().cloned())
+            .and_then(|n| n.iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).find(|k| k != "Off"));
+        if state.as_deref() == Some(selected) || original.as_deref() == Some(selected) {
+            return original.unwrap_or_else(|| selected.to_string());
+        }
+    }
+    selected.to_string()
+}
+
+/// The on and off item values of a check box (`/PCItems`), or the widget's on state.
+fn items_of(doc: &Document, f: &FieldDatum) -> (String, String) {
+    let d = doc.get(f.obj);
+    let items: Vec<String> = d
+        .as_dict()
+        .and_then(|d| d.get(b"PCItems").map(|o| doc.resolve(o)))
+        .and_then(|a| a.as_array().map(|a| a.iter().filter_map(|x| x.as_string().map(|s| s.to_text())).collect()))
+        .unwrap_or_default();
+    let on = items.first().cloned().unwrap_or_else(|| "1".into());
+    let off = items.get(1).cloned().unwrap_or_default();
+    (on, off)
+}
+
+/// The Acrobat date pattern a field's format action names (`AFDate_FormatEx("yyyy-mm-dd")`).
+fn date_pattern_of(doc: &Document, f: &FieldDatum) -> Option<String> {
+    let d = doc.get(f.obj);
+    let aa = doc.resolve(d.as_dict()?.get(b"AA")?);
+    let fa = doc.resolve(aa.as_dict()?.get(b"F")?);
+    let js = text_of(doc, fa.as_dict()?, b"JS")?;
+    let i = js.find("AFDate_FormatEx(")?;
+    let rest = &js[i + "AFDate_FormatEx(".len()..];
+    let q = rest.find('"')?;
+    let body = &rest[q + 1..];
+    Some(body[..body.find('"')?].to_string())
+}
+
+/// A value to write: where (the field's SOM path, and the data path it binds to) and what.
+pub(super) struct Want {
+    pub(super) som: String,
+    pub(super) path: DataPath,
+    pub(super) text: String,
+    /// Create the node even for an empty value (an instance of a repeating subform).
+    pub(super) ensure: bool,
+}
+
+/// `tpl`, or the document's own template when none is given (parsed once).
+pub(super) fn with_template<T>(doc: &Document, tpl: Option<&Template>, f: impl FnOnce(Option<&Template>) -> T) -> T {
+    match tpl {
+        Some(t) => f(Some(t)),
+        None => {
+            let parsed = crate::script::template_of(doc).ok();
+            f(parsed.as_ref())
+        }
+    }
+}
+
+/// [`data_path`] when the template is known, else [`som_to_path`].
+pub(super) fn path_of(tpl: Option<&Template>, som: &str) -> DataPath {
+    match tpl {
+        Some(t) => data_path(t, som),
+        None => som_to_path(som),
+    }
+}
+
+/// The values the datasets should hold for `fields`, by data path: dates in each field's data
+/// picture (or ISO), check and radio states, choice values as saved.
+pub(super) fn wanted(doc: &Document, fields: &[FieldDatum], tpl: Option<&Template>) -> Vec<Want> {
+    let mut out = Vec::new();
+    for f in fields {
+        let som = som_of(doc, f);
+        let path = path_of(tpl, &som);
+        if path.is_empty() {
+            continue;
+        }
+        let text = match &f.data {
+            FieldData::Text(t) => match date_pattern_of(doc, f) {
+                Some(p) => match pattern_to_iso(t, &p) {
+                    // The date goes into the data in the field's data picture, or as an ISO date.
+                    Some(iso) => iso_to_data(iso, data_date_pattern(tpl, &som).as_deref()),
+                    None => t.clone(),
+                },
+                None => t.clone(),
+            },
+            FieldData::Check(on) => {
+                let (on_item, off_item) = items_of(doc, f);
+                if *on { on_item } else { off_item }
+            }
+            FieldData::Radio(sel) => radio_dataset_value(doc, f, sel),
+            FieldData::None => continue,
+        };
+        out.push(Want { som, path, text, ensure: false });
+    }
+    out
+}
+
+/// The values the datasets hold for `fields`: `(field name, what it should hold)`, only for
+/// fields the data mentions.
+pub fn read_values(doc: &Document, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
+    read_values_with(doc, None, fields)
+}
+
+/// [`read_values`] with the form's parsed template when the caller has it; `None` parses the
+/// document's.
+pub fn read_values_with(doc: &Document, tpl: Option<&Template>, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
+    with_template(doc, tpl, |t| values_at(doc, t, fields))
+}
+
+/// The values the document's datasets hold for `fields`, read in each field's data picture and
+/// shown in its own pattern; only fields the data mentions.
+fn values_at(doc: &Document, tpl: Option<&Template>, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
+    let Ok(Some(p)) = crate::read_packets(doc) else { return Vec::new() };
+    let Some(data) = parse_datasets(&p.xdp) else { return Vec::new() };
+    let mut out = Vec::new();
+    for f in fields {
+        let som = som_of(doc, f);
+        let path = path_of(tpl, &som);
+        let Some(text) = data.value_at(&path) else { continue };
+        let text = text.as_str();
+        let value = match &f.data {
+            FieldData::Text(_) => FieldData::Text(match date_pattern_of(doc, f) {
+                Some(pat) => iso_to_pattern(&data_to_iso(text, data_date_pattern(tpl, &som).as_deref()), &pat),
+                None => text.to_string(),
+            }),
+            FieldData::Check(_) => {
+                let (on, _) = items_of(doc, f);
+                FieldData::Check(is_on(text, &on))
+            }
+            FieldData::Radio(_) => FieldData::Radio((!text.trim().is_empty()).then(|| text.trim().to_string())),
+            FieldData::None => continue,
+        };
+        out.push((f.name.clone(), value));
+    }
+    out
+}
+
+/// Does a data value mean "checked" for a button whose on value is `on`?
+pub fn is_on(text: &str, on: &str) -> bool {
+    let t = text.trim();
+    if t == on {
+        return true;
+    }
+    !matches!(t.to_ascii_lowercase().as_str(), "" | "0" | "off" | "false" | "no") && on.trim().is_empty()
+}
diff --git a/crates/xfa/src/data/write.rs b/crates/xfa/src/data/write.rs
new file mode 100644
index 0000000000..282dd33ef5
--- /dev/null
+++ b/crates/xfa/src/data/write.rs
@@ -0,0 +1,264 @@
+use super::build::{MAX_INDEX, build_children, fresh_datasets};
+use super::merge::{Op, Within, merge_all, readable};
+use super::path::path_som;
+use super::values::{FieldDatum, Want, wanted, with_template};
+use super::*;
+
+/// What [`write_datasets`] did.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct DatasetsWrite {
+    /// The datasets packet changed (a new revision of it was added to the document).
+    pub written: bool,
+    /// Values that could not be written, and why.
+    pub warnings: Vec<String>,
+    /// The datasets stream written, when one was.
+    pub stream: Option<ObjRef>,
+}
+
+/// A packet stream's text and encoding; `None` (with a warning) when it can't be read exactly.
+fn packet_text(doc: &Document, o: &Object, warnings: &mut Vec<String>) -> Option<(String, Encoding)> {
+    let s = doc.resolve(o);
+    let Object::Stream(s) = &*s else {
+        warnings.push("The XFA data packet is not a stream; the field values were not written to it".into());
+        return None;
+    };
+    let bytes = match s.decoded_within(64 << 20) {
+        Ok(b) => b,
+        Err(e) => {
+            warnings.push(format!("The XFA data could not be decoded ({e}); the field values were not written to it"));
+            return None;
+        }
+    };
+    let decoded = crate::packets::decode(&bytes);
+    if decoded.is_none() {
+        warnings.push("The XFA data is neither UTF-8 nor UTF-16; the field values were not written to it, so it stays as it was".into());
+    }
+    decoded
+}
+
+/// Write the fields' values into the datasets packet, keeping all the data no field binds to.
+/// Nothing is written when the document has no XFA entry or the data already holds the values;
+/// values that can't be written are reported, never silently dropped.
+pub fn write_datasets(doc: &mut Document, fields: &[FieldDatum]) -> Result<DatasetsWrite, XfaError> {
+    write_datasets_reusing(doc, fields, None)
+}
+
+/// [`write_datasets`], replacing the stream `reuse` in place when the packet is that stream
+/// (written earlier in the same edit) rather than adding another.
+pub fn write_datasets_reusing(doc: &mut Document, fields: &[FieldDatum], reuse: Option<ObjRef>) -> Result<DatasetsWrite, XfaError> {
+    write_datasets_with(doc, None, fields, reuse)
+}
+
+/// [`write_datasets_reusing`] with the form's parsed template when the caller has it (it says
+/// which SOM segments are areas, see [`data_path`]); `None` parses the document's.
+pub fn write_datasets_with(
+    doc: &mut Document,
+    tpl: Option<&Template>,
+    fields: &[FieldDatum],
+    reuse: Option<ObjRef>,
+) -> Result<DatasetsWrite, XfaError> {
+    let wants = with_template(doc, tpl, |t| wanted(doc, fields, t));
+    rewrite(doc, &[Op::Values(&wants)], reuse)
+}
+
+/// Make sure the data has at least `count` instances of `name` under `parent` (a script added
+/// rows: the layout repeats the subform once per data instance).
+pub fn add_data_instances(doc: &mut Document, parent: &DataPath, name: &str, count: usize) -> Result<DatasetsWrite, XfaError> {
+    write_data_ops(doc, &[DataOp::Instances { parent: parent.clone(), name: name.to_string(), count }], None)
+}
+
+/// Put `text` at the data node `path` (a field with no widget, a hidden one or a draw, that a
+/// script gave a value), adding the node as needed.
+pub fn write_data_value(doc: &mut Document, path: &DataPath, text: &str) -> Result<DatasetsWrite, XfaError> {
+    write_data_ops(doc, &[DataOp::Value { path: path.clone(), text: text.to_string() }], None)
+}
+
+/// Remove the data node at `path` (a script removed a row).
+pub fn remove_data_instance(doc: &mut Document, path: &DataPath) -> Result<DatasetsWrite, XfaError> {
+    write_data_ops(doc, &[DataOp::Remove(path.clone())], None)
+}
+
+/// Most instance nodes one [`write_data_ops`] queues over all its passes (a removal starts a new
+/// pass, which asks for the instances again).
+const MAX_ENSURED: usize = 200_000;
+
+// Instance nodes write_data_ops has queued on this thread, for tests that bound its work.
+#[cfg(test)]
+thread_local! {
+    pub(crate) static ENSURED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// Apply `ops` to the datasets packet, in order, as one rewrite of it: everything one script
+/// event changed becomes a single new datasets stream. When the packet is already the stream
+/// `reuse` (written earlier for the same event), that stream is replaced in place instead of
+/// a new one being added. The stream written is in the report.
+pub fn write_data_ops(doc: &mut Document, ops: &[DataOp], reuse: Option<ObjRef>) -> Result<DatasetsWrite, XfaError> {
+    // Runs of values (and instances) merge in one pass; a value set twice keeps the last.
+    let mut steps: Vec<Vec<Want>> = Vec::new();
+    let mut removes: Vec<Option<DataPath>> = Vec::new();
+    let mut run: Vec<Want> = Vec::new();
+    // Instances queued in this run, by parent and name: asking for more only queues the rest.
+    let mut queued: HashMap<(&DataPath, &str), usize> = HashMap::new();
+    let (mut ensured, mut capped) = (0usize, false);
+    let flush = |run: &mut Vec<Want>, steps: &mut Vec<Vec<Want>>, removes: &mut Vec<Option<DataPath>>| {
+        if !run.is_empty() {
+            let mut seen = std::collections::HashSet::new();
+            let mut kept: Vec<Want> = std::mem::take(run).into_iter().rev().filter(|w| seen.insert((w.ensure, w.path.clone()))).collect();
+            kept.reverse();
+            steps.push(kept);
+            removes.push(None);
+        }
+    };
+    for op in ops {
+        match op {
+            DataOp::Value { path, text } if !path.is_empty() => {
+                // An empty value clears an existing node and needs no new one.
+                run.push(Want { som: path_som(path), path: path.clone(), text: text.clone(), ensure: false });
+            }
+            DataOp::Instances { parent, name, count } => {
+                let done = queued.entry((parent, name.as_str())).or_insert(0);
+                while *done < (*count).min(MAX_INDEX) {
+                    if ensured >= MAX_ENSURED {
+                        capped = true;
+                        break;
+                    }
+                    ensured += 1;
+                    #[cfg(test)]
+                    ENSURED.with(|n| n.set(n.get() + 1));
+                    let k = *done;
+                    *done += 1;
+                    let mut path = parent.clone();
+                    path.push((name.clone(), k));
+                    run.push(Want { som: format!("{name}[{k}]"), path, text: String::new(), ensure: true });
+                }
+            }
+            DataOp::Remove(path) if !path.is_empty() => {
+                flush(&mut run, &mut steps, &mut removes);
+                queued.clear();
+                steps.push(Vec::new());
+                removes.push(Some(path.clone()));
+            }
+            _ => {}
+        }
+    }
+    flush(&mut run, &mut steps, &mut removes);
+    let plan: Vec<Op> = steps
+        .iter()
+        .zip(&removes)
+        .map(|(w, r)| match r {
+            Some(p) => Op::Remove(p),
+            None => Op::Values(w),
+        })
+        .collect();
+    let mut written = rewrite(doc, &plan, reuse)?;
+    if capped {
+        written.warnings.push(format!("XFA data instances not written past {MAX_ENSURED}: the rows were added and removed too often"));
+    }
+    Ok(written)
+}
+
+/// Put `bytes` in the document as a datasets stream: in place of `old` when that is the stream
+/// `reuse` or already an unsaved overlay stream of `doc`, else as a new object.
+fn put_stream(doc: &mut Document, old: Option<&Object>, reuse: Option<ObjRef>, bytes: &[u8]) -> ObjRef {
+    let stream = Object::Stream(Stream::flate(Dict::new(), bytes));
+    match old.and_then(Object::as_ref) {
+        Some(r) if reuse == Some(r) || doc.is_edited(r.num) => {
+            doc.set(r, stream);
+            r
+        }
+        _ => doc.add(stream),
+    }
+}
+
+/// Longest packet text written (the packets together are read up to 64 MB).
+pub(super) const MAX_PACKET_WRITE: usize = 48 << 20;
+
+pub(super) fn rewrite(doc: &mut Document, ops: &[Op], reuse: Option<ObjRef>) -> Result<DatasetsWrite, XfaError> {
+    let mut report = DatasetsWrite::default();
+    if ops.is_empty() {
+        return Ok(report);
+    }
+    let Some(root) = doc.root() else { return Ok(report) };
+    let catalog = doc.get(root);
+    let Some(acro_obj) = catalog.as_dict().and_then(|c| c.get(b"AcroForm")).cloned() else { return Ok(report) };
+    let acro_ref = acro_obj.as_ref();
+    let Some(mut acro) = doc.resolve(&acro_obj).as_dict().cloned() else { return Ok(report) };
+    let Some(xfa) = acro.get(b"XFA").cloned() else { return Ok(report) };
+    let warnings = &mut report.warnings;
+    match &*doc.resolve(&xfa) {
+        Object::Array(items) => {
+            let mut items = items.clone();
+            let at = (0..items.len())
+                .step_by(2)
+                .find(|&i| items.get(i).and_then(|n| n.as_string()).is_some_and(|s| s.to_text() == "datasets") && i + 1 < items.len());
+            match at {
+                Some(i) => {
+                    let Some(existing) = items.get(i + 1).cloned() else { return Ok(report) };
+                    let Some((text, encoding)) = packet_text(doc, &existing, warnings) else { return Ok(report) };
+                    let Some(t) = merge_all(&text, Within::Packet, ops, warnings) else { return Ok(report) };
+                    if !readable(&t, Within::Packet, warnings) {
+                        return Ok(report);
+                    }
+                    let r = put_stream(doc, Some(&existing), reuse, &encode(&t, encoding));
+                    report.stream = Some(r);
+                    if let Some(slot) = items.get_mut(i + 1) {
+                        *slot = Object::Ref(r);
+                    }
+                }
+                None => {
+                    // No datasets packet yet: made from the first values, then the rest merged
+                    // in; before the postamble, or last.
+                    let Some(first) = ops.iter().position(|op| matches!(op, Op::Values(_))) else { return Ok(report) };
+                    let Some(Op::Values(wants)) = ops.get(first) else { return Ok(report) };
+                    let fresh = fresh_datasets(&build_children(wants, warnings));
+                    let text = merge_all(&fresh, Within::Packet, ops.get(first + 1..).unwrap_or_default(), warnings).unwrap_or(fresh);
+                    if !readable(&text, Within::Packet, warnings) {
+                        return Ok(report);
+                    }
+                    let r = doc.add(Object::Stream(Stream::flate(Dict::new(), text.as_bytes())));
+                    report.stream = Some(r);
+                    let pos = items.iter().position(|n| n.as_string().is_some_and(|s| s.to_text() == "postamble")).unwrap_or(items.len());
+                    items.insert(pos, Object::Ref(r));
+                    items.insert(pos, Object::String(PdfString::text("datasets")));
+                }
+            }
+            acro.set(b"XFA".to_vec(), Object::Array(items));
+        }
+        Object::Stream(_) => {
+            let Some((text, encoding)) = packet_text(doc, &xfa, warnings) else { return Ok(report) };
+            let Some(new) = merge_all(&text, Within::Xdp, ops, warnings) else { return Ok(report) };
+            if !readable(&new, Within::Xdp, warnings) {
+                return Ok(report);
+            }
+            let r = put_stream(doc, Some(&xfa), reuse, &encode(&new, encoding));
+            report.stream = Some(r);
+            acro.set(b"XFA".to_vec(), Object::Ref(r));
+        }
+        _ => return Ok(report),
+    }
+    match acro_ref {
+        Some(ar) => doc.set(ar, Object::Dict(acro)),
+        None => doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(acro)))?,
+    }
+    report.written = true;
+    Ok(report)
+}
+
+/// The datasets stream's object reference in `doc` (the `datasets` item in the `/XFA` array, or
+/// the single `/XFA` stream), when `doc` has one.
+pub(super) fn datasets_stream_ref(doc: &Document) -> Option<ObjRef> {
+    let root = doc.root()?;
+    let catalog = doc.get(root);
+    let acro = catalog.as_dict()?.get(b"AcroForm").map(|a| doc.resolve(a))?;
+    let xfa = acro.as_dict()?.get(b"XFA")?;
+    match &*doc.resolve(xfa) {
+        Object::Array(items) => {
+            let at = (0..items.len())
+                .step_by(2)
+                .find(|&i| items.get(i).and_then(|n| n.as_string()).is_some_and(|s| s.to_text() == "datasets") && i + 1 < items.len())?;
+            items.get(at + 1)?.as_ref()
+        }
+        Object::Stream(_) => xfa.as_ref(),
+        _ => None,
+    }
+}
diff --git a/crates/xfa/src/fixtures.rs b/crates/xfa/src/fixtures.rs
index b76b3efa1a..8f6e0f7ee8 100644
--- a/crates/xfa/src/fixtures.rs
+++ b/crates/xfa/src/fixtures.rs
@@ -144,6 +144,43 @@ pub fn static_shell(data: &str) -> Vec<u8> {
     assemble(objs)
 }
 
+/// A static XFA form of `n` text fields `form1[0].page1[0].f<i>[0]` on one page, whose values
+/// (`v<i>`) are only in its datasets, as when another viewer filled it in. The first field is
+/// read-only.
+pub fn static_shell_many(n: usize) -> Vec<u8> {
+    let data: String = (0..n).map(|i| format!("<f{i}>v{i}</f{i}>")).collect();
+    let xdp = format!(
+        "<xdp:xdp xmlns:xdp=\"http://ns.adobe.com/xdp/\"><template xmlns=\"http://www.xfa.org/schema/xfa-template/3.3/\"><subform name=\"form1\"/></template><xfa:datasets xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\"><xfa:data><form1><page1>{data}</page1></form1></xfa:data></xfa:datasets></xdp:xdp>"
+    );
+    // Objects 1–7, then the widgets from 8.
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", i + 8)).collect();
+    let kids = kids.join(" ");
+    let mut objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /AcroForm << /XFA 5 0 R /Fields [6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv << /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> >> >> >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Annots [{kids}] >>").into_bytes(),
+        b"<< /Length 0 >>\nstream\n\nendstream".to_vec(),
+        format!("<< /Length {} >>\nstream\n{xdp}\nendstream", xdp.len()).into_bytes(),
+        b"<< /T (form1[0]) /Kids [7 0 R] >>".to_vec(),
+        format!("<< /T (page1[0]) /Parent 6 0 R /Kids [{kids}] >>").into_bytes(),
+    ];
+    for i in 0..n {
+        let y = 760 - (i % 50) * 14;
+        let x = 36 + (i / 50) * 110;
+        // The first field is read-only: its data value is not taken.
+        let flags = if i == 0 { " /Ff 1" } else { "" };
+        objs.push(
+            format!(
+                "<< /Type /Annot /Subtype /Widget /FT /Tx /T (f{i}[0]){flags} /Parent 7 0 R /Rect [{x} {y} {} {}] /P 3 0 R /DA (/Helv 9 Tf 0 g) >>",
+                x + 100,
+                y + 12
+            )
+            .into_bytes(),
+        );
+    }
+    assemble(objs)
+}
+
 /// A PDF file holding `objs` as objects 1, 2, … in order, with a cross-reference table and a
 /// trailer whose root is object 1.
 fn assemble(objs: Vec<Vec<u8>>) -> Vec<u8> {
diff --git a/crates/xfa/src/layout.rs b/crates/xfa/src/layout.rs
index 3657bdbe2e..73c6bde90f 100644
--- a/crates/xfa/src/layout.rs
+++ b/crates/xfa/src/layout.rs
@@ -14,9 +14,26 @@ use base64::Engine;
 
 use crate::XfaError;
 use crate::data::{DataNode, data_date_letters, data_path, data_to_iso, date_letters, is_on, iso_to_pattern};
-use crate::model::*;
+use crate::model::{
+    Access, Area, Border, Common, Draw, ExclGroup, Field, Font, HAlign, Layout, Margin, Node, Occur, PageArea, PageRole, Para, Placement, Presence,
+    Rect, Script, SomIndices, Stroke, Subform, Template, Ui, VAlign, Value,
+};
 use crate::text::{self, Block, Face, Span};
 
+mod common;
+mod draw;
+mod field;
+mod flow;
+mod items;
+mod measure;
+mod pages;
+
+use common::collect_values;
+pub(crate) use common::date_pattern;
+pub use common::formatted_value;
+pub(crate) use items::UNDERLINE_DROP;
+pub use items::{Action, BorderShape, Form, Item, Page, Rounded, Widget, WidgetBorder, WidgetKind};
+
 /// Most pages a form may lay out to.
 pub const MAX_PAGES: usize = 500;
 /// Most items (text spans, lines, widgets…) across all pages.
@@ -37,150 +54,6 @@ const MAX_IMAGE_BYTES: usize = 256 << 20;
 /// Placeholder for the page count in text laid out before the count is known.
 const PAGE_COUNT_MARK: char = '\u{E000}';
 
-/// How far below its baseline an underline is drawn, in the text's size: an underline is the
-/// level line pushed just before its span, this far below it (the PDF writer tells it apart from
-/// a rule by this).
-pub(crate) const UNDERLINE_DROP: f64 = 0.1;
-
-#[derive(Clone, Debug, PartialEq)]
-pub enum Item {
-    Fill {
-        rect: Rect,
-        color: [f64; 3],
-    },
-    Line {
-        from: (f64, f64),
-        to: (f64, f64),
-        width: f64,
-        color: [f64; 3],
-        dashed: bool,
-    },
-    /// A box with rounded (or inverted) corners: its fill, and its edge drawn inside it.
-    Rounded(Box<Rounded>),
-    Text(Span),
-    Image {
-        rect: Rect,
-        data: Arc<Vec<u8>>,
-        content_type: String,
-    },
-    Widget(Box<Widget>),
-}
-
-/// A box with rounded corners ([`Item::Rounded`]).
-#[derive(Clone, Debug, PartialEq)]
-pub struct Rounded {
-    pub rect: Rect,
-    /// Top-left, top-right, bottom-right and bottom-left radii, each at most half the box's
-    /// shorter side.
-    pub radii: [f64; 4],
-    /// Corners whose curve goes into the box rather than around it, in the same order.
-    pub inverted: [bool; 4],
-    pub fill: Option<[f64; 3]>,
-    /// The edge: its width, colour and whether it is dashed.
-    pub edge: Option<(f64, [f64; 3], bool)>,
-    /// A page break cut the box here: that side has no edge, and its corners are square.
-    pub open_top: bool,
-    pub open_bottom: bool,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub enum WidgetKind {
-    Text,
-    /// A text field whose characters are shown as asterisks.
-    Password,
-    /// A drop-down (`list_box` false) or list box: `options` are (saved value, shown text).
-    Choice {
-        options: Vec<(String, String)>,
-        list_box: bool,
-        multi: bool,
-        editable: bool,
-    },
-    /// A signature field, to be signed in the app.
-    Signature,
-    /// An image field: a push button that picks a picture (the picture itself is page content).
-    Image,
-    /// A date field with its Acrobat format pattern (`yyyy-mm-dd`).
-    Date(String),
-    CheckBox {
-        on: String,
-        round: bool,
-    },
-    Radio {
-        group: String,
-        on: String,
-        round: bool,
-    },
-    Button {
-        caption: String,
-    },
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum BorderShape {
-    None,
-    Full,
-    Underline,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct WidgetBorder {
-    pub color: Option<[f64; 3]>,
-    pub fill: Option<[f64; 3]>,
-    pub shape: BorderShape,
-    pub width: f64,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum Action {
-    Reset,
-    Print,
-    SaveAs,
-    Url(String),
-    /// Any other click script: run by the XFA scripting engine.
-    Script(String),
-}
-
-/// An interactive field to create as an AcroForm widget.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Widget {
-    pub rect: Rect,
-    pub kind: WidgetKind,
-    /// The PDF field name (unique in the form, no periods).
-    pub name: String,
-    /// The template's scripting object model path, for data round trips.
-    pub som: String,
-    pub tooltip: Option<String>,
-    pub face: Face,
-    pub h_align: HAlign,
-    pub multiline: bool,
-    pub max_chars: Option<usize>,
-    pub read_only: bool,
-    pub border: WidgetBorder,
-    /// The field's value: saved (bound) values for choice lists, newline-separated when several.
-    pub value: Option<String>,
-    /// The template's default value (what a reset restores); data values are not defaults.
-    pub default: Option<String>,
-    pub action: Option<Action>,
-    /// Check boxes: the on and off values of the data; radio buttons: the on value.
-    pub items: Vec<String>,
-    /// A text field that doesn't scroll: it takes no more text than it shows (`DoNotScroll`).
-    pub no_scroll: bool,
-}
-
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Page {
-    pub width: f64,
-    pub height: f64,
-    pub items: Vec<Item>,
-}
-
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct Form {
-    pub pages: Vec<Page>,
-    pub fields: usize,
-    pub warnings: Vec<String>,
-}
-
 /// Inherited text defaults and the SOM path of the enclosing containers.
 #[derive(Clone)]
 struct Ctx {
@@ -355,1740 +228,3 @@ pub fn layout(tpl: &Template, data: Option<&DataNode>) -> Result<Form, XfaError>
 thread_local! {
     pub(crate) static EMBED_COPIED: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
 }
-
-fn collect_values(nodes: &[Node], out: &mut HashMap<String, String>, depth: usize) {
-    if depth > MAX_DEPTH {
-        return;
-    }
-    for n in nodes {
-        match n {
-            Node::Field(f) => {
-                if let Some(id) = &f.common.id {
-                    out.insert(id.clone(), f.value.plain().unwrap_or_default());
-                }
-            }
-            Node::Subform(s) => {
-                collect_values(&s.children, out, depth + 1);
-                if let Some(ps) = &s.page_set {
-                    for a in &ps.areas {
-                        collect_values(&a.items, out, depth + 1);
-                    }
-                }
-            }
-            Node::Area(a) => collect_values(&a.children, out, depth + 1),
-            Node::ExclGroup(_) | Node::Draw(_) => {}
-        }
-    }
-}
-
-fn clamp_opt(v: f64, min: Option<f64>, max: Option<f64>) -> f64 {
-    let mut v = v;
-    if let Some(m) = min {
-        v = v.max(m);
-    }
-    if let Some(m) = max
-        && m > 0.0
-    {
-        v = v.min(m);
-    }
-    v.max(0.0)
-}
-
-/// Does `node` flow (may be split across pages) rather than being placed as one block?
-fn splittable(node: &Node) -> bool {
-    matches!(node, Node::Subform(s) if matches!(s.layout, Layout::Tb | Layout::Table) && s.common.h.is_none())
-}
-
-/// Top and bottom of an item a page break must not cut (text, a picture, a field); `None`
-/// for fills and lines, which are cut at the break.
-fn solid_extent(item: &Item) -> Option<(f64, f64)> {
-    match item {
-        Item::Text(s) => Some((s.baseline - s.face.size * 0.8, s.baseline + s.face.size * 0.2)),
-        Item::Image { rect, .. } => Some((rect.y, rect.bottom())),
-        Item::Widget(w) => Some((w.rect.y, w.rect.bottom())),
-        Item::Fill { .. } | Item::Line { .. } | Item::Rounded(_) => None,
-    }
-}
-
-/// `item` as the part above `cut` and the part below: solid items go whole to the side their
-/// top is on, fills and lines crossing the cut are cut in two.
-fn divide(item: Item, cut: f64) -> (Option<Item>, Option<Item>) {
-    if let Some((top, _)) = solid_extent(&item) {
-        return if top < cut - 0.01 { (Some(item), None) } else { (None, Some(item)) };
-    }
-    match item {
-        Item::Fill { rect, color } => {
-            if rect.bottom() <= cut + 0.01 {
-                (Some(Item::Fill { rect, color }), None)
-            } else if rect.y >= cut - 0.01 {
-                (None, Some(Item::Fill { rect, color }))
-            } else {
-                let above = Rect::new(rect.x, rect.y, rect.w, cut - rect.y);
-                let below = Rect::new(rect.x, cut, rect.w, rect.bottom() - cut);
-                (Some(Item::Fill { rect: above, color }), Some(Item::Fill { rect: below, color }))
-            }
-        }
-        Item::Line { from, to, width, color, dashed } => {
-            let (lo, hi) = if from.1 <= to.1 { (from, to) } else { (to, from) };
-            if lo.1 >= cut {
-                (None, Some(Item::Line { from, to, width, color, dashed }))
-            } else if hi.1 <= cut {
-                (Some(Item::Line { from, to, width, color, dashed }), None)
-            } else {
-                // lo.1 < cut < hi.1, so the divisor is positive.
-                let t = (cut - lo.1) / (hi.1 - lo.1);
-                let mid = (lo.0 + (hi.0 - lo.0) * t, cut);
-                (Some(Item::Line { from: lo, to: mid, width, color, dashed }), Some(Item::Line { from: mid, to: hi, width, color, dashed }))
-            }
-        }
-        Item::Rounded(r) => {
-            if r.rect.bottom() <= cut + 0.01 {
-                (Some(Item::Rounded(r)), None)
-            } else if r.rect.y >= cut - 0.01 {
-                (None, Some(Item::Rounded(r)))
-            } else {
-                // Each part keeps the corners on its side, rounded no more than its own height
-                // allows, and is open where it was cut.
-                let [tl, tr, br, bl] = r.radii;
-                let above = Rect::new(r.rect.x, r.rect.y, r.rect.w, cut - r.rect.y);
-                let below = Rect::new(r.rect.x, cut, r.rect.w, r.rect.bottom() - cut);
-                let fit = |v: f64, h: f64| v.min(h.max(0.0));
-                let upper = Rounded { rect: above, radii: [fit(tl, above.h), fit(tr, above.h), 0.0, 0.0], open_bottom: true, ..(*r).clone() };
-                let lower = Rounded { rect: below, radii: [0.0, 0.0, fit(br, below.h), fit(bl, below.h)], open_top: true, ..*r };
-                (Some(Item::Rounded(Box::new(upper))), Some(Item::Rounded(Box::new(lower))))
-            }
-        }
-        other => (Some(other), None),
-    }
-}
-
-/// `item` moved by (`dx`, `dy`).
-fn moved(mut item: Item, dx: f64, dy: f64) -> Item {
-    match &mut item {
-        Item::Fill { rect, .. } | Item::Image { rect, .. } => {
-            rect.x += dx;
-            rect.y += dy;
-        }
-        Item::Rounded(r) => {
-            r.rect.x += dx;
-            r.rect.y += dy;
-        }
-        Item::Line { from, to, .. } => {
-            *from = (from.0 + dx, from.1 + dy);
-            *to = (to.0 + dx, to.1 + dy);
-        }
-        Item::Text(s) => {
-            s.x += dx;
-            s.baseline += dy;
-        }
-        Item::Widget(w) => {
-            w.rect.x += dx;
-            w.rect.y += dy;
-        }
-    }
-    item
-}
-
-fn is_row(node: &Node) -> bool {
-    matches!(node, Node::Subform(s) if s.layout == Layout::Row)
-}
-
-/// The Acrobat date pattern for an XFA picture clause such as `date{YYYY-MM-DD}`.
-pub(crate) fn date_pattern(picture: Option<&str>) -> String {
-    picture.and_then(date_letters).unwrap_or_else(|| "yyyy-mm-dd".into())
-}
-
-/// What scripts read as a field's `formattedValue` when its display picture is `picture`: the
-/// ISO date `raw` shown in a date picture (`date{YYYYMMDD}` turns `2026-10-20` into
-/// `20261020`; of several alternatives, the first). `None` for other kinds of picture, for a
-/// clause this can't read or show (month and weekday names) and for a value that isn't an ISO
-/// date: the raw value stands then.
-pub fn formatted_value(picture: &str, raw: &str) -> Option<String> {
-    let first = picture.split('|').next()?.trim();
-    let rest = first.strip_prefix("date")?;
-    if !rest.starts_with(['{', '(']) {
-        return None;
-    }
-    let pattern = date_pattern(Some(first));
-    // A picture with parts this can't show yet (month or weekday names, `MMM` or `EEE`) would
-    // leave them as letters: the raw value stands then.
-    let shows = |t: &String| !t.chars().all(|c| c.is_ascii_alphabetic()) || matches!(t.as_str(), "yyyy" | "yy" | "mm" | "m" | "dd" | "d");
-    if !crate::data::date_tokens(&pattern).iter().all(shows) {
-        return None;
-    }
-    // Only the ISO date's own shape (`2026-10-20`): `2026-1-2` is not one, and stands.
-    let b = raw.as_bytes();
-    let iso = b.len() == 10 && b.iter().enumerate().all(|(i, c)| if i == 4 || i == 7 { *c == b'-' } else { c.is_ascii_digit() });
-    if !iso {
-        return None;
-    }
-    let shown = iso_to_pattern(raw, &pattern);
-    (shown != raw).then_some(shown)
-}
-
-/// The native PDF action a button's click script amounts to (a reset, print, save or link),
-/// else the script itself to run; `None` without a click script.
-fn button_action(scripts: &[Script]) -> Option<Action> {
-    let s = scripts.iter().find(|s| s.activity == "click")?;
-    let t = &s.text;
-    // Only a single-statement idiom becomes a native PDF action; anything else is run by the
-    // XFA scripting engine.
-    let one = t.trim().trim_end_matches(';');
-    let single = !one.contains(';') && !one.contains('\n');
-    if !single {
-        return (!t.trim().is_empty()).then(|| Action::Script(t.clone()));
-    }
-    if t.contains("resetData") {
-        Some(Action::Reset)
-    } else if t.contains("host.print") || t.contains("execMenuItem(\"Print\")") {
-        Some(Action::Print)
-    } else if t.contains("SaveAs") || t.contains("execMenuItem(\"Save\")") {
-        Some(Action::SaveAs)
-    } else if let Some(i) = t.find("launchURL(") {
-        let rest = &t[i + "launchURL(".len()..];
-        let q = rest.find(['"', '\''])?;
-        let quote = rest[q..].chars().next()?;
-        let body = &rest[q + 1..];
-        let end = body.find(quote)?;
-        Some(Action::Url(body[..end].to_string()))
-    } else if t.trim().is_empty() {
-        None
-    } else {
-        Some(Action::Script(t.clone()))
-    }
-}
-
-/// A PDF field name: no periods (they separate hierarchy levels), no control characters.
-fn clean_name(name: &str) -> String {
-    let s: String = name.chars().filter(|c| !c.is_control()).map(|c| if c == '.' { '_' } else { c }).collect();
-    let s = s.trim().to_string();
-    if s.is_empty() { "field".into() } else { s }
-}
-
-impl Layouter<'_> {
-    fn warn_once(&mut self, msg: impl Into<String>) {
-        let m = msg.into();
-        if self.warned.insert(m.clone()) && self.warnings.len() < 100 {
-            self.warnings.push(m);
-        }
-    }
-
-    fn page_no(&self) -> usize {
-        self.pages.len()
-    }
-
-    /// The text an embedded field `id` shows, at most `max` bytes of a field value (the page
-    /// number and count are a few bytes; the text layout cuts them).
-    fn embed(&self, id: &str, max: usize) -> String {
-        let v = match self.tpl.page_roles.iter().find(|(i, _)| i == id).map(|(_, r)| *r) {
-            Some(PageRole::Number) => self.page_no().to_string(),
-            Some(PageRole::Count) => PAGE_COUNT_MARK.to_string(),
-            None => self.values.get(id).map(|v| text::prefix(v, max).to_string()).unwrap_or_default(),
-        };
-        #[cfg(test)]
-        EMBED_COPIED.with(|c| c.set(c.get().saturating_add(v.len() as u64)));
-        v
-    }
-
-    /// `TooLarge` once the measurement budget is spent (sizes measured after that are guesses).
-    fn check_measures(&self) -> Result<(), XfaError> {
-        if self.measures.get() > MAX_MEASURES {
-            return Err(XfaError::TooLarge("the form is nested too deeply to lay out".into()));
-        }
-        Ok(())
-    }
-
-    fn push(&mut self, item: Item) -> Result<(), XfaError> {
-        self.check_measures()?;
-        self.items += 1;
-        if self.items > MAX_ITEMS {
-            return Err(XfaError::TooLarge("the form has too many objects to lay out".into()));
-        }
-        if let Some(p) = self.pages.last_mut() {
-            p.items.push(item);
-        }
-        Ok(())
-    }
-
-    fn push_block(&mut self, b: Block) -> Result<(), XfaError> {
-        for s in b.spans {
-            if s.face.underline {
-                let w = s.face.width(&s.text);
-                let y = s.baseline + s.face.size * UNDERLINE_DROP;
-                self.push(Item::Line { from: (s.x, y), to: (s.x + w, y), width: (s.face.size * 0.06).max(0.3), color: s.face.color, dashed: false })?;
-            }
-            if !s.text.trim().is_empty() {
-                self.push(Item::Text(s))?;
-            }
-        }
-        Ok(())
-    }
-
-    // ───────────────────────────────────────────────────────────────────────── pages
-
-    fn new_page(&mut self) -> Result<(), XfaError> {
-        let idx =
-            (0..self.areas.len()).find(|&i| self.areas[i].occur_max.is_none_or(|m| self.uses[i] < m)).unwrap_or(self.areas.len().saturating_sub(1));
-        self.new_page_of(idx)
-    }
-
-    /// Once the body has been laid out, give every page area that has been used fewer times than
-    /// its `occur min` the pages it still needs, in template order, after the body's pages.
-    fn satisfy_page_area_minimums(&mut self) -> Result<(), XfaError> {
-        let areas = Rc::clone(&self.areas);
-        for (idx, area) in areas.iter().enumerate() {
-            while self.uses.get(idx).is_some_and(|u| *u < area.occur_min) {
-                self.new_page_of(idx)?;
-            }
-        }
-        Ok(())
-    }
-
-    /// Start a page from page area `idx`.
-    fn new_page_of(&mut self, idx: usize) -> Result<(), XfaError> {
-        if self.pages.len() >= MAX_PAGES {
-            return Err(XfaError::TooLarge(format!("the form lays out to more than {MAX_PAGES} pages")));
-        }
-        let areas = Rc::clone(&self.areas);
-        let Some(area) = areas.get(idx) else {
-            return Err(XfaError::Malformed("the template has no page area".into()));
-        };
-        if let Some(u) = self.uses.get_mut(idx) {
-            *u += 1;
-        }
-        self.pages.push(Page { width: area.width, height: area.height, items: Vec::new() });
-        let content = area.content.first().copied().unwrap_or(Rect::new(0.0, 0.0, area.width, area.height));
-        self.cur = Some(Cursor { area: idx, content: 0, rect: content, y: content.y, placed: false });
-        // Master page content: positioned draws and fields.
-        let ctx = Ctx { font: Font::default(), para: Para::default(), som: area.name.clone().map(|n| format!("{n}[0]")).unwrap_or_default() };
-        let page_rect = Rect::new(0.0, 0.0, area.width, area.height);
-        let sibs = SomIndices::of(&area.items);
-        for (i, item) in area.items.iter().enumerate() {
-            self.draw_positioned_child(item, page_rect, &ctx, 1, sibs.at(i))?;
-        }
-        Ok(())
-    }
-
-    /// Move to the next content area, or the next page.
-    fn next_area(&mut self) -> Result<(), XfaError> {
-        if let Some(c) = &self.cur
-            && let Some(area) = self.areas.get(c.area)
-            && let Some(next) = area.content.get(c.content + 1).copied()
-        {
-            let i = c.content + 1;
-            self.cur = Some(Cursor { area: c.area, content: i, rect: next, y: next.y, placed: false });
-            return Ok(());
-        }
-        self.new_page()
-    }
-
-    /// The current content area, how far down it the flow is, and whether anything has been
-    /// placed in it; before the first page, an empty letter-size page from its top.
-    fn cursor(&self) -> (Rect, f64, bool) {
-        match &self.cur {
-            Some(c) => (c.rect, c.y, c.placed),
-            None => (Rect::new(0.0, 0.0, 612.0, 792.0), 0.0, false),
-        }
-    }
-
-    /// Where the flow is now ([`FlowMark`]); `None` before the first page.
-    fn flow_mark(&self) -> Option<FlowMark> {
-        let c = self.cur.as_ref()?;
-        Some(FlowMark { page: self.pages.len(), area: c.area, content: c.content, y: c.y, items: self.pages.last().map_or(0, |p| p.items.len()) })
-    }
-
-    /// Whether the flow is still in the content area `m` was taken in.
-    fn on_area(&self, m: &FlowMark) -> bool {
-        self.pages.len() == m.page && self.cur.as_ref().is_some_and(|c| c.area == m.area && c.content == m.content)
-    }
-
-    /// Whether page `page` (an index) got anything from item `at` on.
-    fn has_items_from(&self, page: usize, at: usize) -> bool {
-        self.pages.get(page).is_some_and(|p| p.items.len() > at)
-    }
-
-    /// Break the flowed subforms being laid out ([`Self::frames`]) across content areas, as
-    /// another viewer breaks such a section on a synthetic form: each one's part here ends after
-    /// its content and its bottom margin (the innermost first, each inside the next), the flow
-    /// moves to the next content area, and each starts a new part there after its top margin
-    /// (the outermost first). The top margins take only what the `need` points of what comes next
-    /// leave of the new area: a child that fits a fresh area but not after the margins would
-    /// otherwise run past its bottom, out of its border. `to_page` moves to a new page instead (a
-    /// child's own page break), which breaks the subforms around it the same way.
-    fn break_frames(&mut self, need: f64, to_page: bool) -> Result<(), XfaError> {
-        let (rect, mut y, _) = self.cursor();
-        let page = self.pages.len().saturating_sub(1);
-        let here: Vec<bool> = self.frames.iter().map(|f| self.on_area(&f.part)).collect();
-        let filled: Vec<bool> = self.frames.iter().map(|f| self.has_items_from(page, f.part.items)).collect();
-        for ((f, here), filled) in self.frames.iter_mut().zip(here).zip(filled).rev() {
-            y = (y + f.margin.bottom).min(rect.bottom());
-            if !here {
-                f.lost = true;
-            } else if filled && y - f.part.y >= 0.01 {
-                f.parts.push((page, f.part.items, Rect::new(f.x, f.part.y, f.w, y - f.part.y)));
-            }
-        }
-        if to_page {
-            self.new_page()?;
-        } else {
-            self.next_area()?;
-        }
-        let (rect, y, _) = self.cursor();
-        let mut room = (rect.bottom() - y - need).max(0.0);
-        for i in 0..self.frames.len() {
-            let Some(mark) = self.flow_mark() else { break };
-            let Some(f) = self.frames.get_mut(i) else { break };
-            f.part = mark;
-            // `max` before `min`: a NaN margin counts as none and leaves `room` a number.
-            let top = f.margin.top.max(0.0).min(room);
-            room = (room - top).max(0.0);
-            self.advance(top);
-        }
-        Ok(())
-    }
-
-    /// Close flowed subform `f` once its content is placed: its last part ends where the flow
-    /// is, and its border (edges and fill) is drawn round each part, closed on every side, under
-    /// that part's content. One holding something that didn't fit its content area ([`Frame::lost`])
-    /// is drawn without its border, and the layout says so.
-    fn finish_frame(&mut self, mut f: Frame) -> Result<(), XfaError> {
-        let Some(b) = f.border.take() else { return Ok(()) };
-        if b.fill().is_none() && b.visible_edges() == [false; 4] {
-            return Ok(());
-        }
-        let (area, end, _) = self.cursor();
-        // The bottom margin stays in the content area, as at a break; content that itself ran
-        // past it has already cost the section its border ([`Self::overflowed`]).
-        let end = end.min(area.bottom()).max(end - f.margin.bottom);
-        let page = self.pages.len().saturating_sub(1);
-        if !self.on_area(&f.part) {
-            f.lost = true;
-        } else if self.has_items_from(page, f.part.items) && end - f.part.y >= 0.01 {
-            f.parts.push((page, f.part.items, Rect::new(f.x, f.part.y, f.w, end - f.part.y)));
-        }
-        if f.lost {
-            self.warn_once("a bordered section holding an item that doesn't fit on its page is drawn without its border");
-            return Ok(());
-        }
-        // The last part first: a part's place on its page stays where it was found.
-        for (page, at, rect) in f.parts.into_iter().rev() {
-            self.insert_border(&b, rect, page, at)?;
-        }
-        Ok(())
-    }
-
-    /// Draw border `b` round `rect` on page `page` (an index), under what that page got from item
-    /// `at` on.
-    fn insert_border(&mut self, b: &Border, rect: Rect, page: usize, at: usize) -> Result<(), XfaError> {
-        let before = self.pages.last().map_or(0, |p| p.items.len());
-        self.draw_border(b, rect)?;
-        let drawn: Vec<Item> = match self.pages.last_mut() {
-            Some(p) => {
-                let from = before.min(p.items.len());
-                p.items.drain(from..).collect()
-            }
-            None => return Ok(()),
-        };
-        if let Some(target) = self.pages.get_mut(page) {
-            let at = at.min(target.items.len());
-            target.items.splice(at..at, drawn);
-        }
-        Ok(())
-    }
-
-    /// Move the cursor down (margins and spacing: the area still counts as empty).
-    fn advance(&mut self, dy: f64) {
-        if let Some(c) = &mut self.cur {
-            c.y += dy.max(0.0);
-        }
-    }
-
-    /// Move past something that was placed.
-    fn place(&mut self, dy: f64) {
-        if let Some(c) = &mut self.cur {
-            c.y += dy.max(0.0);
-            c.placed = true;
-        }
-        let (_, y, _) = self.cursor();
-        self.overflowed(y);
-    }
-
-    /// Something was placed down to `bottom`: past the content area's bottom, the flowed subforms
-    /// it is inside can't hold it in a part, and are drawn without their border.
-    fn overflowed(&mut self, bottom: f64) {
-        let (rect, _, _) = self.cursor();
-        if bottom > rect.bottom() + 0.01 {
-            for f in &mut self.frames {
-                f.lost = true;
-            }
-        }
-    }
-
-    /// Make room for `h`, with `after` more drawn before it should it move (a table's overflow
-    /// leader): stay, or move to the next content area / page. Returns whether a break happened.
-    /// Something that fits a fresh area breaks the flowed subforms it is in with it
-    /// ([`Self::break_frames`]), a table's rows included; one taller than an area just moves on,
-    /// and those subforms are drawn without their border ([`Self::finish_frame`]).
-    fn make_room(&mut self, h: f64, after: f64) -> Result<bool, XfaError> {
-        let (rect, y, placed) = self.cursor();
-        if y + h <= rect.bottom() + 0.01 || !placed {
-            return Ok(false);
-        }
-        if h <= rect.h + 0.01 {
-            self.break_frames(h + after, false)?;
-        } else {
-            self.next_area()?;
-        }
-        Ok(true)
-    }
-
-    /// Place `node` as one block of size (`w`, `h`) at the cursor: in this content area when it fits,
-    /// in the next when it fits there, and across as many as it takes when it is taller than a
-    /// content area (a positioned or fixed-height subform holding more than a page).
-    fn flow_block(&mut self, node: &Node, x: f64, (w, h): (f64, f64), ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
-        let (rect, y, _) = self.cursor();
-        if y + h > rect.bottom() + 0.01 && h <= rect.h + 0.01 {
-            self.make_room(h, 0.0)?;
-        }
-        let (rect, y, _) = self.cursor();
-        let first = self.pages.last().map_or(0, |p| p.items.len());
-        self.leaves.clear();
-        self.draw_node(node, Rect::new(x, y, w, h), ctx, depth, sib)?;
-        let page_h = self.pages.last().map_or(f64::INFINITY, |p| p.height);
-        // What was drawn, when it is lower than the block's own height says (content that
-        // outgrows a fixed height) and ends off the page.
-        let drawn = self
-            .pages
-            .last()
-            .and_then(|p| p.items.get(first..))
-            .unwrap_or_default()
-            .iter()
-            .filter_map(solid_extent)
-            .map(|e| e.1)
-            .fold(y + h, f64::max);
-        if y + h <= rect.bottom() + 0.01 && drawn <= page_h + 0.01 {
-            self.leaves.clear();
-            self.place(h);
-            return Ok(());
-        }
-        self.split_block(first, y, drawn)
-    }
-
-    /// Remember that the items the last page got since `start` are one field or draw at
-    /// `rect`, to be kept together by a page break.
-    fn keep_whole(&mut self, start: usize, rect: Rect) {
-        let end = self.pages.last().map_or(0, |p| p.items.len());
-        if end > start {
-            self.leaves.push((start, end, rect.y, rect.bottom()));
-        }
-    }
-
-    fn item_count(&self) -> usize {
-        self.pages.last().map_or(0, |p| p.items.len())
-    }
-
-    /// Spread the items the last page holds from index `first` on (a block drawn from `top` to
-    /// `end`, past the bottom of its content area) over this and the following content areas.
-    /// Breaks fall between text, pictures and fields, never through one that fits in an area;
-    /// fills and lines are cut at the break.
-    fn split_block(&mut self, first: usize, top: f64, end: f64) -> Result<(), XfaError> {
-        let items: Vec<Item> = match self.pages.last_mut() {
-            Some(p) if first <= p.items.len() => p.items.split_off(first),
-            _ => return Ok(()),
-        };
-        // Each item with the extent of the field or draw it belongs to: such a leaf moves
-        // whole (its border with its text), unless it is taller than a content area.
-        let area_h = self.cursor().0.h;
-        let mut extents: Vec<Option<(f64, f64)>> = vec![None; items.len()];
-        for (start, end, top, bottom) in std::mem::take(&mut self.leaves) {
-            if bottom - top <= area_h + 0.01
-                && let Some(slots) = start.checked_sub(first).and_then(|s| extents.get_mut(s..end.saturating_sub(first)))
-            {
-                slots.fill(Some((top, bottom)));
-            }
-        }
-        let mut rest: Vec<(Item, Option<(f64, f64)>)> = items.into_iter().zip(extents).collect();
-        let origin_x = self.cursor().0.x;
-        // An item's place on the current page is its drawn place moved by (dx, -shift).
-        let (mut dx, mut shift) = (0.0, 0.0);
-        let mut seg_top = top;
-        let mut first_segment = true;
-        loop {
-            let (rect, _, placed) = self.cursor();
-            let limit = rect.bottom() + shift;
-            let mut cut = limit;
-            if rect.h < 1.0 {
-                // No room to split into: leave the rest here.
-                cut = f64::INFINITY;
-            } else {
-                // The lowest break at or above the bottom that crosses no solid item: going
-                // through them from the lowest top up, a break moved to an item's top can't
-                // cross one already passed.
-                let mut solid: Vec<(f64, f64)> =
-                    rest.iter().filter_map(|(item, kept)| kept.or_else(|| solid_extent(item))).filter(|e| e.0 < limit - 0.01).collect();
-                solid.sort_by(|a, b| b.0.total_cmp(&a.0));
-                for (t, b) in solid {
-                    if t < cut - 0.01 && b > cut + 0.01 {
-                        cut = t;
-                    }
-                }
-                if cut <= seg_top + 0.01 {
-                    // An item taller than what is left. Start it in a fresh area if this one
-                    // already holds something; otherwise cut through it.
-                    cut = if first_segment && placed && seg_top > rect.y + 0.01 { seg_top } else { limit };
-                }
-            }
-            let mut here = Vec::new();
-            let mut below = Vec::new();
-            for (item, kept) in rest {
-                if let Some((top, _)) = kept {
-                    if top < cut - 0.01 {
-                        here.push(item)
-                    } else {
-                        below.push((item, kept))
-                    }
-                    continue;
-                }
-                match divide(item, cut) {
-                    (Some(a), None) => here.push(a),
-                    (None, Some(b)) => below.push((b, None)),
-                    (Some(a), Some(b)) => {
-                        here.push(a);
-                        below.push((b, None));
-                    }
-                    (None, None) => {}
-                }
-            }
-            if let Some(p) = self.pages.last_mut() {
-                p.items.extend(here.into_iter().map(|it| moved(it, dx, -shift)));
-            }
-            if below.is_empty() {
-                if let Some(c) = &mut self.cur {
-                    c.y = (end - shift).min(c.rect.bottom()).max(c.y);
-                    c.placed = true;
-                }
-                self.overflowed(end - shift);
-                return Ok(());
-            }
-            rest = below;
-            seg_top = cut;
-            first_segment = false;
-            self.next_area()?;
-            let (rect, _, _) = self.cursor();
-            shift = cut - rect.y;
-            dx = rect.x - origin_x;
-        }
-    }
-
-    fn page_has_flow(&self) -> bool {
-        self.cur.as_ref().is_some_and(|c| c.placed || c.content > 0)
-    }
-
-    // ───────────────────────────────────────────────────────────────────────── flow
-
-    /// Flow `node` (a subform; anything else is ignored) into the content areas.
-    fn flow_subform(&mut self, node: &Node, avail: Option<(f64, f64)>, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
-        if depth > MAX_DEPTH {
-            return Ok(());
-        }
-        let Node::Subform(sf) = node else { return Ok(()) };
-        self.check_measures()?;
-        if sf.break_before_page && self.page_has_flow() {
-            self.break_frames(0.0, true)?;
-        }
-        // Data adds instances of a repeating subform (rows added in another viewer).
-        let instances = self.instances(node, &ctx.som);
-        self.warn_truncated(node, &ctx.som, instances);
-        let ctx_parent = ctx;
-        for i in 0..instances {
-            // Every instance spends budget, so nested repeats that place nothing still stop.
-            self.measures.set(self.measures.get().saturating_add(1));
-            self.check_measures()?;
-            let ctx = ctx_parent.with_som(&sf.common, sib + i);
-            let (rect, _, _) = self.cursor();
-            let (x, w) = avail.unwrap_or((rect.x, rect.w));
-            let w = clamp_opt(sf.common.w.unwrap_or(w), sf.common.min_w, sf.common.max_w).min(w.max(1.0));
-            if !matches!(sf.layout, Layout::Tb | Layout::Table) || sf.common.h.is_some() {
-                // Not splittable: one block.
-                let (_, h) = self.size_of(node, w, ctx_parent, depth);
-                self.flow_block(node, x, (w, h), ctx_parent, depth, sib + i)?;
-                continue;
-            }
-            let m = sf.common.margin;
-            // Its border and fill go round what it takes from here, a part on each content area.
-            let framed = match self.flow_mark() {
-                Some(part) => {
-                    self.frames.push(Frame { x, w, margin: m, border: sf.common.border.clone(), part, parts: Vec::new(), lost: false });
-                    true
-                }
-                None => false,
-            };
-            self.advance(m.top);
-            let inner_x = x + m.left;
-            let inner_w = (w - m.horizontal()).max(1.0);
-            match sf.layout {
-                Layout::Table => self.flow_table(sf, inner_x, inner_w, &ctx, depth)?,
-                _ => {
-                    let sibs = SomIndices::of(&sf.children);
-                    for (ci, child) in sf.children.iter().enumerate() {
-                        if !child.common().presence.occupies() {
-                            continue;
-                        }
-                        let csib = sibs.at(ci);
-                        if let Node::Subform(_) = child
-                            && splittable(child)
-                        {
-                            self.flow_subform(child, Some((inner_x, inner_w)), &ctx, depth + 1, csib)?;
-                            continue;
-                        }
-                        let (cw, ch) = self.size_of(child, inner_w, &ctx, depth + 1);
-                        self.flow_block(child, inner_x, (cw, ch), &ctx, depth + 1, csib)?;
-                    }
-                }
-            }
-            self.advance(m.bottom);
-            if framed && let Some(frame) = self.frames.pop() {
-                self.finish_frame(frame)?;
-            }
-        }
-        if sf.break_after_page {
-            self.break_frames(0.0, true)?;
-        }
-        Ok(())
-    }
-
-    fn columns(&self, sf: &Subform, inner_w: f64) -> Vec<f64> {
-        if !sf.column_widths.is_empty() {
-            return sf.column_widths.clone();
-        }
-        let cells = sf.children.iter().filter_map(|c| if let Node::Subform(r) = c { Some(r.children.len()) } else { None }).max().unwrap_or(1).max(1);
-        vec![inner_w / cells as f64; cells]
-    }
-
-    fn flow_table(&mut self, sf: &Subform, x: f64, inner_w: f64, ctx: &Ctx, depth: usize) -> Result<(), XfaError> {
-        let cols = self.columns(sf, inner_w);
-        let leader =
-            sf.overflow_leader.as_ref().and_then(|name| sf.children.iter().position(|c| c.common().name.as_deref() == Some(name) && is_row(c)));
-        // The overflow leader starts each part after the first, before the row that moved.
-        let lead = leader.and_then(|li| match sf.children.get(li) {
-            Some(Node::Subform(l)) => Some((li, l.as_ref())),
-            _ => None,
-        });
-        let lead_h = lead.map_or(0.0, |(_, l)| self.row_height(l, &cols, inner_w, ctx, depth + 1));
-        let sibs = SomIndices::of(&sf.children);
-        for (ci, child) in sf.children.iter().enumerate() {
-            if !child.common().presence.occupies() {
-                continue;
-            }
-            let csib = sibs.at(ci);
-            if let Node::Subform(row) = child
-                && row.layout == Layout::Row
-            {
-                // Rows added as data (in another viewer) repeat the row.
-                let instances = self.instances(child, &ctx.som);
-                self.warn_truncated(child, &ctx.som, instances);
-                for inst in 0..instances {
-                    let h = self.row_height(row, &cols, inner_w, ctx, depth + 1);
-                    let led = lead.filter(|(li, _)| *li != ci);
-                    if self.make_room(h, led.map_or(0.0, |_| lead_h))?
-                        && let Some((li, l)) = led
-                    {
-                        let (_, y, _) = self.cursor();
-                        self.draw_row(l, &cols, Rect::new(x, y, inner_w, lead_h), ctx, depth + 1, sibs.at(li))?;
-                        self.place(lead_h);
-                    }
-                    let (_, y, _) = self.cursor();
-                    self.draw_row(row, &cols, Rect::new(x, y, inner_w, h), ctx, depth + 1, csib + inst)?;
-                    self.place(h);
-                }
-                continue;
-            }
-            if splittable(child)
-                && let Node::Subform(_) = child
-            {
-                self.flow_subform(child, Some((x, inner_w)), ctx, depth + 1, csib)?;
-                continue;
-            }
-            let (cw, ch) = self.size_of(child, inner_w, ctx, depth + 1);
-            self.flow_block(child, x, (cw, ch), ctx, depth + 1, csib)?;
-        }
-        Ok(())
-    }
-
-    // ───────────────────────────────────────────────────────────────────────── sizing
-
-    /// The size a node takes when given `avail_w` of width. Containers are measured once per
-    /// (node, width, depth): measuring a width-less container measures its content twice (for
-    /// its width, then its height), which would otherwise be exponential in the nesting.
-    /// How many instances of `node` to lay out under the container at `parent_som`: a
-    /// repeating subform's `occur` and data instances ([`instance_count`]); one for anything else.
-    fn instances(&self, node: &Node, parent_som: &str) -> usize {
-        let Node::Subform(sf) = node else { return 1 };
-        let from_data = match (&sf.common.name, self.data) {
-            (Some(name), Some(d)) if sf.occur.max != Some(1) => d.count(&data_path(self.tpl, parent_som), name),
-            _ => 0,
-        };
-        instance_count(&sf.occur, from_data)
-    }
-
-    /// The data holds more instances of `node` than `laid_out`: say so, since calculations
-    /// then see only those.
-    fn warn_truncated(&mut self, node: &Node, parent_som: &str, laid_out: usize) {
-        let Node::Subform(sf) = node else { return };
-        let from_data = match (&sf.common.name, self.data) {
-            (Some(name), Some(d)) if sf.occur.max != Some(1) => d.count(&data_path(self.tpl, parent_som), name),
-            _ => 0,
-        };
-        if from_data > laid_out {
-            self.warn_once(format!(
-                "{}: the data holds {from_data} rows; only the first {laid_out} are laid out (calculations see those)",
-                sf.common.name.as_deref().unwrap_or("a subform")
-            ));
-        }
-    }
-
-    /// The width and height `node` takes in `avail_w`: its own size, else what its content needs
-    /// (containers are measured once per width and depth, and measuring stops at its caps).
-    fn size_of(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> (f64, f64) {
-        let c = node.common();
-        let spent = self.measures.get().saturating_add(1);
-        self.measures.set(spent);
-        if depth > MAX_DEPTH || spent > MAX_MEASURES {
-            return (c.w.unwrap_or(avail_w), c.h.unwrap_or(0.0));
-        }
-        // Only containers recurse; their addresses are stable for the whole layout (the
-        // template is borrowed, the root and page areas are held by the layouter).
-        let key = match node {
-            Node::Subform(s) => Some((&**s as *const Subform as usize, avail_w.to_bits(), depth)),
-            Node::Area(a) => Some((&**a as *const Area as usize, avail_w.to_bits(), depth)),
-            _ => None,
-        };
-        if let Some(key) = key
-            && let Ok(cache) = self.measured.try_borrow()
-            && let Some(m) = cache.get(&key)
-            && m.font == ctx.font
-            && m.para == ctx.para
-        {
-            return m.size;
-        }
-        let size = self.measure(node, avail_w, ctx, depth);
-        if let Some(key) = key
-            && let Ok(mut cache) = self.measured.try_borrow_mut()
-        {
-            cache.insert(key, Measured { font: ctx.font.clone(), para: ctx.para.clone(), size });
-        }
-        size
-    }
-
-    /// The size (width, height) of `node` within `avail_w`, uncached ([`Self::size_of`] caches it).
-    /// Without a width, a container, a text draw or a button is as wide as its content (at most
-    /// `avail_w`) and anything else takes `avail_w`; without a height, it is as tall as its content.
-    fn measure(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> (f64, f64) {
-        let c = node.common();
-        // The node's own SOM: its repeating children count their instances under it, and a
-        // growing text field finds its value at it. Measurements are cached per template node,
-        // so instance 0 stands for all of them.
-        let ctx = ctx.with_som(c, 0);
-        let som = ctx.som.clone();
-        // A container without a width is as wide as its content (a radio group beside its
-        // question, say), and so is a text label or a button (as wide as its caption), within
-        // what is available; any other field without one takes what is available.
-        let w = match c.w {
-            Some(w) => w,
-            None => match node {
-                Node::Subform(_) | Node::ExclGroup(_) | Node::Area(_) => {
-                    let inner = (avail_w - c.margin.horizontal()).max(1.0);
-                    (self.content_width(node, inner, &ctx, depth) + c.margin.horizontal()).min(avail_w)
-                }
-                Node::Draw(d) => self.natural_width(&d.value, &ctx.font, &ctx.para).map_or(avail_w, |t| (t + c.margin.horizontal()).min(avail_w)),
-                Node::Field(f) if f.ui == Ui::Button => f
-                    .caption
-                    .as_ref()
-                    .and_then(|cap| self.natural_width(&cap.value, &ctx.font.apply(&cap.font), &ctx.para.apply(&cap.para)))
-                    .map_or(avail_w, |t| (t + c.margin.horizontal() + f.ui_margin.horizontal()).min(avail_w)),
-                Node::Field(_) => avail_w,
-            },
-        };
-        let w = clamp_opt(w, c.min_w, c.max_w);
-        let h = match c.h {
-            Some(h) => h,
-            None => {
-                let inner_w = (w - c.margin.horizontal()).max(1.0);
-                let content = match node {
-                    Node::Draw(d) => self.value_height(&d.value, inner_w, &ctx),
-                    Node::Field(f) => self.field_height(f, inner_w, &ctx),
-                    Node::ExclGroup(g) => self.group_height(g, inner_w, &ctx, depth),
-                    Node::Area(a) => self.positioned_height(&a.children, inner_w, &ctx, depth),
-                    Node::Subform(s) => match s.layout {
-                        Layout::Positioned => self.positioned_height(&s.children, inner_w, &ctx, depth),
-                        // Each instance of a repeating child takes its height again.
-                        Layout::Tb => s
-                            .children
-                            .iter()
-                            .filter(|k| k.common().presence.occupies())
-                            .map(|k| self.size_of(k, inner_w, &ctx, depth + 1).1 * self.instances(k, &som) as f64)
-                            .sum(),
-                        Layout::LrTb | Layout::RlTb => self.pack_instances(&s.children, inner_w, &ctx, depth, &som).1,
-                        Layout::Table => {
-                            let cols = self.columns(s, inner_w);
-                            s.children
-                                .iter()
-                                .filter(|k| k.common().presence.occupies())
-                                .map(|k| match k {
-                                    Node::Subform(r) if r.layout == Layout::Row => self.row_height(r, &cols, inner_w, &ctx, depth + 1),
-                                    _ => self.size_of(k, inner_w, &ctx, depth + 1).1,
-                                })
-                                .sum()
-                        }
-                        Layout::Row => self.row_height(s, &self.columns(s, inner_w), inner_w, &ctx, depth + 1),
-                    },
-                };
-                content + c.margin.vertical()
-            }
-        };
-        // A flowed subform is as tall as what it holds: other viewers do not stretch one to
-        // the `minH` a designer left on it.
-        let min_h = match node {
-            Node::Subform(s) if c.h.is_none() && s.layout != Layout::Positioned => None,
-            _ => c.min_h,
-        };
-        (w, clamp_opt(h, min_h, c.max_h))
-    }
-
-    /// The natural width of a container's content within `avail_w`.
-    fn content_width(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> f64 {
-        let group: Vec<Node>;
-        let (children, layout): (&[Node], Layout) = match node {
-            Node::Subform(s) => {
-                if s.layout == Layout::Table && !s.column_widths.is_empty() {
-                    return s.column_widths.iter().sum::<f64>().min(avail_w);
-                }
-                (&s.children, s.layout)
-            }
-            Node::ExclGroup(g) => {
-                // Fields are leaves: measuring these copies caches nothing.
-                group = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
-                (&group, g.layout)
-            }
-            Node::Area(a) => (&a.children, Layout::Positioned),
-            _ => return avail_w,
-        };
-        let visible = children.iter().filter(|k| k.common().presence.occupies());
-        match layout {
-            Layout::LrTb | Layout::RlTb | Layout::Row => {
-                let sum: f64 = visible.map(|k| self.size_of(k, avail_w, ctx, depth + 1).0).sum();
-                if sum <= avail_w + 0.05 { sum } else { avail_w }
-            }
-            Layout::Positioned => visible
-                .map(|k| {
-                    let (w, h) = self.size_of(k, avail_w, ctx, depth + 1);
-                    k.common().top_left(w, h).0 + w
-                })
-                .fold(0.0, f64::max)
-                .min(avail_w),
-            Layout::Tb | Layout::Table => visible.map(|k| self.size_of(k, avail_w, ctx, depth + 1).0).fold(0.0, f64::max).min(avail_w),
-        }
-    }
-
-    /// How wide text `v` is unwrapped, in `font` and `para`, with a hair to spare so that laying
-    /// it out at that width keeps it on its lines; `None` for what isn't text, or text that draws
-    /// nothing.
-    fn natural_width(&self, v: &Value, font: &Font, para: &Para) -> Option<f64> {
-        let rich = match v {
-            Value::Text(t) => text::plain(t),
-            Value::Rich(r) => r.clone(),
-            _ => return None,
-        };
-        // No text (a bordered spacer or rule): nothing to size to, so it keeps what it has room for.
-        let w = text::natural_width(&rich, para, &Face::of(font), &|id, max| self.embed(id, max));
-        (w > 0.0).then_some(w + 0.01)
-    }
-
-    /// How tall value `v` is laid out `w` wide: text wrapped in the context's font and paragraph,
-    /// an image at its aspect ratio, and nothing for lines, rectangles and empty values.
-    fn value_height(&self, v: &Value, w: f64, ctx: &Ctx) -> f64 {
-        match v {
-            Value::Text(t) => text::measure_height(&text::plain(t), w, &ctx.para, &Face::of(&ctx.font), &|id, max| self.embed(id, max)),
-            Value::Rich(r) => text::measure_height(r, w, &ctx.para, &Face::of(&ctx.font), &|id, max| self.embed(id, max)),
-            Value::Image { data, .. } => crate::image::size(data).map_or(w, |(iw, ih)| if iw > 0 { w * ih as f64 / iw as f64 } else { w }),
-            Value::Line { .. } | Value::Rectangle(_) | Value::Empty => 0.0,
-        }
-    }
-
-    /// Where field `f`'s caption goes and how much room it takes from the field's box, or `None`
-    /// when it has no caption that takes room (a button's is drawn inside its box).
-    fn caption_reserve(&self, f: &Field, inner_w: f64, ctx: &Ctx) -> Option<(Placement, f64)> {
-        let cap = f.caption.as_ref()?;
-        if !cap.presence.occupies() || f.ui == Ui::Button {
-            return None;
-        }
-        if cap.value.is_empty() && cap.reserve.is_none() {
-            return None;
-        }
-        let placement = if cap.placement == Placement::Inline { Placement::Left } else { cap.placement };
-        let font = ctx.font.apply(&cap.font);
-        let para = ctx.para.apply(&cap.para);
-        let reserve = cap.reserve.unwrap_or_else(|| match placement {
-            Placement::Top | Placement::Bottom => {
-                let rich = match &cap.value {
-                    Value::Rich(r) => r.clone(),
-                    other => text::plain(&other.plain().unwrap_or_default()),
-                };
-                text::measure_height(&rich, inner_w, &para, &Face::of(&font), &|id, max| self.embed(id, max))
-            }
-            _ => (Face::of(&font).width(&cap.value.plain().unwrap_or_default()) + 2.0).min(inner_w * 0.6),
-        });
-        Some((placement, reserve))
-    }
-
-    /// The height of field `f`'s content within `inner_w` (inside its margins): its widget (a check
-    /// box, a button's caption, or one line of text or three when multi-line, more for a text field
-    /// that grows) plus a caption above or below it, or the taller of the two for one beside it.
-    fn field_height(&self, f: &Field, inner_w: f64, ctx: &Ctx) -> f64 {
-        let font = ctx.font.apply(&f.common.font);
-        let lines = if f.multiline { 3.0 } else { 1.0 };
-        let ui = match f.ui {
-            Ui::CheckButton => f.check_size.unwrap_or(10.0).max(text::line_height(font.size)),
-            // A button shows its caption: as tall as the caption's text in its own font.
-            Ui::Button if f.caption.as_ref().is_some_and(|c| !c.value.is_empty()) => {
-                let cap = f.caption.as_ref().map_or(0.0, |c| {
-                    let rich = match &c.value {
-                        Value::Rich(r) => r.clone(),
-                        other => text::plain(&other.plain().unwrap_or_default()),
-                    };
-                    let w = (inner_w - f.ui_margin.horizontal()).max(1.0);
-                    text::measure_height(&rich, w, &ctx.para.apply(&c.para), &Face::of(&ctx.font.apply(&c.font)), &|id, max| self.embed(id, max))
-                });
-                cap + f.ui_margin.vertical()
-            }
-            _ => (text::line_height(font.size) * lines).max(self.grown_text_height(f, inner_w, ctx)) + 4.0 + f.ui_margin.vertical(),
-        };
-        match self.caption_reserve(f, inner_w, ctx) {
-            Some((Placement::Top | Placement::Bottom, r)) => ui + r,
-            Some((_, r)) => {
-                let cap = f.caption.as_ref().map(|c| {
-                    let rich = match &c.value {
-                        Value::Rich(r) => r.clone(),
-                        other => text::plain(&other.plain().unwrap_or_default()),
-                    };
-                    text::measure_height(&rich, (inner_w - r).max(1.0), &ctx.para.apply(&c.para), &Face::of(&ctx.font.apply(&c.font)), &|id, max| {
-                        self.embed(id, max)
-                    })
-                });
-                ui.max(cap.unwrap_or(0.0))
-            }
-            None => ui,
-        }
-    }
-
-    /// The face a field's text is laid out in: at its horizontal scale when the layout draws
-    /// the text itself (a non-interactive field), as designed when the forms layer draws it in
-    /// a widget, whose appearances have no horizontal scaling.
-    fn field_text_face(f: &Field, font: &Font) -> Face {
-        let face = Face::of(font);
-        if f.access == Access::NonInteractive { face } else { face.unscaled() }
-    }
-
-    /// The height the text of a multi-line text field takes (its value in the data, else the
-    /// template's), for a field without a fixed height, which grows to hold its text. `ctx`
-    /// is the field's own (its SOM ends in the field). Zero for anything else.
-    fn grown_text_height(&self, f: &Field, inner_w: f64, ctx: &Ctx) -> f64 {
-        if !f.grows_with_text() || f.common.name.is_none() {
-            return 0.0;
-        }
-        let value = self.data.and_then(|d| d.value_at(&data_path(self.tpl, &ctx.som))).filter(|t| !t.trim().is_empty()).or_else(|| f.value.plain());
-        let Some(value) = value.filter(|t| !t.trim().is_empty()) else { return 0.0 };
-        // Beside a caption the text has what the caption leaves; a widget's text has 2pt of
-        // padding on each side, a non-interactive field's (drawn as text) none, so it wraps
-        // where it is drawn.
-        let beside = match self.caption_reserve(f, inner_w, ctx) {
-            Some((Placement::Top | Placement::Bottom, _)) | None => 0.0,
-            Some((_, r)) => r,
-        };
-        let padding = if f.access == Access::NonInteractive { 0.0 } else { 4.0 };
-        let w = (inner_w - beside - f.ui_margin.horizontal() - padding).max(1.0);
-        let font = ctx.font.apply(&f.common.font);
-        text::measure_height(&text::plain(value.trim_end()), w, &ctx.para, &Self::field_text_face(f, &font), &|_, _| String::new())
-    }
-
-    /// The height of an exclusion group's fields at `inner_w`, by the group's layout: stacked
-    /// top to bottom, at their own positions, or packed in rows.
-    fn group_height(&self, g: &ExclGroup, inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
-        let nodes: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
-        match g.layout {
-            Layout::Tb => nodes.iter().filter(|k| k.common().presence.occupies()).map(|k| self.size_of(k, inner_w, ctx, depth + 1).1).sum(),
-            Layout::Positioned => self.positioned_height(&nodes, inner_w, ctx, depth),
-            _ => self.packed_height(&nodes, inner_w, ctx, depth),
-        }
-    }
-
-    fn positioned_height(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
-        children
-            .iter()
-            .filter(|k| k.common().presence.occupies())
-            .map(|k| {
-                let c = k.common();
-                let (w, h) = self.size_of(k, (inner_w - c.x.unwrap_or(0.0)).max(1.0), ctx, depth + 1);
-                c.top_left(w, h).1 + h
-            })
-            .fold(0.0, f64::max)
-    }
-
-    /// Left-to-right packing: rows of children, wrapped at the available width, as (child,
-    /// instance, place). A repeating subform is packed once per instance it has under the
-    /// container at `som`.
-    fn pack_instances(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize, som: &str) -> (Vec<(usize, usize, Rect)>, f64) {
-        let mut out = Vec::new();
-        let (mut x, mut y, mut line_h) = (0.0, 0.0, 0.0);
-        for (i, k) in children.iter().enumerate() {
-            if !k.common().presence.occupies() {
-                continue;
-            }
-            let (w, h) = self.size_of(k, inner_w, ctx, depth + 1);
-            for instance in 0..self.instances(k, som) {
-                if x > 0.0 && x + w > inner_w + 0.05 {
-                    y += line_h;
-                    x = 0.0;
-                    line_h = 0.0;
-                }
-                out.push((i, instance, Rect::new(x, y, w, h)));
-                x += w;
-                line_h = line_h.max(h);
-            }
-        }
-        (out, y + line_h)
-    }
-
-    /// [`Self::pack_instances`] for children that don't repeat (the fields of a group).
-    fn pack(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> (Vec<(usize, Rect)>, f64) {
-        let (placed, h) = self.pack_instances(children, inner_w, ctx, depth, "");
-        (placed.into_iter().map(|(i, _, r)| (i, r)).collect(), h)
-    }
-
-    fn packed_height(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
-        self.pack(children, inner_w, ctx, depth).1
-    }
-
-    /// Cell rectangles of a row (relative to the row's inner box) and the row height.
-    fn cells(&self, row: &Subform, cols: &[f64], inner_w: f64, ctx: &Ctx, depth: usize) -> (Vec<(usize, Rect)>, f64) {
-        let ctx = ctx.child(&row.common);
-        let mut out = Vec::new();
-        let mut col = 0usize;
-        let mut x = 0.0;
-        let mut h: f64 = 0.0;
-        for (i, k) in row.children.iter().enumerate() {
-            if !k.common().presence.occupies() {
-                continue;
-            }
-            let span = k.common().col_span.max(1);
-            let w = if col < cols.len() { cols.iter().skip(col).take(span).sum::<f64>() } else { k.common().w.unwrap_or((inner_w - x).max(1.0)) };
-            let (_, ch) = self.size_of(k, w, &ctx, depth + 1);
-            out.push((i, Rect::new(x, 0.0, w, ch)));
-            h = h.max(ch);
-            x += w;
-            col += span;
-        }
-        let h = match row.common.h {
-            Some(rh) => rh,
-            None => h + row.common.margin.vertical(),
-        };
-        (out, clamp_opt(h, row.common.min_h, row.common.max_h))
-    }
-
-    fn row_height(&self, row: &Subform, cols: &[f64], inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
-        self.cells(row, cols, inner_w, ctx, depth).1
-    }
-
-    // ───────────────────────────────────────────────────────────────────────── drawing
-
-    fn draw_row(&mut self, row: &Subform, cols: &[f64], rect: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
-        if depth > MAX_DEPTH {
-            return Ok(());
-        }
-        if let Some(b) = &row.common.border {
-            self.draw_border(b, rect)?;
-        }
-        let ctx = ctx.with_som(&row.common, sib);
-        let inner = rect.inset(&row.common.margin);
-        let (cells, _) = self.cells(row, cols, inner.w, &ctx, depth);
-        let sibs = SomIndices::of(&row.children);
-        for (i, r) in cells {
-            if let Some(k) = row.children.get(i) {
-                // Cells stretch to the row height.
-                self.draw_node(k, Rect::new(inner.x + r.x, inner.y, r.w, inner.h), &ctx, depth + 1, sibs.at(i))?;
-            }
-        }
-        Ok(())
-    }
-
-    fn draw_positioned_child(&mut self, k: &Node, inner: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
-        let c = k.common();
-        if !c.presence.occupies() {
-            return Ok(());
-        }
-        let (w, h) = self.size_of(k, (inner.w - c.x.unwrap_or(0.0)).max(1.0), ctx, depth + 1);
-        let (x, y) = c.top_left(w, h);
-        self.draw_node(k, Rect::new(inner.x + x, inner.y + y, w, h), ctx, depth + 1, sib)
-    }
-
-    fn draw_node(&mut self, node: &Node, rect: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
-        if depth > MAX_DEPTH {
-            return Ok(());
-        }
-        let c = node.common();
-        if c.presence == Presence::Invisible {
-            return Ok(());
-        }
-        match node {
-            Node::Draw(d) => {
-                let start = self.item_count();
-                self.draw_draw(d, rect, ctx)?;
-                // Text and pictures stay with their border; a bare line or rectangle is cut.
-                if matches!(d.value, Value::Text(_) | Value::Rich(_) | Value::Image { .. }) {
-                    self.keep_whole(start, rect);
-                }
-                Ok(())
-            }
-            Node::Field(f) => {
-                let start = self.item_count();
-                self.draw_field(f, rect, ctx, None, sib)?;
-                self.keep_whole(start, rect);
-                Ok(())
-            }
-            Node::ExclGroup(g) => self.draw_group(g, rect, ctx, depth, sib),
-            Node::Area(a) => {
-                let ctx = ctx.with_som(&a.common, sib);
-                let sibs = SomIndices::of(&a.children);
-                for (i, k) in a.children.iter().enumerate() {
-                    self.draw_positioned_child(k, rect, &ctx, depth + 1, sibs.at(i))?;
-                }
-                Ok(())
-            }
-            Node::Subform(s) => {
-                // Every drawn instance spends budget, as a flowed one does, so nested repeats that
-                // place nothing still stop.
-                self.measures.set(self.measures.get().saturating_add(1));
-                self.check_measures()?;
-                if let Some(b) = &s.common.border {
-                    self.draw_border(b, rect)?;
-                }
-                let parent_ctx = ctx;
-                let ctx = ctx.with_som(&s.common, sib);
-                let inner = rect.inset(&s.common.margin);
-                let sibs = SomIndices::of(&s.children);
-                match s.layout {
-                    Layout::Positioned => {
-                        for (i, k) in s.children.iter().enumerate() {
-                            self.draw_positioned_child(k, inner, &ctx, depth + 1, sibs.at(i))?;
-                        }
-                    }
-                    Layout::Tb => {
-                        let mut y = inner.y;
-                        for (i, k) in s.children.iter().enumerate() {
-                            if !k.common().presence.occupies() {
-                                continue;
-                            }
-                            let (w, h) = self.size_of(k, inner.w, &ctx, depth + 1);
-                            // A repeating subform here (a table in an area of a positioned page,
-                            // say) gets its instances, as in a flowed one, one under another.
-                            for instance in 0..self.instances(k, &ctx.som) {
-                                self.draw_node(k, Rect::new(inner.x, y, w, h), &ctx, depth + 1, sibs.at(i) + instance)?;
-                                y += h;
-                            }
-                        }
-                    }
-                    Layout::LrTb | Layout::RlTb => {
-                        // A repeating subform here (rows of fields under a heading) gets its
-                        // instances, as in the other layouts.
-                        let (placed, _) = self.pack_instances(&s.children, inner.w, &ctx, depth, &ctx.som);
-                        for (i, instance, r) in placed {
-                            if let Some(k) = s.children.get(i) {
-                                let x = if s.layout == Layout::RlTb { inner.right() - r.x - r.w } else { inner.x + r.x };
-                                self.draw_node(k, Rect::new(x, inner.y + r.y, r.w, r.h), &ctx, depth + 1, sibs.at(i) + instance)?;
-                            }
-                        }
-                    }
-                    Layout::Table => {
-                        let cols = self.columns(s, inner.w);
-                        let mut y = inner.y;
-                        for (i, k) in s.children.iter().enumerate() {
-                            if !k.common().presence.occupies() {
-                                continue;
-                            }
-                            let csib = sibs.at(i);
-                            if let Node::Subform(r) = k
-                                && r.layout == Layout::Row
-                            {
-                                let h = self.row_height(r, &cols, inner.w, &ctx, depth + 1);
-                                self.draw_row(r, &cols, Rect::new(inner.x, y, inner.w, h), &ctx, depth + 1, csib)?;
-                                y += h;
-                            } else {
-                                let (w, h) = self.size_of(k, inner.w, &ctx, depth + 1);
-                                self.draw_node(k, Rect::new(inner.x, y, w, h), &ctx, depth + 1, csib)?;
-                                y += h;
-                            }
-                        }
-                    }
-                    Layout::Row => {
-                        let cols = self.columns(s, inner.w);
-                        self.draw_row(s, &cols, rect, parent_ctx, depth, sib)?;
-                    }
-                }
-                Ok(())
-            }
-        }
-    }
-
-    /// Draw border `b` around `rect`: its fill, then each shown edge as a line inside the box, or
-    /// the whole box as one rounded shape when its corners are rounded.
-    fn draw_border(&mut self, b: &Border, rect: Rect) -> Result<(), XfaError> {
-        let vis = b.visible_edges();
-        // Rounded corners: the box is one shape, filled and edged along its curves, when its
-        // edges are all alike (all shown and the same, or all hidden). Edges that differ keep
-        // square corners.
-        let radii = b.radii(rect.w, rect.h);
-        let alike = b.edges.iter().all(|e| *e == b.edges[0]);
-        if radii.iter().any(|r| *r > 0.0) && (vis == [true; 4] && alike || vis == [false; 4]) {
-            let e = b.edges[0];
-            let edge = vis[0].then(|| {
-                let color = if e.stroke == Stroke::Relief { [0.55, 0.55, 0.55] } else { e.color.0 };
-                (e.thickness.clamp(0.1, 20.0), color, matches!(e.stroke, Stroke::Dashed | Stroke::Dotted))
-            });
-            let shape = Rounded {
-                rect,
-                radii,
-                inverted: b.corners.map(|c| c.inverted),
-                fill: b.fill().map(|f| f.0),
-                edge,
-                open_top: false,
-                open_bottom: false,
-            };
-            return self.push(Item::Rounded(Box::new(shape)));
-        }
-        if let Some(fill) = b.fill() {
-            self.push(Item::Fill { rect, color: fill.0 })?;
-        }
-        let (x0, y0, x1, y1) = (rect.x, rect.y, rect.right(), rect.bottom());
-        // Top, right, bottom, left; lines sit inside the box.
-        let segs = [((x0, y0), (x1, y0)), ((x1, y0), (x1, y1)), ((x0, y1), (x1, y1)), ((x0, y0), (x0, y1))];
-        for (i, seg) in segs.iter().enumerate() {
-            if !vis[i] {
-                continue;
-            }
-            let e = b.edges[i];
-            let t = e.thickness.clamp(0.1, 20.0);
-            let (dx, dy) = match i {
-                0 => (0.0, t / 2.0),
-                1 => (-t / 2.0, 0.0),
-                2 => (0.0, -t / 2.0),
-                _ => (t / 2.0, 0.0),
-            };
-            let color = if e.stroke == Stroke::Relief { [0.55, 0.55, 0.55] } else { e.color.0 };
-            self.push(Item::Line {
-                from: (seg.0.0 + dx, seg.0.1 + dy),
-                to: (seg.1.0 + dx, seg.1.1 + dy),
-                width: t,
-                color,
-                dashed: matches!(e.stroke, Stroke::Dashed | Stroke::Dotted),
-            })?;
-        }
-        Ok(())
-    }
-
-    fn draw_value_text(&mut self, v: &Value, rect: Rect, font: &Font, para: &Para) -> Result<(), XfaError> {
-        let rich = match v {
-            Value::Text(t) => text::plain(t),
-            Value::Rich(r) => r.clone(),
-            _ => return Ok(()),
-        };
-        let face = Face::of(font);
-        // Text that doesn't fit the height it was given (the template's face is narrower than
-        // the standard one drawn in its place, so it wraps to more lines) is drawn smaller,
-        // down to 70%, rather than over what lies below.
-        let fits = |k: f64| text::measure_height(&rich, rect.w / k, para, &face, &|id, max| self.embed(id, max)) <= rect.h / k + 1.0;
-        let scale = if rect.h < 4.0 || fits(1.0) { 1.0 } else { [0.95, 0.9, 0.85, 0.8, 0.75].into_iter().find(|k| fits(*k)).unwrap_or(0.7) };
-        let mut block = text::layout(&rich, Rect::new(rect.x, rect.y, rect.w / scale, rect.h / scale), para, &face, &|id, max| self.embed(id, max));
-        if scale < 1.0 {
-            for s in &mut block.spans {
-                s.x = rect.x + (s.x - rect.x) * scale;
-                s.baseline = rect.y + (s.baseline - rect.y) * scale;
-                s.face.size *= scale;
-            }
-        }
-        self.push_block(block)
-    }
-
-    fn draw_draw(&mut self, d: &Draw, rect: Rect, ctx: &Ctx) -> Result<(), XfaError> {
-        if let Some(b) = &d.common.border {
-            self.draw_border(b, rect)?;
-        }
-        let ctx = ctx.child(&d.common);
-        let inner = rect.inset(&d.common.margin);
-        match &d.value {
-            Value::Text(_) | Value::Rich(_) => self.draw_value_text(&d.value, inner, &ctx.font, &ctx.para),
-            Value::Image { content_type, data } => self.draw_image(data, content_type, inner),
-            Value::Line { slope_up, edge } => {
-                if !edge.visible() {
-                    return Ok(());
-                }
-                let (from, to) = if *slope_up {
-                    ((inner.x, inner.bottom()), (inner.right(), inner.y))
-                } else {
-                    ((inner.x, inner.y), (inner.right(), inner.bottom()))
-                };
-                self.push(Item::Line { from, to, width: edge.thickness.clamp(0.1, 20.0), color: edge.color.0, dashed: edge.stroke == Stroke::Dashed })
-            }
-            Value::Rectangle(b) => self.draw_border(b, inner),
-            Value::Empty => Ok(()),
-        }
-    }
-
-    fn draw_group(&mut self, g: &ExclGroup, rect: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
-        if let Some(b) = &g.common.border {
-            self.draw_border(b, rect)?;
-        }
-        let ctx = ctx.with_som(&g.common, sib);
-        // The group's data node holds the selected button's on value.
-        let selected: Option<String> =
-            self.data.and_then(|d| d.text_at(&data_path(self.tpl, &ctx.som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
-        let inner = rect.inset(&g.common.margin);
-        let group = self.unique_name(g.common.name.as_deref().unwrap_or("group"));
-        let nodes: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
-        let placed: Vec<(usize, Rect)> = match g.layout {
-            Layout::Tb => {
-                let mut y = 0.0;
-                let mut out = Vec::new();
-                for (i, k) in nodes.iter().enumerate() {
-                    if !k.common().presence.occupies() {
-                        continue;
-                    }
-                    let (w, h) = self.size_of(k, inner.w, &ctx, depth + 1);
-                    out.push((i, Rect::new(0.0, y, w, h)));
-                    y += h;
-                }
-                out
-            }
-            Layout::Positioned => nodes
-                .iter()
-                .enumerate()
-                .filter(|(_, k)| k.common().presence.occupies())
-                .map(|(i, k)| {
-                    let c = k.common();
-                    let (w, h) = self.size_of(k, (inner.w - c.x.unwrap_or(0.0)).max(1.0), &ctx, depth + 1);
-                    let (x, y) = c.top_left(w, h);
-                    (i, Rect::new(x, y, w, h))
-                })
-                .collect(),
-            _ => self.pack(&nodes, inner.w, &ctx, depth).0,
-        };
-        let sibs = SomIndices::of(&nodes);
-        for (i, r) in placed {
-            if let Some(f) = g.fields.get(i) {
-                let on = f.items.first().cloned().filter(|s| !s.trim().is_empty()).unwrap_or_else(|| (i + 1).to_string());
-                let tip = f.tooltip.clone().or_else(|| g.tooltip.clone());
-                let chosen = selected.as_deref() == Some(on.as_str());
-                self.draw_field(f, Rect::new(inner.x + r.x, inner.y + r.y, r.w, r.h), &ctx, Some((&group, &on, tip, chosen)), sibs.at(i))?;
-            }
-        }
-        Ok(())
-    }
-
-    /// A picture scaled to fit `inner`, keeping its shape, from its top left.
-    fn draw_image(&mut self, data: &[u8], content_type: &str, inner: Rect) -> Result<(), XfaError> {
-        self.image_bytes = self.image_bytes.saturating_add(data.len());
-        if self.image_bytes > MAX_IMAGE_BYTES {
-            return Err(XfaError::TooLarge("the form's pictures are too large together to lay out".into()));
-        }
-        let fitted = match crate::image::size(data) {
-            Some((iw, ih)) if iw > 0 && ih > 0 && inner.w > 0.0 && inner.h > 0.0 => {
-                let k = (inner.w / iw as f64).min(inner.h / ih as f64);
-                Rect::new(inner.x, inner.y, iw as f64 * k, ih as f64 * k)
-            }
-            _ => inner,
-        };
-        self.push(Item::Image { rect: fitted, data: Arc::new(data.to_vec()), content_type: content_type.to_string() })
-    }
-
-    /// A field name made from `base` that no earlier field of the form has: the first keeps it,
-    /// later ones get `_2`, `_3`, ….
-    fn unique_name(&mut self, base: &str) -> String {
-        let base = clean_name(base);
-        let n = self.names.entry(base.clone()).or_insert(0);
-        *n += 1;
-        if *n == 1 { base } else { format!("{base}_{n}") }
-    }
-
-    /// Draw field `f` at `rect`: its border (a button's is its widget's box), its caption, then its
-    /// widget, or its value as plain text when it is non-interactive, a barcode, or a text field
-    /// taller than its content area. `radio` is set for a group's radio button; `sib` is its SOM index.
-    fn draw_field(
-        &mut self,
-        f: &Field,
-        rect: Rect,
-        ctx: &Ctx,
-        radio: Option<(&str, &str, Option<String>, bool)>,
-        sib: usize,
-    ) -> Result<(), XfaError> {
-        if let Some(b) = &f.common.border
-            && f.ui != Ui::Button
-        {
-            self.draw_border(b, rect)?;
-        }
-        let fctx = ctx.child(&f.common);
-        let inner = rect.inset(&f.common.margin);
-        let (mut ui, mut cap_rect) = (inner, None);
-        if let Some((placement, reserve)) = self.caption_reserve(f, inner.w, ctx) {
-            let r = reserve.max(0.0);
-            match placement {
-                Placement::Top => {
-                    cap_rect = Some(Rect::new(inner.x, inner.y, inner.w, r.min(inner.h)));
-                    ui = Rect::new(inner.x, inner.y + r, inner.w, inner.h - r);
-                }
-                Placement::Bottom => {
-                    cap_rect = Some(Rect::new(inner.x, inner.bottom() - r.min(inner.h), inner.w, r.min(inner.h)));
-                    ui = Rect::new(inner.x, inner.y, inner.w, inner.h - r);
-                }
-                Placement::Right => {
-                    cap_rect = Some(Rect::new(inner.right() - r.min(inner.w), inner.y, r.min(inner.w), inner.h));
-                    ui = Rect::new(inner.x, inner.y, inner.w - r, inner.h);
-                }
-                _ => {
-                    cap_rect = Some(Rect::new(inner.x, inner.y, r.min(inner.w), inner.h));
-                    ui = Rect::new(inner.x + r, inner.y, inner.w - r, inner.h);
-                }
-            }
-        }
-        if let (Some(cr), Some(cap)) = (cap_rect, &f.caption)
-            && cap.presence == Presence::Visible
-        {
-            let font = ctx.font.apply(&cap.font);
-            let para = ctx.para.apply(&cap.para);
-            self.draw_value_text(&cap.value, cr, &font, &para)?;
-        }
-        let som_path = || {
-            if fctx.som.is_empty() {
-                format!("{}[{sib}]", f.common.name.as_deref().unwrap_or("field"))
-            } else {
-                format!("{}.{}[{sib}]", fctx.som, f.common.name.as_deref().unwrap_or("field"))
-            }
-        };
-        match f.ui {
-            Ui::Unknown => {
-                self.warn_once("a field of an unknown kind is left blank");
-                return Ok(());
-            }
-            Ui::ImageEdit => {
-                // The picture the data holds (base64, as Designer saves it) or the template's.
-                let field_name = f.common.name.clone().unwrap_or_else(|| "an image field".into());
-                let text: Vec<u8> = self
-                    .data
-                    .and_then(|d| d.text_at(&data_path(self.tpl, &som_path())))
-                    .map(|t| t.bytes().filter(|b| !b.is_ascii_whitespace()).collect())
-                    .unwrap_or_default();
-                let from_data = if text.is_empty() {
-                    None
-                } else if text.len() > MAX_DATA_IMAGE / 3 * 4 + 4 {
-                    self.warn_once(format!("{field_name}: the picture in the data is larger than 32 MB and is left out"));
-                    None
-                } else {
-                    match base64::engine::general_purpose::STANDARD.decode(&text) {
-                        Ok(d) if crate::image::kind(&d).is_some() => Some(d),
-                        Ok(_) => {
-                            self.warn_once(format!("{field_name}: the picture in the data is not a JPEG, PNG, GIF, BMP or TIFF and is left out"));
-                            None
-                        }
-                        Err(_) => {
-                            self.warn_once(format!("{field_name}: the data holds no readable picture (not base64) and is left out"));
-                            None
-                        }
-                    }
-                };
-                let box_ = ui.inset(&f.ui_margin);
-                match (&from_data, &f.value) {
-                    (Some(d), _) => self.draw_image(d, "", box_)?,
-                    (None, Value::Image { content_type, data }) => self.draw_image(data, content_type, box_)?,
-                    _ => {}
-                }
-                // Then the field itself, which clicking gives a new picture.
-            }
-            Ui::Barcode => {
-                // The value as text, where the bars would be.
-                self.warn_once("barcode fields show their value as text, not as bars");
-                let value = self
-                    .data
-                    .and_then(|d| d.text_at(&data_path(self.tpl, &som_path())))
-                    .map(str::to_string)
-                    .or_else(|| f.value.plain())
-                    .unwrap_or_default();
-                if !value.trim().is_empty() {
-                    let mut para = fctx.para.clone();
-                    para.h_align = HAlign::Center;
-                    self.draw_value_text(&Value::Text(value), ui.inset(&f.ui_margin), &fctx.font, &para)?;
-                }
-                return Ok(());
-            }
-            _ => {}
-        }
-        if f.access == Access::NonInteractive && f.ui != Ui::Button {
-            // Shown as text, not as a field.
-            return self.draw_value_text(&f.value, ui.inset(&f.ui_margin), &fctx.font, &fctx.para);
-        }
-        // A text field that grew past what a content area holds can't be one widget: its text
-        // is drawn as lines the page breaks fall between, and stays what the data holds.
-        if f.grows_with_text() && rect.h > self.cursor().0.h + 0.01 {
-            let value =
-                self.data.and_then(|d| d.value_at(&data_path(self.tpl, &som_path()))).filter(|t| !t.trim().is_empty()).or_else(|| f.value.plain());
-            if let Some(value) = value.filter(|t| !t.trim().is_empty()) {
-                let name = f.common.name.clone().unwrap_or_else(|| "a text field".into());
-                self.warn_once(format!("{name}: its text is longer than a page; it is shown across pages and can't be edited here"));
-                let m = Margin {
-                    top: f.ui_margin.top + 2.0,
-                    bottom: f.ui_margin.bottom + 2.0,
-                    left: f.ui_margin.left + 2.0,
-                    right: f.ui_margin.right + 2.0,
-                };
-                let para = Para { v_align: VAlign::Top, ..fctx.para.clone() };
-                // In the face it was measured in, so it takes the lines it was given.
-                let face = Self::field_text_face(f, &fctx.font);
-                let block = text::layout(&text::plain(value.trim_end()), ui.inset(&m), &para, &face, &|_, _| String::new());
-                return self.push_block(block);
-            }
-        }
-        let face = match (&f.ui, &f.caption) {
-            // Buttons show their caption in the caption's font.
-            (Ui::Button, Some(cap)) => Face::of(&ctx.font.apply(&cap.font)).unscaled(),
-            _ => Face::of(&fctx.font).unscaled(),
-        };
-        let h_align = match (&f.ui, &f.caption) {
-            (Ui::Button, Some(cap)) => ctx.para.apply(&cap.para).h_align,
-            _ => fctx.para.h_align,
-        };
-        let name = self.unique_name(f.common.name.as_deref().unwrap_or("field"));
-        let som = som_path();
-        let read_only = matches!(f.access, Access::ReadOnly | Access::Protected);
-        // The data's value wins over the template's default.
-        let data_value: Option<String> =
-            self.data.and_then(|d| d.value_at(&data_path(self.tpl, &som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
-        // A choice list's default is a saved value too.
-        let template_default = f.value.plain().map(|v| f.saved_value(v.trim())).filter(|v| !v.is_empty());
-        let plain_value = data_value.clone().or_else(|| template_default.clone());
-        let (kind, rect, border, value, tooltip) = match f.ui {
-            Ui::CheckButton => {
-                let s = f.check_size.unwrap_or(10.0).min(ui.w.max(1.0)).min(ui.h.max(1.0));
-                let y = match fctx.para.v_align {
-                    VAlign::Top => ui.y + f.ui_margin.top,
-                    VAlign::Middle => ui.y + (ui.h - s) / 2.0,
-                    VAlign::Bottom => ui.bottom() - s - f.ui_margin.bottom,
-                };
-                let r = Rect::new(ui.x + f.ui_margin.left, y, s, s);
-                let on = f.items.first().cloned().filter(|s| !s.trim().is_empty()).unwrap_or_else(|| "1".into());
-                let (kind, tip, checked) = match radio {
-                    Some((group, on_value, tip, chosen)) => (
-                        WidgetKind::Radio { group: group.to_string(), on: on_value.to_string(), round: f.check_round },
-                        tip.or_else(|| f.tooltip.clone()),
-                        chosen,
-                    ),
-                    None => (
-                        WidgetKind::CheckBox { on: on.clone(), round: f.check_round },
-                        f.tooltip.clone(),
-                        plain_value.as_deref().is_some_and(|v| is_on(v, &on)),
-                    ),
-                };
-                let border = widget_border(f.ui_border.as_ref(), true);
-                (kind, r, border, checked.then(|| on.clone()), tip)
-            }
-            Ui::Button => {
-                let caption = f.caption.as_ref().and_then(|c| c.value.plain()).unwrap_or_default().trim().to_string();
-                // A button's box is its field border, around the whole field (its margins pad
-                // the caption, not the box); without one it is invisible (a link over text, say).
-                let border = match &f.common.border {
-                    Some(b) => widget_border(Some(b), false),
-                    None => WidgetBorder { color: None, fill: None, shape: BorderShape::None, width: 0.0 },
-                };
-                (WidgetKind::Button { caption }, rect, border, None, f.tooltip.clone())
-            }
-            Ui::DateTimeEdit => {
-                let pattern = date_pattern(f.picture.as_deref());
-                // The data holds the date in the field's data picture, or else as an ISO date; the
-                // field shows it in its own pattern.
-                let data_pattern = data_date_letters(f);
-                let shown = plain_value
-                    .as_ref()
-                    .map(|v| if data_value.is_some() { iso_to_pattern(&data_to_iso(v, data_pattern.as_deref()), &pattern) } else { v.clone() });
-                (WidgetKind::Date(pattern), ui, widget_border(f.ui_border.as_ref(), false), shown, f.tooltip.clone())
-            }
-            Ui::ChoiceList => {
-                let options: Vec<(String, String)> = f
-                    .items
-                    .iter()
-                    .enumerate()
-                    .map(|(i, shown)| (f.item_values.get(i).cloned().unwrap_or_else(|| shown.clone()), shown.clone()))
-                    .collect();
-                // The data holds saved values (several on separate lines); shown text is taken
-                // too, as a user typing into an editable list leaves it.
-                let value = plain_value.as_ref().map(|v| f.saved_value(v));
-                let kind = WidgetKind::Choice { options, list_box: f.choice.list_box, multi: f.choice.multi, editable: f.choice.editable };
-                (kind, ui, widget_border(f.ui_border.as_ref(), false), value, f.tooltip.clone())
-            }
-            Ui::Signature => (WidgetKind::Signature, ui, widget_border(f.ui_border.as_ref(), false), None, f.tooltip.clone()),
-            Ui::ImageEdit => {
-                let none = WidgetBorder { color: None, fill: None, shape: BorderShape::None, width: 0.0 };
-                (WidgetKind::Image, ui, none, None, f.tooltip.clone())
-            }
-            Ui::PasswordEdit => (WidgetKind::Password, ui, widget_border(f.ui_border.as_ref(), false), plain_value, f.tooltip.clone()),
-            _ => (WidgetKind::Text, ui, widget_border(f.ui_border.as_ref(), false), plain_value, f.tooltip.clone()),
-        };
-        if rect.w < 1.0 || rect.h < 1.0 {
-            return Ok(());
-        }
-        let action = if f.ui == Ui::Button { button_action(&f.scripts) } else { None };
-        let items: Vec<String> = match &kind {
-            WidgetKind::CheckBox { on, .. } => vec![on.clone(), f.items.get(1).cloned().unwrap_or_default()],
-            WidgetKind::Radio { on, .. } => vec![on.clone()],
-            _ => Vec::new(),
-        };
-        self.fields += 1;
-        self.push(Item::Widget(Box::new(Widget {
-            rect,
-            kind,
-            name,
-            som,
-            tooltip,
-            face,
-            h_align,
-            multiline: f.multiline,
-            max_chars: f.max_chars,
-            read_only,
-            border,
-            value,
-            default: template_default,
-            action,
-            items,
-            no_scroll: f.no_scroll,
-        })))
-    }
-}
-
-/// The widget's own border from the `<ui>` border element. Without one, a check box gets a
-/// solid box, as Designer draws it, and any other field has no box of its own.
-fn widget_border(b: Option<&Border>, check: bool) -> WidgetBorder {
-    let Some(b) = b else {
-        if !check {
-            return WidgetBorder { color: None, fill: None, shape: BorderShape::None, width: 0.0 };
-        }
-        return WidgetBorder { color: Some([0.0, 0.0, 0.0]), fill: Some([1.0, 1.0, 1.0]), shape: BorderShape::Full, width: 0.5 };
-    };
-    let vis = b.visible_edges();
-    let shape = match vis {
-        [false, false, false, false] => BorderShape::None,
-        [false, false, true, false] => BorderShape::Underline,
-        _ => BorderShape::Full,
-    };
-    let edge = (0..4).find(|&i| vis[i]).map(|i| b.edges[i]).unwrap_or_default();
-    WidgetBorder {
-        color: (shape != BorderShape::None).then_some(edge.color.0),
-        fill: b.fill().map(|c| c.0),
-        shape,
-        width: edge.thickness.clamp(0.1, 12.0),
-    }
-}
diff --git a/crates/xfa/src/layout/common.rs b/crates/xfa/src/layout/common.rs
new file mode 100644
index 0000000000..3b60f8a6a0
--- /dev/null
+++ b/crates/xfa/src/layout/common.rs
@@ -0,0 +1,211 @@
+use super::items::{Action, Item, Rounded};
+use super::*;
+
+pub(super) fn collect_values(nodes: &[Node], out: &mut HashMap<String, String>, depth: usize) {
+    if depth > MAX_DEPTH {
+        return;
+    }
+    for n in nodes {
+        match n {
+            Node::Field(f) => {
+                if let Some(id) = &f.common.id {
+                    out.insert(id.clone(), f.value.plain().unwrap_or_default());
+                }
+            }
+            Node::Subform(s) => {
+                collect_values(&s.children, out, depth + 1);
+                if let Some(ps) = &s.page_set {
+                    for a in &ps.areas {
+                        collect_values(&a.items, out, depth + 1);
+                    }
+                }
+            }
+            Node::Area(a) => collect_values(&a.children, out, depth + 1),
+            Node::ExclGroup(_) | Node::Draw(_) => {}
+        }
+    }
+}
+
+pub(super) fn clamp_opt(v: f64, min: Option<f64>, max: Option<f64>) -> f64 {
+    let mut v = v;
+    if let Some(m) = min {
+        v = v.max(m);
+    }
+    if let Some(m) = max
+        && m > 0.0
+    {
+        v = v.min(m);
+    }
+    v.max(0.0)
+}
+
+/// Does `node` flow (may be split across pages) rather than being placed as one block?
+pub(super) fn splittable(node: &Node) -> bool {
+    matches!(node, Node::Subform(s) if matches!(s.layout, Layout::Tb | Layout::Table) && s.common.h.is_none())
+}
+
+/// Top and bottom of an item a page break must not cut (text, a picture, a field); `None`
+/// for fills and lines, which are cut at the break.
+pub(super) fn solid_extent(item: &Item) -> Option<(f64, f64)> {
+    match item {
+        Item::Text(s) => Some((s.baseline - s.face.size * 0.8, s.baseline + s.face.size * 0.2)),
+        Item::Image { rect, .. } => Some((rect.y, rect.bottom())),
+        Item::Widget(w) => Some((w.rect.y, w.rect.bottom())),
+        Item::Fill { .. } | Item::Line { .. } | Item::Rounded(_) => None,
+    }
+}
+
+/// `item` as the part above `cut` and the part below: solid items go whole to the side their
+/// top is on, fills and lines crossing the cut are cut in two.
+pub(super) fn divide(item: Item, cut: f64) -> (Option<Item>, Option<Item>) {
+    if let Some((top, _)) = solid_extent(&item) {
+        return if top < cut - 0.01 { (Some(item), None) } else { (None, Some(item)) };
+    }
+    match item {
+        Item::Fill { rect, color } => {
+            if rect.bottom() <= cut + 0.01 {
+                (Some(Item::Fill { rect, color }), None)
+            } else if rect.y >= cut - 0.01 {
+                (None, Some(Item::Fill { rect, color }))
+            } else {
+                let above = Rect::new(rect.x, rect.y, rect.w, cut - rect.y);
+                let below = Rect::new(rect.x, cut, rect.w, rect.bottom() - cut);
+                (Some(Item::Fill { rect: above, color }), Some(Item::Fill { rect: below, color }))
+            }
+        }
+        Item::Line { from, to, width, color, dashed } => {
+            let (lo, hi) = if from.1 <= to.1 { (from, to) } else { (to, from) };
+            if lo.1 >= cut {
+                (None, Some(Item::Line { from, to, width, color, dashed }))
+            } else if hi.1 <= cut {
+                (Some(Item::Line { from, to, width, color, dashed }), None)
+            } else {
+                // lo.1 < cut < hi.1, so the divisor is positive.
+                let t = (cut - lo.1) / (hi.1 - lo.1);
+                let mid = (lo.0 + (hi.0 - lo.0) * t, cut);
+                (Some(Item::Line { from: lo, to: mid, width, color, dashed }), Some(Item::Line { from: mid, to: hi, width, color, dashed }))
+            }
+        }
+        Item::Rounded(r) => {
+            if r.rect.bottom() <= cut + 0.01 {
+                (Some(Item::Rounded(r)), None)
+            } else if r.rect.y >= cut - 0.01 {
+                (None, Some(Item::Rounded(r)))
+            } else {
+                // Each part keeps the corners on its side, rounded no more than its own height
+                // allows, and is open where it was cut.
+                let [tl, tr, br, bl] = r.radii;
+                let above = Rect::new(r.rect.x, r.rect.y, r.rect.w, cut - r.rect.y);
+                let below = Rect::new(r.rect.x, cut, r.rect.w, r.rect.bottom() - cut);
+                let fit = |v: f64, h: f64| v.min(h.max(0.0));
+                let upper = Rounded { rect: above, radii: [fit(tl, above.h), fit(tr, above.h), 0.0, 0.0], open_bottom: true, ..(*r).clone() };
+                let lower = Rounded { rect: below, radii: [0.0, 0.0, fit(br, below.h), fit(bl, below.h)], open_top: true, ..*r };
+                (Some(Item::Rounded(Box::new(upper))), Some(Item::Rounded(Box::new(lower))))
+            }
+        }
+        other => (Some(other), None),
+    }
+}
+
+/// `item` moved by (`dx`, `dy`).
+pub(super) fn moved(mut item: Item, dx: f64, dy: f64) -> Item {
+    match &mut item {
+        Item::Fill { rect, .. } | Item::Image { rect, .. } => {
+            rect.x += dx;
+            rect.y += dy;
+        }
+        Item::Rounded(r) => {
+            r.rect.x += dx;
+            r.rect.y += dy;
+        }
+        Item::Line { from, to, .. } => {
+            *from = (from.0 + dx, from.1 + dy);
+            *to = (to.0 + dx, to.1 + dy);
+        }
+        Item::Text(s) => {
+            s.x += dx;
+            s.baseline += dy;
+        }
+        Item::Widget(w) => {
+            w.rect.x += dx;
+            w.rect.y += dy;
+        }
+    }
+    item
+}
+
+pub(super) fn is_row(node: &Node) -> bool {
+    matches!(node, Node::Subform(s) if s.layout == Layout::Row)
+}
+
+/// The Acrobat date pattern for an XFA picture clause such as `date{YYYY-MM-DD}`.
+pub(crate) fn date_pattern(picture: Option<&str>) -> String {
+    picture.and_then(date_letters).unwrap_or_else(|| "yyyy-mm-dd".into())
+}
+
+/// What scripts read as a field's `formattedValue` when its display picture is `picture`: the
+/// ISO date `raw` shown in a date picture (`date{YYYYMMDD}` turns `2026-10-20` into
+/// `20261020`; of several alternatives, the first). `None` for other kinds of picture, for a
+/// clause this can't read or show (month and weekday names) and for a value that isn't an ISO
+/// date: the raw value stands then.
+pub fn formatted_value(picture: &str, raw: &str) -> Option<String> {
+    let first = picture.split('|').next()?.trim();
+    let rest = first.strip_prefix("date")?;
+    if !rest.starts_with(['{', '(']) {
+        return None;
+    }
+    let pattern = date_pattern(Some(first));
+    // A picture with parts this can't show yet (month or weekday names, `MMM` or `EEE`) would
+    // leave them as letters: the raw value stands then.
+    let shows = |t: &String| !t.chars().all(|c| c.is_ascii_alphabetic()) || matches!(t.as_str(), "yyyy" | "yy" | "mm" | "m" | "dd" | "d");
+    if !crate::data::date_tokens(&pattern).iter().all(shows) {
+        return None;
+    }
+    // Only the ISO date's own shape (`2026-10-20`): `2026-1-2` is not one, and stands.
+    let b = raw.as_bytes();
+    let iso = b.len() == 10 && b.iter().enumerate().all(|(i, c)| if i == 4 || i == 7 { *c == b'-' } else { c.is_ascii_digit() });
+    if !iso {
+        return None;
+    }
+    let shown = iso_to_pattern(raw, &pattern);
+    (shown != raw).then_some(shown)
+}
+
+/// The native PDF action a button's click script amounts to (a reset, print, save or link),
+/// else the script itself to run; `None` without a click script.
+pub(super) fn button_action(scripts: &[Script]) -> Option<Action> {
+    let s = scripts.iter().find(|s| s.activity == "click")?;
+    let t = &s.text;
+    // Only a single-statement idiom becomes a native PDF action; anything else is run by the
+    // XFA scripting engine.
+    let one = t.trim().trim_end_matches(';');
+    let single = !one.contains(';') && !one.contains('\n');
+    if !single {
+        return (!t.trim().is_empty()).then(|| Action::Script(t.clone()));
+    }
+    if t.contains("resetData") {
+        Some(Action::Reset)
+    } else if t.contains("host.print") || t.contains("execMenuItem(\"Print\")") {
+        Some(Action::Print)
+    } else if t.contains("SaveAs") || t.contains("execMenuItem(\"Save\")") {
+        Some(Action::SaveAs)
+    } else if let Some(i) = t.find("launchURL(") {
+        let rest = &t[i + "launchURL(".len()..];
+        let q = rest.find(['"', '\''])?;
+        let quote = rest[q..].chars().next()?;
+        let body = &rest[q + 1..];
+        let end = body.find(quote)?;
+        Some(Action::Url(body[..end].to_string()))
+    } else if t.trim().is_empty() {
+        None
+    } else {
+        Some(Action::Script(t.clone()))
+    }
+}
+
+/// A PDF field name: no periods (they separate hierarchy levels), no control characters.
+pub(super) fn clean_name(name: &str) -> String {
+    let s: String = name.chars().filter(|c| !c.is_control()).map(|c| if c == '.' { '_' } else { c }).collect();
+    let s = s.trim().to_string();
+    if s.is_empty() { "field".into() } else { s }
+}
diff --git a/crates/xfa/src/layout/draw.rs b/crates/xfa/src/layout/draw.rs
new file mode 100644
index 0000000000..4f318a73d6
--- /dev/null
+++ b/crates/xfa/src/layout/draw.rs
@@ -0,0 +1,324 @@
+use super::common::clean_name;
+use super::items::{Item, Rounded};
+use super::*;
+
+impl Layouter<'_> {
+    // ───────────────────────────────────────────────────────────────────────── drawing
+
+    pub(super) fn draw_row(&mut self, row: &Subform, cols: &[f64], rect: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
+        if depth > MAX_DEPTH {
+            return Ok(());
+        }
+        if let Some(b) = &row.common.border {
+            self.draw_border(b, rect)?;
+        }
+        let ctx = ctx.with_som(&row.common, sib);
+        let inner = rect.inset(&row.common.margin);
+        let (cells, _) = self.cells(row, cols, inner.w, &ctx, depth);
+        let sibs = SomIndices::of(&row.children);
+        for (i, r) in cells {
+            if let Some(k) = row.children.get(i) {
+                // Cells stretch to the row height.
+                self.draw_node(k, Rect::new(inner.x + r.x, inner.y, r.w, inner.h), &ctx, depth + 1, sibs.at(i))?;
+            }
+        }
+        Ok(())
+    }
+
+    pub(super) fn draw_positioned_child(&mut self, k: &Node, inner: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
+        let c = k.common();
+        if !c.presence.occupies() {
+            return Ok(());
+        }
+        let (w, h) = self.size_of(k, (inner.w - c.x.unwrap_or(0.0)).max(1.0), ctx, depth + 1);
+        let (x, y) = c.top_left(w, h);
+        self.draw_node(k, Rect::new(inner.x + x, inner.y + y, w, h), ctx, depth + 1, sib)
+    }
+
+    pub(super) fn draw_node(&mut self, node: &Node, rect: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
+        if depth > MAX_DEPTH {
+            return Ok(());
+        }
+        let c = node.common();
+        if c.presence == Presence::Invisible {
+            return Ok(());
+        }
+        match node {
+            Node::Draw(d) => {
+                let start = self.item_count();
+                self.draw_draw(d, rect, ctx)?;
+                // Text and pictures stay with their border; a bare line or rectangle is cut.
+                if matches!(d.value, Value::Text(_) | Value::Rich(_) | Value::Image { .. }) {
+                    self.keep_whole(start, rect);
+                }
+                Ok(())
+            }
+            Node::Field(f) => {
+                let start = self.item_count();
+                self.draw_field(f, rect, ctx, None, sib)?;
+                self.keep_whole(start, rect);
+                Ok(())
+            }
+            Node::ExclGroup(g) => self.draw_group(g, rect, ctx, depth, sib),
+            Node::Area(a) => {
+                let ctx = ctx.with_som(&a.common, sib);
+                let sibs = SomIndices::of(&a.children);
+                for (i, k) in a.children.iter().enumerate() {
+                    self.draw_positioned_child(k, rect, &ctx, depth + 1, sibs.at(i))?;
+                }
+                Ok(())
+            }
+            Node::Subform(s) => {
+                // Every drawn instance spends budget, as a flowed one does, so nested repeats that
+                // place nothing still stop.
+                self.measures.set(self.measures.get().saturating_add(1));
+                self.check_measures()?;
+                if let Some(b) = &s.common.border {
+                    self.draw_border(b, rect)?;
+                }
+                let parent_ctx = ctx;
+                let ctx = ctx.with_som(&s.common, sib);
+                let inner = rect.inset(&s.common.margin);
+                let sibs = SomIndices::of(&s.children);
+                match s.layout {
+                    Layout::Positioned => {
+                        for (i, k) in s.children.iter().enumerate() {
+                            self.draw_positioned_child(k, inner, &ctx, depth + 1, sibs.at(i))?;
+                        }
+                    }
+                    Layout::Tb => {
+                        let mut y = inner.y;
+                        for (i, k) in s.children.iter().enumerate() {
+                            if !k.common().presence.occupies() {
+                                continue;
+                            }
+                            let (w, h) = self.size_of(k, inner.w, &ctx, depth + 1);
+                            // A repeating subform here (a table in an area of a positioned page,
+                            // say) gets its instances, as in a flowed one, one under another.
+                            for instance in 0..self.instances(k, &ctx.som) {
+                                self.draw_node(k, Rect::new(inner.x, y, w, h), &ctx, depth + 1, sibs.at(i) + instance)?;
+                                y += h;
+                            }
+                        }
+                    }
+                    Layout::LrTb | Layout::RlTb => {
+                        // A repeating subform here (rows of fields under a heading) gets its
+                        // instances, as in the other layouts.
+                        let (placed, _) = self.pack_instances(&s.children, inner.w, &ctx, depth, &ctx.som);
+                        for (i, instance, r) in placed {
+                            if let Some(k) = s.children.get(i) {
+                                let x = if s.layout == Layout::RlTb { inner.right() - r.x - r.w } else { inner.x + r.x };
+                                self.draw_node(k, Rect::new(x, inner.y + r.y, r.w, r.h), &ctx, depth + 1, sibs.at(i) + instance)?;
+                            }
+                        }
+                    }
+                    Layout::Table => {
+                        let cols = self.columns(s, inner.w);
+                        let mut y = inner.y;
+                        for (i, k) in s.children.iter().enumerate() {
+                            if !k.common().presence.occupies() {
+                                continue;
+                            }
+                            let csib = sibs.at(i);
+                            if let Node::Subform(r) = k
+                                && r.layout == Layout::Row
+                            {
+                                let h = self.row_height(r, &cols, inner.w, &ctx, depth + 1);
+                                self.draw_row(r, &cols, Rect::new(inner.x, y, inner.w, h), &ctx, depth + 1, csib)?;
+                                y += h;
+                            } else {
+                                let (w, h) = self.size_of(k, inner.w, &ctx, depth + 1);
+                                self.draw_node(k, Rect::new(inner.x, y, w, h), &ctx, depth + 1, csib)?;
+                                y += h;
+                            }
+                        }
+                    }
+                    Layout::Row => {
+                        let cols = self.columns(s, inner.w);
+                        self.draw_row(s, &cols, rect, parent_ctx, depth, sib)?;
+                    }
+                }
+                Ok(())
+            }
+        }
+    }
+
+    /// Draw border `b` around `rect`: its fill, then each shown edge as a line inside the box, or
+    /// the whole box as one rounded shape when its corners are rounded.
+    pub(super) fn draw_border(&mut self, b: &Border, rect: Rect) -> Result<(), XfaError> {
+        let vis = b.visible_edges();
+        // Rounded corners: the box is one shape, filled and edged along its curves, when its
+        // edges are all alike (all shown and the same, or all hidden). Edges that differ keep
+        // square corners.
+        let radii = b.radii(rect.w, rect.h);
+        let alike = b.edges.iter().all(|e| *e == b.edges[0]);
+        if radii.iter().any(|r| *r > 0.0) && (vis == [true; 4] && alike || vis == [false; 4]) {
+            let e = b.edges[0];
+            let edge = vis[0].then(|| {
+                let color = if e.stroke == Stroke::Relief { [0.55, 0.55, 0.55] } else { e.color.0 };
+                (e.thickness.clamp(0.1, 20.0), color, matches!(e.stroke, Stroke::Dashed | Stroke::Dotted))
+            });
+            let shape = Rounded {
+                rect,
+                radii,
+                inverted: b.corners.map(|c| c.inverted),
+                fill: b.fill().map(|f| f.0),
+                edge,
+                open_top: false,
+                open_bottom: false,
+            };
+            return self.push(Item::Rounded(Box::new(shape)));
+        }
+        if let Some(fill) = b.fill() {
+            self.push(Item::Fill { rect, color: fill.0 })?;
+        }
+        let (x0, y0, x1, y1) = (rect.x, rect.y, rect.right(), rect.bottom());
+        // Top, right, bottom, left; lines sit inside the box.
+        let segs = [((x0, y0), (x1, y0)), ((x1, y0), (x1, y1)), ((x0, y1), (x1, y1)), ((x0, y0), (x0, y1))];
+        for (i, seg) in segs.iter().enumerate() {
+            if !vis[i] {
+                continue;
+            }
+            let e = b.edges[i];
+            let t = e.thickness.clamp(0.1, 20.0);
+            let (dx, dy) = match i {
+                0 => (0.0, t / 2.0),
+                1 => (-t / 2.0, 0.0),
+                2 => (0.0, -t / 2.0),
+                _ => (t / 2.0, 0.0),
+            };
+            let color = if e.stroke == Stroke::Relief { [0.55, 0.55, 0.55] } else { e.color.0 };
+            self.push(Item::Line {
+                from: (seg.0.0 + dx, seg.0.1 + dy),
+                to: (seg.1.0 + dx, seg.1.1 + dy),
+                width: t,
+                color,
+                dashed: matches!(e.stroke, Stroke::Dashed | Stroke::Dotted),
+            })?;
+        }
+        Ok(())
+    }
+
+    pub(super) fn draw_value_text(&mut self, v: &Value, rect: Rect, font: &Font, para: &Para) -> Result<(), XfaError> {
+        let rich = match v {
+            Value::Text(t) => text::plain(t),
+            Value::Rich(r) => r.clone(),
+            _ => return Ok(()),
+        };
+        let face = Face::of(font);
+        // Text that doesn't fit the height it was given (the template's face is narrower than
+        // the standard one drawn in its place, so it wraps to more lines) is drawn smaller,
+        // down to 70%, rather than over what lies below.
+        let fits = |k: f64| text::measure_height(&rich, rect.w / k, para, &face, &|id, max| self.embed(id, max)) <= rect.h / k + 1.0;
+        let scale = if rect.h < 4.0 || fits(1.0) { 1.0 } else { [0.95, 0.9, 0.85, 0.8, 0.75].into_iter().find(|k| fits(*k)).unwrap_or(0.7) };
+        let mut block = text::layout(&rich, Rect::new(rect.x, rect.y, rect.w / scale, rect.h / scale), para, &face, &|id, max| self.embed(id, max));
+        if scale < 1.0 {
+            for s in &mut block.spans {
+                s.x = rect.x + (s.x - rect.x) * scale;
+                s.baseline = rect.y + (s.baseline - rect.y) * scale;
+                s.face.size *= scale;
+            }
+        }
+        self.push_block(block)
+    }
+
+    fn draw_draw(&mut self, d: &Draw, rect: Rect, ctx: &Ctx) -> Result<(), XfaError> {
+        if let Some(b) = &d.common.border {
+            self.draw_border(b, rect)?;
+        }
+        let ctx = ctx.child(&d.common);
+        let inner = rect.inset(&d.common.margin);
+        match &d.value {
+            Value::Text(_) | Value::Rich(_) => self.draw_value_text(&d.value, inner, &ctx.font, &ctx.para),
+            Value::Image { content_type, data } => self.draw_image(data, content_type, inner),
+            Value::Line { slope_up, edge } => {
+                if !edge.visible() {
+                    return Ok(());
+                }
+                let (from, to) = if *slope_up {
+                    ((inner.x, inner.bottom()), (inner.right(), inner.y))
+                } else {
+                    ((inner.x, inner.y), (inner.right(), inner.bottom()))
+                };
+                self.push(Item::Line { from, to, width: edge.thickness.clamp(0.1, 20.0), color: edge.color.0, dashed: edge.stroke == Stroke::Dashed })
+            }
+            Value::Rectangle(b) => self.draw_border(b, inner),
+            Value::Empty => Ok(()),
+        }
+    }
+
+    fn draw_group(&mut self, g: &ExclGroup, rect: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
+        if let Some(b) = &g.common.border {
+            self.draw_border(b, rect)?;
+        }
+        let ctx = ctx.with_som(&g.common, sib);
+        // The group's data node holds the selected button's on value.
+        let selected: Option<String> =
+            self.data.and_then(|d| d.text_at(&data_path(self.tpl, &ctx.som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+        let inner = rect.inset(&g.common.margin);
+        let group = self.unique_name(g.common.name.as_deref().unwrap_or("group"));
+        let nodes: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
+        let placed: Vec<(usize, Rect)> = match g.layout {
+            Layout::Tb => {
+                let mut y = 0.0;
+                let mut out = Vec::new();
+                for (i, k) in nodes.iter().enumerate() {
+                    if !k.common().presence.occupies() {
+                        continue;
+                    }
+                    let (w, h) = self.size_of(k, inner.w, &ctx, depth + 1);
+                    out.push((i, Rect::new(0.0, y, w, h)));
+                    y += h;
+                }
+                out
+            }
+            Layout::Positioned => nodes
+                .iter()
+                .enumerate()
+                .filter(|(_, k)| k.common().presence.occupies())
+                .map(|(i, k)| {
+                    let c = k.common();
+                    let (w, h) = self.size_of(k, (inner.w - c.x.unwrap_or(0.0)).max(1.0), &ctx, depth + 1);
+                    let (x, y) = c.top_left(w, h);
+                    (i, Rect::new(x, y, w, h))
+                })
+                .collect(),
+            _ => self.pack(&nodes, inner.w, &ctx, depth).0,
+        };
+        let sibs = SomIndices::of(&nodes);
+        for (i, r) in placed {
+            if let Some(f) = g.fields.get(i) {
+                let on = f.items.first().cloned().filter(|s| !s.trim().is_empty()).unwrap_or_else(|| (i + 1).to_string());
+                let tip = f.tooltip.clone().or_else(|| g.tooltip.clone());
+                let chosen = selected.as_deref() == Some(on.as_str());
+                self.draw_field(f, Rect::new(inner.x + r.x, inner.y + r.y, r.w, r.h), &ctx, Some((&group, &on, tip, chosen)), sibs.at(i))?;
+            }
+        }
+        Ok(())
+    }
+
+    /// A picture scaled to fit `inner`, keeping its shape, from its top left.
+    pub(super) fn draw_image(&mut self, data: &[u8], content_type: &str, inner: Rect) -> Result<(), XfaError> {
+        self.image_bytes = self.image_bytes.saturating_add(data.len());
+        if self.image_bytes > MAX_IMAGE_BYTES {
+            return Err(XfaError::TooLarge("the form's pictures are too large together to lay out".into()));
+        }
+        let fitted = match crate::image::size(data) {
+            Some((iw, ih)) if iw > 0 && ih > 0 && inner.w > 0.0 && inner.h > 0.0 => {
+                let k = (inner.w / iw as f64).min(inner.h / ih as f64);
+                Rect::new(inner.x, inner.y, iw as f64 * k, ih as f64 * k)
+            }
+            _ => inner,
+        };
+        self.push(Item::Image { rect: fitted, data: Arc::new(data.to_vec()), content_type: content_type.to_string() })
+    }
+
+    /// A field name made from `base` that no earlier field of the form has: the first keeps it,
+    /// later ones get `_2`, `_3`, ….
+    pub(super) fn unique_name(&mut self, base: &str) -> String {
+        let base = clean_name(base);
+        let n = self.names.entry(base.clone()).or_insert(0);
+        *n += 1;
+        if *n == 1 { base } else { format!("{base}_{n}") }
+    }
+}
diff --git a/crates/xfa/src/layout/field.rs b/crates/xfa/src/layout/field.rs
new file mode 100644
index 0000000000..40ec1497de
--- /dev/null
+++ b/crates/xfa/src/layout/field.rs
@@ -0,0 +1,305 @@
+use super::common::{button_action, date_pattern};
+use super::items::{BorderShape, Item, Widget, WidgetBorder, WidgetKind};
+use super::*;
+
+impl Layouter<'_> {
+    /// Draw field `f` at `rect`: its border (a button's is its widget's box), its caption, then its
+    /// widget, or its value as plain text when it is non-interactive, a barcode, or a text field
+    /// taller than its content area. `radio` is set for a group's radio button; `sib` is its SOM index.
+    pub(super) fn draw_field(
+        &mut self,
+        f: &Field,
+        rect: Rect,
+        ctx: &Ctx,
+        radio: Option<(&str, &str, Option<String>, bool)>,
+        sib: usize,
+    ) -> Result<(), XfaError> {
+        if let Some(b) = &f.common.border
+            && f.ui != Ui::Button
+        {
+            self.draw_border(b, rect)?;
+        }
+        let fctx = ctx.child(&f.common);
+        let inner = rect.inset(&f.common.margin);
+        let (mut ui, mut cap_rect) = (inner, None);
+        if let Some((placement, reserve)) = self.caption_reserve(f, inner.w, ctx) {
+            let reserve = auto_check_reserve(f, placement, inner.w, Some(inner.h)).unwrap_or(reserve);
+            let r = reserve.max(0.0);
+            match placement {
+                Placement::Top => {
+                    cap_rect = Some(Rect::new(inner.x, inner.y, inner.w, r.min(inner.h)));
+                    ui = Rect::new(inner.x, inner.y + r, inner.w, inner.h - r);
+                }
+                Placement::Bottom => {
+                    cap_rect = Some(Rect::new(inner.x, inner.bottom() - r.min(inner.h), inner.w, r.min(inner.h)));
+                    ui = Rect::new(inner.x, inner.y, inner.w, inner.h - r);
+                }
+                Placement::Right => {
+                    cap_rect = Some(Rect::new(inner.right() - r.min(inner.w), inner.y, r.min(inner.w), inner.h));
+                    ui = Rect::new(inner.x, inner.y, inner.w - r, inner.h);
+                }
+                _ => {
+                    cap_rect = Some(Rect::new(inner.x, inner.y, r.min(inner.w), inner.h));
+                    ui = Rect::new(inner.x + r, inner.y, inner.w - r, inner.h);
+                }
+            }
+        }
+        if let (Some(cr), Some(cap)) = (cap_rect, &f.caption)
+            && cap.presence == Presence::Visible
+        {
+            let font = ctx.font.apply(&cap.font);
+            let para = ctx.para.apply(&cap.para);
+            self.draw_value_text(&cap.value, cr, &font, &para)?;
+        }
+        let som_path = || {
+            if fctx.som.is_empty() {
+                format!("{}[{sib}]", f.common.name.as_deref().unwrap_or("field"))
+            } else {
+                format!("{}.{}[{sib}]", fctx.som, f.common.name.as_deref().unwrap_or("field"))
+            }
+        };
+        match f.ui {
+            Ui::Unknown => {
+                self.warn_once("a field of an unknown kind is left blank");
+                return Ok(());
+            }
+            Ui::ImageEdit => {
+                // The picture the data holds (base64, as Designer saves it) or the template's.
+                let field_name = f.common.name.clone().unwrap_or_else(|| "an image field".into());
+                let text: Vec<u8> = self
+                    .data
+                    .and_then(|d| d.text_at(&data_path(self.tpl, &som_path())))
+                    .map(|t| t.bytes().filter(|b| !b.is_ascii_whitespace()).collect())
+                    .unwrap_or_default();
+                let from_data = if text.is_empty() {
+                    None
+                } else if text.len() > MAX_DATA_IMAGE / 3 * 4 + 4 {
+                    self.warn_once(format!("{field_name}: the picture in the data is larger than 32 MB and is left out"));
+                    None
+                } else {
+                    match base64::engine::general_purpose::STANDARD.decode(&text) {
+                        Ok(d) if crate::image::kind(&d).is_some() => Some(d),
+                        Ok(_) => {
+                            self.warn_once(format!("{field_name}: the picture in the data is not a JPEG, PNG, GIF, BMP or TIFF and is left out"));
+                            None
+                        }
+                        Err(_) => {
+                            self.warn_once(format!("{field_name}: the data holds no readable picture (not base64) and is left out"));
+                            None
+                        }
+                    }
+                };
+                let box_ = ui.inset(&f.ui_margin);
+                match (&from_data, &f.value) {
+                    (Some(d), _) => self.draw_image(d, "", box_)?,
+                    (None, Value::Image { content_type, data }) => self.draw_image(data, content_type, box_)?,
+                    _ => {}
+                }
+                // Then the field itself, which clicking gives a new picture.
+            }
+            Ui::Barcode => {
+                // The value as text, where the bars would be.
+                self.warn_once("barcode fields show their value as text, not as bars");
+                let value = self
+                    .data
+                    .and_then(|d| d.text_at(&data_path(self.tpl, &som_path())))
+                    .map(str::to_string)
+                    .or_else(|| f.value.plain())
+                    .unwrap_or_default();
+                if !value.trim().is_empty() {
+                    let mut para = fctx.para.clone();
+                    para.h_align = HAlign::Center;
+                    self.draw_value_text(&Value::Text(value), ui.inset(&f.ui_margin), &fctx.font, &para)?;
+                }
+                return Ok(());
+            }
+            _ => {}
+        }
+        if f.access == Access::NonInteractive && f.ui != Ui::Button {
+            // Shown as text, not as a field.
+            return self.draw_value_text(&f.value, ui.inset(&f.ui_margin), &fctx.font, &fctx.para);
+        }
+        // A text field that grew past what a content area holds can't be one widget: its text
+        // is drawn as lines the page breaks fall between, and stays what the data holds.
+        if f.grows_with_text() && rect.h > self.cursor().0.h + 0.01 {
+            let value =
+                self.data.and_then(|d| d.value_at(&data_path(self.tpl, &som_path()))).filter(|t| !t.trim().is_empty()).or_else(|| f.value.plain());
+            if let Some(value) = value.filter(|t| !t.trim().is_empty()) {
+                let name = f.common.name.clone().unwrap_or_else(|| "a text field".into());
+                self.warn_once(format!("{name}: its text is longer than a page; it is shown across pages and can't be edited here"));
+                let m = Margin {
+                    top: f.ui_margin.top + 2.0,
+                    bottom: f.ui_margin.bottom + 2.0,
+                    left: f.ui_margin.left + 2.0,
+                    right: f.ui_margin.right + 2.0,
+                };
+                let para = Para { v_align: VAlign::Top, ..fctx.para.clone() };
+                // In the face it was measured in, so it takes the lines it was given.
+                let face = Self::field_text_face(f, &fctx.font);
+                let block = text::layout(&text::plain(value.trim_end()), ui.inset(&m), &para, &face, &|_, _| String::new());
+                return self.push_block(block);
+            }
+        }
+        let face = match (&f.ui, &f.caption) {
+            // Buttons show their caption in the caption's font.
+            (Ui::Button, Some(cap)) => Face::of(&ctx.font.apply(&cap.font)).unscaled(),
+            _ => Face::of(&fctx.font).unscaled(),
+        };
+        let h_align = match (&f.ui, &f.caption) {
+            (Ui::Button, Some(cap)) => ctx.para.apply(&cap.para).h_align,
+            _ => fctx.para.h_align,
+        };
+        let name = self.unique_name(f.common.name.as_deref().unwrap_or("field"));
+        let som = som_path();
+        let read_only = matches!(f.access, Access::ReadOnly | Access::Protected);
+        // The data's value wins over the template's default.
+        let data_value: Option<String> =
+            self.data.and_then(|d| d.value_at(&data_path(self.tpl, &som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+        // A choice list's default is a saved value too.
+        let template_default = f.value.plain().map(|v| f.saved_value(v.trim())).filter(|v| !v.is_empty());
+        let plain_value = data_value.clone().or_else(|| template_default.clone());
+        let (kind, rect, border, value, tooltip) = match f.ui {
+            Ui::CheckButton => {
+                let s = f.check_size.unwrap_or(10.0).min(ui.w.max(1.0)).min(ui.h.max(1.0));
+                // Without a caption the box sits at the right of the content area, as if a
+                // caption on its left took the rest, so the paragraph's alignment has no room to
+                // act on; beside a caption that alignment places it. The box's own margin doesn't
+                // move it.
+                let x = match (cap_rect, fctx.para.h_align) {
+                    (None, _) | (Some(_), HAlign::Right) => ui.right() - s,
+                    (Some(_), HAlign::Center) => ui.x + (ui.w - s) / 2.0,
+                    (Some(_), HAlign::Left | HAlign::Justify) => ui.x,
+                };
+                let y = match fctx.para.v_align {
+                    VAlign::Top => ui.y,
+                    VAlign::Middle => ui.y + (ui.h - s) / 2.0,
+                    VAlign::Bottom => ui.bottom() - s,
+                };
+                let r = Rect::new(x, y, s, s);
+                let on = f.items.first().cloned().filter(|s| !s.trim().is_empty()).unwrap_or_else(|| "1".into());
+                let (kind, tip, checked) = match radio {
+                    Some((group, on_value, tip, chosen)) => (
+                        WidgetKind::Radio { group: group.to_string(), on: on_value.to_string(), round: f.check_round },
+                        tip.or_else(|| f.tooltip.clone()),
+                        chosen,
+                    ),
+                    None => (
+                        WidgetKind::CheckBox { on: on.clone(), round: f.check_round },
+                        f.tooltip.clone(),
+                        plain_value.as_deref().is_some_and(|v| is_on(v, &on)),
+                    ),
+                };
+                let border = widget_border(f.ui_border.as_ref(), true);
+                (kind, r, border, checked.then(|| on.clone()), tip)
+            }
+            Ui::Button => {
+                let caption = f.caption.as_ref().and_then(|c| c.value.plain()).unwrap_or_default().trim().to_string();
+                // A button's box is its field border, around the whole field (its margins pad
+                // the caption, not the box); without one it is invisible (a link over text, say).
+                let border = match &f.common.border {
+                    Some(b) => widget_border(Some(b), false),
+                    None => WidgetBorder { color: None, fill: None, shape: BorderShape::None, width: 0.0 },
+                };
+                (WidgetKind::Button { caption }, rect, border, None, f.tooltip.clone())
+            }
+            Ui::DateTimeEdit => {
+                let pattern = date_pattern(f.picture.as_deref());
+                // The data holds the date in the field's data picture, or else as an ISO date; the
+                // field shows it in its own pattern.
+                let data_pattern = data_date_letters(f);
+                let shown = plain_value
+                    .as_ref()
+                    .map(|v| if data_value.is_some() { iso_to_pattern(&data_to_iso(v, data_pattern.as_deref()), &pattern) } else { v.clone() });
+                (WidgetKind::Date(pattern), ui, widget_border(f.ui_border.as_ref(), false), shown, f.tooltip.clone())
+            }
+            Ui::ChoiceList => {
+                let options: Vec<(String, String)> = f
+                    .items
+                    .iter()
+                    .enumerate()
+                    .map(|(i, shown)| (f.item_values.get(i).cloned().unwrap_or_else(|| shown.clone()), shown.clone()))
+                    .collect();
+                // The data holds saved values (several on separate lines); shown text is taken
+                // too, as a user typing into an editable list leaves it.
+                let value = plain_value.as_ref().map(|v| f.saved_value(v));
+                let kind = WidgetKind::Choice { options, list_box: f.choice.list_box, multi: f.choice.multi, editable: f.choice.editable };
+                (kind, ui, widget_border(f.ui_border.as_ref(), false), value, f.tooltip.clone())
+            }
+            Ui::Signature => (WidgetKind::Signature, ui, widget_border(f.ui_border.as_ref(), false), None, f.tooltip.clone()),
+            Ui::ImageEdit => {
+                let none = WidgetBorder { color: None, fill: None, shape: BorderShape::None, width: 0.0 };
+                (WidgetKind::Image, ui, none, None, f.tooltip.clone())
+            }
+            Ui::PasswordEdit => (WidgetKind::Password, ui, widget_border(f.ui_border.as_ref(), false), plain_value, f.tooltip.clone()),
+            _ => (WidgetKind::Text, ui, widget_border(f.ui_border.as_ref(), false), plain_value, f.tooltip.clone()),
+        };
+        if rect.w < 1.0 || rect.h < 1.0 {
+            return Ok(());
+        }
+        let action = if f.ui == Ui::Button { button_action(&f.scripts) } else { None };
+        let items: Vec<String> = match &kind {
+            WidgetKind::CheckBox { on, .. } => vec![on.clone(), f.items.get(1).cloned().unwrap_or_default()],
+            WidgetKind::Radio { on, .. } => vec![on.clone()],
+            _ => Vec::new(),
+        };
+        self.fields += 1;
+        self.push(Item::Widget(Box::new(Widget {
+            rect,
+            kind,
+            name,
+            som,
+            tooltip,
+            face,
+            h_align,
+            multiline: f.multiline,
+            max_chars: f.max_chars,
+            read_only,
+            border,
+            value,
+            default: template_default,
+            action,
+            items,
+            no_scroll: f.no_scroll,
+        })))
+    }
+}
+
+/// The room a caption without a reserve takes beside a check box: all the box leaves of a
+/// content area `w` wide (and `h` tall, when known), the box at the size it can be drawn there.
+/// `None` for any other field, or a caption with a reserve of its own.
+pub(super) fn auto_check_reserve(f: &Field, placement: Placement, w: f64, h: Option<f64>) -> Option<f64> {
+    if f.ui != Ui::CheckButton || f.caption.as_ref().is_none_or(|c| c.reserve.is_some()) {
+        return None;
+    }
+    let s = f.check_size.unwrap_or(10.0).min(w.max(1.0)).min(h.map_or(f64::INFINITY, |h| h.max(1.0)));
+    let rest = match (placement, h) {
+        (Placement::Top | Placement::Bottom, Some(h)) => h - s,
+        (Placement::Top | Placement::Bottom, None) => return None,
+        _ => w - s,
+    };
+    Some(rest.max(0.0))
+}
+
+/// The widget's own border from the `<ui>` border element. Without one, a check box gets a
+/// solid box, as Designer draws it, and any other field has no box of its own.
+fn widget_border(b: Option<&Border>, check: bool) -> WidgetBorder {
+    let Some(b) = b else {
+        if !check {
+            return WidgetBorder { color: None, fill: None, shape: BorderShape::None, width: 0.0 };
+        }
+        return WidgetBorder { color: Some([0.0, 0.0, 0.0]), fill: Some([1.0, 1.0, 1.0]), shape: BorderShape::Full, width: 0.5 };
+    };
+    let vis = b.visible_edges();
+    let shape = match vis {
+        [false, false, false, false] => BorderShape::None,
+        [false, false, true, false] => BorderShape::Underline,
+        _ => BorderShape::Full,
+    };
+    let edge = (0..4).find(|&i| vis[i]).map(|i| b.edges[i]).unwrap_or_default();
+    WidgetBorder {
+        color: (shape != BorderShape::None).then_some(edge.color.0),
+        fill: b.fill().map(|c| c.0),
+        shape,
+        width: edge.thickness.clamp(0.1, 12.0),
+    }
+}
diff --git a/crates/xfa/src/layout/flow.rs b/crates/xfa/src/layout/flow.rs
new file mode 100644
index 0000000000..48c57cd888
--- /dev/null
+++ b/crates/xfa/src/layout/flow.rs
@@ -0,0 +1,310 @@
+use super::common::{clamp_opt, divide, is_row, moved, solid_extent, splittable};
+use super::items::Item;
+use super::*;
+
+impl Layouter<'_> {
+    /// Place `node` as one block of size (`w`, `h`) at the cursor: in this content area when it fits,
+    /// in the next when it fits there, and across as many as it takes when it is taller than a
+    /// content area (a positioned or fixed-height subform holding more than a page).
+    fn flow_block(&mut self, node: &Node, x: f64, (w, h): (f64, f64), ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
+        let (rect, y, _) = self.cursor();
+        if y + h > rect.bottom() + 0.01 && h <= rect.h + 0.01 {
+            self.make_room(h, 0.0)?;
+        }
+        let (rect, y, _) = self.cursor();
+        let first = self.pages.last().map_or(0, |p| p.items.len());
+        self.leaves.clear();
+        self.draw_node(node, Rect::new(x, y, w, h), ctx, depth, sib)?;
+        let page_h = self.pages.last().map_or(f64::INFINITY, |p| p.height);
+        // What was drawn, when it is lower than the block's own height says (content that
+        // outgrows a fixed height) and ends off the page.
+        let drawn = self
+            .pages
+            .last()
+            .and_then(|p| p.items.get(first..))
+            .unwrap_or_default()
+            .iter()
+            .filter_map(solid_extent)
+            .map(|e| e.1)
+            .fold(y + h, f64::max);
+        if y + h <= rect.bottom() + 0.01 && drawn <= page_h + 0.01 {
+            self.leaves.clear();
+            self.place(h);
+            return Ok(());
+        }
+        self.split_block(first, y, drawn)
+    }
+
+    /// Remember that the items the last page got since `start` are one field or draw at
+    /// `rect`, to be kept together by a page break.
+    pub(super) fn keep_whole(&mut self, start: usize, rect: Rect) {
+        let end = self.pages.last().map_or(0, |p| p.items.len());
+        if end > start {
+            self.leaves.push((start, end, rect.y, rect.bottom()));
+        }
+    }
+
+    pub(super) fn item_count(&self) -> usize {
+        self.pages.last().map_or(0, |p| p.items.len())
+    }
+
+    /// Spread the items the last page holds from index `first` on (a block drawn from `top` to
+    /// `end`, past the bottom of its content area) over this and the following content areas.
+    /// Breaks fall between text, pictures and fields, never through one that fits in an area;
+    /// fills and lines are cut at the break.
+    fn split_block(&mut self, first: usize, top: f64, end: f64) -> Result<(), XfaError> {
+        let items: Vec<Item> = match self.pages.last_mut() {
+            Some(p) if first <= p.items.len() => p.items.split_off(first),
+            _ => return Ok(()),
+        };
+        // Each item with the extent of the field or draw it belongs to: such a leaf moves
+        // whole (its border with its text), unless it is taller than a content area.
+        let area_h = self.cursor().0.h;
+        let mut extents: Vec<Option<(f64, f64)>> = vec![None; items.len()];
+        for (start, end, top, bottom) in std::mem::take(&mut self.leaves) {
+            if bottom - top <= area_h + 0.01
+                && let Some(slots) = start.checked_sub(first).and_then(|s| extents.get_mut(s..end.saturating_sub(first)))
+            {
+                slots.fill(Some((top, bottom)));
+            }
+        }
+        let mut rest: Vec<(Item, Option<(f64, f64)>)> = items.into_iter().zip(extents).collect();
+        let origin_x = self.cursor().0.x;
+        // An item's place on the current page is its drawn place moved by (dx, -shift).
+        let (mut dx, mut shift) = (0.0, 0.0);
+        let mut seg_top = top;
+        let mut first_segment = true;
+        loop {
+            let (rect, _, placed) = self.cursor();
+            let limit = rect.bottom() + shift;
+            let mut cut = limit;
+            if rect.h < 1.0 {
+                // No room to split into: leave the rest here.
+                cut = f64::INFINITY;
+            } else {
+                // The lowest break at or above the bottom that crosses no solid item: going
+                // through them from the lowest top up, a break moved to an item's top can't
+                // cross one already passed.
+                let mut solid: Vec<(f64, f64)> =
+                    rest.iter().filter_map(|(item, kept)| kept.or_else(|| solid_extent(item))).filter(|e| e.0 < limit - 0.01).collect();
+                solid.sort_by(|a, b| b.0.total_cmp(&a.0));
+                for (t, b) in solid {
+                    if t < cut - 0.01 && b > cut + 0.01 {
+                        cut = t;
+                    }
+                }
+                if cut <= seg_top + 0.01 {
+                    // An item taller than what is left. Start it in a fresh area if this one
+                    // already holds something; otherwise cut through it.
+                    cut = if first_segment && placed && seg_top > rect.y + 0.01 { seg_top } else { limit };
+                }
+            }
+            let mut here = Vec::new();
+            let mut below = Vec::new();
+            for (item, kept) in rest {
+                if let Some((top, _)) = kept {
+                    if top < cut - 0.01 {
+                        here.push(item)
+                    } else {
+                        below.push((item, kept))
+                    }
+                    continue;
+                }
+                match divide(item, cut) {
+                    (Some(a), None) => here.push(a),
+                    (None, Some(b)) => below.push((b, None)),
+                    (Some(a), Some(b)) => {
+                        here.push(a);
+                        below.push((b, None));
+                    }
+                    (None, None) => {}
+                }
+            }
+            if let Some(p) = self.pages.last_mut() {
+                p.items.extend(here.into_iter().map(|it| moved(it, dx, -shift)));
+            }
+            if below.is_empty() {
+                if let Some(c) = &mut self.cur {
+                    c.y = (end - shift).min(c.rect.bottom()).max(c.y);
+                    c.placed = true;
+                }
+                self.overflowed(end - shift);
+                return Ok(());
+            }
+            rest = below;
+            seg_top = cut;
+            first_segment = false;
+            self.next_area()?;
+            let (rect, _, _) = self.cursor();
+            shift = cut - rect.y;
+            dx = rect.x - origin_x;
+        }
+    }
+
+    fn page_has_flow(&self) -> bool {
+        self.cur.as_ref().is_some_and(|c| c.placed || c.content > 0)
+    }
+
+    // ───────────────────────────────────────────────────────────────────────── flow
+
+    /// Flow `node` (a subform; anything else is ignored) into the content areas.
+    pub(super) fn flow_subform(&mut self, node: &Node, avail: Option<(f64, f64)>, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
+        if depth > MAX_DEPTH {
+            return Ok(());
+        }
+        let Node::Subform(sf) = node else { return Ok(()) };
+        self.check_measures()?;
+        if sf.break_before_page && self.page_has_flow() {
+            self.break_frames(0.0, true)?;
+        }
+        // Data adds instances of a repeating subform (rows added in another viewer).
+        let instances = self.instances(node, &ctx.som);
+        self.warn_truncated(node, &ctx.som, instances);
+        let ctx_parent = ctx;
+        for i in 0..instances {
+            // Every instance spends budget, so nested repeats that place nothing still stop.
+            self.measures.set(self.measures.get().saturating_add(1));
+            self.check_measures()?;
+            let ctx = ctx_parent.with_som(&sf.common, sib + i);
+            let (rect, _, _) = self.cursor();
+            let (x, w) = avail.unwrap_or((rect.x, rect.w));
+            let w = clamp_opt(sf.common.w.unwrap_or(w), sf.common.min_w, sf.common.max_w).min(w.max(1.0));
+            if !matches!(sf.layout, Layout::Tb | Layout::Table) || sf.common.h.is_some() {
+                // Not splittable: one block.
+                let (_, h) = self.size_of(node, w, ctx_parent, depth);
+                self.flow_block(node, x, (w, h), ctx_parent, depth, sib + i)?;
+                continue;
+            }
+            let m = sf.common.margin;
+            // Its border and fill go round what it takes from here, a part on each content area.
+            let framed = match self.flow_mark() {
+                Some(part) => {
+                    self.frames.push(Frame { x, w, margin: m, border: sf.common.border.clone(), part, parts: Vec::new(), lost: false });
+                    true
+                }
+                None => false,
+            };
+            self.advance(m.top);
+            let inner_x = x + m.left;
+            let inner_w = (w - m.horizontal()).max(1.0);
+            match sf.layout {
+                Layout::Table => self.flow_table(sf, inner_x, inner_w, &ctx, depth)?,
+                _ => {
+                    let sibs = SomIndices::of(&sf.children);
+                    for (ci, child) in sf.children.iter().enumerate() {
+                        if !child.common().presence.occupies() {
+                            continue;
+                        }
+                        let csib = sibs.at(ci);
+                        if let Node::Subform(_) = child
+                            && splittable(child)
+                        {
+                            self.flow_subform(child, Some((inner_x, inner_w)), &ctx, depth + 1, csib)?;
+                            continue;
+                        }
+                        let (cw, ch) = self.size_of(child, inner_w, &ctx, depth + 1);
+                        self.flow_block(child, inner_x, (cw, ch), &ctx, depth + 1, csib)?;
+                    }
+                }
+            }
+            self.advance(m.bottom);
+            if framed && let Some(frame) = self.frames.pop() {
+                self.finish_frame(frame)?;
+            }
+        }
+        if sf.break_after_page {
+            self.break_frames(0.0, true)?;
+        }
+        Ok(())
+    }
+
+    pub(super) fn columns(&self, sf: &Subform, inner_w: f64) -> Vec<f64> {
+        if !sf.column_widths.is_empty() {
+            return sf.column_widths.clone();
+        }
+        let cells = sf.children.iter().filter_map(|c| if let Node::Subform(r) = c { Some(r.children.len()) } else { None }).max().unwrap_or(1).max(1);
+        vec![inner_w / cells as f64; cells]
+    }
+
+    fn flow_table(&mut self, sf: &Subform, x: f64, inner_w: f64, ctx: &Ctx, depth: usize) -> Result<(), XfaError> {
+        let cols = self.columns(sf, inner_w);
+        let leader =
+            sf.overflow_leader.as_ref().and_then(|name| sf.children.iter().position(|c| c.common().name.as_deref() == Some(name) && is_row(c)));
+        // The overflow leader starts each part after the first, before the row that moved.
+        let lead = leader.and_then(|li| match sf.children.get(li) {
+            Some(Node::Subform(l)) => Some((li, l.as_ref())),
+            _ => None,
+        });
+        let lead_h = lead.map_or(0.0, |(_, l)| self.row_height(l, &cols, inner_w, ctx, depth + 1));
+        let sibs = SomIndices::of(&sf.children);
+        for (ci, child) in sf.children.iter().enumerate() {
+            if !child.common().presence.occupies() {
+                continue;
+            }
+            let csib = sibs.at(ci);
+            if let Node::Subform(row) = child
+                && row.layout == Layout::Row
+            {
+                // Rows added as data (in another viewer) repeat the row.
+                let instances = self.instances(child, &ctx.som);
+                self.warn_truncated(child, &ctx.som, instances);
+                for inst in 0..instances {
+                    let h = self.row_height(row, &cols, inner_w, ctx, depth + 1);
+                    let led = lead.filter(|(li, _)| *li != ci);
+                    if self.make_room(h, led.map_or(0.0, |_| lead_h))?
+                        && let Some((li, l)) = led
+                    {
+                        let (_, y, _) = self.cursor();
+                        self.draw_row(l, &cols, Rect::new(x, y, inner_w, lead_h), ctx, depth + 1, sibs.at(li))?;
+                        self.place(lead_h);
+                    }
+                    let (_, y, _) = self.cursor();
+                    self.draw_row(row, &cols, Rect::new(x, y, inner_w, h), ctx, depth + 1, csib + inst)?;
+                    self.place(h);
+                }
+                continue;
+            }
+            if splittable(child)
+                && let Node::Subform(_) = child
+            {
+                self.flow_subform(child, Some((x, inner_w)), ctx, depth + 1, csib)?;
+                continue;
+            }
+            let (cw, ch) = self.size_of(child, inner_w, ctx, depth + 1);
+            self.flow_block(child, x, (cw, ch), ctx, depth + 1, csib)?;
+        }
+        Ok(())
+    }
+
+    // ───────────────────────────────────────────────────────────────────────── sizing
+
+    /// The size a node takes when given `avail_w` of width. Containers are measured once per
+    /// (node, width, depth): measuring a width-less container measures its content twice (for
+    /// its width, then its height), which would otherwise be exponential in the nesting.
+    /// How many instances of `node` to lay out under the container at `parent_som`: a
+    /// repeating subform's `occur` and data instances ([`instance_count`]); one for anything else.
+    pub(super) fn instances(&self, node: &Node, parent_som: &str) -> usize {
+        let Node::Subform(sf) = node else { return 1 };
+        let from_data = match (&sf.common.name, self.data) {
+            (Some(name), Some(d)) if sf.occur.max != Some(1) => d.count(&data_path(self.tpl, parent_som), name),
+            _ => 0,
+        };
+        instance_count(&sf.occur, from_data)
+    }
+
+    /// The data holds more instances of `node` than `laid_out`: say so, since calculations
+    /// then see only those.
+    fn warn_truncated(&mut self, node: &Node, parent_som: &str, laid_out: usize) {
+        let Node::Subform(sf) = node else { return };
+        let from_data = match (&sf.common.name, self.data) {
+            (Some(name), Some(d)) if sf.occur.max != Some(1) => d.count(&data_path(self.tpl, parent_som), name),
+            _ => 0,
+        };
+        if from_data > laid_out {
+            self.warn_once(format!(
+                "{}: the data holds {from_data} rows; only the first {laid_out} are laid out (calculations see those)",
+                sf.common.name.as_deref().unwrap_or("a subform")
+            ));
+        }
+    }
+}
diff --git a/crates/xfa/src/layout/items.rs b/crates/xfa/src/layout/items.rs
new file mode 100644
index 0000000000..51383792c1
--- /dev/null
+++ b/crates/xfa/src/layout/items.rs
@@ -0,0 +1,145 @@
+use super::*;
+
+/// How far below its baseline an underline is drawn, in the text's size: an underline is the
+/// level line pushed just before its span, this far below it (the PDF writer tells it apart from
+/// a rule by this).
+pub(crate) const UNDERLINE_DROP: f64 = 0.1;
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum Item {
+    Fill {
+        rect: Rect,
+        color: [f64; 3],
+    },
+    Line {
+        from: (f64, f64),
+        to: (f64, f64),
+        width: f64,
+        color: [f64; 3],
+        dashed: bool,
+    },
+    /// A box with rounded (or inverted) corners: its fill, and its edge drawn inside it.
+    Rounded(Box<Rounded>),
+    Text(Span),
+    Image {
+        rect: Rect,
+        data: Arc<Vec<u8>>,
+        content_type: String,
+    },
+    Widget(Box<Widget>),
+}
+
+/// A box with rounded corners ([`Item::Rounded`]).
+#[derive(Clone, Debug, PartialEq)]
+pub struct Rounded {
+    pub rect: Rect,
+    /// Top-left, top-right, bottom-right and bottom-left radii, each at most half the box's
+    /// shorter side.
+    pub radii: [f64; 4],
+    /// Corners whose curve goes into the box rather than around it, in the same order.
+    pub inverted: [bool; 4],
+    pub fill: Option<[f64; 3]>,
+    /// The edge: its width, colour and whether it is dashed.
+    pub edge: Option<(f64, [f64; 3], bool)>,
+    /// A page break cut the box here: that side has no edge, and its corners are square.
+    pub open_top: bool,
+    pub open_bottom: bool,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum WidgetKind {
+    Text,
+    /// A text field whose characters are shown as asterisks.
+    Password,
+    /// A drop-down (`list_box` false) or list box: `options` are (saved value, shown text).
+    Choice {
+        options: Vec<(String, String)>,
+        list_box: bool,
+        multi: bool,
+        editable: bool,
+    },
+    /// A signature field, to be signed in the app.
+    Signature,
+    /// An image field: a push button that picks a picture (the picture itself is page content).
+    Image,
+    /// A date field with its Acrobat format pattern (`yyyy-mm-dd`).
+    Date(String),
+    CheckBox {
+        on: String,
+        round: bool,
+    },
+    Radio {
+        group: String,
+        on: String,
+        round: bool,
+    },
+    Button {
+        caption: String,
+    },
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum BorderShape {
+    None,
+    Full,
+    Underline,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct WidgetBorder {
+    pub color: Option<[f64; 3]>,
+    pub fill: Option<[f64; 3]>,
+    pub shape: BorderShape,
+    pub width: f64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Action {
+    Reset,
+    Print,
+    SaveAs,
+    Url(String),
+    /// Any other click script: run by the XFA scripting engine.
+    Script(String),
+}
+
+/// An interactive field to create as an AcroForm widget.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Widget {
+    pub rect: Rect,
+    pub kind: WidgetKind,
+    /// The PDF field name (unique in the form, no periods).
+    pub name: String,
+    /// The template's scripting object model path, for data round trips.
+    pub som: String,
+    pub tooltip: Option<String>,
+    pub face: Face,
+    pub h_align: HAlign,
+    pub multiline: bool,
+    pub max_chars: Option<usize>,
+    pub read_only: bool,
+    pub border: WidgetBorder,
+    /// The field's value: saved (bound) values for choice lists, newline-separated when several.
+    pub value: Option<String>,
+    /// The template's default value (what a reset restores); data values are not defaults.
+    pub default: Option<String>,
+    pub action: Option<Action>,
+    /// Check boxes: the on and off values of the data; radio buttons: the on value.
+    pub items: Vec<String>,
+    /// A text field that doesn't scroll: it takes no more text than it shows (`DoNotScroll`).
+    pub no_scroll: bool,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Page {
+    pub width: f64,
+    pub height: f64,
+    pub items: Vec<Item>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Form {
+    pub pages: Vec<Page>,
+    pub fields: usize,
+    pub warnings: Vec<String>,
+}
diff --git a/crates/xfa/src/layout/measure.rs b/crates/xfa/src/layout/measure.rs
new file mode 100644
index 0000000000..cd004df982
--- /dev/null
+++ b/crates/xfa/src/layout/measure.rs
@@ -0,0 +1,366 @@
+use super::common::clamp_opt;
+use super::field::auto_check_reserve;
+use super::*;
+
+impl Layouter<'_> {
+    /// The width and height `node` takes in `avail_w`: its own size, else what its content needs
+    /// (containers are measured once per width and depth, and measuring stops at its caps).
+    pub(super) fn size_of(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> (f64, f64) {
+        let c = node.common();
+        let spent = self.measures.get().saturating_add(1);
+        self.measures.set(spent);
+        if depth > MAX_DEPTH || spent > MAX_MEASURES {
+            return (c.w.unwrap_or(avail_w), c.h.unwrap_or(0.0));
+        }
+        // Only containers recurse; their addresses are stable for the whole layout (the
+        // template is borrowed, the root and page areas are held by the layouter).
+        let key = match node {
+            Node::Subform(s) => Some((&**s as *const Subform as usize, avail_w.to_bits(), depth)),
+            Node::Area(a) => Some((&**a as *const Area as usize, avail_w.to_bits(), depth)),
+            _ => None,
+        };
+        if let Some(key) = key
+            && let Ok(cache) = self.measured.try_borrow()
+            && let Some(m) = cache.get(&key)
+            && m.font == ctx.font
+            && m.para == ctx.para
+        {
+            return m.size;
+        }
+        let size = self.measure(node, avail_w, ctx, depth);
+        if let Some(key) = key
+            && let Ok(mut cache) = self.measured.try_borrow_mut()
+        {
+            cache.insert(key, Measured { font: ctx.font.clone(), para: ctx.para.clone(), size });
+        }
+        size
+    }
+
+    /// The size (width, height) of `node` within `avail_w`, uncached ([`Self::size_of`] caches it).
+    /// Without a width, a container, a text draw or a button is as wide as its content (at most
+    /// `avail_w`) and anything else takes `avail_w`; without a height, it is as tall as its content.
+    fn measure(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> (f64, f64) {
+        let c = node.common();
+        // The node's own SOM: its repeating children count their instances under it, and a
+        // growing text field finds its value at it. Measurements are cached per template node,
+        // so instance 0 stands for all of them.
+        let ctx = ctx.with_som(c, 0);
+        let som = ctx.som.clone();
+        // A container without a width is as wide as its content (a radio group beside its
+        // question, say), and so is a text label or a button (as wide as its caption), within
+        // what is available; any other field without one takes what is available.
+        let w = match c.w {
+            Some(w) => w,
+            None => match node {
+                Node::Subform(_) | Node::ExclGroup(_) | Node::Area(_) => {
+                    let inner = (avail_w - c.margin.horizontal()).max(1.0);
+                    (self.content_width(node, inner, &ctx, depth) + c.margin.horizontal()).min(avail_w)
+                }
+                Node::Draw(d) => self.natural_width(&d.value, &ctx.font, &ctx.para).map_or(avail_w, |t| (t + c.margin.horizontal()).min(avail_w)),
+                Node::Field(f) if f.ui == Ui::Button => f
+                    .caption
+                    .as_ref()
+                    .and_then(|cap| self.natural_width(&cap.value, &ctx.font.apply(&cap.font), &ctx.para.apply(&cap.para)))
+                    .map_or(avail_w, |t| (t + c.margin.horizontal() + f.ui_margin.horizontal()).min(avail_w)),
+                Node::Field(_) => avail_w,
+            },
+        };
+        let w = clamp_opt(w, c.min_w, c.max_w);
+        let h = match c.h {
+            Some(h) => h,
+            None => {
+                let inner_w = (w - c.margin.horizontal()).max(1.0);
+                let content = match node {
+                    Node::Draw(d) => self.value_height(&d.value, inner_w, &ctx),
+                    Node::Field(f) => self.field_height(f, inner_w, &ctx),
+                    Node::ExclGroup(g) => self.group_height(g, inner_w, &ctx, depth),
+                    Node::Area(a) => self.positioned_height(&a.children, inner_w, &ctx, depth),
+                    Node::Subform(s) => match s.layout {
+                        Layout::Positioned => self.positioned_height(&s.children, inner_w, &ctx, depth),
+                        // Each instance of a repeating child takes its height again.
+                        Layout::Tb => s
+                            .children
+                            .iter()
+                            .filter(|k| k.common().presence.occupies())
+                            .map(|k| self.size_of(k, inner_w, &ctx, depth + 1).1 * self.instances(k, &som) as f64)
+                            .sum(),
+                        Layout::LrTb | Layout::RlTb => self.pack_instances(&s.children, inner_w, &ctx, depth, &som).1,
+                        Layout::Table => {
+                            let cols = self.columns(s, inner_w);
+                            s.children
+                                .iter()
+                                .filter(|k| k.common().presence.occupies())
+                                .map(|k| match k {
+                                    Node::Subform(r) if r.layout == Layout::Row => self.row_height(r, &cols, inner_w, &ctx, depth + 1),
+                                    _ => self.size_of(k, inner_w, &ctx, depth + 1).1,
+                                })
+                                .sum()
+                        }
+                        Layout::Row => self.row_height(s, &self.columns(s, inner_w), inner_w, &ctx, depth + 1),
+                    },
+                };
+                content + c.margin.vertical()
+            }
+        };
+        // A flowed subform is as tall as what it holds: other viewers do not stretch one to
+        // the `minH` a designer left on it.
+        let min_h = match node {
+            Node::Subform(s) if c.h.is_none() && s.layout != Layout::Positioned => None,
+            _ => c.min_h,
+        };
+        (w, clamp_opt(h, min_h, c.max_h))
+    }
+
+    /// The natural width of a container's content within `avail_w`.
+    fn content_width(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> f64 {
+        let group: Vec<Node>;
+        let (children, layout): (&[Node], Layout) = match node {
+            Node::Subform(s) => {
+                if s.layout == Layout::Table && !s.column_widths.is_empty() {
+                    return s.column_widths.iter().sum::<f64>().min(avail_w);
+                }
+                (&s.children, s.layout)
+            }
+            Node::ExclGroup(g) => {
+                // Fields are leaves: measuring these copies caches nothing.
+                group = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
+                (&group, g.layout)
+            }
+            Node::Area(a) => (&a.children, Layout::Positioned),
+            _ => return avail_w,
+        };
+        let visible = children.iter().filter(|k| k.common().presence.occupies());
+        match layout {
+            Layout::LrTb | Layout::RlTb | Layout::Row => {
+                let sum: f64 = visible.map(|k| self.size_of(k, avail_w, ctx, depth + 1).0).sum();
+                if sum <= avail_w + 0.05 { sum } else { avail_w }
+            }
+            Layout::Positioned => visible
+                .map(|k| {
+                    let (w, h) = self.size_of(k, avail_w, ctx, depth + 1);
+                    k.common().top_left(w, h).0 + w
+                })
+                .fold(0.0, f64::max)
+                .min(avail_w),
+            Layout::Tb | Layout::Table => visible.map(|k| self.size_of(k, avail_w, ctx, depth + 1).0).fold(0.0, f64::max).min(avail_w),
+        }
+    }
+
+    /// How wide text `v` is unwrapped, in `font` and `para`, with a hair to spare so that laying
+    /// it out at that width keeps it on its lines; `None` for what isn't text, or text that draws
+    /// nothing.
+    fn natural_width(&self, v: &Value, font: &Font, para: &Para) -> Option<f64> {
+        let rich = match v {
+            Value::Text(t) => text::plain(t),
+            Value::Rich(r) => r.clone(),
+            _ => return None,
+        };
+        // No text (a bordered spacer or rule): nothing to size to, so it keeps what it has room for.
+        let w = text::natural_width(&rich, para, &Face::of(font), &|id, max| self.embed(id, max));
+        (w > 0.0).then_some(w + 0.01)
+    }
+
+    /// How tall value `v` is laid out `w` wide: text wrapped in the context's font and paragraph,
+    /// an image at its aspect ratio, and nothing for lines, rectangles and empty values.
+    fn value_height(&self, v: &Value, w: f64, ctx: &Ctx) -> f64 {
+        match v {
+            Value::Text(t) => text::measure_height(&text::plain(t), w, &ctx.para, &Face::of(&ctx.font), &|id, max| self.embed(id, max)),
+            Value::Rich(r) => text::measure_height(r, w, &ctx.para, &Face::of(&ctx.font), &|id, max| self.embed(id, max)),
+            Value::Image { data, .. } => crate::image::size(data).map_or(w, |(iw, ih)| if iw > 0 { w * ih as f64 / iw as f64 } else { w }),
+            Value::Line { .. } | Value::Rectangle(_) | Value::Empty => 0.0,
+        }
+    }
+
+    /// Where field `f`'s caption goes and how much room it takes from the field's box, or `None`
+    /// when it has no caption that takes room (a button's is drawn inside its box).
+    pub(super) fn caption_reserve(&self, f: &Field, inner_w: f64, ctx: &Ctx) -> Option<(Placement, f64)> {
+        let cap = f.caption.as_ref()?;
+        if !cap.presence.occupies() || f.ui == Ui::Button {
+            return None;
+        }
+        if cap.value.is_empty() && cap.reserve.is_none() {
+            return None;
+        }
+        // A check box has no text for an inline caption to run with: it is not shown.
+        if f.ui == Ui::CheckButton && cap.placement == Placement::Inline {
+            return None;
+        }
+        let placement = if cap.placement == Placement::Inline { Placement::Left } else { cap.placement };
+        let font = ctx.font.apply(&cap.font);
+        let para = ctx.para.apply(&cap.para);
+        let reserve = cap.reserve.unwrap_or_else(|| match placement {
+            Placement::Top | Placement::Bottom => {
+                let rich = match &cap.value {
+                    Value::Rich(r) => r.clone(),
+                    other => text::plain(&other.plain().unwrap_or_default()),
+                };
+                text::measure_height(&rich, inner_w, &para, &Face::of(&font), &|id, max| self.embed(id, max))
+            }
+            _ => (Face::of(&font).width(&cap.value.plain().unwrap_or_default()) + 2.0).min(inner_w * 0.6),
+        });
+        Some((placement, reserve))
+    }
+
+    /// The height of field `f`'s content within `inner_w` (inside its margins): its widget (a check
+    /// box, a button's caption, or one line of text or three when multi-line, more for a text field
+    /// that grows) plus a caption above or below it, or the taller of the two for one beside it.
+    fn field_height(&self, f: &Field, inner_w: f64, ctx: &Ctx) -> f64 {
+        let font = ctx.font.apply(&f.common.font);
+        let lines = if f.multiline { 3.0 } else { 1.0 };
+        let ui = match f.ui {
+            Ui::CheckButton => f.check_size.unwrap_or(10.0).max(text::line_height(font.size)),
+            // A button shows its caption: as tall as the caption's text in its own font.
+            Ui::Button if f.caption.as_ref().is_some_and(|c| !c.value.is_empty()) => {
+                let cap = f.caption.as_ref().map_or(0.0, |c| {
+                    let rich = match &c.value {
+                        Value::Rich(r) => r.clone(),
+                        other => text::plain(&other.plain().unwrap_or_default()),
+                    };
+                    let w = (inner_w - f.ui_margin.horizontal()).max(1.0);
+                    text::measure_height(&rich, w, &ctx.para.apply(&c.para), &Face::of(&ctx.font.apply(&c.font)), &|id, max| self.embed(id, max))
+                });
+                cap + f.ui_margin.vertical()
+            }
+            _ => (text::line_height(font.size) * lines).max(self.grown_text_height(f, inner_w, ctx)) + 4.0 + f.ui_margin.vertical(),
+        };
+        match self.caption_reserve(f, inner_w, ctx) {
+            Some((Placement::Top | Placement::Bottom, r)) => ui + r,
+            Some((placement, r)) => {
+                // A check box's caption without a reserve is drawn in all the box leaves.
+                let w = match auto_check_reserve(f, placement, inner_w, None) {
+                    Some(auto) => auto,
+                    None => inner_w - r,
+                };
+                let cap = f.caption.as_ref().map(|c| {
+                    let rich = match &c.value {
+                        Value::Rich(r) => r.clone(),
+                        other => text::plain(&other.plain().unwrap_or_default()),
+                    };
+                    text::measure_height(&rich, w.max(1.0), &ctx.para.apply(&c.para), &Face::of(&ctx.font.apply(&c.font)), &|id, max| {
+                        self.embed(id, max)
+                    })
+                });
+                ui.max(cap.unwrap_or(0.0))
+            }
+            None => ui,
+        }
+    }
+
+    /// The face a field's text is laid out in: at its horizontal scale when the layout draws
+    /// the text itself (a non-interactive field), as designed when the forms layer draws it in
+    /// a widget, whose appearances have no horizontal scaling.
+    pub(super) fn field_text_face(f: &Field, font: &Font) -> Face {
+        let face = Face::of(font);
+        if f.access == Access::NonInteractive { face } else { face.unscaled() }
+    }
+
+    /// The height the text of a multi-line text field takes (its value in the data, else the
+    /// template's), for a field without a fixed height, which grows to hold its text. `ctx`
+    /// is the field's own (its SOM ends in the field). Zero for anything else.
+    fn grown_text_height(&self, f: &Field, inner_w: f64, ctx: &Ctx) -> f64 {
+        if !f.grows_with_text() || f.common.name.is_none() {
+            return 0.0;
+        }
+        let value = self.data.and_then(|d| d.value_at(&data_path(self.tpl, &ctx.som))).filter(|t| !t.trim().is_empty()).or_else(|| f.value.plain());
+        let Some(value) = value.filter(|t| !t.trim().is_empty()) else { return 0.0 };
+        // Beside a caption the text has what the caption leaves; a widget's text has 2pt of
+        // padding on each side, a non-interactive field's (drawn as text) none, so it wraps
+        // where it is drawn.
+        let beside = match self.caption_reserve(f, inner_w, ctx) {
+            Some((Placement::Top | Placement::Bottom, _)) | None => 0.0,
+            Some((_, r)) => r,
+        };
+        let padding = if f.access == Access::NonInteractive { 0.0 } else { 4.0 };
+        let w = (inner_w - beside - f.ui_margin.horizontal() - padding).max(1.0);
+        let font = ctx.font.apply(&f.common.font);
+        text::measure_height(&text::plain(value.trim_end()), w, &ctx.para, &Self::field_text_face(f, &font), &|_, _| String::new())
+    }
+
+    /// The height of an exclusion group's fields at `inner_w`, by the group's layout: stacked
+    /// top to bottom, at their own positions, or packed in rows.
+    fn group_height(&self, g: &ExclGroup, inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
+        let nodes: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
+        match g.layout {
+            Layout::Tb => nodes.iter().filter(|k| k.common().presence.occupies()).map(|k| self.size_of(k, inner_w, ctx, depth + 1).1).sum(),
+            Layout::Positioned => self.positioned_height(&nodes, inner_w, ctx, depth),
+            _ => self.packed_height(&nodes, inner_w, ctx, depth),
+        }
+    }
+
+    fn positioned_height(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
+        children
+            .iter()
+            .filter(|k| k.common().presence.occupies())
+            .map(|k| {
+                let c = k.common();
+                let (w, h) = self.size_of(k, (inner_w - c.x.unwrap_or(0.0)).max(1.0), ctx, depth + 1);
+                c.top_left(w, h).1 + h
+            })
+            .fold(0.0, f64::max)
+    }
+
+    /// Left-to-right packing: rows of children, wrapped at the available width, as (child,
+    /// instance, place). A repeating subform is packed once per instance it has under the
+    /// container at `som`.
+    pub(super) fn pack_instances(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize, som: &str) -> (Vec<(usize, usize, Rect)>, f64) {
+        let mut out = Vec::new();
+        let (mut x, mut y, mut line_h) = (0.0, 0.0, 0.0);
+        for (i, k) in children.iter().enumerate() {
+            if !k.common().presence.occupies() {
+                continue;
+            }
+            let (w, h) = self.size_of(k, inner_w, ctx, depth + 1);
+            for instance in 0..self.instances(k, som) {
+                if x > 0.0 && x + w > inner_w + 0.05 {
+                    y += line_h;
+                    x = 0.0;
+                    line_h = 0.0;
+                }
+                out.push((i, instance, Rect::new(x, y, w, h)));
+                x += w;
+                line_h = line_h.max(h);
+            }
+        }
+        (out, y + line_h)
+    }
+
+    /// [`Self::pack_instances`] for children that don't repeat (the fields of a group).
+    pub(super) fn pack(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> (Vec<(usize, Rect)>, f64) {
+        let (placed, h) = self.pack_instances(children, inner_w, ctx, depth, "");
+        (placed.into_iter().map(|(i, _, r)| (i, r)).collect(), h)
+    }
+
+    fn packed_height(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
+        self.pack(children, inner_w, ctx, depth).1
+    }
+
+    /// Cell rectangles of a row (relative to the row's inner box) and the row height.
+    pub(super) fn cells(&self, row: &Subform, cols: &[f64], inner_w: f64, ctx: &Ctx, depth: usize) -> (Vec<(usize, Rect)>, f64) {
+        let ctx = ctx.child(&row.common);
+        let mut out = Vec::new();
+        let mut col = 0usize;
+        let mut x = 0.0;
+        let mut h: f64 = 0.0;
+        for (i, k) in row.children.iter().enumerate() {
+            if !k.common().presence.occupies() {
+                continue;
+            }
+            let span = k.common().col_span.max(1);
+            let w = if col < cols.len() { cols.iter().skip(col).take(span).sum::<f64>() } else { k.common().w.unwrap_or((inner_w - x).max(1.0)) };
+            let (_, ch) = self.size_of(k, w, &ctx, depth + 1);
+            out.push((i, Rect::new(x, 0.0, w, ch)));
+            h = h.max(ch);
+            x += w;
+            col += span;
+        }
+        let h = match row.common.h {
+            Some(rh) => rh,
+            None => h + row.common.margin.vertical(),
+        };
+        (out, clamp_opt(h, row.common.min_h, row.common.max_h))
+    }
+
+    pub(super) fn row_height(&self, row: &Subform, cols: &[f64], inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
+        self.cells(row, cols, inner_w, ctx, depth).1
+    }
+}
diff --git a/crates/xfa/src/layout/pages.rs b/crates/xfa/src/layout/pages.rs
new file mode 100644
index 0000000000..13047058b3
--- /dev/null
+++ b/crates/xfa/src/layout/pages.rs
@@ -0,0 +1,280 @@
+use super::items::{Item, Page, UNDERLINE_DROP};
+use super::*;
+
+impl Layouter<'_> {
+    pub(super) fn warn_once(&mut self, msg: impl Into<String>) {
+        let m = msg.into();
+        if self.warned.insert(m.clone()) && self.warnings.len() < 100 {
+            self.warnings.push(m);
+        }
+    }
+
+    fn page_no(&self) -> usize {
+        self.pages.len()
+    }
+
+    /// The text an embedded field `id` shows, at most `max` bytes of a field value (the page
+    /// number and count are a few bytes; the text layout cuts them).
+    pub(super) fn embed(&self, id: &str, max: usize) -> String {
+        let v = match self.tpl.page_roles.iter().find(|(i, _)| i == id).map(|(_, r)| *r) {
+            Some(PageRole::Number) => self.page_no().to_string(),
+            Some(PageRole::Count) => PAGE_COUNT_MARK.to_string(),
+            None => self.values.get(id).map(|v| text::prefix(v, max).to_string()).unwrap_or_default(),
+        };
+        #[cfg(test)]
+        EMBED_COPIED.with(|c| c.set(c.get().saturating_add(v.len() as u64)));
+        v
+    }
+
+    /// `TooLarge` once the measurement budget is spent (sizes measured after that are guesses).
+    pub(super) fn check_measures(&self) -> Result<(), XfaError> {
+        if self.measures.get() > MAX_MEASURES {
+            return Err(XfaError::TooLarge("the form is nested too deeply to lay out".into()));
+        }
+        Ok(())
+    }
+
+    pub(super) fn push(&mut self, item: Item) -> Result<(), XfaError> {
+        self.check_measures()?;
+        self.items += 1;
+        if self.items > MAX_ITEMS {
+            return Err(XfaError::TooLarge("the form has too many objects to lay out".into()));
+        }
+        if let Some(p) = self.pages.last_mut() {
+            p.items.push(item);
+        }
+        Ok(())
+    }
+
+    pub(super) fn push_block(&mut self, b: Block) -> Result<(), XfaError> {
+        for s in b.spans {
+            if s.face.underline {
+                let w = s.face.width(&s.text);
+                let y = s.baseline + s.face.size * UNDERLINE_DROP;
+                self.push(Item::Line { from: (s.x, y), to: (s.x + w, y), width: (s.face.size * 0.06).max(0.3), color: s.face.color, dashed: false })?;
+            }
+            if !s.text.trim().is_empty() {
+                self.push(Item::Text(s))?;
+            }
+        }
+        Ok(())
+    }
+
+    // ───────────────────────────────────────────────────────────────────────── pages
+
+    pub(super) fn new_page(&mut self) -> Result<(), XfaError> {
+        let idx =
+            (0..self.areas.len()).find(|&i| self.areas[i].occur_max.is_none_or(|m| self.uses[i] < m)).unwrap_or(self.areas.len().saturating_sub(1));
+        self.new_page_of(idx)
+    }
+
+    /// Once the body has been laid out, give every page area that has been used fewer times than
+    /// its `occur min` the pages it still needs, in template order, after the body's pages.
+    pub(super) fn satisfy_page_area_minimums(&mut self) -> Result<(), XfaError> {
+        let areas = Rc::clone(&self.areas);
+        for (idx, area) in areas.iter().enumerate() {
+            while self.uses.get(idx).is_some_and(|u| *u < area.occur_min) {
+                self.new_page_of(idx)?;
+            }
+        }
+        Ok(())
+    }
+
+    /// Start a page from page area `idx`.
+    fn new_page_of(&mut self, idx: usize) -> Result<(), XfaError> {
+        if self.pages.len() >= MAX_PAGES {
+            return Err(XfaError::TooLarge(format!("the form lays out to more than {MAX_PAGES} pages")));
+        }
+        let areas = Rc::clone(&self.areas);
+        let Some(area) = areas.get(idx) else {
+            return Err(XfaError::Malformed("the template has no page area".into()));
+        };
+        if let Some(u) = self.uses.get_mut(idx) {
+            *u += 1;
+        }
+        self.pages.push(Page { width: area.width, height: area.height, items: Vec::new() });
+        let content = area.content.first().copied().unwrap_or(Rect::new(0.0, 0.0, area.width, area.height));
+        self.cur = Some(Cursor { area: idx, content: 0, rect: content, y: content.y, placed: false });
+        // Master page content: positioned draws and fields.
+        let ctx = Ctx { font: Font::default(), para: Para::default(), som: area.name.clone().map(|n| format!("{n}[0]")).unwrap_or_default() };
+        let page_rect = Rect::new(0.0, 0.0, area.width, area.height);
+        let sibs = SomIndices::of(&area.items);
+        for (i, item) in area.items.iter().enumerate() {
+            self.draw_positioned_child(item, page_rect, &ctx, 1, sibs.at(i))?;
+        }
+        Ok(())
+    }
+
+    /// Move to the next content area, or the next page.
+    pub(super) fn next_area(&mut self) -> Result<(), XfaError> {
+        if let Some(c) = &self.cur
+            && let Some(area) = self.areas.get(c.area)
+            && let Some(next) = area.content.get(c.content + 1).copied()
+        {
+            let i = c.content + 1;
+            self.cur = Some(Cursor { area: c.area, content: i, rect: next, y: next.y, placed: false });
+            return Ok(());
+        }
+        self.new_page()
+    }
+
+    /// The current content area, how far down it the flow is, and whether anything has been
+    /// placed in it; before the first page, an empty letter-size page from its top.
+    pub(super) fn cursor(&self) -> (Rect, f64, bool) {
+        match &self.cur {
+            Some(c) => (c.rect, c.y, c.placed),
+            None => (Rect::new(0.0, 0.0, 612.0, 792.0), 0.0, false),
+        }
+    }
+
+    /// Where the flow is now ([`FlowMark`]); `None` before the first page.
+    pub(super) fn flow_mark(&self) -> Option<FlowMark> {
+        let c = self.cur.as_ref()?;
+        Some(FlowMark { page: self.pages.len(), area: c.area, content: c.content, y: c.y, items: self.pages.last().map_or(0, |p| p.items.len()) })
+    }
+
+    /// Whether the flow is still in the content area `m` was taken in.
+    fn on_area(&self, m: &FlowMark) -> bool {
+        self.pages.len() == m.page && self.cur.as_ref().is_some_and(|c| c.area == m.area && c.content == m.content)
+    }
+
+    /// Whether page `page` (an index) got anything from item `at` on.
+    fn has_items_from(&self, page: usize, at: usize) -> bool {
+        self.pages.get(page).is_some_and(|p| p.items.len() > at)
+    }
+
+    /// Break the flowed subforms being laid out ([`Self::frames`]) across content areas, as
+    /// another viewer breaks such a section on a synthetic form: each one's part here ends after
+    /// its content and its bottom margin (the innermost first, each inside the next), the flow
+    /// moves to the next content area, and each starts a new part there after its top margin
+    /// (the outermost first). The top margins take only what the `need` points of what comes next
+    /// leave of the new area: a child that fits a fresh area but not after the margins would
+    /// otherwise run past its bottom, out of its border. `to_page` moves to a new page instead (a
+    /// child's own page break), which breaks the subforms around it the same way.
+    pub(super) fn break_frames(&mut self, need: f64, to_page: bool) -> Result<(), XfaError> {
+        let (rect, mut y, _) = self.cursor();
+        let page = self.pages.len().saturating_sub(1);
+        let here: Vec<bool> = self.frames.iter().map(|f| self.on_area(&f.part)).collect();
+        let filled: Vec<bool> = self.frames.iter().map(|f| self.has_items_from(page, f.part.items)).collect();
+        for ((f, here), filled) in self.frames.iter_mut().zip(here).zip(filled).rev() {
+            y = (y + f.margin.bottom).min(rect.bottom());
+            if !here {
+                f.lost = true;
+            } else if filled && y - f.part.y >= 0.01 {
+                f.parts.push((page, f.part.items, Rect::new(f.x, f.part.y, f.w, y - f.part.y)));
+            }
+        }
+        if to_page {
+            self.new_page()?;
+        } else {
+            self.next_area()?;
+        }
+        let (rect, y, _) = self.cursor();
+        let mut room = (rect.bottom() - y - need).max(0.0);
+        for i in 0..self.frames.len() {
+            let Some(mark) = self.flow_mark() else { break };
+            let Some(f) = self.frames.get_mut(i) else { break };
+            f.part = mark;
+            // `max` before `min`: a NaN margin counts as none and leaves `room` a number.
+            let top = f.margin.top.max(0.0).min(room);
+            room = (room - top).max(0.0);
+            self.advance(top);
+        }
+        Ok(())
+    }
+
+    /// Close flowed subform `f` once its content is placed: its last part ends where the flow
+    /// is, and its border (edges and fill) is drawn round each part, closed on every side, under
+    /// that part's content. One holding something that didn't fit its content area ([`Frame::lost`])
+    /// is drawn without its border, and the layout says so.
+    pub(super) fn finish_frame(&mut self, mut f: Frame) -> Result<(), XfaError> {
+        let Some(b) = f.border.take() else { return Ok(()) };
+        if b.fill().is_none() && b.visible_edges() == [false; 4] {
+            return Ok(());
+        }
+        let (area, end, _) = self.cursor();
+        // The bottom margin stays in the content area, as at a break; content that itself ran
+        // past it has already cost the section its border ([`Self::overflowed`]).
+        let end = end.min(area.bottom()).max(end - f.margin.bottom);
+        let page = self.pages.len().saturating_sub(1);
+        if !self.on_area(&f.part) {
+            f.lost = true;
+        } else if self.has_items_from(page, f.part.items) && end - f.part.y >= 0.01 {
+            f.parts.push((page, f.part.items, Rect::new(f.x, f.part.y, f.w, end - f.part.y)));
+        }
+        if f.lost {
+            self.warn_once("a bordered section holding an item that doesn't fit on its page is drawn without its border");
+            return Ok(());
+        }
+        // The last part first: a part's place on its page stays where it was found.
+        for (page, at, rect) in f.parts.into_iter().rev() {
+            self.insert_border(&b, rect, page, at)?;
+        }
+        Ok(())
+    }
+
+    /// Draw border `b` round `rect` on page `page` (an index), under what that page got from item
+    /// `at` on.
+    fn insert_border(&mut self, b: &Border, rect: Rect, page: usize, at: usize) -> Result<(), XfaError> {
+        let before = self.pages.last().map_or(0, |p| p.items.len());
+        self.draw_border(b, rect)?;
+        let drawn: Vec<Item> = match self.pages.last_mut() {
+            Some(p) => {
+                let from = before.min(p.items.len());
+                p.items.drain(from..).collect()
+            }
+            None => return Ok(()),
+        };
+        if let Some(target) = self.pages.get_mut(page) {
+            let at = at.min(target.items.len());
+            target.items.splice(at..at, drawn);
+        }
+        Ok(())
+    }
+
+    /// Move the cursor down (margins and spacing: the area still counts as empty).
+    pub(super) fn advance(&mut self, dy: f64) {
+        if let Some(c) = &mut self.cur {
+            c.y += dy.max(0.0);
+        }
+    }
+
+    /// Move past something that was placed.
+    pub(super) fn place(&mut self, dy: f64) {
+        if let Some(c) = &mut self.cur {
+            c.y += dy.max(0.0);
+            c.placed = true;
+        }
+        let (_, y, _) = self.cursor();
+        self.overflowed(y);
+    }
+
+    /// Something was placed down to `bottom`: past the content area's bottom, the flowed subforms
+    /// it is inside can't hold it in a part, and are drawn without their border.
+    pub(super) fn overflowed(&mut self, bottom: f64) {
+        let (rect, _, _) = self.cursor();
+        if bottom > rect.bottom() + 0.01 {
+            for f in &mut self.frames {
+                f.lost = true;
+            }
+        }
+    }
+
+    /// Make room for `h`, with `after` more drawn before it should it move (a table's overflow
+    /// leader): stay, or move to the next content area / page. Returns whether a break happened.
+    /// Something that fits a fresh area breaks the flowed subforms it is in with it
+    /// ([`Self::break_frames`]), a table's rows included; one taller than an area just moves on,
+    /// and those subforms are drawn without their border ([`Self::finish_frame`]).
+    pub(super) fn make_room(&mut self, h: f64, after: f64) -> Result<bool, XfaError> {
+        let (rect, y, placed) = self.cursor();
+        if y + h <= rect.bottom() + 0.01 || !placed {
+            return Ok(false);
+        }
+        if h <= rect.h + 0.01 {
+            self.break_frames(h + after, false)?;
+        } else {
+            self.next_area()?;
+        }
+        Ok(true)
+    }
+}
diff --git a/crates/xfa/src/lib.rs b/crates/xfa/src/lib.rs
index 7fe372d53a..7e63218c90 100644
--- a/crates/xfa/src/lib.rs
+++ b/crates/xfa/src/lib.rs
@@ -92,14 +92,14 @@ pub(crate) fn xml_nesting_depth(text: &str) -> usize {
 
 pub use data::{DataImport, ImportNode, export_data, import_data, parse_data_file, write_data_image};
 pub use data::{
-    DataNode, DataOp, DataPath, DatasetsWrite, FieldData, FieldDatum, add_data_instances, build_data, data_path, iso_to_pattern, parse_datasets,
-    pattern_to_iso, read_values, read_values_with, remove_data_instance, som_to_path, write_data_ops, write_data_value, write_datasets,
-    write_datasets_reusing, write_datasets_with,
+    DataNode, DataOp, DataPath, DatasetsWrite, FieldData, FieldDatum, add_data_instances, build_data, clear_password_values, data_path,
+    has_password_values, iso_to_pattern, parse_datasets, pattern_to_iso, read_values, read_values_with, remove_data_instance, som_to_path,
+    write_data_ops, write_data_value, write_datasets, write_datasets_reusing, write_datasets_with,
 };
 pub use layout::{Action, BorderShape, Form, Item, MAX_PAGES, Page, Widget, WidgetKind, formatted_value, layout};
 pub use packets::{Encoding, Packets, decode as decode_packet, encode as encode_packet, read_packets};
 pub use parse::{measure, parse};
-pub use pdf::{CLICK_KEY, LAYOUT_KEY, SOM_KEY, Stripped, XfaShape, existing_layout, strip, xfa_shape};
+pub use pdf::{CLICK_KEY, LAYOUT_KEY, NODE_KEY, SOM_KEY, Stripped, XfaShape, existing_layout, strip, xfa_shape};
 pub use picture::typed_date;
 pub use script::{
     FormNode, LiveForm, MAX_FORM_NODES, NodeKind, OVERRIDES_KEY, Overrides, ScriptEvent, apply_overrides, data_of, field_grows_with_text,
diff --git a/crates/xfa/src/parse.rs b/crates/xfa/src/parse.rs
index e312d5310f..838d1730ea 100644
--- a/crates/xfa/src/parse.rs
+++ b/crates/xfa/src/parse.rs
@@ -5,7 +5,11 @@ use base64::Engine;
 use roxmltree::Node as XmlNode;
 
 use crate::XfaError;
-use crate::model::*;
+use crate::model::{
+    Access, Anchor, Area, Border, Caption, ChoiceList, Color, Common, Corner, Draw, Edge, ExclGroup, Field, FontSpec, HAlign, Layout, Margin, Node,
+    Occur, PageArea, PageRole, PageSet, ParaSpec, Paragraph, Placement, Presence, Rect, RichText, Run, Script, Stroke, Subform, Template, Ui, VAlign,
+    Value,
+};
 
 /// Deepest element nesting followed (templates are shallow; hostile ones are not).
 const MAX_DEPTH: usize = 64;
@@ -424,7 +428,9 @@ fn parse_caption(n: Option<XmlNode>, warnings: &mut Vec<String>) -> Option<Capti
             Some("inline") => Placement::Inline,
             _ => Placement::Left,
         },
-        reserve: attr_measure(n, "reserve").filter(|r| *r >= 0.0),
+        // A reserve of zero or less sizes the caption to its content, as none does (XFA 3.3,
+        // the caption's reserve).
+        reserve: attr_measure(n, "reserve").filter(|r| *r > 0.0),
         presence: Presence::parse(n.attribute("presence")),
         value: parse_value(child(n, "value"), warnings),
         font: parse_font(child(n, "font")),
diff --git a/crates/xfa/src/pdf.rs b/crates/xfa/src/pdf.rs
index 8e930c8f46..ab5d94bb45 100644
--- a/crates/xfa/src/pdf.rs
+++ b/crates/xfa/src/pdf.rs
@@ -2,7 +2,7 @@
 //! streams (standard-14 fonts, WinAnsi), image XObjects and AcroForm widgets. Widget appearance
 //! streams are left empty here; the forms layer regenerates them from the field dictionaries.
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, HashMap, HashSet};
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 use pdfcraft_fonts::{literal, win_ansi};
@@ -12,6 +12,16 @@ use crate::layout::{Action, BorderShape, Form, Item, Page, Rounded, Widget, Widg
 use crate::model::Rect;
 use crate::text::{Face, Family, Span};
 
+mod common;
+mod strip;
+
+pub use common::jpeg_size;
+pub(crate) use common::rounded;
+use common::{all_faces, content_hash, empty_form, hex32, jpeg_info, js_action, n, parse_hex32, rgb, rgb_array, standard_font, state_name};
+pub(crate) use strip::USAGE_RIGHTS_REMOVED;
+use strip::drop_usage_rights;
+pub use strip::{Stripped, XfaShape, existing_layout, strip, xfa_shape};
+
 /// Private key on generated fields: the template's SOM path, so data can be put back.
 pub const SOM_KEY: &[u8] = b"PCSom";
 /// Private key on the AcroForm: what laying the form out produced, so a reopened file is not
@@ -21,209 +31,10 @@ pub const LAYOUT_KEY: &[u8] = b"PCXfaLayout";
 /// PDF action (the script is XFA's, not Acrobat JavaScript); PdfCraft runs the script by the
 /// field's SOM path.
 pub const CLICK_KEY: &[u8] = b"PCXfaClick";
-
-/// Width and height of a JPEG from its first frame header (SOF0–SOF15, not the DNL/JPG/DAC/DHT
-/// markers). `None` for anything else.
-pub fn jpeg_size(data: &[u8]) -> Option<(u32, u32)> {
-    jpeg_frame(data).map(|(w, h, _)| (w, h))
-}
-
-fn jpeg_frame(data: &[u8]) -> Option<(u32, u32, u8)> {
-    jpeg_info(data).map(|(w, h, c, _)| (w, h, c))
-}
-
-/// The SHA-256 of a picture's bytes, to find its XObject again.
-fn content_hash(data: &[u8]) -> [u8; 32] {
-    use sha2::Digest;
-    sha2::Sha256::digest(data).into()
-}
-
-fn hex32(h: &[u8; 32]) -> Vec<u8> {
-    h.iter().flat_map(|b| format!("{b:02x}").into_bytes()).collect()
-}
-
-fn parse_hex32(s: &[u8]) -> Option<[u8; 32]> {
-    let mut out = [0u8; 32];
-    if s.len() != 64 {
-        return None;
-    }
-    for (o, pair) in out.iter_mut().zip(s.as_chunks::<2>().0) {
-        *o = u8::from_str_radix(std::str::from_utf8(pair).ok()?, 16).ok()?;
-    }
-    Some(out)
-}
-
-/// Width, height, components and whether an Adobe APP14 segment is present (such CMYK JPEGs
-/// store inverted values).
-fn jpeg_info(data: &[u8]) -> Option<(u32, u32, u8, bool)> {
-    if data.get(0..2)? != [0xFF, 0xD8] {
-        return None;
-    }
-    let mut i = 2usize;
-    let mut guard = 0;
-    let mut adobe = false;
-    while i + 4 <= data.len() && guard < 10_000 {
-        guard += 1;
-        if *data.get(i)? != 0xFF {
-            i += 1;
-            continue;
-        }
-        let marker = *data.get(i + 1)?;
-        if marker == 0xFF {
-            i += 1;
-            continue;
-        }
-        if (0xD0..=0xD9).contains(&marker) || marker == 0x01 {
-            i += 2;
-            continue;
-        }
-        let len = u16::from_be_bytes([*data.get(i + 2)?, *data.get(i + 3)?]) as usize;
-        if marker == 0xEE && data.get(i + 4..i + 9) == Some(b"Adobe") {
-            adobe = true;
-        }
-        let sof = matches!(marker, 0xC0..=0xCF) && !matches!(marker, 0xC4 | 0xC8 | 0xCC);
-        if sof {
-            let h = u16::from_be_bytes([*data.get(i + 5)?, *data.get(i + 6)?]) as u32;
-            let w = u16::from_be_bytes([*data.get(i + 7)?, *data.get(i + 8)?]) as u32;
-            let comps = *data.get(i + 9)?;
-            return (w > 0 && h > 0).then_some((w, h, comps, adobe));
-        }
-        i = i.checked_add(2)?.checked_add(len.max(2))?;
-    }
-    None
-}
-
-/// Format a number for content streams.
-fn n(v: f64) -> String {
-    let v = if v.is_finite() { v } else { 0.0 };
-    let s = format!("{:.3}", if v.abs() < 5e-4 { 0.0 } else { v });
-    let s = s.trim_end_matches('0').trim_end_matches('.');
-    if s == "-0" { "0".into() } else { s.into() }
-}
-
-fn rgb(c: [f64; 3]) -> String {
-    format!("{} {} {}", n(c[0]), n(c[1]), n(c[2]))
-}
-
-fn rgb_array(c: [f64; 3]) -> Object {
-    Object::Array(c.iter().map(|v| Object::Real(v.clamp(0.0, 1.0))).collect())
-}
-
-fn standard_font(base: &str) -> Object {
-    let mut f = Dict::new();
-    f.set(b"Type".to_vec(), Object::name("Font"));
-    f.set(b"Subtype".to_vec(), Object::name("Type1"));
-    f.set(b"BaseFont".to_vec(), Object::name(base));
-    f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
-    Object::Dict(f)
-}
-
-/// Every face the content streams or `/DA` strings may name.
-fn all_faces() -> Vec<(&'static str, &'static str)> {
-    let mut out = Vec::new();
-    for fam in [Family::Helvetica, Family::Courier, Family::Times] {
-        for (b, i) in [(false, false), (true, false), (false, true), (true, true)] {
-            out.push((fam.resource_name(b, i), fam.base_font(b, i)));
-        }
-    }
-    out
-}
-
-/// The content that draws rounded box `r` on a page `page_h` tall: its fill along its curves,
-/// then its edge inside it. A side a page break cut has no edge.
-pub(crate) fn rounded(r: &Rounded, page_h: f64) -> String {
-    let mut c = String::new();
-    if let Some(color) = r.fill {
-        c.push_str(&format!("{} rg {}f\n", rgb(color), outline(r.rect, r.radii, r.inverted, (false, false), page_h)));
-    }
-    if let Some((w, color, dashed)) = r.edge {
-        // The edge's centre line, half its width inside the box, so the edge stays in: a corner
-        // curving around the box tightens by as much, and one curving into it widens.
-        let inset = Rect::new(r.rect.x + w / 2.0, r.rect.y + w / 2.0, (r.rect.w - w).max(0.0), (r.rect.h - w).max(0.0));
-        let most = inset.w.min(inset.h) / 2.0;
-        let radii: [f64; 4] = std::array::from_fn(|i| match (r.radii[i], r.inverted[i]) {
-            (v, _) if v <= 0.0 => 0.0,
-            (v, true) => (v + w / 2.0).min(most),
-            (v, false) => (v - w / 2.0).clamp(0.0, most),
-        });
-        let path = outline(inset, radii, r.inverted, (r.open_top, r.open_bottom), page_h);
-        c.push_str(&format!("q {} RG {} w {}{path}S Q\n", rgb(color), n(w), if dashed { "[2 2] 0 d " } else { "" }));
-    }
-    c
-}
-
-/// The path around `rect` (top-left based, on a page `page_h` tall) with the corners `radii`
-/// (top-left, top-right, bottom-right, bottom-left), each curving around the box or, when
-/// `inverted`, into it. `open` leaves out the top or bottom side (and doesn't close the path):
-/// those are where a page break cut the box. Ends with a space, for the paint operator.
-fn outline(rect: Rect, radii: [f64; 4], inverted: [bool; 4], open: (bool, bool), page_h: f64) -> String {
-    let (x0, y0, x1, y1) = (rect.x, rect.y, rect.right(), rect.bottom());
-    let pt = |q: (f64, f64)| format!("{} {}", n(q.0), n(page_h - q.1));
-    // Corner `i`: its point, then where its curve starts and ends, going clockwise.
-    let corner = |i: usize| {
-        let r = radii.get(i).copied().unwrap_or(0.0);
-        match i {
-            0 => ((x0, y0), (x0, y0 + r), (x0 + r, y0)),
-            1 => ((x1, y0), (x1 - r, y0), (x1, y0 + r)),
-            2 => ((x1, y1), (x1, y1 - r), (x1 - r, y1)),
-            _ => ((x0, y1), (x0 + r, y1), (x0, y1 - r)),
-        }
-    };
-    // Corner `i`'s curve, from its start: a quarter circle as one Bézier curve.
-    let curve = |i: usize| {
-        if radii.get(i).copied().unwrap_or(0.0) <= 0.0 {
-            return String::new();
-        }
-        let (p, a, b) = corner(i);
-        const K: f64 = 0.5523;
-        let (c1, c2) = if inverted.get(i).copied().unwrap_or(false) {
-            // Centred on the corner itself.
-            ((a.0 + (b.0 - p.0) * K, a.1 + (b.1 - p.1) * K), (b.0 + (a.0 - p.0) * K, b.1 + (a.1 - p.1) * K))
-        } else {
-            ((a.0 + (p.0 - a.0) * K, a.1 + (p.1 - a.1) * K), (b.0 + (p.0 - b.0) * K, b.1 + (p.1 - b.1) * K))
-        };
-        format!("{} {} {} c ", pt(c1), pt(c2), pt(b))
-    };
-    // Along corners `from`, joining them with straight sides.
-    let along = |from: &[usize]| {
-        let mut s = String::new();
-        for &i in from {
-            s.push_str(&format!("{} l {}", pt(corner(i).1), curve(i)));
-        }
-        s
-    };
-    match open {
-        (false, false) => format!("{} m {}{}{}{}h ", pt(corner(0).1), curve(0), along(&[1]), along(&[2]), along(&[3])),
-        (true, false) => format!("{} m {}{} l ", pt((x1, y0)), along(&[2, 3]), pt((x0, y0))),
-        (false, true) => format!("{} m {}{} l ", pt((x0, y1)), along(&[0, 1]), pt((x1, y1))),
-        (true, true) => format!("{} m {} l {} m {} l ", pt((x0, y0)), pt((x0, y1)), pt((x1, y0)), pt((x1, y1))),
-    }
-}
-
-/// A PDF appearance-state name for a check button's on value.
-fn state_name(on: &str) -> String {
-    let s: String = on.trim().chars().map(|c| if c.is_whitespace() || "()<>[]{}/%#".contains(c) || c.is_control() { '_' } else { c }).collect();
-    if s.is_empty() || s == "Off" { "Yes".into() } else { s }
-}
-
-fn empty_form(doc: &mut Document, w: f64, h: f64) -> Object {
-    let mut d = Dict::new();
-    d.set(b"Type".to_vec(), Object::name("XObject"));
-    d.set(b"Subtype".to_vec(), Object::name("Form"));
-    d.set(b"BBox".to_vec(), Object::Array([0.0, 0.0, w, h].iter().map(|v| Object::Real(*v)).collect()));
-    Object::Ref(doc.add(Object::Stream(Stream::from_raw(d, Vec::new()))))
-}
-
-fn js_action(js: &str) -> Object {
-    let mut a = Dict::new();
-    a.set(b"S".to_vec(), Object::name("JavaScript"));
-    a.set(b"JS".to_vec(), Object::String(PdfString::literal(js.as_bytes().to_vec())));
-    Object::Dict(a)
-}
-
-/// What laying a form out says when it took the usage rights off (see [`drop_usage_rights`]).
-pub(crate) const USAGE_RIGHTS_REMOVED: &str =
-    "the form's usage rights were removed: laying it out voids them, and a form with void usage rights can open with every field locked";
+/// Private key on the fields generated to name a signature field by its SOM path, one for each
+/// step of the path above it (`form1[0]`, then `page1[0]`): a new layout replaces them with the
+/// fields they hold.
+pub const NODE_KEY: &[u8] = b"PCXfaNode";
 
 pub struct Written {
     pub pages: usize,
@@ -264,6 +75,11 @@ struct Emitter<'a> {
     warnings: Vec<String>,
     /// The signatures the file holds, by the SOM path of the field signed.
     signed: HashMap<String, Signed>,
+    /// The full names of the fields the file came with, which a generated name must not repeat.
+    taken: HashSet<String>,
+    /// The fields above the signature fields named by their SOM paths, by the path they name:
+    /// each one's object and the fields it holds.
+    nodes: HashMap<String, (ObjRef, Vec<ObjRef>)>,
 }
 
 /// A signature field of the file that has been signed.
@@ -279,13 +95,16 @@ const MAX_FIELDS_SEARCHED: usize = 20_000;
 /// Deepest field nesting followed.
 const MAX_FIELD_DEPTH: usize = 32;
 
-/// The signed signature fields the document came with, by full name. Signing applications name
-/// a dynamic form's fields by their SOM path (`form1[0].page1[0].sign[0]`), which is how a
-/// laid-out signature box finds its signature. Fields of an earlier layout pass are not read.
-fn signed_fields(doc: &Document, catalog: &Dict) -> HashMap<String, Signed> {
+/// The fields the document came with: the full name of each, and the signed signature fields by
+/// SOM path. Signing applications name a dynamic form's fields by their SOM path
+/// (`form1[0].page1[0].sign[0]`), which is how a laid-out signature box finds its signature. A
+/// field an earlier layout pass generated gives no name, but a signature on it is kept, by its
+/// `/PCSom`, so a new layout keeps the box signed.
+fn existing_fields(doc: &Document, catalog: &Dict) -> (HashMap<String, Signed>, HashSet<String>) {
     let mut out = HashMap::new();
-    let Some(acro) = catalog.get(b"AcroForm").map(|a| doc.resolve(a)) else { return out };
-    let Some(fields) = acro.as_dict().and_then(|a| a.get(b"Fields")).map(|f| doc.resolve(f)) else { return out };
+    let mut names = HashSet::new();
+    let Some(acro) = catalog.get(b"AcroForm").map(|a| doc.resolve(a)) else { return (out, names) };
+    let Some(fields) = acro.as_dict().and_then(|a| a.get(b"Fields")).map(|f| doc.resolve(f)) else { return (out, names) };
     let mut stack: Vec<(Object, String, bool, usize)> =
         fields.as_array().into_iter().flatten().map(|f| (f.clone(), String::new(), false, 0)).collect();
     let mut seen = 0usize;
@@ -296,7 +115,22 @@ fn signed_fields(doc: &Document, catalog: &Dict) -> HashMap<String, Signed> {
         }
         let field = doc.resolve(&field);
         let Some(d) = field.as_dict() else { continue };
+        if d.contains(NODE_KEY) {
+            // Generated to name a signature field: only what it holds is looked at.
+            if depth < MAX_FIELD_DEPTH {
+                let kids = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+                stack.extend(kids.into_iter().map(|k| (k, String::new(), false, depth + 1)));
+            }
+            continue;
+        }
         if d.contains(SOM_KEY) {
+            let som = d.get(SOM_KEY).map(|s| doc.resolve(s)).and_then(|s| s.as_string().map(|s| s.to_text()));
+            if d.name(b"FT") == Some(b"Sig")
+                && let Some(som) = som
+                && let Some(value) = d.get(b"V").filter(|v| doc.resolve(v).as_dict().is_some())
+            {
+                out.entry(som).or_insert(Signed { value: value.clone(), appearance: d.get(b"AP").cloned() });
+            }
             continue;
         }
         let name = match d.get(b"T").map(|t| doc.resolve(t)).and_then(|t| t.as_string().map(|t| t.to_text())) {
@@ -304,6 +138,9 @@ fn signed_fields(doc: &Document, catalog: &Dict) -> HashMap<String, Signed> {
             Some(t) => format!("{prefix}.{t}"),
             None => prefix,
         };
+        if !name.is_empty() {
+            names.insert(name.clone());
+        }
         let is_sig = match d.name(b"FT") {
             Some(ft) => ft == b"Sig",
             None => parent_is_sig,
@@ -318,7 +155,7 @@ fn signed_fields(doc: &Document, catalog: &Dict) -> HashMap<String, Signed> {
             stack.extend(kids.into_iter().map(|k| (k, name.clone(), is_sig, depth + 1)));
         }
     }
-    out
+    (out, names)
 }
 
 impl Emitter<'_> {
@@ -363,6 +200,9 @@ impl Emitter<'_> {
             ff |= 1;
         }
         let mut top_level = true;
+        // The SOM path of the generated field above this one, for a signature field named by its
+        // SOM path.
+        let mut under: Option<String> = None;
         match &w.kind {
             WidgetKind::Text | WidgetKind::Date(_) | WidgetKind::Password => {
                 d.set(b"FT".to_vec(), Object::name("Tx"));
@@ -464,6 +304,16 @@ impl Emitter<'_> {
                     }
                     ff |= 1;
                 }
+                if let Some((above, last)) = self.som_steps(&w.som)
+                    && let Some(parent) = self.node(&above)
+                {
+                    // Named by its SOM path, as fields under one for each step above it: other
+                    // viewers lay a dynamic form out again and find a signature by that name.
+                    d.set(b"T".to_vec(), Object::String(PdfString::text(&last)));
+                    d.set(b"Parent".to_vec(), Object::Ref(parent));
+                    top_level = false;
+                    under = Some(above.join("."));
+                }
             }
             WidgetKind::Image => {
                 // A push button with nothing drawn: the forms layer treats one so marked as an
@@ -574,6 +424,12 @@ impl Emitter<'_> {
         if top_level {
             self.fields.push(r);
             self.field_count += 1;
+        } else if let Some(path) = under {
+            if let Some((_, kids)) = self.nodes.get_mut(&path) {
+                kids.push(r);
+            }
+            self.taken.insert(w.som.clone());
+            self.field_count += 1;
         } else if let WidgetKind::Radio { group, .. } = &w.kind
             && let Some((_, kids)) = self.radio_groups.get_mut(group)
         {
@@ -582,6 +438,60 @@ impl Emitter<'_> {
         Ok(Some(r))
     }
 
+    /// The steps of SOM path `som` above the last, and the last, when a field can be named by the
+    /// path: two to [`MAX_FIELD_DEPTH`] steps, none empty, and no field of the file or of this
+    /// pass already named by the path or by a part of it. `None` keeps the field's own name.
+    fn som_steps(&self, som: &str) -> Option<(Vec<String>, String)> {
+        let steps: Vec<&str> = som.split('.').collect();
+        if steps.len() < 2 || steps.len() > MAX_FIELD_DEPTH || steps.iter().any(|s| s.is_empty()) {
+            return None;
+        }
+        for i in 1..=steps.len() {
+            let path = steps.get(..i)?.join(".");
+            // A part already generated by this pass is shared; one the file has is not touched.
+            let generated = i < steps.len() && self.nodes.contains_key(&path);
+            if !generated && self.taken.contains(&path) {
+                return None;
+            }
+        }
+        let (last, above) = steps.split_last()?;
+        Some((above.iter().map(|s| s.to_string()).collect(), last.to_string()))
+    }
+
+    /// The generated field named by the SOM path of `steps`, made (with those above it) when this
+    /// pass has none yet; the topmost goes into the AcroForm's fields. `None` for no steps.
+    fn node(&mut self, steps: &[String]) -> Option<ObjRef> {
+        let mut parent: Option<(ObjRef, String)> = None;
+        for step in steps {
+            let path = match &parent {
+                Some((_, above)) => format!("{above}.{step}"),
+                None => step.clone(),
+            };
+            let r = match self.nodes.get(&path) {
+                Some((r, _)) => *r,
+                None => {
+                    let mut d = Dict::new();
+                    d.set(b"T".to_vec(), Object::String(PdfString::text(step)));
+                    d.set(b"Kids".to_vec(), Object::Array(Vec::new()));
+                    d.set(NODE_KEY.to_vec(), Object::Bool(true));
+                    if let Some((p, _)) = &parent {
+                        d.set(b"Parent".to_vec(), Object::Ref(*p));
+                    }
+                    let r = self.doc.add(Object::Dict(d));
+                    match parent.as_ref().and_then(|(_, above)| self.nodes.get_mut(above)) {
+                        Some((_, kids)) => kids.push(r),
+                        None => self.fields.push(r),
+                    }
+                    self.nodes.insert(path.clone(), (r, Vec::new()));
+                    self.taken.insert(path.clone());
+                    r
+                }
+            };
+            parent = Some((r, path));
+        }
+        parent.map(|(r, _)| r)
+    }
+
     /// An image XObject for a picture: JPEGs as they are (`DCTDecode`), PNGs, GIFs, BMPs and TIFFs
     /// decoded to samples (`FlateDecode`, with a soft mask for transparency). `None`, with a warning,
     /// for anything else.
@@ -908,6 +818,9 @@ fn earlier_images(doc: &Document, pages: ObjRef) -> HashMap<[u8; 32], ObjRef> {
     out
 }
 
+/// Write laid-out `form` into `doc`: its pages replace the document's, its widgets join the
+/// AcroForm's fields (a box the file holds a signature for keeps it), and the AcroForm is marked
+/// laid out. What was written, with any warnings, comes back.
 pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError> {
     let catalog_ref = doc.root().ok_or_else(|| XfaError::Malformed("the document has no catalog".into()))?;
     let mut catalog = doc.get(catalog_ref).as_dict().cloned().ok_or_else(|| XfaError::Malformed("the catalog is not a dictionary".into()))?;
@@ -925,7 +838,7 @@ pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError>
     };
     // Pictures embedded by earlier passes, from the pages this pass replaces.
     let images = earlier_images(doc, pages_ref);
-    let signed = signed_fields(doc, &catalog);
+    let (signed, taken) = existing_fields(doc, &catalog);
     let mut em = Emitter {
         doc,
         images,
@@ -935,7 +848,17 @@ pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError>
         field_count: 0,
         warnings: Vec::new(),
         signed,
+        taken,
+        nodes: HashMap::new(),
     };
+    // Every name a field of this pass takes at the top, wherever and in whatever order it is
+    // written: a signature field named by its SOM path must not repeat one.
+    for w in form.pages.iter().flat_map(|p| &p.items).filter_map(|i| if let Item::Widget(w) = i { Some(w) } else { None }) {
+        em.taken.insert(match &w.kind {
+            WidgetKind::Radio { group, .. } => group.clone(),
+            _ => w.name.clone(),
+        });
+    }
     let mut kids = Vec::new();
     for page in &form.pages {
         kids.push(Object::Ref(em.page(page, pages_ref)?));
@@ -950,6 +873,10 @@ pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError>
             }
         })?;
     }
+    let nodes: Vec<(ObjRef, Vec<ObjRef>)> = em.nodes.values().cloned().collect();
+    for (node, kids) in nodes {
+        em.doc.update_dict(node, |d| d.set(b"Kids".to_vec(), Object::Array(kids.iter().map(|r| Object::Ref(*r)).collect())))?;
+    }
     let Emitter { doc, fields, field_count, warnings, .. } = em;
     let count = kids.len();
     doc.update_dict(pages_ref, |d| {
@@ -1013,283 +940,24 @@ pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError>
     Ok(Written { pages: count, fields: field_count, warnings, usage_rights })
 }
 
-/// What [`strip`] took out, for the user to be told (the packets held more than the fields).
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct Stripped {
-    /// The packets removed, by name (`template`, `datasets`, `config`, `signature`, …).
-    pub packets: Vec<String>,
-    /// Data values in the datasets no field held (what the form's data had that its fields
-    /// didn't show); `None` when the template could not be read to tell.
-    pub unbound_data: Option<usize>,
-    /// Buttons whose click ran an XFA script, and image fields: they do nothing from now on.
-    pub script_buttons: usize,
-    pub image_fields: usize,
-    /// What the layout left out (pictures, rows past the cap), now for good.
-    pub layout_warnings: Vec<String>,
-    /// Reader usage rights (`/Perms /UR3`) were removed: changing the form voids them anyway.
-    pub usage_rights: bool,
-    /// Private keys removed from field dictionaries (`/PCSom`, `/PCXfaClick`, …).
-    pub field_keys: usize,
-}
-
-impl Stripped {
-    /// What was dropped, as lines for the user (empty when nothing worth saying).
-    pub fn notes(&self) -> Vec<String> {
-        let mut out = Vec::new();
-        if !self.packets.is_empty() {
-            out.push(format!("The XFA was taken out of the form: its {} packet(s) are gone from the saved file", self.packets.join(", ")));
-        }
-        match self.unbound_data {
-            Some(n) if n > 0 => out.push(format!("{n} value(s) the form's XFA data held that no field showed are gone with it")),
-            None => out.push("The template could not be read, so data the fields didn't show may be gone with the XFA".into()),
-            _ => {}
-        }
-        if self.script_buttons + self.image_fields > 0 {
-            out.push(format!("{} button(s) that ran XFA scripts and {} image field(s) do nothing now", self.script_buttons, self.image_fields));
-        }
-        for w in &self.layout_warnings {
-            out.push(format!("Kept as laid out: {w}"));
-        }
-        if self.usage_rights {
-            out.push("Adobe Reader extended features were removed (changing the form voids them)".into());
-        }
-        out
-    }
-}
-
-/// What a document's XFA entry says, from its dictionaries alone (no packet decoded).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct XfaShape {
-    /// `/NeedsRendering true`: the form expects to be laid out from the template.
-    pub needs_rendering: bool,
-    /// The AcroForm has fields of its own.
-    pub has_fields: bool,
-    /// PdfCraft laid the form out (the layout mark is there).
-    pub laid_out: bool,
-}
-
-impl XfaShape {
-    /// Whether taking the XFA out leaves a form every viewer shows: the pages PdfCraft laid out
-    /// (with their fields), or a static form's own pages and fields. A dynamic form that was
-    /// never laid out has only placeholder pages: stripping it would leave nothing.
-    pub fn strippable(self) -> bool {
-        self.laid_out || (!self.needs_rendering && self.has_fields)
-    }
-}
-
-/// The document's XFA entry, if any, without decoding a packet.
-pub fn xfa_shape(doc: &Document) -> Option<XfaShape> {
-    let root = doc.root()?;
-    let catalog = doc.get(root);
-    let catalog = catalog.as_dict()?;
-    let acro = doc.resolve(catalog.get(b"AcroForm")?);
-    let acro = acro.as_dict()?;
-    acro.get(b"XFA")?;
-    let bool_of = |v: Option<&Object>| matches!(v.map(|v| doc.resolve(v)).as_deref(), Some(Object::Bool(true)));
-    let needs_rendering = bool_of(catalog.get(b"NeedsRendering")) || bool_of(acro.get(b"NeedsRendering"));
-    let has_fields = acro.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().map(|a| !a.is_empty())).unwrap_or(false);
-    Some(XfaShape { needs_rendering, has_fields, laid_out: acro.contains(LAYOUT_KEY) })
-}
-
-/// Most field dictionaries walked for their private keys.
-const MAX_STRIP_FIELDS: usize = 1_000_000;
-
-/// Take the XFA out of a document, leaving what every viewer shows: the pages as laid out
-/// and, when the fields were kept, an ordinary AcroForm. The packets (template, data and
-/// all), `/NeedsRendering`, the layout mark, the overrides and Reader usage rights go, and
-/// the fields lose the private keys PdfCraft gave them. A flattened form (no fields left)
-/// becomes a plain PDF; one with its fields becomes a static form that Adobe's viewers no
-/// longer lay out again. What the packets held beyond the fields is counted in the report,
-/// so the user can be told; the caller decides whether the form is one to strip
-/// ([`XfaShape::strippable`]). A document without XFA is left as it is.
-pub fn strip(doc: &mut Document) -> Result<Stripped, XfaError> {
-    let mut out = Stripped::default();
-    let Some(root) = doc.root() else { return Ok(out) };
-    let Some(mut catalog) = doc.get(root).as_dict().cloned() else { return Ok(out) };
-    let acro_obj = catalog.get(b"AcroForm").cloned();
-    let Some(acro_obj) = acro_obj else { return Ok(out) };
-    let Some(mut acro) = doc.resolve(&acro_obj).as_dict().cloned() else { return Ok(out) };
-    let Some(xfa) = acro.get(b"XFA").cloned() else { return Ok(out) };
-    // What is about to go, while it can still be read.
-    out.unbound_data = unbound_data(doc);
-    out.layout_warnings = existing_layout(doc).map(|r| r.warnings).unwrap_or_default();
-    let mut streams: Vec<ObjRef> = Vec::new();
-    match &*doc.resolve(&xfa) {
-        Object::Array(items) => {
-            let mut i = 0;
-            while i < items.len() {
-                let name = items.get(i).and_then(|n| n.as_string()).map(|s| s.to_text());
-                let stream = if name.is_some() { items.get(i + 1) } else { items.get(i) };
-                if let Some(n) = &name {
-                    out.packets.push(n.clone());
-                }
-                if let Some(r) = stream.and_then(Object::as_ref) {
-                    streams.push(r);
-                }
-                i += if name.is_some() { 2 } else { 1 };
-            }
-        }
-        Object::Stream(s) => {
-            if let Some(r) = xfa.as_ref() {
-                streams.push(r);
-            }
-            // One XDP: the packets it holds are the envelope's children.
-            let text = s.decoded_within(64 << 20).ok().and_then(|b| crate::packets::decode(&b)).map(|(t, _)| t).unwrap_or_default();
-            let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: 1_000_000 };
-            if crate::xml_nesting_depth(&text) <= crate::MAX_XML_DEPTH
-                && let Ok(parsed) = roxmltree::Document::parse_with_options(&text, opts)
-            {
-                let root = parsed.root_element();
-                if root.tag_name().name() == "xdp" {
-                    out.packets.extend(root.children().filter(|c| c.is_element()).map(|c| c.tag_name().name().to_string()).take(32));
-                } else {
-                    out.packets.push(root.tag_name().name().to_string());
-                }
-            }
-            if out.packets.is_empty() {
-                out.packets.push("xdp".into());
-            }
-        }
-        _ => {}
-    }
-    acro.remove(b"XFA");
-    for key in [b"NeedsRendering".as_slice(), LAYOUT_KEY, crate::script::OVERRIDES_KEY] {
-        acro.remove(key);
-    }
-    // The private keys on every field and widget, down the tree (each dictionary once).
-    let fields = acro.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned()).unwrap_or_default();
-    let mut seen = std::collections::HashSet::new();
-    let mut todo: Vec<ObjRef> = Vec::new();
-    for r in fields.iter().filter_map(Object::as_ref) {
-        if seen.insert(r) && seen.len() <= MAX_STRIP_FIELDS {
-            todo.push(r);
-        }
-    }
-    while let Some(r) = todo.pop() {
-        let Some(d) = doc.get(r).as_dict().cloned() else { continue };
-        if d.contains(CLICK_KEY) {
-            out.script_buttons += 1;
-        }
-        if d.contains(IMAGE_FIELD_KEY) {
-            out.image_fields += 1;
-        }
-        let private: Vec<Vec<u8>> =
-            [SOM_KEY, CLICK_KEY, IMAGE_FIELD_KEY, b"PCItems".as_slice()].iter().filter(|k| d.contains(k)).map(|k| k.to_vec()).collect();
-        if !private.is_empty() {
-            out.field_keys += private.len();
-            doc.update_dict(r, |d| {
-                for k in &private {
-                    d.remove(k);
-                }
-            })?;
-        }
-        if let Some(kids) = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()) {
-            for k in kids.iter().filter_map(Object::as_ref) {
-                if seen.insert(k) && seen.len() <= MAX_STRIP_FIELDS {
-                    todo.push(k);
-                }
-            }
-        }
-    }
-    match acro_obj.as_ref() {
-        Some(r) => doc.set(r, Object::Dict(acro)),
-        None => catalog.set(b"AcroForm".to_vec(), Object::Dict(acro)),
-    }
-    catalog.remove(b"NeedsRendering");
-    out.usage_rights = drop_usage_rights(doc, &mut catalog);
-    doc.set(root, Object::Dict(catalog));
-    // The packet streams are referenced from nowhere else: freed, so an incremental save
-    // doesn't carry an unreachable copy of the data.
-    for r in streams {
-        doc.free(r);
-    }
-    Ok(out)
-}
-
-/// Values in the datasets that no field of the laid-out form holds (leaf text nodes whose
-/// data path no field binds to). `None` when the template can't be read.
-fn unbound_data(doc: &Document) -> Option<usize> {
-    let data = crate::script::data_of(doc)?;
-    let tpl = crate::script::template_of(doc).ok()?;
-    let bound: std::collections::HashSet<crate::data::DataPath> =
-        crate::script::fields_by_som(doc).keys().map(|som| crate::data::data_path(&tpl, som)).collect();
-    fn walk(
-        n: &crate::data::DataNode,
-        path: &mut crate::data::DataPath,
-        bound: &std::collections::HashSet<crate::data::DataPath>,
-        count: &mut usize,
-        depth: usize,
-    ) {
-        if depth > 64 {
-            return;
-        }
-        let mut seen: std::collections::HashMap<&str, usize> = std::collections::HashMap::new();
-        for c in &n.children {
-            let idx = seen.entry(c.name.as_str()).or_insert(0);
-            path.push((c.name.clone(), *idx));
-            *idx += 1;
-            if c.children.is_empty() {
-                if !c.text.trim().is_empty() && !bound.contains(path) {
-                    *count += 1;
-                }
-            } else {
-                walk(c, path, bound, count, depth + 1);
-            }
-            path.pop();
-        }
-    }
-    let mut count = 0;
-    walk(&data, &mut Vec::new(), &bound, &mut count, 0);
-    Some(count)
-}
-
-/// Take the usage rights (`/Perms /UR3`, or the older `/UR`) off a catalog, keeping the rest of
-/// `/Perms` (a certification's `/DocMDP`). They are signed over the form as it was: once its
-/// pages or fields change they are void, and a viewer may lock every field of a form whose
-/// usage rights are void, so they go, and the caller says so. Whether there were any.
-fn drop_usage_rights(doc: &mut Document, catalog: &mut Dict) -> bool {
-    let Some(entry) = catalog.get(b"Perms").cloned() else { return false };
-    let Some(mut perms) = doc.resolve(&entry).as_dict().cloned() else { return false };
-    if !perms.contains(b"UR3") && !perms.contains(b"UR") {
-        return false;
-    }
-    perms.remove(b"UR3");
-    perms.remove(b"UR");
-    match entry.as_ref() {
-        _ if perms.is_empty() => {
-            catalog.remove(b"Perms");
-        }
-        Some(r) => doc.set(r, Object::Dict(perms)),
-        None => catalog.set(b"Perms".to_vec(), Object::Dict(perms)),
-    }
-    true
-}
-
-/// The layout a document already carries from an earlier pass, if any.
-pub fn existing_layout(doc: &Document) -> Option<crate::Report> {
-    let root = doc.root()?;
-    let catalog = doc.get(root);
-    let acro = doc.resolve(catalog.as_dict()?.get(b"AcroForm")?);
-    let mark = doc.resolve(acro.as_dict()?.get(LAYOUT_KEY)?);
-    let mark = mark.as_dict()?;
-    let warnings = mark
-        .get(b"Warnings")
-        .map(|w| doc.resolve(w))
-        .and_then(|w| w.as_array().cloned())
-        .unwrap_or_default()
-        .iter()
-        .filter_map(|w| w.as_string().map(|s| s.to_text()))
-        .take(100)
-        .collect();
-    Some(crate::Report {
-        pages: mark.int(b"Pages").unwrap_or(0).clamp(0, 100_000) as usize,
-        fields: mark.int(b"Fields").unwrap_or(0).clamp(0, 1_000_000) as usize,
-        template_bytes: 0,
-        warnings,
-    })
-}
-
 /// The rectangle of a widget in PDF user space (for tests).
 pub fn pdf_rect(r: Rect, page_height: f64) -> [f64; 4] {
     [r.x, page_height - r.bottom(), r.right(), page_height - r.y]
 }
+
+#[cfg(test)]
+mod tests {
+    use super::parse_hex32;
+
+    #[test]
+    fn parse_hex32_rejects_non_hex_digits() {
+        for prefix in ["+f", "-f", " f"] {
+            let mut s = prefix.as_bytes().to_vec();
+            s.resize(64, b'0');
+            assert!(parse_hex32(&s).is_none(), "{prefix:?}");
+        }
+        let mut ok = b"Ff".to_vec();
+        ok.resize(64, b'0');
+        assert_eq!(parse_hex32(&ok).map(|h| h[0]), Some(0xff));
+    }
+}
diff --git a/crates/xfa/src/pdf/common.rs b/crates/xfa/src/pdf/common.rs
new file mode 100644
index 0000000000..e1325b19ae
--- /dev/null
+++ b/crates/xfa/src/pdf/common.rs
@@ -0,0 +1,200 @@
+use super::*;
+
+/// Width and height of a JPEG from its first frame header (SOF0–SOF15, not the DNL/JPG/DAC/DHT
+/// markers). `None` for anything else.
+pub fn jpeg_size(data: &[u8]) -> Option<(u32, u32)> {
+    jpeg_frame(data).map(|(w, h, _)| (w, h))
+}
+
+fn jpeg_frame(data: &[u8]) -> Option<(u32, u32, u8)> {
+    jpeg_info(data).map(|(w, h, c, _)| (w, h, c))
+}
+
+/// The SHA-256 of a picture's bytes, to find its XObject again.
+pub(super) fn content_hash(data: &[u8]) -> [u8; 32] {
+    use sha2::Digest;
+    sha2::Sha256::digest(data).into()
+}
+
+pub(super) fn hex32(h: &[u8; 32]) -> Vec<u8> {
+    h.iter().flat_map(|b| format!("{b:02x}").into_bytes()).collect()
+}
+
+pub(super) fn parse_hex32(s: &[u8]) -> Option<[u8; 32]> {
+    let mut out = [0u8; 32];
+    if s.len() != 64 || !s.iter().all(u8::is_ascii_hexdigit) {
+        return None;
+    }
+    for (o, pair) in out.iter_mut().zip(s.as_chunks::<2>().0) {
+        *o = u8::from_str_radix(std::str::from_utf8(pair).ok()?, 16).ok()?;
+    }
+    Some(out)
+}
+
+/// Width, height, components and whether an Adobe APP14 segment is present (such CMYK JPEGs
+/// store inverted values).
+pub(super) fn jpeg_info(data: &[u8]) -> Option<(u32, u32, u8, bool)> {
+    if data.get(0..2)? != [0xFF, 0xD8] {
+        return None;
+    }
+    let mut i = 2usize;
+    let mut guard = 0;
+    let mut adobe = false;
+    while i + 4 <= data.len() && guard < 10_000 {
+        guard += 1;
+        if *data.get(i)? != 0xFF {
+            i += 1;
+            continue;
+        }
+        let marker = *data.get(i + 1)?;
+        if marker == 0xFF {
+            i += 1;
+            continue;
+        }
+        if (0xD0..=0xD9).contains(&marker) || marker == 0x01 {
+            i += 2;
+            continue;
+        }
+        let len = u16::from_be_bytes([*data.get(i + 2)?, *data.get(i + 3)?]) as usize;
+        if marker == 0xEE && data.get(i + 4..i + 9) == Some(b"Adobe") {
+            adobe = true;
+        }
+        let sof = matches!(marker, 0xC0..=0xCF) && !matches!(marker, 0xC4 | 0xC8 | 0xCC);
+        if sof {
+            let h = u16::from_be_bytes([*data.get(i + 5)?, *data.get(i + 6)?]) as u32;
+            let w = u16::from_be_bytes([*data.get(i + 7)?, *data.get(i + 8)?]) as u32;
+            let comps = *data.get(i + 9)?;
+            return (w > 0 && h > 0).then_some((w, h, comps, adobe));
+        }
+        i = i.checked_add(2)?.checked_add(len.max(2))?;
+    }
+    None
+}
+
+/// Format a number for content streams.
+pub(super) fn n(v: f64) -> String {
+    let v = if v.is_finite() { v } else { 0.0 };
+    let s = format!("{:.3}", if v.abs() < 5e-4 { 0.0 } else { v });
+    let s = s.trim_end_matches('0').trim_end_matches('.');
+    if s == "-0" { "0".into() } else { s.into() }
+}
+
+pub(super) fn rgb(c: [f64; 3]) -> String {
+    format!("{} {} {}", n(c[0]), n(c[1]), n(c[2]))
+}
+
+pub(super) fn rgb_array(c: [f64; 3]) -> Object {
+    Object::Array(c.iter().map(|v| Object::Real(v.clamp(0.0, 1.0))).collect())
+}
+
+pub(super) fn standard_font(base: &str) -> Object {
+    let mut f = Dict::new();
+    f.set(b"Type".to_vec(), Object::name("Font"));
+    f.set(b"Subtype".to_vec(), Object::name("Type1"));
+    f.set(b"BaseFont".to_vec(), Object::name(base));
+    f.set(b"Encoding".to_vec(), Object::name("WinAnsiEncoding"));
+    Object::Dict(f)
+}
+
+/// Every face the content streams or `/DA` strings may name.
+pub(super) fn all_faces() -> Vec<(&'static str, &'static str)> {
+    let mut out = Vec::new();
+    for fam in [Family::Helvetica, Family::Courier, Family::Times] {
+        for (b, i) in [(false, false), (true, false), (false, true), (true, true)] {
+            out.push((fam.resource_name(b, i), fam.base_font(b, i)));
+        }
+    }
+    out
+}
+
+/// The content that draws rounded box `r` on a page `page_h` tall: its fill along its curves,
+/// then its edge inside it. A side a page break cut has no edge.
+pub(crate) fn rounded(r: &Rounded, page_h: f64) -> String {
+    let mut c = String::new();
+    if let Some(color) = r.fill {
+        c.push_str(&format!("{} rg {}f\n", rgb(color), outline(r.rect, r.radii, r.inverted, (false, false), page_h)));
+    }
+    if let Some((w, color, dashed)) = r.edge {
+        // The edge's centre line, half its width inside the box, so the edge stays in: a corner
+        // curving around the box tightens by as much, and one curving into it widens.
+        let inset = Rect::new(r.rect.x + w / 2.0, r.rect.y + w / 2.0, (r.rect.w - w).max(0.0), (r.rect.h - w).max(0.0));
+        let most = inset.w.min(inset.h) / 2.0;
+        let radii: [f64; 4] = std::array::from_fn(|i| match (r.radii[i], r.inverted[i]) {
+            (v, _) if v <= 0.0 => 0.0,
+            (v, true) => (v + w / 2.0).min(most),
+            (v, false) => (v - w / 2.0).clamp(0.0, most),
+        });
+        let path = outline(inset, radii, r.inverted, (r.open_top, r.open_bottom), page_h);
+        c.push_str(&format!("q {} RG {} w {}{path}S Q\n", rgb(color), n(w), if dashed { "[2 2] 0 d " } else { "" }));
+    }
+    c
+}
+
+/// The path around `rect` (top-left based, on a page `page_h` tall) with the corners `radii`
+/// (top-left, top-right, bottom-right, bottom-left), each curving around the box or, when
+/// `inverted`, into it. `open` leaves out the top or bottom side (and doesn't close the path):
+/// those are where a page break cut the box. Ends with a space, for the paint operator.
+fn outline(rect: Rect, radii: [f64; 4], inverted: [bool; 4], open: (bool, bool), page_h: f64) -> String {
+    let (x0, y0, x1, y1) = (rect.x, rect.y, rect.right(), rect.bottom());
+    let pt = |q: (f64, f64)| format!("{} {}", n(q.0), n(page_h - q.1));
+    // Corner `i`: its point, then where its curve starts and ends, going clockwise.
+    let corner = |i: usize| {
+        let r = radii.get(i).copied().unwrap_or(0.0);
+        match i {
+            0 => ((x0, y0), (x0, y0 + r), (x0 + r, y0)),
+            1 => ((x1, y0), (x1 - r, y0), (x1, y0 + r)),
+            2 => ((x1, y1), (x1, y1 - r), (x1 - r, y1)),
+            _ => ((x0, y1), (x0 + r, y1), (x0, y1 - r)),
+        }
+    };
+    // Corner `i`'s curve, from its start: a quarter circle as one Bézier curve.
+    let curve = |i: usize| {
+        if radii.get(i).copied().unwrap_or(0.0) <= 0.0 {
+            return String::new();
+        }
+        let (p, a, b) = corner(i);
+        const K: f64 = 0.5523;
+        let (c1, c2) = if inverted.get(i).copied().unwrap_or(false) {
+            // Centred on the corner itself.
+            ((a.0 + (b.0 - p.0) * K, a.1 + (b.1 - p.1) * K), (b.0 + (a.0 - p.0) * K, b.1 + (a.1 - p.1) * K))
+        } else {
+            ((a.0 + (p.0 - a.0) * K, a.1 + (p.1 - a.1) * K), (b.0 + (p.0 - b.0) * K, b.1 + (p.1 - b.1) * K))
+        };
+        format!("{} {} {} c ", pt(c1), pt(c2), pt(b))
+    };
+    // Along corners `from`, joining them with straight sides.
+    let along = |from: &[usize]| {
+        let mut s = String::new();
+        for &i in from {
+            s.push_str(&format!("{} l {}", pt(corner(i).1), curve(i)));
+        }
+        s
+    };
+    match open {
+        (false, false) => format!("{} m {}{}{}{}h ", pt(corner(0).1), curve(0), along(&[1]), along(&[2]), along(&[3])),
+        (true, false) => format!("{} m {}{} l ", pt((x1, y0)), along(&[2, 3]), pt((x0, y0))),
+        (false, true) => format!("{} m {}{} l ", pt((x0, y1)), along(&[0, 1]), pt((x1, y1))),
+        (true, true) => format!("{} m {} l {} m {} l ", pt((x0, y0)), pt((x0, y1)), pt((x1, y0)), pt((x1, y1))),
+    }
+}
+
+/// A PDF appearance-state name for a check button's on value.
+pub(super) fn state_name(on: &str) -> String {
+    let s: String = on.trim().chars().map(|c| if c.is_whitespace() || "()<>[]{}/%#".contains(c) || c.is_control() { '_' } else { c }).collect();
+    if s.is_empty() || s == "Off" { "Yes".into() } else { s }
+}
+
+pub(super) fn empty_form(doc: &mut Document, w: f64, h: f64) -> Object {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Form"));
+    d.set(b"BBox".to_vec(), Object::Array([0.0, 0.0, w, h].iter().map(|v| Object::Real(*v)).collect()));
+    Object::Ref(doc.add(Object::Stream(Stream::from_raw(d, Vec::new()))))
+}
+
+pub(super) fn js_action(js: &str) -> Object {
+    let mut a = Dict::new();
+    a.set(b"S".to_vec(), Object::name("JavaScript"));
+    a.set(b"JS".to_vec(), Object::String(PdfString::literal(js.as_bytes().to_vec())));
+    Object::Dict(a)
+}
diff --git a/crates/xfa/src/pdf/strip.rs b/crates/xfa/src/pdf/strip.rs
new file mode 100644
index 0000000000..de395e37e9
--- /dev/null
+++ b/crates/xfa/src/pdf/strip.rs
@@ -0,0 +1,282 @@
+use super::*;
+
+/// What laying a form out says when it took the usage rights off (see [`drop_usage_rights`]).
+pub(crate) const USAGE_RIGHTS_REMOVED: &str =
+    "the form's usage rights were removed: laying it out voids them, and a form with void usage rights can open with every field locked";
+
+/// What [`strip`] took out, for the user to be told (the packets held more than the fields).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Stripped {
+    /// The packets removed, by name (`template`, `datasets`, `config`, `signature`, …).
+    pub packets: Vec<String>,
+    /// Data values in the datasets no field held (what the form's data had that its fields
+    /// didn't show); `None` when the template could not be read to tell.
+    pub unbound_data: Option<usize>,
+    /// Buttons whose click ran an XFA script, and image fields: they do nothing from now on.
+    pub script_buttons: usize,
+    pub image_fields: usize,
+    /// What the layout left out (pictures, rows past the cap), now for good.
+    pub layout_warnings: Vec<String>,
+    /// Reader usage rights (`/Perms /UR3`) were removed: changing the form voids them anyway.
+    pub usage_rights: bool,
+    /// Private keys removed from field dictionaries (`/PCSom`, `/PCXfaClick`, …).
+    pub field_keys: usize,
+}
+
+impl Stripped {
+    /// What was dropped, as lines for the user (empty when nothing worth saying).
+    pub fn notes(&self) -> Vec<String> {
+        let mut out = Vec::new();
+        if !self.packets.is_empty() {
+            out.push(format!("The XFA was taken out of the form: its {} packet(s) are gone from the saved file", self.packets.join(", ")));
+        }
+        match self.unbound_data {
+            Some(n) if n > 0 => out.push(format!("{n} value(s) the form's XFA data held that no field showed are gone with it")),
+            None => out.push("The template could not be read, so data the fields didn't show may be gone with the XFA".into()),
+            _ => {}
+        }
+        if self.script_buttons + self.image_fields > 0 {
+            out.push(format!("{} button(s) that ran XFA scripts and {} image field(s) do nothing now", self.script_buttons, self.image_fields));
+        }
+        for w in &self.layout_warnings {
+            out.push(format!("Kept as laid out: {w}"));
+        }
+        if self.usage_rights {
+            out.push("Adobe Reader extended features were removed (changing the form voids them)".into());
+        }
+        out
+    }
+}
+
+/// What a document's XFA entry says, from its dictionaries alone (no packet decoded).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct XfaShape {
+    /// `/NeedsRendering true`: the form expects to be laid out from the template.
+    pub needs_rendering: bool,
+    /// The AcroForm has fields of its own.
+    pub has_fields: bool,
+    /// PdfCraft laid the form out (the layout mark is there).
+    pub laid_out: bool,
+}
+
+impl XfaShape {
+    /// Whether taking the XFA out leaves a form every viewer shows: the pages PdfCraft laid out
+    /// (with their fields), or a static form's own pages and fields. A dynamic form that was
+    /// never laid out has only placeholder pages: stripping it would leave nothing.
+    pub fn strippable(self) -> bool {
+        self.laid_out || (!self.needs_rendering && self.has_fields)
+    }
+}
+
+/// The document's XFA entry, if any, without decoding a packet.
+pub fn xfa_shape(doc: &Document) -> Option<XfaShape> {
+    let root = doc.root()?;
+    let catalog = doc.get(root);
+    let catalog = catalog.as_dict()?;
+    let acro = doc.resolve(catalog.get(b"AcroForm")?);
+    let acro = acro.as_dict()?;
+    acro.get(b"XFA")?;
+    let bool_of = |v: Option<&Object>| matches!(v.map(|v| doc.resolve(v)).as_deref(), Some(Object::Bool(true)));
+    let needs_rendering = bool_of(catalog.get(b"NeedsRendering")) || bool_of(acro.get(b"NeedsRendering"));
+    let has_fields = acro.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().map(|a| !a.is_empty())).unwrap_or(false);
+    Some(XfaShape { needs_rendering, has_fields, laid_out: acro.contains(LAYOUT_KEY) })
+}
+
+/// Most field dictionaries walked for their private keys.
+const MAX_STRIP_FIELDS: usize = 1_000_000;
+
+/// Take the XFA out of a document, leaving what every viewer shows: the pages as laid out
+/// and, when the fields were kept, an ordinary AcroForm. The packets (template, data and
+/// all), `/NeedsRendering`, the layout mark, the overrides and Reader usage rights go, and
+/// the fields lose the private keys PdfCraft gave them. A flattened form (no fields left)
+/// becomes a plain PDF; one with its fields becomes a static form that Adobe's viewers no
+/// longer lay out again. What the packets held beyond the fields is counted in the report,
+/// so the user can be told; the caller decides whether the form is one to strip
+/// ([`XfaShape::strippable`]). A document without XFA is left as it is.
+pub fn strip(doc: &mut Document) -> Result<Stripped, XfaError> {
+    let mut out = Stripped::default();
+    let Some(root) = doc.root() else { return Ok(out) };
+    let Some(mut catalog) = doc.get(root).as_dict().cloned() else { return Ok(out) };
+    let acro_obj = catalog.get(b"AcroForm").cloned();
+    let Some(acro_obj) = acro_obj else { return Ok(out) };
+    let Some(mut acro) = doc.resolve(&acro_obj).as_dict().cloned() else { return Ok(out) };
+    let Some(xfa) = acro.get(b"XFA").cloned() else { return Ok(out) };
+    // What is about to go, while it can still be read.
+    out.unbound_data = unbound_data(doc);
+    out.layout_warnings = existing_layout(doc).map(|r| r.warnings).unwrap_or_default();
+    let mut streams: Vec<ObjRef> = Vec::new();
+    match &*doc.resolve(&xfa) {
+        Object::Array(items) => {
+            let mut i = 0;
+            while i < items.len() {
+                let name = items.get(i).and_then(|n| n.as_string()).map(|s| s.to_text());
+                let stream = if name.is_some() { items.get(i + 1) } else { items.get(i) };
+                if let Some(n) = &name {
+                    out.packets.push(n.clone());
+                }
+                if let Some(r) = stream.and_then(Object::as_ref) {
+                    streams.push(r);
+                }
+                i += if name.is_some() { 2 } else { 1 };
+            }
+        }
+        Object::Stream(s) => {
+            if let Some(r) = xfa.as_ref() {
+                streams.push(r);
+            }
+            // One XDP: the packets it holds are the envelope's children.
+            let text = s.decoded_within(64 << 20).ok().and_then(|b| crate::packets::decode(&b)).map(|(t, _)| t).unwrap_or_default();
+            let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: 1_000_000 };
+            if crate::xml_nesting_depth(&text) <= crate::MAX_XML_DEPTH
+                && let Ok(parsed) = roxmltree::Document::parse_with_options(&text, opts)
+            {
+                let root = parsed.root_element();
+                if root.tag_name().name() == "xdp" {
+                    out.packets.extend(root.children().filter(|c| c.is_element()).map(|c| c.tag_name().name().to_string()).take(32));
+                } else {
+                    out.packets.push(root.tag_name().name().to_string());
+                }
+            }
+            if out.packets.is_empty() {
+                out.packets.push("xdp".into());
+            }
+        }
+        _ => {}
+    }
+    acro.remove(b"XFA");
+    for key in [b"NeedsRendering".as_slice(), LAYOUT_KEY, crate::script::OVERRIDES_KEY] {
+        acro.remove(key);
+    }
+    // The private keys on every field and widget, down the tree (each dictionary once).
+    let fields = acro.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned()).unwrap_or_default();
+    let mut seen = std::collections::HashSet::new();
+    let mut todo: Vec<ObjRef> = Vec::new();
+    for r in fields.iter().filter_map(Object::as_ref) {
+        if seen.insert(r) && seen.len() <= MAX_STRIP_FIELDS {
+            todo.push(r);
+        }
+    }
+    while let Some(r) = todo.pop() {
+        let Some(d) = doc.get(r).as_dict().cloned() else { continue };
+        if d.contains(CLICK_KEY) {
+            out.script_buttons += 1;
+        }
+        if d.contains(IMAGE_FIELD_KEY) {
+            out.image_fields += 1;
+        }
+        let private: Vec<Vec<u8>> =
+            [SOM_KEY, CLICK_KEY, IMAGE_FIELD_KEY, NODE_KEY, b"PCItems".as_slice()].iter().filter(|k| d.contains(k)).map(|k| k.to_vec()).collect();
+        if !private.is_empty() {
+            out.field_keys += private.len();
+            doc.update_dict(r, |d| {
+                for k in &private {
+                    d.remove(k);
+                }
+            })?;
+        }
+        if let Some(kids) = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()) {
+            for k in kids.iter().filter_map(Object::as_ref) {
+                if seen.insert(k) && seen.len() <= MAX_STRIP_FIELDS {
+                    todo.push(k);
+                }
+            }
+        }
+    }
+    match acro_obj.as_ref() {
+        Some(r) => doc.set(r, Object::Dict(acro)),
+        None => catalog.set(b"AcroForm".to_vec(), Object::Dict(acro)),
+    }
+    catalog.remove(b"NeedsRendering");
+    out.usage_rights = drop_usage_rights(doc, &mut catalog);
+    doc.set(root, Object::Dict(catalog));
+    // The packet streams are referenced from nowhere else: freed, so an incremental save
+    // doesn't carry an unreachable copy of the data.
+    for r in streams {
+        doc.free(r);
+    }
+    doc.require_full_save();
+    Ok(out)
+}
+
+/// Values in the datasets that no field of the laid-out form holds (leaf text nodes whose
+/// data path no field binds to). `None` when the template can't be read.
+fn unbound_data(doc: &Document) -> Option<usize> {
+    let data = crate::script::data_of(doc)?;
+    let tpl = crate::script::template_of(doc).ok()?;
+    let bound: std::collections::HashSet<crate::data::DataPath> =
+        crate::script::fields_by_som(doc).keys().map(|som| crate::data::data_path(&tpl, som)).collect();
+    fn walk(
+        n: &crate::data::DataNode,
+        path: &mut crate::data::DataPath,
+        bound: &std::collections::HashSet<crate::data::DataPath>,
+        count: &mut usize,
+        depth: usize,
+    ) {
+        if depth > 64 {
+            return;
+        }
+        let mut seen: std::collections::HashMap<&str, usize> = std::collections::HashMap::new();
+        for c in &n.children {
+            let idx = seen.entry(c.name.as_str()).or_insert(0);
+            path.push((c.name.clone(), *idx));
+            *idx += 1;
+            if c.children.is_empty() {
+                if !c.text.trim().is_empty() && !bound.contains(path) {
+                    *count += 1;
+                }
+            } else {
+                walk(c, path, bound, count, depth + 1);
+            }
+            path.pop();
+        }
+    }
+    let mut count = 0;
+    walk(&data, &mut Vec::new(), &bound, &mut count, 0);
+    Some(count)
+}
+
+/// Take the usage rights (`/Perms /UR3`, or the older `/UR`) off a catalog, keeping the rest of
+/// `/Perms` (a certification's `/DocMDP`). They are signed over the form as it was: once its
+/// pages or fields change they are void, and a viewer may lock every field of a form whose
+/// usage rights are void, so they go, and the caller says so. Whether there were any.
+pub(super) fn drop_usage_rights(doc: &mut Document, catalog: &mut Dict) -> bool {
+    let Some(entry) = catalog.get(b"Perms").cloned() else { return false };
+    let Some(mut perms) = doc.resolve(&entry).as_dict().cloned() else { return false };
+    if !perms.contains(b"UR3") && !perms.contains(b"UR") {
+        return false;
+    }
+    perms.remove(b"UR3");
+    perms.remove(b"UR");
+    match entry.as_ref() {
+        _ if perms.is_empty() => {
+            catalog.remove(b"Perms");
+        }
+        Some(r) => doc.set(r, Object::Dict(perms)),
+        None => catalog.set(b"Perms".to_vec(), Object::Dict(perms)),
+    }
+    true
+}
+
+/// The layout a document already carries from an earlier pass, if any.
+pub fn existing_layout(doc: &Document) -> Option<crate::Report> {
+    let root = doc.root()?;
+    let catalog = doc.get(root);
+    let acro = doc.resolve(catalog.as_dict()?.get(b"AcroForm")?);
+    let mark = doc.resolve(acro.as_dict()?.get(LAYOUT_KEY)?);
+    let mark = mark.as_dict()?;
+    let warnings = mark
+        .get(b"Warnings")
+        .map(|w| doc.resolve(w))
+        .and_then(|w| w.as_array().cloned())
+        .unwrap_or_default()
+        .iter()
+        .filter_map(|w| w.as_string().map(|s| s.to_text()))
+        .take(100)
+        .collect();
+    Some(crate::Report {
+        pages: mark.int(b"Pages").unwrap_or(0).clamp(0, 100_000) as usize,
+        fields: mark.int(b"Fields").unwrap_or(0).clamp(0, 1_000_000) as usize,
+        template_bytes: 0,
+        warnings,
+    })
+}
diff --git a/crates/xfa/src/script.rs b/crates/xfa/src/script.rs
index c8d506495e..6946aa9b1c 100644
--- a/crates/xfa/src/script.rs
+++ b/crates/xfa/src/script.rs
@@ -7,7 +7,7 @@ use std::collections::{BTreeMap, HashMap};
 use pdfcraft_cos::{Dict, Document, Object, PdfString};
 
 use crate::data::{DataNode, data_path, parse_datasets};
-use crate::model::*;
+use crate::model::{Access, Field, Node, Presence, Script, SomIndices, Template};
 use crate::{Report, XfaError};
 
 /// Private key on the AcroForm: presence scripts set, by SOM path.
@@ -586,19 +586,61 @@ pub fn rerender(doc: &mut Document, tpl: &Template) -> Result<Report, XfaError>
     if form.pages.is_empty() {
         return Err(XfaError::Malformed("the template laid out to no pages".into()));
     }
-    // The AcroForm keeps only the fields PdfCraft did not generate.
+    // The fields an earlier pass generated give way to the new layout's, after it is written: it
+    // keeps a signature one of them holds. The AcroForm keeps every field PdfCraft did not generate.
     let Some(root) = doc.root() else { return Err(XfaError::NotXfa) };
-    if let Some((acro_ref, mut acro)) = acroform(doc) {
-        let fields = acro.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned()).unwrap_or_default();
-        let kept: Vec<Object> =
-            fields.into_iter().filter(|f| f.as_ref().is_none_or(|r| doc.get(r).as_dict().is_none_or(|d| !d.contains(crate::pdf::SOM_KEY)))).collect();
+    let top = |doc: &Document| -> Vec<Object> {
+        acroform(doc).and_then(|(_, acro)| acro.get(b"Fields").map(|f| doc.resolve(f)).and_then(|f| f.as_array().cloned())).unwrap_or_default()
+    };
+    let generated: std::collections::HashSet<pdfcraft_cos::ObjRef> = top(doc)
+        .iter()
+        .filter_map(Object::as_ref)
+        .filter(|r| doc.get(*r).as_dict().is_some_and(|d| d.contains(crate::pdf::SOM_KEY) || d.contains(crate::pdf::NODE_KEY)))
+        .collect();
+    let written = crate::pdf::write_form(doc, &form)?;
+    if !generated.is_empty()
+        && let Some((acro_ref, mut acro)) = acroform(doc)
+    {
+        let kept: Vec<Object> = top(doc).into_iter().filter(|f| f.as_ref().is_none_or(|r| !generated.contains(&r))).collect();
         acro.set(b"Fields".to_vec(), Object::Array(kept));
         match acro_ref {
             Some(r) => doc.set(r, Object::Dict(acro)),
             None => doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(acro)))?,
         }
+        // A generated field edited in this overlay is freed with its appearance and widget kids,
+        // so a replaced password widget's value or masked appearance cannot stay in the overlay.
+        // Signature fields, and the fields that name them by their SOM path, stay: the new
+        // layout's signature field took their value and appearance.
+        let free_ap = |doc: &mut Document, d: &Dict| {
+            if let Some(ap) = d.get(b"AP").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().cloned())
+                && let Some(n) = ap.get(b"N").and_then(Object::as_ref)
+                && doc.is_edited(n.num)
+            {
+                doc.free(n);
+            }
+        };
+        let signature = |d: &Dict| d.name(b"FT") == Some(b"Sig".as_slice()) || d.contains(crate::pdf::NODE_KEY);
+        for r in generated {
+            let Some(d) = doc.get(r).as_dict().cloned().filter(|d| !signature(d)) else { continue };
+            free_ap(doc, &d);
+            if let Some(kids) = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()) {
+                for k in kids.iter().filter_map(Object::as_ref) {
+                    if let Some(kd) = doc.get(k).as_dict().cloned() {
+                        if signature(&kd) {
+                            continue;
+                        }
+                        free_ap(doc, &kd);
+                    }
+                    if doc.is_edited(k.num) {
+                        doc.free(k);
+                    }
+                }
+            }
+            if doc.is_edited(r.num) {
+                doc.free(r);
+            }
+        }
     }
-    let written = crate::pdf::write_form(doc, &form)?;
     let mut warnings = form.warnings;
     warnings.extend(written.warnings);
     if written.usage_rights {
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index 46c2435314..39a1c93483 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -1508,6 +1508,8 @@ fn top_fields(doc: &Document) -> Vec<(String, pdfcraft_cos::Dict)> {
         .collect()
 }
 
+/// Choice lists, a password, a signature and pictures in the template become their kinds of
+/// widget, and their AcroForm fields and image XObjects once written.
 #[test]
 fn choice_lists_signatures_passwords_and_pictures_become_fields_and_images() {
     let form = layout_xml(&fields_template("")).unwrap();
@@ -1570,7 +1572,11 @@ fn choice_lists_signatures_passwords_and_pictures_become_fields_and_images() {
     assert_eq!(opt[0].as_string().unwrap().to_text(), "English", "same shown text and value: a plain string");
     assert_eq!(field("other").int(b"Ff"), Some((1 << 17) | (1 << 18)), "an editable combo box");
     assert_eq!(field("pin").int(b"Ff"), Some(1 << 13), "a password field");
-    assert_eq!(field("sign").name(b"FT"), Some(b"Sig".as_slice()));
+    // The signature field is named by its SOM path, under a generated field for each step above it.
+    assert!(fields.iter().all(|(name, _)| name != "sign"));
+    let named = full_names(&doc);
+    let sign = named.iter().find(|(name, _)| name == "form[0].page1[0].sign[0]").map(|(_, d)| d).expect("named by its SOM path");
+    assert_eq!(sign.name(b"FT"), Some(b"Sig".as_slice()));
     let streams: Vec<pdfcraft_cos::Stream> = doc
         .object_numbers()
         .into_iter()
@@ -2757,6 +2763,465 @@ fn a_text_field_without_a_border_of_its_own_has_no_box() {
     assert_eq!(shapes, [BorderShape::None, BorderShape::Full, BorderShape::Full]);
 }
 
+/// One measured check box: its name, width, box size, check box children, field children, and
+/// where its box was drawn (x and y in inches from the field's top left).
+type CheckCase<'a> = (&'a str, &'a str, Option<&'a str>, String, String, f64, f64);
+
+/// A check box field for the placement tests: `extra` holds its margin, paragraph and caption,
+/// `ui` the check box's own children, and `size` its box size (none for the default 10pt).
+fn placed_check(name: &str, x: f64, y: f64, w: &str, size: Option<&str>, ui: &str, extra: &str) -> String {
+    let size = size.map(|s| format!(r#" size="{s}""#)).unwrap_or_default();
+    format!(
+        r#"<field name="{name}" x="{x}in" y="{y}in" w="{w}" h="0.6in"><ui><checkButton{size}>{ui}</checkButton></ui><font typeface="Arial" size="9pt"/>{extra}<items><integer>1</integer><integer>0</integer></items></field>"#
+    )
+}
+
+/// Where a check box is drawn inside its field, measured in inches from the field's top left in
+/// another viewer on synthetic probes: with no caption the box sits at the right of the content
+/// area whatever the paragraph's alignment, beside a reserved caption the alignment places it,
+/// a caption without a reserve takes all the box leaves, and the box's own margin doesn't move it.
+#[test]
+fn a_check_box_sits_where_its_margins_caption_and_alignment_put_it() {
+    let m = |a: &str| format!("<margin {a}/>");
+    let p = |a: &str| format!("<para {a}/>");
+    let cap = |a: &str, text: &str| format!(r#"<caption {a}><font typeface="Arial" size="9pt"/><value><text>{text}</text></value></caption>"#);
+    // (name, width, box size, check box children, field children, box x and y in inches)
+    let cases: Vec<CheckCase> = vec![
+        ("none", "1.2in", Some("0.25in"), String::new(), String::new(), 0.95, 0.0),
+        ("left_margin", "1.2in", Some("0.25in"), String::new(), m(r#"leftInset="0.3in""#), 0.95, 0.0),
+        ("right_margin", "1.2in", Some("0.25in"), String::new(), m(r#"rightInset="0.3in""#), 0.65, 0.0),
+        ("both_margins", "1.2in", Some("0.25in"), String::new(), m(r#"leftInset="0.1in" rightInset="0.4in""#), 0.55, 0.0),
+        ("h_left", "1.2in", Some("0.25in"), String::new(), p(r#"hAlign="left""#), 0.95, 0.0),
+        ("h_center", "1.2in", Some("0.25in"), String::new(), p(r#"hAlign="center""#), 0.95, 0.0),
+        ("h_right", "1.2in", Some("0.25in"), String::new(), p(r#"hAlign="right""#), 0.95, 0.0),
+        ("h_justify", "1.2in", Some("0.25in"), String::new(), p(r#"hAlign="justify""#), 0.95, 0.0),
+        ("center_right_margin", "1.2in", Some("0.25in"), String::new(), m(r#"rightInset="0.3in""#) + &p(r#"hAlign="center""#), 0.65, 0.0),
+        ("left_left_margin", "1.2in", Some("0.25in"), String::new(), m(r#"leftInset="0.3in""#) + &p(r#"hAlign="left""#), 0.95, 0.0),
+        ("v_top_margin", "1.2in", Some("0.25in"), String::new(), m(r#"topInset="0.15in""#) + &p(r#"vAlign="top""#), 0.95, 0.15),
+        ("v_middle_margin", "1.2in", Some("0.25in"), String::new(), m(r#"topInset="0.2in""#) + &p(r#"vAlign="middle""#), 0.95, 0.275),
+        ("v_bottom_margin", "1.2in", Some("0.25in"), String::new(), m(r#"bottomInset="0.15in""#) + &p(r#"vAlign="bottom""#), 0.95, 0.2),
+        ("v_bottom", "1.2in", Some("0.25in"), String::new(), p(r#"vAlign="bottom""#), 0.95, 0.35),
+        ("cap_left_reserve", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="left" reserve="0.5in""#, "Cap"), 0.5, 0.0),
+        ("cap_right_reserve", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="right" reserve="0.5in""#, "Cap"), 0.0, 0.0),
+        (
+            "cap_left_reserve_center",
+            "1.5in",
+            Some("0.25in"),
+            String::new(),
+            cap(r#"placement="left" reserve="0.5in""#, "Cap") + &p(r#"hAlign="center""#),
+            0.875,
+            0.0,
+        ),
+        (
+            "cap_left_reserve_right",
+            "1.5in",
+            Some("0.25in"),
+            String::new(),
+            cap(r#"placement="left" reserve="0.5in""#, "Cap") + &p(r#"hAlign="right""#),
+            1.25,
+            0.0,
+        ),
+        (
+            "cap_left_reserve_middle",
+            "1.5in",
+            Some("0.25in"),
+            String::new(),
+            cap(r#"placement="left" reserve="0.5in""#, "Cap") + &p(r#"vAlign="middle""#),
+            0.5,
+            0.175,
+        ),
+        (
+            "cap_right_reserve_center",
+            "1.5in",
+            Some("0.25in"),
+            String::new(),
+            cap(r#"placement="right" reserve="0.5in""#, "Cap") + &p(r#"hAlign="center""#),
+            0.375,
+            0.0,
+        ),
+        ("cap_top_reserve", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="top" reserve="0.25in""#, "Cap"), 0.0, 0.25),
+        ("cap_bottom_reserve", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="bottom" reserve="0.25in""#, "Cap"), 0.0, 0.0),
+        (
+            "cap_hidden_reserve",
+            "1.5in",
+            Some("0.25in"),
+            String::new(),
+            cap(r#"placement="left" reserve="0.5in" presence="hidden""#, "Cap"),
+            1.25,
+            0.0,
+        ),
+        ("cap_empty_reserve", "1.5in", Some("0.25in"), String::new(), r#"<caption placement="left" reserve="0.5in"/>"#.to_string(), 0.5, 0.0),
+        ("cap_left_auto", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="left""#, "Cap"), 1.25, 0.0),
+        ("cap_left_auto_center", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="left""#, "Cap") + &p(r#"hAlign="center""#), 1.25, 0.0),
+        ("cap_right_auto", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="right""#, "Cap"), 0.0, 0.0),
+        ("cap_right_auto_middle", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="right""#, "Cap") + &p(r#"vAlign="middle""#), 0.0, 0.175),
+        ("cap_top_auto", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="top""#, "Cap"), 0.0, 0.35),
+        ("cap_top_auto_center", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="top""#, "Cap") + &p(r#"hAlign="center""#), 0.625, 0.35),
+        ("cap_bottom_auto", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="bottom""#, "Cap"), 0.0, 0.0),
+        ("cap_inline", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="inline""#, "Cap"), 1.25, 0.0),
+        ("cap_hidden_auto", "1.5in", Some("0.25in"), String::new(), cap(r#"placement="left" presence="hidden""#, "Cap"), 1.25, 0.0),
+        ("box_margin_left", "1.5in", Some("0.25in"), m(r#"leftInset="0.1in""#), String::new(), 1.25, 0.0),
+        (
+            "box_margin_all",
+            "1.5in",
+            Some("0.25in"),
+            m(r#"leftInset="0.1in" rightInset="0.1in" topInset="0.1in" bottomInset="0.1in""#),
+            String::new(),
+            1.25,
+            0.0,
+        ),
+        ("default_size", "1.2in", None, String::new(), String::new(), 1.2 - 10.0 / 72.0, 0.0),
+        ("default_size_center", "1.2in", None, String::new(), p(r#"hAlign="center""#), 1.2 - 10.0 / 72.0, 0.0),
+    ];
+    let fields: String = cases
+        .iter()
+        .enumerate()
+        .map(|(i, (name, w, size, ui, extra, _, _))| placed_check(name, (i % 4) as f64 * 1.8, (i / 4) as f64 * 0.8, w, *size, ui, extra))
+        .collect();
+    // The form in the measured case the probes started from (DD Form 2946's checklist boxes).
+    let cell = r#"<field name="cell" x="0in" y="8in" w="12.7mm" h="0.6in"><ui><checkButton size="4.9389mm"><border><edge/><fill/></border></checkButton></ui><margin leftInset="0mm" rightInset="3.556mm"/><para vAlign="middle"/><items><integer>1</integer><integer>0</integer></items></field>"#;
+    let body = format!(r#"<subform name="body" layout="position" w="7.5in" h="9in">{fields}{cell}</subform>"#);
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &body)).unwrap();
+    let laid = widgets(&form.pages[0]);
+    let at = |name: &str| laid.iter().find(|w| w.name == name).map(|w| w.rect).unwrap_or_else(|| panic!("no widget {name}"));
+    // The content area starts half an inch in.
+    for (i, (name, _, size, _, _, x, y)) in cases.iter().enumerate() {
+        let r = at(name);
+        let (fx, fy) = (36.0 + (i % 4) as f64 * 1.8 * 72.0, 36.0 + (i / 4) as f64 * 0.8 * 72.0);
+        let s = if size.is_some() { 18.0 } else { 10.0 };
+        assert!((r.x - fx - x * 72.0).abs() < 0.01, "{name}: box x {} in, expected {x}", (r.x - fx) / 72.0);
+        assert!((r.y - fy - y * 72.0).abs() < 0.01, "{name}: box y {} in, expected {y}", (r.y - fy) / 72.0);
+        assert!((r.w - s).abs() < 0.01 && (r.h - s).abs() < 0.01, "{name}: box size {}x{}", r.w, r.h);
+    }
+    // Its box sits 4.2mm in, against its 3.556mm right margin, and in the middle of its height.
+    let r = at("cell");
+    let mm = 72.0 / 25.4;
+    assert!((r.x - 36.0 - (12.7 - 3.556 - 4.9389) * mm).abs() < 0.01, "cell box x {}", r.x - 36.0);
+    assert!((r.y - 36.0 - 8.0 * 72.0 - (0.6 * 72.0 - 4.9389 * mm) / 2.0).abs() < 0.01, "cell box y {}", r.y - 36.0 - 8.0 * 72.0);
+}
+
+/// Radio buttons in an exclusion group sit as check boxes do: at the right without a caption,
+/// moved in by a right margin, and placed by the alignment or the caption beside a caption.
+#[test]
+fn a_radio_button_sits_where_a_check_box_would() {
+    let radio = |name: &str, x: f64, extra: &str| {
+        format!(
+            r#"<field name="{name}" x="{x}in" y="0in" w="1.5in" h="0.6in"><ui><checkButton size="0.25in" shape="round"/></ui><font typeface="Arial" size="9pt"/>{extra}<items><text>{name}</text></items></field>"#
+        )
+    };
+    let cap = |a: &str| format!(r#"<caption {a}><font typeface="Arial" size="9pt"/><value><text>Cap</text></value></caption>"#);
+    // (name, field children, box x and y in inches from the field's top left)
+    let cases = [
+        ("plain", String::new(), 1.25, 0.0),
+        ("right_margin", r#"<margin rightInset="0.3in"/>"#.to_string(), 0.95, 0.0),
+        ("centered", r#"<para hAlign="center"/>"#.to_string(), 1.25, 0.0),
+        ("cap_right_center", cap(r#"placement="right" reserve="0.5in""#) + r#"<para hAlign="center"/>"#, 0.375, 0.0),
+        ("cap_left_auto", cap(r#"placement="left""#), 1.25, 0.0),
+        ("cap_top_auto", cap(r#"placement="top""#), 0.0, 0.35),
+    ];
+    let fields: String = cases.iter().enumerate().map(|(i, (name, extra, _, _))| radio(name, i as f64 * 1.6, extra)).collect();
+    let body = format!(
+        r#"<subform name="body" layout="position" w="7.5in" h="9in"><exclGroup name="group" x="0in" y="0in" w="9.6in" h="0.6in" layout="position">{fields}</exclGroup></subform>"#
+    );
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &body)).unwrap();
+    let laid = widgets(&form.pages[0]);
+    for (i, (name, _, x, y)) in cases.iter().enumerate() {
+        let w = laid.iter().find(|w| w.name == *name).unwrap_or_else(|| panic!("no radio button {name}"));
+        assert!(matches!(w.kind, WidgetKind::Radio { .. }), "{name} is a radio button");
+        let fx = 36.0 + i as f64 * 1.6 * 72.0;
+        assert!((w.rect.x - fx - x * 72.0).abs() < 0.01, "{name}: box x {} in, expected {x}", (w.rect.x - fx) / 72.0);
+        assert!((w.rect.y - 36.0 - y * 72.0).abs() < 0.01, "{name}: box y {} in, expected {y}", (w.rect.y - 36.0) / 72.0);
+    }
+}
+
+/// A caption without a reserve leaves room for the box at the size it is drawn, a box larger than
+/// its field shrinking to fit; and a field without a height is as tall as that caption drawn in
+/// all the box leaves, not at some narrower width.
+#[test]
+fn a_check_box_caption_without_a_reserve_is_measured_as_it_is_drawn() {
+    let cap =
+        r#"<caption placement="left"><font typeface="Arial" size="9pt"/><value><text>Caption text running on one line</text></value></caption>"#;
+    let tall = r#"<field name="tall" x="0in" y="0in" w="1.5in" h="0.25in"><ui><checkButton size="0.75in"/></ui><font typeface="Arial" size="9pt"/>"#
+        .to_string()
+        + cap
+        + "<items><integer>1</integer><integer>0</integer></items></field>";
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &format!(r#"<subform name="body" layout="position" w="7.5in" h="1in">{tall}</subform>"#)))
+        .unwrap();
+    let r = widgets(&form.pages[0]).iter().find(|w| w.name == "tall").map(|w| w.rect).unwrap();
+    assert!((r.w - 18.0).abs() < 0.01, "the box shrinks to the field's height: {}", r.w);
+    assert!((r.x - 36.0 - 1.25 * 72.0).abs() < 0.01, "and still sits at the right: {} in", (r.x - 36.0) / 72.0);
+
+    let grows = r#"<field name="grows" w="3in"><ui><checkButton size="0.25in"/></ui><font typeface="Arial" size="9pt"/>"#.to_string()
+        + cap
+        + r#"<items><integer>1</integer><integer>0</integer></items></field><field name="next" w="3in" h="0.3in"><ui><textEdit/></ui></field>"#;
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &format!(r#"<subform name="body" layout="tb" w="7.5in">{grows}</subform>"#))).unwrap();
+    let next = widgets(&form.pages[0]).iter().find(|w| w.name == "next").map(|w| w.rect).unwrap();
+    assert!((next.y - 36.0 - 18.0).abs() < 0.01, "a one-line caption beside the box keeps the field the box's height: {}", next.y - 36.0);
+}
+
+/// A caption without a reserve beside a check box takes all the room the box leaves, and starts
+/// right after it; an inline caption has no text to run with and is not drawn.
+#[test]
+fn a_check_box_caption_without_a_reserve_takes_the_rest_of_the_field() {
+    let cap = |place: &str, text: &str| {
+        format!(r#"<caption placement="{place}"><font typeface="Arial" size="9pt"/><value><text>{text}</text></value></caption>"#)
+    };
+    let body = format!(
+        r#"<subform name="body" layout="position" w="7.5in" h="9in">{}{}{}{}</subform>"#,
+        placed_check("after", 0.0, 0.0, "1.5in", Some("0.25in"), "", &cap("right", "Right")),
+        placed_check("before", 2.0, 0.0, "1.5in", Some("0.25in"), "", &cap("left", "Left")),
+        placed_check("below", 4.0, 0.0, "1.5in", Some("0.25in"), "", &cap("bottom", "Below")),
+        placed_check("inline", 0.0, 1.0, "1.5in", Some("0.25in"), "", &cap("inline", "Inline")),
+    );
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &body)).unwrap();
+    let span = |t: &str| {
+        form.pages[0].items.iter().find_map(|i| match i {
+            Item::Text(s) if s.text == t => Some(s.clone()),
+            _ => None,
+        })
+    };
+    let right = span("Right").expect("the right caption is drawn");
+    assert!((right.x - 36.0 - 18.0).abs() < 0.01, "a right caption starts after the box: {}", right.x - 36.0);
+    let left = span("Left").expect("the left caption is drawn");
+    assert!((left.x - 36.0 - 2.0 * 72.0).abs() < 0.01, "a left caption starts at the field's left: {}", left.x - 36.0);
+    let below = span("Below").expect("the bottom caption is drawn");
+    assert!(below.baseline - 36.0 > 18.0, "a bottom caption is below the box: {}", below.baseline - 36.0);
+    assert!(span("Inline").is_none(), "an inline caption beside a check box is not drawn");
+}
+
+/// A caption reserve of zero sizes the caption to its content, as no reserve does: beside a check
+/// box it takes the rest of the field, and before a text field it is as wide as its text.
+#[test]
+fn a_zero_caption_reserve_sizes_the_caption_as_none_does() {
+    let cap = |reserve: &str| {
+        format!(r#"<caption placement="right"{reserve}><font typeface="Arial" size="9pt"/><value><text>Right</text></value></caption>"#)
+    };
+    let text = |name: &str, y: &str, reserve: &str| {
+        format!(
+            r#"<field name="{name}" x="0in" y="{y}" w="3in" h="0.3in"><ui><textEdit/></ui><font typeface="Arial" size="9pt"/><caption placement="left"{reserve}><font typeface="Arial" size="9pt"/><value><text>Name</text></value></caption></field>"#
+        )
+    };
+    let body = format!(
+        r#"<subform name="body" layout="position" w="7.5in" h="9in">{}{}{}</subform>"#,
+        placed_check("zero", 0.0, 0.0, "1.5in", Some("0.25in"), "", &cap(r#" reserve="0""#)),
+        text("withZero", "1in", r#" reserve="0in""#),
+        text("without", "2in", ""),
+    );
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &body)).unwrap();
+    let right = form.pages[0].items.iter().find_map(|i| if let Item::Text(s) = i { (s.text == "Right").then_some(s.x) } else { None });
+    assert!(right.is_some_and(|x| (x - 36.0 - 18.0).abs() < 0.01), "the caption starts after the box: {right:?}");
+    let x_of = |name: &str| widgets(&form.pages[0]).iter().find(|w| w.name == name).map(|w| w.rect.x).unwrap();
+    assert!(x_of("withZero") > 36.0 + 1.0, "the caption takes its text's width: {}", x_of("withZero"));
+    assert!((x_of("withZero") - x_of("without")).abs() < 0.01, "as without a reserve: {} {}", x_of("withZero"), x_of("without"));
+}
+
+/// The terminal fields by full name, down the field tree.
+fn full_names(doc: &Document) -> Vec<(String, Dict)> {
+    let root = doc.get(doc.root().unwrap());
+    let acro = doc.resolve(root.as_dict().unwrap().get(b"AcroForm").unwrap());
+    let mut todo: Vec<(Object, String)> =
+        doc.resolve(acro.as_dict().unwrap().get(b"Fields").unwrap()).as_array().unwrap().iter().map(|f| (f.clone(), String::new())).collect();
+    let mut out = Vec::new();
+    while let Some((f, prefix)) = todo.pop() {
+        let d = doc.resolve(&f).as_dict().unwrap().clone();
+        let t = d.get(b"T").map(|t| doc.resolve(t)).and_then(|t| t.as_string().map(|t| t.to_text()));
+        let name = match t {
+            Some(t) if prefix.is_empty() => t,
+            Some(t) => format!("{prefix}.{t}"),
+            None => prefix,
+        };
+        match d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()) {
+            Some(kids) if kids.iter().any(|k| doc.resolve(k).as_dict().is_some_and(|k| k.contains(b"T"))) => {
+                todo.extend(kids.into_iter().map(|k| (k, name.clone())));
+            }
+            _ => out.push((name, d)),
+        }
+    }
+    out
+}
+
+/// A laid-out signature field is named by its SOM path, under a generated field for each step
+/// above it, as other viewers lay a dynamic form out again and find its signature by that name.
+/// Boxes in one subform share those fields; a new layout replaces them rather than adding more;
+/// taking the XFA out leaves them as ordinary fields.
+#[test]
+fn signature_fields_are_named_by_their_som_path() {
+    let xdp = r##"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+ <pageSet><pageArea name="page"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+ <subform name="body" layout="tb" w="7.5in">
+  <field name="name" w="3in" h="0.3in"><ui><textEdit/></ui></field>
+  <field name="sign" w="3in" h="1in"><ui><signature/></ui></field>
+  <field name="other" w="3in" h="1in"><ui><signature/></ui></field>
+ </subform>
+ <subform name="end" layout="tb" w="7.5in">
+  <field name="last" w="3in" h="1in"><ui><signature/></ui></field>
+ </subform>
+</subform>
+</template>
+</xdp:xdp>
+"##;
+    let mut doc = Document::open(Arc::new(shell(xdp))).unwrap();
+    let report = render_into(&mut doc).unwrap();
+    assert_eq!(report.fields, 4, "name and the three signature fields");
+    let doc = Document::open(Arc::new(write_incremental(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    let check = |doc: &Document| {
+        let top: Vec<String> = pdfcraft_forms_free_fields(doc).into_iter().map(|(name, _)| name).collect();
+        assert_eq!(top.iter().filter(|n| *n == "form[0]").count(), 1, "one field for the root subform: {top:?}");
+        assert!(top.iter().any(|n| n == "name"), "other fields keep their names: {top:?}");
+        let named = full_names(doc);
+        for som in ["form[0].body[0].sign[0]", "form[0].body[0].other[0]", "form[0].end[0].last[0]"] {
+            let (_, d) = named.iter().find(|(name, _)| name == som).unwrap_or_else(|| panic!("{som} in {named:?}"));
+            assert_eq!(d.name(b"FT"), Some(b"Sig".as_slice()));
+            assert_eq!(fields_by_som(doc).get(som).map(String::as_str), Some(som), "the data finds it by its SOM path");
+        }
+        assert_eq!(named.len(), 4, "{named:?}");
+    };
+    check(&doc);
+    let body = |doc: &Document| {
+        let named = full_names(doc);
+        let parent = |som: &str| named.iter().find(|(name, _)| name == som).and_then(|(_, d)| d.get(b"Parent").and_then(Object::as_ref));
+        (parent("form[0].body[0].sign[0]"), parent("form[0].body[0].other[0]"))
+    };
+    let (a, b) = body(&doc);
+    assert!(a.is_some() && a == b, "the two boxes of one subform share its field");
+    // Laid out again: the same fields, not a second set.
+    let mut doc = doc;
+    let tpl = crate::script::template_of(&doc).unwrap();
+    rerender(&mut doc, &tpl).unwrap();
+    check(&doc);
+    // The XFA taken out: ordinary fields with the same names, without the private key.
+    strip(&mut doc).unwrap();
+    let named = full_names(&doc);
+    assert!(named.iter().any(|(name, _)| name == "form[0].end[0].last[0]"), "{named:?}");
+    let top = pdfcraft_forms_free_fields(&doc);
+    let node = top.iter().find(|(name, _)| name == "form[0]").map(|(_, d)| d.clone()).expect("the root subform's field");
+    assert!(!node.contains(NODE_KEY));
+}
+
+/// The terminal field named `full`, down the field tree.
+fn field_ref(doc: &Document, full: &str) -> Option<pdfcraft_cos::ObjRef> {
+    let root = doc.get(doc.root()?);
+    let acro = doc.resolve(root.as_dict()?.get(b"AcroForm")?);
+    let mut todo: Vec<(pdfcraft_cos::ObjRef, String)> =
+        doc.resolve(acro.as_dict()?.get(b"Fields")?).as_array()?.iter().filter_map(Object::as_ref).map(|r| (r, String::new())).collect();
+    while let Some((r, prefix)) = todo.pop() {
+        let d = doc.get(r).as_dict()?.clone();
+        let t = d.get(b"T").map(|t| doc.resolve(t)).and_then(|t| t.as_string().map(|t| t.to_text())).unwrap_or_default();
+        let name = if prefix.is_empty() { t } else { format!("{prefix}.{t}") };
+        if name == full {
+            return Some(r);
+        }
+        let kids = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+        todo.extend(kids.iter().filter_map(Object::as_ref).map(|k| (k, name.clone())));
+    }
+    None
+}
+
+/// A box signed on a laid-out form stays signed when the form is laid out again (as after a
+/// script adds a row): the new layout's field, named by the same SOM path, holds the same
+/// signature and is locked, and the old field is gone from the AcroForm.
+#[test]
+fn a_signature_on_a_laid_out_box_survives_a_new_layout() {
+    let mut doc = Document::open(Arc::new(shell(&fields_template("")))).unwrap();
+    render_into(&mut doc).unwrap();
+    let som = "form[0].page1[0].sign[0]";
+    let old = field_ref(&doc, som).expect("the box");
+    // Signed as signing does it: a signature dictionary as the field's value, and a picture.
+    let mut sig = Dict::new();
+    sig.set(b"Type".to_vec(), Object::name("Sig"));
+    let sig = doc.add(Object::Dict(sig));
+    let picture = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(Dict::new(), b"0 0 1 rg 0 0 10 10 re f".to_vec())));
+    doc.update_dict(old, |d| {
+        d.set(b"V".to_vec(), Object::Ref(sig));
+        let mut ap = Dict::new();
+        ap.set(b"N".to_vec(), Object::Ref(picture));
+        d.set(b"AP".to_vec(), Object::Dict(ap));
+    })
+    .unwrap();
+    let tpl = crate::script::template_of(&doc).unwrap();
+    rerender(&mut doc, &tpl).unwrap();
+    let new = field_ref(&doc, som).expect("still named by its SOM path");
+    assert_ne!(new, old, "a field of the new layout");
+    let d = doc.get(new).as_dict().unwrap().clone();
+    assert_eq!(d.get(b"V").and_then(Object::as_ref), Some(sig), "the same signature");
+    let shown = d.get(b"AP").map(|ap| doc.resolve(ap)).and_then(|ap| ap.as_dict().and_then(|ap| ap.get(b"N").and_then(Object::as_ref)));
+    assert_eq!(shown, Some(picture), "and the same picture");
+    assert!(matches!(&*doc.get(picture), Object::Stream(_)), "which is still in the file");
+    assert!(matches!(&*doc.get(sig), Object::Dict(_)), "as is the signature");
+    assert_eq!(d.int(b"Ff").unwrap_or(0) & 1, 1, "a signed box is not signed again");
+    let top = pdfcraft_forms_free_fields(&doc);
+    assert_eq!(top.iter().filter(|(name, _)| name == "form[0]").count(), 1, "the old fields are gone");
+}
+
+/// A box right in the form's root subform, signed and then laid out again, keeps its signature
+/// and picture in the file: its field sits just under the one naming it, and the old fields that
+/// give way to the new layout's (freed when this session made them) take nothing it still uses.
+#[test]
+fn a_signed_box_in_the_root_subform_keeps_its_picture_through_a_new_layout() {
+    let xdp = r#"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/"><template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb"><pageSet><pageArea name="front"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+<field name="sign" w="3in" h="1in"><ui><signature/></ui></field>
+</subform></template></xdp:xdp>"#;
+    let mut doc = Document::open(Arc::new(shell(xdp))).unwrap();
+    render_into(&mut doc).unwrap();
+    let som = "form[0].sign[0]";
+    let old = field_ref(&doc, som).expect("the box");
+    let sig = doc.add(Object::Dict(Dict::new()));
+    let picture = doc.add(Object::Stream(pdfcraft_cos::Stream::from_raw(Dict::new(), b"0 0 1 rg 0 0 10 10 re f".to_vec())));
+    doc.update_dict(old, |d| {
+        d.set(b"V".to_vec(), Object::Ref(sig));
+        let mut ap = Dict::new();
+        ap.set(b"N".to_vec(), Object::Ref(picture));
+        d.set(b"AP".to_vec(), Object::Dict(ap));
+    })
+    .unwrap();
+    let tpl = crate::script::template_of(&doc).unwrap();
+    rerender(&mut doc, &tpl).unwrap();
+    let new = field_ref(&doc, som).expect("still named by its SOM path");
+    let d = doc.get(new).as_dict().unwrap().clone();
+    let shown = d.get(b"AP").map(|ap| doc.resolve(ap)).and_then(|ap| ap.as_dict().and_then(|ap| ap.get(b"N").and_then(Object::as_ref)));
+    assert_eq!(shown, Some(picture));
+    assert!(matches!(&*doc.get(picture), Object::Stream(_)), "the picture is still in the file");
+    assert!(matches!(&*doc.get(sig), Object::Dict(_)), "and the signature");
+}
+
+/// A field of the same pass keeps a signature field named by its SOM path from repeating its
+/// name, written before the box or after it: with a text field named `form[0]` (as a hostile
+/// template may name one), the box keeps its own name and no two fields share one.
+#[test]
+fn a_signature_field_does_not_repeat_a_name_another_field_has() {
+    let text = r#"<field name="form[0]" w="3in" h="0.3in"><ui><textEdit/></ui></field>"#;
+    let sign = r#"<field name="sign" w="3in" h="1in"><ui><signature/></ui></field>"#;
+    for (first, second) in [(text, sign), (sign, text)] {
+        let xdp = format!(
+            r##"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+ <pageSet><pageArea name="page"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+ <subform name="body" layout="tb" w="7.5in">{first}{second}</subform>
+</subform>
+</template>
+</xdp:xdp>
+"##
+        );
+        let mut doc = Document::open(Arc::new(shell(&xdp))).unwrap();
+        render_into(&mut doc).unwrap();
+        let mut top: Vec<String> = pdfcraft_forms_free_fields(&doc).into_iter().map(|(name, _)| name).collect();
+        assert!(top.iter().any(|n| n == "sign"), "the box keeps its own name: {top:?}");
+        top.sort();
+        let len = top.len();
+        top.dedup();
+        assert_eq!(top.len(), len, "no name twice: {top:?}");
+    }
+}
+
+/// A signature box the file already holds a signature for shows that signature, the file's own
+/// objects, and is locked; the other box stays unsigned.
 #[test]
 fn a_signed_signature_box_shows_the_signature_the_file_holds() {
     let mut doc = Document::open(Arc::new(crate::fixtures::signed_shell())).unwrap();
@@ -2765,7 +3230,10 @@ fn a_signed_signature_box_shows_the_signature_the_file_holds() {
     let acro = doc.resolve(catalog.as_dict().unwrap().get(b"AcroForm").unwrap());
     let fields = doc.resolve(acro.as_dict().unwrap().get(b"Fields").unwrap()).as_array().unwrap().clone();
     let laid: Vec<_> = fields.iter().map(|f| doc.resolve(f)).filter(|f| f.as_dict().unwrap().contains(SOM_KEY)).collect();
+    // The file has a field named `form[0]` already: the unsigned box keeps its own name rather
+    // than repeat that one.
     let (signed, unsigned) = (laid[0].as_dict().unwrap(), laid[1].as_dict().unwrap());
+    assert_eq!(unsigned.get(b"T").and_then(|t| t.as_string()).map(|t| t.to_text()).as_deref(), Some("other"));
     // The signature dictionary and the picture are the file's own objects, not copies.
     let value = doc.resolve(signed.get(b"V").unwrap());
     assert_eq!(value.as_dict().unwrap().name(b"Type"), Some(&b"Sig"[..]));
@@ -3098,6 +3566,7 @@ fn stripping_takes_the_xfa_out_and_leaves_an_ordinary_document() {
     ur.set(b"UR3".to_vec(), Object::Dict(pdfcraft_cos::Dict::new()));
     doc.update_dict(root, |d| d.set(b"Perms".to_vec(), Object::Dict(ur))).unwrap();
     let r = strip(&mut doc).unwrap();
+    assert!(doc.full_save_required());
     assert_eq!(r.packets, vec!["template".to_string(), "datasets".to_string()]);
     assert_eq!(r.unbound_data, Some(0));
     assert_eq!((r.script_buttons, r.image_fields), (0, 1), "{r:?}");
@@ -3183,6 +3652,16 @@ fn stripping_takes_the_xfa_out_and_leaves_an_ordinary_document() {
     assert!(started.elapsed() < std::time::Duration::from_secs(5), "{:?}", started.elapsed());
 }
 
+#[test]
+fn strip_marks_document_as_requiring_full_save() {
+    use crate::pdf::strip;
+    let mut doc = Document::open(Arc::new(shell(&fields_template("<form><page1><country>JP</country></page1></form>")))).unwrap();
+    render_into(&mut doc).unwrap();
+    assert!(!doc.full_save_required());
+    strip(&mut doc).unwrap();
+    assert!(doc.full_save_required(), "stripping XFA packets must require a full save to prevent data exposure in incremental saves");
+}
+
 #[test]
 fn som_indices_count_earlier_same_named_siblings() {
     let draw = |name: Option<&str>| {
@@ -3528,3 +4007,69 @@ fn faces_measure_text_at_their_standard_14_widths() {
     let condensed = text::Face { h_scale: 0.8, ..face(text::Family::Times, true, false) };
     assert!((condensed.width(sample) - 0.8 * Std14::TimesBold.text_width(sample, 10.0)).abs() < 1e-9);
 }
+
+/// #3944: clearing XFA password values removes values typed into `<passwordEdit/>` fields from the
+/// datasets packet (including across repeating subforms), restores a field's template default
+/// `<value><text>…</text></value>` when it has one, and replaces the datasets stream in place so
+/// the typed password is not left in an unreferenced stream in the overlay.
+#[test]
+fn clear_password_values_removes_typed_passwords_from_datasets_in_place() {
+    let xdp = r#"<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+ <pageSet><pageArea name="front"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+ <subform name="page1" layout="tb">
+  <field name="user" w="2in" h="0.3in"><ui><textEdit/></ui></field>
+  <field name="pin" w="2in" h="0.3in"><ui><passwordEdit/></ui></field>
+  <field name="preset" w="2in" h="0.3in"><ui><passwordEdit/></ui><value><text>0000</text></value></field>
+  <subform name="row" layout="lr-tb"><occur min="1" max="-1"/>
+   <field name="secret" w="2in" h="0.3in"><ui><passwordEdit/></ui></field>
+  </subform>
+ </subform>
+</subform>
+</template>
+<xfa:datasets xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/">
+<xfa:data><form><page1><user>Ada</user><pin>hunter2</pin><preset>9999</preset><row><secret>first</secret></row><row><secret>second</secret></row></page1></form></xfa:data>
+</xfa:datasets>
+</xdp:xdp>"#;
+    let mut doc = Document::open(Arc::new(shell(xdp))).unwrap();
+    render_into(&mut doc).unwrap();
+    assert!(has_password_values(&doc));
+    let cleared = clear_password_values(&mut doc).unwrap();
+    assert_eq!(cleared, 4);
+    assert!(!has_password_values(&doc), "only default and non-password values remain");
+    assert_eq!(clear_password_values(&mut doc).unwrap(), 0);
+
+    let packets = read_packets(&doc).unwrap().unwrap();
+    assert!(packets.xdp.contains("<user>Ada</user>"), "non-password fields stay: {}", packets.xdp);
+    assert!(packets.xdp.contains("<preset>0000</preset>"), "template default restored: {}", packets.xdp);
+    for secret in ["hunter2", "9999", "first", "second"] {
+        assert!(!packets.xdp.contains(secret), "{secret} still in datasets: {}", packets.xdp);
+    }
+    let written = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let reopened = Document::open(Arc::new(written)).unwrap();
+    for num in reopened.object_numbers() {
+        if let Object::Stream(st) = &*reopened.get(pdfcraft_cos::ObjRef::new(num, 0)) {
+            let decoded = st.decoded().unwrap_or_default();
+            let text = String::from_utf8_lossy(&decoded);
+            for secret in ["hunter2", "9999", "first", "second"] {
+                assert!(!text.contains(secret), "object {num} still holds {secret}: {text}");
+            }
+        }
+    }
+}
+
+/// #3944: a static XFA form whose AcroForm field sets the Password flag (`/Ff 8192`) also has its
+/// typed value cleared from the datasets packet.
+#[test]
+fn clear_password_values_clears_static_xfa_password_fields() {
+    let pdf = String::from_utf8(static_shell("<form1><page1><name>hunter2</name></page1></form1>"))
+        .unwrap()
+        .replace("/T (name[0])", "/T (name[0]) /Ff 8192");
+    let mut doc = Document::open(Arc::new(pdf.into_bytes())).unwrap();
+    assert!(has_password_values(&doc));
+    assert_eq!(clear_password_values(&mut doc).unwrap(), 1);
+    assert!(!has_password_values(&doc));
+    let packets = read_packets(&doc).unwrap().unwrap();
+    assert!(!packets.xdp.contains("hunter2"), "{}", packets.xdp);
+}
diff --git a/crates/xfdf/src/common.rs b/crates/xfdf/src/common.rs
new file mode 100644
index 0000000000..5670415d38
--- /dev/null
+++ b/crates/xfdf/src/common.rs
@@ -0,0 +1,266 @@
+use super::*;
+
+// ── names ───────────────────────────────────────────────────────────────────────────────────
+
+/// Form data files are attacker-supplied. Refuse a DTD and bound the node count, exactly as the
+/// XFA template parser does (`crates/xfa/src/parse.rs`), and bound how deep a nested field tree
+/// may go: the walk below recurses once per nesting level.
+const MAX_NODES: u32 = 2_000_000;
+
+pub(crate) const MAX_DEPTH: usize = 64;
+
+/// The deepest element nesting accepted before the text reaches the XML parser.
+///
+/// roxmltree parses by recursive descent, so its stack use grows with the nesting depth: ten
+/// thousand levels overflow the main thread's stack and abort the process. A stack overflow is
+/// `abort()`, so `catch_unwind` cannot intercept it and the whole application dies - which is why
+/// the bound has to be applied before parsing, not while walking the result. Around three thousand
+/// levels still parse on the default stack, so this stays clear of the cliff while leaving far more
+/// room than the walks below, which cut off at 64.
+pub(crate) const MAX_XML_DEPTH: usize = 1_024;
+
+/// Element nesting depth of `text`, skipping comments, CDATA, processing instructions, the DOCTYPE
+/// and quoted attribute values. A tag that closes itself (`<field/>`) is one level while it is read
+/// and does not stay open, so a long run of them cannot accumulate into the bound. It cannot
+/// under-count a real element; a stray `<` in text is invalid XML and only makes it over-count,
+/// which errs towards refusing the file.
+pub(crate) fn xml_nesting_depth(text: &str) -> usize {
+    fn find(hay: &[u8], from: usize, needle: &[u8]) -> Option<usize> {
+        (from..hay.len()).find(|&p| hay[p..].starts_with(needle))
+    }
+    let b = text.as_bytes();
+    let (mut i, mut depth, mut max) = (0usize, 0usize, 0usize);
+    while i < b.len() {
+        if b[i] != b'<' {
+            i += 1;
+        } else if b[i..].starts_with(b"<!--") {
+            i = find(b, i + 4, b"-->").map_or(b.len(), |p| p + 3);
+        } else if b[i..].starts_with(b"<![CDATA[") {
+            i = find(b, i + 9, b"]]>").map_or(b.len(), |p| p + 3);
+        } else if b[i..].starts_with(b"<?") {
+            i = find(b, i + 2, b"?>").map_or(b.len(), |p| p + 2);
+        } else if b[i..].starts_with(b"<!") {
+            i = find(b, i + 2, b">").map_or(b.len(), |p| p + 1);
+        } else if b[i..].starts_with(b"</") {
+            depth = depth.saturating_sub(1);
+            i = find(b, i + 2, b">").map_or(b.len(), |p| p + 1);
+        } else {
+            depth += 1;
+            max = max.max(depth);
+            // Skip the rest of the start tag, over any quoted attribute value, and remember its last
+            // significant byte: a tag that ends in `/` closes itself, so it is one level deep while it
+            // is read rather than a level left open.
+            i += 1;
+            let mut quote = 0u8;
+            let mut last = 0u8;
+            while i < b.len() {
+                let c = b[i];
+                if quote != 0 {
+                    if c == quote {
+                        quote = 0;
+                    }
+                } else if c == b'"' || c == b'\'' {
+                    quote = c;
+                } else if c == b'>' {
+                    i += 1;
+                    break;
+                } else if !c.is_ascii_whitespace() {
+                    last = c;
+                }
+                i += 1;
+            }
+            if last == b'/' {
+                depth -= 1;
+            }
+        }
+    }
+    max
+}
+
+pub(crate) fn check_form_xml_depth(text: &str) -> Result<(), DataError> {
+    let depth = xml_nesting_depth(text);
+    if depth > MAX_XML_DEPTH {
+        return Err(DataError::Malformed(format!("the file nests XML elements {depth} deep, past the {MAX_XML_DEPTH} the reader accepts")));
+    }
+    Ok(())
+}
+
+pub(crate) fn parse_form_xml(text: &str) -> Result<roxmltree::Document<'_>, roxmltree::Error> {
+    roxmltree::Document::parse_with_options(text, roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES })
+}
+
+pub(crate) const SUBTYPES: [(&str, &str); 17] = [
+    ("Text", "text"),
+    ("FreeText", "freetext"),
+    ("Line", "line"),
+    ("Square", "square"),
+    ("Circle", "circle"),
+    ("Polygon", "polygon"),
+    ("PolyLine", "polyline"),
+    ("Highlight", "highlight"),
+    ("Underline", "underline"),
+    ("Squiggly", "squiggly"),
+    ("StrikeOut", "strikeout"),
+    ("Stamp", "stamp"),
+    ("Caret", "caret"),
+    ("Ink", "ink"),
+    ("FileAttachment", "fileattachment"),
+    ("Sound", "sound"),
+    ("Redact", "redact"),
+];
+
+pub(crate) const FLAGS: [(i64, &str); 9] = [
+    (1, "invisible"),
+    (2, "hidden"),
+    (4, "print"),
+    (8, "nozoom"),
+    (16, "norotate"),
+    (32, "noview"),
+    (64, "readonly"),
+    (128, "locked"),
+    (256, "togglenoview"),
+];
+
+pub(crate) fn esc(s: &str) -> String {
+    let mut o = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => o.push_str("&amp;"),
+            '<' => o.push_str("&lt;"),
+            '>' => o.push_str("&gt;"),
+            '"' => o.push_str("&quot;"),
+            // XML 1.0 §3.3.3 normalizes literal attribute whitespace, but not references.
+            '\t' => o.push_str("&#9;"),
+            '\n' => o.push_str("&#10;"),
+            '\r' => o.push_str("&#13;"),
+            c if (c as u32) < 0x20 && c != '\n' && c != '\t' => {}
+            // XML 1.0 noncharacters are not allowed even as raw text.
+            '\u{FFFE}' | '\u{FFFF}' => {}
+            c => o.push(c),
+        }
+    }
+    o
+}
+
+pub(crate) fn n(v: f64) -> String {
+    let s = format!("{v:.4}");
+    let s = s.trim_end_matches('0').trim_end_matches('.');
+    if s == "-0" { "0".into() } else { s.into() }
+}
+
+pub(crate) fn hex(c: &[f64]) -> Option<String> {
+    let rgb = match c.len() {
+        1 => [c[0]; 3],
+        3 => [c[0], c[1], c[2]],
+        4 => [(1.0 - c[0]) * (1.0 - c[3]), (1.0 - c[1]) * (1.0 - c[3]), (1.0 - c[2]) * (1.0 - c[3])],
+        _ => return None,
+    };
+    Some(format!(
+        "#{:02X}{:02X}{:02X}",
+        (rgb[0].clamp(0.0, 1.0) * 255.0).round() as u8,
+        (rgb[1].clamp(0.0, 1.0) * 255.0).round() as u8,
+        (rgb[2].clamp(0.0, 1.0) * 255.0).round() as u8
+    ))
+}
+
+pub(crate) fn parse_hex(s: &str) -> Option<[f64; 3]> {
+    let h = s.trim().trim_start_matches('#');
+    if h.len() != 6 || !h.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return None;
+    }
+    let p = |i: usize| h.get(i..i + 2).and_then(|s| u8::from_str_radix(s, 16).ok()).map(|v| f64::from(v) / 255.0);
+    Some([p(0)?, p(2)?, p(4)?])
+}
+
+pub(crate) fn nums_of(doc: &Document, o: Option<&Object>) -> Vec<f64> {
+    o.map(|o| doc.resolve(o)).and_then(|a| a.as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect())).unwrap_or_default()
+}
+
+/// A `/Rect` of exactly four finite numbers; any other entry makes the whole rectangle unusable.
+pub(crate) fn rect_strict(doc: &Document, o: Option<&Object>) -> Option<[f64; 4]> {
+    let num = |x: &Object| doc.resolve(x).as_f64().filter(|v| v.is_finite());
+    match doc.resolve(o?).as_array()?.as_slice() {
+        [x0, y0, x1, y1] => Some([num(x0)?, num(y0)?, num(x1)?, num(y1)?]),
+        _ => None,
+    }
+}
+
+/// Whether a quad's four corners enclose any area: some three of them are not collinear.
+pub(crate) fn quad_has_area(q: &[f64; 8]) -> bool {
+    let [ax, ay, bx, by, cx, cy, dx, dy] = *q;
+    let cross = |(px, py): (f64, f64), (qx, qy): (f64, f64), (rx, ry): (f64, f64)| (qx - px) * (ry - py) - (qy - py) * (rx - px);
+    let (a, b, c, d) = ((ax, ay), (bx, by), (cx, cy), (dx, dy));
+    [cross(a, b, c), cross(a, b, d), cross(a, c, d), cross(b, c, d)].iter().any(|v| v.abs() > 0.0)
+}
+
+pub(crate) fn text_of(doc: &Document, d: &Dict, k: &[u8]) -> Option<String> {
+    d.get(k).and_then(|o| match &*doc.resolve(o) {
+        Object::String(s) => Some(s.to_text()),
+        Object::Name(n) => Some(pdfcraft_forms::name_text(n)),
+        _ => None,
+    })
+}
+
+/// The numbers of a list; empty when any entry is non-finite (`nan`, `inf`), so the list is unusable as a whole.
+pub(crate) fn csv(list: &str) -> Vec<f64> {
+    let v: Vec<f64> = list.split([',', ';', ' ']).filter(|t| !t.is_empty()).filter_map(|t| t.trim().parse().ok()).collect();
+    if v.iter().all(|x| x.is_finite()) { v } else { Vec::new() }
+}
+
+pub(crate) fn arr(v: &[f64]) -> Object {
+    Object::Array(v.iter().map(|x| Object::Real(*x)).collect())
+}
+
+/// XML 1.0 fifth-edition NameStartChar, excluding `:` for an unprefixed NCName.
+/// https://www.w3.org/TR/2008/REC-xml-20081126/#NT-NameStartChar
+fn xml_name_start(c: char) -> bool {
+    matches!(
+        c,
+        '_' | 'A'..='Z' | 'a'..='z'
+            | '\u{C0}'..='\u{D6}' | '\u{D8}'..='\u{F6}' | '\u{F8}'..='\u{2FF}'
+            | '\u{370}'..='\u{37D}' | '\u{37F}'..='\u{1FFF}'
+            | '\u{200C}'..='\u{200D}' | '\u{2070}'..='\u{218F}'
+            | '\u{2C00}'..='\u{2FEF}' | '\u{3001}'..='\u{D7FF}'
+            | '\u{F900}'..='\u{FDCF}' | '\u{FDF0}'..='\u{FFFD}'
+            | '\u{10000}'..='\u{EFFFF}'
+    )
+}
+
+fn xml_name_char(c: char) -> bool {
+    xml_name_start(c) || matches!(c, '-' | '.' | '0'..='9' | '\u{B7}' | '\u{300}'..='\u{36F}' | '\u{203F}'..='\u{2040}')
+}
+
+/// Keep the existing letters/digits/`_`/`-`/`.` normalization, constrained to valid NCNames.
+pub(crate) fn xml_name(name: &str) -> String {
+    let mut s: String =
+        name.chars().map(|c| if (c.is_alphanumeric() && xml_name_char(c)) || matches!(c, '_' | '-' | '.') { c } else { '_' }).collect();
+    if !s.chars().next().is_some_and(|c| (c.is_alphabetic() && xml_name_start(c)) || c == '_') {
+        s.insert(0, '_');
+    }
+    s
+}
+
+pub(crate) fn walk_xfdf(node: roxmltree::Node, prefix: &str, out: &mut Vec<(String, Vec<String>)>, depth: usize) -> Result<(), DataError> {
+    if depth > MAX_DEPTH {
+        return Err(DataError::Malformed(format!("XFDF fields nest more than {MAX_DEPTH} deep")));
+    }
+    for f in node.children().filter(|c| c.has_tag_name("field")) {
+        let Some(name) = f.attribute("name") else { continue };
+        let full = if prefix.is_empty() { name.to_string() } else { format!("{prefix}.{name}") };
+        let vals: Vec<String> = f
+            .children()
+            .filter(|c| c.has_tag_name("value"))
+            // Comments and processing instructions can split a value into several text nodes.
+            .map(|v| v.children().filter(|n| n.is_text()).filter_map(|n| n.text()).collect())
+            .collect();
+        // A leaf with no `<value>` is an empty field (the export writes one that way), so it
+        // clears the field like FDF's `/V ()`; a field with kids only names their parent. A
+        // leaf holding only `<value-richtext>` is not read yet, so it leaves the field alone.
+        let names_kids_or_rich = f.children().any(|c| c.has_tag_name("field") || c.has_tag_name("value-richtext"));
+        if !vals.is_empty() || !names_kids_or_rich {
+            out.push((full.clone(), vals));
+        }
+        walk_xfdf(f, &full, out, depth + 1)?;
+    }
+    Ok(())
+}
diff --git a/crates/xfdf/src/fdf.rs b/crates/xfdf/src/fdf.rs
new file mode 100644
index 0000000000..34b59017d2
--- /dev/null
+++ b/crates/xfdf/src/fdf.rs
@@ -0,0 +1,516 @@
+use super::common::{MAX_DEPTH, SUBTYPES, rect_strict, text_of};
+use super::xfdf::{add_popup, apply_values, find_by_name, place};
+use super::*;
+
+fn pdf_string(s: &str) -> Vec<u8> {
+    let mut v = Vec::new();
+    pdfcraft_cos::serialize(&Object::String(PdfString::text(s)), &mut v);
+    v
+}
+
+// Keep aliases as aliases instead of expanding a shared graph once per use. References are
+// queued, not followed recursively, so cycles and long indirect chains cost linear work.
+pub(crate) const MAX_FDF_OBJECTS: usize = 100_000;
+
+pub(crate) const MAX_FDF_BYTES: usize = 64 * 1024 * 1024;
+
+/// Direct values stay borrowed: `Document::resolve` would deep-clone them. Only
+/// indirect values need an owner, and annotation bodies are never retained in discovery.
+enum FdfValue<'a> {
+    Borrowed(&'a Object),
+    Indirect(std::sync::Arc<Object>),
+}
+
+impl<'a> FdfValue<'a> {
+    fn resolve(doc: &Document, value: &'a Object) -> Self {
+        match value {
+            Object::Ref(_) => Self::Indirect(doc.resolve(value)),
+            _ => Self::Borrowed(value),
+        }
+    }
+
+    fn object(&self) -> &Object {
+        match self {
+            Self::Borrowed(value) => value,
+            Self::Indirect(value) => value.as_ref(),
+        }
+    }
+}
+
+struct FdfCopy<'a> {
+    doc: &'a Document,
+    objects: Vec<Object>,
+    numbers: HashMap<ObjRef, u32>,
+    pending: Vec<(ObjRef, usize)>,
+    nodes: usize,
+    bytes: usize,
+}
+
+impl<'a> FdfCopy<'a> {
+    fn new(doc: &'a Document) -> Self {
+        Self { doc, objects: Vec::new(), numbers: HashMap::new(), pending: Vec::new(), nodes: MAX_FDF_OBJECTS, bytes: MAX_FDF_BYTES }
+    }
+
+    fn charge(&mut self, bytes: usize) -> Result<(), DataError> {
+        self.bytes = self.bytes.checked_sub(bytes).ok_or(DataError::ExportLimit("64 MiB data"))?;
+        Ok(())
+    }
+
+    fn slot(&mut self) -> Result<(usize, u32), DataError> {
+        if self.objects.len() >= MAX_FDF_OBJECTS {
+            return Err(DataError::ExportLimit("100,000 objects"));
+        }
+        // Object 1 is the FDF root; arena indices start at object 2. The arena is capped above.
+        let index = self.objects.len();
+        let number = index as u32 + 2;
+        self.charge(100)?; // indirect-object and xref overhead
+        self.objects.push(Object::Null);
+        Ok((index, number))
+    }
+
+    fn dict(&mut self, dict: &Dict, depth: usize) -> Result<Dict, DataError> {
+        if dict.len() > self.nodes {
+            return Err(DataError::ExportLimit("100,000 values"));
+        }
+        let mut out = Dict::new();
+        for (key, value) in dict.iter() {
+            self.dict_entry(&mut out, key, value, depth + 1)?;
+        }
+        Ok(out)
+    }
+
+    fn dict_entry(&mut self, out: &mut Dict, key: &[u8], value: &Object, depth: usize) -> Result<(), DataError> {
+        self.charge(key.len().saturating_mul(3).saturating_add(2))?;
+        let value = self.copy(value, depth)?;
+        out.set(key.to_vec(), value);
+        Ok(())
+    }
+
+    /// Skip source-document links and appearances without cloning their values. The
+    /// dictionary and every retained entry are charged before any owned copy is made.
+    fn annotation_dict(&mut self, dict: &Dict) -> Result<Dict, DataError> {
+        self.charge_value(0)?;
+        let mut out = Dict::new();
+        for (key, value) in dict.iter() {
+            if matches!(key.as_slice(), b"P" | b"AP" | b"Popup" | b"IRT" | b"Parent" | b"FS" | b"Sound") {
+                continue;
+            }
+            self.dict_entry(&mut out, key, value, 1)?;
+        }
+        Ok(out)
+    }
+
+    fn charge_value(&mut self, depth: usize) -> Result<(), DataError> {
+        if depth > MAX_DEPTH {
+            return Err(DataError::ExportLimit("64 direct nesting levels"));
+        }
+        self.nodes = self.nodes.checked_sub(1).ok_or(DataError::ExportLimit("100,000 values"))?;
+        // Includes delimiters, spacing and even the longest finite f64 in plain decimal form.
+        self.charge(330)?;
+        Ok(())
+    }
+
+    fn is_source_page(&self, dict: &Dict) -> Result<bool, DataError> {
+        let Some(value) = dict.get(b"Type") else { return Ok(false) };
+        let mut value = FdfValue::Borrowed(value);
+        let mut seen = HashSet::new();
+        for hops in 0..=MAX_DEPTH {
+            match value.object() {
+                Object::Name(name) => return Ok(matches!(name.as_slice(), b"Page" | b"Pages")),
+                Object::Ref(reference) => {
+                    if self.doc.generation(reference.num) != reference.generation || !seen.insert(*reference) {
+                        return Ok(false);
+                    }
+                    if hops == MAX_DEPTH {
+                        return Err(DataError::ExportLimit("64 Type reference levels"));
+                    }
+                    value = FdfValue::Indirect(self.doc.get(*reference));
+                }
+                _ => return Ok(false),
+            }
+        }
+        Err(DataError::ExportLimit("64 Type reference levels"))
+    }
+
+    fn copy(&mut self, value: &Object, depth: usize) -> Result<Object, DataError> {
+        self.charge_value(depth)?;
+        Ok(match value {
+            Object::Ref(source) => {
+                let number = if let Some(number) = self.numbers.get(source) {
+                    *number
+                } else {
+                    let (index, number) = self.slot()?;
+                    self.numbers.insert(*source, number);
+                    self.pending.push((*source, index));
+                    number
+                };
+                Object::Ref(ObjRef::new(number, 0))
+            }
+            Object::Array(values) => {
+                if values.len() > self.nodes {
+                    return Err(DataError::ExportLimit("100,000 values"));
+                }
+                let mut out = Vec::new();
+                for value in values {
+                    out.push(self.copy(value, depth + 1)?);
+                }
+                Object::Array(out)
+            }
+            // Source page links must not drag page contents or the page tree into an FDF.
+            Object::Dict(dict) if self.is_source_page(dict)? => Object::Null,
+            Object::Dict(dict) => Object::Dict(self.dict(dict, depth)?),
+            Object::String(s) => {
+                self.charge(s.bytes.len().saturating_mul(4))?;
+                value.clone()
+            }
+            Object::Name(name) => {
+                self.charge(name.len().saturating_mul(3))?;
+                value.clone()
+            }
+            // A PDF stream can only be an indirect object, never a dictionary/array value.
+            Object::Stream(_) => return Err(DataError::Malformed("FDF export encountered a direct stream".into())),
+            other => other.clone(),
+        })
+    }
+
+    fn finish(&mut self, doc: &Document) -> Result<(), DataError> {
+        let mut cursor = 0;
+        while let Some((source, index)) = self.pending.get(cursor).copied() {
+            // ISO 32000-2 §7.3.10: an absent or stale reference denotes null. Keep reader
+            // errors distinct so damaged objects cannot be silently lost during export.
+            let value = if doc.generation(source.num) != source.generation {
+                std::sync::Arc::new(Object::Null)
+            } else {
+                match doc.try_get(source.num) {
+                    Ok(value) => value,
+                    Err(pdfcraft_cos::CosError::MissingObject(_)) => std::sync::Arc::new(Object::Null),
+                    Err(error) => return Err(error.into()),
+                }
+            };
+            let copied = match &*value {
+                Object::Stream(stream) => {
+                    self.charge(stream.raw.len())?;
+                    Object::Stream(pdfcraft_cos::Stream { dict: self.dict(&stream.dict, 0)?, raw: stream.raw.clone() })
+                }
+                other => self.copy(other, 0)?,
+            };
+            let slot = self.objects.get_mut(index).ok_or_else(|| DataError::Malformed("FDF object slot is missing".into()))?;
+            *slot = copied;
+            cursor += 1;
+        }
+        Ok(())
+    }
+}
+
+/// FDF with field values and/or comments (appearances are not carried). Each comment is an
+/// indirect object of the FDF, so a reply's `/IRT` can point at its parent's object there
+/// (§12.7.8.3.1). Nested values are copied and renumbered, including shared or cyclic graphs.
+/// Source `/Page` and `/Pages` dictionaries become null at every copy depth.
+/// Refuses exports above the object, value, direct-depth or data budget instead of losing data.
+pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> Result<Vec<u8>, DataError> {
+    let mut copy = FdfCopy::new(doc);
+    copy.charge(file.len().saturating_mul(8))?;
+    let mut body: Vec<u8> = b"<< /FDF << ".to_vec();
+    // Comment dictionaries, written after the root as objects 2, 3, …
+    if fields {
+        body.extend_from_slice(b"/Fields [");
+        for f in pdfcraft_forms::fields(doc) {
+            if matches!(f.kind, FieldKind::PushButton | FieldKind::Signature) {
+                continue;
+            }
+            // Field dictionary, /T string and /V scalar/array, plus every emitted list
+            // entry. Other field kinds emit only their first value (or a default).
+            let field_nodes = if matches!(f.kind, FieldKind::List) && f.value.len() > 1 { f.value.len().saturating_add(3) } else { 3 };
+            copy.nodes = copy.nodes.checked_sub(field_nodes).ok_or(DataError::ExportLimit("100,000 values"))?;
+            copy.charge(f.name.len().saturating_mul(8).saturating_add(100))?;
+            for value in &f.value {
+                copy.charge(value.len().saturating_mul(8).saturating_add(100))?;
+            }
+            body.extend_from_slice(b"<< /T ");
+            body.extend(pdf_string(&f.name));
+            body.extend_from_slice(b" /V ");
+            match f.kind {
+                FieldKind::CheckBox | FieldKind::Radio => {
+                    let v = f.value.first().cloned().unwrap_or_else(|| "Off".into());
+                    pdfcraft_cos::serialize(&Object::Name(pdfcraft_forms::name_bytes(&v)), &mut body);
+                }
+                FieldKind::List if f.value.len() > 1 => {
+                    pdfcraft_cos::serialize(&Object::Array(f.value.iter().map(|v| Object::String(PdfString::text(v))).collect()), &mut body);
+                }
+                _ => body.extend(pdf_string(f.value.first().map(String::as_str).unwrap_or(""))),
+            }
+            body.extend_from_slice(b" >> ");
+        }
+        body.extend_from_slice(b"] ");
+    }
+    if comments {
+        // Keep the page/array owners once. Handles retain positions, never annotation
+        // bodies: the document cache can evict and reparse even a repeated source reference.
+        let pages = pdfcraft_model::pages(doc);
+        let mut arrays = Vec::new();
+        let mut picked: Vec<(Option<ObjRef>, usize, usize)> = Vec::new();
+        for (pi, page) in pages.iter().enumerate() {
+            let owner = page.dict.get(b"Annots").map(|value| FdfValue::resolve(doc, value));
+            let before = picked.len();
+            if let Some(values) = owner.as_ref().and_then(|owner| owner.object().as_array()) {
+                for (ai, a) in values.iter().enumerate() {
+                    let value = FdfValue::resolve(doc, a);
+                    let Some(d) = value.object().as_dict() else { continue };
+                    if d.name(b"Subtype").is_some_and(|sub| SUBTYPES.iter().any(|(s, _)| s.as_bytes() == sub)) {
+                        if picked.len() >= MAX_FDF_OBJECTS {
+                            return Err(DataError::ExportLimit("100,000 comments"));
+                        }
+                        picked.push((a.as_ref(), pi, ai));
+                    }
+                }
+            }
+            // Empty/unselected arrays need no owner. Resolve subsequent pages only after
+            // this page passes the cap, rather than loading them all before discovery.
+            arrays.push(if picked.len() > before { owner } else { None });
+        }
+        let mut numbers = HashMap::new();
+        for (source, _, _) in &picked {
+            let (_, number) = copy.slot()?;
+            if let Some(source) = source {
+                numbers.insert(*source, number);
+            }
+        }
+        copy.numbers = numbers.clone();
+        let count = picked.len();
+        for (index, (_, pi, ai)) in picked.into_iter().enumerate() {
+            let annotation = arrays
+                .get(pi)
+                .and_then(Option::as_ref)
+                .and_then(|owner| owner.object().as_array())
+                .and_then(|values| values.get(ai))
+                .ok_or_else(|| DataError::Malformed("FDF annotation slot is missing".into()))?;
+            let value = FdfValue::resolve(doc, annotation);
+            let d = value.object().as_dict().ok_or_else(|| DataError::Malformed("FDF comment is not a dictionary".into()))?;
+            // A reply points at its parent's object in this FDF; a parent that isn't exported
+            // leaves the reply unthreaded.
+            let irt = d.get(b"IRT").and_then(Object::as_ref).and_then(|r| numbers.get(&r)).copied();
+            let mut d = copy.annotation_dict(d)?;
+            if let Some(num) = irt {
+                d.set(b"IRT".to_vec(), Object::Ref(ObjRef::new(num, 0)));
+            }
+            d.set(b"Page".to_vec(), Object::Int(pi as i64));
+            let slot = copy.objects.get_mut(index).ok_or_else(|| DataError::Malformed("FDF comment slot is missing".into()))?;
+            *slot = Object::Dict(d);
+        }
+        body.extend_from_slice(b"/Annots [");
+        for i in 0..count {
+            let _ = write!(body, "{} 0 R ", i + 2);
+        }
+        body.extend_from_slice(b"] ");
+    }
+    body.extend_from_slice(b"/F ");
+    body.extend(pdf_string(file));
+    body.extend_from_slice(b" >> >>");
+    copy.finish(doc)?;
+    let mut out = b"%FDF-1.2\n%\xE2\xE3\xCF\xD3\n".to_vec();
+    let mut offsets = Vec::with_capacity(copy.objects.len() + 1);
+    offsets.push(out.len());
+    out.extend_from_slice(b"1 0 obj\n");
+    out.extend(body);
+    out.extend_from_slice(b"\nendobj\n");
+    for (i, object) in copy.objects.into_iter().enumerate() {
+        offsets.push(out.len());
+        let _ = writeln!(out, "{} 0 obj", i + 2);
+        pdfcraft_cos::serialize(&object, &mut out);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    let _ = write!(out, "xref\n0 {}\n0000000000 65535 f \n", offsets.len() + 1);
+    for o in offsets {
+        let _ = writeln!(out, "{o:010} 00000 n ");
+    }
+    let _ = write!(out, "trailer\n<< /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n");
+    Ok(out)
+}
+
+/// What one FDF import may copy out of the file. A field tree or comment that repeats a reference
+/// level after level would otherwise expand a small file into millions of values.
+const MAX_FDF_IMPORT_VALUES: usize = 1_000_000;
+
+pub(crate) struct ImportBudget {
+    values: usize,
+    bytes: usize,
+}
+
+impl ImportBudget {
+    pub(crate) fn new() -> Self {
+        Self { values: MAX_FDF_IMPORT_VALUES, bytes: MAX_FDF_BYTES }
+    }
+
+    fn spend(&mut self, values: usize, bytes: usize) -> Result<(), DataError> {
+        match (self.values.checked_sub(values), self.bytes.checked_sub(bytes)) {
+            (Some(v), Some(b)) => {
+                (self.values, self.bytes) = (v, b);
+                Ok(())
+            }
+            _ => Err(DataError::Malformed(format!(
+                "the file expands to more than {MAX_FDF_IMPORT_VALUES} values or {} MiB of text",
+                MAX_FDF_BYTES >> 20
+            ))),
+        }
+    }
+}
+
+/// Copy an object out of another document, resolving references. A reference back to an object
+/// being copied becomes null.
+fn deep(src: &Document, o: &Object, depth: usize, path: &mut Vec<ObjRef>, budget: &mut ImportBudget) -> Result<Object, DataError> {
+    budget.spend(1, 0)?;
+    if depth > 16 {
+        return Ok(Object::Null);
+    }
+    Ok(match o {
+        Object::Ref(r) => {
+            if path.contains(r) {
+                return Ok(Object::Null);
+            }
+            path.push(*r);
+            let copy = deep(src, &src.get(*r), depth + 1, path, budget);
+            path.pop();
+            copy?
+        }
+        Object::Array(a) => Object::Array(a.iter().map(|x| deep(src, x, depth + 1, path, budget)).collect::<Result<_, _>>()?),
+        Object::Dict(d) => {
+            Object::Dict(d.iter().map(|(k, v)| Ok((k.clone(), deep(src, v, depth + 1, path, budget)?))).collect::<Result<_, DataError>>()?)
+        }
+        Object::Stream(_) => Object::Null,
+        Object::String(s) => {
+            budget.spend(0, s.bytes.len())?;
+            o.clone()
+        }
+        Object::Name(n) => {
+            budget.spend(0, n.len())?;
+            o.clone()
+        }
+        other => other.clone(),
+    })
+}
+
+/// Read an FDF field tree. A field listed again beneath itself is skipped.
+pub(crate) fn walk_fdf(
+    fdf: &Document,
+    list: &[Object],
+    prefix: &str,
+    out: &mut Vec<(String, Vec<String>)>,
+    depth: usize,
+    path: &mut Vec<ObjRef>,
+    budget: &mut ImportBudget,
+) -> Result<(), DataError> {
+    if depth > 32 {
+        return Ok(());
+    }
+    for f in list {
+        budget.spend(1, 0)?;
+        let held;
+        let field = match f {
+            Object::Ref(r) if path.contains(r) => continue,
+            Object::Ref(r) => {
+                held = fdf.get(*r);
+                &*held
+            }
+            direct => direct,
+        };
+        let Some(d) = field.as_dict() else { continue };
+        let Some(t) = d.get(b"T").and_then(|t| fdf.resolve(t).as_string().map(|s| s.to_text())) else { continue };
+        let full = if prefix.is_empty() { t } else { format!("{prefix}.{t}") };
+        budget.spend(0, full.len())?;
+        if let Some(v) = d.get(b"V").map(|v| fdf.resolve(v)) {
+            let vals: Vec<String> = match &*v {
+                Object::String(s) => vec![s.to_text()],
+                Object::Name(n) => vec![pdfcraft_forms::name_text(n)],
+                Object::Array(a) => {
+                    budget.spend(a.len(), 0)?;
+                    a.iter().filter_map(|x| fdf.resolve(x).as_string().map(|s| s.to_text())).collect()
+                }
+                _ => Vec::new(),
+            };
+            budget.spend(vals.len(), vals.iter().map(String::len).fold(0, usize::saturating_add))?;
+            out.push((full.clone(), vals));
+        }
+        if let Some(kids) = d.get(b"Kids").map(|k| fdf.resolve(k))
+            && let Some(kids) = kids.as_array()
+        {
+            let entered = f.as_ref().map(|r| path.push(r)).is_some();
+            let walked = walk_fdf(fdf, kids, &full, out, depth + 1, path, budget);
+            if entered {
+                path.pop();
+            }
+            walked?;
+        }
+    }
+    Ok(())
+}
+
+pub(crate) fn fdf_body(fdf: &Document) -> Result<Dict, DataError> {
+    let root = fdf.root().ok_or_else(|| DataError::Malformed("no /Root".into()))?;
+    fdf.get(root)
+        .as_dict()
+        .and_then(|d| d.get(b"FDF").cloned())
+        .map(|f| fdf.resolve(&f))
+        .and_then(|f| f.as_dict().cloned())
+        .ok_or(DataError::UnknownFormat)
+}
+
+pub(crate) fn import_fdf(doc: &mut Document, bytes: &[u8]) -> Result<Report, DataError> {
+    let fdf = Document::open(std::sync::Arc::new(bytes.to_vec())).map_err(|e| DataError::Malformed(e.to_string()))?;
+    let body = fdf_body(&fdf)?;
+    let mut report = Report::default();
+    let mut budget = ImportBudget::new();
+    // Fields (with /Kids for hierarchical names).
+    let mut values = Vec::new();
+    if let Some(list) = body.get(b"Fields").map(|f| fdf.resolve(f)).and_then(|f| f.as_array().cloned()) {
+        walk_fdf(&fdf, &list, "", &mut values, 0, &mut Vec::new(), &mut budget)?;
+    }
+    // Comments: parents first, then replies (whose /IRT needs the parent's new reference).
+    let pages: Vec<ObjRef> = pdfcraft_model::pages(doc).iter().map(|p| p.obj).collect();
+    let mut placed: HashMap<ObjRef, ObjRef> = HashMap::new();
+    let mut later: HashMap<ObjRef, (Option<ObjRef>, Option<String>)> = HashMap::new();
+    for a in body.get(b"Annots").map(|a| fdf.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
+        let Some(mut src) = fdf.resolve(&a).as_dict().cloned() else { continue };
+        // The parent is another comment: link it below rather than copying it in.
+        let irt = src.get(b"IRT").cloned();
+        src.remove(b"IRT");
+        // The pop-up is an annotation of its own (/Popup shall be an indirect reference, ISO
+        // 32000-2 Table 172): copied in, it would become a direct dictionary. A new one is
+        // placed on the page below, as the XFDF import does.
+        let popup = src.get(b"Popup").map(|p| fdf.resolve(p)).and_then(|p| p.as_dict().cloned());
+        src.remove(b"Popup");
+        let mut path: Vec<ObjRef> = a.as_ref().into_iter().collect();
+        let Object::Dict(mut d) = deep(&fdf, &Object::Dict(src), 0, &mut path, &mut budget)? else { continue };
+        let Some(page) = d.get(b"Page").and_then(Object::as_int).and_then(|p| usize::try_from(p).ok()).and_then(|p| pages.get(p).copied()) else {
+            continue;
+        };
+        if !d.name(b"Subtype").is_some_and(|s| SUBTYPES.iter().any(|(x, _)| x.as_bytes() == s)) {
+            continue;
+        }
+        d.remove(b"Page");
+        d.set(b"P".to_vec(), Object::Ref(page));
+        let r = place(doc, page, d)?;
+        later.remove(&r);
+        if let Some(rect) = popup.as_ref().and_then(|p| rect_strict(&fdf, p.get(b"Rect"))) {
+            let open = popup.as_ref().and_then(|p| p.get(b"Open")).is_some_and(|o| matches!(&*fdf.resolve(o), Object::Bool(true)));
+            add_popup(doc, page, r, &rect, open)?;
+        }
+        if let Some(fr) = a.as_ref() {
+            placed.insert(fr, r);
+        }
+        if let Some(irt) = irt {
+            let parent_name = fdf.resolve(&irt).as_dict().and_then(|p| text_of(&fdf, p, b"NM"));
+            later.insert(r, (irt.as_ref(), parent_name));
+        }
+        report.comments += 1;
+    }
+    for (r, (parent_obj, parent_name)) in later {
+        // The parent imported from this file, else one already in the document with its name.
+        let parent = parent_obj.and_then(|p| placed.get(&p).copied()).or_else(|| parent_name.and_then(|nm| find_by_name(doc, &nm)));
+        if let Some(parent) = parent.filter(|p| *p != r) {
+            doc.update_dict(r, |d| d.set(b"IRT".to_vec(), Object::Ref(parent)))?;
+        }
+    }
+    apply_values(doc, &values, &mut report);
+    Ok(report)
+}
diff --git a/crates/xfdf/src/lib.rs b/crates/xfdf/src/lib.rs
index a6da88f4db..ba8cb6f7f7 100644
--- a/crates/xfdf/src/lib.rs
+++ b/crates/xfdf/src/lib.rs
@@ -18,6 +18,22 @@ use std::io::Write as _;
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString};
 use pdfcraft_forms::{FieldKind, FieldValue};
 
+mod common;
+mod fdf;
+mod xfdf;
+
+#[cfg(test)]
+use common::{MAX_DEPTH, MAX_XML_DEPTH, arr, nums_of, parse_hex, text_of, xml_nesting_depth};
+use common::{check_form_xml_depth, esc, parse_form_xml, walk_xfdf, xml_name};
+pub use fdf::export_fdf;
+use fdf::{ImportBudget, fdf_body, import_fdf, walk_fdf};
+#[cfg(test)]
+use fdf::{MAX_FDF_BYTES, MAX_FDF_OBJECTS};
+pub use xfdf::export_xfdf;
+#[cfg(test)]
+use xfdf::{LOCKED, find_by_name};
+use xfdf::{apply_values, import_xfdf};
+
 #[cfg(test)]
 mod tests;
 
@@ -71,772 +87,6 @@ pub struct Report {
     pub rejected: Vec<String>,
 }
 
-// ── names ───────────────────────────────────────────────────────────────────────────────────
-
-/// Form data files are attacker-supplied. Refuse a DTD and bound the node count, exactly as the
-/// XFA template parser does (`crates/xfa/src/parse.rs`), and bound how deep a nested field tree
-/// may go: the walk below recurses once per nesting level.
-const MAX_NODES: u32 = 2_000_000;
-const MAX_DEPTH: usize = 64;
-
-/// The deepest element nesting accepted before the text reaches the XML parser.
-///
-/// roxmltree parses by recursive descent, so its stack use grows with the nesting depth: ten
-/// thousand levels overflow the main thread's stack and abort the process. A stack overflow is
-/// `abort()`, so `catch_unwind` cannot intercept it and the whole application dies - which is why
-/// the bound has to be applied before parsing, not while walking the result. Around three thousand
-/// levels still parse on the default stack, so this stays clear of the cliff while leaving far more
-/// room than the walks below, which cut off at 64.
-const MAX_XML_DEPTH: usize = 1_024;
-
-/// Element nesting depth of `text`, skipping comments, CDATA, processing instructions, the DOCTYPE
-/// and quoted attribute values. A tag that closes itself (`<field/>`) is one level while it is read
-/// and does not stay open, so a long run of them cannot accumulate into the bound. It cannot
-/// under-count a real element; a stray `<` in text is invalid XML and only makes it over-count,
-/// which errs towards refusing the file.
-fn xml_nesting_depth(text: &str) -> usize {
-    fn find(hay: &[u8], from: usize, needle: &[u8]) -> Option<usize> {
-        (from..hay.len()).find(|&p| hay[p..].starts_with(needle))
-    }
-    let b = text.as_bytes();
-    let (mut i, mut depth, mut max) = (0usize, 0usize, 0usize);
-    while i < b.len() {
-        if b[i] != b'<' {
-            i += 1;
-        } else if b[i..].starts_with(b"<!--") {
-            i = find(b, i + 4, b"-->").map_or(b.len(), |p| p + 3);
-        } else if b[i..].starts_with(b"<![CDATA[") {
-            i = find(b, i + 9, b"]]>").map_or(b.len(), |p| p + 3);
-        } else if b[i..].starts_with(b"<?") {
-            i = find(b, i + 2, b"?>").map_or(b.len(), |p| p + 2);
-        } else if b[i..].starts_with(b"<!") {
-            i = find(b, i + 2, b">").map_or(b.len(), |p| p + 1);
-        } else if b[i..].starts_with(b"</") {
-            depth = depth.saturating_sub(1);
-            i = find(b, i + 2, b">").map_or(b.len(), |p| p + 1);
-        } else {
-            depth += 1;
-            max = max.max(depth);
-            // Skip the rest of the start tag, over any quoted attribute value, and remember its last
-            // significant byte: a tag that ends in `/` closes itself, so it is one level deep while it
-            // is read rather than a level left open.
-            i += 1;
-            let mut quote = 0u8;
-            let mut last = 0u8;
-            while i < b.len() {
-                let c = b[i];
-                if quote != 0 {
-                    if c == quote {
-                        quote = 0;
-                    }
-                } else if c == b'"' || c == b'\'' {
-                    quote = c;
-                } else if c == b'>' {
-                    i += 1;
-                    break;
-                } else if !c.is_ascii_whitespace() {
-                    last = c;
-                }
-                i += 1;
-            }
-            if last == b'/' {
-                depth -= 1;
-            }
-        }
-    }
-    max
-}
-
-fn check_form_xml_depth(text: &str) -> Result<(), DataError> {
-    let depth = xml_nesting_depth(text);
-    if depth > MAX_XML_DEPTH {
-        return Err(DataError::Malformed(format!("the file nests XML elements {depth} deep, past the {MAX_XML_DEPTH} the reader accepts")));
-    }
-    Ok(())
-}
-
-fn parse_form_xml(text: &str) -> Result<roxmltree::Document<'_>, roxmltree::Error> {
-    roxmltree::Document::parse_with_options(text, roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES })
-}
-
-const SUBTYPES: [(&str, &str); 17] = [
-    ("Text", "text"),
-    ("FreeText", "freetext"),
-    ("Line", "line"),
-    ("Square", "square"),
-    ("Circle", "circle"),
-    ("Polygon", "polygon"),
-    ("PolyLine", "polyline"),
-    ("Highlight", "highlight"),
-    ("Underline", "underline"),
-    ("Squiggly", "squiggly"),
-    ("StrikeOut", "strikeout"),
-    ("Stamp", "stamp"),
-    ("Caret", "caret"),
-    ("Ink", "ink"),
-    ("FileAttachment", "fileattachment"),
-    ("Sound", "sound"),
-    ("Redact", "redact"),
-];
-
-const FLAGS: [(i64, &str); 9] = [
-    (1, "invisible"),
-    (2, "hidden"),
-    (4, "print"),
-    (8, "nozoom"),
-    (16, "norotate"),
-    (32, "noview"),
-    (64, "readonly"),
-    (128, "locked"),
-    (256, "togglenoview"),
-];
-
-fn esc(s: &str) -> String {
-    let mut o = String::with_capacity(s.len());
-    for c in s.chars() {
-        match c {
-            '&' => o.push_str("&amp;"),
-            '<' => o.push_str("&lt;"),
-            '>' => o.push_str("&gt;"),
-            '"' => o.push_str("&quot;"),
-            // XML 1.0 §3.3.3 normalizes literal attribute whitespace, but not references.
-            '\t' => o.push_str("&#9;"),
-            '\n' => o.push_str("&#10;"),
-            '\r' => o.push_str("&#13;"),
-            c if (c as u32) < 0x20 && c != '\n' && c != '\t' => {}
-            // XML 1.0 noncharacters are not allowed even as raw text.
-            '\u{FFFE}' | '\u{FFFF}' => {}
-            c => o.push(c),
-        }
-    }
-    o
-}
-
-fn n(v: f64) -> String {
-    let s = format!("{v:.4}");
-    let s = s.trim_end_matches('0').trim_end_matches('.');
-    if s == "-0" { "0".into() } else { s.into() }
-}
-
-fn hex(c: &[f64]) -> Option<String> {
-    let rgb = match c.len() {
-        1 => [c[0]; 3],
-        3 => [c[0], c[1], c[2]],
-        4 => [(1.0 - c[0]) * (1.0 - c[3]), (1.0 - c[1]) * (1.0 - c[3]), (1.0 - c[2]) * (1.0 - c[3])],
-        _ => return None,
-    };
-    Some(format!(
-        "#{:02X}{:02X}{:02X}",
-        (rgb[0].clamp(0.0, 1.0) * 255.0).round() as u8,
-        (rgb[1].clamp(0.0, 1.0) * 255.0).round() as u8,
-        (rgb[2].clamp(0.0, 1.0) * 255.0).round() as u8
-    ))
-}
-
-fn parse_hex(s: &str) -> Option<[f64; 3]> {
-    let h = s.trim().trim_start_matches('#');
-    if h.len() != 6 || !h.bytes().all(|b| b.is_ascii_hexdigit()) {
-        return None;
-    }
-    let p = |i: usize| h.get(i..i + 2).and_then(|s| u8::from_str_radix(s, 16).ok()).map(|v| f64::from(v) / 255.0);
-    Some([p(0)?, p(2)?, p(4)?])
-}
-
-fn nums_of(doc: &Document, o: Option<&Object>) -> Vec<f64> {
-    o.map(|o| doc.resolve(o)).and_then(|a| a.as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect())).unwrap_or_default()
-}
-
-/// A `/Rect` of exactly four finite numbers; any other entry makes the whole rectangle unusable.
-fn rect_strict(doc: &Document, o: Option<&Object>) -> Option<[f64; 4]> {
-    let num = |x: &Object| doc.resolve(x).as_f64().filter(|v| v.is_finite());
-    match doc.resolve(o?).as_array()?.as_slice() {
-        [x0, y0, x1, y1] => Some([num(x0)?, num(y0)?, num(x1)?, num(y1)?]),
-        _ => None,
-    }
-}
-
-/// Whether a quad's four corners enclose any area: some three of them are not collinear.
-fn quad_has_area(q: &[f64; 8]) -> bool {
-    let [ax, ay, bx, by, cx, cy, dx, dy] = *q;
-    let cross = |(px, py): (f64, f64), (qx, qy): (f64, f64), (rx, ry): (f64, f64)| (qx - px) * (ry - py) - (qy - py) * (rx - px);
-    let (a, b, c, d) = ((ax, ay), (bx, by), (cx, cy), (dx, dy));
-    [cross(a, b, c), cross(a, b, d), cross(a, c, d), cross(b, c, d)].iter().any(|v| v.abs() > 0.0)
-}
-
-fn text_of(doc: &Document, d: &Dict, k: &[u8]) -> Option<String> {
-    d.get(k).and_then(|o| match &*doc.resolve(o) {
-        Object::String(s) => Some(s.to_text()),
-        Object::Name(n) => Some(pdfcraft_forms::name_text(n)),
-        _ => None,
-    })
-}
-
-fn csv(list: &str) -> Vec<f64> {
-    list.split([',', ';', ' ']).filter(|t| !t.is_empty()).filter_map(|t| t.trim().parse().ok()).collect()
-}
-
-fn arr(v: &[f64]) -> Object {
-    Object::Array(v.iter().map(|x| Object::Real(*x)).collect())
-}
-
-// ── export ──────────────────────────────────────────────────────────────────────────────────
-
-/// Every comment as an XFDF element (one line per comment, replies included).
-fn xfdf_annots(doc: &Document, out: &mut String) {
-    let pages = pdfcraft_model::pages(doc);
-    // NM of every annotation, for inreplyto.
-    let mut names: HashMap<ObjRef, String> = HashMap::new();
-    for p in &pages {
-        for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
-            if let Some(r) = a.as_ref()
-                && let Some(nm) = doc.get(r).as_dict().and_then(|d| text_of(doc, d, b"NM"))
-            {
-                names.insert(r, nm);
-            }
-        }
-    }
-    for (pi, p) in pages.iter().enumerate() {
-        for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
-            let Some(d) = doc.resolve(&a).as_dict().cloned() else { continue };
-            let Some(sub) = d.name(b"Subtype") else { continue };
-            let Some((_, tag)) = SUBTYPES.iter().find(|(s, _)| s.as_bytes() == sub) else { continue };
-            let mut attrs = format!(" page=\"{pi}\"");
-            let rect = nums_of(doc, d.get(b"Rect"));
-            if rect.len() == 4 {
-                let _ = write!(
-                    attrs,
-                    " rect=\"{},{},{},{}\"",
-                    n(rect[0].min(rect[2])),
-                    n(rect[1].min(rect[3])),
-                    n(rect[0].max(rect[2])),
-                    n(rect[1].max(rect[3]))
-                );
-            }
-            for (key, attr) in [
-                (&b"NM"[..], "name"),
-                (b"T", "title"),
-                (b"Subj", "subject"),
-                (b"M", "date"),
-                (b"CreationDate", "creationdate"),
-                (b"RT", "replyType"),
-                (b"State", "state"),
-                (b"StateModel", "statemodel"),
-                (b"Name", "icon"),
-            ] {
-                if let Some(v) = text_of(doc, &d, key) {
-                    let _ = write!(attrs, " {attr}=\"{}\"", esc(&v));
-                }
-            }
-            let flags = d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
-            let fl: Vec<&str> = FLAGS.iter().filter(|(b, _)| flags & b != 0).map(|(_, s)| *s).collect();
-            let _ = write!(attrs, " flags=\"{}\"", fl.join(","));
-            if let Some(c) = hex(&nums_of(doc, d.get(b"C"))) {
-                let _ = write!(attrs, " color=\"{c}\"");
-            }
-            if let Some(c) = hex(&nums_of(doc, d.get(b"IC"))) {
-                let _ = write!(attrs, " interior-color=\"{c}\"");
-            }
-            if let Some(o) = d.get(b"CA").and_then(|o| doc.resolve(o).as_f64()) {
-                let _ = write!(attrs, " opacity=\"{}\"", n(o));
-            }
-            if let Some(w) = d.get(b"BS").and_then(|b| doc.resolve(b).as_dict().and_then(|b| b.get(b"W").and_then(Object::as_f64))) {
-                let _ = write!(attrs, " width=\"{}\"", n(w));
-            }
-            let quads = nums_of(doc, d.get(b"QuadPoints"));
-            if !quads.is_empty() {
-                let _ = write!(attrs, " coords=\"{}\"", quads.iter().map(|v| n(*v)).collect::<Vec<_>>().join(","));
-            }
-            let l = nums_of(doc, d.get(b"L"));
-            if l.len() == 4 {
-                let _ = write!(attrs, " start=\"{},{}\" end=\"{},{}\"", n(l[0]), n(l[1]), n(l[2]), n(l[3]));
-            }
-            if let Some(le) = d.get(b"LE").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned())
-                && le.len() == 2
-            {
-                let name = |o: &Object| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned()).unwrap_or_else(|| "None".into());
-                let _ = write!(attrs, " head=\"{}\" tail=\"{}\"", esc(&name(&le[0])), esc(&name(&le[1])));
-            }
-            // A callout: its leader path, text-box inset, intent and (single-name) line ending.
-            let cl = nums_of(doc, d.get(b"CL"));
-            if cl.len() == 4 || cl.len() == 6 {
-                let _ = write!(attrs, " callout=\"{}\"", cl.iter().map(|v| n(*v)).collect::<Vec<_>>().join(","));
-                let rd = nums_of(doc, d.get(b"RD"));
-                if rd.len() == 4 {
-                    let _ = write!(attrs, " fringe=\"{}\"", rd.iter().map(|v| n(*v)).collect::<Vec<_>>().join(","));
-                }
-                if let Some(it) = d.get(b"IT").map(|o| doc.resolve(o)).and_then(|o| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned())) {
-                    let _ = write!(attrs, " intent=\"{}\"", esc(&it));
-                }
-                if let Some(le) = d.get(b"LE").map(|o| doc.resolve(o)).and_then(|o| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned())) {
-                    let _ = write!(attrs, " head=\"{}\"", esc(&le));
-                }
-            }
-            if let Some(irt) = d.get(b"IRT").and_then(Object::as_ref).and_then(|r| names.get(&r)) {
-                let _ = write!(attrs, " inreplyto=\"{}\"", esc(irt));
-            }
-            let _ = write!(out, "<{tag}{attrs}>");
-            if let Some(c) = text_of(doc, &d, b"Contents") {
-                let _ = write!(out, "<contents>{}</contents>", esc(&c));
-            }
-            if let Some(da) = text_of(doc, &d, b"DA") {
-                let _ = write!(out, "<defaultappearance>{}</defaultappearance>", esc(&da));
-            }
-            let ink = d.get(b"InkList").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
-            if !ink.is_empty() {
-                out.push_str("<inklist>");
-                for g in ink {
-                    let v = nums_of(doc, Some(&g));
-                    let pts: Vec<String> = v.as_chunks::<2>().0.iter().map(|p| format!("{},{}", n(p[0]), n(p[1]))).collect();
-                    let _ = write!(out, "<gesture>{}</gesture>", pts.join(";"));
-                }
-                out.push_str("</inklist>");
-            }
-            // Polygon and polyline points (XFDF `<vertices>`: `x,y;x,y;…`).
-            let vertices = nums_of(doc, d.get(b"Vertices"));
-            let pts: Vec<String> = vertices.as_chunks::<2>().0.iter().map(|p| format!("{},{}", n(p[0]), n(p[1]))).collect();
-            if !pts.is_empty() {
-                let _ = write!(out, "<vertices>{}</vertices>", pts.join(";"));
-            }
-            if let Some(pd) = d.get(b"Popup").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()) {
-                let r = nums_of(doc, pd.get(b"Rect"));
-                if r.len() == 4 {
-                    let open = matches!(pd.get(b"Open"), Some(Object::Bool(true)));
-                    let _ = write!(
-                        out,
-                        "<popup page=\"{pi}\" rect=\"{},{},{},{}\" open=\"{}\"/>",
-                        n(r[0]),
-                        n(r[1]),
-                        n(r[2]),
-                        n(r[3]),
-                        if open { "yes" } else { "no" }
-                    );
-                }
-            }
-            let _ = writeln!(out, "</{tag}>");
-        }
-    }
-}
-
-/// Field values as nested XFDF `<field>` elements.
-fn xfdf_fields(doc: &Document, out: &mut String) {
-    #[derive(Default)]
-    struct Node {
-        values: Vec<String>,
-        kids: Vec<(String, Node)>,
-    }
-    let mut root = Node::default();
-    for f in pdfcraft_forms::fields(doc) {
-        if matches!(f.kind, FieldKind::PushButton | FieldKind::Signature) {
-            continue;
-        }
-        let mut node = &mut root;
-        // One `<field>` level per part of the name, but no more levels than the import reads
-        // back. A `/T` can hold periods of its own, so a name can split into far more parts than
-        // the field tree has levels: nesting every part wrote a file the import refuses and, for
-        // a long enough name, recursed in `write_node` until the stack overflowed. The parts past
-        // the last level stay together in the deepest element's name, and the import joins them
-        // back with periods into the same full name.
-        for part in f.name.splitn(MAX_DEPTH, '.') {
-            let i = match node.kids.iter().position(|(k, _)| k == part) {
-                Some(i) => i,
-                None => {
-                    node.kids.push((part.to_string(), Node::default()));
-                    node.kids.len() - 1
-                }
-            };
-            node = &mut node.kids[i].1;
-        }
-        node.values = match f.kind {
-            FieldKind::CheckBox | FieldKind::Radio if f.value.is_empty() => vec!["Off".into()],
-            _ => f.value.clone(),
-        };
-    }
-    fn write_node(name: &str, node: &Node, out: &mut String) {
-        let _ = write!(out, "<field name=\"{}\">", esc(name));
-        for v in &node.values {
-            let _ = write!(out, "<value>{}</value>", esc(v));
-        }
-        for (k, kid) in &node.kids {
-            write_node(k, kid, out);
-        }
-        out.push_str("</field>\n");
-    }
-    for (k, kid) in &root.kids {
-        write_node(k, kid, out);
-    }
-}
-
-/// XFDF with the document's comments and/or field values.
-pub fn export_xfdf(doc: &Document, comments: bool, fields: bool, file: &str) -> String {
-    let mut out = String::from("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<xfdf xmlns=\"http://ns.adobe.com/xfdf/\" xml:space=\"preserve\">\n");
-    if comments {
-        out.push_str("<annots>\n");
-        xfdf_annots(doc, &mut out);
-        out.push_str("</annots>\n");
-    }
-    if fields {
-        out.push_str("<fields>\n");
-        xfdf_fields(doc, &mut out);
-        out.push_str("</fields>\n");
-    }
-    let _ = writeln!(out, "<f href=\"{}\"/>", esc(file));
-    out.push_str("</xfdf>\n");
-    out
-}
-
-fn pdf_string(s: &str) -> Vec<u8> {
-    let mut v = Vec::new();
-    pdfcraft_cos::serialize(&Object::String(PdfString::text(s)), &mut v);
-    v
-}
-
-// Keep aliases as aliases instead of expanding a shared graph once per use. References are
-// queued, not followed recursively, so cycles and long indirect chains cost linear work.
-const MAX_FDF_OBJECTS: usize = 100_000;
-const MAX_FDF_BYTES: usize = 64 * 1024 * 1024;
-
-/// Direct values stay borrowed: `Document::resolve` would deep-clone them. Only
-/// indirect values need an owner, and annotation bodies are never retained in discovery.
-enum FdfValue<'a> {
-    Borrowed(&'a Object),
-    Indirect(std::sync::Arc<Object>),
-}
-
-impl<'a> FdfValue<'a> {
-    fn resolve(doc: &Document, value: &'a Object) -> Self {
-        match value {
-            Object::Ref(_) => Self::Indirect(doc.resolve(value)),
-            _ => Self::Borrowed(value),
-        }
-    }
-
-    fn object(&self) -> &Object {
-        match self {
-            Self::Borrowed(value) => value,
-            Self::Indirect(value) => value.as_ref(),
-        }
-    }
-}
-
-struct FdfCopy<'a> {
-    doc: &'a Document,
-    objects: Vec<Object>,
-    numbers: HashMap<ObjRef, u32>,
-    pending: Vec<(ObjRef, usize)>,
-    nodes: usize,
-    bytes: usize,
-}
-
-impl<'a> FdfCopy<'a> {
-    fn new(doc: &'a Document) -> Self {
-        Self { doc, objects: Vec::new(), numbers: HashMap::new(), pending: Vec::new(), nodes: MAX_FDF_OBJECTS, bytes: MAX_FDF_BYTES }
-    }
-
-    fn charge(&mut self, bytes: usize) -> Result<(), DataError> {
-        self.bytes = self.bytes.checked_sub(bytes).ok_or(DataError::ExportLimit("64 MiB data"))?;
-        Ok(())
-    }
-
-    fn slot(&mut self) -> Result<(usize, u32), DataError> {
-        if self.objects.len() >= MAX_FDF_OBJECTS {
-            return Err(DataError::ExportLimit("100,000 objects"));
-        }
-        // Object 1 is the FDF root; arena indices start at object 2. The arena is capped above.
-        let index = self.objects.len();
-        let number = index as u32 + 2;
-        self.charge(100)?; // indirect-object and xref overhead
-        self.objects.push(Object::Null);
-        Ok((index, number))
-    }
-
-    fn dict(&mut self, dict: &Dict, depth: usize) -> Result<Dict, DataError> {
-        if dict.len() > self.nodes {
-            return Err(DataError::ExportLimit("100,000 values"));
-        }
-        let mut out = Dict::new();
-        for (key, value) in dict.iter() {
-            self.dict_entry(&mut out, key, value, depth + 1)?;
-        }
-        Ok(out)
-    }
-
-    fn dict_entry(&mut self, out: &mut Dict, key: &[u8], value: &Object, depth: usize) -> Result<(), DataError> {
-        self.charge(key.len().saturating_mul(3).saturating_add(2))?;
-        let value = self.copy(value, depth)?;
-        out.set(key.to_vec(), value);
-        Ok(())
-    }
-
-    /// Skip source-document links and appearances without cloning their values. The
-    /// dictionary and every retained entry are charged before any owned copy is made.
-    fn annotation_dict(&mut self, dict: &Dict) -> Result<Dict, DataError> {
-        self.charge_value(0)?;
-        let mut out = Dict::new();
-        for (key, value) in dict.iter() {
-            if matches!(key.as_slice(), b"P" | b"AP" | b"Popup" | b"IRT" | b"Parent" | b"FS" | b"Sound") {
-                continue;
-            }
-            self.dict_entry(&mut out, key, value, 1)?;
-        }
-        Ok(out)
-    }
-
-    fn charge_value(&mut self, depth: usize) -> Result<(), DataError> {
-        if depth > MAX_DEPTH {
-            return Err(DataError::ExportLimit("64 direct nesting levels"));
-        }
-        self.nodes = self.nodes.checked_sub(1).ok_or(DataError::ExportLimit("100,000 values"))?;
-        // Includes delimiters, spacing and even the longest finite f64 in plain decimal form.
-        self.charge(330)?;
-        Ok(())
-    }
-
-    fn is_source_page(&self, dict: &Dict) -> Result<bool, DataError> {
-        let Some(value) = dict.get(b"Type") else { return Ok(false) };
-        let mut value = FdfValue::Borrowed(value);
-        let mut seen = HashSet::new();
-        for hops in 0..=MAX_DEPTH {
-            match value.object() {
-                Object::Name(name) => return Ok(matches!(name.as_slice(), b"Page" | b"Pages")),
-                Object::Ref(reference) => {
-                    if self.doc.generation(reference.num) != reference.generation || !seen.insert(*reference) {
-                        return Ok(false);
-                    }
-                    if hops == MAX_DEPTH {
-                        return Err(DataError::ExportLimit("64 Type reference levels"));
-                    }
-                    value = FdfValue::Indirect(self.doc.get(*reference));
-                }
-                _ => return Ok(false),
-            }
-        }
-        Err(DataError::ExportLimit("64 Type reference levels"))
-    }
-
-    fn copy(&mut self, value: &Object, depth: usize) -> Result<Object, DataError> {
-        self.charge_value(depth)?;
-        Ok(match value {
-            Object::Ref(source) => {
-                let number = if let Some(number) = self.numbers.get(source) {
-                    *number
-                } else {
-                    let (index, number) = self.slot()?;
-                    self.numbers.insert(*source, number);
-                    self.pending.push((*source, index));
-                    number
-                };
-                Object::Ref(ObjRef::new(number, 0))
-            }
-            Object::Array(values) => {
-                if values.len() > self.nodes {
-                    return Err(DataError::ExportLimit("100,000 values"));
-                }
-                let mut out = Vec::new();
-                for value in values {
-                    out.push(self.copy(value, depth + 1)?);
-                }
-                Object::Array(out)
-            }
-            // Source page links must not drag page contents or the page tree into an FDF.
-            Object::Dict(dict) if self.is_source_page(dict)? => Object::Null,
-            Object::Dict(dict) => Object::Dict(self.dict(dict, depth)?),
-            Object::String(s) => {
-                self.charge(s.bytes.len().saturating_mul(4))?;
-                value.clone()
-            }
-            Object::Name(name) => {
-                self.charge(name.len().saturating_mul(3))?;
-                value.clone()
-            }
-            // A PDF stream can only be an indirect object, never a dictionary/array value.
-            Object::Stream(_) => return Err(DataError::Malformed("FDF export encountered a direct stream".into())),
-            other => other.clone(),
-        })
-    }
-
-    fn finish(&mut self, doc: &Document) -> Result<(), DataError> {
-        let mut cursor = 0;
-        while let Some((source, index)) = self.pending.get(cursor).copied() {
-            // ISO 32000-2 §7.3.10: an absent or stale reference denotes null. Keep reader
-            // errors distinct so damaged objects cannot be silently lost during export.
-            let value = if doc.generation(source.num) != source.generation {
-                std::sync::Arc::new(Object::Null)
-            } else {
-                match doc.try_get(source.num) {
-                    Ok(value) => value,
-                    Err(pdfcraft_cos::CosError::MissingObject(_)) => std::sync::Arc::new(Object::Null),
-                    Err(error) => return Err(error.into()),
-                }
-            };
-            let copied = match &*value {
-                Object::Stream(stream) => {
-                    self.charge(stream.raw.len())?;
-                    Object::Stream(pdfcraft_cos::Stream { dict: self.dict(&stream.dict, 0)?, raw: stream.raw.clone() })
-                }
-                other => self.copy(other, 0)?,
-            };
-            let slot = self.objects.get_mut(index).ok_or_else(|| DataError::Malformed("FDF object slot is missing".into()))?;
-            *slot = copied;
-            cursor += 1;
-        }
-        Ok(())
-    }
-}
-
-/// FDF with field values and/or comments (appearances are not carried). Each comment is an
-/// indirect object of the FDF, so a reply's `/IRT` can point at its parent's object there
-/// (§12.7.8.3.1). Nested values are copied and renumbered, including shared or cyclic graphs.
-/// Source `/Page` and `/Pages` dictionaries become null at every copy depth.
-/// Refuses exports above the object, value, direct-depth or data budget instead of losing data.
-pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> Result<Vec<u8>, DataError> {
-    let mut copy = FdfCopy::new(doc);
-    copy.charge(file.len().saturating_mul(8))?;
-    let mut body: Vec<u8> = b"<< /FDF << ".to_vec();
-    // Comment dictionaries, written after the root as objects 2, 3, …
-    if fields {
-        body.extend_from_slice(b"/Fields [");
-        for f in pdfcraft_forms::fields(doc) {
-            if matches!(f.kind, FieldKind::PushButton | FieldKind::Signature) {
-                continue;
-            }
-            // Field dictionary, /T string and /V scalar/array, plus every emitted list
-            // entry. Other field kinds emit only their first value (or a default).
-            let field_nodes = if matches!(f.kind, FieldKind::List) && f.value.len() > 1 { f.value.len().saturating_add(3) } else { 3 };
-            copy.nodes = copy.nodes.checked_sub(field_nodes).ok_or(DataError::ExportLimit("100,000 values"))?;
-            copy.charge(f.name.len().saturating_mul(8).saturating_add(100))?;
-            for value in &f.value {
-                copy.charge(value.len().saturating_mul(8).saturating_add(100))?;
-            }
-            body.extend_from_slice(b"<< /T ");
-            body.extend(pdf_string(&f.name));
-            body.extend_from_slice(b" /V ");
-            match f.kind {
-                FieldKind::CheckBox | FieldKind::Radio => {
-                    let v = f.value.first().cloned().unwrap_or_else(|| "Off".into());
-                    pdfcraft_cos::serialize(&Object::Name(pdfcraft_forms::name_bytes(&v)), &mut body);
-                }
-                FieldKind::List if f.value.len() > 1 => {
-                    pdfcraft_cos::serialize(&Object::Array(f.value.iter().map(|v| Object::String(PdfString::text(v))).collect()), &mut body);
-                }
-                _ => body.extend(pdf_string(f.value.first().map(String::as_str).unwrap_or(""))),
-            }
-            body.extend_from_slice(b" >> ");
-        }
-        body.extend_from_slice(b"] ");
-    }
-    if comments {
-        // Keep the page/array owners once. Handles retain positions, never annotation
-        // bodies: the document cache can evict and reparse even a repeated source reference.
-        let pages = pdfcraft_model::pages(doc);
-        let mut arrays = Vec::new();
-        let mut picked: Vec<(Option<ObjRef>, usize, usize)> = Vec::new();
-        for (pi, page) in pages.iter().enumerate() {
-            let owner = page.dict.get(b"Annots").map(|value| FdfValue::resolve(doc, value));
-            let before = picked.len();
-            if let Some(values) = owner.as_ref().and_then(|owner| owner.object().as_array()) {
-                for (ai, a) in values.iter().enumerate() {
-                    let value = FdfValue::resolve(doc, a);
-                    let Some(d) = value.object().as_dict() else { continue };
-                    if d.name(b"Subtype").is_some_and(|sub| SUBTYPES.iter().any(|(s, _)| s.as_bytes() == sub)) {
-                        if picked.len() >= MAX_FDF_OBJECTS {
-                            return Err(DataError::ExportLimit("100,000 comments"));
-                        }
-                        picked.push((a.as_ref(), pi, ai));
-                    }
-                }
-            }
-            // Empty/unselected arrays need no owner. Resolve subsequent pages only after
-            // this page passes the cap, rather than loading them all before discovery.
-            arrays.push(if picked.len() > before { owner } else { None });
-        }
-        let mut numbers = HashMap::new();
-        for (source, _, _) in &picked {
-            let (_, number) = copy.slot()?;
-            if let Some(source) = source {
-                numbers.insert(*source, number);
-            }
-        }
-        copy.numbers = numbers.clone();
-        let count = picked.len();
-        for (index, (_, pi, ai)) in picked.into_iter().enumerate() {
-            let annotation = arrays
-                .get(pi)
-                .and_then(Option::as_ref)
-                .and_then(|owner| owner.object().as_array())
-                .and_then(|values| values.get(ai))
-                .ok_or_else(|| DataError::Malformed("FDF annotation slot is missing".into()))?;
-            let value = FdfValue::resolve(doc, annotation);
-            let d = value.object().as_dict().ok_or_else(|| DataError::Malformed("FDF comment is not a dictionary".into()))?;
-            // A reply points at its parent's object in this FDF; a parent that isn't exported
-            // leaves the reply unthreaded.
-            let irt = d.get(b"IRT").and_then(Object::as_ref).and_then(|r| numbers.get(&r)).copied();
-            let mut d = copy.annotation_dict(d)?;
-            if let Some(num) = irt {
-                d.set(b"IRT".to_vec(), Object::Ref(ObjRef::new(num, 0)));
-            }
-            d.set(b"Page".to_vec(), Object::Int(pi as i64));
-            let slot = copy.objects.get_mut(index).ok_or_else(|| DataError::Malformed("FDF comment slot is missing".into()))?;
-            *slot = Object::Dict(d);
-        }
-        body.extend_from_slice(b"/Annots [");
-        for i in 0..count {
-            let _ = write!(body, "{} 0 R ", i + 2);
-        }
-        body.extend_from_slice(b"] ");
-    }
-    body.extend_from_slice(b"/F ");
-    body.extend(pdf_string(file));
-    body.extend_from_slice(b" >> >>");
-    copy.finish(doc)?;
-    let mut out = b"%FDF-1.2\n%\xE2\xE3\xCF\xD3\n".to_vec();
-    let mut offsets = Vec::with_capacity(copy.objects.len() + 1);
-    offsets.push(out.len());
-    out.extend_from_slice(b"1 0 obj\n");
-    out.extend(body);
-    out.extend_from_slice(b"\nendobj\n");
-    for (i, object) in copy.objects.into_iter().enumerate() {
-        offsets.push(out.len());
-        let _ = writeln!(out, "{} 0 obj", i + 2);
-        pdfcraft_cos::serialize(&object, &mut out);
-        out.extend_from_slice(b"\nendobj\n");
-    }
-    let xref = out.len();
-    let _ = write!(out, "xref\n0 {}\n0000000000 65535 f \n", offsets.len() + 1);
-    for o in offsets {
-        let _ = writeln!(out, "{o:010} 00000 n ");
-    }
-    let _ = write!(out, "trailer\n<< /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n");
-    Ok(out)
-}
-/// XML 1.0 fifth-edition NameStartChar, excluding `:` for an unprefixed NCName.
-/// https://www.w3.org/TR/2008/REC-xml-20081126/#NT-NameStartChar
-fn xml_name_start(c: char) -> bool {
-    matches!(
-        c,
-        '_' | 'A'..='Z' | 'a'..='z'
-            | '\u{C0}'..='\u{D6}' | '\u{D8}'..='\u{F6}' | '\u{F8}'..='\u{2FF}'
-            | '\u{370}'..='\u{37D}' | '\u{37F}'..='\u{1FFF}'
-            | '\u{200C}'..='\u{200D}' | '\u{2070}'..='\u{218F}'
-            | '\u{2C00}'..='\u{2FEF}' | '\u{3001}'..='\u{D7FF}'
-            | '\u{F900}'..='\u{FDCF}' | '\u{FDF0}'..='\u{FFFD}'
-            | '\u{10000}'..='\u{EFFFF}'
-    )
-}
-
-fn xml_name_char(c: char) -> bool {
-    xml_name_start(c) || matches!(c, '-' | '.' | '0'..='9' | '\u{B7}' | '\u{300}'..='\u{36F}' | '\u{203F}'..='\u{2040}')
-}
-
-/// Keep the existing letters/digits/`_`/`-`/`.` normalization, constrained to valid NCNames.
-fn xml_name(name: &str) -> String {
-    let mut s: String =
-        name.chars().map(|c| if (c.is_alphanumeric() && xml_name_char(c)) || matches!(c, '_' | '-' | '.') { c } else { '_' }).collect();
-    if !s.chars().next().is_some_and(|c| (c.is_alphabetic() && xml_name_start(c)) || c == '_') {
-        s.insert(0, '_');
-    }
-    s
-}
-
 /// Form data as XML, CSV or tab-delimited text (Acrobat's Export data formats).
 pub fn export_data(doc: &Document, format: Format) -> String {
     let fields: Vec<(String, String)> = pdfcraft_forms::fields(doc)
@@ -880,473 +130,6 @@ pub fn export_data(doc: &Document, format: Format) -> String {
     }
 }
 
-// ── import ──────────────────────────────────────────────────────────────────────────────────
-
-/// Set the values of fields named in `values` (full names), counting what took.
-fn apply_values(doc: &mut Document, values: &[(String, Vec<String>)], report: &mut Report) {
-    let all = pdfcraft_forms::fields(doc);
-    for (name, vals) in values {
-        let Some(f) = all.iter().find(|f| &f.name == name) else { continue };
-        let first = vals.first().cloned().unwrap_or_default();
-        let v = match f.kind {
-            FieldKind::Text => FieldValue::Text(first),
-            FieldKind::CheckBox => FieldValue::Check(!first.is_empty() && first != "Off"),
-            FieldKind::Radio => FieldValue::Radio((!first.is_empty() && first != "Off").then_some(first)),
-            // XML, CSV and text hold a multi-select list's values in one cell, joined by ", "
-            // (as export_data writes them); split it unless the whole cell is one option.
-            FieldKind::List if f.has(pdfcraft_forms::flags::MULTI_SELECT) && vals.len() == 1 && !f.options.iter().any(|(e, _)| *e == first) => {
-                FieldValue::Choice(first.split(", ").filter(|v| !v.is_empty()).map(str::to_string).collect())
-            }
-            FieldKind::Combo | FieldKind::List => FieldValue::Choice(vals.iter().filter(|v| !v.is_empty()).cloned().collect()),
-            FieldKind::PushButton | FieldKind::Signature => continue,
-        };
-        // Read-only fields still take imported data, as in Acrobat.
-        let ro = f.read_only();
-        if ro {
-            let _ = doc.update_dict(f.obj, |d| d.set(b"Ff".to_vec(), Object::Int((f.flags & !pdfcraft_forms::flags::READ_ONLY) as i64)));
-        }
-        match pdfcraft_forms::set_value(doc, name, &v) {
-            Ok(()) => report.fields += 1,
-            Err(_) => report.rejected.push(name.clone()),
-        }
-        if ro {
-            let _ = doc.update_dict(f.obj, |d| d.set(b"Ff".to_vec(), Object::Int(f.flags as i64)));
-        }
-    }
-}
-
-/// A new annotation dictionary from an XFDF element.
-fn annot_from_xml(node: roxmltree::Node, subtype: &str, page_ref: ObjRef) -> Option<Dict> {
-    let mut d = Dict::new();
-    d.set(b"Type".to_vec(), Object::name("Annot"));
-    d.set(b"Subtype".to_vec(), Object::name(subtype));
-    d.set(b"P".to_vec(), Object::Ref(page_ref));
-    let rect = csv(node.attribute("rect")?);
-    if rect.len() != 4 {
-        return None;
-    }
-    d.set(b"Rect".to_vec(), arr(&rect));
-    for (attr, key) in [
-        ("name", &b"NM"[..]),
-        ("title", b"T"),
-        ("subject", b"Subj"),
-        ("date", b"M"),
-        ("creationdate", b"CreationDate"),
-        ("state", b"State"),
-        ("statemodel", b"StateModel"),
-    ] {
-        if let Some(v) = node.attribute(attr) {
-            d.set(key.to_vec(), PdfString::text(v));
-        }
-    }
-    if let Some(v) = node.attribute("replyType") {
-        d.set(b"RT".to_vec(), Object::name(if v.eq_ignore_ascii_case("group") { "Group" } else { "R" }));
-    }
-    if let Some(v) = node.attribute("icon") {
-        d.set(b"Name".to_vec(), Object::name(v));
-    }
-    let flags: i64 = node
-        .attribute("flags")
-        .unwrap_or("print")
-        .split(',')
-        .filter_map(|f| FLAGS.iter().find(|(_, s)| s.eq_ignore_ascii_case(f.trim())).map(|x| x.0))
-        .fold(0, |bits, flag| bits | flag);
-    d.set(b"F".to_vec(), Object::Int(flags));
-    if let Some(c) = node.attribute("color").and_then(parse_hex) {
-        d.set(b"C".to_vec(), arr(&c));
-    }
-    if let Some(c) = node.attribute("interior-color").and_then(parse_hex) {
-        d.set(b"IC".to_vec(), arr(&c));
-    }
-    if let Some(o) = node.attribute("opacity").and_then(|o| o.parse::<f64>().ok()) {
-        d.set(b"CA".to_vec(), Object::Real(o.clamp(0.0, 1.0)));
-    }
-    if let Some(w) = node.attribute("width").and_then(|w| w.parse::<f64>().ok()) {
-        let mut bs = Dict::new();
-        bs.set(b"W".to_vec(), Object::Real(w.max(0.0)));
-        bs.set(b"S".to_vec(), Object::name("S"));
-        d.set(b"BS".to_vec(), Object::Dict(bs));
-    }
-    if let Some(q) = node.attribute("coords") {
-        d.set(b"QuadPoints".to_vec(), arr(&csv(q)));
-    }
-    if let (Some(s), Some(e)) = (node.attribute("start"), node.attribute("end")) {
-        let (s, e) = (csv(s), csv(e));
-        if s.len() == 2 && e.len() == 2 {
-            d.set(b"L".to_vec(), arr(&[s[0], s[1], e[0], e[1]]));
-        }
-    }
-    if node.attribute("head").is_some() || node.attribute("tail").is_some() {
-        d.set(
-            b"LE".to_vec(),
-            Object::Array(vec![Object::name(node.attribute("head").unwrap_or("None")), Object::name(node.attribute("tail").unwrap_or("None"))]),
-        );
-    }
-    if let Some(cl) = node.attribute("callout").map(csv).filter(|c| c.len() == 4 || c.len() == 6) {
-        d.set(b"CL".to_vec(), arr(&cl));
-        if let Some(rd) = node.attribute("fringe").map(csv).filter(|r| r.len() == 4) {
-            d.set(b"RD".to_vec(), arr(&rd));
-        }
-        d.set(b"IT".to_vec(), Object::name(node.attribute("intent").unwrap_or("FreeTextCallout")));
-        // A callout's /LE is one name, not the head/tail pair of a line.
-        match node.attribute("head") {
-            Some(h) => d.set(b"LE".to_vec(), Object::name(h)),
-            None => {
-                d.remove(b"LE");
-            }
-        }
-    }
-    for child in node.children().filter(|c| c.is_element()) {
-        match child.tag_name().name() {
-            "contents" => {
-                d.set(b"Contents".to_vec(), PdfString::text(&child.text().unwrap_or("").replace("\r\n", "\r").replace('\n', "\r")));
-            }
-            "defaultappearance" => {
-                d.set(b"DA".to_vec(), PdfString::literal(child.text().unwrap_or("").as_bytes().to_vec()));
-            }
-            "inklist" => {
-                let list: Vec<Object> = child
-                    .children()
-                    .filter(|g| g.has_tag_name("gesture"))
-                    .map(|g| arr(&g.text().unwrap_or("").split(';').flat_map(|p| csv(p).into_iter()).collect::<Vec<_>>()))
-                    .collect();
-                d.set(b"InkList".to_vec(), Object::Array(list));
-            }
-            "vertices" => {
-                // Whole x,y pairs only; a stray trailing number is dropped.
-                let mut v = csv(child.text().unwrap_or(""));
-                v.truncate(v.len() - v.len() % 2);
-                if !v.is_empty() {
-                    d.set(b"Vertices".to_vec(), arr(&v));
-                }
-            }
-            _ => {}
-        }
-    }
-    Some(d)
-}
-
-/// Put an annotation dictionary on a page, replacing one with the same `/NM`. Returns its
-/// reference.
-/// `/F` bits an imported file may not set on a redaction mark: Invisible, Hidden, NoView — so a
-/// mark it brings in is always drawn for the user to review before content is removed.
-const REDACT_UNSEEN: i64 = 1 | 2 | 32;
-/// `/F` Locked (ISO 32000-2 Table 167): the user protected this annotation from change.
-const LOCKED: i64 = 128;
-
-/// An existing annotation an import must never replace, move or unlock: one the user locked, a
-/// redaction mark (replacing it would drop the region the user marked to remove), or a form
-/// widget or field (replacing it would set the field's value and policy around the form setter).
-fn import_protected(doc: &Document, x: &Dict) -> bool {
-    let flags = x.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
-    flags & LOCKED != 0 || matches!(x.name(b"Subtype"), Some(b"Redact" | b"Widget")) || x.contains(b"FT")
-}
-
-fn place(doc: &mut Document, page_ref: ObjRef, mut d: Dict) -> Result<ObjRef, DataError> {
-    // A redaction mark the import carries is always made visible: clear any Invisible/Hidden/NoView
-    // flag so it cannot remove content the user never sees.
-    if d.name(b"Subtype") == Some(b"Redact".as_slice()) {
-        let f = d.int(b"F").unwrap_or(0);
-        if f & REDACT_UNSEEN != 0 {
-            d.set(b"F".to_vec(), Object::Int(f & !REDACT_UNSEEN));
-        }
-        // Its review outline is drawn opaque, and from the area it removes: applying a mark
-        // without usable /QuadPoints removes its /Rect, which the outline is then drawn from.
-        d.remove(b"CA");
-        d.remove(b"ca");
-        let quads_drawable = d.get(b"QuadPoints").and_then(Object::as_array).is_some_and(|q| {
-            let v: Vec<f64> = q.iter().filter_map(Object::as_f64).filter(|v| v.is_finite()).collect();
-            let (quads, rest) = v.as_chunks::<8>();
-            v.len() == q.len() && rest.is_empty() && !quads.is_empty() && quads.iter().all(quad_has_area)
-        });
-        if !quads_drawable {
-            // Quads the outline can't draw, or any quad that encloses no area, are replaced by the
-            // /Rect's, or dropped when there is no usable /Rect either; such a mark then removes
-            // nothing.
-            match rect_strict(doc, d.get(b"Rect")) {
-                Some([x0, y0, x1, y1]) => {
-                    let (l, r, b, t) = (x0.min(x1), x0.max(x1), y0.min(y1), y0.max(y1));
-                    d.set(b"QuadPoints".to_vec(), arr(&[l, t, r, t, l, b, r, b]));
-                }
-                _ => {
-                    d.remove(b"QuadPoints");
-                }
-            }
-        }
-    }
-    let nm = d.get(b"NM").and_then(|n| n.as_string().map(|s| s.to_text()));
-    let annots: Vec<Object> = doc
-        .get(page_ref)
-        .as_dict()
-        .and_then(|p| p.get(b"Annots").cloned())
-        .map(|a| doc.resolve(&a))
-        .and_then(|a| a.as_array().cloned())
-        .unwrap_or_default();
-    let mut kept = Vec::new();
-    let mut removed: Vec<ObjRef> = Vec::new();
-    // Never let a same-name import replace a protected annotation (`import_protected`): keep it,
-    // and add the imported dict beside it under no name of its own.
-    let mut clash = false;
-    for a in annots {
-        let existing = a.as_ref().and_then(|r| doc.get(r).as_dict().cloned());
-        let same = nm.is_some() && existing.as_ref().and_then(|x| x.get(b"NM").and_then(|n| doc.resolve(n).as_string().map(|s| s.to_text()))) == nm;
-        if same && existing.as_ref().is_some_and(|x| import_protected(doc, x)) {
-            clash = true;
-            kept.push(a);
-        } else if same {
-            removed.extend(a.as_ref());
-        } else {
-            kept.push(a);
-        }
-    }
-    if clash {
-        d.remove(b"NM");
-    }
-    // The replaced note's pop-up goes with it; otherwise it stays on the page pointing at a note that is no longer there.
-    kept.retain(|a| {
-        let Some(x) = a.as_ref().map(|r| doc.get(r)).and_then(|o| o.as_dict().cloned()) else { return true };
-        x.name(b"Subtype") != Some(b"Popup".as_slice()) || x.reference(b"Parent").is_none_or(|p| !removed.contains(&p))
-    });
-    // Keep the replaced comment's identity: replies and review statuses not included in a
-    // partial import still point at it through /IRT. Allocating a new object would detach
-    // those comments and leave their parent outside the page's annotation list.
-    let r = match removed.first().copied() {
-        Some(r) => {
-            doc.set(r, Object::Dict(d));
-            r
-        }
-        None => doc.add(Object::Dict(d)),
-    };
-    // Our own appearance where we can draw one; others keep none (viewers draw a default).
-    let _ = pdfcraft_annot::set_appearance(doc, r);
-    kept.push(Object::Ref(r));
-    doc.update_dict(page_ref, |p| p.set(b"Annots".to_vec(), Object::Array(kept)))?;
-    Ok(r)
-}
-
-fn import_xfdf(doc: &mut Document, text: &str) -> Result<Report, DataError> {
-    check_form_xml_depth(text)?;
-    let xml = parse_form_xml(text).map_err(|e| DataError::Malformed(e.to_string()))?;
-    let root = xml.root_element();
-    if root.tag_name().name() != "xfdf" {
-        return Err(DataError::UnknownFormat);
-    }
-    let mut report = Report::default();
-    let pages: Vec<ObjRef> = pdfcraft_model::pages(doc).iter().map(|p| p.obj).collect();
-    // Comments: parents first, then replies (whose /IRT needs the parent's reference).
-    let mut by_name: HashMap<String, ObjRef> = HashMap::new();
-    let mut later: HashMap<ObjRef, String> = HashMap::new();
-    if let Some(annots) = root.children().find(|c| c.has_tag_name("annots")) {
-        for node in annots.children().filter(|c| c.is_element()) {
-            let tag = node.tag_name().name().to_ascii_lowercase();
-            let Some((subtype, _)) = SUBTYPES.iter().find(|(_, t)| *t == tag) else { continue };
-            let Some(page) = node.attribute("page").and_then(|p| p.parse::<usize>().ok()).and_then(|p| pages.get(p).copied()) else { continue };
-            let Some(d) = annot_from_xml(node, subtype, page) else { continue };
-            let r = place(doc, page, d)?;
-            // A later same-name record replaces this comment, including its reply relation.
-            later.remove(&r);
-            if let Some(nm) = node.attribute("name") {
-                by_name.insert(nm.to_string(), r);
-            }
-            if let Some(irt) = node.attribute("inreplyto") {
-                later.insert(r, irt.to_string());
-            }
-            // A pop-up window.
-            if let Some(pop) = node.children().find(|c| c.has_tag_name("popup"))
-                && let Some(rect) = pop.attribute("rect").map(csv).filter(|r| r.len() == 4)
-            {
-                let mut p = Dict::new();
-                p.set(b"Type".to_vec(), Object::name("Annot"));
-                p.set(b"Subtype".to_vec(), Object::name("Popup"));
-                p.set(b"Rect".to_vec(), arr(&rect));
-                p.set(b"Parent".to_vec(), Object::Ref(r));
-                p.set(b"Open".to_vec(), Object::Bool(pop.attribute("open") == Some("yes")));
-                let pr = doc.add(Object::Dict(p));
-                doc.update_dict(r, |d| d.set(b"Popup".to_vec(), Object::Ref(pr)))?;
-                doc.update_dict(page, |pd| {
-                    if let Some(Object::Array(a)) = pd.get_mut(b"Annots") {
-                        a.push(Object::Ref(pr));
-                    }
-                })?;
-            }
-            report.comments += 1;
-        }
-    }
-    for (r, irt) in later {
-        if let Some(parent) = by_name.get(&irt).copied().or_else(|| find_by_name(doc, &irt)) {
-            doc.update_dict(r, |d| d.set(b"IRT".to_vec(), Object::Ref(parent)))?;
-        }
-    }
-    // Fields.
-    if let Some(fields) = root.children().find(|c| c.has_tag_name("fields")) {
-        let mut values = Vec::new();
-        walk_xfdf(fields, "", &mut values, 0)?;
-        apply_values(doc, &values, &mut report);
-    }
-    Ok(report)
-}
-
-fn find_by_name(doc: &Document, nm: &str) -> Option<ObjRef> {
-    for p in pdfcraft_model::pages(doc) {
-        for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
-            if let Some(r) = a.as_ref()
-                && doc.get(r).as_dict().and_then(|d| text_of(doc, d, b"NM")).as_deref() == Some(nm)
-            {
-                return Some(r);
-            }
-        }
-    }
-    None
-}
-
-/// What one FDF import may copy out of the file. A field tree or comment that repeats a reference
-/// level after level would otherwise expand a small file into millions of values.
-const MAX_FDF_IMPORT_VALUES: usize = 1_000_000;
-
-struct ImportBudget {
-    values: usize,
-    bytes: usize,
-}
-
-impl ImportBudget {
-    fn new() -> Self {
-        Self { values: MAX_FDF_IMPORT_VALUES, bytes: MAX_FDF_BYTES }
-    }
-
-    fn spend(&mut self, values: usize, bytes: usize) -> Result<(), DataError> {
-        match (self.values.checked_sub(values), self.bytes.checked_sub(bytes)) {
-            (Some(v), Some(b)) => {
-                (self.values, self.bytes) = (v, b);
-                Ok(())
-            }
-            _ => Err(DataError::Malformed(format!(
-                "the file expands to more than {MAX_FDF_IMPORT_VALUES} values or {} MiB of text",
-                MAX_FDF_BYTES >> 20
-            ))),
-        }
-    }
-}
-
-/// Copy an object out of another document, resolving references. A reference back to an object
-/// being copied becomes null.
-fn deep(src: &Document, o: &Object, depth: usize, path: &mut Vec<ObjRef>, budget: &mut ImportBudget) -> Result<Object, DataError> {
-    budget.spend(1, 0)?;
-    if depth > 16 {
-        return Ok(Object::Null);
-    }
-    Ok(match o {
-        Object::Ref(r) => {
-            if path.contains(r) {
-                return Ok(Object::Null);
-            }
-            path.push(*r);
-            let copy = deep(src, &src.get(*r), depth + 1, path, budget);
-            path.pop();
-            copy?
-        }
-        Object::Array(a) => Object::Array(a.iter().map(|x| deep(src, x, depth + 1, path, budget)).collect::<Result<_, _>>()?),
-        Object::Dict(d) => {
-            Object::Dict(d.iter().map(|(k, v)| Ok((k.clone(), deep(src, v, depth + 1, path, budget)?))).collect::<Result<_, DataError>>()?)
-        }
-        Object::Stream(_) => Object::Null,
-        Object::String(s) => {
-            budget.spend(0, s.bytes.len())?;
-            o.clone()
-        }
-        Object::Name(n) => {
-            budget.spend(0, n.len())?;
-            o.clone()
-        }
-        other => other.clone(),
-    })
-}
-
-fn walk_xfdf(node: roxmltree::Node, prefix: &str, out: &mut Vec<(String, Vec<String>)>, depth: usize) -> Result<(), DataError> {
-    if depth > MAX_DEPTH {
-        return Err(DataError::Malformed(format!("XFDF fields nest more than {MAX_DEPTH} deep")));
-    }
-    for f in node.children().filter(|c| c.has_tag_name("field")) {
-        let Some(name) = f.attribute("name") else { continue };
-        let full = if prefix.is_empty() { name.to_string() } else { format!("{prefix}.{name}") };
-        let vals: Vec<String> = f
-            .children()
-            .filter(|c| c.has_tag_name("value"))
-            // Comments and processing instructions can split a value into several text nodes.
-            .map(|v| v.children().filter(|n| n.is_text()).filter_map(|n| n.text()).collect())
-            .collect();
-        if !vals.is_empty() {
-            out.push((full.clone(), vals));
-        }
-        walk_xfdf(f, &full, out, depth + 1)?;
-    }
-    Ok(())
-}
-
-/// Read an FDF field tree. A field listed again beneath itself is skipped.
-fn walk_fdf(
-    fdf: &Document,
-    list: &[Object],
-    prefix: &str,
-    out: &mut Vec<(String, Vec<String>)>,
-    depth: usize,
-    path: &mut Vec<ObjRef>,
-    budget: &mut ImportBudget,
-) -> Result<(), DataError> {
-    if depth > 32 {
-        return Ok(());
-    }
-    for f in list {
-        budget.spend(1, 0)?;
-        let held;
-        let field = match f {
-            Object::Ref(r) if path.contains(r) => continue,
-            Object::Ref(r) => {
-                held = fdf.get(*r);
-                &*held
-            }
-            direct => direct,
-        };
-        let Some(d) = field.as_dict() else { continue };
-        let Some(t) = d.get(b"T").and_then(|t| fdf.resolve(t).as_string().map(|s| s.to_text())) else { continue };
-        let full = if prefix.is_empty() { t } else { format!("{prefix}.{t}") };
-        budget.spend(0, full.len())?;
-        if let Some(v) = d.get(b"V").map(|v| fdf.resolve(v)) {
-            let vals: Vec<String> = match &*v {
-                Object::String(s) => vec![s.to_text()],
-                Object::Name(n) => vec![pdfcraft_forms::name_text(n)],
-                Object::Array(a) => {
-                    budget.spend(a.len(), 0)?;
-                    a.iter().filter_map(|x| fdf.resolve(x).as_string().map(|s| s.to_text())).collect()
-                }
-                _ => Vec::new(),
-            };
-            budget.spend(vals.len(), vals.iter().map(String::len).fold(0, usize::saturating_add))?;
-            out.push((full.clone(), vals));
-        }
-        if let Some(kids) = d.get(b"Kids").map(|k| fdf.resolve(k))
-            && let Some(kids) = kids.as_array()
-        {
-            let entered = f.as_ref().map(|r| path.push(r)).is_some();
-            let walked = walk_fdf(fdf, kids, &full, out, depth + 1, path, budget);
-            if entered {
-                path.pop();
-            }
-            walked?;
-        }
-    }
-    Ok(())
-}
-
-fn fdf_body(fdf: &Document) -> Result<Dict, DataError> {
-    let root = fdf.root().ok_or_else(|| DataError::Malformed("no /Root".into()))?;
-    fdf.get(root)
-        .as_dict()
-        .and_then(|d| d.get(b"FDF").cloned())
-        .map(|f| fdf.resolve(&f))
-        .and_then(|f| f.as_dict().cloned())
-        .ok_or(DataError::UnknownFormat)
-}
-
 /// The field values in a form data file (FDF or XFDF) or a filled-in PDF form, in file order.
 pub fn data_values(bytes: &[u8]) -> Result<Vec<(String, Vec<String>)>, DataError> {
     if bytes.starts_with(b"%FDF") {
@@ -1424,57 +207,6 @@ pub fn merge_csv(files: &[Vec<(String, Vec<String>)>]) -> String {
     out
 }
 
-fn import_fdf(doc: &mut Document, bytes: &[u8]) -> Result<Report, DataError> {
-    let fdf = Document::open(std::sync::Arc::new(bytes.to_vec())).map_err(|e| DataError::Malformed(e.to_string()))?;
-    let body = fdf_body(&fdf)?;
-    let mut report = Report::default();
-    let mut budget = ImportBudget::new();
-    // Fields (with /Kids for hierarchical names).
-    let mut values = Vec::new();
-    if let Some(list) = body.get(b"Fields").map(|f| fdf.resolve(f)).and_then(|f| f.as_array().cloned()) {
-        walk_fdf(&fdf, &list, "", &mut values, 0, &mut Vec::new(), &mut budget)?;
-    }
-    // Comments: parents first, then replies (whose /IRT needs the parent's new reference).
-    let pages: Vec<ObjRef> = pdfcraft_model::pages(doc).iter().map(|p| p.obj).collect();
-    let mut placed: HashMap<ObjRef, ObjRef> = HashMap::new();
-    let mut later: HashMap<ObjRef, (Option<ObjRef>, Option<String>)> = HashMap::new();
-    for a in body.get(b"Annots").map(|a| fdf.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
-        let Some(mut src) = fdf.resolve(&a).as_dict().cloned() else { continue };
-        // The parent is another comment: link it below rather than copying it in.
-        let irt = src.get(b"IRT").cloned();
-        src.remove(b"IRT");
-        let mut path: Vec<ObjRef> = a.as_ref().into_iter().collect();
-        let Object::Dict(mut d) = deep(&fdf, &Object::Dict(src), 0, &mut path, &mut budget)? else { continue };
-        let Some(page) = d.get(b"Page").and_then(Object::as_int).and_then(|p| usize::try_from(p).ok()).and_then(|p| pages.get(p).copied()) else {
-            continue;
-        };
-        if !d.name(b"Subtype").is_some_and(|s| SUBTYPES.iter().any(|(x, _)| x.as_bytes() == s)) {
-            continue;
-        }
-        d.remove(b"Page");
-        d.set(b"P".to_vec(), Object::Ref(page));
-        let r = place(doc, page, d)?;
-        later.remove(&r);
-        if let Some(fr) = a.as_ref() {
-            placed.insert(fr, r);
-        }
-        if let Some(irt) = irt {
-            let parent_name = fdf.resolve(&irt).as_dict().and_then(|p| text_of(&fdf, p, b"NM"));
-            later.insert(r, (irt.as_ref(), parent_name));
-        }
-        report.comments += 1;
-    }
-    for (r, (parent_obj, parent_name)) in later {
-        // The parent imported from this file, else one already in the document with its name.
-        let parent = parent_obj.and_then(|p| placed.get(&p).copied()).or_else(|| parent_name.and_then(|nm| find_by_name(doc, &nm)));
-        if let Some(parent) = parent.filter(|p| *p != r) {
-            doc.update_dict(r, |d| d.set(b"IRT".to_vec(), Object::Ref(parent)))?;
-        }
-    }
-    apply_values(doc, &values, &mut report);
-    Ok(report)
-}
-
 // Inspect the first logical record: tabs within quoted CSV cells are data. A quote
 // in the middle of an unquoted TSV name stays literal, as in the TSV reader.
 fn has_tab_delimiter(text: &str) -> bool {
diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs
index 80e7d8049d..2bb54f9232 100644
--- a/crates/xfdf/src/tests.rs
+++ b/crates/xfdf/src/tests.rs
@@ -1874,3 +1874,143 @@ fn a_comment_locked_by_an_indirect_flag_is_not_replaced_by_an_import() {
     assert!(annots.contains(&Object::Ref(note)), "the locked comment was replaced");
     assert_eq!(doc.get(note), before, "the locked comment was changed");
 }
+
+#[test]
+fn import_skips_annotations_with_non_finite_coordinates() {
+    for rect in ["nan,10,100,100", "0,inf,100,100", "0,10,infinity,100", "0,10,100,-inf"] {
+        let mut doc = blank();
+        let xfdf = format!(
+            r#"<xfdf xmlns="http://ns.adobe.com/xfdf/"><annots><square page="0" rect="0,0,50,50" name="good"/><square page="0" rect="{rect}" name="bad"/></annots></xfdf>"#
+        );
+        let r = import(&mut doc, xfdf.as_bytes()).unwrap();
+        assert_eq!(r.comments, 1, "rect {rect}: {r:?}");
+        let names = annots_of(&doc);
+        assert_eq!(names.len(), 1, "rect {rect}: {names:?}");
+        assert_eq!(names[0].get(b"NM"), Some(&PdfString::literal(b"good".to_vec()).into()), "rect {rect}");
+    }
+}
+
+#[test]
+fn import_drops_non_finite_numbers_from_every_coordinate_list() {
+    let xfdf = r#"<xfdf xmlns="http://ns.adobe.com/xfdf/"><annots>
+        <line page="0" rect="0,0,50,50" name="line" start="nan,0" end="10,10"/>
+        <polygon page="0" rect="0,0,50,50" name="poly"><vertices>1,2;inf,4;5,6</vertices></polygon>
+        <ink page="0" rect="0,0,50,50" name="ink"><inklist><gesture>1,2;3,-inf</gesture></inklist></ink>
+        <freetext page="0" rect="0,0,50,50" name="callout" callout="1,2,nan,4,5,6"/>
+        <highlight page="0" rect="0,0,50,50" name="hl" coords="0,0,infinity,0,0,10,10,10"/>
+        </annots></xfdf>"#;
+    let mut doc = blank();
+    let r = import(&mut doc, xfdf.as_bytes()).unwrap();
+    assert_eq!(r.comments, 5, "{r:?}");
+    fn finite(doc: &Document, o: &Object) -> bool {
+        match &*doc.resolve(o) {
+            Object::Real(x) => x.is_finite(),
+            Object::Array(a) => a.iter().all(|e| finite(doc, e)),
+            _ => true,
+        }
+    }
+    let annots = annots_of(&doc);
+    assert_eq!(annots.len(), 5);
+    for d in &annots {
+        for (k, v) in d.iter() {
+            if k.as_slice() != b"P" {
+                assert!(finite(&doc, v), "{d:?}");
+            }
+        }
+        assert!(d.get(b"L").is_none() && d.get(b"CL").is_none() && d.get(b"Vertices").is_none(), "{d:?}");
+    }
+}
+
+fn annots_of(doc: &Document) -> Vec<Dict> {
+    let page = &pdfcraft_model::pages(doc)[0];
+    page.dict
+        .get(b"Annots")
+        .map(|a| doc.resolve(a))
+        .and_then(|a| a.as_array().cloned())
+        .unwrap_or_default()
+        .iter()
+        .map(|a| doc.resolve(a).as_dict().cloned().unwrap())
+        .filter(|d| d.get(b"Subtype") != Some(&Object::name("Widget")))
+        .collect()
+}
+
+/// An empty text field exports as a `<field>` with no `<value>`, and the import skipped such a
+/// field, so importing the data left the target's old text in place. FDF, XML, CSV and text
+/// carry the same empty value and clear the field.
+#[test]
+fn an_empty_field_in_xfdf_clears_the_field_it_is_imported_into() {
+    let src = one_field();
+    assert_eq!(values(&src), vec![("Name".to_string(), Vec::<String>::new())]);
+    let exports = [
+        ("xfdf", export_xfdf(&src, false, true, "form.pdf").into_bytes()),
+        ("fdf", export_fdf(&src, false, true, "form.pdf").unwrap()),
+        ("xml", export_data(&src, Format::Xml).into_bytes()),
+    ];
+    for (format, data) in exports {
+        let mut dst = one_field();
+        set_value(&mut dst, "Name", &FieldValue::Text("Ada".into())).unwrap();
+        let report = import(&mut dst, &data);
+        assert_eq!(values(&dst), values(&src), "{format}: {report:?}: {}", String::from_utf8_lossy(&data));
+    }
+}
+
+/// A leaf holding only `<value-richtext>` is not read by the import, so it must leave the field
+/// as it was rather than clear it like an empty `<field>`.
+#[test]
+fn a_richtext_only_field_in_xfdf_leaves_the_field_alone() {
+    let data = br#"<?xml version="1.0" encoding="UTF-8"?>
+<xfdf xmlns="http://ns.adobe.com/xfdf/"><fields><field name="Name"><value-richtext><body xmlns="http://www.w3.org/1999/xhtml"><p>Bo</p></body></value-richtext></field></fields></xfdf>"#;
+    let mut dst = one_field();
+    set_value(&mut dst, "Name", &FieldValue::Text("Ada".into())).unwrap();
+    let report = import(&mut dst, data);
+    assert_eq!(values(&dst), vec![("Name".to_string(), vec!["Ada".to_string()])], "{report:?}");
+}
+
+/// An FDF comment's pop-up is an annotation of its own (`/Popup` → a `/Subtype /Popup` object
+/// with `/Parent`). The import copied the pop-up's dictionary into the comment as a direct value,
+/// which ISO 32000-2 Table 172 says shall be an indirect reference to an annotation on the page.
+/// The import now places a pop-up of its own, as the XFDF import does, keeping its place and
+/// open state.
+#[test]
+fn an_fdf_comment_popup_is_not_copied_in_as_a_direct_dictionary() {
+    let fdf = fdf_with(
+        "/Annots [2 0 R 3 0 R]",
+        &[
+            "<< /Type /Annot /Subtype /Text /Rect [10 10 30 30] /NM (n) /Page 0 /Contents (note) /Popup 3 0 R >>".into(),
+            "<< /Type /Annot /Subtype /Popup /Rect [40 10 140 60] /Parent 2 0 R /Page 0 /Open true >>".into(),
+        ],
+    );
+    let mut dst = blank();
+    assert_eq!(import(&mut dst, &fdf).unwrap().comments, 1);
+    let note = find_by_name(&dst, "n").unwrap();
+    let popup = dst.get(note).as_dict().unwrap().get(b"Popup").cloned();
+    let page = pdfcraft_model::pages(&dst)[0].dict.get(b"Annots").map(|a| dst.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap();
+    let pr = popup.as_ref().and_then(Object::as_ref).filter(|r| page.contains(&Object::Ref(*r)));
+    let pr = pr.unwrap_or_else(|| panic!("/Popup must be a reference to an annotation on the page: {popup:?}"));
+    let pd = dst.get(pr).as_dict().cloned().unwrap();
+    assert_eq!(pd.name(b"Subtype"), Some(b"Popup".as_slice()));
+    assert_eq!(pd.get(b"Parent"), Some(&Object::Ref(note)));
+    assert_eq!(pd.get(b"Open"), Some(&Object::Bool(true)));
+    let rect: Vec<f64> = pd.get(b"Rect").and_then(Object::as_array).unwrap().iter().filter_map(Object::as_f64).collect();
+    assert_eq!(rect, [40.0, 10.0, 140.0, 60.0]);
+}
+
+/// A pop-up without a usable `/Rect` cannot be placed: the comment still imports, with no
+/// `/Popup` at all (neither the FDF's dictionary copied in nor a pop-up on the page).
+#[test]
+fn an_fdf_comment_popup_without_a_rect_is_dropped() {
+    let fdf = fdf_with(
+        "/Annots [2 0 R 3 0 R]",
+        &[
+            "<< /Type /Annot /Subtype /Text /Rect [10 10 30 30] /NM (n) /Page 0 /Contents (note) /Popup 3 0 R >>".into(),
+            "<< /Type /Annot /Subtype /Popup /Parent 2 0 R /Page 0 /Open true >>".into(),
+        ],
+    );
+    let mut dst = blank();
+    assert_eq!(import(&mut dst, &fdf).unwrap().comments, 1);
+    let note = find_by_name(&dst, "n").unwrap();
+    assert!(dst.get(note).as_dict().unwrap().get(b"Popup").is_none());
+    let page = pdfcraft_model::pages(&dst)[0].dict.get(b"Annots").map(|a| dst.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap();
+    let popups = page.iter().filter(|a| dst.resolve(a).as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Popup".as_slice()))).count();
+    assert_eq!(popups, 0);
+}
diff --git a/crates/xfdf/src/xfdf.rs b/crates/xfdf/src/xfdf.rs
new file mode 100644
index 0000000000..a5881adf26
--- /dev/null
+++ b/crates/xfdf/src/xfdf.rs
@@ -0,0 +1,536 @@
+use super::common::{
+    FLAGS, MAX_DEPTH, SUBTYPES, arr, check_form_xml_depth, csv, esc, hex, n, nums_of, parse_form_xml, parse_hex, quad_has_area, rect_strict, text_of,
+    walk_xfdf,
+};
+use super::*;
+
+// ── export ──────────────────────────────────────────────────────────────────────────────────
+
+/// Every comment as an XFDF element (one line per comment, replies included).
+fn xfdf_annots(doc: &Document, out: &mut String) {
+    let pages = pdfcraft_model::pages(doc);
+    // NM of every annotation, for inreplyto.
+    let mut names: HashMap<ObjRef, String> = HashMap::new();
+    for p in &pages {
+        for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
+            if let Some(r) = a.as_ref()
+                && let Some(nm) = doc.get(r).as_dict().and_then(|d| text_of(doc, d, b"NM"))
+            {
+                names.insert(r, nm);
+            }
+        }
+    }
+    for (pi, p) in pages.iter().enumerate() {
+        for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
+            let Some(d) = doc.resolve(&a).as_dict().cloned() else { continue };
+            let Some(sub) = d.name(b"Subtype") else { continue };
+            let Some((_, tag)) = SUBTYPES.iter().find(|(s, _)| s.as_bytes() == sub) else { continue };
+            let mut attrs = format!(" page=\"{pi}\"");
+            let rect = nums_of(doc, d.get(b"Rect"));
+            if rect.len() == 4 {
+                let _ = write!(
+                    attrs,
+                    " rect=\"{},{},{},{}\"",
+                    n(rect[0].min(rect[2])),
+                    n(rect[1].min(rect[3])),
+                    n(rect[0].max(rect[2])),
+                    n(rect[1].max(rect[3]))
+                );
+            }
+            for (key, attr) in [
+                (&b"NM"[..], "name"),
+                (b"T", "title"),
+                (b"Subj", "subject"),
+                (b"M", "date"),
+                (b"CreationDate", "creationdate"),
+                (b"RT", "replyType"),
+                (b"State", "state"),
+                (b"StateModel", "statemodel"),
+                (b"Name", "icon"),
+            ] {
+                if let Some(v) = text_of(doc, &d, key) {
+                    let _ = write!(attrs, " {attr}=\"{}\"", esc(&v));
+                }
+            }
+            let flags = d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
+            let fl: Vec<&str> = FLAGS.iter().filter(|(b, _)| flags & b != 0).map(|(_, s)| *s).collect();
+            let _ = write!(attrs, " flags=\"{}\"", fl.join(","));
+            if let Some(c) = hex(&nums_of(doc, d.get(b"C"))) {
+                let _ = write!(attrs, " color=\"{c}\"");
+            }
+            if let Some(c) = hex(&nums_of(doc, d.get(b"IC"))) {
+                let _ = write!(attrs, " interior-color=\"{c}\"");
+            }
+            if let Some(o) = d.get(b"CA").and_then(|o| doc.resolve(o).as_f64()) {
+                let _ = write!(attrs, " opacity=\"{}\"", n(o));
+            }
+            if let Some(w) = d.get(b"BS").and_then(|b| doc.resolve(b).as_dict().and_then(|b| b.get(b"W").and_then(Object::as_f64))) {
+                let _ = write!(attrs, " width=\"{}\"", n(w));
+            }
+            let quads = nums_of(doc, d.get(b"QuadPoints"));
+            if !quads.is_empty() {
+                let _ = write!(attrs, " coords=\"{}\"", quads.iter().map(|v| n(*v)).collect::<Vec<_>>().join(","));
+            }
+            let l = nums_of(doc, d.get(b"L"));
+            if l.len() == 4 {
+                let _ = write!(attrs, " start=\"{},{}\" end=\"{},{}\"", n(l[0]), n(l[1]), n(l[2]), n(l[3]));
+            }
+            if let Some(le) = d.get(b"LE").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned())
+                && le.len() == 2
+            {
+                let name = |o: &Object| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned()).unwrap_or_else(|| "None".into());
+                let _ = write!(attrs, " head=\"{}\" tail=\"{}\"", esc(&name(&le[0])), esc(&name(&le[1])));
+            }
+            // A callout: its leader path, text-box inset, intent and (single-name) line ending.
+            let cl = nums_of(doc, d.get(b"CL"));
+            if cl.len() == 4 || cl.len() == 6 {
+                let _ = write!(attrs, " callout=\"{}\"", cl.iter().map(|v| n(*v)).collect::<Vec<_>>().join(","));
+                let rd = nums_of(doc, d.get(b"RD"));
+                if rd.len() == 4 {
+                    let _ = write!(attrs, " fringe=\"{}\"", rd.iter().map(|v| n(*v)).collect::<Vec<_>>().join(","));
+                }
+                if let Some(it) = d.get(b"IT").map(|o| doc.resolve(o)).and_then(|o| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned())) {
+                    let _ = write!(attrs, " intent=\"{}\"", esc(&it));
+                }
+                if let Some(le) = d.get(b"LE").map(|o| doc.resolve(o)).and_then(|o| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned())) {
+                    let _ = write!(attrs, " head=\"{}\"", esc(&le));
+                }
+            }
+            if let Some(irt) = d.get(b"IRT").and_then(Object::as_ref).and_then(|r| names.get(&r)) {
+                let _ = write!(attrs, " inreplyto=\"{}\"", esc(irt));
+            }
+            let _ = write!(out, "<{tag}{attrs}>");
+            if let Some(c) = text_of(doc, &d, b"Contents") {
+                let _ = write!(out, "<contents>{}</contents>", esc(&c));
+            }
+            if let Some(da) = text_of(doc, &d, b"DA") {
+                let _ = write!(out, "<defaultappearance>{}</defaultappearance>", esc(&da));
+            }
+            let ink = d.get(b"InkList").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
+            if !ink.is_empty() {
+                out.push_str("<inklist>");
+                for g in ink {
+                    let v = nums_of(doc, Some(&g));
+                    let pts: Vec<String> = v.as_chunks::<2>().0.iter().map(|p| format!("{},{}", n(p[0]), n(p[1]))).collect();
+                    let _ = write!(out, "<gesture>{}</gesture>", pts.join(";"));
+                }
+                out.push_str("</inklist>");
+            }
+            // Polygon and polyline points (XFDF `<vertices>`: `x,y;x,y;…`).
+            let vertices = nums_of(doc, d.get(b"Vertices"));
+            let pts: Vec<String> = vertices.as_chunks::<2>().0.iter().map(|p| format!("{},{}", n(p[0]), n(p[1]))).collect();
+            if !pts.is_empty() {
+                let _ = write!(out, "<vertices>{}</vertices>", pts.join(";"));
+            }
+            if let Some(pd) = d.get(b"Popup").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()) {
+                let r = nums_of(doc, pd.get(b"Rect"));
+                if r.len() == 4 {
+                    let open = matches!(pd.get(b"Open"), Some(Object::Bool(true)));
+                    let _ = write!(
+                        out,
+                        "<popup page=\"{pi}\" rect=\"{},{},{},{}\" open=\"{}\"/>",
+                        n(r[0]),
+                        n(r[1]),
+                        n(r[2]),
+                        n(r[3]),
+                        if open { "yes" } else { "no" }
+                    );
+                }
+            }
+            let _ = writeln!(out, "</{tag}>");
+        }
+    }
+}
+
+/// Field values as nested XFDF `<field>` elements.
+fn xfdf_fields(doc: &Document, out: &mut String) {
+    #[derive(Default)]
+    struct Node {
+        values: Vec<String>,
+        kids: Vec<(String, Node)>,
+    }
+    let mut root = Node::default();
+    for f in pdfcraft_forms::fields(doc) {
+        if matches!(f.kind, FieldKind::PushButton | FieldKind::Signature) {
+            continue;
+        }
+        let mut node = &mut root;
+        // One `<field>` level per part of the name, but no more levels than the import reads
+        // back. A `/T` can hold periods of its own, so a name can split into far more parts than
+        // the field tree has levels: nesting every part wrote a file the import refuses and, for
+        // a long enough name, recursed in `write_node` until the stack overflowed. The parts past
+        // the last level stay together in the deepest element's name, and the import joins them
+        // back with periods into the same full name.
+        for part in f.name.splitn(MAX_DEPTH, '.') {
+            let i = match node.kids.iter().position(|(k, _)| k == part) {
+                Some(i) => i,
+                None => {
+                    node.kids.push((part.to_string(), Node::default()));
+                    node.kids.len() - 1
+                }
+            };
+            node = &mut node.kids[i].1;
+        }
+        node.values = match f.kind {
+            FieldKind::CheckBox | FieldKind::Radio if f.value.is_empty() => vec!["Off".into()],
+            _ => f.value.clone(),
+        };
+    }
+    fn write_node(name: &str, node: &Node, out: &mut String) {
+        let _ = write!(out, "<field name=\"{}\">", esc(name));
+        for v in &node.values {
+            let _ = write!(out, "<value>{}</value>", esc(v));
+        }
+        for (k, kid) in &node.kids {
+            write_node(k, kid, out);
+        }
+        out.push_str("</field>\n");
+    }
+    for (k, kid) in &root.kids {
+        write_node(k, kid, out);
+    }
+}
+
+/// XFDF with the document's comments and/or field values.
+pub fn export_xfdf(doc: &Document, comments: bool, fields: bool, file: &str) -> String {
+    let mut out = String::from("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<xfdf xmlns=\"http://ns.adobe.com/xfdf/\" xml:space=\"preserve\">\n");
+    if comments {
+        out.push_str("<annots>\n");
+        xfdf_annots(doc, &mut out);
+        out.push_str("</annots>\n");
+    }
+    if fields {
+        out.push_str("<fields>\n");
+        xfdf_fields(doc, &mut out);
+        out.push_str("</fields>\n");
+    }
+    let _ = writeln!(out, "<f href=\"{}\"/>", esc(file));
+    out.push_str("</xfdf>\n");
+    out
+}
+
+// ── import ──────────────────────────────────────────────────────────────────────────────────
+
+/// Set the values of fields named in `values` (full names), counting what took.
+pub(crate) fn apply_values(doc: &mut Document, values: &[(String, Vec<String>)], report: &mut Report) {
+    let all = pdfcraft_forms::fields(doc);
+    for (name, vals) in values {
+        let Some(f) = all.iter().find(|f| &f.name == name) else { continue };
+        let first = vals.first().cloned().unwrap_or_default();
+        let v = match f.kind {
+            FieldKind::Text => FieldValue::Text(first),
+            FieldKind::CheckBox => FieldValue::Check(!first.is_empty() && first != "Off"),
+            FieldKind::Radio => FieldValue::Radio((!first.is_empty() && first != "Off").then_some(first)),
+            // XML, CSV and text hold a multi-select list's values in one cell, joined by ", "
+            // (as export_data writes them); split it unless the whole cell is one option.
+            FieldKind::List if f.has(pdfcraft_forms::flags::MULTI_SELECT) && vals.len() == 1 && !f.options.iter().any(|(e, _)| *e == first) => {
+                FieldValue::Choice(first.split(", ").filter(|v| !v.is_empty()).map(str::to_string).collect())
+            }
+            FieldKind::Combo | FieldKind::List => FieldValue::Choice(vals.iter().filter(|v| !v.is_empty()).cloned().collect()),
+            FieldKind::PushButton | FieldKind::Signature => continue,
+        };
+        // Read-only fields still take imported data, as in Acrobat.
+        let ro = f.read_only();
+        if ro {
+            let _ = doc.update_dict(f.obj, |d| d.set(b"Ff".to_vec(), Object::Int((f.flags & !pdfcraft_forms::flags::READ_ONLY) as i64)));
+        }
+        match pdfcraft_forms::set_value(doc, name, &v) {
+            Ok(()) => report.fields += 1,
+            Err(_) => report.rejected.push(name.clone()),
+        }
+        if ro {
+            let _ = doc.update_dict(f.obj, |d| d.set(b"Ff".to_vec(), Object::Int(f.flags as i64)));
+        }
+    }
+}
+
+/// A new annotation dictionary from an XFDF element.
+fn annot_from_xml(node: roxmltree::Node, subtype: &str, page_ref: ObjRef) -> Option<Dict> {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("Annot"));
+    d.set(b"Subtype".to_vec(), Object::name(subtype));
+    d.set(b"P".to_vec(), Object::Ref(page_ref));
+    let rect = csv(node.attribute("rect")?);
+    if rect.len() != 4 {
+        return None;
+    }
+    d.set(b"Rect".to_vec(), arr(&rect));
+    for (attr, key) in [
+        ("name", &b"NM"[..]),
+        ("title", b"T"),
+        ("subject", b"Subj"),
+        ("date", b"M"),
+        ("creationdate", b"CreationDate"),
+        ("state", b"State"),
+        ("statemodel", b"StateModel"),
+    ] {
+        if let Some(v) = node.attribute(attr) {
+            d.set(key.to_vec(), PdfString::text(v));
+        }
+    }
+    if let Some(v) = node.attribute("replyType") {
+        d.set(b"RT".to_vec(), Object::name(if v.eq_ignore_ascii_case("group") { "Group" } else { "R" }));
+    }
+    if let Some(v) = node.attribute("icon") {
+        d.set(b"Name".to_vec(), Object::name(v));
+    }
+    let flags: i64 = node
+        .attribute("flags")
+        .unwrap_or("print")
+        .split(',')
+        .filter_map(|f| FLAGS.iter().find(|(_, s)| s.eq_ignore_ascii_case(f.trim())).map(|x| x.0))
+        .fold(0, |bits, flag| bits | flag);
+    d.set(b"F".to_vec(), Object::Int(flags));
+    if let Some(c) = node.attribute("color").and_then(parse_hex) {
+        d.set(b"C".to_vec(), arr(&c));
+    }
+    if let Some(c) = node.attribute("interior-color").and_then(parse_hex) {
+        d.set(b"IC".to_vec(), arr(&c));
+    }
+    if let Some(o) = node.attribute("opacity").and_then(|o| o.parse::<f64>().ok()) {
+        d.set(b"CA".to_vec(), Object::Real(o.clamp(0.0, 1.0)));
+    }
+    if let Some(w) = node.attribute("width").and_then(|w| w.parse::<f64>().ok()) {
+        let mut bs = Dict::new();
+        bs.set(b"W".to_vec(), Object::Real(w.max(0.0)));
+        bs.set(b"S".to_vec(), Object::name("S"));
+        d.set(b"BS".to_vec(), Object::Dict(bs));
+    }
+    if let Some(q) = node.attribute("coords") {
+        d.set(b"QuadPoints".to_vec(), arr(&csv(q)));
+    }
+    if let (Some(s), Some(e)) = (node.attribute("start"), node.attribute("end")) {
+        let (s, e) = (csv(s), csv(e));
+        if s.len() == 2 && e.len() == 2 {
+            d.set(b"L".to_vec(), arr(&[s[0], s[1], e[0], e[1]]));
+        }
+    }
+    if node.attribute("head").is_some() || node.attribute("tail").is_some() {
+        d.set(
+            b"LE".to_vec(),
+            Object::Array(vec![Object::name(node.attribute("head").unwrap_or("None")), Object::name(node.attribute("tail").unwrap_or("None"))]),
+        );
+    }
+    if let Some(cl) = node.attribute("callout").map(csv).filter(|c| c.len() == 4 || c.len() == 6) {
+        d.set(b"CL".to_vec(), arr(&cl));
+        if let Some(rd) = node.attribute("fringe").map(csv).filter(|r| r.len() == 4) {
+            d.set(b"RD".to_vec(), arr(&rd));
+        }
+        d.set(b"IT".to_vec(), Object::name(node.attribute("intent").unwrap_or("FreeTextCallout")));
+        // A callout's /LE is one name, not the head/tail pair of a line.
+        match node.attribute("head") {
+            Some(h) => d.set(b"LE".to_vec(), Object::name(h)),
+            None => {
+                d.remove(b"LE");
+            }
+        }
+    }
+    for child in node.children().filter(|c| c.is_element()) {
+        match child.tag_name().name() {
+            "contents" => {
+                d.set(b"Contents".to_vec(), PdfString::text(&child.text().unwrap_or("").replace("\r\n", "\r").replace('\n', "\r")));
+            }
+            "defaultappearance" => {
+                d.set(b"DA".to_vec(), PdfString::literal(child.text().unwrap_or("").as_bytes().to_vec()));
+            }
+            "inklist" => {
+                let list: Vec<Object> = child
+                    .children()
+                    .filter(|g| g.has_tag_name("gesture"))
+                    .map(|g| arr(&g.text().unwrap_or("").split(';').flat_map(|p| csv(p).into_iter()).collect::<Vec<_>>()))
+                    .collect();
+                d.set(b"InkList".to_vec(), Object::Array(list));
+            }
+            "vertices" => {
+                // Whole x,y pairs only; a stray trailing number is dropped.
+                let mut v = csv(child.text().unwrap_or(""));
+                v.truncate(v.len() - v.len() % 2);
+                if !v.is_empty() {
+                    d.set(b"Vertices".to_vec(), arr(&v));
+                }
+            }
+            _ => {}
+        }
+    }
+    Some(d)
+}
+
+/// Put an annotation dictionary on a page, replacing one with the same `/NM`. Returns its
+/// reference.
+/// `/F` bits an imported file may not set on a redaction mark: Invisible, Hidden, NoView — so a
+/// mark it brings in is always drawn for the user to review before content is removed.
+const REDACT_UNSEEN: i64 = 1 | 2 | 32;
+
+/// `/F` Locked (ISO 32000-2 Table 167): the user protected this annotation from change.
+pub(crate) const LOCKED: i64 = 128;
+
+/// An existing annotation an import must never replace, move or unlock: one the user locked, a
+/// redaction mark (replacing it would drop the region the user marked to remove), or a form
+/// widget or field (replacing it would set the field's value and policy around the form setter).
+fn import_protected(doc: &Document, x: &Dict) -> bool {
+    let flags = x.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
+    flags & LOCKED != 0 || matches!(x.name(b"Subtype"), Some(b"Redact" | b"Widget")) || x.contains(b"FT")
+}
+
+pub(crate) fn place(doc: &mut Document, page_ref: ObjRef, mut d: Dict) -> Result<ObjRef, DataError> {
+    // A redaction mark the import carries is always made visible: clear any Invisible/Hidden/NoView
+    // flag so it cannot remove content the user never sees.
+    if d.name(b"Subtype") == Some(b"Redact".as_slice()) {
+        let f = d.int(b"F").unwrap_or(0);
+        if f & REDACT_UNSEEN != 0 {
+            d.set(b"F".to_vec(), Object::Int(f & !REDACT_UNSEEN));
+        }
+        // Its review outline is drawn opaque, and from the area it removes: applying a mark
+        // without usable /QuadPoints removes its /Rect, which the outline is then drawn from.
+        d.remove(b"CA");
+        d.remove(b"ca");
+        let quads_drawable = d.get(b"QuadPoints").and_then(Object::as_array).is_some_and(|q| {
+            let v: Vec<f64> = q.iter().filter_map(Object::as_f64).filter(|v| v.is_finite()).collect();
+            let (quads, rest) = v.as_chunks::<8>();
+            v.len() == q.len() && rest.is_empty() && !quads.is_empty() && quads.iter().all(quad_has_area)
+        });
+        if !quads_drawable {
+            // Quads the outline can't draw, or any quad that encloses no area, are replaced by the
+            // /Rect's, or dropped when there is no usable /Rect either; such a mark then removes
+            // nothing.
+            match rect_strict(doc, d.get(b"Rect")) {
+                Some([x0, y0, x1, y1]) => {
+                    let (l, r, b, t) = (x0.min(x1), x0.max(x1), y0.min(y1), y0.max(y1));
+                    d.set(b"QuadPoints".to_vec(), arr(&[l, t, r, t, l, b, r, b]));
+                }
+                _ => {
+                    d.remove(b"QuadPoints");
+                }
+            }
+        }
+    }
+    let nm = d.get(b"NM").and_then(|n| n.as_string().map(|s| s.to_text()));
+    let annots: Vec<Object> = doc
+        .get(page_ref)
+        .as_dict()
+        .and_then(|p| p.get(b"Annots").cloned())
+        .map(|a| doc.resolve(&a))
+        .and_then(|a| a.as_array().cloned())
+        .unwrap_or_default();
+    let mut kept = Vec::new();
+    let mut removed: Vec<ObjRef> = Vec::new();
+    // Never let a same-name import replace a protected annotation (`import_protected`): keep it,
+    // and add the imported dict beside it under no name of its own.
+    let mut clash = false;
+    for a in annots {
+        let existing = a.as_ref().and_then(|r| doc.get(r).as_dict().cloned());
+        let same = nm.is_some() && existing.as_ref().and_then(|x| x.get(b"NM").and_then(|n| doc.resolve(n).as_string().map(|s| s.to_text()))) == nm;
+        if same && existing.as_ref().is_some_and(|x| import_protected(doc, x)) {
+            clash = true;
+            kept.push(a);
+        } else if same {
+            removed.extend(a.as_ref());
+        } else {
+            kept.push(a);
+        }
+    }
+    if clash {
+        d.remove(b"NM");
+    }
+    // The replaced note's pop-up goes with it; otherwise it stays on the page pointing at a note that is no longer there.
+    kept.retain(|a| {
+        let Some(x) = a.as_ref().map(|r| doc.get(r)).and_then(|o| o.as_dict().cloned()) else { return true };
+        x.name(b"Subtype") != Some(b"Popup".as_slice()) || x.reference(b"Parent").is_none_or(|p| !removed.contains(&p))
+    });
+    // Keep the replaced comment's identity: replies and review statuses not included in a
+    // partial import still point at it through /IRT. Allocating a new object would detach
+    // those comments and leave their parent outside the page's annotation list.
+    let r = match removed.first().copied() {
+        Some(r) => {
+            doc.set(r, Object::Dict(d));
+            r
+        }
+        None => doc.add(Object::Dict(d)),
+    };
+    // Our own appearance where we can draw one; others keep none (viewers draw a default).
+    let _ = pdfcraft_annot::set_appearance(doc, r);
+    kept.push(Object::Ref(r));
+    doc.update_dict(page_ref, |p| p.set(b"Annots".to_vec(), Object::Array(kept)))?;
+    Ok(r)
+}
+
+/// A pop-up window for the comment `parent`, on its page.
+pub(crate) fn add_popup(doc: &mut Document, page: ObjRef, parent: ObjRef, rect: &[f64], open: bool) -> Result<(), DataError> {
+    let mut p = Dict::new();
+    p.set(b"Type".to_vec(), Object::name("Annot"));
+    p.set(b"Subtype".to_vec(), Object::name("Popup"));
+    p.set(b"Rect".to_vec(), arr(rect));
+    p.set(b"Parent".to_vec(), Object::Ref(parent));
+    p.set(b"Open".to_vec(), Object::Bool(open));
+    let pr = doc.add(Object::Dict(p));
+    doc.update_dict(parent, |d| d.set(b"Popup".to_vec(), Object::Ref(pr)))?;
+    doc.update_dict(page, |pd| {
+        if let Some(Object::Array(a)) = pd.get_mut(b"Annots") {
+            a.push(Object::Ref(pr));
+        }
+    })?;
+    Ok(())
+}
+
+pub(crate) fn import_xfdf(doc: &mut Document, text: &str) -> Result<Report, DataError> {
+    check_form_xml_depth(text)?;
+    let xml = parse_form_xml(text).map_err(|e| DataError::Malformed(e.to_string()))?;
+    let root = xml.root_element();
+    if root.tag_name().name() != "xfdf" {
+        return Err(DataError::UnknownFormat);
+    }
+    let mut report = Report::default();
+    let pages: Vec<ObjRef> = pdfcraft_model::pages(doc).iter().map(|p| p.obj).collect();
+    // Comments: parents first, then replies (whose /IRT needs the parent's reference).
+    let mut by_name: HashMap<String, ObjRef> = HashMap::new();
+    let mut later: HashMap<ObjRef, String> = HashMap::new();
+    if let Some(annots) = root.children().find(|c| c.has_tag_name("annots")) {
+        for node in annots.children().filter(|c| c.is_element()) {
+            let tag = node.tag_name().name().to_ascii_lowercase();
+            let Some((subtype, _)) = SUBTYPES.iter().find(|(_, t)| *t == tag) else { continue };
+            let Some(page) = node.attribute("page").and_then(|p| p.parse::<usize>().ok()).and_then(|p| pages.get(p).copied()) else { continue };
+            let Some(d) = annot_from_xml(node, subtype, page) else { continue };
+            let r = place(doc, page, d)?;
+            // A later same-name record replaces this comment, including its reply relation.
+            later.remove(&r);
+            if let Some(nm) = node.attribute("name") {
+                by_name.insert(nm.to_string(), r);
+            }
+            if let Some(irt) = node.attribute("inreplyto") {
+                later.insert(r, irt.to_string());
+            }
+            // A pop-up window.
+            if let Some(pop) = node.children().find(|c| c.has_tag_name("popup"))
+                && let Some(rect) = pop.attribute("rect").map(csv).filter(|r| r.len() == 4)
+            {
+                add_popup(doc, page, r, &rect, pop.attribute("open") == Some("yes"))?;
+            }
+            report.comments += 1;
+        }
+    }
+    for (r, irt) in later {
+        if let Some(parent) = by_name.get(&irt).copied().or_else(|| find_by_name(doc, &irt)) {
+            doc.update_dict(r, |d| d.set(b"IRT".to_vec(), Object::Ref(parent)))?;
+        }
+    }
+    // Fields.
+    if let Some(fields) = root.children().find(|c| c.has_tag_name("fields")) {
+        let mut values = Vec::new();
+        walk_xfdf(fields, "", &mut values, 0)?;
+        apply_values(doc, &values, &mut report);
+    }
+    Ok(report)
+}
+
+pub(crate) fn find_by_name(doc: &Document, nm: &str) -> Option<ObjRef> {
+    for p in pdfcraft_model::pages(doc) {
+        for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
+            if let Some(r) = a.as_ref()
+                && doc.get(r).as_dict().and_then(|d| text_of(doc, d, b"NM")).as_deref() == Some(nm)
+            {
+                return Some(r);
+            }
+        }
+    }
+    None
+}
diff --git a/deny.toml b/deny.toml
index ed9c26c206..f6c2028bbd 100644
--- a/deny.toml
+++ b/deny.toml
@@ -34,7 +34,13 @@ unknown-registry = "deny"
 unknown-git = "deny"
 # Shared UI components and spooler; Cargo.toml pins the immutable revision. craft-print pins
 # storytold's winprint fork (Windows printing, #1107) to an immutable revision of its own.
-allow-git = ["https://github.com/storytold/craft-libs", "https://github.com/storytold/winprint.rs"]
+allow-git = [
+    "https://github.com/storytold/craft-libs",
+    "https://github.com/storytold/winprint.rs",
+    # The reviewed egui 0.37 and winit 0.30.13 fork revisions (immutable pins in Cargo.toml).
+    "https://github.com/storytold/egui",
+    "https://github.com/storytold/winit",
+]
 
 [advisories]
 yanked = "warn"
diff --git a/docs/development.md b/docs/development.md
index 1142fed333..e50907ba56 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -28,6 +28,24 @@ the low-disk artifacts, run `cargo clean --profile low-disk`.
 Building PdfCraft requires Rust 1.95 or later: the UI crate and its `egui` and `craft-ui`
 dependencies need it, and the workspace `rust-version` states the same minimum.
 
+## Annotation tool pin
+
+The annotation quick bar's **Keep tool selected** pin is a shared preference, stored as the
+boolean `comment_tool_pinned`. It survives application restarts, including when switched off.
+Startup uses Select; the remembered pin applies when an annotation tool is picked. Older settings
+without the key keep the default one-shot behavior. Non-boolean values are ignored, preserving
+the current choice and the other valid settings.
+
+The existing opt-in UI control channel uses the same preference:
+
+```sh
+pdfcraft-cli ui --control /path/to/control.json set key=comment-tool-pinned value=true
+pdfcraft-cli ui --control /path/to/control.json state
+```
+
+`ui.state.comment_tool_pinned` reports the boolean. `ui.set` accepts `true` or `false` and refuses
+other values before changing the preference. This changes interface settings only.
+
 ## Interface appearance
 
 Display theme saves System, Light or Dark separately from the palette currently drawn. New
diff --git a/docs/editing-images.md b/docs/editing-images.md
index 67d3613bf1..4ebafd115f 100644
--- a/docs/editing-images.md
+++ b/docs/editing-images.md
@@ -38,7 +38,9 @@ the full placement by the same change; resizing keeps the opposite corner fixed,
 horizontal-only or vertical-only corner drags, and grabbing a grip slightly off-centre does not
 jump. A selected corner keeps control of its drag even over a text label; the drag previews one
 frame and applies one undoable edit on release. Exclusive crops and their holes move
-with the selected image; shared clips stay fixed without moving neighbouring text or artwork.
+with the selected image, also when the picture sits inside a clip it shares with its section
+(a report drawing each picture as `q re W n cm Do Q` within a table's clip): the picture's own
+clip scales with it, and shared clips stay fixed without moving neighbouring text or artwork.
 
 `image_hit` applies the same path and hole checks headlessly. `page_images` retains `rect` as
 the full placement rectangle used by `image_edit` and adds `visible_rect` for selection (null
diff --git a/docs/egui-037-migration-plan.md b/docs/egui-037-migration-plan.md
new file mode 100644
index 0000000000..5866330f28
--- /dev/null
+++ b/docs/egui-037-migration-plan.md
@@ -0,0 +1,812 @@
+# Current integration — 2026-10-25
+
+The local integration includes main `d764a8ebca2dc289841b34ea3048f613a9869bbb` and pins craft-ui, craft-quit and craft-print to published `42e30cd5b3f4b114270dd053fccbc33bedc47f68`. The egui, winit and independent craft-docpath pins are unchanged. Its `Cargo.lock` SHA-256 is `3e0c10576c8584eb1f45a27908177e7c65bb83f8e855bf3a5429edd4e7268c80`.
+
+Main replaced the floating docking workspace with fixed shared side panes in `crates/ui-egui/src/panels/side_panels.rs`. `PaneHost` owns the Tools and inspector columns; `Rail` owns the fixed navigation rail and footer. The integration retains the 0.37 ID, text alignment, capture, IME and accessibility adaptations. The former `docking.rs`, `rail-nav` panel and read-mode inspector panel no longer exist. Floating windows, tab groups and drag/redock operations from the earlier design are not capabilities of this integrated UI. Their historical acceptance items below do not establish current behavior.
+
+Focused scroll, zoom and RTL palette regressions passed. Removing the production fixes while retaining the tests reproduced double scrolling, double zooming and failed reordered-word RTL search; both source files were then restored byte-for-byte. Independent source review accepted the integration. Full combined-tree CI and the separate web WASM check passed with required external oracles: 5,190 passing test executions, zero failures and 22 ignored across 89 summaries. The first attempt stopped at the storage reservation guard; the successful rerun used an increased reservation. The 5,190 result comes from managed run `egui037-pdf-combined-ci-20261025-1340` and qualifies the integration of main `d764a8ebca2dc289841b34ea3048f613a9869bbb` with `Cargo.lock` SHA-256 `3e0c10576c8584eb1f45a27908177e7c65bb83f8e855bf3a5429edd4e7268c80`, published as `fbfad2039c650a02b39ceee5c3f0e4d6fd4b3f74`. The older 5,183-pass result covered commit `9032aeb35f7abe7777f66d4b835fd461a865c516`, integrating main `71b47b51`; it is a separate checkpoint and is not evidence for the current tree. Both runs recorded 22 ignored executions across 89 summaries.
+
+Remaining acceptance includes native/browser GUI, native IME, packaging and paired performance. Shared-pane F6 cycling and explicit RTL edge mirroring are not enabled. New side-pane command labels still need catalog translations; English fallback remains. Current panel checks must exercise Tools/inspector visibility, Read mode, resizing and persistence, rail selection, F4/Shift+F4, capture and accessible Pane/Splitter labels, rather than the removed floating/tab-group workflows.
+
+The qualification tables and original porting protocol below are historical records. Their old pins, lock hashes and docking design describe those checkpoints only; this section supersedes them for the current integration.
+
+> Historical records begin below this notice. Their source identities, lockfile hashes and test counts describe earlier checkpoints only; they do not qualify the current `d764a8eb` integration. The current integration and its 5,190-pass qualification are recorded above.
+
+# PdfCraft — egui 0.37 porting plan
+
+Status update (2026-10-25): Move PdfCraft to the pinned egui 0.37 and winit forks, preserving main `418ac6a2`, including suppression of page link hover while dragging a panel, page-pointer ownership, editor gestures and navigation/security fixes. Adapt UI lifecycle, capture and IME reset handling while preserving logical RTL text. Restore document-properties filename alignment and connect Initial View controls to their accessible labels. Validation: all ten CI stages and the separate web-shell WASM check passed. Focused pointer regressions plus CI recorded 5,130 passing test executions, zero failures and 28 ignored across 143 summaries. The dragged-panel link regression passes on egui 0.37; independent review accepted preservation of the upstream fix. The alignment and accessible-name regressions failed before their fixes and pass afterward; independent reviews accepted the integration and both fixes. Pins and lockfile remain unchanged. Native/browser GUI, native IME, paired app performance and final platform/package acceptance remain open. Human review and human merge are required.
+
+The original planning record below is historical.
+
+Status update (2026-10-25): Move PdfCraft to the pinned egui 0.37 and winit forks, preserving main `24edde65`, including page-pointer ownership, editor gestures and navigation/security fixes. Adapt UI lifecycle, capture and IME reset handling while preserving logical RTL text. Restore document-properties filename alignment and connect Initial View controls to their accessible labels. Validation: all ten CI stages and the separate web-shell WASM check passed. Focused dialog regressions plus CI recorded 5,111 passing test executions, zero failures and 22 ignored across 143 summaries. The alignment and accessible-name regressions failed before their fixes and pass afterward; independent reviews accepted the integration and both fixes. Pins and lockfile remain unchanged. Native/browser GUI, native IME, paired app performance and final platform/package acceptance remain open. Human review and human merge are required.
+
+The original planning record below is historical.
+
+Status: implemented locally against `a2ec27b4775f53c40cad3456936d9406611e3a8d`; not published. Production code, manifests, vendor provenance and tests in this checkout carry the migration. The 2026-10-25 qualification section below supersedes the historical external-config and missing-IME statements; the 2026-10-24 amendment records the earlier local state. The manifests pin egui `6d518fc799681571963842f95b55a6b68431b15a`, winit `a517b3846ee8457d84ee4975110bfda6797c44dc`, and craft-ui/craft-quit/craft-print `25da1314d443171b4adeaad2cd9454b273f35c6f` directly by immutable git revision, while `craft-docpath` remains at `82a24b006eefa036b43c09a67fb9a3fbd17ffe63`; `Cargo.lock` is `f5cee0acb795240d2071116230316fd4e4b6bfe4e4314c82b0a4ca5459739f80`, and the target-main observation is `a7801dc84e74dd12757aecbb6be324dce7a33939`. The repository quality gates passed as recorded below; publication still requires fresh human approval. This revision also incorporates the independent adversarial review of the prior plan (`f781bf52d03d59cd2fb4539771c7a0d196e2f49e64c48635e72c224c9bdcdcd0`).
+
+## Historical qualification state — 2026-10-25
+
+The managed run `egui037-pdfcraft-reviewed-ui-ci-20261025-0541` passed the first nine CI stages, including formatting, strict lint, workspace tests, WASM compilation, assets and dependency checks. It recorded 5,025 passing test executions, zero failures and 16 ignored across 198 summaries (including four focused regression executions). The final parity stage found one stale test reference after the Arabic logical-order test was renamed; the reference was corrected without changing executable source. Formatting and parity then passed in `egui037-pdfcraft-parity-final-20261025-0555`. An intervening submission `0553` was refused by the storage guard before execution and is not validation evidence. Final documentation/attribution corrections were checked by formatting, assets generation/validation and parity in `egui037-pdfcraft-final-doc-assets-20261025-0571`.
+
+The page-text editor keeps the prior four-by-two inset under egui 0.37, and print tests locate the Two-sided control by ComboBox role. Both narrow/wide text image regressions and booklet regressions passed before the full suite. Canonical dependency/source guards retain the vendored security and rendering provenance. The repository WASM gate checks the library layers. The separate web application shell also passed `cargo check --locked --target wasm32-unknown-unknown -p pdfcraft-web` in `egui037-pdfcraft-web-shell-check-20261025-0575`. Native GUI and IME/PRIMARY, browser interaction, packaged WASM size, real-world old settings and paired app performance remain open; these checks do not establish cross-platform acceptance.
+
+This section supersedes every historical statement below that the egui, winit or
+craft-libs revisions resolve through `local-integration-config.toml`, that the
+checked-in manifest does not pin them, or that E21b/P7b surrounding-text support is
+absent from the candidate. Those statements are planning-era history; the current
+tree does not use an external Cargo config.
+
+| Item | Current value |
+|---|---|
+| egui family | `6d518fc799681571963842f95b55a6b68431b15a` (storytold/egui) |
+| winit | `a517b3846ee8457d84ee4975110bfda6797c44dc` (storytold/winit) |
+| craft-ui / craft-quit / craft-print | `25da1314d443171b4adeaad2cd9454b273f35c6f` (storytold/craft-libs) |
+| `Cargo.lock` SHA-256 | `f5cee0acb795240d2071116230316fd4e4b6bfe4e4314c82b0a4ca5459739f80` |
+| Target-main observation | `a7801dc84e74dd12757aecbb6be324dce7a33939` |
+
+`Cargo.toml` pins those revisions directly and `Cargo.lock` resolves them to the
+same immutable git sources; no `local-integration-config.toml` is read. The
+retained `vendor/winit` and `vendor/egui-wgpu` copies remain provenance for the
+patch text and source guards, not runtime path patches.
+
+The pinned egui `6d518fc` tree contains the `TextEdit` outgoing
+surrounding-text/`IMEOutput` producer and egui-winit calls
+`set_ime_surrounding_text`. PdfCraft adds no custom adapter. Native platform
+execution and the outgoing-text tests remain unqualified.
+
+## 1. Baseline and scope
+
+| Item | Value |
+|---|---|
+| PdfCraft source | current owned checkout `a2ec27b4775f53c40cad3456936d9406611e3a8d`; the original planning baseline was `0dc77fe4ed8810b9e9f25b9dd050afae662c062a` (`docs/egui-037-plan-20261022`, tree `ebb7259286988cf937ade02ab08db67064b04084`) |
+| PdfCraft lockfile | current `Cargo.lock` is the direct-pin qualification lock (SHA-256 `f5cee0acb795240d2071116230316fd4e4b6bfe4e4314c82b0a4ca5459739f80`); it is not publication evidence. The planning baseline lock SHA-256 was `eaee6973f7c1ba79f5bfc1bfa3da50ef457d13affeb51a3d50d27437804d4cf7`. |
+| Planning-baseline egui family | `egui`, `eframe`, `egui-winit`, `egui_extras`, `egui_kittest` 0.36.2 from crates.io; `egui-wgpu` 0.36.2 vendored |
+| Planning-baseline winit | 0.30.13 vendored; upstream tag commit `e9809ef54b18499bb4f2cac945719ecc2a61061b` |
+| Planning-baseline craft-libs pins | `craft-ui` `5c874d51eeb3de70e735c8ce87a59a7dedd47675`, `craft-quit` `f58bc1a3df490992d633393d0898af0588ce882c`, `craft-print` `666c358065261a2816b376fa3bb10538dbf53040`, `craft-docpath` `82a24b006eefa036b43c09a67fb9a3fbd17ffe63` |
+| Planning-era shared-libs integration base | `3832c47ef68a0e6214f2c1e85f3526b6adcb686e`; an ancestor of the current craft-libs pin `25da1314d443171b4adeaad2cd9454b273f35c6f` |
+| Historical planning observation of craft-libs PR 199 | OPEN / CONFLICTING at the then-inspected head `b68de8c5f4f1c060904d211a7b1320aa0f7bce78`; API-port ancestor `8614e4a04fae516fba16c22b31ff1008cb6be10b`; audit merge `ec8840af8c5fda695cf195cdd05e5ae078415c07` |
+| Target egui | 0.37.0, upstream release commit `841a328ba2dd8f6996beb7189ebb7fc00e668a2a` |
+| Planning-era reviewed egui candidate | `aiongg/craft/0.37` HEAD `a4f9a17f64a6bae61350fb85804c9df0d9865916`; the current pin is `6d518fc799681571963842f95b55a6b68431b15a` |
+| Planning-era reviewed winit candidate | `craft/0.30.13-lang` HEAD `8b35388bd719e8cc86a95971ba0bc026c9a8f058`; it lacks W15P PRIMARY, which the current pin `a517b3846ee8457d84ee4975110bfda6797c44dc` contains |
+| Shared rollout contract | `craft-libs/docs/egui-037-suite-rollout.md`, current reviewed content identified by the publication/review ledger; record its landed commit before implementation |
+| Shared library plan | `craft-libs/docs/egui-037-migration-plan.md`, current reviewed content identified by the publication/review ledger; record its landed commit before implementation |
+| Shared egui plan | `egui/docs/egui-037-migration-plan.md`, current reviewed content identified by the publication/review ledger; record its landed commit before implementation |
+
+The following paragraph records the pre-merge planning assessment; PR 199 subsequently merged, and the current pinned shared-library candidate includes its integration and later main work. At planning time, PR 199 was an input to the shared-library work, not a branch to merge. Its head and `ec8840a` are stale relative to current main: they omit `craft-platform` and revert security, settings, docking and printing fixes. Only the API-port hunks from `8614e4a` and the README change from `1764bca` are reused, applied onto `3832c47`; the final library revision must be reviewed and published separately.
+
+This plan covers only PdfCraft. It does not adopt, reset or migrate any other checkout, job, VM or shared target. Historical diagnostics retained in the private task evidence for `egui037-audit-20261022` are pointers only; they are not acceptance evidence.
+
+Entry points:
+
+- Native: `apps/pdfcraft/src/main.rs::main` calls `eframe::run_native`; `app_creator` (`main.rs:365`) builds `PdfCraftApp` and wires storage, control, recovery and GPU state.
+- Web: `apps/pdfcraft-web/src/main.rs::main` uses `eframe::WebRunner::start` with `WebOptions { renderer: Glow }`, `?file=`, `?host=parent` and the before-unload warning.
+- Headless: `crates/ui-egui/examples/shot.rs` uses `egui_kittest::Harness::build_eframe` plus `Harness::render`; `apps/pdfcraft-cli` has no egui/eframe dependency.
+- Tests: `crates/ui-egui/tests/it/main.rs` links the integrated UI tests; `apps/pdfcraft/tests/it/main.rs` links twelve winit source guards; `crates/ui-egui/src/control.rs` has the in-crate control/pointer probes; `crates/ui-egui/tests/perf.rs` is the existing timing harness.
+
+Targets to keep green:
+
+- `apps/pdfcraft` (native binary; wgpu plus glow fallback, accesskit, persistence, links, x11/wayland, native clipboard).
+- `apps/pdfcraft-web` (wasm32, eframe glow; no egui-winit clipboard feature is needed or available there).
+- `apps/pdfcraft-cli` (no egui dependency; unchanged).
+- `crates/ui-egui` (library, unit tests, `tests/it` integrated binary, `tests/perf.rs`, `examples/shot.rs`).
+- `xtask` gates (`fmt`, clippy, test, layers, wasm, assets, deny, parity).
+
+## 2. Actual lifecycle, features and compatibility surface
+
+### 2.1 App boundary
+
+`PdfCraftApp` is declared in `crates/ui-egui/src/lib.rs`; the eframe implementation is `impl eframe::App for PdfCraftApp`:
+
+- `raw_input_hook` applies line-scroll speed and injects the OS drag pointer position before egui reads the frame.
+- `save` repairs minimized-window storage through `window_state::WindowState::keep`.
+- `logic` owns host-side work: context capture, window repair, i18n selection, font installation, UI scale, drag/drop completion, inbox/open queues, OS events, control-channel requests, quit guard, autosave, file watching, update/print/export/OCR/optimize/action polls, deferred shortcuts, per-view input blocking, pending edits and picker completion.
+- `ui` owns per-pass layout: title command, full-screen or normal panels, tab strip, mode bar, right rail, docking or read-mode central panel, palette, dialogs, progress, toasts, then `finish_render_frame`.
+- `finish_render_frame` suspends hidden tabs' render pools and commits the visible/compare views' frame demand.
+
+`crates/ui-egui/src/canvas.rs` is a second lifecycle: `DocView::begin_render_frame` resets demand and the frame queue; `DocView::finish_render_frame` builds the render queue, feeds the pool and calls `DocView::receive` for a bounded upload batch.
+
+### 2.2 Lifecycle truth: `logic` is not a frame clock
+
+At the pinned 0.37 source, both native eframe (`crates/eframe/src/native/epi_integration.rs::update`) and web (`crates/eframe/src/web/app_runner.rs::logic`) call `app.logic` and then `app.ui` inside the `Context::run_ui` closure. A discarded layout reruns both. Hidden or occluded windows can call `App::logic` through `Context::run_logic`, which updates only raw viewport/window-focus information; events, input time, layout and normal pass state remain from the previous UI pass. Input therefore belongs only in a known UI phase (`App::ui` or an explicit method it calls), never in background work that reads `ctx.input` under the assumption that the window is hidden.
+
+Two corrections are binding:
+
+- `ViewportInfo::visible()` describes minimized/occluded state; it does not prove that the current callback is logic-only. A hidden UI paint can be requested for screenshots or injected input.
+- After a normally completed `run_ui`, `current_pass_index()` is zero even after multiple passes: `ContextImpl::end_pass` takes the viewport output with `mem::take`, and `run_dyn` restores the count only immediately before the next UI pass. A first-pass guard does not by itself skip ordinary hidden `run_logic` calls. It is still not a frame clock and cannot supply fresh input.
+
+No `run_ui_with_logic`/E22 scheduler API is adopted. There is no stable one-frame boundary inside `run_ui`, and both hosts already run logic per pass. Queues keyed by consumed identity, command/generation identity and monotonic deadlines provide the required behavior.
+
+### 2.3 Hidden work and current input
+
+- `App::logic` may run repeatedly in one visible frame and may run alone while hidden. Autosave, recovery, playback/audio, open completion, file watching, polls and undo application stay there, but use monotonic elapsed time (`std::time::Instant`, `web_time::Instant` on wasm), not `ctx.input(|i| i.time)`.
+- Fresh wheel, pointer, keyboard and IME input is handled in `App::ui` before panels. `Motion::begin_pass` moves from `logic` into `ui` (before any widget reads wheel input) or is guarded by a fresh-UI-pass token; it must never consume the same `ctx.input` event twice.
+- The grid-drop deadline and control-adjacent timers use monotonic deadlines too.
+- UI-produced commands may commit promptly from the UI. The requirement is exactly-once consumption, not "never commit on a discarded pass": egui cannot know at commit time whether a later widget will request a discard. Screenshot completion and render queues may be cancelled without side effects; an edit/undo transaction may not be duplicated when the pass is replayed.
+
+### 2.4 Feature and cfg inventory
+
+| cfg / feature | Where it matters |
+|---|---|
+| `target_arch = "wasm32"` | `apps/pdfcraft-web`; `ui-egui` disables `file_watch`, `pickers`, `system_fonts`; `fill_sign` image inbox and host bridge; no native window and no egui-winit clipboard |
+| `windows` | hidden-maximized restore, DPI change, DWM frame, IME cursor, auto language, measurement units, DX12 presentation (`apps/pdfcraft/src/main.rs`, `motion.rs`, `single_instance.rs`, winit patches W1/W3/W4/W18/W19) |
+| `target_os = "macos"` | Apple events, traffic lights/full-size content view, ⌘Q menu (`craft-quit`), title-bar drag, IME commit/discard/emoji/Korean (W6–W10, W12, W22–W24, W26) |
+| `target_os = "linux"` | GNOME/Wayland frame decision, compositor GPU selection, Wayland regular clipboard and W15P PRIMARY (W15/W15P/E4), X11 DPI/IME (W5/W11/W20/W21), Wayland scroll phases (W13) |
+| `unix, not macos` | single-instance Unix socket, Wayland/X11 detection, fontconfig directory parsing |
+| `not unix` / other | Windows and wasm branches above; no silent fallback to a native-only API |
+| Native eframe features | `default_fonts`, `wgpu`, `glow`, `accesskit`, `persistence`, `links`, `wayland`, `x11`, **`clipboard`** |
+| `ui-egui` eframe features | `default_fonts`, `wgpu`, `accesskit`, `persistence`, `links`, **`clipboard`** for native consumer/test parity |
+| Web eframe features | `default_fonts`, `glow`, `persistence`, `accesskit`; no winit clipboard path |
+| egui features | `bytemuck` in `ui-egui`; `default_fonts` explicit; **`monochrome_emoji_fonts`** in every egui-consuming target that draws PdfCraft UI text |
+| eframe `system_fonts` | stays off; `NativeOptions::system_font_fallback = false` |
+
+`cargo xtask wasm` checks crates below L8; `cargo check -p pdfcraft-web --target wasm32-unknown-unknown` remains required for the actual web shell. A CI feature-identity assertion must show `egui-winit/clipboard` enabled for native roots after the migration, and `cargo deny`/`cargo metadata` must show exactly the approved fork sources.
+
+### 2.5 Control channel and screenshots
+
+`crates/ui-egui/src/control.rs` is the user-observable automation surface. Today it installs `ControlPlugin`, stores the AccessKit tree and injects queued input in hooks, handles requests in `Control::tick`, receives screenshots as `egui::Event::Screenshot`, sends `ViewportCommand::Screenshot(UserData::new(tag))`, crops and PNG-encodes in `screenshot_png`, and times out after 5 seconds. Its tests live both in `src/control.rs` cfg-test modules and `crates/ui-egui/tests/it/control.rs` (65 tests, linked by `tests/it/main.rs`), including discard handling and `screenshots_of_window_and_region`. PR 1 updates both sets.
+
+egui 0.37 removes `Event::Screenshot` and changes `ViewportCommand::Screenshot` to a one-shot `ScreenshotCallback`. A pending screenshot command itself asks the integration to paint a hidden window; `RequestPaintWhileHidden` is additionally required when injected input must be applied without a screenshot.
+
+`Shared::passes` is a pass counter, not a frame counter. The migration renames the unit to accepted frames and increments it in `output_hook` only when `output.platform_output.request_discard_reasons.is_empty()`; an intermediate discarded pass does not count. A request made before a forced discard is not answered before the intended number of accepted frames.
+
+### 2.6 Panels, docking and window chrome (planning baseline)
+
+PdfCraft uses the 0.37 `Panel` API already in its 0.36 form:
+
+- `chrome::tab_strip`: `Panel::top("tab_strip")`;
+- `chrome::mode_bar`: `Panel::top("mode_bar")`;
+- `chrome::right_rail`: `Panel::right("rail")` and `Panel::bottom("rail-nav")`;
+- read-mode inspector: `Panel::right("read_right_panel")`;
+- central panel in `lib.rs`.
+
+0.36 stores `PanelState` under the panel `Id` passed to the constructor. 0.37 derives it as `parent_ui.scope_id().with_salt(IdSalt::new(id_salt))`; the panel child `Ui` is also salted with the new panel ID. Every named panel key therefore changes, and in-panel widget/focus/scroll state may reset. This is not left to implementation: §6.2 migrates the persisted keys in the first compatibility PR and tests the upgrade from a 0.36 fixture.
+
+Docking is `crates/ui-egui/src/docking.rs`; `DockArea::new(egui::Id::unique("pdfcraft-docking"))` wraps `craft_ui::docking`. Persistence is PdfCraft's own `Workspace` JSON, not egui panel memory. `DockArea::direction` is a new opt-in stock-compatible API planned in craft-libs CL-3; the explicit RTL adoption in PR 4 waits for that reviewed revision. Its visual policy preserves saved physical splits, rectangles and logical tab order.
+
+### 2.7 Window frame, decorations and restoration
+
+`apps/pdfcraft/src/main.rs` owns native options, app creation and GPU setup. `apps/pdfcraft/src/decorations.rs` decides whether GNOME Wayland leaves the frame to the app. `crates/ui-egui/src/platform/window_controls.rs` draws the app frame and resize edges, and `window_state.rs` repairs a 64×64 restored window.
+
+`craft-window` owns `Frame`, `Layout` and `Button`; `window_controls.rs` currently has distinct duplicate types and its own GNOME `button-layout` parser. The migration makes `window_controls` re-export `craft_window::{Button, Layout}` and removes the duplicate parser. `decorations::app_drawn` uses `craft_window::Choice::probe(Prefix::new("PDFCRAFT"))`; `PDFCRAFT_TITLEBAR` accepts `app`, `system` and `desktop` (the last two force the desktop frame), matching craft-window. PdfCraft still applies `with_decorations(false)` only when it will draw its own header bar, and the runtime “Use system title bar” preference still toggles `ViewportCommand::Decorations`; craft-window decides the startup frame, not the runtime preference. The probe is called once at startup and never from `App::ui`.
+
+### 2.8 Fonts and language
+
+`theme::install_fonts_for` calls `ctx.set_fonts(installed_font_definitions(cjk))`; `installed_font_definitions` appends one installed face plus optional script fallbacks. `theme::on_interface_baseline` computes `FontTweak::y_offset_factor` from primary and fallback metrics. `system_fonts::fallback` is the single-face, last-resort policy; `PDFCRAFT_SYSTEM_FONTS=0` disables it.
+
+At the planning baseline, the i18n layer preordered right-to-left translations at catalog load (`i18n::LangInfo.rtl`, `catalog.map_translations(display_rtl)`), and `bidi::display_rtl`, `bidi::visual`, `bidi::wrap` and `bidi::visual_auto` preordered runs because egui 0.36 does not. The current migration removed catalog preordering; `display_rtl` and the other preordering helpers remain test-only. The fork's E5/E12/E13/E15/E16/E17/E20 own reordering now. Keeping `display_rtl` in production alongside E5 would double-reorder text.
+
+### 2.9 Clipboard, IME and input
+
+Text copy/paste goes through egui events; images and file paste use `arboard` directly. Native eframe 0.37 no longer enables `egui-winit/clipboard` implicitly when `default-features = false`; without the explicit feature, text cut/copy/paste loses OS integration and the Wayland clipboard/PRIMARY path is compiled out. `arboard` image/file code can mask that loss in a superficial check.
+
+PdfCraft uses ordinary `egui::TextEdit` for its dialogs, forms, comments composer and text editor; it has no custom IME editor producer requiring an app-side surrounding-text adapter. The pinned egui `6d518fc` contains the TextEdit producer/`IMEOutput` surrounding-text path, and egui-winit calls `set_ime_surrounding_text`; native platform execution and outgoing-text tests remain unqualified.
+
+## 3. Dependency, lockfile and vendor audit
+
+### 3.1 Manifests
+
+| Manifest | egui/eframe facts and required change |
+|---|---|
+| `Cargo.toml` workspace | egui/eframe/egui_extras/egui_kittest 0.36; `[patch.crates-io]` contains `winit = vendor/winit` and `egui-wgpu = vendor/egui-wgpu`. Replace window-stack path patches with approved immutable fork revisions; retain PDF vendors |
+| `crates/ui-egui/Cargo.toml` | eframe features `default_fonts`, `wgpu`, `accesskit`, `persistence`, `links`; add `clipboard`; egui features gain `monochrome_emoji_fonts`; egui_kittest dev-dep `eframe`, `wgpu` |
+| `apps/pdfcraft/Cargo.toml` | eframe features `default_fonts`, `wgpu`, `glow`, `accesskit`, `wayland`, `x11`, `persistence`, `links`; add `clipboard`; Linux dev-dep winit 0.30 for the scroll-policy test |
+| `apps/pdfcraft-web/Cargo.toml` | eframe features `default_fonts`, `glow`, `persistence`, `accesskit`; no clipboard feature or egui-winit dependency |
+| `apps/pdfcraft-cli/Cargo.toml` | no egui/eframe; unaffected |
+
+egui 0.37 no longer enables `default_fonts` by default. PdfCraft explicitly enables it in its own features. `monochrome_emoji_fonts` is chosen (not replacing `✔`/`▲`/`▼` with new SVG glyphs): the fonts are already OFL/MIT, attributed, and preserve existing text symbols deterministically with `PDFCRAFT_SYSTEM_FONTS=0`. The painted submenu arrow is not a font glyph after 0.37 and needs no emoji font.
+
+### 3.2 Lockfile duplicates and family resolution
+
+At planning time the lockfile contained one egui family at 0.36.2; the current qualification lockfile resolves the family at 0.37.0 (see `Current qualification state — 2026-10-25`). Several `vello_common`/`vello_cpu` minors still come through the PDF renderer and epaint. The target state must prove one egui family, one epaint family and one winit:
+
+- `egui`, `epaint`, `emath`, `ecolor`, `eframe`, `egui-winit`, `egui-wgpu`, `egui_extras`, `egui_kittest` all at 0.37.0 from one source.
+- `winit` at 0.30.13 with the craft language patches, from one source.
+- `wgpu` remains 30.x; `egui-wgpu` matches the resolved wgpu.
+- `accesskit` moves 0.24.x → 0.25.x; `accesskit_winit` 0.32.x → 0.34.x; epaint moves to `vello_cpu` 0.2.0 while hayro remains on 0.0.8. E11 is not required for PdfCraft because these versions cannot unify (verify with `cargo tree -e features -i vello_cpu`).
+- Verify `cargo metadata` package versions and sources, not tag names.
+
+### 3.3 Vendored winit provenance and compatibility
+
+`vendor/winit` is 0.30.13 (`vendor/winit/.cargo_vcs_info.json` = `e9809ef5…`) and carries **W1–W13**, not W1–W15. It has no language APIs. The planning-era candidate winit fork `8b35388b` carried W1–W15 plus W17–W27 but not W15P; W16 is not in this cut. W14 (`c488d2e9`, macOS cancelable termination plus `dpi` from crates.io) and W15 (`cf73a29c`, `b05ce129`, per-seat Wayland data device and regular clipboard) are in the fork, not the current vendor.
+
+W14 remains opt-in in the shared winit revision and is **not enabled** by PdfCraft; its existing termination path stays `craft-quit`. Validate that `dpi` resolves once with the git source. W15 regular clipboard is required by E4. In the planning-era candidate `8b35388b`, the **W15P** PRIMARY implementation was a prerequisite added by the shared winit work, using SCTK 0.19.2's `PrimarySelectionManagerState`/device/source/offer on the existing connection and event queue, and had to land before egui P2b. The current pin `a517b384` contains W15P (`PATCHES.md` W15P row; `src/platform_impl/linux/wayland/clipboard.rs`) and W27; native evidence remains open. No second regular `wl_data_device` is acceptable.
+
+The egui fork requires companion winit APIs on their target platforms. Integrate and review the series in the approved public storytold fork, compare every current PdfCraft vendor delta, transfer behavioral tests, then replace the path patch with the final immutable git revision. Record provenance and old/new source hashes in migration evidence. Keep the original vendor until equivalence is established; do not publish an interim personal-fork branch dependency.
+
+### 3.4 Source-guard migration and exact inventory
+
+`apps/pdfcraft/tests/it/main.rs` links twelve winit guard modules. All twelve must be transferred to the winit fork (or replaced by equivalent fork-owned immutable tests), and only behavioral/ABI tests remain in PdfCraft:
+
+`winit_macos_emoji_picker`, `winit_macos_ime_commit`, `winit_macos_ime_discard`, `winit_macos_korean_first_key`, `winit_macos_korean_space`, `winit_macos_title_bar_drag` (W12), `winit_wayland_scroll` (W13), `winit_wayland_text_input` (W2), `winit_windows_hidden_maximized` (W4), `winit_windows_ime_cursor` (W3), `winit_x11_dpi` (W11), `winit_x11_ime_focus` (W5).
+
+PdfCraft keeps the retained `vendor/winit` and `vendor/egui-wgpu` copies as provenance and may read them only for provenance assertions (W1 patch text, base hashes, the W1–W13/E2+E3 rows), never as proof of the code the app runs. The resolved graph is checked from `Cargo.lock`: `vendor_graph.rs` requires the exact canonical storytold git URL, 40-character revision and fragment for the two crates it inspects, `winit` and `egui-wgpu`, and rejects path sources. W17 covers W2, W3, W5–W10, W12 and W13; add W1, W4, W11 and the egui-wgpu behavioral coverage to the same central evidence map. The W15/W15P guard belongs on the winit fork or a behavior test, never on `vendor/winit`.
+
+### 3.5 Vendored egui-wgpu provenance
+
+`vendor/egui-wgpu` is 0.36.2 (`49682f8b…`) with E2+E3. The target is 0.37.0 plus the same two patches. The reviewed fork's E2+E3 commit is `9dd799ab` and adds a `surface_fit` unit test; PdfCraft also has stronger guards:
+
+- `apps/pdfcraft/src/main.rs::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`
+- `apps/pdfcraft/src/main.rs::surface_fit_never_empties_or_overflows_a_surface`
+- `apps/pdfcraft/src/main.rs::vendor_provenance_egui_wgpu_surface_fit_identity`
+- `apps/pdfcraft/src/main.rs::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic`
+- `apps/pdfcraft/src/main.rs::vendor_provenance_egui_wgpu_catch_errors_identity`
+- `apps/pdfcraft/src/main.rs::pipeline_creation_error_is_returned_and_device_remains_usable`
+
+Integrate E2+E3 and the behavioral regressions into the central 0.37 fork, then consume the approved revision. Replace the source-path/source-absence assertions with immutable package identity checks. `surface_texture_limits` and `configure_gpu` remain: the first raises the enabled 2D limit, the second preserves adapter selection, DX12 presentation and indirect-validation behavior.
+
+### 3.6 craft-libs: port only, and account for craft-print/GDI/rgb drift
+
+PR 199's egui port changes `craft-ui` roles, `Id::unique`/`Ui::scope_id`, `egui_extras`/`egui_kittest` 0.37, and the docking fixture's `⋮` → `…`. Reuse those API hunks on current main; do not import the stale tree. PdfCraft needs `craft-ui` for docking/icons/tabs/layout, `craft-window` for the frame decision, and no wholesale move of its PDF-specific print UI into `craft_ui::printing`.
+
+Bumping all four craft-libs crates from their four current pins listed in section 1 to a revision based on `3832c47` carries more than a new field:
+
+- `craft-print` adds the unconditional `craft-winprint-gdi` dependency (`storytold/winprint.rs`, revision `417ac3c4…`), a public `rgb` re-export of the GDI transport, `lpstat -l` description parsing and `Printer.description`.
+- Audit `craft-winprint-gdi` licensing/target cfg/`cargo deny`/Windows build, and the non-Windows `rgb::PrintError::Unsupported` behavior.
+- `Printer` now has `description`; update every literal in the repository. At baseline there are 19 `Printer { … }` literals across `crates/print` and UI tests, not 13. This is a mechanical compile fix, with the craft-print tests and Windows native checks re-run.
+- Keep PdfCraft's own `print_ui.rs` sheet preview and options. `description` is not automatically displayed; a product change to show it is separate.
+- The current main already includes intervening security bounds, settings merge, docking permissions and linear printer-name collision checks; preserve them. The shared-library plan's CL-1 diff gate remains mandatory.
+
+### 3.7 Publication and duplicate-resolution rules
+
+- Pin immutable revisions. A branch name is not a pin.
+- `[patch.crates-io]` in the egui or winit repository does not propagate into PdfCraft. PdfCraft's root must patch every resolved egui-workspace package, including `egui_glow` for GL, `epaint_default_fonts`, the used core/render/test crates, and winit.
+- Use approved public immutable storytold fork revisions after vendor equivalence review. Never add a machine-local absolute path patch or publish another vendor fork to bypass dependency publication.
+- Add a CI assertion that `cargo metadata` resolves exactly one package ID for each family crate and one winit, and that no `path` dependency points outside the repository.
+
+### 3.8 Vendors outside the UI port
+
+`vendor/hayro*`, `vendor/lopdf` and `vendor/vello_common` are renderer/text-engine vendors. Keep their revisions, patches and tests. Inspect vello package identities and feature unification; incompatible versions may legitimately coexist. Do not force unrelated major versions to unify or edit PDF renderer vendors merely to make `cargo tree -d` empty.
+
+## 4. egui 0.37 breaking changes that touch PdfCraft
+
+| Change | PdfCraft use | Required action |
+|---|---|---|
+| `default_fonts` no longer a default feature | explicit in ui-egui, pdfcraft, web, craft-ui dev-dep | keep explicit |
+| `monochrome_emoji_fonts` gates emoji faces | `✔`, `▲`, `▼` and previously `⏵` text | enable the feature; add `egui-icons.ttf` attribution; keep painted submenu arrows out of font coverage |
+| eframe `clipboard` becomes explicit | native eframe with `default-features = false` | enable in native app and native UI tests; web needs none; add feature-identity check |
+| `WidgetType` deprecated alias for `Role` | 52 references, 56 `widget_info` closures | map roles explicitly |
+| `Id::new` deprecated → `Id::unique` | 74 references | semantic rename |
+| `Ui::id()` deprecated → `Ui::scope_id()` | 20 references | mechanical rename; `scope_id()` is the value `id()` returned, not a new inherited ID |
+| `UiBuilder::id` deprecated → `scope_id` | `canvas.rs:2607`; not `chrome.rs:697` | rename only the UiBuilder call |
+| `Panel` constructors take `AsIdSalt`; panel keys derive from parent scope | 5 panels | migrate 0.36 `PanelState` keys in PR 1 and test the upgrade |
+| `Ui::shrink_clip_rect` for panels | all panel content | test clip intersection and overlays |
+| `ViewportCommand::Screenshot` callback; `Event::Screenshot` removed | `control.rs` | bounded weak-slot callback; screenshot command itself paints a hidden window |
+| `Event::MouseWheel` gains `source: MouseWheelSource` | 41 references | add source; use `Unknown`/`Wheel`/`Trackpad`/`Momentum` only |
+| `ScrollStyle.kinetic` / rubber-banding | `fling.rs`, `wheel_pager.rs`, `canvas.rs` | keep PdfCraft fling as document owner; leave egui kinetic for ordinary ScrollAreas; prove one curve |
+| `NativeOptions.system_font_fallback` and `system_fonts` feature | not enabled today | set false and guard |
+| kittest panics on missing glyphs and unnamed inputs | 204 harness constructions in `tests/it` | fix names/glyphs in PR 1; no global disabling |
+| `Event::PasteImage`, `MiddleClickPaste`, PRIMARY | image paste via arboard | adopt the W15P PRIMARY contract; no app-level filtering of the event |
+| `Response::accessible_name`, `Ui::label_inputs_by`, `Ui::name_inputs` | custom widgets and text fields | use for accessible names |
+| Submenu arrow is a painted `arrow_atom` | test labels `"File ⏵"`, `"View ⏵"`, etc. | update labels/accessible names and keep an arrow-painted assertion |
+
+## 5. Fork patch audit: E1–E21 and E21b (planning-era baseline)
+
+Base: `0.37.0` = `841a328b`. The E1–E21 audit below was made against the planning-era fork head `a4f9a17f`; the current qualification pin is `6d518fc` (see `Current qualification state — 2026-10-25`), and the E21b row records the later pin. The patch table in the fork's `PATCHES.md` is provenance; each row was re-audited against the source at `a4f9a17f` and PdfCraft's needs, so rows naming `a4f9a17f` are planning-era history.
+
+| # | Fork commits | Crate | Upstream status at 0.37.0 | PdfCraft need | PdfCraft tests / removal condition |
+|---|---|---|---|---|---|
+| E1 | `8f3abf06` | eframe | not upstream; `ViewportHooks` absent | none today: PdfCraft opens one root viewport; `--new-window` is a separate process | compile only; keep for craft-tablet. Remove when upstream adds per-viewport hooks or craft-tablet no longer needs it |
+| E2+E3 | `9dd799ab` | egui-wgpu | not upstream; #8361 open | required: `Surface::configure` panic and start-up errors | six `apps/pdfcraft/src/main.rs` surface/GPU guards plus fork-owned behavioral tests; remove when upstream fixes #8361 and the start-up error path |
+| E4 | `66bacf23` | egui-winit | upstream #8657 draft; 0.37 still uses smithay | required on Hyprland and every Wayland compositor serving one data device | W15 regular clipboard plus W15P PRIMARY; native Wayland single-data-device test; remove when upstream has the behavior |
+| E5 | `0e27d87e`, `777977b7`, `f7e89e23`, `5b2b8e19` | epaint, egui | #8577 open, #8698 reviewed; not in 0.37 | required for Arabic, Kurdish, Hebrew and mixed-direction text | bidi shaping, caret, selection, mark and no-default-fonts tests; remove only when upstream merges #8577 plus fixes |
+| E6 | `0abfabcf` | egui | not proposed | required: caret moves must not kill IME composition | text-edit IME focus test; remove when upstream has equivalent |
+| E7 | `0670c58a` | egui-winit | not upstream | required: shortcuts on Russian/Arabic/Hebrew Windows layouts | native Windows layout test plus source guard; remove when upstream |
+| E8 | `1b03c10f` | egui | not upstream | required: Thai/Vietnamese/Arabic marks above and below the row | TextEdit pixel/ink test; remove when upstream |
+| E9 | `b2f5cafc`, `e1341a3d`, `5105330d`, `75a5b3d3` | egui | not upstream | required for Arabic/Kurdish chrome (menus, scroll bars, combo boxes, headers) | RTL chrome geometry tests, no double-mirroring; remove when upstream |
+| E10 | `dc90c13e`, `c8e573f7`, `34b2c0d4` | eframe web | not upstream; 0.37 has no `web_keys.rs` | required for the web build on non-Latin layouts and named keys | web build + browser keyboard test; remove when upstream |
+| E11 | `92e61afd` | epaint | #8641 draft; not in 0.37 | not required by PdfCraft: epaint 0.2 vello_cpu cannot unify with hayro 0.0.8 | verify with `cargo tree -e features -i vello_cpu`; keep because other suite apps enable multithreading; remove when upstream flushes |
+| E12 | `e955bb18`, `485c0b89`, `0185887c`, `7015ac23`, `4067b2c4`, `620e070e` | epaint, egui | not upstream; follow-up to #8577 | required for paragraph direction, RTL alignment, ellipsis at the visual end, UAX #9 L1 and linear reordering | direct direction/ellipsis/L1 tests; remove when upstream |
+| E13 | `5e4da7f4` | epaint, egui | not upstream | required for caret/hit-test/Delete/Backspace by grapheme cluster | emoji, combining accent, Devanagari cluster tests; remove when upstream |
+| E14 | `cbd77549`, `b3722ac0` | epaint, egui | not upstream | required: fallback faces on the primary baseline and rows growing to fit | replace PdfCraft's manual `y_offset_factor`; baseline/row-height tests; remove when upstream |
+| E15 | `f1cae609` | epaint, egui | not upstream | required: `LineBreaker` trait, grapheme-safe emergency breaks, `LayoutJob::language` | CJK/Thai/Hindi line breaking tests; remove when upstream |
+| E16 | `b3ef9771`, `bed6dfe3` | epaint, egui | not upstream | required: visual cursor movement with affinity, Home/End in reading order, password mask per cluster, neutral paragraph direction | bidi cursor tests and password-mask test; remove when upstream |
+| E17 | `520435df` | egui | not upstream | required: `Context::set_language`, `UiBuilder::language`, AccessKit root language, one text run per bidi level | AccessKit language and text-run tests; remove when upstream |
+| E18 | `89de8f3c` | eframe | fork-only | required as the bridge from PdfCraft's language to E17 and web screen reader/IME `lang` | `Frame::set_ui_language` test; remove when upstream |
+| E19 | `d64047bf`, `642b74f7`, `baeb4515` | egui-winit, egui | fork-only until winit has the APIs | required for Latin shortcut letters on non-Latin layouts | needs W23/W25; app shortcut test; remove when upstream |
+| E20 | `23955535` | egui | fork-only | required so widget text uses the `Ui` language for shaping and line breaking | language/line-break test; remove when upstream |
+| E21 | `a70470b0` | egui-winit, egui | not proposed | required for macOS press-and-hold/dictation and Wayland IME replacing exact bytes | needs W26/W27; byte-count IME test; remove when upstream |
+| E21b/P7b | `6d518fc799681571963842f95b55a6b68431b15a` | egui-winit, egui | present in the pinned fork; native execution unqualified | bounded outgoing surrounding-text payload, TextEdit producer and Wayland W27 adapter are present in the pinned tree | logical/byte-boundary/password/focus/over-limit tests; native Wayland trace remains open |
+
+### 5.1 Audit notes and traps
+
+- **E2+E3 are not one patch.** The surface fit and the error scopes protect different failures.
+- **E4 + W15P.** Regular clipboard uses the winit data device (W15). PRIMARY is a distinct protocol object on the same connection/event queue and per-seat lifecycle (W15P), using SCTK's PRIMARY objects. It must not bind a second regular `wl_data_device`. Preserve password exclusion and no unchanged-selection reclaim. No “filter `MiddleClickPaste`” substitute is acceptable.
+- **E21b is present in the pinned tree.** The planning-era candidate lacked the producer; pinned egui `6d518fc` contains the TextEdit producer/`IMEOutput` path and egui-winit calls `set_ime_surrounding_text`. PdfCraft uses ordinary TextEdit, so it needs no custom model adapter; native platform execution and outgoing-text tests remain open.
+- **E5/E12/E13/E16 are a dependency chain.** Do not cherry-pick E12 without E5 or E13/E16 without E5.
+- **E14 supersedes PdfCraft's baseline hack but not its Windows hinting.** Keep JetBrains Mono `HintingTarget::Smooth`.
+- **E15/E20 change line breaking.** Native wrapping must be the only wrapper once active.
+- **E17/E20 do not automatically force base direction.** PdfCraft sets `TextDirection::RightToLeft` where the UI locale requires it.
+- **E19 is useless without W23/W25; E21 is useless without W26/W27.**
+- **E11 is not required by PdfCraft.**
+
+### 5.2 winit patch provenance and compatibility
+
+Base: `v0.30.13` = `e9809ef54b18499bb4f2cac945719ecc2a61061b`.
+
+The retained vendor carries W1–W13. The planning-era reviewed language branch `8b35388b` carried W1–W15 plus W17–W27 but not W15P. W16 is not in this cut. The current pin `a517b384` contains W15P PRIMARY and W27 (`PATCHES.md`); native evidence remains open.
+
+| Group | Patches | Purpose | Upstream / removal |
+|---|---|---|---|
+| Windows DPI/frame/IME | W1 `b357a332`, W3 `fd104a4c`, W4 `3fffb7ce`, W18 `894bf2d7`, W19 `fa2e1b3d` | mixed-DPI suggested rect, Korean IME cursor, hidden maximized restore, hidden system caret, IME-consumed key presses | W1 merged on master; W3/W4 open; W18/W19 to be proposed |
+| Wayland | W2 `13ca693b`, W13 `5506b1a9`, W15 `cf73a29c`+`b05ce129`, W15P (present in the pinned fork), W27 `f40c76a2` | text input owned by the seat, scroll phase policy, per-seat data device and regular clipboard, PRIMARY on the same connection, text-input-v3 incoming delete plus the outgoing surrounding-text API that E21b sends | W2 merged; W13 to be proposed; W15 #4729 open; W15P present in the pinned fork; W27 has master equivalents |
+| X11 | W5 `283370ce`, W11 `4df8554b`, W20 `019c95f1`, W21 `23bb19a7` | focused replacement IME context, server DPI fallback, one input context per window, quiet IME spot | W5 open; W11/W20/W21 to be proposed; W20 supersedes W5 |
+| macOS | W6 `a82b90fb`, W7 `9b90d5bd`, W8 `6a87addd`, W9 `9500f25d`, W10 `4a7dd791`, W12 `7facf001`, W14 `c488d2e9`, W22 `0816871e`, W23 `c8cd8aa1`, W24 `4b5bc5a0`, W26 `2b9cd1cf` | NSTextInputClient commit flow, discard marked text, emoji picker, Korean space/first key, title-bar drag, cancelable termination, IME ranges, ⌘-layout names, reset, byte-count delete | W14 is opt-in and not enabled by PdfCraft; others open/to be proposed |
+| Language/tests | W17 `2be27382`, W25 `eb4007da` | regression source guards; `platform::latin_layout::KeyEventExtLatinLayout` | tests go with their patches; W25 required by E19 |
+
+Compatibility rules:
+
+- The egui fork's `egui-winit` calls `winit::platform::latin_layout::KeyEventExtLatinLayout`, `KeyEventExtMacOS::key_with_command`, `WindowExtMacOS::take_ime_delete_surrounding` and `WindowExtWayland::take_ime_delete_surrounding`; E21b also calls `WindowExtWayland::set_ime_surrounding_text`.
+- W14 remains compiled in the shared fork but not opted into by PdfCraft; `craft-quit` remains its terminate path.
+- Re-run winit policy/unit tests in the selected fork and app-facing regressions. Native IME/compositor acceptance still requires actual workflows.
+
+## 6. Migration design
+
+### 6.1 Frame boundary and exactly-once side effects
+
+Keep the existing `eframe::App` hooks. Adding a private phase type is allowed only if implementation proves it simplifies real state ownership; do not add a scheduler API or rerun the whole app through a blanket `Context` bridge.
+
+1. `logic` remains the owner of queues, autosave, recovery, file watching, open completion, background polls, control request admission, undo application and other host state. Replayed passes must not re-enqueue an action, duplicate a command or add a second undo step.
+2. UI-produced editing commands may apply in the UI, as they do today (`chrome.rs`, `canvas.rs`, `dialogs.rs` call `execute`/`apply_edit`). Preserve promptness. The rule is exactly-once by command/response ID or document generation, not “zero commits on discard”. A discarded pass may repeat layout; it must not repeat the edit.
+3. Inventory every UI-side `execute`/`apply_edit`/undo path and add a forced-late-discard test using a real toolbar action. A per-pass pending-command queue keyed by `Response::id`/command identity is preferred over moving all UI side effects into logic.
+4. `DocView::begin_render_frame` may collect per-pass demand. Render/upload commits use document/render generation, not `!ctx.will_discard()` as the correctness boundary. A late discard may discard demand work but must not lose an already-produced first-pass texture.
+5. `Control::tick` remains in `logic` for queue servicing. It sends `ViewportCommand::RequestPaintWhileHidden` while a screenshot or injected input waits. Injected input is consumed once; a replay does not replay the click.
+6. Autosave, recovery, grid-drop timeouts and playback use monotonic time. `Motion::begin_pass` is called from `ui` before panels; no logic-only call consumes `ctx.input` or smooth-scroll state.
+7. `Frame::set_ui_language` runs after language resolution, once per pass only when the resolved language changes; it does not read stale input from `logic`.
+8. Never infer a logic-only phase from `visible() == Some(false)`; hidden UI paint is a known UI phase and must handle current input.
+
+### 6.2 Panels, docking and persistence
+
+Current integration note: the shared side panes and rail described at the top supersede the former docking and panel layout below. Retain historical requirements as context, not as claims of implemented capabilities.
+
+
+The first compatibility PR implements an actual one-time panel-key migration. For each of `"tab_strip"`, `"mode_bar"`, `"rail"`, `"rail-nav"` and `"read_right_panel"`:
+
+- old key (0.36): `Id::new(salt)`;
+- new key (0.37 root panel): `ctx.viewport_id().root_ui_id().with_salt(IdSalt::new(salt))` (equivalently `parent_ui.scope_id().with_salt(IdSalt::new(salt))` for the root).
+- Before the first 0.37 UI pass, if the new key has no persisted `PanelState` and the old key does, read the public `PanelState` and insert it under the new key. Keep the old key untouched for rollback. Do not reset a width that can be migrated.
+
+Test with a synthetic 0.36 memory fixture: write the old key with a known outer width, run the 0.37 app, and assert the panel width survives within 1 point. Dump the old/new IDs for one panel and one child widget. A one-time reset of transient in-panel focus/scroll state is explicitly accepted only if the upgrade test demonstrates it; persisted widths are not reset. PdfCraft's own `docking::Workspace` layout is not touched.
+
+Further tests:
+
+- Panel order: tab strip → mode bar → right rail → central panel. Read-mode inspector must not reorder the rail or duplicate a panel ID.
+- A panel's content clip is a subset of the panel rect and parent clip; popups/comment overlays use `Area`/`Window` layers.
+- Floating docking, tab detach, group move and split resize survive restart from `Workspace` JSON, not egui memory.
+- `DockArea::new(Id::unique("pdfcraft-docking"))`; keep the same salt for craft-ui state. If RTL is selected, pass the explicit direction; persisted split/rectangles/logical tab order stay unchanged.
+
+### 6.3 Viewports
+
+PdfCraft has no deferred or immediate child viewports. Keep `ViewportId::ROOT` as the only production viewport. `window_state` and tests already use it. E1 `ViewportHooks` remains a suite feature, not a PdfCraft requirement. Do not add popout document windows in this port.
+
+### 6.4 Screenshot callback correlation
+
+Replace `ViewportCommand::Screenshot(UserData)` plus `Event::Screenshot` with a bounded, cancelable request record:
+
+- one completion slot per admitted request, owned by that request; the callback holds only a weak reference to the slot;
+- callback stores at most one `Arc<ColorImage>` and wakes the owning root viewport after releasing the slot lock; it never encodes PNG, writes a file, runs commands, or strongly captures `Context` in a cycle;
+- `Context::request_screenshot` or `ViewportCommand::Screenshot` with the one-shot callback; `finish_pending` takes each completed slot exactly once and replies on the app thread;
+- cancellation, timeout and viewport close drop/cancel the slot so a late callback cannot produce a file or second reply;
+- admission defaults are 4 requests, 128 MiB/image and 256 MiB aggregate reserved
+  in-flight/completed image bytes. These cap pending requests and aggregate image bytes. Reserve checked bytes before issuing a capture, using the allowed surface dimensions; revalidate dimensions before issuance after resize/DPI changes. Release reservations on completion, cancellation, oversize/stale rejection and shutdown; tests assert retained bytes return to zero;
+- store issuance-time target-UI logical viewport rect, `pixels_per_point`, requested region
+  and geometry epoch in the slot. Reject/retry any resize/DPI/zoom/surface epoch change
+  before save, even a change back. Callback arguments contain pixels only. The callback image may be smaller because E2 surface fitting reduced it; derive x/y image scale from the returned dimensions and recorded logical bounds, verify aspect/rounding, and do not use `ctx.pixels_per_point()` at completion. A resize/DPI generation mismatch retries within the deadline or returns a defined error;
+- PR 1 waits for the approved craft-ui CL-2F completion-slot helper and adopts it directly; no temporary app-local implementation. Preserve PdfCraft request/path/region/reply policy in `control.rs`.
+
+Hidden-window tests are separate:
+
+- a hidden window with queued injected input needs `RequestPaintWhileHidden` to apply it; without the command the input times out;
+- a pending screenshot command itself requests a paint. A request still queued in app
+  logic, or awaiting settling before UI issuance, needs `RequestPaintWhileHidden` to reach
+  that point; test admission and already-issued capture separately;
+- keep late-callback, cancellation, two-region/out-of-order, close, admission overflow and DPI-change tests. Assert exact reply counts, dimensions/pixels, bounded memory and eventual queue drain.
+
+The dependency boundary also requires P2b's bounded asynchronous W15/W15P transfer API
+(total deadline, cumulative byte cap, bounded workers/queue, completion wake and cancellation),
+and P7's emitted-key identity paired by physical key for repeat/release. PdfCraft adds slow/trickle,
+oversized/canceled paste and event-loop responsiveness checks, plus ordinary held-key/Ctrl+Z
+layout-switch, release-modifier-first and focus-loss cases. Do not copy those internals locally;
+consume the reviewed revisions and assert app-visible behavior. Clipboard shortcut keydown may
+be intercepted before egui sees a Key event, so Ctrl+C/Cmd+V alone is not a stuck-key test.
+
+### 6.5 Fonts and glyph coverage
+
+Keep PdfCraft's single-face, last-resort system-font policy. Do not enable eframe's `system_fonts` provider silently. Set `NativeOptions.system_font_fallback = false` and keep a source/feature guard that `eframe/system_fonts` stays off.
+
+Glyph decision: enable `egui/monochrome_emoji_fonts` in `pdfcraft-ui-egui`, the native app and the web dependency graph. This keeps the existing `✔`, `▲` and `▼` text symbols and the OFL/MIT attributed Noto Emoji/emoji-icon fonts deterministic with `PDFCRAFT_SYSTEM_FONTS=0`; do not replace them with new SVG assets in this migration. The new painted submenu arrow is an atom, not text, and is removed from glyph expectations.
+
+Attribution and assets in the first green PR:
+
+- treat the 0.37 font change as a deliberate fixture change: `⋮` (U+22EE) was never covered by the bundled faces, and the craft-libs test fixture moves to `…`; do not restore a tofu-drawing fixture. Production `…`/`−` remain covered;
+- update all four `[[bundled]]` `epaint_default_fonts` entries from 0.36.2 to 0.37.0;
+- add `egui-icons.ttf`, SHA-256 `122806555c73df7cef55aa1d945289ae27fbc4dbbd31abbb4204ee0cda829cc8`, recorded as the MIT-licensed `emoji-icon-font` subset by John Slegers, with its exact usage;
+- run `cargo xtask assets --write` and then `cargo xtask assets`.
+
+Adopt E14 for fallbacks: set `FontTweak::fallback_align = FallbackAlign::Baseline` for script fallbacks; remove metric-derived `y_offset_factor`; keep Windows JetBrains Mono hinting. Add a glyph-coverage test for every UI literal and catalog translation with `MissingGlyphPolicy::Panic` (or `Fonts::has_glyphs`) for embedded-only, craft-fonts, each script fallback, and `PDFCRAFT_SYSTEM_FONTS=0/1`. A missing glyph is a failure, not a snapshot update.
+
+### 6.6 Language and RTL
+
+Current integration note: the shared side panes and rail described at the top supersede the former docking and panel layout below. Retain historical requirements as context, not as claims of implemented capabilities.
+
+
+End state:
+
+- `logic` resolves the language and calls `frame.set_ui_language(Some(code))` (E18), setting `Context::language` (E17).
+- Translated UI text stays logical in catalogs. Remove `catalog.map_translations(display_rtl)`, `bidi::display_rtl` and the matching label preordering. Rely on E5/E12.
+- Use explicit `TextDirection::RightToLeft` for `ar`/`ckb` labels whose first strong character may be Latin or a placeholder; use `LeftToRight` for file/path labels where the extension must stay at the end; use `Auto` for document-authored text. A small local direction helper is used only where multiple call sites need it; no new fork-only API.
+- Replace `bidi::wrap`/`widgets::wrapped_text` with native `Label`/`LayoutJob` wrapping once E15 is active. A remaining custom wrapper must measure with the same direction/language it paints.
+- Set `Style::right_to_left` for `ar`/`ckb` after auditing manual `Layout::right_to_left` call sites. E9 mirrors chrome, not every manually positioned control. Pass an explicit direction to `craft_ui::DockArea`; do not reverse saved workspace order.
+- Keep `bidi::visual` only for painter paths that cannot use a `LayoutJob`; never combine it with native bidi on the same text.
+- AccessKit labels and copied text stay logical; only painting is reordered.
+
+### 6.7 Input, IME and clipboard
+
+- Add `source` to every `Event::MouseWheel` constructor. The only variants are `Unknown`, `Wheel`, `Trackpad`, `Momentum`. On Wayland, Windows, X11 and web, winit reports `Unknown`; macOS reports `Wheel`, `Trackpad` or `Momentum`.
+- PdfCraft's `fling.rs` remains the document-motion owner. On non-macOS platforms it keeps the existing `MouseWheelUnit::Point` + `TouchPhase::End` heuristic, explicitly including `Unknown`; never use the invented `Finger` or `WheelTilt` egui variants. On macOS its custom fling stays off because the OS sends `Momentum`; test that egui kinetic does not add a second document glide. Ordinary widget `ScrollArea`s keep the egui kinetic default; wheel deltas do not create coast velocity, only pointer-drag velocity and momentum do.
+- E10/E19/W23/W25: verify shortcuts on non-Latin layouts through synthetic `RawInput` and native Windows/macOS/Linux tests.
+- E21/W26/W27: test incoming `DeleteSurroundingBytes` and outgoing E21b surrounding text after delete/commit, deletion-only batches, preedit exclusion, reversed selection, UTF-8 boundaries, long/over-limit selections, field/window switching, password clearing and late serials.
+- Text copy/paste stays on egui events; keep `arboard` for image/file clipboard. Enable eframe `clipboard` for native builds. PRIMARY uses W15P: keyboard-only focus, serial freshness, owner/seat changes, empty/absent offers, self-paste, canceled/slow transfers, password exclusion and no unchanged-selection reclaim. Native evidence on wlroots/KWin/Mutter. No second regular data device.
+
+### 6.8 Accessibility
+
+Current integration note: the shared side panes and rail described at the top supersede the former docking and panel layout below. Retain historical requirements as context, not as claims of implemented capabilities.
+
+
+- Map every `WidgetInfo` role explicitly (`Role::TextInput`, `Role::CheckBox`, etc.).
+- Add accessible names to every input widget. 0.37 kittest fails unnamed inputs; use `labelled_by`, `Ui::label_inputs_by`, `Ui::name_inputs` or `Response::accessible_name`.
+- Keep logical labels in AccessKit. Do not set preordered visual strings.
+- `ControlPlugin` copies the AccessKit tree; `ui.inspect` must keep stable widget IDs across panel migration. Test roles/labels for text field, slider, tab and custom button.
+- Panel resize handles expose `Role::Splitter`.
+
+### 6.9 Rendering and GPU
+
+- Keep `surface_texture_limits` and `configure_gpu`. E2+E3 remain required.
+- Do **not** skip `DocView::receive` uploads on `will_discard`. A first-pass texture is carried into the final merged `TexturesDelta`; skipping it can lose a page. Use generation identity to avoid re-scheduling renders and avoid duplicate whole-image deltas.
+- Assert the final merged `FullOutput.textures_delta.set` contains one whole delta per texture generation; a forced-late-discard test must show the page after the next accepted pass.
+- Keep `RESULTS_PER_FRAME`/`UPLOAD_BYTES_PER_FRAME`, hidden-tab suspension, `PDFCRAFT_RENDERER=wgpu|gl`, OpenGL retry and software-renderer notice.
+- Screenshot readback is callback-driven; never assume it is ready in the same input frame.
+
+### 6.10 Commands, undo and persistence
+
+No command ID, tool ID, `parity/` entry, undo transaction or saved-settings key changes in this port. Preserve `commands.rs` registry IDs, `Session` document generations and undo steps, `Workspace` JSON, `window_state` storage key `window`, and `persist()` keys `pdfcraft`/legacy `printcraft`. The only persistence migration is egui's panel `PanelState` keys in §6.2.
+
+## 7. PR stages and rollback
+
+All publication is gated by explicit human approval. No push or PR is authorized by this plan.
+
+### Stage 0 — harness and baseline (before production change)
+
+- Land only this document and a test-only measurement driver/harness; no production behavior changes.
+- The harness must run on the unmodified baseline `a2ec27b` and, where its adapter permits, stock 0.36.2, stock 0.37.0 and the fork.
+- Record baseline frame/idle/RSS samples, `Context::tessellate` with 120 ASCII labels (#8731), startup phase split (instance/adapter/device → pipeline creation → first frame; #8736), and font install/discovery with `PDFCRAFT_SYSTEM_FONTS=0/1` and provider on/off (#8512).
+- Record `cargo metadata`, lock hash, vendor hashes, hardware, renderer/driver, DPI, fixtures and actual commands. A baseline may not be measured after production changes.
+
+### Shared fork prerequisites (external to PdfCraft)
+
+The implementation is blocked until the shared plans publish approved immutable revisions containing:
+
+- the reviewed winit W1–W15, W17–W27 and **W15P** PRIMARY path (all present in the current pin `a517b384`);
+- the reviewed egui E1–E21 and **E21b/P7b** outgoing surrounding-text integration;
+- the craft-libs API-port hunks on current main, with `craft-window` and `craft-print` drift reviewed.
+
+PdfCraft does not vendor a private copy or bypass missing publication with a path patch.
+
+### PR 1 — atomic first-green compatibility change
+
+Depends on: Stage 0 and the complete approved egui/winit revisions (P2b bounded W15/W15P, P7 key release pairing, P7b IME lifecycle, P7c selection fix), plus craft-libs CL-1/CL-2F. PR 4 RTL docking additionally waits for CL-3.
+
+Scope (one reviewable change set; commits may split by file only if every commit is green):
+
+- Pin the egui 0.37 family and winit 0.30.13 fork revision; update `Cargo.lock`.
+- Enable native eframe `clipboard` in `apps/pdfcraft` and `crates/ui-egui`; add the feature-identity assertion. State that web has no egui-winit clipboard.
+- Enable `monochrome_emoji_fonts`; update `ATTRIBUTION.toml` bundled versions and add `egui-icons.ttf`; run assets write/check.
+- Add storytold egui/winit git URLs to `deny.toml` `allow-git`; keep `unknown-git = "deny"`.
+- Rename `WidgetType`/`Id::new`/`Ui::id`/`UiBuilder::id`; map roles; fix all kittest accessible-name and missing-glyph failures (204 harnesses).
+- Update painted submenu labels: `"File ⏵"` → `"File"`, etc.; update AccessKit/name expectations across `commands.rs`, `theme.rs`, `editing.rs`, `control.rs`, `text_select.rs`, `view.rs`; assert the arrow is painted.
+- Add `MouseWheel.source` with the real variants; migrate the screenshot path to the bounded callback; add panel-key migration.
+- Port from craft-libs current main using only the reviewed API hunks and `craft-window`; add `craft-window` type reuse and retain `PDFCRAFT_TITLEBAR`/runtime preference semantics. Add `Printer.description` to every literal (19 at baseline) and audit craft-print/GDI/rgb drift.
+- Transfer winit/egui-wgpu source guards centrally; replace PdfCraft source-path and `source =` assertions with immutable git graph checks.
+- Remove catalog preordering and `display_rtl` as the fork becomes the sole UI bidi owner;
+  include the focused logical-text/selection regression in this first fork pin.
+- Do not defer names, glyphs, attribution, required bidi adaptation or `deny` to PR 3.
+
+Tests: fmt, clippy `-D warnings`, `cargo test -p pdfcraft-ui-egui`, `cargo test -p pdfcraft`, wasm check, `cargo xtask layers/assets/deny/parity`, native feature/graph assertions, source-guard replacements. Snapshot changes must be reviewed, never auto-accepted.
+
+Rollback: revert PR 1; keep the 0.36 lock and vendor directories in history. Do not leave a 0.37 manifest with a 0.36 lock.
+
+### PR 2 — lifecycle, control and render commit
+
+Depends on: PR 1.
+
+Scope:
+
+- Replace `ctx.input` clocks in autosave/recovery/grid/control timers with monotonic deadlines.
+- Move `motion.begin_pass` into UI before panels; remove stale event reads from logic-only iterations.
+- Complete exactly-once command/edit/undo handling with a real forced-late-discard test; remove any “no commit on discard” assumption.
+- Finish screenshot slot stress: hidden injected input, screenshot command paint, cancel/late/out-of-order/DPI, aggregate reservations.
+- Rename `Pending::Frames`/`Shared::passes` to accepted completed frames; increment only when `request_discard_reasons` is empty; add a forced-discard timing test.
+- Add generation-safe texture tests; do not gate uploads on `will_discard`.
+
+Rollback: revert PR 2; PR 1 retains a complete 0.37 callback and basic regression coverage.
+
+### PR 3 — language, fonts, RTL and accessibility completion
+
+Depends on: PR 2.
+
+Scope:
+
+- `Frame::set_ui_language`; AccessKit language.
+- Expand native wrapping and explicit `TextDirection` tests; catalog preordering and
+  `display_rtl` removal already landed in PR 1 and must not be restored independently.
+- E14 fallback alignment; glyph coverage; `system_font_fallback = false`.
+- `Style::right_to_left` after manual-layout audit; craft-ui `DockArea::direction`.
+- Role/name tests already required by PR 1 are strengthened, not introduced here.
+
+Rollback: revert PR 3; PR 2 remains. If native bidi proves wrong, revert the whole 0.37 family to the 0.36 fork tag `767b1cad` with the old preordering.
+
+### PR 4 — platform window, packaging and documentation
+
+Depends on: PR 1 (can run in parallel with PR 2/3 after rebase).
+
+Scope:
+
+- The type re-export/parser replacement lands in PR 1; PR 4 completes extended native policy tests for `craft-window`: `window_controls` re-exports `craft_window::{Button, Layout}`; `decorations` uses `Choice::probe(Prefix::new("PDFCRAFT"))`; remove duplicate parser; keep runtime `Use system title bar` toggle.
+- Native Linux/Windows GUI checks, web build, packaging checks and clipboard/PRIMARY/IME workflows.
+- Update `vendor/README.md`/`SOURCE.json` only for retained vendors; document removed window-stack copies and exact replacement revisions.
+- Update `docs/development.md` and version statements.
+
+Rollback: revert PR 4; PR 1–3 remain.
+
+### PR 5 — performance evidence and final gates
+
+Depends on: all.
+
+Scope: run the Stage 0 harness on the candidate; add paired release results, stock-0.37 control, peak RSS, idle CPU/repaint, texture counters and startup/font/tessellation measurements; update `ROADMAP.md`/status docs. No behavior change.
+
+DAG:
+
+```
+Shared forks published -> Stage 0 -> PR1 -> PR2 -> PR3 -> PR5
+                                      \-> PR4 -> PR5
+```
+
+PR4 may be rebased alongside PR2/PR3, but do not land two PRs that both rewrite `lib.rs` without a rebase review.
+
+## 8. Test plan with user-observable assertions
+
+### 8.1 Existing suites to keep green
+
+- `crates/ui-egui/tests/it` (one binary): accessibility, actions, panels, controls, comments, content, editing, export, fonts, forms, links, pickers, print, recovery, signing, text selection, viewer, XFA.
+- `crates/ui-egui/tests/perf.rs`: collapsed comments, 500-page scrolling and panel budget tests.
+- `apps/pdfcraft/tests/it`: twelve winit guards (transferred/replaced), and the Wayland scroll-policy compile test.
+- `apps/pdfcraft/src/main.rs`: GPU/surface/adapter guards.
+- `examples/shot.rs`: headless screenshot of the real shell.
+- `crates/ui-egui/src/control.rs`: in-crate control, pointer and multi-pass probes.
+
+Include `crates/ui-egui/tests/it/control.rs`, its discarded-pass requests and `screenshots_of_window_and_region` in PR 1 migration and the existing-suite gate.
+
+### 8.2 New or strengthened assertions
+
+| Area | Test | Assertion |
+|---|---|---|
+| Lifecycle | `logic_runs_per_pass_but_one_action_commits_once` | Native/web-shaped driver runs logic + UI twice in one frame; one click yields one edit/undo step |
+| Hidden logic | `hidden_logic_advances_monotonic_deadlines` | Repeated `run_logic` with advancing wall clock and no new events autosaves once and changes no scroll/zoom |
+| Hidden input | `hidden_injected_input_needs_a_ui_pass` | Queued click times out without `RequestPaintWhileHidden`; applies exactly once with it |
+| E22 | `completed_multipass_resets_pass_index` | After completed `run_ui`, `current_pass_index()` is zero; a hidden call still runs; no first-pass guard is used as a scheduler |
+| Panels | `upgrade_from_036_panel_memory` | Old `Id::new(salt)` width migrates to root-scope key; width within 1 pt; ID dump recorded |
+| Panels | `panel_widget_id_stays_stable` | A widget in a panel keeps the same `scope_id`-derived interaction ID across consecutive 0.37 frames; `unique_id` is not substituted for state |
+| Panels | `panel_clip_is_intersected_with_parent` | Child clip no larger than panel/parent; overlay uses `Area` and remains visible |
+| Docking | `dock_float_detach_and_split_survive_restart` | Same `Workspace` JSON round-trips; panel bodies once; Canvas cannot float/share tabs |
+| Screenshots | `two_screenshot_requests_keep_their_slots` | Two regions complete out of order with own dimensions/colours; each reply once |
+| Screenshots | `hidden_screenshot_command_paints_itself` | A pending screenshot paints a hidden window; no false `RequestPaintWhileHidden` requirement |
+| Screenshots | `late_screenshot_is_dropped_after_cancel` | Timeout/close/cancel produces no second reply/file; reservations return to zero |
+| Screenshots | `dpi_change_uses_capture_geometry` | Request-time ppp/rect correlate the image; mismatch retries or errors, never crops with new scale |
+| Multi-pass | `discard_does_not_duplicate_edit_or_undo` | One toolbar action with `max_passes=2`: one edit, one undo step, one generation change |
+| Texture | `discard_keeps_first_pass_texture_and_deduplicates` | Final merged delta has one whole image per generation; page visible next accepted pass; no upload skip |
+| Control | `after_frames_counts_accepted_frames` | Forced discard does not answer early; answers after intended accepted frames |
+| Input | `unknown_wheel_source_keeps_wayland_fling` | `Unknown` + Point + End glides on Linux; `Trackpad`/`Momentum` policy covered; no `Finger`/`WheelTilt` |
+| Input | `one_finger_lift_glides_once` | Offset after 0.5 s follows `fling.rs`; egui kinetic adds no second document curve |
+| Fonts | `every_ui_string_has_all_glyphs` | All `tl!` literals and catalogs pass `MissingGlyphPolicy::Panic` for embedded + craft-fonts + system-font-off |
+| Fonts | `fallback_rows_share_the_baseline` | Fallback baseline equals primary; row grows; `y_offset_factor` not the mechanism |
+| Language | `arabic_ui_labels_use_an_explicit_paragraph_direction` | With an Arabic face, the label's paragraph direction is `RightToLeft` and its Latin run sits right of the Arabic; English stays `Auto` |
+| Language | `arabic_catalog_stays_logical` | Catalog and command lookups stay in logical order and placeholders keep their positions |
+| Language | `a_tab_with_an_arabic_file_name_keeps_its_logical_accessible_name` | AccessKit label is logical; paint is visual only |
+| Editing | `grapheme_caret_and_delete_are_cluster_safe` | Emoji ZWJ/combining accent move/delete as one cluster |
+| IME | `delete_surrounding_bytes_replaces_exactly` | Exact reported bytes deleted; one undo step |
+| IME | `outgoing_surrounding_text_is_fresh` | After delete+commit, preedit exclusion, cursor/selection changes, long/over-limit/password/focus cases; E21b payload present and bounded |
+| Accessibility | `all_input_widgets_have_names` | Every text input role has non-empty label; no global check disable |
+| Accessibility | `panel_tree_roles_and_order` | Tab strip, mode bar, rail and inspector once; expected roles/order |
+| Menu | `submenu_arrow_is_painted_not_named` | `"File"` etc. accessible labels; arrow atom visible; no `"File ⏵"` dependency |
+| Clipboard | `native_egui_winit_clipboard_is_enabled` | Native graph enables `egui-winit/clipboard`; web does not require it |
+| Clipboard | `wayland_text_clipboard_uses_one_data_device` | Regular clipboard works on Hyprland without a second regular device |
+| PRIMARY | `primary_selection_uses_w15p` | Password excluded, unchanged selection not reclaimed, serial/seat/offer/self-paste/cancel cases; single data device |
+| Selection | `textedit_selection_to_toolbar` | Select a subrange in the paragraph TextEdit, click Bold/colour/underline/spacing in Format and assert only that byte range receives `RangeStyle`, with one undo. Repeat via keyboard/focus surrender. `LineEditor.selection` is populated from cursor_range and used by `LineEditor::style` in `apply_line_format`; right-rail-before-central draw order may protect a path but is not proof. Final fork P7c owns #8763 fix (#8764 remains open/unmerged). #8748 is closed/unmerged and root-only PdfCraft has no child case |
+| Web | `web_named_keys_and_non_latin_shortcuts` | Named keys not typed as text; `Ctrl+S` works on Russian layout |
+| GPU | existing surface tests | 8600×3423 at 250% fitted to 8192; bad surface errors; pipeline error returns `CreateRenderer` |
+
+### 8.3 Deliberate broken-behavior probes
+
+Before accepting each test, temporarily revert the fix and confirm the named test fails:
+
+- remove `surface_fit` → surface-fit test fails;
+- remove `catch_errors` → GPU setup error test fails/panics;
+- re-add `display_rtl` to catalog lookups → `i18n::tests::arabic_catalog_stays_logical` fails;
+- switch E21 back to character counts or remove E21b payload → IME tests fail;
+- enqueue the same UI command on a replayed pass → exactly-once test fails;
+- remove the hidden UI paint command for injected input → hidden-input test times out;
+- remove an accessible name, or restore `"File ⏵"` as the only label → accessibility/menu tests fail;
+- skip uploads on discard → texture/page test fails;
+- count passes instead of accepted frames → control timing test answers early.
+
+## 9. Performance protocol and thresholds
+
+### 9.1 Measurement identity
+
+Record for every run:
+
+- exact source SHA, lockfile SHA-256, `cargo metadata` package IDs and sources;
+- features (`CRAFT_FONTS_DIR` set/unset, `PDFCRAFT_SYSTEM_FONTS=0/1`, `PDFCRAFT_RENDERER=wgpu/gl`, `monochrome_emoji_fonts`, `clipboard`);
+- fixture hash (`tests/perf.rs::big(500)`, `named_comments(10_000)`, panel fixture);
+- OS/kernel, CPU, RAM, GPU/adapter/driver/backend, DPI/scale, window size (1400×900), renderer, profile;
+- software adapter (llvmpipe/WARP) versus real GPU;
+- host load and concurrent builds.
+
+Baseline is measured **before** any production change, on `a2ec27b`, in its own checkout/target/evidence. Candidate runs use the same machine, boot, fixture and environment. The first report and every investigated regression include stock-0.36 and stock-0.37 controls where the harness can run them, with all three identities recorded.
+
+### 9.2 Harness-first method
+
+The Stage 0 harness must exist on the baseline before PR 1. It has three layers:
+
+1. **Frame/idle/memory**: open the 500-page fixture and named-comment fixture; warm up, then alternating paired runs.
+2. **Targeted engine measurements**: `Context::tessellate` of 120 ASCII labels for #8731; startup phases (instance/adapter/device → pipeline creation → first frame) for #8736 on WARP and a real GPU; font install/discovery with `PDFCRAFT_SYSTEM_FONTS=0/1` and provider enabled/disabled in an isolated fixture for #8512.
+3. **Operations**: open + first frame, zoom, page scroll, dock/float, save/reopen.
+
+Method:
+
+- Build/run only through `maintenance/task.py run/status/finish` with a dedicated task, source and evidence directory; no direct cargo fallback. Submit each build/test directly; do not nest a multi-resource driver.
+- Use release binaries and separate processes for baseline/candidate.
+- At least 20 warm-up frames, 1,000 measured frames per revision for frame distributions; 10 warmups/30 timed iterations for steady operations; 20 fresh processes for startup. Record every raw sample; report median/p95/p99 and sample counts.
+- Alternate baseline/candidate order; use paired runs, separate allocations, no concurrent builds or noisy workloads.
+- Measure idle after settling for 5 s: zero repaints after 3 s, process CPU from `/proc/<pid>/stat` or platform equivalent.
+- Peak RSS from `getrusage(RUSAGE_SELF).ru_maxrss` or `/usr/bin/time -v`.
+- Texture/allocation counters from `FullOutput.textures_delta` and `DocView::receive` upload count/bytes; add test-only counters if needed.
+- Never infer UI performance from compile duration; never auto-update a golden or snapshot.
+
+### 9.3 Predefined thresholds
+
+Relative to the paired baseline on the same machine:
+
+| Metric | Acceptable candidate |
+|---|---|
+| Frame median | ≤ baseline median × 1.05 |
+| Frame p95 | ≤ baseline p95 × 1.10 |
+| Frame p99 | ≤ baseline p99 × 1.15, with at least 1,000 observations |
+| Peak RSS | ≤ baseline × 1.10 |
+| Idle CPU | ≤ 1% of one core; zero repaints after 3 s |
+| Texture bytes/frame | ≤ baseline × 1.05 + 1 MiB |
+| Open + first frame | median ≤ baseline × 1.05; p95 ≤ baseline × 1.10 |
+| Operation latency | median ≤ baseline × 1.05; p95 ≤ baseline × 1.10 |
+
+Noise policy: if baseline median varies by more than 3% across repetitions, discard that run and repeat on a quiet machine; never relax a threshold to make a candidate pass. If a candidate fails, re-run once, then profile before deciding. Existing debug `BUDGET = 40 ms` smoke gates remain; stricter existing budgets win. Use the suite's 0.05 ms floor only for sub-millisecond measurements.
+
+## 10. Quality gates and platform matrix
+
+Required for every PR:
+
+- `cargo fmt --check`
+- `cargo clippy -p pdfcraft-ui-egui -p pdfcraft -p pdfcraft-web --all-targets -- -D warnings`
+- `cargo test -p pdfcraft-ui-egui`
+- `cargo test -p pdfcraft`
+- `cargo check -p pdfcraft-web --target wasm32-unknown-unknown`
+- `cargo xtask layers`
+- `cargo xtask assets`
+- `cargo xtask deny`
+- `cargo xtask parity`
+- `cargo xtask ci` in CI
+- `cargo tree -d`/`cargo metadata` duplicate/source assertions
+- native feature assertion for `egui-winit/clipboard` and `monochrome_emoji_fonts`
+- source-guard evidence from the immutable winit/egui-wgpu revisions
+
+Platform rows:
+
+| Platform | Required evidence |
+|---|---|
+| Linux X11 | real GUI: panels, docking, control screenshot, clipboard, IME (fcitx5/IBus), wheel/zoom |
+| Linux Wayland GNOME | app-drawn frame, window controls, resize edges, panel clipping, PRIMARY |
+| Linux Wayland KDE/Sway | server-side frame, same layout and shortcuts, regular clipboard |
+| Linux Wayland Hyprland | text clipboard/PRIMARY single-device, screenshot control |
+| Windows 11 | real GPU and WARP, mixed-DPI drag, hidden maximized restore, >8192 surface, Korean IME, screenshot, craft-print/GDI build |
+| macOS | traffic lights/title-bar drag, ⌘Q save prompt via craft-quit (W14 not opted in), press-and-hold/dictation IME, emoji picker, Korean space |
+| FreeBSD | CI or explicitly unresolved; no GUI claim without a real session |
+| Web (Chromium/Firefox) | `trunk build`, open a PDF, Arabic UI, shortcuts on a non-Latin layout, image paste, no named-key text leakage |
+
+Headless `egui_kittest` is not proof of native focus, IME, file pickers, clipboard/PRIMARY or GPU presentation. A row is either backed by real evidence or listed as unresolved. Record actual selected test counts and failures; zero selected tests are not acceptance.
+
+## 11. Risks and migration traps
+
+1. **Double bidi.** Adopting E5 while keeping `display_rtl`/`bidi::visual` reverses Arabic/Kurdish twice. Remove preordering in the same language PR.
+2. **Panel keys.** 0.37 derives panel IDs from the parent scope; widths reset unless the first compatibility PR migrates `PanelState`. Child widget state may reset once and is measured.
+3. **`Ui::scope_id` is the old `Ui::id`.** Rename mechanically; do not switch existing `ui.id().with(...)` state to `unique_id()`.
+4. **Multi-pass side effects.** `logic` and `ui` run per pass; edits/undo/render queues must be exactly-once. Do not impose “no commit on discard”.
+5. **Hidden windows and stale input.** `run_logic` leaves input events/time stale. Current input belongs in the UI; background work uses monotonic deadlines.
+6. **E22 pass-index fallacy.** After a completed `run_ui`, `current_pass_index()` is zero; a first-pass guard does not skip ordinary hidden logic. No E22 scheduler API.
+7. **Screenshot assumptions.** A screenshot command itself paints a hidden window; injected input needs `RequestPaintWhileHidden`. Callback completion may be off-thread and has no built-in DPI metadata.
+8. **Texture uploads.** Skipping uploads on `will_discard` can lose first-pass textures. Use generation identity and the final merged delta.
+9. **Kinetic scroll.** Use real `MouseWheelSource` variants; `Unknown` is normal on Wayland/Windows/X11/web. Keep one document glide.
+10. **Font provider policy.** eframe's system-font provider can read many installed faces, including proprietary ones; keep it off and preserve `PDFCRAFT_SYSTEM_FONTS=0`.
+11. **Default-font glyph loss.** 0.37 gates emoji fonts; enable `monochrome_emoji_fonts`, add `egui-icons.ttf`, and keep the kittest glyph panic.
+12. **Kittest stricter accessibility.** Unnamed inputs fail; fix labels rather than disabling checks.
+13. **`WidgetType::TextEdit` does not exist as a `Role`.** It is `Role::TextInput`; `Checkbox` is `Role::CheckBox`.
+14. **craft-print drift.** The bump adds `craft-winprint-gdi`, `rgb`, `lpstat -l` descriptions and `Printer.description`; audit all, fix 19 literals and preserve current main's security fixes.
+15. **Winit source guards.** Twelve app modules read old vendor paths; move them centrally and use exact git identities.
+16. **Snapshot churn is not acceptance.** Review every diff and keep semantic pixel tests.
+17. **PRIMARY.** W15P is required and is present in the current winit pin; filtering `MiddleClickPaste` does not avoid the protocol risk and is not the selected design.
+18. **IME surrounding text.** The planning-era candidate lacked E21b/P7b; pinned `6d518fc` contains the producer. Native Wayland execution remains unqualified, so do not describe W27 as complete integration.
+
+## 12. Resolved decisions and external gates
+
+Decisions made by this plan:
+
+- **E11:** not required by PdfCraft; epaint's `vello_cpu` 0.2.0 cannot unify with hayro's 0.0.8. Verify with `cargo tree -e features -i vello_cpu`.
+- **Kinetic scrolling:** PdfCraft's `fling.rs` owns document motion; ordinary widget `ScrollArea`s keep egui's kinetic default. Use `Unknown`/`Wheel`/`Trackpad`/`Momentum`; macOS custom fling is off.
+- **Panels:** migrate persisted `PanelState` keys in PR 1; transient in-panel focus/scroll may reset once only if the upgrade test proves it.
+- **PRIMARY:** adopt W15P on the existing winit connection/event queue; no app-level filtering and no second regular data device.
+- **RTL:** remove catalog preordering; explicit `TextDirection` for UI labels; `Style::right_to_left` after manual-layout audit; explicit craft-ui dock direction; saved workspace order unchanged.
+- **Fonts:** `monochrome_emoji_fonts` on; no broad system provider.
+- **Window frame:** `craft_window::Choice` at startup; `PDFCRAFT_TITLEBAR=app|system|desktop`; `window_controls` uses craft-window types; runtime preference remains a `ViewportCommand::Decorations` toggle.
+- **Screenshot helper:** PR 1 waits for and directly adopts the reviewed craft-ui helper after CL-2F; no local duplicate.
+- **Performance:** harness and baseline precede production; stock-0.37 control accompanies first baseline and regressions.
+
+External gates that cannot be decided from this host:
+
+- final approved immutable storytold egui/winit/craft-libs revisions, including W15P and E21b/P7b;
+- native Wayland PRIMARY/IME evidence on wlroots/KWin/Mutter;
+- Windows real-GPU/WARP and native GUI evidence; macOS and FreeBSD hardware evidence;
+- browser runtime and non-Latin keyboard evidence;
+- explicit human approval of every branch/tag push, PR or publication.
+
+## 13. Limitations of this plan
+
+- No build, test, clippy, fmt, wasm, GUI or performance run was performed. The current tree was read only.
+- No compiler diagnostics were generated for this baseline. Historical audit diagnostics are stale.
+- Upstream status comes from the provided `upstream-discussions.json` snapshot and local refs; it is not a live GitHub query. #8763 and #8764 are an open issue/PR, not release fixes. #8748 is closed and N/A because PdfCraft uses only `ViewportId::ROOT`.
+- No native Wayland compositor, macOS or Windows session was available; PRIMARY, IME, focus and real-GPU behavior remain unverified.
+- No performance baseline has been measured. The thresholds in §9 are predeclared relative limits; the absolute baseline must be recorded before implementation.
+- The exact publication revisions for egui, winit and craft-libs remain external prerequisites, not user choices.
+- Only `docs/egui-037-migration-plan.md` was written. No production file, manifest, lockfile, vendor tree or test was changed.
+
+## 14. Source index used for this plan
+
+PdfCraft:
+
+- `Cargo.toml`, `Cargo.lock`, `deny.toml`, `ATTRIBUTION.toml`, `xtask/src/assets.rs`.
+- `apps/pdfcraft/Cargo.toml`, `apps/pdfcraft-web/Cargo.toml`, `apps/pdfcraft/src/main.rs`, `apps/pdfcraft/src/decorations.rs`, `apps/pdfcraft/tests/it/*.rs`.
+- `crates/ui-egui/Cargo.toml`, `crates/ui-egui/src/lib.rs`, `control.rs`, `canvas.rs`, `chrome.rs`, `window_controls.rs`, `window_state.rs`, `theme.rs`, `system_fonts.rs`, `motion.rs`, `recovery.rs`, `fling.rs`, `wheel_pager.rs`, `wheel_boost.rs`, `scroll_speed.rs`, `bidi.rs`, `widgets.rs`, `print_ui.rs`.
+- `crates/print/src/tests.rs`, `crates/ui-egui/tests/it/*.rs`, `crates/ui-egui/tests/perf.rs`, `crates/ui-egui/examples/shot.rs`.
+- `vendor/README.md`, `vendor/winit`, `vendor/egui-wgpu`, retained `vendor/hayro*`, `vendor/lopdf`, `vendor/vello_common`.
+
+Target/reference source:
+
+- egui 0.37 `841a328b`, planning-era candidate `a4f9a17f` (current pin `6d518fc`): `Context::run_ui`/`run_logic`/`end_pass`/`current_pass_index`, `Ui::scope_id`/`unique_id`, `UiBuilder`, `PanelState`/`Panel::id`, `ScreenshotCallback`, `MouseWheelSource`, `ScrollStyle`/`ScrollArea`, `menu::SubmenuButton::arrow_atom`, `epaint_default_fonts`.
+- winit vendor 0.30.13, planning-era candidate `8b35388b` and current pin `a517b384`: `PATCHES.md`, `platform/wayland.rs::set_ime_surrounding_text`, per-seat clipboard/data-device APIs.
+- craft-libs `3832c47` (planning-era; ancestor of the current `25da131` pin), PR 199 `b68de8c`/`8614e4a`/`ec8840a`: `crates/ui`, `crates/window`, `crates/print`, `docs/egui-037-suite-rollout.md`.
+- Shared evidence: `lifecycle-source-audit.md`, `ime-surrounding-gap.md`, `upstream-discussions.json`.
+
+
+## Local implementation update — 2026-10-23
+
+The user clarified that reviewed plans remain local and implementation proceeds before publication. The earlier requirement to publish/land this plan first is superseded; pushes and PR publication still require explicit approval.
+
+The owned checkout now HEADs at `a2ec27b4775f53c40cad3456936d9406611e3a8d`; `57e531ccca0047597809748b5cb4276336d6051a` and the earlier baseline SHAs above remain historical review evidence, and both refs remain reachable. Current integration uses this checkout and its qualification lock; paired measurements must record the exact source and lock they used.
+
+Preserve document-folder native dialogs, colour popup close policy, panel-header spacing, bookmark contrast, and org_drag cancellation after document changes. Preserve new integration regressions and generate fresh baseline geometry.
+
+The complete static delta review and exact old/new object identities are retained in the task evidence: `canonical-diffs-refresh-20261023.json` and `overnight-consumer-review-20261023.md`. This amendment claims no new build, native GUI or performance acceptance.
+
+## Local implementation amendment — 2026-10-24
+
+**Historical note (superseded by the 2026-10-25 qualification state).** The migration is implemented locally but remains unpublished. At the time of this amendment, `egui`/`eframe`/`egui-wgpu` 0.37.0, the reviewed winit worktree and the shared craft-libs helpers resolved through `local-integration-config.toml`; the checked-in `Cargo.toml`/`Cargo.lock` did not yet pin them. The current tree pins egui `6d518fc`, winit `a517b38` and craft-libs `25da131` (craft-ui, craft-quit and craft-print) directly, while `craft-docpath` remains at `82a24b006eefa036b43c09a67fb9a3fbd17ffe63` (see the top section). The repository quality gates passed as recorded below; publication still requires fresh human approval. No push, PR or release is authorized by this amendment.
+
+The font contract now includes the native-only Simplified Chinese face: the pinned craft-fonts input supplies `fonts/simplified-chinese-manifest.txt` (LXGW WenKai Lite, OFL-1.1), `crates/fonts/build.rs` embeds it on native builds only under a 16 MiB cap, and a `CRAFT_FONTS_REQUIRED` build fails rather than skipping an absent or over-cap required Chinese face. Traditional Chinese is served by an installed `Hant` face placed before the Japanese faces even when LXGW is embedded. CI, release and FreeBSD keep an immutable craft-fonts commit pin; the current candidate is recorded in the task evidence and the pin must be updated only to a published central commit.
+
+Fallback faces now use egui 0.37's `FontTweak::fallback_align = FallbackAlign::Baseline` for the existing one-baseline intent (the metric-derived `y_offset_factor` compensation is gone). Control-channel synthetic input that times out after a press keeps one bounded release batch, so a key, pointer button or modifier cannot stay held when the window resumes. Accepted-frame counting remains one count per presented frame, verified at `max_passes` above two.
diff --git a/docs/form-performance.md b/docs/form-performance.md
index c00adf0913..637fd94986 100644
--- a/docs/form-performance.md
+++ b/docs/form-performance.md
@@ -6,10 +6,11 @@ not fresh measurements on upstream main. No private document is needed for the b
 
 ## Architecture
 
-- `crates/ui-egui/src/forms_ui.rs` queues `Edit::SetFieldValue` for a text commit or checkbox
+- `crates/ui-egui/src/tools/forms_ui.rs` queues `Edit::SetFieldValue` for a text commit or checkbox
   toggle. `crates/automation/src/forms.rs::form_fill` uses the same edit API.
-- `crates/engine/src/lib.rs::Session::apply` runs edits on a copy, preserving rollback and undo.
-  `run_edit` calls `pdfcraft_forms::set_value_with` with an engine `JsRunner`.
+- `crates/engine/src/session.rs::Session::apply` runs edits on a copy, preserving rollback and
+  undo. `run_edit` (`crates/engine/src/edit.rs`) calls `pdfcraft_forms::set_value_with` with an
+  engine `JsRunner`.
 - `crates/forms/src/lib.rs` validates and writes the edited value, then runs one calculation
   pass. `/CO` precedes calculated fields omitted from `/CO`. Each script sees prior writes.
   There is no dependency graph or dependency-based filtering: dynamic references and script
@@ -265,6 +266,8 @@ checks, not hosted CI or a new performance speedup claim.
 
 ## Revision history
 
+- 2026-10-25: point the architecture notes at `session.rs` and `edit.rs`, where `Session::apply`
+  and `run_edit` moved when the engine's `lib.rs` was split.
 - 2026-10-19: refresh PR #3318 onto upstream `e397efa8`, retain upstream roadmap additions
   and all performance changes, and repeat focused, scoped, benchmark and headless validation.
 
diff --git a/docs/gaps.md b/docs/gaps.md
index 4349df5922..56ec3ae748 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,6 @@
 # Where PdfCraft falls short of Acrobat Pro
 
-> **Last reviewed:** 2026-10-20 · **Last updated:** 2026-10-20 · **Change:** minor (gap 6 #3673: Character encoding CJK mapping routes corrected; no readiness re-estimate)
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (gaps 5 and 14 current state: native release Hans face via LXGW WenKai Lite; Arabic logical catalog, explicit RTL direction and mirrored stock chrome, with native/browser/IME workflows unqualified; no readiness re-estimate)
 
 > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-19 · **Change:** minor (gap 2: composite fonts with `/ToUnicode /Identity-H` read as Unicode, hayro-interpret patch 44; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-17 · **Last updated:** 2026-10-17 · **Change:** minor (gap 6: #2662 redaction audit counts a cover over one word of a long line; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -37,7 +37,7 @@ update the numbers.
 |---|---|---|---|---|
 | 2 | Rendering is borrowed and its fidelity unmeasured | feature, spec | 110–190 | [pdf-spec-parity.md](pdf-spec-parity.md) |
 | 3 | Editing existing text is fragile on real files | feature | 100–180 | [target-app-parity.md](target-app-parity.md) |
-| 5 | Chinese UI shows missing-glyph boxes in releases | localization | 6–12 | [localization-parity.md](localization-parity.md) |
+| 5 | Chinese UI lacks a web glyph face | localization | 6–12 | [localization-parity.md](localization-parity.md) |
 | 6 | Open-issue backlog of wrong results in shipped features | stability | 45–80 | this file |
 | 7 | OCR reads only unaccented Latin | feature | 40–75 | [file-format-parity.md](file-format-parity.md) |
 | 8 | Office export weak, Office import absent | file format | 55–100 | [file-format-parity.md](file-format-parity.md) |
@@ -46,7 +46,7 @@ update the numbers.
 | 11 | Accessibility: checker only, no tagging tools | feature | 40–70 | [target-app-parity.md](target-app-parity.md) |
 | 12 | No measured fidelity harness against Acrobat | quality | (in 2) | [target-app-parity.md](target-app-parity.md) |
 | 13 | Performance budgets and lazy loading of very large files | performance | 25–45 | this file |
-| 14 | Arabic not mirrored; no Hindi, Indonesian, Korean | localization | 25–45 | [localization-parity.md](localization-parity.md) |
+| 14 | Arabic RTL unqualified end to end; no Hindi, Indonesian, Korean | localization | 25–45 | [localization-parity.md](localization-parity.md) |
 | 15 | Forms: JavaScript object model, actions, submit, XFA depth | feature | 40–75 | [pdf-spec-parity.md](pdf-spec-parity.md) |
 | 16 | UI precision gaps (multi-select move, rulers, accelerators, windows) | UI/UX | 30–60 | [ui-parity.md](ui-parity.md) |
 | 17 | Certificate security and other protect gaps | feature, spec | 15–30 | [pdf-spec-parity.md](pdf-spec-parity.md) |
@@ -117,18 +117,19 @@ update the numbers.
   how a document looks.
 - **Estimate:** 100–180 h (the longest feature pole, M7). **Doc:** [target-app-parity.md](target-app-parity.md).
 
-### 5. Chinese UI shows missing-glyph boxes in releases
+### 5. Chinese UI lacks a web glyph face
 
-- **Missing:** a Simplified Chinese (`Hans`) UI face in release builds and a working fallback.
+- **Missing:** a Simplified Chinese (`Hans`) UI face in the web build and a working fallback. Native release builds embed LXGW WenKai Lite from the pinned craft-fonts native Simplified Chinese manifest.
 - **Evidence:** [#826](https://github.com/storytold/pdfcraft/issues/826),
   [#688](https://github.com/storytold/pdfcraft/issues/688),
   [#728](https://github.com/storytold/pdfcraft/issues/728),
   [#758](https://github.com/storytold/pdfcraft/issues/758),
-  [#689](https://github.com/storytold/pdfcraft/issues/689) (Flatpak). craft-fonts has Noto Sans
-  CJK SC, but at 16.4 MB it is too large to embed whole; the interface needs a cut of it
-  (storytold/craft-libs#213).
-- **Impact:** the second-largest language group sees a broken interface although the catalog is 97%
-  translated.
+  [#689](https://github.com/storytold/pdfcraft/issues/689) (Flatpak) predate the native face; the
+  web build still embeds only BIZ UDPGothic Regular plus the small Arabic, Hebrew, Thai and Devanagari faces.
+  craft-fonts has Noto Sans CJK SC, but at 16.4 MB it is too large to embed whole; a web face needs
+  a cut of it (storytold/craft-libs#213).
+- **Impact:** the second-largest language group sees a broken interface in the web build although
+  the catalog is 97% translated.
 - **Estimate:** 6–12 h (cut CJK faces through craft-fonts-build plus the fallback chain). **Doc:**
   [localization-parity.md](localization-parity.md).
 
@@ -305,14 +306,18 @@ update the numbers.
   to edit.
 - **Estimate:** 25–45 h. **Doc:** this file.
 
-### 14. Arabic not mirrored; no Hindi, Indonesian, Korean
+### 14. Arabic RTL unqualified end to end; no Hindi, Indonesian, Korean
 
-- **Missing:** a right-to-left layout (panels, menus, alignment), bidirectional text in the text
-  layout itself (wrapping, typed text); catalogs for Hindi, Indonesian and Korean (Acrobat ships
-  Korean; it ships Arabic in its Middle East edition; it ships none of Hindi or Indonesian).
+- **Missing:** end-to-end qualification of right-to-left interface workflows on native platforms
+  and in the browser (typed RTL text, IME composition, clipboard/selection and complex multi-line
+  bidirectional text); catalogs for Hindi, Indonesian and Korean (Acrobat ships Korean; it ships
+  Arabic in its Middle East edition; it ships none of Hindi or Indonesian). The logical catalog,
+  explicit right-to-left label direction and mirrored stock chrome are implemented and
+  unit-tested; complex RTL workflows are not yet accepted.
   Vietnamese ships as a catalog (`vi`, 100% of the current localizable union) but stays `partial`
   like other non-English languages (no translated help; engine/OS details stay English).
-- **Evidence:** [localization.md](localization.md) §Arabic; `misc.rtl-ui` planned.
+- **Evidence:** [localization.md](localization.md) §Arabic; `misc.rtl-ui` planned (end-to-end
+  qualification pending).
 - **Estimate:** 25–45 h (Arabic RTL 20–35, three catalogs 8–12 plus review). **Doc:**
   [localization-parity.md](localization-parity.md).
 
@@ -398,6 +403,7 @@ update the numbers.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | minor | Gaps 5 and 14 current state: native release builds embed LXGW WenKai Lite for Simplified Chinese, while the web build has no Hans face; Arabic catalogs stay logical with explicit RTL label direction and mirrored stock chrome, while native/browser RTL input, IME and complex workflows remain unqualified. Estimates unchanged. |
 | 2026-10-19 | minor | Gap 2: a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (WSCAD) reads its codes as Unicode, so such pages have text to select, find and edit (hayro-interpret patch 44, `view.render-cid-fonts`). Estimates unchanged. |
 | 2026-10-15 | minor | Gap 21: the side-by-side view had already shipped; the Compare panel filters text changes and visual differences. Estimate 10–20 h → 8–16 h |
 | 2026-10-20 | minor | Gap 6 #3673: Character encoding accepts Identity-H/V with Adobe CJK collections, or a predefined non-Identity CMap; negative and indirect-reference regressions and a read-only automation test passed after failing before the fix. Per-glyph validation and embedded-font extraction remain separate. Scores and estimates unchanged. |
diff --git a/docs/hardware-parity.md b/docs/hardware-parity.md
index fcd0e8ac0d..da2b8d92b1 100644
--- a/docs/hardware-parity.md
+++ b/docs/hardware-parity.md
@@ -17,7 +17,7 @@ printing are counted in their feature areas). **Platforms ≈ 70% ready, 15–30
 | Multi-threaded rendering | yes | yes (render pool, tiles, watchdog) | yes | yes | single thread | `view.render-priority` |
 | HiDPI / Retina | yes | yes | yes, per-monitor DPI v2 (#324, #725) | yes | yes | text blurry at 1080p/1440p (#730) |
 | Multiple monitors | yes, multiple windows | one window | one window; surfaces fit the GPU limit (#577) | one window | n/a | `view.multiple-windows` planned |
-| Printers | all, PostScript, printer properties | CUPS via craft-print | Windows PDF raster spooler via craft-print (#756, PR #847) | CUPS via craft-print | the browser's print dialog (every printer the system knows): sheets drawn by PdfCraft at 150–300 dpi; copies, two-sided and colour set there | `crates/print/README.md`, `crates/ui-egui/src/web_print.rs` |
+| Printers | all, PostScript, printer properties | CUPS via craft-print | Windows PDF raster spooler via craft-print (#756, PR #847) | CUPS via craft-print | the browser's print dialog (every printer the system knows): sheets drawn by PdfCraft at 150–300 dpi; copies, two-sided and colour set there | `crates/print/README.md`, `crates/ui-egui/src/workflows/web_print.rs` |
 | Scanners (TWAIN, WIA, ICA) | yes | none | none | none (SANE) | n/a | `ocr.scanner-acquire` planned |
 | Smart cards and USB tokens | yes (PKCS #11, CryptoTokenKit, CNG) | Keychain identities (software keys) | CNG store keys, with PIN prompts for cards (#742) | none (PKCS #11 planned) | none | `sign.pkcs11` planned |
 | Pen and touch | Touch mode, pen ink, Windows Ink | trackpad pinch zoom; ink from pointer, no pressure | ink from pointer, no pressure or touch mode | as macOS | pointer | touchpad scrolling 1:1 (#759, PR #868) |
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
index e6754d1cee..fee2ba3e7b 100644
--- a/docs/localization-parity.md
+++ b/docs/localization-parity.md
@@ -1,6 +1,6 @@
 # Localization parity
 
-> **Last reviewed:** 2026-10-21 · **Last updated:** 2026-10-21 · **Change:** minor (Brazilian Portuguese now covers the 2,674-key catalog union; twelve-language mean still rounds to ≈68%; Spanish 100% of the current key union) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (Persian (`fa`, 2,785 entries) added right-to-left like Arabic and Kurdish; Arabic current state corrected: catalogs stay logical, RTL labels take an explicit direction and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native release Hans face via LXGW WenKai Lite; release-pinned craft-fonts still has no Telugu face. Current union 2,798 keys. Scores and estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Per-language status of PdfCraft's interface against Acrobat Pro's. How translations work and how to
 add a language: [localization.md](localization.md). Summary in [ROADMAP.md](../ROADMAP.md).
@@ -13,7 +13,7 @@ add a language: [localization.md](localization.md). Summary in [ROADMAP.md](../R
   **That union is a moving target**: every change that adds a string widens it, so a count is only
   comparable with others measured on the same date, and a catalog that reached 100% falls behind
   without losing a single translation. Every figure here therefore carries its date. The current
-  union is **2,674** keys as of 2026-10-20, against the **2,143-key snapshot** of 2026-10-10; earlier
+  union is **2,798** keys as of 2026-10-25, against the **2,143-key snapshot** of 2026-10-10; earlier
   revisions quote the union of their own date (see the revision history), not this one. The
   twelve-language percentage table below still quotes the 2026-10-10 snapshot for every language
   except Spanish, Vietnamese, Lithuanian and Brazilian Portuguese, which are measured against the current union. English is
@@ -34,22 +34,22 @@ add a language: [localization.md](localization.md). Summary in [ROADMAP.md](../R
 | Language | Code | UI strings translated | Dialogs / tooltips / help | Script support | Native review | Status | Acrobat ships it | To `full` (h) |
 |---|---|---|---|---|---|---|---|---|
 | English | `en` | built in (100%) | all; README and docs | Latin | yes | **full** | yes | 0 |
-| Simplified Chinese | `zh-hans` | 2,088 (97.4%) | dialogs and tooltips through `tl!`; no help | CJK text and IME work, but **release builds have no Hans face**: many characters show as boxes (#826, #688, #728, #758; Flatpak #689) | no | partial | yes | 6–12 |
-| Spanish | `es` | 2,674 (100% of current key union) | dialogs and tooltips; no help | Latin | no | partial | yes | 2–4 |
-| Hindi | `hi` | 0 | none | Devanagari not tested (egui shapes Telugu conjuncts, so shaping is likely workable); no Devanagari face in craft-fonts | no | none | no | 10–18 |
-| Arabic | `ar` | 2,143 (100%) | dialogs and tooltips; no help | Letters joined and lines reordered at load, but **layout not mirrored**, wrapped lines break at the wrong end, typed text runs left to right (`localization.md` §Arabic) | no | partial | yes (Middle East edition) | 25–45 |
+| Simplified Chinese | `zh-hans` | 2,088 (97.4%) | dialogs and tooltips through `tl!`; no help | CJK text and IME work; native craft-fonts builds embed the **LXGW WenKai Lite** Hans face, while the web build has no Hans face beyond BIZ UDPGothic, and missing-glyph reports (#826, #688, #728, #758; Flatpak #689) predate the native face | no | partial | yes | 6–12 |
+| Spanish | `es` | 2,798 (100% of current key union) | dialogs and tooltips; no help | Latin | no | partial | yes | 2–4 |
+| Hindi | `hi` | 0 | none | Devanagari not tested (egui shapes Telugu conjuncts, so shaping is likely workable); the pinned craft-fonts manifest has Noto Sans Devanagari Regular; rendering remains unqualified | no | none | no | 10–18 |
+| Arabic | `ar` | 2,143 (100%) | dialogs and tooltips; no help | Logical-order catalog; egui 0.37's epaint reorders with UAX #9, Arabic, Kurdish and Persian labels use an explicit right-to-left paragraph direction, and stock chrome is mirrored. Native/browser RTL input and IME, and complex bidirectional workflows, are not yet qualified (`localization.md` §Arabic) | no | partial | yes (Middle East edition) | 25–45 |
 | French | `fr` | 2,128 (99.3%) | dialogs and tooltips; no help | Latin | no | partial | yes | 1–2 |
-| Portuguese (Brazil) | `pt-br` | 2,674 (100% of current union) | dialogs and tooltips; no help | Latin | community (#288) | partial | yes | 1–2 |
+| Portuguese (Brazil) | `pt-br` | 2,798 (100% of current union) | dialogs and tooltips; no help | Latin | community (#288) | partial | yes | 1–2 |
 | Indonesian | `id` | 0 | none | Latin | no | none | no | 3–5 |
 | Japanese | `ja` | 2,123 (99.1%) | dialogs and tooltips; no help | BIZ UDPGothic from craft-fonts; IME patched on macOS, Windows, X11, Wayland; vertical text renders but can't be edited | no | partial | yes | 4–8 |
 | German | `de` | 2,128 (99.3%) | dialogs and tooltips; no help | Latin | community, in progress (#828: terminology, clipping) | partial | yes | 2–4 |
 | Korean | `ko` | 0 | none | Hangul IME patched (Microsoft and Apple Korean, `vendor/README.md` winit 3, 6, 9, 10); no Hangul UI face in craft-fonts | no | none | yes | 6–10 |
-| Vietnamese | `vi` | 2,674 (100% of current key union) | dialogs and tooltips; no help | Latin with stacked diacritics; bundled Inter covers them (fonts test) | community | partial | no | 2–4 |
+| Vietnamese | `vi` | 2,798 (100% of current key union) | dialogs and tooltips; no help | Latin with stacked diacritics; bundled Inter covers them (fonts test) | community | partial | no | 2–4 |
 
 **Localization dimension ≈ 68%**: the mean over the twelve, counting a catalog's percentage but only
 60% for Chinese and Arabic until their script problems are fixed, and 0 for Hindi, Indonesian and
 Korean (still missing). Vietnamese moved from 0% to 100% in that mean (59% → 68%). **≈ 55–110 h**
-to bring all twelve to `full`, of which ≈ 35–60 h is engineering (Hans face, RTL layout, bidi text)
+to bring all twelve to `full`, of which ≈ 35–60 h is engineering (remaining RTL qualification, a web Hans face, bidi text)
 and the rest catalogs and fixes; native-speaker review needs humans.
 
 No language is `full` except English: every catalog leaves engine error details in English, and
@@ -63,31 +63,34 @@ help/docs polish (catalog and script work are already done), not missing UI stri
 | Traditional Chinese | `zh-hant` | 2,016 (94.1%) | partial (same Hans/Hant face caveat) | yes |
 | Russian | `ru` | 2,043 (95.3%) | partial | yes |
 | Bulgarian | `bg` | 2,094 (97.7%) | partial | no |
-| Czech | `cs` | 2,674 entries (every key of the other catalogs, the engine's sentences, weekdays and certificate fields) | partial | yes |
+| Czech | `cs` | 2,794 entries (all but four keys of the current union; the engine's sentences, weekdays and certificate fields) | partial | yes |
 | Telugu | `te` | 2,058 (96.0%) | partial (the release-pinned craft-fonts has no Telugu face yet) | no |
 | Hungarian | `hu` | 2,126 (99.2%) | partial | yes |
 | Ukrainian | `uk` | 2,142 (100%) | partial | yes |
-| Italian | `it` | 2,528 entries (every key of the other catalogs that the code looks up) | partial | yes |
-| Kazakh | `kk` | 2,327 entries | partial | no |
-| Polish | `pl` | 2,287 entries | partial | yes |
-| Slovenian | `sl` | 2,324 entries | partial | no |
-| Greek | `el` | 2,341 entries | partial | no |
-| Turkish | `tr` | 2,313 entries | partial | yes |
-| Lithuanian | `lt` | 2,674 (100% of current key union) | partial; community native-speaker review ([#1401](https://github.com/storytold/pdfcraft/pull/1401)) | no |
-| Finnish | `fi` | 2,674 entries | partial; AI-assisted, native proofreading pending | yes |
-| Albanian | `sq` | 2,344 entries | partial; not yet reviewed by a native speaker | no |
-| Catalan | `ca` | 2,592 entries | partial: no translated help, engine error details in English; native-speaker review by the contributor | no |
-| Romanian | `ro` | 2,673 entries (every bundled key) | partial; AI-assisted, not yet reviewed line by line by a native speaker | no |
-| Norwegian Bokmål | `nb` | 2,674 entries | partial; native-speaker terminology review by the contributor ([#1836](https://github.com/storytold/pdfcraft/pull/1836)), not yet line by line | yes |
+| Italian | `it` | 2,736 entries (all but 62 keys of the current union) | partial | yes |
+| Kazakh | `kk` | 2,539 entries | partial | no |
+| Polish | `pl` | 2,611 entries | partial | yes |
+| Slovenian | `sl` | 2,536 entries | partial | no |
+| Greek | `el` | 2,545 entries | partial | no |
+| Turkish | `tr` | 2,525 entries | partial | yes |
+| Lithuanian | `lt` | 2,798 (100% of current key union) | partial; community native-speaker review ([#1401](https://github.com/storytold/pdfcraft/pull/1401)) | no |
+| Finnish | `fi` | 2,798 entries (every current key) | partial; AI-assisted, native proofreading pending | yes |
+| Albanian | `sq` | 2,524 entries | partial; not yet reviewed by a native speaker | no |
+| Catalan | `ca` | 2,798 entries | partial: no translated help, engine error details in English; native-speaker review by the contributor | no |
+| Romanian | `ro` | 2,798 entries (every current key) | partial; AI-assisted, not yet reviewed line by line by a native speaker | no |
+| Norwegian Bokmål | `nb` | 2,707 entries | partial; native-speaker terminology review by the contributor ([#1836](https://github.com/storytold/pdfcraft/pull/1836)), not yet line by line | yes |
+| Persian | `fa` | 2,785 entries (all but 13 keys of the current 2,798-key union) | partial; AI-assisted, not yet reviewed line by line by a native speaker | no |
 
-**19 other languages** ship (33 catalogs plus English = **34** interface languages in Preferences).
-The entry counts without percentages were measured on 2026-10-12–14 (Norwegian Bokmål on 2026-10-18); they are not percentages of the older 2,143-key snapshot above. Their presence does not imply a detailed linguistic or runtime review.
+**20 other languages** ship (34 catalogs plus English = **35** interface languages in Preferences).
+The entry counts without percentages are as of 2026-10-25; they are not percentages of the older 2,143-key snapshot above. Their presence does not imply a detailed linguistic or runtime review.
 Acrobat languages PdfCraft lacks: Danish, Dutch, Swedish, Hebrew. Vietnamese is shipped here but not by Acrobat.
 
 ## Revision history
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | minor | Arabic current state corrected: catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build still has no Hans face and the release-pinned craft-fonts still has no Telugu face. Scores and estimates unchanged |
+| 2026-10-25 | minor | Added Persian (`fa`, 2,785 entries, all but 13 of the current 2,798-key union); right-to-left like Arabic and Kurdish, with logical entries reordered by egui 0.37's epaint; AI-assisted, not yet native-reviewed |
 | 2026-10-21 | minor | Brazilian Portuguese (`pt-br`) now covers all 2,674 distinct keys in the current catalog union; no help or engine/OS error-detail localization; twelve-language mean still rounds to ≈ 68% |
 | 2026-10-20 | minor | Spanish: the 143 keys the other catalogs had and `es.tsv` was missing; `es` now covers the whole 2,674-key union, like `lt` and `vi`. Restated Lithuanian against the current union (its 2,585 was measured on 2026-10-13) and said plainly in *How this was measured* that the union moves, so counts only compare within a date |
 | 2026-10-19 | minor | Removed the 2026-10-13 status line and the 14-language summary that concurrent merges left beside the current ones; the summary keeps the Italian and Norwegian Bokmål measurement dates |
diff --git a/docs/localization.md b/docs/localization.md
index 90c669892d..e73a149d1d 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -1,10 +1,10 @@
 # Interface language
 
-Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **Русский**, **Қазақша**, **Български**, **తెలుగు**, **Magyar**, **Українська**, **Italiano**, **العربية**, **کوردیی ناوەندی**, **Polski**, **Slovenščina**, **Ελληνικά**, **Türkçe**, **Lietuvių**, **Tiếng Việt**, **Suomi**, **Shqip**, **Català**, **Română** or **Norsk bokmål**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
+Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **Русский**, **Қазақша**, **Български**, **తెలుగు**, **Magyar**, **Українська**, **Italiano**, **العربية**, **کوردیی ناوەندی**, **فارسی**, **Polski**, **Slovenščina**, **Ελληνικά**, **Türkçe**, **Lietuvių**, **Tiếng Việt**, **Suomi**, **Shqip**, **Català**, **Română** or **Norsk bokmål**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
 Displayed keyboard shortcuts use the same active interface language. For example, German shows `Strg+K` and `Strg+Umschalt+S` in the toolbar, menus, command palette, tooltips and Keyboard shortcuts dialog; macOS keeps its modifier symbols (`⌘`, `⇧`, `⌃`). Key names have their own `key` catalog context, so the Delete key can read `Entf` while the command remains `Löschen`. A missing key-name entry falls back to the English key name. Actual bindings and machine-facing command ids remain stable.
 
-**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one, and Ukrainian locales (`uk`, `uk_UA`) the Ukrainian one, and Italian locales (`it`, `it_IT`, `it_CH`) the Italian one, and Arabic locales (`ar`, `ar_MA`, `ar_EG`, `ar_SA`, …) the Arabic one, and Turkish locales (`tr`, `tr_TR`) the Turkish one, and Slovenian locales (`sl`, `sl_SI`) the Slovenian one, Vietnamese locales (`vi`, `vi_VN`) the Vietnamese one, Albanian locales (`sq`, `sq_AL`, `sq_XK`, …) the Albanian one, Catalan locales (`ca`, `ca_ES`, `ca_AD`, `ca_ES@valencia`, …) the Catalan one, and Romanian locales (`ro`, `ro_RO`, `ro-RO`, `ro_MD`) the Romanian one. Norwegian Bokmål locales (`nb`, `nb_NO`) use the Bokmål catalog, and so do general Norwegian (`no`, `no_NO`) and Nynorsk (`nn`, `nn_NO`), which have no catalog of their own. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. Neutral `C`/`POSIX` locale values (including `C.UTF-8`) inherited from a launcher do not override the Windows display language; explicitly named supported locales such as `fr_FR.UTF-8` still do. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
+**Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one, and Ukrainian locales (`uk`, `uk_UA`) the Ukrainian one, and Italian locales (`it`, `it_IT`, `it_CH`) the Italian one, and Arabic locales (`ar`, `ar_MA`, `ar_EG`, `ar_SA`, …) the Arabic one, and Turkish locales (`tr`, `tr_TR`) the Turkish one, and Slovenian locales (`sl`, `sl_SI`) the Slovenian one, Vietnamese locales (`vi`, `vi_VN`) the Vietnamese one, Albanian locales (`sq`, `sq_AL`, `sq_XK`, …) the Albanian one, Catalan locales (`ca`, `ca_ES`, `ca_AD`, `ca_ES@valencia`, …) the Catalan one, and Romanian locales (`ro`, `ro_RO`, `ro-RO`, `ro_MD`) the Romanian one, and Persian locales (`fa`, `fa_IR`, `fa_IR.UTF-8`, `fa-AF`, ...) the Persian one. Norwegian Bokmål locales (`nb`, `nb_NO`) use the Bokmål catalog, and so do general Norwegian (`no`, `no_NO`) and Nynorsk (`nn`, `nn_NO`), which have no catalog of their own. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. Neutral `C`/`POSIX` locale values (including `C.UTF-8`) inherited from a launcher do not override the Windows display language; explicitly named supported locales such as `fr_FR.UTF-8` still do. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
 
@@ -12,56 +12,51 @@ The control channel exposes the setting through `ui.set`:
 {"method":"ui.set","params":{"key":"language","value":"ja"}}
 ```
 
-The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `de`, `es`, `fr`, `ru`, `kk`, `bg`, `te`, `hu`, `uk`, `it`, `ar`, `ckb`, `pl`, `sl`, `el`, `tr`, `lt`, `vi`, `fi`, `sq`, `ca`, `ro` or `nb`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `de`, `es`, `fr`, `ru`, `kk`, `bg`, `te`, `hu`, `uk`, `it`, `ar`, `ckb`, `pl`, `sl`, `el`, `tr`, `lt`, `vi`, `fi`, `sq`, `ca`, `ro` or `nb`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
+The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `de`, `es`, `fr`, `ru`, `kk`, `bg`, `te`, `hu`, `uk`, `it`, `ar`, `ckb`, `pl`, `sl`, `el`, `tr`, `lt`, `vi`, `fi`, `sq`, `ca`, `ro`, `fa` or `nb`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `cs`, `pt-br`, `de`, `es`, `fr`, `ru`, `kk`, `bg`, `te`, `hu`, `uk`, `it`, `ar`, `ckb`, `pl`, `sl`, `el`, `tr`, `lt`, `vi`, `fi`, `sq`, `ca`, `ro`, `fa` or `nb`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Most shipped catalogs (Japanese, Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese, Arabic, Kurdish, Slovenian, Kazakh, Polish, Greek, Turkish, Lithuanian, Vietnamese, Romanian, Norwegian Bokmål and others) cover the current localizable surface (about 2,000–2,700 entries each), and Czech (2,674 entries) covers the same surface. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Document contents, filenames, CLI/MCP/control protocol strings and external help stay outside the catalog. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Most shipped catalogs carry most of the current localizable surface (roughly 2,400–2,800 entries each); Czech (2,794 entries) has all but four keys, and Finnish, Vietnamese, Catalan, Brazilian Portuguese, Spanish, Lithuanian and Romanian have all 2,798. Persian has 2,785. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Document contents, filenames, CLI/MCP/control protocol strings and external help stay outside the catalog. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
 
 Whole sentences that the layers below word — what the accessibility checker found, what the PDF/A verifier reports, what a signature's details say, what is wrong with the pages to print, what an edit is called in the history — are translated too, because those layers hand the sentence over apart from the document's own words. See [Sentences the engine words](#sentences-the-engine-words).
 
-The Ukrainian catalog has 2,047 entries, written from the meaning of the English labels using Ukrainian computing vocabulary. Commands use infinitives; fixed-count messages use count-neutral wording. Plural-aware messages use the three [CLDR Ukrainian integer forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#uk): `1 сторінка`, `2 сторінки`, `5 сторінок`; 11–14 take the third form, while 21 and 22 return to the first and second. Calendar dates use genitive month names (`9 жовтня 2026`), while headings use standalone names (`Жовтень 2026`). Home recommendation cards grow to fit translated text; the toolbar search hint truncates before the shortcut, with the full label available on hover.
+The Ukrainian catalog has 2,530 entries, written from the meaning of the English labels using Ukrainian computing vocabulary. Commands use infinitives; fixed-count messages use count-neutral wording. Plural-aware messages use the three [CLDR Ukrainian integer forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#uk): `1 сторінка`, `2 сторінки`, `5 сторінок`; 11–14 take the third form, while 21 and 22 return to the first and second. Calendar dates use genitive month names (`9 жовтня 2026`), while headings use standalone names (`Жовтень 2026`). Home recommendation cards grow to fit translated text; the toolbar search hint truncates before the shortcut, with the full label available on hover.
 
-The Lithuanian catalog has 2,585 entries and three integer plural forms. Calendar headings use standalone month names; dates use genitive forms. Calendar, inspector and password-dialog UI regressions check dynamic labels and preserve document values. A native Lithuanian-speaking contributor has reviewed the translation.
+The Lithuanian catalog has 2,798 entries and three integer plural forms. Calendar headings use standalone month names; dates use genitive forms. Calendar, inspector and password-dialog UI regressions check dynamic labels and preserve document values. A native Lithuanian-speaking contributor has reviewed the translation.
 
-The Vietnamese catalog has 2,674 entries and one plural form (`plural_none`), covering the current catalog-key union. Preferences theme `Appearance` uses context `theme` → `Giao diện`; object/comment/signature appearance stays plain `Diện mạo`. Form fields use `Trường`; redaction apply wording states permanent removal. Calendar months are numeric (`Tháng 1`…`12` / `tháng 1`…`12`). A native Vietnamese-speaking contributor has reviewed the translation. Status stays `partial`: no translated help, and engine/OS details stay English inside a translated frame.
+The Vietnamese catalog has 2,798 entries and one plural form (`plural_none`), covering the current catalog-key union. Preferences theme `Appearance` uses context `theme` → `Giao diện`; object/comment/signature appearance stays plain `Diện mạo`. Form fields use `Trường`; redaction apply wording states permanent removal. Calendar months are numeric (`Tháng 1`…`12` / `tháng 1`…`12`). A native Vietnamese-speaking contributor has reviewed the translation. Status stays `partial`: no translated help, and engine/OS details stay English inside a translated frame.
 
-The Finnish catalog has 2,762 entries: every key of the other bundled catalogs, written from the English labels in ordinary Finnish computing vocabulary and sentence case. Finnish has the English one/other plural rule, with the partitive singular after any number but 1 (`1 sivu`, `2 sivua`, `0 sivua`). Calendar headings use the nominative month (`Lokakuu 2026`); dates use the partitive (`14. lokakuuta 2026`), and Finnish is also a date language for month and weekday names. Any `fi-*` locale selects it; `sv-FI` keeps English until PdfCraft has a Swedish catalog. The bundled Latin faces cover `ä ö å š ž`. The translation is AI-assisted (Claude Code) and has not yet been proofread line by line by a native speaker.
+The Finnish catalog has 2,798 entries: every key of the other bundled catalogs, written from the English labels in ordinary Finnish computing vocabulary and sentence case. Finnish has the English one/other plural rule, with the partitive singular after any number but 1 (`1 sivu`, `2 sivua`, `0 sivua`). Calendar headings use the nominative month (`Lokakuu 2026`); dates use the partitive (`14. lokakuuta 2026`), and Finnish is also a date language for month and weekday names. Any `fi-*` locale selects it; `sv-FI` keeps English until PdfCraft has a Swedish catalog. The bundled Latin faces cover `ä ö å š ž`. The translation is AI-assisted (Claude Code) and has not yet been proofread line by line by a native speaker.
 
-The Catalan catalog has 2,592 entries, written from the meaning of the English labels in standard Catalan computing vocabulary. Commands use the second-person imperative (`Desa`, `Obre`, `Cancel·la`) and notices use impersonal or informal wording. Catalan has two plural forms like English (1 is singular; 0 and every other count take the plural: `1 pàgina`, `3 pàgines`). Every `ca-*` locale, including Valencian (`ca_ES@valencia`), uses this catalog. The interpunct of `l·l` is U+00B7, which the bundled Latin faces cover (tested in `tests/it/fonts.rs`). The date picker has Catalan month and weekday names; dates are day-first like French (`dddd d mmmm yyyy`), but after a day the month carries its own preposition, elided before a vowel (`7 de març`, `7 d'abril`, `8 d'octubre`), as Czech and Russian change theirs through `months_with_day`; the year takes `\de` from the pattern (`d mmmm \de yyyy`). A native Catalan speaker (the contributor) has reviewed the translation.
+The Catalan catalog has 2,798 entries, written from the meaning of the English labels in standard Catalan computing vocabulary. Commands use the second-person imperative (`Desa`, `Obre`, `Cancel·la`) and notices use impersonal or informal wording. Catalan has two plural forms like English (1 is singular; 0 and every other count take the plural: `1 pàgina`, `3 pàgines`). Every `ca-*` locale, including Valencian (`ca_ES@valencia`), uses this catalog. The interpunct of `l·l` is U+00B7, which the bundled Latin faces cover (tested in `tests/it/fonts.rs`). The date picker has Catalan month and weekday names; dates are day-first like French (`dddd d mmmm yyyy`), but after a day the month carries its own preposition, elided before a vowel (`7 de març`, `7 d'abril`, `8 d'octubre`), as Czech and Russian change theirs through `months_with_day`; the year takes `\de` from the pattern (`d mmmm \de yyyy`). A native Catalan speaker (the contributor) has reviewed the translation.
 
-The Romanian catalog (`ro`, Română) has 2,673 entries and three plural forms (`plural_ro`, CLDR `ro`): `one` for 1, `few` for 0 and counts whose last two digits are 1–19 ("2 pagini", "101 pagini"), `other` for the rest, written with "de" ("20 de pagini"). Commands use the noun form common in Romanian software ("Salvare", "Deschidere…"); messages address the user formally. Redaction is "Anonimizare" ("redactare" means editing in Romanian), a watermark "Filigran". Calendar month names are lowercase inside dates (`{day} {month} {y}`). The bundled Inter faces cover ă, â, î, ș, ț (comma below). Not yet reviewed by a second native speaker; status `partial`: no translated help, and engine/OS details stay English inside a translated frame.
+The Romanian catalog (`ro`, Română) has 2,798 entries and three plural forms (`plural_ro`, CLDR `ro`): `one` for 1, `few` for 0 and counts whose last two digits are 1–19 ("2 pagini", "101 pagini"), `other` for the rest, written with "de" ("20 de pagini"). Commands use the noun form common in Romanian software ("Salvare", "Deschidere…"); messages address the user formally. Redaction is "Anonimizare" ("redactare" means editing in Romanian), a watermark "Filigran". Calendar month names are lowercase inside dates (`{day} {month} {y}`). The bundled Inter faces cover ă, â, î, ș, ț (comma below). Not yet reviewed by a second native speaker; status `partial`: no translated help, and engine/OS details stay English inside a translated frame.
 
-The Norwegian Bokmål catalog covers every key the other bundled catalogs have, with the English one/other plural rule, Norwegian key names (`Mellomrom`; Shift keeps its name) and month and weekday names for Fill & Sign dates. It was written from the meaning of the English labels; a native-speaking contributor reviewed its terminology (key names, Opacity, Redact, Highlight, Fill & Sign), not yet every line.
+The Norwegian Bokmål catalog has 2,707 entries, all but 91 of the current key union, with the English one/other plural rule, Norwegian key names (`Mellomrom`; Shift keeps its name) and month and weekday names for Fill & Sign dates. It was written from the meaning of the English labels; a native-speaking contributor reviewed its terminology (key names, Opacity, Redact, Highlight, Fill & Sign), not yet every line.
 
-Edit text reads Hebrew lines in typing order and writes them back in drawing order (`crates/edit/src/bidi.rs`); letters the page's own font lacks are drawn with the craft-fonts `Hebr` face (Noto Sans Hebrew) as Type 3 glyphs, and a build without one says so. Hebrew points (niqqud) can't be written yet in Edit text. Add text (#128) draws Hebrew with the same face through the shaped path Arabic and Thai use: right to left with numbers and Latin in place, points kept on their letter, and typing order for copy and search. The craft-fonts revision pinned for CI and releases has no `Hebr` face yet, so until one is added releases report that error instead of drawing the missing letters, and refuse Hebrew in Add text.
+Edit text reads Hebrew lines in typing order and writes them back in drawing order (`crates/edit/src/bidi.rs`); letters the page's own font lacks are drawn with the craft-fonts `Hebr` face (Noto Sans Hebrew) as Type 3 glyphs, and a build without one says so. Hebrew points (niqqud) can't be written yet in Edit text. Add text (#128) draws Hebrew with the same face through the shaped path Arabic and Thai use: right to left with numbers and Latin in place, points kept on their letter, and typing order for copy and search. The craft-fonts revision pinned for CI and releases includes the `Hebr` face, so releases draw the missing letters and accept Hebrew in Add text.
 
-Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and in a build without craft-fonts every Chinese character does, on the web and on a desktop machine with no installed Chinese face). Until the interface embeds a `Hans` face, the desktop app draws a Chinese interface with a Chinese face already installed on the machine (Microsoft YaHei or JhengHei on Windows, PingFang, Hiragino Sans GB or STHeiti on macOS, WenQuanYi or Droid Sans Fallback on Linux), placed before the Japanese faces so a line keeps one face (#826). The web build has no installed fonts to fall back on. Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French, Hungarian, Italian, Slovenian, Turkish, Lithuanian, Norwegian, Finnish, Albanian, Catalan and Romanian need only the bundled Latin faces (tested in `tests/it/fonts.rs`). Slovenian has four plural forms: one (1, 101, 201…), two (2, 102…), few (3, 4, 103…) and other (everything else, including 0, 5–20 and 21+), so `@plural` entries list four forms (`1 stran`, `2 strani`, `3 strani`, `5 strani`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
+Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese uses the pinned craft-fonts input too. On native builds, `fonts/simplified-chinese-manifest.txt` adds LXGW WenKai Lite as a `Hans` face (at most 16 MiB, never embedded on the web); Simplified Chinese puts the `Hans` faces first, so a line never mixes faces with different baselines. Traditional Chinese has no embedded `Hant` face: the desktop app places a Traditional Chinese face already installed on the machine (Microsoft JhengHei on Windows, PingFang TC on macOS, a Noto CJK TC or WenQuanYi Zen Hei on Linux) before the Japanese faces, even when LXGW is bundled, because a Simplified-only face cannot supply Traditional-only characters. Without an embedded `Hans` face, Simplified Chinese likewise uses an installed Simplified Chinese face (Microsoft YaHei, PingFang SC, …) placed before Japanese (#826). The web build has no installed fonts to fall back on, so it shows a replacement box for characters the Japanese face lacks. Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French, Hungarian, Italian, Slovenian, Turkish, Lithuanian, Norwegian, Finnish, Albanian, Catalan and Romanian need only the bundled Latin faces (tested in `tests/it/fonts.rs`). Slovenian has four plural forms: one (1, 101, 201…), two (2, 102…), few (3, 4, 103…) and other (everything else, including 0, 5–20 and 21+), so `@plural` entries list four forms (`1 stran`, `2 strani`, `3 strani`, `5 strani`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). A build supplied with a craft-fonts `Telu` face draws Telugu and retains that face in the web payload; egui shapes its conjuncts. The release-pinned craft-fonts input has no Telugu face, so its Telugu labels show replacement boxes.
 
-The Brazilian Portuguese catalog has 2,674 entries and covers the current union of catalog keys. It began with the ~1,826-entry gist André Cardoso posted in [#288](https://github.com/storytold/pdfcraft/issues/288), with labels added since and the existing wording reviewed. Portuguese, like French, treats 0 and 1 as singular (`1 página`, `2 páginas`).
+The Brazilian Portuguese catalog has 2,798 entries and covers the current union of catalog keys. It began with the ~1,826-entry gist André Cardoso posted in [#288](https://github.com/storytold/pdfcraft/issues/288), with labels added since and the existing wording reviewed. Portuguese, like French, treats 0 and 1 as singular (`1 página`, `2 páginas`).
 
 The Albanian catalog (`sq.tsv`, interface name **Shqip**) is written in Standard Albanian with the imperative for commands (`Ruaj`, `Hap`, `Fshi`). Albanian uses two plural forms like English: 1 is singular and every other count, including 0, is plural (`1 faqe`, `2 faqe`). Month and weekday names are lowercase (`mars`, `e shtunë`), and the letters `ë` and `ç` are covered by the bundled Latin faces. It has not been reviewed by a native Albanian speaker yet.
 
 ## Arabic and right-to-left text
 
-The Arabic catalog has 2,137 entries in Modern Standard Arabic with Western digits. Counts use the six [CLDR Arabic forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#ar) (`0`, `1`, `2`, `3–10`, `11–99`, the rest), and dates use the Arabic names of the Gregorian months.
+The Arabic catalog has 2,783 entries in Modern Standard Arabic with Western digits. Counts use the six [CLDR Arabic forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#ar) (`0`, `1`, `2`, `3–10`, `11–99`, the rest), and dates use the Arabic names of the Gregorian months.
 
-egui joins the letters of an Arabic word and runs them right to left, but it places the words of a line left to right in the order they are written. So catalog entries are written in logical (typing) order, and `i18n` puts each one into display order when the catalog loads (`bidi::display_rtl`): the line reads right to left, Latin words and numbers inside it read left to right, `{name}` placeholders and keyboard shortcuts stay whole, spaces at either end stay where the code concatenates, and a short caption keeps its colon on the right, beside the widget it captions. Lookups (`tl!`, `tr`, `trn`) therefore return display-order text for Arabic; `i18n::fmt` inserts values as they are. The command search matches a query of several Arabic words word by word.
+egui 0.37's epaint shapes every line with the Unicode bidirectional algorithm (UAX #9). Catalog entries stay in logical (typing) order and are never preordered: `tl!`, `tr` and `trn` return logical text, `bidi::display_rtl` and `bidi::visual` exist only for the tests that prove the old preordering is gone, and epaint joins and reorders Arabic on every line. Interface labels use an explicit `TextDirection::RightToLeft` in an Arabic, Kurdish or Persian interface, so a label whose first strong character is Latin or a `{placeholder}` still reads right to left. File and path labels use `TextDirection::LeftToRight`, so an Arabic file name keeps `.pdf` at its visual end; document-authored text uses `Auto`. Stock chrome is mirrored through `Style::right_to_left` (menus, combo boxes, scroll bars, headers), and `i18n::fmt` inserts values in one pass. The command search matches a query of several Arabic words word by word.
 
-What Arabic does not have yet:
+Wrapped paragraphs break between words in logical order and epaint reorders each resulting line, so a wrapped label reads in the right direction from the first line down. Text typed into a field is shaped and reordered while editing, and the stored value stays logical.
 
-- **The layout is not mirrored.** Panels, menus, toolbars and alignment are as in the left-to-right languages, with Arabic labels in them.
-- **A wrapped paragraph breaks at the wrong end.** A label too long for its line continues on the next line with its *first* words, so wrapped descriptions and tooltips read from the last line up. Single-line labels are right.
-- **Text you type into a field** (search, comments, form values) has joined letters but its words run left to right while you edit it. What is stored is correct.
-- Labels built by joining translated pieces in code (a list such as `A · B · C`) keep the code's left-to-right order.
+Central Kurdish (Sorani, `ckb`) takes the same path: its catalog is written in logical order and `rtl: true` selects the explicit right-to-left direction; epaint reorders it, so it behaves as Arabic does above. Counts use the two [CLDR ckb forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#ckb) (`one`, `other`); Sorani keeps the noun singular after a numeral, so the two `@plural` forms usually read the same. Dates use the Kurdish names of the Gregorian months. The `Arab` face (Noto Sans Arabic) covers the Kurdish-only letters (`ێ ڵ ڕ ۆ ە ڤ ژ چ گ پ`).
 
-These need bidirectional support in the text layout itself, not in the catalog.
+The Persian catalog (`fa.tsv`, interface name **فارسی**) has 2,785 entries, covering 2,785 of the current 2,798-key union; the 13 keys added after it was written still show English. It is written in contemporary software Persian from the meaning of the English labels. Counts use the two [CLDR `fa`](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#fa) forms (`one` for 0 and 1, `other` for every other count), so `@plural` entries list two forms. It is right to left like Arabic and Kurdish: `rtl: true` selects the explicit right-to-left direction, the entries stay in logical order and epaint reorders each line, and the stock chrome is mirrored as it is for Arabic. Compound words use the zero-width non-joiner (نیم‌فاصله, U+200C), the Persian comma `،` and question mark `؟`, and Persian `ی`/`ک` rather than the Arabic `ي`/`ك`. Dates use the Persian names of the Gregorian months. The `Arab` face (Noto Sans Arabic) covers Persian letters, so it needs no Japanese face. The translation is AI-assisted and has not yet been proofread line by line by a native speaker; status `partial`: no translated help, and engine/OS error details stay English inside a translated frame.
 
-Central Kurdish (Sorani, `ckb`) takes the same path: its catalog is written in logical order and `rtl: true` puts every entry into display order at load (`bidi::display_rtl`), so it behaves as Arabic does above and has the same four limits. Counts use the two [CLDR ckb forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#ckb) (`one`, `other`); Sorani keeps the noun singular after a numeral, so the two `@plural` forms usually read the same. Dates use the Kurdish names of the Gregorian months. The `Arab` face (Noto Sans Arabic) covers the Kurdish-only letters (`ێ ڵ ڕ ۆ ە ڤ ژ چ گ پ`).
+Arabic glyphs come from the craft-fonts `Arab` face (Noto Sans Arabic, kept in the web build too). A build without craft-fonts shows Arabic as replacement boxes on the web; on desktop it falls back to one installed font (below). The craft-fonts revision pinned for CI and releases (`.github/workflows/`) has the Arabic and Hebrew faces. Its Noto Sans CJK SC face is 16.4 MB and is left out by the general CJK cap; native builds take the separately pinned Simplified Chinese face (LXGW WenKai Lite) from `fonts/simplified-chinese-manifest.txt`, and the web build embeds only BIZ UDPGothic Regular plus the small Arabic, Hebrew, Thai and Devanagari faces.
 
-Arabic glyphs come from the craft-fonts `Arab` face (Noto Sans Arabic, kept in the web build too). A build without craft-fonts shows Arabic as replacement boxes on the web; on desktop it falls back to one installed font (below). The craft-fonts revision pinned for CI and releases (`.github/workflows/`) has the Arabic face. That revision also holds Noto Sans CJK SC, which `crates/fonts/build.rs` leaves out for size (16.4 MB whole), so Chinese still has no embedded face of its own (desktop builds fall back to an installed Chinese face, above).
+File names and document titles use the craft-fonts `Arab` face (Noto Sans Arabic) for Arabic and the `Hebr` face (Noto Sans Hebrew) for Hebrew when those faces are included in the build input; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). epaint reorders each line with UAX #9, while file and path labels keep an explicit left-to-right base so the extension stays at the visual end; the tab strip, the recent-files list and Properties show such names in display order.
 
-File names and document titles in Arabic or Hebrew are drawn with a craft-fonts `Arab` face when the build input has one; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). The tab strip, the recent-files list and Properties show such names in display order; other places (bookmarks, comments, search results) have the glyphs but may order mixed-direction text wrongly.
-
-Catalog coverage does not guarantee glyph coverage: the craft-fonts revision pinned for CI and releases has no `Hans` face small enough to embed (desktop builds embed a `Hans` face of at most 4 MiB from `CRAFT_FONTS_DIR`), and the web build embeds only BIZ UDPGothic Regular. Chinese font delivery remains separate work, as discussed in [#112](https://github.com/storytold/pdfcraft/pull/112) and [#140](https://github.com/storytold/pdfcraft/pull/140).
+Catalog coverage does not guarantee glyph coverage. Native builds embed LXGW WenKai Lite as the Simplified Chinese face from the pinned craft-fonts input (at most 16 MiB), while the web build embeds only BIZ UDPGothic Regular plus the small Arabic, Hebrew, Thai and Devanagari faces, so Chinese characters none of those faces has show replacement boxes on the web. Traditional Chinese has no embedded face and uses a `Hant` face installed on the machine, placed before the Japanese faces even when LXGW is bundled.
 
 German labels keep nouns capitalized, including tool names inserted into notices. The certificate viewer uses the `certificate` context for `Subject` (the certificate holder), while document properties keep the plain translation (the topic). Search hints reserve room for the shortcut, and Home cards limit their title and description to the available rows; hovering shows the full text when it is shortened.
 
@@ -92,7 +87,9 @@ Error details that come from the operating system, and faults rather than mistak
 ## Adding a language
 
 1. Copy the header of `ja.tsv` into `xx.tsv` and translate entries.
-2. Add one row to `LANGUAGES` in `crates/ui-egui/src/i18n/mod.rs`: code, native name, catalog and plural rule.
+2. Add one row to `LANGUAGES` in `crates/ui-egui/src/i18n.rs`: code, native name, catalog and plural rule.
 3. Add an `ATTRIBUTION.toml` entry for the catalog (`kind = "translation"`, no `sha256`), then run `cargo xtask assets --write` (it regenerates `ATTRIBUTION.md` only) and `cargo xtask assets`.
 
 The Preferences dropdown, the system-language match, the catalog tests (format, duplicates, placeholders, plural forms, command ids) and the translation gaps report then pick it up.
+
+The egui 0.37 migration pins craft-fonts `b076417b5880bd4154bd22f00695b1d28c6bea83`. That manifest supplies Arabic, Hebrew, Thai and Devanagari faces selected for the web payload, but contains no Telugu face. The build code accepts a `Telu` row when a future input provides one; it does not establish Telugu glyph coverage with the current pin.
diff --git a/docs/mcp.md b/docs/mcp.md
index 77a3c9484d..8aa30ec6e8 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -90,8 +90,10 @@ config works across the suite) keep the agent to the folders you give it:
   nearest existing folder's links are followed and the rest must be plain names, so `..` below a
   folder that doesn't exist is refused, as is a link that leads nowhere (writing through it would
   create its target). The result is compared with the root by whole folder names: `/work2/x` is not
-  inside `/work`. On Windows case is ignored, UNC paths are resolved like drive-letter ones, and
-  device names (`CON`, `NUL`, `COM1`...) are refused.
+  inside `/work`. On Windows case is ignored, device names (`CON`, `NUL`, `COM1`...) are refused,
+  and a path on another network share or in a device namespace than the root's (`\\host\share`,
+  `\\?\UNC\...`, `\\.\...`) is refused by name, before it is resolved, so the host is never
+  contacted. A root on a share accepts the paths on that share.
 - A refused path is an ordinary tool error the agent can read and correct, for example
   `automation path rejected: outside the write root /work/project/out: /etc/x.pdf` or
   `automation filesystem access is not granted: write authority is absent: /work/project/out/x.pdf`.
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index 4ce13f195a..8cfe4be471 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (§12.4.4: page transitions and display times read) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-24 · **Change:** minor (§14.3: custom properties edited in Document Properties) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -44,7 +44,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 | §12.9 | Measurement and geospatial | full | 2D measuring with viewports and calibration; no geospatial | `comment.geospatial` planned |
 | §12.10 | Document requirements | yes | none | |
 | §13 | Multimedia: sound, movies, screen, rich media, 3D (U3D, PRC) | yes | preserved untouched; not played or shown | `misc.rich-media-*`, `misc.3d-view` planned (P3) |
-| §14.3 | Metadata: info dictionary, XMP | full, XMP editor | info dictionary edited, with its XMP counterparts (title, author, subject, keywords, creator tool, producer) kept in step; XMP written for PDF/A; no XMP editor or custom properties | `organize.xmp-editor` planned |
+| §14.3 | Metadata: info dictionary, XMP | full, XMP editor | info dictionary edited, with its XMP counterparts (title, author, subject, keywords, creator tool, producer) kept in step; XMP written for PDF/A; custom properties listed, added, changed and deleted (Document Properties ▸ Custom, `doc_info`, `doc_set_info`); no XMP editor | `organize.custom-properties` partial, `organize.xmp-editor` planned |
 | §14.6–14.8 | Marked content, logical structure, tagged PDF | full, with editing tools | read (checker, bookmarks from structure, redaction of tags); no tag editing or autotag | gap 11 |
 | §14.9 | Accessibility support: alt text, ActualText, language | full | alt text figure by figure, language, title | `a11y.alt-text-workflow` |
 | §14.10 | Web capture | yes | none | |
diff --git a/docs/releasing.md b/docs/releasing.md
index ec2e5853b3..6c7131fdd1 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -69,13 +69,20 @@ pinned in `release.yml` and builds with `CRAFT_FONTS_DIR` and `CRAFT_FONTS_REQUI
 embed its Japanese fonts and fail rather than ship without them (`AGENTS.md` §1.4). Bump the pin
 deliberately.
 
-**OCR models:** every desktop package ships the Scan & OCR models (#103). The packaging scripts call
-`stage_models` (`packaging/env.sh`; `package.ps1` on Windows), which runs `cargo xtask models` to
-fetch every `kind = "model"` file in `ATTRIBUTION.toml` (verified by SHA-256) with its licence text
-and an `ATTRIBUTION.txt`, straight into the package, so packaging needs the network. They go where
-`pdfcraft_ocr::Models::dirs_beside_exe` looks: `models\` beside `pdfcraft.exe` (MSI, portable zip),
-`PdfCraft.app/Contents/Resources/models` (macOS), and `share/pdfcraft/models` beside `bin/`
-(deb, rpm, tar.gz, AppImage, Flatpak, FreeBSD). The web build doesn't include them yet.
+**OCR models:** desktop packaging stages the Scan & OCR models (#103).
+The packaging scripts call `stage_models` (`packaging/env.sh`; `package.ps1` on Windows), which runs `cargo xtask models` to fetch every `kind = "model"` file in `ATTRIBUTION.toml` and verify its SHA-256.
+The current detection and recognition files are `text-detection.onnx` and `text-recognition.onnx`.
+Each model ships with its licence text and the directory's `ATTRIBUTION.txt`, so packaging needs the network.
+Upstream announced the legacy RTEN download URLs' brownout in [ocrs #282](https://github.com/robertknight/ocrs/issues/282) on 2026-10-27 and directs consumers to the ONNX models.
+
+Runtime discovery prefers a complete ONNX detection/recognition pair within each directory, then a complete legacy `text-detection.rten` / `text-recognition.rten` pair.
+An incomplete ONNX update can therefore use an intact RTEN pair in the same directory.
+Discovery never combines model formats or files from different directories.
+Directory precedence stays the same: `$PDFCRAFT_MODELS`, the release-package locations beside the executable, then the source tree's `assets/models/`.
+The first directory with a complete supported pair wins, even if an earlier legacy pair precedes a later ONNX pair.
+
+The release-package locations are `models\` beside `pdfcraft.exe` (MSI, portable zip), `PdfCraft.app/Contents/Resources/models` (macOS), and `share/pdfcraft/models` beside `bin/` (deb, rpm, tar.gz, AppImage, Flatpak, FreeBSD).
+The web build does not include these models, and OCR remains limited to the Latin alphabet without accents.
 
 ### macOS
 
@@ -148,7 +155,18 @@ neither the MSI nor the portable zip needs the Visual C++ redistributable.
 - The portable zip holds both executables, the README, the licences, the OFL licence of each
   embedded craft-fonts family, and `portable.txt`. That marker beside `pdfcraft.exe` keeps the
   settings, logs, crash recovery and new digital IDs in `PdfCraftData\` next to the exe instead of
-  `%APPDATA%` and `%LOCALAPPDATA%` (`crates/ui-egui/src/portable.rs`).
+  `%APPDATA%` and `%LOCALAPPDATA%` (`crates/ui-egui/src/platform/portable.rs`). The MSI carries the same
+  OFL notices; `-SkipBuild` requires `CRAFT_FONTS_DIR` so they can be staged, or
+  `-BuiltWithoutCraftFonts` for binaries built without that input, and `test-msi.ps1` checks that
+  the compiled MSI has OFL notice rows when expected (and none for a no-font build).
+  Before either package is created, `font-notices.ps1` validates every declared OFL notice in
+  `fonts/manifest.txt` and the native `fonts/simplified-chinese-manifest.txt` when present
+  (required when `CRAFT_FONTS_REQUIRED` is set). Missing or empty family notices fail packaging;
+  one family's notice cannot cover another. The check conservatively includes declared faces
+  omitted by build-time size caps. `test-font-notices.ps1` exercises these failures in CI.
+  The supplied checkout must match the existing binaries when using `-SkipBuild`.
+  That presence check does not establish byte-for-byte payload or installation coverage;
+  final package qualification still checks all notices against the staged files.
 - **Signing:** `packaging/windows/sign.ps1` signs both executables and the MSI with `signtool`
   (SHA-256, RFC 3161 timestamp), from a `.pfx` (`WINDOWS_CERTIFICATE`) or Azure Trusted Signing
   (`AZURE_*`), whichever is configured. It is the one place to change when signing changes.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 6b079d12f1..25205e92c1 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,6 +1,7 @@
 # PdfCraft roadmap: milestones and what's next
 
-> **Last reviewed:** 2026-10-23 | **Last updated:** 2026-10-23 | **Change:** minor (M8, #3205 follow-up: labelled Italian international phone numbers with a slash match whole; estimates unchanged)
+> **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
+> **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
 
@@ -135,15 +136,15 @@ In order. Each item names its entry in [gaps.md](gaps.md).
    Encrypted output that Acrobat opens shipped with #836 (#774).
 2. **Fix the crash and wrong-result reports** filed against shipped features (gap 6). The first
    batch (#799–#821, including the panic in #816) is fixed.
-3. **A Chinese UI face in releases** (gap 5, #826).
+3. **A Chinese UI face in the web build** (gap 5, #826).
 4. **A fidelity harness against Acrobat, then the renderer decision** (gaps 12 and 2). Owner
    decision needed: our own M2 devices, or #841's proposal as the bridge.
 5. **Editing existing content** (gap 3, M7): fonts, subsets, reflow, CJK and RTL.
 6. **Pro workflows:** OCR languages (gap 7), Office export/import (gap 8), Preflight and PDF/A/X/UA
    (gap 9), signatures with tokens, timestamp servers and online LTV (gap 10), accessibility
    tagging (gap 11).
-7. **1.0 polish (M14):** performance budgets and lazy loading (gap 13), right-to-left layout and the
-   missing languages (gap 14), keyboard-only operation, a screen-reader audit.
+7. **1.0 polish (M14):** performance budgets and lazy loading (gap 13), end-to-end right-to-left
+   qualification and the missing languages (gap 14), keyboard-only operation, a screen-reader audit.
 
 Decided against for now (owner, 2026-10-05): self-installing updates and an update check at start.
 Help ▸ Check for updates is manual only.
@@ -177,7 +178,7 @@ total matches the parity estimate.
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Renderer-creation errors return to the existing OpenGL startup fallback; a real-GPU regression covers errors and device reuse. The underlying x86 DX12 shader compiler failure remains unresolved; see `windows-renderer-startup.md`. With Windows' Animation effects turned off, the wheel scrolls and zooms without easing and egui's animations take no time (`motion.rs`; macOS, Linux and the browser aren't asked yet); Preferences ▸ Animation effects (Use system setting, On, Off) decides it on every platform. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
-| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: the Comments panel groups replies by name and counts all page roots once per frame (#2669, item 5); stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles; Ctrl+Enter submission for highlight comment text and replies, with Shift+Enter newlines (reconciled with upstream main for PR #1457 on 2026-10-14). Missing: custom stamps, replace-text proposals, summary layouts with the page |
+| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: replies thread by their `/IRT` reference rather than the parent's `/NM`, so files that repeat names per page (PyMuPDF) thread correctly, and the Comments header counts comments without their replies, as Acrobat does, with the reply count under it; the Comments panel groups replies and counts all page roots once per frame (#2669, item 5); stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles; Ctrl+Enter submission for highlight comment text and replies, with Shift+Enter newlines (reconciled with upstream main for PR #1457 on 2026-10-14). Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links; nested FDF export uses lazy array owners and annotation positions, with retained entries budgeted before cloning under copied-graph limits and source `/Page` and `/Pages` dictionaries replaced by null at every copy depth); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. A refused restyle or resize of a text box another program drew leaves that comment unchanged (#1327). Make Current Properties Default on an arrow updates arrows, not plain lines (#1302). Flattening keeps a visible comment it cannot draw (#1317). Missing: custom stamps, replace-text proposals, summary layouts with the page |
@@ -193,13 +194,13 @@ total matches the parity estimate.
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Image redaction removes alternate images and unsupported masks only on affected images. Changed marked-content spans lose replacement descriptions; untouched spans keep theirs. Hidden-text cleanup retires unused named descriptions across inherited/shared page and form resources (64 focused tests and scoped Rust 1.96 Clippy/wasm checks pass; publication CI pending). The redaction audit counts a filled cover that hides half of any one word of a long line (#2662), applied or not. Phone-pattern redaction also matches labelled Italian geographic numbers with `+39` and a slash after the area code (#3205 follow-up); unlabelled international slash numbers remain unsupported. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites, page validation overlays separate from original signature artwork (baked Not Verified captions remain; #79 open), snapshot tabs that reuse instead of multiplying. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
-| M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Lossless image export applies per-component Decode, including Indexed mapping (#1201 partial). Existing 16-bit precision and color-management limits remain. #3532 partial: vector printing retains existing appearances with absent Subtype through a print-owned Form copy; source artwork stays unchanged. #3120: Office export reads form XObjects 50 levels deep, as the renderer does, and up to 50 000 a page; pages past that are listed in `truncated_pages`. Word table cells use the grid columns they span, including cells after a merged cell. Done since: text in a table slot covered by another cell's span remains as paragraph text in Word, HTML, RTF and PowerPoint. Missing: OCR languages beyond Latin, editable-text OCR output, full Office layout fidelity/import. Done since: dotted-leader contents entries stay in separate complete paragraphs (#1757) #2156 candidate: last selected print paper persists across sessions; other print preferences unchanged. Image export applies soft-mask Decode opacity intervals before resizing, including indirect entries and inverted ranges. Vector printing gives annotation appearances unoccupied XObject names so existing page artwork survives. |
+| M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Model staging fetches SHA-256-verified ONNX detection/recognition files after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, then complete legacy RTEN pairs, without mixing formats or changing directory precedence. Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Lossless image export applies per-component Decode, including Indexed mapping (#1201 partial). Existing 16-bit precision and color-management limits remain. #3532 partial: vector printing retains existing appearances with absent Subtype through a print-owned Form copy; source artwork stays unchanged. #3120: Office export reads form XObjects 50 levels deep, as the renderer does, and up to 50 000 a page; pages past that are listed in `truncated_pages`. Word table cells use the grid columns they span, including cells after a merged cell. Done since: text in a table slot covered by another cell's span remains as paragraph text in Word, HTML, RTF and PowerPoint. Missing: OCR languages beyond Latin, editable-text OCR output, full Office layout fidelity/import. Done since: dotted-leader contents entries stay in separate complete paragraphs (#1757) #2156 candidate: last selected print paper persists across sessions; other print preferences unchanged. Image export applies soft-mask Decode opacity intervals before resizing, including indirect entries and inverted ranges. Vector printing gives annotation appearances unoccupied XObject names so existing page artwork survives. |
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded, text-only auto-tag proposal tool for one page. Marking a figure decorative rewrites only that stream (#1324). An XFA radio item whose value contains a space is written back unchanged (#1319). Done since: #2569: Growable multiline XFA text reflows after edits, with undo/redo, save/reopen and print coverage; oversized fields still become read-only page text. Structured-data synchronization warnings retain accepted whitespace without relayout from stale data. Done since: #2572: Every repeated page-master button resolves its own field to the shared XFA click script, including print buttons. Done since: #2570: Dynamic XFA rich-text fields carry exData/maxLength into AcroForm MaxLen for reported and enforced Unicode character limits, retained after save/reopen. Done since: #2589: Active XFA skips PDF-container fallback scripts while retaining requested messages and saved scripts; ordinary/static/unlaid-out documents and explicit console/field calls keep their existing behavior. Missing: writing proposed tags and parent tree, field autotag, visual Tags/Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. CLI robustness scans visit each directory once through overlapping roots and symlink aliases. |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded text-only auto-tag proposal tool; text-only Apply writes marked content, paragraph tags and a parent tree, then opens the Tags panel for review. Missing: mixed-content and field autotag, heading/list/table/figure classification, Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Done since: CLI info, text and render use dynamic XFA layout pages, with synthetic count/text/pixel and copy-permission regressions (#1645).<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian and Arabic (logical-order catalog put into display order; layout not yet mirrored); the 2,674-entry Brazilian Portuguese catalog covers the current key union; Czech covers the menus. Italian has 2,528 entries: every key of the other catalogs that the code looks up. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Lithuanian adds a 2,578-entry catalog and date names, reviewed by a native-speaking contributor. Norwegian Bokmål adds a catalog and date names (terminology reviewed by a native speaker). Validated candidate (macOS raster probe; Windows runtime unverified): the Windows policy changes only embedded JetBrains Mono; horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150%, and is down 0.79% at 200%. Inter is pixel-identical; layout hashes, glyph coverage and the 8 MiB atlas are unchanged. Timing and RSS ranges overlap, with no improvement claimed. Estimates unchanged. Candidate #2383 clamps GPU requests to supported limits while retaining the adapter texture extent; synthetic V3D/downlevel and Windows GPU-required tests pass, but Raspberry Pi startup is unverified. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation Linux/Unix UI fallback fonts also use Fontconfig directories, including Nix store paths, with bounded discovery and the existing candidate allowlist; relative includes and digit-prefixed config filtering have isolated regressions. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation XDG desktops use the configuration base for preferences with non-overwriting migration and original-data preservation (#1395). Traditional Chinese accessibility statuses, rule semantics and Taiwan form/table terms have catalog regressions. Long main-menu lists scroll in short windows (#3373). Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation. Candidate #3558: bounded-worker macOS per-file PDFCraft association recovery after desktop open/save/sign; metadata-only watcher handling and upstream #3042 shared-writer preservation; recovery parser limits do not narrow save limits. Native workflow qualified on macOS 27.0.1; other versions and physical SMB/FUSE volumes remain unqualified. Estimates unchanged. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation. |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian and Arabic (logical catalog; explicit right-to-left labels and mirrored stock chrome; end-to-end RTL workflows unqualified); the 2,674-entry Brazilian Portuguese catalog covers the current key union; Czech covers the menus. Italian has 2,528 entries: every key of the other catalogs that the code looks up. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Lithuanian adds a 2,578-entry catalog and date names, reviewed by a native-speaking contributor. Norwegian Bokmål adds a catalog and date names (terminology reviewed by a native speaker). Validated candidate (macOS raster probe; Windows runtime unverified): the Windows policy changes only embedded JetBrains Mono; horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150%, and is down 0.79% at 200%. Inter is pixel-identical; layout hashes, glyph coverage and the 8 MiB atlas are unchanged. Timing and RSS ranges overlap, with no improvement claimed. Estimates unchanged. Candidate #2383 clamps GPU requests to supported limits while retaining the adapter texture extent; synthetic V3D/downlevel and Windows GPU-required tests pass, but Raspberry Pi startup is unverified. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation Linux/Unix UI fallback fonts also use Fontconfig directories, including Nix store paths, with bounded discovery and the existing candidate allowlist; relative includes and digit-prefixed config filtering have isolated regressions. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation XDG desktops use the configuration base for preferences with non-overwriting migration and original-data preservation (#1395). Traditional Chinese accessibility statuses, rule semantics and Taiwan form/table terms have catalog regressions. Long main-menu lists scroll in short windows (#3373). Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean, file-backed input and global memory budgets, performance budgets, keyboard-only operation. Candidate #3558: bounded-worker macOS per-file PDFCraft association recovery after desktop open/save/sign; metadata-only watcher handling and upstream #3042 shared-writer preservation; recovery parser limits do not narrow save limits. Native workflow qualified on macOS 27.0.1; other versions and physical SMB/FUSE volumes remain unqualified. Estimates unchanged. Missing: end-to-end RTL workflow qualification, a Chinese web UI face, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation. |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
 | | **Total** | **2,085–3,840** | **≈ 49% ready** | **≈ 770–1,400** | Area view of the same work: [target-app-parity.md](target-app-parity.md#by-feature-area) |
 
@@ -208,7 +209,7 @@ total matches the parity estimate.
 | Rank | Next milestone | Closes | Estimate (h) |
 |---|---|---|---|
 | 0 | Convert and share: Create PDF from Office, Word export keeps layout | part of gap 8 | 32–55 |
-| 1 | Backlog and platform: crash and wrong-result reports fixed, Chinese UI face (web printing done) | gaps 5, 6 | 50–90 |
+| 1 | Backlog and platform: crash and wrong-result reports fixed, Chinese web UI face (web printing done) | gaps 5, 6 | 50–90 |
 | 2 | Fidelity harness and renderer decision (M2) | gaps 2, 12 | 110–190 |
 | 3 | Editing existing content (M7) | gap 3 | 100–180 |
 | 4 | Pro conversion: OCR languages and clean-up, Office export/import (M10) | gaps 7, 8 | 95–175 |
@@ -242,6 +243,8 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 
 ## Revision history
 
+**2026-10-25 · minor:** M14 localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Estimates unchanged.
+
 **2026-10-23 · minor:** M11: image downsampling uses physical resolution after page-local `/UserUnit` scaling, including shared nested forms.
 Synthetic measurement and optimization regressions cover the change.
 Estimates unchanged.
@@ -252,6 +255,8 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
+| 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
 | 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
 | 2026-10-23 | minor | M10: Word table cells use the grid columns they span, including cells after a merged cell; synthetic export regression and CLI reproduction. Estimates unchanged. |
 | 2026-10-23 | minor | M10: covered table slots retain their text in paragraph flow across Office exporters; emitted superscripts remain in their cells. Synthetic source and CLI regressions; estimates unchanged. |
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index b019bdf3d6..6c7920e33c 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
-> **Last reviewed:** 2026-10-20 · **Last updated:** 2026-10-20 · **Change:** minor (M12 #3673: Character encoding CJK mapping routes corrected; scores and estimates unchanged)
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (localization current state: Arabic logical catalog, explicit RTL direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite. Scores and estimates unchanged)
 
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (localization ≈59% → ≈68%; weighted readiness 49.25 → 49.7 ≈ 50%) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
@@ -183,7 +183,7 @@ features total and are shown for orientation; the others add to it.
 | File formats and conversion | ≈ 40% | 12% | 120–220 | within features | PDF read/write strong, encrypted output included (#774 fixed); export Word is layout-poor (#773); no Excel/PowerPoint export, no Office/HTML/PostScript import | [file-format-parity.md](file-format-parity.md) |
 | PDF specification and standards | ≈ 60% | 8% | 150–260 | within features | ISO 32000 syntax, encryption, annotations and AcroForm strong; rendering and fonts borrowed from `hayro`; PDF 2.0 extras, linearization, public-key security absent; PDF/A partial, PDF/X/UA none | [pdf-spec-parity.md](pdf-spec-parity.md) |
 | Hardware | ≈ 35% | 4% | 25–50 | additional | Page raster is CPU only (Acrobat has GPU rendering); Windows CNG and macOS Keychain keys sign, no PKCS #11; no scanners; web printing goes through the browser's print dialog as pictures, not vectors | [hardware-parity.md](hardware-parity.md) |
-| Localization | ≈ 68% over the 12 key languages | 5% | 35–60 | additional | 22 catalogs + English (23 interface languages); Chinese UI shows tofu in releases (#826, #688); Arabic not mirrored; no Hindi, Indonesian, Korean | [localization-parity.md](localization-parity.md) |
+| Localization | ≈ 68% over the 12 key languages | 5% | 35–60 | additional | 22 catalogs + English (23 interface languages); native craft-fonts builds embed a Simplified Chinese face (LXGW WenKai Lite) but the web build has none; Arabic labels stay logical with explicit RTL direction and mirrored stock chrome, while native/browser/IME workflows are unqualified; no Hindi, Indonesian, Korean | [localization-parity.md](localization-parity.md) |
 | Performance | ≈ 40% | 6% | 25–45 | additional | 500-page smooth scrolling and large-file memory work (#307) done; no performance budgets (`misc.performance-budgets`), no lazy loading of GB files; blurry text at 1080p/1440p (#730) | [gaps.md](gaps.md) |
 | Stability | ≈ 50% | 8% | 45–80 | additional | Never-crash rules and nightly fuzzing; 245 open issues on 2026-10-10, many of them `fix(...)` reports of wrong results in shipped features (the #799–#821 batch is fixed) | [gaps.md](gaps.md) |
 | Platforms | ≈ 70% | 5% | 15–30 | additional | macOS (signed, notarized), Windows x64/x86/ARM64 (signed), Linux (AppImage, deb, rpm, Flatpak), FreeBSD, web (WASM). Acrobat has no Linux, FreeBSD or full web editor; we lack web OCR and web recovery | [hardware-parity.md](hardware-parity.md) |
@@ -249,7 +249,7 @@ stage set to pre-alpha; see the revision history.)
 | Beta requirement | Hours |
 |---|---|
 | An interop suite that opens our outputs in other readers (encrypted output already opens in Acrobat, #774, #836; hours not re-estimated) | 8–15 |
-| Rendering: a fidelity harness against Acrobat captures (local, clean-room) and fixing what it finds; settle the renderer (own M2 devices, or #841's proposal); Chinese UI faces in releases | 80–140 |
+| Rendering: a fidelity harness against Acrobat captures (local, clean-room) and fixing what it finds; settle the renderer (own M2 devices, or #841's proposal); a Chinese web UI face | 80–140 |
 | Editing existing text robust on real files: subset fonts, CJK, RTL, rotated text | 70–120 |
 | Printing on Windows and the web | 15–30 |
 | OCR in the major languages (accents, Cyrillic, CJK), deskew and rotation | 35–60 |
@@ -294,6 +294,7 @@ licensed OCR or AI model.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | minor | Localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Scores and estimates unchanged. |
 | 2026-10-20 | minor | M12 #3673: the Character encoding rule accepts Identity-H/V fonts with Adobe CJK collections, or a predefined non-Identity CMap, while rejecting unknown names and foreign registries. Synthetic checker and read-only automation regressions passed after failing before the fix; per-glyph mapping validation and embedded-font extraction remain separate. Breadth, readiness and hours unchanged. |
 | 2026-10-12 | minor | Exclusive image crops resize with their pixels across nested states, intervening operators and content streams; shared clips remain fixed. Synthetic engine/tool regressions and private image save/reopen checks; estimates unchanged. |
 | 2026-10-11 | minor | Web printing shipped (gap 4): Hardware, Platforms and L Print text updated. Text only: scores, readiness and hours not re-judged |
diff --git a/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml b/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
index b3b9c53849..8ae41ae976 100644
--- a/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.pdfcraft.yml
@@ -48,6 +48,7 @@ modules:
     build-commands:
       - cargo --offline build --release --locked -p pdfcraft
       - install -Dm755 target/release/pdfcraft /app/bin/pdfcraft
+      - install -Dm644 NOTICE /app/share/doc/pdfcraft/NOTICE
       - install -Dm644 packaging/linux/ai.storyteller.pdfcraft.desktop /app/share/applications/ai.storyteller.pdfcraft.desktop
       - install -Dm644 packaging/linux/ai.storyteller.pdfcraft.mime.xml /app/share/mime/packages/ai.storyteller.pdfcraft.xml
       - mkdir -p /app/share/icons && cp -R assets/app-icon/hicolor /app/share/icons/
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index b7813920e7..fd486c392b 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -121,7 +121,7 @@ fi
 
 # ---- .deb / .rpm --------------------------------------------------------------------------------
 if has deb || has rpm; then
-  command -v nfpm >/dev/null || { echo "error: nfpm not found (https://nfpm.goreleaser.com/install/)" >&2; exit 1; }
+  command -v nfpm >/dev/null || { echo "error: nfpm not found (https://nfpm.goreleaser.com/docs/install/)" >&2; exit 1; }
   export VERSION
   export RELEASE="1${PDFCRAFT_BUILD_LABEL:+.$PDFCRAFT_BUILD_LABEL}"
   export NFPM_ARCH="$DEB_ARCH"
@@ -153,7 +153,6 @@ if has appimage; then
   fi
   APPDIR="$WORK/PdfCraft.AppDir"
   cp -R "$STAGE" "$APPDIR"
-  mv "$APPDIR/usr/share/doc" "$WORK/doc-unused"
   ln -s usr/bin/pdfcraft "$APPDIR/AppRun"
   cp "$HERE/$APP_ID.desktop" "$APPDIR/$APP_ID.desktop"
   cp "$ROOT/assets/app-icon/hicolor/256x256/apps/$APP_ID.png" "$APPDIR/$APP_ID.png"
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 2e2ffc83f5..50701e0c16 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -103,6 +103,8 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 # Executable and icon carry the display name (CFBundleExecutable / CFBundleIconFile).
 cp "$WORK/bin/pdfcraft" "$APP/Contents/MacOS/PdfCraft"
 cp "$ROOT/assets/app-icon/pdfcraft.icns" "$APP/Contents/Resources/PdfCraft.icns"
+# Required embedded-font notices are independent of optional font inputs.
+cp "$ROOT/NOTICE" "$APP/Contents/Resources/NOTICE"
 # The standard About panel (PdfCraft menu > About PdfCraft) shows Credits.rtf under the version:
 # the website and Discord links the in-app About dialog has (#1287).
 cp "$HERE/Credits.rtf" "$APP/Contents/Resources/Credits.rtf"
diff --git a/packaging/windows/font-notices.ps1 b/packaging/windows/font-notices.ps1
new file mode 100644
index 0000000000..6d8fdc5a1e
--- /dev/null
+++ b/packaging/windows/font-notices.ps1
@@ -0,0 +1,48 @@
+# Validate one non-comment manifest row before adding its family notice.
+function Get-CraftFontNoticeRow([string] $rootPath, [string] $manifest, [string] $line) {
+  $fields = @($line -split ' \| ' | ForEach-Object { $_.Trim() })
+  if ($fields.Count -lt 6 -or $fields[4] -ne 'OFL-1.1') { throw "Missing OFL metadata in ${manifest}: $line" }
+  # Manifest notice paths must name a family-local file, never escape the font input.
+  $relative = $fields[5].Replace('\', '/')
+  if ($relative -notmatch '^fonts/([a-zA-Z0-9_-]+)/OFL\.txt$') { throw "Invalid font notice path: $relative" }
+  $family = $Matches[1]
+  $fontPath = $fields[2].Replace('\', '/')
+  if ($fontPath -notmatch ('^fonts/' + [regex]::Escape($family) + '/[^/]+$')) {
+    throw "Font and notice must belong to the same family directory: $fontPath / $relative"
+  }
+  $notice = Join-Path $rootPath $relative
+  if (-not (Test-Path -LiteralPath $notice -PathType Leaf) -or (Get-Item -LiteralPath $notice).Length -eq 0) {
+    throw "Missing or empty OFL notice for $($fields[0]): $notice"
+  }
+  return @{ Family = $family; Notice = Get-Item -LiteralPath $notice }
+}
+
+# Validate every declared native font notice before either Windows package is created.
+# Checking all declared faces is deliberately conservative: size-capped faces may not be embedded.
+function Get-CraftFontNotices([string] $FontRoot, [bool] $RequireChinese = $false) {
+  $rootPath = (Resolve-Path -LiteralPath $FontRoot).Path
+  $notices = @{}
+  foreach ($name in 'manifest.txt', 'simplified-chinese-manifest.txt') {
+    $manifest = Join-Path $rootPath "fonts/$name"
+    if (-not (Test-Path -LiteralPath $manifest -PathType Leaf)) {
+      if ($name -eq 'manifest.txt' -or $RequireChinese) { throw "Missing font manifest: $manifest" }
+      continue
+    }
+    foreach ($line in Get-Content -LiteralPath $manifest) {
+      $line = $line.Trim()
+      if (-not $line -or $line.StartsWith('#')) { continue }
+      $entry = Get-CraftFontNoticeRow $rootPath $manifest $line
+      $notices[$entry.Family] = $entry.Notice
+    }
+  }
+  if ($notices.Count -eq 0) { throw "No declared font notices in $rootPath" }
+  foreach ($family in @($notices.Keys | Sort-Object)) { $notices[$family] }
+}
+
+# MSI FileName may be short|long. Compare the long names with the staged inventory.
+function Assert-CraftFontNoticeNames([string[]] $Expected, [string[]] $Actual) {
+  $names = @($Actual | ForEach-Object { ($_ -split '\|')[-1] })
+  foreach ($name in $Expected) {
+    if ($name -notin $names) { throw "The MSI is missing staged font notice: $name" }
+  }
+}
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index 524280b971..dccc21f559 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -16,16 +16,30 @@
 
 .EXAMPLE
   pwsh packaging/windows/package.ps1 -Arch x64
-  pwsh packaging/windows/package.ps1 -Arch x86 -SkipBuild
+  pwsh packaging/windows/package.ps1 -Arch x86 -SkipBuild   # set CRAFT_FONTS_DIR, or -BuiltWithoutCraftFonts
   pwsh packaging/windows/package.ps1 -Arch arm64     # cross-compiled; needs the MSVC ARM64 build tools
 #>
 param(
   [ValidateSet('x64', 'x86', 'arm64')] [string] $Arch = 'x64',
-  [switch] $SkipBuild
+  [switch] $SkipBuild,
+  # -SkipBuild only: the existing binaries were built without CRAFT_FONTS_DIR, so they embed no
+  # craft-fonts faces. Without CRAFT_FONTS_DIR this assertion is required: package.ps1 cannot
+  # otherwise know whether the binaries need the fonts' OFL notices.
+  [switch] $BuiltWithoutCraftFonts
 )
 $ErrorActionPreference = 'Stop'
 $Root = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
 
+if ($BuiltWithoutCraftFonts -and -not $SkipBuild) {
+  throw '-BuiltWithoutCraftFonts describes an existing build made without CRAFT_FONTS_DIR; use it only with -SkipBuild.'
+}
+if ($BuiltWithoutCraftFonts -and $env:CRAFT_FONTS_DIR) {
+  throw '-BuiltWithoutCraftFonts cannot be combined with CRAFT_FONTS_DIR.'
+}
+if ($SkipBuild -and -not $env:CRAFT_FONTS_DIR -and -not $BuiltWithoutCraftFonts) {
+  throw 'package.ps1 -SkipBuild needs CRAFT_FONTS_DIR to stage the OFL notices of embedded craft-fonts, or -BuiltWithoutCraftFonts when the binaries were built without it.'
+}
+
 function Invoke-Native([string] $What, [scriptblock] $Block) {
   Write-Output "==> $What"
   & $Block
@@ -108,17 +122,38 @@ if (-not (Test-Path (Join-Path $Models 'ATTRIBUTION.txt')) -or -not (Get-ChildIt
   throw "no OCR models in $Models after cargo xtask models"
 }
 
+# ---- font notices for the MSI ------------------------------------------------------------------
+# The portable ZIP already carries these notices; stage the complete files before MSI creation too.
+$Docs = Join-Path $Stage 'font-licences'
+New-Item -ItemType Directory -Force -Path $Docs | Out-Null
+$HasCraftFontLicences = 0
+if ($env:CRAFT_FONTS_DIR) {
+  . (Join-Path $PSScriptRoot 'font-notices.ps1')
+  # Validate both native manifests before copying anything. One family's notice cannot
+  # stand in for another's; retain complete files, including copyright and reserved names.
+  $fontNotices = @(Get-CraftFontNotices $env:CRAFT_FONTS_DIR (Test-Path Env:CRAFT_FONTS_REQUIRED))
+  foreach ($ofl in $fontNotices) {
+    Copy-Item -LiteralPath $ofl.FullName -Destination (Join-Path $Docs "OFL-$($ofl.Directory.Name).txt")
+    $HasCraftFontLicences = 1
+  }
+}
+# ---- end font notices for the MSI --------------------------------------------------------------
+
 # ---- MSI ---------------------------------------------------------------------------------------
 $Msi = Join-Path $Dist "pdfcraft-$Version-windows-$Arch.msi"
 Invoke-Native 'wix build' {
   wix build (Join-Path $PSScriptRoot 'pdfcraft.wxs') -arch $Arch `
     (Join-Path $PSScriptRoot 'installer-ui.wxs') `
     -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "ModelsDir=$Models" -d "IconPath=$(Join-Path $Root 'assets\app-icon\pdfcraft.ico')" `
+    -d "DocsDir=$Docs" -d "HasCraftFontLicences=$HasCraftFontLicences" `
     -o $Msi
 }
 # Inspect the built MSI, not just the XML, before signing/publishing it. In a child process, so
 # its Windows Installer database handle is gone before signtool opens the MSI.
-Invoke-Native 'test-msi' { & (Get-Process -Id $PID).Path -NoProfile -File (Join-Path $PSScriptRoot 'test-msi.ps1') $Msi }
+Invoke-Native 'test-msi' {
+  & (Get-Process -Id $PID).Path -NoProfile -File (Join-Path $PSScriptRoot 'test-msi.ps1') $Msi `
+    -CraftFontLicences $HasCraftFontLicences -ExpectedFontNoticesDirectory $Docs
+}
 # wix writes its debug symbols (.wixpdb) next to the MSI; keep them out of the release assets.
 Remove-Item -Force -ErrorAction SilentlyContinue ([IO.Path]::ChangeExtension($Msi, '.wixpdb'))
 & (Join-Path $PSScriptRoot 'sign.ps1') $Msi
@@ -136,13 +171,10 @@ foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE') {
   $p = Join-Path $Root $f
   if (Test-Path $p) { Copy-Item $p $Portable }
 }
-# Builds made with craft-fonts (CRAFT_FONTS_DIR, set for every release) embed its fonts: ship their
-# licences, fonts\<family>\OFL.txt -> OFL-<family>.txt.
-if ($env:CRAFT_FONTS_DIR) {
-  Get-ChildItem -Path (Join-Path $env:CRAFT_FONTS_DIR 'fonts') -Directory -ErrorAction SilentlyContinue | ForEach-Object {
-    $ofl = Join-Path $_.FullName 'OFL.txt'
-    if (Test-Path $ofl) { Copy-Item $ofl (Join-Path $Portable "OFL-$($_.Name).txt") }
-  }
+# Builds made with craft-fonts (CRAFT_FONTS_DIR, set for every release) embed its fonts: ship the
+# same verified notices the MSI carries, fonts\<family>\OFL.txt -> OFL-<family>.txt.
+if ($HasCraftFontLicences -eq 1) {
+  Copy-Item (Join-Path $Docs 'OFL-*.txt') $Portable
 }
 # portable.txt beside pdfcraft.exe switches on portable mode: settings, logs, recovery files and new
 # digital IDs go to PdfCraftData\ next to the exe instead of %APPDATA% (#157; see
diff --git a/packaging/windows/pdfcraft.wxs b/packaging/windows/pdfcraft.wxs
index d96f2cd78d..65e76f254b 100644
--- a/packaging/windows/pdfcraft.wxs
+++ b/packaging/windows/pdfcraft.wxs
@@ -12,6 +12,9 @@
   PdfCraft arrive on its command line.
 -->
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <?ifndef HasCraftFontLicences ?>
+  <?define HasCraftFontLicences=0 ?>
+  <?endif ?>
   <Package
       Name="PdfCraft"
       Manufacturer="Learning Machines LLC"
@@ -88,12 +91,20 @@
     <StandardDirectory Id="DesktopFolder" />
 
     <Feature Id="Main" Title="PdfCraft" Level="1">
+      <?if $(var.HasCraftFontLicences) = 1 ?>
+      <ComponentGroupRef Id="CraftFontLicences" />
+      <?endif ?>
       <ComponentGroupRef Id="PdfcraftFiles" />
       <ComponentGroupRef Id="PdfcraftModels" />
     </Feature>
   </Package>
 
   <Fragment>
+    <?if $(var.HasCraftFontLicences) = 1 ?>
+    <ComponentGroup Id="CraftFontLicences" Directory="INSTALLFOLDER">
+      <Files Include="$(var.DocsDir)\**" />
+    </ComponentGroup>
+    <?endif ?>
     <ComponentGroup Id="PdfcraftFiles" Directory="INSTALLFOLDER">
       <Component Id="PdfcraftApp" Guid="E724C1C6-091F-4E21-A685-80D089FDBE21">
         <File Id="PdfcraftExe" Source="$(var.BinDir)\pdfcraft.exe" KeyPath="yes" />
diff --git a/packaging/windows/test-font-notices.ps1 b/packaging/windows/test-font-notices.ps1
new file mode 100644
index 0000000000..4d2c81b08b
--- /dev/null
+++ b/packaging/windows/test-font-notices.ps1
@@ -0,0 +1,43 @@
+param([string] $CraftFontsRoot)
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'font-notices.ps1')
+$fixture = Join-Path ([IO.Path]::GetTempPath()) ('pdfcraft-font-notices-' + [guid]::NewGuid())
+function Assert-Rejected([scriptblock] $Action, [string] $Message) {
+  $rejected = $false
+  try { & $Action | Out-Null } catch { $rejected = $true }
+  if (-not $rejected) { throw "Expected rejection: $Message" }
+}
+try {
+  foreach ($family in 'core', 'chinese') {
+    New-Item -ItemType Directory -Path (Join-Path $fixture "fonts/$family") -Force | Out-Null
+    Set-Content -LiteralPath (Join-Path $fixture "fonts/$family/OFL.txt") -Value 'Synthetic notice fixture'
+  }
+  $core = 'Core | Regular | fonts/core/face.ttf | Latn | OFL-1.1 | fonts/core/OFL.txt'
+  $chinese = 'Chinese | Regular | fonts/chinese/face.ttf | Hans | OFL-1.1 | fonts/chinese/OFL.txt'
+  Set-Content (Join-Path $fixture 'fonts/manifest.txt') @('# comment', $core, $core)
+  Set-Content (Join-Path $fixture 'fonts/simplified-chinese-manifest.txt') $chinese
+  if (@(Get-CraftFontNotices $fixture $true).Count -ne 2) { throw 'Expected both unique family notices' }
+  Set-Content (Join-Path $fixture 'fonts/simplified-chinese-manifest.txt') ($chinese.Replace('fonts/chinese/OFL.txt', 'fonts/core/OFL.txt'))
+  Assert-Rejected { Get-CraftFontNotices $fixture $true } 'another family cannot supply this notice'
+  Set-Content (Join-Path $fixture 'fonts/simplified-chinese-manifest.txt') $chinese
+  Remove-Item (Join-Path $fixture 'fonts/chinese/OFL.txt')
+  Assert-Rejected { Get-CraftFontNotices $fixture $true } 'one remaining OFL cannot cover the Chinese family'
+  Set-Content (Join-Path $fixture 'fonts/chinese/OFL.txt') '' -NoNewline
+  Assert-Rejected { Get-CraftFontNotices $fixture $true } 'empty family notice'
+  Set-Content (Join-Path $fixture 'fonts/simplified-chinese-manifest.txt') ($chinese.Replace('fonts/chinese/OFL.txt', '../OFL.txt'))
+  Assert-Rejected { Get-CraftFontNotices $fixture $true } 'notice path escapes font input'
+  Remove-Item (Join-Path $fixture 'fonts/simplified-chinese-manifest.txt')
+  Assert-Rejected { Get-CraftFontNotices $fixture $true } 'required Chinese manifest missing'
+  if (@(Get-CraftFontNotices $fixture).Count -ne 1) { throw 'Optional Chinese manifest may be absent' }
+  Set-Content (Join-Path $fixture 'fonts/manifest.txt') 'malformed'
+  Assert-Rejected { Get-CraftFontNotices $fixture } 'malformed metadata'
+  Assert-CraftFontNoticeNames @('OFL-core.txt', 'OFL-chinese.txt') @('SHORT.TXT|OFL-core.txt', 'OFL-chinese.txt')
+  Assert-Rejected { Assert-CraftFontNoticeNames @('OFL-core.txt', 'OFL-chinese.txt') @('OFL-core.txt') } 'MSI lost one staged notice'
+  if ($CraftFontsRoot) {
+    $actual = @(Get-CraftFontNotices $CraftFontsRoot $true)
+    Write-Output "Verified $($actual.Count) notices from the actual native manifests"
+  }
+  Write-Output 'Font notice regression checks passed'
+} finally {
+  Remove-Item -LiteralPath $fixture -Recurse -Force
+}
diff --git a/packaging/windows/test-msi.ps1 b/packaging/windows/test-msi.ps1
index 45e1147fa5..5a9130b29f 100644
--- a/packaging/windows/test-msi.ps1
+++ b/packaging/windows/test-msi.ps1
@@ -4,7 +4,13 @@
 .EXAMPLE
   pwsh packaging/windows/test-msi.ps1 dist/release/pdfcraft-0.2.1-windows-x64.msi
 #>
-param([Parameter(Mandatory)] [string] $Path)
+param(
+  [Parameter(Mandatory)] [string] $Path,
+  # 1 when package.ps1 staged craft-fonts OFL notices, 0 when the binaries embed no craft-fonts.
+  # -1 (the default) skips the check when the MSI is inspected by hand.
+  [int] $CraftFontLicences = -1,
+  [string] $ExpectedFontNoticesDirectory
+)
 $ErrorActionPreference = 'Stop'
 $Installer = New-Object -ComObject WindowsInstaller.Installer
 $Database = $Installer.OpenDatabase((Resolve-Path -LiteralPath $Path).Path, 0)
@@ -69,6 +75,30 @@ foreach ($sequence in @('InstallUISequence', 'InstallExecuteSequence')) {
 }
 $manufacturer = Read-Row 'SELECT `Value` FROM `Property` WHERE `Property` = ''Manufacturer''' 1
 Assert-Equal $manufacturer[0] 'Learning Machines LLC' 'MSI manufacturer'
+
+# Embedded craft-fonts must ship their OFL notices; a build without them must not claim any.
+# Check the compiled File table, not only the WiX source, so a staging or component-group mistake
+# cannot silently omit the licences.
+$fontNotices = @()
+$fileView = $Database.OpenView('SELECT `FileName` FROM `File`')
+try {
+  [void] $fileView.Execute()
+  while ($record = $fileView.Fetch()) {
+    $name = $record.StringData(1)
+    if ($name -like '*OFL-*') { $fontNotices += $name }
+  }
+} finally { [void] $fileView.Close() }
+if ($CraftFontLicences -eq 1 -and $fontNotices.Count -eq 0) {
+  throw 'the MSI carries no craft-font OFL notices'
+}
+if ($CraftFontLicences -eq 0 -and $fontNotices.Count -gt 0) {
+  throw "the MSI carries craft-font notices that packaging did not stage: $($fontNotices -join ', ')"
+}
+if ($ExpectedFontNoticesDirectory) {
+  . (Join-Path $PSScriptRoot 'font-notices.ps1')
+  $expected = @(Get-ChildItem -LiteralPath $ExpectedFontNoticesDirectory -File -Filter 'OFL-*.txt' | ForEach-Object { $_.Name })
+  Assert-CraftFontNoticeNames $expected $fontNotices
+}
 $status = Read-Row 'SELECT `Text` FROM `Control` WHERE `Dialog_` = ''InstallProgress'' AND `Control` = ''Status''' 1
 Assert-Equal $status[0] 'Please wait while setup completes.' 'Persistent progress message'
 Assert-NoRow 'SELECT `Event` FROM `EventMapping` WHERE `Dialog_` = ''InstallProgress'' AND `Control_` = ''Status''' 'progress text subscription'
@@ -258,13 +288,16 @@ $modelsDir = Read-Row 'SELECT `Directory_Parent`, `DefaultDir` FROM `Directory`
 Assert-Equal $modelsDir[0] 'INSTALLFOLDER' 'OCR models folder parent'
 # DefaultDir is `models`, or `SHORT|models` with a generated 8.3 name.
 if ($modelsDir[1] -notmatch '(^|\|)models$') { throw "OCR models folder name: '$($modelsDir[1])'" }
-$modelFiles = 0
+$modelFiles = @()
 $view = $Database.OpenView('SELECT `File`.`FileName` FROM `File`, `Component` WHERE `File`.`Component_` = `Component`.`Component` AND `Component`.`Directory_` = ''ModelsFolder''')
 try {
   [void] $view.Execute()
-  while ($record = $view.Fetch()) { if ($record.StringData(1) -match '\.rten$') { $modelFiles++ } }
+  # FileName can contain a generated 8.3 name before the long name: SHORT|long.
+  while ($record = $view.Fetch()) { $modelFiles += ($record.StringData(1) -split '\|')[-1] }
 } finally { [void] $view.Close() }
-if ($modelFiles -lt 2) { throw "expected the OCR models (*.rten) in models\, found $modelFiles" }
+foreach ($model in @('text-detection.onnx', 'text-recognition.onnx')) {
+  Assert-Equal (@($modelFiles | Where-Object { $_ -ceq $model }).Count) 1 "OCR model $model in models\"
+}
 $rm = Read-Row 'SELECT `Dialog` FROM `Dialog` WHERE `Dialog` = ''MsiRMFilesInUse''' 1
 Assert-Equal $rm[0] 'MsiRMFilesInUse' 'Files-in-use dialog'
 [void] [Runtime.InteropServices.Marshal]::FinalReleaseComObject($Database)
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index cb3fc81de9..b6375cf2b3 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -22,7 +22,7 @@ milestone = "M2"
 status = "shipped"
 commands = ["file.word_count"]
 tools = ["text_word_count"]
-evidence = ["crates/engine/src/word_count.rs::word_count_filters_are_independent_and_do_not_change_normal_extraction", "crates/automation/tests/it/automation.rs::word_count_reads_selected_pages_and_unsaved_edits_without_mutating", "crates/ui-egui/src/word_count_ui.rs::word_count_dialog_counts_changes_pages_and_closes"]
+evidence = ["crates/engine/src/word_count.rs::word_count_filters_are_independent_and_do_not_change_normal_extraction", "crates/automation/tests/it/automation.rs::word_count_reads_selected_pages_and_unsaved_edits_without_mutating", "crates/ui-egui/src/dialogs/word_count_ui.rs::word_count_dialog_counts_changes_pages_and_closes"]
 notes = "Unicode words and characters for the current snapshot; all or current page in GUI, selected pages headlessly. Desktop background work with cancellation. Optional semantic table/code/Figure and invisible-text exclusions; no OCR or visual layout classification. Unsupported structure remains counted and is reported. Mixed ActualText exclusions fail explicitly. See docs/word-count.md."
 
 [[feature]]
@@ -34,7 +34,7 @@ milestone = "M1"
 status = "shipped"
 commands = ["file.open"]
 tools = ["doc_open"]
-evidence = ["crates/automation/tests/it/automation.rs::open_inspect_render_and_find", "crates/ui-egui/tests/it/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/it/ui.rs::files_and_quit_from_the_operating_system", "crates/ui-egui/src/open_worker_tests.rs::a_chosen_tool_runs_on_its_file_only_after_native_preparation_commits", "crates/ui-egui/tests/it/editing.rs::opening_the_same_path_again_focuses_its_tab", "crates/ui-egui/tests/it/editing.rs::opening_a_file_whose_copy_vanished_from_disk_focuses_its_tab"]
+evidence = ["crates/automation/tests/it/automation.rs::open_inspect_render_and_find", "crates/ui-egui/tests/it/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/it/ui.rs::files_and_quit_from_the_operating_system", "crates/ui-egui/src/platform/open_worker/tests.rs::a_chosen_tool_runs_on_its_file_only_after_native_preparation_commits", "crates/ui-egui/tests/it/editing.rs::opening_the_same_path_again_focuses_its_tab", "crates/ui-egui/tests/it/editing.rs::opening_a_file_whose_copy_vanished_from_disk_focuses_its_tab"]
 notes = "File ▸ Open, the command line (Linux and Windows file associations), the Windows MSI's \"Edit with PdfCraft\" entry on PDF files' File Explorer right-click menu (#682; several selected PDFs open as tabs of one window), and on macOS Finder, Open With and the Dock (Apple events; the bundle declares PDF as a document type); an already-open file focuses its tab instead of opening a second copy (#1620). Not yet: a first-level Windows 11 menu entry (needs package identity) or Combine from the file manager (#585)"
 
 [[feature]]
@@ -46,7 +46,7 @@ milestone = "M1"
 status = "shipped"
 commands = ["file.open"]
 tools = ["doc_open"]
-evidence = ["crates/cos/src/document.rs::damaged_xref_is_reconstructed", "crates/cos/src/parser.rs::indirect_stream_with_wrong_length_recovers", "crates/cos/src/document.rs::self_referential_length_does_not_overflow", "crates/engine/src/tests.rs::a_repaired_file_is_rewritten_by_save_even_without_edits", "crates/automation/tests/it/automation.rs::saving_a_repaired_file_puts_the_repair_on_disk", "crates/engine/src/tests.rs::a_signed_repaired_file_keeps_its_bytes_when_saved_without_edits", "crates/cos/src/document.rs::a_table_numbered_from_1_that_begins_with_object_0_is_read_from_0"]
+evidence = ["crates/cos/src/document/tests.rs::damaged_xref_is_reconstructed", "crates/cos/src/parser.rs::indirect_stream_with_wrong_length_recovers", "crates/cos/src/document/tests.rs::self_referential_length_does_not_overflow", "crates/engine/src/tests.rs::a_repaired_file_is_rewritten_by_save_even_without_edits", "crates/automation/tests/it/automation.rs::saving_a_repaired_file_puts_the_repair_on_disk", "crates/engine/src/tests.rs::a_signed_repaired_file_keeps_its_bytes_when_saved_without_edits", "crates/cos/src/document/tests.rs::a_table_numbered_from_1_that_begins_with_object_0_is_read_from_0"]
 notes = "Save and doc_save write a reconstructed file in full even when nothing was edited, so the repair reaches the disk and the saved file opens without one (#1937); a signed one keeps its bytes, so its signatures stay valid. A repair does not mark the document as having unsaved changes, so closing it does not offer to save the repaired file. A classic table numbered 1 n that begins with object 0's free entry is read from 0 (#2676) and logged."
 
 [[feature]]
@@ -58,7 +58,7 @@ milestone = "M1"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/ui.rs::garbage_input_is_rejected_without_panicking", "crates/cos/src/parser.rs::garbage_never_panics", "crates/render/src/raster.rs::missing_page_and_garbage_input_fail_gracefully"]
+evidence = ["crates/ui-egui/tests/it/ui.rs::garbage_input_is_rejected_without_panicking", "crates/cos/src/parser.rs::garbage_never_panics", "crates/render/src/raster/tests.rs::missing_page_and_garbage_input_fail_gracefully"]
 notes = "fuzzed nightly (M1.10)"
 
 [[feature]]
@@ -94,7 +94,7 @@ milestone = "M1"
 status = "shipped"
 commands = []
 tools = ["doc_open"]
-evidence = ["crates/cos/src/document.rs::hybrid_reference_files_read_the_xref_stream_too"]
+evidence = ["crates/cos/src/document/tests.rs::hybrid_reference_files_read_the_xref_stream_too"]
 notes = "/XRefStm entries supplement the classic table and replace its free entries for objects in object streams; each section is merged as a unit so older revisions only fill gaps"
 
 [[feature]]
@@ -106,7 +106,7 @@ milestone = "M1"
 status = "shipped"
 commands = ["file.properties"]
 tools = ["doc_revisions"]
-evidence = ["crates/cos/src/document.rs::looping_revision_chains_stop", "crates/cos/src/document.rs::revision_ends_split_incremental_updates"]
+evidence = ["crates/cos/src/document/tests.rs::looping_revision_chains_stop", "crates/cos/src/document/tests.rs::revision_ends_split_incremental_updates"]
 notes = "/Prev chains followed newest first with a visited set (loops stop and are logged); revisions listed and opened (doc_revisions, doc_open_revision)"
 
 [[feature]]
@@ -178,7 +178,7 @@ milestone = "M1"
 status = "shipped"
 commands = ["file.open"]
 tools = ["doc_open"]
-evidence = ["crates/ui-egui/tests/it/editing.rs::password_prompt_opens_and_security_tab_reports_the_details", "crates/crypt/src/tests.rs::empty_user_password_opens_without_asking", "crates/ui-egui/src/open_worker_tests.rs::a_chosen_tool_survives_wrong_password_retry_and_runs_after_unlock", "crates/ui-egui/src/open_worker_tests.rs::startup_intake_waits_for_local_authentication_and_keeps_its_own_background_password_prompt", "crates/ui-egui/tests/it/pickers.rs::the_open_password_can_be_typed_through_an_input_method_however_the_file_is_opened"]
+evidence = ["crates/ui-egui/tests/it/editing.rs::password_prompt_opens_and_security_tab_reports_the_details", "crates/crypt/src/tests.rs::empty_user_password_opens_without_asking", "crates/ui-egui/src/platform/open_worker/tests.rs::a_chosen_tool_survives_wrong_password_retry_and_runs_after_unlock", "crates/ui-egui/src/platform/open_worker/tests.rs::startup_intake_waits_for_local_authentication_and_keeps_its_own_background_password_prompt", "crates/ui-egui/tests/it/pickers.rs::the_open_password_can_be_typed_through_an_input_method_however_the_file_is_opened"]
 notes = "the field takes typing through the platform input method, which typed keys go through on Linux, however the file was opened (#2818); checked with synthetic input-method events, not on a Linux desktop"
 
 [[feature]]
@@ -286,7 +286,7 @@ milestone = "M1"
 status = "shipped"
 commands = ["file.save"]
 tools = ["doc_save"]
-evidence = ["crates/platform/src/staging.rs::atomic_saves_keep_finder_tags_and_binary_extended_attributes", "crates/platform/src/staging.rs::a_growing_resource_fork_refuses_publication_and_keeps_original", "crates/automation/tests/it/automation.rs::saving_a_pdf_keeps_the_destinations_extended_attributes", "crates/automation/tests/it/automation.rs::a_metadata_preservation_error_keeps_the_pdf_and_unsaved_edit", "crates/ui-egui/tests/it/editing.rs::save_writes_an_incremental_update_and_clears_dirty", "crates/engine/src/tests.rs::save_is_incremental_stamps_mod_date_and_rebases", "crates/organize/src/tests.rs::successive_incremental_saves_stack_revisions", "crates/automation/src/lib.rs::staging_never_writes_through_a_file_planted_at_its_name", "crates/ui-egui/src/editing.rs::saving_never_writes_through_a_file_planted_at_the_staging_name"]
+evidence = ["crates/platform/src/staging/tests.rs::atomic_saves_keep_finder_tags_and_binary_extended_attributes", "crates/platform/src/staging/tests.rs::a_growing_resource_fork_refuses_publication_and_keeps_original", "crates/automation/tests/it/automation.rs::saving_a_pdf_keeps_the_destinations_extended_attributes", "crates/automation/tests/it/automation.rs::a_metadata_preservation_error_keeps_the_pdf_and_unsaved_edit", "crates/ui-egui/tests/it/editing.rs::save_writes_an_incremental_update_and_clears_dirty", "crates/engine/src/tests.rs::save_is_incremental_stamps_mod_date_and_rebases", "crates/organize/src/tests.rs::successive_incremental_saves_stack_revisions", "crates/automation/src/tests.rs::staging_never_writes_through_a_file_planted_at_its_name", "crates/ui-egui/src/editing/tests.rs::saving_never_writes_through_a_file_planted_at_the_staging_name"]
 notes = "The atomic write stages to a new, randomly named file created with create_new, so a file or link planted at the staging path is never written through (desktop app, automation and CLI). On macOS, accessible destination xattrs (including Finder tags) are copied before flush/rename; errors, metadata limits or a changed post-read size refuse the save without replacing the file. System-managed provenance is excluded. Permissions, ACLs, hard-link identity and creation dates are not preserved by this change (#2658)."
 
 [[feature]]
@@ -334,7 +334,7 @@ milestone = "M1"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/cos/src/document.rs::reads_classic_revision_and_edits_are_copy_on_write"]
+evidence = ["crates/cos/src/document/tests.rs::reads_classic_revision_and_edits_are_copy_on_write"]
 notes = ""
 
 [[feature]]
@@ -346,7 +346,7 @@ milestone = "M1"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/cos/tests/it/encryption.rs::qpdf_agrees", "crates/cos/tests/it/writer.rs::qpdf_accepts_object_stream_output", "crates/platform/src/staging.rs::an_atomic_write_replaces_the_target_only_when_complete", "apps/pdfcraft-cli/tests/it/edit.rs::editing_in_place_leaves_a_valid_file_and_no_staging_file", "crates/automation/tests/it/automation.rs::a_root_less_write_output_is_atomic_too"]
+evidence = ["crates/cos/tests/it/encryption.rs::qpdf_agrees", "crates/cos/tests/it/writer.rs::qpdf_accepts_object_stream_output", "crates/platform/src/staging/tests.rs::an_atomic_write_replaces_the_target_only_when_complete", "apps/pdfcraft-cli/tests/it/edit.rs::editing_in_place_leaves_a_valid_file_and_no_staging_file", "crates/automation/tests/it/automation.rs::a_root_less_write_output_is_atomic_too"]
 notes = "qpdf is installed on the Linux CI runner and PDFCRAFT_ORACLES_REQUIRED makes its absence a failure, so these run on every CI run rather than skipping; on a machine without qpdf they skip with a notice (crates/oracle). Every PDF leaves the engine checked (it reopens with its pages): saves, new files from Combine/Extract/Split/Create, signed, timestamped and LTV-embedded files, OCR batch output; and every writer goes through one staging-file writer (the desktop app, the tools with or without --root, the CLI), so a failed write never leaves a truncated file (#1698, #2166)"
 
 [[feature]]
@@ -382,7 +382,7 @@ milestone = "M1"
 status = "shipped"
 commands = ["file.properties"]
 tools = ["doc_revisions"]
-evidence = ["crates/cos/src/document.rs::revision_ends_split_incremental_updates", "crates/automation/tests/it/automation.rs::digital_ids_signing_and_validation_through_tools"]
+evidence = ["crates/cos/src/document/tests.rs::revision_ends_split_incremental_updates", "crates/automation/tests/it/automation.rs::digital_ids_signing_and_validation_through_tools"]
 notes = "revision ends from the xref chain (linearized first-page sections fold into their revision); listed in Document Properties ▸ Advanced and by doc_revisions with the signatures covering each"
 
 [[feature]]
@@ -694,7 +694,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/editing.rs::the_last_session_reopens_its_files_pages_and_active_tab", "crates/ui-egui/tests/it/editing.rs::quitting_with_unsaved_changes_still_remembers_every_file", "crates/ui-egui/tests/it/editing.rs::the_last_session_is_off_by_default_and_skips_missing_and_duplicate_files", "crates/ui-egui/src/last_session.rs::malformed_sessions_are_skipped_and_capped"]
+evidence = ["crates/ui-egui/tests/it/editing.rs::the_last_session_reopens_its_files_pages_and_active_tab", "crates/ui-egui/tests/it/editing.rs::quitting_with_unsaved_changes_still_remembers_every_file", "crates/ui-egui/tests/it/editing.rs::the_last_session_is_off_by_default_and_skips_missing_and_duplicate_files", "crates/ui-egui/src/persist/last_session.rs::malformed_sessions_are_skipped_and_capped"]
 notes = "Desktop, off by default (Preferences ▸ Documents and view, #442): the files open when PdfCraft last closed reopen at the page each showed, with the same tab in front; files named on the command line open after them, in front; files that are gone, and documents the Recovery dialog offers, are skipped. Quitting with unsaved changes still remembers every tab. Zoom and page display come back through core.restore-last-view (#1767); not yet the scroll position within the page (#418); only the first encrypted file asks for its password (later ones stay closed), and a file opened after it dismisses that prompt; a save that fails partway through a quit can leave the remembered list from that quit; never-saved documents and the web build have no paths to reopen."
 
 [[feature]]
@@ -734,7 +734,7 @@ milestone = "M2"
 status = "partial"
 commands = []
 tools = ["page_render"]
-evidence = ["crates/render/src/raster.rs::renders_a_blue_rectangle", "crates/automation/tests/it/automation.rs::open_inspect_render_and_find", "crates/render/src/raster.rs::user_unit_scales_the_page_and_everything_on_it"]
+evidence = ["crates/render/src/raster/tests.rs::renders_a_blue_rectangle", "crates/automation/tests/it/automation.rs::open_inspect_render_and_find", "crates/render/src/raster/tests.rs::user_unit_scales_the_page_and_everything_on_it"]
 notes = "hayro bootstrap renderer; own DisplayList devices in M2.6. Pages with /UserUnit are shown at their size in points, as Acrobat reads the value"
 
 [[feature]]
@@ -746,8 +746,8 @@ milestone = "M2"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::self_referencing_tiling_pattern_terminates"]
-notes = "via hayro bootstrap"
+evidence = ["crates/render/src/raster/tests.rs::self_referencing_tiling_pattern_terminates", "crates/render/tests/it/tiling_cell_placement.rs::far_cells_of_a_fill_sit_at_whole_steps", "crates/render/tests/it/tiling_cell_placement.rs::far_cells_sit_at_whole_steps_under_a_turned_scaled_matrix", "crates/render/tests/it/tiling_cell_placement.rs::far_cells_of_a_stroke_sit_at_whole_steps"]
+notes = "via hayro bootstrap. Tiling pattern cells sit at whole multiples of /XStep and /YStep at any zoom, filled or stroked, under any pattern matrix. Missing: a cell is cut at its step, so content reaching past the step into the next cell is lost; a cell pixmap is capped at 3000 pixels a side, so very large steps draw at reduced resolution"
 
 [[feature]]
 id = "view.render-transparency"
@@ -758,8 +758,8 @@ milestone = "M2"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::soft_mask_without_group_colour_space_is_applied", "crates/render/src/raster.rs::a_multiply_highlight_inside_a_transparency_group_keeps_the_text"]
-notes = "via hayro bootstrap. A transparency group that is neither isolated nor knockout and is entered at full opacity, with no soft mask and Normal blending, is drawn straight onto the page, so a blend mode inside it (the Multiply of a highlight appearance written by other editors) sees the page content (#1968). Missing: a non-isolated group that needs a layer (partial opacity, a soft mask or a blend mode on the group itself) still composites its elements against a blank backdrop, and knockout groups are drawn as ordinary ones"
+evidence = ["crates/render/src/raster/tests.rs::soft_mask_without_group_colour_space_is_applied", "crates/render/src/raster/tests.rs::a_multiply_highlight_inside_a_transparency_group_keeps_the_text", "crates/render/tests/it/luminosity_group_space.rs::black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully"]
+notes = "via hayro bootstrap. A luminosity soft mask whose group is in DeviceCMYK reads its flat CMYK colours and backdrop as their gray, 1 - min(1, 0.3 c + 0.59 m + 0.11 y + k) (ISO 32000-2 §11.5.3), so 100% K masks fully; CMYK images, shadings and tiling patterns inside such a mask still go through the display profile. A transparency group that is neither isolated nor knockout and is entered at full opacity, with no soft mask and Normal blending, is drawn straight onto the page, so a blend mode inside it (the Multiply of a highlight appearance written by other editors) sees the page content (#1968). Missing: a non-isolated group that needs a layer (partial opacity, a soft mask or a blend mode on the group itself) still composites its elements against a blank backdrop, and knockout groups are drawn as ordinary ones"
 
 [[feature]]
 id = "view.render-knockout"
@@ -783,7 +783,7 @@ status = "partial"
 commands = []
 tools = []
 evidence = []
-notes = "hayro bootstrap with vendored patches"
+notes = "hayro bootstrap with vendored patches. Text rendering modes follow ISO 32000-2 §9.3.6 for Type 3 fonts: 3 and 7 render nothing, the others render the glyph descriptions filled (never stroked), and 4 to 7 add nothing to the clipping path (hayro-interpret patches 42 and 64). Coverage is synthetic fixtures; no fidelity comparison across a Type 3 corpus yet"
 
 [[feature]]
 id = "view.render-cid-fonts"
@@ -794,7 +794,7 @@ milestone = "M2"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::huge_cid_width_ranges_terminate", "crates/render/src/raster.rs::non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face", "crates/render/src/raster.rs::mincho_substitute_covers_half_width_katakana", "crates/render/src/text.rs::identity_to_unicode_names_give_text", "crates/fonts/src/pdf.rs::identity_to_unicode_names_read_codes_as_unicode"]
+evidence = ["crates/render/src/raster/tests.rs::huge_cid_width_ranges_terminate", "crates/render/src/raster/tests.rs::non_embedded_japanese_cid_fonts_draw_with_a_craft_fonts_face", "crates/render/src/raster/tests.rs::mincho_substitute_covers_half_width_katakana", "crates/render/src/text/tests.rs::identity_to_unicode_names_give_text", "crates/fonts/src/pdf/tests.rs::identity_to_unicode_names_read_codes_as_unicode"]
 notes = "CID-to-Unicode tables are M2.4; a non-embedded Adobe-Japan1 font is drawn in a craft-fonts Japanese face (Mincho or Gothic by name, else by the descendant font descriptor's Serif flag; bold Gothic for a Bold name or a `/FontWeight` of 600 or more; BIZ UDMincho for Mincho, which covers half-width katakana) when built with craft-fonts; non-embedded GB1, CNS1 and Korea1 fonts still draw nothing (no allowed face); a `/ToUnicode` given as the name `/Identity-H` or `/Identity-V` (WSCAD) reads codes as Unicode for selection, search and editing, without control characters"
 
 [[feature]]
@@ -818,8 +818,8 @@ milestone = "M2"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::widget_appearance_states", "crates/render/src/raster.rs::highlights_without_an_appearance_are_drawn", "crates/engine/src/tests.rs::comments_without_appearances_are_drawn_but_not_saved", "crates/engine/src/tests.rs::cli_display_adds_missing_appearances_without_changing_the_source", "crates/engine/src/tests.rs::fields_left_to_the_viewer_are_displayed_from_their_values", "crates/forms/src/tests.rs::need_appearances_draws_every_text_and_choice_field_in_the_display_copy", "crates/forms/src/tests.rs::the_field_appearance_cache_sees_every_input", "crates/engine/src/tests.rs::buttons_and_combs_left_to_the_viewer_are_displayed", "crates/forms/src/tests.rs::check_boxes_without_an_appearance_show_their_caption_symbol", "crates/forms/src/tests.rs::push_buttons_without_an_appearance_show_their_caption_and_frame", "crates/render/src/raster.rs::invisible_unknown_annotations_and_popups_paint_nothing", "crates/print/src/tests.rs::invisible_annotations_of_unknown_types_do_not_print", "crates/engine/src/tests.rs::stamps_without_appearances_draw_the_stamp_they_name", "crates/automation/tests/it/automation.rs::page_render_draws_stamps_without_an_appearance"]
-notes = "comments without /AP (FreeText, Ink, notes, stamps, shapes, markup) are drawn from their dictionaries in the page view, page_render and page images, including the CLI render command, never saved; a stamp from another program draws the stamp its /Name names (the fourteen standard names of ISO 32000-2 Table 184, Draft when there is none) or, for any other name, a grey frame with both diagonals; text and choice fields are drawn from their values when the form sets /NeedAppearances (every one) or a widget has no /N (#3470), also display-only and cached per widget (a field edit on a 1000-field /NeedAppearances form takes ~13 ms against ~7 ms on a form that needs none) (a read-only document still gets the renderer's Highlight fallback only); check boxes and radio buttons with no appearance for their /AS are drawn display-only from /MK (background, border, and when on the /MK /CA ZapfDingbats symbol in the /DA colour, a check or a dot by default), and push buttons with none from /MK and /BS with their caption; Link borders without /AP and printing are not covered yet; an annotation of a non-standard type with the Invisible flag (ISO 32000-2 Table 167) is neither drawn nor printed, and a popup's own /AP is never painted on the page (its parent's text shows in the popup window, §12.5.6.14)"
+evidence = ["crates/render/src/raster/tests.rs::widget_appearance_states", "crates/render/src/raster/tests.rs::highlights_without_an_appearance_are_drawn", "crates/engine/src/tests.rs::comments_without_appearances_are_drawn_but_not_saved", "crates/engine/src/tests.rs::cli_display_adds_missing_appearances_without_changing_the_source", "crates/engine/src/tests.rs::fields_left_to_the_viewer_are_displayed_from_their_values", "crates/forms/src/tests.rs::need_appearances_draws_every_text_and_choice_field_in_the_display_copy", "crates/forms/src/tests.rs::the_field_appearance_cache_sees_every_input", "crates/engine/src/tests.rs::buttons_and_combs_left_to_the_viewer_are_displayed", "crates/forms/src/tests.rs::check_boxes_without_an_appearance_show_their_caption_symbol", "crates/forms/src/tests.rs::push_buttons_without_an_appearance_show_their_caption_and_frame", "crates/forms/src/tests.rs::need_appearances_draws_check_boxes_and_radio_buttons_from_their_captions", "crates/engine/src/tests.rs::need_appearances_buttons_are_displayed_from_their_captions", "crates/render/src/raster/tests.rs::invisible_unknown_annotations_and_popups_paint_nothing", "crates/print/src/tests.rs::invisible_annotations_of_unknown_types_do_not_print", "crates/engine/src/tests.rs::stamps_without_appearances_draw_the_stamp_they_name", "crates/automation/tests/it/automation.rs::page_render_draws_stamps_without_an_appearance"]
+notes = "comments without /AP (FreeText, Ink, notes, stamps, shapes, markup) are drawn from their dictionaries in the page view, page_render and page images, including the CLI render command, never saved; a stamp from another program draws the stamp its /Name names (the fourteen standard names of ISO 32000-2 Table 184, Draft when there is none) or, for any other name, a grey frame with both diagonals; text and choice fields are drawn from their values when the form sets /NeedAppearances (every one) or a widget has no /N (#3470), also display-only and cached per widget (a field edit on a 1000-field /NeedAppearances form takes ~13 ms against ~7 ms on a form that needs none) (a read-only document still gets the renderer's Highlight fallback only); check boxes and radio buttons with no appearance for their /AS are drawn display-only from /MK (background, border, and when on the /MK /CA ZapfDingbats symbol in the /DA colour, a check or a dot by default), and when the form sets /NeedAppearances so is every one that has an /MK, over the appearance the file carries (ISO 32000-2 Table 224; one without /MK keeps its own), and push buttons with none from /MK and /BS with their caption; Link borders without /AP and printing are not covered yet; an annotation of a non-standard type with the Invisible flag (ISO 32000-2 Table 167) is neither drawn nor printed, and a popup's own /AP is never painted on the page (its parent's text shows in the popup window, §12.5.6.14)"
 
 [[feature]]
 id = "view.render-error-isolation"
@@ -830,7 +830,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::missing_page_and_garbage_input_fail_gracefully", "crates/render/src/raster.rs::scale_is_clamped_for_huge_pages", "crates/render/src/raster.rs::watchdog_skips_a_stuck_page_and_keeps_rendering"]
+evidence = ["crates/render/src/raster/tests.rs::missing_page_and_garbage_input_fail_gracefully", "crates/render/src/raster/tests.rs::scale_is_clamped_for_huge_pages", "crates/render/src/raster/tests.rs::watchdog_skips_a_stuck_page_and_keeps_rendering"]
 notes = ""
 
 [[feature]]
@@ -842,7 +842,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::inline_pool_renders_in_priority_order"]
+evidence = ["crates/render/src/raster/tests.rs::inline_pool_renders_in_priority_order"]
 notes = ""
 
 [[feature]]
@@ -854,7 +854,7 @@ milestone = "M3"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::tiles_match_full_render", "crates/render/src/raster.rs::effective_scale_never_exceeds_the_caps", "crates/ui-egui/tests/it/view.rs::returning_to_a_visited_zoom_reuses_its_cached_tiles", "crates/ui-egui/tests/it/view.rs::zooming_a_tiled_page_shows_its_earlier_tiles_until_new_ones_arrive"]
+evidence = ["crates/render/src/raster/tests.rs::tiles_match_full_render", "crates/render/src/raster/tests.rs::effective_scale_never_exceeds_the_caps", "crates/ui-egui/tests/it/view.rs::returning_to_a_visited_zoom_reuses_its_cached_tiles", "crates/ui-egui/tests/it/view.rs::zooming_a_tiled_page_shows_its_earlier_tiles_until_new_ones_arrive"]
 notes = "capped at 8192 px per side (M3.3); tiles of a zoom already rendered stay cached while their page is on screen, so zooming away and back shows the area sharp instead of re-rendering it tile by tile (#2196)"
 
 [[feature]]
@@ -866,7 +866,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.continuous", "view.page_gaps"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/view.rs::page_gaps_in_organizer_do_not_move_the_document_scroll_position", "crates/ui-egui/tests/it/view.rs::page_gaps_comparison_menu_preserves_the_active_panes_choice", "crates/ui-egui/tests/it/view.rs::page_gaps_comparison_control_preserves_both_states", "crates/ui-egui/tests/it/view.rs::page_gaps_stay_closed_at_fractional_device_scales", "crates/ui-egui/tests/it/view.rs::page_gaps_toggle_joins_edges_without_changing_the_document", "crates/ui-egui/tests/it/view.rs::page_gaps_default_survives_restart_and_applies_to_new_documents", "crates/ui-egui/tests/it/view.rs::page_gaps_menu_joins_pages_without_a_shadow_at_the_seam", "crates/ui-egui/tests/it/view.rs::page_gaps_work_for_mixed_sizes_and_two_page_rows", "crates/ui-egui/tests/it/view.rs::continuous_layout_stacks_pages_vertically", "crates/ui-egui/tests/it/view.rs::page_display_commands_switch_layouts", "crates/ui-egui/tests/it/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/src/canvas.rs::fit_page_and_height_hold_still_while_mixed_page_sizes_scroll_past", "crates/ui-egui/tests/it/view.rs::touchpad_swipe_glides_on_after_the_fingers_lift_and_stops", "crates/ui-egui/tests/it/view.rs::touching_the_touchpad_again_or_turning_animations_off_stops_the_glide", "crates/ui-egui/tests/it/view.rs::rapid_wheel_notches_accelerate_and_follow_touchpad_input", "crates/ui-egui/tests/it/view.rs::changing_continuous_layout_resets_wheel_acceleration"]
+evidence = ["crates/ui-egui/tests/it/view.rs::page_gaps_in_organizer_do_not_move_the_document_scroll_position", "crates/ui-egui/tests/it/view.rs::page_gaps_comparison_menu_preserves_the_active_panes_choice", "crates/ui-egui/tests/it/view.rs::page_gaps_comparison_control_preserves_both_states", "crates/ui-egui/tests/it/view.rs::page_gaps_stay_closed_at_fractional_device_scales", "crates/ui-egui/tests/it/view.rs::page_gaps_toggle_joins_edges_without_changing_the_document", "crates/ui-egui/tests/it/view.rs::page_gaps_default_survives_restart_and_applies_to_new_documents", "crates/ui-egui/tests/it/view.rs::page_gaps_menu_joins_pages_without_a_shadow_at_the_seam", "crates/ui-egui/tests/it/view.rs::page_gaps_work_for_mixed_sizes_and_two_page_rows", "crates/ui-egui/tests/it/view.rs::continuous_layout_stacks_pages_vertically", "crates/ui-egui/tests/it/view.rs::page_display_commands_switch_layouts", "crates/ui-egui/tests/it/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/src/canvas/tests.rs::fit_page_and_height_hold_still_while_mixed_page_sizes_scroll_past", "crates/ui-egui/tests/it/view.rs::touchpad_swipe_glides_on_after_the_fingers_lift_and_stops", "crates/ui-egui/tests/it/view.rs::touching_the_touchpad_again_or_turning_animations_off_stops_the_glide", "crates/ui-egui/tests/it/view.rs::rapid_wheel_notches_accelerate_and_follow_touchpad_input", "crates/ui-egui/tests/it/view.rs::changing_continuous_layout_resets_wheel_acceleration"]
 notes = "Page gaps, shadows and outlines can be hidden through the page-display menu, with a persisted default in Preferences and matching UI control options; page margins in the PDF are unchanged. Continuous scrolling remains the default for PDFs that don't ask for a layout (Preferences ▸ Default page display); pages stack with no snapping. Fit page and Fit height fit the largest page, so the zoom holds still across mixed page sizes. Rapid line-wheel notches gain a bounded, constant-space arrival-rate boost (#1072); isolated notches still use the chosen Scroll speed, and page units stay unboosted. A touchpad swipe glides on after the fingers lift on Wayland (#531; macOS glides by itself; Windows and X11 report no lift through winit), unless Animation effects is off; a click, key, zoom or new scroll catches it. Not yet: fingers resting on the touchpad don't catch it (needs Wayland hold gestures, which the vendored winit doesn't bind)"
 
 [[feature]]
@@ -1022,7 +1022,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.fit_visible"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/viewer.rs::fit_visible_zooms_to_the_content_width", "crates/ui-egui/src/zoom_snap.rs::ink_bounds_finds_the_marked_area"]
+evidence = ["crates/ui-egui/tests/it/viewer.rs::fit_visible_zooms_to_the_content_width", "crates/ui-egui/src/canvas/zoom_snap.rs::ink_bounds_finds_the_marked_area"]
 notes = "View ▸ Zoom ▸ Fit visible (⌘3): the current page's inked area (found by a quick low-resolution render) spans the window width; respects view rotation; drivable via the control channel's command"
 
 [[feature]]
@@ -1190,7 +1190,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = ["link_open"]
-evidence = ["crates/ui-egui/tests/it/view.rs::clicking_a_link_goes_to_its_destination", "crates/ui-egui/tests/it/view.rs::link_destinations_scroll_to_their_position", "crates/ui-egui/tests/it/view.rs::a_link_without_a_position_keeps_the_place_on_the_next_page", "crates/ui-egui/src/canvas.rs::a_null_xyz_coordinate_keeps_the_readers_place_on_the_new_page", "crates/render/src/inspect.rs::bookmarks_and_links_keep_their_destination_view", "crates/render/src/inspect.rs::links_read_bounded_local_remote_go_to_actions", "crates/automation/tests/it/automation.rs::local_gotor_link_open_applies_destinations_and_honors_root", "crates/ui-egui/tests/it/document_links.rs::a_local_gotor_link_opens_in_a_tab_and_applies_its_destination", "crates/ui-egui/tests/it/document_links.rs::an_absolute_gotor_waits_for_consent_and_keeps_its_destination_across_tabs", "crates/ui-egui/tests/it/document_links.rs::cancelling_an_absolute_gotor_by_button_escape_or_dismissal_changes_nothing", "crates/automation/tests/it/automation.rs::absolute_gotor_consent_does_not_bypass_validation_or_passwords", "crates/render/src/inspect.rs::launch_actions_that_name_a_pdf_open_it_like_a_remote_link", "crates/automation/tests/it/automation.rs::a_launch_link_to_a_pdf_opens_it_like_a_remote_link"]
+evidence = ["crates/ui-egui/tests/it/view.rs::clicking_a_link_goes_to_its_destination", "crates/ui-egui/tests/it/view.rs::link_destinations_scroll_to_their_position", "crates/ui-egui/tests/it/view.rs::a_link_without_a_position_keeps_the_place_on_the_next_page", "crates/ui-egui/src/canvas/tests.rs::a_null_xyz_coordinate_keeps_the_readers_place_on_the_new_page", "crates/render/src/inspect/tests.rs::bookmarks_and_links_keep_their_destination_view", "crates/render/src/inspect/tests.rs::links_read_bounded_local_remote_go_to_actions", "crates/automation/tests/it/automation.rs::local_gotor_link_open_applies_destinations_and_honors_root", "crates/ui-egui/tests/it/document_links.rs::a_local_gotor_link_opens_in_a_tab_and_applies_its_destination", "crates/ui-egui/tests/it/document_links.rs::an_absolute_gotor_waits_for_consent_and_keeps_its_destination_across_tabs", "crates/ui-egui/tests/it/document_links.rs::cancelling_an_absolute_gotor_by_button_escape_or_dismissal_changes_nothing", "crates/automation/tests/it/automation.rs::absolute_gotor_consent_does_not_bypass_validation_or_passwords", "crates/render/src/inspect/tests.rs::launch_actions_that_name_a_pdf_open_it_like_a_remote_link", "crates/automation/tests/it/automation.rs::a_launch_link_to_a_pdf_opens_it_like_a_remote_link"]
 notes = "GoTo and URI links plus local-PDF GoToR links: source-relative or local absolute /F paths, /UF preferred in file-spec dictionaries, explicit numeric page/view destinations, and internal tabs. Absolute local GoToR targets require desktop Allow/Cancel confirmation or an explicit allow_absolute opt-in in link_open; relative links open normally. link_open honors --root. Named remote destinations open at default view with a warning; /NewWindow is a tab hint. A Launch action whose /F names a .pdf file (and has no /Win launch parameters) opens that PDF the same way, backslash separators read as / (#4168); URL/network file systems, GoToE, other Launch actions and other actions are not executed. Same-document destinations retain their supported /XYZ, /Fit, /FitH, /FitV and /FitR views; /FitB* is read as whole-page fit. A null /XYZ left or top keeps the reader's place, as ISO 32000-2 §12.3.2.2 says and Acrobat Reader was observed to do (synthetic fixture): the user-space point at the window's top-left stays there on the target page at the same zoom, along each axis the page overflows; CAD exports (WSCAD) write every cross-reference this way. Null /FitH top and /FitV left still go to the page edge."
 
 [[feature]]
@@ -1214,7 +1214,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/control.rs::page_size_shows_while_the_pointer_is_in_the_bottom_left_quadrant", "crates/ui-egui/src/canvas.rs::page_size_hint_zone_is_the_bottom_left_quadrant"]
+evidence = ["crates/ui-egui/tests/it/control.rs::page_size_shows_while_the_pointer_is_in_the_bottom_left_quadrant", "crates/ui-egui/src/canvas/tests.rs::page_size_hint_zone_is_the_bottom_left_quadrant"]
 notes = "While the pointer is in the bottom-left quadrant of the page view, a small label shows the current page's size (after /Rotate and /UserUnit) in the Preferences unit, formatted as in Document Properties (#1855). It never takes clicks and hides when the pointer leaves. Acrobat's trigger is the corner itself and may differ in exact area and wording (not compared with real Acrobat); the size of the current page only, not of the page under the pointer; no headless tool (page sizes are in document info)."
 
 [[feature]]
@@ -1274,8 +1274,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/editing.rs::resized_pages_panel_thumbnails_reorder_multiple_pages_and_undo", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnail_zoom_is_bounded_independent_and_survives_reload", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnail_size_controls_show_more_pages_and_keep_the_selection", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnail_zoom_keeps_a_far_current_page_visible", "crates/ui-egui/tests/it/control.rs::thumbnail_size_is_settable_and_inspectable_through_the_control_channel", "crates/ui-egui/tests/it/ui.rs::theme_and_view_options_apply", "crates/ui-egui/tests/it/viewer.rs::going_to_a_far_page_scrolls_its_thumbnail_into_view", "crates/ui-egui/tests/it/viewer.rs::going_to_a_page_in_view_leaves_the_pages_panel_still", "crates/ui-egui/tests/it/viewer.rs::a_page_change_while_thumbnails_are_dragged_does_not_scroll_the_pages_panel"]
-notes = "Thumbnail size: 50–150% with a slider and buttons above the scroll area (#3808), independent of document and Organize zoom. Accessible through ui.set thumbnail-zoom and ui.state active.thumbnail_zoom; retained on file reload, not persisted between sessions. The panel follows the current page (#2781): a page whose thumbnail is out of sight scrolls it into view, as little as it takes; a thumbnail already in view, or clicked, leaves the panel still, and a page change while the user scrolls the panel or drags thumbnails does not move it."
+evidence = ["crates/ui-egui/tests/it/editing.rs::resized_pages_panel_thumbnails_reorder_multiple_pages_and_undo", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnail_zoom_is_bounded_independent_and_survives_reload", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnail_size_controls_show_more_pages_and_keep_the_selection", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnail_zoom_keeps_a_far_current_page_visible", "crates/ui-egui/tests/it/control.rs::thumbnail_size_is_settable_and_inspectable_through_the_control_channel", "crates/ui-egui/tests/it/ui.rs::theme_and_view_options_apply", "crates/ui-egui/tests/it/viewer.rs::going_to_a_far_page_scrolls_its_thumbnail_into_view", "crates/ui-egui/tests/it/viewer.rs::going_to_a_page_in_view_leaves_the_pages_panel_still", "crates/ui-egui/tests/it/viewer.rs::a_page_change_while_thumbnails_are_dragged_does_not_scroll_the_pages_panel", "crates/ui-egui/tests/it/view.rs::the_pages_panel_tools_act_on_the_selected_pages", "crates/ui-egui/tests/it/view.rs::the_pages_panel_tools_insert_from_a_file_and_extract", "crates/ui-egui/tests/it/view.rs::the_pages_panel_tools_are_off_without_page_editing_permission"]
+notes = "Page tools menu in the panel's header (#4415): insert a blank page or pages from a file after the selection, rotate either way, extract and delete, each on the selected pages (the current one when none is), greyed out where the document's security withholds page changes. Thumbnail size: 50–150% with a slider and buttons above the scroll area (#3808), independent of document and Organize zoom. Accessible through ui.set thumbnail-zoom and ui.state active.thumbnail_zoom; retained on file reload, not persisted between sessions. The panel follows the current page (#2781): a page whose thumbnail is out of sight scrolls it into view, as little as it takes; a thumbnail already in view, or clicked, leaves the panel still, and a page change while the user scrolls the panel or drags thumbnails does not move it."
 
 [[feature]]
 id = "view.thumbnail-context-ops"
@@ -1322,8 +1322,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = ["doc_info"]
-evidence = ["crates/render/src/inspect.rs::attachments_of_both_kinds_are_listed_and_extracted"]
-notes = ""
+evidence = ["crates/render/src/inspect/tests.rs::attachments_of_both_kinds_are_listed_and_extracted", "crates/ui-egui/tests/it/attachment_row.rs::the_right_click_menu_opens_saves_and_deletes", "crates/ui-egui/tests/it/attachment_row.rs::double_clicking_a_pdf_attachment_opens_it_in_a_new_tab"]
+notes = "Each row has Save, Open in a new tab (PDFs) and Delete (the document's own attachments) buttons, the same items on a right-click, and a double-click that opens a PDF in a new tab or saves any other file (#3466). Not yet: Acrobat's Search attachments, and opening a non-PDF attachment in another program (it is saved instead)."
 
 [[feature]]
 id = "view.layers-panel"
@@ -1334,7 +1334,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = ["doc_info", "layer_set"]
-evidence = ["crates/render/src/raster.rs::layer_override_hides_content", "crates/engine/src/tests.rs::layer_choices_survive_edits", "crates/automation/tests/it/automation.rs::layers_and_hidden_comments_change_what_page_render_draws"]
+evidence = ["crates/render/src/raster/tests.rs::layer_override_hides_content", "crates/engine/src/tests.rs::layer_choices_survive_edits", "crates/automation/tests/it/automation.rs::layers_and_hidden_comments_change_what_page_render_draws"]
 notes = "layer_set shows or hides a layer by name (every group with that name, as CAD exporters repeat names) or by position, and page_render draws with the document's layer visibility. Still missing: Reset to initial visibility (view.layers-reset), layer properties, and /OC on annotations (#2176)."
 
 [[feature]]
@@ -1346,7 +1346,7 @@ milestone = "M12"
 status = "partial"
 commands = []
 tools = ["doc_info"]
-evidence = ["crates/engine/src/tests.rs::reset_layers_returns_to_the_files_visibility", "crates/render/src/inspect.rs::initial_layer_visibility_is_the_default_configuration"]
+evidence = ["crates/engine/src/tests.rs::reset_layers_returns_to_the_files_visibility", "crates/render/src/inspect/tests.rs::initial_layer_visibility_is_the_default_configuration"]
 notes = "Layers panel ▸ Layer options ▸ Reset to Initial Visibility shows each layer as the default configuration (/OCProperties /D) has it; doc_info reports it as `initial`. Not yet: listing the layers of all pages or the current page only."
 
 [[feature]]
@@ -1394,7 +1394,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = ["doc_info"]
-evidence = ["crates/render/src/inspect.rs::roman_and_alpha_labels", "crates/automation/tests/it/automation.rs::open_inspect_render_and_find"]
+evidence = ["crates/render/src/inspect/tests.rs::roman_and_alpha_labels", "crates/automation/tests/it/automation.rs::open_inspect_render_and_find"]
 notes = ""
 
 [[feature]]
@@ -1406,7 +1406,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["edit.find"]
 tools = ["text_find"]
-evidence = ["crates/ui-egui/tests/it/ui.rs::find_counts_matches_across_pages", "crates/ui-egui/tests/it/ui.rs::find_reports_no_matches", "crates/automation/tests/it/automation.rs::open_inspect_render_and_find", "crates/render/src/text.rs::identity_v_columns_are_searchable_in_reading_order", "crates/render/src/text.rs::toc_leaders_do_not_hide_word_gaps", "crates/render/src/text.rs::short_tracked_ellipses_remain_searchable"]
+evidence = ["crates/ui-egui/tests/it/ui.rs::find_counts_matches_across_pages", "crates/ui-egui/tests/it/ui.rs::find_reports_no_matches", "crates/automation/tests/it/automation.rs::open_inspect_render_and_find", "crates/render/src/text/tests.rs::identity_v_columns_are_searchable_in_reading_order", "crates/render/src/text/tests.rs::toc_leaders_do_not_hide_word_gaps", "crates/render/src/text/tests.rs::short_tracked_ellipses_remain_searchable"]
 notes = "Horizontal and WMode 1 vertical text are grouped independently, including a horizontal heading above right-to-left vertical columns. Dotted TOC leaders preserve word spaces for phrase search (#3086), while short tracked ellipses remain intact and searchable; sparse lines and condensed OCR gaps below the existing height-based threshold remain limitations. Complex interleaved flows still use a geometric reading-order heuristic."
 
 [[feature]]
@@ -1538,7 +1538,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["edit.column_select"]
 tools = ["text_extract"]
-evidence = ["crates/render/src/text.rs::a_column_selection_takes_one_table_column", "crates/render/src/text.rs::a_column_selection_across_columns_reads_row_by_row", "crates/render/src/text.rs::right_to_left_rows_read_right_to_left", "crates/render/src/text.rs::vertical_lines_keep_reading_order", "crates/ui-egui/tests/it/column_select.rs::alt_drag_selects_only_the_text_inside_the_rectangle", "crates/ui-egui/tests/it/column_select.rs::the_column_select_tool_needs_no_modifier", "crates/ui-egui/tests/it/column_select.rs::alt_drag_with_the_highlighter_marks_only_the_column", "crates/automation/tests/it/automation.rs::text_extract_with_a_rect_takes_one_column"]
+evidence = ["crates/render/src/text/tests.rs::a_column_selection_takes_one_table_column", "crates/render/src/text/tests.rs::a_column_selection_across_columns_reads_row_by_row", "crates/render/src/text/tests.rs::right_to_left_rows_read_right_to_left", "crates/render/src/text/tests.rs::vertical_lines_keep_reading_order", "crates/ui-egui/tests/it/column_select.rs::alt_drag_selects_only_the_text_inside_the_rectangle", "crates/ui-egui/tests/it/column_select.rs::the_column_select_tool_needs_no_modifier", "crates/ui-egui/tests/it/column_select.rs::alt_drag_with_the_highlighter_marks_only_the_column", "crates/automation/tests/it/automation.rs::text_extract_with_a_rect_takes_one_column"]
 notes = "Issue #740. Holding Alt (Option on macOS) when a drag starts selects only the text inside the rectangle drawn, with the Select tool, the text markup tools and Redact (with Highlight and Redact the drag must start on text, since off text they draw an area box). Edit ▸ Column select does the same with a plain drag. A glyph counts when its centre is inside. Copy gives one row per visual line, top to bottom; pieces side by side (table cells) are separated by a tab, right to left in right-to-left rows; vertical text keeps reading order. text_extract takes the same rectangle as rect. Platforms: on Linux desktops whose window manager moves windows with Alt-drag (Xfce, Cinnamon and MATE by default; KDE Plasma 5 and other setups with Alt as the window modifier; GNOME and Plasma 6 use Super) the drag never reaches PdfCraft, so use Edit ▸ Column select or change that setting. On Windows, releasing Alt does not open a system menu (the window has no native menu). The web build has the same Linux caveat in the browser. Checked by hand on Linux (Fedora) with the Column select tool; Alt/Option-drag, and macOS and Windows generally, rest on the kittest tests. Missing: selection across pages, ⇧-click extending a column, a default shortcut, and a check of Acrobat's own copied-text format (not observed)."
 
 [[feature]]
@@ -1562,7 +1562,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/viewer.rs::view_history_select_all_and_find_options", "crates/ui-egui/src/canvas.rs::select_all_copies_the_whole_document_while_scrolling_continuously", "crates/ui-egui/src/canvas.rs::select_all_of_the_document_only_while_scrolling_through_several_pages"]
+evidence = ["crates/ui-egui/tests/it/viewer.rs::view_history_select_all_and_find_options", "crates/ui-egui/src/canvas/tests.rs::select_all_copies_the_whole_document_while_scrolling_continuously", "crates/ui-egui/src/canvas/tests.rs::select_all_of_the_document_only_while_scrolling_through_several_pages"]
 notes = "⌘A: the current page one page at a time; the whole document scrolling continuously (#2639), copied whole"
 
 [[feature]]
@@ -1670,7 +1670,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.theme", "view.theme.light", "view.theme.dark"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/theme.rs::toolbar_and_view_menu_share_three_state_preferences", "crates/ui-egui/src/theme.rs::text_is_readable_on_every_surface"]
+evidence = ["crates/ui-egui/tests/it/theme.rs::toolbar_and_view_menu_share_three_state_preferences", "crates/ui-egui/src/theme/tests.rs::text_is_readable_on_every_surface"]
 notes = "Toolbar and Display theme share three choices and a preference setter; manual choices exit system mode. Every text colour meets WCAG AA (4.5:1) on every surface in both themes; glyphs are pixel-aligned for sharper text at 100–150 % scaling."
 
 [[feature]]
@@ -1778,8 +1778,8 @@ milestone = "M3"
 status = "partial"
 commands = ["help.check_updates"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/updates.rs::a_newer_release_is_offered_for_download", "crates/ui-egui/tests/it/updates.rs::nothing_is_asked_until_the_user_checks", "apps/pdfcraft/src/updates.rs::answers_are_read_and_only_our_release_pages_are_offered"]
-notes = "asks GitHub Releases on request and offers the release page. By the owner's decision there is no check at start and no in-place install (Acrobat has both)"
+evidence = ["crates/ui-egui/tests/it/updates.rs::a_newer_release_is_offered_for_download", "crates/ui-egui/tests/it/updates.rs::an_up_to_date_or_failed_check_says_so", "crates/ui-egui/tests/it/updates.rs::the_check_at_start_offers_the_prompt_and_later_dismisses_it", "crates/ui-egui/tests/it/updates.rs::nothing_is_asked_until_the_user_checks"]
+notes = "asks GitHub Releases through craft-update at start (desktop app only) and on request, offers the release page, and updates and restarts in place where the install type allows it; an install waits while documents are unsaved"
 
 [[feature]]
 id = "view.single-key-accelerators"
@@ -1878,7 +1878,7 @@ milestone = "M7"
 status = "partial"
 commands = ["edit.edit_text"]
 tools = ["text_lines", "text_paragraphs", "text_edit", "text_edit_layout", "text_font_files", "text_font_import", "text_fonts"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/it/automation.rs::a_line_split_across_content_streams_is_listed_and_edited", "crates/ui-egui/tests/it/editing.rs::selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens", "crates/edit/src/tests.rs::marked_paragraph_boundaries_and_cross_stream_transforms_survive_rewrite", "crates/automation/tests/it/automation.rs::explicit_font_and_disjoint_ranges_save_reopen_through_tools", "crates/edit/src/tests.rs::disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically", "crates/engine/tests/it/document_fonts.rs::opentype_cff_document_font_preserves_program_codes_and_rendering_after_reopen", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns", "crates/edit/src/tests.rs::rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen", "crates/ui-egui/tests/it/editing.rs::one_editor_contains_mixed_styles_and_visual_rows", "crates/ui-egui/tests/it/editing.rs::inline_editor_preserves_source_font_and_previews_live_bounds", "crates/fonts/src/pdf.rs::mac_subset_cmap_uses_pdf_unicode_without_changing_source_program", "crates/automation/tests/it/automation.rs::mixed_visual_region_edit_preview_save_reopen_and_undo_through_tools", "crates/ui-egui/tests/it/ui.rs::the_edit_tab_turns_on_edit_text_and_images", "crates/ui-egui/tests/it/editing.rs::the_caret_on_a_small_row_is_as_tall_as_that_row", "crates/edit/src/tests.rs::uzbek_and_kazakh_cyrillic_use_the_bundled_latin_face", "crates/automation/tests/it/automation.rs::editing_uzbek_and_kazakh_cyrillic_through_tools", "crates/edit/src/tests.rs::styled_paragraph_batches_cyrillic_without_changing_source_fonts", "crates/edit/src/tests.rs::styled_paragraph_over_240_fallback_glyphs_splits_and_refuses_atomically", "crates/edit/src/tests.rs::styled_fallback_batches_keep_face_choices_and_range_styles", "crates/edit/src/tests.rs::styled_fallback_shards_keep_text_advances_and_alignment", "crates/edit/src/tests.rs::styled_fallback_budget_is_enforced_before_objects_are_written", "crates/edit/src/tests.rs::styled_fallback_same_base_font_and_character_keep_both_weights", "crates/automation/tests/it/automation.rs::styled_cyrillic_fallback_is_batched_through_tools_and_reopen"]
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/it/automation.rs::a_line_split_across_content_streams_is_listed_and_edited", "crates/ui-egui/tests/it/editing.rs::selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens", "crates/edit/src/tests.rs::marked_paragraph_boundaries_and_cross_stream_transforms_survive_rewrite", "crates/automation/tests/it/automation.rs::explicit_font_and_disjoint_ranges_save_reopen_through_tools", "crates/edit/src/tests.rs::disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically", "crates/engine/tests/it/document_fonts.rs::opentype_cff_document_font_preserves_program_codes_and_rendering_after_reopen", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns", "crates/edit/src/tests.rs::rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen", "crates/ui-egui/tests/it/editing.rs::one_editor_contains_mixed_styles_and_visual_rows", "crates/ui-egui/tests/it/editing.rs::inline_editor_preserves_source_font_and_previews_live_bounds", "crates/fonts/src/pdf/tests.rs::mac_subset_cmap_uses_pdf_unicode_without_changing_source_program", "crates/automation/tests/it/automation.rs::mixed_visual_region_edit_preview_save_reopen_and_undo_through_tools", "crates/ui-egui/tests/it/ui.rs::the_edit_tab_turns_on_edit_text_and_images", "crates/ui-egui/tests/it/editing.rs::the_caret_on_a_small_row_is_as_tall_as_that_row", "crates/edit/src/tests.rs::uzbek_and_kazakh_cyrillic_use_the_bundled_latin_face", "crates/automation/tests/it/automation.rs::editing_uzbek_and_kazakh_cyrillic_through_tools", "crates/edit/src/tests.rs::styled_paragraph_batches_cyrillic_without_changing_source_fonts", "crates/edit/src/tests.rs::styled_paragraph_over_240_fallback_glyphs_splits_and_refuses_atomically", "crates/edit/src/tests.rs::styled_fallback_batches_keep_face_choices_and_range_styles", "crates/edit/src/tests.rs::styled_fallback_shards_keep_text_advances_and_alignment", "crates/edit/src/tests.rs::styled_fallback_budget_is_enforced_before_objects_are_written", "crates/edit/src/tests.rs::styled_fallback_same_base_font_and_character_keep_both_weights", "crates/automation/tests/it/automation.rs::styled_cyrillic_fallback_is_batched_through_tools_and_reopen"]
 notes = "The Edit tab turns Edit text & images on at once, as in Acrobat (leaving the tab puts the tool down and applies an edit in progress); click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); a page's /Contents pieces are parsed joined, so a line whose operands and operator sit in different pieces is listed and edited (lines and paragraphs still don't join across pieces; Edit image still parses each piece alone); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next Since #1116: mixed-style visual regions retain source rows, subset encodings, colour and baseline anchors in one textless-background editor. Explicit paragraph/heading scopes constrain grouping; compatible graphics planes permit cross-stream regions. Full matching document fonts complete absent subset glyphs; installed/file selection, TrueType/OpenType-CFF embedding and disjoint UTF-8 range styles have save/reopen coverage. Single-face OpenType shaping/bidi retains logical text through ToUnicode/ActualText. Replacement text the paragraph's font can't show takes the craft-fonts Japanese faces when they draw all of it (Uzbek қ, Kazakh ә are in none of them), else the bundled Inter face, so those letters write in every build (#2593). Legacy non-SFNT preview, mixed-font/style contextual runs, full structure-tree preservation and author intent in untagged PDFs remain limited; Styled-path outline fallback batches by actual face with 240 glyphs per font and preserves source styles; adjacent equal-font/style characters form runs. At most 15360 distinct fallback glyphs per styled paragraph; missing glyphs are refused before fallback objects are written. Glyph coverage, mixed contextual shaping, single-style fallback and stale-font cleanup are unchanged; see docs/editing-existing-text.md"
 
 [[feature]]
@@ -1926,7 +1926,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["text_edit"]
-evidence = ["crates/edit/src/tests.rs::missing_glyphs_substitute_helvetica_and_impossible_text_is_refused", "crates/edit/src/tests.rs::a_bold_stand_in_font_leaves_an_earlier_regular_one_alone", "crates/fonts/src/pdf.rs::subset_fonts_only_encode_the_glyphs_they_have", "crates/fonts/src/pdf.rs::composite_fonts_use_to_unicode"]
+evidence = ["crates/edit/src/tests.rs::missing_glyphs_substitute_helvetica_and_impossible_text_is_refused", "crates/edit/src/tests.rs::a_bold_stand_in_font_leaves_an_earlier_regular_one_alone", "crates/fonts/src/pdf/tests.rs::subset_fonts_only_encode_the_glyphs_they_have", "crates/fonts/src/pdf/tests.rs::composite_fonts_use_to_unicode"]
 notes = "the line's font is reused when every character has a code and a glyph (ToUnicode, encodings, Differences; subset glyph checks); otherwise a standard face of the source font's family (Helvetica, Times or Courier, in its weight and slant; WinAnsi) is used and reported; text no font can show is refused. Each standard stand-in has a resource of its own face (PCEdTimesBold, ...), so a bold paragraph's stand-in no longer turns paragraphs set earlier in a regular one bold (#4280); pages already saved with the shared PCEdHelv name by older builds are not repaired"
 
 [[feature]]
@@ -2153,8 +2153,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["image_edit", "image_hit"]
-evidence = ["crates/edit/src/tests.rs::private_image_crop_with_intervening_state_resizes_across_streams", "crates/automation/tests/it/automation.rs::private_crops_with_nested_state_resize_save_reopen_through_tools", "crates/edit/src/tests.rs::form_artwork_edits_only_the_selected_placement", "crates/ui-egui/tests/it/editing.rs::editing_existing_form_artwork_on_the_page", "crates/automation/tests/it/automation.rs::editing_form_artwork_through_tools", "crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/it/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/edit/src/tests.rs::curved_image_clips_have_analytic_bounds_and_holes_do_not_capture_points", "crates/edit/src/tests.rs::cropped_image_resizing_moves_private_clips_and_keeps_shared_ones", "crates/ui-egui/tests/it/editing.rs::cropped_image_corner_resize_keeps_opposite_corner_and_scales_crop", "crates/edit/src/tests.rs::image_selection_bounds_respect_clips_and_restore_graphics_state", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools"]
-notes = "existing raster images and grouped Form artwork: select, drag to move, drag a corner to resize keeping proportions; Delete removes one placement. Forms include their nested content as a group; individual internal elements and inline images are not supported. See docs/editing-images.md; added images too Since #1116: raster images and grouped Forms move/resize/turn as placements; selected grips own the gesture and opposite anchor, with no PDF writes during movement. Curved path frames use analytic Bezier extrema and hit testing evaluates actual nonzero/even-odd fill rules, excluding holes; intersections can retain a loose frame. Selection and resize use the visible (clipped) frame; exclusive image clips move with their pixels across nested states, intervening operators and content streams; shared clips stay fixed. Inline images and Form internals remain unsupported; see docs/editing-images.md"
+evidence = ["crates/edit/src/tests.rs::private_image_crop_with_intervening_state_resizes_across_streams", "crates/automation/tests/it/automation.rs::private_crops_with_nested_state_resize_save_reopen_through_tools", "crates/edit/src/tests.rs::form_artwork_edits_only_the_selected_placement", "crates/ui-egui/tests/it/editing.rs::editing_existing_form_artwork_on_the_page", "crates/automation/tests/it/automation.rs::editing_form_artwork_through_tools", "crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/it/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/edit/src/tests.rs::curved_image_clips_have_analytic_bounds_and_holes_do_not_capture_points", "crates/edit/src/tests.rs::cropped_image_resizing_moves_private_clips_and_keeps_shared_ones", "crates/ui-egui/tests/it/editing.rs::cropped_image_corner_resize_keeps_opposite_corner_and_scales_crop", "crates/edit/src/tests.rs::image_selection_bounds_respect_clips_and_restore_graphics_state", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::resizing_an_image_under_a_shared_clip_moves_its_own_clip"]
+notes = "existing raster images and grouped Form artwork: select, drag to move, drag a corner to resize keeping proportions; Delete removes one placement. Forms include their nested content as a group; individual internal elements and inline images are not supported. See docs/editing-images.md; added images too Since #1116: raster images and grouped Forms move/resize/turn as placements; selected grips own the gesture and opposite anchor, with no PDF writes during movement. Curved path frames use analytic Bezier extrema and hit testing evaluates actual nonzero/even-odd fill rules, excluding holes; intersections can retain a loose frame. Selection and resize use the visible (clipped) frame; exclusive image clips move with their pixels across nested states, intervening operators and content streams, also inside a clip the picture shares with other content (its own clip scales, the shared one stays); shared clips stay fixed. Inline images and Form internals remain unsupported; see docs/editing-images.md"
 
 [[feature]]
 id = "edit.image-extract"
@@ -2351,7 +2351,7 @@ milestone = "M12"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/layer_actions.rs::links_set_layer_visibility", "crates/ui-egui/tests/it/layer_actions.rs::push_buttons_set_layer_visibility", "crates/engine/src/tests.rs::set_layer_actions_change_what_renders", "crates/engine/src/tests.rs::set_layer_actions_toggle_in_order_and_keep_radio_groups", "crates/render/src/inspect.rs::links_read_set_layer_actions", "crates/forms/src/tests.rs::push_buttons_read_set_layer_actions"]
+evidence = ["crates/ui-egui/tests/it/layer_actions.rs::links_set_layer_visibility", "crates/ui-egui/tests/it/layer_actions.rs::push_buttons_set_layer_visibility", "crates/engine/src/tests.rs::set_layer_actions_change_what_renders", "crates/engine/src/tests.rs::set_layer_actions_toggle_in_order_and_keep_radio_groups", "crates/render/src/inspect/tests.rs::links_read_set_layer_actions", "crates/forms/src/tests.rs::push_buttons_read_set_layer_actions"]
 notes = "Links and push buttons run it: ON, OFF and Toggle in order, by optional content group, and with /PreserveRB (the default) a layer turned on turns off the rest of its /RBGroups group. Like the Layers panel it changes the view, not the document (no undo step, not saved). Not yet: creating the action (Link Properties, a field's Actions), bookmarks and other triggers, /Next chains, JavaScript ocg.state, and the Layers panel keeping radio-button groups itself."
 
 [[feature]]
@@ -2448,7 +2448,7 @@ status = "shipped"
 commands = ["edit.header_footer"]
 tools = ["doc_header_footer"]
 evidence = ["crates/edit/src/tests.rs::tokens_expand", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove"]
-notes = "<<1>>, <<n>>, <<1 of n>>, <<Page 1 of n>>, dates, Bates"
+notes = "<<1>>, <<n>>, <<1 of n>>, <<Page 1 of n>>, dates (US, ISO, day-first with slashes and the dotted <<dd.mm.yyyy>>, <<d.m.yyyy>>, <<dd.mm.yy>>, <<d.m.yy>>), Bates. Month names are English only"
 
 [[feature]]
 id = "edit.header-footer-ranges"
@@ -2459,7 +2459,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.header_footer"]
 tools = ["doc_header_footer"]
-evidence = ["crates/ui-egui/src/marks_ui.rs::page_ranges_with_subsets", "crates/ui-egui/tests/it/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset"]
+evidence = ["crates/ui-egui/src/dialogs/marks_ui.rs::page_ranges_with_subsets", "crates/ui-egui/tests/it/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset"]
 notes = "all / from–to, all / even / odd"
 
 [[feature]]
@@ -2519,7 +2519,7 @@ milestone = "M7"
 status = "partial"
 commands = ["edit.watermark"]
 tools = ["doc_watermark"]
-evidence = ["crates/edit/src/tests.rs::watermarks_rotate_fade_and_can_go_behind", "crates/edit/src/tests.rs::watermark_offset_moves_the_centre_right_and_up", "crates/edit/src/tests.rs::a_watermark_offset_that_is_not_finite_is_refused", "crates/automation/tests/it/automation.rs::watermarks_move_from_the_page_centre_through_tools", "crates/ui-egui/src/marks_ui.rs::the_watermark_edit_carries_the_offset"]
+evidence = ["crates/edit/src/tests.rs::watermarks_rotate_fade_and_can_go_behind", "crates/edit/src/tests.rs::watermark_offset_moves_the_centre_right_and_up", "crates/edit/src/tests.rs::a_watermark_offset_that_is_not_finite_is_refused", "crates/automation/tests/it/automation.rs::watermarks_move_from_the_page_centre_through_tools", "crates/ui-egui/src/dialogs/marks_ui.rs::the_watermark_edit_carries_the_offset"]
 notes = "rotation, opacity, behind/on top, and a horizontal/vertical offset from the page centre in points (dialog and offset_x/offset_y); no offset from the page edge or in page units, and no print/screen-only variants yet"
 
 [[feature]]
@@ -2847,7 +2847,7 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.replace"]
 tools = ["page_replace"]
-evidence = ["crates/organize/src/tests.rs::replace_pages_swaps_content_but_keeps_annotations", "crates/ui-egui/tests/it/editing.rs::replace_pages_dialog_swaps_page_content", "crates/ui-egui/tests/it/editing.rs::replace_button_replaces_selected_pages_in_organize", "crates/automation/tests/it/automation.rs::replacing_pages_through_tools", "crates/ui-egui/src/canvas.rs::replacing_a_page_after_layout_never_uploads_an_oversized_texture", "crates/ui-egui/src/canvas.rs::oversized_raster_results_do_not_replace_cached_textures"]
+evidence = ["crates/organize/src/tests.rs::replace_pages_swaps_content_but_keeps_annotations", "crates/ui-egui/tests/it/editing.rs::replace_pages_dialog_swaps_page_content", "crates/ui-egui/tests/it/editing.rs::replace_button_replaces_selected_pages_in_organize", "crates/automation/tests/it/automation.rs::replacing_pages_through_tools", "crates/ui-egui/src/canvas/tests.rs::replacing_a_page_after_layout_never_uploads_an_oversized_texture", "crates/ui-egui/src/canvas/tests.rs::oversized_raster_results_do_not_replace_cached_textures"]
 notes = "Content, resources and boxes replaced; links, comments, fields and bookmarks kept. Page-list edits discard demand laid out against the previous geometry; the next frame plans bounded backdrops and tiles. Raster uploads reject empty images and dimensions beyond the current GPU texture limit before replacing cached textures (#3149). This covers the viewer's page, tile, thumbnail, organize and print-preview result paths; it does not change the renderer's output resolution or add a global GPU memory budget."
 
 [[feature]]
@@ -3051,7 +3051,7 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.combine"]
 tools = ["doc_combine"]
-evidence = ["crates/ui-egui/tests/it/combine_grid.rs::combine_shows_a_grid_by_default_and_the_view_is_kept_in_the_settings", "crates/ui-egui/tests/it/combine_grid.rs::cards_select_like_the_list_and_the_selection_survives_switching_views", "crates/ui-egui/tests/it/combine_grid.rs::dragging_a_card_moves_it_and_undo_puts_it_back", "crates/ui-egui/tests/it/combine_grid.rs::a_dragged_selection_moves_together_to_the_first_and_last_gaps", "crates/ui-egui/tests/it/combine_grid.rs::thumbnails_show_the_first_page_each_file_takes", "crates/ui-egui/tests/it/combine_grid.rs::many_files_render_only_what_is_in_view_a_few_at_a_time", "crates/ui-egui/tests/it/combine_grid.rs::long_thin_pages_get_thumbnails_within_the_size_limits", "crates/ui-egui/tests/it/combine_grid.rs::combine_follows_the_order_shown_in_the_grid", "crates/ui-egui/src/combine_grid.rs::render_threads_never_exceed_three_while_files_come_and_go", "crates/ui-egui/src/combine_grid.rs::textures_over_budget_go_longest_unseen_first_and_those_in_view_stay", "crates/ui-egui/src/combine_grid.rs::on_the_web_one_thumbnail_waits_at_a_time", "crates/ui-egui/tests/it/combine_grid.rs::a_file_whose_pages_cant_be_measured_says_there_is_no_preview", "crates/ui-egui/tests/it/combine_grid.rs::the_toolbar_sizes_the_cards_within_limits_and_the_size_is_kept_in_the_settings", "crates/ui-egui/src/combine_grid.rs::the_cards_zoom_far_enough_to_read_a_value", "crates/ui-egui/tests/it/combine_grid.rs::ctrl_keys_and_ctrl_wheel_size_the_cards_and_leave_the_window_alone", "crates/ui-egui/tests/it/combine_grid.rs::zooming_keeps_the_card_under_the_pointer_in_place_and_thumbnails_never_go_blank", "crates/ui-egui/tests/it/combine_grid.rs::zooming_quickly_never_runs_more_than_three_render_threads", "crates/ui-egui/tests/it/combine_grid.rs::hovering_a_card_shows_its_trash_and_magnifier_and_only_then", "crates/ui-egui/tests/it/combine_grid.rs::the_card_trash_removes_only_that_file_and_undo_brings_it_back", "crates/ui-egui/tests/it/combine_grid.rs::the_magnifier_shows_the_file_large_and_flips_through_the_pages_it_adds", "crates/ui-egui/tests/it/combine_grid.rs::the_preview_closes_when_its_file_leaves_and_keeps_to_three_render_threads", "crates/ui-egui/tests/it/combine_grid.rs::a_right_click_on_a_card_offers_preview_and_remove", "crates/ui-egui/tests/it/combine_grid.rs::space_shows_the_selected_file_large_in_the_grid_and_the_list", "crates/ui-egui/tests/it/combine_grid.rs::expanding_a_file_shows_the_pages_it_adds_in_order_with_their_numbers", "crates/ui-egui/tests/it/combine_grid.rs::expand_all_and_collapse_all_from_the_toolbar_and_a_right_click", "crates/ui-egui/tests/it/combine_grid.rs::expanding_is_a_view_kept_across_views_and_zoom_and_never_an_undo_step", "crates/ui-egui/tests/it/combine_grid.rs::dragging_a_page_moves_that_page_even_between_another_files_pages", "crates/ui-egui/tests/it/combine_grid.rs::combining_with_files_expanded_gives_the_same_document", "crates/ui-egui/tests/it/combine_grid.rs::a_page_click_selects_that_page_and_the_arrows_step_rows_of_cards", "crates/ui-egui/tests/it/combine_grid.rs::a_page_cards_magnifier_opens_the_preview_on_that_page", "crates/ui-egui/tests/it/combine_grid.rs::a_long_file_expanded_renders_only_its_pages_in_view_within_three_threads", "crates/ui-egui/tests/it/combine_grid.rs::collapsing_brings_the_files_card_into_view", "crates/ui-egui/tests/it/combine_grid.rs::a_file_too_long_to_spread_out_offers_no_expand", "crates/ui-egui/src/combine_grid.rs::the_next_page_of_a_file_reuses_its_open_document_until_it_closes", "crates/ui-egui/tests/it/combine_grid.rs::removing_pages_from_the_hover_bar_the_toolbar_and_delete_never_touches_the_file", "crates/ui-egui/tests/it/combine_grid.rs::a_split_file_counts_once_and_combines_with_one_bookmark", "crates/ui-egui/src/combine_ui.rs::a_page_moved_between_another_files_pages_splits_its_file_and_parts_rejoin", "crates/ui-egui/src/combine_ui.rs::removing_pages_drops_emptied_parts_and_joins_what_meets", "crates/ui-egui/src/combine_ui.rs::page_lists_become_the_shortest_range", "crates/ui-egui/tests/it/combine_grid.rs::pages_picked_out_of_sight_or_before_an_undo_are_let_go_of", "crates/ui-egui/tests/it/combine_grid.rs::a_files_parts_join_when_what_was_between_them_goes_and_one_file_cannot_be_combined", "crates/organize/src/tests.rs::a_page_shown_twice_gets_its_own_annotations", "crates/engine/src/tests.rs::a_page_with_a_form_field_shown_twice_keeps_one_field", "crates/ui-egui/tests/it/combine_grid.rs::files_picked_by_automation_let_go_of_the_pages_picked"]
+evidence = ["crates/ui-egui/tests/it/combine_grid.rs::combine_shows_a_grid_by_default_and_the_view_is_kept_in_the_settings", "crates/ui-egui/tests/it/combine_grid.rs::cards_select_like_the_list_and_the_selection_survives_switching_views", "crates/ui-egui/tests/it/combine_grid.rs::dragging_a_card_moves_it_and_undo_puts_it_back", "crates/ui-egui/tests/it/combine_grid.rs::a_dragged_selection_moves_together_to_the_first_and_last_gaps", "crates/ui-egui/tests/it/combine_grid.rs::thumbnails_show_the_first_page_each_file_takes", "crates/ui-egui/tests/it/combine_grid.rs::many_files_render_only_what_is_in_view_a_few_at_a_time", "crates/ui-egui/tests/it/combine_grid.rs::long_thin_pages_get_thumbnails_within_the_size_limits", "crates/ui-egui/tests/it/combine_grid.rs::combine_follows_the_order_shown_in_the_grid", "crates/ui-egui/src/workflows/combine_grid/tests.rs::render_threads_never_exceed_three_while_files_come_and_go", "crates/ui-egui/src/workflows/combine_grid/tests.rs::textures_over_budget_go_longest_unseen_first_and_those_in_view_stay", "crates/ui-egui/src/workflows/combine_grid/tests.rs::on_the_web_one_thumbnail_waits_at_a_time", "crates/ui-egui/tests/it/combine_grid.rs::a_file_whose_pages_cant_be_measured_says_there_is_no_preview", "crates/ui-egui/tests/it/combine_grid.rs::the_toolbar_sizes_the_cards_within_limits_and_the_size_is_kept_in_the_settings", "crates/ui-egui/src/workflows/combine_grid/tests.rs::the_cards_zoom_far_enough_to_read_a_value", "crates/ui-egui/tests/it/combine_grid.rs::ctrl_keys_and_ctrl_wheel_size_the_cards_and_leave_the_window_alone", "crates/ui-egui/tests/it/combine_grid.rs::zooming_keeps_the_card_under_the_pointer_in_place_and_thumbnails_never_go_blank", "crates/ui-egui/tests/it/combine_grid.rs::zooming_quickly_never_runs_more_than_three_render_threads", "crates/ui-egui/tests/it/combine_grid.rs::hovering_a_card_shows_its_trash_and_magnifier_and_only_then", "crates/ui-egui/tests/it/combine_grid.rs::the_card_trash_removes_only_that_file_and_undo_brings_it_back", "crates/ui-egui/tests/it/combine_grid.rs::the_magnifier_shows_the_file_large_and_flips_through_the_pages_it_adds", "crates/ui-egui/tests/it/combine_grid.rs::the_preview_closes_when_its_file_leaves_and_keeps_to_three_render_threads", "crates/ui-egui/tests/it/combine_grid.rs::a_right_click_on_a_card_offers_preview_and_remove", "crates/ui-egui/tests/it/combine_grid.rs::space_shows_the_selected_file_large_in_the_grid_and_the_list", "crates/ui-egui/tests/it/combine_grid.rs::expanding_a_file_shows_the_pages_it_adds_in_order_with_their_numbers", "crates/ui-egui/tests/it/combine_grid.rs::expand_all_and_collapse_all_from_the_toolbar_and_a_right_click", "crates/ui-egui/tests/it/combine_grid.rs::expanding_is_a_view_kept_across_views_and_zoom_and_never_an_undo_step", "crates/ui-egui/tests/it/combine_grid.rs::dragging_a_page_moves_that_page_even_between_another_files_pages", "crates/ui-egui/tests/it/combine_grid.rs::combining_with_files_expanded_gives_the_same_document", "crates/ui-egui/tests/it/combine_grid.rs::a_page_click_selects_that_page_and_the_arrows_step_rows_of_cards", "crates/ui-egui/tests/it/combine_grid.rs::a_page_cards_magnifier_opens_the_preview_on_that_page", "crates/ui-egui/tests/it/combine_grid.rs::a_long_file_expanded_renders_only_its_pages_in_view_within_three_threads", "crates/ui-egui/tests/it/combine_grid.rs::collapsing_brings_the_files_card_into_view", "crates/ui-egui/tests/it/combine_grid.rs::a_file_too_long_to_spread_out_offers_no_expand", "crates/ui-egui/src/workflows/combine_grid/tests.rs::the_next_page_of_a_file_reuses_its_open_document_until_it_closes", "crates/ui-egui/tests/it/combine_grid.rs::removing_pages_from_the_hover_bar_the_toolbar_and_delete_never_touches_the_file", "crates/ui-egui/tests/it/combine_grid.rs::a_split_file_counts_once_and_combines_with_one_bookmark", "crates/ui-egui/src/workflows/combine_ui/tests.rs::a_page_moved_between_another_files_pages_splits_its_file_and_parts_rejoin", "crates/ui-egui/src/workflows/combine_ui/tests.rs::removing_pages_drops_emptied_parts_and_joins_what_meets", "crates/ui-egui/src/workflows/combine_ui/tests.rs::page_lists_become_the_shortest_range", "crates/ui-egui/tests/it/combine_grid.rs::pages_picked_out_of_sight_or_before_an_undo_are_let_go_of", "crates/ui-egui/tests/it/combine_grid.rs::a_files_parts_join_when_what_was_between_them_goes_and_one_file_cannot_be_combined", "crates/organize/src/tests.rs::a_page_shown_twice_gets_its_own_annotations", "crates/engine/src/tests.rs::a_page_with_a_form_field_shown_twice_keeps_one_field", "crates/ui-egui/tests/it/combine_grid.rs::files_picked_by_automation_let_go_of_the_pages_picked"]
 notes = "Combine files shows a card per file (the default; Grid/List toggle kept in the settings, --combine-view grid|list): the first page the file contributes (its page range's first page), stacked when it contributes more, and its name shortened in the middle. Cards are sized from 60% to 500% (toolbar slider, buttons and percentage reset, Ctrl/⌘ +/−/0, Ctrl/⌘ with the wheel or a pinch over the grid; the buttons step 60/80/100/125/150/175/200/250/300/400/500%, kept in the settings, --combine-zoom 60..500), keeping the card under the pointer in place. 200% used to be the ceiling, which was too small to read values off an invoice while reordering the pages of a statement (#2531). Hovering a card shows its own actions along the top of its page: remove that file only (whatever else is selected; undoable) and a magnifier that shows the file large, flipping through the pages it adds (buttons, Left/Right; Esc, close or a click outside closes it), also on the card's right-click menu, and Space shows the selected file large (the way there by keyboard). Cards select (click, Ctrl, Shift, arrows by card and by row), drag to reorder (one undo step; the grid scrolls at its edges) and share the list's toolbar. Thumbnails render off the UI thread, only for cards in view, sized to both sides of the page and at most 1536 px (room for a Letter page at 500% on a 1.5 pixels-per-point screen); at most three render threads at once, counted as threads until they exit (no watchdog replacements; a page stuck for good in one step that can't be interrupted keeps its thread, and so its place, for the rest of the run); textures out of view are dropped over a 32 MB budget (those in view are kept). Locked, unreadable and bad-range files show why instead of a page, and a file whose page size can't be read (e.g. opened with an RC4 owner password) says No preview; page ranges are edited in the list. On the web a thumbnail, and the page shown large, render on the UI thread (one per frame, and only one waits at a time), so a very slow or very large page stalls that frame. A file that adds more than one page (up to 2000) expands into its pages (hover bar, right-click, or Expand all / Collapse all in the toolbar): one card per page it adds, in its range's order, each saying Page N and the file's name, on a tinted band; a click on a page selects that page, Up/Down step rows of cards, dragging a file's card moves the whole file (a drop among a file's pages goes to its nearer end), and its magnifier opens the preview on that page; expanding is a view, not an undo step, and changes nothing in the combined file; a page's render reuses its file's open document for a moment rather than reading the file again. With a file expanded, single pages are selected (click, Ctrl, Shift), dragged anywhere (a page moved between another file's pages splits its file into parts, shown as rows in the list with their own page ranges; parts side by side join again) and removed (a page card's trash, the toolbar, Delete), each one undo step, never changing the files themselves; a split file still counts and combines as one file."
 
 [[feature]]
@@ -3231,7 +3231,7 @@ milestone = "M4"
 status = "partial"
 commands = []
 tools = ["doc_info", "page_transition_set"]
-evidence = ["crates/render/src/inspect.rs::page_transitions_and_display_times_are_read", "crates/automation/tests/it/automation.rs::doc_info_lists_page_transitions_and_display_times", "crates/organize/src/tests.rs::page_transitions_are_set_removed_and_checked", "crates/automation/tests/it/automation.rs::page_transitions_are_set_and_removed_through_the_tools"]
+evidence = ["crates/render/src/inspect/tests.rs::page_transitions_and_display_times_are_read", "crates/automation/tests/it/automation.rs::doc_info_lists_page_transitions_and_display_times", "crates/organize/src/tests.rs::page_transitions_are_set_removed_and_checked", "crates/automation/tests/it/automation.rs::page_transitions_are_set_and_removed_through_the_tools"]
 notes = "Read and set, not played: each page's /Trans (style, duration, dimension, motion, direction, Fly scale and backdrop) and /Dur display time are read with the spec's defaults and listed by doc_info (DocInfo::transitions); page_transition_set (Edit::SetTransition, one undo step) writes or removes them on chosen pages with the values checked first. Not yet: playing them in full screen, auto-advancing on /Dur, and the Page Transitions dialog"
 
 [[feature]]
@@ -3339,7 +3339,7 @@ milestone = "M4"
 status = "shipped"
 commands = []
 tools = ["bookmark_list", "bookmark_set_style"]
-evidence = ["crates/render/src/inspect.rs::outline_items_carry_their_colour_and_style", "crates/organize/src/tests.rs::bookmarks_report_their_colour_and_style", "crates/organize/src/tests.rs::bookmark_style_and_colour_are_set_as_the_table_says", "crates/ui-egui/src/panels.rs::bookmark_titles_take_their_style_and_colour", "crates/ui-egui/src/theme.rs::a_document_colour_is_kept_where_it_reads", "crates/ui-egui/tests/it/bookmarks.rs::style_and_colour_from_the_bookmark_menu", "crates/automation/tests/it/automation.rs::bookmark_list_reports_colour_and_style"]
+evidence = ["crates/render/src/inspect/tests.rs::outline_items_carry_their_colour_and_style", "crates/organize/src/tests.rs::bookmarks_report_their_colour_and_style", "crates/organize/src/tests.rs::bookmark_style_and_colour_are_set_as_the_table_says", "crates/ui-egui/src/panels/bookmarks.rs::bookmark_titles_take_their_style_and_colour", "crates/ui-egui/src/theme/tests.rs::a_document_colour_is_kept_where_it_reads", "crates/ui-egui/tests/it/bookmarks.rs::style_and_colour_from_the_bookmark_menu", "crates/automation/tests/it/automation.rs::bookmark_list_reports_colour_and_style"]
 notes = "#3193: the Bookmarks panel draws each title in its /C colour and /F style (ISO 32000-2 §12.3.3, Tables 151 and 152: bit 1 italic, bit 2 bold), lightening a colour too dark for the dark theme until it reads (3:1). A bookmark's menu has Style (Bold, Italic) and Colour (the comment swatches and Other colour…); bookmark_set_style does the same and bookmark_list reports them. Regular removes /F, black removes /C, and /F bits the table doesn't define are kept. Not yet: one change for several selected bookmarks, and a Properties dialog."
 
 [[feature]]
@@ -3363,8 +3363,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["file.properties"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/bookmarks.rs::expanding_and_collapsing_all_bookmarks"]
-notes = "Bookmarks panel options: expand all, expand top-level, collapse all"
+evidence = ["crates/ui-egui/tests/it/bookmarks.rs::expanding_and_collapsing_all_bookmarks", "crates/ui-egui/tests/it/bookmarks.rs::a_closed_top_level_bookmark_opens_closed", "crates/organize/src/tests.rs::bookmarks_add_rename_move_delete"]
+notes = "Bookmarks panel options: expand all, expand top-level, collapse all. Each bookmark, top level included, opens as its /Count says (positive open; negative or missing closed, ISO 32000-2 Table 151); the triangle toggles it for the session and a search shows matches inside closed ones. Adding or moving a bookmark into another opens that one. Missing: the open/closed state the reader sets is not written back to /Count on save"
 
 [[feature]]
 id = "organize.bookmarks-from-structure"
@@ -3471,8 +3471,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["file.properties"]
 tools = ["doc_info"]
-evidence = ["crates/ui-egui/tests/it/editing.rs::document_properties_edit_is_one_undoable_step", "crates/ui-egui/tests/it/editing.rs::cancelling_properties_discards_the_draft", "crates/organize/src/tests.rs::document_info_falls_back_to_the_xmp_packet", "crates/engine/src/tests.rs::document_information_stated_only_in_xmp_is_shown"]
-notes = "Title, Author, Subject and Keywords (and Creator, Producer in doc_info) come from /Info, else from the XMP packet (dc:title, dc:creator, dc:description, pdf:Keywords, xmp:CreatorTool, pdf:Producer) for files that state them only there; edits write both. Missing: a UTF-16 XMP packet isn't read, and /Info kept only in an older revision's trailer isn't looked up"
+evidence = ["crates/ui-egui/tests/it/editing.rs::document_properties_edit_is_one_undoable_step", "crates/ui-egui/tests/it/editing.rs::cancelling_properties_discards_the_draft", "crates/organize/src/tests.rs::document_info_falls_back_to_the_xmp_packet", "crates/engine/src/tests.rs::document_information_stated_only_in_xmp_is_shown", "crates/ui-egui/tests/it/dialog_chrome.rs::document_properties_values_line_up_and_long_fields_wrap", "crates/ui-egui/tests/it/dialog_chrome.rs::space_audit_tab_measures_the_file_and_stays_in_the_card"]
+notes = "Description, Initial View, Security, Fonts, Custom (organize.custom-properties) and Advanced, plus a Space Audit tab Acrobat does not have (its audit is only in the PDF Optimizer); the audit runs when the tab opens and again after an edit. Title, Author, Subject and Keywords (and Creator, Producer in doc_info) come from /Info, else from the XMP packet (dc:title, dc:creator, dc:description, pdf:Keywords, xmp:CreatorTool, pdf:Producer) for files that state them only there; edits write both. Missing: a UTF-16 XMP packet isn't read, and /Info kept only in an older revision's trailer isn't looked up"
 
 [[feature]]
 id = "organize.edit-metadata"
@@ -3495,7 +3495,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["file.properties"]
 tools = ["doc_info"]
-evidence = ["crates/ui-egui/tests/it/view.rs::fonts_tab_lists_fonts_and_embedding", "crates/render/src/inspect.rs::doc_info_says_which_face_stands_in_and_why", "crates/render/src/inspect.rs::an_embedded_font_reports_no_substitution_at_all"]
+evidence = ["crates/ui-egui/tests/it/view.rs::fonts_tab_lists_fonts_and_embedding", "crates/render/src/inspect/resources.rs::doc_info_says_which_face_stands_in_and_why", "crates/render/src/inspect/resources.rs::an_embedded_font_reports_no_substitution_at_all"]
 notes = "name, type, embedding, subset and encoding; doc_info also reports the face standing in for a program the document does not embed and why it was chosen (Acrobat's Actual Font), including the case where no licensed face exists so nothing is drawn. Still missing: the Fonts tab in the interface does not show the substituted face yet, only the data layer does"
 
 [[feature]]
@@ -3507,8 +3507,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["file.properties"]
 tools = ["doc_initial_view"]
-evidence = ["crates/organize/src/view.rs::initial_view_resolves_indirect_boolean_preferences", "crates/ui-egui/tests/it/ui.rs::a_document_asking_for_full_screen_is_asked_about_first", "crates/organize/src/tests.rs::initial_view_round_trips_and_keeps_scripts", "crates/ui-egui/tests/it/viewer.rs::initial_view_is_edited_and_honoured_on_open", "crates/automation/tests/it/automation.rs::initial_view_through_tools"]
-notes = "navigation panel, layout, magnification, page, window and interface options; honoured on open; script open actions kept. Open in Full Screen mode (/PageMode /FullScreen) asks first (Full Screen / Not now), as Acrobat does, instead of taking the screen. Window and interface options also read indirect boolean ViewerPreferences values. Missing: Acrobat's Full Screen preference to turn that alert off and its \"remember my choice for this document\" (misc.prefs-full-screen)"
+evidence = ["crates/organize/src/view.rs::initial_view_resolves_indirect_boolean_preferences", "crates/ui-egui/tests/it/ui.rs::a_document_asking_for_full_screen_is_asked_about_first", "crates/organize/src/tests.rs::initial_view_round_trips_and_keeps_scripts", "crates/ui-egui/tests/it/viewer.rs::initial_view_is_edited_and_honoured_on_open", "crates/automation/tests/it/automation.rs::initial_view_through_tools", "crates/render/src/inspect/navigation.rs::a_go_to_action_opens_at_its_destination_explicit_or_named", "crates/ui-egui/tests/it/open_action.rs::an_xyz_open_action_puts_its_point_at_the_window_top_left", "crates/ui-egui/tests/it/open_action.rs::a_fith_open_action_puts_its_top_at_the_window_top", "crates/ui-egui/tests/it/open_action.rs::a_named_open_destination_opens_its_page", "crates/ui-egui/tests/it/open_action.rs::a_full_screen_document_shows_its_non_full_screen_panel_outside_full_screen", "crates/organize/src/tests.rs::an_unchanged_opening_destination_keeps_its_position_and_name", "crates/automation/tests/it/automation.rs::doc_info_reports_the_open_destination", "crates/organize/src/tests.rs::choosing_page_one_replaces_a_named_opening_destination", "crates/organize/src/tests.rs::a_named_opening_destination_is_kept_while_it_still_holds"]
+notes = "navigation panel, layout, magnification, page, window and interface options; honoured on open; script open actions kept. Open in Full Screen mode (/PageMode /FullScreen) asks first (Full Screen / Not now), as Acrobat does, instead of taking the screen. Window and interface options also read indirect boolean ViewerPreferences values. Missing: Acrobat's Full Screen preference to turn that alert off and its \"remember my choice for this document\" (misc.prefs-full-screen). On open the /OpenAction destination places the view as ISO 32000-2 Table 149 says (the /XYZ point at the window's top-left, /FitH and /FitV top or left at the edge), and a named destination (name or string, /Names /Dests tree or catalog /Dests, §12.3.2.4) resolves; Always use my default zoom keeps only the page. A full-screen document shows its /NonFullScreenPageMode panel outside full screen (Table 147). doc_info reports the opening destination. Document Properties keeps an opening action whose page and magnification are left alone, but still edits only those two; it shows a named destination's page and magnification, and choosing another page or magnification replaces the name with an explicit destination, except that page 1 at the default magnification removes /OpenAction so the first page opens. A name that resolves nowhere reads as page 1 and is kept until another page is chosen"
 
 [[feature]]
 id = "organize.custom-properties"
@@ -3517,10 +3517,10 @@ area = "D"
 tier = "P2"
 milestone = "M4"
 status = "partial"
-commands = []
+commands = ["file.properties"]
 tools = ["doc_info", "doc_set_info"]
-evidence = ["crates/organize/src/tests.rs::custom_document_properties_are_listed_set_removed_and_their_names_checked", "crates/render/src/inspect.rs::custom_document_properties_are_listed_apart_from_the_standard_ones", "crates/automation/tests/it/automation.rs::custom_document_properties_are_set_listed_and_cleared_through_the_tools"]
-notes = "Through the tools: doc_set_info sets or clears an /Info entry under any name the spec does not use (names checked as Acrobat does: no standard name, no empty name, no spaces or delimiters, at most 127 bytes), and doc_info lists them under custom, apart from the standard entries. Not yet: the Custom tab in Document Properties, and mirroring them into XMP (pdfx:) as Acrobat does"
+evidence = ["crates/organize/src/tests.rs::custom_document_properties_are_listed_set_removed_and_their_names_checked", "crates/render/src/inspect/tests.rs::custom_document_properties_are_listed_apart_from_the_standard_ones", "crates/automation/tests/it/automation.rs::custom_document_properties_are_set_listed_and_cleared_through_the_tools", "crates/ui-egui/tests/it/editing.rs::custom_properties_are_added_in_the_custom_tab_as_one_undoable_step", "crates/ui-egui/tests/it/editing.rs::custom_properties_are_changed_and_deleted_in_the_custom_tab", "crates/ui-egui/tests/it/editing.rs::the_custom_tab_refuses_names_a_custom_property_cannot_have", "crates/ui-egui/tests/it/editing.rs::a_custom_property_whose_name_the_tools_refuse_is_listed_and_left_alone", "crates/ui-egui/tests/it/editing.rs::a_custom_property_is_deleted_from_an_info_dictionary_in_the_trailer", "crates/ui-egui/tests/it/editing.rs::add_stops_at_the_256_custom_properties_the_tab_lists", "crates/organize/src/tests.rs::document_info_entries_are_cleared_from_an_info_dictionary_in_the_trailer"]
+notes = "Document Properties ▸ Custom lists them, with Name and Value fields and Add, Update (the value of the listed property the Name field names) and Delete; OK writes the changes as one undo step with the other tabs' changes. A property already in the file under a name the tools refuse (a space, a delimiter) or a name that is not UTF-8 is listed and cannot be changed or deleted there, and Add is off for a name the file already uses for an entry that is not listed (not text, only padding, or past the 256 listed), and once the tab or the file lists 256 properties. Through the tools: doc_set_info sets or clears an /Info entry under any name the spec does not use (names checked as Acrobat does: no standard name, no empty name, no spaces or delimiters, at most 127 bytes), and doc_info lists them under custom, apart from the standard entries. Not yet: mirroring them into XMP (pdfx:) as Acrobat does"
 
 [[feature]]
 id = "organize.xmp-editor"
@@ -3583,8 +3583,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_list"]
-evidence = ["crates/ui-egui/tests/it/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/it/comments.rs::the_panel_posts_comments_and_replies", "crates/ui-egui/tests/it/comments.rs::page_groups_collapse_and_expand"]
-notes = "cards grouped by page with replies, status badges, selection, reply box and an Add a comment box; page groups fold and unfold from their chevron or with Collapse/Expand all pages in the panel's \"…\" menu (a comment selected on a folded page opens its group). Groups by author, type or colour don't fold yet"
+evidence = ["crates/ui-egui/tests/it/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/it/comments.rs::the_panel_posts_comments_and_replies", "crates/ui-egui/tests/it/comments.rs::page_groups_collapse_and_expand", "crates/ui-egui/tests/it/comments.rs::replies_follow_irt_references_when_names_repeat_on_every_page", "crates/engine/src/tests.rs::replies_thread_by_reference_when_names_repeat_across_pages", "crates/automation/tests/it/automation.rs::replies_thread_by_reference_when_ids_repeat_across_pages"]
+notes = "cards grouped by page with replies (threaded by the `/IRT` reference, so files whose `/NM` repeats per page, as PyMuPDF writes them, thread correctly; the header counts comments without replies, as Acrobat does), status badges, selection, reply box and an Add a comment box; page groups fold and unfold from their chevron or with Collapse/Expand all pages in the panel's \"…\" menu (a comment selected on a folded page opens its group). Groups by author, type or colour don't fold yet"
 
 [[feature]]
 id = "comment.appearance-generation"
@@ -3607,7 +3607,7 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.note"]
 tools = ["comment_add"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::sticky_note_composer_posts_and_returns_to_select", "crates/ui-egui/tests/it/comments.rs::the_comment_composer_shortcut_only_posts_the_focused_editor", "crates/annot/src/tests.rs::every_tool_creates_a_drawable_comment", "crates/annot/src/tests.rs::every_note_icon_draws_its_own_shape", "crates/annot/src/tests.rs::a_star_note_keeps_its_star_when_recoloured", "crates/engine/src/tests.rs::sticky_notes_stay_upright_where_they_are_placed_on_rotated_pages", "crates/render/src/raster.rs::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages", "crates/ui-egui/tests/it/comments.rs::a_sticky_note_on_a_turned_page_is_picked_where_it_is_drawn"]
+evidence = ["crates/ui-egui/tests/it/comments.rs::sticky_note_composer_posts_and_returns_to_select", "crates/ui-egui/tests/it/comments.rs::the_comment_composer_shortcut_only_posts_the_focused_editor", "crates/annot/src/tests.rs::every_tool_creates_a_drawable_comment", "crates/annot/src/tests.rs::every_note_icon_draws_its_own_shape", "crates/annot/src/tests.rs::a_star_note_keeps_its_star_when_recoloured", "crates/engine/src/tests.rs::sticky_notes_stay_upright_where_they_are_placed_on_rotated_pages", "crates/render/src/raster/tests.rs::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages", "crates/ui-egui/tests/it/comments.rs::a_sticky_note_on_a_turned_page_is_picked_where_it_is_drawn"]
 notes = "our own icon drawings for the seven standard /Name values of ISO 32000-2 Table 175 (Comment, Note, Help, Insert, Key, NewParagraph, Paragraph) and seven further names (Check, Circle, Cross, CrossHairs, Star, RightArrow, UpArrow), each its own shape, chosen in Properties or comment_add, and kept when the colour changes; another name draws as Note. With a pop-up; Ctrl+Enter (also Command+Enter) posts from the focused editor, Shift+Enter adds a newline. Notes are saved with the NoRotate flag, and it is honoured: on a page with /Rotate the icon stays upright with its top-left where it was placed, and is selected and hovered there (#2583). Not yet: opening the pop-ups a file saves open (/Open); NoZoom (the icon scales with the zoom); printing and flattening still place the icon in its /Rect, turned with the page."
 
 [[feature]]
@@ -3751,8 +3751,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.line"]
 tools = ["comment_add"]
-evidence = ["crates/annot/src/tests.rs::every_tool_creates_a_drawable_comment"]
-notes = ""
+evidence = ["crates/annot/src/tests.rs::every_tool_creates_a_drawable_comment", "crates/annot/src/tests.rs::a_positive_leader_length_puts_the_line_above_a_left_to_right_line_and_a_negative_one_below", "crates/annot/src/tests.rs::an_inline_caption_breaks_the_line_around_its_text"]
+notes = "A line without an appearance is drawn with its leader lines (/LL, /LLE, /LLO: the line sits |LL| + LLO from /L, on the left of travel for a positive /LL) and its caption (/Cap, /CP Inline or Top, /CO), endings at the line itself (ISO 32000-2 Table 178). Not yet: the tool can't add leader lines or a caption, the caption is always black Helvetica 10 (no /DS or rich-text styling), and drawing past /Rect is clipped (/Rect isn't grown)."
 
 [[feature]]
 id = "comment.arrow"
@@ -3934,6 +3934,18 @@ tools = []
 evidence = ["crates/ui-egui/tests/it/comments.rs::make_current_properties_default", "crates/ui-egui/tests/it/comments.rs::properties_dialog_makes_the_strikethrough_colour_default"]
 notes = "colour, opacity and line width become the tool's defaults (canvas and Comments panel menus, and Acrobat's Make Properties Default box in Comment Properties, applied on OK with the edited look) and survive a restart: the per-tool styles are persisted with the settings and restored through their clamping setters (#340)"
 
+[[feature]]
+id = "comment.keep-tool-selected"
+title = "Keep annotation tools selected between uses and restarts"
+area = "E"
+tier = "P2"
+milestone = "M14"
+status = "shipped"
+commands = ["comment.line"]
+tools = []
+evidence = ["crates/ui-egui/tests/it/comment_pin.rs::pin_from_quick_bar_survives_restart_and_unpinning", "crates/ui-egui/tests/it/comment_pin.rs::legacy_settings_keep_the_default_and_other_preferences", "crates/ui-egui/tests/it/comment_pin.rs::malformed_pin_values_preserve_the_current_choice", "crates/ui-egui/tests/it/control.rs::comment_pin_is_reported_and_persistent"]
+notes = "The annotation quick bar's shared pin survives restarts as a boolean setting (#4253); unpinning is remembered too. Old settings default to one-shot use, and malformed values keep the current choice. UI-only preference, reachable through opt-in ui.set key=comment-tool-pinned and reported by ui.state.comment_tool_pinned. Startup uses Select; the shared pin applies when an annotation tool is picked. Independent per-tool pins and restoring the active tool are outside this preference."
+
 [[feature]]
 id = "comment.author-identity"
 title = "Author name from identity preferences"
@@ -4291,7 +4303,7 @@ milestone = "M12"
 status = "partial"
 commands = ["measure.distance"]
 tools = ["measure_distance"]
-evidence = ["crates/automation/tests/it/automation.rs::measurements_calibrate_draw_save_reopen_and_export", "crates/measure/src/tests.rs::calibrated_lengths_concave_areas_and_axis_scales", "crates/ui-egui/tests/it/control.rs::measurement_tools_draw_live_calibrate_save_and_export", "crates/ui-egui/tests/it/control.rs::a_plan_scale_picked_or_typed_applies_at_once", "crates/ui-egui/src/measure_ui.rs::typed_ratios_are_read_leniently"]
+evidence = ["crates/automation/tests/it/automation.rs::measurements_calibrate_draw_save_reopen_and_export", "crates/measure/src/tests.rs::calibrated_lengths_concave_areas_and_axis_scales", "crates/ui-egui/tests/it/control.rs::measurement_tools_draw_live_calibrate_save_and_export", "crates/ui-egui/tests/it/control.rs::a_plan_scale_picked_or_typed_applies_at_once", "crates/ui-egui/src/tools/measure_ui.rs::typed_ratios_are_read_leniently"]
 notes = "Two-point distance annotations with saved numeric captions and rectilinear scales. Partial: only single-unit decimal formats; compound (ft-in) and fractional formats are not supported (listed as unsupported, data kept), no leader lines or caption placement options, geospatial scales unsupported, and interop with Acrobat-authored measurements (reading theirs, Acrobat reading ours) is untested."
 
 [[feature]]
@@ -4439,7 +4451,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["form.fields"]
 tools = ["doc_info"]
-evidence = ["crates/ui-egui/tests/it/view.rs::field_list_jumps_to_a_fields_page", "crates/render/src/inspect.rs::fields_listed_only_on_the_pages_are_listed", "crates/ui-egui/tests/it/bulk_fields.rs::fields_panel_selects_multiple_fields_and_opens_their_shared_properties", "crates/ui-egui/tests/it/bulk_fields.rs::double_clicking_a_field_in_the_panel_opens_its_individual_properties"]
+evidence = ["crates/ui-egui/tests/it/view.rs::field_list_jumps_to_a_fields_page", "crates/render/src/inspect/tests.rs::fields_listed_only_on_the_pages_are_listed", "crates/ui-egui/tests/it/bulk_fields.rs::fields_panel_selects_multiple_fields_and_opens_their_shared_properties", "crates/ui-egui/tests/it/bulk_fields.rs::double_clicking_a_field_in_the_panel_opens_its_individual_properties"]
 notes = "list with jump-to-field; in Prepare a form, Shift/Ctrl/Command-click selects several fields and Properties edits their shared properties; double-click opens field properties; fields a file lists only as page widgets (empty /Fields) are adopted too"
 
 [[feature]]
@@ -4451,8 +4463,8 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/view.rs::highlight_fields_tints_the_field_area", "crates/ui-egui/tests/it/view.rs::required_radio_buttons_get_a_round_red_border", "crates/ui-egui/tests/it/view.rs::field_highlighting_is_on_by_default_and_remembered", "crates/ui-egui/tests/it/view.rs::stored_field_highlight_choice_wins_over_the_default", "crates/ui-egui/tests/it/view.rs::highlight_fields_leaves_read_only_fields_alone", "crates/ui-egui/tests/it/editing.rs::a_secured_form_shows_its_form_notice_and_its_security"]
-notes = "only fields that can be filled are marked (a read-only field is left as drawn, so a form's locked boxes don't look fillable); offered on secured forms too; on by default for new settings (a stored choice is kept) and remembered for the next document and session; toggled from the form bar and from Preferences > Appearance, where it sets the default for documents opened afterwards; required fields get a red border (round for radio buttons); the tint is drawn over the field, where Acrobat paints the highlight colour behind it"
+evidence = ["crates/ui-egui/tests/it/view.rs::highlight_fields_tints_the_field_area", "crates/ui-egui/tests/it/view.rs::required_radio_buttons_get_a_round_red_border", "crates/ui-egui/tests/it/view.rs::field_highlighting_is_on_by_default_and_remembered", "crates/ui-egui/tests/it/view.rs::stored_field_highlight_choice_wins_over_the_default", "crates/ui-egui/tests/it/view.rs::highlight_fields_leaves_read_only_fields_alone", "crates/ui-egui/tests/it/editing.rs::a_secured_form_shows_its_form_notice_and_its_security", "crates/ui-egui/tests/it/view.rs::round_check_boxes_get_a_round_highlight"]
+notes = "only fields that can be filled are marked (a read-only field is left as drawn, so a form's locked boxes don't look fillable); offered on secured forms too; on by default for new settings (a stored choice is kept) and remembered for the next document and session; toggled from the form bar and from Preferences > Appearance, where it sets the default for documents opened afterwards; required fields get a red border (the tint and border round for radio buttons and for check boxes laid out for a round XFA check button); the tint is drawn over the field, where Acrobat paints the highlight colour behind it"
 
 [[feature]]
 id = "form.field-appearance-display"
@@ -4463,7 +4475,7 @@ milestone = "M2"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/render/src/raster.rs::widget_appearance_states", "crates/engine/src/tests.rs::validated_signatures_without_layers_keep_their_appearance", "crates/engine/src/tests.rs::real_layered_signatures_keep_their_original_appearance", "crates/engine/src/tests.rs::real_layered_signatures_round_trip_behind_a_user_password", "crates/engine/src/tests.rs::a_metadata_edit_keeps_the_original_signature_appearance", "crates/engine/src/tests.rs::saving_after_an_edit_keeps_the_baked_appearance", "crates/engine/src/tests.rs::chamfered_signature_borders_survive_trust_exports_printing_and_save", "crates/engine/src/tests.rs::mixed_signature_caption_details_survive_trust_exports_printing_and_save", "crates/engine/src/tests.rs::buttons_and_combs_left_to_the_viewer_are_displayed", "crates/forms/src/tests.rs::button_states_without_an_appearance"]
+evidence = ["crates/render/src/raster/tests.rs::widget_appearance_states", "crates/engine/src/tests.rs::validated_signatures_without_layers_keep_their_appearance", "crates/engine/src/tests.rs::real_layered_signatures_keep_their_original_appearance", "crates/engine/src/tests.rs::real_layered_signatures_round_trip_behind_a_user_password", "crates/engine/src/tests.rs::a_metadata_edit_keeps_the_original_signature_appearance", "crates/engine/src/tests.rs::saving_after_an_edit_keeps_the_baked_appearance", "crates/engine/src/tests.rs::chamfered_signature_borders_survive_trust_exports_printing_and_save", "crates/engine/src/tests.rs::mixed_signature_caption_details_survive_trust_exports_printing_and_save", "crates/engine/src/tests.rs::buttons_and_combs_left_to_the_viewer_are_displayed", "crates/forms/src/tests.rs::button_states_without_an_appearance"]
 notes = "widgets retain their original artwork. Signature validation is a separate viewer page overlay; it is never written into document streams or included in image/text exports, vector printing or Print as Image. Saves retain signed appearance bytes. Generic in-place appearance rewriting is deferred: no supported producer template is positively identified, and caption text plus drawing uniqueness does not establish an icon role. Baked Not Verified captions remain unchanged; issue #79 is not fully resolved. Check boxes and radio buttons with no appearance for their state are shown (display-only) with their /MK border and background and, when on, the /MK /CA ZapfDingbats symbol in the /DA colour (a check or a dot by default); push buttons with none show their /MK frame and caption; files that carry their own appearances are not redrawn."
 
 [[feature]]
@@ -4499,8 +4511,8 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.fields"]
 tools = ["form_fill"]
-evidence = ["crates/ui-egui/tests/it/forms.rs::check_boxes_radios_and_choices", "crates/forms/src/tests.rs::choices_accept_exports_or_display_text"]
-notes = "combo and list boxes, multi-select lists; editable combo boxes accept free text"
+evidence = ["crates/ui-egui/tests/it/forms.rs::check_boxes_radios_and_choices", "crates/forms/src/tests.rs::choices_accept_exports_or_display_text", "crates/ui-egui/tests/it/forms.rs::an_editable_combo_box_takes_a_typed_value", "crates/ui-egui/tests/it/forms.rs::a_combo_box_without_edit_takes_no_typing", "crates/automation/tests/it/automation.rs::form_fill_takes_free_text_only_in_an_editable_combo_box"]
+notes = "combo and list boxes, multi-select lists; an editable combo box (Edit flag) has a text box over the field as well as its list, and takes typed text on the page and through form_fill; a combo box without Edit takes only its options. No type-ahead or spell check in the typed box"
 
 [[feature]]
 id = "form.push-buttons"
@@ -4559,7 +4571,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/forms/src/af.rs::numbers_format_like_acrobat", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools"]
+evidence = ["crates/forms/src/af/tests.rs::numbers_format_like_acrobat", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools"]
 notes = "AFNumber_Format/Keystroke run natively: decimals, 5 separator styles, currency before/after, negative styles (red shown as minus/parentheses)"
 
 [[feature]]
@@ -4571,7 +4583,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/forms/src/af.rs::numbers_format_like_acrobat"]
+evidence = ["crates/forms/src/af/tests.rs::numbers_format_like_acrobat"]
 notes = "AFPercent_Format/Keystroke"
 
 [[feature]]
@@ -4583,7 +4595,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/forms/src/af.rs::dates_times_and_masks", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/forms/src/af.rs::digits_typed_without_separators_fill_adjacent_fields"]
+evidence = ["crates/forms/src/af/tests.rs::dates_times_and_masks", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/forms/src/af.rs::digits_typed_without_separators_fill_adjacent_fields"]
 notes = "AFDate_FormatEx/KeystrokeEx, AFDate_Format presets, AFTime_Format(Ex): lenient parsing, month and day names, impossible dates refused; digits typed without separators fill fields the format writes side by side by their fixed widths (20261018 for yyyymmdd, 1430 for HHMM). A run of digits is split only where the format itself has no separator: 20261018 typed into a yyyy-mm-dd field is still refused"
 
 [[feature]]
@@ -4595,7 +4607,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/forms/src/af.rs::dates_times_and_masks"]
+evidence = ["crates/forms/src/af/tests.rs::dates_times_and_masks"]
 notes = "zip, zip+4, phone, SSN, arbitrary masks (9 A O X)"
 
 [[feature]]
@@ -4607,7 +4619,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/forms/src/af.rs::validation_and_calculation", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools"]
+evidence = ["crates/forms/src/af/tests.rs::validation_and_calculation", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools"]
 notes = "AFRange_Validate with Acrobat's messages"
 
 [[feature]]
@@ -4619,7 +4631,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/forms/src/af.rs::validation_and_calculation", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat"]
+evidence = ["crates/forms/src/af/tests.rs::validation_and_calculation", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat"]
 notes = "SUM, PRD, AVG, MIN, MAX over fields and groups"
 
 [[feature]]
@@ -4631,7 +4643,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/forms/src/af.rs::validation_and_calculation", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools", "crates/forms/src/af.rs::notation_is_read_only_from_a_comment"]
+evidence = ["crates/forms/src/af/tests.rs::validation_and_calculation", "crates/forms/src/tests.rs::formats_validation_and_calculations_run_like_acrobat", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools", "crates/forms/src/af/tests.rs::notation_is_read_only_from_a_comment"]
 notes = "BVCALC expressions with + - * / and parentheses, escaped names, read from the script's comment as Acrobat writes it; a string or code that spells the markers is not notation"
 
 [[feature]]
@@ -4799,7 +4811,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.prepare"]
 tools = ["form_add_field", "form_set_props", "form_delete_field"]
-evidence = ["crates/ui-egui/tests/it/prepare.rs::placing_moving_editing_and_deleting_a_field", "crates/ui-egui/tests/it/prepare.rs::arrow_keys_nudge_the_selected_field_instead_of_turning_the_page", "crates/ui-egui/src/prepare.rs::corner_drags_stretch_freely_and_keep_proportions_with_shift", "crates/ui-egui/tests/it/prepare.rs::deleting_several_selected_fields_and_detecting_fields_from_the_panel", "crates/engine/src/tests.rs::preparing_a_form_adds_renames_and_deletes_fields", "crates/ui-egui/tests/it/bulk_fields.rs::shared_properties_preserve_mixed_values_and_undo_the_whole_change", "crates/ui-egui/tests/it/bulk_fields.rs::select_all_in_prepare_a_form_selects_only_the_current_pages_fields", "crates/ui-egui/tests/it/bulk_fields.rs::dragging_an_empty_page_area_selects_fields_without_moving_them"]
+evidence = ["crates/ui-egui/tests/it/prepare.rs::placing_moving_editing_and_deleting_a_field", "crates/ui-egui/tests/it/prepare.rs::arrow_keys_nudge_the_selected_field_instead_of_turning_the_page", "crates/ui-egui/src/tools/prepare.rs::corner_drags_stretch_freely_and_keep_proportions_with_shift", "crates/ui-egui/tests/it/prepare.rs::deleting_several_selected_fields_and_detecting_fields_from_the_panel", "crates/engine/src/tests.rs::preparing_a_form_adds_renames_and_deletes_fields", "crates/ui-egui/tests/it/bulk_fields.rs::shared_properties_preserve_mixed_values_and_undo_the_whole_change", "crates/ui-egui/tests/it/bulk_fields.rs::select_all_in_prepare_a_form_selects_only_the_current_pages_fields", "crates/ui-egui/tests/it/bulk_fields.rs::dragging_an_empty_page_area_selects_fields_without_moving_them"]
 notes = "fields shown with blue fill and name tags; select, move (drag, or the arrow keys: a point, Shift ten points, #2608), resize by corners (Shift keeps the field's proportions, #2199), Delete (every selected field, one undo step); field tools return to Select after one field. Shared General, Appearance and applicable Options edits are atomic and opt-in; Ctrl/Command+A selects the current page, rectangle and panel selection are supported. Names, positions, choices/defaults and script tabs remain individual GUI edits"
 
 [[feature]]
@@ -5027,7 +5039,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props", "form_fill"]
-evidence = ["crates/ui-egui/tests/it/prepare.rs::format_validate_and_calculate_tabs", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools", "crates/forms/src/tests.rs::renaming_a_field_renames_it_in_the_calculations_that_read_it", "crates/forms/src/tests.rs::a_rename_reaches_every_stored_form_of_a_calculation", "crates/automation/tests/it/automation.rs::renaming_a_field_keeps_the_formulas_that_read_it", "crates/ui-egui/tests/it/prepare.rs::renaming_a_field_says_how_many_calculations_now_use_the_new_name", "crates/forms/src/af.rs::a_regex_after_a_condition_is_not_read_as_code", "crates/forms/src/af.rs::a_line_comment_ends_at_any_line_terminator", "crates/forms/src/af.rs::a_token_ends_at_a_line_separator"]
+evidence = ["crates/ui-egui/tests/it/prepare.rs::format_validate_and_calculate_tabs", "crates/automation/tests/it/automation.rs::form_formats_and_calculations_through_tools", "crates/forms/src/tests.rs::renaming_a_field_renames_it_in_the_calculations_that_read_it", "crates/forms/src/tests.rs::a_rename_reaches_every_stored_form_of_a_calculation", "crates/automation/tests/it/automation.rs::renaming_a_field_keeps_the_formulas_that_read_it", "crates/ui-egui/tests/it/prepare.rs::renaming_a_field_says_how_many_calculations_now_use_the_new_name", "crates/forms/src/af/tests.rs::a_regex_after_a_condition_is_not_read_as_code", "crates/forms/src/af/tests.rs::a_line_comment_ends_at_any_line_terminator", "crates/forms/src/af/tests.rs::a_token_ends_at_a_line_separator"]
 notes = "sum/product/average/min/max of picked fields, simplified field notation; custom script pending. Renaming a field renames it in the calculations that read it (field lists, notation, and getField calls naming it in a string literal), in the rename's undo step; Field Properties says how many changed and form_set_props lists them. Not rewritten: names built at run time, other events' scripts, document-level scripts. A regular expression that starts a statement right after a `}` is still read as code, so a quote inside one can hide the getField calls after it from a rename and from the calculation order. Whether Acrobat does this is not observed."
 
 [[feature]]
@@ -5284,8 +5296,8 @@ milestone = "M12"
 status = "partial"
 commands = ["file.open"]
 tools = ["doc_open", "doc_info", "form_fields", "form_fill", "js_run"]
-evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/it/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/it/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/engine/src/tests.rs::xfa_date_arithmetic_reads_the_date_as_its_display_picture_shows_it", "crates/automation/tests/it/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/it/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/ui-egui/tests/it/xfa.rs::a_form_whose_scripts_were_turned_off_at_open_says_so", "crates/ui-egui/tests/it/xfa.rs::scripts_turned_off_by_a_click_bring_a_closed_notice_bar_back", "crates/automation/tests/it/automation.rs::doc_info_says_when_a_runaway_script_turned_the_forms_scripts_off", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them", "crates/xfa/src/tests.rs::page_area_without_occur_serves_every_body_page", "apps/pdfcraft-cli/tests/it/xfa.rs::info_reports_the_laid_out_pages_and_fields", "apps/pdfcraft-cli/tests/it/xfa.rs::text_reads_the_layout_including_a_page_absent_from_the_placeholder", "apps/pdfcraft-cli/tests/it/xfa.rs::render_matches_the_engine_layout_on_the_second_page", "apps/pdfcraft-cli/tests/it/xfa.rs::a_laid_out_form_keeps_the_original_copy_permissions", "crates/engine/src/tests.rs::filling_growable_xfa_text_reflows_and_undo_restores_the_layout", "crates/engine/src/tests.rs::xfa_text_growth_refreshes_widget_geometry_but_fixed_height_fields_keep_their_widgets", "crates/automation/tests/it/automation.rs::growable_xfa_text_paginates_after_fill_save_and_print", "crates/engine/src/tests.rs::an_xfa_script_that_fails_partway_keeps_what_it_changed_before_the_error", "crates/engine/src/tests.rs::repeated_xfa_print_buttons_run_their_click_script", "crates/automation/tests/it/automation.rs::repeated_xfa_print_buttons_work_through_tools_and_after_reopen", "crates/xfa/src/tests.rs::rich_text_max_length_reaches_the_field_and_layout", "crates/automation/tests/it/automation.rs::xfa_rich_text_max_length_is_reported_and_enforced_through_tools", "crates/xfa/src/tests.rs::bmp_and_tiff_pictures_are_decoded_and_drawn", "crates/engine/src/tests.rs::active_xfa_does_not_run_pdf_container_scripts_but_keeps_requested_alerts", "crates/engine/src/tests.rs::active_xfa_without_template_scripts_does_not_initialize_pdf_fallback_scripts", "crates/engine/src/tests.rs::inactive_xfa_and_ordinary_pdfs_keep_document_helpers_and_alerts", "crates/automation/tests/it/automation.rs::active_xfa_skips_container_fallback_scripts_after_save_and_reopen", "crates/xfa/src/tests.rs::laying_a_form_out_takes_off_the_usage_rights_it_voids", "crates/engine/src/tests.rs::a_dynamic_xfa_form_is_saved_without_the_usage_rights_its_layout_voided", "crates/xfa/src/tests.rs::faces_measure_text_at_their_standard_14_widths", "crates/xfa/src/tests.rs::rich_text_links_keep_their_address", "crates/xfa/src/tests.rs::links_in_rich_text_become_link_annotations_one_per_line", "crates/xfa/src/tests.rs::a_links_pieces_share_one_address", "crates/xfa/src/tests.rs::a_rule_between_two_pieces_of_a_link_keeps_them_apart", "crates/xfa/src/tests.rs::links_to_anything_but_web_and_email_addresses_stay_plain_text", "crates/automation/tests/it/automation.rs::links_in_xfa_rich_text_are_listed_through_tools", "crates/xfa/src/tests.rs::rounded_corners_make_a_border_one_rounded_shape", "crates/xfa/src/tests.rs::a_rounded_box_cut_by_a_page_break_keeps_its_corners_on_each_page", "crates/xfa/src/tests.rs::rounded_boxes_are_written_as_curved_paths", "crates/xfa/src/tests.rs::a_flowed_subform_is_drawn_with_its_border_under_its_content"]
-notes = "Active XFA layout skips PDF-container document-script initialization for the Acrobat console/field context, so fallback-viewer scripts do not run there. Scripts remain in the file/listing; explicit console/field and XFA alerts still run. Ordinary PDF, static XFA and unlaid-out shells keep document scripts; static-conversion undo restores the XFA policy. Changed growable multiline text (no fixed h) reflows from final datasets after edits, with or without scripts; pages/widgets refresh and undo/redo, save/reopen and print retain all text. Oversized text still uses the existing read-only page-text fallback with a warning; fixed-height fields do not reflow. Repeated page-master buttons resolve their own PDF field to the shared XFA click script; the numPages-based print script requests printing from every copy, including after save/reopen (#2572). Rich-text exData/maxLength is carried into AcroForm MaxLen, reported by form_fields and enforced by form_fill (Unicode characters); limits and accepted values survive save/reopen (#2570). laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters (a page area with no occur repeats without limit, one with occur max=1 is used once, one with occur min=1 the body never reached gets a page after the body, as Acrobat Pro does on a synthetic form), breaks, repeated header rows, borders and fills of flowed subforms (a page break between their children gives each page's part a closed border, the margins repeated at the cut, as measured on a synthetic form in another viewer, and a child's own page break breaks them the same way; one holding an item that doesn't fit on its page, cut across pages or placed past the content area's bottom, is drawn without its border, with a layout warning), captions, rounded and inverted border corners, rich text (its http, https and mailto links clickable), JPEG/PNG/GIF/BMP/TIFF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes, radio groups, drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields, image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; usage rights the form carried (/Perms /UR3) are taken off with a note, as the layout voids them and a form with void usage rights opens with every field locked; doc_info reports xfa_layout. CLI info reports the laid-out page/field counts and dimensions while retaining the input file size and raw counts as pdf_pages/acroform_fields; text and render use those pages too, preserving copy permissions and leaving the source file unchanged (#1645). XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, formattedValue in a date display picture's pattern (number and text display pictures still give the raw value), presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. All the scripts of one event run on one thread, each in a fresh context on the form as the engine holds it then (nothing shared between scripts; the live form kept up to date in place for values, rebuilt only when the structure changed), so hundreds of calculations run within the open budget. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off, which the app says in a toast and on the notice bar, with a button to the JavaScript console, and doc_info reports as xfa_scripts_off) and what open-time scripts changed is noted. A script that fails partway keeps what it changed before the error, as JavaScript does (forms often trip over an object an earlier version had after their first lines did the work). Missing: a page area's relevant=\"-print\" (on a synthetic form Acrobat still prints the page but leaves it blank; PdfCraft prints its content, #2574); a page break before the first section (Acrobat opens an empty body page first when the first section has breakBefore targetType=pageArea, with or without startNew, as seen on synthetic forms; PdfCraft skips a break on an empty page and lays out one page fewer, #2574); loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; barcodes are drawn as their text, not bars; keep rules; text is measured at the exact standard-14 widths of the face it is drawn in (bold, italic and Times included), not in the template's own typefaces, and Acrobat fidelity is eyeballed on real forms, not measured (#60)"
+evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/it/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/it/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/engine/src/tests.rs::xfa_date_arithmetic_reads_the_date_as_its_display_picture_shows_it", "crates/automation/tests/it/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/it/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/ui-egui/tests/it/xfa.rs::a_form_whose_scripts_were_turned_off_at_open_says_so", "crates/ui-egui/tests/it/xfa.rs::scripts_turned_off_by_a_click_bring_a_closed_notice_bar_back", "crates/automation/tests/it/automation.rs::doc_info_says_when_a_runaway_script_turned_the_forms_scripts_off", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them", "crates/xfa/src/tests.rs::page_area_without_occur_serves_every_body_page", "apps/pdfcraft-cli/tests/it/xfa.rs::info_reports_the_laid_out_pages_and_fields", "apps/pdfcraft-cli/tests/it/xfa.rs::text_reads_the_layout_including_a_page_absent_from_the_placeholder", "apps/pdfcraft-cli/tests/it/xfa.rs::render_matches_the_engine_layout_on_the_second_page", "apps/pdfcraft-cli/tests/it/xfa.rs::a_laid_out_form_keeps_the_original_copy_permissions", "crates/engine/src/tests.rs::filling_growable_xfa_text_reflows_and_undo_restores_the_layout", "crates/engine/src/tests.rs::xfa_text_growth_refreshes_widget_geometry_but_fixed_height_fields_keep_their_widgets", "crates/automation/tests/it/automation.rs::growable_xfa_text_paginates_after_fill_save_and_print", "crates/engine/src/tests.rs::an_xfa_script_that_fails_partway_keeps_what_it_changed_before_the_error", "crates/engine/src/tests.rs::repeated_xfa_print_buttons_run_their_click_script", "crates/automation/tests/it/automation.rs::repeated_xfa_print_buttons_work_through_tools_and_after_reopen", "crates/xfa/src/tests.rs::rich_text_max_length_reaches_the_field_and_layout", "crates/automation/tests/it/automation.rs::xfa_rich_text_max_length_is_reported_and_enforced_through_tools", "crates/xfa/src/tests.rs::bmp_and_tiff_pictures_are_decoded_and_drawn", "crates/engine/src/tests.rs::active_xfa_does_not_run_pdf_container_scripts_but_keeps_requested_alerts", "crates/engine/src/tests.rs::active_xfa_without_template_scripts_does_not_initialize_pdf_fallback_scripts", "crates/engine/src/tests.rs::inactive_xfa_and_ordinary_pdfs_keep_document_helpers_and_alerts", "crates/automation/tests/it/automation.rs::active_xfa_skips_container_fallback_scripts_after_save_and_reopen", "crates/xfa/src/tests.rs::laying_a_form_out_takes_off_the_usage_rights_it_voids", "crates/engine/src/tests.rs::a_dynamic_xfa_form_is_saved_without_the_usage_rights_its_layout_voided", "crates/xfa/src/tests.rs::faces_measure_text_at_their_standard_14_widths", "crates/xfa/src/tests.rs::rich_text_links_keep_their_address", "crates/xfa/src/tests.rs::links_in_rich_text_become_link_annotations_one_per_line", "crates/xfa/src/tests.rs::a_links_pieces_share_one_address", "crates/xfa/src/tests.rs::a_rule_between_two_pieces_of_a_link_keeps_them_apart", "crates/xfa/src/tests.rs::links_to_anything_but_web_and_email_addresses_stay_plain_text", "crates/automation/tests/it/automation.rs::links_in_xfa_rich_text_are_listed_through_tools", "crates/xfa/src/tests.rs::rounded_corners_make_a_border_one_rounded_shape", "crates/xfa/src/tests.rs::a_rounded_box_cut_by_a_page_break_keeps_its_corners_on_each_page", "crates/xfa/src/tests.rs::rounded_boxes_are_written_as_curved_paths", "crates/xfa/src/tests.rs::a_flowed_subform_is_drawn_with_its_border_under_its_content", "crates/xfa/src/tests.rs::a_check_box_sits_where_its_margins_caption_and_alignment_put_it", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_takes_the_rest_of_the_field", "crates/xfa/src/tests.rs::a_radio_button_sits_where_a_check_box_would", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_is_measured_as_it_is_drawn", "crates/xfa/src/tests.rs::signature_fields_are_named_by_their_som_path", "crates/xfa/src/tests.rs::a_signature_on_a_laid_out_box_survives_a_new_layout"]
+notes = "Active XFA layout skips PDF-container document-script initialization for the Acrobat console/field context, so fallback-viewer scripts do not run there. Scripts remain in the file/listing; explicit console/field and XFA alerts still run. Ordinary PDF, static XFA and unlaid-out shells keep document scripts; static-conversion undo restores the XFA policy. Changed growable multiline text (no fixed h) reflows from final datasets after edits, with or without scripts; pages/widgets refresh and undo/redo, save/reopen and print retain all text. Oversized text still uses the existing read-only page-text fallback with a warning; fixed-height fields do not reflow. Repeated page-master buttons resolve their own PDF field to the shared XFA click script; the numPages-based print script requests printing from every copy, including after save/reopen (#2572). Rich-text exData/maxLength is carried into AcroForm MaxLen, reported by form_fields and enforced by form_fill (Unicode characters); limits and accepted values survive save/reopen (#2570). laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters (a page area with no occur repeats without limit, one with occur max=1 is used once, one with occur min=1 the body never reached gets a page after the body, as Acrobat Pro does on a synthetic form), breaks, repeated header rows, borders and fills of flowed subforms (a page break between their children gives each page's part a closed border, the margins repeated at the cut, as measured on a synthetic form in another viewer, and a child's own page break breaks them the same way; one holding an item that doesn't fit on its page, cut across pages or placed past the content area's bottom, is drawn without its border, with a layout warning), captions, rounded and inverted border corners, rich text (its http, https and mailto links clickable), JPEG/PNG/GIF/BMP/TIFF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes and radio groups (each box placed by its field's margins, caption and paragraph alignment as measured on two synthetic forms in another viewer: with no caption at the right of the content area, beside a reserved caption where the alignment puts it, and a caption without a reserve taking the rest of the field; a check box's own margin larger than the box draws a bigger box there, which isn't copied), drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields (each named by its SOM path, under a generated field for each step above it, so that another viewer, which lays the form out again, finds a signature made here, as seen on a synthetic form, and a box signed here keeps its signature, and that name, when a script lays the form out again; a box whose path, or a part of it, the file already gives another field keeps its own name, and its signature isn't found there yet), image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; usage rights the form carried (/Perms /UR3) are taken off with a note, as the layout voids them and a form with void usage rights opens with every field locked; doc_info reports xfa_layout. CLI info reports the laid-out page/field counts and dimensions while retaining the input file size and raw counts as pdf_pages/acroform_fields; text and render use those pages too, preserving copy permissions and leaving the source file unchanged (#1645). XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, formattedValue in a date display picture's pattern (number and text display pictures still give the raw value), presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. All the scripts of one event run on one thread, each in a fresh context on the form as the engine holds it then (nothing shared between scripts; the live form kept up to date in place for values, rebuilt only when the structure changed), so hundreds of calculations run within the open budget. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off, which the app says in a toast and on the notice bar, with a button to the JavaScript console, and doc_info reports as xfa_scripts_off) and what open-time scripts changed is noted. A script that fails partway keeps what it changed before the error, as JavaScript does (forms often trip over an object an earlier version had after their first lines did the work). Missing: a page area's relevant=\"-print\" (on a synthetic form Acrobat still prints the page but leaves it blank; PdfCraft prints its content, #2574); a page break before the first section (Acrobat opens an empty body page first when the first section has breakBefore targetType=pageArea, with or without startNew, as seen on synthetic forms; PdfCraft skips a break on an empty page and lays out one page fewer, #2574); loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; barcodes are drawn as their text, not bars; keep rules; text is measured at the exact standard-14 widths of the face it is drawn in (bold, italic and Times included), not in the template's own typefaces, and Acrobat fidelity is eyeballed on real forms, not measured (#60)"
 
 [[feature]]
 id = "form.xfa-formcalc"
@@ -5368,7 +5380,7 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.signature", "sign.fill.initials", "sign.fill.signature.change", "sign.fill.initials.change", "sign.fill.signature.remove", "sign.fill.initials.remove"]
 tools = ["fill_sign_add", "comment_edit", "comment_image_preview"]
-evidence = ["crates/ui-egui/tests/it/fill_sign.rs::drawn_signatures_resize_from_their_corners", "crates/ui-egui/tests/it/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/it/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/it/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/it/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/it/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/it/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/it/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/it/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/it/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/it/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/it/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/it/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/it/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/it/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/it/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/it/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/it/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/it/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::large_signature_images_are_scaled_down", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/it/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save", "crates/ui-egui/tests/it/fill_sign.rs::fill_and_sign_tools_pick_up_placed_marks_to_move_and_resize_them", "crates/ui-egui/tests/it/fill_sign.rs::select_tool_picks_up_a_signature_over_a_form_field", "crates/ui-egui/tests/it/fill_sign.rs::scanned_signatures_are_framed_cleaned_adjusted_placed_and_remembered", "crates/ui-egui/tests/it/fill_sign.rs::scan_cancel_errors_and_stale_answers_preserve_saved_signatures", "crates/automation/tests/it/automation.rs::scanned_signatures_through_tools_drop_the_paper_and_report_bad_arguments", "crates/engine/src/signature_scan.rs::a_photo_is_scanned_into_a_trimmed_transparent_signature_in_its_ink_colour", "crates/ui-egui/tests/it/fill_sign.rs::undo_button_and_ctrl_z_take_back_one_drawn_stroke_at_a_time", "crates/ui-egui/src/fill_sign.rs::undo_removes_the_last_stroke_and_skips_empty_ones", "crates/ui-egui/src/comments.rs::shift_keeps_the_current_proportions_unless_the_box_has_its_own"]
+evidence = ["crates/ui-egui/tests/it/fill_sign.rs::drawn_signatures_resize_from_their_corners", "crates/ui-egui/tests/it/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/it/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/it/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/tools/comments/tests.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/it/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/it/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/it/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/it/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/it/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/it/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/it/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/it/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/it/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/it/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/it/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/tools/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/it/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/it/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/it/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/it/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::large_signature_images_are_scaled_down", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/it/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save", "crates/ui-egui/tests/it/fill_sign.rs::fill_and_sign_tools_pick_up_placed_marks_to_move_and_resize_them", "crates/ui-egui/tests/it/fill_sign.rs::select_tool_picks_up_a_signature_over_a_form_field", "crates/ui-egui/tests/it/fill_sign.rs::scanned_signatures_are_framed_cleaned_adjusted_placed_and_remembered", "crates/ui-egui/tests/it/fill_sign.rs::scan_cancel_errors_and_stale_answers_preserve_saved_signatures", "crates/automation/tests/it/automation.rs::scanned_signatures_through_tools_drop_the_paper_and_report_bad_arguments", "crates/engine/src/signature_scan/tests.rs::a_photo_is_scanned_into_a_trimmed_transparent_signature_in_its_ink_colour", "crates/ui-egui/tests/it/fill_sign.rs::undo_button_and_ctrl_z_take_back_one_drawn_stroke_at_a_time", "crates/ui-egui/src/tools/fill_sign.rs::undo_removes_the_last_stroke_and_skips_empty_ones", "crates/ui-egui/src/tools/comments/tests.rs::shift_keeps_the_current_proportions_unless_the_box_has_its_own"]
 notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn (an Undo button and Ctrl/Cmd+Z in the pad take back the last stroke; Clear empties it) or imported from local PNG/JPEG images; all three are placed upright and anchored as displayed on pages with /Rotate (#299); saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; while a Fill & Sign tool is active, marks already placed are picked up as with Select (hover shows the move cursor, a click selects, a drag moves, the selected mark's handles resize) and the tool places only away from them; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; holding Shift on a corner handle keeps any resizable comment's current proportions (#2199); native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 32 megapixels and 8192 pixels per side, larger than 4 megapixels or 4096 pixels per side scaled down to fit (#1075); Scan tab (fill_sign_add scan/sensitivity headless): a phone photo of a signature on paper (PNG/JPEG within the same image limits, EXIF-oriented, kept at most 4 megapixels) is framed automatically (all words; table, sheet edge and dust ignored; a sideways signature turned upright), the frame can be moved, resized or redrawn and the photo turned in quarter turns, and an ink-sensitivity slider (0-100) controls how faint ink is kept; the paper is estimated by a morphological closing, so shadows and uneven light are removed, and the result is trimmed ink in its own colour on transparency, saved like an imported image. Still missing: perspective correction of a skewed sheet, live camera capture, keyboard control of the frame, and processing off the UI thread (bounded by the 4-megapixel working copy; quick 900 px previews while dragging)"
 
 [[feature]]
@@ -5781,7 +5793,7 @@ status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
 evidence = ["crates/redact/src/tests.rs::vectors_are_removed_or_clipped_and_inline_images_go"]
-notes = "covered paths removed, others clipped; shadings clipped"
+notes = "intersecting paths removed to avoid leaking geometry behind clipping; shadings clipped"
 
 [[feature]]
 id = "protect.redact-annots-fields"
@@ -6288,7 +6300,7 @@ milestone = "M9"
 status = "shipped"
 commands = ["sign.panel"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/signing.rs::drawing_a_signature_creating_an_id_signing_and_trusting", "crates/ui-egui/tests/it/signing.rs::certifying_without_a_visible_signature", "crates/ui-egui/src/canvas.rs::signature_badges_keep_signed_visible_widgets_on_the_page"]
+evidence = ["crates/ui-egui/tests/it/signing.rs::drawing_a_signature_creating_an_id_signing_and_trusting", "crates/ui-egui/tests/it/signing.rs::certifying_without_a_visible_signature", "crates/ui-egui/src/canvas/tests.rs::signature_badges_keep_signed_visible_widgets_on_the_page"]
 notes = "signed/valid, problems, invalid and certified bars; visible signed widgets also carry a separate viewer validation overlay. Trust and explicit validation invalidate view caches without editing document artwork; baked appearance captions remain unchanged."
 
 [[feature]]
@@ -6532,8 +6544,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["ocr.recognize"]
 tools = ["ocr_recognize", "ocr_status"]
-evidence = ["crates/engine/src/tests.rs::recognize_text_makes_a_scanned_page_searchable", "crates/automation/tests/it/automation.rs::ocr_tools_make_a_scan_searchable", "crates/ui-egui/tests/it/ocr.rs::recognize_text_dialog_adds_searchable_text"]
-notes = "ocrs engine (MIT/Apache) with CC-BY-SA models fetched by `cargo xtask models`; the desktop release packages ship them (#103; packaging/env.sh stage_models), the web build does not yet; runs on a worker thread with progress; one undoable step; pages with text are skipped unless asked (ocr.skip-renderable-text)."
+evidence = ["crates/ocr/src/lib.rs::model_discovery_prefers_the_complete_onnx_pair", "crates/ocr/src/lib.rs::model_discovery_falls_back_to_legacy_when_the_onnx_pair_is_incomplete", "crates/ocr/src/lib.rs::model_discovery_refuses_mixed_format_pairs", "crates/ocr/src/lib.rs::model_discovery_keeps_legacy_only_installations", "crates/engine/src/tests.rs::recognize_text_makes_a_scanned_page_searchable", "crates/automation/tests/it/automation.rs::ocr_tools_make_a_scan_searchable", "crates/ui-egui/tests/it/ocr.rs::recognize_text_dialog_adds_searchable_text"]
+notes = "ocrs engine (MIT/Apache) with CC-BY-SA ONNX models fetched and SHA-256 checked by `cargo xtask models`; within each search directory, a complete ONNX pair takes precedence over a complete legacy RTEN pair, incomplete and mixed-format pairs are not combined, and directory precedence is unchanged; the desktop release packages ship them (#103; packaging/env.sh stage_models), the web build does not yet; runs on a worker thread with progress; one undoable step; pages with text are skipped unless asked (ocr.skip-renderable-text)."
 
 [[feature]]
 id = "ocr.recognize-range"
@@ -7040,8 +7052,8 @@ milestone = "M10"
 status = "partial"
 commands = ["export.docx"]
 tools = ["doc_export_office"]
-evidence = ["crates/export/src/lib.rs::word_table_cell_widths_follow_the_columns_they_span", "crates/export/src/lib.rs::table_spans_do_not_consume_text_they_do_not_emit", "crates/edit/src/tests.rs::reading_keeps_dotted_leader_entries_whole_and_in_order", "crates/engine/src/tests.rs::exporting_office_keeps_dotted_leader_entries_as_paragraphs", "crates/export/src/lib.rs::word_does_not_invent_borders_for_aligned_invoice_fields", "crates/export/src/lib.rs::word_overlap_does_not_consume_invoice_body_space", "crates/export/src/lib.rs::word_keeps_a_page_with_a_clear_image_and_big_title_in_flow", "crates/export/src/lib.rs::word_rotated_pages_keep_separate_page_sizes_and_unique_shapes", "crates/engine/src/tests.rs::office_export_positions_follow_the_displayed_crop_rotation_and_units", "crates/automation/tests/it/automation.rs::exporting_an_invoice_to_word_keeps_the_watermark_out_of_flow", "crates/export/src/lib.rs::docx_is_a_word_package", "crates/export/src/lib.rs::text_colour_survives_every_format", "crates/engine/src/tests.rs::exporting_office_files_keeps_text_colour", "crates/export/src/lib.rs::grid_text_becomes_a_real_table_in_every_format", "crates/export/src/lib.rs::a_link_inside_a_sentence_is_not_a_table_column", "crates/export/src/lib.rs::sentences_that_run_on_into_links_are_not_a_table", "crates/export/src/lib.rs::a_superscript_beside_a_number_keeps_its_table", "crates/export/src/lib.rs::word_opens_text_with_control_characters_and_long_pages", "crates/engine/src/tests.rs::exporting_office_files_keeps_images", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/it/compare.rs::export_to_word_html_and_rtf", "crates/export/src/lib.rs::docx_keeps_a_shared_page_background", "crates/edit/src/tests.rs::a_page_painted_first_with_a_full_page_fill_has_that_background", "crates/engine/src/tests.rs::exporting_to_word_keeps_the_page_background"]
-notes = "Text in slots covered by a preceding table-cell span remains in paragraph flow instead of being discarded. Flowing Word document: paragraphs, Heading 1/2 from larger text, bold/italic, text colour (fill as sRGB; gray/CMYK converted naively, colour spaces via cs/sc read as black), borderless detected tables with spans/empty cells (cell widths sum the grid columns they occupy, including cells after spans, verified in the XML; a row whose blocks run on into each other, such as a link or superscript inside a sentence, or overlap, as a paragraph's lines do, is text and not a table row, #2806), per-page sections/sizes, the page colour (a full-page opaque fill painted first, such as Edit a PDF ▸ Background) as the document background when every page shares one non-white colour (Word has no per-page background, so differing colours are dropped; #2992; checked in the XML only, not yet opened in Word), and positioned editable text/artwork only for pages with rotated text or text overlapped by an image or watermark-sized text, other pages flowing with inline images (#773); synthetic invoice regression; dotted-leader contents entries keep the title, dots and page number together in separate paragraphs (#1757); the emitted package validates with Open XML SDK 2.20 (Office 2010 schema). Word/LibreOffice rendering of the positioned output remains unverified. Pictures on positioned pages are DrawingML anchors behind the text (a VML rectangle with an image showed no picture, #1936; not yet opened in Word); a Word file embeds at most 1000 pictures and 512 MiB of them. The earlier flowing output was checked with macOS textutil and opened in Microsoft Word (Windows). Characters XML forbids are dropped; the page size stays within Word's 22 in. Not yet: exact font matching, vector rules, arbitrary paint-order/transparency, colour per run within a paragraph, general exact layout fidelity."
+evidence = ["crates/export/src/tests.rs::word_table_cell_widths_follow_the_columns_they_span", "crates/export/src/tests.rs::table_spans_do_not_consume_text_they_do_not_emit", "crates/edit/src/tests.rs::reading_keeps_dotted_leader_entries_whole_and_in_order", "crates/engine/src/tests.rs::exporting_office_keeps_dotted_leader_entries_as_paragraphs", "crates/export/src/tests.rs::word_does_not_invent_borders_for_aligned_invoice_fields", "crates/export/src/tests.rs::word_overlap_does_not_consume_invoice_body_space", "crates/export/src/tests.rs::word_keeps_a_page_with_a_clear_image_and_big_title_in_flow", "crates/export/src/tests.rs::word_rotated_pages_keep_separate_page_sizes_and_unique_shapes", "crates/engine/src/tests.rs::office_export_positions_follow_the_displayed_crop_rotation_and_units", "crates/automation/tests/it/automation.rs::exporting_an_invoice_to_word_keeps_the_watermark_out_of_flow", "crates/export/src/tests.rs::docx_is_a_word_package", "crates/export/src/tests.rs::text_colour_survives_every_format", "crates/engine/src/tests.rs::exporting_office_files_keeps_text_colour", "crates/export/src/tests.rs::grid_text_becomes_a_real_table_in_every_format", "crates/export/src/tests.rs::a_link_inside_a_sentence_is_not_a_table_column", "crates/export/src/tests.rs::sentences_that_run_on_into_links_are_not_a_table", "crates/export/src/tests.rs::a_superscript_beside_a_number_keeps_its_table", "crates/export/src/tests.rs::word_opens_text_with_control_characters_and_long_pages", "crates/engine/src/tests.rs::exporting_office_files_keeps_images", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/it/compare.rs::export_to_word_html_and_rtf", "crates/export/src/tests.rs::docx_keeps_a_shared_page_background", "crates/edit/src/tests.rs::a_page_painted_first_with_a_full_page_fill_has_that_background", "crates/engine/src/tests.rs::exporting_to_word_keeps_the_page_background", "crates/export/src/tests.rs::an_italic_word_stays_in_its_sentence", "crates/export/src/tests.rs::a_sentence_keeps_its_reading_order", "crates/export/src/tests.rs::runs_keep_the_spaces_the_source_had_between_them", "crates/export/src/tests.rs::a_paragraph_is_a_heading_only_when_its_text_is", "crates/automation/tests/it/automation.rs::exporting_to_word_keeps_an_italic_word_inside_its_sentence"]
+notes = "Text in slots covered by a preceding table-cell span remains in paragraph flow instead of being discarded. Flowing Word document: paragraphs, Heading 1/2 from larger text, bold/italic, text colour (fill as sRGB; gray/CMYK converted naively, colour spaces via cs/sc read as black), borderless detected tables with spans/empty cells (cell widths sum the grid columns they occupy, including cells after spans, verified in the XML; a row whose blocks run on into each other, such as a link or superscript inside a sentence, or overlap, as a paragraph's lines do, is text and not a table row, #2806), per-page sections/sizes, the page colour (a full-page opaque fill painted first, such as Edit a PDF ▸ Background) as the document background when every page shares one non-white colour (Word has no per-page background, so differing colours are dropped; #2992; checked in the XML only, not yet opened in Word), and positioned editable text/artwork only for pages with rotated text or text overlapped by an image or watermark-sized text, other pages flowing with inline images (#773); synthetic invoice regression; dotted-leader contents entries keep the title, dots and page number together in separate paragraphs (#1757); the emitted package validates with Open XML SDK 2.20 (Office 2010 schema). Word/LibreOffice rendering of the positioned output remains unverified. Pictures on positioned pages are DrawingML anchors behind the text (a VML rectangle with an image showed no picture, #1936; not yet opened in Word); a Word file embeds at most 1000 pictures and 512 MiB of them. The earlier flowing output was checked with macOS textutil and opened in Microsoft Word (Windows). Characters XML forbids are dropped; the page size stays within Word's 22 in. A block that continues another on its line (an italic case name, a link, a superscript) is a run in its own size, bold/italic and colour inside that paragraph, keeping the source's word space between them, rather than a paragraph of its own; a lead-in in bold no longer makes its whole line a heading (#4158). Not yet: a style change that wraps onto the next line still splits its paragraph there (the reading blocks keep style boundaries, #4158), exact font matching, vector rules, arbitrary paint-order/transparency, general exact layout fidelity."
 
 [[feature]]
 id = "create.export-rtf"
@@ -7052,8 +7064,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.rtf"]
 tools = ["doc_export_office"]
-evidence = ["crates/export/src/lib.rs::table_spans_do_not_consume_text_they_do_not_emit", "crates/export/src/lib.rs::rtf_escapes_and_sizes", "crates/export/src/lib.rs::text_colour_survives_every_format", "crates/export/src/lib.rs::word_opens_text_with_control_characters_and_long_pages", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/it/compare.rs::export_to_word_html_and_rtf"]
-notes = "Text in slots covered by a preceding table-cell span remains in paragraph flow instead of being discarded. Paragraphs with sizes, bold, italic, text colour (colortbl), Unicode; page breaks. Images are left out."
+evidence = ["crates/export/src/tests.rs::table_spans_do_not_consume_text_they_do_not_emit", "crates/export/src/tests.rs::rtf_escapes_and_sizes", "crates/export/src/tests.rs::text_colour_survives_every_format", "crates/export/src/tests.rs::word_opens_text_with_control_characters_and_long_pages", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/it/compare.rs::export_to_word_html_and_rtf"]
+notes = "Text in slots covered by a preceding table-cell span remains in paragraph flow instead of being discarded. Paragraphs with sizes, bold, italic, text colour (colortbl), Unicode; a block that continues another on its line is a formatted group inside that paragraph (#4158), though a style change that wraps onto the next line still splits it; page breaks. Images are left out."
 
 [[feature]]
 id = "create.export-xlsx"
@@ -7076,18 +7088,18 @@ milestone = "M10"
 status = "partial"
 commands = ["export.pptx"]
 tools = ["doc_export_office"]
-evidence = ["crates/export/src/lib.rs::table_spans_do_not_consume_text_they_do_not_emit",
-    "crates/export/src/pptx.rs::pptx_is_a_presentationml_package",
-    "crates/export/src/pptx.rs::pptx_slide_has_title_body_and_images_in_order",
-    "crates/export/src/pptx.rs::pptx_text_colour_and_formatting",
-    "crates/export/src/pptx.rs::pptx_empty_pages_produce_valid_slide",
-    "crates/export/src/pptx.rs::pptx_slide_dimensions_and_clamping",
-    "crates/export/src/pptx.rs::pptx_table_cell_with_largest_font_stays_in_table_and_not_in_title",
-    "crates/export/src/pptx.rs::pptx_opens_in_libreoffice",
-    "crates/export/src/pptx.rs::pptx_package_parts_are_complete_and_consistent",
-    "crates/export/src/pptx.rs::hostile_sizes_do_not_overflow_the_slide_position",
-    "crates/export/src/lib.rs::grid_text_becomes_a_real_table_in_every_format",
-    "crates/export/src/lib.rs::text_colour_survives_every_format",
+evidence = ["crates/export/src/tests.rs::table_spans_do_not_consume_text_they_do_not_emit",
+    "crates/export/src/pptx/tests.rs::pptx_is_a_presentationml_package",
+    "crates/export/src/pptx/tests.rs::pptx_slide_has_title_body_and_images_in_order",
+    "crates/export/src/pptx/tests.rs::pptx_text_colour_and_formatting",
+    "crates/export/src/pptx/tests.rs::pptx_empty_pages_produce_valid_slide",
+    "crates/export/src/pptx/tests.rs::pptx_slide_dimensions_and_clamping",
+    "crates/export/src/pptx/tests.rs::pptx_table_cell_with_largest_font_stays_in_table_and_not_in_title",
+    "crates/export/src/pptx/tests.rs::pptx_opens_in_libreoffice",
+    "crates/export/src/pptx/tests.rs::pptx_package_parts_are_complete_and_consistent",
+    "crates/export/src/pptx/tests.rs::hostile_sizes_do_not_overflow_the_slide_position",
+    "crates/export/src/tests.rs::grid_text_becomes_a_real_table_in_every_format",
+    "crates/export/src/tests.rs::text_colour_survives_every_format",
     "crates/engine/src/tests.rs::exporting_office_files_keeps_images",
     "crates/engine/src/tests.rs::exporting_office_files_keeps_text_colour",
     "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf",
@@ -7152,7 +7164,7 @@ milestone = "M10"
 status = "partial"
 commands = ["export.html"]
 tools = ["doc_export_office"]
-evidence = ["crates/export/src/lib.rs::table_spans_do_not_consume_text_they_do_not_emit", "crates/export/src/lib.rs::html_has_headings_paragraphs_and_images_in_order", "crates/export/src/lib.rs::text_colour_survives_every_format", "crates/export/src/lib.rs::grid_text_becomes_a_real_table_in_every_format", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/it/compare.rs::export_to_word_html_and_rtf", "crates/automation/tests/it/automation.rs::exporting_office_files_says_which_pages_left_form_text_out", "crates/edit/src/tests.rs::reading_follows_forms_as_far_as_the_renderer_and_says_where_it_stops"]
+evidence = ["crates/export/src/tests.rs::table_spans_do_not_consume_text_they_do_not_emit", "crates/export/src/tests.rs::html_has_headings_paragraphs_and_images_in_order", "crates/export/src/tests.rs::text_colour_survives_every_format", "crates/export/src/tests.rs::grid_text_becomes_a_real_table_in_every_format", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/it/compare.rs::export_to_word_html_and_rtf", "crates/automation/tests/it/automation.rs::exporting_office_files_says_which_pages_left_form_text_out", "crates/edit/src/tests.rs::reading_follows_forms_as_far_as_the_renderer_and_says_where_it_stops"]
 notes = "Text in slots covered by a preceding table-cell span remains in paragraph flow instead of being discarded. Single HTML file with headings, paragraphs (with text colour), inline images, and detected tables with spans/empty cells. Text and images in form XObjects are read 50 levels deep, as the renderer does, and up to 50 000 forms a page; the tool lists pages past that in truncated_pages, with a warning (#3120). Not yet: multi-page folder output, CSS from fonts."
 
 [[feature]]
@@ -7260,7 +7272,7 @@ milestone = "M2"
 status = "shipped"
 commands = []
 tools = ["text_extract"]
-evidence = ["crates/render/src/text.rs::rtl_runs_come_out_in_logical_order_and_cjk_has_no_spaces", "crates/render/src/text.rs::lines_words_and_search", "crates/automation/tests/it/automation.rs::parallel_text_extraction_keeps_page_order_and_follows_edits"]
+evidence = ["crates/render/src/text/tests.rs::rtl_runs_come_out_in_logical_order_and_cjk_has_no_spaces", "crates/render/src/text/tests.rs::lines_words_and_search", "crates/automation/tests/it/automation.rs::parallel_text_extraction_keeps_page_order_and_follows_edits"]
 notes = ""
 
 [[feature]]
@@ -7324,7 +7336,7 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/automation/tests/it/optimize_content_boundaries.rs::fragment_merge_preserves_a_comment_across_content_pieces", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/ui-egui/src/optimize_ui.rs::the_progress_card_shows_the_stage_and_cancels", "crates/engine/src/tests.rs::an_optimize_job_reports_its_stages_and_can_be_cancelled", "crates/optimize/tests/optimize.rs::images_and_forms_nothing_draws_are_dropped", "crates/automation/tests/it/automation.rs::a_deleted_image_is_not_kept_by_reduce_or_optimize", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_picks_a_preset", "crates/automation/tests/it/automation.rs::a_page_printed_in_strips_gets_small_through_tools", "crates/optimize/tests/optimize.rs::the_mobile_preset_makes_a_printed_page_small"]
+evidence = ["crates/automation/tests/it/optimize_content_boundaries.rs::fragment_merge_preserves_a_comment_across_content_pieces", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/ui-egui/src/workflows/optimize_ui.rs::the_progress_card_shows_the_stage_and_cancels", "crates/engine/src/tests.rs::an_optimize_job_reports_its_stages_and_can_be_cancelled", "crates/optimize/tests/optimize.rs::images_and_forms_nothing_draws_are_dropped", "crates/automation/tests/it/automation.rs::a_deleted_image_is_not_kept_by_reduce_or_optimize", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_picks_a_preset", "crates/automation/tests/it/automation.rs::a_page_printed_in_strips_gets_small_through_tools", "crates/optimize/tests/optimize.rs::the_mobile_preset_makes_a_printed_page_small"]
 notes = "Settings menu with the Standard and Mobile presets (Custom once an option changes; doc_optimize preset), Images (with Merge image fragments: a page picture drawn as one-pixel strips, as some PDF printers write it, is put back together so it can be resampled), Discard Objects, Discard User Data, Clean Up (also drops images and forms the pages list but never draw, such as deleted images); runs in the background with a progress bar (per image) and Cancel; no Fonts or Transparency panels, no saved custom presets, no space audit"
 
 [[feature]]
@@ -7661,7 +7673,7 @@ status = "shipped"
 commands = ["optimize.advanced"]
 tools = ["doc_audit_space"]
 evidence = ["crates/optimize/tests/optimize.rs::space_audit_shares_the_file_out_by_kind", "crates/optimize/tests/optimize.rs::space_audit_counts_what_fields_and_comments_draw_with_by_kind", "crates/optimize/tests/optimize.rs::space_audit_survives_deeply_nested_forms", "crates/automation/tests/it/automation.rs::auditing_space_through_tools", "crates/ui-egui/tests/it/viewer.rs::optimizer_audits_space_usage", "crates/ui-egui/tests/it/viewer.rs::space_audit_numbers_line_up_under_their_headers"]
-notes = "PDF Optimizer ▸ Audit space usage: what the file's bytes are spent on now (not what optimizing would save), in 16 categories (images, content streams, fonts, X Object forms, structure, bookmarks, thumbnails, comments, forms, named destinations, colour spaces, shadings, patterns, graphics states, embedded files, overhead) with bytes and percentages. Resources are counted by kind wherever they are used, so the fonts and images form fields and comments draw with count as fonts and images. Still missing: sizes are each object as it would be written uncompressed, so objects packed in compressed object streams count larger than they take on disk (overhead, the rest of the file, shrinks to match)"
+notes = "PDF Optimizer ▸ Audit space usage, and Document Properties ▸ Space Audit: what the file's bytes are spent on now (not what optimizing would save), in 16 categories (images, content streams, fonts, X Object forms, structure, bookmarks, thumbnails, comments, forms, named destinations, colour spaces, shadings, patterns, graphics states, embedded files, overhead) with bytes and percentages. Resources are counted by kind wherever they are used, so the fonts and images form fields and comments draw with count as fonts and images. Still missing: sizes are each object as it would be written uncompressed, so objects packed in compressed object streams count larger than they take on disk (overhead, the rest of the file, shrinks to match)"
 
 [[feature]]
 id = "optimize.optimizer-presets"
@@ -8000,7 +8012,7 @@ milestone = "M10"
 status = "shipped"
 commands = ["print.dialog"]
 tools = ["doc_print", "printers"]
-evidence = ["crates/ui-egui/tests/it/print.rs::paper_choice_survives_cancel_and_settings_restore", "crates/ui-egui/tests/it/print.rs::restored_paper_keeps_preview_and_saved_sheet_dimensions", "crates/ui-egui/tests/it/print.rs::print_dialog_lays_out_sheets_and_saves_a_pdf", "crates/engine/src/tests.rs::printing_lays_out_sheets_that_render", "crates/ui-egui/src/web_print.rs::a_job_draws_every_sheet_at_its_planned_resolution_then_builds_the_page", "crates/ui-egui/src/web_print.rs::the_print_page_turns_sideways_sheets_names_other_sizes_and_ends_without_a_blank_page", "crates/print/src/tests.rs::every_paper_reaches_the_spooler_by_a_name_of_its_size", "crates/automation/src/printing.rs::printing_to_a_printer_feeds_the_laid_out_paper"]
+evidence = ["crates/ui-egui/tests/it/print.rs::paper_choice_survives_cancel_and_settings_restore", "crates/ui-egui/tests/it/print.rs::restored_paper_keeps_preview_and_saved_sheet_dimensions", "crates/ui-egui/tests/it/print.rs::print_dialog_lays_out_sheets_and_saves_a_pdf", "crates/engine/src/tests.rs::printing_lays_out_sheets_that_render", "crates/ui-egui/src/workflows/web_print.rs::a_job_draws_every_sheet_at_its_planned_resolution_then_builds_the_page", "crates/ui-egui/src/workflows/web_print.rs::the_print_page_turns_sideways_sheets_names_other_sizes_and_ends_without_a_blank_page", "crates/print/src/tests.rs::every_paper_reaches_the_spooler_by_a_name_of_its_size", "crates/automation/src/printing.rs::printing_to_a_printer_feeds_the_laid_out_paper"]
 notes = "⌘P; settings and live sheet preview; on the web the same dialog prints through the browser's print dialog; last paper selection, including cancelled Print dialogs, persists by canonical name; this change does not alter persistence of other print preferences. CUPS jobs from the dialog and doc_print ask for the chosen paper (media) in every size: PPD keywords for the common ones, PWG 5101.1 names for A6, A0–A2, ARCH and ANSI C–E, checked against a synthetic PPD with cupsfilter, not on a physical large-format printer (#3752). On macOS jobs still take the PPD's default paper tray until craft-print sends Auto Select (#3752)"
 
 [[feature]]
@@ -8012,7 +8024,7 @@ milestone = "M10"
 status = "shipped"
 commands = ["print.dialog"]
 tools = ["printers", "printer_options", "doc_print"]
-evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list", "crates/print/src/tests.rs::driverless_printers_join_the_list_without_a_queue", "crates/print/src/tests.rs::windows_printers_carry_one_default_and_keep_their_names", "crates/print/src/tests.rs::printer_options_come_from_the_ppd", "crates/print/src/tests.rs::printer_option_defaults_and_job_arguments", "crates/ui-egui/tests/it/print.rs::print_dialog_shows_the_printer_driver_options", "crates/ui-egui/tests/it/print.rs::printers_listed_in_the_background_preselect_the_default_unless_one_was_picked", "crates/ui-egui/src/web_print.rs::resolution_falls_with_the_sheet_count_and_long_jobs_are_refused", "crates/ui-egui/src/web_print.rs::large_sheets_are_drawn_within_the_pixel_cap_and_bad_sizes_are_refused", "crates/ui-egui/src/web_print.rs::a_sink_error_or_a_page_that_isnt_there_stops_the_job", "crates/print/src/tests.rs::a_command_that_never_answers_is_stopped_at_the_deadline", "crates/ui-egui/tests/it/print.rs::printer_options_are_read_off_the_gui_thread_and_a_dead_read_offers_nothing"]
+evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list", "crates/print/src/tests.rs::driverless_printers_join_the_list_without_a_queue", "crates/print/src/tests.rs::windows_printers_carry_one_default_and_keep_their_names", "crates/print/src/tests.rs::printer_options_come_from_the_ppd", "crates/print/src/tests.rs::printer_option_defaults_and_job_arguments", "crates/ui-egui/tests/it/print.rs::print_dialog_shows_the_printer_driver_options", "crates/ui-egui/tests/it/print.rs::printers_listed_in_the_background_preselect_the_default_unless_one_was_picked", "crates/ui-egui/src/workflows/web_print.rs::resolution_falls_with_the_sheet_count_and_long_jobs_are_refused", "crates/ui-egui/src/workflows/web_print.rs::large_sheets_are_drawn_within_the_pixel_cap_and_bad_sizes_are_refused", "crates/ui-egui/src/workflows/web_print.rs::a_sink_error_or_a_page_that_isnt_there_stops_the_job", "crates/print/src/tests.rs::a_command_that_never_answers_is_stopped_at_the_deadline", "crates/ui-egui/tests/it/print.rs::printer_options_are_read_off_the_gui_thread_and_a_dead_read_offers_nothing"]
 notes = "CUPS queues via lpstat -p -d and driverless destinations without a queue via lpstat -e; on Windows shared craft-print lists the queues (EnumPrinters), the default (GetDefaultPrinter) and each driver's two-sided support in this process, and draws jobs as vectors with Windows.Data.Pdf into the XPS print API with a driver-validated PrintTicket (exact paper, orientation, no scaling; portrait and landscape sheets in one job via /Rotate), starting no PowerShell, so printing works under App Control script enforcement (#1107); the printer list and submission run on workers; Save as PDF on every platform. Properties…: on CUPS the driver's own PPD job options (tray, paper type, finishing …, not installable options or what the dialog sets) for this job, sent as lp -o; on Windows the driver's Printing Preferences window (printui), saved as that printer's per-user defaults rather than per job. On the web: \"Browser's print dialog\" (the default there) reaches the system's printers through the browser; PdfCraft draws the sheets itself (300 dpi up to 100 sheets, 200 up to 300, 150 up to 1,000; at most 64 megapixels a sheet and 1 GiB a job) and prints them from a hidden iframe, one per printed page, a landscape sheet among portrait ones turned onto the paper; copies, two-sided and colour are chosen in the browser's dialog; a browser that refuses to print gets the print-ready PDF as a download. Checked in headless Chromium, not yet in Firefox or Safari; pictures, not vectors; sheets of another paper size print at their own size only where the browser honours named @page sizes (Chromium doesn't). Properties… on CUPS reads the driver options off the GUI thread and gives lpoptions ten seconds before the PPD defaults stand (#1818)"
 
 [[feature]]
@@ -8084,7 +8096,7 @@ milestone = "M10"
 status = "shipped"
 commands = ["print.dialog"]
 tools = ["doc_print"]
-evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list", "crates/ui-egui/src/print_ui.rs::two_sided_follows_the_printer_until_chosen", "crates/automation/src/printing.rs::duplex_printer_leaves_two_sided_to_the_printer"]
+evidence = ["crates/print/src/tests.rs::spooler_arguments_and_printer_list", "crates/ui-egui/src/workflows/print_ui.rs::two_sided_follows_the_printer_until_chosen", "crates/automation/src/printing.rs::duplex_printer_leaves_two_sided_to_the_printer"]
 notes = "long/short edge via the spooler: lp -o sides=…, and the Windows driver's Duplex setting. Two-sided starts at Printer default, as in Acrobat: nothing is sent, so the printer's own default (its Properties) applies until Off or an edge is chosen (doc_print: duplex \"printer\"). Missing: the document's /ViewerPreferences /Duplex preset isn't read yet"
 
 [[feature]]
@@ -8472,8 +8484,8 @@ milestone = "M3"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/control.rs::inspect_and_click_by_label_and_id"]
-notes = "AccessKit labels on all custom widgets; full audit in M14.3"
+evidence = ["crates/ui-egui/tests/it/control.rs::inspect_and_click_by_label_and_id", "crates/ui-egui/tests/it/viewer.rs::the_accessible_window_has_the_window_title_as_its_name"]
+notes = "AccessKit labels on all custom widgets; the accessible window is named with the window title and follows it (#4614); full audit in M14.3"
 
 [[feature]]
 id = "a11y.keyboard-only"
@@ -9168,7 +9180,7 @@ milestone = "M12"
 status = "shipped"
 commands = []
 tools = ["view_reading_colors"]
-evidence = ["crates/automation/tests/it/automation.rs::reading_colors_through_tools", "crates/render/src/raster.rs::reading_colors_map_solid_paints_and_leave_images", "crates/render/src/raster.rs::reading_colors_tiles_match_full_render", "crates/render/src/raster.rs::print_preview_requests_render_with_reading_colors_off", "crates/render/src/raster.rs::reading_colors_keep_highlight_annotations_readable", "crates/ui-egui/tests/it/reading_colors.rs::reading_colours_preference_round_trips", "crates/ui-egui/tests/it/reading_colors.rs::reading_colours_seed_on_open", "crates/ui-egui/tests/it/reading_colors.rs::pending_pages_use_document_reading_background"]
+evidence = ["crates/automation/tests/it/automation.rs::reading_colors_through_tools", "crates/render/src/raster/tests.rs::reading_colors_map_solid_paints_and_leave_images", "crates/render/src/raster/tests.rs::reading_colors_tiles_match_full_render", "crates/render/src/raster/tests.rs::print_preview_requests_render_with_reading_colors_off", "crates/render/src/raster/tests.rs::reading_colors_keep_highlight_annotations_readable", "crates/ui-egui/tests/it/reading_colors.rs::reading_colours_preference_round_trips", "crates/ui-egui/tests/it/reading_colors.rs::reading_colours_seed_on_open", "crates/ui-egui/tests/it/reading_colors.rs::pending_pages_use_document_reading_background"]
 notes = "View only, off by default: Preferences ▸ Reading colours holds the app-wide preference, seeded into every document as it opens (including created ones), and view_reading_colors reads and sets it per document (Acrobat's Replace Document Colors). Solid text paints and, by default, line-art paints (including stencil-mask image paints) are remapped by luminance — each lerps between the preset's text and background colour by how dark or light the original paint is — while images, shadings and tiling patterns pass through untouched. Annotations keep the colours they were given (both /AP appearances and the no-/AP Highlight fallback), so a Multiply highlight over a dark background shows the marked-up words in the highlight's colour instead of a flat bar that hides them (#1548). Presets: black on white, white on black, yellow on black, green on black, or a custom #RRGGBB pair; only_black limits the mapping to near-black paints (a 10% luminance threshold — our choice; Acrobat's was not observed). Display only: the document is not changed and print and export are unaffected; print previews and view snapshots render with the document's true colours (a preview matches the uncoloured printout, and a snapshot is an export surface), so reading colours apply to the reading view only. Pending canvas pages use the configured reading background before their raster arrives (#2059). Closes #897 (duplicate #488)."
 
 [[feature]]
@@ -10000,8 +10012,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/commands.rs::localized_shortcut_labels_follow_language_and_platform", "crates/ui-egui/src/i18n/mod.rs::keyboard_key_names_have_a_separate_context_and_english_fallback", "crates/ui-egui/tests/it/commands.rs::localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::arabic_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::arabic_lookups_are_in_display_order", "crates/ui-egui/src/i18n/mod.rs::arabic_plurals_follow_the_six_cldr_forms", "crates/ui-egui/src/i18n/mod.rs::arabic_labels_have_glyphs", "crates/ui-egui/src/bidi.rs::rtl_labels_keep_placeholders_whole", "crates/ui-egui/tests/it/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/it/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/it/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/it/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/it/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::spanish_keeps_the_holes_in_what_the_engine_says", "crates/print/src/tests.rs::wordings_are_said", "crates/ui-egui/src/i18n/mod.rs::norwegian_bokmal_is_registered_and_persists"]
-notes = "Shortcut modifiers and key names use a dedicated catalog context across toolbar, menus, palette, Help and tooltips, with English fallback and macOS symbols preserved. Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian/Italian/Arabic/Norwegian Bokmål and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk|it|ar|nb and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Brazilian Portuguese covers the current union of catalog keys, including signature and accessibility messages; Czech remains limited to menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one, and Norwegian locales (nb, nb_NO, and no/nn until a Nynorsk catalog exists) the Bokmål one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. The sentences the layers below word for themselves (accessibility findings and the saved report, PDF/A problems, signature details, page-range mistakes, edit labels) are handed over apart from the document's own values and go through the catalog too, through said(&i18n::words); Spanish, Italian and Brazilian Portuguese translate them, Polish the signature details and the changes after signing; strings absent from other catalogs fall back to English. OS error details, and faults rather than mistakes, stay as they are. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Arabic (ar and every ar-* locale) covers commands, dialogs and panels with the six CLDR plural forms; its labels are put into display order when the catalog loads, because egui joins Arabic letters but lays words out left to right. Missing: a right-to-left layout (Arabic labels sit in the left-to-right layout, a wrapped Arabic paragraph breaks at the wrong end, and text typed into a field is not reordered), Czech dialogs, Chinese and Telugu font delivery in releases (the pinned craft-fonts revision has an Arabic face; its Noto Sans CJK SC is too large to embed whole), the engine's sentences in the other catalogs, a full localization audit."
+evidence = ["crates/ui-egui/src/commands.rs::localized_shortcut_labels_follow_language_and_platform", "crates/ui-egui/src/i18n/tests.rs::keyboard_key_names_have_a_separate_context_and_english_fallback", "crates/ui-egui/tests/it/commands.rs::localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings", "crates/ui-egui/src/i18n/tests.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/tests.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/tests.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/tests.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/tests.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/tests.rs::arabic_is_registered_and_persists", "crates/ui-egui/src/i18n/tests.rs::arabic_catalog_stays_logical", "crates/ui-egui/src/i18n/tests.rs::arabic_plurals_follow_the_six_cldr_forms", "crates/ui-egui/src/i18n/tests.rs::arabic_labels_have_glyphs", "crates/ui-egui/src/bidi/tests.rs::arabic_ui_labels_use_an_explicit_paragraph_direction", "crates/ui-egui/src/theme/tests.rs::arabic_chrome_is_right_to_left_after_the_language_changes", "crates/ui-egui/tests/it/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/it/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/it/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/it/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/tests.rs::french_is_registered", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/it/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/tests.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/tests.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/tests.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/tests.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/tests.rs::spanish_keeps_the_holes_in_what_the_engine_says", "crates/print/src/tests.rs::wordings_are_said", "crates/ui-egui/src/i18n/tests.rs::norwegian_bokmal_is_registered_and_persists"]
+notes = "Shortcut modifiers and key names use a dedicated catalog context across toolbar, menus, palette, Help and tooltips, with English fallback and macOS symbols preserved. Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian/Italian/Arabic/Norwegian Bokmål and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk|it|ar|nb and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Brazilian Portuguese covers the current union of catalog keys, including signature and accessibility messages; Czech remains limited to menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one, and Norwegian locales (nb, nb_NO, and no/nn until a Nynorsk catalog exists) the Bokmål one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. The sentences the layers below word for themselves (accessibility findings and the saved report, PDF/A problems, signature details, page-range mistakes, edit labels) are handed over apart from the document's own values and go through the catalog too, through said(&i18n::words); Spanish, Italian and Brazilian Portuguese translate them, Polish the signature details and the changes after signing; strings absent from other catalogs fall back to English. OS error details, and faults rather than mistakes, stay as they are. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Arabic (ar and every ar-* locale) covers commands, dialogs and panels with the six CLDR plural forms. Catalogs stay logical and egui 0.37's epaint applies UAX #9 reordering; Arabic and Kurdish labels take an explicit right-to-left paragraph direction and stock chrome is mirrored through Style::right_to_left. Missing: native and browser end-to-end RTL input, IME and complex bidirectional workflows are not yet qualified; Czech dialogs, Chinese and Telugu font delivery (native release builds embed LXGW WenKai Lite for Simplified Chinese, while the web build has no Chinese face beyond BIZ UDPGothic and the release-pinned craft-fonts has no Telugu face), the engine's sentences in the other catalogs, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"
@@ -10132,8 +10144,8 @@ milestone = "M14"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::date_languages_are_the_interface_languages", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language"]
-notes = "The UI offers 22 non-English catalogs plus English fallback (entry counts vary by language), and the selected language persists. Partial because the languages are not all usable yet: Chinese shows tofu in releases (#826, #688), the release-pinned craft-fonts has no Telugu face, Arabic is not mirrored (misc.rtl-ui), and strings missing from a catalog fall back to English (localization-parity.md). The language can be set through the UI control channel (`set language`) but not through an automation tool, so pdfcraft-cli run and MCP cannot change it."
+evidence = ["crates/ui-egui/src/i18n/tests.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/tests.rs::date_languages_are_the_interface_languages", "crates/ui-egui/src/i18n/tests.rs::language_persists_and_invalid_input_keeps_current_language"]
+notes = "The UI offers 22 non-English catalogs plus English fallback (entry counts vary by language), and the selected language persists. Partial because the languages are not all usable yet: Simplified Chinese has a native release LXGW WenKai Lite face but the web build has no Hans face (#826, #688), the release-pinned craft-fonts has no Telugu face, Arabic labels stay logical with explicit right-to-left direction and mirrored stock chrome while native/browser/IME RTL workflows are not yet qualified (misc.rtl-ui), and strings missing from a catalog fall back to English (localization-parity.md). The language can be set through the UI control channel (`set language`) but not through an automation tool, so pdfcraft-cli run and MCP cannot change it."
 
 [[feature]]
 id = "misc.rtl-ui"
@@ -10145,7 +10157,7 @@ status = "planned"
 commands = []
 tools = []
 evidence = []
-notes = "Only a first step exists: Arabic and Hebrew file names and paths in the tab strip, the recent-files list and Properties have glyphs (a craft-fonts Arab face, or an installed font on desktop) and are shown in display order (crates/ui-egui/src/bidi.rs). Missing: multi-line text (bookmarks, comments, search results), text input, a mirrored layout and a right-to-left interface language."
+notes = "Implemented and unit-tested: Arabic and Hebrew file names and paths in the tab strip, the recent-files list and Properties have glyphs (a craft-fonts Arab face, or an installed font on desktop), keep logical text and are laid out left to right so the extension stays at the visual end; Arabic and Kurdish interface labels use an explicit right-to-left paragraph direction and stock chrome mirrors through Style::right_to_left (crates/ui-egui/src/bidi.rs, theme.rs); catalogs are never preordered. Still not qualified: native and browser end-to-end RTL input, IME composition, clipboard/selection and complex multi-line RTL workflows. Status stays planned until those workflows are accepted."
 
 [[feature]]
 id = "misc.installers"
diff --git a/vendor/README.md b/vendor/README.md
index 2d5a90fdbd..20fb0c75a8 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -1,5 +1,27 @@
 # Vendored crates
 
+## Window-stack provenance after the egui 0.37 migration
+
+The checked-in, resolved Cargo graph pins `winit` to storytold/winit
+`a517b3846ee8457d84ee4975110bfda6797c44dc` and the egui crates to storytold/egui
+`6d518fc799681571963842f95b55a6b68431b15a`. Neither `vendor/winit` nor
+`vendor/egui-wgpu` is a root `[patch.crates-io]` path entry. The retained copies
+record the app's earlier patches; their source-reading tests establish provenance,
+while the resolved forks and their behavioral tests establish runtime behavior.
+
+The retained winit copy has upstream base `e9809ef54b18499bb4f2cac945719ecc2a61061b`,
+as recorded in `vendor/winit/.cargo_vcs_info.json`. Its thirteen patch rows below
+match the fork's `PATCHES.md` entries W1–W13 commit for commit (W1 `b357a332`,
+W2 `13ca693b`, W3 `fd104a4c`, W4 `3fffb7ce`, W5 `283370ce`, W6 `a82b90fb`,
+W7 `9b90d5bd`, W8 `6a87addd`, W9 `9500f25d`, W10 `4a7dd791`, W11 `4df8554b`,
+W12 `7facf001`, W13 `5506b1a9`). The reviewed winit fork additionally carries
+W14–W27 (W14 is opt-in and is not enabled by PdfCraft). `vendor/egui-wgpu` carries
+E2 (`surface_fit`) and E3 (`catch_errors`); the egui-wgpu 0.37 fork retains both,
+including its `surface_fit` tests exercised by PdfCraft's behavioral tests.
+
+Keep both copies while their provenance tests remain in use. Renderer and security
+vendors below retain their independent path patches and licenses.
+
 Permissively licensed crates we carry small patches for. Each directory keeps the upstream
 licence files unchanged. Every patch is marked `PdfCraft patch:` in the source, is covered by a
 PdfCraft test, and should be proposed upstream. Remove the vendored copy once upstream releases
@@ -17,17 +39,24 @@ Other resource categories retain their existing parent-chain lookup.
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it; (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::text_rendering_modes_other_than_invisible_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours` |; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret) |
-| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour, planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated, axis-aligned image is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 at the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat); (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group; under reading colours its background is painted inside it as the initial backdrop, so a Multiply highlight blends with the dark background instead of staying an opaque block, and otherwise the background stays outside, so a blend mode over an empty part of the page keeps its colour instead of blending with the white paper (#2970); (19) `set_paint` samples a mesh shading's texture over its triangles alone (`EncodedShadingPattern::extent`, padded rather than repeated) and skips a mesh with none on the canvas: a BricsCAD plan's 310 one-triangle `sh` each covered the whole tile, 2 s per 1024 px tile at any zoom (the watchdog gave the page up on a busy machine), now about 70 ms; (20) a tiling pattern whose step is too large for a cell pixmap, where what is painted (a fill, or a stroke with its width) can only show the first cell (PowerPoint's `/XStep 2147480100` for a picture fill drawn once), has its `/BBox` drawn at full scale with a transparent border and padded instead of tiled (`shows_one_cell`; a cell whose scale isn't finite and positive, from a `/BBox` too thin to divide by, keeps the old path: `usable_cell_scale`); shrinking the cell to fit the 3000 px limit of (3) left the picture under a pixel, so network diagrams lost their pictures (#3349); (22) knockout groups: while one is innermost, fills, strokes, glyph outlines and shadings are drawn with `Compose::Copy` (weighted by coverage), so each element replaces what earlier elements of the group drew instead of compositing over it; an image or nested group, drawn into a layer of its own, first has what is under its shape cleared (`knockout_image` for an unmasked image's rectangle, only when `draw_image` will draw it, decoded at the size it is drawn; a knockout erase pass that draws a nested group's content with every paint clearing instead of painting, a shading fill's clear clipped to the shading's `/BBox` as its paint is) and then composites over it (#2971); (23) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_samples_the_same_columns`, `raster::tests::non_integer_minification_samples_colour_and_mask_from_the_same_columns`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (19) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (20) `raster::tests::a_tiling_pattern_drawn_once_shows_its_cell`, `raster::tests::a_large_step_still_tiles_where_the_next_cell_shows`, `raster::tests::a_tiling_cell_too_thin_to_scale_keeps_the_old_path` |; (22) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients` |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it (`7 Tr` since follows 64); (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it; (64) text in a Type 3 font follows ISO 32000-2 §9.3.6 in the clipping modes: under `7 Tr` it is not rendered (reported to the device as clipping text, `GlyphDrawMode::Clip`, so extraction keeps it), and in modes 4 to 7 a Type 3 glyph adds nothing to the clipping path (`clip_glyph`), so text shown only in a Type 3 font leaves no clip at `ET`. Since (42) `7 Tr` painted the glyphs in the fill colour (black by default), so a fill meant to follow showed them wherever it didn't cover them; 4 to 6 still render filled; (66) a Separation colour space whose colourant is the special name `All` paints every colourant at once (ISO 32000-2 §8.6.6.4): on screen and in an RGB print raster its tint t is the gray 1 − t, complemented because the device is additive, whatever its alternate space and tint transform say (hayro drew it through the tint transform, so a `/DeviceCMYK` transform giving cyan drew registration marks light cyan); `/None` still paints nothing, any other name still goes through its alternate, and a DeviceN space naming `All` keeps its alternate, since the clause gives the name that meaning in a Separation space; (63) a luminosity soft mask whose group colour space is `/DeviceCMYK` (by name, not an ICC-based or calibrated space) reads a `/DeviceCMYK` fill or stroke colour drawn in it, and its `/BC`, as their gray `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)` (ISO 32000-2 §10.4.2.3, §11.5.3: device colour converts to gray with no colour calibration; `Context::luminosity_in_device_cmyk`, `color::device_cmyk_to_gray`): it went through the CMYK display profile, where 100% K is a dark grey, so a 100% K mask let about an eighth of the masked paint through. CMYK images, shadings and tiling patterns inside such a mask, and CMYK on the page, still use the profile | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret); (64) `type3_text_clip::{clip_only_type3_text_is_not_rendered_and_leaves_no_clip, invisible_type3_text_is_not_rendered, other_modes_render_type3_glyphs_filled_and_never_clip, only_outline_glyphs_shape_a_clip_shared_with_type3_text, self_nesting_type3_text_in_a_clip_mode_stays_bounded}` (`cargo test -p pdfcraft-render --test it`), `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`, `text::tests::clipping_mode_type3_text_is_kept_by_the_ocr_filter`; (66) `separation_all::{separation_all_fills_paint_the_complemented_tint_as_gray, separation_all_strokes_paint_the_complemented_tint_as_gray, separation_all_images_paint_each_sample_as_the_complemented_gray, separation_all_shadings_paint_the_complemented_gray, separation_none_paints_nothing, a_named_separation_still_paints_through_its_alternate, a_device_n_space_naming_all_still_paints_through_its_alternate}` (`cargo test -p pdfcraft-render --test it`); (63) `color::device_cmyk_gray_tests::{each_ink_darkens_by_its_iso_weight, ink_past_full_coverage_is_black_and_bad_components_read_as_zero}` (hayro-interpret), `it::luminosity_group_space::{black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully, each_process_ink_in_a_device_cmyk_group_masks_by_its_weight, a_device_cmyk_backdrop_colour_masks_by_its_gray, gray_and_rgb_groups_mask_as_before, device_cmyk_on_the_page_keeps_its_display_colour}` (pdfcraft-render) |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour, planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated, axis-aligned image is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 at the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat); (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group; under reading colours its background is painted inside it as the initial backdrop, so a Multiply highlight blends with the dark background instead of staying an opaque block, and otherwise the background stays outside, so a blend mode over an empty part of the page keeps its colour instead of blending with the white paper (#2970); (19) `set_paint` samples a mesh shading's texture over its triangles alone (`EncodedShadingPattern::extent`, padded rather than repeated) and skips a mesh with none on the canvas: a BricsCAD plan's 310 one-triangle `sh` each covered the whole tile, 2 s per 1024 px tile at any zoom (the watchdog gave the page up on a busy machine), now about 70 ms; (20) a tiling pattern whose step is too large for a cell pixmap, where what is painted (a fill, or a stroke with its width) can only show the first cell (PowerPoint's `/XStep 2147480100` for a picture fill drawn once), has its `/BBox` drawn at full scale with a transparent border and padded instead of tiled (`shows_one_cell`; a cell whose scale isn't finite and positive, from a `/BBox` too thin to divide by, keeps the old path: `usable_cell_scale`); shrinking the cell to fit the 3000 px limit of (3) left the picture under a pixel, so network diagrams lost their pictures (#3349); (22) knockout groups: while one is innermost, fills, strokes, glyph outlines and shadings are drawn with `Compose::Copy` (weighted by coverage), so each element replaces what earlier elements of the group drew instead of compositing over it; an image or nested group, drawn into a layer of its own, first has what is under its shape cleared (`knockout_image` for an unmasked image's rectangle, only when `draw_image` will draw it, decoded at the size it is drawn; a knockout erase pass that draws a nested group's content with every paint clearing instead of painting, a shading fill's clear clipped to the shading's `/BBox` as its paint is) and then composites over it (#2971); (23) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres; (25) a tiling cell is drawn at the scale that makes one `/XStep` (`/YStep`) exactly the cell pixmap's whole number of pixels (`tiling_cell_pixels`, at least 1 and at most the cap), so the repeated pixmap puts cells at whole multiples of the step at any device scale; drawing at the unrounded scale repeated the cell up to half a pixel off at every step, and the error grew with distance from the pattern's origin (ISO 32000-2 8.7.3.1) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_samples_the_same_columns`, `raster::tests::non_integer_minification_samples_colour_and_mask_from_the_same_columns`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (19) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (20) `raster::tests::a_tiling_pattern_drawn_once_shows_its_cell`, `raster::tests::a_large_step_still_tiles_where_the_next_cell_shows`, `raster::tests::a_tiling_cell_too_thin_to_scale_keeps_the_old_path`; (22) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (25) `tiling_cell_placement::{far_cells_of_a_fill_sit_at_whole_steps, far_cells_sit_at_whole_steps_under_a_turned_scaled_matrix, far_cells_of_a_stroke_sit_at_whole_steps, a_cell_pixmap_spans_exactly_one_step}` (`cargo test -p pdfcraft-render --test it`) |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer); (4) a segment header's long-form referred-to segment count is capped at `u16::MAX` and a larger count is refused before its retention or referred-to bytes are read: the 29-bit count went straight to `Vec::with_capacity`, a reservation of about 2 GiB whose failure aborts the process (from storytold/craft-libs#176) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate`; (4) `segment::tests::test_referred_to_count_is_capped` (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`) |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order; (6) `find_latest_trailer`: a rebuild takes a `/Type /XRef` stream dictionary as the trailer when the file has no `trailer` keyword (the latest in the file wins, as a later `trailer` would), so a concatenated or truncated file keeps its /Info and /ID instead of failing to load; a candidate whose /Root is the catalog beats one whose /Root is another dictionary, and an in-file /Root must match its generation (#2365) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace`; (6) `inspect::tests::rebuilt_file_keeps_the_info_of_its_cross_reference_stream`, `inspect::tests::rebuilt_file_prefers_a_trailer_whose_root_is_the_catalog` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); an EI followed by a delimiter (EI%..., EI[...) ends the image like one followed by white space; only a regular character after EI skips the candidate; (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW, RunLength and ASCII85 never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it.; (17) CCITT `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11), not zero rows: scanned Group 4 pages written that way rendered blank; (18) The streaming Flate decoder (`lzw_flate::flate::fallback`) copies a back-reference in runs of up to its distance (`extend_from_within`), not byte by byte. The copy reads only bytes already in the output, and a copy whose source does not exist still writes nothing, so the bytes are those a byte-by-byte copy writes. Inflating the A1 sample's content stream (278.6 MB) takes about 14% less time (0.66 s to 0.56 s); the output is identical; (19) CCITT `/Rows` below the image's `/Height` decodes to the height: a plotter driver wrote `/Rows` equal to `/Columns`, so only the first rows were decoded and the rest drawn black (#3308) (20) `stream` followed by spaces or tabs and then the line break (`stream \r\n`, as Microsoft Reporting Services writes it) starts the data after the line break; the content stream was taken to start at the space and the page rendered blank.; (21) a JP2 colour specification naming an enumerated colour space the decoder refuses (CIEJab in a veraPDF fixture, YCbCr, PhotoYCC, YPbPr, bilevel…) no longer fails the image: it is decoded again from a copy whose `colr` names the space the decoder assumes without one, greyscale, sRGB or CMYK by component count, as MuPDF and Poppler draw it (`without_refused_enumerated_colour`; the page drew blank, #3306); (22) an object stream's index of `objnum offset` pairs is parsed once per stream and kept beside its decoded data (`ObjectStreamIndexes`, `XRef::with_object_stream_indexes`), and an offset past `usize` is malformed instead of wrapping: `XRef::get_with` parsed the whole index again for every object it fetched from the stream, so reading all of a stream of N objects took N² steps (a Firefox page whose 65,542 objects share one stream took 37 s to draw and 40 s to extract its text); (23) the inline-image end-of-data look-ahead no longer rejects a candidate `EI` because a byte above 0x7F lies between it and the next one: when the candidate is the end, those bytes are the content stream that follows the image, and its strings carry such bytes (WinAnsi `(Grüße) Tj`, the two-byte codes of any Type 0 font), so the operator check that follows decides alone, bounded as in (4) (a scanned page whose OCR text held an accented word and a later capital "EI" — EINGANG, BEI, KLEIN — drew and extracted nothing after the image: 40 of 275 pages across five real documents); (24) `xref::prev_offset`: a trailer `/Prev` written as a reference `N G R` is read as the offset that object holds when the section's own entries place it (iText's `indirectPrev.pdf`; each section's entries are read before its `Prev` is followed), and otherwise as offset N (tiff2pdf; JHOVE's PDF-HUL-157 files, #2366), as `pdfcraft-cos` and other readers take it, so the earlier sections' pages are seen instead of one; (25) direct arrays and dictionaries share a reader-local nesting cap of 128, counted while skipping and while parsing a dictionary (its lenient repair reads, rather than skips, an object found where a key belongs, so `<< << …` recursed through that read); deeper objects return `None` instead of overflowing the stack (including unused trailer values, trailer entries, content operands and marked-content properties); a chain of 65 direct stitching functions now stops at this cap, before the 64-function guard; (26) an xref stream subsection must be backed by its decoded data: all-zero `/W` widths (an entry reads no bytes) and a declared count longer than the data are refused before any entry is inserted, where a tiny stream with a large `/Size` or `/Index` count inserted that many entries (from storytold/craft-libs#239); a subsection running past object number `i32::MAX` is refused instead of overflowing or turning negative; (27) an xref stream's type field is read big-endian at its full `/W[0]` width, where only its first byte was read and wider fields shifted every later entry, and `/W[0]` over 8 bytes is refused like `/W[1]` (from storytold/craft-libs#241); (28) a content instruction keeps up to 256 operands (`MAX_OPERANDS`) instead of 10, and past that drops the oldest instead of ending the content stream: the eleventh operand of a twelve-ink DeviceN `scn` (ISO 32000-2 §8.6.6.5 allows any number of components) blanked the rest of the page (#4260) | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`, `content::tests::inline_image_ei_may_be_followed_by_a_delimiter`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`; (17) `raster::tests::group4_fax_with_rows_zero_decodes_to_the_image_height`; (18) `filter::lzw_flate::tests::back_reference_longer_than_its_distance_repeats_its_source`, `back_reference_cut_by_the_limit_resumes_in_the_next_call` and `back_reference_reads_bytes_written_by_an_earlier_call`; each fails when the copy returns the wrong remaining count; (19) `raster::tests::group4_fax_with_rows_below_its_height_decodes_to_the_image_height`; (20) `raster::tests::space_before_the_line_break_after_stream_still_renders`; (21) `raster::tests::a_jp2_image_in_a_refused_enumerated_colour_space_is_drawn`, `filter::jpx::tests::refused_enumerated_colour_spaces_become_the_component_counts_default`, `filter::jpx::tests::what_the_decoder_handles_or_cant_be_read_is_left_alone` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (22) `raster::tests::objects_in_one_large_object_stream_are_read_in_linear_time`; (23) `text::tests::text_after_an_inline_image_survives_a_non_ascii_byte_before_a_later_ei`, `content::tests::an_inline_image_ends_at_its_own_ei_when_later_text_holds_a_non_ascii_byte` (hayro-syntax); (24) `xref::tests::prev_as_reference_reaches_the_earlier_section`, `xref::tests::prev_as_reference_to_an_object_holding_the_offset_reads_that_offset`, `pdfcraft-cos` `document::tests::a_prev_written_as_a_reference_still_reaches_the_earlier_sections`, `document::tests::a_prev_reference_to_an_object_holding_the_offset_reads_that_offset`; (25) `raster::tests::deeply_nested_direct_objects_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap`, `raster::tests::nesting_at_the_cap_fits_a_512_kib_stack` (native only), `raster::tests::function_limits_depth_guard_refuses_a_chain_of_references`; (26) `xref::tests::xref_stream_entries_need_backing_bytes`; (27) `xref::tests::xref_stream_type_field_uses_the_full_w0_width`, `xref::tests::xref_stream_loader_rejects_oversized_w0` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (28) `content::ops::tests::scn_with_twelve_components_keeps_them_all`, `content::ops::tests::operands_past_the_cap_keep_the_latest_in_order` (hayro-syntax), `raster::tests::devicen_inks::a_twelve_ink_devicen_colour_paints`, `raster::tests::devicen_inks::a_four_ink_devicen_colour_paints`, `raster::tests::devicen_inks::an_operator_with_hundreds_of_operands_does_not_end_the_content` |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. (2) on Wayland, a seat's text input is destroyed when the seat goes away, not whenever it loses a capability: losing any capability (a touch screen or tablet unplugged, a remote-desktop session ending) destroyed it, and only an added capability recreated it, so IME stopped working until restart. Port of [winit#4747](https://github.com/rust-windowing/winit/pull/4747); (3) on Windows, an IME composition reports its cursor from `GCS_CURSORPOS` only when `WM_IME_COMPOSITION` says it is set, and at the end of the composition otherwise: the Microsoft Korean IME never sets it, so the cursor read as 0 (egui then drew no caret while composing; it now draws it after the syllable). Port of [winit#4746](https://github.com/rust-windowing/winit/pull/4746); (4) on Windows, a hidden window is not maximized until it is shown, and a hidden window shown while maximized gets one `ShowWindow(SW_MAXIMIZE)`: `SW_MAXIMIZE` shows a hidden window, so PdfCraft, which eframe keeps hidden until its first frame is drawn, appeared unpainted (white) when it restored a maximized window, and could lose its focus. Port of [winit#4587](https://github.com/rust-windowing/winit/pull/4587) (the later, focus-safe form of [winit#4575](https://github.com/rust-windowing/winit/pull/4575)); (5) on X11, when allowing or disallowing IME replaces the focused window's input context (egui does it each time a text field gains or loses focus), the new context is focused: no focus event follows, so it stayed unfocused until the window lost and regained focus. Port of [winit#4727](https://github.com/rust-windowing/winit/pull/4727); (6) on macOS, `insertText` commits through IME when a composition was started (`pending_commit`, set by `setMarkedText`) rather than when marked text is left: input methods that end a composition with `unmarkText` before `insertText` lost the text, and Apple Korean dropped the key typed after a syllable (`한` then `5` or `;`); other `insertText` calls stay `KeyboardInput`; a commit outside a key press (a candidate clicked with the mouse, dictation) clears the marked text and leaves no key to swallow, as in [winit#4748](https://github.com/rust-windowing/winit/pull/4748) (without it the next key, such as Backspace, was lost). `validAttributesForMarkedText` lists the underline and marked-clause attributes, without which some input methods don't compose. Port of [winit#4650](https://github.com/rust-windowing/winit/pull/4650), the 0.30 backport of [winit#4651](https://github.com/rust-windowing/winit/pull/4651) (merged on winit master), with the underline attribute spelled as AppKit's `NSUnderlineStyleAttributeName` (`NSUnderline`); (7) on macOS, disallowing IME with a composition in progress (focus leaving a text field) tells the input method to discard its marked text (`discardMarkedText`): it kept composing it once IME was allowed again, so the abandoned syllable came back (`하`, then `가` typed in the next field, became `학`, then `하` + `가`; Japanese `か` then `さ` became `傘`). Port of [winit#4745](https://github.com/rust-windowing/winit/pull/4745); (8) on macOS, text inserted outside a key press without a composition (the emoji picker) is reported as `Ime::Commit`; it was dropped. Port of the emoji-picker part of [winit#4749](https://github.com/rust-windowing/winit/pull/4749) (0.30 backport of [winit#4748](https://github.com/rust-windowing/winit/pull/4748)); its `selectedRange` change for dictation is left out because it switches on press-and-hold for every held key (an accent menu instead of key repeat, and the chosen accent added after the repeated letters); (9) on macOS, a key whose text was committed through IME isn't also sent as `KeyboardInput` unless AppKit forwards it as a command (Enter): Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`, `insertText(" ")`, `setMarkedText("")`, and the last call reset winit's state, so the space arrived twice. Same goal as [winit#4478](https://github.com/rust-windowing/winit/pull/4478), whose changes don't reach this call order (macOS 14); to be proposed upstream there; (10) on macOS, when the first key in a fresh app reaches Apple Korean's `insertText` as a raw compatibility jamo instead of starting a composition, that key is interpreted once more, synchronously, before it is sent as `KeyboardInput` (g k s typed ㅎㅏㄴ instead of 한); only an unmodified, non-repeated first key whose one callback inserts that same jamo, with IME enabled and nothing composed, focus and input source unchanged, is retried (`ime_startup.rs`). Port of [winit#4744](https://github.com/rust-windowing/winit/pull/4744), with its policy tests.; (11) on X11 without `Xft.dpi`, the scale factor comes from the X screen's configured DPI (its size in pixels and millimetres) before the output's physical density from RandR: Xorg can deliberately run a dense panel at 96 DPI, and only winit applications then looked zoomed; `Xft.dpi` still wins, `WINIT_X11_SCALE_FACTOR` still overrides, and a screen reporting no size keeps the RandR fallback. PdfCraft patch (#1150, replacing the launcher pin proposed in #908). (12) on macOS, `WinitView` answers `mouseDownCanMoveWindow` with the window's `movable_by_window_background` attribute (NO unless asked): NSView answers YES for a view that isn't opaque, so with the transparent title bar and full-size content view PdfCraft uses, AppKit moved the window for any drag that began in the 28 pt title-bar band before the app saw it, and document tabs (which live in that band) could not be dragged to reorder them. The empty strip still moves the window through `ViewportCommand::StartDrag`. PdfCraft patch. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build; (13) on Wayland, pixel-only wheel, wheel-tilt and continuous-source scroll events report `Moved` rather than starting an unterminated finger gesture, so egui follows modifier release instead of keeping Ctrl zoom latched (#991). Finger gestures and unknown sources retain their existing phase policy | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11; (2) `pdfcraft` `tests/winit_wayland_text_input.rs`; the capability change itself needs a Wayland session and an input method; (3) `pdfcraft` `tests/winit_windows_ime_cursor.rs`; composing itself needs the Microsoft Korean IME; (4) `pdfcraft` `tests/winit_windows_hidden_maximized.rs`; the start-up itself needs Windows and a window that was closed maximized; (5) `pdfcraft` `tests/winit_x11_ime_focus.rs`; switching fields itself needs an X11 session and an input method (IBus, fcitx5); (6) `pdfcraft` `tests/winit_macos_ime_commit.rs`; composing itself needs macOS and an input method; (7) `pdfcraft` `tests/winit_macos_ime_discard.rs`; composing itself needs macOS and an input method; (8) `pdfcraft` `tests/winit_macos_emoji_picker.rs`; the picker itself needs macOS; (9) `pdfcraft` `tests/winit_macos_korean_space.rs`; composing itself needs macOS and Apple Korean; (10) `pdfcraft` `tests/winit_macos_korean_first_key.rs` and `ime_startup.rs`'s own tests (run them with `rustc --test`); typing itself needs macOS and Apple Korean; (11) `pdfcraft` `tests/winit_x11_dpi.rs` keeps the patch in the build, and `util::randr` tests the policy (run them in the vendored crate); the scale itself needs an X11 session; (12) `pdfcraft` `tests/winit_macos_title_bar_drag.rs` keeps the patch in the build; the drag itself needs macOS and a pointer; (13) `pdfcraft` `tests/winit_wayland_scroll.rs` compiles the production phase policy and exercises modifier release through egui; live COSMIC confirmation remains open |
-| egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::egui_wgpu_carries_the_surface_size_fit`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::egui_wgpu_returns_a_surface_it_cannot_configure_as_an_error`, which keeps it around `add_surface`'s configure |
+| egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::vendor_provenance_egui_wgpu_surface_fit_identity`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::vendor_provenance_egui_wgpu_catch_errors_identity`, which keeps it around `add_surface`'s configure |
 | vello_common | 0.0.8 | Apache-2.0 OR MIT | (1) `clip::intersect` (the clip step every clipped path passes through) starts its row walk at the first row both paths have strips in, not the earlier of the two first rows. The walk visited every row from the top of the clip for each path (on the A1 sample's full-page canvas, about half its strip rows per stroke), and rows where one path has no strips produce no output, so the strips are unchanged (vello_common 0.1 starts at the later row too). Its cost grew with the page, and a full-page render of the A1 sample was about 30% faster; the output is byte-identical | (1) `clip::tests::intersect_walks_only_rows_both_paths_have_strips` counts the rows the walk visits (`cargo test --manifest-path vendor/vello_common/Cargo.toml`) and fails without the patch; the render crate's pixel tests run through the patched crate |
 | hayro-cmap | 0.1.0 | Apache-2.0 OR MIT | (1) malformed parts of a CMap (bad bfchar/bfrange entries, unresolvable `usecmap`, unparseable tail) are skipped instead of discarding the whole map, so search and redaction find text the edit layer can read (#3177); (2) a binary CMap's `usecmap` counts against the 16-level nesting limit as a text one does, where it passed its own depth and a self-referencing binary CMap recursed until the stack overflowed (from storytold/craft-libs#254) | (1) `hayro-cmap::tests::bad_bfchar_entry_is_skipped`, `unresolvable_usecmap_is_skipped`; (2) `tests::self_referencing_binary_usecmap_stops_at_the_nesting_limit` |
 | hayro-postscript | 0.1.0 | Apache-2.0 OR MIT | (1) the token scanner's `object::read` skips `<<` and `>>` in a loop; it called itself once per delimiter, so a CMap stream holding a long run of `<` or `>` overflowed the stack and aborted the process (from storytold/craft-libs#263) | (1) `hayro-postscript::object::tests::long_open_dict_run_does_not_overflow`, `long_close_dict_run_does_not_overflow`, `dict_delimiters_are_skipped`, `nested_dict_delimiters_are_skipped` |
 
+`hayro-postscript` is the crates.io 0.1.0 package plus patch (1). The local Cargo
+registry cache metadata for that package (`.cargo_vcs_info.json`) records upstream
+VCS commit `a2354aebaf86f5ab13e5fd6b6b0521306488bf9d`. The registry copy and this vendored tree's
+source files differ only in `src/object.rs` (the patch above); the vendored tree
+omits the registry dotfiles `.cargo_vcs_info.json` and `.cargo-ok`, so the upstream
+commit is recorded here.
+
 Renderer startup errors: `egui-wgpu::RenderState::create` also wraps `Renderer::new` in
 `winit::catch_errors` when the winit feature is enabled. A rejected shader or render pipeline
 is returned as `WgpuError::CreateRenderer`, allowing PdfCraft's existing startup OpenGL retry.
diff --git a/vendor/hayro-interpret/src/color.rs b/vendor/hayro-interpret/src/color.rs
index c0f2da16f3..531e3b01c9 100644
--- a/vendor/hayro-interpret/src/color.rs
+++ b/vendor/hayro-interpret/src/color.rs
@@ -391,6 +391,13 @@ impl ColorSpace {
         matches!(self.0.as_ref(), ColorSpaceType::DeviceGray)
     }
 
+    // PdfCraft patch (63).
+    /// Whether this is `/DeviceCMYK` itself, not an ICC-based or default colour space that
+    /// stands in for it.
+    pub(crate) fn is_device_cmyk(&self) -> bool {
+        matches!(self.0.as_ref(), ColorSpaceType::DeviceCmyk)
+    }
+
     /// Get the number of components of the color space.
     pub(crate) fn num_components(&self) -> u8 {
         match self.0.as_ref() {
@@ -1050,6 +1057,8 @@ pub(crate) struct Separation {
     /// `eval_tint_transform`).
     tint_transform: Option<Function>,
     is_none_separation: bool,
+    /// PdfCraft patch (66): the colourant is the special name `All`.
+    is_all: bool,
 }
 
 /// PdfCraft patch (55): `tint_transform` run on the tints of one colour, or, when it cannot be
@@ -1080,20 +1089,33 @@ impl Separation {
         // PdfCraft patch (55): an unreadable tint transform keeps the space (see
         // `eval_tint_transform`).
         let tint_transform = iter.next::<Object<'_>>().and_then(|f| Function::new(&f));
-        // Either I did something wrong, or no other viewers properly handles
-        // `All`, so let's just ignore it as well.
         let is_none_separation = name.as_str() == "None";
+        // PdfCraft patch (66): `All` names every colourant of the output device at once
+        // (ISO 32000-2 §8.6.6.4), so its tints never go through the alternate space.
+        let is_all = name.as_str() == "All";
 
         Some(Self {
             alternate_space,
             tint_transform,
             is_none_separation,
+            is_all,
         })
     }
 }
 
 impl ToRgb for Separation {
     fn convert_f32(&self, input: &[f32], output: &mut [u8], _: bool) -> Option<()> {
+        if self.is_all {
+            // PdfCraft patch (66): §8.6.6.4: the tint applies to every colourant, and on an
+            // additive device it is complemented first, so tint t is the gray 1 − t on each of
+            // R, G and B whatever the alternate space and tint transform say.
+            for (tint, rgb) in input.iter().zip(output.chunks_exact_mut(3)) {
+                // `clamp` keeps NaN, and `f32_to_u8`'s cast saturates it to 0.
+                let gray = f32_to_u8(1.0 - tint.clamp(0.0, 1.0));
+                rgb.copy_from_slice(&[gray, gray, gray]);
+            }
+            return Some(());
+        }
         count_tint_transform_runs(input.len());
         // PdfCraft patch (55): see `eval_tint_transform`.
         let evaluated = input
@@ -1327,6 +1349,18 @@ fn f32_to_u8(val: f32) -> u8 {
     (val * 255.0 + 0.5) as u8
 }
 
+// PdfCraft patch (63).
+/// The `/DeviceCMYK` to `/DeviceGray` conversion of ISO 32000-2 §10.4.2.3,
+/// `gray = 1.0 - min(1.0, 0.3 c + 0.59 m + 0.11 y + k)`, which §11.5.3 also gives for the
+/// luminosity of a soft mask whose group is in `/DeviceCMYK`. A missing component counts as
+/// zero, and each component is clamped to `[0, 1]` first (`NaN` and infinities read as zero).
+pub(crate) fn device_cmyk_to_gray(cmyk: &[f32]) -> f32 {
+    let component = |i: usize| clamp_component(cmyk.get(i).copied().unwrap_or(0.0), 0.0, 1.0);
+    let ink = 0.3 * component(0) + 0.59 * component(1) + 0.11 * component(2) + component(3);
+    // Every component is in [0, 1], so `ink` is not negative and the result is in [0, 1].
+    1.0 - ink.min(1.0)
+}
+
 /// Clamp an input-derived colour component to `[lo, hi]` without panicking on
 /// NaN or on a reversed range. Non-finite values map to zero.
 fn clamp_component(value: f32, lo: f32, hi: f32) -> f32 {
@@ -1435,3 +1469,36 @@ pub(crate) trait ToRgb {
         ))
     }
 }
+
+#[cfg(test)]
+mod device_cmyk_gray_tests {
+    use super::device_cmyk_to_gray;
+
+    fn assert_close(cmyk: &[f32], expected: f32) {
+        let got = device_cmyk_to_gray(cmyk);
+        assert!(
+            (got - expected).abs() < 1e-5,
+            "{cmyk:?}: gray {got}, expected {expected}"
+        );
+    }
+
+    #[test]
+    fn each_ink_darkens_by_its_iso_weight() {
+        assert_close(&[0.0, 0.0, 0.0, 0.0], 1.0);
+        assert_close(&[0.0, 0.0, 0.0, 1.0], 0.0);
+        assert_close(&[0.0, 0.0, 0.0, 0.5], 0.5);
+        assert_close(&[1.0, 0.0, 0.0, 0.0], 0.7);
+        assert_close(&[0.0, 1.0, 0.0, 0.0], 0.41);
+        assert_close(&[0.0, 0.0, 1.0, 0.0], 0.89);
+        assert_close(&[0.5, 0.5, 0.5, 0.25], 0.25);
+    }
+
+    #[test]
+    fn ink_past_full_coverage_is_black_and_bad_components_read_as_zero() {
+        assert_close(&[1.0, 1.0, 1.0, 1.0], 0.0);
+        assert_close(&[0.0, 0.0, 0.0, 1.5], 0.0);
+        assert_close(&[2.0, -1.0, f32::NAN, f32::INFINITY], 0.7);
+        assert_close(&[], 1.0);
+        assert_close(&[0.0, 0.0], 1.0);
+    }
+}
diff --git a/vendor/hayro-interpret/src/context.rs b/vendor/hayro-interpret/src/context.rs
index 1b1655dcd4..ff178b25b9 100644
--- a/vendor/hayro-interpret/src/context.rs
+++ b/vendor/hayro-interpret/src/context.rs
@@ -173,6 +173,11 @@ pub struct Context<'a> {
     /// a limit was reached, the clip count to return to at its `Q`.
     saved_bytes: usize,
     skipped_saves: Vec<usize>,
+    // PdfCraft patch (63).
+    /// This is the content of a luminosity soft mask whose group colour space is `/DeviceCMYK`,
+    /// so a `/DeviceCMYK` fill or stroke colour paints as its gray (ISO 32000-2 §11.5.3,
+    /// §10.4.2.3) rather than through the CMYK profile used for display.
+    pub(crate) luminosity_in_device_cmyk: bool,
 }
 
 /// PdfCraft patch: most graphics states saved at once. Every `q` copies the current state, dash
@@ -251,6 +256,7 @@ impl<'a> Context<'a> {
             nesting_depth,
             saved_bytes: 0,
             skipped_saves: Vec::new(),
+            luminosity_in_device_cmyk: false,
         }
     }
 
diff --git a/vendor/hayro-interpret/src/interpret/path.rs b/vendor/hayro-interpret/src/interpret/path.rs
index c1fd47f395..a08a60e3bd 100644
--- a/vendor/hayro-interpret/src/interpret/path.rs
+++ b/vendor/hayro-interpret/src/interpret/path.rs
@@ -1,4 +1,4 @@
-use crate::color::{Color, ColorSpace};
+use crate::color::{Color, ColorSpace, device_cmyk_to_gray};
 use crate::context::{Context, path_as_rect};
 use crate::device::Device;
 use crate::util::{BezPathExt, Float32Ext};
@@ -169,7 +169,13 @@ pub(crate) fn get_paint<'a>(context: &Context<'a>, is_stroke: bool) -> Paint<'a>
             Paint::Color(Color::new(ColorSpace::device_gray(), smallvec![0.0], 0.0))
         }
     } else {
-        let color = Color::new(data.color_space, data.color, data.alpha);
+        // PdfCraft patch (63): see `Context::luminosity_in_device_cmyk`.
+        let color = if context.luminosity_in_device_cmyk && data.color_space.is_device_cmyk() {
+            let gray = device_cmyk_to_gray(&data.color);
+            Color::new(ColorSpace::device_gray(), smallvec![gray], data.alpha)
+        } else {
+            Color::new(data.color_space, data.color, data.alpha)
+        };
 
         if let Some(tf) = &data.transfer_function {
             Paint::Color(Color::from_rgba(tf.apply(&color.to_rgba())))
diff --git a/vendor/hayro-interpret/src/interpret/text.rs b/vendor/hayro-interpret/src/interpret/text.rs
index cd5e147f9b..b7b1b2a2b7 100644
--- a/vendor/hayro-interpret/src/interpret/text.rs
+++ b/vendor/hayro-interpret/src/interpret/text.rs
@@ -69,11 +69,15 @@ pub(crate) fn show_glyph<'a>(
     device.set_blend_mode(ctx.get().graphics_state.blend_mode);
     let stroke_props = ctx.stroke_props();
 
-    // PdfCraft patch: only mode 3 has any effect on text in a Type 3 font (ISO 32000-1
-    // 9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts
-    // look bold, and the clip modes have no outline to clip with.
+    // PdfCraft patch: text in a Type 3 font is rendered from its glyph descriptions in every mode
+    // but 3 and 7 (ISO 32000-2 §9.3.6). Stroking ran the glyph procedure a second time, so
+    // `2 Tr` made bitmap fonts look bold.
+    // PdfCraft patch (64): in modes 3 and 7 the text "shall not be rendered" (§9.3.6); `7 Tr`
+    // painted the glyphs in the fill colour. It is still reported as clipping text, but in
+    // modes 4 to 7 "nothing shall be added to the clipping path" (`clip_glyph`).
     let render_mode = match (glyph, ctx.get().text_state.render_mode) {
         (Glyph::Type3(_), TextRenderingMode::Invisible) => TextRenderingMode::Invisible,
+        (Glyph::Type3(_), TextRenderingMode::Clip) => TextRenderingMode::Clip,
         (Glyph::Type3(_), _) => TextRenderingMode::Fill,
         (_, mode) => mode,
     };
@@ -187,9 +191,9 @@ pub(crate) fn clip_glyph(context: &mut Context<'_>, glyph: &Glyph<'_>, transform
                 context.get_mut().text_state.clip_paths.extend(outline);
             }
         }
-        Glyph::Type3(_) => {
-            warn!("text rendering mode clip not implemented for shape glyphs");
-        }
+        // PdfCraft patch (64): a Type 3 glyph adds nothing to the clipping path in modes 4 to 7
+        // (ISO 32000-2 §9.3.6), so text shown only in a Type 3 font leaves no clip at `ET`.
+        Glyph::Type3(_) => {}
     }
 }
 
diff --git a/vendor/hayro-interpret/src/soft_mask.rs b/vendor/hayro-interpret/src/soft_mask.rs
index 4d97d565b5..1cd60a17e9 100644
--- a/vendor/hayro-interpret/src/soft_mask.rs
+++ b/vendor/hayro-interpret/src/soft_mask.rs
@@ -1,4 +1,4 @@
-use crate::color::{Color, ColorComponents, ColorSpace};
+use crate::color::{Color, ColorComponents, ColorSpace, DeviceFamily, device_cmyk_to_gray};
 use crate::context::{Context, InterpreterCache};
 use crate::device::Device;
 use crate::function::Function;
@@ -59,6 +59,9 @@ struct Repr<'a> {
     transfer_function: Option<TransferFunction>,
     settings: InterpreterSettings,
     background: Color,
+    // PdfCraft patch (63).
+    /// A luminosity mask whose group colour space is `/DeviceCMYK`.
+    luminosity_in_device_cmyk: bool,
     xref: &'a XRef,
     nesting_depth: u32,
 }
@@ -107,10 +110,17 @@ impl<'a> SoftMask<'a> {
         // PdfCraft patch: the group's /CS is optional (ISO 32000-2 §11.6.5.2; Chrome/Skia omit
         // it). Upstream returned None here, silently dropping the whole soft mask. Fall back to
         // DeviceRGB, the blending space our renderer composites in.
-        let cs = group
+        let cs_object = group
             .dict
             .get::<Dict<'_>>(GROUP)
-            .and_then(|g| g.get::<Object<'_>>(CS))
+            .and_then(|g| g.get::<Object<'_>>(CS));
+        // PdfCraft patch (63): the group is composited in `/DeviceCMYK` itself. An ICC-based
+        // or calibrated group space keeps its own conversion.
+        let group_in_device_cmyk = cs_object
+            .as_ref()
+            .and_then(DeviceFamily::of_object)
+            .is_some_and(|family| family == DeviceFamily::Cmyk);
+        let cs = cs_object
             .and_then(|o| ColorSpace::new(o, &context.interpreter_cache.object_cache))
             .unwrap_or_else(ColorSpace::device_rgb);
         let transfer_function = dict
@@ -121,7 +131,19 @@ impl<'a> SoftMask<'a> {
             LUMINOSITY => {
                 let color = dict
                     .get::<ColorComponents>(BC)
-                    .map(|c| Color::new(cs, c, 1.0))
+                    .map(|c| {
+                        // PdfCraft patch (63): a DeviceCMYK backdrop's luminosity is its gray
+                        // (ISO 32000-2 §11.5.3), as for the group's content.
+                        if group_in_device_cmyk && c.len() == 4 {
+                            Color::new(
+                                ColorSpace::device_gray(),
+                                smallvec![device_cmyk_to_gray(&c)],
+                                1.0,
+                            )
+                        } else {
+                            Color::new(cs, c, 1.0)
+                        }
+                    })
                     .unwrap_or(Color::new(ColorSpace::device_gray(), smallvec![0.0], 1.0));
 
                 (MaskType::Luminosity, color)
@@ -157,6 +179,7 @@ impl<'a> SoftMask<'a> {
             settings: context.settings.clone(),
             xref: context.xref,
             background,
+            luminosity_in_device_cmyk: group_in_device_cmyk && mask_type == MaskType::Luminosity,
             parent_resources,
             nesting_depth,
         })))
@@ -174,6 +197,7 @@ impl<'a> SoftMask<'a> {
             state,
             self.0.nesting_depth,
         );
+        ctx.luminosity_in_device_cmyk = self.0.luminosity_in_device_cmyk;
         draw_form_xobject(&self.0.parent_resources, &self.0.group, &mut ctx, device);
     }
 
diff --git a/vendor/hayro/src/lib.rs b/vendor/hayro/src/lib.rs
index a5ce6c2a94..37d1a5b078 100644
--- a/vendor/hayro/src/lib.rs
+++ b/vendor/hayro/src/lib.rs
@@ -61,7 +61,7 @@ use vello_cpu::{Level, Pixmap, RenderMode};
 
 mod renderer;
 /// PdfCraft patch: exported for its regression test.
-pub use renderer::{image_resampling_size, tiling_cell_scale, usable_cell_scale};
+pub use renderer::{image_resampling_size, tiling_cell_pixels, tiling_cell_scale, usable_cell_scale};
 /// PdfCraft patch: exported for its regression test.
 #[doc(hidden)]
 pub use renderer::set_skip_offscreen_paths;
diff --git a/vendor/hayro/src/renderer.rs b/vendor/hayro/src/renderer.rs
index 8909cb62a4..242c54ec2b 100644
--- a/vendor/hayro/src/renderer.rs
+++ b/vendor/hayro/src/renderer.rs
@@ -1302,13 +1302,18 @@ impl Renderer {
                         xs = tiling_cell_scale(xs, t.x_step, MAX_PIXMAP_SIZE);
                         ys = tiling_cell_scale(ys, t.y_step, MAX_PIXMAP_SIZE);
 
-                        let x_step = xs * t.x_step;
-                        let y_step = ys * t.y_step;
+                        // PdfCraft patch (25): the cell pixmap repeats every `pix_width` pixels,
+                        // so one step must be exactly that many pixels. The cell is drawn at the
+                        // scale that makes it so, and the paint transform below maps the pixmap
+                        // back onto pattern space: cells sit at whole multiples of the step at
+                        // any device scale. Drawing at the unrounded scale repeated the cell a
+                        // fraction of a pixel too early or late, and the error grew with every
+                        // step away from the pattern's origin.
+                        let (pix_width, xs) = tiling_cell_pixels(xs, t.x_step, MAX_PIXMAP_SIZE);
+                        let (pix_height, ys) = tiling_cell_pixels(ys, t.y_step, MAX_PIXMAP_SIZE);
 
-                        let scaled_width = bbox.width() as f32 * xs;
-                        let scaled_height = bbox.height() as f32 * ys;
-                        let pix_width = x_step.abs().round() as u16;
-                        let pix_height = y_step.abs().round() as u16;
+                        let scaled_width = bbox.width() * xs;
+                        let scaled_height = bbox.height() * ys;
 
                         let mut renderer = Self {
                             ctx: RenderContext::new_with(
@@ -1332,7 +1337,7 @@ impl Renderer {
                             preview: self.preview,
                             image_transparency_stack: Vec::new(),
                         };
-                        let mut initial_transform = Affine::scale_non_uniform(xs as f64, ys as f64)
+                        let mut initial_transform = Affine::scale_non_uniform(xs, ys)
                             * Affine::translate((-bbox.x0, -bbox.y0));
                         t.interpret(&mut renderer, initial_transform, is_stroke);
                         let mut pix = Pixmap::new(pix_width, pix_height);
@@ -1341,14 +1346,14 @@ impl Renderer {
                         renderer.ctx.render_to_pixmap(&mut resources, &mut pix);
 
                         // TODO: Fix these
-                        if x_step < 0.0 {
+                        if t.x_step < 0.0 {
                             initial_transform *=
-                                Affine::new([-1.0, 0.0, 0.0, 1.0, scaled_width as f64, 0.0]);
+                                Affine::new([-1.0, 0.0, 0.0, 1.0, scaled_width, 0.0]);
                         }
 
-                        if y_step < 0.0 {
+                        if t.y_step < 0.0 {
                             initial_transform *=
-                                Affine::new([1.0, 0.0, 0.0, -1.0, 0.0, scaled_height as f64]);
+                                Affine::new([1.0, 0.0, 0.0, -1.0, 0.0, scaled_height]);
                         }
 
                         paint_transform =
@@ -2186,3 +2191,26 @@ pub fn tiling_cell_scale(scale: f32, step: f32, max_pixels: f32) -> f32 {
         scale
     }
 }
+
+/// PdfCraft patch (25): the side of a tiling cell pixmap in pixels, and the scale to draw the
+/// cell at so that one `step` spans exactly that many pixels. The pixmap repeats every whole
+/// number of pixels; drawing the cell at `scale` itself would repeat it at `round(scale × step)`
+/// instead of `scale × step`, a fraction of a pixel off at every step (ISO 32000-2 8.7.3.1: cells
+/// are displaced by multiples of `/XStep` and `/YStep`). The side is kept within 1 and
+/// `max_pixels` (itself at most `u16::MAX`). When `scale × step` isn't finite and positive,
+/// `scale` is kept and the side is `max_pixels` for an infinite product, 1 otherwise.
+pub fn tiling_cell_pixels(scale: f32, step: f32, max_pixels: f32) -> (u16, f64) {
+    // A whole number of pixels; `max` and `min` (not `clamp`, which panics on NaN) make a NaN cap 1.
+    let max = f64::from(max_pixels).floor().max(1.0).min(f64::from(u16::MAX));
+    let (scale, step) = (f64::from(scale), f64::from(step.abs()));
+    let exact = scale * step;
+    if !(exact.is_finite() && exact > 0.0) {
+        let pixels = if exact == f64::INFINITY { max } else { 1.0 };
+        // In 1..=u16::MAX, so the cast is exact.
+        return (pixels as u16, scale);
+    }
+    let pixels = exact.round().max(1.0).min(max);
+    // `pixels` is in 1..=u16::MAX, so the cast is exact; `step` is positive and finite here
+    // (`exact` is), so the division is too.
+    (pixels as u16, pixels / step)
+}
diff --git a/xtask/src/demo_pdf/mod.rs b/xtask/src/demo_pdf.rs
similarity index 100%
rename from xtask/src/demo_pdf/mod.rs
rename to xtask/src/demo_pdf.rs
diff --git a/xtask/src/layers.rs b/xtask/src/layers.rs
index 8ad15733a2..b961ebef66 100644
--- a/xtask/src/layers.rs
+++ b/xtask/src/layers.rs
@@ -182,6 +182,34 @@ impl std::fmt::Display for Violation {
     }
 }
 
+/// Layer and testkit rules for one dependency of `c` that is itself a workspace crate.
+fn check_workspace_dep(c: &Crate, class: Class, layer: u8, d: &Dep, out: &mut Vec<Violation>) {
+    let dep_class = classify(&d.name);
+    // Test support is a dev-dependency only (`Class::Testkit`) and so never reaches
+    // the product graph a standalone crate publishes. Checking it against the
+    // standalone allow-list would stop `cos` using the shared oracles in its own
+    // tests, which is the one thing those crates exist for.
+    let testkit_dev = dep_class == Some(Class::Testkit) && d.kind == DepKind::Dev;
+    if matches!(class, Class::Standalone(_)) && !testkit_dev && !standalone_allowed(&c.name, &d.name) {
+        out.push(Violation::StandaloneHasWorkspaceDep { krate: c.name.clone(), dep: d.name.clone() });
+        return;
+    }
+    match dep_class {
+        None => {}
+        Some(Class::Testkit) if d.kind != DepKind::Dev && class != Class::Testkit => {
+            out.push(Violation::TestkitAsNormalDep { krate: c.name.clone(), dep: d.name.clone() });
+        }
+        Some(Class::Testkit) => {}
+        Some(dc) => {
+            let to = dc.layer().unwrap_or(u8::MAX);
+            let ok = to < layer || (to == layer && sideways_allowed(&c.name, &d.name));
+            if !ok {
+                out.push(Violation::Upward { krate: c.name.clone(), dep: d.name.clone(), from: layer, to: to.min(8), kind: d.kind });
+            }
+        }
+    }
+}
+
 pub fn check(crates: &[Crate]) -> Vec<Violation> {
     let mut out = Vec::new();
     for c in crates {
@@ -198,30 +226,7 @@ pub fn check(crates: &[Crate]) -> Vec<Violation> {
                 continue;
             }
             if d.workspace {
-                let dep_class = classify(&d.name);
-                // Test support is a dev-dependency only (`Class::Testkit`) and so never reaches
-                // the product graph a standalone crate publishes. Checking it against the
-                // standalone allow-list would stop `cos` using the shared oracles in its own
-                // tests, which is the one thing those crates exist for.
-                let testkit_dev = dep_class == Some(Class::Testkit) && d.kind == DepKind::Dev;
-                if matches!(class, Class::Standalone(_)) && !testkit_dev && !standalone_allowed(&c.name, &d.name) {
-                    out.push(Violation::StandaloneHasWorkspaceDep { krate: c.name.clone(), dep: d.name.clone() });
-                    continue;
-                }
-                match dep_class {
-                    None => {}
-                    Some(Class::Testkit) if d.kind != DepKind::Dev && class != Class::Testkit => {
-                        out.push(Violation::TestkitAsNormalDep { krate: c.name.clone(), dep: d.name.clone() });
-                    }
-                    Some(Class::Testkit) => {}
-                    Some(dc) => {
-                        let to = dc.layer().unwrap_or(u8::MAX);
-                        let ok = to < layer || (to == layer && sideways_allowed(&c.name, &d.name));
-                        if !ok {
-                            out.push(Violation::Upward { krate: c.name.clone(), dep: d.name.clone(), from: layer, to: to.min(8), kind: d.kind });
-                        }
-                    }
-                }
+                check_workspace_dep(c, class, layer, d, &mut out);
             } else if layer < UI_MIN_LAYER && is_ui_crate(&d.name) && !(class == Class::Testkit || d.kind == DepKind::Dev && d.name == "egui_kittest")
             {
                 out.push(Violation::UiBelowL7 { krate: c.name.clone(), dep: d.name.clone(), layer });
diff --git a/xtask/src/parity.rs b/xtask/src/parity.rs
index 5466776102..ac32f32e85 100644
--- a/xtask/src/parity.rs
+++ b/xtask/src/parity.rs
@@ -104,6 +104,18 @@ fn valid_milestone(m: &str) -> bool {
     m == "none" || m.strip_prefix('M').and_then(|n| n.parse::<u32>().ok()).is_some_and(|n| n <= 14)
 }
 
+/// Why an `evidence` entry (`path.rs::test_fn`) does not resolve to a test in the source tree, if it doesn't.
+fn evidence_error(ev: &str, repo: &Path) -> Option<String> {
+    let Some((path, func)) = ev.split_once("::") else {
+        return Some(format!("evidence {ev:?} must be `path.rs::test_fn`"));
+    };
+    match std::fs::read_to_string(repo.join(path)) {
+        Ok(src) if src.contains(&format!("fn {func}(")) => None,
+        Ok(_) => Some(format!("evidence: no `fn {func}` in {path}")),
+        Err(_) => Some(format!("evidence: {path} does not exist")),
+    }
+}
+
 /// Validate features against the registry, tool table and source tree; returns the errors.
 pub fn validate(features: &[Feature], commands: &HashSet<String>, tools: &HashSet<String>, repo: &Path) -> Vec<String> {
     let mut errors = Vec::new();
@@ -143,14 +155,8 @@ pub fn validate(features: &[Feature], commands: &HashSet<String>, tools: &HashSe
             errors.push(e("shipped features must cite at least one test in `evidence`".into()));
         }
         for ev in &f.evidence {
-            let Some((path, func)) = ev.split_once("::") else {
-                errors.push(e(format!("evidence {ev:?} must be `path.rs::test_fn`")));
-                continue;
-            };
-            match std::fs::read_to_string(repo.join(path)) {
-                Ok(src) if src.contains(&format!("fn {func}(")) => {}
-                Ok(_) => errors.push(e(format!("evidence: no `fn {func}` in {path}"))),
-                Err(_) => errors.push(e(format!("evidence: {path} does not exist"))),
+            if let Some(m) = evidence_error(ev, repo) {
+                errors.push(e(m));
             }
         }
     }